From e759efaeb2054a1bc32ada0ddba6cd8987538754 Mon Sep 17 00:00:00 2001 From: Ben Lincoln Date: Mon, 3 Oct 2022 13:11:46 -0700 Subject: [PATCH] v0.41 --- asminject.py | 57 ++++++++- docs/Partially-Modified_Function-01.PNG | Bin 0 -> 100883 bytes docs/examples-python-extract-and-decompile.md | 28 ++--- docs/how_asminject_works.md | 113 +++++++++++++++++- docs/version_history.md | 6 + 5 files changed, 178 insertions(+), 26 deletions(-) create mode 100644 docs/Partially-Modified_Function-01.PNG diff --git a/asminject.py b/asminject.py index f7c31da..3f29902 100644 --- a/asminject.py +++ b/asminject.py @@ -12,8 +12,8 @@ BANNER = r""" \/ \/\______| \/ \/ \/|__| \/ asminject.py -v0.40 -Ben Lincoln, Bishop Fox, 2022-08-05 +v0.41 +Ben Lincoln, Bishop Fox, 2022-10-03 https://github.com/BishopFox/asminject based on dlinject, which is Copyright (c) 2019 David Buchanan dlinject source: https://github.com/DavidBuchanan314/dlinject @@ -151,6 +151,24 @@ class asminject_state_codes: self.message_type_map["pointer_to_string_data"] = self.state_map["switch_to_new_communication_address"] * 104 class asminject_parameters: + @staticmethod + def get_file_as_cstring(file_path): + result = "" + try: + with open(file_path, "rb") as input_file: + try: + current_byte = input_file.read(1) + while current_byte != b"": + result = result + "\\x" + '{0:0{1}x}'.format(int.from_bytes(current_byte, "little"), 2) + current_byte = input_file.read(1) + except Exception as e: + log_error(f"Couldn't read binary data from file '{file_path}': {e}", ansi=injection_params.ansi) + sys.exit(1) + except FileNotFoundError as e: + log_error(f"Couldn't open file '{file_path}': {e}", ansi=injection_params.ansi) + sys.exit(1) + return result + # because random.shuffle with a random function is deprecrated in Python 3.9 @staticmethod def get_securely_shuffled_array(arr): @@ -378,6 +396,11 @@ class asminject_parameters: self.state_backup_restore_instruction_list = [] self.randomized_backup_restore_instruction_list = [] + # ARM-specific options that are (more or less) independent of the overall architecture + self.arm_backup_s0_to_s31 = False + self.arm_backup_d16_to_d31 = False + + # 512 is the minimum for the x86-64 fxsave instruction #self.cpu_state_size = 1024 # Might need to make this dynamic based on the stack backup size @@ -612,6 +635,10 @@ class asminject_parameters: self.stack_pointer_register_name = "sp" self.general_purpose_register_list = ["r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7", "r8", "r9", "r10", "r11"] self.state_backup_restore_instruction_list = [ ("stmdb sp!,{r0-r11}", "ldmia sp!, {r0-r11}") ] + if self.arm_backup_s0_to_s31: + self.state_backup_restore_instruction_list.append(("stmdb sp!,{s0-s31}", "ldmia sp!, {s0-s31}")) + if self.arm_backup_d16_to_d31: + self.state_backup_restore_instruction_list.append(("stmdb sp!,{d16-d31}", "ldmia sp!, {d16-d31}")) self.flag_setting_instructions = [ "cmp", "cmn", "tst", "teq" ] self.no_obfuscation_after_instructions = [ "ldr", "b", "bx", "bl", "blx"] self.populate_randomized_state_backup_restore_list() @@ -2027,7 +2054,7 @@ def asminject(injection_params): time.sleep(0.1) log("Process is frozen", ansi=injection_params.ansi) elif injection_params.stop_method == "slow": - log("Switching to super slow motion, like every late 1990s/early 2000s action film director did after seeing _The Matrix_...", ansi=injection_params.ansi) + log("Dilating time relative to the target process...", ansi=injection_params.ansi) try: injection_params.set_dynamic_process_info_vars() @@ -2172,7 +2199,7 @@ def asminject(injection_params): # cleanup os.rmdir(injection_params.freeze_dir) elif injection_params.stop_method == "slow": - log("Returning to normal time", ansi=injection_params.ansi) + log("Un-dilating time relative to the target process", ansi=injection_params.ansi) try: injection_params.set_dynamic_process_info_vars() output_process_priority_and_affinity(injection_params, "Post-injection") @@ -2462,6 +2489,9 @@ if __name__ == "__main__": parser.add_argument("--var",action='append',nargs=2, type=str, help="Specify a custom variable for use by the stage 2 code, e.g. --var pythoncode \"print('OK')\". May be specified multiple times for different variables.") + + parser.add_argument("--var-from-file",action='append',nargs=2, type=str, + help="Read the content of a file into a C-escaped string for use as a variable in the stage 2 code, e.g. --var-from-file pythoncode '/home/user/exploit_script.py'. May be specified multiple times for different variables.") parser.add_argument("--plaintext", type=str2bool, nargs='?', const=True, default=False, @@ -2543,6 +2573,13 @@ if __name__ == "__main__": parser.add_argument("--use-stage-2-source", type=str, help="Debugging option for issue reproduction. Path to a pre-existing stage 2 assembly source code file, e.g. the result of adding --write-assembly-source-to-disk and --preserve-temp-files to a previous run of asminject.py. Note that you *must* use the '-post-obfuscation-pre-replacement.s' version of the file or injection will fail.") + parser.add_argument("--arm-backup-fpr-1", type=str2bool, nargs='?', + const=True, default=False, + help="For ARM processors specifically, back up the s0-s31 floating-point registers before executing the payload, and restore them afterward. Will cause an assembly failure if the registers don't exist on the target hardware.") + + parser.add_argument("--arm-backup-fpr-2", type=str2bool, nargs='?', + const=True, default=False, + help="For ARM processors specifically, back up the d16-d31 floating-point registers before executing the payload, and restore them afterward. Will cause an assembly failure if the registers don't exist on the target hardware.") args = parser.parse_args() @@ -2552,6 +2589,12 @@ if __name__ == "__main__": for var_set in args.var: injection_params.custom_replacements[f"[VARIABLE:{var_set[0]}:VARIABLE]"] = var_set[1] injection_params.custom_replacements[f"[VARIABLE:{var_set[0]}.length:VARIABLE]"] = str(len(var_set[1])) + + if args.var_from_file: + for var_set in args.var_from_file: + file_content_escaped = asminject_parameters.get_file_as_cstring(var_set[1]) + injection_params.custom_replacements[f"[VARIABLE:{var_set[0]}:VARIABLE]"] = file_content_escaped + injection_params.custom_replacements[f"[VARIABLE:{var_set[0]}.length:VARIABLE]"] = str(len(file_content_escaped)) # attempt to autodetermine architecture unless explicitly specified architecture_string = "" @@ -2570,6 +2613,12 @@ if __name__ == "__main__": log(f"Using {autodetection_string}processor architecture '{architecture_string}'") + if args.arm_backup_fpr_1: + injection_params.arm_backup_s0_to_s31 = True + + if args.arm_backup_fpr_2: + injection_params.arm_backup_d16_to_d31 = True + injection_params.base_script_path = os.path.dirname(os.path.abspath(inspect.getfile(inspect.currentframe()))) injection_params.pid = args.pid injection_params.set_architecture(architecture_string) diff --git a/docs/Partially-Modified_Function-01.PNG b/docs/Partially-Modified_Function-01.PNG new file mode 100644 index 0000000000000000000000000000000000000000..0e81f6451b14a2a428ad9faa5c58e8d6e3a4c8fb GIT binary patch literal 100883 zcmd3ObySq!_bvvYAYc&EN;lHd7Tw(--Cfcm0!qqI(kNYnbPORP-7z4IbPY%hG1NUH zpU?OH{<-U}yY5=QduNFZyz{>AdC%Er?`J>z*?d%1l)}Ry!@|@FrHX-psf2-X zz4jIs_{}TZJM!S$Z6|3RR}2i?`{=K0!!!P8;FqLs654KRjuvj7#xCXmcZ-@zgU{YRCzwnlKECEEDSR{i17LPU7K5v-+%h_>HUEa&kprVtQQQ=9?`v> z8_+G5SV^ro67%UdD-o#(e=I0CK?8<_emxUwA9lEUi-9p6bxY~m)eqnCf2jTQ>u*7S z2>*Gz^+*KspSQyQjUR0-t0YI?HuHG2NK1)}iz{d54hF{CsgTgn(63*=I;`pb9qc>@ zBq4#JVnTni4}7@R-ps;c_D_}k6!yPEe&~f>x9K(!QBm_J4`pGb;3s+(diosg?#F*0 zY}=$Gic)R4J6`VUSYd6Gh{dGXKj;5?{sw(M`sHyq{rc6rx0LVmuHIq1#{SLx&)fe; z9}P9N7Wg}Yx3IQK>k&dy(t_DWpCX^5?VK43jPD9GSIZYym?M{HvoTu0O%^#>ZLeo7 zu$tR|9Mh9kRMdR+>Qz}t-pi0XLrFZAdyOl#UYBu|yhm|x<4gLK1 z0NFtupg&$G>T@`%=h*0OORg>}iAcQsM6@C0_fO4E+0 zVTX2mdoaVYN=h|8c5Puq$^7=o6qJ=uwHwt-f+Z{EWpB}L?Gs`3;CDBia%u|P7 z+3Z{4S0{VRaPW*W!@;;Dgw)if@892S>*!z=5YVz6hibqJHL7gjEbd@3v^T4@*&x}e zsi`LHHTmcv6>1a}rH@ot4&1j<*yT#;8;5r&r0`coieNhZ`&>?;R)d*=noxb6dF1}; zz-AX?#^~O1Pkd5R0f#}o)#b&x&1k*~bLHOH-rnBuAz}(xR?dodA_s=D$Ui&Cv$8dm zz!nSu2NySX$V$C61P?hZ$5~(lFAO$(Kt@)W;g6CrHZ~56ib{x$jV;tFg@WtY&VLUa zFXmxmlc)AS{t`tc%Hrtg$Y(ny&)ImO>O89%bBsc5VH;?J~2(iOBI~x;_R#fW^eS%OKj2O`JkHlZQMlg;O0FEG7!|!PHDM$ z5Ajn*5fS~VYWr9i%qQ^3AHDL@(#l1eCF-Syq7tuOtz|`vsY*+KNKH$F!#o`uj~Bwn z?WDjjEC$j`Iy;uG!s1-Ldy!(A zP>ybu&4lFRDOg^CTHeN=->uv!eP9I>41ISc_^bxMZ=akVBGkZ@Su_f>p$0G(9v-!k zJf-mvJn}d&Y6gX5tG%VJJtVSmrSZBa`AcAfIhEvSf0+5^CMG5`GjrFWtGap|ixyNr zjQu*){_J=cb+$i1Z;(vpFWPHSQSX5$1olDn)Z)oQUbD`-?1l}s-^-jA+pWinb%GN% zfB*ghrlvrv)X*cEfRy`{_}QPAfz@P@k~(a};2$2vQ)Te0R`fL=Ijv;5zE@~ z?qW5cF((P|H0UYi<*oeA71WXmJb@K(r5h6!c^4O_J1=%x=jM!n#Xz#b5hh+<^+VC0942a7ItalGjJ+j_PUJrpJ;>3CKx z^ezQq$!+21ZF5V@O|Sx5`zw9$VjUhCRq%$0iVB*a&m;o@Q$IaDZD(%SbZB9C;^5$b zbL*D!>(`lV#NjkFG=%r=eHk59M{dC7z{GiuGPO568Mfjrl#OR`ad8<2-WhGRwY5)? zo8wA))plK;3cxsl8!?^wRUjEjR;X74RaH|Xx_|%c&!4X-g+1h*ote zV9L7t`!%(-KUdpLe8nT@U;9;ND&)NI9{6;h8iBB9Z zVNma;0%ig|U*IfrGqZe)zGO(Y_~lu}cRut%3yWL|3W`dTHXJZ&Yv2GU8@wv+-@kv* z!`Yngd$I?~=4?Jw753b&G=NzRef9Ng0M6F7dUtPie@Kd2!_BRdnA5NrL@yTLNlTkh zg>=>f>7vP^J|16=NFP4TZ@#?HD=RA#a#{L-zUmKLPU-TH#c*PFmKOupJjJeX+;_^= zAOf*ZW(K%>GoEwoPG_e(&52-B)7jQ~*MV?SdqjV zy$cH3Z@ifG*_p_F<~Utjrag%}&Fm08xA7MZ5w?KcLZ>5jM3k#hq>1({Q51qEM{mH& z5VL7#f)KZPus$LyFR!ku3bEgCnv$xiJNZ&Y0KE8*Mr@MPRSOsow?zm5%oc1Fzw;x>r&$q&|FJ8O@o``O9MKBn>9Kc-FAKg?? zR2=&rc%#aBQBqHE9Fmk|J@t%{^ARj<**?PMWHKAV$LqHgBXzJCElx~UJR5;a!eRCO z?KNPW`|d~fDqdb*GmxPifgf{obBC8br#zgUZl0b4H6H6FaW&O8V2|O7GVbh~@Ta){ z{(%Wg(I;x3n9w05C9T==!*tO4cWm9u!VIelWi^bBVaM?)PvJ#c1N`-)0|QDWx>aar z2(NWE1#6-JK+gyW+j|DFH98PCq|=6nGwQ%vhUMFD4PeP`f99XdsMfhG6H-tV=PINW zT94!ws$_+L(B4+Gjq>NSsL%l;8mV(#wR5krn^0xftyIpEj8ret<--G!HYO%Uz}d1U z@rPt~ZcdI2i!a@3$)}@Kqmy)_?Y#jxeSQ6yA0s`U9M~5!|AMl(o*S8igM%*ydT^g{ zW{{l&VE60Yh)gWQgu&_1#6;b9TQM=Q>dU$9-*W(D*!`Ya8_L>mOeaajrxa2TC*kC9 zLi9yIe1Si*Z&|-Q4Y(Yrwmn@2;L@S?EXBP-?jE7UtfaC)g~)Ri0CAG~R<5^PE^}Nq z=p(|hF%qX|!z=%qt`jCm74>d;o-l}Nb>oI{%q>}h2d(DDnd0q8cUkV9c=787Ha=lp zA3Z&QGX&yi-{@?WlWJP)>DY~$^dWp^6(p&Keap0LxVSe#6sb(-@8LuQi$}}nw1qeil3f-naoqAfg|Hb zlSLmHY?ZM3%dftN!XCx;$)~`bG+LM6tIPMn$H#Xr%T~Sd{ zhMS0voQVgLO!;v6YjPQ&WsL@Siqg#YyrEu@RD4 zVwY#GQ)M6$$d+UI0pO|LRNs8ELLSd)WC(Ikk12kDNo2XUa(V~Z+(|z~4e8&&BCe$E& zA^@(G0uO25p;@f`I3VD%C~B#Xyx@55@a z%&PH!2|}9vrZNBjU6B z^#tJQ(dvlzZr0gb5u`kOn7dl!3dxpWK0qSCog{BF+fawl`BdEE4^XCq!Lb_=}?!&dtiwDbzMjOE4u;^76qrG#*MDgd(5A~Fh z+pwLLsrhw8&Dd?wc-oA8EJpfz-mNzyEi;LN&9M%Eo=3JHWPl#W`uaL*A)FIE z`tG(i36MWli#fZw^^!~`yiYXrmT_!4$t^E0AFZ@j6BHH(Y2)}9gOZZc)Y`y8B`{2l zQbPk^JSfy=DPO>aFYuZm81(St9Ls`)bbO&L-2HG%r>?%fyRT0{M@Oen`OAx@Pw;e* zTiJHUF?%Db#@&FQ(l0q#D* zJ_XWNA90S=?QJN)b9lfBgCPKG2HEB}%se6%^+B+6k~ya@fjN#g`grP5uZpI4Wm)FP zWsvyzJq1XWUHjWJ;I(2W?8d+%5RsBH$9B;X5D*ogt36<})*(x)TLjcI5 zsi+tQxDt@&?_6Kqnyynr?+<0=PeLGp%5G}ZK)Z-m0&ylTE)@{{n0AK}0X~EOZVg>t zSojK%#{{BA1o*1SGSg6yU;xPG3wOmu+W-K4U1r?O0O+^0vFhV`xROKt7137q1( zfB8wzFHi&9e4UE0oSBI0SCgQh*cMK(jvOCP^xy$AY+%*<*&F8 z>|Z(+qo!haF=(_o=C{w|rYIPCT;FXBvfZv0Y|k!MI7@JB{K*ROyek z#wlb}UCN8t666;3(!Cf!x;8otp+7yCauiVI410O9M~p{p2$F9tl_YM(?(Xun(&iV) z-=TT3Fl&sr_n-X@!I{70({zoFX2ze++3Ent==AvI>VT!yIFv`X;i)O@lchW zjsdNt+iAD1L()4ZJ13i^M}-Ek?qp%l2;i2N5a*Y1>Dvy%vkhK+ zkq?Jt0?vuNULqG(PL8z?_6J@9YO2+@)W@stZu&yCT3%F^4Sa97&b45&QMjlw<;FDM z)m##$WM*~)@8=W^Aa_l0od4i=oOos`KxiS`+8r}1C!HNe_Z$F>fYjt6l;6HdU0t1- zzx<}#rlvuEe}A%oW1~gCi2JSvNt$pXhYSi)bBoX63`!Ty&0`>2l=Q79yUDM_=w`!i zdv~~Tb9jGRtYYeGb!v<=wX2QH4*x(x$UKK?VA6_cxk;w z9}Z`m=B#&MpdloCvE#uORdhHH69>oYf)YOcD2qOU);JrVowfnQ?ZE0CUEZ+$U5rfi zf3D1BY)ouF=dYb6T%!yxT*eVC)#0(kBOiOlu6wg{eEels7b(u|k8sa9%E63)T)FOM zf2-G-Dg+|RFY(CKm4k7%_YOT`y6EWX%m71V*po;NPZymC9$VeA8y@@;2u7D)sKHt~ zI%*dj%D6Ue6fM`yzUSxdv$~O!_|APml#gBp*xpdUg{!sMdZ9)~mAPE<2HbV@!@WrN z?P)KN@0-PJI5|Bja5NG}?igvgZ)$#m!75Bl)v8RTvR4Mgvp?LD3$$&IEGqu~JxsUZ z_>*F)^!PVpIK0Nu023=gLsJt9$gBv9{^`f0iCTwDqmP!>IjU(7=^k5CQ&e8T z9u}!Evb(qnT(Ok{LUL;>5SPN9vll903W9wvHvxfK3j+m+szLIF+RX20dT+X{#tDAV%U>#EGoQpw87 zj$fQ}>DKI6g=(?~Nk-Zf^V?rv-rOu$T9QZ1QD*_5_SR#o zb1;6O%4|rEQv*C_%}T#$=FguLkyHj+GxcytMh2`uO>U&LnQCadjuG7N5q79Pm|~e5 z*!*CJ%tEq1eR4(Z^~_AdjwB^}ba|aJOLeR7s8`u6FC!2PT3Xm`9hPg;b#C@EWKik= zk*wn4cSAoqV~8|r9L#}VlAo&1F{*I9ej|s=lq}!0qYxO1mb`o+KE>0#o#wfsmY|eQ zzz$OT{;7e)at8kj!aB*92xpmWILX#5RV??x9uTLd6BjpP*LG5tiZ(>C2{>+lZ3!Z0 zqFG2?>HVlWRlQ9nSYD9KyPG&UoqL&Zm<*uTzVI(v`T@n?{kz6NWoJu_sct$)w8}8A9ZV>&bzaPYvPw(om$)D zMmytOu@*9rme;D$RAL)bHBlSzqDN9v%p4qQ_wIe1Y!G}w&i|81G>sGYt;kizE&J&? zGjkFoJ1*{>ac;}&;r)T};ZSNZHb7tk#$tVK=oX)?rd*m()nKi&D6jvSZ{Oz_aVxvA zUOgktbifM_o!o6etse0p!0Jz20KB?J$q1tFxOD){+R-5oKh z-{@U6_N(m3W^K^1%3jZ=X%h?I?u)~WE{oVj>Pp{cHZl9glCb}PXdiMuh#g)sH7?}d zow}o)rx=Jj7zxF-ANl!_luXncn!w(Z;iOr-Ryc0BS=t(^)M-|}HseX1P_&uzs7`@= z{Y$8j)vs?lvT{8`5u^kK7JYAh&E2-ARgY%%)Xq`o*%1+Ev~H9X^2xjffwTTT`5^J@ z&rnjfS|bHqjTVSds!HNBFHJl8;b$jY<7;raWC4Ofa>qMm=e{SGJUl$eSs!6K8By=i z@jt)Q-1e44FmJxG>W;f8)Yw#=qNQyfZV4K*+z!OyHRK${KQD_^uQYAJDO{;N*
6|F znB*H9{DOej?8sx@tOX+uEijSDVBO}@R!DIGg)nk+{?!1EnQ3|N%X5A*@upI`^{ok4 zAwMC_qv;XtnffY_NgD8({1iDy*jGiiq9DVzgj^ogeA$P2^ z3>z(M2htlb;Ki012paKb97y*3d_4|6G-angBS5S$mXT*^#bWqio$_EQR+L@_P*VVH z=%fj0d;*)ihf~fdpixpuq-@3^;QHmOe|C@jM0p*!1ig%q2OISJu1eN*kSt46icx&o zT?`maU@z4M82^jcOT1jvlOMf$hs{KbvX+;{XL4Bflz5a{l+5gJ1T;q7*e8 zpgI6Y!RK4tk?rI`2NRaGRpvcXLcYhtR-8dC+0o+L+1S)}d4q#Y3h8Gl{ElK-TU+|t zye4n{)dFY~E)^)I722E~a{!jfC1#sPY&J8BQhexv67R^`kO6YSlC{#TOJ!8vW&=?p0G1JCPWXF={X?z;eB*kKc)&>$6u55+%F43TQhaC3 z5GnZc$10M#Sy`_pJ)z4?C6>V-U_Na13JY`5Q#)6M&)d(px9XY z`7^H!G4Ni7v{L+Vo`HkmL?f|6z>G38Z2K3r!Db zY7D_gWKL9s7Wtl(qgP!?{5-PSK3vtq11jWkXVfx7^efaL#da`rMz{7!0LDcx4(bAls51F%=g9#&kwcUiaK755%Td!xHxKd^_V(nBN?!oYkEK?xW|f^ zB%;N}F7VtTL(K<;B71rK_?%wbo*chf4(ROjjmFr&1DWG)jkvz(!!qRpI`v|8?g+Rki?_u+&Zs`*mb?g-_)2%Qzc zBNtkS?MU{F*QBoW8YiweNwk-bncJWEHC}R?ujLC7<8HP!^e3L&Zwp zR308Vhn&0lP>Lh}$nmaUmH)XIfT^;SPe0{O>oaz5 zzlPiKADJl~fVa_GExM2@`%xfZ%ESPvBw^BT@RK9>7^_T^=PkRNLAuFz%1Fu>Mev;lcZJkd;| z=iTBJ?8#5Qq=|@3AGBciaE3&T9kJ3&BnxoL3JT&@y>4j+HsXieA8_4@dkiW^F5rtQ zCtKe}O1jh8eXI86`Du-sy82htQHIa1YgYKV&vPiWsM7a@r~YVmlKbHpz$LOzRxJp2_p?& zn|vNy)Z9tM?%CPWTwKh6Pbt+SOHUW0%;GX_f<5#nGegvfLP_0s@Tw4)F4V zO7AU)%;U$5qhDG*@E#5twzLFJe*3NZX1bv++|UpCJUBQF#4hp8EghNiLm!*MqNX$M z7YZrRk>(5dO9D}KEoxsUbuHa$I~aq!c8cRkh$mqCbnL{936wjVGfw+Dt9=R%=&UkLr#~ALq`k9G0LK1=A| z)K~rWg96R4IJIt!A>rSQuaWVyJeY#TL&W!6g0;0a)sOrX|uRGwgnS;9&)QU`6m4MQEY737M6YzMF98#2=J2a;VtV3 z&eA?3-!i0$Q*uVvQf54Bv<&23&<$LQ#B3tg7yFobULITDuwnt~i4B$dZTr*EBqr!( zeM3Vz;Kp=hFi)Q(^rUaVX`Zpq7jL*@heza^=N*Bp;y~Qu3nXmj?vNnK9lPD z$B$z%woy@0F3wy`$gmb$Dk=u#+HW8fC@Gw*@>4JSnr8#YQLl4Jocz6}J&MtriAz%4 z^YE$gR5L$w7a2|hb8Nt4>l_E`gL(dr!4sG!Vii(FFlJtz0 zJ$C#(KoB8MYS~7l&%T&U#_Obl*T z7aQVP?+8+}+6lDL&GE^GmBEdvteyxONyTuu1jqW@OQo|Wk}`G!_I z)-Yt_;}bWcY^XtL04R>6Ec-v3??k&98Et-Od;C(!rt{PF(0ykor%&NMIhiH?evF_f zAq~K=G$bxQKF0tSWiyhSB`Z6b2hzv_(+io zWFmOfvnR>!K##LQEOBKLH zv#+t?Ffzt6C^-~r8Lo3OGH#L(0WJwZ--^jfW_1QNX!@J4mN7kjvEu@v_-U$|nnP2b zwt`IThz)}9^QM|#l1AeD@^iLhs-pu|9@Q$=*6VwJm~_{YSN8`9@~uZ?0YE4*^sj3+ z^q;7IK0X&f4G46`Dgbs7Gd_N{H*Q=KUV-+onM1@q)Sp(l&Ew#ZcAMRWJmjQp5Yav7 z=dLS+`k^CE&Tl7E950l55<`tDqJF-zeY3HWP_)zJ^QtcyKGq(2%4go~eSYqls;XuX zCqU%6x73dLLoI8_4)?u_t7D(r_JYL|>5y3v-Z-HNQ}-TH^+#4bN4FZY@V&o&p+y-@fkVH zkvlSRJg~6#x;XLnK6l?tE(dj{SpO4xc@-7n<&p{A()8WjA8Hj7sI&Tdp>-QSSN0Hc z*j7Tbz5$u*m)>MxTuj$aQEDQhRI zJbV_tBJ76xPBSL+8DW2I^E*2zk$Wkm)=E?RKYd~3%Oz_$&_C+fY|!c1f3iP@=M7Xz zP}g&n%?uucdUcQnRDohhRwxxp#o1ZXVBlbG%MPfa$nz$vL^%}G6kscSIqae{GWYHc z0hLa2uZ33dd%Ae(#&eX0*0Z-6hg*Wsd$gJc`lZ#!dCepm`l;^q&Eesj?qWRj&AAq{ zt_IEiM1q3m%#0lu6*>hF_nF?>+NniB-iPI&Y>A+kxx6^K?{|vOA@Y3x>F5Gfh$N_} zCS>JcW!9&O(JwgtumFS~hdm*iA-sRzXo39+S!p`M>e5r2nR>Gly&Ab;#gk(;m8t6Z zgI*p4kQmAVK!3MH|D-@wH5ICh|3|6i9Wgpo%Dx3GZ-~v|791_FIy=cCqDU2InrIZ( zg^boX($>`zi}{_&K7VdbFXM9*VsuBbG%@yYr-p-lu)(X1MqevAwbEYiGhKmH^aj1A zt@5WtI_uT`57){4;&VlPiebA4h^c2$QCb;IhPwDvBBh|7702j<;>oHaX~^ML9iQ!WYN5FNxHw+G?176vf~`J`3?^vn)3f+71^d<) zE!&YUIyPtC=nao^e`Vj**O~+ell>AA(Ui*^h4wF zBJtgL9N{MP4{{T`d!%BX54j;&sK$6Y(k0*^LN7zc^|j>e3@3yFF=ptiKs~Z+Q;srE& zmHCrj0T$f}eem<6#D0rctNnr?^{JMIr29ZiBHG`b3s}fgV%}6A4ZL9t0QZ;d6e}&s zkT{45B_@!)DFrS%I53DFzwS#Zq^siOP+Y|GWHSQt&=!SLXL;O73fSv+vRB zveM9KHlLNNLMpvn<2dxCRS=WUlLboinou@*CMLs6o14)7w4#l=)%qekom1KiVov;# za85~}<-}k&y7(k^YF9x+s|ND#6z_xlFJ-1MBmJVi!!i&1uNJ-91(xaSSw{X|x@vhB zPCZ6-z#A)RzYVg^p z`>-3-%N1#!Yp@|h-v4A47S=;y+*VYz;n)C^|&fA4eNpnNZGp4=5)bDL(5JkcIH!Jc+LqB zv^0+;gU!KORd=r&NC;Pf7V{3;z2Q+#s=N&KU~_5&7QEBEQ(r8yzMe;7b8*%Iz_AY= z)%2`KuSppwrB{JE0=)TB^xHF?-Ce9m(tYvsKdq)VmH-;uAkp5KWbd?C7qm?xvT+z(%7t%HD@EHG9 zHe=rbqzAbQry62n4rDwl?E(b#D*G!E%#4=RV0}JGMs9pn$--&U0{%_6axMD4qh5Mz zs4L%_KU&G+mnuMhLjb;_eLK|DM)>^CUI1qBtApD}w%%{?%ZV>zCFmNeE~t{0`E~%m zTA-4Zy8)uTpPKvo&=j}J^L-HA8@=ZPJvPP%P$!Lm0gPqj9IBbyR)2FW1r*}l-QCph zse~;+OT!!x;l}_c7AqOCW+v>hpIK$Uan)Z@>0Iu1J zCc8k6Q+luGi2rFJS4<$6a!W!&q5#Od+Efo=I}Y&8QX{`5 z!)E_wAc*loOp#H1M@UXmk%4crK3T@L1(+WuzwPT+*;4Ef%{gvT2>xzb$!$GFVV$9ZX3MBBiD?p zsY!8hRRAp2(DsaqZpBIjAg-emNkx81iHRBNHjBMrR3uCl+Xg{Win@eV26Z@P+TB^} z+xjrP-h;i!xRs3cQD!j&QVvRzss1O+wTIh%nn&B_8d)Kw9y?KEP=mxt@`p@Fgx*V_ z7Xv1ix)mHmATrM$aOna{D5_FXgww|bij-3B+ximD&N8T7sZ;Vl$Eaj@o)S@&m5K}z zt9Q2*@7meP9RTx7;6<%O_f#sChui4&vZVB+H2p9A@*xnMsAtqDRkge-AfPgVLo|1>15q+zGn5sr83#1Dn#E5Gcr0Jl1I2NDue(5p@z z<7|Ef+)(E8Ae%0;Zuq!S#-}zH>jP(%Q%UY3UB2+^*BgLTJZo@Jot{y+z{5T~iaG#j z%FA$Yk{M#xyREk^kn4*j*KUw8JsFf^W}cX=NvZs6-+>UGH5WiIzCMDP6-&&nPeh@wbMM}5-KvduY4@|g zKMVIhg63NEv2=BG7=WtRYJZOP&TNHl1;dM>p_94j*~Uib?kR&*w78)`R8+rilZgCk zzrl%q3Oq|n5b#KH7Z>L75J-M}$YGv4IU+{ip3Pbf5*uW@;C5gHLektUV~ zIu{hJ5tC1sS7r^f5W53h7VuL}f7&$*oxIlf~P$79#GnS!hpR%X3b2KmGB9~dsgIP3fp77cFzfE^JG&~~; zRW^Of=csfXoITZ(Jt%hyyO1Y`#_3T9D@VV|AwTJjw~!ZCT1O071&`|R!<~Vli}Tge zr!UN|Wge6n|J%v;zi3cnd-PY-RR6}SuCwdoE(yBl&dUcD@9|)Zn~srDPZo9$JttvO zKzIa!Kt z@4vG<@F65NmOW?Y7J3@mXhBV#t6}%75vzab|;J{cRC_3sZ7(`UYAZG`5!8+uK?A z`K!Ngf@VOr!+MN)$t&4nZTOQt!tW*X%gZ@SOG|o&(V#H~3=GIVy?ZvVJ9)A~WAcjs z_GDsUKsSO(44GoQvGB-VIpNG#|L8>bpU!ijzt_B*uuA}9M{XV-M;%JZERcsf?;RdC znY&{gufD$O{J~(l2M*9mMK$EOyR8og&l7&P54{pDW9W~7n$XhPo6WQr~KU)|{lxkO6}b`>Le^ z!^r?NC;`nys0n)o=$rz1w|!Z{ZH%_ye{Wj@^ytL4Uep0+&SeSM7;PW_a{%Z+(enQ` zRiF@Rrg}3UXu^z(;Q(ldzjmuk2Ncpw2`&su>H2KT7~f0&-O^!8pv6H0_!5W0J3xdg ziX2sI8>PXh{YS=x@hoO$OE-tJ;m-@Ms+$-Nl>fUPHYb67&?g4gJf_su!$T8vKmk3m zcs>w^w5&>;oHs|7c8vF0-({&NK&!L?l*{4(zD5QmzxIuWd2T0uHxD#BzNu7msZ%${p{&lirfMRo0O(d1S-PE~^qZW?z-SqFd0Wke8;phw>4>Twt5q7oBsppo;cdb#0Og z3;6-`8-HJQ_SddmL-)TJXw|uxgXTE5P#-!Pms7&@un&J<(lN)N#}L7BdDMLA7wSVp zqsseVj#&Y!Eif=pFd?2Q?>kg;g zMc+H-t4e_?y@{!5#YMpOwBXtKx!gA?n!QVvU>u?k5fMM(@OaQG8zBjI_}H1|evZ2Z zY~y2C7>l|v>hS*6=woO=UE2}kiOnbzW*&`;lG<_sdeEJ7A6S$mmK;7lT>&d}+djbc;a`s@e>C(?c>i=_& zbki%Tyl>VcNs#RjaP}FVLBnU|VS{gS(TMP?QJ}B+<&XNm<9PKGKREB-anR6sFo_Ud zO$PYC?B)M@_)bjg_*WM^3s5gq$HF7`Ui|%AURD+>PqFR(y_lmz2L}r>0ghm}4LuuB z=t_vMZfkND9)TEo^>+bsSN%66w63nupWaAGfRY_uoyb!fx*FYqb$XUFqn1VEAy)t7Q~m#n@r8>aTi z&~P1`dF?F@QSN+pb=!B@o!O>_3)BtJ z`QLXztjUT?T)Y^s#qYfE^D-l>BwbXF$9C)%1~KPsXAEtkv!^Em*Dec2wAf_aSPA)V zX#jiQz4U}TJXunnKL<)FVq$R7%ieh@{Eua2cY@qf0yKQwj*z5H5ukqEpIQP0DIb@X z+`8jk^X#WsL{9A(u?V)G?XOg=jjWR6Q%JL}JIvjqm3;sD$-{@@{#2lhmrBkGR4Fq9 zA0L!ai1`Y{ossI)yRlMHrKgIJY7D0V!>C*Q*W6<2cfm@7~F!+&{KQ_!t)eNzjdzM8sOn?X^cdJc78~dg|8MJNRV|v?D(S z$%E2dlW}i~rJ$+tUHRQ<0c=qv2?=twwz5!lSkWN{_2(J{he)3@JMxMH#Ed8<_w5_EN~gTh*j zX-6?86{*(vO4QiD_uQ-Xc(X#9rbgemOl;YQn8k(M}tiWy%7D-qtR;OYN8ft5T)sdHk5@ z&!NW(;1q#2B<%hBAD9bJsPj{y+}MN_dD*azsvP3!8MP-#k2v~2k_Qae*X2C8zo4+( zJ^L^ct3N%`v?rm6j$y@poA~UEO&z-Rv9y$RdmH_X&g-hzL-BJUG0sI?6{?Lwyw(e$ zDJis;1ML;IT0>fEWRVu2-UQ}^cYB*dzu}>h_Ah#~t3Ym&@LYLA@BH-Oz?h>f{{%~9rRiKAJxo7+*K-X%Yh z>wkP)dzU(+A8HUYE;b;L;WJ^@ovA`AurbOkr<7wk0CWVKF)qXguI7=+-U6lX8bsUYKBOlX6yUz@$UZFBK2H_w|nu-;Z)`BeAT$n zNRwYHMNcdQ;&n7b)cd(?HKb5myL^eO-qTTWXO?<#ef{TX!3^mBkR3w-J24D6m%2FL zIse>uLV(4nVAFQ6PHZLM>;=dw?igq&P1iQDltKWuk7v5}NFpHfLoFj1#MaRuh5 zrG?AcaJTn(cjnLTZg-i(=Ge=IKR;af?WB7>eUcJ5C|@LUJQg_^v^?AESuS4w@};R* z?+8n;dMhX3GDkjnG$Jp3BO)uybd3M>C}aL3W5PFgTh+km)0LDoQl1rm2BnKA;9UkX zpKFkEXLFV4!dpS%A1Ee!Rx>iNzFSrP`S~E;>tvZqy+HM`l<>WKtDm`-Et@Vc?h9a< z;SyJxeSholFtYAtv8YcJmmjK>&44W4R{X8Y@@v!qaRgbs>!n;GwA^84`+A0>VKTqF zaeD*@fU|TRduwY?0b$#YO-<2_6to@5^&P`4!n$+(k;KTZAE*P{TORws{7$2Ie2?!} zJ1X@{aYpza8*_#b?DYEVu!DBqhQgSV-t=>f8`#yW!6d|c+c2qpzx3t{)Xfq-fv>jX zo}hJ~K2v{%t0F+%i zP`t&Mf{r91@OLf5bCu>4?TTNh$H0>QiRjGS?0T9%Uq5kL>SX4(`+!B^ST_(xB;^H6 z&uwk+1E6{r_RRD2r@&uIU;^Fl?Ic!k#hPiT+ zZ3}(<-rkh)$R@uXT9GrRorZmKMx}Pu!Z;pw-D4g%E2#v|Qt6JUjB-;c*)P$iO7Sd2 z+BMrUg_=lHmiQ(a7uCcJtFNR> zxvz0@T5gPUDmD8faNVH-pq3nL-jkl~dop~sEAe+Yh z_UO3~c(QP3sV+PkxtWpevb+bHAY-$nN>!n$h{>DSTC1C-r$gn-T6A>NDA#(Y--c)# z9sE+_wcl5w-;{d#=J|8{gPpmM_T@4&(bf(o9l0P!zkYpseMUHrF@3GO%yg*tvon)a3Kf+_(`mm4 zLE2O2K(Bp%*WWMD6Y=Ml>Ek<;lOIFyiktvd{4t`JG%oag?Kj^#1R03r$;&-Qz^6(k zaYNnK?n<8?M(&9u4k~;4UwF}piKX|ZH-;dlIPX%Xy?__a-l6yv=e+2>u(Q*e`MjvJ z^Vmm8hsK3d?H|-C!NAn1$z1Ka%G|r6hs}*~dNfr?N=Zq18;7NJxu=e`?rT=;`tY*o zSn)@Co=?n1{piom#1?``*hQmcQ@>2 z&)Bl0j({;X+Rdg4D;I;m!|{NDZN7(-0P@*Nm;@V}$H;dm>K?5Smz6Rt=yMn-p*re2 zK-2(_xgxLm2K58i_CrL27?Vd?v#A)sJCvxy#^~jq8g8pWmxYD$pwFC5ALfsDnGAhO z#5tQD$~OBqufhgSey^_fPzSu{u^JQr_my5j7U+438XGSHCyrwP!}?~{)%K!F-2bfg zm87BZ)~}OdL%(Ed)1bbBM=L5#O?g}XfGB3F>( z)MjmAI&_Sdmv_>i7z@HY8NovEd=nt6;Wm}L8OtF0vooeoyUfHr3i*JM|Ev4vYoKpX zZ1%@}>OJZ*ql??<KHv#W_m=F(G3^*XiwAH5=SK%h zNM`3KwQ&|RSJ0eE(R@kO|2=U37Oot_emypJsbx>XZ2&zZp$0dOcRS>2wgx7vv~J^0 zDfJ{E-z>$D0aBn#f9ei}HbHFH&*{2NK~Jbtz@2OllSnHpdC_ z3>ym@4*v&rZvj>18twfq15`jz0cqHZpmcXxfV9%x-Q5dN6r>dik(O@h4g~~B>F)0C z`X+m;`<(CGbH}+c#vPY2w!`gOi}!io_2iuY`TGy*&?sSR??Y7 zfA|m)#Gj|;S!&Y+^v@?ocQOIpzG>tdSQH~`M{m`xG7Y&v(r>AVRUr& z5@bHqYCf@TsGecZP6}S?N;yM)cy<~eLK7ZSX#O*9aQ`TLX2d~Z_(s%V6sOiqetYl5 zpIIt#BRYYEY_WTzJYl#|7j<<%Di#wQ-cm#>63>#V5&_JoK| z+4Z|HnV{u*+#9iQRZjaB`|Dr7bx9S&60!~g(lKZfOoi_Qi1wt*?QxY08o92_eGf1y zeI7a&!Tp8>m7$#=YDE0_d=yUC>cE`uRpZ==GZqJawJmP2J&%bHk1k^twnV#ut)sm;t&yup3zM%;x?KLy%4p?r zp^4?oxmbjceRkisUR%I_uwa3CV`Ib7*;%^S+=yN+ z4<%`3P!46hcntI6?xi;5ktvm^rlwK(Qdids{p`Ng5cx15Z5*9HJ)@sEX1$k)apA&@ zVv#BK&6~SC*hJ_P6T%BW!KD}ReZAi61UA@h|Z?55c zK*NgHXT*gI`XFd-s`pcX6%$93;p&@_^7hU$J0#Te>5Y^P&p~!b^7*?fp)^P1OG{os zLFhBhL$8iIlPayOm_FE=4fYJGzdLKlY7Up0>rsfDD?JV1D6-kj z%&L^nqQ3aWxW{dBYK2T^Wl#nIJFnNwdSN$lL${7)q&v5w9QLP0hLFoMp)M_(o3&Us zkC!w$3QU!Pc2|)5Cwt4e%OmAzaGy%0*61ol(-@uTclkz64NjJohH|04WP}Q>Ek@!V z9o=;($2mTRI_4gXhg0AA_YV$kVPiKR?!5Of$wuz2u;lACyFs6W?Z{~quTf-R0`e#w zal9?VsgQG<_J+k+6(NE~ffOOVVxI4?#)SZYnM_=f;B=expT&lM^!6=B$7z9g8|#eY z6Iw2j&ZeecXQ#wPtY#bEcd?o&2U*YXdN^Wu$r7@qqt$@u)Dyns##UD&{}cmQNnXER zE|m-T{@LZY@(Xk>IT`zXNPE3>&6sQUERH@`HziZbUAaz zIC-o)okg?tiDU1|cz2o&G4IE>mBKk&+Kh=WvObydw*n^O;rma7COf(Pv-erXiE+H5W6a`mM4w{}#5HmX@h0Z#!S{%U8#B(VV#`kQ`JhWA(ouqbMRS z-sV!M%yzVAZk$dRMgYq_AnUZ3xT5g1sxn9$>TMMsD1hbH6Xx>Tu_@VFo zBo1lJ_jUn`WQVoqs2Hiukrt%7<28o}*PR~9;NaElk9U|lb`Kyfa!Exl=LErK6O}{O z5P~!0nv7E2E2OP$y2T6YdH76o4vwY!&Cejpr;r`bWs)xwfwe*Y&T-s$Umcqj(HlD#}H1$>R2@ zO@hdRP~)U2a(Ig&Jb>=`^`W%%t@~1=X};Q*py2eP=Kgw^Y(`kqR8TQF6O)giALd9r z|MZv-c99hZTDq^d_X)MS=U4Ha#VW+pr@GZU{9DRbE<4`dFNs)THB~ICIr42B5&Ru* zil9*tciniiLbnUY$7cyb9OzH7{K?3kX2{!#h>7X6MU9~Fk9u5qgpYv=QZuKOl_hq_ zh!A_cNO(*ow>TSg+wA|))HCXM2Sk>=KArlv;6$vqhBzM*cr8s($m zKH~LNQ?omjvfpLOl`^5jzr1{9SWT67f4`raee2^bcudI+!-X`rJdRdP9(E<~a#-6} zourYln|?XDF#hrip-lX%6EjlBI7$SK{PJJyyKSwJrP}pQm}LBdnwol}?$t!3q~ek&riH_V@{(;cyA&#)i-9H-h?fSXjk;l4HddI;yJ7 z%gaXfKYpARo=yc}Bm9X6Pz9tJ1Tw zY*e}lr@IIO7D6VS?>ex&AM%wu%&D;r6r^FbwGB+X`4RFp?$JyHe0#WP5_N|A_h3tL`1}Uc~z&!tYSTw1ZPiM@K!B**S+I|C1LXIp%( zbS|CAVsw3oKVRU?f3|q6XliMxwtUULu6gNjE3Y#v@;*#Kmoj>q+|SBSih>kwP*DZK zh|@qo+jwer9S=tya1Fc+5;(o&!7=Lic3iW8cqv1cX?@hC^1}XdeovG@EXfDhy+-x- zU%q&WhQ-df4FS``NpwG}hvPdi-(H=cj6qEFNU`54_(N+5&74qQcEI}P zW{q(nGxAUy7$^@oGFJ8v=B_<`8l^W@)phTFB*f+uv}%Ihf$-SBIo3c5l*w~cY z`lA&u#G~-P&bBs)NJ=*J^#$y%cwW8wK%;Yn_O?lH9h37mG5@LK1JK4IgaXQH)~d<= zqNfj)PEv)$>K z?@Gyn4ex8v5q@uG5D-5*z4O{TwyvQe)P99fla+9w%uaw#W%l%vxODKPTCbDFy)i6U z%TSjG<-E^MEO_oq){Re2J`1Hzg7Wffz$tOv?#OYlWPO?#_a`9Fnm6bEL-QvFZcJ&NN7otRdc{Xsyb(Zx;nQjHxvQQ-rUq zRy*0;T^Vehj4&WvpHH~6z0^n9aG0fnwZ7GUq*$?U7&znObM2|HuuksuiKC0H?RKF% z?(xR5%1UH#@Kak`R{gC2+|TlWM}&)>%$ny9)YbV+m=4;)nf+5|mdaJ2 zmsaOn&j48YSh_;ZEG%e>ibV-fj&yU z5qmRf85@nrY-~sz zd^2txSnHO(;)SJAo2@oSz*B@xE^ObXj7LJ!>`x$e(C%)JO%i?NGM(Qpsmb21f4J>^ z6(dtzGj65hOfI8n>pRhsVNX*m)ISEt#JCXetw|-wq?GcW*dk$X8LyD@lXz)wnX9QY z$>m_eo7^ep!`l$vC#tH$D^lP8UgGaMya5*HO(LSmoihNIPOQb2J7+Vx9nrmlyT)@A z7;0AZm(84i%DYAtS?U(WjYfzi&B<(Vr6{_VqR)mv;4N-9=qg<2D>q_JZT(NM|!1 zZxiH~;v94*1wv&i1^Q@TTs|v1yLkoqIvn_-1xe#M!~S*jTi6!G>`U^oTcbpHqO2B&7^Dn=$8$Wd9Xs)slBL z3thKqZ}$}V=pHU+sPk^rt;nrtv}-n=j@sMW-lL{Yf4(v=^H2V`zR8&F=FJN?Z*KI_ z(JAhb_mk>WId;7C!|TdLd2oP5*VPrx>G<=au6))=rYL<72Z|n(^!`IyfumVm>)E{$ zRC+b*$<8EMYcI_=p?!`YH#^9L(QLBJ&*~4GA_X||t@md8SlD}C3Y=A(jmt;5r&zM+58=0A!jYKbPNr~eLGSv_XC0NMCR z(jmO_T=x6&-~o*4V{I26fOB0Wd|wWAMrfy}^v9cG_%?H^RFI;5i^KElRAjB-8(=pR z@9kE;Tm7xoo$9V24b_h~TD3(Xwj58NuHy3*G5j-J;LrcFwEcfhu~#yR{=G79LJ)qF zR&m`@#Ni42!>N~YQKsT~dj8kubJ{O9_DT?+e05^^9k_sX!+b9C{1*QC`Om_D|9pl2 zK8ar&pUCsquQu<+02h-HdAR*}4MLfY5R8$rCAoEz3iXdPA+bhVTl*uIjeh*z+E{fp zJmAu$h5zS`_^(QW#3aM1-&%m*Vub&(DB^#5@Bj6(|6g3{U#-O3#t|B3=3tnfRGWc% z>!PxvUSj!jsv&4jd3AdFDe&VhGR#2A^7)TIW0Ms)e3X(=iqk8Y1k81-o4Gm-n_sVx z;T&u{eTw$vkF4Wa3~YYh6c_K2aD{n#UV>j)P2O9qa7A9cNU?OHrAcLfLaR|X3g0KEFXi0ZDi?5}Ol z+qciEaP4*$0OZd^h${t;S!7J|SDz2I0Kjn)piTul!(wB}JW;Px2N%KQ;rZvrsNVTt z-@h%w(=Kqv3z$84-`i(a|2`Fz&KwN^Kv+4cm^nH*ZFI{>;l2P}lJCEw9jY4;E(Zmo zc}9RijFXpilIVYV#~098jL*#}q#^<0NWh{mesk~H)5Q6I@9?6HmDNOqK@3%Q)f33n zKYoKII7|**A?44*Mbq1!?*NoKjv-k>M^_I1SSu(;&hl)o z`kxMHJp@pC+pZlTJ={h0oWR@>f~Nh^8@(UuO_m^f{N%|>c7}2xH89!BYvJ}vk^kP_ zvuQabH}FS+KfP)RS2vISb9Jg)mCie#)hnI<(T)Kp@V{usZlQXtxUB*-(C^;{O2@>+&}vjg0ZcUHe}Byyn9U3e^zew;|2!?|z5in| z*1vuAd{KHL;_&eAX>RrUix)qZ`>m?}SxwxZeEmAJzPCraU_SkOg4xtN+TF5U*Zt9QWYc8%PfLgpQw=$HshiSXyU5~XIyzD4Fg`R+_X)w73toK(j~wOC(J7KE zp8zPpTw#DcKTm_o%HGn_GEgj-#}B6;;n6ZSH2e#Tzdu;78S?_lb*U`zSke}nobC3) z*=Ps$&SDGXDAEBT929epah)dnEUhaTw?@$|ZX*i!gv-dvPY9!%%x=FypCkq;H}c zNUvD_G#4bdXaPi5-iL%dH8!S3kdl&ea&uo~wEWATz$WIaC*G~w^6S)XE)p5?=I7aU zNI=Ip>EBuEi@ifZ5e-pph)!1~0;_XZ-|?E8iBHG$B&>K|rWtjR16s~=#ldr`c) z1Q!-769b_p;#Wsc?B_jNz6hW(M9s*EZ%z(2VCrV-@yektNN={42&82!K0XI73R6&k za>?^+O}NJC*W-h^3)q^In=`sKjo;pQD;6$Zrw#KrS(enCZefpb+BLl_wP}YOE(Zb-kMGS#E^ZEdN-8Of@FtowrK|8j zFdzbnON||nx`{85N1a@jHBBqt_VsL%f*hm{_b*++QXVK~h;D3rrRq6Z!Qgik)85WT zXG&(CvR1sPAhIp;^tAf7oO9S}VuFg8^Twl*GPYFJ0iw4B`Jth`StAQ$)uh)6_g|!k z&}?j^Ef3ngJlNU;J&kBKpK-4(KoJSM)274*^2|f%mL#R6xnb}@5E^6%oHa3g1Wvon zt#qCZWI2!aR$t1dPfMt(qQQE$(Is_-2_KELLN@a%4PO81s ztDBAG z+~nv|ZoQ!maW@j(-ps4gGWka%@t*fdxGzsFo4OnTT`S<3cuQ3f1g_eT5AbZZ<3SEj z>RxdN26~(^>Qm=8P~Ge_{k{x-&8KZ! z^hl1_Sx^;$X@Z&POG=3-eCEUpckWzpbmX+zHO275Thlo`&R3+}HTeRfm+d8mh}97j z=}Kn;RaN2=%R7MqL{dx!ZFlHZOE&mfwLYLzw=z4kk};GR!!s*fQB1^CJu>^M4Oj^^%T`#xZj-PV@mpL*L<0#U8UY zyQ06hIy|*78Qj#J*2+W}P;qu@pRLODB0u>h)WS}ztv!;KM%|jTm>@ed^n{pkZ{`T3 zrO(R0YBFwpLoeLe-PPTgF*p+{x7(+0vZiXcZsChLfJpDU}tF1Ldjd(EaQ*%O(>GtGXtT zd(I)4B{7Ey1gAc{iYCgh(-q&6kzDLIAY-8%@H3#zA!2- z4wrXtSUyvJ=tRD{iVU&?!G*2;xmdIP2BQ^)eItJILjLP>`R!g4u$31TMFUJkoKikF z#4A5`B$P8cZ}+u)vWs~of1krbJ%UQcd1E1^no;{H3j|Z;0(XGr6=%>c1Z(jJ7$DFF zex)t!ORUD1VaY+$7_)F(tDGtw%#r=k*ry@z6rS7{McU;tvPZ_ogrKjOI6YEfH0|d) z+>M5FMc*+-e3fQeE#=*LBGGCyrU(*-CnCZb-?w+PB(A^B3E0TVth;y z;FRd=uz?s&9f_Tbgc zQjUcWPzDY^4pG(B5%1n{LpJjx&ol&J*=168VFcgMX*jKGi{8-H<(!xfc^u0hda#(G z1>zLO-DM{M;T|P%aSSqKL9pGDr1f|WE`Sc9n?A2BmlXr9VROr*NgrH{p7X&@D=J5c?HLR@N^ovjaUC3s-;0=6D*un&}o;=it$C>~)8(2%cnK9wK2 z@;S@~Tkca(oC%zzD{$mm#?x`C6&PNEnl3!yKvkf@y!^z5gdR^Qlftj74k^jiKq0rm)OSx%x62~R?4ut^2g}Gu zDrDa?IN_nD{)EM^_;s-GJ_zT0x8^=DMr3xUPPBf}y6&`Edd|E5>-2aFNv}>j7_kV) zm?lV|7;H=ixSs4tVv<#fmRhg!u0OnEef8tw0T^;B1bXjgsRFq99DhC}aIhV`s z69CMWJl=8No>xB?;rTJpPZo~_ViQG*j+9lwBv*UBl7IPP1zYA%Nn#uzeYb}O`KF|h zOY!xDq{Oa%hwYXA>9IqJEme70Z)q9*D!PIxYnz>j3 zP_+3$DiTTNcD!K-;{L`u9|3Gqx0@fX!65&tV!`+QBNNtUzs}yo;^H@xoRb>RVU{{F z`P9^OR-D*NfpXw$e{L&2leSDCJDKZGZ@{dI!02k{ z(K$&FQIn}e^fo~5_^x$MX9^q=;Ai!Lf&$Cgu>lX*hACA#-vt1UJjJTlkE-Y;J8-(iNtfLXZzM_SC9gULLRk*jR`uG;CKB{NWN@)-i6AR0u zl>w9z)SdB9bOsAH3?{xUqqUD#ok#yb~c2iAMHOJqKuRwrix{^7LTxw8u6w8qmSVovEYAF-@^sQZ6vY zeF~|2r6OADF<_{w>HzIG&vrrI>$(bZ<%KN=0#pWEwuUM(6ANW_KOh$}Q$|r_#cNsf z4GgnVRraJ%F${%|cI5{0=kO6XZ{F6{!Oq|9FJ^d&ju-XC;72fi80~=D$gLr^(NdNG zK9_HXy_slqD!t^a-LS=Am^q5tBB!T+8UJJs(i7pi$`T$g-@d)~?VEi^vcz?8etK4J z-?P8Oph7VTAyt?t>P(CHvXS%8Z(YHfb+aAPZ5p2m=h0y$jNmB&18v1 z+M@|K2tqD;3bxK~dNQhOP3iaB4+>58pgM?wnD5iT74rL%s`X>;Y%B(twId^;k36e1 zJ3enI(njpbaD!;=eh}}i$8ef7?Ee|wlaY`=NX(i_NW#ND*+9m@;^vAE`>K;N*8v|Y znIf2*=pH{=>c~xCs6M&!adXzo z{`uKqO<3j0SC9CSQ%rGvuQYae{uL!-q4>`cYBA8#}Gz{Y)w!<+G!N1L;WJIInt0 z38*>HflC_S<})<}{|PItu;nKziuyX>F<<`c-o0vunTt~GtX`Of5)6<*jkIo=P;$IY zO!DD@3VSH_ebdnI9O|A!I^Ta#`7rA-b2_tbDj%&1_E)vOK@UGzND=FM)nzK5;Uf`g zid%nr8iQh9{OFRxYB|G4n2oCrX5WpN!Jk*HtggNGLhVX@G0|q$l|0plk}_bwR)nOd zz0Kl>7u&J}P7KzQIn{xP8#gRZ4wPW4>5OnaT$m-^>ed&PWY4vpXT36;WY91-gHb)Glvv08x3@XTcjxOja$i?k%fKbFDm2LD~S^+0SlB zyz-&#l_Rzc`Fbq|ZV^d)&E4f{1U_%c9gZsh#SY<18{4)pu6ID$YvG#m_AN5~pFrDt zZ73PM(t+(2@GyZ1jnM02ZZ0x=FDb2ZstixDJt_KB1O3 zvEQGV&`MU}aEEf5$63lrY0^m;P_bAu!pCFD9FZM6#R!-tvkO17)dW@26jg_ZgBQRi z=b0r?RgL<8j;-3;Erwh`yDiIZI35rrMFm!E1BFXy5uwp2pt(yH3%3SehXBx4!^!7K zq4BAsv;GweOw2bqGaH-CU6n2ffOwr(pM+9}##`%E6Zh@g4>I_F#2-pHl$1oliuCj} z!)!7!{Yr3fY4LT zImsc+wl)F`ve8=}a4a0IfTQ}-uejTL?R-tZpDyR31WQUX+8HwdD_umQbsT~(43!%@ zg?yy^riv*lMQaliUY?#5G}DG1-vSt_=7IIecHwPcAO-I+{=~%G+W?7ptEncKa6=NV zTUcD0X+FAW3CF$J;EFC+SK^KJFDNen$FEb|PZ$-wMK*tMI5@~>Iez)twYK7Z?qcVi zDA=Lk#m5&tKAxW(Klk^O1B9GtBPw^(m-) z3j6pG2M|4?K+ZxRannjl#5t8%1h*)U!*6dK&3Bm}3^_lL`JVN&A@4rjN-wgw7)WxG zz|32HPr!mYmUrD??v>yTBct6hZTF0wh$#XBr+g}Aj3@zjmno-39MBuRd{17^XsOA_ zM5o}Aky=U#wkD~aF zxX|&`+ib?-p9oBX)L%}`fP%dCwktp{4o;8mKp|8EFwN@SPxIeL^W=c5t{NBQK*Llg z(l*L23g#b-x>OXIkK{rJiX~%}Q6_wNnl2?lIponlyFlBoGNPu&@=@T73HAr|pV%g# zdXLO>#5rPmdf9~0OxZHNR>s{O-49P7FgBLK@AkN0_|#mhQ282$D}94q(S5ca1kQ;q+V0_{@o~$opPja5J1hQkuTWg@ zx$@ATco$7%6&Kme_%baCzQ{MQ$ma=t`F2?4R|u$)1l%2+jJp-Tb*CYrV3-q+-nD74 z(1)w2)SBX&2l$m*t*RDO>MsK@hWh*|#PHq3AUP!R@e$hGYIJg~hybS-2zEYDXbbSX zvQq7IWPXbzTJrJZyQHM6C1rzc~%3!@Jl?OQ+LTG@)<;p00CT5(ubgj|EM)$Xz& zD&{e$r7&=2bKMg<+zf~E4Xz&_yAI^d+^F@=xkFL^bQV2r73Di`UPtPKAwG>XX)05j z{Xrggn$uHt1QbUY8k|Jq;f4x9_zKJ*N=jtM`*ZzO)@-lnx_S4*=5M3md9F6q_%0kV z1at;UtQfLX`sOCQGxCkPln!^zBy^{7ffUM_&W&5TxA04(u2dJhS~^g}jB}-PgQ9DRWx;vE?twUdq5ya4aHfO+nkTYrhR#n9WKJ5m8ZVy`9Ao zgzcJo!m}ZMS5CBy9^YaIDngE3s-IQ3G=twN)ygGR(IvMSC{Q|0De|27N23Q$+oDr) zP*NNO@&}%Z`_sL1u*!8;FLxMH_s1bt{m>M;qVNdyvLYl$b_-V+Za}Ix-$K`cXsX9)-}H|9RWdWz3Nm9ozsq;vV(9 ziqg+LTICt?Go+NPi2eDqB7?{Cl{nZAo|THVM==3g(jMW3Wf5g^tftz+duSLpf@IO) zl`S@>sHm{kC@!-j0cmvD2on2N)IjwaC*nF`NVU-sAXIC<-q~X_-*5+ma7S6a(eE2B zqSV)3KYxtQ_VBI8!;A6H@ZMpfDZUHzh*Nxc)2_$PZl|X(F5@bF++UybCNJK-diB*` z66rWE?}glWj82t!pJnUx>pe={Thf%5*N;l+>1(Ol527Pjrs|_pUYF6Zc9&{diwu|o znS0rov#-KQ&bxt_KPrvPt)B`kp`mVKPif(##Hkr-D9-3XyNmuq01F+Cz zz)>=BYr{FT*E4t<+}U-2{hg<)R&zm0^(y~?N$zN+hfN}e<9CvN>Lz*2{>)o59ZCJ zRvnoq+ymoJ$#XkVs0?FsFy}xX%($tQg#c6Dy6kAx`4e+eimDn(`*o;Qy2-cOPr+s} z3fZ2Kb9VQ9O9V~2QkTlfAzSzQgqkiRPS$-rBd8|KyiIqg1RgdWpV(xe6&X8SQYkpN zp>b%q!(e$xF@kj9JGZNmNpZ{4aN~N>7#482S6vL=z`Y>OO2I%is`pJ0m23kuXk0dD z+ok3Dxa>lwEhV)oVsPy+S=?%O0SK(a!tud9K*Yyqt1W@`04XruE!xBqc9(r*o5Nm0 zQjiqb$P3#Gj&fqvo& z`Xl8eFW>!42^#rDzhyqYu8s`MXfxoPEt?&+J>p;$?0?uG;3nUf-3q|-OF%6HQ{pvl zJ8JdQQ(RVnOYv>BJOq!hg&qZtM*VUpXI8fpyTrqtq0d^itDQjtlD#}@nH^r&?}IlQ z?!kTu4da(QK**(lCJER&_3*XWruFIOM{EP~Ah9hv(rC8jE1=!}c4UbSREXw2zX%K1 zaysQPN)cofNmMZ{6f8vLCmPsz`%WuHw5sCdb>BEEB>bOLZT*x(^ z%h87=|n5Z+j4rEy>g65)Kj z@dg;aneggocvW`|VxLf2xHhw5*8BPza;pHBzzE>re%n0?Q$2-C(TjsSZOce7lY<8p zmTqU_zOy>gR?6`B8Wh2>I&BIG3O6kNxPP=5s^B#rs<26lM}h?VFe^c07dTq9MwKd_ z9nU@a#F?7{rVJ64YsUxp*U3(kffPvJ?)2hCXJV?*2+)cC;R1+g%x|@ydovahvZk8t z@<+BN!^t>nax!~9!oZ8OV%24B1^h!=!5P^jjP58ud_7Ys18ln`!8{`Veyl3+(}av5 z90hg^!hwC{PoQqGGF^co3 z-fX`3)YJ;Tb#Q`6xk744?S6&^Fg5V@VN%YW{J6U!rm(jibEQi{p^brPj13V7 z`_hEBCl1c^eXzUJX`o*ivIsI<8^yRzI87rUKxQ^doJKCpjJCtATRKNd){{1sp;q2z z3?>#ifUu`u?EayFM_&h=OZvG%4ol5*i1CZ+V{0LAEFN`yYQ~?bqK%f7Kzi_{IhSA=BjIaikv} zS!CGFvG(?4t=fy- z1!=Jus0-iT+%p@reZ15=!(RmLnE&Yowj61jGissl-T_bb^G+*=u-&Zq#>G;}=n5b{ z%Ym2uorb0T6kl9A_=e+6*&`u1@v*aOi=RO$XUU>Ex@UDHP@wD4BTAUoDwpRN=~_Q` zrR2xdZi$LE4P*-@2=#=NmjjFK?Q>h((On1u!5rFyL+U27)HjEe7#Z$_c{uLg0^}-a z`1#lNURGCw5?%+qV$?=Qv(J0R>WBffs=;>GbhK~FI5NP_PV|+IuOE$SYVFOEPI$AHVp)?|Mu^o ze|iBP(4sqpU_MUBr2RBa{Sw0WACxr$q1p#*FVVu2`!SA>A)%k-d>!$C`d1gXRKwz3 z_c+(=QJcBAxGaI4I$dbdg}8gap;2~VDav=U-Idh23qmL$3BnsMJrwzUQ;!J*+$zAj zX}OzSO;wfEZc#R+=o+H!H;oIezN)eu6 z(x_RJG34;EEaLgC-*@{HR4s{6@WGjs1yNn<2M-#l%q~1M`i=S%WQI@;m_pww-fCfK z=Zq&rJmCBN(PyxQ1?r_&XlejhiJm(iOQv5%i2laQJ;(#GR3lt)-W5?Y@Tbe0j8>F7 z!x19WCX&_Y^Jt|DPw8ERP+vsM-TfP(2y8jhE^;pBue{fC*<&QA0x` zfQSRq=kU?rkEdRrl@QcFQn-u#(3`~7)zyr@HMI1kx#$u68_6iSvE3!rJTk)9zIzS?d&Gu#ZvE?~YN!DD zw!L19H8t zM+MH+V4_VkdgX!62i6IuChToHQ_p}$yTlAGq-GCv2QjXn z9o6O0lmBf3i$J`&<**v;8Y~%NM*!05L6$|LcT}`O0ibsud5Kb9MCOh21hwPt$R5?j>YoFk@rmI!wRCm}?8QQ$n16 zp8sc!>UJtJN;t&6pMF~Bv$-&|SJu$CHm1>4Wcp$#CAKX;XUv<-crc7^)2QP!t0)TE zbWfsBvf04rbEAQSVYJpr6L@j)Y{EO~xzYp*-}bxn7jJ{K&4{Eg&)GS>zWOu?ueO%W zu9c9lNc&C9@Rvue_a$kUIuXZjI=0TyoDb9TM2vZmW!#t~)FNg0Bw1L59AO7dp?P$f z{+FwE!UzkE5&|qL;%Nj<6?feNq~(@j&E;;^RDe=u5px7xvNr z>C(^37JFpMzk1qH@T=#}wP)BT2&IoEc+=CX$oGbZ`V78&X*^JxZ;w3AJ^i%7^iIJm zC&yVLni@8-SZk%i3q!@>b|Q$seE#`jeV6msSR(lgWw^7_i3v;#?G4xt+;WtHY= zu{OyTXEz-kH3J}22)qNr8EEcsD=)Yo-`QeoP~qj(O;uH*#0$@G-`fu9853}+?lBJK zqNbMOTToX|CniisD>VM0$x3~PS~T2#`5hO36(>V$4|{Xy2ZaQo%}iCLRa}~;Pchkb zet4lbZc}a@Y}K1{K#w9&Q`Pkg2&H0r5kX42X*Q;gyVU&x+Sax*kkCRdoL$~14Y|$q z+l1-Xav4p*@8g@bv_$(WRb~qch8qs{8|PQ(#Du(5iD@6`rYXKaWnft7q#%%ywqD8q z)GEER7<^B~wm>{0qQ1-^<6bzWge*9q&CD*OHQ$$_-tE)S6P2Koce(BPDBEH9PPKmP z^eoUdKjKG^6pAH7JwZ&Q5o03-%SN;28CJ z1Lm$ih40ogx)PFMT$Dl)^z`XB2-8I`T*ymIT3B8k$(vF9tC{l0&$yTAZ(cW6x;jxj z6VFvy*)PV(I2SDp9F`@PTq~o$;tHbvHsB#l4jh)+rSyT zGf+%JE#3>JdyH>)S1bYkPDm+e;Nr z+wmg;yydH2koqj6QcQX#{t4S=m(+|}{NorT z02>BNG+)|R9Oq$RzKUB~*o!@TP+*~Pa#VFRJ-d?S663CZ8bGMGR;)-1R$eEuyI?C& z`=xVnCF^!OUy8aE@11t*8S9lJoj!Wx*>;!cU>=2wO3&`f&VITa8js`i*fA%An3}R? zm$kH^)ECOEdcJr0Phoc6n{8#Y*)xykwik~bwel7htWx$+ImWs-?3TKZcKUF;i_CUUTUx~FkUMfDPA7Jy-B}q$3>9&!3Bt{W$1Gv~`zH=a z7T1za;tB_Lk{<4%LVHAlnG_#I7hCn^clVy`EE=B; znmDc2>*pJtyh1tLsmDv2pI4nrbaI^UnQEAUsH?)oi@L$x+D$kpSOlLJPftaqr270G zJ#w}l;qFOQkc!11O5PF+=XM>TtEzIg9^;qW-0F%1t|49Qn&P;;;6F|v-Ip=({{k=R zNDEy_(cpU|`)lq!1!_EOm23RbA9?zWY zHSSIcdgZbs9W9r^nxY|)q{>3u|2)BqRIy4m;K^g#(-wl0?GE9xTO@RQXt=T|GWQD? z2j$p5h>Q)?%0zagat9DDh&z@9nvG_@PJNJc|6XH)C@$OLsG7u3p^RrJ4O@ndLDI@7 zorq|at5W1`I_VGDYH|>oSQ+~AXoJi7lhEA!8N`9;7LG_uOYcb!{ZwR;a|FXFS4+#cjFPt~ zj3%W@EG$)Gtcp9&EOM7YCAkFq{xq1`7{B&PKl;d&UTU4hzuGI2=CUUm+_usm55yZ3 zRx@gwhaMpb=cxr>v|K5yo0jc-Xdq!#ePmM@Mn@syZrcA>xb`-8mQryx<=Jt51&w@n z5iSi55h;C;FD@>xrpLvhqMj#Xt_dh4JWZAh((!{V?1phn8S-iR4?O}+$Ffhx+%jNo zIOtAGz|?6t-zaRFbUzaqc6X0KWNjk%jD|l8TJNp@9KBA2Q>EqE`5}0k=tkTu@@R22 zSI2H+{1HjHq@!_Y_xu2Gm?WW_AHKXK=&a^?1*^9%rz+Ub&yO9s6Dnyjcn=n|^ea~~ zmP)Lgbw_#Wwl_L_9L8Gt=lXlIm?Oo}R(r&l=GvFW2MY&|?k=y{y|}!)n#JFhLbKXQ zal-0eC9R_~(^ru8*mqmXeH1Z;rzD%S)T7&mU!>V#=QAw{~0X znj%M%{95{W@z}lx_Uuau^n~^+X1OlWsd3sq>)p1MGagnXxi9{6y?C^<&)ocQs<4l^ zmu=q@3#U6h6mzXV-pmiLS(7;6~gPJldbV6k@hx{sd*W$Z`VwZc`n6Lpgv) zY43@ewpZs<<~sfMn|^CkPcjsl^X-o~pkZ9^`BCd#xaG$X;NbNb*LZWjtgNhwj!jMluJuzvLvCxLc4w+H39~w9X~ZFx z`ryC_GOiEw8Zc+Q>wa;oAEq_h+Q_V*?1=>jW-Gq0* zWY2LJzB>fXzIIz|->`aRNR_+$ZWTEhGO@8wy(?}mrprSqzo0}WW%!Ewdw;BI!F;C`P}qP`cPZGn>4+HJi4z zK4Hvn9AZCE+vSfu+TLn>Z>^U5Sk9!UvyICJ$1L^|yO?~5LYlk#b*Bx%XkJ%EbeFv_ zI$@~_mSD-#!;Iw9HFv`GL6c9F+HYF=2=t@679=9K_dF0#eZ+gGA#iWBODB>eW5naa z;4Q-RX$^Ne+j6d+bOkBD7+2{A{u9~RXZp%>`Z4i#EK2@%+I4xtg*_J*o zw9*OC$QQD^cnOzP>s27g4g1WRDbuD*a?VE^JA=~aovH77R}$X`W46ZTOwcH#o1LAa zMRLBFSgVdjX2Vv69ByTmlvJ71>=X2+U@GDH%AJF`9>W%VJ=Lu!?)3Q44^oR0unY~X zTO#=#E#JGe4W`R=d6K!)LcXmvmQ^HWuH}bYkW_1A%9FFBSW=ZzX)MTGjt*2P8C9Q9 ziumr&3E)<{SHpDN`NQ+d4t!C9WvhjRtY+zZ;X9rY8bz z5eX|fm6V<*cr@}NFLEkA-(jfEOn&0MxSy$1%FmId-|}43Fm>0WKW@znGjw8eW*O-{ z+tM+fBxYw&Y;Me@BiI-!HJdVc(InyXuQj1W6Tf4f8gu%COIQ_{1$IiPgqjQ6K zNo4`}@epau`pC=m_q!q`M2I+y+hwHmENn!i6gGRaoLl-j`n0wh=dYx z&|9x4RYmbC-30y6m6TxJBE>w7aD5UU>YnDM_D^s)3QCg+{rE1I;gIuYx9OAK!6~@f)iYVyA#~q~bLXk=otmnz=FdqLse+@syLb1J-&)r{LMXSt5t)-^ z3RjC}GiGDARvT-`_5oqR?#A9MIApVBKa?E=Ir4t{%Y1fkz;Y_sZ~saovkFQC_Fn)I ziBCw#MPf1C+1CW~d1)2txrxS1xt$y3G&LAQnhd9?;>$D?+vv4(Pj6O7F;k^txQGRT zFHY_G{ODO`6RYAefD!I~14=_eX0B~1 zoK6P>#+NmJ`&NJawCbh)U^>)?3|w8tW;vuS5$J_YZvMRN@`+j;m?IpI>pho;YE;0V z8J^xrGwkWh(&3`>x!VQ?`MSa520Uq+(GLWTuF8_Ri3fo+o|AWfjLxJqHn4RhibnM{lDzNErGe>Yb7J)RCZ8tO5U|elR6jBNn03 zS)e?9w4LbGTdp5NmT0kaOdB=?p2nCcN;F^qO^k=*VSd`ai~UlyU+u+NWz!iT+8RKn z872lWjjB05KGQfHa^ZRM>Vtr3eQYvJCRy5@&lgIZp?_*eDX(j_IIT)y135ZYU8s(h z-yT?~0LO2TkP@t1#3x}BELMpFk{yL(KLxKFqOVUU1z1%yqg4Xx>b}7tO+;)DI(ctP z0di?DOAhkaBqFt1HB&%bO#J#tap!EayHUIdXlfSW#^b=P?=yl62RCS-XPfu2W}!B| z*}f;sbm!m~b7 z+>7aO1QgTpL^<6ExAR33}{dz)uh4{jt63I(x@Z4`bcUtSwmBkH1Z0M zUpD8%p&q^XSduwwVKATPYLk0S=Prxdgt=|0mFrN?)Z!?vIQ|0VH${xdM(%xq#tSiiyP>Yi{u5c2qFn z|7xo522|Oyp+-AyA89shJ1k*7WK#1x9T?dZX_TdtQRn)uO}&qtDVg30rkuKNeW)xu zeusH5n>cT&b{B$qCziAyd@qC*&<)%i;^9hr^>*NiT-j&11flZybVGM& z;Rt^#&%;?@xjR8xz)rG|hScWcn**)Z=E{4Mo|Bc5!4C|DfS;_TRg@5BI+CxoJ5so{ zn|I1)ksb8*Sf}NmBYJ_`2~alLnyt(MI^mJ9Tg7l?Kvk2W9k(RPQpEBWsj2QbVd)eq zG}UGojaqx_7#L#W5SF@!;}v~tYokAz&r)%5fvGklmTXKl9Qc-bipM6kDR3t;{{Fod zr>kv+pR(k6#j3ag^i8x=j z>lh2N(B|*HgEJf=^sLp=Wc2B12SDPg(JFL2zls0$Gasdlf)==ton9w@kIw^eCQ7>; zcH?kAH{`wTJ;AO3m{^GJkD~yuc;N)n8saj1BBp#iOceIOCF3@ zUKfCAm?vwPU+t~_#_v~A5mO2~Xd*Aa4;zqo$LGT}kB`5ZVi*#v_km&N>V6=D_JBlv z7V)%Xrid@i;Z5E|#wrM=WhG`4(vrz&Yy#dj%_xvG%NG(0p9sFYFs{^^-ueo+b+Z18 zt;%$8?Th>SHRu1N8QKdh?;ZMDf!oD)wiJeNb>}Nw^>MuVR!o$_k%h^X+2!eJl*RTy zj91cO&46mD=hf{e^~yS+i6wpFsHgAjfTNuvWL7V+3DEdzd1-a#y-AgseWSi3^lo}Y zex`*iFWYQ#s=(gKU{oTb6g2Jd`%Ml7<)I(HS6rpJa=PKWyLWW-vYI#eZfm}^e9x}Y zqmfIkAY6VOHX$L57UvQz;JhIiOdK?VnB%vagaeQi?utXC+z_A!NvAykt~ofmK4u2x z9d9tYx%Ch8Gnj*QmYh7cjLFC)V+OX92CuaCVf|k1 z&+M<0R?cR$nMK7C^x1p{%4fIDUvvlMXDre$Jj(Kaw>_yQN z5VqvRSB6$9=ce`&U#>rbGEkiHzXV^`;IT>o{ET~n>ZcZ+rrJ&chBt5aCK?0GNW)1697F)DqQ~;PpP|*@N=&SWNM4q^w3(?gs6<8%GQfZCwvUmW+ASs-@ioKRe!a!AmNI_k_o< zA8-c9x!5U&i-nUt-GS8cfq?4OplOC=ObY+0FZlBK(~DSmwa2j*IhMmX+nUv{t}#CuEj6k4^hpHz=yZ10T(rH!Uz*BKZ`ilki?+?HPayBjj;=G+f~ThneS9P* z`tgN3<*im|i>3<`KurUry+TT}16u3LY`bH#j{(q&fl53vmPGdHdJtY9R=%LGSHrzE zE^bWshPdNG0Mh}o>C0J}yHy4kTYIN6oe@)Gx1*C;(@7|cP zKixgyv8 zPnoqtNlu(us5Q1FCzq%Z+^@q)DlPWM8q=+@7{tb@0S8aPCzDxv5Vwomw8ga2w5K<; z>eWe;YLy&8cd9^H(yJW{x-dUIZ))IRmm?L+zsi=3$zIOzNr(J4Z$I8pyDR;ZgttZP zW5u5G>_e5D7?1x{#-nqW#7AbyVH8B${no;M;VI*#4_s4tqb%Q_=kub|B0?nq`(m?<6t>8mYyu+heBj2pN@o@wetC8= zzQ5f9lXiBC>VldM(sQI$`&STa8R-{x#gT9rKbLZ;t<*{~zkw}0{GhjYGM*)nyph*{Yf9TsLs*C%&CY~5@xRvx@N z5YG&%np2w@ds-jm|0Eegqi@4yLqvq*_s#waW0*Br#c+x9%KOnShm73(rPsq;~NvPU=eUStn2xxcB+-Inw=TUBP5BnN5`&u3rHVxNP>vb=cwdNXTl7 z^HtMkdt-P?v0VJRho-|ZWJvCZbjhz?J3vt0O|{ppCXki0913^mGY7nu#Sly& zo1h|ba}t7pqP}&$O%6t{$7I~42G$5v9`y&bOcMfbDlR5PO7*hV69GgA z)Ss|V4~N-&KWQUA0bc2u!>DymF}blM2hn&!!PXvkQ3{ z3Dn||ihkL8dai^ry~xM9Rbud_BYjo&#%%jbnyQ8Bv(O%MJ29!nY&NY0 z(L|mdM>7*C|aMLbZ zy_g&8`wq5quJ}9#K2o3UX4HJy5D8D=)4q8+wmD$+Zbr76`*}I1(V$wK?_Q!^RO>}` z5`iK>duiclvMoihQY$NXykLGmQ?k%vou*`Hum#Er&~n_*{63g?)qApxKr8g|kXE0_ zrx?@e5ZtaTZ~ptYe@GIO@cYHO!IT7w(Lz~Am7NAvC?W!fFv|zfDJ;IT?-Mr= z21k#k=QEUPMC2I)mu2!cP*b(XJadjtYcU|rp8quV%ih6d_F%rs={}Ufes~hhr1| z)%4*JCwEE3%%(C$57^zSwE#Bb>2UTFHMbT$kPIDfZg_Rv5+LBS6%8Pn>nQwVwPOl@ zj$nDq#oXhUr?QxlH01{1AaL$Ob$hrqTRh+9=Cx1@-o0UyTBtLNURV@IuuS8SH+k@E zX+QoCedas)C&mIa;##=rL}AVl@LApjO-xj~jg!<6ut{wT3mZReq2rK~=jBk7kO(m$ zt8GMZd#LHYe=pTWA;Kbo;PGHJ91*5cXPTkv@i1mCDJ3a69+}}?2(oFV4)t?;dG~?d z%>3nla12{f8TilXCroi~BE1RuAS1RYO+mAdP&URY@^1m&bl6G&{$2({_6bHOG_UF>$CL@|+xY z59(Z2RXfEAqb<5ar09DNj&~VAN+KfPCzvnv^!R^2-!GQp99RqtP1#K5QlBU4P1z4& z`(Ga9+`BAAx4fKphicvI=W*A9pSiEEwVo!VLo{1?M;~JJYjpW$ zI~?@uZ3U&_kX1rW(-jlXHm5Dlw*(+`v@&=m!%B0hTtNEWZ6y5Z+2g56`a?}Rx2hE^ zirP(uVbu-6Vx7E4BCXxW-=@%1pSb*N!o+WWB z$GJndx8B*^8+SF3*K?`YwS8l1)X$)xx8&UQtG7fxQ@wzTu)Wm}W^*k+X@s=?!&)!Y zIG03tzqH8B2i}@;5#Uf~H8laJ{EOr@q-hYj6;heXX(wb-#WmVIl)GhAg2N;P^p_|o zRnE=ty*-CBt$9PA|MfKmgD77MqC$Ld5x){ky~Ys46{*PFCe=( ze;A}LTv}`;COJz_6ld^KR&@RX=abt{R!1Sbb-bH*8HYiRFF;@ARXTn+W60dEQ&-CC zKA&p83m%7DlPqTuLf$t2zN&O{WBnJ9?7_*( zx;S2r(Jf8o1>~%oA|oeCbrb<99{VbWC{=vG^vV?rS6TT7u4zPjPdq!PA*qy78X#jL zNiS;2aropCy_wFf=J7BweN*$(ZEM2QYa0M~b()*w-0v!tIC>d40LqmX6Ju+E#F0P&A>b;-$muzx;hHTYT3cn z!G4-tTAZ2Q$9J{~KiGJUJE;Dg&rnbpe^M)jx@GCkWqM_|CEA0H_-g@w8LrQ*v?f&x z3m<+jJl*X!U@gD4cKH`HgX&8xaC0EnssEV)Bq5>)69KHZ9Vvd*bL&5E>sxIa>5b2+ zfF_9c?EW9j=FbEFzu;;+Z`+^eA><7Ejx^fuFaJy93PFx_XUI8?fMs1C@AMA?oZ7j% zss{)@%=`SauyNT2%KvEm;*A0w_g{`SHZqfvk_>7(%f0@*AMnrC_g@AL3JU)(#s~!k z_b=ZDfMn4B;&;GP+jVAO{&|tFw)}0YSIWbfa5w);tIw0P)%~TNfhg3P=U?wH-{mHD5GC!wX9RuhTEV z3w%U`rLTXmZ_l3qm{3oNc4EF2lr5I9kkGf1;?O_iyoUe${2US)Ir{9Oq7nxNdi(@n zLf22XaM}KxP%8$gTWO1Fsh6dehX4>t`*HvOafYMHB!R;>4xd=Wyi&sbwiCssuLkNT zwzw51>emW6cJbKHQL-d}3i+?BulmJE zTKpbFkH)Ik&8=W{t3PLg9V+h4UxGAF5YkMlOn{LGMG%Or+FVwq zyeMPqG%Z}#yfMWN-LCofT7EetF?ALkPkY?zCl8tYPv+OEuWFQLWO9<)iac2cm%}1K zdEu4s#9#6~WGez5J#`|&CWHU{^xR%b8%hE9@4H5aJ-59me+!ikUXWnHWSj*Lsgz`Zh%sH zvBRX_x2d0^h?MF8C@cOicN$_m@pvc2f*s-*p*rydY189|f%c94%LN-0Y(N-K`$TuLSA8hBt95%M10GYe9 zk?y)bMyxq8k*fIz|Bnh3-yWdRYjW01godK}zE+@&`3x{LwX@jFBBduM#tOighY=GK z|6+9D-eqbtmhScsF8&9aY{g5Uuvvhv@- z^_>jMV3U^IDXMytD~-$H;XIG^28#Uetfux1Pb$aXU&oWpYt<+X2OtgB1KQ_*dF?e7 z^xY9vpi1~XK)1}~Kz$DWTX2zg4kW8u0NzD*p_cAY3F@cFe?QKt$z+`hsvh&-x&Kp} z@$aYuJH-Eo!~Ode{^xPBQ%V149@6?opVwvrxL7i$cDr`6a?kY;5%Js;4YpKyRa?bbLQOd_ThRnmg) zojdBymZ;<|nTUbMWfs{4>|4K;mQY9Cs|v$u<8`5FpXWQJ!gqB|19Vzuk1^y2fYPHe zXn>A-dQcjKMX!?RkGMTu1L*f8H{SEby0@?&^%^J01?Lnpt~S)g40Hw*4F2{9-`*b@ zYXz!utiI%hkjScAj8d&7o%4AV0*@Uq0vrqoWTRmGc|C2p74*{d;_Ws5%MUO*Ni23s zZt0NLUgmiq`G5i{ia_0X=tl`<#n0tGCon~6=R9l_E6Bn8dKL!Z)ICWehQYX5)IBj~ z#flX@E2!_j5p=`8dPVZFW%>N6!?vXzrUNbZW?OTxW@{uhnT5slI`x9*;RqzlHm#yO z+!hKxyCgT`wI^%Y9nQLGc6+DYj4f;fLAbFw&3IwtVT;H5q!!mCUs}OLL`KQN!-lEa z;$GI!~b=6G^Nr=z^Sm# z)Cdd11iUzuMlSsk-8O|ac)pOeUkTX2?cR3>G95baU;6kzUa6J5E#;-`$)*_xS zeCJC`b)Xz@VL>kN81UbVR<=#ks~2{J@UT-HZj5*-(Y_3yjl~>9darw1HrDDTW^N^F z6BCoY!vi%}OBNOuvKJV?8js${Di)^bJa~AUCYouL3xQx(fsC{&)7MdelCi-L5whPy zL+=bpvk)Tnjm$KRVns4J)J8e{Wk{$i8{FN2*Od8-e_*Ht`sYn3DX)V0L@>Pao=dRz z_VrCn0_0#;=P75)s(?o^q{w5yk*(lo7$aWyu7de0c+JW;bvG-WUccX54h^q5*ZlWF zz|TebSn@?dpxqIT`FXp$Ey?HmXAjRN#}3my1$v)nu89LpAEF%nT* zJDD#Dlu&y9LhVjh;34qTN276)dWXCT<83r}x0xBJz3jZK*!Zgeux2<~Uu}&j85;56 zfDp%1h8c`rnhqi&Mq^_T0wR+qpz^1_Tk~skH?a3RJa3~zU~edvYC*AXlXHDIUT;>P z1R;a&V*vQpfR;k0y?-=v5f1s(^5MEpEfT!)ZhFHU)9z#%(YH_Fd96PfovgdpP`i!4 zhTHMu)mjJI0}a%sTFF>l<*U!5OZZtcCDKQ+cAKzD4h~@lQ-Wl!t~hMw-?~QRTI8+4 zGzc9YGW1xa4vt-!ilpyoX~&8*(N(?qHT(Osmzu<#T{$N{IDXz{11l6cSqu^2kB!e# zvQP(qKea_D)hkoNhs%k6Pci)C14vxx)dn026zbxlp+b{$u)DCLjyfL^kr6Xaa-B7? zl=N##$^*DJUo0)81)bR=zxnlZ`?UUc?{jjhFq=ijLqW+_qQ*Hp>w<+Nm6vGmnvQ== z#YZ3|DYPZ`jmH#|lRKzH@baR4{i@u2=3Rx1*g%U%7XkNo4e4G*Ba2Y|r~55q6OuM( zBwwNAcLd_%j^W|`Zjab@o}T?e$jEapd%nRXbonaTqT=Wt8*eguBlUFDDJj7Z_XZk8 zSXA-Ze4Y{pwu~G0{OKXMY~|qD2(573UxsE9&i2f9iS*H!Xy39^zoR2mV3QINSuQP& zF|kv;%(E~P3hYR_a>m&6hQzC>&E4K9X6f?9Ns-UP!vmib`yMOc2$QcKgPS|);lXfo zKRDtS@jeri2ob-|$yA~ci6qi~RFpB#qE&%b4As_eQgm3$rp zi!@fI8hVsXrgC!v{gau!r(TmKjs`QiqeFtKk|p#0YP_!eBV?YX-s8jjj~CZs>f*b1 zO|X3_9KAoiy`V0`!w2WGjsj5>`?s;#%zRtdk_+|9bc3JHFV3l&JsV`aMCIhBtY(qX z@$gWCU9s?_mkN~gGqVPdiWnK&rZ9G3Q?~b3H zQdOq8KuBn=R;WcuE?b)O7Yi|Av9K_9wxV30xcl?ui2FxMC$91jv$}gQNF7|nXWM;? z^Qk1{#8m6(uehClXUh?6-Q9J88oR2L^P;F~#Hm$ZH4gtU+}!s6+Q0=fKX262d$D!z zV_wn!Q##Rs;eAIgKHC{^xPQTzMR(Mb|Q8rbLB zb*Ru%=;$&j?4t6gDbsZ|bmR2E?BIN0AWs>kQbgb)W*bB^)p4PZ#4fiivIU zdP!MIyw&{mOUtToVhk0XgF^*)2{Cby3e9CpO93zG&K;b@b{O9Mtmw^Vc*Vt{L z^F>BC!ZT5W84=&MdtI6>HM#Uw$H93VJw50MxJGGvTt~T`;BVL;sj_Vwni&Wsz9+4J zp4C&uk`Esq+G93&vu-+~(3r>qzOhcZyRY2cjBI$m+dWvt%*~xTov(`O5+T zI^_*d&HCDP8}qGv4{i4$02o>1s``Sj^7#k9S9y_gU=Ze~LJVb)we^V7ua|o7(=R|> zmnW%H@jKYo)};Bxi_2@P^O{S(m;NA2%W|v5gyK|uAk;nEC{N7D!iw<&fO&zY4=(B@ z_a2|_INq1LGNr9}C0;Z++Zl}goORa8x;|#AsoanhdE>8|^wAZRG*c`IT+!{}s6f%< za-qJyAn@B;F59&d?+bifw#>nx_t~rUf=-a5wn*?pAlV5<>J*tir@9>AvqZT1K>W#?R&C4)Q1$I;`n)r~x-UvHz$18h! zko#E+BjeA_NP!IjN2*!53==>e=)fw%>w(#GTPmVNPyVzkcytu{^5xDn6$H8?`3N;@ zy}ZY6jKG}}V}Ar{O+7^snBtzBy*ba^1&++?D>_Xg|8Ew%qnj(WbcvBfyPq))U(bM- zQzV;Q(B1b?e;v+@12nNMYFE4g;c`PKgj6gF4@+&srO6kn$7*Hh4%Bq(uqA;n7TM!- zZiJu03cWT|)@JX%)tBi$V8oiv_oMY<=NFJK*x(#Z=QqB2yyLw;6YtW3T`Sb8F}s^L zb#%X3W?m;?o}7eVX^gL$1ddU?sT^f!HQ|7_yNl78Yo~$#GVHaRPQ)yMpUV%U>0=7`nczFC4bEvG{$`%$240>`+`kez)$ImquM`_Id z#Y)FD%w`Ko6KPxY(uo^5sO{(8Px+fWVv)%#OjMXL>s>wJsmZMHk_FD6O0^TOf#(Rg z+9o^DU?9)~M&bI|W;CyxP!*HmUJ29b)8148+5;S&rcga9P3CqO&YLj2-m+NAi!Tt} zrChljpgTvBrUq2`{<2H(^FAdm3SN)zsK9PJ$ExjJCrXX3M|-Ad_1?Ij(`&exY7duw z?vQRynG})HNdDhKs6(NO1u8n+u2GXjUf-oi^mE0ui7xvoPx~nk+9oF_HFc^el>EQp zT3gHTc&8S1bR5xJjiXcc$XL_w#(9dk1#y!OAlU`g*+j@GP z+nXtR8xKyrb91vyW&GMT{9_P*Hrr7AzF6a{Uy((!mAQO|{o109n}R4xIQaP?8cO!N zPo%GSZ-hP`_HEs)u)cxNVUF}Z(1!K1;*XYc4-PJB>OE{c!~HE0L*R^+Nfx@HR-UUc zdmoL6^>}<$oC^-3qs4Bs!n?b>^KABc`6M5sesMEqbo!-H{zp#)mqXBFVsKtSL`2wX zZ8*?Nys8QRtU5)#)AaY7g?Bi=1IDw0y%0Cd*`^;S3jpK&^HVzCI0xezaD71r22k|` z7$T84EM{D;jHbJz;wh=cD|)Z+U#_)*(wnvE79JOR(8kEwCV52i%O!PWnU4N$rYO)F zjwo89tJQcAbz2}~GHmjcH72M#n~eOu-RVc_I-A(Eq#%TR#WwzQ;efT33R2j%=K&k5 zMUwu0#YAOj`YO|lkwiTu1%>wL8jD~=WU=%_aamK-6hLkrsKwHGd2%6a`OK@jcR1<2 z%>5XMynV1g`N-r*l}SUNh*#&vqE=h0vs4#ZAB8G{24BLDT?lLV{~F-@A3~0CPpSj8+B;w3?I3d z`6@|SDT9~Yj9A+{X0(F11#fT1WM+T6!`Ui965{Izh%~;oY88d>^>G%EzVBLY8T8Na zCb?SSa|{bBKfBDHK3#WA=Zr>o*e&c<{-K!VYO^V(6ccmnHA5Rys!I+Sq(cM*XKpv3 z$G~@jqwT&wpuDjPOV&M8zcaU6-|P?1$q~#Y+JOfBx#P*K`k;zY?lgRP~Nv^MV>|zYf)NB1}w<7byBQdV5y` z0l(e;CyG#UGd+;&5# zBE$<5)a3de_Fa3=U}#`YEf>P8wq$=8_T$CaW|uN|?XNOoe(Y8X1uCMwRQ@6)9UlE? zuwJLo_6?~?9yh?B8HRkly>r|6V^!~p7d@&B-%^FXIU_PeCivo3+ z@dc4G6oxy&=-A0A_MV-vF*YkAt3&U0eW7q4?wJpoAR1V>A&)a9A9OU|8?0S6I&oH; z35M#n1T}glFN#Md%u&AdqdPJ)2XVS%yma_goL!QM3G=E#kARw9txXnv=sh}$GSg{O zjHS?6n6u>}dF7@OcTZZ#%5Jh2LBMJ?8IXT!OAiDQ_ECs3ZA`>ETfNL5MtEfA>LP1E zO)+?AN(F}n2%WRV9Sb87Z4rdz_eYv42rz2a)__SO)V?>~rQ0YH764M*J7fW>K2xf} z-8IU2Zy&DInKw7b*;u;@-5gS`4g+n2*TdY)fP#dw#n z^$VIP*Z>()Mnl+IWMp1xX;NmASK3IBX>~yuR#1JEAkf7+@yB3C{3pqJNB9Pv2;KLW9EtStr=O=U&J8wJTJ~_TZC#JG2-CPlbxkP5YQXxlmE?d>&qTQ_9$|Ar zlh&}$C#SDjS>g^>(==K#X;M`#D}t9CU32PvMvhu->FmORF+b9VBN`kUn#|EF!@_nS zf<*doIeM&)G`QPdTHRxEQhZ>2!f-mFlf%AEspwL?y8jxC&Q+Kt+)-u9p!(bfJzr%? zi-pgOKq&B>(SqUw$Go;%3VI(Zf}vJEaI`9Sy3zeu1IF~9CVpL1uw#>>#aluq^;5FV z8%hKQroczO$@c5RY}w{qHT6}a3#DA=Cl&RajTzGn;tYO*vXkZD2G8WTbkgP%fNbMi zV7h(10O5%`KW9OpNt zb07489yIMKtzP{=$y5s+eEsz>#}pxNQu7CFeg9H=E48xRr@m+%KBtft;lKpVS}mOP z?(PaU#;7oK%Bi%VLz4GycpMYnQ&cIJ5IrGY)gY1TmviYMi|LKao#E6}&iBD$AR?$} zK|z^uS9S(J4KjmXz;MxOs_jC1vJiL~x<#kV-#iK%%vW3jRbi%@UAk6j*sq$B-& zDvRXL1eSt`ZgXG6^OK<~j`R_? zC-&sp7f<&ql4=K2r#^TjsOA$2yA18u=Vgt`?tqsI~_qjkK3AaFgITJV0Ym)Ar&6$y zUTBCd7Y)r90Apm*&{Bq>i&VmTd#6TAM8SWn(xJ_jgshNJQW%(9g)7gNl6NV4efV&6 zbliZ674W#y!W^*B)%ATPma^)wYP7!9j&xwpOvQI;C@e&YjQsHu-L0a+5t}dNI~+>& z0;z9Mk$T0&Rd=o~pY`#apcEHV7(q{Xr_I<$dLq7oXXw|c7IQh5%6W615A2hX_`epL z-8^3&AQIBucQF!VOZ-0RRX`z}&_|?~dke8Np1{~2cq2e4vnXbx;9b!D1|q-@OlGPx z5Q>V#d4$^$6EnIp)~2U-J>F*ByF|yL69R2yGGtrmK|#yqf-TEhr<~0`J2LPcC1)>B zM6!$3>&_By+is46C6c~K!VyANWWh4;o_2<_7AJC!ELWdvC`kuor46SaAQ!Au5-pC8 zSW$!@#33mBKlgp1MSNab7FM)i-;8Ceemc=>8#&Q!k>YL2=JR-~*PO)d2ba}1D2$MO zve+A2&RFB>?l#YSsfYSfx>#?wgn(?)`v8e`J-~2>f!XRe>btzsYq-##DZ%sG8Kval z`N0M(M~C~%i~HB=3A7#0X)b*OBVw57!d;JdNmHfaSwHYxBJtPP0dIp-S2AP2lB&yq z+vkZ5*y-NTX^YJjYl3YK96!2`62hJ=23q`JuYcYZSenpS(F#+c*`7&eN!6||7x9SH zsQli(_61)DWIoo!QODLbnVTi{%f_tlIY$~ENZ~v^rbF9l*P=eonj6_uR9Pv4(( zujjGg=pOQNR^lk|jJ zJq5&^3qTAU@m`3;^>^Cr zAwMwKJC+?x=j$IC+L~HwApfrHbeC8tDQTU`(|ZiC;tnVnHxLK#Fm3=HD8w*NPOE#8 z2M~rQVuYH`5il6`mqgYMj9kSB3BI37UHC%IBtg?d3@$M4nWEpk0M?I8VqDQ zEY6{Rq;)||VJrG>s};t{6kTpU$%y)F{W!vdot#u|*zt{7ItH3-H2wYKX5<`$UWD+& zHTZ05t_PM1t*$1RXQG&v(C6jJ0XUy^J9j@ z9h`uEzdWL^>bB(XAL$73V!qz6ryvsfd^w&~ZcD6&gqOMI*2MI_l#h+Q_RlwAr3{>N zIviuD%JEDGwaVBFy}HuT8MCt!B!5d0KuB0$-*j=f)KHDj{;tgXiIc}7VF52sW~GofC4x@kheZv=>Gd!rj1q=Rg_d3oI9KADcJ&D7GF z=;|7Q-|8q}z>=6sg& zO;z5gZ?~s%WfSmf{6-G(^?*b94M#NAH=CH&*tmz7zEAO+`DW_YRYWU24M?nfr_b`}!TH?%p`MWI+sk)&9nD6JG$q0VO-)UFd^Q9>rEAgDIlAAvi& zVE(6IuvND+^(TH^i&dfXEqI(9-af!C5Y1k08;v%frRp1{RbWr?A_5=`+L@_0Oal*Q+Z2V4hja!z}s@h-!r8-YX_=M$-J*$H=7I#QN-F= zEV7@&bQH1Dw0oZ$fdMO(g(~P9O)*6|HY3zS0v%I{_6NWcyOfdbmz5+2QdCK6UkIO{ zd18i!><16)n|-}_dNou>!oI@M1<&6N5qM(`ckc$2gI{3OxujcZoi;F@~E z8$2$lG)+enxLSWtVeGbl#^-kK8t8}5QRFH$(3rq65 zq8_fam`}6`%*g&AnH(oRIZ&m4xg|~3LZd4j8a8M2us5$?)%~skkCQU;ez~qUM#mt}g4rY-Cp;ireF)Ja(?GiG zT%5LdO~ia(tZS(C;<0OcF07HW2Z0XWVfzA|!;*j)QnXaR>tm8B6B946F9GFgQQKQT z%gfs>?i~;6%%FXhAFlVziz8mYeLDE$$jtJdhjYwxiE|=@Z*yfL2MYW4_6r0O`863w zGLrBNfYuRYWlrD!zS04@AEOa&ckk6Vj2n%8j4?2D)1mQHWs2zuH)nRF0#07+sbWcQ zXZ8X`#U%mvxLZ>3sO@ci0&EGdU&ES<^Xv3s(IMlOdbQ{jUw|Nco%1n?o;32ioOsOe z-mqWZP0myHwjVh@g>L0jk=&e+d*4`-Y28x+)uM`v)A3Ec5z&NbLTO)Lo6j|I)Rva^ zAtDANqEK2MYn@jY|AuZKK?Xq93Y%#JQVR=&i}R3;L2)sANZ)(=-<_XoUgaj?f|``t z02|%kKl;3v=wS6ilw?WZ85=}E@EfRs^8Y6G^(*I_HwuH}(U;j|gsEJe)2c;Z+vr%LGqrh$ti1ptwVzy{5{woM&8iC z)$y5kmcw!^B})*bCJqP0vTYA0U>ty~)a7NLlpF;;YaEZq4N03@)x>>dYa|NN!zJ|E zM6Ffdz}<+-#c1{)JAb6bgA^_J?R>>+^MbEuX+J;S9>#Y*spj@cM}sJi?m7G16Q6rP7v62`u=R8?j|O_6|(6X>Ap?RMU643Me1za~TYW=g83cYSb>nW)FC<7w|$ z&CMlc4j9|`i`CF;c4qlAULxI#0Z5%AgP{g(WIqz<{=|n?!tsoB>lIFh$an&hhHCW_3ESPQ=#_0j|;4`QEt;0=4Q|xs*vX= zep#rYae|@|BBOaxj-!6FI?Kd5)d(U+`!$&juO|CLDNDB{Q&1`#7khExl_)$~h-vEj zUCjd$UQZ|D2iJO26mEuSO*QniX5LaF9NpUnZ4=YwrSZKNN==$B0=oA9 z%ulUVvP2y4Xf2Zx6L}MCXUEBI{%xusJ~LARIwFndf|DX33@{o6yzw&tQ7#ihKQdxy z7=_tIyc{J-PqX~SV{BGS2`h1NAaxTdEL>w^o|v2G@Gyi!8~CmR7|6vkOIo#AOHCD>So^?vf6EDT9Y`~bx< zk`8nmrlMdXdjq)E@o5A-rKMXI$z&e-9t@aewR7}NN!;;q4>ywB-uRm2odEzv5!xpw zwJ~IxVP|(|zXaU1SH+sx7G$(unBZElD1oUd1_F#ahh_d{du6pPjm1<@^kUuSST(g& zPE4T7$xj=j@2l-!Z;|l(as>T2c}?EM9mLMqOoyZsdA6@-c>jLhj5MdcBn>q`TK@`( zA})q3YtuFEZEtKN+qI0e_sRASDos zGy&>aan4i@wz|rX7wxW3Kj$c&osJMVIy#vzw+WOy+)x_qDO^Y5stRpE=Pzc$0MyB5 z`_1YmpEGUiH&n$i!z{6CTt;8W!wmzvjh=~VFHezr(M!VMHU<_}Cc_r-9=99wgIe*& zM?Vx@?G0wkH4bOmE09ioiw#i&?nXg!7U`dNoXGGoSgvPk$(8*yepBP(m~9+M_z1Qd z_7dz*@>8yiyb=w=9mW_mx+^51~U%NdiS=&MEVNTC-*pa_XEQK&j&iQ_wusG z$NPLXx{9xUDs2=9k!3z_^*3J(bL{Qy{Zyfml$YOPL}s)j$#a4147Gn{MOz^D z^{;UXwt$wZW~lRiIz5^2uWx%MX^3+z++FVoI$o@BuowEJaJqJFB?F$xj*d#)8iKSr z*l&n*<@E565O9y#J-RwekU8F8DyNutJ;T|W&xBz;-Jf~YSs&bFW0ML9h*>TMs2(o> zrOhMWV%?*Y1^@&kP zNGr-KI;IChok_**jh@`U0qt41?-X$y!^6y;I#C?4@Xt?@vZPJ~WCldVOrpqyGvo5QXxh3s5cUb~>Cm>?Jxw?XhlXXrRJC z2n!4Qsm>6G_~Cr{r(pKU{KdxM`K8fiI^R@fmEpxuvP7Z(qz?hWd5}j*=hP#@vz0!d z!Q~8pzK;L&J&p6L`e!KMgg~#coX0B)9hkzH-JdiUup?nBDVDMv?C%$(rC;<%*VOnz zjy=K}e$*eIqfpQVpqcJ+X#>M+Yb24A92nxcpHF?!g1gC^cSHC{CX1quADv?99EW7V zQ=e6`#F9m%F^M@?vrE?$<22=Z%zR~jRaq)EvD1XSQAF4O80-4roFmfj*a5XELgz>}BXsIwF#MjOu; zMpWKy}0Je9h>#7RV;ey2AW>xihH6e zm!5iXm5-j*_&fo?zBA|UcE(AApqj>g>j)VcpDr5jAKbj|@N;!OP^otG*%VW8c4j@l z-dVW2IH;dJUE=4Hl<-BcG|Xj$Vx2kaYt=_!ZINO-FQ9tFs` zgl|JKLh2AS6i~lrxBC6dT$%o8 zssAjJU+6uizZ7jxUvD7)VB+Rv7To+`q60UhLebo`)uSsK5ud?e95pYuSIXn1BbXg5 zk{2nEYgeRpsa+KiUZO?({`Y{+!!ZYU1di~bVpct%KoC?j*FgbkHee<^{L2FPY0&N* zF|>UwZKp8Xyl-$=nrn!y5B(q+87!Ebf&kD1*7GqZp;+T{vmb7fS>QAN7kh6N6la&l z4?+l#0KtPxaCd@R@SwpR0t5)|uECw)4k1_w?(XivoyOhW*^`-XW_GK#>VL7f+ZSCl z{dT{nkDurH33sI^_d3WtgIzgDHSmXF+j~w>+M%O=$H7%7{D`3q{MOg&Y&Azsmn*3Z zTknzMrMe^K1y-l0i#I4KNZxbgsZQk8Mc{l`KqI5|e4|gNYC}OCd`l(&H_5auAh1K1 z!4$_>)YVlv{^z?u>w|A)5Pa7CwY|fU_C~E$7G?{1dy_C@Ko|=Y0V1_lNVi+~cQToBLm?Pu&^O0z`SvDpguHe)jmN=@^|2QcQOxDlxvrnz zr2|98Z<(GwY74bw<2K_qnf&<2R!enuYcJsiZ+s34)uMkX|DtCoSgK*L$`&V~c{-vZ zFRL?EYRZ$%KCiPq0D3Q0)=Qc{k$G}oc52qt$ne<*;w2>f?U!*2wb6S!CkO8X2!8{o z14GqfQYOws24E>$ZH^sqdK%2YP;NPea17X3Az$T(Gv#kG_+=K#{Tex~E0o9-ScKYR zshFx*XzAzzEtf*mV=<^WELH$v_vD1cF61Sfpx|Aprr1K3NWaIKe_4T2HIenn!5p8g z%tmc8TL`yTn(u*y8Ha`B%&0*2w|uH%li{^dug6KF&A>pUyIraxvl-)2Y(3P|CFk$o zeT2z{N9S;ROLR_CnLq5`JgOu=EIBVWxJ2_4dkC%Rd6SGybj~lN>eH!>|LKJXC%>a& z?bkxnm;3Zq^Kn;U*y{_0*r~=t@18((xIB(FetutByH$X!)~b8FClH2C6}7!ss5v3LOq`z@)MF1oyy$Xe|# zW#z~_PGDfayxvx|VV1z6U+M1-dzWaqvLWh6#J|JrNDCJjnA7qDna9e?Y}H}?VwX?5 z{_Gg#`qMDoxjbRwb2hW(R4AM;)of$ybEH(5kJ0B(8!*!zf8LR*6}cFxIa>A^u{K!G z`dB|d&2Fb?k-nD3r( z961w}qpq02^-Z66I8qI@%ZPng=Jz`K13lvm>9#-lyvN0@&;Jz_3GZcFGo9LvVaH25 z-S0c)DQ2{OKY#e}-e2h(m`L0QAfgTG3XrCSFt2|1*dCEaK_v`A>Fr)fUC7EJAmqpU zC?}^ttXe?MMD9=68N|lT9tVI+s88pkn)i9_jn3!WK(&>pyx^tF)eagjK#&OP>vOSN zhFZ>)kiUjpRZZmAyPlHDdU)CrF#81MqPq+X51rui zi-UomP0Sp<5Pa^cc6Syw8Bq>{6MqrJAS5z@2gPN%rC|<8Q z6=+KYF=l#&N|GBaEY^zxowtyRQ2^3RkyNHQjhj_R2=Jvw*;Hw>GE_9>=xh1Qj?n`HU~mIUlKE%SB#( z;d5!rnp9rw=mf|QiCTRT%oNX-U(}3W7pX31$SDJp9QV1*tmPqK>bHPol(j1GMYK9c zLByjdw>w}(F{>vIcD{~iH-~B+FRN>6DK$EpufYOiH1ZDFzHVE$Q-ck)5IUZ`wOSeG?N?w(4Ot`~vJ8?S&gQ|Y{mjrKvj_?)C1>>h`n#Sr7st*hTE zk^xh+2=AVH-bC{9PMC}k5X{%8gypXl75%&-Y3dD~oMgSOn~iL2eio=cIN+*ur1J(! z3_Rh{a{45@5|L#_U9SYVyfZ+$4z=D0k&ix|^}4%DT&&!v4;7(QTOqUY9c7^Xacfk4 zGk-=p?>djcOZ|9Mc@-z8iwr?x(8&_ogev6I6@zACDJaodOpwK~up9_@v99}LUt=^W zK@&(s{48h{90O}vHgM#Y&-m5(seqI$Bs6^E2>8zGeP0mior-T;YApY)6r`6YOLn(l zT?qE+G=KN$)REHBv9Z}ITnx*UvHf2cf5HYbXnxP95OETd{!Uk!Y1A8eb9F55W=0DE zn}*eD^F7OMVwsSHg92Dw++WJHqNHd&H8mT`s1qXij_GMPjw1x&Lqj{f?i_}-*4sfD z{DV>ZXK;Pk#v%Y@@?2w|(DQ5doSF?o>}{fbAuHRIbY*x^kt9<-h5@+?Mm`l)q27q^ znmKmUg04TPJ$Yimo>@R7l8F57x+N38M=K}2J`zK*sNI11@$qibY#Iqbu=(KLbhPM; zh+8iYNm*NC;;quK%4cqM>`tVmu?FCkl&HTq5A*~`7!>@!p_M+jGyh-|!6HR|T{zf3 zULf@9;4llsiTy`Y^E3KTVFG=se33e1!jX;`wZu0njDq*4l=K?!+rCX&kNdOWb5`)N zqTddu#+N7^4X27i>P5(`t;=eA6;SiRWC_W!eyckU0V8P^3bKP_id|r|~I}6sRjSSkKJ`GAItWJ5~Ik1#&?0G-_ zXCc*A@S*JtEGX0H`A3d!FT-+G_Cq(!7X`_*v^Km&#Fy6W@l^hN7>SiCAnSTH=p8Yt zjz%~Jz{!0rJj2 zO^mMwdMDl*{Aw9!T%iY66L*`~=9)#|u)(VufR!SrAP1p9roIk(2_IfDypD}y{sp_(tErU;}uKN0=o4o0CSRxU4 z)c#Ky>3%Q)fq{Mg{dgiMC@Hm;(#CE)Gt)%{F&Lt6^z^j(_+3+yBsUrypOe02-pyIf z`-^JfheU0!Z4F-}^CkxJyQBXU4vh&Q9U?;dEVrF>`s z+=snAtL@k1UJK`NwpMN5TYn|lFLQIE83GZTf3l2vp@mxq|BN78Lf4SfPSFL#gw;Do zJwD!%xDUT(gx+&Hl#->R`$|Cb#tt!&ggitf>g$;Bqg&tXwaN~$p# z$Z!26-8G1acyh4hq$gF9EQ$~66k}f`BcbS@T@Ca^Xf{9EiwM^_?4Y(ZyRH5y#z&bh zDL!*W&(5CeD4;~IPoo2ALzC?huDg4TfiU}w$-_llG7O9k`3&;&$pTgmts+HR$8~X@ zNJ44ggYqhaA0JR!l!exx9-+A!jb-a!SE!txVw$;@bob$LeAzf!`g?TiF`Wq3sQ#_V z^@y$Xc%bXEIEw@DSx`4M(%3B=oJ`kxWvKQ!`USJR-5D%zM^@J#0t)S<5VdfiF(cL2(awx*T>yhDz>jD;V@@|}-quOH0>cLqK!^jgyy`=HQO8aSYf8jqT6a zyLG+dKzJRX?S3Wt6qulAuK3wl9E0TOI6}|c(-g&qM(ksL#t~%nQeM!=uawETvvUl@ z9jpqtB$$LL6YcN2UW1&iDiIO;&V2krB2z3wQ>@QC0F-IfZoklZi~dO&Hr_^lppwl@ z_j9eH6+}Gi)1S7fx5=oKYni?kvk803X(IegtTFDKRx3a-zP_Zy<$6!7Yq?nx_EZUJ z5#)OK`S}lcoqKwg(t*_}x>PrVTtp~{T>U65jrzcST#N9F#^uDk1@io|%ZFVcW3n?S zM7t>oGGDcN7EKo1Z9o8|4v+IET{3mM$z(nG^o3NXz9SFZxELHS!Ti3Gr7L+JoNT_q z|1$OiI@Hc0*=ng_vZ_inS26kwE~8wAQNnQ_E2Q;V4#Y!?0GKQ7zyb))g@2sLD}D5s zda(YywIVbVPnV2EDBCD6=*iGQ<0GtIOji6GyGAIZgi+RC{gmeIE1`mp8ckv1dRjgV z1NmtO2l~_d$EC)Po@f5z44R)+4{qTAvY_b&40P~p)ow1l0#HvhWp`#g^mCl{ZEn}Fl)~UOG$QHaCi@%#w zwQV9%q5X&<{KeGV8=(MmVkG@ky&-Po!-wz&*Vrf}C5^PWt|Xx7J73@%a@Cs3M{-(Z zoGG5Ci01mh1=TrS)P7i4`fDr~F<^SSsiZpUtV6iVT8JxPyZrGuojdzIdFOs!nJNPw zVwNav1(j(BMRueWF4+J-IJBB)5 zkm)yNT3gB4dwc&Vnh-UL=Hh1YxVAdLWBNOn z2@C%TvU^@a^Nn#w!S&UCc9lD_(C=yFip=G3sH}7)$H_WdTYc-k-8X=Svf0pp^YwHn z?w9f+nz4mvPo$W_NQ^>2B=Rdbh1kW7jh__60Rd^5Jn<`Fk5N-=ax;=H$sY5j`Qw^g zCM7Q$2Csy~-Wz;Xn(EI)pH z5>uWeaMUxxXKEB2^PZkOLH5e@Q+ow%c{6`N2YlmfVfo?xG1=Ie%+&Tvg#BsHr`j;Y z0Xu)_{z{WB1foRNEYHHB;jFY|X|(T}X*$bYIoj>3j-)YCQ?`B%1FrH81E&N^JiLio z5~jwKr@q_1GV4nv^yM8AGryIn_+GrItM~Q}u~_PszUIHX>h73`ZEE5}AN)vv_4^AV zOz6Cv9H#0Y*Fkh+b=iTBM5L|{N#7su(LzM4QdnTbU}4?_guJ%1KUe$ZI7MAkpZ9iF z8!B1&!{qJ+7;;TivcmH6r7|ymuI1i4@;K*}w+f;G{o9X49XNALytyk`9Ockk8K8!AZT= z^;#K^#a0it{!hq^`0C?5d3Vo?(ax{RO0q`fPR{wqd9n{ww4qo^`J|p9)>>j4uZ4YU zyiAQylT!@nyEsOEzf<+FB`|nQc~4h$J>Q4sFPXmPFZ%)@+(s-HU-=Y@XHMkE;-^%b zia2~Bf6Y{$qeT)w4v2@wK|yRTrv{oRI6g9z>(e0^1X`^bo3c_Cu;%o%&}K$)axsI^d1mVh!Dg2))=YuO@sD?Tg#1#a01l;bfAxi&3ZurE zNuu>W5>W+d_`>PLHRtB$-cajdZ2e|Fh;!QPvrzoTGi&56zq5)R zYk$Yp8qa=mDz@yGQ@cZDBdd{jc!nO8mh#F%4Gpur0K2w{R&1q|exmt+N z`g}0AM^ai5y~X}iC+$0-NB7^T`<)=Md$CZH%O$J@m|#-vv7cU$zs{f?hJm3$=<_pI0t$qx+dWo<5CWovvLcatKs1QQO*uWJjGYriw@ig!$UZ)vJ|FQqF5>tI z>*$y{>-HOhHoYsDzh8%4EtV|#%A-r&#GVX$t;Ve9W;3=Hm*%NeL}K!?>V z(ve8H?6@ypJ`p2#@)h%lESW9LrvLBDXRVE#6SDn66pWa^;)PAh2=v-EUh)^%izbUF%QxvlQYly2A!AAGv>9g z%GVRA@_fYU$#Yn1(f$XLDg5Sx@arAW6DuPL6{s=!8f>zDS%Dec`IHp2;yY}fjy-!E z+*J-Yb|^IzBGKzNUC@jX^xVmX+au6_wmMN1URf%^QtwY@ol<3<5J$Kar&J}ehm0)L z8ZNeYhTIpvaL}y!;W|?Sz~=`3>uLcvATCY&_K`|Ph#cKk?S!2{oHo(k^H`VO(qacV z%ts4d2PTl3@Vkl1sbXy4FSu=>Dvy??oU(C%*_zA6A!3^dn1|HV`#kk=wJOK5 z`+D~b33@{?XeOt`U@56N076YwEpe&n%NBYR1S;Uy1P_ z)#lN_Byl+pHRRV^tDvXA6Am~X*T>W8Y2kz|n@_LQ8^Dfl4NFfdkYE|U|MKb*pJT(+ zfRqL=;{fCl&>S^ujc1=8WnQ7=-~LhvUj81WQ?Wug*$2t=O+>wZ&%Z?R*8d9it+jiI zfVgdkOnt(XC})k8Sb_4|^9b)dE(CTA)<}5Z7c#wB#?)auP7XJcDKBSCiBBcBVaUtt zW$(Pb@tx$Qe46C!*{0^;+c1I60OZ0~wx{Qh_;;VrM|SIBsoF3MO^V$B?mWcDl>%LZ?jTfkG)}($ap@#S`jg|R@O1*0D z9SXi3jM@u>97D4WCrjyxjRv86`kF^PwQc8|69f59hOF zTusdlg084S{7sTnOw6mf=2YZw-|8-QMan)=?w=Vk67mJhM-h3roRNqRelRtT`{?*@#co0{T)w`l-7^n~GzMJ9@cD-LXOm+AnC#y*0^x#eu>iL7?lp-& zY4i1RE<&&(rUIG*nppWetTJ7E+9q8@S~2=p;|sZducVmJdHm%hnR2d&hVH+iqO*Q` z`2za(S%AWRJ|meezo_zBb1B0u)G3OuBdb`e-J++~$&%I><^7UcaN7?S#>i*>)0coQ zrdVhseK(xaJsw2VVY8~~xMel8`Y~30Yxg4%%gmiQAMHFJ-IiHkH$jF6({L`acT*Nj zwfAreU+Y&i;5C)T>qU^=FB;)?$&7>aGLx%4CO@OYrMWXhSS0!UVuFv~nh2OvP!7Yt zS(_Y5$C0JnbJ!EDKihl_@a(yx0;x>3GxfM^>gv_BemxO}8>Ox2XYKH5f*v>$0C)%@ zA<_kku8hAA6&2N4EpQ(0=o}Ynj1B;u?F|z70hsO6(|(PYk!)7@y$O3h&*WR!dzdwJ z@H$`_$>i&=_kkKpPOiJZ9piG}=@?=$>|1OVH1UEA#JfK1m-eTzhdcr%3IW=;^h&n( z^HuGQ!mx70Tx}%>IVYT{uW!sdUhaVzIQ4_y*U3gss_Wz4udE8ZjkBY_GrjYyq2HP= z2wtEb61xR|XEWgfbfkoEB&plG@f>@TaB;HA-Uu?snG#Y#?y5AN?$vbO0!YLAZ_v=> z&*$HPMnpRG!sBO%n!YSBMW(+Tx;Qc!<916?0GA;li!yEHhCiM+DI*e{b_BUuV1J zf@D}kcdj<~UX4Yv67`{~)Iw|Kp>*Q-Ry(|_=cC)mOSl+^)fZFvoW^!DB{^GCA*dCe zysCw7v&Z_DDWuC^I=j;LBJ!L9!>fXWs z1^1_;y;ffs6{_WbSg3&-0?MogY9;hFkkbB<$d=M3VThXUs=5$V^tW#~P^Eb9e=QZ^ znidp1JT2PKzGXqFUDPQO+5|uDb~j)7>)2X?1)IwPN0BO>5g^62K6{aF4bzRE_4vR1 zNk&S&y)Htdr)PjDskWK$xWZA6I#qMdkh&E8u3bE8Wa#mJuEhfP@a{VQYNeeZoh>L5 z@L|%DBv%&e#RMX?zU9p|t7Avu_tqCE(O3xkO-eVr493%~soFER$C|<6MD&nux7A30 zB%!AcmYVvlFffzoE7h)h=Vc%w9IAaVjg=4g=Bxel;}>IN*6T5e)vni}wXK)MCW+A> zI_@qHG+K%1%6`e<(pFhYZ-IZNX+T(`ktH|(%k&m?aA19G9Ayj3C(asRGzo<)z|wrU`5Ysm5EWcsC2#< z{}FuQUIhNc=M70@uaghuR_EfFRo>coEE|BUTUl!TjoXpw(aBnTbWQrbS_+$OU%8lX6q3GR$0mz2CNtz9a~wso)HV< z%L#dm%V{n4BS@zE-XsYlW2A^y%?73pbg)KEI1R|C-34I(g48fLYSwH#6ey*QdbwE- z3>ZAJjiP#GwvN91hpb`+*ZQo3EW;KRz8u>hg~Fr?bQT1O53 z_|WxuLl%jJsQ=+ZQTqF^SPn*q+G5S_WY2pGWJ@SX`H%XCMH=Lk6q~$dzybZW%i()g zRrlckU;!eBQzhaf32o0#-Z7AT`@Yl|vQYIJa*#8^shIY8G}F7ndzyX^nLskWC*t(< za?|4TyZc0X{pXE-RJ;`HkN7cYh<&Jj;!WFJLl1`Z=Ht`FCbX_UCw9nHRdtU*M_ zCmf#FsN_oJKY%1m^hW9|3Rc<^>!Q~hzkyuuOUzs^XM3e`uv<(7=5&eH45juSnNCOo z`quJTbRC`VN@MGd@6LK}!CXFy<3e?|$d!8(V2S}pF$~~#BwDKNs`HI0c4`39`XJob zADcE`H)i~u()QX43qZk+j0SAn*2Poz`z2+K{9qvtT*2r;*CMFd2%Er>WK z`n%8siO4Tqz}MB)Oy-BgneW5?1R$Po zzCliYA7%;%Q!EjgV>Or%XEqn}1B2?-pd&P4oi(ur@X$b_VG2f@iUi`y%$ksz>OHOHr%?BR zLN?b_tKd|FbH3L?&E&{Y2tFQW*B!9#$pjb%wNfP-AuJo58+6Pz1fPS$E-0?<9y|R_ zsV8hqQ9p2mpUQcS#l+Otg3M`hoy4JI!nn3L1aLjW#xj%`BSwQU3PM8T3DT`IDTF*_ zV{_b8GY?Z=j7OCQI{jq)po2&+x}3ndqYdIcQDm+Le*Icn#H6}vUjgqY?fWzaCn%E< z8>>5q>H5a=zMPL@Bm3@^+Vg@42!W}i8Jm-Xe5{ENxvn;Rq1N&My@4Y2RCq=s7uYNTBQSMES$PM!P+5A^RwK@WFFf{uCR{xT&`2 zFDJ$N{N%o;JPz>qgh?zOT%(Uqyqzs~p{A#&{(zJhJxx)I0xMtIQK1jRTVXGcb@ei} z&WVAyg6TxtUOqVZ^Jrmd1z@&TNX7fcVQRCU8=tU10lk4ThxQj+#wZkal5!*G6u9f_ zbAna`je?Ju@IXSsz>q~u!qB?f;H3dbmKx7jy;v|2a18adZtfPeZWhzr9mhtAEHCGV z&skU3i%;t<#!8xIcsK zhK~!6QeoNk>dE8QD9yvOJZbn#V4&{#%g-;@R7;H~_NI!eYkT)rzfD>6tab#XJ+kS+ zws(n+$fowxn@*_jZTReUJ7WI5Z$@or)QLqbgrI9J*PM|6vhWgu;Phh#fYy zHJ@g-KGfX0zxV4G6<1f6i)P~Oo9jK(<_Qe2-3lV+I`2fG2O3>FyCLnL+t4xm44wY0 zi)Tzo$fiq8P8Pt*)ea7<^+_}7I1<)-6RYhr=tKEJyi$Ex(~=dHxHhYair-I%cP`&7HA*WTqo1v_|&Nss@IwU zXX?22{)N;k|CcgoXtNshGtJN1hn27H0raG#qDVA?6@A7TFb`Up}_~f zm`E7Q$c$KbPrHtOtw!gtrwlV5`BGCzr(VpJle59?EGnBJGr7?p;ARcxH{@{Q(F}Qk z_AFso)|gn9fFQ#Pb!O;Q49ZV73BSYmKRvr1zIS?oOGK1JK)~G9z53m=so{)2hnTMq zA`(Rw_99irq_Unn%co&Tzgt_2n*#_p0ZGjk}Ic0@TK0JtG@-r z%3l3;ip$llf`vPIcz1WBRKeRE=UXw5gIFixugljLIm+aYeM<(Yo*ZvJ16i2J<0cVR zJJyAY($h$KU77n2emm@DnBQ8TGfD@l4F?k(TrS4KQ1&gfopmFgmE_0jl&F4oc5+ub z6b!HH-0V%I@w>&*I_@!VbfQ3Wx$NpIqb0Mlg+v6m4G%}yfm6PN7&Lli7-DrL@h?3Z zw|ghBZ#_A?%Nf$~VEFt2@c~4&rpPHB8>sv$no1F%?9-^$;bvm2AbJmoYzw zG8)=}j`l&>g-dsHP^rb%aLs;mk14!UI^mD&&L+NYQyj&@$_+jtW zKHn=cnL~OaxZ5suvh~)IlKOyQWWiJ&i^@@R;<_4N8}n3w$i%_%iB!A!47%47-&=4d z8j)tQeK;RIukKcCV9&k3qOiTPfQk_oF4HVlF4D%$=W#64&h_h#M{3Iw3;Q}b5cdv^r5n zQgf7dNRRcD%ob!u>@5?NsB6%k^8S_w_6CVS($DEII4op!(b0*ACOAv#El(8Do3OWQw=VqPj?2v*j(}0DbBBb zF4ulYvqsO4!{l;AAX7u>n_Wvvel1p1x0jXxr}i-+z0}jxl*4@hn1;kP2v~rXF(rO-&FJ3yycG?YA9eFb5Su`B;HU;&6*XV=rU7eQD^C zIy$WSoh_i!Vq;fB;eXpH++RbOb}1LxC-$evPVt)Sm~79l^KZkL#y`(8Q%?RC8&GlM zg&-6(I~Y-yBdjgJfI*!I_PNp*tES zy95;7s$d;D)jt*1dV%yB9Stagu-o|E|gTcc`h=UFvgi63vhB!d4u(-Z3+{d6M$4p*7HMW^ka5$d!)8ME5nnJDUzH|JU>f}>c6Ad&QFOZk zBMf$IAevMz0)OZEz%o)&QuMHeA5&{dmjETxvD}=-?GXI?a-Yp*n*Ql&3x91iy>o1d zuywk47Z8?Rv?a{^V?Mu6#sU5wXI1+&`adUO3PLI{JH?zHC-MXsoe@_HXD64Pjet`k+32_ZF($Ekk=JN4t zz{;B#FexOq?bKnw~a@Q`}|)Q{Z@}Q48w{>NBbsSZ+G)IK(^W$f{bh| z=5#WNirYV?)A(0A@LD#l4{U)YL&Cd?6)Dg=IzKk|JVFYR*|@pByn4gq@cGYLw*_bw z(yPPHcp4W^_v&F>qK)q|-qN029L!m0)O~L=8hiz5OayZMY0`;# z2KjOqUh8k@u@K?IlBPF|Uk@(}^6=l1>j$A=RC)`F^YUt&Pj4(v7Ra0d5{o#R*Y|Zy(7e}&yf|-1KF#+qO zUQg~a&%Wj2cD4g_O4;lwmC!Lh)$DQv*F55!jVvK*n`SqGNR%RAx!6t8j=_6US7`d(erN3dbivXf>8i) zc@d2ctEbkj!)%8a?S39tC!OJ1Wo=s(y_E9CI*0QYE_bGPQN$?gz1uRp<<`WIaDx6p z*l<2xE>m>fYO}H1F$vt8Wp~$^MssXLDw&l4I$yYe^277df{7OX>V>K-r;;j8X@Q6D zFf*?*QYtEL*6X(!u{MF{qWIj7PQzXh@$7pqkMc|HN@;1sv0n;&)t{jq=WBB1oJ#hj zIYu)_LzWs{&DOdM=GTS|hx%4_M$#uur$X`cJdNx#rT`wTh3>4V*Ltqwth9CODN%1L znr;uR>AklAX8A!m=MPrEb-S>OXRrVdj^Dg9iYLU!3;#1N420 z!=cpUfhKYy7^+wv7ihh}JZ1KX41<&uDB5OsilA)fzzi~g`2B8YP;8lgr)4xeo5LLI zQwC>Lq#ryR{R|5&Jy()-rNk(%p+VC5Nhi|HCU(l@o>--B^H~uY8JQoXCz9gp-NpXX zVal*^gTOt#r>++_qzc3?Dpv!rOOo>iM(6eQaL;bH`8Z6`Wm4iy?oNH6umny; zTja!hCY4o@@Wt1FEJ!-BdpMP4_&X#-1kx7N0&OIr6>Pn-A`1;79NvU{P#12kUgW?> zZ|9nXV)Xm>?>0IV`rc;a{&fa!v}B4nM}X0323`LS`UQ~8iXRmSyB(T>TbbVi8hN8k znq4JRg&Llzs(GMW*K19=KiIl$(Ly=Z)@hDTAQWp&oK2|}%okz@(uH0DnRblK!WmEC zTv5Ks_xR-|@yp|xW^_V7Yw`(DzHLolIBnV{I#^m{&d-e|!2Jj!a{d;};pIMKj2e^} z0-krDip|v)A0NuT7}>5~n7#l69-~35)DJ<%7*ylV2kKZY=g7SY^jVsvx^-$r!Ts&u zcG`sGO4XySf7LNC67rti0oCNE8{0gf`KvP!K_OgLSFdn*+FP*L!cPegAJftK8svFa z;_1rqkR}OOU(%u83^H+PkJ-;!uqr&Y!xxNY!vklOSRAzWdIqgmnpLkFD~t-JtK=AnRYq1#rH8vxvr`XAKwzVGL*di_-!};BqfIIzjxQ-abvcHu9$RsU!CT%maXL3EME+(y8fMQLQ|0#By=-*tyMB zkVb4&K)nT$2i@HP6N8D{xKl=Y`N&U%yy)0OBLOc0LmQXenRMTqp@IdwzkZxQDMEa4 zzA8)c{wl6mmyp-QgdP{SD}%eU-*F$|fWnd^`Q&IRmG*F9edS2b&46^QH_F~^n*LyX zoEfMES6l1FC@H?WKdd!}YopJ|m~?rtebB1z80in``i>gOs3*60cgY2)__;v&CMuLP z&qseim6(|Ja#!RQ?u`wDRsvwS8$=RscMZg=%cb>Q-`5oCq^3OHuPfBE;+mS02l(5V zbtAA=n)}BQGW(3{>b|sGluU@wpEibv_qe}Y&tTNCq0`GK3P&=KOM7Q?Yd7w6T;s|| zvs6iCRH#e>c0Y=i8@Qv*-f5aONFpVVWP`&I2>foJ05@!rR=Mq~wY;$bDX@ODHNLeg z66<^G9wNO^6KDO$=U1B$I;Z7;D?divcCtwsXEImymyp90jJI@l@|gm_78{Ml-Kpi; z+{vNq7<94O3W_U6#+;rWbf+8UtV)yZ*R-kW=>=S$p;UMse#F&sChzWw67mm}=Sug} z8t86IA5>f?&VENVKq34&{o_NN^&(EMVy+|t%J#=#eTNP{STA;(6Lywq2# zWqf~s-J9>_c|bt;F*0;*ak}^=gQov3ZFT{@kNHB4G5~N!4aAq*JCM_m`htk_YmG{{ zM(qN`#RjMDLN~{b>tm{J@o0@oKNuCj#aQkSshd?N#bWGwf(zAo*6ObEj<)9Tc0a^L zq`7_{)7;F@0vpa%zvYI>7tb3o1;{NWIy8`9XpGCtTn&w}AYBW(-gd1encbt?fyD+p zJyL!G!(ZhEl6*NdCLs954Fo@R-QSFAR!cQ-I|rq_-@TbN%ps?;w^(j6VDKOX4`(b` zdEj{^DrzMXX=SDCeZ-y8`oL;6qcAH`qL;neX=`J%GD_^->CmfeZh+6{4Wq?lLz z!=IT?&V8W45`*r1KwY!90Isq#Q9M!pTL#gm_d~r=v0t*so%C_Z$UY8~C>OUC1P2FG zU)O`@e;#iTGD83Jckt|wmA@DK^LR7hO8c)H2do{b1Pb}df8-ST`?Ud5?(Xpp7#9Dz z4}#GJcIRr?D#a4g-`}Do-g)(}O88eHEI$2Hn!m5Q;Qpzf|KnR_bh~i>6r(Slih?3w zsnJ>Q`s@uJd)vfBC5{$3sp11B-`l^H2X09U^rgr=@2{GVHmShSo-H>FD;Far?LKbs z%ddt-)Gq(7k^lcKPy-w|=;-K06icuERwfz^5UF|U>h0ZrAVxZd_j8%S-fVd?jsu`S|mHj|)-J60@NsmfA18QG92?FY-z4 zwElh;JfgkPz}H2m{$0=}Cnr;Dyt2n6Wn_?uh=@2X@k#BjKmGeUaB00!hTC32YQvLm zvm1>KEom*`|Fa+(pqSJuzcGR9ad(TAUwd0Jo5?Tjdb{#cEzu*ny?;g)7}Vi@elREk zH!HFl&V{PQm|Sn87h?X~=Mw{C9`BR1^DF|+wm{GpRc{UYZ%d@*Yf^5$}u&o&8EHr2dVO+ zLeORxyA%29(-fq3Z2#-%Vyu?)RR$WP@WdXU==Z@7*Z9AUJJYeBuquVB%~_5vE-uUl zUBL!s(ZPMgS^vAiT+YW>tFN~+y6(kEnqYQ1|37z{GwZFxLs?~I<>*9vJ3CU)h}jCB z4Wb)ceLAxv;D7?G%Jwy*A{GDXA9gy+p4UtJnpQU_s|abKeS{zQ|2+vmiA{nQw|ejF z?2L|qfym$5|Amx<1R5JVF?E&}t$v|k`#+OiTphNqOP1vM^)W>68|X!bzyAGJUu&>i zMrdELak;vUtt|;Z|6|HI9uiy!hy$LU*26MjL^mdb3;sP(NrtfDMev>Vkp-mG0zsmG z6-Dgd^ZVcaLh`pIDPwn2&SleiF0rb_MRRWcSIeATpv!@-q~n+&9)YJ&X*{eoNeY_k ze>J&S1{!C(pT#A&Kb8v8F&!L?333qsOtc$;w|95rzg6f`Cw?mz2;W~FTHA(!Whm`` zJ&8U~KGW(P@CF_)uxi1Y=JLOrcmMPPw59?js!?-YU0ozx)*OFLa#B0PgA(WV)AeUk zKE8tgOrP>W$WKVb%VjyKB&4JP7o8}Af4~S%dxp4fr^lFw2lu^cI9l1=o66^Mq%HZ+ zhoWL*)BhI4`MX>?k3zYDn6ICot)t^+ZlW&jE+rVmoNpGe|BgQ}0u3B#dUt;*WJ}e7 zNtjdozx79>DgtQgfDb^6NkQt&_upThGYk9j-gpNHa66|l)=G^ z%>TU@Oz{6-*Q37l)n4N3v$H{SsRmro1J9T)_6mz{Z`R$V8*p#`Q>OvwxXHp&QpW#T zF@;4iq#Isyn9jERXK@V<{(oJ0`z)zxK6bAEZC0t2e;ThgE0WOU^q{hk8`NpeUq?_< zyP1C$-;Gx2-If1f0XX6^GP)P*B}}IeOo+T(Xxy*G;~ZlDu4+d-|5VIk4?Py0`E**I z{r23&4ol)xp?u;$m*6>3EJ6LN5opo~d4+NLTxj0lyPb9*4!hi}@+8Rw##kjtMyve( z(guOV&(5+(67y(j^L2$pOjLEQ~-OcMKlruqt8WMtA3FcW} z7I3@10ym3I=M|Z)WophzwV!x{r<_n>BweX5f=VTibqt%+SFBi0da-Md^6}%xp$tOk z#d-WY9!D96T}4=8Vl_oY){tPyFIz)w>hxE&RfKliW^?1<-X6fb2B=h_gVJ=DxH|7p?3F0nQfI2G&J)t%*oyAg}` z(>gffjup+B94y@*w+1y5Mi4EH5GmL{M_QXX?DkYn1=kerre;^1z@{{rj6qhAC28l;F|&5U%;_+8xL-BY&8>>C`}S zi>LW`lPfH(3T;@awT4_K^5(&uy3-*7aDP#H`7$T=USc^ri1!+z#{`*YWn<&^w63I9@gTLNhL&C8jE7borT-WVA6*UKj;M2o>x z89PIL(QI?I$0Pjna|`+F2WkFO2q7Uxh-t^S+Y2_w&BHqj&a9xZ4g;^6uYZpfX*hCN z@eQcy!7hD`E&Z)P#w+kpMh8{e+7h|mD}5w%xQ7?k|AplJRKSqTHoAH5rHzA3_ZSOo z<(#NpMbNP8!$ZZ*)4c$c$JHDJ5Qg38QeAXtRqXT!;<7-q^&QN$+VA`3tLnNHAjDGg z2R1)$t{dCgv9>-xk>KJwAC*@bh_Qjd8NSbJj3)!2nUV&wQUX38+_$2mSw3d4-27HbK>fJ5OMsN&ZGaC5x^l(m$#RxoE zhocQ_t}OVhTk4}f#yXu1u|>E%-R4m&(9M2n?3XV|1qz+9Lo$fYid6Ob zogO#>O>gPcj!f3N>^Zh+)J8&1*YBar9Cleo(&`_NF^(OabxtOGdk0K1t4(IhN^p>{ zt@mPMWBdF1erQy>v75uez;~ErYG~A0z-LR8l5yRvRlGNIIb93mFKKwXJ%8T1oZ&>n zbm0D>T$0Ad)H3TA9*)!#^&ECl$me74Tst_|W0LvkX=tr#g~*`gR$(-lf3W24Z#=wZ z&*u9v0&hvA)vNgR8`+muRwq@;G!l20=5N~Ej~`!uS)M%98TN&ZvV(Xs;BuY7V=+b2 zmpf@k^%4~hhvUk#nvCf2-R)4Oo^x^G*bD5_C^^CK&|u|AV{^9Lnc)-^?8>B6#qhg# zuq3Z!xG$db|7n=mSVr->(dV?`cHy!4?CACUh>OLv+|%}LztkQ7z4_f(sh&AN`Pn$b z%WsYV6KU@Xdy}spIoI=ogC%J$niLdhWRl9#`(vL;$g*Khu)n)Z%&TGwKGmgwDq_Y7 zk7GO(zdb8KBAE59vD^n{jtm(tYZ6-{&6OkTcGoP)NMOJA5-Qu)E2JvRcz6K3@~2U{ zf^wEV0h_Vkeyy#x%7pXJTXdh09X5qF>EhRb)>Ev~i_j*iux z3k&h8#Sb_+H<*MzzmtN*^ zr{x>~f6!mQhN#;W@J2#)Sl+}6pz}HPO5y}`>N?{$=PP$lHWOKbU-8tDI>;O^&RnjO zgZmRp6}&lUsorne@t}mhT6=TKQL9c#pc47A6 zN;zLzDSl0Zh;B4@tSPEkr9BBnzc1o1ij~+!Xn5pqQ&i;-MjNU(Uk_}0NeSV;*l zBO|4d5UKsXEXu)wicF7uWwt+va1;u?(G3j_0s<(X;DKx1z^z?Ggc^(0vB*p@!TbU? z42;<3@xuHuo~v;4fwL2vLV4Qz>IF%YLf)TXVv;BhJ6)u&Z?yg1=0Xc+N)5|Wz3%NT z_H^k%ScNqu4{y4SLk&3(Pw@D-Py_)jg=i@{KR>fbPV~MBbx{%Ko~=#)9}Bhq!73x@ ze0ut$BlCPUWKhuu zrl(h#oEquw&b8Z>q%j`FYN#qmD=@~`8Pp=6JKZtt7&y3mD=Nas&Y|}%I6cLlE>^;^ zw#EdPB_=((-RZ9g0jd89j@peXOX6uJZ&-+q&gl7t-g-^1@-vFw;G7k>!!q>;`SLVs zY;2KGc@Nm(kCPac`E*4`ZgJR0FqXbF2!#u~FAP_1p(Z&1#NgGSP{oq5|F7h5B$*@o96* zGBSnA%1}m85tfK37>_#v{ASfLfyyvn5*so(c^86@kXotu+g9%? zco%jX0ysoOFnGKvlIrRkYjb&H^HW!PIN@<|-8@e}B*Wt4&=f|W+Ar%P_X_Y;KnGErNZi&|HUKYwo^rY#}Ny zPxk&javHz&a57K^b8u-}wEIH3uEKpY$c?{tKqZS!hDE3IlF7@lH3sN6W&+sJ_@3+vs zpGZiediql!8m;e7kjl%SF0+`~V1ASVW-TM@9r*8EP8&JrXudgY2PHq9>4fFvM0aYl zoUEpg4kvpvyE#~MITU&f`4;3!Xqe26!iDy9F4oGamN{{7fTm_2xYbpw?q0HLeNouP zHJM~447c0s9J!p!hNi{Xw6uZO7u`}-Q!PWg%EH&9#b$@Bx%V6T*NNTVl3SVg!oNr>iEhfJ_oI$ug^+ZxCj_dfz z@Yh-gD-<)6gt2n{1RLIHvEI2rFp$c{om;;ahr^yMq1Idm6-)JepjDj}GM!sxGsAuG zClfY!0Nd9GSZvl2U-;V2`5zN#(@m!L^#}x<@8p+(TRVK?=t5s)AEqqcpmO4EZvwGn4p`pG9a2~rM@ z3|b8V7&z+1C?iZv=5%g%NN^w`yGqA79&yR$h2Vnqcf6MQ{ozvi@wQChWKkQ0`A_gI z|2qB2gM%pcJA1@i-JBc_6+e1=I}aOCXJx^paXI>oq~_QmHng>k=ZdKf#!-I!cCtut zeQG(XCShiVgUe0^3BEeG$&nX4Gfr}q+-7$&Q0c6no^~fQ+v4$>0k;?R8Vc}PDqQwO z0x~tQ4)2x~QvUwUJx=R?XlzbBnCuCJLKxiI)Dtx`!+=H-`Kv346&#GoU*dk|nCEsA z`jMrjW%*!*+nR2<)t&w`fmP4X{%m6zdeBm$Q7?i_nE9q^V4W#ESH5GivPdW+V+;;1 zJRYo$!;tW|3Mo%e$Sy_`!O@lO<=L@$t?b(sG5qjAEq~u*Rxfy{^w0rdr)U9?so$ zEG%U7_mc_;#LU;7@a&DEpBQx;4Caa=5yC@3rm~C1B$;%Yuqaeykf2jFL?cQ$tAZW;k3UnANXEpJ3>?G?RVTzV`R-(^jnv?w zz=90v2^~X0Rj4`Z>g$ut5!or!ZiP1-YFgjj{pR5Tg^V2h;e+4B7{96JOG<}$ELlX2 z<&jKJ$f+ug@@RUf{?+c62m)69Bm3)%%E@YD;lml~$m;6g?rsOCGepCY6r0IO*w=9F z=aYwtnj%87Sf8LEgE|Y&(4Oqye$IrD-p|P0U=YL~EpG2sk7{1er`din9i^DjO!g}4 zH5iZyMpjrC9jlC#YOll+@GdTC?#@?Mw>+J~V$coqqfO7vf%Ld`yQtu_r=x>ttmf}u z3JjY09t~?ta@L#4+O+uhkb{?*Z`WB~FYcGa*0t(t?XQHOz$`0OQ@GcDI9YV9@_M1R zSZT_f$Wggkbx(IW?_hJ?1(Ne9;|#Uo4qt3n?YpZXy}i+i`-k}YMlf{->3mk>Xugj2 zA%s$SwiH|Z<&o8N$q688rY+|Jf&uWR!R_tz$|dneBV?aHM~OAsov*r&xb7yGb8zpC zEMOxegIT1_u1_ar-90<4tH(?A@R=TyfdL35JFdK6zs3insxatweovh##bvcKn9TKZ zIGQCLJK7rywBPIw&s(ywWn}j95bTX;B^2!&%8{(9s#5*?Q^9A*@kBjDIJ8%`sYavC z6eHCCBODvE*RzpyW}AoQ!yvVk>)pyL=Nlp4vunmq+q2!*iq<;lUws5udXLu|;L^tW zGLw@B!mx2&&RX$>gwbEwfh#UHo0SLa-WxV^#t<`bZHb*OVULyQ5H&W214X#;@%+=3 z=U6J+$==P}++X9d8-$zMYUZm+309Z873hoehG%T`GUWu?rI0{T)6}7vGIN8i-nsMJ zIxR@Olf{*mo7n)KIU-+Z730Hca=X{JtFihk8fNcTBPgU-)L&LB;-D(5{^(T!CWMXL zUubaH_oi7t*23fNj!YNH>@1AYfg!VdeS~kI_snSz*LAV3jNJR#_QHk15JsI(woe!=B&6m zPyi+bnLFNZOQVoTr9;f#@l<4>oTrWCTZDfKAH;9Rg*pw2Sq{O&GCsU&iLGLK8YZ&kF>F7e1dH$VSk zH`V_BcFA6|aZRbzWZM@>ozY^xb$(%oH}C^=AhY!qkS&_L`_~gX08Mbd-TsCzG*jI6Fza}Kj-BCQN92CH%^Sr3Y@_7$XzJo)Ip2K8 zF~(CpZ}f9ubQDk?wcvhUdB_(fARr>HE{BFdZh!W^&p>>y3+ZT)=OGf$)$ctd#%F?z zc3O059N=!Q4QdazwVIk5hgC0kg148m0UjBxS7kLw8mzNgaj)R8rzU#%DfI zD0jER{jaMB^0azv)bQre1&8Il-xTs6c_#b-^I5qTwCRi)<2!t=dnWtcDH_cN|AI{I zzWs?CY~ChnK0ZwPWuuYD&@4fAxe{ec<#LZ`V8<DcGu=v!f3lm0+t#u19aX^ zU2ShC&-7l+#9_U>JBC4wSocLrVAdC5KqbG;H=SyF_usj;h9F#TrGrdB5IK?5vE0~2 zq1D84bLc7Q;jxOUS!+h-b-&@&cMI& zABpHLe-WK_OL!llj{Qg=kqT%5B#=yD2})soxoY9_^5E$Td`nr;=b|?@W*;+|J$-tp&=fXDgU9RlESBob zYi>w{d|lOJbOxYnwXbD)?fXg-;Y5Bow{`1Guyi`k-f(R5Z{wkaQIEG5NEUNt>NPe% zoMJKRu?;0+mL)a}#Pzhe%50vVO0P5}-uZ&FM7r52{N4V1B@sS1+i^MyF>KNm-{*CuxYPD^hd5YGqfOT z@dK8n6H~`wv$BtCuleAwD$VnmH@E9yky3ZBHdns7>t--4Sd9PDwv?>6o$xjW$P-bp zlHPpOmg?vv)43RQ7(T5}7p10RYFJro)Mpgvv~#kUtdGoBS^~=D{q5~n6``(Cy4Vo( zq4!Z4UJrPCXJW>S-q>*6R1;nM?Hfg z@Nxe-pV{t?A${TDfpK;wPhq>s^M1ox?C$+DpkANfC->$WWRsMPyoE}J*4_%l_Bl!D84`- zBES7c=g!#L>gumd9oO44{*K!d<4-VR#9zPS)6-*~HdhefbFmmaTn^S)a&tB(YJ1^x zxd6)K1r!6+d$pl`c#shhMn)rUzkt)N?fO5{-O&|66BFXo(+Czb#SCadi_t>4*8AgX z%kCYwp-A4{u8Q`EFGNJiV|*IDS%Px8dC5g`Iq)PR4(l&>gq<@pK65%qU+zX6ULJ1& zYzp7jw!`6cj3<$JN=`?IAR~jRUVpo{>R!>_ker^LOsT-d?6BXOo0rF|-|Hrw5!MB4 zRBjG4c+S72LL@pmI`)o?#7m{#+O2>4018`G8reoWQv#PijK0v$+3K~I4hKx!dnw!u z3~3A1?3eTUTJMs0-AOQpcFs=EH=@$oB@&(b086P<;$(NM%A%_qoFpj%m^s0>SImlw zp*MbaV|S^nQX#2~bhLfwO(;G~r(I>Ay{5j8+iW12iY`$mBud90K(HR+F z%HWFoye*&RImHF9WA8t0Y@Q$7_HN(x(9 zR}|5x$D=9#;mnl&_K!2WD*>P0@R0_mk=Q0j1WvDK3`WM}q?E()l0;rMwq0OjhJ3R4 zBIe}e>XxtD^~mEI6ISoc0Rsd2C1I=n>i3CUAMSLYu1xih>5NU}D7o9|w5Iq}oOx<$ zsx#;bDa@8BIK9R)JC**?uv*wuu^Tm?{?WZqjape#8kwl_1vt5aha6g28P#Sp{^u5+ z@KiN|rwrclu%FY*0}T-|ywUZFuP?&?@_0c49sy*@vte0+OIrsE=?_;g(L*I<3sqIH z^R-97oQ18cvoo$lMexTDikaF>UiX#x>s!Fb^Qlxw1G9*xG@gS#U+9CRB$KIXV~NtT zk@-4Hw9(Pj!2!o#ZJr1mHvb^Cv@FZD;5vq=LynIHhDRI^*48qR_>Tn?rY@$YRu=t&d)hcSHo$YE7H=6r*;nx#5i4Su*%C3g+$5!dN$KvTr7YGcs?O&iN%-= zKzg=p=QDg#QVQpq`374K%SD#G(ezJFXKnr|DIYK~sTXT1b#D$~`~u%b^Caj8d9V7T zqrrcH=WqWML4ZKS$_nl2iIA2yjK$M{529h9aH!R*XvS-5R<^v*-D&6d+fIM1RpU_v zW@g>$A2JnQzuy)ELPB6u*=`IryH`P5tNqI(uK^P_7gt^v@6TUEfrwHh+}w%S%ucAE zqlC=N=)!Rhm^~V3GrblQU!MBL8?Q3ag9gUO12r2ye;4YuM?tNQ{vo8Qfy?CPprNUm zQtf{CgUexFeKb^pH0EMTCc@+8<|h-g&iTuoXoDklbT%=zR0E5^Dy5f`_njZMA2cz~$RT5a0(_+cW>S$X8pl zy1Nbjl#~R-#!~V>Geqflt z85VOssi|Z*>gA@}N2aott_#Xr$_3Bh=H{2RT0ziuVdAEUrTVD0aT9lqfYNAyVAZNvJn&ydS44}OXCp(f+s5~b6JvAOFY zY1LUE%-DfQy(VM--~cG(>OCD)7X4Bt8juIy(miG{P*=$yi zJtAXZ3|Y5p?Y_Pk2lf2a*Y`_JMJEw;%Ki>1_$73H9&k8}}Z*oMX z(}LA|apMQyU!)-F>jP<-#JB|+ftM_j$!FeZC;aeIXPp^PSBKH;q_wd-A|yl%u*M|Q zDK};Z6Hy)>J=NyhlUDc>(Dt^J+|5lLWLvr|ty@1NJ$!Qp8~?Lry|%aQ{K&x%M9twmd=8UA?9!YlPiPE z%0&0jYN_EUop~#yq2b#TiUf>tct8|jV4VSj$>A{Q@CMsFV-FS`X^Du?#m0kCSL75F zwk~(RfZi=qPEKfQYC#^}=J8TBk~%AVfqEa<<59?c~q81hyrl#~0(~3P4 z6KFDH<&sJ3(jp@7nT=Oz=SJtTq|-j%=B}?}u~{~Wft}96`nAT&a>SDeiO!Q)1!b z+B{tH-X6n%i^KHvWIaAP0ySKF0m_s2{T`T(XuQ!$?Qs(iM?er^V*d6Lh)qu3 zib6lMz8U zyV}`@gyvE3U|Cu!skVF30H=_Nf-xuvh{02x0l-Lxx4*#~jpF?)*Sdp&LB5r(R2`&m zzs~XU)JG&}8JI4@)P|En{CRu)+3VGHdC7rZzmH9CnZpMUk7b|!`DN&=WOjBhI9RQ` z=A_kq>~G~mMiLfhMJAj|>G|FuI#OC%%0zQLwrIqsE4#4_#g{;HP zd9T>3+=Bvj7@L1Jye~3yvi@w=PUxvOd;$pPyH#{<_UhO8{)k3)p<$|cM>IDdF*~0! zfKiIrd>)X%xjOzygtt{fNMtnE>m>wg?*5)fz3$oP{9IuB^787bj}Vf>^O1zh(X8Wq zBV4Ujo#QBtJF%zHe%0a3$~Qq7GJ)=fh(VTf0~hUj*S6Ko5q5O6?)pG~Fq(vQDAx0I znFJC4F(WrOqzHMo9AUjToE{s*-l4>`FARUP`Si@x6BP=cRU6Kk?oQ(mlk4i{8tsiS zMp9TiS5`_p-90aQ7zG63`p4+crb$pfR=e2Jz+oa9Pv+L)@w&Bjy0;=0Df*u*S#NDl z{=V2s2iC_;0@DS)zEr+YjpxsnTe>i7sHVa%ZS30gmAK+gwpOSoPYq33_QmTz*4!rb?pfu{jzN@ID z`okfePs!X3l{JDSf!QqXV?aPL8m9UB#>UX`0``BYi$o&v{bpzgBDc~;NyRacj{Tcs z2k#vzE_8CSfiW$eoB!wjI3kVaybq;9+@93T%#8kYAp#y(oS!1qFe*YgE*>veQk&-z zlU*)vBHapAqu2RQpYv8n>a^8Xq^MX0FC?q+bsU9)MIv|m^Nn_#H}ZZ3RMadcqHn76 zPt+7Ye}35ks1C&XUZQNz%o)<+;vzi3ac3BI^L#6J%C&=Tl9CeKJ63pvyi$!jB4Du+ z$@ds4k%-nE5(HvNqtgf`2??!8#Bpzf?TBh4Q}OnyXk_nS`@Ni)kBT7Y~>f-5ld5oT#thw{sPycC)a+x!SYd zI$qc_?62b>;B^}fKtRP}Erz_>eUMjG#Syu|gsvGGd(00D0}{s-gvcFC9O43fdg!W;yY zt6lt!NPcm#zs=5Y9IltxU|nZPB!&_ z>)ZPjQgloj8Yl)80E>&>um!0fKZ@>xGuKd^PCY>4RL{VIhA1~NArIQ{@KjXbEG%go zY&M8QBimdpo%hFo7Z$n%AnA-9Ovy-05*8NkLJr2S9d-^&_BJ`{12Y7V%K>FJi=YAr z5ADC+Zwks4w*^|mYE8ZgehG2H6?LQG=l=ZE$g1!eTlcQ#ekB-_hvNII=zRYlW|-?uC# zvXSZB6`LEjjY0=-2vPt!WLj8o^|)2jNuW7+EH?8LCRy4Zc)33)&=EqL|B z(OBRBAB=BhWSZ=ovWH7$r;cMojwER9o?}M|-sX@<2>bcyAet}PsI>9Q+A~`=u)QOe z!~&zIC%k%^u9{WGrN2sXtz-C?t5H?|0Q2(am^$WM2t;PUc6mygjcRW+=-R3prpev$j*3*RaK?ZZX}CITm0@;li3EqP`T1Y1?w(0J3(cA)Z*873jkY8{ z%*K2bvv;q7Z*Rz$i9Lxr82~q@_IS26-yJ>CB=dNE$u?DB1Y=2{){ht7K|pAK!JF>+ z@ZpCXMmc3{FsI9Z00J}+?F#apz|6c2J}^nNRvWMLl|&`Y3!5tTdoCYbXM8k*<> zFH22!Vw)t{#%51FyTHR^0E6qLly)NK-5KV^QN=2_i-6Y`%ZHuB!Wi?a>aWYqDvwfz z(TU_6=Nqz6@Fsy}mMgIB)C}IQUS3ZpuhhJvO##gix{AzAyB_ir<%raMjbh~pRrls`-kzYAx zO70TJRNgbFr^n;5=ub7hri(b`d$refZGwvnJ3qdPd1#r8f5E7CNvtLBM^dm!&@xJ~ zKU8UQ5@BN~5BtM?_qdi*NnvH~U2CrsBcMbj=YsrevG4#(FeqOHyXJj17D&i7RclVI zsYSnaqV=K|2l6j4DO9oI^p=C92VF4v1G#)oAlNa^sI2qpXikn%XbEB&RD64)O zjT}PE*rQQ~7Wc6RB{Prwtz?8U>xB^#m56U+|7K%@j7bm0Xz+vF!XgX?zBDO<_{*0t zBEeDRbC!s(INQf-e7?s*YA2@~s;Gi`>mkZ!0`#b%9zfI%bo!5%YblV%Z2ibXpAu?` zAQ9CA#>NhdwdT@yry`mys$R#U;buOnG)70tgp-rvYcrGbKO)g_QZ8|9sn$0HIl+($ z<&C$&pN4r2Dlzidp9$&pE;a)x3~t(C?#}rCc)y`m^p8!tVxW@jT_1ewjXaaS+I94i zZ?(HN!9AQ~-#wi9nLyvJ)1exjS05QCa11eZFZIfq+`kSluP$R)6>6FQjRS&GH>$o6u9*d z4dn<1>I6q%C^!X$hJ5&FcK%ahctmQUW}pP#RvorcvvV|^2#`JDRx30^(FN9ncgfL2 zy?x|3xT#=>3)Z{5?SuP^-%oGFN|=Ml1%{cfx22a+g^ov7HoKBg6|vZubf0XiZjR=9 zmNm-^CUCLP7%fw9A08fP)a)RWOE{4ST_4gblFu$n=3&IzmQ2R7}(g>2jjo6S%wHNJO%oT!N8She{xikRiQVyG$6uU z9*pM`XQMzqn)SaLAQ$7{Vgn`+A%n>OE_dd%Nu)ozxblLO+s4i;EJU2Ir-xNVJ3B{T zt&%uq?unRNqjPtp-p1B+^q8?X_MU^)x%n!@eB?+_jv5DY9(5&;59f^!#qy8Hw0I@x2|?1HMNhWYFlGE-XEDPQ&9O|rXg8toyXkEewCD< zi-`QbP?M2Cmym!2RCi=T0vSLHK_bcqIXh0J!`9>;D1A&E1iDCZ*k}Qb9&B5{Z=OIbD&7 z+7$?Gdud>Yz7Z=AK;JmZx$+fJ9Ua%=UxgGtH1cTHANFTQP<~An_`0YM)#6!N&Vbbv zp-BgZOUN&%DFg}i%+D9<0c5ABh)qOf5evs`yfP>1Qb^)xrKR#~4Dsib7?JP)TlIT)B%G0Xs%u;}oy)PtWJ=_R`%Ss_xnZ9YMGG04i=D0Oovo4_W#_1L zXucEzBjZHJxNMX}U7fYpT{f|49wpA^rk`U`i3Ve4F@%VSFwimnG*sG)r%^1>=KXGk zg|(lRMYLzg8sRXOS@PHO2?0d0FF=01z1fp$m?1ap2cs1=U~s&Gt6ZKg-~^B+9{_r6 z?j+13^!F{?nu3lF{Oygynt zue%ze;^?n+=xiAR11l>TGcz1vCR$wdxSSl5)e3B$MB*$+@4k@bXA@{@mU_H}gro2N zuB;?5L`VwZWb$xvk05N1Oq^rRoqQWPe;zzv6F3zDhV&!4*@@DK0z=V>LJgD?r zv$InGG`wkB{tjsg5W&JZv^`S(6po8K*-&|TYicSGfoN|JdAcG&LN9}=vu4xe?7W?* z^H^;%@zHAe2MPVz+IO4W+)p3;^Yh8n)w9iZw!*_CyJpbA&V0-LNCpVt*@*@7Er?nq3F?FTV z`3bee(3cm5Lov9Ll4k_TVq3*uWTVGjALP+>)&fB$ys>SN9|r( z^u;E!g3C=`Eylxf**ljt1uRNsJEm7!SwU|f8rrrZRqExHzigREcpN5)ER?7yD!Bci zh={K|JcNdUrG6h6olk`(i(>yHs{8^~u0I5amUv9mTGLaE0G+DCzU)Ht&ei3P#Nk|p zM5`ML%4_30e=`y$`Tne%85LgFN0!uTW5U>k{K00$5?X+f4kDz4@Ohqp!N$bg@uWi8 zkyBL-@)w2-3ztiIYhv>A`?QMx8#=L5BhL)%MGg*=_3i0*=H`N7;k675pAlu$)jQit zvWUJ{lGj?Ahh=0S+S&$dwr5B?B0hw8a((^UI$8V0h2mR|2$bO>s}LCeeq+{OBB1@Y z!LLZTxL7QiaoitV3jV&!oqFnR&FXp;{as08k+A)sI;Wc! zML>z|ovu(U)>-xjqw0JH!troiB%l{2VmPOKeNC>2F4CJVZ|#V{{|{qI&Js+&xJ4x9 z;P4+GM=RIyzAOe75hSci^TspN(+q6N^ocstBT|XSp-@Y}l?b?f#wyEn{RRFzodu{QlVgkwMjZSoN!Di`UfC@c(!^YYiQNpX8 z#7L8cNdUgIlkz+xvs?Fm#-TcpG0MqRtxZXG8Tp{)h9GeOPGyy3X1 z07Q4Nv$t=w-Qvs2Dq3#A4y<>snuOgtLk&5j;5K@AFdI&H53^h%n*cHL<&iTwF79{5 z8Ki)q!o_Vw$Jm*0ZS3LO3Ii+ptfHpo3E}6sENxyNN!QEm1KbjSeov}?F4Wi*f2F-$ zs^0yVD0)*<*M0*gz*>Mu)ZL3A-`-|4@cv;k@1xT4`{&XY@P;mK&Tl$IU&Kq!8N)v$3;b+@?n1s8C zMXB9xotNhZH!(2^C0+R__n_&#tjSd$A%T*%*6fh*1RY~#0xiMY#+x}7uKC45!KlZp z>l2Fg)nYFoY;>@nwhau?qf$}?P4=%;dXp~q$G@je6%_n5$Q^5SN8)gz@quoP|TXIFCl~ZtSOxq6++Ki?GdG# znt3u?8KmbU$5e$5^y3Yx7izy2eF9CRgtGF#wCmF9)O43xWn5kUf`FS58 z^af%CG#3|RVnPPmU)}!5M^b;x&XL&p6A|%60llh@Eh~p)|DCO^Y5xu@Yt4{aRd>e2 zRUk>cIM9_*y}kzXxW$RdPr?DJAc>(P!XJ*`t;AVDF1pGz78g)ZF{!D2ncmvltE~or zZ2BSQDrRIvu;#TCJrMh(=viI=D}uIeEdQYicqj7JY3^@tSv2lUc>0(dD!2 zh-1>h6fJ<%QQnbD-vjCmkCE|!$My2}@UX}7$_V&{c=#FhH{df^mc;LkC0`WB>+Wak z`P|^3NiJQp)qG~gS8iq|UuWfLyxmW?y}b>t3$vqxlE+PvD<2>fy3a0m_3l^Vh%XTl zIBC2`fD}T`%8CR!*Cc493{=cSU{vHcbSQ1yv4 zMvw2cf%YA@^XitP?`2mY$RydA^#f2rPSm}yfM{&o9JAKi3YpA0R3h;Gr{NFj0PWT~ zX8U}S98u@)jx0(<#602eo}OJvtVcX;ZMF2=tK^K@diH^LQ(bm|x##o=zA?96jM69Hl@Y!8p(@{u6bNuef%gU zC52#VIe@Emh(7pBla8FdKB*o-&=nOe^)LiIFeu2y-jFZ3w4pmBH%o3fgSX4Z-h5=M zPe!fz7S{QUZ)YM$68tYps>$_8ey+=df}LRB#anF(IKxntjhn+G+}?btxsn!98=E5Z z{w40%a;>+Y$MYEQcqTG{P6X{=(LRv69S{v34+OE~nM7>LuJe;m!XpdUfIL`Ueg&k6 z1{9)&PjxkZs~hK33FdIhN8nAsq}xe!y8Q42o2F!h2AW>u`yy39QvuxLo%6rJVxq2q zWCjZ?8g2MM#1#O{ow3LGzoD(};i*6=DQ&nWCv#et3M410D4sqZZdxMn%?N8}gn`tK zg@r}@le#eBE+}~n2SrF@*iqFgD`&`yXQsO=PG5E%Q&TnW4dv%WYb0`)U z*i;QKgoQ=rHhxm_t~Aa& z&^Ed>zjU;*{!=`aEgzm>83Q^nACK?&`_pa75C>NfhbxnBEcw_^Q`dmmGAYxAD!P>> zwTWtD4bVyWuBV5o?O}J7+w<*6b~`?PXve@{`@PxzA;#5|j4u$Y(5U{6+!-RF5~`kG zYInaLzuF_lp!u}hM|k$rx+2uqm$FPF6k0ou1yh?|l*MV&cD>CJUNAM>$82oARygRKu7?nuAFZcNP zxPKH%)mqP#lrpH=0q7U%aS#PPg2IxiyF)FmbD#qP%l*lXgEJX?-reoi z0W?-|IULqVnT{UJA!Cy3_l9wM+^x{6*Ov5Z>i;aHTMr$Z9Os)$W|@qNb(Kp(%T|jd?OMjF;{Q#lM(TndXJ;cA=z%`)jYz-Wfy(?0ZH= z*W-D)bc2P?`kMp&kW>xx3_eehu?+9a{b;?(lJoqcxa8zWO*&Ch6kVfyQH$fJT4F;Z z*tNt&m46ZVl+!FNEHtG-jrM1tdmJB!Jz>1ckeAEZ$}cdG+RCa-t>vB*m2A22!aZJw z@Zye$PkVGS51B@*+9Gx0|5^YXk*)wcKxt282?~-)9sUT#NU)e^h#F0Ie$ywYHQd-s z49r}^HyXX}=@m&=E<2nkOZ^&4=4jj-rktZ zmGf=&*7nWL{%(JLjH(0sm6#&5;^ZPZfc08HY?G_#s<)a@PX6O zV7UPf4UM8#78xZ^^FeVK!TiWg@hpm-h?X{WcZ7(BCJ>dpSmoDyao#8N#;u4MqChZ3f(;@4DvafuFI8Ll zw@^k~o4|b5?@Mf}yYwwP5xq?OuU{Sz5PCkU7_^t5Q=gH8duhDhT3O;O@^&c;6Xl~>DkJB9dVqAPF)>8ms-icmPO z^WCYzJ_`UKz{R~Sg!k)1Qc83) zl3TsKJLMHp+uMa;%hIu1^Fa_?yxg%jIt)PKrUqQ^PXvKePo;iyExNYA_xM> zb+}sf>E%V=(t9k9aTwOx!&teVp5K3FXJ!PVA{K#b#Ih^Uzg+m3vBn4)>Mm+KY zBUQB*?#m`BSq+XTz_y>tw?cyY4QA-h6*K)NnwiXYvYHK z(5JhPc3rcx4U3j&;_FK-?gj<`c4FC@1l@;xEF zE$vSaq{Whp+MZ>QZ}o9M9|bAAladk-Gmno3sK?;i(sWJK;Pv9R0b^U6fa0(0sL}*w zP`VA`<80e8&XvP7RvgVR3rLjQcGC9fQEv6Z)V>4yBnrx=>~lPC)SA`GAC*O>$niHI z2hg)xMGJX%a75kv4H#<+Y|I}_X^qc%#qJg133ka>$;#P!%rlUOg~bh#AcWUXO?7qI z1HL?6Q#NysXD zxkZE<%Yd2C>+K!Pd^=92G9F!q`uXoyzIa7t4O&RRd(CzNjT2+?ufZ30NZwnmV2Dm( zkrI!JiCMyHMb!@^sgc1?GD@3UB}-?r4-IYjS;Y;`hKNXdmDlOLirCZB2Kz@xZ5NI4 z1D%Io_;vhgHLTvB50H1m@l>F`5qm;$aYicGe}#U1r!t-H+A)h`?_*a z-zCz|Y3t_Aff?p#0M4n@*E(3$;=CaK7Ll%X0D&3omoELOy{O^n;An_}T}4DP6pYe^ zcqcO!vA<7&iNnPupTg>XM~RKD)SV~sy|B2L$=OP@dvg$-7Y+^?3hK9j@lRRFP>gtM zkBf`n^_3|puqa|T@vYki9aD9>f(nvSZ_;N9lqZWyuPqG?ny|1RhzhbV#{xRpEhzdr zvoD=xuUm!WUsDQX{NFTG729284Q02tnOIo5Cn|}N4Ss&fGnANueS>ark(-AX2|o-< zPru|OMG-SqBKugOrwzt>*~gH46$ZWK9y+|$d6VW%j#D}Id&(dO0lKyJ0;XtH8pBS% z*>_+jjXX*WMSQW{cF<>xhY@yO29{Ef@Pk9~%DVFFJ=jkOBRjw*7c}%>aZZXHunGpI z=o=XcI5=Aly`S^B_Tu>yRki; zR<4B*r)_O`lc{p}M%(XW0@_UgbQp`p@Nc(ur@9=$z@TvBj2>&bK+;x7qgl~-dXh@- zaytNMER{@`=-VyEij_v^7vkyl-gl;)t!nj;Ip39k3&FwZyg5Pztv!6|>N^PL#L+c= zam@g8I6h7x+?0|E-=7qQ4$i$^g@Wp#(OFH%66C(TK47l1Xw)A6?Ky4+Ek z(~%8Gq*q#~6f8vH^Y$WKtdaZ9xSNt99EPuv8H&lTw8%y*z#!e&Ses?7qb0r#s=HOVSo|F5;H42yD$)*vPbNC`+uH%LmOba$819Wo5fpok!?A}Jx_05fzqqat0> z-93~bHACI)Ip^p7bD!tVuRZg8v1jdX?{Dq3-uGRAlw~N+q~zan&$2QAf&*rhI0QSG zuRZA*-T<{PvOL3;kT9baTabV9MDvR~%l0hyhKrCx-Eec`{pf(NNVA_WaiMjv5J5IJ zD0fwCtOf|$Tie_Bhu^us+F6J_f`c+1c&JM=Ot8)f1(j$~0O?>Y>6E!HWUl2;%|+B!U}_oBbuZLOP*13&1t7Cg=bl9 zJ_dOW0az2Y<3M1`un-^wF+F~qusfUi>({U6XTA&{5|gsqLeGkC&BI(H>jM-s%Pb{D z{wD0Ltr?#_8~joNI@VhFrGM4FIx`cD)-+Q}Pkm4=HfwkEsgBN4;fZ^Hne~xQ zucb)!k}Df0`JqwDh2Q!$NcA2)!yc&?I%~e(&?OT_Z^|Bx}jI zjcamDg-A*hT!-^)8laUo04(shDeB7OJeyHFCfXoX=Hf1ZxITBcWZ*AF0DBRNiaxx* zj;pw_xjG1s5tY51hz>e&5cDZfFP07+&U>CEJMcw4C3$;dkl@y>J529CYaj~92N8(? z3P{w^-k#Cf>3_TvWa2siqr=6;6j=t{j8gdV{WZP6f2w||6=Rt3S6b=jYuKa0*16`A z-cRdBd6}P82xam=B&a@ERZXs#oViv15>zOzZZB94v^WX&COw(rRD4| zB_;ibn?xI%6gZ0DP4qTt^i1ko=R~C=?bdj0zO6Fv$cS2!A3#eu^g6wch`4!qNur=M z1~bvseC`4CnXdACKRL$45pv+O-$to|0H!n!CBMw)A`x*mr82n$nsMOQGIG|Yo6#R1 zi=5cKjY(WyXEzx}U5v%G$E`l0KSEOodSp=7dT6dKCs-!cH2d$1D<{k;0J!7DnKGCs zL|k0a79E(n#;q3{I-XL}>h@|H8aD;gVnNR0k%I=Fu*eN@J8QtKHrNE)`=Gyet@VXn!)}#2s%o5{5qAS>8I$94zKUTOH1_3fI z!JRvtt3+`)G>;=l=`O;F=-k8ueK=+tHa{0{2h4aHry@U;g6lW5XTYK=qVHbW3C-yxz z%Uq59W@dZ_e{od5{X2i5NY=hj=41@n8c&||HA4&KY?y+tnt$cfh{ihh)6zT;;ZkDZ z3O*vj)HR^XJS-*0N{wL;UB*iUa+N<>I~cuPq3OL-%1-zbI0RaSfQjP0_#dFQ} zawqUmSmdot3Fj|JuI*PwMtUun_K24+O*giT?`kKh8Jg5=lY#*NG2us{FrnBuimhrY zu#7_1gqO#P2Yv;Oo}Xh308Tc(rG>8}K^v4hBtwsMDZh&ojE%*omZ;)m*M_}}jD&Pm zGBLxq=lAfwrHg=|;;^EnG%;_ng@oUj&3sE%k)>q0+58#9 z@87r6&UE9wd%wjs(}kZew?q5`l1ec5d3h!)9k~VvvnwHv#zsY6cB5R5C02Cp+Olzf zaa(OMr3a$QdF^pDOUptrWo2C%;=_^p`GI6~7ZjC_#7x}Wk*bNu_b816-)gDrTen5) z;}ltl16v6IKP(d*NJ1tQxrbu-9!JxyM>%>I@K6{zoao0(2(5Rfj=>trY+mEDwmUlj zkP9C&CHcXQloR*EyN7@|KMS~6-ET=U!S;$qD{H$Ad&IXrGZ`o8*Y0()8!UradF}l( z*dZ_6w33K9u?vXpu?u?N%-1?v8-ibgU<9aob-0W@`doV%Z&0Z6k7Z0AuBx4VJu{)zfjvcFqr16+lG0@TR_Ge%| zfT1+4DI(k&gD&)EZXWLKX{dBEuk|10Lbg`asNUX`#!abL6MIa7qc>? zFydg|+u1i~d6Lshy{mLddW5QVOZ(CHiJ=^H$8q3zb+I*|H+?k0b)0K}H~7?x1H7y6 zkj>OV9BI!^P8QBF#1nPpw{XTw?7a^+ij9{g^ts$sWstv`FO1Ndp@=MZz>9dvZ*-dzoiSTGyC2%|2Lpx7dPBryTvgoyU^ zqw9Et7uvw{$B#VkgOzm^mL;{56u<9ad&Z_Uqpa2q0SOFAM#k*QAiu|=?&!`mA;62h zOcsZP2an^QV&IT9%qnXbk8x1F6#Gqbgz#KWz+h8l;}Zrvh_JI>Anon2jkpIP+v z3kv{8)~cu?==3;wihvM;F95D|#8M4LkuXaDOVJ__X{n$7g5GZHhx}f+!w?$$as>U= zFUa++N!fxZ8jbW1JYE}+WiNM5j4deWX!3urTxg`JCYJ{YX%<81?j)W|Y!3l(f|c8x zR9dwwfr^@1&Qm;nfOq))CuRZgBEb7xsEMQvfYMiV4|AOAchg|15kbdmw^Te|_@^m+?f^dE+fDc;4^x zQ2hwIArDe4KbJe4om`L$D|Rs@C87XRQEnF%8aD?o(}|mhHFhEmmrd)u!~oNjiE)t= zAVCCd+hxW|Lk+m+i|&Ge!{+eWqmV#`r6p33E0E*4KZs0XWn*h+Vfp$Sv!2hvcj>73 zN`oz^S{L@S!d{N3?B~zBhesmL<0ax~G}@xhD`g%=kjE3y5E?3+9g-{u0-p*BJWE}P z`5R~#G71Xivtwn~QzBA;r2ILUTXUCcLF4LD3y=@Ll$Iu#@T{%%Jrebl=@~vBG! zNM+8pNgEo>>Kbbo4^~a3U>Q&Jh9K#WYrksIea8cI6d_i38=Dok8UJ{|aqozy8=j~W zNLT@q^}KyA{GMs5b$=pYnyq`^Q{_B8QRPg!HLh)UysfZ1ul;SpB=UI2{2^%+V1;s_ z&Pm&4byEvGW+k>~C6mt2gMYL#=$dfA-ObHGsvzK)C-Dy1@w<0AR^I~;6#6^g2Te3U z0h6=1F0h&c;32QyP_%U`QeJM4QzIux>n&8;1KM!-nxA%8I~bH9zZdcql-fxtlESN@ z(f})o^ZU<0$3%;CR_#t{9F6VZ=xpl{oY}PDkU5#}OZN}4oX)Y|KsF^!uya+gJsxVmZDRZ(arpL~ zs2d6sQ|SPUNxivg>hHhJ&b@Wf`A+uI|82>xOfnDVEnr%f2a5w?tlx*uY`(ttS%K8( z)+@DXNima3$ApEvjLgiq^mMZ>7-UiI;j<8EvE0+-ZXmkEAs;C*1XyGqGp7+?o8j$k zHB^>E4IUgIN+{rM=NKEy6T!GZcK98kDH0BTF&Yb|2Oo;|z=b_tRH)_De z+ttCEg#5jkpYpzEF*l*1%yVA&s~+d#Vgi@~U+jC>Sgqfq&b^Vni3&VsK4k3qY*lW~ zU2t`wuD(7+;6?*qvnM4041AdL@Ld1d+I;jI0!dI&%l&F|+@C*Ha1~7AQGRqmX=yyz z`i5R^KK1q83EXKSw6R(GH9o%57K5hj5(^fKd$BB9?l$?nsF>!tJMY(0plTmJS()(S zWS8uC?{R_Gz|ORMXAigChE5QGVDWIe-MUBh7mLh3S;3lT*Ow2Eq7wHelaCMv(gHO= zqhsnJ`#P(6t<}oO{NBC$$G+l3^70I2uH$rIaF$*ZUuX7$!DNDtEf#C%&jJ3~zx@=m z?)7yjq&ICi8!-O{^E8Ek8S=HyfF3pP$f)8-VZOG-Od`HJGm{Mv|FUtyJPjcq+fNU-&A0IzuNU-OPrvyaA5x5ad($p9e&yVtlXwEQtY9}` z)At~hho=f~HyAk)HdOlv{ed(o4A6Mk($~vuE+}{_;u?<|{o*K4q@=k!ZmY&U#k3kN zDjk$=BvIliXOtYi*h*aC4d({?={#))YYlzbSc`P)7&YU=l0(~w|R_5iWnS6~+1BOq8jN3T=%|9InA7kI?j5l{Uv$tbo3 zWZ)S&IKsBKA7`_Ny?)ao6EKw0==TQ^tMROSNg{zEAFyy;u_yeNSHSOf9S<|D?N7;7 z*6*$!=<8$U;P?{OWLCRNG?3M7*Lm+2;2h+g6q*ft*Pk1Hca%NeR{flZ^_P=l0vOGe z6^_z1z7&G>>WmC20G59`ULwb00UQEAh`bFFEfr3>1Yd`kydgb%jbX;_*L8K1vZsZF zDsSUQKNP99X%J?}rfq;ucdlnkg55HiZF^nv`F+~+m#=TV21)pal~4dXiKT|50(me2 zC!N12mbIDXjyvS!N`64rl zysA25lL@>m=^mK-MRKzr2{?&jY;&#esh$0*fLkh_bWjc4abRfv+BK$$Cd_R~-=E3k z%vaCCIV2^|ia+#KIaem7rcRZXocTR5tWG7Cd6eVlNn=(k+SZ;2f-w?c?IfW%`uOrC z3kYGa%{5=^#(#NvL3sMRbqp-`m2Q*MBvv5cmMV;3_3#iC6BAalw9K5DvGACWUs`I5 zbekmAIxx=zeC2nbcDuLb zz`B~7Q(Yx$d+WeaObvd!x=VmU;$upzf`G!`UuVU*?vvhewTs zM1!GukkZ+)h*L*=BC<4r3sz2|ulPnkK}s*LE#{(OIo@V`g&6rC#TVtkgGAsKwCCWC|aKyyF^Ke23q0R@5D;k8Q7f2 zJf{n6!q!~SdXGaTqNK#iyyjfLv`McNuAcAQ7CjAJc+xEDK?~DIA1PIP!=HgZBD>X4 z2M69Gb92R^=gYB|rya{v^?xz~gXmJuuh_Fvb0g`w3{BIX@$&9SK+$0>e==)*4ht9? zrN0f?PwNgIv$j zG8f3Guw86wA4&Ld6gc@5cw*;0!C9{*fSy}6-Ke8XVxfrZ?ynE5wXWSCX^##MH~JnY zY#5^gji+lu#J0m>`!Yb36oo`MA1g!p4TNC2o+_|T! z@YF!Fx|(pRa=prT$K@C1Pt-FpFv*ODB^tf%grKMwqn(X92+eKIu_&S^W8{uL{@pPGOe!IArJ_~vlCP)uQ|FZ$nTR?pmVvPP$gfG7P834^#~n+ zM5ZGS4&>7E5Dg7VJF`J%=C$+;Gs*HD^~28S%Iv=JgH?!usknaajCbXi!2+!eCnIk@q^&jVVvhVD`&RIheIEE3JOzi33mxUzJiDd6S>EhqSG(WVV@2Tf-9!oT|9{q z2u|!(y<)MQoq~Z$YDordZA0VP$OyUK!$&Qc<6V@jdC;*G{PnFXc;nvXYZiG7MprX! zNjE4+fsQUWbaw<1(cSGmGVX|kvlc+sY1P)QiRlH?XnwjsuSCfgK04uK}mIcCMin*;BxUGx?7U@u88uXEf-&W*WQ5Mqlr@6j=<6J zl+Lh60u=X^L|lz(!k)@I_Fo^FOgnvmL$8fGzZ7n>*>7VC3X}<)rx@Ly6r~`yLl$y> z0f@@Lzz?-LnoXJNGSAW_B$!^We_QN`oR#@J?E&GGm9@2E8{lDJ(X>UXM^(-I9we6%}t+Uw9f_=d)) zuk#lkhqZ4rwB!{PwSXB7g&z#pL%x4^o!XyapyA^3c0wCu117kcdC=&L+i()Yp}>fe zT+SRCIl#xp~MmE`d)9X~%*diodU!)Afi)g#aYA1L(A(f3;dX=@Wx5VQ0gaY%4? z*9&f{?eYEP=GGFL#4Zm8V17;ge5_sN}3Hj<7TZa=WCglzS;W`|eiI1tqKaNkcmp;zZ>C994S-4_F9%pDkq^#iEXh-D{ zH|8u(8&Oel_r_~cYNe&`-Ei!RSE^v&Ac|icyRx4et&s77bkm2ayEm4o#3QvgD(;Np zsyXpu1paJu6E9kUWmp3mM5AevmL_oH8j)($TvKYaw)Feht~T55&f7hUzZUS{EKeHa zd5dA~)A?9yzBnoD`--=Gx)aI#WqZ3oj?wbQMHgHu>us=%{;QXevQTOQdHRGL6_)yr zoE{2K+wY$>FD{mMT1iQgr;ESS)OU%YG>Yirdfx#$%kw9KcLyl2@q?3YjBxm*(oEhJ zfi~DCCbXQdq6jZtH9qA0#9qA*kRl0a)`j}A1WUhb|(5R!!Pk`3GKg=C#k-=*q;d>9p|ANJGv#~-Lre2OyxcI3R9oz#$4%+ zM5UQLa!RL<+vokNN*3kc?!Rr>3s+&mXe$%8N~%ux6t<{l>Yb{UJm1t4lM2vY<7dDB zCl2yy>SNKRpN+eOmAbIR*snRhRw{Fp9Th#4O%%>uBJgK@-F3D>O&aSoS=L65i$i6q z;X2Ouk;Q$+|K$R?3Xbv}92^`kLX#?|h%6Y^)~un5WfYEsQ=*%c#3z0J+YeHy)t&YL70@atA7ja1dqBpT^Jm zFVoRUonEGnqi{S7!t-%(78(wKD{%CKVA|)Ut&O(K#=cUf4$HUsVwok!$;FNHSh~SQn&}u=czlBR*_!uJ9LC@n6#%_HXm$jUW2|ws6Y6Wq_OG;E-0>C?Wy_v3iy_!J$OF=0@pgQl5X$P*DlM z2#4$ioxmIJg1@NR>U#Fy*+52u{J$p8z5ng%PyTl9pU?e&?DMzz?b;&ezrW#_Je0ce zUz6ak5&ro+|1Lf!dw#K3I6CggR(T)%_B?gl&F`Oo^o`JEW^uE~bh4`m@4v%KxSDE+ z|7-tWZjy%n#~K#ma5%hT(hb1}F1V1c@K1*=I>Np`|JQ^L`%^OiUESpQ%HNKA(E$Nk z)`, and other values to appear as `"Unable to represent this value as a string"`. @@ -341,11 +341,7 @@ If an object is instantiated directly in a module or class (as opposed to in a f ``` _windows_flavour = _WindowsFlavour() -_posix_flavour = _PosixFlavour() -``` - -The scripts will reconstruct these two statements as: - +_posix_flavour = _PosixFla ``` _windows_flavour = "" _posix_flavour = "" @@ -386,14 +382,12 @@ Looks like the symbols `asminject.py` needs are still there, but does injecting ``` ``` -# export PYTHONSCRIPT="`cat tools/python/recursive_marshal.py| sed -z 's/\n/\\\\n/g' | sed 's.".\\\\".g'`" - # ps auxww | grep python_loop user 945132 [...] practice/dist-linux/python_loop-with_library/python_loop-with_library # python3 ./asminject.py 945132 execute_python_code.s \ - --relative-offsets-from-binaries --var pythoncode "${PYTHONSCRIPT}" + --relative-offsets-from-binaries --var-from-file pythoncode tools/python/recursive_marshal.py ...omitted for brevity... ``` diff --git a/docs/how_asminject_works.md b/docs/how_asminject_works.md index 5479e9f..c7e468f 100644 --- a/docs/how_asminject_works.md +++ b/docs/how_asminject_works.md @@ -3,12 +3,16 @@ [ Back to the main README.md ] * [An introduction to code injection](#an-introduction-to-code-injection) -* [Determining which code to overwrite](#determining-which-code-to-overwrite) -* [Overwriting code without crashing the target process](#overwriting-code-without-crashing-the-target-process) +* [Reading and writing memory in another process](#reading-and-writing-memory-in-another-process) +* [Payload staging](#payload-staging) * [Writeable versus executable memory](#writeable-versus-executable-memory) +* [Determining which code to overwrite](#determining-which-code-to-overwrite) +* [Building the code to inject](#building-the-code-to-inject) +* [Injecting code without destabilizing the target process](#injecting-code-without-destabilizing-the-target-process) * [Communicating with the target process](#communicating-with-the-target-process) * [Performing complex tasks inside the target process](#performing-complex-tasks-inside-the-target-process) * [Cleaning up](#cleaning-up) +* [Obfuscation and anti-detection](#obfuscation-and-anti-detection) ## An introduction to code injection @@ -40,15 +44,112 @@ In other words, by the time the last new instruction is executed, the target pro This view still glosses over numerous important details, but those will be covered in the sections that follow. +## Reading and writing memory in another process + +On Linux, there are two main options for accessing the memory space of another process: + +* The `ptrace` debugging/tracing interface +* The `/proc//mem` pseudofile + +`ptrace` is the interface that debuggers like `gdb` use to interact with a process (more specifically, one or more threads of a process, but the distinction isn't important here). It has all kinds of neat features, like the ability to pause and resume execution, query the state of the CPU registers, and of course read from and write to the memory space of the target process. Unfortunately, only one "tracer" may be attached to a given "tracee". This means that software developers can make it more difficult to attach via `ptrace` by having their software attach *to itself* as a faux debugger, and verify that the attachment remains in place while the software runs. One could modify the software to bypass that protection, but that sounds like a continuous cat-and-mouse game that wouldn't be very fun. If it's the easiest way for a determined attacker to achieve their goal, the attacker will still *do* it, but in this case there's an easier approach. + +`/proc` is the `procfs` interface in Linux - a virtual mapping of information about the system into the filesystem. For each process currently running on the system, `/proc` contains a directory named after the process' ID. Each of those directories contains a file named `mem` that is actually a mapping to the memory space for that process. If a process is running in a context that has permission to access the `mem` file for another process, it can open it as if it were a real file, then read and write data - as long as it only accesses offsets that are within memory ranges that the target process has actually mapped. The `/proc//maps` pseudofile contains a list of those memory ranges for the corresponding process. + +Interacting with the `mem` file for another process requires the same permission as using the `ptrace` interface (`CAP_SYS_PTRACE`), but multiple processes can access the `mem` file at the same time. Therefore, `asminject.py` can tamper with a process even if someone is debugging it using `gdb` at the same time. + +## Payload staging + +Injecting a small initial payload that leverages its foothold to inject a larger payload (as described in the previous section) is typically referred to as a "staged" approach, with the initial payload being referred to as a "stager". + +`asminject.py` uses a two-stage model that was originally based on the code included with [dlinject](https://github.com/DavidBuchanan314/dlinject/). At a high level, it works like the hypothetical instructions in the [introduction to code injection](#an-introduction-to-code-injection) section, above. `asminject.py` overwrites some of the existing instructions in the target process with the first stage code. When the target process does something that would normally execute the original instructions, it instead triggers the first stage code. + +`asminject.py` and the first stage work together to preserve the state of the target process as closely as possible (discussed in more detail in the [preserving program state](#preserving-program-state) and [preserving CPU state](#preserving-cpu-state) subsections, below) before taking any other action. This allows them to restore that state after the payload has finished executing, so that the original functionality of the target process typically remains unaffected. The first stage then allocates two new blocks of memory: one with read/execute permissions, and one with read/write permissions, as described further in the [writeable versus executable memory](#writeable-versus-executable-memory) section, below. The virtual addresses of the new blocks are unpredictable and different each time, so the first stage uses the mechanism discussed in the [communicating with the target process](#communicating-with-the-target-process) section to notify `asminject.py` where the new blocks are located, and that it's ready for `asminject.py` to write the second stage to the new read/execute block of memory. + +`asminject.py` receives the notification, writes the second stage to the specified location, and then notifies the first stage that it can proceed. The first stage then executes the second stage code. + +The second stage consists of a reusable template that performs actions every `asminject.py` payload requires, as well as the specific payload selected by the operator. It begins by notifying `asminject.py` that the instructions originally overwritten by the first stage can be restored. By doing this as early as possible, `asminject.py` reduces the likelihood of destabilizing the process if another thread attempts to call the same (overwritten) function. + +Once `asminject.py` has restored the original instructions and notified the second stage, the second stage executes the operator-specified payload. After the payload has executed, it requests that `asminject.py` perform any necessary cleanup. After it receives notification that the cleanup phase is complete, the template concludes by restoring the CPU state and returning to the location where execution was originally hijacked. + +## Writeable versus executable memory + +In the olden days, all of a process' memory space could theoretically contain executable instructions, static data, or data that was dynamically created and updated by the process. Some software even depends on the ability to dynamically create and update its own instructions. This freedom-loving approach is referred to as allowing memory to be readable, writeable, and executable, usually abbreviated to read/write/execute, r/w/x, or `rwx`. Linux on Intel architectures still generally allows processes to map memory with these open permissions, and so `dlinject` creates a `rwx` block of memory for all of the injected code to do its work in. + +However, some newer architectures and configurations use a model in which a particular block of memory can either by writeable *or* executable, but not both (sometimes abbreviated to `w^x`, for "write XOR execute"). Memory blocks containing executable instructions can't be directly modified by the process. This has benefits such as helping to prevent certain types of memory corruption attacks. + +In order to work identically on both types of platform, `asminject.py` always allocates two blocks of memory: one that's readable and executable, and one that's readable and writeable. The stager and payload instructions - as well as fixed data those instructions refer to - is written to the read/execute block, and any data that needs to be updated on the fly goes in the read/write block. + ## Determining which code to overwrite -## Overwriting code without crashing the target process +When injecting new code into an existing process, one typically wants to overwrite instructions that will be executed reasonably soon (so that the delay before executing the actual payload is short), but that are not currently being executed (because that would destabilize the target process). + +One approach is to select a particular function that's called reasonably frequently (something like `printf`), overwrite it, and either wait for the target process to call it on its own, or do something that triggers use of that function. This is a solid approach, and `asminject.py` may eventually support it as an alternative mode, but it doesn't use it at all today because it relies on a more flexible technique. + +Like its parent/sibling [dlinject](https://github.com/DavidBuchanan314/dlinject/), `asminject.py` takes advantage of another Linux pseudofile: `/proc//syscall`. When a Linux process is waiting for a system call or similar task to complete, the `syscall` file for that process will contain the address of the instruction in its own memory space that should execute once the task finishes, as well as the stack pointer value that should be used when execution resumes at the specified instruction. In other words, if the `syscall` file contains at least two values, then `asminject.py` can discern the following information: + +* The process is waiting for something else to happen +* Once that something else does happen, the CPU will begin executing instructions at the location specified in the `syscall` file + +This means that `asminject.py` can wait until the `syscall` file for the target process contains those two values, then perform the following tasks: + +* Back up the existing instructions starting at the instruction pointer address specified in the `syscall` file. +* Overwrite the existing instructions with the first stage. + +When the task the process is waiting for completes, instead of executing the original instructions, it will automatically trigger the first stage. It doesn't matter if the process was waiting for a particular syscall or some other blocking task. + +## Building the code to inject + +Like [dlinject](https://github.com/DavidBuchanan314/dlinject/), the current version of `asminject.py` uses `gcc` to assemble its payloads from source immediately prior to injecting them into the target process. Unliked `dlinject`, `asminject.py` post-processes the `gcc` output using `objcopy` to extract the raw instructions from the ELF wrapper generated by `gcc`. The `objcopy` step is not strictly necessary on most x86-64 versions of Linux because that version of `gcc` supports the `--oformat=binary` option to output raw binary directly. However, `gcc` on other architectures does not seem to reliably implement that option, and I've even seen it not work as advertised on some x86-64 distributions. `dlinject` doesn't need to worry about this as much, because it only runs on x86-64 Linux. In the interest of simplifying the code, `asminject.py` uses the `objcopy` technique for all architectures even though it introduces a potentially-unnecessary step on x86-64 Linux. + +A future version of `asminject.py` may support assembling code using [Keystone](https://www.keystone-engine.org/) instead of `gcc`. This would have several benefits, including the ability to perform injection without ever writing the binary code to disk. + +## Injecting code without destabilizing the target process + +Tampering with a running process - especially without using the standard `ptrace` debugging interface - risks destabilizing that process. This section discusses some of the ways `asminject.py` attempts to keep target processes running more or less normally during and after code injection. ### Stopping the target process -### Preserving CPU and program state +When replacing instructions in another process, it's important to avoid situations where the CPU begins executing the modified code before the modifications are complete. Consider the following simplified scenario, based on the example from the [introduction to code injection](#an-introduction-to-code-injection) section, above. The attacking process has replaced two out of three instructions, but simultaneously the CPU has already begun to execute the function. Instead of closing the file and passing the file data to the JSON function, it allocates a new block of memory and copies the second stage into that block of memory, but then instead of executing the second stage, it attempts to pass the data that would have been parsed by the JSON function to the data analysis functions: + +[ The CPU executes a partially-modified function while the attacking process is still updating it ] + +Because the JSON function was never called, there is no data to pass to the data analysis functions. At a minimum, no further data processing will take place, and the target process will therefore not behave normally. More severe effects may also occur. For example, the data analysis functions may not be written to handle a null pointer being passed, and the process could immediately crash at that point. The program might also be designed to re-read the data file if it encounters a null pointer. However, the data file was never closed, and so the re-read attempt might also result in an error or the program crashing if it can't handle attempts to read a locked file. If the program has more robust error handling, but does not limit the number of attempts to recover from the error, it may eventually exhaust all available memory, because each time it executes the `Load_Data` function, the modified instructions will cause additional memory to be allocated and never released. + +If `asminject.py` were using the `ptrace` interface, it could simply send a `PTRACE_INTERRUPT` request to the target process and gracefully halt it in its tracks. As discussed in [reading and writing memory in another process](#reading-and-writing-memory-in-another-process), `asminject.py` deliberately avoids using the `ptrace` interface, so it needs to use some other method to pause the target process. It inherits several techniques from `dlinject`, but defaults to a new, potentially less intrusive approach. + +I'll discuss the `dlinject`-derived methods first, since they're more straightforward. + +* Any process can be paused and resumed using the OS-level `SIGSTOP` and `SIGCONT` signals. This is equivalent to using Ctrl-Z to pause and background a process in a Linux terminal session, then running the `fg` command to bring it to the foreground and resume it. +* If a process is running in a container, the process can be paused by using [the cgroup freezer interface](https://www.kernel.org/doc/Documentation/cgroup-v1/freezer-subsystem.txt) +* If process stability is not a significant concern, `asminject.py` can attempt to modify it while it's running normally. I do not recommend this approach. + +I originally conceived of `asminject.py` in the context of evading security software that tried to prevent tampering with individual processes. It seemed like security software could easily flag `SIGSTOP` and `SIGCONT` signals as suspicious. Additionally, sometimes one of my test processes wouldn't *really* continue running immediately after a `SIGCONT` signal. I'd still have to bring it to the foreground from the terminal where I'd originally launched it. + +I thought back to games like *The Outer Worlds*, *Horizon: Zero Dawn*, and *Superhot* that incorporate "time dilation" modes where the game world is slowed down dramatically, as well as the extreme slow motion in films like *X-Men: Days of Future Past* and *The Matrix*. What if there were a way to allow the process to continue running (i.e. not send it an explicit signal to stop), but so slowly that it would effectively be stopped relative to `asminject.py`? That might be a lot harder for monitoring software to reliably detect and counter without lots of production-breaking false positives. + +Linux, like most modern operating systems, allows each process to be assigned a priority. Higher-priority processes are given preference by the CPU scheduler over lower-priority processes. So part of any "time dilation" technique would be to increase the priority of the `asminject.py` process, while decreasing the priority of the target process. But there's an additional wrinkle - most modern Linux systems also have at least two (and usually more) logical CPU cores. So even with the process priorities adjusted, the target process might still be shuffled over to an under-utilized core and continue executing. `asminject.py` therefore also temporarily assigns itself and the target process to the same core while it's performing the initial injection. This is referred to as the "CPU affinity" for each process. After injection is complete, `asminject.py` restores the original priority and CPU affinity for both itself and the target process. + +The "time dilation" technique was so successful that I made it the default behaviour for `asminject.py`. + +### Preserving program state + +`asminject.py` backs up the instructions that will be overwritten by the first stage, and then restores them once the second stage has notified `asminject.py` that the first stage is no longer in use. + +`dlinject` performs a similar backup, but the restore is handled by the assembly payload. I moved that functionality into the main script because it seemed a lot easier than writing per-architecture assembly code to do the same thing. + +`dlinject` also performs special handling on the target process' stack. It backs up part of the stack before the code injection process. The second stage duplicates part of the existing stack to a location in newly-allocated memory, restores the original version of the real stack, uses the duplicate copy just long enough to perform its work, and then resets the stack pointer to the restored version of the stack from before code injection took place. This may work better in some cases, but because some `asminject.py` payloads will intentionally change the state of the program, I thought it would be better and easier to default to using the real stack throughout. + +`asminject.py` includes command-line options to back up some or all additional memory regions for the target process before injection and restore them after the payload completes. They're discussed in [restoring more of the target process's memory](specialized_options.md#restoring-more-of-the-target-processs-memory). + +### Preserving CPU state + +Like `dlinject`, `asminject.py`'s first stage backs up as much of the CPU state as possible before any other activity, and restores those same values after the payload has finished executing. + +For all supported architectures, the most important step is pushing nearly all of the CPU registers onto the stack at the beginning, and popping them back off in reverse order at the end. The main exceptions are the program counter/instruction pointer register, and the stack pointer register. Backing up and restoring those values would likely destabilize the target process. + +The x86 and x86-64 architectures support some very powerful state backup/restore instructions. `asminject.py` uses the `pushfq` and `popfq` instructions on x86-64, and the `pushf`/`popf` instructions on x86 to backup and restore the state of the `EFLAGS` register. It also uses the `fxsave` and `fxrstor` instructions to backup and restore the states of the registers related to the x87 floating-point unit, MMX, and SSE/SSE2 instructions. This should result in a very complete backup/restore of the parts of the CPU state that would otherwise cause unwanted side effects after the injected code finished. + -## Writeable versus executable memory ## Communicating with the target process @@ -56,4 +157,6 @@ This view still glosses over numerous important details, but those will be cover ## Cleaning up +## Obfuscation and anti-detection + diff --git a/docs/version_history.md b/docs/version_history.md index 0263a37..1d780d0 100644 --- a/docs/version_history.md +++ b/docs/version_history.md @@ -1,5 +1,11 @@ ## asminject.py - Version history +### 0.41 (2022-10-03) + +* First public release (scheduled for 2022-10-11) +* Added `--var-from-file` command-line option to make using very large variables (like entire scripts) easier +* Added `--arm-backup-fpr-1` and `--arm-backup-fpr-2` options to back up and restore ARM floating-point registers on supported architectures + ### 0.40 (2022-08-05) * Fixed a bug related to restoring the original target process priority