[32976] in bugtraq
Announcing Userland Exec
daemon@ATHENA.MIT.EDU (the grugq)
Thu Jan 1 15:14:08 2004
Message-ID: <3FF46EC2.8070402@hcunix.net>
Date: Thu, 01 Jan 2004 19:02:26 +0000
From: the grugq <grugq@hcunix.net>
MIME-Version: 1.0
To: bugtraq@securityfocus.com, full-disclosure@lists.netsys.com
Content-Type: multipart/mixed;
boundary="------------000200000701010608010405"
--------------000200000701010608010405
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Hey,
This is an implementation of userland exec, that is, code which replaces
the current process image with a new one. The accompaning paper explains
the design and implementation of this code. The full src code is also
included.
peace,
--gq
--------------000200000701010608010405
Content-Type: text/plain;
name="ul_exec.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="ul_exec.txt"
The Design and Implementation of Userland Exec
by the grugq
Abstract:
This paper examines a mechanism to execute a binary without the use of the
syscall execve(). The design for this mechanism is simple: clean up the
address space; check for, and load, the dynamic linker; load the binary; set
up the stack; locate the entry point, and transfer control of execution. One
implemenation of this mechanism is used to illustrate this design.
Introduction:
Userland exec replaces the existing process image within the current address
space with a new one. In this, userland exec mimics the behavior of the
system call execve()*. However, because it operates in userland, the kernel
process structures which describe the process image remain unchanged. This
means that the process name reported by system utilities will be the old
process name, etc.
The ability to load a new process image without the direct aid of the kernel
is important in many scenarios. For example: a program (e.g. shellcode) could
load a binary off the wire and execute it without first creating a copy on
disk; or, a program could extract a binary from an encrypted data store and
execute it without creating a plain text image on the disk. Userland exec is
useful for any situation where it is preferable not to create a file on the
disk when executing a program.
This paper will describe the design and implementation of the userland exec
code. First it will discuss how execve() creates a new process image, and what
this process image looks like (including the stack layout). Based on this
knowledge the design of the userland exec code will be examined, using the
userland exec implementation to illustrate concepts.
*) This implementation of userland exec is specific to ELF binaries on i386
Linux systems, however the methodology outlined is universal across Unix-like
systems.
Background:
When a Unix program wants to execute another program it will use the execve()
system call to load the new program as a process image (creating the new
process via fork() is ignored here). The man page for the exec family of
function calls (execl() and the other wrappers for execve()) describes what
happens: "[t]he exec family of functions replaces the current process image
with a new process image." A more complete picture of what happens when a
process image is replaced can be found in the execve() man page:
execve() does not return on success, and the text, data,
bss, and stack of the calling process are overwritten by
that [sic] of the program loaded.
Clearly, the program which calls execve() is taken out of memory and the new
program loaded. When this happens, the .text and .data segments as well as the
heap and the stack are replaced. Any implementation of userland exec would
have to remove the old process' text, data and heap, and reset the stack.
To design a userland exec implementation, a more detailed description of how
execve() operates is required. This more detailed description of how a new
process image is created from an ELF binary would be:
First, execve() cleans the address space of the current process by unmapping
all of the pages of memory which form the existing image. If the executable is
dynamically linked -- that is, if it uses run time libraries provided by the
system -- the dynamic linker is loaded into memory. The main ELF executable is
then mapped into the process address space. The stack is initialized with the
environmental variables and the other parameters to main(). The stack is also
initialized with arguments for the dynamic linker to allow it to locate the
binary in memory. Finally, the kernel determines the correct entry point:
either the dynamic linker, if it is loaded, or the main binary, if it is
not.The kernel then transfers execution to this entry point.
This more detailed description provides a blueprint for the userland exec
implementation. However, some specific details still need to be clarified:
in particular the exact layout of the stack just after the image is created.
The diagram below roughly illustrates this stack layout.
-----------------------------------------
[ 0 ] <-- top of the stack
[ envp strings ]
[ 0 ]
[ argv strings ]
[ 0 ]
[ auxv ]
[ 0 ]
[ envp ]
[ 0 ]
[ argv ]
[ argc ] <-- stack pointer
-----------------------------------------
At the top of the stack are the environmental and argument strings. The bottom
of the stack starts with the argument count, then come the argument
pointerarray and the environmental pointer array. In the middle is the
Elf_aux vector. This array of data structures provides information to the
dynamic linker about the process image, e.g. the location of the program
header table.
The dynamic linker is responsible for relocating the ELF binary, if required,
as well as loading all the necessary libraries and performing run time symbol
resolution. For more information on dynamic linkers see [Levine 1999],
[grugq 2001] and [grugq & scut 2001].
Design:
With a clear understanding of how execve() creates a new process image, it is
possible to enumerate a list of steps that a userland implementation must
follow. That list is:
1. Clean out the address space
2. If the binary is dynamically linked, load the dynamic linker
3. Load the binary
4. Initialize the stack
5. Determine the entry point (i.e. the dynamic linker or the main executable)
6. Transfer execution to the entry point
Note: the second and third step are actually interchangeable.
Implementation:
Step 0, preserving arguments to main()
When userland exec is invoked, it accepts arguments to the main() function of
the new program. While building the new process image, userland exec will
reset the stack and potentially damage those parameters. For this reason, the
first thing that userland exec must do is preserve these arguments for later
use. In this implementation, the arguments are stored in tables allocated with
mmap(). The contents of these tables can then be copied back into the stack
when it is being initialized for the new process image.
Step 1, clean out the address space
To prepare the address space for a new process image userland exec needs to
clean out only certain address ranges, not the entire old image. The address
range of primary importance is the one to which the new program binary has
been relocated. On i386 Linux systems, this address is usually 0x08048000. The
.text segment, and the .data segment, of the current process's binary will be
mapped to this location. Following the .data segment will be the .bss, and
following that, the heap. Userland exec must therefore map the old executable
down, in addition to mapping down the old heap. Depending on the state of the
program, the heap can be of varying size.
The userland exec implementation must determine where the memory range which
comprises the .text, .data and heap, begins and ends so that it can map the
range down. There are several different ways of determining this range. In
some instances, for a specific target, it is possible to hard-code the values.
For a more generic approach, one approach might be to register a signal
handler and start probing the address space, e.g. to determine the end of the
heap. Using the hard coded start address of 0x08048000 and the probed heap
size, userland exec could map down this range.
In this implementation, userland exec uses the process maps file maintained by
the kernel to determine the location and size of the process' .text and .data
segments and the heap. Convieniently, under Linux, the first three lines of
the /proc/self/maps file contain the .text segment, the .data segment and the
heap. By mapping down the first three memory segments listed in the maps file
userland exec can clean the range required for the new .text and .data
segments, and the new heap.
Step 2, check for, and load, the dynamic linker
Determining whether a given ELF binary requires a dynamic linker, or not, is
incredibly straightforward. The execve() man pages describe the exact method
used by the kernel (and by userland exec) to check for a dynamic linker.
If the executable is a dynamically-linked ELF executable,
the interpreter named in the PT_INTERP segment is used to
load the needed shared libraries.
The dynamic linker is only required for those processes which utilize shared
libraries from the system. If a binary requires dynamic linking, the path
to the desired dynamic linker will be stored in a special program header
segment: PT_INTERP. By searching the program header table of the new ELF
image, userland exec can determine whether a dynamic linker is required, and,
simultaneously, which dynamic linker to load. Loading the linker after this is
trivial, requiring only an understanding of how ELF binaries are loaded into
memory. The next section will discuss how this is done.
Step 3, load the main binary
The principle for loading an ELF binary is the same regardless of whether the
binary is loaded from a memory buffer or off the disk. For each PT_LOAD
segment in the program header table, the loader ensures that the ELF image
from p_offset for p_filesz bytes is copied into a memory buffer (with p_flags
permissions) at p_vaddr of p_memsz (aligned to p_align) bytes. That is, each
PT_LOAD segment essentially says "this part of the ELF goes into this part of
the memory image".
The userland exec implementation scans the program header table and determines
the total amount of memory the loaded ELF will occupy. This simply means
aligning the p_memsz values of all the PT_LOAD segments using p_align, then
adding them together. The userland exec code then allocates a memory range
starting from the first PT_LOAD segment's p_vaddr for the total length
previously calculated. With the memory now reserved, all that remains is to
copy the PT_LOAD segments into their appropriate ranges and then set the
segment permissions based on their p_flags.
Step 4, initialize the stack
With the main binary, and any dynamic linker, loaded into memory, the last
major task which still remains is setting up the stack. The stack, at program
start up, has a strict format examined briefly above. To initialize the
stack, userland exec must reset the stack pointer. Performing this is simply
a matter of calculating the size of the stack contents (the argv strings,
environmental strings, auxv, etc. etc.) and subtracting this value from the
stack base. With the space allocated for the new parameters, userland exec can
begin creating the stack layout.
To create the stack layout the userland exec implementation must extract the
saved parameters for the main() function (argc, argv and envp) and copy them
to the stack. This can trivially be accomplished using the saved parameters
from step 0 and some simple pointer arithmetic. The Elf_Aux vector is the only
data structure which requires some explanation. This vector contains data
which the dynamic linker needs in order to integrate with the process image
correctly. There are only a few key pieces of information required by the
dynamic linker to perform its task. These are: its own load address (AT_BASE);
the location of the program header table (AT_PHDR), as well as the number of
program headers (AT_PHNUM); the size of a page of memory (AT_PAGESZ); any
flags to alter its run time behavior (AT_FLAGS), and the entry point for the
main executable (AT_ENTRY).
Step 5, determine entry point
Locating the correct entry point for the new process image is very straight
forward. If a dynamic linker was loaded, then the entry point is the load
address of the linker plus the e_entry value, otherwise it is the main ELF's
e_entry.
Step 6, transfer control of execution
The final step is to start the new process image running by transferring
control of execution to the entry point located during step 5.
These six steps are all that are required to load an arbitrary ELF binary into
an address space and execute it.
Conclusion:
It has been shown that the execve() system call can be mimicked in userland
with a minimum of difficulty. Creating a new process image is a simple matter
of: cleaning out the address space; checking for, and loading, the dynamic
linker; loading the binary; initializing the stack; determining the entry
point and, transferring control of execution. By following these six steps,a
new process image can be created and run. Using this implementation as a start
point, it is possible to create both smaller, and also more elaborate,userland
exec implementations.
History of userland exec:
The author first developed a userland exec implementation in early 2002. The
initial proof of concept implementation demonstrated that it was indeed
possible to mimic execve() in userland. However, several limitations in the
implementation made it unfit for public release. Recently, some people have
posted incredibly crude mechanisms for executing a new binary in an address
space occupied by another process image. Given the severe limitations of this
technique, and the request of a friend for the old proof of concept
implementation, the author felt compelled to implement a fully functional
version of userland exec. Design and implementation took less than 48 hours
to complete.
Acknowledgments:
As always, the creation of any work is not possible without the help of other
individuals. Here, then, is a list of those who've been involved in some
capacity or another in making userland exec: mammon_; gera; duke, and Grendel,
PhD. Additionally thanks to those ppl who made .sg so enjoyable Halvar &
Evelyn, SK, Saumil, Charl and Dave Aitel. And all the ppl who came to my talk.
Bibliography:
http://www.phrack.org/phrack/58/p58-0x05 grugq & scut, 2001
http://downloads.securityfocus.com/library/subversiveld.pdf grugq, 2001
http://www.iecc.com/linker/ levine, 1999
--------------000200000701010608010405
Content-Type: application/x-gzip;
name="ul_exec-1.1.tar.gz"
Content-Transfer-Encoding: base64
Content-Disposition: inline;
filename="ul_exec-1.1.tar.gz"
H4sIADxh9D8AA+xca3vbxrHOV+JXbO1YBiSSInWzI0VJKYqy2cqiDklZ9rF9WAgAKVQggOIi
WW2c337emV1ceHGctLbTnkM8ekRgd3Z2dnZ2dmZ2gNQbOe8da/ObL3g1GjuNJ7u7+OVr/lfe
P3nyZLex19jZ3fmm0WxubW19I3a/JFHZlcaJGQnxTRQEyS/Bfar+P/RK1fzH0ZeTgd8+/1sQ
gdX8f42rPP8vzBtn7HrO5+6j0Ww09nZ2Pjb/zcbO1tz8b+/sbH8jGp+bkGXX//P5b7crh5WJ
ZWntk9PWswEeapem54napRNFQSRqoWObfuJaotat1zdd3/JS2xG1ycS+ErVeLGrjYOomtXFk
Tp1aGLh+4qDVNIycMTA4dg38tW5qV0Hq22Z0f7iFFqbnTvzaOPWtxA38OC/5azoNiycvCPjJ
9T3XdwpwTWv1QSdmLbJuNa139Cc8KTmuB8LyHNPHrxeYNn5i89apB9pp9whQnnuVegwXB9pg
2Bp22zOlpnbc7QxRtBmEyabtOommgRv74lsdCAxNk7/0jG4NreLZYAKGdBRfm5FjXnkO3d9P
rwKPWBaIb/8ovv0fUTv9VifMxib6qrnbT/c2Rc2zNA3MAW8LfN/qrb6BJ0mbkZVrdYxsn6ol
livXZ+pQ32YoOXuGqOWdfq9pzAm0iqbgokIl1n8WVhA5mma7cSIhJMsyuMSJE2HWgzQR68Sm
31tCV9eXvMr6P1tD1mfu4xP6f29vZ29e/+81t1b6/2tcm+s1TayLdhDeR+7kOhG6ZYitRmNb
JNeOmETp5G9U38KWwPWxiJzYiW4du45yquo7pEki6FDSzsL0bZHGjnB9EQdpZDlcAoUF5S/G
QTSNq+LOTa4FNhf6hZ4hLNPAdseuZRKOqoAuFaETYWNJHFuEUXDr2rhJrs2E6RoHnhfcuf4E
usy3XbktAAu1mzrJPt0363OkxSIYZzRZATaxKeYew0lM0EpYzavglqoUKwgJLj+AhnaqgHBj
4QEfoSm65eHN0oROLc90p05EPBJbi4SgwxJHMkIwTjsFcV+GFiFHqTDZgZVOHT8xs0nbxHwE
qI/E1MQW7ppeXDCeJ4wQl4fBg9uus2yY9q0TJW5MXRbtqQMAUuHYMZMUokPTTuIBunkQcTBO
7jBtiizmBDoJPfN+biSwIvzgznPsiUN4aY4rQ0Ih2ZYIZZsUOIXt3DpeAAtGXN3PyvNOXQzx
7MNokaSA4ymEkUZ/L64cohGsDITj20FE9EbUzzRInKy/OOMkBovlIMaonh1TJt8iDh2LpBtN
XRL7iOTalxIex4qVhG74vDsQg97J8LLV7wjcn/d7L7vHnWNx9BqVHdG6GD7v9cVf/tIaoPrx
Y9E6O+b1efZadF6d9zuDgUB998X5aRetgKbfOht2O4Oq6J61Ty+Ou2fPquLoYijOekNx2n3R
HQJs2KsSdkK02FL0TsSLTr/9HI+to+5pd/iaehUn3eEZdXeC/lrivNWHwXJx2uqL84v+eW/A
2GgUx91B+7TVfdE5rgsQgY5F52XnbCgGz1unpzyqfucZCpjydu9s2O+CwF5/II46ILF1dMq4
uB8M87jb77SHNJ7irg0egbrTqhicd9pduum86mAorf7rqkI76PzXBYBQSdiOWy9azzA4/RNs
wQS0L/qdF0QwGDG4OBoMu8OLYUc86/WOB4QK6Aed/stuuzM4EKe9AXPsYtCpopNhi7sHFrAL
1bg/uhh0mXHds2Gn3784H3Z7ZwYhet67BGdAbAutj5nJvTMeM5jU678mvMQPnoOquHzeQXmf
eMpcaxEvBuBee0jYSpDoFfwclgYrzjrPTrvgertDtT1CdNkddAxMWXdAAF3Z82XrNY/xgodP
kwXa5G1JVKs8paJ7IlrHL7tEvAKGIAy6Smh6J4RpcNF+rrivpH5T07SHmWPxfZzYblC//qFU
BAs8sMzZMscbU0GpRFkv51ws7WpxG7jYjWTFyAqm08DXuWy9c3oyukrHVao1o0k8grWL39uZ
Ase/DY0DTaMmmkIz3x4OD7adiVUVFlwAsa6wqAfGoP1Dq+RYK7RLTbAJrkO33IpDcXZxeoo+
tApjNoQcrb7V2HlqHIjNdagTKCn2okRo2jbpwjgQd1BvAfq+TiPsAil0lHcL3UfcrLhjoevU
C9CjY3KBuHddEkoUGoY4lH3D66hgE0wj/0A1ZaIFiJaIJJkzeBpVwUAFEganUUYOnIm46C8G
AytFD5XKBw1/WmVuVnJ+SuYAO9oBbnNdW6c/8dB24AmCEU4yYmbozlUIwDg0Km8JoGLGU/3B
22Qa3HriESh89AgQb/0Hqpp0dV7d5Op4rlrs74sH0QPCbFTlHdAbTAH4uoQEVIsl/TLiHBvj
yFv/dRqOMI2RTv/y1igVYv1Ro2gnJEDRsgKnsP3n0bB3XtGVFBqN921lRRszQq/9i0JPItvx
xttbo861HUFmsd5IZNm9DzGNhLCiAziJ7g3dyErWaUJYmiG47FaKNJTbKwbjxNgcQxMmDthJ
EjA1w5Ed3PmEgJuQ087gUzO3kaps1kAUI+dvqRs5EsC+x+aN0XqufwOjhRCStAIp4RiB3kKm
1pj6NUm8IWV1iajesqjOVyglUBLhD5JW14fVZXru36XFxhJRZ0LAA7Vi0CRUspLPnlyAcgVV
JWMVZYoJr169kobEVeSYN7G0vpbFWapki1yZVx6ZLJYp7Sqtgnm6I0uZVQQZMTl50qxkIh+C
Ww3AfowPCxWKDw9hEbljpSlo6ZMKIBGfUSMsF+CBHJj4UbAE6usQFUPXdakdDTVssaHgaj84
IylRYp+URrkV+JRXKz6Buzw0Wm/M99mFqaCSyPTjMUQEdnISBV7GEN+5E+7UnEhhzFel7F+1
xRjBxAn6gWHMdjd+pJdhwnCDhT5OrRvSyDQRnkPODSx6YRK7o4SnArpZMR8zSuAQ4DSUQg3k
luk/Zi8EnNONuvgTWcBWZMbwkNKEp+rDF4zBlP1/jph9buf/m0/5/03sdM15/7+x92Tl/3+N
a+X/r/z/lf+/8v9X/v/K//939f9J5fiT2bLUhyayZ8vGlp94c03v483kPnTixeLp1PQXS8mH
Wh5pKPwwN2Yfw7F1+J46/tV+CEfUC5nC58PRaa91DJO3KfYF3LJSq+Q97FNnksh2ZTSGWFsT
CtPYM8lzPxT6+cno1U/41zdm0NhmYv5WPJcZnhyRPO/VX7TOR+f97svWsPMT3bfOemevX/Qu
BiXQFkTlTL+pilvqT78xNuCAGrWmYazpP2e3hQNaOI6Y38wbI09MuaHqac7JRDkcBr1cYAgF
epABnnN5mJhXBey5gs3dCtUIboVDLkN4HYzHxjwKPMdw3UYJPP8kSEYeFPKhaKCYsMCRDZOI
PN4rOEB5lKYCPwXwLqx8Ym7m6JIZH6SeNHy4T5KGqsA+KXeEO2wqcFyxucfsD7D5odxZ2szY
BSHHQXeJCPh1+KFRHghXfJ8Nw0+neN7YQPXGBrxYoSI0f5iRAHKcyNVx/dQ5UBCzsscgalwZ
z0KSmFvygKhNxpCNQyHnnqun8G/+js7pno/oDeUMK0mTvIKvx6LF0nTSfdU5hjcnuCgLMOng
LcCxAkOd2lSzGWB9OxxBBDuKxVVRa1axjDjSxBhb3VOgzL3NLH7229kHFCpmwTKajT2XCtBD
eD/JYjxlDGjwEzmdgZpvNi14uglvISlwre9FIO3OsWkl0raFiYb2FGeZhp6T22fseAosYMkT
NnPZpyfzxYwl01iGmNiwWP1r1OoVEywLfjqU0Nge2wcfgb9cAn/Zx5b4sQb9JQ36ndZxxg1T
wDq8F+kEY6alAItr7E5S0urk5MpoBQ2IBYhjQCpcJLmRG4vOhFeLG8s4SyWfOJ7vCCu+CC4U
El0jtMbaz3ohuaSwaDRy1X9CxtWopzD8EsdK9LzXqihklhmkYkuVaeqTbIe5YJeDoDJsYshY
qGTQJYUjVGDLeU/iUGZClex+rosoiwZwFDOTrAFj2YAUPbLd70jXSLeBRNAUEzO6ohAHhZTZ
ZleMwzCt8D4PI+oZ8xZ4J2o8KYZRpQFUFlUsg0LBxk6i2EYpZPHffwXfWGB+HcuU+s2Cx0t2
CoyAesxY7Mjw8Ud3JBk21LGKKdzCgxqTN7Ak8kk7RRKRh0HYcF/sEXJrkpvC2ObtgPXb2AaB
cDx8nZHCAhv1j3tnp68x2u+hzXjIs0P7oNqOqRMgqIq1OFHMsbwgdlBWCkOWm9FEKG1KpVXQ
WY+h7aFwqsVirIrSVg/m26RWD2SnjGFGv36031x4M4J1moyZXZ729rmTgU9gqmjZ/HO8tqCf
qkttF+YXrNfKId+5OHd53tc50jpTouKPi1POpzNuse0XlgMZBlVpgRTmAE/8okwqMgC31GDJ
V5uCm7dXZAz92rFuVExxNuSdh8VlUBIrP/BBOCsO95+yKMravWTOsp9yrpapnHH3sLyIeBz5
MDZKGsEwDg+zM6Zi3qF8eW1zeDtTg8tFSeFcdlql8ORGKhk3LDPSKpbbuJGZ51KZbWS2Mav5
klWdqyYIViWfGGwmjpGZc0RBZzg6fn1mkI3jkFXDFBlLjwOuHTPkefMoHEKWYf1fmJM5q19a
cNGNXqYboyvzwMiP87wxwZP8oz9HLflM9lGhgvSoc8tLrMFL7PcOUK6uL3qV4/+cKvv14//b
W0/m8/+3m81V/vdXuVbx/1X8fxX/X8X/V/H/Vfz/d4z/f+oAwPbcq3/uUGB5qD8P6svorQq+
UMqNyqORys5JoGWvLMHg0JlOTMkaSi3Cy6oLGlJi3mA1q/XvkHuWvpdN6nXRFXfQz6R+lcab
OiY0dVclfhwNjtHAcnz0ybhUuPBH4gu5HXBQhAw/wE0VMt2Q/ZEDsXhhNB3OvGGHBRiEAE8C
X6PKf2gSyAugTSWeW9M7mG3ehS8wAbWoSRUGuqRfbY4oyrLQ5bl662tZGx2NxpZvyFQe4yBr
c6Le5hLhssYfQFvqw/1Q/rqZvr8dJXBOZjmSpa2Ra6rCtvSjHHPLzyM18LHeNN8RvjzRrfAc
VcZl4rDPSNmEkn4OqMBLk8WlSMpPRcBvJqgye36SRa41rZRcp82kUS7NHeVwxOz4VM5oEXeK
Kdg1F6kughGVuWh4drTBXib1x/6locKfG4eEDnec+vXGfUeOZJMcQZVBmrOHoTmOHYz1dc7t
NDK42g8c3z5UtMgizAC1px7nSIr5AEBC5Q5wTpqsLwjDDxNFJOMexFCRzKMjgsteq0o5/VBk
7c5ksc1mPsbMbBV6yoKhMgO1NKjFMX8owg5nFy9GvZNR6+JV5YnsU81yKfVPlsossFEShPMJ
mPFCAiZFW8uxJLEQvFqIXck1QqKSvi8kRYZbWWLws64OtThJUwkMdcuRQjebSzmRO5x8THMi
k4qzmo1s3mh21zPWqIhJ1uaWYx2lJhIb5wvOY6Px/gI2qv4N2BSGMk8MQbDZNB0sGwurjZx2
ubfEy3sliFEG8YZoeMc0jkqtlowv74HH84s9LB2XrMpFKIuHSTgiiw4rZNB/B+Yu7NTslVvx
E2eU3jiR73hk2MaiuSdBuFF+AFnMvZ53LLYNsSZ+3lbhyA5sknbrlAw9Mlug5I46z2AqDDrD
IVkNF+e87XOuaykVNpvQgvxaJneEWJ1GALYq1nLhqmZzCTnFoqvMSKM8QVR41w1qW6xT2YD4
JcHWWFE03hXMkkdGb6j8HSre0KTwDUnMO8kNCZMfiWTHS4Xwk0ZakFkoKk5d5YuT58NfDV0I
aQE4I8gGQ1ODOTSljNg0lHrxXe4NLsj0r9HEcowfVccbTRkQJnWMqZNqhir42If0zMYG4VWH
qjL6uqDQZfA/h86OcouREPtKI1lYO4sjkQwvgqoZ/3+PkVQwbUXYX85hflZVycapEuQx6y85
MTvbWDqXJAkjeB66D5Jcu0pGEtknFUhh+v6NQLkh3tVNFZ8GJ2wDhspcZerX2dIjALL9DJ3Q
cNi63IfYq4rWcCRPkPhkaKZ2l2vPyWn676rYaXy3twCyI0GeH/eronRQSOcaMnk7z8SYabat
mkH6qwWkn04XILcY8qhFvlWeMj8L0mQQzjZYNooGV+OW/MJySvmMDZFZAjKLnDZ7TpYvv18B
T95PFFxuSMg9l6248vZqVdUREauvQ7Gus+UnLQ1DWku3ZW0m1vQZENiuTN947KXxNWTODtKE
GjIVY/2BQ8yQaegoeOs/MGYNrnnTjwU+a8za4pH9DoBvHzyK3z5A+yrluBTmVWWx6w85v8oH
rQVvpLk1Z6fPs0oZsuVjtN+om+RQxmosIM+JsFYePLJF7Ye54cg1zQv9YwtYnSjSyyfLjfPF
F7uWWurq7a4wLJvsufGX2V+lM8fSWyDMhdI+X9jf2aIrKjEMLsV2umOUTPaPvfR1QG9mgKwl
73Opw1glUzOvb2mL/M1J2BePQmZwXsKdLHsBpsSB/CWvMJx/OycnIX+HY/Y8Sr1/8nvHzf+v
XOXzH/nllM9/APSp7z/sNBe+/7O1vXr/46tcq/Of1fnP6vxndf6zOv9Znf/8u77/8Wvf9Vhy
IlQ+/ZnxUXznfUL5a45yuug2N+6pko37u2vXc4TOtfDr/3AoHr/1H1MYGkYug1HEG5VlH0iG
5fEUJYGr0HP4dR67it9L1xwmuGlBJ2dZ5FnX7J9wrjrA1g9Fc4/jEjF0i3Vdrrcod/px4/E+
RQnIM4DXl2fYycpmUdlcqNwqKrcWKreLyu2Fyp2icmehcreo3F2o3Csq9xYqnxSVTxYqnxaV
Txcqvysqv1uoNB/v5/etEkMW2XVVgjwqQS7yzipBtkuQi4y0S5DHJchFrjolyE4JcpHF4xLk
SQmyzG/bGZupl8jX6sUkwNaGnUmlVFcyyaPzQOkhb2ywQwyYfZkvKKW2kku99NzzUxdCkH2x
Q3i0JIQXBDdkpdw4bI81njZ2nsLcr9HNd7gR9bpMRy9/rGVdA/rItJKZdSlXCp4cvxw98Gfe
4pFvkmDDZg9avd+iVqFEs+azd+qHNDpyhe0Cwg9LPvC6PDIjAJn/XvZDVXBIlRdJyPnHLPik
kxe4os3PwgBX6fjNbnPrnTqRUaEPSsV2lyWPP9iErQHfDA7yJrDHD2YSyQ8PRa25mA9L0XS4
3TKTuvG+0cjj6JxIq9I/dRofhMPmVHOZdV2CKqWpL03dlim8H+aSszl2I4M28ts4MvZEOore
S6PoDeS8UL2sFddIg1WLWI56J+ejr+OouHwmJhKHfF8ge+FAnuflbxrIdNl50leJrnRl/v+X
+vYvXZ/w/xvw++e//7y311j5/1/j+uj3f+UHfrOv/y75Lq78oi5/N6T8Vd3lH8yForAFYEkN
TCFqFNTUNPrU7D5/6qduqRbyy7P0pdu5D9uqr9qKmmejJUMt+yAufZIYwxFqFIH6ki31VLey
T+KKBXLkF3BL38TVKn+cA8nrsg/lFpj/g3VHtv4x2yN6g6GevP/sYv7L6397r7G3PR//291Z
xf++yvUQjh58xos2H+fv8+ey6ZXSnzfrEAmSCO2h9lAcdwbtfpdd1X14+xa23hsnqo0jFzaS
dy9IWViBz291ypASbSZ1btvvwCVEQ7EvdgWe8Vf28kkB0DfKRnQgZ7KdFqax63lpXBUonzCS
k07n+KjV/vO+uE6ScH9z8yowI7vOyomIqdvO5q3r3MEESaf18Dr8cXy4vSt7g0/fQTePrx0v
pMBO9JhiYUTyHbqRcTSZd0euoh1v2k5sRe7/tvftzXEUSZz3r/tT1BqDNPJo9LQx8sKFLNmg
OIEVWMAC6xA90z1S45nu2X7oQXD32S9/mVnV1Y+RzC2wsYc6ds2oux5ZWVlZmVlZmQtnq2Or
DgbEoMAS8vnL49ef7wUfPPhW7l8a6uoBZBbYmhbzoYmq+eKM8Ke/LuJrkrJwpXSWTVxH1Jg+
UnMlLIp4Pp7FKzBYWWysnIfFWVjM+aUgxHZ1mizMabZIJoVcESsWCR8D6vwU5vmA+nBA7tY1
Y758uU5SaXqesD9gQWOlDizu/fHgAir+qWYzvXWWljtmEUIDtWOhD7MiMxck9K8XZbbwcLOD
tkglz/JFRtSB3nloK4Tc6UY8I0H9PMuiFOHhqOVM709db4TFJEkYgV5r22gtD6PkmoTM8yn+
Y3FFYz19ffga88ICpDmfZWNShi5DQgVcY2BLZArAXzYeGJ9LDXG9ashm4SuYrknqLFwzgIDG
tyCZnIRluCbAhAdlo/Qn8wGCjfHF24JIbcZXm+kPmj6enbwiYuUL2zzJNzB7mLPGw+oae0TC
NYf0i6LxOVCHxfFiFhCmppmpKxQBARdYsy4XOQZht0vUbQTyjVSRR2F+vtmuH7yhcYZefVxX
t9eyvynC83iPSvGbVsMTE/CGmvc3TLIGf/QHWxob3n+j08Wkr484IO2M4+339hEHL+Wr18kH
dZMx0fK81WIUYItf3mQUHOrn/jajnjbLwJSC5N4mS8VxGc+xMoh27sB22YeKeWDCK16LvZ3M
tRMoextMt3f1Mvd6aVMoFFJZpzi5YFbfR6E4bQ5oGdByw1lvEyb+eIIzXtjSz/Nwjlf8rUmj
vDKV0uV3ox15JQ1NIO7VZWwLHC5RW/B/M1DyE4frsxaEUlRalth98qbRNBhowLr0I+Gm5rPP
SOF+AYe5LTOw3hnm4WvzMACXq99keENtdWvvd2ofdmpHS2p/0ql71KmbLKn7rFP3tFO3XFL3
407dN526xZK6Tzt1f+jU/WVJ3d1O3f1O3XBJ3e1O3ZNO3YVX11b9iL2QbYmDTp2J1rF//zN9
2CItJhshLWkyj8+JUcfNZS3duWZYSHj9yvz9w+gzYw7tjyP741R+PBxa53WzjCyHyyhuaJbU
/aS/pqOYGsY3Fpwf7I99++PE/jiQH/AZWdLfx/39WUpZVm23v9p2/boxhw3MHh0qdN8enciv
by1q9w/uwuzWk2Wo3dq9C7dUZmdp7e0uhr/9UgH92uLzq1NLC69Pju9CLTW6tbS7zTsQvHn9
clndA3zYIUgbpB77tI6j4NzSdT/N08vmtMTh9d6Hm8/+YeKx/jDxRH89HBrziAoM6d8x/zu5
rmvHka2AZrhP/ptdlahsxDV61lhcJNpllNgui4XfZZGgasT/Fguvy/HC6zJZ1P094kjVj+hd
s68JYNqlCpH9EcsP1JmQRP0IYjX14lWb2qLn9kdhfxgA+GiKKvCuekRbugywMSlAsszIwck3
bh6a+y5kMbtpuqxLTS6GEsrEXBonaEq0scZlozESvrUt+pVAgGq1hQLSlCtgViWHUjFY0ugs
GVu5AImXcD0M8lOzYRTSPZwLGSmVxIWE0OAD/p7Gi+TcNp6cpx3hAJ+1Wf5sQh0/hPye5soL
iF7aovzRalFLSKNaYsnAK22nirKy2Uil9dXPf0UUXXVPXAIaCbwi9are2SdBosyhV6QlLtLn
W8TFs7OmHkfao22gWcwJjih6hsOS4MEHcPhJ3xWq3Zm9AYd4No/OJp+urVYp0E+TaIN1MOwD
Od5AGRxhXG9vml9/5b/Apz5+iR3fbdajh8ED2b7dqw8nWERnEz4daomtNWh2pmKz/+bg6Egv
r2VTyJWb8BVZGa3gwp+8JwxVKXcA4m5MAGHn7F8VzX0NwOb2P0zrn/bf+AfMqPP8Ewd0Tcw4
xAzNki98M2F4ZwNUbPvWRnbQyO0N7N7awJO7G3h6awMftzYgh13dgtjBjV6GUTxJ5rRycQmm
kFjd7GLEuslme4bYAOFNEPH4Pea1XPiB7cX+7Zj1OsmC9VeB8vEzT3yk78GDmqyMI+HOu8db
vW+3e9/u9L7d7X37pPft0963H/e+fdb79pPet5A2+9+/WPL+YMn7wyXvXy55/2oQ1HjvCOV2
kg/V8yw0W0/X+YYU2JescWZfusSXMTsYkWA/irKr9qeaxUXclYXlR2zeLCu8XV/yPLSSAIcA
YmZray+r4p4fDSq9xYiVdWZVWn66Gah/iX1DzFJWkeOxyaer+m2NhUMmZUbCag3IYypXc2UU
fvw46HDOqIFc6QcHwOyRaVtlA6YmifBG2tiuRBfTWSWRc/N616a/AJv33m8+63//4pV9b8F2
XX2q65ehZYG4pdsdpcTPExeWb8/UEp4jita43aC3ntYjDjFm4wb9qMNzABJRkR0siZx9Y7Wv
W0O1r28dKRXSwdk+ov4+ov4+op4+up1EidtfbTfhdW83+rrRDXYC0ULcd78/nOl3egyv6bV2
2TPoBb4SouvNnWdhuzVtin47dyzys8TP+gZNGe43kHzmLfdlHMHay2Bsht9DL0fQj25Vd3lH
7/Pwt1Y4Axvwtaz3ZD5F0VJ27mY7bDVjtmPX96NiQXx4Z7P1Yrv9YqvxIrCT8RtBZvXJ17je
g1PC+s8gX5uNp4l5tJi8f23t+bdW6OxElhREYqG5KvRqzRBaIlMiDmB8mZ3USAz0PQgwz2b9
BJgGadKEIw3elPECIQVxNMRKBOJI+FzqPAtIdVwkfUoDfeP6H/i1m0rmIidlhH4lxUWzLn+Q
3itxcK/yPFYbb6MJPp5UAzufXgd5syl+93WVWjuzOsTB6s3lVwdte3NeNyh/tVqUl0ua5I/t
NpuNniGeiBQ8g+PDb2q/XRn5Yr4p4mk1440EDrALeLvjRL9iZaMYNYDhHhWUvt75XX/n0t8y
KlOzjj0LO+sns8l00jWmMpeObQRl/fXR/9mS/an3669b3b0WbfNpZmwOwjy/Ma+oZGPwk+li
uRl4CRS0U90GB3/uQrLoh8R4oITLrdlLQbECyTJYtnpEEPSkwOxX18kswSnTcrB+WW6gX46h
O8Da7QXrFwvWD3Ge9U1W92zl4ztBeXYHKM96QSksKG8QQqEPLWUblme3g7K1eSsg/LkLR2nh
OM3DRS8cyfIzn6U42b4dFi3QhSax0CAkUJ5Xi7IXpM7RCul45j1o5k6i6QUqskAdJnksAYT6
gMpuO5e7hXruJJ9eoDIL1OvLOJ/CxcCD6QPTt++z70SvROC25GzBcKyZjqVLNahPaVCftPZd
1Drhs2CJ71E6lYqrcHiQr16fsLuHteBRne6xMnw97u6/1Tnq3N47u1i7jiu+OdbqGb4l7zHy
g4P2Vk/V7hh6ijs3O43BsyfLbfZLfuZJMen9EHygQb3Cd6Tbraj0toIbZJBWCHKCI+bo9y9O
NiAuObuSc5SxIp+PBCvcOXnyi6Q0B2U+Wz9k/xKIAEOJ8sU+KxidVhmai7rs1UWcIk9oPIKk
6RRZhNAn4RLbdcwB5W2bfGXNL/rP8sXR6Ruzs+2//ArX4PQyZuJ2fQkt89X+my/NKnjGzBQ3
aRleD3zoGA5xj0nDgv0ox6RJrWdmI4ovNyS+gPtNX341WWTWL816aa63zPoVKdLr+yZtm2YV
XftWKBYArp89bQiggEQvXmYLIK5gAapgWEaWJlxrDWlXnLAcDk7vxD3cfWa4LlvNyoK9h4iG
9wbvi8jP99+Y1f3Tj07vQGNYMPbK+WLj7AxunPRrRIPUz9n4Z9al1gmLP5sRKI04Uhj9XBXl
+uU8FKtHT32jDeTzvsab0r7i5jdjn0YKuys8pDBuhVXmwXROHHSF/q2YsKuM9aabh5M8+xt8
vy6Ie0RxSKvvIkkjuzLpK8i9zGphtn2HOIrhM8a7zrN4MwzN3+fc9uOnn+0ZU1RjmCEebV5P
hsg16ReNXNFPUJTdUIyxn8fb7vPW7mdeveaHPbMgHkzPh/H42i+1U5d6QqXgiyaAhDvTp/FQ
ipv9su5wZ8iNsLpHEnvRyL3KlHZByMbkE5aIN9jgEpHir4lVcx6nMVz2Ci8hqbpsEYLXigsk
M1kzV1nOQeqZHQK1eRHH7Cs1rXDtF1d9OBsObcuJ+qQV4knX9jBjFsx6joycO8JVIlZxrjjW
vfzLCTHkCoecs5zHtM4IkwtcTq/9o2RAVu1ZW11rtv/YvBoALhwj405NrxOVtnEqWUiwnJc6
bTHCZzbhBvRXbnEUENcFntjLktqQE4e2L1Z9V9hOWpI2EUJKX4A7mN8dnX6Bq6LwyaUVDbwS
cLgWE8+RXGYxC0u+XR7F8FukcYxqFy+d5K6FVZ1V2dn1ATOOBMbKeTzPcmu6xb9b/G/bcObX
/o5dzUKTs2hEaNA2WAZBCYxMGAV3sapWn4ERzzIL7QO/Va7It7ZFC+bLQARDj61YHXC9kfyG
QdiKtw7CXuFnT2cfWK19N7AP+iUOuCZn4n7clTiwaNjVmqZ2k/8i8WKc8Z36Kf+Ni+okrVMr
nxl+QVvqoirXxWmW9US8TdLWy15g1JXYlMmiBxhhGiv4uOK2L5x36vV5Gyq1rMoMMQHWcR1Q
T8LFzxfH1O6knJrxHNCsc7M5ULPCHna9+hSHltDizAYL2CP9tszgkQgefOOCCDBrQG4ME4eQ
DbHcepoRZ+Y9wxIkViZPbhIXPWXZzrJnDuNwhpIcHMHZXm6rx/s4ID09NZeF8YWkjiGQcXGi
6AtdsAe8llADzsc7S9lxIquwx8EXfGSa/gd2eN7BY/c52T89+AIXv798+eXrr79vgL+f3jh2
NCEpmqRbbhCZjHkDx0SuEE05GmjP1E8guP3Dw69Jdv92//iblz+Zf5bx6Hxk+MsadKvdTw6f
vlSt5qdmff+P5ZC/OPpq/+vvzauj45dvGlVIxJN+2P31JzCeLI/EC1wmHgMQ/wjPeNZoI2KF
c3YzZJEmpo2fZoP30YUlGeENo76hi99tlmLY/ovptDnSlkAosYJDQr/gu7CrhgVP2g/5BELT
YjVJjq820ETZYBNasR6d8C3zHTSEOOHIHxIJo2gO3Nr0WHBgmSEpiiqOJCkZ87m5iBNIasY5
0kad2WvTIy+XJXP65vT1yYmbT0Sg2D81HLLNnLwmBa7R+Jv2uiMwL6E9G/UgEnu5ZkzLY9pb
ILFX5zTnWaMl0X9Cn4mMiP/Q9jmuzjmjt98T0UHVQtQ/S/GYSlqUgysAmqlc0qLrbj91CJRg
JMTRCY3T+MqdFDaaESauV1YgDzErBZm0F9sbGbmwiRUW3vmu2kqr3DE8n5kiGIp2M3Y+fvJa
GMqEs+IZI3zZerLz7Gmb5G3Nl/Vw9wwv8Wfb8WZnaTKp+6iBNgrRMPXfdliKFehcw82lxNJs
LVwx3qJ4FpcI3I0r1SacIvA0JsG6oUMfp/XWXEmtiXsP4maO3kYIwn0cmzfff3W6/48e/ssP
q3tSpDXaeUrMJaW9kLQmREbNEVRwPvcruyL8UcpREWrI+C39iHvrj0k/iq/XSJOaxY+xVb71
W8ILTczI5ag/FBy0YLLOg3tSC4e07adV5MMPY9nq/EUzn8dRQjqGlNm8fvWq3UqryCOUabUS
YW3T/9MJF/oR29XbZiutIpw1abjVHlQ4LrJZVYrStCeRYltPq8ga/tNqhU1QsDMJxPPsUqxS
iCKrT7fIuNUIaQtRqxF+5TXSLXLVRkyzCBqJWq10i0StRqZhzqqtTiNruXjnPa0iM/zuaeVn
ko+1yM/wf2g2YlpFZlRmuSRQb5aymxNHzRakrqbiPZnD7lZgo5KwWFTOM6c0WtJUrKohY3QN
u4Wlm3qTrztqtIPIVsS19KOk/CyqKS6prY6H5oqW5dD8a3A3C1Hp1RmKIIHF1wtIYFAqVQgD
k4Qm0hB8x7GVfXESyKZHXDvzzU6etMMcT/Yft9Gzsyh4Mu2ae01j4E9WrAYwKzxHe63+/RIK
7gqX7m9ppZ78Pb0wBEZdj8A1U7QaqFLbVVrNV6QBtgaQVMUw2c8YjwfNB2YFFfzWXl6HSLha
LBntxrVZ03iscIP4yYK7EDfQjP3C+JT+zvqrcAZ//GzwU11f9v1FiBtGxCqXINwG1IXrzk81
xqQJjWonEZDubCDqNoDdgsQatlj0tGIp9IOXr1/9F192v386j73/TwSQnKd/xO3/94j/sd3J
/7a9/fT+/v+f8XC8pihDKhpOghPKpuWnwfGuesK0o/ZiDSeJPJcRrBBrGy7hBgiqmep9KPlm
+lOduCjE8OnjCBtn1YJtZGfFIpzE/F4TWZ5pplpNxKkpoFfNLBoVGZwQ5U9bEjX9EMR+Tsxu
UyLkfyqNucjgzoXRfta6dYFAPhGc/31RhOz6lyAsf0wfd6z/Jzud+L/bO1v38X/+lOc+/u99
/N/7+L/38X/v4//ex//9L4//G83o5fskf8RbxBxtBwUmaBDDs1qsEkslPiSS6hRMwk/1gRr0
+3lgQ1WSMOiSmEyjvkCe3EZP8E4OeKk+DJoy6H9r7Sm64eCcHxXlYHkoTq8aC7SStlCy+BTl
qJB88F72wkbKwqFBD5uNPBsqF6PUq/2jY5rM/ympxvYw0sHzu7Ok+DFaeegNXCH46QXtODP3
2qyuqRw6UL2BFQZpc21tIIlhmFlLOkHzmdkiqDhBzdZb3MYcyQHFQyvg21KCOBTkiLacgmd9
HQgzHHjKfkV2sE8dsDZTz5Y3IauKXqEQoYqBTcOmGXXiPM/y1YdaZmAeNoKmbg/85gQF1GI0
k2Cvo412MMWHQ/P16fHh2fH+D9//yr8+P379Yv/Y67c3+01xkZR75sOC76ZRJwzV4BZYFPvI
QaRZOwdUnqoWN3MFlJrVUg/bw+70P60m7963f6svMmE0UtUEDp8T2jBhXUTAlGRGYsTfGLG2
rZ2/cPzWf/ex+h84w5cv/yP2n62nH7fjP25/vL17r//9Gc+DBw/ggTOD5gBCCGzsF+YDTWPO
y+NXtxlzaMWyPG4DgsiRK/FCg6jY4ragN7lcFLF5eB7L+Ywm/EMp6idQ9agos1xsTSva+4qa
8+HGwKpLoU6FF2Ek7gnqeH2ZhFwM/nKn0iqbfKyzQig75QDaQTWdkuJjjV521AMTzhAbhYFi
A9IoCA5dUmh2oeZzI9YUOEisdeNd4JScPReT9N3IBAG7WYgLgTjMUDlGC1/cgqMtq6Tw3ZuP
+VSaVN15Nbmw6gntCu9YocANLukl4jObuHCqB7IisldAUS0WWS5hP+L0MskzzvIpoRAlxApj
PYhuaB+zBzc4fZgnqXXo0Ulaca4/bI3DhGIIxch86cBL2C8oIKwSPUSALDL+hTSNhKgocuo3
HG+g3ZKibI5WLnGlEIqRhQqObYVV3OsxCzVlZntz95lEcBiyb+kRo+AdaEHPx+ZhFAcF3CYJ
o4xoq4jJ6VfhNDR2sckzQsy8oElexDTSYRCIvkh/02gZgCu2lLK7qx4UymEZQraIpQJ+BFT6
+6xagY97LMTxDksBxQMMX/RsG+iFz39oCOKbcpNVpkphxmRMQchSr21Wwh1tjn6fDc/yfwmQ
/Ls02Xnusv9v7zzp2P92t+/5/5/x/GbFq86y4jKVgntlDx5+gf+Y77J8Fv0NJ4a1kuASIrDX
2+rW0HCVoc3ByH8NfJHurxyS/0997PrX+d34I/rY3Nzd/PjJk6Xrn3+34v/vPvkf5skfAUz7
+Yuv//b8698no4vfr487+P/u9k5b/t998nTrnv//Gc/9+c/9+c/9+c/9+c/9+c/9+c9/9Pxn
mpI2gca/PqaBn9H0HfAhxdkXZ1bR6P/6YCsIcB8B1Vvp5vW/Z+XzAGnlYtIs3CsCpZECfZlN
S+tZc1gez+Kw0DpeY5oq3S+91k6Arm+9POitBobBgwfeK+RHJ8y6LPFIHI9U6f6bxGZN154x
jE4uuvZXWBfOqKm2Xc9veK3TVd1X8JuNg+4PjAktSBp3s7HWP6mgiv+0aPSXeJbI/7+n+H+X
/L+zu7vVlv/x6l7+/xOee/n/Xv6/l//v5f97+f9e/v+Pyf/90v9SwV9k/pZg/vuLon8JKdTK
f1bu+yMcQO7I/7nzZGe3ff9nd+ve/+NPeexFQOyGh3wHjIWII1yHrOUD2iK/sV4iL30vkc7T
2GiD/XHBWbr31DVkEdKeZ+LrcM4RDkKSEBA6MSnmvNeyU0dcR9ax+6fGidGdOihuCr6BjPKX
MYLgAnq5wVZfXq2bxpacYEB7kudX/UyChl/Dc2IL8YSjTA015lSoMS6sOwInjcmfG3c4L2A+
h+9KoL4rrNw/10tS7ZgPehM5D9MC/iY2ASUNy/mzjMzrNA4SRb/DfndEVkDhZJ1lLr3BqUQu
8gXBERqP5Aoz4f8b38sHwuaMBl1oTJCk4GhUDbccdTZp+O3YSGziCcJSYWjS+ApxokfmSDKl
cmQMr695MkeCUkZYfBFeQgSqZ7KM56Yxm2sj80V2hYvLQ+eRk5RypxqByAgk275MjyS8CSzw
YgNiWfPqIplcGMnmOo59pxYdYh6zf0WVSgDPCJSUFIGEXXHahq3D0iJhLstLESkVfJq4GQng
6FCDrrCTxywK/JqcLXQUsC9SOEYNDiPFxCRI7KLfEr8EnzFhEllpVQedoDQACjkEJkmvKYE1
iRELJStG5lUmy42JP3RxLlY59I5zOxoQKVYErsJiY/RNpasr5O2ys1lx+AwHnNxdnuQk3Us4
M2gsRA3IpE3LgNeS65U74Qhl4aT04mdBcOZYH5P8ZgHUSlQbuH6xk1JPv16Pixnrb/CQEcRp
DDZAMDJNsqe5rep42YyrpKxklUlQOYmituAb/xwlh1QuThaLDmMbuUy64EFKiE1dvwKQDHfU
4HkafsSjxKjmtkmH29rIWLVfHuaJ5pPxndhwJqTcVUQwuDVvl49CWvTRlPCfK6JrcSFrEhyC
yqj/2KroUtYTTFJgkkpGqCdu+yIE78lktQdOK/NH1TcEo9l1ZYnoJhAN6xBSQbN4CytNXke8
cxIvSjhrrQ141fZgsdVe4fl/ZfAHrIMG4WrrzrOnwXGSVte6romRXQgjEk+smEgvymbZ+Q38
2RCjR0KdpQn81DgPWJ4RNr9Jk2uOc6bsDTC+IASe51mVRnvqCxhyObc2rmgBF41NMBVt3Baw
c25v5dr5bvBQy09QQGdf0qsWQpfebK+6JaSFHbOC4yQtj3dES8DqecoumFgdutMSkyGqPo91
r401hBDN5wxcI3AOoICpIGZDn2fwplTrhAzsKkdI1Lxw/pwYzcCtkULo9IKzLhd75uGP5dtO
V17yucaOZver5pgDb8NqfBg9JA12DnYD100OEbRIeA9BH1cSNZPhkNUeBk1cJq77yLoeTjHX
9o60W5sWc3tOgHKfogxhaLPShrREIIZqgk6GDnHM5YaG+ePQtjBGCS6i61TXHpDvb+owSGRE
qdb6ML6xLfBG92ORTN7aupZuNJyXCSRlM6Kf+Z9lf5VZdgNBqNXwHXWg2Rs0YIodg1Jao3le
EMyRFM3Sjbg9ouKoEecM5HyloW/BNi7icOHaFxxgsHZKRgbRU+7iDle8A3LwMFpFJBjA/qb7
eO0KKxPA0KAmepbpgVW0bDgKc+gwYfFtRtQABTsk014ESyQ8l73085wgCdllLHZrMaj2Phap
5c5GhPK7pCsbRuT2YccYbwQpRM57RAGvxE213mdmKiXFLQdhS38tX2+Sl6pUnYcDMCtLawRG
4RGKEBXbRRvCqaxUczR1S0rj2NEe5Lsxa2rH9XWha8ij4iDOUZXzKuVwOF4uSGflFN3FMlRu
oC38SwAE9vVNkKleQ/4pW0wEeU3YShA3xm3r+CJlA3PSjBAwOG9KQmU4S37xDLDBEm/uFm91
wWQKcbuWVCGN1sNZkQWdLlwebsfbW+NHuCFYZIHQMvP0HOuxDyFUkfKK3swsz9C0lNbJ3DLq
LGfJ1o/zFmg0wm7vdibdJHAyJucmbQPz2UIBsdPRad03z4TVvgrvDgFPSjMGnZXeli8qJRvs
rONZFWssH4WnKbs1F7yn3xQZgsNaoUS6gQaTeK7jCCU/o3meJjEJDwk2kLxMJhW905UAaVqE
M7umZJY5OmUd5K694OVaRJSEzIvHMWY1R2REWkS1pKWRn30RcOSr/++Z6Gh9fanJ4Eezad4a
83csOAml5IZwSx1Y7zRUUWHe3t74LV9hEfw9mqmuL/+N6jyYf3MQdxSYEI6BYplIpvE4/3+a
x2BfNrr2ZNkgm60bJxJ+89ymN8rl7ghIb5yVZTYPGm1wFM6iPnByNTm54FDWMG69NL4GOp4w
z8Na1GjCoUUMl8FRhMhm8ySKmFEzE3s5m57RXJpLYkpZrhurtEpgql7q7AuOBfghcoTDBy2+
GY6tLt/SyFgTx3s/YrgnZAUSYMfwfqLmg+6eRNAsSApOOK4r8SBEYp3U4n29pTN3tILDMPAk
KXBUVmBnMxXUACZYer1VArMkgGCwKOo2U4m1GhAUCIzIPA6WB2aePm7of03YEU09Nj8ex5cw
82998sknb4fBj2w9xCn01lvuUl98ZEjdLeU9bmKxdAV9SsR6CCQ5yRgIR1RSNUCoks/7Kcey
aSxIh2M88ukfkVcuir89bkUSDxsosObzLfES55iBnF2CiMJSqicFgbs1MgdshrQU0RACgm0n
49gdtTBd+WZYK3pNjAY7I3PcNFAGu7DN2Z3e465PRubQ7sdtW6VZTUbxqE8E8LfcWtQZBE9H
SFwkps3W3tpoOQgQuHFP4Ihxeq0rNskjxi4zEtrUKh4vr1qxz+kSaBqnCaOcLG5zCLMNfBOY
ip0g4wQgVbw7RoEkvcwYozT/4YStCs3qdrREP061JTW3pWRDjYFtaFwls8jTq9tU1lI7aKcN
WsqDLDPCUYopw828kLfu8gJR3mvZThYZb89E1gVUCXAescnxdUAh05Y5lo/YMzVzsS8HqhVx
S/ib4RgfJhln2O0oLj4LFgWzvq9Zqlxq80swSw/kyqWNN5mWXNGGnbZ1oEIznx+zB0QC0Zyl
Vis9C/WyKi7S4DhmDcGTZq0g1tX1lVy2hnoY0L8Kob4RehZ2T2uqOGw97LHZNjENCQ4EFNQd
ZSlN5yTO2efEtsnJBUhNYVOjrBWYXKF4qtJzWkMQuFQEJHHOmT+oAXhidzHO2kioEk2qbQtS
rnIRFgFfl9WtAmrka7GCmZYVTGKB2nQUOHqQlcn5WneRspUhDERfVy29tlo0lPfhEvVwpagP
fdhAGKjKZGVzuz2C6K1LSKf1hgF+NFbbSTD1aoQiRLDq3jYP89IoXZhwXF22FoCa0QXwq8TZ
MlCSWB6nim191RmVpI9Dzr/Bu1Fqybd0h1k6LTVQ1oKUIX18foN6iOChW/+tJlJZ2o6j12lS
VLUW0mGyCGDpypNC9bCRGDZGLcvGOD5P1K0oRmTYIlOlWq7YKoKUJDF0JgRwb/AC6DghrNRT
Dp9LsxPe8Gpv3jROdAWAzwSsESH4LuiZpk9WWuve7tCa6b2tGheP1yUfE41Hsj6MgldcneUQ
TmWDvCoLQnk4uRjyMrF/kRwI77exWn8kajVHQzwnJTaQGBi53FTnQPG4LWxpsMEcrEiXeTMh
q9oe3gSW9mx9wG7k1rRGodcGqXy9yNyCQtexTFEgwV3adnZYbbyL9w7DOBXsZ+XNFipLF5a9
UWOFxvonzgXuxfaSwNPsOwN2Aq0LhVxLtmJNaxn4gtrApyMVRB1kJMjHKf2P8y+whCc8yuYg
kA0vj2MXOp8h20BPG4j1vlEPQDMjeRZGx5q6/EQB0Rl7cdNd537nuszcMCDz1ZEyHQitcw6s
JNkhUErWkgss4O9jy9A19I2rgjPd5LaH73uqDXG6XpTEOdgEE5rz5DJumARdqOywY5whUGkL
G0KITlKStCNamwjhkIdYWwTCFdG5bGYdi3jRPBwTo4YcuQR81K2OBUpsq+xUetMkW86Q5sbb
AbA2W/TZEOvi2NvW1YqIgXvlhrXJPDYimSJbMWEKJ7xupk9Oz9i568TRUX1gb1vwzmliXvjE
BOg/tbK1VNdjGaJFICwYyrJy5958LI0A5NxyUGtx6qkY6w7P+kbYmV+/Y6IJtfyHJMSpFAbr
NiBoQWi34FoUVP4NHVxlENFpLQHv1QjjNVaQHje58MJQeHVERrScBPSOaCG9ojXWVWMzVJLu
055VH8YSGRJPnVcz2oDirCrAcNSNoGMIxRSKsmVhtcq+2tzAZ4ugzJNLGvxQuxFBYAYzRb+y
2jiYxEbqGZwD3+CcCvPygq34B8LavWR/VH6w46mNnslUKA0WzEmyUAuCMwc0Vr8KmIV4QpzT
ep7pPmXx65uCna1cjhYsf9RwK+wGIvMoZ/XsrIC9mMjh+PX+YeBWT7qUEoa61fCbOC0qF8Xf
2j3k6I8hWJxRh1C1MMDFGXhx8YuEEGG7qOgarGa0gV1lixTVQSrYoPbcLQYIBLI4u+REEZDK
z6gitbpKiginLkWOoTP+YyBdqUEABxMYbaCjdbwCa9hqfgUkpodyWA/BQOke4zrP2PBk5WP9
HHjiHo/84fsIjsXEHuX0rjbOOO8M94EY/9i2N4dVzs+LduHIFTAyUWaTSbW4UVsaO2LdSGKj
gLHi1rkizibsmjpLVAtBNmukYlVsgnDm0pbgS3bOxCjLpMcJgbVLq5oW9WTz5huwDMZO65ZR
yibfgoNUFjvvdpcWrMzi9JzYJO0MlwmzEByRwmDPStZ31rSpfaYwu+udiqGOOSzVNamQzJUB
u9X04sIqxUkusiytYmgXolNawSA1amBwS8qjYDOu/TnQjBK55Rm7Q0+x9tTvoB6If/jC5t70
piMcdE/NdOmGBaKE/AwMhuxOA2YrRyAeDmzCRN/NzjvRGvIqVIupyNAV6S8X7PgAo/Ok1LSC
zvHEjInBTsGHcdWCUz01xxloyz3mk7bBRm3LI3NSG0ct/xWKD0LciyglS4klB+df4wnH0qCz
jayqjcUdUgxbR4D2NR9BiI8Z/yPuFkU1Zm8rB5BkyrSELUNkAvAIU2wcteWmYUtx1qee7TZg
fdE0PEtaB0enzpWq/ZFf3K3eWvcxhj7ExQvvsHPq2SZ9a91qHVhQldnLhSDILqx54NuWlFmx
IUp2b0msEk7YQSQpmqnv2nDIbsOmTNHa5JyPh+OdQxC+qXwyETrG0cO+O3qoTTlEO81zB10i
TlDjxuPrBeFNLSQMvLbjEsGyylCbhFrijNiq/MR4gPKcbd/uMKbpTaNnt7MbX+kXyYazmL2L
bwxtqBNh5v4xgBNe9cS9K1rpIQMydTFb4C7YRImc3bAZkvol7oqqKq/un5692H/zcvA8aCif
LY+Wxr6GOidfHH49GLZcSpBRZsxrNWhWLLTOV998OXjeWLuhuETVWyEXxB2TH6gkccRA8snz
ATrmH6NwByjOMRa1Xh3vf/5mMPTOsWqrvFJ40LK+cz3OkTewfPvJ0JN+G+b3Y/9oqOcEfrnx
1DBd5bVSFzitjnWItioQ1gf1pfj4NEejRI4ygWfz8ETpxaxSJ2VJtiAMbCh+DldJYT023T5E
YsdKEWhpi4unw9u9rkVEmsJfQZat5IuWjaQfEzR1LLqAhLVpMOKgr/meQxCXRiOqWCPgXp+I
rFaAqq71oInPQqxQIG5NdcxBWQEkyuTjpORcxL6sDn0hTFum66YjL3V4kMHXs5CTlKOyTvOI
ZExpLUs7ld13OLSB9uDi/U60PcfCrbsdbArzas6Gv2Q6hetCSTzjoHbh7aWz0DJM2TeDbKru
+6wq9Rnt1YWfJTff3uG0VyXPwHfkt+vA+vI7GaCxgT3vREeU1B8uF/awQQVLXPuh3Pq26MZM
D8OgiwfFr3XRYk+zKq1th123V5V4iHADvXPQtZXqDjzOkLhWwiOq4DYrMrGWxjMSi8D9h3Y+
g54tGULiFwk0/ZuOR92eurrLtUqRoOsLmbf7xIGO2N8Qh73bcrqgEwMEIdHb1LoAt6tGyIIo
viuRs1aDEyGVYRw1zneZbj3XxZp6fScdtWPPqLAO296lbQsoxOrY0yydJqpkVuNZgusWHDUC
F4EnasXkXXsRZ6BweB0CLjEWOsvZJEfEPXfro/aUrbx1U7td1Utd72ew4pXINuu5E3tnYeZz
Nu8xmWOUcWOQeu8kKAmCNPlXFddbEphQLOfhtNmTIJ3WYqI6TDYmKeg9OlTSiGclO97GHLcV
ooctjMYryF5WkgtngQYF7dAbLa/DpS71JSdMxcCJIlKz+8xcZBUJalgM6vJLpLzvrhizbkUU
vI8TTBxbCMQi2UrnUHI4EGgifruOrvyLGxfxjJ1kGPlEwhEJk1FFy4zoi9At2+JQ2J1L8czW
vKuLDBFRJeFuepnNLoW9gm6CSUgTjAskfItBZpZvfzDzay5DejunFXH23JwTGRMjq97pRH6e
Iy/8bBicXOBu7r4eZ7GwCzS909NvNi4uZgBJSHxUnOMoKE5/zm5Y+vginF2GufkoeEnr+4YG
9OZ/0f/Dap7MhubgglYyd3gI79r9pIxn8MmNnIJvG5/ArIRlSf2HMzjRviCMJhDAFhc3NB0X
ZbnY29i4uroaLS6Q/3qU5ecb8nPjybONxZNn65vXm0+M7zAyZI8RWxeGe/D9YlTQQiIZ/Gaa
TapiRGSwISbSmw3SmpjKaDDRaBFNjbTXbAhAkHQ70ZrYUTaIxODIMmRPlv/fr47eP/fP/XP/
3D/3z/1z/9w//4XP/wVJ0U8PABgBAA==
--------------000200000701010608010405--
