From 198206d60ddcb453193e67a8ff05665c270ee83c Mon Sep 17 00:00:00 2001 From: wannebetheshy <74280345+wannebetheshy@users.noreply.github.com> Date: Thu, 18 Jun 2026 17:10:34 +0300 Subject: [PATCH 1/5] feat(lab3): SSH signing + gitleaks pre-commit + history rewrite practice --- .gitleaks.toml | 5 ++ .pre-commit-config.yaml | 12 ++++ submissions/lab3.md | 131 ++++++++++++++++++++++++++++++++++++++++ 3 files changed, 148 insertions(+) create mode 100644 .gitleaks.toml create mode 100644 .pre-commit-config.yaml create mode 100644 submissions/lab3.md diff --git a/.gitleaks.toml b/.gitleaks.toml new file mode 100644 index 000000000..063f7c13c --- /dev/null +++ b/.gitleaks.toml @@ -0,0 +1,5 @@ +[allowlist] + description = "Allow documentation examples in submissions" + paths = [ + '''submissions/lab3\.md''', + ] diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 000000000..0bd663214 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,12 @@ +repos: + - repo: https://github.com/gitleaks/gitleaks + rev: v8.27.2 + hooks: + - id: gitleaks + + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v5.0.0 + hooks: + - id: detect-private-key + - id: check-added-large-files + args: ["--maxkb=500"] diff --git a/submissions/lab3.md b/submissions/lab3.md new file mode 100644 index 000000000..2cbffe90d --- /dev/null +++ b/submissions/lab3.md @@ -0,0 +1,131 @@ +# Lab 3 — Submission + +## Task 1: SSH Commit Signing + +### Local configuration +- `git config --global gpg.format` → `ssh` +- `git config --global user.signingkey` → `/home/pavel/.ssh/id_ed25519.pub` +- `git config --global commit.gpgsign` → `true` + +### Local verification +Output of `git log --show-signature -1`: +``` + +``` + +### GitHub verification +- Direct link to your most recent commit on GitHub: +- Screenshot of the Verified badge: + +### One-paragraph reflection +A forged-author commit allows an attacker (or a malicious insider) to plant backdoors, sabotage releases, or comply fraud while attributing the change to a trusted colleague — perfect Repudiation under STRIDE-R: the actual actor can deny the action, and the framed developer cannot prove their innocence. Without signing, `git log --author` is trivially spoofable via `git commit --author "trusted@example.com"`. The Verified badge breaks this attack by binding the commit to the SSH private key only the real author possesses: a commit showing "Unverified" next to a trusted name is an immediate red flag that triggers investigation rather than silent acceptance. + +--- + +## Task 2: Pre-commit + gitleaks + +### `.pre-commit-config.yaml` (full content) +```yaml +repos: + - repo: https://github.com/gitleaks/gitleaks + rev: v8.27.2 + hooks: + - id: gitleaks + + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v5.0.0 + hooks: + - id: detect-private-key + - id: check-added-large-files + args: ["--maxkb=500"] +``` + +### `pre-commit install` output +``` +pre-commit installed at .git/hooks/pre-commit +``` + +### The blocked commit +Output of the `git commit` that gitleaks blocked: +``` +Detect hardcoded secrets.................................................Failed +- hook id: gitleaks +- exit code: 1 + +○ + │╲ + │ ○ + ○ ░ + ░ gitleaks + +Finding: GH_PAT=REDACTED +Secret: REDACTED +RuleID: github-pat +Entropy: 4.143943 +File: submissions/leak-attempt.txt +Line: 2 +Fingerprint: submissions/leak-attempt.txt:github-pat:2 + +5:02PM INF 0 commits scanned. +5:02PM INF scanned ~101 bytes (101 bytes) in 23.8ms +5:02PM WRN leaks found: 1 + +detect private key.......................................................Passed +check for added large files..............................................Passed +``` + +### Tune-out exercise + +**1. Inline allowlist** — `[allowlist]` block in `.gitleaks.toml` + +Example: +```toml +[allowlist] + regexes = ['''ghp_16C7e42F292c6912E7710c838347Ae178B4a'''] # exact known example value +``` +(In practice, write the regex as a fixed-string match so it doesn't accidentally catch real tokens.) + +This approach is OK when the pattern is highly specific (a single known example value, not a broad regex), the exemption is peer-reviewed and intentional, and the file lives in the repo itself so it's version-controlled and auditable. If you use a broad regex like `ghp_[A-Za-z0-9]+` you effectively disable the rule for the entire codebase — that's when it becomes dangerous. + +**2. Path exclusion** — `paths: [docs/]` in `.gitleaks.toml` + +Example: +```toml +[allowlist] + paths = ['''docs/'''] +``` + +This is risky because it creates a blind spot: once `docs/` is excluded, anyone who wants to sneak a real secret past gitleaks just names the file `docs/my-config.md`. Path exclusions are also fragile — a file move from `src/` into `docs/` silently removes it from scanning. Use only for tightly scoped paths (e.g., `docs/examples/fake-credentials.md`) and add a comment explaining the rationale. + +--- + +## Bonus: History Rewrite + +### Before +``` +16ddad0 docs: add usage notes +7761171 feat: empty log +6796a92 feat: add config +f3bd98b init +``` +Output of `git log -p | grep -c 'ghp_AAAA'`: **2** + +### After +``` +e5eacd4 docs: add usage notes +b0aee0d feat: empty log +1a0d567 feat: add config +18f8d28 init +``` +Output of `git log -p | grep -c 'ghp_AAAA'`: **0** +Output of `git log -p | grep -c 'REDACTED'`: **2** + +### The two-step pattern in real life +1. `git filter-repo --replace-text replacements.txt` — rewrite locally +2. **Rotate the secret immediately** — what's the MANDATORY second step in a real incident. Even after a successful `--force` push that overwrites all branches, the token was already exposed: GitHub's API, CDN caches, local clones on every contributor's machine, and any CI log that ever printed it may still hold the live value. Rewriting history removes the evidence but does not invalidate the credential. Rotation (revoking the old token and issuing a new one) is the only action that actually closes the attack window. + +### Two real-world gotchas + +1. **filter-repo refused to run because the repo was not a fresh clone.** The tool checks reflog depth and aborts with "this does not look like a fresh clone" if there is more than one entry for HEAD. In the sandbox this was hit immediately because commits had been added after `git init`. The fix is `--force`, but in a real incident you should work on a dedicated fresh clone (so your working copy stays clean) and only force-push once the rewrite is verified. + +2. **All commit SHAs change after the rewrite, breaking every in-flight PR and CI run.** After `filter-repo` runs, every commit hash is different — the history is literally a new DAG. In a team repo this means every open pull request shows as "nothing to merge" or conflicts, every local clone is now diverged, and CI pipelines referencing old SHAs point to orphaned objects. The standard playbook is: announce the rewrite, ask everyone to re-clone or hard-reset their local branches, and re-open any PRs that were in progress. From cdf834e428199df34a611a8878e05d7e48e16ffc Mon Sep 17 00:00:00 2001 From: wannebetheshy <74280345+wannebetheshy@users.noreply.github.com> Date: Thu, 18 Jun 2026 17:10:34 +0300 Subject: [PATCH 2/5] docs(lab3): add actual git log --show-signature output to submission --- submissions/lab3.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/submissions/lab3.md b/submissions/lab3.md index 2cbffe90d..4226ab596 100644 --- a/submissions/lab3.md +++ b/submissions/lab3.md @@ -10,7 +10,12 @@ ### Local verification Output of `git log --show-signature -1`: ``` - +commit 92499f1601e4733d054faacca7834ae1e4370dee +Good "git" signature for alexander@heronwater.com with ED25519 key SHA256:vwqxlQeyMQRmpij9axlAMAhQZB9aoV+I7goi6xeApDs +Author: Temniy Princ +Date: Thu Jun 18 17:04:36 2026 +0300 + + feat(lab3): SSH signing + gitleaks pre-commit + history rewrite practice ``` ### GitHub verification From 1f37941d96b88d5a32d9f6c83d7aa0b246d9b362 Mon Sep 17 00:00:00 2001 From: wannebetheshy <74280345+wannebetheshy@users.noreply.github.com> Date: Thu, 18 Jun 2026 17:12:22 +0300 Subject: [PATCH 3/5] docs(lab3): add GitHub commit links with Verified badge --- submissions/lab3.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/submissions/lab3.md b/submissions/lab3.md index 4226ab596..d9266c565 100644 --- a/submissions/lab3.md +++ b/submissions/lab3.md @@ -19,8 +19,9 @@ Date: Thu Jun 18 17:04:36 2026 +0300 ``` ### GitHub verification -- Direct link to your most recent commit on GitHub: -- Screenshot of the Verified badge: +- Latest commit (docs update): https://github.com/wannebetheshy/DevSecOps-Intro/commit/cdf834e428199df34a611a8878e05d7e48e16ffc +- First lab3 commit: https://github.com/wannebetheshy/DevSecOps-Intro/commit/198206d60ddcb453193e67a8ff05665c270ee83c +- Screenshot of the Verified badge: ![Verified badge](verified-badge.png) ### One-paragraph reflection A forged-author commit allows an attacker (or a malicious insider) to plant backdoors, sabotage releases, or comply fraud while attributing the change to a trusted colleague — perfect Repudiation under STRIDE-R: the actual actor can deny the action, and the framed developer cannot prove their innocence. Without signing, `git log --author` is trivially spoofable via `git commit --author "trusted@example.com"`. The Verified badge breaks this attack by binding the commit to the SSH private key only the real author possesses: a commit showing "Unverified" next to a trusted name is an immediate red flag that triggers investigation rather than silent acceptance. From 2fb05251bb71d0cc0c1c7a4c18cc91272fb83642 Mon Sep 17 00:00:00 2001 From: wannebetheshy <74280345+wannebetheshy@users.noreply.github.com> Date: Thu, 18 Jun 2026 17:13:24 +0300 Subject: [PATCH 4/5] docs(lab3): add Verified badge screenshot --- submissions/verified-badge.png | Bin 0 -> 95716 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 submissions/verified-badge.png diff --git a/submissions/verified-badge.png b/submissions/verified-badge.png new file mode 100644 index 0000000000000000000000000000000000000000..b47a9f5dc153cbe3aafcd16860fa5e565f815920 GIT binary patch literal 95716 zcmeFZXH-*L6fVlqBdCZR6-22=1!)3Gm98Kq^cIj3P>|kBKuSPGM5)pRBuIw>Srca&Tl{$n-Jzamh(h-<6E)>JQStKVrDAGLX)8lY8!F=V)nd z_R{V-89%?MkXG*8DEQ*a|K$sPGJ(gB5r6+F4vzmtI_?TLRWNt7H+OUKRIzq-BRi{T zOC%%vn+)>osm|-K8{QueTA83L62u%a!@py$NNb5hMR1OPVY)4yW+}+=c~3v zrp=t(@jq$7K>qoBj>(|>@Anz^r&d>g|L4uM6w&{V%fDax@7G(`63+kr{l&BY|K$H+ zHp1=>m%CarQBe&NS$tot0u%b@^G(C<0jw^meX>zjUFtC1pw#-FiHV7*xHvZ_C#0aD z;IgQfPDdQya5EJ{bVS6d*%mvA#5wo40oeK8zu8_;r)WhFArZ}A@%{Ip-=WKporOqcrknc}vY3Y*!x17BE ze0(Ee+IFBdB9?bGObeyMd4fe$8o^+^>$Jh*%6|lCow<~q;ZDDA+^|)9csHC)nSvR%EtPSSsy+s7R53rs*!bhen zFnd1RrF)>^r196y9f#J7O zPP?VJA!4peA@9N%BLcIs#N5}?!;-|T`?{rVNAyf+%j`oFgz)`8KCKOu7u~&km*(cp z`z$OhSnF|J9)psBes!swKf0wc`%GdS_wUQMG&JZmjT^$(2m4Fso7W}}$;teB8v@#Y{)}dolaq@d3uP9NM-cJaYHDHc{QYS? zchb3Dd*--rj_vI3_J6v;?zS;fAd~F{mNHX{#VDoTCan5xvyMB(@$tj(l>^x1LISLK*K;#PH*r|WXU&|r?C9{1U?cBC6_ zLKN?}bo&Hx@ST?(QIK-u2j9$EjQ=fHV>@8tcZ z%z4~6Cb>C;i5p^bHez=9@@0NJai{L>(L%pE)^3!)dcU1Jb1^I|OpKnM3vxlNTMKIg zwLe_vV`F2>F&svFHf;B0D6bc^F!vXlcK}DAne9sbdrFo}y>1G4#&WYm#GL1zrJQ$V zU|^^|TuO{ge`MCYaOo$Tb;nZYk=KulkUsCNT0ZXFchj-GY4Y*sTp>y-DuSK44vvnP z(IU%4Z~%LGwjf%iX=ChWU{UCnqPE5lttj?={5z zafud5N1PFpl$&CtPOUG(RlP|FCfX7a5pgIVWm4w!l#-5@_2F+j*2ufq+39A^iv!C? z>oqP0Uuy+kFFrp02r*T4Zv1Dmv`JfA+s@ve&IviyWxFDW%`u-28Ce;Xvuc;a9iMeR z2> zX`)J3SC?EL-|yM_65KPPLU;WJ8w_ch{@usNhZT~go~)~+r1aLlufJc_)!SPyC(`jG zLphFyjxNs8)5Zq1TC1Kc1$!~AH#YLzkgn|XM_bhJ1g_#_jHYwo;M1p1Uc~&;=*Y;_ zIAdRZZ^G7ac5fOKV_bcAmF4$M(ShKm1F%iyXuIy2qhpLO;4aCg|wqpOTs zPo&gm{gf%pMAgN`C1tJR?xq-G+NxG$t~-W%FcZqH8qY5WCdz9kC#%?JQ7Qj zwdsX_um5IF#>ycRLEMK#e*OA&VR>0E+y2JfJR8IuEfD%Cu(C4UkU?uYtm~_28eia5 z=y_@BYWz|nFhZ?KFT9{%{W-~_m9$vi-v(6&3jw3eN=>Dqp<#u1tuDqKpeJBgNpjJWHf!^Ty`sDbX?Mv9nA`Ny*w|mik+JFZ>#tf`UR*Q`73q+w*c- zTbuWJcvMA2MI+PuczG=x`KG-<7{;$n8UpL_j2#~tS&2VAVT07yKW#GM_&x33v7s51 zW&KsBW4U5}r^c*EC*7%hB_#p7O zZ%>a9_2-f#JhdKKcC|M4YeRE&V^~l4T{A6Ik{u%EE1=*fny=7(#F*gX($X53lEwM?dzj0##bzy6A$_y8 zXG6bUHV)*tS{@!8WLtD5fPJOq=2mRcosgklWWfnsE+xx@)f+S z_c_G4`uZ|Rk5MNXN<66??ws;=wVyz=nmI|5Tk3TiDbqQ#bF9u}qois;NEymlP;OUL zFLi^IQI3p`ceM3FgoTHK9{Z}~aJI$rULsux$2qYzed4e;m1sMUlVkQ@e+i-*6u%8s zvO&$wcki-&x*HXNL?0aNDnV4CP!<#AxPPDqfe}a8@)hyg>clz|?uOUn|4K-#2iZwS zEtheX)vA_LT!q_qYGGmFA~dHkLz!e!Z@kF~L_%!C1Zm6+V9Y}Amn=9o=TORRaSveR zIG4CczMSIV+>8#=!2Ug(*>$VBTo}i+@QCALO8ITzSq=plX(~hZ+?cukSik(}^dFdda?RDlLoc4+e3!?=mHQsZv3`H; z@f~CUYgsIQJ^S{CSYOy16!FNQBK_`m%bXm&)CPCaSS+WuJjMPNG@N-dxSWgh3}g;0 zo8zVZZ%@3TIa(R#Od9!ZhS6zf)d!JNzCmq2TL7moJNH zWuNGvjr5h{9_VUld`5azoP|c)@S7b8s>X|{j+Z)$@QA^ zJ+a;!kEm`R7u>yTXi)yWR0Fj_jgEaFzJNllHE znES@-6yj%AIy$;R^vR2w#rbCSvXs*|l^6PpXapz%BZEX;4ZQa^B3MO5#S(_f%PN#2 z_cuoK1whEkaN{gGDlRD*if)S<$nKT3>G}5d>c({L9a(baNC^pvy~)z)6->Tiu?0Ta z>#X`|VQHy|{dniJNo^N0qqfAM_Xz$6J^!okcJ}sc5Le%%3?eQU01?UD^F+d0rDJUb zYrY}Fi?y?$0LmrXh1P44r}1~2TCx&qj!m=OaU+>6EL(RVsIBF!(IVg8E~fF~h47}e z!yog9VOh4rya0XbX=rG?ZSl@ez&N?PlSWx=yX?+mSn`az)ZW&Bu$$iIMcnkjI?dj- zpD2TvH5*Hzxu9H$@S1;O&H-i&yPj=79teNL38A>ksNp4FQQ@|Vq8GBgIVx3gNaX(2 zbH{$FO73*>*s+WStSHk+tsdB70z9tH&b?rt4Hhlmh-4*Y;vy@se5&X9F!2)G)ySr` z@zU^|6D)2ESXvg`cDS{%QC1*Ry&s)4zPP!`1GYJW*!kRkv`TaQbSzc0wyRH;iec)P z^9(=0+3?jqeZS*^XPTOtJA~Q-+ccNOc7un0ND`8sr@rC#;>=hQzYrC6T675q7M~+8<=}3^Ck# zxFvNmC(4I?RbQB-j!Tb^j~CVrVL3TDmoHrs$``-st`f>@^UBL~C+5Y87syuy_Y)oW z4lR?pxWx?{1H&~;O;hdc?DqP@r8$Izpj&>w-YUiM=7&oiYk*x&Z~b+jRe)QYTNkYZ zb`HpgQ|tYubwPgVOSDJV9PDs|H0XmaMnA3Gb$Jzlo&d2SjKY=S07^*0!7eM4n42Ok zx9)(t^vSn3Z?NunMYgiN+~l=*D> z7C4XKU5xnkalJHoM83l$%kXM{78~r8qN%G(&AcOaaQ8e?8w|a~Zd5CK{-4+~6GTo$ z&#|Nu;+uR{>Eh~IY#tngMC|JeIZQlHxpN1g*%%abx3~9m+E}%BsY_uIo~8fol$i%ln6Fuq;(e_K%ZQ>j+<+J zurN@pFxNHV7W`&y7>nAqeXszf)R6jZhKxg*IUHzL~z>@q7}!Rgm3EU zW`h90>b2Wh3g5SzJxg)u`JQ4>Vx>P*0qn_Yx&{$|yFqfoPRq`2Zdz7~A6;De0{zO% zMT5j>Gw26x6(d0&PJ%u6Llax4x{SfBaOs>eiMxNs=7$dD>8HJa|13$G1q0l#5ZEfg zM;fe<45heO692K<8u2&q8`H(;7?On(P~Lz=DOoSwA@R#lkCHAlgIGm*JWTBF;P+ZBtII9?6$3T?z^fjR84_ z_2^K(-)i|E-5s5ss!8JTzJZ)5{J!{>O-ooq=X8zZma(Xq7^=qPM52ShGSW>aNLs@Q z+3VNmpyf)mnJ*<}aYOS`WItb-U6Vu9l24-)3 zo65Ft2);aioNrX1!mW3j6JPsNOGig1#kR5^*QB1r@29qVUp3(-mmnXkBHEzTA!B-} zOBQ6=6MZ^vT)$33uX_+Nc?MtXSU#jX&01K9mRRS7RiuY8 ziLW$LOZRxpH{156HYus84LP1&9-&No_UX7KA~rU*l=-&X&H|)*7w7F6YiVJj7}*}} ztX*WGDzp%#j;UaAwH1D@zv!Km>v!(>{rf-r>5iI16N_D%_<@ft?MW$T1yM|YHOJa! zEH9qbdVJr0tns`YDZI`g3jv~qZ?0i{5k#(|J!@#b0hE`QH=*|Ltwu2ceu0=6XqmNu z4+7zKc0y2&9Lk49S;9aFD|VjGOhmyVm7+N!mhl0UbOUFj%LAFJwvywuwV5i&^zC_e zuna|LZ$G~#Ki9Y4zWohfUBloeD_7&QlC_q*lJ<@m91|K28fJ`-3&WViT7m2DmK-+$ z|E7y4I&$9u@>z9M!TDf|$PKxD`}T$6WA-$9@qNS1qi&)b?|yUU$}D|d{xd6IO1WoW zTM3JB;O$7heL-)IyY^Q_W#xKn#BnX}P`q%Y)jHRc75XbOpLSA)Dy=R78Y8Y z$HcnbIdeE&++Fyq-QC?|v$C>IrCb)q@b3e2pPn35ynX~(?rvE&oX#;*0KBU4E{nIT zO>8=Sv*vyz3F4PmR&pQdxV=S;jf}KT)jWH<{u66U;5C0`!6hQ1Ktau1l~Y49buy2e z3=FoO-rl5)OmcB{)!M+rq?70-yp#vr%E0$oSrmL4F=p5r@%{Alw7s>phl0f?{iomJ z1(Pc$DwD@2luQX(na0e|30vOYCML-~n;-;Yo#*fWlQFe~=_X563+=|~4_DXL#ugU~ zb|w-kf!jgLQ7-2u)}B!XEL|teMJ`Ntn%uc_C*jvgc&0g;mzQ36Lm7@6(5&q`%-1+s zTrfI)x?HQ@(<$b;^BxQf;1jtMDZf*^$io}MWDc}4yM`ce9DUNhk;e9Z+%50%?MfdAp9BfA4jc z3`oUkzPsmFxNoL{ltb?Xsuig(q#Tz#fBW;da-0-P@C4$3IDHQ+4h!`xfhq#?%Fai93CC4tn{WSDVF)pfTTIUD@n|z@k8iXmANt! z-VukH6&|~K5DJQb4xv7hSfwQGR;(kgdBlH$%?wXYmHn`dyo>0mvKF${~VR0ntK0cjPe z5%p)q9akRGi3x^(63zYkl~MBa8MV2EIhT~w=?A1M!30pg)~kKyYyDZJT3Xt)w{CF& zh#|SBAxp({w5W=Cz5{!*7b1 z;rF!F*G#n{S*=gs1sGJiC)J!-8t&j zD{0iy0~@2YT=(xc58M}JldJZ|gF@W#w?}CTYi@hi2qC+&bld4^6USP|n(c~A)ucSa zG()<1ho05`21DZgn{mtK>VO&t*0Gy!Sam=RCE$Vg#a;b9dQ=-0UN zKLC8~n`;VYg&~*rKuBNLc<~~I6&xgA3BGNjE_hG6oHbB%|BED*S&kyuY=ENSiN6rdLYE3y4bDC0H8Do74~6_qNxDuFX)#z&o|F;T`G;>F)Yn?j>_EGL0Rb%L7~ICf2p&{ zi1tmxU63!^oSr4R;RnB7D#!gXa~}}qMIhN& z&H5y5P;uqoGsxcD&U*kOBYS$x5ci)J;P*GBlrpXYuU@5hbWKh5na}WAS~_+&N|U~v zxjE;1Hf4sZ78!1?_Lm^Pa7R$2G2q9a0MYALT$xz>%9!MK=TUv1IqBp&Nq^#rcX&Br z%7}q*b>|k%`<{s_y_ylA+!GsBRFt7y4{L85)hAJRVL`=ioTR^T>Yf2N(E8%-hz|8W z?|B8?JXVw5uR-Gf%0O-or~q?E6PZy_(e|#clHdGauA4R8==eD2+`%Jra|?qCR?>ya zvYcxD2$j903susA3$^@L%w{!?;mQSc+{VV2;maa?_wKwnI`k^O&3qCi(ZVQTZA6obRz{gPalhKl_^eg{lmQ|SLDD}Hl!em=K!3eo-V z%7aThVHS?%o#~3^ZgVokrIEtuXhm^fe;*AKLdg&P99>rCDrd4p6%;Ow zsXI@hf>|HPXQx(I&!>EDR*yREMZpavpI4Un9=(()z_oz%YLaCuhsg3;LspvUt0fF1 zw*%$2BA$BrnP0!!C4KzZlgu5<2?9sONkv5k3Kpn_GEV!z>YsX7-DYve+!OtF$bJmv z+;739-}f|vUEQi}PEJYjqlh;#l1+InqGfEo#(>ZnwOfn|$QNANs zduJ(d6qMPSnURs{BO^uaot->82&37VmF%~env{?bw+nyf=^EMPF(!T0$xjI9HCEwr z^K0U~bLVNIFj}M76ggwX;0m zuMgGA%gcu+r-p`f&%9S@0Uos3=j(^x*?yOof7tk2g)?z@u`@UVqYlTfj4Efqj94L; zwzmzctZMEyGzOddZH{?FgSzv5^o1GC6Ox`*G#CO z7^xGTQe-k~j_SAq={l|!XLlX9P&U&!MeQ-%n4ck6k^porceUUa5D=Iy(A(bE4Ge?n z)W}=_6oJ+B)Z|#1ZxR6gtPo7?VM&SIR60;~w6&C0XlZL>EeUG&MzvjeuEhElS(@)& zF;|&K91Zs8>hx%@Gv@ImilCl-iljeYT~3fP2NlOvF6wR#|b60omY=SaD%riArJ&CLD8gBYA@S`Ul>sHV}qcc=M(~!grM2js~8SVEp^G=ys6jgu+1r~taJzqJ4PvHAZsh? zGLi7Cd?D^^Nf3UIY{y&LiUiz^GPe3+mM>+xp52IfB*gAg&80Ls*x74GXPQ0_R}ros%=^YTJ3!fI9&yBf#wK|!L_S>!7~ zk~l~rdxFfBNnE#(O`i^UfWZ|^AU6*Wj|mYb?x9%0ctFScm_xBMp;Sj_0RkZxa_Cbb z5^&WiV~k0RF%c1HH!~($uGiN6AN=Hx0C?hD`e{u{F|N(FU@8&$L>7%7+w)$yLpmss zvVc$l78e_Kj5zqP_FJ3gK=(6CLxtIQ;Zajd@^JJg>9x9=>aki6jPL2HH(2KN2!(Ol z!&8!1NPTuGDfCmhO(JU0M+fcW$z%N3#In1Yc7>6s1$t|F6a zotLmnNO{tPl+1Nmu)9pl z>}!;(m#;H_U)3DQoNPP0fB>!Af}@cAluTm{v%P_@n3#byu;6}5S4H$(cGv(yYH#c>s#_IeZ5un{axAU?wvlJo-|;T<33vz=-7~}b@mF*` zeLf2Q{(=?*7Y~K3vfY`)ax~}fADK57`w#&e$NR!owuYWxfD&1?w) z)XCMge_qmiy=AK0zj_ zhl{%|K>Bdrp~5tO0E%9jw@Mpo$jg6l-yA`MTx9Q5!G95kO=ysj-6{U`Ni+@6FN^w1 z(CwY$8=Md@torh$$9@D|NAU!zBsYU|s`>O~yx4mGv9WN%SvYU*A1&cY|t zoHiryU_1H7uneV`*r=$eE9CwOLXJ6wI2=hV!UaV?0KS3k$1-&=VPh(T-@IdGR)Hld zI5@YeIv0g#=>l6KHj#PLS8gvy8>QW?4(KQnW1ASrqSnk8>PPr=$}^ti6J7OaQc83NqSH_*GBr(oHSV@{Ol&L{ z#HP0pJ4Bw>R%#CznZey$KFHCu^7-Ao@j}n2bGm0aBxDL!>9~@h0capvT2HOoQ+_~K zm%BK*RpIu5@fbYzLyk!uXCGHeqrV7Pf&d>a(O>zm;gNaV^)Je`+-5DSW6IlX3~z54 z*3)J`vs=}=ykLZio+8eeg))m8wZ-x3SNs;!%%JP{9*8XH9(UC_-j00%;#B0-t0?%{ zc`*jpU1}>H-WV>ZZfoz0bH5cg-#$L-V?2lh2tpl)V+JMuG!qMzexUwTj{CiKGdF=~ z=d`K5SF=R8L`kVa!_Kw)cl<3wZ2zq>WAgel+rQ&=ay0v2ko{D((k{(LNLc*_%w!Ji z|H~lA@vTjbkWOdmhkq3vq`MkX{O<_ZBY@89N$>8j2kdmE{9rHq2EPC@+XI27{-^C_ zT5sXzzKj`RIV)ef0zOR{DC&qql1CMwXQdjq-afY9NUfAsf!#6&PS6N7pk8_P!#N`> zL%)J`!r}{Zkyk4N6@Gng9?n1a`0a1xs_|w)nGPH%1IMA@>x_W_xlW4E6?*$x!uPC zrs^)l%b|`;PEH|Lb-W~CZMkRK&vrD3cG%7gP@!2!UjyY>p8nn*jSGSAtp*c>)<%o6 zayo4>wdk~z6p#XI%~CIshu#*~)$HwcA^hTqboY1%iDD<+YJY!UWKbQ*lCfuXe^l@7 zbll9H)vfI9{>V1@llUhM)^Pha*P88At)U3h#Va~#&7r~R{}3x>!`Bk#ON4EH-U6(% z?OHTvQw^p$l)-i(TeH3W=fDCaO3;2y2gvx>E4Swdv9@}UK5)!UidXF(&#&_hn{)nv z$SYp$=Ycg-*^Z)O-o5kZfss3C`#pf6fG#IBql4onNe;|>Ero*l^|uj%InJ}HzgFFW z4kU+>(TRz+vq~g8p258^TRrzC*Ymr(JqVme$yaWtf&iC@+wywZ0O;Dm61Xj>ME)$c zo2v2zDwHfSw~g$@jyM3kv};d~a>=Q0rvjBP=K(XN2^G1&nA^&?j~_28$C<{0AA^M5 zj-ouX7PXrway{)H;;T!{%*-g0+8SNsWsDY12LRcRpq3YekX}NzjGqwGAD>@Ityuzo zB{f4imPX%?G(sngS-R-X?SppiF|1{Hn8GtFuyT4yK?@NI%)Nb!9qx_UpKl=4dAKPOz$A?Z zSEb*Z@>Wt-?ih|M-*ia-kXvnOY;0^$j(!l2O#=0RgzGjzdr=VJ@9_3HZCzS zakPcBsqWR+8&vpsBJEGdYGB||Jkf~`la-|Bnym1swV4c;-hQu3@h8XL$fFC)QhA4z zH?ubzsg>K$q+r`X*Z$8^2L!H%XDH)eY>tgp*c&2qQtzuG^8$iz=FG}cTLU8?JvhvJ ze17yJvEl~c$T5KACByDv!MV1!K zqa;c1JjEoa2!@B!E_Fa2WvV8l!Bq9HlhmsRpKg$p``>39X&JAZ9;twOOZ7pYG8jtY z@1~8;ihaP341--rOT(B4W`W13SP}5L-TfBz4FQ)gQFfHtYdC$sd8-yfUb7R_9LmB6 zF<|=Z8@Pq)!Kt_QWJH!)j?dvvg0R^KnT7_pm91L*;P;oFne6KZDawIwBMpu)>5*(b{tkU;i;zcq*j-TNH0u(ra=8+dtJ52uqYW1n)Oj07 zz25Ta26SlhBw?9>v;lDzA%Y6bd^HEDAAEK`0X@Co@~{aMZRDxS`@$v~h@)+GqB%k9 zz-j&MOCkqeA{$g79`4^YpCs!C{l( z0qgz&lpH0fxqlfOM8gbYxO4}$c9+_^rqs@pOJG1H99pTs0)73uEC)7PXui0zl8qWf zS@(Q<8Wbv-3nVb{LoLnCTzBuvgfa+4vWkj{=75$IF71-ME98w(1$JYM8aq3CXQH$T z5{U$Q1V>Vn4Cszw<>SLhoO~I_$#)M9P8BUIyh2F(R{0(sS_0&r{Ym=dl^9EaCSVQ- z(oVHE`Ha)Q^ji*;n$&j88t6n1D^3D9%77rKRz&kDW(H z#?}Vkp6`@G0_{CuEm&eeLkggKbU^b6sgMe~DQqS)LjiyGV08x`14KCXekafuod9U| z9$dOn?Ad?6^Xns7(CJ|_mD(hvu(J>J?#Vt!IRHWlfwm4$PfzPE$J!j79IeB#A<#D? zV9_8U}DUA#;fGc?MgbD-AG&)njb)yi`6 z`rc~)5m44tpLB^QNc+_Y=NV=V3=GKBN&{j6Xu3dV-y>^K4qAF#+}sAd&yKG3fF+`&;~NUw z92de>ZY@mbCmMULvVl0H1kwr8qk4LIt>t7T4^e{_IRzHa^g0A=OF(PHjQgi(G4M%% zyLNl{P~%2(xE|o{7Phwd7(l1mai6k?8;-PNXVes|!X%98A8UXW^qSjlQBBKLM@poq zOPvU+SB6WSJ}33bZ1pt_ILtSPl4NbwJ8QW|rYjmTaF5|P%gMtjbx+{Cgl>_hc2W}z zXaEdl5@@CgIU~x~08zeyX>)R--%%So=)w}LR_ku<`E~7{4v_kvl)GeDmjekK5T#q~aut>8k`*=hcw!9&7NQDUqBD-k*B(eUGw z&vCB;U=2ka(&d70lKn|e&j0fGPlw4WeH#@&KR+PA`}2vZ%sDgp@cZ{9tJ_&;s^=J` zO#cMA(eci1w-2;9(tR`A89Lvm z?Hk#fe#QSDtzT7j_3g)2e}TTgI^qHZkfXA?x;IIK^S~JU z7!2r@;wCR$xx&iHnbYtk*w*T-z=A4}nuYwuY9t#Jx6I&J1F^8UpC%v1DkMb9VZB$2gp2J#TS}mFkXUK2_D1E?(pqZXPGHZq=MzCF_Xe znXgNcl^|{u`P5il^T18y3_Tu{3c!_(N_|0Q$r&ilX4c(jmmD+4GfB?Scq(9S_ojBT^B zfl63l>uH*4@?UqhIR|m?wl_>YB$Y2G&I!rv})5{t?D3D)aQ|ANk|OoP!Rh zfh_z04&3B@{zf;~oPd-JVH85?Bv!Vy-MV$_g@wb_x_A&lRb(dBzdFdVomU$A17vm0 zSsePhc@>+?tRK9SiWHuv^{!lBA`=N(yB){Fq!lA9w`?~(ReQr8q(onT?RW`3)&1rg z$4mAacStOwqoMh3NpOf(%5d;b6t-7XR_;?^(hmHg%kk0?uO^N4ORHRhq2+>C+4;zTc)a=NFnMNGH~0P91suhH|yBJ3c!jgY8KG zH}%#;xqqnY%X32|9JgbhXV#jEdu;s8#ufk?pSIhwlKEYS9>nq)HUl@ZzP7ToxCp&n zB$M(2Bwtrp9=!vO?gdc&=9=Yca42C_`Lvhh@^zz-$T0JG7ivr8yb%5=g@~?8(Y8R3udZ@I2%G;Tz_eXy7CPs*_uN=9HOE6$L41iG|9n*Z138U_wscOafWR4p_xv3N~RYn zDRW&&Zf0`pQPuEr0LiH!jpXxHG==z|u4c|=I!DUg=&jQ1k4)-g!+Ob%!qMeDl zIx^sn(0adKRGI>McH(15y7Dmk7Crsi_4lBDV}%{l%6-8i-1YN%i?o!KF`>dUe%@r# zo%*^gyh|V2zEs_@-(Q39_BAXbKeHYFBH%3yAQc%SPk~mESY!~ozOZHHrCzLV#sb{L z<>#E|XM^Y}6(uE<6B{LmMZhr0Q8S(k^6Gf+ol3sg%^GGIve(SCzNlF@Y;gsH-;a_ol zuydEA-eFYYW&A%-c@mR6Zi%};xInL(bJWwMgq)5jK|=@M=~@ z=AD1r&!4ZFFtxE2oSN}-h05lRKcK?u?XlKMoJ!w#O-e#!&1=ff$4sYJM19R84n2jq zy9dnQ^g9JJnp^PRIux@lNu8-I}9TpqV(oJgBv<1n%1SxwDYg%J|&4aO6ifQyhqAxH-CL%Jn9hBH$#PqSq)k|9B^Vi13XfQ434ne77{ znw{|F#aLs4N^)hS1f7gT!K+IVJ)eSu@7=kB#7TNZE4?cttU*yQC8f)M{PBm|R&UyX z4c55Y+sxcNAUT=kmq(%9`#_4LBk1(DlppRZ@1vQyxpxNnOMvBhEGn*dSOdbo71qF_ z>r4HpfaOJMYK$B7)yWawdLsQ3j_}l?CVr6>Rf`>H&51A}(gVz|k!JV3=<4KNq4fUoaA`8Ny+gv$HNr_~p~W7P*q85Om(NO`D(Bn3=N&ZMu@g^==tHAp@#$unjba(ZMk&!Q;&;4_B^bc$*g(32>^E)sh^Fx_bK>WwX z&Q8IR7iz@66nRPfjiHDm|NNu}L`kWkJo1Y`U;n2Hcrdf1x2b_C+!v%?Ted90fJ0;S z_VyNb7^&O0AHR6<;@|i0e;C8s#@Xl{Q(f=ppT5XZb8Y0?)AN(Iy1Kf>0LvN7CyRRD z1oL7$-~3hFyJVuay+(6>els*6;6gQVueaL5%*@{#V{AlCHOMA^lq-RO;LS|j-@*{} z!7RT$PoAoqdx=AgIlQBKNfEwulJ@umDb0E95>F_qPfxmFjr^33Q(V_;P{u~qPnW-G`={F_Vtk*%A#f8)>OV4^xpIa^-?by5twil`jPzuh;SKs zMg@^1X9U=?jnQfb;IYW5n2j737gB)}pZq|zF;*0~IbQP8#-=@ZzBwW?vH|p0zHRUt z1t{x>*@9w;!*mx&3BDH>r-Me05Z`@$UxTVIV5grue;&Mkqc6tomn8i18}NpJo-B11 z5bn8Qa$fiNuY>+(W28hpa3nKBB|O?$>X`5L1_t!&B6cspiwrnolX)Z~ zzHWT0N*1X8MB!^RK=cZlO9lEG&w~W*rq6K!ngxU`P^osq$86dTni9j9KxxlD51G z#5Eg}MS-BX!v(0~kxY^a0m(iMprHnoPUkbW=aum+x3B$C2aK^*Q9a9HvZ4y$-G!wk z-P_*!mF}CSOBfsl3+dL{+tbmp|pnA}52s%qq z`v;IupB}&p--9=U1a}&iI2|827aQ>483f7lW5L@wbPsAkf8)#}7uJqgKFh`<{Hs^5 z9EAF|&dQU>)zeZ{HSzbiG{ELR>&$<>Czn@_91LHEC z|3Fo-3Ba{!Q+te2rF-a9wfFqmTKf@v-7P~NC9Y=PQjpg!rH=BpkA-8(ooknSCnuAD z2-szF3<_RF0Nw@CIa2Iw7Qp7p3?{Ypq>D%)`R^Xv0ekFew^8zfG`F8cU+q(09o{y- zsb-gS$)yuJMd_oJGX~{j`(HgTe>6XHt$8LoR%k>oWV-Tw)~LeilqE#vBYPZcryM7D zEFTFvUb?})(^a`Ox3$%se(A<@K)L3)14($*uL;+mUqqu;F*QN*`AgB^)FwWsqP=o# zB4ksDWhRG-vU-7TsSZQO+D>3TaO&?89{UdfHqkG=&U;tltH|_ge{DI)8w3)0g+Vw3 zcv9!Q$Q`C>-(4!eP*maf$5+Uza=G;K!SP$oKqHOjM}M|<}(h7DiT0=5i&to z@X?|nRD-u$Jaj&OZPAs`1Y)Ixg#2|{+9r0&o8N5)xnPw&pZ_wBmxvc-@u?Hvs!_JH zdob-sU~;V5Cify7G|Ry!Y^QYe-~_ONBEUNyfYP9O+pGnSNft#UfIR@5h>~P>;a$*I zLCWn#rhIMy?GH$e54QtZ4pv)OxDnkTs(vpicu8VF9(wSCGk+q5g0WE6G42~IEZvn` zRgJ(geg8k0d&__1 z5!J2)wgAYvLAI$1-aZcV2cwQ#HAlyg8NLw{(>^OTCE~RB)Q1&LdmbuWKNXy`*oKU`Sd`7~Ou_;6L(%`>224s_k* z0)ayhz~d(_{m(@l93q^)&O-^URAc<8Q4}4SvKHBPM#;_tqWBqC!@;u*;rIoj10W^M zh5?VKk2oWrwED~KJIYR*6#a7U4m#rsSy@>@CuH^#PIm7>F0!2+dmV5YRvmc6A-Otw zxka*%hX%#_T)V+g2hL~iEO*z2>hD8|eq+^tec#c%e=)p^2T2>&L*kx-v@h8om;SoA zBeWjR)k$ibsaMU>COhbL=u18wi&$2Ar;@+0UrNYsZl%42#1}jiGUi zbAIUx*|BH!sQYW9c@32nZ1pvY3{%brI-3bxVT^eKXx^!6-L{e9!b|k(zCl4b{a%j3 zB?AC4h=Ym%&QZ3f?`0x2cW`sBBK+;@N8?HI+rw+I|E$McyEeQ>TQxK9yL*ojrOi9B zPU#x&hneRxrPP@$E9$pPp!zEr}l{GI&OakLFxitq}XGY2mTm_J&@qvaL(GsN>*=Y$oT*d}CaR$<>OwqYgR|t5;Hu6E+T>lG)@iP4voe z6~m3&7`dKpUQ{w2MZT01u-6^Ty6^@D22HqezU8m~9_vrD#eDgQt+A=;ra1`-fR4SO z#qayT8c4u~20bgj1dcor-L>f|4r{(+4-o4=BqR)ojm5{Nlmal)LsRkBul})1DTBHz zKH!uro>y3tQIP%lyWRzzP+vbkZJApO(f`66jv3ywF+byA&2BKYmqFBL1<;k1UDe1= zW)l{Px!oso9AWL94E1e*@wqjEfj1jsp%gph5=)+ zAY~3SQOvu(4S>YJccb?{82FzmV(|ffC42hRgMTzP-EnX6%yidQglrIQL6O3S<3! zt>N*gsvlb@T2p-yxAV%i)DT|lKWWV_2m}th8~*OUkFUhyIU=~PX?j!TPMoXv4|dyy zQ$x?6#)Pw+8GKIEyh#&7k*e9x-^NiFtbUZ(o@x*(v{h7Ht?olfuei3N_`bY^`nqi; zfrrXxqRfqVsNS+6!q&xp{~HMU$s)xQc-;Uf?I})Eo@!d4UfHi zytV}-(IJoOs~Lg1&L;$~9=a1oAY|UOm5`9Ay<8+jqRl!w&oy0776civ2zYGDH&c@D z?pR_DkEY2oYuEN#%cO7kmmMrCAJgfIB?QEgiCI5ustZ=hF=%n#8n(fE1o|+&-S1*- zPg?3`3UphkT~YEKibu{bUz)gG)nqgxYhbSj@_ihmKc32~&z2@Ef3!+1%HRAbF_nvl z{t=zYR8M5c{2^5Y8bPQS%XNAzjKIJv*JTs%aqAzC*5GwH6hIqTx$uEoF&SxcuhrUMPDxt0M&Nwuz@9Q}Sj z5zpK2h&NhFUQi$9J(Ultt#FGpB?cH&XQR?q4LDPV$&Nli`nY-XW?xHp5Hf@RvbShC z(HjEGygE~4G)VFBqbWYS3uogO3;^J)fu%fRKGlY5y#(7Y2;e$^*wb4EMn?_XzCIh9 zoV12)_*?$|-!g=2Yb%Ls(|Z|S`K${_al}kfQBMyxB-Tc9lnZTMT)Vs!5)$IszEn6$ zNxq68-mF>fFT&-Uq0EZBiCC&YrBi{!BP`-{8~)R!CzUsqOxWT->-orLj6Q?cw%C%MG_k za0Yn;P+KgAJw3E#edKA8_QlGS|xhyUe@KvD`>h&mRV*#EAF45L)#ZC(le^z81f z)9HFkNmuj@c_rJzXX!s#13V+IQT^U1lTM!?R3cmrTT~9kR1lr|-GPEl`5umK$w?s!eCWfNW1kd#1LSl+cOiYys^VXIqSCbd_ z9@Bq^Ovq-v&l7rRJDp+VR5)mm-rV|~Djc9xsdpC)6+s!zFRZWUm7K=_VP3EAx4^<_ zQE6!lWcr8>m$f3WBEYQ7j_l~{ZccxfMm<^1YAj@C)Lmk`D7@vrwiq+n zJvh0l&^}ZZY84q#nC35V==B@~)qbP>_<{M-8czKTJ2)d2OaNBG@VyN~4(j z_3MM)Pu};GOKo02!8BE2{Y6(aWOroJe9xVswhcP|ju%0r+3QP-L4<+Cym4@&LX7VE znj&}?1MT{sl2Ogp-qGlxAvs{jyO8wASwGQQLOie-ICAU(VA=PZqT`Z__8+jIEFL+`d9oo>8{Fn z&fpxG@LM@=FyD~#r_W*0-9C_~dLsAtm|rP2#u*CkxdkzX`SrPm8P~Jp%T^L57LKI` z?|UxLW9~}e3g38X_h-%8-^;5be3-?s>o?qDx*8hm(`6xqp`o-OVL?$TG3zFAzijWH zZ&l8>coxrY_BT4&oq~%i7DCH(9Y_HR3yUfo_b5<`472IF28uyNvp}JsfoFHy1Ujpf8WNaj=JS<&H5T!Tbf>f zC8V^hOPFSQCaqR$aTt1JVr=XmoB2YdMT9ESTT}9F_V8c5rLUo}Vg`%zCutP_Sy3NEI!HPn&%viAo0M}Briti_PGQhfXGeXp>@;sUGygR!*u z*&S#<12su++OY9EDjXERhSk&(GQpptJFeWSV+%c=-JF!3UPB@A-anZV{1Wo+v|q35 zY+P$EjC4h#{jcc7OWb_?Aw}((NuTpEwSf?dQ5(*y7i<@OGS4n)$c*U4nPf99;3pj+ zT*MfTh(X_@t)uf=NeR!$$OynuG(kZ@^!xWge(iOgZC(Sfvoa{&&oB67G?&wS`L9=N zo1yagyglah==T@zxtu3LP_9fuo)(HC5aEBWT7s4uPOQCdqVn$6@~f2llGI)K6b}uF z&e#hRFV+4#E(j^Fh=wy6>-$56G-O%v*T*0fH(Wv>t1?3{J1i+3tFe+=PD=7E_s_Qd z3L2U&lFyX0Dao(TaUrrq=zzM#*}P7ymw1}fX`d=LH#a6WHZ&pv)Wt#9ptebeU_X?r z9uHD}R)YJ$up#B3{IVP~Mlkc)Jqf_xrk0j4a+;0o?xP4yKVeLzf|8=fwl?3GyU${=KnMnYk`w zp>d=GHIlq8w&Zk9KgVd^N`BUNvC(g}i4qW;+%u{JAI#NBz)jE!eNm1w_G;G6Ti}{d zP*T#|)fM;|x}LI`P&+)Mr^irLRrR?~*aC^#TPmDl)5$16v8{P|5~^NgUQIC5sSvNn zmS3D=>Ya^rhq2aSay%!s;V;|j^NXlzuhc7$AXS7Txz`rHNI^j{Ha1acaF91u6W{f_ zUJ#GH;WPi$@kPohT?GSX+PdYx62I5J&M%~sU@JKk!^W`bl9a+{{_s>K=W)8M*yr2# z@1UWj3Vy**QdLb;$mW9eCKU;MN==OhOftZIMAg)YrYmjJTqjF~M4J_2S(ABexecYy zX5A0a#M8qZN$CDUJ#n14d+pCf#omeQusAa_3t*s1t3x?ol3v%x4!TuR^2@|AN5U4e z*&KKzAwdIt&hcua8?pHK`qFfxP_?v;#3XIxv|WT-)Ah4Q(200(0RPGT;*)QE zrT~r=ABNf@pEZhTnQ04{Nn<2A+hY^qC>gm!{{H=H@W!$JPDtha*_;G+`9u8n7s=rZ z!LDoUX8X=gC<+QAWKFFFI^$SiVPUZ~{RL_#1RhUs@Xi|PhQ$) zC?>l>(PGtcc60Uo94)T~1g0ST$UWozeMQh4NUW+oi8>w)uSOo6CgRyzYwStf)NAE9 zdJ-H-cGh;uS#7N7ZHY=hPPFBya;!{V839r6)Aj8=UhmPJG!&bSna|K5OJ$Y|4YP_4 zTDv0Ss@V5GaXKJmv>CetZW!$#?6u_`hF9^fH?U=@AD2s@cnTLpy((pV_qkg>EyUIS?XyE$` zw;wL~B}IZVDNmn0Bj)Ah?MXN!AWJ`~PqOL|eJxtkhfg(i3oVv6!6;xg8(UfJ6?Td+PI40#U6}@dMOW?rNTeN3~ar zG@zdn0lfRzbvTcVf@1lw$T8sYd8rfmxU#bF&cWa9lpAB?<1D+e{l8QS0s-u3;k$C* z-y94PL_K107_$H+j>Oo(TUuJW7kwYH*0+{J1p{3SSWApYDW35WM~Zu!%u}q-l%!2r z=BZD5hW7Gwo|d>&6HPJPj@%;;W)>qp2ks`T4Cnobw(_4{=9H^+G zw=sx2vLZX*NWS?dgSd=|iBni}GVlAQot|AuqNnLEZ+9V|o;trRcZR`gGV>|9_Ug8G z67gV0owTGRPCtNe?oLk;t{1nU|2~wv@e2GbD)^wqI9_CeT4vrl02*o^=RnZ4K7d`I z;b6%FAj#j|^nh}9vxZ|o2J1Z$G893dpjX+$yWNV(aHN~OqJMmiifcKsmc^F&zbyEQ zaNn341u_}xNKUqoZ-70ft*uQ)M)ox+NgCKjXx`ULRDvLnfcOvWrPS2au|oZO(6>qA zbsi`d(~aoJ+G-RM@tXhp_a+X7UhnaV><_b=hJr*jVEdz@DY|~~xtZ4g0l?#D&-kv< zm=LP-FZCvp^YY#g5)pi>g;HvFSZS&~D(Dwn=?y>S&jj20#|@O9s(E~;r>APw7Q|F) z0;=HZq#njbLlY2y+XJab#Y237j~~&4)Ci&fESf!H$~kKr`03Mi9oF?6d z9A_IGnFj{1f_rNjYol^h9%2y*xwsHPAWq=7_W}77%Ga2$zu#}X)G{&>RxzfAUYz_P zSUmoY?8LP+nZ)o|q*KANU84X^%)*?}Od+{|rzbcH!cAj)_j1H^YWwAaAb>-#5W1om z;88%he{j!a7UZqgCj-L8DmnCAZimGrDmhVqzC8tBEr}rOmR?+VWE(jgB)jURH31Yb ziQmaK$;bf)P(NvY=ak-6~(>!+~~7|AgBPSsIp?PeL~$!r5KCLmhDDKI0N- z7S|69pn1O*n07iqp^K*1=rg5p-1}w=fDj39ph^w}Dd`PO67z{-)3aA+Pydsf-q|rH zqk-lUP@06&Wwn6@T zybu+hZfGgp_WU9h$2uQT#vv8Q-Z$AxU6@#=887+@rg@n~8-*x2HP9W)h?h(7(G)r5Fx9q9-gY)^Z{u zKzn1fJzc9b6$dI$T8HAW;^X9sid#@Y4>W&!OV!rheoYG!6S&D5P0Xu>KYY03Y`;au z!BN(6330Di0-M6}Z=V2UD2+g9pbl*98VVd5+RYB7qoot0v8)DvpuW*jQTbwXe0=iO z;jf8_IW&Xs-hLC1$=i1=E8Hk5EEI26ccI@Dm0#-a8u~S4yainwxR|pxdmBFOU~3vI z9YT`kTsB~bS;-Ko?*8bVTxI&U3O=hIl?*1)O^@0nVgUh9cxm}o;|y>yKV>m+_sHuN zlTO;ER^)3gvBa)CTJ|d_Xh+Pyz=5$_A%rcKcQKRGc58?tM6?%yY;rIjojm>L?208htU&<+yQk9jPjE~#z;#`yN!8A zC`SQd9k{$qrBYQQobxUmZpgKiXAoAzfjPrvd5(wD%X{UnR$~>L6VH({Z0vZEV=sP? zmZPPgW2Q=85)Hlba%YZMlDe~uDR%gaWOtWMy3sdA<@nH0X-H1s%#a7T50T?ageVH2 zM>a)=#@54{kCo`ER+vH`iHO$<oH5qSNpGcjy7`(>yFDg!8Xvs(#Q*%Za}-p zazGR@cjlm>w!P{7Juo1CRORhW4qvQ?OX<5+6nOAiu7=*Zwu87AP8Bd**-PEsZ$Ohq z2bO9@2@oYo7e_QmKPXtq%2&&?9y)t(W&b?|#lb6?og=B+5K#lAE~P(2yK0IU+@`D! zwmj%quyO?}iG0&eO(hi-Cd*wMEG(=$Xy|>W9PCW9&CwLwlUa|1rYpUn+ePAbe)p{d zPj`2h#DSvAJQW8Az!gDof3(|gqIh#CP*=`A|L+0Qg!;`(TG|c+mtG?SHhzvmfT!m* zc$Uh@DhMDMQt?>$`0c~lid;6!58T|`$jHgHKYVy&@rH_Poa=~)l9?wVSG@`wOD(3j znwa1?iY_H!E7Hw}JT_x+R*Fkk^8;dO7C6yVe5mz4n* zh{XH#y9LL4cQH~O_o9G!O9*cXAWr!ePT+q@CY+-gp1S~8($v@YKv1yJII&Fh*@-mP zVadAfg2#mYvXXJS+xWc2!7jPe;c8H%yf!}GJqZaAf%&iI;Ffl_y`f|yFPRFuu1iW< zJaK)_3~~FL)VsSR9x=-w_9IV=Eoo>g2EJ(vu5x_1gF|tcr(W|K;U<$NM-5RaO*JGb z((SXr|6Qtcb#D}qG`%iKo+FY!R~mTPs+OiuJs<;{2OxG2@$tog{_yzm7))~I#gNJ=6jr9+_8V;U0^s0F!JYy;tc z=eA!F56=ki`!Lkh+FaziwrIRD8c7q42N4WTi2MZ5#*}!D)^*mc8IWa&tj_g1+RIS5 zvURn!GgaH&d0B7v^2$e#IS%zCay9NT1nX{|-#RbReljX3xI9#G&wA0-3wk}RAx|>* ztEX$9bj~)S#%}N8pht+iRLeZTwXbThgxl#$n(h;kKo_5fq{;m?muvp%Q`MI91zSsr zFYP%O=DYVtXUJ$+!XaOuGizNfjpoIGJgpT<+049JA2^$tFEZDs3L>Yfc|>?w2uui7 zhgMx)fBLjtXIC(VXL2g9Ll@uKZsS#2|B%g_In7kjUJVC$|9lsxvw!D4 zEhSAi35gEdDE+7Q5(;wo&y!zXyUN(5ZT=TDW@&BG*jN9#t+%&1Q~QR~;ksY+=-oqy zO;YYfb^(EUGV=SKmC9DCJ}5;JREG))Z&M1?)=Xuzq6A^ zA+~q*)i=K{4&%Qe4W1~nbmQf)&7HZsq;O&V?`QUX4#n>Oev4=R{|mGu|Ap!~^#1<$ zi&A~by8oN1z`y+e{hLIvSPfAHCvyrY3Eed8P5z-?Wp~w94(^0xth9l^szUpX?6Uj& zr9iLgXt-D2-Q8|$T2-GAswNF0j$q(KVG|LEzkPG(43k)If4RSsJ+E%(c7009P`2h( z?U6o`Q2_kM-+#2uZ`>Gn--ZORM<`S7x|WvK@9eyq7A6LU+%I3OcLvDW&Bq&n6lmj$ zq+JO$H}#d6j9OhBZ6T6>#^7aC?{>JhDy)M}=9fy%sVBmn0qAYzHVbHp-1crCbbM9)ik?7dsQd>Q%(6E#AlGnX7vnVk3joiNC*ni^G`rd*7dsd~td9 z>vE$k?(Q;EXfM;hcPf=k6pgVbam z3RWlPyoR3&O!zt7Ulj%$`ppvPC(PQPvVOjeX#jju7#mb%Hq8wZC(%8q^0EwMS59y> zUgapTxGcX73k$Q!i;s)DuJz$V8%(JHB97Ky5H%=0Lc0aY%~4f0=EpvdYau09;Ad56 zveeVcEus%X`vwrw_PjTp1#&(J&HhK3?}dO|ao5~jZp3y%4 z6wb$&u8=3?ejtzJ(0t2xc?G0{0QXCL54iT=W*sYVb&h0m3M6XR1nTBW$D>bzg5zr| zen4(sn1EuM#jW9{i%c>F4>MM;>sd$S-50TpsNbj@6G7SP484vVlt9N#E)+>gNzR3} z&K{7H2lfB%djLITpi*a!Lh<3*pqnX24Q594kyClgyqIY)^6%qV@!hN6uRgtgjnrSk zV`NQgyu*(NV!ZY7^1B97(j9KcFqn0?bHIW4W4rr3x7$CGX1vmr5Q=L(m<;G8EM&1b z#kJ_NEs$CGOuustCpvn0`UfTnozm~-&gi=s_w_;Mzo0Pol8dXrt?_ol^XKIbD_BS| z2^jAB`TNz^D&#nCRza2zrr5)L3LyGh>Z-7Y@0+hXN)I(?5Ui`qyE)a{(9?wk9L7KW z{WIIRyt1;h^XV3xSBuRCZ}GFdo^!B|*XuV-p0(X28*OalvY)-4?7HKkY`Ay$DYE!{+!dGBnRs9(9I zAV&u1W9qJUP(ADGZ{9{Nf!1GSnY@nf~}Fu6H54i6)p$Vd;FJpz@j$jPU=1hz(p?B zTB#|k$%y39%$!M~45HTMuo?Fl^){B(1$Q=Zk%1)+tznC<&VYR1JHb!*dw?s@QB!uz zQkd0SmK75lpC+5RIi4G%l4byHLTltEdi{C~T#PFsH}se6xKv`V_Py4xOsh8y{Ekt~JiiQsZUh-c!nSaik18#bI_2vEa8v1o) z813IZF%j1m&jI^D)%&ar7KHudgjZr>;wH*8_dj9M{(Ja$9}l z7m!%o1-97G6BcbvDrZ9OymfGZMkx(urXPeOs_9)CC`2Yl0k>PoU$?dKPd37 z)DDi8j`%NskB?UjoppD0BRijPSurFa+}x1#PICrG#yg5-J8-5p4hH zXlr+OPRGq(fRxnbDI?{zb-8MOa3Rc6CZkv!ZBEOYPL@~foW-$$rr`@rn_>Al#;D;w ze}8UnPHFFKOTOjs;s}AA{Pj19$q4u$HA>9478xHHJK1eX!-s&fmwzX z+1WwIXTCYfEVft(cMOmxuJ@5204`%Q333-29!=er;DyGMy$WK2j*K9}Ow}@aP%%&) z%oGC3r+l=OT)nqh1;#9~x}w2yju_c2?kGs+R?;-GyObeOW)?`opLAZ$17Zft3O?XJ zE1mE4@(kDVhEqz-L9u~pGjlDj>_a_}7{{v&F~LJzYd?m` zZLOvC6c|X*u>{@bZ@5|kcR%00I06`MyCvSd&~BRh_I*4Lk+e*kDUg@PyvVC=7^YEF zD$wC#A7KZs`1`kSJzx>%Go*?wt#yG|442Q`=4Q{5riZYXOK&hF55n`F$s*7 zg;tnw3tA<3UCqtNi-P?LxeHXZi?Xy|*X@nn)24NZ>JA zJcaxWNwN8*S(gO9;uJDTUA=YZuX{JAD_qa)DqJBI$f1SILwyAk&;&W^$W5ot&Q4M| za|61Ea{==}i8DCJl2@7>V>B8dQ@FZ(2|M&_bhKjbMNO_B+$FOUKw5ARM)U zQnFm7818;U!#yAd7TBCv<*Le4f3$u??<)Nh;6PC+=1U`NG z1PCz&SR&N&w`RrVVOpdAyBe4i16p8;^+c~sv<>?9QS0C!HVS~6u*X_J!W_$&V_`c7 zVPMvE6=$nECPm_OW4tDQy2@?^>jl{G&yMZP!>9cG85IMFEy_SiyzdcG#sNg^$^zgJ zck~!X?8aQpeu4CB&8@e)lZLjjzn1sRf6lw%`_MPf8z9)a=aH?LTL>o-R6uROxchEW z1{`^n;t$u(`JIpO9}OR{X`SQaalZ*QKott||5-pY=FCw_Mj*l3!Wtg)f%e5>@(i{_ zTt@4M^%~u4I0d*u0uLje*RVtwZJ}yKP!r%BOxKmDc~%@H6`2z%9P-+e01&Ic`@LPQ z&MrqN8NhUOBF+aMAdYPb#uv1^byvxQJOFnvRbS#Z27wT8ea7Jq?Tn(OV=8n#G|Agp zLb&gpu8&K`az}#SQh2iaIj|uDnKyD?5Nx+|aCCcjBV=;Uz{r2>H z?68zcts?A44?Ude9XI}Md z5K@7m04vc|Ea)s6$`HBvdC&_AzJ+?jf{As=A}``c))A7|{Nd_&-e>JB+5Iv_VyWl& z_&CDoectF^9VVaF_Sa|COwR0QM_Z_yo7IA|z6T6^R|#xamnObjZT)GWV<{3Es0M9% zb&Z9#Un$}Wag`5>BT$DBaarB;0B%q1`6>;NljY`8e&>MgYRu_+5gT4Ia*^b`VkGxpJDq&f`ii}!BBe#N2APBG`O$aQkUCy{f(^7 zbCg`$)xI)wP4Kf7|Cp_ijn83#Zd^hDJ=|a-Uh$$acvk<1%EYS?=lZ7ZG2yjFR(R3*pf9jPb*)?X2{TZ75Y!APhV3rp7E zVp1I&ByV~xd%g2>>uNf6fZoT#6A<0QSZv>!zmHghG2Yc+Ew;Zg8p2y;PdKtQo{cLL zNYGqSWOzS0N3|*n2FJ#-n@(6PcHtw5f8qe}OqQDESdajFv=e3^#~kc-`h1~>8$H$a z?9k<`o5ST`AsXeFgxkwq>nTI+K9)Iy+8ZmYLhXoBK+UF|_q8AnO2+d&fmzR`<_PIg zvuU)lnuQH~kBsiPewf39Wlk_n4JsMH;jVuL&CZwXWMXAgStT8hh=0QwlsK2Nv9>o{?n?psYj{*t%WuycMuVkvb-$F}Z8nx=xrIz` zx^0ZsU8$4Y_;+RI@IcJ*v85^y1sXuD2`m**>wANk2-@HYe762ANl88gwJJHKO>K=o zQ!Dd8)fHK44ys8%zq>|dWChe#CRQlG70JrSbUwpM)~vGY{>q5DJz0jCC@o53zJ;|` zvj>xi`E_q^F{pTH1gTiF-}ORflT6% zs=SnHS`*OIA8g8j%}E{E!RS={oNy%1a4Lo=5M)^3nKAP94&7yRSeUEKV!@;L0VnPCPI|+QQanR+9^ko3C5)gONn(Tno0SQz*@D2$Mw?4l6R4n{%{Ojp` zfo<^8&uVG z(6Pc56uf`e+QT;$RWVpvn!NNrIyx(nbE34N1L4AmNp7m?R!jJND`9RYw6QLgD+adD zLWIc+sX_FnsUzeFY%z*!Ryau{PW%Pk=;{v6WE$8@TxqibAN$BaPJXlZD; z4t@X-1;%P!UykOgvqYG#Oq9?N1hs5?{222GZ!1P^x0huBIn01^a*%ahgFHok6OpyM z$xF3lu9I0;)vVt>GTq!bstOzXf}!=*zZ(a{Ld*kdQwl(ozUE*u!!r}dk=JDfo>P$9 zt$^qQ%ETW=MFv24B3w<7mGk-by!pVTlZMWM#`|?Wc#a`S=8*3+!T6xJf~xPbLVn5W zYd|9z8qQ-;)D`b|Ixw^r5bpCNcx_c%wI*-S1!h0kp|HGvUq};_{~e~ffsA&guYeSZ z<&e0ZGo4+Wqc5nyHvoGUo$k7;-M{Z;cKTaM_72Jr17}fj)o(d>S*fUgHW@+)(Ldgv zeRP=9|G`0Lhzc3$K!?bz^Y_iC5Mq5W3RJ6bshBcNNJ#9IqNSuH*H)Hx42e*s;PP%D z%bQJ5d`@1WN7C$9FlUeq&y-xW(F)_hN{gR!% zw2Sa@iOEYXQ`7GB?QLe$%JOoQeEl_r#)8`)#;dtX0>YetpT5wdt0)&F3dW}%fKuG>#&m?q+k$qP-(7{%ZL(6S z3*^a)h9-rZ-Ls7!@qVXMn5i*@LSxOmS|DU|+S1Ol9@cUDYxXfWUGT=p7g76pyQ4LC zuG>h2r<`R`Lm`H(R7klMU6*iv()?{>v9by)$8LMb+fdxF_k**5Ku3xp_odUjIS?AU zX#tw09|cq3`g7G^x?Nn@zwSvkoSCW+!X@W9H^aYB);<$XI|CO-YW1y?SQh2u!^w|R z`JOPX@hdpkLMQHbw5F@PfqIoJX|I%|WPU-xtQEOfDzwW}pOdakrQd`0tPfdjP0bUh zn%b#>7xI?pV@z)6v#2ww#lB$75|wG0JGgRexF8NOQ}F8A4bX%Cin=QRXpf_N|MS|D zQxmWS>{=@_+ynV;Uk-qyqcYOc8K7C!=PN5Mc)>JKtfXI(MPpsH;U8`V4#hxsnF?&2 zIL$rHHr6c5>Z#4Lx>8bBE-;wphRo_10p1yqZgO#Pofo?}`suOYXmsAgrTr!~SsLiR zD~3VL`8M@tM`F^E4hG2j%Qqq4=v%STGeo$^$!Q3r?ibqtKoxtqUZfvIj!QnaSbJjN z*G?}_{b*bmd;T%yq&SWA2sbx(R5=D?V zw^qgI_McE+xGKG?$Z}WATg=X@%h3HHjZVxH1JklFCuN?YcNmqmM7f{V2m7!h*uk{`7v_fe)+ZIX+py~O=MJ%J`a{xM;ptPO3`-8^6jyelVRhURz{R$QzdaD83 zvY06y0cI;loy+4zxSDP|w;+H&hsN5HVUHdtOnq$qw-CVpj4lt^9NO3%y|VfzpMS>& zyGiL}EX}W%l3z`Dq@L9VUmtD+WaMlF_rVwGclUJ70H;fp zy(r|1i-hKQSQ9k?BA8Jl;Gz)6YTB`o+SK@4;4|=3m?MIya*v#73=IvdRZ5;i-?ZuH zkx0;#Z$JP`b=XX;AgUFRz#SxN)(1Aoq6mhUX8ZA|ByXyyr~t=L?m0eSheks`AHu7T zl)mo30c~34f5|fRK&%6aK!jsD$?@lSed z*r4d?l(3IFBIbW$j4LY(0qr6rj{y+Mzc}PR{%gdF8OQg%CZ!6MBhOmF^a}!h6uq(z zp0^1&><0u$RAAD=6&D7M_=6SiDfuqWt)ZZmr+6nnyr=OC+@*YWF#+rN1|^@DkI&5E z{jV^j4ic=_KoyAHC2Bt0m{eRW0^9K$$bjN@wNb|0{s)462HzQNqi7&wgdi-F&av;q z53B^ixaw(`VY{^mVzNi-*g%$w!L6xyf6j~RvQGuH4QLbZt})c%lN|Ank1}EO84x;2tCy?Hmh-hi5F>d1*dKm#ajmk3 z$$n9^8Xu3RGUZ~EKr+6)?{$}l$%!>3B}IQCbMR{vHz?>0^iHO0d9r`iWu{u& zyc{h4iG5bGSO{=hqA4;c0MAeiB2Ett0Bst5zKs@H)L(xdV2l#-spZh=Ms1+{uFezn{zQgb{JVHW6&M;EcBZ+2}Bn&MylLPA>m+xU@&uK=srEMn+k3@gzWmh~qGq&YP*Z%jXmUiP}KN zWc&dky9Fzi@6Vr9K;hcnIY=MZ4JkMV8z8B$nM{S585eMkB^s+s9*e7WchlT#O7RGw13dEKQyq{vgpJHts$b%~(o-dmii=yIFC4=IvwKv4RX$2Crb z0No1c=Zp0B7O8X2E(-NscE=5Wsn;b15wiaQJE)(ON#z@Miu9TyY5k1)t8%-0doYBX zS<=HkJ8Oy`*pRS00Xqr0N)ZGiB{Lu?U0q!;-i)s73TSW!HM?j~#%b+ zy~|9>cKxvG-s0@a3iz|20R_JiN`+*%^PSRGZBYHAKVc69QVkM{)6vy|@-YoMdM^93 zUlu4W*h;g8XH~bj$;O=-9->+`>Y0On=&VnLWc7Op--!T+OEO=2%~vhc;U? ziEzr0ILgJ3cST3y!U*%omGPQ0-k?ls#4X5Wk>(f(I^~9y_dme+iS#!j87h31Gr&AA zw(6k4Ki^*tjx&L?Lz(Z_CrYx#FS6yRk;VEkWis5{UI+Hds?LyT-X!7eIKOr8!%Q_7 zpax1xN_{YH5Jn+<$76u98gEv>e2D}uYoE)Dv+%@3(>ExH7d0BaU}d*F zkbcj+J6;qT>d0cy>f-{^*kXbIDt{5-j$~nja~SxG>@Jy7><+IT2nmY}6dS!qq7blv zP%1JHJ!U8ci%$)g74oEHu5cKkgGKyU1i1L{CKeK*)ZhKzBlwOho(}_W954J-@x)q+ zS8}NTc4*>(ho#GO{%+9O-g7ZYU%w z%3`#uX8?^-2tTk(-Od(pp>RO-9Cb!9*-ddGdti|?ipPIGW5zgin#`d%AFa?fKk2pd!T_tY*VOw1(WGCFDtGh80CKtu!A$ zV8KA@S3|$Q0H7^p;fJtdsILbB1MtBh^hr#70tO|ZL8L1CA2ZdAu#+7#CeF@)U{YXj zfi#Ef(#-cjK15G!V=}n6uGqmK?yf|ZFNy};bKP9lzP`Rx9OF03>f8a0aJVQLjk#zc z{H0a`Vyl~OX9tSlt=I-QkE}L2s5p^ElGUdZCe`O1G|2X7aPLbTia!)GaZRnsE}wq< zpxogw+a8&!AU8f!B;(^tO8Jb+Vz{Z6$q8??Y0*;NV5~fX4+o&Hj@u^4Qd;ZrNh;C-g`l z$82+Re{~!ida##@ax75G)loowYWPD+_mI&1YgAMRKxOsd@Zlty)(l~|8%`G)HMRes zeQf@SaS0EL<#S}Oqwx!-A>4)_JbFk#Ag9pD%TQ zM+Dh09Kyr7?DvaGx^HrUM0Kpn-aJy5rWeHL;{~oSi!@vx!F^8e<5LJmzKvv~k+CrF zoy2Ybp+q#DV7e?4EuxT0Xlqd=#>8b<9NyEN(4$n4nYXGCmqTU zB3+N+Oup8&Kbnlvc{pe0P-fPB_~a!LQ8)pwAY<+X)Ru~`51x~f{>%FU$%FJomD`9t z*pd)?yi{+SZ)7CVgzJr2Wl~a@K5HGsWXn!^I{GHz%gF3R$V0s^1~c!f?q^i$%1%aP zYx+bg8w~soR1r*gb5gMGwR@#`AD`I^e6YhFcgHI_Pm;Lpa)C)?4y(~jl?=br(MId! z-jagzRT%-J1tUzh(p|A9ze4=!uGr&pK4f*aSKP=MSv|~O8WuWW$pYo0N5k%edyBnb zQppGS;NuLpOj_i#*-s z<>kgQG0|lR0MJmLK7XF7a_02)1&%*3Yj{#KWRj6u_>DL=wkI7oL^od|!7aI_sZKO0 z7q^PLd$$L9KJ3~BFef|Hxe`UE*lv~Qtp~(@zfFekmUk3L82b$0tJ=yR=ZY-Mt|^>E zvF3^-Be+KtJ2|96altzK92c@et-NFs_dGS_xxG@;$wJ#n_J%w)ZD?VWFZRL`JO!w# z9EZ4P#B>t<gdXiFLHp@N<Ji*DC7I!N#5U`iJmImO)KW)E1G`vnE* zn{cJOdp#&y0-vUD^`Cc)hyCBl@YKUh2>8dGmHdA?5X1xqL3Hhyijh^cyj1wTWvbtb z-=(%w)AAaQj}g2VWf}PNezTlGUJoOyEnZ)?ORcM-fY0aC_XaQ5xm@S>#1#B$-pbgW z&a$cLfJdJn56XPch~OcHw%((<%Z9~nRfnBsTzp0?l)8&U!dgB)$Yha+joUCT&;j!CLK}xmM7{YHb`{|aKdSw&v zavaTC(4*+o(SGOET?I@3&;=6(cya|!gq&@p=W<^GOwTz?i;|+7)6qG08=sprw;=(^ z*i8}yG0|Q0-{xDJ%$+d52fCQwoqIL#@Cge{S`P_)Wqsp;&qGWl8cdYA@&Fy``n;6~ zo7sTg=c?EBEHkAQl-UCf57gNWU6XY3+-&k^LH*&h0jk~ zNrq<-{okHWl$iIz>wpsA832SAZf-~k?@={+;DZoqQA)}g$0K!QSyk)8MdE&}E%k*A z`Brw`z8hg8UDHyj=q#i+NNpd|8cktuKf^}J-}?KiCvv?(sOTWx?$}y{#Al^78E|!K*JY=jJ!d>H0K0GRRk6KbPeuO=}|6Y<3TYbc1$})q zoxOrpGtC;*+&9=VGBe8MUm-^>{$Ob>R~sKs2qY8Qlg*dV-c~Ab;hIl&33IzR!^V5y z0o5!tq`rUuZUOQL3cfvbU{tS-=0;LwA8oA;yIeNoq9ETqWCR7fTXolt527^zLB0tu z*gqr$6W;!h_g^r8DH-Y850olQ08+FYeL}m~HG#vOxpBz7~y`b~6eix1;45ENtLYUF}A0sw+kWA0S@SfEkl(}DBqERMaT>Ux0 zXEEl!xpN1N%bggLqYQXao{Jj`@`KNi*yP+bgO9p_^l6{&b{%{rPWYrwi7GfSm8)wS zcJ%0SeXR9XD<8d(i`_$YPmEq~y0*Gd(T;i{6at<#Y4|jUIq>Ib4$o0W-3Y)a|v ze#+#&B1237Qk6N~`9ecOC0!4dAp>mLV=({@e0NzuwxN)NJmp2Trc33~@76L@&ud?@ zB5ooITxp#4kB<+ZzNCr&?IC#dO#E3#Sls{kZeWHMr@a_+7}xoj-jo{p$RKy|`x82% zosGWk&>;^pt6aTsXYee1i&nZ}7QC#W-u>)w%f$QchU|$}q6(^qMz*NtzBQA#-$T16 zM7{_j2?1HYl~&pIfbQnf5?(ajTcxHOeh3_i%@U%4ko2&3(gQUa`g(f#%V6Pk8gE`s z^spZ42j9Rzp)`7zR|Tud?mvM+fGi0>Bk|?Njn3l!g7=h3NsOMtTQ#U26%|}r3Gw6x zpnPOxVyf?$AOQL>*!XZ+pR!^nCm}f$P}N+2b#-|$Uaoxu_BgUL@TfBy@rBgl>QV2! zHOJmb8_ug#iuO1EWqJ_GxzId7MPfaWEMGU8%3pBQNe!Txmcq#cP)>V<|MNTBr=cU*2*WaZ>3M$ixZz#4M-C?x1UYx{K#3_y?h2~(H zMjhtroG@G-U)U>LUT}ah;`j7)%k#ftK*jjbm;dbQmrAoqUX2L&A;2@YP8_VQjFvHs z3tQ*0nT`Z%x?Mz`nAZrud2F(}sL_$D7q(NFhTDn6i>F#cj?q=?Lu6M2X_51esV;}p^-apoHtc9-09AiA= zdG5IG^IBf28dt#+5(13;&QOB;pF*(Lg~;tfW02B^7PgWd?^|3>7CwI5zV)E?qFSs`TIcQ`yV? z9ICERBok6gC0CNpcO55TCa{*i{24Opj{b9KC~~!@XKh54LuA2u zv!+c(l205|5=d~$#>NJSMg8+2Z~`#{(I}G3Q&;!SXDXJ>xM|;b2*e#wwUX$2B97VC z-rfNdB~V6$Xct=gY&3=T7G?UUmDbH{PW$V=v6aH!tH_}P*RcraUc^C;_x@<*$1GE-Oj99IF! zH9yBFjwr36AMdieKcbH@8yksS+!=89Uom4b>Aw*t;S0G57+~Cie(2muv9U^)dcqU& znC?P(`p!5WF(}$Gu(FcRw%&nxkGfjpAtX)_nyZdy+s&6CLDGQ#t%_40OHwlGIY8oH z$Fc>A3x+zGjZ{TL7NrG^Tiof*E+|1;b1>Wr6smuBej2@fwu{7lX0MrmtBhOM!SPYP zMi41RjsCiP<3Ua=%vBuOZSucU>ZswV6s6hZvtUqlbwS(WYuJcmy7cXvZuLz4v=M`OAT=dVoe#c~)O0yLQ zyRyWuEmK;?Xx|W0{|b<@+#j<*$)&ILAH#@eIsJZzb4Ky8Nl;^fpKbX%RLKNZjD(uf zzFI|2iGlEDVZ^WxbSpX_Uv=3Y(MP$*>k@@*%Y%mmlF1IEp$^;L1TY&g166;Zm|{Ui zL$^ID-=`!^GPVhVohUwY5-`^I(b^gVz6M($nYrvO0%x6*ADI0xKsDqB7H_Mv_2T94 zTE|x7JlqP~t9gL3+Fc+}-&#pen2gl!&J1U-;c?zR|Gc>&=H3Vc;XxrGo`X4KVInc5 z0PCnj5s3=8?)$T8a$#e#?Y8XVzcQYmn~J2Sqqg(yE!qQ#x#@i9%fShJ$Qg+>fM3 z+jai>gyI};RtnVgQa*4Yxw&*z+oLp3Bph(6)nH%*<$2!F+{}ywK$;!0GbnuDdn#7z z@oaCSG5!Ac9KtstMYjy7z|_GN>D+&v^ZjjGecji0L~K0w-!w0TE<`Hz&2SeOIrU0D zB)J2Njyx(hdgk}{qQM)yP|F14hH@w@K$!`!+d%8}&&YTRhh$C&yDza4nG+5gWif(ap^gD zChn{cseg)=+V)}|SW(*u_**6^h`(sqv=e)hX38D~?ZJ8?K@lJ>${>CY;G@ zOcW4ha}QPt7V|xZCPT6@yE>Qsx=(8AHK_EMsMH1(6(QJu&J4O9(~FW`|3^$7LGW2X z?G@Hv?Y8`e%u1dnwkFp5gQkXsMFwW`q3(kFufn5lzu-QBU=0)I(hMd>WA&f#3c@K1 z0{Jydr+Io6IFg^p#93)62Nx-+j9pMIIY}3)AA8;vcw{L$<)#onKRoWY$_)_M2 zf~8Sk!3s2vD^elyH~C79r$Y9M-U<{9r{q(pmGKxnE` z!VcIhnXFgvw#{2t5-4tc@9)$^dfy-Oy&Yx>16M=sk9 z&zzk55MgI4o?~;4jO?vVT$hny{@tG;P%mVrqw}@U@|-I%qpPNFJ}N6frfYMP0Dx*=48wm4FOCG-0gkRvHN2 zdQNUTmK)G_fC)cOxs+5$3D>4dBYDqJVK}}e*1ThBIi&t7>XE$DB=n+R2CKQk*|=a) z_mIWNwtPqpVgO|}Q-(9Qhx6Q$ABp5QD(nmC30`!{JDsySXLC+CA7~v1Pu)F(fe+NkDKc8B&(P!oXk+ImO)`VgA|j`0 z1&dqP&kmA?rX~c)|9%Uh+Tiupn+KF=U^v^HO8*!>4%RW>N+~&K3VHq9&SCLr45HY{l2CHa7R|Er85Ax%Gz7X;0r`~tpE zq-4ug!Ag(Fq2+6&K0EDMsX8PBbiRR;WEt2TaRz_JobsFhxn|XUER$mC+^AfeHY zg@Z>Kp%eydBVNW*A@?wN(eWar4B@}r<#Sjd7Iw6@&8hd`7f{&V#fCyjZE zO*Om8@VB2*6R=_%sVXk0WF{>gs#KjxfXA^}b8*=_jheQ zc{!BzKF7zarFB5Vuf%NfSKwVs7W1CZnq)#&D_WE=49(4|iR0#MZw>y|$eYs}reBVK z2d!>8slI1*AEKvbn7(2@9$C@R)3KT@>uX9G;qZ0+x-D)v303=ik?^{XO&2jz%2QJ-#N zalHWC1IDS{?)2}08;KVE_7213aM(e91DHK6{Y?#nrG{;7D0U|USA)>$-Dr@6kFGqO zFD|a@eP|ka?=D$puitoHeR2~?OowIoeCEa|=(-3$XG1GQhC&ivA3y&pQ56-MK%Q7w z^!aGn#=?3+sK7i4FG=rP;c#BWgPi_aqGLb=WFSIvdV0|gF{LIgjooi@ z)dHayMTm2jQ>Bax?;i94L8}Di-XB@v>`hJH#oMqYLaK`AR6Y6W9v^IR$Szm_0dUMz zlM|*B$)E+Tm7F4#@%A1zufI^rLvqgOu=&Sp>+94t98_;c9E}I7I0*#kZ@JH*!W=#d z;=Qa955cwXB+{u1U7ehWEiLom`O*3MY8o5+zDP<`J3sM=?@N~;j+i*vN`#FZ>u6mt zr3YDN2&qG<8Y?Q#`pXRDuVST_10kf+Qa|CLGcYsPx3r)YD~W^L?RT;j0h|pGn?W-l z#3yByl`xt;nn%L|fcjbs^=ST!dNnIXpYC?sba*@_$ z=(|b|T^%Um5?_n&z}o->9tLLiW@uUxF{?At$WVnx#maMM)+8U9m>BgWr$#eZP+SAJ8F`-HN6hS;Y-+!^|3vh+W_uuH*G%j&c$3BI;N)}}>6!+OOH8tkob2om z!NE&Vl!k`}MyVaoz<>f6#bEyTX#NEyao}Q!YeU0JFju+DqI44uMHMXU`a%(AVm70O zq${VF2odvr$f0#xW4V-}RY$`?WAf3SNaljU@7bQCZJeAVPzBgomsbx{)C1lu_#7s& z+{Alg3|NIJ>N|r0-4upxoGuE@;oZAF5q-tWQk?Zr7wJ)BR5xSjtv*h;I!s& za&Q+6Oq8ii=^ygOtAwLt2RD_KR~DLe{N6cK4VTe-%kkV!j;*A`&S%Papa4j>p~_z# z)YLN#+RN-$>>X3Na#KGuha-xkzvdX#Q#u10+h2dyK%5)3vu1-NJ~<4hw$5d~SX(fY z|FIA6K7;hQ%P-`P;=Rz}Ww)}9{AxB9e9&2V+9&td#OFl-gnlw<;uMUGApuDQm~8-S ziQa10aZ}yK?HS4g&#}(2&2wx@?s%9vAs?l7vj|H_K!&6Mp6L(6OWgV)>WHoKuNMoM zY>>!;ryC)pgO)q}M9_P1swM$x1$gFY&gX*M16;RYNX2SnobzC9MBvSvTYw9Qiixp$ zO7o>^ylU(Km*_TsB;CY~%C|t`xJM#Xs27Z67g|~2pvVml!u7&l33)LcP&N>b2#86W zhkr#uK!ChP=?oewS*c$?e|jF==SqG<2^Jv0QF40u5|5YV2B&+_#g*%tdU`$}Wo#U{ z1G7&kR@Sm*AQ#Yj>>^0_g-=o}PmaZC9{K0vzjaybOZFAVVzaRoLlqzRc9HOdsUZF6}CuT7~+S3P9&A3bbOY4UN<1@AUZ(-`W8AI>o3)+jTH2|a^pS{ zvB!T|GXY_)*vI5*Wym7<+!5iLWWtPqOkp8L;*}urDn|LjV@*87Wvh6!aXLS*Q+O~n zFpmcyjtWOy0iT=tomJO7JiWXeE-rTM!6~Er-8m)+6B5R;-4U4}Pb?rU4RY=r&4zD1 zU_%oc8ykT5asK#mLtln9K@3~0zg!kDwcg!a9eit8+ZoT(0VG8Z8w+>u)$y|1%}`My zV!wEbOglKAhNK46F2Ld4pQ&q1*y7H~{c&BHnm%7KnJ$ol%_ z;SA@pxDF0?*-hy=&eVct2vrUZD7s3Uk^7bQvS_4GaANMfX zOjU&4_%Efz6TYt&0Ol2|CILN;)rE>*4anU&-DslZ^}8N2Gr!+m>LeEJf%94}=PV#3 zrHR3$fin3~o)zn?zvh^!G8?l=!z(z9e5?VO z(@r9RR~#zCiX-LsIPjjoHW^=kc6*?8a4-nOtZ`ku7tg?X#e( zq!gT-sixQ(X6F(;QSLkdO0u< z#wse%XRbUTu{{vPWk^e%to&MFJmJ(Z_2Im0-JnPbbY2|p55t;BNVpMa)}Ru#gaHKP zu+wwMRY5Z7m8r?uSjL> zS{nD?0=Wh#N*V^&pMCJF{?Ql^2~JE8>G^6$Pw@YJS+{20LUw49S)y;e4Wp*#ONbig z=2)KjR!$^0z;odSZh8iI`J z_P0O(+KvB9?#40Mi_}(Vjimj9tN-gu&n9W=n!Xnem+8~|aQ)-s4$|8z8BaO5IEQQq z|8r3)){hY-4rSRvGVM#@G*SoAtiG zLmj0t7mAc?uAor&uWCjZB7aOl{y8)bx^-y(xybG3`2{6EdRmB>!O2fh2-FL+mmZ7k z3crHrYleV+dTmy;8uey=QBmf~r~jORUJi-h-g16TPkZ%KXsIf0n$ZPQE~B^wUs`fscPj?BncEk;~|Z=?6#Xd7D>NIR@oX0O?qO$oWVU6_^@mzJg@>VB{oj^e$!<$6v$R%-UtGRPUs0n+JI zA&8wnDW-&4m86oAQFv+T_wR|4wU?l{dF?M>v8JtE?6%BPhCd$v_H#zI!tZKt`}nzC zGUMCjDDfa2MtT{DhFeRXQ0f`#He%3sK&b?aueSP#l)G-BZ6=CRyzCx{k6c#u9NT6% zY}3ifk8al5Z;k|1RjK3(z3hkUVYRYuhO3)v_S_UX1y$WgccaVtonN#zH&j(B2t|j? zYB>7s90={YgGW*S zTOgVU%nxK8eyzQ@f~pBv_AWk}l*GikEysrNHlGCJkx?eV#zLacpWX-6>_;&E%O5Ti z)lJG|!vP{{q)@YBeGZN<7>1eIYr*~KpoJMoTpkh~@}u+qSQ(+yB_wXLx1%`{WVzkQ z+5`>F4UEc$!H&Btd>Rj+P%D+i3K=Y3ZM8Gz*hgZXh+sa2hT(0=o(geg6u_C)H+ExW zpRHm;7n_K|;YMz*?HdBTTe!F#nc?o?v1O+7i%oU>0vR%;uo3!0!Nju8oRljL%Og_1 z+6R&J9zE$oO={#~wd|qj}bS8D()1pT=Q{ z$4&JD_q{I`upGmSiryZqjT&-Dlu|(ubDBC8enfNhmnC(!G&dqwNpaR5zPAG;CJIW5 zNv$nOuFVqnIPbk$_P&Jz&h2fU_LKD;6Yqaz-Ig8YefBIs{O+LaQ<6VkQe+pRR+zZF zoOxx$u%UTMW2%OS60bW)+5U-mbQ8>5Jz#s1rgSPpiRVzf(_}sskAt?`yZSncBRV_# zwcCjs5y&l|EW6b{pMfl^LH`A1!liP~eG5gb_S6SLNk+RfnIgko4rjYfowPf zf3RaT(sPztY7U`4VC7yr9&o~)4GD?woaCu2yJdBeJNxfq6bL^wAL727Bm>t;(4u-T z@X^e{^8LbP=}B6v?ny=A3+{dL&hC)iKs_t;7ODCS*9J+TWsZz5M5Q1xm2^3~Ihc1E z3I2C|zd9zqtLf=IIXyr43|h<)=5!I!*Ym#zr~$|tvA4&9b)V**qN%>Q`7m%q3$(}Z zKjYx~)wl(Af7*o|E#F;T^V!3t&d*VwJdEQiWJiGp_%0)ZNGT2T0G=Lvl`Ua~`W2>ihOs9KCbfYWy8DrC^mX%Ms7vjwTXda6SvRUP8N z?c4INBqg;GH9RoX0WAWXv302H_hyI@1l_|bo8t}q_;I<<9OZ{_Fx1IFDGdWvUte=3 z0#YE`G~2wA#{-ZBU`g;3G3~~Cp>Z3ok!hnP9VV~J=Z^k7Tcdux+BMplrOuNsHLJ!+ zxQ2S~g(?fqUBCe0Iz9A)+V{~`XxGhz=EkOorvsMhc!I3m0m1>1%`Gi{@R|XiV5Sg? zEC9B(w6rCsD)?^l+Dcl>Z+&NH_mxBiC%?|NfezGT>-8b+1HPkjNecxzXZh=AdTDxZ zy+NbDUYkY8qjwL0L7g*oD4_3R4pV+wuHM zPP$-JAuEauhK0d;1v)msI+gt=^(4YIQ=wm}Q@yl2wbuGt>l;g;3Sf;I{ z-D!}G4TuxgG#tOSz!$bLr9O*_g5oYvGz(!MW`P~$V<0uh1o}0ljt-F*ZPf3Q2O`Af zrZUe=FUA^DAobj7)Fm>L z%9Ylz|H2xPGe&StAoA^}w#8*PuQc-+eok}li705B6yw(+Xq}W9_x$zNl0m23@|~OP z^N@$h$pwN3lUdnJqDiTtz18-8X)T+DM#+dRzS? zDI^{}=7@ru_jXwUR>Q9zZOcr#KwD#Z;5B2c*E%24?T=3c4vD7pyh+g$hs@Hrcl-A3 z+aT2X1Xd@6rBG78MU3OZm;MJGuc6lGY6t0O04z&&Rr7XnBQAqG44`i{H>W*n6G(+O z6%+HB?hlvx8uqC#Er`f)IGzy#3`W6#=9^jyDnV7}?R$8y-s)UUY2t3YsCEW@7ib{8 zzJGrPb5h)4ywOyk4i^f%3q$EddnYQreSI)|c=zI>^p%)+s>DPERN!%Nas2N)&r}h> zcyo$66&VT=hZ5&^Tb1^PeYrgHc@B`Ei*>10=eu|)4#AEHig+FA z&!NyLXDT*A#3}R8v0>$~1%P-Mwm+Z41u^d+SxUT*B+r5>_Qyv`bY+shK#q_BJtu1@ zX&@VrM-!DW4$zk+sSfr38(8QpD@V}b+WIL*k4ud6;+4fM(=k4u_bIqA8B)Dz{b#l` z_1tq2+YfZ1>%U2tySLE*VJ4c(8|hJhz1(F*E84M{^yLc|Zt5C!A@i;p%=^4J$hKFp z64YVKr){y`|EQy19c0oOzL8dQLJSx+cX#&^vyr_wCo;DwB=5~-q$kX+k8E1>9iqmv zok;){cx7M=x44`WZF~Ey+?E+C+>JrvA`+l%mW4YW1}^}h=)K{R@A0^N>pij8K&S}? z5!bJkV*t#wZga5XMd5eqOt*8?vhsntjvQ2gL{k@SE+x3lm(-F@R2UNVearQYrbpV^%I)W-@d(ayI2vHmXXe^5c^|G{NVoSD*QEHh!~8* zW5UAbeIuOJ{*1quKYKriKc}&I`k$kv0b%~R@81%Szc!;^6#V}Y-68+~M+xw`f9z8) zKDgkp4uO7wP`*zaln+`QKcC|KZmmF5M(% zP2x{^B0F*OkBH9e*21U6|BAf~k@WmSCJDdxB`?~4!(JXgHu$gD%Xt}D+v_hEtaCPe z-pjB;DLJcx`j0QnEzQK#Dn>;sxB1J_n-w7aD6=zod zr8xfAw`(A49BsnaCy$6rBzB`Ma}+FFrW`4IU* zf2=mR5j+3;^ZFm2(I1xr-EmkF|3807Se8&Av6r{+?#NOCV$O6ZOCB5Hf#j^A)*YeY z-oU_aPLa<;AF%Fd_Pt+e7p>wpyfrh9g{d<^UyC<-0W*}AZBq%Ow!hzgbCqE+9S!@w zWwF?iU_O2@BTQx&?tOD+V@>kAj0LC zT#bP479P$|AlMzBjG4nUf>3!g6&|`!AV~-5U3ROHu~-0kRsjWV2`0fnO4(#p?}OcZ z`dc=Bxj$o^3o%?4@_lOy=dk*8(itwNuRvEUv@7qq;8eO`;5}AE0;O! zX0HbD9$y7g{b}y*RQ4lnstZKsuhV({&7M=)t@4Z>gNyBw#wjk|?Z?)O^gsg)px#4P zmW$l01Z3^i|Fu@6E~N?QczwI94yY{XEg8$@T?mgt!qgtm>^lVZSsDy@W3@&LqVb?} z=7qXoy!%GE`&T}cMrY|`&-d>YEB2J23T={QwOn=lfx~T?t-)mS^-G_53zCD5vl5Q zBx)nh+vl0%U5c{@&Bjw)b+_Z0_~|Rslz1+cHctV%{0Jtr&QA|QQu=zb4P}}>-fx?w zule?yPR`GLH_HEKc1}+D;#~drhXP>RER;H^+I#xdIhZ6{rTniEAS304j7&RkLsX1fr@W{7f_9e%y3qE~gfQT=z_lp7P)d~mj0j&fhIu{=JVf`>%9^Yn=*x+g)g%?J~6 z@Jtw7o0S2jG?oCcXFxne*J@lsPG!I#Aoh4(LDk_#CGsEa;=s%A-o2wa*2>@Bhed(3 zktxc_e4W4+*xvpcYTAKgHs$3XVNw`A1D6m`ES97$M-O>;xQ|TFohDVwK0!t?#|sW8 z(ito@7sjV{7o#;3M@mU=7&Pio;6af7Bns~gJ2aF+5_;h7%yuUUypCn^&d#Qp<5gB3 zdoi?*2o=_S-S~cWeZ{ZbvGIL)8s!P^B|;91ZUMtAZrOochK}>A?HEv#kkgX<`~1L; z{i=Vv5m>J`^Dqc*U}EVt=c=ZrJ=)&eo6n1ThIRve7VNUK70N%uz$ZQxl&c*aXJ2BG za=v)}=2m2N^|9sx732kPGTtJW6SIC74&l9aZ?Q;)a-%ypiCIvlGt%Rsv>nM;YD!&L z3p3{$bBi4g>ea2Zz{p*n6c3K)2?z&W@jQ~k1RP8xaMHOeUMqNxl-uD`OX!n)r+p(R ziHMq*uSU?Kz?>@<3dFGz37qvXT1J(ca7eWhau!cQa*x|33SPUQIF27Mq^4Mgqzo#N3=~&UcGwFa%azw_k3+vx(^*D4ob|%eB7U-0R50YA6opc{obj+ z|MA>PRMfAztfGQxVveye9eZD11eqCDj-0WJtNHH)0CasvO!E`78@>Rq^S~8D z;BmKAzHEe+Lp1D0X|Lmy3{I&-pWMbLkyz@C!!TuEa8>FLgE{cdPQ8oqa`?FC`Kx-Z zuFkN>MHlKZ&MZW7+Fw-VlL9v;MK(*$WTYZ|?A<#D)v`M9C8k;*?ock7wm-GY-`%Zt z4DC2Rygxrdpj={>D$pFXHe4Lwk@x^MDvgaQNAKQ?D5f-!5v{d z0L9pN6(`R*MJVuSWhr61+7@FU%j=#=G5xB=q@8#RaZ zQU|jc^(%UOJRE6*dwhsl4A`(OZEa~I4vhC>SgW>XF@{G+h^8nG51s+UB0a&;M@GNX z;u*sy0bgupfH`QLKh3Oi&a1N9cj5uYkDmU8E!XNoWA;cP@cpR=J3Cb?%kC5Y(ls}q zbVayAOV|>DJa5p^_+f~1IaIQ2Wl5gq&PX*ei$PthEJ)ktP%kcBy2oL217J0wT^J8& zxT_TI(khocrs4ilx_Rt*5)+J#Ty=B7e4Rh)ebLa-l3Y&@7A|T~7N&yJ`lW7*!C3uf zgq!w`@!z3IZ9qEw&=P7G2u zc}T+Z>eVZh#5r6^@KmCe7De;NUmh=K)QtdAVdA$cg);s(sV_jK7xG6~+!OYc#976SWcCe2E9r@P`~6Q4*5empqCCZ`%GI zOpPgI1`d6H^v|?|LYn>6p`~=&)nC7UAz5RfW#K(rCPRVT2P0fI1B940an$m81$$%W zNR%f~6$Db>GU@KJk zkq}K5=|cievfg-9cmU}E#&GBIn@RO&z0e$-og+s}Kpg<88Zg`DKHbyo|0b1vbm0s$ z>S8pTJy`@W)dyIBkl0w|q+QtYbVf?2cFwW+EcRRP$hjbRJholW8KQT1t0Q497A|iA zR6(E^h)^ueIHaw!?&1rU%hKIV69>%M?yMMn{y}=eo2Y0c{~k#NT4vNnl3dHck`fA$ zxnbJk18JtpZc3#=anI}u%s171Fo}KwT0#h%BUar`G8B$`n^?eN`y7y?I=^lKeo@fD zE!PS7oJhuR!dOWNNYt`<+1c4I&Q|F`BXfM>ju6O^+Z|oa+ig49#{`r2Zs!em#3?Dj zS?t@D$yeR?M$J@dc_Uq7J7EG1iUNx_kDm7DOGaG(xV*@nno5@NcD9m99PAwx< zxF6~OFNJZcY{lvr@YMvKa2+WS9ePrHx4F1~IdsPIB>+jV(0RxVd4tZc@96`h;cMF0 z@2l}u(+hzMKqWv9pdcaHK$fy*r}5RMA_3&))!V2j@_DMv8|I_gM1^`?dUH)Tb#(O@-F`Ym zxFdK<&8M2Wy7ClUHAbuD)ha>6mwmAnKVGQj10%bQ*nHhESOcn+=3?j3a(UQ!N6MYqi35FTW7%;N zZb?>_tbYg$U_P#*$`lSJc^%Jm4PGv@qoZ55Z~s8jK^8YL(#C@q2Bf6Wy?;iHHir%U zD{uMWPJk8@@ZyPNoG2(66zZpw|QKgqg7g8_keN?^5u3kJad?I->mjmdE(;YLI?w_DEW+x zAMZ0GEi;*9jH5=o3IIWQ2W+g0o7fV5ko+1>ym|kog`1E}c zDPL!Nwet!9aFY(V-rqB(0*7;a_ib;>>i0K+8L&VtzdQ+GZ2sMXCYw1xpx);S)2#Qs z`+h~h_vV$I%iqYO*<85*GKhqa0G0;j7Aa{L=mHu6WQcLi`;rhAshJBp1lbJR;qnIK zWsJPMyrA^B3a@Ge-T7b?mSH1MH36EUwH|SZe6L(j_fx>y(q(sl=r1fIc(i=MO_yLi zACSkmrm(5c9R~mlZe4V>rA|iMR-HLpUdIy_^R6$7%O_#%5#UhQoDz8*C0!z(hBduh zEpMrPg?Vpv3LCBpMs2sZwx+8h31ENfa28#f=FgPRlYrM+RFztLYO)&Es`u~QT=L0N z*bVkp`)UlL%jU3)mT19uFzyfdT`Ml%WSg9uT4I8x+g1=(cq%9 z%JFM@>UMjXB~0#I(a_g#F6`oIE}e3bq5LrM)lkN1f6Z`BQUoTTf`F!x2gFs_qBmBn zsD8tHs92_Pi7!uCe_U?z-|t6W?XjJ=+TZ>c7phPK_y|-XOKa;nxVhdJxUO4u?_Tg* z1KB{9{$X2jSwpSHmj5OJz!%^1|ejPtFs?x3&4`ZVX_O!%0?pXU?&D`+$G0% z0wAJHMq{q?Pn)>WqMqH`(v#nP0Df574{)Zpk^~%sD*+a2c2|)6$>T)1to;09a$43q zc{rZRhhtp@VB_cmiWlv=d(+_GnA*uOS?lheG*oIf`4tRKnml^XDeXv(kCWh$A*ZK? zI^(zx&vws_ht#u`%0EMDb4U3bGfYMUKl>eE)0eX7Yjwa9exU@`Bl(l6Jsen9MaEO{ z02A&h)R%+=OO=Kk%|kTqaNBP4H6Lv6X|*Sr+qQ7Z`|(@LOjKGJy)&Dr*d5jmp0JO* z)W;0)#eyp-rhv-ziu5yVgtvA*$kt7YH@8%+OS!!p?Y%@_#W^f-`pfm zZp*}RTYAFWH{?E=m@(LZ@dg5r#DsO;L>5fBBd03&f6Ho*1_L=4r8`--?FIkL97Pa; zQ}874bbp<;dsm$jYjow-UP%RGJ?LD1lu8jMFeM;Dq(;Z#lmiog8Dx_>p>*1^su$%!5`@?3r`yG;Al;dpg zrjYLmP#DN9QMyx&p(&3>>(2dm2A_h8;Dm*a%^BR=23D~tY{Y`T4ccrBR!-cbGFE+!Vre?`UqokN(XyBdcgPNLCaCRkA!OV!R z;uY;^9cF=xKi?0i)df>QMT-o0_8wX*bhA68^>iBM=GgNcvs6^Pyd)IqRny|E6ci8W zZ^?XKcfSyU4GpeyF$D(y2iHcW2;TzvIr?$^9=AoE0@9o4 z{EX-W=#bem*2{(!0Gofc4&Zz@u&@^2WAo`iv=7Yf8inKKZw4s8CqtDFLEzfolJKrZ ze{)iLcRx1stDrP33;vU99b$J6VV_RfeXmj6S{{@(S$fUiO;h$(SnZ*ok0;(^LCFRF zAX>lVutVegLwmCg*XmM;(Se|&*L2ss`|(3j*n zg-jc|sLU9vz0v1aSKS#RqC8Pl-Yb5ZK$bQro1?^vQgVK*pMSB0cRXI5uuby~5m#>Q zsJ}6;WeSQ0Jkd)sirS8k5Mn_RlDr~z5?CcAC0}@)BVc2QcUvTaX(VCD&p~;34^$Pl2Sa&j^TFdzP`Q$ z#(CLO1a(EH`Bhx6^XKx*w1YNb>-9 zv#}S_m6k7^8CYXDVb7~bL5bVW*rBggeEv8MPTw#*l}=eWI8M}G4KRu zT>n*VVqz-x#qf)A=h~dV(#5&GgTvlz8@U*V+Zjj3)29$SgfGRrPbxHNFnm8~COuwQ zNB|dkjbP8A8s@eL7o+JZFi|J*VVa+=bWWEh=ewxGnu>Q_$jd{hD*ZX&Seeo zf$=8UMWo;Ha`Q)R5v!!9I^n&EdE)^cT@dVoL^AVX4gIGjb?>X}Hx3ov|9G>;6&)K3 zJCBUjvpemw>Jb2<-hmtlj`aQ`-H8%sd{SEI3!xQ{R=qh%xhz=gK$8b4s`lLUG=#rJ zmd-u9Yzx*6{T1kXsI>>bvtEKicU0cy{M{*0*VnVd8Ek4fi|Kg!c67XRrs9I89f^xj zVki+bYcPBQ66xVW+f~%78VrQX00e^@Ki}IJprfNRE`RqnbUItkR7HyD zLMit{tIq0*S4Emn*hK!k*By20-%@FkgCXJBWNqyCZSUVKA(8l&W&DcA#eLQP!)f2P zAH~W*x@5HaMLIN|w(8uVGIn;|`AI{{>P1?tKjJIwuV7raGMb~Dgdzr&8jNsY;?6b& z-nCgD?BFQ8nV9Z-9Zo2CG4MU8j{~@{?(*IPDo%3~omyF4b~N)PU?E-teJl)Fj;{{U z@0LLW3~oRatM!wm>Z%);?O?mL$M)m2v$w zEImVj$foWU($uh1}du`Ruk-c*%Jr*N>DP!SbL zO6*%1-X2n?IX_Sag8lwR^!ClIQ}f#G$)Da{6Xo?w0R%FIdL1~cQdHrMHD#B!*7~k{ z)YaAD1Xn_(3zX(arVE7F)sNEA=dYzh4wX+wu3?<%Stm77v5#)LIhdpDw?KWu%SwoO zc5!NsgobWaABt8F!C{*v4TGA{9OkGziz`SiTD9S8CGLBcl!WAvPgXn6jih5=xVa&@ z=So8(h5BIS@-l0{YUb?tg}djj41RPgdu<#5MDCV?sH114g#sg-`LC7NxwzzNXKhVA zh=5RC?i+%9o69{OLVaRZGnMQMjHRx~Q#>iDk_Q@GC5kU(8cQIMZpCxLy;p^ z9Qa8|yuW+x31t2=mCV>pJJHFc$8WyJ0j&=`7H0ooe%mB75F&S&} zn`_Pou^VI-ABlKk%p>Upvj%2YSH&PlsNW%&d`^1gb#FGUzz zEuJG}S52+RbSMafIS~qMkcV)Yl^i zO9{X^=*<=h#nIoC{hFYwSZ+n0()>{q3QlK5cC@JP-=#MNQZuI8>oOB!dcp4ko<1t( zy;m+S+_1`77KP|6wzf2b?(>MkECK9v&_oAs&(sDK9q?LbR&$S|9V^L)0(3m_vy$PD zj?kl}a|DZ`Zq3V=&A@a};Ix^fzOOIT!vn=Gl2PD%y>vP`fFf=(ptK-)QM*dk%__L@?-J#=9F^Qv*thaPvsodI(Ellzija zb*?D4O&){F0DRinC3QE=%^Fvev5Ii;LWbp>**O=Dr}2wgQW2rnd5-NVID&@SwR$sk4C12ieMBc|4dq zK@uOe)hp(LsK@qh1>wHGep8_KVzwew{R36vf?xn`dn7%<>Tp9G z4nnVL8x_h!upKd*ttpgj4ohXP^_tfT<_#fX84YJ&f^S-LEWlY_zPyS!{Y|aryw2L*8r`8zq}Lwx zBUzGH^Voh05ClIad7K>>-Fvz&FLfp8!zzPPJWOhK7H7#j0**qO;7g^$_9Iw<$mKa- zJfyC_QtC}G)c)(&bfmi55AYrdRwDtK6Y%L2Pv?S>3Ak>W!i`F6U;Zno45lYGCkLy@ zjMi5z5A^xbV3=e*zcs_ubr{EKeKa2`=>R2G7|q0>{i#m{=t62-iXG@3F&ZD3U^?+M zOMcP#J>QZ|`|y?<-)0|lgyMpFsQI7?%27OG$sw7!Fb z{tp*mx|!9OkjsS9deYGsYGRQ}2YVSZgqWz%#^JEr`(}B%J=cuHSi&1I1HCZal2Rxq zK!A`Q>3bb82TLhutb`kp8HbbaOPtr1rCGjh*6OJ;4e2S}<1xZWUhP zl%ubuBwyf*qz4QP-DQN?8B6<`7mk>ujNlLIjvVCK8E5X=8Y6X&>JQ#=Q)gIkqsha9 zcWYKkXQCq{Y=S)Rwp_Hz^?|yQRGxQYJ8sxT#-@@JA~zZB2X2+H5e_|My>b5V6U$VX zl@V2Tr`O51tZ3Z5RP}thcn}h0V6u~ za?iXx`njf{oZlPBx;NzS{7_5)OCT4W-~VcNVkZbv8?yvvznWCzHc->oxo>XUnTt#bW5q#GIZJOSw-9MrPKJ)Q2}%Th2e0 zT|?_G@LWVWAXDi^)!{Cxa|9QnC}d|;x#$5I*?S03@kjG|3^*K)82I`5o1z4oDdMO5 zx_DE-?Fs^l#X$DSX)^^v6kjaTG%z-3ngf^l_A&DsKPb#2dn0A(2@rGy0l>IGWAY4# z;)$$mw+l45cYD8wG4@rJ>Z`-#SKCiVYZ4{C6Kuklhw&s}9v)RMh%dT1qllv!I0yNI z0Uj9iAspPjj_8puCj_}?C2r?@qq#4VC?f*YQhK@}DD(U9;oF-}l}xMuy1BB#eck9e z?k$o7PvQdW)4cCfjnyLD4FG#h?(b#* z0~ZnBw3Og(Hogh#uM&fRDN&sdb#Jv<{`l$r(j zvLfIHUK+c#18yBFtHli%Q)!7kICx@@tm5LiamgTi5F^@!&|;F}eWOiL(gdaW(=zBJ}j=$HEa zrv!!wV+zlj1Bzp-N211e_MfoV<;Ib5ij2H8DHE6-sq(0FWVQY+ZtP{Nt;}?}?^h7D z^GxrW1??cuy*3)_T0QV}WLJ0Z$g90jn!NxO0a$4>T#T0lR_yQK(`%RdfF3?V zf&tHt3D!nRu?ghm0Xl7AVKWak=SIB`V+zWlQBl8OBA9^?Q>EI<8%%YG4{NzCAN8rb z-T@#<#2pb~BXjevS#q(h<$-|VVTGEbGiy6JhCpMfE7!5fADz(=R9AsrnNwl~RhtL@ z`<20J3V47zT^n(!5!Ay&InI(O2kRr}!F!S)KELW#;oboY37G*^hMlJr*cjsEcBU{To|N!Dlq;~@EKk|8k45JbWwnx|F`5D4gi z-iA2b7bFt&d4cHEEuCN!Q@l@Q01HMgc1 zS4VG_+%?!|z>iTBqS!#%ro5Wc*|zV;hcB>pL1~lW-t}Nee|0<7J+8#~8P1L>ib$mY z_4U=7UXfqZxVS8?v^K+Ajlx2XmtadOe%$PjS^jf0i zU{X=eS#deA0fK>nQE9(E3l>sQ#w=&sr<*RNE}WkZuO1?c^{1QF&Dy~{dfd7E^*+$H z1DPhOM?wNA5GeYyDKvEsHYVD<{BRX_=YpYui0p5q zNyMQ)k1a7h-bx8pfQmMxk-89Qd7qp>^IT@4<7U@nwc$hs>y#^khuy^mdZZPbyX>|- zUGAc#Bs|FHmM%fU{`5u-P;fAzQcz7{m|^&Z%khkKIrUZ}NV-0_hd_G!L?Y_Vz{IUt zzEsoILD|t7P+z{&=ZePmY$Im7wlKr#YY+xl2kkKyy-rZ0>ujYxoW;PbtU_YD2YFHhQXi4`&HW4WK%oYBrC%`=~%D( zVg*H2D$S?rwMhCV+p#nkm*3BQZ$#LZK6UYI!BEIz)OBA(H|0f=bhm|F;m@)A1CGZ7 zcRt}F>_sEi9B7Hz1Eg1(3*|#%m5wDHsoHlUHc$6LB|l0AB!H(Zooa;z1xwgAZWD7N z!b7W>oSYoS1WjFXq%#=U*(s>qRTCi#xO-S#sc}g-n6!CfA`bdojB_3AE2}Fa;5@1B zdd}JwLBAC4hnpdnLp(Dx(=_*p>_YA9Ku^zY=){dCxKZ_E%gYammZ5v=8W)4S`g=PQ zOnAS{>d4$HktE>*hWQoM%Khi>lH2!aP@wIaDptAyQ_4P}6gm;*-?;u%|2cRqKPrwI z>is0E=O1x(jnw+3%!KDrXnvC_XA9@!_<*i9Z8enFo0wz_TEr@k zb|41!kZlERHB_QKX5|>$*J6h+EOck_JWGGK?Q&`EO4BtNh5sop-MrRy)iA+C_f?pc zbGpHu&c+^XMY%7EqQP5oC=ANDfTYF&?&RZ?V8XC>LoFm89nW6>I&EiSOz7+jab?Yn1MK$R3fh%&UE?;w3xTL&t%2i50A zago3o+?;v^d~#zLn+C<`X~-+02{Xu=iwv3-!XOxc=hd&dp;7C8A zZ>1&;jlOC}Dv@r`eIm;=v(R!)n1Y9YxP)&{`)=Ox!*rhX3-r|{fyXzyHiSpUjQiz3#IjrVl!tr6=mVS5rM-25c z+mC?|#RDTEZ?#i^3$gT+nHh;$Ki?Mj>e(|4Vwf?A9$Xm11v+`BP2BJLpqbG*TDIcd zvG*OScHl^piiHU-_6>W57Q+E@)KuCGWTa?e`u@Ip0F#QxYp1}S%U2Er3fPDE&Mqr4 z#3GG%|63DCPmGsaTfGX{}`Fq@4D*) z&fJqbFK){QQhml%JiKXiCimO!>3}n55N;yX?wc114)X#T-|+!zSpDMt+*iSSM7KLS zdZm}}^wZ|Fn}6%1D(YGqT$lr1qiHTv@sF;WxRMgb{DSi_WXT`lvX79$(&S~xk?3&@ zT+#S)FAI5fa8h-rrR@8fYAG0ZFk!HhJ%38Pgd$0#&e>=P)$z|udf#uQj-`vY{k!UC z?rDcD^rh(M_cg^*8#zSRE7Pv4`X_0!ZO|xi3|8ev-Y?@fh>Q+xA%yJjuo!W%S4oOV zvQdeh9j}sp>twUn_0`;CWu;maNvC{GIjxA|o^+@)XgqwWYiQUwjGEs%&9{Oa)wkbe zX1&?%5EM-#wcKUWcNN2&*VbTHzn>MWPG8FYuPR(Hl;#=~f<8EwpkLYAKD#ktNO8wf z)?+)$5Q*lzY%#JUcjKL?A-+TMWMUqVc#Bg@ks zRh*C}Wc9tgG$^CTdf$?O`24^>Gt(ROm#2RgJz~DvPcsJ-;AeQ%YQ>zk+T+!_UKP+} z)|pKTdC`mL(i~W%=H_)5HX|c+M{Bi9vFvbRK|!+B`8xo7-Me+wa%{(-Y0qN8HtHN}2C6k9Bft30d59jkJ!JHzUTEE3Y6R*)N|lC(hW( zFCMo?GtPK?Z?#(6t782&`E)0wqEHsCkMw?>Y+^|PlS+E=`8E-oSx{7PEyuaqdw!1a zc`cI8kl6A!OEVuuErkAi)BoN(p3q(qFRC6{($O|DYwBAJ}$277=dGP z`evwfm5h5?s>M3HKi5A7`svj#5mN{SHo!ERhzJ4z zGzhz@t0%I6#0fN1D3iK%ahF{?AotZT$~AcWfPS9Ns?-0#1WmIYT>yH>4xbJIuPvuU z)YArxn0@Znt~zgsLmYSZ1og5L?PIxrf7ghH%#^+PdB}xJm@?&(q*K#V0~<|N(4QpN zIU0-Z@PUrhWp)e5H0U4qwHKK8M!{48nCmro*dO1BI9&+oJUreRS{fxg%{wm%V(o0%M8&8?+2}+L z0_lbJ+}wi4sM`SWfe5&~+u> zm#rcq=*U?o6!6sr8~f}CL5l&cT6)WK{wo7j{@J6>8&e-XqM?DY372 z*U%4ykzUhjY#A_j;X=Z553dhiml0#jBp86qhmK}1Hd>{>h>7cfNbM)YCM7*KktdFdU_83v;-X9HqiBx>&rSPPC+w!$Z!3vFal<7cjg2dp55O4l6q2Qa^` zTfoPUb7|yCA;B?iKD zo4}671lS&0xHI=#WT?Q*h?jwBg1xIt23T~K$H&$jD_D~b>$*$?8|8L4VPcKmAjG@b zj#?e#;rJv1$Td2+rD_~jQ#0~ezpKJi3^Eje0?B5M7g!FG})VX`<=vzA4Ugva1zcRPbdsSx$$dh~_3yX$D zHzQ#mu~fPJy?P`4J9lvcJzx9RNS{r8hU_C0asjucsQVW8{v+<815{(}MF_8E(sPK4 zVI&}!%Y~jC0kTTo3&4`N2@)sBz%x12xHRSiZw=c2!=g|lV>M$D_!W<>Ps7j@nwM9^TqP+c#(I|7zkIXZr+;}j;z{WK7l}$EEe7yA8-HYJ#`{GMp1S22 z01(kHEbCMM3qX~&cM`%BV~ua;(5Fq+XPpBe#%|<>N1!KCWjhnfJg%GM9#_idBTE~_9UvD$yBM264xnC$a)6wI7 zD=^ewuuC=~^zj#|OHsYkeq2l~gpFl?Pd_DXS`~HG-oD7`xxD8)bq})G?3Eu*AgzKO zT43Bu6fY}VFhacZ+t45psC$-+98^~wut^83PDvnIj?kq@3{49VeSYSGO zH3wxRx+3KKni~dqdKQ@!szTBV-Me1j1hPXbEzT0npqT#sNV0Nc+*g+xOn{qLIb|V! z36Zn2V{5)%N~W07R=_BoW~l*Ywe?8L{UI}RUOfwRkfzVAh;N6{Z*G@E%RDtDr%%x; z`O9?qJNU$Y|5>YZ1A_yfVZIi~^O;wB`?rmJ=2LuN#+)t~LO`A}xlhpo?Cq{7c~5}~ zqRe)+<9q0MNLZBU_C5N=zNEBGB87~-eQ|ea)Q5qw7jT>Y=dz^+cUq@ZShA{YwGJs12 zk{V3zZrowIVtIJfUEu^8B@LOs=Y4>N)M@WtYZL(opf7# z$m3vc1im8yx9epDeuWsMilF`dbh_sEv``?E@rE?aE zwXn=zCJ!q;@KTh!^mr6k$X@ZyD?h)I?tA6)n9DlpMUnf@?!34oD@@_P<96O`s3Y=r z;(|w2b*G(EO9wwIq7%h~3UP@mH9A%li_UNh1DI$3=?Vs%_nh}!KL9TeW^nR?T2vB` z(dx#{o7V)~V?OH%Wes_g@QC__J+C-fS_YVeHK?2541J;Yq|j;1Qs|f&}7gvV70U>Hd0vr%>$v662v%e1*aCHB$f^V(y=Iwx*LQ-_Frh zQ$0A$rG0qaBkT5(0B`2L%uzp})5F9Z*}QTl)I>7?p45aCB?B7jmZvFUef%5U=tG*jM4ivzN%df*vXL50IS?bI3&dNe7PbBwk zCtYQ~-kJN)^FMre-kHwpr`*!sO7Y-9&|3`T7VGxLwanM<&O}#AODQQ+^{y4BNX)ZS z&duT?_IUTQUz1dlfL4f-gE8mtXNTUlVzPaiLQ@6tN5Z1w+GiD|p`>A;82tN7o`tGC zrE`}=E#Jt?{L3oQp@;6MqYq(uEkZ^IQKY9X6XuO%M|$|);flf2r^+5>J;_KGyf z0RH=BNkr8?8wGw&C;|R|K0f#W&pCGPOaJ)}{?AI){_kH1wtac}&qHx=nB}_F|2&zX zV7<7=cJ;@Y7;|;?Q5v3Gf1V?#`WC(thmB1>Ezhme_Qxh?96@nW?*ntR47?xwxxriE zlheyW&ZeU9vtmN3_VY&ouz?CseSfv7f%l(BJ+v9#-p%p#NTLw=cs-QVcf{~hDCye~ z-YyxO-{0l1LB<~3NgWg$sxtThN{j#b8c~F+f#IxmHC;gq-+X>z30b}rjXL)SP^rz9 z<74-;3zz%8eMF(e47@4-ypD|;2vZ;NvAw#ED5Zgm@q&x7Rr}{DeVWM=qW)PM@JEKC zQGS13&&Ma?i3!7>XL|ThH#NER-{1K}2LJ!~L#1jJif$5e{Z&+ zB_`4T`|EIw`pcKg7?Aw=9B_h$KL*cn#7^ET#QXPWY7!!df4=+Q{In72cLB>ZpQ5Ch z@$XU;6wD-`<#}8E2v@s=zJGFNMi7oTlc55xH8L`|>38t)TfgJAib(P!x9d(kKuB?o z-*sTC%pl|b$;s(puB8RlYdaBi`~xwykVhbs)!GWn`gl+2O~^#+osaR+Y2+`YW)F{z z#aWKJ{Q7QZ23czn{`mSMJ2Or~GD{PXr@m||=dlJ%rK6LJoVt43{Q21jKYT__hr>d^ zx>v=_xTC1x)c-C949w- zP_$X>r>Z0g^guMr7U$sti@@SQ?3;6^l0dW8+TUT8rT5m+=db-2dkSf$Jn2l`QNk)C0o?_ng@;W+rc-xY4^_XV=%<}owr51j5S z^#tOzhRGYdYY7O%xth|!j9WvvIqDS=9yM<=7+L;(!z7|n<1coX*|eKCjyE@UF5jnT z3w?ES9tV%mNvy9Qr9=)GfJp8`7nn6b-$Nl8pMNquTIT`qH<{|^mwf#sKE!i&{KRW* zZh;t0>--(?sit9(Wb`>m%gfgTM~l;S1H;1$D@`$LNMF6=$C3gqC)vFl&q7k$OUirr zE@P4>s_m0;a&h61xkK^}zXzpcg=U95fBpdQ14`C=_Pia16kaNIx_rb(_VIfA;*2!n-LNh_qz9cuW@$)m)6<-I4o98wzDm`X{?Lo*A;s} zPbmSLZDitfPZoVR+5nrQ?2FQb&qJu`q-5?q# zFyJ9jWuJspfiC-3hLivqF`HLr63~)@?m9dRb~01Wi1C7=+tWbcSZuxnSRTW06dFi;M%#w7rtgd2DC5w4`imVZpJz zUO%>M_u4mA*r{_t5fRT`yx_fwe>XyKr0X}iUTbPHM6-XPqnA}(A1uBX>7`)Mt=z;n33kjSaQpU~9kT8Mw zJ}an9aCUY91JpASkV(Q}4|{$# zqi1-|?N_wAmTYm%lT)5aTk7KY#t6!AL#3n``1nR>^M(Hs<8OS~;~%}ft7Y5ez?gqZ zgeF#@kdX~Y{?iCVULG&E&8^o-*+&N@ny-DZb`c)xu{PCOkz}DHFakdhmIY zuC3J{be@?-x zzcwJ*oR<`4L)$kzE2JK?+k6T@99X95Q?tPQd-!(tJj{_nv%Y3?Xj8qd<-tk4^;$_1 zJvjGYVY^d4di3R3x)-wd=!__w%;2NLLVDIV7#uW6UHgKN#g+gN%JVzvA&|m)FGpS1 z(q3ur6v{JH0Qs%^si#aWTZ3i5CA&xT6FsEG$N!@a00N(y^}Rn0_xGtLgESeLoB7k@ z{k2*BgX@92o(<1i}tMLCfmr=Hj51N=0?HZa@p}?c>Lfe{_z=e{1%! z86FtYoSkMTcuYf=UqP31Sro+n`n$6~jQ$ zj zyt*Ej*(MJ9UfK!?II%yupFGj+c&!%d0|QLz$HvH#x{L`eERBr3!Cnl`mF@RORTl&@ zGUCW9D+^m%GC)EYFF@*#g-Fi-#@i}kvoat9q;RW4tMfCr0`oy%!**5Wq05DqFCj5D zP;C{cF#P$m-ud>CpP%1#Y=N3lhjBzN3mOF{pFU*}s%~e8sH>~<*cSOX+p%rL9O;|) z#OMpc-JRdXVSTFnx|Up_>V0sl=zAVLcu*xC8Tw<1YPYker~7PvKr;3g91#&hVoLJ^ zT@x%8&@21S-=7`;uZ5J+8IDdWgsgylF0L-j(mm<~>Dx`@2i+Z6^2w z4(?PA4-z1jhlfreJ{o6f9~>kERdu&4?Y;l8fMmN*?hWRfTmnq)Bmj)2d;6Oyo>*S? zj*l0p^AdOl*6V9h=SXk_4GrX0Ajdedw)PI>kZ@E4IE;G)<}d~X1pNM{f(yVI8{8al zSsI3$qSyG=>UvN&pd&C*Dc*f$BySZ-wu(iCPx(HOB-N_=!Ur!B`u*n_fKnS68oKkB zG~Qcy=3kH@%V3w034-Aq(89?9{%rZuCAHzg>Jax!SMv>fMORiJa!+T1;qZt9c@NteygpiBkvYGj8FbFOP zv~LN+YWBt=OMpv}&yfiMv(QyM{tSzpTNt#do^#_U7mi98MrFUs4J|q7iCrCW{*N{v zjmZ2H;n`%Q^S08x+K6p1ZAvo(m1l`f7M*-&*V9)2D*{XR&Kf*WOZ-HrMz);rBQYm42X@nxWCu^1%y9uHW09HJD3WE72ku=2mm4}`I0K>4G+1*eEIpXod4d5c2BD-!63Ruk z){zGN>2l$3-+sS*Sw2N4sZnvg{mA-inxq%Xu=fUZdB~Be z=8;|!;r*J|tIJqSU+^-*{q&HilJ<{3XLHO{qOe)bMyQVSBnj#|w~!Oh`H9biQa-h| zvpX&@!4^?2bseNvsrq9>o5v%6qD~$l8||)Yv>x!70=D`=Q^08c2d*!_l>|zvPjEK> zJo!T#3y3yt{00XGCMFhySBLBzClZAs;LYA?!|uKNCx8qZ_A`z08_@;ZRl&bT3L1Ci zD%-q&^C%CCnf?FQ{DH*(M(}x(S{`&~lZKk{->c%0={`wi9r;@H&yOD3Wc+``-^ll6 zyTr1^?sY%0UjDI_f`ZvE|4-xKHs!$!&F%B^;%Yg_rt;DW+$M-1iT zX04JHW1W*zQty!BC4TrPr6A0ek7D^4;EN8zRPB}&>^W_S!LV7?b_%?$7*X$_Zd9^= z{LjrPuH62(2|@VOJh}8>Vzb3-NZ4GLVzh#^iGn@BKMz9^g0Hr*vz5KVgib6Sj(r8FSPgHGuDUuHZ0e%b$%G|B({A1XURH-^tgKZ-{T0f1Q!9iBVH z*USa_&9|<2lF8LcW8rJ9ikZ0;aV&N;%+}VNoSgEy@=%po=N{Q?yzqVORNlZ_R);^! z>&?7Smt!%3@?heKyrjE-$##;l=?KS~*PPkLFYJ*+nWyZH(c7n3C1y_@Dyqmah?Dpn z&S-D!myy!16PvGo>zcMxtuBkUUyuLVfXLXivbwgT;W%oO@YdBa=VJ>j67KrNW?^XB`jnJ3%{G6C zI$cf*94K_*u(Y%cB^C8_gMsPw^$nBD^GfK8g_gSq@aD5e%SL~>DxC$K)>eda5-4`|oQF~Dci?+T_uzdpPOG*!8Y_3sPqXKWRi zA@Qv$P8p^Jj@NIW?l-Ef|0RZ zN#bT-u1`iD48M^RJmxDTTu4WLj6JemW0oZ)-<#VaBip!pWD4-mTd##29^R|8NpD{m zyo)#UIoE~zs+!BmkpGVq=f56=97(H3C|SCqVO6Eb6Axhjun~Ut-!UUq?f0qB$&d0afwT@^?fKg^+ByBK>RLEgyqZZ2leT z7SAY@5xQNG3wg$yot@25h<)Z$y;ODF&M_{HQlzgsU*iF?`T)ws!N6Ny$L(mpX{_VS zYaZdS4_TiJB>avO_XMfXA67As0Uxv-Lx-w1m&i5{D!V}ZRAe>Y!M8smC(_ljns8jX zuWN-o6?lP=`^vea<^TK0rG(3bj5_`(Ja~?O_wmp6iYGV7pSx_X;l9(B_?B|yt?p@*rZ%L+xhz6HTn%?R})H@$g6qCC@otBZR9$o3#UT{ z26%9}-3Yj@>tMhGQfoXyHqAKRe;8$L_0IwH6~@W32llm_H_M+4yP_)3$6PAlzfe-I zlR)v*Xp~eT^uU7rc4JpbOC^=fr27M?62=@)ccb$IT48%S@2^2I{Tl}yWvVru?vGoEL{)Fp-h}=!7S{!7h+!f*buKP*Sk8nh zX&IbVIDtF#$n}&Bg**)<<*`@pW7C@x2eHem-tP(@0|T4Dp~L1s`Rsv-z192@+ZuG< z(PNm%-&)q=Y()OQt$w}TUG59ziI}qA7rHZ-LP8pAsrz^KdrRr-7M(0w)Y6kGf#yp? z2bEeShyH>zdtre7f8y#cFpq_ZT+6TwLmFJl5}@$fe0b z5vTRI%H7?SRp%o5iEZ^MhaJ{tdOFYifn%>1?-pkDNE}1Ez03~Gtj2EN`IhK=w547e z)vC#9uPbnNqFo&m5NX9{pX#y6?XAGGz?>M&ttzXm&WySpUgXdt$EfPAl0=rn^kZ=@ia?w=#y5oH^zqPP&AK# zZ>lNv@_Im5i^m?h;4l516=GjhdkMwwmBV{u^q4q1KP87Mk-l?!N)wvL3>o%tc>S6h z>@9FvziiP+n%WXk>d3y}JZe!DQwb{N{o@ElM$1(6VdHMWSa=-R)Hl}fJvP1MTK|&6 zuaiNA0+;i<&(BBRX$|8jTBv7Wb~*mGDsWnUY%zX4sR5OdKGdZi)}-y>-*tgF=~6(| zZnFd*`WvHaFLm*NAB_udYx;abtoWD)KI7P#+)YaV_I8G1o0;2XQkCx-#y&S`OZA(M zU?xmquA*DFuJRIxjdZNf^nd<3a!ah1h$QhdG1ULWQ+rs63wV#*d z^~p8MT)EOHD7YX4G4n+3n+z(oH$Twp!v=6{nddf}22obzI5IMs0J=*^xR2)Ay!X7x zg@;o!c6tm-?*8nm3DMzz3$W$x>=NlWFFvloW#Upu(u;OrvuSvA#4NcTlLj3&w4?H z)l(v;Q-2P$LjZ4nMZobhdQHP6Wz60pWcdPB5yc!$3I8ZIG{0nZs2JKPMr9?lY>BfS zR*F%mX-|AD{oW|H4?qcpYd~)eZo4H6Y1kBf*;-O)n)zTxxWOR=vPE=tfW88RRK9J? zomS6xTqq;8J98M2?8b0BKERk*S`y7jxX*4iBnUH*G2m226P%554kygj^GQ0H-FNx^fyu3uE^)c9sDnD;X05@e2xIEL-dLJ`(4xB0xg}&~^@D|Ys zvdJ__@bDr&j=TGXhbwss^w3J29EnxMA4qs=q04*C=UNa0%??4|?|Q{C0|paVT@ z@e<~3-C19}fq^fTV_SX0R@*Cx&ODn2(MM8If;nTA2f$(vfnhbitxHArfGI_@B?0#L z;^hlYhcy!LinQF1;eMNK9gmbk)~&nPN~3EyCaGU@>e5uB-(FLE@-2lDh5y9;UI6rVad z+=dflt#V(}@N5Sc4I|o_^hVqFv^eJ*LYSCiPRAAr$zcmpC_|vlH+&&?NB59O@t@vJ z>JoN#KDyn6^VeTLrc%V7(9ldR=Ty}~XDOPw6%Xgn7@vzQRBnpL-Gl(eFfJL>?73qL z12zSriO9*xi3BjTx0m~SinRn9ktfW+!K>FyT5p~1-^2Ow@g5tO z$m9$qNp+&VLe$RJ$(M3qEMA@jJQ?6FnHrvZ9@Sgrrx)U^_L@07ZEWMZyooFMVp`E> z!b3PZWP)gjCfa)5K(LDNGNpGaW)w;q&`f=)u+7 zX&pbL;5`c4Y&P-O<;hB+8l7R$TTQgJ)fNCkR2o8F(WZC54HKH zy}S5x;dBjsJ}vSeJd6r$j&&RI4F(APca}z@vB!|{kR^NZ;>89#waL$6ZAU}o8cfv%5=_FTL9 zV7{kLo%i;ZzfpPDeb5o)xbnb#hCuB1IODKROuZ=@{;+gm( zT)<0|C34=rdI<=7`s;Cg;xSC`po@$N-8rS9?zkI&ez|1Mdi^y((Jl~syj$!^4T=wM z0@7&b4k7EpNIEVw?}XXYs}>}@-d#H3cVO7V+WSPf&54?CON845RgA5``S^J>c)2N( z_4>`5;EE89^pvuKm{c*|<@^Gav)w^k7Rfmz~*6N4r>>Xbg|7Zckk0vo8AqY7#5e&ug zZ3qvb*j+c(;FmKbl!E{AMF8og1Q47P-11^c>X(XVD5Xt-ZcGwT^lV+eQaA?>6pTW) z^4P8jo0`(_IIPucGXV}rIdR76)lvDwaf-*K2TX_FlO*8 zPv^N@u&wcM5j`}sX}1JZ*{*dDey#w$N!Nhf)6;`U2$np6OgX50aimjy#MUm}t zZrh1bhcO*kVJfM&iFhLbTgwV$mDVFL#P#4#X7(YpI^zl~hQq9?&Y~Er4=#d!t2iH= zz_{Zk0XmVnEjX8cmC8|rjOzj?5lI_(4Fqh?JMs1zw*8i)1l;=9ggh9jj>iB9l8?%F z1e{yxo5_pPEcr`8I1~{Z?HmB0*#wS-?o*;eSVnmk%ZeCqnzs9f(w;-LVsJhVO`O48 zua1Yf@51Nc;97hwcaeC0H|0FtD}Z95W_kF2z4|!2?F6#INoK{_7@!P4#qNDtjM$wW zNahcd`N8#(+W25Yeq?#fBJ^pFaCy|ef6`+C?_cR2Pb!qV(f06{<4mXg^3$+|Uh+_4 zk0b}u?@y}&+fbO-&h4H?2nn(~?+Eb{YdSxR?HcrZ8z2?rWXPE2&Pe#m;cSCfwX(v0 zY4lvgbU{@1rQ$@t<>dg)!WId>OK%%&1+3Gg}HWbs1_$k?(Cnb8}damdtZxXCnzSe zNbf?BG$CCH!JaMdjxMJ+j1YX`2Z6?sX*M9FJH{a_ATpO)~m#xKYurCr|Hfg?|Ssap}<6MH?pj> zw5wc+QMV)R%7pQT3_9KOtt;tp;&dOVVqC9Yy>i_=oCgjY#+OpY zVgn-)oc2_J>7(K_ctq1ZkKyLLU*ua2CTeGWJf243`{%H*M$_#}Y%nM~D@@B2kTby8 zwC?7OIuV7_#9_=O5L9vQr?dDNBkkCYZ9jkJn?{?ASxR-%GA4&Ys);8SP!CIAo`eOh z00Zp-&})t2T>^mUK*r(V0AAkVmLKDR+uDdt_$B#o)ssi#NwT+z*}kfUGvJ-YR`u}@ z<{-~+#Qw*)!FV%DqxN};&CN{%{&fICTTlGBpy_(%1Y8)5h0(N5yUt#kp?=t!)9KXl z1r^z9#SE~Ivo_eZ7CpnYN)!9hrflmRQWCNZFa^kWw)N1k_A*FQo;T;|0kQVO!GYu6 z>ZsZyld-c7p1i_Bu$ASXvPVswN-5SPU1b^dZhpoPh9cGL$*UR=l_}hzk3_^#feV#|#Xqo=&4k zFL1+EPxF=*7XkeuF#wJ$xY=PA+_np#a>h=RnQjD&h4Z_NEs~JXygKu)*hUZq{NyZ= z6B?d`K?hq?Qxj%)HCo7q-JTtO@$|8?>2*G@K7d$%o)s4%0mhO}* zaUzN00zP5&%8C@}0RiCU;k11<>_8Z0i9YRjG_w ze|Dj>+th(Iu)BOg+T1HVoHbme8Y=drGO4*!eQL6!TvYTzmb&}mdn0RWX5cm@!FnBW z>etBBDh>eRr`i}yHk=IV)wg3*nW{krR^GK6TED#ZaNa%n8cu?iNE zSQgfw@ZA+T@{WRb>xgMYHgHhRRn2%RWb#Zi@SX}&g!Ew8tqeg!Ul1YbCt&AT* zn*cCUC~RIz%E~f`18}V3f2{?Oy|Ugw)OoD`sx##0aJDRRhh)aN>TF94E}zCeTd}K3 zv)a9~cXbr_w)TjcT1}#Q%Wl#6UMQl~;T_i#Bpcxzj(iF_t=!gD z@X4|~D%vU9Qr$eWce%SPX0*&8i~&C@gj#9~Vp?Xqp{L*)9rk;Z=ev)VEobLEypb=PsTu9tj(nrlHQsM# zv^*oz%}{Q>_5D6I9?yI*e|GQw%Zh01+zJPqj-CPTvdDhxG3P4tWxJu$FRtsRJB}Vi zd}EJMWJ!M5kw(~`!|m^_-=h*ioL!19dW_Pgvkb=Xtj zszU)D5Z!i>%Xzm$&g@Mpidm29#TS-PAMYfaXzt&im{B8##Ma zK4!eBhPmukyt7@f6Pq5KY7#+GX&U4(NpdCfV}aW~=i+3)6jRvzPq%@(q!~n| ztF1{ofUqknGDDJ0lqgliaPz~dABu%YA!mMt*fcPsnk!Cd#Y|Hu)tc1GI=b!Slm@fA z_42_b1{-gPI_$uI3rPj%Q3rC%wY6s=!I{vep)kW);Mnz06FGew9Eaw2moN!n(glR% znaWiawbq(zKgZv7ABrL|v+YKRSsa<-ql7vxwMG2R#7_`kfdT||oNF-jtjYpN4OF%e zriJY@C~^Ci$uF)4dzWH|(`kx3J97iOhZ~)|%Bei#hG?>_7?=9u#MIP_&Nx1m3S*f_ zK?f%|{GtAIvfZn+*j>u%es%_pRw`si>Otdm(1D=K5~*CKFH*W*&1Fe~EwFVh{u6oU z)GI%_9Rn2`X1^zjxey?ho$kV+$h`9n!YK5>=IT;9w9plEupB7> zbDXtdGt;S6jo7SR_yvH;B*Y)cbzj{j_VqdWND^H>(Vc$7^SaYaY}*5b7*PZM z4O*T|v;0jaUGjyuFJBs|b1OV>5sC_)f4CK%kX)*+plJ9AQZHZ6-v$dXxw*P3+k^_d z?`gjtPyR^CP=iaPw>5-%*8hPR`*{s0xkPlQQo4Gej-t3Kdj8G*jQo58471|8M$TMj zzX8SN3n1LGc5s+aKE!V5F3A?Z;i$ztem?ax*b0k6Kq5*NEkGO6Qr||%df?PYheq#^&X~oS!CH+v7^l$BG&ZiGqc?nkjmp4eiLnz_9L0k zp=}Mx!Kb@m0yv%fi+nq~(y|Zvmc1wM>BkoDScNw7L89n0PGLsdoR zI>kcbQ)p~RfUj-<^8M>_R~Ex(tV(D7#3D4 z^^Gy?whiP}Y_FB0%Y9OffiS8zvS@W^vmsn7%w*ZAp&0?FbeL$(X*W1}4bA&*ooh!k zS{=q+0?{l$AerX9sksQF+B^V@rm%IW3R`qs;wUa#qa1x!qU@FxL0;)-xS|XWpRs2j zv*U&~h>hjuIEX||y##=Ih)$=FKT-=10SEc(w{Oi`Ke}Y09pKW$ZvznxBogU^@!CpUJ=-9%f&vhzu_q+yC~v_jP;t{C^JH z>>`cX208R5EgiDSamZE-s;VMvY6Ijyh_A<%Iqu?=wwI1Bdup&@vM9!--JffWE0&G) zWxN~glK6Qf*L=m4bE2>JCJz#mg(D2v6gNV&IyC+Y7*W|yI9wFd7nl39WlYG?ax_0gn(m)x~XB}8MwSr%~Z8$h5ZC2;&nmCfu9Vvp|7i7KfcY&LGyx8x*JiLAh0 zC%C1rrMQ(W4^Htz{Aw?wI!jLHaLO1M9XiC7z-*t*A2Yni*HS}8aq)JM{XprVT4+Yz zj#%9q_!F@i|H@6IdN5KhMGjm8Ix0B^m;vjq>9VW9ZZ-H~w2TVh z2io^UU%a^Jvad+@z_F5_gW%Q(Ldpn>oZp;ns(;@XrwPLJyLfn^TxZ2Fa3iYFlo>|y zWIu(4)L6NDZ`|$JqO>pr)a&h?tqWc#6f4k9L1&0AML>8-k6%(*Q4z6yybfKgi1S>X zSyYm29%z~B8%M2SRnDLUyO`K6 zY2LJd$qWbQ$)tS_KD%X6^4T4&!Ne1(8@gM3A)~dU7@?C>VoI zM_0KWcPE?l_&N-bGr6BQ8bUoPqd!xptJV{Y_|*J-6RE>U%^O5)H(^g&PYx298Y%QF zO8gO-BY=mI6PCk8{;;^1b*2Q}SVd%~ zP88PnW(~R=XBcAyc*%*?cus}`lS?MPQkjsx=_eRjw!P0fcmIk?OUczD&@Oo=pH?fB zjBj=8GUMS-4JHudKP=M8Eu>DU!yO>bHHMJlYU%R63s*2sDZAR%n zFOQ-Ay)ePPIuI@?vSNpGW%P8@{Fi^*!f9C4qGZ+X5B-N6DKjquQCcr$-?xrct;q6<1Nx>Ax}l0v^q5k^Br7Ojx9%Y0p?X#yjYfI~uy&R-v3UjFo}H+6A@<-x&lJjcp!6x>qjj%u41$58y95McFsy-rg>zLG9CnV5PVAi1Wu;R%bLu-2 zG9*$`fk6e$o~tU-YwZ7jouE&4*o!$&WP_Ch%z(IWd>H}6) zTeF`Y4rW_}t_U z#1$w>+_myD8R&ki2N8j*O#@#1xcvSjK~w2~~UMgOU9Fm)Fep&+p_>SKDUU6E4$m*`FZ;O^>Vg zn?>3JI-8|}>+;SeembAh{Fo7f3fbrUMe!`B=DM4i*xzS_>bd)L>S%tSH>@1 z&4$;0Nr@AgnINmMF}n$oO^5mbWL}xWr&@^~E8!{OFZv40m?-;p+3@K8$~M)WOMH?| zzCZW<^P|#_vHO<=j1ArC0QhEitVg-jbY#)-zWM$FEclZ#{JmtNWnx1T=s z45c3zY+4L@_F#XRiugP(YcyTMvX$+tpji@cQ=(#zzO0?+q)Sg;GVShzs6UXuJltzz ztJ*&pMcKio)%|{Vei|oWsUEIgd&vxq(}sXs)9cO?sm>_^d&_td@Z6_(oIQhfD!t=4 z06+lqWh#)w6J?z28UX+6b!^BTQ_sBJK2{O!WavspKQ?i&KDsF#w5{=txH# zKM|Z&LGG~yzH53C*P#?u8tDbjI~j)5{4W#@sPe$K4-1D_7Zx6PUJekv;rc~o_;6Q6 z$1@6qEhy7Ju%Ea-QWZyj4OhH++TUO5nB6nbBJHH8s@>3mJId0uS?)LM>AdZ=0(8kFe&ap&DxwV5;pE3|CQ z0$*r_o?OFZwe6t_z##&S{v1HtrIT3wVItxlGQD`aW_-LOEig6Pn`S(#@a(o-Udv9I zx*AgbI{DQl^~x`$bjusJFR%EkzdRqlBtKcTVP!_7y{5}Jv13Xkv;PxoId}5&fo6Q= z-Dm4F<6KTeC28?uHxul(tBVYDN^y|A&XbLqf$8rTE`{VA*JZ&Sc%h>-IrjLVa?^gH zjjq(X`m$E|z02qOp}7-=%;mHjQv2~G=pR1PKEmOrMGxbc-3v;?wLG1lPpGh8#(VI= zJ4am^_xP8Jac2q*^i>3^-Nvi8FT>BVaDj7VGWbKr)mfD9MOd|Sd?HayMLtV@RV78E zU_Ai#j~!a>Yr9;y9*l9m(fZ)NO`9x^yRu0IkdQFyQB0mN$ z$dm~7V(rqtl-~DUxE|!X1bo}#haD@?o+XqSq zjZ(mUNwqE152;q6U*V=Ult zIgVBH&)w*VupGTxWlqDp=`!UMlm4swhnD-n29D9_z}LWmz%OTS>^W>N4SrO(P{A`8 zDT(O!%P&@E0ucNZ^ssT~ysvJ0y!de^jD1LUXzYKr0Nh&sE>m-dJ}!4!X8BHdFJytC zzP;2vkS|V_th81b*}!FEI&Fm?U&-!F$tCaI`HuTVeUl*BMD~86C|QcIa$m|@CnxFc z^CO16X*Cn`;mh^Z<0*3CrSVEG=Fo@2Zt9Qh7dqzmxh8ahkiI*@kOy{a)~39mtl)84 zX$+Y&fLWH-pE}<2U@F@8Q!S!m(yJ8+*Fz=dgx0mYI3?%j%iYzyp`b_BDe%2X_;hO* zlpmmpv#vdFn(@Dh{ecb1CsyZJvZKPQIl%%K3$JeI!khZn*HcjxSL1!|9V$xQ<{F zTV#FdT zMIjAx!6{4|(+$~{X(F^CrEYmw2gkLuwdT;~nU#9l!o0b_-b=ONFYv6&8*1KWY53#Z zxs?*dRKd=1HK&Y80OS0%S=5=ap;YeEk3uig_ z`c|ToId!qWA8S(pUp^zMF^{fV@vT)NsTR>7R5bo%LJc6LGxnW#63=`8fSpO_$tNJz zhW5(cVpld~=t3ub@_xUH^u-*Wk;g>^LYj1LvUsDbfKu?O*2iIsg;wU8e8!u&H)qew z%g+|e(Rr}2VCEV+9q5n2!Y)Y`%O@*=sM61m2{)Jdd$-9_Uj-W_SkSD+u_X#Rht`27 z2_&nW7DG0Z$nhL;=2l@rJUq##GKbE;_*o{aGUxOeGzZ{LpxsLhw)^Lb1JuUX&(CzS zhMzP!8E9Qkb!yt?!URkESn*M~w!c=Y!O2~qR?g{6OU9gZRTSIX1+<5a+X3{NX}_H6oR zf+7*N&u*u@^FolO(DnPY$nO)1XS#rO2wC(~fN8FOB7WxEt>2Wd+f6Z2Vk!&&-TWfaC{=iXX}y=)C!)sX?100`!54o`RVD z)D-WS0n3pdxW+Jpo-R#(1oMb2`akv~ESn`dbzzj&TbS9OR#M1*TLP*~Rr?DG5WPdN zNr?~SdVeWp?QHnET$lAAcs-$YXNJrW1m?ianA^DRPb=yQ@%Z$gczl_nfHVFZ@tED& zawAlLuJ-#!eNSVHu@cSGeflOw${VXQTN_GuHFS6j^A=*%UQLk7?R31S7-c7F*Jbw` z{zTWQXi#A;GcjV35e_H1-@i?O@>QDZXpe{+#Tdkdrcj`9OA^0qa{{;Hjy zZhlWs*U(PjH^%Y2f&o*~Z|hGtHH?0Ui-_dAA6h~2<0DY3XTt;v`G`T5G1&NQLS0+#Y2??k_wm&@k zK_t(UC6#EIY`267%Q=6$Zw59YjcW)s_NR|tznCS9S1TDTA5j(B&0adqqRh4J*40r$ zdMlR}yJ@A$f3xlRoRDbl%5*5Uk(8wYF9k0sWochqRaFhttoQE&2wcxWAhEaBjR9FV z%*dg-GN3w8POSiWn;hTvRXoA7F0*sGH$S%4t6+jvCj}+M1T+!KdS|vdB2%@1LWayc z5z2`ykl+9oESQj~kiOOKpzR@Q$RK#3eYnD&1`UilA|uaO`3`tUhKF%$ygYKX#Rs7f*L5pl{UU<&1uPA#dhN-~$eG-9PsuhX*5Lloky$fcrbugv1>AWX>)D`=$?&0+rx>4Oq63Ew7TUJbV)sOigE3-d7EV{+ zsFTJ`FTa=J(OF~FlEG>{G(+}K(h%t|1+1Q&t{}(9BxIXR*cApRYa6kQ(!o)-E6dp$ zhm=pZ#G-Ghdu_6IQh^8Y8s^o3FaU?9?gD*r5GVZIF>H1DX|5vRa_Pz1)5{H}wNf#R zsDu^j;eX9M{e|91=1^0zMF8Cr#xYSCSU3sMMoF3tWH-all1@p?-5jY3KS<(%0p|UC zqtI(FG@U)csS1(yKr3FcxM)`I`)b$M+ncEbNaD_t6wD2uuVN@-}mt9 z!3ruezh)P)7d<@tFm-tjF*nWijc40@m#oQDr~O@|U$b|G99^LG%=jo_XD+@3f4Fap ztbbE`Kyh!G1ixo6_Bs7@cU{7#e0KW1Z6-&Jk&%NXO474zGapLv(9hs&5oy{Rd)Ur} zhLY>T*aifQ4DD(j=+51x6bBlcJ&)s(uG(OGdq~as$uqEv%Cf9s_u_+TT`DkQ<#Al? zsS(B^c&du_JE}G2Ax!mvrNSSO@4}6~hZJZjjs`rI8W_a0Z3J%YhF_cZij}Qck`^Z0tF>(NnPyhT-_9WgVV- zQj15b{ZEd5-P`2!x=Z%MbU9*AlhOY?iH(!3rSEV~sb$B`j@?|H=ik{8tqBig76%f< zUna=J3HWL8mKK>W9^4xR6lfey63_1R>E=ZUzkBhkT;MM3`IqL=X`{#%xVKF1> zxVRlD+5ZKIx~TRzPc#;!5n1_pN=$l2RK*7FZnXu<%%=Y-NFs6_-21*+r8Y5sjHKTT z1SYy1d1?i1G}z(=2J+HJ_>S%IwGCrNKEmfbDAm;u3rQl-Akxs(N_-_-^D^|}ayO(_cMAGP6m{JeaQYg^5v3q&OD#tm_HrRErh<%TfOiz~T0XDK#0PzJ2J?cG(ojNM@s`rwUq zqun20BPSXgziN5fOgO$N)bru83CE*8`X@g$Db=IUi9+s)6N*Pl;>VTsysC(n^#3@~ z_@}A))9yVF)_pdCgabM?@7)l8kimc%;X?q*9G7jBWsf*6edy4pA-nm1F!3K)>2Gxc zJDHCUqBH|3>4rm|fn4B-fJfyj59z+SULI>iM66Fz5(?uiL0J7QnK8Yd2?a{AH`2v3Ks^HQBhUplm9+tA{Ae{ zG*#i!6R)j3=*~h%c2e7qf35GA^&2+%t(~4~wk}!j?k->8#*s*z#4=|vy|LVe$at{U zrOUZsJ!?hokk*90hqKlSQ)V}CZ;Iv&yl(E?Oue>HmcTyE4;G~x8>GdXLqX4Gn|9Z^ zin;}VKimPy!1tF8VqqR88#60SrC-}MtKF`FNl()!qRyx#6VS7?RGRG_^0bN>ijRtAWnGlFL^5BaeU3;) zPCrep5K8@Oen@JeS=;f`K*DT=>2a;5c&mSYv;x6Sl^vvDWr+XfP#3a z*p~loDq-+=O_}qxlLN93f$3O5K|$FU>nc`MG#Vu^hX6H*e6xAxPehm4VO*9S@6O$W zEn2nH(=L6|GnX`OAcX3|8v?=8gBK0DG4vW`SMNTwy@BEhzebpG9BhtC>DHpdS!nmb zdvX!FookaZwd-Ob7%qh}ycX<_I+FMs0Goye{TqaMo-<8HTMuxHxN z;eM9#1wh+gWGaHEx!fZToW~3d!PV}*rh}=JMK!VLbKX6vt#8J`X^EO#;GLtna>VC5 zIx8;!xGen>MgC{0`sXAuJ&O49UFwyHW^3c;nBW^vu!->1mMf^9j8P1JrJ%c@<~YmJ z2j>BKI(hTR*fyj4)K5yCN)dqV=)DQ3A-I%p^b$(fdGqa&oCA617=V17yuj#QoMZ89 zF`z$EG-%A|_TbpHhjLW*08n`O1PxGjN>g(|vnbv>I!21&g|mI|co-bspwOk1rNqF= z-r3x-@ON5RL`<{3yE|NE(j^!KX*Mu|aqraYT%EX%x9m-t5tElz!I)WGp7j$W&uwl_ zbtZisH-G5y-L+l5H|~DWWWmX{yNlw6usSr-_9*l|_hP&>9fV&1*=IsricEv<-!x!) z{|OZbgp6M@S=&L*OB4bdUV_bF=z{|C(N1e~-_P|h=WApG*%#wxYHj@tfZfu|>kW^J zdu4gaV_@)oR--v=C^kzmM?D0Z`wGa3hK7jWUKpzEm%LxT+;cq{UNjl3p&Tv6R6Ec& zw(gutr5viV#dxNY*OR7Vt(U7k9q7N?ZC3L9IS;|;VSd-^QtNTwW&^#s*aCJOlX~!` zby?f~p_r*2l4tDsuGwT}cv1Vs%ZqjrXJ_Y=+b;2BF^mi9nv7xm6On`gIE$;y#=7i} zq(~V4O{Ps}+{F1H9tZ|hi*Aozj zVn0iitZ;nHUesvDjgtJ+jE8)8HryO_c9uW5EIFnES}CW4gFjE%;-udP`oow&1sEj< z-3Wq<8Rh1I;0D_`Nb7(A^ev6T_HgU!SKxwN-5di9J<1W#@AR;n_VMq+WaTWw^AV1@ zIRhAPmn05@@B+VHHi_>YJUR+44+it1wDoJiCIUQI{n6zFTSF~1B;@3Z)U8+^dn2zJfeZIzU8vCGi0X?VYosyDNP;hl{fJx6W<~ zL&kTVoUjAqb7Z6l-18&l9pSt|!sFr>sUM`Kp(zVx!E$2!D8V2%Ox;&4DbWcN9tIg{PH@CH|5VbCup42>MjqG6lCbwGcDVJGm@ilYr&Z1bwAsR7MlYvTQ@=u%hL3Xr2k zsTPfa2}Jh2mgaJIm#$QOEbCQ-Of2ds1=gp>br^PsRo5e=^*4gK?&V1EXE+=s>p@0C+ zUV8o1^z>hT_WwjNpcUtyJoOLk&2oMW=4IlUis6xw64fWSC5hc(r&{T^)>ZrQnzn0F zxmMuulpt-Sq%5(Zk?T40Yl!8N}T( zScrWk+4j5loWL=~Oepz=W}-!Nb6aE9H(XiS(BtW{`cK^!h3_k$0Ckdzh9=PM_9MHR z_l4v}MZ-HK0yJ14g0JG%AtXZE94hVKag6$@^y*bb^Po-#V^41R4k;l2q48%s*Hx!? zy4_aPX?xIS>ZMb1uV}dKNJXcNku6@DHp&}w9tX!eV64oswsE$QI7K_GPWLzXQ6z9# zp~0uK$lUf?bVG!Q!$WQBkS`$Xep-oDXH*mi({2!wg;A^V{X)0AyuwKdJXQ`>ukjS>$z>a_sdSs7F7@7~^4 zGY#2}r{905V=ezT$AB7GOVRb<#5Lki4_=S>)|Qc&-OuQ!za_?YW6;`$pY@AI!C-|G zzkdSVL(PyXX=w{Svl8s0=1*#d)HJ;5eV(w`eVy08I;TKZ(f0u0Lnx-(oJvLG!D43; z0$}4{6b3bc34D4Wfxh`}+18(x5lIho2tf*QI`mCt3J8jIcyw!`=(p=XzlB%Jde~9c z%l#aZzTjbtCS>|Ir7pMKrrSRib1>%w{}w?IiZ%qfri+`~H-${e!~;0gy6%`X2fP|Yn#ClPjPN%WAm8&f(JCNu;0m7I+3&% zf~LKzN|XVhqyRK$w;paOT&u6JKRO*u{i0(CuMT-tK)3Fcx~7GxApO6h5i>bNBT+cp zbjUs(`^(u?mP|;OiK(~eT3)gG+7$mgRr)taOm`Y_;v^C<-=loCOhAvgQuNS*q-0F8 z_S9lr80$cv{Q=4<1_M*TuiJ!*kFof#AKOh!)v{>t*4yoHCqu)&cW*}RpjUx5!&Un) zi~;rbkS*a4L5IK*09W_iwy$`fT_hmdY2FAnSa3osz3I>A-LqdagdqR=IKElR^zxR= z381=Ifsr+<_xD?|HfSP4Lqo)O%H`PJPBBUWn`sHz~HSWw)xv@Z+SE~`lT9QS>+Q}nr;n$TrFgnmSmBs=~7UF71(6W{aX0132PnBF7 zVSaE>&};9ycCvQW_CV#_!o2NH<1-Hr`YWFk6B}11Ri5ciu|c+Avp&KReO^`EX!r8p zD@=5HX+=xu*^TY5K>H-}$@s7pSQ_SojJG`zX+}3yQ`*V-knl=Wm>CyGjQZPaI$LMQ z7YJ71Mtn-DW@<@*nwxgqbx(Q?CwR)x(&~MZiUNkpd&v0cL|ikJb9l5W59caf?OQ4t z{_{Is8u>CbWzOs+TnXMj;XcNUJ9y-zBPWXJeajkK9`~g#M}vE;Jp5fz7XLnv$Hz&St*zmagnG1cPRiU$RO|dW)4v``?-vj_7`WZ| zx3_O7W=zRg{USA<{5UruNzP0Yc=TR__GyMocDp{+l6_D`{QD5UM;csA@U3%8`}5Ot(W{{Q?1LiX|^Mn=@O1-3ARpQd7@>tyevXoHr>KQ>&p z$Uc~d{5CNB^>rL<j|C+ZMO<8+U;g)JK3pO0`0*{ zliGXd25dZktPX3z+BPcoK~)v-Lcza=S~gzMpz@Dt|4)1sef?wo^%1=o-se2`?&AOH zTkb`Fz-J&)aPGaEQ}$8I8$=9iBh^G`V1E;=k1RAlw4(U-?YZ6BgE#4NNYK%kCAo87 za9WPu!y^<2KVXnQpzP$cwQ7^QwrrjT_}?vdWWd0@m9H+IqrBVUJvqPCorVI}*!EJZ zms+T;JdgUJUF}B9WA{E^D&`|&7PvpN)gJj$B17*w9D9<&w;%mzW?sC<4v z6hlGD?S8>mWaJ$JG+V<8=qlJRwo}f{h;mwtp=L{S22k()x!c)u^_+v`Q*Xh+{py;) z^78V0yMB7OS|)wv+n!}~!Iepu7Z(?d>Q%A!gir50BJBtWAzJQAZSdUOeCe{fUWU3Q zNtZRJF{Sops}=0HW}48_t*a#S_#3&*wy``}xheOxSwC!Y_u~K5hc1b|j?MWIFb4aV@xyQvhJAW2!3(UNaD7cLW6P( z8o-Tr)}1F&2%^dZ6jz?P=B%)f6Iy!WS^b58J@7fx#nWxZ75to(WNGTWw$x3rdZLuu zrXR-N^r=%2OSfaJVsE8CcuK4CI`)V($t4evRNnto`nh#x-#Na!jRC6u7^tlS(n=PN z?#FApo!oXuEH@WAA=SS(gfji@6w4bddfR}BCUCSREEY!EUYes(;j&EuGXS&chOJ8z zIYcq_4VyexWvc_#yfDQck~GxN9)*T>|IaItmx@VA{Vw-UJeqEut@gcbIJvD^>lFf+ z((c+zv_~8kB8##~EOF9sNebZ>Lj3{dtE`?AjpBFs_)t5n_gt&i?!4)T)mtG&sO`PZ z(G*IAEbbJTtuRix_8a;N&=B2fo@-v(KXG5VoJ>_-A7NDc71;t)?Fddo+p^tScm^%T zs^TIe6SB360umF6Pxd#FU&y=-rhL$e`R%?B?Ss7#2uaeNJCilbZKj#`3(5sTypQK= ztC9*eI}!WSUQLMS<8B9yV*2)-o}k11A>OH-$YXn!Jor!d7&a9)2+yQyaNM2)1E#5l z8+g$5oF7lpb6oF1XdakzCbSyXhQ-(N;6N=OT+|W(SjKvJx=A*?yQb~1I&hwA3Fm>< ziX!9Ssv2(E4~>miORdJSe|NoYK*@gLjX^sN+Xvc)$t3I_hKp(zcII279m%Xm?h6VE z8hP&HqXApZVyO6roSd9M5?|aaGH*?@6oFV4biZy1z(@vJ!YGY6NTp~(7qQfy=H{Y- z_Gdm9-Ey+V6J1qStGW=ob+3XnXaik|uCkr|bPcJ!D&`85y(cL6XgC6i_fvbmuZIdV^msp1_fhqxs;M zsHkhdM>x!f3N491amx6N7^Pa^83&7FBeP5?$T z7!SA&0n>J){#s3fAkf~77U=F{i+v()?$D|PF4N3h<{J+|Z*)lnYb|44<)+>eS@(GqJo2VS@F&f&M z7SXEt1iiDCzD&(qH}#k01ksNXST!lNK7fY01G~cn$nH4Yiu(m%F|ZkR%y~#$e;f03 zd;Jim(lbAPs!Kv#1pwLa%`BB&m);*BTk2Lgn65sYWLCKHoe?R2FRl4+`kNm%@KNe1 zDO9TrZa^;`c#um=e^DeC+ZC$t?(Q{g9HXtzf-^8Khbom@D!rJNHvFhJ2R`pMcl3{_wT~;;kEHG?G>zCWW5bx@_4^& z^10)}t<>phi?QM$*sTamV?e?8IaQe3<%k7-sl`ZDg@o!5sM<>{M#Wr2t{QhF>GxaL zc3+f+9baCYZo0U+s%e`O-+3WnVv_m91|E8pgt-#X-wFm)NZCZ)mAz%?3S>Fq?x^#? z?nEXX`$BiJCVF<9_`XQ+sH7{SX7PtQVa(a3IRiQ+)(qW&y>WJ!NJl++AS=?aBIVm| z!~=w2`@IJkFx-seFZ41nlq6>Wkceb%)ycs3LStoRRjsumK@kYlYoCL*N*AsZ$h_{3 z-s?b(20*<0^Q*+1X*we~_$F-4hVk9R5SwXa6CW?ED52HY*Jod`_vy-ijW)*5w{d*L z>%0tl7YyK}6jUiwu`n(jf-46afEbZb#00&iFq^wzIDZcD1iTht~u@_HvksEz{H#t?%HFhKZ@&3==ek2@gN`q8()%<7$XZs2@AoTf3yUj~l5#8yJn2@CYiD9~80%Q(Qew6ixn0r=W}CM6 z*M?tsx#mL#wcxQEV(1D!4yecEy=Ilf5JKv##*G6M3XNJ}7`kVz%x@~}3>P}$-k9-X zi6a#zdt2@Jg`4%U4h5bXJ~JMOX-n93jH~@W{mQdSFco}jxVO|T4VzqjL%nK^#Y24h zqx`S2!v^3Us$W;{uUX>}2Lu!x;8~%|(s7B=m30&4!j>)x6OlVE7y~TL}if7eAhfIWn4=m3e zniRCpcH+OGjefLoy6IYF`li%sxPI6-u0-jlGD7>@4Q`>?OrF-_@Jqj=rP(k@5#GWu z{tK_=01)Wp^FEJ-zWi1Sl2pG(oGi-p77>S4+ZTis3iYGm>$?Q9*I6B}I1mR$KUK5q zM9L?Ebl(0M)qCs3_B43N_;^k3^k=E0OQp+#^d5q$T7lh@kVjk#Vf|S_p`mcwIi(W> zlCbgVS?rr`wU+joae&T$elL!#Esj3{CPP5s5u%QuXT{jEssU&c{7p?9TVS6?S;qQi zSYF;He~hWgaN!e4e_zp?gkQ1-cY9iyi%holMvARuJUprpS`7iWx3d(3bX0O1#mpPF zrYVmM|6u=eSP=oIbJV&xNaRLspa`kxDbVZTo>}E#$Q+aN9R?!oo@$F!^XXNW*dmq0k&Z zDr8D%Y^U5~~4!lU&79h!zY13{lYd{rwlg3va-u+jpQTgkQE zDMD>sXB!sybkW<&^inlsx&3Cg_Vx|HObAWl>CV#;tT{c<0Bb$8zioekMu`K(E3hqn zcb1aZZPGY6Na)kor|5u#gZ7-@j0?mYnY};ml9F0E;!Qb$@>ndr7p9YLJ4M+^JO3Ij zQ8s~{1};Vtkc@mGDzoa%Nx;rxP1sl72@)yrRey1DdweDm5mH@UJ#XX>bz%CFN6_;@ z1BEwC3B4HZxa7Td^(vap#aM-2Ov-axUoeR2tro}q0qhqPrj1~%JbP{tIpVkq2a{~o z0^hZ4#*?dK%&v zZky+afG_wCsadoWh_qp%JJFW8x)DT$O%1&f)0AR1pm#di+t4ytcZ7ep4tC+ z@}QQ#ZU6AFEK-4X56*R{9zgXG1*mi}P`C*T+SnVe=_3~x#nz((J>otroy`b9K2fA>($Ky8B8Q~>Cd7AsCvq3X9lKt{da)Vf z)Lw35F^Bv!<(};u{w7^ktwk8kV!S4aX0*7%TyUcgL?z%aaB1hc6-4GGp{<=f501T0 z-=xdT3c|T#K_-DQkC%t1XFoHYu_&-JnY;DdpJ33gKOmEd7lC5~`jPFj0-QK-UVo2v zhS5N%^7ZAY;QGKCW;2_Ukd0yG-2;If-$lx$>d8?nb8T0l=uLpOTAJ=Y&O-=okdhXg zj>iL;<391`Lr9%cQX2xEna+rmUcL5g;Sb^V!H!<9<*Wl2kdOHKOBjf_EFNb*{;onF zh1$pO5a+ikK4lEK(pBT>j>7*GHJ!X6H{6~)oM@Qn2yMQGZt^Ns3Felr-?%|urQ1X| z*U6p-qBio>W41<=WhLnKE7B9yt}g#%jKMl_>S{Cncsa04pwh|$j*CTNiFa7uhACQ9Ew@BS zqs(ePhid{&ciQ)w1vWMcLk&Y!?W}AUFCl$<6@IQmd&I3-Vdp=Pqdq?9)NjUtM=eVQ z15Jj4mzov{`r=_dxt_de(8f335Ap%h-t5|1n|-H%`Ehk2a2;?+1=_Gc&-@@hOOd`N zo+H=~3ug=Ra#7MXY*dz*C8trny^v4^|Gv1`EO(ypA}T-K_Yl-qiMFK+R?+s}O|JRR z-V72*MyPOPyiUC`T54H@9am;OYJ|V%>f-VmVh*eby?(3Cjd2)60|7P-x(P@*p??EW ziQrWJ9QLej#lc*Q;nENkF$Ug4w3-pvT)^5>*ofU807Nz5gBjnU{a)@(ukbo|D?k>5 zN;XU2il|Ud>$M`j@v*U;L;2UfR3^R9jc5it2ZlE$II3ns7-LngC=Fj#b=Ah{^9_fs z-{@JhU>gjU?IGXZrUh8szy`M(0yK+}t;J7rkPrmyuY%Vc9qeO|O?DUbPH&<#ZZMP0 zu>H>W3D^%|bk=TNF(1g$uRA-o7%%)|XAgE=cX6GarACX3i}j4zuPDFc*3BeYchY!$ zYkNylsF}*I9X}mOlMV61YG~bu3aP8gMvD~J{*A-vSTKsCFv9+q*`tQYJSkOI~te>scX%PSP0->O0wemZq=&96CJkQfl z8^68I0c)WT<9CO}lc4f`=Fxb)=@Y4pnVDJ8I*1lu!LA+0>G-pMRi`cS)vOO1%;^Wf z$fxB3OpE78HC>Fw>zzctq%o~bKVDhSr zP{WpiDKkDkz6@A)7%*;g9&o$rxQPhP?@g?fRo^{hWvKVusuAp>wvzF28ei~eWLbbi z4a}MACOz*VPejeCWA1Ir$;#p|cpdvg7J|utNbHyFjsxwxPQh~#2Z!P(?3b`MmjTm- zluM=pU4}fR*j5J|vVd6xZ@;OtHTs#w-#he2M_Z`v+j>(QHfn&Y{pgp;E2LjnuN=P^ zosg5E#^ZHf1K)E@@N(%~sXoX%ao90{lQ8;&^O;~5S2tG2miuU}55~hxd((H1X2W(@ z81hs->%V8C&|79^Kl=+N;32BM#s%hKnjg;uuDY0>x%^bh>sXRclN>uJ>f{rCdv?AL zSq~0QY2v28CsQkGl^m)xJyFR+E|9kR;rFa=UK-QEp2cTTdfUOod?@Xp`WheSMSDF~aCUw;LCMGW&&KNOf3w1F9y>ztB6fYW zw400NvuTQ_k!ht%_cw}p{KtaX#N1~0LCN^TZoUPDZxQJ5Ud;ZpH!69E27P0gd$oP~ zJcg2jVre{!@X~XWA5}(z$t~3)quXRMi6$HYCu5q$hg-VUKq%WeA+qj*k|b;n@|pe6 zt5a_}eW@em-?MT38+KUPR$?_76ee!DZE$y_2zGA!Vp#}Xa3>@uhw9fA+_z&KQhBQb zxsKK^hqvuy-uEkp_HY#T!KwS<*Gq7BI1=|fvLVI@Q zYy=Ik#Ajf@F?!QmtKwdiq)b>cKlHc+pnaOAl%?$A?ylim!K<{htAG3vA0pmX{cfj* z)xD_wBl621b&#BLd!9IiuTNfd)kBS_!1>Y(=8GaPFI2WNzkE3ekB=6EF{4(+WJETk zdH~_Y`mEC_$iovKMk8nR+XtOdqx2R;Dqic_b|{u)C?K#0^Ry^oh8$|RLk0Za)i6lr z=CB!RjgX|Grb3x)1Ik#ow#L&G(t6M>tc{d_;s{IN^vphVGOmOPnfsCvmYS z36nM+OxDs Date: Thu, 9 Jul 2026 09:02:16 +0300 Subject: [PATCH 5/5] feat(lab9): falco custom rules + conftest hardening policies --- labs/lab9/falco/rules/custom-rules.yaml | 30 +++ labs/lab9/policies/extra/hardening.rego | 42 ++++ submissions/lab9.md | 265 ++++++++++++++++++++++++ 3 files changed, 337 insertions(+) create mode 100644 labs/lab9/falco/rules/custom-rules.yaml create mode 100644 labs/lab9/policies/extra/hardening.rego create mode 100644 submissions/lab9.md diff --git a/labs/lab9/falco/rules/custom-rules.yaml b/labs/lab9/falco/rules/custom-rules.yaml new file mode 100644 index 000000000..26e1f0229 --- /dev/null +++ b/labs/lab9/falco/rules/custom-rules.yaml @@ -0,0 +1,30 @@ +- rule: Write to /tmp by container + desc: Detects any write to /tmp inside a container — common indicator of dropper activity or staging + condition: > + open_write + and container + and fd.directory = /tmp + output: > + Write to /tmp detected in container + (user=%user.name container=%container.name image=%container.image.repository + file=%fd.name cmd=%proc.cmdline) + priority: WARNING + tags: [container, drift] + +- rule: Possible Cryptominer Activity + desc: > + Detects a container connecting to well-known cryptomining pool ports or running + a known miner binary — maps to the Tesla 2018 K8s dashboard incident (Lecture 1) + condition: > + container + and ( + (evt.type = connect and fd.rport in (3333, 4444, 5555, 7777, 14444, 19999, 45700)) + or + (proc.name in (xmrig, ethminer, cgminer, t-rex, claymore, nbminer)) + ) + output: > + Possible cryptominer activity in container + (container=%container.name image=%container.image.repository + proc=%proc.name conn=%fd.name cmd=%proc.cmdline) + priority: CRITICAL + tags: [container, mitre_execution, mitre_command_and_control] diff --git a/labs/lab9/policies/extra/hardening.rego b/labs/lab9/policies/extra/hardening.rego new file mode 100644 index 000000000..5dea8de5d --- /dev/null +++ b/labs/lab9/policies/extra/hardening.rego @@ -0,0 +1,42 @@ +package main + +# 1. Pod or container must set runAsNonRoot: true +deny contains msg if { + input.kind == "Deployment" + c := input.spec.template.spec.containers[_] + not c.securityContext.runAsNonRoot == true + not input.spec.template.spec.securityContext.runAsNonRoot == true + msg := sprintf("Deployment '%s': container '%s' must set runAsNonRoot: true", [input.metadata.name, c.name]) +} + +# 2. allowPrivilegeEscalation must be explicitly false on every container +deny contains msg if { + input.kind == "Deployment" + c := input.spec.template.spec.containers[_] + not c.securityContext.allowPrivilegeEscalation == false + msg := sprintf("Deployment '%s': container '%s' must set allowPrivilegeEscalation: false", [input.metadata.name, c.name]) +} + +# 3. capabilities.drop must include ALL on every container +deny contains msg if { + input.kind == "Deployment" + c := input.spec.template.spec.containers[_] + not "ALL" in c.securityContext.capabilities.drop + msg := sprintf("Deployment '%s': container '%s' must drop ALL capabilities", [input.metadata.name, c.name]) +} + +# 4. Memory limits must be set (OOM kill bound) +deny contains msg if { + input.kind == "Deployment" + c := input.spec.template.spec.containers[_] + not c.resources.limits.memory + msg := sprintf("Deployment '%s': container '%s' must set resources.limits.memory", [input.metadata.name, c.name]) +} + +# 5. Image must not use :latest tag +deny contains msg if { + input.kind == "Deployment" + c := input.spec.template.spec.containers[_] + endswith(c.image, ":latest") + msg := sprintf("Deployment '%s': container '%s' uses disallowed :latest tag — pin to a digest or explicit version", [input.metadata.name, c.name]) +} diff --git a/submissions/lab9.md b/submissions/lab9.md new file mode 100644 index 000000000..de8fb93de --- /dev/null +++ b/submissions/lab9.md @@ -0,0 +1,265 @@ +# Lab 9 — Submission + +## Task 1: Runtime Detection with Falco + +**Environment:** Falco 0.43.1, modern eBPF, kernel 7.0.12+kali-amd64 +**Target container:** `alpine:3.20` named `lab9-target` + +### Baseline alert A — Terminal shell in container + +```json +{ + "hostname": "8e925df0b9ce", + "output": "2026-07-09T05:57:50.101174653+0000: Notice A shell was spawned in a container with an attached terminal | evt_type=execve user=root user_uid=0 user_loginuid=-1 process=sh proc_exepath=/bin/busybox parent=systemd command=sh -c echo \"shell-in-container test\" terminal=34816 exe_flags=EXE_WRITABLE|EXE_LOWER_LAYER container_id=acf977765e42 container_name=lab9-target container_image_repository=alpine container_image_tag=3.20 k8s_pod_name= k8s_ns_name=", + "output_fields": { + "container.id": "acf977765e42", + "container.image.repository": "alpine", + "container.image.tag": "3.20", + "container.name": "lab9-target", + "evt.type": "execve", + "proc.cmdline": "sh -c echo \"shell-in-container test\"", + "user.name": "root" + }, + "priority": "Notice", + "rule": "Terminal shell in container", + "source": "syscall", + "tags": ["container", "shell", "mitre_execution"] +} +``` + +**Trigger command:** `docker exec -t lab9-target /bin/sh -c 'echo "shell-in-container test"'` +The `-t` flag allocates a pseudo-TTY, which sets `proc.tty != 0` — the key field in Falco's "Terminal shell in container" condition. Without `-t`, the rule does not fire. + +--- + +### Baseline alert B — Read sensitive file untrusted + +```json +{ + "hostname": "8e925df0b9ce", + "output": "2026-07-09T05:58:37.183217419+0000: Warning Sensitive file opened for reading by non-trusted program | file=/etc/shadow gparent=containerd-shim ggparent=systemd evt_type=open user=root user_uid=0 process=cat proc_exepath=/bin/busybox parent=sh command=cat /etc/shadow terminal=0 container_id=acf977765e42 container_name=lab9-target container_image_repository=alpine container_image_tag=3.20", + "output_fields": { + "container.id": "acf977765e42", + "container.name": "lab9-target", + "evt.type": "open", + "fd.name": "/etc/shadow", + "proc.cmdline": "cat /etc/shadow", + "user.name": "root" + }, + "priority": "Warning", + "rule": "Read sensitive file untrusted", + "source": "syscall", + "tags": ["filesystem", "mitre_credential_access"] +} +``` + +**Trigger command:** `docker exec lab9-target /bin/sh -c 'cat /etc/shadow'` + +--- + +### Custom rule (labs/lab9/falco/rules/custom-rules.yaml) + +```yaml +- rule: Write to /tmp by container + desc: Detects any write to /tmp inside a container — common indicator of dropper activity or staging + condition: > + open_write + and container + and fd.directory = /tmp + output: > + Write to /tmp detected in container + (user=%user.name container=%container.name image=%container.image.repository + file=%fd.name cmd=%proc.cmdline) + priority: WARNING + tags: [container, drift] + +- rule: Possible Cryptominer Activity + desc: > + Detects a container connecting to well-known cryptomining pool ports or running + a known miner binary — maps to the Tesla 2018 K8s dashboard incident (Lecture 1) + condition: > + container + and ( + (evt.type = connect and fd.rport in (3333, 4444, 5555, 7777, 14444, 19999, 45700)) + or + (proc.name in (xmrig, ethminer, cgminer, t-rex, claymore, nbminer)) + ) + output: > + Possible cryptominer activity in container + (container=%container.name image=%container.image.repository + proc=%proc.name conn=%fd.name cmd=%proc.cmdline) + priority: CRITICAL + tags: [container, mitre_execution, mitre_command_and_control] +``` + +--- + +### Custom rule fired — "Write to /tmp by container" + +```json +{ + "hostname": "8e925df0b9ce", + "output": "2026-07-09T05:57:02.768832199+0000: Warning Write to /tmp detected in container (user=root container=lab9-target image=alpine file=/tmp/my-write.txt cmd=sh -c echo \"test\" > /tmp/my-write.txt)", + "output_fields": { + "container.name": "lab9-target", + "container.image.repository": "alpine", + "fd.name": "/tmp/my-write.txt", + "proc.cmdline": "sh -c echo \"test\" > /tmp/my-write.txt", + "user.name": "root" + }, + "priority": "Warning", + "rule": "Write to /tmp by container", + "source": "syscall", + "tags": ["container", "drift"] +} +``` + +**Trigger command:** `docker exec lab9-target /bin/sh -c 'echo "test" > /tmp/my-write.txt'` + +--- + +### Tuning consideration (Lecture 9 slide 8) + +The "write to /tmp" rule generates significant noise in production: logging frameworks (`logback`, `log4j`), Node.js, and many runtimes write temp files to `/tmp` legitimately. The preferred tuning approach is the `exceptions:` block over inline `and not proc.name=...` conditions because exceptions are composable — multiple exception entries can be added without rewriting the condition, and they appear in structured form that linting tools can validate. For example: + +```yaml +exceptions: + - name: trusted_loggers + fields: [proc.name] + comps: [in] + values: [["node", "python3", "java"]] +``` + +This is preferable to `condition: ... and not proc.name in (node, python3, java)` because the condition stays clean and each exception entry is independently auditable (Lecture 9 slide 8: "exceptions are first-class citizens in Falco rule governance"). + +--- + +## Task 2: Conftest Policy-as-Code + +### My policy file (labs/lab9/policies/extra/hardening.rego) + +```rego +package main + +# 1. Pod or container must set runAsNonRoot: true +deny contains msg if { + input.kind == "Deployment" + c := input.spec.template.spec.containers[_] + not c.securityContext.runAsNonRoot == true + not input.spec.template.spec.securityContext.runAsNonRoot == true + msg := sprintf("Deployment '%s': container '%s' must set runAsNonRoot: true", [input.metadata.name, c.name]) +} + +# 2. allowPrivilegeEscalation must be explicitly false on every container +deny contains msg if { + input.kind == "Deployment" + c := input.spec.template.spec.containers[_] + not c.securityContext.allowPrivilegeEscalation == false + msg := sprintf("Deployment '%s': container '%s' must set allowPrivilegeEscalation: false", [input.metadata.name, c.name]) +} + +# 3. capabilities.drop must include ALL on every container +deny contains msg if { + input.kind == "Deployment" + c := input.spec.template.spec.containers[_] + not "ALL" in c.securityContext.capabilities.drop + msg := sprintf("Deployment '%s': container '%s' must drop ALL capabilities", [input.metadata.name, c.name]) +} + +# 4. Memory limits must be set (OOM kill bound) +deny contains msg if { + input.kind == "Deployment" + c := input.spec.template.spec.containers[_] + not c.resources.limits.memory + msg := sprintf("Deployment '%s': container '%s' must set resources.limits.memory", [input.metadata.name, c.name]) +} + +# 5. Image must not use :latest tag +deny contains msg if { + input.kind == "Deployment" + c := input.spec.template.spec.containers[_] + endswith(c.image, ":latest") + msg := sprintf("Deployment '%s': container '%s' uses disallowed :latest tag — pin to a digest or explicit version", [input.metadata.name, c.name]) +} +``` + +### Good manifest passes + +``` +$ conftest test labs/lab9/manifests/k8s/juice-hardened.yaml --policy labs/lab9/policies/extra/ + +10 tests, 10 passed, 0 warnings, 0 failures, 0 exceptions +``` + +### Bad manifest fails (unhardened — no securityContext, :latest tag, no resources) + +``` +$ conftest test labs/lab9/manifests/k8s/juice-unhardened.yaml --policy labs/lab9/policies/extra/ + +FAIL - juice-unhardened.yaml - main - Deployment 'juice-unhardened': container 'juice' must set allowPrivilegeEscalation: false +FAIL - juice-unhardened.yaml - main - Deployment 'juice-unhardened': container 'juice' must set resources.limits.memory +FAIL - juice-unhardened.yaml - main - Deployment 'juice-unhardened': container 'juice' must set runAsNonRoot: true +FAIL - juice-unhardened.yaml - main - Deployment 'juice-unhardened': container 'juice' uses disallowed :latest tag — pin to a digest or explicit version + +10 tests, 6 passed, 0 warnings, 4 failures, 0 exceptions +``` + +### Why CI-time vs admission-time (Lecture 9 slide 9) + +CI-time Conftest runs during PR review — it catches misconfigurations before code is merged and before any cluster is involved, giving the developer immediate feedback in the same loop where they can fix it at zero cost. Admission-time gating (Kyverno, OPA Gatekeeper) runs at `kubectl apply` time and acts as the last line of defense — it blocks deployments that somehow bypassed CI (direct `kubectl` from a developer laptop, a CI pipeline that skipped the policy step, or a manifest created by an operator without repo access). Running both creates defense-in-depth: CI-time prevents the problem from ever reaching the cluster in the normal flow; admission-time enforces the same policy unconditionally regardless of how the manifest was submitted. + +--- + +## Bonus: Cryptominer Detection Rule + +### Rule + +```yaml +- rule: Possible Cryptominer Activity + desc: > + Detects a container connecting to well-known cryptomining pool ports or running + a known miner binary — maps to the Tesla 2018 K8s dashboard incident (Lecture 1) + condition: > + container + and ( + (evt.type = connect and fd.rport in (3333, 4444, 5555, 7777, 14444, 19999, 45700)) + or + (proc.name in (xmrig, ethminer, cgminer, t-rex, claymore, nbminer)) + ) + output: > + Possible cryptominer activity in container + (container=%container.name image=%container.image.repository + proc=%proc.name conn=%fd.name cmd=%proc.cmdline) + priority: CRITICAL + tags: [container, mitre_execution, mitre_command_and_control] +``` + +### Triggered alert + +```json +{ + "hostname": "8e925df0b9ce", + "output": "2026-07-09T06:00:44.325149895+0000: Critical Possible cryptominer activity in container (container=lab9-target image=alpine proc=nc conn=172.17.0.2:39281->8.8.8.8:3333 cmd=nc -w 3 8.8.8.8 3333)", + "output_fields": { + "container.name": "lab9-target", + "container.image.repository": "alpine", + "fd.name": "172.17.0.2:39281->8.8.8.8:3333", + "proc.cmdline": "nc -w 3 8.8.8.8 3333", + "proc.name": "nc" + }, + "priority": "Critical", + "rule": "Possible Cryptominer Activity", + "source": "syscall", + "tags": ["container", "mitre_execution", "mitre_command_and_control"] +} +``` + +**Trigger command:** `docker exec lab9-target sh -c 'timeout 3 nc -w 3 8.8.8.8 3333 2>/dev/null || true'` + +### Reflection + +**Indicators used:** (1) outbound TCP connect to known mining-pool ports (`fd.rport in (3333, 4444, ...)`) + (2) process name matches known miner binaries (`proc.name in (xmrig, ethminer, ...)`). Port-based detection catches any process connecting to a mining pool, while process-name detection catches miners even on non-standard ports. Together they cover the two most common deployment patterns: downloaded miner binary and miner-as-a-service calling home. + +**What this misses (false-negative case):** A sophisticated attacker exfiltrates mining traffic over HTTPS port 443 (which is indistinguishable from legitimate outbound HTTPS), uses a custom-compiled miner binary with a renamed process (so `proc.name` doesn't match any known list), or pools mining traffic through a CDN domain. Port-based and process-name-based rules are defeated by any mining setup designed to blend in with normal web traffic — this is the "living off the land" evasion (Lecture 9 slide 8's noise/signal discussion). + +**SLA matrix integration:** Per Lecture 9's SLA matrix, a CRITICAL Falco alert maps to a 1-hour response SLA. In practice, this rule should auto-page the on-call team and simultaneously trigger a `kubectl cordon` + pod eviction to stop the resource drain while investigation proceeds — the financial impact of a cryptominer is direct (CPU/GPU billing) and measurable, which makes it one of the few runtime alerts where automated remediation (not just notification) is defensible.