From 70be992586143da9bd5809bb08d70c6c597a0eaf Mon Sep 17 00:00:00 2001 From: HD Moore Date: Wed, 19 Nov 2008 07:15:44 +0000 Subject: [PATCH] Nuke the old/obsolete dev directory git-svn-id: file:///home/svn/framework3/trunk@5960 4d416f70-5f16-0410-b530-b9f4589650da --- dev/add_standard_header.rb | 32 - dev/adminy/movey.pl | 39 - dev/adminy/movey_requires.pl | 27 - dev/aux_design.txt | 48 - dev/contrib/MSF_nolimit.bugtraq@gmail.com.txt | 75 - dev/correlate.rb | 55 - dev/db/nessus.nbe | 202 - dev/db/test.rc | 2 - dev/db/test2.rc | 7 - dev/db/test3.rc | 19 - .../devguide/dev_guide_arch_packages.png | Bin 10347 -> 0 bytes .../devguide/dev_guide_payload_hierarchy.png | Bin 5420 -> 0 bytes .../devguide/developers_guide.tex | 3735 --- dev/documentation/devguide/logo.jpg | Bin 53476 -> 0 bytes dev/gendoc.sh | 11 - dev/machinetest/extconf.rb | 2 - dev/machinetest/machinetest.rb | 12 - dev/machinetest/machinetestinternal.c | 67 - dev/materials/blackhat05/bh05.pdf | Bin 309577 -> 0 bytes dev/materials/blackhat05/bh05.tex | 1646 -- dev/materials/blackhat05/blog.txt | 33 - dev/materials/blackhat05/outline-new.txt | 383 - dev/materials/blackhat05/outline.txt | 378 - dev/materials/blackhat05/skape_bio.txt | 7 - dev/materials/blackhat05/submission_form.txt | 673 - dev/materials/bluehat01/06v1/asp_outline.txt | 81 - dev/materials/bluehat01/06v1/msf_outline.txt | 75 - dev/materials/cansecwest05/admtable.tex | 77 - dev/materials/cansecwest05/admtable2.tex | 77 - dev/materials/cansecwest05/csw05.sh | 4 - dev/materials/cansecwest05/csw05.tex | 1202 - dev/materials/cansecwest05/optytable.tex | 166 - dev/materials/cansecwest05/optytable2.tex | 166 - dev/materials/cansecwest05/shi0.png | Bin 3791 -> 0 bytes dev/materials/cansecwest05/shi1.png | Bin 4799 -> 0 bytes dev/materials/cansecwest05/shi2.png | Bin 4812 -> 0 bytes dev/materials/cansecwest05/shi3.png | Bin 5015 -> 0 bytes dev/materials/cansecwest05/shi4.png | Bin 5030 -> 0 bytes dev/materials/cansecwest05/shi5.png | Bin 5114 -> 0 bytes dev/materials/cansecwest05/shi6.png | Bin 4797 -> 0 bytes dev/materials/cansecwest05/shi7.png | Bin 4703 -> 0 bytes dev/materials/cansecwest05/shi8.png | Bin 3540 -> 0 bytes .../diagrams/Diagrams.vsd | Bin 126976 -> 0 bytes .../diagrams/flowcharts.vsd | Bin 48640 -> 0 bytes .../documentation/ruby/RubyCheat.pdf | Bin 56404 -> 0 bytes .../documentation/ruby/RubyCheat1.png | Bin 37847 -> 0 bytes .../documentation/ruby/RubyCheat2.png | Bin 42445 -> 0 bytes .../documentation/ruby/ruby-doc-bundle.tar.gz | Bin 934020 -> 0 bytes .../examples/modules/auxiliary/bh_aux.rb | 19 - .../examples/modules/encoders/bh_encoder.rb | 22 - .../examples/plugins/bob_plugin.rb | 12 - .../slides/bh_training_deck.ppt | Bin 3184640 -> 0 bytes .../msf3_internals_training/tools/srv.c | 116 - .../msf3_internals_training/tools/srv.exe | Bin 61440 -> 0 bytes .../msf3_internals_training/tools/srvloop.c | 123 - .../msf3_internals_training/tools/srvloop.exe | Bin 61440 -> 0 bytes .../msf3_internals_training/tools/vulnsrv.c | 119 - dev/merge.sh | 18 - dev/meterpreter/DemoClient.rb | 19 - dev/meterpreter/demo1.html | 5 - dev/meterpreter/demo_migrate.rb | 19 - dev/meterpreter/demo_mirror_dir.rb | 16 - dev/meterpreter/demo_mirror_dir2.rb | 16 - dev/meterpreter/demo_site.rb | 13 - dev/meterpreter/demo_socket.rb | 39 - dev/meterpreter/metcli.rb | 361 - dev/meterpreter/mrp.rb | 22 - dev/meterpreter/todo | 6 - dev/msf3/TODO | 30 - dev/msf3/bugs | 18 - dev/msf3/design.txt | 53 - dev/msf3/guidelines.txt | 7 - dev/msf3/msf3.features | 22 - dev/msf3/msf_alpha_announce.txt | 111 - dev/msf3/notes.txt | 21 - dev/msf3/overview.txt | 35 - dev/msf3/plan.txt | 130 - dev/msf3/ported | 8 - dev/msf3/ruby.nono | 16 - dev/msf3/vars | 14 - dev/msfgui.txt | 48 - dev/msfgui/irb-gtk2.rb | 86 - dev/msfgui/testgtk.rb | 6 - dev/msfwx.txt | 122 - dev/old_data_msfweb/exploits.rhtml | 311 - dev/old_data_msfweb/favicon.ico | Bin 326 -> 0 bytes dev/old_data_msfweb/images/aix.gif | Bin 186 -> 0 bytes dev/old_data_msfweb/images/amiga.gif | Bin 977 -> 0 bytes dev/old_data_msfweb/images/any.gif | Bin 944 -> 0 bytes dev/old_data_msfweb/images/be.gif | Bin 185 -> 0 bytes dev/old_data_msfweb/images/bsd.gif | Bin 595 -> 0 bytes dev/old_data_msfweb/images/cisco.gif | Bin 884 -> 0 bytes dev/old_data_msfweb/images/hpux.gif | Bin 216 -> 0 bytes dev/old_data_msfweb/images/irix.gif | Bin 197 -> 0 bytes dev/old_data_msfweb/images/linux.gif | Bin 571 -> 0 bytes dev/old_data_msfweb/images/logo.jpg | Bin 66601 -> 0 bytes dev/old_data_msfweb/images/novell.gif | Bin 77 -> 0 bytes dev/old_data_msfweb/images/os2.gif | Bin 155 -> 0 bytes dev/old_data_msfweb/images/osx.gif | Bin 229 -> 0 bytes dev/old_data_msfweb/images/sun.gif | Bin 1042 -> 0 bytes dev/old_data_msfweb/images/unknown.gif | Bin 885 -> 0 bytes dev/old_data_msfweb/images/win32.gif | Bin 264 -> 0 bytes dev/old_data_msfweb/index.rhtml | 14 - dev/old_data_msfweb/msfweb_common.rb | 109 - dev/old_data_msfweb/payloads.rhtml | 216 - dev/old_data_msfweb/style.css | 243 - dev/old_msfweb | 60 - dev/porting/queue/Credits.rb | 418 - dev/porting/queue/arkeia_agent_access.rb | 292 - dev/porting/queue/awstats_configdir_exec.rb | 215 - dev/porting/queue/backupexec_dump.rb | 459 - dev/porting/queue/backupexec_registry.rb | 435 - dev/porting/queue/bakbone_netvault_heap.rb | 293 - dev/porting/queue/barracuda_img_exec.rb | 254 - dev/porting/queue/blackice_pam_icq.rb | 411 - dev/porting/queue/ca_server_getconfig.rb | 292 - .../queue/cabrightstor_unixbackdoor.rb | 183 - dev/porting/queue/cacti_graphimage_exec.rb | 243 - dev/porting/queue/cvstrac_exec.rb | 148 - dev/porting/queue/exchange2000_xexch50.rb | 378 - dev/porting/queue/gnu_mailutils_imap4d.rb | 337 - .../queue/google_proxystylesheet_exec.rb | 2916 --- dev/porting/queue/hpux_ftpd_preauth_list.rb | 172 - dev/porting/queue/hpux_lpd_exec.rb | 171 - dev/porting/queue/ie_javaprxy.rb | 227 - dev/porting/queue/iis_source_dumper.rb | 564 - dev/porting/queue/irix_lpsched_exec.rb | 202 - dev/porting/queue/irix_telnetd_envfmt.rb | 227 - dev/porting/queue/local_shell.rb | 146 - dev/porting/queue/mailenable_auth_header.rb | 214 - .../queue/openview_connectednodes_exec.rb | 182 - dev/porting/queue/openview_omniback.rb | 209 - dev/porting/queue/oracle8i_unauth_remote.rb | 273 - dev/porting/queue/php_wordpress_lastpost.rb | 204 - dev/porting/queue/phpbb_highlight.rb | 295 - dev/porting/queue/poptop_negative_read.rb | 382 - dev/porting/queue/rpc_statd_fmt.rb | 199 - dev/porting/queue/samba_nttrans.rb | 384 - dev/porting/queue/samba_trans2open.rb | 287 - .../queue/samba_trans2open_solsparc.rb | 322 - dev/porting/queue/sambar6_search_results.rb | 204 - dev/porting/queue/seattlelab_mail_55.rb | 233 - dev/porting/queue/solaris_bin_login.rb | 247 - dev/porting/queue/solaris_kcms_readfile.rb | 234 - dev/porting/queue/solaris_snmpxdmid.rb | 190 - dev/porting/queue/subversion_date_win32.rb | 217 - dev/porting/queue/svnserve_date.rb | 240 - dev/porting/queue/uow_imap4_copy.rb | 296 - dev/porting/queue/uow_imap4_lsub.rb | 260 - dev/porting/queue/ut2003_secure_linux.rb | 288 - dev/porting/queue/wzdftpd_site.rb | 208 - dev/porting/stalled.txt | 32 - dev/pwncraft/auxiliaries_controller.rb | 145 - dev/pwncraft/exploits_controller.rb | 191 - dev/readline-5.0-bin.zip | Bin 206857 -> 0 bytes dev/rel3.1/TODO | 15 - dev/skape/tds/1970epoch.csv | 5900 ----- dev/skape/tds/tds.rb | 52 - dev/skape/tds/tds.txt | 19923 ---------------- dev/standalone-meterp/clean-svn.sh | 3 - dev/standalone-meterp/meterp-needs | 19 - dev/standalone-meterp/needs-copier.rb | 48 - dev/tabify.rb | 25 - dev/testing/blocks.rb | 104 - dev/windows/cygwin.bat | 4 - dev/windows/launcher.c | 92 - dev/windows/license.rb | 38 - dev/windows/license_3.txt | 254 - dev/windows/metasploit.ico | Bin 326 -> 0 bytes dev/windows/msf2.nsi | 127 - dev/windows/msf3.nsi | 121 - dev/windows/msf3_native.nsi | 114 - dev/windows/msfconsole.bat | 5 - dev/windows/msfconsole.exe | Bin 57344 -> 0 bytes dev/windows/msfweb.bat | 5 - dev/windows/run_msfconsole | 16 - dev/windows/run_msfweb | 16 - dev/wsee.pl | 33 - dev/wuftpd_site_exec.rb | 294 - 179 files changed, 54053 deletions(-) delete mode 100755 dev/add_standard_header.rb delete mode 100644 dev/adminy/movey.pl delete mode 100644 dev/adminy/movey_requires.pl delete mode 100644 dev/aux_design.txt delete mode 100644 dev/contrib/MSF_nolimit.bugtraq@gmail.com.txt delete mode 100644 dev/correlate.rb delete mode 100644 dev/db/nessus.nbe delete mode 100644 dev/db/test.rc delete mode 100644 dev/db/test2.rc delete mode 100644 dev/db/test3.rc delete mode 100755 dev/documentation/devguide/dev_guide_arch_packages.png delete mode 100755 dev/documentation/devguide/dev_guide_payload_hierarchy.png delete mode 100755 dev/documentation/devguide/developers_guide.tex delete mode 100755 dev/documentation/devguide/logo.jpg delete mode 100755 dev/gendoc.sh delete mode 100644 dev/machinetest/extconf.rb delete mode 100644 dev/machinetest/machinetest.rb delete mode 100755 dev/machinetest/machinetestinternal.c delete mode 100644 dev/materials/blackhat05/bh05.pdf delete mode 100644 dev/materials/blackhat05/bh05.tex delete mode 100644 dev/materials/blackhat05/blog.txt delete mode 100644 dev/materials/blackhat05/outline-new.txt delete mode 100644 dev/materials/blackhat05/outline.txt delete mode 100644 dev/materials/blackhat05/skape_bio.txt delete mode 100644 dev/materials/blackhat05/submission_form.txt delete mode 100644 dev/materials/bluehat01/06v1/asp_outline.txt delete mode 100644 dev/materials/bluehat01/06v1/msf_outline.txt delete mode 100644 dev/materials/cansecwest05/admtable.tex delete mode 100644 dev/materials/cansecwest05/admtable2.tex delete mode 100644 dev/materials/cansecwest05/csw05.sh delete mode 100644 dev/materials/cansecwest05/csw05.tex delete mode 100644 dev/materials/cansecwest05/optytable.tex delete mode 100644 dev/materials/cansecwest05/optytable2.tex delete mode 100644 dev/materials/cansecwest05/shi0.png delete mode 100644 dev/materials/cansecwest05/shi1.png delete mode 100644 dev/materials/cansecwest05/shi2.png delete mode 100644 dev/materials/cansecwest05/shi3.png delete mode 100644 dev/materials/cansecwest05/shi4.png delete mode 100644 dev/materials/cansecwest05/shi5.png delete mode 100644 dev/materials/cansecwest05/shi6.png delete mode 100644 dev/materials/cansecwest05/shi7.png delete mode 100644 dev/materials/cansecwest05/shi8.png delete mode 100755 dev/materials/msf3_internals_training/diagrams/Diagrams.vsd delete mode 100755 dev/materials/msf3_internals_training/diagrams/flowcharts.vsd delete mode 100644 dev/materials/msf3_internals_training/documentation/ruby/RubyCheat.pdf delete mode 100644 dev/materials/msf3_internals_training/documentation/ruby/RubyCheat1.png delete mode 100644 dev/materials/msf3_internals_training/documentation/ruby/RubyCheat2.png delete mode 100644 dev/materials/msf3_internals_training/documentation/ruby/ruby-doc-bundle.tar.gz delete mode 100644 dev/materials/msf3_internals_training/examples/modules/auxiliary/bh_aux.rb delete mode 100644 dev/materials/msf3_internals_training/examples/modules/encoders/bh_encoder.rb delete mode 100644 dev/materials/msf3_internals_training/examples/plugins/bob_plugin.rb delete mode 100755 dev/materials/msf3_internals_training/slides/bh_training_deck.ppt delete mode 100755 dev/materials/msf3_internals_training/tools/srv.c delete mode 100755 dev/materials/msf3_internals_training/tools/srv.exe delete mode 100755 dev/materials/msf3_internals_training/tools/srvloop.c delete mode 100755 dev/materials/msf3_internals_training/tools/srvloop.exe delete mode 100755 dev/materials/msf3_internals_training/tools/vulnsrv.c delete mode 100755 dev/merge.sh delete mode 100644 dev/meterpreter/DemoClient.rb delete mode 100644 dev/meterpreter/demo1.html delete mode 100755 dev/meterpreter/demo_migrate.rb delete mode 100755 dev/meterpreter/demo_mirror_dir.rb delete mode 100755 dev/meterpreter/demo_mirror_dir2.rb delete mode 100755 dev/meterpreter/demo_site.rb delete mode 100755 dev/meterpreter/demo_socket.rb delete mode 100644 dev/meterpreter/metcli.rb delete mode 100755 dev/meterpreter/mrp.rb delete mode 100644 dev/meterpreter/todo delete mode 100644 dev/msf3/TODO delete mode 100644 dev/msf3/bugs delete mode 100644 dev/msf3/design.txt delete mode 100644 dev/msf3/guidelines.txt delete mode 100644 dev/msf3/msf3.features delete mode 100644 dev/msf3/msf_alpha_announce.txt delete mode 100644 dev/msf3/notes.txt delete mode 100644 dev/msf3/overview.txt delete mode 100644 dev/msf3/plan.txt delete mode 100644 dev/msf3/ported delete mode 100644 dev/msf3/ruby.nono delete mode 100644 dev/msf3/vars delete mode 100644 dev/msfgui.txt delete mode 100755 dev/msfgui/irb-gtk2.rb delete mode 100644 dev/msfgui/testgtk.rb delete mode 100644 dev/msfwx.txt delete mode 100644 dev/old_data_msfweb/exploits.rhtml delete mode 100644 dev/old_data_msfweb/favicon.ico delete mode 100644 dev/old_data_msfweb/images/aix.gif delete mode 100644 dev/old_data_msfweb/images/amiga.gif delete mode 100644 dev/old_data_msfweb/images/any.gif delete mode 100644 dev/old_data_msfweb/images/be.gif delete mode 100644 dev/old_data_msfweb/images/bsd.gif delete mode 100644 dev/old_data_msfweb/images/cisco.gif delete mode 100644 dev/old_data_msfweb/images/hpux.gif delete mode 100644 dev/old_data_msfweb/images/irix.gif delete mode 100644 dev/old_data_msfweb/images/linux.gif delete mode 100644 dev/old_data_msfweb/images/logo.jpg delete mode 100644 dev/old_data_msfweb/images/novell.gif delete mode 100644 dev/old_data_msfweb/images/os2.gif delete mode 100644 dev/old_data_msfweb/images/osx.gif delete mode 100644 dev/old_data_msfweb/images/sun.gif delete mode 100644 dev/old_data_msfweb/images/unknown.gif delete mode 100644 dev/old_data_msfweb/images/win32.gif delete mode 100644 dev/old_data_msfweb/index.rhtml delete mode 100644 dev/old_data_msfweb/msfweb_common.rb delete mode 100644 dev/old_data_msfweb/payloads.rhtml delete mode 100644 dev/old_data_msfweb/style.css delete mode 100755 dev/old_msfweb delete mode 100644 dev/porting/queue/Credits.rb delete mode 100644 dev/porting/queue/arkeia_agent_access.rb delete mode 100644 dev/porting/queue/awstats_configdir_exec.rb delete mode 100644 dev/porting/queue/backupexec_dump.rb delete mode 100644 dev/porting/queue/backupexec_registry.rb delete mode 100644 dev/porting/queue/bakbone_netvault_heap.rb delete mode 100644 dev/porting/queue/barracuda_img_exec.rb delete mode 100644 dev/porting/queue/blackice_pam_icq.rb delete mode 100644 dev/porting/queue/ca_server_getconfig.rb delete mode 100644 dev/porting/queue/cabrightstor_unixbackdoor.rb delete mode 100644 dev/porting/queue/cacti_graphimage_exec.rb delete mode 100644 dev/porting/queue/cvstrac_exec.rb delete mode 100644 dev/porting/queue/exchange2000_xexch50.rb delete mode 100644 dev/porting/queue/gnu_mailutils_imap4d.rb delete mode 100644 dev/porting/queue/google_proxystylesheet_exec.rb delete mode 100644 dev/porting/queue/hpux_ftpd_preauth_list.rb delete mode 100644 dev/porting/queue/hpux_lpd_exec.rb delete mode 100644 dev/porting/queue/ie_javaprxy.rb delete mode 100644 dev/porting/queue/iis_source_dumper.rb delete mode 100644 dev/porting/queue/irix_lpsched_exec.rb delete mode 100644 dev/porting/queue/irix_telnetd_envfmt.rb delete mode 100644 dev/porting/queue/local_shell.rb delete mode 100644 dev/porting/queue/mailenable_auth_header.rb delete mode 100644 dev/porting/queue/openview_connectednodes_exec.rb delete mode 100644 dev/porting/queue/openview_omniback.rb delete mode 100644 dev/porting/queue/oracle8i_unauth_remote.rb delete mode 100644 dev/porting/queue/php_wordpress_lastpost.rb delete mode 100644 dev/porting/queue/phpbb_highlight.rb delete mode 100644 dev/porting/queue/poptop_negative_read.rb delete mode 100644 dev/porting/queue/rpc_statd_fmt.rb delete mode 100644 dev/porting/queue/samba_nttrans.rb delete mode 100644 dev/porting/queue/samba_trans2open.rb delete mode 100644 dev/porting/queue/samba_trans2open_solsparc.rb delete mode 100644 dev/porting/queue/sambar6_search_results.rb delete mode 100644 dev/porting/queue/seattlelab_mail_55.rb delete mode 100644 dev/porting/queue/solaris_bin_login.rb delete mode 100644 dev/porting/queue/solaris_kcms_readfile.rb delete mode 100644 dev/porting/queue/solaris_snmpxdmid.rb delete mode 100644 dev/porting/queue/subversion_date_win32.rb delete mode 100644 dev/porting/queue/svnserve_date.rb delete mode 100644 dev/porting/queue/uow_imap4_copy.rb delete mode 100644 dev/porting/queue/uow_imap4_lsub.rb delete mode 100644 dev/porting/queue/ut2003_secure_linux.rb delete mode 100644 dev/porting/queue/wzdftpd_site.rb delete mode 100644 dev/porting/stalled.txt delete mode 100644 dev/pwncraft/auxiliaries_controller.rb delete mode 100644 dev/pwncraft/exploits_controller.rb delete mode 100644 dev/readline-5.0-bin.zip delete mode 100644 dev/rel3.1/TODO delete mode 100644 dev/skape/tds/1970epoch.csv delete mode 100644 dev/skape/tds/tds.rb delete mode 100644 dev/skape/tds/tds.txt delete mode 100644 dev/standalone-meterp/clean-svn.sh delete mode 100644 dev/standalone-meterp/meterp-needs delete mode 100644 dev/standalone-meterp/needs-copier.rb delete mode 100755 dev/tabify.rb delete mode 100644 dev/testing/blocks.rb delete mode 100644 dev/windows/cygwin.bat delete mode 100644 dev/windows/launcher.c delete mode 100755 dev/windows/license.rb delete mode 100644 dev/windows/license_3.txt delete mode 100644 dev/windows/metasploit.ico delete mode 100644 dev/windows/msf2.nsi delete mode 100644 dev/windows/msf3.nsi delete mode 100644 dev/windows/msf3_native.nsi delete mode 100644 dev/windows/msfconsole.bat delete mode 100644 dev/windows/msfconsole.exe delete mode 100644 dev/windows/msfweb.bat delete mode 100755 dev/windows/run_msfconsole delete mode 100755 dev/windows/run_msfweb delete mode 100644 dev/wsee.pl delete mode 100644 dev/wuftpd_site_exec.rb diff --git a/dev/add_standard_header.rb b/dev/add_standard_header.rb deleted file mode 100755 index 798ba5d9fa..0000000000 --- a/dev/add_standard_header.rb +++ /dev/null @@ -1,32 +0,0 @@ -#!/usr/bin/env ruby - -banner = -%q{## -# $Id:$ -## - -## -# This file is part of the Metasploit Framework and may be subject to -# redistribution and commercial restrictions. Please see the Metasploit -# Framework web site for more information on licensing and terms of use. -# http://metasploit.com/projects/Framework/ -## - -} - -mod = ARGV.shift -data = File.read(mod) - -if (data =~ /This file is part of the Metasploit/) { - exit(0) -} - - -fd = File.open(mod, 'w') -fd.write(banner) -fd.write(data) -fd.close - -system("svn propset svn:keywords 'Rev Revision Id Header' #{mod}") - - diff --git a/dev/adminy/movey.pl b/dev/adminy/movey.pl deleted file mode 100644 index 08f743b8b2..0000000000 --- a/dev/adminy/movey.pl +++ /dev/null @@ -1,39 +0,0 @@ -#/usr/bin/perl -use strict; - -die if @ARGV != 1; - -move($ARGV[0]); - -sub old_to_new { - my $name = shift; - - $name =~ s/^([A-Z])/lc($1)/ge; - $name =~ s/([A-Z])/"_" . lc($1)/ge; - - return($name); -} - -sub move { - my $dir = shift; - my @entries; - - opendir(DIR, $dir) || die "Can't open $dir: $!\n"; - @entries = readdir(DIR); - closedir(DIR); - - foreach my $entry (@entries) { - next if($entry eq 'Attic' || $entry =~ /^\./); - - my $path = $dir . '/' . $entry; - my $newpath = $dir . '/' . old_to_new($entry); - - if(-d $path) { - move($path); - } - - print "$path -> $newpath\n"; - rename($path, $newpath) || die("BAH!"); - - } -} diff --git a/dev/adminy/movey_requires.pl b/dev/adminy/movey_requires.pl deleted file mode 100644 index 6bdddf0671..0000000000 --- a/dev/adminy/movey_requires.pl +++ /dev/null @@ -1,27 +0,0 @@ -#!/usr/bin/perl -pi -use strict; - -s/require '(.*?)'/"require '" . waka($1) . "'"/ge; - -sub waka { - my $required = shift; - - my @pieces = split('/', $required); - map { $_ = old_to_new($_) } @pieces; - my $new = join('/', @pieces); - - return $new; -} - -sub old_to_new { - my $name = shift; - - if(uc($name) eq $name) { - return(lc($name)); - } - - $name =~ s/^([A-Z])/lc($1)/ge; - $name =~ s/([A-Z])/"_" . lc($1)/ge; - - return($name); -} diff --git a/dev/aux_design.txt b/dev/aux_design.txt deleted file mode 100644 index f3923ac6a9..0000000000 --- a/dev/aux_design.txt +++ /dev/null @@ -1,48 +0,0 @@ -Auxiliary Module Design ------------------------ - -The goal of this document is to define the requirements and basic -implementation of Metasploit v3.0 Auxiliary Modules. Auxiliary modules have a -unique role in the Framework in that they can do just about anything. -Auxiliary modules work similar to exploits, in that the user selects a module, -configures, and launches it, but differs in that they do not execute arbitrary -code on target systems. - - -Design Goals ------------- - -Auxiliary modules should be capable of performing reconnaisance activities, -such as sending probes or listening to the network, and exporting the data -into a persistent storage system accessible to the rest of the Framework. Not -all auxiliary modules produce this type of data, some may perform intrusive -actions, such as file retrieval or modifying access credentials. - -An Auxiliary module has the ability to define new commands and then process -these commands. Any user interface that sypports Auxiliary modules needs to -take into account this fact and allow these optional commands to be accessed. - -Unlike exploits, auxiliary modules do not use Targets, instead they support -what we call Actions. An Action is an option, that when set, causes the -auxiliary module to perform a selected task. Between the extensible command -set and the Actions system, a single auxiliary module is capable performing an -almost infinite number of tasks. - -An example would be a module that performs various tasks against a Microsoft -SQL Server. This module would only support the default command of 'run', but -could allow the user to send a UDP probe and display the data, perform an -account brute force, or scan all open ports for an exposed MSSQL DCERPC -interface. - - - - - -Storage -------- - - - - -Requirements ------------- diff --git a/dev/contrib/MSF_nolimit.bugtraq@gmail.com.txt b/dev/contrib/MSF_nolimit.bugtraq@gmail.com.txt deleted file mode 100644 index a499cc74ee..0000000000 --- a/dev/contrib/MSF_nolimit.bugtraq@gmail.com.txt +++ /dev/null @@ -1,75 +0,0 @@ -From nolimit.bugtraq@gmail.com Sun Jan 22 16:40:09 2006 -From nolimit.bugtraq@gmail.com Sun Jan 22 22:39:35 2006 -Return-Path: -X-Spam-Checker-Version: SpamAssassin 3.1.0-gr0 (2005-09-13) on sugar.14x.net -X-Spam-Level: -X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,HTML_40_50, - HTML_MESSAGE autolearn=ham version=3.1.0-gr0 -Delivered-To: hdm-hdm@metasploit.com -Received: (qmail 8349 invoked from network); 22 Jan 2006 16:39:35 -0600 -Received: from unknown (HELO uproxy.gmail.com) (66.249.92.203) - by sugar.14x.net with SMTP; 22 Jan 2006 16:39:35 -0600 -Received: by uproxy.gmail.com with SMTP id j3so504335ugf - for ; Sun, 22 Jan 2006 14:40:09 -0800 (PST) -DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; - s=beta; d=gmail.com; - h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:references; - b=FBG7YV3XXWeZisoQR5v8dxhWbwA/m0bXqv9oL5+jChFGrjP4k1cR2k8HdCygCpy1yJQoMLwlbPNVtdUkYMAoFg+fTTRDbZiiM8XQtidhcaM41Hbep60wkSBX8UemqRSLFaX0fRqiNDkHrAyEkVZOedxEwEzy+YYDFeqEiGVWib8= -Received: by 10.66.219.19 with SMTP id r19mr1989749ugg; - Sun, 22 Jan 2006 14:40:09 -0800 (PST) -Received: by 10.66.255.7 with HTTP; Sun, 22 Jan 2006 14:40:08 -0800 (PST) -Message-ID: <786b40bf0601221440x27049938h4c4fd527c23b930c@mail.gmail.com> -Date: Sun, 22 Jan 2006 17:40:09 -0500 -From: nolimit bugtraq -To: H D Moore -Subject: Re: Metasploit Framework License -In-Reply-To: <200601221520.34147.hdm@metasploit.com> -MIME-Version: 1.0 -Content-Type: multipart/alternative; - boundary="----=_Part_10104_11843058.1137969609003" -References: <200601221520.34147.hdm@metasploit.com> -Status: R -X-Status: NC -X-KMail-EncryptionState: -X-KMail-SignatureState: -X-KMail-MDN-Sent: - -------=_Part_10104_11843058.1137969609003 -Content-Type: text/plain; charset=ISO-8859-1 -Content-Transfer-Encoding: quoted-printable -Content-Disposition: inline - -I give you full rights to use any exploits I've published in the metasploit -framework, and continue to be honored by it. - -On 1/22/06, H D Moore wrote: -> -> Hello, -> -> I you are receiving this email, there is a good chance that you -> contributed to the Metasploit Framework sometime in the past. -> Starting with version 3.0, we are changing the licensing terms. -> -> - -------=_Part_10104_11843058.1137969609003 -Content-Type: text/html; charset=ISO-8859-1 -Content-Transfer-Encoding: quoted-printable -Content-Disposition: inline - -I give you full rights to use any exploits I've published in the metasploit= - framework, and continue to be honored by it.

- - -------=_Part_10104_11843058.1137969609003-- - - - diff --git a/dev/correlate.rb b/dev/correlate.rb deleted file mode 100644 index aa9fab75e7..0000000000 --- a/dev/correlate.rb +++ /dev/null @@ -1,55 +0,0 @@ -#!/usr/local/bin/ruby - -if ARGV.empty? - puts "usage: " - exit(1) -end - -textmode = false - -if ARGV[0] == 't' - ARGV.shift - textmode = true -else - delta = ARGV.shift.to_i -end - -first = TRUE -last = [ ] - -# simple algorithm, build up a list of all the possible addresses -# calculating the delta range for each address in the file... then -# just do a set intersection across these all and you have your results - -ARGV.each do |file| - cur = [ ] - IO.foreach(file) do |line| - if textmode - cur << line - else - addr = line.hex - (-delta .. delta).each do |d| - cur << addr + d - end - end - end - - if first - first = FALSE - last = cur - else - last = last & cur - end - -end - -# print da results - -last.each { |l| - if textmode - puts l - else - puts "0x%08x" % l - end -} - diff --git a/dev/db/nessus.nbe b/dev/db/nessus.nbe deleted file mode 100644 index 69ee66854e..0000000000 --- a/dev/db/nessus.nbe +++ /dev/null @@ -1,202 +0,0 @@ -timestamps|||scan_start|Sun Apr 2 14:53:29 2006| -timestamps||192.168.106.128|host_start|Sun Apr 2 14:53:31 2006| -results|192.168.106|192.168.106.128|echo (7/tcp) -results|192.168.106|192.168.106.128|discard (9/tcp) -results|192.168.106|192.168.106.128|daytime (13/tcp) -results|192.168.106|192.168.106.128|qotd (17/tcp) -results|192.168.106|192.168.106.128|chargen (19/tcp) -results|192.168.106|192.168.106.128|ftp (21/tcp) -results|192.168.106|192.168.106.128|smtp (25/tcp) -results|192.168.106|192.168.106.128|domain (53/tcp) -results|192.168.106|192.168.106.128|http (80/tcp) -results|192.168.106|192.168.106.128|nntp (119/tcp) -results|192.168.106|192.168.106.128|epmap (135/tcp) -results|192.168.106|192.168.106.128|netbios-ssn (139/tcp) -results|192.168.106|192.168.106.128|https (443/tcp) -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp) -results|192.168.106|192.168.106.128|printer (515/tcp) -results|192.168.106|192.168.106.128|afpovertcp (548/tcp) -results|192.168.106|192.168.106.128|nntps (563/tcp) -results|192.168.106|192.168.106.128|NFS-or-IIS (1025/tcp) -results|192.168.106|192.168.106.128|IIS (1027/tcp) -results|192.168.106|192.168.106.128|iad3 (1032/tcp) -results|192.168.106|192.168.106.128|netinfo (1033/tcp) -results|192.168.106|192.168.106.128|wms (1755/tcp) -results|192.168.106|192.168.106.128|msdtc (3372/tcp) -results|192.168.106|192.168.106.128|ms-wbt-server (3389/tcp) -results|192.168.106|192.168.106.128|irc-serv (6666/tcp) -results|192.168.106|192.168.106.128|afs3-bos (7007/tcp) -results|192.168.106|192.168.106.128|ftp (21/tcp)|10330|Security Note|An FTP server is running on this port.\nHere is its banner : \n220 vmwin2000sp4 Microsoft FTP Service (Version 5.0).\r\n -results|192.168.106|192.168.106.128|domain (53/udp)|11002|Security Note|\nA DNS server is running on this port. If you do not use it, disable it.\n\nRisk factor : Low\n -results|192.168.106|192.168.106.128|chargen (19/tcp)|10330|Security Note|Chargen is running on this port\n -results|192.168.106|192.168.106.128|smtp (25/tcp)|10330|Security Note|An SMTP server is running on this port\nHere is its banner : \n220 vmwin2000sp4 Microsoft ESMTP MAIL Service, Version: 5.0.2195.6713 ready at Sun, 2 Apr 2006 14:53:35 -0500 \r\n -results|192.168.106|192.168.106.128|domain (53/tcp)|11002|Security Note|\nA DNS server is running on this port. If you do not use it, disable it.\n\nRisk factor : Low\n -results|192.168.106|192.168.106.128|snmp (161/udp)|10800|Security Note|\nSynopsis :\n\nThe System Information of the remote host can be obtained via SNMP.\n\nDescription :\n\nIt is possible to obtain the system information about the remote\nhost by sending SNMP requests with the OID 1.3.6.1.2.1.1.1.\n\nAn attacker may use this information to gain more knowledge about\nthe target host.\n\nSolution : \n\nDisable the SNMP service on the remote host if you do not use it,\nor filter incoming UDP packets going to this port.\n\nRisk factor : \n\nLow\n\nPlugin output :\n\nSystem information :\n sysDescr : Hardware: x86 Family 6 Model 14 Stepping 8 AT/AT COMPATIBLE - Software: Windows 2000 Version 5.0 (Build 2195 Uniprocessor Free)\n sysObjectID : 1.3.6.1.4.1.311.1.1.3.1.2\n sysUptime : 0d 0h 40m 13s\n sysContact : \n sysName : VMWIN2000SP4\n sysLocation : \n sysServices : 76\n\n\n -results|192.168.106|192.168.106.128|snmp (161/udp)|10546|Security Note|\nSynopsis :\n\nThe list of LANMAN users of the remote host can be obtained via SNMP.\n\nDescription :\n\nIt is possible to obtain the list of lanman users on the remote\nhost by sending SNMP requests with the OID 1.3.6.1.4.1.77.1.2.25.1.1\n\nAn attacker may use this information to gain more knowledge about\nthe target host.\n\nSolution : \n\nDisable the SNMP service on the remote host if you do not use it,\nor filter incoming UDP packets going to this port.\n\nRisk factor : \n\nLow\n\nPlugin output :\n\nGuest\nAdministrator\nIUSR_VMWIN2000\nIWAM_VMWIN2000\nTsInternetUser\nNetShowServices\n\n -results|192.168.106|192.168.106.128|snmp (161/udp)|10550|Security Note|\nSynopsis :\n\nThe list of processes running on the remote host can be obtained via SNMP.\n\nDescription :\n\nIt is possible to obtain the list of running processes on the remote\nhost by sending SNMP requests with the OID 1.3.6.1.2.1.25.4.2.1.2\n\nAn attacker may use this information to gain more knowledge about\nthe target host.\n\nSolution : \n\nDisable the SNMP service on the remote host if you do not use it,\nor filter incoming UDP packets going to this port.\n\nRisk factor : \n\nLow\n\nPlugin output :\n\nSystem Idle Process\nSystem\nSMSS.EXE\nCSRSS.EXE\nWINLOGON.EXE\nSERVICES.EXE\nLSASS.EXE\ntermsrv.exe\nsvchost.exe\nspoolsv.exe\nmsdtc.exe\ntcpsvcs.exe\nsvchost.exe\nLLSSRV.EXE\nsfmprint.exe\nNSPMON.exe\nnscm.exe\nregsvc.exe\nRsFsa.exe\nDLLHOST.EXE\nRsSub.exe\nDLLHOST.EXE\nmstask.exe\nSNMP.EXE\nlserver.exe\nVMwareService.e\nWinMgmt.exe\nsvchost.exe\nDNS.EXE\ninetinfo.exe\nnspm.exe\nnsum.exe\nCMD.EXE\nWINLOGON.EXE\nmdm.exe\nRsEng.exe\ndfssvc.exe\nSFMSVC.EXE\nsvchost.exe\nexplorer.exe\nCSRSS.EXE\n\n -results|192.168.106|192.168.106.128|domain (53/udp)|10539|Security Warning|\nSynopsis :\n\nThe remote name server allows recursive queries to be performed\nby the host running nessusd.\n\n\nDescription :\n\nIt is possible to query the remote name server for third party names.\n\nIf this is your internal nameserver, then forget this warning.\n\nIf you are probing a remote nameserver, then it allows anyone\nto use it to resolve third parties names (such as www.nessus.org).\nThis allows hackers to do cache poisoning attacks against this\nnameserver.\n\nIf the host allows these recursive queries via UDP,\nthen the host can be used to 'bounce' Denial of Service attacks\nagainst another network or system.\n\nSee also : \n\nhttp://www.cert.org/advisories/CA-1997-22.html\n\nSolution : \n\nRestrict recursive queries to the hosts that should\nuse this nameserver (such as those of the LAN connected to it).\n\nIf you are using bind 8, you can do this by using the instruction\n'allow-recursion' in the 'options' section of your named.conf\n\nIf you are using bind 9, you can define a grouping of internal addresses\nusing the 'acl' command\n\nThen, within the options block, you can explicitly state:\n'allow-recursion { hosts_defined_in_acl }'\n\nFor more info on Bind 9 administration (to include recursion), see: \nhttp://www.nominum.com/content/documents/bind9arm.pdf\n\nIf you are using another name server, consult its documentation.\n\nRisk factor :\n\nMedium / CVSS Base Score : 4 \n(AV:R/AC:L/Au:NR/C:N/A:N/I:P/B:I)\nCVE : CVE-1999-0024\nBID : 136, 678\n -results|192.168.106|192.168.106.128|https (443/tcp)|10330|Security Note|An unknown service is running on this port.\nIt is usually reserved for HTTPS\n -results|192.168.106|192.168.106.128|msdtc (3372/tcp)|10330|Security Note|A MSDTC server is running on this port\n -results|192.168.106|192.168.106.128|snmp (161/udp)|10264|Security Hole|\nSynopsis :\n\nThe community name of the remote SNMP server can be guessed.\n\nDescription :\n\nIt is possible to obtain the default community names of the remote\nSNMP server.\n\nAn attacker may use this information to gain more knowledge about\nthe remote host, or to change the configuration of the remote\nsystem (if the default community allow such modifications).\n\nSolution : \n\nDisable the SNMP service on the remote host if you do not use it,\nfilter incoming UDP packets going to this port, or change the \ndefault community string.\n\nRisk factor : \n\nHigh\n\nPlugin output :\n\nThe remote SNMP server replies to the following default community\nstrings :\n\npublic\n\nCVE : CAN-1999-0517, CAN-1999-0186, CAN-1999-0254, CAN-1999-0516\nBID : 11237, 10576, 177, 2112, 6825, 7081, 7212, 7317, 9681, 986\nOther references : IAVA:2001-B-0001\n -results|192.168.106|192.168.106.128|snmp (161/udp)|19763|Security Note|\nSynopsis :\n\nThe list of software installed on the remote host can be obtained via SNMP.\n\nDescription :\n\nIt is possible to obtain the list of installed softwares on the \nremote host by sending SNMP requests with the OID 1.3.6.1.2.1.25.6.3.1.2\n\nAn attacker may use this information to gain more knowledge about\nthe target host.\n\nSolution : \n\nDisable the SNMP service on the remote host if you do not use it,\nor filter incoming UDP packets going to this port.\n\nRisk factor : \n\nNone\n\nPlugin output :\n\n7-Zip 4.23\nVMware Tools\nWebFldrs\nDebugging Tools for Windows\n\n -results|192.168.106|192.168.106.128|general/icmp|10114|Security Note|\nSynopsis :\n\nIt is possible to determine the exact time set on the remote host.\n\nDescription :\n\nThe remote host answers to an ICMP timestamp request. This allows an attacker \nto know the date which is set on your machine. \n\nThis may help him to defeat all your time based authentication protocols.\n\nSolution : filter out the ICMP timestamp requests (13), and the outgoing ICMP \ntimestamp replies (14).\n\nRisk factor :\n\nNone / CVSS Base Score : 0 \n(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)\nCVE : CVE-1999-0524\n -results|192.168.106|192.168.106.128|snmp (161/udp)|10551|Security Note|\nSynopsis :\n\nThe list of network interfaces cards of the remote host can be obtained via\nSNMP.\n\nDescription :\n\nIt is possible to obtain the list of the network interfaces installed\non the remote host by sending SNMP requests with the OID 1.3.6.1.2.1.2.1.0\n\nAn attacker may use this information to gain more knowledge about\nthe target host.\n\nSolution : \n\nDisable the SNMP service on the remote host if you do not use it,\nor filter incoming UDP packets going to this port.\n\nRisk factor : \n\nLow\n\nPlugin output :\n\nInterface 1 information :\n ifIndex : 1\n ifDescr : MS TCP Loopback interface \n ifPhysAddress : \n\nInterface 2 information :\n ifIndex : 16777219\n ifDescr : VMware Accelerated AMD PCNet Adapter \n ifPhysAddress : 000c29de7efd\n\n\n -results|192.168.106|192.168.106.128|epmap (135/udp)|11890|Security Hole|\nA security vulnerability exists in the Messenger Service that could allow \narbitrary code execution on an affected system. An attacker who successfully \nexploited this vulnerability could be able to run code with Local System \nprivileges on an affected system, or could cause the Messenger Service to fail.\nDisabling the Messenger Service will prevent the possibility of attack. \n\nThis plugin actually checked for the presence of this flaw.\n\nSolution : see http://www.microsoft.com/technet/security/bulletin/ms03-043.mspx\n \nRisk factor : High\nCVE : CVE-2003-0717\nBID : 8826\nOther references : IAVA:2003-A-0028, IAVA:2003-a-0017, IAVA:2003-b-0007\n -results|192.168.106|192.168.106.128|snmp (161/udp)|10547|Security Note|\nSynopsis :\n\nThe list of LANMAN services running on the remote host can be obtained via SNMP.\n\nDescription :\n\nIt is possible to obtain the list of lanman services on the remote\nhost by sending SNMP requests with the OID 1.3.6.1.4.1.77.1.2.3.1.1\n\nAn attacker may use this information to gain more knowledge about\nthe target host.\n\nSolution : \n\nDisable the SNMP service on the remote host if you do not use it,\nor filter incoming UDP packets going to this port.\n\nRisk factor : \n\nLow\n\nPlugin output :\n\nServer\nAlerter\nEvent Log\nMessenger\nTelephony\nDNS Client\nDNS Server\nDHCP Client\nDHCP Server\nWorkstation\nSNMP Service\nPlug and Play\nPrint Spooler\nRunAs Service\nTask Scheduler\nComputer Browser\nAutomatic Updates\nCOM+ Event System\nIIS Admin Service\nProtected Storage\nRemovable Storage\nTerminal Services\nIPSEC Policy Agent\nNetwork Connections\nRemote Storage File\nTCP/IP Print Server\nLogical Disk Manager\nRemote Storage Media\nVMware Tools Service\nRemote Storage Engine\nFTP Publishing Service\nSimple TCP/IP Services\nDistributed File System\nLicense Logging Service\nRemote Registry Service\nFile Server for Macintosh\nSecurity Accounts Manager\nSystem Event Notification\nPrint Server for Macintosh\nRemote Procedure Call (RPC)\nTerminal Services Licensing\nTCP/IP NetBIOS Helper Service\nWindows Media Monitor Service\nWindows Media Program Service\nWindows Media Station Service\nWindows Media Unicast Service\nInternet Authentication Service\nNT LM Security Support Provider\nDistributed Link Tracking Client\nRemote Access Connection Manager\nWorld Wide Web Publishing Service\nWindows Management Instrumentation\nDistributed Transaction Coordinator\nSimple Mail Transport Protocol (SMTP)\nNetwork News Transport Protocol (NNTP)\nWindows Management Instrumentation Driver Extensions\n\n -results|192.168.106|192.168.106.128|http (80/tcp)|10330|Security Note|A web server is running on this port\n -results|192.168.106|192.168.106.128|nntp (119/tcp)|10330|Security Note|An NNTP server is running on this port\n -results|192.168.106|192.168.106.128|nntps (563/tcp)|10330|Security Note|An unknown service is running on this port.\nIt is usually reserved for NNTPS\n -results|192.168.106|192.168.106.128|echo (7/tcp)|10330|Security Note|An echo server is running on this port\n -results|192.168.106|192.168.106.128|qotd (17/tcp)|17975|Security Note|qotd seems to be running on this port\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|11011|Security Note|A CIFS server is running on this port\n -results|192.168.106|192.168.106.128|netbios-ssn (139/tcp)|11011|Security Note|An SMB server is running on this port\n -results|192.168.106|192.168.106.128|netbios-ns (137/tcp)|10150|Security Note|\nSynopsis :\n\nIt is possible to obtain the network name of the remote host.\n\nDescription :\n\nThe remote host listens on udp port 137 and replies to NetBIOS\nnbtscan requests.\nBy sending a wildcard request it is possible to obtain the name of\nthe remote system and the name of its domain.\n\nRisk factor :\n\nNone\n\nPlugin output :\n\nThe following 10 NetBIOS names have been gathered :\n\n VMWIN2000SP4 = Computer name\n INet~Services = Domain Controllers (IIS)\n WORKGROUP = Workgroup / Domain name\n IS~VMWIN2000SP4 = Computer name (IIS)\n VMWIN2000SP4 = File Server Service\n WORKGROUP = Browser Service Elections\n VMWIN2000SP4 = Messenger Service\n WORKGROUP = Master Browser\n __MSBROWSE__ = Master Browser\n ADMINISTRATOR = Messenger Username\n\nThe remote host has the following MAC address on its adapter :\n 00:0c:29:de:7e:fd\nCVE : CAN-1999-0621\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|10785|Security Note|\nSynopsis :\n\nIt is possible to obtain information about the remote operating\nsystem.\n\nDescription :\n\nIt is possible to get the remote operating system name and\nversion (Windows and/or Samba) by sending an authentication\nrequest to port 139 or 445.\n\nRisk factor :\n\nNone\n\nPlugin output :\n\nThe remote Operating System is : Windows 5.0\nThe remote native lan manager is : Windows 2000 LAN Manager\nThe remote SMB Domain Name is : VMWIN2000SP4\n\n -results|192.168.106|192.168.106.128|epmap (135/tcp)|10736|Security Note|\nSynopsis :\n\nA DCE/RPC service is running on the remote host.\n\nDescription :\n\nBy sending a Lookup request to the port 135 it was possible to\nenumerate the Distributed Computing Environment (DCE) services\nrunning on the remote port.\nUsing this information it is possible to connect and bind to\neach service by sending an RPC request to the remote port/pipe.\n\nRisk factor :\n\nNone\n\nPlugin output :\n\nThe following DCERPC services are available locally :\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc, version 1.0\nDescription : Messenger Service\nWindows process : svchost.exe\nAnnotation : Messenger Service\nType : Local RPC service\nNamed pipe : DNSResolver\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc, version 1.0\nDescription : Messenger Service\nWindows process : svchost.exe\nAnnotation : Messenger Service\nType : Local RPC service\nNamed pipe : ntsvcs\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : bfa951d1-2f0e-11d3-bfd1-00c04fa3490a, version 1.0\nDescription : Unknown RPC service\nType : Local RPC service\nNamed pipe : NNTPSVC_LPC\n\nObject UUID : a4138d7b-b4fb-4cec-9b04-90bca9591288\nUUID : 906b0ce0-c70b-1067-b317-00dd010662da, version 1.0\nDescription : Distributed Transaction Coordinator\nWindows process : msdtc.exe\nType : Local RPC service\nNamed pipe : LRPC00000228.00000001\n\nObject UUID : b6636f36-41a7-4bb0-96a8-01af659c6bff\nUUID : 906b0ce0-c70b-1067-b317-00dd010662da, version 1.0\nDescription : Distributed Transaction Coordinator\nWindows process : msdtc.exe\nType : Local RPC service\nNamed pipe : LRPC00000228.00000001\n\nObject UUID : 3a57cabd-429e-411b-ba3a-8f3de07e0024\nUUID : 906b0ce0-c70b-1067-b317-00dd010662da, version 1.0\nDescription : Distributed Transaction Coordinator\nWindows process : msdtc.exe\nType : Local RPC service\nNamed pipe : LRPC00000228.00000001\n\nObject UUID : 8f35706f-5ecd-49fc-956a-2a789af31ac8\nUUID : 906b0ce0-c70b-1067-b317-00dd010662da, version 1.0\nDescription : Distributed Transaction Coordinator\nWindows process : msdtc.exe\nType : Local RPC service\nNamed pipe : LRPC00000228.00000001\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 1ff70682-0a51-30e8-076d-740be8cee98b, version 1.0\nDescription : Scheduler Service\nWindows process : svchost.exe\nType : Local RPC service\nNamed pipe : LRPC000003f0.00000001\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 378e52b0-c0a9-11cf-822d-00aa0051e40f, version 1.0\nDescription : Scheduler Service\nWindows process : svchost.exe\nType : Local RPC service\nNamed pipe : LRPC000003f0.00000001\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 6bffd098-a112-3610-9833-46c3f874532d, version 1.0\nDescription : DHCP Server Service\nWindows process : unknown\nType : Local RPC service\nNamed pipe : DHCPSERVERLPC\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 5b821720-f63b-11d0-aad2-00c04fc324db, version 1.0\nDescription : DHCP Server Service\nWindows process : unknown\nType : Local RPC service\nNamed pipe : DHCPSERVERLPC\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 3d267954-eeb7-11d1-b94e-00c04fa3080d, version 1.0\nDescription : Unknown RPC service\nType : Local RPC service\nNamed pipe : LRPC00000454.00000001\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 12d4b7c8-77d5-11d1-8c24-00c04fa3080d, version 1.0\nDescription : Unknown RPC service\nType : Local RPC service\nNamed pipe : LRPC00000454.00000001\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 493c451c-155c-11d3-a314-00c04fb16103, version 1.0\nDescription : Unknown RPC service\nType : Local RPC service\nNamed pipe : LRPC00000454.00000001\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 82ad4280-036b-11cf-972c-00aa006887b0, version 2.0\nDescription : Internet Information Service (IISAdmin)\nWindows process : inetinfo.exe\nType : Local RPC service\nNamed pipe : OLE9\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 82ad4280-036b-11cf-972c-00aa006887b0, version 2.0\nDescription : Internet Information Service (IISAdmin)\nWindows process : inetinfo.exe\nType : Local RPC service\nNamed pipe : INETINFO_LPC\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 8cfb5d70-31a4-11cf-a7d8-00805f48a135, version 3.0\nDescription : Internet Information Service (SMTP)\nWindows process : inetinfo.exe\nType : Local RPC service\nNamed pipe : OLE9\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 8cfb5d70-31a4-11cf-a7d8-00805f48a135, version 3.0\nDescription : Internet Information Service (SMTP)\nWindows process : inetinfo.exe\nType : Local RPC service\nNamed pipe : INETINFO_LPC\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 8cfb5d70-31a4-11cf-a7d8-00805f48a135, version 3.0\nDescription : Internet Information Service (SMTP)\nWindows process : inetinfo.exe\nType : Local RPC service\nNamed pipe : SMTPSVC_LPC\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 4f82f460-0e21-11cf-909e-00805f48a135, version 4.0\nDescription : Internet Information Service (NNTP)\nWindows process : inetinfo.exe\nType : Local RPC service\nNamed pipe : OLE9\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 4f82f460-0e21-11cf-909e-00805f48a135, version 4.0\nDescription : Internet Information Service (NNTP)\nWindows process : inetinfo.exe\nType : Local RPC service\nNamed pipe : INETINFO_LPC\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 4f82f460-0e21-11cf-909e-00805f48a135, version 4.0\nDescription : Internet Information Service (NNTP)\nWindows process : inetinfo.exe\nType : Local RPC service\nNamed pipe : SMTPSVC_LPC\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 4f82f460-0e21-11cf-909e-00805f48a135, version 4.0\nDescription : Internet Information Service (NNTP)\nWindows process : inetinfo.exe\nType : Local RPC service\nNamed pipe : NNTPSVC_LPC\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : bfa951d1-2f0e-11d3-bfd1-00c04fa3490a, version 1.0\nDescription : Unknown RPC service\nType : Local RPC service\nNamed pipe : OLE9\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : bfa951d1-2f0e-11d3-bfd1-00c04fa3490a, version 1.0\nDescription : Unknown RPC service\nType : Local RPC service\nNamed pipe : INETINFO_LPC\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : bfa951d1-2f0e-11d3-bfd1-00c04fa3490a, version 1.0\nDescription : Unknown RPC service\nType : Local RPC service\nNamed pipe : SMTPSVC_LPC\n\n\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|10736|Security Note|\nSynopsis :\n\nA DCE/RPC service is running on the remote host.\n\nDescription :\n\nBy sending a Lookup request to the port 135 it was possible to\nenumerate the Distributed Computing Environment (DCE) services\nrunning on the remote port.\nUsing this information it is possible to connect and bind to\neach service by sending an RPC request to the remote port/pipe.\n\nRisk factor :\n\nNone\n\nPlugin output :\n\nThe following DCERPC services are available remotely :\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc, version 1.0\nDescription : Messenger Service\nWindows process : svchost.exe\nAnnotation : Messenger Service\nType : Remote RPC service\nNamed pipe : \\PIPE\\scerpc\nNetbios name : \\\\VMWIN2000SP4\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc, version 1.0\nDescription : Messenger Service\nWindows process : svchost.exe\nAnnotation : Messenger Service\nType : Remote RPC service\nNamed pipe : \\PIPE\\ntsvcs\nNetbios name : \\\\VMWIN2000SP4\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : bfa951d1-2f0e-11d3-bfd1-00c04fa3490a, version 1.0\nDescription : Unknown RPC service\nType : Remote RPC service\nNamed pipe : \\PIPE\\NNTPSVC\nNetbios name : \\\\VMWIN2000SP4\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : bfa951d1-2f0e-11d3-bfd1-00c04fa3490a, version 1.0\nDescription : Unknown RPC service\nType : Remote RPC service\nNamed pipe : \\PIPE\\SMTPSVC\nNetbios name : \\\\VMWIN2000SP4\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 3d267954-eeb7-11d1-b94e-00c04fa3080d, version 1.0\nDescription : Unknown RPC service\nType : Remote RPC service\nNamed pipe : \\pipe\\HydraLsPipe\nNetbios name : \\\\VMWIN2000SP4\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 12d4b7c8-77d5-11d1-8c24-00c04fa3080d, version 1.0\nDescription : Unknown RPC service\nType : Remote RPC service\nNamed pipe : \\pipe\\HydraLsPipe\nNetbios name : \\\\VMWIN2000SP4\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 493c451c-155c-11d3-a314-00c04fb16103, version 1.0\nDescription : Unknown RPC service\nType : Remote RPC service\nNamed pipe : \\pipe\\HydraLsPipe\nNetbios name : \\\\VMWIN2000SP4\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 82ad4280-036b-11cf-972c-00aa006887b0, version 2.0\nDescription : Internet Information Service (IISAdmin)\nWindows process : inetinfo.exe\nType : Remote RPC service\nNamed pipe : \\PIPE\\INETINFO\nNetbios name : \\\\VMWIN2000SP4\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 8cfb5d70-31a4-11cf-a7d8-00805f48a135, version 3.0\nDescription : Internet Information Service (SMTP)\nWindows process : inetinfo.exe\nType : Remote RPC service\nNamed pipe : \\PIPE\\INETINFO\nNetbios name : \\\\VMWIN2000SP4\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 8cfb5d70-31a4-11cf-a7d8-00805f48a135, version 3.0\nDescription : Internet Information Service (SMTP)\nWindows process : inetinfo.exe\nType : Remote RPC service\nNamed pipe : \\PIPE\\SMTPSVC\nNetbios name : \\\\VMWIN2000SP4\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 4f82f460-0e21-11cf-909e-00805f48a135, version 4.0\nDescription : Internet Information Service (NNTP)\nWindows process : inetinfo.exe\nType : Remote RPC service\nNamed pipe : \\PIPE\\INETINFO\nNetbios name : \\\\VMWIN2000SP4\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 4f82f460-0e21-11cf-909e-00805f48a135, version 4.0\nDescription : Internet Information Service (NNTP)\nWindows process : inetinfo.exe\nType : Remote RPC service\nNamed pipe : \\PIPE\\SMTPSVC\nNetbios name : \\\\VMWIN2000SP4\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 4f82f460-0e21-11cf-909e-00805f48a135, version 4.0\nDescription : Internet Information Service (NNTP)\nWindows process : inetinfo.exe\nType : Remote RPC service\nNamed pipe : \\PIPE\\NNTPSVC\nNetbios name : \\\\VMWIN2000SP4\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : bfa951d1-2f0e-11d3-bfd1-00c04fa3490a, version 1.0\nDescription : Unknown RPC service\nType : Remote RPC service\nNamed pipe : \\PIPE\\INETINFO\nNetbios name : \\\\VMWIN2000SP4\n\n\n -results|192.168.106|192.168.106.128|NFS-or-IIS (1025/tcp)|10736|Security Note|\nSynopsis :\n\nA DCE/RPC service is running on the remote host.\n\nDescription :\n\nBy sending a Lookup request to the port 135 it was possible to\nenumerate the Distributed Computing Environment (DCE) services\nrunning on the remote port.\nUsing this information it is possible to connect and bind to\neach service by sending an RPC request to the remote port/pipe.\n\nRisk factor :\n\nNone\n\nPlugin output :\n\nThe following DCERPC services are available on TCP port 1025 :\n\nObject UUID : a4138d7b-b4fb-4cec-9b04-90bca9591288\nUUID : 906b0ce0-c70b-1067-b317-00dd010662da, version 1.0\nDescription : Distributed Transaction Coordinator\nWindows process : msdtc.exe\nType : Remote RPC service\nTCP Port : 1025\nIP : 192.168.106.128\n\nObject UUID : b6636f36-41a7-4bb0-96a8-01af659c6bff\nUUID : 906b0ce0-c70b-1067-b317-00dd010662da, version 1.0\nDescription : Distributed Transaction Coordinator\nWindows process : msdtc.exe\nType : Remote RPC service\nTCP Port : 1025\nIP : 192.168.106.128\n\nObject UUID : 3a57cabd-429e-411b-ba3a-8f3de07e0024\nUUID : 906b0ce0-c70b-1067-b317-00dd010662da, version 1.0\nDescription : Distributed Transaction Coordinator\nWindows process : msdtc.exe\nType : Remote RPC service\nTCP Port : 1025\nIP : 192.168.106.128\n\nObject UUID : 8f35706f-5ecd-49fc-956a-2a789af31ac8\nUUID : 906b0ce0-c70b-1067-b317-00dd010662da, version 1.0\nDescription : Distributed Transaction Coordinator\nWindows process : msdtc.exe\nType : Remote RPC service\nTCP Port : 1025\nIP : 192.168.106.128\n\n\n -results|192.168.106|192.168.106.128|IIS (1027/tcp)|10736|Security Note|\nSynopsis :\n\nA DCE/RPC service is running on the remote host.\n\nDescription :\n\nBy sending a Lookup request to the port 135 it was possible to\nenumerate the Distributed Computing Environment (DCE) services\nrunning on the remote port.\nUsing this information it is possible to connect and bind to\neach service by sending an RPC request to the remote port/pipe.\n\nRisk factor :\n\nNone\n\nPlugin output :\n\nThe following DCERPC services are available on TCP port 1027 :\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 1ff70682-0a51-30e8-076d-740be8cee98b, version 1.0\nDescription : Scheduler Service\nWindows process : svchost.exe\nType : Remote RPC service\nTCP Port : 1027\nIP : 192.168.106.128\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 378e52b0-c0a9-11cf-822d-00aa0051e40f, version 1.0\nDescription : Scheduler Service\nWindows process : svchost.exe\nType : Remote RPC service\nTCP Port : 1027\nIP : 192.168.106.128\n\n\n -results|192.168.106|192.168.106.128|iad3 (1032/tcp)|10736|Security Note|\nSynopsis :\n\nA DCE/RPC service is running on the remote host.\n\nDescription :\n\nBy sending a Lookup request to the port 135 it was possible to\nenumerate the Distributed Computing Environment (DCE) services\nrunning on the remote port.\nUsing this information it is possible to connect and bind to\neach service by sending an RPC request to the remote port/pipe.\n\nRisk factor :\n\nNone\n\nPlugin output :\n\nThe following DCERPC services are available on TCP port 1032 :\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 50abc2a4-574d-40b3-9d66-ee4fd5fba076, version 5.0\nDescription : DNS Server\nWindows process : dns.exe\nType : Remote RPC service\nTCP Port : 1032\nIP : 192.168.106.128\n\n\n -results|192.168.106|192.168.106.128|netinfo (1033/tcp)|10736|Security Note|\nSynopsis :\n\nA DCE/RPC service is running on the remote host.\n\nDescription :\n\nBy sending a Lookup request to the port 135 it was possible to\nenumerate the Distributed Computing Environment (DCE) services\nrunning on the remote port.\nUsing this information it is possible to connect and bind to\neach service by sending an RPC request to the remote port/pipe.\n\nRisk factor :\n\nNone\n\nPlugin output :\n\nThe following DCERPC services are available on TCP port 1033 :\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 6bffd098-a112-3610-9833-46c3f874532d, version 1.0\nDescription : DHCP Server Service\nWindows process : unknown\nType : Remote RPC service\nTCP Port : 1033\nIP : 192.168.106.128\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 5b821720-f63b-11d0-aad2-00c04fc324db, version 1.0\nDescription : DHCP Server Service\nWindows process : unknown\nType : Remote RPC service\nTCP Port : 1033\nIP : 192.168.106.128\n\n\n -results|192.168.106|192.168.106.128|unknown (1035/tcp)|10736|Security Note|\nSynopsis :\n\nA DCE/RPC service is running on the remote host.\n\nDescription :\n\nBy sending a Lookup request to the port 135 it was possible to\nenumerate the Distributed Computing Environment (DCE) services\nrunning on the remote port.\nUsing this information it is possible to connect and bind to\neach service by sending an RPC request to the remote port/pipe.\n\nRisk factor :\n\nNone\n\nPlugin output :\n\nThe following DCERPC services are available on TCP port 1035 :\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 3d267954-eeb7-11d1-b94e-00c04fa3080d, version 1.0\nDescription : Unknown RPC service\nType : Remote RPC service\nTCP Port : 1035\nIP : 192.168.106.128\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 12d4b7c8-77d5-11d1-8c24-00c04fa3080d, version 1.0\nDescription : Unknown RPC service\nType : Remote RPC service\nTCP Port : 1035\nIP : 192.168.106.128\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 493c451c-155c-11d3-a314-00c04fb16103, version 1.0\nDescription : Unknown RPC service\nType : Remote RPC service\nTCP Port : 1035\nIP : 192.168.106.128\n\n\n -results|192.168.106|192.168.106.128|unknown (1036/tcp)|10736|Security Note|\nSynopsis :\n\nA DCE/RPC service is running on the remote host.\n\nDescription :\n\nBy sending a Lookup request to the port 135 it was possible to\nenumerate the Distributed Computing Environment (DCE) services\nrunning on the remote port.\nUsing this information it is possible to connect and bind to\neach service by sending an RPC request to the remote port/pipe.\n\nRisk factor :\n\nNone\n\nPlugin output :\n\nThe following DCERPC services are available on TCP port 1036 :\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 82ad4280-036b-11cf-972c-00aa006887b0, version 2.0\nDescription : Internet Information Service (IISAdmin)\nWindows process : inetinfo.exe\nType : Remote RPC service\nTCP Port : 1036\nIP : 192.168.106.128\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 8cfb5d70-31a4-11cf-a7d8-00805f48a135, version 3.0\nDescription : Internet Information Service (SMTP)\nWindows process : inetinfo.exe\nType : Remote RPC service\nTCP Port : 1036\nIP : 192.168.106.128\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 4f82f460-0e21-11cf-909e-00805f48a135, version 4.0\nDescription : Internet Information Service (NNTP)\nWindows process : inetinfo.exe\nType : Remote RPC service\nTCP Port : 1036\nIP : 192.168.106.128\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : bfa951d1-2f0e-11d3-bfd1-00c04fa3490a, version 1.0\nDescription : Unknown RPC service\nType : Remote RPC service\nTCP Port : 1036\nIP : 192.168.106.128\n\n\n -results|192.168.106|192.168.106.128|unknown (1037/udp)|10736|Security Note|\nSynopsis :\n\nA DCE/RPC service is running on the remote host.\n\nDescription :\n\nBy sending a Lookup request to the port 135 it was possible to\nenumerate the Distributed Computing Environment (DCE) services\nrunning on the remote port.\nUsing this information it is possible to connect and bind to\neach service by sending an RPC request to the remote port/pipe.\n\nRisk factor :\n\nNone\n\nPlugin output :\n\nThe following DCERPC services are available on UDP port 1037 :\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : bfa951d1-2f0e-11d3-bfd1-00c04fa3490a, version 1.0\nDescription : Unknown RPC service\nType : Remote RPC service\nUDP Port : 1037\nIP : 192.168.106.128\n\n\n -results|192.168.106|192.168.106.128|unknown (1038/udp)|10736|Security Note|\nSynopsis :\n\nA DCE/RPC service is running on the remote host.\n\nDescription :\n\nBy sending a Lookup request to the port 135 it was possible to\nenumerate the Distributed Computing Environment (DCE) services\nrunning on the remote port.\nUsing this information it is possible to connect and bind to\neach service by sending an RPC request to the remote port/pipe.\n\nRisk factor :\n\nNone\n\nPlugin output :\n\nThe following DCERPC services are available on UDP port 1038 :\n\nObject UUID : 00000000-0000-0000-0000-000000000000\nUUID : 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc, version 1.0\nDescription : Messenger Service\nWindows process : svchost.exe\nAnnotation : Messenger Service\nType : Remote RPC service\nUDP Port : 1038\nIP : 192.168.106.128\n\n\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|10394|Security Hole|\nSynopsis :\n\nIt is possible to logon on the remote host.\n\nDescription :\n\nThe remote host is running one of the Microsoft Windows operating\nsystem. It was possible to logon using the administrator account\nwith a blank password.\n\nSee Also :\n\nhttp://support.microsoft.com/support/kb/articles/Q143/4/74.ASP\nhttp://support.microsoft.com/support/kb/articles/Q246/2/61.ASP\n\nRisk factor :\n\nCritical / CVSS Base Score : 10 \n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\n\nPlugin output :\n\n- NULL sessions are enabled on the remote host\n- The 'administrator' account has no password set\n\nCVE : CVE-1999-0504, CVE-1999-0506, CVE-2000-0222, CVE-1999-0505, CVE-2002-1117\nBID : 494, 990, 11199\n -results|192.168.106|192.168.106.128|daytime (13/tcp)|11153|Security Note|Daytime is running on this port\n -results|192.168.106|192.168.106.128|netbios-ns (137/udp)|11830|Security Warning|\nThe remote host is running a version of the NetBT name\nservice which suffers from a memory disclosure problem.\n\nAn attacker may send a special packet to the remote NetBT name\nservice, and the reply will contain random arbitrary data from \nthe remote host memory. This arbitrary data may be a fragment from\nthe web page the remote user is viewing, or something more serious\nlike a POP password or anything else.\n\nAn attacker may use this flaw to continuously 'poll' the content\nof the memory of the remote host and might be able to obtain sensitive\ninformation.\n\n\nSolution : See http://www.microsoft.com/technet/security/bulletin/ms03-034.mspx\nRisk factor : Medium\nCVE : CVE-2003-0661\nBID : 8532\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|10400|Security Note|\nSynopsis :\n\nAccess the remote Windows Registry.\n\nDescription :\n\nIt was possible to access the remote Windows Registry using the login\n/ password combination used for the Windows local checks (SMB tests).\n\nRisk factor :\n\nNone\n -results|192.168.106|192.168.106.128|http (80/tcp)|11032|Security Note|The following directories were discovered:\n/_vti_bin, /images\n\nWhile this is not, in and of itself, a bug, you should manually inspect \nthese directories to ensure that they are in compliance with company\nsecurity standards\n\nThe following directories require authentication:\n/printers\nOther references : OWASP:OWASP-CM-006\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|10531|Security Note|\nSynopsis :\n\nRemote system has latest service pack installed.\n\nDescription :\n\nBy reading the registry key HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CSDVersion\nit was possible to determine the Service Pack version of the Windows 2000\nsystem.\n\nRisk factor :\n\nNone\n\nPlugin output :\n\nThe remote Windows 2000 system has Service Pack 4 applied.\n\nCVE : CVE-1999-0662\nBID : 7930, 8090, 8128, 8154\n -results|192.168.106|192.168.106.128|general/tcp|11936|Security Note|The remote host is running Microsoft Windows 2000 Advanced Server Service Pack 4 (English)\n -results|192.168.106|192.168.106.128|http (80/tcp)|10107|Security Note|The remote web server type is :\n\nMicrosoft-IIS/5.0\r\n\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|16326|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host.\n\nDescription :\n\nThe remote version of Windows contains a flaw in the Server Message\nBlock (SMB) implementation which may allow an attacker to execute arbitrary \ncode on the remote host.\n\nTo exploit this flaw, an attacker would need to send malformed responses\nto the remote SMB client, and would be able to either execute arbitrary\ncode on the remote host or to perform a denial of service.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/MS05-011.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-0045\nBID : 12484\nOther references : IAVA:2005-t-0005\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|19402|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host due to a flaw in the \nPlug-And-Play service.\n\nDescription :\n\nThe remote version of Windows contains a flaw in the function \nPNP_QueryResConfList() in the Plug and Play service which may allow an \nattacker to execute arbitrary code on the remote host with the SYSTEM\nprivileges.\n\nA series of worms (Zotob) are known to exploit this vulnerability in the \nwild.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-039.mspx\n\nRisk factor : \n\nCritical / CVSS Base Score : 10\n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-1983\nBID : 14513\nOther references : IAVA:2005-A-0025, IAVA:2005-B-0017\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|16123|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through the web client.\n\nDescription :\n\nThe remote host contains a version of the HTML Help ActiveX control which\nis vulnerable to a security flaw which may allow an attacker to execute\narbitrary code on the remote host by constructing a malicious web page\nand entice a victim to visit this web page.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows NT, 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-001.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2004-1043\nOther references : IAVA:2005-A-0002\n -results|192.168.106|192.168.106.128|smtp (25/tcp)|10263|Security Note|\nSynopsis :\n\nAn SMTP server is listening on the remote port.\n\nDescription :\n\nThe remote host is running a mail (SMTP) server on this port.\n\nSince SMTP servers are the targets of spammers, it is recommended you \ndisable it if you do not use it.\n\nSolution : \n\nDisable this service if you do not use it, or filter incoming traffic \nto this port.\n\nRisk factor : \n\nNone\n\nPlugin output :\n\nRemote SMTP server banner :\n220 vmwin2000sp4 Microsoft ESMTP MAIL Service, Version: 5.0.2195.6713 ready at Sun, 2 Apr 2006 14:53:35 -0500 \r\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|18483|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host due to a flaw in the \nSMB implementation.\n\nDescription :\n\nThe remote version of Windows contains a flaw in the Server Message\nBlock (SMB) implementation which may allow an attacker to execute arbitrary \ncode on the remote host.\n\nAn attacker does not need to be authenticated to exploit this flaw.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-027.mspx\n\nRisk factor : \n\nCritical / CVSS Base Score : 10\n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-1208\nBID : 13942\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|11835|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host.\n\nDescription :\n\nThe remote host is running a version of Windows which has a flaw in \nits RPC interface, which may allow an attacker to execute arbitrary code \nand gain SYSTEM privileges. \n\nAn attacker or a worm could use it to gain the control of this host.\n\nNote that this is NOT the same bug as the one described in MS03-026 \nwhich fixes the flaw exploited by the 'MSBlast' (or LoveSan) worm.\n \nSolution :\n\nhttp://www.microsoft.com/technet/security/bulletin/MS03-039.mspx \n\nRisk factor :\n\nCritical / CVSS Base Score : 10 \n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2003-0715, CVE-2003-0528, CVE-2003-0605\nBID : 8458, 8460\nOther references : IAVA:2003-A-0012\n -results|192.168.106|192.168.106.128|discard (9/tcp)|11367|Security Warning|\nThe remote host is running a 'discard' service. This service\ntypically sets up a listening socket and will ignore all the\ndata which it receives. \n\nThis service is unused these days, so it is advised that you\ndisable it.\n\n\nSolution : \n\n- Under Unix systems, comment out the 'discard' line in /etc/inetd.conf\n and restart the inetd process\n \n- Under Windows systems, set the following registry key to 0 :\n HKLM\\System\\CurrentControlSet\\Services\\SimpTCP\\Parameters\\EnableTcpDiscard\n \nThen launch cmd.exe and type :\n\n net stop simptcp\n net start simptcp\n \nTo restart the service.\n\n \nRisk factor : Low\nCVE : CAN-1999-0636\n -results|192.168.106|192.168.106.128|ftp (21/tcp)|10092|Security Note|\nSynopsis :\n\nA FTP server is listening on this port\n\nDescription :\n\nIt is possible to obtain the banner of the remote FTP server\nby connecting to the remote port.\n\nRisk factor : \n\nNone\n\nPlugin output :\n\nThe remote FTP banner is :\n220 vmwin2000sp4 Microsoft FTP Service (Version 5.0).\r\n\n -results|192.168.106|192.168.106.128|ftp (21/tcp)|10092|Security Note|\nSynopsis :\n\nA FTP server is listening on this port\n\nDescription :\n\nIt is possible to obtain the banner of the remote FTP server\nby connecting to the remote port.\n\nRisk factor : \n\nNone\n\nPlugin output :\n\nThe remote FTP banner is :\n220 vmwin2000sp4 Microsoft FTP Service (Version 5.0).\r\n -results|192.168.106|192.168.106.128|ftp (21/tcp)|10079|Security Note|\nSynopsis :\n\nAnonymous logins are allowed on the remote FTP server.\n\nDescription :\n\nThis FTP service allows anonymous logins. If you do not want to share data \nwith anyone you do not know, then you should deactivate the anonymous account, \nsince it can only cause troubles.\n\nRisk factor :\n\nLow / CVSS Base Score : 2 \n(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)\nCVE : CVE-1999-0497\n -results|192.168.106|192.168.106.128|afpovertcp (548/tcp)|10666|Security Note|\nSynopsis :\n\nFile sharing service is available.\n\nDescription :\n\nThe remote host is running an AppleShare IP file service.\nBy sending DSIGetStatus request on tcp port 548, it was\npossible to disclose information about the remote host.\n\nRisk factor :\n\nNone / CVSS Base Score : 0 \n(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)\n\nPlugin output :\n\nThis host is running an AppleShare File Services over IP.\n Machine type: Windows NT\n Server name: VMWIN2000SP4\n UAMs: ClearTxt Passwrd/Microsoft V1.0/MS2.0\n AFP Versions: AFPVersion 2.0/AFPVersion 2.1/AFP2.2\n\n -results|192.168.106|192.168.106.128|echo (7/tcp)|10061|Security Note|\nSynopsis :\n\nAn echo service is running on the remote host.\n\nDescription :\n\nThe remote host is running the 'echo' service. This service \nechoes any data which is sent to it. \n \nThis service is unused these days, so it is strongly advised that\nyou disable it, as it may be used by attackers to set up denial of\nservices attacks against this host.\n\nSolution :\n\n- Under Unix systems, comment out the 'echo' line in /etc/inetd.conf\n and restart the inetd process\n \n- Under Windows systems, set the following registry key to 0 :\n HKLM\\System\\CurrentControlSet\\Services\\SimpTCP\\Parameters\\EnableTcpEcho\n HKLM\\System\\CurrentControlSet\\Services\\SimpTCP\\Parameters\\EnableUdpEcho\n \nThen launch cmd.exe and type :\n\n net stop simptcp\n net start simptcp\n \nTo restart the service.\n\nRisk factor :\n\nNone / CVSS Base Score : 0 \n(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)\nCVE : CVE-1999-0103, CVE-1999-0635\n -results|192.168.106|192.168.106.128|echo (7/udp)|10061|Security Note|\nSynopsis :\n\nAn echo service is running on the remote host.\n\nDescription :\n\nThe remote host is running the 'echo' service. This service \nechoes any data which is sent to it. \n \nThis service is unused these days, so it is strongly advised that\nyou disable it, as it may be used by attackers to set up denial of\nservices attacks against this host.\n\nSolution :\n\n- Under Unix systems, comment out the 'echo' line in /etc/inetd.conf\n and restart the inetd process\n \n- Under Windows systems, set the following registry key to 0 :\n HKLM\\System\\CurrentControlSet\\Services\\SimpTCP\\Parameters\\EnableTcpEcho\n HKLM\\System\\CurrentControlSet\\Services\\SimpTCP\\Parameters\\EnableUdpEcho\n \nThen launch cmd.exe and type :\n\n net stop simptcp\n net start simptcp\n \nTo restart the service.\n\nRisk factor :\n\nNone / CVSS Base Score : 0 \n(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)\nCVE : CVE-1999-0103, CVE-1999-0635\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|15460|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through the web client.\n\nDescription :\n\nThe remote version of Windows contains a flaw in the Windows Shell which\nmay allow an attacker to execute arbitrary code on the remote host.\n\nTo exploit this flaw, an attacker would need to lure a victim into visiting\na malicious website or into opening a malicious file attachment.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows NT, 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms04-037.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2004-0214, CVE-2004-0572\nBID : 10677\nOther references : IAVA:2004-A-0019\n -results|192.168.106|192.168.106.128|http (80/tcp)|10077|Security Note|\nSynopsis :\n\nFrontpage extensions are enabled.\n\nDescription :\n\nThe remote web server appears to be running with the Frontpage extensions.\nFrontpage allows remote web developers and administrators to modify web\ncontent from a remote location. While this is a fairly typical scenario\non an internal Local Area Network, the Frontpage extensions should not\nbe available to anonymous users via the Internet (or any other untrusted\n3rd party network).\n\nRisk factor :\n\nNone / CVSS Base Score : 0 \n(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)\n\nPlugin output :\n\nThe remote frontpage server leaks information regarding the name anonymous user\r\nBy knowing the name of the anonymous user, more sophisticated attacks may be launched\r\nWe could gather that the name of the anonymous user is : IUSR_VMWIN2000\nCVE : CVE-2000-0114\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|18489|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through the email client.\n\nDescription :\n\nThe remote host is running a version of Microsoft Outlook Express which contains\na security flaw which may allow an attacker to execute arbitrary code on the remote host.\n\nTo exploit this flaw, an attacker would need to lure a user to connect to a rogue NNTP\n(news) server sending malformed replies to several queries.\n\nSolution : \n\nMicrosoft has released a set of patches for Outlook Express :\n\nSolution : http://www.microsoft.com/technet/security/bulletin/ms05-030.mspx\n\nRisk factor :\n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-1213\nBID : 13951\nOther references : IAVA:2005-t-0018\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|13643|Security Warning|\nSynopsis :\n\nIt is possible to crash the remote email client.\n\nDescription :\n\nThe remote host is missing a cumulative security update for Outlook Express\nwhich fixes a denial of service vulnerability in the Outlook Express mail\nclient.\n\nTo exploit this vulnerability, an attacker would need to send a malformed\nmessage to a victim on the remote host. The message will crash her version\nof Outlook, thus preventing her from reading her e-mail.\n\nSolution : \n\nMicrosoft has released a set of patches for Outlook Express :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms04-018.mspx\n\nRisk factor : \n\nMedium / CVSS Base Score : 4 \n(AV:R/AC:H/Au:NR/C:N/A:C/I:N/B:A)\nCVE : CVE-2004-0215\nBID : 10711\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|10456|Security Note|\nSynopsis :\n\nIt is possible to enumerate remote services.\n\nDescription :\n\nThis plugin implements the SvcOpenSCManager() and SvcEnumServices()\ncalls to obtain, using the SMB protocol, the list of active services\nof the remote host.\n\nAn attacker may use this feature to gain better knowledge of the remote\nhost.\n\nSolution : \n\nTo prevent the listing of the services for being obtained, you should\neither have tight login restrictions, so that only trusted users can \naccess your host, and/or you should filter incoming traffic to this port.\n\nRisk factor : \n\nLow / CVSS Base Score : 2 \n(AV:R/AC:H/Au:NR/C:P/A:N/I:N/B:N)\n\nPlugin output :\n\nAlerter [ Alerter ] \nComputer Browser [ Browser ] \nDistributed File System [ Dfs ] \nDHCP Client [ Dhcp ] \nDHCP Server [ DHCPServer ] \nLogical Disk Manager [ dmserver ] \nDNS Server [ DNS ] \nDNS Client [ Dnscache ] \nEvent Log [ Eventlog ] \nCOM+ Event System [ EventSystem ] \nInternet Authentication Service [ IAS ] \nIIS Admin Service [ IISADMIN ] \nServer [ lanmanserver ] \nWorkstation [ lanmanworkstation ] \nLicense Logging Service [ LicenseService ] \nTCP/IP NetBIOS Helper Service [ LmHosts ] \nTCP/IP Print Server [ LPDSVC ] \nFile Server for Macintosh [ MacFile ] \nPrint Server for Macintosh [ MacPrint ] \nMessenger [ Messenger ] \nDistributed Transaction Coordinator [ MSDTC ] \nFTP Publishing Service [ MSFTPSVC ] \nNetwork Connections [ Netman ] \nNetwork News Transport Protocol (NNTP) [ NntpSvc ] \nWindows Media Monitor Service [ nsmonitor ] \nWindows Media Program Service [ nsprogram ] \nWindows Media Station Service [ nsstation ] \nWindows Media Unicast Service [ nsunicast ] \nNT LM Security Support Provider [ NtLmSsp ] \nRemovable Storage [ NtmsSvc ] \nPlug and Play [ PlugPlay ] \nIPSEC Policy Agent [ PolicyAgent ] \nProtected Storage [ ProtectedStorage ] \nRemote Access Connection Manager [ RasMan ] \nRemote Registry Service [ RemoteRegistry ] \nRemote Storage Engine [ Remote_Storage_Engine ] \nRemote Storage File [ Remote_Storage_File_System_Agent ] \nRemote Storage Media [ Remote_Storage_Subsystem ] \nRemote Procedure Call (RPC) [ RpcSs ] \nSecurity Accounts Manager [ SamSs ] \nTask Scheduler [ Schedule ] \nRunAs Service [ seclogon ] \nSystem Event Notification [ SENS ] \nSimple TCP/IP Services [ SimpTcp ] \nSimple Mail Transport Protocol (SMTP) [ SMTPSVC ] \nSNMP Service [ SNMP ] \nPrint Spooler [ Spooler ] \nTelephony [ TapiSrv ] \nTerminal Services [ TermService ] \nTerminal Services Licensing [ TermServLicensing ] \nDistributed Link Tracking Client [ TrkWks ] \nVMware Tools Service [ VMTools ] \nWorld Wide Web Publishing Service [ W3SVC ] \nWindows Management Instrumentation [ WinMgmt ] \nWindows Management Instrumentation Driver Extensions [ Wmi ] \nAutomatic Updates [ wuauserv ] \n\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|20002|Security Warning|\nSynopsis :\n\nVulnerabilities in the Windows Shell may allow an attacker to execute\narbitrary code on the remote host.\n\nDescription :\n\nThe remote version of Windows contains a version of the Windows Shell\nwhich has several vulnerabilities.\n\nAn attacker may exploit these vulnerabilities by :\n\n - Sending a malformed .lnk file a to user on the remote host which\n triggers an overflow\n\n - Sending a malformed HTML document to a user on the remote host and\n have him view it in the Windows Explorer preview pane\n\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-049.mspx\n\nRisk factor :\n\nMedium / CVSS Base Score : 6 \n(AV:R/AC:H/Au:NR/C:P/A:P/I:P/B:N)\nCVE : CVE-2005-2122, CVE-2005-2118, CVE-2005-2117\nBID : 15070, 15069, 15064\nOther references : IAVA:2005-A-0027\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|10859|Security Note|\nSynopsis :\n\nIt is possible to obtain remote host SID.\n\nDescription :\n\nBy emulating the call to LsaQueryInformationPolicy() it was\npossible to obtain the host SID (Security Identifier).\n\nThe host SID can then be used to get the list of local users.\n\nRisk factor : \n\nNone\n\nPlugin output :\n\nThe remote host SID value is :\n1-5-21-484763869-1383384898-725345543\nCVE : CVE-2000-1200\nBID : 959\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|10860|Security Note|\nSynopsis :\n\nIt is possible to enumerate local users.\n\nDescription :\n\nUsing the host SID, it is possible to enumerates the local \nusers on the remote Windows system. (we only enumerated users \nname whose ID is between 1000 and 2000 or whatever preferences\nyou set).\n\nRisk factor : \n\nNone\n\nPlugin output :\n\n- Administrator account name : Administrator (id 500)\n- Guest account name : Guest (id 501)\n- TsInternetUser (id 1000)\n- NetShowServices (id 1001)\n- NetShow Administrators (id 1002)\n- IUSR_VMWIN2000 (id 1003)\n- IWAM_VMWIN2000 (id 1004)\n- DHCP Users (id 1005)\n- DHCP Administrators (id 1006)\n- WINS Users (id 1007)\n\nCVE : CVE-2000-1200\nBID : 959\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|20000|Security Warning|\nSynopsis :\n\nA flaw in the Plug and Play service may allow an authenticated attacker \nto execute arbitrary code on the remote host and therefore elevate his \nprivileges.\n\nDescription :\n\nThe remote host contain a version of the Plug and Play service which\ncontains a vulnerability in the way it handles user-supplied data.\n\nAn authenticated attacker may exploit this flaw by sending a malformed\nRPC request to the remote service and execute code within the SYSTEM\ncontext.\n\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000 and XP :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-047.mspx\n\nRisk factor :\n\nMedium / CVSS Base Score : 6 \n(AV:R/AC:L/Au:R/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-2120\nBID : 15065\n -results|192.168.106|192.168.106.128|general/tcp|20094|Security Note|\nSynopsis :\n\nThe remote host seems to be a VMWare virtual machine.\n\nDescription :\n\nThe remote host seems to be a VMWare virtual machine running\nthe Microsoft Windows Operating system. Since it is physically \naccessible through the network, you should ensure that its \nconfiguration matches the one of your corporate security policy.\n\nRisk factor :\n\nNone\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|12209|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host due to a flaw in the \nLSASS service.\n\nDescription :\n\nThe remote version of Windows contains a flaw in the function LsarClearAuditLog\nof the Local Security Authority Server Service (LSASS) which may allow an \nattacker to execute arbitrary code on the remote host with the SYSTEM\nprivileges.\n\nA series of worms (Sasser) are known to exploit this vulnerability in the \nwild.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows NT, 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms04-011.mspx\n\nRisk factor : \n\nCritical / CVSS Base Score : 10\n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nOther references : IAVA:2004-A-0006\n -results|192.168.106|192.168.106.128|nntp (119/tcp)|10159|Security Note|\nSynopsis :\n\nA NNTP server is listening on the remote port\n\nDescription :\n\nThe remote host is running a news server (NNTP). Make sure\nthat hosting such a server is authorized by your company \npolicy.\n\nSolution : \n\nDisable this service if you do not use it.\n\n\nRisk factor : \n\nNone\n\nPlugin output :\n\nRemote server banner :\n200 NNTP Service 5.00.0984 Version: 5.0.2195.6702 Posting Allowed \r\n\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|18592|Security Warning|\nSynopsis :\n\nA security update is missing on the remote host.\n\nDescription :\n\nThe remote host is missing the Update Rollup 1 (URP1) for Windows 2000 SP4.\n\nThis update rollup contains several security fixes in addition to previously\nreleased security patches.\n\nSolution :\n\nhttp://support.microsoft.com/kb/891861/\n\nRisk factor :\n\nMedium / CVSS Base Score : 6 \n(AV:R/AC:H/Au:NR/C:P/A:P/I:P/B:N)\nBID : 14093\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|10397|Security Note|\nSynopsis :\n\nIt is possible to obtain network information.\n\nDescription :\n\nIt was possible to obtain the browse list of the remote\nWindows system by send a request to the LANMAN pipe.\nThe browse list is the list of the nearest Windows systems\nof the remote host. \n\nRisk factor :\n\nNone\n\nPlugin output :\n\nHere is the browse list of the remote host : \n\nVMWIN2000SP4 ( os: 5.0 )\n\n -results|192.168.106|192.168.106.128|NFS-or-IIS (1025/tcp)|20008|Security Hole|\nSynopsis :\n\nA vulnerability in MSDTC could allow remote code execution.\n\nDescription :\n\nThe remote version of Windows contains a version of MSDTC (Microsoft Data\nTransaction Coordinator) service which is vulnerable to several remote code\nexecution, local privilege escalation and denial of service vulnerabilities.\n\nAn attacker may exploit these flaws to obtain the complete control of the\nremote host.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-051.mspx\n\nRisk factor :\n\nCritical / CVSS Base Score : 10\n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-2119, CVE-2005-1978, CVE-2005-1979, CVE-2005-1980\nBID : 15059, 15058, 15057, 15056\nOther references : IAVA:2005-A-0030\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|18482|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through the web client.\n\nDescription :\n\nThe remote host contains a version of the HTML Help ActiveX control which\nis vulnerable to a security flaw which may allow an attacker to execute\narbitrary code on the remote host by constructing a malicious web page\nand entice a victim to visit this web page.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-026.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-1208\nBID : 13953\nOther references : IAVA:2005-A-0017\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|12267|Security Warning|\nA denial of service vulnerability exists in the implementation of the\nIDirectPlay4 application programming interface (API) of Microsoft DirectPlay\nbecause of a lack of robust packet validation.\n\nIf a user is running a networked DirectPlay application,\nan attacker who successfully exploited this vulnerability could\ncause the DirectPlay application to fail. The user would have\nto restart the application to resume functionality.\n\nSolution : http://www.microsoft.com/technet/security/bulletin/ms04-016.mspx\nRisk factor : High\nCVE : CAN-2004-0202\nBID : 10487\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|19405|Security Hole|\nSynopsis :\n\nIt is possible to crash the remote service or disclose information.\n\nDescription :\n\nThe remote host contains a version of the Kerberos protocol which is \nvulnerable to multiple security flaws which may allow an attacker to crash\nthe remote service (AD), disclose information or spoof session.\n\nAn attacker need valid credentials to exploit those flaws.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-042.mspx\n\nRisk factor : \n\nMedium / CVSS Base Score : 4 \n(AV:R/AC:L/Au:R/C:P/A:P/I:P/B:N)\nCVE : CVE-2005-1981, CVE-2005-1981\nBID : 14519, 14520\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|16299|Security Warning|\nSynopsis :\n\nRandom portions of memory may be disclosed thru the NetBIOS name service.\n\nDescription :\n\nThe remote host is running a version of the NetBT name\nservice which suffers from a memory disclosure problem.\n\nAn attacker may send a special packet to the remote NetBT name\nservice, and the reply will contain random arbitrary data from \nthe remote host memory. This arbitrary data may be a fragment from\nthe web page the remote user is viewing, or something more serious\nlike a POP password or anything else.\n\nAn attacker may use this flaw to continuously 'poll' the content\nof the memory of the remote host and might be able to obtain sensitive\ninformation.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows NT, 2000, XP ans 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms03-034.mspx\n\nRisk factor :\n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2003-0661\nBID : 8532\n -results|192.168.106|192.168.106.128|general/tcp|10916|Security Warning|\nSynopsis :\n\nIt is possible to retrieve users whose password never expires using \nthe supplied credentials.\n\nDescription :\n\nUsing the supplied credentials it was possible to extract the list of\nlocal users whose password never expires.\nIt is recommended to allow/force users to change their password for\nsecurity reasons.\n\nRisk factor :\n\nMedium / CVSS Base Score : 4 \n(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:C)\n\nPlugin output :\n\nThe following users have password which never expires :\nAdministrator\nGuest\nTsInternetUser\nNetShowServices\nIUSR_VMWIN2000\nIWAM_VMWIN2000\n\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|12052|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host.\n\nDescription :\n\nThe remote Windows host has a ASN.1 library which is vulnerable to a \nflaw which could allow an attacker to execute arbitrary code on this host.\n\nTo exploit this flaw, an attacker would need to send a specially crafted\nASN.1 encoded packet (either an IPsec session negotiation, or an HTTPS request)\nwith improperly advertised lengths.\n\nA public code is available to exploit this flaw.\n\nSolution :\n\nMicrosoft has released a set of patches for Windows NT, 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms04-007.mspx\n\nRisk factor : \n\n Critical / CVSS Base Score : 10\n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2003-0818\nBID : 9633, 9635, 13300\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|19408|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host due to a flaw in the \nPlug-And-Play service.\n\nDescription :\n\nThe remote version of Windows contains a flaw in the function \nPNP_QueryResConfList() in the Plug and Play service which may allow an \nattacker to execute arbitrary code on the remote host with the SYSTEM\nprivileges.\n\nA series of worms (Zotob) are known to exploit this vulnerability in the \nwild.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-039.mspx\n\nRisk factor : \n\n Critical / CVSS Base Score : 10\n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-1983\nBID : 14513\nOther references : IAVA:2005-A-0025\n -results|192.168.106|192.168.106.128|http (80/tcp)|11874|Security Note|The remote IIS server *seems* to be Microsoft IIS 5 - SP3 or SP4\n\n -results|192.168.106|192.168.106.128|http (80/tcp)|11874|Security Note|The remote IIS server *seems* to be Microsoft IIS 5 - SP3 or SP4\n\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|16125|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host.\n\nDescription :\n\nThe remote host contains a version of the Indexing Service which is\nvulnerable to a security flaw which may allow an attacker to execute\narbitrary code on the remote host by constructing a malicious query.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows NT, 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-003.mspx\n\nRisk factor :\n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2004-0897\nBID : 12228\nOther references : IAVA:2005-t-0001\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|20001|Security Hole|\nSynopsis :\n\nA flaw in the Microsoft Collaboration Data Object may allow an attacker\nto execute arbitrary code on the remote host.\n\nDescription :\n\nAn unchecked buffer condition may allow an attacker to execute arbitrary\ncode on the remote host.\n\nTo execute this flaw, an attacker would need to send a malformed message\nvia SMTP to the remote host, either by using the SMTP server\n(if Exchange is installed) or by sending an email to a user on the remote\nhost.\n\nWhen the email is processed by CDO, an unchecked buffer may allow cause\ncode execution.\n\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-048.mspx\n\nRisk factor :\n\nHigh / CVSS Base Score : 7 \n(AV:R/AC:L/Au:NR/C:P/A:P/I:P/B:N)\nCVE : CVE-2005-1987\nBID : 15067\nOther references : IAVA:2005-t-0040\n -results|192.168.106|192.168.106.128|nntp (119/tcp)|15465|Security Hole|\nThe remote host is running a version of Microsoft NNTP server which is\nvulnerable to a buffer overflow issue.\n\nAn attacker may exploit this flaw to execute arbitrary commands on the remote\nhost with the privileges of the NNTP server process.\n\nSolution : http://www.microsoft.com/technet/security/bulletin/MS04-036.mspx\nRisk factor : High\nCVE : CVE-2004-0574\nBID : 11379\nOther references : IAVA:2004-A-0018\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|19998|Security Warning|\nSynopsis :\n\nA flaw in the remote network connection manager may allow an attacker to cause\na denial of service on the remote host.\n\nDescription :\n\nThe remote host contains a version of the Network Connection Manager which\ncontains a denial of service vulnerability which may allow an attacker to\ndisable the component responsible for managing network and remote access\nconnections.\n\nTo exploit this vulnerability, an attacker would need to send a malformed\npacket to the remote host.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-045.mspx\n\nRisk factor :\n\nMedium / CVSS Base Score : 4 \n(AV:R/AC:L/Au:NR/C:N/A:P/I:N/B:A)\nCVE : CVE-2005-2307\nOther references : IAVA:2005-t-0042\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|11457|Security Note|\nSynopsis :\n\nUser credentials are stored in memory.\n\nDescription :\n\nThe registry key \nHKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\CachedLogonsCount\nis non-null. It means that the remote host locally caches the passwords\nof the users when they log in, in order to continue to allow the users\nto log in in the case of the failure of the PDC.\n\nSolution : \n\nuse regedt32 and set the value of this key to 0\n\nRisk factor :\n\nLow / CVSS Base Score : 1 \n(AV:L/AC:H/Au:R/C:P/A:N/I:N/B:N)\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|18215|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through Explorer.\n\nDescription :\n\nThe remote host is running a version of Microsoft Windows which contains a \nsecurity flaw in the Web View of the Windows Explorer which may allow an \nattacker to execute arbitrary code on the remote host.\n\nTo succeed, the attacker would have to send a rogue file to a user of the \nremote computer and have it preview it using the Web View with the Windows \nExplorer.\n\nSolution : \n\nMicrosoft has released a patch for Windows 2000 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-024.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-1191\nBID : 13248\nOther references : IAVA:2005-t-0016\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|13637|Security Hole|\nSynopsis :\n\nLocal users can elevate their privileges.\n\nDescription :\n\nThe remote host is running a version of the Utility Manager which contains\na flaw which may allow a local attacker to execute arbitrary code on the host,\nthus escalating his privileges and obtaining the full control of the remote\nsystem.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms04-019.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 7 \n(AV:L/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2004-0213\nBID : 10707\nOther references : IAVA:2004-t-0019\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|10861|Security Hole|\nThe July 2004 Cumulative Patch for IE is not applied on the remote host.\n\nImpact of vulnerability: Run code of attacker's choice. \n\nRecommendation: Customers using IE should install the patch immediately. \n\nSee http://www.microsoft.com/technet/security/bulletin/ms05-020.mspx\nRisk factor : High\nCVE : CAN-2003-0814, CAN-2003-0815, CAN-2003-0816, CAN-2003-0817, CAN-2003-0823, CAN-2004-0549, CAN-2004-0566, CAN-2003-1048, CAN-2001-1325, CAN-2001-0149, CAN-2001-0727, CAN-2001-0875, CVE-2001-1325, CVE-2001-0149, CVE-2001-0727, CVE-2001-0875, CVE-2001-0339, CVE-2001-0002, CAN-2002-0190, CVE-2002-0026, CAN-2003-1326, CVE-2002-0027, CVE-2002-0022, CAN-2003-1328, CAN-2002-1262, CAN-2002-0193, CAN-1999-1016, CVE-2003-0344, CAN-2003-0233, CAN-2003-0309, CAN-2003-0113, CAN-2003-0114, CAN-2003-0115, CAN-2003-0116, CAN-2003-0531, CAN-2003-0809, CAN-2003-0530, CAN-2003-1025, CAN-2003-1026, CAN-2003-1027, CAN-2005-0554, CAN-2005-0555\nBID : 11388, 11385, 11383, 11381, 11377, 11367, 11366, 10473, 8565, 9009, 9012, 9013, 9014, 9015, 9182, 9663, 9798, 12477, 12475, 12473, 12530, 13123, 13117, 13120\nOther references : IAVA:2003-A-0014, IAVA:2004-A-0016, IAVA:2005-A-0006\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|16324|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through the web client.\n\nDescription :\n\nThe remote version of Windows contains a flaw in the Windows Shell which\nmay allow an attacker to elevate his privileges and/or execute arbitrary\ncode on the remote host.\n\nTo exploit this flaw, an attacker would need to lure a victim into visiting\na malicious website or into opening a malicious file attachment.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-008.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-0053\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|10395|Security Warning|\nSynopsis :\n\nIt is possible to enumerate remote network shares.\n\nDescription :\n\nBy connecting to the remote host using a NULL (or guest) session\nNessus was able to enumerates the network share names.\n\nRisk factor :\n\nNone\n\nPlugin output :\n\nHere is the list of the SMB shares of this host : \n\nIPC$\nADMIN$\nC$\n\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|10396|Security Note|\nSynopsis :\n\nIt is possible to access a network share.\n\nDescription :\n\nThe remote has one or many Windows shares that can be accessed\nthrough the Network with the given credentials.\nDepending on the share rights, it may allow an attacker to \nread/write confidential data.\n\nSolution :\n\nTo restrict access under Windows, open the explorer, do a right\nclick on each shares, go to the 'sharing' tab, and click on \n'permissions'\n\nRisk factor :\n\nNone\n\nPlugin output :\n\nThe following shares can be accessed as administrator :\n\n- C$ - (readable,writable)\n + Content of this share :\narcsetup.exe\nASFRoot\nAUTOEXEC.BAT\nboot.ini\nConfig.Msi\nCONFIG.SYS\nDocuments and Settings\nInetpub\nIO.SYS\nMicrosoft UAM Volume\nMSDOS.SYS\nNTDETECT.COM\nntldr\npagefile.sys\nProgram Files\nRECYCLER\nSystem Volume Information\nTools\nWINNT\n\n- ADMIN$ - (readable,writable)\n + Content of this share :\n..\naddins\nApplication Compatibility Scripts\nAppPatch\nBGInfo.bmp\nBlue Lace 16.bmp\ncertocm.log\nclock.avi\nclusocm.log\ncluster\nCoffee Bean.bmp\nCOM+.log\ncomsetup.log\nConfig\nConnection Wizard\ncontrol.ini\nCursors\nDebug\ndelttsul.exe\ndesktop.ini\nDownloaded Program Files\nDriver Cache\nexplorer.exe\nexplorer.scf\nFeatherTexture.bmp\nfolder.htt\nFonts\nfrontpg.ini\nGone Fishing.bmp\nGreenstone.bmp\nHelp\nhh.exe\nIIS Temporary Compressed Files\niis5.log\nime\nimsins.log\ninf\nInstaller\njava\nlanma256.bmp\nlanmannt.bmp\nLicenOc.log\nMedia\nmmdet.log\nModemDet.txt\nmsagent\nmsapps\nmsdfmap.ini\nmsmqprop.log\nmww32\nNOTEPAD.EXE\nnsrex.INI\nocgen.log\nockodak.log\nODBCINST.INI\nOEWABLog.txt\nOffline Web Pages\npoledit.exe\nPrairie Wind.bmp\nregedit.exe\nRegistration\nREGLOCS.OLD\nrepair\nRhododendron.bmp\nRiver Sumida.bmp\nSanta Fe Stucco.bmp\nSchedLgU.Txt\nsecurity\nServicePackFiles\nSET33.tmp\nSET38.tmp\nsetupact.log\nsetupapi.log\nsetuperr.log\nsetuplog.txt\nShellIconCache\nSoap Bubbles.bmp\nSpeech\nsptsupd.log\nSti_Trace.log\nsvcpack.log\nsystem\nsystem.ini\n\n\nCVE : CVE-1999-0519, CVE-1999-0520\nBID : 8026\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|19401|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through the web client.\n\nDescription :\n\nThe remote host contains a version of the Internet Explorer which is\nvulnerable to multiple security flaws (JPEG Rendering, Web Folder, COM\nObject) which may allow an attacker to execute arbitrary code on the\nremote host by constructing a malicious web page and entice a victim \nto visit this web page.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-038.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-1988, CVE-2005-1989, CVE-2005-1990\nBID : 14511, 14512, 14515\nOther references : IAVA:2005-A-0024\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|18682|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through the web client.\n\nDescription :\n\nThe remote host contains a version of the JView Profiler module which\nis vulnerable to a security flaw which may allow an attacker to execute\narbitrary code on the remote host by constructing a malicious web page\nand entice a victim to visit this web page.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-037.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-2087\nOther references : IAVA:2005-B-0016\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|11145|Security Note|\nHotfix to fix Certificate Validation Flaw (Q329115)\nis not installed.\n\nThe vulnerability could enable an attacker who had\na valid end-entity certificate to issue a\nsubordinate certificate that, although bogus,\nwould nevertheless pass validation. Because\nCryptoAPI is used by a wide range of applications,\nthis could enable a variety of identity spoofing\nattacks.\nImpact of vulnerability: Identity spoofing. \n\nMaximum Severity Rating: Critical \n\nRecommendation: Administrators should install the patch immediately. \n\nAffected Software: \n\nMicrosoft Windows 98 \nMicrosoft Windows 98 Second Edition \nMicrosoft Windows Me \nMicrosoft Windows NT 4.0 \nMicrosoft Windows NT 4.0, Terminal Server Edition \nMicrosoft Windows 2000 \nMicrosoft Windows XP \nMicrosoft Office for Mac \nMicrosoft Internet Explorer for Mac \nMicrosoft Outlook Express for Mac \n\nSee\nhttp://www.microsoft.com/technet/security/bulletin/ms02-050.mspx\n\nRisk factor : High\nCVE : CAN-2002-1183, CAN-2002-0862\nBID : 5410\n -results|192.168.106|192.168.106.128|IIS (1027/tcp)|13852|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host.\n\nDescription :\n\nThere is a flaw in the Task Scheduler application which could allow a\nremote attacker to execute code remotely. There are many attack vectors\nfor this flaw. An attacker, exploiting this flaw, would need to either \nhave the ability to connect to the target machine or be able to coerce a\nlocal user to either install a .job file or browse to a malicious website.\n\nSolution :\n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms04-022.mspx\n\nRisk factor :\n\nCritical / CVSS Base Score : 10\n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2004-0212\nBID : 10708\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|18490|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through the web client.\n\nDescription :\n\nThe remote host is missing the IE cumulative security update 883939.\n\nThe remote version of IE is vulnerable to several flaws which may allow an attacker to\nexecute arbitrary code on the remote host.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-025.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-1211, CVE-2002-0648\nBID : 5560, 13947, 13946, 13943, 13941\nOther references : IAVA:2005-A-0016\n -results|192.168.106|192.168.106.128|general/tcp|10913|Security Note|\nSynopsis :\n\nIt is possible to retrieve disabled users account using the supplied\ncredentials.\n\nDescription :\n\nUsing the supplied credentials it was possible to extract the disabled\nuser account list.\nPermanently disabled accounts should be suppressed.\n\nRisk factor :\n\nNone / CVSS Base Score : 0 \n(AV:L/AC:H/Au:R/C:N/A:N/I:N/B:N)\n\nPlugin output :\n\nThe following accounts are disabled :\nGuest\n\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|20003|Security Hole|\nSynopsis :\n\nA vulnerability in DirectShow could allow remote code execution.\n\nDescription :\n\nThe remote host contains a version of DirectX which is vulnerable\nto a remote code execution flaw.\n\nTo exploit this flaw, an attacker would need to send a specially\nmalformed .avi file to a user on the remote host and have him\nopen it.\n\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-050.mspx\n\nRisk factor :\n\nRisk factor :\n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-2128\nBID : 15063\nOther references : IAVA:2005-A-0029\n -results|192.168.106|192.168.106.128|http (80/tcp)|11422|Security Note|\nSynopsis :\n\nRemote web server is not or badly configured\n\nDescription :\n\nThe remote web server seems to have its default welcome page set.\nIt probably means that this server is not used at all.\n\nSolution :\n\nDisable this service, as you do not use it\n\nRisk factor :\n\nNone / CVSS Base Score : 0 \n(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)\n -results|192.168.106|192.168.106.128|general/tcp|10902|Security Note|\nSynopsis :\n\nIt is possible to retrieve Users in the 'Administrators' group using\nthe supplied credentials.\n\nDescription :\n\nUsing the supplied credentials it was possible to extract the member\nlist of group 'Administrators'.\nMembers of this group have a complete access to the remote system.\n\nYou should make sure that only the proper users are member of this\ngroup.\n\nRisk factor :\n\nNone / CVSS Base Score : 0 \n(AV:L/AC:H/Au:R/C:N/A:N/I:N/B:N)\n\nPlugin output :\n\nThe following users are in the 'Administrators' group :\n. VMWIN2000SP4\\Administrator (User)\n. VMWIN2000SP4\\NetShowServices (User)\n\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|18681|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through the web client.\n\nDescription :\n\nThe remote host contains a version of the Color Management Module which\nis vulnerable to a security flaw which may allow an attacker to execute\narbitrary code on the remote host by constructing a malicious web page\nand entice a victim to visit this web page.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-036.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-1219\nBID : 14214\nOther references : IAVA:2005-A-0018\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|18502|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host due to a flaw in the \nSMB implementation.\n\nDescription :\n\nThe remote version of Windows contains a flaw in the Server Message\nBlock (SMB) implementation which may allow an attacker to execute arbitrary \ncode on the remote host.\n\nAn attacker does not need to be authenticated to exploit this flaw.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-027.mspx\n\nRisk factor : \n\nCritical / CVSS Base Score : 10\n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-1206\nBID : 13942\nOther references : IAVA:2005-t-0019\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|11885|Security Warning|\nA vulnerability exists because the ListBox control and the ComboBox control \nboth call a function, which is located in the User32.dll file, that contains \na buffer overrun. An attacker who had the ability to log on to a system \ninteractively could run a program that could send a specially-crafted Windows \nmessage to any applications that have implemented the ListBox control or the \nComboBox control, causing the application to take any action an attacker \nspecified. An attacker must have valid logon credentials to exploit the \nvulnerability. This vulnerability could not be exploited remotely. \n\n\nSolution : see http://www.microsoft.com/technet/security/bulletin/ms03-045.mspx\n\nRisk factor : Medium\nCVE : CAN-2003-0659\nBID : 8827\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|19999|Security Hole|\nSynopsis :\n\nA flaw in the client service for NetWare may allow an attacker to execute\narbitrary code on the remote host.\n\nDescription :\n\nThe remote host contains a version of the Client Service for NetWare which \nis vulnerable to a buffer overflow.\n\nAn attacker may exploit this flaw by connecting to the NetWare RPC service\n(possibly over IP) and trigger the overflow by sending a malformed RPC\nrequest.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-046.mspx\n\nRisk factor :\n\nCritical / CVSS Base Score : 10 \n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-1985\nBID : 15066\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|16327|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through explorer.\n\nDescription :\n\nThe remote host is running a version of Windows which is vulnerable to two\nvulnerabilities when dealing with OLE and/or COM. \n\nThese vulnerabilities may allow a local user to escalate his privileges\nand allow a remote user to execute arbitrary code on the remote host.\n\nTo exploit these flaws, an attacker would need to send a specially crafted\ndocument to a victim on the remote host.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/MS05-012.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-0047, CVE-2005-0044\nBID : 12488, 12483\nOther references : IAVA:2005-A-0007\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|11790|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host.\n\nDescription :\n\nThe remote host is running a version of Windows which has a flaw in \nits RPC interface, which may allow an attacker to execute arbitrary code \nand gain SYSTEM privileges.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows NT, 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms03-026.mspx\n\nRisk factor :\n\nCritical / CVSS Base Score : 10 \n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2003-0352, CVE-2003-0715, CVE-2003-0528, CVE-2003-0605\nBID : 8205, 8458, 8460\nOther references : IAVA:2003-A-0011\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|15962|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host due to WINS service.\n\nDescription :\n\nThe remote Windows Internet Naming Service (WINS) is vulnerable to a Heap\noverflow vulnerability which could allow an attacker to execute arbitrary\ncode on this host.\n\nTo exploit this flaw, an attacker would need to send a specially crafted\npacket on port 42 of the remote host.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows NT, 2000 and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms04-045.mspx\n\nRisk factor : \n\nCritical / CVSS Base Score : 10 \n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2004-0567, CVE-2004-1080\nBID : 11763, 11922\nOther references : IAVA:2004-b-0016, IAVA:2004-t-0039\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|11928|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through the Help service.\n\nDescription :\n\nA security vulnerability exists in the Windows Help Service that could allow \narbitrary code execution on an affected system. An attacker who successfully \nexploited this vulnerability could be able to run code with Local System on\nthis host.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows NT, 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms03-044.mspx\n\nRisk factor :\n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2003-0711\nBID : 8828\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|11888|Security Warning|\nA security vulnerability exists in the Messenger Service that could allow \narbitrary code execution on an affected system. An attacker who successfully \nexploited this vulnerability could be able to run code with Local System \nprivileges on an affected system, or could cause the Messenger Service to fail.\nDisabling the Messenger Service will prevent the possibility of attack. \n\nThis plugin determined by reading the remote registry that the patch\nMS03-043 has not been applied.\n\nSolution : see http://www.microsoft.com/technet/security/bulletin/ms03-043.mspx\n \nRisk factor : High\nCVE : CAN-2003-0717\nBID : 8826\nOther references : IAVA:2003-B-0007\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|11583|Security Note|\nSynopsis :\n\nIt is possible to crash the remote web client.\n\nDescription :\n\nThe remote host is running a version of the shlwapi.dll which crashes\nwhen processing a malformed HTML form.\n\nAn attacker may use this flaw to prevent the users of this host from\nworking properly.\n\nTo exploit this flaw, an attacker would need to send a malformed\nHTML file to the remote user, either by e-mail or by making him\nvisit a rogue web site.\n\nSolution :\n\nNone\n\nRisk factor :\n\nLow / CVSS Base Score : 3 \n(AV:R/AC:H/Au:NR/C:N/A:P/I:N/B:A)\nBID : 7402\n -results|192.168.106|192.168.106.128|general/tcp|10915|Security Warning|\nSynopsis :\n\nIt is possible to retrieve users who never logged in using the supplied\ncredentials.\n\nDescription :\n\nUsing the supplied credentials it was possible to extract the list of\nlocal users who never logged into the remote host.\nIt is recommended to delete useless accounts.\n\nRisk factor :\n\nMedium / CVSS Base Score : 4 \n(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:C)\n\nPlugin output :\n\nThe following users never logged in :\nGuest\nTsInternetUser\n\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|12051|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host.\n\nDescription :\n\nThe remote Windows Internet Naming Service (WINS) is vulnerable to a \nflaw which could allow an attacker to execute arbitrary code on this host.\n\nTo exploit this flaw, an attacker would need to send a specially crafted\npacket with improperly advertised lengths.\n\nSolution :\n\nMicrosoft has released a set of patches for Windows NT, 2000 and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms04-006.mspx\n\nRisk factor : \n\n Critical / CVSS Base Score : 10\n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2003-0825\nBID : 9624\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|20004|Security Hole|\nSynopsis :\n\nA vulnerability in MSDTC and COM+ could allow remote code execution.\n\nDescription :\n\nThe remote version of Windows contains a version of MSDTC and COM+ which\nare vulnerable to several remote code execution, local privilege escalation\nand denial of service vulnerabilities.\n\nAn attacker may exploit these flaws to obtain the complete control of the\nremote host.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-051.mspx\n\nRisk factor :\n\nCritical / CVSS Base Score : 10\n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-2119, CVE-2005-1978, CVE-2005-1979, CVE-2005-1980\nBID : 15059, 15058, 15057, 15056\nOther references : IAVA:2005-A-0030\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|12207|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through database engine.\n\nDescription :\n\nThe remote host has a bug in its Microsoft Jet Database Engine (837001).\n\nAn attacker may exploit one of these flaws to execute arbitrary code on the\nremote system.\n\nTo exploit this flaw, an attacker would need the ability to craft a specially\nmalformed database query and have this engine execute it.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows NT, 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms04-014.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2004-0197\nBID : 10112\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|19406|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host due to a flaw in the \nSpooler service.\n\nDescription :\n\nThe remote host contains a version of the Print Spooler service which\nis vulnerable to a security flaw which may allow an attacker to execute\ncode on the remote host or crash the spooler service.\n\nAn attacker can execute code on the remote host with a NULL session against :\n- Windows 2000\n\nAn attacker can crash the remote service with a NULL session against :\n- Windows 2000\n- Windows XP SP1\n\nAn attacker needs valid credentials to crash the service against :\n- Windows 2003\n- Windows XP SP2\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-043.mspx\n\nRisk factor : \n\nCritical / CVSS Base Score : 10\n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-1984\nBID : 14514\nOther references : IAVA:2005-t-0029\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|19404|Security Hole|\nSynopsis :\n\nIt is possible to crash the remote desktop service.\n\nDescription :\n\nThe remote host contains a version of the Remote Desktop protocol/service\nwhich is vulnerable to a security flaw which may allow an attacker to crash\nthe remote service and cause the system to stop responding.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-041.mspx\n\nRisk factor : \n\nMedium / CVSS Base Score : 5 \n(AV:R/AC:L/Au:NR/C:N/A:C/I:N/B:A)\nCVE : CVE-2005-1218\nBID : 14259\nOther references : IAVA:2005-t-0026\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|18602|Security Hole|\nIt is possible to anonymously read the event logs of the remote Windows 2000 host by \nconnecting to the \\srvsvc pipe and binding to the event log service.\n\nAn attacker may use this flaw to anonymously read the system logs of the remote host.\nAs system logs typically include valuable information, an attacker may use them to\nperform a better attack against the remote host.\n\nSolution : Install the Update Rollup Package 1 (URP1) for Windows 2000 SP4 or \nset the value RestrictGuestAccess on the Applications and System logs\nRisk factor : High\nBID : 14093, 14178\n -results|192.168.106|192.168.106.128|irc-serv (6666/tcp)|11157|Security Note|An unknown service runs on this port.\nIt is sometimes opened by this/these Trojan horse(s):\n Dark Connection Inside\n NetBus worm\n Beasty\n\nHere is the service banner:\n4\n\nUnless you know for sure what is behind it, you'd better\ncheck your system\n\n*** Anyway, don't panic, Nessus only found an open port. It may\n*** have been dynamically allocated to some service (RPC...)\n\nSolution: if a trojan horse is running, run a good antivirus scanner\nRisk factor : Low\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|20906|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through the Media Player.\n\nDescription :\n\nThe remote host is running either Windows Media Player plug-in.\n\nThere is a vulnerability in the remote version of this software which may\nallow an attacker to execute arbitrary code on the remote host.\n\nTo exploit this flaw, one attacker would need to set up a rogue\nEMBED element and send it to a victim on the remote host.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms06-006.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2006-0005\nBID : 16644\n -results|192.168.106|192.168.106.128|general/tcp|10914|Security Warning|\nSynopsis :\n\nIt is possible to retrieve users who can never changed their password\nusing the supplied credentials.\n\nDescription :\n\nUsing the supplied credentials it was possible to extract the list of\nusers who never changed their password.\nIt is recommended to allow/force users to change their password for\nsecurity reasons.\n\nRisk factor :\n\nMedium / CVSS Base Score : 4 \n(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:C)\n\nPlugin output :\n\nThe following users never changed their password :\nTsInternetUser\nNetShowServices\nIUSR_VMWIN2000\nIWAM_VMWIN2000\n\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|18022|Security Hole|\nSynopsis :\n\nA local user can elevate his privileges on the remote host.\n\nDescription :\n\nThe remote host contains a version of the Windows kernel which is vulnerable\nto a security flaw which may allow a local user to elevate his privileges\nor to crash the remote host (therefore causing a denial of service).\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003:\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-018.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 7 \n(AV:L/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-0551, CVE-2005-0550, CVE-2005-0060\nBID : 13121, 13115, 13110, 13109\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|11921|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host.\n\nDescription :\n\nThe remote version of Windows contains a flaw in the function \nNetpValidateName() in the WorkStation service which may allow an \nattacker to execute arbitrary code on the remote host with the SYSTEM\nprivileges.\n\nA series of worms (Welchia, Spybot, ...) are known to exploit this\nvulnerability in the wild.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000 and XP :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms03-049.mspx\n\nRisk factor :\n\nCritical / CVSS Base Score : 10 \n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2003-0812\nBID : 9011\nOther references : IAVA:2003-B-0008, IAVA:2003-a-0018, CERT:CA-2003-28\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|18021|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host.\n\nDescription :\n\nThe remote version of Windows is affected by a vulnerability in \nMicrosoft Message Queuing Service (MSMQ).\n\nAn attacker may exploit this flaw to execute arbitrary code on the remote\nhost with the SYSTEM privileges.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000 and XP :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-017.mspx\n\nRisk factor : \n\nCritical / CVSS Base Score : 10 \n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-0059\nBID : 13112\nOther references : IAVA:2005-t-0011\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|17651|Security Note|\nSynopsis :\n\nIt is possible to retrieve password policy using the supplied credentials.\n\nDescription :\n\nUsing the supplied credentials it was possible to extract the password\npolicy.\nPassword policy must be conform to the Informationnal System Policy.\n\nRisk factor :\n\nNone / CVSS Base Score : 0 \n(AV:L/AC:H/Au:R/C:N/A:N/I:N/B:N)\n\nPlugin output :\n\nThe following password policy is defined on the remote host:\n\nMinimum password len: 0\nPassword history len: 0\nMaximum password age (d): 42\nPassword must meet complexity requirements: Enabled\nMinimum password age (d): 0\nForced logoff time (s): Not set\nLocked account time (s): 1800\nTime between failed logon (s): 1800\nNumber of invalid logon before locked out (s): 0\n\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|20382|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host by sending a malformed file\nto a victim.\n\nDescription :\n\nThe remote host contains a version of Microsoft Windows is missing a critical\nsecurity update which fixes several vulnerabilities in the Graphic Rendering\nEngine, and in the way Windows handles Metafiles.\n\nAn attacker may exploit these flaws to execute arbitrary code on the remote\nhost. To exploit this flaw, an attacker would need to send a specially \ncrafted Windows Metafile (WMF) to a user on the remote host, or lure him\ninto visiting a rogue website containing such a file.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP SP2 and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms06-001.mspx\n\nRisk factor :\n\nHigh / CVSS Base Score : 8\n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-4560\nBID : 16074\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|16325|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host.\n\nDescription :\n\nThe remote version of Windows contains a flaw in the Logging Service which\nmay allow an attacker to execute arbitrary code on the remote host.\n\nTo exploit this flaw, an attacker would need to send a malformed packet to\nthe remote logging service, and would be able to either execute arbitrary\ncode on the remote host or to perform a denial of service.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows NT, 2000 and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-010.mspx\n\nRisk factor : \n\nCritical / CVSS Base Score : 10 \n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-0050\nBID : 12481\nOther references : IAVA:2005-t-0003\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|12054|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host.\n\nDescription :\n\nThe remote Windows host has a ASN.1 library which is vulnerable to a \nflaw which could allow an attacker to execute arbitrary code on this host.\n\nTo exploit this flaw, an attacker would need to send a specially crafted\nASN.1 encoded packet with improperly advertised lengths.\n\nThis particular check sent a malformed NTLM packet and determined that \nthe remote host is not patched.\n\nSolution :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms04-007.mspx\n\nRisk factor :\n\nCritical / CVSS Base Score : 10 \n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2003-0818\nBID : 9633, 9635, 9743, 13300\nOther references : IAVA:2004-A-0001\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|20811|Security Note|\nSynopsis :\n\nIt is possible to enumerate installed software.\n\nDescription :\n\nThis plugin lists software installed on the remote host by crawling\nthe registry entries in :\nHKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\n\nSolution : \n\nRemove software that are not compliant with your company policy.\n\nRisk factor : \n\nNone\n\nPlugin output :\n\nThe following software are installed on the remote host:\n\nDebugging Tools for Windows [version 6.5.3.8]\nWebFldrs [version 9.00.3501]\nVMware Tools [version 3.1.0000]\n7-Zip 4.23\n\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|20172|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host by sending a malformed file\nto a victim.\n\nDescription :\n\nThe remote host contains a version of Microsoft Windows is missing a critical\nsecurity update which fixes several vulnerabilities in the Graphic Rendering\nEngine, and in the way Windows handles Metafiles.\n\nAn attacker may exploit these flaws to execute arbitrary code on the remote\nhost. To exploit these flaws, an attacker would need to send a specially \ncrafted Windows Metafile (WMF) or Enhanced Metafile (EMF) to a victim on\nthe remote host. When viewing the malformed file, a buffer overflow condition\noccurs which may allow the execution of arbitrary code with the privileges of\nthe user.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP SP2 and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-053.mspx\n\nRisk factor :\n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-2123, CVE-2005-2124, CVE-2005-0803\nBID : 15352, 15356\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|12206|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host.\n\nDescription :\n\nThe remote host has multiple bugs in its RPC/DCOM implementation (828741).\n\nAn attacker may exploit one of these flaws to execute arbitrary code on the\nremote system.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows NT, 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms04-012.mspx\n\nRisk factor : \n\nCritical / CVSS Base Score : 10 \n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2003-0813, CVE-2004-0116, CVE-2003-0807, CVE-2004-0124\nBID : 10121, 10123, 10127, 8811\nOther references : IAVA:2004-A-0005\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|18485|Security Note|\nSynopsis :\n\nIt is possible to spoof the content of a web site.\n\nDescription :\n\nThe remote version of Windows contains a flaw in the Microsoft Agent service \nwhich may allow an attacker to spoof the content of a web site.\n\nTo exploit this flaw, an attacker would need to set up a rogue web site and \nlure a victim on the remote host into visiting it.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-032.mspx\n\nRisk factor : \n\nLow / CVSS Base Score : 3 \n(AV:R/AC:H/Au:NR/C:P/A:N/I:N/B:C)\nCVE : CVE-2005-1214\nBID : 13948\nOther references : IAVA:2005-t-0022\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|18023|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host due to a flaw in the \nTCP/IP stack.\n\nDescription :\n\nThe remote host runs a version of Windows which has a flaw in its TCP/IP\nstack.\n\nThe flaw may allow an attacker to execute arbitrary code with SYSTEM\nprivileges on the remote host, or to perform a denial of service attack\nagainst the remote host.\n\nProof of concept code is available to perform a Denial of Service against\na vulnerable system.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-019.mspx\n\nRisk factor : \nHigh / CVSS Base Score : 9 \n(AV:R/AC:L/Au:NR/C:P/A:C/I:P/B:A)\nCVE : CVE-2005-0048, CVE-2004-0790, CVE-2004-1060, CVE-2004-0230, CVE-2005-0688\nBID : 13124, 13116\nOther references : IAVA:2005-B-0011, IAVA:2005-B-0012\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|20299|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through the web client.\n\nDescription :\n\nThe remote host is missing the IE cumulative security update 905915.\n\nThe remote version of IE is vulnerable to several flaws which may allow an \nattacker to execute arbitrary code on the remote host.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-054.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-2829, CVE-2005-2830, CVE-2005-2831, CVE-2005-1790\nBID : 15823, 15825, 15827\n -results|192.168.106|192.168.106.128|ftp (21/tcp)|11160|Security Hole|\nThe remote server is incorrectly configured \nwith a NULL password for the user 'Administrator' and has \nFTP enabled. \n \nSolution : Change the Administrator password on this host.\n\nRisk factor : High\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|20005|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through the web client.\n\nDescription :\n\nThe remote host contains a version of the Internet Explorer which is\nvulnerable to a security flaw (COM Object Instantiation Memory Corruption\nVulnerability) which may allow an attacker to execute arbitrary code on the\nremote host by constructing a malicious web page and entice a victim \nto visit this web page.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP SP2 and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-052.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-2127\nBID : 15061\nOther references : IAVA:2005-A-0028, IAVA:2005-t-0032\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|13642|Security Warning|\nSynopsis :\n\nIt is possible to execute commands on the remote host.\n\nDescription :\n\nThe remote host is running a version of Windows which has a flaw in \nits shell. An attacker could persuade a user on the remote host to execute\na rogue program by using a CLSID instead of a file type, thus fooling\nthe user into thinking that he will not execute an application but simply\nopen a document.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows NT, 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms04-024.mspx\n\nRisk factor : \n\nMedium / CVSS Base Score : 6 \n(AV:R/AC:H/Au:NR/C:P/A:P/I:P/B:N)\nCVE : CVE-2004-0420\nBID : 9510\nOther references : IAVA:2004-B-0010\n -results|192.168.106|192.168.106.128|daytime (13/tcp)|10052|Security Note|\nSynopsis :\n\nA daytime service is running on the remote host\n\nDescription :\n\nThe remote host is running a 'daytime' service. This service\nis designed to give the local time of the day of this host\nto whoever connects to this port.\n \nThe date format issued by this service may sometimes help an attacker \nto guess the operating system type of this host, or to set up \ntimed authentication attacks against the remote host.\n\nIn addition to that, the UDP version of daytime is running, an attacker \nmay link it to the echo port of a third party host using spoofing, thus \ncreating a possible denial of service condition between this host and\na third party.\n\nSolution :\n\n- Under Unix systems, comment out the 'daytime' line in /etc/inetd.conf\n and restart the inetd process\n \n- Under Windows systems, set the following registry keys to 0 :\n HKLM\\System\\CurrentControlSet\\Services\\SimpTCP\\Parameters\\EnableTcpDaytime\n HKLM\\System\\CurrentControlSet\\Services\\SimpTCP\\Parameters\\EnableUdpDaytime\n \nThen launch cmd.exe and type :\n\n net stop simptcp\n net start simptcp\n \nTo restart the service.\n\nRisk factor :\n\nNone / CVSS Base Score : 0 \n(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)\nCVE : CVE-1999-0103\n -results|192.168.106|192.168.106.128|daytime (13/udp)|10052|Security Note|\nSynopsis :\n\nA daytime service is running on the remote host\n\nDescription :\n\nThe remote host is running a 'daytime' service. This service\nis designed to give the local time of the day of this host\nto whoever connects to this port.\n \nThe date format issued by this service may sometimes help an attacker \nto guess the operating system type of this host, or to set up \ntimed authentication attacks against the remote host.\n\nIn addition to that, the UDP version of daytime is running, an attacker \nmay link it to the echo port of a third party host using spoofing, thus \ncreating a possible denial of service condition between this host and\na third party.\n\nSolution :\n\n- Under Unix systems, comment out the 'daytime' line in /etc/inetd.conf\n and restart the inetd process\n \n- Under Windows systems, set the following registry keys to 0 :\n HKLM\\System\\CurrentControlSet\\Services\\SimpTCP\\Parameters\\EnableTcpDaytime\n HKLM\\System\\CurrentControlSet\\Services\\SimpTCP\\Parameters\\EnableUdpDaytime\n \nThen launch cmd.exe and type :\n\n net stop simptcp\n net start simptcp\n \nTo restart the service.\n\nRisk factor :\n\nNone / CVSS Base Score : 0 \n(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)\nCVE : CVE-1999-0103\n -results|192.168.106|192.168.106.128|http (80/tcp)|10695|Security Note|\nThe IIS server appears to have the .IDA ISAPI filter mapped.\n\nAt least one remote vulnerability has been discovered for the .IDA\n(indexing service) filter. This is detailed in Microsoft Advisory\nMS01-033, and gives remote SYSTEM level access to the web server. \n\nIt is recommended that even if you have patched this vulnerability that\nyou unmap the .IDA extension, and any other unused ISAPI extensions\nif they are not required for the operation of your site.\n\nSolution: \nTo unmap the .IDA extension:\n 1.Open Internet Services Manager. \n 2.Right-click the Web server choose Properties from the context menu. \n 3.Master Properties \n 4.Select WWW Service -> Edit -> HomeDirectory -> Configuration \nand remove the reference to .ida from the list.\n\nIn addition, you may wish to download and install URLSCAN from the\nMicrosoft Technet web site. URLSCAN, by default, blocks all .ida\nrequests to the IIS server.\n\nRisk factor : Medium\nCVE : CVE-2001-0500\nBID : 2880\n -results|192.168.106|192.168.106.128|http (80/tcp)|11213|Security Note|\nSynopsis :\n\nDebugging functions are enabled on the remote HTTP server.\n\nDescription :\n\nThe remote webserver supports the TRACE and/or TRACK methods. TRACE and TRACK\nare HTTP methods which are used to debug web server connections. \n\nIt has been shown that servers supporting this method are subject to\ncross-site-scripting attacks, dubbed XST for "Cross-Site-Tracing", when\nused in conjunction with various weaknesses in browsers. \n\nAn attacker may use this flaw to trick your legitimate web users to give\nhim their credentials. \n\nSolution :\n\nDisable these methods.\n\nSee also :\n\nhttp://www.kb.cert.org/vuls/id/867593\n\nRisk factor :\n\nLow / CVSS Base Score : 2 \n(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)\n\nPlugin output :\n\n\nSolution : Use the URLScan tool to deny HTTP TRACE requests or to permit only the methods \nneeded to meet site requirements and policy.\nBID : 9506, 9561, 11604\n -results|192.168.106|192.168.106.128|http (80/tcp)|11213|Security Note|\nSynopsis :\n\nDebugging functions are enabled on the remote HTTP server.\n\nDescription :\n\nThe remote webserver supports the TRACE and/or TRACK methods. TRACE and TRACK\nare HTTP methods which are used to debug web server connections. \n\nIt has been shown that servers supporting this method are subject to\ncross-site-scripting attacks, dubbed XST for "Cross-Site-Tracing", when\nused in conjunction with various weaknesses in browsers. \n\nAn attacker may use this flaw to trick your legitimate web users to give\nhim their credentials. \n\nSolution :\n\nDisable these methods.\n\nSee also :\n\nhttp://www.kb.cert.org/vuls/id/867593\n\nRisk factor :\n\nLow / CVSS Base Score : 2 \n(AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N)\n\nPlugin output :\n\n\nSolution : Use the URLScan tool to deny HTTP TRACE requests or to permit only the methods \nneeded to meet site requirements and policy.\nBID : 9506, 9561, 11604\n -results|192.168.106|192.168.106.128|qotd (17/tcp)|10198|Security Note|\nThe quote service (qotd) is running on this host.\n\nA server listens for TCP connections on TCP port 17. Once a connection \nis established a short message is sent out the connection (and any \ndata received is thrown away). The service closes the connection \nafter sending the quote.\n\nAnother quote of the day service is defined as a datagram based\napplication on UDP. A server listens for UDP datagrams on UDP port 17.\nWhen a datagram is received, an answering datagram is sent containing \na quote (the data in the received datagram is ignored).\n\n\nAn easy attack is 'pingpong' which IP spoofs a packet between two machines\nrunning qotd. This will cause them to spew characters at each other,\nslowing the machines down and saturating the network.\n\n\n\nSolution : \n \n- Under Unix systems, comment out the 'qotd' line in /etc/inetd.conf\n and restart the inetd process\n \n- Under Windows systems, set the following registry keys to 0 :\n HKLM\\System\\CurrentControlSet\\Services\\SimpTCP\\Parameters\\EnableTcpQotd\n HKLM\\System\\CurrentControlSet\\Services\\SimpTCP\\Parameters\\EnableUdpQotd\n \nThen launch cmd.exe and type :\n\n net stop simptcp\n net start simptcp\n \nTo restart the service.\n\nRisk factor : Low\nCVE : CVE-1999-0103\n -results|192.168.106|192.168.106.128|qotd (17/udp)|10198|Security Note|\nThe quote service (qotd) is running on this host.\n\nA server listens for TCP connections on TCP port 17. Once a connection \nis established a short message is sent out the connection (and any \ndata received is thrown away). The service closes the connection \nafter sending the quote.\n\nAnother quote of the day service is defined as a datagram based\napplication on UDP. A server listens for UDP datagrams on UDP port 17.\nWhen a datagram is received, an answering datagram is sent containing \na quote (the data in the received datagram is ignored).\n\n\nAn easy attack is 'pingpong' which IP spoofs a packet between two machines\nrunning qotd. This will cause them to spew characters at each other,\nslowing the machines down and saturating the network.\n\n\n\nSolution : \n \n- Under Unix systems, comment out the 'qotd' line in /etc/inetd.conf\n and restart the inetd process\n \n- Under Windows systems, set the following registry keys to 0 :\n HKLM\\System\\CurrentControlSet\\Services\\SimpTCP\\Parameters\\EnableTcpQotd\n HKLM\\System\\CurrentControlSet\\Services\\SimpTCP\\Parameters\\EnableUdpQotd\n \nThen launch cmd.exe and type :\n\n net stop simptcp\n net start simptcp\n \nTo restart the service.\n\nRisk factor : Low\nCVE : CVE-1999-0103\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|15964|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through HyperTerminal.\n\nDescription :\n\nThe remote host contains a version of the HyperTerminal software which\nis vulnerable to a security flaw which may allow an attacker to execute\narbitrary code on the remote host by tricking a victim into using Hyperterminal\nto log into a rogue host.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows NT, 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms04-043.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2004-0568\nBID : 11916\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|16124|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through the web or email\nclient.\n\nDescription :\n\nThe remote host contains a version of the Windows kernel which is vulnerable\nto a security flaw in the way that cursors and icons are handled. An attacker\nmay be able to execute arbitrary code on the remote host by constructing a\nmalicious web page and entice a victim to visit this web page. An attacker may\nsend a malicious email to the victim to exploit this flaw too.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows NT, 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-002.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2004-1305, CVE-2004-1049\nBID : 12233\nOther references : IAVA:2005-A-0001\n -results|192.168.106|192.168.106.128|nntp (119/tcp)|11033|Security Note|This NNTP server allows unauthenticated connections\nFor your information, we counted 3 newsgroups on this NNTP server:\n0 in the alt hierarchy, 0 in rec, 0 in biz, 0 in sci, 0 in soc, 0 in misc, 0 in news, 0 in comp, 0 in talk, 0 in humanities.\nAlthough this server says it allows posting, we were unable to send a message\n(posted in alt.test)\n\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|19407|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host due to a flaw in the \nSpooler service.\n\nDescription :\n\nThe remote host contains a version of the Print Spooler service which\nis vulnerable to a security flaw which may allow an attacker to execute\ncode on the remote host or crash the spooler service.\n\nAn attacker can execute code on the remote host with a NULL session against :\n- Windows 2000\n\nAn attacker can crash the remote service with a NULL session against :\n- Windows 2000\n- Windows XP SP1\n\nAn attacker needs valid credentials to crash the service against :\n- Windows 2003\n- Windows XP SP2\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-043.mspx\n\nRisk factor : \n\n Critical / CVSS Base Score : 10\n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-1984\nBID : 14514\nOther references : IAVA:2005-t-0029\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|12205|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host.\n\nDescription :\n\nThe remote host is missing a critical Microsoft Windows Security Update (835732).\n\nThis update fixes various flaws which may allow an attacker to execute arbitrary code\non the remote host.\n\nA series of worms (Sasser) are known to exploit this vulnerability in the \nwild.\n\nSolution :\n\nMicrosoft has released a set of patches for Windows NT, 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms04-011.mspx\n\nRisk factor : \n\nCritical / CVSS Base Score : 10\n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2003-0907, CVE-2003-0908, CVE-2003-0909, CVE-2003-0910, CVE-2004-0117, CVE-2004-0118, CVE-2004-0119, CVE-2004-0121\nBID : 10111, 10113, 10117, 10119, 10122, 10124, 10125\nOther references : CVE:CVE-2003-0533, CVE:CVE-2003-0663, CVE:CVE-2003-0719, CVE:CVE-2003-0806, CVE:CVE-2003-0906, IAVA:2004-A-0006\n -results|192.168.106|192.168.106.128|smtp (25/tcp)|12065|Security Hole|\n The remote Windows host has a ASN.1 library which is vulnerable to a \nflaw which could allow an attacker to execute arbitrary code on this host.\n\nTo exploit this flaw, an attacker would need to send a specially crafted\nASN.1 encoded packet with improperly advertised lengths.\n\nThis particular check sent a malformed SMTP authorization packet and determined that \nthe remote host is not patched.\n\nSolution : http://www.microsoft.com/technet/security/bulletin/ms04-007.mspx\nRisk factor : High\nCVE : CVE-2003-0818\nBID : 9633, 9635, 9743, 13300\nOther references : IAVA:2004-A-0001\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|15456|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through NetDDE service.\n\nDescription :\n\nThe remote version of Windows is affected by a vulnerability in \nNetwork Dynamic Data Exchange (NetDDE).\n\nTo exploit this flaw, NetDDE would have to be running and an attacker\nwith a specific knowledge of the vulnerability would need to send a malformed\nNetDDE message to the remote host to overrun a given buffer.\n\nA public exploit is available to exploit this vulnerability.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows NT, 2000, XP and 2003:\n\nhttp://www.microsoft.com/technet/security/bulletin/ms04-031.mspx\n\nRisk factor : \n\nCritical / CVSS Base Score : 10 \n(AV:R/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2004-0206\nBID : 11372\nOther references : IAVA:2004-t-0035\n -results|192.168.106|192.168.106.128|ms-wbt-server (3389/tcp)|10940|Security Note|\nSynopsis :\n\nThe Terminal Services are enabled on the remote host.\n\nDescription :\n\nTerminal Services allow a Windows user to remotely obtain\na graphical login (and therefore act as a local user on the\nremote host).\n\nIf an attacker gains a valid login and password, he may\nbe able to use this service to gain further access\non the remote host. An attacker may also use this service\nto mount a dictionnary attack against the remote host to try\nto log in remotely.\n\nNote that RDP (the Remote Desktop Protocol) is vulnerable\nto Man-in-the-middle attacks, making it easy for attackers to\nsteal the credentials of legitimates users by impersonating the\nWindows server.\n\nSolution :\n\nDisable the Terminal Services if you do not use them, and\ndo not allow this service to run across the internet\n\nRisk factor :\n\nNone / CVSS Base Score : 0 \n(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)\nBID : 3099, 7258\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|13641|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through the web client.\n\nDescription :\n\nThe remote host is subject to two vulnerabilities in the HTML Help and showHelp\nmodules, which could allow an attacker to execute arbitrary code on the remote \nhost.\n\nTo exploit this flaw, an attacker would need to set up a rogue website\ncontaining a malicious showHelp URL, and would need to lure a user on the\nremote host to visit it. Once the user visits the web site, a buffer overflow\nwould allow the attacker to execute arbitrary commands with the privileges\nof the victim user.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms04-023.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2004-0201, CVE-2003-1041\nBID : 10705, 9320\nOther references : IAVA:2004-A-0012\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|16329|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through the web client.\n\nDescription :\n\nThe remote host is running a version of Windows which contains a flaw in\nthe DHTML Editing Component ActiveX Control.\n\nAn attacker may exploit this flaw to execute arbitrary code on the remote host.\n\nTo exploit this flaw, an attacker would need to construct a malicious web page\nand lure a victim into visiting it.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-013.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2004-1319\nBID : 11950\nOther references : IAVA:2005-t-0004\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|11887|Security Hole|\nA security vulnerability exists in the Microsoft Local Troubleshooter ActiveX control in \nWindows 2000. The vulnerability exists because the ActiveX control (Tshoot.ocx) contains\na buffer overflow that could allow an attacker to run code of their choice on a user's system. \nTo exploit this vulnerability, the attacker would have to create a specially formed HTML based \ne-mail and send it to the user. \nAlternatively an attacker would have to host a malicious Web site that contained a Web page \ndesigned to exploit this vulnerability.\n\nSolution : see http://www.microsoft.com/technet/security/bulletin/ms03-042.mspx\nRisk factor : High\nCVE : CAN-2003-0661\nOther references : IAVA:2003-A-0029\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|20389|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host by sending a malformed file\nto a victim.\n\nDescription :\n\nThe remote version of Microsoft Windows contains a flaw in the Embedded Web\nFont engine.\nAn attacker may execute arbitrary code on the remote host by constructing a\nmalicious web page and entice a victim to visit this web page or by sending\na malicious font file.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms06-002.mspx\n\nRisk factor :\n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2006-0010\nBID : 16194\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|19403|Security Warning|\nSynopsis :\n\nArbitrary code can be executed on the remote host due to a flaw in the \nTelephony service.\n\nDescription :\n\nThe remote host contains a version of the Telephony service which is\nvulnerable to a security flaw which may allow an attacker to execute\narbitrary code and take control of the remote host.\n\nOn Windows 2000 and Windows 2003 the server must be enabled and only\nauthenticated user can try to exploit this flaw.\n\nOn Windows 2000 Pro and Windows XP this is a local elevation of\nprivilege vulnerability.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-040.mspx\n\nRisk factor : \n\nMedium / CVSS Base Score : 6 \n(AV:R/AC:L/Au:R/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-0058\nBID : 14518\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|13640|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through the web client.\n\nDescription :\n\nThe remote host is running a version of Windows which contains a flaw in\nthe task scheduler which may lead to arbitrary execution of commands \non the remote host.\n\nTo exploit this vulnerability, an attacker would need to lure a user on\nthe remote host to take certain steps to execute a .job file, or to visit\na rogue web site, then he may be able to execute arbitrary commands on the \nremote host.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000 and XP :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms04-022.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2004-0212\nBID : 10708\nOther references : IAVA:2004-A-0013\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|16330|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through the web client.\n\nDescription :\n\nThe remote host is running a version of Windows which contains a flaw in\nthe Hyperlink Object Library.\n\nAn attacker may exploit this flaw to execute arbitrary code on the remote host.\n\nTo exploit this flaw, an attacker would need to construct a malicious hyperlink\nand lure a victim into clicking it.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-015.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-0057\nBID : 12479\nOther references : IAVA:2005-B-0004\n -results|192.168.106|192.168.106.128|chargen (19/udp)|10043|Security Note|\nThe remote host is running a 'chargen' service.\n\nWhen contacted, chargen responds with some random characters (something\nlike all the characters in the alphabet in a row). When contacted via UDP, it \nwill respond with a single UDP packet. When contacted via TCP, it will \ncontinue spewing characters until the client closes the connection. \n\nThe purpose of this service was to mostly to test the TCP/IP protocol\nby itself, to make sure that all the packets were arriving at their\ndestination unaltered. It is unused these days, so it is suggested\nyou disable it, as an attacker may use it to set up an attack against\nthis host, or against a third party host using this host as a relay.\n\nAn easy attack is 'ping-pong' in which an attacker spoofs a packet between \ntwo machines running chargen. This will cause them to spew characters at \neach other, slowing the machines down and saturating the network.\n \nSolution : \n\n- Under Unix systems, comment out the 'chargen' line in /etc/inetd.conf \n and restart the inetd process\n\n- Under Windows systems, set the following registry keys to 0 :\n HKLM\\System\\CurrentControlSet\\Services\\SimpTCP\\Parameters\\EnableTcpChargen\n HKLM\\System\\CurrentControlSet\\Services\\SimpTCP\\Parameters\\EnableUdpChargen\n \n Then launch cmd.exe and type :\n\n net stop simptcp\n net start simptcp\n \nTo restart the service.\n\n \nRisk factor : Low\nCVE : CVE-1999-0103\n -results|192.168.106|192.168.106.128|http (80/tcp)|11424|Security Note|\nSynopsis :\n\nThe remote server is running with WebDAV enabled. \n\nDescription :\n\nWebDAV is an industry standard extension to the HTTP specification.\nIt adds a capability for authorized users to remotely add and manage\nthe content of a web server.\n\nIf you do not use this extension, you should disable it.\n\nSolution :\n\nhttp://support.microsoft.com/default.aspx?kbid=241520\n\nRisk factor :\n\nNone / CVSS Base Score : 0 \n(AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|18585|Security Note|\nIt was possible to enumerate the list of services running on the remote\nhost thru a NULL session, by connecting to \\srvsvc\n\n\nHere is the list of services running on the remote host :\nAlerter [ Alerter ] \nComputer Browser [ Browser ] \nDistributed File System [ Dfs ] \nDHCP Client [ Dhcp ] \nDHCP Server [ DHCPServer ] \nLogical Disk Manager [ dmserver ] \nDNS Server [ DNS ] \nDNS Client [ Dnscache ] \nEvent Log [ Eventlog ] \nCOM+ Event System [ EventSystem ] \nInternet Authentication Service [ IAS ] \nIIS Admin Service [ IISADMIN ] \nServer [ lanmanserver ] \nWorkstation [ lanmanworkstation ] \nLicense Logging Service [ LicenseService ] \nTCP/IP NetBIOS Helper Service [ LmHosts ] \nTCP/IP Print Server [ LPDSVC ] \nFile Server for Macintosh [ MacFile ] \nPrint Server for Macintosh [ MacPrint ] \nMessenger [ Messenger ] \nDistributed Transaction Coordinator [ MSDTC ] \nFTP Publishing Service [ MSFTPSVC ] \nNetwork Connections [ Netman ] \nNetwork News Transport Protocol (NNTP) [ NntpSvc ] \nWindows Media Monitor Service [ nsmonitor ] \nWindows Media Program Service [ nsprogram ] \nWindows Media Station Service [ nsstation ] \nWindows Media Unicast Service [ nsunicast ] \nNT LM Security Support Provider [ NtLmSsp ] \nRemovable Storage [ NtmsSvc ] \nPlug and Play [ PlugPlay ] \nIPSEC Policy Agent [ PolicyAgent ] \nProtected Storage [ ProtectedStorage ] \nRemote Access Connection Manager [ RasMan ] \nRemote Registry Service [ RemoteRegistry ] \nRemote Storage Engine [ Remote_Storage_Engine ] \nRemote Storage File [ Remote_Storage_File_System_Agent ] \nRemote Storage Media [ Remote_Storage_Subsystem ] \nRemote Procedure Call (RPC) [ RpcSs ] \nSecurity Accounts Manager [ SamSs ] \nTask Scheduler [ Schedule ] \nRunAs Service [ seclogon ] \nSystem Event Notification [ SENS ] \nSimple TCP/IP Services [ SimpTcp ] \nSimple Mail Transport Protocol (SMTP) [ SMTPSVC ] \nSNMP Service [ SNMP ] \nPrint Spooler [ Spooler ] \nTelephony [ TapiSrv ] \nTerminal Services [ TermService ] \nTerminal Services Licensing [ TermServLicensing ] \nDistributed Link Tracking Client [ TrkWks ] \nVMware Tools Service [ VMTools ] \nWorld Wide Web Publishing Service [ W3SVC ] \nWindows Management Instrumentation [ WinMgmt ] \nWindows Management Instrumentation Driver Extensions [ Wmi ] \nAutomatic Updates [ wuauserv ] \n\nSolution : Install the Update Rollup Package 1 (URP1) for Windows 2000 SP4\nRisk factor : Low\nBID : 14093, 14177\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|11886|Security Warning|\nThere is a vulnerability in Authenticode that, under certain low memory \nconditions, could allow an ActiveX control to download and install without \npresenting the user with an approval dialog. To exploit this vulnerability, \nan attacker could host a malicious Web Site designed to exploit this \nvulnerability. If an attacker then persuaded a user to visit that site an \nActiveX control could be installed and executed on the user's system. \nAlternatively, an attacker could create a specially formed HTML e-mail and i\nsend it to the user. \n\nExploiting the vulnerability would grant the attacker with the same privileges \nas the user.\n\nSolution : see http://www.microsoft.com/technet/security/bulletin/ms03-041.mspx\nRisk factor : High\nCVE : CAN-2003-0660\nBID : 8830\nOther references : IAVA:2003-B-0006\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|15963|Security Hole|\nSynopsis :\n\nLocal users can elevate their privileges on the remote host.\n\nDescription :\n\nThe remote host is running version of the NT kernel and LSASS which may\nallow a local user to gain elevated privileged.\n\nAn attacker who has the ability to execute arbitrary commands on the remote\nhost may exploit these flaws to gain SYSTEM privileges.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows NT, 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms04-044.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 7 \n(AV:L/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2004-0893, CVE-2004-0894\nBID : 11913, 11914\nOther references : IAVA:2004-t-0040\n -results|192.168.106|192.168.106.128|http (80/tcp)|10661|Security Note|\nIIS 5 has support for the Internet Printing Protocol(IPP), which is \nenabled in a default install. The protocol is implemented in IIS5 as an \nISAPI extension. At least one security problem (a buffer overflow)\nhas been found with that extension in the past, so we recommend\nyou disable it if you do not use this functionality.\n\nSolution: \nTo unmap the .printer extension:\n 1.Open Internet Services Manager. \n 2.Right-click the Web server choose Properties from the context menu. \n 3.Master Properties \n 4.Select WWW Service -> Edit -> HomeDirectory -> Configuration \nand remove the reference to .printer from the list.\n\nReference : http://online.securityfocus.com/archive/1/181109\n\nRisk factor : Low\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|18020|Security Hole|\nSynopsis :\n\nArbitrary code can be executed on the remote host through the web client.\n\nDescription :\n\nThe remote version of Windows contains a flaw in the Windows Shell which\nmay allow an attacker to elevate his privileges and/or execute arbitrary\ncode on the remote host.\n\nTo exploit this flaw, an attacker would need to lure a victim into visiting\na malicious website or into opening a malicious file attachment.\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000, XP and 2003 :\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-016.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 8 \n(AV:R/AC:H/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-0063\nBID : 13132\nOther references : IAVA:2005-A-0009\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|20298|Security Hole|\nSynopsis :\n\nA local user can elevate his privileges on the remote host.\n\nDescription :\n\nThe remote host contains a version of the Windows kernel which is vulnerable\nto a security flaw which may allow a local user to elevate his privileges\nor to crash it (therefore causing a denial of service).\n\nSolution : \n\nMicrosoft has released a set of patches for Windows 2000:\n\nhttp://www.microsoft.com/technet/security/bulletin/ms05-055.mspx\n\nRisk factor : \n\nHigh / CVSS Base Score : 7 \n(AV:L/AC:L/Au:NR/C:C/A:C/I:C/B:N)\nCVE : CVE-2005-2827\nBID : 15826\n -results|192.168.106|192.168.106.128|microsoft-ds (445/tcp)|11808|Security Hole|\nThe remote host is running a version of Windows which has a flaw in \nits RPC interface which may allow an attacker to execute arbitrary code \nand gain SYSTEM privileges. There is at least one Worm which is \ncurrently exploiting this vulnerability. Namely, the MsBlaster worm.\n \n Solution: see http://www.microsoft.com/technet/security/bulletin/MS03-026.mspx \n Risk factor : High\nCVE : CAN-2003-0352\nBID : 8205\nOther references : IAVA:2003-A-0011\n -results|192.168.106|192.168.106.128|ftp (21/tcp)|10934|Security Warning|It may be possible to make the remote FTP server crash\nby sending the command 'STAT *?AAA...AAA.\n\nAn attacker may use this flaw to prevent your site from distributing files\n\n*** Warning : we could not verify this vulnerability.\n*** Nessus solely relied on the banner of this server\n\nSolution : Apply the relevant hotfix from Microsoft\n\nSee:http://www.microsoft.com/technet/security/bulletin/ms02-018.mspx\n\nRisk factor : Medium\nCVE : CVE-2002-0073\nBID : 4482\nOther references : IAVA:2002-A-0002\n -results|192.168.106|192.168.106.128|ftp (21/tcp)|10934|Security Warning|It may be possible to make the remote FTP server crash\nby sending the command 'STAT *?AAA...AAA.\n\nAn attacker may use this flaw to prevent your site from distributing files\n\n*** Warning : we could not verify this vulnerability.\n*** Nessus solely relied on the banner of this server\n\nSolution : Apply the relevant hotfix from Microsoft\n\nSee:http://www.microsoft.com/technet/security/bulletin/ms02-018.mspx\n\nRisk factor : Medium\nCVE : CVE-2002-0073\nBID : 4482\nOther references : IAVA:2002-A-0002\n -results|192.168.106|192.168.106.128|general/tcp|19506|Security Note|Information about this scan : \n\nNessus version : Unknown (NASL_LEVEL=2202)\nPlugin feed version : 200604021515\nType of plugin feed : Registered (7 days delay)\nScanner IP : 192.168.106.1\nPort range : default\nThorough tests : no\nExperimental tests : no\nParanoia level : 1\nReport Verbosity : 1\nSafe checks : yes\nMax hosts : 20\nMax checks : 4\nScan Start Date : 2006/4/2 14:53\nScan duration : 166 sec\n\n -results|192.168.106|192.168.106.128|irc-serv (6666/tcp)|11154|Security Note|An unknown server is running on this port.\nIf you know what it is, please send this banner to the Nessus team:\n0x00: 34 00 00 00 56 34 12 00 00 00 00 00 00 00 00 00 4...V4..........\n0x10: 34 00 00 00 04 00 F0 00 D6 07 04 00 00 00 02 00 4...............\n0x20: 13 00 37 00 14 00 0F 00 00 00 00 00 01 00 00 00 ..7.............\n0x30: 06 00 00 00 02 00 E2 41 C0 A8 6A 01 00 00 00 00 .......A..j.....\n0x40: 00 00 00 00 .... \n\n -timestamps||192.168.106.128|host_end|Sun Apr 2 14:56:20 2006| -timestamps|||scan_end|Sun Apr 2 14:56:20 2006| diff --git a/dev/db/test.rc b/dev/db/test.rc deleted file mode 100644 index 2cb0973b16..0000000000 --- a/dev/db/test.rc +++ /dev/null @@ -1,2 +0,0 @@ -load db_postgres -exit diff --git a/dev/db/test2.rc b/dev/db/test2.rc deleted file mode 100644 index d81f454d9f..0000000000 --- a/dev/db/test2.rc +++ /dev/null @@ -1,7 +0,0 @@ -load db_sqlite3 -db_create -db_import_nessus_nbe /home/hdm/local.nbe -db_hosts -db_vulns -db_destroy -db_hosts diff --git a/dev/db/test3.rc b/dev/db/test3.rc deleted file mode 100644 index 75842feb98..0000000000 --- a/dev/db/test3.rc +++ /dev/null @@ -1,19 +0,0 @@ -load db_sqlite3 -use aux/recon -set RHOST 127.0.0.1 -set ACTION Probe All Ports -run -sleep 1 -db_services -sleep 1 -db_services -sleep 1 -db_services -sleep 1 -db_services -sleep 1 -db_services -sleep 1 -db_services -sleep 1 -db_services diff --git a/dev/documentation/devguide/dev_guide_arch_packages.png b/dev/documentation/devguide/dev_guide_arch_packages.png deleted file mode 100755 index 19fda5ff455792aeacceb308dafc08d79794e3db..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 10347 zcmeHtcT`i~x93ghT`5vTupkHsgf2}G>4X|O0-=b~6#*#%K?D^1iu5Z8NDBrCN*54` z1r-o5gpSA;>7giH`W)Z9S-*Mn*Q{Cd*3A0O+_m;1x$J$;J~z93_TKk_xv4%Ivj8&$ zL2QNwI+hTGxDTkA5ee?t^kf8rKZskF`r1%sx8OYZLVN9!$t4J?N@m$}r32qjx*J%U zKv1|S1mW&M&+&=&k2>qC(R-8`ZK;L*0o%u{t*yzl?yc_fCr?gJeo7YZQAamjj)~=Y z6?DT`K&S#o3If-SH5!5Mjkg$3C!QTQaS(@KfpZ+Nz9MGToV0jO1X8r zt2mnb?#JWIPjhn>f2B$^+40>QkuhK%zOp>l9CQGzimi5(d={HHsheU1VUF^zrRvaA ziu99dMVICkM93Wj=JCXct>yW;p`fj0rxwP#G9)?-gSw-D^~PFgq1YM%e>~DTTA(8= zl@v4=_g&QLY@p)TM?4rovX2cC_AYBab6X4LWm24*EtTTi8nQ4Tg)qQG0vs{#vCF4TnP?N66_>?W3ejhgv?#~NI zpNd`f^WiEzj?Qa+NDNa;ZUb1aSuJ^H>L=gbe43rK4`wPz3OtXn$@-D;M`?* z!ii{#Al0gN*3eg|8SOM2sm?y~5J>_1QxvZR(vxaEZqp>Qq3D#vw7hWQI3}O-2o#YV zdY|}@JB7R;pxJ-vm`F7uy1)DhAE+K(Lm%rTp`w|i#TT(Q^4W2&tM&|f2 zl+^g-<1@7AQ+`YsZY;BVTN5(^y|AiwyA~&IEBhk}1pma(uZBc$UR47hh4`?EOJ)mH z2;;+GGop!gAgpw|(ukIt-^;LuP#OKVyoMo4ui%o0I*!0qB#^-b3ox~A`XeYK*GLB| zG@>*5T)k!6Ew|&+ULN$6g_#MGI5I6i7*x?bXaLa8H z_gF#P00Vr?+qb|Kf!Eef6*WVU(n|+N3c<319CFSi?hp5$U4`(^KAvwmPpS<{DE*5A zWkN|FU;s~#o!kFx7eq07_(%y&;_gbZ+ko(PQ5ARrQmsHahrl_ks)3S#2~gg|`o{1Q zf>OQDrlv~b9>_ithrl0Es(8Ujs=e5AOOF)}>^of#BXI;cJqb+JQvUegfC0b*W1y&i7?KH5Bo5K6o<_Jeg;X>No8 z&kwV$`BM-@Cl_m(4NjQd!2u)N&BSB4A#}=@zZ(K$zCBCN1R|N#xuJ#4S94l6s|52zZC?xd2jt*ao=}8U*%nx-3zwwO*H+?0IUB% zh$b7gd;;3DBSn+>aqUHxKV@;^k7IG|?)2Ez=Y0{ZSmvpd*i{$-t4nMM(ZEO*Mp)ew z`p1a~8%e{;H;wT zh7VabPs?iOzlqo~ot66N%*s?~MsaMZ$FkJ$7Nxzf5BF=~cw0Ou{-FPi#96+v=G$fg z#MCY~OKrzHY(Aq@HY~Hk)$$A^TxOV)AF2sIr2EJymE9{qZA;>9TGW+xEEp<%FW=xl z)?1p$dvcu+nsSkcPDmr%gIN2~;^B8{UH3V=$P(-16f)LBj0-+Lal|>(J5=;R3KeZ) z$x98lI*#qg*J1HOz)1eaXvtDDHfAPt({1-8-Xgfhi!8Ye{9&KP}^*@GQV!7ZaN@#2$cz{0?Nv7J-$_yq)qgmyx!tFKo29k zy2FeS=rw9fLqi2m+R={6YfeM;jBJB>6M_AY_&-n}zoo8#_Aw!zx*&iC1Q@3y-= zJcCS-a$XdA%P?Hmaiu0U;a5I8Gjh#iBKkg`D`L$Q zY2yfB760O|&L+P=G##li*fegKs4;#&*ztP%NUSB3tlQU@XQr#}4dhP9EYUU$D5d^I z{HD8hohhFN=(vo;JmaKEN5V+hyoHuz<>VI40GyWR{|Q(9UkpRf_7nUI9$o9ni!0M_ z`_>wL*qy5u<6D%@48kCDp-}ef`uh4P_S1A{R_npe0#-M2cYU66SrP9f3>Yrn@wS|P zpTN=90g6ZEfbR<8I8)nl=uZ;lW!(e+(AU=o;EXflgQ$mgj0!*wx5~yaE@EP0J^7jq ziFN+HR6;40PaTfzl*wUYvQybnZP-Yt7p&L^Lkdun64OTKfsC9dDY4m;^ zat);Q8FFK(bBNzJ|L?E2SEoDk^t6d%ARjc&cHwc(p1(F)OHT-krFmA!Fid~$&3cuB&>Rki+@e3^Y+)>SSnvm668 z0|8ULa{TYZ;@ zAidryWzRcrUaIO|Y8w$$#=asmrCBui_uC{N8$?KGEz5?GmJrkK z&&ebhV(9Y9ty=9Ov(oaA$#qA)`M9sxe1Vs~U4>I#v+#i1Wp;do_`dpG0NF3g~~ zE7ep(V9YnH1WG!(0b$aaR0B@nyqsHZZ`B{F;9Z-8YCf7$!|QW&v>!;NuVY?pyvq~o zO>*T*8cc~&%*-?BeKHZ|`tCH>NlQ;-|1DgF^-eC9Iymwud&p6-_9+4Gi~GxM$QvUM zf`X@CohpP;^pfXVn`&@D{Zl>le}5D*#WsPi=)qdy{HL00J$SJyR$0smVd2q3v$iU$ zKe70l%bPodIIWaP09Rb1_k*8X{prd_Z#9qaPjEz^v+QqgZ#UE2=WbJ>J_nJ%?4&m( zokRGdx`sx7_7BkW;$jhpsk=X02gA*+TOxNu+^iK`VnGMRLOS~QuZg+2IZCNnVd^>5 zRbM&`lb(d0wbx+@4<)_qdNU_Tb%hTHgl4zbW|c$$xSCQ44W+}d{j|Q7e2CSz=|6&! z`s9DgP{DAL%&c23CUu9M&-JYpDEE#%v}7yOFE4#xriwkOFmHt*^$~7PR>u|i3|8jm z=W}TCt+c815p^PV*5{W-8*=$K-LKy(`}Xw1i%XzybR;X-XZvj|LryIJ^5>_Q$Lbhf zhppkGg6Gg~uFXpR>i5&nPBO)&yvI$C)p%3OBi#8&wBWhWt{@fqO-)A2S%hOZ z)d!}&t$TTiDlG{&-75X)Zi4VM|H=tr%-x?}onNlbH2%{%BQESGE6yu5t|f2Kitc;* znZ-3V5P8x{%UCcf!6$uPfs$|7cwnW&oyGDOZ+2#K0+f0J_Um&0ayc#;)1L3mF&R>_ zv;Q;tuvBy3t0qa@EN0VBsQ;%8gp#@u!hNTy2`eFV)b4MqawQRxmB~oR1D4)mtOTjg zUvGU-9!u@1VUd(JNV`jbC~+T;J_hNZ+naYc=@fzAx!_t9I=n|KMd&F zqY%!+LHWl^J#Db-vuRNaqk176qE0cOt17l?Ffut-0c|#v~>xfX=1J*XdCdM>MQ_} zTg+eJ2#+6cd)diO`(%=lsH^vRWWZQqjTU8{Aq1!)B#>m~=vp7>$4!s+3zF%R#7c;G zL zBX0&_tmhFJ>o6ZN26P>dr{tiXE2&R!OS=ULdUZ3Uu5IZr?Dbek>8EU7n}g$U{m0`B zcl>|#|NqnfpD~`VZ{Dth$-+-#;SQB#lgJoDu9Di`$~)98lo~{_8JpR%Slfdb)acWU z4p%#6oNCm>Ks=vYTwH|2Z{@7h;ni+0KYjXiiqZb0jYiq{6;~-ClwZF|rNI;A_g9!J zO+oVz!!CW=$v_gkrToNC`!)mq{hJ*;pMq}T@SUe}r0r1wvzbL+RE9-FJ(I?CnWTK* z)AJ6E5MJ=@-H%B8$j2*XwL>&$$6Ok8o!GkiHt^NlKmMxO$pL$2G&@|w5wdF!4Ov0G z%nEy2hvs!d|IUG+R515Y__1X~c|a&^w)I4qDp)0$9{3YIx<*3X3<%eE1A2$^vWc6W zXGQf7@c*0dca{B8&qd%zRB7-d%rtm=p1e|d;N{o;csfa;{M}j*J?y>kKWr+~0_KFa ztveY9IydSP4#M&E9pZ=MhX-5zRP`Q`&z|ni%=+(7ng_ByH*ESlbCd&8`|51aHBMA6 zwX*fnyUk_Zt776@XQ}1euF-M%Y9F_4(TzMIyqY@;4y2%qJ+~`NxJg#KcM(AS%5-5= zr097`ywO^PwF9ZoX#2rFQk0}{lR3_x9o8PLX}&wsE80HO~ImL@etmWNQ1@^D1-%x z<6wf2$V&@DnAi69m8VHork(ckfKg%LUQVMtNulQNlBPereOD4;29$14o5i0!9(ncp zF=DBGs{a|vOwm!mD*@5J_r5-1d|&mh{@AUM5T(62vP^=vsf^MB$Eu8-!}R+zcl&lr z(#j-;xCc_=Z@5lJEWQ-s^&H~*dJOHf`+FzreeKvJ*=FU|q;gv5+hWe?mHxLWiFtAX z_=Y;LWRZ%--rPr-gz(oJomF)UC$ZHX3EpPBWd`xZ6P`+u9*U#-MGX<*<7pVx;(H1G z<9`-CH(iqFBp0DRLhZ~m{xa__1narD?6l_f794zUjn*u#u#w%dnhmxT9!@%SDL!Ch z#71N1iCeE>r|+;Onkr4c##i*x2`i8xYbC)A>(weMriv;h7C)d{Ahw`xqC?ayf7!$( zh)EfGs|Bf;n0IQXn+o$A5(}J%_>=fmE>xhV(U)tyyWXCH^$r|zi{$jyE+XOZb+QNA z)_nD|=;dq+uTr;xV*B(vRlmu;f-!C$Pg=TYD8P2(2QOzQA*YgfWqPmFwtLig^SO@~ z8i8*2Hd$f@Ov@9i-aco_wTN&_LBU_nRs|0zI}3zhU(#ak?^}%I~b!{z75ccVy_P ztXbNn%@pZtCoZ37ZB!7#0{UU!bk-{$Dddu@6l8{&mv31gf!gdKA3Dl zsXVt|>(g$dRsZv4$>X=3QM>ZK{*o2zCD}72)^6j6^oq?;{MF>^C%h$<9Tm)n8r%)vDL;-z5L@c zv>48TbhL7*iL0Y+_97Ek=5WX($JVG`4MJC=&v!zW2L&G+U$21Z<<*l5SBO(ecs!Hi z#M=BO^h~UHMREkmgSP^o;1|xyIP?40asNZ+PPrlFj=4=^C3x{>0omE>ckNvhofDhd zg{2AR@qU=J_51oAUalbv9_xblh^awCBi_G5JAbK&vK)`Paj9Q=Zi=ydR{RC8=hgP-6 zKMovm?w!GfX?%GZ%qSjpedkxOBPy6WId@vXDH-4B_h2zwuC-SnOo6{w$7rR!qc&%_ zwx`)`W|CpEc0I7T+|I*K%n!*>ES>z^IxGPh1g3D z%>1eMN+(W-8x4YtV)8_jJc`86u`fO6Kq2s^rIqErq^VSK=OZBYuXtW-pLFcLg@vM&UAKW$=H^!sncj`XaxU8De7c>Rex`9CIdzpd%q?w%gyv! zC0$QOp2Hza!0e)g=d3XEGm;0W8$Fl|amaJ#4&W6I2aDALh#3tEIFroBwExEXJKEGp V*f!2CT^s_Jp{}V;r8f5Ne*s4Ly0-uT diff --git a/dev/documentation/devguide/dev_guide_payload_hierarchy.png b/dev/documentation/devguide/dev_guide_payload_hierarchy.png deleted file mode 100755 index 524098f6640b5b203a48a95161590b0789346519..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 5420 zcmbVQXHXMhla7KQJro0>hTcUfp_gC)=@6tTQbMm%qzEE}qLI*%4$`C-h0v=d^d>!Y z42tw7P3m#qeKU98+|AtF{n~fmnSFO=XZP9XdEXl7X;6_flLG(%D$R#*#I^MU0B-o+ zzIlDB;d^UwZEpA=G*kgqL#%7p4zVLl7X|=S$5EWy+`9H5whs}y06-ug01z4h0GwW5 zg{}eszV`rtb!z}XE)4)+^vr5DQ~&@N$~57yM*)^w*~+VIouKaE$g8l(5?n6rD7qR5 zXQvC>We_@xsOB@?_-`e`B|+3!ie&?@nWmIl)JVQ&v_* zKB^YjY#A>?IE~WD<`VQv<(I_zN?#tF=|{__Wzt(GWVme~TJ(-J&MNqDB9emffRUu* zd>>=!G8;*Jwit5N_RMp+i)zN@jsFY59P`iI4pC0?EPG=fppM73_ujnDV~goVQzSvX zO`87xc*C(S%7%hWmv#6>Ob7nX_J3%jz#{)Qfft3B;i7SPT|Vv}W#%r=K43hCwke}D z-nl_ckX{HNBCNM9g$*DUay{opCo{@9&mfaZ?sW+(r>+{c+!AygeJhi|{snOW&Dx|K za%8-##LaDH3dWn!r|O93Hm8(vpb+rx`NHw)xDAG;ikG+9DnU;+HRfGmZ3~Bi~h^9WX^T`KU{BM;_rDT*0u!Y`} z=DPt%c@Iaw7<`;PG(}o36>);EwvAK1JlPAMWe-?F6`E+h{3NMUlP3~8yj|1FZq90+ zrAx;VF2JB~{LUN@KznxY%1r@@)S>qt`e~e)XqPMUh7;4T=+7zh*F&`{GjXK9vi(eCg}sJ1ONWjJZMD$nr2@w1t`55=OT68ErE+vtYPgo>mZkZRQv48L%NR8dCBq4f{Hn~B zVkGFfB`J@-V{SoqZ&3mG8*KcTn4lHO@n)(o(w`Y(pk5^ zfDB2L)!xP>1O5!|z;UO653bmo788QDo4SWzEdD|GpO$aeuC@4{68qHgGhUtl87}XX z^WV;D&q=c~zXhs8Pb7y4%u4(?%fTGT18Hn2ahMNNX-Od3f)(3!L`k6YMn9vo-9s+t zjq=?49t&z2q`}pyB}KqTPR|^&U&nAwswG3y@~!Q}Aj&5x`l-X8KbbePO=xG?*hK_<;cBX zmm)M_Z_9*bfT-4(I7geDB{37)5zXRhDKx5+>(mW*OFmox)n>I`dv2%sS}^Q zV>S?%ZdB{kJFDOy6EX6USMC0JgQ~|J;&A@6w6ru~=qELoFGEy9q)x^Y*`g0<@i42D z<#>B_8!8jkOqU9;DX&ASTmcx@T-p$o*z6$EJEk*D=(IW>mJ+qJm7fJ7chfngGkxT^ zBA)$;p?V^a8bNh1m16psb@ZZ$7OQIh+!>T4(&shGABnvAoX=B3@5TtUwKse)-=4#_ zASv1pnA_)+$)r}y!kX~Ft=>>TQZI?!fw$;z{B<^$I)w?7qFAn0-O5877s@=B>2%C+uf!<`g_JVfJ0)>RlLg zf)A+A3!PR1>Z?QRV37A(ZZ*Ne=#CQt<_&w`YR;QR#Us4!PW##R&vdYhfv@)E#>b9V zmw$gBE;oFeJwQ!sa0J(e;7&L1Dw*}^Jun855=5-P!~`3y%B*cJ3^zvmHXJlu{Afa) zTsrqUB6k)p_W%-WtPns#fKy7ffEe`xwWJ~Bo;j=@7LVE}*n|hxWRfNqetVs7mBYdH6IV$MU z0@|hICi4ZJ!-YJdwN3|vheyT=r#kg0JVP>+-;bYg-JQ+Wne;8QB!t+X^YyrGXlQ`J zzQ+TkKZ}Zjz>5aX>Xu2`xQ7ewYMWKgxaCCuC$ufD%w8t@9`s26Ev|O&Ur|HO=DY-5 z3qI+iVC2slI=nTP}ga?-`wM|@QL0r zz%_F~*Is=!iRO5@`$g9L-gwcG@^^l{tj55@bwrzU_i&gnACN}h72>CVtWLXu!mrs@ z7fR-)atkSQ?~G2W^!;fqcF)WyWoK54o`Y+YtHcFy=*W`s_b{c$wWHQlcT?8XbOtSx zEYsHWoN-;_k{l#W(Q&fCt6QRN`Jov-S{TwBJPeX{F_Oe(tR;`V4vVrM4SkbT^5cZ| z@;0f)b`sZk4rM^@YOID13PcIEs)^RL7iw{BIo#(Sxt*|bAAIM~?D-?GFFc zQ+U6S88|EV>6Cj|eG;D+9(EAJEEMneQ>*a|y~aMKqWevKaBO{164}S`w?}FJp&K*P zTN8u;F~%q#Trf=hPA{;pICgdZ(P@zpMz=(>TUX5O6TdFEI;CcTG5hrGXM**X#IOnouYFbGnukQRDHHd{Ldz}^Md&CFR|z5iM%=((a3qRlKzdp zrul5UB{idKMqe?OL-}&8IEVdxwDALT)|`3!q&6sq$O|$=#{@;I-lw;CfmN{>aw)Qh zyeF$_HHX}Flo}HU4ilR$hyYWu8O~s|W0>$W5W3%du$B@h@g-TB0{5%J;V}szeW@?= z7Qx#@LX<`I<-zL6RmjE8Qa!gu>_AqQCAKjg>_3yzSNQf7vk-%qwvxQRp+LTYT@tPv zLLNyog>!}c&+OtqXHcH9nw_JH zsz{`a|Mnb0xbT{cATD}N6JAerVi<49orV6bC{L!UN14?{jJ+Pnqx7~KstsoEEkU*C?xKJqw?p*22i z$#DhnKA2C{Z9!xEB$`88UjE&0|D4?I&gf;LtZ5%epV}M4b+^?GkF)p2pqqdxls-qX z5e}*}%pT`!?V?)%&AOjrJI{Kb7~F7AuSos}~b`-kFr3k_AMo z{>Y)`6kHvYsljLNR$eoyH)Oawks%I^8fJG@7@~feZSOLmiM+;<$EgPn>C{-h(nAte{`x*CUtfMUB+BQ$@mHY%r zxQHSK=tlh_-#It-Z=K-PftlXv3g!IdFo$^JaxOj|7Yp>^J!>-O^w#KR43G(E?_6__ zPlHHM8%RIBc9MY7%;l6x;!>{{eM;;HC;de(iH8)!aZfK`E$S?Cu)tD1E+M$qi2epN zU#@2=Ert5W00|W<+x_3^A|?vVxhHUb9TqZYu3Jfrc7(1s5!MWt2S;>Rq(c5T>RvTf z&OTeTk+E1N=j&7#kr67%8aKoldXL6n3usu7n~_dPk?Wc%3|)$6OH|xaw(Tb3w!hp* zgOy*n5OpQ^X2ZWHJk^eVU7OFDl3&68Jw-2bm+pfIay^H`>K@68P9=J1*R$$k@2iW8 zJrq1irQkZQa|i1r6%pJF=a+-P&Z6d-8+^@HpYt0#@YxK>^k#B5EY#K23?YzCtLxtqvcqj+sv*PI>wZrZs_0;~!P>-YI13f_%A^_9Q|ox>4a$~^Yl0F+9vkR+JhBAPvIV)X zHQ9VhqD1Z6gLQ?gULuB{cP-RKL#ajfhQ#|A$)9Kl@7zoD4NKY3#Bx>tjxfZ3tH1Qu zpgz*p`eAJ`D6{3CVyKC$2VzJ2CCcq0C}vjAE4H0k#)%g1l*r;J=$vuJ5WgI>N~;{f z)GFB6N>f=us!lO>wY2#C=qBhg@CsFUTDKIcn$@YZ_ity)l%dEH=-fStI)MnWFS;fI|@vg69XP&@93f$t)de z#>_wv&SUU3O_V}B9bG(3{3JI@0@SWBq!WZ96pcM#6MZhBFGwr7Q@Xl)llbM4X@TEa zJ8Bnk*K#&{kq0&gd-1F9PBNwv9S@Dc^Jtt+pHAmIvGclv+L-!S4&Ri+3PvXPX#Fl@ zDwp(-#`toI%zvi6oqYwb40F|s|A(eHNrUc}ot&S9gcb}!Q`b=VMya&=c%OvoC0n1``ZLImoyq0urfeK&H?Z(0&Cv-u{N#t(@+ilC%B=0J^cg9 zt?|Y`+tI~l%P^{mByho9XBnk@Fw7Yd#WZm%=#>(Zy2xUb>?3KFt%869uPr_2Qr>3E zz-a+9!y^IkdB6jDZ2qi*Et_Em-S1`S7%-EZ*!xxsuwdd|qDLTOFo`>#ppiHeKhB#% z_vv~1DRH*Q+5{3!=1kx!dYe=hB*3=hD)`I*VVqoh%-525YDi);%)K|*)oQ+w{!ZP> zq|#zO{BqZxtMC)lq!P+Y&nzU;7<)w8E$hU#DqyJ7gZzsu;ge7UJt2pL6#SG*xN~dU z^{atEXs1FRPr>`rRHt#LMIP*@hSJWw$DDNb-hwmW@sflbuNdY6+nYknkP+G(*xEp? z$McBX^AJ*rjmiNLTK*|y7PAu-4Q}5lo11ntg3SUBQJ?Qz&z{N06F--NSG)#yO3){r zHh4gm?bjT-o_`(5*UGF_QJlqS#o9Eo-s{)4aGgCuH#*?5ZMqA?B|4>?w;L*)A}>g_c3J z-=rSIZ-7l2KAV60a+!P9Gyb@{HKEaAK@}>TRB!MgDbIsV&-8@EKh-M{crWLuRLN_$~z_`U1aj#EL$SI=MJr z{C%}nZA=&NE7?>|0-O^ll0IW7kn%xxRrvpmKF@H0FV&Zo3!FNF0`b$+SjRUzj2#z8 zvw<_;_VDYsSEmHT+71wNiT)yth8VUV1iAl5hHEu*nbP6Wdn~2l5fT|RWt7emGG`b* tzoGmwP&#) to -the constructor. By default, the shell's input and output class -instances are initialized to instances of the -\texttt{Rex::Ui::Text::Input::Stdio} and -\texttt{Rex::Ui::Text::Output::Stdio}, respectively. To change the -input and output class instances, a call can be made to the -\texttt{init\_ui} method. - -\par -To use the shell, a call must be made to the shell instance's -\texttt{run} method. This method accepts either a block context, -which will be passed line-based input strings, or will operate in a -callback mode where a call is made to the \texttt{run\_single} -method on the shell instance. If the second method is used, the -class is intended to be overridden with a custom implementation of -the \texttt{run\_single} method. - - \subsubsection{Dispatcher Shell} - -\par -The \texttt{Rex::Ui::Text::DispatcherShell} class extends the -\texttt{Rex::Ui::Text::Shell} class by introducing the concept of a -generalized command dispatcher interface. The dispatcher shell -works by overriding the \texttt{run\_single} method. Unlike the -base shell class, the dispatcher shell provides a mechanism by which -command dispatchers can be registered for processing input text in a -normalized fashion. All command dispatchers should include the -\texttt{Rex::Ui::Text::DispatcherShell::CommandDispatcher} mixin -which provides a set of helper methods, mainly dealing without -wrappering the output of text. - -\par -The registration of a command dispatcher is accomplished by calling -either \texttt{enstack\_dispatcher} or \texttt{append\_dispatcher}. -The \texttt{enstack\_dispatcher} front inserts the supplied command -dispatcher instance so that it will have the first opportunity to -process commands. The \texttt{append\_dispatcher} method inserts -the supplied command dispatcher instance at the end of the list. To -remove command dispatchers, the complementary methods -\texttt{destack\_dispatcher} and \texttt{remove\_dispatcher} can be -used. - -\par -When a line of input arrives, the base shell class calls the -overridden \texttt{run\_single} method which breaks the input string -down into an array of arguments as delimited by normal shell -characters. The first argument in the string is then evaluated in -relation to all of the registered command dispatchers by checking to -see if any of them implement a method called \texttt{cmd\_}. -If they do, the dispatcher shell calls the method and passes it the -parsed argument array. - -\par -In order to make it possible to automatically generate a help menu -for all registered command dispatchers, each command dispatcher -should implement a method named \texttt{commands} which should -return a hash that associates commands with a description of the -operation they perform. - - \subsubsection{Table} - -\par -The \texttt{Rex::Ui::Text::Table} class can be used to format data -in the form of a table with a header, columns, and rows. For more -information on using the table class, please refer to the -auto-generated API documentation on the Metasploit website. - - \subsubsection{Subscribers} - -\par -The Rex library supports creating classes that are designed to -subscribe to input and output interfaces via the -\texttt{Rex::Ui::Subscriber} interface. This mixin provides a -method called \texttt{init\_ui} which can be passed an input and -output class instance. These instances should implement the -\texttt{Rex::Ui::Text::Input} and \texttt{Rex::Ui::Output} -interfaces, respectively. Once \texttt{init\_ui} has been called, -subsequent calls to methods like \texttt{print\_line} will be passed -down into the initialized output class instance. If no class -instance has been defined, the call will be ignored. This makes it -possible to provide a way by which classes can interact with the -user interface only when desired. To disable user interface -interaction, a call can be made to \texttt{reset\_ui} which will -disable future input and output classes for the class. - -\chapter{Framework Core} - -\par -The framework core implements the set of classes that provide an -interface to framework modules and plugins. The core portion of the -framework is designed by used in an instance-based approach. This -means that the entire framework state can be contained within one -class instance thereby allowing programmers to have multiple -concurrent and separate framework instances in use at the same time -rather than forcing everything to share one singleton instance. - -\par -The current major version of the framework core can be accessed -through \texttt{Msf::Framework::Major} and the minor version can be -accessed through \texttt{Msf::Framework::Minor}. A combined version -of these two version numbers can be accessed through -\texttt{Msf::Framework::Version} or \texttt{framework.version} on an -instance level. The current revision of the framework core -interface can be accessed through -\\\texttt{Msf::Framework::Revision}. - -\par -The framework core is accessed through an instance of the -\texttt{Msf::Framework} class. Creating an instance of the -framework is illustrated in figure \ref{fig-code-framework-create}. - -\begin{figure}[h] -\begin{verbatim} - -framework = Msf::Framework.new -\end{verbatim} -\caption{Creating an instance of the framework} -\label{fig-code-framework-create} -\end{figure} - -\par -The framework instance itself is nothing more than a way of -connecting the different critical subsystems of the framework core, -such as module management, session management, event dispatching, -and so on. The manner of using these subsystems will be described -in the following subsections. To use the framework core library, a -ruby script should require \texttt{msf/core}. - - \section{DataStore} - -\par -Each framework instance has an instance of the -\texttt{Msf::DataStore} class that can be accessed via -\texttt{framework.datastore}. The purpose of the datastore in the -3.0 version of the framework is to act as a replacement for the -concept of the environment in the 2.x branch. The datastore is -simply a hash of values that may be used either by modules or by the -framework itself to reference programmer or user controlled values. -Interacting with the datastore is illustrated in figure -\ref{fig-code-framework-datastore}. - -\begin{figure}[h] -\begin{verbatim} - -framework.datastore['foo'] = 'bar' - -if (framework.datastore['foo'] == 'bar') - puts "'foo' is 'bar'" -end -\end{verbatim} -\caption{Creating an instance of the framework} -\label{fig-code-framework-datastore} -\end{figure} - -\par -Modules will inherit values from the framework's global datastore if -they are not found in the module's localized datastore. This aspect -will be discussed in more detail in chapter \ref{framework-modules}. - - \section{Event Notifications} - -\par -One of the major goals with the 3.0 version of the framework was to -provide developers with a useful event notification system that -would allow them to perform arbitrary actions when certain framework -events occurred. To support this, each framework instance can have -event handlers registered through the \texttt{framework.events} -attribute which is an instance of the \texttt{Msf::EventDispatcher} -class. - -\par -The \texttt{EventDispatcher} class supports registering event -handlers for a few basic different categories. These categories -will be discussed individually. One of the nice aspects of the -event-driven framework is that modules can automatically indicate -their interest in being registered for event handler notifications -by simply implementing the event subscriber mixins described below. -When a module is loaded into the framework, it will automatically -detect that it includes one or more of the subscriber interfaces and -automatically register the module with the appropriate event -notifiers. This makes it possible for modules to take certain -actions when specific events occur. - - \subsection{Exploit events} - -\par -Event subscribers can be registered to be notified when events -regarding exploitation occur. To register an exploit event -subscriber, a call should be made to -\texttt{framework.events.register\_exploit\_subscriber}. This -method should be passed an instance of an object that includes the -\texttt{Msf::ExploitEvent} mixin. The type of event that this -subscriber will be notified of is when an exploit succeeds. In the -event that an exploit succeeds, the subscriber's -\texttt{on\_exploit\_success} method will be called with the exploit -instance that succeeded and the session instance that it created. - -\par -To remove an event subscriber, a call should be made to\\ -\texttt{framework.events.remove\_exploit\_subscriber} passing the -object instance that was used to add the subscriber in the first -place. - - \subsection{General framework events} - -\par -To receive event notifications about internal framework events, a -general event subscriber can be registered through the -\texttt{framework.events.register\_general\_subscriber} method. -This method takes an instance of an object that includes the -\texttt{Msf::GeneralEventSubscriber} mixin. When a module is loaded -into the framework instance, the \texttt{on\_module\_load\_proc} -will be called if it is non-nil and will be passed the reference -name and class associated with the newly loaded module. When a -module instance is created, the \texttt{on\_module\_created\_proc} -will be called if it's non-nil and will be passed the newly created -module instance. - -\par -To remove an event subscriber, a call should be made to\\ -\texttt{framework.events.remove\_general\_subscriber} passing the -object instance that was used to add the subscriber in the first -place. - - \subsection{Database events} - -\par -One of the new additions to the framework is support for tracking hosts, -services, and other sorts of information. This is accomplished by using the -database tracking plugin and can be augmented through additional module and -plugin support. To receive notifications about database events, such as when -a new hsot or service is detected, a database event subscriber can be -registered through the \texttt{framework.events.add\_db\_subscriber} method. -This method takes an instance of an object that implements the -\texttt{Msf::DatabaseEvent} mixins. When a new host is detected a call will -be made to the \texttt{on\_db\_host} method on all of the registered database -event subscribers. When a new service is detected, a call will be made to the -\texttt{on\_db\_service} method on all of the registered database event -subscribers. - -\par -To remove an event subscriber, a call should be made to\\ -\texttt{framework.events.remove\_db\_subscriber} passing the -object instance that was used to add the subscriber in the first -place. - - \subsection{Session events} - -\par -To receive notifications about events pertaining to sessions, a -session event subscriber can be registered through the -\texttt{framework.events.add\_session\_subscriber} method. This -method takes an instance of an object that implements the -\texttt{Msf::SessionEvent} mixin. When a new session is opened, the -framework will call into the subscriber's \texttt{on\_session\_open} -method with the session instance that has just been opened as the -first argument. When a session terminates, the framework will call -into the subscriber's \texttt{on\_session\_close} method with the -session instance that is being closed. - -\par -To remove an event subscriber, a call should be made to\\ -\texttt{framework.events.remove\_session\_subscriber} passing the -object instance that was used to add the subscriber in the first -place. - - \section{Framework Managers} - -\par -The framework core itself is composed of a few different managers -that are responsible for some of the basic aspects of the framework, -such as module and plugin management. - - \subsection{Module management} - -\par -The module management aspect of the framework is one of its most -integral parts. The \texttt{Msf::ModuleManager} class is -responsible for providing the interface for loading modules and for -acting as a factory for module instance creation. The module -manager itself can be accessed through the -\texttt{framework.modules} attribute. The loading of modules is -accomplished by adding a search path to the module manager by making -a call to the \texttt{add\_module\_path} method. This method will -automatically load all of the modules found within the supplied -directory\footnote{The module path must conform to the standard -module directory layout, with the base directory structure appearing -similar to the \texttt{modules} sub-directory in the framework -distribution}. - -\par -Modules are symbolically identified by what is referred to as a -\textit{reference name}. The reference name takes a form that is -similar to a directory path and is partially controlled by the -filesystem path that the module is loaded from. An example of a -reference name would be an exploit labeled -\texttt{windows/ftp/wsftpd}. This would mean that the exploit was -loaded from \texttt{exploits/windows/ftp/wsftpd.rb}. It is -important to note that module's must retain a namespace hierarchy -that mirrors the path in which they are located. For instance, the -example described previously would have the class declared as -\texttt{Msf::Exploits::Windows::Ftp::Wsftpd}. This is necessary so -that the framework's module manager knows what namespace to look in -to see what class was added after loading the file. The reference -name of a module can be accessed through the \texttt{refname} -attribute on both the class of the module and its instances. - -\par -In order to help solve the potential for module name ambiguities -across module types, modules can also be referenced to by what is -called a \textit{full reference name}. This name is the same as the -reference name of the module but is prefixed with the module's type. -For instance, the exploit \texttt{windows/ftp/wsftpd} would become -\texttt{exploit/windows/ftp/wsftpd}. The full reference named can -be accessed through the \texttt{fullname} attribute on both the -class of the module and its instances. - -\par -In order to make the module manager easy to use, each different -module type is broken down into a more basic class called a module -set which is implemented by the \texttt{Msf::ModuleSet} class. The -purpose of a module set is to act as a localized factory for each -different module type (exploit, encoder, nop, etc). Each -type-specific module set can be accessed through either -\texttt{framework.type} or \texttt{framework.modules.type}. For -example, if one wanted to enumerate exploit modules, they would use -the \texttt{framework.exploits} method to get access to the exploit -module set. - -\par -Module sets are implemented in the form of a hash that associates -the reference names of modules with their underlying classes. To -create an instance of a module, a call is made to the module set's -\texttt{create} method passing the reference name of the module that -should be instantiated. For example, to create an instance of an -exploit named \texttt{windows/ftp/wsftpd}, a call would be made as -shown in figure \ref{fig-code-framework-modcreate} - -\begin{figure}[h] -\begin{verbatim} -framework.exploits.create('windows/ftp/wsftpd') -\end{verbatim} -\caption{Creating an instance of a framework module} -\label{fig-code-framework-modcreate} -\end{figure} - -\par -The table shown in figure \ref{fig-table-modulsets} shows the -relation between module types and framework module set accessors. - -\begin{figure}[h] -\begin{center} -\begin{tabular}{|l|l|} -\hline -\textbf{Module Type} & \textbf{Accessor} \\ -\hline -MODULE\_ENCODER & framework.encoders \\ -MODULE\_EXPLOIT & framework.exploits \\ -MODULE\_NOP & framework.nops \\ -MODULE\_AUXILIARY & framework.auxiliary \\ -MODULE\_PAYLOAD & framework.payloads \\ -\hline -\end{tabular} -\caption{Module types and their framework accessors} -\label{fig-table-modulsets} -\end{center} -\end{figure} - -\par -To reload the contents of a module, a call can be issued to -\texttt{reload\_module} passing the module instance that should be -reloaded. This will lead to the framework re-reading the contents -of the module's underlying file path and automatically creating a -new instance of the module. - - \subsection{Plugin management} - -\par -One of the new features in the 3.0 version of the framework is the -concept of framework plugins. Unlike modules, framework plugins are -meant to add features to the framework or to change the behavior of -existing aspects of the framework. Plugins have a very loose -definition in terms of the scope in which they can operate. For -instance, a plugin could add an entirely new module type for use by -the framework. Alternatively, a plugin could add commands to the -existing user interfaces that interact with the framework. A plugin -could also register custom event subscribers for doing things like -automatically causing Meterpreter to list the contents of a -computer's C drive when a new Meterpreter session is created. The -possibilities, as they say, are endless. - -\par -The plugin manager can be accessed through the -\texttt{framework.plugins} accessor which is an instance of the -\texttt{Msf::PluginManager} class. To load a plugin, a call can be -made to \texttt{framework.plugins.load} with the path of the plugin -that is to be loaded. Optionally, a second parameter can be passed -to the \texttt{load} method that is a hash of option parameters that -may be useful to the plugin, such as \texttt{LocalInput} and -\texttt{LocalOutput} handles for use with printing strings to the -screen for whatever medium is currently being used. The table shown -in figure \ref{fig-table-plugin-hash} shows the pre-defined hash -elements that can be passed in the option hash. - -\begin{figure}[h] -\begin{center} -\begin{tabular}{|l|p{3.5in}|} -\hline -\textbf{Hash Element} & \textbf{Description} \\ -\hline -LocalInput & The local input class instance which implements the \texttt{Rex::Ui::Text::Input} interface. \\ -\hline -LocalOutput & The local input class instance which implements the \texttt{Rex::Ui::Output} interface. \\ -\hline -ConsoleDriver & The console driver instance of \texttt{Msf::Ui::Console::Driver}. \\ -\hline -WebDriver & The console driver instance of \texttt{Msf::Ui::Web::Driver}. \\ -\hline -\end{tabular} -\caption{Plugin optional constructor hash elements} -\label{fig-table-plugin-hash} -\end{center} -\end{figure} - -\par -All plugins are reference counted. This is to make it possible to -implement singleton plugins that could possibly be loaded more than -once but will only have one underlying instance. The reference -count to an instance of a plugin is automatically incremented each -time \texttt{load} is called on it. - -\par -To unload a framework plugin, a call can be made to -\texttt{framework.plugins.unload} passing the instance of the plugin -previously loaded as the first parameter. Since all plugins are -reference counted, a plugin will not actually be unloaded until its -reference count drops to zero. - -\par -For more detail on the implementation of framework plugins, please -see chapter \ref{framework-plugins}. - - \subsection{Session management} - -\par -The session manager is used to track sessions created from within a -framework instance as the result of an exploit succeeding. The -purpose of sessions is to expose features to a programmer that allow -it to be interacted with. For instance, a command shell session -allows programmers to send commands and read responses to those -commands through a well-defined API. For more information on -sessions and how they can be interacted with, please see chapter -\ref{framework-sessions}. The session manager itself can be -accessed through the \texttt{framework.sessions} accessor and is an -instance of the \texttt{Msf::SessionManager} class. - -\par -The primary purpose of the session manager is to provide an -interface for registering new sessions and assigning them a unique -session identifier as well as allowing sessions to be deregistered -when they are destroyed. The registering of sessions with the -framework session manager is accomplished by making a call into the -\texttt{framework.sessions.register} method which takes an instance -of a session as its argument. This method will assign the session a -unique session identifier and add it to the managed hash of -sessions. Sessions can be enumerated by making a call into -\texttt{framework.sessions.each\_sorted} or by calling any of the -hash-compatible enumeration methods. To obtain the session instance -associated with a particular session identifier, the -\texttt{framework.sessions.get} method can be called with the -session identifier to look up. When a session is being destroyed, a -call must be made to \texttt{framework.sessions.deregister} passing -the instance of the session being destroyed as the first argument. - - \subsection{Job management} - -\par -Each framework instance supports running various tasks in the -context of worker threads through the concept of jobs. The job -interface can be accessed through the \texttt{framework.jobs} -accessor which is an instance of the \texttt{Rex::JobContainer} -class. For more information on jobs, please refer to the job -explanation in the Rex documentation in section \ref{rex-jobs}. - - \section{Utility Classes} - -\par -Some classes in the framework core are intended to be used to make -certain tasks simpler without being out of scope of the core aspects -of the framework. These classes are described below. - - \subsection{Exploit driver} - -\par -The \texttt{Msf::ExploitDriver} class encapsulates the task of -running an exploit module in terms of coordinating the validation of -required module options, the validation of target selection, the -generation of a selected payload, and the execution of exploit and -payload setup and cleanup. These operations are what has to be -performed when attempting to execute an exploit. - -\par -An instance of an exploit driver is initialized as described in -figure \ref{fig-code-exploit-driver}. - -\begin{figure}[h] -\begin{verbatim} -driver = Msf::ExploitDriver.new(framework) - -driver.payload = payload_instance -driver.exploit = exploit_instance -driver.target_idx = 0 - -session = driver.run -\end{verbatim} -\caption{Using the ExploitDriver class} -\label{fig-code-exploit-driver} -\end{figure} - -\par -When the \texttt{run} method is called, the first step is to -validate the options required by the payload and the exploit that -have been selected. This is done by calling the public -\texttt{validate} method on the exploit driver instance. In the -event that options fail to validate or that a target index has not -been properly selected, an exception will be thrown to the caller. -After validation has completed, the exploit's \texttt{TARGET} data -store element is set to the selected target index. From there, an -encoded version of the payload is generated by calling -\texttt{generate\_payload} on the exploit instance. Once completed, -the exploit is set up by calling \texttt{setup} on the exploit -module instance and finally the actual exploit code is triggered by -calling \texttt{exploit} on the exploit module instance. - -\par -Once exploitation has completed, the exploit driver calls the -\texttt{stop\_handler} method on the payload module instance and -then calls the \texttt{cleanup} method on the exploit module -instance. - -\par -The exploit driver can also be instructed to run the exploit in the -context of a job. When this is done, the underlying exploitation -operation is done in the context of a job worker thread by calling -\texttt{framework.jobs.start\_bj\_job}. The exploit driver can be -told to use a job by setting the \texttt{use\_job} attribute to -true. - - \subsection{Encoded payload} - -\par -The purpose of the \texttt{Msf::EncodedPayload} class is to -encapsulate the operation of encoding a payload with an arbitrary -set of requirements. To generate an encoded payload, an instance of -an \texttt{Msf::EncodedPayload} class must be created by passing its -constructor an instance of a payload as well as an optional hash of -requirements that will be used during the generation phase. This -can be accomplished by calling the class' \texttt{create} method as -shown in figure \ref{fig-code-enc-payload}. - - -\begin{figure}[h] -\begin{verbatim} - -encoded = Msf::EncodedPayload.create(payload_instance, - 'BadChars' => "\x0a\0xd", - 'Space' => 400, - 'Prepend' => "\x41\x41", - 'Append' => "\xcc\xcc\", - 'SaveRegisters' => "edi", - 'MinNops' => 16) -\end{verbatim} -\caption{Creating an instance of an EncodedPayload} -\label{fig-code-exploit-driver} -\end{figure} - -\par -Once an encoded payload instance has been created, the next step is -to make a call to the instance's \texttt{generate} method which will -return the encoded version of the payload. After generation has -occurred, the following attributes can be accessed on the encoded -payload instance in order to get information about the now-encoded -payload. Figure \ref{fig-table-enc-payload} shows the attributes -and their purposes. - -\begin{figure}[h] -\begin{center} -\begin{tabular}{|l|p{3.5in}|} -\hline -\textbf{Attribute} & \textbf{Description} \\ -\hline -raw & The un-encoded raw payload buffer. \\ -\hline -encoded & The encoded payload buffer which may be equal to raw if no encoder was used. \\ -\hline -nop\_sled\_size & The size of the NOP sled prepended to the encoded payload. Zero if no NOPs were generated. \\ -\hline -nop\_sled & The NOP sled portion of the encoded payload, if any. \\ -\hline encoder & The encoder module instance that was used to encode -the -payload. \\ -\hline nop & The nop module instance that was used to generate the -NOP -sled, if any. \\ -\hline -\end{tabular} -\caption{\texttt{Msf::EncodedPayload} instance attributes} -\label{fig-table-enc-payload} -\end{center} -\end{figure} - -\par -To control the behavior of the encoded payload class, an optional -hash can be passed into the constructor. The table in figure -\ref{fig-table-enc-payload-options} describes the options that can -be specified and the affect they have on behavior. - - -\begin{figure}[h] -\begin{center} -\begin{tabular}{|l|p{3.5in}|} -\hline -\textbf{Hash Element} & \textbf{Description} \\ -\hline -BadChars & A string of bad characters to avoid when encoding. \\ -\hline -Encoder & The name of the preferred encoder to use. \\ -\hline -MinNops & The minimum number of NOPs to generate. \\ -\hline -MaxNops & The maximum number of NOPs to generate. \\ -\hline -Space & The amount of room left for use by the payload. If this value is not specified, then NOP padding will not be performed and there will be no restrictions on payload size. \\ -\hline -SaveRegisters & A white-space separated list of registers to save when generating the NOP sled. \\ -\hline -Prepend & Raw instructions or text to prepend to the encoded payload. \\ -\hline -Append & Raw instructions or text to append to the encoded payload. \\ -\hline -\end{tabular} -\caption{\texttt{Msf::EncodedPayload} constructor options} -\label{fig-table-enc-payload-options} -\end{center} -\end{figure} - -\chapter{Framework Base} - -\par -The framework base is a library layer built on top of the framework -core that adds classes that make dealing with the framework easier. -It also provides a set of classes that could be useful to third -party development tools that don't necessarily fit within the scope -of the framework core itself. The classes that compose the -framework base are described in the following subsections. To use -the framework base library, a ruby script should require -\texttt{msf/base}. - - \section{Configuration} - -\par -One important aspect of a managed framework installation is the -concept of persistent configuration and methods for getting -information about the structure of an installation, such as the root -directory of the installation and other types of attributes. To -facilitate this, the framework base library provides the -\texttt{Msf::Config} class that has methods for obtaining various -installation directory paths. It also supports the serialization of -configuration files. The table shown in figure -\ref{fig-table-config} describes the different methods that can be -used to obtain configuration information. - - -\begin{figure}[h] -\begin{center} -\begin{tabular}{|l|p{3.5in}|} -\hline -\textbf{Method} & \textbf{Description} \\ -\hline -install\_root & The installation's root directory. \\ -\hline -config\_directory & The configuration directory (\verb#~/.msf3#). \\ -\hline -module\_directory & install\_root + '/modules'. \\ -\hline -plugin\_directory & install\_root + '/plugins'. \\ -\hline -log\_directory & config\_directory + '/logs'. \\ -\hline -session\_log\_directory & config\_directory + '/logs/sessions'. \\ -\hline -user\_module\_directory & config\_directory + '/modules'. \\ -\hline -data\_directory & install\_root + '/data'. \\ -\hline -config\_file & config\_directory + '/config'. \\ -\hline -load & Loads the contents of a configuration file and returns an instance of a \texttt{Rex::Parser::Ini} object. \\ -\hline -save & Saves the supplied option hash to the configuration file supplied as \texttt{'ConfigFile'} in the options hash or the config\_file by default. \\ -\hline -\end{tabular} -\caption{\texttt{Msf::Config} accessor methods} -\label{fig-table-config} -\end{center} -\end{figure} - - \section{Logging} - -\par -The framework base library provides a wrapper class that can be used -to control debug logging at an administrative level by providing -methods for enabling log sources and for controlling logs that are -applied to sessions created from within a framework instance. To -initialize logging, a call must be made to -\texttt{Msf::Logging.init} which will register the log sources -\texttt{rex}, \texttt{core}, and \texttt{base} as being directed at -\texttt{framework.log} as found in the -\texttt{Msf::Config.log\_directory}. Individual log sources can be -subsequently enabled or disabled by making calls to -\texttt{Msf::Logging.enable\_log\_source} and -\texttt{Msf::Logging.disable\_log\_source}, respectively. When -session logging is enabled, calls can be issued to -\texttt{start\_session\_log} and \texttt{stop\_session\_log} which -operate on a provided session instance to start or stop logging to a -session-specific log file in the -\texttt{Msf::Config.session\_log\_directory} directory. - - \section{Serialization} - -\par -To make life easier for framework programmers, the framework base -library provides a class that can be used to serialize information -about modules, such as their description, options, and other -information to a uniform, human readable format. The class that -provides this feature is the \texttt{Msf::Serializer::ReadableText} -class. For more information, please review the auto-generated API -documentation on the Metasploit website. - - \section{Sessions} - -\par -While the framework core has an abstract concept of sessions as -described through the \texttt{Msf::Session} base module, the -framework base actually provides some of the concrete -implementations. This separation was done to eliminate -module-specific session implementations from the framework core as -the core should have no conceptual dependencies on modules that use -it. The base library, on the other hand, is more of a facilitation -layer for subscribers of the framework. The two sessions currently -implemented in the base library are the \texttt{CommandShell} -session and the \texttt{Meterpreter} session. - - \subsection{CommandShell} - -\par -The command shell session implements the framework core \\ -\texttt{Msf::Session::Provider::SingleCommandShell} interface -against a connected stream, such as a TCP connection. For more -information about this mixin, please read chapter -\ref{framework-sessions}. - - \subsection{Meterpreter} - -\par -The meterpreter session implements the -\texttt{Msf::Session::Interactive} and \\ -\texttt{Msf::Session::Comm} -mixins. This allows it to be operated through an interactive user -shell and also indicates to the framework that internet traffic can -be routed (pivoted) through the session by making use of it as a -Comm socket factory. The session itself is merely an extension of -the \texttt{Rex::Post::Meterpreter} class which operates against a -connected stream, such as a TCP connection. - - \section{Simplified Framework} - -\par -The simplified framework provides methods that make the framework -and the different module types easier to use by providing wrapper -methods that handle most of the actions that would be common to a -subscriber of the framework. To create an instance of the -simplified framework, the \texttt{Msf::Simple::Framework.create} -method should be called along with an optional hash. The return -value is an instance of an \texttt{Msf::Framework} class that has -been extended by the \texttt{Msf::Simple::Framework} mixin. Existing -framework instances can also be simplified by calling the -\texttt{Msf::Simple::Framework.simplify} method with the existing -framework instance as the first argument. All module instances -created from within a simplified framework instance will -automatically be simplified by the module type-specific mixins. - -\par -The creation of a simplified framework instance automatically leads -to the initialization of the \texttt{Msf::Config} class and the -\texttt{Msf::Logging} class. Any existing configuration file is -also automatically loaded. The default global module directory -(\texttt{Msf::Config::module\_directory}) and the user-specific -module directory (\texttt{Msf::Config::user\_module\_directory}) are -added as search paths to the framework instance which leads to the -loading of all modules within the two directories. Finally, a -general event subscriber is registered with the framework instance -that will be called whenever module instances are created within the -framework. This allows the simplified framework the opportunity to -simplify each created module instance. - -\par -Each module type has a simplified framework module mixin that is -automatically used to extend created module instances via the -general event subscriber described above. For example, when an -exploit module instance is created, the instance is extended by the -\texttt{Msf::Simple::Exploit} mixin. Each different module mixin -provides a helper method or methods for driving that specific module -type's primary action or actions. Furthermore, each module instance -has methods that can be used to save and restore module-specific -configuration elements through the \texttt{save\_config} and -\texttt{load\_config} methods. Each module-specific mixin is -described individually below. - - \subsection{Auxiliary} - -\par -The simplified auxiliary mixin provided in \texttt{Msf::Simple::Auxiliary} -extends each auxiliary module instance with a method called -\texttt{run\_simple}. This method takes a hash parameter that is used to -control the execution of the auxiliary module. It sets everything up, -including the module's datastore. - - \subsection{Exploit} - -\par -The simplified exploit mixin provided in -\texttt{Msf::Simple::Exploit} extends each exploit module instance -with a method called \texttt{exploit\_simple}. This method takes a -hash parameter that is used to control the exploitation of something -by creating an instance of an \texttt{Msf::ExploitDriver} class and -doing all the required initialization and configuration of the -module prior to issuing the call to the exploit driver's -\texttt{run} method. If the operation succeeds, the return value is -a session instance. Otherwise, an exception will be thrown or -\texttt{nil} may be returned. For more information about the hash -elements that can be passed in, please refer to the auto-generated -API documentation on the Metasploit website. - - \subsection{NOP} - -\par -The simplified NOP mixin provided in \texttt{Msf::Simple::Nop} -extends each nop module instance with a method called -\texttt{generate\_simple}. This method takes the length of the sled -generate and the hash of options that should be used for the -generation. On success, the return value is a buffer that is -encoded using the \texttt{Msf::Simple::Buffer} class using the -format specified in the option hash as the \texttt{'Format'} -element. If no format is specified, the raw version of the NOP sled -is returned. - - \subsection{Payload} - -\par -The simplified payload mixin provided in -\texttt{Msf::Simple::Payload} extends each payload module instance -with a method called \texttt{generate\_simple}. This method takes a -hash of options that are used to generate a payload buffer. The -elements that can be used in the option hash can be found in the -auto-generated API documentation found on the Metasploit website. If -the operation is successful, the encoded payload buffer will be -serialized to the format supplied in the \texttt{'Format'} hash -element. If the format is not raw, any staged payloads will also be -appended to the serialized buffer. - -\chapter{Framework Ui} - -\par -The framework user interface library is used to encapsulate code -common to different user interface mediums to allow third party -development and extension of custom user interfaces separate from -those distributed with the framework itself. Each different user -interface medium is encapsulated in an abstract \textit{driver} -class, \texttt{Msf::Ui::Driver} that is designed to have an actual -interface that is specific to the underlying user interface medium -being used. - -\par -The inherited driver base class simply defines three methods that -are to be common to all user interfaces. Those methods are -\texttt{run}, \texttt{stop}, and \texttt{cleanup}. Their names -imply the actions that are to be performed. Each of the currently -defined user interface mediums will be explained individually in the -following sections. To use the framework ui library, a ruby script -should require \texttt{msf/ui}. - -\chapter{Framework Modules} -\label{framework-modules} - -\par -The primary purpose of the Metasploit framework is to facilitate the -development of modules that can plug into the framework core and be -shared with other existing modules. For instance, an advanced -encoder module can be plugged into the framework and will be -automatically applied to payloads of a compatible architecture and -platform. This makes it so there are zero code changes required due -to the fact that all modules conform to a well-defined interface -through which they can be interacted with by the framework. As -another example, new payloads can be developed and are immediately -usable to all exploits without modification. This eliminates the -need to copy static payload blobs into exploits as is most common -with proof of concept exploits. This chapter is dedicated to -describing the interfaces that each module type exposes in order to -provide an understanding of what it takes to implement each module -type. - -\par -At some level, all modules inherit from the module base class -provided in \texttt{Msf::Module}. This class implements all of the -things that are common to Metasploit framework modules, such as -common accessors and attributes. When a module is loaded into the -framework, a copy of the class that gets added is made which is what -is used for future instantiations of the module. The copy class -then has some of its attributes set that allow the framework to look -at some of the module's information at a glance without having to -create an instance of it. This information can be accessed through a -set of class methods and attributes that are described in figure -\ref{fig-table-mod-class-methods}. - -\begin{figure}[h] -\begin{center} -\begin{tabular}{|l|p{3.5in}|} -\hline -\textbf{Method} & \textbf{Description} \\ -\hline -framework & The framework instance that the module is associated with. \\ -\hline -type & The module's symbolic type. One of \texttt{MODULE\_ENCODER}, \texttt{MODULE\_EXPLOIT}, \texttt{MODULE\_NOP}, \texttt{MODULE\_PAYLOAD}, or \texttt{MODULE\_RECON} \\ -\hline -fullname & The complete symbolic name of the module including is string type. For example: exploit/windows/ms03\_026 \\ -\hline -rank & The module's integer rank to indicates its quality. The rank is used by the framework when selecting which encoders, payloads, and NOP generators to use. \\ -\hline -rank\_to\_s & Returns the string representation of the module's rank. \\ -\hline -refname & The module's symbolic reference name. For example: windows/ms03\_026 \\ -\hline -orig\_cls & The original, non-duplicated class that was loaded for the module. \\ -\hline -file\_path & The file path that the module was loaded from. \\ -\hline -\end{tabular} -\caption{\texttt{Msf::Module} class methods} -\label{fig-table-mod-class-methods} -\end{center} -\end{figure} - -\par -To support generic initialization, each module defines its own -custom information hash that is eventually passed to the constructor -of \texttt{Msf::Module}. This information class is then assigned to -the instance attribute named \texttt{module\_info} and is then -processed. The parts that are common to all modules are broken down -and transformed into uniform types that can be accessed through -instance methods. The same methods that are accessible through the -module class can also be used through the class instance (as shown -in figure \ref{fig-table-mod-class-methods}). - -\par -The table in figure \ref{fig-table-mod-info} shows how the common -module information hash elements are broken down into their -respective data types and the methods that can be used to access -them. - -\begin{figure}[hbp] -\begin{center} -\begin{tabular}{|l|l|l|p{2.0in}|} -\hline -\textbf{Hash Element} & \textbf{Accessor} & \textbf{Type} & \textbf{Description} \\ -\hline -Name & name & String & The short name of the module. \\ -\hline -Alias & alias & String & An alias string for the refname of the module. \\ -\hline -Description & description & String & A longer description of the module. \\ -\hline -Version & version & String & The current revision of the derived module. \\ -\hline -License & license & String & The license that the module has been released under. \\ -\hline -Author & author & Array & An array of \texttt{Msf::Author} instances. \\ -\hline -Arch & arch & Array & An array of architectures (like \texttt{ARCH\_X86}). \\ -\hline -Platform & platform & PlatformList & An instance of a \texttt{Msf::PlatformList}. \\ -\hline -References & references & Array & An array of \texttt{Msf::Reference} instances. \\ -\hline -Options & options & OptionContainer & Options conveyed in the hash are added to the module's option container. \\ -\hline -AdvancedOptions & options & OptionContainer & Options conveyed in the hash are added to the module's option container as advanced options. \\ -\hline -DefaultOptions & options & OptionContainer & Previously registered options have their default value modified. \\ -\hline -Privileged & privileged & Bool & Whether or not the module requires or grants privileged access. \\ -\hline -Compat & compat & Hash & A hash of compatibility flags. \\ -\hline -\end{tabular} -\caption{\texttt{Msf::Module} information hash accessors} -\label{fig-table-mod-info} -\end{center} -\end{figure} - - -\par -Some of the information hash accessors also have helper methods that -make it easier to interact with them. For instance, the -\texttt{Arch} hash element array contained within the \texttt{arch} -attribute can be serialized to a comma separated string by calling -\texttt{arch\_to\_s}. Architectures can also be enumerated by -calling \texttt{each\_arch} by passing it a block that accepts the -architecture as a parameter. It is also possible to check if a -module supports an architecture by calling the \texttt{arch?} method -and passing it the architecture to check for as a parameter. Like -architectures, platforms can be serialized to a string by calling -\texttt{platform\_to\_s}. - -\par -The \texttt{Author} hash element can also be converted to a comma -separated string of authors by calling \texttt{author\_to\_s}. The -array of \texttt{Msf::Author} instances contained within the -\texttt{author} array attribute can be enumerated by calling -\texttt{each\_author} and passing it a block that takes an author -instance as its first parameter. - -\par -The \texttt{Msf::Module} class also has some helper methods that -allow users to quickly check if a module is of a specific type by -calling the \texttt{?} method set. For instance, if a caller -wished to see if a module instance was an exploit, they could call -\texttt{mod.exploit?}. - -\par -Since the Rex library introduces the concept of socket communication -factories (through the \texttt{Comm} class), each module has an -attribute that can return the \texttt{Comm} instance that was used -or preferred. By default, all modules return -\texttt{Rex::Socket::Comm::Local}. - -\par -Each module has its own instance-based datastore which is an -instance of the \texttt{Msf::ModuleDataStore} class and can be -accessed through the \texttt{datastore} accessor. This mirrors the -functionality provided by the global framework datastore in that it -provides a localized variable to value association for use in -satisfying required options. For instance, if a module requires the -\texttt{RHOST} option to be set to a value, the module's data store -must have a hash entry for \texttt{RHOST}. Alternatively, modules -are designed to be able to fall back on the framework global -datastore if their localized datastore does not have a value for a -variable being checked for. This provides a basic level of -variable/value inheritance. In some cases, modules may wish to -share their localized copies of the datastore with other modules -without having to taint the global datastore. This can be -accomplished by calling the \texttt{share\_datastore} method on a -module instance and passing it a data store instance as the first -argument. - -\par -Finally, framework modules are designed to be able to indicate their -relative compatibilities with other modules. For instance, an -exploit may wish to indicate that it is incompatible with a specific -class of payload connection mediums. This is accomplished through -the \texttt{Compat} information hash element. After the -compatibility layer has been initialized, calls can be made to a -module's \texttt{compatible?} method by passing another module -instance as the argument. If the supplied module instance is -compatible with the instance that's being checked against, then true -is returned. - -\par -This basic interface provides a generalized view into the behavior -and expectations of framework modules. However, all module types -have well-defined interfaces for dealing with the actions that they -are meant to undertake. These specific interfaces will be described -in the following sections. - - \section{Auxiliary} - -\par -Auxiliary modules are a new concept in Metasploit 3.0 and are intended to help -solve the problem of trying to use exploit modules in situations where they -should not be used. For instance, denial of service bugs are poor candidates -for exploits because they do not require the use of a payload and may not have -targets. Additionally, bugs that lead to the ability to read remote files or -perform other sorts of actions that also don't require a payload have also -been a poor fit for exploits. To solve this problem, the concept of an -auxiliary module was introduced. Auxiliary modules are basically a generic -module type. They have a very loosely defined interface which makes it -possible for developers to use them to write modules that perform denial of -service attacks, port scanning, and other forms of information collection -about a host or service. Auxiliary modules are a great fit for use in -collecting information that can be fed back into the framework's centralized -database of hosts and services. - -\par -At an implementation level, all auxiliary modules must inherit from -\texttt{Msf::Auxiliary} at some level. In addition to inheriting from this -base class, auxiliary modules may also choose to use zero or more of the -auxiliary and exploit mixins provided by the framework. At the time of this -writing, three mixins exist for auxiliary modules. These mixins are: - -\begin{enumerate} -\item \texttt{Msf::Auxiliary::Dos} - -Provides common methods for Denial of Service auxiliary modules. -\item \texttt{Msf::Auxiliary::Scanner} - -Provides a common interface for allowing users to specify subnets and to have -the auxiliary module scan those subnets rather than only being able to specify -a single IP address. -\item \texttt{Msf::Auxiliary::Report} - -Provides a set of methods that can be used to report information about a host -or service to the framework's database. This information can then be used to -fire off an exploit or other auxiliary modules automatically. -\end{enumerate} - -\par -Auxiliary modules have a very simple interface. There is really only one -method that a developer of an auxiliary module would needs to implement. The -\texttt{run} method is intended to do just that: run the auxiliary module. -The actions performed within the \texttt{run} method are arbitrary, and the -framework has no method of checking if the \texttt{run} method succeeded or -not. - -\par -To support the ability to run multiple different commands, auxiliary modules -are able to specify zero or more \textit{actions} in their information hash. -Actions are analogous to targets which are used in exploits. An auxiliary -module can query the action selected by the user by calling the -\texttt{action} method on itself. - -\par -In certain situations, developers may wish to offer additional commands that -aren't as easily expressed through actions. In these cases, an arbitrary -number of console commands can be dynamically added to the command set -whenever the auxiliary module is used from the console interface. This is -accomplished by overriding the \texttt{auxiliary\_commands} method on the base -class. This method should return a hash that associates the name of a command -with its description. The developer should then implement a method on the -auxiliary module that is of the form \texttt{cmd\_NAME} where name is the hash -key that was specified in the commands hash. For example, to add a command -called \texttt{test}: - -\begin{verbatim} -def auxiliary_commands - { - "test" => "This is a test" - } -end - -def cmd_test(*args) - -end -\end{verbatim} - - \section{Encoder} - -\par -Encoder modules are used to generate transformed versions of raw -payloads in a way that allows them to be restored to their original -form at execution time and then subsequently executed. To -accomplish this, most encoders will take the raw form of the payload -and run it through some kind of encoding algorithm, like bitwise -XOR. After the encoded version is generated, a decoding stub is -prefixed to the encoded version of the payload. This stub is -responsible for performing the inverse operation on the buffer -attached to the decoder when it executes. After the decoder -restores the payload to its original form, it will transfer -execution to the start of the now normalized payload. - -\par -To support the above described encoder model, the Metasploit -framework provides the \texttt{Msf::Encoder} class which inherits -from the \texttt{Msf::Module} base class. All encoders must inherit -from the \texttt{Msf::Encoder} class at some level to ensure that -encoder-specific methods are included in the derived class. - -\par -Like the module information hash, encoders have some specialized -information hash elements that describe information about the -encoder being used. The information that encoder modules need to -describe are the attributes of the decoder which is conveyed through -the \texttt{Decoder} information hash element. The \texttt{Decoder} -hash element references another hash that contains decoder specific -properties. These are described in the table shown in figure -\ref{fig-table-encoder-hash} along with their types and module -instance accessors. - -\begin{figure}[h] -\begin{center} -\begin{tabular}{|l|l|l|p{2.0in}|} -\hline -\textbf{Hash Element} & \textbf{Accessor} & \textbf{Type} & \textbf{Description} \\ -\hline -Stub & decoder\_stub & String & The raw stub to be prefixed to encoded payloads. \\ -\hline -KeyOffset & decoder\_key\_offset & Fixnum & The offset to the key in the decoder stub. \\ -\hline -KeySize & decoder\_key\_size & Fixnum & The size of the decoder key in bytes. \\ -\hline -BlockSize & decoder\_block\_size & Fixnum & The size of each encoding block in bytes. \\ -\hline -KeyPack & decoder\_key\_pack & String & The byte-ordering to use when packing the key. The default is 'V'. \\ -\hline -\end{tabular} -\caption{\texttt{Msf::Encoder} \texttt{Decoder} information hash -accessors} \label{fig-table-encoder-hash} -\end{center} -\end{figure} - -\par -Each of the methods described in figure \ref{fig-table-encoder-hash} -are designed to be overridable so that derived encoder classes can -dynamically choose the values returned by them rather than being -forced to initialize them in a static hash element. The decoder -hash itself can be accessed through the \texttt{decoder\_hash} -method in case an encoder module wishes to convey non-standard -information in the hash for later reference. - -\par -Perhaps of more importance that the decoder initialization vector is -how the encoding process is exposed. The base class -\texttt{Msf::Encoder} implements an instance method named -\texttt{encode} which takes a buffer as the first argument, a string -of bad characters (or nil) as the second argument, and an optional -encoder state as the third argument. The \texttt{encode} method -wraps the encoding process in terms of selecting a decoder key, -initializing the encoder state, and then performing the actual -encoding operation. Once completed, the encoded buffer is returned -to the caller. This is the primary method that the framework uses -when interacting with framework encoder modules. - - \subsection{encode} - -\par -At a more detailed level, the \texttt{encode} method first creates -an instance of a \texttt{Msf::EncoderState} class if one was not -supplied as the third argument of \texttt{encode}. The purpose of -the encoder state is to contain transient information about a -specific encoding operation in a non-global fashion. After creating -the encoder state instance, \texttt{encode} prepends any -encoder-specific data to the raw payload that may be necessary -through the use of the \texttt{prepend\_buf} instance method on the -encoder module. This method is intended to be overridden and used -as necessary. By default, an empty string is returned, effectively -leaving the buffer in the same state that it was when it was passed -in. - -\par -After prepending the raw buffer as necessary, the \texttt{encode} -method then selects a decoder key if the \texttt{decoder\_key\_size} -method returns a non-zero value and the encoder state currently has -a \texttt{nil} key. This is accomplished by calling the -\texttt{find\_key} method on the encoder module which has a default -implementation that is intended to work across all encoder modules. -Once a key has been selected, the \texttt{init\_key} method is -called on the encoder state object to set the \texttt{state.key} and -\texttt{state.orig\_key} attributes. If no key is found, a -\texttt{Msf::NoKeyError} exception is raised. - -\par -The next step is to initialize some of the encoder state specific -attributes by calling the \texttt{init\_state} method on the encoder -module instance which simply stores the currently defined decoder -key offset, size, and pack as attributes of the encoder state as -conveyed through the accessor methods on the encoder module instance -itself. The encoder state then has the string of bad characters and -the raw buffer set as attributes so that they can be contextually -referenced throughout the encoding process. - -\par -With the encoder state finally initialized, the next step is to -begin the encoding process by calling the \texttt{encode\_begin} -method on the encoder module instance. This method simply does -nothing in its default implementation, but it is designed to allow -derived encoder modules to alter the attributes of the encoder state -prior to actually starting the encoding process. Once -\texttt{encode\_begin} returns, the \texttt{encode} method makes a -call into the \texttt{do\_encode} method by passing it the buffer, -bad characters, and initialized encoder state. This is the method -that does the actual encoding work and could possibly be overridden -if the default implementation was not suitable for a given encoder. - -\par -Once \texttt{do\_encode} completes, the \texttt{encode} method makes -a call into \texttt{encode\_end} and passes the encoder state as an -argument. The default implementation of this method simply does -nothing, but it is provided as a means by which an encoder can hook -into the finalization of the encoding process to alter the results -that will be returned to the caller. - - \subsection{do\_encode} - -\par -The \texttt{do\_encode} method is the actual workhorse of the -encoding process. It starts by making a copy of the decoder stub by -calling the encoder module instance's \texttt{decoder\_stub} method -and passing it the encoder state as an argument. The -\texttt{decoder\_stub} method is the only one that takes an encoder -state as an argument as some encoders may generate dynamic decoder -stubs depending on the state. - -\par -After obtaining the decoder stub, the next step is to substitute the -packed version of the decoder key at whatever offset was conveyed in -the decoder information hash through the \texttt{KeyOffset} and -\texttt{KeySize} as well as the \texttt{KeyPack}. These attributes -are gotten through the encoder state's attributes since it's -possible that a derived encoder may wish to alter their values to be -non-static between iterations of the encoding process. - -\par -Finally, the actual block-based encoding occurs by simply walking -the raw buffer in block size chunks calling the -\texttt{encode\_block} method on each chunk. This method is passed -the encoder state and the chunk to be encoded. By default, the -\texttt{encode\_block} method simply returns the block it is passed, -but all encoders are intended to override this method to return the -encoded value of the block based on the current encoder state. - -\par -After all the blocks have been encoded, the encoder state's -\texttt{encoded} attribute will contain the encoded version of each -blocked. The \texttt{do\_encode} method then prepends the decoder -stub to the front of the encoded buffer and then checks to see if -the complete stub + encoded buffer has any bad characters. If bad -characters are found, a \texttt{Msf::BadcharError} exception is -raised to the caller indicating what character and position the bad -character was found at in the encoded buffer. If all goes well, the -\texttt{do\_encode} method returns true. - - \subsection{Helper methods} - -\par -Internal the encoder module class are some instance helper methods -that can be used by derived classes to make things easier. For -instance, the encoder module base class has a method called -\texttt{has\_badchars?} that can be used to check to see if the -supplied buffer has any of the supplied bad characters. If it does, -the index of the first bad character found is returned. Otherwise, -\texttt{nil} is returned. - - \section{Exploit} - -\par -Exploit modules are used to leverage vulnerabilities in a manner -that allows the framework to execute arbitrary code. This broad -definition encompasses things like command execution and code -execution which are described in terms of payloads in the framework -nomenclature. Support for exploit modules is provided through the -\texttt{Msf::Exploit} base class. All exploit modules must derive -from the \texttt{Msf::Exploit} base class at some level. The -primary interface exposed by exploit modules to the framework are -methods that can be used to check to see if a target is vulnerable -and to actually launch the exploit. These methods will be discussed -more later in this section. - -\par -Like the module information hash, exploit modules have a few exploit -module specific information hash elements that are used to control -the way the framework interacts with the exploit module and to -control the exploit module itself. These exploit module specific -hash elements are described in the table shown in figure -\ref{fig-table-exploit-hash}. - -\begin{figure}[h] -\begin{center} -\begin{tabular}{|l|l|l|p{2.0in}|} -\hline -\textbf{Hash Element} & \textbf{Accessor} & \textbf{Type} & \textbf{Description} \\ -\hline -Stance & stance & Exploit::Stance & One of \texttt{Exploit::Stance::Aggressive} or \texttt{Exploit::Stance::Passive}. \\ -\hline -Targets & targets & Array & An array of \texttt{Msf::Target} instances. \\ -\hline -DefaultTarget & default\_target & Fixnum & The default target index to use, if any. \\ -\hline -Payload & payload\_info & Hash & A hash of elements that controls the exploit's interaction with payloads. \\ -\hline -\end{tabular} -\caption{\texttt{Msf::Exploit} information hash elements} -\label{fig-table-exploit-hash} -\end{center} -\end{figure} - -\par -The following subsections will describe the distinctions between -different types and stances of exploit modules as well as the -interfaces that can be used to operate upon them. - - \subsection{Stances} - -\par -In the 3.0 version of the framework, exploit modules are designed to -take a stance that describes how they go about exploiting their -vulnerability at a very general level. While there is much debate -in how this breakdown should occur, the framework puts them into two -basic categories called \textit{stances}. The first stance that an -exploit can take is an aggressive stance. In this mode, an exploit -is actively triggering an exploit. The second stance that an -exploit can take is a passive stance. In this mode, an exploit is -waiting for something to occur, such as a client connecting to a -server, so that the exploit can be triggered. Stances are not -designed to take locality into account. They merely break down the -manner in which the exploit will operate. - -\par -The framework uses the exploit's stance to figure out whether how it -should go about executing the \texttt{exploit} method. For -instance, passive exploits are implied to take longer because they -are waiting for some event to trigger the exploitation. For that -reason, it is better for the framework to run passive exploits in -the context of a job rather than blocking on their exploit routine. -Furthermore, passive exploits may be capable of exploiting more than -one target before they are completed. - -\par -For a module to indicate a passive stance it should initialize the -\texttt{Stance} information hash element to -\texttt{Msf::Exploit::Stance::Passive}. If a module wishes to take -an aggressive stance, which is the default, it should initialize the -\texttt{Stance} information hash element to -\texttt{Msf::Exploit::Stance::Aggressive}. - - \subsection{Types} - -\par -To further categorize exploits, each exploit is described in terms -of an \textit{exploit type}. The purpose of the exploit type is to -indicate the locality of the exploit in terms of whether or not it -is exploiting a remote machine, a local application, or is capable -of operating as both types. - -\par -The remote exploit type, as indicated by -\texttt{Msf::Exploit::Type::Remote}, is used tell the framework that -the exploit is designed to operate against a target other than that -of the local machine. While this doesn't explicitly limit the -exploit to the use of network communication, that is typically what -is implied. Exploit modules can indicate that they are a remote -exploit module by inheriting from \texttt{Msf::Exploit::Remote} -which inherits from \texttt{Msf::Exploit}. - -\par -The local exploit type, as indicated by -\texttt{Msf::Exploit::Type::Local}, is used to tell the framework -that the exploit is designed to operate against an application or -service running on the local machine. This definition typically -limits it to exploitation by means other than network communication -on the local machine. Exploits modules can indicate that they are a -local exploit module by inheriting from \texttt{Msf::Exploit::Local} -which inherits from \texttt{Msf::Exploit}. - -\par -The third exploit type, \texttt{Msf::Exploit::Type::Omni}, is used -to indicate to the framework that the exploit module is capable of -operating both locally and remotely. Exploit modules that fit this -criteria should inherit from the \texttt{Msf::Exploit} class -directly. - - \subsection{Interface} - -\par -To interact with exploit modules, the framework uses a well-defined -interface that is exposed by the exploit module base class. These -methods, along with their purposes, are described in the following -subsections. - - \subsubsection{check} - -\par -The exploit module \texttt{check} method is used to indicate whether -or not a remote machine is thought to be vulnerable. The default -implementation of the \texttt{check} method simply returns that it -is unsupported by the exploit module. However, a complete set of -codes can be returned from the \texttt{check} method as shown in the -table in figure \ref{fig-table-exploit-checkcodes}. - -\begin{figure}[h] -\begin{center} -\begin{tabular}{|l|p{2.5in}|} -\hline -\textbf{Check Code} & \textbf{Description} \\ -\hline -Exploit::CheckCode::Safe & The target is not exploitable. \\ -Exploit::CheckCode::Detected & The target service is running, but could not be validated. \\ -Exploit::CheckCode::Appears & The target appears to be vulnerable. \\ -Exploit::CheckCode::Vulnerable & The target is vulnerable. \\ -Exploit::CheckCode::Unsupported & The exploit does not support \texttt{check}. \\ -\hline -\end{tabular} -\caption{Codes returned from calls to \texttt{exploit.check}} -\label{fig-table-exploit-checkcodes} -\end{center} -\end{figure} - - - \subsubsection{exploit} - -\par -The exploit module's \texttt{exploit} method is the entry point that -is used to kick off the exploitation process. Prior to calling this -method, the framework will have ensured that all required options -have been set and that a payload has been generated for use by the -exploit. After that, it's up to the exploit to perform whatever -action is necessary to trigger the vulnerability in question. - - \subsubsection{setup} - -\par -If a payload instance has been created and assigned to the exploit, -the \texttt{setup} method will initialize the payload's handler by -calling \texttt{setup\_handler} on it and will start the handler by -calling \texttt{start\_handler}. The \texttt{setup} method is -called by the framework prior to calling the exploit module's -\texttt{exploit} method. - - \subsubsection{cleanup} - -\par -The \texttt{cleanup} method gives an exploit module the chance to -remove any resources that were created during the call to -\texttt{exploit} and also gives the exploit module base class a -chance to call \texttt{cleanup\_handler} on the payload instance -that's associated with the exploit, if there is one. - - \subsubsection{generate\_payload} - -\par -This method is used by the framework to generate a payload using -either a passed payload instance as the argument or by using the -\texttt{payload\_instance} attribute of the exploit module instance. -The return value is an instance of an \texttt{EncodedPayload} that -takes into account some of the limiting payload factors described in -the exploit module's \texttt{payload\_info} hash. It also takes -into account any target-specific limiting payload factors. The -resulting encoded payload is assigned to the exploit module's -\texttt{payload} attribute. - - \subsubsection{generate\_single\_payload} - -\par -This method generates an encoded payload using either the supplied -payload instance or the exploit's assigned payload instance and -returns it to the caller in the form of an \texttt{EncodedPayload} -instance. The encoded payload is not assigned as an instance -attribute. - - \subsubsection{regenerate\_payload} - -\par -The \texttt{regenerate\_payload} method is simply a wrapper around -the \texttt{generate\_single\_payload} assuming the exploit's -payload instance as the first parameter. - - \subsection{Accessors and Attributes} - -\par -Exploit modules have a number of accessors and attributes that can -be used by derived exploits modules to make their lives easier. -These accessors and attributes are described below. - - \subsubsection{compatible\_payloads} - -\par -This method returns an array of payloads that are compatible with -the currently selected target, or with all targets if one has not -been selected. The array returned is composed of a two-element -array that consists of the name of the reference name of the -compatible payload and the class associated with the payload. This -method takes into account any architecture and platform restrictions -specified by the currently selected target, if any. - - \subsubsection{handler} - -\par -The \texttt{handler} method is used by exploits to pass information -on to the associated payload that may be required or useful in -detecting if a session has been created. For instance, all -find-style payloads require the original connection that was used to -trigger the vulnerability. By calling the \texttt{handler} method -with the socket that was used, the payload can check and see if a -session has been created. - - \subsubsection{make\_nops} - -\par -In some cases an exploit may need to generate a NOP sled outside of -the context of normal encoded payload generation. TO do this, a -call can be make to the \texttt{make\_nops} instance method with the -length of the sled that should be generated. - - \subsubsection{nop\_generator} - -\par -This method returns an instance of the first compatible nop -generator. - - \subsubsection{nop\_save\_registers} - -\par -This method returns the selected target's NOP save register -information if the \texttt{target} attribute is \texttt{non-nil} and -the \texttt{target.save\_register} attribute is \texttt{non-nil}. -Otherwise, the module information hash element's -\texttt{SaveRegisters} value is returned. - - \subsubsection{payload} - -\par -This attribute is an instance of a \texttt{Msf::EncodedPayload} -after a call has been made to \texttt{generate\_payload}. - - \subsubsection{payload\_append} - -\par -This method returns the selected target's payload append information -if the \texttt{target} attribute is \texttt{non-nil} and the -\texttt{target.payload\_append} attribute is \texttt{non-nil}. -Otherwise, the value of the \texttt{Append} hash element in the -\texttt{payload\_info} hash is returned. - - \subsubsection{payload\_badchars} - -\par -This method returns the value of the \texttt{BadChars} hash element -in the \texttt{payload\_info} hash is returned. - - \subsubsection{payload\_info} - -\par -This method returns the value of the \texttt{Payload} module -information hash element that is used to convey module-specific -payload restrictions. - - \subsubsection{payload\_instance} - -\par -This attribute is set to the payload instance that was used to -generate the encoded payload conveyed in the \texttt{payload} -attribute. - - \subsubsection{payload\_max\_nops} - -\par -This method returns the selected target's payload maximum NOP sled -length if the \texttt{target} attribute is \texttt{non-nil} and the -\texttt{target.payload\_max\_nops} attribute is \texttt{non-nil}. -Otherwise, the value of the \texttt{MaxNops} hash element in the -\texttt{payload\_info} hash is returned. - - \subsubsection{payload\_min\_nops} -\par -This method returns the selected target's payload minimum NOP sled -length if the \texttt{target} attribute is \texttt{non-nil} and the -\texttt{target.payload\_min\_nops} attribute is \texttt{non-nil}. -Otherwise, the value of the \texttt{MinNops} hash element in the -\texttt{payload\_info} hash is returned. - - \subsubsection{payload\_prepend} - -\par -This method returns the selected target's payload append information -if the \texttt{target} attribute is \texttt{non-nil} and the -\texttt{target.payload\_append} attribute is \texttt{non-nil}. -Otherwise, the value of the \texttt{Append} hash element in the -\texttt{payload\_info} hash is returned. - - \subsubsection{payload\_prepend\_encoder} - -\par -This method returns the selected target's payload prepend encoder -information if the \texttt{target} attribute is \texttt{non-nil} and -the \texttt{target.payload\_prepend\_encoder} attribute is -\texttt{non-nil}. Otherwise, the value of the -\texttt{PrependEncoder} hash element in the \texttt{payload\_info} -hash is returned. - - \subsubsection{payload\_space} - -\par -This method returns the selected target's payload maximum payload -space if the \texttt{target} attribute is \texttt{non-nil} and the -\texttt{target.payload\_space} attribute is \texttt{non-nil}. -Otherwise, the value of the \texttt{Space} hash element in the -\texttt{payload\_info} hash is returned. - - \subsubsection{stack\_adjustment} - -\par -This method returns the instructions associated with adjusting the -stack pointer by a fixed amount in an architecture independent -fashion. First, the method looks to see if a target-specific stack -adjustment has been specified and if so uses that. Otherwise, the -method uses the stack adjustment specified as the value of the -\texttt{StackAdjustment} hash element in the \texttt{payload\_info} -hash. From there, the method tries to generate the instructions -associated with the target or module specific architecture. - - \subsubsection{target} - -\par -This attribute returns the \texttt{Msf::Target} instance associated -with the target index that has been set in the module's datastore -through the \texttt{TARGET} option value. If the index is invalid -or \texttt{nil}, \texttt{nil} is returned. - -\par -This attribute is typically used by exploits to get target-specific -addressing information. - - \subsection{Mixins} - -\par -One of the major design changes in the 3.0 version of the framework -was the introduction of exploit mixins. The purpose of exploits -mixins are to reduce, and in most cases eliminate, the duplicated -code that is often shared between exploit modules that attempt to -leverage vulnerabilities found in specific protocol implementations. -The mixins also provide a way to share code that is often used -independent of protocols, such as the generation of an SEH -registration record during the exploitation of an SEH overwrite. By -placing this code in mixins, the framework can augment the support -at shared levels and introduce things like normalized evasion -without having to modify every existing exploit. Encapsulation is -very powerful. - -\par -These mixins are meant to be \texttt{include}'d in exploits that -need them. More than one mixin can be included in a single exploit. - -\par -As the framework grows, the number of exploit mixins that can be -used by modules will grow as well. This document will attempt to -show some of the existing mixins. - - \subsubsection{Msf::Exploit::Brute} - -\par -The brute force mixin provides a flexible implementation that can be -used in a generic fashion for exploits that wish to support brute -forcing. This mixin implements the \texttt{exploit} method and -detects if the currently selected target is a brute force target. If -it is, the mixin does all the required address walking based on -target specified start addresses and stop addresses. During each -iteration, the mixin calls the \texttt{brute\_exploit} method with -the current address state which should be implemented by the derived -class. If the \texttt{exploit} method is called with a target that -is not intended for brute forcing, the mixin calls the -\texttt{single\_exploit} method. - - \subsubsection{Msf::Exploit::Egghunter} - -\par -The purpose of the egghunter mixin is to encapsulate the generation -of an architecture and platform specific egghunter as provided by -the \texttt{Rex::Exploitation::Egghunter} class. This feature is -provided by the mixin's \texttt{generate\_egghunter} method which -takes into account the currently selected target's platform and -architecture. - - \subsubsection{Msf::Exploit::Remote::DCERPC} - -\par -The DCERPC mixin provides methods that are useful to exploits that -attempt to leverage vulnerabilities in DCERPC applications. It also -provides a unified evasion interface that makes it so any exploits -that use the mixin can make use of multi-context bind evasion and -packet fragmentation. - -\par -This mixin automatically registers the \texttt{RHOST} and -\texttt{RPORT} options. It also registers two advanced options, -\texttt{DCEFragSize} and \texttt{DCEMultiBind}. - - \subsubsection{Msf::Exploit::Remote::Ftp} - -\par -The FTP mixin provides a set of methods that are useful when -interacting with an FTP server, such as logging into the server and -sending some of the basic commands. This mixin includes the -\texttt{Msf::Exploit::Remote::Tcp} mixin. - -\par -This mixin automatically registers the \texttt{RHOST}, -\texttt{RPORT}, \texttt{USER}, and \texttt{PASS} options. - - \subsubsection{Msf::Exploit::Remote::HttpClient} - -\par -The HTTP client mixin wraps some of the methods for creating an -instance of a \texttt{Rex::Proto::Http::Client} such that derived -exploits can simply call \texttt{connect} on their module instance -to establish an HTTP connection to a remote server. This mixin also -automatically registers the \texttt{RHOST}, \texttt{RPORT}, and -\texttt{VHOST} options. - - \subsubsection{Msf::Exploit::Remote::HttpServer} - -\par -The HTTP server mixin wraps the creation or re-use of a local HTTP -server that is used in the exploitation of HTTP clients, like -web-browsers. This mixin also includes the -\texttt{Msf::Exploit::Remote::TcpServer} mixin. - - \subsubsection{Msf::Exploit::Remote::SMB} - -\par -The SMB mixin implements methods that are useful when exploiting -vulnerabilities over the SMB protocol. It provides methods for -connecting and logging into an SMB server as well as other helper -methods for operating on the SMB connection once established. This -mixin includes the \texttt{Msf::Exploit::Remote::Tcp} mixin. - -\par -This mixin automatically registers the \texttt{RPORT}, -\texttt{SMBDirect}, \texttt{SMBUSER}, \texttt{SMBPASS}, -\texttt{SMBDOM}, and \texttt{SMBNAME} options. It also registers -the \texttt{SMBPipeWriteMinSize}, \texttt{SMBPipeWriteMaxSize}, -\texttt{SMBPipeReadMinSize}, and \texttt{SMBPipeReadMaxSize} -advanced options. - - \subsubsection{Msf::Exploit::Remote::Tcp} - -\par -The TCP mixin implements a basic TCP client interface that can be -used in a generic fashion to connect or otherwise communicate with -applications that speak over TCP. - -\par -This mixin automatically registers the \texttt{RPORT}, -\texttt{RHOST}, and \texttt{SSL} options. - - \subsubsection{Msf::Exploit::Remote::TcpServer} - -\par -The TCP server mixin implements a basic TCP server that can be used -to exploit vulnerabilities in clients that speak over TCP. - -\par -This mixin automatically registers the \texttt{SRVHOST} and -\texttt{SRVPORT} options. - - \subsubsection{Msf::Exploit::Remote::Udp} - -\par -The UDP mixin implements a basic UDP client interface that can be -used in a generic fashion to connect or otherwise communicate with -applications that speak over UDP. - -\par -This mixin automatically registers the \texttt{RPORT}, -\texttt{RHOST}, and \texttt{SSL} options. - - \subsubsection{Msf::Exploit::Seh} - -\par -The SEH mixin implements some wrapper methods that can be used by -exploits that leverage the SEH overwrite exploitation vector. The -purpose of this mixin is to wrap the generation of SEH registration -records in such a way that it's possible to take into account higher -evasion levels. This is accomplish by using the -\texttt{Rex::Exploitation::Seh} class. - -\par -This mixin automatically registers the \texttt{DynamicSehRecord} -advanced option. - - \section{Nop} - -\par -NOP generator modules are used to create a string of instructions -that have no real affect when executed on a machine other than -altering the state of registers or toggling processor flags. All -nop modules must inherit from the \texttt{Msf::Nop} base class at -some level. Nop modules are fairly simplistic when compared to the -other types of modules in the framework. There are only two methods -that the framework uses when dealing with nop modules. - - \subsection{generate\_sled} - -\par -The \texttt{generate\_sled} method performs the action that the name -implies. It takes the size of the NOP sled to generate as the first -argument and a hash of optional parameters as the second argument. -The hash controls some of the behaviors of the NOP generator. The -table shown in figure \ref{fig-table-nop-genhash} shows the hash -elements that may be passed by the framework to -\texttt{generate\_sled}. - -\begin{figure}[h] -\begin{center} -\begin{tabular}{|l|l|p{3.0in}|} -\hline -\textbf{Hash Element} & \textbf{Type} & \textbf{Description} \\ -\hline -Random & Bool & Indicates that random NOP generation should be used. \\ -\hline -SaveRegisters & Array & An array of architecture-specific registers that should not be touched by instructions generated in the NOP sled. \\ -\hline -BadChars & String & The string of bad characters, if any, that should be avoided by the NOP sled. \\ -\hline -\end{tabular} -\caption{\texttt{Msf::Nop} \texttt{generate\_sled} optional hash -arguments} \label{fig-table-nop-genhash} -\end{center} -\end{figure} - -\par -Once sled generation has completed, the return value from -\texttt{generate\_sled} the the NOP sled buffer if it succeeds. - - \subsection{nop\_repeat\_threshold} - -\par -This method simply returns the default number of times to attempt to -find a valid NOP byte when generating the NOP sled. The default is -\texttt{10000}. This is primarily used as a reference for nop -modules during sled generation. - - \section{Payload} - -\par -Payload modules provide the framework with code that can be executed -after an exploit succeeds in getting control of execution flow. -Payloads can be either command strings or raw instructions, but in -the end they boil down into code that will be executed on the target -machine. To provide this feature-set, the framework offers the -\texttt{Msf::Payload} base class that implements routines that are -common to all payloads as well as providing some helpful attributes. - -\par -One of the major differences between payload modules and other types -of modules in the framework is that they are a composition of a few -different mixins that lead to a complete payload feature set. -Payloads are at their base an implementation of the -\texttt{Msf::Payload} class. However, they also include the support -necessary to handle the client half of any connections that the -payload might make through \textit{handlers}. Handlers will be -discussed in more detail later in this section. Aside from -handlers, payloads are also broken down into three separate payload -types: singles, stagers, and stages. These payload types will be -discussed in more detail later in this chapter. - -\par -Furthermore, unlike other framework modules, payload modules will -not necessarily correspond one-to-one with the module names that can -be used within the framework. This is because the framework will -automatically generate permutations of different module types so -that they can be used in various combinations without having to be -linked together statically. This is especially useful for staged -payloads because it is possible for stagers and stages to be -automatically merged together at load time rather than having to -statically build an association in the module files. This is a -major enhancement from the 2.x framework version. - -\par -To better help with visualizing the payload hierarchy, the diagram -in figure \ref{fig-img-payload} shows the class hierarchy of a -particular type of payload known as a staged payload. - -\begin{figure}[h] -\begin{center} -\includegraphics[height=4.0in]{dev_guide_payload_hierarchy} -\caption{Staged payload class hierarchy} \label{fig-img-payload} -\end{center} -\end{figure} - - \subsection{Interface} - -\par -The framework uses a well-defined, uniform interface to work with -payload modules. Like other modules, payload modules also have -module-specific information hash elements. The table shown in -figure \ref{fig-table-payload-hash} shows the elements that are -specific to payload module information hash and the accessors that -can be used to access them. - -\begin{figure}[h] -\begin{center} -\begin{tabular}{|l|l|l|p{2.0in}|} -\hline -\textbf{Hash Element} & \textbf{Accessor} & \textbf{Type} & \textbf{Description} \\ -\hline -BadChars & badchars & String & The string of bad characters for this payload, if any. \\ -\hline -SaveRegisters & save\_registers & Array & An array of architecture specific registers that should be saved when using this payload. \\ -\hline -Payload & module\_info['Payload'] & Hash & A hash of information specific to this payload. \\ -\hline -Convention & convention & String & The staging convention used by this payload, if any. \\ -\hline -SymbolLookup & symbol\_lookup & String & The method used to resolved symbols by this payload, if any. \\ -\hline -Handler & handler\_klass & Msf::Handler::Xxx & The handler class to be used with this payload, or \texttt{Msf::Handler::None}. \\ -\hline -Session & session & Msf::Session::Xxx & The session class to create when the payload succeeds. \\ -\hline -\end{tabular} -\caption{\texttt{Msf::Payload} information hash accessors} -\label{fig-table-payload-hash} -\end{center} -\end{figure} - -\par -Using the payload-specific information, the framework drives the -payload class by using a specific set of methods. These methods are -described in detail below. - - \subsubsection{compatible\_convention?} - -\par -This method checks to see if the supplied staging convention is -compatible with the current payload module's staging convention. If -the current payload's staging convention is undefined (as would be -the case for a non-staged payload) or the conventions match, then -true is returned. Alternatively, if the current payload's type is -that of a stager and the supplied convention is undefined, then true -is also returned. In every other case, false is returned. - - \subsubsection{compatible\_encoders} - -\par -This method returns an array of compatible encoders where each -element in the array is an array with two elements that contains the -reference name of the encoder and the encoder's module class. - - \subsubsection{compatible\_nops} - -\par -This method returns an array of compatible NOP generators where each -element in the array is an array with two elements that contains the -reference name of the NOP generator and the nop's module class. - - \subsubsection{connection\_type} - -\par -This method returns the type of connection being used for this -payload as derived from the payload's handler. - - \subsubsection{generate} - -\par -This method causes the underlying payload to be generated. This -method works by calling the \texttt{payload} method on the payload -module instance and creating a duplicate copy of it. From there, -any defined variables are substituted as conveyed through the -\texttt{offsets} attribute. The resultant substituted buffer is -then returned to the caller. - - \subsubsection{payload\_type} - -\par -This method returns the type of the payload that is implemented by -the derived class. This can be one of -\texttt{Msf::Payload::Type::Single}, -\texttt{Msf::Payload::Type::Stager}, or -\texttt{Msf::Payload::Type::Stage}. - - \subsubsection{size} - -\par -This method returns the size of the payload as returned by a call to -\texttt{generate}. - - \subsubsection{staged?} - -\par -This method returns true if the payload type is either -\texttt{Stager} or \texttt{Stage}. - - \subsubsection{substitute\_vars} - -\par -This method substitutes variables using the \texttt{offsets} hash as -a guide. It also calls \texttt{replace\_var} prior to doing -substitution which gives derived classes a chance to do custom -variable substitution prior to using built-in facilities. - - \subsubsection{validate} - -\par -This method wraps the call to the payload's option container's -validate method. - - \subsection{Types} - -\par -Framework payloads are broken down into three distinct payload -types. The first type of payload that can be implemented is -referred to as a \textit{single} payload. Single payloads are -self-contained, single stage payloads that do no undergo a staging -process. An example of a typical single payload is one that -connects back to an attacker and supplies them with a shell without -any intermediate staging. The second type of payload is referred to -as a \textit{stager}. Stages are responsible for connecting back to -the attacker in some fashion and processing a second stage payload. -The third type of payload is referred to as a \textit{stage} and it -is what's executed by a stager payload. These three payload types -allow the framework to dynamically generated various combinations of -payloads. - - \subsubsection{Single} - -\par -As described above, single payloads are self-contained, single-stage -payloads that perform one logical task without requiring any -secondary code. Single payloads are the simplest of the three -payload types because they correlate one-to-one with the payloads -that end up being generated by the framework. - -\par -For single payloads, the module information hash's \texttt{Payload} -hash element will contain a sub-hash with a few key elements. The -table shown in figure \ref{fig-table-single-payload-hash} describes -the hash elements that are used by the framework and the accessors -that are used to obtain them. - -\begin{figure}[h] -\begin{center} -\begin{tabular}{|l|l|l|p{2.0in}|} -\hline -\textbf{Hash Element} & \textbf{Accessor} & \textbf{Type} & \textbf{Description} \\ -\hline -Payload & payload & String & The raw payload associated with this payload module. \\ -\hline -Offsets & offsets & Hash & An array of variables that should be substituted at specific offsets based on the module's datastore. \\ -\hline -\end{tabular} -\caption{Payload information sub-hash accessors} -\label{fig-table-single-payload-hash} -\end{center} -\end{figure} - -\par -For single payloads, the \texttt{Payload} hash typically contains a -\texttt{Payload} sub-hash element that actually contains the raw -payload. This is illustrated below: - -\begin{verbatim} - { - 'Payload' => - { - 'Payload' => "\xcc\xcc\xcc", - 'Offsets' => ... - } - } -\end{verbatim} - - \subsubsection{Stage} - -\par -A stage payload is an implementation of a connection-independent -task like spawning a command shell or running an arbitrary command. -Stage payloads are combined with various framework stagers to -produce a set of connection-oriented multi-stage payloads. This is -done automatically by the framework by associating stage payloads -with stagers that have a compatible staging convention. The staging -convention describes the manner in which connection information is -passed from the stager to the stage in terms of what register might -hold a file descriptor, for instance. Stages and stagers are also -matched up by their symbol lookup convention if necessary so that -stages can assume that certain locations in memory will hold -routines that may be useful. - -\par -Stage payloads convey their raw payload contents in relation to the -\texttt{Stage} module information hash element. The sub-hash -elements are similar to the single-style payloads in that it has -both a \texttt{Payload} and an \texttt{Offsets} element. - -\par -Stage payloads are meaningless unless there is a compatible stager. - - \subsubsection{Stager} - -\par -A stager payload is an implementation of a payload that establishes -some communication channel with the attacker to read in or otherwise -obtain a second stage payload to execute. For example, a stager -might connection back to the attacker on a defined port and read in -code to execute. - -\par -Stagers convey their raw payload contents in relation to the -\texttt{Stager} module information hash element. The sub-hash -elements are similar to single-style payloads in that it has both a -\texttt{Payload} and an \texttt{Offsets} element. - -\par -Furthermore, staged payloads have some extra accessor methods that -single payloads do not. For instance, the stager's payload and -offsets can be obtained through the \texttt{payload} and -\texttt{offsets} accessors. The stage's payload and offsets can be -obtained through the \texttt{stage\_payload} and -\texttt{stage\_offsets} accessors. - -\par -The code below shows how those hash elements would be set up: - - -\begin{verbatim} - { - 'Stager' => - { - 'Payload' => "\xcc\xcc\xcc", - 'Offsets' => ... - }, - 'Stage' => - { - 'Payload' => "\xcc\xcc\xcc", - 'Offsets' => ... - } - } -\end{verbatim} - - \subsection{Handlers} - -\par -Handles are one of the critical components of a payload. They are -responsible for handling the attacker's half of establishing a -connection that might be created by the payload being transmitted -via an exploit. The different handlers will be discussed in detail -later in this subsection. - -\par -Handlers themselves act as mixins that get merged into an actual -payload module class. The framework interacts with handlers through -a well-defined interface. Prior to initiating an exploit, the -framework will call into the payload handler's -\texttt{setup\_handler} and \texttt{start\_handler} methods that -will lead to the initialization of the handler in preparation for a -payload connection. When a connection arrives, the handler calls -the \texttt{handle\_connection} method on the payload instance. This -method is intended to be overridden as necessary by the payload to -do custom tasks. For instance, staged payloads will initiate the -transfer of the second stage over the established connection and -then call the default implementation which leads to the creation of -a session for the connection. - -\par -When an exploit has finished, the framework will call into the -payload handlers \texttt{stop\_handler} and -\texttt{cleanup\_handler} methods to stop it from listening for -future connections. - - \subsubsection{Bind TCP} - -\par -The bind TCP handler is provided through -\texttt{Msf::Handler::BindTcp}. It will attempt to establish a -connection to a target machine on a given port (specified in -\texttt{LPORT}). If a connection is established, a call is made -into \texttt{handle\_connection} passing along the socket associated -with the connection. - - \subsubsection{Find port} - -\par -The find port handler is provided by the -\texttt{Msf::Handler::FindPort} class. When an exploit calls the -\texttt{handler} method with a socket connection, the find port -handler will attempt to see if the socket has now been re-purposed -for use by the payload. The find port handler is meant to be used -for payloads that search for a socket by comparing peer port names -relative to the target machine. - - \subsubsection{Find tag} - -\par -The find port handler is provided by the -\texttt{Msf::Handler::FindTag} class. When an exploit calls the -\texttt{handler} method with a socket connection, the find port -handler will attempt to see if the socket has now been re-purposed -for use by the payload. The find tag handler is meant to be used -for find socket style payloads that search for a socket based on the -presence of a tag on the wire. - - \subsubsection{None} - -\par -If a payload does not establish a connection of any sort, the -\texttt{Msf::Handler::None} handler is used. - - \subsubsection{Reverse TCP} - -\par -The reverse TCP handler is provided by the -\texttt{Msf::Handler::ReverseTcp} class. It will listen on a port -for incoming connections and will make a call into -\texttt{handle\_connection} with the client sockets as they do. - -\chapter{Framework Plugins} -\label{framework-plugins} - -\par -The 3.0 version of the framework offers a new type of framework -concept which is that of the \textit{framework plugin}. Unlike -modules, framework plugins are designed to alter or augment the -framework itself. The scope under which plugins fall is -intentionally very broad as to encourage free flowing creativity -with what they might be capable of doing. The interface for a -plugin is intentionally very simple. All plugins must exist under -the \texttt{Msf::Plugin} namespace and they must inherit the -\texttt{Msf::Plugin} base class. Plugins are loaded into the -framework by calling \texttt{framework.plugins.load} with a file -path that contains the plugin. The framework will then take care of -loading the plugin and creating an instance of the class found -within the file specified, assuming the class was added to the -\texttt{Msf::Plugin} namespace. - -\par -When the framework creates an instance of a plugin, it calls the -plugin's constructor and passes it the framework instance that it's -being created from. It also passes along a hash of arbitrary -parameters, some of which have a well-defined purpose as described -in the chapter on the plugin manager in the framework core -documentation. Alternatively, a plugin could be passed custom -initialization parameters through the options hash. - -\par -To understand the types of things a framework plugin is capable of, -a few different theoretical examples will be enumerated in this -chapter. The first example would be a plugin that simply adds a new -command to the console interface when loaded that performs some -simple task. The sample plugin included with the default -distribution of the framework illustrates how this can be -accomplished. A more advanced plugin might automate some of the -actions taken when a Meterpreter session is created, such as by -automatically downloading the remote machine's password hashes and -passing them off to a cracking program. - -\par -Another example of a plugin would be introducing an entirely new -module type into the framework. This would be accomplished by -extending the existing framework instance to support accessors for -dealing with the new module type. - -\chapter{Framework Sessions} -\label{framework-sessions} - -\par -The typical end-game for an exploit is to provide the attacker with -some type of session that allows them to run commands or perform -other actions on a target machine. In most cases, this session is a -typical command interpreter that has had its input and output piped -over a socket connection to the attacker. However, a command shell -in and of itself is no particularly automatable unless wrapped in a -class that allows access to the shell from the level of a command -script. It is for this reason that the 3.0 version of the framework -emphasizes generalized session classes that can be used by the -framework, plugins, and external scripts to automate the process of -controlling a session that is created after an exploit succeeds. - -\par -To provide an extensible level of automation control, framework -sessions can implement one or more of the provider mixins found -under the \texttt{Msf::Session::Provider} namespace. The current -distribution of the framework provides four basic provider -interfaces that can be implemented by specific sessions. - -\begin{enumerate} - \item \texttt{MultiCommandExecution} - -This interface provides methods that can be used to execute -multiple simultaneous commands on the target machine. This -interface is a super-set of the \texttt{SingleCommandExecution} -interface. - - \item \texttt{MultiCommandShell} - -This interface provides methods for executing multiple command -shells simultaneously on the target machine. This interface is a -super-set of the \texttt{SingleCommandShell} interface. - - \item \texttt{SingleCommandExecution} - -This interface provides methods for executing a single command on -the target machine. - - \item \texttt{SingleCommandShell} - -This interface provides methods for executing a single command shell -on the target machine. - -\end{enumerate} - -\par -By implementing one or more of these methods, sessions can be made -programmatically automatable at the most basic level. Aside from -the standard interfaces, sessions can also optionally implement the -\texttt{Msf::Session::Comm} mixin which is intended to be used for -channeling network traffic through a remote machine. Sessions that -implement the \texttt{Msf::Session::Comm} mixin can be used in -conjunction with the switch board routing table present in the Rex -library. - -\par -At the time of this writing, there are two basic session -implementations that are found in the framework base library. These -two sessions are described in the following sections. - - \section{Command Shell} - -\par -The command shell session provided through -\texttt{Msf::Sessions::CommandShell} implements the -\texttt{Msf::Session::Provider::SingleCommandShell} interface. The -methods used to interact with the shell are simply tunneled over the -stream associated with the remote side of the connection. Any -payload that renders a command shell should return an instance of -this session. - - \section{Meterpreter} - -\par -The meterpreter session provided through -\texttt{Msf::Sessions::Meterpreter} implements the -\texttt{Msf::Session::Comm} interface and is also capable of -implementing some of the other automated interfaces. By -implementing the Comm interface, all meterpreter sessions can be -used for pivoting network traffic. - -\chapter{Methodologies} - -\par -One of the most critical things to understand prior to attempting to -write a module for the framework are some of the methodologies that -should be undertaken. The goal of the 3.0 version of the framework -is to make modules easier to implement and at the same time make -them more robust. With that goal in mind, all programmers wishing -to write framework modules should heed the advice from this chapter. - -\par -First and foremost, modules should be simple. In the event that a -module is becoming complicated or large, it may be best to take a -step back and see if any of the code being put into it might be -better generalized in a mixin that could later be shared with other -modules. This is especially true in the event that an exploit is -dealing with a protocol that may later be useful to other exploits. -An equally true case is when an exploit is attempting to trigger a -vulnerability that has a generalized approach that could be applied -to other exploit modules. - -\par -Secondly, modules should be clean. One of the key factors when -doing any sort of development is to ensure consistency in both -design and implementation. This applies not only to naming schemes -but also to things like indention. If a module has inconsistent -indention and/or naming schemes, its readability will be drastically -reduced. Every programmer is entitled to their own coding style, -but they should be sure to stick with it throughout the development -of a given unit. - -\par -Finally, encapsulation is king. If a module needs to perform an -action that could perhaps be changed to a different algorithm at a -later date, encapsulating the operation in a generalized interface -is a great way to ensure that code does not have to be rewritten or -otherwise altered in the future. - -\appendix -\chapter{Samples} - -\par -This chapter contains various samples that illustrate how the -framework and other libraries can be interacted with to perform -various tasks. The source code to these samples can be found in the -documentation directory that is included with all releases of the -3.0 version of the framework. - - \section{Framework} - -\par -This section contains samples specific to interacting with the -framework itself. - - \subsection{Dumping module info} - -\par -This sample demonstrates how a module's information can be easily -serialized to a readable format. - -\footnotesize{ -\begin{verbatim} -#!/usr/bin/ruby - -$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..', - 'lib')) - -require 'msf/base' - -if (ARGV.empty?) - puts "Usage: #{File.basename(__FILE__)} module_name" - exit -end - -framework = Msf::Simple::Framework.create - -begin - # Create the module instance. - mod = framework.modules.create(ARGV.shift) - - # Dump the module's information in readable text format. - puts Msf::Serializer::ReadableText.dump_module(mod) -rescue - puts "Error: #{$!}\n\n#{$@.join("\n")}" -end -\end{verbatim}} - - \subsection{Encoding the contents of a file} - -\par -This sample demonstrates how a file can be encoded using a framework -encoder. - -\footnotesize{ -\begin{verbatim} -#!/usr/bin/ruby - -$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..', - 'lib')) - -require 'msf/base' - -if (ARGV.empty?) - puts "Usage: #{File.basename(__FILE__)} encoder_name file_name format" - exit -end - -framework = Msf::Simple::Framework.create - -begin - # Create the encoder instance. - mod = framework.encoders.create(ARGV.shift) - - puts(Msf::Simple::Buffer.transform( - mod.encode(IO.readlines(ARGV.shift).join), ARGV.shift || 'ruby')) -rescue - puts "Error: #{$!}\n\n#{$@.join("\n")}" -end -\end{verbatim}} - - \subsection{Enumerating modules} - -\par -This sample demonstrates enumerating all of the modules in the -framework and displays their module type and reference name. - -\footnotesize{ -\begin{verbatim} -#!/usr/bin/ruby - -$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..', - 'lib')) - -require 'msf/base' - -framework = Msf::Simple::Framework.create - -# Enumerate each module in the framework. -framework.modules.each_module { |name, mod| - puts "#{mod.type}: #{name}" -} -\end{verbatim}} - - \subsection{Running an exploit using framework base} - -\par -This sample demonstrates using the framework core directly to -launch an exploit. It makes use of the simplified exploit wrapper -method provided by the Msf::Simple::Exploit mixin. - -\footnotesize{ -\begin{verbatim} -#!/usr/bin/ruby - -$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..', - 'lib')) - -require 'msf/base' - -if (ARGV.length == 0) - puts "Usage: #{File.basename(__FILE__)} exploit_name payload_name OPTIONS" - exit -end - -framework = Msf::Simple::Framework.create -exploit_name = ARGV.shift || 'test/multi/aggressive' -payload_name = ARGV.shift || 'windows/meterpreter/reverse_tcp' -input = Rex::Ui::Text::Input::Stdio.new -output = Rex::Ui::Text::Output::Stdio.new - -begin - # Initialize the exploit instance - exploit = framework.exploits.create(exploit_name) - - # Fire it off. - session = exploit.exploit_simple( - 'Payload' => payload_name, - 'OptionStr' => ARGV.join(' '), - 'LocalInput' => input, - 'LocalOutput' => output) - - # If a session came back, try to interact with it. - if (session) - output.print_status("Session #{session.sid} created, interacting...") - output.print_line - - session.init_ui(input, output) - - session.interact - else - output.print_line("Exploit completed, no session was created.") - end - -rescue - output.print_error("Error: #{$!}\n\n#{$@.join("\n")}") -end -\end{verbatim}} - - - \subsection{Running an exploit using framework core} - -\par -This sample demonstrates using the framework core directly to launch -an exploit. It uses the framework base Framework class so that the -distribution module path is automatically set, but relies strictly -on framework core classes for everything else. - -\footnotesize{ -\begin{verbatim} -#!/usr/bin/ruby - -$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..', - 'lib')) - -require 'msf/base' - -if (ARGV.length == 0) - puts "Usage: #{File.basename(__FILE__)} exploit_name payload_name OPTIONS" - exit -end - -framework = Msf::Simple::Framework.create -exploit_name = ARGV.shift || 'test/multi/aggressive' -payload_name = ARGV.shift || 'windows/meterpreter/reverse_tcp' -input = Rex::Ui::Text::Input::Stdio.new -output = Rex::Ui::Text::Output::Stdio.new - -begin - # Create the exploit driver instance. - driver = Msf::ExploitDriver.new(framework) - - # Initialize the exploit driver's exploit and payload instance - driver.exploit = framework.exploits.create(exploit_name) - driver.payload = framework.payloads.create(payload_name) - - # Import options specified in VAR=VAL format from the supplied command - # line. - driver.exploit.datastore.import_options_from_s(ARGV.join(' ')) - - # Share the exploit's datastore with the payload. - driver.payload.share_datastore(driver.exploit.datastore) - - # Initialize the target index to what's in the exploit's data store or - # zero by default. - driver.target_idx = (driver.exploit.datastore['TARGET'] || 0).to_i - - # Initialize the exploit and payload user interfaces. - driver.exploit.init_ui(input, output) - driver.payload.init_ui(input, output) - - # Fire it off. - session = driver.run - - # If a session came back, try to interact with it. - if (session) - output.print_status("Session #{session.sid} created, interacting...") - output.print_line - - session.init_ui(input, output) - - session.interact - else - output.print_line("Exploit completed, no session was created.") - end - -rescue - output.print_error("Error: #{$!}\n\n#{$@.join("\n")}") -end -\end{verbatim}} - - \section{Framework Module} - -\par -This section shows some sample framework modules. - - \subsection{Auxiliary} - -\par -This sample illustrates a very basic auxiliary module that -displays the currently selected action and dynamically registers -a command that will show up when the auxiliary module is used. - -\footnotesize{ -\begin{verbatim} -class Auxiliary::Sample < Msf::Auxiliary - - def initialize - super( - 'Name' => 'Sample Auxiliary Module', - 'Version' => '$Revision$', - 'Description' => 'Sample Auxiliary Module', - 'Author' => 'hdm', - 'License' => MSF_LICENSE, - 'Actions' => - [ - ['Default Action'], - ['Another Action'] - ] - ) - - end - - def run - print_status("Running the simple auxiliary module with action #{action.name}") - end - - def auxiliary_commands - return { "aux_extra_command" => "Run this auxiliary test commmand" } - end - - def cmd_aux_extra_command(*args) - print_status("Running inside aux_extra_command()") - end - -end -\end{verbatim} -} - - \subsection{Encoder} - -\par -This sample illustrates a very basic encoder that simply returns the -block that it's passed. - -\footnotesize{ -\begin{verbatim} -module Msf -module Encoders - -class Sample < Msf::Encoder - - def initialize - super( - 'Name' => 'Sample encoder', - 'Version' => '$Revision$', - 'Description' => %q{ - Sample encoder that just returns the block it's passed - when encoding occurs. - }, - 'Author' => 'skape', - 'Arch' => ARCH_ALL) - end - - # - # Returns the unmodified buffer to the caller. - # - def encode_block(state, buf) - buf - end - -end - -end -end -\end{verbatim}} - - \subsection{Exploit} - -\par -This exploit sample shows how an exploit module could be written to -exploit a bug in an arbitrary TCP server. - -\footnotesize{ -\begin{verbatim} -module Msf - -class Exploits::Sample < Msf::Exploit::Remote - - # - # This exploit affects TCP servers, so we use the TCP client mixin. - # - include Exploit::Remote::Tcp - - def initialize(info = {}) - super(update_info(info, - 'Name' => 'Sample exploit', - 'Description' => %q{ - This exploit module illustrates how a vulnerability could be exploited - in an TCP server that has a parsing bug. - }, - 'Author' => 'skape', - 'Version' => '$Revision$', - 'Payload' => - { - 'Space' => 1000, - 'BadChars' => "\x00", - }, - 'Targets' => - [ - # Target 0: Windows All - [ - 'Windows Universal', - { - 'Platform' => 'win', - 'Ret' => 0x41424344 - } - ], - ], - 'DefaultTarget' => 0)) - end - - # - # The sample exploit just indicates that the remote host is always - # vulnerable. - # - def check - return Exploit::CheckCode::Vulnerable - end - - # - # The exploit method connects to the remote service and sends 1024 A's - # followed by the fake return address and then the payload. - # - def exploit - connect - - print_status("Sending #{payload.encoded.length} byte payload...") - - # Build the buffer for transmission - buf = "A" * 1024 - buf += [ target.ret ].pack('V') - buf += payload.encoded - - # Send it off - sock.put(buf) - sock.get - - handler - end - -end - -end -\end{verbatim}} - - \subsection{Nop} - -\par -This class implements a very basic NOP sled generator that just -returns a string of 0x90's for the supplied sled length. - -\footnotesize{ -\begin{verbatim} -module Msf -module Nops - -class Sample < Msf::Nop - - def initialize - super( - 'Name' => 'Sample NOP generator', - 'Version' => '$Revision$', - 'Description' => 'Sample single-byte NOP generator', - 'Author' => 'skape', - 'Arch' => ARCH_X86) - end - - # - # Returns a string of 0x90's for the supplied length. - # - def generate_sled(length, opts) - "\x90" * length - end - -end - -end -end -\end{verbatim}} - - \subsection{Payload} - -\par -This sample payload is designed to trigger a debugger exception via -int3. - -\footnotesize{ -\begin{verbatim} -module Msf -module Payloads -module Singles - -module Sample - - include Msf::Payload::Single - - def initialize(info = {}) - super(update_info(info, - 'Name' => 'Debugger Trap', - 'Version' => '$Revision$', - 'Description' => 'Causes a debugger trap exception through int3', - 'Author' => 'skape', - 'Platform' => 'win', - 'Arch' => ARCH_X86, - 'Payload' => - { - 'Payload' => "\xcc" - } - )) - end - -end - -end -end -end -\end{verbatim}} - - \section{Framework Plugin} - - \subsection{Console user interface plugin} - -\par -This class illustrates a sample plugin. Plugins can change the -behavior of the framework by adding new features, new user interface -commands, or through any other arbitrary means. They are designed -to have a very loose definition in order to make them as useful as -possible. - -\footnotesize{ -\begin{verbatim} -module Msf - -class Plugin::Sample < Msf::Plugin - - ### - # - # This class implements a sample console command dispatcher. - # - ### - class ConsoleCommandDispatcher - include Msf::Ui::Console::CommandDispatcher - - # - # The dispatcher's name. - # - def name - "Sample" - end - - # - # Returns the hash of commands supported by this dispatcher. - # - def commands - { - "sample" => "A sample command added by the sample plugin" - } - end - - # - # This method handles the sample command. - # - def cmd_sample(*args) - print_line("You passed: #{args.join(' ')}") - end - end - - # - # The constructor is called when an instance of the plugin is created. The - # framework instance that the plugin is being associated with is passed in - # the framework parameter. Plugins should call the parent constructor when - # inheriting from Msf::Plugin to ensure that the framework attribute on - # their instance gets set. - # - def initialize(framework, opts) - super - - # If this plugin is being loaded in the context of a console application - # that uses the framework's console user interface driver, register - # console dispatcher commands. - add_console_dispatcher(ConsoleCommandDispatcher) - - print_status("Sample plugin loaded.") - end - - # - # The cleanup routine for plugins gives them a chance to undo any actions - # they may have done to the framework. For instance, if a console - # dispatcher was added, then it should be removed in the cleanup routine. - # - def cleanup - # If we had previously registered a console dispatcher with the console, - # deregister it now. - remove_console_dispatcher('Sample') - end - - # - # This method returns a short, friendly name for the plugin. - # - def name - "sample" - end - - # - # This method returns a brief description of the plugin. It should be no - # more than 60 characters, but there are no hard limits. - # - def desc - "Demonstrates using framework plugins" - end - -end -end -\end{verbatim} - -\end{document} diff --git a/dev/documentation/devguide/logo.jpg b/dev/documentation/devguide/logo.jpg deleted file mode 100755 index 5e495ab37e1921d59b019756967c55e25ff130c6..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 53476 zcmbrl1CVAx(=Pb7ZQHhO+qP}nwr$(CIo;E?HEm;>JKyg9H*Uo4-hVf?PMnC0s616! zQB{d2^Zcy;>;n*`#ihgnKtMnM$$t;v=Kz2%=4oXP0LaM!r~v=~5KvGscyL&7I5+?hFen%}2m~Ym2@07A1&v7v6`fcK8pFtG1rv*u zSxsFtC@C#Hqo|35jCJVj4x5~XO;}V_D|2D(fL%=4*z}%)l1s$I+08vTym)r2j|@^dEU3z`;Pk{`LMN!H@vp z|3qOzB^H8EGIByAVHOTbY9eJR8alXxL}yiA5OKa2RWS};{MiJ+g8W-B5(pAN0I+u? z$GQ~Hx+KT>zaq4&e2HkMy5TW!a5z;=+(x|GReCEV&s>_hkHof9S!DLtC$|rjnRiF< z+@*~}m}B~=9FiyIb;IcNCF@uz=(LfKRPk!u)~wPpxke|V6R_zCGuEIe(z8KuCUnwZ z$BH`FxJBt^@8=Z_orJr_u@DP`6>@imbDLAHfTSjTMuVTHdX>dzo%n8y3rRupmUwNmH+fQFfyHpO*c?UAJ|cdmxnSW zL;6`rP`8n-zSRR>7=n4Q8%SBLllas^8`jl?`@mc&DHU{46&3Ll^Mw6EBM8Iy35jNb zl|UdNA?-=JWN|L5B4S<~8|z&e3}8 zKcGZ=Pg*PJ1lOP9CXF+FP(4Wvx;N;CBS3Ga*A#vIbc{_BsbmV{n5w(=Eauu5C(|2F zhy>@{@D0`Gbtl%vi$=!)KybaZQLHw!&a{b*yAz4x6HRxJpM%FhptfER=^f?S)`dQB zK7L&I|J~00zuDdY@c6F8D6x|$@AnBQ6-g#uqERXv(y>Mi)cXNSQy3q)A%lG`Ee%X#50tf+iu|(I_ zW1X$~1yx7k_8xlg)Im7078v%6oQnzNqmlRKm#7*)WAOu?+472oY$@h(qsJrQDqWGnrWZp^sD3gJ7MF zj=%WPax#5doRtu9cLx6ymva8Zd1g=G4**3ceXCuGevk|$lE7YwasmZrL>#hg&6$R3 zLFGn6dx7NPqt_poq46{PdqCdZ^SnH}+nLv@JlknJ+o}Th|07XJa)5GA(TB^_=uG6* zv@=W?eK+TfjAXSw&k~QUxh>8?nKqa{nSm8+txWmiy8m>JUcu;AiC4fT0>{J*fYO_3PDOvGqo@fz7yy^l;1 zPwsB6O06eqg^!m#pp)90vg9~npe@VKD=k#QO1qt7MwHrBBbPBU2Iac6vB;U!XgD2m zgl}%u^f>HD{{`>5vm6_Y;7;WdnxkT}5+X|I1VCm=Ls+?#s2CwJz61js;Z0~^$aB@- z4r?^%n+2g)pypUF-^!lP)$)!mFDnH`57B0yCHu{HdBrM1w@+sQ#(`6*F`+tdh-zxX zgoxDVsDFXBFJQKUqu~gv$}0X*^=qcWHF5wBOzJBOicj%Tks|~`Nu*LC@)|D+EGB1a zlggD>kbiKB+7F6jjaIXL`BqEi%5h9_WpK}4*y4tJFsDzzhvU~4?wAbU}W#z&&WPN zXL*eU(;n4G){^wJGNeO(m9c#4ZkbEc1u~icAR4PuJDh^@hV=?`aJwfEHS84evSj4k z*j8rR9H;OIvkW3&M4wc1$aycdCY(?3nC@*X#V&c)Zz=?@StvoX`dX@}yTq-85H%eh zOA?L_Iz%`Tb46jpFNv0JF^0fdYbUv*i%<*2r_jY%&AP+3mhvH~JYL%+5B3a~)%ifpyYsSCOi2*NaJ4 z*VHcCDtqfu%h#WPcz}a9ui}z9tZj-NpOVvEyO7Q!4%e3~NF?>j?`w-N`i6515iH){ z^AU)x_XE&-Y#)#l(#OVv^{qeniok-cvgGd5gY|8ncL57lWMKV5wdzYgQ~>}XB31BP z1(bv1mmi~Ro^ZW+|#uRgKj`TntEHQrVx;(`YKK_B5w-#pRYh0KG)_!d3VVVp!wp6==IDf zK(UTM#_B6W0}Ek*2j)G@@?A&%KP;_bZ(N_gEC!J`_P_3z==SVta_#eZf7Qdn60M#z zWACF>#-8qVU_o6LI|*U$$NJ!H8~s*yUO zE8j!SnLTzTGAQ9cfW5!I`CiT#nOm+%JgoWLIFTPjvH%XCEqSi0-TzWPbIW_dMp>@S zI^ohZ6htn>GZEn^88DJn%uQ6=|KZ{Pt0|L^i3uZ4x6HTW1u4NKtP|i8R^Rz?4+&n> zD{7=x=Wg?#eag0n7Axj%t2e@5rQiv~YrjxvcYFX*pu zUJ(NeAwvREgE5W`0oxFj{t6kYNJ9WAxB3Q5+tF%6Wt$(s=<2l&XH1eT4)-Rmk)2(z zPS`PAU*Og8d?_+yrr-(tFi|7eXThk)-4DRMEka4|;-p;fN(fi+<5sk~1?2Xuv*Yd? zB46T~ju}f=a|+ z`$-zu+RxxqmEIZF=1{`uc1blaTE2MP6qow6Yhq#BlJsj5Nu&bK8SHxIsJ2(MMQbOw z{#q_K9O4bHw5n;)hXfN6WK%)b1CgNM@AK*p;4a&EQH+_bX2-y+zBMyn5*2C6UTi*z zqoWuD2wr{leAh*9GDV}K^-7uEQ$`MB?%6J&*|+O<#Tx+d1$MjrMtaZt zutd1$=W4AO8t^Lu8<#B`)_;5&8l1hEoS}l-9z)^Wka8`xAFIhq4CgUr*4M@WsUqM&rs2BAz~k{rh*g1>;tb8YLI0OTQK}nS1|vm@;wvn6+IW zF$!%o0NacZ(;B;IHeg?-X8ui(E8UjpKqDoCC~GxGZLBNl(B!N9n6t#GN}$)Qc1X#^ zXu=7?(yfp7G(hqYCzI$97y!WSI`qHYl|lKN2Kwdy;7M@%h>yVC-#LED#4-~3qH3z+ z(xhj^&_U$OzO+I$ZOTT6*Fq_D{TK{CTM7)b#p~LPeImg5E}P#z4#X9W7FV8~GkO1? z`^KQLzqV7@ifh@}=3K@fJI|B&>zbuVBH#!__tJnnYC^(juc02^=>TZ2Frz_lLT}jn zPyO&^Gdlz$lm07o{t#W>qz{#gI^{ZO-wtfoLc}W&Bm75%`KIH#w_X1?_N~%?@3a38 z&rgrF022Nh?Cgl5fcdT#?GKZFiMH#$UN>A)%sB1P`@b+PYCoJQuKkoTGC^4`Q zWwQ%|%a8`JjiC!AQ`#u%H;&};c;0#42tjEz!9@Q*?!JwEJ!tvTJfR0a{H0Q~likTe zO$cm&L?@k1hNzxSDbg8${^0A}!=^%!f0-+AD=5Th%{?!9=Iut*P#1^IkW6UDW!sYM zUUJnsurbb|EO;d#QDhAYlm<+*HV-@U@@5P;&NVF>f)bS)L88A0oF7))W~IO}`w%Qb zSwr87oMsDV&G~v$h%qS2^5zNKjnL7~rW7?4lsLnvTlTxSs0M(#CPgJBduW0i&*c>W zflMY(F*Jjav8w3i@Cwy_smCRfy%XEFa^dGouk(kKhRJ<<+?EfUkk|>t9hi*$&e+pKYQb|HeYQ3tyM$Sv;V?E9IWciHtpLFjBmcR(|(8(P@`?*bUx17G2J>>4f;ym2W@z? zJ7e?+kI#DEfs-l=Bro8?j6c6q5)|s?7f#)r9Mxrw%Z}Ghe~^_OpeqAqn{I}`=_{Z7 z95<>az2kkVbz2h_xC1rTa*X9DP6Yg5A)V-*;8$c)6(t{>ST<=tOKn}wIj?mYL@!3- zC1dmef5?)WTUGGeaqD2Hpy>e;{seQ0_u)?aV|x)NW25rhkV%>t3<(H{Z3LXOD&6}L zlQDoA7NN6xpq*n5|4ewBJcAdSt4QgGXP~?@HRjWSzzz+n14x*jVI}UkJ;IF z-9j>S*N$NBkzesU%Bp)f*G$i5R53w8F=Xjd&7No3@j^lIXw;|zy&nOeIj+W+9cTN$ z^cs75(H#%F(+JCUciFdNWH0+i{)hm&Rl+;(MT>!68h-#9>_~rjzjz@$aQnYlm*hE@ zKBf^-LEm50&L$M!1@cAp zNqp`bzSKFb=mR0(g3SwRe`0QFFQzxu+W^3JbN#2S@_SX0sDkdi%D~@3OcKsPp+he{ zHdP$|lOQV@jxDnn>l%qDRn%wDQG^;TSj`gH_I$ulqt+7jD=l6Uh|G(r#mb8oJ#dN; zn_C}5@?i$HT(f%W@x3^M{zhM$PID*t5OVt=p%w_g9 zs~^CzM3%s}sx!k6;Qm~{WFFi!FeLN`0DmEH0FS=`X7U5LL3A(M{Q-PZT%T8E_|f}i zwxn0v@J@Qgb%t!Lo@#)qR9x2g)%C+|(}$uTwezD38rnG16sn;+8dX|Hq_~GENT$Up zw!&1|IXo?w2^lj3!jzgf8~Y&+{kmv<3jD4Uf?D=NK6{a-Bj1>}AV98g2)^eAK0XUx z)(rv}MhWPPegN1#fEi9b@ zIzJc+WMpEoBA&KA%02smK{CU+(=B8(`6M^5cp{fttX3wk-sWOXk7eG}`Pnk0Y%v8W z$)@XBo!<4G5tZuiLcz)=p-AP*O6$HOH>{3fDVEt{8nesjRGmtfu1<}yU#LDyJ)JuR z-lpv!lT)Z3NQ9`?$WVR%PMd`MoW(O>NF*G)x9An6u7jkynfL;WVUF-`ecO5=bx_h@G%x!^_T4;>*fGGH4NlsCj0V%5H&+3yF?8{ky(^h%)cdX!}FZ*#W; zX8s+0HJU2{qA#w?f27h;oV%ef3{TS~Kk#u`k!oo*#%65^7PIP6BQ)mqd^@6XJBr^c za>y*aq~R+jLZcg=TfwC#K@gF9PzmW{@@Smnu9q3z*oJhj`yU-4UY95wBg8!uxED&y zLOxM|M5WaP57yIv1IzuFi9byofa|^v5vMici-P_vacbD!y@qyR0m}?~sv5roVl(KblFP-l8FIN8xw%zsMN>2!JhXTXb6pty$ol1=e zx9okM^FQE%N?X69uOGmJKmo4JP%p$O!A=ABR0r~mK96!bW%s$ZPlEl{nXG<`P};na zvZOOq4PY4&3skr^sH#3^i7A%wpX0Prs>sAq)qVo`0Q%wi15j{y{mvojk_gRlQoL(D zm=Wb)cl5zfgLM4?;I}BIedF=^2>uoHK*&$^>|`2t_K6#Sn#G?1t6;|(5TwUDF9Y+? zH|JzKpDcge27e1B7cZ5Q)CbQhK};QsU%@U@6SgcSlsA!!$bNb=EGF@Q!^ek&7{iA> zlosI6k1!%+9rSp-0D18L<>XJ8%i?4bmDgg`p2dQh=-&8hf$?GIeEpf43>mGm$TlgCEcOA1cY_~P#J%Z(7Wsat#c z^wyvSM0>bvLd*%Pcywz!XI6AhR+d$MQLOS3oAK{6pla4QNnX2hrFA(kl+fT)F}tpm zjxg0*lwc53X5PI0w2l9ZFlAXzA^{v&sUW_Ng=#2h}qg z=P!Nr5AVa5)d*r@_I^3N^hyw1lX#kZsGa9yZV-&tG82k)^0Q5qz`5WhvdY=-!^wKuliGR?%!B&l`9M}-+xzju1_6ds#bZ~<+wUiKM{f> z164I8^6&*x1qR7t|Gwl-*ooModcWOKdHnYIj!444e&cvn6FB<^m{r$%{~uda8wZqFHlzLav4HrN0S1Yrr8E> zbRN_`%uPRf4`T+0H0eu!E68Y(YD-q$l*jE46NSa^%SL-11Ub$#5Ay$VlK;*6KknWC z9dUv3CeLALKY$(E3mPpZ!`4Yw-Wq3!2O1W!IY~KL6+Z~Jo&hy3(!K*)bV$-)iJ<%; zP(Q|VnY$6=RYip+MenY-*OjAO2mlU&4L+U9#e`HuFfA)zHY^7a><2tl- z5IEt~iS4(02pwWi@LP7cWR6ZvW4;bJP9aY02#uG31iJ0!RH|_CZ{;{q21%F%Iq7$` z4S0l4oXjGiyt%|a5XX(ef58h;JhQn*K`4UnXMl)iYF*faqNtJ}g+dzu-9sF_K7cwH zM7#$a{k?qPQMB-v(B2E>ail-~rvjP=SH*QgeA#Z*1^f9qJ%q|$5!=U4HOtt+eps+`1$8?5nkRwTC-?u(qeb#`vVPbI{xO zVt6x9r)^FUs7PUBNO;w98kP{oONzbmX+Z|T;;2G{vPJpgkwd|~bz$jNM98!0#3+#1 zwKQ#c_-GvKt520Vb)hwNBb$vwy6E`va(4}qdp<)~Qi7<7bO2}G5 z;_DYAu0Tn)$qTDM5+hAu;z&+XL-_@>ZA#=_`EfK|@4p?1Y~8HA`M4OYR)E3Y#MPgB zQ`+foHV4w|8R_mC=Ry%sEj?ZKgK;~=b==G>Xxi`f9V6O1b5#=-{ipCF$=_8RXt-2shu5Wn82|AfTe1aHF4L`OKk6o}{>{{BZn!;*o4 zy_&($)C{2D9&bk0ugNPYWrHZ}{JtspR0!oXw57KpOs02_rhS$f3RarGZee-SXdH|7 zE*Z#_*f~x>XCBz_CX3m=Z|j_rcdl1^)#9DX)BIjyx@J&6N(03~rrW{doFW>F-m_ zC_S)epW`8y5FM`?UZt8obfYS5MG+;%(lce1@~GcM)0|^Wx?P}dqp?Y`=}Ao<_|M>6 z37;g)^b75{*TXK^ZN0yuSdE|Z8<=9<@T19#HeJGyA27pkYLiuSxKJC}ELJ>2OB*di z3*)SU1Fyg%9HA9X*(O2Cuvh0Imi7dFg4#*Oe*kcn2=%!x*oFha6ev#ASt5Rlj96!v#0ZNw2S7e@d;mB z?e1>J2W2kJPCKJ9EkOzVPOEr1Wvk#YOMbS!T%&WzJHk^6&>Luv4o5m;8f@!*{sr2) zq|X6#hls~{mglD)p>}^}-VvTAE`7D$)pp*dB`T=1#*vA^5$T0vv@SB^2p`gTdGgO> z+@?3bBK6;He8{h*8fA`CxP43ePGNaLeUVo2Kp~6)%n-k zK9Uj<=$Ng)W6?^>9l;Yu5@5IH1O(V-BWV*ifPA^epT9HuRS_C3hsJ& z-$T)bge)u@LVFHcI&`t#4bQ6~Q1}yVnhZ}3)~=TmGNHp+xcf4h|eci`Ch;Gv;2dn2SLz;N?1wIgbBHZqJ@P!FS(*7 zUWtkM27|rZwIoW&8=?;h9R|lAfJi`Rwk~b(1Z+g)I!qaHtNQbz`av8Dt!vx*dGdTE z@tm1qC!FTIpPg7G|Y8h(-b|uUYz?PyDCKb#f zShi=m4)Q32dTfUbsT5p-qwN)%L+E`+)_Sz8uHH_r0gbpmZ;CITe@PkfJlaZ@b+k&I zPV+3h-EHR)f#U7*;r{4fY7~TuwlMg7Yq#g2@5owy;;Ip@n4`ItZ@jCUV$d%lix(s^ zZ4jGe@`G{wkFodZo*`z8*olv>;$8()pHHFPh!G+ssyBFv#_(xlZF{&9a~G_bM7#X1 zuR{+*ncN((mMj0Lfe-VcA|eX>sbvTwKjt8@{$iQj3nTpE>;9$j)mjuks_tyqq-MdOwegy!15A4TRtgQ+C`T=~mYX&I0<9uaa@b1AT^m<{Qj^BHd zUN>8SgAy*UR*{lJAw7XVSD^J}kYY1ol_=&8lOtA19ug_o{q>5rz`Yq9D>V$kavE#h z5yOjYjS>y`M1|*)?fC(G1=tt25=6RH`yR6SaXL%^u^QhC(ai!sXt&v*y;#zZ;)~!F zciZl6N(X{r`E|Qhs8?sJa)qgC50sS=B_O30Xz4`s?c#g|bB1_TjrS>(xj1z%Nkd_h zWb&i)!XuiOq(OLPb(PNLWdaGd38hDHb%idspPVkaM2pj#`b&Hg^5$nBY}dUrrFI4c zuiDUEd83nL&XhNAIgz#9x4nEMCq)}#$*Q}4IyYgqQOek;R3Pc*7fWdeUur2%jCsF^ z_Z6LE78R(x+BBO`!+%``1Gq^h7bx~bJ?|7c0at(ddC?U8Ce{q*bvF?r1(4VMarJvq z#$K>34IFl@%-B-f?H0yL&cPzIyug-Yn|5ddkA-n7h~hVol+l2TwJnId_`Ii~=EcdY zvy2_Ed~nMT%bYw*;{E};-nNmIrG8ciHWr;B1NLDUgh*Z1mqWnabr7c%Wc12VR`#ra zpsEVCR!`aDv5r#y)(jWK>?#RSRM)#}-6J;JVAau*qfuy~P0Wh6CP(6FnnvBzDK{t~ z82d24u07yOXveXLTfweBLslE+%Y{~no`p0Dc_eOBBPT22El<2Q4E??Vs8^+kQ?;|-xc5t?{L}g zox(73?m>+FG~OD^#^ubr+Y+wlvOU^BLP<#7tvShwC}c=5W63F7vjjr#n`V>s3*|UH zMglD1Ux?If<>WcheK|3u3RSQ`TGvfDokmURYQe1?vsgwPuBw0rUF$}iZq`|We*(vc z`7+!jD&7w6j(>Hr&TNBX%Sm(zVc&eYr-pOyW-MZZ=6T@RSOkbKY*ERbb*J~w3nRbF zj$h3asZZmkZV$pUV}0heQ{WQ@+VXFWWP$jH)9-i#F1u8?oaSht_NUS~hae^SYjyl_ zHLRBgmwb4~9NIZguZExruZRsyR?-C-1LKDkw*vUP5`rgUjgq$YY>z%-v~&+W$I!D) zU48(TMsRDRIxEi#t62L|fi}?M{F1 z&N!}rH;d1vsk*W*W0$VogM+rq!3*0lcxG93sP$pnomeqc(F7Y z;Mgd=Rj9rjJLk45xMcJ}P_KQxSOt)v7h=-9sg9cvS;lqtv5Sy2QRdCK#&t?pXHvJarmY^l zH;XI!At(2_wppnF>VfLo{?6Qfg?!gpK97r^>CR#4DxP%}akfr5bHF?V|I+sH^GRhP z4DQzN^7Vmh@*hD}OI|Kv&Yg8abglpN7)!A`3q7N%U#B zLJmN{dBwqbClFAmAiPpVuG9+rN+VetD+QYi6^jO4lK6C6dd5{Gd|0- z)g^Q8F*yz>iANyFDaHLw?);a=we@rIx=?BC!Zpw`e{m0ai=+3fJ8o4&(4!?Ht}-9? zTC=(S0pRT7O|pcbZ~o@qgONgY?Mm4)!eZJcOSiu)w7I=XY%$)IPSZ<(@4lvM$e3G% zAHTLwm9G=+)~$xMm0plm$gi6U9$z7+|ZPPq!+ zr759J{z60@#&Dm=*Js_Wl1W$L z(4CZ{=Z?1rrA$D~&$1i-=kl3DCk% z#>LcOe!D1nDRdE2genZxo3f@7HVlQ)WBOuK{pCc7v7B~D9@G{Nw2%#eLjr&4JE_YUruPK3= zcZS#HMPyCl{3Oyp9u&J%W%~Q$uN?}>{re3t8DN_OPg4WW7tMbnpXP4>d_p_4rtHf} z_TM47>m{LWjkZR5mJ}Z^PFr~uX+xq8Qp1rsXDGL%Zv?mk<%#hOP&q=zDyj31 z`vdl20GI*lxK8g|;8y%WlipzY1s|8lsQU`uB>|lLNg81$^?EMcmr+!~c>h-bpX1Ju z=A|gG{||us{zibIVl6NBlaMC39%G%#V3w(Vi}+t<36V9Z7{QFJ$4V@E93zSv;%0Fm zrTPUAg5Wm4+yH$ILkMu7%J2vTszYa3WL)v5q^_P4;PVGClyJOKV9U?r`g*BuI`y{I zP4Qhk_xu;mA@Tprb`%sxMurcQER`Sf-{f5C@3Mx*R3wDNCg~DETRR!6+|uORQ{G9& zF+$tpxMv^$ht08cNt4xRXP1*yfv8qO&nO3BW3xODbGO zt$inf+`M-*zEDVb;{)NGWxU(my$})vOx(Qt?fSZC*~6)59%nyGEl!jxa^-M3aUHZn z;nC%$P>|CCDXuz1G2g-e0A|oT$0iu<=Xh?WWO54QSnNeqRx_eSY3Xi}XI~@V1xm>6 zW^-dIS5y7hI&tlv(uR5efoidH$BKLRZtI}#;0I%gj*Ffo+e#gu^9i+ub@!%!(yWhO<$FT&A>4bU@Z|?=B)r%1?Go;2 znmkr`ZKrd4J?)q@c5yPWTNuZvC0szo7g|9+<6HtbsDzph_4q+g0h9=Kh``~8auXhY zYPS%&dL?1Gtd2K>v_(?w%0re~Cn`@7)zW@((_PO9&i2qmR1uY}GiB22g9nXJmZ*gQ zCm&Bxw-i#^byw5w7GZV`@cNT#N19>nyImT-0#1M$LkLD zL`W^%otdyDNzUt?k#*NRMg94AL1yvFG>nsjpm|HVKA0ghszTiKnQR~UaX+aX8^ZV* zIheS%V>3$#nlRw5^Cj?X)8^!(rrOnXlj zem~rJPA5iSR|Q(*o<*-=JHZ@IOducav~_@*bCyKfs%hHsVInWmXUQ&ZY0_@`9@mdE zCITH=aLD&F`7z6Li;GK-P|8_biuQ;sH=tB{v!^UKlRz8?dbjuq+WFVB`~Xf$E*#G5 zyzZ;r$)(iEHef28iba^#O0ZS~`Nqr^_+3LSfxS>|UlAa*{Uz1FX909ccGyZ_L-JJ4m1Lk8iT$FvOXGmw@({Q#uvP$W-Muos|g z=gMq4q^&9DutFH7^ieT^d>*t8MEtVm?Wr`>+L_;1e>(`~tn0{1j>LT6HMN-m0is8n z?3Y;?H?7V@k#jf^<~AU&ZDx9LbJ! zJVyk)d`}lR1NeDC@Vx8Ur;WoB5`~auOJrwVQE4H%1VMu+-MN{{>nZkc4JyOAop?KP zS?Wsbk`z5qY(jRrI*Y}`J=xn)V1V*UVzrDV#&n$cI@4=qTGsB!G9X#1M| zT%2eAeodw+qec{%wVgI9cPr<*L}HFB-1~%LX1G^N*B}l_kd&iPS6fk+^sYhKFr}$8 zfYvU9uu;G-T}7Q`PoB*jt8l^1xFwM0&Y31p9s|w!(0HcsN~h|qda&Ll6AY{_mS?eX zlQw8V35i+#QR^6>bSt{47<|EpSlj!2;bJ0F-+-Qt7J|^$pwPMEAxlNrC8YXV9I;4u z1?dEQjQIUaU%#By|1bU>2;iST`6{?w)3_a$nA>Wxemm9!dns4lo3UuRm|KU6WmezZ zV`%rF-gQBD59@n8El;JTlG%`@9kjY-q4wR;@R);maljBcOlPZz$Y^rh?F1B}DKq3mg1Aw} zDK;3t*2xxLE6+q4Exh=zem^WfPG-;{l?m{MkNWBm;1M)WJ0wKP1aOe9z48q@K+?+5 z*#Mvv?c=N46YPMe*X-d>>7%i{e40&zp0R1oBgD+GP;SO7&UG#iJ?yR9bTN3_SoR=x z2_imM9eq9dMelU}(x1yK%G&h`LS7RiaY=!4Tw|ik7d)k>>{T1uZfTaSN3oqbh)H&} z79vfoAP0}0W0A;Vmy&je$Yurg;30K1IZRW!M2@P|W)l%7QaLc-Wq;#lqCw7o-Nb#F z^g3#D&f~I;l+nDA6%Z#x=~ zY$w}_VWag59nol~H}1;{aN1xFp&*ilHR{80Gp8r!(X)*)uC0m%+1yf>W*(vv1Ux(f za>MQ*DwW0PLkW!g$}%qMYdLOs@xUS0KW>!7(n6ag@4Fk-`Ex2Ns|PcW<5h)cigywU z6_b@(XR#4yob^8xY~xzT|E5hPPT7W)r4G!{`QqK-tPzFvN-GjO_@hIBwT>P1rH+aV zkzjbgw@DXSuTop9g|38OeZ$#ZwV`+Ln=G7v9=O$I&uuL>YDFn$1ks|4e;=s)CP!EH z4qO4w%4$%RmC}p)GhU(3=4EFkguHOxczaCr_LaM~-EIJr?p_;}&6w&|bgED~s9l$SZ3L6_DvyJHqh--h5B#|&p7Q*J?c|G$e zi_PmDypj2;%W7cmr0uiQ63g<}5`6-TJ8@I#l(z%Eh+vHRz~EnXatKKkuQl)OW>aXC zu&%!!>c-e|kZZvu(kgmhgM;*t{|Xe%dqocm6=u<_n+K48-AmNpWu)i5#w; zj|)Z^_+rYRagDr_3}AH6-EVZ!Q8k!fb5d|Z-OsenS-(#52s3BL^XJks5oA&_bC#|= zaMR4caZ58cb>qUF)JMRlm@#{!)A~I7EkbtClGdMp*+mm&A#;YsziwRC?jqn9kDq5U zv<6>Fl7PoRn`FXDx6a6+Ca+#aI~u&2q*ER{PiOO_Ruaj0ee_;czO1FDjswd=5`sw) zBTF_D|Dm3&3|kb0RNORkWS35q+An}SgNJgVz+4L`p|!~)rKg*7XBURV;p1}&EOh7n zS5*GZ9q$2B8Icj0z<3cx#7X0P)ppaWp?tW`Q+hZ&h1)q58I8ha+3L~FdiOLruhg!B zY*FP^d$QurocW;|o z)RiWy+L?W!-;;I88f9V~<;B%R~HAgA?&tS*1H8j-^P8k{9 zxo(R2ZOxlGxFKHattbi~=I-W#Z3=FGQl+>8OUw#4$@^mSfQ79+W>2cVYN>XZRQ>Dy zPb4@L&*D&`2mV^DEqkl4SFefllF5zAfDQ`Uk?<_~1~Z%T36~!gaZ2+F7L8{7FN@#E z6GlpSFf6Em6(&8MTmceojUuaaI-Zw5fQpERCM*LmB>dD*hLy~2@e0$#ewmy zzl;xm03-)RBO;-2c{dUmGAU^d9oS6#y*IHo7S&hF=p@N*#2VTG*ln<)+%+*ysIWW7 zgiVLJD&E50wDh>QFw(+~}B;zg>kf#n~v7(P6 zC}hmh&k&IhKT{z_tA=i6EcyN?XklscSLk?BtQ%S%67ib3aCgG6U~TX?bNPi&+x1 zy7tqrxcFLWYfee9kVj!bdhW;5=l1WDx}4FSog)R**p@IXPZ0wof*K(gUha4wl#H6T z!({S*7r|8DuJ;h1s|KC)8}=-0ysjZo+wAI0F?6QO1L1bBRV(p#p&uTkWwWHba0r;m z8`+Y01oOjunT}$Ls47a6c0;f~t&ffYtt)iJO}X;2c6w|>J)ext0D054?rwJ%2eidl z(57UbZ$(}M>wt&sNx{S@t^uo3;_prcBnWp&sZ-Dps8px6L6gAThUF-k>b1+hFNySvy6eA2||bJ~}dxaRosi#lzlDnhxEYnvHXDa7q^5O^LDIXSWSA zNuGDxQn@tqpwU+86rBv0w9*I)gP3dGBA zgqAfiq#|Ta|ND{3NF+)4K;wka>yd8f3x(PEc#)uF2?Jx@0S*(uXj0kR+*GGIH|An0 zc(5xkt&%DjECO&h=>qf)8ew4>J{B7w$Bb(>fO@O$(%FUTFlR{~A;=+}ZWMlW=_lscr(+USj{utK3@ z0)Tw%ihs3BmX2Kw@{aNPhgB&wLV8#87J^{CW!%GYKt+C4CMlG+-|{qPYZ|$P>P(Rg z*RUWp#}02>k98x$KtV*$X)m$?fHH%9-0a6}E;TP|$RcOa#QI#y6l}FF{j>dZt3u0S zyS!(eE{OaoiGw+=pYfkHT6wJG*;%Ap%iOk|!*B5h^2H2=P0XwFtHTQ^oS_$3SKyzlRHk~+{vYQrH%?N8{$0P7CnH|DP_7tI+ zY>UNu@~ajP3hOSHPIAsCy)C%4V z!A)Um>Oh%X*Vl1Qy?5=J3XCQSBQK$Cs(rXseK!vlXfr}`_20X#ayP*H&oFIF!(Bb$ zoEuSY(z%P?q~7UzHMQVOq4tZsDw_0f4TqvECRZ zRRnx}Z?z~@fOn7}$DY%gR;y1)1Jnve8CZ@|lIg%*$>J&hS>$*BG4Y4N;$R*uQS zdIQAb*yt}bO2|oSN%~gZCe1E5rp!=rax{4PA$)ufcnG&U9}M%Cw!h;F4$B*rvfgwQ zJ}0Wrq;^5Ap|JCFZpcW8SR305+0iu1M10v1>yX66O3%lCkQzGCb_e*FK;AAd8%(B} zCYz~DjVB>-mI_JZKKuR@g(u|iB#_MK%hjHqy-{bcQE6TxWH;fR$t;)6(|icLn6 z$z{tY)X%-5_v{f7_`p$M^zg8y$L`Kg=YIG~Cw3F1P?2a;d;ESzuEO2%prIMt8FNfO ze0U6(3{Js5;RwVS6$(v(!b?tPxScrX{)@>gPx9&r@-&NhWVRM8Nelb3uuP-~CBr{91o~qz4zxyqe1{mO^Z&umoSafR;qAmZv9XHxpWUYxK3ssu`7-z0XVKck%ufHe zr`}B&Qb&}ix4>&)K;{BLCeEi{TguXqclWKJf4=y4%niao$d$y>{b|;xT4Oy`n8pj` zl1*x_MzhA^X2-6Le6o0B%rW9IO{sDuZuj;iL9{5|Loo$IbpJvL2_0~{6nX=)nnre= z8QQbDv4SN;`ECID9>q*u5kGQ`m(~s=TIRlCef-2uSs=e)-0)qOGeoDTXau9{ADl~# zC7e|Et^W^`7mMf2FrDXnJcj5PQ zY;S|J!|Q{7cp1VKn72}P`Io~jSzaNHP7+rOLj;*y=GNrZdE-(z@e2O{abGIb@3XzL zF;5}#gy~CAJyfejDWz4mfRwV~hYj51v+(N!j`;U$ZTd@XnJ8RZqBdUIjM7&-wb0%i z&sN-Cu8W*q!sH#+KVJFW!jiMJ;G%kRaT>=_Ov%K$HRAn)7`8sXyj*s;Ww4d0b#A&A zKO(|M7-E^iR2`M6+5#4p25j$I4lD9J5#LOEdv$9Fk(XO6ipPYBZj2WnIoD72`{g|S~&=jV(m>6t)_7kGoSK$v-Dcw+bR%3Esxf5jjR_F zR!1p7w5BC$B}m|r8HGg>8<;sn#n=u4K-^AUTe$sN^l`+48`;{g|S@u^Y3r*Bm z5=ud9lJF4`5dmjzFc>xs%3%%lH%{ppvKMmMTnm7@=FX*&N6561M4_Ie6J&Nm5yx`5 z3t~qFt=;J(7VUwUN-n}++e6mr*%+_*|LE0gyUI;to z?~zGJ!yewn9q3)kM$!S|$@UfYi%+O1KTCBcYP1=QwaWOcHH(4dvywNaaR7~373@h_ zi^Vj=tfB;tOGyuMJe0qTu{=M?%zF4a%(ID+-D_HedFKJR5JxAD;J8vIH#<#xZlj#W zAw`|qthJ?%#atUY#K6foAjC`+<*@qE5ipXtM77(yIVY2uD;Kwx3d&jwU5)t1d1g!D z)-ui7_!Y9Z6lC>S+*{c|v%B>v+Uwj3;oi~e6WOKLy7gklt4_6b2B4mWdUUodzzJkV zA7(Mq(9pB8_w~l&#eJ;&GG`5igN#bUv0G=^Y<6Jhaa;fZ(D-3s8O2ha5fLpjk7yjG z5&)8mc)_gq70DrGEK$8MNeqfnWHL&l z#*e7W2?tG}Jb+I*20}n=HKdMRE6;%vXcCK`h*>=zp!WM2oIxerwpGU-tb_&1VIPOe zT-};)ZMmzG;*RD-Wx6=m zNaFYLd+|X9qWvEe1vy1hmvIVpDpn-N1O*#A4HwPzJ+BtQB}+q8*?lfyrQhr11Y86NX*aP7DN^fkBgstqh(Yfr! zwtouG2QndxJxJb>)JX-UVQsT&_-RtPnADot!Q!Dzb^!`SElzM6MID6DlO=8pi4Pm> zP@3M>_=Y=5qSigGIddfPNVC>hx>LnprAYuR6(-H&Uf}2BQ*SnVDr?_}1|51cGB9qNXo* zEft`XIyn85YWHfwS$mD?=y&Ppe!0Y@4UT*4KR3V2P>Sqe#|?||3AppTl(Tl@5TNjA zs@Iu*Q{$UaEY(Y4NOz{eQGJ|_kZm2tt15L6W2bK8_TX;3u)-9fb*a@b2wM6_)!A2P z=h@LFt6+_ZFXiA26FHB;D%yqT?(BbL) z1|-;v9Y)NTVs@tg01q4!DyMLqxqu^=s>4h}0M60<81tTf$!&FKQf8jKnXIi?u~R4M zbU6z)>O8ad8g;9~kZV=ZZkF>SL%3j$#EL|Upz23(8)59zNjqJ>l&qdXTVEX!L}l+0 zqQhLIY$%+n6}|n=8ZPoW41x%C~kh8n3t_>w`ZjXtOM;g|)l%{2Bs8X1WosgQD17SRN z@Z049{h}fJwWF1l)m=zsWelti!Bzl*2=GB3$N6)pJdX!J{Xjba{d9b6eme8b)?wTr zFyj_2eYUMIwXsaay7CCyOonrCE+o3}H9%wX*H(td#gQmAueTD5WOK(FTI4K%5()X` zwIydEs~92Xs4)|K_gi&mVrk4VoGQXJ!kl(aFIeRkm~#f;Be>3jPtCaX@DKs<4PM2p zwN!6jDq(c$y5#LI^86~qxe}99Pf1k?GWQ%|v}@cQ+|yPP1yS^c3YvB=Qjn(um`}R!|O86hx@kBrn^mNl(PJgRbGW;5`I-^|p0}H#^hzDdbv}=QtMC#3|lA!rzgkE&$tNfj8V-k5pizoELD1Jws5ff-zVj;g`rvvqQK$fB0D zi0e?z+^0@>;;@P>C&DE`X2mzL0#7Gwj~lT;Mfa}YUgv03qS?evZEU5wnW64^louTA zt)0gv39|_G82rp^OcDp{gE)@-!#w5@9mIS@b-KU7v45Iz=o&0L$+022p6 z0CAo=T*L#@VG-`Tl}I)p04M3j!ix#%IBWuI~GIraO8@LHmi0{fW=*Y1+2mtlpo(oIE=N-T`O^wMJWQqq? z4nrQ<6t99i_v8Y1uzkGqC$~hTZ6XzsS7W(YGJ>RR4H7m8Ab@-wkA7@+9s$3*O*P|i z4-o+TdcShf&pK(QoN=a_X~!CArkru6nrX)xX{MZUuLIyeFzL8>ZX5fz*PS@!OmT*B z=EPu!?jPID$c8egpdAckP2%e-s2h0~nleG({!j=8`)gbnO{t)qslLbS^X=jDd;C1U ze<0Y8iXt`A!&(?)dTOhA*GZn1C8t}mpaez@Nl?_NV-Cgs5cPa^0O}*Q$)lV3kE6-eTiG)FelwOhz{T#e;(pKKR)~FRl}`P6x1jxcBY=SPz}n2LX|pHs(Dc{ zKths%0O~cmfOP;79ktKcAt;(@lBFW1sGyZUgA-CJYP9Q);6%mjY0~=~L-|nqBe?7v zfc3zaCfvHZp0!z~NdzD(lnUO^oKVJ^Q0yB9=*=!dF1vtxLSu7o1I!`UeaH4!_5)_K zj;8xVplsMjZ-MEFrLOf;w_Ucfa3_2vv(%?7 z5S#sB1Q(L*rd95mjvle89jd;P_AQ)*f;od1j+l**Sbb&w6`VGhyWoApZ>Ly|l_Hn! z(Ws?W8r12V-Jr6V1;P!3r~o?_@*lGuxBdv`<_=z9)C0uBzkqMQ%o^;7&b}Y7+1-LN zylsn0nXWzKh09mooPM2Fl(*M!Jl%!08yT&d$46%q_e~4O6Lxw=169_HVH~k6NounK zT0OBk>gJHSUA30UAT!v@ku)RfX7NXOqY>Sj)iB(`oCkpKpML$>ii3>(m4uAmY1_POI*=JD0 z)Eym+{@(Yp7`T@gm3tDrw>~DWR5uwx&>%oFDU5!y0aM z>f79f3*E6k>aoyQd{~fGaCLBjtZiJ}$jOkf#=1s1yY}2vb_a>w3Vfj>wKS$Ej8m+o z6e3z>+i}~&eYX64KtHeh^7q zS5+QHw>K&snOWT`oUA}n)hL>n)uchgVVUvI@pRTiohDleztRmKpnuW+n`-q^{i+gL|M1j0}tOl6k%xO~1Bw=Cvk?3EZz^ zyZmv!Zxu^#6E2Wi#ceO`Lir1lBXdIJ3*`(?t!{LxQ-5de3Tk_YF6RRlwm6!myYlD; zCn$Y6tor#@Y-3Cw1vH8aYzpDQXu3W~ndXw+;7V<;X2`f(S(JYL4d~v=@bxD^)_o>rf3`u$TG@ z!<5CT4Jt6JT)NLWNyZ+}N~Lz%Gj#ERrfVp$mzEWG7#-R3ZfP`(p_{O&)F-O(yIA3u%wU+u{B)AVuS-&YHDrrwWsw!5jC#kI}cJ@;8D(`f>d~|K{{SA#g+|=mOJ!o6 zaBm)IUEA#f$tin`l{Q#S9Rp>L;mC zYK2Z;%Qs&xF9fpoOtSk7QA}pe0=d~FT4L_oL{}7c0V8a=#Y~)r+hU21dV(Tfv@XM~ z8;P%KrD$6y{;ltagjktNGBoDBacH8(ixQ-hLR~_r)`w^TyGKZM6!>c$N1CyMf?Bvq za@k2R(OC8UXfbnKk?2>M=JO;JsQzd6)Q6D8QakqLz!Cnl{5%Gajj8VOSjMN_v&}sULdzu z4DooFziP6N6Y8Cw;oG~h47iav9R5*qp%a@?IcS|m+@iCH1-XyLUK)&MvamleU6(7O zN|Bjlx|IS`En<+jH)Nexuoofx5*<4|)VSJ>mD$&iAe|BK%S4_YEdb7ri~;UCR@ys! zhvjcgpR}<9XI}c|Hj&v|8-I9`+M7o&M`@|VZUl~F>%x3=`ruI+C0eNBukut!lbeW@ zNe#wqcXe@Z5D;V<>BNIr!g3hY15@jVJVG&RZf6inISmC!BKEs3=CJt6O3M8;T^P$G zf@KqBq`hzfMBI(h5vFQ}+|>+GsAC_SoY49m#M=<$xf5+N6Cv#mMAW&q>E+4k8@-&! z>CDc^xv7#cxHibdY|c)a=v-L2gzJk^l88 z>TSjOn`Sl0TXLA9xnkD-m9FIZQ|*jp1~BE_Uj9DR;W_iM>3>5883MoQ(K*hWHVZGi@_tg$$5qWdR& z9XTmg>lwPPTQ6$LSp)PGRWP$ug{6uafkAq}maWxtTljVp`AsDwtL;Yt9< zJv~RU3U6znw{7<6UbX5Kgf1TSGl-z9D-|r1T(Ubem7O37gtY1?t3`X$sSjL0g{VET z&LUF@Cp0G~VYjB=YF+rXL*kw*Jf)NxljD7E=e`%tJ~SMl7Jagj zgeW~n6FgL6kzN|5?Mq4|1&N#}sF|g%N_uqWxjYoAMAAzutZ>ADljBO|96nf;ML00jffJdVp8QLf%eT_Z(jbq8=%&`YCiZ3Vir zj_KAz)Y%&?h_>Dg`u@BlXwXY74UxB&reKL1+R+jIGE%~Q_v!)$4TEECm<@H6q=CjC zB@VC{g!+q%lMJG?-JQwJLRyVR61b>lWQ|lQ`OQ#O_QcMRQ%4 zRrg-s>P;g;b@(u zQ*yM0qmo8PMU^FC$x9iXNS>;+Ab4bp&mpputEl?*207G6+kp{GD^SatUj=v|DYpUJ zz3PzL8kmqyUQ$XtAGh%PH+`jV@uRje#x6`UlWNv#LKGXuR^IH|xvH~i_8MSU7S->a zp$I!Gs8XDp6hNa}sUg;w&}j{3JBFGsXRabP`y8rM)v8p-!PH8!cFNJ53i{Q(DWs?(0c1a8&IXa(-`Gk!n4^z8%PR=Jx;{gny0% z3|+S0n5Ga9Jw?)(&aJBrOqFN_lq)?PgjOKH;49IOng(CO0^5*M6J-0K7jg+T*gx zBXm8Hd-I{fnnY9$P~pDEsyhf$qf7^F>s72JC;)Wp*I*6x$w2&|AUg*r2<{`W2HTHc zFE4(e7F67%tHOjWu~BOo5~C}38b$%9NkuAsnncE{-~&k2gvyE@0k+@*0vgKtKc}YZ zZ0$U7Sw0)RWxFB|?y4aTBNo<_xB@g|?IWP~I_4Gjht;ukUrOY2ZzX??juTrCTFZbf zCV=5TQG0qo1R`;No5`j4*plV=1Jq89mk z@-Bnhq+@RsLCPNYm-hbvWH;y{KQ7&N*I3!3LXB$J`nI6N)2$d)tqfyr>^r3GktA?H z1or|NiDxcPjt!}m%HF+WF_6bx&t$GxY3*d~%FM->f<#5(Xrt`?h|)GxiWQC+QYerE zS1r$PZK}O7wc*{pZ-_5Sxq3C7e7?ix^WWY+J|G)w*pNt_Eb&1H@K`)9l$f7hG-GL*iQlUc5k?;$$vmz8?E-l6l_5m|M z7nDRd9mj2a7yF})_P`V{L#=~M&bkegFI<%qa@2v)1VCi&z~bQMB@qx1D4aaN-F0bf zW2AlZ-maA#_eCdj$R;`;GDH-yDm#M{ zJ8k_d-+Rw6T4ua;iu$(`ViMAASjxnOPz@4>;$@2#iKA^{({hwVzyLi&z#PM4&Gf|# z<~Y`~Xv(q{{U0S*B$mW;AOW3Ym(eJy+F1c4NV`F^^9+xty5A?$IfS>4q!FW7S1lFm zkyfK6H(}cZ)5Gy9@|7(mNme#$(g5tfn@JP(hbT{3wz9Mv>Kgd>QHI3);)>(^fT$*);NZ6&FHV zC5yXMu@}8*gsQ4cCqES|@~68^bbWyb`2!8VRT;Uw^(!8QIjQQ_nCf?#xI2)zEpeNz z)%J=swWyG@7Do)0#h;ob&?(e%p{ogBq7pPlCumP#v<}wuMLd-~LYLC0QZj_&SDZ6l zJC?vs(Bx^)3Wx2Ec8S&rfdr{XWdmhFB@Ucu?0DZh2d8?o1JxChd`3#8nM_M8^p?a8 zdZznTg^I}|NQ#caKUfBWMj*u_t0^$cVD|^)4SCoDz&6l41AiYqHDu;T&l?B0KPH<8 zxIZ9k&YE%08wa>QAZf6BgYs+6nsLUwY#!kJfv-Ag$3FrEFPD$w{rdcS9ehLj_<8I0 z0s>vl*KZ$xk53N`Y@>!h2E!q;8Z8UC_saL$Om>3Hqw(3LIE5OH*H0i#6_zwMNh6D# zEt@4aXyibzY|Hm0IbFv=CrMQFg0w)uA{8rWW3S~b3b^WaF4$mLLs}-4!h!*23J+=x zj^}ME`;rGO*-XAK301FVGBmN2)q;FY`!Lmsq+rD&N14z`G=W>whCbc`M7D&MF^RTB;O%%PjNwF*8FQ;^eJ6mj)}X73EsAbi(^1mZQ&PEm7;ILs z%hiQ-YN7E7hT)c4^EbfNLv3VED9H)OhPL+D9DdC(pyY@`VTvjpIcm3=z$zWt)}h?$ zz0RZ$qGb|#wX4^Z)EdcaA}#7|<&=QCnW7%OwUDnYj?LoSS`KQi zJLNhpi)-A=jP?%GS!3-cVp0mms9JrTVKFEN26aJ-aM@yrEQ%EJg09F_r5QjH2k+&m>%uf`RMy5+@I^w(H@zY&}Fg{IwviEmypOhoQKP z5T&YRZ1VTWyRvp9E7pS8$T#=1D%GNlIfuJP_@{FSh>w_tz!D1QTAEK)o(5RGWAhX8 z*7qn}nk{a{>R}XGv2Y!77nRWz0p4+EE^ypLr4i}k09|3m=q_GHnw!=z3buyEgu5V& zHNLP2p-3Gz7G1l!$ad??zlOu*(==*QK_!TqDdep`mX5qhB#G(CxXB&N5FjO@ZsY1J zu<`S%Yt_iZZYpz$>cw`pg3E4sA&PHOBw5uBJl9{_;__4 zPRCo4*0LW)@i|*)`-R($Nf5zgt?%fZ5t#zfFp5WTW*x`84gLvwn1EvthABdsNzP;U zN}bS0LN|M?%fkyp!1^KyGNwoHje26;w+~KO-af5)?D8)F2JjImZXqEt(6jan+IbaT z5@3`mN7|s4Pa zR0Y@yM~%4)xQ4(Eg{A}3ea*O<<3b8`CTJ$S4D1Y6Ycyn6e&qnh##HQ(`5JAG;p4Zp zh&F7Utc~ar)qG@$1WuNzUWR||uslqzmSZ*K^#HdNAOT0-06T|Y>-fJOxqq*EboAFz z+^Ut@IyM{P@#OEc)|3V)t*swMLhz7&U=SAAU{7rQly!LP9*xIeu{?G%)f4n~VM75b z+^EJl?M)aO2PIJ;$af(0OW2ku^kI@T{(;~d`?S}Mz&u0)@$1g8j%;o;(@i+zPaQNL z0o%vRPC57jkelo~eB-{nnB1Ybhfguz!}|5t@dBJr?GHd6p}6>bzl-PoePH|9bSPV> z@r<1G&h+A1soQ8A!TcGv+M>Fp0pibjx`>` zf3(csx`?2&vGA%1KHRovGdS*@#ooCZ`y4FsT?q;ytXV#$pv_U4J`6U z7}s{k%e_~9rV_}p3PqHvNY$o2Bq^x~RIHS02Ous}un%HN8}oG?#6UU-ZK^xI_mM;m zB0z6QFP8#Tuuw$VYVNf4oJ=AjwQo__00cG>9mE7W@4or<-POh6a)s_nYb#Kyu&J$9 zpp9C!s#OsX0o&idyMGUVNQnYUS@u9&$>WzTdN%1_s4*17;)!A)9{X9-%tPcKWff_79h_3%Q69^2Z7W^i`R+ES>M<={PH`I`ZGzCTQhv z)mqqWEm_7Z5|Xr?t31ex_S_JXUAp2Ca!ArNO7+$VfkZDi!-wM`pOyOWeB9N`WlP7> zYqW~s24r5zc1WpGFx7HBszb30KU5=S(snS^jk|nohHj$-$ zj^o@wFSE1U&Du`;P%eqL)5lMdRGTA_c#8mG$J3P}SR()wQyA`4(x2E=E~8!2cWetq zg=7vn3Qtto)FX&CR~4cy4s4yu&$_YZS>OWQu=U^M=pnYgbmuD}cJ0!DeNF4${T?~tTin$>mKV|;*641p;ZV<1%8b|GIMe& zd{&4+43Qzkq9tl54&l?T-XCl_^It2Gv{JQrpjnTBB1hV(5|1FO7gbPnckTP3Nh6-^ zV6hZLmo80aNC4YKETx)BnD{F3sz}bmxCJLpzT6w^~v%A~JXpLENBQU$Z z#ytgMjmtHly@ugVY@S`Zas zeJp(m3a!M(Z4fZLgQ<4_5GVnMslKfK_FG#CPt@ofX{o|VLw`taYyzQ1hrpmO3xGsi zT+OhU3SkrbKma8G5|0A1*(Eo)cTJ^&SP|6ii^}>a6Qx3AhD5Oof2M2;RT+7NcIY0^ z2#&$bK2?6WSrVj|klL15;*v_WRb3UIZ4a)lioML*czAc7Pn;3@SyL!l2#l(i5rhl`*>3+gryz1M;Bg&HmWz4Hv+}ZAe0>}#qq+Gc6#72vg~+o@3IN zwk}{0^|(8@vIz120Pk|TWT+bn16u3tG7H&!O&Z8Vb>z($DaQT9rIx)6iz~YwyBB0J z_cI+cpC2o;ZLhJ*c;21P>iO*G?;G}BHwU|ccrT?Ss}ZJf38gsT)SNDey1_^l}b>QEIfwZVh<$HV+JB`3U}iC|tbKU)*s4Qe%2+b~ReLNEJf5 zW;Wt9F75Vc9fO#53pGgKAX=Mh#sD`s0RI4m)JMav!M9%k`F?F~&$GN!RL4t`kQA2l zucAi#mc4fQTklfx7hp%a`e%PmbAQ_AWpX))aIvs@xR@B&U4oKdxQNmt4=UolUquG@ z+a&g)AZU|owoc%;+`IXw--n{{l@JEhnF1jqp5B@*spfQXNP z;JFkQ?cA8leF9k6zrW?DWQB6|+-+o)~)P8)RF#5E^mw*l@~0zrK3BZIXUHiZbArEoQ6Uh>knV}eSk zdz+L19Kc*Ch&?oWMvsV?H{03yHYV^Sy^XFms_HkQb#boLH4!fqU{XG#NCVHfhzJ$U zw0*HL00d3BhjB50+-3%m=El;=nCGXJJsA9P8{}!&K&Br{THN4R+L0ch0tW(t${YQl z6nciiG6KsQn5|7U3kxr6x&F~k%rP{odzF+A2*iLyZW!!#owS=FWSQ1#Rp820YUSgM zZl*?@^F;#=(yYfuMbTjLqbli%Qmf5occ#2bkFL#@GF}gltxU?Kt6!NM8d=#@wR(Aw zftH!Kb?zh=6BMq*+ya?Nv5FtThs?J*k4gR8yJpdpYz@AKxm|bk%l1Nv8Xyq%k}D{i zr$FCu9=i_Vwy}+`%h_XNwFb+cApFFj1ub`U$WWtqV>eL%Fe4D}FyDQ|HZc3croQe? zSoTD0g}RpZf=UfFih)#ty|hRzK8CCb=#qwjr|bd13{fx_*#IyJb|`>qKN)4>Ym{vn zBZKC%QR~MWs6R1%C~oC*+|E&f8*bLvDj+fRqMb4MIx7>|9hCAB+MamXv=t%@x_kvLQSOfLcmQY!Ra_vQkLguoo$&=d|mJooFYiAJ@J z$+jgFD9}u?+JaCD;&f$anXnW<3I!1mDa;#&z-{X>oaX-k2zJ#=q;FK_tvWW!3m2@f z_9Ao%kOI}Kx^&!pHtG93cj>7Y3bA<^9Cc}!M&b()xS;`4Kovc(Bv?E6pki2^UyZKB31g1AZpAtTj=0s(i{v-}3Lszr z*iP0U1TYvtLzk3y04QquET!IUpR*@IqN!-eTawW#2kQWW;4E7E}V6zU979fNU7 zCIXlM05wDRHmbTbtc}l5)TxR6rgX^I?14_gu>&N}_@+#U?YxR09v~tc2yMQlY+g|1 z4tYTG(xB87B~V(04fmy31VAfMssYdw*8v|cq2ai7)eltkgdJCkl7V(x*zeZjExyZo zQlh%UHpg*|iWpn>lthvpkigdTCtus>O#E3?iD$%SmO6b!Mn2!1)UZ*n((PqMw^b)= zFeqab!g=c+)si`)yMt5b5FP&juTRV2@@w>Nh1=#2$?w+?g-Q}im>V9Em<>sKN_D`S z?lkIb1g%I%Zl*Xy$@PibP?i zM@A~@N4P4$k3V-lfY-GJ+V$;KnmZM3SAx}9;%?}tt7;UnUTE7xX)IDBsr#67^`@F? zpOd)LO*G@4u%DFmHxbyS5&45*AK&il(^V&b<@F@@72>c}8i^aLcUlT!A~Zsh8pB4n zLFgU5e@a#R1E6%aWnCz#IDhnK5ZnG~Od-Hm$f^3dwB;#^YsZzXT==S_$$kH(X0JQ3`PT`~4#2e&jY>=mv@p#L*CwQwK$bL_Vk%2my zico5=*H60Nm_!d3zIrmuH28 zvNlwLJr%3-F@!_eD0LAK*aUiN&7hdMYT>k~8Cyt8o%u(%T__JtOe4PFAkHJ*f#>Xr z1Vlr9{{X=YeOuW)fh`0TVXg^M^NCzH-mBWl-bb+^Li>Wi_!pa)%qAczS+{n@q5}k~ zVUM@=NOlh!`aqGfxf#gO2te75mmbI4JA{F3s=~iCxH%z2Dwo3A)_{WaU;(f+A}AHb ztWDQp00Qm;UBJdD48~5%^Axo$5oih|efXL4g5rR);;>JY?p1= zce}@9zxRIQU+8;n;o;%8T~CfW6(yOT#cK8@K^%f7Sb}*ZvLm|~i)?StZqzUv-svWn zDUgP`B}=xd)|AT&O&iKzVL(Y_jS*%F0nq?34#-Iw1L4GR65qCo9A@fWr?2WvDjX{- zTD==UtmWJcL}^YAI}|*7+1jrE0Bf*pJAIh~tY5VY5}9HMD?9T_&q|`5t&_eas1~I5 zfIu1uz0tVA;2>cr0C{r;!HBQj^sOa}P^V{R?IO|kvTsE@i!{6mxCnX+bHWr39of(X zYBZF`5#}fe6O_8H{aYXaj2XP;TE4!5FDx#_R7tem+{k;Tb7mzt=XA0rd8R+Oz3ZIVeX@M5uI zNi4*_fWQm_iXyc@bnEBWpl{?Kv#4v5(YHc9M1QZJO}=js`NzO@E84B^xi8DO{_pi{ zKK{Dq=&ko%y&QgG_uU#r_aUr{TufG0P$+4nMTl4OQKTMHbC(G+1k>G1xvOqPkx z!)~qYd7ve?M(9Ytg`@z-ZSC7shI1k@N0_u@Re(9Yk_?7(x7+^!i*LW;{Ganf_V4m) zOyJB&8!v^Fo_h!hu7?O|TSq=pL2Ez##ts zGq0!h{{RoC*HG;sjgN8%;D5|>XenyAEn_k=+cb3=ZOkG$9k;f&FI2)|joRyZ8g7o; zx&~k3XL7NSo%mq^=RYxr&s;Rd0RsohAHVYa{{Z!C0AhsK;|Ccm1iwUMfYWiW zzS};vM+n&Z1M&lsDu6vhVB9wAto~wv0f*)voBH|re$90zHKA;NJ)lsP+MQN~SJ_m; zg#hwTg(H7W^N8|d$jfAwnQa^wRYd}Q)a;NzTQ6my5be8 z)~!`dYRWw#vX8QqDGr-$^L}5)zg=FM!?iVmo4a#~b+UamiXjRQxOW2H29A_74Y!*T zR7A)%rHm(SV+VG%>b%pfi3vXK+1h|JcqT%sbe!e(;#Lrev}RUsO#UHvLZw1<+k(Z& zgg0D^=5zjG@*Pe#?7Ov2E(&YOATJ11FG__v<>HNv+=7uB&q_p9#@!Hs8%4u^XbuG) zyrN=&>bP{*y0`4pQjoHCGk2AAR|T{een!X2HQC@*V349^G^fB+7{j1W0Co6I*55dj^9 zKm>K~F6@>(B z66*9v#XurpNL}{Zp@shdsCDt%@o%h#rb2|#`u0{Dvyjj^UzgTLQQh(YT&Bp-kT+{D z%EwGOiC@I!D@rR;dpD|s9f-s1n)0JcYIg=x|qXDR!g3*xbFZ7B*n7m!`R#xX>9lOA6XeG=v1UB^b zNE_Co5$Wd6;NapL{{Z6dKeJh8-(JgWbpXhiU4UH0F6tw1$wd>#qKSQ>6bI(?(hl1I z5Y;vT5fB02STg=&8!PKl$wj3>Oz2tfhr;p2~E#n0U@?2OgoSR zo0JVXg{W(ZF;i8Vv}5IkW7%b2+Wla5GDv;ceyxf28z6F;Ge*s~hdEy5Ym+byW=V>w zGZET7CXH4YN3tDCpb@j%w&bg8c8JfJD6DN#(9*m_QRMy_qzh|wB(|ykgToS!;5viD0-eDl;xX&G(E$S#LvEW02y_q-9fU4g5iw=B z5w@vA6<*z~*&%k{s-$X1s@X&mGliEH$ihaNqp=alM`=eO6B~i@hbp@aG_nQyFe)s!4y2;Bjs8Da z{Ki0{lH}aOxb`cA^y-G=*ZD$0*gfOp*R0eadjr3S5AEDT`So2`c2iN9J<#SJL$TJV z0pvZKk}>!H0O9<@sA|SUIeE6};kWbamcG>L#Z#>^f)S*$wQUeQ0VI$|>K$v{-AkS8 z%OA}52iR^#Ti<55KUtbbr6xxlvN1iz3YiNAs%Y=!hODsHPbcJwPvAeGbN~-_nrW?b z&9%mZw!^=M-F|H}@zaiabqZ6{u2OX#LjZvMr5_(JAK9&c@7>(9*!yvtB6o`G+j~;+ zJ93h@LE7##+C2_5#Y+uzW^+v+^_9)29_s+TG!05ALajoS^n_`YPCzvN;y1)M9=K)W zOs69+yTL_00Ibn&;4I3>6C0~PT!hDEhC}F_#pX3&0j~Ka?7b2v8l_!*a+nK3jefi) zc?|Q39~3Noz5GKXZIY=))XAH>W1eyGQj{*%lHFOzwlu>oO}&9c+tLUPI;}1@Abntx z1KE_CNK(m+29npRr&|Z0`nK;)U9(<|SS?GLlOIt&DoG=XIX)#(9zznt%qK;!?g*H}@l#&&i z645k?JXNh+P=V zWn~M~LtH=?vpBsYaIFPycHH!UoQaG<=iZ^{k0)ufto3cFY}lJAi?aZZ`(piSQZ7mn zW+_E+8YvLoWqANGm846SBSFt^G+r~JDb=M;z85=A!%c~cJLqNLlMi%Lu~c4p?8?n| z6&#i8@8T7*U_`L&6Ask#CaT*^OI_TI(Gra+LP0SK z0Ah#7u?MypZee}3xm%C71@ZMzJE>xi&Wi0krm=6?pU3dCqC+HR^Y$u`rUBn@4xy~- zPN&6ONO5>e@O)WO6IYYEjo6V@KvPoM*RYbvSQ5;EfbJ(u!1G)uNakuyHgl;l)1?mP zk~^@fU&Yvyxr@5r#mRbvu|Okr0W1_^6l=8^dBc_~R<&YJvRS#C$_k#}koJvsOmmlcq;vPQHljPrlB+zj-H@DD${^2vofY)|3WW z5kLR{JDN360Q__{uefp@>8z74w3jjkwP_?l>Aezg53|ygRkQ#PQ094Q1?}Y@cnARb z2nPKzwy0esjfzN*8xP%eWo>>TfFsVw@a57uVwnVx$sDM51IFs=b?>H9N7wJ?l7H`q z?>4v_pom`^dHzpF2V=qmznb17{7tvtZ~UAcJ=^P^6aN5wKY6vsBN1mw=1sz4jP!|J z$z~y2R=PWn*p1+?K6sb7dU>}Vg=}j$0CnGRKZi}R+_JOfI%yOZcFE2aK-pvZKG6Vv zB!QvzJj*b$ELcvqmDnt4gQ{JRg;hE1P%KZ-07?G(Zay=WD zcaljxKCa2f2$Zutb>A6-o-`fBh($9vP!5K@hKh_h*#zm;DEs>K58t-mCxCuEWCV8j z0D7nVLDTW>03SGY_i9G7!bhljH(tJbd;Q_z{;>fKWHfLw{{SZ+m_L5t0t4^z{o83* zx}*4hBk5B^FY*MIrnH{|(s>a2l}no$ofoBX{51O46r?7ekYTu=1w**JvY z?(XhR2=4Cg?(PACHttSvcW4}fHy&IY2<~nn1isV1weFoYcjhh3|FvpW@6)GF)!zI0 zJmPoDss8@2F-sS(p=KWc`a&SNw+&5JP|PF8%hl6A5MZ0Kh{6hSM;w|v&#&5tdAMCp z9aNIh4M>mdn5fRmi?2$`ZEzx)v4Fu)>&}t;_PYWScuCK5rbxl~_Pt5SBisuBpuZ=3 zxxGCXLo&ZRTY~l(DO{6!q;uN7C-}j6<_<({)FQ%cT{%1d+YyNg1GqK2bV{7CRjnj=;Av-iKPpqZG7ua5e<$Y8zvBYpou=7sOB zXOU^f`lYjlv4KLZ4kO<<$M8vU6b6;K5?t=p23xXT(&+^eyaga>z`!OQG-Nb9GaA`D z1}aj_2cG{iXK*cfsZ)KI-ie&<%0OMpwlf#dI6g-E9^x)&vi*w4x;?-kxQ4H~SSZTF zn*MWGONdYzhA5Szryg$yn}!i4h#Op*HSybIMl!2`QvkGQe=UR*u#KD75OC4s&WP*h zc>U}hBIWV%@E7sJVy$wUZ}pq4P`&jwhwSnlw40n>9&bZqUtWr3H;}cKI{vA=rZZd0WnWQ#;zsF-Hh-V(@!6 z=N`~<$nA=)Y-{O*tYg*Hk74EHf8npFf!l*$&L+m-vS)wB94;TVy>ei5KQXq|0}`e( zG9QlHaxmg3?eK7%K&#Rja>0lFT>=L4Oe5M1{HE~g@*OXTpiImYd zbo=QX;{jg2Oy5+3;{eB54$o>Do1x20xd zhcWX7VmKos_y2PQAAe%xZrxc0nh>BM;6g37AKVUBpAg6kp=Cib>Qf4DY4VV5ezKA3 zv3H9O3&&@MxaeLwbMYd9`xNnGVwOKx4QO5#i_KXzE6s@z+Gy_J85+nTurVTQSiXLbJR?~;JCzye?b9?(G7{UW*@7UA1p7re?PLVNv~i$wiD zt97qNzwYlSMv(=ZRPR~Bpd1}hzV22~c;~&vsiWLA2Ycd{xEpUCe4VY(97VUshb>24 z3@g=-a^!+SRQS;%Ma9)HP{Y7=y{hNZuys+~d75Kw#;IQfais%PPTc?|eWX*SuKBTV zk|MZ0wMsYsU3LeFbaCuS9zzTA^9AKbgwc9#J)X5rXdko#WUdY~W`@bnrRE`J%H>Rv zeXYCvG2{{VZG-%re$T3ou`wYBF;kt)LDH00TebRzFTY#h^nzV*8^@+wee_q7-2H~ zDsP_f`Ru-vSfR4ld+wX9Q{-dd|wWpHW}+QfA5CsAUrUvYMGGjn#-XiP`Tg z#+_}&jjcdC3zH7)jm>mNGU@5=6n#9W`e|A$d_vd|SlV$)>--{VhaV>CL__cwC)gW>*GWNYcWmxe>PfaeP5L&h-g$W`YdaYV5HK2{O`@z|jXc*000adq=Sij;gG zGr_mxVr?c>=5%T|@2oVm00Na+BA)CMbvOTw}BaWJb- zBJd?`hXIRO$`&<%Io8r*b$5;PraTON{7X}49= zafzg?SFIhjX|VBN7c#owhI3RH4+li?iN(3h$E6E%H{%jN2@TYk~ElJFsxGkE{5p*$gkny=T0BYG&zWX`|Ng3>tcwT_+}>6Z7Acb z)|e9@e4_MT^w=&&vbfCYzL|9{N4F(=*_^ld>u$}i8!N5bmU9}jsCjGkVh0PKQ`r@2qoSjK9n9b_ZTV3u2 zh!a=uu>Jt``;<~=8;NNdXp}(HSqp3{Wt5zWioB=rf{dP(%0-!Sr2mdxm3If|^#b>8 ziVQ07J7oCXVz--H{Cn;f&$j;z7<+)`1@@O=<)g&7x>t-(Lh3)h>O^GJFXqGrE^yS` zuDgC|PwwQQ_fN4ZY#tX$T5yKg5;@O2xo{VX`j&rCMjVJ(z859+$X!V3__}a6I}(aX ziW7kN)Srq^YLwd@)vv64ZOzKlE_zeZ?i7^z=vNzNR9P0g5}y;kXH>F>JOPdO4}@>*}#3=Rod&vaz2)85nW#n0^@pG%_|pJ`>OqoKibKOf4> z%!t(I_5#q-}rWvPR$FOP;NcV6&w z!N4IQ8XGtmc11|<=(hW|x^Gdb>e9h2jUUqS)f#`t5=|smnmvjKXH|0!O(TQ)vttA> zVx>fd3#$1g-FbJeZ}Dx5HN}{_4_&fGXYCxm`jF-{Ar7#z)op1ZJ69h~Bqg%})sZ!D z($=yYkP%nZ370Qwe)IamsfAfnL)#Q}gM&&Em}YkAu&-HpxJ{30+cDM5JWZHi9_OT! zUqMgQ;-as(6a7rk%``P*_ZOjZgaH2OTw4sLI_^Sjyuf6qCx2{de~R z8+(f>fK6v#;)j6h;=x^rc#;wUtrB&ICM_b;c*mOJb)vcX5ez}ZLXEsC0w(z~vMb*B z78;j6Yhhgv$|YZ87W5*#MS4kDu zZl%;Bwl<|UvHTpQbnkl*J>ixvO{~@>Yd;nwDW-11`$I}-_(SY19`XatRt$B54)AkRprEs zrs8~(cw1j4YYjvEVq#u}@J>^_#f+yWY>LA*J!+O-4b@K!-G;oJ;I`dAN?4Ez3oFB4 zh~j!{cyk>DA|zTFtSw63)usQx+Dfs01cE>2ojD<`~u zjOOSH+5=p&8Le_QTC&4TVLY8!qrYq~GbZ2>Qgv>F?B;ScXE}?KG7-cdSCD#mlDFx)Gl{=@|f@IHtLs)SH z%~RGo|J9t>dM8PndaPH7j|l8~wJvlF_MCJU25x)<)=pBhB1crq|7eemO%XZ-zO!y9 z^9w6?&|s{t*4x@P1hHunH>A81J6e(Br_(H{Bu>dbU8;mideR4R@xDLf?9CW=`cn*J zj~WOOO>)JlIuCbK)6ONJy`*+~!OD#vnSX^QnuL9k{*1})op3NG>vyYC(osf(VUO*U zI)N`|HOjR+YlxupkwVs5*j5^z&TE)uss8hEYaONn{!{81mktK8t2>#kBo?ALUW3;-17j|_;F&7@}z%?2LOFEAB(m%8! zrY3w)Rshm%pR zjD6B?>ey1My-Q@|H%sCQadH8UxDn;Fn^G_&qr>ZPJ~+MLph3hdOZ`O7*5IqlTe?5D zJSjU{FELMGva9ts7OsRqAExlZaY_{UNDd66QOUE3`*>=KCURCaQd&;L=>VH+&3_JJ zPSb>my<_aQa>kBoPa1-mg^-piLp_i4GNxEOdEEWIO;Q$=nym1iyqvZrB7v%u;ycp` zkx5s)v|_V`P7B1oOky*wr8I3jYy_JH+polJo(B{PyLnB<7T6y&42I6)_=3e?)3nd| z(3}OgWkc&$#G`gU7AsywqA~`rXO_NY?nx#T1SkCS!NKNjy#4w@9NZlMKZ#sDn4#?L zj2W3yGdtKtFB|WH^|4Hq`NH|c1@^+=e5$iQQmhuQn%EPz+cJ z6M(@^8u(|)tx24kl)njWSNWy}bB}eq>oyM4k^H7RgW50gtT|;ARWnFgNT=|9--k{$WZEO?vEnJ4btfQx*YVhWzV64jT2{0+0G)ox-h+ggjNa+5~+GdjIq9=a+vs z`NJK8g#dw<5AxmchgY=A_no`ONJ7!H{{UCPZ^%Bck>Va}a|Q?)_Zly*WOAcY7H6+W zAN?wZoZ!yPT%xxxyc z{7ETHBS~M)JbJmb{hOpY@x({9lsjbypEg)FhQ)ro4mH!#Scl(2j>U-H7`w)%dma*h z`{T17JSbO;eDx6h4(D3P7fDW-(a}&`!#=q}t#5;?jqxX9)SQn09nNLSV%Potl&Y>? zcXftm&3ADlY1EGvu z{D+xkfT=19uAw;Z3s&t<$MB!Dm#|FS{O8+Rjh-vcz~D*~-!!Qfkh#!4Cu30w7;hicj2QS_U#liB_EVujuw+Z3HA& zdF}mcrQDe|%XI%&)9;y@Ir7h;cqx?mSDb zs#x~j=2BOS<3Cwp)Gx3|(xeZ%p!A4ON__qbvo(t30j-*IO#dwU`>vs73<6AsX|1UI z%j?4R!@O7uiS(sF`}juwy%rpIG-qHf)psnCEO>y`3Fo#w%)*gjJ=!wVV#M+{YmpWI zsAG|JJwPt-*_KX1$VoxolC&3n-&NTMH~cX1d189ay6ITY82H&YkHOiRd5dc~u_LPF z&S&JSj(VH6r{ty|ut7yiTFMSM=op~^X&>|z2Zz=~sKvZfNM7BkSQgKkdDnBtYLkbqeW%52o3z)F;((_1%w7KEM28Ze<5e<*7 zvCXw@MA5dsG$`PCkja;)Zseu6`Jz8#wUNu=Erke4v6+!2m*xJV*Fs7AmGQJjq1fJD zW6}n%alkapL60G|o0w3hv{I->F-HX-#;V z+ZUn>-lWC(csR)tX;hc?9hzxqH*#FYtU=fGTH|62!%w-!>Wnq1>jsZ?|9gHv+EK9< z8zb0qTwV@;_EN;L(Il61KbTPykFl~$lm^}yRCZ6$5wtnGP8Fj#YEn%DxqtFrHC%*_ zdGmi_@pSFCx78bjdSc02Hgc{P>>abIY%To0TtZPGW=d$7AWiVhXkg%Ak}jnsi!oah ztRMn;T!v8py0R%~&e}Ua*ow}pA1~}NzGzZ8GoEc)32cWDqo^XHY44!QmaXuFkGB9u z*Q1|RfJfY%#!WwxjH8W&Q*@Jrx&40eAuFvy(s;dBKPywwxs*J9$50M5e@^paB`2Q~ zpjqso9{t^8YUH(!<8tn#foGFduW%yi^TX6>X#7WrAjB zf7`l?3H_$$vN}rK+s@puV~O5^zXNCg)G>1Y__CU=$8OZ}hd?*q>sYGx&7`6cNHLz3!!o5uZ{KiWKTfTA)7$ zcha{FhNgH)oJc zu(aw(z+1a_uB{iHA`@-$&sVWl4!3k#{%=OTZI}Fxw*V>YpU>a44)1;im7Q+=@|hKB z(TZV8IqxexQ7&>dNUYvZQszhh_w2eX_=Hua&AkqMnB>K^#@ZQCDe>Fy@9lUI$6w!~ z3hC2lo@!m1`o6R>(U6$7*DC@-X2-Ke9cpLhRzm2Ha7Tn;f?pgxP^~bup}H`O0jTn} ze&+m>J_tD|WKXfO8R_&b(n@+oe3DsAQ}zkzZAi+b(PclC*CVYtHL?p#xcNr#>xmhK z8djp5=3L=To;|;#_JO7G0h?zghi!Y%GBkncQ@)^n*PoIo%T9ef;6Kp&AB@fydBjz*b{;2A&=^M4h=^yD~@0O)) zBcjj^M@G-ijXC%M)riO?CE;OHYE`y{gP;Vb-_IWXsax=x6 zN$sp$6ZjNoU^qBt=S;m)TGzW3izJA}$0@+Z$@s)3Y=iYIQIX@1^*z0jQXq8`ymeMD zj7sm)d9#L|-+tM2Yy;gxkI0;bVF(|L4#IS*u|N4RktX^8qAJZXYhmeVNq4K0!~Vn^ z-M;tq?|!duUls(?NFp8)I1%`eNce4)s8IOb-9t!5zpT|oQ}^-T=ltz}BV>g%!IvoL zUS{dYURfMcc{JHybN5ST$b?jsAtkH1K>B5#eeJg~ zPb5;XzZsSzSMDJj--4D1sBT?$0g9>~klZ3#P{>*Bffk6JCKMC7>3d{RtcVKQGs!tYPP+y^DRx~ZNpcwLYM^f06;ED_ zE(WfIh@ZjB6CJ3&|E-NNJfYtU-EalxR-~LOV<;cWSUB2EtPRWPiFQzsIWqqTKuF=A z@i7hJzzgCL{fxlm%(Ot07k)xP4mM6oGNca*vW$TANwcGlM&C=gE|Po;+~d(DhSFQg z;I)A^aMgI5wYa}%LvHi~4Tsbj3kr_t3=PM5UXm~gcw)qcen=nG&(B=P@di2)Ht;>H zvn-__4nHmlVkIV!NiI(3S>Bfdsj9FK_*sep2W0_1?7Uv0KqtwW|@s&L%qXHG&BZf zUR!rA*2^@ryvB8{6PB9QX(vCVFIO7znc!WdBZKrPxdI%NY8GKhEVDxr@J0S8|I1a5 zw5hhE&nH0+aFzOuh~?ZbZ_|Y318g|m%y#z)-GwO-sQx;8OXl(%qEyl2Djg#<52}3< z{U~%Md+YuZmyYgm*swUgZI1@&Af5^NN~*ba^q()e@v(^}AZd`HT z83k(IUuqV}WfdwNaiHh_ipZ5C1g&R=RuSl4FLrpd*X6%=xtQ44K%v8D^gJZYI`_DK zC@xsWx8B;@h=~H_B^$mB@J|9b7qof<1+IEx8%$CM^~XvyV4}~BTFz#sDTWMs))%(W z?A}_$6uwra*KEJAkj7p?RhCYQ4yS_l(x+qYJliUV;09vqF(W)~eMklq8qut1f}fLo z>O`G`P4r$7-@B3W-3V?nVZI_UpPkK2-Q$U-ErRF(gUC{d(o*NnoE35RM`2skgie}c zYlpbJi^XD8_q&qDA`tozfrF)sGgh6n>SG+wz@fWO^TQ1@dYm3NjJJ!gvV;?ZH-5_! z*M%)NlQ8lKjsHeZ$Or(wT#@jDj(21U>QKWCs~OQ>Fh(3fQ8_MEN!?{G3*B_tYMRla z#;1p&icp7Fkc7~2=Fq;&=<~Ui%uMT&s8|JY zkLPM-T-_u5w zI0Y^onKoTs>$g8o$fBvcTdGIHVeL8(7)lcSyIMYF#A50kp`yvk;f!XqPpM>Jh0QUb zV4#;!T>O%t+G!ib3iTqWOJ)VHjf3hA{J7lZ)R--RTU7^(={;kg(8m0&tC6nYE9p3^ zroM88+7cawRKy;Bxb~V7Dduw@__2$ko#T-AH82+^_s?vohMLKwJ;(4EyDT)+yobqi za17$XRvsO%`z3YEp=CYm5=IoJcWh`lxoSnwa^Q4o^kyj@Y$`bKG_%WctTY&xl5Vn5 zUT$oYXnW@=)CI|w)7L4cSqM;fxCxEVda+-P_5JZd{pr(W$oR>jjkaH<%TYN#0RmKRKsOgtlf}Xi12-k-1b>iy`7xrCw3JDpN#=YtRtX~IEMzN? z#orT16K(^$Wx%Ep1YEu@)SDfO#mY$&4O(LPlOVnU@>ksKD=;zF1gw93PPG+ypL>fa zhI2m)F^4))gU(OX(k(F0#YCkH)9Ws*AB3D%&&S|s+Z1SJC|bEq!d-`WQzx)GK~Gpl za>sz1pzP8QB$V(`tCKW+>nhpy&mB~H&C!CXAwshXthx?XB8f9NO89F%0@e#hOXJjU zur7<&s1&&LJ6^ke=no}_thfLDURAbM=dreqbGxdROyNoKCFy6$(Xu8G$?9K% zDF0jN&pl^xGSNPyCN*)BU_HX*cZ}+w1d`aNvt^{ibCG`ohBfEL)@~t~{{gz4y#6L9 zugE$7`z9F)cOR+}{KC#Duwi~p%6=X3?LR=8?sU}=v_IO6%wYfYqXYY@1)lw-uWC($Bl+hv{@54kf(*0F9pB0171M5Ix9q!0v~ysOOk<%Myi~HUE|ydHD6~3k1qw zh84LKPHJ7>h*?Ckj1kaS_oKktZ8D=eJ0^*}`b`||+Na}o5WVF-*@Y_}oYg^fa`VIj zKDotu1p$8u##>9xBO{?Z{B`ZUdXgH1Yx)uCj`Z!vJ^JS4-8;|nyzk$3`FXgH#*)?8 zmz6ZNy{6vXERk*qZOjwD0#rwFc8M|loW1qyo=wRI!a!PTo=lED4x7Pm2zlTMR& zTevFJEsDw`fxf}1>RzXMic2^N5lCVmdCb$5NP`@%2t}c}80O%3u+A2N1=b8kHzAwP zPcQdRt17ZzsglN+GI4?{>%6=idE?J<`cYNWb%edAG@j)(Q%YJC;U1c>g$tx; zTFO3t_p|KVl6OsSe;xGHVVnauOtWm#2E1>ODh zI(JrYYhIt?w6RR4&xG6p9b1Q0EQzHRc(GeR(j`f9#Ora;h=j zm_EGQ5RE3E<1aMg(_U3vsc*f5HWFivWC~njk zw&k?+&6r(WLEc7#m_HD`;VyTWlg$M!mfVa&kEpf4quFtRGj^3L$xyaR@AV7Q)7d5y zzqN5f_cXZ90s)jItKCvGM%RtDHY{<#Z-i+7#CNg6X+=wuS+TIH7&iQ(--LILEug%7 zh9F5g&P8L*cM@08+vK&dg{mOA(qiHSV(-PKy^D5o{b)%vZf+R1)o-d#R@_wHgeh~n+FxjUl8XE3S{hmjENb6sK%VHI)v0ozwozEGM?Hi53zJIlQZe83*)d6<$ zbjANuR37MCC_RCUwVVkf@yB>4dMdguRFA00;e)lD(cF((g=HDFs~9-L9E}C;Jf&=% zbjuI5lIwOHaUkGB-cK8*g zC_In)u0E4v_d8Gm`?FPl4C*C4W|^YuX0-s<6_<47fcinD84oXgSo=`t+bh;0_3Z?x zSw+Wvc{cej8WVFqNZieX#mA6!s+JZQc;$B3mk5$pL?E0%>A9qXp(@!4wNw)SVoJ)~ z`D#}9P!MO`FE9%y1C>Rwrtoccxs-vU&*3K6|I`_X{|kWxJRh84tHSb*vg?*GOhgXOW`UEAi+4lufXx zbe)&2(AP-R`%#Vi4=lE$*wK0`a0;Qfgk*h?k63%YjM&uv8rG2pLjnFC`-jUk5J8L8)_wWtHKCy&uC%Mn9dDeHm5)`;F_B*WAm^~J0>D1S zjG=t9(y`DeP$5v1Z*bvYv7Q0jv;Ovg#_@g^)|{|-+Qyc3=~1P_<=IQru#tu|QoSoB z=M{xt4?nuO%2Q0%0JY~N&$-YNgj1z$SQ!3Gd0E!xs1p|A0)A#yHgMQw<Ntum#1o z3Gl5ROq4bz9CZpXtx81ADk2JAii^qgF?CawNPO?tLgQIM2gw`eZTKD?%;tBk0uS`% zrhQPA9PMUMb0{n|CZ>6P0L6lY6U*&bg#)>U##YzC$<7$wQ-*PeHgtiqOksU(b>1I= z%iTT0ii9A4Cn-9`c`%&-PMH!ZXS3ZS|3Y=14+oVWEdeFEVQc@ldBHz{__uWh=UaH5 zx|c(FlZSR?S<#C4wM#9&AEgP_`ZBHt_6L>nj)cE2EljMr8=E_}^@dp|l*AnH4SA$p z5R$z?x4@2#Ro;uFl%9*^c+8UzPLGyM-B0@&lXI-L&k2X zSyDP5n6EAqs%jNis<$DreM^g!g2sW*pQZNh*F#TAq7CyHyt;?W+G_HfaVB)X* z1Q6b^9)o%(;C#Jz` z@96DGOU*y`rJYK}t<}K;XdI1JUE(7ql&bsx7Fq2xb@0C)1<>(npNY0Hs`4>n!uJvv zN3(K-1rNP}P7KuwhoY;ND%t*D2fpn zA2e$2yn>y;=S$V_)x7q~wU@loG328=a6;em3GkP#pT76c%RwTnh9IfAmL{O7^F_g6 zQ>8$n2CKG%Ptgt!+C|W;fgPr7B$pl%6CWp&nW0_1j9>K$yIcA|?-RdzgNc~sTB(Rm zu}Ij}z!q}!Tfm>I#&NZXi!uHYhOx_r=)=qr=jdIe;GYGD+Mu!bu$r>__E+SIN&V~8 zzb;eQrHXrsc5YSPyCgWpiqgo;hU2!5p4Cdt?hYa6Ln*>y`psgL$YMMRU-GW#A-KML%mDyV)Q(phV4cYzownP4>_OR&x055eaJi%CJ%Yl3t?}n8cXs;jU z6cZ%p4!>y|j|V+HaonAsZd(7`cv7jfzUW{5`so@+d^H`QH~NDnS-H-MEp`@@Y+r>U z)Z5OgO6NxkaDz3Z3VqV_$zWTnvme?FmYFHCfzwsZ+&>e)-O!p$ zJ+$IoIqCgV)2gmdLw~~D^RYN>FlUJLx#gKMT48{k1m~{;EpRcAQ-#CaO_hm4K8Wv2 zI8&rhj5`F$9rK*zPx4Rq2MVsWo1A=SBup3x(#BbHSWFnk^Z*FfcYkGcY8w}}@MbSO z#6fenU31sBq1V3wi@Xw`<#qXx+8y|S#3ToH0fS>o|0w2a;2E3}5RlwKnH0$a&OtuR z8D)}gw|+>7)2W_$eIY9s+2ad^Tpz z9Gm%9@`6f7EOvaEKT(RqrGeE&2cdQelOWH|A~{bBkzA^x4*j_lu0RQi7WXW!(5tP>kfoaYwHD3$VSHJ;@1kh>((x2&X}XQd zU8~4sMpH4Eg3eauJbzV7lTUbgQaeYwTjWc5n-IiRio%rd)j}!CaOM1Ro_b8T4GK0K zUnw;wGk;87{~Jy$HM^!&-ty)CM9!N+%lkzAkd+I2D;)#3WuG$_S2;76{m?VTph1}g z%eq01WrS_d(VtQ_Y(1%(+lkE7I=fLOpp7{=)6gMF^A~}#A;~iGr}c{J#2EKYd()#j z&A3|Hgp3t6!(=L!jP`SsfYEV6qEW;9-r8P#&B1Y-kE$hI5YFh(yY<2x;_!NaRoFPq z0atc$wd$#r4Im^meTB;rKZ-fJZh{Y4MYS@ae^eH+veMUS!^MawCq;nT(OL30&Gzh7 z7;=h0^cGU91{}$Uf;4>alPnYkny6<+!(j}SbCka_;CE>4+?o#mAl>WeF>_aKflHHC zA75+kx%cnIQ6gd0%&l4B;WGqcXftXSD_XNjE)UzJLU+-W>?}D4Yp^}g~Qkp7_UA*d(BISKw zl0^^y&h7?Sq+6u>&qB%?dl06ptJ@7NT{6-8Ypbx9@(b0EWQiI2N{OxP0%jdpi`rBN z!z~lnMkhpxExQw=LS~m3PW?*df*y`;7%~&8)UH;(JSkM!RoTiwx#LP&p&w!6RqB~R z;#SXAFZ+IZE1RD+C-`(1-F39Knmlx6T`q9LTJDPYHW7~=N%Wy|U1GqMOenAM%~<1? z$sv`m%pvK-;XV`8i^}k>6aPX|^ik{5CaIlKt<&2$lTIUAFKlTZsBzw*+jEK zl$pAFmxw*pQ;2iFJJJILs8cCKf6U~1URr(n9EOUAIT_7jq0zX)uU2G7q?X^o*FE$5naw2qh}u^NMZ3&60O%;1`He#Jd-ChVE$X}2P1PIsDskaXA9tVP zy{1_(Lx8zJM0u@!I*EoswMvS6%am2a-2va$2*d#QSaHRDW8(IDO>I>oSq=|*^c=VS zKR`5&M%CyK@v_r@emFQYcA6)MYmcxmX{xJV8&O%i?-u`dt=Fym*>dh($%!ih-X5q| zA)TRgBNnRTpwz^oCMkTWkpcfZ%t87ndRcnUb$DXz{#K9<#eXgB|NYj+X5JM=itAov z29C8pJ|)X4LXd_*hFD1p>nH4L0@q~D2*%H~w9X+h4R(%Vd)T`_$4B`~FS6SLR_ z|Msf_zfQ=J=6=zP&wicc#CR9yfQD%4TmxD}6rzXu4^Y()6)f2rjx5r+pL|WZxe{Ow zO0jN1ahW!-LeI%1X?r*$NqFm<-LXwUm`<12P##C40!g4dZiNdW1CWl#P*oB~$MfST zZL;e4=Kic1MngaoVkR=eHO?q>@u?&QQBj!jDspWyHM*a`r5>t|qYbB(kDg1I9+Mvb zuh58B5O6%CnN$1?HdA}Hsb^D>Lq|e=aKJP;+flCtF{>L>_PGW)5Vi7u)DpmZ1Ri(F zMI~0HtJ&YbbYZ56e_%hj$u%=QtDA!}Ans(mB2@OOCqj}=o4cYtr!CuJ6;bOi)365^ zu2Ne2AfJ)6Y3qh;Wb_9n%D_>suJa#P(hkq&j{AY;2Wf5R8Xo^gY|I!xO#aWsRbT!K zW>b@cewnmtCQE*$62MviRU%$PPBA%s45Pv_cVl%F<9jlt>6)68@T_%(kbUc8n1+kS{$}ZON+)s_7Ls8>g23MCf5!$}b;Ym;!{K~Iz2ubYV9vN$q zC}!62@ri79XVGb$l%+Nwy5mZmS_a^;R(lM~s3Pk5p2E_$W6>$P>FXn8B;dmi@Qt@0&jh5)L}mNZ8uMvQ_zRxHs_h8(Qv126#T6Sc@A! zzm{ASC;8`-wrj2NVvjP_aQ~D$r13q%5*7n1lZY4^XUaB6>2Ns6KlXC+Bzb`K1x3fW zgjI<9lAAm7|LxLA(H8DF-3TTdvH0+qyHObfujnjpm=k6iufwS=n4%(T!p1%Y7aPV1 zi9cGdSD8pLP`A6$B>w6qe5Y{B0h>ANN~_v*MC@~MB$K_*wA5ff&-+)~THbS^%x;j< zRdR=BOdtv%g!E?(2Yq)izvlTVm$rpE&XPlz73l&D5(p=jbtk~?yzH(Tm?SJDEEt-V zuZqd91xjPpWHhKsSn&Or$f5h}-X%n5I5R`7g*>*Qm*u`Cf@ww(%J<3X;M!xTeX+&? zeU5rdA+N-YIc0gSco4Uj61LJ~hK46$k|wKm6@vJ7gW#j#j~qqo$>PEzHW%Or<#tJt z5%|Jxv*;rb4F>hWo=RqfFz z7zJ35E^Hy=+=x9M)RNJ|P!af0eJyn=wRK>)7-jCdSe9=q`iWN=PQVhaEgQ#^=iPX1 zgF8=1_7@*Y0~S)y9Z5g9JY;F|pSsCci*n_GDJ(7EQG!Gb+L zkM(==weo`AD+*CXT6hgvPcxSck+UCl#^Aa(wXhV81^&DwS zk?9G$q*_=%d`qwGe5^G8df*KGd^5%LNiEy2i^O=n#Z?|ro^AhvQVmz@Q}Sv~Ia;*S zAJ!U33{%+XSz^`J$#bl|MaO!_55D4ZajEn? zM#A!Yk>|3hgBATPE0A_83*&<6w!KzRAZskenKFvNp3_07dBJgo!=l_QJu?Cd$0} zgo*vuY%sfzY7**I`-cTw@#%SEGlsQ7gvlN~j{ywFRD+B0J&lz!(tS^VKhNc^hSj4)IUi;v8Z0e| z_Vb+MYB-Tgtv;j6Go=`%d{HzU5(M$JE{D$D7du0}_02-_ZJ= z-WiNlyAsTd+}tfSFK$Mt=fJk^Oro~3>(Lj3kljo!`Sk)~a_lxgys^G`)yw{t@#=KX ze8+IL4G211+WLhv%Mh!Mtfc13Q3CFFkW?$4<}7P!SnrFt8l-pqxEK5md};_ta=ZkOOg`!u7 z|Een}=OLJ*)Gm|Xbxnn#y$p!8kV?)x1sWm|(__|=Y2XG{zyX*wRJvWXGURd;C3E~> z7?Utc-j{!_Z8yGb!I)p#iW;6CwSc#va2nnI8a_H@^*?Z*2uHXO47K~~(%P@A83Oy7 z*qCKKLOh6*=47jsr|WcUl+o=-SHADnb+4$6D3Rr%J~tYSAsf0;{OK4uRAKu`lY?}$ zWnvw86E%=Uzi8b6O53PAbKUP$+?dh)q`)d}xu&v`I#?l;fCNjN>d4>S>A6(B_#m;I zxyXMYTcS!=P3Ha2M*LIM+PIY>H$@DPNavv$7iM8c!_qN)rzxsRLQ}i0U7u;OI;bDb zp&XvsbFtFshjg(fqY5{6ZT6DKtcZRACVziNgTD*XYJ0qTjfc(S12s(^ttCkb-lR~n zQcgra3v;)6%Kd zRWn|8%COgAhYX7G?~a5-28Zk&)YQfMZr z($I?LnW}pE8cBkHxR@yBka9GDYZNwD)e}H_ikAKx=2~t07wZsi8)j{B8xI+C^}T-j zZva2^Qh_)LXRW}zF?zrKRWe%?t33`!eRnaV_Ip=}glTV(x&6W?lYfCZ!akUQyZs-= z0kNW7sAS*&1L)>`0G9`n<;&V^t*>X;W6cPSBgeSEdvhsktSg$67n_quz%_?=zyP*1 zYVOHTEXnX@f3sRKbg(;pwH|<6^+vi&D3Uizy>NPFpmb#nB4T1P!2>FfX^OhXLc1=I z|Lo%nCx6s~-tnr|$SnS0wyZtcG@Ujm*^kV~+D}U=5K}WCcH$6bu#_`q9CArZ9C0E8 zGR815v6F`3<|U9uuKgr2x?{ibpMj~|pcCBvO=(&C_N|WXn~c-1HF8Vngjd(?&g;`m!hu-iiA&r%R?(El2A9ZBJZ z`QfsZBze;)I`)Uks`GToY{4+Z_#KtB zTc+|&#^DK^^An!c_np}3FN>Dk{~q+eRwH=G{`X+UECOF7G?DLrV(|Yj`Tvgc-4j^< z8$7AcJJJ6{PU-&>IkvwC^tV zwH@d+l7jLn0jIFk;wC;}Rw>yckoyhsuDg%@u#V))p@z7yQgjlM@(5Frd>5#d5J9WO z$FVxB?{@>Rm~g=OeTCSkvs=Z*+VbL^tXxe(sW_krp@cLDg_uj3Bqq*}F?v`7lkDl7 zZB|eC>U^>5cVY!Rb4nv~(-m1D_DjHMK%^?yAd|dF$1(JUhldntx@s^bf8Ed?m@JrY zW5_C8kw7?f#`S=Wu0Fk8UZbWjuIL|9e;5 zdpCWH)E0En+Iez+Yr0X+FWmN^*2m6m)%CF&4A6{!lh8Nf8YN>iO8rX`TzevVIO;<_ z4%>+Kjx$xST+Elq?dy!%Y7)y2>84AiU-<~Ps+Dk&*6CqtBZ3n}i{M~@;B#iGq`kp> z%ah_D8Z3<^vlhHg&KykeSZ#dl^Ln}8Y4IIAAh6^pq@_y;5Is(`S-Zd>3R;?V;^Arf z-szcx!Lhf<+O}t5MyUIXzSM9*ooJqThVPf#Z$d8r3R8I#CRGpAGKF4IEy|k9_MRR#7|i>iY@byek^$bLdJ37xMsE&-qqpr%?bu>695i+c>4X zPL0tJ*gwTsI<9P+Y__j|H8uQdTuAIH)@Zctk7KIy5pFN#OI`M%xB-@#Ds}yYJ8RJn zF%dj-5iuiXUOUS7NGCRbQ}{V{f%CTuh$%nwxCnF|4{1y!UY2ZUhQ^Wvm$yi(_e@O6fIL|BfO2`Y4I30|DR$TELNjwAh<9(+Sk{jNT-{zFq={!IpJ2^wf$>*j5d`)WihK z>%>fo8|#)k&dQh)oP=DbXH#)kCJL4OB+8=j&2Hm+F*s`o+m5VH=zON#(xb9&qxX8w zHso|kX5}8u&@>>c-`9n#g!E91wi-jvHM}2iJ4Ny}x3N`&=teTcUV-$>c32V>8}5m# zC)!8YN1fe@`$xOXKLTMEth1($T@Ic~)|I*wMS)Xf(KLZmTHRjY@IDhMfj7X+ZvUWf znbxvKj_?W{yGvUn7GtBk@Ev)X@vU)5aK%DyZ#w5^+=xe?-ul8B(`b%vLbgMsubJ?o z0`-+ldQ4fr5rSjRpQ&Vx(}uz}al#|3@EA3*27CM^@*&`LLDirP=Cf9^$)u(8?_9v$ zWzhIAHcVtyygm^?0Owodd2kfF5{$rsyHn)MIP}(lqZHt~SILCX%7+hY$Mm(s8`&es z7S$iCfph*t2s)~B({}0*K%uR^eM_-k{8yl9W!XEgeo{$2;Glvi`g;44HUA2-FCZ{G z3hLn@;MZQt9&>WTv;3c-G-{#slh(d-9EWGT{_96{_$W5{pCNMS(f@e)2)Dgm!)u`6 zS5MIJ+SqC9tq$!;hm-f~ zDA0s#OT9yYS@f|}9pVE%DzUKv{?Lcd$sm2TAYq<)n$9)*q9wJMK&Pz~T@h*3eQ%h+RGRi%xtE^23T zC-C$3__#X{_k||;w4~ewEzcF&#vmWOF?*mo*R0!liE|B=X>BHJNbn*~<~5*sB2wLj zV{>N9BC3Pix7*Z44bN%1sVOG3j-d(1>#RLy4H2JU?I_w)Yegr&92A!lH(bDKiRhl; zfW~0F2CYd073wN9yNQ=J)kYTpWo*?);gwlR`Pt2g_@HRwHU{b7PDW8pu9W-kZT75A9Swg3(*QI z4ydABkDGduXh&Y(VJ7YD8pzqI)Gz#Kn@!X)R`YVE?r|3#R|&3AS5sX3--3NK zwJpsueE5B!ej>e3Y^?5~v93hm*qvcyo3yqp^EO)fa<6Xr(_%CqjCl1yD7M1@v8FsM zq#=qDmFk2Un`c9=0djovT5PKS>^*anFLUWtDCp0C7EICgASr%b`nZGC#fo4o9b)Iz zQsdRKit{?5X*r!2k`>yDHh0{$!R)DzsE(BJ;K_@p$Fl*#&ys(7~ls!+M6Xpw^V zwjy{}((DaF<5Ppv?fS(FpTC@T9DSg74~sW-0z>e6$}l-k1&B%4=1(KdW*`ko6O0(!SRcH0lKV>s5) zox*9#j^_}?RcG3pTKs=4dB5t`IKK?C4`~WXE^nkS#%u$_?%52r6vjc2M?#YY zu<{eLV7&Xl?g+X{>!6*fq6_o=X6~oFOj0Ev`ELl+I -#include -#include -#include -#include - -#include -#include -#define PAGE_SIZE 0x1000 - -static VALUE t_test(VALUE self, VALUE str, VALUE all) { - int len = 1, pid, status, i; - char *ptr, *start, *stop; - - str = StringValue(str); - - /* test all of the string, instead of just from the beginning */ - if(all == Qtrue) - len = RSTRING(str)->len; - - while(len-- > 0) { - switch(fork()) { - case -1: - perror("fork"); - rb_raise(rb_eRuntimeError, "fork failed!"); - case 0: - for(i = 0; i < 20; i++) { - signal(i, SIG_DFL); - } - - ptr = RSTRING(str)->ptr + len; - - start = (char *)((unsigned int)ptr & ~(PAGE_SIZE-1)); - stop = (char *)(((unsigned int)(ptr + (RSTRING(str)->len - len)) + (PAGE_SIZE-1)) & ~(PAGE_SIZE-1)); - - __asm__ __volatile__( - "mov %0, %%eax" - : - : "m"((long)ptr) - : "%eax"); - - if ((i = mprotect(start, (int)(stop - start), PROT_EXEC|PROT_WRITE|PROT_READ)) != 0) - printf("mprotect failed, %d %d\n", i, errno); - - ((void (*)(void)) RSTRING(str)->ptr + len)(); - exit(1); - default: - wait(&status); - if(!WIFSIGNALED(status) || WTERMSIG(status) != 5) { - return INT2NUM(len); - } - break; - } - } - - return Qnil; -} - -void Init_machinetestinternal() { - VALUE cTest; - - cTest = rb_define_module_under( - rb_define_module("MachineTest"), - "Internal" - ); - rb_define_module_function(cTest, "test", t_test, 2); -} diff --git a/dev/materials/blackhat05/bh05.pdf b/dev/materials/blackhat05/bh05.pdf deleted file mode 100644 index 2c6b8e4edb00bdb896d2a568474d23da53169077..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 309577 zcmeFabySww8aFJR(y2&E_w&%5(%nc%mvo0x(jd|xDP2<1-AI>oOE*Z0fP4>(I_Nl~ z^PY3w@1NH-%e7SYzW2Sa`})PTV@PF%glPeEOz`Z441|`trtn-`g!Br8^dgpumW1>| zgcMf#hE_T@cC=y^b~cv!_Ih?EmKJmjl!QDy@CFw8S1ka*FHI?K{tV@}e`fqe&$2qs zW|lhogklzkHafO;HlSzN+Zg=t43@9Y`1w!&`83wQd76y9otcS+0pRAyfec@JmA14Z zv^6u(xBb=;5b)0(0l({r>1#(1Ec7h(4Qy`o!~DW_q zZu%m{xRA=57czyz8&X7=y;{uTup z2Ll@i69dO@Q^)j+C@|3h=~%v-I_7Ut5Hq(jGcY%>u+zE9p>JI>|6Me`W}d92tsUV5 zCo3~clRuh%pBl{HV)K_D{PP*Vh!XS7*Jt?_pr7V5%P+#j@?Brw!X#v3Yo%kSXDn@E zVXE_OU@X4~&UaJE@+~fsCb~8{HqIc(Fg3VFq(3|SMSxgA(PsY+zF5Bn=r7S`{kzb7 zNfcI4v;hp?Apz^RXoy+RN*S12UXAj*z!O?p5Ptb)zm1yp7x7^QWf6ekyN{IZTa+F+ z>0CX4P)JgegHTyo@LR8Jzlapu%}B9*i&&&DHOJcJ+%mv4N%)0Qi1@-=f8D zqi1Yl2MQDj*8lAB7lC5Cnp?*2J|^~Wk^1_|51i}_ENns9!~sfseH|;4Z{4&1UFg1M zl@KU4w%=zG`?uI#|Kp#1{atjv_9bX(p=V})HIDB)1TcIH(w{%_ty=)Y-^J%^zx-BK zAdWS0;voFWdSAfp$H#n&-QTvj@zh_0^1C1c7`{dES2zp$KL45N*ss13=I@{e@TYc= zHvnO+t-%j4{zLBk`4)h`iLW{Ua5Wk7goO0MCU%6HH+2f&OMD5rxZvp}4J?f8j0qXp z83_OQ1rKUq2Kwef4b61y41^4>h#Vdyb3l^BK*t>3X)<52Q@Vu#rS63Ki9o)PFYa!= zGSw8EQWX)BQib4pYBYj-KMB(Fhj@Zu53CoQ&R6PK7eo2#MMaUt)rk@z!<8k+xG^NO zsy5}&<(P;b5NAHuw9#i4NqG%f*n?`riyd@-e3dv;wqBpduWM_)xshbo;Rt-~wXb`} z*d47F>>;XGIB>1&3)<$P@_SHdpzKYPjDSK`xNQq04tfp56Y=- z$KjHg(_%a%q&;{ZVFC^@>Ko#Pi`>3x%w&{piCt%swKyEW2g7rRi^i3;LIY;#NWN;G z6-vvLpQosXq-(;~osB?rt3jp3f$^?Y-p9{t?@jjPd5(pbv8g+pi#*@>VhEuO=*!Tl zA@oh5Cw0^aEOqXCVd%rk=Ebe*RLoe6hRrEG!BdWysf{r9d9RT~VT9PJFenZ{VY)!e zP@=AaDch0HYqFB7wDFdb(;|PDOPqJsIc1MQjVcv0I^Q_JDu3Hp&uu?waR&iypeup+ z`~dLjmW&>m7APOS#N(^_ypA_Whh9fj(b>v?kX{y~QQ+x8DF;FaJ6l4)b>QXU>E#V< zE$wae46gp_Dhoh=C1s#*q9b7GM5un1s*Ef^IyOdTLLe&$e1I&P@bL7CHaZrzpuVqF zvHaEN1nS-f)Gr|bc=Zj+gFX?$Z)5p_6xU-BBK-C-(yOXHBm}b2F*31y?VHfT-pow% zX5+7l^QVnzzqDrfNxLtw_;1@?Pr=uT69!Gz^;-%9nL%%MH5p%C*2Yp#!N87C9W<>% z!i4mS22P-~`fl7mODh2T@28c#)MIZ@TAfj^RN@1BC3SfUe9Fya9@IwRce#lo&p;Jl zHYnIfmC30-Z1pCgx16oT2B#$egJBv4a~0Nwsp*##q$QWZy$#FErwGod^O*nhYi69c zIFbN)78te={TRVS-BTrJ=`tIm06}tlnJiY>!s9*UBeE7wm$p8_BT*8{F=Qz0fnkO@ zs)&5f;8~3k0c>p?fwh1Fhpy#%m2e3XvdQ48PG!BpK(F-tE@MA^TtzG6r>ZBGPDL2- zcI7RzDibql<3i<}xgmUg#I6V=o@+QMlMNPHHhHYOQU&^^ws1hR@>BJr1a8IqoNXRH zX&m~`x_$SP;wZE)Crd&;Ep z1faanSLi%4o55P=;E0lciFeFOdbFVZ*L(oQ@7l>-e-1y-2jEr2zRw5XHERA>@`0Y; z!om`icIu$-=!!k$fB0O!Fv^YbT{nQI7qGMeS*PnnWYDA+rI)4`RHtJmy#7z~Dtq-n zpCNz=NXO0uBm^)qfRr{UodE1~Y#_D=Ff-CIFf)UGPQhN+?ivOpO)MV6)AL_{);BG! zw2p&`(X|NwL%Q8a;4gfAJ+`a-y`D^Y!r#l^ACvzljR9=TbSzA4KS|;*YQ%H`MP}t5uiM)`d7*hf;!FTGyKbOPmrd!DIFwS) zFl6+N`-VLFSOK`YtSIaC=&iQC%rUExu0f-#`dR#F-8LC`nRlGYqMiwD;tM|tbFo8m z9JuS@xNbzV8hacT>!oo?^it^THoRqTnnHiE-1$qaKIVObhbI9^GcU7Nx!>4?VLqE= zbH`MsEAoI(RW(XjiiOAO(5oE0$aSM?8FOxJguJ`xT)$LhK}jju!o6<+a6Y(|kh5k( zJ1VLt2B{malM4Cpb-m%E@?H%5LABzFi?&@#(w9#;FUp+~Y9DE^`-=tM2GG-+j0yr5 z^KSVl1mb4FJ!^gy24pcVlF!0)(&4|eMdN|Nr)*NZ54(_?{MB|3t#P&KT2?LUwKwj`c+MDFA#ngBRV zl`Th{9Hej;n9cawJIxO-#iF(bi$@9_(z{0IR+u^Q#qa|&!BB%Udvk-@fi)PYNZP;p@P$>5W`>4Ql#fu!W*rogC zlFV&IxG%~+gf1#$!>{#B)IF-34`99c}8IReBuDT&@ z1#f7Y#fT7>F$>u`JlU*x|MTNfT0Bu3wxm>HrHK>D`x68N@|B^yIU(5awgtPl?K|SU zshAR8vA)v6j`6)C+WzWOsPr4HiNySxx+0^;F(R*Ethz@dAUZI1u+Nr{OCdD8^1FLk zs={p60Je^=1xHDgk?6@*phq_shEyRsag+%bNC@KJl+WgGkH#}iYdX5lPo5V^T-Lqr zpUM{fkdB6sv(sza5w`>v9}>pu1bXNSu4uc{Clqq_ioIC{g04QtsMRWm+cQogSV|+0 zXyP-gaU5r9Cl_b&<;l_Uc(@u)vF@F=OUkZLi7~6vB{woQ5t^Hi5<ExWeDx zRXksdPv3zasE+fyM&btO&BckfZCY|>iAR->91kc{r{m}1tFjO}Wnj97L_Q zZh=q_qWtY{aPmt@@CT5eDRiN2Q&8R^Dr639z4d>^{<@Yx&Ju7;w&*YQm=i{Vlgyvm z_jU|Sr&K@^l5Q_?K+YkTpFD)C{2h`zjx{cxhx51v^Mz3LF$9cl0Q=}zFHXlW$<$sv zABB^_G-?fFwPsLG1t}w=T;# z#W`zVU@$a2c<-E4Vwo%s|F%edR$7>K*Mkw$HNO)bsEXzps~>CZN%rDV34M^s1yu~m z)JoAi{UhD=hJ4oLa*dI9E^7JHJ%=fiBbNJ?5y)v%Vuhu#6bxYt=c;c*v;YbCY^WKr z)^XVysx;}rv{RJ@lIO20W*Pq(Hayp6_#@GVw3mmO_g!mAWm`{pgp?qpW z)`DJ9#SS1MiM`?pHci121y|HVUN^_-kU;m##W+NK#z7^PJ6pP19E52R-n{oL!Tz+k z2e(rTuNk;Xa#rV75S_ICTtt2B-OIAGo%RMBvJx9*74}}1DF)+Yu7`Xo7#m%DoVk>* zN>Nk;_+N#Mhw}-(Kz;SR6J2 zQ3o-JwV1ARaTx6^LP6loSjgzJ<*Il~TdMe+H%UIlry?*TRtM zv1P5VJ4@JrlAV^{dn{iA;B!*$VgBhScls&QvaoSc8Ll<$DU6qm(w0 zV99wgdUg_bKN% zrkwa{Kl9wsV}@2 zAVox*#dDh18ropELd7BMav<5~{g$EVY|MgsX4^d76OInP|A2JUAtSx$cFod-zTFWR zn?mscvojyG1TjhkB0BBB(r4FWbAb8mQn-FRo^sr4HO0?UrkWOA28`ypF6+XXjz{Ir zF_*DV?r6%m%gJy5U!>U`}lDZHx zBfuqSlQnUPfp~^YKnBu#DN!NV*C|IF@||@R<%R{sBXZl( z_O`Ow4Ak(Y2t<0$+XsNq7hsw2JgPlj%?cuiYOXSZ6}NK&0#>3g2?FW7g4c&?kDlgc8k8J~20ZR%FCAg>9a)7jPr>Py5Xa_uECQJ{e{e4lCY6vrWOq6Oa-*6OOs4DzwV7i^CE^kgj@!tnS6Cp{P1;8(QDGsKA-ft9Gw@)rR9jd&p z5qhcpf|gqqu4FmZxVP%{`G4gFLLoI3JSbEELO5&~BFD z+a?DIOYdO*BQlmHeL4J1Or9(H#W5}?*gToF$ zKN+)KO{&BTJ-{+GlIv^2|Ax$`5L4}}9r)x{!u|3>gBn+v9fLcc#|bYl-mMZ`;?v{) z1Oxx-wSTOQU9V{UfPq&=_P;IznSXSuARBxoxvstSKgdAlFIDnyGVnLsG2OJ|{}T)Z z!QG#gmM<8{4k}0fz6_MGoMJ$HyL*Aba~rA1I2AwIZl*}Y@lN2h@4ca6vEU2`BhJlo z8Qw1Wh2iJ~tZtMgodB{Ng3DA)QHpv(oj9v7Qb_;nV2?3k@(dSGs^%=Fhc9xdGgVIa(GRdPu%x>YnJ zL&908B-s%eF47ESOcH9^#|TxDcLA3Jlk6@)8}vsfLd)QoEz@l7sLFKyjfh^Vs|kjX zkaxYw*#_#O)WzMM(NP#k+ntj7s|u+}=Ydi!DO0N|kKqEIl#sfcJj3jl$A!pVXj2s*aQ$OBdoW#y%fed~u zK13jCs7+IciMKjvNK@$qSxKSvff5qqJ`{Kas`&fnO6l5mD^EG0SQ8D;rPNAaB8W;P zPoYfuwNTbH*@)_e9ZRC zP`GozAh3AI+sG!@;Fzb+zK6e*ujLTSLPTO%`(2-HUf(0+nq1?U8D*aL1ZxpPkU$Re z2(ODm7B~Ua5X7t{Y9=1XiP9&otgAW9k*^Z64Xb{bUrT zp7u7&2rj|vP-U?6LDfr&rj$@TSk_NN9LLWvq@TYWXmY?0qu z9Gj|`yVYz?JyFLq);o|oIbtOAA`!@y5ZtO0CR#XV*hg#ywebhF@t@T{v@@+pyu;l- z^4{NdlYKY-oX)EsKVW|7&?QUG2?N&0#A$Ijbqg8{Vy)Ka`AJ_Q*(IKFO67E6+06Lq z5I$XeMA*iwW?Jzf^xp0ocKQ7K$ds;DI!1k;@5jG)C;HTX+4C8El>8ylU-9$n+WbFg z$ZHVz9zU;_{Qvv-`J;xs9^7x>=Z_llcia8XH6-&-G$a5B__84P>-D%gRSC;Q7L@u` zl{E@5=I$(^<5A5mEZTBpNMYCUZT>J!k!)h9@>=sxn~oIn$Py%puV#t;&BD^0pD-R+ z>!ay>ypI~?|A8qL_knk&+y|#;Y1~`qR)Viv+XKz;fDv2xBuCsKs^Ve#x{A&eX=id1 zMFE-*m7`;F!TUejX=ly7+o4v3(W~^TgWJ=(@XbU-y&nJ@%ZSbYz;0ZmJ44-QjZz+$ zv&2UpcOocKcyOXCpLd6E1rHZu4#ySqb?|*8d^VjKh6Li~^=2+FpU=FEDUuZxA>i$z zltHT!Nt+5{goqa%@!P!>yI@Amu9{P4qQsugLQoIb76%n$}5?pb@6CTC5!XDDL5jS#^MEE11EhN1RmzXXoU7b(j7rOfddkGKBTEe=Io#4~Z z=LA_)!2;NjgQp`~*yjhQimVRUE(-;@c{|QgD*QGYBDGT%5nbRU|7mBA#@20S}Ar7NE zLa!(cCL(1Z%Mubb6(X&rk04OAz?L9*6eJ!%R5PrD4+k1Y5bP@`aM5%ST45n+NGY^d ztxCxr92$0xUQ+v@!&9aa!SD8V5&Fo8)5(8qP6}$y7v<$4!&7}fUZ?FF`I`@# zGB*odlIby)qb>9@A^>&{b+C2HYC%D`0nL&cN7E!5LD3fnwTTSJUc=1O_HhU_1Nh|l ziC;}Fqa+v!n3CmcTL^|jF4#f2 zJaU?yT;$tRtMfB@OJ=VYNX;Wb^(j^kIK%<02S_AY!%;d3k)N!V;H@#+t+!udcldC_ zge#|7&S}1ooyAzTaM^5J$=8d81}FE#MwH)JD&AT}3^PTik(vqaq6?v8fuv z`|SPYdD=9#@l2-dPk83nI{g|ff8d$_f=<8Qfc4!PHp|Vr$yLpP`S)}>%S|=>FWNEx zTb&Lv5&)L#G7V^}#=oxJe%(ZNvvvz29pG<^_J1H9V^>-IHq=~EPg=|P&!6rEM(Tq| zM;j9|jMj$fg{2`+h$JzhJ4q@UAW4`h&3}N23g6PI)Gv|1!ar(UHSD>dVff6m^!m4` z5|rVR!BofwcDz(~S&AjPoA))8=5dpewhmnyI&piU7LRwrtLq4|3H(;||7Ul?HTd9g}U7u&+TC;I5^7E0oTzMlK4 zYnP1ZU3RXU6xzX&Z=67DRyyrLr)Hm=p<0pEj+NEDAVG^2QIz#Z?zZ*NFK zg5x4y)I7y*FU_gWH4m91z1!|Q%^hi2B8d}n>6$y0+g;|NMw=8=E%|x&v)zGCO*T^( zX0unr^wD!L1)mZqFf=cU`$+=6Ql#FG6;f#K0*?gzNFupmgmU=M0?j=lJ1L$Kk9a&p z6=xLk=RbVQPMna2NM$X*kS}zl;(lt+Z?_gc^eb1!*`hfAujxekDbwdDNk2@yUezDBOdE z^L@RMEt=q!Md|y_lkR#uxq9lWn#l|``}C!R(@L5G3kEH{5Ji}L7!0&BD$pmAdB_^6 zY~s!+8h(~qR;yU|=8-^XP5_}Sn89+V!^rlX0GK+*=43ff(x0T$7t>v!s#vL`l?vOe zQMH$Wqi5^c8&G`IY*_!AGJvS_v^rAgRU#!8m^i3rr4foknn+nCEN1J9Bz{Mzv&oM=5C%1Yd342`+9?+%HBn3%|DM_^d z95%2KTUxEi&w~gPj&b;9+@=&0RKVYnwNJm=qo8C=CQe1}Rf*k9Wyn4{phErVG^1qaN0>#Rj{ z1ozXe6%XYiM%h6go)APm7okU83+Znq;;CRN^u-&*3lV0s-@zo2_#3=evw0tbT`Tbz zX)oA=<#-l(h{06R!HHMEC%m$NyC?&ZvL0v#Vkxs6z62i~^^eOw+e2{>Ecdl%%{Fwl z=mPhhctkHhce_5HXE0Z}AQ?M;E)CvN{vZsZld=pL93f8-qCr&9%tpt30M1^r$~Po_ zxLvb}+7+KVEoDhDUYmlr$ZzB~BhU{MGFrBpkmS&8cRBKQ2L26ownv7+>x1N;J(Ww3 z6R1I?0@J_J4$DpG{rM{4HC%pAJ1k#zkNhWFr+z{^H_gBmeOwRj*Y<|>$FkCIw!40d zf3r&XpV7|Ot;9dj&To62-tTB9MkZh@zh+#sbesnTXG(DD88LN8Q6R?ne))Rgu53Dq zI3G)W=VqKxU^a@b#71!TQte zR8fC5J6O@Hf0`YHKg~|y4YN}^C4BJJ>=b`BJDoSp4(b=PqY1b&J3W6fJEZ+bIV32) zZcE#rR(fF?U+!s*ec}lh)y9|ON9}VeojpgrbQvez^ABcSPX5E}Ot>e%{#_~Kpf z*-`4X*>S7dq=v|ZH$ng>fs_;G@@Bu;OEri_h|kg?;U?VqU#8RHg3nC3+B&nyt9DSldX`e8&tV|=0Q?P+ zeWfy{s{v8+9Hd z?7*zB96R^A# z`MbB5N~%m!JZKZ`&DD2bFt~N03oooz_p-hPnH`!R%}(pMiw^Un(a6@&rSl(o=N=`y z$T!|O`Ga?|u6d{MEAJ@xItWWVLjGIciTa**!r~78hIj00Eq~;l8uLGR$HCl*JYUPH zN~^PZk1p|`g_CjJYb@}P>X`+08t&2&`F&dZu*&6r&@LLgzaD* z<~sR+H^j588iaP)&QAgy?>{FWWV&!P%9iRsVQrA@LwUA$4^;{eSrEeDFp5p9=}QpF3I^$Sw&N`fBD;~YDvDis2vF$;r(**rv$?ncssCd46xdeNY^@C#C&=nLmgzOmw zh>PjNe)m=U^B6)T`fK_6w%9{U(Vm`JxOnepQn0=YLSUh%YZ)Gxz^xq6dzNOu{UOWm z6~j!!DCI}mj^-gWkJJ9gAKfpAm+#}e2 zFLjI10Q{XEtMBwK+%ST$J$aWQ)F%1_K#Vf_Q51cSa37+zth{4#otI0gpL_P$UAI^C zZPYeFLghBw3$6Smp4|g96V-3U21*{T-M5nnrX5t%XPG|fSVBVwt(>Y%f z#|G9<65-eCi}l)if46b{`hd}YSX};+2sbwBUY{oVVWaNX6Gk@@^uI$OmvJu_J6lg7x2fCts6Ua|B|`a#gO0IsmuDK*1SG{^(F1U zY_tckvCy#tfq&hp`}I`S^|V|G)tim~VI7n0W#fI7KN|2={rRtZ5-C)k#{4aLGsV9u`E6lPBj1nQVu8@o}c6xR*2@X zPWVInQijot=DBEI%CE*%E zO-4B+8BAAG?Shw>Xt59(1IuowkL3%dt#)5IAN{DerVYFza)&HoTVxjZbU(4qr<^I|s#Y%BUcf zq)rSMNjWM)q7tS;NUq=^5m|TWY&s(D$Kud=fm2V)f3jxRX9CRx(?u#>{jJNld#t3O_=-TApyM#leaUgAwvl5W2z7+O`8NH90~5 zq^=}*57Kx3xjvSx$HS?OLo%$r!sB@y*NL&ghq#^$(Uga_ioNFVMOA@uK%xQrA{T5& zhYL)otcQfDORb4HkXBjdbhFU#1Y%Ju(&B3`t2qwBN&Dl4{bg0}yAqNMmkcKQoEvx7 zZsR>G<34p8uc-Olrg?g-=va0(IdU;L8K9;|pFPnxg%{84-va(nxM7l62i~pCpUEF+ z{n&-PP|YQ!iCQ_6HH22i(jzu?EMB$a(PZZCWZnG@g!b2EnkVr_1@0S@i^uDB@|;?J z9QbtGarJeTId!7;?9otWLbkTipiZKpwlozC*+XdiZ9HOiCqSLZ*h563#Ht;;@(wy- zUT|c+TBswpESodGD^d{0ouu;Fk(SZrF(;I=*!n9RJx3gJ1oCFY!}E4xNt{CiB6woS zd4*__k3DV7a7cq_XitE}9u1i=kPuIM_b_(6MZ(foL;~o2RFK*N?Gfs*A1Tar_8v9g zCRFg*l%iSUEtHxgt!J%%$7Spy<>i#ALzF2LVab>$1)}C^Ii!@dEuuAeXB2MW{cd@T zc~Z80EG$cQ^6~h2cRn6Up zWG$-mM5x4Az4KY$=kjFN{}PO$qkV4_aZk)ORDQ2N+5R}|^&g!V`>XzB z`*CgddT_tipKLd!!xfkOZo8Yc{hxBl5BmcDGyMrVTltp_G9b$NaysPK3%q5j-60EX z7&Buk`fvzbZoJV48>7L(X>zw~b{-Cdf|H2KQb{^qTxh(N1`jdM9WE8e6t%H=vHRhu z3MsvDPXs;}b@9!sKw<%dVjiA(T@dB)puA9Z>LB*QEmr57wAEk`3p3P(orr8ZKzZE| zpeIMxqm$jkn1jQ{vGZYvQ^3f!5@L?R3EPdIRIrr@6^z3XMG>R79G0G2SRtl^!lBJ4 zo$j3fG4|R`wcV%Zl7*(pwG5FJlKoyzG%{*o&^JR z7>%CV1QV2!DS*qIn2-^!lc9!ecT0pypPA~N27D77rIpK*a4T^$l!GUB`L=I zXgLRWE81tx0!08Kcjw z?b6;hy;pl-iq_ld-bpz@K@?&ixa^u?eVDUh+I5-kHmh|Zm-lS8Q>sozSY`>n#)en73wS9L3pDRJ#vCiDKbjeyO^=K0 z0>?_Ns_D`jPVWLAE$GbSx~Kkd*#nUI#!t2Dg#lDJ%6JJLlAFk)=3#e&S5Spk?TAi8 zenO?`@e{Svxl+lG`P&$(5AvVs2G8iM)g(UE*?NH;lh4Xnbjs<MuLp^}Qlz~DXs-cy#-Vu%l^#t`f zSMxsYYU}8TNdta`LRRKf<>v~5Y1Bb$uDRoCaKGl9ueUFJ z^F3_8*N*LG5#s*>=ltB}{5I$Gs!CmLDyjo*Dl#VM**{wx-*LdE4NMh%I@Q}0584=` z4#cRcIX$^r-BlpDmxd(!$MWt0+Y?40CBu1`muYJyO?IlktQyzOu2r$`%YMgJb(-2v zVqM0`f~KL_MK7^HCiG|BnKVf-Mi(R@&Myi53V{9TPv+OE-%e0#80l4l&5Am$UbBuG zF*s;vdNxIzJu1?Sh~O3L_+GKjgU73DW=lNx91T~AIiVlxZBaeM6~R+R$*^xK67qg` z3%`l)q)>xmar-HWCji)fa2mZ@oewIqKV6Dho{>rRFly#})V(Tj-_w~N>VfJ9-P1#Z zW7{&*&5H#8iA_BGk&;gnPYb5sKC%sY&)HHkrdj6_$4lehaAwcmN!@iDw4nPm1wkaS zs))6P9sfcmZR5y8K3%)n_sF1Hww2++5zo(AXE|| zyjL(`mcK==8um`NN#M~ab`eA}R?Ta(MwyUxL5_d8z%!ufp$>+T-wABRIu2 ze)1+qGkJg(jx>8)r&tU`JItHU{ged3=20NaHP(q>L9}Bta}Uu-03f(G_h3)G(gI1Y zc|(M}({`7J+zGs8;fvAXIszG;{!dp%Cn};22(Ck;x0aP1H`N+eWWZ!7@M=Tb9@Ej` z@{7^wNTj?nIyAG;A-BS*`Vu2$8SSkXNX3#^6A1-$Z*O@P;q*c~V(mvr9aLK*Mjx-d z)lspW!e-rns=$(QHW|5nWpoT+hRrt3Lq_g*w1SHZ*Gwwwz`DKtVsu0b#avPvsiU(T ztIL_{z;uJPEOm)^hn1#=IYow5g4N9Pb{zXPYD_j3UEa+_hK$j@s7Wy&88wQS3{s5H zRcqvDVl{F;jMGt7I3h5F()91*f^`N1bGTUjhQ+>O9 zvnwpmus`eNrC_)B?4-D-k|GC1`?#iW_;4q7`)3!RS=md^o;lTc&>2-)A>nwqCtV4^ zaVQ*p-&%=q1(GoDW^`iA3So3-GDhk@5sMUIjX7ZV2wpB> zEe>^WP_`c_TRrLMp8Y3E`r|pigw~7*j%K-uV@DfEh|VO0*9|%6l6d5Urd&- z?M$m^$!f}+q3yAemzcz?PQ0^n>B;ZBo0wV2=uvPmETs~yPuCcPvPw&%^>N>E2zOlK z)XD7Z6XXm(b0iBqE&_Lx;iR`SsSl4x>*IIK0xorHrfzzJN`%^8hD<5|Cr=gj!F!q- zL({ith^uCsx9^p>ilAH4g(`)=gZ&5_h^n%Y=&dqN({E7cQK8paqQ?8NGWKxQI4r>t zdS;iXx59k$4(u9?*-Fjpa^0{2C_;EapK4nEw09VS34B)0zM0e#AhYw}i`ii*M4EbA z+|9wH$$QrCfHI=gKke24&b{V?t*=udu?Bt!M)nANR)XL&aybJNDd9OK;^pcb`6X0( z>|5l&at`~=3fbRq&J|XE&pFrk=KP1{MfN{<>qfEe>&-gfxZ`?ozri^_`kdcw_kY#r z0KZ=3bNzZ>4+1cJ*-}LKYoD{N(rpvZfHAX5J&tJ@m|LMevVQ+5Eo0Jp>bBQpV9PKV z_9D;cdKFRdyWMQk5d|DCwP`dH&)7s%fB_)F@i+9h#=WYn0psSh=8fSPE$RJBL=(mC z6yci1Xq(h8f{v5}$y_>wMaH;elUs=*A^P>Q1DM}3STXGA93!rE;^8;W$?hTXWP}sx z(xQSn9usBz#~Co;SHox0$rX$z(UX*PaKGsR-+r!fuiw?H>XshLT|J|yDC<@tFKsmi zUsB?Pkm>t4YoDW}3_iMGqA&Z41l^90!(o!){pM7W;&S2jna zq%G^?qSPRd7-R@5-0Pl&W;ey7$$B$omk(U0z%wgrc1~IJW%g#TIquqFEE?V>(FRwT zb2@CW5?Pdlc#S96ui#M`!8>b5lL47Z6Vdj}A?){s>1R2FVzgnKgXB{~<@qD<$hamP zdsv?(Ld0UM`rl43qLC-Gjqojb6&fr1Mq=@T&7m(0oc07q1i|R`+gUzv_AXM!9Y|vh z_!kDXbyh-~WMTpS65ElokEZ$y;o3gzjv`kO;v8h^UOZJVoqRs3#cEOqP2#oKTr^)y z)i6GV-78-~CUaj+K$cDjTWYY!vP-#t$~^6@fmLvX1`(B*KVcxC966RN^j%+bnhh~- zDMn_s>g)&{#?tDC=Q?w4ao{7p6}@a)%}`cdu05e^u-VUt5QqJ&`i@&zoYNQ0yeQ-D z$PZLJQ5`{BTT#_Ve?yAqg0Q0SW(JHsW2(5p!>TU8`lG4RM(&KA}g6slm%et&hXI3$B4zKs|hOjACk$VXJ+(gK5mk6J* z_s-w432zE(KzY`u-=qDwM!2kscB(g9bB&6~TAk%nXr#rw$od+UM%rNe{FsYU%r=-g z+VPX}n2`%(y`sgQ#8rT?9w9BW*j=a9NU0$fkA!sdC3>NFMgWo#oac<8`bX)iUcvr~ z3pu&h$}%%Md6u4h=94*hbM7|qQ`foA9;TnTR=j4(=T0cMb zFg)UI3I+pZe0rp4tA7fhe?72Jyu{hXb$$ zj4f7CiaXuG3J?A=DT;I=AdSs@(ngoV9?#?`-=V=$1^!3CO?Yn%#<<)64REo)16-9q z0GIn3aQzsptmay_xL=X$IYGJ$HgkTA6!-Nn6M~$c@OwpUiZ$r8MvPM}RHe&VAKF8F z(g8#$Wwfzo+ksmF4{n;psZqI-_zozNkGrlUewZsH#7x7R6vRjL;Na~P{hBPu0o4!24yUA_pJaDwH0de16<5&5`B+FL2*2@urQvVE`hc;4PMzD5^*Mf46F}O=C!2)G3nW!}v~5Bo za79o261&RxkaC0d2TWo&%0H$^6UtQhZMN0V#MO@UzBpn-Y=)BU1>r6hoPX#LqELWU zUwOsTWRz#+WOEpxThR)d;q2UK-oOQ*!##yPpbW6|#C!K~{1M;MY%AN75*qsv3rZIS zI{LA9c)1|deVHd*Xm^FW1snGob476?yWY^zon#I9S&&3+$_o$1PaRYTtOSavpXI4^H<3FoXMt83keA>86 zC>xKzDZJ5+ZJgoQpP6)6@6c^JGx^Mnu>xk`9q9gY(sP<(I^eHyt4H zfs;ArUX*%eb1Py2qc{X38WLXLqS*=y0~}qPMd!)ZZlY~EUpH<0V5?e7J!>dmpnPXA zC)k~sW<6ZXLcGE1KwaWy4NlTXgtJrbRJL=4v-fu(^=1{b-7QKU)(j49lF^NM2wBDA zVsRR@}$fAwsDnzIL?4MSb1v4&EY(lD{}m2&D~Y3P#ew1_<%t zeG%wv{j6M67$nDSgBTjfT zW1ft@z+UbP4Npo;PyGZO1{|x?e?P$c*!whg-;qyRtYO!Z@9Y{kyX@t5VV}kquEblL zD#c=kEZS#`Rqr9}yENe7HF5;uC=TTItoQ}`YW22RcwjH#PS%PmbOi8GHZbJleWJk4 zh!R}xuztuH8c}+DetU33@>A((`CZKTsoL4Y$xu3Cv{B~_$x|>={qApn!bB6BdT_qOMCd4eKdR)%TCM8)OF3==(uQO&XxgBGGOxg zN1aG2UlMW|K}v0T7IDfjtJOPMr4a05CjE0L8GWs6wWbr@7o^%c!X7Q!{_$#&l;sG`Itotj(SOLK3$fO4wS-uWwTf(}joi8(*V z&FkdszZ~i~r z{C~Ll{||1;^xB$LH;5~UMqL5t6y78?u0gyYf2Vah2sq77&TkiQOMWsND;N6%IIAPR z04JQ;6>v`W95H_dPFb3i7!Yu3hU!9-KHkxkX(EL%&y}NVx&qE_5OBtTfK!9x58zaB z4c@ZS#&;<$D{%VgTmz@THE?Q)Bk0Y4+Q)uIRCh$_}9Ssqu~7AcK>t1`Q4Sq|3`weGaPhF zRNVn)eOo~w=Jp$z9GZx2HqiANVn|4^?U?Ok?fR!@r8J$;dOe|@3Gxbh!NV^3J15no zq8{&GKr-`>uch(X*^Xhq2mbT-;Ge6#S@!@@h^UVPU@J?I`5(yAKKnedt-Xep5x9LS z0EC;qFGe#k+p+zjQY7}SHsW#nxS9!Q1IT!j_Cvj^%IGnuGHU!e>UPGN3n!s=@X+w` z0nz3iDmZVQ=-LEnP-T=0eO6lvo8Jp^1q>5Ir|sGLxx&W}ba}}_;C}J2%49l*yn#06 zk65U=-SMBkbc>yqL>?A$4lJ5Sp3^czk51A~&!0tV2zby)LjsvahBXJ3Ezlaw$541= z6l@YU=B##jl7NziZOMIA87;?d1^IMnDf!qveO`uHNGccxN@>(hQ5~^Yd@E##M*Kt! zDf;N`XP;-;Mc_-Pb@8MUn73RZ;L<6gdMeRhSyOUFe>iSN&CjDCBkn0v5U46jesn*u zWv+~%;L4}_d^%&vE4xcuXR%;&TNKjoCCH~^f_!>^Zbrc$K3&n@kX4Pjru#8>UPaW- zl~0!k`E)@@x!~fbjr!!|j3@+1oKf5J_mptOUcF-&G5es2%b(Mko*)+fq;%~_~b@Uj|afiC&Ve-Iy{-@_d*qh zcF*n()UyJR9_8C;4s#03t>m2=COpJ6^jUP$TrZATvngLWgs#vQ7d4JQoPyKWs?` zx5P&eO+TW;GKBOu&#R)U=;oX%ekx&si)Y?-+(AANv7T0ldue`|>3N~x*n9hsV&Zd> zKfy)I9__}cD&A~>%v=>GbIZ@9_)F9c_&#S{oPSE=ptAQfpG1G7>ks_#KSaF=pt zBQ3((lc+?;AMbKvh;>FAunR8;dJ_B7M6|FbI9vKM{aE4DoWH7Y()(A4)`@ZGzMG6_&wbD5uD|F1u9(PJ~ULT zReZ0&Y%QUdl)S+K(xJfZj{?A;^ZVU+1AQGM?<>h;@9JD3r`R9JY5eedO$q4=IWMCS zGA>=1iM4}Ek58X;R7Z=0>x`2Y8e!AV@+ZMr78|n4`9iLsULj}N#8J%01M^uf3CNJK zt2L$Rr;#IFb+2PqJ{jzrAFnUilxLB3F*kehK5@;Fh~;S(RjK24yL(;X9A$|fxI)el zJ_gHPm0%M!CJ@J*B%tQSXmbl+Bj;6xQ&@^g67mhfmkQ_ORu_3yEXvTT+b!y{u#yxL zz8|bB9k14u9C2XKR}uX{Yf5)aI$vKobz*Hb%R;WfOlf)Ig=QyGMb@1IR{`tuEV!22 zu$&p)Io4M;uAzZEdgRzU;#8c2h5>|Dq2{P{caXq0pxW5CaZ zTcjK5ZV*AbL+O-|P^7!NTk8CQaYkmGt^3UEv)1v8pPu!;uWR{xuIIYrO6?SeO!CRL z3na(^-?eeAQXe0y?S3YIsf5@}sCs9hrWv=N7z9}+-klP8(8PHx%gZ4k|IHORv(TTo zgMkE^@SgDVIyb!#J$Xj>A%kn5HT_&u8?R0oBh#e9tBxvqXwA?_J~1YFPTo`@6CN%= zzY>eH;l3pBQZMN&JVL))8xJ^~z1`ME)%BloWXM7nB|ozG9*UBWEJ{gP#c$xxQ;vbT z>X+*Ck?Tjn}MDo#ZPN zCp2VppPAop8rpL7c$l z^w|8=e6*r+z!MhQUi564Aj}m+dDfBh2iW|%-2Cfue#U=cIX@%g4SN45$}=+lS#Ey6 zul_&Og|3(Se}mICHh<0E{Q1iH2ZH~sE_7?_^>5f@1;&_e{`|ZSpRdpnJj#6~H(df< zQu|M>0??@Z!}-u&`C0i{(Q7t@H@0-?o_v+-zpF1c2cqY-Eu;2Q{#;#t1P%H4yN#r+ zcD#K!3QxqIZ^uH$7`9{`sd;8qQ(P})rf7d8l#4oS8P+02M~s*znEcL%C*AQV*Pc6M za|UAez>8oyOUzQN7T62aLqHnwR{eF_3ekI8@BBqcZ7n@1Hmo`KWF`E9Eoc6Be%hh; zmh3-uLSTgQL=I9>z{)m4&M;shxNcN_o_fL$8>?vymQu-S9~$1oGEQP{5HYmnZg3w# zsTBS9t<3seTOF0+gLR^0BJpU+%p$TUd+9l%u2J2&1qU(JMg%pTFGgxaTt7Y$pX{a! z2!aXpN2@e=e84$snWkwTsok~`h2tYYt!MH{J3oYYA~w`L0F#?MVwgJ#Zv@y#`c@LC zeQSy7h(3-Z@C|}?e~6}qXjKkfyClFV)vKLb1xK028O53Q&MhT3RZIc09KYHsW{8R` z^_et=X&96it8(Y_-B`xB`N@*PJ-y=RrH-A#GLSk+m1=im7)K!H7fN~(AT=SKbriTd zC?5HEL#m+-`m_#G?bCmAOwJXD1(t3d#8N*QM46YdymVziD8?3AXAngwW!$n z$QalS+opV6F#A{8BMX2_<$gy`FL#9iP8(XxrP3tBqyQ6~Bw{hko zgOQOo@>Uw@Yd^g}^m=;9m_1Vodb0H(#?_xt?d4y|b!)5oj~&LFz3$&nD>7ckQ~a~a z%n!(QD|F(DKsSr)fBH}cMqh6W#a})5y}SB1g6|(~lxO@Fqj)W+e<#R?zaF&(z1gP=Rd=Cp72Hmhl#dcK z>{N*M{n0I)$5Z}@0_LUL?!mDG`4=Uvl?hlMgC;g7r@h|9#x)KPX3bL#Dtm^RH7j0+Vu z(XO$sgp6c$RFAZVGH5Y`&7LSr@)2yXNlV=WHp)Bc`DlF-WiNYPJSY^N92e^DkJ%?i zUhK}!VHa^PL+gplgV%66II=kLC&g39L`6PC>)ZthTH7^#Q0vMj=tm%AL0RDx%mmxk z*l`^J?Sn4Q)>WfqKx-BRCg_Esa_Bg;Ub%0%W^JV+!Kd~a;uq&3~^&@SXaPFX;R{>Apr{7?c3sMcc z!$0DC*C}RG>*pYGSGWh~rNRhpju&nc+Oqo%2n~%Nme#T(uVsh2`cZv3q6)fgG9`=%MCE@^PTlNe;~8Zn0CR=^tN% zx>jJfZ_Id*)jw9^kZY#0&v{6$%Kv5?Qvr4W*1GjW$Bddj6P7dZ5ILiH1 z8+F-*(65?S+Nki18)!XFHR|dzyTnfGsoS|OJ5S&OF!f@8z^?E8`@dn=l^DAHSOs#x z{^?`&N9_8uS@$i5;wmESKd7$jfQs)`*RP)YUUB|U*mb=!|JyhF#x9_E{_Co1%xH`o z$>m6qCJkwYr@vMMA2r?wH`PUvJTYtU$St%V8HM_&aIBR`U zCf=Q9=t{y2@^K4I)d=4uWHKhzclgEkiF0{Nl4Duye8Mi`QPS9z(s0_vC6aN9oWc&% zaOv&SAP-yUpPNr^tU{$i8MA?CP&>e+Skk(A3u_8vzC=^hWg?k)HaGeCAsfkI756il zbESK3hnqojwuo#)b6AVyExx+wD5Uy*)W+m*A;}$m@wWv}9;QVeT8;NNpe5$+bLwjt zk~K4)MR#>9?p(Hy<)@*%52J`nicb+@-w`tKsFjvwgl_kPg~B|dYjkd_(P8|g zWL-!BIh0z<8?c_^9YZ}H%A;V^?k^R`dUs(JrJ+|}+&$R022)Ka@ynff@$6$vDfwmO zCsG-(W-(mW?u#dLSU6dET%R=amIEy{#WqgEP?T_q{adxDK6hraY56xsAH9($N@Qq2 z-i~rv%X~nFWwM4ra$nz%GqoSLx?!aR4~?Zp;ch&I>QaJ0yrF0W4dREr1N}Ohrjs~H zsB?N+p8@VyJfii^*n?A6!hL1xlk83yZgw-KqPQ%F4N3!y+@ABXKn(9e1wBcCJ> zYIeKr@%ZkHkeA=Hse*7EnnfURTJO`@8JxS{f_kBfS;)D3ye|Jj8Er4PdSlNqx`b3? z@g4yitwKWViVR3)7JeiKb0*27{Ntiv-#7u=_3eWdC2xnOu9XS}!*Y0`2OFE5@(ay+ z8k%1ia(1La;Zo1dkye>P3I>^kE>8>FxMT}ND*g(bThTQ?2F|yjiSOE2u7h&^b+Pm< zviSG1>h+iVc{vt%irp4Vzj*Fe+|Sb{Xa-rQs@dsaoK}VYj zrwBaQTJb%7b3%^Fw!!Eili4-uvg$ODXM3u4Xt}f2jTneZB+V1rw7L?vU{?4A0*h}h z_~Miie7yA>HqsL7jvSGE)uYKZF8WMcy_`%0>*yBI1x-8>GAxh%@WjZsH1Z$$8()Df zQ4CV288%Rm^*xq>kD`x@B(!|y%bMmz)bo|`C5-hFZWQ6%rw=1Zz%>4hTYY}Qhyy6N zx?f|$-DA6I!%-Rv;{1>2o;v0@M0nF{YCr}v0 zb2=!9^E1j(jxOz3M>Gb%@UQSX-EGDAROV`@mE%QC>W@3#Ixk4cQ=k~r zZqSUC>6^zb`qUwy$y0+xZ;k>wR_>IwR!&hdh(VyaEA^=K5^WkLP9>Fym<|cGAGCl3 zyp%xa;*poz6a7-JSZ=8$nl#`rFL0R190etw*$d|0)1ih=Ia4o@`t5frkf{AQXSHK2 zQS7EPvGu!ebExkHrZ**XYJlAfgU(ep;cslz!XI0nC$1n=hfiQF2EoL3x9=;Nc+NCo z=KLwQmOU=8&&-Y#p|GfKqNy_Gz7*96^IC3EC~s3(<_kO;tl$UQ7;rv&iSZv8AHDM< z^TTYO6(1L|L0>Ok!^l09QlUB41 zi!SY#F6>QIn_+V}e!6KWG_>UQ)##L~Gl(d`1-}+4{bG;w$jaT;ywtSkTSJ zi`NmgYId#wn5F}5kIreXb@7dn~IX=~3{A!Nv$k>Jo7cMz$PUPF-#W$h&sVG>=5B^QC$9^zZuPJST~5G3paD{#7SKB`+Jt?@c)w(dpwyN4TDbRXR;yh+16t7Bnd z$oyiyu*gDCQc%AXwUd5U-Hj_klcG45N}fU9y{I&nL76s_%Wf%|n22hR^?-QO)Bo=A zUd89~IPFzXS`}qatV(PVD7~#0kC```t>|gnaf|Hj<%a}D;k^ebV`CSsVR90AUz7Gx zY9R~n7(hZY?tfUL((H4fg0@8%UY@5Z0&pA43gf<^Qrmwpiu%kr5Ru-IGHJvWe%nio zwhsvz)6d@!GzQtj8dT?k@f+vKbk!lqQ{>AEP zu<_<)#ih%bD?2WH(%|Au@BOohOP&)*(G8p*^qt>YLjGgHezOMsHtK(CMgIo_`af_8 zZpC6;WB1yd_^G?e@@K(*{iA+C=zs5y{7-OwYo+`jxc+Ss;jiFY+QRR6_cNe6z>Yh9E;a#`;8CEeLo}Gi}s6=Jv zJZgvS?W#3{A>O6gv4HI-Wj z!-nom&n@?`cX?VgOf7bsaDssL3T$;lz9?575@#VHrtRKH(lIwW8hKtyS&Ls02nh3+ zvJVu@ru7wRH}oH{ym{9P2=hWSAojuXJ(Ie`z1R1)4irM*H(ym`t2Ckz(vBOcoNpog zF3i0T0bzdR*1;ogr)kHwF2J&DFQ?1T7)d=!yLI%)^VL_Je6*v5-0pm{CzV=|SMq#) zqE${9kmsotare2|Rd(1%l5~viQvh+UM}|nuXY|DrflP82vLzXvV^{s=Xh=t5mttIHW(u^!I_8B@Aj4F?uOb(Mc5`^nhq>^+leX?HM2aZ zIJ$xlT0Ol$XdYKUh_n~EIL{YZG$;xRD##sev|15i%dzGB0tNgz(Pxp#MR=PjXWXg2y_oxn$jsNSx1)|1WB8WQ0_@v5XH5zu(A8o0=jxp z+@!%#a2n|uv$1L0m??qNJ0_@Zl+NzMjtltpPFl_jxnS6iw%nH}7~xN=?xXj5LNu2P zi)lAnNXqpqK~hi@gYRf7)%aJ>(0M+#8%R&M7nsQr&F?hyiAtub5~Sq;HvCHFL530i zW@k|~S#{cKQ1Dw=Qjp2#Gm^Raszi-PNF91qow&iIk3gg``~pRMJOgE+JvEU%CYuCL zyEF&~$yDP*%HEf}icH)HcCww9fIsRu*YKONAiFR;of~_(WI=DEnsCb1xXpT5x!~Hk zO#Fjx_v`eBZ;s=SX?=~H+kP&~l`Q>-!u+@0=igP){~UY4_$`{^Cw}hrGO%yI;fnIV zdhUNNu34@+1-^Z=KWP15i0kVOD%Z5WGEun5cFTr05BFpU>HC0HB=uj!UD$#8d1!&&9GEtUU z;;&4UD)#6`m@1mZfHJd!Ub1LSrWo#KEOiC~LHWfOCQ#sF7(zRM6-kj0BpU#t2 z?|t4xR)J!-N~L)z7iRtVi+VPcYgi}OmyB;jJp$9A9RK8+;^U?~9>R^|3(1Wx(qlZT<1@wRP`*($;ljX7Mat{=(GOm(#-uZ7vm~G}MK@6O1~fF5@g+<@c(_hN!DY zx=i)(nLI4N<|iD-N+)iI*9(1l9LiH4SZJMJ{1TG9$882~J`)k_z3!tr2uC;Xq zpsh93VnJqLMTnv78PHKgksf55X2MEID7+A{iy0oBSQ6HDRO|3;4~^eX)#->x_p;{h zHheidpSalUfZRN~2W4OopAKN2IctoqM_>sB*DoE8rJ9!<`*jNWS+Q zoY{~;r;O|7U(DXtrHbdEh`6yTA9oq$N(pa+@mr|{l(<<3^l(R#&1y%_EYIRL5h{75 zRu+AFc@XnT90GG4HNRk$n9QL1wR%bwSM$W)_Ru`0YD)d+1<)=!2jE&I!Ix`j8}rg& zQDY&U`UgGsw<34`2G_qehJNRU-{d&_qaJ(4zvBAOaS@C+0T(|N*Vp^Uzd`XD*H;$A z&&BoiulRQEeot6X2NsVLn$c%p-J7iLHEcw(jP~PZJ3^8p-5`hY-F%&mDIB#fKqJ@Q z!j)kYtR6I;(&Ox->V=i}syMI$SVE!&@yWCsn+|D)89GEW^^#WY{@l>1pBsZr=hl+( z zgCaGdqhsbX`1P{2$zjP65;fuqz0yHaBDoKQ8FZU;WjtC;@h81deAw3dj~}XXEWHKC z4tXN6nOMpR3w35X`LPX^aGMu?(xicPOuS#89obM1KLyvhzp7UuL2u!p=$U>{M(>#Z zJ3BDMQzt!E=Xd!Ztp({N>g`asm;(B1cdSNnCY%aGoV2%1%ESj?qwg5bDD6k(3EOo@accSxl@udmUFhi6&UDU%tG31O+sJkNz= zB2*<3nV+W1;FS#4_%_E~j#twNopi$xCisvF%UI?th zBqW^AT6Aoy$IM0cVsQ|Fd>8=v4yg9l>JZNBqQaGk7~-zu{`=WkvY8eH;C=**Sf5Ro zL>_9659zy}+VLGg(8@;%gVuC3apnK!g$%u+gk$SphUZr%rqjm`rt2Ys_Yi<~g1fh2 z@5(SDXMxT2=`x2-#;QVZ^}xTHWn31~)$wJU{Au6@Fow^C0L7P8?s(jf;Ckq4c>z&& z%=ClS{##KsKgRVnb8f5an*@Y^9oK)hpl_lfeva$!J&h|||LVE#efIwiuK!(ieU0n) z=bPW*dQG^1e~aa^jxQ`4Ek1g#pw>72|2tgkTOM^w7WH}^)nOp|^Mmer!3J1#M6`bG z-4FTj=H&i$iBk5D5~b;(+0NKRNFd2giSmHDYeGGniQcCP@BGLRI=1y3I>Yk$b%~Pm zWuH02O^I@d#y_gF@sXe?J$TnsE1C2XIR;b+RH&Z9kBYpX+$2R)oieZ(wHT>*W?2x; zd13ex4-C(63X-hlJc5J>DC~Qb@x8$=Sj_e3V2~V$AkA5(?f*?&AO1S7Wv_58d4=mf zZ)~K3P*N)kOj)8d@SX5c{hT`sx~(y~_Wt=3F2SVHLs6W5@Yy1WkD@uLMA@LeBrZ}& z^cX$~!u)jB*aCU>^4ZF$*ov(?fBq=X>#?8=&uRNQvG_y1s920Ih(^oFK%LTt02WV{ zo}qhbP{|s$Hk!N88-fG~o574+mt2;$NVAvi`-(db2-7M+n5vqiG)-LBDYL2vF&+{g z+~Fv7B}j!od3H=BaaE@TH)+PnrBMU$2Ps#z*in zX*I6mRK@4K+FpZtqR^FU{LHi7ek_ym0|cCb+l#OPOiHBySZDV-2<?UtXBDc&?i{XIm}%eWV&gQGcNgu*%&o)cl@YEgh^o}` zo-rcVSJtY^&2dx!ke}z_z@RYMGEt(~*j8=Tzu~zsK=6v#Wi>2{Y8=mf{R6y@&6wkh zyI4oI<5OQIq+EDT<;lXiZA!LX6@9&VJqQTH*JL6g5?yT|(`k?~OW}numyjSEiNR~V zUmaH0x0u|os!CaolE=*E8&f~{+ER{_W!!@UJQNQ6jbqMF{nbtqbd4}!Bb;|YR z@(zeE#}7sdt}{ZuDa^mY^+16wG-&wsw2iBdlA_yYNZY9MkDTjoW=Qhpl^K$<^*3e+ z{(ozRJh?VQ)PFZaTHDWm!3+txF+=JWe=|eOG3=+#!LQAbozU;hkW1kyF1l{kxCXbp9tv8|73{wdca}V>6;GC*H46~TU|~}tc^!Q{-GIC`C~KW!8bER?mIK2vMpYA zxg6YymIjOJrCwF4t}Abf2V8A}$KcX*utZPO-PzV@rwF9Yf&mV-!p9Tk6>mYZp@!qm zeedYCPcu+8xO!%+#Ka|B3e8QoWfAU z0MJ*WaczdEjeV;$DzSmh2jmqW9L=Q2-Y%7xUjTyoe z1DGLHI5(BXZmG5kT0|i;jkX!X+?z^cH*z>{6Kz4wU0!%r7KT8iW^{#a65OOj0j!ol zqJ8qs-C9_Os{3CyJX?oTVgX!>L{q6!fgERD<2nbx^}>Y4^cAiZ70ANxIF)QugFZk* zIpdC2#muLf&dXrZ)$^~4h2VJ4_TeEkM&l~2N!ir7w}EUU*(JY5{(Ir>QH8uAip_0{ z%g1K|rx1$AfDv+9q48UxQBv@%^%CzZ=1>`*!e2WBuX7~+Gp%p39BvgFud{>xb?f?8 zBG47BZ$d79O5H!FR{Zk0|GBunUP=D#U-u7MGyQ5S@<#0Ug+@75pwMVoOfX@3RcP#M z-o#f;u=E0kXVb?Pr|c;|hx7JZ1+_g!=Ru3b?Y20sVank9Q(MU6@oAtf#B~D6Jj^+Q z6IcLl1`N-(!BA6%i^0=9OB%o1gK$-6qy*}Wi%GIqb;h}Mh^w{`_aC=~jNP<_pnPi! zp&+UJqb(%;Tb=#0LtDp01nuE zo%^E!(EF+Z5U4Xsi`x-$;U5ww9CJ`H5@X*-+lV>J{6_2JD_UPx(}Ojkhw~$BYTqY~ zBvh9f6GKl;%sUQWrzX7jo)q+iWA5GT~h4d@Gjmhw5HJwu|n?h6^p zg86{bcJ_#whbp%Fvo2_3^2g5rC*NSV1b*5lC+ZeSi!0K!y{jrdAb5NLmXf2_SDxP( zGf|QK(Xz1#n=nQ901q}gy-7W_&^=bzYk)>Oefoka#KFc2!xHI%&v3%9TVPN_+&dH2 zQL#_M*VeVU4`YR?Bb(JJBZB0!8|%6-I1~-V%yPjNNxQ1pU)c+*pvVY+2KWt4z;8%n zwT#)4Z)lcJGuxtRyJ$gM;gc*8n-PU+;L^M53z0Pi`a-rYK(~BW;og_r4+HOu@Ybl; zhXeXT?od2{MhHek?^E z_CX5Hc#+8YCNpaYcuF>OIa! z1-IX6#ah1wvA`L?W0t7FPaR?jkL_UiiY+X*%>)hKGwqz*j=Fh@LlOivuY7JV(KbI4 ztwJmMh00W(nY#f_rP3NjMiC){wue@D%k$b3>@x?61p73?Mk24M`)qQDthqT!cyB@m zii?|TKIVw46Fl*%ADl9;%cEFm1#gXC-rIXc7B@;HP2w~l z&qy8ANkv8z9&R8}q;&6Org?C469%y3a{ip8G+EyA9 zqAcJUD58RKXyP=xzHBM|8CW0U?dZ0$ut4DopuB7#)1Zpb2X#Y{@k&Q*UvyfeA4hrP zb1!-MfbkEP^!0z#_r`DCgV|6OYd9rYZs%D`m*=qewW^;&R~|)6ntml;0dHtATz-h^ z9-^m(UKO_cCQDP&EN^tRnfP50W+kg`o8ro5D_%e42_~DpQVBKD~5cPNG}Q zn@+Z5p{SlWcaKjd(M{SX*u@Y9gQW4%3ht!qXpp-=@@jT7XAmw0j0y9E2RcM*3S+t5 z_wdJk{>6gs;d9V2D>^x8np9^e$4C@2BX7t^W&ETiwrQ#m3kJjC)V=3{)$TIghx96Md%GX7~FC{q^sg3XVsEt(q0aBDIO-Z_nlByS3o~r&V!cG z6q!QO3LmY3E(H6^Uxc3zeacCV53MEP=VD~^b*n&hqBT4^;S;<~Tv_Eqi-ZOx@CANW zSL3wLHDomSPt9}vRrqW&Pf(!yTQWsnX|%Pw*5h1&L7KiP_$%VB_x*oUOg~24&CdN> zh`Y{$`GK|7OPbhIdQA_Eq6l?6Kc@C%Bq62KIEAMh1hJH|KE5KIpFQ$>^*2`>>X6 zbF6bmZ8~qEj??gEy@WpNFpxxwJaAEQuWXL%rC#OaT|$vK-ml}>XTEHl3rB7hfKt|* zc)i>Tb$@szf)V~OWm>tV?NDC&Ym_HAq8(h-~m%O>d4o>F+WK5 ziNO^kPPKN@d#@m}lcJ)Lce`Is;)unU{x_?x{c?l<-$ki^9y=WI9>O zz%e|`7QwCDtzjhcF2^T&^_Kgi6aKqh?L4vObZad!)K?FmKR;vCB@GY`S{U;D7@cx} z+sZcq&&dh`fsu)Z7Y}p%#INBJoqi_fq#|m4C7Wiwsx#OY-AnG+QN`dD-+ESv2)fiZ zDzm)A76+21mBy6tAXEm*(`(=z-|boAq-yie%&kl?CSz(Bj;lBTyjjX{sX03U=qvQXl>v9~*OmY=?h90S(4L z2}BZdppgJKZGbK0Zn#pj1FCj8op?jYlqw$7I9~7kb7q`*o*n%=c;b4W^$5W~iRr*v z6)e8uMbc<_&CmA{Ne%>Lr2p+smC+aQ$_3T8>HM0qN%PX8H4RZiuRrcCbNYhxI<}mO z&Os&#$?iQ=uvn$bs0cylFle_IkVz?O9w}hyZzLq|3)Q(ZbmRy`@dZDV;=gy1KlH`$ zxj>tb@JPA9GPi+1sE6=Z59rrl76lyeEkwcBKKWU+e?CKSV<$rJ&tBm=WwbmJmob52 z8h#PpqcBJ2sWXE~GLgxF5Vg3VwWFl|+5IA>aK&U!%=dxWc5flDfrVKuzx@Zm`@a72 zL*U)~N4;I$`fVfsKZ$>2{0s1yZsmqtX}asx`9IZWOn=$v|7+(MuYbii*#C{D`!|92 zJo&DVyT8EP^&MY<8G zINZ;T{WPqfb0j}ptDlq2*1b%(*MukyX1D9oesV_Z&@!x zfGgeG3Rz1Q<@YYz7!7{*7ek3>TP zFF)(UzdUt$!c4_ZBZpD4LITwhMSX`nRF0Vx)EY&pE+EzoQiLZvQ&@Y(e}xoEyYpj1 z2U0f=4^pg~l1x-0l|PDgI*I2}yQZ39tHf$h$I*aVn}tf`#Gt(sdu)4 zxkiNSvZceLX|L(9_(A!I3cCA@Uol3)Dzq@S6q{T6fdvxzNwmbO>Uz!YZ!5*L>RT5T z;pZm##$+Kzk-RruFQrF}o7C6WRn#Mubgg)N8IPw~{p|e^$@xO@MBOBYDc)T$De39G zsOIT%!R9*&G}WP9I#aV+SW58Tjs92>8cZ;8@KtVlYWupZ1J-__6KZOsTStPat0y1W znpiTv46r-pO9!hGLM9xMwijDlhJr;9g-W!T!5Wa2ZyZ+Uca0=9zcW7yT`9uGZBwF- zIFMY>uiuw9Ra4{N6eUSy2}Npr6|Wt%0cDenhY8IWUb2Sq2z2v#vLxE0CPJZoxg?H$ z%j}-J-4Lte(k)mosvT7^UyUFfB1U!D3thf)IUD#w?)4gszaaHdV5qSH6f~R8fy8;J zlkhYt-LUR1AGZKqR>V~9yTmiFh_rco;Y8r%tCg3{?RQI$!r04ryTRH6Pp=64`%ds};VP z0w0VO+&A_i8LMtRPffT!g;nlw_668Y;f zh7Mdlp-0b99G&IAB}wxQlL_6T(godg30bYgpT0cTX>&!&fvx__y})#xA@Gfj ze{(Nf@$A;Uz;vCF@^1@ard#E&!;dfClSpVU^6P_OKd6Qju?|5cr<9@D zlHcr_PgAsuZy};3>Ee?|?QOA{PMvyr2s;pAT;={4u|}5bwFi+l88V3VAxV~Fi3UY; znxn-Es9}ft2rn<$CLdMq@<2Oh-KKv#1TkbCgWaF+1^T}8r`2e#9KYQQ=8gq$WbS&g zLNArZYfqsQVYX~&@lm|3KBC6Uw#>X&I*)kyHl|wsUGFqQRK{dnf0mG^N&fdiD z7lYkz7ek$T?M2Tiu09CJVB4wegslJD(82SV9K&3viPIG1M8QGs22^pq%NLZo;Jne) zdjiB%w!(tVEmX7S{Hdug*k};e=$=Ug>f8?tUDr31@M_W~%ScromE^l*7eZkirS|_^ z7Ea zjCfc}6KcN*LQABwdjwIurw1WDNO8t}c3Bj%MSda3-Y_2EUU0H)n-5vw1MUTyv83*X zOxjiXVvUh%GpnV5+&m(7Sy_|rK50yNV)rzpO8w<>L2OY7bcVZ@>(6j!8?>R*Q5ncF zvD4TdKT+(`u70ed)Vna*+|{4;8F^yhP$f1{Y>R16_nAJaWPK&mWdfdNrN+B4)bjzu z@ySU{arB#e;nm;V3$6wzjMx?+T{+9`W?e%_MAc(PhV@)H?j>^sbI@a91geN}NB-b!AtRH;S5yV28C@u`oiV&QiZI>QNZ;et(2E>tKvEzIExQavkAXCW zr1Z|%bAueX8KRD4M`>|52Gr{}Z%(Duj4rRC)}%c()3|s^JC^P^xtVh)z9reGz`lkK zUdf)0gmp@8E{Ti6FZK`-q0rU~_^WVMW(x}ot_*?V)4*(|6U}H73xu4$( zf6ilIx`}=GnXPj3E56-`{||13AG{XWfbQ&HeJxA?p+ z>A6!w#X5cYD=3Tpi_?NodKL^ei3$8iaY&^3bpxA68v&trnh{~12VhBp-lrmFhS6WU zhfAZi(0ungoaQl0(gq4mHx?948l|2#qVlR{F_bZ8G2%kYRX9yA669fW^|RVLPRu^k z$7?8)4Ih}b{FI*ZHzc`0-}kV>-p?|tO`{MNv73h@Gn~dZG;$BtH}jpt*Xn7;N(361 zKLexO7NF+9u5eU-wvBf}^q00aP4m<)fz3%085DSMj zaHe_?(>T({x!$cGH#jI2o-PW|G{Dh6>}3fAHbCYFm|QS^WjT4VXJ(a7)`7qWF^L7W>xAz({l!ykUn?7@Uw2Nc)c<^fSl8a-dd^K3Y6_MJ-*P*u@EZVvY zo*F6|Ye~U94RuLe4*OP1|XS+CfO)! zjO{I6I%RkOi{Y^nKff2^IZkQ;wjl4yb?X6sZSNxi6aVYShOEv@vD!ONK02VsOgkV)n^Z3zt=S5NkK z=EdR>;s+#7jfI4mVjl(XJLN1{PZW_fbI@#?Y`is6@z^f|MSfCAeIy`nUUD$=WzYi1 z!m2JVFt{Tsv3ai(Niw{-Dn&34B~)8zJ<4$*@7xA!79C5=Dsc#5o~H1z>l5`Pk@^eO z(kZ#MnnQFV_H_p?t1Mp=>vr@0O3AelBHlQ!mH+Fka%pO7r-2K-ez}=$<21Tn^*0G+~jxIrnLF zJqu|!hj1Z4`zs!=a}d5E;>V)-CX3(}9-=`O4T7y}D$CoexVWK|jXfjNheu|u{QcA#1|KM}86%ZSn-k_Ouo;6i z)|{M8sj<`dCh6-6rm){&I(r9zspFk%n11{YrY?8(pTjF|50TZlhZr{fk@U52e_3+E zflo3te7yxz^mD`G&tE{3K90kGc-)le%fNO|2T_!I&aWA!#_$!k1ky~|5`H899lHvm{wx-n*uPc_#2qI^!^m4 zAb$f>n%gkNgu4w>rfZnS`6h1}12EOXJmk27>EYhHf}DkyrT|PQ-v18MWI-2T3Iu?u z-6#X<&WR0mHiEg748Jrfx@pN?v7aBb>)}(+_n(VUxw@+;>lM!lp(%uA?6~(kf|2@? zA|>osY;A=yxMR1GXOQCv?|+Hi4(6t#D%|QNsU5sZMC>`Juv4ZzprbBd<2^`vvcgB0 zO*i$FNj}ofBIj{RI94P^S>Nl@$AY|k6=lHc~{o_d%K|mVI_#KNAyfLW;ck8O`>Kxntu|-~FO@x*xFg=Th?~*Wflwue$*LSs(9T zjp9~cxC#TmzG!-?;66!U+*FiKfJOMXB zG##ERv&P2@KoE@psINRYM?Zb3tDSO-#j&%RZs1k);ZjHSihnev;#Krvb1RG5Dky>P zC=h)p44%jPsE9GF?6I3D|3`SQT?Jr1uF^3Hb8IF~R{P6mmD6?<_{JTNSYgsPL;Q`r zPY;0T!!)xy5!&8LLNHIkV2D|@*x+E@Vd9vzUf?7rS(EZ~Kn0chm-_IT6W;NbYXYJV zVI}zkfspR|299ci;J(V(tv=RBZlNS-%{V@*y#@n+;x5k?_uFVst3iNvJMS0A+llO(u<*l*1 zg-1{aGPXoy5FDWkq=L^+6uan^up4uU^n~4IW?+{9Vr|0K-MI)xdUTZ_t5^4_R z8CEJk61+ndso02^9EZw+_=uEIMbJiK90kU;y0xwQgysvSq(!wwEdE?J*t_=rhLjKr z18rOh65eiz`p@N+Z9O&<56jf};x5g6-V(OVXWQ>xnw*AAXpsb!W|R@|9Cut!pMkiu zJrMpY5pM+s{8(MyL>Am4;&rOaKU0@X*AWLYuz&O>F#Sbd-efZTlx%+vSz!9rbN_RN zcx$2i?+TIqzfg!b@9p2hVE_KTjn&0wIQ}2r+lvV>2nt2JTD*w@>tfm=;s({APnp_4 zo>Gd&v2jN~Qo?T-6tHbMBqUe**e9?`?GWEVG)wytjLPmxv*^B%;mq zpC#gp_Wv7+sPdge{O!Gc_Dd4c&f#y~+YNs&5q)mn+aPl$vw1Up_n^6nqUh%&+?r57 zX#;7noyzJl$cD~|7Oos6m3e}HB*jD2kKkj6+GSw4N1K$k6ut4bi*jO*ok4DSrm zD(^1**$MNsn2+toX0&N}hp~ob#7m0vFpdq~u{w-+4F`e34VY`bOes?LSDR>|4k%5fmC>ZI5-!FQ0s$X>aagGhlK7G%Xxr*nPPfb%wghX z86A1(3Bz@gk~Za2z^eUMBwpt!e0!+=7>PHT2Dg!Tt=|5TNc;g3Z>6nViNu?*ho2(x z&*=@ndhR;G=G$-opNPckmFnL<;r{}O8^2kQ{{e{vmvz*n@NJ9|I9XW|Y;tFAJ;tIvFhzEhtEucj!AXOEjIs2aZGK@?(-U+V=PL)u+ zO6u#lggwg;`Xw#+p0;7nTNWf<)$bPM&W#1R^}7WL#A7?(#A9P;+{9x?bH>uu`Dkoj z$73rA6fxapIyHz9fcLE*5~y&%c1d`dT$7Oe+~3N(X!?jt)ujIo-L~c12_UbKzu|rc z7&WTM7}#6>mXF+&<_ENGHVH$H#dyi=WP-H$hc4EdGmWa`>u-7`SQXl zk@|>>_9VL!Qw_N8hn6Zs@H_#hT4$c`7aQI<;Yf5>`r|C1(NQAw>m=F{VzT2M?^&(_ znS_S?Z%+i3Rz{y?8sHq^JgQ6^a;@c)L(<+IUOTVf=>I>wy>(a>==Q%YAky94-5pZW z-6<(42m;a|NVjx%mq>S)bV`GCcbC+=!SNiKalU%qGw0{uKC-zkte+$+vtTJ4IxEAs7P8n3?dyg zcyt7EfPjTp0?~F{EaF=>&i*2d@KYO$fmv89i`uxKfEsCJN3P+n-%3-nJ$i3vnW)fI8PKux z_F4cZGxYBGV=%3V2+|@e2+SHT3T%-#hYSFVYuPE++?zQA3JA&8*~6vNg;trS*nNqD z9Rj&;Lw2PdN@i}Wr+DI7zN9JdSeezl(;mpOyj2D}J4^V8p;eEnRAD~$&itM8c~#=e zfH&`p=FRc8+ZTq9wm=jJAIk|7e)f{45zJ9YXWkiGeGej!Zw(8b%LlnU`b?iv>{%3Q zDqJeFkSDu$W1yc!ko=%lGI1U^8b>Y}J+zjDArz!+Ci1vx#XO#a19fjzUP%w1fWhU3 z9I*jpFR?fZj2FCpzQtGCmx!41kl{^5H{z#*)`XAZO2YRUkUvAAc$1RExQo9o5zM_9 z6cZZ!ih{)j`n>oRr}`mS_DValPhSD$G&NnHOPcv~NXt@4c|*?#*tFWH1&uP+im^6wS(R(NJN;~&XtxC^OE))q`uJQ(h(570C_wWXxTmf1l3!0q~gQb zLjxFSCO!x$hc!kgE7lcU!5yjW?XjjWK5<#Ty2Z>RJg<;V^5$37vW8PX#Rfro$9#oX zKU`{@+|Y>G8^>zD*c?)I*6NI_Iq0Q*FHNC(bJNJ-IG;b3DeA z#dM1I0xHOb1snQw+O`9@3lNU3)wzWMa$j-nfUBKYx9ySG?dLz8%ox2t^e&|vv$K~0 zLtEpf#8})BFzuQf$6jZZsvK(0O=qrUE#zvi!^Wm*l2UdiOOVYAs*N48Hk#xM%kA7M zD&OjxC^Jgn%6zLvHjXHrWZmA$qM^sKw&d*Z#L7d7YGH}Tz;fW{(|QEyHax|x{yySH z*=SR78tn^)8FUnmjG+nL26twgc=@bRlVB$Quz22^AI!QGfOzm2n zO={T&i&of)v>g(jG)v?tHF6Vsa|^e;?m=sR*N4$c2fApAd#kS@chzbFbVb{QdWl>f zQCg1G=z#0$pqa=|DlbC*#vZy{3tcanxjpn%+X+|4MrRtn$O$m9v**V%^%bv)I<9LF zVxO?rPo5eA<(WT?#&s47YsKn~etR2+awD~txn41zUDv68S%G8-YrdjN-B%}rsRwH$ zL$DevBZ6wclZU3WOY~%|ApkKks5V_lnK|h?9AnCV1$XW?A8sHy&i!)6>9ieG7fsY{ zCJBkB!B!i4vG4}-=v_3}X3Afy&;#qm&#TZkf5yWq^gjva4}?5-)#RI45`Nutn z|6tt%HPPQxp$FHBAKoSVPv226|2W&{-zDj{B_HK6zg3ckv-dK^)S?8tA=3WYl4Sn> zwGz+@)ZhNk<>(QPZLW+&KD`KQ99}VZh57cekre;76c}8XH6tDf`UGrT!|T(f4;b7 zBR)m!r6`3YaO+p9Nr7R%M=!gjTRLP#=@il9B6J`rtGf_0R|UvWo^7d^?jyhaRIp*% zg_jV8rGU*^n`c^D$9(D6U?u<=EHL(!Rsqk{NU614HSsDu^g`dLwCA=ZX7{QzoF%z~ z>4-{{*`6pGN};g}GhLclBy2z)E|5mtS%ZPE9?DYp+FYuw+o>m-g}(O@3G+%~&vxHr zgcE!@TVjbi2;i79j?n+pXW7eqxtv`0c%xWpA5#0EdHb4YRFYG-#WnuYC~F zJ8>X*wb{;8+lg|+v$7JGU)O6lx)Bk1ljguG#DH5nXD3Pt-~0?I74ZBRDDm3G0E>0W z@YMh`MSoPe5#bAg5Z(49h;1=IWpcW!Oi6&sbPA|U$a8mw%*N4+r=zC^_QEIr_)-1IAcY*e;x4K*`1WY?+ba=hYDTD|gFzla zFJ!3a9H_Jvijpdxg1b~i&sc@;%vhGxt-srEF~NgyN`b}-_N0lS3%reE^45lIo8-Fb zs!BWe83jJqbfr0^*km%=dgda+{phHM(<>n}NOpN2-K3troyRzkXxw+pA!s;M=vmMv zsOVR4^}Wh&sA30)uVA9EBs0(zL%@o2wqx91IZ1pf6X`B)NT{yVha`q}s%0EPD^L5# zd$DKdi&f(s02K}!HiN&HDLII``>i5f(-#qFSPwK3P8_?n_xUfmF3Fh6POa4ayHoskf^oT((;f}{=}{#9VYbT3l+zMt_oMd`1t5%XPB@sGDg z%zwU{{N3{Of6qx~y7xbQ{~hj&((koY_rJyWb^rUKbZ>q6{^R~#lzzKU>H|!k_+w5G z=M-PxN@eHla~<_EpES`Kg=r7d;h>tkJ}GUZaBuKipJeGu=xZ99j&ZoKztTzEyf1>7 z2fxIaN+IOgt?%@`~adzJK*j>OG)LZm^P z_w838b|jb6@>w!Sh+ZU0@)io2v07f#EwWNik&!g#JgKvj6@ARJ@~PSZg$jN919`>C z0=1j+n~Q}b$1wGXSDv8nu60yklasXZVh{;@84<-a*GKq0Ia$PqUz=%h;Dh@0yAhy> zK6A8zj}?~}l?WJ&myILj$8Jq-7i1TqSk~Gjj&tgNgD9heUKiE-1UUpymFgy48&_6R z>6dcus*=|aRY{*;M}6T~YLJ*Y1DVwA#dYL%>W1JWW&^SXGx91lN@yu@c+f}<2S53v ztZ?6uEi}_2s4`tNJJw}8+Gs3=ZI$W!s#GiHGVP6AabK18%m7uXUKRVgzq771d~)?2 z;AGTgPronvTcb49xssTx?eJcXERLwlC>N|9HIpX@J!LkwO8?qUtgYo$&p62+RjGTs zw=3eQs0kgXLFJQG))8hQttj^@UUTA52_V3&^{H!}^1NLa&9gK3$76 zQ+*%*kqgi-)fRFgL4dgU&p@ppVFDD$BRS??)O+u?E$XLe_ zz!1T(BNohNASmM~QJ*C6S4=&;t&Pv)6#wRh zOr(#T&?<@FAycQE&+1a1Bh~xV!*~x*a0>%^rJNG3(Ni1;Lnd-SucVEu_4dmbh}M^G z&hyX-o7hK$Tg(}ldDgO`rUXatRnAF3g-mL{?g!NGR47zfDH%GHElI4BGW0pB? zBd>RAj>2jI}=cen2PRPIYs z{hG?Uq9~vwvE{yUlN!Q34LSL^@hlW0UQ_Lj8ArhJIN>W0pZeUmovPw$?Lm zqBvso8&Q51T@6x2Il&ys?j0QIG5W(T90=Ti`4ZoA=!RGO)_Zq5cYSRTZ_LBikW_hn z^~hBKGd7s4vgj?C_g)->43@qE43Tu(hjn>IBGBeU2)uA5BpbRt-ZgOyuUR8lt&3J1 zG9p&>a>tF98g6(iNscxReYt(Y=OsY5(ups=<^IACJUe|K9D1hlPy#~>j}SCaE(wfh zj;Sy_tcmeUgm#o&@~)dv%hUW7t2Drs>Qr~aeESlO>rj{SlNv^h-p?Bao#@iqAF@<& zN_e9i=bW{)P~cZE$+PzcUM_HSuL-%MM6BMxtYH!4knHLKpr-;AN zwG*SuDJSa`1ejq=flNe(BiHyIV*#6jya-6Yq^WLAiA$DLq*|Xg#r1ReqUS2G3oUHn zv*^vLQyJb1_38~64}A==LZz*zBnG}8z6kNW*9p8{>0S3V6qU2pOJnFoDHZf+0QhXU zUF*b-$+ZI4=NEx#nfNWAV>dX6$2(Wx6P9Pa?(2^C=j4iz(gYdGGBs0h8h&9Ue(B3V zlik??DQ5ZXCXL92A?uwmQlEJ~L>Ev*uQC4{x1xm6W$0xZsrCcHxMSKFOVS!ygP(wp{Gb@L?6xquTjXKga-7s{7s*< z1?{rO#pTO0Qs3Fv1zQBP4Kurxr6-qYVK>%vqwpOEeL3m9UgwKA{YXIKN_K`8OCM+A zJ`_xiQw=N#d@!f!apk0dBF3M@D$yWgqv;{nmyDYKywmqSH?KtPQ)S!|w{^S91dz{| zsT0s;yCVVCwxPn#)v(?4Yscc9k&ZwMFM6^Az1w$lDj3+VR@~z%GY;S_{U@V9%Y6-; z{%Bhtnlp!Y&yUfpYb1bRPw~d<-IF3`rYc+w!8b>r)vR)C=Q|o`Z*Qt9-dwM!jv6K- zoWJFn?5-G-%xj-l^iR(dTDkCzxYe7(;3l9{D zzk}u<9z6o2wQTrI_tvi89R>10{_;n+@Sma?@G|}znw#PPXx;+eN#ouoIQh79hh}xP z!>Ko@liGlh{c1sy6k@MZgy1DGVdtRduwY5A*3==RI;(FwRUQ=5!+L{ z_Yf{Jofk9@b1!*{`7u`NwQbv{EXd;M((Y;$4#6{3-D+4Qi(`QXg3pitkJVW2kRFt{Y z3V5=UP3sFJpOjkHP%(NBcjQqh`)qF=F7?%}2m#3zxV`y$7>Jsb{#NU8XFOofDmF(3 zz1PbZW>qv-%N30@BQ=f#UI;WS=}Qnr77}Rrnmr_K1V6)@&j=?kdcoI3pSi){hl8$i z(=EC&a&(he0f9y&A(Jtq?Q2@vL)R#Fls7sp(XC{$L5CR-*DHS9i-;g7c!PGq?9On? zYt$}eq#D>4^v)aEKxGxLRfD02w=?K~>lUQ5^eTAq(>WY1?K~q9a`vZ%c%zz0BPc@o zSDRz`b-6jMQj;Sr`{vzatmSMtwpnG`^jRwrq^blIE~?=h52!9x%t zLN5+pDkP|JAATL%pQ0*M)a!=pkibG$_aqN8L`QbS&AmaEI~%eSsS_MJMRcD)o)BpK zB}5fNUN}=s7bbWC8o@xoBk3xQQltbZhgUb;Q}qyOmGM1}z5(WywcV!IS>73Q4bdjP zOXr3oa;yATJKx}Z=CaVPUdw`pQ&p&v)S8-K_%Ap!m1vOu6wYNmBH!Ws`cjZ}qAzRe zqW0FbcH>ip0vO%`}fG+k!$^{DIR^xjI#C7}`YJj@oxA z!`vwII=6N+RO@P!AI+d%dZ%dNWW3sK?axy=Z7v8BT1mzWQZhTmaAP{@SFR{GlxKNj zUc{a^C4(2*SiFaVU&EhBTzH$)#Cz>`gtHUO_19r?ObKCqeG;q`ad{dltQzsKtX$;-d+`o~@j{;v#vX}+?t5z|-+`7f4RVSbW)DVAr6&$93EDpcLc1&=PG*RHXxZhd-*>{>!ScIW&!U7OAZ>e~i~$~t&J^u^DnD}1@Y(7h(+T5}hDA)H%u zXa!B_MZ`}Y*A?Nzn5;fRMiF(ic$yI-jr?+80a=3_6o6NtlW}x}{!m~ym}jJScs&GS zy2C33sHlv;0(0~|Uh4pOefPC>u3O3+oxDfXvFrI91%-gd3hj~cW4&#&f!1CAQFw>`sNdr+>EEL73sOMzrISwzc*OIz+A!OK zcID%ROPLdrs5x7-qi^^(x@!5P&DBMlbS~{1jyzkHe|rqO=JhBe@2PFo!Px6QA-&y` zZmV29m-hd=l__Xl71_7XpuzUm{6gqE&7Ka;)S zJ*^+h)j_Pg0Rz8TNfzJ*3ON?^|LgJV183dO;d&2+Kf(3Ce?0ROxc*rc#dQDSeht@q zgUSOa|K6jUdxO>Yb^j0G`s018?{EcNkN@3mg_(cBb^mT#;V}MlIUiu78@HsP+(}ly z-H=M60MMY`e8usPSm}%iGxY#{{&=Xvf}QE@o~59I;CwJ))C*c<-MAOs$dr{Tk3Rz7 ziURZFw!&k}PZsSf0Jx@1D-^kew54h2Uz@8Bx(Z@7wMi21kL0pKcwrbzlXaBW0v z>86nOZ5O{Wl1>`XCe@1JjT4aN?7-_IAvK9=EX5B#VCzR)D71^+F-R}SE+PMtkFgp;PKY=f5Rk-zYn*?RZgwltwPw<--keKY;IcbxI?xx zAioVq3hL~Ikez^Ok}0N8!`~qlOf0} z0R#yhSDn&Cm$R1Piv3JT=aH~GoD!r&l?cgvyQ+78i=+vDl~x89U|-?<6j!n{Da8yKw&3)XMhb zhUQ)R{HCG$<-L}B*U5K4{wM4H-=@|F@|5pj1>BqYU9f&s(KL^zM|R#ToJYu5yqI3K zk!Lf58y;CPn+6d}ATy3r2w8&5J1a9z7aC2^oPh zeRKg>-?MeYO{CL7m7B$`}dy9F(b^APPL&fursrQ>R&2q^L= zPI}v#WsE`W+xVidx{CzAy-(a}d?T`fhX(=_C>Q0xQ|M3_8P>$GO@)VMhsOgn;902} zAe8~ws!ekzggyK8)#!?QfxREeduiM`wh+l)v%@BwH#Se&g|1i8a| z4VS?Yf79&!W-YqcCrRHyUGIoZ!Kya`n1pd4YKny0{Iv!F8=}vy)C%e#G9iI7Y1Fj6 z11*AdHlXzxI}=tq@p8gbB^kG5`Od{G`AcEn*%ROwS|_Nq!^Dj*y^h>FE8H!n?~~xS z&`=f=7rfdwjE3+#n##Yf^};jFA6aqHCe``6cu)~}FxXQ!`|(TB>t0K2V4isp5gsT_ zU$$;OdcTM)0xaOJfYDmyaQam86g_aBey2|*qOQ7AjO%9PO;oasUs~v> z={sSbUrXh#|I-9gl&AW~2@w&k%I_e2`sV7DSPQfaIdAJ8m%&`4jWeUPSCRjvqG z`DEf0OJ*j3nbc7!s>{n!qBER=u4m`==}5XIByGDQ(UVVMS$@D85qKySJbsJV2;bZ$ zEVYr3Y(p}?RS2z4vsgvb%iPE3OC%nh@)BVKPxhR84ebbJ4XX%9bebj7O4gAMFo`ib zJlL>l&q>IW7Gy$rsZ&}}*)&Cgz@vitB6Tv1@_Iei4sxLg{|oG=sdb6E(Xav-tJL|8 z=2{^wF((GzrdA)4U!iI~!G(1I@*8s=G3#^TrF^3`%EPfhFk#>B4_h;6K&owi24a3)K4IL7xcaZ>gSNXhr`44`puE_ zPeb;{8|C+`{2_$?YS;G98Yd>U9~S=~ySDdwlkdO(pMU88vF?HT>OV}rzxQnXfg-6e#WA$>Mys6c(9XH~B(y7OUDVlc^>f=LPU$B|vjk*{6 zu$|U9FnJ0B&d&q^=V!uq=VyV+J{UnsIx9zk_5sywv0$d0(_}?u1MIr@=Vv9%L#vO+ zXcytTn*i6-784nuvA@_=I)WZAW4xX(gt7%mq-=NLp?!BSp- zlB60*BdWI1S->+yxgk4#LzFJYV0 z5MM-3NtML}AulJtk7P?#Bmg%?%BQ>b{f1@cu7s5)yrS?l#XBs2{R7K{d@7v%fI-A3 zTb7mGrcG4WqX2-s=6^`-y7a%ndJ%hh{5lrTs z77o&wzBHrTkBu~EJ>Et^d^&JZF-uHQ7D|d&s;7E$rh&Gb1SDpY_%Z*av_9rD4VSK) z+w1vF8GcYnm3BniHRa$alR>lkFDqM5om!ZjCjfsz^2kPs9YE!4`g47vI6kvMw$*iL zn?Rzp)F=zqE;${mbnFw&C+sFt`8{C6V>Ozy@(cXag=U8Du`xjLL~@b9klTIf zQ>j71C@rD7oH(NktL^DiRv7*OEO$rdzQb$9XzbBkDZaSJ^2|M!qbfoSE=-(q!?OrZ z2A0%`i<7a9i;QIhi))*7Rg$;c>UhmS+wR~DLnEJu zu@nH#@xx|tvSthB-afrbBm*yYJY^G07il!DOnkNC)7>PrYW;MF9qHY~M+d?^aw|X8 z;N8JFL>~a>khE&=ku|gN7nNhUPG1J2mXfnA?tz3_T$I_}y<_LA#Eq9K6I!QO$Val@HSbXdbNX$!S#d0p0x!jrc> zW4KOL!#8MLH*0f9?|@#9P?G!=%MaXde}m<}X5ViTrGFaBe|9c0eX~UUGW$Nzc-*1& zch~(F+4uL*`ao#%2U^(x5&w75`Z4Mrt#@WUo)(~SyonfvO!4VFZl!5aZbj~*HnEU% zU-0~?cXJG^#1hc8AA~=UymE>uo?F8)Cnww&Kv0P3KrHrr(M{a_0p=N)>P1N^E#Vu2 zP_k7-Cs$D>QeO#g6f}iy<@DaQ>ay#Uiv zBa$Z0Vu+9Ipl7%uJtdD`NbhKRoSi#-M6(A&PJ!K8cW7LDv5#S$brABZRs<3Xk%$zX zR4lNfR=asXuTyNF&2wBaq9tRj#V#f+Z2lz#xV0mN1WEPzH5fxRKg7ha=mtMJ zNMpP8;Ng}=D0@4E{eGDKkO%8w7H*S-C1o`Qc~hdi5wpdC(7^y z+@o{Pe1)o+NkT6*Zah#lUC7r0kchY3C=SX|1>uw)X#>I1E0D^^#Ac!%`AHjG%o7)k zU0GQp!biNTsYeaN0WD;z`y<;9&j~yyIz}^$k%N%h_X2#gu&HXieY1d(s{Pj~yI%RO zo^biL!z=7J$29bFax2u2=@D7KzmRlS77?QwHHuNiYt zVTQHNtko+WVNsMzXgiEkV0H~yJx7g&%%4b{h81k1P#2&?l6_u4nE0kn{Mdj6PZsM% zp0jy;i2r=`#CvWgR>f26-ED4mzvRa&g8~*1{(RB6-ri<%c-#2qw*5F#W|}~1J0c%G zwA;>)@?w`JLrThygx5}G@nUB?Hw$;DKNHy6^KW>5=tj>Y%M+-zzsJypqq`TPTeP`I z&|%KK+}P-G4bo{FlKvBF{W?tEfAt=Q$!}Jm|BhPUv>QKO0r<0gi0PXy>6g^H_lx`( z2!C_k{crJo-LC`TZ-VN_ZHIq>>JJ0xZ=5E5RPG4^^yM>aRCS)91prPdWr`2yX(|ni zYAR~d12|@E<|gDScD3eJ8aRB z!FNs3r?W>%hEnj+&{VWpAs>Y=DJH7K-pUm)4hVeYDn<6N-)h)yAUHOGW9zg7dJF#D zQ^e_nAenONx|-!=zJ-_#@h98s13;dbFH-PwTRh-h{67I#$`EquSfmp{?QQCRq6$Hh9PmCV0cWrEtD1oRmr z1a3!?EW9s<&F14#!AtDh$laj6&-8LamWVyKDu z7MoQe@0N2qwwYHv{B?PtYed0~(cdvlWBS- z$Q+g@dPdE}^0~L*>~+H_+{8#s{a-QlK=$+VaCPtXd5Ed+E~5YDIQ%D=`t#d_`w#c) z6PpJautQ#&cD9FTT9sDSqBHf~`t^_^ax$J;{UNb6qTK!pteRbV}YGHNO~r9}%S zBQ?C=IyE=2!0me}s^P;~0-eCHwnc|NEAGh0Q-i^8CtlAwKTZ%E>6qH(_G1s?>ZWM1 zTsE`gz1r(=eQ`_S+L4jW+I_{ISzn$roXC(ceVh_ks%C9ezUP0|Jg^fD02RL;b668( zeZ%@-Q%wHRPOvd5Eb`~XbmB(w|Hy2m8$8=lxB6zAwtWLL`3QAHgEIf_W|+u3k{=Rwsa z8aTtQy0;7|EtLgATB{#1?YT2!%lBATZ1hlfhMpfmx@UgMq&EBrYsC1ZsJe;)N@0)$ z)%9)QxLQ@dX{eVP4;s{%5ZRX}kMUhNSJa*(+lGlt2}R@3bdzl7AWXTQ8?&@l;}sq0 zXDrE5zQ3SzmQx$g6Pnj+Q%ie=Ye(O{df1D8>TU6Q?5I^%a?&i82tpt%pFspMs7Tdd zS1n{bCVtI|o~>%#)6Nk!uS|)Fk&>lXM19L?n~k!!MQsT{4;!WKG2-0kg4Bd%D< z_WT0M$Z`j>3pypI{Ah1KQTIjBD~fFMm1H6@bFS(~?BeT~*Mv`$+bFN~0#zp8#r6p` z91Ko2u-fod-Nx*B7h@SRIUKU#H;-u!~d|LW0db2XnBY56GWYBN>g9gBN6} z6pk#%STwp-t4Tt99Ild%7+>=gyQ3y$a6w1T!g2esK;tv?cw8tg=53_y4cMGkV?ZLD zxx#tj+>Q%Kn^wyBUns@=z}fXvN`3p@{fScd+g|^0m}363_2=7%`z58A?;RE2LlJ;d zzqyX-UMlo`-9JXDpM)t^z{s}W?)sFb0bvT>c|heHVWj;8WnYhOGH+BlGECI@Nc(}LyytPe8OYSF)ktY0@`_b#_@C&);=q(<2i2{xC9}5I5gC` zR`y)|Cxszfp~y=M+QW+C0l!MREp`?xGqg1|y`);|3#Czm#J%g}t%1@{U%NFW$$QCb z>u0J7WTmJc3&{CnWWyfu%ZeF8QDS?8*}OI-2mS!16ABuGK5)i-2=1jL36QC@sQS8X zC4G|76ZUL^=LE5=8PL}n1(`%v1{wz?IcE$JVb-)5{iKA+<{>VXWpKH~v|%6>f1&7D z2=?q1ybOGy(|)ds;zkjSPhTq>ziMQK%_7s{HP3h*OF)`DE>$ztfNqm4x4GijCzTbIa5`|`F&#PUJw--1muq8Q3tg~XC7)FPOLM0=jm=hYC~y_>v>YrIaCAmflLhCV7?lTrPvVK~Q6kWIE&7STKXfXu&O_C#6Zg z2cC0RKsgH+>OO6HeP0ccD-1OiZlwW&f-h{K{ZeYL^ngcAZt$yG9u(FyLvQ%Sxc-!r zwqn$)3V8((92E^Bc?CUsnbC+5oRG?l-AgD@&3ILxx!_ACiqh+z0_BUU-3>5cpS%}N zs=Hb$7q0I*2f#5P8zACL-n&hBQrbU`&9;~gJEq)3fzIf4SIBuZBX1t^c(XjSWm>k6 zvdiNO73jE^FiwozVf{vvL9{bF9?Y_8ylS-F$rwdFc&rn3@TGGpowUrwYol7@S{47d zs7o_v{01tz0$jXpo{>X|32ot1J5^g$~R#B;%t%m&lZyhi~s(NkojIV@FVSh{GtEHy8Hiu@9Tb@ ze&~dMcoFhj`%26Yqyzs#-ye3w-)Pv%{|0?X7M&Hwl~X**#>!2NM%Yh-Nu?`LgaGKf zx$5g>`y2Gd$OVgX5ku%a-+mHunuuS3KBmDMArv$QqsA@9PYu%Joae`)hfTb0_tXjW zL?4>1XdF^&h)mK_5(iO%ehssWn36Szml@8xph)Z@mL{M1@cmfOx~V=7?wQ~!Fb2pR zd!x8AZP6n*_Y%?sa!Jsw*baKxYXvm%OHMds`sQ|fZaOuU%rJg*+pg(P+kH-hvHt$A ziiI)1#UOiH<+*gaVthGNE5z$boKhv|9vf@QQYjbzceFhHyQm(Rx-B}wlPl6B(xgm@ zU>1q;z3ey?axu*E-lQBcP@)GTcIN|yhGVzQ_{>JRjx9#6Ag9FkOTxpe@~ z8kAMa*&*uS^!WRjskI^3fxw$nM@()Q%d(wVnvG|-w9od!^J@%aNand^@S5Vxt3tU< zL#908ELat$bj9>=$jhQk5jcDfdb|Tlnc}VLp&fi#3TY->69Z{;j^-9 z5DE7g_yB`Ipr1`z;Ufchyew#N${}*li!d#cdUv-7wKtGnsp=arVfghG^7hc9`Qi?; zPMPzlLpcIWlnp+xlD4Bhdc%ByENyXhAM6x2!b7S%4y)$ardN(*_G~NSE7Ws3Ri+8G zqjq<0O6PDyZr|o_bTg_?!F<(^uUi*UMe_`^(ArY(nJWqEhO5D7$y&kVWTSmIpfBnI z2hsB`C%At90K~zKdoXJiEVL~-@b!$z$(wE{^ejF3))~@~zRcHZBAHLX0v&}mQ>~Wd z&m_GwPT^l2;$Y)4ezkeI=ly)EG(NL8?^1v5sQ5`a)L>mLTSFi3$!@sSlSXUxAPuB3 zs;oA}kZ}#HTPTTyHg1{AWb@@@Uea4&WvJrUKY`z`&|LG`I9KVWCvP5`ENBjB04O|tMF zICqsd*z!{#^A$QPQE;el=N^78?}(D2<(7!_XHJQPq5CQI@wgV0Ty6 z$}L^c02FhDbXP@^mIqKQqeJIqLpROJF()iDeY3-^!z^QAXjlv5c0_j9`U%*)q!7}p z5(R!t($ zc7SoOsG=iGBa)cmsA0O1jUju}y9|NS$GY|34 zd^TjJTcVfyl4H6%hw1vJCUEIY)(@{q-o3Ot(p~jQv)-fgd6RC(KqAM$l9>yWVDiE_ zN1j~)jz_NF{Zvkcs04M zF>zA}UO12PVooLFl(uLRgp1y}oG?bgbU#{}*Am4Pc$0pS1aBLCf;N1E9e#UbwU3s} zz-jzf&^*xX{5)mde_Q?pn*V;Ei22(*`5zA5nEx!{VE(2J`6X!X2j_oJJa?e^&2{&V zkMHY#4VvEzM-S%ae-B519kAbJOL>$;Fn}!`dv77}ka8`r1H%nAKSnpE1X)Uj$Q`xl&{D8o zWKlEBbzsO2DCsm7KZ!BH(gD1B^rZ{<7;TtrL_qJ1EXdyRC;aA`;16t`xL;av4sqPr z7LcOeNG6hHh4gC@hrg`l(;QZ?*aFanx92-ujH0q{oZ-mPWT8!#u1NDWbbwGE7n3Gr z#6XUT1vd{~QB_7REh(h9LG)V<9L1esQc#$-HXPF9*55oz$bG5%e(n1c0|@3M=l4m` z3}i!v=vqB#x*ulxvR>vJDD@`1P(g#Lw>rB_Oxo*VJ2*R78@fCY3SbCzBj5fSha|#) z7X@J}OktRCYE4hQD({VIm9I!O6bWiDxCboD=%?V*_@av`BjqWL*j@{I*@qOE?habO zivxF5t|uF2&(<75;mUd}litM3@>^vc!uOG0>7(|1mZ%)P)MW6(@DndwU?c1*dtP`_ z7G$iSSI!iFB5BU7F?K>_G<1Ue*0}QPX#`1=OqSgfC+I0K)MH|O^lbx!dYz{i{5tgj z7!>Rmxz2r&<}dd$!uXg_UT`I=NHsGHq`QwmoR^pxS36J%7Yw44X}Y>x#1C#6jimP( zJ*;4|qOQ${6G87=EVbobHB4jHehQ8JXSONXMc zR>bH0K(p&K@71})9$*C>tzJ{@h}{bV?Sd25EMiL1Eaq~zR$6K-B}k*qey~2VL7q)Y zpMe*f(UB+ed&^LAXMlgx-k7T~lJz|`1X6e+;5cq8cRQBxPJ;S4`$c@ffshb>(<}J%g5-R zH-IyJ?=u%jTQ4sq&1&l5)z8*h!_teI)1bu$y^lRQ=54P|x%qYIMcZN>87n-jt#4Y- z@StMZ(QkYO1lp?h23-mHosFs!Uy!-Q`d}Cnu1a-&fgk=v3ZGk0-1^p^pH!OS?6X>O zSb6wFgh2+EBujC76bRPVuHjs$;~{QA$~aKr@IdYW{7|T`Yk~`sBKu_<1}ry*`HYBM zQ-4_q9%r9A`lg@}k<963l12YK`bhgkZ4uzUy`oMVr_qE6;J!VVyW3Zkb@dI}WN4T` zIb;?tKo6!aHqSZ|CKE8(;WRI4pZKcSmYC!b;i3#+iml7ri zf6hxwP42n6+VmcB`PCQ;J1QqoSz61Orz~WBmssD9rKqPBGGC*OSpIbuk%*&?q9N}}2+93&9j1?^b%=#h4q z?H2pE=_*F5O1C6Gb)>Y%c+x2)+c_L&y1}}YyBFT86%%Z?AC(4r(D{^o>ZwoW12o!w zO8jzI25HF$;1DB%UxwSFQ#)G9VhXnW;eugUH~cvpJj1iBIcAv+ z@QoNVA#&Ny#oN`&H{KC7WpA^5G-a-KZEY@pS}9?o*9IbZL7Z+0aD{+yAf=NELb&ia z7bl}R%LY3{tsc^fndYDipHG2#Ysq6#3d6?}vlR4*o1_>Lj(UULN z1k)&%$-g8>KwYpgP}BtcWkUEPGPUDhSpAiO4}3L0XW;#}`XK|qIVt|D zUhXFh{IkM>`I~g(mn^%VI{!T?-7)ZY*Znw4{M1qI9aCQ#JXpyZt3X6;%`x15q zd125lY71{yMtt(*Yo$naJhDv~B>FzLC}QswG7 zoCh*>u7-HbMIn@ko1RkGvMB@KM;iK^BOdwf7k@78$XBVoVnPJ4xXrKSjSN!T z^TI{G^90rx8nL6EZh)&-IE0|Q zesAARegG@xDQJ6SN;B5POBJj{K>5Dn3v}F5s?X7QXhvg2$p@-Y4oS`EA1Y_((=b$_ zeOB5BWWkSDS*TpIApn3%GD#CFtih&pWC>w%$P|ckZbTK+GQZSDE~0zaZ-S+t+#360 z*Lyc?3jKm0?dD%7B)a?YNsW8KJv=!BLP;o#tWstG6x#1v3DV`lpb+^=g<*~xkg&)y zg?=WG-@jz-DZSP@reGlpSglsUmEU58@Da7|3(S)+5fEb6Z6^KzK&&zVu~dM6*Ic;6 z^Ob$nnzOZbBlql=S+!6GWGtB?^U32I6;mt!3Y3YPtESs4y>+@hj%V+G0>NJg!FvbA zpCEX@WAu+h@XtZ;UZ3;pAoyTh_&o%FF9Tak7?A@Oud20Yq7=A zj{%Q-_!Qdgu?IZ~`IqqLv=?;1qU==K98L3k44aLPXWX)Hf0AC0<`Rrq1G6@Ef5r*`?1(?Te(IoL^Xlc2H8DAJx z%O*TIC6ba#DJ84Cu_>enNVEZA(7YKSxR7lo%*XQ96J$@!5ZTu`m+6&nFRX+DZWk2~ zSd*B=$^i^xy6(oC{=hcw%CsPmzvKLeE*HCC8eoU4&JQ3ZBz(I`XwL!@UqQZ=&!}C) zGo4!z&|rSs@b%SG1*8>3Ieu-e+4e`I;~0P;DgPgHZvmBsmbQP3ba!`mcS=g9fONNX zNOyO4cT0mbNH@~bjg&M92!0QE&WxVp%<;T4^IxCKwQ#xEPoU3r?d#t6zJGw0DZDBl zd8jIbI0|tbYZa?~m&NDit=v0vlKyhL$1%nVQhPrK*<(-9G0shU z+qhMS*08+P#SV9pF)oe*&7}jT^*s8%i^9d#P9I0sPOuN+6V7d~a9Ik^K5gpK+5MX; zi$qkB(k2-Zk^>$R!~xxUjikKTEWDT?l%N5n7&NN0XqJ%%{usOWkYCL&Bl!V0W6R}K z=Q0NGJAIT@&pn9VQyy)eUPjVOf*lF)@I@!?qxOw6GEdxU9o;`u3qTVI~_h+BZ z1`lx)6B--;JRue-;4apMxc$s41AQCRCB_oc1n>Y_`-B-=hDz^HY>|r>pDCMFm^m4c zxWDhaM(!@Rr+ZEX3d-#a{w z6n%ReV^S0rnSx9&K2=py%WSlUmQkO_z8*WOGQSJ<2=wl19Q(=F8f54lpp zM@?;*{}m(;sMfH8El|{zV9*SlA&lC!ZNh*Be3rrTQ=J(@k@9ro#iCHne9}$rs;_1# zy-`mqcIJw z1Qeca1d*bMlYzz8g~0h%w;|uw($F-QC@(|qb}ZXOwpPfsas@KaVdE|ruS@{Qza)r2 zcH5$Ih|>+x3-(*-E2vc{<$LDGV~;lN0p2tCP&xXPO#X^gf}dFaVL~n=e1n zu7`uz7KX?P1JOh0VkUG;$CQ}F8-)fZA)Mgkh$e$bjXG-SH;5C|FvC|vlz0L1=2P0| z+WOFi<~3A~1{jReG>E|Jd2VMV`2x75K}xsct+O#t(}y zC=1Oktd2ce@fJ2tOtMr)PG?8PBZ(W*rI&0^Gi2D6tnw%>NXYMJHa=fW*x!3I@|N^E z_`>SNcn^K~+?F;jZ0dzDz|=iq5FTZ0Kq&Zz7d~4{7#o0RaLmY?-^y=n+>K_1LQoBC zh;N)JDUSHst!S z8fSOrswk8!_x9c!ZAeRW*-x!oeozDZMv$XwY$wqmTgbP9WP{qa`tfMC{o0ZeQdz@Q~6%{ z>D2Qm)tTq%AM668Jrpuh7%<^M-f;xb!2!OPPZ$Rc#KUO0br8WqRrZ% z)9gewwVHa1ZVHJg#uVO8fB)Y65OqZ8A$O~Dl?<>Vu_XLz6)9WC_|I)mL;JN8h! z>Ht$Q>2&w=_??sg*Q>(XuTOA_nq+=rh~GQOzc9o<7o5MT^MBhA|44vfc?1Ccb6kLY5uy{@`Ew`AKHL^m_q(fm-?*^^Ghxjx$xjpx77BfpxrQ;NDj13 z4=!cCco~J_KT}|#Ye5-byL8YF7}TwWlJDLfs8f~j50~;gvn>^J?&@sWA>6M3InV}iUm&xng428CAHmYfRlvPq1H)hS}U@1iFtu<90v$6USB0x`nE ztI!)CCJlgSHN3%$KvBE+Nq8~>xlR4&GAt0`UbrXNY{?cm2I}_5% z-r~|*`01G!R0xL#dvj!IW=K@fv=BtafRg;DY98L?z!DkwlCt40Au$H~z*h)u&|jCo z*gCW(gP?Cg=J@e>*1pSTRiw^QeFU)(vmgFvJXHIN9tZT2?m&you7s)o?v+pn^U@FB*3H! z8UZ|oXr%{}n)Po?D4~-1>aSR)2tB%-*Nh7=sh(xFZ99y>?l5AQNlv*KVi+Es2u=9j zxi2tSv(jDj7BdMLF=?7fEK`Pq-AJYs&Kh*v>-+<;dAP286UxHaU+RkX7$YN;)6?VW zDy+bwpVSrxr*17Mq!W@ZOmQ1FN=P^IejsUurPSi(LgW7=(@<&)SG*cThW;i3INwg# zkKc#>X)>HS+CQu+q-G+c0_@GRc|$ley;xGR#zDDNWxd&YQECS&K1bHGw7u8+SAk_* z5icAnTtjV3c}S5B3P@j&e@W7f&xkKngy{wL9*@ip_Psr*O(llg2We+GQr^O`P=O|< zLjzbEV;b%Zks4ZH8+GmeZJo^&JpOpF4Uy8KO;as}hu+9>9lfJ`RVoaG$Rz!`Zk9XO0xW*%!KO^x z$5K(>;p0_y3v)Em^lR;GD;Wv3#YF$ndBE& zRM`{9Fz3(ekQRqya(aa%sS>5hA2y0z=RdNIkBp=*t8tq2%H1A%6<^k6tSvYq9)drI zd@ktuk^y=c{02VvW8l?M_@*_K^){-8O6M?&=lBSMHzw>xet*2{%{=O44N^-0Mg%a} zf#11@?D&c@2j~`J2kv!KiC*XJp5ZNa zLaP_l3qD-@Cj6%3m!7Y0@tF$Wnf%$LeqiqW+@v1G^~coq4f61xnbhN$b%pPnF8;`b zVEIO|_{$T49|n&3gu_IE z!YPSZpz3$1ad5JBZmIQ1XOs;NqjwGA35qjqI*39@kkbbhKyPJK7lPf@$PzS_ppS+h zqSRF@y<96tAoScm?sAd#WY9mOR9s+(Mbn84ub}ww^LjZF;9KH+c^0$AyV8Hey&lsdytEk2KAe~41zWzRCtw0yrsDa$v@ZNSfvmp{%Q00)C?1EHeWytRCd z|MD3MA!2DDf>vy4&Z42S3lqFjI-a6xa$sPT&PTXe0yp&g#_QcZ7iLJhL1bY__j{As zUe5t0f+S?X$te?Z^LR4E+P;(=PJ?v@Cjn&iXlF2s;GCb^h6tH2#=64oc!(Spv9-fS zH@;@1bwt*yECaUBVVm7}a*}dLj23eID$jE!3t;c{_*FSfi-$+tGw$52j_jll?r~zK zEkvvM3hEk%UQ<=n+~qne5O$T)XR>NXysVr50O7>5f>s_)GaHNZSv_)N_SNJyq`r$n z{5}|VHwjSU^+{{SIR7pTVGK!7&wC`ovHop{#!DVQHAIVJt|dHP@j7WcJG%vK4jq8A&*s8BB|Y;(|#h{?143uRX3Wql|IR;6#VQ$AVw@OIYci%iCess8dEyP(&K=`s6?K) zJrwW^TtkTyrAU|}7qn04p@#~Gz|xyPIE{6(=8$;`1Y4b4g6QqFS@n!12Lh7HSF6w5 zTt$3#alA$@328vha2~HKBV7f2Sr=BGLCoB)8&`;oN08)_>5^_&tT$BY_!aHRSMU$e zhl*r;_Rm7rzJ3Y*q>VT@=<^e!`u?Q#Ul`Sc!2ZFg9^=Y?-Kf4F5AtX@k2&ryjp~m? z4i?s5TgUo+lKkJNsmFQwzlXPf7}c-W{FYP}0KD>t`=uYt(JHr3spKm}YFc$d(Nr4% z^SGdT3M>fgYvbdL&aQAnrowaLB$oowz8RI>C{7F!5MY+3TrfuDQ@~Al6BP5YmmD1Y zV+}96)ym2T=Jh8R@HzlBKQ9qL&5tWFAL=r_rXKmWMT)5T4cc<@nRn~PCs*xN7aKVA zpjq-3oAv@kp>7ob_h>jWi--c=d%=Dq-Ni2^DO@jG3=B~7+c253Wqx)9y2%sNIfvmY z{{Yu`zAC++vIc=DlYR_=mGX5?D&Mo^1OX$Lr0Uvj)D<=kq##@S+QshT5_dECxOdhF zUyOtSz9=iG%c17>?adpAU=?1!;}i|lExMt}Sm&a>^Q^%^9v(jsA;-618_ma8Bk(V0 zQz08EWD!WuuX8n1zmN_+=}dzVh>OPjBxp?JSHUb`v*>d+3?#0@6-Y7xp(}Jv7AghC zc&xB9o&qo`F^Aahqb0y>&8%0e1_^Gxwn*@gMujW)gqHZd^CXZb6ThnUghF!aEzj-Q z^70N=)vcYFaszJ21!MV$X8jB2^h5lSSSU;__v^BgEhnYYbiv|JkgT{ zXWFTwvKW)GC5tR7NUZ1i~>ORUB%9{mj*zev3|cerm|Lk4`1>&8Y;H zDZTp1TIh!B6qRglsPpvl)m9Irn-&BL{qyD)dfni93H8Vj!6rE$tm@c{^EEGq{u#50 z20QGl231i#G27R=c>;-)$dY2dn>LLqp}^#_M2FpHgcj2F9r&RocpLAtm5hz^w=PD! zAiXYYt!v!WOPJ#f)LjZ`UKU3$#L`YIM6FNfA_Ezxi&D!=sqZd9PP$gG@6+Z+jma1Z;7aE2X)~~8wE#$^?p=NTA@Dw&JZQl`= zMrp3ClAwG9keekMT^&Nm$t(MTl=K{Ry#kWB9 z=vCD9^r%MOd7hqMUDQa7xH-q5RlGJtl+W=pa{Q5px}aZW=iVt8UhB5785z%wc;xT5 zp3)@{3{5KNIQLbTp+-IpVxE3dH;Y|h0p?>RYFhF9n^V<*DQ7^C zCxTXAaRQT+RoJRNIF--@!9cq`zVWS6n?}1RR_iW z?7p=MM+PWj#0UCSQt}0`8?&&^b0JIAMq7C6W<8fhpIL-1n~o>kgsqt*=R24(oz8xG z;_hU^=-OY1%!J1gCXLQAyM3AMkRVK=Mij##5n}p0%!Cn<6v0{}RV`H{*%ujVvR(!o zlr!T->W+bx121=CsW22d+MVM1N;&z79rVmKPY`3$hitTyKK*K}p4%>?w*+tU8Q*gh zkgv8T(*EpHj{}!~m(HKN)bBKse*#Ka9*Ii;6SBeQ1NgZyUmw9MNRHxwi8ad>$mW8(&x^x{F!{JpmIshLK+(&S!ziM1 zYLf1u?luUgnm(l({Zi6Ni8iGCS)yqIxvS%g>4DL>>C@Yrjp>C8F{L=_Rc}7e6l(Ca z3}dhqLJ;}qWWvzCToFRPSmGb5Plq8Xqd36NO~U+yTD&8R#e4{8o%s9|&`t!DEa9jVepdwh6kt*D7V`k8 z`B)WHE)7T-J{6Y)Gh_`sZahkDA0|vL>i)!s80{m=Paz|+FIMK}Wle$J_bt*7j{a6L0<~n`r7t42@1Z-t1BWLqm3I4@%&$(PtZ%gNU(tji?sO+RaP&#`J~NDxVV8Z)!r^ zO-x0SYV?LKI+ZmT+E^QLUy^lt!ICapDAmY@(?Sj+m(>|4q{sk=qw7+hv$7rUzC0LV zEbO=ono)kK$cC$(RK>SXqOV9SCCk8;vB;wD8$;OZ7DRh}U4^Cgk0(1@nbT0#5eu- zHTRFn;F0$9*XJxh(3T!G_t%oa4-l$f(cJHDSpRV7@@w4yk4%E!?d`W@@b@%#z;b~B zz}y2Iv$!*KNoz!yzDJ`~0}+Ecmpji=simGucq(oh?ExrYk#ZuDk_UwnsP(VG?6f-L zB>z!$p#iG9y#acHMr~CMHFsXmU0HkdO?5{fRClK=y_=9ew_oTb^Q!{4)z!A!59n_* zM%G|XTsp9?9#nS}2@zt4?wjfcTKW`2=aB-CdyuHtp$en#W1~}dTa1&S86IZri#+uF z9}qz7hv<4k6#5!sU)WMUrfQ>Mr{!6v@e8 zo%6vWuHlFmH7ySqOmhy&^JGa9(Fd(0y4tjeS>#>B zbWIEm9L($DMe2$2f`UA#UcmkM#OBSa0KslD?i>OFK?40#)ef(`C>CWg?ILt*lqVm495D}!* z2Oj%D1Z@W)@sj%xlNSmzgrOq{ywU@1lRRa|JER%gqxoR$nMk6A!G1|TRH|2#=X5fJ zZIO;q{aT*2%7X-z!!_z%r-n;0g%1ewS8*y~LHPFuGE~A6CjNTLRHBwL5{4K|1o1O@ z@e=8A7hQLd#d-d_-d~edd_3q)Mb#(jQn(gyF0x2f`LUsff&kk4#S9bFqP#v!T-V0P z0_YVBncX}Rhz+e#-8466ak)TCRDH_;zxp^g4{3SIs-BtWD(QWOQ9e)zn}eu!2ASdB zGM}bagZ<9#au^>0#Z+1jSDdUY=0^#L`}Xsm?DvqorS$yOK;|;qt*MhYSbjW4dDDpi z9&0hUh+ECvYt5rIXVCEDjNM$J*Y%`RK89L=Mu@m;J;}9sLqWJp2 znZZ5FICfBrktP=VA%kQa%*->c=>}nDe!Gypy#S1WIRaC665x^B`4oj9myE9p%+zI+ zQc2Re-mm6{)u1wvG z_f-+_6CfxwBY}4lE;%IzE#*llAbfG@t%@~ACSNE~hg2Hr!W)}gVPBC-_^IgL{TRX!`J2Kq-mY&m z^kpAFe7fKQDlcK6g*kBjL>b1vNIJ&dUvNcrV3;1BxD7W2NIdPUl+>!Ar&|FU^uq>;V+lwT5?PFcEjbhOb(cbmc@HMpSVzF+d+k zHVRW*ELbbN5TLylsrrp0Q?kRTEeia{2{C9R;NGZ6qE9U!ytGg6@E=w8S>S@+(ZB*p zqw8DNOFHzcc=142k`O{5Or$x(2JUg7b&XD6{t0I8N@USDkQ70i8Mxrh(Hi$W8- zNm|I!gJq6%)0+B3$cb`2$~*IHSoiHky`z9BLexK0w*vgN4l7PQk&c*xhZZ7&^a2qN z;nN(>9O1Fx)&2oWM3@aw;qjC?FRPd@@uJ*AHC&RHA67_%(R;)1Mo&xTXehP5oIh75 z4=B@AlrF;;2Q`CN;BZRNq6#7C?1mQi7yC$*G?rtg15N~hti;pCo!q6K}RIG;9 zSN)vJ^nHM^C0dwD3#P-jpp(f}s8{k>G~rm9{Hu5M%~$uU=2G=#yl)Z9Ewto6qPfANx>YU*iU)uq#TbnhdBjFf?Z9$aQaU7@lw1bh#-!ZP78n3JbJQrwpaKz0n^c2REBnyj?4!DGZND=Jh@+mlW z()EQ8M{qo{s+D;PVxUY*Bb zu)TK5Tsbh`S6Z{H&OSCF-PFZ3VCvGk|jxiOlcX zz2kQIy<@TX(;)zisZVI{35n8(llCZ+&xNTutHDtMDB^}OP*!slaOyC99Sw1&BeHJZ zFS&)PjpmRPPu#`OTt;+(*K|0t$Gld9%%|9dQr1QBxR&~AgyR0T8QapI$vaQ3Z3Ks1 zpq8H}&zd-TVv1ad;B}P?GCC3%3PnD~V#rxUC<8)=KU=dk6Ur3zYQJPaT$GFb_zUKN z0A$?cgGrz&G_%)=#!^~ei%Lm5Ln+>Xr+ukHaf!6B#p{dUubS45zkgJk&7VG+zwsg--@K2c}Cc2lc z!bPz@Yt#n~9nw9uBGt1gLs$UQcGVVEM@aWlMe5%Dp!=y-<{brP+QPBIzQ| z_vWwXO5Keh>0CnG;qp5%OC?=fZ|=?xQS`%Dx%rs&(`Uqcvnq8Yb}+H&EmNwz#qsrJ zx|6;rcJIEW5{yQkS4Wmb^=W{lOVg1&^EJ&J6pH2$Onq&ZG+jL}-X3V{Zb&pXwI|Qh zXcX1)wDPzYxd&qbKk1-BXk0ZDE-cF2m%Xa}vtOw^V}pef%xC=t7CYc_lamu(*7bgDrYOx;G4Q z{Kq9!JE_9kBj*Zx<&)v7-|Q;Lar@s#rqKDUrTO=mKhX~{!59U%F5KRF0{D@ERw6T! z0l3+k9C1^sZnkP4G7H*a#0cncz%9BjA~koBN^w6&0TI?=0`D3p@-<`Nk}O@s@J~df zOr;kh3zV_46u$fV{$2Nx8AeZRHmsJ!nA?PWf#oPj{kpXax}A;t)UkqMX3A-IEha~sPrESow7pL)~6@5sC>IPrv2 zovzQm&{vFnL5`v&wfTzLo*H8-U~OkIqGScwv6emf-LmL(?+nx`kV1XbdE9+TSRplg zS0&QT-n%=r_Rsi383Lee+V2Z0UpCGRB#%337@we2*T*6A8}4^N5jb;4~7AdMW6@BqOX&yw=eAQ7Z-uF?!n+P9;WmI zFp?2&xJSsMqH2C;m%J)Bpo8goLSTteTk?c=D`4z{cDBoFc;m`hAV3F``~X7LLz}HD zq9VvN83x>vYXhBp(OfVsiNh+Lnz{%%@zo@t?mpUuQ5IhH^5LRiIW(~+%PeQ z$$k8i#FfjDjZWCR@wMxiBP=RN^Dehj5BHN#V1N?P`#KK@7NjKbhr1wcGWS}GmX6L% z(xF_`Y?7aq>4{uRCrG@au4-b6))5zZ*u!h*B-Budm)N(Hgtl%R zchVd$h3BO!3sOQg`Y2)ed%72VWeVY2T!L*7Oy*ahSTTx7B~T;4Q*eqBGu?|NL}*rN z4S|LPhKf^wvFvf~6TyI36-?FSz=YaEwcaEZk`UwN`dFN7&=njZb-C-M0?o=@!c11t zK06(=DuOZ#EOV~{)gsnj=Fuog#a&J9omf`Xr@QGyMkoYR!|XdZ$puOT*@@oejKCY3 z3Swh20jx*84thd17E*C}@~ggx`Ey^?e)L7YpZemh#;^I}i+}oJ>0kMx!JmAw{eSF> z&{D6Z^DtFl1H%jX3rV+}n@I#wI`WO0NCXLP8QEq@FXDJ+NnsD2oAQ*qF*=0XojqGbG8F*-3ugtp3XFKa+F{)*(c`el%ENe}d?HAEZtgp%DQ3GS!lAteh19k-OrsBxQ%e@#K;&)m%qPT|y zg|Uy@QzX^2>(gQVDC9iMCx?Izs>&jxwHe#@vz1h0M%OliVE5Lk@Gq%E)!o8R}|`t!%t&7gDaHeRYR1z2OEW zf`xoNVYUqQyixb_Ztd;f)e!EX^kwCkd|eeNh?5r&9SLuKJJrT6)fhvW-+i3a@v{V8 zUnp}Ao78u2?gU`luXkGUQQ`YBe&UMXSAPD5EB-e9?0Z*yj8y;GVe+3`k>v-{*rP)| zX3f7mO#UOih~*n3=`Yv)z+C&4#P^>$+anX@&(8MS4DDaIKmtg7f8lKX-<%C_&GEt6 zs$IJN%GsR$jUN7R&~GoPiMRPm(Eu4KX$fu_X5wq za<<_AgR@Ql?ra{a-<<93-*h(e+s|_G3qaKkpsP;m1{Z}?;-!&>w*8aM=GwB^B`A8Q z2Su;d$mNx=Oi!McZ1hOyaxv@*O$X0O$$wJYEIF-ouBCUzBsJB`Z0IG1b)!@7-g=Gh z-GEfZp&Vr4Tj5TZLmMR1K?Avde!$?UMy?xxg@VKif97N}$p9~Pqw|`mce4+O?~-z% z!LX)Gt+wXf;`F+lflYFrB>(lq))8q>sIT2U2i0QH_4IupCB`QC7|()V3-Qu1LT$wV)JC4`Bi)JMAc7AI!*Q57Q39s{GGF^|nNPx2R0G1kYaq5U z@4|55n19oU9H;rpb`|zFXPdfu`T;j1Hx_CI;B5XK8x#-DmipTKour>B{`51$Me0`x z9R%c6XH7tXE;66P@U4RvuN~gOa>3GHcXlN7A*T721AF3DmsnWs_Z8voXiYr7< zS7sQ5Jsc}cS8H$h-f3RzLRyKI+UruaHkZ{={Ci?NB`~cE=aJO%KtG{%qN4nPU z@8R#P`+h*d{{wgXzFhmy-1f`vwxlBYaPy>X=jBHeV8%o%g~X?-<_dZJuS3g1@j`OO zB|?aW6Esw{9&er)4j|=|Xf^~A1>tR)1bk_8eoxYIEc&zraf2xznEeG;rQ_1l0k-1Ur!|;M zt`6)AYAQ@3Wh6ufV|t&Eta*^GY}cb1QYcjJD*rsVMUhvf9}PA=TvnKeoiTjt7%$0G z01ds$tNso>mBN5=ea;}jBkk4dyIM!QaAEQoTs+!mnnI-B7D=+p74*wXPXMP#O*8P` z&%a%dT$~*^3SBs)lWj1SH|{ZlT-g&buu^I=a5`}i?;$F`EXJiNC85q)Y&+ODiB%qY zHUqfKUm=?D+&PFMyF&YB&xLjWz&U=WqU=B(x!OQ9Zx(}awn1;!6a4t~q7jT1>W!k;Ak&eb z)+DEF(MZMPKP4JeIpXjofwnbA*G@`Mh!DQ4gvvc`7(17J{ywm|c}Newi)kU;Cxh!z7e$YN1&Ue;K1 zj`z_6e7Fd&vW-L?dN(f`n$(b5g4SI+2IwWd(RUN4;T^>dMPHL1$Dm$tgyD>l7zF9Q zHbQV!E9563{H(_TpJQwjO8_VB!f!6pLa@B4dSZZ&Ut-J6e_8(o$11e!UXj%FqDl(R z*(LFCpHeYiP$~m=8ekYD62!Dx{0=Q|O%=h(+>5vnQz-{ELp7A}*di}U>2pb>56)(s z^1R0kL*FibB05$kLhFO7vN*0A6R8D#51B+Nkd}eF4S1YkIbXq?ZCyNiORQ}`sd4zB z)X34%$7gt3Z=RqO`dT@uSq&$IhA!3~l0v)bOKYB!jrAzLs6Vzt6P5&r)|6`8&X`eP z>%4KoYEI$YjvQ86Ra5O%Y38#P8OC0fnup_c({uwEDCh$Fj4D9Y6can?oN*gaHI)@f zizp>R;mmGjJy9fdN?m;iS9UvyC78I@v@k%Gwlw|Rm16cK*{M`HUQg^RFi4sw z&{jP1VO6ai2D8E`-qY4|PEhu03KsqHzHiK29}QzM3Q#PlPPWTFC|XDjJ(*Aks@ z;ENL4t0-4WY*Y{zX7zeLlr_;`$SL^WC%Q2DtbGQQH8mc~ntcv{vgTVrS+l1OP}cOc z0302ZK9n_sK4cp8Jd`yhz?XV18Z>uL%fBmYDm9PeZmt8$nskvVVHt(URpqSbW$Ug& zx8|1ScFr^yFgW$p~quV1~ooo5Ha6 zX>N=>s@Gaat8&|rnKtl%qUMZ@lW5@@=@rJ@>F2=M%B{5uKzP%%dI)cEFb;Ug*Yg2c zsA0Anuw#X=8tq%3H1fpxAKeWM2wo1#FR$>80>IsJzq#AM=2x1~5qjqrUiHtW){gE! z99t2P&jBRWz|P**P}c$q@F##DK(YLQHT)Ou_UG)z`M=0+tUmzQ9$o5}vK#9UG{j$D z$MX0tes{(Hxx2AGlA(Toy5HQ588A@ySF4ic3evLg_z_yKUJh6B+NVX{?M;KgX29%@ zI1y0!3HK0yd$vJqnsivezGqo_?YP|Hd}f46!3TpR7Y=;lLj#ww4CP}OwuqL7;NUZb zDHW;teA7}kONOC{SHV(C$A*L(gtG56_mp#5Y!m_9(BbMmbdjj*=RlX%HP;)pG$Kc_ zO_ew5Wh#K`4Ho`YW?}(7|0lo~;!8m)I3=yiG_om>g+mf#fh@ z@WMET_xi?3v!ed&(Cp6R&DT|CYJKDs`G&wZpH(c)yzhB#t%&)yS^o3^VEuuZ_tOu+ zw|_XmUhbdUJJv@&-+yO&M=xM$X=QImpiaQb@NH;?=69Ekzy00s|7*UzzQ+Yn^nzBl z28Ook50`@(H0j0YW$1;}=~xLKe``LxT77#0bw(z3I%Yu6JtH#*9VeirpNW~3j)k3* zfRUAjj**ic@O>{F^z5Cj4GHL_Of6qQ(F+jp@DR|yAfOkuQnVtV7bc*P(S2=dtZQ#- zWy#J+NdRcTn0?$vCTG=Cq(MO%f!rN=7SUg@jzkpZIlZ#4WN8s z(wd4`>z^FSj71cK5F@NNKSwKkW9;)*Z_e7;n}_4v4d@k_IE-P`ZxA%$eM{pbuZ+bm z;L|$4%r)c!jsgdgf~Yrb0E&ig=#9|O#~IZ66z#2dgIU&$1z=5Bsu4%7f{j6Xa@aeL z?*~EANbz09cz(zeat@7P9o?|8HyaLW_DB}ho5wSf6nx_v&kdLK$FkfAS z!F;1=sAWxWFMQdTRHM}iPd4tmX`_!+T1QJ8_B=deDxILB4s8fMDjlnVFBK4C)Mbob zzl4fSVdkcVI`9QRfx;d0{O}k(_HvjB^V;mec!PQ`)h3K4^vbcV&^FA zbd#__RBLzG{TK=u^I1DHZ-ybgSy2{!!q|*(Is3sw)XY(@AW3V>V$fMKtuNMnq6)j7 zx{O0(Js;e;$w0ekm3J1{AvkxyRy1^9$rq`Awq=USFu{gC1iLRK7<~V^7aLnK_BjsdS@J|VsIyXoR$G!KVK@1g2?W@_a`Kmfwoz0N7hM)L zL_zVW$i|KYF=#sJZ1wTVv}7GQ-Yg}RY&2*>onFChl8~UlDL_U34SsUvNNi~)I%M5) z&>|6O1o>HPzFZW!3V!1Py>HM~6K9U0(`2vP76n$U%oHN&>BfNH?{+#wMzp`Z7zkZw zyJPb0ReUuZx-GWo2;3h0NBs- zuTSKp>Tdt6+J8+t`}R@$gKGb_llf2XFa4?H%=&%x`$5LOhmQTlK`iSZNoPMS{x^E` zN7C7^uKS;p&RBm+Is;rB`*nqret>zjo>9B`32AtGrcu@HDVI+{3+`p_5rWeHrf|0r z!Lj`728o(*(`LxJkt=5{?0A7hPd)!6abv$rT+@TZt$^6{RIXL~10-(Fhc%WYfJx_* zkaQVl7r}dX#~OBi*==j^Hko5)w|6LgwGrJYANK+ckZ|jZp4EmGys4c25&})_`>rbq z>!X*$DRh9SW1qVXG}XkTOdLz{ zl^Gr3@f%Z(s+5WvRFXVp9AJ3=w4CkP_Dbf28PKa?9`2bVcjq#shE;=ml)vi^N4%wfClh+Jl+>POcl@=9tEAfFXo6@V^RyNU z!!$_-Uj5~T-774%4HfZAwUwNzWvK{OWJk7GuLSc6sUlgZaI?W-xJ^}NS2spxp&;@v zGez*CH9Kqm@T=O^M~MqYBGwGlWTV#|oU~aZ^D0#7>QemN;O~px%~z_x_!~)|OUqDT zjKlELE>Z|O$jn*a2qYs2(VE+Cs!)QuGJkw(I2D4xrPFf$)TNZQ#s4f0e+U;RK$>>% zWMIn~fs6O;(Ag%wrTb~YTWQbKPW=*ABjIKBcW@4hf)+X_c|Kj`;nZ`)VU!qxJX=Bu z&22`hwgOvU9HSF=jVNB4P~iEgU{wq*xInNBe%=||cZE>0_NC-}FGQh{6EjhaXA5+y z0l#}D;v$B;4w-1_X)XFvQQFvwF6e@C#ZY7q+F@L4K1*PuDDhr%$8wm)R2Tj|+Ud6X z>a&Pe;O<5~(Vka)r~|3bG`<3zZKF{IleYvv{d|CxTLZ?Iu z7bIlTx+G?*P*?2bIri2jhRvp0y~q zS!i@v*<9r2CQw;YLD^_*oVN3EKCPJc-b`j95V#ClE9MaUT zk#5Ygy|3vXvS*H?KF5R?G(X>Sa%evZ2Td{i@?!T08(PVF0iaVV6dG>OK zqHn=x<$CG=tWiHu0e`Mhj~}!jw_)E{WB<{~|4%gPk4Q7tZxFV>IvZhqgsOcXC4Y6@ z-<`_!-SwJZ3yVMHq5)>C{HjJRDN9HGD~+nZcukxyK3(wio_C{He7<|YGSMGc%_3)h zS=&On9LD^pjF$Ke^PvNUQfAMn8 z%%jIYUSLgE3f7*r8fVP)U1N}bCHtsVOguD=4!FE3vJ6Ur&&5YZn6$4B=@M6Vn3Os` z<*+V%#!DY0piDoL9x2zbJ7zJX8kbE2Gd)7HlT5soQ?1S_B2DYOSdB7p_pjP`l!Mi+ znZ7oT4V6ihmeDNJwN>zq@s)vr_W1P(hwL0N6tmV$7VzW6>Ghhn5Rpy=oxCU?^NYH% zVN6N`kGZexo0-$%UXoHPbJ*BnK4Y}z02yZp4reMqUL??YuXTy=E~z(erpa>;nhInl zN)(()t-@i`3qGuVj_MO6sbX~uZ3?*tZ`110Zl%}6IbUG(X|_k9$erb|_BiKfPfc7U z)pkeI=tEg&HPA2?slveW(wj!WaDAIH64zp@2AAO~qxE=RG6KfbbBw_R!LKQ&Z-JdB zHt@8EHxSk#+gS=af)7<)b>Zi*q*@&p${>1;db&^WF-kz~wXr4hnFAm{o)TawsbHgp zW{-CTw+;N37DJyGjY49lJf%R^EAp3)NMp;_u>#Y~3R6QA1P@Ep;vcFD08Ae{b#L@# zt}Yhg?Bp!8`eLYP$`5PFNdwdQ@m>ZY6I#LLLVvs zLDo5O>rKUn0u4FNukxFQO_+nIH(}s}Y%UI8Mm&I9+3rCvPCbNBHGCvw&at7cD)a11 zRy4eLrmb$=qCF=4oPLjscAPAZ!#8n9)kGH}ye1+R<5>e!lAh&u>_%m^mEdRe;dhz( zV+>t^*Ei`;M+rn#$c6hORbhO+sH+i9pjR z0P~`_jt_r2&MT?ONXo8&h;*5BH-Y^MZ5@+}l?Pu2gR;nl`NG^GE z8dnC6;cP9!DYTsZ1DHA40K@|m} zt}kE$6S6Yk0t$qWN&}1}fT%G*jPdd7bYHW>HWtixrlE{?UP%kfRkm*Ot3&27%@bn5D`118&3 ztLd7`sP{H*M|PIz9iJVdnTj?Fs2tB$=yON0?yG~Bk^&BFiBw@@p9hWS2}p!5Tn>7% zECS;kD|oXQEcYkw3JdgdH34p3`$J$Jd!!++;ZTYV4T!VQf)DxQ9TW;YXCkK{(9M7A zWarZk>R4e>4coKJ-tPS2IAIn$Mp^0gqHC$Bdcv6(Wwe+AF4Q#=RWy#vl^X1A zIGN1pa)QX~^Ifj>J-kCDwl+JHg{pJ=s0#iVh|h~?*GWC@Pz{Xr5`-Z=dwF8*Xs(&bAMW=9LRh%Bi3h=FA!s{>o6ZL4 ztK&7=s+TJRzYnpo! zr;Xu^M~BAZjH^-)H3_0VK66r=&;@6!)Rwb1JnYLdd1?~E=7sirqmAqVlAra4iYn1U zNdC?9IpU&ikJ3>*JuIyg-srgLx}?tx-BJ-wz}J#ia7rm|^tJ-8^AaPCdv#@+wD5(g zd1m_xq-pQ`;`FNsBGXwN{WFk9hsFVYIg9on_N=k5NqViODn1D)W~tdeQ`Arj;jW{3 z#97^Vb414r2r9*9agIJSc1&<{AZ^CQh6|7n9)X3`d($+5N6`>SsHfzf7@U3C{%|po zZm3FE6wP7VzHj~%rK)FPqs7MMKBk_eVr#&9KCGmKwilCtd5ij^x*#f1`)teyTThZ^ zP5I{I=ij-5b1OL(J-+-@&8n7yV|;%??aR_+>ZWOfqO-*y%4#|uA?~xOHf4e&_s@=r zFt!aQTtzO+dn&3;L-g6_GA!4Fji6uP+-A10e@^$m_QWy$?1^Lg2Rw1VNcSH-aZJDG zdt>_16ZhNe{_FeCJG<1ko$h9Z!eEPy*7OLtnQ8`HjL8hsyPw z-Jx_UA>wF=V`4wT&-$;sTkLHGix$T z5Hx*s>4d$#jYCZx%Ir|Ziu>52tC#p-dbEd$j*vC(l<^YkQ?5}JPaW*p#8r%_PnV`Y zj2Est1bX*=SfB5X=kwSuvJzHHHV0Hh zG_iLg2<`0VuE3IDxh^L;NN`~LP$|e-0v^|1rLGf(DmA(rS=X5PoW5WGB5agcQ8uU- zI63G(I%bL`abwV%y;j{ovSmp?@dGy$)(6Wo!$5lv&^m~N)jRKE8UPOn#qqR z?SUw4fKx&QOf5SmT?AedLV{tnWi0bglYsdd2{lbgnbTOuv3@31y^f3}vox#mv+u{- zq0X3SPlh|UcxXP!D1>-A!ZLaeq`RcaCXnuz4yM0KcS|7Mh2YI`#Z|kUR4|mbmw|LA z+>XYXds;T5=;$~^8AbxeX(zz>{)}pYx$Y+0on8ddL%vOS zxN{l#Mj+jhZ_^#ksj$!ZMwd?@Vf5VZpqYsmj<)pLx(qI=As$r=#GuGaI%t0nEOMBr z3Bh=^wV;?T^J%S#_CwVNg6*Q(o|hP~A+NB`4!}S@V_9W(2)6W$q-LfuS0Tk*Wro9EToL!N0^#mvPb5B+#v6o0 z%=s9q<6v65Q^TBFHW&iE2`7QjHi+I4c zkdn$h8wa<8iPr93nNbde)J9HaE*05)N~nqw8;ud)UXfgUoZcv~Y@Yr4P7u8(*lbj9$aI{|f&0o@=3{m* zBVz?VSLa6C8FLm{Ol$Arsum7tdD=hR8@LLAf=AW`@?8c~qFM$&*PY8#3Fjab6T*6WB9G0#GJ|ALPJAWn1&QfOOaZj+9X*k z=Lx6J$YI4YT$Z(5Pp?tUNnfuTxtjB~74J$(AY(L?O1`#p?b&!f(w0M`w6E~Fxi_s= zrZO~KsQ5AzFomXM@G@PmSZu}EWTX%@svXc9rIS*^?G9ei*o9uU2V^wx$6Xetwn*?q zZ@zElhvkVv?)C7I=&pVzLrmn@uKx55QcNSF4!IB!RSm%tIDF8+a>!h9GIT#Afs?}| zzukwRl$O>n)xvu$kr6YagrV{fy0r44ocG3{rcl40nK{XB}QV`TQIMo^A856*wH$k#{(AeLbP^bthDtAe4C$Ani9= z@88ck#I2$2*q}FE=D}dEpjr6Ao82N@Y7^c-%Te zQb-S|))Tnhxr4lO!Ga~!(eyC}Ny3=dAp$n2LJq!M>O_h~N}MY4P&_m(c|KMDfgE$W zwj1gLMGR&ly@{p-3l!V4a`$Bjy6XG3Pw6SgmDo`gO+G?>iITg5Rb%-;hfg%RE&ZA$ zOuPhao?y<-ysw2#c?#s=QQq zE&iEKSLb74Qin;;v7jY(+z9bxB~)hT78zn!>&M2bo0p)AoJ!%{n8IGo31S(6u{sHm z3|*N|Fxa$|m`}<@Z5xhIUdvuCwzjU?mG+srT;b^|x3!l0i4%TMX7_pF)?KkBl!|cz zFRJVsePyZ0d{U|jbu!6Yyqg=FM%uU`km_7L!Pb_alf$1{lw#vB&S>z#by$Oy_5KUOj-A4ap3epLB=xA=d#LGYu>@3+_ey|Ux?I^Dmt_t62b z7JeT^p@5myXZMhDD2ZE??YhY=G=57bI+|HI_#$Qo9Mq0Q2}ikUi{$1toG~Yk@vDdh z3<39M>i1i#<-G!^(5+mHLojq)=K8|OY3`9pW<^$BDRX9i72^hx$<43II6QPOgYYq= z(C9d;@-nTkl8%$dKkFhp>=-WNCn6f-osM6E7bvV2@zf#Puf7%n_wg&?hiG{Rmoxn? zWT0-nne`aNKTNHim*?}^b2M@xg(ryrMiHWxF6V(3gkT<<4>-T`GdMtubV>Lg(Dxzw z07Ltb5&$*pW+n-3@JV#-RsR%XQ~X(S;Z?IgQfC9-QvueaWS5JHt0%cM7LiGuy6vCF zJ!2o*<(TejhrT@J3bj;7SprbB{1rtzcPLuCMN#S%AL)3{$~_511Ne! zyM^ww;6|)?%^8-3Cs4HJSVm>ZtC;sh(S+B)59Wmq*TAi}T1y~AB9Bs9iF(mJ3e4ZF z9Q0}4s2k$!q}yerY>Cdh5$RXuH7r>*siX;pf$8A{7L=iyED{OElM1OiDUWq2zM)9} ze?n0Mr8MMfpbwg>LHNo6&QYUDMii#W@GNhC{lNpesyR7Hbw{sS$&H119w8-WOj>vO zuvefd7e$^K>tB4RgNkd!aO~7tO+Sc1=w!RK5aPkQs(|`y3iBI*p)_l)7TjaCI7o6k zw1)z9ie#Rj$&gUDP*<@NP-k{rje>UZ6}L1vR87kD36#Hof*@=-`+y$_4fddv9@|8P zErgedS^fzO5{9*S`2+qSf!z1O5-D;f7=xJ!%JXTz)YKi>xrK{*<|SvrwCmO;CBnaZ{96_yWU?j7ABsN2?^WOHq626 z4CjGVbyng}n{5k_hKkGMMYs3R@yxU5=osYz0GICwA8h>&MM^eK)We;sW0f1Ue!16C z(Ey4rOP3Rh#Y{9syxuU+VQsCAK*hkcbw3+l?#k2D+ZWR;_ouMDNXTyFN`Bcd`AEB- zfJjMyhg^~Oz;xMd+0n=wc0y1th$}V5(|oCniuR=zfTASYuP921{1=MeeTO2ldp2q^ z>-W}402IkAK#Xc&{DGqQC;&y|UNqns#)0-n20VBk1;|Q#b$Brd`&4nD#Q@Z1I=e+$ z*ELT^MO|!QNOd7cYp2{LeVv^>bRv2Q%3dXXo(MDE=u0SCuu4VQpG+>=w{s_auoHH zrcVf3$(nRjPBJ9noSM?Uj1V1+eIK&E&sWWDT&WWUbNf zF|okTT-;K@z=+ZoS(^8FgWm!Mc4LmZ+Ubo)1#VT-Ml53~=~bxl*(lff72^GxhMzUx zOm~L6Z(WvOpHSSz7pRe=&SmgYkevj!#{odCv>W_QC{~LtcIlE|Ite z&z!N1Of{vqRpgc)w%@E9{mi#nY0h6<9V2|TKz_FPys6{X1#4b^fq>hF>u$GW$EfK? z_MHDgQjK{}^2S$%0ogy&9)kC zR_?Z(QosvQqmjm`>+DP`rWpimya5;N<45j;`Wn?!b9GlBN&a)^lY~h~7F%plGG5-h zTakl1G)gZ131>&-l-D8b_D`+tHcmJX$ZT(p$?S%$WZ!mhv4_l*n2rozeR{6`N_<2| zcj2o1W_#szW1PiEER5C7a%z!`)N+mCUK%hT%TJe=FX!|02zfYC{Yx4=DVX6o=#r=m zBvQ4|81E3b?n#eP(x`jm>93(jfg^1zEz#L(^sCEkTP&@yiXFgjL}A?;*`!6gCZ%Kw$&W#08+q zI@6l#N+gc6czaM{1}HNPflUa(y4VOJ4#-LfZ&wa@>pL_7^FxiFu_4 zvl|4IT|RB%wg$Cz&!RJ&S(LPu_YYpm6eIMlcW45INm0@R(ofCQLa!j%0`VT z!x7u9oibKw80z=_^`ZFXJM3eX0j4F!V)sWx9uY3uMF52qiIE>~YQ{b+^+;}Ka33Xo zf3p5O`TE*AfRQUYv-^VPC7v)#wlspf*9Y(D#cYWR;cT*Pn08!QH}p zv%HF%{={}tN3RIm1W|LMLE9G+%{vH@I(NhYFX=e=TWx|1)FxY};}`cnc^URj&7Nn3dK@L&n}RCdOpbYd%8?h_F$uVHqf0=i%UU<`BIr81{EH@P08O;YQm41gW?zF0wCy@?6DEI06G|KxFSXwn|^s#O{ z_o}`*AlgEctuDZUj{;6ZipBKxqmmMF9-*WwY!A0K0`U?EQ(N6@p6F= znO{qjfJEa-dBS1#&|Z?{&`ilDtQx-7V4_e7lQ13?F!GlO2PJy)U8VMm5wOJ7P&G@Atga zJ$+ErFH^!a2K2iqm%3J8qHhAJUE}r+~YP* zYI!6m20_`eQ@C_J%T{7C z?k$4d?CmC}q!-@OmFdt`SAjq`uhwj?@B_M2ZD7_2-8hT7mBxO0&G3HZ0=V0p0iie& z(6wB9BMP{$ROQV<&Dr+4!)imr><`MI^RYV}m`Spqm6F==5UqBLD~LC;GdGx>-FC`8 z4BU0fY%>B^%Mu|O^mCqI^lCc@ZX>cytWR%Vs6UCZvm>1AtGK_pnnO0+!>JxHZXNz9 zfIbLJtU{OTqO3^I{Pl^#1Whe4wjS=4X5kaG%j+`+RS;^&M&(M?#gAPY zj1$V%%qCI8c~9;7EbOF4-))ESA{5V*rNIQBmbn@+TyRa9mMN$(t=~BKx}ItH-+-uX z4>bP*Cx3ot_dnp|HXwh%$=y4~e;g-2o}~Pqm5%90n;p|{uKSxdyWhjfFP(LCz+8{t z>~wAaU7W}ypoLboC?WM^a&%t z#gzhQ2NJWMJ3>-nGpOp=`gA>VDw5NdSzP%DbI)Hm?UHS!imh=Y$WA!TXPkOo%By2@ z%C&s*y7H<4UKjoSjS%7WryJWZ(8OJ1Q$MrhyJL=Dv*c&z9MeDGocl$i>qqAt)7^*r z>xLEcpBq-UrOEHE`)`yccebc+b#x)J3Db z24<>)UVA&gmp@vp5H8m156&K%lE4Fjb^h%Z9g-{~`W8`}?rPcx2+`Ca#F2`8E;eY@ zg7-E`wDiTXWa6a3_qD|MVe;ObL4|iOGQ{XzKQKZL;hklTl8Q;&8pZKts5Ve>4dHyG z?o3;sELm^g*d3X%&Ns!V9w44P)xHU)BRI82tqfL7>!RJ_xrU}COy!-c8M5b~6X_*% zt?HF8vb3iXZ~2_2Ldu;WTK#HDukF&vhdC5OJr(h|Luoynf|cGx;FQ4&>Cm2OJW0=A z&RY9SwiTi29Nzi;Qy-4LX4gjt7+;FHpuY@cTCk$g%j!owu25Yn+YqfXG<+7{*ZW{E zQrI#U-$kU(?$u{b&j?@0ibPqXqBK;8bS*!THd8TIq~vr$ioSF9tHUnR_0TWXYbuc) z3#S*X*@`;>&nlJ3He1s`E;LE}6l~6my6yc_;UdHGO1jCU4{O;)UMTN=l9S(Bs-sIv zA6z(It(#2Fd87~R0q0v7uCLB8+-z-TbTD^=e+_!G#=-TA4EgK*=+6!{rhmYp_Nxr} zaXAjYjv-hS-Y->T9qHmMW9HV2S+<^G=y{6fInC;dp0BD2ip^?( zzzR!;Zj46YnRZ1X(?hHF3@2`$ti)Npv@kk?7rQ^^G`D@qX+Ayx!zh|K_z|+7h>t&t ze);*%jP5dB!B}nQ)*jkrk&=`9`FWULcN+Z?{S?Woqn#Qfbvx z6V0>06-bYS+xOc3v)=8(qMu%RMQ^lK(-R>iQ@in#7W-UpD1OEvU+eYZ+iZzziNZl4 z>I3y-`i?KlVS)3cz1iObIAC@&kobAHpfP8;3BYxX?qup0LC8-au z<5dw2vyCZBA)Fg_^ar&v2urPt4tT^jGVq>7XaycmeP|dGb?ngw+ly=rz+RKfm`(&f zdDnECA-zC`Xp1EZ0fHi5$A!G3sM`z?I;FhLkXP`^e6-9gq_;UD{?;eZ{SaIH?FyD? z;_zqeuIC9sOHUcsRTJF!T=|wr9bVS5O5_%l0s@*yk!mP6LjH)_t*-=H;U&O~ zi-t3mJrR?`LVbuxk!$HL!Pn3((^`@SOI_n9NG>z%sZa8sqwX2G;FR742}RWLz9Puw z{B4jpD$^1zN1FxM1_ymJ~N5Q zUk-1A8jD{FDE%BEclNAr)co}}FOs zKUrUG6B&*v14Aeeo;jS^y|%Me+j4Wz@`d^QVkeA~C(itF-L4x09c2!_szX(D;MC&q znM9D@K0aP3DhYc9cXkgpjpi|N*^3libs-b~i8eR+nf?vRAr&KgPiOJg=XKAke2b3x z$1_V21>+(ml5B=`jn?tbUCbU~F1EZQ;8h$7Shlp9QL!!1?F?cbbdpoy2zdKqXj1-D zD;8a9Y)&|=nbS=WRBBwfqu+;*r+h=}E}z?wyH=-RI|8jVsv$nuDCAVuo;{|mB3vI2 zQUr?|)SO#(tJR|8J{`I*v~VqMu3m-(eh{w#b|2c-;&fh`L)3w;*OENcreb%|l)k66 zmgdW12$2Vf?wE(g{*Dhie_Sdv6DGm5pO4 zuM|Y!TIMYts>ZGRzFRjXHKBNcJ=mb!XjvSPHvfsPSw=eY&7^mhafMaqM(BN`!q=$@ zQqo~dN|_tRaTl+3Z!(ueyfdqb0^~Hb$$tjEFta@iO+fG`gi^i9t2z!y8;VqlE zVclJ_00RikqDL(~s!Jjd&qpL+Dj|`=9*~@kIa=b$_JZUsQ(>Pwev##A%+*J@hY&>% zd!#$GFhiE|mc?f*hjVNgGey3FH6L?5Zw+76x{MctQm6E=?vVv<0?n0mB!amsK6SwI zfXLAF+)0n8iR;1M9Lot;#Pa0UFQVkHcO!Sd9N%}x{sGk$(;rHaKONlzQ?h=Dgxe4I z*A>l=sw<}7Q)Dsy52`Dm9-{wxH{o_t7>$&rnYN5BFo)~`jTFD&0~%Rfd+P_^P4fCq zMe^_SmEUfN2qLMC!|saq1Jw7YWmf=>L{KNDmnu4LL!eeIHbaE$;l>oi(s6o`fK=*%mrx zg&{;yFkEN7eOW|kDzNl5%4MAxaj05<9_)G3Y@P1}o9bXgE7(3%6Wb|lKNj&AAZyhl zBp1&Zrp7_!aMIx56D>+qB#R7p5;nk}31au1bMkqLs2zr@ZFf7+Jj@+)%xeK2Swd(5 z8Q!|FrJ-kUe?q1Si+p+SOIJ;ZC|IFZjI$D#^J|DC*j?xR%5Z-26=ZSp77wA#{@s1E z%R04Y9PHTOt4p=Yi!zVTOP?aoPkl!TH#G=eD@z*sTY8)KaHXieT#!C=ZlXl;AbaR8 z?JW|W-5}!awN`zm$%}F?5&RXS07}n0=-_T)Zfu;cB-ku4vv!r|$-1>4Wzf_MEcG{;+4-x*z&jTnqJaR^`%IY(JNq zPV(c1-MDa!EC;li%*K?Ln$0H26M}Q2w1-8&fjcZSf{?r*H;z|&z!C55hSzxrGLaYu z$P2TD3Od)M8j|E8I;->RSsv4krq<{qq|~eB2D-=*Zp^5_ND?8hJYRasim*VAmTpKe zXz+@MU1;Cg{uwIjUNJk9X-?`958~RjOvPoOFnEB2cF%CUbQ>?0hbAf&Mu)jMP79JF zXv}~%Yd@9W0$B^h?w(l;6-p^^CbofZQpjO!8U+|T_`IIj%L$*O7Sw~ zO=T4J!hg1soQIQoo(8)Zf_xue8%2cI#R^T^n2^@NWvAJpsl;1EhumYyIfOqZ4Zc?i z1^V%B1Z%+R!w>P+_v*K$nB5Q!jkC@ohfOQ-;e9ha2Mo(`H_;jhzg!$yPaWWGI5Wr> z*%tP1s@vd^W-xPYYi>fGWt%6ETlTAbM2-(yhqvqtd*iGXQq0YsIP+E!jLkY`skyrr zFLd#o)s_^$(PNVY_OuZ>BZR5RkZ83|?SYi^ z@`n=43tW7LdhGdd3@U|hI(cElpQ(RZagwSs98c@b?t?)``B+;DtE$AEvO|Q7#t(z@ zsAt;tqdOmZR#O^d+%r_j$;VNttyG?uF+os|dG04Kv(7U4n%7H391n=qJs#(jAZHU{ zR}fJlI6m$$u^Ekn3TW%kuTT~&aGZpId0LZSRloJgzpX|TMan9P2L5E85u&2&%~S%k zQ-TuG)(dvT@qzR}JC#`$HJ%rQp|3VnqXkTB#-0x*c^H9i=HvHLZRl&LsPi% z0sMs1jXV$`L#5>9H}6IJyQoxS$t721ZO!*nxXug)jrdID{0`?jC1S#z6D z)lJ5w)J>i@f+%LOUXKulnCg}m4*K?w2d*|H)x(TL3mL14&{t`g?=L_ZxL+t|^S3&j z&aKbiTp!{uv+N>HB`Y6TM5v@A2`~^Yot`uKbLTAI(loUp-cTc~*Zn4(;1+ z`nDnVyX*dPpdv8ThZPuG`E?{F-~eZNz`%6NH~?vafBT{OFO5)t5$-+nK{SheYiGU zklpFWjM{#Rw>QFEG8uzIru5m5)?AL^$(svarilse5M|j|GaX>P-o;*F58^Qmnt`BP z^5cV2S48z;0PM8DOU9wAdzTcgokEhJ+L=+Uha8*FC}8V+ln!)VPR|JdA=F{{>ktxA zx=?*lWDIs?vui)stpi&~BOO)dlU=)+jiq}Lp&B8;$TE4?0@vD0U5Yf7aIeARHS zCos%fc(17?72x!wk91rpQ4io9f(!^yG>B#;O)pD0zVF1Q@f2mYd3y?tQo z-Bb{tSyQ09X4@dXM6hsJatK}?tXC1U4w!7$Kl6Wg{ZYVZZ);mwZR@?GhM5MR{XKtL z4V=Md0~pCPB)LO-2?n^urva<2!|`!$r_03_Y*%kj9l1~EN@kJ;aHRThWl{#Bh%s7_ zAQCl;X?*}j`V7GpSrfDZbb<%ygmp_NNx}kK_58ixnAb znJNX$N2M;s=#sTs#!NMLCr*bfo>$qBCYy8F&Epb4g;(6W>K3V)dgL?t;au<0bg)g! z9O7#i`>GwU6PpHXIF;Jr6&o5H<*nyx zN0BcoWHc{vz!voz)F5ww7!huf%MH~$pYz= zGT_8ykVgT+V`^oz<7jtu>_)elqJ2N-y3Lw0QO#x2tV5kWXKgDht$_XIrf5X7npa>b zvrOeUwM_a#-Q}+9o^NCD1)(^IgYYjv^XCfve*n#0w0<|^_)cvEu;)LRmidc1(!>3AI{w_+S(Vg#J?Z7TK&DtQAvSg;X_&{zTxY@0v zCeZO4lMqV{s7ogZcA78}I3962`b23eluMC5v_*}(+acDBCL5QvYMeb^So^h};V5*&$MVp1t{ZGKrvXUwp|%?C8)>pm)dPs2qv0~1 zkszeq(?J>Ewt6d}fWdDgJLvl!jt-Jb0i)mf@H8OXLLJ>vTS$E)Tf7YPd@j~Stw4Bs z#YCz0Y^B`bmCpyb(#^sJ1W*dC=&``7*7*qH@BBk&Wya8=sF}`UXsk+>xdMAWglh6G{!N%ZMhj?OK>!g`wrjC8-~q zAggtd2npQ}hu^P%x}Fi@Jk?nnbC^UVBhIvQ&flniEi6Q}oqRh;f#4`~LG zNEjdH(*nD0qPjG)?hBplS#V<}y^7@Al=qoW5HBnvD{BnJ5Cs=kCR3g~#5A!0^TM01 zaN*qD_J7Xy2zCf>70#1`1i}3Yz5e)0b4mdf%*opnXk*L|qqQ-oa@sFOd_Ciz$?1kC zcAQS1VAR&Vx85uA{DPgRvKe|%hkIoaZuJS*s8500wmk3LvPe1WRUM{!D^S(s*$MB* z9EJoq1bq^)cDd>9UKOd$Uu7n?mYQ!dQ8y7Q)G)cypvsfRb6t~Eu+uBemAvd{4P0$Y zc4>Y~84AvpOmAf(0I4>}v~_c*k+S9HGBNiCB+T6X<zi+)WdO)M`o3N?BgAH2UZSM^9``+0PRn6re zuyG6o${Nmkp#dO9M7$P!`DKYa4*h_KF8vvnuD%%vM_-(URQWe}r6v2YYTbnov4yB| zgiE%f4&G#}%9Ny`UY7JxNXk5^L+x>|Um|cS6s~9W#T~%~-5t(h)bkq`=6{pqqQe+? zKT&`3Xf4?>BuW#rT#EYPX&3+-eFykKCwHKEM$6n$;1O-nrUjv{DC1)VjNgg^9`N7X zV~gHj$`HD1o;eRXaYRF8YpI`?)m+*mvZBteDsu>-=*9^#X28G^-hH+RxNAMPS{@8)XkyjJcnisfHm!B)OW0Lfb*mJNOSxsaX1a}jx{WTHexuu z=v^d5ld)3Cp;UewnJI{JK+In&sxSr~Yrys|rc)nJR@5vgdQs@xyRwC*>r4z2>Wm?pSk^ z);lo&w9TewdaS=-qVA40uZ`F{Gl|%}d1aq0Jtb5^8WiCmOrdT=t1G;pud)tZKm4%9 zRbl2t=cC)p4>%4rQUQuEe6+?M?ZI?-kv_Cur69dAbV|Eg+M5-VVy9aVUJ8z&`y%9Zxxtee zTLvT@+9Gs*+Hfc0IS)Q|gIqjcRPIEH%M5hHimZF*E5eaVpekJGTR_?4wRk3ZI0Vh7 zQLw0OgkfYl3XZnh25xjvhApPD$Rk!r~Id$;Z^lzdc9o}#jKFLC#Dme zsbeR7S;-L)`XPt7o*bkAY%E!eo_KNqKh-S}4#aWl^g=uG-9S%)iLKM@O+^J=t@{l* z+Gf>HHk6@R*t$|nvx;BS4Ay=mG%MLv-|Pkpct7Px4-GAE*c`E7E8$S_xl22s65c_& zZ>f_yz41O?^81uBm2gv+mgakX)s!3M)nFsIH>U_9K1+zL*_*S*mHif#DX;d8+X7ER zvQMx|BWXN0;W2M=s2eh7TOzR=6k2Z1RSH}|qxJore}S66u50ch^7{tbKOisq88ys5 z%8Qup%u0WG{=)pDyy!RAG5vjc(SK6cF#k$k^c1iV{4Q$xW5uohxNC;D-~67FCn04r zdp$EU-d1{UlECi?n>9=(#N+4 z3N`1b_CamigfyEOG-yF8j`8DW1$^rK$D}x%HTS7Gcqnw8ilvBei<)PXPL>=EJFu3Z zFKJmiLLzQC1I44X3jY`=YG6X=c`n7br7xy7xxs+;+3+FLl5!M8jFwNGMpAt>NHVOM z%agHiez036vX%voo}N)OzSD!~RO0YF?-*pjqFJi@k`*hi9$lImIH*U63GD!2Ml9fy zq_Jt1^e~m?1yItg2`BL8pb(F|lS**BUzil;mAUc;6H-*v)`Jc^E6hWXT94NtfVI+5 z?LPVfURIc1edGuB(irG{kT6~fEz&n`@M8R{{SaT26&Q#YJDsx#sgnAb?P{v?`%?^%y}p3MIls1nMA#om>`PZ_sqP>i7f|~w$p@zzB4_^Q?@6HQb=@tq)jMUVe^*vwn8Ffo9-_`HaSKv41hN| z_*RacbULb3IMGsq7%se7pPTw(At;c9USqt)Ald(s98R#(l&GG0TM{WZ3rDng2!c$sBvCMEkoE4j!XVfNQI^d7^j`ij86qfH_u)a%l=H8)+@N?3L?|e!>~rtghb9mB;SV8>)D2FjYUj zk4DW6F)OIp(u!>wFyyQlK)N9#dhWl8nv`a1sl6-`_X(FyDdia^mDJS8G3Ri^-9youJNH zich)j(+VS#5ngyAyl;>>+aAb&`qJC20*Z8`+O(u@kC&^uXLRlS?7+c&)~BgTbSKQ*Snd%RBW%KJSP3`9+pwx-)z2tWZgSmj&O>`O zs{P|2E=yf+@->vFu~pzRO4*} zl~3#PQOybF`qslg28yPByhY47Nk^ee5oFBp z8)8(R!CP3n_lgrASudP5l0=hXT-`mZx&!$+d4$*zH7>r|$-oz2I`2dvaOz<-7=?(Z zdP;i<_Nml~mAj5-Z@`6D#>cN5n5r`2`G(lAAbo$x!F-ck8hgs$TN=CCGivO^K-c+E zgI*V;U-KlEQ#df6={_Y)PXcWcamzXxyNCNu;zT}t?5aCNhcJ20s@2Y>6w0_y_43uh zT0iWXnEk4e1GWeWZRp!KeytAG*958PnEf8}tY#QRvu75dr@d8gU$4uljEpX>9vpt? zTvjIlT2YaU=Wx&SWDQdwsZxRGiOIq;ak9K#r06~LgA4I+5n&^EN9o)m-RiWY8Sv6W zUCUx*{Yb0wg~P?fNg415#^&_#dSjL}1R&DFS$z;_VeaqNfHMz`L`NQeXN|n$WbeqS z;b7Ck&GIWXjY%um3X2Bn_qq7P^f2ep7-wf&@Dgn@W=3`zx`U3OE3T%!HTuVsTh4GE zO4BAXg-0_pil}pMV2==HbJV_ss_s_Ff{jUHPUE-{T){=nBBzkx0Gs!`Q~G8W?G%n;u?{#7?qnB(`+#?3IJ|-h z7qBF~%hwChGSmyEg3J9P1WmW-9hxq^Viv>&{eU_@skeKOhm6R4H8&JJ1q!zyPF4~^ zIJ_2di~dJ6Q(pvlQ_>06;rg&C^EaUs-HvvopS!cE@I&Nc&)9fXKtfdNElM>SKyyCZ zl4&cH?lz?C(CwXv-6Q#&HoBcG5s>%_Mo-eOwzAB?#17mivmAqT7JANdj1La1o?vP- zEnd#u8Or1`s$w|ziR3~9|NJBGEcVRZ=NB?VW6b$M2jDDE>}My@C6B4J)VDt?dLNND3u*gmxFe<{%8Wlc*d%tGRA)_p;77Qt`AMbR$o}oO zP1JABzVLNNY1h9SOKIR>sYx6PE|4EMfC7Ts;py=T5Zs)d*CO86ofXjLAC@;V?XS%s zUmvF?HAdn-d;5#j{>vTk*9iC_wePM5{YRaB<~wuMpCvKO-#NMNV*B>P{q+v`J15@X zSV#Nk+gJaM@#f5TmYZ+6{{NDm3gT9O2pHDzsE!PtxB3^->plaQu>`+wnvTIxpr)GR z?K;>KvDFqn0|nNq^RoS;p@O5?sR$9W&)vnO9OQoB$T(P@)}Zoz{RkpQla zrYKzk9n?+ciNCU00;iPjkdqb3g#(ndn#k)qcfJ;bp3-yin-*dJS8 znaFHfd}i9J_|F~jJKocz(AKgdW3>!Kk}SIGYl=4hjo@XEn)c<*rq?b*n`A86qKb1T zFbM}vSii<+@dqG2J#OPO)a^Dtje+=la~q$OG*35qJU|Llw?Fapz31ixuW%8aS{RMV zDWXQM$}EcV-Q(a-z5l5s=-{CdHeRdkLm6q(J_M0IQKj9b7mucbF;M7@_M-y5U2K?2 zO4_wHgl@BQa9eo!W77JK_1-|Fm8m(-R=$iX zGRdd~omn$nrZRJ5UuB@lF~#;m9^yZt$vt;1;)o#=_gKC0nCH6YJA$(jllD={`R&1SJLxN z^YiV0_*Z)Vz6o$fVa^Ol&)0Jr;hjfB9bBj??4a8E`Y8HG2=-mdW^g?b;aRv}PLs6R z3}hawXz{|x1>?@051hK#>BatP?@6*7;x{auB#JVGZC%JcT({(x1+)wtBZEVzowU{c z_~cL6L&f{^;!E5;F9|ZC<5Gebu)hH3pev{e^!$0G#Pb835a=(g(1UXZJkxT7b&WeQ zMRh+DNGtQPF{}<-4ANq1!k=`E^AypCux>qoF={anfXR7y3PW0B_KFW%eGnWrC|vsf zU{2oVTM{JT!i}TD(INzJ;ij~_E{FsrPDoa&O-r?at5dICp!5OjKqBN8%XPKeF+KHr zGsjU3oAR?7XV)X!>R6#D%C=1Viw+dH=!8|U3Q6F;jYK9nOf(Wv8n4odgZ-ip2?-N) z9a&MP4kA|M3n+5^c}t3@SAJH3pVoovHZPzYn6cvf7;>vu5n*n(o~(CU&wOlO!hdZ& zA3d&Y{nysB7-Hr&Jx4GRDw!Eo7L;VDyIq7%l~60!Gl!dnYcktSjZnJS zv2?Vt=!3c3rss3oj+0`hcx%*d`^l=8!j>m>Kcpu;ke=GEKzjE4J3W_wnVwevPEU+) z>B&a}=k+x`d8EjDbc#fQyWV%{iHZ%G@m+d8yK5W(=~;vahSeu#xg>k4Y8nad0;Fdm z1GOac_vx8*)cSayyc)k}d~_=}G{*_=%vl%`<)He*cJRN`vm8iId>}n>I_7Y{Za(W? zSA61Q$OSuxA3q^CY0rJ~{C4vh(IQRIavFARZBNrn=DMN|)mem~^FA8ZiVvkUKd*9M z|MAo@hM|u95;-Q^<%Xe-ZeZ(3DDwq{sfM!1pW<^4hjQDfM`6)>&|7eI=kvW~(7`u@ zrE|+i8mzroB%^p&=IheVDX+~IU!2%Edw1=k1?6hbtO%@&IGE!Xk9M!v%4T3nHD0SS zpsSg^FCRo>W3EA66I7tgaR5(xmgw-*=KMhrcdm|WY1fV347K}XoDIL0sryv{LVvmyM_F!F#OB#{LTXSH`aaUHT>^{=buk5 z{|HYOU~t9n7Vi1-y&;LTXfvynb(B=*R~^<*H~3`Uy=M#<5txFE4D({<=GV`;x>VOj zMR_?KZ;R&b=Hf!Qn&brj$J<^hzbtr}?4kF{z`ML;JGc!h6uk(0W5KB>iV3%#Xhkar z%Lxp9D@$f$l+@VVE*S*|Jzh>fmR*Ze*aAHxdmsCU^YxcrBsSho zjL*3^%ymTZJK*x+e=w_69-9l0Q((6FVsrj_|CK`)4Jo}?roD5Ezc+2-Dojs08iNG* zfp@={=-exxVe9$Ta99JRS`fVWHXIUWkZvYXo&+dCy%xm)@^aQ$31nojoHvahM5J8D z4k!qaVi&|LP^CQRquCvB{hes>m|~K^r37?kD0Y01N3y?K@zh$Y)U^c}fXzhE8h)63wYI}kw=3C0F*gYgrm$*4(XQe zP6kK>!a{A2Ei`{6h^f9t%iwbr@Ze-`4M zUMgmJ4!w*D=(79;2KzLeDj>cCT8#YdHRWuPW;S zA}DfYkiY(GT1HBDBHx3QbEJ7x`Tb<#{MR~BAB?ik2aLQX+uHT}1gc!*U`9FNb~4Vn zHqBGqD5!jh?ai$xN{Bxz+XUBB16g7plunnJ$yn0Oet}6eiI*j2Cg+e&a9U)5qH2{K zk`#j`43->}djFwk>Ge8kqLDBs49Y>yjsyJhq_OkFc;V{E=iW<@dI-K*FDgjp5qDT7 z`;pJ|SbI6rJTd3>ff-@=>ZW)X&b163RYzo4iam%Vn{Px<5J^@RR?xg|FJayjL}RE_ z{Z*pAi}w3B5_SJ~_I-W#5G44|OVpq1yN8$ixjX(Y1n^#>e)YM(Ti*fpw=w*_&ES_N zcUT`{bpBM|u>tzXe_5hpCGM|;dXDZ;=b<4KxDf;NnA|0w9@urSCE(BE)AzFGgFIQz zy1vjL`Ur_mYRrX?LR5U$FuPQu3)r!V=nviLJ(7VW=VtI!^5a?QyK3R$e-Q*M9B)|rO{PFfw4mh(nt}5=Y&sMQ$mn}t|sE@|NiQYaz z0&@J+M(J44#FX+vEe!uHyDoxTh79{AkuSOnePt@|B`^mJL%^GIqwE+k3NOea<8v%{ zB&h99ZtuVgoSjVAQd0>aJ=7lZwC6KZZ%M6St2az4T|VQVNO~)oR@#EDvRhH)LW;bq zeBa!l1@pyR^UH~Ll2zDs%?YGKRG-iCf-83t#uTIZNyV{;1yAv!`A|?0I72&^lS_2- zkXj=w_>cgg%o`Y|q3KSZL)SwU!i#Xejky)4Xkr%4z34n6b;=)qC^F#xpEAf32L2c*k$;* zOIb|CNaiNtIbqaO1c%4Q^1FfcVnHvVOEzz0bit}4?ZIa z6z5(uC`zrqoL#3AVM9*g7g@!WC5|0YB~B7#J2&E=O1P!t)Vl!Db74;26_iU@N$GR( zSC~<-*VEp#cPTJ6UN+~R4c1buFs8w5i6+|~T1Lk0nhpxq4LJuv7ipplC$uZEBvC=d zcs&esz<7&zx5EYOiRg@a*O>;_%)rrL;D4jgg6(~7?0SHN5i4mLOY-TBFEY@)JJ_3q zX3E4{)+zAEnXxJQbhgrJ$_nmUY$x3c`iXrmHCkBwG(of>W{4?*-4xK2YR??-XJ{${ zd2tx^-r|;Qq{(Z(XH5Y;e4o`N(0~*5A}KD!C8l0Z!`IVxA*OSpRRkJtS-POfOw$>+ zp*q#~Zio@&W-@a=#?W!%K-%o{oYp#1T-W4nv3?{zvei8Lh;_||SO_Ni#nNQK!e`?# zHA`=p>6#vONa3Dft=qx_0)dzeh9Ah+&nv92QC8nnSd0&+ZvV7B{Vr+iL5A*M?&tFL zT|(gBc<$j_d=;0US6IKOSU)PN01d*ws#t(!2ltBAbfauVja#$}@`{~xEX+7JWypyu zN^lMYe1_aUU5MTI&Rtp5%Lhy>(TLbRp$yZ47#(uHzh#b+O{WQzIg@lfhF*8AGII<&$d9 z2}1?LY=W$CUG{F1zErC>KN%l>6bki4#%$M1o3|K5bg_l0LCBe`GAFNZx#!c^>cS^U z1!hUa&6TxE^~8Fz)6Q0n`<5xFL2rhYc>_rqT*oXfMj{|+gbb%>5}^9sf*xNCAAI|R zBA9Fj;!f0~wRgli0lJ6_j~FRA*PPK2rp0BD8Suh=a7h+3cf8UHnd$mcR>)FF%+-{q zT+nWupC9ok8kR>?Fc%uq4HC!AJ(A8)aCP)jn0UvdG(j5JBX#GtE6w*fk3`Iy0?BrqgE8r?1@17v#@0#cxN7YY=9tfh z*umH=t)>0MQ}OEO#n=*t85Nmwqmi{xFA+Rs`*W;EuCfarIeOE!$$F>Q0eWDay{s`c zUGz8>Uq5*TnjwFH>mv(jhGwVdDGh|Y!{AO21X|~p3R$gV*3lSxeME0KSV*RX$EFPQ zu}%MJ4JVQi2|q`=x28(2LJMWmY7RZTNN_BH0fH?pFbT7LF1E9|U!sAWR1E`3K-WhY zc~&oJ*=~v;ilpp)u1c{!;g9Oksu*}yWS#`UFKRYO>3POt(P!c0cK3~KM%%~ZTzKv% zB`cAa5Iwv{9xWI*MGY2u>1icMy}aS7)n5XQz8Os|X&B2dEWWwsVGv}!uzWIRmL{;Q z#OMEBj1Rf9%;}KyN~`%`;W5*`hy04sm-ZW&9@Kn^ziQTZX?8y@xxVHzeWO_q*?IqX z$@MTh_EkgfwddjGenGRoy;%4=&;7lU>(?~vA#vpEm-uP~0YenOs#zPc!?w}%s69sj z(eedh;1y%v4Y9W?@*f&DbMdUz{Wx;HU=%iKclu{oC3-rE9_c=M~L-XEyA;!EwHS;ePR zC7vV=smaHDh&yN)+&l1@f6FB#8QAlj)nP?q>bf-&pjjXM#{GsA0_uiP#bzp<*L_h* zIsGx^2;&Nf0wlqZM@L_eB*{=AZSlMw3$O|$U0ErX{EGVkLnPie#8JLf_~4+ez2NnyXeEy%k%y!$HRjcwW_wBc_CAo z0n*B2mbK9&-hnA=BR&icVVT0gzC>L!ei4YRgqQViCqU3j*;Z7)f$Dd^f zAHijEhZapX=M|Vu`D?{J%4KQooSJMdfxcA2MOy=gfbEx(X79xFaS~tES|y@1W7LO3 z5CcPgPnAj%Ve6E0XLx)@KDpxG=jUjYc!V#Rx|g%#lNxhZy$@?}Rbe*xd`O^JQN9vI&wUDrN`7pUA>yBc-`{nI*V(Hx45Jukp}c>&(*ku%`E>USNhawcYg zYH~lW?+92FdIycfiB%tkQRQWwj}_dQ9k~Rg#8)2_Ih4sJ4r9tw41y&x@+)vR%wPE# zwyE~nCH^fU?soo#2ufvOfy{aIfE05T}rT-R>zsP z(uokk0Dcd5?pOoI++)8t)^q-B`xvowJ(yj4wJz6S4Lvs*BbGJT`&T_hKFMTtY+EMrjq>PvuO|4p%x7zj>)l z{JU(0f!xa$e1)6ey=>JIFA|@SfAAgD{#~|mL>WFvC~;1o>uNksm2+Nqrm3bklm>Y| zhU?wnhXQdSUjbwe`NRuNP%a=K{27B_Lfk@ z=vZ6D;#QX{s^&`omRLGr1eqZzl4xh}0Q@s)2ArED?a2fc|1@!o)8c$jmlvuzd-Ws{ z=y%mG;S8?oUk+HVL4MgCEqiHKtp-A`u|qt@G+v|?H1nHsZG?%&r>KLHqM(i$@cHzL z@sW7Sdo>2yJ83vflv>!;`^&K=%bE9@7sw!enx}MJCTjWHYgC?$;Xacd#l22?yCbC;ZGm4-YZB$G3vaS% zS}yS~55*2AWiuf@TStF7M>T)rLbWPOPK`VXtEAIR39tES)Az|g6vz99S` zn&+6mm7jar`qk%{{|{vAAqe5?FZ5rs_3Qm|3vm+n>+rk)D>ZRfy!IZm_9*Qt71whY z5ucA-@C8=xv9?0LEWEo3Eq_G=qfd~ppePGD-7(qR*q8r2D!1y*xMOjgp`MNKY1gd281ZKiatfUseA?oRV{Xqc@9nxmr0* z){b%YgNbv328}#H+jcDO4fnED6xIRTJ*^Q6zGgv~3a=&yOF1+o8Pr;&LIws!Os_`9 zLd79wqH7r%jZqH1L=c0_$2cqBXL4X#+~>fJrU6_z`G`u(=BA!%Uc*`;6UK?2hRvBV z)$hCq3-c!`eyT&M0bQy z1XNWIy}pd6Y$N4>iVFg6ucvs&+uiq!f3WOHsegh;&z|+k>{g# z@!+R_6|RS{kgtDdKNha9nIzxTTMsc)|G02{7nyP|K))rK{PgnhyPT=N@!WS|S^w10 z)_2S5|0P_%ZW9;cw8En45nBOE_>LhF#_zH>WKo7+auLubU8VC7&NUU%S^m&f>pPldJOjIX8!c~V zv~DtU^xzZCL%69P8h!sHTqPl4%1lrpvWcIZc-EWX$$;4Qsp)Exj4%+5+MjBC=M(*p z?Xk3W0X|X1{EErDR?&$*Z7*P%zJbZ4kB-w)N>Mni#*&q;_R=Q!1eJjdzj^vM;i5(I zrpScJhl$EZw2h*StS~xl1^Z8gtC8(D;bQ)=a1s1TxW<#37vw@A$sOMO4dKH7xp2Kp z;=&r{^@_|I$?e4!kAxvv` zzA1pkN%b7A%Gln)%Yxm)4i8_=T*0^bw!poGNx-kfGIT-DbqwSvT6IR+1j2pBtutQW zJzaPl)Z5)ggZU|HUMAh?OO7bhfEDKWJp0bf$f$tF7n_K#5sxPdw@UiE*YPt+Qf@TO zFSs>$W%RG#Q2I+R@;O304udCiz^k=ztx2?NdX`eSvdzrhc9&8ACCy-X96c`MtjG3t z&J*1Oh&BrW?gz57SRaKi69iu}MEa-D3H3z4fcl{a@5u z58K_pa^S0M0XBmC>gm=&+@MV~AE4g4LB(BZW&Z*zQp^||`!Rf$3Sk#$W=7u*L(VJ5 z&DAv?$N{QMOkEzoNCEPUd136cJsS!#AgB*WF~AyY#FtpWApA&~{oU&rHtJOt-BRS| z+pzUh>Bec+t)xOhfs6XtKIWE1YMt^*htBv(FPw~qz*FZh%RWJl1v4bKErlOXx=E4= zb{Z1{AI=NOASq0>so1e#)juIOF1{1|rSm&Mq2lp6W9jll=fjZwi}!@}#!7 zuc={<;A|TfA9khh@!B_7l6(!r_g!DYHA?`$`QiL)K%|UVPvxC)#TdO=M4Tr(x35ABa_{D%DNQ3F4 zP{rzDZRu^0Hvz^~vQ!sOGj`!oF;2>XHa0v#J$l#yE0w^K$41Q!qkuoHC+=L&W)8?A zc4d9>B=}~kuT5--q2wMO;!nH__9A zug{Y@+^Gld{S3)A2Vak|UwPY&`q`^gXIn5F!U(M)Ozm=_Cf1Hc8CL!Lalyy73p%te z&xKr;QLg+$im)$N1i?$wIT(-sDq7#=-~3p#zJ@G(D_ReSPXF08;$KbTLxaKBzxVr^ z>EY#mE?VEk=KPK49yZ2({dxaXt@Yg^_TNQ|fe|ps`|#h-cl->hs99zTqk0UNE*BH} z&D1e*UBnhB)Co`S8FV$%SREy*f z)uLaTU)F|l^r$16B(5PZ@5rgt@Xo#t1tF)Dlf>0f;&kHVG_}-?i<4c?C=4`m<0-RU zSXh8je}1?E{gJa3;ZTnX3$Wds7_o!{lFHiz3zm+XvzAsiu`EhOw4fC~+5|U6-TCau z)tdw2elmdex5)r$6}{JF#L4jOB=4-QNC%bbOT*xS^rCanhikbU(<5712S|7aEO_RD zhI|R!22+9kKsSNVP_5aA(LMcI&_4q1^$Q`DaGHgWtDvW@r>Kb82c%0jyOvxuw+ueG znGdI(=*kK|^QCLp?%%IXN;4w)@E~Gyj!10pa>hE_Gy(GhvSB$ZhE%?LhCz{8WCw3x zZi%9ysM~q7)M>1hTs_K5S;ESK--Zhb+u%~ zyRbxZ1$()mWClD9ZEqmXnad;22L)UyCf-ebD#sWwC6bxlnHWNkg-8(*9@tevGZ|a5 z;L*SW_1;?L2p9HZEb5qkYH~ZDifzy{*zIyq1V{pX^ zGayl9PGYDtad(XmSjo>kl-VMhO_Hh|o}5A|-45asrY+PH1`#gO&zuux`Z?u6rb$8y z231l^@RN&@M#+T>r;f>OCnv|W6Q)W)PXdx zXrx0n{Mwsqu*Yb?VyiSW3>m1h3E0yzZ5ZkW9W9uWay zOun`XiO(&O5Jf2PPQ{?Rp0qUbI`K(+@s`+`$>`+IY_|t$5 zimJ)g5gTO}BUAK{413M0LHks+Ts%ty;n@mvd-Gy5GiBBC@gAFa<%6igfq3360~T5J z{^H`|YWs*Mm5ncPEDWDEvU1;@85E34@b(0rol6?UHD!^wn$el?h(k)p^T}da9%=;=bTeJbQNcfg(;|uj+J$djMi{gQifkg&@oZN~9gz z;mMqdiPrj;ee>-D=_8B{F%mZMH-Xn1?S0iixxK8P&QjpfXH0ktTY^F158eovo)T}T zz-IKw(ayJ2G^vGtflzzLT-^f>c6*rScL%1Eub21(qWruJ{u;UQ4N)F4cmC-z_|F^k zSsxO5eh11=W`$WFf;Ya>;ejgmU+foX^yd=#+aLNr9Cdz|I`nfI0hXTru}%B$FFj>_ z$SnB!_5R@0FYlro{9_lL5>!ClExP^wA*)cZ8Az7!<;X>PHI|x&nvDSm|J`SJslEy_ zIce-n70?B?&SwGA;z`kl?1>wqbv`}=bjV-Z9a1r{avgbdp@7VOKLC8Ty8yQ=d9^roMkFVyjW5fOO&9jq(sif58XW0TPFZdya}G-w&xZhN$yv|zLs zGN@r@G^`_fRu;w)=9^e#BgWP&k@RN*Iq(ey>Kyeo4TIgJq&?P^=k!j=slGja4#Eib z)iqxRgAb+glV7-}r7%Bi0j>Wpf=Ci6pu%1M2cw{GA}9zMDwsXN9MP=IPvOFqYo7qD znh>E&eNHe0U{&MzMxB1mC$BJ5TL!Rxcl*>LJK$L-$-IE`KD59s^UM@)!)ucb{g|oH zwS^0rdTQJ8%-1g+J{PJqGi^Hkh|z7A9X2Pt`{W7err^*cEuwJJ#Su+uqwH2`LgBQ8q|5Cyh@nU@XOEyb1QqSp$wZr( z@SbrEDPp!Vvg?{wJfGgQ$m~x7Uf%Dr$OgX3lT^o!8!|=2fF9Ff4ehtG)KPaqa(~B; z65Q|qV(ZP_!kbtiEA4Rj5F1ON+*52&hLFdMKzeS zHga~J1&=elEuOubniMx}80h!oiSBr7aiqT4eOsQl8?pMrT;1F}IoK@%!(h(OcIu+q z_%;_ovs%-aL)swEsJV^=!c1#s{L9fR#8lmxJWw!6qfF#|uH-0fx>ynKq4sAD)JDaf z@So}rUsUgW_PM6@ncR6@qZW@a;G?d|`-MIENG{ZuY5zsd*mw!e-9p_+Qt{$oVU(~% zG$+xfGW=s@80m!4^PN)yvx*6i#oKU5+y&J?5CMR zKrPpgvn;!XOn=Y-{@pf+A6uWV!7kr|>L0K^4_x~0TK~J;nS0ngyxh-W^IbyI-*}Go z{#$%i|NjDPzCDim3L6H%`lVkqMO`WywyUhD?!%?WY6l7F6SW&X4z)W~QRaqnhL<{X z5OfsFwA179`X@)Oe)_OA`jM}Pq`@Ii&YMO#wmdMAb*@N|?$2^QL<7!pnANmaUIHn5 z)DaKqu1b>QCk;6O#cn?5ngT)A# z0%~^T&4?t@eS-AL>Ox8eX(BkU#qNl^{+Vi@v@TIT@nuf5ySMF(nQnR^Ic}=RejRea$ZDPFzR8>%Zstm zC>{`yR`XtKY^lT}75 zt4DFb*$JHK{R+|Ens7BkzN4tthph)BfTJD$=#;2*isB7I{IY}$Nk$YIFZFD8Cng}v zrh(!DH_hl^B1@=1wOyL7LtFWyID+81)VUZ#Rpo}R(d4a#H(3kh6dB?DWkx7>mplG* zYM`Zeb#p;dkJK_~CB?RwpFvUZYqN^Kw=&`vclj9l;U%RtIf$eSs5q(qZdqYpOr~kW zoSCG64KAA+f=|zmn3MWTqca(0)0?HnX%84#FSPdLD~fc$3TtqT1_6C^^3Mh;a-tF1 zyHH-@nz2T2F_A_5%zK$+Tf=?0TTdgRY`HGioaIVc7=Uu2GB8JXTI2j_R!B_YRGk!F zL3MvTryqty8G(wX`@r?qKR&)^O@r8OF*|6t@b9cC;QfX*dD-8x<`Ks|YlQyAnksOp z{AYi#Mp`Gn|A95bYyXBdf_i^q&CNY)I;4^TtZ9aqbo!k&i4=ckO}r%!+NYgEqDL}n zP33&akup)Qv2e8Bi5Y?F5DN#H8=klqjRS0o;;bgk^9+0Rn~TPAHRVd}Nb{fy^Ulgf zu7gksCNyPpH8a!fYK_ee0fIgq*;+?hTfI9Kg>zBsV%Cxx)*+$h-rx%Jp}HjSsssq> zv>uZtNZaH-nc>?O?DHh^mX2e{=Z$6xalqttvKoLNwo`%8pDAIa^L8PoQppkGgNEbh zIap91ReB$fUGPRVOzZ(ctq0P8$={Ra(>s(|0BL5vlIGB2{VCBV22!rhZ=|UtHmi^d zXuKvuVt2q0FCGLjw5sy$mZ&@a;&SJkQe) zr~+)Gd-s(zXWM^}<|apBZ(DzZ!R-(U5a!Ufh}i)71Jcxp>@@SZfQHD%s&XyaETxJA z_t4k6u{Ak6La?JWU$VFd0qza%hs#%NIlqwH)g?Dh?G;FC*M2kwb}V#KbSpyfUc1$= zruZ^>-^+hdcylWgeM&_{>@h>`DdkyrZOw^@w}GWA-uM|c3Vq5fnVp@QD1Z@rgjs#S z_gG^kBv>}mIv4K zU5=w6@ zmS8@g9HTz!RkWl*%q1Pq(&_G2wiw0Yj}M5@O-gVhpsr5ww~eX6=$C(4+||rYcRo2u z6R)52*6xi{Y+UYwwQgsaZ6Cus$ z5{@kg>=8qJc6a>3bK(JODnag3QiL9?aG!pn#L;f}2kcxnI&t#2d9WdVF?ZC(glzGM%n=ENszGy{)XwU{h;K zQhqG8l;fB}TTaHGuNY#j|8v=BuD|$Z+9N)Z7eooqUOaujRG!ZglNEyU4cotSCkW6V7 z0kzXkQBtjjRqmh?u3;$T6mm3p>XYQon91i+?CS>T&buZn3GoQH1Fp&LK6_m(>O_l> zSMNW+hJGDT3D}-jmlmBP_BmeC|Ik|kLsY^62?i?WiXb~VGdQB*svaXA1~7`xa6x|G z4af-DUazA<*uFyw*q%40T%R3M>-Y+|Thugc%QW?=te7^|Ma1P?k|P0-QTy}e8iYUr z%1tOK%2lg{!!Mfdv}{@f83j|}2fIDksY->!Eu~YSr4_*+8gC69%r#>UYg+DN;%-c& zMkj15?;LM#2K^6;wkf6p^3To-r`grd8Li76PS51V=<~;zne!u}xs6LDMcd$)AJKw| zS7VPDP({d;qN`a7zV+i8;LMe$Np(g^Ob}m7pw$O;4cWPA= z2LLx?P-ntU6{L?_GF zv_rGX@zyHVqzl}Ubv@;}wBK}1mRmoYo2sGc*mc9I%Ac~QaPpu?Pvbyx%rf>=!L>$? zP$|f?gWcs#dpz{B4aShu`Bi#p;@8?|NpEKj%$vytGp`}^KDm$KC1Hk^Etu8T zF@|PNQH0`>bjMmJZ=v^CBQyABvL&p&3^P|V$xQ-u3fdqbCXN!^SRsq7WR4V_PpsfH z39n=lK0jl01N?wvDdN}5r{t{bar;HGlkok$L$o+^hzXi+h$-mi`aYYc4XCc2HJ!*D zG`uAkPGSw>hU^MZxW?KSDV5zX2QEJWzB*lBU4Aa`y7dz9Ap~BDQIkkHTp zt(_&*G|c?*Suphif*7b01-fU)k$Lf*&@Z7atU*I$)oQU<_R!}>q}P|Gx84t z04)zc{9VgqK&^FD!d9#duiOQP0!T4ENHd@rXpsQ}DGHPrF=6bkF*T->Bic{W`_|VlqahAK=7?hkh6e%5c_=X4X<)b zbQ0aB%!Fxx!?`VW$Q;c$_~`TFJ5 zF^EqNjE(FS6HY(d3MC(5{sttzx`DORE-4sSj7HiNkxUK+)EXtI0&YyQY9R2gq7nWu zk{^i@HEVn&?a=_Qh9*wfE)n$s)U1Kul7N3Ew;qRPwM7Tso{3SS2SSSfY-J2^xtuyq z_XiWyZUsWBIGyAkbbsqr2GC4pXRPj7)CpSCQx>e2G zt7P{xJVWg0kJ>z{u)FZ7w{ywiTq zfR$x62gk9zoeTXLMMbX@Sw};Yl zqjtrs$57ArS1tc8p6th3{x#y}o4WiV4DBD+^6wIO?lt-0<$kW^-({Emo#+0$b@_M6 z2mjJ?z-sJYtjh=g2Q3H87E-WAy(E$-!56(;a(pQl35Zzp#uWOQnD_kuA?8ZFG5->C z^Y6u6Yw&k5UplqXDi*7Ev6%EU_iVndN+HABz-EYP_CUk&FVrN5pA-jdq7k;i2DeXq z4bBo-@%SJHh;sU&{VHDxaH&m(d@`ZCr$`YKV2f~w3W)dg&BA^2ENawv=oTmm+qkW$ z19em}%LmXxsyD@{l$th4Vr#IGt<{i20Acc~vXSLNqlEFX#q8nY7GKPP)B@8|75SX& zBEfu<>B-55lA{hI{+@K8K3&g<#EIU|$h}R*a;B8cxdRRyEmZNZRh&~l zQB5k!@9RF)_Z?xz7hsX|_9wC8R4`pq7P(s}O(NXd-eNMkXfrJ<1(e?m}c7Nx2my2TG( z#I@U|(PZKE)5(b;=Fj+?2-QZ^V7l4wSVJ-=C_?i26lgox0b08T&|2Zr6ULBg$^wna zO;g74G+u_BFJ|?6C>=;ONlyfnyR8Ab8ll%Y%@}$*y~-}l_1fx;$`<#)*h2o`tb$EM z{t!q&{*%cg2s>0BXcl!Xyk-C`c%U_cHD6oetKl{W_8_|5>u_Ys#PF;R*3687-X7^# zVL4l0e~r!agD8%|+-6_=0(a%JlSbprX~8d;JKBprpI@>BaVw2XFBrCGnKu8qEmDtBbfpHzrqR9c)8_Bh`H;jR_pFp7?vRc)$-Lct zbw1&W6I{zm^q}Rw4_fYm2!|$5V-M(3i^C2FX!#d_mb+&x;qx8dYdLcrdFQEWow#Ze zoWd|b%hz_DwK*^6AG91tjMhfvD2rgQ-?>M8zbEfVknYn2pUH!k_YYk0ZhKQSAKyu! zwcIpZYl%^|zxaWY|GX;ynjrJ7l0S3~{b%j6e?7^6$dLJ3wmvBGuT|F%sW< zImt9U)8|Wd)ryqq$T3Ea)}4HUQNWe)IlssWnkicj3u#$KfWrk1qQU91r>%GiJx z^R?vL5E<^rEp1n#A*v&0Jn)q#2-U`w1^Zfq+y~vwK<_D_J+F^l&TkIF zlr1fdG=(!kb?~`8XG}r#D+W-_LIHsVAK4is$&(w%Q2>LNqf8j6KK&wIwFQBU?uoOdOFlZl+2boA&<@Xh1nO5kgsflZ9 zwOBSDO9T+*2Fr((*R`%kEcH+zw_~8-3cWX|BV`aQUx!hTjPFRHv3AZ{$BmPBg{O5z zGC$T(VlzLw7E*-Yr;vDNVx+|{y1pYEb#^7ldv)4#Gyt-U>r62^=}X!}Q}p!3q`Zw= z2oQB-Aj}xC7g&vGuqa|6hANhQvVno_P*)Jz2XIe0^V$7Vs!H}+swV?u;NIXASEfRB zP;I2RdG)f!JX!3$Iz5yn#$z@~n~KJIyMyQFMff`KFzF@cZ#u1)1w@;OI`wj4Unzm~ zV?+>Z^T|mu^Y(u!+i7UEF7DP%B8P{zhv)dIUz()DjpvX|-RL|aI#4jdd=tFU)= zV;1#qMqzat_f2EYP2!R_*vrp>$|Bj39{l1g6@v?f{v=v~@(jo><83JR5ZZX)6A|ue zbtdR}{jY$+x(Pa^H_sAqqynwd^?u-MyStZE<{v@e*DI@4wo_F9-t58Ha*~YT zXpbDrn-ly3NaT-xwjFt6HywOaZnStWjrvbgjh?@$3#}9uP`d%_u*NBZ*q+@jsjg(H z1%3zDE|i@)TeaXPJuJ-E;XKWCwl!U&XrHDvT2Trll)*A2&zBmb36D(Li?Mb6rJM%# ziP;Bjua>Kxt`?w$>V=EHkc{oSXt5u9lHU{cO?5TsNm?)dB+G*c%!lFXfVnsb}pB@ia79I{Zz_nT)^%1scsXkfQ(8;#Ow_oHYwK^NZ0*=Myi@HL52H`g%+cMybGkn49TCeB=m1 zTJc}CrukUcGtz~SxYA-4_X2ebg$UXs12+hB@7tW-mU(?Fz!#+Mu+z{tn5-iAeeG4J z3{$|;mQ6KfSoA)~+=9~C_B7*TI~~#MWLjy4?oHq*!JHA0{*UyqUHAN>y5}Dy`91%b zP@@3+8<2Ga@UKhH6+Y-GfPd}){$U^rDPCkz_CGf~ly zcCKQ=R9QqJnN|d=FQ38XLPCP@g8xTWo4f4`{^galYV&1xQp$Jk1C99G@I1Y`PgVkvO z`V3KQfYV@hQ6%`KYK#Pkk@>4HAbN?H)rK%DnSIq%$_a_F(>c)**; zctDo)jXkcU;p&%}kb8~|!ktFBcni>~Ke@(DEO+4-iFy+|8yC4`YZg)1r4lFhm{c(H zDgltCf(2!MWS*TkG-C!$G5Q$qYO;UShTlm!&$Rj#G_0nhTyukod2;0pTk)<lGfBZSOfzr{y6aS%c4&r}9bSwK0PYOPB7EpIwr6 zS&h?_cj|{HH$E~DAGj(^FUxj#jP{nCNX8WBc9MsOW<6#3a>Sx&L#o0oFPA;yKami` z`I22(Mx+M!d|dpc>6E)jQVfn7K7l!@xkCOP#WVSu-Mkjw&e3(rJm&*6KIFMpe_a2i z_*bbd!<@`da}c;HQpd1h(9g$O!c#~-U5H@tKY9UWey|XSKBPwFh}*}*n+QwRK{M>wfmP%vTRp2f zWpUYLDF7#yCO*O3=lY05v=d_p&PVzv4AOto_VD6aFfifpIOz1gonyV=~UXwj(z?MOMvBnIxuDY{9$nV|A zIqcb0LC;(%mmQ->u>ifyqNyZ_~W196(!Fl!ANNY zkN-GM4897qKctR=G$!y14;&CF8FG422ziW60?f!h_~IVi!*Z_?%yLms1-WN=kV;)> z@T~Nw9cbmq64VuTy|5KH;p0c_+TL&DKWZ8jd;4puvIT0qAdl@SFl_#~(>i32P-*lP zUPlxE4qm-q;f43+8+aMD^%0}CK_{2dVxb2-v(v|KYrWG-EQT$ug@@>-5Ti+@yS4x{ z`T}fQ$x%tOI|O^w%hJ6=qCafg!Y6sBsD&vQ?~W?XR+o+~FgF5!)ocG3)vAgPrJJdT zJ({odQTX*Ta?0|CNEBB-EpOzuDt`Do zN~cmOoN-djAZ&?haf2v zAw1sFPA(aMS?f)O5vH#2w? z+m-~dZA*>c+qQ7ZvsN1}SV4v$-(x>$5m_76Ah7`%nrqlD(oL(!wx|RY96}$bQ+-yY zpW(R0O-RjwJ(G>$Htsu#nw>EXi00BTK1}u42lu?bYI1&*OoCuLn;5Jp-v2XuhOtBYTez^g;%v-vvhM-z<{YdfQV zg;(z%@XFiz9bWo%U*XjYU4{M|ydeI77aRayWG`W4vwwqERxK=fL9m*UKB*tpKSjEFXpVT@ap*;UQ&OBR|^1M?ErWwOf(Q%Bv(3HyqMSs@2Q%< z(m-MAoXK7}jB#0cz3;OF_3p96X@|Sn2v}{zacc_5+rCdmTe++;7Su_OEqim1Z_ZgK z7RGEfv-fz^;{0=it1LBid?4I!Wj!1Em=tSL`;z!LBeiB3I1F0kGVZO=CVpJt@1k77!?L|9i5Zz(yjy6Wk=zIcncotLs=0S=7VM?xv;|5}0nW|#C`m?T zH21-|P5$QG(#LLmI+{sRo>DxI-Qa#qfMbgn^~Sg6!aA;+RmE|nZ{o&d7=0CbnH3Tv zCe&ms7=zOY2MBJ<;(R(KY))xH!$YjUgdWvzl3fbOS;>V%G@NjBA?}N%;O#)=;s81v z_*JlH)h)!-&LP!b5%v(T_f=$njIggcRNr{FhbX;&+`D}jlXZ`<-?IOHj<9b}6aUV0 z4Bz1U{{~?{_Ft^OdWCe~LJT-~^f)R#)?*a(rJd|L?p)MPs6bd~hdEv*H!<0jD8q}r za}6b)kv4m8JOf+VVYeG>ci%$1l@kuxK@gZHK!c7HgNj7;*52AL^T~jlr%-ZdUtkdz zqt8A%=^$WMC0&$Zv9QSAZi#x2y!?58=ZVV102>kBbi<*}1z3U6r4^7X$TGw^H5DeY z5;79K5nb|0-lFhY2F}qWm^kUvazEdoc_GTeZT)rfM!+s`Km#!#7Zs_9Mwp?f6=p9; z=as0W$R-jj?p^jm-?7V@_5FUzmFwjH$J<%Q1(|MZTSB@^x*MdWyStI@R=T^pySqe@ zRvM&{4y79eq?K;I7aY%#nK@@>&ffd;|3_c+=e6#2ujg6!K7uk3jC%fMe0O|u|B)#Q zfy4ZQ7>q5hSb|c3G48yTm$sIv^Ksmghz7lWbNDMVk8%v4gz41Ym9Ud6{5$87UFYgx z`S{>;mY{rLLAEKP8|c5hZmLu<{;U5&vAOHNPJi}a;=cVofb%Hs3zRS>bO{@Iup(4o z=bIpH+I~++Cu7`FpnqJ>6OGV( zYsTYfolZPeff82svxKQU39^;P_CuZ`K{~T%kX6M9ur(Tn%tz&Dty6Z%l@ruk{CeqW zmA#+Lpfhf0wnjXUc2~mSbAb|e6o-B1JVxRHB`lfi-g)%9a~{j@oX6(YFELaDtuKHQ z2Gb=NAQ+g>UQgR4%veC0otr|5;LIfUJvPoBEqd3La!)v-%~^f^oi;z3%5;1Y9^dP9 z&&RQGuU>Y{uOiMb4HJB*M)a}A)f-Ynjl-?}hSII`k&b~9=)VF%F%7HH!oZQA^)KbD z0=I7Mc_A`G7|-IZKA9w|rmhx@o9ky!AUX3->Pq!lqEUorP2gm%dnN_2xMYw4{TCb1 zf6>t{YU#>JV&C;&vlFezK>x*pBdFzS4CO$h))ImSTs6bagXUZ(4b>CjXYlzV4E5O_ z-JXvIbOK!6Y6QioOCky$zZ$euBv0+tz|`du($f+<^|rc z^0f4kD&;I8=z&4Xorh{NNf_N*pK}mtX!LiQUpsu_NS6W;xiAA=bXC`&gWlhAF0GYM zY1@{4T}_k_S(T-t>@*JmW9G1celP0hfk*42WJkkC#5tN--@I8HmxUJi~3pRT~Wow z4(z##=yPr)qrk&W`^wSQo4AxbA>lW|_CF@QI^l#i+*MgbGhLfV9D{t~sHvTn1{<4P z%EeaC)j9t~&DYK%9;J$Pz z*U2s4yZRbPeBlV7uLO?vuTv#RclJd=yo1vHSlECq&|&rnJWT7hW)%8wo39%K?K6gW zf}7S&e7sFCS2$+8B2^Bi!bS}=K zrEw|ZeYVb}s0n=eD(_2e@crD~62#_Qni=#~OJq7~)U6t8dTFm(P>7-Hi(D?L+S0Pd zg7_qDWGa|^+q5SKZ{h4>2n7m01mEg*^1uyRj2igxT|y3dKO$H<5&o0v_16v9&mgd0 ztJi;|0lSX^`&mivtI*$Tz#haG{)2Ojzs?W;Bh~9Zpy=mM^s@o`2V=9fe_Fl3IvlWP z$G&rnoo1#>69aRzJeW!~;kyPbWTFc_s)pfk7u^O< zZzC(8wDlRFb-*-Llwo3oblx{$%ephAaM5h|cMTYB*0Ae7KhS`ssNT)Z&VjkvcY(=W z&jO?#TVY^s);+qrzR~6Aq)HF1Q*ewj(deSle)%Fc@x!KLx{C3sS^1{^4oytNYL^^= z4!w8t_087qZfCz)2I0W!2EDtnFAzEFHwY~LBLSfZ>J6}8Gy)batGTWFq1Ac7nJGr0 zv1>q5D8+(9KGWkwmLwzY%scmr5XU8f)?ufFcFRr7m;$>%Nq{nev->93=5E=YL)51D znLTW$a6)AKh5LumK|{@_y#}V)&W_{Hx2Xxr-%FKX!YMlHV?q`ZVfylb`tm`pIv5LJ zik)~caK?f~NCiH*AO$~(Y+2kmx$%NtRpAMGPB$hKo2dS21_>K1`Z<_<_c`Yju^p8q+I!BN?AH7Mg=&kUQ+I%^8dHtWI`Kx1d*bYHx_a|o z9gDtl%_bv)$2aXQlIfR8Q!Rw;XPcaij|<|U^|`2dX4B~lOEegSq^g4jIuDaXPb|{v zQxIh47sVk#tcHvPN63K;daTtoH+(lbOTu{vu5KG=csDwG8A~}q#eBlcF5Le{OP&2C zBj%5iU&g*2OZtCfG~@V=bw(})+u{6T1Ts63J&4}l zBVqkq0s8gv{^eT;dIUWY6tsRR!*LpT1Cd-J^zYoy;|l{TIiG#)=##{Bx2B$V7+P24 zkL68kb=FBrl4@_f(B6KEX7a5e{>=iq?RLhX(x)xDVD5r7)}6Ezq9HnX=W-S(HX{P* z;Z`1X4a_|yf8M%M;YWM8NaI6%TzrnN9aQU^E*%$n>ua4~Z)Rm3P|qJtH*oW67kF;N z;BarP%3aJlW^Go%D=&bL#a_)tZR*NGZ^@>e`eE?j%SE2c&OC2dyQ~}5crxYw6=GYc|LY6a$2OV);eAGr zW`~}T?`nd8ZFpUe;8o5(pVX$4>@TZ93mj#adE)vU;;#ETxJ@F_qpaKCJ0!W;iO%%~ z!2`L``D5{V5DNL{t=G?pxL=CbeFWvdz4dyKV0Tx9?mzCYT|lPaw_bnu+<(0FdJydN zvv@H8YT)nQ-b-GL&SypHSv)OYLdIXYpqTP}>sG3Cw)1$1v7c?EHS`{ak4 zmTpmp5+eOok;MQ3@g{yzW_*N#QagLfaR!v}}6jnf~ zos=Mz0`uz)b8X_yh9RL36=V11;nRIbN~{`v-E;HvZyogCnBz0c*2u?%6|ii(LOVU{ zZ)k4R-igHPz5Xs`?{$T&O0}9DE>vHNV)pra&5(2Om;JSUM1rLF;*~L^p|jcKdYdTb zL!%0;Zm1_ak|PFVl;~+Jr2VqW3w4B%NXg&u<)9ra7wYA{QVQ{FY`7v1F@q8~FI-yg zAX7mXK}eQ~X2t^*i%v+I`mI2qi}bj9`m;00M~vvnmvgZfD_`GI6g2d3>)R^TZPYlO zz9RMo75wP3Ibb9lkmRMqB=rmzfr3g<1#&IJBtg*`3xO#wb(6tZKM0OPy1J3Q5c4DZ zl_;{E;z@>dL92x32UjeFW302s0)c)89w=#kX*}Ur zPC|LBTP4CkWlR%~etiDiRe1a0TQp>y26`~+z>8h{3^feZ!13!X2;H=XC!Thqo@N#( z;F4Z*@8ge*)hwxlWWR1l2iB($!rO|DvIStfgn;;ZSdR@r5f`VB48q0r4#eXZ*Gsrr zF!5iIj*%G?n`_O!b9Wb`*iz7 zz=zjdO+7;Hzg1z|BADvv^r9Y z?parcWVwdTL##-&PyLDg$R-CfA*^);QU;v+WdmfK`OU(yu#E>sLG>|sDMh1#tlQJt z{@#x(BbTr2R)8OCt(qRH#PCxNVI2YFqRVZ%O~&I$9NJTQN_JY_ad^4hBeJ|QCtZlO z{1fYI_2)00F|UsmyuZvoKfB1j7-tZuQ^BIca!WYgmkx?(KzF zWF~(rQR6Ib)^pfSe3PB?fe1(pg{#UCQ(A$uRn#dA~2u(-{04 z?`@t!*~bO6Wi(Qj<(c3_2IKo{PIeZov}25_f1y`jf5?01dKGcvO1~VGiY!C7*wO4l14%PU-c~5dvXckW1rns8Ces#uErr7-(?*~>aGxrgCv-`6NT4*U0 zx(bOhzSq**FXNi7_v$f6Ak$4H=5!S(P_vker)3p4*$Q9@YPGv-p>7#8+h>2wLjy6- z+z?@xgZ7wn-G5anRzRA9O<9laC~IecSO>?bq2>?sz4)H@G(UO2^*`~x;0NzNVLjwM z99@HNmrDwB9OI`^sSYzN#q^^6_E(HCb}!*#DUG9tg<;N^wq@x%a(N$55b~8Oq*j^b ztW)#Tb27d*lS6uK#$@~4ROV&^vgcjP zoplO@?#CLcBhlk|PfuHvH+ptkif3^7eaD$g+4dF+ zEn{nYioTg&Yvg6LVho|Zx^-aCpb12G?tfF#3$oV;m%$Ve>^e`h`aymAv^Ymw+H^Vo z`|2(P7*iXa7Ygz#JXE$In)HX+d#QlRL(La~vKVt-ck>&TfrT?NV zzt0hTaGUKx%HbV)??3LZW%+&d;ZGL+lXL%qEdReC``3!}U&sawvA?U)Rb_zeI;3V` z!7&u1^95?dXluS#k{qUz2ja=Ia_B$fhnm~M&Tz`<^Qeh0n`7?1?JXt(2>!s5fWXOQVbZP104R1ApZ%&Nqv{nYVnWo?j17Mwe-=(lf%E(~Hkv^ri z){24XBCF~#6vUfMKZ3?1B`lE1Vq4}W`e+;9tQ(9K8>jbX;|uY2#u_F55>sbqJB0F* z;ak}Si&nlzNJ{!Ga(Ifmc%0kFii3vOl@)z+_Sy}XN*HY*L`HQECMd*3NnRRE;m=T_ zNCAxw*7tgVvT$z^rj2~07Shr0WxC;G=3+7C;jpaqlDC*a8G0fw$38ofnybz9c?`Y*bh=59 zkqzx|YNeZOIPvV-?aUMAVSknSMX`vW9%5Z}kmAECO!-1;9BN#|<4`ikdTM79awwz3 z>YMKUkKi&yB$dHe3n3Ip)h_tog;7h(2p8(>qs|Dwpsg%)23>uV%R~>p>J@z7PyVeN zE6C&voHfNwkAcF5JN@>iZR2nl=i|QC88B_Dxn`>Gw58E1>tsvMf{zF>h6px3@CaKb z45T$0Cw6_UIK_jOC2fE8{o=#tWwDCpuE&<_rLW{ht*vD+3FE)I($|v1;R&^OYP}q@ zw<~>y)tzo8qk&4H4}$^`CfK`mM76l~p6}&Ibb_VO*n1j0ZB;$Z7Sa7sMRA;ZY(+$h zIA3LH+Lp--!s;Sd!qD~83Dmal^~l3p&>9*}BC?$HlWRsumD$(NWt&3b>pf2VDmb5` zgSTC?p9S6QhphS(&*`;z`z}>fjKfC@?vdruI_bI}C|uOu^o76Y%AunMlZ6e;@-lJe z6Li$6crU`W(E80i!s~Q$*?SA$72!{?{p+apf57$~ZXT+1=6n78uieG^Beox8sovxF z{ubC@4zhor$jEjdnfNzw|7(ZxpI6%Vxo$tJ%l`q}^S{ToeMD8`%nxkm;bKPcm|0@# zXY{U5ZakaEgu@)(8Pdx8iES^H-(h=tISPVnz@x!%!C+11IWueXE<(}?8@%v9D8|-K z)sX-0v^tx_Mw2vgwD!{``$5P|ZD+nqn8|Q=7k?MecFj|oU$MRLcs2KO`X1ZFKe7FU zcb zuDYf3=K6yNyz4zA&!7P3u&O?F&A7K#WXr0C)MZyd0BeQTg8wmZ_twrJ#1%XswK0M} z6CID|R;Ln<^A;h)ZqMTA?3OYmCo-_w+#st~BUu)YBUXN&lM#(o_*omm zzr;!J8UA{NnTf_xoU0jD6swHRW8DbffLT4gyaXN(a(N%QSqC>9gi~m}%r5$P7~BN7!If<7X*zAPY#VS%NvI$KC-ex z)km|7g8BjO_~f3IHsZQrQ!}5jApA8yh%)kwJ{2Y0rkPi-=85Rj(U$x{@o!&j@9p*u ze_B`G(80=rr9?5vrRBKQwtTN(_i`^uB{3eqm5rKGIbeA8SV#F>cWNx@t6R&8mpe{} zPrk6XM{}h9S2`5(q?r`ocumUz_62F2PpRznN-@EJEzTU_ z4)M1c`17J~kXRO44u~n!gI%YnU**IKn8;l6qYN%;7=ib^l4zo2GV`8>kKAmYn@CaU z)IZ^h{0^)^xfm@Gc6#%&IN;LuXz+FsS&Z@Zyq>L#A53KhDr&UgvSU8=sV-!i;(6^2 zWnUzXiRv0?qDbzo?$rFHO3J>IKH{CZV$F6juN!v@a)Ini`A2NuM|b>W$)98UXN=@8 zYWqHd_TR3yAEaE~Vf#m}$X{do*GcR@Imh&Wzkl?9P}>jk;QkBSz!>>&s_j2wTg%w_ zeJrsEsuYJX2Lq=2$P7a}d;DPe@XH29OopuK0en_$_@%wPHw_EhlaFBmN4ynq#1UND zp;v8V@b=6qItF^U)}KCKFnVVAX?9P~-1`%MXNFns5ZyNSR92>Ayu(mG>A}=^JJ+Pg z$aK@?v}&D>RtHY!Hta%!?sqk$by{d4cEAyTd`yRlI6q9sLr#wTq*DAXnD^)mM+0X4 zhnBs^UrdmMtOT3hycI+Vg)`}IKw%-5K2UJ+^F86SmD==P7)DA#G4$ZkJtNcU z*}ua!f9CJ8O|VRVhiygp?5)Gq=sHQPn*@SzZLGF@1ZR~7K2h&7?-utDSruVYLhP&b za`tO5rb)4F2ACvT6*L8aL-N9EEQWMb-c?@^8!fpQKN{Lm%etS!A;u@B#$_SkFd(Pf z@|ZW0hM27Fb8D~41V_IFcdKzoXdrxXYmZuH^R&+gP{N}2l^D)~7Ip_#)Pk8F76bjv z#*HGo(_n5tFu{-Pj)2-;SLAy&U=Zn-FCHd8?q|1f?})>d&G?Q34oP0B`KZ)-uJP0i ziz~VZBLs?-zi+7G$+uK~5MImvO-uGU3Li&|59~oqn|e#@)IJLiD2k)_0v00qUDKKH z=bG`aF4q}XFt~+31mNN-^}!@PJD#mL`e+%pY8w4AX{`rg)ov9(Lmefl{`h(aB75r% zo2QKck6{h+S$x*Xpph!G5l*;1atq9c>eR{{LjbmNJP6(S#9KX4B!Mmznv^y#mj1Uu zx#$hE{fPD4fqb_miWHuvkvaR&&3#5Ll?V&BU&_QN+FX78a)sd1V9zxMc>djK=0Y7l z0K>1OycR<3IIg(tU@=5%{^sqBTneE);ETiFo=A_NZK1f6H$6i}G1F?24gln~6;iIV zeL7TrjJ@zT0CJZf(wn$35HZ?3d4<4mEx#(znJo+qq_jvi_N~xyo7r(1_sd;mTwU7lc_%qECTs<- zPVF?^M3IBX_X~Q`r((9n=<%mtml5Ib^^AI>UZLA&Fuup3MUX?Hz;MD|RiJFjP+q&~ z=YK(cJFzcPZ)-ZIg5Ktv|4qH3qG8{bLQeJB%~1aBdC8%!=60yypCJ3MmG;j7&0mrI zA5q#5@;&d-`}dUggZ$lpaE|5wuhPCx^!r&Ie?vAqurKiMB6~Mk${vUb?%BTqV(Wa~ zP(*LO-hG#OlH%rO?oOyynF?wL!Y0G#`Ggd%8MJA^1_ht-PEFqw_9=mCr`lO}XYCYRjb??#Vr2(t7%_QNT%yBXlz}Hn&Fc);EXk)w zsh?UWY!OT4VstV((68V@_P=;yGYG#UBVLl#1xJ^C?^u*=^;QW{9=8frmofy`K9u;W z!@-(~*8=Pp+D<)-2p+1tuuYPRpm9_7AIqc&8gAv~j9r>5Nf|_KEmqD`ynvM8PiBox z+T}W)KJ2Iq=B4`?P|yQ-z@l>-UF(*5>o*R`&zLL`5|47Mzg%3@#5&eIJwAL+=DK^W z=B?ALn_Y;u#+Vnt>lM)wrO_1e*hCO`@GxLR%hD}4g>8ry#1kimKL&g_!hM} z94|Zrsj4zEgE5yy7-@;lA-f0&2^RPyZp6CwZY`Bh4?Uk-IZWWPbR&(9u4KgQ7~j8bDNES3!g4Z?pl2qq$ulCVh;Z8xH8Ms2i$U9 zco?KzzH>U!7b?oE2}&4>^o%%KV3jyJlnV#Zkg3NI@!7Kd4r_1k#p~p*k?UQBWpX{x z@ub&6!xVC9EjbP{&+N`$ zh+wdA-%k?C?UPFv5NztHViK>A@I)vd^!xOoe2MW8OUz(aC|%i zTF?G94STz9N;Xn=Jm=O|+g%q0MB2fchy>-Ft&7P^!rXT(BigmWJnUTk(O=ds<4#@a zb2~e}iE&dSuf~cQhCxL(Sv0mTV7o2QhrEX>mH1kLWihEY-C`Imf+j(Z5SMtchhX4I z;RG-hUurNSb*y#B6|p%wCQJJ_rV3#*3P%7;9nu0v*Li=^EyFfcC`K7N9ZHWTF|1R- zB1rL+?bCJ^(FP%ez2T06J`hxt;>-M&r~{ceBWjMs?CXtTb;9y-cWf&rS!m>jP`4u` zG;KcKfm^-HcZ3ybmsjtb4oOi`-0wDew`h5O*HxJ&w^p9mp+Rp|+YDZ>QFLsf8$8r_ zC4%Rn>7~`AodqBj8bGQ?RBosSQ}pBKcSw~sqIDn_tm8yQ>*0xmloc2BvWLQpL}CqH z=!%k{53;ZzF_oc=LpmDDsF0LLshr65F^cFED0MvJh?!DV zc@(;~h{L4IXhQ9Cx_EBMU#Y7W(kRKs`Ke3lP{SH@W!tloseF@q{@Hrv=(?3Kw#r0( z&1afp!)(Mm17{##Qakf!Q-OE3TXe)c{@ZNOhbE)7jTV1 zHgj_gPsGP)geai7Q&`e{WaGdq+0*>JNbR66rn14@tj9R7-eJ{YiF0Xd_Pwq*PJc&> zjzo9B2ZG#EwVt|Q1?G3{nW{-gj_#i4v={TxGP<^=6+01QkQ}p*_wiH>YE>@p=Ns_C zVi}5aG(tFup)xpO8{v3$LP5edQ&%|bC$155^)71hRQOz!2{DErB;-ysssp=khJ9f8 z9-~sWY3;l7ip(6TVEDB;RV6Jc2eo@!B`o=ds!P%e9J;R(+9HpAOoxqoW{%fFb+Bi% z1v+nS-Jpyb%a*c5QuSeGR{_Up(GnH+WzEix!mO>z_(vIyEtC8=R4KHA%G_KjXuMY+ zX{Gz*S>)_T>cs8842gV7bI8sU(HGR*Vj8f(duHQ+E@ql2IZHo&forT=aPFk)utwQg+wJ9A+Gv0+oSIKzo;5Ce+$tecO!E4YqWP8<^lOjgmEJXn^TuwcCG-Qu1kIerk|ib5!6G&i=Au-O;mbef$~ zy)W0mZSP!EXfY$VX>@Vc#VJE%k+{(2K1tVFcjI|N{7-fUuEj4*h7u6C8}_`8kbgW@ zYVOcHCW`#+u@ZqFOu2?@N7?ph=^Yzmp8{;;DR>ta7{6;CMmIzA9L z>O!BSd!?#UGZfi3P^JhnkmzNmE2XkgGFGF?`E+Y(c4c*Zwo5`>A&XG*YsVy}MmgD` znjS>}Vc$pL&UQWG&M7^=l{%q=*2fYd)(B_1H{$7DutJuSZ?&zYjf z?X)b69CG+R<~6bHbLOT>yKCAYUE9qXSz}$&SzI;rK40fGL1U95j!GKFjqhao_}rRF zsk7{$D80QJ?4aVO0Rr|SnyG-c9jC@is+0a((_z}$FnY}NttoOn_J z+Nkv$;1w;Tr95EST9tk_p5o-o&6+mCX;Dv_^$72;X5V_ic`$SCBiU=v*o zh1*LUGlwN+`IaMoDo<;@{N8 zo1>~@AlADHIbx~AHO1e=7%mowIZh|dPTgY3FTWxL-AvoohAb7ANsc9gvLHW1khP&i z8ID9@Nl7W}L}Aetb4NENf`1z+U`HI;#wN0WZ&aG!s8}rZY}qyZH7}w2WP+k)tf#ZK z4S0i=Lyuj*iV7IB`RhRq6(t7sfMORX1}ZI--XCnNp0rI`Z=J)Gp%~NA3~z6!`D~n0 z&&^~rfDXBlCYi2j=^0ifHRe(MbmmgV*`TK0jn9rGO3Nr-hW{olmAMcsx~!4F(`Rd%N2^t5|J!p< zaUeckk{EP-M@W7-k;Zz;k*C2ibR`6DT2Rq-FE>HO;j=wY^FEdxNvED=1kcA(pb@9R zbbR@-LO9@)uPZp-uD4O`n72+eIM9giT)AeuJ_WYum=!f?Y4Ny&d674bzppz6a$xRN zW3!sqfo{SkXNjZ6z9e3&)>`n%`_C#h)E4f>aZNBSv-H zW5o33?Uzsdx`eOE4%eWjte)pPDp&|Unni5hjB%Nj}Gk!PyyXQ^w;EumyG>Z9F7n z#XT97IQl|83%3g>S&)XRbpbLut-PMTCu1zf9U0$fSX*4yjGFb4G&$vqfhfozk-_9C z#r2?g!g;#tU&tR(q1qqiX4ySUKY)}R8Y7s($=??aI%N%m0?G9UM<0WmaqpalT~m^O}DIZ zb$_xYJIU(1FKQ(hKP|y%ARJkL^LlH~dpfvZ=WAVh(EN2xhxe7#A)Aj&MD3rT@z*;? ze~!lc|LhM{BkR4K``7LX{1J^0f^+W?cYj0SF9%M)k9cIe&tUu;Nc~kY|GQMoh36VrBvF6W< zPU^4O8j3Z~Aa$&tACi}l{T!^v;c+@c%Dj~`pC4mQwEs}WE>!S* zq^mDlGlK()P)E=-xC2U0h=?7+g>RhwNbrehjx)dy#OqKk`qoXqNlDJ_%D~eIqt5p#)&NAZhy(E_N#;sB+B1^;qzF+Y zn~713V2et%n#w!p3+=UUGvkG(O$RPRN11WM$^kYdZKF<)x)T^+n`C@MYkc}e<71^Rh1lB6^W~4X`0~pXgrMpf zsoFhEa$9r?LP%56MI^X8@?1B@c_VrTNtEHE9#nfO8IL(DSRp=#vOwsrsk>v;$Tz%r z0mCEEOI(VOwt{qQfU z@jf^9->w=Tkc|pP*T2X{x~ygp zKGcORjRkg;AM=}UI%T}|^nFJ06V$Jr3lH?l96S#-UQ=s7DQcdueeSB8wEv_$nSw~f zHGnerR5#zc31iUEHxmhXE{%!|>mQ3`=#LE3fzZqIgp{a-qb>>pDxKfjv!?)6kcBm? znm8c{3U{tyZ+?U%g9MXPo(aoN^q>>JB1|5w;!ZZgb?Rsue#@t*ERjS6?Qdo_;x!yd zfL!Dodl_xOR*h6!Smu~ly|G?B4f=HLoS%V^i8n&M=%&|siUH|3(CRMo!=Z`6xb zG}0*ccY$|ktCY;Wv&N2W0MN+#1C7K)oL~oPdC|E9S}D9}o`BWpS^P?CsOZW!uKEb_ zr2DI8EYbCLl$$Zf1ohBX!$V2tu*90LfwS)TOGQy0K%q=S>Q5zbe4x$_#Q zk2!~`a8hs#O+|{PEQuyPqUJeysV9qIg7=)GVb~y$Kdvb6b0(>4Ifrif^Yf-g*;EMa zy7UR>wsq1fVC0@F&XuskI_O!#6{DNOwe*dh&|2g=j4MBR;TI>MfhXK%sTBFX?Q-0y zjq1gx=_~+^#Q+-V9GVpXG-41^XR)}zI4d&2W-*}+#P2(1knu6Fi7te_tNlXDj0vNC z7CJbLEjzxmgsEa{A6h0`>D-&WKKr&=))CS{6KqeEPA?u>7SN1Q^*3_gZ|E=gKeE=d z;epIsi(bus(DMe_OU&5*6EOa@X8f6a_bV9xBbxC+FyB4k{+?$1!_%?*6xP4ij1M;I z{<}2eeYVu^z{tn|SQ7WY{(1&82;3kABJY}k$h%Qc>Yzn}9tiO;3;_k&x#j{Mc8p1y z&KfNVtMr=-1QE$9V@VwnD`eW|RUeme4w_SmBv63O61munbf|AAiIvH>=fPxIM-Dr{ zpfS`LdWl*6cOhu!*<^tXZ{|^<=d7-KZ4I)xLiOLcgVL~=1AX%k@!hO_fGG^#6?{PL zH>^ZBWb065+fRlLn^4!i@7p;hv|dC6v`34H77dxNaUGF$GNSbY7;xE8t$#z9#Mf2uPBQji zt*%_YxK?Cwn#ZL{Z&z#nc(pB`C{s^YySd+=jlb}eo;cLbKLw*aTVuVK>F`A>D3n0L zXefW6EQ#>jPlSb>WI7x~@cM(kj4+&7^Ge+gd4y1S`fUMt zhe=Ov_=)`^jD~W3Fcb2`>=C?6Eq9-(dx=B0g;U%f<6uk;t_`|NKt3vq_0#Iw9a&5E zALO07E^_V7dOn+feDVqbnp_+O72*;3_pdUWi^tz>C`(vYT}IE64k|8IG5yGNpOr8Y zXuB5Sg4AgmFZwf{M8}I#Pz$A1bA?Ohs1Ag|0E7N?bjL^a)LS2Qr9bPf;I>>c7aHjM zss%mK73?dWpy~=A-qQ!07K!oF-a|09RI2*u4>NpoEhmX9E8kDGw$NB5wLxdHMU~1> zK{RaCrx99JDS!LQt&@L{*nSI{BqpYME7M0y$$E!APselx_a;t|GvhV7(F>iOvKmc# zD>KbwMISe%7f3St9Mr5EUS$FG4KmBY!jfV%q{1nkTjYIYER>LM&`_ii64Heqt<5MP zS%ff|QR^23@Mu#|P{wCKeu9mDRnS3h!m_S4@AU{h~EmH;#a!)7Qr<1#XVH9;@u%){$Vr)A) zDfl!=^o*(lyhMwTYHw)EhqISj)rP!LaC_}bkvU#{#3;6OM*k~if#oTDF-DKlkXbz8 zJ&N=VR&Q+;XWqvY-y26Q$F&LZK45x?IKE;?3aQ^3T3Vtp4ZrlUeP0(n*A?c@V7@Iq zT&k+SCgj@i5%;-@_KrZV3_BBgV@FMKx&a=mkLSWT;eZ7U&dp*M1!TqhCkGO~48q<< zj{aUYS(8_Mvk*`sL6y_Ee$X~=*6q!F>a&DMk}Gjx$cNU3iDa_y;w{UdkY1aIc`n@^ zwm6(0O-`)iY?mk{o1rJ%=519KbFFfM>|R-cmh6-h@Y3}gDm|&^;fp-(7>?d@1p5>~ zg-0ZQrSg*4l2OZSjrQdzcQe_m5BjrQ{Opl*61ci0-&J)FZXeIk&RhQxsAH;>;6@b5c?w=`KdQrd*X1c!;3w)F4Ki=MYA360$ z#Q*Kvrh{s~AfEUR@fhNMX!nSJ_a}&7*yZG}P%{@nScF?l$5N0&f#Z9?csyBPed{u? zWeZ60MNV&X0!!M%qL5ZBNc~Dglg@pjH%}UstL1_(H25~Py>+w>SUt`^ytfQ-1JSN| z79klFQY#ETcOITY{F=4bpg(&LU_8@3(KGOpO21#Fq^V$oLiCN8K z6f;qV;lzbB?DZo2WJOOC7&9rw1;x}Da+QgOcnk@8B5b12jAkA&rJ64sv=fLM#l#M9 zpvCwr9+?d-m%lGANsh1LUftyroAQGy+$3G7@$CJ+JaP}@#rltKh_-*B7 zapyQ^q09F!ZHti{D6C34=isUuD)lb{8DieIY-9)&Az#5APPM01T$3e_6WlPTVs15? zi+9=L5-`778_6mffTP$wA483K85eaeLb?n5-nxpEnat4sPJ{9D<4)V?h=wIP1ThYh z#CcQ}VqFG%hGYZBE->EW1rG1h1!pAQ>Il~dfUNN+3i|c>+QmcVXmP>#!7D(>sKh3G zyP52T?jzl3J8EC0+WgkeoOWzuxhe%M4?n-(q~&w4nfAiXeo~zVsZ}t$B%RHxqUtzz zZnDNQHXq)xO3DmRbS`ZN#4*l--ASKW?!?&QlTkEx_eTWsp+fIAX@+K=)T2QOnLdU# z>L=o1>D8P$vQ>TP8H;5jZdh|Hr6kFW8vdd7=P}e~xU;L2!R3xljs64I7Kd}|!!M7A zUM-Q{;2l@((Zxi03peF8Dyd0zYB`(Qh$mGKdbZZh%!%z84DzJB^DNq!D5*Gj%{^~~ zQ1XWEBxi&iw>)fKU-Pp}B?3J_`Qtmvzw+@88%EH3N&h7tRR816$32MarJeF~Hg|ZW zFgU~NXW$?J^~c(V(S+RYs# zR?bjyKU@%i-hxO7tcCsw9R`)y>*gFB4}auQN76w%q4VX9B@>35{ zU@)dh47ztEBp<7sZZzjWpxq!WTFI;{zD3IY?u6g;=_zoVN`Wp9bKp0~Gx$@MVs)S( z%ZlwGv%LGzM{j)AbT=342ItLYE=!DSWtxkr?QdlJJ>>U|Z_K|NzW1WWZnTO@l+k~y zV|3$K+*hQPJbM(qHtf8g^dwfeUO+m0L+&@ogWN+tNAMLg@x%|vXT$_mthZu5&WzZj zGUQZ13W%!E6MQY0;oj|q&D_qRh-41-(Wt<+AJ&^NRzQ?#L!KW_ax|YK_``V3Ng6F* zQNU7{|Lp}H?9TeZdUFBTqe*drvK6PV2it8X1iN0JxQ!7@c1PVVm4d-hNkgH*9>u#H z6&>wgxUeUvq}eu^c}TgcUAw}y#g(Uxr$m==D@8q;E3MjZ!@TT~Fq~jDS~Yp~3{dkp zFJ%BV{{o(foFRSO?NR-kV?fPs->Z3=J2h_&sCgmsvO6_Tzo+jHArcbeSkIO4UZ$5A zafSQh^aGVGyMQo7j{ANeU4Nten^&JZT7#|@w>%*wQNfI(2dHEs_yvckJwfecHY-1b zjAe$}pS^^^axAildFKi|DYWt=45(3|$D!mY#2rOT$~Umz+mKA5xkkH*5#Kb64Kzzo zYYwr4hVS#G4g`+}TO&v2uXjQN$H{|Blcb|sR?CS;O^_J!-wf%Ajkn;^|hATClc$wsRmfb9#H| za`s9!*whTHOd&s}B5_rN0AC%2+0EbygkY?`1#6`qXvUlKPHeq0iiwZLw3U89^^y9R zDb{0@&JQa5BF%u{?6!(tJMOyq{dxCA+_H6%F-dj61T;f|;JBT-v+IndBl;3Q$c^B2~ z=KqoL4y+UVe7xG-1p-)NU3zh+Y)sma17=A0Jo;ipYrVw$OAj90mxeekiT=WyTQ2$s>=$2TVZo?ll|$c)*yESzW&Q! z+?tM+jThJQzbN^iZq2K;ayILqknd?sa;+HP#;E`iL^5_Dme(JHLQZE9e;pMn##uo0 zmV;2#mm=T&V~Q*qcrF-ii2NI*4g5;o?hru93(o-89>$u!1oGs3BqT{?rX++Y{Q925 z-}`gTNe1oWD**DDw-+Igom!gQXf|_vUKS9l+BQ0zAL~`0I(;z5uWB4WF>AhhE#LPygSgQS;G zjK0&flm2lfTG2aQbqK^mOX(jJsWC9VnYes^X0-AmQ?co61)tSMJ|ILbxlu@cHi7nl zf2i5}HXY>^Ma)+yhkfm7W7j8=$7t@DBQdw>&HFy)201&i97UnX;vdzE0rg{Y%ZQ-~Q5fnWqM_sQ zgvks!8H$B5dUif@q@aY82!4b@2?9#JWMsIo4t9CQD2Ie@`rpwUzWR$+>u75tDuK!i zDR2)H`*?7Ur|Hb0&%r=d$lq+OQ}C%xU&!yhoP9nt8pJt6ri@0Cg|j2DO*(Z)dHfxz z#iBNR^$1@);S7mIXY!bZEa{81LUQvI{zO>PuIhYFvrOT8%KILV)tjq{ksDS(Ae$c0 zsmQa}^eDjT(wsR##$HaZ*AEg*f@H|FNx&^8?|_4Dp7DIa;RFeMFFfD~3bA3qF$)EO zr;5||QR^)-cx(;%F}F+ibKad-uw(iv<6Zbua{;Itm0T9#4OA1k>N|&JI{GF`?BZ8S z9!@YdCw?!ekbDN_QVT4PlS}5SY;5 zEMDVE=2K8abpmore>t|cu&9}C{kGglTk-h_b=aH!x;^n-sCS2%kWSN!P99oGJwL$#;l1VT)bC+#9yTcn`E{1nLvW&Y?SJFQPx36TshszEvY^zI#4ONN2N00%YUegW8J*ps7TiqnJNTr7 zYzS(Cu|`+LRpV{f3e$BVo*F~6!z!ga>SMmmUUDV$^385RG*ju12tHezwIfyD#iL#> zB|z@-rpV2^MrY+HSDPKDT@@kIl%1~ zx~w{tFP-h2^{AUt1}|%PnoV9}3DcxMeRpuzy*0Jdziii&5V^Y;25^-?q?V3vY>?Kr@N>To8ZMM~d<*-4xonL@QOF2%sPJ=9B zMhK9Lsve@HCe3mBv`9Q8HqDfilxWD%2We!(+@mw5m!Dr58$1)LkSc=%kMN2ek~AvT zXCys=HYh8RyBad1kWwav@gor>s@G=|xSQ?#uUt*gh=(ncF$(}F6r(D>5y)aM!KY= z1wp#IyHn{_x__JP@f`7ZKYE_$+<(2V!!aDg;o5xncCXJh=Uj8m>jC9~j&}TWr?)U1 z4hh;V@|vnuyMv5ONa&wR93CS|X6BAj7auDY)qjYZHgW=cT2ot8{iq-6DILd>8N+^g zeAzMCTM}bXq+%IS*|^1gd2Sh-!0sw8#F#goS|w&M>ioyH%ry16)C1ckGRlJ1r(>Ll zyirgW%*2g`V=+#Kl~@d>hLAP2rt+y=SfE!V$k4ojrn;OI>di|0?u1)dsV)@(pLC83si078)rc;X{1$(6f-N>HFO55%VkqmMY+`amyM$5GL82BbHfI)jB!KjH58 zDgA%o?rp$(hr6sm3(S9?yFWB@uzvOX{8bYO>mA!mAa{Yez^~Ua{-f&2Z#99i0=;s+ z3E7`?{i8(k8%-bp^J&XbTBQ1u=gV;-1)m?jN`6SlOGuPn%F^1TH)k%WAyz7V&Gl(= z>b)}A%&-u@0;(Zr%DVD~?l5HO{+9l}XV8*a~|JU~4astqB1h9DlGi zxTsE8N}6)=zUEi9!gGbI(R^iV2}^qlzH zB7q$cJzJzjHq!M*PR!)LzBPbBtf*k|6vXWSSwYiAhMbw3*q4~wgc|RpeQcwCM8h%n zwB%slP|(S!-GI8-d2U{iP%-{hy*ZCY-CRm5#tIlTz@N*4%6WsG%ZeBfN$U~WXw$FE zvcwY;JvG6vB7(NYzwhJ0E%oW4pEv|)#xUW!Jh{YD@5a3)e>Otv5HO#4Jw3X^g4IBt zMJgfV<`4k{zWDt&OrQ3H!!k7YNjZBjG@d^+KE7(-KmI6UBgnsaHcPA^MEiN>C0gDz z!RWQm**l~WFgl{%<1j$2`=XL;7S5|r%}hj3MA}{(1zHGN^AYlFw{3E3SEn+H;k7FX zJNl>n7pgcu?yDSg*wMzhy}`cv8Y@|p1>4#m;WO$hoafSwO%`d|wf77xlEq~5)irhs zHQaQ4rR!O0KEAd&e+y&M9AalRZJlPl_P&bP-)HVt2i+!IrK z@TqGZr5(i?TDjxY)-V`r;PQ;tp0a&urY3v${e9LN1%)hFNHv+!_|5e3WF6%^7!zeD zDlg{r&$vxzqp2*10L-W(Id| zpX4A!ZD!)j$27Q+{*p5g`S{VEd)X(~*DfXR1XlJ6?-FXX`g-t-mVMtUzbSf1Ry&jK6Lf34FL;$Fz4`8UMk$JN}fvj%k0Bt>2ek z{$%SPXN>j!6Ecy4?ZH% zGL+k@+5FOrfDmeQ-wq`Qsfc$qAMBO zqlO-ZJbI5+`s(vWKL%aO*@5;pfKMMBB<74Et?cvj#4r&mGjbWm1fV(FO6Ad`E59h= zn5T4gtiU5nr<~~@7>I|THZMP-dtapRB@%2G(k7-Bz}7DSwl05T>*HXjKgzI+`k7|dA=^4P zUFoApA8PdtRzU%qrCfgw809c$%0-Ma{G+IdG8vwOwP5EQ9o(10b(;wp{px0NwuX=& zy4xCTB=~1M{7-F};A5*BEmSy?EDoL#!KkNXzP5k?ynP=cf1Qd~`+&EP40!uQ+w!hZ zWynjKPD|mOw$t|NM`>`bEbwP13*MoRnm3voC{oPX6B*TJD!Fj3*LY%Y?!9ZSCeRTf6=03`{* z#$-2ub-X=6uh7JNAsIRPwkJ(=XCvS?uphoi(d(1C<|O~y29DI*s(>HVpH%@a(5C&z z+ltu(rc$7~(b)(C9R)bKBqi`=%V)=%8;@_R0);yg-&Y0bTxCA6doj`X2B|&28Ua)V z1o2;n-c|*AZ>s`{P_2|BLpeKuuy-bEHY16Uh=5?LJ>zxJ$bAlCFqx+q^q8b_{cced zC_0&|5g?+S2Uvt)hfWU&==A83!eb!#a`=s5TqGf(7J5Mfbx8=1NFN5jHDr>y1Tmx# zLp8v)5$X0JD8%+Ba7AQ^tQeq}U%VrVAmW?y6(vD?(Mn(bc(9q?N5FLl66F(%}3ppzD}yA$8;T zB;cp`H`P_6b<4nD>ql%!G!>Z0+0(hG0Br5vnLldrnS5`TUDF2VDFMAv*LL|<{EWty zPl{M{efTI$AczE$8oY8K{75zp)Pi#>ix!(r6^6mRUe*c_aC6M%7g21^KH?N|u(!%r zlOcCVGg1W)e_wRdB>Q^jwj|K!PGPz9ly~?U0pTrL(@SpAYOEIw1&G;^>?yf@rULdq z)LMz)vztp99i_3jGW(wZhBo3n^BM7VH@+;hGwrr|VpYR(IpeN$bFV?XP4Vw&y<<`L z^SJe!Ezx&zE6@<{Uq>s@VCWl_ZV?H5xL?Pucg*bm!MZ!Pe*ae7ddC{$e}mTN%D4T` zFBde^g`sn?@js?_Fp30YkV~6gDIR)8RB5DF6Lxj2E;x|Oju(k{C5}GvYAkuRWaW2R z&qj`-eHsx!*(!@HBZ{0(+?~&Xi>JN3#_^HKUPB*qFy1aK&3M7O6-+4Tb6HovAfln} z2qA)U)qX8wIh|o21VWJu{uSs*qD!S`1NQ#V&4m+)7a;9`3&m~#UsxfE0z#;*R{&pFG0a_LsP+b1)p*Ul`+%xI ztP`gugJmY*Ol>=w;Kaf5C1{c;`}8!AAdGd=(_35E2Rn%F?RyFRB(%b9PReo4jw6ZG zo-rK+sNK33W*tG!v~vQWI?0L4#aG1+dncIhgxL6G>s}Ue_-j;1AZ`Oou7PS;y{w4v z1|r>o3D2oT_>yw&5v2{39flCeMfl{thjK<2W0-uw%zxU063!@u!f(l3`oLN8pqaob zHeH-{D_lSt=4FKe-ZgT@I_fNRSg9&TLI)T)= zW7DO4z*}B%v6{;Rz=aR>6ljMxS|89kvGf_^#Wu-s0?CgQ!7^t6RN^U(? z#azuPSKNa`oX&Z0!(=&(^MX=#-6$~$2BZU`ylca3nKB2~ok+4S$nLaaJMpc+%E|`q zP)&gsC4T;+(eX)^_B_^UT$@0~)6(2*9cT>xIa^}Q33zhnbko?J>f?>$?Nja7llBr8 z=VMTw5~ApwZI{m@zHn`Mi4X~`PrnTpSPsB3gu;E%Y40Zu4Vk_J7aywD7w+32?dOQT zwa>z^UjHPqc@0EJYIjNILT#vi0P8g_QcpcqvwSL;`5OKjqF1?OYm z^;u>(OMv%I40!MSlleYK2B^)cLBkK7HbYHk&xN{9wOr2EiXm|x`!Iaw8bwG<+^UJ^ zcKO_J4Rr$v>D6cT6SV$1YW?OU^c`A(c5VMRw6X&2fWB{JV5R>tY6ZHx{RUdUZ#n~_ z_4lIIJEn907FzGvcl?1?7Jwhd?;d6qDt1KzhS=0yJht_@AH@6~x9qv>i-gnIg!|a0 zxOs3XrPdY2Qm|bRJzkSBZ{P9_nrJ-R<6_DVXe1C4*QF-W3DWK+aW=yME7V^7;8Hto5gf zTaG&y7f(-Wh%OMUVG0sB=_-6?hQ^ccoAq=lqa2bwcvfl;aHYftaM!NiG9w0-N()?6 z1y+(I+e>JL4(!|=*ltV)CtgD5Ibb@!m6cfnf6|?}@^K7uF+K?2^vs8mI*_+OFOJ+Z zHotgkD=BKb#KLT5Y=_5P1wL>?+0nt2);&UPON zg~_8}YR*st4YJ7xS#j3v+S+l9`tb>jN^jph1rXJH3EZknjEd`qD_-p(__3|LA6k23 zvDdNM%OGrI(8v3W_vknHQk`TFTNx%rc41-{C6!YKoj)r+rb*CKHhuB5H1(QD7Kzvn zE1!0EYt>12KsV8xX;I;&ql3emWkn%D&E8UB9XJbbJOSHdhRU!xq*qUMP98>iGhjpR zkSI3M$sqXZN{&i=6on#(SQpe4Xd_JFdlZm^7f<95QcK8Qm=ZmhrFH*)Z>B5JQO2?o z4{Pkx1JtC)XZCU}RR_Xb``hb?Ykg60EaT8;`DNyke5D%q1K4FU+8`XHTRtA2fr`J9 z&WX!}SdKjqC&ggt(o>^vTBd7@xkQP7mqQ_xds1dND6U!g8B`=MT`g=36-R^U&_A=L`(Zcl-fb zg8l3Kx#Qq<%aO09I=?)&`Ozikx7X4BqvM``ehGpVXfN^Y)BO`hzh9p$SM0Kw0m8^J z8bPOureoJALT*zv!utV3(Yqs24&=kJ0&*r^nNY;CElY4`^NA4@#QVa?3~{i& zaRzbpz7{j!e5Oigm1#q7f~XbR4G-15bKJ=S9{a(+&I#x6-<5276-G?FsJ?HtM4jRMmNfnILy9M`K~T-iTMy_iASfx+S}dK) z)N0S~vC7f4s>~C4KSB-=^$Wx>sybJxrDmf**c!KU8!3D?X&%I3`NGb9vdXPw)D6o) zUr672J+Iza-Kp%d*0G^>5DOJTNjr?k7G3N80cX<~d0WT`G;~Ww4E+bAcjLmZ@SO%Do!5mqrmOHF=0?UcRtc0-4{3#5q$ zBaavKvqQ6ReUF3e8_zVn62EnR)79@)GLxNXjqKi>#bVP+C)->P&yg#d)HeC zYY9mQQe+3S7D096M9(v}gt}i`r%@Fy1%#|(M zGr+}Z(yU07DWqF+%}$gtrya2`N=ybnd(QIgK)-rw=ux5H47=D>qAH7ZwFBOJGOZ^s zvn@WD!*cEnaI4Iy^Pfzj4+IM2++^^yP;8E?6WZ7H0d)m+^G9SsgsA}6N;*DO=9{AH$5eAgQ`8DlJYKg zINC``T1#rCar4MIw?Fru-XwyE_$&z%0|vE-3O*9@AsupNX^}x-NHuI#ZJj4Um^`dt zQ<`?cedj~m);gqL_-1EFnI%v_gPIsoU7`T{z|-65q>RRjtIGdz>lV1>TnC_>$NEf= zFo^?-GJ`$LPoQUU95q_Z9s~9fG;wO?n`eeMa%OlDQ#k?r>*CzU zo=(7u*wq)$J&G|Y!ld1wSTCi>E49`Y+UTE}Zd_DVYB{^?H!F2}cUpB$fAPLLm$_Tc z2i*PT`8!m`WKxJk5?^$*Wpn%vqegW)@(#7y2*$vY-!$Tb7eKT-p5Aik;ru6pGSMF z(U0BS(pqgu0kJ2qu3R?15oh2L#QQpRK8MZT zG=7ts!OkdIX~h%Qt;lg^h%W8q$r{V#5&G0jsQ%i^4S(9Rh z7rEL_O71uklrJgmW=#kXp+j_#MM{^ul`{F`q;w)EGBy}v=ewemAU^Xe0iM!vWNQ=J zXoRU3NvS6-PyJ+c?8@uoS^DSIEr0&kq!x{{pSa>o)*e{AuC?ep9#>6$E;n2 zij}Kfd=U_6tWg(5<^=!I*UHOvJtHCdWD9*Mmd-V$l z<9ZD{?{gF!L)cC62X+ubxvyT5Kah*Anmg`NoiZ3NAOaze)3L0E7%0ow-fYpcE9x`a zvq55;b>=&zp@_bjJcgmB^0EG0EhTxmiMZ%aLOw13cb45TbNV^UzS)?3$1fvB!cyOs*VyJcZOA+VS@5R z?NI?@fTN6z6??BY@V%}nNS4ShQLI`cQx=WG^Pd790cKPoP(Q{iMC_jy#rJr^G}53J?($$UM)%;!!*a?@TbFQ}ZleJF?oK(TGZV$Bm2(B4>=LZdv91~|y5 zS-#TwvI=2KTKl*PRtlj zOrfemBQC7nEH zd=;bKHqVU0vtJ?t+IJjSAA}@&R`QscCIJRR**Qf-r^|Lp7zW~dJz^6(Z;alWy1RkuKFx;2U)Y_i;>%ztE7o$t3JxVjzj;o@r`jV%*cJJ> zED}bWyIU+fAp27RJJ~?#W*h9gFQm+i5@Zz}84@#UZb9&Ir8dcmF^CL7ITzE3Gz2fy z<0>Iu47gf$7n)9k1jsgiN>yv_ImT$9r*V9QLe=5el!J=;sTS~JUjQ%m`S!(x)z=a; z+}z*Sz3~1!g=Z7FrylERXUQQxJ$QL@RGfJX5#!*^`WkL}lC=EaN6{8$*pSDbB_?o>D6 z=dm9xeuBPVhjG9Sc{hyvde{8l4&xYqEKV{0UKn@BEeVLP-(2_4!nohV7tjjeZ;{(S z=+Fj4ZoiE$>L)Rjg80Xd?Erk?M*Rd|hptKAwX&#fV*AMqsw z#Mc5NBK2SRk^$h$I3BSWh%dk;%ivpl#qmjx$1Q;&OS&u}Gcvkw#17Z>--iZt5IS>d z(iicGYGK=V&a^F$!LN%uelmUc3NU+ASYF!aQ5Z&k@yNjRx(S3_@-F3xNLIooHsd9I zHNcrOS6x-3(xrlN@bp2u6?Yv=zS--6`X}5H+*JLgp4wvCZQ8vp?V9U0H#Xa z?}AHyivR6hpKu$;s8_jl z2KO42Mdhp2aL9Z0-K08I6(?IQIn!pjTXjD zhgy#yog|vSV#s8zp{9wXkItjhAVHUQcvJf-iL)c0fTl5@=^e;kp3PG*E#-~sxuDqU z;{h^S13l-(&nxqDI3(;07chSQ?geF=tSu`C)HxCb%(p_g7H_%Ay_w8Az9T&7AKcVsYbj+)L{yvR2L{!Xtu-atPO+`d_J zd>6O@orwPJz>W2ebI2`)fDiZUlKdUxpntONzY%=h8CL&i@b&xjnv0cq0mwW3_O8)! zckbtLN30iWZe%hf8{jU`b0MkP$G0znRE=C-6ou0=V~`ln;j_nMg)7$NpG<*AK(!DA z=JJP-A;$n(papw&z=Uz)&RB`&iH}LG8?(y*SH#`gk)M&visPy&va1jzl}E8IuTa@6 zjCCdu5wONNuv~ynym6`It(DwwcN0hT3n&u=Ypx>T6OuR2xE|!JJOay#Om5{547v=H z?H}subah;KxD47#$kMJs^7vDL00f`1t{yEE5?cgOK^W3$@|1chb1Q1_sa8Uq!bpi2Zzz-vq>YXP~2o65c-7Qa&E?t;A z?;{%sWu2#Sg1&?+n%myrrNzYFQ|9PF2WW#f;{~xx2=M+us`buwviNWl4ZX2%b50;0 z=YlE+Zt11YP7Rv3LmqX3@|vv(1FulpOa~*!fSGieMs2vk?OuLvv3EdRHnzP?Ik5|q zthIF`tg&lKrdCNHzOic(g`Qu)9)M{6z5=#13qM+w-<$EsC9VmpCiP8IC3e6?OGP_2 zU}SMDrYN@97#2+=%zBNChOlJH$FVTX#jykccNEwjf|eB6&eh-I>*O20#?`;#EA}hC z7TUhZ`hbeYs$r$eLmkNY&fg$++Ia&U>;%mu2>R0;!$j za&GRT_z_xO1S$^keJ=Gy?h!di_{J``vZ_jo9nX zEd4*|MMnn+D}ld$V^*EgLfD(zUX2E?56uET7n!W%yD3f{}`TMtXCk*N4r-ZE}u8*9*_6Iyfxe*oe z>gTPA>e8vGp8dvGfa!G+*sIN%%d;#LG70vBwKja9fC)`76vCjBV=Li-gy4z^aO|jJ za)JR8O9P)mTIs|*oxP)!H~$hT~K*4#q`O6fh4C=%VsE7p_)7Nj(-g3{%2KhOtcYzm1&n!hSl zNEDQq!i#~WjL{}LDtwI-R3Y5!Xji<`K~th$;pHg8=Uxy*D9{!NXOOULn?cp(nu0ue zRQI&B zdVyCjBSPTX-|C|#47Pb{)RR?R@Q(Y2-Lyi?9n*SNw5bEpvQOYay&%}&!t&Hhu=S_r zuxmMEq20$q<#ptT%V;;xK4)&S>7hciZ;YAIM1N>}2|1&x7AN6-e2yr*Fs}<`7$83|0{)?X%VEF%4mIxSi0u(WIognIn-x4OW%ZZ>m>*7 ze&L?;_9nfMt}RI6qn zOVE%=bg(X_cv%16sLBY2NGO(ZFO6V1u5niY;TTX=+`iKUdfAiT^#PX4c&&QU+qVJ zdA{9BzW+5e(!+7m2`lB275S+L_+R zH$GhPK$)I|J@I(L!ALgpiQE_GPoQl&kK%Fr!Vl(a(rHBm|& z?$$wTfvGiCr%fV68If@WyWep$YN3C6x=uvpG+2eUhEt8J;{n5Re5VHs*;y;x_6rdErjvn!X^xC9^kg}w;CkCJ|2bGVanWPZj!yu`A zRSNavM}H}W8$c<#e^iP!MVGHi(QkGI22_fj&F_?A;!mZhoN|lbVEC0%=vi6gDuwt{ z@OgE9D)M=)0@ezd!(#o|(=*yj3cB~5S;cH52&4tHcX=6+Y?_Y^PgNw?dpR&N3(~0- zaT@-VVc1rFnDH70q6Iew+T6=DJY@O~$a@$8EF}o*c5hMYgzEe9#A4cbke9TDE6jyU zz2^xI!J8Ei1D2u6PRG{I%v?mUQRr$|vO!6n_v=!UALc)fL$D~)Wrx{l83oX`CxEw) zz|2@-?P$_Fqs-vVAtG`|vYG4U{y1mm(hETklzh&aP-%^~5=)owt7WE&a+wV?!f`*j zKS`120(T(hldC(wo-0{sI>x{>7)cws_8#53Kwg5A=`uV=UZVS0wzJ;aQEtzOux2cr z90+|{|CYrMKeS3O4Y|6rtkl*pXgh5Sk6b9btY|M}Tv!mM19<@yQrXaovel}d1X>Kd z&f(0<;iZkt3M(ED-%AM=5)Rw}=giaV}NK#2i15Bzf79qXz8%27Pf zG~wH)`bfbRAD#q{-DoPGU z@T@TaZj4_hLjeBHjH%X*C_!MKyn7VE!@SF0qF&Uh38qx5RNiJ4DK4{ao?C5(m3*~y z0IhiZO)Kheuh`&-zuv72OCgLeEmI;#_H;pRW@lHeN_F1_U*-&Gn!<9CQBe-jVfADw zd<>|K=&(bFX)T?mP77o6%)5L|D+a3epdNX4(0-^@U#L5~O)K6MAL;%j7Dp|XOF8NQ zu`mSt5LmLleVbM=dmZ>+jB6x}3FP1-uAB_59nm=Kjbn~xyc3M;7~t9JHjtujxi2Mn z>-0>E$^2-oULtV#z5i-FBue7}maGUHN@EeXzc?60$*|sFymSIFzZr~siUG+h8JJO= zsQcdioBjoER%v4%gKzlgdScY`N@7Jx>cJ}Xs30mvwB{uR>WRuwW9v#=Yo!t zQRWj-+i53|Zk{FRT*Pe6R4&|X_#7RVyXZ(A_oKIcf*(IM=j#pRwsu8PzuD$J)ly^1xaRqRSHZ%QUUw24hv>7&6W=~9kZK6eYkn3jfo-&?0`JI zjCP0{;nT6M)TKgJUVHO0FL`jEbc{U0!tf@~sCCh?j+@)?het25V2Wrup2^y(=<911 zSCH2vLvQEsgUYWQ-VBylE;e6A(j|snZ*g6B@GxJ(3#q^@{#_>SSW*34CcYWOd{-<7 z8ejeEGI7Vh<`(zBhx>K8>5hZdKUw!*&nWJgFZ?AF|6ums_ZbD%ZAJn9Eu&cfBcpJ` zLP?gm*y3QM=!&Iqa;O0b(s@@Q{>mWN$#OpA$CTo^1M6f{zm!9(azRp8w=ToY=MyK<|6B*bk%GwB7~MDV~q%;$EW)Y;HLD@0N&?WsKN|ib&$IMwc0GL*k+Ch7b=WtCiK2#*oe^GES5P)d19nP`??{l5`O=c??ncVv#o=B)#wtnHcy>CU_WsCKJYXR^Mb|;3qO6 z_)R8;cJRB!H7kE16a5&^bH2$0*Eg9^{-sRB17#vVeC;op(1ZubgvlM5$iJ0|vRj#O z0LsKd)OIeSu$%8UnV@r~0m{ULpNa=ckA5z=FSGsq&7nT?TrwgzX%19W8$9H2uQ!F2 z=cVG11-9e6(bv=;E1yS&5zHq9GrERA(dtJTj)7fWyH#6D#ekpJQv`_wVyR7aTOz&ihpM2i!rJBS*9A-hO}!7+Be-i@~}Jt zudW}MQS@|b5Ln<(i2^f*L-nu(RX8)C30%%Y1_gvz)MPlVnF7bOJ@dO4fI7ZKgQJ~+&m4O+W_A)emrrAENehyJXBOG;oek;Zus)-j`_B%rZwF1$a#xxul;9;DMNO`)P<|O5 zYvy>tUE(nJX`4ZfW_JnwV<}2Ng6=_a2EbkmwvwOT$X*RKb;} zNw-_@0s?aQBa%!+6GI*TqKBZeR`1D*>N$a_goBtns`c#GR6^hZ_tQU9i5-}=oUf^b zx{;7g&`s9&sl=Ze;ZAe>CGx9AL;^KJ=vE^#02)F0okmb&cZS@i66&gvcy@B0lYms> z*@T{(VCLWu;Cw<60wVO0A4be=Dp4MGs}bt2_i_bN=qfciH{T@A2)m&SJB$LdAg7z_ z8U^Lb`bNdsiXn;lXh79z3M=d7w(}6A-2xh*>XgTX7>tih4i3o+l6hlVj6AotTdFWg zF7<+Thah?+xPyPMI0(KV2Q#aO)G)F(MH;J{R8$k^yIkVvTmW;4 zu$@erB-4YsK3rffVF}D7UZ5pA0}d#BZW2F+zRo-C@s(=?%Yv>GG&y*~Njibz=@&x9%yp`>&Yjx4TwDOlsGhP`}MLu2;3RBL6C6}SI-T>~|D zg!1u4nK`1>2Nut(_o5!-N!JS|*9^woshQV?_b)%Vx1PefuH&KoT_o-pl>J;Jz8Ud+ zmq`Ha(EfFixZ@La3wz+h{W_Dl<7@U$*8SHri95y+e`FFYfCG!)J;g4JmAJk8;kS2& zemLwkT6x`iT6r~Tl5eh%Ri(g{=A$>{hlD)Ld{eJ$)=WJ~o}WQZH2KM?V*t(@FojS6 zG=Z@FlLw#yI@DW%uB8dXfO{aIJWe&Lss+%3GAfN?JpU2K3y(iyTm*ckIV;*%uRu!zX*c#NQ^#%q#5 z>q9fWrG*obRa|WENh}xS+shwNNlI&Q9RXI;QGga4*Q_ZqhZ-w1+NWa5DH8>zvH)dp z?z&jno_k_-+W&FDaOk4<&IMV8QS!=Od@PjIWgGNCTO@@~wSEy!PDh7o zwFQ9~m$75+jBzNN!2$b2`|QgN4=I~V`%h*Jr8f9x=+MWdoL?w=LLz66si?XP@^3v- zk_@SMu_*w%c8|1u2;t#D#?D67pbF~DB?5;d54OCEktw{qi~GSK5R+_2Aj>G${K6oBRiN7&Rrgd-pE#CH*x3~kP%AjTA|IW3d(y1=dNqN0?LKz4 z#Ycj@y#)b1jvL$e(EC_=7cg$Cr zy~cFf0SABH>f3Y14>px$_H>&_TcdaLR z^No(NQ)Dh|{#q^r>D zqPpFhQ28a0Vj8I?CBu14K|e7<$PGka;Uh3iy%nK|)r^{uk574mAhxNIhbe71u#b3v z(E{n5mCT19(MfM{Ia=*k?|q~g#aZ35-Zw>M3z97b^>AoPvdnE)+$OM9Fp&;(%7jWq zCj7kuwoRv^Hw;1{qSH+_Y)|@AL&$AARkgW52{V6LmwQDIr=h5vq(cVl8=|FRvc41+ zM_<-ccF{#64vd*zD9u&`!|M5Dq~OTuOsR&*%28qQkmhQ;UKyR2n#p$K5p7gvaf;xm zV&q&AUK+Sxo~preol(%GktN&NZBec{lNBDWg*1Q&G%q~-`}Z1Xk?}2=__+#ywW+xC zy$0G9{U25MkMA`NpM`~`?F&LxLRO%$hAg2v3^z9+;7I{b1@raq?mi!I0SpblrH!7x zjp}U!E3G<>2#q9-fGRZ;A@H~Q?bGVo5~|WMu~4%Bh85E>(o!=6QZss5CTcpsHFG*9 z25MR+CcwXwv(vG4veGA{5jVClg`wdiKWyZgC(&!Zm~ z{|~pcfOaPT>4*ML>*#;gP4QdXp6zGuA`EoD-y2*gEAgxqulNot&_GA$ z6s6E;^)9eLw#Cf5b~l`{=ox1$A|h_Lq(+z0V*t$)}%w zs0@M5X`?@K9f}z1g-YkzsKGqd7CI?dLBpg;KnXQTrD> z7g+zc`PqQp33oUD*T4JrW&H}Lf3*1-8L8O-*BNg&KO-SM9SimC&%NFH^bBnObnCPH zxb=VNb^ZEb{vpD@*!pZg8ch6b@$J@U1Ph1r0^)c^T9 z)?d3*{N~pG{uBE{@tFZf_P?w6eX;8K)3jI}dsk>xX4-vUrb(WAH%;Nd`9alS)vOQY z>2n>6Z)wzDr7*r7OHkCO_fr~P-nbFHZXh!TOvrc>VB9Md6sHqciq@A(3RbAKyyJ5o z(CSa(8Aojo9&wyPm_lDr#VKO(;yq_Txi?9sO>7kn)0f_G2FOOCeJ-+hGPgjT5MRtP?LMvN2% zhx%yH?DM1Z+Wt+fl%b)FZiga;;ujN2yIWV|A0`y49MRpA-QqZV`@4fggW%~V1{kdS z9*EI>vQ0D59u&cT0GQE((G!C@Ed2>|`~DjG*5xOFxu?ih3Zize*8OtB9hU_M zL8yYXZT5(!(iahiXCAL()|k_Myu?@d`bb?*kJJ=}lE;L~t+igZia$N8EvmrRtWcix z3)*z8pGR9bc`{L;e-_Q8<|1bqrV#sabmzDQil|ln6?@?gu4&WWHjlp2hRjWR3N+41 z18UW}JB?(TisWttxKoMyMbo%IbYBRG@e+ge#(Eo% z#B2jTapI+Kc*8a6`Tdhmy3s#j>-Pfv)4+-iXj^cHt!zMRmVYO(`YuYjGm9HYjNhtd zv)!3r{twpOF_`(65(c(AgUJ6^_~;3mp+)mMae{ebo~xk##8`n`+)|pHXi#XQIf^y# zEm;bwB#q_5!)LD;UTu>kqlpDXWPQ33xp5##BnIUPifdQP4509%cs6vY%|8h9bY3zy zOvF_LC16A6Ig;@n^hb)8gdXo@X5k)hB@PjOO0xJ1*@pvg#^H;#HA9axg(s}MU6YqW zU7KZJy$uEo*r^KELot7zyTAlb&DHkwGg*~YUPOb@j!(*=xc>wfKQ%AhYWtZ&g^ee8 zFQJiXvuMy;t-3=j_JjtTXB!qdo}i?YSbJ-a2AIexs9LzcI5Rt)LAYjT3?)2?Xpe+y zC20|aW>j?z4gC4b7l(q+(lFS%kBWDMPt1?b=*DER+SOdq@uY{k4kSD(q0+5H2NJw zK!tXYPbbp6-rWS?-vWd;>=qzd4kR|OG^jRKXSc|b|CKQOIVDWH*V-; zX$oeF_eXP)uXgOX2*F>?VTAi(!fWe#FuH;T+yX@TCjh}Q0s>^=K9YOmUjWJayghe7 z&@s>396Mj)w1WxjbbK;Gu>0J!=}^s*Bdu+tZ($3_!ftDm-`5-1fHSkd4;+9G z_se<%8*m8r|7P7ktB(F&^l@j@_BVVm|Iw@c8`G`(V*e99+6H~etWo5oI3xzJO|_%RmvU>E1`JC-A)TM2%cHrV$augd@3AFxlpB8*RQTyReYklpz(a=qr|28 zv9S#U2gPGj3g%Wd?txY|!}g&@liR6Wo_W4}5A}@(wX#&GFeOCm3WnI2}1Pr3#BaI*HBEE@j-#1kAY-L++RHrP)4^?#2jn) zJi}(dUOA|qc6OaI(8i(6J2-QeyPW)>Ru;SBHg2^eQOBjI93=N)2JxW}k^|eOc*3j9 z1@m`S1>gaBf1C!c@doY_n3Yaz1T-3xx_q*2v1{6-=L&3K z|Btx0fU9cT+J|Wn5Tqmo1nJytIz_s>k?yX|rn?cOyCelfX^=)lX=#y=5Co)4Lh@UH zdi0$0zxUktz3=Zc_TFo)IcASB<{V?pXNg^|KM?m?T_$D1nuq9`}iJ9 zkgmUx9{+yvam5dRk{wsY8PF81e^k z^7LwIxF+lEzUvo!oQk4z5?CWC5d`43ET&*>{yr4#_O2I;!p9B zaO1XkcB1VE3YKE5 zfeC1GyXxE~)X>UJ1B(+;rQJ0sC1fHzBWR+R3t=R5Jm~HSJ>4Bi4AjmyTWxYm%Q7EY zkloHBb#TS*cSu`4@1FBqwg;a)F}4+m;+yoj5o_+7e1^nf?>YZh+3_3T`rofSuDIcM z+3^Dp{(rIZ;Q0=G{L9AWH^kse8E{p(e;_-4JsA9-(EVSmJg$J3e+Z=SvV#j)y!}(V z#|w2i`}79@Lb1j=T>yN$Pt`-ZXR0;D${fm{j}?no{X52?CV|0Hj29>Ua3Kir74N%t zk=NJL-S=iN%!1}4u&3;bAm6P9@%8EgiIE5M)KR z7sNCKO@<_I!+wC%#Jhn$qIUNYLmWuzaI8AH z0qIV-M*V|3%Dx0Du+0r@BufIhI?+a&>9_D})Ffjxh3p@~3vsY?^R2+zCu|kv4(rK# zqRX~THauBgXDBd{Y`6W!o*u+CZcZ)pd?J8AQ5CzCdr&fN;xw5{?siMIUL4Je$ozuY z!t`6QxD!~F8G5~wR`XeEeKQ*I`A7Z*2d6y&&omBhg3|)0=9AfRONVzchPg3d?Alfz zbv7Ggon&}~LT?W+Pzyd9Hy?d?k5FPrLb{QeyaSh(im3cPxg0`34KH`@OJ#c6W?kya= z(B`mEdq`Caefdz}M8~~bAz83#h&a;(YDwpufg?V_dTy^|BN+6_r!}2E546h z1h&bG(8sIAOk<~}j=t1YA^mjFRAsH_IU>dTF9yC?Y+o?VDEm<$rGg&M+aAm_^3H$N zhF>NT)NXGo<4Eby>JrarWA|a;FnfG^fyvyta-SeC%3-3V?EG^n6pVptv!1iMYd8hVF;_;;BkflAXpHuc@Zo(m} zAAezacF%xMADu^5F?+Xp(Ml-vD>ix^i9nA);!V`C?$AdZ8~5qeL+gTErFh1aUfAlL z^GoDqEj{T`mtHzPSFU~Bt7J-q19vwzwi^CIT3kIk(C_?k;rMP80=V{XB+ah|!T*P( zxpZ~@Nzz;`AO2T9)gO}P58o5dHNr6&&vyu7o@)?f;QI2FzRJM&VF2EsAGJlxFO0Q3|q7Z)=akO{0TT+BQiz!vR?U+T&&1rp-t z2VE8b5;DGYM1fR5YRXcV|7k6pogH{VAXiscW~iN|oteFpt*HsKy^}de&_w`DZ79G- z?JNL++B&(@0sEw1MC;!GLI1~<2Q29vKoC9~8wWEx5DEhZ_L-dAmu>v+RQnGqZ)a~~ zZ*FOKRdZ2$S34VfLlX$FCv`A&f`FV%ZS9>+nQSbLoD7}ZnJn$B0Ouai56liGW`Azh zuYRik;h3-k%>eeUtSqd|T!5z&%mHTRVrBjRw^_fwS^9t2EHEcC7qD~xIa;iMe*yf9 zALPF^TDGRnrcMq{m!E$(K)=4a>VMc0z=_KRASJP}vM_@=fB^!tGjspXc;;VDyMNP= zzpOE?LYn{WzJ~2rz?Q4E$v>m}?QISJk9`dQN(C_C_4Y~}05k?)6$Y%A#DTl4*MNK1 z#vUhoV--`tK~4rz6cr}}shYYu|K@n-Vf!`6iCVhENmsgtmKop!1vfNdY2vF$YU{8|$!=yPQ)!kWDDkP(BmZkQZ?&d=oKLJs-YZ z;B_C3(75aF)}!U)`;DbEIJjuRBxowy-FG6vJ<;NeC$Lsu^k+Tq+m<9aNJwTSCE#cq zg^1+9!^ESoBE)$F{EPjnqdA}mCOhC7cRG+pYt!<)2_@V|5Z=^hD?3UGKz-g zrl=qhdpl>qW(NV((_i)E6&5|9I{ynR@?Z4iHD2xSQ|0R3Kh}eP6QjYx%mEk$z--*i zJOCU8E0~p;4KPoDIoO%OJY0Xs-G3CL!NK-tN9}LGyq64j)t~=<6Y(2-_J2V4+e-lc zmQnwi#qx?>e{|~)4g@OopKxG13px-gaWqb9G|#QSh=iT(D4aJRz%6T25_6Q&gR#A} zGimo;T-_2*O)mXtabjx%L7Nl~C-wz04tm_q_Gyx35tUQCQnaFgC>0BQ?d{KIW&X`= zU3L-^j0W`-Q%KN9iyBKJ&tmyHxt%LF$vxoqi$Z+6xCmy385RhOMea#8*g19xskDC@ zVyBxnCUgVgAETUM8%tEXvI>-X=0n1xq-^_WCVFnaPz8ddDh?#a{2s}NP1pIJy;8!_5hE0^dI5n!#ZW_>U=|_7z zb^yR9d^=q0w3(5r*B@9F+jFNiU*iLJ)QV^b6#84ehn1j`3(vA-|E}HFeeWiGY_zVz2r^KOC7=q@F?Kk zyW~wa9`65?H`)Kho8Z3$LR@v{ci#MWQ509mu0I&$l0pB57|hMd%mcVI{t`v;XPnsI zi2p?t#h-Cv|1sUKE4crKQ~=gHEMz|#{ll67H2j}Rg}3Tcc9Rcoc`q}Zsy}yrS;eJK z#Gyv3SdgofNVZQdhG%%w$$A}EL~L)LWUBYASx&fi@uPr4r-O`Cwl&x#m~(I_va003 zr~8GGp8X~>aONR=TMzrl!u)TcnT2MOSEd9~@XN#J)Fwo9rP_6KrW+XZDB3A!azi5F zpF3{3JQ4C{4fV}_$<~xl^ARUOO|nO^^jJ}cCn9x3r=jBM=FlKM2h%EI)HjrXM@6+x z5dJNk#41&EW1M-dT2v`2af6yflx^DhCUOPGoYTV+RhN-Fy@*IeAsqvS84NPrERW|U z&Bs07OFT(stPfG4$wtj@$19wZF)!Mh476d@>saY~3lTcmW4fT{-oQX&-pf9Ftv1+S z^5VpiR4uP!EP{4mdT3jugp0q|SWpo0lP|up z%N?lEd9XPeycH|tNXnW+zRTEDu#@qkjX~fW&%HOX%XGp!BCLuQ#Mreuw6x_~{Q@XQ z>N{W=80n;6m0Qs>N+GVf=%5qjto1319?oRh+X4~Q}8IywbAPPdk2CKcwtdde}dXh+^zV3PI_V10X^c^5oVLU|8A z6gAz(tN#;OI{%E70Vi?V#OEDwj$NEi^m44&YNd59QyI}P{H$)j8SJKFuF~1#rBwf} zi+plVaS@65W@GYoxDTVA9!xja#o#`4Hmln_Z z#j`R~RXGhy{%-c$tGmYsRwpeucl^JgG6$`q*%5V}=8&?sPCqRXDi z=jho7E*~$My9|uaq0@cr4~Zu4mN@PXzlkdt-_f8hrtBq6d-0K7f_r}i_59d#mn%4g zCi<^(`ro6x@?5dj@5YAz0?O+TW5XYNZ}4yN5toANSCrR(BlW<43Cj2nhMoPd)0ry}r$x~}~s3$FLF#!+lhggIaBLXmcX@WfL~ zPa*e`L0s&>T-ai4>6O-5x%ped_h~1CBu^c^`|Foy5NPjh=Y-L%JA|k7vY28APhkmJ zkALILrGCvx?jj*e(iqa^B_BgUs2;^F^pxm@yuo|w6=6%TzVOYAm3FeshPCNC*~pM1 zOs|?xh)wVE11$-|=>`+=+YqEbd~vdzNo{zOwZ>jouG*!OK<`h)uy@{sO#eX%Jh;To zHL>c@CnQw(qE>|RX@>5gu_kScU8=M|rYk#3TbB9hX;*!20`72EwCw57a@ic)B4Sdj zFe=(>EF5%5-O13NTWOUEq&$Vd8ZGLX<3Woqb^7y+CbJzo+p)v8`xw2BapF77e%Zkn z#_W3!bvx=p2~F=N+a`;9XwXx!;1lx(8B>iq@CDq8CQqmDBI#GPlSCqQt7K`{)CvA< zR}}6=*%Q!%#X3Wc+?&KQ*qf}7B-c5>%R3XBr=8+=GUCE>q&(vzzEVc%F>P^Th;4EV zel+~CsEHG|hmK$5Z7`dy5~74ijTbCE4FYq=KwW@w;2K?bi$w8Rwy(WL)_HIk?P{+lPhkkOtO|;_^M)2@82Y(yVv}%Dy*IaORc0y=20^PSHy;qNOf> zYEVD4=-`9GyG!A`q{V4|>z1fed@18&{=Kr?1~wgg!iU1K4c>Xe`}jqY!bJ>-J#pL7 zoE-(;$7(XZgN1^1Laj1M%+2h84YDvHD}rn$$QZP*IJszJxq~!O!Vz5 z7MhCJnDNsX9yPJAzM=It!F3J#qU;U`qWHpA@2unhjXe6*4Dk2s#=qjW^86QY zTmLGLc>avr3RoboZ3voL+GPJqD*S3AxRPW4knUI0$=|Mp{s#t&E4#;^7e>G-?tdy3 zY5=JKxM;lx%H}NLnA|=fp<7IfOj3<-+Qus%RLkLk<%c=-;f5=G1@ENCV8+*4C(|0} z>p$__tjEW(@jo((5bfG4784F&$+`XT;8j|9BBsD|0iBI`A}{UP)a?XFIlr{xXGFfP zjE5s6npG&&3GrQ>islE-hJLZGjmHRIs(6|nG^uYB%}|YsXu98Hd|fQ_0FL2_R_D_S zF!a&HhIp;s3vPz@CUNwb%}EfKEm4Ct%Z8rOIhV$d+^um6&4y0HkKROM zA)GHjAc>PZ@Qdg%AVpnb3hCxO0fw+QqBF*y-@4HdQVAEOj6LEof9w()*9_G`HSh)1 z5tX}pRL!Sm6bCNF>Jb+Mba~=2i!pq}E6B%J_{{0H;1B)rJ&qK29YiX0 z;o#v&U|e*b5Od3)kFM7sl;y-R#}Z^c(DQCQ_3}=P3=IUCIqb4&Mz@U^7ugiOC>(&C5Qn+FS`ycl7+1R^vZ!l z+O~O$){>UEC-4k!EuSHhrt3M5))RQ7lxt@#eTmpp1uP_|F0}iSLmO=MWbB-mj0;ArO>&CEB&{2*FWQr z{$slTizUo&h;!E+DrRSFZ(?a@jtUaBG&3^=g7J(^FONmBkb#(i6H+FoW@KQHiM_L- zu`yut1DRQZ%xpkrPKMVWAq%LTxuFx(*2WO(43dS|7(y&SHrHSF=Js}`)*vS!Z!$2; zADMwcMoy+KrXX8OJ17L$;s5c39i(k+=mhwgJg&d4KY_AsOd$}<%Sv4SumYKx0snw{ z02KjhXzB#5hdKd+08|xX=>~!T9cc$L zy($TC!q>^XJH3-7~eZv2=h~LO>>l=H{kO-@h)${kl13Hl}WuW8`dM54{>{ zmFr1r4z;wonl@JzR1gCx*qWLff}9LZERBJZ4IO})=5{p>z_B3qKkCTN^|Smd%B%SY z6nEV+BjEU*sWS)=jF)_6YJ2r{)l!f%khQ6;p_4TT@~0YHliHhtL``j+4M8^c9;SBY zrXVd7OMn-ErU9;+U$~JI{C$R-0Nzi~)jYnOoHhUpfQ+F|m*T)3+uo#**ij)5)dRL1`_#EC9!K_v1?+nUx>wiQb}E>k-APJ^-CJ5pJ~LL zEkN?u#VK4TSGZ2D@Jn)q?+JcV*+OlcEgfv!K?>KLt9DJQc1^1G3#r;q8m;SxsuuQ6 zb|8Q+Yyl}}WCH{z41LSAZcw!2G|Sbs)p5ZZHHy)Q@hsWJ-Y8^qSc8 z7h+)OzEfFVr?I?F^IfJ~F`?zpG^Ri|*j*QAf1TX^I=THXS=xV3@RQ2K(!~;}p#60x zK(7g**M!ht2%$eI+^-)3tPga8`;XhdTD{qR+tFNGNrC7KFb@wZ==usUWpi`0{kUQy z<6vk1aY4q$2>_2={rUG8-W!@4Ix16Dx5Z)<6YeSFa^Aa@Pvsl~kKzwA?1@E1c?Ttk zk}^jIOIQWrjkx`A#IR_AWa2#%teXZxSh3WS71?fqq|t|N-i`Jbv%XuQ&0}6{vwdFH zW4*U=z%S!?qR8t4juH69keJa_kYy`oN?S}AaA!0-u$>P%^0OUaNEC&I-n@BUflGWO zfzMkc1E++`2pj!C>C62w(iXoPj}W@rVYp>Uo<1u@$tyEN6(qSq34N6jv`>uyyF`Xa z`KjEEH;63TyIF|;ZBMe~8$+Q;DoN_2xIr>45{EpEqvbw7W`6?7*A1SEFh!3GGV>D> zzJkznSksDR)6_C9@oxihd89llJlrCg+dR|#&?m+){i*ydJdFLFe1`|o6t+8&FR+~2 z=fSg6?MK*)Hrtwa^#^b5xWY^$d^3e0)A?b`l0HRJL40r*2K|9&mu+D!24%pk&`~X6 zaAyz#&JEF5H-jkx$u+rR&ixVMm3+t^kbesxZ@aj2bcg{L3Qxe823Hrb`IX|^TY0WP zJHZ2LTGShNV7S{%3|Y8grhG26ct$YsMP4ny`PQfBHVHlG?|Cyi(=WfOaCWg!oF|e! z((_796_(IlO$-L3@UZx4{x;v5pvURxeB*oK;Il^cagek~(;ZmFlOb%~-Y2%-{3%(z z)nUIJ4kaO+zq6OlHW(s&@7L5APx-Ez?vBmS%+p%t|=Yg*z+#m-z ze8;O=dhX-56Y5A2=YmSK_KeKin2xP{lm3FtZ)Tla+Xcs?7p5J_$l#MN4By1v z1FE;E5@nxYh%Lc}%)KG#v5)fC@h6^KjLo9A&|!vdO%lL*N3Lqg*`8{;>kR5I?fVHg zR=(@t(l-?ALL_cyn8>t!>ZL~&@Th+6nFcG?QZs29SB6XKx>1-s_Gn}F{8qu!5z5}a zwal&KN-3NnjmDA5Y3BiQjiwvvpuo~6jI+c3e6&jjA4|caR80Td0wHuS(eWu9Ypo^O*oXs5f4)W^c#C4xS zt*WQIRq~!Z6U@qC@7on5XOmel(e}uElLe-%wWk{UnI(!Z!U|)u@Ck~ODBeN8SDut+ zUJUhSPjaWVQOf){IMlPmTIFHGNWjb&U>~~xwoHiTRx~o zh$mQ&VlJnn(U(FW`J8DGZzw$Wa%rG@W-ejRK&`0DxsLurP|IN#CSK;$5VcMJv)uN> zW8meaFX(M2;wZ>;Q0XLR754JK{zbQy!V(H`P`lVxE{cQ2MCv$bTc*>M^#Bqf!%?ho{gd*A8} zoxd2{DET%y!qO7ergfHB8i^d)#8z{>coyoij1RoKM1@mrK%;^H33NlmVsDV0X#d;h zAOw3Wk?{DJybXBtGN?Cxg;JV;!j{HYL3v_9L8!}WL@Xc6|r_7>e4FJ8Qd zj%Cn2?s}z&7-%SG@ou^^OQKg(wvYRy-fKsuQ4*uW4XjgmRrhYi7DQ%^9+&Nc>7~&8 zNvnQsJKwG;uGQmxx6+yb2+dwSMid@icuFLN+B+fYq2r0p#|XA>`*{P^y6bns9om^c zU}BbZKZMIO?5oVuq#d=jF6(I->>Ga5DPtYmh80E3$GvU`Aq_F8QcE^VyH_Caq$Bwz zQbA@KZOGoiU|rd+0^6)=*R2QC{*a(f#O1G!rR92^Z;HAY3d!EzS7)aC#0y?vY;Q(; zJZL=VO|cwA%_+8StovzXjNk2|AdCHFUa%$KqC(i>EVpXc+30Kaixs9Q=7om$X*R`Y zBUBO#mBC=g*)GSc=Yx5^D`+d=Z{eb=@nT0C@MF{0vTg# zkfPhE;an+N!(AGyZ^|c4rw#FN<$FmuZ>heh&F^@e=L1O%fG7S=WVwsYM8dcNj&^B({yhf$! z-D!VppAxfVBl0XNcg>^8H=$(b58jNvfq$#nMq=@0NlYvmS2N^JBTrtl3Nvk}hNB}! zmdCwe_l}1wZ#?OVjo&>X@@6a~Xz@Mhh=+l%LKO?F2>}^nki?tu4>+AAhCa{eSD_&A zCe`8cD4IK`646uTDPuj!+n(d96>$C96PL_K$SvsMfAeJZ4YL5lww+!}IXS_7H^pJ@ z$&iot)pzCl&lou-izya(+K!V-%Y2lBAABgF{*oNPmqL-yy=)szSnSc4=5H(3ZT=NU z`hASTezn;`eZ-JG(Sxjo&B-*)?E*wdBA5?Xf5 zGWXyWKEAJ{JS$=f5gXbhOfQUZCv};n%8Kr|ZQ*;5InspI`hz5y4Le#Zf%Oep)dTek z_bh??_|ARSfdcIB7|S-L_kAR=&7EGZxnm}k%7!u(f)>Nx;+S#osY=fh38C1^@(mdp z$`f}Dw4|hfzY0as!40J2Y<1zCd{bqy5~3GRY(jQptZ^cmryIPZxNfChwuFT;qG)qm z5*B^Z;f`ml`ZVF*fpz5tutBpKX5|bfp z1IcUgh7PfRDx*J8d+6@ZBXvVjjQc(~mJ?iuq$L=sej)0)J?SCO=9xW@SKIW4gFc07 zCq6qoNBiJKN3WzN?E9_L7dJR778X~IqC0kv+xi)h)JsaU)=2q{XVN~+7)JOCpbhk# zqKy%FuP=OvE>yXt5m!~1K}`Rh90BD3E3KVN zgy+_)jfEz2zW7u|wd|dwgdBl$HEW)GGoe)5e*Sf;^FYfDZ(?0W1 z&+f;u9+*LekP>sE+6U7B!g#t;&g`PvrY>W?J`6P_mrm zQEQWJd=^AfL=EBMllHXG>z3d=eeRxnFO@sjw%p;~1Y*zV{>7+9*mPC$q!tIRD*!Ab!tKVE#aiSME3iX=h z7^&M)UAgU_iqB7B22=I4$Kdt5Van5r{E^Dn$rh`(zbS!=yU_8(?7F~;9fO~IQ0~w2 zmX@o?cYQT8PH7r8DQJhF?VDpKZ|3$;NgKaSl9pf}=?y%l?b13k{q&w;eG`0B%q!jU zP-At*I#p+5WPpBK`zzbhhbKBjw(P3C!opmlETOyOxdjgQsl0nxgn=4mKBFl^{E%`p zqxir+2%loyyb!Wcws$w7u_1+5P)6Rzx^h{vZm{ssoiiS?wpP)Q#DR&{D=mA5-l_Zf$v!W(J5IkZd!vNQq+IT59IS^mHmqTVr7yvGN<1#Fo_J?gu>dFFZ2-rsfi!fjdb*8(nnz$uU;?K?rz$E%%F5zV1`f&kROW1(EzJ78Ueb4z%ttBdI=qO`Q z*=_}CXzu{S5XUH6wX(y(&8TWsmQl7jWi=?Xv>ao1-vC64QL09nrMjA3)qzn?gN0p< zh2!>*EV{nobZH--Mqw zh9w^d!UmzwLEVL*Ny{il;Ck(;C`arLCWaIWe_TpWi_=PrU|!RTONmciPf5;-f0k`+ zk!x;XgBsh#=+gUKQtn03JYq!QQb9H!B7uiN=obkw1b1FU3lSqcM*NtR zR1Iupt(a#9ev0TzckUg%VxjMOt{BES$i~8gK#w3yz;OE=^M|I-rwM&c&WIE$Y{74G zbKgia!)GgrKYfb&J_I$@ovs)UwHWUK^4i+sVlqq(EsV%hb#kWGFf`oakPsx)W2x}& ziMKrAZwbkGm}OhJc@{NP*NE=We$h_ThN($Op-V|m|By>7%gjVC{f+^)@U}tNt0T+Q zSBkQ7FC^ub8r+!#CmN`%k85iap`{U^=SJ_BPu-0+dehgD@41Y=>z6IQ$(e~?l%iMp z`Tc8&hbI^j=K2ZS(zRLiI@My8AIfMpd+&YXc-VNGF(PHqph162yxh$c@_~KEcXG9i z9}_?1UCPL@8y5Iwhl`j(JT?=hLz)3Tk8YPnDbKH z7N?h!7X>$pp7?y^{5C!D@O~ET{98NSRs50ly7(4KAJ5l#>FO^2^Lt_s&@o|$}B ze(15ZS+!Qkkvgjr2d#iSdbKENU-G0B^wg^fU$b^yX^ze({DqOPW_;x%ExTSdi6_x% z_^w9!pDU(A^QT(XWCys-ZjtU7e#1DN_T>th7Wgpu&4fBIuKf&e^Pb1s@Wz)!UGj=v zntR=3r5=es7X99_4IC!}jdl3bSQCW1ArO0Q<@Sy)0dFwg1%hkX8>ZHSCZ}2feW|Gu zl&H6pS{Q_ktUX+ykD86zOAp?HZnO?$9uIL9t`1~1xeTpP#J+$%=(K-Y_La+(4((hu zyP|vN%ML>SD+VFP_k^eM#<}ZyTjRI{f}PKuH;~~`VLueXw!ilKoH6<)H}3S~n_L@a z7_K(&roSjr*5AT^|Dh7SI;R83|DQ?}P$9o*QQ+#Q7X5x8;}0#Wt*I;}tjHiDr=kT| zq5q^eS+8Q5e^n*dcmAw5Ie;Sm(3^mr8t@kX(3@Z$K!g3EH-9hhcTLI8%)$mN0KRKW zK(PPNmh5bR$iK|vyS4<5I5J&^2VDtyF0RYN7=NQIe|jH()sELX<<}G$2P($z!Z{Dw-0M_5)^M7bIFz4lB;fHDibMgFf`6uND zAc0?NH=yB`Hh@zKI7?*%c(X-K0dKu2aG(+u;taUAZBgAOpT9JAHq$LIeEo9`!}|xmNUFNT9(gwTrV_@pKGb@6&J1+^K@$CQc6EVe{FU^ z{osZtA3oA;aWhiCfPxp{B~?w$nZ$vpgCFs>KXk!L2$8QMu)9=Lzr8jFCAbNOG+$;2Zx3(3KyT;@(W+S_r3z3lBsD|eyoPtTvk+Wfx zgLO)J`hd@z?B-l!GtR3e!P_t@o_uV*zS0o0(+H|{bQUCTJ{UQs3p;p^6gZM|$02xP zKl$3E{(j$C*ra|K2#qmca;tzt1+wO3>SSHonaEt(S>su25OK!(h4}dS{u!c5rK^i0 zC$!Sp0rvFWGfL{6yZpM0k-F#I8#doQ+$_I1=Nj&t8Qp&p2P6*uwgv^)Rzr~LU<7o| zyG`K`QnYya00{8&cW3y0ZQZ;2M5X;nE=w2Pex!2<>|8FaRj|B#7s1~m&JIZOCSQ}bep9r`VO>fAJe=-KO%{eYMWWKmxkHD$n1%{@VEhzeSsBrpedy7}miu|xAa*GyCu&EnFY=rqGr_CbI~}BC$Vbaj6=0WR-{3n_+LLbQ zcR5c#Jdm67jXAw|73%^%pF%g}+iMMAVPm}r9U9hpJq&O0)MUlT3iim(X78oS#pL^q zK0kTRB$rpMkItuLVc^l&_I!7WwKUVTr_M$^qAna@H~P*QzO~*vlgX5lc_^)^8?f0r zQ+y##clLfp?A^#GP{oDPqo(GG3+>ZD@_R;Gu-j%wo^XVk6D_dZ7u27P40p~1O-}Gb z76m`-b}-8)k-|*3Qn6K?K0LZ`JBJip=o`G*kllE9o{Fc2Z_HQKy0G7heo-f2ieGjxOTP^GYMR8=mi+s7inB(x)M@0AKXPdk}ML@%F}iO6|A6m~(2d{vbj*U-H%4rpsInd1Taq ztZyPA?+CWm#Og^I)YmfhVxnVkM|xQ}hWJl-zt$C5zMh@nGS_uwHcu+t`pSkT5x(=B z>J)dcI<=~+ZY6qruKJ^-!`|bl*ZH_w-Sw5`g|lkaQ!w}4je?Q;C}gUWn7!nV1yod0 zJv2%_2285-XevnYIW;1lD@#Uk*WYzz6-ID}Bg9VX7CsQI+x##w=lHaN8c{OXZHn#&BV8G3mn$nBp*&-dVpTSr*(_tQ6n_IpvV>+s`Jcyt)`HK;c;mql$T znkXuqR3l5MZp_dIym{}HDHSWI_0@)Jl9hYSemQm_reiO6$~ZUjvr8*&sX0}#N$aRv zz;(r%wpj(*`GkXI5@HSvUm zR1a{i=eMq^4}6Xr^K^}kRBCv%8}hy}dp)ZFqm@HM?D_0uz?|-JJ;BPB2?dkp-Dkxg zS`@`QJ`TN)U09Esvp{?1J#T^J*7}-;OF`iUw(_A(ynM1Axbo2;&fBEWiQ<%irUy$Q z@oy`kW^0)KeK6E8yzeC{0m+tP%<5gI)_GZu% zadZ2nCG-YH;|EuXX!_d3`BvUqaIX%>WQTWd^W+^J^7pS{vqF>Y%%wZryr>_29)>iYH`^y zSuJn75^-!55xi61cJUQnZC|q<;ml)kP8yG_Cq{gzxf{|Pm7#a^)G*^)3{PsHt}0ZW zH#fl8I;WpBIBwPGonB~t`|AwujFJ;q+M#lnKJDRi>yAO&AgY>3vksVM9mubi zXDT5$64rplaA8J8RK)d_)pL4@86o=#PAFJ-nOk#Q#f@J06SVznD(mzH5_41-!QuKE zo@fRh|7@c4ihJLS-HE`;g>F6v|2=CmDUYUVO{Fk2Cb2$|u7n-hc!iAA^b}*=rdiaW z@x6zN(W=$3UwYzwUasEhjp(?GQy$DgXqK|&U-{N4%gza&H$Ls9&FPk_wcg4W-thif zl$t75Pg@BIbU~MyG54kK0}Bn+u+in5m)-K-6_20dl~@D|DMK0T{S3bHP6jhkGpS^r z^2I%q`>k4>!XJtV$#3LoEPe}ZOb>&`o8~KSk_&P4=OxO-rsE{TkI3s^OGhZuu?Gjmo^B4lvLRJ{Z@R&5>h*EeT(I}P z{&4^+IUH|gvdu^Qvr`ghwn6}~Mk{WzKiz*h-$nY?V4vu+AWP?0I61so2TO!pSGuY3 zrzDl$WG86RbhoT%UsDs$c*UP`qhZQy;p!|JX$;U37Y3413Eh7EbW1d*65q znW3K}n1+?&dZS>`GlUdZCRPNq&L1&&CHqz}AXrl&ot$%&zI?&F*wD;Z|E770CeQrNbc%dxBV0bbg zZnx0S8j2LaZde0vb(oVex+j|pOYw=}e83CGsGe@?kZTq^qc+kup5uVogN-H(->O}i z=6eg9huG3Up5*bC)ObS#k>rH2(VD=CFKjeiaT;=)N&E@2k18kau;fn0vIsg#Bdk2yZ&4#V$T=!FWY7V)2oQP?>(?-_!>8JjnBzItkUm?c-`fAWaUa7RGqS2 zKR((ZamJUPkP3NqL=?V~l$hg3W??hL7~AWC`pO_1h3|uY;}=0LS~+Ze?K?$i5zfW$ zleuZJAUqtHMQ0cX@8DD7=}3DdTB527l0k_AQ16msoZ5jU@-8dmgU@H`2E9-RLq6$# z3btVwD^k?e?QhwwQv&b$9Us!(I3?1}Z%ihwsghpGK|c@=s69C1TO8j}dN(VP}STPK#w$Di25 zLb*@%SA(%zmOG+;JUz~ezF2v8k2qdsG>9lbYXyS!@7a^MftPf^kIwSu<~4D~m%yF0 z`W4CWW*n3kJuDuS`3MO`#A3S`&-Tm00I0)R&<$_zBK7y*UI=w1YBErU;c;%?IN~;7 zJ+HfXVevR3-iWmR2*J*-tJTX%)kmf3t1~TY5f>4A{~*l#@dDg{txs0VXPQc1Gcf~J zwH&j-=9IaO$=^%y3b*6ChdhFO^TLey}Ytb1!UG|P4|E+iCqGxzOyCEfan zLJOs0I}r`ILv)zxP1FjWdsTW)guhqJ557I6*O~!SYsoGd6e)TEHEbTE(7Nq2u-o`H zIX1jA6lLteinJ&{YuveK$S@|7WfcN{_adFR`cU(W5kg-jl36aD16i|m!V1pW*eEn& z3_`!Ilv$?>A)y)!V4 z-WMWvGv?X2$rtFO*0koBLcV75={dhHQZNSh9>&n3Vw0G=){wfwRNfAp5lu-D7k{a& z3-(a5n%U(mcb>fC9ar)HTDZ_{*M zPgOf}*2#d^|KTb=SOTTl%ZC{3XDzsO+2y9t8kH`Hk+sT=?e}dyc6yyAiS)qMB3j)3 z9dYc-rqMM~N&Qdi0Zpj9w{J#HY1#No0ie&}Nw05;6E6i6(eh{_NUmJ?XSM~cGPDp2 zkMSIv9IAa|wJqOi8>)zG7sn|PmE!Q1lcRm@u`}TP6AQv?eL>^*dz=r>FudFMc&dp~Nc=x|pk(Ux zC0Q>H32|gv!``o}3$&&X;=1!}rb_h7-mM^{Pq@!_7!-lCH;t2i$A`CqFlocUxS^o8 zWOu5pn~b?0(H3qt+&9GT&}=?f-%DR4kMka>2@)fRI-xAzCNtMf7oJl3Hj%)=6iE*s zk3rm+{8=nsD*PpBNae8L?L9-PxyV(8DFm;fB(^}mS0BoV_)64XW+a`H46owcNPflB zSk#G3G3FTLh8mN)1>M-4HKITihJjVaM*)#ZpBsdRi4}Gmf<87LTh987Eu6HF^2$sJ zYv0{C#_205p5~&I4KHvE^PSr?WMEFXp!E4$ zIgokeuDC@qasPUx9%~^13O@XuGbNB1iUFRNr>1ABy-)&?&%{YAb%e9o{Rf3J%4i*~~kgBQU-dCMu%0ImSBN${`ewrs^x~%M|@NQtF<(<<6dn z5G4^QS66#s{6e{yPUf8W(F3X4^B2W_>&a#)=B67r=IA-*_73K6QE^6A`uL;HQc~=6 z9db6j8yyWl@ZvOA;uYTxU|H#kgMG1|K00oPVBm?5+~R#B{Fzl}6cx@Kx;^UKi!&j^ zI%1YKqN?*He`ZPRFSoM=vMCp6Czkcc2^jPKT&QOqVHo+REyup%wI;mt5qs7U^w&xxuZPAfk1`tbKcg;T ztPhIS-4Kw&42kq%#pAr|g9po8PHGm|8gAeu(K-pEpe!R1S4Ao;LJLF6Ny$oU!CH>+ z!YBzPm*5>P{PPkHHNQ!RR3}U?d_6-Bz37t0kF(|caM%wi86LK6v#VlrO1Dz-tf`G| zcXgrQ70-Q*u%oY#NI!~0xAoY!U4GmXmX~rIW*Ym-&ti78f)~nPpFAe&8mf3)Q?V&d zzPT_s=w79midLgK@$#gdi$!nMwVV{uxVJhvQh9@l!=3jYh*Ec@Al>bP`;9;xDoy=T z>KK-^M52SxMCRA~Ac>4wCOh=7hPNx?79!`*G(J&Nz0Cev)k!2|LVl!bTcBvawx;&M zgxsM=Gh)wrCi(MLr;Y7!IBumKuB~^v3g0~?{{UAVcPXyk^HB7=4jM|Q8q+Gt9go<2 zc!#GgoE|O(fT5@m(oeNwb#ZT`Kjowz6>ZRXAlFpwnbNp_;pvk}y~u!}x*N>SGf%TO z@&cQO`)Pkqt>;o)?6U51Oy?<78FeE8G!aQ=cN@#p{bf+HteFIiAZPL#58I^Q^RUOV zp1x1QrCq8kXd<7cVJ6TM!sC9f=s+bn!{^o*l}~&6xK5Tyo?O^3NIw~ouaVQYpNcbD zf0D(vS2H=tR_uZ`|NKG2OuREOpTn0BGRl?5!SPciN2ZVOj;U|UL{3*s} zVP_+wt)M%BG63`@sMTWJL-vBpn{#!#JO1q_1+0%StEiSZ(L0^%JJB6vC99sr&vEYV zK*}cJRT5c!{fOBW=#W&D^-%pO%3YAx@?E?I^TAb^6XefJ!kNM&oOZqxcoO-4rY}y` zTgsmN82m|>9=DmvN&Ec&W9}Yo=n8~4$IX*4EFN)GXrb%qz;Hwopi4%@m)_1>mW#K3Wsj`(hE z5ZP$ZS#{0u4(Kzbmcu0JLyJ|Z8Fe^9{vaOd%;E&)I@Rq3(RwB3=nk6riF}s&_x-sY z=;sKF5@C(@p&~i!ii@jxqPVtxk$9(D0bc?PYEk1f!2=!Id09f2EI>s~J8ooePo52+ zoWtwgllYB~lcWFulw{%r42>4brg!@Jn8wUh!NV5G=>+B*;_VEFrWK1MkB$W-RJo%c z#POhd=lMGsb%(QXLpa3f*wBjckz7z$6Na$}-4SQYL2JxBi0#DupqPlCs1R1yaFV+d zx&EGpahD`@eCrm3)d^$X`+aNe1&_be$~ zfz+r&spU3|9Z;`SX;uQakAK!|&zpFud3Dz6gjShL!A)7)C&jyHda&(Vr?(J(_+jh? z@z1^7TO1VShWx|KOs$;}cCB73%Ye+(SLf!My?6x>dk`l6($sij(`|2I{C7Mx+PbmSPmtqRjr%>`w5Hu*`d({ZvZT_@ zG}yB(1!{HCD04n4q^!A<852?gp|qn0UPB_M9=S zdUsSl8AVq{H)#U4F7pra{dY#hQ!E=3n?}t~ZWxM&R>iC6!ROfG28E&vtg)kI+M=43 zq2T#oG`kc%V@(O@QFA*Ld-Pak>D5FpH@z%2w+KpkU~4oYTnBS!J1A3Snq7jalmG!A z)sMn@nOPn5L~3tfM}u86>{DVVXNm60tsZ_yUw2QmPYVA+z8hECG^v@cosrT-J^cX*k%PXy;%C`RQ){aB1KQNxpDSEyV^7c2g~ zBO}AaSY@J$aAMU7&g=Cwp=PqwdD0x%A{^&!#ltX(xjN4p=|RzmoyPbXSMddLvsASQXWT!qO{?2A-otN@S{+JdIHOKMN5}cXSW22 z-Oc%gE>$>Fywfrg;MK)zu@uP`gh~GrW;I}`)kt=Ak?LVHuxRYc$<`*V?u!J4_w8`i zP+rBJxD(Tix{~_F5d3TMfVKLPQRt40z3S}RkDjaBJ$gh z@fY9K_VJ5o^el~F=dai~su^}wvBb!)$?w~U=@F|v0;!Qi)1cN6TMWWsW)$>Ep+Bn6 zqdX5xrMQxnXQZaXl;r4C1|sJ+6+yDmjPNx#XtfK_JxrfA< z6Ps1SCjnw;1Sg`$3`q5x(a4kZi9uVg4eQ72LGVxzopR|U{PzyLI~xAtpxTaBWy!5G zZ=;F@v3Sd-C=;6KG+DsV#w;JeK*j+_YR-s*+b(81hO8kMml*>%6ibVvze=*_C2An@ znu9k|5TwF~%F^1C3A3Rm!I?NzKejMRP?M#OlN;`m=US0JowR{EJeSgm z{>`#CZQuGU*!g4e9^)*l-%MO>a1n8%PtXmNsYLgl8IIxnLdNg`pS#VLMo{BcB0KU0 z*?o2Aa70<3D)xqd@Ix3X##l#iyeyri&a&mUUoAII-%rz za^jH+oUK@I1Xi5B;v5fE(!9^=SmVNx$W8W1k|(Oyr3uZtag}Vl$xoybixGr=e8fPw zJdb3{AD>wWUS!+6X)q#Hp&pf9?-}L%%v@KZ)cG2%)h&Yd<=j`PoU;V7HewKvPAkAr z`tjb>i%coZiu)DXzvDY9&Zdu(opn({c0Ls>(IClB*4yT)usPzo@aLf}Y0KEfqff0_ zdhS~Zx&bm7G7%UC+J2$YfYvH>2oVR-<$#&}hSe3LxrFyT17k?@USvv9X=QmSGZ^_n z9C`XkzEgZRQj&;|d-$}^VtBNC-PCusj`EMn{U*7dfj0GI@?}ik{Jb4tb_(XdnvRjs ziK`6i5{>nkurw+0CQhPu=cB}jNlN(G$M0W&63M|C(P))v4RUd(&*EDxT)ZvsU)6h_ zL}e5vUP}Ir5jm-^e+M&xk?;h=q6^1NRG6jbu?$?lZ~B;08>Mtx=o%0{$+UIsjskym zge{74r^~G8dTPQD&MN@U6?mJ;i z)i7oZ!A(Q~y{uiSOuVt_divP&z)_e}-AOp>UMiTe#=eJClE76yu@(|n#+dP1x`q#K z`Y`}G>y!CgW@ZlbP?cTbRnVjX*;~-LI&@aKzjan@k-5?e&?nw3BNEPD;C=|^(;|`)R-j zb>T9qgSqyVzx7|<38xk;>s{`rL^*~aeQZsw7r*0>P6A)$7HTaXl5j7Bn4CaG=-aJIfk^v?3ap>9U%-ooJBqPc5Lu zjqa&u+vmO~oKDsNzA~llaf`7a2pfFD0kv7C=IV8~4OAGfrg5--{k@U~WkI))p5J@{Ay5^G$Q?vOeHP6>wk+_HOQW5@HNhtOJm; z)&3-#8=1uiaR7PP*jf1fL8KK5uTP4IIn-(#Y2<#!OHn*P5$#Wy`^Yj_|!om-!V zvZ7rt9Dx8s6>Gd(s7`P*+|#z}9xa}^Jop3RG=b1V#z&xm@Mb9o_4e}==)A~AlWKFG zjpIsJ+pc(^`}zKxhV_Q>z}Eq2L{tybyq-QYC*F$)=P5KWXQqjUEltlV|PTI_|F514uUm6Dyl zGkK|*=A;H(uY5FenGtCH2=QfBR9Zh{{E?bM6Bj%{!D)MV*&nt30E_#Rvd( z_SdWL3{Zs{3NGKfu`#!UF_LV@mp}Y0+EDdpg{XJP13;nO* z@9;)mFow{&o3XEpLmuFrPK6$1h4M%5z-OL}w}JtklTpR?mhp)ib1U_rpL339U8fmq zVX`)M1Vk36HEYX@8!oTW2`Y(X_6O`c4y)S?%YN*{`?fN}K^W;|-R)7Ad87hTxlmg7 zynyospJo+j>kEzPmBsG*qcTM6Eb_$~5xB6bf^0gIfe_7+!GlQB47V#eh=}h&6G~IP z4MaWy;E_oF)F}OQEynpfJYzk!#ek2?{ZCYugcwH}TgdZW&4?b*NnZD=&i+cL0)I=~ z0!!pn;_QC8lz4fRBqOfi7F>gKtA?Nws_X_sEU4U_yZ7f^3fcrBDCSwEbw9kC+2z=v z_b=uKsdAy=61;*z7B|=!%q}%L@ClLrS{ZXCUOjooyx;!#d&64KoNW~>9Mc#VoZ>)# zeu2l`C~Y*!=Vu0K%r~plT55L{SuNG@hcNiH;e@hC^0&MX9VoO5vVgqU)it`gX}pqj zfFDw*V~p`@{zL5P7~*z^`fl7x3{!=6=cOH@v&0HTFatA4u4B;WNbC%5Y zKF81=plhYTI5bc{f@o&u_NsNqU>fYbu={yoOAQR44Au8H@*FQMb8o88`oghw;JQo( zG}_T%L;`3;(f1|g7&XH3K{fSnw#G=SDWjzLqqDT@XhJNrol`tN<(ty;ospq+wg8Gp z%!5S?@^dm}QL+j}9YqmeON+IkWyANA9@i%hMH)`Rm?f({mQTsTOg+<|M-=?z7y|@T zNfmgP7BlmUKcNSDtHxO$1?}o!a#wnh!Sv2q4HS`AZZj@tu7Ufe!wr1dtBXLIKy&R# z`1-cs**@_g^L<-{G(H?NLz@Tp8PA5TB= zT;`Y5yD-9m)y~BhPK7|_F(;rwrKB0m||B1+{Bgbj+32Rr) zEjMDuX*-(XcF)8}T+Z6L?T!x7D&m+p-*dwOLPdStKx%g}f^$n0G%&-i$7J;;^?ki{ zeiq%V^3p2!V#UHKw8L;Lhz8#TiO+K{T;w!?(3H0%+Jq|wwJ)t#-G@-$?pjNF z6Ta>lI`Q~eDJQRMKAbUCu6r~hpj9d#vpA>M%K8)`6dSpfH~(s@J4BThe+D%at`hkQ zeNgIKuAT|@T94ItmL+L{N~*c^6O;-Tl_sBaBPM07!ElFJ9zfpdJM0Y3;l~_JA1Gcv zOR1hCCqUS54PDiXh52a0;#voaj%g*t5ml&i_TdV^vUDuGlh*WHTX0g^HV)M2#cbd; z$g7_{hjQQ^Dk!D1g7@w~!AG0aex3N3AwqCSFues!zx$PXj%sG%am{*J`tA4ba>*f> zBp>+JU5dPrMQxnlf&&}Puky;e6(QU6`)pBut6oF^dTxx;T8-M7{%+hVK2-T>`6@#N z{D|XdBNop?fLBCVGneC{UikZ-f;>4VIRKU9c~ZJ29}TOo^x91>j53Okq)-1i+$